From d11d904c81a202c7bfb5b18f4ee248eb2fc9174f Mon Sep 17 00:00:00 2001
From: Corey Minyard <corey@minyard.net>
Date: Fri, 4 Apr 2025 10:47:07 -0500
Subject: [PATCH 0001/2760] hw/ipmi: Move vmsd registration to device class
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

It's the right way to do it now, and it handles multiple instances
properly.  I need multiple instances for some testing I'm doing so this
is the right thing to do.

Tested by doing:

   (qemu) migrate -d exec:cat>filen.mig

before and after the fix, then:

   scripts/analyze-migration.py -d desc -f file1.mig >file1.json
   scripts/analyze-migration.py -d desc -f file2.mig >file2.json
   diff file1.json file2.json

with no differences.

Signed-off-by: Corey Minyard <corey@minyard.net>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
---
 hw/ipmi/ipmi_bmc_extern.c |  3 +--
 hw/ipmi/ipmi_bmc_sim.c    |  3 +--
 hw/ipmi/isa_ipmi_bt.c     |  3 +--
 hw/ipmi/isa_ipmi_kcs.c    | 12 +++++-------
 4 files changed, 8 insertions(+), 13 deletions(-)

diff --git a/hw/ipmi/ipmi_bmc_extern.c b/hw/ipmi/ipmi_bmc_extern.c
index d015500254..3e9f8c5a50 100644
--- a/hw/ipmi/ipmi_bmc_extern.c
+++ b/hw/ipmi/ipmi_bmc_extern.c
@@ -497,8 +497,6 @@ static void ipmi_bmc_extern_realize(DeviceState *dev, Error **errp)
 
     qemu_chr_fe_set_handlers(&ibe->chr, can_receive, receive,
                              chr_event, NULL, ibe, NULL, true);
-
-    vmstate_register(NULL, 0, &vmstate_ipmi_bmc_extern, ibe);
 }
 
 static void ipmi_bmc_extern_init(Object *obj)
@@ -528,6 +526,7 @@ static void ipmi_bmc_extern_class_init(ObjectClass *oc, void *data)
     bk->handle_reset = ipmi_bmc_extern_handle_reset;
     dc->hotpluggable = false;
     dc->realize = ipmi_bmc_extern_realize;
+    dc->vmsd = &vmstate_ipmi_bmc_extern;
     device_class_set_props(dc, ipmi_bmc_extern_properties);
 }
 
diff --git a/hw/ipmi/ipmi_bmc_sim.c b/hw/ipmi/ipmi_bmc_sim.c
index 6157ac7120..bc0ddc52a9 100644
--- a/hw/ipmi/ipmi_bmc_sim.c
+++ b/hw/ipmi/ipmi_bmc_sim.c
@@ -2187,8 +2187,6 @@ static void ipmi_sim_realize(DeviceState *dev, Error **errp)
     register_cmds(ibs);
 
     ibs->timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, ipmi_timeout, ibs);
-
-    vmstate_register(NULL, 0, &vmstate_ipmi_sim, ibs);
 }
 
 static const Property ipmi_sim_properties[] = {
@@ -2212,6 +2210,7 @@ static void ipmi_sim_class_init(ObjectClass *oc, void *data)
 
     dc->hotpluggable = false;
     dc->realize = ipmi_sim_realize;
+    dc->vmsd = &vmstate_ipmi_sim;
     device_class_set_props(dc, ipmi_sim_properties);
     bk->handle_command = ipmi_sim_handle_command;
 }
diff --git a/hw/ipmi/isa_ipmi_bt.c b/hw/ipmi/isa_ipmi_bt.c
index a1b66d5ee8..474a792c9a 100644
--- a/hw/ipmi/isa_ipmi_bt.c
+++ b/hw/ipmi/isa_ipmi_bt.c
@@ -117,8 +117,6 @@ static void isa_ipmi_bt_realize(DeviceState *dev, Error **errp)
     qdev_set_legacy_instance_id(dev, iib->bt.io_base, iib->bt.io_length);
 
     isa_register_ioport(isadev, &iib->bt.io, iib->bt.io_base);
-
-    vmstate_register(NULL, 0, &vmstate_ISAIPMIBTDevice, dev);
 }
 
 static void isa_ipmi_bt_init(Object *obj)
@@ -147,6 +145,7 @@ static void isa_ipmi_bt_class_init(ObjectClass *oc, void *data)
     AcpiDevAmlIfClass *adevc = ACPI_DEV_AML_IF_CLASS(oc);
 
     dc->realize = isa_ipmi_bt_realize;
+    dc->vmsd = &vmstate_ISAIPMIBTDevice;
     device_class_set_props(dc, ipmi_isa_properties);
 
     iic->get_backend_data = isa_ipmi_bt_get_backend_data;
diff --git a/hw/ipmi/isa_ipmi_kcs.c b/hw/ipmi/isa_ipmi_kcs.c
index d9ebdd5371..94bbe45d35 100644
--- a/hw/ipmi/isa_ipmi_kcs.c
+++ b/hw/ipmi/isa_ipmi_kcs.c
@@ -72,6 +72,10 @@ static bool vmstate_kcs_before_version2(void *opaque, int version)
     return version <= 1;
 }
 
+/*
+ * Version 1 had an incorrect name, it clashed with the BT IPMI
+ * device, so receive it, but transmit a different version.
+ */
 static const VMStateDescription vmstate_ISAIPMIKCSDevice = {
     .name = TYPE_IPMI_INTERFACE,
     .version_id = 2,
@@ -119,13 +123,6 @@ static void ipmi_isa_realize(DeviceState *dev, Error **errp)
     qdev_set_legacy_instance_id(dev, iik->kcs.io_base, iik->kcs.io_length);
 
     isa_register_ioport(isadev, &iik->kcs.io, iik->kcs.io_base);
-
-    /*
-     * Version 1 had an incorrect name, it clashed with the BT
-     * IPMI device, so receive it, but transmit a different
-     * version.
-     */
-    vmstate_register(NULL, 0, &vmstate_ISAIPMIKCSDevice, iik);
 }
 
 static void isa_ipmi_kcs_init(Object *obj)
@@ -154,6 +151,7 @@ static void isa_ipmi_kcs_class_init(ObjectClass *oc, void *data)
     AcpiDevAmlIfClass *adevc = ACPI_DEV_AML_IF_CLASS(oc);
 
     dc->realize = ipmi_isa_realize;
+    dc->vmsd = &vmstate_ISAIPMIKCSDevice;
     device_class_set_props(dc, ipmi_isa_properties);
 
     iic->get_backend_data = isa_ipmi_kcs_get_backend_data;

From 3e0a763136aa715c536497008d9fa2c0d64c3909 Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Wed, 2 Apr 2025 00:01:48 +1000
Subject: [PATCH 0002/2760] ipmi/pci-ipmi-bt: Rename copy-paste variables
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

IPMI drivers use p/k suffix in variable names depending on bt or kcs.
The pci bt driver must have come from the kcs driver because it's
still using k suffixes in some cases. Rename.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Message-ID: <20250401140153.685523-2-npiggin@gmail.com>
Signed-off-by: Corey Minyard <corey@minyard.net>
---
 hw/ipmi/pci_ipmi_bt.c | 38 +++++++++++++++++++-------------------
 1 file changed, 19 insertions(+), 19 deletions(-)

diff --git a/hw/ipmi/pci_ipmi_bt.c b/hw/ipmi/pci_ipmi_bt.c
index afeea6f303..a3b742d22c 100644
--- a/hw/ipmi/pci_ipmi_bt.c
+++ b/hw/ipmi/pci_ipmi_bt.c
@@ -38,49 +38,49 @@ struct PCIIPMIBTDevice {
     uint32_t uuid;
 };
 
-static void pci_ipmi_raise_irq(IPMIBT *ik)
+static void pci_ipmi_raise_irq(IPMIBT *ib)
 {
-    PCIIPMIBTDevice *pik = ik->opaque;
+    PCIIPMIBTDevice *pib = ib->opaque;
 
-    pci_set_irq(&pik->dev, true);
+    pci_set_irq(&pib->dev, true);
 }
 
-static void pci_ipmi_lower_irq(IPMIBT *ik)
+static void pci_ipmi_lower_irq(IPMIBT *ib)
 {
-    PCIIPMIBTDevice *pik = ik->opaque;
+    PCIIPMIBTDevice *pib = ib->opaque;
 
-    pci_set_irq(&pik->dev, false);
+    pci_set_irq(&pib->dev, false);
 }
 
 static void pci_ipmi_bt_realize(PCIDevice *pd, Error **errp)
 {
     Error *err = NULL;
-    PCIIPMIBTDevice *pik = PCI_IPMI_BT(pd);
+    PCIIPMIBTDevice *pib = PCI_IPMI_BT(pd);
     IPMIInterface *ii = IPMI_INTERFACE(pd);
     IPMIInterfaceClass *iic = IPMI_INTERFACE_GET_CLASS(ii);
 
-    if (!pik->bt.bmc) {
+    if (!pib->bt.bmc) {
         error_setg(errp, "IPMI device requires a bmc attribute to be set");
         return;
     }
 
-    pik->uuid = ipmi_next_uuid();
+    pib->uuid = ipmi_next_uuid();
 
-    pik->bt.bmc->intf = ii;
-    pik->bt.opaque = pik;
+    pib->bt.bmc->intf = ii;
+    pib->bt.opaque = pib;
 
     pci_config_set_prog_interface(pd->config, 0x02); /* BT */
     pci_config_set_interrupt_pin(pd->config, 0x01);
-    pik->bt.use_irq = 1;
-    pik->bt.raise_irq = pci_ipmi_raise_irq;
-    pik->bt.lower_irq = pci_ipmi_lower_irq;
+    pib->bt.use_irq = 1;
+    pib->bt.raise_irq = pci_ipmi_raise_irq;
+    pib->bt.lower_irq = pci_ipmi_lower_irq;
 
     iic->init(ii, 8, &err);
     if (err) {
         error_propagate(errp, err);
         return;
     }
-    pci_register_bar(pd, 0, PCI_BASE_ADDRESS_SPACE_IO, &pik->bt.io);
+    pci_register_bar(pd, 0, PCI_BASE_ADDRESS_SPACE_IO, &pib->bt.io);
 }
 
 const VMStateDescription vmstate_PCIIPMIBTDevice = {
@@ -96,16 +96,16 @@ const VMStateDescription vmstate_PCIIPMIBTDevice = {
 
 static void pci_ipmi_bt_instance_init(Object *obj)
 {
-    PCIIPMIBTDevice *pik = PCI_IPMI_BT(obj);
+    PCIIPMIBTDevice *pib = PCI_IPMI_BT(obj);
 
-    ipmi_bmc_find_and_link(obj, (Object **) &pik->bt.bmc);
+    ipmi_bmc_find_and_link(obj, (Object **) &pib->bt.bmc);
 }
 
 static void *pci_ipmi_bt_get_backend_data(IPMIInterface *ii)
 {
-    PCIIPMIBTDevice *pik = PCI_IPMI_BT(ii);
+    PCIIPMIBTDevice *pib = PCI_IPMI_BT(ii);
 
-    return &pik->bt;
+    return &pib->bt;
 }
 
 static void pci_ipmi_bt_class_init(ObjectClass *oc, void *data)

From 7376d10b50fb5faa8324092c3f70195d713e34ac Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Wed, 2 Apr 2025 00:01:49 +1000
Subject: [PATCH 0003/2760] ipmi: add fwinfo to pci ipmi devices
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This requires some adjustments to callers to avoid possible behaviour
changes for PCI devices.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Message-ID: <20250401140153.685523-3-npiggin@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
[Rename pci_ipmi_bt_get_fwinfo to pci_ipmi_kcs_get_fwinfo in the
 pci_ipmi_kcs.c file.]
Signed-off-by: Corey Minyard <corey@minyard.net>
---
 hw/acpi/ipmi.c             |  3 ++-
 hw/ipmi/isa_ipmi_bt.c      |  1 +
 hw/ipmi/isa_ipmi_kcs.c     |  1 +
 hw/ipmi/pci_ipmi_bt.c      | 12 ++++++++++++
 hw/ipmi/pci_ipmi_kcs.c     | 11 +++++++++++
 hw/smbios/smbios_type_38.c |  7 ++++++-
 include/hw/ipmi/ipmi.h     |  5 +++++
 7 files changed, 38 insertions(+), 2 deletions(-)

diff --git a/hw/acpi/ipmi.c b/hw/acpi/ipmi.c
index a20e57d465..39f8f2f6d6 100644
--- a/hw/acpi/ipmi.c
+++ b/hw/acpi/ipmi.c
@@ -55,7 +55,8 @@ static Aml *aml_ipmi_crs(IPMIFwInfo *info)
         abort();
     }
 
-    if (info->interrupt_number) {
+    /* Should PCI interrupts also be appended? */
+    if (info->irq_source == IPMI_ISA_IRQ && info->interrupt_number) {
         aml_append(crs, aml_irq_no_flags(info->interrupt_number));
     }
 
diff --git a/hw/ipmi/isa_ipmi_bt.c b/hw/ipmi/isa_ipmi_bt.c
index 474a792c9a..76585e786e 100644
--- a/hw/ipmi/isa_ipmi_bt.c
+++ b/hw/ipmi/isa_ipmi_bt.c
@@ -49,6 +49,7 @@ static void isa_ipmi_bt_get_fwinfo(struct IPMIInterface *ii, IPMIFwInfo *info)
     ISAIPMIBTDevice *iib = ISA_IPMI_BT(ii);
 
     ipmi_bt_get_fwinfo(&iib->bt, info);
+    info->irq_source = IPMI_ISA_IRQ;
     info->interrupt_number = iib->isairq;
     info->i2c_slave_address = iib->bt.bmc->slave_addr;
     info->uuid = iib->uuid;
diff --git a/hw/ipmi/isa_ipmi_kcs.c b/hw/ipmi/isa_ipmi_kcs.c
index 94bbe45d35..ba3ae208b2 100644
--- a/hw/ipmi/isa_ipmi_kcs.c
+++ b/hw/ipmi/isa_ipmi_kcs.c
@@ -49,6 +49,7 @@ static void isa_ipmi_kcs_get_fwinfo(IPMIInterface *ii, IPMIFwInfo *info)
     ISAIPMIKCSDevice *iik = ISA_IPMI_KCS(ii);
 
     ipmi_kcs_get_fwinfo(&iik->kcs, info);
+    info->irq_source = IPMI_ISA_IRQ;
     info->interrupt_number = iik->isairq;
     info->uuid = iik->uuid;
 }
diff --git a/hw/ipmi/pci_ipmi_bt.c b/hw/ipmi/pci_ipmi_bt.c
index a3b742d22c..7ba8b3ab96 100644
--- a/hw/ipmi/pci_ipmi_bt.c
+++ b/hw/ipmi/pci_ipmi_bt.c
@@ -38,6 +38,17 @@ struct PCIIPMIBTDevice {
     uint32_t uuid;
 };
 
+static void pci_ipmi_bt_get_fwinfo(struct IPMIInterface *ii, IPMIFwInfo *info)
+{
+    PCIIPMIBTDevice *pib = PCI_IPMI_BT(ii);
+
+    ipmi_bt_get_fwinfo(&pib->bt, info);
+    info->irq_source = IPMI_PCI_IRQ;
+    info->interrupt_number = pci_intx(&pib->dev);
+    info->i2c_slave_address = pib->bt.bmc->slave_addr;
+    info->uuid = pib->uuid;
+}
+
 static void pci_ipmi_raise_irq(IPMIBT *ib)
 {
     PCIIPMIBTDevice *pib = ib->opaque;
@@ -125,6 +136,7 @@ static void pci_ipmi_bt_class_init(ObjectClass *oc, void *data)
 
     iic->get_backend_data = pci_ipmi_bt_get_backend_data;
     ipmi_bt_class_init(iic);
+    iic->get_fwinfo = pci_ipmi_bt_get_fwinfo;
 }
 
 static const TypeInfo pci_ipmi_bt_info = {
diff --git a/hw/ipmi/pci_ipmi_kcs.c b/hw/ipmi/pci_ipmi_kcs.c
index 05ba97ec58..0aa35143e9 100644
--- a/hw/ipmi/pci_ipmi_kcs.c
+++ b/hw/ipmi/pci_ipmi_kcs.c
@@ -38,6 +38,16 @@ struct PCIIPMIKCSDevice {
     uint32_t uuid;
 };
 
+static void pci_ipmi_kcs_get_fwinfo(struct IPMIInterface *ii, IPMIFwInfo *info)
+{
+    PCIIPMIKCSDevice *pik = PCI_IPMI_KCS(ii);
+
+    ipmi_kcs_get_fwinfo(&pik->kcs, info);
+    info->irq_source = IPMI_PCI_IRQ;
+    info->interrupt_number = pci_intx(&pik->dev);
+    info->uuid = pik->uuid;
+}
+
 static void pci_ipmi_raise_irq(IPMIKCS *ik)
 {
     PCIIPMIKCSDevice *pik = ik->opaque;
@@ -125,6 +135,7 @@ static void pci_ipmi_kcs_class_init(ObjectClass *oc, void *data)
 
     iic->get_backend_data = pci_ipmi_kcs_get_backend_data;
     ipmi_kcs_class_init(iic);
+    iic->get_fwinfo = pci_ipmi_kcs_get_fwinfo;
 }
 
 static const TypeInfo pci_ipmi_kcs_info = {
diff --git a/hw/smbios/smbios_type_38.c b/hw/smbios/smbios_type_38.c
index 168b886647..e9b856fcd9 100644
--- a/hw/smbios/smbios_type_38.c
+++ b/hw/smbios/smbios_type_38.c
@@ -72,7 +72,12 @@ static void smbios_build_one_type_38(IPMIFwInfo *info)
                      " SMBIOS, ignoring this entry.", info->register_spacing);
         return;
     }
-    t->interrupt_number = info->interrupt_number;
+    if (info->irq_source == IPMI_ISA_IRQ) {
+        t->interrupt_number = info->interrupt_number;
+    } else {
+        /* TODO: How to handle PCI? */
+        t->interrupt_number = 0;
+    }
 
     SMBIOS_BUILD_TABLE_POST;
 }
diff --git a/include/hw/ipmi/ipmi.h b/include/hw/ipmi/ipmi.h
index 77a7213ed9..c8ef04856e 100644
--- a/include/hw/ipmi/ipmi.h
+++ b/include/hw/ipmi/ipmi.h
@@ -90,6 +90,11 @@ typedef struct IPMIFwInfo {
     } memspace;
 
     int interrupt_number;
+    enum {
+        IPMI_NO_IRQ = 0,
+        IPMI_ISA_IRQ,
+        IPMI_PCI_IRQ,
+    } irq_source;
     enum {
         IPMI_LEVEL_IRQ,
         IPMI_EDGE_IRQ

From 7f9e7af40a1721e5adb95761754bc12af0f3d2f1 Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Wed, 2 Apr 2025 00:01:50 +1000
Subject: [PATCH 0004/2760] ipmi/bmc-sim: Add 'Get Channel Info' command

Linux issues this command when booting a powernv machine.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Message-ID: <20250401140153.685523-4-npiggin@gmail.com>
Signed-off-by: Corey Minyard <corey@minyard.net>
---
 hw/ipmi/ipmi_bmc_sim.c | 68 ++++++++++++++++++++++++++++++++++++++++--
 hw/ipmi/ipmi_bt.c      |  2 ++
 hw/ipmi/ipmi_kcs.c     |  1 +
 include/hw/ipmi/ipmi.h | 10 +++++++
 4 files changed, 79 insertions(+), 2 deletions(-)

diff --git a/hw/ipmi/ipmi_bmc_sim.c b/hw/ipmi/ipmi_bmc_sim.c
index bc0ddc52a9..03e58d283e 100644
--- a/hw/ipmi/ipmi_bmc_sim.c
+++ b/hw/ipmi/ipmi_bmc_sim.c
@@ -70,6 +70,7 @@
 #define IPMI_CMD_GET_MSG                  0x33
 #define IPMI_CMD_SEND_MSG                 0x34
 #define IPMI_CMD_READ_EVT_MSG_BUF         0x35
+#define IPMI_CMD_GET_CHANNEL_INFO         0x42
 
 #define IPMI_NETFN_STORAGE            0x0a
 
@@ -1020,8 +1021,8 @@ static void send_msg(IPMIBmcSim *ibs,
     uint8_t *buf;
     uint8_t netfn, rqLun, rsLun, rqSeq;
 
-    if (cmd[2] != 0) {
-        /* We only handle channel 0 with no options */
+    if (cmd[2] != IPMI_CHANNEL_IPMB) {
+        /* We only handle channel 0h (IPMB) with no options */
         rsp_buffer_set_error(rsp, IPMI_CC_INVALID_DATA_FIELD);
         return;
     }
@@ -1219,6 +1220,68 @@ static void get_watchdog_timer(IPMIBmcSim *ibs,
     }
 }
 
+static void get_channel_info(IPMIBmcSim *ibs,
+                             uint8_t *cmd, unsigned int cmd_len,
+                             RspBuffer *rsp)
+{
+    IPMIInterface *s = ibs->parent.intf;
+    IPMIInterfaceClass *k = IPMI_INTERFACE_GET_CLASS(s);
+    IPMIFwInfo info = {};
+    uint8_t ch = cmd[2] & 0x0f;
+
+    /* Only define channel 0h (IPMB) and Fh (system interface) */
+
+    if (ch == 0x0e) { /* "This channel" */
+        ch = IPMI_CHANNEL_SYSTEM;
+    }
+    rsp_buffer_push(rsp, ch);
+
+    if (ch != IPMI_CHANNEL_IPMB && ch != IPMI_CHANNEL_SYSTEM) {
+        /* Not a supported channel */
+        rsp_buffer_set_error(rsp, IPMI_CC_INVALID_DATA_FIELD);
+        return;
+    }
+
+    if (k->get_fwinfo) {
+        k->get_fwinfo(s, &info);
+    }
+
+    if (ch == IPMI_CHANNEL_IPMB) {
+        rsp_buffer_push(rsp, IPMI_CHANNEL_MEDIUM_IPMB);
+        rsp_buffer_push(rsp, IPMI_CHANNEL_PROTOCOL_IPMB);
+    } else { /* IPMI_CHANNEL_SYSTEM */
+        rsp_buffer_push(rsp, IPMI_CHANNEL_MEDIUM_SYSTEM);
+        rsp_buffer_push(rsp, info.ipmi_channel_protocol);
+    }
+
+    rsp_buffer_push(rsp, 0x00); /* Session-less */
+
+    /* IPMI Enterprise Number for Vendor ID */
+    rsp_buffer_push(rsp, 0xf2);
+    rsp_buffer_push(rsp, 0x1b);
+    rsp_buffer_push(rsp, 0x00);
+
+    if (ch == IPMI_CHANNEL_SYSTEM) {
+        uint8_t irq;
+
+        if (info.irq_source == IPMI_ISA_IRQ) {
+            irq = info.interrupt_number;
+        } else if (info.irq_source == IPMI_PCI_IRQ) {
+            irq = 0x10 + info.interrupt_number;
+        } else {
+            irq = 0xff; /* no interrupt / unspecified */
+        }
+
+        /* Both interrupts use the same irq number */
+        rsp_buffer_push(rsp, irq);
+        rsp_buffer_push(rsp, irq);
+    } else {
+        /* Reserved */
+        rsp_buffer_push(rsp, 0x00);
+        rsp_buffer_push(rsp, 0x00);
+    }
+}
+
 static void get_sdr_rep_info(IPMIBmcSim *ibs,
                              uint8_t *cmd, unsigned int cmd_len,
                              RspBuffer *rsp)
@@ -2015,6 +2078,7 @@ static const IPMICmdHandler app_cmds[] = {
     [IPMI_CMD_RESET_WATCHDOG_TIMER] = { reset_watchdog_timer },
     [IPMI_CMD_SET_WATCHDOG_TIMER] = { set_watchdog_timer, 8 },
     [IPMI_CMD_GET_WATCHDOG_TIMER] = { get_watchdog_timer },
+    [IPMI_CMD_GET_CHANNEL_INFO] = { get_channel_info, 3 },
 };
 static const IPMINetfn app_netfn = {
     .cmd_nums = ARRAY_SIZE(app_cmds),
diff --git a/hw/ipmi/ipmi_bt.c b/hw/ipmi/ipmi_bt.c
index 583fc64730..28cf6ab218 100644
--- a/hw/ipmi/ipmi_bt.c
+++ b/hw/ipmi/ipmi_bt.c
@@ -419,6 +419,8 @@ void ipmi_bt_get_fwinfo(struct IPMIBT *ib, IPMIFwInfo *info)
     info->interface_type = IPMI_SMBIOS_BT;
     info->ipmi_spec_major_revision = 2;
     info->ipmi_spec_minor_revision = 0;
+    /* BT System Interface Format, IPMI v1.5 */
+    info->ipmi_channel_protocol = IPMI_CHANNEL_PROTOCOL_BT_15;
     info->base_address = ib->io_base;
     info->register_length = ib->io_length;
     info->register_spacing = 1;
diff --git a/hw/ipmi/ipmi_kcs.c b/hw/ipmi/ipmi_kcs.c
index c15977cab4..578dd7cef3 100644
--- a/hw/ipmi/ipmi_kcs.c
+++ b/hw/ipmi/ipmi_kcs.c
@@ -405,6 +405,7 @@ void ipmi_kcs_get_fwinfo(IPMIKCS *ik, IPMIFwInfo *info)
     info->interface_type = IPMI_SMBIOS_KCS;
     info->ipmi_spec_major_revision = 2;
     info->ipmi_spec_minor_revision = 0;
+    info->ipmi_channel_protocol = IPMI_CHANNEL_PROTOCOL_KCS;
     info->base_address = ik->io_base;
     info->i2c_slave_address = ik->bmc->slave_addr;
     info->register_length = ik->io_length;
diff --git a/include/hw/ipmi/ipmi.h b/include/hw/ipmi/ipmi.h
index c8ef04856e..802a2febb0 100644
--- a/include/hw/ipmi/ipmi.h
+++ b/include/hw/ipmi/ipmi.h
@@ -41,6 +41,15 @@ enum ipmi_op {
     IPMI_SEND_NMI
 };
 
+/* Channel properties */
+#define IPMI_CHANNEL_IPMB                0x00
+#define IPMI_CHANNEL_SYSTEM              0x0f
+#define IPMI_CHANNEL_MEDIUM_IPMB         0x01
+#define IPMI_CHANNEL_MEDIUM_SYSTEM       0x0c
+#define IPMI_CHANNEL_PROTOCOL_IPMB       0x01
+#define IPMI_CHANNEL_PROTOCOL_KCS        0x05
+#define IPMI_CHANNEL_PROTOCOL_BT_15      0x08
+
 #define IPMI_CC_INVALID_CMD                              0xc1
 #define IPMI_CC_COMMAND_INVALID_FOR_LUN                  0xc2
 #define IPMI_CC_TIMEOUT                                  0xc3
@@ -76,6 +85,7 @@ typedef struct IPMIFwInfo {
     int interface_type;
     uint8_t ipmi_spec_major_revision;
     uint8_t ipmi_spec_minor_revision;
+    uint8_t ipmi_channel_protocol;
     uint8_t i2c_slave_address;
     uint32_t uuid;
 

From d9494ef96c859515aa9df450fb61e833da7cb7c7 Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Wed, 2 Apr 2025 00:01:51 +1000
Subject: [PATCH 0005/2760] ipmi/bmc-sim: implement watchdog dont log flag

If the dont-log flag is set in the 'timer use' field for the
'set watchdog' command, a watchdog timeout will not get logged as
a timer use expiration.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Message-ID: <20250401140153.685523-5-npiggin@gmail.com>
Signed-off-by: Corey Minyard <corey@minyard.net>
---
 hw/ipmi/ipmi_bmc_sim.c | 26 +++++++++++++++++---------
 1 file changed, 17 insertions(+), 9 deletions(-)

diff --git a/hw/ipmi/ipmi_bmc_sim.c b/hw/ipmi/ipmi_bmc_sim.c
index 03e58d283e..4ed66e1ee0 100644
--- a/hw/ipmi/ipmi_bmc_sim.c
+++ b/hw/ipmi/ipmi_bmc_sim.c
@@ -514,7 +514,8 @@ static void gen_event(IPMIBmcSim *ibs, unsigned int sens_num, uint8_t deassert,
 
 static void sensor_set_discrete_bit(IPMIBmcSim *ibs, unsigned int sensor,
                                     unsigned int bit, unsigned int val,
-                                    uint8_t evd1, uint8_t evd2, uint8_t evd3)
+                                    uint8_t evd1, uint8_t evd2, uint8_t evd3,
+                                    bool do_log)
 {
     IPMISensor *sens;
     uint16_t mask;
@@ -534,7 +535,7 @@ static void sensor_set_discrete_bit(IPMIBmcSim *ibs, unsigned int sensor,
             return; /* Already asserted */
         }
         sens->assert_states |= mask & sens->assert_suppt;
-        if (sens->assert_enable & mask & sens->assert_states) {
+        if (do_log && (sens->assert_enable & mask & sens->assert_states)) {
             /* Send an event on assert */
             gen_event(ibs, sensor, 0, evd1, evd2, evd3);
         }
@@ -544,7 +545,7 @@ static void sensor_set_discrete_bit(IPMIBmcSim *ibs, unsigned int sensor,
             return; /* Already deasserted */
         }
         sens->deassert_states |= mask & sens->deassert_suppt;
-        if (sens->deassert_enable & mask & sens->deassert_states) {
+        if (do_log && (sens->deassert_enable & mask & sens->deassert_states)) {
             /* Send an event on deassert */
             gen_event(ibs, sensor, 1, evd1, evd2, evd3);
         }
@@ -700,6 +701,7 @@ static void ipmi_sim_handle_timeout(IPMIBmcSim *ibs)
 {
     IPMIInterface *s = ibs->parent.intf;
     IPMIInterfaceClass *k = IPMI_INTERFACE_GET_CLASS(s);
+    bool do_log = !IPMI_BMC_WATCHDOG_GET_DONT_LOG(ibs);
 
     if (!ibs->watchdog_running) {
         goto out;
@@ -711,14 +713,16 @@ static void ipmi_sim_handle_timeout(IPMIBmcSim *ibs)
             ibs->msg_flags |= IPMI_BMC_MSG_FLAG_WATCHDOG_TIMEOUT_MASK;
             k->do_hw_op(s, IPMI_SEND_NMI, 0);
             sensor_set_discrete_bit(ibs, IPMI_WATCHDOG_SENSOR, 8, 1,
-                                    0xc8, (2 << 4) | 0xf, 0xff);
+                                    0xc8, (2 << 4) | 0xf, 0xff,
+                                    do_log);
             break;
 
         case IPMI_BMC_WATCHDOG_PRE_MSG_INT:
             ibs->msg_flags |= IPMI_BMC_MSG_FLAG_WATCHDOG_TIMEOUT_MASK;
             k->set_atn(s, 1, attn_irq_enabled(ibs));
             sensor_set_discrete_bit(ibs, IPMI_WATCHDOG_SENSOR, 8, 1,
-                                    0xc8, (3 << 4) | 0xf, 0xff);
+                                    0xc8, (3 << 4) | 0xf, 0xff,
+                                    do_log);
             break;
 
         default:
@@ -738,24 +742,28 @@ static void ipmi_sim_handle_timeout(IPMIBmcSim *ibs)
     switch (IPMI_BMC_WATCHDOG_GET_ACTION(ibs)) {
     case IPMI_BMC_WATCHDOG_ACTION_NONE:
         sensor_set_discrete_bit(ibs, IPMI_WATCHDOG_SENSOR, 0, 1,
-                                0xc0, ibs->watchdog_use & 0xf, 0xff);
+                                0xc0, ibs->watchdog_use & 0xf, 0xff,
+                                do_log);
         break;
 
     case IPMI_BMC_WATCHDOG_ACTION_RESET:
         sensor_set_discrete_bit(ibs, IPMI_WATCHDOG_SENSOR, 1, 1,
-                                0xc1, ibs->watchdog_use & 0xf, 0xff);
+                                0xc1, ibs->watchdog_use & 0xf, 0xff,
+                                do_log);
         k->do_hw_op(s, IPMI_RESET_CHASSIS, 0);
         break;
 
     case IPMI_BMC_WATCHDOG_ACTION_POWER_DOWN:
         sensor_set_discrete_bit(ibs, IPMI_WATCHDOG_SENSOR, 2, 1,
-                                0xc2, ibs->watchdog_use & 0xf, 0xff);
+                                0xc2, ibs->watchdog_use & 0xf, 0xff,
+                                do_log);
         k->do_hw_op(s, IPMI_POWEROFF_CHASSIS, 0);
         break;
 
     case IPMI_BMC_WATCHDOG_ACTION_POWER_CYCLE:
         sensor_set_discrete_bit(ibs, IPMI_WATCHDOG_SENSOR, 2, 1,
-                                0xc3, ibs->watchdog_use & 0xf, 0xff);
+                                0xc3, ibs->watchdog_use & 0xf, 0xff,
+                                do_log);
         k->do_hw_op(s, IPMI_POWERCYCLE_CHASSIS, 0);
         break;
     }

From dacb3e70ef73d1c9a2d0d4cfd65031deff49f742 Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Wed, 2 Apr 2025 00:01:52 +1000
Subject: [PATCH 0006/2760] ipmi/bmc-sim: add error handling for 'Set BMC
 Global Enables' command

Mask out unsupported bits and return failure if attempting to set
any. This is not required by the IPMI spec, but it does require that
system software not change bits it isn't aware of.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Message-ID: <20250401140153.685523-6-npiggin@gmail.com>
Signed-off-by: Corey Minyard <corey@minyard.net>
---
 hw/ipmi/ipmi_bmc_sim.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/hw/ipmi/ipmi_bmc_sim.c b/hw/ipmi/ipmi_bmc_sim.c
index 4ed66e1ee0..1c60a71831 100644
--- a/hw/ipmi/ipmi_bmc_sim.c
+++ b/hw/ipmi/ipmi_bmc_sim.c
@@ -235,6 +235,7 @@ struct IPMIBmcSim {
 #define IPMI_BMC_MSG_FLAG_RCV_MSG_QUEUE_SET(s) \
     (IPMI_BMC_MSG_FLAG_RCV_MSG_QUEUE & (s)->msg_flags)
 
+#define IPMI_BMC_GLOBAL_ENABLES_SUPPORTED 0x0f
 #define IPMI_BMC_RCV_MSG_QUEUE_INT_BIT    0
 #define IPMI_BMC_EVBUF_FULL_INT_BIT       1
 #define IPMI_BMC_EVENT_MSG_BUF_BIT        2
@@ -934,7 +935,14 @@ static void set_bmc_global_enables(IPMIBmcSim *ibs,
                                    uint8_t *cmd, unsigned int cmd_len,
                                    RspBuffer *rsp)
 {
-    set_global_enables(ibs, cmd[2]);
+    uint8_t val = cmd[2];
+
+    if (val & ~IPMI_BMC_GLOBAL_ENABLES_SUPPORTED) {
+        rsp_buffer_set_error(rsp, IPMI_CC_INVALID_DATA_FIELD);
+        return;
+    }
+
+    set_global_enables(ibs, val);
 }
 
 static void get_bmc_global_enables(IPMIBmcSim *ibs,

From 08b462dd9970a88d7f0e7c61ca48502463b0b78d Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Thu, 10 Apr 2025 17:42:52 +0200
Subject: [PATCH 0007/2760] scsi: add conversion from ENODEV to sense

This is mostly for completeness; I noticed it because ENODEV is used internally
within scsi-disk.c, but when scsi_sense_from_errno(ENODEV) is called the resulting
sense is never used and instead scsi_sense_from_host_status() is called later
by scsi_req_complete_failed().

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 scsi/utils.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/scsi/utils.c b/scsi/utils.c
index 357b036671..545956f4f9 100644
--- a/scsi/utils.c
+++ b/scsi/utils.c
@@ -587,20 +587,27 @@ int scsi_sense_from_errno(int errno_value, SCSISense *sense)
         return GOOD;
     case EDOM:
         return TASK_SET_FULL;
+#if ENODEV != ENOMEDIUM
+    case ENODEV:
+        /*
+         * Some of the BSDs have ENODEV and ENOMEDIUM as synonyms.  For
+         * everyone else, give a more severe sense code for ENODEV.
+         */
+#endif
 #ifdef CONFIG_LINUX
         /* These errno mapping are specific to Linux.  For more information:
          * - scsi_check_sense and scsi_decide_disposition in drivers/scsi/scsi_error.c
          * - scsi_result_to_blk_status in drivers/scsi/scsi_lib.c
          * - blk_errors[] in block/blk-core.c
          */
+    case EREMOTEIO:
+        *sense = SENSE_CODE(TARGET_FAILURE);
+        return CHECK_CONDITION;
     case EBADE:
         return RESERVATION_CONFLICT;
     case ENODATA:
         *sense = SENSE_CODE(READ_ERROR);
         return CHECK_CONDITION;
-    case EREMOTEIO:
-        *sense = SENSE_CODE(TARGET_FAILURE);
-        return CHECK_CONDITION;
 #endif
     case ENOMEDIUM:
         *sense = SENSE_CODE(NO_MEDIUM);

From 280712b78781c43511d6286d40f9a518a4de25ff Mon Sep 17 00:00:00 2001
From: Ewan Hai <ewanhai-oc@zhaoxin.com>
Date: Mon, 14 Apr 2025 03:53:42 -0400
Subject: [PATCH 0008/2760] target/i386: Fix model number of Zhaoxin YongFeng
 vCPU template

The model number was mistakenly set to 0x0b (11) in commit ff04bc1ac4.
The correct value is 0x5b. This mistake occurred because the extended
model bits in cpuid[eax=0x1].eax were overlooked, and only the base
model was used.

Using the wrong model number can affect guest behavior. One known issue
is that vPMU (which relies on the model number) may fail to operate
correctly.

This patch corrects the model field by introducing a new vCPU version.

Fixes: ff04bc1ac4 ("target/i386: Introduce Zhaoxin Yongfeng CPU model")
Signed-off-by: Ewan Hai <ewanhai-oc@zhaoxin.com>
Link: https://lore.kernel.org/r/20250414075342.411626-1-ewanhai-oc@zhaoxin.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 1b64ceaaba..3fb1ec62da 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -5621,6 +5621,18 @@ static const X86CPUDefinition builtin_x86_defs[] = {
         .features[FEAT_VMX_VMFUNC] = MSR_VMX_VMFUNC_EPT_SWITCHING,
         .xlevel = 0x80000008,
         .model_id = "Zhaoxin YongFeng Processor",
+        .versions = (X86CPUVersionDefinition[]) {
+            { .version = 1 },
+            {
+                .version = 2,
+                .note = "with the correct model number",
+                .props = (PropValue[]) {
+                    { "model", "0x5b" },
+                    { /* end of list */ }
+                }
+            },
+            { /* end of list */ }
+        }
     },
 };
 

From f6b5f71f04529d3f56b35f91badac9f5e7e225ca Mon Sep 17 00:00:00 2001
From: "Maciej S. Szmigiero" <maciej.szmigiero@oracle.com>
Date: Thu, 27 Mar 2025 19:24:16 +0100
Subject: [PATCH 0009/2760] target/i386: Reset parked vCPUs together with the
 online ones

Commit 3f2a05b31ee9 ("target/i386: Reset TSCs of parked vCPUs too on VM
reset") introduced a way to reset TSCs of parked vCPUs during VM reset to
prevent them getting desynchronized with the online vCPUs and therefore
causing the KVM PV clock to lose PVCLOCK_TSC_STABLE_BIT.

The way this was done was by registering a parked vCPU-specific QEMU reset
callback via qemu_register_reset().

However, it turns out that on particularly device-rich VMs QEMU reset
callbacks can take a long time to execute (which isn't surprising,
considering that they involve resetting all of VM devices).

In particular, their total runtime can exceed the 1-second TSC
synchronization window introduced in KVM commit 5d3cb0f6a8e3 ("KVM:
Improve TSC offset matching").
Since the TSCs of online vCPUs are only reset from "synchronize_post_reset"
AccelOps handler (which runs after all qemu_register_reset() handlers) this
essentially makes that fix ineffective on these VMs.

The easiest way to guarantee that these parked vCPUs are reset at the same
time as the online ones (regardless how long it takes for VM devices to
reset) is to piggyback on post-reset vCPU synchronization handler for one
of online vCPUs - as there is no generic post-reset AccelOps handler that
isn't per-vCPU.

The first online vCPU was selected for that since it is easily available
under "first_cpu" define.
This does not create an ordering issue since the order of vCPU TSC resets
does not matter.

Fixes: 3f2a05b31ee9 ("target/i386: Reset TSCs of parked vCPUs too on VM reset")
Signed-off-by: Maciej S. Szmigiero <maciej.szmigiero@oracle.com>
Link: https://lore.kernel.org/r/e8b85a5915f79aa177ca49eccf0e9b534470c1cd.1743099810.git.maciej.szmigiero@oracle.com
Cc: qemu-stable@nongnu.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 accel/kvm/kvm-all.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index f89568bfa3..951e8214e0 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -437,9 +437,8 @@ int kvm_unpark_vcpu(KVMState *s, unsigned long vcpu_id)
     return kvm_fd;
 }
 
-static void kvm_reset_parked_vcpus(void *param)
+static void kvm_reset_parked_vcpus(KVMState *s)
 {
-    KVMState *s = param;
     struct KVMParkedVcpu *cpu;
 
     QLIST_FOREACH(cpu, &s->kvm_parked_vcpus, node) {
@@ -2738,7 +2737,6 @@ static int kvm_init(MachineState *ms)
     }
 
     qemu_register_reset(kvm_unpoison_all, NULL);
-    qemu_register_reset(kvm_reset_parked_vcpus, s);
 
     if (s->kernel_irqchip_allowed) {
         kvm_irqchip_create(s);
@@ -2908,6 +2906,10 @@ static void do_kvm_cpu_synchronize_post_reset(CPUState *cpu, run_on_cpu_data arg
 void kvm_cpu_synchronize_post_reset(CPUState *cpu)
 {
     run_on_cpu(cpu, do_kvm_cpu_synchronize_post_reset, RUN_ON_CPU_NULL);
+
+    if (cpu == first_cpu) {
+        kvm_reset_parked_vcpus(kvm_state);
+    }
 }
 
 static void do_kvm_cpu_synchronize_post_init(CPUState *cpu, run_on_cpu_data arg)

From 94a159f3dc737d00749cc930adaec112abe07b3c Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Thu, 3 Apr 2025 21:39:54 +0200
Subject: [PATCH 0010/2760] target/i386/hvf: fix lflags_to_rflags
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Clear the flags before adding in the ones computed from lflags.

Cc: Wei Liu <liuwe@linux.microsoft.com>
Cc: qemu-stable@nongnu.org
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/hvf/x86_flags.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target/i386/hvf/x86_flags.c b/target/i386/hvf/x86_flags.c
index 03d6de5efc..fedc70a1b8 100644
--- a/target/i386/hvf/x86_flags.c
+++ b/target/i386/hvf/x86_flags.c
@@ -293,6 +293,7 @@ void set_SF(CPUX86State *env, bool val)
 
 void lflags_to_rflags(CPUX86State *env)
 {
+    env->eflags &= ~(CC_C|CC_P|CC_A|CC_Z|CC_S|CC_O);
     env->eflags |= get_CF(env) ? CC_C : 0;
     env->eflags |= get_PF(env) ? CC_P : 0;
     env->eflags |= get_AF(env) ? CC_A : 0;

From bd65810538bfa4baef4f9e2fe40166d008a2a64c Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Mon, 17 Feb 2025 10:21:02 +0100
Subject: [PATCH 0011/2760] target/i386: special case ADC/SBB x,0 and SBB x,x

Avoid the three-operand CC_OP_ADD and CC_OP_ADC in these relatively
common cases.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/tcg/emit.c.inc  | 71 +++++++++++++++++++++++++++++++++----
 target/i386/tcg/translate.c | 20 +++++++++++
 2 files changed, 85 insertions(+), 6 deletions(-)

diff --git a/target/i386/tcg/emit.c.inc b/target/i386/tcg/emit.c.inc
index 0fa1664a24..f477a2da99 100644
--- a/target/i386/tcg/emit.c.inc
+++ b/target/i386/tcg/emit.c.inc
@@ -1170,11 +1170,28 @@ static void gen_AAS(DisasContext *s, X86DecodedInsn *decode)
     assume_cc_op(s, CC_OP_EFLAGS);
 }
 
+static void gen_ADD(DisasContext *s, X86DecodedInsn *decode);
 static void gen_ADC(DisasContext *s, X86DecodedInsn *decode)
 {
     MemOp ot = decode->op[1].ot;
-    TCGv c_in = tcg_temp_new();
+    TCGv c_in;
 
+    /*
+     * Try to avoid CC_OP_ADC by transforming as follows:
+     * CC_ADC: src1 = dst + c_in, src2 = 0, src3 = c_in
+     * CC_ADD: src1 = dst + c_in, src2 = c_in (no src3)
+     *
+     * In general src2 vs. src3 matters when computing AF and OF, but not here:
+     * - AF is bit 4 of dst^src1^src2, which is bit 4 of dst^src1 in both cases
+     * - OF is a function of the two MSBs, and in both cases they are zero for src2
+     */
+    if (decode->e.op2 == X86_TYPE_I && decode->immediate == 0) {
+        gen_compute_eflags_c(s, s->T1);
+        gen_ADD(s, decode);
+        return;
+    }
+
+    c_in = tcg_temp_new();
     gen_compute_eflags_c(s, c_in);
     if (s->prefix & PREFIX_LOCK) {
         tcg_gen_add_tl(s->T0, c_in, s->T1);
@@ -3830,22 +3847,64 @@ static void gen_SARX(DisasContext *s, X86DecodedInsn *decode)
     tcg_gen_sar_tl(s->T0, s->T0, s->T1);
 }
 
+static void gen_SUB(DisasContext *s, X86DecodedInsn *decode);
 static void gen_SBB(DisasContext *s, X86DecodedInsn *decode)
 {
     MemOp ot = decode->op[0].ot;
-    TCGv c_in = tcg_temp_new();
+    TCGv c_in;
 
+    /*
+     * Try to avoid CC_OP_SBB by transforming as follows:
+     * CC_SBB: src1 = dst + c_in, src2 = 0, src3 = c_in
+     * CC_SUB: src1 = dst + c_in, src2 = c_in (no src3)
+     *
+     * In general src2 vs. src3 matters when computing AF and OF, but not here:
+     * - AF is bit 4 of dst^src1^src2, which is bit 4 of dst^src1 in both cases
+     * - OF is a function of the two MSBs, and in both cases they are zero for src2
+     */
+    if (decode->e.op2 == X86_TYPE_I && decode->immediate == 0) {
+        gen_compute_eflags_c(s, s->T1);
+        gen_SUB(s, decode);
+        return;
+    }
+
+    c_in = tcg_temp_new();
     gen_compute_eflags_c(s, c_in);
+
+    /*
+     * Here the change is as follows:
+     * CC_SBB: src1 = T0, src2 = T0, src3 = c_in
+     * CC_SUB: src1 = 0, src2 = c_in (no src3)
+     *
+     * The difference also does not matter:
+     * - AF is bit 4 of dst^src1^src2, but bit 4 of src1^src2 is zero in both cases
+     *   therefore AF comes straight from dst (in fact it is c_in)
+     * - for OF, src1 and src2 have the same sign in both cases, meaning there
+     *   can be no overflow
+     */
+    if (decode->e.op2 != X86_TYPE_I && !decode->op[0].has_ea && decode->op[0].n == decode->op[2].n) {
+        if (s->cc_op == CC_OP_DYNAMIC) {
+            tcg_gen_neg_tl(s->T0, c_in);
+        } else {
+            /*
+             * Do not negate c_in because it will often be dead and only the
+             * instruction generated by negsetcond will survive.
+             */
+            gen_neg_setcc(s, JCC_B << 1, s->T0);
+        }
+        tcg_gen_movi_tl(s->cc_srcT, 0);
+        decode->cc_src = c_in;
+        decode->cc_dst = s->T0;
+        decode->cc_op = CC_OP_SUBB + ot;
+        return;
+    }
+
     if (s->prefix & PREFIX_LOCK) {
         tcg_gen_add_tl(s->T0, s->T1, c_in);
         tcg_gen_neg_tl(s->T0, s->T0);
         tcg_gen_atomic_add_fetch_tl(s->T0, s->A0, s->T0,
                                     s->mem_index, ot | MO_LE);
     } else {
-        /*
-         * TODO: SBB reg, reg could use gen_prepare_eflags_c followed by
-         * negsetcond, and CC_OP_SUBB as the cc_op.
-         */
         tcg_gen_sub_tl(s->T0, s->T0, s->T1);
         tcg_gen_sub_tl(s->T0, s->T0, c_in);
     }
diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
index a8935f487a..aee3342898 100644
--- a/target/i386/tcg/translate.c
+++ b/target/i386/tcg/translate.c
@@ -1183,6 +1183,26 @@ static CCPrepare gen_prepare_cc(DisasContext *s, int b, TCGv reg)
     return cc;
 }
 
+static void gen_neg_setcc(DisasContext *s, int b, TCGv reg)
+{
+    CCPrepare cc = gen_prepare_cc(s, b, reg);
+
+    if (cc.no_setcond) {
+        if (cc.cond == TCG_COND_EQ) {
+            tcg_gen_addi_tl(reg, cc.reg, -1);
+        } else {
+            tcg_gen_neg_tl(reg, cc.reg);
+        }
+        return;
+    }
+
+    if (cc.use_reg2) {
+        tcg_gen_negsetcond_tl(cc.cond, reg, cc.reg, cc.reg2);
+    } else {
+        tcg_gen_negsetcondi_tl(cc.cond, reg, cc.reg, cc.imm);
+    }
+}
+
 static void gen_setcc(DisasContext *s, int b, TCGv reg)
 {
     CCPrepare cc = gen_prepare_cc(s, b, reg);

From ec6019f2308b5d27b4ee33497b06174e9f58b100 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Thu, 13 Feb 2025 18:45:06 +0100
Subject: [PATCH 0012/2760] target/i386: tcg: remove tmp0 and tmp4 from
 SHLD/SHRD

Apply some of the simplifications used for RCL and RCR.  tmp4 is not
used anywhere else, so remove it.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/tcg/emit.c.inc  |  6 ++---
 target/i386/tcg/translate.c | 51 +++++++++++++++++++++----------------
 2 files changed, 31 insertions(+), 26 deletions(-)

diff --git a/target/i386/tcg/emit.c.inc b/target/i386/tcg/emit.c.inc
index f477a2da99..a41afb7fe4 100644
--- a/target/i386/tcg/emit.c.inc
+++ b/target/i386/tcg/emit.c.inc
@@ -4015,8 +4015,7 @@ static void gen_SHLD(DisasContext *s, X86DecodedInsn *decode)
     }
 
     decode->cc_dst = s->T0;
-    decode->cc_src = s->tmp0;
-    gen_shiftd_rm_T1(s, ot, false, count);
+    decode->cc_src = gen_shiftd_rm_T1(s, ot, false, count);
     if (can_be_zero) {
         gen_shift_dynamic_flags(s, decode, count, CC_OP_SHLB + ot);
     } else {
@@ -4068,8 +4067,7 @@ static void gen_SHRD(DisasContext *s, X86DecodedInsn *decode)
     }
 
     decode->cc_dst = s->T0;
-    decode->cc_src = s->tmp0;
-    gen_shiftd_rm_T1(s, ot, true, count);
+    decode->cc_src = gen_shiftd_rm_T1(s, ot, true, count);
     if (can_be_zero) {
         gen_shift_dynamic_flags(s, decode, count, CC_OP_SARB + ot);
     } else {
diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
index aee3342898..5529327680 100644
--- a/target/i386/tcg/translate.c
+++ b/target/i386/tcg/translate.c
@@ -135,7 +135,6 @@ typedef struct DisasContext {
 
     /* TCG local register indexes (only used inside old micro ops) */
     TCGv tmp0;
-    TCGv tmp4;
     TCGv_i32 tmp2_i32;
     TCGv_i32 tmp3_i32;
     TCGv_i64 tmp1_i64;
@@ -1580,10 +1579,13 @@ static bool check_cpl0(DisasContext *s)
 }
 
 /* XXX: add faster immediate case */
-static void gen_shiftd_rm_T1(DisasContext *s, MemOp ot,
+static TCGv gen_shiftd_rm_T1(DisasContext *s, MemOp ot,
                              bool is_right, TCGv count)
 {
     target_ulong mask = (ot == MO_64 ? 63 : 31);
+    TCGv cc_src = tcg_temp_new();
+    TCGv tmp = tcg_temp_new();
+    TCGv hishift;
 
     switch (ot) {
     case MO_16:
@@ -1591,9 +1593,9 @@ static void gen_shiftd_rm_T1(DisasContext *s, MemOp ot,
            This means "shrdw C, B, A" shifts A:B:A >> C.  Build the B:A
            portion by constructing it as a 32-bit value.  */
         if (is_right) {
-            tcg_gen_deposit_tl(s->tmp0, s->T0, s->T1, 16, 16);
+            tcg_gen_deposit_tl(tmp, s->T0, s->T1, 16, 16);
             tcg_gen_mov_tl(s->T1, s->T0);
-            tcg_gen_mov_tl(s->T0, s->tmp0);
+            tcg_gen_mov_tl(s->T0, tmp);
         } else {
             tcg_gen_deposit_tl(s->T1, s->T0, s->T1, 16, 16);
         }
@@ -1604,47 +1606,53 @@ static void gen_shiftd_rm_T1(DisasContext *s, MemOp ot,
     case MO_32:
 #ifdef TARGET_X86_64
         /* Concatenate the two 32-bit values and use a 64-bit shift.  */
-        tcg_gen_subi_tl(s->tmp0, count, 1);
+        tcg_gen_subi_tl(tmp, count, 1);
         if (is_right) {
             tcg_gen_concat_tl_i64(s->T0, s->T0, s->T1);
-            tcg_gen_shr_i64(s->tmp0, s->T0, s->tmp0);
+            tcg_gen_shr_i64(cc_src, s->T0, tmp);
             tcg_gen_shr_i64(s->T0, s->T0, count);
         } else {
             tcg_gen_concat_tl_i64(s->T0, s->T1, s->T0);
-            tcg_gen_shl_i64(s->tmp0, s->T0, s->tmp0);
+            tcg_gen_shl_i64(cc_src, s->T0, tmp);
             tcg_gen_shl_i64(s->T0, s->T0, count);
-            tcg_gen_shri_i64(s->tmp0, s->tmp0, 32);
+            tcg_gen_shri_i64(cc_src, cc_src, 32);
             tcg_gen_shri_i64(s->T0, s->T0, 32);
         }
         break;
 #endif
     default:
-        tcg_gen_subi_tl(s->tmp0, count, 1);
+        hishift = tcg_temp_new();
+        tcg_gen_subi_tl(tmp, count, 1);
         if (is_right) {
-            tcg_gen_shr_tl(s->tmp0, s->T0, s->tmp0);
+            tcg_gen_shr_tl(cc_src, s->T0, tmp);
 
-            tcg_gen_subfi_tl(s->tmp4, mask + 1, count);
+            /* mask + 1 - count = mask - tmp = mask ^ tmp */
+            tcg_gen_xori_tl(hishift, tmp, mask);
             tcg_gen_shr_tl(s->T0, s->T0, count);
-            tcg_gen_shl_tl(s->T1, s->T1, s->tmp4);
+            tcg_gen_shl_tl(s->T1, s->T1, hishift);
         } else {
-            tcg_gen_shl_tl(s->tmp0, s->T0, s->tmp0);
+            tcg_gen_shl_tl(cc_src, s->T0, tmp);
+
             if (ot == MO_16) {
                 /* Only needed if count > 16, for Intel behaviour.  */
-                tcg_gen_subfi_tl(s->tmp4, 33, count);
-                tcg_gen_shr_tl(s->tmp4, s->T1, s->tmp4);
-                tcg_gen_or_tl(s->tmp0, s->tmp0, s->tmp4);
+                tcg_gen_subfi_tl(tmp, 33, count);
+                tcg_gen_shr_tl(tmp, s->T1, tmp);
+                tcg_gen_or_tl(cc_src, cc_src, tmp);
             }
 
-            tcg_gen_subfi_tl(s->tmp4, mask + 1, count);
+            /* mask + 1 - count = mask - tmp = mask ^ tmp */
+            tcg_gen_xori_tl(hishift, tmp, mask);
             tcg_gen_shl_tl(s->T0, s->T0, count);
-            tcg_gen_shr_tl(s->T1, s->T1, s->tmp4);
+            tcg_gen_shr_tl(s->T1, s->T1, hishift);
         }
-        tcg_gen_movi_tl(s->tmp4, 0);
-        tcg_gen_movcond_tl(TCG_COND_EQ, s->T1, count, s->tmp4,
-                           s->tmp4, s->T1);
+        tcg_gen_movcond_tl(TCG_COND_EQ, s->T1,
+                           count, tcg_constant_tl(0),
+                           tcg_constant_tl(0), s->T1);
         tcg_gen_or_tl(s->T0, s->T0, s->T1);
         break;
     }
+
+    return cc_src;
 }
 
 #define X86_MAX_INSN_LENGTH 15
@@ -3768,7 +3776,6 @@ static void i386_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cpu)
     dc->tmp1_i64 = tcg_temp_new_i64();
     dc->tmp2_i32 = tcg_temp_new_i32();
     dc->tmp3_i32 = tcg_temp_new_i32();
-    dc->tmp4 = tcg_temp_new();
     dc->cc_srcT = tcg_temp_new();
 }
 

From a440975cc33b48316f26d4ba0f1714375ff47738 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Thu, 13 Feb 2025 19:25:41 +0100
Subject: [PATCH 0013/2760] target/i386: tcg: remove subf from SHLD/SHRD
 expansion

It is computing 33-count but 32-count had just been used, so just shift
further by one.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/tcg/translate.c | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
index 5529327680..822dbb2e9a 100644
--- a/target/i386/tcg/translate.c
+++ b/target/i386/tcg/translate.c
@@ -1633,17 +1633,16 @@ static TCGv gen_shiftd_rm_T1(DisasContext *s, MemOp ot,
         } else {
             tcg_gen_shl_tl(cc_src, s->T0, tmp);
 
-            if (ot == MO_16) {
-                /* Only needed if count > 16, for Intel behaviour.  */
-                tcg_gen_subfi_tl(tmp, 33, count);
-                tcg_gen_shr_tl(tmp, s->T1, tmp);
-                tcg_gen_or_tl(cc_src, cc_src, tmp);
-            }
-
             /* mask + 1 - count = mask - tmp = mask ^ tmp */
             tcg_gen_xori_tl(hishift, tmp, mask);
             tcg_gen_shl_tl(s->T0, s->T0, count);
             tcg_gen_shr_tl(s->T1, s->T1, hishift);
+
+            if (ot == MO_16) {
+                /* Only needed if count > 16, for Intel behaviour.  */
+                tcg_gen_shri_tl(tmp, s->T1, 1);
+                tcg_gen_or_tl(cc_src, cc_src, tmp);
+            }
         }
         tcg_gen_movcond_tl(TCG_COND_EQ, s->T1,
                            count, tcg_constant_tl(0),

From d387eb7fa989f3397d681111324f6a54c1b32484 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Thu, 13 Feb 2025 19:30:20 +0100
Subject: [PATCH 0014/2760] target/i386: tcg: remove tmp0

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/tcg/emit.c.inc  | 20 ++++++++++----------
 target/i386/tcg/translate.c | 27 +++++++++++++++------------
 2 files changed, 25 insertions(+), 22 deletions(-)

diff --git a/target/i386/tcg/emit.c.inc b/target/i386/tcg/emit.c.inc
index a41afb7fe4..bd24438230 100644
--- a/target/i386/tcg/emit.c.inc
+++ b/target/i386/tcg/emit.c.inc
@@ -1710,22 +1710,22 @@ static void gen_CMPccXADD(DisasContext *s, X86DecodedInsn *decode)
     switch (jcc_op) {
     case JCC_O:
         /* (src1 ^ src2) & (src1 ^ dst). newv is only used here for a moment */
+        cmp_lhs = tcg_temp_new(), cmp_rhs = tcg_constant_tl(0);
         tcg_gen_xor_tl(newv, s->cc_srcT, s->T0);
-        tcg_gen_xor_tl(s->tmp0, s->cc_srcT, cmpv);
-        tcg_gen_and_tl(s->tmp0, s->tmp0, newv);
-        tcg_gen_sextract_tl(s->tmp0, s->tmp0, 0, 8 << ot);
-        cmp_lhs = s->tmp0, cmp_rhs = tcg_constant_tl(0);
+        tcg_gen_xor_tl(cmp_lhs, s->cc_srcT, cmpv);
+        tcg_gen_and_tl(cmp_lhs, cmp_lhs, newv);
+        tcg_gen_sextract_tl(cmp_lhs, cmp_lhs, 0, 8 << ot);
         break;
 
     case JCC_P:
-        tcg_gen_ext8u_tl(s->tmp0, s->T0);
-        tcg_gen_ctpop_tl(s->tmp0, s->tmp0);
-        cmp_lhs = s->tmp0, cmp_rhs = tcg_constant_tl(1);
+        cmp_lhs = tcg_temp_new(), cmp_rhs = tcg_constant_tl(1);
+        tcg_gen_ext8u_tl(cmp_lhs, s->T0);
+        tcg_gen_ctpop_tl(cmp_lhs, cmp_lhs);
         break;
 
     case JCC_S:
-        tcg_gen_sextract_tl(s->tmp0, s->T0, 0, 8 << ot);
-        cmp_lhs = s->tmp0, cmp_rhs = tcg_constant_tl(0);
+        cmp_lhs = tcg_temp_new(), cmp_rhs = tcg_constant_tl(0);
+        tcg_gen_sextract_tl(cmp_lhs, s->T0, 0, 8 << ot);
         break;
 
     default:
@@ -1876,7 +1876,7 @@ static void gen_CMPXCHG8B(DisasContext *s, X86DecodedInsn *decode)
                                       s->mem_index, MO_TEUQ);
     }
 
-    /* Set tmp0 to match the required value of Z. */
+    /* Compute the required value of Z. */
     tcg_gen_setcond_i64(TCG_COND_EQ, cmp, old, cmp);
     Z = tcg_temp_new();
     tcg_gen_trunc_i64_tl(Z, cmp);
diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
index 822dbb2e9a..5d433f8522 100644
--- a/target/i386/tcg/translate.c
+++ b/target/i386/tcg/translate.c
@@ -134,7 +134,6 @@ typedef struct DisasContext {
     TCGv T1;
 
     /* TCG local register indexes (only used inside old micro ops) */
-    TCGv tmp0;
     TCGv_i32 tmp2_i32;
     TCGv_i32 tmp3_i32;
     TCGv_i64 tmp1_i64;
@@ -2175,14 +2174,17 @@ static void gen_enter(DisasContext *s, int esp_addend, int level)
     level &= 31;
     if (level != 0) {
         int i;
+        if (level > 1) {
+            TCGv fp = tcg_temp_new();
 
-        /* Copy level-1 pointers from the previous frame.  */
-        for (i = 1; i < level; ++i) {
-            gen_lea_ss_ofs(s, s->A0, cpu_regs[R_EBP], -size * i);
-            gen_op_ld_v(s, d_ot, s->tmp0, s->A0);
+            /* Copy level-1 pointers from the previous frame.  */
+            for (i = 1; i < level; ++i) {
+                gen_lea_ss_ofs(s, s->A0, cpu_regs[R_EBP], -size * i);
+                gen_op_ld_v(s, d_ot, fp, s->A0);
 
-            gen_lea_ss_ofs(s, s->A0, s->T1, -size * i);
-            gen_op_st_v(s, d_ot, s->tmp0, s->A0);
+                gen_lea_ss_ofs(s, s->A0, s->T1, -size * i);
+                gen_op_st_v(s, d_ot, fp, s->A0);
+            }
         }
 
         /* Push the current FrameTemp as the last level.  */
@@ -2405,10 +2407,11 @@ static void gen_ldy_env_A0(DisasContext *s, int offset, bool align)
     int mem_index = s->mem_index;
     TCGv_i128 t0 = tcg_temp_new_i128();
     TCGv_i128 t1 = tcg_temp_new_i128();
+    TCGv a0_hi = tcg_temp_new();
 
     tcg_gen_qemu_ld_i128(t0, s->A0, mem_index, mop | (align ? MO_ALIGN_32 : 0));
-    tcg_gen_addi_tl(s->tmp0, s->A0, 16);
-    tcg_gen_qemu_ld_i128(t1, s->tmp0, mem_index, mop);
+    tcg_gen_addi_tl(a0_hi, s->A0, 16);
+    tcg_gen_qemu_ld_i128(t1, a0_hi, mem_index, mop);
 
     tcg_gen_st_i128(t0, tcg_env, offset + offsetof(YMMReg, YMM_X(0)));
     tcg_gen_st_i128(t1, tcg_env, offset + offsetof(YMMReg, YMM_X(1)));
@@ -2419,12 +2422,13 @@ static void gen_sty_env_A0(DisasContext *s, int offset, bool align)
     MemOp mop = MO_128 | MO_LE | MO_ATOM_IFALIGN_PAIR;
     int mem_index = s->mem_index;
     TCGv_i128 t = tcg_temp_new_i128();
+    TCGv a0_hi = tcg_temp_new();
 
     tcg_gen_ld_i128(t, tcg_env, offset + offsetof(YMMReg, YMM_X(0)));
     tcg_gen_qemu_st_i128(t, s->A0, mem_index, mop | (align ? MO_ALIGN_32 : 0));
-    tcg_gen_addi_tl(s->tmp0, s->A0, 16);
+    tcg_gen_addi_tl(a0_hi, s->A0, 16);
     tcg_gen_ld_i128(t, tcg_env, offset + offsetof(YMMReg, YMM_X(1)));
-    tcg_gen_qemu_st_i128(t, s->tmp0, mem_index, mop);
+    tcg_gen_qemu_st_i128(t, a0_hi, mem_index, mop);
 }
 
 #include "emit.c.inc"
@@ -3771,7 +3775,6 @@ static void i386_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cpu)
     dc->T1 = tcg_temp_new();
     dc->A0 = tcg_temp_new();
 
-    dc->tmp0 = tcg_temp_new();
     dc->tmp1_i64 = tcg_temp_new_i64();
     dc->tmp2_i32 = tcg_temp_new_i32();
     dc->tmp3_i32 = tcg_temp_new_i32();

From 9a688e70bdb2f23112afeddefd91bd45674d4db9 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Thu, 13 Feb 2025 18:51:34 +0100
Subject: [PATCH 0015/2760] target/i386: tcg: remove some more uses of
 temporaries

Remove all uses of 32-bit temporaries in emit.c.inc.  Remove uses
in translate.c outside the large multiplexed generator functions.
tmp3_i32 is not used anymore and can go away.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/tcg/emit.c.inc  | 83 +++++++++++++++++++++++--------------
 target/i386/tcg/translate.c | 43 +++++++++++--------
 2 files changed, 77 insertions(+), 49 deletions(-)

diff --git a/target/i386/tcg/emit.c.inc b/target/i386/tcg/emit.c.inc
index bd24438230..4e09e96fc1 100644
--- a/target/i386/tcg/emit.c.inc
+++ b/target/i386/tcg/emit.c.inc
@@ -1916,9 +1916,10 @@ static void gen_CPUID(DisasContext *s, X86DecodedInsn *decode)
 static void gen_CRC32(DisasContext *s, X86DecodedInsn *decode)
 {
     MemOp ot = decode->op[2].ot;
+    TCGv_i32 tmp = tcg_temp_new_i32();
 
-    tcg_gen_trunc_tl_i32(s->tmp2_i32, s->T0);
-    gen_helper_crc32(s->T0, s->tmp2_i32, s->T1, tcg_constant_i32(8 << ot));
+    tcg_gen_trunc_tl_i32(tmp, s->T0);
+    gen_helper_crc32(s->T0, tmp, s->T1, tcg_constant_i32(8 << ot));
 }
 
 static void gen_CVTPI2Px(DisasContext *s, X86DecodedInsn *decode)
@@ -2376,8 +2377,10 @@ static void gen_LAR(DisasContext *s, X86DecodedInsn *decode)
 
 static void gen_LDMXCSR(DisasContext *s, X86DecodedInsn *decode)
 {
-    tcg_gen_trunc_tl_i32(s->tmp2_i32, s->T0);
-    gen_helper_ldmxcsr(tcg_env, s->tmp2_i32);
+    TCGv_i32 tmp = tcg_temp_new_i32();
+
+    tcg_gen_trunc_tl_i32(tmp, s->T0);
+    gen_helper_ldmxcsr(tcg_env, tmp);
 }
 
 static void gen_lxx_seg(DisasContext *s, X86DecodedInsn *decode, int seg)
@@ -2590,11 +2593,13 @@ static void gen_MOVDQ(DisasContext *s, X86DecodedInsn *decode)
 static void gen_MOVMSK(DisasContext *s, X86DecodedInsn *decode)
 {
     typeof(gen_helper_movmskps_ymm) *ps, *pd, *fn;
+    TCGv_i32 tmp = tcg_temp_new_i32();
+
     ps = s->vex_l ? gen_helper_movmskps_ymm : gen_helper_movmskps_xmm;
     pd = s->vex_l ? gen_helper_movmskpd_ymm : gen_helper_movmskpd_xmm;
     fn = s->prefix & PREFIX_DATA ? pd : ps;
-    fn(s->tmp2_i32, tcg_env, OP_PTR2);
-    tcg_gen_extu_i32_tl(s->T0, s->tmp2_i32);
+    fn(tmp, tcg_env, OP_PTR2);
+    tcg_gen_extu_i32_tl(s->T0, tmp);
 }
 
 static void gen_MOVQ(DisasContext *s, X86DecodedInsn *decode)
@@ -2691,13 +2696,17 @@ static void gen_MULX(DisasContext *s, X86DecodedInsn *decode)
     switch (ot) {
     case MO_32:
 #ifdef TARGET_X86_64
-        tcg_gen_trunc_tl_i32(s->tmp2_i32, s->T0);
-        tcg_gen_trunc_tl_i32(s->tmp3_i32, s->T1);
-        tcg_gen_mulu2_i32(s->tmp2_i32, s->tmp3_i32,
-                          s->tmp2_i32, s->tmp3_i32);
-        tcg_gen_extu_i32_tl(cpu_regs[s->vex_v], s->tmp2_i32);
-        tcg_gen_extu_i32_tl(s->T0, s->tmp3_i32);
-        break;
+        {
+            TCGv_i32 t0 = tcg_temp_new_i32();
+            TCGv_i32 t1 = tcg_temp_new_i32();
+
+            tcg_gen_trunc_tl_i32(t0, s->T0);
+            tcg_gen_trunc_tl_i32(t1, s->T1);
+            tcg_gen_mulu2_i32(t0, t1, t0, t1);
+            tcg_gen_extu_i32_tl(cpu_regs[s->vex_v], t0);
+            tcg_gen_extu_i32_tl(s->T0, t1);
+            break;
+        }
 
     case MO_64:
 #endif
@@ -3741,10 +3750,14 @@ static void gen_RORX(DisasContext *s, X86DecodedInsn *decode)
     switch (ot) {
     case MO_32:
 #ifdef TARGET_X86_64
-        tcg_gen_trunc_tl_i32(s->tmp2_i32, s->T0);
-        tcg_gen_rotri_i32(s->tmp2_i32, s->tmp2_i32, b);
-        tcg_gen_extu_i32_tl(s->T0, s->tmp2_i32);
-        break;
+        {
+            TCGv_i32 tmp = tcg_temp_new_i32();
+
+            tcg_gen_trunc_tl_i32(tmp, s->T0);
+            tcg_gen_rotri_i32(tmp, tmp, b);
+            tcg_gen_extu_i32_tl(s->T0, tmp);
+            break;
+        }
 
     case MO_64:
 #endif
@@ -4334,7 +4347,7 @@ static void gen_VCVTSI2Sx(DisasContext *s, X86DecodedInsn *decode)
         }
         return;
     }
-    in = s->tmp2_i32;
+    in = tcg_temp_new_i32();
     tcg_gen_trunc_tl_i32(in, s->T1);
 #else
     in = s->T1;
@@ -4364,7 +4377,7 @@ static inline void gen_VCVTtSx2SI(DisasContext *s, X86DecodedInsn *decode,
         return;
     }
 
-    out = s->tmp2_i32;
+    out = tcg_temp_new_i32();
 #else
     out = s->T0;
 #endif
@@ -4416,7 +4429,7 @@ static void gen_VEXTRACTPS(DisasContext *s, X86DecodedInsn *decode)
     gen_pextr(s, decode, MO_32);
 }
 
-static void gen_vinsertps(DisasContext *s, X86DecodedInsn *decode)
+static void gen_vinsertps(DisasContext *s, X86DecodedInsn *decode, TCGv_i32 tmp)
 {
     int val = decode->immediate;
     int dest_word = (val >> 4) & 3;
@@ -4433,7 +4446,7 @@ static void gen_vinsertps(DisasContext *s, X86DecodedInsn *decode)
     }
 
     if (new_mask != (val & 15)) {
-        tcg_gen_st_i32(s->tmp2_i32, tcg_env,
+        tcg_gen_st_i32(tmp, tcg_env,
                        vector_elem_offset(&decode->op[0], MO_32, dest_word));
     }
 
@@ -4452,15 +4465,19 @@ static void gen_vinsertps(DisasContext *s, X86DecodedInsn *decode)
 static void gen_VINSERTPS_r(DisasContext *s, X86DecodedInsn *decode)
 {
     int val = decode->immediate;
-    tcg_gen_ld_i32(s->tmp2_i32, tcg_env,
+    TCGv_i32 tmp = tcg_temp_new_i32();
+
+    tcg_gen_ld_i32(tmp, tcg_env,
                    vector_elem_offset(&decode->op[2], MO_32, (val >> 6) & 3));
-    gen_vinsertps(s, decode);
+    gen_vinsertps(s, decode, tmp);
 }
 
 static void gen_VINSERTPS_m(DisasContext *s, X86DecodedInsn *decode)
 {
-    tcg_gen_qemu_ld_i32(s->tmp2_i32, s->A0, s->mem_index, MO_LEUL);
-    gen_vinsertps(s, decode);
+    TCGv_i32 tmp = tcg_temp_new_i32();
+
+    tcg_gen_qemu_ld_i32(tmp, s->A0, s->mem_index, MO_LEUL);
+    gen_vinsertps(s, decode, tmp);
 }
 
 static void gen_VINSERTx128(DisasContext *s, X86DecodedInsn *decode)
@@ -4581,25 +4598,29 @@ static void gen_VMOVSD_ld(DisasContext *s, X86DecodedInsn *decode)
 static void gen_VMOVSS(DisasContext *s, X86DecodedInsn *decode)
 {
     int vec_len = vector_len(s, decode);
+    TCGv_i32 tmp = tcg_temp_new_i32();
 
-    tcg_gen_ld_i32(s->tmp2_i32, OP_PTR2, offsetof(ZMMReg, ZMM_L(0)));
+    tcg_gen_ld_i32(tmp, OP_PTR2, offsetof(ZMMReg, ZMM_L(0)));
     tcg_gen_gvec_mov(MO_64, decode->op[0].offset, decode->op[1].offset, vec_len, vec_len);
-    tcg_gen_st_i32(s->tmp2_i32, OP_PTR0, offsetof(ZMMReg, ZMM_L(0)));
+    tcg_gen_st_i32(tmp, OP_PTR0, offsetof(ZMMReg, ZMM_L(0)));
 }
 
 static void gen_VMOVSS_ld(DisasContext *s, X86DecodedInsn *decode)
 {
     int vec_len = vector_len(s, decode);
+    TCGv_i32 tmp = tcg_temp_new_i32();
 
-    tcg_gen_qemu_ld_i32(s->tmp2_i32, s->A0, s->mem_index, MO_LEUL);
+    tcg_gen_qemu_ld_i32(tmp, s->A0, s->mem_index, MO_LEUL);
     tcg_gen_gvec_dup_imm(MO_64, decode->op[0].offset, vec_len, vec_len, 0);
-    tcg_gen_st_i32(s->tmp2_i32, OP_PTR0, offsetof(ZMMReg, ZMM_L(0)));
+    tcg_gen_st_i32(tmp, OP_PTR0, offsetof(ZMMReg, ZMM_L(0)));
 }
 
 static void gen_VMOVSS_st(DisasContext *s, X86DecodedInsn *decode)
 {
-    tcg_gen_ld_i32(s->tmp2_i32, OP_PTR2, offsetof(ZMMReg, ZMM_L(0)));
-    tcg_gen_qemu_st_i32(s->tmp2_i32, s->A0, s->mem_index, MO_LEUL);
+    TCGv_i32 tmp = tcg_temp_new_i32();
+
+    tcg_gen_ld_i32(tmp, OP_PTR2, offsetof(ZMMReg, ZMM_L(0)));
+    tcg_gen_qemu_st_i32(tmp, s->A0, s->mem_index, MO_LEUL);
 }
 
 static void gen_VPMASKMOV_st(DisasContext *s, X86DecodedInsn *decode)
diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
index 5d433f8522..abe210cc4e 100644
--- a/target/i386/tcg/translate.c
+++ b/target/i386/tcg/translate.c
@@ -135,7 +135,6 @@ typedef struct DisasContext {
 
     /* TCG local register indexes (only used inside old micro ops) */
     TCGv_i32 tmp2_i32;
-    TCGv_i32 tmp3_i32;
     TCGv_i64 tmp1_i64;
 
     sigjmp_buf jmpbuf;
@@ -1318,30 +1317,35 @@ static void gen_bpt_io(DisasContext *s, TCGv_i32 t_port, int ot)
 
 static void gen_ins(DisasContext *s, MemOp ot, TCGv dshift)
 {
+    TCGv_i32 port = tcg_temp_new_i32();
+
     gen_string_movl_A0_EDI(s);
     /* Note: we must do this dummy write first to be restartable in
        case of page fault. */
     tcg_gen_movi_tl(s->T0, 0);
     gen_op_st_v(s, ot, s->T0, s->A0);
-    tcg_gen_trunc_tl_i32(s->tmp2_i32, cpu_regs[R_EDX]);
-    tcg_gen_andi_i32(s->tmp2_i32, s->tmp2_i32, 0xffff);
-    gen_helper_in_func(ot, s->T0, s->tmp2_i32);
+    tcg_gen_trunc_tl_i32(port, cpu_regs[R_EDX]);
+    tcg_gen_andi_i32(port, port, 0xffff);
+    gen_helper_in_func(ot, s->T0, port);
     gen_op_st_v(s, ot, s->T0, s->A0);
     gen_op_add_reg(s, s->aflag, R_EDI, dshift);
-    gen_bpt_io(s, s->tmp2_i32, ot);
+    gen_bpt_io(s, port, ot);
 }
 
 static void gen_outs(DisasContext *s, MemOp ot, TCGv dshift)
 {
+    TCGv_i32 port = tcg_temp_new_i32();
+    TCGv_i32 value = tcg_temp_new_i32();
+
     gen_string_movl_A0_ESI(s);
     gen_op_ld_v(s, ot, s->T0, s->A0);
 
-    tcg_gen_trunc_tl_i32(s->tmp2_i32, cpu_regs[R_EDX]);
-    tcg_gen_andi_i32(s->tmp2_i32, s->tmp2_i32, 0xffff);
-    tcg_gen_trunc_tl_i32(s->tmp3_i32, s->T0);
-    gen_helper_out_func(ot, s->tmp2_i32, s->tmp3_i32);
+    tcg_gen_trunc_tl_i32(port, cpu_regs[R_EDX]);
+    tcg_gen_andi_i32(port, port, 0xffff);
+    tcg_gen_trunc_tl_i32(value, s->T0);
+    gen_helper_out_func(ot, port, value);
     gen_op_add_reg(s, s->aflag, R_ESI, dshift);
-    gen_bpt_io(s, s->tmp2_i32, ot);
+    gen_bpt_io(s, port, ot);
 }
 
 #define REP_MAX 65535
@@ -1869,14 +1873,16 @@ static void gen_bndck(DisasContext *s, X86DecodedInsn *decode,
                       TCGCond cond, TCGv_i64 bndv)
 {
     TCGv ea = gen_lea_modrm_1(s, decode->mem, false);
+    TCGv_i32 t32 = tcg_temp_new_i32();
+    TCGv_i64 t64 = tcg_temp_new_i64();
 
-    tcg_gen_extu_tl_i64(s->tmp1_i64, ea);
+    tcg_gen_extu_tl_i64(t64, ea);
     if (!CODE64(s)) {
-        tcg_gen_ext32u_i64(s->tmp1_i64, s->tmp1_i64);
+        tcg_gen_ext32u_i64(t64, t64);
     }
-    tcg_gen_setcond_i64(cond, s->tmp1_i64, s->tmp1_i64, bndv);
-    tcg_gen_extrl_i64_i32(s->tmp2_i32, s->tmp1_i64);
-    gen_helper_bndck(tcg_env, s->tmp2_i32);
+    tcg_gen_setcond_i64(cond, t64, t64, bndv);
+    tcg_gen_extrl_i64_i32(t32, t64);
+    gen_helper_bndck(tcg_env, t32);
 }
 
 /* generate modrm load of memory or register. */
@@ -2021,8 +2027,10 @@ static void gen_op_movl_seg_real(DisasContext *s, X86Seg seg_reg, TCGv seg)
 static void gen_movl_seg(DisasContext *s, X86Seg seg_reg, TCGv src)
 {
     if (PE(s) && !VM86(s)) {
-        tcg_gen_trunc_tl_i32(s->tmp2_i32, src);
-        gen_helper_load_seg(tcg_env, tcg_constant_i32(seg_reg), s->tmp2_i32);
+        TCGv_i32 sel = tcg_temp_new_i32();
+
+        tcg_gen_trunc_tl_i32(sel, src);
+        gen_helper_load_seg(tcg_env, tcg_constant_i32(seg_reg), sel);
         /* abort translation because the addseg value may change or
            because ss32 may change. For R_SS, translation must always
            stop as a special handling must be done to disable hardware
@@ -3777,7 +3785,6 @@ static void i386_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cpu)
 
     dc->tmp1_i64 = tcg_temp_new_i64();
     dc->tmp2_i32 = tcg_temp_new_i32();
-    dc->tmp3_i32 = tcg_temp_new_i32();
     dc->cc_srcT = tcg_temp_new();
 }
 

From 3fec86e95cd44ac7db639686ef1dda143af59aea Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Thu, 3 Apr 2025 14:06:37 +0200
Subject: [PATCH 0016/2760] target/i386: tcg: simplify computation of AF after
 INC/DEC

No difference in generated code, but the XOR-based formula is
easily understood on its own.  This will make more sense once
ADD/SUB stop using dst^src1^src2 to compute AF.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/tcg/cc_helper_template.h.inc | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/target/i386/tcg/cc_helper_template.h.inc b/target/i386/tcg/cc_helper_template.h.inc
index 9aff16b880..b821e5bca3 100644
--- a/target/i386/tcg/cc_helper_template.h.inc
+++ b/target/i386/tcg/cc_helper_template.h.inc
@@ -175,13 +175,10 @@ static uint32_t glue(compute_all_logic, SUFFIX)(DATA_TYPE dst, DATA_TYPE src1)
 static uint32_t glue(compute_all_inc, SUFFIX)(DATA_TYPE dst, DATA_TYPE src1)
 {
     uint32_t cf, pf, af, zf, sf, of;
-    DATA_TYPE src2;
 
     cf = src1;
-    src1 = dst - 1;
-    src2 = 1;
     pf = compute_pf(dst);
-    af = (dst ^ src1 ^ src2) & CC_A;
+    af = (dst ^ (dst - 1)) & CC_A; /* bits 0..3 are all clear */
     zf = (dst == 0) * CC_Z;
     sf = lshift(dst, 8 - DATA_BITS) & CC_S;
     of = (dst == SIGN_MASK) * CC_O;
@@ -191,13 +188,10 @@ static uint32_t glue(compute_all_inc, SUFFIX)(DATA_TYPE dst, DATA_TYPE src1)
 static uint32_t glue(compute_all_dec, SUFFIX)(DATA_TYPE dst, DATA_TYPE src1)
 {
     uint32_t cf, pf, af, zf, sf, of;
-    DATA_TYPE src2;
 
     cf = src1;
-    src1 = dst + 1;
-    src2 = 1;
     pf = compute_pf(dst);
-    af = (dst ^ src1 ^ src2) & CC_A;
+    af = (dst ^ (dst + 1)) & CC_A; /* bits 0..3 are all set */
     zf = (dst == 0) * CC_Z;
     sf = lshift(dst, 8 - DATA_BITS) & CC_S;
     of = (dst == SIGN_MASK - 1) * CC_O;

From 767149d3d078356073a32238b313cee9d02db5d8 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Thu, 20 Mar 2025 14:55:42 +0100
Subject: [PATCH 0017/2760] target/i386: emulate: microoptimize and explain
 ADD_COUT_VEC/SUB_COUT_VEC

The logic is the same, but the majority(NOT a, b, c) is brought out
to a separate macro and implemented without NOT operations.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/hvf/x86_flags.c | 26 +++++++++++++++++++++-----
 1 file changed, 21 insertions(+), 5 deletions(-)

diff --git a/target/i386/hvf/x86_flags.c b/target/i386/hvf/x86_flags.c
index fedc70a1b8..60ab4f01a2 100644
--- a/target/i386/hvf/x86_flags.c
+++ b/target/i386/hvf/x86_flags.c
@@ -45,14 +45,30 @@
 #define LF_MASK_CF     (0x01 << LF_BIT_CF)
 #define LF_MASK_PO     (0x01 << LF_BIT_PO)
 
+/* majority(NOT a, b, c) = (a ^ b) ? b : c */
+#define MAJ_INV1(a, b, c)  ((((a) ^ (b)) & ((b) ^ (c))) ^ (c))
+
+/*
+ * ADD_COUT_VEC(x, y) = majority((x + y) ^ x ^ y, x, y)
+ *
+ * If two corresponding bits in x and y are the same, that's the carry
+ * independent of the value (x+y)^x^y.  Hence x^y can be replaced with
+ * 1 in (x+y)^x^y, resulting in majority(NOT (x+y), x, y)
+ */
 #define ADD_COUT_VEC(op1, op2, result) \
-   (((op1) & (op2)) | (((op1) | (op2)) & (~(result))))
+   MAJ_INV1(result, op1, op2)
 
+/*
+ * SUB_COUT_VEC(x, y) = NOT majority(x, NOT y, (x - y) ^ x ^ NOT y)
+ *                    = majority(NOT x, y, (x - y) ^ x ^ y)
+ *
+ * Note that the carry out is actually a borrow, i.e. it is inverted.
+ * If two corresponding bits in x and y are different, the value of the
+ * bit in (x-y)^x^y likewise does not matter.  Hence, x^y can be replaced
+ * with 0 in (x-y)^x^y, resulting in majority(NOT x, y, x-y)
+ */
 #define SUB_COUT_VEC(op1, op2, result) \
-   (((~(op1)) & (op2)) | (((~(op1)) ^ (op2)) & (result)))
-
-#define GET_ADD_OVERFLOW(op1, op2, result, mask) \
-   ((((op1) ^ (result)) & ((op2) ^ (result))) & (mask))
+   MAJ_INV1(op1, op2, result)
 
 /* ******************* */
 /* OSZAPC */

From 5dcdbd071253e249a76c7771bcf78eca3763a131 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Thu, 3 Apr 2025 18:20:06 +0200
Subject: [PATCH 0018/2760] target/i386: tcg: use cout to commonize
 add/adc/sub/sbb cases

Use the carry-out vector as the basis to compute AF, CF and OF.  The cost
is pretty much the same, because the carry-out is just four boolean
operations, and the code is much smaller because add/adc/sub/sbb now
share most of it.

A similar algorithm to what is used in target/i386/emulate can also be
used for APX, in order to build the result of CCMP/CTEST with a new CC_OP_*.
CCMP needs to place into the flags from either a subtraction or a constant
value; CTEST likewise place into the flags either an AND or a constant
value.  The new CC_OP for CCMP and CTEST would store for a successful
predcate:

- in DST and SRC2, the result of the operation;

- in SRC, a carry-out vector for CCMP or zero for CTEST;

If the default flag value is used, DST/SRC/SRC2 can be filled with
constants:

- in DST the negated ZF;

- in SRC's top 2 bits, a value that results in the desired OF and CF;

- in SRC2 a suitable value (any of 0/1/~0/~1) that can be used
  instead of DST to compute the desired SF and PF.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.h                        | 25 ++++++++
 target/i386/hvf/x86_flags.c              | 25 --------
 target/i386/tcg/cc_helper_template.h.inc | 80 ++++++++----------------
 3 files changed, 52 insertions(+), 78 deletions(-)

diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index 76f24446a5..7a8d695bdb 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -2843,4 +2843,29 @@ static inline bool ctl_has_irq(CPUX86State *env)
 # define TARGET_VSYSCALL_PAGE  (UINT64_C(-10) << 20)
 #endif
 
+/* majority(NOT a, b, c) = (a ^ b) ? b : c */
+#define MAJ_INV1(a, b, c)  ((((a) ^ (b)) & ((b) ^ (c))) ^ (c))
+
+/*
+ * ADD_COUT_VEC(x, y) = majority((x + y) ^ x ^ y, x, y)
+ *
+ * If two corresponding bits in x and y are the same, that's the carry
+ * independent of the value (x+y)^x^y.  Hence x^y can be replaced with
+ * 1 in (x+y)^x^y, resulting in majority(NOT (x+y), x, y)
+ */
+#define ADD_COUT_VEC(op1, op2, result) \
+   MAJ_INV1(result, op1, op2)
+
+/*
+ * SUB_COUT_VEC(x, y) = NOT majority(x, NOT y, (x - y) ^ x ^ NOT y)
+ *                    = majority(NOT x, y, (x - y) ^ x ^ y)
+ *
+ * Note that the carry out is actually a borrow, i.e. it is inverted.
+ * If two corresponding bits in x and y are different, the value of the
+ * bit in (x-y)^x^y likewise does not matter.  Hence, x^y can be replaced
+ * with 0 in (x-y)^x^y, resulting in majority(NOT x, y, x-y)
+ */
+#define SUB_COUT_VEC(op1, op2, result) \
+   MAJ_INV1(op1, op2, result)
+
 #endif /* I386_CPU_H */
diff --git a/target/i386/hvf/x86_flags.c b/target/i386/hvf/x86_flags.c
index 60ab4f01a2..0c75e0419c 100644
--- a/target/i386/hvf/x86_flags.c
+++ b/target/i386/hvf/x86_flags.c
@@ -45,31 +45,6 @@
 #define LF_MASK_CF     (0x01 << LF_BIT_CF)
 #define LF_MASK_PO     (0x01 << LF_BIT_PO)
 
-/* majority(NOT a, b, c) = (a ^ b) ? b : c */
-#define MAJ_INV1(a, b, c)  ((((a) ^ (b)) & ((b) ^ (c))) ^ (c))
-
-/*
- * ADD_COUT_VEC(x, y) = majority((x + y) ^ x ^ y, x, y)
- *
- * If two corresponding bits in x and y are the same, that's the carry
- * independent of the value (x+y)^x^y.  Hence x^y can be replaced with
- * 1 in (x+y)^x^y, resulting in majority(NOT (x+y), x, y)
- */
-#define ADD_COUT_VEC(op1, op2, result) \
-   MAJ_INV1(result, op1, op2)
-
-/*
- * SUB_COUT_VEC(x, y) = NOT majority(x, NOT y, (x - y) ^ x ^ NOT y)
- *                    = majority(NOT x, y, (x - y) ^ x ^ y)
- *
- * Note that the carry out is actually a borrow, i.e. it is inverted.
- * If two corresponding bits in x and y are different, the value of the
- * bit in (x-y)^x^y likewise does not matter.  Hence, x^y can be replaced
- * with 0 in (x-y)^x^y, resulting in majority(NOT x, y, x-y)
- */
-#define SUB_COUT_VEC(op1, op2, result) \
-   MAJ_INV1(op1, op2, result)
-
 /* ******************* */
 /* OSZAPC */
 /* ******************* */
diff --git a/target/i386/tcg/cc_helper_template.h.inc b/target/i386/tcg/cc_helper_template.h.inc
index b821e5bca3..d8fd976ca1 100644
--- a/target/i386/tcg/cc_helper_template.h.inc
+++ b/target/i386/tcg/cc_helper_template.h.inc
@@ -44,18 +44,32 @@
 
 /* dynamic flags computation */
 
-static uint32_t glue(compute_all_add, SUFFIX)(DATA_TYPE dst, DATA_TYPE src1)
+static uint32_t glue(compute_all_cout, SUFFIX)(DATA_TYPE dst, DATA_TYPE carries)
 {
-    uint32_t cf, pf, af, zf, sf, of;
-    DATA_TYPE src2 = dst - src1;
+    uint32_t af_cf, pf, zf, sf, of;
 
-    cf = dst < src1;
+    /* PF, ZF, SF computed from result.  */
     pf = compute_pf(dst);
-    af = (dst ^ src1 ^ src2) & CC_A;
     zf = (dst == 0) * CC_Z;
     sf = lshift(dst, 8 - DATA_BITS) & CC_S;
-    of = lshift((src1 ^ src2 ^ -1) & (src1 ^ dst), 12 - DATA_BITS) & CC_O;
-    return cf + pf + af + zf + sf + of;
+
+    /*
+     * AF, CF, OF computed from carry out vector.  To compute AF and CF, rotate it
+     * left by one so cout(DATA_BITS - 1) is in bit 0 and cout(3) in bit 4.
+     *
+     * To compute OF, place the highest two carry bits into OF and the bit
+     * immediately to the right of it; then, adding CC_O / 2 XORs them.
+     */
+    af_cf = ((carries << 1) | (carries >> (DATA_BITS - 1))) & (CC_A | CC_C);
+    of = (lshift(carries, 12 - DATA_BITS) + CC_O / 2) & CC_O;
+    return pf + zf + sf + af_cf + of;
+}
+
+static uint32_t glue(compute_all_add, SUFFIX)(DATA_TYPE dst, DATA_TYPE src1)
+{
+    DATA_TYPE src2 = dst - src1;
+    DATA_TYPE carries = ADD_COUT_VEC(src1, src2, dst);
+    return glue(compute_all_cout, SUFFIX)(dst, carries);
 }
 
 static int glue(compute_c_add, SUFFIX)(DATA_TYPE dst, DATA_TYPE src1)
@@ -66,25 +80,9 @@ static int glue(compute_c_add, SUFFIX)(DATA_TYPE dst, DATA_TYPE src1)
 static uint32_t glue(compute_all_adc, SUFFIX)(DATA_TYPE dst, DATA_TYPE src1,
                                          DATA_TYPE src3)
 {
-    uint32_t cf, pf, af, zf, sf, of;
-
-#ifdef WIDER_TYPE
-    WIDER_TYPE src13 = (WIDER_TYPE) src1 + (WIDER_TYPE) src3;
-    DATA_TYPE src2 = dst - src13;
-
-    cf = dst < src13;
-#else
     DATA_TYPE src2 = dst - src1 - src3;
-
-    cf = (src3 ? dst <= src1 : dst < src1);
-#endif
-
-    pf = compute_pf(dst);
-    af = (dst ^ src1 ^ src2) & 0x10;
-    zf = (dst == 0) << 6;
-    sf = lshift(dst, 8 - DATA_BITS) & 0x80;
-    of = lshift((src1 ^ src2 ^ -1) & (src1 ^ dst), 12 - DATA_BITS) & CC_O;
-    return cf + pf + af + zf + sf + of;
+    DATA_TYPE carries = ADD_COUT_VEC(src1, src2, dst);
+    return glue(compute_all_cout, SUFFIX)(dst, carries);
 }
 
 static int glue(compute_c_adc, SUFFIX)(DATA_TYPE dst, DATA_TYPE src1,
@@ -101,16 +99,9 @@ static int glue(compute_c_adc, SUFFIX)(DATA_TYPE dst, DATA_TYPE src1,
 
 static uint32_t glue(compute_all_sub, SUFFIX)(DATA_TYPE dst, DATA_TYPE src2)
 {
-    uint32_t cf, pf, af, zf, sf, of;
     DATA_TYPE src1 = dst + src2;
-
-    cf = src1 < src2;
-    pf = compute_pf(dst);
-    af = (dst ^ src1 ^ src2) & CC_A;
-    zf = (dst == 0) * CC_Z;
-    sf = lshift(dst, 8 - DATA_BITS) & CC_S;
-    of = lshift((src1 ^ src2) & (src1 ^ dst), 12 - DATA_BITS) & CC_O;
-    return cf + pf + af + zf + sf + of;
+    DATA_TYPE carries = SUB_COUT_VEC(src1, src2, dst);
+    return glue(compute_all_cout, SUFFIX)(dst, carries);
 }
 
 static int glue(compute_c_sub, SUFFIX)(DATA_TYPE dst, DATA_TYPE src2)
@@ -123,25 +114,9 @@ static int glue(compute_c_sub, SUFFIX)(DATA_TYPE dst, DATA_TYPE src2)
 static uint32_t glue(compute_all_sbb, SUFFIX)(DATA_TYPE dst, DATA_TYPE src2,
                                          DATA_TYPE src3)
 {
-    uint32_t cf, pf, af, zf, sf, of;
-
-#ifdef WIDER_TYPE
-    WIDER_TYPE src23 = (WIDER_TYPE) src2 + (WIDER_TYPE) src3;
-    DATA_TYPE src1 = dst + src23;
-
-    cf = src1 < src23;
-#else
     DATA_TYPE src1 = dst + src2 + src3;
-
-    cf = (src3 ? src1 <= src2 : src1 < src2);
-#endif
-
-    pf = compute_pf(dst);
-    af = (dst ^ src1 ^ src2) & 0x10;
-    zf = (dst == 0) << 6;
-    sf = lshift(dst, 8 - DATA_BITS) & 0x80;
-    of = lshift((src1 ^ src2) & (src1 ^ dst), 12 - DATA_BITS) & CC_O;
-    return cf + pf + af + zf + sf + of;
+    DATA_TYPE carries = SUB_COUT_VEC(src1, src2, dst);
+    return glue(compute_all_cout, SUFFIX)(dst, carries);
 }
 
 static int glue(compute_c_sbb, SUFFIX)(DATA_TYPE dst, DATA_TYPE src2,
@@ -286,6 +261,5 @@ static int glue(compute_c_blsi, SUFFIX)(DATA_TYPE dst, DATA_TYPE src1)
 #undef DATA_BITS
 #undef SIGN_MASK
 #undef DATA_TYPE
-#undef DATA_MASK
 #undef SUFFIX
 #undef WIDER_TYPE

From 26a44d9d2d4296701ceebc1085ab28171a1e7e3b Mon Sep 17 00:00:00 2001
From: Wei Liu <liuwe@linux.microsoft.com>
Date: Fri, 7 Mar 2025 11:55:12 -0800
Subject: [PATCH 0019/2760] target/i386/hvf: introduce x86_emul_ops

This will be used to remove HVF specific code from the instruction emulator.

For now we only introduce two hooks for x86_decode.c. More hooks will be added
when the code is refactored.

The emulator initialization function now takes in a pointer to the ops structure.

Signed-off-by: Wei Liu <liuwe@linux.microsoft.com>
Link: https://lore.kernel.org/r/1741377325-28175-2-git-send-email-liuwe@linux.microsoft.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/hvf/hvf.c     | 20 +++++++++++++++++++-
 target/i386/hvf/x86_emu.c |  5 ++++-
 target/i386/hvf/x86_emu.h | 10 +++++++++-
 3 files changed, 32 insertions(+), 3 deletions(-)

diff --git a/target/i386/hvf/hvf.c b/target/i386/hvf/hvf.c
index 9ba0e04ac7..03456ffbc7 100644
--- a/target/i386/hvf/hvf.c
+++ b/target/i386/hvf/hvf.c
@@ -229,6 +229,24 @@ hv_return_t hvf_arch_vm_create(MachineState *ms, uint32_t pa_range)
     return hv_vm_create(HV_VM_DEFAULT);
 }
 
+static void hvf_read_segment_descriptor(CPUState *s, struct x86_segment_descriptor *desc,
+                                        X86Seg seg)
+{
+    struct vmx_segment vmx_segment;
+    vmx_read_segment_descriptor(s, &vmx_segment, seg);
+    vmx_segment_to_x86_descriptor(s, &vmx_segment, desc);
+}
+
+static void hvf_read_mem(CPUState *cpu, void *data, target_ulong gva, int bytes)
+{
+    vmx_read_mem(cpu, data, gva, bytes);
+}
+
+static const struct x86_emul_ops hvf_x86_emul_ops = {
+    .read_mem = hvf_read_mem,
+    .read_segment_descriptor = hvf_read_segment_descriptor,
+};
+
 int hvf_arch_init_vcpu(CPUState *cpu)
 {
     X86CPU *x86cpu = X86_CPU(cpu);
@@ -237,7 +255,7 @@ int hvf_arch_init_vcpu(CPUState *cpu)
     int r;
     uint64_t reqCap;
 
-    init_emu();
+    init_emu(&hvf_x86_emul_ops);
     init_decoder();
 
     if (hvf_state->hvf_caps == NULL) {
diff --git a/target/i386/hvf/x86_emu.c b/target/i386/hvf/x86_emu.c
index ebba80a36b..c15b5a7ca8 100644
--- a/target/i386/hvf/x86_emu.c
+++ b/target/i386/hvf/x86_emu.c
@@ -1231,6 +1231,8 @@ static struct cmd_handler {
 
 static struct cmd_handler _cmd_handler[X86_DECODE_CMD_LAST];
 
+const struct x86_emul_ops *emul_ops;
+
 static void init_cmd_handler(void)
 {
     int i;
@@ -1253,7 +1255,8 @@ bool exec_instruction(CPUX86State *env, struct x86_decode *ins)
     return true;
 }
 
-void init_emu(void)
+void init_emu(const struct x86_emul_ops *o)
 {
+    emul_ops = o;
     init_cmd_handler();
 }
diff --git a/target/i386/hvf/x86_emu.h b/target/i386/hvf/x86_emu.h
index bc0fc72c76..1422d06ea1 100644
--- a/target/i386/hvf/x86_emu.h
+++ b/target/i386/hvf/x86_emu.h
@@ -23,7 +23,15 @@
 #include "x86_decode.h"
 #include "cpu.h"
 
-void init_emu(void);
+struct x86_emul_ops {
+    void (*read_mem)(CPUState *cpu, void *data, target_ulong addr, int bytes);
+    void (*read_segment_descriptor)(CPUState *cpu, struct x86_segment_descriptor *desc,
+                                    enum X86Seg seg);
+};
+
+extern const struct x86_emul_ops *emul_ops;
+
+void init_emu(const struct x86_emul_ops *ops);
 bool exec_instruction(CPUX86State *env, struct x86_decode *ins);
 void x86_emul_raise_exception(CPUX86State *env, int exception_index, int error_code);
 

From 0860abbe849e7345fee28c08fa200f7cc315f175 Mon Sep 17 00:00:00 2001
From: Wei Liu <liuwe@linux.microsoft.com>
Date: Fri, 7 Mar 2025 11:55:13 -0800
Subject: [PATCH 0020/2760] target/i386/hvf: remove HVF specific calls from
 x86_decode.c

Use the newly defined emul_ops. This allows the module to be reused
by other accelerator in the future.

No functional change intended.

Signed-off-by: Wei Liu <liuwe@linux.microsoft.com>
Link: https://lore.kernel.org/r/1741377325-28175-3-git-send-email-liuwe@linux.microsoft.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/hvf/x86_decode.c | 19 ++++++-------------
 1 file changed, 6 insertions(+), 13 deletions(-)

diff --git a/target/i386/hvf/x86_decode.c b/target/i386/hvf/x86_decode.c
index 5fea2dd3cc..728e159638 100644
--- a/target/i386/hvf/x86_decode.c
+++ b/target/i386/hvf/x86_decode.c
@@ -21,6 +21,7 @@
 #include "panic.h"
 #include "x86_decode.h"
 #include "vmx.h"
+#include "x86_emu.h"
 #include "x86_mmu.h"
 #include "x86_descr.h"
 
@@ -74,7 +75,7 @@ static inline uint64_t decode_bytes(CPUX86State *env, struct x86_decode *decode,
         break;
     }
     target_ulong va  = linear_rip(env_cpu(env), env->eip) + decode->len;
-    vmx_read_mem(env_cpu(env), &val, va, size);
+    emul_ops->read_mem(env_cpu(env), &val, va, size);
     decode->len += size;
     
     return val;
@@ -1893,16 +1894,6 @@ static void decode_prefix(CPUX86State *env, struct x86_decode *decode)
     }
 }
 
-static struct x86_segment_descriptor get_cs_descriptor(CPUState *s)
-{
-    struct vmx_segment vmx_cs;
-    x86_segment_descriptor cs;
-    vmx_read_segment_descriptor(s, &vmx_cs, R_CS);
-    vmx_segment_to_x86_descriptor(s, &vmx_cs, &cs);
-
-    return cs;
-}
-
 void set_addressing_size(CPUX86State *env, struct x86_decode *decode)
 {
     decode->addressing_size = -1;
@@ -1914,7 +1905,8 @@ void set_addressing_size(CPUX86State *env, struct x86_decode *decode)
         }
     } else if (!x86_is_long_mode(env_cpu(env))) {
         /* protected */
-        x86_segment_descriptor cs = get_cs_descriptor(env_cpu(env));
+        x86_segment_descriptor cs;
+        emul_ops->read_segment_descriptor(env_cpu(env), &cs, R_CS);
         /* check db */
         if (cs.db) {
             if (decode->addr_size_override) {
@@ -1950,7 +1942,8 @@ void set_operand_size(CPUX86State *env, struct x86_decode *decode)
         }
     } else if (!x86_is_long_mode(env_cpu(env))) {
         /* protected */
-        x86_segment_descriptor cs = get_cs_descriptor(env_cpu(env));
+        x86_segment_descriptor cs;
+        emul_ops->read_segment_descriptor(env_cpu(env), &cs, R_CS);
         /* check db */
         if (cs.db) {
             if (decode->op_size_override) {

From 444bae08bbdae175b14cc96a11af8640eb262963 Mon Sep 17 00:00:00 2001
From: Wei Liu <liuwe@linux.microsoft.com>
Date: Fri, 7 Mar 2025 11:55:14 -0800
Subject: [PATCH 0021/2760] target/i386/hvf: provide and use handle_io in
 emul_ops

This drops the calls to hvf_handle_io from x86_emu.c.

Signed-off-by: Wei Liu <liuwe@linux.microsoft.com>
Link: https://lore.kernel.org/r/1741377325-28175-4-git-send-email-liuwe@linux.microsoft.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/hvf/hvf.c     |  1 +
 target/i386/hvf/x86_emu.c | 29 +++++++++++++++--------------
 target/i386/hvf/x86_emu.h |  2 ++
 3 files changed, 18 insertions(+), 14 deletions(-)

diff --git a/target/i386/hvf/hvf.c b/target/i386/hvf/hvf.c
index 03456ffbc7..7da03f9c08 100644
--- a/target/i386/hvf/hvf.c
+++ b/target/i386/hvf/hvf.c
@@ -245,6 +245,7 @@ static void hvf_read_mem(CPUState *cpu, void *data, target_ulong gva, int bytes)
 static const struct x86_emul_ops hvf_x86_emul_ops = {
     .read_mem = hvf_read_mem,
     .read_segment_descriptor = hvf_read_segment_descriptor,
+    .handle_io = hvf_handle_io,
 };
 
 int hvf_arch_init_vcpu(CPUState *cpu)
diff --git a/target/i386/hvf/x86_emu.c b/target/i386/hvf/x86_emu.c
index c15b5a7ca8..7b01ccde5d 100644
--- a/target/i386/hvf/x86_emu.c
+++ b/target/i386/hvf/x86_emu.c
@@ -396,18 +396,18 @@ static void exec_out(CPUX86State *env, struct x86_decode *decode)
 {
     switch (decode->opcode[0]) {
     case 0xe6:
-        hvf_handle_io(env_cpu(env), decode->op[0].val, &AL(env), 1, 1, 1);
+        emul_ops->handle_io(env_cpu(env), decode->op[0].val, &AL(env), 1, 1, 1);
         break;
     case 0xe7:
-        hvf_handle_io(env_cpu(env), decode->op[0].val, &RAX(env), 1,
-                      decode->operand_size, 1);
+        emul_ops->handle_io(env_cpu(env), decode->op[0].val, &RAX(env), 1,
+                            decode->operand_size, 1);
         break;
     case 0xee:
-        hvf_handle_io(env_cpu(env), DX(env), &AL(env), 1, 1, 1);
+        emul_ops->handle_io(env_cpu(env), DX(env), &AL(env), 1, 1, 1);
         break;
     case 0xef:
-        hvf_handle_io(env_cpu(env), DX(env), &RAX(env), 1,
-                      decode->operand_size, 1);
+        emul_ops->handle_io(env_cpu(env), DX(env), &RAX(env), 1,
+                            decode->operand_size, 1);
         break;
     default:
         VM_PANIC("Bad out opcode\n");
@@ -421,10 +421,10 @@ static void exec_in(CPUX86State *env, struct x86_decode *decode)
     target_ulong val = 0;
     switch (decode->opcode[0]) {
     case 0xe4:
-        hvf_handle_io(env_cpu(env), decode->op[0].val, &AL(env), 0, 1, 1);
+        emul_ops->handle_io(env_cpu(env), decode->op[0].val, &AL(env), 0, 1, 1);
         break;
     case 0xe5:
-        hvf_handle_io(env_cpu(env), decode->op[0].val, &val, 0,
+        emul_ops->handle_io(env_cpu(env), decode->op[0].val, &val, 0,
                       decode->operand_size, 1);
         if (decode->operand_size == 2) {
             AX(env) = val;
@@ -433,10 +433,11 @@ static void exec_in(CPUX86State *env, struct x86_decode *decode)
         }
         break;
     case 0xec:
-        hvf_handle_io(env_cpu(env), DX(env), &AL(env), 0, 1, 1);
+        emul_ops->handle_io(env_cpu(env), DX(env), &AL(env), 0, 1, 1);
         break;
     case 0xed:
-        hvf_handle_io(env_cpu(env), DX(env), &val, 0, decode->operand_size, 1);
+        emul_ops->handle_io(env_cpu(env), DX(env), &val, 0,
+                            decode->operand_size, 1);
         if (decode->operand_size == 2) {
             AX(env) = val;
         } else {
@@ -486,8 +487,8 @@ static void exec_ins_single(CPUX86State *env, struct x86_decode *decode)
     target_ulong addr = linear_addr_size(env_cpu(env), RDI(env),
                                          decode->addressing_size, R_ES);
 
-    hvf_handle_io(env_cpu(env), DX(env), env->hvf_mmio_buf, 0,
-                  decode->operand_size, 1);
+    emul_ops->handle_io(env_cpu(env), DX(env), env->hvf_mmio_buf, 0,
+                        decode->operand_size, 1);
     vmx_write_mem(env_cpu(env), addr, env->hvf_mmio_buf,
                   decode->operand_size);
 
@@ -511,8 +512,8 @@ static void exec_outs_single(CPUX86State *env, struct x86_decode *decode)
 
     vmx_read_mem(env_cpu(env), env->hvf_mmio_buf, addr,
                  decode->operand_size);
-    hvf_handle_io(env_cpu(env), DX(env), env->hvf_mmio_buf, 1,
-                  decode->operand_size, 1);
+    emul_ops->handle_io(env_cpu(env), DX(env), env->hvf_mmio_buf, 1,
+                        decode->operand_size, 1);
 
     string_increment_reg(env, R_ESI, decode);
 }
diff --git a/target/i386/hvf/x86_emu.h b/target/i386/hvf/x86_emu.h
index 1422d06ea1..40cc786694 100644
--- a/target/i386/hvf/x86_emu.h
+++ b/target/i386/hvf/x86_emu.h
@@ -27,6 +27,8 @@ struct x86_emul_ops {
     void (*read_mem)(CPUState *cpu, void *data, target_ulong addr, int bytes);
     void (*read_segment_descriptor)(CPUState *cpu, struct x86_segment_descriptor *desc,
                                     enum X86Seg seg);
+    void (*handle_io)(CPUState *cpu, uint16_t port, void *data, int direction,
+                      int size, int count);
 };
 
 extern const struct x86_emul_ops *emul_ops;

From e9c40026b641da21c96c877153cbe08706b2aac9 Mon Sep 17 00:00:00 2001
From: Wei Liu <liuwe@linux.microsoft.com>
Date: Fri, 7 Mar 2025 11:55:15 -0800
Subject: [PATCH 0022/2760] target/i386: rename hvf_mmio_buf to emu_mmio_buf

We want to refactor HVF's instruction emulator to a common component. Renaming
hvf_mmio_buf removes the association between HVF and the instruction emulator.

The definition of the field is still guarded by CONFIG_HVF for now, since it is
the only user.

No functional change.

Signed-off-by: Wei Liu <liuwe@linux.microsoft.com>
Link: https://lore.kernel.org/r/1741377325-28175-5-git-send-email-liuwe@linux.microsoft.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.h         |  2 +-
 target/i386/hvf/hvf.c     |  4 ++--
 target/i386/hvf/x86_emu.c | 12 ++++++------
 3 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index 7a8d695bdb..3c5c39ce3d 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -2109,7 +2109,7 @@ typedef struct CPUArchState {
 #endif
 #if defined(CONFIG_HVF)
     HVFX86LazyFlags hvf_lflags;
-    void *hvf_mmio_buf;
+    void *emu_mmio_buf;
 #endif
 
     uint64_t mcg_cap;
diff --git a/target/i386/hvf/hvf.c b/target/i386/hvf/hvf.c
index 7da03f9c08..1cecb76595 100644
--- a/target/i386/hvf/hvf.c
+++ b/target/i386/hvf/hvf.c
@@ -168,7 +168,7 @@ void hvf_arch_vcpu_destroy(CPUState *cpu)
     X86CPU *x86_cpu = X86_CPU(cpu);
     CPUX86State *env = &x86_cpu->env;
 
-    g_free(env->hvf_mmio_buf);
+    g_free(env->emu_mmio_buf);
 }
 
 static void init_tsc_freq(CPUX86State *env)
@@ -262,7 +262,7 @@ int hvf_arch_init_vcpu(CPUState *cpu)
     if (hvf_state->hvf_caps == NULL) {
         hvf_state->hvf_caps = g_new0(struct hvf_vcpu_caps, 1);
     }
-    env->hvf_mmio_buf = g_new(char, 4096);
+    env->emu_mmio_buf = g_new(char, 4096);
 
     if (x86cpu->vmware_cpuid_freq) {
         init_tsc_freq(env);
diff --git a/target/i386/hvf/x86_emu.c b/target/i386/hvf/x86_emu.c
index 7b01ccde5d..e59a73e00d 100644
--- a/target/i386/hvf/x86_emu.c
+++ b/target/i386/hvf/x86_emu.c
@@ -184,8 +184,8 @@ void write_val_ext(CPUX86State *env, target_ulong ptr, target_ulong val, int siz
 
 uint8_t *read_mmio(CPUX86State *env, target_ulong ptr, int bytes)
 {
-    vmx_read_mem(env_cpu(env), env->hvf_mmio_buf, ptr, bytes);
-    return env->hvf_mmio_buf;
+    vmx_read_mem(env_cpu(env), env->emu_mmio_buf, ptr, bytes);
+    return env->emu_mmio_buf;
 }
 
 
@@ -487,9 +487,9 @@ static void exec_ins_single(CPUX86State *env, struct x86_decode *decode)
     target_ulong addr = linear_addr_size(env_cpu(env), RDI(env),
                                          decode->addressing_size, R_ES);
 
-    emul_ops->handle_io(env_cpu(env), DX(env), env->hvf_mmio_buf, 0,
+    emul_ops->handle_io(env_cpu(env), DX(env), env->emu_mmio_buf, 0,
                         decode->operand_size, 1);
-    vmx_write_mem(env_cpu(env), addr, env->hvf_mmio_buf,
+    vmx_write_mem(env_cpu(env), addr, env->emu_mmio_buf,
                   decode->operand_size);
 
     string_increment_reg(env, R_EDI, decode);
@@ -510,9 +510,9 @@ static void exec_outs_single(CPUX86State *env, struct x86_decode *decode)
 {
     target_ulong addr = decode_linear_addr(env, decode, RSI(env), R_DS);
 
-    vmx_read_mem(env_cpu(env), env->hvf_mmio_buf, addr,
+    vmx_read_mem(env_cpu(env), env->emu_mmio_buf, addr,
                  decode->operand_size);
-    emul_ops->handle_io(env_cpu(env), DX(env), env->hvf_mmio_buf, 1,
+    emul_ops->handle_io(env_cpu(env), DX(env), env->emu_mmio_buf, 1,
                         decode->operand_size, 1);
 
     string_increment_reg(env, R_ESI, decode);

From ae3c6134ecb4c7d3ba1c6bae3ff5b5dd6cf05d56 Mon Sep 17 00:00:00 2001
From: Wei Liu <liuwe@linux.microsoft.com>
Date: Fri, 7 Mar 2025 11:55:16 -0800
Subject: [PATCH 0023/2760] target/i386/hvf: use emul_ops->read_mem in
 x86_emu.c

No functional change.

Signed-off-by: Wei Liu <liuwe@linux.microsoft.com>
Link: https://lore.kernel.org/r/1741377325-28175-6-git-send-email-liuwe@linux.microsoft.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/hvf/x86_emu.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/target/i386/hvf/x86_emu.c b/target/i386/hvf/x86_emu.c
index e59a73e00d..7b816b5a1d 100644
--- a/target/i386/hvf/x86_emu.c
+++ b/target/i386/hvf/x86_emu.c
@@ -184,7 +184,7 @@ void write_val_ext(CPUX86State *env, target_ulong ptr, target_ulong val, int siz
 
 uint8_t *read_mmio(CPUX86State *env, target_ulong ptr, int bytes)
 {
-    vmx_read_mem(env_cpu(env), env->emu_mmio_buf, ptr, bytes);
+    emul_ops->read_mem(env_cpu(env), env->emu_mmio_buf, ptr, bytes);
     return env->emu_mmio_buf;
 }
 
@@ -510,8 +510,8 @@ static void exec_outs_single(CPUX86State *env, struct x86_decode *decode)
 {
     target_ulong addr = decode_linear_addr(env, decode, RSI(env), R_DS);
 
-    vmx_read_mem(env_cpu(env), env->emu_mmio_buf, addr,
-                 decode->operand_size);
+    emul_ops->read_mem(env_cpu(env), env->emu_mmio_buf, addr,
+                       decode->operand_size);
     emul_ops->handle_io(env_cpu(env), DX(env), env->emu_mmio_buf, 1,
                         decode->operand_size, 1);
 
@@ -620,7 +620,7 @@ static void exec_scas_single(CPUX86State *env, struct x86_decode *decode)
     addr = linear_addr_size(env_cpu(env), RDI(env),
                             decode->addressing_size, R_ES);
     decode->op[1].type = X86_VAR_IMMEDIATE;
-    vmx_read_mem(env_cpu(env), &decode->op[1].val, addr, decode->operand_size);
+    emul_ops->read_mem(env_cpu(env), &decode->op[1].val, addr, decode->operand_size);
 
     EXEC_2OP_FLAGS_CMD(env, decode, -, SET_FLAGS_OSZAPC_SUB, false);
     string_increment_reg(env, R_EDI, decode);
@@ -645,7 +645,7 @@ static void exec_lods_single(CPUX86State *env, struct x86_decode *decode)
     target_ulong val = 0;
 
     addr = decode_linear_addr(env, decode, RSI(env), R_DS);
-    vmx_read_mem(env_cpu(env), &val, addr,  decode->operand_size);
+    emul_ops->read_mem(env_cpu(env), &val, addr,  decode->operand_size);
     write_reg(env, R_EAX, val, decode->operand_size);
 
     string_increment_reg(env, R_ESI, decode);

From 63d8bc669302ec22bd394c45380848a2d5947943 Mon Sep 17 00:00:00 2001
From: Wei Liu <liuwe@linux.microsoft.com>
Date: Fri, 7 Mar 2025 11:55:17 -0800
Subject: [PATCH 0024/2760] target/i386/hvf: provide and use write_mem in
 emul_ops

Signed-off-by: Wei Liu <liuwe@linux.microsoft.com>
Link: https://lore.kernel.org/r/1741377325-28175-7-git-send-email-liuwe@linux.microsoft.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/hvf/hvf.c     | 6 ++++++
 target/i386/hvf/x86_emu.c | 8 ++++----
 target/i386/hvf/x86_emu.h | 1 +
 3 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/target/i386/hvf/hvf.c b/target/i386/hvf/hvf.c
index 1cecb76595..e4f48a79fb 100644
--- a/target/i386/hvf/hvf.c
+++ b/target/i386/hvf/hvf.c
@@ -242,8 +242,14 @@ static void hvf_read_mem(CPUState *cpu, void *data, target_ulong gva, int bytes)
     vmx_read_mem(cpu, data, gva, bytes);
 }
 
+static void hvf_write_mem(CPUState *cpu, void *data, target_ulong gva, int bytes)
+{
+    vmx_write_mem(cpu, gva, data, bytes);
+}
+
 static const struct x86_emul_ops hvf_x86_emul_ops = {
     .read_mem = hvf_read_mem,
+    .write_mem = hvf_write_mem,
     .read_segment_descriptor = hvf_read_segment_descriptor,
     .handle_io = hvf_handle_io,
 };
diff --git a/target/i386/hvf/x86_emu.c b/target/i386/hvf/x86_emu.c
index 7b816b5a1d..3ff41c35d8 100644
--- a/target/i386/hvf/x86_emu.c
+++ b/target/i386/hvf/x86_emu.c
@@ -179,7 +179,7 @@ void write_val_ext(CPUX86State *env, target_ulong ptr, target_ulong val, int siz
         write_val_to_reg(ptr, val, size);
         return;
     }
-    vmx_write_mem(env_cpu(env), ptr, &val, size);
+    emul_ops->write_mem(env_cpu(env), &val, ptr, size);
 }
 
 uint8_t *read_mmio(CPUX86State *env, target_ulong ptr, int bytes)
@@ -489,8 +489,8 @@ static void exec_ins_single(CPUX86State *env, struct x86_decode *decode)
 
     emul_ops->handle_io(env_cpu(env), DX(env), env->emu_mmio_buf, 0,
                         decode->operand_size, 1);
-    vmx_write_mem(env_cpu(env), addr, env->emu_mmio_buf,
-                  decode->operand_size);
+    emul_ops->write_mem(env_cpu(env), env->emu_mmio_buf, addr,
+                        decode->operand_size);
 
     string_increment_reg(env, R_EDI, decode);
 }
@@ -596,7 +596,7 @@ static void exec_stos_single(CPUX86State *env, struct x86_decode *decode)
     addr = linear_addr_size(env_cpu(env), RDI(env),
                             decode->addressing_size, R_ES);
     val = read_reg(env, R_EAX, decode->operand_size);
-    vmx_write_mem(env_cpu(env), addr, &val, decode->operand_size);
+    emul_ops->write_mem(env_cpu(env), &val, addr, decode->operand_size);
 
     string_increment_reg(env, R_EDI, decode);
 }
diff --git a/target/i386/hvf/x86_emu.h b/target/i386/hvf/x86_emu.h
index 40cc786694..107c1f1ac8 100644
--- a/target/i386/hvf/x86_emu.h
+++ b/target/i386/hvf/x86_emu.h
@@ -25,6 +25,7 @@
 
 struct x86_emul_ops {
     void (*read_mem)(CPUState *cpu, void *data, target_ulong addr, int bytes);
+    void (*write_mem)(CPUState *cpu, void *data, target_ulong addr, int bytes);
     void (*read_segment_descriptor)(CPUState *cpu, struct x86_segment_descriptor *desc,
                                     enum X86Seg seg);
     void (*handle_io)(CPUState *cpu, uint16_t port, void *data, int direction,

From 585678640c778ee35a86638eacb22372bda70ee1 Mon Sep 17 00:00:00 2001
From: Wei Liu <liuwe@linux.microsoft.com>
Date: Fri, 7 Mar 2025 11:55:18 -0800
Subject: [PATCH 0025/2760] target/i386/hvf: provide and use simulate_{wrmsr,
 rdmsr} in emul_ops

Change the first argument's type to be CPUState to match other hooks.

Signed-off-by: Wei Liu <liuwe@linux.microsoft.com>
Link: https://lore.kernel.org/r/1741377325-28175-8-git-send-email-liuwe@linux.microsoft.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/hvf/hvf-i386.h |  4 ++--
 target/i386/hvf/hvf.c      | 18 ++++++++++--------
 target/i386/hvf/x86_emu.c  |  4 ++--
 target/i386/hvf/x86_emu.h  |  2 ++
 4 files changed, 16 insertions(+), 12 deletions(-)

diff --git a/target/i386/hvf/hvf-i386.h b/target/i386/hvf/hvf-i386.h
index 044ad236ae..8c42ae6b01 100644
--- a/target/i386/hvf/hvf-i386.h
+++ b/target/i386/hvf/hvf-i386.h
@@ -19,8 +19,8 @@
 uint32_t hvf_get_supported_cpuid(uint32_t func, uint32_t idx, int reg);
 
 void hvf_handle_io(CPUState *, uint16_t, void *, int, int, int);
-void hvf_simulate_rdmsr(CPUX86State *env);
-void hvf_simulate_wrmsr(CPUX86State *env);
+void hvf_simulate_rdmsr(CPUState *cpu);
+void hvf_simulate_wrmsr(CPUState *cpu);
 
 /* Host specific functions */
 int hvf_inject_interrupt(CPUArchState *env, int vector);
diff --git a/target/i386/hvf/hvf.c b/target/i386/hvf/hvf.c
index e4f48a79fb..8c31d2e0cf 100644
--- a/target/i386/hvf/hvf.c
+++ b/target/i386/hvf/hvf.c
@@ -252,6 +252,8 @@ static const struct x86_emul_ops hvf_x86_emul_ops = {
     .write_mem = hvf_write_mem,
     .read_segment_descriptor = hvf_read_segment_descriptor,
     .handle_io = hvf_handle_io,
+    .simulate_rdmsr = hvf_simulate_rdmsr,
+    .simulate_wrmsr = hvf_simulate_wrmsr,
 };
 
 int hvf_arch_init_vcpu(CPUState *cpu)
@@ -506,10 +508,10 @@ void hvf_store_regs(CPUState *cs)
     macvm_set_rip(cs, env->eip);
 }
 
-void hvf_simulate_rdmsr(CPUX86State *env)
+void hvf_simulate_rdmsr(CPUState *cs)
 {
-    X86CPU *cpu = env_archcpu(env);
-    CPUState *cs = env_cpu(env);
+    X86CPU *cpu = X86_CPU(cs);
+    CPUX86State *env = &cpu->env;
     uint32_t msr = ECX(env);
     uint64_t val = 0;
 
@@ -611,10 +613,10 @@ void hvf_simulate_rdmsr(CPUX86State *env)
     RDX(env) = (uint32_t)(val >> 32);
 }
 
-void hvf_simulate_wrmsr(CPUX86State *env)
+void hvf_simulate_wrmsr(CPUState *cs)
 {
-    X86CPU *cpu = env_archcpu(env);
-    CPUState *cs = env_cpu(env);
+    X86CPU *cpu = X86_CPU(cs);
+    CPUX86State *env = &cpu->env;
     uint32_t msr = ECX(env);
     uint64_t data = ((uint64_t)EDX(env) << 32) | EAX(env);
 
@@ -900,9 +902,9 @@ int hvf_vcpu_exec(CPUState *cpu)
         {
             hvf_load_regs(cpu);
             if (exit_reason == EXIT_REASON_RDMSR) {
-                hvf_simulate_rdmsr(env);
+                hvf_simulate_rdmsr(cpu);
             } else {
-                hvf_simulate_wrmsr(env);
+                hvf_simulate_wrmsr(cpu);
             }
             env->eip += ins_len;
             hvf_store_regs(cpu);
diff --git a/target/i386/hvf/x86_emu.c b/target/i386/hvf/x86_emu.c
index 3ff41c35d8..aec7a8a3fa 100644
--- a/target/i386/hvf/x86_emu.c
+++ b/target/i386/hvf/x86_emu.c
@@ -672,13 +672,13 @@ void x86_emul_raise_exception(CPUX86State *env, int exception_index, int error_c
 
 static void exec_rdmsr(CPUX86State *env, struct x86_decode *decode)
 {
-    hvf_simulate_rdmsr(env);
+    emul_ops->simulate_rdmsr(env_cpu(env));
     env->eip += decode->len;
 }
 
 static void exec_wrmsr(CPUX86State *env, struct x86_decode *decode)
 {
-    hvf_simulate_wrmsr(env);
+    emul_ops->simulate_wrmsr(env_cpu(env));
     env->eip += decode->len;
 }
 
diff --git a/target/i386/hvf/x86_emu.h b/target/i386/hvf/x86_emu.h
index 107c1f1ac8..555b567e2c 100644
--- a/target/i386/hvf/x86_emu.h
+++ b/target/i386/hvf/x86_emu.h
@@ -30,6 +30,8 @@ struct x86_emul_ops {
                                     enum X86Seg seg);
     void (*handle_io)(CPUState *cpu, uint16_t port, void *data, int direction,
                       int size, int count);
+    void (*simulate_rdmsr)(CPUState *cs);
+    void (*simulate_wrmsr)(CPUState *cs);
 };
 
 extern const struct x86_emul_ops *emul_ops;

From 7517ee9ec23801d4b6c4e5acbc0ad1bfa06c755a Mon Sep 17 00:00:00 2001
From: Wei Liu <liuwe@linux.microsoft.com>
Date: Fri, 7 Mar 2025 11:55:19 -0800
Subject: [PATCH 0026/2760] target/i386: rename lazy flags field and its type

The same structure and code can be used by other accelerators. Drop
the hvf prefix in the type and field name.

No functional change.

Signed-off-by: Wei Liu <liuwe@linux.microsoft.com>
Link: https://lore.kernel.org/r/1741377325-28175-9-git-send-email-liuwe@linux.microsoft.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.h           |  6 ++--
 target/i386/hvf/x86_flags.c | 56 ++++++++++++++++++-------------------
 2 files changed, 31 insertions(+), 31 deletions(-)

diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index 3c5c39ce3d..119efc6c60 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -1811,10 +1811,10 @@ typedef struct CPUCaches {
         CPUCacheInfo *l3_cache;
 } CPUCaches;
 
-typedef struct HVFX86LazyFlags {
+typedef struct X86LazyFlags {
     target_ulong result;
     target_ulong auxbits;
-} HVFX86LazyFlags;
+} X86LazyFlags;
 
 typedef struct CPUArchState {
     /* standard registers */
@@ -2108,7 +2108,7 @@ typedef struct CPUArchState {
     QemuMutex xen_timers_lock;
 #endif
 #if defined(CONFIG_HVF)
-    HVFX86LazyFlags hvf_lflags;
+    X86LazyFlags lflags;
     void *emu_mmio_buf;
 #endif
 
diff --git a/target/i386/hvf/x86_flags.c b/target/i386/hvf/x86_flags.c
index 0c75e0419c..84e27364a0 100644
--- a/target/i386/hvf/x86_flags.c
+++ b/target/i386/hvf/x86_flags.c
@@ -53,7 +53,7 @@
 #define SET_FLAGS_OSZAPC_SIZE(size, lf_carries, lf_result) { \
     target_ulong temp = ((lf_carries) & (LF_MASK_AF)) | \
     (((lf_carries) >> (size - 2)) << LF_BIT_PO); \
-    env->hvf_lflags.result = (target_ulong)(int##size##_t)(lf_result); \
+    env->lflags.result = (target_ulong)(int##size##_t)(lf_result); \
     if ((size) == 32) { \
         temp = ((lf_carries) & ~(LF_MASK_PDB | LF_MASK_SD)); \
     } else if ((size) == 16) { \
@@ -63,7 +63,7 @@
     } else { \
         VM_PANIC("unimplemented");  \
     } \
-    env->hvf_lflags.auxbits = (target_ulong)(uint32_t)temp; \
+    env->lflags.auxbits = (target_ulong)(uint32_t)temp; \
 }
 
 /* carries, result */
@@ -90,10 +90,10 @@
     } else { \
         VM_PANIC("unimplemented");      \
     } \
-    env->hvf_lflags.result = (target_ulong)(int##size##_t)(lf_result); \
-    target_ulong delta_c = (env->hvf_lflags.auxbits ^ temp) & LF_MASK_CF; \
+    env->lflags.result = (target_ulong)(int##size##_t)(lf_result); \
+    target_ulong delta_c = (env->lflags.auxbits ^ temp) & LF_MASK_CF; \
     delta_c ^= (delta_c >> 1); \
-    env->hvf_lflags.auxbits = (target_ulong)(uint32_t)(temp ^ delta_c); \
+    env->lflags.auxbits = (target_ulong)(uint32_t)(temp ^ delta_c); \
 }
 
 /* carries, result */
@@ -107,8 +107,8 @@
 void SET_FLAGS_OxxxxC(CPUX86State *env, uint32_t new_of, uint32_t new_cf)
 {
     uint32_t temp_po = new_of ^ new_cf;
-    env->hvf_lflags.auxbits &= ~(LF_MASK_PO | LF_MASK_CF);
-    env->hvf_lflags.auxbits |= (temp_po << LF_BIT_PO) | (new_cf << LF_BIT_CF);
+    env->lflags.auxbits &= ~(LF_MASK_PO | LF_MASK_CF);
+    env->lflags.auxbits |= (temp_po << LF_BIT_PO) | (new_cf << LF_BIT_CF);
 }
 
 void SET_FLAGS_OSZAPC_SUB32(CPUX86State *env, uint32_t v1, uint32_t v2,
@@ -204,27 +204,27 @@ void SET_FLAGS_OSZAPC_LOGIC8(CPUX86State *env, uint8_t v1, uint8_t v2,
 
 bool get_PF(CPUX86State *env)
 {
-    uint32_t temp = (255 & env->hvf_lflags.result);
-    temp = temp ^ (255 & (env->hvf_lflags.auxbits >> LF_BIT_PDB));
+    uint32_t temp = (255 & env->lflags.result);
+    temp = temp ^ (255 & (env->lflags.auxbits >> LF_BIT_PDB));
     temp = (temp ^ (temp >> 4)) & 0x0F;
     return (0x9669U >> temp) & 1;
 }
 
 void set_PF(CPUX86State *env, bool val)
 {
-    uint32_t temp = (255 & env->hvf_lflags.result) ^ (!val);
-    env->hvf_lflags.auxbits &= ~(LF_MASK_PDB);
-    env->hvf_lflags.auxbits |= (temp << LF_BIT_PDB);
+    uint32_t temp = (255 & env->lflags.result) ^ (!val);
+    env->lflags.auxbits &= ~(LF_MASK_PDB);
+    env->lflags.auxbits |= (temp << LF_BIT_PDB);
 }
 
 bool get_OF(CPUX86State *env)
 {
-    return ((env->hvf_lflags.auxbits + (1U << LF_BIT_PO)) >> LF_BIT_CF) & 1;
+    return ((env->lflags.auxbits + (1U << LF_BIT_PO)) >> LF_BIT_CF) & 1;
 }
 
 bool get_CF(CPUX86State *env)
 {
-    return (env->hvf_lflags.auxbits >> LF_BIT_CF) & 1;
+    return (env->lflags.auxbits >> LF_BIT_CF) & 1;
 }
 
 void set_OF(CPUX86State *env, bool val)
@@ -241,45 +241,45 @@ void set_CF(CPUX86State *env, bool val)
 
 bool get_AF(CPUX86State *env)
 {
-    return (env->hvf_lflags.auxbits >> LF_BIT_AF) & 1;
+    return (env->lflags.auxbits >> LF_BIT_AF) & 1;
 }
 
 void set_AF(CPUX86State *env, bool val)
 {
-    env->hvf_lflags.auxbits &= ~(LF_MASK_AF);
-    env->hvf_lflags.auxbits |= val << LF_BIT_AF;
+    env->lflags.auxbits &= ~(LF_MASK_AF);
+    env->lflags.auxbits |= val << LF_BIT_AF;
 }
 
 bool get_ZF(CPUX86State *env)
 {
-    return !env->hvf_lflags.result;
+    return !env->lflags.result;
 }
 
 void set_ZF(CPUX86State *env, bool val)
 {
     if (val) {
-        env->hvf_lflags.auxbits ^=
-         (((env->hvf_lflags.result >> LF_SIGN_BIT) & 1) << LF_BIT_SD);
+        env->lflags.auxbits ^=
+         (((env->lflags.result >> LF_SIGN_BIT) & 1) << LF_BIT_SD);
         /* merge the parity bits into the Parity Delta Byte */
-        uint32_t temp_pdb = (255 & env->hvf_lflags.result);
-        env->hvf_lflags.auxbits ^= (temp_pdb << LF_BIT_PDB);
+        uint32_t temp_pdb = (255 & env->lflags.result);
+        env->lflags.auxbits ^= (temp_pdb << LF_BIT_PDB);
         /* now zero the .result value */
-        env->hvf_lflags.result = 0;
+        env->lflags.result = 0;
     } else {
-        env->hvf_lflags.result |= (1 << 8);
+        env->lflags.result |= (1 << 8);
     }
 }
 
 bool get_SF(CPUX86State *env)
 {
-    return ((env->hvf_lflags.result >> LF_SIGN_BIT) ^
-            (env->hvf_lflags.auxbits >> LF_BIT_SD)) & 1;
+    return ((env->lflags.result >> LF_SIGN_BIT) ^
+            (env->lflags.auxbits >> LF_BIT_SD)) & 1;
 }
 
 void set_SF(CPUX86State *env, bool val)
 {
     bool temp_sf = get_SF(env);
-    env->hvf_lflags.auxbits ^= (temp_sf ^ val) << LF_BIT_SD;
+    env->lflags.auxbits ^= (temp_sf ^ val) << LF_BIT_SD;
 }
 
 void lflags_to_rflags(CPUX86State *env)
@@ -295,7 +295,7 @@ void lflags_to_rflags(CPUX86State *env)
 
 void rflags_to_lflags(CPUX86State *env)
 {
-    env->hvf_lflags.auxbits = env->hvf_lflags.result = 0;
+    env->lflags.auxbits = env->lflags.result = 0;
     set_OF(env, env->eflags & CC_O);
     set_SF(env, env->eflags & CC_S);
     set_ZF(env, env->eflags & CC_Z);

From 3667f0bb58427edadc4a049080141d395b48fc29 Mon Sep 17 00:00:00 2001
From: Wei Liu <liuwe@linux.microsoft.com>
Date: Fri, 7 Mar 2025 11:55:20 -0800
Subject: [PATCH 0027/2760] target/i386/hvf: drop unused headers

Signed-off-by: Wei Liu <liuwe@linux.microsoft.com>
Link: https://lore.kernel.org/r/1741377325-28175-10-git-send-email-liuwe@linux.microsoft.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/hvf/x86_decode.c | 3 ---
 target/i386/hvf/x86_emu.c    | 4 ----
 2 files changed, 7 deletions(-)

diff --git a/target/i386/hvf/x86_decode.c b/target/i386/hvf/x86_decode.c
index 728e159638..ddd7b60bcf 100644
--- a/target/i386/hvf/x86_decode.c
+++ b/target/i386/hvf/x86_decode.c
@@ -20,10 +20,7 @@
 
 #include "panic.h"
 #include "x86_decode.h"
-#include "vmx.h"
 #include "x86_emu.h"
-#include "x86_mmu.h"
-#include "x86_descr.h"
 
 #define OPCODE_ESCAPE   0xf
 
diff --git a/target/i386/hvf/x86_emu.c b/target/i386/hvf/x86_emu.c
index aec7a8a3fa..26a4876aac 100644
--- a/target/i386/hvf/x86_emu.c
+++ b/target/i386/hvf/x86_emu.c
@@ -40,11 +40,7 @@
 #include "x86_decode.h"
 #include "x86.h"
 #include "x86_emu.h"
-#include "x86_mmu.h"
 #include "x86_flags.h"
-#include "vmcs.h"
-#include "vmx.h"
-#include "hvf-i386.h"
 
 #define EXEC_2OP_FLAGS_CMD(env, decode, cmd, FLAGS_FUNC, save_res) \
 {                                                       \

From fb8ebedd2a9d2c2c098464dee4ec7bd1c8c463a1 Mon Sep 17 00:00:00 2001
From: Wei Liu <liuwe@linux.microsoft.com>
Date: Fri, 7 Mar 2025 11:55:21 -0800
Subject: [PATCH 0028/2760] target/i386/hvf: rename some include guards

These headers will be moved out to its own component.

Signed-off-by: Wei Liu <liuwe@linux.microsoft.com>
Link: https://lore.kernel.org/r/1741377325-28175-11-git-send-email-liuwe@linux.microsoft.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/hvf/x86.h        | 4 ++--
 target/i386/hvf/x86_decode.h | 4 ++--
 target/i386/hvf/x86_flags.h  | 6 +++---
 3 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/target/i386/hvf/x86.h b/target/i386/hvf/x86.h
index 063cd0b83e..73edccfba0 100644
--- a/target/i386/hvf/x86.h
+++ b/target/i386/hvf/x86.h
@@ -16,8 +16,8 @@
  * License along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
-#ifndef HVF_X86_H
-#define HVF_X86_H
+#ifndef X86_EMU_DEFS_H
+#define X86_EMU_DEFS_H
 
 typedef struct x86_register {
     union {
diff --git a/target/i386/hvf/x86_decode.h b/target/i386/hvf/x86_decode.h
index a2d7a2a27b..930d965164 100644
--- a/target/i386/hvf/x86_decode.h
+++ b/target/i386/hvf/x86_decode.h
@@ -15,8 +15,8 @@
  * License along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
-#ifndef HVF_X86_DECODE_H
-#define HVF_X86_DECODE_H
+#ifndef X86_EMU_DECODE_H
+#define X86_EMU_DECODE_H
 
 #include "cpu.h"
 #include "x86.h"
diff --git a/target/i386/hvf/x86_flags.h b/target/i386/hvf/x86_flags.h
index 75c2a7feab..6c175007b5 100644
--- a/target/i386/hvf/x86_flags.h
+++ b/target/i386/hvf/x86_flags.h
@@ -21,8 +21,8 @@
  * x86 eflags functions
  */
 
-#ifndef X86_FLAGS_H
-#define X86_FLAGS_H
+#ifndef X86_EMU_FLAGS_H
+#define X86_EMU_FLAGS_H
 
 #include "cpu.h"
 void lflags_to_rflags(CPUX86State *env);
@@ -78,4 +78,4 @@ void SET_FLAGS_OSZAPC_LOGIC16(CPUX86State *env, uint16_t v1, uint16_t v2,
 void SET_FLAGS_OSZAPC_LOGIC8(CPUX86State *env, uint8_t v1, uint8_t v2,
                              uint8_t diff);
 
-#endif /* X86_FLAGS_H */
+#endif /* X86_EMU_FLAGS_H */

From 5ffd2705f797ffe59165f3f29ad1065f648d6add Mon Sep 17 00:00:00 2001
From: Wei Liu <liuwe@linux.microsoft.com>
Date: Fri, 7 Mar 2025 11:55:22 -0800
Subject: [PATCH 0029/2760] target/i386: add a directory for x86 instruction
 emulator

Signed-off-by: Wei Liu <liuwe@linux.microsoft.com>
Link: https://lore.kernel.org/r/1741377325-28175-12-git-send-email-liuwe@linux.microsoft.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/emulate/meson.build | 0
 target/i386/meson.build         | 1 +
 2 files changed, 1 insertion(+)
 create mode 100644 target/i386/emulate/meson.build

diff --git a/target/i386/emulate/meson.build b/target/i386/emulate/meson.build
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/target/i386/meson.build b/target/i386/meson.build
index 2e9c472f49..c1aacea613 100644
--- a/target/i386/meson.build
+++ b/target/i386/meson.build
@@ -31,6 +31,7 @@ subdir('whpx')
 subdir('nvmm')
 subdir('hvf')
 subdir('tcg')
+subdir('emulate')
 
 target_arch += {'i386': i386_ss}
 target_system_arch += {'i386': i386_system_ss}

From 2d4f09523fd48bdb42a163e3b53a420c799217f3 Mon Sep 17 00:00:00 2001
From: Wei Liu <liuwe@linux.microsoft.com>
Date: Fri, 7 Mar 2025 11:55:23 -0800
Subject: [PATCH 0030/2760] target/i386/emulate: add a panic.h

The macros will be used by the instruction emulator. The code is the same as
the one under hvf.

Signed-off-by: Wei Liu <liuwe@linux.microsoft.com>
Link: https://lore.kernel.org/r/1741377325-28175-13-git-send-email-liuwe@linux.microsoft.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/emulate/panic.h | 45 +++++++++++++++++++++++++++++++++++++
 1 file changed, 45 insertions(+)
 create mode 100644 target/i386/emulate/panic.h

diff --git a/target/i386/emulate/panic.h b/target/i386/emulate/panic.h
new file mode 100644
index 0000000000..71c24874ba
--- /dev/null
+++ b/target/i386/emulate/panic.h
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2016 Veertu Inc,
+ * Copyright (C) 2017 Google Inc,
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+#ifndef X86_EMU_PANIC_H
+#define X86_EMU_PANIC_H
+
+#define VM_PANIC(x) {\
+    printf("%s\n", x); \
+    abort(); \
+}
+
+#define VM_PANIC_ON(x) {\
+    if (x) { \
+        printf("%s\n", #x); \
+        abort(); \
+    } \
+}
+
+#define VM_PANIC_EX(...) {\
+    printf(__VA_ARGS__); \
+    abort(); \
+}
+
+#define VM_PANIC_ON_EX(x, ...) {\
+    if (x) { \
+        printf(__VA_ARGS__); \
+        abort(); \
+    } \
+}
+
+#endif

From 27458df871097d7fc14b19d9e01c35d29737b9b3 Mon Sep 17 00:00:00 2001
From: Wei Liu <liuwe@linux.microsoft.com>
Date: Fri, 7 Mar 2025 11:55:24 -0800
Subject: [PATCH 0031/2760] target/i386: move x86 instruction emulator out of
 hvf

Move x86_decode, x86_emu, x86_flags and some headers to the new location.
Fix up all the inclusion sites in hvf.

Signed-off-by: Wei Liu <liuwe@linux.microsoft.com>
Link: https://lore.kernel.org/r/1741377325-28175-14-git-send-email-liuwe@linux.microsoft.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/emulate/meson.build           | 5 +++++
 target/i386/{hvf => emulate}/x86.h        | 0
 target/i386/{hvf => emulate}/x86_decode.c | 0
 target/i386/{hvf => emulate}/x86_decode.h | 0
 target/i386/{hvf => emulate}/x86_emu.c    | 0
 target/i386/{hvf => emulate}/x86_emu.h    | 0
 target/i386/{hvf => emulate}/x86_flags.c  | 0
 target/i386/{hvf => emulate}/x86_flags.h  | 0
 target/i386/hvf/hvf.c                     | 8 ++++----
 target/i386/hvf/meson.build               | 3 ---
 target/i386/hvf/vmx.h                     | 2 +-
 target/i386/hvf/x86.c                     | 4 ++--
 target/i386/hvf/x86_cpuid.c               | 2 +-
 target/i386/hvf/x86_descr.h               | 2 +-
 target/i386/hvf/x86_mmu.c                 | 2 +-
 target/i386/hvf/x86_task.c                | 6 +++---
 target/i386/hvf/x86hvf.c                  | 2 +-
 17 files changed, 19 insertions(+), 17 deletions(-)
 rename target/i386/{hvf => emulate}/x86.h (100%)
 rename target/i386/{hvf => emulate}/x86_decode.c (100%)
 rename target/i386/{hvf => emulate}/x86_decode.h (100%)
 rename target/i386/{hvf => emulate}/x86_emu.c (100%)
 rename target/i386/{hvf => emulate}/x86_emu.h (100%)
 rename target/i386/{hvf => emulate}/x86_flags.c (100%)
 rename target/i386/{hvf => emulate}/x86_flags.h (100%)

diff --git a/target/i386/emulate/meson.build b/target/i386/emulate/meson.build
index e69de29bb2..4edd4f462f 100644
--- a/target/i386/emulate/meson.build
+++ b/target/i386/emulate/meson.build
@@ -0,0 +1,5 @@
+i386_system_ss.add(when: [hvf, 'CONFIG_HVF'], if_true: files(
+  'x86_decode.c',
+  'x86_emu.c',
+  'x86_flags.c',
+))
diff --git a/target/i386/hvf/x86.h b/target/i386/emulate/x86.h
similarity index 100%
rename from target/i386/hvf/x86.h
rename to target/i386/emulate/x86.h
diff --git a/target/i386/hvf/x86_decode.c b/target/i386/emulate/x86_decode.c
similarity index 100%
rename from target/i386/hvf/x86_decode.c
rename to target/i386/emulate/x86_decode.c
diff --git a/target/i386/hvf/x86_decode.h b/target/i386/emulate/x86_decode.h
similarity index 100%
rename from target/i386/hvf/x86_decode.h
rename to target/i386/emulate/x86_decode.h
diff --git a/target/i386/hvf/x86_emu.c b/target/i386/emulate/x86_emu.c
similarity index 100%
rename from target/i386/hvf/x86_emu.c
rename to target/i386/emulate/x86_emu.c
diff --git a/target/i386/hvf/x86_emu.h b/target/i386/emulate/x86_emu.h
similarity index 100%
rename from target/i386/hvf/x86_emu.h
rename to target/i386/emulate/x86_emu.h
diff --git a/target/i386/hvf/x86_flags.c b/target/i386/emulate/x86_flags.c
similarity index 100%
rename from target/i386/hvf/x86_flags.c
rename to target/i386/emulate/x86_flags.c
diff --git a/target/i386/hvf/x86_flags.h b/target/i386/emulate/x86_flags.h
similarity index 100%
rename from target/i386/hvf/x86_flags.h
rename to target/i386/emulate/x86_flags.h
diff --git a/target/i386/hvf/hvf.c b/target/i386/hvf/hvf.c
index 8c31d2e0cf..23ebf2550a 100644
--- a/target/i386/hvf/hvf.c
+++ b/target/i386/hvf/hvf.c
@@ -59,12 +59,12 @@
 #include "hvf-i386.h"
 #include "vmcs.h"
 #include "vmx.h"
-#include "x86.h"
+#include "emulate/x86.h"
 #include "x86_descr.h"
-#include "x86_flags.h"
+#include "emulate/x86_flags.h"
 #include "x86_mmu.h"
-#include "x86_decode.h"
-#include "x86_emu.h"
+#include "emulate/x86_decode.h"
+#include "emulate/x86_emu.h"
 #include "x86_task.h"
 #include "x86hvf.h"
 
diff --git a/target/i386/hvf/meson.build b/target/i386/hvf/meson.build
index 05c3c8cf18..519d190f0e 100644
--- a/target/i386/hvf/meson.build
+++ b/target/i386/hvf/meson.build
@@ -2,10 +2,7 @@ i386_system_ss.add(when: [hvf, 'CONFIG_HVF'], if_true: files(
   'hvf.c',
   'x86.c',
   'x86_cpuid.c',
-  'x86_decode.c',
   'x86_descr.c',
-  'x86_emu.c',
-  'x86_flags.c',
   'x86_mmu.c',
   'x86_task.c',
   'x86hvf.c',
diff --git a/target/i386/hvf/vmx.h b/target/i386/hvf/vmx.h
index 80ce26279b..3c56afc9d3 100644
--- a/target/i386/hvf/vmx.h
+++ b/target/i386/hvf/vmx.h
@@ -29,7 +29,7 @@
 #include <Hypervisor/hv_vmx.h>
 #include "vmcs.h"
 #include "cpu.h"
-#include "x86.h"
+#include "emulate/x86.h"
 #include "system/hvf.h"
 #include "system/hvf_int.h"
 
diff --git a/target/i386/hvf/x86.c b/target/i386/hvf/x86.c
index a0ede13886..5c75ec9a00 100644
--- a/target/i386/hvf/x86.c
+++ b/target/i386/hvf/x86.c
@@ -19,8 +19,8 @@
 #include "qemu/osdep.h"
 
 #include "cpu.h"
-#include "x86_decode.h"
-#include "x86_emu.h"
+#include "emulate/x86_decode.h"
+#include "emulate/x86_emu.h"
 #include "vmcs.h"
 #include "vmx.h"
 #include "x86_mmu.h"
diff --git a/target/i386/hvf/x86_cpuid.c b/target/i386/hvf/x86_cpuid.c
index ae836f65cc..fa131b18c6 100644
--- a/target/i386/hvf/x86_cpuid.c
+++ b/target/i386/hvf/x86_cpuid.c
@@ -24,7 +24,7 @@
 #include "qemu/cpuid.h"
 #include "host/cpuinfo.h"
 #include "cpu.h"
-#include "x86.h"
+#include "emulate/x86.h"
 #include "vmx.h"
 #include "system/hvf.h"
 #include "hvf-i386.h"
diff --git a/target/i386/hvf/x86_descr.h b/target/i386/hvf/x86_descr.h
index ce5de98349..24af4946cd 100644
--- a/target/i386/hvf/x86_descr.h
+++ b/target/i386/hvf/x86_descr.h
@@ -19,7 +19,7 @@
 #ifndef HVF_X86_DESCR_H
 #define HVF_X86_DESCR_H
 
-#include "x86.h"
+#include "emulate/x86.h"
 
 typedef struct vmx_segment {
     uint16_t sel;
diff --git a/target/i386/hvf/x86_mmu.c b/target/i386/hvf/x86_mmu.c
index 579d0c3a4c..afc5c17d5d 100644
--- a/target/i386/hvf/x86_mmu.c
+++ b/target/i386/hvf/x86_mmu.c
@@ -19,7 +19,7 @@
 #include "qemu/osdep.h"
 #include "panic.h"
 #include "cpu.h"
-#include "x86.h"
+#include "emulate/x86.h"
 #include "x86_mmu.h"
 #include "vmcs.h"
 #include "vmx.h"
diff --git a/target/i386/hvf/x86_task.c b/target/i386/hvf/x86_task.c
index 161217991f..bdf8b51ae6 100644
--- a/target/i386/hvf/x86_task.c
+++ b/target/i386/hvf/x86_task.c
@@ -14,11 +14,11 @@
 #include "hvf-i386.h"
 #include "vmcs.h"
 #include "vmx.h"
-#include "x86.h"
+#include "emulate/x86.h"
 #include "x86_descr.h"
 #include "x86_mmu.h"
-#include "x86_decode.h"
-#include "x86_emu.h"
+#include "emulate/x86_decode.h"
+#include "emulate/x86_emu.h"
 #include "x86_task.h"
 #include "x86hvf.h"
 
diff --git a/target/i386/hvf/x86hvf.c b/target/i386/hvf/x86hvf.c
index 531a340b37..2057314892 100644
--- a/target/i386/hvf/x86hvf.c
+++ b/target/i386/hvf/x86hvf.c
@@ -24,7 +24,7 @@
 #include "vmcs.h"
 #include "cpu.h"
 #include "x86_descr.h"
-#include "x86_decode.h"
+#include "emulate/x86_decode.h"
 #include "system/hw_accel.h"
 
 #include "hw/i386/apic_internal.h"

From 6aa0d0391c56e411d43bbf9f9c6acd1fea6f55c4 Mon Sep 17 00:00:00 2001
From: Wei Liu <liuwe@linux.microsoft.com>
Date: Fri, 7 Mar 2025 11:55:25 -0800
Subject: [PATCH 0032/2760] MAINTAINERS: add an entry for the x86 instruction
 emulator

Add myself as a reviewer.

Signed-off-by: Wei Liu <liuwe@linux.microsoft.com>
Link: https://lore.kernel.org/r/1741377325-28175-15-git-send-email-liuwe@linux.microsoft.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 MAINTAINERS | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/MAINTAINERS b/MAINTAINERS
index d54b5578f8..67228401f0 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -534,6 +534,14 @@ S: Supported
 F: target/i386/whpx/
 F: include/system/whpx.h
 
+X86 Instruction Emulator
+M: Cameron Esfahani <dirty@apple.com>
+M: Roman Bolshakov <rbolshakov@ddn.com>
+R: Phil Dennis-Jordan <phil@philjordan.eu>
+R: Wei Liu <wei.liu@kernel.org>
+S: Maintained
+F: target/i386/emulate/
+
 Guest CPU Cores (Xen)
 ---------------------
 X86 Xen CPUs

From c901905ea6703a2feb5867537a8559dc129447f7 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Thu, 3 Apr 2025 21:45:36 +0200
Subject: [PATCH 0033/2760] target/i386/emulate: remove flags_mask

The field is written but never read.

Cc: Wei Liu <liuwe@linux.microsoft.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/emulate/x86_decode.c | 864 +++++++++++++++----------------
 target/i386/emulate/x86_decode.h |   2 -
 2 files changed, 424 insertions(+), 442 deletions(-)

diff --git a/target/i386/emulate/x86_decode.c b/target/i386/emulate/x86_decode.c
index ddd7b60bcf..7fee219687 100644
--- a/target/i386/emulate/x86_decode.c
+++ b/target/i386/emulate/x86_decode.c
@@ -429,7 +429,6 @@ struct decode_tbl {
     void (*decode_op4)(CPUX86State *env, struct x86_decode *decode,
                        struct x86_decode_op *op4);
     void (*decode_postfix)(CPUX86State *env, struct x86_decode *decode);
-    uint32_t flags_mask;
 };
 
 struct decode_x87_tbl {
@@ -445,7 +444,6 @@ struct decode_x87_tbl {
     void (*decode_op2)(CPUX86State *env, struct x86_decode *decode,
                        struct x86_decode_op *op2);
     void (*decode_postfix)(CPUX86State *env, struct x86_decode *decode);
-    uint32_t flags_mask;
 };
 
 struct decode_tbl invl_inst = {0x0, 0, 0, false, NULL, NULL, NULL, NULL,
@@ -470,7 +468,6 @@ static void decode_x87_ins(CPUX86State *env, struct x86_decode *decode)
     if (decoder->operand_size) {
         decode->operand_size = decoder->operand_size;
     }
-    decode->flags_mask = decoder->flags_mask;
     decode->fpop_stack = decoder->pop;
     decode->frev = decoder->rev;
     
@@ -503,9 +500,6 @@ static void decode_ffgroup(CPUX86State *env, struct x86_decode *decode)
         X86_DECODE_CMD_INVL
     };
     decode->cmd = group[decode->modrm.reg];
-    if (decode->modrm.reg > 2) {
-        decode->flags_mask = 0;
-    }
 }
 
 static void decode_sldtgroup(CPUX86State *env, struct x86_decode *decode)
@@ -693,733 +687,724 @@ static void decode_db_4(CPUX86State *env, struct x86_decode *decode)
 }
 
 
-#define RFLAGS_MASK_NONE    0
-#define RFLAGS_MASK_OSZAPC  (CC_O | CC_S | CC_Z | CC_A | CC_P | CC_C)
-#define RFLAGS_MASK_LAHF    (CC_S | CC_Z | CC_A | CC_P | CC_C)
-#define RFLAGS_MASK_CF      (CC_C)
-#define RFLAGS_MASK_IF      (IF_MASK)
-#define RFLAGS_MASK_TF      (TF_MASK)
-#define RFLAGS_MASK_DF      (DF_MASK)
-#define RFLAGS_MASK_ZF      (CC_Z)
-
 struct decode_tbl _1op_inst[] = {
     {0x0, X86_DECODE_CMD_ADD, 1, true, decode_modrm_rm, decode_modrm_reg, NULL,
-     NULL, NULL, RFLAGS_MASK_OSZAPC},
+     NULL, NULL},
     {0x1, X86_DECODE_CMD_ADD, 0, true, decode_modrm_rm, decode_modrm_reg, NULL,
-     NULL, NULL, RFLAGS_MASK_OSZAPC},
+     NULL, NULL},
     {0x2, X86_DECODE_CMD_ADD, 1, true, decode_modrm_reg, decode_modrm_rm, NULL,
-     NULL, NULL, RFLAGS_MASK_OSZAPC},
+     NULL, NULL},
     {0x3, X86_DECODE_CMD_ADD, 0, true, decode_modrm_reg, decode_modrm_rm, NULL,
-     NULL, NULL, RFLAGS_MASK_OSZAPC},
+     NULL, NULL},
     {0x4, X86_DECODE_CMD_ADD, 1, false, decode_rax, decode_imm8, NULL, NULL,
-     NULL, RFLAGS_MASK_OSZAPC},
+     NULL},
     {0x5, X86_DECODE_CMD_ADD, 0, false, decode_rax, decode_imm, NULL, NULL,
-     NULL, RFLAGS_MASK_OSZAPC},
+     NULL},
     {0x6, X86_DECODE_CMD_PUSH_SEG, 0, false, false, NULL, NULL, NULL,
-     decode_pushseg, RFLAGS_MASK_NONE},
+     decode_pushseg},
     {0x7, X86_DECODE_CMD_POP_SEG, 0, false, false, NULL, NULL, NULL,
-     decode_popseg, RFLAGS_MASK_NONE},
+     decode_popseg},
     {0x8, X86_DECODE_CMD_OR, 1, true, decode_modrm_rm, decode_modrm_reg, NULL,
-     NULL, NULL, RFLAGS_MASK_OSZAPC},
+     NULL, NULL},
     {0x9, X86_DECODE_CMD_OR, 0, true, decode_modrm_rm, decode_modrm_reg, NULL,
-     NULL, NULL, RFLAGS_MASK_OSZAPC},
+     NULL, NULL},
     {0xa, X86_DECODE_CMD_OR, 1, true, decode_modrm_reg, decode_modrm_rm, NULL,
-     NULL, NULL, RFLAGS_MASK_OSZAPC},
+     NULL, NULL},
     {0xb, X86_DECODE_CMD_OR, 0, true, decode_modrm_reg, decode_modrm_rm,
-     NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL},
     {0xc, X86_DECODE_CMD_OR, 1, false, decode_rax, decode_imm8,
-     NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL},
     {0xd, X86_DECODE_CMD_OR, 0, false, decode_rax, decode_imm,
-     NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL},
 
     {0xe, X86_DECODE_CMD_PUSH_SEG, 0, false, false,
-     NULL, NULL, NULL, decode_pushseg, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, decode_pushseg},
     {0xf, X86_DECODE_CMD_POP_SEG, 0, false, false,
-     NULL, NULL, NULL, decode_popseg, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, decode_popseg},
 
     {0x10, X86_DECODE_CMD_ADC, 1, true, decode_modrm_rm, decode_modrm_reg,
-     NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL},
     {0x11, X86_DECODE_CMD_ADC, 0, true, decode_modrm_rm, decode_modrm_reg,
-     NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL},
     {0x12, X86_DECODE_CMD_ADC, 1, true, decode_modrm_reg, decode_modrm_rm,
-     NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL},
     {0x13, X86_DECODE_CMD_ADC, 0, true, decode_modrm_reg, decode_modrm_rm,
-     NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL},
     {0x14, X86_DECODE_CMD_ADC, 1, false, decode_rax, decode_imm,
-     NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL},
     {0x15, X86_DECODE_CMD_ADC, 0, false, decode_rax, decode_imm,
-     NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL},
 
     {0x16, X86_DECODE_CMD_PUSH_SEG, 0, false, false,
-     NULL, NULL, NULL, decode_pushseg, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, decode_pushseg},
     {0x17, X86_DECODE_CMD_POP_SEG, 0, false, false,
-     NULL, NULL, NULL, decode_popseg, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, decode_popseg},
 
     {0x18, X86_DECODE_CMD_SBB, 1, true, decode_modrm_rm, decode_modrm_reg,
-     NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL},
     {0x19, X86_DECODE_CMD_SBB, 0, true, decode_modrm_rm, decode_modrm_reg,
-     NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL},
     {0x1a, X86_DECODE_CMD_SBB, 1, true, decode_modrm_reg, decode_modrm_rm,
-     NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL},
     {0x1b, X86_DECODE_CMD_SBB, 0, true, decode_modrm_reg, decode_modrm_rm,
-     NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL},
     {0x1c, X86_DECODE_CMD_SBB, 1, false, decode_rax, decode_imm8,
-     NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL},
     {0x1d, X86_DECODE_CMD_SBB, 0, false, decode_rax, decode_imm,
-     NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL},
 
     {0x1e, X86_DECODE_CMD_PUSH_SEG, 0, false, false,
-     NULL, NULL, NULL, decode_pushseg, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, decode_pushseg},
     {0x1f, X86_DECODE_CMD_POP_SEG, 0, false, false,
-     NULL, NULL, NULL, decode_popseg, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, decode_popseg},
 
     {0x20, X86_DECODE_CMD_AND, 1, true, decode_modrm_rm, decode_modrm_reg,
-     NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL},
     {0x21, X86_DECODE_CMD_AND, 0, true, decode_modrm_rm, decode_modrm_reg,
-     NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL},
     {0x22, X86_DECODE_CMD_AND, 1, true, decode_modrm_reg, decode_modrm_rm,
-     NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL},
     {0x23, X86_DECODE_CMD_AND, 0, true, decode_modrm_reg, decode_modrm_rm,
-     NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL},
     {0x24, X86_DECODE_CMD_AND, 1, false, decode_rax, decode_imm,
-     NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL},
     {0x25, X86_DECODE_CMD_AND, 0, false, decode_rax, decode_imm,
-     NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL},
     {0x28, X86_DECODE_CMD_SUB, 1, true, decode_modrm_rm, decode_modrm_reg,
-     NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL},
     {0x29, X86_DECODE_CMD_SUB, 0, true, decode_modrm_rm, decode_modrm_reg,
-     NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL},
     {0x2a, X86_DECODE_CMD_SUB, 1, true, decode_modrm_reg, decode_modrm_rm,
-     NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL},
     {0x2b, X86_DECODE_CMD_SUB, 0, true, decode_modrm_reg, decode_modrm_rm,
-     NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL},
     {0x2c, X86_DECODE_CMD_SUB, 1, false, decode_rax, decode_imm,
-     NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL},
     {0x2d, X86_DECODE_CMD_SUB, 0, false, decode_rax, decode_imm,
-     NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL},
     {0x2f, X86_DECODE_CMD_DAS, 0, false,
-     NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL, NULL, NULL},
     {0x30, X86_DECODE_CMD_XOR, 1, true, decode_modrm_rm, decode_modrm_reg,
-     NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL},
     {0x31, X86_DECODE_CMD_XOR, 0, true, decode_modrm_rm, decode_modrm_reg,
-     NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL},
     {0x32, X86_DECODE_CMD_XOR, 1, true, decode_modrm_reg, decode_modrm_rm,
-     NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL},
     {0x33, X86_DECODE_CMD_XOR, 0, true, decode_modrm_reg, decode_modrm_rm,
-     NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL},
     {0x34, X86_DECODE_CMD_XOR, 1, false, decode_rax, decode_imm,
-     NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL},
     {0x35, X86_DECODE_CMD_XOR, 0, false, decode_rax, decode_imm,
-     NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL},
 
     {0x38, X86_DECODE_CMD_CMP, 1, true, decode_modrm_rm, decode_modrm_reg,
-     NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL},
     {0x39, X86_DECODE_CMD_CMP, 0, true, decode_modrm_rm, decode_modrm_reg,
-     NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL},
     {0x3a, X86_DECODE_CMD_CMP, 1, true, decode_modrm_reg, decode_modrm_rm,
-     NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL},
     {0x3b, X86_DECODE_CMD_CMP, 0, true, decode_modrm_reg, decode_modrm_rm,
-     NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL},
     {0x3c, X86_DECODE_CMD_CMP, 1, false, decode_rax, decode_imm8,
-     NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL},
     {0x3d, X86_DECODE_CMD_CMP, 0, false, decode_rax, decode_imm,
-     NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL},
 
     {0x3f, X86_DECODE_CMD_AAS, 0, false,
-     NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL, NULL, NULL},
 
     {0x40, X86_DECODE_CMD_INC, 0, false,
-     NULL, NULL, NULL, NULL, decode_incgroup, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL, NULL, decode_incgroup},
     {0x41, X86_DECODE_CMD_INC, 0, false,
-     NULL, NULL, NULL, NULL, decode_incgroup, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL, NULL, decode_incgroup},
     {0x42, X86_DECODE_CMD_INC, 0, false,
-     NULL, NULL, NULL, NULL, decode_incgroup, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL, NULL, decode_incgroup},
     {0x43, X86_DECODE_CMD_INC, 0, false,
-     NULL, NULL, NULL, NULL, decode_incgroup, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL, NULL, decode_incgroup},
     {0x44, X86_DECODE_CMD_INC, 0, false,
-     NULL, NULL, NULL, NULL, decode_incgroup, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL, NULL, decode_incgroup},
     {0x45, X86_DECODE_CMD_INC, 0, false,
-     NULL, NULL, NULL, NULL, decode_incgroup, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL, NULL, decode_incgroup},
     {0x46, X86_DECODE_CMD_INC, 0, false,
-     NULL, NULL, NULL, NULL, decode_incgroup, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL, NULL, decode_incgroup},
     {0x47, X86_DECODE_CMD_INC, 0, false,
-     NULL, NULL, NULL, NULL, decode_incgroup, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL, NULL, decode_incgroup},
 
     {0x48, X86_DECODE_CMD_DEC, 0, false,
-     NULL, NULL, NULL, NULL, decode_decgroup, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL, NULL, decode_decgroup},
     {0x49, X86_DECODE_CMD_DEC, 0, false,
-     NULL, NULL, NULL, NULL, decode_decgroup, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL, NULL, decode_decgroup},
     {0x4a, X86_DECODE_CMD_DEC, 0, false,
-     NULL, NULL, NULL, NULL, decode_decgroup, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL, NULL, decode_decgroup},
     {0x4b, X86_DECODE_CMD_DEC, 0, false,
-     NULL, NULL, NULL, NULL, decode_decgroup, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL, NULL, decode_decgroup},
     {0x4c, X86_DECODE_CMD_DEC, 0, false,
-     NULL, NULL, NULL, NULL, decode_decgroup, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL, NULL, decode_decgroup},
     {0x4d, X86_DECODE_CMD_DEC, 0, false,
-     NULL, NULL, NULL, NULL, decode_decgroup, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL, NULL, decode_decgroup},
     {0x4e, X86_DECODE_CMD_DEC, 0, false,
-     NULL, NULL, NULL, NULL, decode_decgroup, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL, NULL, decode_decgroup},
     {0x4f, X86_DECODE_CMD_DEC, 0, false,
-     NULL, NULL, NULL, NULL, decode_decgroup, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL, NULL, decode_decgroup},
 
     {0x50, X86_DECODE_CMD_PUSH, 0, false,
-     NULL, NULL, NULL, NULL, decode_pushgroup, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, decode_pushgroup},
     {0x51, X86_DECODE_CMD_PUSH, 0, false,
-     NULL, NULL, NULL, NULL, decode_pushgroup, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, decode_pushgroup},
     {0x52, X86_DECODE_CMD_PUSH, 0, false,
-     NULL, NULL, NULL, NULL, decode_pushgroup, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, decode_pushgroup},
     {0x53, X86_DECODE_CMD_PUSH, 0, false,
-     NULL, NULL, NULL, NULL, decode_pushgroup, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, decode_pushgroup},
     {0x54, X86_DECODE_CMD_PUSH, 0, false,
-     NULL, NULL, NULL, NULL, decode_pushgroup, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, decode_pushgroup},
     {0x55, X86_DECODE_CMD_PUSH, 0, false,
-     NULL, NULL, NULL, NULL, decode_pushgroup, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, decode_pushgroup},
     {0x56, X86_DECODE_CMD_PUSH, 0, false,
-     NULL, NULL, NULL, NULL, decode_pushgroup, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, decode_pushgroup},
     {0x57, X86_DECODE_CMD_PUSH, 0, false,
-     NULL, NULL, NULL, NULL, decode_pushgroup, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, decode_pushgroup},
 
     {0x58, X86_DECODE_CMD_POP, 0, false,
-     NULL, NULL, NULL, NULL, decode_popgroup, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, decode_popgroup},
     {0x59, X86_DECODE_CMD_POP, 0, false,
-     NULL, NULL, NULL, NULL, decode_popgroup, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, decode_popgroup},
     {0x5a, X86_DECODE_CMD_POP, 0, false,
-     NULL, NULL, NULL, NULL, decode_popgroup, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, decode_popgroup},
     {0x5b, X86_DECODE_CMD_POP, 0, false,
-     NULL, NULL, NULL, NULL, decode_popgroup, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, decode_popgroup},
     {0x5c, X86_DECODE_CMD_POP, 0, false,
-     NULL, NULL, NULL, NULL, decode_popgroup, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, decode_popgroup},
     {0x5d, X86_DECODE_CMD_POP, 0, false,
-     NULL, NULL, NULL, NULL, decode_popgroup, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, decode_popgroup},
     {0x5e, X86_DECODE_CMD_POP, 0, false,
-     NULL, NULL, NULL, NULL, decode_popgroup, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, decode_popgroup},
     {0x5f, X86_DECODE_CMD_POP, 0, false,
-     NULL, NULL, NULL, NULL, decode_popgroup, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, decode_popgroup},
 
     {0x60, X86_DECODE_CMD_PUSHA, 0, false,
-     NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, NULL},
     {0x61, X86_DECODE_CMD_POPA, 0, false,
-     NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, NULL},
 
     {0x68, X86_DECODE_CMD_PUSH, 0, false, decode_imm,
-     NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL},
     {0x6a, X86_DECODE_CMD_PUSH, 0, false, decode_imm8_signed,
-     NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL},
     {0x69, X86_DECODE_CMD_IMUL_3, 0, true, decode_modrm_reg,
-     decode_modrm_rm, decode_imm, NULL, NULL, RFLAGS_MASK_OSZAPC},
+     decode_modrm_rm, decode_imm, NULL, NULL},
     {0x6b, X86_DECODE_CMD_IMUL_3, 0, true, decode_modrm_reg, decode_modrm_rm,
-     decode_imm8_signed, NULL, NULL, RFLAGS_MASK_OSZAPC},
+     decode_imm8_signed, NULL, NULL},
 
     {0x6c, X86_DECODE_CMD_INS, 1, false,
-     NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, NULL},
     {0x6d, X86_DECODE_CMD_INS, 0, false,
-     NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, NULL},
     {0x6e, X86_DECODE_CMD_OUTS, 1, false,
-     NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, NULL},
     {0x6f, X86_DECODE_CMD_OUTS, 0, false,
-     NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, NULL},
 
     {0x70, X86_DECODE_CMD_JXX, 1, false,
-     NULL, NULL, NULL, NULL, decode_jxx, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, decode_jxx},
     {0x71, X86_DECODE_CMD_JXX, 1, false,
-     NULL, NULL, NULL, NULL, decode_jxx, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, decode_jxx},
     {0x72, X86_DECODE_CMD_JXX, 1, false,
-     NULL, NULL, NULL, NULL, decode_jxx, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, decode_jxx},
     {0x73, X86_DECODE_CMD_JXX, 1, false,
-     NULL, NULL, NULL, NULL, decode_jxx, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, decode_jxx},
     {0x74, X86_DECODE_CMD_JXX, 1, false,
-     NULL, NULL, NULL, NULL, decode_jxx, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, decode_jxx},
     {0x75, X86_DECODE_CMD_JXX, 1, false,
-     NULL, NULL, NULL, NULL, decode_jxx, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, decode_jxx},
     {0x76, X86_DECODE_CMD_JXX, 1, false,
-     NULL, NULL, NULL, NULL, decode_jxx, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, decode_jxx},
     {0x77, X86_DECODE_CMD_JXX, 1, false,
-     NULL, NULL, NULL, NULL, decode_jxx, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, decode_jxx},
     {0x78, X86_DECODE_CMD_JXX, 1, false,
-     NULL, NULL, NULL, NULL, decode_jxx, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, decode_jxx},
     {0x79, X86_DECODE_CMD_JXX, 1, false,
-     NULL, NULL, NULL, NULL, decode_jxx, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, decode_jxx},
     {0x7a, X86_DECODE_CMD_JXX, 1, false,
-     NULL, NULL, NULL, NULL, decode_jxx, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, decode_jxx},
     {0x7b, X86_DECODE_CMD_JXX, 1, false,
-     NULL, NULL, NULL, NULL, decode_jxx, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, decode_jxx},
     {0x7c, X86_DECODE_CMD_JXX, 1, false,
-     NULL, NULL, NULL, NULL, decode_jxx, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, decode_jxx},
     {0x7d, X86_DECODE_CMD_JXX, 1, false,
-     NULL, NULL, NULL, NULL, decode_jxx, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, decode_jxx},
     {0x7e, X86_DECODE_CMD_JXX, 1, false,
-     NULL, NULL, NULL, NULL, decode_jxx, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, decode_jxx},
     {0x7f, X86_DECODE_CMD_JXX, 1, false,
-     NULL, NULL, NULL, NULL, decode_jxx, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, decode_jxx},
 
     {0x80, X86_DECODE_CMD_INVL, 1, true, decode_modrm_rm, decode_imm8,
-     NULL, NULL, decode_addgroup, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, decode_addgroup},
     {0x81, X86_DECODE_CMD_INVL, 0, true, decode_modrm_rm, decode_imm,
-     NULL, NULL, decode_addgroup, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, decode_addgroup},
     {0x82, X86_DECODE_CMD_INVL, 1, true, decode_modrm_rm, decode_imm8,
-     NULL, NULL, decode_addgroup, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, decode_addgroup},
     {0x83, X86_DECODE_CMD_INVL, 0, true, decode_modrm_rm, decode_imm8_signed,
-     NULL, NULL, decode_addgroup, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, decode_addgroup},
     {0x84, X86_DECODE_CMD_TST, 1, true, decode_modrm_rm, decode_modrm_reg,
-     NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL},
     {0x85, X86_DECODE_CMD_TST, 0, true, decode_modrm_rm, decode_modrm_reg,
-     NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL},
     {0x86, X86_DECODE_CMD_XCHG, 1, true, decode_modrm_reg, decode_modrm_rm,
-     NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL},
     {0x87, X86_DECODE_CMD_XCHG, 0, true, decode_modrm_reg, decode_modrm_rm,
-     NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL},
     {0x88, X86_DECODE_CMD_MOV, 1, true, decode_modrm_rm, decode_modrm_reg,
-     NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL},
     {0x89, X86_DECODE_CMD_MOV, 0, true, decode_modrm_rm, decode_modrm_reg,
-     NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL},
     {0x8a, X86_DECODE_CMD_MOV, 1, true, decode_modrm_reg, decode_modrm_rm,
-     NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL},
     {0x8b, X86_DECODE_CMD_MOV, 0, true, decode_modrm_reg, decode_modrm_rm,
-     NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL},
     {0x8c, X86_DECODE_CMD_MOV_FROM_SEG, 0, true, decode_modrm_rm,
-     decode_modrm_reg, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     decode_modrm_reg, NULL, NULL, NULL},
     {0x8d, X86_DECODE_CMD_LEA, 0, true, decode_modrm_reg, decode_modrm_rm,
-     NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL},
     {0x8e, X86_DECODE_CMD_MOV_TO_SEG, 0, true, decode_modrm_reg,
-     decode_modrm_rm, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     decode_modrm_rm, NULL, NULL, NULL},
     {0x8f, X86_DECODE_CMD_POP, 0, true, decode_modrm_rm,
-     NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL},
 
     {0x90, X86_DECODE_CMD_NOP, 0, false,
-     NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, NULL},
     {0x91, X86_DECODE_CMD_XCHG, 0, false, NULL, decode_rax,
-     NULL, NULL, decode_xchgroup, RFLAGS_MASK_NONE},
+     NULL, NULL, decode_xchgroup},
     {0x92, X86_DECODE_CMD_XCHG, 0, false, NULL, decode_rax,
-     NULL, NULL, decode_xchgroup, RFLAGS_MASK_NONE},
+     NULL, NULL, decode_xchgroup},
     {0x93, X86_DECODE_CMD_XCHG, 0, false, NULL, decode_rax,
-     NULL, NULL, decode_xchgroup, RFLAGS_MASK_NONE},
+     NULL, NULL, decode_xchgroup},
     {0x94, X86_DECODE_CMD_XCHG, 0, false, NULL, decode_rax,
-     NULL, NULL, decode_xchgroup, RFLAGS_MASK_NONE},
+     NULL, NULL, decode_xchgroup},
     {0x95, X86_DECODE_CMD_XCHG, 0, false, NULL, decode_rax,
-     NULL, NULL, decode_xchgroup, RFLAGS_MASK_NONE},
+     NULL, NULL, decode_xchgroup},
     {0x96, X86_DECODE_CMD_XCHG, 0, false, NULL, decode_rax,
-     NULL, NULL, decode_xchgroup, RFLAGS_MASK_NONE},
+     NULL, NULL, decode_xchgroup},
     {0x97, X86_DECODE_CMD_XCHG, 0, false, NULL, decode_rax,
-     NULL, NULL, decode_xchgroup, RFLAGS_MASK_NONE},
+     NULL, NULL, decode_xchgroup},
 
     {0x98, X86_DECODE_CMD_CBW, 0, false, NULL, NULL,
-     NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL},
     {0x99, X86_DECODE_CMD_CWD, 0, false, NULL, NULL,
-     NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL},
 
     {0x9a, X86_DECODE_CMD_CALL_FAR, 0, false, NULL,
-     NULL, NULL, NULL, decode_farjmp, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, decode_farjmp},
 
     {0x9c, X86_DECODE_CMD_PUSHF, 0, false, NULL, NULL,
-     NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL},
     /*{0x9d, X86_DECODE_CMD_POPF, 0, false, NULL, NULL,
-     NULL, NULL, NULL, RFLAGS_MASK_POPF},*/
+     NULL, NULL, NULL},*/
     {0x9e, X86_DECODE_CMD_SAHF, 0, false, NULL, NULL,
-     NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL},
     {0x9f, X86_DECODE_CMD_LAHF, 0, false, NULL, NULL,
-     NULL, NULL, NULL, RFLAGS_MASK_LAHF},
+     NULL, NULL, NULL},
 
     {0xa0, X86_DECODE_CMD_MOV, 1, false, decode_rax, fetch_moffs,
-     NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL},
     {0xa1, X86_DECODE_CMD_MOV, 0, false, decode_rax, fetch_moffs,
-     NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL},
     {0xa2, X86_DECODE_CMD_MOV, 1, false, fetch_moffs, decode_rax,
-     NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL},
     {0xa3, X86_DECODE_CMD_MOV, 0, false, fetch_moffs, decode_rax,
-     NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL},
 
     {0xa4, X86_DECODE_CMD_MOVS, 1, false, NULL, NULL,
-     NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL},
     {0xa5, X86_DECODE_CMD_MOVS, 0, false, NULL, NULL,
-     NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL},
     {0xa6, X86_DECODE_CMD_CMPS, 1, false, NULL, NULL,
-     NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL},
     {0xa7, X86_DECODE_CMD_CMPS, 0, false, NULL, NULL,
-     NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL},
     {0xaa, X86_DECODE_CMD_STOS, 1, false, NULL, NULL,
-     NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL},
     {0xab, X86_DECODE_CMD_STOS, 0, false, NULL, NULL,
-     NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL},
     {0xac, X86_DECODE_CMD_LODS, 1, false, NULL, NULL,
-     NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL},
     {0xad, X86_DECODE_CMD_LODS, 0, false, NULL, NULL,
-     NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL},
     {0xae, X86_DECODE_CMD_SCAS, 1, false, NULL, NULL,
-     NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL},
     {0xaf, X86_DECODE_CMD_SCAS, 0, false, NULL, NULL,
-     NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL},
 
     {0xa8, X86_DECODE_CMD_TST, 1, false, decode_rax, decode_imm,
-     NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL},
     {0xa9, X86_DECODE_CMD_TST, 0, false, decode_rax, decode_imm,
-     NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL},
 
     {0xb0, X86_DECODE_CMD_MOV, 1, false, NULL,
-     NULL, NULL, NULL, decode_movgroup8, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, decode_movgroup8},
     {0xb1, X86_DECODE_CMD_MOV, 1, false, NULL,
-     NULL, NULL, NULL, decode_movgroup8, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, decode_movgroup8},
     {0xb2, X86_DECODE_CMD_MOV, 1, false, NULL,
-     NULL, NULL, NULL, decode_movgroup8, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, decode_movgroup8},
     {0xb3, X86_DECODE_CMD_MOV, 1, false, NULL,
-     NULL, NULL, NULL, decode_movgroup8, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, decode_movgroup8},
     {0xb4, X86_DECODE_CMD_MOV, 1, false, NULL,
-     NULL, NULL, NULL, decode_movgroup8, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, decode_movgroup8},
     {0xb5, X86_DECODE_CMD_MOV, 1, false, NULL,
-     NULL, NULL, NULL, decode_movgroup8, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, decode_movgroup8},
     {0xb6, X86_DECODE_CMD_MOV, 1, false, NULL,
-     NULL, NULL, NULL, decode_movgroup8, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, decode_movgroup8},
     {0xb7, X86_DECODE_CMD_MOV, 1, false, NULL,
-     NULL, NULL, NULL, decode_movgroup8, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, decode_movgroup8},
 
     {0xb8, X86_DECODE_CMD_MOV, 0, false, NULL,
-     NULL, NULL, NULL, decode_movgroup, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, decode_movgroup},
     {0xb9, X86_DECODE_CMD_MOV, 0, false, NULL,
-     NULL, NULL, NULL, decode_movgroup, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, decode_movgroup},
     {0xba, X86_DECODE_CMD_MOV, 0, false, NULL,
-     NULL, NULL, NULL, decode_movgroup, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, decode_movgroup},
     {0xbb, X86_DECODE_CMD_MOV, 0, false, NULL,
-     NULL, NULL, NULL, decode_movgroup, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, decode_movgroup},
     {0xbc, X86_DECODE_CMD_MOV, 0, false, NULL,
-     NULL, NULL, NULL, decode_movgroup, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, decode_movgroup},
     {0xbd, X86_DECODE_CMD_MOV, 0, false, NULL,
-     NULL, NULL, NULL, decode_movgroup, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, decode_movgroup},
     {0xbe, X86_DECODE_CMD_MOV, 0, false, NULL,
-     NULL, NULL, NULL, decode_movgroup, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, decode_movgroup},
     {0xbf, X86_DECODE_CMD_MOV, 0, false, NULL,
-     NULL, NULL, NULL, decode_movgroup, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, decode_movgroup},
 
     {0xc0, X86_DECODE_CMD_INVL, 1, true, decode_modrm_rm, decode_imm8,
-     NULL, NULL, decode_rotgroup, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, decode_rotgroup},
     {0xc1, X86_DECODE_CMD_INVL, 0, true, decode_modrm_rm, decode_imm8,
-     NULL, NULL, decode_rotgroup, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, decode_rotgroup},
 
     {0xc2, X86_DECODE_RET_NEAR, 0, false, decode_imm16,
-     NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL},
     {0xc3, X86_DECODE_RET_NEAR, 0, false, NULL,
-     NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL},
 
     {0xc4, X86_DECODE_CMD_LES, 0, true, decode_modrm_reg, decode_modrm_rm,
-     NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL},
     {0xc5, X86_DECODE_CMD_LDS, 0, true, decode_modrm_reg, decode_modrm_rm,
-     NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL},
 
     {0xc6, X86_DECODE_CMD_MOV, 1, true, decode_modrm_rm, decode_imm8,
-     NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL},
     {0xc7, X86_DECODE_CMD_MOV, 0, true, decode_modrm_rm, decode_imm,
-     NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL},
 
     {0xc8, X86_DECODE_CMD_ENTER, 0, false, decode_imm16, decode_imm8,
-     NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL},
     {0xc9, X86_DECODE_CMD_LEAVE, 0, false, NULL, NULL,
-     NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL},
     {0xca, X86_DECODE_RET_FAR, 0, false, decode_imm16, NULL,
-     NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL},
     {0xcb, X86_DECODE_RET_FAR, 0, false, decode_imm_0, NULL,
-     NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL},
     {0xcd, X86_DECODE_CMD_INT, 0, false, decode_imm8, NULL,
-     NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL},
     /*{0xcf, X86_DECODE_CMD_IRET, 0, false, NULL, NULL,
-     NULL, NULL, NULL, RFLAGS_MASK_IRET},*/
+     NULL, NULL, NULL},*/
 
     {0xd0, X86_DECODE_CMD_INVL, 1, true, decode_modrm_rm, decode_imm_1,
-     NULL, NULL, decode_rotgroup, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, decode_rotgroup},
     {0xd1, X86_DECODE_CMD_INVL, 0, true, decode_modrm_rm, decode_imm_1,
-     NULL, NULL, decode_rotgroup, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, decode_rotgroup},
     {0xd2, X86_DECODE_CMD_INVL, 1, true, decode_modrm_rm, decode_rcx,
-     NULL, NULL, decode_rotgroup, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, decode_rotgroup},
     {0xd3, X86_DECODE_CMD_INVL, 0, true, decode_modrm_rm, decode_rcx,
-     NULL, NULL, decode_rotgroup, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, decode_rotgroup},
 
     {0xd4, X86_DECODE_CMD_AAM, 0, false, decode_imm8,
-     NULL, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL, NULL},
     {0xd5, X86_DECODE_CMD_AAD, 0, false, decode_imm8,
-     NULL, NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL, NULL},
 
     {0xd7, X86_DECODE_CMD_XLAT, 0, false,
-     NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, NULL},
 
     {0xd8, X86_DECODE_CMD_INVL, 0, true, NULL,
-     NULL, NULL, NULL, decode_x87_ins, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, decode_x87_ins},
     {0xd9, X86_DECODE_CMD_INVL, 0, true, NULL,
-     NULL, NULL, NULL, decode_x87_ins, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, decode_x87_ins},
     {0xda, X86_DECODE_CMD_INVL, 0, true, NULL,
-     NULL, NULL, NULL, decode_x87_ins, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, decode_x87_ins},
     {0xdb, X86_DECODE_CMD_INVL, 0, true, NULL,
-     NULL, NULL, NULL, decode_x87_ins, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, decode_x87_ins},
     {0xdc, X86_DECODE_CMD_INVL, 0, true, NULL,
-     NULL, NULL, NULL, decode_x87_ins, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, decode_x87_ins},
     {0xdd, X86_DECODE_CMD_INVL, 0, true, NULL,
-     NULL, NULL, NULL, decode_x87_ins, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, decode_x87_ins},
     {0xde, X86_DECODE_CMD_INVL, 0, true, NULL,
-     NULL, NULL, NULL, decode_x87_ins, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, decode_x87_ins},
     {0xdf, X86_DECODE_CMD_INVL, 0, true, NULL,
-     NULL, NULL, NULL, decode_x87_ins, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, decode_x87_ins},
 
     {0xe0, X86_DECODE_CMD_LOOP, 0, false, decode_imm8_signed,
-     NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL},
     {0xe1, X86_DECODE_CMD_LOOP, 0, false, decode_imm8_signed,
-     NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL},
     {0xe2, X86_DECODE_CMD_LOOP, 0, false, decode_imm8_signed,
-     NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL},
 
     {0xe3, X86_DECODE_CMD_JCXZ, 1, false,
-     NULL, NULL, NULL, NULL, decode_jxx, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, decode_jxx},
 
     {0xe4, X86_DECODE_CMD_IN, 1, false, decode_imm8,
-     NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL},
     {0xe5, X86_DECODE_CMD_IN, 0, false, decode_imm8,
-     NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL},
     {0xe6, X86_DECODE_CMD_OUT, 1, false, decode_imm8,
-     NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL},
     {0xe7, X86_DECODE_CMD_OUT, 0, false, decode_imm8,
-     NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL},
     {0xe8, X86_DECODE_CMD_CALL_NEAR, 0, false, decode_imm_signed,
-     NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL},
     {0xe9, X86_DECODE_CMD_JMP_NEAR, 0, false, decode_imm_signed,
-     NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL},
     {0xea, X86_DECODE_CMD_JMP_FAR, 0, false,
-     NULL, NULL, NULL, NULL, decode_farjmp, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, decode_farjmp},
     {0xeb, X86_DECODE_CMD_JMP_NEAR, 1, false, decode_imm8_signed,
-     NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL},
     {0xec, X86_DECODE_CMD_IN, 1, false,
-     NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, NULL},
     {0xed, X86_DECODE_CMD_IN, 0, false,
-     NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, NULL},
     {0xee, X86_DECODE_CMD_OUT, 1, false,
-     NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, NULL},
     {0xef, X86_DECODE_CMD_OUT, 0, false,
-     NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, NULL},
 
     {0xf4, X86_DECODE_CMD_HLT, 0, false,
-     NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, NULL},
 
     {0xf5, X86_DECODE_CMD_CMC, 0, false,
-     NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_CF},
+     NULL, NULL, NULL, NULL, NULL},
 
     {0xf6, X86_DECODE_CMD_INVL, 1, true,
-     NULL, NULL, NULL, NULL, decode_f7group, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL, NULL, decode_f7group},
     {0xf7, X86_DECODE_CMD_INVL, 0, true,
-     NULL, NULL, NULL, NULL, decode_f7group, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL, NULL, decode_f7group},
 
     {0xf8, X86_DECODE_CMD_CLC, 0, false,
-     NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_CF},
+     NULL, NULL, NULL, NULL, NULL},
     {0xf9, X86_DECODE_CMD_STC, 0, false,
-     NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_CF},
+     NULL, NULL, NULL, NULL, NULL},
 
     {0xfa, X86_DECODE_CMD_CLI, 0, false,
-     NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_IF},
+     NULL, NULL, NULL, NULL, NULL},
     {0xfb, X86_DECODE_CMD_STI, 0, false,
-     NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_IF},
+     NULL, NULL, NULL, NULL, NULL},
     {0xfc, X86_DECODE_CMD_CLD, 0, false,
-     NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_DF},
+     NULL, NULL, NULL, NULL, NULL},
     {0xfd, X86_DECODE_CMD_STD, 0, false,
-     NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_DF},
+     NULL, NULL, NULL, NULL, NULL},
     {0xfe, X86_DECODE_CMD_INVL, 1, true, decode_modrm_rm,
-     NULL, NULL, NULL, decode_incgroup2, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL, decode_incgroup2},
     {0xff, X86_DECODE_CMD_INVL, 0, true, decode_modrm_rm,
-     NULL, NULL, NULL, decode_ffgroup, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL, decode_ffgroup},
 };
 
 struct decode_tbl _2op_inst[] = {
     {0x0, X86_DECODE_CMD_INVL, 0, true, decode_modrm_rm,
-     NULL, NULL, NULL, decode_sldtgroup, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, decode_sldtgroup},
     {0x1, X86_DECODE_CMD_INVL, 0, true, decode_modrm_rm,
-     NULL, NULL, NULL, decode_lidtgroup, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, decode_lidtgroup},
     {0x6, X86_DECODE_CMD_CLTS, 0, false,
-     NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_TF},
+     NULL, NULL, NULL, NULL, NULL},
     {0x9, X86_DECODE_CMD_WBINVD, 0, false,
-     NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, NULL},
     {0x18, X86_DECODE_CMD_PREFETCH, 0, true,
-     NULL, NULL, NULL, NULL, decode_x87_general, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, decode_x87_general},
     {0x1f, X86_DECODE_CMD_NOP, 0, true, decode_modrm_rm,
-     NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL},
     {0x20, X86_DECODE_CMD_MOV_FROM_CR, 0, true, decode_modrm_rm,
-     decode_modrm_reg, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     decode_modrm_reg, NULL, NULL, NULL},
     {0x21, X86_DECODE_CMD_MOV_FROM_DR, 0, true, decode_modrm_rm,
-     decode_modrm_reg, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     decode_modrm_reg, NULL, NULL, NULL},
     {0x22, X86_DECODE_CMD_MOV_TO_CR, 0, true, decode_modrm_reg,
-     decode_modrm_rm, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     decode_modrm_rm, NULL, NULL, NULL},
     {0x23, X86_DECODE_CMD_MOV_TO_DR, 0, true, decode_modrm_reg,
-     decode_modrm_rm, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     decode_modrm_rm, NULL, NULL, NULL},
     {0x30, X86_DECODE_CMD_WRMSR, 0, false,
-     NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, NULL},
     {0x31, X86_DECODE_CMD_RDTSC, 0, false,
-     NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, NULL},
     {0x32, X86_DECODE_CMD_RDMSR, 0, false,
-     NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, NULL},
     {0x40, X86_DECODE_CMD_CMOV, 0, true, decode_modrm_reg, decode_modrm_rm,
-     NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL},
     {0x41, X86_DECODE_CMD_CMOV, 0, true, decode_modrm_reg, decode_modrm_rm,
-     NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL},
     {0x42, X86_DECODE_CMD_CMOV, 0, true, decode_modrm_reg, decode_modrm_rm,
-     NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL},
     {0x43, X86_DECODE_CMD_CMOV, 0, true, decode_modrm_reg, decode_modrm_rm,
-     NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL},
     {0x44, X86_DECODE_CMD_CMOV, 0, true, decode_modrm_reg, decode_modrm_rm,
-     NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL},
     {0x45, X86_DECODE_CMD_CMOV, 0, true, decode_modrm_reg, decode_modrm_rm,
-     NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL},
     {0x46, X86_DECODE_CMD_CMOV, 0, true, decode_modrm_reg, decode_modrm_rm,
-     NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL},
     {0x47, X86_DECODE_CMD_CMOV, 0, true, decode_modrm_reg, decode_modrm_rm,
-     NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL},
     {0x48, X86_DECODE_CMD_CMOV, 0, true, decode_modrm_reg, decode_modrm_rm,
-     NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL},
     {0x49, X86_DECODE_CMD_CMOV, 0, true, decode_modrm_reg, decode_modrm_rm,
-     NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL},
     {0x4a, X86_DECODE_CMD_CMOV, 0, true, decode_modrm_reg, decode_modrm_rm,
-     NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL},
     {0x4b, X86_DECODE_CMD_CMOV, 0, true, decode_modrm_reg, decode_modrm_rm,
-     NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL},
     {0x4c, X86_DECODE_CMD_CMOV, 0, true, decode_modrm_reg, decode_modrm_rm,
-     NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL},
     {0x4d, X86_DECODE_CMD_CMOV, 0, true, decode_modrm_reg, decode_modrm_rm,
-     NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL},
     {0x4e, X86_DECODE_CMD_CMOV, 0, true, decode_modrm_reg, decode_modrm_rm,
-     NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL},
     {0x4f, X86_DECODE_CMD_CMOV, 0, true, decode_modrm_reg, decode_modrm_rm,
-     NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL},
     {0x77, X86_DECODE_CMD_EMMS, 0, false,
-     NULL, NULL, NULL, NULL, decode_x87_general, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, decode_x87_general},
     {0x82, X86_DECODE_CMD_JXX, 0, false,
-     NULL, NULL, NULL, NULL, decode_jxx, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, decode_jxx},
     {0x83, X86_DECODE_CMD_JXX, 0, false,
-     NULL, NULL, NULL, NULL, decode_jxx, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, decode_jxx},
     {0x84, X86_DECODE_CMD_JXX, 0, false,
-     NULL, NULL, NULL, NULL, decode_jxx, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, decode_jxx},
     {0x85, X86_DECODE_CMD_JXX, 0, false,
-     NULL, NULL, NULL, NULL, decode_jxx, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, decode_jxx},
     {0x86, X86_DECODE_CMD_JXX, 0, false,
-     NULL, NULL, NULL, NULL, decode_jxx, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, decode_jxx},
     {0x87, X86_DECODE_CMD_JXX, 0, false,
-     NULL, NULL, NULL, NULL, decode_jxx, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, decode_jxx},
     {0x88, X86_DECODE_CMD_JXX, 0, false,
-     NULL, NULL, NULL, NULL, decode_jxx, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, decode_jxx},
     {0x89, X86_DECODE_CMD_JXX, 0, false,
-     NULL, NULL, NULL, NULL, decode_jxx, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, decode_jxx},
     {0x8a, X86_DECODE_CMD_JXX, 0, false,
-     NULL, NULL, NULL, NULL, decode_jxx, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, decode_jxx},
     {0x8b, X86_DECODE_CMD_JXX, 0, false,
-     NULL, NULL, NULL, NULL, decode_jxx, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, decode_jxx},
     {0x8c, X86_DECODE_CMD_JXX, 0, false,
-     NULL, NULL, NULL, NULL, decode_jxx, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, decode_jxx},
     {0x8d, X86_DECODE_CMD_JXX, 0, false,
-     NULL, NULL, NULL, NULL, decode_jxx, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, decode_jxx},
     {0x8e, X86_DECODE_CMD_JXX, 0, false,
-     NULL, NULL, NULL, NULL, decode_jxx, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, decode_jxx},
     {0x8f, X86_DECODE_CMD_JXX, 0, false,
-     NULL, NULL, NULL, NULL, decode_jxx, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, decode_jxx},
     {0x90, X86_DECODE_CMD_SETXX, 1, true, decode_modrm_rm,
-     NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL},
     {0x91, X86_DECODE_CMD_SETXX, 1, true, decode_modrm_rm,
-     NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL},
     {0x92, X86_DECODE_CMD_SETXX, 1, true, decode_modrm_rm,
-     NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL},
     {0x93, X86_DECODE_CMD_SETXX, 1, true, decode_modrm_rm,
-     NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL},
     {0x94, X86_DECODE_CMD_SETXX, 1, true, decode_modrm_rm,
-     NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL},
     {0x95, X86_DECODE_CMD_SETXX, 1, true, decode_modrm_rm,
-     NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL},
     {0x96, X86_DECODE_CMD_SETXX, 1, true, decode_modrm_rm,
-     NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL},
     {0x97, X86_DECODE_CMD_SETXX, 1, true, decode_modrm_rm,
-     NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL},
     {0x98, X86_DECODE_CMD_SETXX, 1, true, decode_modrm_rm,
-     NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL},
     {0x99, X86_DECODE_CMD_SETXX, 1, true, decode_modrm_rm,
-     NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL},
     {0x9a, X86_DECODE_CMD_SETXX, 1, true, decode_modrm_rm,
-     NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL},
     {0x9b, X86_DECODE_CMD_SETXX, 1, true, decode_modrm_rm,
-     NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL},
     {0x9c, X86_DECODE_CMD_SETXX, 1, true, decode_modrm_rm,
-     NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL},
     {0x9d, X86_DECODE_CMD_SETXX, 1, true, decode_modrm_rm,
-     NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL},
     {0x9e, X86_DECODE_CMD_SETXX, 1, true, decode_modrm_rm,
-     NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL},
     {0x9f, X86_DECODE_CMD_SETXX, 1, true, decode_modrm_rm,
-     NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL},
 
     {0xb0, X86_DECODE_CMD_CMPXCHG, 1, true, decode_modrm_rm, decode_modrm_reg,
-     NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL},
     {0xb1, X86_DECODE_CMD_CMPXCHG, 0, true, decode_modrm_rm, decode_modrm_reg,
-     NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL},
 
     {0xb6, X86_DECODE_CMD_MOVZX, 0, true, decode_modrm_reg, decode_modrm_rm,
-     NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL},
     {0xb7, X86_DECODE_CMD_MOVZX, 0, true, decode_modrm_reg, decode_modrm_rm,
-     NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL},
     {0xb8, X86_DECODE_CMD_POPCNT, 0, true, decode_modrm_reg, decode_modrm_rm,
-     NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL},
     {0xbe, X86_DECODE_CMD_MOVSX, 0, true, decode_modrm_reg, decode_modrm_rm,
-     NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL},
     {0xbf, X86_DECODE_CMD_MOVSX, 0, true, decode_modrm_reg, decode_modrm_rm,
-     NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL},
     {0xa0, X86_DECODE_CMD_PUSH_SEG, 0, false, false,
-     NULL, NULL, NULL, decode_pushseg, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, decode_pushseg},
     {0xa1, X86_DECODE_CMD_POP_SEG, 0, false, false,
-     NULL, NULL, NULL, decode_popseg, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, decode_popseg},
     {0xa2, X86_DECODE_CMD_CPUID, 0, false,
-     NULL, NULL, NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, NULL},
     {0xa3, X86_DECODE_CMD_BT, 0, true, decode_modrm_rm, decode_modrm_reg,
-     NULL, NULL, NULL, RFLAGS_MASK_CF},
+     NULL, NULL, NULL},
     {0xa4, X86_DECODE_CMD_SHLD, 0, true, decode_modrm_rm, decode_modrm_reg,
-     decode_imm8, NULL, NULL, RFLAGS_MASK_OSZAPC},
+     decode_imm8, NULL, NULL},
     {0xa5, X86_DECODE_CMD_SHLD, 0, true, decode_modrm_rm, decode_modrm_reg,
-     decode_rcx, NULL, NULL, RFLAGS_MASK_OSZAPC},
+     decode_rcx, NULL, NULL},
     {0xa8, X86_DECODE_CMD_PUSH_SEG, 0, false, false,
-     NULL, NULL, NULL, decode_pushseg, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, decode_pushseg},
     {0xa9, X86_DECODE_CMD_POP_SEG, 0, false, false,
-     NULL, NULL, NULL, decode_popseg, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, decode_popseg},
     {0xab, X86_DECODE_CMD_BTS, 0, true, decode_modrm_rm, decode_modrm_reg,
-     NULL, NULL, NULL, RFLAGS_MASK_CF},
+     NULL, NULL, NULL},
     {0xac, X86_DECODE_CMD_SHRD, 0, true, decode_modrm_rm, decode_modrm_reg,
-     decode_imm8, NULL, NULL, RFLAGS_MASK_OSZAPC},
+     decode_imm8, NULL, NULL},
     {0xad, X86_DECODE_CMD_SHRD, 0, true, decode_modrm_rm, decode_modrm_reg,
-     decode_rcx, NULL, NULL, RFLAGS_MASK_OSZAPC},
+     decode_rcx, NULL, NULL},
 
     {0xae, X86_DECODE_CMD_INVL, 0, true, decode_modrm_rm,
-     NULL, NULL, NULL, decode_aegroup, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, decode_aegroup},
 
     {0xaf, X86_DECODE_CMD_IMUL_2, 0, true, decode_modrm_reg, decode_modrm_rm,
-     NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL},
     {0xb2, X86_DECODE_CMD_LSS, 0, true, decode_modrm_reg, decode_modrm_rm,
-     NULL, NULL, NULL, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL},
     {0xb3, X86_DECODE_CMD_BTR, 0, true, decode_modrm_rm, decode_modrm_reg,
-     NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL},
     {0xba, X86_DECODE_CMD_INVL, 0, true, decode_modrm_rm, decode_imm8,
-     NULL, NULL, decode_btgroup, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, decode_btgroup},
     {0xbb, X86_DECODE_CMD_BTC, 0, true, decode_modrm_rm, decode_modrm_reg,
-     NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL},
     {0xbc, X86_DECODE_CMD_BSF, 0, true, decode_modrm_reg, decode_modrm_rm,
-     NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL},
     {0xbd, X86_DECODE_CMD_BSR, 0, true, decode_modrm_reg, decode_modrm_rm,
-     NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL},
 
     {0xc1, X86_DECODE_CMD_XADD, 0, true, decode_modrm_rm, decode_modrm_reg,
-     NULL, NULL, NULL, RFLAGS_MASK_OSZAPC},
+     NULL, NULL, NULL},
 
     {0xc7, X86_DECODE_CMD_CMPXCHG8B, 0, true, decode_modrm_rm,
-     NULL, NULL, NULL, NULL, RFLAGS_MASK_ZF},
+     NULL, NULL, NULL, NULL},
 
     {0xc8, X86_DECODE_CMD_BSWAP, 0, false,
-     NULL, NULL, NULL, NULL, decode_bswap, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, decode_bswap},
     {0xc9, X86_DECODE_CMD_BSWAP, 0, false,
-     NULL, NULL, NULL, NULL, decode_bswap, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, decode_bswap},
     {0xca, X86_DECODE_CMD_BSWAP, 0, false,
-     NULL, NULL, NULL, NULL, decode_bswap, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, decode_bswap},
     {0xcb, X86_DECODE_CMD_BSWAP, 0, false,
-     NULL, NULL, NULL, NULL, decode_bswap, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, decode_bswap},
     {0xcc, X86_DECODE_CMD_BSWAP, 0, false,
-     NULL, NULL, NULL, NULL, decode_bswap, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, decode_bswap},
     {0xcd, X86_DECODE_CMD_BSWAP, 0, false,
-     NULL, NULL, NULL, NULL, decode_bswap, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, decode_bswap},
     {0xce, X86_DECODE_CMD_BSWAP, 0, false,
-     NULL, NULL, NULL, NULL, decode_bswap, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, decode_bswap},
     {0xcf, X86_DECODE_CMD_BSWAP, 0, false,
-     NULL, NULL, NULL, NULL, decode_bswap, RFLAGS_MASK_NONE},
+     NULL, NULL, NULL, NULL, decode_bswap},
 };
 
 struct decode_x87_tbl invl_inst_x87 = {0x0, 0, 0, 0, 0, false, false, NULL,
@@ -1427,207 +1412,207 @@ struct decode_x87_tbl invl_inst_x87 = {0x0, 0, 0, 0, 0, false, false, NULL,
 
 struct decode_x87_tbl _x87_inst[] = {
     {0xd8, 0, 3, X86_DECODE_CMD_FADD, 10, false, false,
-     decode_x87_modrm_st0, decode_decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_st0, decode_decode_x87_modrm_st0, NULL},
     {0xd8, 0, 0, X86_DECODE_CMD_FADD, 4, false, false, decode_x87_modrm_st0,
-     decode_x87_modrm_floatp, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_floatp, NULL},
     {0xd8, 1, 3, X86_DECODE_CMD_FMUL, 10, false, false, decode_x87_modrm_st0,
-     decode_decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+     decode_decode_x87_modrm_st0, NULL},
     {0xd8, 1, 0, X86_DECODE_CMD_FMUL, 4, false, false, decode_x87_modrm_st0,
-     decode_x87_modrm_floatp, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_floatp, NULL},
     {0xd8, 4, 3, X86_DECODE_CMD_FSUB, 10, false, false, decode_x87_modrm_st0,
-     decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_st0, NULL},
     {0xd8, 4, 0, X86_DECODE_CMD_FSUB, 4, false, false, decode_x87_modrm_st0,
-     decode_x87_modrm_floatp, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_floatp, NULL},
     {0xd8, 5, 3, X86_DECODE_CMD_FSUB, 10, true, false, decode_x87_modrm_st0,
-     decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_st0, NULL},
     {0xd8, 5, 0, X86_DECODE_CMD_FSUB, 4, true, false, decode_x87_modrm_st0,
-     decode_x87_modrm_floatp, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_floatp, NULL},
     {0xd8, 6, 3, X86_DECODE_CMD_FDIV, 10, false, false, decode_x87_modrm_st0,
-     decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_st0, NULL},
     {0xd8, 6, 0, X86_DECODE_CMD_FDIV, 4, false, false, decode_x87_modrm_st0,
-     decode_x87_modrm_floatp, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_floatp, NULL},
     {0xd8, 7, 3, X86_DECODE_CMD_FDIV, 10, true, false, decode_x87_modrm_st0,
-     decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_st0, NULL},
     {0xd8, 7, 0, X86_DECODE_CMD_FDIV, 4, true, false, decode_x87_modrm_st0,
-     decode_x87_modrm_floatp, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_floatp, NULL},
 
     {0xd9, 0, 3, X86_DECODE_CMD_FLD, 10, false, false,
-     decode_x87_modrm_st0, NULL, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_st0, NULL, NULL},
     {0xd9, 0, 0, X86_DECODE_CMD_FLD, 4, false, false,
-     decode_x87_modrm_floatp, NULL, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_floatp, NULL, NULL},
     {0xd9, 1, 3, X86_DECODE_CMD_FXCH, 10, false, false, decode_x87_modrm_st0,
-     decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_st0, NULL},
     {0xd9, 1, 0, X86_DECODE_CMD_INVL, 10, false, false,
-     decode_x87_modrm_st0, NULL, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_st0, NULL, NULL},
     {0xd9, 2, 3, X86_DECODE_CMD_INVL, 10, false, false,
-     decode_x87_modrm_st0, NULL, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_st0, NULL, NULL},
     {0xd9, 2, 0, X86_DECODE_CMD_FST, 4, false, false,
-     decode_x87_modrm_floatp, NULL, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_floatp, NULL, NULL},
     {0xd9, 3, 3, X86_DECODE_CMD_INVL, 10, false, false,
-     decode_x87_modrm_st0, NULL, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_st0, NULL, NULL},
     {0xd9, 3, 0, X86_DECODE_CMD_FST, 4, false, true,
-     decode_x87_modrm_floatp, NULL, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_floatp, NULL, NULL},
     {0xd9, 4, 3, X86_DECODE_CMD_INVL, 10, false, false,
-     decode_x87_modrm_st0, NULL, decode_d9_4, RFLAGS_MASK_NONE},
+     decode_x87_modrm_st0, NULL, decode_d9_4},
     {0xd9, 4, 0, X86_DECODE_CMD_INVL, 4, false, false,
-     decode_x87_modrm_bytep, NULL, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_bytep, NULL, NULL},
     {0xd9, 5, 3, X86_DECODE_CMD_FLDxx, 10, false, false, NULL, NULL, NULL,
      RFLAGS_MASK_NONE},
     {0xd9, 5, 0, X86_DECODE_CMD_FLDCW, 2, false, false,
-     decode_x87_modrm_bytep, NULL, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_bytep, NULL, NULL},
 
     {0xd9, 7, 3, X86_DECODE_CMD_FNSTCW, 2, false, false,
-     decode_x87_modrm_bytep, NULL, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_bytep, NULL, NULL},
     {0xd9, 7, 0, X86_DECODE_CMD_FNSTCW, 2, false, false,
-     decode_x87_modrm_bytep, NULL, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_bytep, NULL, NULL},
 
     {0xda, 0, 3, X86_DECODE_CMD_FCMOV, 10, false, false,
-     decode_x87_modrm_st0, decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_st0, decode_x87_modrm_st0, NULL},
     {0xda, 0, 0, X86_DECODE_CMD_FADD, 4, false, false, decode_x87_modrm_st0,
-     decode_x87_modrm_intp, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_intp, NULL},
     {0xda, 1, 3, X86_DECODE_CMD_FCMOV, 10, false, false, decode_x87_modrm_st0,
-     decode_decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+     decode_decode_x87_modrm_st0, NULL},
     {0xda, 1, 0, X86_DECODE_CMD_FMUL, 4, false, false, decode_x87_modrm_st0,
-     decode_x87_modrm_intp, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_intp, NULL},
     {0xda, 2, 3, X86_DECODE_CMD_FCMOV, 10, false, false, decode_x87_modrm_st0,
-     decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_st0, NULL},
     {0xda, 3, 3, X86_DECODE_CMD_FCMOV, 10, false, false, decode_x87_modrm_st0,
-     decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_st0, NULL},
     {0xda, 4, 3, X86_DECODE_CMD_INVL, 10, false, false, NULL, NULL, NULL,
      RFLAGS_MASK_NONE},
     {0xda, 4, 0, X86_DECODE_CMD_FSUB, 4, false, false, decode_x87_modrm_st0,
-     decode_x87_modrm_intp, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_intp, NULL},
     {0xda, 5, 3, X86_DECODE_CMD_FUCOM, 10, false, true, decode_x87_modrm_st0,
-     decode_decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+     decode_decode_x87_modrm_st0, NULL},
     {0xda, 5, 0, X86_DECODE_CMD_FSUB, 4, true, false, decode_x87_modrm_st0,
-     decode_x87_modrm_intp, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_intp, NULL},
     {0xda, 6, 3, X86_DECODE_CMD_INVL, 10, false, false, NULL, NULL, NULL,
      RFLAGS_MASK_NONE},
     {0xda, 6, 0, X86_DECODE_CMD_FDIV, 4, false, false, decode_x87_modrm_st0,
-     decode_x87_modrm_intp, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_intp, NULL},
     {0xda, 7, 3, X86_DECODE_CMD_INVL, 10, false, false, NULL, NULL, NULL,
      RFLAGS_MASK_NONE},
     {0xda, 7, 0, X86_DECODE_CMD_FDIV, 4, true, false, decode_x87_modrm_st0,
-     decode_x87_modrm_intp, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_intp, NULL},
 
     {0xdb, 0, 3, X86_DECODE_CMD_FCMOV, 10, false, false, decode_x87_modrm_st0,
-     decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_st0, NULL},
     {0xdb, 0, 0, X86_DECODE_CMD_FLD, 4, false, false,
-     decode_x87_modrm_intp, NULL, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_intp, NULL, NULL},
     {0xdb, 1, 3, X86_DECODE_CMD_FCMOV, 10, false, false,
-     decode_x87_modrm_st0, decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_st0, decode_x87_modrm_st0, NULL},
     {0xdb, 2, 3, X86_DECODE_CMD_FCMOV, 10, false, false,
-     decode_x87_modrm_st0, decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_st0, decode_x87_modrm_st0, NULL},
     {0xdb, 2, 0, X86_DECODE_CMD_FST, 4, false, false,
-     decode_x87_modrm_intp, NULL, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_intp, NULL, NULL},
     {0xdb, 3, 3, X86_DECODE_CMD_FCMOV, 10, false, false,
-     decode_x87_modrm_st0, decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_st0, decode_x87_modrm_st0, NULL},
     {0xdb, 3, 0, X86_DECODE_CMD_FST, 4, false, true,
-     decode_x87_modrm_intp, NULL, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_intp, NULL, NULL},
     {0xdb, 4, 3, X86_DECODE_CMD_INVL, 10, false, false, NULL, NULL,
-     decode_db_4, RFLAGS_MASK_NONE},
+     decode_db_4},
     {0xdb, 4, 0, X86_DECODE_CMD_INVL, 10, false, false, NULL, NULL, NULL,
      RFLAGS_MASK_NONE},
     {0xdb, 5, 3, X86_DECODE_CMD_FUCOMI, 10, false, false,
-     decode_x87_modrm_st0, decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_st0, decode_x87_modrm_st0, NULL},
     {0xdb, 5, 0, X86_DECODE_CMD_FLD, 10, false, false,
-     decode_x87_modrm_floatp, NULL, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_floatp, NULL, NULL},
     {0xdb, 7, 0, X86_DECODE_CMD_FST, 10, false, true,
-     decode_x87_modrm_floatp, NULL, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_floatp, NULL, NULL},
 
     {0xdc, 0, 3, X86_DECODE_CMD_FADD, 10, false, false,
-     decode_x87_modrm_st0, decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_st0, decode_x87_modrm_st0, NULL},
     {0xdc, 0, 0, X86_DECODE_CMD_FADD, 8, false, false,
-     decode_x87_modrm_st0, decode_x87_modrm_floatp, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_st0, decode_x87_modrm_floatp, NULL},
     {0xdc, 1, 3, X86_DECODE_CMD_FMUL, 10, false, false,
-     decode_x87_modrm_st0, decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_st0, decode_x87_modrm_st0, NULL},
     {0xdc, 1, 0, X86_DECODE_CMD_FMUL, 8, false, false,
-     decode_x87_modrm_st0, decode_x87_modrm_floatp, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_st0, decode_x87_modrm_floatp, NULL},
     {0xdc, 4, 3, X86_DECODE_CMD_FSUB, 10, true, false,
-     decode_x87_modrm_st0, decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_st0, decode_x87_modrm_st0, NULL},
     {0xdc, 4, 0, X86_DECODE_CMD_FSUB, 8, false, false,
-     decode_x87_modrm_st0, decode_x87_modrm_floatp, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_st0, decode_x87_modrm_floatp, NULL},
     {0xdc, 5, 3, X86_DECODE_CMD_FSUB, 10, false, false,
-     decode_x87_modrm_st0, decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_st0, decode_x87_modrm_st0, NULL},
     {0xdc, 5, 0, X86_DECODE_CMD_FSUB, 8, true, false,
-     decode_x87_modrm_st0, decode_x87_modrm_floatp, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_st0, decode_x87_modrm_floatp, NULL},
     {0xdc, 6, 3, X86_DECODE_CMD_FDIV, 10, true, false,
-     decode_x87_modrm_st0, decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_st0, decode_x87_modrm_st0, NULL},
     {0xdc, 6, 0, X86_DECODE_CMD_FDIV, 8, false, false,
-     decode_x87_modrm_st0, decode_x87_modrm_floatp, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_st0, decode_x87_modrm_floatp, NULL},
     {0xdc, 7, 3, X86_DECODE_CMD_FDIV, 10, false, false,
-     decode_x87_modrm_st0, decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_st0, decode_x87_modrm_st0, NULL},
     {0xdc, 7, 0, X86_DECODE_CMD_FDIV, 8, true, false,
-     decode_x87_modrm_st0, decode_x87_modrm_floatp, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_st0, decode_x87_modrm_floatp, NULL},
 
     {0xdd, 0, 0, X86_DECODE_CMD_FLD, 8, false, false,
-     decode_x87_modrm_floatp, NULL, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_floatp, NULL, NULL},
     {0xdd, 1, 3, X86_DECODE_CMD_FXCH, 10, false, false,
-     decode_x87_modrm_st0, decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_st0, decode_x87_modrm_st0, NULL},
     {0xdd, 2, 3, X86_DECODE_CMD_FST, 10, false, false,
-     decode_x87_modrm_st0, NULL, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_st0, NULL, NULL},
     {0xdd, 2, 0, X86_DECODE_CMD_FST, 8, false, false,
-     decode_x87_modrm_floatp, NULL, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_floatp, NULL, NULL},
     {0xdd, 3, 3, X86_DECODE_CMD_FST, 10, false, true,
-     decode_x87_modrm_st0, NULL, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_st0, NULL, NULL},
     {0xdd, 3, 0, X86_DECODE_CMD_FST, 8, false, true,
-     decode_x87_modrm_floatp, NULL, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_floatp, NULL, NULL},
     {0xdd, 4, 3, X86_DECODE_CMD_FUCOM, 10, false, false,
-     decode_x87_modrm_st0, decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_st0, decode_x87_modrm_st0, NULL},
     {0xdd, 4, 0, X86_DECODE_CMD_FRSTOR, 8, false, false,
-     decode_x87_modrm_bytep, NULL, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_bytep, NULL, NULL},
     {0xdd, 5, 3, X86_DECODE_CMD_FUCOM, 10, false, true,
-     decode_x87_modrm_st0, decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_st0, decode_x87_modrm_st0, NULL},
     {0xdd, 7, 0, X86_DECODE_CMD_FNSTSW, 0, false, false,
-     decode_x87_modrm_bytep, NULL, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_bytep, NULL, NULL},
     {0xdd, 7, 3, X86_DECODE_CMD_FNSTSW, 0, false, false,
-     decode_x87_modrm_bytep, NULL, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_bytep, NULL, NULL},
 
     {0xde, 0, 3, X86_DECODE_CMD_FADD, 10, false, true,
-     decode_x87_modrm_st0, decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_st0, decode_x87_modrm_st0, NULL},
     {0xde, 0, 0, X86_DECODE_CMD_FADD, 2, false, false,
-     decode_x87_modrm_st0, decode_x87_modrm_intp, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_st0, decode_x87_modrm_intp, NULL},
     {0xde, 1, 3, X86_DECODE_CMD_FMUL, 10, false, true,
-     decode_x87_modrm_st0, decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_st0, decode_x87_modrm_st0, NULL},
     {0xde, 1, 0, X86_DECODE_CMD_FMUL, 2, false, false,
-     decode_x87_modrm_st0, decode_x87_modrm_intp, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_st0, decode_x87_modrm_intp, NULL},
     {0xde, 4, 3, X86_DECODE_CMD_FSUB, 10, true, true,
-     decode_x87_modrm_st0, decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_st0, decode_x87_modrm_st0, NULL},
     {0xde, 4, 0, X86_DECODE_CMD_FSUB, 2, false, false,
-     decode_x87_modrm_st0, decode_x87_modrm_intp, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_st0, decode_x87_modrm_intp, NULL},
     {0xde, 5, 3, X86_DECODE_CMD_FSUB, 10, false, true,
-     decode_x87_modrm_st0, decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_st0, decode_x87_modrm_st0, NULL},
     {0xde, 5, 0, X86_DECODE_CMD_FSUB, 2, true, false,
-     decode_x87_modrm_st0, decode_x87_modrm_intp, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_st0, decode_x87_modrm_intp, NULL},
     {0xde, 6, 3, X86_DECODE_CMD_FDIV, 10, true, true,
-     decode_x87_modrm_st0, decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_st0, decode_x87_modrm_st0, NULL},
     {0xde, 6, 0, X86_DECODE_CMD_FDIV, 2, false, false,
-     decode_x87_modrm_st0, decode_x87_modrm_intp, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_st0, decode_x87_modrm_intp, NULL},
     {0xde, 7, 3, X86_DECODE_CMD_FDIV, 10, false, true,
-     decode_x87_modrm_st0, decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_st0, decode_x87_modrm_st0, NULL},
     {0xde, 7, 0, X86_DECODE_CMD_FDIV, 2, true, false,
-     decode_x87_modrm_st0, decode_x87_modrm_intp, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_st0, decode_x87_modrm_intp, NULL},
 
     {0xdf, 0, 0, X86_DECODE_CMD_FLD, 2, false, false,
-     decode_x87_modrm_intp, NULL, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_intp, NULL, NULL},
     {0xdf, 1, 3, X86_DECODE_CMD_FXCH, 10, false, false,
-     decode_x87_modrm_st0, decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_st0, decode_x87_modrm_st0, NULL},
     {0xdf, 2, 3, X86_DECODE_CMD_FST, 10, false, true,
-     decode_x87_modrm_st0, decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_st0, decode_x87_modrm_st0, NULL},
     {0xdf, 2, 0, X86_DECODE_CMD_FST, 2, false, false,
-     decode_x87_modrm_intp, NULL, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_intp, NULL, NULL},
     {0xdf, 3, 3, X86_DECODE_CMD_FST, 10, false, true,
-     decode_x87_modrm_st0, decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_st0, decode_x87_modrm_st0, NULL},
     {0xdf, 3, 0, X86_DECODE_CMD_FST, 2, false, true,
-     decode_x87_modrm_intp, NULL, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_intp, NULL, NULL},
     {0xdf, 4, 3, X86_DECODE_CMD_FNSTSW, 2, false, true,
-     decode_x87_modrm_bytep, NULL, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_bytep, NULL, NULL},
     {0xdf, 5, 3, X86_DECODE_CMD_FUCOMI, 10, false, true,
-     decode_x87_modrm_st0, decode_x87_modrm_st0, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_st0, decode_x87_modrm_st0, NULL},
     {0xdf, 5, 0, X86_DECODE_CMD_FLD, 8, false, false,
-     decode_x87_modrm_intp, NULL, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_intp, NULL, NULL},
     {0xdf, 7, 0, X86_DECODE_CMD_FST, 8, false, true,
-     decode_x87_modrm_intp, NULL, NULL, RFLAGS_MASK_NONE},
+     decode_x87_modrm_intp, NULL, NULL},
 };
 
 void calc_modrm_operand16(CPUX86State *env, struct x86_decode *decode,
@@ -2045,7 +2030,6 @@ static inline void decode_opcode_general(CPUX86State *env,
     if (inst_decoder->operand_size) {
         decode->operand_size = inst_decoder->operand_size;
     }
-    decode->flags_mask = inst_decoder->flags_mask;
 
     if (inst_decoder->is_modrm) {
         decode_modrm(env, decode);
diff --git a/target/i386/emulate/x86_decode.h b/target/i386/emulate/x86_decode.h
index 930d965164..87cc728598 100644
--- a/target/i386/emulate/x86_decode.h
+++ b/target/i386/emulate/x86_decode.h
@@ -295,8 +295,6 @@ typedef struct x86_decode {
     struct x86_modrm modrm;
     struct x86_decode_op op[4];
     bool is_fpu;
-    uint32_t flags_mask;
-
 } x86_decode;
 
 uint64_t sign(uint64_t val, int size);

From ae39acef49e29169f90cd3a799d6cd0b50bc65d2 Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Thu, 10 Apr 2025 15:56:19 +0800
Subject: [PATCH 0034/2760] i386/cpu: Consolidate the helper to get Host's
 vendor

Extend host_cpu_vendor_fms() to help more cases to get Host's vendor
information.

Cc: Dongli Zhang <dongli.zhang@oracle.com>
Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250410075619.145792-1-zhao1.liu@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/host-cpu.c        | 10 ++++++----
 target/i386/kvm/vmsr_energy.c |  3 +--
 2 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/target/i386/host-cpu.c b/target/i386/host-cpu.c
index 3e4e85e729..072731a4dd 100644
--- a/target/i386/host-cpu.c
+++ b/target/i386/host-cpu.c
@@ -109,9 +109,13 @@ void host_cpu_vendor_fms(char *vendor, int *family, int *model, int *stepping)
 {
     uint32_t eax, ebx, ecx, edx;
 
-    host_cpuid(0x0, 0, &eax, &ebx, &ecx, &edx);
+    host_cpuid(0x0, 0, NULL, &ebx, &ecx, &edx);
     x86_cpu_vendor_words2str(vendor, ebx, edx, ecx);
 
+    if (!family && !model && !stepping) {
+        return;
+    }
+
     host_cpuid(0x1, 0, &eax, &ebx, &ecx, &edx);
     if (family) {
         *family = ((eax >> 8) & 0x0F) + ((eax >> 20) & 0xFF);
@@ -129,11 +133,9 @@ void host_cpu_instance_init(X86CPU *cpu)
     X86CPUClass *xcc = X86_CPU_GET_CLASS(cpu);
 
     if (xcc->model) {
-        uint32_t ebx = 0, ecx = 0, edx = 0;
         char vendor[CPUID_VENDOR_SZ + 1];
 
-        host_cpuid(0, 0, NULL, &ebx, &ecx, &edx);
-        x86_cpu_vendor_words2str(vendor, ebx, edx, ecx);
+        host_cpu_vendor_fms(vendor, NULL, NULL, NULL);
         object_property_set_str(OBJECT(cpu), "vendor", vendor, &error_abort);
     }
 }
diff --git a/target/i386/kvm/vmsr_energy.c b/target/i386/kvm/vmsr_energy.c
index 31508d4e77..f499ec6e8b 100644
--- a/target/i386/kvm/vmsr_energy.c
+++ b/target/i386/kvm/vmsr_energy.c
@@ -29,10 +29,9 @@ char *vmsr_compute_default_paths(void)
 
 bool is_host_cpu_intel(void)
 {
-    int family, model, stepping;
     char vendor[CPUID_VENDOR_SZ + 1];
 
-    host_cpu_vendor_fms(vendor, &family, &model, &stepping);
+    host_cpu_vendor_fms(vendor, NULL, NULL, NULL);
 
     return g_str_equal(vendor, CPUID_VENDOR_INTEL);
 }

From 1da8f3a3c53b604edfe0d55e475102640490549e Mon Sep 17 00:00:00 2001
From: Stefan Hajnoczi <stefanha@redhat.com>
Date: Tue, 22 Apr 2025 15:09:23 -0400
Subject: [PATCH 0035/2760] Open 10.1 development tree

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 VERSION | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/VERSION b/VERSION
index a13e7b9c87..54e6ccf854 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-10.0.0
+10.0.50

From 6b661b7ed7cd02c54a78426d5eb7dd8543b030ed Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sun, 23 Mar 2025 10:16:23 -0700
Subject: [PATCH 0036/2760] target/avr: Improve decode of LDS, STS

The comment about not being able to define a field with
zero bits is out of date since 94597b6146f3
("decodetree: Allow !function with no input bits").

This fixes the missing load of imm in the disassembler.

Cc: qemu-stable@nongnu.org
Fixes: 9d8caa67a24 ("target/avr: Add support for disassembling via option '-d in_asm'")
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/avr/insn.decode | 7 ++-----
 target/avr/translate.c | 2 --
 2 files changed, 2 insertions(+), 7 deletions(-)

diff --git a/target/avr/insn.decode b/target/avr/insn.decode
index 482c23ad0c..cc302249db 100644
--- a/target/avr/insn.decode
+++ b/target/avr/insn.decode
@@ -118,11 +118,8 @@ BRBC            1111 01 ....... ...         @op_bit_imm
 @io_rd_imm      .... . .. ..... ....        &rd_imm     rd=%rd imm=%io_imm
 @ldst_d         .. . . .. . rd:5  . ...     &rd_imm     imm=%ldst_d_imm
 
-# The 16-bit immediate is completely in the next word.
-# Fields cannot be defined with no bits, so we cannot play
-# the same trick and append to a zero-bit value.
-# Defer reading the immediate until trans_{LDS,STS}.
-@ldst_s         .... ... rd:5 ....          imm=0
+%ldst_imm       !function=next_word
+@ldst_s         .... ... rd:5 ....          imm=%ldst_imm
 
 MOV             0010 11 . ..... ....        @op_rd_rr
 MOVW            0000 0001 .... ....         &rd_rr      rd=%rd_d rr=%rr_d
diff --git a/target/avr/translate.c b/target/avr/translate.c
index 4ab71d8138..e7f8ced9b3 100644
--- a/target/avr/translate.c
+++ b/target/avr/translate.c
@@ -1578,7 +1578,6 @@ static bool trans_LDS(DisasContext *ctx, arg_LDS *a)
     TCGv Rd = cpu_r[a->rd];
     TCGv addr = tcg_temp_new_i32();
     TCGv H = cpu_rampD;
-    a->imm = next_word(ctx);
 
     tcg_gen_mov_tl(addr, H); /* addr = H:M:L */
     tcg_gen_shli_tl(addr, addr, 16);
@@ -1783,7 +1782,6 @@ static bool trans_STS(DisasContext *ctx, arg_STS *a)
     TCGv Rd = cpu_r[a->rd];
     TCGv addr = tcg_temp_new_i32();
     TCGv H = cpu_rampD;
-    a->imm = next_word(ctx);
 
     tcg_gen_mov_tl(addr, H); /* addr = H:M:L */
     tcg_gen_shli_tl(addr, addr, 16);

From 29bcd5a46a9de61587f490d92c5a5500b2684f22 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 21 Mar 2025 14:31:26 -0700
Subject: [PATCH 0037/2760] target/avr: Remove OFFSET_CPU_REGISTERS
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This define isn't really used.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/avr/cpu.h    | 2 --
 target/avr/helper.c | 3 +--
 2 files changed, 1 insertion(+), 4 deletions(-)

diff --git a/target/avr/cpu.h b/target/avr/cpu.h
index 06f5ae4d1b..84a8f5cc8c 100644
--- a/target/avr/cpu.h
+++ b/target/avr/cpu.h
@@ -60,8 +60,6 @@
 #define OFFSET_CODE 0x00000000
 /* CPU registers, IO registers, and SRAM */
 #define OFFSET_DATA 0x00800000
-/* CPU registers specifically, these are mapped at the start of data */
-#define OFFSET_CPU_REGISTERS OFFSET_DATA
 /*
  * IO registers, including status register, stack pointer, and memory
  * mapped peripherals, mapped just after CPU registers
diff --git a/target/avr/helper.c b/target/avr/helper.c
index 3412312ad5..e5bf16c6b7 100644
--- a/target/avr/helper.c
+++ b/target/avr/helper.c
@@ -340,8 +340,7 @@ void helper_fullwr(CPUAVRState *env, uint32_t data, uint32_t addr)
     env->fullacc = false;
 
     /* Following logic assumes this: */
-    assert(OFFSET_CPU_REGISTERS == OFFSET_DATA);
-    assert(OFFSET_IO_REGISTERS == OFFSET_CPU_REGISTERS +
+    assert(OFFSET_IO_REGISTERS == OFFSET_DATA +
                                   NUMBER_OF_CPU_REGISTERS);
 
     if (addr < NUMBER_OF_CPU_REGISTERS) {

From a2860ff908da0d71ce25adcb02388fe26b467390 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 25 Mar 2025 08:58:56 -0700
Subject: [PATCH 0038/2760] target/avr: Add defines for i/o port registers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/avr/cpu.h    | 10 ++++++++++
 target/avr/helper.c | 36 ++++++++++++++++++------------------
 2 files changed, 28 insertions(+), 18 deletions(-)

diff --git a/target/avr/cpu.h b/target/avr/cpu.h
index 84a8f5cc8c..1a5a5b8e3e 100644
--- a/target/avr/cpu.h
+++ b/target/avr/cpu.h
@@ -47,6 +47,16 @@
 /* Number of IO registers accessible by ld/st/in/out */
 #define NUMBER_OF_IO_REGISTERS 64
 
+/* CPU registers mapped into i/o ports 0x38-0x3f. */
+#define REG_38_RAMPD  0
+#define REG_38_RAMPX  1
+#define REG_38_RAMPY  2
+#define REG_38_RAMPZ  3
+#define REG_38_EIDN   4
+#define REG_38_SPL    5
+#define REG_38_SPH    6
+#define REG_38_SREG   7
+
 /*
  * Offsets of AVR memory regions in host memory space.
  *
diff --git a/target/avr/helper.c b/target/avr/helper.c
index e5bf16c6b7..f8ada8b106 100644
--- a/target/avr/helper.c
+++ b/target/avr/helper.c
@@ -216,29 +216,29 @@ target_ulong helper_inb(CPUAVRState *env, uint32_t port)
 {
     target_ulong data = 0;
 
-    switch (port) {
-    case 0x38: /* RAMPD */
+    switch (port - 0x38) {
+    case REG_38_RAMPD:
         data = 0xff & (env->rampD >> 16);
         break;
-    case 0x39: /* RAMPX */
+    case REG_38_RAMPX:
         data = 0xff & (env->rampX >> 16);
         break;
-    case 0x3a: /* RAMPY */
+    case REG_38_RAMPY:
         data = 0xff & (env->rampY >> 16);
         break;
-    case 0x3b: /* RAMPZ */
+    case REG_38_RAMPZ:
         data = 0xff & (env->rampZ >> 16);
         break;
-    case 0x3c: /* EIND */
+    case REG_38_EIDN:
         data = 0xff & (env->eind >> 16);
         break;
-    case 0x3d: /* SPL */
+    case REG_38_SPL:
         data = env->sp & 0x00ff;
         break;
-    case 0x3e: /* SPH */
+    case REG_38_SPH:
         data = env->sp >> 8;
         break;
-    case 0x3f: /* SREG */
+    case REG_38_SREG:
         data = cpu_get_sreg(env);
         break;
     default:
@@ -265,39 +265,39 @@ void helper_outb(CPUAVRState *env, uint32_t port, uint32_t data)
 {
     data &= 0x000000ff;
 
-    switch (port) {
-    case 0x38: /* RAMPD */
+    switch (port - 0x38) {
+    case REG_38_RAMPD:
         if (avr_feature(env, AVR_FEATURE_RAMPD)) {
             env->rampD = (data & 0xff) << 16;
         }
         break;
-    case 0x39: /* RAMPX */
+    case REG_38_RAMPX:
         if (avr_feature(env, AVR_FEATURE_RAMPX)) {
             env->rampX = (data & 0xff) << 16;
         }
         break;
-    case 0x3a: /* RAMPY */
+    case REG_38_RAMPY:
         if (avr_feature(env, AVR_FEATURE_RAMPY)) {
             env->rampY = (data & 0xff) << 16;
         }
         break;
-    case 0x3b: /* RAMPZ */
+    case REG_38_RAMPZ:
         if (avr_feature(env, AVR_FEATURE_RAMPZ)) {
             env->rampZ = (data & 0xff) << 16;
         }
         break;
-    case 0x3c: /* EIDN */
+    case REG_38_EIDN:
         env->eind = (data & 0xff) << 16;
         break;
-    case 0x3d: /* SPL */
+    case REG_38_SPL:
         env->sp = (env->sp & 0xff00) | (data);
         break;
-    case 0x3e: /* SPH */
+    case REG_38_SPH:
         if (avr_feature(env, AVR_FEATURE_2_BYTE_SP)) {
             env->sp = (env->sp & 0x00ff) | (data << 8);
         }
         break;
-    case 0x3f: /* SREG */
+    case REG_38_SREG:
         cpu_set_sreg(env, data);
         break;
     default:

From 204a7bd85686601e7c60d1d23502540a8d9661bb Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 21 Mar 2025 17:14:27 -0700
Subject: [PATCH 0039/2760] target/avr: Move cpu register accesses into system
 memory

Integrate the i/o 0x00-0x1f and 0x38-0x3f loopbacks into
the cpu registers with normal address space accesses.
We no longer need to trap accesses to the first page within
avr_cpu_tlb_fill but can wait until a write occurs.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/avr/cpu.c       |  16 +++
 target/avr/cpu.h       |   7 ++
 target/avr/helper.c    | 223 +++++++++++++++++------------------------
 target/avr/helper.h    |   3 -
 target/avr/translate.c |  42 ++++----
 5 files changed, 138 insertions(+), 153 deletions(-)

diff --git a/target/avr/cpu.c b/target/avr/cpu.c
index 834c7082aa..0b14b36c17 100644
--- a/target/avr/cpu.c
+++ b/target/avr/cpu.c
@@ -23,6 +23,7 @@
 #include "qemu/qemu-print.h"
 #include "exec/exec-all.h"
 #include "exec/translation-block.h"
+#include "exec/address-spaces.h"
 #include "cpu.h"
 #include "disas/dis-asm.h"
 #include "tcg/debug-assert.h"
@@ -110,6 +111,8 @@ static void avr_cpu_disas_set_info(CPUState *cpu, disassemble_info *info)
 static void avr_cpu_realizefn(DeviceState *dev, Error **errp)
 {
     CPUState *cs = CPU(dev);
+    CPUAVRState *env = cpu_env(cs);
+    AVRCPU *cpu = env_archcpu(env);
     AVRCPUClass *mcc = AVR_CPU_GET_CLASS(dev);
     Error *local_err = NULL;
 
@@ -122,6 +125,19 @@ static void avr_cpu_realizefn(DeviceState *dev, Error **errp)
     cpu_reset(cs);
 
     mcc->parent_realize(dev, errp);
+
+    /*
+     * Two blocks in the low data space loop back into cpu registers.
+     */
+    memory_region_init_io(&cpu->cpu_reg1, OBJECT(cpu), &avr_cpu_reg1, env,
+                          "avr-cpu-reg1", 32);
+    memory_region_add_subregion(get_system_memory(),
+                                OFFSET_DATA, &cpu->cpu_reg1);
+
+    memory_region_init_io(&cpu->cpu_reg2, OBJECT(cpu), &avr_cpu_reg2, env,
+                          "avr-cpu-reg2", 8);
+    memory_region_add_subregion(get_system_memory(),
+                                OFFSET_DATA + 0x58, &cpu->cpu_reg2);
 }
 
 static void avr_cpu_set_int(void *opaque, int irq, int level)
diff --git a/target/avr/cpu.h b/target/avr/cpu.h
index 1a5a5b8e3e..6f68060ab0 100644
--- a/target/avr/cpu.h
+++ b/target/avr/cpu.h
@@ -23,6 +23,7 @@
 
 #include "cpu-qom.h"
 #include "exec/cpu-defs.h"
+#include "exec/memory.h"
 
 #ifdef CONFIG_USER_ONLY
 #error "AVR 8-bit does not support user mode"
@@ -152,6 +153,9 @@ struct ArchCPU {
 
     CPUAVRState env;
 
+    MemoryRegion cpu_reg1;
+    MemoryRegion cpu_reg2;
+
     /* Initial value of stack pointer */
     uint32_t init_sp;
 };
@@ -252,6 +256,9 @@ bool avr_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
                       MMUAccessType access_type, int mmu_idx,
                       bool probe, uintptr_t retaddr);
 
+extern const MemoryRegionOps avr_cpu_reg1;
+extern const MemoryRegionOps avr_cpu_reg2;
+
 #include "exec/cpu-all.h"
 
 #endif /* QEMU_AVR_CPU_H */
diff --git a/target/avr/helper.c b/target/avr/helper.c
index f8ada8b106..d0e86f5614 100644
--- a/target/avr/helper.c
+++ b/target/avr/helper.c
@@ -108,7 +108,7 @@ bool avr_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
                       MMUAccessType access_type, int mmu_idx,
                       bool probe, uintptr_t retaddr)
 {
-    int prot, page_size = TARGET_PAGE_SIZE;
+    int prot;
     uint32_t paddr;
 
     address &= TARGET_PAGE_MASK;
@@ -133,23 +133,9 @@ bool avr_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
         /* Access to memory. */
         paddr = OFFSET_DATA + address;
         prot = PAGE_READ | PAGE_WRITE;
-        if (address < NUMBER_OF_CPU_REGISTERS + NUMBER_OF_IO_REGISTERS) {
-            /*
-             * Access to CPU registers, exit and rebuilt this TB to use
-             * full access in case it touches specially handled registers
-             * like SREG or SP.  For probing, set page_size = 1, in order
-             * to force tlb_fill to be called for the next access.
-             */
-            if (probe) {
-                page_size = 1;
-            } else {
-                cpu_env(cs)->fullacc = 1;
-                cpu_loop_exit_restore(cs, retaddr);
-            }
-        }
     }
 
-    tlb_set_page(cs, address, paddr, prot, mmu_idx, page_size);
+    tlb_set_page(cs, address, paddr, prot, mmu_idx, TARGET_PAGE_SIZE);
     return true;
 }
 
@@ -203,134 +189,78 @@ void helper_wdr(CPUAVRState *env)
 }
 
 /*
- * This function implements IN instruction
- *
- * It does the following
- * a.  if an IO register belongs to CPU, its value is read and returned
- * b.  otherwise io address is translated to mem address and physical memory
- *     is read.
- * c.  it caches the value for sake of SBI, SBIC, SBIS & CBI implementation
- *
+ * The first 32 bytes of the data space are mapped to the cpu regs.
+ * We cannot write these from normal store operations because TCG
+ * does not expect global temps to be modified -- a global may be
+ * live in a host cpu register across the store.  We can however
+ * read these, as TCG does make sure the global temps are saved
+ * in case the load operation traps.
  */
-target_ulong helper_inb(CPUAVRState *env, uint32_t port)
+
+static uint64_t avr_cpu_reg1_read(void *opaque, hwaddr addr, unsigned size)
 {
-    target_ulong data = 0;
+    CPUAVRState *env = opaque;
 
-    switch (port - 0x38) {
-    case REG_38_RAMPD:
-        data = 0xff & (env->rampD >> 16);
-        break;
-    case REG_38_RAMPX:
-        data = 0xff & (env->rampX >> 16);
-        break;
-    case REG_38_RAMPY:
-        data = 0xff & (env->rampY >> 16);
-        break;
-    case REG_38_RAMPZ:
-        data = 0xff & (env->rampZ >> 16);
-        break;
-    case REG_38_EIDN:
-        data = 0xff & (env->eind >> 16);
-        break;
-    case REG_38_SPL:
-        data = env->sp & 0x00ff;
-        break;
-    case REG_38_SPH:
-        data = env->sp >> 8;
-        break;
-    case REG_38_SREG:
-        data = cpu_get_sreg(env);
-        break;
-    default:
-        /* not a special register, pass to normal memory access */
-        data = address_space_ldub(&address_space_memory,
-                                  OFFSET_IO_REGISTERS + port,
-                                  MEMTXATTRS_UNSPECIFIED, NULL);
-    }
-
-    return data;
+    assert(addr < 32);
+    return env->r[addr];
 }
 
 /*
- *  This function implements OUT instruction
- *
- *  It does the following
- *  a.  if an IO register belongs to CPU, its value is written into the register
- *  b.  otherwise io address is translated to mem address and physical memory
- *      is written.
- *  c.  it caches the value for sake of SBI, SBIC, SBIS & CBI implementation
- *
+ * The range 0x38-0x3f of the i/o space is mapped to cpu regs.
+ * As above, we cannot write these from normal store operations.
  */
-void helper_outb(CPUAVRState *env, uint32_t port, uint32_t data)
-{
-    data &= 0x000000ff;
 
-    switch (port - 0x38) {
+static uint64_t avr_cpu_reg2_read(void *opaque, hwaddr addr, unsigned size)
+{
+    CPUAVRState *env = opaque;
+
+    switch (addr) {
     case REG_38_RAMPD:
-        if (avr_feature(env, AVR_FEATURE_RAMPD)) {
-            env->rampD = (data & 0xff) << 16;
-        }
-        break;
+        return 0xff & (env->rampD >> 16);
     case REG_38_RAMPX:
-        if (avr_feature(env, AVR_FEATURE_RAMPX)) {
-            env->rampX = (data & 0xff) << 16;
-        }
-        break;
+        return 0xff & (env->rampX >> 16);
     case REG_38_RAMPY:
-        if (avr_feature(env, AVR_FEATURE_RAMPY)) {
-            env->rampY = (data & 0xff) << 16;
-        }
-        break;
+        return 0xff & (env->rampY >> 16);
     case REG_38_RAMPZ:
-        if (avr_feature(env, AVR_FEATURE_RAMPZ)) {
-            env->rampZ = (data & 0xff) << 16;
-        }
-        break;
+        return 0xff & (env->rampZ >> 16);
     case REG_38_EIDN:
-        env->eind = (data & 0xff) << 16;
-        break;
+        return 0xff & (env->eind >> 16);
     case REG_38_SPL:
-        env->sp = (env->sp & 0xff00) | (data);
-        break;
+        return env->sp & 0x00ff;
     case REG_38_SPH:
-        if (avr_feature(env, AVR_FEATURE_2_BYTE_SP)) {
-            env->sp = (env->sp & 0x00ff) | (data << 8);
-        }
-        break;
+        return 0xff & (env->sp >> 8);
     case REG_38_SREG:
-        cpu_set_sreg(env, data);
-        break;
-    default:
-        /* not a special register, pass to normal memory access */
-        address_space_stb(&address_space_memory, OFFSET_IO_REGISTERS + port,
-                          data, MEMTXATTRS_UNSPECIFIED, NULL);
+        return cpu_get_sreg(env);
     }
+    g_assert_not_reached();
 }
 
-/*
- *  this function implements LD instruction when there is a possibility to read
- *  from a CPU register
- */
-target_ulong helper_fullrd(CPUAVRState *env, uint32_t addr)
+static void avr_cpu_trap_write(void *opaque, hwaddr addr,
+                               uint64_t data64, unsigned size)
 {
-    uint8_t data;
+    CPUAVRState *env = opaque;
+    CPUState *cs = env_cpu(env);
 
-    env->fullacc = false;
-
-    if (addr < NUMBER_OF_CPU_REGISTERS) {
-        /* CPU registers */
-        data = env->r[addr];
-    } else if (addr < NUMBER_OF_CPU_REGISTERS + NUMBER_OF_IO_REGISTERS) {
-        /* IO registers */
-        data = helper_inb(env, addr - NUMBER_OF_CPU_REGISTERS);
-    } else {
-        /* memory */
-        data = address_space_ldub(&address_space_memory, OFFSET_DATA + addr,
-                                  MEMTXATTRS_UNSPECIFIED, NULL);
-    }
-    return data;
+    env->fullacc = true;
+    cpu_loop_exit_restore(cs, cs->mem_io_pc);
 }
 
+const MemoryRegionOps avr_cpu_reg1 = {
+    .read = avr_cpu_reg1_read,
+    .write = avr_cpu_trap_write,
+    .endianness = DEVICE_NATIVE_ENDIAN,
+    .valid.min_access_size = 1,
+    .valid.max_access_size = 1,
+};
+
+const MemoryRegionOps avr_cpu_reg2 = {
+    .read = avr_cpu_reg2_read,
+    .write = avr_cpu_trap_write,
+    .endianness = DEVICE_NATIVE_ENDIAN,
+    .valid.min_access_size = 1,
+    .valid.max_access_size = 1,
+};
+
 /*
  *  this function implements ST instruction when there is a possibility to write
  *  into a CPU register
@@ -339,19 +269,50 @@ void helper_fullwr(CPUAVRState *env, uint32_t data, uint32_t addr)
 {
     env->fullacc = false;
 
-    /* Following logic assumes this: */
-    assert(OFFSET_IO_REGISTERS == OFFSET_DATA +
-                                  NUMBER_OF_CPU_REGISTERS);
-
-    if (addr < NUMBER_OF_CPU_REGISTERS) {
+    switch (addr) {
+    case 0 ... 31:
         /* CPU registers */
         env->r[addr] = data;
-    } else if (addr < NUMBER_OF_CPU_REGISTERS + NUMBER_OF_IO_REGISTERS) {
-        /* IO registers */
-        helper_outb(env, addr - NUMBER_OF_CPU_REGISTERS, data);
-    } else {
-        /* memory */
+        break;
+
+    case REG_38_RAMPD + 0x38 + NUMBER_OF_CPU_REGISTERS:
+        if (avr_feature(env, AVR_FEATURE_RAMPD)) {
+            env->rampD = data << 16;
+        }
+        break;
+    case REG_38_RAMPX + 0x38 + NUMBER_OF_CPU_REGISTERS:
+        if (avr_feature(env, AVR_FEATURE_RAMPX)) {
+            env->rampX = data << 16;
+        }
+        break;
+    case REG_38_RAMPY + 0x38 + NUMBER_OF_CPU_REGISTERS:
+        if (avr_feature(env, AVR_FEATURE_RAMPY)) {
+            env->rampY = data << 16;
+        }
+        break;
+    case REG_38_RAMPZ + 0x38 + NUMBER_OF_CPU_REGISTERS:
+        if (avr_feature(env, AVR_FEATURE_RAMPZ)) {
+            env->rampZ = data << 16;
+        }
+        break;
+    case REG_38_EIDN + 0x38 + NUMBER_OF_CPU_REGISTERS:
+        env->eind = data << 16;
+        break;
+    case REG_38_SPL + 0x38 + NUMBER_OF_CPU_REGISTERS:
+        env->sp = (env->sp & 0xff00) | data;
+        break;
+    case REG_38_SPH + 0x38 + NUMBER_OF_CPU_REGISTERS:
+        if (avr_feature(env, AVR_FEATURE_2_BYTE_SP)) {
+            env->sp = (env->sp & 0x00ff) | (data << 8);
+        }
+        break;
+    case REG_38_SREG + 0x38 + NUMBER_OF_CPU_REGISTERS:
+        cpu_set_sreg(env, data);
+        break;
+
+    default:
         address_space_stb(&address_space_memory, OFFSET_DATA + addr, data,
                           MEMTXATTRS_UNSPECIFIED, NULL);
+        break;
     }
 }
diff --git a/target/avr/helper.h b/target/avr/helper.h
index 4d02e648fa..e8d13e925f 100644
--- a/target/avr/helper.h
+++ b/target/avr/helper.h
@@ -23,7 +23,4 @@ DEF_HELPER_1(debug, noreturn, env)
 DEF_HELPER_1(break, noreturn, env)
 DEF_HELPER_1(sleep, noreturn, env)
 DEF_HELPER_1(unsupported, noreturn, env)
-DEF_HELPER_3(outb, void, env, i32, i32)
-DEF_HELPER_2(inb, tl, env, i32)
 DEF_HELPER_3(fullwr, void, env, i32, i32)
-DEF_HELPER_2(fullrd, tl, env, i32)
diff --git a/target/avr/translate.c b/target/avr/translate.c
index e7f8ced9b3..0490936cd5 100644
--- a/target/avr/translate.c
+++ b/target/avr/translate.c
@@ -194,6 +194,9 @@ static bool avr_have_feature(DisasContext *ctx, int feature)
 static bool decode_insn(DisasContext *ctx, uint16_t insn);
 #include "decode-insn.c.inc"
 
+static void gen_inb(DisasContext *ctx, TCGv data, int port);
+static void gen_outb(DisasContext *ctx, TCGv data, int port);
+
 /*
  * Arithmetic Instructions
  */
@@ -1293,9 +1296,8 @@ static bool trans_SBRS(DisasContext *ctx, arg_SBRS *a)
 static bool trans_SBIC(DisasContext *ctx, arg_SBIC *a)
 {
     TCGv data = tcg_temp_new_i32();
-    TCGv port = tcg_constant_i32(a->reg);
 
-    gen_helper_inb(data, tcg_env, port);
+    gen_inb(ctx, data, a->reg);
     tcg_gen_andi_tl(data, data, 1 << a->bit);
     ctx->skip_cond = TCG_COND_EQ;
     ctx->skip_var0 = data;
@@ -1311,9 +1313,8 @@ static bool trans_SBIC(DisasContext *ctx, arg_SBIC *a)
 static bool trans_SBIS(DisasContext *ctx, arg_SBIS *a)
 {
     TCGv data = tcg_temp_new_i32();
-    TCGv port = tcg_constant_i32(a->reg);
 
-    gen_helper_inb(data, tcg_env, port);
+    gen_inb(ctx, data, a->reg);
     tcg_gen_andi_tl(data, data, 1 << a->bit);
     ctx->skip_cond = TCG_COND_NE;
     ctx->skip_var0 = data;
@@ -1502,11 +1503,18 @@ static void gen_data_store(DisasContext *ctx, TCGv data, TCGv addr)
 
 static void gen_data_load(DisasContext *ctx, TCGv data, TCGv addr)
 {
-    if (ctx->base.tb->flags & TB_FLAGS_FULL_ACCESS) {
-        gen_helper_fullrd(data, tcg_env, addr);
-    } else {
-        tcg_gen_qemu_ld_tl(data, addr, MMU_DATA_IDX, MO_UB);
-    }
+    tcg_gen_qemu_ld_tl(data, addr, MMU_DATA_IDX, MO_UB);
+}
+
+static void gen_inb(DisasContext *ctx, TCGv data, int port)
+{
+    gen_data_load(ctx, data, tcg_constant_i32(port + NUMBER_OF_CPU_REGISTERS));
+}
+
+static void gen_outb(DisasContext *ctx, TCGv data, int port)
+{
+    gen_helper_fullwr(tcg_env, data,
+                      tcg_constant_i32(port + NUMBER_OF_CPU_REGISTERS));
 }
 
 /*
@@ -2126,9 +2134,8 @@ static bool trans_SPMX(DisasContext *ctx, arg_SPMX *a)
 static bool trans_IN(DisasContext *ctx, arg_IN *a)
 {
     TCGv Rd = cpu_r[a->rd];
-    TCGv port = tcg_constant_i32(a->imm);
 
-    gen_helper_inb(Rd, tcg_env, port);
+    gen_inb(ctx, Rd, a->imm);
     return true;
 }
 
@@ -2139,9 +2146,8 @@ static bool trans_IN(DisasContext *ctx, arg_IN *a)
 static bool trans_OUT(DisasContext *ctx, arg_OUT *a)
 {
     TCGv Rd = cpu_r[a->rd];
-    TCGv port = tcg_constant_i32(a->imm);
 
-    gen_helper_outb(tcg_env, port, Rd);
+    gen_outb(ctx, Rd, a->imm);
     return true;
 }
 
@@ -2407,11 +2413,10 @@ static bool trans_SWAP(DisasContext *ctx, arg_SWAP *a)
 static bool trans_SBI(DisasContext *ctx, arg_SBI *a)
 {
     TCGv data = tcg_temp_new_i32();
-    TCGv port = tcg_constant_i32(a->reg);
 
-    gen_helper_inb(data, tcg_env, port);
+    gen_inb(ctx, data, a->reg);
     tcg_gen_ori_tl(data, data, 1 << a->bit);
-    gen_helper_outb(tcg_env, port, data);
+    gen_outb(ctx, data, a->reg);
     return true;
 }
 
@@ -2422,11 +2427,10 @@ static bool trans_SBI(DisasContext *ctx, arg_SBI *a)
 static bool trans_CBI(DisasContext *ctx, arg_CBI *a)
 {
     TCGv data = tcg_temp_new_i32();
-    TCGv port = tcg_constant_i32(a->reg);
 
-    gen_helper_inb(data, tcg_env, port);
+    gen_inb(ctx, data, a->reg);
     tcg_gen_andi_tl(data, data, ~(1 << a->bit));
-    gen_helper_outb(tcg_env, port, data);
+    gen_outb(ctx, data, a->reg);
     return true;
 }
 

From ba675861ea6f1f8b3eeee4a2d64b47204b883ab1 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 25 Mar 2025 08:37:49 -0700
Subject: [PATCH 0040/2760] target/avr: Remove NUMBER_OF_IO_REGISTERS

This define is no longer used.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/avr/cpu.h | 2 --
 1 file changed, 2 deletions(-)

diff --git a/target/avr/cpu.h b/target/avr/cpu.h
index 6f68060ab0..9862705c6a 100644
--- a/target/avr/cpu.h
+++ b/target/avr/cpu.h
@@ -45,8 +45,6 @@
 
 /* Number of CPU registers */
 #define NUMBER_OF_CPU_REGISTERS 32
-/* Number of IO registers accessible by ld/st/in/out */
-#define NUMBER_OF_IO_REGISTERS 64
 
 /* CPU registers mapped into i/o ports 0x38-0x3f. */
 #define REG_38_RAMPD  0

From c0f830cb6a756add847f9cd9d62d50397a1284c1 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 21 Mar 2025 18:19:28 -0700
Subject: [PATCH 0041/2760] target/avr: Use cpu_stb_mmuidx_ra in helper_fullwr

Avoid direct use of address_space_memory.
Make use of the softmmu cache of the i/o page.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/avr/helper.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/target/avr/helper.c b/target/avr/helper.c
index d0e86f5614..7d6954ec26 100644
--- a/target/avr/helper.c
+++ b/target/avr/helper.c
@@ -23,10 +23,10 @@
 #include "qemu/error-report.h"
 #include "cpu.h"
 #include "accel/tcg/cpu-ops.h"
+#include "accel/tcg/getpc.h"
 #include "exec/cputlb.h"
 #include "exec/page-protection.h"
 #include "exec/cpu_ldst.h"
-#include "exec/address-spaces.h"
 #include "exec/helper-proto.h"
 
 bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
@@ -67,6 +67,11 @@ bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
     return false;
 }
 
+static void do_stb(CPUAVRState *env, uint32_t addr, uint8_t data, uintptr_t ra)
+{
+    cpu_stb_mmuidx_ra(env, addr, data, MMU_DATA_IDX, ra);
+}
+
 void avr_cpu_do_interrupt(CPUState *cs)
 {
     CPUAVRState *env = cpu_env(cs);
@@ -311,8 +316,7 @@ void helper_fullwr(CPUAVRState *env, uint32_t data, uint32_t addr)
         break;
 
     default:
-        address_space_stb(&address_space_memory, OFFSET_DATA + addr, data,
-                          MEMTXATTRS_UNSPECIFIED, NULL);
+        do_stb(env, addr, data, GETPC());
         break;
     }
 }

From 95d4f72d6a667c71adae8a3c8093efe32043d9b4 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 22 Mar 2025 20:10:28 -0700
Subject: [PATCH 0042/2760] target/avr: Use do_stb in avr_cpu_do_interrupt
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/avr/helper.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/target/avr/helper.c b/target/avr/helper.c
index 7d6954ec26..f23fa3e8ba 100644
--- a/target/avr/helper.c
+++ b/target/avr/helper.c
@@ -88,14 +88,14 @@ void avr_cpu_do_interrupt(CPUState *cs)
     }
 
     if (avr_feature(env, AVR_FEATURE_3_BYTE_PC)) {
-        cpu_stb_data(env, env->sp--, (ret & 0x0000ff));
-        cpu_stb_data(env, env->sp--, (ret & 0x00ff00) >> 8);
-        cpu_stb_data(env, env->sp--, (ret & 0xff0000) >> 16);
+        do_stb(env, env->sp--, ret, 0);
+        do_stb(env, env->sp--, ret >> 8, 0);
+        do_stb(env, env->sp--, ret >> 16, 0);
     } else if (avr_feature(env, AVR_FEATURE_2_BYTE_PC)) {
-        cpu_stb_data(env, env->sp--, (ret & 0x0000ff));
-        cpu_stb_data(env, env->sp--, (ret & 0x00ff00) >> 8);
+        do_stb(env, env->sp--, ret, 0);
+        do_stb(env, env->sp--, ret >> 8, 0);
     } else {
-        cpu_stb_data(env, env->sp--, (ret & 0x0000ff));
+        do_stb(env, env->sp--, ret, 0);
     }
 
     env->pc_w = base + vector * size;

From 9f99072fc08e1044700404ae0a5f13a30a0a2a60 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 25 Mar 2025 15:26:28 -0700
Subject: [PATCH 0043/2760] hw/avr: Prepare for TARGET_PAGE_SIZE > 256

If i/o does not cover the entire first page, allocate a portion
of ram as an i/o device, so that the entire first page is i/o.

While memory_region_init_ram_device_ptr is happy to allocate
the RAMBlock, it does not register the ram for migration.
Do this by hand.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 hw/avr/atmega.c | 39 ++++++++++++++++++++++++++++++++-------
 hw/avr/atmega.h |  1 +
 2 files changed, 33 insertions(+), 7 deletions(-)

diff --git a/hw/avr/atmega.c b/hw/avr/atmega.c
index f6844bf118..11fab184de 100644
--- a/hw/avr/atmega.c
+++ b/hw/avr/atmega.c
@@ -19,6 +19,7 @@
 #include "hw/sysbus.h"
 #include "qom/object.h"
 #include "hw/misc/unimp.h"
+#include "migration/vmstate.h"
 #include "atmega.h"
 
 enum AtmegaPeripheral {
@@ -224,8 +225,6 @@ static void atmega_realize(DeviceState *dev, Error **errp)
     char *devname;
     size_t i;
 
-    assert(mc->io_size <= 0x200);
-
     if (!s->xtal_freq_hz) {
         error_setg(errp, "\"xtal-frequency-hz\" property must be provided.");
         return;
@@ -240,11 +239,37 @@ static void atmega_realize(DeviceState *dev, Error **errp)
     qdev_realize(DEVICE(&s->cpu), NULL, &error_abort);
     cpudev = DEVICE(&s->cpu);
 
-    /* SRAM */
-    memory_region_init_ram(&s->sram, OBJECT(dev), "sram", mc->sram_size,
-                           &error_abort);
-    memory_region_add_subregion(get_system_memory(),
-                                OFFSET_DATA + mc->io_size, &s->sram);
+    /*
+     * SRAM
+     *
+     * Softmmu is not able mix i/o and ram on the same page.
+     * Therefore in all cases, the first page exclusively contains i/o.
+     *
+     * If the MCU's i/o region matches the page size, then we can simply
+     * allocate all ram starting at the second page.  Otherwise, we must
+     * allocate some ram as i/o to complete the first page.
+     */
+    assert(mc->io_size == 0x100 || mc->io_size == 0x200);
+    if (mc->io_size >= TARGET_PAGE_SIZE) {
+        memory_region_init_ram(&s->sram, OBJECT(dev), "sram", mc->sram_size,
+                               &error_abort);
+        memory_region_add_subregion(get_system_memory(),
+                                    OFFSET_DATA + mc->io_size, &s->sram);
+    } else {
+        int sram_io_size = TARGET_PAGE_SIZE - mc->io_size;
+        void *sram_io_mem = g_malloc0(sram_io_size);
+
+        memory_region_init_ram_device_ptr(&s->sram_io, OBJECT(dev), "sram-as-io",
+                                          sram_io_size, sram_io_mem);
+        memory_region_add_subregion(get_system_memory(),
+                                    OFFSET_DATA + mc->io_size, &s->sram_io);
+        vmstate_register_ram(&s->sram_io, dev);
+
+        memory_region_init_ram(&s->sram, OBJECT(dev), "sram",
+                               mc->sram_size - sram_io_size, &error_abort);
+        memory_region_add_subregion(get_system_memory(),
+                                    OFFSET_DATA + TARGET_PAGE_SIZE, &s->sram);
+    }
 
     /* Flash */
     memory_region_init_rom(&s->flash, OBJECT(dev),
diff --git a/hw/avr/atmega.h b/hw/avr/atmega.h
index a99ee15c7e..9ac4678231 100644
--- a/hw/avr/atmega.h
+++ b/hw/avr/atmega.h
@@ -41,6 +41,7 @@ struct AtmegaMcuState {
     MemoryRegion flash;
     MemoryRegion eeprom;
     MemoryRegion sram;
+    MemoryRegion sram_io;
     DeviceState *io;
     AVRMaskState pwr[POWER_MAX];
     AVRUsartState usart[USART_MAX];

From eba24b60a72115e21e850977b3019aaf037c66c9 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 25 Mar 2025 15:32:50 -0700
Subject: [PATCH 0044/2760] target/avr: Increase TARGET_PAGE_BITS to 10

Now that we can handle the MCU allocating only a portion of the
first page to i/o, increase the page size.  Choose 10 as larger
than the i/o on every MCU, just so that this path is tested.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/avr/cpu-param.h | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/target/avr/cpu-param.h b/target/avr/cpu-param.h
index 81f3f49ee1..f5248ce9e7 100644
--- a/target/avr/cpu-param.h
+++ b/target/avr/cpu-param.h
@@ -21,13 +21,7 @@
 #ifndef AVR_CPU_PARAM_H
 #define AVR_CPU_PARAM_H
 
-/*
- * TARGET_PAGE_BITS cannot be more than 8 bits because
- * 1.  all IO registers occupy [0x0000 .. 0x00ff] address range, and they
- *     should be implemented as a device and not memory
- * 2.  SRAM starts at the address 0x0100
- */
-#define TARGET_PAGE_BITS 8
+#define TARGET_PAGE_BITS 10
 #define TARGET_PHYS_ADDR_SPACE_BITS 24
 #define TARGET_VIRT_ADDR_SPACE_BITS 24
 

From 2de267c330381d44862a29efd9025d64c9c0e9b4 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Wed, 15 Jan 2025 08:38:12 +0100
Subject: [PATCH 0045/2760] hw/s390x/s390-virtio-ccw: Remove the deprecated 2.9
 machine type

The s390-ccw-virtio-2.9 machine is older than 6 years, so according to
our machine support policy, it can be removed now.

Message-ID: <20250115073819.15452-2-thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 hw/s390x/s390-virtio-ccw.c | 24 ------------------------
 1 file changed, 24 deletions(-)

diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
index 75b32182eb..72de2bd8dc 100644
--- a/hw/s390x/s390-virtio-ccw.c
+++ b/hw/s390x/s390-virtio-ccw.c
@@ -1270,30 +1270,6 @@ static void ccw_machine_2_10_class_options(MachineClass *mc)
 }
 DEFINE_CCW_MACHINE(2, 10);
 
-static void ccw_machine_2_9_instance_options(MachineState *machine)
-{
-    ccw_machine_2_10_instance_options(machine);
-    s390_cpudef_featoff_greater(12, 1, S390_FEAT_ESOP);
-    s390_cpudef_featoff_greater(12, 1, S390_FEAT_SIDE_EFFECT_ACCESS_ESOP2);
-    s390_cpudef_featoff_greater(12, 1, S390_FEAT_ZPCI);
-    s390_cpudef_featoff_greater(12, 1, S390_FEAT_ADAPTER_INT_SUPPRESSION);
-    s390_cpudef_featoff_greater(12, 1, S390_FEAT_ADAPTER_EVENT_NOTIFICATION);
-    css_migration_enabled = false;
-}
-
-static void ccw_machine_2_9_class_options(MachineClass *mc)
-{
-    static GlobalProperty compat[] = {
-        { TYPE_S390_STATTRIB, "migration-enabled", "off", },
-        { TYPE_S390_FLIC_COMMON, "migration-enabled", "off", },
-    };
-
-    ccw_machine_2_10_class_options(mc);
-    compat_props_add(mc->compat_props, hw_compat_2_9, hw_compat_2_9_len);
-    compat_props_add(mc->compat_props, compat, G_N_ELEMENTS(compat));
-}
-DEFINE_CCW_MACHINE(2, 9);
-
 #endif
 
 static void ccw_machine_register_types(void)

From 2abe33895868c3846cd5d50a7207ca22cc98f741 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Wed, 15 Jan 2025 08:38:13 +0100
Subject: [PATCH 0046/2760] hw/s390x/css: Remove the obsolete
 "css_migration_enabled" variable
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Now that the s390-ccw-virtio-2.9 machine type has been removed, we
don't need the "css_migration_enabled" variable anymore and can remove
the related code.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250115073819.15452-3-thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 hw/s390x/css.c         | 31 +------------------------------
 include/hw/s390x/css.h |  6 ------
 2 files changed, 1 insertion(+), 36 deletions(-)

diff --git a/hw/s390x/css.c b/hw/s390x/css.c
index 738800c98d..17afcbb2cd 100644
--- a/hw/s390x/css.c
+++ b/hw/s390x/css.c
@@ -23,8 +23,6 @@
 #include "hw/s390x/s390-virtio-ccw.h"
 #include "hw/s390x/s390-ccw.h"
 
-bool css_migration_enabled = true;
-
 typedef struct CrwContainer {
     CRW crw;
     QTAILQ_ENTRY(CrwContainer) sibling;
@@ -180,16 +178,10 @@ static const VMStateDescription vmstate_orb = {
     }
 };
 
-static bool vmstate_schdev_orb_needed(void *opaque)
-{
-    return css_migration_enabled;
-}
-
 static const VMStateDescription vmstate_schdev_orb = {
     .name = "s390_subch_dev/orb",
     .version_id = 1,
     .minimum_version_id = 1,
-    .needed = vmstate_schdev_orb_needed,
     .fields = (const VMStateField[]) {
         VMSTATE_STRUCT(orb, SubchDev, 1, vmstate_orb, ORB),
         VMSTATE_END_OF_LIST()
@@ -390,33 +382,12 @@ static int subch_dev_post_load(void *opaque, int version_id)
         css_subch_assign(s->cssid, s->ssid, s->schid, s->devno, s);
     }
 
-    if (css_migration_enabled) {
-        /* No compat voodoo to do ;) */
-        return 0;
-    }
-    /*
-     * Hack alert. If we don't migrate the channel subsystem status
-     * we still need to find out if the guest enabled mss/mcss-e.
-     * If the subchannel is enabled, it certainly was able to access it,
-     * so adjust the max_ssid/max_cssid values for relevant ssid/cssid
-     * values. This is not watertight, but better than nothing.
-     */
-    if (s->curr_status.pmcw.flags & PMCW_FLAGS_MASK_ENA) {
-        if (s->ssid) {
-            channel_subsys.max_ssid = MAX_SSID;
-        }
-        if (s->cssid != channel_subsys.default_cssid) {
-            channel_subsys.max_cssid = MAX_CSSID;
-        }
-    }
     return 0;
 }
 
 void css_register_vmstate(void)
 {
-    if (css_migration_enabled) {
-        vmstate_register(NULL, 0, &vmstate_css, &channel_subsys);
-    }
+    vmstate_register(NULL, 0, &vmstate_css, &channel_subsys);
 }
 
 IndAddr *get_indicator(hwaddr ind_addr, int len)
diff --git a/include/hw/s390x/css.h b/include/hw/s390x/css.h
index cd97e2b707..dbf919bdd2 100644
--- a/include/hw/s390x/css.h
+++ b/include/hw/s390x/css.h
@@ -333,10 +333,4 @@ static inline int ccw_dstream_read_buf(CcwDataStream *cds, void *buff, int len)
 #define ccw_dstream_read(cds, v) ccw_dstream_read_buf((cds), &(v), sizeof(v))
 #define ccw_dstream_write(cds, v) ccw_dstream_write_buf((cds), &(v), sizeof(v))
 
-/**
- * true if (vmstate based) migration of the channel subsystem
- * is enabled, false if it is disabled.
- */
-extern bool css_migration_enabled;
-
 #endif

From d6305b6e613fa23882b9b7b58f6b0aec0eeef015 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Wed, 15 Jan 2025 08:38:14 +0100
Subject: [PATCH 0047/2760] hw/s390x/s390-stattrib: Remove the old
 migration_enabled flag
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Now that the machine types that set the migration_enabled flag to
false are gone, we can remove it and the related code.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250115073819.15452-4-thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 hw/s390x/s390-stattrib-kvm.c          | 2 +-
 hw/s390x/s390-stattrib.c              | 7 +------
 include/hw/s390x/storage-attributes.h | 1 -
 3 files changed, 2 insertions(+), 8 deletions(-)

diff --git a/hw/s390x/s390-stattrib-kvm.c b/hw/s390x/s390-stattrib-kvm.c
index 2a8e31718b..d0ff04364d 100644
--- a/hw/s390x/s390-stattrib-kvm.c
+++ b/hw/s390x/s390-stattrib-kvm.c
@@ -185,7 +185,7 @@ static long long kvm_s390_stattrib_get_dirtycount(S390StAttribState *sa)
 
 static int kvm_s390_stattrib_get_active(S390StAttribState *sa)
 {
-    return kvm_s390_cmma_active() && sa->migration_enabled;
+    return kvm_s390_cmma_active();
 }
 
 static void kvm_s390_stattrib_class_init(ObjectClass *oc, void *data)
diff --git a/hw/s390x/s390-stattrib.c b/hw/s390x/s390-stattrib.c
index be07c28c6e..35bf697ef0 100644
--- a/hw/s390x/s390-stattrib.c
+++ b/hw/s390x/s390-stattrib.c
@@ -304,7 +304,7 @@ static int qemu_s390_set_migrationmode_stub(S390StAttribState *sa, bool value,
 
 static int qemu_s390_get_active(S390StAttribState *sa)
 {
-    return sa->migration_enabled;
+    return true;
 }
 
 static void qemu_s390_stattrib_class_init(ObjectClass *oc, void *data)
@@ -360,10 +360,6 @@ static void s390_stattrib_realize(DeviceState *dev, Error **errp)
                          &savevm_s390_stattrib_handlers, dev);
 }
 
-static const Property s390_stattrib_props[] = {
-    DEFINE_PROP_BOOL("migration-enabled", S390StAttribState, migration_enabled, true),
-};
-
 static void s390_stattrib_class_init(ObjectClass *oc, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
@@ -371,7 +367,6 @@ static void s390_stattrib_class_init(ObjectClass *oc, void *data)
     dc->hotpluggable = false;
     set_bit(DEVICE_CATEGORY_MISC, dc->categories);
     dc->realize = s390_stattrib_realize;
-    device_class_set_props(dc, s390_stattrib_props);
 }
 
 static void s390_stattrib_instance_init(Object *obj)
diff --git a/include/hw/s390x/storage-attributes.h b/include/hw/s390x/storage-attributes.h
index 8921a04d51..b5c6d8fa55 100644
--- a/include/hw/s390x/storage-attributes.h
+++ b/include/hw/s390x/storage-attributes.h
@@ -25,7 +25,6 @@ OBJECT_DECLARE_TYPE(S390StAttribState, S390StAttribClass, S390_STATTRIB)
 struct S390StAttribState {
     DeviceState parent_obj;
     uint64_t migration_cur_gfn;
-    bool migration_enabled;
 };
 
 

From 7c3b69feb07acbd70cbf3ce6cbd5ccbefedf5e58 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Wed, 15 Jan 2025 08:38:15 +0100
Subject: [PATCH 0048/2760] hw/intc/s390_flic: Remove the obsolete
 migration_enabled flag
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Now that the machine types that set the migration_enabled flag to
false are gone, we can remove it and the related code.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250115073819.15452-5-thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 hw/intc/s390_flic.c          | 14 --------------
 include/hw/s390x/s390_flic.h |  1 -
 2 files changed, 15 deletions(-)

diff --git a/hw/intc/s390_flic.c b/hw/intc/s390_flic.c
index c20f4c1075..4fae023197 100644
--- a/hw/intc/s390_flic.c
+++ b/hw/intc/s390_flic.c
@@ -470,11 +470,6 @@ static void qemu_s390_flic_class_init(ObjectClass *oc, void *data)
     fsc->inject_crw_mchk = qemu_s390_inject_crw_mchk;
 }
 
-static const Property s390_flic_common_properties[] = {
-    DEFINE_PROP_BOOL("migration-enabled", S390FLICState,
-                     migration_enabled, true),
-};
-
 static void s390_flic_common_realize(DeviceState *dev, Error **errp)
 {
     S390FLICState *fs = S390_FLIC_COMMON(dev);
@@ -486,7 +481,6 @@ static void s390_flic_class_init(ObjectClass *oc, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
-    device_class_set_props(dc, s390_flic_common_properties);
     dc->realize = s390_flic_common_realize;
 }
 
@@ -515,18 +509,10 @@ static void qemu_s390_flic_register_types(void)
 
 type_init(qemu_s390_flic_register_types)
 
-static bool adapter_info_so_needed(void *opaque)
-{
-    S390FLICState *fs = s390_get_flic();
-
-    return fs->migration_enabled;
-}
-
 const VMStateDescription vmstate_adapter_info_so = {
     .name = "s390_adapter_info/summary_offset",
     .version_id = 1,
     .minimum_version_id = 1,
-    .needed = adapter_info_so_needed,
     .fields = (const VMStateField[]) {
         VMSTATE_UINT32(summary_offset, AdapterInfo),
         VMSTATE_END_OF_LIST()
diff --git a/include/hw/s390x/s390_flic.h b/include/hw/s390x/s390_flic.h
index 85016d5ccc..91edaaca40 100644
--- a/include/hw/s390x/s390_flic.h
+++ b/include/hw/s390x/s390_flic.h
@@ -42,7 +42,6 @@ OBJECT_DECLARE_TYPE(S390FLICState, S390FLICStateClass,
 struct S390FLICState {
     SysBusDevice parent_obj;
     bool ais_supported;
-    bool migration_enabled;
 };
 
 

From 4b91f6d16d4e50cf0f19d74f318d0ba61f90cc64 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 10 Mar 2025 16:14:11 +0100
Subject: [PATCH 0049/2760] hw/s390x/skeys: Declare QOM types using
 DEFINE_TYPES() macro
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When multiple QOM types are registered in the same file,
it is simpler to use the the DEFINE_TYPES() macro. In
particular because type array declared with such macro
are easier to review.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Eric Farman <farman@linux.ibm.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250310151414.11550-2-philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 hw/s390x/s390-skeys.c | 39 +++++++++++++++++----------------------
 1 file changed, 17 insertions(+), 22 deletions(-)

diff --git a/hw/s390x/s390-skeys.c b/hw/s390x/s390-skeys.c
index 811d892122..d50e71b927 100644
--- a/hw/s390x/s390-skeys.c
+++ b/hw/s390x/s390-skeys.c
@@ -316,14 +316,6 @@ static void qemu_s390_skeys_class_init(ObjectClass *oc, void *data)
     dc->user_creatable = false;
 }
 
-static const TypeInfo qemu_s390_skeys_info = {
-    .name          = TYPE_QEMU_S390_SKEYS,
-    .parent        = TYPE_S390_SKEYS,
-    .instance_size = sizeof(QEMUS390SKeysState),
-    .class_init    = qemu_s390_skeys_class_init,
-    .class_size    = sizeof(S390SKeysClass),
-};
-
 static void s390_storage_keys_save(QEMUFile *f, void *opaque)
 {
     S390SKeysState *ss = S390_SKEYS(opaque);
@@ -481,19 +473,22 @@ static void s390_skeys_class_init(ObjectClass *oc, void *data)
     set_bit(DEVICE_CATEGORY_MISC, dc->categories);
 }
 
-static const TypeInfo s390_skeys_info = {
-    .name          = TYPE_S390_SKEYS,
-    .parent        = TYPE_DEVICE,
-    .instance_size = sizeof(S390SKeysState),
-    .class_init    = s390_skeys_class_init,
-    .class_size    = sizeof(S390SKeysClass),
-    .abstract = true,
+static const TypeInfo s390_skeys_types[] = {
+    {
+        .name           = TYPE_S390_SKEYS,
+        .parent         = TYPE_DEVICE,
+        .instance_size  = sizeof(S390SKeysState),
+        .class_init     = s390_skeys_class_init,
+        .class_size     = sizeof(S390SKeysClass),
+        .abstract       = true,
+    },
+    {
+        .name           = TYPE_QEMU_S390_SKEYS,
+        .parent         = TYPE_S390_SKEYS,
+        .instance_size  = sizeof(QEMUS390SKeysState),
+        .class_init     = qemu_s390_skeys_class_init,
+        .class_size     = sizeof(S390SKeysClass),
+    },
 };
 
-static void qemu_s390_skeys_register_types(void)
-{
-    type_register_static(&s390_skeys_info);
-    type_register_static(&qemu_s390_skeys_info);
-}
-
-type_init(qemu_s390_skeys_register_types)
+DEFINE_TYPES(s390_skeys_types)

From 3f979fe13e405d5721f3b43b5669a462f4816569 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 10 Mar 2025 16:14:12 +0100
Subject: [PATCH 0050/2760] hw/s390x/skeys: Introduce TYPE_DUMP_SKEYS_INTERFACE
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The storage keys are part of the machine memory.

Introduce the TYPE_DUMP_SKEYS_INTERFACE type,
allowing machine using storage keys to dump them
when a DumpSKeysInterface::qmp_dump_skeys() callback
is provided.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Eric Farman <farman@linux.ibm.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250310151414.11550-3-philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 hw/s390x/s390-skeys.c           |  5 +++++
 include/hw/s390x/storage-keys.h | 15 +++++++++++++++
 2 files changed, 20 insertions(+)

diff --git a/hw/s390x/s390-skeys.c b/hw/s390x/s390-skeys.c
index d50e71b927..0d3d4f74b4 100644
--- a/hw/s390x/s390-skeys.c
+++ b/hw/s390x/s390-skeys.c
@@ -474,6 +474,11 @@ static void s390_skeys_class_init(ObjectClass *oc, void *data)
 }
 
 static const TypeInfo s390_skeys_types[] = {
+    {
+        .name           = TYPE_DUMP_SKEYS_INTERFACE,
+        .parent         = TYPE_INTERFACE,
+        .class_size     = sizeof(DumpSKeysInterface),
+    },
     {
         .name           = TYPE_S390_SKEYS,
         .parent         = TYPE_DEVICE,
diff --git a/include/hw/s390x/storage-keys.h b/include/hw/s390x/storage-keys.h
index 408d2815d4..fb766d4631 100644
--- a/include/hw/s390x/storage-keys.h
+++ b/include/hw/s390x/storage-keys.h
@@ -125,4 +125,19 @@ S390SKeysState *s390_get_skeys_device(void);
 void hmp_dump_skeys(Monitor *mon, const QDict *qdict);
 void hmp_info_skeys(Monitor *mon, const QDict *qdict);
 
+#define TYPE_DUMP_SKEYS_INTERFACE "dump-skeys-interface"
+
+typedef struct DumpSKeysInterface DumpSKeysInterface;
+DECLARE_CLASS_CHECKERS(DumpSKeysInterface, DUMP_SKEYS_INTERFACE,
+                       TYPE_DUMP_SKEYS_INTERFACE)
+
+struct DumpSKeysInterface {
+    InterfaceClass parent_class;
+
+    /**
+     * @qmp_dump_skeys: Callback to dump guest's storage keys to @filename.
+     */
+    void (*qmp_dump_skeys)(const char *filename, Error **errp);
+};
+
 #endif /* S390_STORAGE_KEYS_H */

From 1b759bb0cdd6ee5c83bdf8ff3c6897071c5a3a2a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 10 Mar 2025 16:14:13 +0100
Subject: [PATCH 0051/2760] hw/s390x/ccw: Have CCW machine implement a
 qmp_dump_skeys() callback
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In preparation to make @dump-skeys command generic,
extract s390_qmp_dump_skeys() out of qmp_dump_skeys().
Register it as CCW qmp_dump_skeys() callback.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Eric Farman <farman@linux.ibm.com>
Message-ID: <20250310151414.11550-4-philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 hw/s390x/s390-skeys.c           | 7 ++++++-
 hw/s390x/s390-virtio-ccw.c      | 3 +++
 include/hw/s390x/storage-keys.h | 1 +
 3 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/hw/s390x/s390-skeys.c b/hw/s390x/s390-skeys.c
index 0d3d4f74b4..fd1123b0f3 100644
--- a/hw/s390x/s390-skeys.c
+++ b/hw/s390x/s390-skeys.c
@@ -142,7 +142,7 @@ void hmp_dump_skeys(Monitor *mon, const QDict *qdict)
     }
 }
 
-void qmp_dump_skeys(const char *filename, Error **errp)
+void s390_qmp_dump_skeys(const char *filename, Error **errp)
 {
     S390SKeysState *ss = s390_get_skeys_device();
     S390SKeysClass *skeyclass = S390_SKEYS_GET_CLASS(ss);
@@ -219,6 +219,11 @@ out:
     fclose(f);
 }
 
+void qmp_dump_skeys(const char *filename, Error **errp)
+{
+    s390_qmp_dump_skeys(filename, errp);
+}
+
 static bool qemu_s390_skeys_are_enabled(S390SKeysState *ss)
 {
     QEMUS390SKeysState *skeys = QEMU_S390_SKEYS(ss);
diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
index 72de2bd8dc..910dab0831 100644
--- a/hw/s390x/s390-virtio-ccw.c
+++ b/hw/s390x/s390-virtio-ccw.c
@@ -810,6 +810,7 @@ static void ccw_machine_class_init(ObjectClass *oc, void *data)
     NMIClass *nc = NMI_CLASS(oc);
     HotplugHandlerClass *hc = HOTPLUG_HANDLER_CLASS(oc);
     S390CcwMachineClass *s390mc = S390_CCW_MACHINE_CLASS(mc);
+    DumpSKeysInterface *dsi = DUMP_SKEYS_INTERFACE_CLASS(oc);
 
     s390mc->hpage_1m_allowed = true;
     s390mc->max_threads = 1;
@@ -835,6 +836,7 @@ static void ccw_machine_class_init(ObjectClass *oc, void *data)
     nc->nmi_monitor_handler = s390_nmi;
     mc->default_ram_id = "s390.ram";
     mc->default_nic = "virtio-net-ccw";
+    dsi->qmp_dump_skeys = s390_qmp_dump_skeys;
 
     object_class_property_add_bool(oc, "aes-key-wrap",
                                    machine_get_aes_key_wrap,
@@ -876,6 +878,7 @@ static const TypeInfo ccw_machine_info = {
     .interfaces = (InterfaceInfo[]) {
         { TYPE_NMI },
         { TYPE_HOTPLUG_HANDLER},
+        { TYPE_DUMP_SKEYS_INTERFACE},
         { }
     },
 };
diff --git a/include/hw/s390x/storage-keys.h b/include/hw/s390x/storage-keys.h
index fb766d4631..ac303001f5 100644
--- a/include/hw/s390x/storage-keys.h
+++ b/include/hw/s390x/storage-keys.h
@@ -122,6 +122,7 @@ int s390_skeys_set(S390SKeysState *ks, uint64_t start_gfn,
 
 S390SKeysState *s390_get_skeys_device(void);
 
+void s390_qmp_dump_skeys(const char *filename, Error **errp);
 void hmp_dump_skeys(Monitor *mon, const QDict *qdict);
 void hmp_info_skeys(Monitor *mon, const QDict *qdict);
 

From 76720b6e85b5a6c61044e2110195068c1106fe4e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 10 Mar 2025 16:14:14 +0100
Subject: [PATCH 0052/2760] qapi/machine: Make @dump-skeys command generic
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reduce misc-target.json by one target specific command.

Error message is returned for machines not implementing
TYPE_DUMP_SKEYS_INTERFACE:

  $ qemu-system-aarch64 -M virt -S -qmp stdio
  {"QMP": {"version": {"qemu": {"micro": 50, "major": 9}}, "capabilities": ["oob"]}}
  { "execute": "qmp_capabilities" }
  {"return": {}}
  { "execute": "dump-skeys", "arguments": { "filename": "/tmp/foo" }  }
  {"error": {"class": "GenericError", "desc": "Storage keys information not available for this architecture"}}

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250310151414.11550-5-philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 hw/core/machine-qmp-cmds.c | 14 ++++++++++++++
 hw/s390x/s390-skeys.c      |  6 +-----
 qapi/machine.json          | 18 ++++++++++++++++++
 qapi/misc-target.json      | 19 -------------------
 4 files changed, 33 insertions(+), 24 deletions(-)

diff --git a/hw/core/machine-qmp-cmds.c b/hw/core/machine-qmp-cmds.c
index 3130c5cd45..fd8b4e0b44 100644
--- a/hw/core/machine-qmp-cmds.c
+++ b/hw/core/machine-qmp-cmds.c
@@ -25,6 +25,7 @@
 #include "system/numa.h"
 #include "system/runstate.h"
 #include "system/system.h"
+#include "hw/s390x/storage-keys.h"
 
 /*
  * fast means: we NEVER interrupt vCPU threads to retrieve
@@ -406,3 +407,16 @@ GuidInfo *qmp_query_vm_generation_id(Error **errp)
     info->guid = qemu_uuid_unparse_strdup(&vms->guid);
     return info;
 }
+
+void qmp_dump_skeys(const char *filename, Error **errp)
+{
+    ObjectClass *mc = object_get_class(qdev_get_machine());
+    ObjectClass *oc = object_class_dynamic_cast(mc, TYPE_DUMP_SKEYS_INTERFACE);
+
+    if (!oc) {
+        error_setg(errp, "Storage keys information not available"
+                         " for this architecture");
+        return;
+    }
+    DUMP_SKEYS_INTERFACE_CLASS(oc)->qmp_dump_skeys(filename, errp);
+}
diff --git a/hw/s390x/s390-skeys.c b/hw/s390x/s390-skeys.c
index fd1123b0f3..067ea03726 100644
--- a/hw/s390x/s390-skeys.c
+++ b/hw/s390x/s390-skeys.c
@@ -15,6 +15,7 @@
 #include "hw/qdev-properties.h"
 #include "hw/s390x/storage-keys.h"
 #include "qapi/error.h"
+#include "qapi/qapi-commands-machine.h"
 #include "qapi/qapi-commands-misc-target.h"
 #include "qobject/qdict.h"
 #include "qemu/error-report.h"
@@ -219,11 +220,6 @@ out:
     fclose(f);
 }
 
-void qmp_dump_skeys(const char *filename, Error **errp)
-{
-    s390_qmp_dump_skeys(filename, errp);
-}
-
 static bool qemu_s390_skeys_are_enabled(S390SKeysState *ss)
 {
     QEMUS390SKeysState *skeys = QEMU_S390_SKEYS(ss);
diff --git a/qapi/machine.json b/qapi/machine.json
index a6b8795b09..a9ff807631 100644
--- a/qapi/machine.json
+++ b/qapi/machine.json
@@ -1898,3 +1898,21 @@
 { 'command': 'x-query-interrupt-controllers',
   'returns': 'HumanReadableText',
   'features': [ 'unstable' ]}
+
+##
+# @dump-skeys:
+#
+# Dump the storage keys for an s390x guest
+#
+# @filename: the path to the file to dump to
+#
+# Since: 2.5
+#
+# .. qmp-example::
+#
+#     -> { "execute": "dump-skeys",
+#          "arguments": { "filename": "/tmp/skeys" } }
+#     <- { "return": {} }
+##
+{ 'command': 'dump-skeys',
+  'data': { 'filename': 'str' } }
diff --git a/qapi/misc-target.json b/qapi/misc-target.json
index 8d70bd24d8..42e4a7417d 100644
--- a/qapi/misc-target.json
+++ b/qapi/misc-target.json
@@ -274,25 +274,6 @@
   'returns': 'SevAttestationReport',
   'if': 'TARGET_I386' }
 
-##
-# @dump-skeys:
-#
-# Dump guest's storage keys
-#
-# @filename: the path to the file to dump to
-#
-# Since: 2.5
-#
-# .. qmp-example::
-#
-#     -> { "execute": "dump-skeys",
-#          "arguments": { "filename": "/tmp/skeys" } }
-#     <- { "return": {} }
-##
-{ 'command': 'dump-skeys',
-  'data': { 'filename': 'str' },
-  'if': 'TARGET_S390X' }
-
 ##
 # @GICCapability:
 #

From 4a00039c4666fb3f5b24dca8f3212fe049e0f92e Mon Sep 17 00:00:00 2001
From: Cornelia Huck <cohuck@redhat.com>
Date: Mon, 14 Apr 2025 11:45:43 +0200
Subject: [PATCH 0053/2760] hw: add compat machines for 10.1

Add 10.1 machine types for arm/i440fx/m68k/q35/s390x/spapr.

Signed-off-by: Cornelia Huck <cohuck@redhat.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20250414094543.221241-1-cohuck@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 hw/arm/virt.c              | 11 +++++++++--
 hw/core/machine.c          |  3 +++
 hw/i386/pc.c               |  3 +++
 hw/i386/pc_piix.c          | 13 +++++++++++--
 hw/i386/pc_q35.c           | 13 +++++++++++--
 hw/m68k/virt.c             | 11 +++++++++--
 hw/ppc/spapr.c             | 17 ++++++++++++++---
 hw/s390x/s390-virtio-ccw.c | 14 +++++++++++++-
 include/hw/boards.h        |  3 +++
 include/hw/i386/pc.h       |  3 +++
 10 files changed, 79 insertions(+), 12 deletions(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index a96452f17a..3e72adaa91 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -3408,10 +3408,17 @@ static void machvirt_machine_init(void)
 }
 type_init(machvirt_machine_init);
 
-static void virt_machine_10_0_options(MachineClass *mc)
+static void virt_machine_10_1_options(MachineClass *mc)
 {
 }
-DEFINE_VIRT_MACHINE_AS_LATEST(10, 0)
+DEFINE_VIRT_MACHINE_AS_LATEST(10, 1)
+
+static void virt_machine_10_0_options(MachineClass *mc)
+{
+    virt_machine_10_1_options(mc);
+    compat_props_add(mc->compat_props, hw_compat_10_0, hw_compat_10_0_len);
+}
+DEFINE_VIRT_MACHINE(10, 0)
 
 static void virt_machine_9_2_options(MachineClass *mc)
 {
diff --git a/hw/core/machine.c b/hw/core/machine.c
index 63c6ef93d2..abfcedd4a5 100644
--- a/hw/core/machine.c
+++ b/hw/core/machine.c
@@ -37,6 +37,9 @@
 #include "hw/virtio/virtio-iommu.h"
 #include "audio/audio.h"
 
+GlobalProperty hw_compat_10_0[] = {};
+const size_t hw_compat_10_0_len = G_N_ELEMENTS(hw_compat_10_0);
+
 GlobalProperty hw_compat_9_2[] = {
     {"arm-cpu", "backcompat-pauth-default-use-qarma5", "true"},
     { "virtio-balloon-pci", "vectors", "0" },
diff --git a/hw/i386/pc.c b/hw/i386/pc.c
index 01d0581f62..1b5d55e96d 100644
--- a/hw/i386/pc.c
+++ b/hw/i386/pc.c
@@ -79,6 +79,9 @@
     { "qemu64-" TYPE_X86_CPU, "model-id", "QEMU Virtual CPU version " v, },\
     { "athlon-" TYPE_X86_CPU, "model-id", "QEMU Virtual CPU version " v, },
 
+GlobalProperty pc_compat_10_0[] = {};
+const size_t pc_compat_10_0_len = G_N_ELEMENTS(pc_compat_10_0);
+
 GlobalProperty pc_compat_9_2[] = {};
 const size_t pc_compat_9_2_len = G_N_ELEMENTS(pc_compat_9_2);
 
diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
index 6c91e2d292..dbb59df64f 100644
--- a/hw/i386/pc_piix.c
+++ b/hw/i386/pc_piix.c
@@ -479,12 +479,21 @@ static void pc_i440fx_machine_options(MachineClass *m)
                                      "Use a different south bridge than PIIX3");
 }
 
-static void pc_i440fx_machine_10_0_options(MachineClass *m)
+static void pc_i440fx_machine_10_1_options(MachineClass *m)
 {
     pc_i440fx_machine_options(m);
 }
 
-DEFINE_I440FX_MACHINE_AS_LATEST(10, 0);
+DEFINE_I440FX_MACHINE_AS_LATEST(10, 1);
+
+static void pc_i440fx_machine_10_0_options(MachineClass *m)
+{
+    pc_i440fx_machine_10_1_options(m);
+    compat_props_add(m->compat_props, hw_compat_10_0, hw_compat_10_0_len);
+    compat_props_add(m->compat_props, pc_compat_10_0, pc_compat_10_0_len);
+}
+
+DEFINE_I440FX_MACHINE(10, 0);
 
 static void pc_i440fx_machine_9_2_options(MachineClass *m)
 {
diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
index fd96d0345c..c538b3d05b 100644
--- a/hw/i386/pc_q35.c
+++ b/hw/i386/pc_q35.c
@@ -361,12 +361,21 @@ static void pc_q35_machine_options(MachineClass *m)
                      pc_q35_compat_defaults, pc_q35_compat_defaults_len);
 }
 
-static void pc_q35_machine_10_0_options(MachineClass *m)
+static void pc_q35_machine_10_1_options(MachineClass *m)
 {
     pc_q35_machine_options(m);
 }
 
-DEFINE_Q35_MACHINE_AS_LATEST(10, 0);
+DEFINE_Q35_MACHINE_AS_LATEST(10, 1);
+
+static void pc_q35_machine_10_0_options(MachineClass *m)
+{
+    pc_q35_machine_10_1_options(m);
+    compat_props_add(m->compat_props, hw_compat_10_0, hw_compat_10_0_len);
+    compat_props_add(m->compat_props, pc_compat_10_0, pc_compat_10_0_len);
+}
+
+DEFINE_Q35_MACHINE(10, 0);
 
 static void pc_q35_machine_9_2_options(MachineClass *m)
 {
diff --git a/hw/m68k/virt.c b/hw/m68k/virt.c
index d967bdd743..295a614e16 100644
--- a/hw/m68k/virt.c
+++ b/hw/m68k/virt.c
@@ -366,10 +366,17 @@ type_init(virt_machine_register_types)
 #define DEFINE_VIRT_MACHINE(major, minor) \
     DEFINE_VIRT_MACHINE_IMPL(false, major, minor)
 
-static void virt_machine_10_0_options(MachineClass *mc)
+static void virt_machine_10_1_options(MachineClass *mc)
 {
 }
-DEFINE_VIRT_MACHINE_AS_LATEST(10, 0)
+DEFINE_VIRT_MACHINE_AS_LATEST(10, 1)
+
+static void virt_machine_10_0_options(MachineClass *mc)
+{
+    virt_machine_10_1_options(mc);
+    compat_props_add(mc->compat_props, hw_compat_10_0, hw_compat_10_0_len);
+}
+DEFINE_VIRT_MACHINE(10, 0)
 
 static void virt_machine_9_2_options(MachineClass *mc)
 {
diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index b0a0f8c689..6fef1d167a 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -4767,14 +4767,25 @@ static void spapr_machine_latest_class_options(MachineClass *mc)
     DEFINE_SPAPR_MACHINE_IMPL(false, major, minor)
 
 /*
- * pseries-10.0
+ * pseries-10.1
  */
-static void spapr_machine_10_0_class_options(MachineClass *mc)
+static void spapr_machine_10_1_class_options(MachineClass *mc)
 {
     /* Defaults for the latest behaviour inherited from the base class */
 }
 
-DEFINE_SPAPR_MACHINE_AS_LATEST(10, 0);
+DEFINE_SPAPR_MACHINE_AS_LATEST(10, 1);
+
+/*
+ * pseries-10.0
+ */
+static void spapr_machine_10_0_class_options(MachineClass *mc)
+{
+    spapr_machine_10_1_class_options(mc);
+    compat_props_add(mc->compat_props, hw_compat_10_0, hw_compat_10_0_len);
+}
+
+DEFINE_SPAPR_MACHINE(10, 0);
 
 /*
  * pseries-9.2
diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
index 910dab0831..5af3c4f547 100644
--- a/hw/s390x/s390-virtio-ccw.c
+++ b/hw/s390x/s390-virtio-ccw.c
@@ -924,14 +924,26 @@ static const TypeInfo ccw_machine_info = {
     DEFINE_CCW_MACHINE_IMPL(false, major, minor)
 
 
+static void ccw_machine_10_1_instance_options(MachineState *machine)
+{
+}
+
+static void ccw_machine_10_1_class_options(MachineClass *mc)
+{
+}
+DEFINE_CCW_MACHINE_AS_LATEST(10, 1);
+
 static void ccw_machine_10_0_instance_options(MachineState *machine)
 {
+    ccw_machine_10_1_instance_options(machine);
 }
 
 static void ccw_machine_10_0_class_options(MachineClass *mc)
 {
+    ccw_machine_10_1_class_options(mc);
+    compat_props_add(mc->compat_props, hw_compat_10_0, hw_compat_10_0_len);
 }
-DEFINE_CCW_MACHINE_AS_LATEST(10, 0);
+DEFINE_CCW_MACHINE(10, 0);
 
 static void ccw_machine_9_2_instance_options(MachineState *machine)
 {
diff --git a/include/hw/boards.h b/include/hw/boards.h
index f22b2e7fc7..bfe8643a27 100644
--- a/include/hw/boards.h
+++ b/include/hw/boards.h
@@ -761,6 +761,9 @@ struct MachineState {
     } \
     type_init(machine_initfn##_register_types)
 
+extern GlobalProperty hw_compat_10_0[];
+extern const size_t hw_compat_10_0_len;
+
 extern GlobalProperty hw_compat_9_2[];
 extern const size_t hw_compat_9_2_len;
 
diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
index 103b54301f..8677dc8950 100644
--- a/include/hw/i386/pc.h
+++ b/include/hw/i386/pc.h
@@ -215,6 +215,9 @@ void pc_system_parse_ovmf_flash(uint8_t *flash_ptr, size_t flash_size);
 /* sgx.c */
 void pc_machine_init_sgx_epc(PCMachineState *pcms);
 
+extern GlobalProperty pc_compat_10_0[];
+extern const size_t pc_compat_10_0_len;
+
 extern GlobalProperty pc_compat_9_2[];
 extern const size_t pc_compat_9_2_len;
 

From 4e3823c68cc5ce04756a8f11d1ec9c18172f0bd3 Mon Sep 17 00:00:00 2001
From: Cornelia Huck <cohuck@redhat.com>
Date: Mon, 14 Apr 2025 11:37:32 +0200
Subject: [PATCH 0054/2760] tests/functional/test_vnc: skip test if no crypto
 backend available

The test_change_password test will fail if no cryptographic backend is
available (e.g. if QEMU was built on a system with no cryptographic
library development packages installed); just skip the test in that
case.

Signed-off-by: Cornelia Huck <cohuck@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250414093732.220498-1-cohuck@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/functional/test_vnc.py | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/tests/functional/test_vnc.py b/tests/functional/test_vnc.py
index 8c9953bdb0..d4e9dd0279 100755
--- a/tests/functional/test_vnc.py
+++ b/tests/functional/test_vnc.py
@@ -55,6 +55,8 @@ class Vnc(QemuSystemTest):
         except VMLaunchFailure as excp:
             if "-vnc: invalid option" in excp.output:
                 self.skipTest("VNC support not available")
+            elif "Cipher backend does not support DES algorithm" in excp.output:
+                self.skipTest("No cryptographic backend available")
             else:
                 self.log.info("unhandled launch failure: %s", excp.output)
                 raise excp

From 22baa5f340d4fe3e7f271d275367b806ef3da834 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Mon, 14 Apr 2025 13:30:15 +0200
Subject: [PATCH 0055/2760] gitlab-ci: Remove the avocado tests from the CI
 pipelines
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We are going to move the remaining Avocado tests step by step
into the functional test framework. Unfortunately, Avocado fails
with an error if it cannot determine a test to run, so disable
the tests here now to avoid failures in the Gitlab-CI during the
next steps.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20250414113031.151105-2-thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 .gitlab-ci.d/buildtest-template.yml | 11 ----------
 .gitlab-ci.d/buildtest.yml          | 33 +++++++++++------------------
 2 files changed, 12 insertions(+), 32 deletions(-)

diff --git a/.gitlab-ci.d/buildtest-template.yml b/.gitlab-ci.d/buildtest-template.yml
index 39da7698b0..13fa4f4a4f 100644
--- a/.gitlab-ci.d/buildtest-template.yml
+++ b/.gitlab-ci.d/buildtest-template.yml
@@ -95,7 +95,6 @@
   cache:
     key: "${CI_JOB_NAME}-cache"
     paths:
-      - ${CI_PROJECT_DIR}/avocado-cache
       - ${CI_PROJECT_DIR}/functional-cache
     policy: pull-push
   artifacts:
@@ -109,16 +108,6 @@
     reports:
       junit: build/tests/results/latest/results.xml
   before_script:
-    - mkdir -p ~/.config/avocado
-    - echo "[datadir.paths]" > ~/.config/avocado/avocado.conf
-    - echo "cache_dirs = ['${CI_PROJECT_DIR}/avocado-cache']"
-           >> ~/.config/avocado/avocado.conf
-    - echo -e '[job.output.testlogs]\nstatuses = ["FAIL", "INTERRUPT"]'
-           >> ~/.config/avocado/avocado.conf
-    - if [ -d ${CI_PROJECT_DIR}/avocado-cache ]; then
-        du -chs ${CI_PROJECT_DIR}/*-cache ;
-      fi
-    - export AVOCADO_ALLOW_UNTRUSTED_CODE=1
     - export QEMU_TEST_ALLOW_UNTRUSTED_CODE=1
     - export QEMU_TEST_CACHE_DIR=${CI_PROJECT_DIR}/functional-cache
   after_script:
diff --git a/.gitlab-ci.d/buildtest.yml b/.gitlab-ci.d/buildtest.yml
index 00f4bfcd9f..431bc07d8f 100644
--- a/.gitlab-ci.d/buildtest.yml
+++ b/.gitlab-ci.d/buildtest.yml
@@ -29,8 +29,7 @@ functional-system-alpine:
       artifacts: true
   variables:
     IMAGE: alpine
-    MAKE_CHECK_ARGS: check-avocado check-functional
-    AVOCADO_TAGS: arch:avr arch:loongarch64 arch:mips64 arch:mipsel
+    MAKE_CHECK_ARGS: check-functional
 
 build-system-ubuntu:
   extends:
@@ -60,8 +59,7 @@ functional-system-ubuntu:
       artifacts: true
   variables:
     IMAGE: ubuntu2204
-    MAKE_CHECK_ARGS: check-avocado check-functional
-    AVOCADO_TAGS: arch:alpha arch:microblazeel arch:mips64el
+    MAKE_CHECK_ARGS: check-functional
 
 build-system-debian:
   extends:
@@ -92,8 +90,7 @@ functional-system-debian:
       artifacts: true
   variables:
     IMAGE: debian
-    MAKE_CHECK_ARGS: check-avocado check-functional
-    AVOCADO_TAGS: arch:arm arch:i386 arch:riscv64 arch:sh4 arch:sparc arch:xtensa
+    MAKE_CHECK_ARGS: check-functional
 
 crash-test-debian:
   extends: .native_test_job_template
@@ -155,9 +152,7 @@ functional-system-fedora:
       artifacts: true
   variables:
     IMAGE: fedora
-    MAKE_CHECK_ARGS: check-avocado check-functional
-    AVOCADO_TAGS: arch:microblaze arch:mips arch:xtensa arch:m68k
-      arch:riscv32 arch:ppc arch:sparc64
+    MAKE_CHECK_ARGS: check-functional
 
 crash-test-fedora:
   extends: .native_test_job_template
@@ -278,9 +273,7 @@ functional-system-centos:
       artifacts: true
   variables:
     IMAGE: centos9
-    MAKE_CHECK_ARGS: check-avocado check-functional
-    AVOCADO_TAGS: arch:ppc64 arch:or1k arch:s390x arch:x86_64 arch:rx
-      arch:sh4
+    MAKE_CHECK_ARGS: check-functional
 
 build-system-opensuse:
   extends:
@@ -309,8 +302,7 @@ functional-system-opensuse:
       artifacts: true
   variables:
     IMAGE: opensuse-leap
-    MAKE_CHECK_ARGS: check-avocado check-functional
-    AVOCADO_TAGS: arch:s390x arch:x86_64 arch:aarch64
+    MAKE_CHECK_ARGS: check-functional
 
 #
 # Flaky tests. We don't run these by default and they are allow fail
@@ -338,10 +330,9 @@ functional-system-flaky:
   allow_failure: true
   variables:
     IMAGE: debian
-    MAKE_CHECK_ARGS: check-avocado check-functional
+    MAKE_CHECK_ARGS: check-functional
     QEMU_JOB_OPTIONAL: 1
     QEMU_TEST_FLAKY_TESTS: 1
-    AVOCADO_TAGS: flaky
 
 # This jobs explicitly disable TCG (--disable-tcg), KVM is detected by
 # the configure script. The container doesn't contain Xen headers so
@@ -482,8 +473,8 @@ clang-user:
 # Since slirp callbacks are used in QEMU Timers, we cannot use libslirp with
 # CFI builds, and thus have to disable it here.
 #
-# Split in three sets of build/check/avocado to limit the execution time of each
-# job
+# Split in three sets of build/check/functional to limit the execution time
+# of each job
 build-cfi-aarch64:
   extends:
     - .native_build_job_template
@@ -520,7 +511,7 @@ functional-cfi-aarch64:
       artifacts: true
   variables:
     IMAGE: fedora
-    MAKE_CHECK_ARGS: check-avocado check-functional
+    MAKE_CHECK_ARGS: check-functional
 
 build-cfi-ppc64-s390x:
   extends:
@@ -558,7 +549,7 @@ functional-cfi-ppc64-s390x:
       artifacts: true
   variables:
     IMAGE: fedora
-    MAKE_CHECK_ARGS: check-avocado check-functional
+    MAKE_CHECK_ARGS: check-functional
 
 build-cfi-x86_64:
   extends:
@@ -592,7 +583,7 @@ functional-cfi-x86_64:
       artifacts: true
   variables:
     IMAGE: fedora
-    MAKE_CHECK_ARGS: check-avocado check-functional
+    MAKE_CHECK_ARGS: check-functional
 
 tsan-build:
   extends: .native_build_job_template

From bc65ae696104c15e52a5e26f225b689e2c2cdba6 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Mon, 14 Apr 2025 13:30:16 +0200
Subject: [PATCH 0056/2760] tests/functional: Move the check for the parameters
 from avocado to functional
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

test_x86_64_pc in tests/avocado/boot_linux_console.py only checks
whether the kernel parameters have correctly been passed to the
kernel in the guest by looking for them in the console output of the
guest. Let's move that to the functional test framework now, but
instead of doing it in a separate test, let's do it for all tuxrun
tests instead, so it is done automatically for all targets that have
a tuxrun test.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20250414113031.151105-3-thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/avocado/boot_linux_console.py      | 34 ------------------------
 tests/functional/qemu_test/tuxruntest.py |  9 ++++---
 2 files changed, 5 insertions(+), 38 deletions(-)

diff --git a/tests/avocado/boot_linux_console.py b/tests/avocado/boot_linux_console.py
index c15f39ae1f..cbb1e2fb50 100644
--- a/tests/avocado/boot_linux_console.py
+++ b/tests/avocado/boot_linux_console.py
@@ -9,17 +9,9 @@
 # later.  See the COPYING file in the top-level directory.
 
 import os
-import lzma
-import gzip
 import shutil
 
-from avocado import skip
-from avocado import skipUnless
-from avocado import skipUnless
 from avocado_qemu import QemuSystemTest
-from avocado_qemu import exec_command
-from avocado_qemu import exec_command_and_wait_for_pattern
-from avocado_qemu import interrupt_interactive_console_until_pattern
 from avocado_qemu import wait_for_console_pattern
 from avocado.utils import process
 from avocado.utils import archive
@@ -68,29 +60,3 @@ class LinuxKernelTest(QemuSystemTest):
         process.run("rpm2cpio %s | cpio -id %s" % (rpm, path), shell=True)
         os.chdir(cwd)
         return os.path.normpath(os.path.join(self.workdir, path))
-
-class BootLinuxConsole(LinuxKernelTest):
-    """
-    Boots a Linux kernel and checks that the console is operational and the
-    kernel command line is properly passed from QEMU to the kernel
-    """
-    timeout = 90
-
-    def test_x86_64_pc(self):
-        """
-        :avocado: tags=arch:x86_64
-        :avocado: tags=machine:pc
-        """
-        kernel_url = ('https://archives.fedoraproject.org/pub/archive/fedora'
-                      '/linux/releases/29/Everything/x86_64/os/images/pxeboot'
-                      '/vmlinuz')
-        kernel_hash = '23bebd2680757891cf7adedb033532163a792495'
-        kernel_path = self.fetch_asset(kernel_url, asset_hash=kernel_hash)
-
-        self.vm.set_console()
-        kernel_command_line = self.KERNEL_COMMON_COMMAND_LINE + 'console=ttyS0'
-        self.vm.add_args('-kernel', kernel_path,
-                         '-append', kernel_command_line)
-        self.vm.launch()
-        console_pattern = 'Kernel command line: %s' % kernel_command_line
-        self.wait_for_console_pattern(console_pattern)
diff --git a/tests/functional/qemu_test/tuxruntest.py b/tests/functional/qemu_test/tuxruntest.py
index ad74156f9c..c2bd5baaae 100644
--- a/tests/functional/qemu_test/tuxruntest.py
+++ b/tests/functional/qemu_test/tuxruntest.py
@@ -77,12 +77,12 @@ class TuxRunBaselineTest(QemuSystemTest):
         blockdev = "driver=raw,file.driver=file," \
             + f"file.filename={disk},node-name=hd0"
 
-        kcmd_line = self.KERNEL_COMMON_COMMAND_LINE
-        kcmd_line += f" root=/dev/{self.root}"
-        kcmd_line += f" console={self.console}"
+        self.kcmd_line = self.KERNEL_COMMON_COMMAND_LINE
+        self.kcmd_line += f" root=/dev/{self.root}"
+        self.kcmd_line += f" console={self.console}"
 
         self.vm.add_args('-kernel', kernel,
-                         '-append', kcmd_line,
+                         '-append', self.kcmd_line,
                          '-blockdev', blockdev)
 
         # Sometimes we need extra devices attached
@@ -103,6 +103,7 @@ class TuxRunBaselineTest(QemuSystemTest):
         wait to exit cleanly.
         """
         ps1='root@tuxtest:~#'
+        self.wait_for_console_pattern(self.kcmd_line)
         self.wait_for_console_pattern('tuxtest login:')
         exec_command_and_wait_for_pattern(self, 'root', ps1)
         exec_command_and_wait_for_pattern(self, 'cat /proc/interrupts', ps1)

From 951ededf12a89534195cf5c5210242a169a85656 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Mon, 14 Apr 2025 13:30:17 +0200
Subject: [PATCH 0057/2760] tests/functional: Convert reverse_debugging tests
 to the functional framework
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

These tests are using the gdb-related library functions from the
Avocado framework which we don't have in the functional framework
yet. So for the time being, keep those imports and skip the test
if the Avocado framework is not installed on the host.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20250414113031.151105-4-thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 MAINTAINERS                                   |   2 +-
 tests/functional/meson.build                  |   4 +
 .../reverse_debugging.py                      | 114 +++---------------
 .../functional/test_aarch64_reverse_debug.py  |  38 ++++++
 tests/functional/test_ppc64_reverse_debug.py  |  41 +++++++
 tests/functional/test_x86_64_reverse_debug.py |  36 ++++++
 6 files changed, 139 insertions(+), 96 deletions(-)
 rename tests/{avocado => functional}/reverse_debugging.py (66%)
 create mode 100755 tests/functional/test_aarch64_reverse_debug.py
 create mode 100755 tests/functional/test_ppc64_reverse_debug.py
 create mode 100755 tests/functional/test_x86_64_reverse_debug.py

diff --git a/MAINTAINERS b/MAINTAINERS
index d54b5578f8..af1d847f8e 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3671,7 +3671,7 @@ F: docs/system/replay.rst
 F: stubs/replay.c
 F: tests/avocado/replay_kernel.py
 F: tests/avocado/replay_linux.py
-F: tests/avocado/reverse_debugging.py
+F: tests/functional/*reverse_debug*.py
 F: tests/functional/*replay*.py
 F: qapi/replay.json
 
diff --git a/tests/functional/meson.build b/tests/functional/meson.build
index 0f8be30fe2..7b0f4ab0b1 100644
--- a/tests/functional/meson.build
+++ b/tests/functional/meson.build
@@ -13,6 +13,7 @@ endif
 test_timeouts = {
   'aarch64_aspeed' : 600,
   'aarch64_raspi4' : 480,
+  'aarch64_reverse_debug' : 180,
   'aarch64_rme_virt' : 1200,
   'aarch64_rme_sbsaref' : 1200,
   'aarch64_sbsaref_alpine' : 1200,
@@ -78,6 +79,7 @@ tests_aarch64_system_thorough = [
   'aarch64_raspi3',
   'aarch64_raspi4',
   'aarch64_replay',
+  'aarch64_reverse_debug',
   'aarch64_rme_virt',
   'aarch64_rme_sbsaref',
   'aarch64_sbsaref',
@@ -229,6 +231,7 @@ tests_ppc64_system_thorough = [
   'ppc64_powernv',
   'ppc64_pseries',
   'ppc64_replay',
+  'ppc64_reverse_debug',
   'ppc64_tuxrun',
   'ppc64_mac99',
 ]
@@ -311,6 +314,7 @@ tests_x86_64_system_thorough = [
   'x86_64_hotplug_cpu',
   'x86_64_kvm_xen',
   'x86_64_replay',
+  'x86_64_reverse_debug',
   'x86_64_tuxrun',
 ]
 
diff --git a/tests/avocado/reverse_debugging.py b/tests/functional/reverse_debugging.py
similarity index 66%
rename from tests/avocado/reverse_debugging.py
rename to tests/functional/reverse_debugging.py
index f24287cd0a..f9a1d395f1 100644
--- a/tests/avocado/reverse_debugging.py
+++ b/tests/functional/reverse_debugging.py
@@ -1,5 +1,7 @@
 # Reverse debugging test
 #
+# SPDX-License-Identifier: GPL-2.0-or-later
+#
 # Copyright (c) 2020 ISP RAS
 #
 # Author:
@@ -10,14 +12,9 @@
 import os
 import logging
 
-from avocado import skipUnless
-from avocado_qemu import BUILD_DIR
-from avocado.utils import datadrainer
-from avocado.utils import gdb
-from avocado.utils import process
-from avocado.utils.network.ports import find_free_port
-from avocado.utils.path import find_command
-from boot_linux_console import LinuxKernelTest
+from qemu_test import LinuxKernelTest, get_qemu_img
+from qemu_test.ports import Ports
+
 
 class ReverseDebugging(LinuxKernelTest):
     """
@@ -36,8 +33,10 @@ class ReverseDebugging(LinuxKernelTest):
     endian_is_le = True
 
     def run_vm(self, record, shift, args, replay_path, image_path, port):
+        from avocado.utils import datadrainer
+
         logger = logging.getLogger('replay')
-        vm = self.get_vm()
+        vm = self.get_vm(name='record' if record else 'replay')
         vm.set_console()
         if record:
             logger.info('recording the execution...')
@@ -100,25 +99,25 @@ class ReverseDebugging(LinuxKernelTest):
         return vm.qmp('query-replay')['return']['icount']
 
     def reverse_debugging(self, shift=7, args=None):
+        from avocado.utils import gdb
+        from avocado.utils import process
+
         logger = logging.getLogger('replay')
 
         # create qcow2 for snapshots
         logger.info('creating qcow2 image for VM snapshots')
         image_path = os.path.join(self.workdir, 'disk.qcow2')
-        qemu_img = os.path.join(BUILD_DIR, 'qemu-img')
-        if not os.path.exists(qemu_img):
-            qemu_img = find_command('qemu-img', False)
-        if qemu_img is False:
-            self.cancel('Could not find "qemu-img", which is required to '
-                        'create the temporary qcow2 image')
+        qemu_img = get_qemu_img(self)
+        if qemu_img is None:
+            self.skipTest('Could not find "qemu-img", which is required to '
+                          'create the temporary qcow2 image')
         cmd = '%s create -f qcow2 %s 128M' % (qemu_img, image_path)
         process.run(cmd)
 
         replay_path = os.path.join(self.workdir, 'replay.bin')
-        port = find_free_port()
 
         # record the log
-        vm = self.run_vm(True, shift, args, replay_path, image_path, port)
+        vm = self.run_vm(True, shift, args, replay_path, image_path, -1)
         while self.vm_get_icount(vm) <= self.STEPS:
             pass
         last_icount = self.vm_get_icount(vm)
@@ -127,7 +126,9 @@ class ReverseDebugging(LinuxKernelTest):
         logger.info("recorded log with %s+ steps" % last_icount)
 
         # replay and run debug commands
-        vm = self.run_vm(False, shift, args, replay_path, image_path, port)
+        with Ports() as ports:
+            port = ports.find_free_port()
+            vm = self.run_vm(False, shift, args, replay_path, image_path, port)
         logger.info('connecting to gdbstub')
         g = gdb.GDBRemote('127.0.0.1', port, False, False)
         g.connect()
@@ -193,80 +194,3 @@ class ReverseDebugging(LinuxKernelTest):
 
         logger.info('exiting gdb and qemu')
         vm.shutdown()
-
-class ReverseDebugging_X86_64(ReverseDebugging):
-    """
-    :avocado: tags=accel:tcg
-    """
-
-    REG_PC = 0x10
-    REG_CS = 0x12
-    def get_pc(self, g):
-        return self.get_reg_le(g, self.REG_PC) \
-            + self.get_reg_le(g, self.REG_CS) * 0x10
-
-    # unidentified gitlab timeout problem
-    @skipUnless(os.getenv('QEMU_TEST_FLAKY_TESTS'), 'Test is unstable on GitLab')
-    def test_x86_64_pc(self):
-        """
-        :avocado: tags=arch:x86_64
-        :avocado: tags=machine:pc
-        """
-        # start with BIOS only
-        self.reverse_debugging()
-
-class ReverseDebugging_AArch64(ReverseDebugging):
-    """
-    :avocado: tags=accel:tcg
-    """
-
-    REG_PC = 32
-
-    # unidentified gitlab timeout problem
-    @skipUnless(os.getenv('QEMU_TEST_FLAKY_TESTS'), 'Test is unstable on GitLab')
-    def test_aarch64_virt(self):
-        """
-        :avocado: tags=arch:aarch64
-        :avocado: tags=machine:virt
-        :avocado: tags=cpu:cortex-a53
-        """
-        kernel_url = ('https://archives.fedoraproject.org/pub/archive/fedora'
-                      '/linux/releases/29/Everything/aarch64/os/images/pxeboot'
-                      '/vmlinuz')
-        kernel_hash = '8c73e469fc6ea06a58dc83a628fc695b693b8493'
-        kernel_path = self.fetch_asset(kernel_url, asset_hash=kernel_hash)
-
-        self.reverse_debugging(
-            args=('-kernel', kernel_path))
-
-class ReverseDebugging_ppc64(ReverseDebugging):
-    """
-    :avocado: tags=accel:tcg
-    """
-
-    REG_PC = 0x40
-
-    # unidentified gitlab timeout problem
-    @skipUnless(os.getenv('QEMU_TEST_FLAKY_TESTS'), 'Test is unstable on GitLab')
-    def test_ppc64_pseries(self):
-        """
-        :avocado: tags=arch:ppc64
-        :avocado: tags=machine:pseries
-        :avocado: tags=flaky
-        """
-        # SLOF branches back to its entry point, which causes this test
-        # to take the 'hit a breakpoint again' path. That's not a problem,
-        # just slightly different than the other machines.
-        self.endian_is_le = False
-        self.reverse_debugging()
-
-    # See https://gitlab.com/qemu-project/qemu/-/issues/1992
-    @skipUnless(os.getenv('QEMU_TEST_FLAKY_TESTS'), 'Test is unstable on GitLab')
-    def test_ppc64_powernv(self):
-        """
-        :avocado: tags=arch:ppc64
-        :avocado: tags=machine:powernv
-        :avocado: tags=flaky
-        """
-        self.endian_is_le = False
-        self.reverse_debugging()
diff --git a/tests/functional/test_aarch64_reverse_debug.py b/tests/functional/test_aarch64_reverse_debug.py
new file mode 100755
index 0000000000..58d4532835
--- /dev/null
+++ b/tests/functional/test_aarch64_reverse_debug.py
@@ -0,0 +1,38 @@
+#!/usr/bin/env python3
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+#
+# Reverse debugging test
+#
+# Copyright (c) 2020 ISP RAS
+#
+# Author:
+#  Pavel Dovgalyuk <Pavel.Dovgalyuk@ispras.ru>
+#
+# This work is licensed under the terms of the GNU GPL, version 2 or
+# later.  See the COPYING file in the top-level directory.
+
+from qemu_test import Asset, skipIfMissingImports, skipFlakyTest
+from reverse_debugging import ReverseDebugging
+
+
+@skipIfMissingImports('avocado.utils')
+class ReverseDebugging_AArch64(ReverseDebugging):
+
+    REG_PC = 32
+
+    KERNEL_ASSET = Asset(
+        ('https://archives.fedoraproject.org/pub/archive/fedora/linux/'
+         'releases/29/Everything/aarch64/os/images/pxeboot/vmlinuz'),
+        '7e1430b81c26bdd0da025eeb8fbd77b5dc961da4364af26e771bd39f379cbbf7')
+
+    @skipFlakyTest("https://gitlab.com/qemu-project/qemu/-/issues/2921")
+    def test_aarch64_virt(self):
+        self.set_machine('virt')
+        self.cpu = 'cortex-a53'
+        kernel_path = self.KERNEL_ASSET.fetch()
+        self.reverse_debugging(args=('-kernel', kernel_path))
+
+
+if __name__ == '__main__':
+    ReverseDebugging.main()
diff --git a/tests/functional/test_ppc64_reverse_debug.py b/tests/functional/test_ppc64_reverse_debug.py
new file mode 100755
index 0000000000..5931adef5a
--- /dev/null
+++ b/tests/functional/test_ppc64_reverse_debug.py
@@ -0,0 +1,41 @@
+#!/usr/bin/env python3
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+#
+# Reverse debugging test
+#
+# Copyright (c) 2020 ISP RAS
+#
+# Author:
+#  Pavel Dovgalyuk <Pavel.Dovgalyuk@ispras.ru>
+#
+# This work is licensed under the terms of the GNU GPL, version 2 or
+# later.  See the COPYING file in the top-level directory.
+
+from qemu_test import skipIfMissingImports, skipFlakyTest
+from reverse_debugging import ReverseDebugging
+
+
+@skipIfMissingImports('avocado.utils')
+class ReverseDebugging_ppc64(ReverseDebugging):
+
+    REG_PC = 0x40
+
+    @skipFlakyTest("https://gitlab.com/qemu-project/qemu/-/issues/1992")
+    def test_ppc64_pseries(self):
+        self.set_machine('pseries')
+        # SLOF branches back to its entry point, which causes this test
+        # to take the 'hit a breakpoint again' path. That's not a problem,
+        # just slightly different than the other machines.
+        self.endian_is_le = False
+        self.reverse_debugging()
+
+    @skipFlakyTest("https://gitlab.com/qemu-project/qemu/-/issues/1992")
+    def test_ppc64_powernv(self):
+        self.set_machine('powernv')
+        self.endian_is_le = False
+        self.reverse_debugging()
+
+
+if __name__ == '__main__':
+    ReverseDebugging.main()
diff --git a/tests/functional/test_x86_64_reverse_debug.py b/tests/functional/test_x86_64_reverse_debug.py
new file mode 100755
index 0000000000..d713e91e14
--- /dev/null
+++ b/tests/functional/test_x86_64_reverse_debug.py
@@ -0,0 +1,36 @@
+#!/usr/bin/env python3
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+#
+# Reverse debugging test
+#
+# Copyright (c) 2020 ISP RAS
+#
+# Author:
+#  Pavel Dovgalyuk <Pavel.Dovgalyuk@ispras.ru>
+#
+# This work is licensed under the terms of the GNU GPL, version 2 or
+# later.  See the COPYING file in the top-level directory.
+
+from qemu_test import skipIfMissingImports, skipFlakyTest
+from reverse_debugging import ReverseDebugging
+
+
+@skipIfMissingImports('avocado.utils')
+class ReverseDebugging_X86_64(ReverseDebugging):
+
+    REG_PC = 0x10
+    REG_CS = 0x12
+    def get_pc(self, g):
+        return self.get_reg_le(g, self.REG_PC) \
+            + self.get_reg_le(g, self.REG_CS) * 0x10
+
+    @skipFlakyTest("https://gitlab.com/qemu-project/qemu/-/issues/2922")
+    def test_x86_64_pc(self):
+        self.set_machine('pc')
+        # start with BIOS only
+        self.reverse_debugging()
+
+
+if __name__ == '__main__':
+    ReverseDebugging.main()

From 0e756f404d73ddf7b5506e9109e2c074f30fb79e Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Mon, 14 Apr 2025 13:30:18 +0200
Subject: [PATCH 0058/2760] tests/functional: Convert the i386 replay avocado
 test
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since this was the last test in tests/avocado/replay_kernel.py,
we can remove that Avocado file now.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20250414113031.151105-5-thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 MAINTAINERS                          |   1 -
 tests/avocado/replay_kernel.py       | 110 ---------------------------
 tests/functional/meson.build         |   1 +
 tests/functional/test_i386_replay.py |  28 +++++++
 4 files changed, 29 insertions(+), 111 deletions(-)
 delete mode 100644 tests/avocado/replay_kernel.py
 create mode 100755 tests/functional/test_i386_replay.py

diff --git a/MAINTAINERS b/MAINTAINERS
index af1d847f8e..42348df9d6 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3669,7 +3669,6 @@ F: include/system/replay.h
 F: docs/devel/replay.rst
 F: docs/system/replay.rst
 F: stubs/replay.c
-F: tests/avocado/replay_kernel.py
 F: tests/avocado/replay_linux.py
 F: tests/functional/*reverse_debug*.py
 F: tests/functional/*replay*.py
diff --git a/tests/avocado/replay_kernel.py b/tests/avocado/replay_kernel.py
deleted file mode 100644
index 3551532372..0000000000
--- a/tests/avocado/replay_kernel.py
+++ /dev/null
@@ -1,110 +0,0 @@
-# Record/replay test that boots a Linux kernel
-#
-# Copyright (c) 2020 ISP RAS
-#
-# Author:
-#  Pavel Dovgalyuk <Pavel.Dovgaluk@ispras.ru>
-#
-# This work is licensed under the terms of the GNU GPL, version 2 or
-# later.  See the COPYING file in the top-level directory.
-
-import os
-import lzma
-import shutil
-import logging
-import time
-import subprocess
-
-from avocado import skip
-from avocado import skipUnless
-from avocado import skipUnless
-from avocado_qemu import wait_for_console_pattern
-from avocado.utils import archive
-from avocado.utils import process
-from boot_linux_console import LinuxKernelTest
-
-class ReplayKernelBase(LinuxKernelTest):
-    """
-    Boots a Linux kernel in record mode and checks that the console
-    is operational and the kernel command line is properly passed
-    from QEMU to the kernel.
-    Then replays the same scenario and verifies, that QEMU correctly
-    terminates.
-    """
-
-    timeout = 180
-    KERNEL_COMMON_COMMAND_LINE = 'printk.time=1 panic=-1 '
-
-    def run_vm(self, kernel_path, kernel_command_line, console_pattern,
-               record, shift, args, replay_path):
-        # icount requires TCG to be available
-        self.require_accelerator('tcg')
-
-        logger = logging.getLogger('replay')
-        start_time = time.time()
-        vm = self.get_vm()
-        vm.set_console()
-        if record:
-            logger.info('recording the execution...')
-            mode = 'record'
-        else:
-            logger.info('replaying the execution...')
-            mode = 'replay'
-        vm.add_args('-icount', 'shift=%s,rr=%s,rrfile=%s' %
-                    (shift, mode, replay_path),
-                    '-kernel', kernel_path,
-                    '-append', kernel_command_line,
-                    '-net', 'none',
-                    '-no-reboot')
-        if args:
-            vm.add_args(*args)
-        vm.launch()
-        self.wait_for_console_pattern(console_pattern, vm)
-        if record:
-            vm.shutdown()
-            logger.info('finished the recording with log size %s bytes'
-                        % os.path.getsize(replay_path))
-            self.run_replay_dump(replay_path)
-            logger.info('successfully tested replay-dump.py')
-        else:
-            vm.wait()
-            logger.info('successfully finished the replay')
-        elapsed = time.time() - start_time
-        logger.info('elapsed time %.2f sec' % elapsed)
-        return elapsed
-
-    def run_replay_dump(self, replay_path):
-        try:
-            subprocess.check_call(["./scripts/replay-dump.py",
-                                   "-f", replay_path],
-                                  stdout=subprocess.DEVNULL)
-        except subprocess.CalledProcessError:
-            self.fail('replay-dump.py failed')
-
-    def run_rr(self, kernel_path, kernel_command_line, console_pattern,
-               shift=7, args=None):
-        replay_path = os.path.join(self.workdir, 'replay.bin')
-        t1 = self.run_vm(kernel_path, kernel_command_line, console_pattern,
-                         True, shift, args, replay_path)
-        t2 = self.run_vm(kernel_path, kernel_command_line, console_pattern,
-                         False, shift, args, replay_path)
-        logger = logging.getLogger('replay')
-        logger.info('replay overhead {:.2%}'.format(t2 / t1 - 1))
-
-class ReplayKernelNormal(ReplayKernelBase):
-
-    def test_i386_pc(self):
-        """
-        :avocado: tags=arch:i386
-        :avocado: tags=machine:pc
-        """
-        kernel_url = ('https://storage.tuxboot.com/20230331/i386/bzImage')
-        kernel_hash = 'a3e5b32a354729e65910f5a1ffcda7c14a6c12a55e8213fb86e277f1b76ed956'
-        kernel_path = self.fetch_asset(kernel_url,
-                                       asset_hash=kernel_hash,
-                                       algorithm = "sha256")
-
-        kernel_command_line = self.KERNEL_COMMON_COMMAND_LINE + 'console=ttyS0'
-        console_pattern = 'VFS: Cannot open root device'
-
-        self.run_rr(kernel_path, kernel_command_line, console_pattern, shift=5)
diff --git a/tests/functional/meson.build b/tests/functional/meson.build
index 7b0f4ab0b1..4113b221de 100644
--- a/tests/functional/meson.build
+++ b/tests/functional/meson.build
@@ -151,6 +151,7 @@ tests_i386_system_quick = [
 ]
 
 tests_i386_system_thorough = [
+  'i386_replay',
   'i386_tuxrun',
 ]
 
diff --git a/tests/functional/test_i386_replay.py b/tests/functional/test_i386_replay.py
new file mode 100755
index 0000000000..7c4c2602da
--- /dev/null
+++ b/tests/functional/test_i386_replay.py
@@ -0,0 +1,28 @@
+#!/usr/bin/env python3
+#
+# Replay test that boots a Linux kernel on a i386 machine
+# and checks the console
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+from qemu_test import Asset
+from replay_kernel import ReplayKernelBase
+
+
+class I386Replay(ReplayKernelBase):
+
+    ASSET_KERNEL = Asset(
+         'https://storage.tuxboot.com/20230331/i386/bzImage',
+        'a3e5b32a354729e65910f5a1ffcda7c14a6c12a55e8213fb86e277f1b76ed956')
+
+    def test_pc(self):
+        self.set_machine('pc')
+        kernel_url = ()
+        kernel_path = self.ASSET_KERNEL.fetch()
+        kernel_command_line = self.KERNEL_COMMON_COMMAND_LINE + 'console=ttyS0'
+        console_pattern = 'VFS: Cannot open root device'
+        self.run_rr(kernel_path, kernel_command_line, console_pattern, shift=5)
+
+
+if __name__ == '__main__':
+    ReplayKernelBase.main()

From 574f71bc1f22640d45a90969805eaaacd38bf859 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Mon, 14 Apr 2025 13:30:19 +0200
Subject: [PATCH 0059/2760] tests/avocado: Remove the LinuxKernelTest class
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

All tests that used this class have been converted to the functional
framework, so we can remove the boot_linux_console.py file now.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20250414113031.151105-6-thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/avocado/boot_linux_console.py | 62 -----------------------------
 1 file changed, 62 deletions(-)
 delete mode 100644 tests/avocado/boot_linux_console.py

diff --git a/tests/avocado/boot_linux_console.py b/tests/avocado/boot_linux_console.py
deleted file mode 100644
index cbb1e2fb50..0000000000
--- a/tests/avocado/boot_linux_console.py
+++ /dev/null
@@ -1,62 +0,0 @@
-# Functional test that boots a Linux kernel and checks the console
-#
-# Copyright (c) 2018 Red Hat, Inc.
-#
-# Author:
-#  Cleber Rosa <crosa@redhat.com>
-#
-# This work is licensed under the terms of the GNU GPL, version 2 or
-# later.  See the COPYING file in the top-level directory.
-
-import os
-import shutil
-
-from avocado_qemu import QemuSystemTest
-from avocado_qemu import wait_for_console_pattern
-from avocado.utils import process
-from avocado.utils import archive
-
-class LinuxKernelTest(QemuSystemTest):
-    KERNEL_COMMON_COMMAND_LINE = 'printk.time=0 '
-
-    def wait_for_console_pattern(self, success_message, vm=None):
-        wait_for_console_pattern(self, success_message,
-                                 failure_message='Kernel panic - not syncing',
-                                 vm=vm)
-
-    def extract_from_deb(self, deb, path):
-        """
-        Extracts a file from a deb package into the test workdir
-
-        :param deb: path to the deb archive
-        :param path: path within the deb archive of the file to be extracted
-        :returns: path of the extracted file
-        """
-        cwd = os.getcwd()
-        os.chdir(self.workdir)
-        file_path = process.run("ar t %s" % deb).stdout_text.split()[2]
-        process.run("ar x %s %s" % (deb, file_path))
-        archive.extract(file_path, self.workdir)
-        os.chdir(cwd)
-        # Return complete path to extracted file.  Because callers to
-        # extract_from_deb() specify 'path' with a leading slash, it is
-        # necessary to use os.path.relpath() as otherwise os.path.join()
-        # interprets it as an absolute path and drops the self.workdir part.
-        return os.path.normpath(os.path.join(self.workdir,
-                                             os.path.relpath(path, '/')))
-
-    def extract_from_rpm(self, rpm, path):
-        """
-        Extracts a file from an RPM package into the test workdir.
-
-        :param rpm: path to the rpm archive
-        :param path: path within the rpm archive of the file to be extracted
-                     needs to be a relative path (starting with './') because
-                     cpio(1), which is used to extract the file, expects that.
-        :returns: path of the extracted file
-        """
-        cwd = os.getcwd()
-        os.chdir(self.workdir)
-        process.run("rpm2cpio %s | cpio -id %s" % (rpm, path), shell=True)
-        os.chdir(cwd)
-        return os.path.normpath(os.path.join(self.workdir, path))

From 42a87f0ce7aaf1923a610cabe4d65f7b1ce9a327 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Mon, 14 Apr 2025 13:30:20 +0200
Subject: [PATCH 0060/2760] tests/functional: Convert the 32-bit big endian
 Wheezy mips test
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The test checks some entries in /proc and the output of some commands ...
we put these checks into exportable functions now so that they can
be reused more easily.

Additionally the linux_ssh_mips_malta.py uses SSH to test the networking
of the guest. Since we don't have a SSH module in the functional
framework yet, let's use the check_http_download() function here instead.

And while we're at it, also switch the NIC to e1000 now to get some more
test coverage, since the "pcnet" device is already tested in the test
test_mips_malta_cpio.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20250414113031.151105-7-thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/avocado/linux_ssh_mips_malta.py |   8 --
 tests/functional/meson.build          |   2 +-
 tests/functional/test_mips_malta.py   | 108 +++++++++++++++++++++++++-
 3 files changed, 107 insertions(+), 11 deletions(-)

diff --git a/tests/avocado/linux_ssh_mips_malta.py b/tests/avocado/linux_ssh_mips_malta.py
index d9bb525ad9..73d294ad5c 100644
--- a/tests/avocado/linux_ssh_mips_malta.py
+++ b/tests/avocado/linux_ssh_mips_malta.py
@@ -172,14 +172,6 @@ class LinuxSSH(QemuSystemTest, LinuxSSHMixIn):
         # Wait for VM to shut down gracefully
         self.vm.wait()
 
-    def test_mips_malta32eb_kernel3_2_0(self):
-        """
-        :avocado: tags=arch:mips
-        :avocado: tags=endian:big
-        :avocado: tags=device:pcnet32
-        """
-        self.check_mips_malta('mips', 'be')
-
     def test_mips_malta32el_kernel3_2_0(self):
         """
         :avocado: tags=arch:mipsel
diff --git a/tests/functional/meson.build b/tests/functional/meson.build
index 4113b221de..4dedfc7b9f 100644
--- a/tests/functional/meson.build
+++ b/tests/functional/meson.build
@@ -39,7 +39,7 @@ test_timeouts = {
   'arm_tuxrun' : 240,
   'arm_sx1' : 360,
   'intel_iommu': 300,
-  'mips_malta' : 120,
+  'mips_malta' : 480,
   'mipsel_replay' : 480,
   'mips64el_replay' : 180,
   'netdev_ethtool' : 180,
diff --git a/tests/functional/test_mips_malta.py b/tests/functional/test_mips_malta.py
index 9697c7d63f..89b9556f30 100755
--- a/tests/functional/test_mips_malta.py
+++ b/tests/functional/test_mips_malta.py
@@ -6,10 +6,93 @@
 #
 # SPDX-License-Identifier: GPL-2.0-or-later
 
-from qemu_test import LinuxKernelTest, Asset
+import os
+
+from qemu_test import LinuxKernelTest, Asset, wait_for_console_pattern
 from qemu_test import exec_command_and_wait_for_pattern
 
 
+def mips_run_common_commands(test, prompt='#'):
+    exec_command_and_wait_for_pattern(test,
+        'uname -m',
+        'mips')
+    exec_command_and_wait_for_pattern(test,
+        'grep XT-PIC /proc/interrupts',
+        'timer')
+    wait_for_console_pattern(test, prompt)
+    exec_command_and_wait_for_pattern(test,
+        'grep XT-PIC /proc/interrupts',
+        'serial')
+    wait_for_console_pattern(test, prompt)
+    exec_command_and_wait_for_pattern(test,
+        'grep XT-PIC /proc/interrupts',
+        'ata_piix')
+    wait_for_console_pattern(test, prompt)
+    exec_command_and_wait_for_pattern(test,
+        'grep XT-PIC /proc/interrupts',
+        'rtc')
+    wait_for_console_pattern(test, prompt)
+    exec_command_and_wait_for_pattern(test,
+        'cat /proc/devices',
+        'input')
+    wait_for_console_pattern(test, prompt)
+    exec_command_and_wait_for_pattern(test,
+        'cat /proc/devices',
+        'fb')
+    wait_for_console_pattern(test, prompt)
+    exec_command_and_wait_for_pattern(test,
+        'cat /proc/ioports',
+        ' : serial')
+    wait_for_console_pattern(test, prompt)
+    exec_command_and_wait_for_pattern(test,
+        'cat /proc/ioports',
+        ' : ata_piix')
+    wait_for_console_pattern(test, prompt)
+
+def mips_check_wheezy(test, kernel_path, image_path, kernel_command_line,
+                      dl_file, hsum, nic='pcnet', cpuinfo='MIPS 24Kc'):
+    test.require_netdev('user')
+    test.require_device(nic)
+    test.set_machine('malta')
+
+    port=8080
+    test.vm.add_args('-kernel', kernel_path,
+                     '-append', kernel_command_line,
+                     '-drive', 'file=%s,snapshot=on' % image_path,
+                     '-netdev', 'user,id=n1' +
+                                ',tftp=' + os.path.basename(kernel_path) +
+                                ',hostfwd=tcp:127.0.0.1:0-:%d' % port,
+                     '-device', f'{nic},netdev=n1',
+                     '-no-reboot')
+    test.vm.set_console()
+    test.vm.launch()
+
+    wait_for_console_pattern(test, 'login: ', 'Oops')
+    exec_command_and_wait_for_pattern(test, 'root', 'Password:')
+    exec_command_and_wait_for_pattern(test, 'root', ':~# ')
+    mips_run_common_commands(test)
+
+    exec_command_and_wait_for_pattern(test, 'cd /', '# ')
+    test.check_http_download(dl_file, hsum, port,
+                             pythoncmd='python -m SimpleHTTPServer')
+
+    exec_command_and_wait_for_pattern(test, 'cat /proc/cpuinfo', cpuinfo)
+    exec_command_and_wait_for_pattern(test, 'cat /proc/devices', 'usb')
+    exec_command_and_wait_for_pattern(test, 'cat /proc/ioports',
+                                      ' : piix4_smbus')
+    # lspci for the host bridge does not work on big endian targets:
+    # https://gitlab.com/qemu-project/qemu/-/issues/2826
+    # exec_command_and_wait_for_pattern(test, 'lspci -d 11ab:4620',
+    #                                   'GT-64120')
+    exec_command_and_wait_for_pattern(test,
+                                      'cat /sys/bus/i2c/devices/i2c-0/name',
+                                      'SMBus PIIX4 adapter')
+    exec_command_and_wait_for_pattern(test, 'cat /proc/mtd', 'YAMON')
+    # Empty 'Board Config' (64KB)
+    exec_command_and_wait_for_pattern(test, 'md5sum /dev/mtd2ro',
+                                      '0dfbe8aa4c20b52e1b8bf3cb6cbdf193')
+
+
 class MaltaMachineConsole(LinuxKernelTest):
 
     ASSET_KERNEL_2_63_2 = Asset(
@@ -70,7 +153,8 @@ class MaltaMachineConsole(LinuxKernelTest):
         exec_command_and_wait_for_pattern(self, 'cat /proc/cpuinfo',
                                                 'BogoMIPS')
         exec_command_and_wait_for_pattern(self, 'uname -a',
-                                                'Debian')
+                                                '4.5.0-2-4kc-malta #1 Debian')
+        mips_run_common_commands(self)
 
         exec_command_and_wait_for_pattern(self, 'ip link set eth0 up',
                                           'eth0: link up')
@@ -89,6 +173,26 @@ class MaltaMachineConsole(LinuxKernelTest):
         # Wait for VM to shut down gracefully
         self.vm.wait()
 
+    ASSET_WHEEZY_KERNEL = Asset(
+        ('https://people.debian.org/~aurel32/qemu/mips/'
+         'vmlinux-3.2.0-4-4kc-malta'),
+        '0377fcda31299213c10b8e5babe7260ef99188b3ae1aca6f56594abb71e7f67e')
+
+    ASSET_WHEEZY_DISK = Asset(
+        ('https://people.debian.org/~aurel32/qemu/mips/'
+         'debian_wheezy_mips_standard.qcow2'),
+        'de03599285b8382ad309309a6c4869f6c6c42a5cfc983342bab9ec0dfa7849a2')
+
+    def test_wheezy(self):
+        kernel_path = self.ASSET_WHEEZY_KERNEL.fetch()
+        image_path = self.ASSET_WHEEZY_DISK.fetch()
+        kernel_command_line = (self.KERNEL_COMMON_COMMAND_LINE
+                               + 'console=ttyS0 root=/dev/sda1')
+        mips_check_wheezy(self,
+            kernel_path, image_path, kernel_command_line, nic='e1000',
+            dl_file='/boot/initrd.img-3.2.0-4-4kc-malta',
+            hsum='ff0c0369143d9bbb9a6e6bc79322a2be535619df639e84103237f406e87493dc')
+
 
 if __name__ == '__main__':
     LinuxKernelTest.main()

From 689a8b56a6f3d16458004006b604950295da87df Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Mon, 14 Apr 2025 13:30:21 +0200
Subject: [PATCH 0061/2760] tests/functional: Convert the 32-bit little endian
 Wheezy mips test
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reuse the test function from the big endian test to easily
convert the 32-bit little endian Wheezy mips test.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20250414113031.151105-8-thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/avocado/linux_ssh_mips_malta.py |  8 --------
 tests/functional/meson.build          |  1 +
 tests/functional/test_mipsel_malta.py | 22 ++++++++++++++++++++++
 3 files changed, 23 insertions(+), 8 deletions(-)

diff --git a/tests/avocado/linux_ssh_mips_malta.py b/tests/avocado/linux_ssh_mips_malta.py
index 73d294ad5c..c1300aec96 100644
--- a/tests/avocado/linux_ssh_mips_malta.py
+++ b/tests/avocado/linux_ssh_mips_malta.py
@@ -172,14 +172,6 @@ class LinuxSSH(QemuSystemTest, LinuxSSHMixIn):
         # Wait for VM to shut down gracefully
         self.vm.wait()
 
-    def test_mips_malta32el_kernel3_2_0(self):
-        """
-        :avocado: tags=arch:mipsel
-        :avocado: tags=endian:little
-        :avocado: tags=device:pcnet32
-        """
-        self.check_mips_malta('mips', 'le')
-
     def test_mips_malta64eb_kernel3_2_0(self):
         """
         :avocado: tags=arch:mips64
diff --git a/tests/functional/meson.build b/tests/functional/meson.build
index 4dedfc7b9f..cba0abf292 100644
--- a/tests/functional/meson.build
+++ b/tests/functional/meson.build
@@ -40,6 +40,7 @@ test_timeouts = {
   'arm_sx1' : 360,
   'intel_iommu': 300,
   'mips_malta' : 480,
+  'mipsel_malta' : 420,
   'mipsel_replay' : 480,
   'mips64el_replay' : 180,
   'netdev_ethtool' : 180,
diff --git a/tests/functional/test_mipsel_malta.py b/tests/functional/test_mipsel_malta.py
index fe9c3a172e..9ee2884da8 100755
--- a/tests/functional/test_mipsel_malta.py
+++ b/tests/functional/test_mipsel_malta.py
@@ -13,6 +13,8 @@ from qemu_test import QemuSystemTest, LinuxKernelTest, Asset
 from qemu_test import interrupt_interactive_console_until_pattern
 from qemu_test import wait_for_console_pattern
 
+from test_mips_malta import mips_check_wheezy
+
 
 class MaltaMachineConsole(LinuxKernelTest):
 
@@ -57,6 +59,26 @@ class MaltaMachineConsole(LinuxKernelTest):
     def test_mips_malta32el_nanomips_64k_dbg(self):
         self.do_test_mips_malta32el_nanomips(self.ASSET_KERNEL_64K)
 
+    ASSET_WHEEZY_KERNEL = Asset(
+        ('https://people.debian.org/~aurel32/qemu/mipsel/'
+         'vmlinux-3.2.0-4-4kc-malta'),
+        'dc8a3648305b0201ca7a5cd135fe2890067a65d93c38728022bb0e656ad2bf9a')
+
+    ASSET_WHEEZY_DISK = Asset(
+        ('https://people.debian.org/~aurel32/qemu/mipsel/'
+         'debian_wheezy_mipsel_standard.qcow2'),
+        '454f09ae39f7e6461c84727b927100d2c7813841f2a0a5dce328114887ecf914')
+
+    def test_wheezy(self):
+        kernel_path = self.ASSET_WHEEZY_KERNEL.fetch()
+        image_path = self.ASSET_WHEEZY_DISK.fetch()
+        kernel_command_line = (self.KERNEL_COMMON_COMMAND_LINE
+                               + 'console=ttyS0 root=/dev/sda1')
+        mips_check_wheezy(self,
+            kernel_path, image_path, kernel_command_line,
+            dl_file='/boot/initrd.img-3.2.0-4-4kc-malta',
+            hsum='9fc9f250ed56a74e35e704ddfd5a1c5a5625adefc5c9da91f649288d3ca000f0')
+
 
 class MaltaMachineYAMON(QemuSystemTest):
 

From 8e3461c3a6fc0b1bce4571e46e861db0b2bcf621 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Mon, 14 Apr 2025 13:30:22 +0200
Subject: [PATCH 0062/2760] tests/functional: Convert the 64-bit little endian
 Wheezy mips test
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reuse the test function from the 32-bit big endian test to easily
convert the 64-bit little endian Wheezy mips test.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20250414113031.151105-9-thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/avocado/linux_ssh_mips_malta.py   |  8 --------
 tests/functional/meson.build            |  1 +
 tests/functional/test_mips64el_malta.py | 22 ++++++++++++++++++++++
 3 files changed, 23 insertions(+), 8 deletions(-)

diff --git a/tests/avocado/linux_ssh_mips_malta.py b/tests/avocado/linux_ssh_mips_malta.py
index c1300aec96..2fa5cf9a6c 100644
--- a/tests/avocado/linux_ssh_mips_malta.py
+++ b/tests/avocado/linux_ssh_mips_malta.py
@@ -179,11 +179,3 @@ class LinuxSSH(QemuSystemTest, LinuxSSHMixIn):
         :avocado: tags=device:pcnet32
         """
         self.check_mips_malta('mips64', 'be')
-
-    def test_mips_malta64el_kernel3_2_0(self):
-        """
-        :avocado: tags=arch:mips64el
-        :avocado: tags=endian:little
-        :avocado: tags=device:pcnet32
-        """
-        self.check_mips_malta('mips64', 'le')
diff --git a/tests/functional/meson.build b/tests/functional/meson.build
index cba0abf292..a4a317115b 100644
--- a/tests/functional/meson.build
+++ b/tests/functional/meson.build
@@ -42,6 +42,7 @@ test_timeouts = {
   'mips_malta' : 480,
   'mipsel_malta' : 420,
   'mipsel_replay' : 480,
+  'mips64el_malta' : 420,
   'mips64el_replay' : 180,
   'netdev_ethtool' : 180,
   'ppc_40p' : 240,
diff --git a/tests/functional/test_mips64el_malta.py b/tests/functional/test_mips64el_malta.py
index a8da15a26b..dd37212f9d 100755
--- a/tests/functional/test_mips64el_malta.py
+++ b/tests/functional/test_mips64el_malta.py
@@ -16,6 +16,8 @@ from qemu_test import LinuxKernelTest, Asset
 from qemu_test import exec_command_and_wait_for_pattern
 from qemu_test import skipIfMissingImports, skipFlakyTest, skipUntrustedTest
 
+from test_mips_malta import mips_check_wheezy
+
 
 class MaltaMachineConsole(LinuxKernelTest):
 
@@ -90,6 +92,26 @@ class MaltaMachineConsole(LinuxKernelTest):
         # Wait for VM to shut down gracefully
         self.vm.wait()
 
+    ASSET_WHEEZY_KERNEL = Asset(
+        ('https://people.debian.org/~aurel32/qemu/mipsel/'
+         'vmlinux-3.2.0-4-5kc-malta'),
+        '5e8b725244c59745bb8b64f5d8f49f25fecfa549f3395fb6d19a3b9e5065b85b')
+
+    ASSET_WHEEZY_DISK = Asset(
+        ('https://people.debian.org/~aurel32/qemu/mipsel/'
+         'debian_wheezy_mipsel_standard.qcow2'),
+        '454f09ae39f7e6461c84727b927100d2c7813841f2a0a5dce328114887ecf914')
+
+    def test_wheezy(self):
+        kernel_path = self.ASSET_WHEEZY_KERNEL.fetch()
+        image_path = self.ASSET_WHEEZY_DISK.fetch()
+        kernel_command_line = (self.KERNEL_COMMON_COMMAND_LINE
+                               + 'console=ttyS0 root=/dev/sda1')
+        mips_check_wheezy(self,
+            kernel_path, image_path, kernel_command_line, cpuinfo='MIPS 20Kc',
+            dl_file='/boot/initrd.img-3.2.0-4-5kc-malta',
+            hsum='7579f8b56c1187c7c04d0dc3c0c56c7a6314c5ddd3a9bf8803ecc7cf8a3be9f8')
+
 
 @skipIfMissingImports('numpy', 'cv2')
 class MaltaMachineFramebuffer(LinuxKernelTest):

From f79592f427d7faabb25d533815d6c3dd4ab9726d Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Mon, 14 Apr 2025 13:30:23 +0200
Subject: [PATCH 0063/2760] tests/functional: Convert the 64-bit big endian
 Wheezy mips test
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reuse the test function from the 32-bit big endian test to easily
convert the 64-bit big endian Wheezy mips test.

Since this was the last test in tests/avocado/linux_ssh_mips_malta.py,
we can remove this avocado file now, too.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20250414113031.151105-10-thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 MAINTAINERS                           |   1 -
 tests/avocado/linux_ssh_mips_malta.py | 181 --------------------------
 tests/functional/meson.build          |   2 +
 tests/functional/test_mips64_malta.py |  35 +++++
 4 files changed, 37 insertions(+), 182 deletions(-)
 delete mode 100644 tests/avocado/linux_ssh_mips_malta.py
 create mode 100755 tests/functional/test_mips64_malta.py

diff --git a/MAINTAINERS b/MAINTAINERS
index 42348df9d6..72f6b208f5 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1355,7 +1355,6 @@ F: hw/acpi/piix4.c
 F: hw/mips/malta.c
 F: hw/pci-host/gt64120.c
 F: include/hw/southbridge/piix.h
-F: tests/avocado/linux_ssh_mips_malta.py
 F: tests/functional/test_mips*_malta.py
 F: tests/functional/test_mips*_tuxrun.py
 
diff --git a/tests/avocado/linux_ssh_mips_malta.py b/tests/avocado/linux_ssh_mips_malta.py
deleted file mode 100644
index 2fa5cf9a6c..0000000000
--- a/tests/avocado/linux_ssh_mips_malta.py
+++ /dev/null
@@ -1,181 +0,0 @@
-# Functional test that boots a VM and run commands via a SSH session
-#
-# Copyright (c) Philippe Mathieu-Daudé <f4bug@amsat.org>
-#
-# This work is licensed under the terms of the GNU GPL, version 2 or
-# later.  See the COPYING file in the top-level directory.
-
-import os
-import re
-import base64
-import logging
-import time
-
-from avocado import skipUnless
-from avocado_qemu import LinuxSSHMixIn
-from avocado_qemu import QemuSystemTest
-from avocado_qemu import wait_for_console_pattern
-from avocado.utils import process
-from avocado.utils import archive
-from avocado.utils import ssh
-
-
-@skipUnless(os.getenv('AVOCADO_TIMEOUT_EXPECTED'), 'Test might timeout')
-@skipUnless(ssh.SSH_CLIENT_BINARY, 'No SSH client available')
-class LinuxSSH(QemuSystemTest, LinuxSSHMixIn):
-    """
-    :avocado: tags=accel:tcg
-    """
-
-    timeout = 150 # Not for 'configure --enable-debug --enable-debug-tcg'
-
-    KERNEL_COMMON_COMMAND_LINE = 'printk.time=0 '
-    VM_IP = '127.0.0.1'
-
-    BASE_URL = 'https://people.debian.org/~aurel32/qemu/'
-    IMAGE_INFO = {
-        'be': {'base_url': 'mips',
-               'image_name': 'debian_wheezy_mips_standard.qcow2',
-               'image_hash': '8987a63270df67345b2135a6b7a4885a35e392d5',
-               'kernel_hash': {
-                   32: '592e384a4edc16dade52a6cd5c785c637bcbc9ad',
-                   64: 'db6eea7de35d36c77d8c165b6bcb222e16eb91db'}
-              },
-        'le': {'base_url': 'mipsel',
-               'image_name': 'debian_wheezy_mipsel_standard.qcow2',
-               'image_hash': '7866764d9de3ef536ffca24c9fb9f04ffdb45802',
-               'kernel_hash': {
-                   32: 'a66bea5a8adaa2cb3d36a1d4e0ccdb01be8f6c2a',
-                   64: '6a7f77245acf231415a0e8b725d91ed2f3487794'}
-              }
-        }
-    CPU_INFO = {
-        32: {'cpu': 'MIPS 24Kc', 'kernel_release': '3.2.0-4-4kc-malta'},
-        64: {'cpu': 'MIPS 20Kc', 'kernel_release': '3.2.0-4-5kc-malta'}
-        }
-
-    def get_url(self, endianess, path=''):
-        qkey = {'le': 'el', 'be': ''}
-        return '%s/mips%s/%s' % (self.BASE_URL, qkey[endianess], path)
-
-    def get_image_info(self, endianess):
-        dinfo = self.IMAGE_INFO[endianess]
-        image_url = self.get_url(endianess, dinfo['image_name'])
-        image_hash = dinfo['image_hash']
-        return (image_url, image_hash)
-
-    def get_kernel_info(self, endianess, wordsize):
-        minfo = self.CPU_INFO[wordsize]
-        kernel_url = self.get_url(endianess,
-                                  'vmlinux-%s' % minfo['kernel_release'])
-        kernel_hash = self.IMAGE_INFO[endianess]['kernel_hash'][wordsize]
-        return kernel_url, kernel_hash
-
-    def ssh_disconnect_vm(self):
-        self.ssh_session.quit()
-
-    def boot_debian_wheezy_image_and_ssh_login(self, endianess, kernel_path):
-        image_url, image_hash = self.get_image_info(endianess)
-        image_path = self.fetch_asset(image_url, asset_hash=image_hash)
-
-        self.vm.set_console()
-        kernel_command_line = (self.KERNEL_COMMON_COMMAND_LINE
-                               + 'console=ttyS0 root=/dev/sda1')
-        self.vm.add_args('-no-reboot',
-                         '-kernel', kernel_path,
-                         '-append', kernel_command_line,
-                         '-drive', 'file=%s,snapshot=on' % image_path,
-                         '-netdev', 'user,id=vnet,hostfwd=:127.0.0.1:0-:22',
-                         '-device', 'pcnet,netdev=vnet')
-        self.vm.launch()
-
-        self.log.info('VM launched, waiting for sshd')
-        console_pattern = 'Starting OpenBSD Secure Shell server: sshd'
-        wait_for_console_pattern(self, console_pattern, 'Oops')
-        self.log.info('sshd ready')
-
-        self.ssh_connect('root', 'root', False)
-
-    def shutdown_via_ssh(self):
-        self.ssh_command('poweroff')
-        self.ssh_disconnect_vm()
-        wait_for_console_pattern(self, 'Power down', 'Oops')
-
-    def run_common_commands(self, wordsize):
-        self.ssh_command_output_contains(
-            'cat /proc/cpuinfo',
-            self.CPU_INFO[wordsize]['cpu'])
-        self.ssh_command_output_contains(
-            'uname -m',
-            'mips')
-        self.ssh_command_output_contains(
-            'uname -r',
-            self.CPU_INFO[wordsize]['kernel_release'])
-        self.ssh_command_output_contains(
-            'cat /proc/interrupts',
-            'XT-PIC  timer')
-        self.ssh_command_output_contains(
-            'cat /proc/interrupts',
-            'XT-PIC  i8042')
-        self.ssh_command_output_contains(
-            'cat /proc/interrupts',
-            'XT-PIC  serial')
-        self.ssh_command_output_contains(
-            'cat /proc/interrupts',
-            'XT-PIC  ata_piix')
-        self.ssh_command_output_contains(
-            'cat /proc/interrupts',
-            'XT-PIC  eth0')
-        self.ssh_command_output_contains(
-            'cat /proc/devices',
-            'input')
-        self.ssh_command_output_contains(
-            'cat /proc/devices',
-            'usb')
-        self.ssh_command_output_contains(
-            'cat /proc/devices',
-            'fb')
-        self.ssh_command_output_contains(
-            'cat /proc/ioports',
-            ' : serial')
-        self.ssh_command_output_contains(
-            'cat /proc/ioports',
-            ' : ata_piix')
-        self.ssh_command_output_contains(
-            'cat /proc/ioports',
-            ' : piix4_smbus')
-        self.ssh_command_output_contains(
-            'lspci -d 11ab:4620',
-            'GT-64120')
-        self.ssh_command_output_contains(
-            'cat /sys/bus/i2c/devices/i2c-0/name',
-            'SMBus PIIX4 adapter')
-        self.ssh_command_output_contains(
-            'cat /proc/mtd',
-            'YAMON')
-        # Empty 'Board Config' (64KB)
-        self.ssh_command_output_contains(
-            'md5sum /dev/mtd2ro',
-            '0dfbe8aa4c20b52e1b8bf3cb6cbdf193')
-
-    def check_mips_malta(self, uname_m, endianess):
-        wordsize = 64 if '64' in uname_m else 32
-        kernel_url, kernel_hash = self.get_kernel_info(endianess, wordsize)
-        kernel_path = self.fetch_asset(kernel_url, asset_hash=kernel_hash)
-        self.boot_debian_wheezy_image_and_ssh_login(endianess, kernel_path)
-
-        stdout, _ = self.ssh_command('uname -a')
-        self.assertIn(True, [uname_m + " GNU/Linux" in line for line in stdout])
-
-        self.run_common_commands(wordsize)
-        self.shutdown_via_ssh()
-        # Wait for VM to shut down gracefully
-        self.vm.wait()
-
-    def test_mips_malta64eb_kernel3_2_0(self):
-        """
-        :avocado: tags=arch:mips64
-        :avocado: tags=endian:big
-        :avocado: tags=device:pcnet32
-        """
-        self.check_mips_malta('mips64', 'be')
diff --git a/tests/functional/meson.build b/tests/functional/meson.build
index a4a317115b..985ac5c27f 100644
--- a/tests/functional/meson.build
+++ b/tests/functional/meson.build
@@ -42,6 +42,7 @@ test_timeouts = {
   'mips_malta' : 480,
   'mipsel_malta' : 420,
   'mipsel_replay' : 480,
+  'mips64_malta' : 240,
   'mips64el_malta' : 420,
   'mips64el_replay' : 180,
   'netdev_ethtool' : 180,
@@ -191,6 +192,7 @@ tests_mipsel_system_thorough = [
 ]
 
 tests_mips64_system_thorough = [
+  'mips64_malta',
   'mips64_tuxrun',
 ]
 
diff --git a/tests/functional/test_mips64_malta.py b/tests/functional/test_mips64_malta.py
new file mode 100755
index 0000000000..53c3e0c122
--- /dev/null
+++ b/tests/functional/test_mips64_malta.py
@@ -0,0 +1,35 @@
+#!/usr/bin/env python3
+#
+# Functional tests for the big-endian 64-bit MIPS Malta board
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+from qemu_test import LinuxKernelTest, Asset
+from test_mips_malta import mips_check_wheezy
+
+
+class MaltaMachineConsole(LinuxKernelTest):
+
+    ASSET_WHEEZY_KERNEL = Asset(
+        ('https://people.debian.org/~aurel32/qemu/mips/'
+         'vmlinux-3.2.0-4-5kc-malta'),
+        '3e4ec154db080b3f1839f04dde83120654a33e5e1716863de576c47cb94f68f6')
+
+    ASSET_WHEEZY_DISK = Asset(
+        ('https://people.debian.org/~aurel32/qemu/mips/'
+         'debian_wheezy_mips_standard.qcow2'),
+        'de03599285b8382ad309309a6c4869f6c6c42a5cfc983342bab9ec0dfa7849a2')
+
+    def test_wheezy(self):
+        kernel_path = self.ASSET_WHEEZY_KERNEL.fetch()
+        image_path = self.ASSET_WHEEZY_DISK.fetch()
+        kernel_command_line = (self.KERNEL_COMMON_COMMAND_LINE
+                               + 'console=ttyS0 root=/dev/sda1')
+        mips_check_wheezy(self,
+            kernel_path, image_path, kernel_command_line, cpuinfo='MIPS 20Kc',
+            dl_file='/boot/initrd.img-3.2.0-4-5kc-malta',
+            hsum='d98b953bb4a41c0fc0fd8d19bbc691c08989ac52568c1d3054d92dfd890d3f06')
+
+
+if __name__ == '__main__':
+    LinuxKernelTest.main()

From e83aee9c6a0f169e8c5d9387f2429ec8f539dda9 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Mon, 14 Apr 2025 13:30:24 +0200
Subject: [PATCH 0064/2760] tests/avocado: Remove the boot_linux.py tests
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

These tests are based on the cloudinit functions from Avocado.
The cloudinit is very, very slow compared to our other tests,
so most of these Avocado tests have either been disabled by default
with a decorator, or have been marked to only run with KVM.

We won't include this sluggish cloudinit stuff in the functional
framework, and we've already got plenty of other tests there that
check pretty much the same things, so let's simply get rid of these
old tests now.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20250414113031.151105-11-thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/avocado/boot_linux.py | 132 ------------------------------------
 1 file changed, 132 deletions(-)
 delete mode 100644 tests/avocado/boot_linux.py

diff --git a/tests/avocado/boot_linux.py b/tests/avocado/boot_linux.py
deleted file mode 100644
index a029ef4ad1..0000000000
--- a/tests/avocado/boot_linux.py
+++ /dev/null
@@ -1,132 +0,0 @@
-# Functional test that boots a complete Linux system via a cloud image
-#
-# Copyright (c) 2018-2020 Red Hat, Inc.
-#
-# Author:
-#  Cleber Rosa <crosa@redhat.com>
-#
-# This work is licensed under the terms of the GNU GPL, version 2 or
-# later.  See the COPYING file in the top-level directory.
-
-import os
-
-from avocado_qemu.linuxtest import LinuxTest
-from avocado_qemu import BUILD_DIR
-
-from avocado import skipUnless
-
-
-class BootLinuxX8664(LinuxTest):
-    """
-    :avocado: tags=arch:x86_64
-    """
-    timeout = 480
-
-    def test_pc_i440fx_tcg(self):
-        """
-        :avocado: tags=machine:pc
-        :avocado: tags=accel:tcg
-        """
-        self.require_accelerator("tcg")
-        self.vm.add_args("-accel", "tcg")
-        self.launch_and_wait(set_up_ssh_connection=False)
-
-    def test_pc_i440fx_kvm(self):
-        """
-        :avocado: tags=machine:pc
-        :avocado: tags=accel:kvm
-        """
-        self.require_accelerator("kvm")
-        self.vm.add_args("-accel", "kvm")
-        self.launch_and_wait(set_up_ssh_connection=False)
-
-    def test_pc_q35_tcg(self):
-        """
-        :avocado: tags=machine:q35
-        :avocado: tags=accel:tcg
-        """
-        self.require_accelerator("tcg")
-        self.vm.add_args("-accel", "tcg")
-        self.launch_and_wait(set_up_ssh_connection=False)
-
-    def test_pc_q35_kvm(self):
-        """
-        :avocado: tags=machine:q35
-        :avocado: tags=accel:kvm
-        """
-        self.require_accelerator("kvm")
-        self.vm.add_args("-accel", "kvm")
-        self.launch_and_wait(set_up_ssh_connection=False)
-
-
-# For Aarch64 we only boot KVM tests in CI as booting the current
-# Fedora OS in TCG tests is very heavyweight. There are lighter weight
-# distros which we use in the machine_aarch64_virt.py tests.
-class BootLinuxAarch64(LinuxTest):
-    """
-    :avocado: tags=arch:aarch64
-    :avocado: tags=machine:virt
-    """
-    timeout = 720
-
-    def test_virt_kvm(self):
-        """
-        :avocado: tags=accel:kvm
-        :avocado: tags=cpu:host
-        """
-        self.require_accelerator("kvm")
-        self.vm.add_args("-accel", "kvm")
-        self.vm.add_args("-machine", "virt,gic-version=host")
-        self.vm.add_args('-bios',
-                         os.path.join(BUILD_DIR, 'pc-bios',
-                                      'edk2-aarch64-code.fd'))
-        self.vm.add_args('-device', 'virtio-rng-pci,rng=rng0')
-        self.vm.add_args('-object', 'rng-random,id=rng0,filename=/dev/urandom')
-        self.launch_and_wait(set_up_ssh_connection=False)
-
-
-# See the tux_baseline.py tests for almost the same coverage in a lot
-# less time.
-class BootLinuxPPC64(LinuxTest):
-    """
-    :avocado: tags=arch:ppc64
-    """
-
-    timeout = 360
-
-    @skipUnless(os.getenv('SPEED') == 'slow', 'runtime limited')
-    def test_pseries_tcg(self):
-        """
-        :avocado: tags=machine:pseries
-        :avocado: tags=accel:tcg
-        """
-        self.require_accelerator("tcg")
-        self.vm.add_args("-accel", "tcg")
-        self.launch_and_wait(set_up_ssh_connection=False)
-
-    def test_pseries_kvm(self):
-        """
-        :avocado: tags=machine:pseries
-        :avocado: tags=accel:kvm
-        """
-        self.require_accelerator("kvm")
-        self.vm.add_args("-accel", "kvm")
-        self.vm.add_args("-machine", "cap-ccf-assist=off")
-        self.launch_and_wait(set_up_ssh_connection=False)
-
-class BootLinuxS390X(LinuxTest):
-    """
-    :avocado: tags=arch:s390x
-    """
-
-    timeout = 240
-
-    @skipUnless(os.getenv('SPEED') == 'slow', 'runtime limited')
-    def test_s390_ccw_virtio_tcg(self):
-        """
-        :avocado: tags=machine:s390-ccw-virtio
-        :avocado: tags=accel:tcg
-        """
-        self.require_accelerator("tcg")
-        self.vm.add_args("-accel", "tcg")
-        self.launch_and_wait(set_up_ssh_connection=False)

From 7fecdb0acd99fa838bb461c67164f6119ec1a3bb Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Mon, 14 Apr 2025 13:30:25 +0200
Subject: [PATCH 0065/2760] tests/functional: Use the tuxrun kernel for the x86
 replay test
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This way we can do a full boot in record-replay mode and
should get a similar test coverage compared to the old
replay test from tests/avocado/replay_linux.py. Thus remove
the x86 avocado replay_linux test now.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20250414113031.151105-12-thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/avocado/replay_linux.py          | 46 --------------------------
 tests/functional/test_x86_64_replay.py | 43 ++++++++++++++++++------
 2 files changed, 33 insertions(+), 56 deletions(-)

diff --git a/tests/avocado/replay_linux.py b/tests/avocado/replay_linux.py
index 5916922435..6ba283d3bf 100644
--- a/tests/avocado/replay_linux.py
+++ b/tests/avocado/replay_linux.py
@@ -118,52 +118,6 @@ class ReplayLinux(LinuxTest):
         except subprocess.CalledProcessError:
             self.fail('replay-dump.py failed')
 
-@skipUnless(os.getenv('AVOCADO_TIMEOUT_EXPECTED'), 'Test might timeout')
-class ReplayLinuxX8664(ReplayLinux):
-    """
-    :avocado: tags=arch:x86_64
-    :avocado: tags=accel:tcg
-    """
-
-    chksum = 'e3c1b309d9203604922d6e255c2c5d098a309c2d46215d8fc026954f3c5c27a0'
-
-    def test_pc_i440fx(self):
-        """
-        :avocado: tags=machine:pc
-        """
-        self.run_rr(shift=1)
-
-    def test_pc_q35(self):
-        """
-        :avocado: tags=machine:q35
-        """
-        self.run_rr(shift=3)
-
-@skipUnless(os.getenv('AVOCADO_TIMEOUT_EXPECTED'), 'Test might timeout')
-class ReplayLinuxX8664Virtio(ReplayLinux):
-    """
-    :avocado: tags=arch:x86_64
-    :avocado: tags=virtio
-    :avocado: tags=accel:tcg
-    """
-
-    hdd = 'virtio-blk-pci'
-    cd = 'virtio-blk-pci'
-    bus = None
-
-    chksum = 'e3c1b309d9203604922d6e255c2c5d098a309c2d46215d8fc026954f3c5c27a0'
-
-    def test_pc_i440fx(self):
-        """
-        :avocado: tags=machine:pc
-        """
-        self.run_rr(shift=1)
-
-    def test_pc_q35(self):
-        """
-        :avocado: tags=machine:q35
-        """
-        self.run_rr(shift=3)
 
 @skipUnless(os.getenv('AVOCADO_TIMEOUT_EXPECTED'), 'Test might timeout')
 class ReplayLinuxAarch64(ReplayLinux):
diff --git a/tests/functional/test_x86_64_replay.py b/tests/functional/test_x86_64_replay.py
index 180f23a60c..27287d452d 100755
--- a/tests/functional/test_x86_64_replay.py
+++ b/tests/functional/test_x86_64_replay.py
@@ -5,30 +5,53 @@
 #
 # SPDX-License-Identifier: GPL-2.0-or-later
 
-from qemu_test import Asset, skipFlakyTest
+from subprocess import check_call, DEVNULL
+
+from qemu_test import Asset, skipFlakyTest, get_qemu_img
 from replay_kernel import ReplayKernelBase
 
 
 class X86Replay(ReplayKernelBase):
 
     ASSET_KERNEL = Asset(
-         ('https://archives.fedoraproject.org/pub/archive/fedora/linux'
-          '/releases/29/Everything/x86_64/os/images/pxeboot/vmlinuz'),
-        '8f237d84712b1b411baf3af2aeaaee10b9aae8e345ec265b87ab3a39639eb143')
+        'https://storage.tuxboot.com/buildroot/20241119/x86_64/bzImage',
+        'f57bfc6553bcd6e0a54aab86095bf642b33b5571d14e3af1731b18c87ed5aef8')
 
-    def do_test_x86(self, machine):
+    ASSET_ROOTFS = Asset(
+        'https://storage.tuxboot.com/buildroot/20241119/x86_64/rootfs.ext4.zst',
+        '4b8b2a99117519c5290e1202cb36eb6c7aaba92b357b5160f5970cf5fb78a751')
+
+    def do_test_x86(self, machine, blkdevice, devroot):
+        self.require_netdev('user')
         self.set_machine(machine)
+        self.cpu="Nehalem"
         kernel_path = self.ASSET_KERNEL.fetch()
-        kernel_command_line = self.KERNEL_COMMON_COMMAND_LINE + 'console=ttyS0'
-        console_pattern = 'VFS: Cannot open root device'
-        self.run_rr(kernel_path, kernel_command_line, console_pattern, shift=5)
+
+        raw_disk = self.uncompress(self.ASSET_ROOTFS)
+        disk = self.scratch_file('scratch.qcow2')
+        qemu_img = get_qemu_img(self)
+        check_call([qemu_img, 'create', '-f', 'qcow2', '-b', raw_disk,
+                    '-F', 'raw', disk], stdout=DEVNULL, stderr=DEVNULL)
+
+        args = ('-drive', 'file=%s,snapshot=on,id=hd0,if=none' % disk,
+                '-drive', 'driver=blkreplay,id=hd0-rr,if=none,image=hd0',
+                '-device', '%s,drive=hd0-rr' % blkdevice,
+                '-netdev', 'user,id=vnet,hostfwd=:127.0.0.1:0-:22',
+                '-device', 'virtio-net,netdev=vnet',
+                '-object', 'filter-replay,id=replay,netdev=vnet')
+
+        kernel_command_line = (self.KERNEL_COMMON_COMMAND_LINE +
+                               f"console=ttyS0 root=/dev/{devroot}")
+        console_pattern = 'Welcome to TuxTest'
+        self.run_rr(kernel_path, kernel_command_line, console_pattern, shift=5,
+                    args=args)
 
     @skipFlakyTest('https://gitlab.com/qemu-project/qemu/-/issues/2094')
     def test_pc(self):
-        self.do_test_x86('pc')
+        self.do_test_x86('pc', 'virtio-blk', 'vda')
 
     def test_q35(self):
-        self.do_test_x86('q35')
+        self.do_test_x86('q35', 'ide-hd', 'sda')
 
 
 if __name__ == '__main__':

From a820caf8444c963faf69228e4a0a0d4673c24ab5 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Mon, 14 Apr 2025 13:30:26 +0200
Subject: [PATCH 0066/2760] tests/functional: Use the tuxrun kernel for the
 aarch64 replay test
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This way we can do a full boot in record-replay mode and
should get a similar test coverage compared to the old
replay test from tests/avocado/replay_linux.py.

Since the aarch64 test was the last avocado test in the
tests/avocado/replay_linux.py file, we can remove this
file now completely.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250414113031.151105-13-thuth@redhat.com>
---
 MAINTAINERS                             |   1 -
 tests/avocado/replay_linux.py           | 160 ------------------------
 tests/functional/test_aarch64_replay.py |  37 ++++--
 3 files changed, 29 insertions(+), 169 deletions(-)
 delete mode 100644 tests/avocado/replay_linux.py

diff --git a/MAINTAINERS b/MAINTAINERS
index 72f6b208f5..e29910cbd7 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3668,7 +3668,6 @@ F: include/system/replay.h
 F: docs/devel/replay.rst
 F: docs/system/replay.rst
 F: stubs/replay.c
-F: tests/avocado/replay_linux.py
 F: tests/functional/*reverse_debug*.py
 F: tests/functional/*replay*.py
 F: qapi/replay.json
diff --git a/tests/avocado/replay_linux.py b/tests/avocado/replay_linux.py
deleted file mode 100644
index 6ba283d3bf..0000000000
--- a/tests/avocado/replay_linux.py
+++ /dev/null
@@ -1,160 +0,0 @@
-# Record/replay test that boots a complete Linux system via a cloud image
-#
-# Copyright (c) 2020 ISP RAS
-#
-# Author:
-#  Pavel Dovgalyuk <Pavel.Dovgaluk@ispras.ru>
-#
-# This work is licensed under the terms of the GNU GPL, version 2 or
-# later.  See the COPYING file in the top-level directory.
-
-import os
-import logging
-import time
-
-from avocado import skipUnless
-from avocado_qemu import BUILD_DIR
-from avocado.utils import cloudinit
-from avocado.utils import network
-from avocado.utils import vmimage
-from avocado.utils import datadrainer
-from avocado.utils.path import find_command
-from avocado_qemu.linuxtest import LinuxTest
-
-class ReplayLinux(LinuxTest):
-    """
-    Boots a Linux system, checking for a successful initialization
-    """
-
-    timeout = 1800
-    chksum = None
-    hdd = 'ide-hd'
-    cd = 'ide-cd'
-    bus = 'ide'
-
-    def setUp(self):
-        # LinuxTest does many replay-incompatible things, but includes
-        # useful methods. Do not setup LinuxTest here and just
-        # call some functions.
-        super(LinuxTest, self).setUp()
-        self._set_distro()
-        self.boot_path = self.download_boot()
-        self.phone_server = cloudinit.PhoneHomeServer(('0.0.0.0', 0),
-                                                      self.name)
-        ssh_pubkey, self.ssh_key = self.set_up_existing_ssh_keys()
-        self.cloudinit_path = self.prepare_cloudinit(ssh_pubkey)
-
-    def vm_add_disk(self, vm, path, id, device):
-        bus_string = ''
-        if self.bus:
-            bus_string = ',bus=%s.%d' % (self.bus, id,)
-        vm.add_args('-drive', 'file=%s,snapshot=on,id=disk%s,if=none' % (path, id))
-        vm.add_args('-drive',
-            'driver=blkreplay,id=disk%s-rr,if=none,image=disk%s' % (id, id))
-        vm.add_args('-device',
-            '%s,drive=disk%s-rr%s' % (device, id, bus_string))
-
-    def vm_add_cdrom(self, vm, path, id, device):
-        vm.add_args('-drive', 'file=%s,id=disk%s,if=none,media=cdrom' % (path, id))
-
-    def launch_and_wait(self, record, args, shift):
-        self.require_netdev('user')
-        vm = self.get_vm()
-        vm.add_args('-smp', '1')
-        vm.add_args('-m', '1024')
-        vm.add_args('-netdev', 'user,id=vnet,hostfwd=:127.0.0.1:0-:22',
-                    '-device', 'virtio-net,netdev=vnet')
-        vm.add_args('-object', 'filter-replay,id=replay,netdev=vnet')
-        if args:
-            vm.add_args(*args)
-        self.vm_add_disk(vm, self.boot_path, 0, self.hdd)
-        self.vm_add_cdrom(vm, self.cloudinit_path, 1, self.cd)
-        logger = logging.getLogger('replay')
-        if record:
-            logger.info('recording the execution...')
-            mode = 'record'
-        else:
-            logger.info('replaying the execution...')
-            mode = 'replay'
-        replay_path = os.path.join(self.workdir, 'replay.bin')
-        vm.add_args('-icount', 'shift=%s,rr=%s,rrfile=%s' %
-                    (shift, mode, replay_path))
-
-        start_time = time.time()
-
-        vm.set_console()
-        vm.launch()
-        console_drainer = datadrainer.LineLogger(vm.console_socket.fileno(),
-                                    logger=self.log.getChild('console'),
-                                    stop_check=(lambda : not vm.is_running()))
-        console_drainer.start()
-        if record:
-            while not self.phone_server.instance_phoned_back:
-                self.phone_server.handle_request()
-            vm.shutdown()
-            logger.info('finished the recording with log size %s bytes'
-                % os.path.getsize(replay_path))
-            self.run_replay_dump(replay_path)
-            logger.info('successfully tested replay-dump.py')
-        else:
-            vm.event_wait('SHUTDOWN', self.timeout)
-            vm.wait()
-            logger.info('successfully finished the replay')
-        elapsed = time.time() - start_time
-        logger.info('elapsed time %.2f sec' % elapsed)
-        return elapsed
-
-    def run_rr(self, args=None, shift=7):
-        t1 = self.launch_and_wait(True, args, shift)
-        t2 = self.launch_and_wait(False, args, shift)
-        logger = logging.getLogger('replay')
-        logger.info('replay overhead {:.2%}'.format(t2 / t1 - 1))
-
-    def run_replay_dump(self, replay_path):
-        try:
-            subprocess.check_call(["./scripts/replay-dump.py",
-                                   "-f", replay_path],
-                                  stdout=subprocess.DEVNULL)
-        except subprocess.CalledProcessError:
-            self.fail('replay-dump.py failed')
-
-
-@skipUnless(os.getenv('AVOCADO_TIMEOUT_EXPECTED'), 'Test might timeout')
-class ReplayLinuxAarch64(ReplayLinux):
-    """
-    :avocado: tags=accel:tcg
-    :avocado: tags=arch:aarch64
-    :avocado: tags=machine:virt
-    :avocado: tags=cpu:max
-    """
-
-    chksum = '1e18d9c0cf734940c4b5d5ec592facaed2af0ad0329383d5639c997fdf16fe49'
-
-    hdd = 'virtio-blk-device'
-    cd = 'virtio-blk-device'
-    bus = None
-
-    def get_common_args(self):
-        return ('-bios',
-                os.path.join(BUILD_DIR, 'pc-bios', 'edk2-aarch64-code.fd'),
-                "-cpu", "max,lpa2=off",
-                '-device', 'virtio-rng-pci,rng=rng0',
-                '-object', 'rng-builtin,id=rng0')
-
-    def test_virt_gicv2(self):
-        """
-        :avocado: tags=machine:gic-version=2
-        """
-
-        self.run_rr(shift=3,
-                    args=(*self.get_common_args(),
-                          "-machine", "virt,gic-version=2"))
-
-    def test_virt_gicv3(self):
-        """
-        :avocado: tags=machine:gic-version=3
-        """
-
-        self.run_rr(shift=3,
-                    args=(*self.get_common_args(),
-                          "-machine", "virt,gic-version=3"))
diff --git a/tests/functional/test_aarch64_replay.py b/tests/functional/test_aarch64_replay.py
index bd6609d914..db12e76603 100755
--- a/tests/functional/test_aarch64_replay.py
+++ b/tests/functional/test_aarch64_replay.py
@@ -5,25 +5,46 @@
 #
 # SPDX-License-Identifier: GPL-2.0-or-later
 
-from qemu_test import Asset, skipIfOperatingSystem
+from subprocess import check_call, DEVNULL
+
+from qemu_test import Asset, skipIfOperatingSystem, get_qemu_img
 from replay_kernel import ReplayKernelBase
 
 
 class Aarch64Replay(ReplayKernelBase):
 
     ASSET_KERNEL = Asset(
-        ('https://archives.fedoraproject.org/pub/archive/fedora/linux/'
-         'releases/29/Everything/aarch64/os/images/pxeboot/vmlinuz'),
-        '7e1430b81c26bdd0da025eeb8fbd77b5dc961da4364af26e771bd39f379cbbf7')
+        'https://storage.tuxboot.com/buildroot/20241119/arm64/Image',
+        'b74743c5e89e1cea0f73368d24ae0ae85c5204ff84be3b5e9610417417d2f235')
+
+    ASSET_ROOTFS = Asset(
+        'https://storage.tuxboot.com/buildroot/20241119/arm64/rootfs.ext4.zst',
+        'a1acaaae2068df4648d04ff75f532aaa8c5edcd6b936122b6f0db4848a07b465')
 
     def test_aarch64_virt(self):
+        self.require_netdev('user')
         self.set_machine('virt')
-        self.cpu = 'cortex-a53'
+        self.cpu = 'cortex-a57'
         kernel_path = self.ASSET_KERNEL.fetch()
+
+        raw_disk = self.uncompress(self.ASSET_ROOTFS)
+        disk = self.scratch_file('scratch.qcow2')
+        qemu_img = get_qemu_img(self)
+        check_call([qemu_img, 'create', '-f', 'qcow2', '-b', raw_disk,
+                    '-F', 'raw', disk], stdout=DEVNULL, stderr=DEVNULL)
+
+        args = ('-drive', 'file=%s,snapshot=on,id=hd0,if=none' % disk,
+                '-drive', 'driver=blkreplay,id=hd0-rr,if=none,image=hd0',
+                '-device', 'virtio-blk-device,drive=hd0-rr',
+                '-netdev', 'user,id=vnet,hostfwd=:127.0.0.1:0-:22',
+                '-device', 'virtio-net,netdev=vnet',
+                '-object', 'filter-replay,id=replay,netdev=vnet')
+
         kernel_command_line = (self.KERNEL_COMMON_COMMAND_LINE +
-                               'console=ttyAMA0')
-        console_pattern = 'VFS: Cannot open root device'
-        self.run_rr(kernel_path, kernel_command_line, console_pattern)
+                               'console=ttyAMA0 root=/dev/vda')
+        console_pattern = 'Welcome to TuxTest'
+        self.run_rr(kernel_path, kernel_command_line, console_pattern,
+                    args=args)
 
 
 if __name__ == '__main__':

From 5c2bae2155b162f7355ca759881c5fdaaf7bc209 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Mon, 14 Apr 2025 13:30:27 +0200
Subject: [PATCH 0067/2760] tests/functional: Convert the SMMU test to the
 functional framework

This test was using cloudinit and a "dnf install" command in the guest
to exercise the NIC with SMMU enabled. Since we don't have the cloudinit
stuff in the functional framework and we should not rely on having access
to external networks (once our ASSETs have been cached), we rather boot
into the initrd first, manually mount the root disk and then use the
check_http_download() function from the functional framework here instead
for testing whether the network works as expected.

Unfortunately, there seems to be a small race when using the files
from Fedora 33: To enter the initrd shell, we have to send a "return"
once. But it does not seem to work if we send it too early. Using a
sleep(0.2) makes it work reliably for me, but to make it even more
unlikely to trigger this situation, let's better limit the Fedora 33
tests to only run with KVM.

Finally, while we're at it, we also add some lines for testing writes
to the hard disk, as we already do it in the test_intel_iommu test.

Reviewed-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Eric Auger <eric.auger@redhat.com>
Message-ID: <20250414113031.151105-14-thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 MAINTAINERS                           |   2 +-
 tests/avocado/smmu.py                 | 139 -----------------
 tests/functional/meson.build          |   2 +
 tests/functional/test_aarch64_smmu.py | 205 ++++++++++++++++++++++++++
 4 files changed, 208 insertions(+), 140 deletions(-)
 delete mode 100644 tests/avocado/smmu.py
 create mode 100755 tests/functional/test_aarch64_smmu.py

diff --git a/MAINTAINERS b/MAINTAINERS
index e29910cbd7..07f77c048e 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -211,7 +211,7 @@ L: qemu-arm@nongnu.org
 S: Maintained
 F: hw/arm/smmu*
 F: include/hw/arm/smmu*
-F: tests/avocado/smmu.py
+F: tests/functional/test_aarch64_smmu.py
 
 AVR TCG CPUs
 M: Michael Rolnik <mrolnik@gmail.com>
diff --git a/tests/avocado/smmu.py b/tests/avocado/smmu.py
deleted file mode 100644
index 83fd79e922..0000000000
--- a/tests/avocado/smmu.py
+++ /dev/null
@@ -1,139 +0,0 @@
-# SMMUv3 Functional tests
-#
-# Copyright (c) 2021 Red Hat, Inc.
-#
-# Author:
-#  Eric Auger <eric.auger@redhat.com>
-#
-# This work is licensed under the terms of the GNU GPL, version 2 or
-# later.  See the COPYING file in the top-level directory.
-import os
-
-from avocado import skipUnless
-from avocado_qemu import BUILD_DIR
-from avocado_qemu.linuxtest import LinuxTest
-
-@skipUnless(os.getenv('QEMU_TEST_FLAKY_TESTS'), 'Test is unstable on GitLab')
-class SMMU(LinuxTest):
-    """
-    :avocado: tags=accel:kvm
-    :avocado: tags=cpu:host
-    :avocado: tags=arch:aarch64
-    :avocado: tags=machine:virt
-    :avocado: tags=distro:fedora
-    :avocado: tags=smmu
-    :avocado: tags=flaky
-    """
-
-    IOMMU_ADDON = ',iommu_platform=on,disable-modern=off,disable-legacy=on'
-    kernel_path = None
-    initrd_path = None
-    kernel_params = None
-
-    def set_up_boot(self):
-        path = self.download_boot()
-        self.vm.add_args('-device', 'virtio-blk-pci,bus=pcie.0,' +
-                         'drive=drv0,id=virtio-disk0,bootindex=1,'
-                         'werror=stop,rerror=stop' + self.IOMMU_ADDON)
-        self.vm.add_args('-drive',
-                         'file=%s,if=none,cache=writethrough,id=drv0' % path)
-
-    def setUp(self):
-        super(SMMU, self).setUp(None, 'virtio-net-pci' + self.IOMMU_ADDON)
-
-    def common_vm_setup(self, custom_kernel=False):
-        self.require_accelerator("kvm")
-        self.vm.add_args("-accel", "kvm")
-        self.vm.add_args("-cpu", "host")
-        self.vm.add_args("-machine", "iommu=smmuv3")
-        self.vm.add_args("-d", "guest_errors")
-        self.vm.add_args('-bios', os.path.join(BUILD_DIR, 'pc-bios',
-                         'edk2-aarch64-code.fd'))
-        self.vm.add_args('-device', 'virtio-rng-pci,rng=rng0')
-        self.vm.add_args('-object',
-                         'rng-random,id=rng0,filename=/dev/urandom')
-
-        if custom_kernel is False:
-            return
-
-        kernel_url = self.distro.pxeboot_url + 'vmlinuz'
-        initrd_url = self.distro.pxeboot_url + 'initrd.img'
-        self.kernel_path = self.fetch_asset(kernel_url)
-        self.initrd_path = self.fetch_asset(initrd_url)
-
-    def run_and_check(self):
-        if self.kernel_path:
-            self.vm.add_args('-kernel', self.kernel_path,
-                             '-append', self.kernel_params,
-                             '-initrd', self.initrd_path)
-        self.launch_and_wait()
-        self.ssh_command('cat /proc/cmdline')
-        self.ssh_command('dnf -y install numactl-devel')
-
-
-    # 5.3 kernel without RIL #
-
-    def test_smmu_noril(self):
-        """
-        :avocado: tags=smmu_noril
-        :avocado: tags=smmu_noril_tests
-        :avocado: tags=distro_version:31
-        """
-        self.common_vm_setup()
-        self.run_and_check()
-
-    def test_smmu_noril_passthrough(self):
-        """
-        :avocado: tags=smmu_noril_passthrough
-        :avocado: tags=smmu_noril_tests
-        :avocado: tags=distro_version:31
-        """
-        self.common_vm_setup(True)
-        self.kernel_params = (self.distro.default_kernel_params +
-                              ' iommu.passthrough=on')
-        self.run_and_check()
-
-    def test_smmu_noril_nostrict(self):
-        """
-        :avocado: tags=smmu_noril_nostrict
-        :avocado: tags=smmu_noril_tests
-        :avocado: tags=distro_version:31
-        """
-        self.common_vm_setup(True)
-        self.kernel_params = (self.distro.default_kernel_params +
-                              ' iommu.strict=0')
-        self.run_and_check()
-
-    # 5.8 kernel featuring range invalidation
-    # >= v5.7 kernel
-
-    def test_smmu_ril(self):
-        """
-        :avocado: tags=smmu_ril
-        :avocado: tags=smmu_ril_tests
-        :avocado: tags=distro_version:33
-        """
-        self.common_vm_setup()
-        self.run_and_check()
-
-    def test_smmu_ril_passthrough(self):
-        """
-        :avocado: tags=smmu_ril_passthrough
-        :avocado: tags=smmu_ril_tests
-        :avocado: tags=distro_version:33
-        """
-        self.common_vm_setup(True)
-        self.kernel_params = (self.distro.default_kernel_params +
-                              ' iommu.passthrough=on')
-        self.run_and_check()
-
-    def test_smmu_ril_nostrict(self):
-        """
-        :avocado: tags=smmu_ril_nostrict
-        :avocado: tags=smmu_ril_tests
-        :avocado: tags=distro_version:33
-        """
-        self.common_vm_setup(True)
-        self.kernel_params = (self.distro.default_kernel_params +
-                              ' iommu.strict=0')
-        self.run_and_check()
diff --git a/tests/functional/meson.build b/tests/functional/meson.build
index 985ac5c27f..b317ad42c5 100644
--- a/tests/functional/meson.build
+++ b/tests/functional/meson.build
@@ -18,6 +18,7 @@ test_timeouts = {
   'aarch64_rme_sbsaref' : 1200,
   'aarch64_sbsaref_alpine' : 1200,
   'aarch64_sbsaref_freebsd' : 720,
+  'aarch64_smmu' : 720,
   'aarch64_tuxrun' : 240,
   'aarch64_virt' : 360,
   'aarch64_virt_gpu' : 480,
@@ -88,6 +89,7 @@ tests_aarch64_system_thorough = [
   'aarch64_sbsaref',
   'aarch64_sbsaref_alpine',
   'aarch64_sbsaref_freebsd',
+  'aarch64_smmu',
   'aarch64_tcg_plugins',
   'aarch64_tuxrun',
   'aarch64_virt',
diff --git a/tests/functional/test_aarch64_smmu.py b/tests/functional/test_aarch64_smmu.py
new file mode 100755
index 0000000000..c65d0f2817
--- /dev/null
+++ b/tests/functional/test_aarch64_smmu.py
@@ -0,0 +1,205 @@
+#!/usr/bin/env python3
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+#
+# SMMUv3 Functional tests
+#
+# Copyright (c) 2021 Red Hat, Inc.
+#
+# Author:
+#  Eric Auger <eric.auger@redhat.com>
+#
+# This work is licensed under the terms of the GNU GPL, version 2 or
+# later.  See the COPYING file in the top-level directory.
+
+import os
+import time
+
+from qemu_test import LinuxKernelTest, Asset, exec_command_and_wait_for_pattern
+from qemu_test import BUILD_DIR
+from qemu.utils import kvm_available
+
+
+class SMMU(LinuxKernelTest):
+
+    default_kernel_params = ('earlyprintk=pl011,0x9000000 no_timer_check '
+                             'printk.time=1 rd_NO_PLYMOUTH net.ifnames=0 '
+                             'console=ttyAMA0 rd.rescue')
+    IOMMU_ADDON = ',iommu_platform=on,disable-modern=off,disable-legacy=on'
+    kernel_path = None
+    initrd_path = None
+    kernel_params = None
+
+    GUEST_PORT = 8080
+
+    def set_up_boot(self, path):
+        self.vm.add_args('-device', 'virtio-blk-pci,bus=pcie.0,' +
+                         'drive=drv0,id=virtio-disk0,bootindex=1,'
+                         'werror=stop,rerror=stop' + self.IOMMU_ADDON)
+        self.vm.add_args('-drive',
+                f'file={path},if=none,cache=writethrough,id=drv0,snapshot=on')
+
+        self.vm.add_args('-netdev',
+                         'user,id=n1,hostfwd=tcp:127.0.0.1:0-:%d' %
+                         self.GUEST_PORT)
+        self.vm.add_args('-device', 'virtio-net,netdev=n1' + self.IOMMU_ADDON)
+
+    def common_vm_setup(self, kernel, initrd, disk):
+        self.require_accelerator("kvm")
+        self.require_netdev('user')
+        self.set_machine("virt")
+        self.vm.add_args('-m', '1G')
+        self.vm.add_args("-accel", "kvm")
+        self.vm.add_args("-cpu", "host")
+        self.vm.add_args("-machine", "iommu=smmuv3")
+        self.vm.add_args("-d", "guest_errors")
+        self.vm.add_args('-bios', os.path.join(BUILD_DIR, 'pc-bios',
+                         'edk2-aarch64-code.fd'))
+        self.vm.add_args('-device', 'virtio-rng-pci,rng=rng0')
+        self.vm.add_args('-object',
+                         'rng-random,id=rng0,filename=/dev/urandom')
+
+        self.kernel_path = kernel.fetch()
+        self.initrd_path = initrd.fetch()
+        self.set_up_boot(disk.fetch())
+
+    def run_and_check(self, filename, hashsum):
+        self.vm.add_args('-initrd', self.initrd_path)
+        self.vm.add_args('-append', self.kernel_params)
+        self.launch_kernel(self.kernel_path, initrd=self.initrd_path,
+                           wait_for='attach it to a bug report.')
+        prompt = '# '
+        # Fedora 33 requires 'return' to be pressed to enter the shell.
+        # There seems to be a small race between detecting the previous ':'
+        # and sending the newline, so we need to add a small delay here.
+        self.wait_for_console_pattern(':')
+        time.sleep(0.2)
+        exec_command_and_wait_for_pattern(self, '\n', prompt)
+        exec_command_and_wait_for_pattern(self, 'cat /proc/cmdline',
+                                          self.kernel_params)
+
+        # Checking for SMMU enablement:
+        self.log.info("Checking whether SMMU has been enabled...")
+        exec_command_and_wait_for_pattern(self, 'dmesg | grep smmu',
+                                          'arm-smmu-v3')
+        self.wait_for_console_pattern(prompt)
+        exec_command_and_wait_for_pattern(self,
+                                    'find /sys/kernel/iommu_groups/ -type l',
+                                    'devices/0000:00:')
+        self.wait_for_console_pattern(prompt)
+
+        # Copy a file (checked later), umount afterwards to drop disk cache:
+        self.log.info("Checking hard disk...")
+        exec_command_and_wait_for_pattern(self,
+                        "while ! (dmesg -c | grep vda:) ; do sleep 1 ; done",
+                        "vda2")
+        exec_command_and_wait_for_pattern(self, 'mount /dev/vda2 /sysroot',
+                                          'mounted filesystem')
+        exec_command_and_wait_for_pattern(self, 'cp /bin/vi /sysroot/root/vi',
+                                          prompt)
+        exec_command_and_wait_for_pattern(self, 'umount /sysroot', prompt)
+        # Switch from initrd to the cloud image filesystem:
+        exec_command_and_wait_for_pattern(self, 'mount /dev/vda2 /sysroot',
+                                          prompt)
+        exec_command_and_wait_for_pattern(self,
+                ('for d in dev proc sys run ; do '
+                 'mount -o bind /$d /sysroot/$d ; done'), prompt)
+        exec_command_and_wait_for_pattern(self, 'chroot /sysroot', prompt)
+        # Check files on the hard disk:
+        exec_command_and_wait_for_pattern(self,
+            ('if diff -q /root/vi /usr/bin/vi ; then echo "file" "ok" ; '
+             'else echo "files differ"; fi'), 'file ok')
+        self.wait_for_console_pattern(prompt)
+        exec_command_and_wait_for_pattern(self, f'sha256sum {filename}',
+                                          hashsum)
+
+        # Check virtio-net via HTTP:
+        exec_command_and_wait_for_pattern(self, 'dhclient eth0', prompt)
+        self.check_http_download(filename, hashsum, self.GUEST_PORT)
+
+
+    # 5.3 kernel without RIL #
+
+    ASSET_KERNEL_F31 = Asset(
+        ('https://archives.fedoraproject.org/pub/archive/fedora/linux/'
+         'releases/31/Server/aarch64/os/images/pxeboot/vmlinuz'),
+        '3ae07fcafbfc8e4abeb693035a74fe10698faae15e9ccd48882a9167800c1527')
+
+    ASSET_INITRD_F31 = Asset(
+        ('https://archives.fedoraproject.org/pub/archive/fedora/linux/'
+         'releases/31/Server/aarch64/os/images/pxeboot/initrd.img'),
+        '9f3146b28bc531c689f3c5f114cb74e4bd7bd548e0ba19fa77921d8bd256755a')
+
+    ASSET_DISK_F31 = Asset(
+        ('https://archives.fedoraproject.org/pub/archive/fedora/linux/releases'
+         '/31/Cloud/aarch64/images/Fedora-Cloud-Base-31-1.9.aarch64.qcow2'),
+        '1e18d9c0cf734940c4b5d5ec592facaed2af0ad0329383d5639c997fdf16fe49')
+
+    F31_FILENAME = '/boot/initramfs-5.3.7-301.fc31.aarch64.img'
+    F31_HSUM = '1a4beec6607d94df73d9dd1b4985c9c23dd0fdcf4e6ca1351d477f190df7bef9'
+
+    def test_smmu_noril(self):
+        self.common_vm_setup(self.ASSET_KERNEL_F31, self.ASSET_INITRD_F31,
+                             self.ASSET_DISK_F31)
+        self.kernel_params = self.default_kernel_params
+        self.run_and_check(self.F31_FILENAME, self.F31_HSUM)
+
+    def test_smmu_noril_passthrough(self):
+        self.common_vm_setup(self.ASSET_KERNEL_F31, self.ASSET_INITRD_F31,
+                             self.ASSET_DISK_F31)
+        self.kernel_params = (self.default_kernel_params +
+                              ' iommu.passthrough=on')
+        self.run_and_check(self.F31_FILENAME, self.F31_HSUM)
+
+    def test_smmu_noril_nostrict(self):
+        self.common_vm_setup(self.ASSET_KERNEL_F31, self.ASSET_INITRD_F31,
+                             self.ASSET_DISK_F31)
+        self.kernel_params = (self.default_kernel_params +
+                              ' iommu.strict=0')
+        self.run_and_check(self.F31_FILENAME, self.F31_HSUM)
+
+
+    # 5.8 kernel featuring range invalidation
+    # >= v5.7 kernel
+
+    ASSET_KERNEL_F33 = Asset(
+        ('https://archives.fedoraproject.org/pub/archive/fedora/linux/'
+         'releases/33/Server/aarch64/os/images/pxeboot/vmlinuz'),
+        'd8b1e6f7241f339d8e7609c456cf0461ffa4583ed07e0b55c7d1d8a0c154aa89')
+
+    ASSET_INITRD_F33 = Asset(
+        ('https://archives.fedoraproject.org/pub/archive/fedora/linux/'
+         'releases/33/Server/aarch64/os/images/pxeboot/initrd.img'),
+        '92513f55295c2c16a777f7b6c35ccd70a438e9e1e40b6ba39e0e60900615b3df')
+
+    ASSET_DISK_F33 = Asset(
+        ('https://archives.fedoraproject.org/pub/archive/fedora/linux/releases'
+         '/33/Cloud/aarch64/images/Fedora-Cloud-Base-33-1.2.aarch64.qcow2'),
+        'e7f75cdfd523fe5ac2ca9eeece68edc1a81f386a17f969c1d1c7c87031008a6b')
+
+    F33_FILENAME = '/boot/initramfs-5.8.15-301.fc33.aarch64.img'
+    F33_HSUM = '079cfad0caa82e84c8ca1fb0897a4999dd769f262216099f518619e807a550d9'
+
+    def test_smmu_ril(self):
+        self.common_vm_setup(self.ASSET_KERNEL_F33, self.ASSET_INITRD_F33,
+                             self.ASSET_DISK_F33)
+        self.kernel_params = self.default_kernel_params
+        self.run_and_check(self.F33_FILENAME, self.F33_HSUM)
+
+    def test_smmu_ril_passthrough(self):
+        self.common_vm_setup(self.ASSET_KERNEL_F33, self.ASSET_INITRD_F33,
+                             self.ASSET_DISK_F33)
+        self.kernel_params = (self.default_kernel_params +
+                              ' iommu.passthrough=on')
+        self.run_and_check(self.F33_FILENAME, self.F33_HSUM)
+
+    def test_smmu_ril_nostrict(self):
+        self.common_vm_setup(self.ASSET_KERNEL_F33, self.ASSET_INITRD_F33,
+                             self.ASSET_DISK_F33)
+        self.kernel_params = (self.default_kernel_params +
+                              ' iommu.strict=0')
+        self.run_and_check(self.F33_FILENAME, self.F33_HSUM)
+
+
+if __name__ == '__main__':
+    LinuxKernelTest.main()

From f8c54844175922d77faa8b586f451e379d53a191 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Mon, 14 Apr 2025 13:30:28 +0200
Subject: [PATCH 0068/2760] gitlab-ci: Update QEMU_JOB_AVOCADO and
 QEMU_CI_AVOCADO_TESTING
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since we don't run the Avocado jobs in the CI anymore, rename
these variables to QEMU_JOB_FUNCTIONAL and QEMU_CI_FUNCTIONAL.

Also, there was a mismatch between the documentation and the
implementation of QEMU_CI_AVOCADO_TESTING: While the documentation
said that you had to "Set this variable to have the tests using the
Avocado framework run automatically", you indeed needed to set it
to make the pipelines appear in your dashboard - but they were never
run automatically in forks and had to be triggered manually. Let's
improve this now: No need to hide these pipelines from the users
by default anymore (the functional tests should be stable enough
nowadays), and rather allow the users to run the pipelines auto-
matically with this switch now instead, as was documented.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20250414113031.151105-15-thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 .gitlab-ci.d/base.yml               |  8 ++------
 .gitlab-ci.d/buildtest-template.yml |  2 +-
 docs/devel/testing/ci-jobs.rst.inc  | 19 +++++++++----------
 3 files changed, 12 insertions(+), 17 deletions(-)

diff --git a/.gitlab-ci.d/base.yml b/.gitlab-ci.d/base.yml
index 25b88aaa06..60a24a9d14 100644
--- a/.gitlab-ci.d/base.yml
+++ b/.gitlab-ci.d/base.yml
@@ -69,10 +69,6 @@ variables:
     - if: '$QEMU_CI != "1" && $QEMU_CI != "2" && $CI_PROJECT_NAMESPACE != $QEMU_CI_UPSTREAM'
       when: never
 
-    # Avocado jobs don't run in forks unless $QEMU_CI_AVOCADO_TESTING is set
-    - if: '$QEMU_JOB_AVOCADO && $QEMU_CI_AVOCADO_TESTING != "1" && $CI_PROJECT_NAMESPACE != $QEMU_CI_UPSTREAM'
-      when: never
-
 
     #############################################################
     # Stage 2: fine tune execution of jobs in specific scenarios
@@ -101,8 +97,8 @@ variables:
       when: manual
       allow_failure: true
 
-    # Avocado jobs can be manually start in forks if $QEMU_CI_AVOCADO_TESTING is unset
-    - if: '$QEMU_JOB_AVOCADO && $CI_PROJECT_NAMESPACE != $QEMU_CI_UPSTREAM'
+    # Functional jobs can be manually started in forks
+    - if: '$QEMU_JOB_FUNCTIONAL && $QEMU_CI_FUNCTIONAL != "1" && $CI_PROJECT_NAMESPACE != $QEMU_CI_UPSTREAM'
       when: manual
       allow_failure: true
 
diff --git a/.gitlab-ci.d/buildtest-template.yml b/.gitlab-ci.d/buildtest-template.yml
index 13fa4f4a4f..d4f145fdb5 100644
--- a/.gitlab-ci.d/buildtest-template.yml
+++ b/.gitlab-ci.d/buildtest-template.yml
@@ -114,4 +114,4 @@
     - cd build
     - du -chs ${CI_PROJECT_DIR}/*-cache
   variables:
-    QEMU_JOB_AVOCADO: 1
+    QEMU_JOB_FUNCTIONAL: 1
diff --git a/docs/devel/testing/ci-jobs.rst.inc b/docs/devel/testing/ci-jobs.rst.inc
index 3756bbe355..f1c541cc25 100644
--- a/docs/devel/testing/ci-jobs.rst.inc
+++ b/docs/devel/testing/ci-jobs.rst.inc
@@ -126,10 +126,10 @@ QEMU_JOB_PUBLISH
 The job is for publishing content after a branch has been
 merged into the upstream default branch.
 
-QEMU_JOB_AVOCADO
-~~~~~~~~~~~~~~~~
+QEMU_JOB_FUNCTIONAL
+~~~~~~~~~~~~~~~~~~~
 
-The job runs the Avocado integration test suite
+The job runs the functional test suite
 
 Contributor controlled runtime variables
 ----------------------------------------
@@ -149,13 +149,12 @@ the jobs to be manually started from the UI
 Set this variable to 2 to create the pipelines and run all
 the jobs immediately, as was the historical behaviour
 
-QEMU_CI_AVOCADO_TESTING
-~~~~~~~~~~~~~~~~~~~~~~~
-By default, tests using the Avocado framework are not run automatically in
-the pipelines (because multiple artifacts have to be downloaded, and if
-these artifacts are not already cached, downloading them make the jobs
-reach the timeout limit). Set this variable to have the tests using the
-Avocado framework run automatically.
+QEMU_CI_FUNCTIONAL
+~~~~~~~~~~~~~~~~~~
+By default, tests using the functional framework are not run automatically
+in the pipelines (because multiple artifacts have to be downloaded, which
+might cause a lot of network traffic). Set this variable to have the tests
+using the functional framework run automatically.
 
 Other misc variables
 --------------------

From 5748e464150911127d07c0b7adeea474fd905149 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Fri, 14 Mar 2025 09:59:57 +0100
Subject: [PATCH 0069/2760] docs/devel/testing: Dissolve the
 ci-definitions.rst.inc file

This file was meant for defining the vocabulary for our testing
efforts, but it did not age well: First, the definitions are not
only about the CI part, but also about testing in general, so most
of the information should rather reside in main.rst instead.
Second, some vocabulary has never been really adopted by the QEMU
project, for example we never really use the word "system testing"
since "system" rather means the system emulator binaries in the
QEMU project (and we also don't do any testing with other components
like libvirt and virt-managers here). It also defines that the qtests
are the "functional" tests in QEMU, which is not really up to date
anymore after the "tests/functional" framework has been introduced
a couple of months ago (FWIW, the qtests could rather be seen as a
mix between unit testing and functional testing).

To solve this problem, move the useful parts of this file into
main.rst and directly into ci.rst, and drop the ones (like "system
testing") that we don't really need anymore.

Message-ID: <20250314085959.1585568-1-thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 docs/devel/testing/ci-definitions.rst.inc | 121 ----------------------
 docs/devel/testing/ci.rst                 |  28 ++++-
 docs/devel/testing/main.rst               |  65 ++++++++++--
 3 files changed, 81 insertions(+), 133 deletions(-)
 delete mode 100644 docs/devel/testing/ci-definitions.rst.inc

diff --git a/docs/devel/testing/ci-definitions.rst.inc b/docs/devel/testing/ci-definitions.rst.inc
deleted file mode 100644
index 6d5c6fd9f2..0000000000
--- a/docs/devel/testing/ci-definitions.rst.inc
+++ /dev/null
@@ -1,121 +0,0 @@
-Definition of terms
-===================
-
-This section defines the terms used in this document and correlates them with
-what is currently used on QEMU.
-
-Automated tests
----------------
-
-An automated test is written on a test framework using its generic test
-functions/classes. The test framework can run the tests and report their
-success or failure [1]_.
-
-An automated test has essentially three parts:
-
-1. The test initialization of the parameters, where the expected parameters,
-   like inputs and expected results, are set up;
-2. The call to the code that should be tested;
-3. An assertion, comparing the result from the previous call with the expected
-   result set during the initialization of the parameters. If the result
-   matches the expected result, the test has been successful; otherwise, it has
-   failed.
-
-Unit testing
-------------
-
-A unit test is responsible for exercising individual software components as a
-unit, like interfaces, data structures, and functionality, uncovering errors
-within the boundaries of a component. The verification effort is in the
-smallest software unit and focuses on the internal processing logic and data
-structures. A test case of unit tests should be designed to uncover errors due
-to erroneous computations, incorrect comparisons, or improper control flow [2]_.
-
-On QEMU, unit testing is represented by the 'check-unit' target from 'make'.
-
-Functional testing
-------------------
-
-A functional test focuses on the functional requirement of the software.
-Deriving sets of input conditions, the functional tests should fully exercise
-all the functional requirements for a program. Functional testing is
-complementary to other testing techniques, attempting to find errors like
-incorrect or missing functions, interface errors, behavior errors, and
-initialization and termination errors [3]_.
-
-On QEMU, functional testing is represented by the 'check-qtest' target from
-'make'.
-
-System testing
---------------
-
-System tests ensure all application elements mesh properly while the overall
-functionality and performance are achieved [4]_. Some or all system components
-are integrated to create a complete system to be tested as a whole. System
-testing ensures that components are compatible, interact correctly, and
-transfer the right data at the right time across their interfaces. As system
-testing focuses on interactions, use case-based testing is a practical approach
-to system testing [5]_. Note that, in some cases, system testing may require
-interaction with third-party software, like operating system images, databases,
-networks, and so on.
-
-On QEMU, system testing is represented by the 'check-avocado' target from
-'make'.
-
-Flaky tests
------------
-
-A flaky test is defined as a test that exhibits both a passing and a failing
-result with the same code on different runs. Some usual reasons for an
-intermittent/flaky test are async wait, concurrency, and test order dependency
-[6]_.
-
-Gating
-------
-
-A gate restricts the move of code from one stage to another on a
-test/deployment pipeline. The step move is granted with approval. The approval
-can be a manual intervention or a set of tests succeeding [7]_.
-
-On QEMU, the gating process happens during the pull request. The approval is
-done by the project leader running its own set of tests. The pull request gets
-merged when the tests succeed.
-
-Continuous Integration (CI)
----------------------------
-
-Continuous integration (CI) requires the builds of the entire application and
-the execution of a comprehensive set of automated tests every time there is a
-need to commit any set of changes [8]_. The automated tests can be composed of
-the unit, functional, system, and other tests.
-
-Keynotes about continuous integration (CI) [9]_:
-
-1. System tests may depend on external software (operating system images,
-   firmware, database, network).
-2. It may take a long time to build and test. It may be impractical to build
-   the system being developed several times per day.
-3. If the development platform is different from the target platform, it may
-   not be possible to run system tests in the developer’s private workspace.
-   There may be differences in hardware, operating system, or installed
-   software. Therefore, more time is required for testing the system.
-
-References
-----------
-
-.. [1] Sommerville, Ian (2016). Software Engineering. p. 233.
-.. [2] Pressman, Roger S. & Maxim, Bruce R. (2020). Software Engineering,
-       A Practitioner’s Approach. p. 48, 376, 378, 381.
-.. [3] Pressman, Roger S. & Maxim, Bruce R. (2020). Software Engineering,
-       A Practitioner’s Approach. p. 388.
-.. [4] Pressman, Roger S. & Maxim, Bruce R. (2020). Software Engineering,
-       A Practitioner’s Approach. Software Engineering, p. 377.
-.. [5] Sommerville, Ian (2016). Software Engineering. p. 59, 232, 240.
-.. [6] Luo, Qingzhou, et al. An empirical analysis of flaky tests.
-       Proceedings of the 22nd ACM SIGSOFT International Symposium on
-       Foundations of Software Engineering. 2014.
-.. [7] Humble, Jez & Farley, David (2010). Continuous Delivery:
-       Reliable Software Releases Through Build, Test, and Deployment, p. 122.
-.. [8] Humble, Jez & Farley, David (2010). Continuous Delivery:
-       Reliable Software Releases Through Build, Test, and Deployment, p. 55.
-.. [9] Sommerville, Ian (2016). Software Engineering. p. 743.
diff --git a/docs/devel/testing/ci.rst b/docs/devel/testing/ci.rst
index ed88a2010b..e21d39db57 100644
--- a/docs/devel/testing/ci.rst
+++ b/docs/devel/testing/ci.rst
@@ -1,14 +1,34 @@
 .. _ci:
 
-==
-CI
-==
+Continuous Integration (CI)
+===========================
+
+Continuous integration (CI) requires the builds of the entire application and
+the execution of a comprehensive set of automated tests every time there is a
+need to commit any set of changes [1]_. The automated tests are composed
+of unit, functional and other tests.
 
 Most of QEMU's CI is run on GitLab's infrastructure although a number
 of other CI services are used for specialised purposes. The most up to
 date information about them and their status can be found on the
 `project wiki testing page <https://wiki.qemu.org/Testing/CI>`_.
 
-.. include:: ci-definitions.rst.inc
+These tests are also used as gating tests before merging pull requests.
+A gating test restricts the move of code from one stage to another on a
+test/deployment pipeline. The step move is granted with approval. The approval
+can be a manual intervention or a set of tests succeeding [2]_.
+
+On QEMU, the gating process happens during the pull request. The approval is
+done by the project leader running its own set of tests. The pull request gets
+merged when the tests succeed.
+
 .. include:: ci-jobs.rst.inc
 .. include:: ci-runners.rst.inc
+
+References
+----------
+
+.. [1] Humble, Jez & Farley, David (2010). Continuous Delivery:
+       Reliable Software Releases Through Build, Test, and Deployment, p. 55.
+.. [2] Humble, Jez & Farley, David (2010). Continuous Delivery:
+       Reliable Software Releases Through Build, Test, and Deployment, p. 122.
diff --git a/docs/devel/testing/main.rst b/docs/devel/testing/main.rst
index 9869bcf034..e56da22edf 100644
--- a/docs/devel/testing/main.rst
+++ b/docs/devel/testing/main.rst
@@ -5,19 +5,32 @@ Testing in QEMU
 
 QEMU's testing infrastructure is fairly complex as it covers
 everything from unit testing and exercising specific sub-systems all
-the way to full blown acceptance tests. To get an overview of the
+the way to full blown functional tests. To get an overview of the
 tests you can run ``make check-help`` from either the source or build
 tree.
 
-Most (but not all) tests are also integrated into the meson build
-system so can be run directly from the build tree, for example:
-
-.. code::
+Most (but not all) tests are also integrated as an automated test into
+the meson build system so can be run directly from the build tree,
+for example::
 
   [./pyvenv/bin/]meson test --suite qemu:softfloat
 
 will run just the softfloat tests.
 
+An automated test is written with one of the test frameworks using its
+generic test functions/classes. The test framework can run the tests and
+report their success or failure [1]_.
+
+An automated test has essentially three parts:
+
+1. The test initialization of the parameters, where the expected parameters,
+   like inputs and expected results, are set up;
+2. The call to the code that should be tested;
+3. An assertion, comparing the result from the previous call with the expected
+   result set during the initialization of the parameters. If the result
+   matches the expected result, the test has been successful; otherwise, it has
+   failed.
+
 The rest of this document will cover the details for specific test
 groups.
 
@@ -44,9 +57,17 @@ cannot find them.
 Unit tests
 ~~~~~~~~~~
 
-Unit tests, which can be invoked with ``make check-unit``, are simple C tests
-that typically link to individual QEMU object files and exercise them by
-calling exported functions.
+A unit test is responsible for exercising individual software components as a
+unit, like interfaces, data structures, and functionality, uncovering errors
+within the boundaries of a component. The verification effort is in the
+smallest software unit and focuses on the internal processing logic and data
+structures. A test case of unit tests should be designed to uncover errors
+due to erroneous computations, incorrect comparisons, or improper control
+flow [2]_.
+
+In QEMU, unit tests can be invoked with ``make check-unit``. They are
+simple C tests that typically link to individual QEMU object files and
+exercise them by calling exported functions.
 
 If you are writing new code in QEMU, consider adding a unit test, especially
 for utility modules that are relatively stateless or have few dependencies. To
@@ -885,6 +906,10 @@ changing the ``-c`` option.
 Functional tests using Python
 -----------------------------
 
+A functional test focuses on the functional requirement of the software,
+attempting to find errors like incorrect functions, interface errors,
+behavior errors, and initialization and termination errors [3]_.
+
 The ``tests/functional`` directory hosts functional tests written in
 Python. You can run the functional tests simply by executing:
 
@@ -1023,3 +1048,27 @@ coverage-html`` which will create
 Further analysis can be conducted by running the ``gcov`` command
 directly on the various .gcda output files. Please read the ``gcov``
 documentation for more information.
+
+Flaky tests
+-----------
+
+A flaky test is defined as a test that exhibits both a passing and a failing
+result with the same code on different runs. Some usual reasons for an
+intermittent/flaky test are async wait, concurrency, and test order dependency
+[4]_.
+
+In QEMU, tests that are identified to be flaky are normally disabled by
+default. Set the QEMU_TEST_FLAKY_TESTS environment variable before running
+the tests to enable them.
+
+References
+----------
+
+.. [1] Sommerville, Ian (2016). Software Engineering. p. 233.
+.. [2] Pressman, Roger S. & Maxim, Bruce R. (2020). Software Engineering,
+       A Practitioner’s Approach. p. 48, 376, 378, 381.
+.. [3] Pressman, Roger S. & Maxim, Bruce R. (2020). Software Engineering,
+       A Practitioner’s Approach. p. 388.
+.. [4] Luo, Qingzhou, et al. An empirical analysis of flaky tests.
+       Proceedings of the 22nd ACM SIGSOFT International Symposium on
+       Foundations of Software Engineering. 2014.

From 52e9ed6d3ac44424e098333772077a41bb88c4db Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Mon, 14 Apr 2025 13:30:29 +0200
Subject: [PATCH 0070/2760] Remove the remainders of the Avocado tests
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Now that all Avocado tests have been converted to or been replaced by
other functional tests, we can delete the remainders of the Avocado
tests from the QEMU source tree.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20250414113031.151105-16-thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 MAINTAINERS                             |   8 +-
 configure                               |   2 +-
 docs/about/build-platforms.rst          |  10 +-
 docs/devel/build-system.rst             |  11 +-
 docs/devel/codebase.rst                 |   5 -
 docs/devel/testing/avocado.rst          | 581 ------------------------
 docs/devel/testing/functional.rst       |   3 -
 docs/devel/testing/index.rst            |   1 -
 docs/devel/testing/main.rst             |  15 -
 pythondeps.toml                         |   8 +-
 tests/Makefile.include                  |  60 +--
 tests/avocado/README.rst                |  10 -
 tests/avocado/avocado_qemu/__init__.py  | 424 -----------------
 tests/avocado/avocado_qemu/linuxtest.py | 253 -----------
 14 files changed, 16 insertions(+), 1375 deletions(-)
 delete mode 100644 docs/devel/testing/avocado.rst
 delete mode 100644 tests/avocado/README.rst
 delete mode 100644 tests/avocado/avocado_qemu/__init__.py
 delete mode 100644 tests/avocado/avocado_qemu/linuxtest.py

diff --git a/MAINTAINERS b/MAINTAINERS
index 07f77c048e..5fd757c5dd 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2073,7 +2073,7 @@ S: Supported
 F: hw/acpi/viot.c
 F: hw/acpi/viot.h
 
-ACPI/AVOCADO/BIOSBITS
+ACPI/FUNCTIONAL/BIOSBITS
 M: Ani Sinha <anisinha@redhat.com>
 M: Michael S. Tsirkin <mst@redhat.com>
 S: Supported
@@ -4246,12 +4246,6 @@ R: Philippe Mathieu-Daudé <philmd@linaro.org>
 S: Maintained
 F: tests/tcg/Makefile.target
 
-Integration Testing with the Avocado framework
-W: https://trello.com/b/6Qi1pxVn/avocado-qemu
-R: Cleber Rosa <crosa@redhat.com>
-S: Odd Fixes
-F: tests/avocado/
-
 GitLab custom runner (Works On Arm Sponsored)
 M: Alex Bennée <alex.bennee@linaro.org>
 M: Philippe Mathieu-Daudé <philmd@linaro.org>
diff --git a/configure b/configure
index 02f1dd2311..000309cf61 100755
--- a/configure
+++ b/configure
@@ -1685,7 +1685,7 @@ LINKS="$LINKS pc-bios/optionrom/Makefile"
 LINKS="$LINKS pc-bios/s390-ccw/Makefile"
 LINKS="$LINKS pc-bios/vof/Makefile"
 LINKS="$LINKS .gdbinit scripts" # scripts needed by relative path in .gdbinit
-LINKS="$LINKS tests/avocado tests/data"
+LINKS="$LINKS tests/data"
 LINKS="$LINKS tests/qemu-iotests/check tests/qemu-iotests/Makefile"
 LINKS="$LINKS python"
 for f in $LINKS ; do
diff --git a/docs/about/build-platforms.rst b/docs/about/build-platforms.rst
index 1552b1a704..52521552c8 100644
--- a/docs/about/build-platforms.rst
+++ b/docs/about/build-platforms.rst
@@ -123,11 +123,11 @@ Rust build dependencies
   to build QEMU.
 
 Optional build dependencies
-  Build components whose absence does not affect the ability to build
-  QEMU may not be available in distros, or may be too old for QEMU's
-  requirements.  Many of these, such as the Avocado testing framework
-  or various linters, are written in Python and therefore can also
-  be installed using ``pip``.  Cross compilers are another example
+  Build components whose absence does not affect the ability to build QEMU
+  may not be available in distros, or may be too old for our requirements.
+  Many of these, such as additional modules for the functional testing
+  framework or various linters, are written in Python and therefore can
+  also be installed using ``pip``.  Cross compilers are another example
   of optional build-time dependency; in this case it is possible to
   download them from repositories such as EPEL, to use container-based
   cross compilation using ``docker`` or ``podman``, or to use pre-built
diff --git a/docs/devel/build-system.rst b/docs/devel/build-system.rst
index a759982f45..258cfad3fe 100644
--- a/docs/devel/build-system.rst
+++ b/docs/devel/build-system.rst
@@ -134,7 +134,7 @@ in how the build process runs Python code.
 
 At this stage, ``configure`` also queries the chosen Python interpreter
 about QEMU's build dependencies.  Note that the build process does  *not*
-look for ``meson``, ``sphinx-build`` or ``avocado`` binaries in the PATH;
+look for ``meson`` or ``sphinx-build`` binaries in the PATH;
 likewise, there are no options such as ``--meson`` or ``--sphinx-build``.
 This avoids a potential mismatch, where Meson and Sphinx binaries on the
 PATH might operate in a different Python environment than the one chosen
@@ -151,7 +151,7 @@ virtual environment with ``pip``, either from wheels in ``python/wheels``
 or by downloading the package with PyPI.  Downloading can be disabled with
 ``--disable-download``; and anyway, it only happens when a ``configure``
 option (currently, only ``--enable-docs``) is explicitly enabled but
-the dependencies are not present\ [#pip]_.
+the dependencies are not present.
 
 .. [#distlib] The scripts are created based on the package's metadata,
               specifically the ``console_script`` entry points.  This is the
@@ -164,10 +164,6 @@ the dependencies are not present\ [#pip]_.
               because the Python Packaging Authority provides a package
               ``distlib.scripts`` to perform this task.
 
-.. [#pip] ``pip`` might also be used when running ``make check-avocado``
-           if downloading is enabled, to ensure that Avocado is
-           available.
-
 The required versions of the packages are stored in a configuration file
 ``pythondeps.toml``.  The format is custom to QEMU, but it is documented
 at the top of the file itself and it should be easy to understand.  The
@@ -497,8 +493,7 @@ number of dynamically created files listed later.
   ``pyvenv/bin``, and calling ``pip`` to install dependencies.
 
 ``tests/Makefile.include``
-  Rules for external test harnesses. These include the TCG tests
-  and the Avocado-based integration tests.
+  Rules for external test harnesses like the TCG tests.
 
 ``tests/docker/Makefile.include``
   Rules for Docker tests. Like ``tests/Makefile.include``, this file is
diff --git a/docs/devel/codebase.rst b/docs/devel/codebase.rst
index ef98578296..40273e7d31 100644
--- a/docs/devel/codebase.rst
+++ b/docs/devel/codebase.rst
@@ -175,11 +175,6 @@ yet, so sometimes the source code is all you have.
 * `tests <https://gitlab.com/qemu-project/qemu/-/tree/master/tests>`_:
   QEMU `test <testing>` suite
 
-  - `avocado <https://gitlab.com/qemu-project/qemu/-/tree/master/tests/avocado>`_:
-    Functional tests booting full VM using `Avocado framework <checkavocado-ref>`.
-    Those tests will be transformed and moved into
-    `tests/functional <https://gitlab.com/qemu-project/qemu/-/tree/master/tests/functional>`_
-    in the future.
   - `data <https://gitlab.com/qemu-project/qemu/-/tree/master/tests/data>`_:
     Data for various tests.
   - `decode <https://gitlab.com/qemu-project/qemu/-/tree/master/tests/decode>`_:
diff --git a/docs/devel/testing/avocado.rst b/docs/devel/testing/avocado.rst
deleted file mode 100644
index eda76fe2db..0000000000
--- a/docs/devel/testing/avocado.rst
+++ /dev/null
@@ -1,581 +0,0 @@
-.. _checkavocado-ref:
-
-
-Integration testing with Avocado
-================================
-
-The ``tests/avocado`` directory hosts integration tests. They're usually
-higher level tests, and may interact with external resources and with
-various guest operating systems.
-
-These tests are written using the Avocado Testing Framework (which must be
-installed separately) in conjunction with a the ``avocado_qemu.QemuSystemTest``
-class, implemented at ``tests/avocado/avocado_qemu``.
-
-Tests based on ``avocado_qemu.QemuSystemTest`` can easily:
-
- * Customize the command line arguments given to the convenience
-   ``self.vm`` attribute (a QEMUMachine instance)
-
- * Interact with the QEMU monitor, send QMP commands and check
-   their results
-
- * Interact with the guest OS, using the convenience console device
-   (which may be useful to assert the effectiveness and correctness of
-   command line arguments or QMP commands)
-
- * Interact with external data files that accompany the test itself
-   (see ``self.get_data()``)
-
- * Download (and cache) remote data files, such as firmware and kernel
-   images
-
- * Have access to a library of guest OS images (by means of the
-   ``avocado.utils.vmimage`` library)
-
- * Make use of various other test related utilities available at the
-   test class itself and at the utility library:
-
-   - http://avocado-framework.readthedocs.io/en/latest/api/test/avocado.html#avocado.Test
-   - http://avocado-framework.readthedocs.io/en/latest/api/utils/avocado.utils.html
-
-Running tests
--------------
-
-You can run the avocado tests simply by executing:
-
-.. code::
-
-  make check-avocado
-
-This involves the automatic installation, from PyPI, of all the
-necessary avocado-framework dependencies into the QEMU venv within the
-build tree (at ``./pyvenv``). Test results are also saved within the
-build tree (at ``tests/results``).
-
-Note: the build environment must be using a Python 3 stack, and have
-the ``venv`` and ``pip`` packages installed.  If necessary, make sure
-``configure`` is called with ``--python=`` and that those modules are
-available.  On Debian and Ubuntu based systems, depending on the
-specific version, they may be on packages named ``python3-venv`` and
-``python3-pip``.
-
-It is also possible to run tests based on tags using the
-``make check-avocado`` command and the ``AVOCADO_TAGS`` environment
-variable:
-
-.. code::
-
-   make check-avocado AVOCADO_TAGS=quick
-
-Note that tags separated with commas have an AND behavior, while tags
-separated by spaces have an OR behavior. For more information on Avocado
-tags, see:
-
- https://avocado-framework.readthedocs.io/en/latest/guides/user/chapters/tags.html
-
-To run a single test file, a couple of them, or a test within a file
-using the ``make check-avocado`` command, set the ``AVOCADO_TESTS``
-environment variable with the test files or test names. To run all
-tests from a single file, use:
-
- .. code::
-
-  make check-avocado AVOCADO_TESTS=$FILEPATH
-
-The same is valid to run tests from multiple test files:
-
- .. code::
-
-  make check-avocado AVOCADO_TESTS='$FILEPATH1 $FILEPATH2'
-
-To run a single test within a file, use:
-
- .. code::
-
-  make check-avocado AVOCADO_TESTS=$FILEPATH:$TESTCLASS.$TESTNAME
-
-The same is valid to run single tests from multiple test files:
-
- .. code::
-
-  make check-avocado AVOCADO_TESTS='$FILEPATH1:$TESTCLASS1.$TESTNAME1 $FILEPATH2:$TESTCLASS2.$TESTNAME2'
-
-The scripts installed inside the virtual environment may be used
-without an "activation".  For instance, the Avocado test runner
-may be invoked by running:
-
- .. code::
-
-  pyvenv/bin/avocado run $OPTION1 $OPTION2 tests/avocado/
-
-Note that if ``make check-avocado`` was not executed before, it is
-possible to create the Python virtual environment with the dependencies
-needed running:
-
- .. code::
-
-  make check-venv
-
-It is also possible to run tests from a single file or a single test within
-a test file. To run tests from a single file within the build tree, use:
-
- .. code::
-
-  pyvenv/bin/avocado run tests/avocado/$TESTFILE
-
-To run a single test within a test file, use:
-
- .. code::
-
-  pyvenv/bin/avocado run tests/avocado/$TESTFILE:$TESTCLASS.$TESTNAME
-
-Valid test names are visible in the output from any previous execution
-of Avocado or ``make check-avocado``, and can also be queried using:
-
- .. code::
-
-  pyvenv/bin/avocado list tests/avocado
-
-Manual Installation
--------------------
-
-To manually install Avocado and its dependencies, run:
-
-.. code::
-
-  pip install --user avocado-framework
-
-Alternatively, follow the instructions on this link:
-
-  https://avocado-framework.readthedocs.io/en/latest/guides/user/chapters/installing.html
-
-Overview
---------
-
-The ``tests/avocado/avocado_qemu`` directory provides the
-``avocado_qemu`` Python module, containing the ``avocado_qemu.QemuSystemTest``
-class.  Here's a simple usage example:
-
-.. code::
-
-  from avocado_qemu import QemuSystemTest
-
-
-  class Version(QemuSystemTest):
-      """
-      :avocado: tags=quick
-      """
-      def test_qmp_human_info_version(self):
-          self.vm.launch()
-          res = self.vm.cmd('human-monitor-command',
-                            command_line='info version')
-          self.assertRegex(res, r'^(\d+\.\d+\.\d)')
-
-To execute your test, run:
-
-.. code::
-
-  avocado run version.py
-
-Tests may be classified according to a convention by using docstring
-directives such as ``:avocado: tags=TAG1,TAG2``.  To run all tests
-in the current directory, tagged as "quick", run:
-
-.. code::
-
-  avocado run -t quick .
-
-The ``avocado_qemu.QemuSystemTest`` base test class
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
-
-The ``avocado_qemu.QemuSystemTest`` class has a number of characteristics
-that are worth being mentioned right away.
-
-First of all, it attempts to give each test a ready to use QEMUMachine
-instance, available at ``self.vm``.  Because many tests will tweak the
-QEMU command line, launching the QEMUMachine (by using ``self.vm.launch()``)
-is left to the test writer.
-
-The base test class has also support for tests with more than one
-QEMUMachine. The way to get machines is through the ``self.get_vm()``
-method which will return a QEMUMachine instance. The ``self.get_vm()``
-method accepts arguments that will be passed to the QEMUMachine creation
-and also an optional ``name`` attribute so you can identify a specific
-machine and get it more than once through the tests methods. A simple
-and hypothetical example follows:
-
-.. code::
-
-  from avocado_qemu import QemuSystemTest
-
-
-  class MultipleMachines(QemuSystemTest):
-      def test_multiple_machines(self):
-          first_machine = self.get_vm()
-          second_machine = self.get_vm()
-          self.get_vm(name='third_machine').launch()
-
-          first_machine.launch()
-          second_machine.launch()
-
-          first_res = first_machine.cmd(
-              'human-monitor-command',
-              command_line='info version')
-
-          second_res = second_machine.cmd(
-              'human-monitor-command',
-              command_line='info version')
-
-          third_res = self.get_vm(name='third_machine').cmd(
-              'human-monitor-command',
-              command_line='info version')
-
-          self.assertEqual(first_res, second_res, third_res)
-
-At test "tear down", ``avocado_qemu.QemuSystemTest`` handles all the
-QEMUMachines shutdown.
-
-The ``avocado_qemu.LinuxTest`` base test class
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
-
-The ``avocado_qemu.LinuxTest`` is further specialization of the
-``avocado_qemu.QemuSystemTest`` class, so it contains all the characteristics
-of the later plus some extra features.
-
-First of all, this base class is intended for tests that need to
-interact with a fully booted and operational Linux guest.  At this
-time, it uses a Fedora 31 guest image.  The most basic example looks
-like this:
-
-.. code::
-
-  from avocado_qemu import LinuxTest
-
-
-  class SomeTest(LinuxTest):
-
-      def test(self):
-          self.launch_and_wait()
-          self.ssh_command('some_command_to_be_run_in_the_guest')
-
-Please refer to tests that use ``avocado_qemu.LinuxTest`` under
-``tests/avocado`` for more examples.
-
-QEMUMachine
------------
-
-The QEMUMachine API is already widely used in the Python iotests,
-device-crash-test and other Python scripts.  It's a wrapper around the
-execution of a QEMU binary, giving its users:
-
- * the ability to set command line arguments to be given to the QEMU
-   binary
-
- * a ready to use QMP connection and interface, which can be used to
-   send commands and inspect its results, as well as asynchronous
-   events
-
- * convenience methods to set commonly used command line arguments in
-   a more succinct and intuitive way
-
-QEMU binary selection
-^^^^^^^^^^^^^^^^^^^^^
-
-The QEMU binary used for the ``self.vm`` QEMUMachine instance will
-primarily depend on the value of the ``qemu_bin`` parameter.  If it's
-not explicitly set, its default value will be the result of a dynamic
-probe in the same source tree.  A suitable binary will be one that
-targets the architecture matching host machine.
-
-Based on this description, test writers will usually rely on one of
-the following approaches:
-
-1) Set ``qemu_bin``, and use the given binary
-
-2) Do not set ``qemu_bin``, and use a QEMU binary named like
-   "qemu-system-${arch}", either in the current
-   working directory, or in the current source tree.
-
-The resulting ``qemu_bin`` value will be preserved in the
-``avocado_qemu.QemuSystemTest`` as an attribute with the same name.
-
-Attribute reference
--------------------
-
-Test
-^^^^
-
-Besides the attributes and methods that are part of the base
-``avocado.Test`` class, the following attributes are available on any
-``avocado_qemu.QemuSystemTest`` instance.
-
-vm
-""
-
-A QEMUMachine instance, initially configured according to the given
-``qemu_bin`` parameter.
-
-arch
-""""
-
-The architecture can be used on different levels of the stack, e.g. by
-the framework or by the test itself.  At the framework level, it will
-currently influence the selection of a QEMU binary (when one is not
-explicitly given).
-
-Tests are also free to use this attribute value, for their own needs.
-A test may, for instance, use the same value when selecting the
-architecture of a kernel or disk image to boot a VM with.
-
-The ``arch`` attribute will be set to the test parameter of the same
-name.  If one is not given explicitly, it will either be set to
-``None``, or, if the test is tagged with one (and only one)
-``:avocado: tags=arch:VALUE`` tag, it will be set to ``VALUE``.
-
-cpu
-"""
-
-The cpu model that will be set to all QEMUMachine instances created
-by the test.
-
-The ``cpu`` attribute will be set to the test parameter of the same
-name. If one is not given explicitly, it will either be set to
-``None ``, or, if the test is tagged with one (and only one)
-``:avocado: tags=cpu:VALUE`` tag, it will be set to ``VALUE``.
-
-machine
-"""""""
-
-The machine type that will be set to all QEMUMachine instances created
-by the test.
-
-The ``machine`` attribute will be set to the test parameter of the same
-name.  If one is not given explicitly, it will either be set to
-``None``, or, if the test is tagged with one (and only one)
-``:avocado: tags=machine:VALUE`` tag, it will be set to ``VALUE``.
-
-qemu_bin
-""""""""
-
-The preserved value of the ``qemu_bin`` parameter or the result of the
-dynamic probe for a QEMU binary in the current working directory or
-source tree.
-
-LinuxTest
-^^^^^^^^^
-
-Besides the attributes present on the ``avocado_qemu.QemuSystemTest`` base
-class, the ``avocado_qemu.LinuxTest`` adds the following attributes:
-
-distro
-""""""
-
-The name of the Linux distribution used as the guest image for the
-test.  The name should match the **Provider** column on the list
-of images supported by the avocado.utils.vmimage library:
-
-https://avocado-framework.readthedocs.io/en/latest/guides/writer/libs/vmimage.html#supported-images
-
-distro_version
-""""""""""""""
-
-The version of the Linux distribution as the guest image for the
-test.  The name should match the **Version** column on the list
-of images supported by the avocado.utils.vmimage library:
-
-https://avocado-framework.readthedocs.io/en/latest/guides/writer/libs/vmimage.html#supported-images
-
-distro_checksum
-"""""""""""""""
-
-The sha256 hash of the guest image file used for the test.
-
-If this value is not set in the code or by a test parameter (with the
-same name), no validation on the integrity of the image will be
-performed.
-
-Parameter reference
--------------------
-
-To understand how Avocado parameters are accessed by tests, and how
-they can be passed to tests, please refer to::
-
-  https://avocado-framework.readthedocs.io/en/latest/guides/writer/chapters/writing.html#accessing-test-parameters
-
-Parameter values can be easily seen in the log files, and will look
-like the following:
-
-.. code::
-
-  PARAMS (key=qemu_bin, path=*, default=./qemu-system-x86_64) => './qemu-system-x86_64
-
-Test
-^^^^
-
-arch
-""""
-
-The architecture that will influence the selection of a QEMU binary
-(when one is not explicitly given).
-
-Tests are also free to use this parameter value, for their own needs.
-A test may, for instance, use the same value when selecting the
-architecture of a kernel or disk image to boot a VM with.
-
-This parameter has a direct relation with the ``arch`` attribute.  If
-not given, it will default to None.
-
-cpu
-"""
-
-The cpu model that will be set to all QEMUMachine instances created
-by the test.
-
-machine
-"""""""
-
-The machine type that will be set to all QEMUMachine instances created
-by the test.
-
-qemu_bin
-""""""""
-
-The exact QEMU binary to be used on QEMUMachine.
-
-LinuxTest
-^^^^^^^^^
-
-Besides the parameters present on the ``avocado_qemu.QemuSystemTest`` base
-class, the ``avocado_qemu.LinuxTest`` adds the following parameters:
-
-distro
-""""""
-
-The name of the Linux distribution used as the guest image for the
-test.  The name should match the **Provider** column on the list
-of images supported by the avocado.utils.vmimage library:
-
-https://avocado-framework.readthedocs.io/en/latest/guides/writer/libs/vmimage.html#supported-images
-
-distro_version
-""""""""""""""
-
-The version of the Linux distribution as the guest image for the
-test.  The name should match the **Version** column on the list
-of images supported by the avocado.utils.vmimage library:
-
-https://avocado-framework.readthedocs.io/en/latest/guides/writer/libs/vmimage.html#supported-images
-
-distro_checksum
-"""""""""""""""
-
-The sha256 hash of the guest image file used for the test.
-
-If this value is not set in the code or by this parameter no
-validation on the integrity of the image will be performed.
-
-Skipping tests
---------------
-
-The Avocado framework provides Python decorators which allow for easily skip
-tests running under certain conditions. For example, on the lack of a binary
-on the test system or when the running environment is a CI system. For further
-information about those decorators, please refer to::
-
-  https://avocado-framework.readthedocs.io/en/latest/guides/writer/chapters/writing.html#skipping-tests
-
-While the conditions for skipping tests are often specifics of each one, there
-are recurring scenarios identified by the QEMU developers and the use of
-environment variables became a kind of standard way to enable/disable tests.
-
-Here is a list of the most used variables:
-
-AVOCADO_ALLOW_LARGE_STORAGE
-^^^^^^^^^^^^^^^^^^^^^^^^^^^
-Tests which are going to fetch or produce assets considered *large* are not
-going to run unless that ``AVOCADO_ALLOW_LARGE_STORAGE=1`` is exported on
-the environment.
-
-The definition of *large* is a bit arbitrary here, but it usually means an
-asset which occupies at least 1GB of size on disk when uncompressed.
-
-SPEED
-^^^^^
-Tests which have a long runtime will not be run unless ``SPEED=slow`` is
-exported on the environment.
-
-The definition of *long* is a bit arbitrary here, and it depends on the
-usefulness of the test too. A unique test is worth spending more time on,
-small variations on existing tests perhaps less so. As a rough guide,
-a test or set of similar tests which take more than 100 seconds to
-complete.
-
-AVOCADO_ALLOW_UNTRUSTED_CODE
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^
-There are tests which will boot a kernel image or firmware that can be
-considered not safe to run on the developer's workstation, thus they are
-skipped by default. The definition of *not safe* is also arbitrary but
-usually it means a blob which either its source or build process aren't
-public available.
-
-You should export ``AVOCADO_ALLOW_UNTRUSTED_CODE=1`` on the environment in
-order to allow tests which make use of those kind of assets.
-
-AVOCADO_TIMEOUT_EXPECTED
-^^^^^^^^^^^^^^^^^^^^^^^^
-The Avocado framework has a timeout mechanism which interrupts tests to avoid the
-test suite of getting stuck. The timeout value can be set via test parameter or
-property defined in the test class, for further details::
-
-  https://avocado-framework.readthedocs.io/en/latest/guides/writer/chapters/writing.html#setting-a-test-timeout
-
-Even though the timeout can be set by the test developer, there are some tests
-that may not have a well-defined limit of time to finish under certain
-conditions. For example, tests that take longer to execute when QEMU is
-compiled with debug flags. Therefore, the ``AVOCADO_TIMEOUT_EXPECTED`` variable
-has been used to determine whether those tests should run or not.
-
-QEMU_TEST_FLAKY_TESTS
-^^^^^^^^^^^^^^^^^^^^^
-Some tests are not working reliably and thus are disabled by default.
-This includes tests that don't run reliably on GitLab's CI which
-usually expose real issues that are rarely seen on developer machines
-due to the constraints of the CI environment. If you encounter a
-similar situation then raise a bug and then mark the test as shown on
-the code snippet below:
-
-.. code::
-
-  # See https://gitlab.com/qemu-project/qemu/-/issues/nnnn
-  @skipUnless(os.getenv('QEMU_TEST_FLAKY_TESTS'), 'Test is unstable on GitLab')
-  def test(self):
-      do_something()
-
-You can also add ``:avocado: tags=flaky`` to the test meta-data so
-only the flaky tests can be run as a group:
-
-.. code::
-
-   env QEMU_TEST_FLAKY_TESTS=1 ./pyvenv/bin/avocado \
-      run tests/avocado -filter-by-tags=flaky
-
-Tests should not live in this state forever and should either be fixed
-or eventually removed.
-
-
-Uninstalling Avocado
---------------------
-
-If you've followed the manual installation instructions above, you can
-easily uninstall Avocado.  Start by listing the packages you have
-installed::
-
-  pip list --user
-
-And remove any package you want with::
-
-  pip uninstall <package_name>
-
-If you've used ``make check-avocado``, the Python virtual environment where
-Avocado is installed will be cleaned up as part of ``make check-clean``.
diff --git a/docs/devel/testing/functional.rst b/docs/devel/testing/functional.rst
index 9bc973392a..8030cb4299 100644
--- a/docs/devel/testing/functional.rst
+++ b/docs/devel/testing/functional.rst
@@ -6,9 +6,6 @@ Functional testing with Python
 The ``tests/functional`` directory hosts functional tests written in
 Python. They are usually higher level tests, and may interact with
 external resources and with various guest operating systems.
-The functional tests have initially evolved from the Avocado tests, so there
-is a lot of similarity to those tests here (see :ref:`checkavocado-ref` for
-details about the Avocado tests).
 
 The tests should be written in the style of the Python `unittest`_ framework,
 using stdio for the TAP protocol. The folder ``tests/functional/qemu_test``
diff --git a/docs/devel/testing/index.rst b/docs/devel/testing/index.rst
index 1171f7db8f..ccc2fc6cbc 100644
--- a/docs/devel/testing/index.rst
+++ b/docs/devel/testing/index.rst
@@ -10,7 +10,6 @@ testing infrastructure.
    main
    qtest
    functional
-   avocado
    acpi-bits
    ci
    fuzzing
diff --git a/docs/devel/testing/main.rst b/docs/devel/testing/main.rst
index e56da22edf..6b18ed875c 100644
--- a/docs/devel/testing/main.rst
+++ b/docs/devel/testing/main.rst
@@ -919,21 +919,6 @@ Python. You can run the functional tests simply by executing:
 
 See :ref:`checkfunctional-ref` for more details.
 
-Integration tests using the Avocado Framework
----------------------------------------------
-
-The ``tests/avocado`` directory hosts integration tests. They're usually
-higher level tests, and may interact with external resources and with
-various guest operating systems.
-
-You can run the avocado tests simply by executing:
-
-.. code::
-
-  make check-avocado
-
-See :ref:`checkavocado-ref` for more details.
-
 .. _checktcg-ref:
 
 Testing with "make check-tcg"
diff --git a/pythondeps.toml b/pythondeps.toml
index c03c9df81b..7eaaa0fed1 100644
--- a/pythondeps.toml
+++ b/pythondeps.toml
@@ -27,9 +27,5 @@ pycotap = { accepted = ">=1.1.0", installed = "1.3.1" }
 sphinx = { accepted = ">=3.4.3", installed = "5.3.0", canary = "sphinx-build" }
 sphinx_rtd_theme = { accepted = ">=0.5", installed = "1.1.1" }
 
-[avocado]
-# Note that qemu.git/python/ is always implicitly installed.
-# Prefer an LTS version when updating the accepted versions of
-# avocado-framework, for example right now the limit is 92.x.
-avocado-framework = { accepted = "(>=103.0, <104.0)", installed = "103.0", canary = "avocado" }
-pycdlib = { accepted = ">=1.11.0" }
+[testdeps]
+qemu.qmp = { accepted = ">=0.0.3", installed = "0.0.3" }
diff --git a/tests/Makefile.include b/tests/Makefile.include
index 010369bd3a..23fb722d42 100644
--- a/tests/Makefile.include
+++ b/tests/Makefile.include
@@ -18,7 +18,6 @@ ifneq ($(filter $(all-check-targets), check-softfloat),)
 	@echo " $(MAKE) check-tcg                Run TCG tests"
 	@echo " $(MAKE) check-softfloat          Run FPU emulation tests"
 endif
-	@echo " $(MAKE) check-avocado            Run avocado (integration) tests for currently configured targets"
 	@echo
 	@echo " $(MAKE) check-report.junit.xml   Generates an aggregated XML test report"
 	@echo " $(MAKE) check-venv               Creates a Python venv for tests"
@@ -26,7 +25,6 @@ endif
 	@echo
 	@echo "The following are useful for CI builds"
 	@echo " $(MAKE) check-build              Build most test binaries"
-	@echo " $(MAKE) get-vm-images            Downloads all images used by avocado tests, according to configured targets (~350 MB each, 1.5 GB max)"
 	@echo
 	@echo
 	@echo "The variable SPEED can be set to control the gtester speed setting."
@@ -86,26 +84,12 @@ distclean-tcg: $(DISTCLEAN_TCG_TARGET_RULES)
 
 # Python venv for running tests
 
-.PHONY: check-venv check-avocado check-acceptance check-acceptance-deprecated-warning
+.PHONY: check-venv
 
 # Build up our target list from the filtered list of ninja targets
 TARGETS=$(patsubst libqemu-%.a, %, $(filter libqemu-%.a, $(ninja-targets)))
 
 TESTS_VENV_TOKEN=$(BUILD_DIR)/pyvenv/tests.group
-TESTS_RESULTS_DIR=$(BUILD_DIR)/tests/results
-ifndef AVOCADO_TESTS
-	AVOCADO_TESTS=tests/avocado
-endif
-# Controls the output generated by Avocado when running tests.
-# Any number of command separated loggers are accepted.  For more
-# information please refer to "avocado --help".
-AVOCADO_SHOW?=app
-ifndef AVOCADO_TAGS
-	AVOCADO_CMDLINE_TAGS=$(patsubst %-softmmu,-t arch:%, \
-						 $(filter %-softmmu,$(TARGETS)))
-else
-	AVOCADO_CMDLINE_TAGS=$(addprefix -t , $(AVOCADO_TAGS))
-endif
 
 quiet-venv-pip = $(quiet-@)$(call quiet-command-run, \
     $(PYTHON) -m pip -q --disable-pip-version-check $1, \
@@ -113,47 +97,11 @@ quiet-venv-pip = $(quiet-@)$(call quiet-command-run, \
 
 $(TESTS_VENV_TOKEN): $(SRC_PATH)/pythondeps.toml
 	$(call quiet-venv-pip,install -e "$(SRC_PATH)/python/")
-	$(MKVENV_ENSUREGROUP) $< avocado
+	$(MKVENV_ENSUREGROUP) $< testdeps
 	$(call quiet-command, touch $@)
 
-$(TESTS_RESULTS_DIR):
-	$(call quiet-command, mkdir -p $@, \
-            MKDIR, $@)
-
 check-venv: $(TESTS_VENV_TOKEN)
 
-FEDORA_31_ARCHES_TARGETS=$(patsubst %-softmmu,%, $(filter %-softmmu,$(TARGETS)))
-FEDORA_31_ARCHES_CANDIDATES=$(patsubst ppc64,ppc64le,$(FEDORA_31_ARCHES_TARGETS))
-FEDORA_31_ARCHES := x86_64 aarch64 ppc64le s390x
-FEDORA_31_DOWNLOAD=$(filter $(FEDORA_31_ARCHES),$(FEDORA_31_ARCHES_CANDIDATES))
-
-# download one specific Fedora 31 image
-get-vm-image-fedora-31-%: check-venv
-	$(call quiet-command, \
-             $(PYTHON) -m avocado vmimage get \
-             --distro=fedora --distro-version=31 --arch=$*, \
-	"AVOCADO", "Downloading avocado tests VM image for $*")
-
-# download all vm images, according to defined targets
-get-vm-images: check-venv $(patsubst %,get-vm-image-fedora-31-%, $(FEDORA_31_DOWNLOAD))
-
-check-avocado: check-venv $(TESTS_RESULTS_DIR) get-vm-images
-	$(call quiet-command, \
-            $(PYTHON) -m avocado \
-            --show=$(AVOCADO_SHOW) run --job-results-dir=$(TESTS_RESULTS_DIR) \
-            $(if $(AVOCADO_TAGS),, --filter-by-tags-include-empty \
-			--filter-by-tags-include-empty-key) \
-            $(AVOCADO_CMDLINE_TAGS) --max-parallel-tasks=1 \
-            $(if $(GITLAB_CI),,--failfast) $(AVOCADO_TESTS), \
-            "AVOCADO", "tests/avocado")
-
-check-acceptance-deprecated-warning:
-	@echo
-	@echo "Note '$(MAKE) check-acceptance' is deprecated, use '$(MAKE) check-avocado' instead."
-	@echo
-
-check-acceptance: check-acceptance-deprecated-warning | check-avocado
-
 FUNCTIONAL_TARGETS=$(patsubst %-softmmu,check-functional-%, $(filter %-softmmu,$(TARGETS)))
 .PHONY: $(FUNCTIONAL_TARGETS)
 $(FUNCTIONAL_TARGETS):
@@ -166,13 +114,13 @@ check-functional:
 
 # Consolidated targets
 
-.PHONY: check check-clean get-vm-images
+.PHONY: check check-clean
 check:
 
 check-build: run-ninja
 
 check-clean:
-	rm -rf $(TESTS_RESULTS_DIR)
+	rm -rf $(BUILD_DIR)/tests/functional
 
 clean: check-clean clean-tcg
 distclean: distclean-tcg
diff --git a/tests/avocado/README.rst b/tests/avocado/README.rst
deleted file mode 100644
index 94488371bb..0000000000
--- a/tests/avocado/README.rst
+++ /dev/null
@@ -1,10 +0,0 @@
-=============================================
-Integration tests using the Avocado Framework
-=============================================
-
-This directory contains integration tests. They're usually higher
-level, and may interact with external resources and with various
-guest operating systems.
-
-For more information, please refer to ``docs/devel/testing.rst``,
-section "Integration tests using the Avocado Framework".
diff --git a/tests/avocado/avocado_qemu/__init__.py b/tests/avocado/avocado_qemu/__init__.py
deleted file mode 100644
index 93c3460242..0000000000
--- a/tests/avocado/avocado_qemu/__init__.py
+++ /dev/null
@@ -1,424 +0,0 @@
-# Test class and utilities for functional tests
-#
-# Copyright (c) 2018 Red Hat, Inc.
-#
-# Author:
-#  Cleber Rosa <crosa@redhat.com>
-#
-# This work is licensed under the terms of the GNU GPL, version 2 or
-# later.  See the COPYING file in the top-level directory.
-
-import logging
-import os
-import subprocess
-import sys
-import tempfile
-import time
-import uuid
-
-import avocado
-from avocado.utils import ssh
-from avocado.utils.path import find_command
-
-from qemu.machine import QEMUMachine
-from qemu.utils import (get_info_usernet_hostfwd_port, kvm_available,
-                        tcg_available)
-
-
-#: The QEMU build root directory.  It may also be the source directory
-#: if building from the source dir, but it's safer to use BUILD_DIR for
-#: that purpose.  Be aware that if this code is moved outside of a source
-#: and build tree, it will not be accurate.
-BUILD_DIR = os.path.dirname(os.path.dirname(os.path.dirname(os.path.dirname(__file__))))
-
-
-def has_cmd(name, args=None):
-    """
-    This function is for use in a @avocado.skipUnless decorator, e.g.:
-
-        @skipUnless(*has_cmd('sudo -n', ('sudo', '-n', 'true')))
-        def test_something_that_needs_sudo(self):
-            ...
-    """
-
-    if args is None:
-        args = ('which', name)
-
-    try:
-        _, stderr, exitcode = run_cmd(args)
-    except Exception as e:
-        exitcode = -1
-        stderr = str(e)
-
-    if exitcode != 0:
-        cmd_line = ' '.join(args)
-        err = f'{name} required, but "{cmd_line}" failed: {stderr.strip()}'
-        return (False, err)
-    else:
-        return (True, '')
-
-def has_cmds(*cmds):
-    """
-    This function is for use in a @avocado.skipUnless decorator and
-    allows checking for the availability of multiple commands, e.g.:
-
-        @skipUnless(*has_cmds(('cmd1', ('cmd1', '--some-parameter')),
-                              'cmd2', 'cmd3'))
-        def test_something_that_needs_cmd1_and_cmd2(self):
-            ...
-    """
-
-    for cmd in cmds:
-        if isinstance(cmd, str):
-            cmd = (cmd,)
-
-        ok, errstr = has_cmd(*cmd)
-        if not ok:
-            return (False, errstr)
-
-    return (True, '')
-
-def run_cmd(args):
-    subp = subprocess.Popen(args,
-                            stdout=subprocess.PIPE,
-                            stderr=subprocess.PIPE,
-                            universal_newlines=True)
-    stdout, stderr = subp.communicate()
-    ret = subp.returncode
-
-    return (stdout, stderr, ret)
-
-def is_readable_executable_file(path):
-    return os.path.isfile(path) and os.access(path, os.R_OK | os.X_OK)
-
-
-def pick_default_qemu_bin(bin_prefix='qemu-system-', arch=None):
-    """
-    Picks the path of a QEMU binary, starting either in the current working
-    directory or in the source tree root directory.
-
-    :param arch: the arch to use when looking for a QEMU binary (the target
-                 will match the arch given).  If None (the default), arch
-                 will be the current host system arch (as given by
-                 :func:`os.uname`).
-    :type arch: str
-    :returns: the path to the default QEMU binary or None if one could not
-              be found
-    :rtype: str or None
-    """
-    if arch is None:
-        arch = os.uname()[4]
-    # qemu binary path does not match arch for powerpc, handle it
-    if 'ppc64le' in arch:
-        arch = 'ppc64'
-    qemu_bin_name = bin_prefix + arch
-    qemu_bin_paths = [
-        os.path.join(".", qemu_bin_name),
-        os.path.join(BUILD_DIR, qemu_bin_name),
-        os.path.join(BUILD_DIR, "build", qemu_bin_name),
-    ]
-    for path in qemu_bin_paths:
-        if is_readable_executable_file(path):
-            return path
-    return None
-
-
-def _console_interaction(test, success_message, failure_message,
-                         send_string, keep_sending=False, vm=None):
-    assert not keep_sending or send_string
-    if vm is None:
-        vm = test.vm
-    console = vm.console_file
-    console_logger = logging.getLogger('console')
-    while True:
-        if send_string:
-            vm.console_socket.sendall(send_string.encode())
-            if not keep_sending:
-                send_string = None # send only once
-
-        # Only consume console output if waiting for something
-        if success_message is None and failure_message is None:
-            if send_string is None:
-                break
-            continue
-
-        try:
-            msg = console.readline().decode().strip()
-        except UnicodeDecodeError:
-            msg = None
-        if not msg:
-            continue
-        console_logger.debug(msg)
-        if success_message is None or success_message in msg:
-            break
-        if failure_message and failure_message in msg:
-            console.close()
-            fail = 'Failure message found in console: "%s". Expected: "%s"' % \
-                    (failure_message, success_message)
-            test.fail(fail)
-
-def interrupt_interactive_console_until_pattern(test, success_message,
-                                                failure_message=None,
-                                                interrupt_string='\r'):
-    """
-    Keep sending a string to interrupt a console prompt, while logging the
-    console output. Typical use case is to break a boot loader prompt, such:
-
-        Press a key within 5 seconds to interrupt boot process.
-        5
-        4
-        3
-        2
-        1
-        Booting default image...
-
-    :param test: an Avocado test containing a VM that will have its console
-                 read and probed for a success or failure message
-    :type test: :class:`avocado_qemu.QemuSystemTest`
-    :param success_message: if this message appears, test succeeds
-    :param failure_message: if this message appears, test fails
-    :param interrupt_string: a string to send to the console before trying
-                             to read a new line
-    """
-    _console_interaction(test, success_message, failure_message,
-                         interrupt_string, True)
-
-def wait_for_console_pattern(test, success_message, failure_message=None,
-                             vm=None):
-    """
-    Waits for messages to appear on the console, while logging the content
-
-    :param test: an Avocado test containing a VM that will have its console
-                 read and probed for a success or failure message
-    :type test: :class:`avocado_qemu.QemuSystemTest`
-    :param success_message: if this message appears, test succeeds
-    :param failure_message: if this message appears, test fails
-    """
-    _console_interaction(test, success_message, failure_message, None, vm=vm)
-
-def exec_command(test, command):
-    """
-    Send a command to a console (appending CRLF characters), while logging
-    the content.
-
-    :param test: an Avocado test containing a VM.
-    :type test: :class:`avocado_qemu.QemuSystemTest`
-    :param command: the command to send
-    :type command: str
-    """
-    _console_interaction(test, None, None, command + '\r')
-
-def exec_command_and_wait_for_pattern(test, command,
-                                      success_message, failure_message=None):
-    """
-    Send a command to a console (appending CRLF characters), then wait
-    for success_message to appear on the console, while logging the.
-    content. Mark the test as failed if failure_message is found instead.
-
-    :param test: an Avocado test containing a VM that will have its console
-                 read and probed for a success or failure message
-    :type test: :class:`avocado_qemu.QemuSystemTest`
-    :param command: the command to send
-    :param success_message: if this message appears, test succeeds
-    :param failure_message: if this message appears, test fails
-    """
-    _console_interaction(test, success_message, failure_message, command + '\r')
-
-class QemuBaseTest(avocado.Test):
-
-    # default timeout for all tests, can be overridden
-    timeout = 120
-
-    def _get_unique_tag_val(self, tag_name):
-        """
-        Gets a tag value, if unique for a key
-        """
-        vals = self.tags.get(tag_name, [])
-        if len(vals) == 1:
-            return vals.pop()
-        return None
-
-    def setUp(self, bin_prefix):
-        self.arch = self.params.get('arch',
-                                    default=self._get_unique_tag_val('arch'))
-
-        self.cpu = self.params.get('cpu',
-                                   default=self._get_unique_tag_val('cpu'))
-
-        default_qemu_bin = pick_default_qemu_bin(bin_prefix, arch=self.arch)
-        self.qemu_bin = self.params.get('qemu_bin',
-                                        default=default_qemu_bin)
-        if self.qemu_bin is None:
-            self.cancel("No QEMU binary defined or found in the build tree")
-
-    def fetch_asset(self, name,
-                    asset_hash, algorithm=None,
-                    locations=None, expire=None,
-                    find_only=False, cancel_on_missing=True):
-        return super().fetch_asset(name,
-                        asset_hash=asset_hash,
-                        algorithm=algorithm,
-                        locations=locations,
-                        expire=expire,
-                        find_only=find_only,
-                        cancel_on_missing=cancel_on_missing)
-
-
-class QemuSystemTest(QemuBaseTest):
-    """Facilitates system emulation tests."""
-
-    def setUp(self):
-        self._vms = {}
-
-        super().setUp('qemu-system-')
-
-        accel_required = self._get_unique_tag_val('accel')
-        if accel_required:
-            self.require_accelerator(accel_required)
-
-        self.machine = self.params.get('machine',
-                                       default=self._get_unique_tag_val('machine'))
-
-    def require_accelerator(self, accelerator):
-        """
-        Requires an accelerator to be available for the test to continue
-
-        It takes into account the currently set qemu binary.
-
-        If the check fails, the test is canceled.  If the check itself
-        for the given accelerator is not available, the test is also
-        canceled.
-
-        :param accelerator: name of the accelerator, such as "kvm" or "tcg"
-        :type accelerator: str
-        """
-        checker = {'tcg': tcg_available,
-                   'kvm': kvm_available}.get(accelerator)
-        if checker is None:
-            self.cancel("Don't know how to check for the presence "
-                        "of accelerator %s" % accelerator)
-        if not checker(qemu_bin=self.qemu_bin):
-            self.cancel("%s accelerator does not seem to be "
-                        "available" % accelerator)
-
-    def require_netdev(self, netdevname):
-        netdevhelp = run_cmd([self.qemu_bin,
-                             '-M', 'none', '-netdev', 'help'])[0];
-        if netdevhelp.find('\n' + netdevname + '\n') < 0:
-            self.cancel('no support for user networking')
-
-    def _new_vm(self, name, *args):
-        self._sd = tempfile.TemporaryDirectory(prefix="qemu_")
-        vm = QEMUMachine(self.qemu_bin, base_temp_dir=self.workdir,
-                         log_dir=self.logdir)
-        self.log.debug('QEMUMachine "%s" created', name)
-        self.log.debug('QEMUMachine "%s" temp_dir: %s', name, vm.temp_dir)
-        self.log.debug('QEMUMachine "%s" log_dir: %s', name, vm.log_dir)
-        if args:
-            vm.add_args(*args)
-        return vm
-
-    def get_qemu_img(self):
-        self.log.debug('Looking for and selecting a qemu-img binary')
-
-        # If qemu-img has been built, use it, otherwise the system wide one
-        # will be used.
-        qemu_img = os.path.join(BUILD_DIR, 'qemu-img')
-        if not os.path.exists(qemu_img):
-            qemu_img = find_command('qemu-img', False)
-        if qemu_img is False:
-            self.cancel('Could not find "qemu-img"')
-
-        return qemu_img
-
-    @property
-    def vm(self):
-        return self.get_vm(name='default')
-
-    def get_vm(self, *args, name=None):
-        if not name:
-            name = str(uuid.uuid4())
-        if self._vms.get(name) is None:
-            self._vms[name] = self._new_vm(name, *args)
-            if self.cpu is not None:
-                self._vms[name].add_args('-cpu', self.cpu)
-            if self.machine is not None:
-                self._vms[name].set_machine(self.machine)
-        return self._vms[name]
-
-    def set_vm_arg(self, arg, value):
-        """
-        Set an argument to list of extra arguments to be given to the QEMU
-        binary. If the argument already exists then its value is replaced.
-
-        :param arg: the QEMU argument, such as "-cpu" in "-cpu host"
-        :type arg: str
-        :param value: the argument value, such as "host" in "-cpu host"
-        :type value: str
-        """
-        if not arg or not value:
-            return
-        if arg not in self.vm.args:
-            self.vm.args.extend([arg, value])
-        else:
-            idx = self.vm.args.index(arg) + 1
-            if idx < len(self.vm.args):
-                self.vm.args[idx] = value
-            else:
-                self.vm.args.append(value)
-
-    def tearDown(self):
-        for vm in self._vms.values():
-            vm.shutdown()
-        self._sd = None
-        super().tearDown()
-
-
-class LinuxSSHMixIn:
-    """Contains utility methods for interacting with a guest via SSH."""
-
-    def ssh_connect(self, username, credential, credential_is_key=True):
-        self.ssh_logger = logging.getLogger('ssh')
-        res = self.vm.cmd('human-monitor-command',
-                          command_line='info usernet')
-        port = get_info_usernet_hostfwd_port(res)
-        self.assertIsNotNone(port)
-        self.assertGreater(port, 0)
-        self.log.debug('sshd listening on port: %d', port)
-        if credential_is_key:
-            self.ssh_session = ssh.Session('127.0.0.1', port=port,
-                                           user=username, key=credential)
-        else:
-            self.ssh_session = ssh.Session('127.0.0.1', port=port,
-                                           user=username, password=credential)
-        for i in range(10):
-            try:
-                self.ssh_session.connect()
-                return
-            except:
-                time.sleep(i)
-        self.fail('ssh connection timeout')
-
-    def ssh_command(self, command):
-        self.ssh_logger.info(command)
-        result = self.ssh_session.cmd(command)
-        stdout_lines = [line.rstrip() for line
-                        in result.stdout_text.splitlines()]
-        for line in stdout_lines:
-            self.ssh_logger.info(line)
-        stderr_lines = [line.rstrip() for line
-                        in result.stderr_text.splitlines()]
-        for line in stderr_lines:
-            self.ssh_logger.warning(line)
-
-        self.assertEqual(result.exit_status, 0,
-                         f'Guest command failed: {command}')
-        return stdout_lines, stderr_lines
-
-    def ssh_command_output_contains(self, cmd, exp):
-        stdout, _ = self.ssh_command(cmd)
-        for line in stdout:
-            if exp in line:
-                break
-        else:
-            self.fail('"%s" output does not contain "%s"' % (cmd, exp))
diff --git a/tests/avocado/avocado_qemu/linuxtest.py b/tests/avocado/avocado_qemu/linuxtest.py
deleted file mode 100644
index 66fb9f1507..0000000000
--- a/tests/avocado/avocado_qemu/linuxtest.py
+++ /dev/null
@@ -1,253 +0,0 @@
-# Test class and utilities for functional Linux-based tests
-#
-# Copyright (c) 2018 Red Hat, Inc.
-#
-# Author:
-#  Cleber Rosa <crosa@redhat.com>
-#
-# This work is licensed under the terms of the GNU GPL, version 2 or
-# later.  See the COPYING file in the top-level directory.
-
-import os
-import shutil
-
-from avocado.utils import cloudinit, datadrainer, process, vmimage
-
-from avocado_qemu import LinuxSSHMixIn
-from avocado_qemu import QemuSystemTest
-
-if os.path.islink(os.path.dirname(os.path.dirname(__file__))):
-    # The link to the avocado tests dir in the source code directory
-    lnk = os.path.dirname(os.path.dirname(__file__))
-    #: The QEMU root source directory
-    SOURCE_DIR = os.path.dirname(os.path.dirname(os.readlink(lnk)))
-else:
-    SOURCE_DIR = BUILD_DIR
-
-class LinuxDistro:
-    """Represents a Linux distribution
-
-    Holds information of known distros.
-    """
-    #: A collection of known distros and their respective image checksum
-    KNOWN_DISTROS = {
-        'fedora': {
-            '31': {
-                'x86_64':
-                {'checksum': ('e3c1b309d9203604922d6e255c2c5d09'
-                              '8a309c2d46215d8fc026954f3c5c27a0'),
-                 'pxeboot_url': ('https://archives.fedoraproject.org/'
-                                 'pub/archive/fedora/linux/releases/31/'
-                                 'Everything/x86_64/os/images/pxeboot/'),
-                 'kernel_params': ('root=UUID=b1438b9b-2cab-4065-a99a-'
-                                   '08a96687f73c ro no_timer_check '
-                                   'net.ifnames=0 console=tty1 '
-                                   'console=ttyS0,115200n8'),
-                },
-                'aarch64':
-                {'checksum': ('1e18d9c0cf734940c4b5d5ec592facae'
-                              'd2af0ad0329383d5639c997fdf16fe49'),
-                'pxeboot_url': 'https://archives.fedoraproject.org/'
-                               'pub/archive/fedora/linux/releases/31/'
-                               'Everything/aarch64/os/images/pxeboot/',
-                'kernel_params': ('root=UUID=b6950a44-9f3c-4076-a9c2-'
-                                  '355e8475b0a7 ro earlyprintk=pl011,0x9000000'
-                                  ' ignore_loglevel no_timer_check'
-                                  ' printk.time=1 rd_NO_PLYMOUTH'
-                                  ' console=ttyAMA0'),
-                },
-                'ppc64':
-                {'checksum': ('7c3528b85a3df4b2306e892199a9e1e4'
-                              '3f991c506f2cc390dc4efa2026ad2f58')},
-                's390x':
-                {'checksum': ('4caaab5a434fd4d1079149a072fdc789'
-                              '1e354f834d355069ca982fdcaf5a122d')},
-            },
-            '32': {
-                'aarch64':
-                {'checksum': ('b367755c664a2d7a26955bbfff985855'
-                              'adfa2ca15e908baf15b4b176d68d3967'),
-                'pxeboot_url': ('http://dl.fedoraproject.org/pub/fedora/linux/'
-                                'releases/32/Server/aarch64/os/images/'
-                                'pxeboot/'),
-                'kernel_params': ('root=UUID=3df75b65-be8d-4db4-8655-'
-                                  '14d95c0e90c5 ro no_timer_check net.ifnames=0'
-                                  ' console=tty1 console=ttyS0,115200n8'),
-                },
-            },
-            '33': {
-                'aarch64':
-                {'checksum': ('e7f75cdfd523fe5ac2ca9eeece68edc1'
-                              'a81f386a17f969c1d1c7c87031008a6b'),
-                'pxeboot_url': ('http://dl.fedoraproject.org/pub/fedora/linux/'
-                                'releases/33/Server/aarch64/os/images/'
-                                'pxeboot/'),
-                'kernel_params': ('root=UUID=d20b3ffa-6397-4a63-a734-'
-                                  '1126a0208f8a ro no_timer_check net.ifnames=0'
-                                  ' console=tty1 console=ttyS0,115200n8'
-                                  ' console=tty0'),
-                 },
-            },
-        }
-    }
-
-    def __init__(self, name, version, arch):
-        self.name = name
-        self.version = version
-        self.arch = arch
-        try:
-            info = self.KNOWN_DISTROS.get(name).get(version).get(arch)
-        except AttributeError:
-            # Unknown distro
-            info = None
-        self._info = info or {}
-
-    @property
-    def checksum(self):
-        """Gets the cloud-image file checksum"""
-        return self._info.get('checksum', None)
-
-    @checksum.setter
-    def checksum(self, value):
-        self._info['checksum'] = value
-
-    @property
-    def pxeboot_url(self):
-        """Gets the repository url where pxeboot files can be found"""
-        return self._info.get('pxeboot_url', None)
-
-    @property
-    def default_kernel_params(self):
-        """Gets the default kernel parameters"""
-        return self._info.get('kernel_params', None)
-
-
-class LinuxTest(LinuxSSHMixIn, QemuSystemTest):
-    """Facilitates having a cloud-image Linux based available.
-
-    For tests that intend to interact with guests, this is a better choice
-    to start with than the more vanilla `QemuSystemTest` class.
-    """
-
-    distro = None
-    username = 'root'
-    password = 'password'
-    smp = '2'
-    memory = '1024'
-
-    def _set_distro(self):
-        distro_name = self.params.get(
-            'distro',
-            default=self._get_unique_tag_val('distro'))
-        if not distro_name:
-            distro_name = 'fedora'
-
-        distro_version = self.params.get(
-            'distro_version',
-            default=self._get_unique_tag_val('distro_version'))
-        if not distro_version:
-            distro_version = '31'
-
-        self.distro = LinuxDistro(distro_name, distro_version, self.arch)
-
-        # The distro checksum behaves differently than distro name and
-        # version. First, it does not respect a tag with the same
-        # name, given that it's not expected to be used for filtering
-        # (distro name versions are the natural choice).  Second, the
-        # order of precedence is: parameter, attribute and then value
-        # from KNOWN_DISTROS.
-        distro_checksum = self.params.get('distro_checksum',
-                                          default=None)
-        if distro_checksum:
-            self.distro.checksum = distro_checksum
-
-    def setUp(self, ssh_pubkey=None, network_device_type='virtio-net'):
-        super().setUp()
-        self.require_netdev('user')
-        self._set_distro()
-        self.vm.add_args('-smp', self.smp)
-        self.vm.add_args('-m', self.memory)
-        # The following network device allows for SSH connections
-        self.vm.add_args('-netdev', 'user,id=vnet,hostfwd=:127.0.0.1:0-:22',
-                         '-device', '%s,netdev=vnet' % network_device_type)
-        self.set_up_boot()
-        if ssh_pubkey is None:
-            ssh_pubkey, self.ssh_key = self.set_up_existing_ssh_keys()
-        self.set_up_cloudinit(ssh_pubkey)
-
-    def set_up_existing_ssh_keys(self):
-        ssh_public_key = os.path.join(SOURCE_DIR, 'tests', 'keys', 'id_rsa.pub')
-        source_private_key = os.path.join(SOURCE_DIR, 'tests', 'keys', 'id_rsa')
-        ssh_dir = os.path.join(self.workdir, '.ssh')
-        os.mkdir(ssh_dir, mode=0o700)
-        ssh_private_key = os.path.join(ssh_dir,
-                                       os.path.basename(source_private_key))
-        shutil.copyfile(source_private_key, ssh_private_key)
-        os.chmod(ssh_private_key, 0o600)
-        return (ssh_public_key, ssh_private_key)
-
-    def download_boot(self):
-        # Set the qemu-img binary.
-        # If none is available, the test will cancel.
-        vmimage.QEMU_IMG = super().get_qemu_img()
-
-        self.log.info('Downloading/preparing boot image')
-        # Fedora 31 only provides ppc64le images
-        image_arch = self.arch
-        if self.distro.name == 'fedora':
-            if image_arch == 'ppc64':
-                image_arch = 'ppc64le'
-
-        try:
-            boot = vmimage.get(
-                self.distro.name, arch=image_arch, version=self.distro.version,
-                checksum=self.distro.checksum,
-                algorithm='sha256',
-                cache_dir=self.cache_dirs[0],
-                snapshot_dir=self.workdir)
-        except:
-            self.cancel('Failed to download/prepare boot image')
-        return boot.path
-
-    def prepare_cloudinit(self, ssh_pubkey=None):
-        self.log.info('Preparing cloudinit image')
-        try:
-            cloudinit_iso = os.path.join(self.workdir, 'cloudinit.iso')
-            pubkey_content = None
-            if ssh_pubkey:
-                with open(ssh_pubkey) as pubkey:
-                    pubkey_content = pubkey.read()
-            cloudinit.iso(cloudinit_iso, self.name,
-                          username=self.username,
-                          password=self.password,
-                          # QEMU's hard coded usermode router address
-                          phone_home_host='10.0.2.2',
-                          phone_home_port=self.phone_server.server_port,
-                          authorized_key=pubkey_content)
-        except Exception:
-            self.cancel('Failed to prepare the cloudinit image')
-        return cloudinit_iso
-
-    def set_up_boot(self):
-        path = self.download_boot()
-        self.vm.add_args('-drive', 'file=%s' % path)
-
-    def set_up_cloudinit(self, ssh_pubkey=None):
-        self.phone_server = cloudinit.PhoneHomeServer(('0.0.0.0', 0),
-                                                      self.name)
-        cloudinit_iso = self.prepare_cloudinit(ssh_pubkey)
-        self.vm.add_args('-drive', 'file=%s,format=raw' % cloudinit_iso)
-
-    def launch_and_wait(self, set_up_ssh_connection=True):
-        self.vm.set_console()
-        self.vm.launch()
-        console_drainer = datadrainer.LineLogger(self.vm.console_socket.fileno(),
-                                                 logger=self.log.getChild('console'))
-        console_drainer.start()
-        self.log.info('VM launched, waiting for boot confirmation from guest')
-        while not self.phone_server.instance_phoned_back:
-            self.phone_server.handle_request()
-
-        if set_up_ssh_connection:
-            self.log.info('Setting up the SSH connection')
-            self.ssh_connect(self.username, self.ssh_key)

From 858640eaee9f3039580118f5629825825cea311a Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Thu, 27 Mar 2025 21:13:05 +0100
Subject: [PATCH 0071/2760] tests/functional: Remove semicolons at the end of
 lines
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Yes, we are all C coders who try to write Python code for testing...
but still, let's better avoid semicolons at the end of the lines
to keep "pylint" happy!

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Message-ID: <20250327201305.996241-1-thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/functional/aspeed.py                    |  2 +-
 tests/functional/test_aarch64_aspeed.py       |  2 +-
 tests/functional/test_arm_aspeed_ast2500.py   |  6 ++--
 tests/functional/test_arm_aspeed_ast2600.py   | 36 +++++++++----------
 tests/functional/test_arm_aspeed_bletchley.py |  4 +--
 tests/functional/test_arm_aspeed_palmetto.py  |  4 +--
 tests/functional/test_arm_aspeed_romulus.py   |  4 +--
 .../functional/test_arm_aspeed_witherspoon.py |  4 +--
 tests/functional/test_arm_bpim2u.py           |  2 +-
 tests/functional/test_arm_cubieboard.py       |  2 +-
 tests/functional/test_arm_orangepi.py         |  2 +-
 tests/functional/test_s390x_topology.py       | 12 +++----
 12 files changed, 40 insertions(+), 40 deletions(-)

diff --git a/tests/functional/aspeed.py b/tests/functional/aspeed.py
index 77dc8930fa..7a40d5dda7 100644
--- a/tests/functional/aspeed.py
+++ b/tests/functional/aspeed.py
@@ -44,7 +44,7 @@ class AspeedTest(LinuxKernelTest):
 
     def do_test_arm_aspeed_buildroot_poweroff(self):
         exec_command_and_wait_for_pattern(self, 'poweroff',
-                                          'System halted');
+                                          'System halted')
 
     def do_test_arm_aspeed_sdk_start(self, image):
         self.require_netdev('user')
diff --git a/tests/functional/test_aarch64_aspeed.py b/tests/functional/test_aarch64_aspeed.py
index c25c966278..c7f3b3b319 100755
--- a/tests/functional/test_aarch64_aspeed.py
+++ b/tests/functional/test_aarch64_aspeed.py
@@ -85,7 +85,7 @@ class AST2x00MachineSDK(QemuSystemTest):
 
         exec_command_and_wait_for_pattern(self,
             'echo lm75 0x4d > /sys/class/i2c-dev/i2c-1/device/new_device ',
-            'i2c i2c-1: new_device: Instantiated device lm75 at 0x4d');
+            'i2c i2c-1: new_device: Instantiated device lm75 at 0x4d')
         exec_command_and_wait_for_pattern(self,
             'cat /sys/bus/i2c/devices/1-004d/hwmon/hwmon*/temp1_input', '0')
         self.vm.cmd('qom-set', path='/machine/peripheral/tmp-test',
diff --git a/tests/functional/test_arm_aspeed_ast2500.py b/tests/functional/test_arm_aspeed_ast2500.py
index 1ffba6c995..ddc6459f71 100755
--- a/tests/functional/test_arm_aspeed_ast2500.py
+++ b/tests/functional/test_arm_aspeed_ast2500.py
@@ -22,17 +22,17 @@ class AST2500Machine(AspeedTest):
         image_path = self.ASSET_BR2_202411_AST2500_FLASH.fetch()
 
         self.vm.add_args('-device',
-                         'tmp105,bus=aspeed.i2c.bus.3,address=0x4d,id=tmp-test');
+                         'tmp105,bus=aspeed.i2c.bus.3,address=0x4d,id=tmp-test')
         self.do_test_arm_aspeed_buildroot_start(image_path, '0x0',
                                                 'ast2500-evb login:')
 
         exec_command_and_wait_for_pattern(self,
              'echo lm75 0x4d > /sys/class/i2c-dev/i2c-3/device/new_device',
-             'i2c i2c-3: new_device: Instantiated device lm75 at 0x4d');
+             'i2c i2c-3: new_device: Instantiated device lm75 at 0x4d')
         exec_command_and_wait_for_pattern(self,
                              'cat /sys/class/hwmon/hwmon1/temp1_input', '0')
         self.vm.cmd('qom-set', path='/machine/peripheral/tmp-test',
-                    property='temperature', value=18000);
+                    property='temperature', value=18000)
         exec_command_and_wait_for_pattern(self,
                              'cat /sys/class/hwmon/hwmon1/temp1_input', '18000')
 
diff --git a/tests/functional/test_arm_aspeed_ast2600.py b/tests/functional/test_arm_aspeed_ast2600.py
index 6ae4ed636a..5ef52f0659 100755
--- a/tests/functional/test_arm_aspeed_ast2600.py
+++ b/tests/functional/test_arm_aspeed_ast2600.py
@@ -27,38 +27,38 @@ class AST2600Machine(AspeedTest):
         image_path = self.ASSET_BR2_202411_AST2600_FLASH.fetch()
 
         self.vm.add_args('-device',
-                         'tmp105,bus=aspeed.i2c.bus.3,address=0x4d,id=tmp-test');
+                         'tmp105,bus=aspeed.i2c.bus.3,address=0x4d,id=tmp-test')
         self.vm.add_args('-device',
-                         'ds1338,bus=aspeed.i2c.bus.3,address=0x32');
+                         'ds1338,bus=aspeed.i2c.bus.3,address=0x32')
         self.vm.add_args('-device',
-                         'i2c-echo,bus=aspeed.i2c.bus.3,address=0x42');
+                         'i2c-echo,bus=aspeed.i2c.bus.3,address=0x42')
         self.do_test_arm_aspeed_buildroot_start(image_path, '0xf00',
                                                 'ast2600-evb login:')
 
         exec_command_and_wait_for_pattern(self,
              'echo lm75 0x4d > /sys/class/i2c-dev/i2c-3/device/new_device',
-             'i2c i2c-3: new_device: Instantiated device lm75 at 0x4d');
+             'i2c i2c-3: new_device: Instantiated device lm75 at 0x4d')
         exec_command_and_wait_for_pattern(self,
                              'cat /sys/class/hwmon/hwmon1/temp1_input', '0')
         self.vm.cmd('qom-set', path='/machine/peripheral/tmp-test',
-                    property='temperature', value=18000);
+                    property='temperature', value=18000)
         exec_command_and_wait_for_pattern(self,
                              'cat /sys/class/hwmon/hwmon1/temp1_input', '18000')
 
         exec_command_and_wait_for_pattern(self,
              'echo ds1307 0x32 > /sys/class/i2c-dev/i2c-3/device/new_device',
-             'i2c i2c-3: new_device: Instantiated device ds1307 at 0x32');
+             'i2c i2c-3: new_device: Instantiated device ds1307 at 0x32')
         year = time.strftime("%Y")
-        exec_command_and_wait_for_pattern(self, 'hwclock -f /dev/rtc1', year);
+        exec_command_and_wait_for_pattern(self, 'hwclock -f /dev/rtc1', year)
 
         exec_command_and_wait_for_pattern(self,
              'echo slave-24c02 0x1064 > /sys/bus/i2c/devices/i2c-3/new_device',
-             'i2c i2c-3: new_device: Instantiated device slave-24c02 at 0x64');
+             'i2c i2c-3: new_device: Instantiated device slave-24c02 at 0x64')
         exec_command_and_wait_for_pattern(self,
-             'i2cset -y 3 0x42 0x64 0x00 0xaa i', '#');
+             'i2cset -y 3 0x42 0x64 0x00 0xaa i', '#')
         exec_command_and_wait_for_pattern(self,
              'hexdump /sys/bus/i2c/devices/3-1064/slave-eeprom',
-             '0000000 ffaa ffff ffff ffff ffff ffff ffff ffff');
+             '0000000 ffaa ffff ffff ffff ffff ffff ffff ffff')
         self.do_test_arm_aspeed_buildroot_poweroff()
 
     ASSET_BR2_202302_AST2600_TPM_FLASH = Asset(
@@ -90,10 +90,10 @@ class AST2600Machine(AspeedTest):
 
         exec_command_and_wait_for_pattern(self,
             'echo tpm_tis_i2c 0x2e > /sys/bus/i2c/devices/i2c-12/new_device',
-            'tpm_tis_i2c 12-002e: 2.0 TPM (device-id 0x1, rev-id 1)');
+            'tpm_tis_i2c 12-002e: 2.0 TPM (device-id 0x1, rev-id 1)')
         exec_command_and_wait_for_pattern(self,
             'cat /sys/class/tpm/tpm0/pcr-sha256/0',
-            'B804724EA13F52A9072BA87FE8FDCC497DFC9DF9AA15B9088694639C431688E0');
+            'B804724EA13F52A9072BA87FE8FDCC497DFC9DF9AA15B9088694639C431688E0')
 
         self.do_test_arm_aspeed_buildroot_poweroff()
 
@@ -107,9 +107,9 @@ class AST2600Machine(AspeedTest):
         self.archive_extract(self.ASSET_SDK_V806_AST2600_A2)
 
         self.vm.add_args('-device',
-            'tmp105,bus=aspeed.i2c.bus.5,address=0x4d,id=tmp-test');
+            'tmp105,bus=aspeed.i2c.bus.5,address=0x4d,id=tmp-test')
         self.vm.add_args('-device',
-            'ds1338,bus=aspeed.i2c.bus.5,address=0x32');
+            'ds1338,bus=aspeed.i2c.bus.5,address=0x32')
         self.do_test_arm_aspeed_sdk_start(
             self.scratch_file("ast2600-a2", "image-bmc"))
 
@@ -120,20 +120,20 @@ class AST2600Machine(AspeedTest):
 
         exec_command_and_wait_for_pattern(self,
             'echo lm75 0x4d > /sys/class/i2c-dev/i2c-5/device/new_device',
-            'i2c i2c-5: new_device: Instantiated device lm75 at 0x4d');
+            'i2c i2c-5: new_device: Instantiated device lm75 at 0x4d')
         exec_command_and_wait_for_pattern(self,
              'cat /sys/class/hwmon/hwmon19/temp1_input', '0')
         self.vm.cmd('qom-set', path='/machine/peripheral/tmp-test',
-                    property='temperature', value=18000);
+                    property='temperature', value=18000)
         exec_command_and_wait_for_pattern(self,
              'cat /sys/class/hwmon/hwmon19/temp1_input', '18000')
 
         exec_command_and_wait_for_pattern(self,
              'echo ds1307 0x32 > /sys/class/i2c-dev/i2c-5/device/new_device',
-             'i2c i2c-5: new_device: Instantiated device ds1307 at 0x32');
+             'i2c i2c-5: new_device: Instantiated device ds1307 at 0x32')
         year = time.strftime("%Y")
         exec_command_and_wait_for_pattern(self,
-             '/sbin/hwclock -f /dev/rtc1', year);
+             '/sbin/hwclock -f /dev/rtc1', year)
 
 if __name__ == '__main__':
     AspeedTest.main()
diff --git a/tests/functional/test_arm_aspeed_bletchley.py b/tests/functional/test_arm_aspeed_bletchley.py
index 0da856c5ed..5a60b24b3d 100644
--- a/tests/functional/test_arm_aspeed_bletchley.py
+++ b/tests/functional/test_arm_aspeed_bletchley.py
@@ -12,14 +12,14 @@ class BletchleyMachine(AspeedTest):
 
     ASSET_BLETCHLEY_FLASH = Asset(
         'https://github.com/legoater/qemu-aspeed-boot/raw/master/images/bletchley-bmc/openbmc-20250128071329/obmc-phosphor-image-bletchley-20250128071329.static.mtd.xz',
-        'db21d04d47d7bb2a276f59d308614b4dfb70b9c7c81facbbca40a3977a2d8844');
+        'db21d04d47d7bb2a276f59d308614b4dfb70b9c7c81facbbca40a3977a2d8844')
 
     def test_arm_ast2600_bletchley_openbmc(self):
         image_path = self.uncompress(self.ASSET_BLETCHLEY_FLASH)
 
         self.do_test_arm_aspeed_openbmc('bletchley-bmc', image=image_path,
                                         uboot='2019.04', cpu_id='0xf00',
-                                        soc='AST2600 rev A3');
+                                        soc='AST2600 rev A3')
 
 if __name__ == '__main__':
     AspeedTest.main()
diff --git a/tests/functional/test_arm_aspeed_palmetto.py b/tests/functional/test_arm_aspeed_palmetto.py
index 35d832bc98..ff0b821be6 100755
--- a/tests/functional/test_arm_aspeed_palmetto.py
+++ b/tests/functional/test_arm_aspeed_palmetto.py
@@ -12,14 +12,14 @@ class PalmettoMachine(AspeedTest):
 
     ASSET_PALMETTO_FLASH = Asset(
         'https://github.com/legoater/qemu-aspeed-boot/raw/master/images/palmetto-bmc/openbmc-20250128071432/obmc-phosphor-image-palmetto-20250128071432.static.mtd',
-        'bce7c392eec75c707a91cfc8fad7ca9a69d7e4f10df936930d65c1cb9897ac81');
+        'bce7c392eec75c707a91cfc8fad7ca9a69d7e4f10df936930d65c1cb9897ac81')
 
     def test_arm_ast2400_palmetto_openbmc(self):
         image_path = self.ASSET_PALMETTO_FLASH.fetch()
 
         self.do_test_arm_aspeed_openbmc('palmetto-bmc', image=image_path,
                                         uboot='2019.04', cpu_id='0x0',
-                                        soc='AST2400 rev A1');
+                                        soc='AST2400 rev A1')
 
 if __name__ == '__main__':
     AspeedTest.main()
diff --git a/tests/functional/test_arm_aspeed_romulus.py b/tests/functional/test_arm_aspeed_romulus.py
index b97ed951b1..0447212bbf 100755
--- a/tests/functional/test_arm_aspeed_romulus.py
+++ b/tests/functional/test_arm_aspeed_romulus.py
@@ -12,14 +12,14 @@ class RomulusMachine(AspeedTest):
 
     ASSET_ROMULUS_FLASH = Asset(
         'https://github.com/legoater/qemu-aspeed-boot/raw/master/images/romulus-bmc/openbmc-20250128071340/obmc-phosphor-image-romulus-20250128071340.static.mtd',
-        '6d031376440c82ed9d087d25e9fa76aea75b42f80daa252ec402c0bc3cf6cf5b');
+        '6d031376440c82ed9d087d25e9fa76aea75b42f80daa252ec402c0bc3cf6cf5b')
 
     def test_arm_ast2500_romulus_openbmc(self):
         image_path = self.ASSET_ROMULUS_FLASH.fetch()
 
         self.do_test_arm_aspeed_openbmc('romulus-bmc', image=image_path,
                                         uboot='2019.04', cpu_id='0x0',
-                                        soc='AST2500 rev A1');
+                                        soc='AST2500 rev A1')
 
 if __name__ == '__main__':
     AspeedTest.main()
diff --git a/tests/functional/test_arm_aspeed_witherspoon.py b/tests/functional/test_arm_aspeed_witherspoon.py
index ea1ce89b05..51a2d47af2 100644
--- a/tests/functional/test_arm_aspeed_witherspoon.py
+++ b/tests/functional/test_arm_aspeed_witherspoon.py
@@ -12,14 +12,14 @@ class WitherspoonMachine(AspeedTest):
 
     ASSET_WITHERSPOON_FLASH = Asset(
         'https://github.com/legoater/qemu-aspeed-boot/raw/master/images/witherspoon-bmc/openbmc-20240618035022/obmc-phosphor-image-witherspoon-20240618035022.ubi.mtd',
-        '937d9ed449ea6c6cbed983519088a42d0cafe276bcfe4fce07772ca6673f9213');
+        '937d9ed449ea6c6cbed983519088a42d0cafe276bcfe4fce07772ca6673f9213')
 
     def test_arm_ast2500_witherspoon_openbmc(self):
         image_path = self.ASSET_WITHERSPOON_FLASH.fetch()
 
         self.do_test_arm_aspeed_openbmc('witherspoon-bmc', image=image_path,
                                         uboot='2016.07', cpu_id='0x0',
-                                        soc='AST2500 rev A1');
+                                        soc='AST2500 rev A1')
 
 if __name__ == '__main__':
     AspeedTest.main()
diff --git a/tests/functional/test_arm_bpim2u.py b/tests/functional/test_arm_bpim2u.py
index 8de6ccba88..8bed64b702 100755
--- a/tests/functional/test_arm_bpim2u.py
+++ b/tests/functional/test_arm_bpim2u.py
@@ -163,7 +163,7 @@ class BananaPiMachine(LinuxKernelTest):
                 self, 'Hit any key to stop autoboot:', '=>')
         exec_command_and_wait_for_pattern(self, "setenv extraargs '" +
                                                 kernel_command_line + "'", '=>')
-        exec_command_and_wait_for_pattern(self, 'boot', 'Starting kernel ...');
+        exec_command_and_wait_for_pattern(self, 'boot', 'Starting kernel ...')
 
         self.wait_for_console_pattern(
             'Please press Enter to activate this console.')
diff --git a/tests/functional/test_arm_cubieboard.py b/tests/functional/test_arm_cubieboard.py
index b87a28154d..1eaca0272b 100755
--- a/tests/functional/test_arm_cubieboard.py
+++ b/tests/functional/test_arm_cubieboard.py
@@ -128,7 +128,7 @@ class CubieboardMachine(LinuxKernelTest):
                 self, 'Hit any key to stop autoboot:', '=>')
         exec_command_and_wait_for_pattern(self, "setenv extraargs '" +
                                                 kernel_command_line + "'", '=>')
-        exec_command_and_wait_for_pattern(self, 'boot', 'Starting kernel ...');
+        exec_command_and_wait_for_pattern(self, 'boot', 'Starting kernel ...')
 
         self.wait_for_console_pattern(
             'Please press Enter to activate this console.')
diff --git a/tests/functional/test_arm_orangepi.py b/tests/functional/test_arm_orangepi.py
index 1815f56e02..f9bfa8c78d 100755
--- a/tests/functional/test_arm_orangepi.py
+++ b/tests/functional/test_arm_orangepi.py
@@ -174,7 +174,7 @@ class OrangePiMachine(LinuxKernelTest):
         exec_command_and_wait_for_pattern(self, ' ', '=>')
         exec_command_and_wait_for_pattern(self, "setenv extraargs '" +
                                                 kernel_command_line + "'", '=>')
-        exec_command_and_wait_for_pattern(self, 'boot', 'Starting kernel ...');
+        exec_command_and_wait_for_pattern(self, 'boot', 'Starting kernel ...')
 
         self.wait_for_console_pattern('systemd[1]: Hostname set ' +
                                       'to <orangepipc>')
diff --git a/tests/functional/test_s390x_topology.py b/tests/functional/test_s390x_topology.py
index eefd9729cb..1b5dc65135 100755
--- a/tests/functional/test_s390x_topology.py
+++ b/tests/functional/test_s390x_topology.py
@@ -217,12 +217,12 @@ class S390CPUTopology(QemuSystemTest):
         self.assertEqual(res['return']['polarization'], 'horizontal')
         self.check_topology(0, 0, 0, 0, 'medium', False)
 
-        self.guest_set_dispatching('1');
+        self.guest_set_dispatching('1')
         res = self.vm.qmp('query-s390x-cpu-polarization')
         self.assertEqual(res['return']['polarization'], 'vertical')
         self.check_topology(0, 0, 0, 0, 'medium', False)
 
-        self.guest_set_dispatching('0');
+        self.guest_set_dispatching('0')
         res = self.vm.qmp('query-s390x-cpu-polarization')
         self.assertEqual(res['return']['polarization'], 'horizontal')
         self.check_topology(0, 0, 0, 0, 'medium', False)
@@ -283,7 +283,7 @@ class S390CPUTopology(QemuSystemTest):
         self.check_polarization('vertical:high')
         self.check_topology(0, 0, 0, 0, 'high', False)
 
-        self.guest_set_dispatching('0');
+        self.guest_set_dispatching('0')
         self.check_polarization("horizontal")
         self.check_topology(0, 0, 0, 0, 'high', False)
 
@@ -310,11 +310,11 @@ class S390CPUTopology(QemuSystemTest):
         self.check_topology(0, 0, 0, 0, 'high', True)
         self.check_polarization("horizontal")
 
-        self.guest_set_dispatching('1');
+        self.guest_set_dispatching('1')
         self.check_topology(0, 0, 0, 0, 'high', True)
         self.check_polarization("vertical:high")
 
-        self.guest_set_dispatching('0');
+        self.guest_set_dispatching('0')
         self.check_topology(0, 0, 0, 0, 'high', True)
         self.check_polarization("horizontal")
 
@@ -360,7 +360,7 @@ class S390CPUTopology(QemuSystemTest):
 
         self.check_topology(0, 0, 0, 0, 'high', True)
 
-        self.guest_set_dispatching('1');
+        self.guest_set_dispatching('1')
 
         self.check_topology(0, 0, 0, 0, 'high', True)
 

From 99fb9256b761c3cec4a82d2e9597b6cf24ae1285 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Mon, 14 Apr 2025 16:54:57 +0200
Subject: [PATCH 0072/2760] tests/functional: Remove unnecessary import
 statements
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

pylint complains about these unnecessary import statements,
so let's remove them.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250414145457.261734-1-thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/functional/qemu_test/ports.py              | 3 +--
 tests/functional/qemu_test/tuxruntest.py         | 2 --
 tests/functional/qemu_test/uncompress.py         | 2 +-
 tests/functional/test_aarch64_rme_sbsaref.py     | 6 ++----
 tests/functional/test_aarch64_rme_virt.py        | 2 --
 tests/functional/test_aarch64_sbsaref_alpine.py  | 3 ---
 tests/functional/test_aarch64_sbsaref_freebsd.py | 2 --
 tests/functional/test_aarch64_tcg_plugins.py     | 1 -
 tests/functional/test_aarch64_virt.py            | 8 ++------
 tests/functional/test_arm_aspeed_ast2500.py      | 3 +--
 tests/functional/test_arm_cubieboard.py          | 2 --
 tests/functional/test_arm_quanta_gsj.py          | 2 --
 tests/functional/test_arm_smdkc210.py            | 2 --
 tests/functional/test_migration.py               | 3 +--
 tests/functional/test_mips64el_replay.py         | 6 +-----
 tests/functional/test_mips_replay.py             | 2 +-
 tests/functional/test_mipsel_replay.py           | 2 +-
 tests/functional/test_ppc64_hv.py                | 8 ++++----
 tests/functional/test_vnc.py                     | 4 ++--
 tests/functional/test_x86_64_kvm_xen.py          | 2 --
 20 files changed, 17 insertions(+), 48 deletions(-)

diff --git a/tests/functional/qemu_test/ports.py b/tests/functional/qemu_test/ports.py
index cc39939d48..631b77abf6 100644
--- a/tests/functional/qemu_test/ports.py
+++ b/tests/functional/qemu_test/ports.py
@@ -10,12 +10,11 @@
 import fcntl
 import os
 import socket
-import sys
-import tempfile
 
 from .config import BUILD_DIR
 from typing import List
 
+
 class Ports():
 
     PORTS_ADDR = '127.0.0.1'
diff --git a/tests/functional/qemu_test/tuxruntest.py b/tests/functional/qemu_test/tuxruntest.py
index c2bd5baaae..6c442ff0dc 100644
--- a/tests/functional/qemu_test/tuxruntest.py
+++ b/tests/functional/qemu_test/tuxruntest.py
@@ -10,8 +10,6 @@
 # SPDX-License-Identifier: GPL-2.0-or-later
 
 import os
-import stat
-from subprocess import check_call, DEVNULL
 
 from qemu_test import QemuSystemTest
 from qemu_test import exec_command_and_wait_for_pattern
diff --git a/tests/functional/qemu_test/uncompress.py b/tests/functional/qemu_test/uncompress.py
index ce79da1b68..b7ef8f759b 100644
--- a/tests/functional/qemu_test/uncompress.py
+++ b/tests/functional/qemu_test/uncompress.py
@@ -13,7 +13,7 @@ import os
 import stat
 import shutil
 from urllib.parse import urlparse
-from subprocess import run, CalledProcessError, DEVNULL
+from subprocess import run, CalledProcessError
 
 from .asset import Asset
 
diff --git a/tests/functional/test_aarch64_rme_sbsaref.py b/tests/functional/test_aarch64_rme_sbsaref.py
index 0f4f6103a1..746770e776 100755
--- a/tests/functional/test_aarch64_rme_sbsaref.py
+++ b/tests/functional/test_aarch64_rme_sbsaref.py
@@ -9,15 +9,13 @@
 #
 # SPDX-License-Identifier: GPL-2.0-or-later
 
-import time
 import os
-import logging
 
-from qemu_test import QemuSystemTest, Asset
-from qemu_test import exec_command, wait_for_console_pattern
+from qemu_test import QemuSystemTest, Asset, wait_for_console_pattern
 from qemu_test import exec_command_and_wait_for_pattern
 from test_aarch64_rme_virt import test_realms_guest
 
+
 class Aarch64RMESbsaRefMachine(QemuSystemTest):
 
     # Stack is built with OP-TEE build environment from those instructions:
diff --git a/tests/functional/test_aarch64_rme_virt.py b/tests/functional/test_aarch64_rme_virt.py
index a1abf584f0..8452d27928 100755
--- a/tests/functional/test_aarch64_rme_virt.py
+++ b/tests/functional/test_aarch64_rme_virt.py
@@ -9,9 +9,7 @@
 #
 # SPDX-License-Identifier: GPL-2.0-or-later
 
-import time
 import os
-import logging
 
 from qemu_test import QemuSystemTest, Asset
 from qemu_test import exec_command, wait_for_console_pattern
diff --git a/tests/functional/test_aarch64_sbsaref_alpine.py b/tests/functional/test_aarch64_sbsaref_alpine.py
index c660cc7a40..6108ec65a5 100755
--- a/tests/functional/test_aarch64_sbsaref_alpine.py
+++ b/tests/functional/test_aarch64_sbsaref_alpine.py
@@ -10,11 +10,8 @@
 #
 # SPDX-License-Identifier: GPL-2.0-or-later
 
-import os
-
 from qemu_test import QemuSystemTest, Asset, skipSlowTest
 from qemu_test import wait_for_console_pattern
-from unittest import skipUnless
 from test_aarch64_sbsaref import fetch_firmware
 
 
diff --git a/tests/functional/test_aarch64_sbsaref_freebsd.py b/tests/functional/test_aarch64_sbsaref_freebsd.py
index bd6728dc70..26dfc5878b 100755
--- a/tests/functional/test_aarch64_sbsaref_freebsd.py
+++ b/tests/functional/test_aarch64_sbsaref_freebsd.py
@@ -10,8 +10,6 @@
 #
 # SPDX-License-Identifier: GPL-2.0-or-later
 
-import os
-
 from qemu_test import QemuSystemTest, Asset, skipSlowTest
 from qemu_test import wait_for_console_pattern
 from test_aarch64_sbsaref import fetch_firmware
diff --git a/tests/functional/test_aarch64_tcg_plugins.py b/tests/functional/test_aarch64_tcg_plugins.py
index 4ea71f5f88..cb7e9298fb 100755
--- a/tests/functional/test_aarch64_tcg_plugins.py
+++ b/tests/functional/test_aarch64_tcg_plugins.py
@@ -13,7 +13,6 @@
 
 import tempfile
 import mmap
-import os
 import re
 
 from qemu.machine.machine import VMLaunchFailure
diff --git a/tests/functional/test_aarch64_virt.py b/tests/functional/test_aarch64_virt.py
index 884aad7af6..4d0ad90ff8 100755
--- a/tests/functional/test_aarch64_virt.py
+++ b/tests/functional/test_aarch64_virt.py
@@ -13,12 +13,8 @@
 import logging
 from subprocess import check_call, DEVNULL
 
-from qemu.machine.machine import VMLaunchFailure
-
-from qemu_test import QemuSystemTest, Asset
-from qemu_test import exec_command, exec_command_and_wait_for_pattern
-from qemu_test import wait_for_console_pattern
-from qemu_test import skipIfMissingCommands, get_qemu_img
+from qemu_test import QemuSystemTest, Asset, exec_command_and_wait_for_pattern
+from qemu_test import wait_for_console_pattern, get_qemu_img
 
 
 class Aarch64VirtMachine(QemuSystemTest):
diff --git a/tests/functional/test_arm_aspeed_ast2500.py b/tests/functional/test_arm_aspeed_ast2500.py
index ddc6459f71..a3b44572fc 100755
--- a/tests/functional/test_arm_aspeed_ast2500.py
+++ b/tests/functional/test_arm_aspeed_ast2500.py
@@ -4,9 +4,8 @@
 #
 # SPDX-License-Identifier: GPL-2.0-or-later
 
-from qemu_test import Asset
+from qemu_test import Asset, exec_command_and_wait_for_pattern
 from aspeed import AspeedTest
-from qemu_test import exec_command_and_wait_for_pattern
 
 
 class AST2500Machine(AspeedTest):
diff --git a/tests/functional/test_arm_cubieboard.py b/tests/functional/test_arm_cubieboard.py
index 1eaca0272b..b536c2f77a 100755
--- a/tests/functional/test_arm_cubieboard.py
+++ b/tests/functional/test_arm_cubieboard.py
@@ -4,8 +4,6 @@
 #
 # SPDX-License-Identifier: GPL-2.0-or-later
 
-import os
-
 from qemu_test import LinuxKernelTest, Asset, exec_command_and_wait_for_pattern
 from qemu_test import interrupt_interactive_console_until_pattern
 from qemu_test import skipBigDataTest
diff --git a/tests/functional/test_arm_quanta_gsj.py b/tests/functional/test_arm_quanta_gsj.py
index da60aeb659..cb0545f7bf 100755
--- a/tests/functional/test_arm_quanta_gsj.py
+++ b/tests/functional/test_arm_quanta_gsj.py
@@ -4,8 +4,6 @@
 #
 # SPDX-License-Identifier: GPL-2.0-or-later
 
-import os
-
 from qemu_test import LinuxKernelTest, Asset, exec_command_and_wait_for_pattern
 from qemu_test import interrupt_interactive_console_until_pattern, skipSlowTest
 
diff --git a/tests/functional/test_arm_smdkc210.py b/tests/functional/test_arm_smdkc210.py
index 0fda45c63a..3154e7f732 100755
--- a/tests/functional/test_arm_smdkc210.py
+++ b/tests/functional/test_arm_smdkc210.py
@@ -4,8 +4,6 @@
 #
 # SPDX-License-Identifier: GPL-2.0-or-later
 
-import os
-
 from qemu_test import LinuxKernelTest, Asset
 
 
diff --git a/tests/functional/test_migration.py b/tests/functional/test_migration.py
index 181223a69e..c4393c3543 100755
--- a/tests/functional/test_migration.py
+++ b/tests/functional/test_migration.py
@@ -11,14 +11,13 @@
 # This work is licensed under the terms of the GNU GPL, version 2 or
 # later.  See the COPYING file in the top-level directory.
 
-
 import tempfile
-import os
 import time
 
 from qemu_test import QemuSystemTest, skipIfMissingCommands
 from qemu_test.ports import Ports
 
+
 class MigrationTest(QemuSystemTest):
 
     timeout = 10
diff --git a/tests/functional/test_mips64el_replay.py b/tests/functional/test_mips64el_replay.py
index 4f63d7fb34..26a6ccff3f 100755
--- a/tests/functional/test_mips64el_replay.py
+++ b/tests/functional/test_mips64el_replay.py
@@ -4,11 +4,7 @@
 #
 # SPDX-License-Identifier: GPL-2.0-or-later
 
-import os
-import logging
-
-from qemu_test import Asset, exec_command_and_wait_for_pattern
-from qemu_test import skipIfMissingImports, skipFlakyTest, skipUntrustedTest
+from qemu_test import Asset, skipUntrustedTest
 from replay_kernel import ReplayKernelBase
 
 
diff --git a/tests/functional/test_mips_replay.py b/tests/functional/test_mips_replay.py
index eda031ccad..4327481e35 100755
--- a/tests/functional/test_mips_replay.py
+++ b/tests/functional/test_mips_replay.py
@@ -4,7 +4,7 @@
 #
 # SPDX-License-Identifier: GPL-2.0-or-later
 
-from qemu_test import Asset, skipSlowTest, exec_command_and_wait_for_pattern
+from qemu_test import Asset, skipSlowTest
 from replay_kernel import ReplayKernelBase
 
 
diff --git a/tests/functional/test_mipsel_replay.py b/tests/functional/test_mipsel_replay.py
index 0a330de43f..5f4796cf89 100644
--- a/tests/functional/test_mipsel_replay.py
+++ b/tests/functional/test_mipsel_replay.py
@@ -4,7 +4,7 @@
 #
 # SPDX-License-Identifier: GPL-2.0-or-later
 
-from qemu_test import Asset, wait_for_console_pattern, skipSlowTest
+from qemu_test import Asset, skipSlowTest
 from replay_kernel import ReplayKernelBase
 
 
diff --git a/tests/functional/test_ppc64_hv.py b/tests/functional/test_ppc64_hv.py
index 1920e91f18..d87f440fa7 100755
--- a/tests/functional/test_ppc64_hv.py
+++ b/tests/functional/test_ppc64_hv.py
@@ -9,14 +9,14 @@
 # This work is licensed under the terms of the GNU GPL, version 2 or
 # later.  See the COPYING file in the top-level directory.
 
+import os
+import subprocess
+
+from datetime import datetime
 from qemu_test import QemuSystemTest, Asset
 from qemu_test import wait_for_console_pattern, exec_command
 from qemu_test import skipIfMissingCommands, skipBigDataTest
 from qemu_test import exec_command_and_wait_for_pattern
-import os
-import time
-import subprocess
-from datetime import datetime
 
 # Alpine is a light weight distro that supports QEMU. These tests boot
 # that on the machine then run a QEMU guest inside it in KVM mode,
diff --git a/tests/functional/test_vnc.py b/tests/functional/test_vnc.py
index d4e9dd0279..5c0ee5f927 100755
--- a/tests/functional/test_vnc.py
+++ b/tests/functional/test_vnc.py
@@ -11,12 +11,12 @@
 # later.  See the COPYING file in the top-level directory.
 
 import socket
-from typing import List
-from qemu.machine.machine import VMLaunchFailure
 
+from qemu.machine.machine import VMLaunchFailure
 from qemu_test import QemuSystemTest
 from qemu_test.ports import Ports
 
+
 VNC_ADDR = '127.0.0.1'
 
 def check_connect(port: int) -> bool:
diff --git a/tests/functional/test_x86_64_kvm_xen.py b/tests/functional/test_x86_64_kvm_xen.py
index c6abf6bba3..a5d445023c 100755
--- a/tests/functional/test_x86_64_kvm_xen.py
+++ b/tests/functional/test_x86_64_kvm_xen.py
@@ -11,8 +11,6 @@
 #
 # SPDX-License-Identifier: GPL-2.0-or-later
 
-import os
-
 from qemu.machine import machine
 
 from qemu_test import QemuSystemTest, Asset, exec_command_and_wait_for_pattern

From 12c6b6153063aafcdbadca8fee7eac793ef85e4b Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Mon, 14 Apr 2025 14:15:20 +0200
Subject: [PATCH 0073/2760] MAINTAINERS: Add functional tests that are not
 covered yet
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Some functional tests are currently not covered by the entries
in MAINTAINERS yet, so scripts/get_maintainers.pl fails to suggest
the right people who should be CC:-ed for related patches.
Add the uncovered tests to the right sections to close this gap.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250414121520.213665-1-thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 MAINTAINERS | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/MAINTAINERS b/MAINTAINERS
index 5fd757c5dd..c6d9b022f9 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -475,6 +475,7 @@ F: docs/system/i386/sgx.rst
 F: target/i386/kvm/
 F: target/i386/sev*
 F: scripts/kvm/vmxcap
+F: tests/functional/test_x86_64_hotplug_cpu.py
 
 Xen emulation on X86 KVM CPUs
 M: David Woodhouse <dwmw2@infradead.org>
@@ -626,6 +627,7 @@ S: Maintained
 F: hw/alpha/
 F: hw/isa/smc37c669-superio.c
 F: tests/tcg/alpha/system/
+F: tests/functional/test_alpha_clipper.py
 
 ARM Machines
 ------------
@@ -950,7 +952,7 @@ F: hw/misc/sbsa_ec.c
 F: hw/watchdog/sbsa_gwdt.c
 F: include/hw/watchdog/sbsa_gwdt.h
 F: docs/system/arm/sbsa.rst
-F: tests/functional/test_aarch64_sbsaref*.py
+F: tests/functional/test_aarch64_*sbsaref*.py
 
 Sharp SL-5500 (Collie) PDA
 M: Peter Maydell <peter.maydell@linaro.org>
@@ -1019,9 +1021,10 @@ S: Maintained
 F: hw/arm/virt*
 F: include/hw/arm/virt.h
 F: docs/system/arm/virt.rst
-F: tests/functional/test_aarch64_virt*.py
+F: tests/functional/test_aarch64_*virt*.py
 F: tests/functional/test_aarch64_tuxrun.py
 F: tests/functional/test_arm_tuxrun.py
+F: tests/functional/test_arm_virt.py
 
 Xilinx Zynq
 M: Edgar E. Iglesias <edgar.iglesias@gmail.com>
@@ -1262,6 +1265,7 @@ F: hw/m68k/mcf_intc.c
 F: hw/char/mcf_uart.c
 F: hw/net/mcf_fec.c
 F: include/hw/m68k/mcf*.h
+F: tests/functional/test_m68k_mcf5208evb.py
 
 NeXTcube
 M: Thomas Huth <huth@tuxfamily.org>
@@ -1406,6 +1410,7 @@ S: Maintained
 F: docs/system/openrisc/or1k-sim.rst
 F: hw/intc/ompic.c
 F: hw/openrisc/openrisc_sim.c
+F: tests/functional/test_or1k_sim.py
 
 PowerPC Machines
 ----------------
@@ -1827,6 +1832,7 @@ F: include/hw/isa/apm.h
 F: tests/unit/test-x86-topo.c
 F: tests/qtest/test-x86-cpuid-compat.c
 F: tests/functional/test_i386_tuxrun.py
+F: tests/functional/test_linux_initrd.py
 F: tests/functional/test_mem_addr_space.py
 F: tests/functional/test_pc_cpu_hotplug_props.py
 F: tests/functional/test_x86_64_tuxrun.py
@@ -3150,6 +3156,7 @@ F: include/ui/
 F: qapi/ui.json
 F: util/drm.c
 F: docs/devel/ui.rst
+F: tests/functional/test_vnc.py
 
 Cocoa graphics
 M: Peter Maydell <peter.maydell@linaro.org>
@@ -3815,6 +3822,7 @@ F: configs/targets/*linux-user.mak
 F: scripts/qemu-binfmt-conf.sh
 F: scripts/update-syscalltbl.sh
 F: scripts/update-mips-syscall-args.sh
+F: tests/functional/test_arm_bflt.py
 
 Tiny Code Generator (TCG)
 -------------------------
@@ -4187,6 +4195,7 @@ F: hw/remote/vfio-user-obj.c
 F: include/hw/remote/vfio-user-obj.h
 F: hw/remote/iommu.c
 F: include/hw/remote/iommu.h
+F: tests/functional/test_multiprocess.py
 
 EBPF:
 M: Jason Wang <jasowang@redhat.com>

From 8163eeee4e5b6ce5ecb2f7300b80ae8a6f868afd Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Mon, 14 Apr 2025 22:49:40 +0800
Subject: [PATCH 0074/2760] rust/hpet: convert num_timers to u8 type

The C version of HPET uses the uint8_t type for num_timers, and usize
type in Rust version will break migration between the C and Rust
versions.

So convert num_timers' type to u8 (consistent with the C version of
HPET) to make it friendly for vmstate support.

Note the commit 7bda68e8e2b0 ("qdev, rust/hpet: fix type of HPET
'timers property") supports the usize type property, but the uint8
property has to be re-supported now.

Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250414144943.1112885-7-zhao1.liu@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/hw/timer/hpet/src/hpet.rs | 31 ++++++++++++++++++-------------
 1 file changed, 18 insertions(+), 13 deletions(-)

diff --git a/rust/hw/timer/hpet/src/hpet.rs b/rust/hw/timer/hpet/src/hpet.rs
index 3ae3ec25f1..1afa891362 100644
--- a/rust/hw/timer/hpet/src/hpet.rs
+++ b/rust/hw/timer/hpet/src/hpet.rs
@@ -12,7 +12,7 @@ use std::{
 use qemu_api::{
     bindings::{
         address_space_memory, address_space_stl_le, qdev_prop_bit, qdev_prop_bool,
-        qdev_prop_uint32, qdev_prop_usize,
+        qdev_prop_uint32, qdev_prop_uint8,
     },
     c_str,
     cell::{BqlCell, BqlRefCell},
@@ -34,9 +34,9 @@ use crate::fw_cfg::HPETFwConfig;
 const HPET_REG_SPACE_LEN: u64 = 0x400; // 1024 bytes
 
 /// Minimum recommended hardware implementation.
-const HPET_MIN_TIMERS: usize = 3;
+const HPET_MIN_TIMERS: u8 = 3;
 /// Maximum timers in each timer block.
-const HPET_MAX_TIMERS: usize = 32;
+const HPET_MAX_TIMERS: u8 = 32;
 
 /// Flags that HPETState.flags supports.
 const HPET_FLAG_MSI_SUPPORT_SHIFT: usize = 0;
@@ -559,14 +559,19 @@ pub struct HPETState {
 
     /// HPET timer array managed by this timer block.
     #[doc(alias = "timer")]
-    timers: [BqlRefCell<HPETTimer>; HPET_MAX_TIMERS],
-    num_timers: BqlCell<usize>,
+    timers: [BqlRefCell<HPETTimer>; HPET_MAX_TIMERS as usize],
+    num_timers: BqlCell<u8>,
 
     /// Instance id (HPET timer block ID).
     hpet_id: BqlCell<usize>,
 }
 
 impl HPETState {
+    // Get num_timers with `usize` type, which is useful to play with array index.
+    fn get_num_timers(&self) -> usize {
+        self.num_timers.get().into()
+    }
+
     const fn has_msi_flag(&self) -> bool {
         self.flags & (1 << HPET_FLAG_MSI_SUPPORT_SHIFT) != 0
     }
@@ -628,7 +633,7 @@ impl HPETState {
             self.hpet_offset
                 .set(ticks_to_ns(self.counter.get()) - CLOCK_VIRTUAL.get_ns());
 
-            for timer in self.timers.iter().take(self.num_timers.get()) {
+            for timer in self.timers.iter().take(self.get_num_timers()) {
                 let mut t = timer.borrow_mut();
 
                 if t.is_int_enabled() && t.is_int_active() {
@@ -640,7 +645,7 @@ impl HPETState {
             // Halt main counter and disable interrupt generation.
             self.counter.set(self.get_ticks());
 
-            for timer in self.timers.iter().take(self.num_timers.get()) {
+            for timer in self.timers.iter().take(self.get_num_timers()) {
                 timer.borrow_mut().del_timer();
             }
         }
@@ -663,7 +668,7 @@ impl HPETState {
         let new_val = val << shift;
         let cleared = new_val & self.int_status.get();
 
-        for (index, timer) in self.timers.iter().take(self.num_timers.get()).enumerate() {
+        for (index, timer) in self.timers.iter().take(self.get_num_timers()).enumerate() {
             if cleared & (1 << index) != 0 {
                 timer.borrow_mut().update_irq(false);
             }
@@ -737,7 +742,7 @@ impl HPETState {
             1 << HPET_CAP_COUNT_SIZE_CAP_SHIFT |
             1 << HPET_CAP_LEG_RT_CAP_SHIFT |
             HPET_CAP_VENDER_ID_VALUE << HPET_CAP_VENDER_ID_SHIFT |
-            ((self.num_timers.get() - 1) as u64) << HPET_CAP_NUM_TIM_SHIFT | // indicate the last timer
+            ((self.get_num_timers() - 1) as u64) << HPET_CAP_NUM_TIM_SHIFT | // indicate the last timer
             (HPET_CLK_PERIOD * FS_PER_NS) << HPET_CAP_CNT_CLK_PERIOD_SHIFT, // 10 ns
         );
 
@@ -746,7 +751,7 @@ impl HPETState {
     }
 
     fn reset_hold(&self, _type: ResetType) {
-        for timer in self.timers.iter().take(self.num_timers.get()) {
+        for timer in self.timers.iter().take(self.get_num_timers()) {
             timer.borrow_mut().reset();
         }
 
@@ -774,7 +779,7 @@ impl HPETState {
             GlobalRegister::try_from(addr).map(HPETRegister::Global)
         } else {
             let timer_id: usize = ((addr - 0x100) / 0x20) as usize;
-            if timer_id <= self.num_timers.get() {
+            if timer_id <= self.get_num_timers() {
                 // TODO: Add trace point - trace_hpet_ram_[read|write]_timer_id(timer_id)
                 TimerRegister::try_from(addr & 0x18)
                     .map(|reg| HPETRegister::Timer(&self.timers[timer_id], reg))
@@ -859,8 +864,8 @@ qemu_api::declare_properties! {
         c_str!("timers"),
         HPETState,
         num_timers,
-        unsafe { &qdev_prop_usize },
-        usize,
+        unsafe { &qdev_prop_uint8 },
+        u8,
         default = HPET_MIN_TIMERS
     ),
     qemu_api::define_property!(

From 64e1256b21395eb7c8a9419faba4187dea73970d Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Mon, 14 Apr 2025 22:49:41 +0800
Subject: [PATCH 0075/2760] rust/hpet: convert HPETTimer index to u8 type

The C version of HPET uses the uint8_t type for timer index ("tn"), and
usize type in Rust version will break migration between the C and Rust
versions.

So convert HPETTimer index' type to u8 (consistent with the C version of
HPET) to make it friendly for vmstate support.

Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250414144943.1112885-8-zhao1.liu@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/hw/timer/hpet/src/hpet.rs | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/rust/hw/timer/hpet/src/hpet.rs b/rust/hw/timer/hpet/src/hpet.rs
index 1afa891362..dc8a23f29d 100644
--- a/rust/hw/timer/hpet/src/hpet.rs
+++ b/rust/hw/timer/hpet/src/hpet.rs
@@ -184,7 +184,7 @@ fn timer_handler(timer_cell: &BqlRefCell<HPETTimer>) {
 pub struct HPETTimer {
     /// timer N index within the timer block (`HPETState`)
     #[doc(alias = "tn")]
-    index: usize,
+    index: u8,
     qemu_timer: Timer,
     /// timer block abstraction containing this timer
     state: NonNull<HPETState>,
@@ -210,7 +210,7 @@ pub struct HPETTimer {
 }
 
 impl HPETTimer {
-    fn init(&mut self, index: usize, state: &HPETState) {
+    fn init(&mut self, index: u8, state: &HPETState) {
         *self = HPETTimer {
             index,
             // SAFETY: the HPETTimer will only be used after the timer
@@ -235,7 +235,7 @@ impl HPETTimer {
             Timer::NS,
             0,
             timer_handler,
-            &state.timers[self.index],
+            &state.timers[self.index as usize],
         )
     }
 
@@ -246,7 +246,7 @@ impl HPETTimer {
     }
 
     fn is_int_active(&self) -> bool {
-        self.get_state().is_timer_int_active(self.index)
+        self.get_state().is_timer_int_active(self.index.into())
     }
 
     const fn is_fsb_route_enabled(&self) -> bool {
@@ -611,7 +611,7 @@ impl HPETState {
 
     fn init_timer(&self) {
         for (index, timer) in self.timers.iter().enumerate() {
-            timer.borrow_mut().init(index, self);
+            timer.borrow_mut().init(index.try_into().unwrap(), self);
         }
     }
 

From ad3ab01bb7380f8cc8cf86dd260ce751148d6d21 Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Mon, 14 Apr 2025 22:49:43 +0800
Subject: [PATCH 0076/2760] rust/hpet: Fix a clippy error

Carge clippy complained about:

error: casts from `u8` to `u32` can be expressed infallibly using `From`

So use `From` to convert `u8` to `u32`.

Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250414144943.1112885-10-zhao1.liu@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/hw/timer/hpet/src/hpet.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rust/hw/timer/hpet/src/hpet.rs b/rust/hw/timer/hpet/src/hpet.rs
index dc8a23f29d..cbd2ed4f6b 100644
--- a/rust/hw/timer/hpet/src/hpet.rs
+++ b/rust/hw/timer/hpet/src/hpet.rs
@@ -353,7 +353,7 @@ impl HPETTimer {
         // still operate and generate appropriate status bits, but
         // will not cause an interrupt"
         self.get_state()
-            .update_int_status(self.index as u32, set && self.is_int_level_triggered());
+            .update_int_status(self.index.into(), set && self.is_int_level_triggered());
         self.set_irq(set);
     }
 

From d031d2fac9b94126ed0cd440da9e69e229d88aef Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Mon, 14 Apr 2025 22:49:38 +0800
Subject: [PATCH 0077/2760] rust/vmstate_test: Fix typo in
 test_vmstate_macro_array_of_pointer_wrapped()

test_vmstate_macro_array_of_pointer_wrapped() tests the 3rd element, so
fix the index.

Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250414144943.1112885-5-zhao1.liu@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/qemu-api/tests/vmstate_tests.rs | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/rust/qemu-api/tests/vmstate_tests.rs b/rust/qemu-api/tests/vmstate_tests.rs
index b8d8b45b19..8b93492a68 100644
--- a/rust/qemu-api/tests/vmstate_tests.rs
+++ b/rust/qemu-api/tests/vmstate_tests.rs
@@ -383,12 +383,12 @@ fn test_vmstate_macro_array_of_pointer_wrapped() {
     );
     assert_eq!(foo_fields[3].offset, (FOO_ARRAY_MAX + 2) * PTR_SIZE);
     assert_eq!(foo_fields[3].num_offset, 0);
-    assert_eq!(foo_fields[2].info, unsafe { &vmstate_info_uint8 });
+    assert_eq!(foo_fields[3].info, unsafe { &vmstate_info_uint8 });
     assert_eq!(foo_fields[3].version_id, 0);
     assert_eq!(foo_fields[3].size, PTR_SIZE);
     assert_eq!(foo_fields[3].num, FOO_ARRAY_MAX as i32);
     assert_eq!(
-        foo_fields[2].flags.0,
+        foo_fields[3].flags.0,
         VMStateFlags::VMS_ARRAY.0 | VMStateFlags::VMS_ARRAY_OF_POINTER.0
     );
     assert!(foo_fields[3].vmsd.is_null());

From efc5603292bfde97fd82fabcedce86310bedbc65 Mon Sep 17 00:00:00 2001
From: Rakesh Jeyasingh <rakeshjb010@gmail.com>
Date: Mon, 7 Apr 2025 23:43:26 +0530
Subject: [PATCH 0078/2760] rust/hw/char/pl011: Extract extract DR read logic
 into separate function

- Split `read()` DR case into `read_data_register()`

Signed-off-by: Rakesh Jeyasingh <rakeshjb010@gmail.com>
Link: https://lore.kernel.org/r/20250407181327.171563-2-rakeshjb010@gmail.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/hw/char/pl011/src/device.rs | 39 ++++++++++++++++----------------
 1 file changed, 20 insertions(+), 19 deletions(-)

diff --git a/rust/hw/char/pl011/src/device.rs b/rust/hw/char/pl011/src/device.rs
index bf88e0b00a..87153cdae1 100644
--- a/rust/hw/char/pl011/src/device.rs
+++ b/rust/hw/char/pl011/src/device.rs
@@ -190,25 +190,7 @@ impl PL011Registers {
 
         let mut update = false;
         let result = match offset {
-            DR => {
-                self.flags.set_receive_fifo_full(false);
-                let c = self.read_fifo[self.read_pos];
-                if self.read_count > 0 {
-                    self.read_count -= 1;
-                    self.read_pos = (self.read_pos + 1) & (self.fifo_depth() - 1);
-                }
-                if self.read_count == 0 {
-                    self.flags.set_receive_fifo_empty(true);
-                }
-                if self.read_count + 1 == self.read_trigger {
-                    self.int_level &= !Interrupt::RX.0;
-                }
-                // Update error bits.
-                self.receive_status_error_clear.set_from_data(c);
-                // Must call qemu_chr_fe_accept_input
-                update = true;
-                u32::from(c)
-            }
+            DR => self.read_data_register(&mut update),
             RSR => u32::from(self.receive_status_error_clear),
             FR => u32::from(self.flags),
             FBRD => self.fbrd,
@@ -306,6 +288,25 @@ impl PL011Registers {
         false
     }
 
+    fn read_data_register(&mut self, update: &mut bool) -> u32 {
+        self.flags.set_receive_fifo_full(false);
+        let c = self.read_fifo[self.read_pos];
+
+        if self.read_count > 0 {
+            self.read_count -= 1;
+            self.read_pos = (self.read_pos + 1) & (self.fifo_depth() - 1);
+        }
+        if self.read_count == 0 {
+            self.flags.set_receive_fifo_empty(true);
+        }
+        if self.read_count + 1 == self.read_trigger {
+            self.int_level &= !Interrupt::RX.0;
+        }
+        self.receive_status_error_clear.set_from_data(c);
+        *update = true;
+        u32::from(c)
+    }
+
     #[inline]
     #[must_use]
     fn loopback_tx(&mut self, value: registers::Data) -> bool {

From 6d8c6dee3a767e7650e5d0640e13adb9f01fa37c Mon Sep 17 00:00:00 2001
From: Rakesh Jeyasingh <rakeshjb010@gmail.com>
Date: Mon, 7 Apr 2025 23:43:27 +0530
Subject: [PATCH 0079/2760] rust/hw/char/pl011: Extract DR write logic into
 separate function

- Split `write()` DR case into `write_data_register()`

Signed-off-by: Rakesh Jeyasingh <rakeshjb010@gmail.com>
Link: https://lore.kernel.org/r/20250407181327.171563-3-rakeshjb010@gmail.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/hw/char/pl011/src/device.rs | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/rust/hw/char/pl011/src/device.rs b/rust/hw/char/pl011/src/device.rs
index 87153cdae1..bb2a0f207a 100644
--- a/rust/hw/char/pl011/src/device.rs
+++ b/rust/hw/char/pl011/src/device.rs
@@ -221,12 +221,7 @@ impl PL011Registers {
         // eprintln!("write offset {offset} value {value}");
         use RegisterOffset::*;
         match offset {
-            DR => {
-                // interrupts always checked
-                let _ = self.loopback_tx(value.into());
-                self.int_level |= Interrupt::TX.0;
-                return true;
-            }
+            DR => return self.write_data_register(value),
             RSR => {
                 self.receive_status_error_clear = 0.into();
             }
@@ -307,6 +302,13 @@ impl PL011Registers {
         u32::from(c)
     }
 
+    fn write_data_register(&mut self, value: u32) -> bool {
+        // interrupts always checked
+        let _ = self.loopback_tx(value.into());
+        self.int_level |= Interrupt::TX.0;
+        true
+    }
+
     #[inline]
     #[must_use]
     fn loopback_tx(&mut self, value: registers::Data) -> bool {

From cfac5cdff51ba72780a22bc63a7c8092c8761af3 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 17 Mar 2025 11:34:00 -0700
Subject: [PATCH 0080/2760] exec/tswap: target code can use TARGET_BIG_ENDIAN
 instead of target_words_bigendian()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250317183417.285700-2-pierrick.bouvier@linaro.org>
---
 cpu-target.c         |  1 +
 include/exec/tswap.h | 11 ++++++-----
 2 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/cpu-target.c b/cpu-target.c
index cae77374b3..519b0f8900 100644
--- a/cpu-target.c
+++ b/cpu-target.c
@@ -155,6 +155,7 @@ void cpu_abort(CPUState *cpu, const char *fmt, ...)
     abort();
 }
 
+#undef target_words_bigendian
 bool target_words_bigendian(void)
 {
     return TARGET_BIG_ENDIAN;
diff --git a/include/exec/tswap.h b/include/exec/tswap.h
index ecd4faef01..2683da0adb 100644
--- a/include/exec/tswap.h
+++ b/include/exec/tswap.h
@@ -13,13 +13,14 @@
 /**
  * target_words_bigendian:
  * Returns true if the (default) endianness of the target is big endian,
- * false otherwise. Note that in target-specific code, you can use
- * TARGET_BIG_ENDIAN directly instead. On the other hand, common
- * code should normally never need to know about the endianness of the
- * target, so please do *not* use this function unless you know very well
- * what you are doing!
+ * false otherwise. Common code should normally never need to know about the
+ * endianness of the target, so please do *not* use this function unless you
+ * know very well what you are doing!
  */
 bool target_words_bigendian(void);
+#ifdef COMPILING_PER_TARGET
+#define target_words_bigendian()  TARGET_BIG_ENDIAN
+#endif
 
 /*
  * If we're in target-specific code, we can hard-code the swapping

From 663310b05c43e59cfe97b9add7b645b3f495cd42 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 17 Mar 2025 11:34:01 -0700
Subject: [PATCH 0081/2760] exec/tswap: implement {ld,st}.*_p as functions
 instead of macros

Defining functions allows to use them from common code, by not depending
on TARGET_BIG_ENDIAN.
Remove previous macros from exec/cpu-all.h.
By moving them out of cpu-all.h, we'll be able to break dependency on
cpu.h for memory related functions coming in next commits.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250317183417.285700-3-pierrick.bouvier@linaro.org>
---
 include/exec/cpu-all.h | 25 ---------------
 include/exec/tswap.h   | 70 ++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 70 insertions(+), 25 deletions(-)

diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
index 47b14446b8..d000fe4871 100644
--- a/include/exec/cpu-all.h
+++ b/include/exec/cpu-all.h
@@ -26,31 +26,6 @@
 #include "exec/tswap.h"
 #include "hw/core/cpu.h"
 
-/* Target-endianness CPU memory access functions. These fit into the
- * {ld,st}{type}{sign}{size}{endian}_p naming scheme described in bswap.h.
- */
-#if TARGET_BIG_ENDIAN
-#define lduw_p(p) lduw_be_p(p)
-#define ldsw_p(p) ldsw_be_p(p)
-#define ldl_p(p) ldl_be_p(p)
-#define ldq_p(p) ldq_be_p(p)
-#define stw_p(p, v) stw_be_p(p, v)
-#define stl_p(p, v) stl_be_p(p, v)
-#define stq_p(p, v) stq_be_p(p, v)
-#define ldn_p(p, sz) ldn_be_p(p, sz)
-#define stn_p(p, sz, v) stn_be_p(p, sz, v)
-#else
-#define lduw_p(p) lduw_le_p(p)
-#define ldsw_p(p) ldsw_le_p(p)
-#define ldl_p(p) ldl_le_p(p)
-#define ldq_p(p) ldq_le_p(p)
-#define stw_p(p, v) stw_le_p(p, v)
-#define stl_p(p, v) stl_le_p(p, v)
-#define stq_p(p, v) stq_le_p(p, v)
-#define ldn_p(p, sz) ldn_le_p(p, sz)
-#define stn_p(p, sz, v) stn_le_p(p, sz, v)
-#endif
-
 /* MMU memory access macros */
 
 #if !defined(CONFIG_USER_ONLY)
diff --git a/include/exec/tswap.h b/include/exec/tswap.h
index 2683da0adb..84060a4999 100644
--- a/include/exec/tswap.h
+++ b/include/exec/tswap.h
@@ -80,4 +80,74 @@ static inline void tswap64s(uint64_t *s)
     }
 }
 
+/* Return ld{word}_{le,be}_p following target endianness. */
+#define LOAD_IMPL(word, args...)                    \
+do {                                                \
+    if (target_words_bigendian()) {                 \
+        return glue(glue(ld, word), _be_p)(args);   \
+    } else {                                        \
+        return glue(glue(ld, word), _le_p)(args);   \
+    }                                               \
+} while (0)
+
+static inline int lduw_p(const void *ptr)
+{
+    LOAD_IMPL(uw, ptr);
+}
+
+static inline int ldsw_p(const void *ptr)
+{
+    LOAD_IMPL(sw, ptr);
+}
+
+static inline int ldl_p(const void *ptr)
+{
+    LOAD_IMPL(l, ptr);
+}
+
+static inline uint64_t ldq_p(const void *ptr)
+{
+    LOAD_IMPL(q, ptr);
+}
+
+static inline uint64_t ldn_p(const void *ptr, int sz)
+{
+    LOAD_IMPL(n, ptr, sz);
+}
+
+#undef LOAD_IMPL
+
+/* Call st{word}_{le,be}_p following target endianness. */
+#define STORE_IMPL(word, args...)           \
+do {                                        \
+    if (target_words_bigendian()) {         \
+        glue(glue(st, word), _be_p)(args);  \
+    } else {                                \
+        glue(glue(st, word), _le_p)(args);  \
+    }                                       \
+} while (0)
+
+
+static inline void stw_p(void *ptr, uint16_t v)
+{
+    STORE_IMPL(w, ptr, v);
+}
+
+static inline void stl_p(void *ptr, uint32_t v)
+{
+    STORE_IMPL(l, ptr, v);
+}
+
+static inline void stq_p(void *ptr, uint64_t v)
+{
+    STORE_IMPL(q, ptr, v);
+}
+
+static inline void stn_p(void *ptr, int sz, uint64_t v)
+{
+    STORE_IMPL(n, ptr, sz, v);
+}
+
+#undef STORE_IMPL
+
 #endif  /* TSWAP_H */

From 3dd08a6920a3bfbc51da7fdf7b87c1f8d876a457 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 17 Mar 2025 11:34:02 -0700
Subject: [PATCH 0082/2760] exec/memory_ldst: extract memory_ldst declarations
 from cpu-all.h

They are now accessible through exec/memory.h instead, and we make sure
all variants are available for common or target dependent code.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250317183417.285700-4-pierrick.bouvier@linaro.org>
---
 include/exec/cpu-all.h         | 12 ------------
 include/exec/memory_ldst.h.inc |  4 ----
 2 files changed, 16 deletions(-)

diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
index d000fe4871..7e8d66de31 100644
--- a/include/exec/cpu-all.h
+++ b/include/exec/cpu-all.h
@@ -32,18 +32,6 @@
 
 #include "exec/hwaddr.h"
 
-#define SUFFIX
-#define ARG1         as
-#define ARG1_DECL    AddressSpace *as
-#define TARGET_ENDIANNESS
-#include "exec/memory_ldst.h.inc"
-
-#define SUFFIX       _cached_slow
-#define ARG1         cache
-#define ARG1_DECL    MemoryRegionCache *cache
-#define TARGET_ENDIANNESS
-#include "exec/memory_ldst.h.inc"
-
 static inline void stl_phys_notdirty(AddressSpace *as, hwaddr addr, uint32_t val)
 {
     address_space_stl_notdirty(as, addr, val,
diff --git a/include/exec/memory_ldst.h.inc b/include/exec/memory_ldst.h.inc
index 92ad74e956..7270235c60 100644
--- a/include/exec/memory_ldst.h.inc
+++ b/include/exec/memory_ldst.h.inc
@@ -19,7 +19,6 @@
  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  */
 
-#ifdef TARGET_ENDIANNESS
 uint16_t glue(address_space_lduw, SUFFIX)(ARG1_DECL,
     hwaddr addr, MemTxAttrs attrs, MemTxResult *result);
 uint32_t glue(address_space_ldl, SUFFIX)(ARG1_DECL,
@@ -34,7 +33,6 @@ void glue(address_space_stl, SUFFIX)(ARG1_DECL,
     hwaddr addr, uint32_t val, MemTxAttrs attrs, MemTxResult *result);
 void glue(address_space_stq, SUFFIX)(ARG1_DECL,
     hwaddr addr, uint64_t val, MemTxAttrs attrs, MemTxResult *result);
-#else
 uint8_t glue(address_space_ldub, SUFFIX)(ARG1_DECL,
     hwaddr addr, MemTxAttrs attrs, MemTxResult *result);
 uint16_t glue(address_space_lduw_le, SUFFIX)(ARG1_DECL,
@@ -63,9 +61,7 @@ void glue(address_space_stq_le, SUFFIX)(ARG1_DECL,
     hwaddr addr, uint64_t val, MemTxAttrs attrs, MemTxResult *result);
 void glue(address_space_stq_be, SUFFIX)(ARG1_DECL,
     hwaddr addr, uint64_t val, MemTxAttrs attrs, MemTxResult *result);
-#endif
 
 #undef ARG1_DECL
 #undef ARG1
 #undef SUFFIX
-#undef TARGET_ENDIANNESS

From 713b5e1dccd1219f663f274a89b17e322e617ef9 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 17 Mar 2025 11:34:03 -0700
Subject: [PATCH 0083/2760] exec/memory_ldst_phys: extract memory_ldst_phys
 declarations from cpu-all.h

They are now accessible through exec/memory.h instead, and we make sure
all variants are available for common or target dependent code.

Move stl_phys_notdirty function as well.
Cached endianness agnostic version rely on st/ld*_p, which is available
through tswap.h.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250317183417.285700-5-pierrick.bouvier@linaro.org>
---
 include/exec/cpu-all.h              | 31 -----------------------------
 include/exec/memory.h               | 10 ++++++++++
 include/exec/memory_ldst_phys.h.inc |  5 +----
 3 files changed, 11 insertions(+), 35 deletions(-)

diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
index 7e8d66de31..66a4252269 100644
--- a/include/exec/cpu-all.h
+++ b/include/exec/cpu-all.h
@@ -25,37 +25,6 @@
 #include "exec/memory.h"
 #include "exec/tswap.h"
 #include "hw/core/cpu.h"
-
-/* MMU memory access macros */
-
-#if !defined(CONFIG_USER_ONLY)
-
-#include "exec/hwaddr.h"
-
-static inline void stl_phys_notdirty(AddressSpace *as, hwaddr addr, uint32_t val)
-{
-    address_space_stl_notdirty(as, addr, val,
-                               MEMTXATTRS_UNSPECIFIED, NULL);
-}
-
-#define SUFFIX
-#define ARG1         as
-#define ARG1_DECL    AddressSpace *as
-#define TARGET_ENDIANNESS
-#include "exec/memory_ldst_phys.h.inc"
-
-/* Inline fast path for direct RAM access.  */
-#define ENDIANNESS
-#include "exec/memory_ldst_cached.h.inc"
-
-#define SUFFIX       _cached
-#define ARG1         cache
-#define ARG1_DECL    MemoryRegionCache *cache
-#define TARGET_ENDIANNESS
-#include "exec/memory_ldst_phys.h.inc"
-#endif
-
-/* page related stuff */
 #include "exec/cpu-defs.h"
 #include "exec/target_page.h"
 
diff --git a/include/exec/memory.h b/include/exec/memory.h
index e1c196a0c2..cc5915033c 100644
--- a/include/exec/memory.h
+++ b/include/exec/memory.h
@@ -21,6 +21,7 @@
 #include "exec/memattrs.h"
 #include "exec/memop.h"
 #include "exec/ramlist.h"
+#include "exec/tswap.h"
 #include "qemu/bswap.h"
 #include "qemu/queue.h"
 #include "qemu/int128.h"
@@ -2732,6 +2733,12 @@ MemTxResult address_space_write_rom(AddressSpace *as, hwaddr addr,
 #define ARG1_DECL    AddressSpace *as
 #include "exec/memory_ldst.h.inc"
 
+static inline void stl_phys_notdirty(AddressSpace *as, hwaddr addr, uint32_t val)
+{
+    address_space_stl_notdirty(as, addr, val,
+                               MEMTXATTRS_UNSPECIFIED, NULL);
+}
+
 #define SUFFIX
 #define ARG1         as
 #define ARG1_DECL    AddressSpace *as
@@ -2798,6 +2805,9 @@ static inline void address_space_stb_cached(MemoryRegionCache *cache,
     }
 }
 
+#define ENDIANNESS
+#include "exec/memory_ldst_cached.h.inc"
+
 #define ENDIANNESS   _le
 #include "exec/memory_ldst_cached.h.inc"
 
diff --git a/include/exec/memory_ldst_phys.h.inc b/include/exec/memory_ldst_phys.h.inc
index ecd678610d..db67de7525 100644
--- a/include/exec/memory_ldst_phys.h.inc
+++ b/include/exec/memory_ldst_phys.h.inc
@@ -19,7 +19,6 @@
  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  */
 
-#ifdef TARGET_ENDIANNESS
 static inline uint16_t glue(lduw_phys, SUFFIX)(ARG1_DECL, hwaddr addr)
 {
     return glue(address_space_lduw, SUFFIX)(ARG1, addr,
@@ -55,7 +54,7 @@ static inline void glue(stq_phys, SUFFIX)(ARG1_DECL, hwaddr addr, uint64_t val)
     glue(address_space_stq, SUFFIX)(ARG1, addr, val,
                                     MEMTXATTRS_UNSPECIFIED, NULL);
 }
-#else
+
 static inline uint8_t glue(ldub_phys, SUFFIX)(ARG1_DECL, hwaddr addr)
 {
     return glue(address_space_ldub, SUFFIX)(ARG1, addr,
@@ -139,9 +138,7 @@ static inline void glue(stq_be_phys, SUFFIX)(ARG1_DECL, hwaddr addr, uint64_t va
     glue(address_space_stq_be, SUFFIX)(ARG1, addr, val,
                                        MEMTXATTRS_UNSPECIFIED, NULL);
 }
-#endif
 
 #undef ARG1_DECL
 #undef ARG1
 #undef SUFFIX
-#undef TARGET_ENDIANNESS

From 82b75e943bdeb04c414767f8beff31d63dc5f2d3 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 17 Mar 2025 11:34:04 -0700
Subject: [PATCH 0084/2760] exec/memory.h: make devend_memop "target defines"
 agnostic
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Will allow to make system/memory.c common later.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250317183417.285700-6-pierrick.bouvier@linaro.org>
---
 include/exec/memory.h | 16 ++++------------
 1 file changed, 4 insertions(+), 12 deletions(-)

diff --git a/include/exec/memory.h b/include/exec/memory.h
index cc5915033c..577f473446 100644
--- a/include/exec/memory.h
+++ b/include/exec/memory.h
@@ -3138,25 +3138,17 @@ address_space_write_cached(MemoryRegionCache *cache, hwaddr addr,
 MemTxResult address_space_set(AddressSpace *as, hwaddr addr,
                               uint8_t c, hwaddr len, MemTxAttrs attrs);
 
-#ifdef COMPILING_PER_TARGET
 /* enum device_endian to MemOp.  */
 static inline MemOp devend_memop(enum device_endian end)
 {
     QEMU_BUILD_BUG_ON(DEVICE_HOST_ENDIAN != DEVICE_LITTLE_ENDIAN &&
                       DEVICE_HOST_ENDIAN != DEVICE_BIG_ENDIAN);
 
-#if HOST_BIG_ENDIAN != TARGET_BIG_ENDIAN
-    /* Swap if non-host endianness or native (target) endianness */
-    return (end == DEVICE_HOST_ENDIAN) ? 0 : MO_BSWAP;
-#else
-    const int non_host_endianness =
-        DEVICE_LITTLE_ENDIAN ^ DEVICE_BIG_ENDIAN ^ DEVICE_HOST_ENDIAN;
-
-    /* In this case, native (target) endianness needs no swap.  */
-    return (end == non_host_endianness) ? MO_BSWAP : 0;
-#endif
+    bool big_endian = (end == DEVICE_NATIVE_ENDIAN
+                       ? target_words_bigendian()
+                       : end == DEVICE_BIG_ENDIAN);
+    return big_endian ? MO_BE : MO_LE;
 }
-#endif /* COMPILING_PER_TARGET */
 
 /*
  * Inhibit technologies that require discarding of pages in RAM blocks, e.g.,

From 2ec0dc245f1e0505a75eb8fdd69acf857999d735 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 17 Mar 2025 11:34:05 -0700
Subject: [PATCH 0085/2760] codebase: prepare to remove cpu.h from
 exec/exec-all.h

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250317183417.285700-7-pierrick.bouvier@linaro.org>
---
 hw/ppc/spapr_nested.c          | 1 +
 hw/sh4/sh7750.c                | 1 +
 include/tcg/tcg-op.h           | 1 +
 page-vary-target.c             | 2 +-
 target/ppc/helper_regs.h       | 2 ++
 target/ppc/tcg-excp_helper.c   | 1 +
 target/riscv/bitmanip_helper.c | 2 +-
 7 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/hw/ppc/spapr_nested.c b/hw/ppc/spapr_nested.c
index 201f629203..a79e398c13 100644
--- a/hw/ppc/spapr_nested.c
+++ b/hw/ppc/spapr_nested.c
@@ -2,6 +2,7 @@
 #include "qemu/cutils.h"
 #include "exec/exec-all.h"
 #include "exec/cputlb.h"
+#include "exec/target_long.h"
 #include "helper_regs.h"
 #include "hw/ppc/ppc.h"
 #include "hw/ppc/spapr.h"
diff --git a/hw/sh4/sh7750.c b/hw/sh4/sh7750.c
index 6faf0e3ca8..41306fb600 100644
--- a/hw/sh4/sh7750.c
+++ b/hw/sh4/sh7750.c
@@ -29,6 +29,7 @@
 #include "hw/irq.h"
 #include "hw/sh4/sh.h"
 #include "system/system.h"
+#include "target/sh4/cpu.h"
 #include "hw/qdev-properties.h"
 #include "hw/qdev-properties-system.h"
 #include "sh7750_regs.h"
diff --git a/include/tcg/tcg-op.h b/include/tcg/tcg-op.h
index a02850583b..bc46b5570c 100644
--- a/include/tcg/tcg-op.h
+++ b/include/tcg/tcg-op.h
@@ -9,6 +9,7 @@
 #define TCG_TCG_OP_H
 
 #include "tcg/tcg-op-common.h"
+#include "exec/target_long.h"
 
 #ifndef TARGET_LONG_BITS
 #error must include QEMU headers
diff --git a/page-vary-target.c b/page-vary-target.c
index 3f81144cda..84ddeb7c26 100644
--- a/page-vary-target.c
+++ b/page-vary-target.c
@@ -21,7 +21,7 @@
 
 #include "qemu/osdep.h"
 #include "exec/page-vary.h"
-#include "exec/exec-all.h"
+#include "exec/target_page.h"
 
 bool set_preferred_target_page_bits(int bits)
 {
diff --git a/target/ppc/helper_regs.h b/target/ppc/helper_regs.h
index 8196c1346d..b928c2c452 100644
--- a/target/ppc/helper_regs.h
+++ b/target/ppc/helper_regs.h
@@ -20,6 +20,8 @@
 #ifndef HELPER_REGS_H
 #define HELPER_REGS_H
 
+#include "target/ppc/cpu.h"
+
 void hreg_swap_gpr_tgpr(CPUPPCState *env);
 void hreg_compute_hflags(CPUPPCState *env);
 void hreg_update_pmu_hflags(CPUPPCState *env);
diff --git a/target/ppc/tcg-excp_helper.c b/target/ppc/tcg-excp_helper.c
index 5a189dc3d7..c422648cfd 100644
--- a/target/ppc/tcg-excp_helper.c
+++ b/target/ppc/tcg-excp_helper.c
@@ -19,6 +19,7 @@
 #include "qemu/osdep.h"
 #include "qemu/main-loop.h"
 #include "qemu/log.h"
+#include "target/ppc/cpu.h"
 #include "exec/cpu_ldst.h"
 #include "exec/exec-all.h"
 #include "exec/helper-proto.h"
diff --git a/target/riscv/bitmanip_helper.c b/target/riscv/bitmanip_helper.c
index b99c4a39a1..e9c8d7f778 100644
--- a/target/riscv/bitmanip_helper.c
+++ b/target/riscv/bitmanip_helper.c
@@ -20,7 +20,7 @@
 
 #include "qemu/osdep.h"
 #include "qemu/host-utils.h"
-#include "exec/exec-all.h"
+#include "exec/target_long.h"
 #include "exec/helper-proto.h"
 #include "tcg/tcg.h"
 

From eab9254fecb57666cd6e550b57d6e56321bc9ba7 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 17 Mar 2025 11:34:06 -0700
Subject: [PATCH 0086/2760] exec/exec-all: remove dependency on cpu.h

Previous commit changed files relying transitively on it.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250317183417.285700-8-pierrick.bouvier@linaro.org>
---
 include/exec/exec-all.h | 1 -
 1 file changed, 1 deletion(-)

diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index dd5c40f223..19b0eda44a 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -20,7 +20,6 @@
 #ifndef EXEC_ALL_H
 #define EXEC_ALL_H
 
-#include "cpu.h"
 #if defined(CONFIG_USER_ONLY)
 #include "exec/cpu_ldst.h"
 #endif

From 9ed7bcff051217d4cdeefc97ef3f4b41ab2fbfbe Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 17 Mar 2025 11:34:07 -0700
Subject: [PATCH 0087/2760] exec/memory-internal: remove dependency on cpu.h

Needed so compilation units including it can be common.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250317183417.285700-9-pierrick.bouvier@linaro.org>
---
 include/exec/memory-internal.h | 2 --
 1 file changed, 2 deletions(-)

diff --git a/include/exec/memory-internal.h b/include/exec/memory-internal.h
index 100c1237ac..b729f3b25a 100644
--- a/include/exec/memory-internal.h
+++ b/include/exec/memory-internal.h
@@ -20,8 +20,6 @@
 #ifndef MEMORY_INTERNAL_H
 #define MEMORY_INTERNAL_H
 
-#include "cpu.h"
-
 #ifndef CONFIG_USER_ONLY
 static inline AddressSpaceDispatch *flatview_to_dispatch(FlatView *fv)
 {

From ede39130af7d325e8dbc6b533a86cb384fdee65d Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 17 Mar 2025 11:34:08 -0700
Subject: [PATCH 0088/2760] exec/ram_addr: remove dependency on cpu.h
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Needed so compilation units including it can be common.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250317183417.285700-10-pierrick.bouvier@linaro.org>
---
 include/exec/ram_addr.h | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/include/exec/ram_addr.h b/include/exec/ram_addr.h
index e4c28fbec9..f5d574261a 100644
--- a/include/exec/ram_addr.h
+++ b/include/exec/ram_addr.h
@@ -20,13 +20,14 @@
 #define RAM_ADDR_H
 
 #ifndef CONFIG_USER_ONLY
-#include "cpu.h"
 #include "system/xen.h"
 #include "system/tcg.h"
 #include "exec/cputlb.h"
 #include "exec/ramlist.h"
 #include "exec/ramblock.h"
 #include "exec/exec-all.h"
+#include "exec/memory.h"
+#include "exec/target_page.h"
 #include "qemu/rcu.h"
 
 #include "exec/hwaddr.h"

From d21be2b61976c57ede5db6e8aa96e57e5e27bf16 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 17 Mar 2025 11:34:09 -0700
Subject: [PATCH 0089/2760] system/kvm: make kvm_flush_coalesced_mmio_buffer()
 accessible for common code

This function is used by system/physmem.c will be turn into common code
in next commit.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250317183417.285700-11-pierrick.bouvier@linaro.org>
---
 include/system/kvm.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/system/kvm.h b/include/system/kvm.h
index ab17c09a55..21da3b8b05 100644
--- a/include/system/kvm.h
+++ b/include/system/kvm.h
@@ -210,11 +210,11 @@ bool kvm_arm_supports_user_irq(void);
 int kvm_on_sigbus_vcpu(CPUState *cpu, int code, void *addr);
 int kvm_on_sigbus(int code, void *addr);
 
+void kvm_flush_coalesced_mmio_buffer(void);
+
 #ifdef COMPILING_PER_TARGET
 #include "cpu.h"
 
-void kvm_flush_coalesced_mmio_buffer(void);
-
 /**
  * kvm_update_guest_debug(): ensure KVM debug structures updated
  * @cs: the CPUState for this cpu

From dea4acbdef980d92cbee60df16e8209946bf026f Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 17 Mar 2025 11:34:10 -0700
Subject: [PATCH 0090/2760] exec/ram_addr: call xen_hvm_modified_memory only if
 xen is enabled

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250317183417.285700-12-pierrick.bouvier@linaro.org>
---
 include/exec/ram_addr.h | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/include/exec/ram_addr.h b/include/exec/ram_addr.h
index f5d574261a..92e8708af7 100644
--- a/include/exec/ram_addr.h
+++ b/include/exec/ram_addr.h
@@ -339,7 +339,9 @@ static inline void cpu_physical_memory_set_dirty_range(ram_addr_t start,
         }
     }
 
-    xen_hvm_modified_memory(start, length);
+    if (xen_enabled()) {
+        xen_hvm_modified_memory(start, length);
+    }
 }
 
 #if !defined(_WIN32)
@@ -415,7 +417,9 @@ uint64_t cpu_physical_memory_set_dirty_lebitmap(unsigned long *bitmap,
             }
         }
 
-        xen_hvm_modified_memory(start, pages << TARGET_PAGE_BITS);
+        if (xen_enabled()) {
+            xen_hvm_modified_memory(start, pages << TARGET_PAGE_BITS);
+        }
     } else {
         uint8_t clients = tcg_enabled() ? DIRTY_CLIENTS_ALL : DIRTY_CLIENTS_NOCODE;
 

From 105d7ea0a574a7db79cd378fe563e0ce51e38dda Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 17 Mar 2025 11:34:11 -0700
Subject: [PATCH 0091/2760] hw/xen: add stubs for various functions

Those symbols are used by system/physmem.c, and are called only if
xen_enabled() (which happens only if CONFIG_XEN is set and xen is
available).

So we can crash the stubs in case those are called, as they are linked
only when CONFIG_XEN is not set.

Acked-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Anthony PERARD <anthony.perard@vates.tech>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250317183417.285700-13-pierrick.bouvier@linaro.org>
---
 hw/xen/meson.build |  3 +++
 hw/xen/xen_stubs.c | 51 ++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 54 insertions(+)
 create mode 100644 hw/xen/xen_stubs.c

diff --git a/hw/xen/meson.build b/hw/xen/meson.build
index 4a486e3673..a1850e7698 100644
--- a/hw/xen/meson.build
+++ b/hw/xen/meson.build
@@ -9,6 +9,9 @@ system_ss.add(when: ['CONFIG_XEN_BUS'], if_true: files(
 
 system_ss.add(when: ['CONFIG_XEN', xen], if_true: files(
   'xen-operations.c',
+),
+if_false: files(
+  'xen_stubs.c',
 ))
 
 xen_specific_ss = ss.source_set()
diff --git a/hw/xen/xen_stubs.c b/hw/xen/xen_stubs.c
new file mode 100644
index 0000000000..5e565df392
--- /dev/null
+++ b/hw/xen/xen_stubs.c
@@ -0,0 +1,51 @@
+/*
+ * Various stubs for xen functions
+ *
+ * Those functions are used only if xen_enabled(). This file is linked only if
+ * CONFIG_XEN is not set, so they should never be called.
+ *
+ * Copyright (c) 2025 Linaro, Ltd.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "system/xen.h"
+#include "system/xen-mapcache.h"
+
+void xen_hvm_modified_memory(ram_addr_t start, ram_addr_t length)
+{
+    g_assert_not_reached();
+}
+
+void xen_ram_alloc(ram_addr_t ram_addr, ram_addr_t size,
+                   struct MemoryRegion *mr, Error **errp)
+{
+    g_assert_not_reached();
+}
+
+bool xen_mr_is_memory(MemoryRegion *mr)
+{
+    g_assert_not_reached();
+}
+
+void xen_invalidate_map_cache_entry(uint8_t *buffer)
+{
+    g_assert_not_reached();
+}
+
+ram_addr_t xen_ram_addr_from_mapcache(void *ptr)
+{
+    g_assert_not_reached();
+}
+
+uint8_t *xen_map_cache(MemoryRegion *mr,
+                       hwaddr phys_addr,
+                       hwaddr size,
+                       ram_addr_t ram_addr_offset,
+                       uint8_t lock,
+                       bool dma,
+                       bool is_write)
+{
+    g_assert_not_reached();
+}

From d3ab5b56630ba8e68af62aabb5a829e5f55b4dd7 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 17 Mar 2025 11:34:12 -0700
Subject: [PATCH 0092/2760] system/xen: remove inline stubs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250317183417.285700-14-pierrick.bouvier@linaro.org>
---
 include/system/xen-mapcache.h | 41 -----------------------------------
 include/system/xen.h          | 21 +++---------------
 2 files changed, 3 insertions(+), 59 deletions(-)

diff --git a/include/system/xen-mapcache.h b/include/system/xen-mapcache.h
index b68f196ddd..bb454a7c96 100644
--- a/include/system/xen-mapcache.h
+++ b/include/system/xen-mapcache.h
@@ -14,8 +14,6 @@
 
 typedef hwaddr (*phys_offset_to_gaddr_t)(hwaddr phys_offset,
                                          ram_addr_t size);
-#ifdef CONFIG_XEN_IS_POSSIBLE
-
 void xen_map_cache_init(phys_offset_to_gaddr_t f,
                         void *opaque);
 uint8_t *xen_map_cache(MemoryRegion *mr, hwaddr phys_addr, hwaddr size,
@@ -28,44 +26,5 @@ void xen_invalidate_map_cache(void);
 uint8_t *xen_replace_cache_entry(hwaddr old_phys_addr,
                                  hwaddr new_phys_addr,
                                  hwaddr size);
-#else
-
-static inline void xen_map_cache_init(phys_offset_to_gaddr_t f,
-                                      void *opaque)
-{
-}
-
-static inline uint8_t *xen_map_cache(MemoryRegion *mr,
-                                     hwaddr phys_addr,
-                                     hwaddr size,
-                                     ram_addr_t ram_addr_offset,
-                                     uint8_t lock,
-                                     bool dma,
-                                     bool is_write)
-{
-    abort();
-}
-
-static inline ram_addr_t xen_ram_addr_from_mapcache(void *ptr)
-{
-    abort();
-}
-
-static inline void xen_invalidate_map_cache_entry(uint8_t *buffer)
-{
-}
-
-static inline void xen_invalidate_map_cache(void)
-{
-}
-
-static inline uint8_t *xen_replace_cache_entry(hwaddr old_phys_addr,
-                                               hwaddr new_phys_addr,
-                                               hwaddr size)
-{
-    abort();
-}
-
-#endif
 
 #endif /* XEN_MAPCACHE_H */
diff --git a/include/system/xen.h b/include/system/xen.h
index 990c19a8ef..5f41915732 100644
--- a/include/system/xen.h
+++ b/include/system/xen.h
@@ -25,30 +25,15 @@
 #endif /* COMPILING_PER_TARGET */
 
 #ifdef CONFIG_XEN_IS_POSSIBLE
-
 extern bool xen_allowed;
-
 #define xen_enabled()           (xen_allowed)
+#else /* !CONFIG_XEN_IS_POSSIBLE */
+#define xen_enabled() 0
+#endif /* CONFIG_XEN_IS_POSSIBLE */
 
 void xen_hvm_modified_memory(ram_addr_t start, ram_addr_t length);
 void xen_ram_alloc(ram_addr_t ram_addr, ram_addr_t size,
                    struct MemoryRegion *mr, Error **errp);
-
-#else /* !CONFIG_XEN_IS_POSSIBLE */
-
-#define xen_enabled() 0
-static inline void xen_hvm_modified_memory(ram_addr_t start, ram_addr_t length)
-{
-    /* nothing */
-}
-static inline void xen_ram_alloc(ram_addr_t ram_addr, ram_addr_t size,
-                                 MemoryRegion *mr, Error **errp)
-{
-    g_assert_not_reached();
-}
-
-#endif /* CONFIG_XEN_IS_POSSIBLE */
-
 bool xen_mr_is_memory(MemoryRegion *mr);
 bool xen_mr_is_grants(MemoryRegion *mr);
 #endif

From 822baa8242a38b0b5dfcd05a859f2f50ea229539 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 17 Mar 2025 11:34:13 -0700
Subject: [PATCH 0093/2760] system/physmem: compilation unit is now common to
 all targets

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250317183417.285700-15-pierrick.bouvier@linaro.org>
---
 system/meson.build | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/system/meson.build b/system/meson.build
index eec07a9451..bd82ef132e 100644
--- a/system/meson.build
+++ b/system/meson.build
@@ -3,7 +3,6 @@ specific_ss.add(when: 'CONFIG_SYSTEM_ONLY', if_true: [files(
   'ioport.c',
   'globals-target.c',
   'memory.c',
-  'physmem.c',
 )])
 
 system_ss.add(files(
@@ -16,6 +15,7 @@ system_ss.add(files(
   'dma-helpers.c',
   'globals.c',
   'memory_mapping.c',
+  'physmem.c',
   'qdev-monitor.c',
   'qtest.c',
   'rtc.c',

From 5519a52c0c269926572300cf2cd7f2f77ab28f87 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 17 Mar 2025 11:34:14 -0700
Subject: [PATCH 0094/2760] include/exec/memory: extract devend_big_endian from
 devend_memop

we'll use it in system/memory.c.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250317183417.285700-16-pierrick.bouvier@linaro.org>
---
 include/exec/memory.h | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/include/exec/memory.h b/include/exec/memory.h
index 577f473446..fc07f69916 100644
--- a/include/exec/memory.h
+++ b/include/exec/memory.h
@@ -3138,16 +3138,22 @@ address_space_write_cached(MemoryRegionCache *cache, hwaddr addr,
 MemTxResult address_space_set(AddressSpace *as, hwaddr addr,
                               uint8_t c, hwaddr len, MemTxAttrs attrs);
 
-/* enum device_endian to MemOp.  */
-static inline MemOp devend_memop(enum device_endian end)
+/* returns true if end is big endian. */
+static inline bool devend_big_endian(enum device_endian end)
 {
     QEMU_BUILD_BUG_ON(DEVICE_HOST_ENDIAN != DEVICE_LITTLE_ENDIAN &&
                       DEVICE_HOST_ENDIAN != DEVICE_BIG_ENDIAN);
 
-    bool big_endian = (end == DEVICE_NATIVE_ENDIAN
-                       ? target_words_bigendian()
-                       : end == DEVICE_BIG_ENDIAN);
-    return big_endian ? MO_BE : MO_LE;
+    if (end == DEVICE_NATIVE_ENDIAN) {
+        return target_words_bigendian();
+    }
+    return end == DEVICE_BIG_ENDIAN;
+}
+
+/* enum device_endian to MemOp.  */
+static inline MemOp devend_memop(enum device_endian end)
+{
+    return devend_big_endian(end) ? MO_BE : MO_LE;
 }
 
 /*

From a54240931ca6a7968123622f3134eba1e2cccb8a Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 17 Mar 2025 11:34:15 -0700
Subject: [PATCH 0095/2760] include/exec/memory: move devend functions to
 memory-internal.h
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Only system/physmem.c and system/memory.c use those functions, so we can
move then to internal header.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250317183417.285700-17-pierrick.bouvier@linaro.org>
---
 include/exec/memory-internal.h | 19 +++++++++++++++++++
 include/exec/memory.h          | 18 ------------------
 2 files changed, 19 insertions(+), 18 deletions(-)

diff --git a/include/exec/memory-internal.h b/include/exec/memory-internal.h
index b729f3b25a..c75178a3d6 100644
--- a/include/exec/memory-internal.h
+++ b/include/exec/memory-internal.h
@@ -43,5 +43,24 @@ void address_space_dispatch_free(AddressSpaceDispatch *d);
 
 void mtree_print_dispatch(struct AddressSpaceDispatch *d,
                           MemoryRegion *root);
+
+/* returns true if end is big endian. */
+static inline bool devend_big_endian(enum device_endian end)
+{
+    QEMU_BUILD_BUG_ON(DEVICE_HOST_ENDIAN != DEVICE_LITTLE_ENDIAN &&
+                      DEVICE_HOST_ENDIAN != DEVICE_BIG_ENDIAN);
+
+    if (end == DEVICE_NATIVE_ENDIAN) {
+        return target_words_bigendian();
+    }
+    return end == DEVICE_BIG_ENDIAN;
+}
+
+/* enum device_endian to MemOp.  */
+static inline MemOp devend_memop(enum device_endian end)
+{
+    return devend_big_endian(end) ? MO_BE : MO_LE;
+}
+
 #endif
 #endif
diff --git a/include/exec/memory.h b/include/exec/memory.h
index fc07f69916..2f84a7cfed 100644
--- a/include/exec/memory.h
+++ b/include/exec/memory.h
@@ -3138,24 +3138,6 @@ address_space_write_cached(MemoryRegionCache *cache, hwaddr addr,
 MemTxResult address_space_set(AddressSpace *as, hwaddr addr,
                               uint8_t c, hwaddr len, MemTxAttrs attrs);
 
-/* returns true if end is big endian. */
-static inline bool devend_big_endian(enum device_endian end)
-{
-    QEMU_BUILD_BUG_ON(DEVICE_HOST_ENDIAN != DEVICE_LITTLE_ENDIAN &&
-                      DEVICE_HOST_ENDIAN != DEVICE_BIG_ENDIAN);
-
-    if (end == DEVICE_NATIVE_ENDIAN) {
-        return target_words_bigendian();
-    }
-    return end == DEVICE_BIG_ENDIAN;
-}
-
-/* enum device_endian to MemOp.  */
-static inline MemOp devend_memop(enum device_endian end)
-{
-    return devend_big_endian(end) ? MO_BE : MO_LE;
-}
-
 /*
  * Inhibit technologies that require discarding of pages in RAM blocks, e.g.,
  * to manage the actual amount of memory consumed by the VM (then, the memory

From 94f5cd62b81d9f6785ebfb9acd41ae253ff32865 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 17 Mar 2025 11:34:16 -0700
Subject: [PATCH 0096/2760] system/memory: make compilation unit common
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250317183417.285700-18-pierrick.bouvier@linaro.org>
---
 system/memory.c    | 17 +++++------------
 system/meson.build |  2 +-
 2 files changed, 6 insertions(+), 13 deletions(-)

diff --git a/system/memory.c b/system/memory.c
index 4c829793a0..eddd21a6cd 100644
--- a/system/memory.c
+++ b/system/memory.c
@@ -353,15 +353,6 @@ static void flatview_simplify(FlatView *view)
     }
 }
 
-static bool memory_region_big_endian(MemoryRegion *mr)
-{
-#if TARGET_BIG_ENDIAN
-    return mr->ops->endianness != DEVICE_LITTLE_ENDIAN;
-#else
-    return mr->ops->endianness == DEVICE_BIG_ENDIAN;
-#endif
-}
-
 static void adjust_endianness(MemoryRegion *mr, uint64_t *data, MemOp op)
 {
     if ((op & MO_BSWAP) != devend_memop(mr->ops->endianness)) {
@@ -563,7 +554,7 @@ static MemTxResult access_with_adjusted_size(hwaddr addr,
     /* FIXME: support unaligned access? */
     access_size = MAX(MIN(size, access_size_max), access_size_min);
     access_mask = MAKE_64BIT_MASK(0, access_size * 8);
-    if (memory_region_big_endian(mr)) {
+    if (devend_big_endian(mr->ops->endianness)) {
         for (i = 0; i < size; i += access_size) {
             r |= access_fn(mr, addr + i, value, access_size,
                         (size - access_size - i) * 8, access_mask, attrs);
@@ -2584,7 +2575,8 @@ void memory_region_add_eventfd(MemoryRegion *mr,
     unsigned i;
 
     if (size) {
-        adjust_endianness(mr, &mrfd.data, size_memop(size) | MO_TE);
+        MemOp mop = (target_words_bigendian() ? MO_BE : MO_LE) | size_memop(size);
+        adjust_endianness(mr, &mrfd.data, mop);
     }
     memory_region_transaction_begin();
     for (i = 0; i < mr->ioeventfd_nb; ++i) {
@@ -2619,7 +2611,8 @@ void memory_region_del_eventfd(MemoryRegion *mr,
     unsigned i;
 
     if (size) {
-        adjust_endianness(mr, &mrfd.data, size_memop(size) | MO_TE);
+        MemOp mop = (target_words_bigendian() ? MO_BE : MO_LE) | size_memop(size);
+        adjust_endianness(mr, &mrfd.data, mop);
     }
     memory_region_transaction_begin();
     for (i = 0; i < mr->ioeventfd_nb; ++i) {
diff --git a/system/meson.build b/system/meson.build
index bd82ef132e..4f44b78df3 100644
--- a/system/meson.build
+++ b/system/meson.build
@@ -2,7 +2,6 @@ specific_ss.add(when: 'CONFIG_SYSTEM_ONLY', if_true: [files(
   'arch_init.c',
   'ioport.c',
   'globals-target.c',
-  'memory.c',
 )])
 
 system_ss.add(files(
@@ -15,6 +14,7 @@ system_ss.add(files(
   'dma-helpers.c',
   'globals.c',
   'memory_mapping.c',
+  'memory.c',
   'physmem.c',
   'qdev-monitor.c',
   'qtest.c',

From 0ac7e071c5d5ada2fc12626e267851fd1c10974a Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 17 Mar 2025 11:34:17 -0700
Subject: [PATCH 0097/2760] system/ioport: make compilation unit common
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250317183417.285700-19-pierrick.bouvier@linaro.org>
---
 system/ioport.c    | 1 -
 system/meson.build | 2 +-
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/system/ioport.c b/system/ioport.c
index 55c2a75239..89daae9d60 100644
--- a/system/ioport.c
+++ b/system/ioport.c
@@ -26,7 +26,6 @@
  */
 
 #include "qemu/osdep.h"
-#include "cpu.h"
 #include "exec/ioport.h"
 #include "exec/memory.h"
 #include "exec/address-spaces.h"
diff --git a/system/meson.build b/system/meson.build
index 4f44b78df3..063301c3ad 100644
--- a/system/meson.build
+++ b/system/meson.build
@@ -1,6 +1,5 @@
 specific_ss.add(when: 'CONFIG_SYSTEM_ONLY', if_true: [files(
   'arch_init.c',
-  'ioport.c',
   'globals-target.c',
 )])
 
@@ -13,6 +12,7 @@ system_ss.add(files(
   'dirtylimit.c',
   'dma-helpers.c',
   'globals.c',
+  'ioport.c',
   'memory_mapping.c',
   'memory.c',
   'physmem.c',

From c4b45298a9b87dc8195aeb3f6439629be9881a17 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 10 Mar 2025 12:57:24 -0700
Subject: [PATCH 0098/2760] accel/tcg: Build user-exec-stub.c once
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

CONFIG_USER_ONLY == !CONFIG_SYSTEM_ONLY.
Therefore it's cleaner to just add to user_ss.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/meson.build | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/accel/tcg/meson.build b/accel/tcg/meson.build
index 38ff227eb0..14bf797fda 100644
--- a/accel/tcg/meson.build
+++ b/accel/tcg/meson.build
@@ -12,7 +12,6 @@ tcg_specific_ss.add(files(
   'translator.c',
 ))
 tcg_specific_ss.add(when: 'CONFIG_USER_ONLY', if_true: files('user-exec.c'))
-tcg_specific_ss.add(when: 'CONFIG_SYSTEM_ONLY', if_false: files('user-exec-stub.c'))
 if get_option('plugins')
   tcg_specific_ss.add(files('plugin-gen.c'))
 endif
@@ -22,6 +21,10 @@ specific_ss.add(when: ['CONFIG_SYSTEM_ONLY', 'CONFIG_TCG'], if_true: files(
   'cputlb.c',
 ))
 
+user_ss.add(when: ['CONFIG_TCG'], if_true: files(
+  'user-exec-stub.c',
+))
+
 system_ss.add(when: ['CONFIG_TCG'], if_true: files(
   'icount-common.c',
   'monitor.c',

From e9358339c5dc7aab0b48d35b57371efae1737046 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 10 Mar 2025 13:15:22 -0700
Subject: [PATCH 0099/2760] accel/tcg: Build plugin-gen.c once
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We assert that env immediately follows CPUState in cpu-all.h.
Change the offsetof expressions to be based on CPUState instead
of ArchCPU.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/meson.build  |  7 ++++---
 accel/tcg/plugin-gen.c | 13 +++++--------
 2 files changed, 9 insertions(+), 11 deletions(-)

diff --git a/accel/tcg/meson.build b/accel/tcg/meson.build
index 14bf797fda..185830d0f5 100644
--- a/accel/tcg/meson.build
+++ b/accel/tcg/meson.build
@@ -3,6 +3,10 @@ common_ss.add(when: 'CONFIG_TCG', if_true: files(
   'tcg-runtime.c',
   'tcg-runtime-gvec.c',
 ))
+if get_option('plugins')
+  common_ss.add(when: 'CONFIG_TCG', if_true: files('plugin-gen.c'))
+endif
+
 tcg_specific_ss = ss.source_set()
 tcg_specific_ss.add(files(
   'tcg-all.c',
@@ -12,9 +16,6 @@ tcg_specific_ss.add(files(
   'translator.c',
 ))
 tcg_specific_ss.add(when: 'CONFIG_USER_ONLY', if_true: files('user-exec.c'))
-if get_option('plugins')
-  tcg_specific_ss.add(files('plugin-gen.c'))
-endif
 specific_ss.add_all(when: 'CONFIG_TCG', if_true: tcg_specific_ss)
 
 specific_ss.add(when: ['CONFIG_SYSTEM_ONLY', 'CONFIG_TCG'], if_true: files(
diff --git a/accel/tcg/plugin-gen.c b/accel/tcg/plugin-gen.c
index 7e5f040bf7..c1da753894 100644
--- a/accel/tcg/plugin-gen.c
+++ b/accel/tcg/plugin-gen.c
@@ -22,13 +22,12 @@
 #include "qemu/osdep.h"
 #include "qemu/plugin.h"
 #include "qemu/log.h"
-#include "cpu.h"
 #include "tcg/tcg.h"
 #include "tcg/tcg-temp-internal.h"
-#include "tcg/tcg-op.h"
-#include "exec/exec-all.h"
+#include "tcg/tcg-op-common.h"
 #include "exec/plugin-gen.h"
 #include "exec/translator.h"
+#include "exec/translation-block.h"
 
 enum plugin_gen_from {
     PLUGIN_GEN_FROM_TB,
@@ -89,15 +88,13 @@ static void gen_enable_mem_helper(struct qemu_plugin_tb *ptb,
     qemu_plugin_add_dyn_cb_arr(arr);
 
     tcg_gen_st_ptr(tcg_constant_ptr((intptr_t)arr), tcg_env,
-                   offsetof(CPUState, neg.plugin_mem_cbs) -
-                   offsetof(ArchCPU, env));
+                   offsetof(CPUState, neg.plugin_mem_cbs) - sizeof(CPUState));
 }
 
 static void gen_disable_mem_helper(void)
 {
     tcg_gen_st_ptr(tcg_constant_ptr(0), tcg_env,
-                   offsetof(CPUState, neg.plugin_mem_cbs) -
-                   offsetof(ArchCPU, env));
+                   offsetof(CPUState, neg.plugin_mem_cbs) - sizeof(CPUState));
 }
 
 static TCGv_i32 gen_cpu_index(void)
@@ -113,7 +110,7 @@ static TCGv_i32 gen_cpu_index(void)
     }
     TCGv_i32 cpu_index = tcg_temp_ebb_new_i32();
     tcg_gen_ld_i32(cpu_index, tcg_env,
-                   -offsetof(ArchCPU, env) + offsetof(CPUState, cpu_index));
+                   offsetof(CPUState, cpu_index) - sizeof(CPUState));
     return cpu_index;
 }
 

From 66269bb96999395906e0e38ca7e59f92ab371933 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 14 Mar 2025 18:20:00 -0700
Subject: [PATCH 0100/2760] accel/tcg: Fix cpu_ld*_code_mmu for user mode

These routines are buggy in multiple ways:
  - Use of target-endian loads, then a bswap that
    depends on the host endiannness.
  - A non-unwinding code load must set_helper_retaddr 1,
    which is magic within adjust_signal_pc.
  - cpu_ldq_code_mmu used MMU_DATA_LOAD

The bugs are hidden because all current uses of cpu_ld*_code_mmu
are from system mode.

Fixes: 2899062614a ("accel/tcg: Add cpu_ld*_code_mmu")
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/user-exec.c | 41 ++++-------------------------------------
 1 file changed, 4 insertions(+), 37 deletions(-)

diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index 2322181b15..629a1c9ce6 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -1257,58 +1257,25 @@ uint64_t cpu_ldq_code(CPUArchState *env, abi_ptr ptr)
 uint8_t cpu_ldb_code_mmu(CPUArchState *env, abi_ptr addr,
                          MemOpIdx oi, uintptr_t ra)
 {
-    void *haddr;
-    uint8_t ret;
-
-    haddr = cpu_mmu_lookup(env_cpu(env), addr, oi, ra, MMU_INST_FETCH);
-    ret = ldub_p(haddr);
-    clear_helper_retaddr();
-    return ret;
+    return do_ld1_mmu(env_cpu(env), addr, oi, ra ? ra : 1, MMU_INST_FETCH);
 }
 
 uint16_t cpu_ldw_code_mmu(CPUArchState *env, abi_ptr addr,
                           MemOpIdx oi, uintptr_t ra)
 {
-    void *haddr;
-    uint16_t ret;
-
-    haddr = cpu_mmu_lookup(env_cpu(env), addr, oi, ra, MMU_INST_FETCH);
-    ret = lduw_p(haddr);
-    clear_helper_retaddr();
-    if (get_memop(oi) & MO_BSWAP) {
-        ret = bswap16(ret);
-    }
-    return ret;
+    return do_ld2_mmu(env_cpu(env), addr, oi, ra ? ra : 1, MMU_INST_FETCH);
 }
 
 uint32_t cpu_ldl_code_mmu(CPUArchState *env, abi_ptr addr,
                           MemOpIdx oi, uintptr_t ra)
 {
-    void *haddr;
-    uint32_t ret;
-
-    haddr = cpu_mmu_lookup(env_cpu(env), addr, oi, ra, MMU_INST_FETCH);
-    ret = ldl_p(haddr);
-    clear_helper_retaddr();
-    if (get_memop(oi) & MO_BSWAP) {
-        ret = bswap32(ret);
-    }
-    return ret;
+    return do_ld4_mmu(env_cpu(env), addr, oi, ra ? ra : 1, MMU_INST_FETCH);
 }
 
 uint64_t cpu_ldq_code_mmu(CPUArchState *env, abi_ptr addr,
                           MemOpIdx oi, uintptr_t ra)
 {
-    void *haddr;
-    uint64_t ret;
-
-    haddr = cpu_mmu_lookup(env_cpu(env), addr, oi, ra, MMU_DATA_LOAD);
-    ret = ldq_p(haddr);
-    clear_helper_retaddr();
-    if (get_memop(oi) & MO_BSWAP) {
-        ret = bswap64(ret);
-    }
-    return ret;
+    return do_ld8_mmu(env_cpu(env), addr, oi, ra ? ra : 1, MMU_INST_FETCH);
 }
 
 #include "ldst_common.c.inc"

From 446321b3234a67ef4576847596ca2859f3b2f89a Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 11 Mar 2025 12:52:36 -0700
Subject: [PATCH 0101/2760] include/exec: Use vaddr for *_mmu guest memory
 access routines

Use vaddr only for the newest api, because it has the least
number of uses and therefore is the easiest to audit.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/atomic_template.h | 16 ++++++-------
 accel/tcg/cputlb.c          |  8 +++----
 accel/tcg/ldst_common.c.inc | 20 ++++++++--------
 accel/tcg/user-exec.c       |  8 +++----
 include/exec/cpu_ldst.h     | 48 ++++++++++++++++++-------------------
 5 files changed, 50 insertions(+), 50 deletions(-)

diff --git a/accel/tcg/atomic_template.h b/accel/tcg/atomic_template.h
index 89593b2502..08a475c10c 100644
--- a/accel/tcg/atomic_template.h
+++ b/accel/tcg/atomic_template.h
@@ -77,7 +77,7 @@
 # define END  _le
 #endif
 
-ABI_TYPE ATOMIC_NAME(cmpxchg)(CPUArchState *env, abi_ptr addr,
+ABI_TYPE ATOMIC_NAME(cmpxchg)(CPUArchState *env, vaddr addr,
                               ABI_TYPE cmpv, ABI_TYPE newv,
                               MemOpIdx oi, uintptr_t retaddr)
 {
@@ -101,7 +101,7 @@ ABI_TYPE ATOMIC_NAME(cmpxchg)(CPUArchState *env, abi_ptr addr,
 }
 
 #if DATA_SIZE < 16
-ABI_TYPE ATOMIC_NAME(xchg)(CPUArchState *env, abi_ptr addr, ABI_TYPE val,
+ABI_TYPE ATOMIC_NAME(xchg)(CPUArchState *env, vaddr addr, ABI_TYPE val,
                            MemOpIdx oi, uintptr_t retaddr)
 {
     DATA_TYPE *haddr = atomic_mmu_lookup(env_cpu(env), addr, oi,
@@ -120,7 +120,7 @@ ABI_TYPE ATOMIC_NAME(xchg)(CPUArchState *env, abi_ptr addr, ABI_TYPE val,
 }
 
 #define GEN_ATOMIC_HELPER(X)                                        \
-ABI_TYPE ATOMIC_NAME(X)(CPUArchState *env, abi_ptr addr,            \
+ABI_TYPE ATOMIC_NAME(X)(CPUArchState *env, vaddr addr,              \
                         ABI_TYPE val, MemOpIdx oi, uintptr_t retaddr) \
 {                                                                   \
     DATA_TYPE *haddr, ret;                                          \
@@ -156,7 +156,7 @@ GEN_ATOMIC_HELPER(xor_fetch)
  * of CF_PARALLEL's value, we'll trace just a read and a write.
  */
 #define GEN_ATOMIC_HELPER_FN(X, FN, XDATA_TYPE, RET)                \
-ABI_TYPE ATOMIC_NAME(X)(CPUArchState *env, abi_ptr addr,            \
+ABI_TYPE ATOMIC_NAME(X)(CPUArchState *env, vaddr addr,              \
                         ABI_TYPE xval, MemOpIdx oi, uintptr_t retaddr) \
 {                                                                   \
     XDATA_TYPE *haddr, cmp, old, new, val = xval;                   \
@@ -202,7 +202,7 @@ GEN_ATOMIC_HELPER_FN(umax_fetch, MAX,  DATA_TYPE, new)
 # define END  _be
 #endif
 
-ABI_TYPE ATOMIC_NAME(cmpxchg)(CPUArchState *env, abi_ptr addr,
+ABI_TYPE ATOMIC_NAME(cmpxchg)(CPUArchState *env, vaddr addr,
                               ABI_TYPE cmpv, ABI_TYPE newv,
                               MemOpIdx oi, uintptr_t retaddr)
 {
@@ -226,7 +226,7 @@ ABI_TYPE ATOMIC_NAME(cmpxchg)(CPUArchState *env, abi_ptr addr,
 }
 
 #if DATA_SIZE < 16
-ABI_TYPE ATOMIC_NAME(xchg)(CPUArchState *env, abi_ptr addr, ABI_TYPE val,
+ABI_TYPE ATOMIC_NAME(xchg)(CPUArchState *env, vaddr addr, ABI_TYPE val,
                            MemOpIdx oi, uintptr_t retaddr)
 {
     DATA_TYPE *haddr = atomic_mmu_lookup(env_cpu(env), addr, oi,
@@ -245,7 +245,7 @@ ABI_TYPE ATOMIC_NAME(xchg)(CPUArchState *env, abi_ptr addr, ABI_TYPE val,
 }
 
 #define GEN_ATOMIC_HELPER(X)                                        \
-ABI_TYPE ATOMIC_NAME(X)(CPUArchState *env, abi_ptr addr,            \
+ABI_TYPE ATOMIC_NAME(X)(CPUArchState *env, vaddr addr,              \
                         ABI_TYPE val, MemOpIdx oi, uintptr_t retaddr) \
 {                                                                   \
     DATA_TYPE *haddr, ret;                                          \
@@ -278,7 +278,7 @@ GEN_ATOMIC_HELPER(xor_fetch)
  * of CF_PARALLEL's value, we'll trace just a read and a write.
  */
 #define GEN_ATOMIC_HELPER_FN(X, FN, XDATA_TYPE, RET)                \
-ABI_TYPE ATOMIC_NAME(X)(CPUArchState *env, abi_ptr addr,            \
+ABI_TYPE ATOMIC_NAME(X)(CPUArchState *env, vaddr addr,              \
                         ABI_TYPE xval, MemOpIdx oi, uintptr_t retaddr) \
 {                                                                   \
     XDATA_TYPE *haddr, ldo, ldn, old, new, val = xval;              \
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index fb22048876..b03998f926 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -2925,25 +2925,25 @@ uint64_t cpu_ldq_code(CPUArchState *env, abi_ptr addr)
     return do_ld8_mmu(cs, addr, oi, 0, MMU_INST_FETCH);
 }
 
-uint8_t cpu_ldb_code_mmu(CPUArchState *env, abi_ptr addr,
+uint8_t cpu_ldb_code_mmu(CPUArchState *env, vaddr addr,
                          MemOpIdx oi, uintptr_t retaddr)
 {
     return do_ld1_mmu(env_cpu(env), addr, oi, retaddr, MMU_INST_FETCH);
 }
 
-uint16_t cpu_ldw_code_mmu(CPUArchState *env, abi_ptr addr,
+uint16_t cpu_ldw_code_mmu(CPUArchState *env, vaddr addr,
                           MemOpIdx oi, uintptr_t retaddr)
 {
     return do_ld2_mmu(env_cpu(env), addr, oi, retaddr, MMU_INST_FETCH);
 }
 
-uint32_t cpu_ldl_code_mmu(CPUArchState *env, abi_ptr addr,
+uint32_t cpu_ldl_code_mmu(CPUArchState *env, vaddr addr,
                           MemOpIdx oi, uintptr_t retaddr)
 {
     return do_ld4_mmu(env_cpu(env), addr, oi, retaddr, MMU_INST_FETCH);
 }
 
-uint64_t cpu_ldq_code_mmu(CPUArchState *env, abi_ptr addr,
+uint64_t cpu_ldq_code_mmu(CPUArchState *env, vaddr addr,
                           MemOpIdx oi, uintptr_t retaddr)
 {
     return do_ld8_mmu(env_cpu(env), addr, oi, retaddr, MMU_INST_FETCH);
diff --git a/accel/tcg/ldst_common.c.inc b/accel/tcg/ldst_common.c.inc
index ebbf380d76..0447c0bb92 100644
--- a/accel/tcg/ldst_common.c.inc
+++ b/accel/tcg/ldst_common.c.inc
@@ -135,7 +135,7 @@ static void plugin_load_cb(CPUArchState *env, abi_ptr addr,
     }
 }
 
-uint8_t cpu_ldb_mmu(CPUArchState *env, abi_ptr addr, MemOpIdx oi, uintptr_t ra)
+uint8_t cpu_ldb_mmu(CPUArchState *env, vaddr addr, MemOpIdx oi, uintptr_t ra)
 {
     uint8_t ret;
 
@@ -145,7 +145,7 @@ uint8_t cpu_ldb_mmu(CPUArchState *env, abi_ptr addr, MemOpIdx oi, uintptr_t ra)
     return ret;
 }
 
-uint16_t cpu_ldw_mmu(CPUArchState *env, abi_ptr addr,
+uint16_t cpu_ldw_mmu(CPUArchState *env, vaddr addr,
                      MemOpIdx oi, uintptr_t ra)
 {
     uint16_t ret;
@@ -156,7 +156,7 @@ uint16_t cpu_ldw_mmu(CPUArchState *env, abi_ptr addr,
     return ret;
 }
 
-uint32_t cpu_ldl_mmu(CPUArchState *env, abi_ptr addr,
+uint32_t cpu_ldl_mmu(CPUArchState *env, vaddr addr,
                      MemOpIdx oi, uintptr_t ra)
 {
     uint32_t ret;
@@ -167,7 +167,7 @@ uint32_t cpu_ldl_mmu(CPUArchState *env, abi_ptr addr,
     return ret;
 }
 
-uint64_t cpu_ldq_mmu(CPUArchState *env, abi_ptr addr,
+uint64_t cpu_ldq_mmu(CPUArchState *env, vaddr addr,
                      MemOpIdx oi, uintptr_t ra)
 {
     uint64_t ret;
@@ -178,7 +178,7 @@ uint64_t cpu_ldq_mmu(CPUArchState *env, abi_ptr addr,
     return ret;
 }
 
-Int128 cpu_ld16_mmu(CPUArchState *env, abi_ptr addr,
+Int128 cpu_ld16_mmu(CPUArchState *env, vaddr addr,
                     MemOpIdx oi, uintptr_t ra)
 {
     Int128 ret;
@@ -205,14 +205,14 @@ static void plugin_store_cb(CPUArchState *env, abi_ptr addr,
     }
 }
 
-void cpu_stb_mmu(CPUArchState *env, abi_ptr addr, uint8_t val,
+void cpu_stb_mmu(CPUArchState *env, vaddr addr, uint8_t val,
                  MemOpIdx oi, uintptr_t retaddr)
 {
     helper_stb_mmu(env, addr, val, oi, retaddr);
     plugin_store_cb(env, addr, val, 0, oi);
 }
 
-void cpu_stw_mmu(CPUArchState *env, abi_ptr addr, uint16_t val,
+void cpu_stw_mmu(CPUArchState *env, vaddr addr, uint16_t val,
                  MemOpIdx oi, uintptr_t retaddr)
 {
     tcg_debug_assert((get_memop(oi) & MO_SIZE) == MO_16);
@@ -220,7 +220,7 @@ void cpu_stw_mmu(CPUArchState *env, abi_ptr addr, uint16_t val,
     plugin_store_cb(env, addr, val, 0, oi);
 }
 
-void cpu_stl_mmu(CPUArchState *env, abi_ptr addr, uint32_t val,
+void cpu_stl_mmu(CPUArchState *env, vaddr addr, uint32_t val,
                     MemOpIdx oi, uintptr_t retaddr)
 {
     tcg_debug_assert((get_memop(oi) & MO_SIZE) == MO_32);
@@ -228,7 +228,7 @@ void cpu_stl_mmu(CPUArchState *env, abi_ptr addr, uint32_t val,
     plugin_store_cb(env, addr, val, 0, oi);
 }
 
-void cpu_stq_mmu(CPUArchState *env, abi_ptr addr, uint64_t val,
+void cpu_stq_mmu(CPUArchState *env, vaddr addr, uint64_t val,
                  MemOpIdx oi, uintptr_t retaddr)
 {
     tcg_debug_assert((get_memop(oi) & MO_SIZE) == MO_64);
@@ -236,7 +236,7 @@ void cpu_stq_mmu(CPUArchState *env, abi_ptr addr, uint64_t val,
     plugin_store_cb(env, addr, val, 0, oi);
 }
 
-void cpu_st16_mmu(CPUArchState *env, abi_ptr addr, Int128 val,
+void cpu_st16_mmu(CPUArchState *env, vaddr addr, Int128 val,
                   MemOpIdx oi, uintptr_t retaddr)
 {
     tcg_debug_assert((get_memop(oi) & MO_SIZE) == MO_128);
diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index 629a1c9ce6..dec17435c5 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -1254,25 +1254,25 @@ uint64_t cpu_ldq_code(CPUArchState *env, abi_ptr ptr)
     return ret;
 }
 
-uint8_t cpu_ldb_code_mmu(CPUArchState *env, abi_ptr addr,
+uint8_t cpu_ldb_code_mmu(CPUArchState *env, vaddr addr,
                          MemOpIdx oi, uintptr_t ra)
 {
     return do_ld1_mmu(env_cpu(env), addr, oi, ra ? ra : 1, MMU_INST_FETCH);
 }
 
-uint16_t cpu_ldw_code_mmu(CPUArchState *env, abi_ptr addr,
+uint16_t cpu_ldw_code_mmu(CPUArchState *env, vaddr addr,
                           MemOpIdx oi, uintptr_t ra)
 {
     return do_ld2_mmu(env_cpu(env), addr, oi, ra ? ra : 1, MMU_INST_FETCH);
 }
 
-uint32_t cpu_ldl_code_mmu(CPUArchState *env, abi_ptr addr,
+uint32_t cpu_ldl_code_mmu(CPUArchState *env, vaddr addr,
                           MemOpIdx oi, uintptr_t ra)
 {
     return do_ld4_mmu(env_cpu(env), addr, oi, ra ? ra : 1, MMU_INST_FETCH);
 }
 
-uint64_t cpu_ldq_code_mmu(CPUArchState *env, abi_ptr addr,
+uint64_t cpu_ldq_code_mmu(CPUArchState *env, vaddr addr,
                           MemOpIdx oi, uintptr_t ra)
 {
     return do_ld8_mmu(env_cpu(env), addr, oi, ra ? ra : 1, MMU_INST_FETCH);
diff --git a/include/exec/cpu_ldst.h b/include/exec/cpu_ldst.h
index 769e9fc440..ddd8e0cf48 100644
--- a/include/exec/cpu_ldst.h
+++ b/include/exec/cpu_ldst.h
@@ -157,48 +157,48 @@ void cpu_stl_le_mmuidx_ra(CPUArchState *env, abi_ptr ptr, uint32_t val,
 void cpu_stq_le_mmuidx_ra(CPUArchState *env, abi_ptr ptr, uint64_t val,
                           int mmu_idx, uintptr_t ra);
 
-uint8_t cpu_ldb_mmu(CPUArchState *env, abi_ptr ptr, MemOpIdx oi, uintptr_t ra);
-uint16_t cpu_ldw_mmu(CPUArchState *env, abi_ptr ptr, MemOpIdx oi, uintptr_t ra);
-uint32_t cpu_ldl_mmu(CPUArchState *env, abi_ptr ptr, MemOpIdx oi, uintptr_t ra);
-uint64_t cpu_ldq_mmu(CPUArchState *env, abi_ptr ptr, MemOpIdx oi, uintptr_t ra);
-Int128 cpu_ld16_mmu(CPUArchState *env, abi_ptr addr, MemOpIdx oi, uintptr_t ra);
+uint8_t cpu_ldb_mmu(CPUArchState *env, vaddr ptr, MemOpIdx oi, uintptr_t ra);
+uint16_t cpu_ldw_mmu(CPUArchState *env, vaddr ptr, MemOpIdx oi, uintptr_t ra);
+uint32_t cpu_ldl_mmu(CPUArchState *env, vaddr ptr, MemOpIdx oi, uintptr_t ra);
+uint64_t cpu_ldq_mmu(CPUArchState *env, vaddr ptr, MemOpIdx oi, uintptr_t ra);
+Int128 cpu_ld16_mmu(CPUArchState *env, vaddr addr, MemOpIdx oi, uintptr_t ra);
 
-void cpu_stb_mmu(CPUArchState *env, abi_ptr ptr, uint8_t val,
+void cpu_stb_mmu(CPUArchState *env, vaddr ptr, uint8_t val,
                  MemOpIdx oi, uintptr_t ra);
-void cpu_stw_mmu(CPUArchState *env, abi_ptr ptr, uint16_t val,
+void cpu_stw_mmu(CPUArchState *env, vaddr ptr, uint16_t val,
                  MemOpIdx oi, uintptr_t ra);
-void cpu_stl_mmu(CPUArchState *env, abi_ptr ptr, uint32_t val,
+void cpu_stl_mmu(CPUArchState *env, vaddr ptr, uint32_t val,
                  MemOpIdx oi, uintptr_t ra);
-void cpu_stq_mmu(CPUArchState *env, abi_ptr ptr, uint64_t val,
+void cpu_stq_mmu(CPUArchState *env, vaddr ptr, uint64_t val,
                  MemOpIdx oi, uintptr_t ra);
-void cpu_st16_mmu(CPUArchState *env, abi_ptr addr, Int128 val,
+void cpu_st16_mmu(CPUArchState *env, vaddr addr, Int128 val,
                   MemOpIdx oi, uintptr_t ra);
 
-uint32_t cpu_atomic_cmpxchgb_mmu(CPUArchState *env, abi_ptr addr,
+uint32_t cpu_atomic_cmpxchgb_mmu(CPUArchState *env, vaddr addr,
                                  uint32_t cmpv, uint32_t newv,
                                  MemOpIdx oi, uintptr_t retaddr);
-uint32_t cpu_atomic_cmpxchgw_le_mmu(CPUArchState *env, abi_ptr addr,
+uint32_t cpu_atomic_cmpxchgw_le_mmu(CPUArchState *env, vaddr addr,
                                     uint32_t cmpv, uint32_t newv,
                                     MemOpIdx oi, uintptr_t retaddr);
-uint32_t cpu_atomic_cmpxchgl_le_mmu(CPUArchState *env, abi_ptr addr,
+uint32_t cpu_atomic_cmpxchgl_le_mmu(CPUArchState *env, vaddr addr,
                                     uint32_t cmpv, uint32_t newv,
                                     MemOpIdx oi, uintptr_t retaddr);
-uint64_t cpu_atomic_cmpxchgq_le_mmu(CPUArchState *env, abi_ptr addr,
+uint64_t cpu_atomic_cmpxchgq_le_mmu(CPUArchState *env, vaddr addr,
                                     uint64_t cmpv, uint64_t newv,
                                     MemOpIdx oi, uintptr_t retaddr);
-uint32_t cpu_atomic_cmpxchgw_be_mmu(CPUArchState *env, abi_ptr addr,
+uint32_t cpu_atomic_cmpxchgw_be_mmu(CPUArchState *env, vaddr addr,
                                     uint32_t cmpv, uint32_t newv,
                                     MemOpIdx oi, uintptr_t retaddr);
-uint32_t cpu_atomic_cmpxchgl_be_mmu(CPUArchState *env, abi_ptr addr,
+uint32_t cpu_atomic_cmpxchgl_be_mmu(CPUArchState *env, vaddr addr,
                                     uint32_t cmpv, uint32_t newv,
                                     MemOpIdx oi, uintptr_t retaddr);
-uint64_t cpu_atomic_cmpxchgq_be_mmu(CPUArchState *env, abi_ptr addr,
+uint64_t cpu_atomic_cmpxchgq_be_mmu(CPUArchState *env, vaddr addr,
                                     uint64_t cmpv, uint64_t newv,
                                     MemOpIdx oi, uintptr_t retaddr);
 
 #define GEN_ATOMIC_HELPER(NAME, TYPE, SUFFIX)   \
 TYPE cpu_atomic_ ## NAME ## SUFFIX ## _mmu      \
-    (CPUArchState *env, abi_ptr addr, TYPE val, \
+    (CPUArchState *env, vaddr addr, TYPE val, \
      MemOpIdx oi, uintptr_t retaddr);
 
 #ifdef CONFIG_ATOMIC64
@@ -244,10 +244,10 @@ GEN_ATOMIC_HELPER_ALL(xchg)
 #undef GEN_ATOMIC_HELPER_ALL
 #undef GEN_ATOMIC_HELPER
 
-Int128 cpu_atomic_cmpxchgo_le_mmu(CPUArchState *env, abi_ptr addr,
+Int128 cpu_atomic_cmpxchgo_le_mmu(CPUArchState *env, vaddr addr,
                                   Int128 cmpv, Int128 newv,
                                   MemOpIdx oi, uintptr_t retaddr);
-Int128 cpu_atomic_cmpxchgo_be_mmu(CPUArchState *env, abi_ptr addr,
+Int128 cpu_atomic_cmpxchgo_be_mmu(CPUArchState *env, vaddr addr,
                                   Int128 cmpv, Int128 newv,
                                   MemOpIdx oi, uintptr_t retaddr);
 
@@ -297,13 +297,13 @@ Int128 cpu_atomic_cmpxchgo_be_mmu(CPUArchState *env, abi_ptr addr,
 # define cpu_stq_mmuidx_ra    cpu_stq_le_mmuidx_ra
 #endif
 
-uint8_t cpu_ldb_code_mmu(CPUArchState *env, abi_ptr addr,
+uint8_t cpu_ldb_code_mmu(CPUArchState *env, vaddr addr,
                          MemOpIdx oi, uintptr_t ra);
-uint16_t cpu_ldw_code_mmu(CPUArchState *env, abi_ptr addr,
+uint16_t cpu_ldw_code_mmu(CPUArchState *env, vaddr addr,
                           MemOpIdx oi, uintptr_t ra);
-uint32_t cpu_ldl_code_mmu(CPUArchState *env, abi_ptr addr,
+uint32_t cpu_ldl_code_mmu(CPUArchState *env, vaddr addr,
                           MemOpIdx oi, uintptr_t ra);
-uint64_t cpu_ldq_code_mmu(CPUArchState *env, abi_ptr addr,
+uint64_t cpu_ldq_code_mmu(CPUArchState *env, vaddr addr,
                           MemOpIdx oi, uintptr_t ra);
 
 uint32_t cpu_ldub_code(CPUArchState *env, abi_ptr addr);

From 0b6426ba6c218fa807fe97258d75cb4bc84c860d Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 11 Mar 2025 13:03:37 -0700
Subject: [PATCH 0102/2760] include/exec: Split out cpu-ldst-common.h

Split out the *_mmu api, which no longer uses
target specific argument types.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/cpu-ldst-common.h | 122 +++++++++++++++++++++++++++++++++
 include/exec/cpu_ldst.h        | 108 +----------------------------
 2 files changed, 123 insertions(+), 107 deletions(-)
 create mode 100644 include/exec/cpu-ldst-common.h

diff --git a/include/exec/cpu-ldst-common.h b/include/exec/cpu-ldst-common.h
new file mode 100644
index 0000000000..c46a6ade5d
--- /dev/null
+++ b/include/exec/cpu-ldst-common.h
@@ -0,0 +1,122 @@
+/*
+ * Software MMU support
+ *
+ * SPDX-License-Identifier: LGPL-2.1-or-later
+ */
+
+#ifndef CPU_LDST_COMMON_H
+#define CPU_LDST_COMMON_H
+
+#ifndef CONFIG_TCG
+#error Can only include this header with TCG
+#endif
+
+#include "exec/memopidx.h"
+#include "exec/vaddr.h"
+#include "exec/mmu-access-type.h"
+#include "qemu/int128.h"
+
+uint8_t cpu_ldb_mmu(CPUArchState *env, vaddr ptr, MemOpIdx oi, uintptr_t ra);
+uint16_t cpu_ldw_mmu(CPUArchState *env, vaddr ptr, MemOpIdx oi, uintptr_t ra);
+uint32_t cpu_ldl_mmu(CPUArchState *env, vaddr ptr, MemOpIdx oi, uintptr_t ra);
+uint64_t cpu_ldq_mmu(CPUArchState *env, vaddr ptr, MemOpIdx oi, uintptr_t ra);
+Int128 cpu_ld16_mmu(CPUArchState *env, vaddr addr, MemOpIdx oi, uintptr_t ra);
+
+void cpu_stb_mmu(CPUArchState *env, vaddr ptr, uint8_t val,
+                 MemOpIdx oi, uintptr_t ra);
+void cpu_stw_mmu(CPUArchState *env, vaddr ptr, uint16_t val,
+                 MemOpIdx oi, uintptr_t ra);
+void cpu_stl_mmu(CPUArchState *env, vaddr ptr, uint32_t val,
+                 MemOpIdx oi, uintptr_t ra);
+void cpu_stq_mmu(CPUArchState *env, vaddr ptr, uint64_t val,
+                 MemOpIdx oi, uintptr_t ra);
+void cpu_st16_mmu(CPUArchState *env, vaddr addr, Int128 val,
+                  MemOpIdx oi, uintptr_t ra);
+
+uint32_t cpu_atomic_cmpxchgb_mmu(CPUArchState *env, vaddr addr,
+                                 uint32_t cmpv, uint32_t newv,
+                                 MemOpIdx oi, uintptr_t retaddr);
+uint32_t cpu_atomic_cmpxchgw_le_mmu(CPUArchState *env, vaddr addr,
+                                    uint32_t cmpv, uint32_t newv,
+                                    MemOpIdx oi, uintptr_t retaddr);
+uint32_t cpu_atomic_cmpxchgl_le_mmu(CPUArchState *env, vaddr addr,
+                                    uint32_t cmpv, uint32_t newv,
+                                    MemOpIdx oi, uintptr_t retaddr);
+uint64_t cpu_atomic_cmpxchgq_le_mmu(CPUArchState *env, vaddr addr,
+                                    uint64_t cmpv, uint64_t newv,
+                                    MemOpIdx oi, uintptr_t retaddr);
+uint32_t cpu_atomic_cmpxchgw_be_mmu(CPUArchState *env, vaddr addr,
+                                    uint32_t cmpv, uint32_t newv,
+                                    MemOpIdx oi, uintptr_t retaddr);
+uint32_t cpu_atomic_cmpxchgl_be_mmu(CPUArchState *env, vaddr addr,
+                                    uint32_t cmpv, uint32_t newv,
+                                    MemOpIdx oi, uintptr_t retaddr);
+uint64_t cpu_atomic_cmpxchgq_be_mmu(CPUArchState *env, vaddr addr,
+                                    uint64_t cmpv, uint64_t newv,
+                                    MemOpIdx oi, uintptr_t retaddr);
+
+#define GEN_ATOMIC_HELPER(NAME, TYPE, SUFFIX)   \
+TYPE cpu_atomic_ ## NAME ## SUFFIX ## _mmu      \
+    (CPUArchState *env, vaddr addr, TYPE val,   \
+     MemOpIdx oi, uintptr_t retaddr);
+
+#ifdef CONFIG_ATOMIC64
+#define GEN_ATOMIC_HELPER_ALL(NAME)          \
+    GEN_ATOMIC_HELPER(NAME, uint32_t, b)     \
+    GEN_ATOMIC_HELPER(NAME, uint32_t, w_le)  \
+    GEN_ATOMIC_HELPER(NAME, uint32_t, w_be)  \
+    GEN_ATOMIC_HELPER(NAME, uint32_t, l_le)  \
+    GEN_ATOMIC_HELPER(NAME, uint32_t, l_be)  \
+    GEN_ATOMIC_HELPER(NAME, uint64_t, q_le)  \
+    GEN_ATOMIC_HELPER(NAME, uint64_t, q_be)
+#else
+#define GEN_ATOMIC_HELPER_ALL(NAME)          \
+    GEN_ATOMIC_HELPER(NAME, uint32_t, b)     \
+    GEN_ATOMIC_HELPER(NAME, uint32_t, w_le)  \
+    GEN_ATOMIC_HELPER(NAME, uint32_t, w_be)  \
+    GEN_ATOMIC_HELPER(NAME, uint32_t, l_le)  \
+    GEN_ATOMIC_HELPER(NAME, uint32_t, l_be)
+#endif
+
+GEN_ATOMIC_HELPER_ALL(fetch_add)
+GEN_ATOMIC_HELPER_ALL(fetch_sub)
+GEN_ATOMIC_HELPER_ALL(fetch_and)
+GEN_ATOMIC_HELPER_ALL(fetch_or)
+GEN_ATOMIC_HELPER_ALL(fetch_xor)
+GEN_ATOMIC_HELPER_ALL(fetch_smin)
+GEN_ATOMIC_HELPER_ALL(fetch_umin)
+GEN_ATOMIC_HELPER_ALL(fetch_smax)
+GEN_ATOMIC_HELPER_ALL(fetch_umax)
+
+GEN_ATOMIC_HELPER_ALL(add_fetch)
+GEN_ATOMIC_HELPER_ALL(sub_fetch)
+GEN_ATOMIC_HELPER_ALL(and_fetch)
+GEN_ATOMIC_HELPER_ALL(or_fetch)
+GEN_ATOMIC_HELPER_ALL(xor_fetch)
+GEN_ATOMIC_HELPER_ALL(smin_fetch)
+GEN_ATOMIC_HELPER_ALL(umin_fetch)
+GEN_ATOMIC_HELPER_ALL(smax_fetch)
+GEN_ATOMIC_HELPER_ALL(umax_fetch)
+
+GEN_ATOMIC_HELPER_ALL(xchg)
+
+#undef GEN_ATOMIC_HELPER_ALL
+#undef GEN_ATOMIC_HELPER
+
+Int128 cpu_atomic_cmpxchgo_le_mmu(CPUArchState *env, vaddr addr,
+                                  Int128 cmpv, Int128 newv,
+                                  MemOpIdx oi, uintptr_t retaddr);
+Int128 cpu_atomic_cmpxchgo_be_mmu(CPUArchState *env, vaddr addr,
+                                  Int128 cmpv, Int128 newv,
+                                  MemOpIdx oi, uintptr_t retaddr);
+
+uint8_t cpu_ldb_code_mmu(CPUArchState *env, vaddr addr,
+                         MemOpIdx oi, uintptr_t ra);
+uint16_t cpu_ldw_code_mmu(CPUArchState *env, vaddr addr,
+                          MemOpIdx oi, uintptr_t ra);
+uint32_t cpu_ldl_code_mmu(CPUArchState *env, vaddr addr,
+                          MemOpIdx oi, uintptr_t ra);
+uint64_t cpu_ldq_code_mmu(CPUArchState *env, vaddr addr,
+                          MemOpIdx oi, uintptr_t ra);
+
+#endif /* CPU_LDST_COMMON_H */
diff --git a/include/exec/cpu_ldst.h b/include/exec/cpu_ldst.h
index ddd8e0cf48..1fbdbe59ae 100644
--- a/include/exec/cpu_ldst.h
+++ b/include/exec/cpu_ldst.h
@@ -66,11 +66,8 @@
 #error Can only include this header with TCG
 #endif
 
-#include "exec/memopidx.h"
-#include "exec/vaddr.h"
+#include "exec/cpu-ldst-common.h"
 #include "exec/abi_ptr.h"
-#include "exec/mmu-access-type.h"
-#include "qemu/int128.h"
 
 #if defined(CONFIG_USER_ONLY)
 #include "user/guest-host.h"
@@ -157,100 +154,6 @@ void cpu_stl_le_mmuidx_ra(CPUArchState *env, abi_ptr ptr, uint32_t val,
 void cpu_stq_le_mmuidx_ra(CPUArchState *env, abi_ptr ptr, uint64_t val,
                           int mmu_idx, uintptr_t ra);
 
-uint8_t cpu_ldb_mmu(CPUArchState *env, vaddr ptr, MemOpIdx oi, uintptr_t ra);
-uint16_t cpu_ldw_mmu(CPUArchState *env, vaddr ptr, MemOpIdx oi, uintptr_t ra);
-uint32_t cpu_ldl_mmu(CPUArchState *env, vaddr ptr, MemOpIdx oi, uintptr_t ra);
-uint64_t cpu_ldq_mmu(CPUArchState *env, vaddr ptr, MemOpIdx oi, uintptr_t ra);
-Int128 cpu_ld16_mmu(CPUArchState *env, vaddr addr, MemOpIdx oi, uintptr_t ra);
-
-void cpu_stb_mmu(CPUArchState *env, vaddr ptr, uint8_t val,
-                 MemOpIdx oi, uintptr_t ra);
-void cpu_stw_mmu(CPUArchState *env, vaddr ptr, uint16_t val,
-                 MemOpIdx oi, uintptr_t ra);
-void cpu_stl_mmu(CPUArchState *env, vaddr ptr, uint32_t val,
-                 MemOpIdx oi, uintptr_t ra);
-void cpu_stq_mmu(CPUArchState *env, vaddr ptr, uint64_t val,
-                 MemOpIdx oi, uintptr_t ra);
-void cpu_st16_mmu(CPUArchState *env, vaddr addr, Int128 val,
-                  MemOpIdx oi, uintptr_t ra);
-
-uint32_t cpu_atomic_cmpxchgb_mmu(CPUArchState *env, vaddr addr,
-                                 uint32_t cmpv, uint32_t newv,
-                                 MemOpIdx oi, uintptr_t retaddr);
-uint32_t cpu_atomic_cmpxchgw_le_mmu(CPUArchState *env, vaddr addr,
-                                    uint32_t cmpv, uint32_t newv,
-                                    MemOpIdx oi, uintptr_t retaddr);
-uint32_t cpu_atomic_cmpxchgl_le_mmu(CPUArchState *env, vaddr addr,
-                                    uint32_t cmpv, uint32_t newv,
-                                    MemOpIdx oi, uintptr_t retaddr);
-uint64_t cpu_atomic_cmpxchgq_le_mmu(CPUArchState *env, vaddr addr,
-                                    uint64_t cmpv, uint64_t newv,
-                                    MemOpIdx oi, uintptr_t retaddr);
-uint32_t cpu_atomic_cmpxchgw_be_mmu(CPUArchState *env, vaddr addr,
-                                    uint32_t cmpv, uint32_t newv,
-                                    MemOpIdx oi, uintptr_t retaddr);
-uint32_t cpu_atomic_cmpxchgl_be_mmu(CPUArchState *env, vaddr addr,
-                                    uint32_t cmpv, uint32_t newv,
-                                    MemOpIdx oi, uintptr_t retaddr);
-uint64_t cpu_atomic_cmpxchgq_be_mmu(CPUArchState *env, vaddr addr,
-                                    uint64_t cmpv, uint64_t newv,
-                                    MemOpIdx oi, uintptr_t retaddr);
-
-#define GEN_ATOMIC_HELPER(NAME, TYPE, SUFFIX)   \
-TYPE cpu_atomic_ ## NAME ## SUFFIX ## _mmu      \
-    (CPUArchState *env, vaddr addr, TYPE val, \
-     MemOpIdx oi, uintptr_t retaddr);
-
-#ifdef CONFIG_ATOMIC64
-#define GEN_ATOMIC_HELPER_ALL(NAME)          \
-    GEN_ATOMIC_HELPER(NAME, uint32_t, b)     \
-    GEN_ATOMIC_HELPER(NAME, uint32_t, w_le)  \
-    GEN_ATOMIC_HELPER(NAME, uint32_t, w_be)  \
-    GEN_ATOMIC_HELPER(NAME, uint32_t, l_le)  \
-    GEN_ATOMIC_HELPER(NAME, uint32_t, l_be)  \
-    GEN_ATOMIC_HELPER(NAME, uint64_t, q_le)  \
-    GEN_ATOMIC_HELPER(NAME, uint64_t, q_be)
-#else
-#define GEN_ATOMIC_HELPER_ALL(NAME)          \
-    GEN_ATOMIC_HELPER(NAME, uint32_t, b)     \
-    GEN_ATOMIC_HELPER(NAME, uint32_t, w_le)  \
-    GEN_ATOMIC_HELPER(NAME, uint32_t, w_be)  \
-    GEN_ATOMIC_HELPER(NAME, uint32_t, l_le)  \
-    GEN_ATOMIC_HELPER(NAME, uint32_t, l_be)
-#endif
-
-GEN_ATOMIC_HELPER_ALL(fetch_add)
-GEN_ATOMIC_HELPER_ALL(fetch_sub)
-GEN_ATOMIC_HELPER_ALL(fetch_and)
-GEN_ATOMIC_HELPER_ALL(fetch_or)
-GEN_ATOMIC_HELPER_ALL(fetch_xor)
-GEN_ATOMIC_HELPER_ALL(fetch_smin)
-GEN_ATOMIC_HELPER_ALL(fetch_umin)
-GEN_ATOMIC_HELPER_ALL(fetch_smax)
-GEN_ATOMIC_HELPER_ALL(fetch_umax)
-
-GEN_ATOMIC_HELPER_ALL(add_fetch)
-GEN_ATOMIC_HELPER_ALL(sub_fetch)
-GEN_ATOMIC_HELPER_ALL(and_fetch)
-GEN_ATOMIC_HELPER_ALL(or_fetch)
-GEN_ATOMIC_HELPER_ALL(xor_fetch)
-GEN_ATOMIC_HELPER_ALL(smin_fetch)
-GEN_ATOMIC_HELPER_ALL(umin_fetch)
-GEN_ATOMIC_HELPER_ALL(smax_fetch)
-GEN_ATOMIC_HELPER_ALL(umax_fetch)
-
-GEN_ATOMIC_HELPER_ALL(xchg)
-
-#undef GEN_ATOMIC_HELPER_ALL
-#undef GEN_ATOMIC_HELPER
-
-Int128 cpu_atomic_cmpxchgo_le_mmu(CPUArchState *env, vaddr addr,
-                                  Int128 cmpv, Int128 newv,
-                                  MemOpIdx oi, uintptr_t retaddr);
-Int128 cpu_atomic_cmpxchgo_be_mmu(CPUArchState *env, vaddr addr,
-                                  Int128 cmpv, Int128 newv,
-                                  MemOpIdx oi, uintptr_t retaddr);
-
 #if TARGET_BIG_ENDIAN
 # define cpu_lduw_data        cpu_lduw_be_data
 # define cpu_ldsw_data        cpu_ldsw_be_data
@@ -297,15 +200,6 @@ Int128 cpu_atomic_cmpxchgo_be_mmu(CPUArchState *env, vaddr addr,
 # define cpu_stq_mmuidx_ra    cpu_stq_le_mmuidx_ra
 #endif
 
-uint8_t cpu_ldb_code_mmu(CPUArchState *env, vaddr addr,
-                         MemOpIdx oi, uintptr_t ra);
-uint16_t cpu_ldw_code_mmu(CPUArchState *env, vaddr addr,
-                          MemOpIdx oi, uintptr_t ra);
-uint32_t cpu_ldl_code_mmu(CPUArchState *env, vaddr addr,
-                          MemOpIdx oi, uintptr_t ra);
-uint64_t cpu_ldq_code_mmu(CPUArchState *env, vaddr addr,
-                          MemOpIdx oi, uintptr_t ra);
-
 uint32_t cpu_ldub_code(CPUArchState *env, abi_ptr addr);
 uint32_t cpu_lduw_code(CPUArchState *env, abi_ptr addr);
 uint32_t cpu_ldl_code(CPUArchState *env, abi_ptr addr);

From efe25c260cd69dcfc948e1622bedbdec953569a8 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 12 Mar 2025 20:04:59 -0700
Subject: [PATCH 0103/2760] include/exec: Split out accel/tcg/cpu-mmu-index.h

The implementation of cpu_mmu_index was split between cpu-common.h
and cpu-all.h, depending on CONFIG_USER_ONLY.  We already have the
plumbing common to user and system mode.  Using MMU_USER_IDX
requires the cpu.h for a specific target, and so is restricted to
when we're compiling per-target.

Include the new header only where needed.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/accel/tcg/cpu-mmu-index.h | 41 +++++++++++++++++++++++++++++++
 include/exec/cpu-all.h            |  6 -----
 include/exec/cpu-common.h         | 20 ---------------
 include/exec/cpu_ldst.h           |  1 +
 semihosting/uaccess.c             |  1 +
 target/arm/gdbstub64.c            |  3 +++
 target/hppa/mem_helper.c          |  1 +
 target/i386/tcg/translate.c       |  1 +
 target/loongarch/cpu_helper.c     |  1 +
 target/microblaze/helper.c        |  1 +
 target/microblaze/mmu.c           |  1 +
 target/openrisc/translate.c       |  1 +
 target/sparc/cpu.c                |  1 +
 target/sparc/mmu_helper.c         |  1 +
 target/tricore/helper.c           |  1 +
 target/xtensa/mmu_helper.c        |  1 +
 16 files changed, 56 insertions(+), 26 deletions(-)
 create mode 100644 include/accel/tcg/cpu-mmu-index.h

diff --git a/include/accel/tcg/cpu-mmu-index.h b/include/accel/tcg/cpu-mmu-index.h
new file mode 100644
index 0000000000..8d1cb53bfa
--- /dev/null
+++ b/include/accel/tcg/cpu-mmu-index.h
@@ -0,0 +1,41 @@
+/*
+ * cpu_mmu_index()
+ *
+ *  Copyright (c) 2003 Fabrice Bellard
+ *
+ * SPDX-License-Identifier: LGPL-2.1-or-later
+ */
+
+#ifndef ACCEL_TCG_CPU_MMU_INDEX_H
+#define ACCEL_TCG_CPU_MMU_INDEX_H
+
+#include "hw/core/cpu.h"
+#include "tcg/debug-assert.h"
+#ifdef COMPILING_PER_TARGET
+# ifdef CONFIG_USER_ONLY
+#  include "cpu.h"
+# endif
+#endif
+
+/**
+ * cpu_mmu_index:
+ * @env: The cpu environment
+ * @ifetch: True for code access, false for data access.
+ *
+ * Return the core mmu index for the current translation regime.
+ * This function is used by generic TCG code paths.
+ */
+static inline int cpu_mmu_index(CPUState *cs, bool ifetch)
+{
+#ifdef COMPILING_PER_TARGET
+# ifdef CONFIG_USER_ONLY
+    return MMU_USER_IDX;
+# endif
+#endif
+
+    int ret = cs->cc->mmu_index(cs, ifetch);
+    tcg_debug_assert(ret >= 0 && ret < NB_MMU_MODES);
+    return ret;
+}
+
+#endif /* ACCEL_TCG_CPU_MMU_INDEX_H */
diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
index 66a4252269..33b9dc81eb 100644
--- a/include/exec/cpu-all.h
+++ b/include/exec/cpu-all.h
@@ -34,8 +34,6 @@ CPUArchState *cpu_copy(CPUArchState *env);
 
 #ifdef CONFIG_USER_ONLY
 
-static inline int cpu_mmu_index(CPUState *cs, bool ifetch);
-
 /*
  * Allow some level of source compatibility with softmmu.  We do not
  * support any of the more exotic features, so only invalid pages may
@@ -45,10 +43,6 @@ static inline int cpu_mmu_index(CPUState *cs, bool ifetch);
 #define TLB_MMIO            (1 << (TARGET_PAGE_BITS_MIN - 2))
 #define TLB_WATCHPOINT      0
 
-static inline int cpu_mmu_index(CPUState *cs, bool ifetch)
-{
-    return MMU_USER_IDX;
-}
 #else
 
 /*
diff --git a/include/exec/cpu-common.h b/include/exec/cpu-common.h
index 3771b2130c..be032e1a49 100644
--- a/include/exec/cpu-common.h
+++ b/include/exec/cpu-common.h
@@ -272,24 +272,4 @@ static inline CPUState *env_cpu(CPUArchState *env)
     return (CPUState *)env_cpu_const(env);
 }
 
-#ifndef CONFIG_USER_ONLY
-/**
- * cpu_mmu_index:
- * @env: The cpu environment
- * @ifetch: True for code access, false for data access.
- *
- * Return the core mmu index for the current translation regime.
- * This function is used by generic TCG code paths.
- *
- * The user-only version of this function is inline in cpu-all.h,
- * where it always returns MMU_USER_IDX.
- */
-static inline int cpu_mmu_index(CPUState *cs, bool ifetch)
-{
-    int ret = cs->cc->mmu_index(cs, ifetch);
-    tcg_debug_assert(ret >= 0 && ret < NB_MMU_MODES);
-    return ret;
-}
-#endif /* !CONFIG_USER_ONLY */
-
 #endif /* CPU_COMMON_H */
diff --git a/include/exec/cpu_ldst.h b/include/exec/cpu_ldst.h
index 1fbdbe59ae..740f5d937f 100644
--- a/include/exec/cpu_ldst.h
+++ b/include/exec/cpu_ldst.h
@@ -67,6 +67,7 @@
 #endif
 
 #include "exec/cpu-ldst-common.h"
+#include "accel/tcg/cpu-mmu-index.h"
 #include "exec/abi_ptr.h"
 
 #if defined(CONFIG_USER_ONLY)
diff --git a/semihosting/uaccess.c b/semihosting/uaccess.c
index 382a366ce3..2e33596428 100644
--- a/semihosting/uaccess.c
+++ b/semihosting/uaccess.c
@@ -9,6 +9,7 @@
 
 #include "qemu/osdep.h"
 #include "exec/cpu-all.h"
+#include "accel/tcg/cpu-mmu-index.h"
 #include "exec/exec-all.h"
 #include "semihosting/uaccess.h"
 
diff --git a/target/arm/gdbstub64.c b/target/arm/gdbstub64.c
index 1a4dbec567..be38016fc7 100644
--- a/target/arm/gdbstub64.c
+++ b/target/arm/gdbstub64.c
@@ -27,6 +27,9 @@
 #include <sys/prctl.h>
 #include "mte_user_helper.h"
 #endif
+#ifdef CONFIG_TCG
+#include "accel/tcg/cpu-mmu-index.h"
+#endif
 
 int aarch64_cpu_gdb_read_register(CPUState *cs, GByteArray *mem_buf, int n)
 {
diff --git a/target/hppa/mem_helper.c b/target/hppa/mem_helper.c
index fb1d93ef1f..a1ade9079e 100644
--- a/target/hppa/mem_helper.c
+++ b/target/hppa/mem_helper.c
@@ -22,6 +22,7 @@
 #include "cpu.h"
 #include "exec/exec-all.h"
 #include "exec/cputlb.h"
+#include "accel/tcg/cpu-mmu-index.h"
 #include "exec/page-protection.h"
 #include "exec/helper-proto.h"
 #include "hw/core/cpu.h"
diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
index abe210cc4e..6418d4bb03 100644
--- a/target/i386/tcg/translate.c
+++ b/target/i386/tcg/translate.c
@@ -20,6 +20,7 @@
 
 #include "qemu/host-utils.h"
 #include "cpu.h"
+#include "accel/tcg/cpu-mmu-index.h"
 #include "exec/exec-all.h"
 #include "exec/translation-block.h"
 #include "tcg/tcg-op.h"
diff --git a/target/loongarch/cpu_helper.c b/target/loongarch/cpu_helper.c
index 930466ca48..f8965cd155 100644
--- a/target/loongarch/cpu_helper.c
+++ b/target/loongarch/cpu_helper.c
@@ -8,6 +8,7 @@
 
 #include "qemu/osdep.h"
 #include "cpu.h"
+#include "accel/tcg/cpu-mmu-index.h"
 #include "internals.h"
 #include "cpu-csr.h"
 
diff --git a/target/microblaze/helper.c b/target/microblaze/helper.c
index 27fc929bee..022c98f0c3 100644
--- a/target/microblaze/helper.c
+++ b/target/microblaze/helper.c
@@ -21,6 +21,7 @@
 #include "qemu/osdep.h"
 #include "cpu.h"
 #include "exec/cputlb.h"
+#include "accel/tcg/cpu-mmu-index.h"
 #include "exec/page-protection.h"
 #include "qemu/host-utils.h"
 #include "exec/log.h"
diff --git a/target/microblaze/mmu.c b/target/microblaze/mmu.c
index f8587d5ac4..2d18659b99 100644
--- a/target/microblaze/mmu.c
+++ b/target/microblaze/mmu.c
@@ -22,6 +22,7 @@
 #include "qemu/log.h"
 #include "cpu.h"
 #include "exec/cputlb.h"
+#include "accel/tcg/cpu-mmu-index.h"
 #include "exec/page-protection.h"
 
 static unsigned int tlb_decode_size(unsigned int f)
diff --git a/target/openrisc/translate.c b/target/openrisc/translate.c
index 7a6af183ae..da033bffff 100644
--- a/target/openrisc/translate.c
+++ b/target/openrisc/translate.c
@@ -20,6 +20,7 @@
 
 #include "qemu/osdep.h"
 #include "cpu.h"
+#include "accel/tcg/cpu-mmu-index.h"
 #include "exec/exec-all.h"
 #include "tcg/tcg-op.h"
 #include "qemu/log.h"
diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
index 5716120117..57fbf16ad2 100644
--- a/target/sparc/cpu.c
+++ b/target/sparc/cpu.c
@@ -22,6 +22,7 @@
 #include "cpu.h"
 #include "qemu/module.h"
 #include "qemu/qemu-print.h"
+#include "accel/tcg/cpu-mmu-index.h"
 #include "exec/exec-all.h"
 #include "exec/translation-block.h"
 #include "hw/qdev-properties.h"
diff --git a/target/sparc/mmu_helper.c b/target/sparc/mmu_helper.c
index 3821cd91ec..78cb24a8e2 100644
--- a/target/sparc/mmu_helper.c
+++ b/target/sparc/mmu_helper.c
@@ -21,6 +21,7 @@
 #include "qemu/log.h"
 #include "cpu.h"
 #include "exec/cputlb.h"
+#include "accel/tcg/cpu-mmu-index.h"
 #include "exec/page-protection.h"
 #include "qemu/qemu-print.h"
 #include "trace.h"
diff --git a/target/tricore/helper.c b/target/tricore/helper.c
index a64412e6bd..b1ee126112 100644
--- a/target/tricore/helper.c
+++ b/target/tricore/helper.c
@@ -20,6 +20,7 @@
 #include "hw/registerfields.h"
 #include "cpu.h"
 #include "exec/cputlb.h"
+#include "accel/tcg/cpu-mmu-index.h"
 #include "exec/page-protection.h"
 #include "fpu/softfloat-helpers.h"
 #include "qemu/qemu-print.h"
diff --git a/target/xtensa/mmu_helper.c b/target/xtensa/mmu_helper.c
index 63be741a42..40b02f0a2c 100644
--- a/target/xtensa/mmu_helper.c
+++ b/target/xtensa/mmu_helper.c
@@ -33,6 +33,7 @@
 #include "exec/helper-proto.h"
 #include "qemu/host-utils.h"
 #include "exec/cputlb.h"
+#include "accel/tcg/cpu-mmu-index.h"
 #include "exec/exec-all.h"
 #include "exec/page-protection.h"
 

From a333692c48c916f0416b982ecefdcc9452088b41 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 11 Mar 2025 13:45:24 -0700
Subject: [PATCH 0104/2760] include/exec: Inline *_mmuidx_ra memory operations

These need to be per-target for 'abi_ptr'.  Expand inline to
the *_mmu api with trivial massaging of the arguments.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/ldst_common.c.inc | 118 --------------------------
 include/exec/cpu_ldst.h     | 163 ++++++++++++++++++++++++++++--------
 2 files changed, 129 insertions(+), 152 deletions(-)

diff --git a/accel/tcg/ldst_common.c.inc b/accel/tcg/ldst_common.c.inc
index 0447c0bb92..99a56df3fb 100644
--- a/accel/tcg/ldst_common.c.inc
+++ b/accel/tcg/ldst_common.c.inc
@@ -248,124 +248,6 @@ void cpu_st16_mmu(CPUArchState *env, vaddr addr, Int128 val,
  * Wrappers of the above
  */
 
-uint32_t cpu_ldub_mmuidx_ra(CPUArchState *env, abi_ptr addr,
-                            int mmu_idx, uintptr_t ra)
-{
-    MemOpIdx oi = make_memop_idx(MO_UB, mmu_idx);
-    return cpu_ldb_mmu(env, addr, oi, ra);
-}
-
-int cpu_ldsb_mmuidx_ra(CPUArchState *env, abi_ptr addr,
-                       int mmu_idx, uintptr_t ra)
-{
-    return (int8_t)cpu_ldub_mmuidx_ra(env, addr, mmu_idx, ra);
-}
-
-uint32_t cpu_lduw_be_mmuidx_ra(CPUArchState *env, abi_ptr addr,
-                               int mmu_idx, uintptr_t ra)
-{
-    MemOpIdx oi = make_memop_idx(MO_BEUW | MO_UNALN, mmu_idx);
-    return cpu_ldw_mmu(env, addr, oi, ra);
-}
-
-int cpu_ldsw_be_mmuidx_ra(CPUArchState *env, abi_ptr addr,
-                          int mmu_idx, uintptr_t ra)
-{
-    return (int16_t)cpu_lduw_be_mmuidx_ra(env, addr, mmu_idx, ra);
-}
-
-uint32_t cpu_ldl_be_mmuidx_ra(CPUArchState *env, abi_ptr addr,
-                              int mmu_idx, uintptr_t ra)
-{
-    MemOpIdx oi = make_memop_idx(MO_BEUL | MO_UNALN, mmu_idx);
-    return cpu_ldl_mmu(env, addr, oi, ra);
-}
-
-uint64_t cpu_ldq_be_mmuidx_ra(CPUArchState *env, abi_ptr addr,
-                              int mmu_idx, uintptr_t ra)
-{
-    MemOpIdx oi = make_memop_idx(MO_BEUQ | MO_UNALN, mmu_idx);
-    return cpu_ldq_mmu(env, addr, oi, ra);
-}
-
-uint32_t cpu_lduw_le_mmuidx_ra(CPUArchState *env, abi_ptr addr,
-                               int mmu_idx, uintptr_t ra)
-{
-    MemOpIdx oi = make_memop_idx(MO_LEUW | MO_UNALN, mmu_idx);
-    return cpu_ldw_mmu(env, addr, oi, ra);
-}
-
-int cpu_ldsw_le_mmuidx_ra(CPUArchState *env, abi_ptr addr,
-                          int mmu_idx, uintptr_t ra)
-{
-    return (int16_t)cpu_lduw_le_mmuidx_ra(env, addr, mmu_idx, ra);
-}
-
-uint32_t cpu_ldl_le_mmuidx_ra(CPUArchState *env, abi_ptr addr,
-                              int mmu_idx, uintptr_t ra)
-{
-    MemOpIdx oi = make_memop_idx(MO_LEUL | MO_UNALN, mmu_idx);
-    return cpu_ldl_mmu(env, addr, oi, ra);
-}
-
-uint64_t cpu_ldq_le_mmuidx_ra(CPUArchState *env, abi_ptr addr,
-                              int mmu_idx, uintptr_t ra)
-{
-    MemOpIdx oi = make_memop_idx(MO_LEUQ | MO_UNALN, mmu_idx);
-    return cpu_ldq_mmu(env, addr, oi, ra);
-}
-
-void cpu_stb_mmuidx_ra(CPUArchState *env, abi_ptr addr, uint32_t val,
-                       int mmu_idx, uintptr_t ra)
-{
-    MemOpIdx oi = make_memop_idx(MO_UB, mmu_idx);
-    cpu_stb_mmu(env, addr, val, oi, ra);
-}
-
-void cpu_stw_be_mmuidx_ra(CPUArchState *env, abi_ptr addr, uint32_t val,
-                          int mmu_idx, uintptr_t ra)
-{
-    MemOpIdx oi = make_memop_idx(MO_BEUW | MO_UNALN, mmu_idx);
-    cpu_stw_mmu(env, addr, val, oi, ra);
-}
-
-void cpu_stl_be_mmuidx_ra(CPUArchState *env, abi_ptr addr, uint32_t val,
-                          int mmu_idx, uintptr_t ra)
-{
-    MemOpIdx oi = make_memop_idx(MO_BEUL | MO_UNALN, mmu_idx);
-    cpu_stl_mmu(env, addr, val, oi, ra);
-}
-
-void cpu_stq_be_mmuidx_ra(CPUArchState *env, abi_ptr addr, uint64_t val,
-                          int mmu_idx, uintptr_t ra)
-{
-    MemOpIdx oi = make_memop_idx(MO_BEUQ | MO_UNALN, mmu_idx);
-    cpu_stq_mmu(env, addr, val, oi, ra);
-}
-
-void cpu_stw_le_mmuidx_ra(CPUArchState *env, abi_ptr addr, uint32_t val,
-                          int mmu_idx, uintptr_t ra)
-{
-    MemOpIdx oi = make_memop_idx(MO_LEUW | MO_UNALN, mmu_idx);
-    cpu_stw_mmu(env, addr, val, oi, ra);
-}
-
-void cpu_stl_le_mmuidx_ra(CPUArchState *env, abi_ptr addr, uint32_t val,
-                          int mmu_idx, uintptr_t ra)
-{
-    MemOpIdx oi = make_memop_idx(MO_LEUL | MO_UNALN, mmu_idx);
-    cpu_stl_mmu(env, addr, val, oi, ra);
-}
-
-void cpu_stq_le_mmuidx_ra(CPUArchState *env, abi_ptr addr, uint64_t val,
-                          int mmu_idx, uintptr_t ra)
-{
-    MemOpIdx oi = make_memop_idx(MO_LEUQ | MO_UNALN, mmu_idx);
-    cpu_stq_mmu(env, addr, val, oi, ra);
-}
-
-/*--------------------------*/
-
 uint32_t cpu_ldub_data_ra(CPUArchState *env, abi_ptr addr, uintptr_t ra)
 {
     int mmu_index = cpu_mmu_index(env_cpu(env), false);
diff --git a/include/exec/cpu_ldst.h b/include/exec/cpu_ldst.h
index 740f5d937f..8e8b9b53f7 100644
--- a/include/exec/cpu_ldst.h
+++ b/include/exec/cpu_ldst.h
@@ -119,41 +119,136 @@ void cpu_stl_le_data_ra(CPUArchState *env, abi_ptr ptr,
 void cpu_stq_le_data_ra(CPUArchState *env, abi_ptr ptr,
                         uint64_t val, uintptr_t ra);
 
-uint32_t cpu_ldub_mmuidx_ra(CPUArchState *env, abi_ptr ptr,
-                            int mmu_idx, uintptr_t ra);
-int cpu_ldsb_mmuidx_ra(CPUArchState *env, abi_ptr ptr,
-                       int mmu_idx, uintptr_t ra);
-uint32_t cpu_lduw_be_mmuidx_ra(CPUArchState *env, abi_ptr ptr,
-                               int mmu_idx, uintptr_t ra);
-int cpu_ldsw_be_mmuidx_ra(CPUArchState *env, abi_ptr ptr,
-                          int mmu_idx, uintptr_t ra);
-uint32_t cpu_ldl_be_mmuidx_ra(CPUArchState *env, abi_ptr ptr,
-                              int mmu_idx, uintptr_t ra);
-uint64_t cpu_ldq_be_mmuidx_ra(CPUArchState *env, abi_ptr ptr,
-                              int mmu_idx, uintptr_t ra);
-uint32_t cpu_lduw_le_mmuidx_ra(CPUArchState *env, abi_ptr ptr,
-                               int mmu_idx, uintptr_t ra);
-int cpu_ldsw_le_mmuidx_ra(CPUArchState *env, abi_ptr ptr,
-                          int mmu_idx, uintptr_t ra);
-uint32_t cpu_ldl_le_mmuidx_ra(CPUArchState *env, abi_ptr ptr,
-                              int mmu_idx, uintptr_t ra);
-uint64_t cpu_ldq_le_mmuidx_ra(CPUArchState *env, abi_ptr ptr,
-                              int mmu_idx, uintptr_t ra);
+static inline uint32_t
+cpu_ldub_mmuidx_ra(CPUArchState *env, abi_ptr addr, int mmu_idx, uintptr_t ra)
+{
+    MemOpIdx oi = make_memop_idx(MO_UB, mmu_idx);
+    return cpu_ldb_mmu(env, addr, oi, ra);
+}
 
-void cpu_stb_mmuidx_ra(CPUArchState *env, abi_ptr ptr, uint32_t val,
-                       int mmu_idx, uintptr_t ra);
-void cpu_stw_be_mmuidx_ra(CPUArchState *env, abi_ptr ptr, uint32_t val,
-                          int mmu_idx, uintptr_t ra);
-void cpu_stl_be_mmuidx_ra(CPUArchState *env, abi_ptr ptr, uint32_t val,
-                          int mmu_idx, uintptr_t ra);
-void cpu_stq_be_mmuidx_ra(CPUArchState *env, abi_ptr ptr, uint64_t val,
-                          int mmu_idx, uintptr_t ra);
-void cpu_stw_le_mmuidx_ra(CPUArchState *env, abi_ptr ptr, uint32_t val,
-                          int mmu_idx, uintptr_t ra);
-void cpu_stl_le_mmuidx_ra(CPUArchState *env, abi_ptr ptr, uint32_t val,
-                          int mmu_idx, uintptr_t ra);
-void cpu_stq_le_mmuidx_ra(CPUArchState *env, abi_ptr ptr, uint64_t val,
-                          int mmu_idx, uintptr_t ra);
+static inline int
+cpu_ldsb_mmuidx_ra(CPUArchState *env, abi_ptr addr, int mmu_idx, uintptr_t ra)
+{
+    return (int8_t)cpu_ldub_mmuidx_ra(env, addr, mmu_idx, ra);
+}
+
+static inline uint32_t
+cpu_lduw_be_mmuidx_ra(CPUArchState *env, abi_ptr addr,
+                      int mmu_idx, uintptr_t ra)
+{
+    MemOpIdx oi = make_memop_idx(MO_BEUW | MO_UNALN, mmu_idx);
+    return cpu_ldw_mmu(env, addr, oi, ra);
+}
+
+static inline int
+cpu_ldsw_be_mmuidx_ra(CPUArchState *env, abi_ptr addr,
+                      int mmu_idx, uintptr_t ra)
+{
+    return (int16_t)cpu_lduw_be_mmuidx_ra(env, addr, mmu_idx, ra);
+}
+
+static inline uint32_t
+cpu_ldl_be_mmuidx_ra(CPUArchState *env, abi_ptr addr,
+                     int mmu_idx, uintptr_t ra)
+{
+    MemOpIdx oi = make_memop_idx(MO_BEUL | MO_UNALN, mmu_idx);
+    return cpu_ldl_mmu(env, addr, oi, ra);
+}
+
+static inline uint64_t
+cpu_ldq_be_mmuidx_ra(CPUArchState *env, abi_ptr addr,
+                     int mmu_idx, uintptr_t ra)
+{
+    MemOpIdx oi = make_memop_idx(MO_BEUQ | MO_UNALN, mmu_idx);
+    return cpu_ldq_mmu(env, addr, oi, ra);
+}
+
+static inline uint32_t
+cpu_lduw_le_mmuidx_ra(CPUArchState *env, abi_ptr addr,
+                      int mmu_idx, uintptr_t ra)
+{
+    MemOpIdx oi = make_memop_idx(MO_LEUW | MO_UNALN, mmu_idx);
+    return cpu_ldw_mmu(env, addr, oi, ra);
+}
+
+static inline int
+cpu_ldsw_le_mmuidx_ra(CPUArchState *env, abi_ptr addr,
+                      int mmu_idx, uintptr_t ra)
+{
+    return (int16_t)cpu_lduw_le_mmuidx_ra(env, addr, mmu_idx, ra);
+}
+
+static inline uint32_t
+cpu_ldl_le_mmuidx_ra(CPUArchState *env, abi_ptr addr,
+                     int mmu_idx, uintptr_t ra)
+{
+    MemOpIdx oi = make_memop_idx(MO_LEUL | MO_UNALN, mmu_idx);
+    return cpu_ldl_mmu(env, addr, oi, ra);
+}
+
+static inline uint64_t
+cpu_ldq_le_mmuidx_ra(CPUArchState *env, abi_ptr addr,
+                     int mmu_idx, uintptr_t ra)
+{
+    MemOpIdx oi = make_memop_idx(MO_LEUQ | MO_UNALN, mmu_idx);
+    return cpu_ldq_mmu(env, addr, oi, ra);
+}
+
+static inline void
+cpu_stb_mmuidx_ra(CPUArchState *env, abi_ptr addr, uint32_t val,
+                  int mmu_idx, uintptr_t ra)
+{
+    MemOpIdx oi = make_memop_idx(MO_UB, mmu_idx);
+    cpu_stb_mmu(env, addr, val, oi, ra);
+}
+
+static inline void
+cpu_stw_be_mmuidx_ra(CPUArchState *env, abi_ptr addr, uint32_t val,
+                     int mmu_idx, uintptr_t ra)
+{
+    MemOpIdx oi = make_memop_idx(MO_BEUW | MO_UNALN, mmu_idx);
+    cpu_stw_mmu(env, addr, val, oi, ra);
+}
+
+static inline void
+cpu_stl_be_mmuidx_ra(CPUArchState *env, abi_ptr addr, uint32_t val,
+                     int mmu_idx, uintptr_t ra)
+{
+    MemOpIdx oi = make_memop_idx(MO_BEUL | MO_UNALN, mmu_idx);
+    cpu_stl_mmu(env, addr, val, oi, ra);
+}
+
+static inline void
+cpu_stq_be_mmuidx_ra(CPUArchState *env, abi_ptr addr, uint64_t val,
+                     int mmu_idx, uintptr_t ra)
+{
+    MemOpIdx oi = make_memop_idx(MO_BEUQ | MO_UNALN, mmu_idx);
+    cpu_stq_mmu(env, addr, val, oi, ra);
+}
+
+static inline void
+cpu_stw_le_mmuidx_ra(CPUArchState *env, abi_ptr addr, uint32_t val,
+                     int mmu_idx, uintptr_t ra)
+{
+    MemOpIdx oi = make_memop_idx(MO_LEUW | MO_UNALN, mmu_idx);
+    cpu_stw_mmu(env, addr, val, oi, ra);
+}
+
+static inline void
+cpu_stl_le_mmuidx_ra(CPUArchState *env, abi_ptr addr, uint32_t val,
+                     int mmu_idx, uintptr_t ra)
+{
+    MemOpIdx oi = make_memop_idx(MO_LEUL | MO_UNALN, mmu_idx);
+    cpu_stl_mmu(env, addr, val, oi, ra);
+}
+
+static inline void
+cpu_stq_le_mmuidx_ra(CPUArchState *env, abi_ptr addr, uint64_t val,
+                     int mmu_idx, uintptr_t ra)
+{
+    MemOpIdx oi = make_memop_idx(MO_LEUQ | MO_UNALN, mmu_idx);
+    cpu_stq_mmu(env, addr, val, oi, ra);
+}
 
 #if TARGET_BIG_ENDIAN
 # define cpu_lduw_data        cpu_lduw_be_data

From ef6ffba62afabd1a7d42bbec93d299799576c7af Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 11 Mar 2025 13:56:02 -0700
Subject: [PATCH 0105/2760] include/exec: Inline *_data_ra memory operations

These need to be per-target for 'abi_ptr'.  Expand inline to
the *_mmuidx_ra api with a lookup of the target's cpu_mmu_index().

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/ldst_common.c.inc | 108 ---------------------------
 include/exec/cpu_ldst.h     | 144 +++++++++++++++++++++++++++++-------
 2 files changed, 118 insertions(+), 134 deletions(-)

diff --git a/accel/tcg/ldst_common.c.inc b/accel/tcg/ldst_common.c.inc
index 99a56df3fb..2f203290db 100644
--- a/accel/tcg/ldst_common.c.inc
+++ b/accel/tcg/ldst_common.c.inc
@@ -248,114 +248,6 @@ void cpu_st16_mmu(CPUArchState *env, vaddr addr, Int128 val,
  * Wrappers of the above
  */
 
-uint32_t cpu_ldub_data_ra(CPUArchState *env, abi_ptr addr, uintptr_t ra)
-{
-    int mmu_index = cpu_mmu_index(env_cpu(env), false);
-    return cpu_ldub_mmuidx_ra(env, addr, mmu_index, ra);
-}
-
-int cpu_ldsb_data_ra(CPUArchState *env, abi_ptr addr, uintptr_t ra)
-{
-    return (int8_t)cpu_ldub_data_ra(env, addr, ra);
-}
-
-uint32_t cpu_lduw_be_data_ra(CPUArchState *env, abi_ptr addr, uintptr_t ra)
-{
-    int mmu_index = cpu_mmu_index(env_cpu(env), false);
-    return cpu_lduw_be_mmuidx_ra(env, addr, mmu_index, ra);
-}
-
-int cpu_ldsw_be_data_ra(CPUArchState *env, abi_ptr addr, uintptr_t ra)
-{
-    return (int16_t)cpu_lduw_be_data_ra(env, addr, ra);
-}
-
-uint32_t cpu_ldl_be_data_ra(CPUArchState *env, abi_ptr addr, uintptr_t ra)
-{
-    int mmu_index = cpu_mmu_index(env_cpu(env), false);
-    return cpu_ldl_be_mmuidx_ra(env, addr, mmu_index, ra);
-}
-
-uint64_t cpu_ldq_be_data_ra(CPUArchState *env, abi_ptr addr, uintptr_t ra)
-{
-    int mmu_index = cpu_mmu_index(env_cpu(env), false);
-    return cpu_ldq_be_mmuidx_ra(env, addr, mmu_index, ra);
-}
-
-uint32_t cpu_lduw_le_data_ra(CPUArchState *env, abi_ptr addr, uintptr_t ra)
-{
-    int mmu_index = cpu_mmu_index(env_cpu(env), false);
-    return cpu_lduw_le_mmuidx_ra(env, addr, mmu_index, ra);
-}
-
-int cpu_ldsw_le_data_ra(CPUArchState *env, abi_ptr addr, uintptr_t ra)
-{
-    return (int16_t)cpu_lduw_le_data_ra(env, addr, ra);
-}
-
-uint32_t cpu_ldl_le_data_ra(CPUArchState *env, abi_ptr addr, uintptr_t ra)
-{
-    int mmu_index = cpu_mmu_index(env_cpu(env), false);
-    return cpu_ldl_le_mmuidx_ra(env, addr, mmu_index, ra);
-}
-
-uint64_t cpu_ldq_le_data_ra(CPUArchState *env, abi_ptr addr, uintptr_t ra)
-{
-    int mmu_index = cpu_mmu_index(env_cpu(env), false);
-    return cpu_ldq_le_mmuidx_ra(env, addr, mmu_index, ra);
-}
-
-void cpu_stb_data_ra(CPUArchState *env, abi_ptr addr,
-                     uint32_t val, uintptr_t ra)
-{
-    int mmu_index = cpu_mmu_index(env_cpu(env), false);
-    cpu_stb_mmuidx_ra(env, addr, val, mmu_index, ra);
-}
-
-void cpu_stw_be_data_ra(CPUArchState *env, abi_ptr addr,
-                        uint32_t val, uintptr_t ra)
-{
-    int mmu_index = cpu_mmu_index(env_cpu(env), false);
-    cpu_stw_be_mmuidx_ra(env, addr, val, mmu_index, ra);
-}
-
-void cpu_stl_be_data_ra(CPUArchState *env, abi_ptr addr,
-                        uint32_t val, uintptr_t ra)
-{
-    int mmu_index = cpu_mmu_index(env_cpu(env), false);
-    cpu_stl_be_mmuidx_ra(env, addr, val, mmu_index, ra);
-}
-
-void cpu_stq_be_data_ra(CPUArchState *env, abi_ptr addr,
-                        uint64_t val, uintptr_t ra)
-{
-    int mmu_index = cpu_mmu_index(env_cpu(env), false);
-    cpu_stq_be_mmuidx_ra(env, addr, val, mmu_index, ra);
-}
-
-void cpu_stw_le_data_ra(CPUArchState *env, abi_ptr addr,
-                        uint32_t val, uintptr_t ra)
-{
-    int mmu_index = cpu_mmu_index(env_cpu(env), false);
-    cpu_stw_le_mmuidx_ra(env, addr, val, mmu_index, ra);
-}
-
-void cpu_stl_le_data_ra(CPUArchState *env, abi_ptr addr,
-                        uint32_t val, uintptr_t ra)
-{
-    int mmu_index = cpu_mmu_index(env_cpu(env), false);
-    cpu_stl_le_mmuidx_ra(env, addr, val, mmu_index, ra);
-}
-
-void cpu_stq_le_data_ra(CPUArchState *env, abi_ptr addr,
-                        uint64_t val, uintptr_t ra)
-{
-    int mmu_index = cpu_mmu_index(env_cpu(env), false);
-    cpu_stq_le_mmuidx_ra(env, addr, val, mmu_index, ra);
-}
-
-/*--------------------------*/
-
 uint32_t cpu_ldub_data(CPUArchState *env, abi_ptr addr)
 {
     return cpu_ldub_data_ra(env, addr, 0);
diff --git a/include/exec/cpu_ldst.h b/include/exec/cpu_ldst.h
index 8e8b9b53f7..2eda652a38 100644
--- a/include/exec/cpu_ldst.h
+++ b/include/exec/cpu_ldst.h
@@ -85,17 +85,6 @@ int cpu_ldsw_le_data(CPUArchState *env, abi_ptr ptr);
 uint32_t cpu_ldl_le_data(CPUArchState *env, abi_ptr ptr);
 uint64_t cpu_ldq_le_data(CPUArchState *env, abi_ptr ptr);
 
-uint32_t cpu_ldub_data_ra(CPUArchState *env, abi_ptr ptr, uintptr_t ra);
-int cpu_ldsb_data_ra(CPUArchState *env, abi_ptr ptr, uintptr_t ra);
-uint32_t cpu_lduw_be_data_ra(CPUArchState *env, abi_ptr ptr, uintptr_t ra);
-int cpu_ldsw_be_data_ra(CPUArchState *env, abi_ptr ptr, uintptr_t ra);
-uint32_t cpu_ldl_be_data_ra(CPUArchState *env, abi_ptr ptr, uintptr_t ra);
-uint64_t cpu_ldq_be_data_ra(CPUArchState *env, abi_ptr ptr, uintptr_t ra);
-uint32_t cpu_lduw_le_data_ra(CPUArchState *env, abi_ptr ptr, uintptr_t ra);
-int cpu_ldsw_le_data_ra(CPUArchState *env, abi_ptr ptr, uintptr_t ra);
-uint32_t cpu_ldl_le_data_ra(CPUArchState *env, abi_ptr ptr, uintptr_t ra);
-uint64_t cpu_ldq_le_data_ra(CPUArchState *env, abi_ptr ptr, uintptr_t ra);
-
 void cpu_stb_data(CPUArchState *env, abi_ptr ptr, uint32_t val);
 void cpu_stw_be_data(CPUArchState *env, abi_ptr ptr, uint32_t val);
 void cpu_stl_be_data(CPUArchState *env, abi_ptr ptr, uint32_t val);
@@ -104,21 +93,6 @@ void cpu_stw_le_data(CPUArchState *env, abi_ptr ptr, uint32_t val);
 void cpu_stl_le_data(CPUArchState *env, abi_ptr ptr, uint32_t val);
 void cpu_stq_le_data(CPUArchState *env, abi_ptr ptr, uint64_t val);
 
-void cpu_stb_data_ra(CPUArchState *env, abi_ptr ptr,
-                     uint32_t val, uintptr_t ra);
-void cpu_stw_be_data_ra(CPUArchState *env, abi_ptr ptr,
-                        uint32_t val, uintptr_t ra);
-void cpu_stl_be_data_ra(CPUArchState *env, abi_ptr ptr,
-                        uint32_t val, uintptr_t ra);
-void cpu_stq_be_data_ra(CPUArchState *env, abi_ptr ptr,
-                        uint64_t val, uintptr_t ra);
-void cpu_stw_le_data_ra(CPUArchState *env, abi_ptr ptr,
-                        uint32_t val, uintptr_t ra);
-void cpu_stl_le_data_ra(CPUArchState *env, abi_ptr ptr,
-                        uint32_t val, uintptr_t ra);
-void cpu_stq_le_data_ra(CPUArchState *env, abi_ptr ptr,
-                        uint64_t val, uintptr_t ra);
-
 static inline uint32_t
 cpu_ldub_mmuidx_ra(CPUArchState *env, abi_ptr addr, int mmu_idx, uintptr_t ra)
 {
@@ -250,6 +224,124 @@ cpu_stq_le_mmuidx_ra(CPUArchState *env, abi_ptr addr, uint64_t val,
     cpu_stq_mmu(env, addr, val, oi, ra);
 }
 
+/*--------------------------*/
+
+static inline uint32_t
+cpu_ldub_data_ra(CPUArchState *env, abi_ptr addr, uintptr_t ra)
+{
+    int mmu_index = cpu_mmu_index(env_cpu(env), false);
+    return cpu_ldub_mmuidx_ra(env, addr, mmu_index, ra);
+}
+
+static inline int
+cpu_ldsb_data_ra(CPUArchState *env, abi_ptr addr, uintptr_t ra)
+{
+    return (int8_t)cpu_ldub_data_ra(env, addr, ra);
+}
+
+static inline uint32_t
+cpu_lduw_be_data_ra(CPUArchState *env, abi_ptr addr, uintptr_t ra)
+{
+    int mmu_index = cpu_mmu_index(env_cpu(env), false);
+    return cpu_lduw_be_mmuidx_ra(env, addr, mmu_index, ra);
+}
+
+static inline int
+cpu_ldsw_be_data_ra(CPUArchState *env, abi_ptr addr, uintptr_t ra)
+{
+    return (int16_t)cpu_lduw_be_data_ra(env, addr, ra);
+}
+
+static inline uint32_t
+cpu_ldl_be_data_ra(CPUArchState *env, abi_ptr addr, uintptr_t ra)
+{
+    int mmu_index = cpu_mmu_index(env_cpu(env), false);
+    return cpu_ldl_be_mmuidx_ra(env, addr, mmu_index, ra);
+}
+
+static inline uint64_t
+cpu_ldq_be_data_ra(CPUArchState *env, abi_ptr addr, uintptr_t ra)
+{
+    int mmu_index = cpu_mmu_index(env_cpu(env), false);
+    return cpu_ldq_be_mmuidx_ra(env, addr, mmu_index, ra);
+}
+
+static inline uint32_t
+cpu_lduw_le_data_ra(CPUArchState *env, abi_ptr addr, uintptr_t ra)
+{
+    int mmu_index = cpu_mmu_index(env_cpu(env), false);
+    return cpu_lduw_le_mmuidx_ra(env, addr, mmu_index, ra);
+}
+
+static inline int
+cpu_ldsw_le_data_ra(CPUArchState *env, abi_ptr addr, uintptr_t ra)
+{
+    return (int16_t)cpu_lduw_le_data_ra(env, addr, ra);
+}
+
+static inline uint32_t
+cpu_ldl_le_data_ra(CPUArchState *env, abi_ptr addr, uintptr_t ra)
+{
+    int mmu_index = cpu_mmu_index(env_cpu(env), false);
+    return cpu_ldl_le_mmuidx_ra(env, addr, mmu_index, ra);
+}
+
+static inline uint64_t
+cpu_ldq_le_data_ra(CPUArchState *env, abi_ptr addr, uintptr_t ra)
+{
+    int mmu_index = cpu_mmu_index(env_cpu(env), false);
+    return cpu_ldq_le_mmuidx_ra(env, addr, mmu_index, ra);
+}
+
+static inline void
+cpu_stb_data_ra(CPUArchState *env, abi_ptr addr, uint32_t val, uintptr_t ra)
+{
+    int mmu_index = cpu_mmu_index(env_cpu(env), false);
+    cpu_stb_mmuidx_ra(env, addr, val, mmu_index, ra);
+}
+
+static inline void
+cpu_stw_be_data_ra(CPUArchState *env, abi_ptr addr, uint32_t val, uintptr_t ra)
+{
+    int mmu_index = cpu_mmu_index(env_cpu(env), false);
+    cpu_stw_be_mmuidx_ra(env, addr, val, mmu_index, ra);
+}
+
+static inline void
+cpu_stl_be_data_ra(CPUArchState *env, abi_ptr addr, uint32_t val, uintptr_t ra)
+{
+    int mmu_index = cpu_mmu_index(env_cpu(env), false);
+    cpu_stl_be_mmuidx_ra(env, addr, val, mmu_index, ra);
+}
+
+static inline void
+cpu_stq_be_data_ra(CPUArchState *env, abi_ptr addr, uint64_t val, uintptr_t ra)
+{
+    int mmu_index = cpu_mmu_index(env_cpu(env), false);
+    cpu_stq_be_mmuidx_ra(env, addr, val, mmu_index, ra);
+}
+
+static inline void
+cpu_stw_le_data_ra(CPUArchState *env, abi_ptr addr, uint32_t val, uintptr_t ra)
+{
+    int mmu_index = cpu_mmu_index(env_cpu(env), false);
+    cpu_stw_le_mmuidx_ra(env, addr, val, mmu_index, ra);
+}
+
+static inline void
+cpu_stl_le_data_ra(CPUArchState *env, abi_ptr addr, uint32_t val, uintptr_t ra)
+{
+    int mmu_index = cpu_mmu_index(env_cpu(env), false);
+    cpu_stl_le_mmuidx_ra(env, addr, val, mmu_index, ra);
+}
+
+static inline void
+cpu_stq_le_data_ra(CPUArchState *env, abi_ptr addr, uint64_t val, uintptr_t ra)
+{
+    int mmu_index = cpu_mmu_index(env_cpu(env), false);
+    cpu_stq_le_mmuidx_ra(env, addr, val, mmu_index, ra);
+}
+
 #if TARGET_BIG_ENDIAN
 # define cpu_lduw_data        cpu_lduw_be_data
 # define cpu_ldsw_data        cpu_ldsw_be_data

From 0a29f11676d5b834f980a818d35b23d20d7ea226 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 11 Mar 2025 14:08:55 -0700
Subject: [PATCH 0106/2760] include/exec: Inline *_data memory operations

These need to be per-target for 'abi_ptr'.  Expand inline to
the *_data_ra api with ra == 0.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/ldst_common.c.inc |  89 --------------------------
 include/exec/cpu_ldst.h     | 123 ++++++++++++++++++++++++++++++------
 2 files changed, 104 insertions(+), 108 deletions(-)

diff --git a/accel/tcg/ldst_common.c.inc b/accel/tcg/ldst_common.c.inc
index 2f203290db..9791a4e9ef 100644
--- a/accel/tcg/ldst_common.c.inc
+++ b/accel/tcg/ldst_common.c.inc
@@ -243,92 +243,3 @@ void cpu_st16_mmu(CPUArchState *env, vaddr addr, Int128 val,
     do_st16_mmu(env_cpu(env), addr, val, oi, retaddr);
     plugin_store_cb(env, addr, int128_getlo(val), int128_gethi(val), oi);
 }
-
-/*
- * Wrappers of the above
- */
-
-uint32_t cpu_ldub_data(CPUArchState *env, abi_ptr addr)
-{
-    return cpu_ldub_data_ra(env, addr, 0);
-}
-
-int cpu_ldsb_data(CPUArchState *env, abi_ptr addr)
-{
-    return (int8_t)cpu_ldub_data(env, addr);
-}
-
-uint32_t cpu_lduw_be_data(CPUArchState *env, abi_ptr addr)
-{
-    return cpu_lduw_be_data_ra(env, addr, 0);
-}
-
-int cpu_ldsw_be_data(CPUArchState *env, abi_ptr addr)
-{
-    return (int16_t)cpu_lduw_be_data(env, addr);
-}
-
-uint32_t cpu_ldl_be_data(CPUArchState *env, abi_ptr addr)
-{
-    return cpu_ldl_be_data_ra(env, addr, 0);
-}
-
-uint64_t cpu_ldq_be_data(CPUArchState *env, abi_ptr addr)
-{
-    return cpu_ldq_be_data_ra(env, addr, 0);
-}
-
-uint32_t cpu_lduw_le_data(CPUArchState *env, abi_ptr addr)
-{
-    return cpu_lduw_le_data_ra(env, addr, 0);
-}
-
-int cpu_ldsw_le_data(CPUArchState *env, abi_ptr addr)
-{
-    return (int16_t)cpu_lduw_le_data(env, addr);
-}
-
-uint32_t cpu_ldl_le_data(CPUArchState *env, abi_ptr addr)
-{
-    return cpu_ldl_le_data_ra(env, addr, 0);
-}
-
-uint64_t cpu_ldq_le_data(CPUArchState *env, abi_ptr addr)
-{
-    return cpu_ldq_le_data_ra(env, addr, 0);
-}
-
-void cpu_stb_data(CPUArchState *env, abi_ptr addr, uint32_t val)
-{
-    cpu_stb_data_ra(env, addr, val, 0);
-}
-
-void cpu_stw_be_data(CPUArchState *env, abi_ptr addr, uint32_t val)
-{
-    cpu_stw_be_data_ra(env, addr, val, 0);
-}
-
-void cpu_stl_be_data(CPUArchState *env, abi_ptr addr, uint32_t val)
-{
-    cpu_stl_be_data_ra(env, addr, val, 0);
-}
-
-void cpu_stq_be_data(CPUArchState *env, abi_ptr addr, uint64_t val)
-{
-    cpu_stq_be_data_ra(env, addr, val, 0);
-}
-
-void cpu_stw_le_data(CPUArchState *env, abi_ptr addr, uint32_t val)
-{
-    cpu_stw_le_data_ra(env, addr, val, 0);
-}
-
-void cpu_stl_le_data(CPUArchState *env, abi_ptr addr, uint32_t val)
-{
-    cpu_stl_le_data_ra(env, addr, val, 0);
-}
-
-void cpu_stq_le_data(CPUArchState *env, abi_ptr addr, uint64_t val)
-{
-    cpu_stq_le_data_ra(env, addr, val, 0);
-}
diff --git a/include/exec/cpu_ldst.h b/include/exec/cpu_ldst.h
index 2eda652a38..0054508eda 100644
--- a/include/exec/cpu_ldst.h
+++ b/include/exec/cpu_ldst.h
@@ -74,25 +74,6 @@
 #include "user/guest-host.h"
 #endif /* CONFIG_USER_ONLY */
 
-uint32_t cpu_ldub_data(CPUArchState *env, abi_ptr ptr);
-int cpu_ldsb_data(CPUArchState *env, abi_ptr ptr);
-uint32_t cpu_lduw_be_data(CPUArchState *env, abi_ptr ptr);
-int cpu_ldsw_be_data(CPUArchState *env, abi_ptr ptr);
-uint32_t cpu_ldl_be_data(CPUArchState *env, abi_ptr ptr);
-uint64_t cpu_ldq_be_data(CPUArchState *env, abi_ptr ptr);
-uint32_t cpu_lduw_le_data(CPUArchState *env, abi_ptr ptr);
-int cpu_ldsw_le_data(CPUArchState *env, abi_ptr ptr);
-uint32_t cpu_ldl_le_data(CPUArchState *env, abi_ptr ptr);
-uint64_t cpu_ldq_le_data(CPUArchState *env, abi_ptr ptr);
-
-void cpu_stb_data(CPUArchState *env, abi_ptr ptr, uint32_t val);
-void cpu_stw_be_data(CPUArchState *env, abi_ptr ptr, uint32_t val);
-void cpu_stl_be_data(CPUArchState *env, abi_ptr ptr, uint32_t val);
-void cpu_stq_be_data(CPUArchState *env, abi_ptr ptr, uint64_t val);
-void cpu_stw_le_data(CPUArchState *env, abi_ptr ptr, uint32_t val);
-void cpu_stl_le_data(CPUArchState *env, abi_ptr ptr, uint32_t val);
-void cpu_stq_le_data(CPUArchState *env, abi_ptr ptr, uint64_t val);
-
 static inline uint32_t
 cpu_ldub_mmuidx_ra(CPUArchState *env, abi_ptr addr, int mmu_idx, uintptr_t ra)
 {
@@ -342,6 +323,110 @@ cpu_stq_le_data_ra(CPUArchState *env, abi_ptr addr, uint64_t val, uintptr_t ra)
     cpu_stq_le_mmuidx_ra(env, addr, val, mmu_index, ra);
 }
 
+/*--------------------------*/
+
+static inline uint32_t
+cpu_ldub_data(CPUArchState *env, abi_ptr addr)
+{
+    return cpu_ldub_data_ra(env, addr, 0);
+}
+
+static inline int
+cpu_ldsb_data(CPUArchState *env, abi_ptr addr)
+{
+    return (int8_t)cpu_ldub_data(env, addr);
+}
+
+static inline uint32_t
+cpu_lduw_be_data(CPUArchState *env, abi_ptr addr)
+{
+    return cpu_lduw_be_data_ra(env, addr, 0);
+}
+
+static inline int
+cpu_ldsw_be_data(CPUArchState *env, abi_ptr addr)
+{
+    return (int16_t)cpu_lduw_be_data(env, addr);
+}
+
+static inline uint32_t
+cpu_ldl_be_data(CPUArchState *env, abi_ptr addr)
+{
+    return cpu_ldl_be_data_ra(env, addr, 0);
+}
+
+static inline uint64_t
+cpu_ldq_be_data(CPUArchState *env, abi_ptr addr)
+{
+    return cpu_ldq_be_data_ra(env, addr, 0);
+}
+
+static inline uint32_t
+cpu_lduw_le_data(CPUArchState *env, abi_ptr addr)
+{
+    return cpu_lduw_le_data_ra(env, addr, 0);
+}
+
+static inline int
+cpu_ldsw_le_data(CPUArchState *env, abi_ptr addr)
+{
+    return (int16_t)cpu_lduw_le_data(env, addr);
+}
+
+static inline uint32_t
+cpu_ldl_le_data(CPUArchState *env, abi_ptr addr)
+{
+    return cpu_ldl_le_data_ra(env, addr, 0);
+}
+
+static inline uint64_t
+cpu_ldq_le_data(CPUArchState *env, abi_ptr addr)
+{
+    return cpu_ldq_le_data_ra(env, addr, 0);
+}
+
+static inline void
+cpu_stb_data(CPUArchState *env, abi_ptr addr, uint32_t val)
+{
+    cpu_stb_data_ra(env, addr, val, 0);
+}
+
+static inline void
+cpu_stw_be_data(CPUArchState *env, abi_ptr addr, uint32_t val)
+{
+    cpu_stw_be_data_ra(env, addr, val, 0);
+}
+
+static inline void
+cpu_stl_be_data(CPUArchState *env, abi_ptr addr, uint32_t val)
+{
+    cpu_stl_be_data_ra(env, addr, val, 0);
+}
+
+static inline void
+cpu_stq_be_data(CPUArchState *env, abi_ptr addr, uint64_t val)
+{
+    cpu_stq_be_data_ra(env, addr, val, 0);
+}
+
+static inline void
+cpu_stw_le_data(CPUArchState *env, abi_ptr addr, uint32_t val)
+{
+    cpu_stw_le_data_ra(env, addr, val, 0);
+}
+
+static inline void
+cpu_stl_le_data(CPUArchState *env, abi_ptr addr, uint32_t val)
+{
+    cpu_stl_le_data_ra(env, addr, val, 0);
+}
+
+static inline void
+cpu_stq_le_data(CPUArchState *env, abi_ptr addr, uint64_t val)
+{
+    cpu_stq_le_data_ra(env, addr, val, 0);
+}
+
 #if TARGET_BIG_ENDIAN
 # define cpu_lduw_data        cpu_lduw_be_data
 # define cpu_ldsw_data        cpu_ldsw_be_data

From 4ba597c138306450e7fcc50d2dba3bfdad8478c8 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 11 Mar 2025 14:34:28 -0700
Subject: [PATCH 0107/2760] include/exec: Inline *_code memory operations

These need to be per-target for 'abi_ptr' and endianness.
These expand inline to the *_mmu api with a lookup of the
target's cpu_mmu_index() and ra == 0.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c      | 28 ----------------------------
 accel/tcg/user-exec.c   | 40 ----------------------------------------
 include/exec/cpu_ldst.h | 31 +++++++++++++++++++++++++++----
 3 files changed, 27 insertions(+), 72 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index b03998f926..2817c9dbdd 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -2897,34 +2897,6 @@ static void do_st16_mmu(CPUState *cpu, vaddr addr, Int128 val,
 
 /* Code access functions.  */
 
-uint32_t cpu_ldub_code(CPUArchState *env, abi_ptr addr)
-{
-    CPUState *cs = env_cpu(env);
-    MemOpIdx oi = make_memop_idx(MO_UB, cpu_mmu_index(cs, true));
-    return do_ld1_mmu(cs, addr, oi, 0, MMU_INST_FETCH);
-}
-
-uint32_t cpu_lduw_code(CPUArchState *env, abi_ptr addr)
-{
-    CPUState *cs = env_cpu(env);
-    MemOpIdx oi = make_memop_idx(MO_TEUW, cpu_mmu_index(cs, true));
-    return do_ld2_mmu(cs, addr, oi, 0, MMU_INST_FETCH);
-}
-
-uint32_t cpu_ldl_code(CPUArchState *env, abi_ptr addr)
-{
-    CPUState *cs = env_cpu(env);
-    MemOpIdx oi = make_memop_idx(MO_TEUL, cpu_mmu_index(cs, true));
-    return do_ld4_mmu(cs, addr, oi, 0, MMU_INST_FETCH);
-}
-
-uint64_t cpu_ldq_code(CPUArchState *env, abi_ptr addr)
-{
-    CPUState *cs = env_cpu(env);
-    MemOpIdx oi = make_memop_idx(MO_TEUQ, cpu_mmu_index(cs, true));
-    return do_ld8_mmu(cs, addr, oi, 0, MMU_INST_FETCH);
-}
-
 uint8_t cpu_ldb_code_mmu(CPUArchState *env, vaddr addr,
                          MemOpIdx oi, uintptr_t retaddr)
 {
diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index dec17435c5..ebc7c3ecf5 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -1214,46 +1214,6 @@ static void do_st16_mmu(CPUState *cpu, vaddr addr, Int128 val,
     clear_helper_retaddr();
 }
 
-uint32_t cpu_ldub_code(CPUArchState *env, abi_ptr ptr)
-{
-    uint32_t ret;
-
-    set_helper_retaddr(1);
-    ret = ldub_p(g2h_untagged(ptr));
-    clear_helper_retaddr();
-    return ret;
-}
-
-uint32_t cpu_lduw_code(CPUArchState *env, abi_ptr ptr)
-{
-    uint32_t ret;
-
-    set_helper_retaddr(1);
-    ret = lduw_p(g2h_untagged(ptr));
-    clear_helper_retaddr();
-    return ret;
-}
-
-uint32_t cpu_ldl_code(CPUArchState *env, abi_ptr ptr)
-{
-    uint32_t ret;
-
-    set_helper_retaddr(1);
-    ret = ldl_p(g2h_untagged(ptr));
-    clear_helper_retaddr();
-    return ret;
-}
-
-uint64_t cpu_ldq_code(CPUArchState *env, abi_ptr ptr)
-{
-    uint64_t ret;
-
-    set_helper_retaddr(1);
-    ret = ldq_p(g2h_untagged(ptr));
-    clear_helper_retaddr();
-    return ret;
-}
-
 uint8_t cpu_ldb_code_mmu(CPUArchState *env, vaddr addr,
                          MemOpIdx oi, uintptr_t ra)
 {
diff --git a/include/exec/cpu_ldst.h b/include/exec/cpu_ldst.h
index 0054508eda..77dc5ac61c 100644
--- a/include/exec/cpu_ldst.h
+++ b/include/exec/cpu_ldst.h
@@ -473,10 +473,33 @@ cpu_stq_le_data(CPUArchState *env, abi_ptr addr, uint64_t val)
 # define cpu_stq_mmuidx_ra    cpu_stq_le_mmuidx_ra
 #endif
 
-uint32_t cpu_ldub_code(CPUArchState *env, abi_ptr addr);
-uint32_t cpu_lduw_code(CPUArchState *env, abi_ptr addr);
-uint32_t cpu_ldl_code(CPUArchState *env, abi_ptr addr);
-uint64_t cpu_ldq_code(CPUArchState *env, abi_ptr addr);
+static inline uint32_t cpu_ldub_code(CPUArchState *env, abi_ptr addr)
+{
+    CPUState *cs = env_cpu(env);
+    MemOpIdx oi = make_memop_idx(MO_UB, cpu_mmu_index(cs, true));
+    return cpu_ldb_code_mmu(env, addr, oi, 0);
+}
+
+static inline uint32_t cpu_lduw_code(CPUArchState *env, abi_ptr addr)
+{
+    CPUState *cs = env_cpu(env);
+    MemOpIdx oi = make_memop_idx(MO_TEUW, cpu_mmu_index(cs, true));
+    return cpu_ldw_code_mmu(env, addr, oi, 0);
+}
+
+static inline uint32_t cpu_ldl_code(CPUArchState *env, abi_ptr addr)
+{
+    CPUState *cs = env_cpu(env);
+    MemOpIdx oi = make_memop_idx(MO_TEUL, cpu_mmu_index(cs, true));
+    return cpu_ldl_code_mmu(env, addr, oi, 0);
+}
+
+static inline uint64_t cpu_ldq_code(CPUArchState *env, abi_ptr addr)
+{
+    CPUState *cs = env_cpu(env);
+    MemOpIdx oi = make_memop_idx(MO_TEUQ, cpu_mmu_index(cs, true));
+    return cpu_ldq_code_mmu(env, addr, oi, 0);
+}
 
 /**
  * tlb_vaddr_to_host:

From 6a9dfe1984b0c593fb0ddb52d4e70832e6201dd6 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 11 Mar 2025 18:34:58 -0700
Subject: [PATCH 0108/2760] accel/tcg: Perform aligned atomic reads in
 translator_ld

Perform aligned atomic reads in translator_ld, if possible.
According to

https://lore.kernel.org/qemu-devel/20240607101403.1109-1-jim.shu@sifive.com/

this is required for RISC-V Ziccif.

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/translator.c | 42 ++++++++++++++++++++++++++++++++++++++----
 1 file changed, 38 insertions(+), 4 deletions(-)

diff --git a/accel/tcg/translator.c b/accel/tcg/translator.c
index ef1538b4fc..157be33bf6 100644
--- a/accel/tcg/translator.c
+++ b/accel/tcg/translator.c
@@ -265,12 +265,14 @@ static bool translator_ld(CPUArchState *env, DisasContextBase *db,
 
     if (likely(((base ^ last) & TARGET_PAGE_MASK) == 0)) {
         /* Entire read is from the first page. */
-        memcpy(dest, host + (pc - base), len);
-        return true;
+        goto do_read;
     }
 
     if (unlikely(((base ^ pc) & TARGET_PAGE_MASK) == 0)) {
-        /* Read begins on the first page and extends to the second. */
+        /*
+         * Read begins on the first page and extends to the second.
+         * The unaligned read is never atomic.
+         */
         size_t len0 = -(pc | TARGET_PAGE_MASK);
         memcpy(dest, host + (pc - base), len0);
         pc += len0;
@@ -329,7 +331,39 @@ static bool translator_ld(CPUArchState *env, DisasContextBase *db,
         host = db->host_addr[1];
     }
 
-    memcpy(dest, host + (pc - base), len);
+ do_read:
+    /*
+     * Assume aligned reads should be atomic, if possible.
+     * We're not in a position to jump out with EXCP_ATOMIC.
+     */
+    host += pc - base;
+    switch (len) {
+    case 2:
+        if (QEMU_IS_ALIGNED(pc, 2)) {
+            uint16_t t = qatomic_read((uint16_t *)host);
+            stw_he_p(dest, t);
+            return true;
+        }
+        break;
+    case 4:
+        if (QEMU_IS_ALIGNED(pc, 4)) {
+            uint32_t t = qatomic_read((uint32_t *)host);
+            stl_he_p(dest, t);
+            return true;
+        }
+        break;
+#ifdef CONFIG_ATOMIC64
+    case 8:
+        if (QEMU_IS_ALIGNED(pc, 8)) {
+            uint64_t t = qatomic_read__nocheck((uint64_t *)host);
+            stq_he_p(dest, t);
+            return true;
+        }
+        break;
+#endif
+    }
+    /* Unaligned or partial read from the second page is not atomic. */
+    memcpy(dest, host, len);
     return true;
 }
 

From 028119c8baedb091e4f358a6176710507b4ce37d Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 11 Mar 2025 20:21:26 -0700
Subject: [PATCH 0109/2760] accel/tcg: Use cpu_ld*_code_mmu in translator.c

Cache the mmu index in DisasContextBase.
Perform the read on host endianness, which lets us
share code with the translator_ld fast path.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/translator.c    | 58 ++++++++++++++++++---------------------
 include/exec/translator.h |  1 +
 2 files changed, 28 insertions(+), 31 deletions(-)

diff --git a/accel/tcg/translator.c b/accel/tcg/translator.c
index 157be33bf6..4c320ab9c3 100644
--- a/accel/tcg/translator.c
+++ b/accel/tcg/translator.c
@@ -11,10 +11,10 @@
 #include "qemu/log.h"
 #include "qemu/error-report.h"
 #include "exec/exec-all.h"
+#include "exec/cpu-ldst-common.h"
+#include "accel/tcg/cpu-mmu-index.h"
 #include "exec/translator.h"
-#include "exec/cpu_ldst.h"
 #include "exec/plugin-gen.h"
-#include "exec/cpu_ldst.h"
 #include "exec/tswap.h"
 #include "tcg/tcg-op-common.h"
 #include "internal-target.h"
@@ -142,6 +142,7 @@ void translator_loop(CPUState *cpu, TranslationBlock *tb, int *max_insns,
     db->host_addr[1] = NULL;
     db->record_start = 0;
     db->record_len = 0;
+    db->code_mmuidx = cpu_mmu_index(cpu, true);
 
     ops->init_disas_context(db, cpu);
     tcg_debug_assert(db->is_jmp == DISAS_NEXT);  /* no early exit */
@@ -457,55 +458,50 @@ bool translator_st(const DisasContextBase *db, void *dest,
 
 uint8_t translator_ldub(CPUArchState *env, DisasContextBase *db, vaddr pc)
 {
-    uint8_t raw;
+    uint8_t val;
 
-    if (!translator_ld(env, db, &raw, pc, sizeof(raw))) {
-        raw = cpu_ldub_code(env, pc);
-        record_save(db, pc, &raw, sizeof(raw));
+    if (!translator_ld(env, db, &val, pc, sizeof(val))) {
+        MemOpIdx oi = make_memop_idx(MO_UB, db->code_mmuidx);
+        val = cpu_ldb_code_mmu(env, pc, oi, 0);
+        record_save(db, pc, &val, sizeof(val));
     }
-    return raw;
+    return val;
 }
 
 uint16_t translator_lduw(CPUArchState *env, DisasContextBase *db, vaddr pc)
 {
-    uint16_t raw, tgt;
+    uint16_t val;
 
-    if (translator_ld(env, db, &raw, pc, sizeof(raw))) {
-        tgt = tswap16(raw);
-    } else {
-        tgt = cpu_lduw_code(env, pc);
-        raw = tswap16(tgt);
-        record_save(db, pc, &raw, sizeof(raw));
+    if (!translator_ld(env, db, &val, pc, sizeof(val))) {
+        MemOpIdx oi = make_memop_idx(MO_UW, db->code_mmuidx);
+        val = cpu_ldw_code_mmu(env, pc, oi, 0);
+        record_save(db, pc, &val, sizeof(val));
     }
-    return tgt;
+    return tswap16(val);
 }
 
 uint32_t translator_ldl(CPUArchState *env, DisasContextBase *db, vaddr pc)
 {
-    uint32_t raw, tgt;
+    uint32_t val;
 
-    if (translator_ld(env, db, &raw, pc, sizeof(raw))) {
-        tgt = tswap32(raw);
-    } else {
-        tgt = cpu_ldl_code(env, pc);
-        raw = tswap32(tgt);
-        record_save(db, pc, &raw, sizeof(raw));
+    if (!translator_ld(env, db, &val, pc, sizeof(val))) {
+        MemOpIdx oi = make_memop_idx(MO_UL, db->code_mmuidx);
+        val = cpu_ldl_code_mmu(env, pc, oi, 0);
+        record_save(db, pc, &val, sizeof(val));
     }
-    return tgt;
+    return tswap32(val);
 }
 
 uint64_t translator_ldq(CPUArchState *env, DisasContextBase *db, vaddr pc)
 {
-    uint64_t raw, tgt;
+    uint64_t val;
 
-    if (translator_ld(env, db, &raw, pc, sizeof(raw))) {
-        tgt = tswap64(raw);
-    } else {
-        tgt = cpu_ldq_code(env, pc);
-        raw = tswap64(tgt);
-        record_save(db, pc, &raw, sizeof(raw));
+    if (!translator_ld(env, db, &val, pc, sizeof(val))) {
+        MemOpIdx oi = make_memop_idx(MO_UQ, db->code_mmuidx);
+        val = cpu_ldq_code_mmu(env, pc, oi, 0);
+        record_save(db, pc, &val, sizeof(val));
     }
-    return tgt;
+    return tswap64(val);
 }
 
 void translator_fake_ld(DisasContextBase *db, const void *data, size_t len)
diff --git a/include/exec/translator.h b/include/exec/translator.h
index d70942a10f..205dd85bba 100644
--- a/include/exec/translator.h
+++ b/include/exec/translator.h
@@ -73,6 +73,7 @@ struct DisasContextBase {
     int max_insns;
     bool plugin_enabled;
     bool fake_insn;
+    uint8_t code_mmuidx;
     struct TCGOp *insn_start;
     void *host_addr[2];
 

From 5c43a750b67d803588e0743e571ec055dbe6488f Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 12 Mar 2025 06:04:13 -0700
Subject: [PATCH 0110/2760] accel/tcg: Implement translator_ld*_end

Add a new family of translator load functions which take
an absolute endianness value in the form of MO_BE/MO_LE.
Expand the other translator_ld* functions on top of this.
Remove exec/tswap.h from translator.c.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/translator.c    | 26 +++++++++++++++------
 include/exec/translator.h | 49 ++++++++++++++++++++++++---------------
 2 files changed, 49 insertions(+), 26 deletions(-)

diff --git a/accel/tcg/translator.c b/accel/tcg/translator.c
index 4c320ab9c3..2ab081b95f 100644
--- a/accel/tcg/translator.c
+++ b/accel/tcg/translator.c
@@ -8,6 +8,7 @@
  */
 
 #include "qemu/osdep.h"
+#include "qemu/bswap.h"
 #include "qemu/log.h"
 #include "qemu/error-report.h"
 #include "exec/exec-all.h"
@@ -15,7 +16,6 @@
 #include "accel/tcg/cpu-mmu-index.h"
 #include "exec/translator.h"
 #include "exec/plugin-gen.h"
-#include "exec/tswap.h"
 #include "tcg/tcg-op-common.h"
 #include "internal-target.h"
 #include "disas/disas.h"
@@ -468,7 +468,8 @@ uint8_t translator_ldub(CPUArchState *env, DisasContextBase *db, vaddr pc)
     return val;
 }
 
-uint16_t translator_lduw(CPUArchState *env, DisasContextBase *db, vaddr pc)
+uint16_t translator_lduw_end(CPUArchState *env, DisasContextBase *db,
+                             vaddr pc, MemOp endian)
 {
     uint16_t val;
 
@@ -477,10 +478,14 @@ uint16_t translator_lduw(CPUArchState *env, DisasContextBase *db, vaddr pc)
         val = cpu_ldw_code_mmu(env, pc, oi, 0);
         record_save(db, pc, &val, sizeof(val));
     }
-    return tswap16(val);
+    if (endian & MO_BSWAP) {
+        val = bswap16(val);
+    }
+    return val;
 }
 
-uint32_t translator_ldl(CPUArchState *env, DisasContextBase *db, vaddr pc)
+uint32_t translator_ldl_end(CPUArchState *env, DisasContextBase *db,
+                            vaddr pc, MemOp endian)
 {
     uint32_t val;
 
@@ -489,10 +494,14 @@ uint32_t translator_ldl(CPUArchState *env, DisasContextBase *db, vaddr pc)
         val = cpu_ldl_code_mmu(env, pc, oi, 0);
         record_save(db, pc, &val, sizeof(val));
     }
-    return tswap32(val);
+    if (endian & MO_BSWAP) {
+        val = bswap32(val);
+    }
+    return val;
 }
 
-uint64_t translator_ldq(CPUArchState *env, DisasContextBase *db, vaddr pc)
+uint64_t translator_ldq_end(CPUArchState *env, DisasContextBase *db,
+                            vaddr pc, MemOp endian)
 {
     uint64_t val;
 
@@ -501,7 +510,10 @@ uint64_t translator_ldq(CPUArchState *env, DisasContextBase *db, vaddr pc)
         val = cpu_ldq_code_mmu(env, pc, oi, 0);
         record_save(db, pc, &val, sizeof(val));
     }
-    return tswap64(val);
+    if (endian & MO_BSWAP) {
+        val = bswap64(val);
+    }
+    return val;
 }
 
 void translator_fake_ld(DisasContextBase *db, const void *data, size_t len)
diff --git a/include/exec/translator.h b/include/exec/translator.h
index 205dd85bba..3c32655569 100644
--- a/include/exec/translator.h
+++ b/include/exec/translator.h
@@ -18,7 +18,7 @@
  * member in your target-specific DisasContext.
  */
 
-#include "qemu/bswap.h"
+#include "exec/memop.h"
 #include "exec/vaddr.h"
 
 /**
@@ -181,42 +181,53 @@ bool translator_io_start(DisasContextBase *db);
  */
 
 uint8_t translator_ldub(CPUArchState *env, DisasContextBase *db, vaddr pc);
-uint16_t translator_lduw(CPUArchState *env, DisasContextBase *db, vaddr pc);
-uint32_t translator_ldl(CPUArchState *env, DisasContextBase *db, vaddr pc);
-uint64_t translator_ldq(CPUArchState *env, DisasContextBase *db, vaddr pc);
+uint16_t translator_lduw_end(CPUArchState *env, DisasContextBase *db,
+                             vaddr pc, MemOp endian);
+uint32_t translator_ldl_end(CPUArchState *env, DisasContextBase *db,
+                            vaddr pc, MemOp endian);
+uint64_t translator_ldq_end(CPUArchState *env, DisasContextBase *db,
+                            vaddr pc, MemOp endian);
+
+#ifdef COMPILING_PER_TARGET
+static inline uint16_t
+translator_lduw(CPUArchState *env, DisasContextBase *db, vaddr pc)
+{
+    return translator_lduw_end(env, db, pc, MO_TE);
+}
+
+static inline uint32_t
+translator_ldl(CPUArchState *env, DisasContextBase *db, vaddr pc)
+{
+    return translator_ldl_end(env, db, pc, MO_TE);
+}
+
+static inline uint64_t
+translator_ldq(CPUArchState *env, DisasContextBase *db, vaddr pc)
+{
+    return translator_ldq_end(env, db, pc, MO_TE);
+}
 
 static inline uint16_t
 translator_lduw_swap(CPUArchState *env, DisasContextBase *db,
                      vaddr pc, bool do_swap)
 {
-    uint16_t ret = translator_lduw(env, db, pc);
-    if (do_swap) {
-        ret = bswap16(ret);
-    }
-    return ret;
+    return translator_lduw_end(env, db, pc, MO_TE ^ (do_swap * MO_BSWAP));
 }
 
 static inline uint32_t
 translator_ldl_swap(CPUArchState *env, DisasContextBase *db,
                     vaddr pc, bool do_swap)
 {
-    uint32_t ret = translator_ldl(env, db, pc);
-    if (do_swap) {
-        ret = bswap32(ret);
-    }
-    return ret;
+    return translator_ldl_end(env, db, pc, MO_TE ^ (do_swap * MO_BSWAP));
 }
 
 static inline uint64_t
 translator_ldq_swap(CPUArchState *env, DisasContextBase *db,
                     vaddr pc, bool do_swap)
 {
-    uint64_t ret = translator_ldq(env, db, pc);
-    if (do_swap) {
-        ret = bswap64(ret);
-    }
-    return ret;
+    return translator_ldq_end(env, db, pc, MO_TE ^ (do_swap * MO_BSWAP));
 }
+#endif /* COMPILING_PER_TARGET */
 
 /**
  * translator_fake_ld - fake instruction load

From 87f8eb1d30050d6df6cbd0c61eee6dc836451370 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 12 Mar 2025 10:37:23 -0700
Subject: [PATCH 0111/2760] accel/tcg: Remove mmap_lock/unlock from
 watchpoint.c
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The mmap_lock is user-only, whereas watchpoint.c
is only compiled for system mode.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/watchpoint.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/accel/tcg/watchpoint.c b/accel/tcg/watchpoint.c
index 65b21884ce..cfb37a49e7 100644
--- a/accel/tcg/watchpoint.c
+++ b/accel/tcg/watchpoint.c
@@ -124,17 +124,14 @@ void cpu_check_watchpoint(CPUState *cpu, vaddr addr, vaddr len,
             }
             cpu->watchpoint_hit = wp;
 
-            mmap_lock();
             /* This call also restores vCPU state */
             tb_check_watchpoint(cpu, ra);
             if (wp->flags & BP_STOP_BEFORE_ACCESS) {
                 cpu->exception_index = EXCP_DEBUG;
-                mmap_unlock();
                 cpu_loop_exit(cpu);
             } else {
                 /* Force execution of one insn next time.  */
                 cpu->cflags_next_tb = 1 | CF_NOIRQ | curr_cflags(cpu);
-                mmap_unlock();
                 cpu_loop_exit_noexc(cpu);
             }
         } else {

From 4d3ad3c3ba1f1e9c217d0581e4913a59ef2ac15f Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 12 Mar 2025 10:36:39 -0700
Subject: [PATCH 0112/2760] include/exec: Split out mmap-lock.h
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Split out mmap_lock, et al from page-protection.h
to a new header.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cpu-exec.c           |  1 +
 accel/tcg/internal-target.h    |  1 +
 accel/tcg/tb-maint.c           |  1 +
 accel/tcg/translate-all.c      |  1 +
 bsd-user/bsd-mem.h             |  1 +
 bsd-user/mmap.c                |  1 +
 include/exec/mmap-lock.h       | 33 +++++++++++++++++++++++++++++++++
 include/exec/page-protection.h | 22 ----------------------
 linux-user/arm/cpu_loop.c      |  1 +
 linux-user/elfload.c           |  1 +
 linux-user/flatload.c          |  1 +
 linux-user/mmap.c              |  1 +
 linux-user/syscall.c           |  1 +
 target/arm/helper.c            |  1 +
 14 files changed, 45 insertions(+), 22 deletions(-)
 create mode 100644 include/exec/mmap-lock.h

diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index ef3d967e3a..372b876604 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -27,6 +27,7 @@
 #include "disas/disas.h"
 #include "exec/cpu-common.h"
 #include "exec/page-protection.h"
+#include "exec/mmap-lock.h"
 #include "exec/translation-block.h"
 #include "tcg/tcg.h"
 #include "qemu/atomic.h"
diff --git a/accel/tcg/internal-target.h b/accel/tcg/internal-target.h
index 2cdf11c905..c88f007ffb 100644
--- a/accel/tcg/internal-target.h
+++ b/accel/tcg/internal-target.h
@@ -13,6 +13,7 @@
 #include "exec/translation-block.h"
 #include "tb-internal.h"
 #include "tcg-target-mo.h"
+#include "exec/mmap-lock.h"
 
 /*
  * Access to the various translations structures need to be serialised
diff --git a/accel/tcg/tb-maint.c b/accel/tcg/tb-maint.c
index 3f1bebf6ab..d5899ad047 100644
--- a/accel/tcg/tb-maint.c
+++ b/accel/tcg/tb-maint.c
@@ -24,6 +24,7 @@
 #include "exec/log.h"
 #include "exec/exec-all.h"
 #include "exec/page-protection.h"
+#include "exec/mmap-lock.h"
 #include "exec/tb-flush.h"
 #include "tb-internal.h"
 #include "system/tcg.h"
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index 82bc16bd53..16e5043597 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -45,6 +45,7 @@
 
 #include "exec/cputlb.h"
 #include "exec/page-protection.h"
+#include "exec/mmap-lock.h"
 #include "tb-internal.h"
 #include "exec/translator.h"
 #include "exec/tb-flush.h"
diff --git a/bsd-user/bsd-mem.h b/bsd-user/bsd-mem.h
index 90ca0e3377..1be906c591 100644
--- a/bsd-user/bsd-mem.h
+++ b/bsd-user/bsd-mem.h
@@ -56,6 +56,7 @@
 #include <fcntl.h>
 
 #include "qemu-bsd.h"
+#include "exec/mmap-lock.h"
 #include "exec/page-protection.h"
 #include "user/page-protection.h"
 
diff --git a/bsd-user/mmap.c b/bsd-user/mmap.c
index 3f0df79c37..47e317517c 100644
--- a/bsd-user/mmap.c
+++ b/bsd-user/mmap.c
@@ -17,6 +17,7 @@
  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 #include "qemu/osdep.h"
+#include "exec/mmap-lock.h"
 #include "exec/page-protection.h"
 #include "user/page-protection.h"
 
diff --git a/include/exec/mmap-lock.h b/include/exec/mmap-lock.h
new file mode 100644
index 0000000000..50ffdab9c5
--- /dev/null
+++ b/include/exec/mmap-lock.h
@@ -0,0 +1,33 @@
+/*
+ * QEMU user-only mmap lock, with stubs for system mode
+ *
+ *  Copyright (c) 2003 Fabrice Bellard
+ *
+ * SPDX-License-Identifier: LGPL-2.1-or-later
+ */
+#ifndef EXEC_MMAP_LOCK_H
+#define EXEC_MMAP_LOCK_H
+
+#ifdef CONFIG_USER_ONLY
+
+void TSA_NO_TSA mmap_lock(void);
+void TSA_NO_TSA mmap_unlock(void);
+bool have_mmap_lock(void);
+
+static inline void mmap_unlock_guard(void *unused)
+{
+    mmap_unlock();
+}
+
+#define WITH_MMAP_LOCK_GUARD() \
+    for (int _mmap_lock_iter __attribute__((cleanup(mmap_unlock_guard))) \
+         = (mmap_lock(), 0); _mmap_lock_iter == 0; _mmap_lock_iter = 1)
+
+#else
+
+static inline void mmap_lock(void) {}
+static inline void mmap_unlock(void) {}
+#define WITH_MMAP_LOCK_GUARD()
+
+#endif /* CONFIG_USER_ONLY */
+#endif /* EXEC_MMAP_LOCK_H */
diff --git a/include/exec/page-protection.h b/include/exec/page-protection.h
index 3e0a8a0333..c43231af8b 100644
--- a/include/exec/page-protection.h
+++ b/include/exec/page-protection.h
@@ -38,26 +38,4 @@
  */
 #define PAGE_PASSTHROUGH 0x0800
 
-#ifdef CONFIG_USER_ONLY
-
-void TSA_NO_TSA mmap_lock(void);
-void TSA_NO_TSA mmap_unlock(void);
-bool have_mmap_lock(void);
-
-static inline void mmap_unlock_guard(void *unused)
-{
-    mmap_unlock();
-}
-
-#define WITH_MMAP_LOCK_GUARD() \
-    for (int _mmap_lock_iter __attribute__((cleanup(mmap_unlock_guard))) \
-         = (mmap_lock(), 0); _mmap_lock_iter == 0; _mmap_lock_iter = 1)
-#else
-
-static inline void mmap_lock(void) {}
-static inline void mmap_unlock(void) {}
-#define WITH_MMAP_LOCK_GUARD()
-
-#endif /* !CONFIG_USER_ONLY */
-
 #endif
diff --git a/linux-user/arm/cpu_loop.c b/linux-user/arm/cpu_loop.c
index 7416e3216e..e8417d0406 100644
--- a/linux-user/arm/cpu_loop.c
+++ b/linux-user/arm/cpu_loop.c
@@ -25,6 +25,7 @@
 #include "signal-common.h"
 #include "semihosting/common-semi.h"
 #include "exec/page-protection.h"
+#include "exec/mmap-lock.h"
 #include "user/page-protection.h"
 #include "target/arm/syndrome.h"
 
diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index fa83d78667..99811af5e7 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -10,6 +10,7 @@
 #include "user/tswap-target.h"
 #include "user/page-protection.h"
 #include "exec/page-protection.h"
+#include "exec/mmap-lock.h"
 #include "exec/translation-block.h"
 #include "user/guest-base.h"
 #include "user-internals.h"
diff --git a/linux-user/flatload.c b/linux-user/flatload.c
index d5cb1830dd..4beb3ed1b9 100644
--- a/linux-user/flatload.c
+++ b/linux-user/flatload.c
@@ -35,6 +35,7 @@
 
 #include "qemu.h"
 #include "exec/page-protection.h"
+#include "exec/mmap-lock.h"
 #include "user-internals.h"
 #include "loader.h"
 #include "user-mmap.h"
diff --git a/linux-user/mmap.c b/linux-user/mmap.c
index d1f36e6f16..f88a80c31e 100644
--- a/linux-user/mmap.c
+++ b/linux-user/mmap.c
@@ -21,6 +21,7 @@
 #include "trace.h"
 #include "exec/log.h"
 #include "exec/page-protection.h"
+#include "exec/mmap-lock.h"
 #include "exec/tb-flush.h"
 #include "exec/translation-block.h"
 #include "qemu.h"
diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 8bfe4912e1..5826ac3adb 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -26,6 +26,7 @@
 #include "tcg/startup.h"
 #include "target_mman.h"
 #include "exec/page-protection.h"
+#include "exec/mmap-lock.h"
 #include "exec/tb-flush.h"
 #include "exec/translation-block.h"
 #include <elf.h>
diff --git a/target/arm/helper.c b/target/arm/helper.c
index bb445e30cd..0454b06a6c 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -14,6 +14,7 @@
 #include "cpu-features.h"
 #include "exec/helper-proto.h"
 #include "exec/page-protection.h"
+#include "exec/mmap-lock.h"
 #include "qemu/main-loop.h"
 #include "qemu/timer.h"
 #include "qemu/bitops.h"

From 8be545ba5a315a9aaf7307f143a4a7926a6e605c Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 12 Mar 2025 12:11:21 -0700
Subject: [PATCH 0113/2760] include/system: Move exec/memory.h to
 system/memory.h
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Convert the existing includes with

  sed -i ,exec/memory.h,system/memory.h,g

Move the include within cpu-all.h into a !CONFIG_USER_ONLY block.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 MAINTAINERS                               | 2 +-
 accel/kvm/kvm-all.c                       | 2 +-
 accel/tcg/cputlb.c                        | 2 +-
 backends/tpm/tpm_util.c                   | 2 +-
 block/blkio.c                             | 4 ++--
 disas/disas-mon.c                         | 2 +-
 docs/devel/memory.rst                     | 2 +-
 hw/acpi/erst.c                            | 2 +-
 hw/arm/strongarm.h                        | 2 +-
 hw/avr/atmega.c                           | 2 +-
 hw/block/fdc-sysbus.c                     | 2 +-
 hw/core/cpu-system.c                      | 2 +-
 hw/core/loader-fit.c                      | 2 +-
 hw/core/loader.c                          | 2 +-
 hw/display/apple-gfx.h                    | 2 +-
 hw/display/edid-region.c                  | 2 +-
 hw/display/framebuffer.h                  | 2 +-
 hw/display/vga_int.h                      | 2 +-
 hw/hyperv/hv-balloon-our_range_memslots.h | 2 +-
 hw/hyperv/hyperv.c                        | 2 +-
 hw/i386/acpi-common.c                     | 2 +-
 hw/i386/acpi-microvm.c                    | 2 +-
 hw/i386/pc_piix.c                         | 2 +-
 hw/intc/ioapic_internal.h                 | 2 +-
 hw/intc/mips_gic.c                        | 2 +-
 hw/intc/ompic.c                           | 2 +-
 hw/net/i82596.h                           | 2 +-
 hw/net/ne2000.c                           | 2 +-
 hw/net/pcnet.h                            | 2 +-
 hw/pci-bridge/pci_bridge_dev.c            | 2 +-
 hw/pci-host/remote.c                      | 2 +-
 hw/ppc/pnv_homer.c                        | 2 +-
 hw/ppc/sam460ex.c                         | 2 +-
 hw/remote/iommu.c                         | 2 +-
 hw/remote/machine.c                       | 2 +-
 hw/remote/proxy-memory-listener.c         | 2 +-
 hw/remote/vfio-user-obj.c                 | 2 +-
 hw/s390x/s390-pci-inst.c                  | 2 +-
 hw/timer/sh_timer.c                       | 2 +-
 hw/tpm/tpm_ppi.h                          | 2 +-
 hw/usb/hcd-uhci.h                         | 2 +-
 hw/vfio/common.c                          | 2 +-
 hw/vfio/container.c                       | 2 +-
 hw/vfio/pci.h                             | 2 +-
 hw/vfio/platform.c                        | 2 +-
 hw/virtio/vhost-iova-tree.h               | 2 +-
 hw/xtensa/sim.c                           | 2 +-
 hw/xtensa/virt.c                          | 2 +-
 hw/xtensa/xtensa_memory.c                 | 2 +-
 hw/xtensa/xtfpga.c                        | 2 +-
 include/exec/cpu-all.h                    | 5 ++++-
 include/exec/ioport.h                     | 2 +-
 include/exec/ram_addr.h                   | 2 +-
 include/hw/acpi/acpi.h                    | 2 +-
 include/hw/acpi/ich9_tco.h                | 2 +-
 include/hw/arm/fsl-imx25.h                | 2 +-
 include/hw/arm/fsl-imx31.h                | 2 +-
 include/hw/arm/fsl-imx6.h                 | 2 +-
 include/hw/arm/fsl-imx6ul.h               | 2 +-
 include/hw/arm/omap.h                     | 2 +-
 include/hw/arm/stm32l4x5_soc.h            | 2 +-
 include/hw/boards.h                       | 2 +-
 include/hw/char/parallel.h                | 2 +-
 include/hw/char/riscv_htif.h              | 2 +-
 include/hw/char/serial-mm.h               | 2 +-
 include/hw/char/serial.h                  | 2 +-
 include/hw/display/macfb.h                | 2 +-
 include/hw/fsi/aspeed_apb2opb.h           | 2 +-
 include/hw/fsi/cfam.h                     | 2 +-
 include/hw/fsi/fsi-master.h               | 2 +-
 include/hw/fsi/fsi.h                      | 2 +-
 include/hw/fsi/lbus.h                     | 2 +-
 include/hw/gpio/npcm7xx_gpio.h            | 2 +-
 include/hw/i2c/npcm7xx_smbus.h            | 2 +-
 include/hw/i2c/pm_smbus.h                 | 2 +-
 include/hw/i386/apic_internal.h           | 2 +-
 include/hw/i386/x86.h                     | 2 +-
 include/hw/ide/ahci.h                     | 2 +-
 include/hw/ipmi/ipmi.h                    | 2 +-
 include/hw/isa/apm.h                      | 2 +-
 include/hw/isa/isa.h                      | 2 +-
 include/hw/m68k/q800.h                    | 2 +-
 include/hw/mem/npcm7xx_mc.h               | 2 +-
 include/hw/mem/pc-dimm.h                  | 2 +-
 include/hw/mips/mips.h                    | 2 +-
 include/hw/misc/auxbus.h                  | 2 +-
 include/hw/misc/ivshmem-flat.h            | 2 +-
 include/hw/misc/mac_via.h                 | 2 +-
 include/hw/misc/npcm7xx_mft.h             | 2 +-
 include/hw/misc/npcm_clk.h                | 2 +-
 include/hw/misc/npcm_gcr.h                | 2 +-
 include/hw/misc/pvpanic.h                 | 2 +-
 include/hw/net/dp8393x.h                  | 2 +-
 include/hw/net/msf2-emac.h                | 2 +-
 include/hw/nvram/mac_nvram.h              | 2 +-
 include/hw/nvram/npcm7xx_otp.h            | 2 +-
 include/hw/pci-host/fsl_imx8m_phy.h       | 2 +-
 include/hw/pci-host/pam.h                 | 2 +-
 include/hw/pci-host/remote.h              | 2 +-
 include/hw/pci/pci.h                      | 2 +-
 include/hw/pci/pcie_host.h                | 2 +-
 include/hw/pci/shpc.h                     | 2 +-
 include/hw/ppc/mac_dbdma.h                | 2 +-
 include/hw/ppc/pnv_lpc.h                  | 2 +-
 include/hw/ppc/pnv_occ.h                  | 2 +-
 include/hw/ppc/pnv_sbe.h                  | 2 +-
 include/hw/ppc/pnv_xscom.h                | 2 +-
 include/hw/ppc/ppc4xx.h                   | 2 +-
 include/hw/ppc/vof.h                      | 2 +-
 include/hw/ppc/xics.h                     | 2 +-
 include/hw/register.h                     | 2 +-
 include/hw/remote/proxy-memory-listener.h | 2 +-
 include/hw/sh4/sh_intc.h                  | 2 +-
 include/hw/southbridge/ich9.h             | 2 +-
 include/hw/sysbus.h                       | 2 +-
 include/hw/timer/npcm7xx_timer.h          | 2 +-
 include/hw/tricore/tricore.h              | 2 +-
 include/hw/usb.h                          | 2 +-
 include/hw/vfio/vfio-common.h             | 2 +-
 include/hw/vfio/vfio-container-base.h     | 2 +-
 include/hw/virtio/vhost-backend.h         | 2 +-
 include/hw/virtio/vhost.h                 | 2 +-
 include/hw/virtio/virtio.h                | 2 +-
 include/hw/xen/xen-pvh-common.h           | 2 +-
 include/hw/xtensa/mx_pic.h                | 2 +-
 include/qemu/iova-tree.h                  | 2 +-
 include/qemu/reserved-region.h            | 2 +-
 include/system/dma.h                      | 2 +-
 include/system/hostmem.h                  | 2 +-
 include/system/kvm_int.h                  | 2 +-
 include/{exec => system}/memory.h         | 8 ++------
 include/system/vhost-user-backend.h       | 2 +-
 migration/dirtyrate.c                     | 2 +-
 migration/rdma.c                          | 2 +-
 migration/rdma.h                          | 2 +-
 migration/savevm.c                        | 2 +-
 monitor/hmp-cmds-target.c                 | 2 +-
 rust/wrapper.h                            | 2 +-
 scripts/analyze-inclusions                | 2 +-
 stubs/ram-block.c                         | 2 +-
 system/dirtylimit.c                       | 2 +-
 system/ioport.c                           | 2 +-
 system/memory.c                           | 2 +-
 system/memory_mapping.c                   | 2 +-
 system/physmem.c                          | 2 +-
 system/qtest.c                            | 2 +-
 target/avr/cpu.h                          | 2 +-
 target/loongarch/cpu.h                    | 2 +-
 target/mips/cpu.h                         | 2 +-
 target/xtensa/cpu.c                       | 2 +-
 tests/qtest/fuzz/generic_fuzz.c           | 2 +-
 tests/qtest/fuzz/qos_fuzz.c               | 2 +-
 tests/unit/test-resv-mem.c                | 2 +-
 ui/console.c                              | 2 +-
 util/vfio-helpers.c                       | 2 +-
 155 files changed, 160 insertions(+), 161 deletions(-)
 rename include/{exec => system}/memory.h (99%)

diff --git a/MAINTAINERS b/MAINTAINERS
index 04573e2934..5d391cfaa7 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3120,7 +3120,7 @@ R: Philippe Mathieu-Daudé <philmd@linaro.org>
 S: Supported
 F: include/exec/ioport.h
 F: include/exec/memop.h
-F: include/exec/memory.h
+F: include/system/memory.h
 F: include/exec/ram_addr.h
 F: include/exec/ramblock.h
 F: include/system/memory_mapping.h
diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index 951e8214e0..9e06a95f75 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -33,7 +33,7 @@
 #include "system/cpus.h"
 #include "system/accel-blocker.h"
 #include "qemu/bswap.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "exec/ram_addr.h"
 #include "qemu/event_notifier.h"
 #include "qemu/main-loop.h"
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index 2817c9dbdd..6f0ea9067b 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -22,7 +22,7 @@
 #include "accel/tcg/cpu-ops.h"
 #include "exec/exec-all.h"
 #include "exec/page-protection.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "exec/cpu_ldst.h"
 #include "exec/cputlb.h"
 #include "exec/tb-flush.h"
diff --git a/backends/tpm/tpm_util.c b/backends/tpm/tpm_util.c
index f07a2656ce..f2d1739e33 100644
--- a/backends/tpm/tpm_util.c
+++ b/backends/tpm/tpm_util.c
@@ -25,7 +25,7 @@
 #include "qapi/error.h"
 #include "qapi/visitor.h"
 #include "tpm_int.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "hw/qdev-properties.h"
 #include "system/tpm_backend.h"
 #include "system/tpm_util.h"
diff --git a/block/blkio.c b/block/blkio.c
index 5f4fce2b1b..4142673984 100644
--- a/block/blkio.c
+++ b/block/blkio.c
@@ -11,7 +11,7 @@
 #include "qemu/osdep.h"
 #include <blkio.h>
 #include "block/block_int.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "exec/cpu-common.h" /* for qemu_ram_get_fd() */
 #include "qemu/defer-call.h"
 #include "qapi/error.h"
@@ -19,7 +19,7 @@
 #include "qobject/qdict.h"
 #include "qemu/module.h"
 #include "system/block-backend.h"
-#include "exec/memory.h" /* for ram_block_discard_disable() */
+#include "system/memory.h" /* for ram_block_discard_disable() */
 
 #include "block/block-io.h"
 
diff --git a/disas/disas-mon.c b/disas/disas-mon.c
index 37bf16ac79..9c693618c2 100644
--- a/disas/disas-mon.c
+++ b/disas/disas-mon.c
@@ -7,7 +7,7 @@
 #include "qemu/osdep.h"
 #include "disas-internal.h"
 #include "disas/disas.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "hw/core/cpu.h"
 #include "monitor/monitor.h"
 
diff --git a/docs/devel/memory.rst b/docs/devel/memory.rst
index 69c5e3f914..57fb2aec76 100644
--- a/docs/devel/memory.rst
+++ b/docs/devel/memory.rst
@@ -369,4 +369,4 @@ callbacks are called:
 API Reference
 -------------
 
-.. kernel-doc:: include/exec/memory.h
+.. kernel-doc:: include/system/memory.h
diff --git a/hw/acpi/erst.c b/hw/acpi/erst.c
index ec64f92893..5c4c1dc638 100644
--- a/hw/acpi/erst.c
+++ b/hw/acpi/erst.c
@@ -12,7 +12,7 @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "hw/qdev-core.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "qom/object.h"
 #include "hw/pci/pci_device.h"
 #include "qom/object_interfaces.h"
diff --git a/hw/arm/strongarm.h b/hw/arm/strongarm.h
index 192821f6aa..b11b3a3379 100644
--- a/hw/arm/strongarm.h
+++ b/hw/arm/strongarm.h
@@ -1,7 +1,7 @@
 #ifndef STRONGARM_H
 #define STRONGARM_H
 
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "target/arm/cpu-qom.h"
 
 #define SA_CS0          0x00000000
diff --git a/hw/avr/atmega.c b/hw/avr/atmega.c
index 11fab184de..cb721c96b7 100644
--- a/hw/avr/atmega.c
+++ b/hw/avr/atmega.c
@@ -12,7 +12,7 @@
 #include "qemu/module.h"
 #include "qemu/units.h"
 #include "qapi/error.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "exec/address-spaces.h"
 #include "system/system.h"
 #include "hw/qdev-properties.h"
diff --git a/hw/block/fdc-sysbus.c b/hw/block/fdc-sysbus.c
index 381b492aec..4955e478cd 100644
--- a/hw/block/fdc-sysbus.c
+++ b/hw/block/fdc-sysbus.c
@@ -26,7 +26,7 @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "qom/object.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "hw/sysbus.h"
 #include "hw/block/fdc.h"
 #include "migration/vmstate.h"
diff --git a/hw/core/cpu-system.c b/hw/core/cpu-system.c
index aed5076ec7..5ef8c24b5b 100644
--- a/hw/core/cpu-system.c
+++ b/hw/core/cpu-system.c
@@ -22,7 +22,7 @@
 #include "qapi/error.h"
 #include "exec/address-spaces.h"
 #include "exec/cputlb.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "exec/tb-flush.h"
 #include "exec/tswap.h"
 #include "hw/qdev-core.h"
diff --git a/hw/core/loader-fit.c b/hw/core/loader-fit.c
index 6eb66406b0..2dea485ae0 100644
--- a/hw/core/loader-fit.c
+++ b/hw/core/loader-fit.c
@@ -20,7 +20,7 @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "qemu/units.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "hw/loader.h"
 #include "hw/loader-fit.h"
 #include "qemu/cutils.h"
diff --git a/hw/core/loader.c b/hw/core/loader.c
index 2e35f0aa90..a3aa62d132 100644
--- a/hw/core/loader.c
+++ b/hw/core/loader.c
@@ -59,7 +59,7 @@
 #include "uboot_image.h"
 #include "hw/loader.h"
 #include "hw/nvram/fw_cfg.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "hw/boards.h"
 #include "qemu/cutils.h"
 #include "system/runstate.h"
diff --git a/hw/display/apple-gfx.h b/hw/display/apple-gfx.h
index 3900cdbabb..a8b1d1efc0 100644
--- a/hw/display/apple-gfx.h
+++ b/hw/display/apple-gfx.h
@@ -9,7 +9,7 @@
 #define QEMU_APPLE_GFX_H
 
 #include "qemu/queue.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "hw/qdev-properties.h"
 #include "ui/surface.h"
 
diff --git a/hw/display/edid-region.c b/hw/display/edid-region.c
index 675429dc18..f1596fba9a 100644
--- a/hw/display/edid-region.c
+++ b/hw/display/edid-region.c
@@ -1,5 +1,5 @@
 #include "qemu/osdep.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "hw/display/edid.h"
 
 static uint64_t edid_region_read(void *ptr, hwaddr addr, unsigned size)
diff --git a/hw/display/framebuffer.h b/hw/display/framebuffer.h
index 38fa0dcec6..29a828ce7a 100644
--- a/hw/display/framebuffer.h
+++ b/hw/display/framebuffer.h
@@ -1,7 +1,7 @@
 #ifndef QEMU_FRAMEBUFFER_H
 #define QEMU_FRAMEBUFFER_H
 
-#include "exec/memory.h"
+#include "system/memory.h"
 
 /* Framebuffer device helper routines.  */
 
diff --git a/hw/display/vga_int.h b/hw/display/vga_int.h
index f77c1c1145..60ad26e03e 100644
--- a/hw/display/vga_int.h
+++ b/hw/display/vga_int.h
@@ -27,7 +27,7 @@
 
 #include "ui/console.h"
 #include "exec/ioport.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 
 #include "hw/display/bochs-vbe.h"
 #include "hw/acpi/acpi_aml_interface.h"
diff --git a/hw/hyperv/hv-balloon-our_range_memslots.h b/hw/hyperv/hv-balloon-our_range_memslots.h
index df3b686bc7..b1f19d77da 100644
--- a/hw/hyperv/hv-balloon-our_range_memslots.h
+++ b/hw/hyperv/hv-balloon-our_range_memslots.h
@@ -11,7 +11,7 @@
 #define HW_HYPERV_HV_BALLOON_OUR_RANGE_MEMSLOTS_H
 
 
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "qom/object.h"
 #include "hv-balloon-page_range_tree.h"
 
diff --git a/hw/hyperv/hyperv.c b/hw/hyperv/hyperv.c
index 831e04f214..382c62d668 100644
--- a/hw/hyperv/hyperv.c
+++ b/hw/hyperv/hyperv.c
@@ -12,7 +12,7 @@
 #include "qemu/module.h"
 #include "qapi/error.h"
 #include "exec/address-spaces.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "system/kvm.h"
 #include "qemu/bitops.h"
 #include "qemu/error-report.h"
diff --git a/hw/i386/acpi-common.c b/hw/i386/acpi-common.c
index 0cc2919bb8..7bd08067a7 100644
--- a/hw/i386/acpi-common.c
+++ b/hw/i386/acpi-common.c
@@ -23,7 +23,7 @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "hw/acpi/acpi.h"
 #include "hw/acpi/aml-build.h"
 #include "hw/acpi/utils.h"
diff --git a/hw/i386/acpi-microvm.c b/hw/i386/acpi-microvm.c
index 279da6b4aa..bc6571778c 100644
--- a/hw/i386/acpi-microvm.c
+++ b/hw/i386/acpi-microvm.c
@@ -24,7 +24,7 @@
 #include "qemu/cutils.h"
 #include "qapi/error.h"
 
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "hw/acpi/acpi.h"
 #include "hw/acpi/acpi_aml_interface.h"
 #include "hw/acpi/aml-build.h"
diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
index dbb59df64f..0dce512f18 100644
--- a/hw/i386/pc_piix.c
+++ b/hw/i386/pc_piix.c
@@ -47,7 +47,7 @@
 #include "hw/i386/kvm/clock.h"
 #include "hw/sysbus.h"
 #include "hw/i2c/smbus_eeprom.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "hw/acpi/acpi.h"
 #include "qapi/error.h"
 #include "qemu/error-report.h"
diff --git a/hw/intc/ioapic_internal.h b/hw/intc/ioapic_internal.h
index 37b8565539..51205767f4 100644
--- a/hw/intc/ioapic_internal.h
+++ b/hw/intc/ioapic_internal.h
@@ -22,7 +22,7 @@
 #ifndef HW_INTC_IOAPIC_INTERNAL_H
 #define HW_INTC_IOAPIC_INTERNAL_H
 
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "hw/intc/ioapic.h"
 #include "hw/sysbus.h"
 #include "qemu/notify.h"
diff --git a/hw/intc/mips_gic.c b/hw/intc/mips_gic.c
index 5e3cbeabec..12d3908938 100644
--- a/hw/intc/mips_gic.c
+++ b/hw/intc/mips_gic.c
@@ -14,7 +14,7 @@
 #include "qemu/module.h"
 #include "qapi/error.h"
 #include "hw/sysbus.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "system/kvm.h"
 #include "system/reset.h"
 #include "kvm_mips.h"
diff --git a/hw/intc/ompic.c b/hw/intc/ompic.c
index 42af4567c6..169baf2ded 100644
--- a/hw/intc/ompic.c
+++ b/hw/intc/ompic.c
@@ -13,7 +13,7 @@
 #include "hw/qdev-properties.h"
 #include "hw/sysbus.h"
 #include "migration/vmstate.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "qom/object.h"
 
 #define TYPE_OR1K_OMPIC "or1k-ompic"
diff --git a/hw/net/i82596.h b/hw/net/i82596.h
index f0bbe810eb..4bdfcaf856 100644
--- a/hw/net/i82596.h
+++ b/hw/net/i82596.h
@@ -3,7 +3,7 @@
 
 #define I82596_IOPORT_SIZE       0x20
 
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "exec/address-spaces.h"
 
 #define PORT_RESET              0x00    /* reset 82596 */
diff --git a/hw/net/ne2000.c b/hw/net/ne2000.c
index b482c5f3af..b1923c8c3e 100644
--- a/hw/net/ne2000.c
+++ b/hw/net/ne2000.c
@@ -25,7 +25,7 @@
 #include "qemu/osdep.h"
 #include "net/eth.h"
 #include "qemu/module.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "hw/irq.h"
 #include "migration/vmstate.h"
 #include "ne2000.h"
diff --git a/hw/net/pcnet.h b/hw/net/pcnet.h
index eb7f46aab3..a94356ec30 100644
--- a/hw/net/pcnet.h
+++ b/hw/net/pcnet.h
@@ -7,7 +7,7 @@
 #define PCNET_LOOPTEST_CRC      1
 #define PCNET_LOOPTEST_NOCRC    2
 
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "hw/irq.h"
 
 /* BUS CONFIGURATION REGISTERS */
diff --git a/hw/pci-bridge/pci_bridge_dev.c b/hw/pci-bridge/pci_bridge_dev.c
index 0a91a8ae6c..4931ea24f6 100644
--- a/hw/pci-bridge/pci_bridge_dev.c
+++ b/hw/pci-bridge/pci_bridge_dev.c
@@ -28,7 +28,7 @@
 #include "hw/pci/shpc.h"
 #include "hw/pci/slotid_cap.h"
 #include "hw/qdev-properties.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "hw/pci/pci_bus.h"
 #include "hw/hotplug.h"
 #include "qom/object.h"
diff --git a/hw/pci-host/remote.c b/hw/pci-host/remote.c
index bfb25ef6af..be077d075e 100644
--- a/hw/pci-host/remote.c
+++ b/hw/pci-host/remote.c
@@ -28,7 +28,7 @@
 #include "hw/pci/pcie_host.h"
 #include "hw/qdev-properties.h"
 #include "hw/pci-host/remote.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 
 static const char *remote_pcihost_root_bus_path(PCIHostState *host_bridge,
                                                 PCIBus *rootbus)
diff --git a/hw/ppc/pnv_homer.c b/hw/ppc/pnv_homer.c
index 18a53a80c1..0521f9a428 100644
--- a/hw/ppc/pnv_homer.c
+++ b/hw/ppc/pnv_homer.c
@@ -20,7 +20,7 @@
 #include "qemu/log.h"
 #include "qapi/error.h"
 #include "exec/hwaddr.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "system/cpus.h"
 #include "hw/qdev-core.h"
 #include "hw/qdev-properties.h"
diff --git a/hw/ppc/sam460ex.c b/hw/ppc/sam460ex.c
index 7dc3b309c8..a070de23cf 100644
--- a/hw/ppc/sam460ex.c
+++ b/hw/ppc/sam460ex.c
@@ -24,7 +24,7 @@
 #include "exec/page-protection.h"
 #include "hw/loader.h"
 #include "elf.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "ppc440.h"
 #include "hw/pci-host/ppc4xx.h"
 #include "hw/block/flash.h"
diff --git a/hw/remote/iommu.c b/hw/remote/iommu.c
index 7c56aad0fc..ec845d1f58 100644
--- a/hw/remote/iommu.c
+++ b/hw/remote/iommu.c
@@ -13,7 +13,7 @@
 #include "hw/remote/iommu.h"
 #include "hw/pci/pci_bus.h"
 #include "hw/pci/pci.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "exec/address-spaces.h"
 #include "trace.h"
 
diff --git a/hw/remote/machine.c b/hw/remote/machine.c
index fdc6c441bb..d4616025e8 100644
--- a/hw/remote/machine.c
+++ b/hw/remote/machine.c
@@ -16,7 +16,7 @@
 #include "qemu/osdep.h"
 
 #include "hw/remote/machine.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "qapi/error.h"
 #include "hw/pci/pci_host.h"
 #include "hw/remote/iohub.h"
diff --git a/hw/remote/proxy-memory-listener.c b/hw/remote/proxy-memory-listener.c
index a926f61ebe..ce7f5b9bfb 100644
--- a/hw/remote/proxy-memory-listener.c
+++ b/hw/remote/proxy-memory-listener.c
@@ -10,7 +10,7 @@
 
 #include "qemu/int128.h"
 #include "qemu/range.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "exec/cpu-common.h"
 #include "exec/ram_addr.h"
 #include "qapi/error.h"
diff --git a/hw/remote/vfio-user-obj.c b/hw/remote/vfio-user-obj.c
index 6e51a92856..9bdd0a465b 100644
--- a/hw/remote/vfio-user-obj.c
+++ b/hw/remote/vfio-user-obj.c
@@ -57,7 +57,7 @@
 #include "hw/qdev-core.h"
 #include "hw/pci/pci.h"
 #include "qemu/timer.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "hw/pci/msi.h"
 #include "hw/pci/msix.h"
 #include "hw/remote/vfio-user-obj.h"
diff --git a/hw/s390x/s390-pci-inst.c b/hw/s390x/s390-pci-inst.c
index 8cdeb6cb7f..b4e003c19c 100644
--- a/hw/s390x/s390-pci-inst.c
+++ b/hw/s390x/s390-pci-inst.c
@@ -13,7 +13,7 @@
 
 #include "qemu/osdep.h"
 #include "exec/memop.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "qemu/error-report.h"
 #include "system/hw_accel.h"
 #include "hw/boards.h"
diff --git a/hw/timer/sh_timer.c b/hw/timer/sh_timer.c
index 7788939766..d4fa32c9d6 100644
--- a/hw/timer/sh_timer.c
+++ b/hw/timer/sh_timer.c
@@ -9,7 +9,7 @@
  */
 
 #include "qemu/osdep.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "qemu/log.h"
 #include "hw/irq.h"
 #include "hw/sh4/sh.h"
diff --git a/hw/tpm/tpm_ppi.h b/hw/tpm/tpm_ppi.h
index bf5d4a300f..88f316ee95 100644
--- a/hw/tpm/tpm_ppi.h
+++ b/hw/tpm/tpm_ppi.h
@@ -12,7 +12,7 @@
 #ifndef TPM_TPM_PPI_H
 #define TPM_TPM_PPI_H
 
-#include "exec/memory.h"
+#include "system/memory.h"
 
 typedef struct TPMPPI {
     MemoryRegion ram;
diff --git a/hw/usb/hcd-uhci.h b/hw/usb/hcd-uhci.h
index 6d26b94e92..d4664297cf 100644
--- a/hw/usb/hcd-uhci.h
+++ b/hw/usb/hcd-uhci.h
@@ -28,7 +28,7 @@
 #ifndef HW_USB_HCD_UHCI_H
 #define HW_USB_HCD_UHCI_H
 
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "qemu/timer.h"
 #include "hw/pci/pci_device.h"
 #include "hw/usb.h"
diff --git a/hw/vfio/common.c b/hw/vfio/common.c
index 1a0d9290f8..989c6ee83d 100644
--- a/hw/vfio/common.c
+++ b/hw/vfio/common.c
@@ -28,7 +28,7 @@
 #include "hw/vfio/vfio-common.h"
 #include "hw/vfio/pci.h"
 #include "exec/address-spaces.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "exec/ram_addr.h"
 #include "exec/target_page.h"
 #include "hw/hw.h"
diff --git a/hw/vfio/container.c b/hw/vfio/container.c
index 7c57bdd27b..1d1c5f9a77 100644
--- a/hw/vfio/container.c
+++ b/hw/vfio/container.c
@@ -24,7 +24,7 @@
 
 #include "hw/vfio/vfio-common.h"
 #include "exec/address-spaces.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "exec/ram_addr.h"
 #include "qemu/error-report.h"
 #include "qemu/range.h"
diff --git a/hw/vfio/pci.h b/hw/vfio/pci.h
index d94ecaba68..6c59300248 100644
--- a/hw/vfio/pci.h
+++ b/hw/vfio/pci.h
@@ -12,7 +12,7 @@
 #ifndef HW_VFIO_VFIO_PCI_H
 #define HW_VFIO_VFIO_PCI_H
 
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "hw/pci/pci_device.h"
 #include "hw/vfio/vfio-common.h"
 #include "qemu/event_notifier.h"
diff --git a/hw/vfio/platform.c b/hw/vfio/platform.c
index 67bc57409c..96c6bf5654 100644
--- a/hw/vfio/platform.c
+++ b/hw/vfio/platform.c
@@ -28,7 +28,7 @@
 #include "qemu/main-loop.h"
 #include "qemu/module.h"
 #include "qemu/range.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "exec/address-spaces.h"
 #include "qemu/queue.h"
 #include "hw/sysbus.h"
diff --git a/hw/virtio/vhost-iova-tree.h b/hw/virtio/vhost-iova-tree.h
index 0c4ba5abd5..08f63b61cd 100644
--- a/hw/virtio/vhost-iova-tree.h
+++ b/hw/virtio/vhost-iova-tree.h
@@ -11,7 +11,7 @@
 #define HW_VIRTIO_VHOST_IOVA_TREE_H
 
 #include "qemu/iova-tree.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 
 typedef struct VhostIOVATree VhostIOVATree;
 
diff --git a/hw/xtensa/sim.c b/hw/xtensa/sim.c
index 1cea29c66d..49d17e7bb2 100644
--- a/hw/xtensa/sim.c
+++ b/hw/xtensa/sim.c
@@ -32,7 +32,7 @@
 #include "hw/boards.h"
 #include "hw/loader.h"
 #include "elf.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "qemu/error-report.h"
 #include "xtensa_memory.h"
 #include "xtensa_sim.h"
diff --git a/hw/xtensa/virt.c b/hw/xtensa/virt.c
index b08404fc17..b10866ccd8 100644
--- a/hw/xtensa/virt.c
+++ b/hw/xtensa/virt.c
@@ -33,7 +33,7 @@
 #include "hw/pci-host/gpex.h"
 #include "net/net.h"
 #include "elf.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "qemu/error-report.h"
 #include "xtensa_memory.h"
 #include "xtensa_sim.h"
diff --git a/hw/xtensa/xtensa_memory.c b/hw/xtensa/xtensa_memory.c
index 2c1095f017..13a6077d86 100644
--- a/hw/xtensa/xtensa_memory.c
+++ b/hw/xtensa/xtensa_memory.c
@@ -27,7 +27,7 @@
 
 #include "qemu/osdep.h"
 #include "qapi/error.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "qemu/error-report.h"
 #include "xtensa_memory.h"
 
diff --git a/hw/xtensa/xtfpga.c b/hw/xtensa/xtfpga.c
index 3f3677f1c9..3bd0ef8268 100644
--- a/hw/xtensa/xtfpga.c
+++ b/hw/xtensa/xtfpga.c
@@ -34,7 +34,7 @@
 #include "hw/loader.h"
 #include "hw/qdev-properties.h"
 #include "elf.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "exec/tswap.h"
 #include "hw/char/serial-mm.h"
 #include "net/net.h"
diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
index 33b9dc81eb..4395fd08af 100644
--- a/include/exec/cpu-all.h
+++ b/include/exec/cpu-all.h
@@ -22,11 +22,14 @@
 #include "exec/page-protection.h"
 #include "exec/cpu-common.h"
 #include "exec/cpu-interrupt.h"
-#include "exec/memory.h"
 #include "exec/tswap.h"
 #include "hw/core/cpu.h"
 #include "exec/cpu-defs.h"
 #include "exec/target_page.h"
+#ifndef CONFIG_USER_ONLY
+#include "system/memory.h"
+#endif
+
 
 CPUArchState *cpu_copy(CPUArchState *env);
 
diff --git a/include/exec/ioport.h b/include/exec/ioport.h
index 4397f12f93..ecea3575bc 100644
--- a/include/exec/ioport.h
+++ b/include/exec/ioport.h
@@ -24,7 +24,7 @@
 #ifndef IOPORT_H
 #define IOPORT_H
 
-#include "exec/memory.h"
+#include "system/memory.h"
 
 #define MAX_IOPORTS     (64 * 1024)
 #define IOPORTS_MASK    (MAX_IOPORTS - 1)
diff --git a/include/exec/ram_addr.h b/include/exec/ram_addr.h
index 92e8708af7..8677761af5 100644
--- a/include/exec/ram_addr.h
+++ b/include/exec/ram_addr.h
@@ -26,7 +26,7 @@
 #include "exec/ramlist.h"
 #include "exec/ramblock.h"
 #include "exec/exec-all.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "exec/target_page.h"
 #include "qemu/rcu.h"
 
diff --git a/include/hw/acpi/acpi.h b/include/hw/acpi/acpi.h
index d1a4fa2af8..4b8ee094c4 100644
--- a/include/hw/acpi/acpi.h
+++ b/include/hw/acpi/acpi.h
@@ -21,7 +21,7 @@
  */
 
 #include "qemu/notify.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "hw/acpi/acpi_dev_interface.h"
 
 /*
diff --git a/include/hw/acpi/ich9_tco.h b/include/hw/acpi/ich9_tco.h
index 2562a7cf39..b3c3f69451 100644
--- a/include/hw/acpi/ich9_tco.h
+++ b/include/hw/acpi/ich9_tco.h
@@ -10,7 +10,7 @@
 #ifndef HW_ACPI_TCO_H
 #define HW_ACPI_TCO_H
 
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "migration/vmstate.h"
 
 /* As per ICH9 spec, the internal timer has an error of ~0.6s on every tick */
diff --git a/include/hw/arm/fsl-imx25.h b/include/hw/arm/fsl-imx25.h
index df2f83980f..b68d4334a0 100644
--- a/include/hw/arm/fsl-imx25.h
+++ b/include/hw/arm/fsl-imx25.h
@@ -29,7 +29,7 @@
 #include "hw/sd/sdhci.h"
 #include "hw/usb/chipidea.h"
 #include "hw/watchdog/wdt_imx2.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "target/arm/cpu.h"
 #include "qom/object.h"
 
diff --git a/include/hw/arm/fsl-imx31.h b/include/hw/arm/fsl-imx31.h
index 40c593a5cf..41232a2237 100644
--- a/include/hw/arm/fsl-imx31.h
+++ b/include/hw/arm/fsl-imx31.h
@@ -25,7 +25,7 @@
 #include "hw/i2c/imx_i2c.h"
 #include "hw/gpio/imx_gpio.h"
 #include "hw/watchdog/wdt_imx2.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "target/arm/cpu.h"
 #include "qom/object.h"
 
diff --git a/include/hw/arm/fsl-imx6.h b/include/hw/arm/fsl-imx6.h
index 9da32fc189..124bbd478f 100644
--- a/include/hw/arm/fsl-imx6.h
+++ b/include/hw/arm/fsl-imx6.h
@@ -34,7 +34,7 @@
 #include "hw/usb/imx-usb-phy.h"
 #include "hw/pci-host/designware.h"
 #include "hw/or-irq.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "cpu.h"
 #include "qom/object.h"
 
diff --git a/include/hw/arm/fsl-imx6ul.h b/include/hw/arm/fsl-imx6ul.h
index 8277b0e8b2..4e3209b25b 100644
--- a/include/hw/arm/fsl-imx6ul.h
+++ b/include/hw/arm/fsl-imx6ul.h
@@ -33,7 +33,7 @@
 #include "hw/net/imx_fec.h"
 #include "hw/usb/chipidea.h"
 #include "hw/usb/imx-usb-phy.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "cpu.h"
 #include "qom/object.h"
 #include "qemu/units.h"
diff --git a/include/hw/arm/omap.h b/include/hw/arm/omap.h
index 7cb87ea89c..6185507373 100644
--- a/include/hw/arm/omap.h
+++ b/include/hw/arm/omap.h
@@ -20,7 +20,7 @@
 #ifndef HW_ARM_OMAP_H
 #define HW_ARM_OMAP_H
 
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "target/arm/cpu-qom.h"
 #include "qemu/log.h"
 #include "qom/object.h"
diff --git a/include/hw/arm/stm32l4x5_soc.h b/include/hw/arm/stm32l4x5_soc.h
index c243fb0e7f..c2fae6e23f 100644
--- a/include/hw/arm/stm32l4x5_soc.h
+++ b/include/hw/arm/stm32l4x5_soc.h
@@ -24,7 +24,7 @@
 #ifndef HW_ARM_STM32L4x5_SOC_H
 #define HW_ARM_STM32L4x5_SOC_H
 
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "hw/arm/armv7m.h"
 #include "hw/or-irq.h"
 #include "hw/misc/stm32l4x5_syscfg.h"
diff --git a/include/hw/boards.h b/include/hw/boards.h
index bfe8643a27..8556e01e21 100644
--- a/include/hw/boards.h
+++ b/include/hw/boards.h
@@ -3,7 +3,7 @@
 #ifndef HW_BOARDS_H
 #define HW_BOARDS_H
 
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "system/hostmem.h"
 #include "system/blockdev.h"
 #include "qapi/qapi-types-machine.h"
diff --git a/include/hw/char/parallel.h b/include/hw/char/parallel.h
index cfb97cc7cc..7b04478226 100644
--- a/include/hw/char/parallel.h
+++ b/include/hw/char/parallel.h
@@ -1,7 +1,7 @@
 #ifndef HW_PARALLEL_H
 #define HW_PARALLEL_H
 
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "hw/isa/isa.h"
 #include "hw/irq.h"
 #include "chardev/char-fe.h"
diff --git a/include/hw/char/riscv_htif.h b/include/hw/char/riscv_htif.h
index df493fdf6b..ee0ca29902 100644
--- a/include/hw/char/riscv_htif.h
+++ b/include/hw/char/riscv_htif.h
@@ -22,7 +22,7 @@
 
 #include "chardev/char.h"
 #include "chardev/char-fe.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 
 #define TYPE_HTIF_UART "riscv.htif.uart"
 
diff --git a/include/hw/char/serial-mm.h b/include/hw/char/serial-mm.h
index 62a8489d69..77abd098e0 100644
--- a/include/hw/char/serial-mm.h
+++ b/include/hw/char/serial-mm.h
@@ -27,7 +27,7 @@
 #define HW_SERIAL_MM_H
 
 #include "hw/char/serial.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "chardev/char.h"
 #include "hw/sysbus.h"
 #include "qom/object.h"
diff --git a/include/hw/char/serial.h b/include/hw/char/serial.h
index 942b372df6..4bf90a46f3 100644
--- a/include/hw/char/serial.h
+++ b/include/hw/char/serial.h
@@ -27,7 +27,7 @@
 #define HW_SERIAL_H
 
 #include "chardev/char-fe.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "qemu/fifo8.h"
 #include "qom/object.h"
 
diff --git a/include/hw/display/macfb.h b/include/hw/display/macfb.h
index 27cebefc9e..0fae1f33a6 100644
--- a/include/hw/display/macfb.h
+++ b/include/hw/display/macfb.h
@@ -13,7 +13,7 @@
 #ifndef MACFB_H
 #define MACFB_H
 
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "hw/irq.h"
 #include "hw/nubus/nubus.h"
 #include "hw/sysbus.h"
diff --git a/include/hw/fsi/aspeed_apb2opb.h b/include/hw/fsi/aspeed_apb2opb.h
index f6a2387abf..878619eafa 100644
--- a/include/hw/fsi/aspeed_apb2opb.h
+++ b/include/hw/fsi/aspeed_apb2opb.h
@@ -8,7 +8,7 @@
 #ifndef FSI_ASPEED_APB2OPB_H
 #define FSI_ASPEED_APB2OPB_H
 
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "hw/fsi/fsi-master.h"
 #include "hw/sysbus.h"
 
diff --git a/include/hw/fsi/cfam.h b/include/hw/fsi/cfam.h
index 7abc3b287b..cceb4bd6f1 100644
--- a/include/hw/fsi/cfam.h
+++ b/include/hw/fsi/cfam.h
@@ -7,7 +7,7 @@
 #ifndef FSI_CFAM_H
 #define FSI_CFAM_H
 
-#include "exec/memory.h"
+#include "system/memory.h"
 
 #include "hw/fsi/fsi.h"
 #include "hw/fsi/lbus.h"
diff --git a/include/hw/fsi/fsi-master.h b/include/hw/fsi/fsi-master.h
index 68e5f56db2..b634ecd393 100644
--- a/include/hw/fsi/fsi-master.h
+++ b/include/hw/fsi/fsi-master.h
@@ -7,7 +7,7 @@
 #ifndef FSI_FSI_MASTER_H
 #define FSI_FSI_MASTER_H
 
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "hw/qdev-core.h"
 #include "hw/fsi/fsi.h"
 #include "hw/fsi/cfam.h"
diff --git a/include/hw/fsi/fsi.h b/include/hw/fsi/fsi.h
index e00f6ef078..f34765ed80 100644
--- a/include/hw/fsi/fsi.h
+++ b/include/hw/fsi/fsi.h
@@ -7,7 +7,7 @@
 #ifndef FSI_FSI_H
 #define FSI_FSI_H
 
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "hw/qdev-core.h"
 #include "hw/fsi/lbus.h"
 #include "qemu/bitops.h"
diff --git a/include/hw/fsi/lbus.h b/include/hw/fsi/lbus.h
index 558268c013..12519073cd 100644
--- a/include/hw/fsi/lbus.h
+++ b/include/hw/fsi/lbus.h
@@ -9,7 +9,7 @@
 
 #include "hw/qdev-core.h"
 #include "qemu/units.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 
 #define TYPE_FSI_LBUS_DEVICE "fsi.lbus.device"
 OBJECT_DECLARE_SIMPLE_TYPE(FSILBusDevice, FSI_LBUS_DEVICE)
diff --git a/include/hw/gpio/npcm7xx_gpio.h b/include/hw/gpio/npcm7xx_gpio.h
index b1d771bd77..7c0bf61a96 100644
--- a/include/hw/gpio/npcm7xx_gpio.h
+++ b/include/hw/gpio/npcm7xx_gpio.h
@@ -15,7 +15,7 @@
 #ifndef NPCM7XX_GPIO_H
 #define NPCM7XX_GPIO_H
 
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "hw/sysbus.h"
 
 /* Number of pins managed by each controller. */
diff --git a/include/hw/i2c/npcm7xx_smbus.h b/include/hw/i2c/npcm7xx_smbus.h
index dc45963c0e..9c544c561b 100644
--- a/include/hw/i2c/npcm7xx_smbus.h
+++ b/include/hw/i2c/npcm7xx_smbus.h
@@ -16,7 +16,7 @@
 #ifndef NPCM7XX_SMBUS_H
 #define NPCM7XX_SMBUS_H
 
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "hw/i2c/i2c.h"
 #include "hw/irq.h"
 #include "hw/sysbus.h"
diff --git a/include/hw/i2c/pm_smbus.h b/include/hw/i2c/pm_smbus.h
index 0d74207efb..dafe0df4f6 100644
--- a/include/hw/i2c/pm_smbus.h
+++ b/include/hw/i2c/pm_smbus.h
@@ -1,7 +1,7 @@
 #ifndef PM_SMBUS_H
 #define PM_SMBUS_H
 
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "hw/i2c/smbus_master.h"
 
 #define PM_SMBUS_MAX_MSG_SIZE 32
diff --git a/include/hw/i386/apic_internal.h b/include/hw/i386/apic_internal.h
index d6e85833da..429278da61 100644
--- a/include/hw/i386/apic_internal.h
+++ b/include/hw/i386/apic_internal.h
@@ -22,7 +22,7 @@
 #define QEMU_APIC_INTERNAL_H
 
 #include "cpu.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "qemu/timer.h"
 #include "target/i386/cpu-qom.h"
 #include "qom/object.h"
diff --git a/include/hw/i386/x86.h b/include/hw/i386/x86.h
index d43cb3908e..258b1343a1 100644
--- a/include/hw/i386/x86.h
+++ b/include/hw/i386/x86.h
@@ -18,7 +18,7 @@
 #define HW_I386_X86_H
 
 #include "exec/hwaddr.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 
 #include "hw/boards.h"
 #include "hw/i386/topology.h"
diff --git a/include/hw/ide/ahci.h b/include/hw/ide/ahci.h
index ac0292c634..cd07b87811 100644
--- a/include/hw/ide/ahci.h
+++ b/include/hw/ide/ahci.h
@@ -24,7 +24,7 @@
 #ifndef HW_IDE_AHCI_H
 #define HW_IDE_AHCI_H
 
-#include "exec/memory.h"
+#include "system/memory.h"
 
 typedef struct AHCIDevice AHCIDevice;
 
diff --git a/include/hw/ipmi/ipmi.h b/include/hw/ipmi/ipmi.h
index 802a2febb0..cd581aa134 100644
--- a/include/hw/ipmi/ipmi.h
+++ b/include/hw/ipmi/ipmi.h
@@ -25,7 +25,7 @@
 #ifndef HW_IPMI_H
 #define HW_IPMI_H
 
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "hw/qdev-core.h"
 #include "qom/object.h"
 
diff --git a/include/hw/isa/apm.h b/include/hw/isa/apm.h
index b6e070c00e..0834539045 100644
--- a/include/hw/isa/apm.h
+++ b/include/hw/isa/apm.h
@@ -1,7 +1,7 @@
 #ifndef APM_H
 #define APM_H
 
-#include "exec/memory.h"
+#include "system/memory.h"
 
 #define APM_CNT_IOPORT  0xb2
 #define ACPI_PORT_SMI_CMD APM_CNT_IOPORT
diff --git a/include/hw/isa/isa.h b/include/hw/isa/isa.h
index 40d6224a4e..1d852011b3 100644
--- a/include/hw/isa/isa.h
+++ b/include/hw/isa/isa.h
@@ -3,7 +3,7 @@
 
 /* ISA bus */
 
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "exec/ioport.h"
 #include "hw/qdev-core.h"
 #include "qom/object.h"
diff --git a/include/hw/m68k/q800.h b/include/hw/m68k/q800.h
index 34365c9860..9caaed9692 100644
--- a/include/hw/m68k/q800.h
+++ b/include/hw/m68k/q800.h
@@ -26,7 +26,7 @@
 #include "hw/boards.h"
 #include "qom/object.h"
 #include "target/m68k/cpu-qom.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "hw/m68k/q800-glue.h"
 #include "hw/misc/mac_via.h"
 #include "hw/net/dp8393x.h"
diff --git a/include/hw/mem/npcm7xx_mc.h b/include/hw/mem/npcm7xx_mc.h
index 7ed38be243..568cc35fdd 100644
--- a/include/hw/mem/npcm7xx_mc.h
+++ b/include/hw/mem/npcm7xx_mc.h
@@ -16,7 +16,7 @@
 #ifndef NPCM7XX_MC_H
 #define NPCM7XX_MC_H
 
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "hw/sysbus.h"
 
 /**
diff --git a/include/hw/mem/pc-dimm.h b/include/hw/mem/pc-dimm.h
index fe0f3ea963..e0dbdd43dc 100644
--- a/include/hw/mem/pc-dimm.h
+++ b/include/hw/mem/pc-dimm.h
@@ -16,7 +16,7 @@
 #ifndef QEMU_PC_DIMM_H
 #define QEMU_PC_DIMM_H
 
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "hw/qdev-core.h"
 #include "qom/object.h"
 
diff --git a/include/hw/mips/mips.h b/include/hw/mips/mips.h
index 101799f7d3..1f3672ba5f 100644
--- a/include/hw/mips/mips.h
+++ b/include/hw/mips/mips.h
@@ -7,7 +7,7 @@
 /* Kernels can be configured with 64KB pages */
 #define INITRD_PAGE_SIZE (64 * KiB)
 
-#include "exec/memory.h"
+#include "system/memory.h"
 
 /* bonito.c */
 PCIBus *bonito_init(qemu_irq *pic);
diff --git a/include/hw/misc/auxbus.h b/include/hw/misc/auxbus.h
index 03cacdee42..ccd18ce209 100644
--- a/include/hw/misc/auxbus.h
+++ b/include/hw/misc/auxbus.h
@@ -25,7 +25,7 @@
 #ifndef HW_MISC_AUXBUS_H
 #define HW_MISC_AUXBUS_H
 
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "hw/qdev-core.h"
 #include "qom/object.h"
 
diff --git a/include/hw/misc/ivshmem-flat.h b/include/hw/misc/ivshmem-flat.h
index 0c2b015781..09bc3abcad 100644
--- a/include/hw/misc/ivshmem-flat.h
+++ b/include/hw/misc/ivshmem-flat.h
@@ -14,7 +14,7 @@
 #include "qemu/queue.h"
 #include "qemu/event_notifier.h"
 #include "chardev/char-fe.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "qom/object.h"
 #include "hw/sysbus.h"
 
diff --git a/include/hw/misc/mac_via.h b/include/hw/misc/mac_via.h
index 63cdcf7c69..6a15228150 100644
--- a/include/hw/misc/mac_via.h
+++ b/include/hw/misc/mac_via.h
@@ -9,7 +9,7 @@
 #ifndef HW_MISC_MAC_VIA_H
 #define HW_MISC_MAC_VIA_H
 
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "hw/sysbus.h"
 #include "hw/misc/mos6522.h"
 #include "hw/input/adb.h"
diff --git a/include/hw/misc/npcm7xx_mft.h b/include/hw/misc/npcm7xx_mft.h
index d6384382ce..e4b997a6ad 100644
--- a/include/hw/misc/npcm7xx_mft.h
+++ b/include/hw/misc/npcm7xx_mft.h
@@ -16,7 +16,7 @@
 #ifndef NPCM7XX_MFT_H
 #define NPCM7XX_MFT_H
 
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "hw/clock.h"
 #include "hw/irq.h"
 #include "hw/sysbus.h"
diff --git a/include/hw/misc/npcm_clk.h b/include/hw/misc/npcm_clk.h
index 8fa1e14bdd..52e972f460 100644
--- a/include/hw/misc/npcm_clk.h
+++ b/include/hw/misc/npcm_clk.h
@@ -16,7 +16,7 @@
 #ifndef NPCM_CLK_H
 #define NPCM_CLK_H
 
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "hw/clock.h"
 #include "hw/sysbus.h"
 
diff --git a/include/hw/misc/npcm_gcr.h b/include/hw/misc/npcm_gcr.h
index d81bb9afb2..702e7fddb1 100644
--- a/include/hw/misc/npcm_gcr.h
+++ b/include/hw/misc/npcm_gcr.h
@@ -16,7 +16,7 @@
 #ifndef NPCM_GCR_H
 #define NPCM_GCR_H
 
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "hw/sysbus.h"
 #include "qom/object.h"
 
diff --git a/include/hw/misc/pvpanic.h b/include/hw/misc/pvpanic.h
index 049a94c112..5098693437 100644
--- a/include/hw/misc/pvpanic.h
+++ b/include/hw/misc/pvpanic.h
@@ -15,7 +15,7 @@
 #ifndef HW_MISC_PVPANIC_H
 #define HW_MISC_PVPANIC_H
 
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "qom/object.h"
 
 #include "standard-headers/misc/pvpanic.h"
diff --git a/include/hw/net/dp8393x.h b/include/hw/net/dp8393x.h
index 4a3f7478be..24273dc1f4 100644
--- a/include/hw/net/dp8393x.h
+++ b/include/hw/net/dp8393x.h
@@ -22,7 +22,7 @@
 
 #include "hw/sysbus.h"
 #include "net/net.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 
 #define SONIC_REG_COUNT  0x40
 
diff --git a/include/hw/net/msf2-emac.h b/include/hw/net/msf2-emac.h
index 846ba6e6dc..b5d9127e46 100644
--- a/include/hw/net/msf2-emac.h
+++ b/include/hw/net/msf2-emac.h
@@ -23,7 +23,7 @@
  */
 
 #include "hw/sysbus.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "net/net.h"
 #include "net/eth.h"
 #include "qom/object.h"
diff --git a/include/hw/nvram/mac_nvram.h b/include/hw/nvram/mac_nvram.h
index 0c4dfaeff6..e9d8398f84 100644
--- a/include/hw/nvram/mac_nvram.h
+++ b/include/hw/nvram/mac_nvram.h
@@ -26,7 +26,7 @@
 #ifndef MAC_NVRAM_H
 #define MAC_NVRAM_H
 
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "hw/sysbus.h"
 
 #define MACIO_NVRAM_SIZE 0x2000
diff --git a/include/hw/nvram/npcm7xx_otp.h b/include/hw/nvram/npcm7xx_otp.h
index ea4b5d0731..77b05f8b82 100644
--- a/include/hw/nvram/npcm7xx_otp.h
+++ b/include/hw/nvram/npcm7xx_otp.h
@@ -16,7 +16,7 @@
 #ifndef NPCM7XX_OTP_H
 #define NPCM7XX_OTP_H
 
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "hw/sysbus.h"
 
 /* Each OTP module holds 8192 bits of one-time programmable storage */
diff --git a/include/hw/pci-host/fsl_imx8m_phy.h b/include/hw/pci-host/fsl_imx8m_phy.h
index 4f4875b37d..5f1b212fd9 100644
--- a/include/hw/pci-host/fsl_imx8m_phy.h
+++ b/include/hw/pci-host/fsl_imx8m_phy.h
@@ -11,7 +11,7 @@
 
 #include "hw/sysbus.h"
 #include "qom/object.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 
 #define TYPE_FSL_IMX8M_PCIE_PHY "fsl-imx8m-pcie-phy"
 OBJECT_DECLARE_SIMPLE_TYPE(FslImx8mPciePhyState, FSL_IMX8M_PCIE_PHY)
diff --git a/include/hw/pci-host/pam.h b/include/hw/pci-host/pam.h
index 005916f826..44f3908160 100644
--- a/include/hw/pci-host/pam.h
+++ b/include/hw/pci-host/pam.h
@@ -50,7 +50,7 @@
  * 0xf0000 - 0xfffff System BIOS Area Memory Segments
  */
 
-#include "exec/memory.h"
+#include "system/memory.h"
 
 #define SMRAM_C_BASE    0xa0000
 #define SMRAM_C_END     0xc0000
diff --git a/include/hw/pci-host/remote.h b/include/hw/pci-host/remote.h
index 690a01f0fe..5264c35936 100644
--- a/include/hw/pci-host/remote.h
+++ b/include/hw/pci-host/remote.h
@@ -11,7 +11,7 @@
 #ifndef PCI_HOST_REMOTE_H
 #define PCI_HOST_REMOTE_H
 
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "hw/pci/pcie_host.h"
 
 #define TYPE_REMOTE_PCIHOST "remote-pcihost"
diff --git a/include/hw/pci/pci.h b/include/hw/pci/pci.h
index 822fbacdf0..c2fe6caa2c 100644
--- a/include/hw/pci/pci.h
+++ b/include/hw/pci/pci.h
@@ -1,7 +1,7 @@
 #ifndef QEMU_PCI_H
 #define QEMU_PCI_H
 
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "system/dma.h"
 #include "system/host_iommu_device.h"
 
diff --git a/include/hw/pci/pcie_host.h b/include/hw/pci/pcie_host.h
index 82d92177da..f09de76bfe 100644
--- a/include/hw/pci/pcie_host.h
+++ b/include/hw/pci/pcie_host.h
@@ -22,7 +22,7 @@
 #define PCIE_HOST_H
 
 #include "hw/pci/pci_host.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "qom/object.h"
 
 #define TYPE_PCIE_HOST_BRIDGE "pcie-host-bridge"
diff --git a/include/hw/pci/shpc.h b/include/hw/pci/shpc.h
index a0789df153..ad1089567a 100644
--- a/include/hw/pci/shpc.h
+++ b/include/hw/pci/shpc.h
@@ -1,7 +1,7 @@
 #ifndef SHPC_H
 #define SHPC_H
 
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "hw/hotplug.h"
 #include "hw/pci/pci_device.h"
 #include "migration/vmstate.h"
diff --git a/include/hw/ppc/mac_dbdma.h b/include/hw/ppc/mac_dbdma.h
index 672c2be471..896ee4a2b1 100644
--- a/include/hw/ppc/mac_dbdma.h
+++ b/include/hw/ppc/mac_dbdma.h
@@ -23,7 +23,7 @@
 #ifndef HW_MAC_DBDMA_H
 #define HW_MAC_DBDMA_H
 
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "qemu/iov.h"
 #include "system/dma.h"
 #include "hw/sysbus.h"
diff --git a/include/hw/ppc/pnv_lpc.h b/include/hw/ppc/pnv_lpc.h
index 174add4c53..266d56214f 100644
--- a/include/hw/ppc/pnv_lpc.h
+++ b/include/hw/ppc/pnv_lpc.h
@@ -20,7 +20,7 @@
 #ifndef PPC_PNV_LPC_H
 #define PPC_PNV_LPC_H
 
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "hw/ppc/pnv.h"
 #include "hw/qdev-core.h"
 #include "hw/isa/isa.h" /* For ISA_NUM_IRQS */
diff --git a/include/hw/ppc/pnv_occ.h b/include/hw/ppc/pnv_occ.h
index 3ec42de0ff..013ea2e53e 100644
--- a/include/hw/ppc/pnv_occ.h
+++ b/include/hw/ppc/pnv_occ.h
@@ -20,7 +20,7 @@
 #ifndef PPC_PNV_OCC_H
 #define PPC_PNV_OCC_H
 
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "hw/qdev-core.h"
 
 #define TYPE_PNV_OCC "pnv-occ"
diff --git a/include/hw/ppc/pnv_sbe.h b/include/hw/ppc/pnv_sbe.h
index b6b378ad14..48a8b86a80 100644
--- a/include/hw/ppc/pnv_sbe.h
+++ b/include/hw/ppc/pnv_sbe.h
@@ -20,7 +20,7 @@
 #ifndef PPC_PNV_SBE_H
 #define PPC_PNV_SBE_H
 
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "hw/qdev-core.h"
 
 #define TYPE_PNV_SBE "pnv-sbe"
diff --git a/include/hw/ppc/pnv_xscom.h b/include/hw/ppc/pnv_xscom.h
index a927aea1c0..b14549db70 100644
--- a/include/hw/ppc/pnv_xscom.h
+++ b/include/hw/ppc/pnv_xscom.h
@@ -20,7 +20,7 @@
 #ifndef PPC_PNV_XSCOM_H
 #define PPC_PNV_XSCOM_H
 
-#include "exec/memory.h"
+#include "system/memory.h"
 
 typedef struct PnvXScomInterface PnvXScomInterface;
 typedef struct PnvChip PnvChip;
diff --git a/include/hw/ppc/ppc4xx.h b/include/hw/ppc/ppc4xx.h
index 1bd9b8821b..2e94b00673 100644
--- a/include/hw/ppc/ppc4xx.h
+++ b/include/hw/ppc/ppc4xx.h
@@ -26,7 +26,7 @@
 #define PPC4XX_H
 
 #include "hw/ppc/ppc.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "hw/sysbus.h"
 
 /*
diff --git a/include/hw/ppc/vof.h b/include/hw/ppc/vof.h
index d3f293da8b..2918aaab12 100644
--- a/include/hw/ppc/vof.h
+++ b/include/hw/ppc/vof.h
@@ -8,7 +8,7 @@
 
 #include "qom/object.h"
 #include "exec/address-spaces.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "exec/cpu-defs.h"
 
 typedef struct Vof {
diff --git a/include/hw/ppc/xics.h b/include/hw/ppc/xics.h
index e94d53405f..097fcdf00f 100644
--- a/include/hw/ppc/xics.h
+++ b/include/hw/ppc/xics.h
@@ -28,7 +28,7 @@
 #ifndef XICS_H
 #define XICS_H
 
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "hw/qdev-core.h"
 #include "qom/object.h"
 
diff --git a/include/hw/register.h b/include/hw/register.h
index 6a076cfcdf..a913c52aee 100644
--- a/include/hw/register.h
+++ b/include/hw/register.h
@@ -12,7 +12,7 @@
 #define REGISTER_H
 
 #include "hw/qdev-core.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "hw/registerfields.h"
 #include "qom/object.h"
 
diff --git a/include/hw/remote/proxy-memory-listener.h b/include/hw/remote/proxy-memory-listener.h
index c4f3efb928..ec516d8267 100644
--- a/include/hw/remote/proxy-memory-listener.h
+++ b/include/hw/remote/proxy-memory-listener.h
@@ -9,7 +9,7 @@
 #ifndef PROXY_MEMORY_LISTENER_H
 #define PROXY_MEMORY_LISTENER_H
 
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "io/channel.h"
 
 typedef struct ProxyMemoryListener {
diff --git a/include/hw/sh4/sh_intc.h b/include/hw/sh4/sh_intc.h
index f62d5c5e13..94f183121e 100644
--- a/include/hw/sh4/sh_intc.h
+++ b/include/hw/sh4/sh_intc.h
@@ -1,7 +1,7 @@
 #ifndef SH_INTC_H
 #define SH_INTC_H
 
-#include "exec/memory.h"
+#include "system/memory.h"
 
 typedef unsigned char intc_enum;
 
diff --git a/include/hw/southbridge/ich9.h b/include/hw/southbridge/ich9.h
index 6c60017024..1e231e89c9 100644
--- a/include/hw/southbridge/ich9.h
+++ b/include/hw/southbridge/ich9.h
@@ -7,7 +7,7 @@
 #include "hw/pci/pci.h"
 #include "hw/pci/pci_device.h"
 #include "hw/rtc/mc146818rtc.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "qemu/notify.h"
 #include "qom/object.h"
 
diff --git a/include/hw/sysbus.h b/include/hw/sysbus.h
index 81bbda10d3..7dc88aaa27 100644
--- a/include/hw/sysbus.h
+++ b/include/hw/sysbus.h
@@ -4,7 +4,7 @@
 /* Devices attached directly to the main system bus.  */
 
 #include "hw/qdev-core.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "qom/object.h"
 
 #define QDEV_MAX_MMIO 32
diff --git a/include/hw/timer/npcm7xx_timer.h b/include/hw/timer/npcm7xx_timer.h
index d45c051b56..e287375dce 100644
--- a/include/hw/timer/npcm7xx_timer.h
+++ b/include/hw/timer/npcm7xx_timer.h
@@ -16,7 +16,7 @@
 #ifndef NPCM7XX_TIMER_H
 #define NPCM7XX_TIMER_H
 
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "hw/sysbus.h"
 #include "qemu/timer.h"
 
diff --git a/include/hw/tricore/tricore.h b/include/hw/tricore/tricore.h
index c19ed3f013..4ffc0fe1d6 100644
--- a/include/hw/tricore/tricore.h
+++ b/include/hw/tricore/tricore.h
@@ -1,7 +1,7 @@
 #ifndef HW_TRICORE_H
 #define HW_TRICORE_H
 
-#include "exec/memory.h"
+#include "system/memory.h"
 
 struct tricore_boot_info {
     uint64_t ram_size;
diff --git a/include/hw/usb.h b/include/hw/usb.h
index e410693d0c..26a9f3ecde 100644
--- a/include/hw/usb.h
+++ b/include/hw/usb.h
@@ -25,7 +25,7 @@
  * THE SOFTWARE.
  */
 
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "hw/qdev-core.h"
 #include "qemu/iov.h"
 #include "qemu/queue.h"
diff --git a/include/hw/vfio/vfio-common.h b/include/hw/vfio/vfio-common.h
index 04b123a6c9..f5b3f45a43 100644
--- a/include/hw/vfio/vfio-common.h
+++ b/include/hw/vfio/vfio-common.h
@@ -21,7 +21,7 @@
 #ifndef HW_VFIO_VFIO_COMMON_H
 #define HW_VFIO_VFIO_COMMON_H
 
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "qemu/queue.h"
 #include "qemu/notify.h"
 #include "ui/console.h"
diff --git a/include/hw/vfio/vfio-container-base.h b/include/hw/vfio/vfio-container-base.h
index 4cff9943ab..6aca02fb3d 100644
--- a/include/hw/vfio/vfio-container-base.h
+++ b/include/hw/vfio/vfio-container-base.h
@@ -13,7 +13,7 @@
 #ifndef HW_VFIO_VFIO_CONTAINER_BASE_H
 #define HW_VFIO_VFIO_CONTAINER_BASE_H
 
-#include "exec/memory.h"
+#include "system/memory.h"
 
 typedef struct VFIODevice VFIODevice;
 typedef struct VFIOIOMMUClass VFIOIOMMUClass;
diff --git a/include/hw/virtio/vhost-backend.h b/include/hw/virtio/vhost-backend.h
index 70c2e8ffee..d6df209a2f 100644
--- a/include/hw/virtio/vhost-backend.h
+++ b/include/hw/virtio/vhost-backend.h
@@ -11,7 +11,7 @@
 #ifndef VHOST_BACKEND_H
 #define VHOST_BACKEND_H
 
-#include "exec/memory.h"
+#include "system/memory.h"
 
 typedef enum VhostBackendType {
     VHOST_BACKEND_TYPE_NONE = 0,
diff --git a/include/hw/virtio/vhost.h b/include/hw/virtio/vhost.h
index a9469d50bc..bb4b58e115 100644
--- a/include/hw/virtio/vhost.h
+++ b/include/hw/virtio/vhost.h
@@ -3,7 +3,7 @@
 
 #include "hw/virtio/vhost-backend.h"
 #include "hw/virtio/virtio.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 
 #define VHOST_F_DEVICE_IOTLB 63
 #define VHOST_USER_F_PROTOCOL_FEATURES 30
diff --git a/include/hw/virtio/virtio.h b/include/hw/virtio/virtio.h
index 6386910280..7e0c471ea4 100644
--- a/include/hw/virtio/virtio.h
+++ b/include/hw/virtio/virtio.h
@@ -14,7 +14,7 @@
 #ifndef QEMU_VIRTIO_H
 #define QEMU_VIRTIO_H
 
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "hw/qdev-core.h"
 #include "net/net.h"
 #include "migration/vmstate.h"
diff --git a/include/hw/xen/xen-pvh-common.h b/include/hw/xen/xen-pvh-common.h
index 17c5a58a5a..5db83d88ec 100644
--- a/include/hw/xen/xen-pvh-common.h
+++ b/include/hw/xen/xen-pvh-common.h
@@ -9,7 +9,7 @@
 #ifndef XEN_PVH_COMMON_H__
 #define XEN_PVH_COMMON_H__
 
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "qom/object.h"
 #include "hw/boards.h"
 #include "hw/pci-host/gpex.h"
diff --git a/include/hw/xtensa/mx_pic.h b/include/hw/xtensa/mx_pic.h
index 500424c8d3..cd316d86eb 100644
--- a/include/hw/xtensa/mx_pic.h
+++ b/include/hw/xtensa/mx_pic.h
@@ -28,7 +28,7 @@
 #ifndef XTENSA_MX_PIC_H
 #define XTENSA_MX_PIC_H
 
-#include "exec/memory.h"
+#include "system/memory.h"
 
 struct XtensaMxPic;
 typedef struct XtensaMxPic XtensaMxPic;
diff --git a/include/qemu/iova-tree.h b/include/qemu/iova-tree.h
index 16d354a814..14e82a22d5 100644
--- a/include/qemu/iova-tree.h
+++ b/include/qemu/iova-tree.h
@@ -23,7 +23,7 @@
  * for the thread safety issue.
  */
 
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "exec/hwaddr.h"
 
 #define  IOVA_OK           (0)
diff --git a/include/qemu/reserved-region.h b/include/qemu/reserved-region.h
index 8e6f0a97e2..9026cf08fd 100644
--- a/include/qemu/reserved-region.h
+++ b/include/qemu/reserved-region.h
@@ -20,7 +20,7 @@
 #ifndef QEMU_RESERVED_REGION_H
 #define QEMU_RESERVED_REGION_H
 
-#include "exec/memory.h"
+#include "system/memory.h"
 
 /*
  * Insert a new region into a sorted list of reserved regions. In case
diff --git a/include/system/dma.h b/include/system/dma.h
index e142f7efa6..aaa03b9711 100644
--- a/include/system/dma.h
+++ b/include/system/dma.h
@@ -10,7 +10,7 @@
 #ifndef DMA_H
 #define DMA_H
 
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "exec/address-spaces.h"
 #include "block/block.h"
 #include "block/accounting.h"
diff --git a/include/system/hostmem.h b/include/system/hostmem.h
index 62642e602c..88fa791ac7 100644
--- a/include/system/hostmem.h
+++ b/include/system/hostmem.h
@@ -16,7 +16,7 @@
 #include "system/numa.h"
 #include "qapi/qapi-types-machine.h"
 #include "qom/object.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "qemu/bitmap.h"
 #include "qemu/thread-context.h"
 
diff --git a/include/system/kvm_int.h b/include/system/kvm_int.h
index 4de6106869..756a3c0a25 100644
--- a/include/system/kvm_int.h
+++ b/include/system/kvm_int.h
@@ -9,7 +9,7 @@
 #ifndef QEMU_KVM_INT_H
 #define QEMU_KVM_INT_H
 
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "qapi/qapi-types-common.h"
 #include "qemu/accel.h"
 #include "qemu/queue.h"
diff --git a/include/exec/memory.h b/include/system/memory.h
similarity index 99%
rename from include/exec/memory.h
rename to include/system/memory.h
index 2f84a7cfed..fbbf4cf911 100644
--- a/include/exec/memory.h
+++ b/include/system/memory.h
@@ -11,10 +11,8 @@
  *
  */
 
-#ifndef MEMORY_H
-#define MEMORY_H
-
-#ifndef CONFIG_USER_ONLY
+#ifndef SYSTEM_MEMORY_H
+#define SYSTEM_MEMORY_H
 
 #include "exec/cpu-common.h"
 #include "exec/hwaddr.h"
@@ -3197,5 +3195,3 @@ void ram_block_add_cpr_blocker(RAMBlock *rb, Error **errp);
 void ram_block_del_cpr_blocker(RAMBlock *rb);
 
 #endif
-
-#endif
diff --git a/include/system/vhost-user-backend.h b/include/system/vhost-user-backend.h
index 327b0b84f1..5ed953cd53 100644
--- a/include/system/vhost-user-backend.h
+++ b/include/system/vhost-user-backend.h
@@ -13,7 +13,7 @@
 #define QEMU_VHOST_USER_BACKEND_H
 
 #include "qom/object.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "qemu/option.h"
 #include "qemu/bitmap.h"
 #include "hw/virtio/vhost.h"
diff --git a/migration/dirtyrate.c b/migration/dirtyrate.c
index 4cd14779d6..09caf92f87 100644
--- a/migration/dirtyrate.c
+++ b/migration/dirtyrate.c
@@ -27,7 +27,7 @@
 #include "qobject/qdict.h"
 #include "system/kvm.h"
 #include "system/runstate.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "qemu/xxhash.h"
 #include "migration.h"
 
diff --git a/migration/rdma.c b/migration/rdma.c
index 76fb034923..d9603ab603 100644
--- a/migration/rdma.c
+++ b/migration/rdma.c
@@ -30,7 +30,7 @@
 #include "qemu/sockets.h"
 #include "qemu/bitmap.h"
 #include "qemu/coroutine.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include <sys/socket.h>
 #include <netdb.h>
 #include <arpa/inet.h>
diff --git a/migration/rdma.h b/migration/rdma.h
index f55f28bbed..4d3386b84a 100644
--- a/migration/rdma.h
+++ b/migration/rdma.h
@@ -19,7 +19,7 @@
 #ifndef QEMU_MIGRATION_RDMA_H
 #define QEMU_MIGRATION_RDMA_H
 
-#include "exec/memory.h"
+#include "system/memory.h"
 
 void rdma_start_outgoing_migration(void *opaque, InetSocketAddress *host_port,
                                    Error **errp);
diff --git a/migration/savevm.c b/migration/savevm.c
index ce158c3512..c33200a33f 100644
--- a/migration/savevm.c
+++ b/migration/savevm.c
@@ -48,7 +48,7 @@
 #include "qapi/qapi-builtin-visit.h"
 #include "qemu/error-report.h"
 #include "system/cpus.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "exec/target_page.h"
 #include "trace.h"
 #include "qemu/iov.h"
diff --git a/monitor/hmp-cmds-target.c b/monitor/hmp-cmds-target.c
index 239c2a61a4..6654d31406 100644
--- a/monitor/hmp-cmds-target.c
+++ b/monitor/hmp-cmds-target.c
@@ -25,7 +25,7 @@
 #include "qemu/osdep.h"
 #include "disas/disas.h"
 #include "exec/address-spaces.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "monitor/hmp-target.h"
 #include "monitor/monitor-internal.h"
 #include "qapi/error.h"
diff --git a/rust/wrapper.h b/rust/wrapper.h
index d4fec54657..94866b7e32 100644
--- a/rust/wrapper.h
+++ b/rust/wrapper.h
@@ -52,7 +52,7 @@ typedef enum memory_order {
 #include "qemu-io.h"
 #include "system/system.h"
 #include "hw/sysbus.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "chardev/char-fe.h"
 #include "hw/clock.h"
 #include "hw/qdev-clock.h"
diff --git a/scripts/analyze-inclusions b/scripts/analyze-inclusions
index b6280f25c8..d2c566667d 100644
--- a/scripts/analyze-inclusions
+++ b/scripts/analyze-inclusions
@@ -53,7 +53,7 @@ echo $(grep_include -F 'trace/generated-tracers.h') files include generated-trac
 echo $(grep_include -F 'qapi/error.h') files include qapi/error.h
 echo $(grep_include -F 'qom/object.h') files include qom/object.h
 echo $(grep_include -F 'block/aio.h') files include block/aio.h
-echo $(grep_include -F 'exec/memory.h') files include exec/memory.h
+echo $(grep_include -F 'system/memory.h') files include system/memory.h
 echo $(grep_include -F 'fpu/softfloat.h') files include fpu/softfloat.h
 echo $(grep_include -F 'qemu/bswap.h') files include qemu/bswap.h
 echo
diff --git a/stubs/ram-block.c b/stubs/ram-block.c
index 108197683b..e88fab31a5 100644
--- a/stubs/ram-block.c
+++ b/stubs/ram-block.c
@@ -1,7 +1,7 @@
 #include "qemu/osdep.h"
 #include "exec/ramlist.h"
 #include "exec/cpu-common.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 
 void *qemu_ram_get_host_addr(RAMBlock *rb)
 {
diff --git a/system/dirtylimit.c b/system/dirtylimit.c
index 7dedef8dd4..30cd09f3d1 100644
--- a/system/dirtylimit.c
+++ b/system/dirtylimit.c
@@ -19,7 +19,7 @@
 #include "system/dirtylimit.h"
 #include "monitor/hmp.h"
 #include "monitor/monitor.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "exec/target_page.h"
 #include "hw/boards.h"
 #include "system/kvm.h"
diff --git a/system/ioport.c b/system/ioport.c
index 89daae9d60..2291739039 100644
--- a/system/ioport.c
+++ b/system/ioport.c
@@ -27,7 +27,7 @@
 
 #include "qemu/osdep.h"
 #include "exec/ioport.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "exec/address-spaces.h"
 #include "trace.h"
 
diff --git a/system/memory.c b/system/memory.c
index eddd21a6cd..2865d0deb1 100644
--- a/system/memory.c
+++ b/system/memory.c
@@ -16,7 +16,7 @@
 #include "qemu/osdep.h"
 #include "qemu/log.h"
 #include "qapi/error.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "qapi/visitor.h"
 #include "qemu/bitops.h"
 #include "qemu/error-report.h"
diff --git a/system/memory_mapping.c b/system/memory_mapping.c
index 37d3325f77..8538a8241e 100644
--- a/system/memory_mapping.c
+++ b/system/memory_mapping.c
@@ -16,7 +16,7 @@
 #include "qapi/error.h"
 
 #include "system/memory_mapping.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "exec/address-spaces.h"
 #include "hw/core/cpu.h"
 
diff --git a/system/physmem.c b/system/physmem.c
index 333a5eb94d..e61fea41b5 100644
--- a/system/physmem.c
+++ b/system/physmem.c
@@ -50,7 +50,7 @@
 #include "qemu/log.h"
 #include "qemu/memalign.h"
 #include "qemu/memfd.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "exec/ioport.h"
 #include "system/dma.h"
 #include "system/hostmem.h"
diff --git a/system/qtest.c b/system/qtest.c
index 12152efbcd..5407289154 100644
--- a/system/qtest.c
+++ b/system/qtest.c
@@ -17,7 +17,7 @@
 #include "system/runstate.h"
 #include "chardev/char-fe.h"
 #include "exec/ioport.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "exec/tswap.h"
 #include "hw/qdev-core.h"
 #include "hw/irq.h"
diff --git a/target/avr/cpu.h b/target/avr/cpu.h
index 9862705c6a..b0518a1f60 100644
--- a/target/avr/cpu.h
+++ b/target/avr/cpu.h
@@ -23,7 +23,7 @@
 
 #include "cpu-qom.h"
 #include "exec/cpu-defs.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 
 #ifdef CONFIG_USER_ONLY
 #error "AVR 8-bit does not support user mode"
diff --git a/target/loongarch/cpu.h b/target/loongarch/cpu.h
index 254e4fbdcd..02ef6ddecb 100644
--- a/target/loongarch/cpu.h
+++ b/target/loongarch/cpu.h
@@ -14,7 +14,7 @@
 #include "hw/registerfields.h"
 #include "qemu/timer.h"
 #ifndef CONFIG_USER_ONLY
-#include "exec/memory.h"
+#include "system/memory.h"
 #endif
 #include "cpu-csr.h"
 #include "cpu-qom.h"
diff --git a/target/mips/cpu.h b/target/mips/cpu.h
index f6877ece8b..9ef72a95d7 100644
--- a/target/mips/cpu.h
+++ b/target/mips/cpu.h
@@ -4,7 +4,7 @@
 #include "cpu-qom.h"
 #include "exec/cpu-defs.h"
 #ifndef CONFIG_USER_ONLY
-#include "exec/memory.h"
+#include "system/memory.h"
 #endif
 #include "fpu/softfloat-types.h"
 #include "hw/clock.h"
diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
index 7663b62d01..ec6a0a8b66 100644
--- a/target/xtensa/cpu.c
+++ b/target/xtensa/cpu.c
@@ -36,7 +36,7 @@
 #include "migration/vmstate.h"
 #include "hw/qdev-clock.h"
 #ifndef CONFIG_USER_ONLY
-#include "exec/memory.h"
+#include "system/memory.h"
 #endif
 
 
diff --git a/tests/qtest/fuzz/generic_fuzz.c b/tests/qtest/fuzz/generic_fuzz.c
index d107a496da..239be9372d 100644
--- a/tests/qtest/fuzz/generic_fuzz.c
+++ b/tests/qtest/fuzz/generic_fuzz.c
@@ -20,7 +20,7 @@
 #include "tests/qtest/libqos/pci-pc.h"
 #include "fuzz.h"
 #include "string.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "exec/ramblock.h"
 #include "hw/qdev-core.h"
 #include "hw/pci/pci.h"
diff --git a/tests/qtest/fuzz/qos_fuzz.c b/tests/qtest/fuzz/qos_fuzz.c
index d3839bf999..9afe8bf6d8 100644
--- a/tests/qtest/fuzz/qos_fuzz.c
+++ b/tests/qtest/fuzz/qos_fuzz.c
@@ -19,7 +19,7 @@
 #include "qemu/osdep.h"
 #include "qemu/units.h"
 #include "qapi/error.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "qemu/main-loop.h"
 
 #include "tests/qtest/libqtest.h"
diff --git a/tests/unit/test-resv-mem.c b/tests/unit/test-resv-mem.c
index cd8f7318cc..4de2d042d1 100644
--- a/tests/unit/test-resv-mem.c
+++ b/tests/unit/test-resv-mem.c
@@ -10,7 +10,7 @@
 
 #include "qemu/osdep.h"
 #include "qemu/range.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "qemu/reserved-region.h"
 
 #define DEBUG 0
diff --git a/ui/console.c b/ui/console.c
index 6456e8dd90..6cd122cf40 100644
--- a/ui/console.c
+++ b/ui/console.c
@@ -35,7 +35,7 @@
 #include "qemu/option.h"
 #include "chardev/char.h"
 #include "trace.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "qom/object.h"
 #include "qemu/memfd.h"
 
diff --git a/util/vfio-helpers.c b/util/vfio-helpers.c
index f8bab46c68..fdff042ab4 100644
--- a/util/vfio-helpers.c
+++ b/util/vfio-helpers.c
@@ -16,7 +16,7 @@
 #include "qapi/error.h"
 #include "exec/ramlist.h"
 #include "exec/cpu-common.h"
-#include "exec/memory.h"
+#include "system/memory.h"
 #include "trace.h"
 #include "qemu/error-report.h"
 #include "standard-headers/linux/pci_regs.h"

From dfc56946a70052136126f6a207f237af8032d74a Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 12 Mar 2025 12:31:54 -0700
Subject: [PATCH 0114/2760] include/system: Move exec/address-spaces.h to
 system/address-spaces.h
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Convert the existing includes with sed.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/hvf/hvf-accel-ops.c                 | 2 +-
 hw/acpi/erst.c                            | 2 +-
 hw/arm/aspeed_ast10x0.c                   | 2 +-
 hw/arm/bananapi_m2u.c                     | 2 +-
 hw/arm/collie.c                           | 2 +-
 hw/arm/exynos4_boards.c                   | 2 +-
 hw/arm/fsl-imx31.c                        | 2 +-
 hw/arm/fsl-imx8mp.c                       | 2 +-
 hw/arm/imx8mp-evk.c                       | 2 +-
 hw/arm/integratorcp.c                     | 2 +-
 hw/arm/kzm.c                              | 2 +-
 hw/arm/microbit.c                         | 2 +-
 hw/arm/mps2-tz.c                          | 2 +-
 hw/arm/mps2.c                             | 2 +-
 hw/arm/mps3r.c                            | 2 +-
 hw/arm/msf2-soc.c                         | 2 +-
 hw/arm/msf2-som.c                         | 2 +-
 hw/arm/musca.c                            | 2 +-
 hw/arm/omap1.c                            | 2 +-
 hw/arm/omap_sx1.c                         | 2 +-
 hw/arm/orangepi.c                         | 2 +-
 hw/arm/stellaris.c                        | 2 +-
 hw/arm/stm32f100_soc.c                    | 2 +-
 hw/arm/stm32f205_soc.c                    | 2 +-
 hw/arm/stm32f405_soc.c                    | 2 +-
 hw/arm/stm32l4x5_soc.c                    | 2 +-
 hw/avr/atmega.c                           | 2 +-
 hw/char/goldfish_tty.c                    | 2 +-
 hw/char/omap_uart.c                       | 2 +-
 hw/char/riscv_htif.c                      | 2 +-
 hw/core/cpu-system.c                      | 2 +-
 hw/core/null-machine.c                    | 2 +-
 hw/core/sysbus.c                          | 2 +-
 hw/display/apple-gfx.m                    | 2 +-
 hw/dma/rc4030.c                           | 2 +-
 hw/hyperv/hv-balloon.c                    | 2 +-
 hw/hyperv/hyperv.c                        | 2 +-
 hw/i386/kvm/xen_evtchn.c                  | 2 +-
 hw/i386/kvm/xen_gnttab.c                  | 2 +-
 hw/i386/kvm/xen_overlay.c                 | 2 +-
 hw/i386/sgx-epc.c                         | 2 +-
 hw/i386/sgx.c                             | 2 +-
 hw/i386/vapic.c                           | 2 +-
 hw/ide/ahci-sysbus.c                      | 2 +-
 hw/input/lasips2.c                        | 2 +-
 hw/intc/loongarch_extioi.c                | 2 +-
 hw/intc/riscv_aplic.c                     | 2 +-
 hw/intc/riscv_imsic.c                     | 2 +-
 hw/loongarch/virt.c                       | 2 +-
 hw/mem/memory-device.c                    | 2 +-
 hw/microblaze/petalogix_ml605_mmu.c       | 2 +-
 hw/microblaze/petalogix_s3adsp1800_mmu.c  | 2 +-
 hw/microblaze/xlnx-zynqmp-pmu.c           | 2 +-
 hw/mips/mipssim.c                         | 2 +-
 hw/misc/allwinner-h3-dramc.c              | 2 +-
 hw/misc/allwinner-r40-dramc.c             | 2 +-
 hw/misc/ivshmem-flat.c                    | 2 +-
 hw/misc/mac_via.c                         | 2 +-
 hw/net/i82596.c                           | 2 +-
 hw/net/i82596.h                           | 2 +-
 hw/nvram/fw_cfg.c                         | 2 +-
 hw/openrisc/openrisc_sim.c                | 2 +-
 hw/openrisc/virt.c                        | 2 +-
 hw/pci-host/mv64361.c                     | 2 +-
 hw/ppc/pegasos2.c                         | 2 +-
 hw/ppc/pnv_psi.c                          | 2 +-
 hw/ppc/ppc4xx_sdram.c                     | 2 +-
 hw/ppc/prep_systemio.c                    | 2 +-
 hw/ppc/rs6000_mc.c                        | 2 +-
 hw/ppc/spapr_ovec.c                       | 2 +-
 hw/ppc/vof.c                              | 2 +-
 hw/remote/iommu.c                         | 2 +-
 hw/riscv/microblaze-v-generic.c           | 2 +-
 hw/riscv/opentitan.c                      | 2 +-
 hw/riscv/shakti_c.c                       | 2 +-
 hw/s390x/css.c                            | 2 +-
 hw/s390x/ipl.h                            | 2 +-
 hw/s390x/s390-skeys.c                     | 2 +-
 hw/s390x/virtio-ccw.c                     | 2 +-
 hw/sparc/sun4m_iommu.c                    | 2 +-
 hw/sparc64/sun4u_iommu.c                  | 2 +-
 hw/timer/hpet.c                           | 2 +-
 hw/tpm/tpm_crb.c                          | 2 +-
 hw/vfio/ap.c                              | 2 +-
 hw/vfio/ccw.c                             | 2 +-
 hw/vfio/common.c                          | 2 +-
 hw/vfio/container.c                       | 2 +-
 hw/vfio/platform.c                        | 2 +-
 hw/vfio/spapr.c                           | 2 +-
 hw/virtio/vhost-vdpa.c                    | 2 +-
 hw/virtio/virtio-balloon.c                | 2 +-
 hw/virtio/virtio-bus.c                    | 2 +-
 include/hw/misc/lasi.h                    | 2 +-
 include/hw/nubus/nubus.h                  | 2 +-
 include/hw/ppc/vof.h                      | 2 +-
 include/hw/tricore/triboard.h             | 2 +-
 include/{exec => system}/address-spaces.h | 8 ++------
 include/system/dma.h                      | 2 +-
 monitor/hmp-cmds-target.c                 | 2 +-
 monitor/hmp-cmds.c                        | 2 +-
 rust/wrapper.h                            | 2 +-
 system/ioport.c                           | 2 +-
 system/memory.c                           | 2 +-
 system/memory_mapping.c                   | 2 +-
 target/arm/hvf/hvf.c                      | 2 +-
 target/arm/kvm.c                          | 2 +-
 target/avr/cpu.c                          | 2 +-
 target/i386/cpu-apic.c                    | 2 +-
 target/i386/cpu.c                         | 2 +-
 target/i386/hvf/vmx.h                     | 2 +-
 target/i386/kvm/xen-emu.c                 | 2 +-
 target/i386/nvmm/nvmm-all.c               | 2 +-
 target/i386/sev.c                         | 2 +-
 target/i386/tcg/system/misc_helper.c      | 2 +-
 target/i386/tcg/system/tcg-cpu.c          | 2 +-
 target/i386/whpx/whpx-all.c               | 2 +-
 target/loongarch/kvm/kvm.c                | 2 +-
 target/riscv/kvm/kvm-cpu.c                | 2 +-
 target/s390x/mmu_helper.c                 | 2 +-
 target/s390x/sigp.c                       | 2 +-
 target/s390x/tcg/excp_helper.c            | 2 +-
 target/xtensa/dbg_helper.c                | 2 +-
 122 files changed, 123 insertions(+), 127 deletions(-)
 rename include/{exec => system}/address-spaces.h (89%)

diff --git a/accel/hvf/hvf-accel-ops.c b/accel/hvf/hvf-accel-ops.c
index 12fc30c276..601c3bc0ac 100644
--- a/accel/hvf/hvf-accel-ops.c
+++ b/accel/hvf/hvf-accel-ops.c
@@ -50,7 +50,7 @@
 #include "qemu/osdep.h"
 #include "qemu/error-report.h"
 #include "qemu/main-loop.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "exec/exec-all.h"
 #include "gdbstub/enums.h"
 #include "hw/boards.h"
diff --git a/hw/acpi/erst.c b/hw/acpi/erst.c
index 5c4c1dc638..2e49b551f2 100644
--- a/hw/acpi/erst.c
+++ b/hw/acpi/erst.c
@@ -23,7 +23,7 @@
 #include "hw/acpi/acpi-defs.h"
 #include "hw/acpi/aml-build.h"
 #include "hw/acpi/bios-linker-loader.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "system/hostmem.h"
 #include "hw/acpi/erst.h"
 #include "trace.h"
diff --git a/hw/arm/aspeed_ast10x0.c b/hw/arm/aspeed_ast10x0.c
index ec329f4991..21ffab10f3 100644
--- a/hw/arm/aspeed_ast10x0.c
+++ b/hw/arm/aspeed_ast10x0.c
@@ -11,7 +11,7 @@
 
 #include "qemu/osdep.h"
 #include "qapi/error.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "system/system.h"
 #include "hw/qdev-clock.h"
 #include "hw/misc/unimp.h"
diff --git a/hw/arm/bananapi_m2u.c b/hw/arm/bananapi_m2u.c
index 4d84d10d24..b750a575f7 100644
--- a/hw/arm/bananapi_m2u.c
+++ b/hw/arm/bananapi_m2u.c
@@ -19,7 +19,7 @@
 
 #include "qemu/osdep.h"
 #include "qemu/units.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "qapi/error.h"
 #include "qemu/error-report.h"
 #include "hw/boards.h"
diff --git a/hw/arm/collie.c b/hw/arm/collie.c
index eaa5c52d45..e83aee58c6 100644
--- a/hw/arm/collie.c
+++ b/hw/arm/collie.c
@@ -16,7 +16,7 @@
 #include "strongarm.h"
 #include "hw/arm/boot.h"
 #include "hw/block/flash.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "qom/object.h"
 #include "qemu/error-report.h"
 
diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
index 43dc89d902..2d8f2d7326 100644
--- a/hw/arm/exynos4_boards.c
+++ b/hw/arm/exynos4_boards.c
@@ -28,7 +28,7 @@
 #include "hw/sysbus.h"
 #include "net/net.h"
 #include "hw/arm/boot.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "hw/arm/exynos4210.h"
 #include "hw/net/lan9118.h"
 #include "hw/qdev-properties.h"
diff --git a/hw/arm/fsl-imx31.c b/hw/arm/fsl-imx31.c
index 9de0f2148f..2a8ffb15f7 100644
--- a/hw/arm/fsl-imx31.c
+++ b/hw/arm/fsl-imx31.c
@@ -23,7 +23,7 @@
 #include "qapi/error.h"
 #include "hw/arm/fsl-imx31.h"
 #include "system/system.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "hw/qdev-properties.h"
 #include "chardev/char.h"
 #include "target/arm/cpu-qom.h"
diff --git a/hw/arm/fsl-imx8mp.c b/hw/arm/fsl-imx8mp.c
index 82edf61082..af7a7e6745 100644
--- a/hw/arm/fsl-imx8mp.c
+++ b/hw/arm/fsl-imx8mp.c
@@ -9,7 +9,7 @@
  */
 
 #include "qemu/osdep.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "hw/arm/bsa.h"
 #include "hw/arm/fsl-imx8mp.h"
 #include "hw/intc/arm_gicv3.h"
diff --git a/hw/arm/imx8mp-evk.c b/hw/arm/imx8mp-evk.c
index b5aec06ec5..b3082fa60d 100644
--- a/hw/arm/imx8mp-evk.c
+++ b/hw/arm/imx8mp-evk.c
@@ -7,7 +7,7 @@
  */
 
 #include "qemu/osdep.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "hw/arm/boot.h"
 #include "hw/arm/fsl-imx8mp.h"
 #include "hw/boards.h"
diff --git a/hw/arm/integratorcp.c b/hw/arm/integratorcp.c
index 8aa2e6e98e..ac0c6c6096 100644
--- a/hw/arm/integratorcp.c
+++ b/hw/arm/integratorcp.c
@@ -16,7 +16,7 @@
 #include "hw/misc/arm_integrator_debug.h"
 #include "hw/net/smc91c111.h"
 #include "net/net.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "system/runstate.h"
 #include "system/system.h"
 #include "qemu/log.h"
diff --git a/hw/arm/kzm.c b/hw/arm/kzm.c
index 08d2b3025c..362c145409 100644
--- a/hw/arm/kzm.c
+++ b/hw/arm/kzm.c
@@ -19,7 +19,7 @@
 #include "hw/arm/boot.h"
 #include "hw/boards.h"
 #include "qemu/error-report.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "net/net.h"
 #include "hw/net/lan9118.h"
 #include "hw/char/serial-mm.h"
diff --git a/hw/arm/microbit.c b/hw/arm/microbit.c
index 3f56fb45ce..ade363daaa 100644
--- a/hw/arm/microbit.c
+++ b/hw/arm/microbit.c
@@ -13,7 +13,7 @@
 #include "hw/boards.h"
 #include "hw/arm/boot.h"
 #include "system/system.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 
 #include "hw/arm/nrf51_soc.h"
 #include "hw/i2c/microbit_i2c.h"
diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
index 13ed868b6b..b0633a5a69 100644
--- a/hw/arm/mps2-tz.c
+++ b/hw/arm/mps2-tz.c
@@ -54,7 +54,7 @@
 #include "hw/arm/armv7m.h"
 #include "hw/or-irq.h"
 #include "hw/boards.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "system/system.h"
 #include "system/reset.h"
 #include "hw/misc/unimp.h"
diff --git a/hw/arm/mps2.c b/hw/arm/mps2.c
index 3f8db0cab6..6958485a66 100644
--- a/hw/arm/mps2.c
+++ b/hw/arm/mps2.c
@@ -33,7 +33,7 @@
 #include "hw/arm/armv7m.h"
 #include "hw/or-irq.h"
 #include "hw/boards.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "system/system.h"
 #include "hw/qdev-properties.h"
 #include "hw/misc/unimp.h"
diff --git a/hw/arm/mps3r.c b/hw/arm/mps3r.c
index 1bddb5e822..4dd1e8a718 100644
--- a/hw/arm/mps3r.c
+++ b/hw/arm/mps3r.c
@@ -28,7 +28,7 @@
 #include "qemu/units.h"
 #include "qapi/error.h"
 #include "qobject/qlist.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "cpu.h"
 #include "system/system.h"
 #include "hw/boards.h"
diff --git a/hw/arm/msf2-soc.c b/hw/arm/msf2-soc.c
index e8a5b231ba..bc9b419e37 100644
--- a/hw/arm/msf2-soc.c
+++ b/hw/arm/msf2-soc.c
@@ -25,7 +25,7 @@
 #include "qemu/osdep.h"
 #include "qemu/units.h"
 #include "qapi/error.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "hw/char/serial-mm.h"
 #include "hw/arm/msf2-soc.h"
 #include "hw/misc/unimp.h"
diff --git a/hw/arm/msf2-som.c b/hw/arm/msf2-som.c
index 9b20f1e2c9..29c76c6860 100644
--- a/hw/arm/msf2-som.c
+++ b/hw/arm/msf2-som.c
@@ -33,7 +33,7 @@
 #include "hw/qdev-properties.h"
 #include "hw/arm/boot.h"
 #include "hw/qdev-clock.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "hw/arm/msf2-soc.h"
 
 #define DDR_BASE_ADDRESS      0xA0000000
diff --git a/hw/arm/musca.c b/hw/arm/musca.c
index e9c092abc3..a4f43f1992 100644
--- a/hw/arm/musca.c
+++ b/hw/arm/musca.c
@@ -22,7 +22,7 @@
 #include "qemu/osdep.h"
 #include "qemu/error-report.h"
 #include "qapi/error.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "system/system.h"
 #include "hw/arm/boot.h"
 #include "hw/arm/armsse.h"
diff --git a/hw/arm/omap1.c b/hw/arm/omap1.c
index 3ee10b4777..91d7e3f04b 100644
--- a/hw/arm/omap1.c
+++ b/hw/arm/omap1.c
@@ -23,7 +23,7 @@
 #include "qemu/main-loop.h"
 #include "qapi/error.h"
 #include "cpu.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "hw/hw.h"
 #include "hw/irq.h"
 #include "hw/qdev-properties.h"
diff --git a/hw/arm/omap_sx1.c b/hw/arm/omap_sx1.c
index 24b4043183..aa1e96b3ad 100644
--- a/hw/arm/omap_sx1.c
+++ b/hw/arm/omap_sx1.c
@@ -34,7 +34,7 @@
 #include "hw/arm/boot.h"
 #include "hw/block/flash.h"
 #include "system/qtest.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "qemu/cutils.h"
 #include "qemu/error-report.h"
 
diff --git a/hw/arm/orangepi.c b/hw/arm/orangepi.c
index 634af9b0a1..e0956880d1 100644
--- a/hw/arm/orangepi.c
+++ b/hw/arm/orangepi.c
@@ -19,7 +19,7 @@
 
 #include "qemu/osdep.h"
 #include "qemu/units.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "qapi/error.h"
 #include "qemu/error-report.h"
 #include "hw/boards.h"
diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
index 3361111360..cbe914c93e 100644
--- a/hw/arm/stellaris.c
+++ b/hw/arm/stellaris.c
@@ -20,7 +20,7 @@
 #include "net/net.h"
 #include "hw/boards.h"
 #include "qemu/log.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "system/system.h"
 #include "hw/arm/armv7m.h"
 #include "hw/char/pl011.h"
diff --git a/hw/arm/stm32f100_soc.c b/hw/arm/stm32f100_soc.c
index 53b5636452..0eabaf8d9b 100644
--- a/hw/arm/stm32f100_soc.c
+++ b/hw/arm/stm32f100_soc.c
@@ -27,7 +27,7 @@
 #include "qapi/error.h"
 #include "qemu/module.h"
 #include "hw/arm/boot.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "hw/arm/stm32f100_soc.h"
 #include "hw/qdev-properties.h"
 #include "hw/qdev-clock.h"
diff --git a/hw/arm/stm32f205_soc.c b/hw/arm/stm32f205_soc.c
index 47a54e592b..32e96912f0 100644
--- a/hw/arm/stm32f205_soc.c
+++ b/hw/arm/stm32f205_soc.c
@@ -26,7 +26,7 @@
 #include "qapi/error.h"
 #include "qemu/module.h"
 #include "hw/arm/boot.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "hw/arm/stm32f205_soc.h"
 #include "hw/qdev-properties.h"
 #include "hw/qdev-clock.h"
diff --git a/hw/arm/stm32f405_soc.c b/hw/arm/stm32f405_soc.c
index 18d8824f29..bba9060daf 100644
--- a/hw/arm/stm32f405_soc.c
+++ b/hw/arm/stm32f405_soc.c
@@ -24,7 +24,7 @@
 
 #include "qemu/osdep.h"
 #include "qapi/error.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "system/system.h"
 #include "hw/arm/stm32f405_soc.h"
 #include "hw/qdev-clock.h"
diff --git a/hw/arm/stm32l4x5_soc.c b/hw/arm/stm32l4x5_soc.c
index dbf75329f7..6278d354c8 100644
--- a/hw/arm/stm32l4x5_soc.c
+++ b/hw/arm/stm32l4x5_soc.c
@@ -24,7 +24,7 @@
 #include "qemu/osdep.h"
 #include "qemu/units.h"
 #include "qapi/error.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "system/system.h"
 #include "hw/or-irq.h"
 #include "hw/arm/stm32l4x5_soc.h"
diff --git a/hw/avr/atmega.c b/hw/avr/atmega.c
index cb721c96b7..2e8b8e8c67 100644
--- a/hw/avr/atmega.c
+++ b/hw/avr/atmega.c
@@ -13,7 +13,7 @@
 #include "qemu/units.h"
 #include "qapi/error.h"
 #include "system/memory.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "system/system.h"
 #include "hw/qdev-properties.h"
 #include "hw/sysbus.h"
diff --git a/hw/char/goldfish_tty.c b/hw/char/goldfish_tty.c
index 7374561141..f0891ffa4d 100644
--- a/hw/char/goldfish_tty.c
+++ b/hw/char/goldfish_tty.c
@@ -15,7 +15,7 @@
 #include "chardev/char-fe.h"
 #include "qemu/log.h"
 #include "trace.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "system/dma.h"
 #include "hw/char/goldfish_tty.h"
 
diff --git a/hw/char/omap_uart.c b/hw/char/omap_uart.c
index 07fb868965..8cbf6ce803 100644
--- a/hw/char/omap_uart.c
+++ b/hw/char/omap_uart.c
@@ -21,7 +21,7 @@
 #include "chardev/char.h"
 #include "hw/arm/omap.h"
 #include "hw/char/serial-mm.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 
 /* UARTs */
 struct omap_uart_s {
diff --git a/hw/char/riscv_htif.c b/hw/char/riscv_htif.c
index ec5db5a597..c884be5d75 100644
--- a/hw/char/riscv_htif.c
+++ b/hw/char/riscv_htif.c
@@ -28,7 +28,7 @@
 #include "chardev/char-fe.h"
 #include "qemu/timer.h"
 #include "qemu/error-report.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "exec/tswap.h"
 #include "system/dma.h"
 #include "system/runstate.h"
diff --git a/hw/core/cpu-system.c b/hw/core/cpu-system.c
index 5ef8c24b5b..82b68b8927 100644
--- a/hw/core/cpu-system.c
+++ b/hw/core/cpu-system.c
@@ -20,7 +20,7 @@
 
 #include "qemu/osdep.h"
 #include "qapi/error.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "exec/cputlb.h"
 #include "system/memory.h"
 #include "exec/tb-flush.h"
diff --git a/hw/core/null-machine.c b/hw/core/null-machine.c
index 7f1fb562be..a6e477a2d8 100644
--- a/hw/core/null-machine.c
+++ b/hw/core/null-machine.c
@@ -14,7 +14,7 @@
 #include "qemu/osdep.h"
 #include "qemu/error-report.h"
 #include "hw/boards.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "hw/core/cpu.h"
 
 static void machine_none_init(MachineState *mch)
diff --git a/hw/core/sysbus.c b/hw/core/sysbus.c
index 98819d5dc6..6eb4c0f15a 100644
--- a/hw/core/sysbus.c
+++ b/hw/core/sysbus.c
@@ -21,7 +21,7 @@
 #include "qapi/error.h"
 #include "hw/sysbus.h"
 #include "monitor/monitor.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 
 static void sysbus_dev_print(Monitor *mon, DeviceState *dev, int indent);
 static char *sysbus_get_fw_dev_path(DeviceState *dev);
diff --git a/hw/display/apple-gfx.m b/hw/display/apple-gfx.m
index c4323574e1..2ff1c90df7 100644
--- a/hw/display/apple-gfx.m
+++ b/hw/display/apple-gfx.m
@@ -18,7 +18,7 @@
 #include "qapi/visitor.h"
 #include "qapi/error.h"
 #include "block/aio-wait.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "system/dma.h"
 #include "migration/blocker.h"
 #include "ui/console.h"
diff --git a/hw/dma/rc4030.c b/hw/dma/rc4030.c
index 5bf54347ed..6842e7d491 100644
--- a/hw/dma/rc4030.c
+++ b/hw/dma/rc4030.c
@@ -32,7 +32,7 @@
 #include "qemu/timer.h"
 #include "qemu/log.h"
 #include "qemu/module.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "trace.h"
 #include "qom/object.h"
 
diff --git a/hw/hyperv/hv-balloon.c b/hw/hyperv/hv-balloon.c
index 6f33c3e741..0b1da723c8 100644
--- a/hw/hyperv/hv-balloon.c
+++ b/hw/hyperv/hv-balloon.c
@@ -10,7 +10,7 @@
 #include "qemu/osdep.h"
 #include "hv-balloon-internal.h"
 
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "exec/cpu-common.h"
 #include "exec/ramblock.h"
 #include "hw/boards.h"
diff --git a/hw/hyperv/hyperv.c b/hw/hyperv/hyperv.c
index 382c62d668..d21e428eae 100644
--- a/hw/hyperv/hyperv.c
+++ b/hw/hyperv/hyperv.c
@@ -11,7 +11,7 @@
 #include "qemu/main-loop.h"
 #include "qemu/module.h"
 #include "qapi/error.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "system/memory.h"
 #include "system/kvm.h"
 #include "qemu/bitops.h"
diff --git a/hw/i386/kvm/xen_evtchn.c b/hw/i386/kvm/xen_evtchn.c
index 9b8b092bc2..f9223ef1a1 100644
--- a/hw/i386/kvm/xen_evtchn.c
+++ b/hw/i386/kvm/xen_evtchn.c
@@ -23,7 +23,7 @@
 #include "qobject/qdict.h"
 #include "qom/object.h"
 #include "exec/target_page.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "migration/vmstate.h"
 #include "trace.h"
 
diff --git a/hw/i386/kvm/xen_gnttab.c b/hw/i386/kvm/xen_gnttab.c
index 7b843a72b1..430ba62896 100644
--- a/hw/i386/kvm/xen_gnttab.c
+++ b/hw/i386/kvm/xen_gnttab.c
@@ -17,7 +17,7 @@
 #include "qapi/error.h"
 #include "qom/object.h"
 #include "exec/target_page.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "migration/vmstate.h"
 
 #include "hw/sysbus.h"
diff --git a/hw/i386/kvm/xen_overlay.c b/hw/i386/kvm/xen_overlay.c
index db9aa7942d..a2b26e9906 100644
--- a/hw/i386/kvm/xen_overlay.c
+++ b/hw/i386/kvm/xen_overlay.c
@@ -16,7 +16,7 @@
 #include "qapi/error.h"
 #include "qom/object.h"
 #include "exec/target_page.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "migration/vmstate.h"
 
 #include "hw/sysbus.h"
diff --git a/hw/i386/sgx-epc.c b/hw/i386/sgx-epc.c
index 875e1c5c33..00b220d4d6 100644
--- a/hw/i386/sgx-epc.c
+++ b/hw/i386/sgx-epc.c
@@ -17,7 +17,7 @@
 #include "qapi/error.h"
 #include "qapi/visitor.h"
 #include "target/i386/cpu.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 
 static const Property sgx_epc_properties[] = {
     DEFINE_PROP_UINT64(SGX_EPC_ADDR_PROP, SGXEPCDevice, addr, 0),
diff --git a/hw/i386/sgx.c b/hw/i386/sgx.c
index e665e2111c..5685c4fb80 100644
--- a/hw/i386/sgx.c
+++ b/hw/i386/sgx.c
@@ -20,7 +20,7 @@
 #include "qapi/error.h"
 #include "qemu/error-report.h"
 #include "qapi/qapi-commands-misc-target.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "system/hw_accel.h"
 #include "system/reset.h"
 #include <sys/ioctl.h>
diff --git a/hw/i386/vapic.c b/hw/i386/vapic.c
index 14de9b7a82..26aae64e5d 100644
--- a/hw/i386/vapic.c
+++ b/hw/i386/vapic.c
@@ -16,7 +16,7 @@
 #include "system/hw_accel.h"
 #include "system/kvm.h"
 #include "system/runstate.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "hw/i386/apic_internal.h"
 #include "hw/sysbus.h"
 #include "hw/boards.h"
diff --git a/hw/ide/ahci-sysbus.c b/hw/ide/ahci-sysbus.c
index 03a5bd42d0..3c1935d81c 100644
--- a/hw/ide/ahci-sysbus.c
+++ b/hw/ide/ahci-sysbus.c
@@ -22,7 +22,7 @@
  */
 
 #include "qemu/osdep.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "hw/qdev-properties.h"
 #include "migration/vmstate.h"
 
diff --git a/hw/input/lasips2.c b/hw/input/lasips2.c
index d9f8c36778..987034efd3 100644
--- a/hw/input/lasips2.c
+++ b/hw/input/lasips2.c
@@ -29,7 +29,7 @@
 #include "hw/input/lasips2.h"
 #include "exec/hwaddr.h"
 #include "trace.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "migration/vmstate.h"
 #include "hw/irq.h"
 #include "qapi/error.h"
diff --git a/hw/intc/loongarch_extioi.c b/hw/intc/loongarch_extioi.c
index a51a215e6e..a558c50185 100644
--- a/hw/intc/loongarch_extioi.c
+++ b/hw/intc/loongarch_extioi.c
@@ -11,7 +11,7 @@
 #include "qapi/error.h"
 #include "hw/irq.h"
 #include "hw/loongarch/virt.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "hw/intc/loongarch_extioi.h"
 #include "trace.h"
 
diff --git a/hw/intc/riscv_aplic.c b/hw/intc/riscv_aplic.c
index 5964cde7e0..789c4a4d6e 100644
--- a/hw/intc/riscv_aplic.c
+++ b/hw/intc/riscv_aplic.c
@@ -22,7 +22,7 @@
 #include "qemu/module.h"
 #include "qemu/error-report.h"
 #include "qemu/bswap.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "hw/sysbus.h"
 #include "hw/pci/msi.h"
 #include "hw/boards.h"
diff --git a/hw/intc/riscv_imsic.c b/hw/intc/riscv_imsic.c
index 241b12fef0..852f413e5a 100644
--- a/hw/intc/riscv_imsic.c
+++ b/hw/intc/riscv_imsic.c
@@ -22,7 +22,7 @@
 #include "qemu/module.h"
 #include "qemu/error-report.h"
 #include "qemu/bswap.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "hw/sysbus.h"
 #include "hw/pci/msi.h"
 #include "hw/boards.h"
diff --git a/hw/loongarch/virt.c b/hw/loongarch/virt.c
index 65c9027feb..f1eb42c2c1 100644
--- a/hw/loongarch/virt.c
+++ b/hw/loongarch/virt.c
@@ -18,7 +18,7 @@
 #include "system/reset.h"
 #include "system/rtc.h"
 #include "hw/loongarch/virt.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "hw/irq.h"
 #include "net/net.h"
 #include "hw/loader.h"
diff --git a/hw/mem/memory-device.c b/hw/mem/memory-device.c
index 1de8dfec7d..1a432e9bd2 100644
--- a/hw/mem/memory-device.c
+++ b/hw/mem/memory-device.c
@@ -17,7 +17,7 @@
 #include "qemu/range.h"
 #include "hw/virtio/vhost.h"
 #include "system/kvm.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "trace.h"
 
 static bool memory_device_is_empty(const MemoryDeviceState *md)
diff --git a/hw/microblaze/petalogix_ml605_mmu.c b/hw/microblaze/petalogix_ml605_mmu.c
index 21ad215e44..c887c7a99e 100644
--- a/hw/microblaze/petalogix_ml605_mmu.c
+++ b/hw/microblaze/petalogix_ml605_mmu.c
@@ -36,7 +36,7 @@
 #include "hw/boards.h"
 #include "hw/char/serial-mm.h"
 #include "hw/qdev-properties.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "hw/ssi/ssi.h"
 
 #include "boot.h"
diff --git a/hw/microblaze/petalogix_s3adsp1800_mmu.c b/hw/microblaze/petalogix_s3adsp1800_mmu.c
index bdba2006b7..f976c90bd2 100644
--- a/hw/microblaze/petalogix_s3adsp1800_mmu.c
+++ b/hw/microblaze/petalogix_s3adsp1800_mmu.c
@@ -33,7 +33,7 @@
 #include "system/system.h"
 #include "hw/boards.h"
 #include "hw/misc/unimp.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "hw/char/xilinx_uartlite.h"
 
 #include "boot.h"
diff --git a/hw/microblaze/xlnx-zynqmp-pmu.c b/hw/microblaze/xlnx-zynqmp-pmu.c
index bdbf7328bf..0922c65295 100644
--- a/hw/microblaze/xlnx-zynqmp-pmu.c
+++ b/hw/microblaze/xlnx-zynqmp-pmu.c
@@ -17,7 +17,7 @@
 
 #include "qemu/osdep.h"
 #include "qapi/error.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "hw/boards.h"
 #include "cpu.h"
 #include "boot.h"
diff --git a/hw/mips/mipssim.c b/hw/mips/mipssim.c
index c530688e76..b6dabf2893 100644
--- a/hw/mips/mipssim.c
+++ b/hw/mips/mipssim.c
@@ -28,7 +28,7 @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "qemu/datadir.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "hw/clock.h"
 #include "hw/mips/mips.h"
 #include "hw/char/serial-mm.h"
diff --git a/hw/misc/allwinner-h3-dramc.c b/hw/misc/allwinner-h3-dramc.c
index c4f3eb9274..74ff71b753 100644
--- a/hw/misc/allwinner-h3-dramc.c
+++ b/hw/misc/allwinner-h3-dramc.c
@@ -24,7 +24,7 @@
 #include "migration/vmstate.h"
 #include "qemu/log.h"
 #include "qemu/module.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "hw/qdev-properties.h"
 #include "qapi/error.h"
 #include "hw/misc/allwinner-h3-dramc.h"
diff --git a/hw/misc/allwinner-r40-dramc.c b/hw/misc/allwinner-r40-dramc.c
index 96e1848c21..5908a059e8 100644
--- a/hw/misc/allwinner-r40-dramc.c
+++ b/hw/misc/allwinner-r40-dramc.c
@@ -24,7 +24,7 @@
 #include "migration/vmstate.h"
 #include "qemu/log.h"
 #include "qemu/module.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "hw/qdev-properties.h"
 #include "qapi/error.h"
 #include "qemu/bitops.h"
diff --git a/hw/misc/ivshmem-flat.c b/hw/misc/ivshmem-flat.c
index 40309a8ff3..076c4b42de 100644
--- a/hw/misc/ivshmem-flat.c
+++ b/hw/misc/ivshmem-flat.c
@@ -17,7 +17,7 @@
 #include "hw/qdev-properties-system.h"
 #include "hw/sysbus.h"
 #include "chardev/char-fe.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "trace.h"
 
 #include "hw/misc/ivshmem-flat.h"
diff --git a/hw/misc/mac_via.c b/hw/misc/mac_via.c
index 03b1feda50..3c0819c58a 100644
--- a/hw/misc/mac_via.c
+++ b/hw/misc/mac_via.c
@@ -16,7 +16,7 @@
  */
 
 #include "qemu/osdep.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "migration/vmstate.h"
 #include "hw/sysbus.h"
 #include "hw/irq.h"
diff --git a/hw/net/i82596.c b/hw/net/i82596.c
index ee919dab3c..64ed3c8390 100644
--- a/hw/net/i82596.c
+++ b/hw/net/i82596.c
@@ -15,7 +15,7 @@
 #include "hw/irq.h"
 #include "hw/qdev-properties.h"
 #include "migration/vmstate.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "qemu/module.h"
 #include "trace.h"
 #include "i82596.h"
diff --git a/hw/net/i82596.h b/hw/net/i82596.h
index 4bdfcaf856..dc1fa1a1dc 100644
--- a/hw/net/i82596.h
+++ b/hw/net/i82596.h
@@ -4,7 +4,7 @@
 #define I82596_IOPORT_SIZE       0x20
 
 #include "system/memory.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 
 #define PORT_RESET              0x00    /* reset 82596 */
 #define PORT_SELFTEST           0x01    /* selftest */
diff --git a/hw/nvram/fw_cfg.c b/hw/nvram/fw_cfg.c
index a757939cfb..cbfb2b5303 100644
--- a/hw/nvram/fw_cfg.c
+++ b/hw/nvram/fw_cfg.c
@@ -27,7 +27,7 @@
 #include "system/system.h"
 #include "system/dma.h"
 #include "system/reset.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "hw/boards.h"
 #include "hw/nvram/fw_cfg.h"
 #include "hw/qdev-properties.h"
diff --git a/hw/openrisc/openrisc_sim.c b/hw/openrisc/openrisc_sim.c
index 83d7c2a8af..c2284a7d41 100644
--- a/hw/openrisc/openrisc_sim.c
+++ b/hw/openrisc/openrisc_sim.c
@@ -28,7 +28,7 @@
 #include "net/net.h"
 #include "hw/openrisc/boot.h"
 #include "hw/qdev-properties.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "system/device_tree.h"
 #include "system/system.h"
 #include "hw/sysbus.h"
diff --git a/hw/openrisc/virt.c b/hw/openrisc/virt.c
index 3055306783..0d1c1f103c 100644
--- a/hw/openrisc/virt.c
+++ b/hw/openrisc/virt.c
@@ -11,7 +11,7 @@
 #include "qemu/guest-random.h"
 #include "qapi/error.h"
 #include "cpu.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "hw/irq.h"
 #include "hw/boards.h"
 #include "hw/char/serial-mm.h"
diff --git a/hw/pci-host/mv64361.c b/hw/pci-host/mv64361.c
index 9c41c155fb..a297318c6e 100644
--- a/hw/pci-host/mv64361.c
+++ b/hw/pci-host/mv64361.c
@@ -17,7 +17,7 @@
 #include "hw/irq.h"
 #include "hw/intc/i8259.h"
 #include "hw/qdev-properties.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "qemu/log.h"
 #include "qemu/error-report.h"
 #include "trace.h"
diff --git a/hw/ppc/pegasos2.c b/hw/ppc/pegasos2.c
index 246d6d633b..7b2dc6985c 100644
--- a/hw/ppc/pegasos2.c
+++ b/hw/ppc/pegasos2.c
@@ -31,7 +31,7 @@
 #include "qemu/error-report.h"
 #include "system/kvm.h"
 #include "kvm_ppc.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "qom/qom-qobject.h"
 #include "qobject/qdict.h"
 #include "trace.h"
diff --git a/hw/ppc/pnv_psi.c b/hw/ppc/pnv_psi.c
index 1fe11dde50..f832ee61e8 100644
--- a/hw/ppc/pnv_psi.c
+++ b/hw/ppc/pnv_psi.c
@@ -18,7 +18,7 @@
  */
 
 #include "qemu/osdep.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "hw/irq.h"
 #include "target/ppc/cpu.h"
 #include "qemu/log.h"
diff --git a/hw/ppc/ppc4xx_sdram.c b/hw/ppc/ppc4xx_sdram.c
index 562bff8d53..bf0faad9e7 100644
--- a/hw/ppc/ppc4xx_sdram.c
+++ b/hw/ppc/ppc4xx_sdram.c
@@ -34,7 +34,7 @@
 #include "qapi/error.h"
 #include "qemu/log.h"
 #include "qemu/error-report.h"
-#include "exec/address-spaces.h" /* get_system_memory() */
+#include "system/address-spaces.h" /* get_system_memory() */
 #include "hw/irq.h"
 #include "hw/qdev-properties.h"
 #include "hw/ppc/ppc4xx.h"
diff --git a/hw/ppc/prep_systemio.c b/hw/ppc/prep_systemio.c
index b1f2e130f0..08f29e72e4 100644
--- a/hw/ppc/prep_systemio.c
+++ b/hw/ppc/prep_systemio.c
@@ -28,7 +28,7 @@
 #include "hw/isa/isa.h"
 #include "hw/qdev-properties.h"
 #include "migration/vmstate.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "qom/object.h"
 #include "qemu/error-report.h" /* for error_report() */
 #include "qemu/module.h"
diff --git a/hw/ppc/rs6000_mc.c b/hw/ppc/rs6000_mc.c
index 0e5d53b8b6..27f1c90f06 100644
--- a/hw/ppc/rs6000_mc.c
+++ b/hw/ppc/rs6000_mc.c
@@ -24,7 +24,7 @@
 #include "hw/isa/isa.h"
 #include "hw/qdev-properties.h"
 #include "migration/vmstate.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "qapi/error.h"
 #include "trace.h"
 #include "qom/object.h"
diff --git a/hw/ppc/spapr_ovec.c b/hw/ppc/spapr_ovec.c
index 88e29536aa..6d6eaf67cb 100644
--- a/hw/ppc/spapr_ovec.c
+++ b/hw/ppc/spapr_ovec.c
@@ -15,7 +15,7 @@
 #include "hw/ppc/spapr_ovec.h"
 #include "migration/vmstate.h"
 #include "qemu/bitmap.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "qemu/error-report.h"
 #include "trace.h"
 #include <libfdt.h>
diff --git a/hw/ppc/vof.c b/hw/ppc/vof.c
index 09cb77de93..f14efa3a7c 100644
--- a/hw/ppc/vof.c
+++ b/hw/ppc/vof.c
@@ -15,7 +15,7 @@
 #include "qemu/units.h"
 #include "qemu/log.h"
 #include "qapi/error.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "hw/ppc/vof.h"
 #include "hw/ppc/fdt.h"
 #include "system/runstate.h"
diff --git a/hw/remote/iommu.c b/hw/remote/iommu.c
index ec845d1f58..3e0758a21e 100644
--- a/hw/remote/iommu.c
+++ b/hw/remote/iommu.c
@@ -14,7 +14,7 @@
 #include "hw/pci/pci_bus.h"
 #include "hw/pci/pci.h"
 #include "system/memory.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "trace.h"
 
 /**
diff --git a/hw/riscv/microblaze-v-generic.c b/hw/riscv/microblaze-v-generic.c
index d8e67906d2..e863c50cbc 100644
--- a/hw/riscv/microblaze-v-generic.c
+++ b/hw/riscv/microblaze-v-generic.c
@@ -22,7 +22,7 @@
 #include "net/net.h"
 #include "hw/boards.h"
 #include "hw/char/serial-mm.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "hw/char/xilinx_uartlite.h"
 #include "hw/misc/unimp.h"
 
diff --git a/hw/riscv/opentitan.c b/hw/riscv/opentitan.c
index 98a67fe52a..019d6b3986 100644
--- a/hw/riscv/opentitan.c
+++ b/hw/riscv/opentitan.c
@@ -28,7 +28,7 @@
 #include "hw/riscv/boot.h"
 #include "qemu/units.h"
 #include "system/system.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 
 /*
  * This version of the OpenTitan machine currently supports
diff --git a/hw/riscv/shakti_c.c b/hw/riscv/shakti_c.c
index e2242b97d0..17c5c72102 100644
--- a/hw/riscv/shakti_c.c
+++ b/hw/riscv/shakti_c.c
@@ -25,7 +25,7 @@
 #include "hw/intc/riscv_aclint.h"
 #include "system/system.h"
 #include "hw/qdev-properties.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "hw/riscv/boot.h"
 
 static const struct MemmapEntry {
diff --git a/hw/s390x/css.c b/hw/s390x/css.c
index 17afcbb2cd..53444f6828 100644
--- a/hw/s390x/css.c
+++ b/hw/s390x/css.c
@@ -14,7 +14,7 @@
 #include "qapi/visitor.h"
 #include "qemu/bitops.h"
 #include "qemu/error-report.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "hw/s390x/ioinst.h"
 #include "hw/qdev-properties.h"
 #include "hw/s390x/css.h"
diff --git a/hw/s390x/ipl.h b/hw/s390x/ipl.h
index 8e3882d506..c6ecb3433c 100644
--- a/hw/s390x/ipl.h
+++ b/hw/s390x/ipl.h
@@ -14,7 +14,7 @@
 #define HW_S390_IPL_H
 
 #include "cpu.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "hw/qdev-core.h"
 #include "hw/s390x/ipl/qipl.h"
 #include "qom/object.h"
diff --git a/hw/s390x/s390-skeys.c b/hw/s390x/s390-skeys.c
index 067ea03726..0bb90fed04 100644
--- a/hw/s390x/s390-skeys.c
+++ b/hw/s390x/s390-skeys.c
@@ -20,7 +20,7 @@
 #include "qobject/qdict.h"
 #include "qemu/error-report.h"
 #include "system/memory_mapping.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "system/kvm.h"
 #include "migration/qemu-file-types.h"
 #include "migration/register.h"
diff --git a/hw/s390x/virtio-ccw.c b/hw/s390x/virtio-ccw.c
index 43f3b162c8..e8ecb90826 100644
--- a/hw/s390x/virtio-ccw.c
+++ b/hw/s390x/virtio-ccw.c
@@ -12,7 +12,7 @@
 
 #include "qemu/osdep.h"
 #include "qapi/error.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "system/kvm.h"
 #include "net/net.h"
 #include "hw/virtio/virtio.h"
diff --git a/hw/sparc/sun4m_iommu.c b/hw/sparc/sun4m_iommu.c
index 5a4c1f5e3b..4a542b18d2 100644
--- a/hw/sparc/sun4m_iommu.c
+++ b/hw/sparc/sun4m_iommu.c
@@ -29,7 +29,7 @@
 #include "hw/sysbus.h"
 #include "migration/vmstate.h"
 #include "qemu/module.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "trace.h"
 
 /*
diff --git a/hw/sparc64/sun4u_iommu.c b/hw/sparc64/sun4u_iommu.c
index eba811af0c..533fcae1fb 100644
--- a/hw/sparc64/sun4u_iommu.c
+++ b/hw/sparc64/sun4u_iommu.c
@@ -27,7 +27,7 @@
 #include "qemu/osdep.h"
 #include "hw/sysbus.h"
 #include "hw/sparc/sun4u_iommu.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "qemu/log.h"
 #include "qemu/module.h"
 #include "trace.h"
diff --git a/hw/timer/hpet.c b/hw/timer/hpet.c
index ccb97b6806..ea82472105 100644
--- a/hw/timer/hpet.c
+++ b/hw/timer/hpet.c
@@ -36,7 +36,7 @@
 #include "hw/rtc/mc146818rtc_regs.h"
 #include "migration/vmstate.h"
 #include "hw/timer/i8254.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "qom/object.h"
 #include "trace.h"
 
diff --git a/hw/tpm/tpm_crb.c b/hw/tpm/tpm_crb.c
index 6cdeb72df0..b668aee97a 100644
--- a/hw/tpm/tpm_crb.c
+++ b/hw/tpm/tpm_crb.c
@@ -18,7 +18,7 @@
 
 #include "qemu/module.h"
 #include "qapi/error.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "hw/qdev-properties.h"
 #include "hw/pci/pci_ids.h"
 #include "hw/acpi/tpm.h"
diff --git a/hw/vfio/ap.c b/hw/vfio/ap.c
index c7ab4ff57a..d6575d7c44 100644
--- a/hw/vfio/ap.c
+++ b/hw/vfio/ap.c
@@ -28,7 +28,7 @@
 #include "migration/vmstate.h"
 #include "hw/qdev-properties.h"
 #include "hw/s390x/ap-bridge.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "qom/object.h"
 
 #define TYPE_VFIO_AP_DEVICE      "vfio-ap"
diff --git a/hw/vfio/ccw.c b/hw/vfio/ccw.c
index e5e0d9e3e7..29e804e122 100644
--- a/hw/vfio/ccw.c
+++ b/hw/vfio/ccw.c
@@ -27,7 +27,7 @@
 #include "hw/s390x/vfio-ccw.h"
 #include "hw/qdev-properties.h"
 #include "hw/s390x/ccw-device.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "qemu/error-report.h"
 #include "qemu/main-loop.h"
 #include "qemu/module.h"
diff --git a/hw/vfio/common.c b/hw/vfio/common.c
index 989c6ee83d..98832af88d 100644
--- a/hw/vfio/common.c
+++ b/hw/vfio/common.c
@@ -27,7 +27,7 @@
 
 #include "hw/vfio/vfio-common.h"
 #include "hw/vfio/pci.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "system/memory.h"
 #include "exec/ram_addr.h"
 #include "exec/target_page.h"
diff --git a/hw/vfio/container.c b/hw/vfio/container.c
index 1d1c5f9a77..2e993c7e73 100644
--- a/hw/vfio/container.c
+++ b/hw/vfio/container.c
@@ -23,7 +23,7 @@
 #include <linux/vfio.h>
 
 #include "hw/vfio/vfio-common.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "system/memory.h"
 #include "exec/ram_addr.h"
 #include "qemu/error-report.h"
diff --git a/hw/vfio/platform.c b/hw/vfio/platform.c
index 96c6bf5654..c6edbdd4ae 100644
--- a/hw/vfio/platform.c
+++ b/hw/vfio/platform.c
@@ -29,7 +29,7 @@
 #include "qemu/module.h"
 #include "qemu/range.h"
 #include "system/memory.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "qemu/queue.h"
 #include "hw/sysbus.h"
 #include "trace.h"
diff --git a/hw/vfio/spapr.c b/hw/vfio/spapr.c
index 1a5d1611f2..c9a7dd8d68 100644
--- a/hw/vfio/spapr.c
+++ b/hw/vfio/spapr.c
@@ -13,7 +13,7 @@
 #include <linux/vfio.h>
 #include "system/kvm.h"
 #include "system/hostmem.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 
 #include "hw/vfio/vfio-common.h"
 #include "hw/hw.h"
diff --git a/hw/virtio/vhost-vdpa.c b/hw/virtio/vhost-vdpa.c
index 7efbde3d4c..1e0336df1d 100644
--- a/hw/virtio/vhost-vdpa.c
+++ b/hw/virtio/vhost-vdpa.c
@@ -20,7 +20,7 @@
 #include "hw/virtio/virtio-net.h"
 #include "hw/virtio/vhost-shadow-virtqueue.h"
 #include "hw/virtio/vhost-vdpa.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "migration/blocker.h"
 #include "qemu/cutils.h"
 #include "qemu/main-loop.h"
diff --git a/hw/virtio/virtio-balloon.c b/hw/virtio/virtio-balloon.c
index 2eb5a14fa2..0d0603c674 100644
--- a/hw/virtio/virtio-balloon.c
+++ b/hw/virtio/virtio-balloon.c
@@ -24,7 +24,7 @@
 #include "hw/boards.h"
 #include "system/balloon.h"
 #include "hw/virtio/virtio-balloon.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "qapi/error.h"
 #include "qapi/qapi-events-machine.h"
 #include "qapi/visitor.h"
diff --git a/hw/virtio/virtio-bus.c b/hw/virtio/virtio-bus.c
index 896feb37a1..d1c79c567b 100644
--- a/hw/virtio/virtio-bus.c
+++ b/hw/virtio/virtio-bus.c
@@ -28,7 +28,7 @@
 #include "qapi/error.h"
 #include "hw/virtio/virtio-bus.h"
 #include "hw/virtio/virtio.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 
 /* #define DEBUG_VIRTIO_BUS */
 
diff --git a/include/hw/misc/lasi.h b/include/hw/misc/lasi.h
index f01c0f680a..0bdfb11b50 100644
--- a/include/hw/misc/lasi.h
+++ b/include/hw/misc/lasi.h
@@ -12,7 +12,7 @@
 #ifndef LASI_H
 #define LASI_H
 
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "hw/pci/pci_host.h"
 #include "hw/boards.h"
 
diff --git a/include/hw/nubus/nubus.h b/include/hw/nubus/nubus.h
index fee79b71d1..7825840dca 100644
--- a/include/hw/nubus/nubus.h
+++ b/include/hw/nubus/nubus.h
@@ -11,7 +11,7 @@
 
 #include "hw/qdev-properties.h"
 #include "hw/sysbus.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "qom/object.h"
 #include "qemu/units.h"
 
diff --git a/include/hw/ppc/vof.h b/include/hw/ppc/vof.h
index 2918aaab12..3a0fbffe54 100644
--- a/include/hw/ppc/vof.h
+++ b/include/hw/ppc/vof.h
@@ -7,7 +7,7 @@
 #define HW_VOF_H
 
 #include "qom/object.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "system/memory.h"
 #include "exec/cpu-defs.h"
 
diff --git a/include/hw/tricore/triboard.h b/include/hw/tricore/triboard.h
index 8250470643..ca49a0c752 100644
--- a/include/hw/tricore/triboard.h
+++ b/include/hw/tricore/triboard.h
@@ -21,7 +21,7 @@
 #include "qapi/error.h"
 #include "hw/boards.h"
 #include "system/system.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "qom/object.h"
 
 #include "hw/tricore/tc27x_soc.h"
diff --git a/include/exec/address-spaces.h b/include/system/address-spaces.h
similarity index 89%
rename from include/exec/address-spaces.h
rename to include/system/address-spaces.h
index 0d0aa61d68..72d17afb0f 100644
--- a/include/exec/address-spaces.h
+++ b/include/system/address-spaces.h
@@ -11,16 +11,14 @@
  *
  */
 
-#ifndef EXEC_ADDRESS_SPACES_H
-#define EXEC_ADDRESS_SPACES_H
+#ifndef SYSTEM_ADDRESS_SPACES_H
+#define SYSTEM_ADDRESS_SPACES_H
 
 /*
  * Internal interfaces between memory.c/exec.c/vl.c.  Do not #include unless
  * you're one of them.
  */
 
-#ifndef CONFIG_USER_ONLY
-
 /* Get the root memory region.  This interface should only be used temporarily
  * until a proper bus interface is available.
  */
@@ -35,5 +33,3 @@ extern AddressSpace address_space_memory;
 extern AddressSpace address_space_io;
 
 #endif
-
-#endif
diff --git a/include/system/dma.h b/include/system/dma.h
index aaa03b9711..82e7ad5437 100644
--- a/include/system/dma.h
+++ b/include/system/dma.h
@@ -11,7 +11,7 @@
 #define DMA_H
 
 #include "system/memory.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "block/block.h"
 #include "block/accounting.h"
 
diff --git a/monitor/hmp-cmds-target.c b/monitor/hmp-cmds-target.c
index 6654d31406..011a367357 100644
--- a/monitor/hmp-cmds-target.c
+++ b/monitor/hmp-cmds-target.c
@@ -24,7 +24,7 @@
 
 #include "qemu/osdep.h"
 #include "disas/disas.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "system/memory.h"
 #include "monitor/hmp-target.h"
 #include "monitor/monitor-internal.h"
diff --git a/monitor/hmp-cmds.c b/monitor/hmp-cmds.c
index 7ded3378cf..8ddcdd76c1 100644
--- a/monitor/hmp-cmds.c
+++ b/monitor/hmp-cmds.c
@@ -14,7 +14,7 @@
  */
 
 #include "qemu/osdep.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "exec/ioport.h"
 #include "exec/gdbstub.h"
 #include "gdbstub/enums.h"
diff --git a/rust/wrapper.h b/rust/wrapper.h
index 94866b7e32..beddd9aab2 100644
--- a/rust/wrapper.h
+++ b/rust/wrapper.h
@@ -64,5 +64,5 @@ typedef enum memory_order {
 #include "chardev/char-serial.h"
 #include "exec/memattrs.h"
 #include "qemu/timer.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "hw/char/pl011.h"
diff --git a/system/ioport.c b/system/ioport.c
index 2291739039..5300716464 100644
--- a/system/ioport.c
+++ b/system/ioport.c
@@ -28,7 +28,7 @@
 #include "qemu/osdep.h"
 #include "exec/ioport.h"
 #include "system/memory.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "trace.h"
 
 struct MemoryRegionPortioList {
diff --git a/system/memory.c b/system/memory.c
index 2865d0deb1..a4185ea353 100644
--- a/system/memory.c
+++ b/system/memory.c
@@ -33,7 +33,7 @@
 #include "qemu/accel.h"
 #include "hw/boards.h"
 #include "migration/vmstate.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 
 //#define DEBUG_UNASSIGNED
 
diff --git a/system/memory_mapping.c b/system/memory_mapping.c
index 8538a8241e..da708a08ab 100644
--- a/system/memory_mapping.c
+++ b/system/memory_mapping.c
@@ -17,7 +17,7 @@
 
 #include "system/memory_mapping.h"
 #include "system/memory.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "hw/core/cpu.h"
 
 //#define DEBUG_GUEST_PHYS_REGION_ADD
diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index 2439af63a0..93a3f9b53d 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -22,7 +22,7 @@
 
 #include <mach/mach_time.h>
 
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "hw/boards.h"
 #include "hw/irq.h"
 #include "qemu/main-loop.h"
diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index da30bdbb23..97de8c7e93 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -30,7 +30,7 @@
 #include "internals.h"
 #include "hw/pci/pci.h"
 #include "exec/memattrs.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "gdbstub/enums.h"
 #include "hw/boards.h"
 #include "hw/irq.h"
diff --git a/target/avr/cpu.c b/target/avr/cpu.c
index 0b14b36c17..1121822470 100644
--- a/target/avr/cpu.c
+++ b/target/avr/cpu.c
@@ -23,7 +23,7 @@
 #include "qemu/qemu-print.h"
 #include "exec/exec-all.h"
 #include "exec/translation-block.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "cpu.h"
 #include "disas/dis-asm.h"
 #include "tcg/debug-assert.h"
diff --git a/target/i386/cpu-apic.c b/target/i386/cpu-apic.c
index c1708b04bb..242a05fdbe 100644
--- a/target/i386/cpu-apic.c
+++ b/target/i386/cpu-apic.c
@@ -14,7 +14,7 @@
 #include "system/hw_accel.h"
 #include "system/kvm.h"
 #include "system/xen.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "hw/qdev-properties.h"
 #include "hw/i386/apic_internal.h"
 #include "cpu-internal.h"
diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 3fb1ec62da..5c9f80b4cc 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -38,7 +38,7 @@
 #ifndef CONFIG_USER_ONLY
 #include "system/reset.h"
 #include "qapi/qapi-commands-machine-target.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "hw/boards.h"
 #include "hw/i386/sgx-epc.h"
 #endif
diff --git a/target/i386/hvf/vmx.h b/target/i386/hvf/vmx.h
index 3c56afc9d3..029516e5c0 100644
--- a/target/i386/hvf/vmx.h
+++ b/target/i386/hvf/vmx.h
@@ -33,7 +33,7 @@
 #include "system/hvf.h"
 #include "system/hvf_int.h"
 
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 
 static inline uint64_t rreg(hv_vcpuid_t vcpu, hv_x86_reg_t reg)
 {
diff --git a/target/i386/kvm/xen-emu.c b/target/i386/kvm/xen-emu.c
index e81a245881..b23010374f 100644
--- a/target/i386/kvm/xen-emu.c
+++ b/target/i386/kvm/xen-emu.c
@@ -17,7 +17,7 @@
 #include "system/kvm_int.h"
 #include "system/kvm_xen.h"
 #include "kvm/kvm_i386.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "xen-emu.h"
 #include "trace.h"
 #include "system/runstate.h"
diff --git a/target/i386/nvmm/nvmm-all.c b/target/i386/nvmm/nvmm-all.c
index 04e5f7e637..91f0e32366 100644
--- a/target/i386/nvmm/nvmm-all.c
+++ b/target/i386/nvmm/nvmm-all.c
@@ -9,7 +9,7 @@
 
 #include "qemu/osdep.h"
 #include "cpu.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "exec/ioport.h"
 #include "qemu/accel.h"
 #include "system/nvmm.h"
diff --git a/target/i386/sev.c b/target/i386/sev.c
index 0e1dbb6959..ba88976e9f 100644
--- a/target/i386/sev.c
+++ b/target/i386/sev.c
@@ -39,7 +39,7 @@
 #include "qapi/qapi-commands-misc-target.h"
 #include "confidential-guest.h"
 #include "hw/i386/pc.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "qemu/queue.h"
 
 OBJECT_DECLARE_TYPE(SevCommonState, SevCommonStateClass, SEV_COMMON)
diff --git a/target/i386/tcg/system/misc_helper.c b/target/i386/tcg/system/misc_helper.c
index ce18c75b9f..0555cf2604 100644
--- a/target/i386/tcg/system/misc_helper.c
+++ b/target/i386/tcg/system/misc_helper.c
@@ -22,7 +22,7 @@
 #include "cpu.h"
 #include "exec/helper-proto.h"
 #include "exec/cpu_ldst.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "exec/cputlb.h"
 #include "tcg/helper-tcg.h"
 #include "hw/i386/apic.h"
diff --git a/target/i386/tcg/system/tcg-cpu.c b/target/i386/tcg/system/tcg-cpu.c
index 13a3507863..ab1f3c7c59 100644
--- a/target/i386/tcg/system/tcg-cpu.c
+++ b/target/i386/tcg/system/tcg-cpu.c
@@ -23,7 +23,7 @@
 
 #include "system/system.h"
 #include "qemu/units.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 
 #include "tcg/tcg-cpu.h"
 
diff --git a/target/i386/whpx/whpx-all.c b/target/i386/whpx/whpx-all.c
index 41fb8c5a4e..d58cb11cee 100644
--- a/target/i386/whpx/whpx-all.c
+++ b/target/i386/whpx/whpx-all.c
@@ -10,7 +10,7 @@
 
 #include "qemu/osdep.h"
 #include "cpu.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "exec/ioport.h"
 #include "gdbstub/helpers.h"
 #include "qemu/accel.h"
diff --git a/target/loongarch/kvm/kvm.c b/target/loongarch/kvm/kvm.c
index f0e3cfef03..1bda570482 100644
--- a/target/loongarch/kvm/kvm.c
+++ b/target/loongarch/kvm/kvm.c
@@ -18,7 +18,7 @@
 #include "system/kvm_int.h"
 #include "hw/pci/pci.h"
 #include "exec/memattrs.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "hw/boards.h"
 #include "hw/irq.h"
 #include "hw/loongarch/virt.h"
diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
index 0f4997a918..5315134e08 100644
--- a/target/riscv/kvm/kvm-cpu.c
+++ b/target/riscv/kvm/kvm-cpu.c
@@ -35,7 +35,7 @@
 #include "accel/accel-cpu-target.h"
 #include "hw/pci/pci.h"
 #include "exec/memattrs.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "hw/boards.h"
 #include "hw/irq.h"
 #include "hw/intc/riscv_imsic.h"
diff --git a/target/s390x/mmu_helper.c b/target/s390x/mmu_helper.c
index d8f483898d..b079d120db 100644
--- a/target/s390x/mmu_helper.c
+++ b/target/s390x/mmu_helper.c
@@ -17,7 +17,7 @@
 
 #include "qemu/osdep.h"
 #include "qemu/error-report.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "cpu.h"
 #include "s390x-internal.h"
 #include "kvm/kvm_s390x.h"
diff --git a/target/s390x/sigp.c b/target/s390x/sigp.c
index 6a4d9c5081..a3347f1236 100644
--- a/target/s390x/sigp.c
+++ b/target/s390x/sigp.c
@@ -14,7 +14,7 @@
 #include "hw/boards.h"
 #include "system/hw_accel.h"
 #include "system/runstate.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "exec/cputlb.h"
 #include "exec/exec-all.h"
 #include "system/tcg.h"
diff --git a/target/s390x/tcg/excp_helper.c b/target/s390x/tcg/excp_helper.c
index f969850f87..ac733f407f 100644
--- a/target/s390x/tcg/excp_helper.c
+++ b/target/s390x/tcg/excp_helper.c
@@ -28,7 +28,7 @@
 #include "tcg_s390x.h"
 #ifndef CONFIG_USER_ONLY
 #include "qemu/timer.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 #include "hw/s390x/ioinst.h"
 #include "hw/s390x/s390_flic.h"
 #include "hw/boards.h"
diff --git a/target/xtensa/dbg_helper.c b/target/xtensa/dbg_helper.c
index 5546c82ecd..163a1ffc7b 100644
--- a/target/xtensa/dbg_helper.c
+++ b/target/xtensa/dbg_helper.c
@@ -31,7 +31,7 @@
 #include "exec/helper-proto.h"
 #include "qemu/host-utils.h"
 #include "exec/exec-all.h"
-#include "exec/address-spaces.h"
+#include "system/address-spaces.h"
 
 void HELPER(wsr_ibreakenable)(CPUXtensaState *env, uint32_t v)
 {

From 91a853837da22e35d140471058e5d73dbfa87707 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 12 Mar 2025 12:49:38 -0700
Subject: [PATCH 0115/2760] include/system: Move exec/ioport.h to
 system/ioport.h
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Convert the existing includes with sed.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 MAINTAINERS                       | 2 +-
 hw/block/fdc-isa.c                | 2 +-
 hw/display/vga_int.h              | 2 +-
 include/hw/char/parallel-isa.h    | 2 +-
 include/hw/dma/i8257.h            | 2 +-
 include/hw/ide/ide-bus.h          | 2 +-
 include/hw/isa/isa.h              | 2 +-
 include/{exec => system}/ioport.h | 6 ++----
 monitor/hmp-cmds.c                | 2 +-
 system/ioport.c                   | 2 +-
 system/physmem.c                  | 2 +-
 system/qtest.c                    | 2 +-
 target/i386/nvmm/nvmm-all.c       | 2 +-
 target/i386/whpx/whpx-all.c       | 2 +-
 tests/qtest/fuzz/qtest_wrappers.c | 2 +-
 15 files changed, 16 insertions(+), 18 deletions(-)
 rename include/{exec => system}/ioport.h (97%)

diff --git a/MAINTAINERS b/MAINTAINERS
index 5d391cfaa7..9a96cc1b5e 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3118,7 +3118,7 @@ M: Peter Xu <peterx@redhat.com>
 M: David Hildenbrand <david@redhat.com>
 R: Philippe Mathieu-Daudé <philmd@linaro.org>
 S: Supported
-F: include/exec/ioport.h
+F: include/system/ioport.h
 F: include/exec/memop.h
 F: include/system/memory.h
 F: include/exec/ram_addr.h
diff --git a/hw/block/fdc-isa.c b/hw/block/fdc-isa.c
index a10c24aab1..561cfa47c1 100644
--- a/hw/block/fdc-isa.c
+++ b/hw/block/fdc-isa.c
@@ -42,7 +42,7 @@
 #include "system/block-backend.h"
 #include "system/blockdev.h"
 #include "system/system.h"
-#include "exec/ioport.h"
+#include "system/ioport.h"
 #include "qemu/log.h"
 #include "qemu/main-loop.h"
 #include "qemu/module.h"
diff --git a/hw/display/vga_int.h b/hw/display/vga_int.h
index 60ad26e03e..747b5cc6cf 100644
--- a/hw/display/vga_int.h
+++ b/hw/display/vga_int.h
@@ -26,7 +26,7 @@
 #define HW_VGA_INT_H
 
 #include "ui/console.h"
-#include "exec/ioport.h"
+#include "system/ioport.h"
 #include "system/memory.h"
 
 #include "hw/display/bochs-vbe.h"
diff --git a/include/hw/char/parallel-isa.h b/include/hw/char/parallel-isa.h
index 5284b2ffec..3edaf9dbe4 100644
--- a/include/hw/char/parallel-isa.h
+++ b/include/hw/char/parallel-isa.h
@@ -12,7 +12,7 @@
 
 #include "parallel.h"
 
-#include "exec/ioport.h"
+#include "system/ioport.h"
 #include "hw/isa/isa.h"
 #include "qom/object.h"
 
diff --git a/include/hw/dma/i8257.h b/include/hw/dma/i8257.h
index 4342e4a91e..33b6286d5a 100644
--- a/include/hw/dma/i8257.h
+++ b/include/hw/dma/i8257.h
@@ -2,7 +2,7 @@
 #define HW_I8257_H
 
 #include "hw/isa/isa.h"
-#include "exec/ioport.h"
+#include "system/ioport.h"
 #include "qom/object.h"
 
 #define TYPE_I8257 "i8257"
diff --git a/include/hw/ide/ide-bus.h b/include/hw/ide/ide-bus.h
index 4841a7dcd6..121b455fcd 100644
--- a/include/hw/ide/ide-bus.h
+++ b/include/hw/ide/ide-bus.h
@@ -1,7 +1,7 @@
 #ifndef HW_IDE_BUS_H
 #define HW_IDE_BUS_H
 
-#include "exec/ioport.h"
+#include "system/ioport.h"
 #include "hw/ide/ide-dev.h"
 #include "hw/ide/ide-dma.h"
 
diff --git a/include/hw/isa/isa.h b/include/hw/isa/isa.h
index 1d852011b3..a82c5f1004 100644
--- a/include/hw/isa/isa.h
+++ b/include/hw/isa/isa.h
@@ -4,7 +4,7 @@
 /* ISA bus */
 
 #include "system/memory.h"
-#include "exec/ioport.h"
+#include "system/ioport.h"
 #include "hw/qdev-core.h"
 #include "qom/object.h"
 
diff --git a/include/exec/ioport.h b/include/system/ioport.h
similarity index 97%
rename from include/exec/ioport.h
rename to include/system/ioport.h
index ecea3575bc..780ea5a676 100644
--- a/include/exec/ioport.h
+++ b/include/system/ioport.h
@@ -21,8 +21,8 @@
  * IO ports API
  */
 
-#ifndef IOPORT_H
-#define IOPORT_H
+#ifndef SYSTEM_IOPORT_H
+#define SYSTEM_IOPORT_H
 
 #include "system/memory.h"
 
@@ -39,9 +39,7 @@ typedef struct MemoryRegionPortio {
 
 #define PORTIO_END_OF_LIST() { }
 
-#ifndef CONFIG_USER_ONLY
 extern const MemoryRegionOps unassigned_io_ops;
-#endif
 
 void cpu_outb(uint32_t addr, uint8_t val);
 void cpu_outw(uint32_t addr, uint16_t val);
diff --git a/monitor/hmp-cmds.c b/monitor/hmp-cmds.c
index 8ddcdd76c1..74a0f56566 100644
--- a/monitor/hmp-cmds.c
+++ b/monitor/hmp-cmds.c
@@ -15,7 +15,7 @@
 
 #include "qemu/osdep.h"
 #include "system/address-spaces.h"
-#include "exec/ioport.h"
+#include "system/ioport.h"
 #include "exec/gdbstub.h"
 #include "gdbstub/enums.h"
 #include "monitor/hmp.h"
diff --git a/system/ioport.c b/system/ioport.c
index 5300716464..4f96e9119f 100644
--- a/system/ioport.c
+++ b/system/ioport.c
@@ -26,7 +26,7 @@
  */
 
 #include "qemu/osdep.h"
-#include "exec/ioport.h"
+#include "system/ioport.h"
 #include "system/memory.h"
 #include "system/address-spaces.h"
 #include "trace.h"
diff --git a/system/physmem.c b/system/physmem.c
index e61fea41b5..234e489199 100644
--- a/system/physmem.c
+++ b/system/physmem.c
@@ -51,7 +51,7 @@
 #include "qemu/memalign.h"
 #include "qemu/memfd.h"
 #include "system/memory.h"
-#include "exec/ioport.h"
+#include "system/ioport.h"
 #include "system/dma.h"
 #include "system/hostmem.h"
 #include "system/hw_accel.h"
diff --git a/system/qtest.c b/system/qtest.c
index 5407289154..523a047995 100644
--- a/system/qtest.c
+++ b/system/qtest.c
@@ -16,7 +16,7 @@
 #include "system/qtest.h"
 #include "system/runstate.h"
 #include "chardev/char-fe.h"
-#include "exec/ioport.h"
+#include "system/ioport.h"
 #include "system/memory.h"
 #include "exec/tswap.h"
 #include "hw/qdev-core.h"
diff --git a/target/i386/nvmm/nvmm-all.c b/target/i386/nvmm/nvmm-all.c
index 91f0e32366..17394d073d 100644
--- a/target/i386/nvmm/nvmm-all.c
+++ b/target/i386/nvmm/nvmm-all.c
@@ -10,7 +10,7 @@
 #include "qemu/osdep.h"
 #include "cpu.h"
 #include "system/address-spaces.h"
-#include "exec/ioport.h"
+#include "system/ioport.h"
 #include "qemu/accel.h"
 #include "system/nvmm.h"
 #include "system/cpus.h"
diff --git a/target/i386/whpx/whpx-all.c b/target/i386/whpx/whpx-all.c
index d58cb11cee..b64852e13e 100644
--- a/target/i386/whpx/whpx-all.c
+++ b/target/i386/whpx/whpx-all.c
@@ -11,7 +11,7 @@
 #include "qemu/osdep.h"
 #include "cpu.h"
 #include "system/address-spaces.h"
-#include "exec/ioport.h"
+#include "system/ioport.h"
 #include "gdbstub/helpers.h"
 #include "qemu/accel.h"
 #include "system/whpx.h"
diff --git a/tests/qtest/fuzz/qtest_wrappers.c b/tests/qtest/fuzz/qtest_wrappers.c
index 0580f8df86..d7adcbe3fd 100644
--- a/tests/qtest/fuzz/qtest_wrappers.c
+++ b/tests/qtest/fuzz/qtest_wrappers.c
@@ -13,7 +13,7 @@
 
 #include "qemu/osdep.h"
 #include "hw/core/cpu.h"
-#include "exec/ioport.h"
+#include "system/ioport.h"
 
 #include "fuzz.h"
 

From 4705a71db5909ac5586e87397b2dece132b9e330 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 12 Mar 2025 17:42:03 -0700
Subject: [PATCH 0116/2760] include/system: Move exec/ram_addr.h to
 system/ram_addr.h
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Convert the existing includes with sed.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 MAINTAINERS                         | 2 +-
 accel/kvm/kvm-all.c                 | 2 +-
 accel/tcg/cputlb.c                  | 2 +-
 accel/tcg/translate-all.c           | 2 +-
 hw/ppc/spapr.c                      | 2 +-
 hw/ppc/spapr_caps.c                 | 2 +-
 hw/ppc/spapr_pci.c                  | 2 +-
 hw/remote/memory.c                  | 2 +-
 hw/remote/proxy-memory-listener.c   | 2 +-
 hw/s390x/s390-stattrib-kvm.c        | 2 +-
 hw/s390x/s390-stattrib.c            | 2 +-
 hw/s390x/s390-virtio-ccw.c          | 2 +-
 hw/vfio/common.c                    | 3 +--
 hw/vfio/container.c                 | 2 +-
 hw/vfio/spapr.c                     | 2 +-
 hw/virtio/virtio-mem.c              | 2 +-
 include/{exec => system}/ram_addr.h | 7 +++----
 migration/ram.c                     | 2 +-
 system/memory.c                     | 2 +-
 system/physmem.c                    | 2 +-
 target/arm/tcg/mte_helper.c         | 2 +-
 target/ppc/kvm.c                    | 2 +-
 target/s390x/kvm/kvm.c              | 2 +-
 23 files changed, 25 insertions(+), 27 deletions(-)
 rename include/{exec => system}/ram_addr.h (99%)

diff --git a/MAINTAINERS b/MAINTAINERS
index 9a96cc1b5e..b1ac3ff7d2 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3121,7 +3121,7 @@ S: Supported
 F: include/system/ioport.h
 F: include/exec/memop.h
 F: include/system/memory.h
-F: include/exec/ram_addr.h
+F: include/system/ram_addr.h
 F: include/exec/ramblock.h
 F: include/system/memory_mapping.h
 F: system/dma-helpers.c
diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index 9e06a95f75..a30b19f455 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -34,7 +34,7 @@
 #include "system/accel-blocker.h"
 #include "qemu/bswap.h"
 #include "system/memory.h"
-#include "exec/ram_addr.h"
+#include "system/ram_addr.h"
 #include "qemu/event_notifier.h"
 #include "qemu/main-loop.h"
 #include "trace.h"
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index 6f0ea9067b..134e523cab 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -27,7 +27,7 @@
 #include "exec/cputlb.h"
 #include "exec/tb-flush.h"
 #include "exec/memory-internal.h"
-#include "exec/ram_addr.h"
+#include "system/ram_addr.h"
 #include "exec/mmu-access-type.h"
 #include "exec/tlb-common.h"
 #include "exec/vaddr.h"
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index 16e5043597..167535bcb1 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -40,7 +40,7 @@
 #endif
 #endif
 #else
-#include "exec/ram_addr.h"
+#include "system/ram_addr.h"
 #endif
 
 #include "exec/cputlb.h"
diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index 6fef1d167a..c1a7ac3536 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -77,7 +77,7 @@
 #include "hw/virtio/virtio-scsi.h"
 #include "hw/virtio/vhost-scsi-common.h"
 
-#include "exec/ram_addr.h"
+#include "system/ram_addr.h"
 #include "system/confidential-guest-support.h"
 #include "hw/usb.h"
 #include "qemu/config-file.h"
diff --git a/hw/ppc/spapr_caps.c b/hw/ppc/spapr_caps.c
index 815c94ed2f..f2f5722d8a 100644
--- a/hw/ppc/spapr_caps.c
+++ b/hw/ppc/spapr_caps.c
@@ -27,7 +27,7 @@
 #include "qapi/error.h"
 #include "qapi/visitor.h"
 #include "system/hw_accel.h"
-#include "exec/ram_addr.h"
+#include "system/ram_addr.h"
 #include "target/ppc/cpu.h"
 #include "target/ppc/mmu-hash64.h"
 #include "cpu-models.h"
diff --git a/hw/ppc/spapr_pci.c b/hw/ppc/spapr_pci.c
index e0a9d50edc..384269b831 100644
--- a/hw/ppc/spapr_pci.c
+++ b/hw/ppc/spapr_pci.c
@@ -34,7 +34,7 @@
 #include "hw/pci/pci_host.h"
 #include "hw/ppc/spapr.h"
 #include "hw/pci-host/spapr.h"
-#include "exec/ram_addr.h"
+#include "system/ram_addr.h"
 #include <libfdt.h>
 #include "trace.h"
 #include "qemu/error-report.h"
diff --git a/hw/remote/memory.c b/hw/remote/memory.c
index 6d60da91e0..00193a552f 100644
--- a/hw/remote/memory.c
+++ b/hw/remote/memory.c
@@ -11,7 +11,7 @@
 #include "qemu/osdep.h"
 
 #include "hw/remote/memory.h"
-#include "exec/ram_addr.h"
+#include "system/ram_addr.h"
 #include "qapi/error.h"
 
 static void remote_sysmem_reset(void)
diff --git a/hw/remote/proxy-memory-listener.c b/hw/remote/proxy-memory-listener.c
index ce7f5b9bfb..30ac74961d 100644
--- a/hw/remote/proxy-memory-listener.c
+++ b/hw/remote/proxy-memory-listener.c
@@ -12,7 +12,7 @@
 #include "qemu/range.h"
 #include "system/memory.h"
 #include "exec/cpu-common.h"
-#include "exec/ram_addr.h"
+#include "system/ram_addr.h"
 #include "qapi/error.h"
 #include "qemu/error-report.h"
 #include "hw/remote/mpqemu-link.h"
diff --git a/hw/s390x/s390-stattrib-kvm.c b/hw/s390x/s390-stattrib-kvm.c
index d0ff04364d..ebcd56368f 100644
--- a/hw/s390x/s390-stattrib-kvm.c
+++ b/hw/s390x/s390-stattrib-kvm.c
@@ -16,7 +16,7 @@
 #include "qemu/error-report.h"
 #include "system/kvm.h"
 #include "system/memory_mapping.h"
-#include "exec/ram_addr.h"
+#include "system/ram_addr.h"
 #include "kvm/kvm_s390x.h"
 #include "qapi/error.h"
 
diff --git a/hw/s390x/s390-stattrib.c b/hw/s390x/s390-stattrib.c
index 35bf697ef0..a86002be6a 100644
--- a/hw/s390x/s390-stattrib.c
+++ b/hw/s390x/s390-stattrib.c
@@ -16,7 +16,7 @@
 #include "hw/qdev-properties.h"
 #include "hw/s390x/storage-attributes.h"
 #include "qemu/error-report.h"
-#include "exec/ram_addr.h"
+#include "system/ram_addr.h"
 #include "qapi/error.h"
 #include "qobject/qdict.h"
 #include "cpu.h"
diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
index 5af3c4f547..52c273b3de 100644
--- a/hw/s390x/s390-virtio-ccw.c
+++ b/hw/s390x/s390-virtio-ccw.c
@@ -13,7 +13,7 @@
 
 #include "qemu/osdep.h"
 #include "qapi/error.h"
-#include "exec/ram_addr.h"
+#include "system/ram_addr.h"
 #include "system/confidential-guest-support.h"
 #include "hw/boards.h"
 #include "hw/s390x/sclp.h"
diff --git a/hw/vfio/common.c b/hw/vfio/common.c
index 98832af88d..bae0633c3d 100644
--- a/hw/vfio/common.c
+++ b/hw/vfio/common.c
@@ -29,8 +29,7 @@
 #include "hw/vfio/pci.h"
 #include "system/address-spaces.h"
 #include "system/memory.h"
-#include "exec/ram_addr.h"
-#include "exec/target_page.h"
+#include "system/ram_addr.h"
 #include "hw/hw.h"
 #include "qemu/error-report.h"
 #include "qemu/main-loop.h"
diff --git a/hw/vfio/container.c b/hw/vfio/container.c
index 2e993c7e73..812d5edbcf 100644
--- a/hw/vfio/container.c
+++ b/hw/vfio/container.c
@@ -25,7 +25,7 @@
 #include "hw/vfio/vfio-common.h"
 #include "system/address-spaces.h"
 #include "system/memory.h"
-#include "exec/ram_addr.h"
+#include "system/ram_addr.h"
 #include "qemu/error-report.h"
 #include "qemu/range.h"
 #include "system/reset.h"
diff --git a/hw/vfio/spapr.c b/hw/vfio/spapr.c
index c9a7dd8d68..66a2d2bb0d 100644
--- a/hw/vfio/spapr.c
+++ b/hw/vfio/spapr.c
@@ -17,7 +17,7 @@
 
 #include "hw/vfio/vfio-common.h"
 #include "hw/hw.h"
-#include "exec/ram_addr.h"
+#include "system/ram_addr.h"
 #include "qemu/error-report.h"
 #include "qapi/error.h"
 #include "trace.h"
diff --git a/hw/virtio/virtio-mem.c b/hw/virtio/virtio-mem.c
index 5f57eccbb6..c7968ee0c6 100644
--- a/hw/virtio/virtio-mem.c
+++ b/hw/virtio/virtio-mem.c
@@ -24,7 +24,7 @@
 #include "hw/virtio/virtio-mem.h"
 #include "qapi/error.h"
 #include "qapi/visitor.h"
-#include "exec/ram_addr.h"
+#include "system/ram_addr.h"
 #include "migration/misc.h"
 #include "hw/boards.h"
 #include "hw/qdev-properties.h"
diff --git a/include/exec/ram_addr.h b/include/system/ram_addr.h
similarity index 99%
rename from include/exec/ram_addr.h
rename to include/system/ram_addr.h
index 8677761af5..3b81c3091f 100644
--- a/include/exec/ram_addr.h
+++ b/include/system/ram_addr.h
@@ -16,10 +16,9 @@
  * The functions declared here will be removed soon.
  */
 
-#ifndef RAM_ADDR_H
-#define RAM_ADDR_H
+#ifndef SYSTEM_RAM_ADDR_H
+#define SYSTEM_RAM_ADDR_H
 
-#ifndef CONFIG_USER_ONLY
 #include "system/xen.h"
 #include "system/tcg.h"
 #include "exec/cputlb.h"
@@ -559,5 +558,5 @@ uint64_t cpu_physical_memory_sync_dirty_bitmap(RAMBlock *rb,
 
     return num_dirty;
 }
-#endif
+
 #endif
diff --git a/migration/ram.c b/migration/ram.c
index 424df6d9f1..6295f675df 100644
--- a/migration/ram.c
+++ b/migration/ram.c
@@ -48,7 +48,7 @@
 #include "qapi/qapi-commands-migration.h"
 #include "qapi/qmp/qerror.h"
 #include "trace.h"
-#include "exec/ram_addr.h"
+#include "system/ram_addr.h"
 #include "exec/target_page.h"
 #include "qemu/rcu_queue.h"
 #include "migration/colo.h"
diff --git a/system/memory.c b/system/memory.c
index a4185ea353..6a5d853071 100644
--- a/system/memory.c
+++ b/system/memory.c
@@ -26,7 +26,7 @@
 #include "trace.h"
 
 #include "exec/memory-internal.h"
-#include "exec/ram_addr.h"
+#include "system/ram_addr.h"
 #include "system/kvm.h"
 #include "system/runstate.h"
 #include "system/tcg.h"
diff --git a/system/physmem.c b/system/physmem.c
index 234e489199..307d0764b6 100644
--- a/system/physmem.c
+++ b/system/physmem.c
@@ -67,7 +67,7 @@
 #include "system/replay.h"
 
 #include "exec/memory-internal.h"
-#include "exec/ram_addr.h"
+#include "system/ram_addr.h"
 
 #include "qemu/pmem.h"
 
diff --git a/target/arm/tcg/mte_helper.c b/target/arm/tcg/mte_helper.c
index 5d6d8a17ae..80164a8050 100644
--- a/target/arm/tcg/mte_helper.c
+++ b/target/arm/tcg/mte_helper.c
@@ -27,7 +27,7 @@
 #include "user/cpu_loop.h"
 #include "user/page-protection.h"
 #else
-#include "exec/ram_addr.h"
+#include "system/ram_addr.h"
 #endif
 #include "exec/cpu_ldst.h"
 #include "exec/helper-proto.h"
diff --git a/target/ppc/kvm.c b/target/ppc/kvm.c
index 992356cb75..8b12b8e7d2 100644
--- a/target/ppc/kvm.c
+++ b/target/ppc/kvm.c
@@ -41,7 +41,7 @@
 #include "trace.h"
 #include "gdbstub/enums.h"
 #include "exec/memattrs.h"
-#include "exec/ram_addr.h"
+#include "system/ram_addr.h"
 #include "system/hostmem.h"
 #include "qemu/cutils.h"
 #include "qemu/main-loop.h"
diff --git a/target/s390x/kvm/kvm.c b/target/s390x/kvm/kvm.c
index 4d56e653dd..b9f1422197 100644
--- a/target/s390x/kvm/kvm.c
+++ b/target/s390x/kvm/kvm.c
@@ -41,7 +41,7 @@
 #include "system/runstate.h"
 #include "system/device_tree.h"
 #include "gdbstub/enums.h"
-#include "exec/ram_addr.h"
+#include "system/ram_addr.h"
 #include "trace.h"
 #include "hw/s390x/s390-pci-inst.h"
 #include "hw/s390x/s390-pci-bus.h"

From 548a01650c9be153b352406cd4afb86cb350788e Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 12 Mar 2025 19:03:02 -0700
Subject: [PATCH 0117/2760] include/system: Move exec/ramblock.h to
 system/ramblock.h
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Convert the existing includes with sed.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 MAINTAINERS                         | 2 +-
 hw/display/virtio-gpu-udmabuf.c     | 2 +-
 hw/hyperv/hv-balloon.c              | 2 +-
 hw/virtio/vhost-user.c              | 2 +-
 include/system/ram_addr.h           | 2 +-
 include/{exec => system}/ramblock.h | 9 ++++-----
 migration/dirtyrate.c               | 2 +-
 migration/file.c                    | 2 +-
 migration/multifd-nocomp.c          | 2 +-
 migration/multifd-qatzip.c          | 2 +-
 migration/multifd-qpl.c             | 2 +-
 migration/multifd-uadk.c            | 2 +-
 migration/multifd-zero-page.c       | 2 +-
 migration/multifd-zlib.c            | 2 +-
 migration/multifd-zstd.c            | 2 +-
 migration/multifd.c                 | 2 +-
 migration/postcopy-ram.c            | 2 +-
 tests/qtest/fuzz/generic_fuzz.c     | 2 +-
 18 files changed, 21 insertions(+), 22 deletions(-)
 rename include/{exec => system}/ramblock.h (96%)

diff --git a/MAINTAINERS b/MAINTAINERS
index b1ac3ff7d2..ba885010c5 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3122,7 +3122,7 @@ F: include/system/ioport.h
 F: include/exec/memop.h
 F: include/system/memory.h
 F: include/system/ram_addr.h
-F: include/exec/ramblock.h
+F: include/system/ramblock.h
 F: include/system/memory_mapping.h
 F: system/dma-helpers.c
 F: system/ioport.c
diff --git a/hw/display/virtio-gpu-udmabuf.c b/hw/display/virtio-gpu-udmabuf.c
index 85ca23cb32..0510577475 100644
--- a/hw/display/virtio-gpu-udmabuf.c
+++ b/hw/display/virtio-gpu-udmabuf.c
@@ -19,7 +19,7 @@
 #include "hw/virtio/virtio-gpu.h"
 #include "hw/virtio/virtio-gpu-pixman.h"
 #include "trace.h"
-#include "exec/ramblock.h"
+#include "system/ramblock.h"
 #include "system/hostmem.h"
 #include <sys/ioctl.h>
 #include <linux/memfd.h>
diff --git a/hw/hyperv/hv-balloon.c b/hw/hyperv/hv-balloon.c
index 0b1da723c8..acabff2c4a 100644
--- a/hw/hyperv/hv-balloon.c
+++ b/hw/hyperv/hv-balloon.c
@@ -12,7 +12,7 @@
 
 #include "system/address-spaces.h"
 #include "exec/cpu-common.h"
-#include "exec/ramblock.h"
+#include "system/ramblock.h"
 #include "hw/boards.h"
 #include "hw/hyperv/dynmem-proto.h"
 #include "hw/hyperv/hv-balloon.h"
diff --git a/hw/virtio/vhost-user.c b/hw/virtio/vhost-user.c
index 267b612587..48561d3c74 100644
--- a/hw/virtio/vhost-user.c
+++ b/hw/virtio/vhost-user.c
@@ -28,7 +28,7 @@
 #include "system/cryptodev.h"
 #include "migration/postcopy-ram.h"
 #include "trace.h"
-#include "exec/ramblock.h"
+#include "system/ramblock.h"
 
 #include <sys/ioctl.h>
 #include <sys/socket.h>
diff --git a/include/system/ram_addr.h b/include/system/ram_addr.h
index 3b81c3091f..b4e4425acb 100644
--- a/include/system/ram_addr.h
+++ b/include/system/ram_addr.h
@@ -23,7 +23,7 @@
 #include "system/tcg.h"
 #include "exec/cputlb.h"
 #include "exec/ramlist.h"
-#include "exec/ramblock.h"
+#include "system/ramblock.h"
 #include "exec/exec-all.h"
 #include "system/memory.h"
 #include "exec/target_page.h"
diff --git a/include/exec/ramblock.h b/include/system/ramblock.h
similarity index 96%
rename from include/exec/ramblock.h
rename to include/system/ramblock.h
index 64484cd821..d8a116ba99 100644
--- a/include/exec/ramblock.h
+++ b/include/system/ramblock.h
@@ -16,11 +16,10 @@
  * The functions declared here will be removed soon.
  */
 
-#ifndef QEMU_EXEC_RAMBLOCK_H
-#define QEMU_EXEC_RAMBLOCK_H
+#ifndef SYSTEM_RAMBLOCK_H
+#define SYSTEM_RAMBLOCK_H
 
-#ifndef CONFIG_USER_ONLY
-#include "cpu-common.h"
+#include "exec/cpu-common.h"
 #include "qemu/rcu.h"
 #include "exec/ramlist.h"
 
@@ -91,5 +90,5 @@ struct RAMBlock {
      */
     ram_addr_t postcopy_length;
 };
-#endif
+
 #endif
diff --git a/migration/dirtyrate.c b/migration/dirtyrate.c
index 09caf92f87..986624c79a 100644
--- a/migration/dirtyrate.c
+++ b/migration/dirtyrate.c
@@ -14,7 +14,7 @@
 #include "qemu/error-report.h"
 #include "hw/core/cpu.h"
 #include "qapi/error.h"
-#include "exec/ramblock.h"
+#include "system/ramblock.h"
 #include "exec/target_page.h"
 #include "qemu/rcu_queue.h"
 #include "qemu/main-loop.h"
diff --git a/migration/file.c b/migration/file.c
index 7f11e26f5c..bb8031e3c7 100644
--- a/migration/file.c
+++ b/migration/file.c
@@ -6,7 +6,7 @@
  */
 
 #include "qemu/osdep.h"
-#include "exec/ramblock.h"
+#include "system/ramblock.h"
 #include "qemu/cutils.h"
 #include "qemu/error-report.h"
 #include "qapi/error.h"
diff --git a/migration/multifd-nocomp.c b/migration/multifd-nocomp.c
index ffe75256c9..94f248e8a2 100644
--- a/migration/multifd-nocomp.c
+++ b/migration/multifd-nocomp.c
@@ -11,7 +11,7 @@
  */
 
 #include "qemu/osdep.h"
-#include "exec/ramblock.h"
+#include "system/ramblock.h"
 #include "exec/target_page.h"
 #include "file.h"
 #include "migration-stats.h"
diff --git a/migration/multifd-qatzip.c b/migration/multifd-qatzip.c
index 6a0e989fae..7419e5dc0d 100644
--- a/migration/multifd-qatzip.c
+++ b/migration/multifd-qatzip.c
@@ -13,7 +13,7 @@
  */
 
 #include "qemu/osdep.h"
-#include "exec/ramblock.h"
+#include "system/ramblock.h"
 #include "qapi/error.h"
 #include "qemu/error-report.h"
 #include "qapi/qapi-types-migration.h"
diff --git a/migration/multifd-qpl.c b/migration/multifd-qpl.c
index 88e2344af2..52902eb00c 100644
--- a/migration/multifd-qpl.c
+++ b/migration/multifd-qpl.c
@@ -14,7 +14,7 @@
 #include "qemu/module.h"
 #include "qapi/error.h"
 #include "qapi/qapi-types-migration.h"
-#include "exec/ramblock.h"
+#include "system/ramblock.h"
 #include "multifd.h"
 #include "qpl/qpl.h"
 
diff --git a/migration/multifd-uadk.c b/migration/multifd-uadk.c
index 6895c1f65a..fd7cd9b5e8 100644
--- a/migration/multifd-uadk.c
+++ b/migration/multifd-uadk.c
@@ -13,7 +13,7 @@
 #include "qemu/osdep.h"
 #include "qemu/module.h"
 #include "qapi/error.h"
-#include "exec/ramblock.h"
+#include "system/ramblock.h"
 #include "migration.h"
 #include "multifd.h"
 #include "options.h"
diff --git a/migration/multifd-zero-page.c b/migration/multifd-zero-page.c
index f1e988a959..dbc1184921 100644
--- a/migration/multifd-zero-page.c
+++ b/migration/multifd-zero-page.c
@@ -12,7 +12,7 @@
 
 #include "qemu/osdep.h"
 #include "qemu/cutils.h"
-#include "exec/ramblock.h"
+#include "system/ramblock.h"
 #include "migration.h"
 #include "migration-stats.h"
 #include "multifd.h"
diff --git a/migration/multifd-zlib.c b/migration/multifd-zlib.c
index 8cf8a26bb4..8820b2a787 100644
--- a/migration/multifd-zlib.c
+++ b/migration/multifd-zlib.c
@@ -13,7 +13,7 @@
 #include "qemu/osdep.h"
 #include <zlib.h>
 #include "qemu/rcu.h"
-#include "exec/ramblock.h"
+#include "system/ramblock.h"
 #include "exec/target_page.h"
 #include "qapi/error.h"
 #include "migration.h"
diff --git a/migration/multifd-zstd.c b/migration/multifd-zstd.c
index abed140855..3c2dcf76b0 100644
--- a/migration/multifd-zstd.c
+++ b/migration/multifd-zstd.c
@@ -13,7 +13,7 @@
 #include "qemu/osdep.h"
 #include <zstd.h>
 #include "qemu/rcu.h"
-#include "exec/ramblock.h"
+#include "system/ramblock.h"
 #include "exec/target_page.h"
 #include "qapi/error.h"
 #include "migration.h"
diff --git a/migration/multifd.c b/migration/multifd.c
index dfb5189f0e..86c83e43c0 100644
--- a/migration/multifd.c
+++ b/migration/multifd.c
@@ -16,7 +16,7 @@
 #include "qemu/rcu.h"
 #include "exec/target_page.h"
 #include "system/system.h"
-#include "exec/ramblock.h"
+#include "system/ramblock.h"
 #include "qemu/error-report.h"
 #include "qapi/error.h"
 #include "file.h"
diff --git a/migration/postcopy-ram.c b/migration/postcopy-ram.c
index 5d3edfcfec..995614b38c 100644
--- a/migration/postcopy-ram.c
+++ b/migration/postcopy-ram.c
@@ -31,7 +31,7 @@
 #include "qemu/error-report.h"
 #include "trace.h"
 #include "hw/boards.h"
-#include "exec/ramblock.h"
+#include "system/ramblock.h"
 #include "socket.h"
 #include "yank_functions.h"
 #include "tls.h"
diff --git a/tests/qtest/fuzz/generic_fuzz.c b/tests/qtest/fuzz/generic_fuzz.c
index 239be9372d..507de74806 100644
--- a/tests/qtest/fuzz/generic_fuzz.c
+++ b/tests/qtest/fuzz/generic_fuzz.c
@@ -21,7 +21,7 @@
 #include "fuzz.h"
 #include "string.h"
 #include "system/memory.h"
-#include "exec/ramblock.h"
+#include "system/ramblock.h"
 #include "hw/qdev-core.h"
 #include "hw/pci/pci.h"
 #include "hw/pci/pci_device.h"

From 261a0303ae4770cadaf02ec21da9b5e60076cd43 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 17 Mar 2025 17:13:28 +0100
Subject: [PATCH 0118/2760] accel/tcg: Remove unnecesary inclusion of
 memory-internal.h in cputlb.c
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

At some point cputlb.c stopped depending on the
"exec/memory-internal.h" header. Clean that now.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250317161329.40300-2-philmd@linaro.org>
---
 accel/tcg/cputlb.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index 134e523cab..613f919fff 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -26,7 +26,6 @@
 #include "exec/cpu_ldst.h"
 #include "exec/cputlb.h"
 #include "exec/tb-flush.h"
-#include "exec/memory-internal.h"
 #include "system/ram_addr.h"
 #include "exec/mmu-access-type.h"
 #include "exec/tlb-common.h"

From d4c9cab37fa440807a4f2bf87efd0511d5694b2c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 17 Mar 2025 17:13:29 +0100
Subject: [PATCH 0119/2760] exec: Restrict memory-internal.h to system/
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Only file units within the system/ directory need access to
"memory-internal.h". Restrict its scope by moving it there.

The comment from commit 9d70618c684 ("memory-internal.h:
Remove obsolete claim that header is obsolete") is now obsolete,
remove it.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250317161329.40300-3-philmd@linaro.org>
---
 MAINTAINERS                                | 2 +-
 {include/exec => system}/memory-internal.h | 6 ------
 system/memory.c                            | 4 ++--
 system/physmem.c                           | 3 ++-
 4 files changed, 5 insertions(+), 10 deletions(-)
 rename {include/exec => system}/memory-internal.h (88%)

diff --git a/MAINTAINERS b/MAINTAINERS
index ba885010c5..661a47db5a 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3129,7 +3129,7 @@ F: system/ioport.c
 F: system/memory.c
 F: system/memory_mapping.c
 F: system/physmem.c
-F: include/exec/memory-internal.h
+F: system/memory-internal.h
 F: scripts/coccinelle/memory-region-housekeeping.cocci
 
 Memory devices
diff --git a/include/exec/memory-internal.h b/system/memory-internal.h
similarity index 88%
rename from include/exec/memory-internal.h
rename to system/memory-internal.h
index c75178a3d6..085e81a9fe 100644
--- a/include/exec/memory-internal.h
+++ b/system/memory-internal.h
@@ -11,12 +11,6 @@
  *
  */
 
-/*
- * This header is for use by exec.c, memory.c and accel/tcg/cputlb.c ONLY,
- * for declarations which are shared between the memory subsystem's
- * internals and the TCG TLB code. Do not include it from elsewhere.
- */
-
 #ifndef MEMORY_INTERNAL_H
 #define MEMORY_INTERNAL_H
 
diff --git a/system/memory.c b/system/memory.c
index 6a5d853071..7e2f16f4e9 100644
--- a/system/memory.c
+++ b/system/memory.c
@@ -24,8 +24,6 @@
 #include "qemu/qemu-print.h"
 #include "qom/object.h"
 #include "trace.h"
-
-#include "exec/memory-internal.h"
 #include "system/ram_addr.h"
 #include "system/kvm.h"
 #include "system/runstate.h"
@@ -35,6 +33,8 @@
 #include "migration/vmstate.h"
 #include "system/address-spaces.h"
 
+#include "memory-internal.h"
+
 //#define DEBUG_UNASSIGNED
 
 static unsigned memory_region_transaction_depth;
diff --git a/system/physmem.c b/system/physmem.c
index 307d0764b6..16cf557d1a 100644
--- a/system/physmem.c
+++ b/system/physmem.c
@@ -66,7 +66,6 @@
 #include "qemu/main-loop.h"
 #include "system/replay.h"
 
-#include "exec/memory-internal.h"
 #include "system/ram_addr.h"
 
 #include "qemu/pmem.h"
@@ -88,6 +87,8 @@
 #include <daxctl/libdaxctl.h>
 #endif
 
+#include "memory-internal.h"
+
 //#define DEBUG_SUBPAGE
 
 /* ram_list is read under rcu_read_lock()/rcu_read_unlock().  Writes

From 5983a20a0bca7d54846abbb36fb59c7d9b1f226b Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 12 Mar 2025 14:33:07 -0700
Subject: [PATCH 0120/2760] meson: Introduce top-level libuser_ss and
 libsystem_ss

We already have two subdirectories for which we need
to build files twice, for user vs system modes.
Move this handling to the top level.

This cannot be combined with user_ss or system_ss,
because the formulation has not been extended to support
configuration symbols.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 gdbstub/meson.build | 32 ++++++++------------------------
 meson.build         | 22 ++++++++++++++++++++++
 tcg/meson.build     | 23 ++---------------------
 3 files changed, 32 insertions(+), 45 deletions(-)

diff --git a/gdbstub/meson.build b/gdbstub/meson.build
index dff741ddd4..0e8099ae9c 100644
--- a/gdbstub/meson.build
+++ b/gdbstub/meson.build
@@ -4,32 +4,16 @@
 # types such as hwaddr.
 #
 
-# We need to build the core gdb code via a library to be able to tweak
-# cflags so:
-
-gdb_user_ss = ss.source_set()
-gdb_system_ss = ss.source_set()
-
 # We build two versions of gdbstub, one for each mode
-gdb_user_ss.add(files('gdbstub.c', 'user.c'))
-gdb_system_ss.add(files('gdbstub.c', 'system.c'))
+libuser_ss.add(files(
+  'gdbstub.c',
+  'user.c'
+))
 
-gdb_user_ss = gdb_user_ss.apply({})
-gdb_system_ss = gdb_system_ss.apply({})
-
-libgdb_user = static_library('gdb_user',
-                             gdb_user_ss.sources() + genh,
-                             c_args: '-DCONFIG_USER_ONLY',
-                             build_by_default: false)
-
-libgdb_system = static_library('gdb_system',
-                                gdb_system_ss.sources() + genh,
-                                build_by_default: false)
-
-gdb_user = declare_dependency(objects: libgdb_user.extract_all_objects(recursive: false))
-user_ss.add(gdb_user)
-gdb_system = declare_dependency(objects: libgdb_system.extract_all_objects(recursive: false))
-system_ss.add(gdb_system)
+libsystem_ss.add(files(
+  'gdbstub.c',
+  'system.c'
+))
 
 common_ss.add(files('syscalls.c'))
 
diff --git a/meson.build b/meson.build
index 41f68d3806..7e22afe135 100644
--- a/meson.build
+++ b/meson.build
@@ -3662,12 +3662,14 @@ io_ss = ss.source_set()
 qmp_ss = ss.source_set()
 qom_ss = ss.source_set()
 system_ss = ss.source_set()
+libsystem_ss = ss.source_set()
 specific_fuzz_ss = ss.source_set()
 specific_ss = ss.source_set()
 rust_devices_ss = ss.source_set()
 stub_ss = ss.source_set()
 trace_ss = ss.source_set()
 user_ss = ss.source_set()
+libuser_ss = ss.source_set()
 util_ss = ss.source_set()
 
 # accel modules
@@ -4045,6 +4047,26 @@ common_ss.add(qom, qemuutil)
 common_ss.add_all(when: 'CONFIG_SYSTEM_ONLY', if_true: [system_ss])
 common_ss.add_all(when: 'CONFIG_USER_ONLY', if_true: user_ss)
 
+libuser_ss = libuser_ss.apply({})
+libuser = static_library('user',
+                         libuser_ss.sources() + genh,
+                         c_args: '-DCONFIG_USER_ONLY',
+                         dependencies: libuser_ss.dependencies(),
+                         build_by_default: false)
+libuser = declare_dependency(objects: libuser.extract_all_objects(recursive: false),
+                             dependencies: libuser_ss.dependencies())
+common_ss.add(when: 'CONFIG_USER_ONLY', if_true: libuser)
+
+libsystem_ss = libsystem_ss.apply({})
+libsystem = static_library('system',
+                           libsystem_ss.sources() + genh,
+                           c_args: '-DCONFIG_SOFTMMU',
+                           dependencies: libsystem_ss.dependencies(),
+                           build_by_default: false)
+libsystem = declare_dependency(objects: libsystem.extract_all_objects(recursive: false),
+                               dependencies: libsystem_ss.dependencies())
+common_ss.add(when: 'CONFIG_SYSTEM_ONLY', if_true: libsystem)
+
 # Note that this library is never used directly (only through extract_objects)
 # and is not built by default; therefore, source files not used by the build
 # configuration will be in build.ninja, but are never built by default.
diff --git a/tcg/meson.build b/tcg/meson.build
index 69ebb4908a..7df378d773 100644
--- a/tcg/meson.build
+++ b/tcg/meson.build
@@ -27,24 +27,5 @@ if host_os == 'linux'
   tcg_ss.add(files('perf.c'))
 endif
 
-tcg_ss = tcg_ss.apply({})
-
-libtcg_user = static_library('tcg_user',
-                             tcg_ss.sources() + genh,
-                             dependencies: tcg_ss.dependencies(),
-                             c_args: '-DCONFIG_USER_ONLY',
-                             build_by_default: false)
-
-tcg_user = declare_dependency(objects: libtcg_user.extract_all_objects(recursive: false),
-                              dependencies: tcg_ss.dependencies())
-user_ss.add(tcg_user)
-
-libtcg_system = static_library('tcg_system',
-                                tcg_ss.sources() + genh,
-                                dependencies: tcg_ss.dependencies(),
-                                c_args: '-DCONFIG_SOFTMMU',
-                                build_by_default: false)
-
-tcg_system = declare_dependency(objects: libtcg_system.extract_all_objects(recursive: false),
-                                dependencies: tcg_ss.dependencies())
-system_ss.add(tcg_system)
+libuser_ss.add_all(tcg_ss)
+libsystem_ss.add_all(tcg_ss)

From 7ed79a9adbeff0ff8a8b6c76d3d10b2fe0f68c63 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 12 Mar 2025 14:37:07 -0700
Subject: [PATCH 0121/2760] gdbstub: Move syscalls.c out of common_ss

Copy to libuser_ss and libsystem_ss.
This file uses semihosting/semihost.h, which has separate
implementations with and without CONFIG_USER_ONLY.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 gdbstub/meson.build | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/gdbstub/meson.build b/gdbstub/meson.build
index 0e8099ae9c..b25db86767 100644
--- a/gdbstub/meson.build
+++ b/gdbstub/meson.build
@@ -7,15 +7,15 @@
 # We build two versions of gdbstub, one for each mode
 libuser_ss.add(files(
   'gdbstub.c',
+  'syscalls.c',
   'user.c'
 ))
 
 libsystem_ss.add(files(
   'gdbstub.c',
+  'syscalls.c',
   'system.c'
 ))
 
-common_ss.add(files('syscalls.c'))
-
 # The user-target is specialised by the guest
 specific_ss.add(when: 'CONFIG_USER_ONLY', if_true: files('user-target.c'))

From 1a1567b1747ef46fca2dfa8c22c2262a2e8f6d6c Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 12 Mar 2025 14:55:21 -0700
Subject: [PATCH 0122/2760] accel/tcg: Use libuser_ss and libsystem_ss

While some of these files are built exactly once, due
to being in only libuser_ss or libsystem_ss, some of
the includes that they depend on require CONFIG_USER_ONLY.
So make use of the common infrastructure to allow that.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/meson.build | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/accel/tcg/meson.build b/accel/tcg/meson.build
index 185830d0f5..72d4acfe5e 100644
--- a/accel/tcg/meson.build
+++ b/accel/tcg/meson.build
@@ -1,12 +1,21 @@
-common_ss.add(when: 'CONFIG_TCG', if_true: files(
+if not get_option('tcg').allowed()
+   subdir_done()
+endif
+
+tcg_ss = ss.source_set()
+
+tcg_ss.add(files(
   'cpu-exec-common.c',
   'tcg-runtime.c',
   'tcg-runtime-gvec.c',
 ))
 if get_option('plugins')
-  common_ss.add(when: 'CONFIG_TCG', if_true: files('plugin-gen.c'))
+  tcg_ss.add(files('plugin-gen.c'))
 endif
 
+libuser_ss.add_all(tcg_ss)
+libsystem_ss.add_all(tcg_ss)
+
 tcg_specific_ss = ss.source_set()
 tcg_specific_ss.add(files(
   'tcg-all.c',
@@ -22,11 +31,11 @@ specific_ss.add(when: ['CONFIG_SYSTEM_ONLY', 'CONFIG_TCG'], if_true: files(
   'cputlb.c',
 ))
 
-user_ss.add(when: ['CONFIG_TCG'], if_true: files(
+libuser_ss.add(files(
   'user-exec-stub.c',
 ))
 
-system_ss.add(when: ['CONFIG_TCG'], if_true: files(
+libsystem_ss.add(files(
   'icount-common.c',
   'monitor.c',
   'tcg-accel-ops.c',

From 695e7f6026c4ed8a1a50cd26d3199fc4f4d9b3a5 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sun, 16 Mar 2025 15:48:07 -0700
Subject: [PATCH 0123/2760] target/mips: Restrict semihosting tests to system
 mode
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We do not set CONFIG_SEMIHOSTING in
configs/targets/mips*-linux-user.mak.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/mips/cpu.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/target/mips/cpu.c b/target/mips/cpu.c
index b207106dd7..47df563e12 100644
--- a/target/mips/cpu.c
+++ b/target/mips/cpu.c
@@ -32,8 +32,10 @@
 #include "exec/exec-all.h"
 #include "hw/qdev-properties.h"
 #include "hw/qdev-clock.h"
-#include "semihosting/semihost.h"
 #include "fpu_helper.h"
+#ifndef CONFIG_USER_ONLY
+#include "semihosting/semihost.h"
+#endif
 
 const char regnames[32][3] = {
     "r0", "at", "v0", "v1", "a0", "a1", "a2", "a3",
@@ -415,12 +417,11 @@ static void mips_cpu_reset_hold(Object *obj, ResetType type)
     restore_pamask(env);
     cs->exception_index = EXCP_NONE;
 
+#ifndef CONFIG_USER_ONLY
     if (semihosting_get_argc()) {
         /* UHI interface can be used to obtain argc and argv */
         env->active_tc.gpr[4] = -1;
     }
-
-#ifndef CONFIG_USER_ONLY
     if (kvm_enabled()) {
         kvm_mips_reset_vcpu(cpu);
     }

From 690793e005e004f749aa963ea0040f18e067c98e Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 17 Mar 2025 09:36:32 -0700
Subject: [PATCH 0124/2760] target/xtensa: Restrict semihosting tests to system
 mode

We do not set CONFIG_SEMIHOSTING in
configs/targets/xtensa*-linux-user.mak.

Do not raise SIGILL for user-only unconditionally.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/xtensa/translate.c | 24 +++++++++++-------------
 1 file changed, 11 insertions(+), 13 deletions(-)

diff --git a/target/xtensa/translate.c b/target/xtensa/translate.c
index 4f02cefde3..cb817b3119 100644
--- a/target/xtensa/translate.c
+++ b/target/xtensa/translate.c
@@ -35,14 +35,14 @@
 #include "tcg/tcg-op.h"
 #include "qemu/log.h"
 #include "qemu/qemu-print.h"
-#include "semihosting/semihost.h"
 #include "exec/translator.h"
 #include "exec/translation-block.h"
-
 #include "exec/helper-proto.h"
 #include "exec/helper-gen.h"
-
 #include "exec/log.h"
+#ifndef CONFIG_USER_ONLY
+#include "semihosting/semihost.h"
+#endif
 
 #define HELPER_H "helper.h"
 #include "exec/helper-info.c.inc"
@@ -2241,17 +2241,15 @@ static uint32_t test_exceptions_simcall(DisasContext *dc,
                                         const OpcodeArg arg[],
                                         const uint32_t par[])
 {
-    bool is_semi = semihosting_enabled(dc->cring != 0);
-#ifdef CONFIG_USER_ONLY
-    bool ill = true;
-#else
-    /* Between RE.2 and RE.3 simcall opcode's become nop for the hardware. */
-    bool ill = dc->config->hw_version <= 250002 && !is_semi;
-#endif
-    if (ill || !is_semi) {
-        qemu_log_mask(LOG_GUEST_ERROR, "SIMCALL but semihosting is disabled\n");
+#ifndef CONFIG_USER_ONLY
+    if (semihosting_enabled(dc->cring != 0)) {
+        return 0;
     }
-    return ill ? XTENSA_OP_ILL : 0;
+#endif
+    qemu_log_mask(LOG_GUEST_ERROR, "SIMCALL but semihosting is disabled\n");
+
+    /* Between RE.2 and RE.3 simcall opcode's become nop for the hardware. */
+    return dc->config->hw_version <= 250002 ? XTENSA_OP_ILL : 0;
 }
 
 static void translate_simcall(DisasContext *dc, const OpcodeArg arg[],

From d0b4cfa62937ce59bd88de5928ada687329be194 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 12 Mar 2025 17:16:05 -0700
Subject: [PATCH 0125/2760] semihosting: Move user-only implementation
 out-of-line
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Avoid testing CONFIG_USER_ONLY in semihost.h.
The only function that's required is semihosting_enabled.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/semihosting/semihost.h | 29 ++---------------------------
 semihosting/meson.build        |  5 +++--
 semihosting/stubs-all.c        |  6 ++++++
 semihosting/stubs-system.c     |  6 ------
 semihosting/user.c             | 20 ++++++++++++++++++++
 5 files changed, 31 insertions(+), 35 deletions(-)
 create mode 100644 semihosting/user.c

diff --git a/include/semihosting/semihost.h b/include/semihosting/semihost.h
index 97d2a2ba99..b03e637578 100644
--- a/include/semihosting/semihost.h
+++ b/include/semihosting/semihost.h
@@ -26,32 +26,6 @@ typedef enum SemihostingTarget {
     SEMIHOSTING_TARGET_GDB
 } SemihostingTarget;
 
-#ifdef CONFIG_USER_ONLY
-static inline bool semihosting_enabled(bool is_user)
-{
-    return true;
-}
-
-static inline SemihostingTarget semihosting_get_target(void)
-{
-    return SEMIHOSTING_TARGET_AUTO;
-}
-
-static inline const char *semihosting_get_arg(int i)
-{
-    return NULL;
-}
-
-static inline int semihosting_get_argc(void)
-{
-    return 0;
-}
-
-static inline const char *semihosting_get_cmdline(void)
-{
-    return NULL;
-}
-#else /* !CONFIG_USER_ONLY */
 /**
  * semihosting_enabled:
  * @is_user: true if guest code is in usermode (i.e. not privileged)
@@ -59,17 +33,18 @@ static inline const char *semihosting_get_cmdline(void)
  * Return true if guest code is allowed to make semihosting calls.
  */
 bool semihosting_enabled(bool is_user);
+
 SemihostingTarget semihosting_get_target(void);
 const char *semihosting_get_arg(int i);
 int semihosting_get_argc(void);
 const char *semihosting_get_cmdline(void);
 void semihosting_arg_fallback(const char *file, const char *cmd);
+
 /* for vl.c hooks */
 void qemu_semihosting_enable(void);
 int qemu_semihosting_config_options(const char *optstr);
 void qemu_semihosting_chardev_init(void);
 void qemu_semihosting_console_init(Chardev *);
-#endif /* CONFIG_USER_ONLY */
 void qemu_semihosting_guestfd_init(void);
 
 #endif /* SEMIHOST_H */
diff --git a/semihosting/meson.build b/semihosting/meson.build
index 86f5004bed..f3d38dda91 100644
--- a/semihosting/meson.build
+++ b/semihosting/meson.build
@@ -7,8 +7,9 @@ specific_ss.add(when: ['CONFIG_SEMIHOSTING', 'CONFIG_SYSTEM_ONLY'], if_true: fil
   'uaccess.c',
 ))
 
-common_ss.add(when: ['CONFIG_SEMIHOSTING', 'CONFIG_SYSTEM_ONLY'], if_false: files('stubs-all.c'))
-system_ss.add(when: ['CONFIG_SEMIHOSTING'], if_true: files(
+common_ss.add(when: 'CONFIG_SEMIHOSTING', if_false: files('stubs-all.c'))
+user_ss.add(when: 'CONFIG_SEMIHOSTING', if_true: files('user.c'))
+system_ss.add(when: 'CONFIG_SEMIHOSTING', if_true: files(
   'config.c',
   'console.c',
 ), if_false: files(
diff --git a/semihosting/stubs-all.c b/semihosting/stubs-all.c
index a2a1fc9c6f..c001c84574 100644
--- a/semihosting/stubs-all.c
+++ b/semihosting/stubs-all.c
@@ -11,6 +11,12 @@
 #include "qemu/osdep.h"
 #include "semihosting/semihost.h"
 
+/* Queries to config status default to off */
+bool semihosting_enabled(bool is_user)
+{
+    return false;
+}
+
 SemihostingTarget semihosting_get_target(void)
 {
     return SEMIHOSTING_TARGET_AUTO;
diff --git a/semihosting/stubs-system.c b/semihosting/stubs-system.c
index f26cbb7c25..989789f373 100644
--- a/semihosting/stubs-system.c
+++ b/semihosting/stubs-system.c
@@ -22,12 +22,6 @@ QemuOptsList qemu_semihosting_config_opts = {
     },
 };
 
-/* Queries to config status default to off */
-bool semihosting_enabled(bool is_user)
-{
-    return false;
-}
-
 /*
  * All the rest are empty subs. We could g_assert_not_reached() but
  * that adds extra weight to the final binary. Waste not want not.
diff --git a/semihosting/user.c b/semihosting/user.c
new file mode 100644
index 0000000000..515de3d2c0
--- /dev/null
+++ b/semihosting/user.c
@@ -0,0 +1,20 @@
+/*
+ * Semihosting for user emulation
+ *
+ * Copyright (c) 2019 Linaro Ltd
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "semihosting/semihost.h"
+
+bool semihosting_enabled(bool is_user)
+{
+    return true;
+}
+
+SemihostingTarget semihosting_get_target(void)
+{
+    return SEMIHOSTING_TARGET_AUTO;
+}

From 17a71e89693e17d60f73a00b4cea6963073152e3 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 20 Mar 2025 16:09:51 -0700
Subject: [PATCH 0126/2760] semihosting: Assert is_user in user-only
 semihosting_enabled
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Suggested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 semihosting/user.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/semihosting/user.c b/semihosting/user.c
index 515de3d2c0..98c144cb45 100644
--- a/semihosting/user.c
+++ b/semihosting/user.c
@@ -11,6 +11,7 @@
 
 bool semihosting_enabled(bool is_user)
 {
+    assert(is_user);
     return true;
 }
 

From 3e57baa22ea6892d1b8c212253b2859be30f45ee Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 14 Mar 2025 10:39:19 -0700
Subject: [PATCH 0127/2760] include/exec: Split out watchpoint.h
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Relatively few objects in qemu care about watchpoints, so split
out to a new header.  Removes an instance of CONFIG_USER_ONLY
from hw/core/cpu.h.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/tcg-accel-ops.c           |  1 +
 include/exec/watchpoint.h           | 41 +++++++++++++++++++++++++++++
 include/hw/core/cpu.h               | 30 ---------------------
 system/watchpoint.c                 |  1 +
 target/arm/debug_helper.c           |  1 +
 target/i386/cpu.c                   |  1 +
 target/i386/machine.c               |  2 +-
 target/i386/tcg/system/bpt_helper.c |  1 +
 target/ppc/cpu.c                    |  1 +
 target/ppc/cpu_init.c               |  2 +-
 target/riscv/debug.c                |  1 +
 target/s390x/helper.c               |  1 +
 target/s390x/tcg/excp_helper.c      |  1 +
 target/xtensa/dbg_helper.c          |  1 +
 14 files changed, 53 insertions(+), 32 deletions(-)
 create mode 100644 include/exec/watchpoint.h

diff --git a/accel/tcg/tcg-accel-ops.c b/accel/tcg/tcg-accel-ops.c
index d9b662efe3..5c88056157 100644
--- a/accel/tcg/tcg-accel-ops.c
+++ b/accel/tcg/tcg-accel-ops.c
@@ -37,6 +37,7 @@
 #include "exec/hwaddr.h"
 #include "exec/tb-flush.h"
 #include "exec/translation-block.h"
+#include "exec/watchpoint.h"
 #include "gdbstub/enums.h"
 
 #include "hw/core/cpu.h"
diff --git a/include/exec/watchpoint.h b/include/exec/watchpoint.h
new file mode 100644
index 0000000000..4b6668826c
--- /dev/null
+++ b/include/exec/watchpoint.h
@@ -0,0 +1,41 @@
+/*
+ * CPU watchpoints
+ *
+ * Copyright (c) 2012 SUSE LINUX Products GmbH
+ * SPDX-License-Identifier: LGPL-2.1-or-later
+ */
+
+#ifndef EXEC_WATCHPOINT_H
+#define EXEC_WATCHPOINT_H
+
+#if defined(CONFIG_USER_ONLY)
+static inline int cpu_watchpoint_insert(CPUState *cpu, vaddr addr, vaddr len,
+                                        int flags, CPUWatchpoint **watchpoint)
+{
+    return -ENOSYS;
+}
+
+static inline int cpu_watchpoint_remove(CPUState *cpu, vaddr addr,
+                                        vaddr len, int flags)
+{
+    return -ENOSYS;
+}
+
+static inline void cpu_watchpoint_remove_by_ref(CPUState *cpu,
+                                                CPUWatchpoint *wp)
+{
+}
+
+static inline void cpu_watchpoint_remove_all(CPUState *cpu, int mask)
+{
+}
+#else
+int cpu_watchpoint_insert(CPUState *cpu, vaddr addr, vaddr len,
+                          int flags, CPUWatchpoint **watchpoint);
+int cpu_watchpoint_remove(CPUState *cpu, vaddr addr,
+                          vaddr len, int flags);
+void cpu_watchpoint_remove_by_ref(CPUState *cpu, CPUWatchpoint *watchpoint);
+void cpu_watchpoint_remove_all(CPUState *cpu, int mask);
+#endif
+
+#endif /* EXEC_WATCHPOINT_H */
diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index abd8764e83..37cb7d1531 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -1109,36 +1109,6 @@ static inline bool cpu_breakpoint_test(CPUState *cpu, vaddr pc, int mask)
     return false;
 }
 
-#if defined(CONFIG_USER_ONLY)
-static inline int cpu_watchpoint_insert(CPUState *cpu, vaddr addr, vaddr len,
-                                        int flags, CPUWatchpoint **watchpoint)
-{
-    return -ENOSYS;
-}
-
-static inline int cpu_watchpoint_remove(CPUState *cpu, vaddr addr,
-                                        vaddr len, int flags)
-{
-    return -ENOSYS;
-}
-
-static inline void cpu_watchpoint_remove_by_ref(CPUState *cpu,
-                                                CPUWatchpoint *wp)
-{
-}
-
-static inline void cpu_watchpoint_remove_all(CPUState *cpu, int mask)
-{
-}
-#else
-int cpu_watchpoint_insert(CPUState *cpu, vaddr addr, vaddr len,
-                          int flags, CPUWatchpoint **watchpoint);
-int cpu_watchpoint_remove(CPUState *cpu, vaddr addr,
-                          vaddr len, int flags);
-void cpu_watchpoint_remove_by_ref(CPUState *cpu, CPUWatchpoint *watchpoint);
-void cpu_watchpoint_remove_all(CPUState *cpu, int mask);
-#endif
-
 /**
  * cpu_get_address_space:
  * @cpu: CPU to get address space from
diff --git a/system/watchpoint.c b/system/watchpoint.c
index 08dbd8483d..21d0bb36ca 100644
--- a/system/watchpoint.c
+++ b/system/watchpoint.c
@@ -21,6 +21,7 @@
 #include "qemu/error-report.h"
 #include "exec/cputlb.h"
 #include "exec/target_page.h"
+#include "exec/watchpoint.h"
 #include "hw/core/cpu.h"
 
 /* Add a watchpoint.  */
diff --git a/target/arm/debug_helper.c b/target/arm/debug_helper.c
index a9a619ba6b..473ee2af38 100644
--- a/target/arm/debug_helper.c
+++ b/target/arm/debug_helper.c
@@ -13,6 +13,7 @@
 #include "cpregs.h"
 #include "exec/exec-all.h"
 #include "exec/helper-proto.h"
+#include "exec/watchpoint.h"
 #include "system/tcg.h"
 
 #ifdef CONFIG_TCG
diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 5c9f80b4cc..c596e2174d 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -35,6 +35,7 @@
 #include "standard-headers/asm-x86/kvm_para.h"
 #include "hw/qdev-properties.h"
 #include "hw/i386/topology.h"
+#include "exec/watchpoint.h"
 #ifndef CONFIG_USER_ONLY
 #include "system/reset.h"
 #include "qapi/qapi-commands-machine-target.h"
diff --git a/target/i386/machine.c b/target/i386/machine.c
index 70f632a36f..6cb561c632 100644
--- a/target/i386/machine.c
+++ b/target/i386/machine.c
@@ -7,7 +7,7 @@
 #include "hw/i386/x86.h"
 #include "kvm/kvm_i386.h"
 #include "hw/xen/xen.h"
-
+#include "exec/watchpoint.h"
 #include "system/kvm.h"
 #include "system/kvm_xen.h"
 #include "system/tcg.h"
diff --git a/target/i386/tcg/system/bpt_helper.c b/target/i386/tcg/system/bpt_helper.c
index be232c1ca9..08ccd3f5e6 100644
--- a/target/i386/tcg/system/bpt_helper.c
+++ b/target/i386/tcg/system/bpt_helper.c
@@ -21,6 +21,7 @@
 #include "cpu.h"
 #include "exec/exec-all.h"
 #include "exec/helper-proto.h"
+#include "exec/watchpoint.h"
 #include "tcg/helper-tcg.h"
 
 
diff --git a/target/ppc/cpu.c b/target/ppc/cpu.c
index bfcc695de7..4d8faaddee 100644
--- a/target/ppc/cpu.c
+++ b/target/ppc/cpu.c
@@ -22,6 +22,7 @@
 #include "cpu-models.h"
 #include "cpu-qom.h"
 #include "exec/log.h"
+#include "exec/watchpoint.h"
 #include "fpu/softfloat-helpers.h"
 #include "mmu-hash64.h"
 #include "helper_regs.h"
diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
index f81cb680fc..17f0f3d3ff 100644
--- a/target/ppc/cpu_init.c
+++ b/target/ppc/cpu_init.c
@@ -40,7 +40,7 @@
 #include "qemu/cutils.h"
 #include "disas/capstone.h"
 #include "fpu/softfloat.h"
-
+#include "exec/watchpoint.h"
 #include "helper_regs.h"
 #include "internal.h"
 #include "spr_common.h"
diff --git a/target/riscv/debug.c b/target/riscv/debug.c
index 9db4048523..fea989afe9 100644
--- a/target/riscv/debug.c
+++ b/target/riscv/debug.c
@@ -30,6 +30,7 @@
 #include "trace.h"
 #include "exec/exec-all.h"
 #include "exec/helper-proto.h"
+#include "exec/watchpoint.h"
 #include "system/cpu-timers.h"
 
 /*
diff --git a/target/s390x/helper.c b/target/s390x/helper.c
index c689e11b46..e660c69f60 100644
--- a/target/s390x/helper.c
+++ b/target/s390x/helper.c
@@ -27,6 +27,7 @@
 #include "target/s390x/kvm/pv.h"
 #include "system/hw_accel.h"
 #include "system/runstate.h"
+#include "exec/watchpoint.h"
 
 void s390x_tod_timer(void *opaque)
 {
diff --git a/target/s390x/tcg/excp_helper.c b/target/s390x/tcg/excp_helper.c
index ac733f407f..1d51043e88 100644
--- a/target/s390x/tcg/excp_helper.c
+++ b/target/s390x/tcg/excp_helper.c
@@ -24,6 +24,7 @@
 #include "exec/helper-proto.h"
 #include "exec/cputlb.h"
 #include "exec/exec-all.h"
+#include "exec/watchpoint.h"
 #include "s390x-internal.h"
 #include "tcg_s390x.h"
 #ifndef CONFIG_USER_ONLY
diff --git a/target/xtensa/dbg_helper.c b/target/xtensa/dbg_helper.c
index 163a1ffc7b..c4f4298a50 100644
--- a/target/xtensa/dbg_helper.c
+++ b/target/xtensa/dbg_helper.c
@@ -31,6 +31,7 @@
 #include "exec/helper-proto.h"
 #include "qemu/host-utils.h"
 #include "exec/exec-all.h"
+#include "exec/watchpoint.h"
 #include "system/address-spaces.h"
 
 void HELPER(wsr_ibreakenable)(CPUXtensaState *env, uint32_t v)

From 53d2354cec1df5a364600ab5dcf4462266a84b63 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 12 Mar 2025 19:45:02 -0700
Subject: [PATCH 0128/2760] hw/core: Move unconditional files to libsystem_ss,
 libuser_ss

Many of the headers used by these require CONFIG_USER_ONLY.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 hw/core/meson.build | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/core/meson.build b/hw/core/meson.build
index b5a545a0ed..547de6527c 100644
--- a/hw/core/meson.build
+++ b/hw/core/meson.build
@@ -26,7 +26,7 @@ system_ss.add(when: 'CONFIG_XILINX_AXI', if_true: files('stream.c'))
 system_ss.add(when: 'CONFIG_PLATFORM_BUS', if_true: files('sysbus-fdt.c'))
 system_ss.add(when: 'CONFIG_EIF', if_true: [files('eif.c'), zlib, libcbor, gnutls])
 
-system_ss.add(files(
+libsystem_ss.add(files(
   'cpu-system.c',
   'fw-path-provider.c',
   'gpio.c',
@@ -46,7 +46,7 @@ system_ss.add(files(
   'vm-change-state-handler.c',
   'clock-vmstate.c',
 ))
-user_ss.add(files(
+libuser_ss.add(files(
   'cpu-user.c',
   'qdev-user.c',
 ))

From 7c2f3580e51f3a1d74d78b88267be22650b518ac Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 12 Mar 2025 19:45:50 -0700
Subject: [PATCH 0129/2760] system: Move most files to libsystem_ss
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Some of the headers used require CONFIG_USER_ONLY.
Do not move vl.c, because it has other include dependencies
that are present in system_ss.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 system/meson.build | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/system/meson.build b/system/meson.build
index 063301c3ad..c2f0082766 100644
--- a/system/meson.build
+++ b/system/meson.build
@@ -4,6 +4,10 @@ specific_ss.add(when: 'CONFIG_SYSTEM_ONLY', if_true: [files(
 )])
 
 system_ss.add(files(
+  'vl.c',
+), sdl, libpmem, libdaxctl)
+
+libsystem_ss.add(files(
   'balloon.c',
   'bootdevice.c',
   'cpus.c',
@@ -23,9 +27,8 @@ system_ss.add(files(
   'runstate-hmp-cmds.c',
   'runstate.c',
   'tpm-hmp-cmds.c',
-  'vl.c',
   'watchpoint.c',
-), sdl, libpmem, libdaxctl)
+))
 
 if have_tpm
   system_ss.add(files('tpm.c'))

From 6c1ae457a17a9462fb89ef1f30ad7da5266bfea6 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 12 Mar 2025 19:46:44 -0700
Subject: [PATCH 0130/2760] plugins: Move api.c, core.c to libuser_ss,
 libsystem_ss

Headers used by these files require CONFIG_USER_ONLY.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 plugins/meson.build | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/plugins/meson.build b/plugins/meson.build
index 3be8245a69..5383c7b88b 100644
--- a/plugins/meson.build
+++ b/plugins/meson.build
@@ -61,5 +61,8 @@ endif
 user_ss.add(files('user.c', 'api-user.c'))
 system_ss.add(files('system.c', 'api-system.c'))
 
-common_ss.add(files('loader.c', 'api.c', 'core.c'))
+libuser_ss.add(files('api.c', 'core.c'))
+libsystem_ss.add(files('api.c', 'core.c'))
+
+common_ss.add(files('loader.c'))
 

From 1596f1206f1d7d9ab9abfb7e010f3d3775c51202 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 12 Mar 2025 20:08:44 -0700
Subject: [PATCH 0131/2760] include/exec: Drop ifndef CONFIG_USER_ONLY from
 cpu-common.h

We were hiding a number of declarations from user-only,
although it hurts nothing to allow them.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/cpu-common.h | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/include/exec/cpu-common.h b/include/exec/cpu-common.h
index be032e1a49..9b83fd7ac8 100644
--- a/include/exec/cpu-common.h
+++ b/include/exec/cpu-common.h
@@ -9,9 +9,7 @@
 #define CPU_COMMON_H
 
 #include "exec/vaddr.h"
-#ifndef CONFIG_USER_ONLY
 #include "exec/hwaddr.h"
-#endif
 #include "hw/core/cpu.h"
 #include "tcg/debug-assert.h"
 #include "exec/page-protection.h"
@@ -40,8 +38,6 @@ int cpu_get_free_index(void);
 void tcg_iommu_init_notifier_list(CPUState *cpu);
 void tcg_iommu_free_notifier_list(CPUState *cpu);
 
-#if !defined(CONFIG_USER_ONLY)
-
 enum device_endian {
     DEVICE_NATIVE_ENDIAN,
     DEVICE_BIG_ENDIAN,
@@ -176,8 +172,6 @@ int ram_block_discard_range(RAMBlock *rb, uint64_t start, size_t length);
 int ram_block_discard_guest_memfd_range(RAMBlock *rb, uint64_t start,
                                         size_t length);
 
-#endif
-
 /* Returns: 0 on success, -1 on error */
 int cpu_memory_rw_debug(CPUState *cpu, vaddr addr,
                         void *ptr, size_t len, bool is_write);

From bcd6d0d60c5c5edf324af4427039d50693731e46 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 12 Mar 2025 20:10:02 -0700
Subject: [PATCH 0132/2760] include/hw/core: Drop ifndef CONFIG_USER_ONLY from
 cpu.h

We were hiding a number of declarations from user-only,
although it hurts nothing to allow them.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/hw/core/cpu.h | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index 37cb7d1531..6dcee5d0ba 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -614,8 +614,6 @@ extern bool mttcg_enabled;
  */
 bool cpu_paging_enabled(const CPUState *cpu);
 
-#if !defined(CONFIG_USER_ONLY)
-
 /**
  * cpu_get_memory_mapping:
  * @cpu: The CPU whose memory mappings are to be obtained.
@@ -676,8 +674,6 @@ int cpu_write_elf32_qemunote(WriteCoreDumpFunction f, CPUState *cpu,
  */
 GuestPanicInformation *cpu_get_crash_info(CPUState *cpu);
 
-#endif /* !CONFIG_USER_ONLY */
-
 /**
  * CPUDumpFlags:
  * @CPU_DUMP_CODE:
@@ -701,7 +697,6 @@ enum CPUDumpFlags {
  */
 void cpu_dump_state(CPUState *cpu, FILE *f, int flags);
 
-#ifndef CONFIG_USER_ONLY
 /**
  * cpu_get_phys_page_attrs_debug:
  * @cpu: The CPU to obtain the physical page address for.
@@ -758,8 +753,6 @@ bool cpu_virtio_is_big_endian(CPUState *cpu);
  */
 bool cpu_has_work(CPUState *cpu);
 
-#endif /* CONFIG_USER_ONLY */
-
 /**
  * cpu_list_add:
  * @cpu: The CPU to be added to the list of CPUs.
@@ -1136,8 +1129,6 @@ const char *target_name(void);
 
 #ifdef COMPILING_PER_TARGET
 
-#ifndef CONFIG_USER_ONLY
-
 extern const VMStateDescription vmstate_cpu_common;
 
 #define VMSTATE_CPU() {                                                     \
@@ -1147,7 +1138,6 @@ extern const VMStateDescription vmstate_cpu_common;
     .flags = VMS_STRUCT,                                                    \
     .offset = 0,                                                            \
 }
-#endif /* !CONFIG_USER_ONLY */
 
 #endif /* COMPILING_PER_TARGET */
 

From a771605798ba929fa18da2bcdd316c463c387462 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 12 Mar 2025 20:11:41 -0700
Subject: [PATCH 0133/2760] include/hw/intc: Remove ifndef CONFIG_USER_ONLY
 from armv7m_nvic.h
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We were hiding a number of declarations from user-only,
although it hurts nothing to allow them.  The inlines
for user-only are unused.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/hw/intc/armv7m_nvic.h | 14 --------------
 1 file changed, 14 deletions(-)

diff --git a/include/hw/intc/armv7m_nvic.h b/include/hw/intc/armv7m_nvic.h
index 89fe8aedaa..7b9964fe7e 100644
--- a/include/hw/intc/armv7m_nvic.h
+++ b/include/hw/intc/armv7m_nvic.h
@@ -189,21 +189,7 @@ int armv7m_nvic_raw_execution_priority(NVICState *s);
  * @secure: the security state to test
  * This corresponds to the pseudocode IsReqExecPriNeg().
  */
-#ifndef CONFIG_USER_ONLY
 bool armv7m_nvic_neg_prio_requested(NVICState *s, bool secure);
-#else
-static inline bool armv7m_nvic_neg_prio_requested(NVICState *s, bool secure)
-{
-    return false;
-}
-#endif
-#ifndef CONFIG_USER_ONLY
 bool armv7m_nvic_can_take_pending_exception(NVICState *s);
-#else
-static inline bool armv7m_nvic_can_take_pending_exception(NVICState *s)
-{
-    return true;
-}
-#endif
 
 #endif

From 31030cf0ff7c72584663a5fe9a9318fc843210ef Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 12 Mar 2025 20:12:17 -0700
Subject: [PATCH 0134/2760] include/hw/s390x: Remove ifndef CONFIG_USER_ONLY in
 css.h

We were hiding a number of declarations from user-only,
although it hurts nothing to allow them.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/hw/s390x/css.h | 2 --
 1 file changed, 2 deletions(-)

diff --git a/include/hw/s390x/css.h b/include/hw/s390x/css.h
index dbf919bdd2..0b0400a9d4 100644
--- a/include/hw/s390x/css.h
+++ b/include/hw/s390x/css.h
@@ -238,7 +238,6 @@ uint32_t css_get_adapter_id(CssIoAdapterType type, uint8_t isc);
 void css_register_io_adapters(CssIoAdapterType type, bool swap, bool maskable,
                               uint8_t flags, Error **errp);
 
-#ifndef CONFIG_USER_ONLY
 SubchDev *css_find_subch(uint8_t m, uint8_t cssid, uint8_t ssid,
                          uint16_t schid);
 bool css_subch_visible(SubchDev *sch);
@@ -262,7 +261,6 @@ int css_enable_mss(void);
 IOInstEnding css_do_rsch(SubchDev *sch);
 int css_do_rchp(uint8_t cssid, uint8_t chpid);
 bool css_present(uint8_t cssid);
-#endif
 
 extern const PropertyInfo css_devid_ro_propinfo;
 

From 161f5bc8e965fa8255db435683e6b52042037bb7 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 14 Mar 2025 12:57:31 -0700
Subject: [PATCH 0135/2760] include/exec: Split out icount.h

Split icount stuff from system/cpu-timers.h.
There are 17 files which only require icount.h, 7 that only
require cpu-timers.h, and 7 that require both.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cpu-exec.c             |  2 +-
 accel/tcg/icount-common.c        |  2 +-
 accel/tcg/monitor.c              |  1 +
 accel/tcg/tcg-accel-ops-icount.c |  2 +-
 accel/tcg/tcg-accel-ops-mttcg.c  |  2 +-
 accel/tcg/tcg-accel-ops-rr.c     |  2 +-
 accel/tcg/tcg-accel-ops.c        |  2 +-
 accel/tcg/tcg-all.c              |  2 +-
 accel/tcg/translate-all.c        |  2 +-
 hw/core/ptimer.c                 |  2 +-
 include/exec/icount.h            | 68 ++++++++++++++++++++++++++++++++
 include/system/cpu-timers.h      | 58 ---------------------------
 replay/replay.c                  |  2 +-
 stubs/icount.c                   |  2 +-
 system/cpu-timers.c              |  1 +
 system/dma-helpers.c             |  2 +-
 system/vl.c                      |  1 +
 target/arm/helper.c              |  1 +
 target/riscv/cpu_helper.c        |  2 +-
 target/riscv/csr.c               |  2 +-
 target/riscv/debug.c             |  1 +
 target/riscv/machine.c           |  2 +-
 target/riscv/pmu.c               |  2 +-
 util/async.c                     |  2 +-
 util/main-loop.c                 |  1 +
 util/qemu-timer.c                |  1 +
 26 files changed, 92 insertions(+), 75 deletions(-)
 create mode 100644 include/exec/icount.h

diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index 372b876604..034c2ded6b 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -35,7 +35,7 @@
 #include "exec/log.h"
 #include "qemu/main-loop.h"
 #include "exec/cpu-all.h"
-#include "system/cpu-timers.h"
+#include "exec/icount.h"
 #include "exec/replay-core.h"
 #include "system/tcg.h"
 #include "exec/helper-proto-common.h"
diff --git a/accel/tcg/icount-common.c b/accel/tcg/icount-common.c
index 402d3e3f4e..d6471174a3 100644
--- a/accel/tcg/icount-common.c
+++ b/accel/tcg/icount-common.c
@@ -35,7 +35,7 @@
 #include "system/replay.h"
 #include "system/runstate.h"
 #include "hw/core/cpu.h"
-#include "system/cpu-timers.h"
+#include "exec/icount.h"
 #include "system/cpu-timers-internal.h"
 
 /*
diff --git a/accel/tcg/monitor.c b/accel/tcg/monitor.c
index eeb38a4d9c..1c182b6bfb 100644
--- a/accel/tcg/monitor.c
+++ b/accel/tcg/monitor.c
@@ -14,6 +14,7 @@
 #include "qapi/qapi-commands-machine.h"
 #include "monitor/monitor.h"
 #include "system/cpu-timers.h"
+#include "exec/icount.h"
 #include "system/tcg.h"
 #include "tcg/tcg.h"
 #include "internal-common.h"
diff --git a/accel/tcg/tcg-accel-ops-icount.c b/accel/tcg/tcg-accel-ops-icount.c
index 27cf1044c7..d0f7b410fa 100644
--- a/accel/tcg/tcg-accel-ops-icount.c
+++ b/accel/tcg/tcg-accel-ops-icount.c
@@ -25,7 +25,7 @@
 
 #include "qemu/osdep.h"
 #include "system/replay.h"
-#include "system/cpu-timers.h"
+#include "exec/icount.h"
 #include "qemu/main-loop.h"
 #include "qemu/guest-random.h"
 #include "hw/core/cpu.h"
diff --git a/accel/tcg/tcg-accel-ops-mttcg.c b/accel/tcg/tcg-accel-ops-mttcg.c
index bdcc385ae9..dfcee30947 100644
--- a/accel/tcg/tcg-accel-ops-mttcg.c
+++ b/accel/tcg/tcg-accel-ops-mttcg.c
@@ -26,7 +26,7 @@
 #include "qemu/osdep.h"
 #include "system/tcg.h"
 #include "system/replay.h"
-#include "system/cpu-timers.h"
+#include "exec/icount.h"
 #include "qemu/main-loop.h"
 #include "qemu/notify.h"
 #include "qemu/guest-random.h"
diff --git a/accel/tcg/tcg-accel-ops-rr.c b/accel/tcg/tcg-accel-ops-rr.c
index f62cf24e1d..6eec5c9eee 100644
--- a/accel/tcg/tcg-accel-ops-rr.c
+++ b/accel/tcg/tcg-accel-ops-rr.c
@@ -27,7 +27,7 @@
 #include "qemu/lockable.h"
 #include "system/tcg.h"
 #include "system/replay.h"
-#include "system/cpu-timers.h"
+#include "exec/icount.h"
 #include "qemu/main-loop.h"
 #include "qemu/notify.h"
 #include "qemu/guest-random.h"
diff --git a/accel/tcg/tcg-accel-ops.c b/accel/tcg/tcg-accel-ops.c
index 5c88056157..ccdb781eef 100644
--- a/accel/tcg/tcg-accel-ops.c
+++ b/accel/tcg/tcg-accel-ops.c
@@ -29,7 +29,7 @@
 #include "system/accel-ops.h"
 #include "system/tcg.h"
 #include "system/replay.h"
-#include "system/cpu-timers.h"
+#include "exec/icount.h"
 #include "qemu/main-loop.h"
 #include "qemu/guest-random.h"
 #include "qemu/timer.h"
diff --git a/accel/tcg/tcg-all.c b/accel/tcg/tcg-all.c
index c1a30b0121..7a5b810b88 100644
--- a/accel/tcg/tcg-all.c
+++ b/accel/tcg/tcg-all.c
@@ -26,7 +26,7 @@
 #include "qemu/osdep.h"
 #include "system/tcg.h"
 #include "exec/replay-core.h"
-#include "system/cpu-timers.h"
+#include "exec/icount.h"
 #include "tcg/startup.h"
 #include "qapi/error.h"
 #include "qemu/error-report.h"
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index 167535bcb1..bb161ae61a 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -55,7 +55,7 @@
 #include "qemu/cacheinfo.h"
 #include "qemu/timer.h"
 #include "exec/log.h"
-#include "system/cpu-timers.h"
+#include "exec/icount.h"
 #include "system/tcg.h"
 #include "qapi/error.h"
 #include "accel/tcg/cpu-ops.h"
diff --git a/hw/core/ptimer.c b/hw/core/ptimer.c
index 7f63d17ca1..0aeb10fb53 100644
--- a/hw/core/ptimer.c
+++ b/hw/core/ptimer.c
@@ -11,7 +11,7 @@
 #include "migration/vmstate.h"
 #include "qemu/host-utils.h"
 #include "exec/replay-core.h"
-#include "system/cpu-timers.h"
+#include "exec/icount.h"
 #include "system/qtest.h"
 #include "block/aio.h"
 #include "hw/clock.h"
diff --git a/include/exec/icount.h b/include/exec/icount.h
new file mode 100644
index 0000000000..4964987ae4
--- /dev/null
+++ b/include/exec/icount.h
@@ -0,0 +1,68 @@
+/*
+ * icount - Instruction Counter API
+ * CPU timers state API
+ *
+ * Copyright 2020 SUSE LLC
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef EXEC_ICOUNT_H
+#define EXEC_ICOUNT_H
+
+/**
+ * ICountMode: icount enablement state:
+ *
+ * @ICOUNT_DISABLED: Disabled - Do not count executed instructions.
+ * @ICOUNT_PRECISE: Enabled - Fixed conversion of insn to ns via "shift" option
+ * @ICOUNT_ADAPTATIVE: Enabled - Runtime adaptive algorithm to compute shift
+ */
+typedef enum {
+    ICOUNT_DISABLED = 0,
+    ICOUNT_PRECISE,
+    ICOUNT_ADAPTATIVE,
+} ICountMode;
+
+#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
+extern ICountMode use_icount;
+#define icount_enabled() (use_icount)
+#else
+#define icount_enabled() ICOUNT_DISABLED
+#endif
+
+/*
+ * Update the icount with the executed instructions. Called by
+ * cpus-tcg vCPU thread so the main-loop can see time has moved forward.
+ */
+void icount_update(CPUState *cpu);
+
+/* get raw icount value */
+int64_t icount_get_raw(void);
+
+/* return the virtual CPU time in ns, based on the instruction counter. */
+int64_t icount_get(void);
+/*
+ * convert an instruction counter value to ns, based on the icount shift.
+ * This shift is set as a fixed value with the icount "shift" option
+ * (precise mode), or it is constantly approximated and corrected at
+ * runtime in adaptive mode.
+ */
+int64_t icount_to_ns(int64_t icount);
+
+/**
+ * icount_configure: configure the icount options, including "shift"
+ * @opts: Options to parse
+ * @errp: pointer to a NULL-initialized error object
+ *
+ * Return: true on success, else false setting @errp with error
+ */
+bool icount_configure(QemuOpts *opts, Error **errp);
+
+/* used by tcg vcpu thread to calc icount budget */
+int64_t icount_round(int64_t count);
+
+/* if the CPUs are idle, start accounting real time to virtual clock. */
+void icount_start_warp_timer(void);
+void icount_account_warp_timer(void);
+void icount_notify_exit(void);
+
+#endif /* EXEC_ICOUNT_H */
diff --git a/include/system/cpu-timers.h b/include/system/cpu-timers.h
index 64ae54f6d6..a1abed0d7a 100644
--- a/include/system/cpu-timers.h
+++ b/include/system/cpu-timers.h
@@ -15,64 +15,6 @@
 /* init the whole cpu timers API, including icount, ticks, and cpu_throttle */
 void cpu_timers_init(void);
 
-/* icount - Instruction Counter API */
-
-/**
- * ICountMode: icount enablement state:
- *
- * @ICOUNT_DISABLED: Disabled - Do not count executed instructions.
- * @ICOUNT_PRECISE: Enabled - Fixed conversion of insn to ns via "shift" option
- * @ICOUNT_ADAPTATIVE: Enabled - Runtime adaptive algorithm to compute shift
- */
-typedef enum {
-    ICOUNT_DISABLED = 0,
-    ICOUNT_PRECISE,
-    ICOUNT_ADAPTATIVE,
-} ICountMode;
-
-#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
-extern ICountMode use_icount;
-#define icount_enabled() (use_icount)
-#else
-#define icount_enabled() ICOUNT_DISABLED
-#endif
-
-/*
- * Update the icount with the executed instructions. Called by
- * cpus-tcg vCPU thread so the main-loop can see time has moved forward.
- */
-void icount_update(CPUState *cpu);
-
-/* get raw icount value */
-int64_t icount_get_raw(void);
-
-/* return the virtual CPU time in ns, based on the instruction counter. */
-int64_t icount_get(void);
-/*
- * convert an instruction counter value to ns, based on the icount shift.
- * This shift is set as a fixed value with the icount "shift" option
- * (precise mode), or it is constantly approximated and corrected at
- * runtime in adaptive mode.
- */
-int64_t icount_to_ns(int64_t icount);
-
-/**
- * icount_configure: configure the icount options, including "shift"
- * @opts: Options to parse
- * @errp: pointer to a NULL-initialized error object
- *
- * Return: true on success, else false setting @errp with error
- */
-bool icount_configure(QemuOpts *opts, Error **errp);
-
-/* used by tcg vcpu thread to calc icount budget */
-int64_t icount_round(int64_t count);
-
-/* if the CPUs are idle, start accounting real time to virtual clock. */
-void icount_start_warp_timer(void);
-void icount_account_warp_timer(void);
-void icount_notify_exit(void);
-
 /*
  * CPU Ticks and Clock
  */
diff --git a/replay/replay.c b/replay/replay.c
index 3adc387b3d..a3e24c967a 100644
--- a/replay/replay.c
+++ b/replay/replay.c
@@ -11,7 +11,7 @@
 
 #include "qemu/osdep.h"
 #include "qapi/error.h"
-#include "system/cpu-timers.h"
+#include "exec/icount.h"
 #include "system/replay.h"
 #include "system/runstate.h"
 #include "replay-internal.h"
diff --git a/stubs/icount.c b/stubs/icount.c
index edbf60cbfa..ceb73b4fc2 100644
--- a/stubs/icount.c
+++ b/stubs/icount.c
@@ -1,6 +1,6 @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
-#include "system/cpu-timers.h"
+#include "exec/icount.h"
 
 /* icount - Instruction Counter API */
 
diff --git a/system/cpu-timers.c b/system/cpu-timers.c
index 23dd82b465..cb35fa62b8 100644
--- a/system/cpu-timers.c
+++ b/system/cpu-timers.c
@@ -36,6 +36,7 @@
 #include "hw/core/cpu.h"
 #include "system/cpu-timers.h"
 #include "system/cpu-timers-internal.h"
+#include "exec/icount.h"
 
 /* clock and ticks */
 
diff --git a/system/dma-helpers.c b/system/dma-helpers.c
index 6bad75876f..0d592f6468 100644
--- a/system/dma-helpers.c
+++ b/system/dma-helpers.c
@@ -13,7 +13,7 @@
 #include "trace.h"
 #include "qemu/thread.h"
 #include "qemu/main-loop.h"
-#include "system/cpu-timers.h"
+#include "exec/icount.h"
 #include "qemu/range.h"
 
 /* #define DEBUG_IOMMU */
diff --git a/system/vl.c b/system/vl.c
index ec93988a03..c17945c493 100644
--- a/system/vl.c
+++ b/system/vl.c
@@ -89,6 +89,7 @@
 #include "audio/audio.h"
 #include "system/cpus.h"
 #include "system/cpu-timers.h"
+#include "exec/icount.h"
 #include "migration/colo.h"
 #include "migration/postcopy-ram.h"
 #include "system/kvm.h"
diff --git a/target/arm/helper.c b/target/arm/helper.c
index 0454b06a6c..becbbbd0d8 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -24,6 +24,7 @@
 #include "exec/translation-block.h"
 #include "hw/irq.h"
 #include "system/cpu-timers.h"
+#include "exec/icount.h"
 #include "system/kvm.h"
 #include "system/tcg.h"
 #include "qapi/error.h"
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index 6c4391d96b..0dd8645994 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -31,7 +31,7 @@
 #include "accel/tcg/cpu-ops.h"
 #include "trace.h"
 #include "semihosting/common-semi.h"
-#include "system/cpu-timers.h"
+#include "exec/icount.h"
 #include "cpu_bits.h"
 #include "debug.h"
 #include "pmp.h"
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index 7948188356..c52c87faae 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -27,7 +27,7 @@
 #include "exec/exec-all.h"
 #include "exec/cputlb.h"
 #include "exec/tb-flush.h"
-#include "system/cpu-timers.h"
+#include "exec/icount.h"
 #include "qemu/guest-random.h"
 #include "qapi/error.h"
 #include <stdbool.h>
diff --git a/target/riscv/debug.c b/target/riscv/debug.c
index fea989afe9..7fc9e121e1 100644
--- a/target/riscv/debug.c
+++ b/target/riscv/debug.c
@@ -32,6 +32,7 @@
 #include "exec/helper-proto.h"
 #include "exec/watchpoint.h"
 #include "system/cpu-timers.h"
+#include "exec/icount.h"
 
 /*
  * The following M-mode trigger CSRs are implemented:
diff --git a/target/riscv/machine.c b/target/riscv/machine.c
index 889e2b6570..a1f70cc955 100644
--- a/target/riscv/machine.c
+++ b/target/riscv/machine.c
@@ -21,7 +21,7 @@
 #include "qemu/error-report.h"
 #include "system/kvm.h"
 #include "migration/cpu.h"
-#include "system/cpu-timers.h"
+#include "exec/icount.h"
 #include "debug.h"
 
 static bool pmp_needed(void *opaque)
diff --git a/target/riscv/pmu.c b/target/riscv/pmu.c
index 0408f96e6a..a68809eef3 100644
--- a/target/riscv/pmu.c
+++ b/target/riscv/pmu.c
@@ -22,7 +22,7 @@
 #include "qemu/timer.h"
 #include "cpu.h"
 #include "pmu.h"
-#include "system/cpu-timers.h"
+#include "exec/icount.h"
 #include "system/device_tree.h"
 
 #define RISCV_TIMEBASE_FREQ 1000000000 /* 1Ghz */
diff --git a/util/async.c b/util/async.c
index 863416dee9..2719c629ae 100644
--- a/util/async.c
+++ b/util/async.c
@@ -35,7 +35,7 @@
 #include "block/raw-aio.h"
 #include "qemu/coroutine_int.h"
 #include "qemu/coroutine-tls.h"
-#include "system/cpu-timers.h"
+#include "exec/icount.h"
 #include "trace.h"
 
 /***********************************************************/
diff --git a/util/main-loop.c b/util/main-loop.c
index acad8c2e6c..42bd75c193 100644
--- a/util/main-loop.c
+++ b/util/main-loop.c
@@ -27,6 +27,7 @@
 #include "qemu/cutils.h"
 #include "qemu/timer.h"
 #include "system/cpu-timers.h"
+#include "exec/icount.h"
 #include "system/replay.h"
 #include "qemu/main-loop.h"
 #include "block/aio.h"
diff --git a/util/qemu-timer.c b/util/qemu-timer.c
index 788466fe22..1fb48be281 100644
--- a/util/qemu-timer.c
+++ b/util/qemu-timer.c
@@ -27,6 +27,7 @@
 #include "qemu/timer.h"
 #include "qemu/lockable.h"
 #include "system/cpu-timers.h"
+#include "exec/icount.h"
 #include "system/replay.h"
 #include "system/cpus.h"
 

From 1751889b5a63f7b246525fad4cfd6902e674dcc4 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 14 Mar 2025 13:15:07 -0700
Subject: [PATCH 0136/2760] include/exec: Protect icount_enabled from poisoned
 symbols

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/icount.h | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/include/exec/icount.h b/include/exec/icount.h
index 4964987ae4..7a26b40084 100644
--- a/include/exec/icount.h
+++ b/include/exec/icount.h
@@ -22,13 +22,21 @@ typedef enum {
     ICOUNT_ADAPTATIVE,
 } ICountMode;
 
-#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
+#ifdef CONFIG_TCG
 extern ICountMode use_icount;
 #define icount_enabled() (use_icount)
 #else
 #define icount_enabled() ICOUNT_DISABLED
 #endif
 
+/* Protect the CONFIG_USER_ONLY test vs poisoning. */
+#if defined(COMPILING_PER_TARGET) || defined(COMPILING_SYSTEM_VS_USER)
+# ifdef CONFIG_USER_ONLY
+#  undef  icount_enabled
+#  define icount_enabled() ICOUNT_DISABLED
+# endif
+#endif
+
 /*
  * Update the icount with the executed instructions. Called by
  * cpus-tcg vCPU thread so the main-loop can see time has moved forward.

From 4d9baad7dc1d57cc3fe7d71d16431ccff203dfbb Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 12 Mar 2025 20:15:41 -0700
Subject: [PATCH 0137/2760] include/system: Remove ifndef CONFIG_USER_ONLY in
 qtest.h

This is include/system, so CONFIG_USER_ONLY will never be true.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/system/qtest.h | 2 --
 1 file changed, 2 deletions(-)

diff --git a/include/system/qtest.h b/include/system/qtest.h
index 6ddddc501b..84b1f8c6ee 100644
--- a/include/system/qtest.h
+++ b/include/system/qtest.h
@@ -23,7 +23,6 @@ static inline bool qtest_enabled(void)
     return qtest_allowed;
 }
 
-#ifndef CONFIG_USER_ONLY
 void G_GNUC_PRINTF(2, 3) qtest_sendf(CharBackend *chr, const char *fmt, ...);
 void qtest_set_command_cb(bool (*pc_cb)(CharBackend *chr, gchar **words));
 bool qtest_driver(void);
@@ -33,6 +32,5 @@ void qtest_server_init(const char *qtest_chrdev, const char *qtest_log, Error **
 void qtest_server_set_send_handler(void (*send)(void *, const char *),
                                  void *opaque);
 void qtest_server_inproc_recv(void *opaque, const char *buf);
-#endif
 
 #endif

From c09a2edce0b0764698f61073e968288820b0941c Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 12 Mar 2025 20:18:08 -0700
Subject: [PATCH 0138/2760] include/qemu: Remove ifndef CONFIG_USER_ONLY from
 accel.h

While setup_post and has_memory will not be used for
CONFIG_USER_ONLY, let the struct have constant layout.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/qemu/accel.h | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/include/qemu/accel.h b/include/qemu/accel.h
index 972a849a2b..fbd3d897fe 100644
--- a/include/qemu/accel.h
+++ b/include/qemu/accel.h
@@ -38,13 +38,13 @@ typedef struct AccelClass {
 
     const char *name;
     int (*init_machine)(MachineState *ms);
-#ifndef CONFIG_USER_ONLY
+    bool (*cpu_common_realize)(CPUState *cpu, Error **errp);
+    void (*cpu_common_unrealize)(CPUState *cpu);
+
+    /* system related hooks */
     void (*setup_post)(MachineState *ms, AccelState *accel);
     bool (*has_memory)(MachineState *ms, AddressSpace *as,
                        hwaddr start_addr, hwaddr size);
-#endif
-    bool (*cpu_common_realize)(CPUState *cpu, Error **errp);
-    void (*cpu_common_unrealize)(CPUState *cpu);
 
     /* gdbstub related hooks */
     int (*gdbstub_supported_sstep_flags)(void);
@@ -78,12 +78,10 @@ const char *current_accel_name(void);
 
 void accel_init_interfaces(AccelClass *ac);
 
-#ifndef CONFIG_USER_ONLY
 int accel_init_machine(AccelState *accel, MachineState *ms);
 
 /* Called just before os_setup_post (ie just before drop OS privs) */
 void accel_setup_post(MachineState *ms);
-#endif /* !CONFIG_USER_ONLY */
 
 /**
  * accel_cpu_instance_init:

From e4610f38095a3ae01177fe67fd70e4d66b683259 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 12 Mar 2025 20:23:18 -0700
Subject: [PATCH 0139/2760] target/riscv: Remove ifndef CONFIG_USER_ONLY from
 cpu_cfg.h

While RISCVCPUConfig.satp_mode is unused for user-only,
this header is used from disas/riscv.h, whose users are
only built once.  The savings of 4 bytes isn't worth it.

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/riscv/cpu_cfg.h | 2 --
 1 file changed, 2 deletions(-)

diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
index 8a843482cc..cfe371b829 100644
--- a/target/riscv/cpu_cfg.h
+++ b/target/riscv/cpu_cfg.h
@@ -196,9 +196,7 @@ struct RISCVCPUConfig {
 
     bool short_isa_string;
 
-#ifndef CONFIG_USER_ONLY
     RISCVSATPMap satp_mode;
-#endif
 };
 
 typedef struct RISCVCPUConfig RISCVCPUConfig;

From 8916c373a3fd56938f1b7d57010491a0b9662b1e Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 12 Mar 2025 20:24:44 -0700
Subject: [PATCH 0140/2760] meson: Only allow CONFIG_USER_ONLY from certain
 source sets
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Poison CONFIG_USER_ONLY and CONFIG_SOFTMMU unless
the compilation unit is in specific_ss, libuser_ss,
or libsystem_ss.  This is intended to prevent files
being incorrectly added to common_ss.

Remove #ifndef CONFIG_USER_ONLY / #error / #endif blocks.
All they do is trigger the poison error.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/poison.h                       | 5 +++++
 include/hw/hw.h                             | 4 ----
 include/system/confidential-guest-support.h | 4 ----
 include/system/replay.h                     | 4 ----
 include/system/xen.h                        | 4 ----
 meson.build                                 | 6 ++++--
 6 files changed, 9 insertions(+), 18 deletions(-)

diff --git a/include/exec/poison.h b/include/exec/poison.h
index 2c151fd1e0..4180a5a489 100644
--- a/include/exec/poison.h
+++ b/include/exec/poison.h
@@ -66,4 +66,9 @@
 #pragma GCC poison CONFIG_WHPX
 #pragma GCC poison CONFIG_XEN
 
+#ifndef COMPILING_SYSTEM_VS_USER
+#pragma GCC poison CONFIG_USER_ONLY
+#pragma GCC poison CONFIG_SOFTMMU
+#endif
+
 #endif
diff --git a/include/hw/hw.h b/include/hw/hw.h
index 045c1c8b09..1b33d12b7f 100644
--- a/include/hw/hw.h
+++ b/include/hw/hw.h
@@ -1,10 +1,6 @@
 #ifndef QEMU_HW_H
 #define QEMU_HW_H
 
-#ifdef CONFIG_USER_ONLY
-#error Cannot include hw/hw.h from user emulation
-#endif
-
 G_NORETURN void hw_error(const char *fmt, ...) G_GNUC_PRINTF(1, 2);
 
 #endif
diff --git a/include/system/confidential-guest-support.h b/include/system/confidential-guest-support.h
index b68c4bebbc..ea46b50c56 100644
--- a/include/system/confidential-guest-support.h
+++ b/include/system/confidential-guest-support.h
@@ -18,10 +18,6 @@
 #ifndef QEMU_CONFIDENTIAL_GUEST_SUPPORT_H
 #define QEMU_CONFIDENTIAL_GUEST_SUPPORT_H
 
-#ifdef CONFIG_USER_ONLY
-#error Cannot include system/confidential-guest-support.h from user emulation
-#endif
-
 #include "qom/object.h"
 
 #define TYPE_CONFIDENTIAL_GUEST_SUPPORT "confidential-guest-support"
diff --git a/include/system/replay.h b/include/system/replay.h
index 8926d8cf4b..1c87c97fdd 100644
--- a/include/system/replay.h
+++ b/include/system/replay.h
@@ -11,10 +11,6 @@
 #ifndef SYSTEM_REPLAY_H
 #define SYSTEM_REPLAY_H
 
-#ifdef CONFIG_USER_ONLY
-#error Cannot include this header from user emulation
-#endif
-
 #include "exec/replay-core.h"
 #include "qapi/qapi-types-misc.h"
 #include "qapi/qapi-types-run-state.h"
diff --git a/include/system/xen.h b/include/system/xen.h
index 5f41915732..c2f283d1c2 100644
--- a/include/system/xen.h
+++ b/include/system/xen.h
@@ -10,10 +10,6 @@
 #ifndef SYSTEM_XEN_H
 #define SYSTEM_XEN_H
 
-#ifdef CONFIG_USER_ONLY
-#error Cannot include system/xen.h from user emulation
-#endif
-
 #include "exec/cpu-common.h"
 
 #ifdef COMPILING_PER_TARGET
diff --git a/meson.build b/meson.build
index 7e22afe135..657949326b 100644
--- a/meson.build
+++ b/meson.build
@@ -4050,7 +4050,8 @@ common_ss.add_all(when: 'CONFIG_USER_ONLY', if_true: user_ss)
 libuser_ss = libuser_ss.apply({})
 libuser = static_library('user',
                          libuser_ss.sources() + genh,
-                         c_args: '-DCONFIG_USER_ONLY',
+                         c_args: ['-DCONFIG_USER_ONLY',
+                                  '-DCOMPILING_SYSTEM_VS_USER'],
                          dependencies: libuser_ss.dependencies(),
                          build_by_default: false)
 libuser = declare_dependency(objects: libuser.extract_all_objects(recursive: false),
@@ -4060,7 +4061,8 @@ common_ss.add(when: 'CONFIG_USER_ONLY', if_true: libuser)
 libsystem_ss = libsystem_ss.apply({})
 libsystem = static_library('system',
                            libsystem_ss.sources() + genh,
-                           c_args: '-DCONFIG_SOFTMMU',
+                           c_args: ['-DCONFIG_SOFTMMU',
+                                    '-DCOMPILING_SYSTEM_VS_USER'],
                            dependencies: libsystem_ss.dependencies(),
                            build_by_default: false)
 libsystem = declare_dependency(objects: libsystem.extract_all_objects(recursive: false),

From 4d43552abe5c20ab414c054dd591bb6777832355 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Thu, 20 Mar 2025 15:29:34 -0700
Subject: [PATCH 0141/2760] exec/cpu-all: extract tlb flags defines to
 exec/tlb-flags.h

Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250320223002.2915728-3-pierrick.bouvier@linaro.org>
---
 accel/tcg/cputlb.c                   |  1 +
 accel/tcg/user-exec.c                |  1 +
 include/exec/cpu-all.h               | 63 --------------------
 include/exec/tlb-flags.h             | 89 ++++++++++++++++++++++++++++
 semihosting/uaccess.c                |  1 +
 target/arm/ptw.c                     |  1 +
 target/arm/tcg/helper-a64.c          |  1 +
 target/arm/tcg/mte_helper.c          |  1 +
 target/arm/tcg/sve_helper.c          |  1 +
 target/i386/tcg/system/excp_helper.c |  1 +
 target/riscv/op_helper.c             |  1 +
 target/riscv/vector_helper.c         |  1 +
 target/s390x/tcg/mem_helper.c        |  1 +
 target/sparc/mmu_helper.c            |  1 +
 14 files changed, 101 insertions(+), 63 deletions(-)
 create mode 100644 include/exec/tlb-flags.h

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index 613f919fff..b2db49e305 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -34,6 +34,7 @@
 #include "qemu/error-report.h"
 #include "exec/log.h"
 #include "exec/helper-proto-common.h"
+#include "exec/tlb-flags.h"
 #include "qemu/atomic.h"
 #include "qemu/atomic128.h"
 #include "tb-internal.h"
diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index ebc7c3ecf5..667c5e0354 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -21,6 +21,7 @@
 #include "disas/disas.h"
 #include "exec/vaddr.h"
 #include "exec/exec-all.h"
+#include "exec/tlb-flags.h"
 #include "tcg/tcg.h"
 #include "qemu/bitops.h"
 #include "qemu/rcu.h"
diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
index 4395fd08af..5c4379f0d0 100644
--- a/include/exec/cpu-all.h
+++ b/include/exec/cpu-all.h
@@ -35,69 +35,6 @@ CPUArchState *cpu_copy(CPUArchState *env);
 
 #include "cpu.h"
 
-#ifdef CONFIG_USER_ONLY
-
-/*
- * Allow some level of source compatibility with softmmu.  We do not
- * support any of the more exotic features, so only invalid pages may
- * be signaled by probe_access_flags().
- */
-#define TLB_INVALID_MASK    (1 << (TARGET_PAGE_BITS_MIN - 1))
-#define TLB_MMIO            (1 << (TARGET_PAGE_BITS_MIN - 2))
-#define TLB_WATCHPOINT      0
-
-#else
-
-/*
- * Flags stored in the low bits of the TLB virtual address.
- * These are defined so that fast path ram access is all zeros.
- * The flags all must be between TARGET_PAGE_BITS and
- * maximum address alignment bit.
- *
- * Use TARGET_PAGE_BITS_MIN so that these bits are constant
- * when TARGET_PAGE_BITS_VARY is in effect.
- *
- * The count, if not the placement of these bits is known
- * to tcg/tcg-op-ldst.c, check_max_alignment().
- */
-/* Zero if TLB entry is valid.  */
-#define TLB_INVALID_MASK    (1 << (TARGET_PAGE_BITS_MIN - 1))
-/* Set if TLB entry references a clean RAM page.  The iotlb entry will
-   contain the page physical address.  */
-#define TLB_NOTDIRTY        (1 << (TARGET_PAGE_BITS_MIN - 2))
-/* Set if TLB entry is an IO callback.  */
-#define TLB_MMIO            (1 << (TARGET_PAGE_BITS_MIN - 3))
-/* Set if TLB entry writes ignored.  */
-#define TLB_DISCARD_WRITE   (1 << (TARGET_PAGE_BITS_MIN - 4))
-/* Set if the slow path must be used; more flags in CPUTLBEntryFull. */
-#define TLB_FORCE_SLOW      (1 << (TARGET_PAGE_BITS_MIN - 5))
-
-/*
- * Use this mask to check interception with an alignment mask
- * in a TCG backend.
- */
-#define TLB_FLAGS_MASK \
-    (TLB_INVALID_MASK | TLB_NOTDIRTY | TLB_MMIO \
-    | TLB_FORCE_SLOW | TLB_DISCARD_WRITE)
-
-/*
- * Flags stored in CPUTLBEntryFull.slow_flags[x].
- * TLB_FORCE_SLOW must be set in CPUTLBEntry.addr_idx[x].
- */
-/* Set if TLB entry requires byte swap.  */
-#define TLB_BSWAP            (1 << 0)
-/* Set if TLB entry contains a watchpoint.  */
-#define TLB_WATCHPOINT       (1 << 1)
-/* Set if TLB entry requires aligned accesses.  */
-#define TLB_CHECK_ALIGNED    (1 << 2)
-
-#define TLB_SLOW_FLAGS_MASK  (TLB_BSWAP | TLB_WATCHPOINT | TLB_CHECK_ALIGNED)
-
-/* The two sets of flags must not overlap. */
-QEMU_BUILD_BUG_ON(TLB_FLAGS_MASK & TLB_SLOW_FLAGS_MASK);
-
-#endif /* !CONFIG_USER_ONLY */
-
 /* Validate correct placement of CPUArchState. */
 QEMU_BUILD_BUG_ON(offsetof(ArchCPU, parent_obj) != 0);
 QEMU_BUILD_BUG_ON(offsetof(ArchCPU, env) != sizeof(CPUState));
diff --git a/include/exec/tlb-flags.h b/include/exec/tlb-flags.h
new file mode 100644
index 0000000000..a0e51a4b37
--- /dev/null
+++ b/include/exec/tlb-flags.h
@@ -0,0 +1,89 @@
+/*
+ * TLB flags definition
+ *
+ *  Copyright (c) 2003 Fabrice Bellard
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
+ */
+#ifndef TLB_FLAGS_H
+#define TLB_FLAGS_H
+
+#include "exec/cpu-defs.h"
+
+#ifdef CONFIG_USER_ONLY
+
+/*
+ * Allow some level of source compatibility with softmmu.  We do not
+ * support any of the more exotic features, so only invalid pages may
+ * be signaled by probe_access_flags().
+ */
+#define TLB_INVALID_MASK    (1 << (TARGET_PAGE_BITS_MIN - 1))
+#define TLB_MMIO            (1 << (TARGET_PAGE_BITS_MIN - 2))
+#define TLB_WATCHPOINT      0
+
+#else
+
+/*
+ * Flags stored in the low bits of the TLB virtual address.
+ * These are defined so that fast path ram access is all zeros.
+ * The flags all must be between TARGET_PAGE_BITS and
+ * maximum address alignment bit.
+ *
+ * Use TARGET_PAGE_BITS_MIN so that these bits are constant
+ * when TARGET_PAGE_BITS_VARY is in effect.
+ *
+ * The count, if not the placement of these bits is known
+ * to tcg/tcg-op-ldst.c, check_max_alignment().
+ */
+/* Zero if TLB entry is valid.  */
+#define TLB_INVALID_MASK    (1 << (TARGET_PAGE_BITS_MIN - 1))
+/*
+ * Set if TLB entry references a clean RAM page.  The iotlb entry will
+ * contain the page physical address.
+ */
+#define TLB_NOTDIRTY        (1 << (TARGET_PAGE_BITS_MIN - 2))
+/* Set if TLB entry is an IO callback.  */
+#define TLB_MMIO            (1 << (TARGET_PAGE_BITS_MIN - 3))
+/* Set if TLB entry writes ignored.  */
+#define TLB_DISCARD_WRITE   (1 << (TARGET_PAGE_BITS_MIN - 4))
+/* Set if the slow path must be used; more flags in CPUTLBEntryFull. */
+#define TLB_FORCE_SLOW      (1 << (TARGET_PAGE_BITS_MIN - 5))
+
+/*
+ * Use this mask to check interception with an alignment mask
+ * in a TCG backend.
+ */
+#define TLB_FLAGS_MASK \
+    (TLB_INVALID_MASK | TLB_NOTDIRTY | TLB_MMIO \
+    | TLB_FORCE_SLOW | TLB_DISCARD_WRITE)
+
+/*
+ * Flags stored in CPUTLBEntryFull.slow_flags[x].
+ * TLB_FORCE_SLOW must be set in CPUTLBEntry.addr_idx[x].
+ */
+/* Set if TLB entry requires byte swap.  */
+#define TLB_BSWAP            (1 << 0)
+/* Set if TLB entry contains a watchpoint.  */
+#define TLB_WATCHPOINT       (1 << 1)
+/* Set if TLB entry requires aligned accesses.  */
+#define TLB_CHECK_ALIGNED    (1 << 2)
+
+#define TLB_SLOW_FLAGS_MASK  (TLB_BSWAP | TLB_WATCHPOINT | TLB_CHECK_ALIGNED)
+
+/* The two sets of flags must not overlap. */
+QEMU_BUILD_BUG_ON(TLB_FLAGS_MASK & TLB_SLOW_FLAGS_MASK);
+
+#endif /* !CONFIG_USER_ONLY */
+
+#endif /* TLB_FLAGS_H */
diff --git a/semihosting/uaccess.c b/semihosting/uaccess.c
index 2e33596428..ccb0c96070 100644
--- a/semihosting/uaccess.c
+++ b/semihosting/uaccess.c
@@ -11,6 +11,7 @@
 #include "exec/cpu-all.h"
 #include "accel/tcg/cpu-mmu-index.h"
 #include "exec/exec-all.h"
+#include "exec/tlb-flags.h"
 #include "semihosting/uaccess.h"
 
 void *uaccess_lock_user(CPUArchState *env, target_ulong addr,
diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index 4330900348..8d4e9e07a9 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -12,6 +12,7 @@
 #include "qemu/main-loop.h"
 #include "exec/exec-all.h"
 #include "exec/page-protection.h"
+#include "exec/tlb-flags.h"
 #include "cpu.h"
 #include "internals.h"
 #include "cpu-features.h"
diff --git a/target/arm/tcg/helper-a64.c b/target/arm/tcg/helper-a64.c
index 9244848efe..fa79d19425 100644
--- a/target/arm/tcg/helper-a64.c
+++ b/target/arm/tcg/helper-a64.c
@@ -31,6 +31,7 @@
 #include "exec/cpu-common.h"
 #include "exec/exec-all.h"
 #include "exec/cpu_ldst.h"
+#include "exec/tlb-flags.h"
 #include "qemu/int128.h"
 #include "qemu/atomic128.h"
 #include "fpu/softfloat.h"
diff --git a/target/arm/tcg/mte_helper.c b/target/arm/tcg/mte_helper.c
index 80164a8050..888c670754 100644
--- a/target/arm/tcg/mte_helper.c
+++ b/target/arm/tcg/mte_helper.c
@@ -31,6 +31,7 @@
 #endif
 #include "exec/cpu_ldst.h"
 #include "exec/helper-proto.h"
+#include "exec/tlb-flags.h"
 #include "accel/tcg/cpu-ops.h"
 #include "qapi/error.h"
 #include "qemu/guest-random.h"
diff --git a/target/arm/tcg/sve_helper.c b/target/arm/tcg/sve_helper.c
index d786b4b111..e3bed77b48 100644
--- a/target/arm/tcg/sve_helper.c
+++ b/target/arm/tcg/sve_helper.c
@@ -23,6 +23,7 @@
 #include "exec/exec-all.h"
 #include "exec/page-protection.h"
 #include "exec/helper-proto.h"
+#include "exec/tlb-flags.h"
 #include "tcg/tcg-gvec-desc.h"
 #include "fpu/softfloat.h"
 #include "tcg/tcg.h"
diff --git a/target/i386/tcg/system/excp_helper.c b/target/i386/tcg/system/excp_helper.c
index 6876329de2..b0b74df72f 100644
--- a/target/i386/tcg/system/excp_helper.c
+++ b/target/i386/tcg/system/excp_helper.c
@@ -22,6 +22,7 @@
 #include "exec/cpu_ldst.h"
 #include "exec/cputlb.h"
 #include "exec/page-protection.h"
+#include "exec/tlb-flags.h"
 #include "tcg/helper-tcg.h"
 
 typedef struct TranslateParams {
diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
index 72dc48e58d..f3d26b6b95 100644
--- a/target/riscv/op_helper.c
+++ b/target/riscv/op_helper.c
@@ -25,6 +25,7 @@
 #include "exec/cputlb.h"
 #include "exec/cpu_ldst.h"
 #include "exec/helper-proto.h"
+#include "exec/tlb-flags.h"
 #include "trace.h"
 
 /* Exceptions processing helpers */
diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
index 67b3bafebb..83978be060 100644
--- a/target/riscv/vector_helper.c
+++ b/target/riscv/vector_helper.c
@@ -25,6 +25,7 @@
 #include "exec/cpu_ldst.h"
 #include "exec/page-protection.h"
 #include "exec/helper-proto.h"
+#include "exec/tlb-flags.h"
 #include "fpu/softfloat.h"
 #include "tcg/tcg-gvec-desc.h"
 #include "internals.h"
diff --git a/target/s390x/tcg/mem_helper.c b/target/s390x/tcg/mem_helper.c
index 8187b917ba..0ff2e10d81 100644
--- a/target/s390x/tcg/mem_helper.c
+++ b/target/s390x/tcg/mem_helper.c
@@ -29,6 +29,7 @@
 #include "exec/cputlb.h"
 #include "exec/page-protection.h"
 #include "exec/cpu_ldst.h"
+#include "exec/tlb-flags.h"
 #include "accel/tcg/cpu-ops.h"
 #include "qemu/int128.h"
 #include "qemu/atomic128.h"
diff --git a/target/sparc/mmu_helper.c b/target/sparc/mmu_helper.c
index 78cb24a8e2..249b1f6c4c 100644
--- a/target/sparc/mmu_helper.c
+++ b/target/sparc/mmu_helper.c
@@ -23,6 +23,7 @@
 #include "exec/cputlb.h"
 #include "accel/tcg/cpu-mmu-index.h"
 #include "exec/page-protection.h"
+#include "exec/tlb-flags.h"
 #include "qemu/qemu-print.h"
 #include "trace.h"
 

From 31d399ff385498816e597bcc72de0f6efc36051e Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 25 Mar 2025 19:47:32 -0700
Subject: [PATCH 0142/2760] accel/tcg: Fix argument types of tlb_reset_dirty
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The arguments to tlb_reset_dirty are host pointers.
The conversion from ram_addr_t was done in the sole
caller, tlb_reset_dirty_range_all.

Fixes: e554861766d ("exec: prepare for splitting")
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c    | 6 +++---
 include/exec/cputlb.h | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index b2db49e305..10090067f7 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -912,7 +912,7 @@ static inline void copy_tlb_helper_locked(CPUTLBEntry *d, const CPUTLBEntry *s)
  * We must take tlb_c.lock to avoid racing with another vCPU update. The only
  * thing actually updated is the target TLB entry ->addr_write flags.
  */
-void tlb_reset_dirty(CPUState *cpu, ram_addr_t start1, ram_addr_t length)
+void tlb_reset_dirty(CPUState *cpu, uintptr_t start, uintptr_t length)
 {
     int mmu_idx;
 
@@ -923,12 +923,12 @@ void tlb_reset_dirty(CPUState *cpu, ram_addr_t start1, ram_addr_t length)
 
         for (i = 0; i < n; i++) {
             tlb_reset_dirty_range_locked(&cpu->neg.tlb.f[mmu_idx].table[i],
-                                         start1, length);
+                                         start, length);
         }
 
         for (i = 0; i < CPU_VTLB_SIZE; i++) {
             tlb_reset_dirty_range_locked(&cpu->neg.tlb.d[mmu_idx].vtable[i],
-                                         start1, length);
+                                         start, length);
         }
     }
     qemu_spin_unlock(&cpu->neg.tlb.c.lock);
diff --git a/include/exec/cputlb.h b/include/exec/cputlb.h
index 8125f6809c..03ed7e2165 100644
--- a/include/exec/cputlb.h
+++ b/include/exec/cputlb.h
@@ -31,7 +31,7 @@ void tlb_unprotect_code(ram_addr_t ram_addr);
 #endif
 
 #ifndef CONFIG_USER_ONLY
-void tlb_reset_dirty(CPUState *cpu, ram_addr_t start1, ram_addr_t length);
+void tlb_reset_dirty(CPUState *cpu, uintptr_t start, uintptr_t length);
 void tlb_reset_dirty_range_all(ram_addr_t start, ram_addr_t length);
 #endif
 

From 970354edc09a0ede505cea117b92e71330f1ed53 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 25 Mar 2025 20:10:42 -0700
Subject: [PATCH 0143/2760] accel/tcg: Pass CPUTLBEntryFull to
 tlb_reset_dirty_range_locked
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

While we're renaming things, don't modify addr; save it for
reuse in the qatomic_set.  Compute the host address into a
new local variable.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index 10090067f7..5df98d93d0 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -882,18 +882,16 @@ void tlb_unprotect_code(ram_addr_t ram_addr)
  *
  * Called with tlb_c.lock held.
  */
-static void tlb_reset_dirty_range_locked(CPUTLBEntry *tlb_entry,
+static void tlb_reset_dirty_range_locked(CPUTLBEntryFull *full, CPUTLBEntry *ent,
                                          uintptr_t start, uintptr_t length)
 {
-    uintptr_t addr = tlb_entry->addr_write;
+    const uintptr_t addr = ent->addr_write;
 
     if ((addr & (TLB_INVALID_MASK | TLB_MMIO |
                  TLB_DISCARD_WRITE | TLB_NOTDIRTY)) == 0) {
-        addr &= TARGET_PAGE_MASK;
-        addr += tlb_entry->addend;
-        if ((addr - start) < length) {
-            qatomic_set(&tlb_entry->addr_write,
-                        tlb_entry->addr_write | TLB_NOTDIRTY);
+        uintptr_t host = (addr & TARGET_PAGE_MASK) + ent->addend;
+        if ((host - start) < length) {
+            qatomic_set(&ent->addr_write, addr | TLB_NOTDIRTY);
         }
     }
 }
@@ -918,16 +916,18 @@ void tlb_reset_dirty(CPUState *cpu, uintptr_t start, uintptr_t length)
 
     qemu_spin_lock(&cpu->neg.tlb.c.lock);
     for (mmu_idx = 0; mmu_idx < NB_MMU_MODES; mmu_idx++) {
+        CPUTLBDesc *desc = &cpu->neg.tlb.d[mmu_idx];
+        CPUTLBDescFast *fast = &cpu->neg.tlb.f[mmu_idx];
+        unsigned int n = tlb_n_entries(fast);
         unsigned int i;
-        unsigned int n = tlb_n_entries(&cpu->neg.tlb.f[mmu_idx]);
 
         for (i = 0; i < n; i++) {
-            tlb_reset_dirty_range_locked(&cpu->neg.tlb.f[mmu_idx].table[i],
+            tlb_reset_dirty_range_locked(&desc->fulltlb[i], &fast->table[i],
                                          start, length);
         }
 
         for (i = 0; i < CPU_VTLB_SIZE; i++) {
-            tlb_reset_dirty_range_locked(&cpu->neg.tlb.d[mmu_idx].vtable[i],
+            tlb_reset_dirty_range_locked(&desc->vfulltlb[i], &desc->vtable[i],
                                          start, length);
         }
     }

From f05d251906a335465a5c5b3a6ffcdce96eca54f4 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 25 Mar 2025 20:21:23 -0700
Subject: [PATCH 0144/2760] accel/tcg: Rebuild full flags in
 tlb_reset_dirty_range_locked

Undo the split between inline and slow flags before masking.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index 5df98d93d0..28c47d4872 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -886,9 +886,10 @@ static void tlb_reset_dirty_range_locked(CPUTLBEntryFull *full, CPUTLBEntry *ent
                                          uintptr_t start, uintptr_t length)
 {
     const uintptr_t addr = ent->addr_write;
+    int flags = addr | full->slow_flags[MMU_DATA_STORE];
 
-    if ((addr & (TLB_INVALID_MASK | TLB_MMIO |
-                 TLB_DISCARD_WRITE | TLB_NOTDIRTY)) == 0) {
+    flags &= TLB_INVALID_MASK | TLB_MMIO | TLB_DISCARD_WRITE | TLB_NOTDIRTY;
+    if (flags == 0) {
         uintptr_t host = (addr & TARGET_PAGE_MASK) + ent->addend;
         if ((host - start) < length) {
             qatomic_set(&ent->addr_write, addr | TLB_NOTDIRTY);

From 24b5e0fdb543a09c26d6d77051b17055288bef8e Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 25 Mar 2025 20:22:14 -0700
Subject: [PATCH 0145/2760] include/exec: Move TLB_MMIO, TLB_DISCARD_WRITE to
 slow flags

Recover two bits from the inline flags.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/tlb-flags.h | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/include/exec/tlb-flags.h b/include/exec/tlb-flags.h
index a0e51a4b37..54a6bae768 100644
--- a/include/exec/tlb-flags.h
+++ b/include/exec/tlb-flags.h
@@ -53,20 +53,15 @@
  * contain the page physical address.
  */
 #define TLB_NOTDIRTY        (1 << (TARGET_PAGE_BITS_MIN - 2))
-/* Set if TLB entry is an IO callback.  */
-#define TLB_MMIO            (1 << (TARGET_PAGE_BITS_MIN - 3))
-/* Set if TLB entry writes ignored.  */
-#define TLB_DISCARD_WRITE   (1 << (TARGET_PAGE_BITS_MIN - 4))
 /* Set if the slow path must be used; more flags in CPUTLBEntryFull. */
-#define TLB_FORCE_SLOW      (1 << (TARGET_PAGE_BITS_MIN - 5))
+#define TLB_FORCE_SLOW      (1 << (TARGET_PAGE_BITS_MIN - 3))
 
 /*
  * Use this mask to check interception with an alignment mask
  * in a TCG backend.
  */
 #define TLB_FLAGS_MASK \
-    (TLB_INVALID_MASK | TLB_NOTDIRTY | TLB_MMIO \
-    | TLB_FORCE_SLOW | TLB_DISCARD_WRITE)
+    (TLB_INVALID_MASK | TLB_NOTDIRTY | TLB_FORCE_SLOW)
 
 /*
  * Flags stored in CPUTLBEntryFull.slow_flags[x].
@@ -78,8 +73,14 @@
 #define TLB_WATCHPOINT       (1 << 1)
 /* Set if TLB entry requires aligned accesses.  */
 #define TLB_CHECK_ALIGNED    (1 << 2)
+/* Set if TLB entry writes ignored.  */
+#define TLB_DISCARD_WRITE    (1 << 3)
+/* Set if TLB entry is an IO callback.  */
+#define TLB_MMIO             (1 << 4)
 
-#define TLB_SLOW_FLAGS_MASK  (TLB_BSWAP | TLB_WATCHPOINT | TLB_CHECK_ALIGNED)
+#define TLB_SLOW_FLAGS_MASK \
+    (TLB_BSWAP | TLB_WATCHPOINT | TLB_CHECK_ALIGNED | \
+     TLB_DISCARD_WRITE | TLB_MMIO)
 
 /* The two sets of flags must not overlap. */
 QEMU_BUILD_BUG_ON(TLB_FLAGS_MASK & TLB_SLOW_FLAGS_MASK);

From a456c72695e59589d88100ca7b3448817a6fa953 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 27 Mar 2025 16:11:09 -0500
Subject: [PATCH 0146/2760] include/exec: Move tb_{,set_}page_addr[01] to
 translation-block.h

Move the accessor functions for TranslationBlock
into the header related to the structure.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/exec-all.h          | 49 -------------------------------
 include/exec/translation-block.h | 50 ++++++++++++++++++++++++++++++++
 2 files changed, 50 insertions(+), 49 deletions(-)

diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index 19b0eda44a..fcad3446fe 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -123,55 +123,6 @@ int probe_access_full_mmu(CPUArchState *env, vaddr addr, int size,
 #endif /* !CONFIG_USER_ONLY */
 #endif /* CONFIG_TCG */
 
-static inline tb_page_addr_t tb_page_addr0(const TranslationBlock *tb)
-{
-#ifdef CONFIG_USER_ONLY
-    return tb->itree.start;
-#else
-    return tb->page_addr[0];
-#endif
-}
-
-static inline tb_page_addr_t tb_page_addr1(const TranslationBlock *tb)
-{
-#ifdef CONFIG_USER_ONLY
-    tb_page_addr_t next = tb->itree.last & TARGET_PAGE_MASK;
-    return next == (tb->itree.start & TARGET_PAGE_MASK) ? -1 : next;
-#else
-    return tb->page_addr[1];
-#endif
-}
-
-static inline void tb_set_page_addr0(TranslationBlock *tb,
-                                     tb_page_addr_t addr)
-{
-#ifdef CONFIG_USER_ONLY
-    tb->itree.start = addr;
-    /*
-     * To begin, we record an interval of one byte.  When the translation
-     * loop encounters a second page, the interval will be extended to
-     * include the first byte of the second page, which is sufficient to
-     * allow tb_page_addr1() above to work properly.  The final corrected
-     * interval will be set by tb_page_add() from tb->size before the
-     * node is added to the interval tree.
-     */
-    tb->itree.last = addr;
-#else
-    tb->page_addr[0] = addr;
-#endif
-}
-
-static inline void tb_set_page_addr1(TranslationBlock *tb,
-                                     tb_page_addr_t addr)
-{
-#ifdef CONFIG_USER_ONLY
-    /* Extend the interval to the first byte of the second page.  See above. */
-    tb->itree.last = addr;
-#else
-    tb->page_addr[1] = addr;
-#endif
-}
-
 /* TranslationBlock invalidate API */
 void tb_phys_invalidate(TranslationBlock *tb, tb_page_addr_t page_addr);
 void tb_invalidate_phys_range(tb_page_addr_t start, tb_page_addr_t last);
diff --git a/include/exec/translation-block.h b/include/exec/translation-block.h
index 3c69bc71a9..8b8e730561 100644
--- a/include/exec/translation-block.h
+++ b/include/exec/translation-block.h
@@ -13,6 +13,7 @@
 #include "exec/vaddr.h"
 #ifdef CONFIG_USER_ONLY
 #include "qemu/interval-tree.h"
+#include "exec/target_page.h"
 #endif
 
 /*
@@ -157,4 +158,53 @@ static inline uint32_t tb_cflags(const TranslationBlock *tb)
 bool tcg_cflags_has(CPUState *cpu, uint32_t flags);
 void tcg_cflags_set(CPUState *cpu, uint32_t flags);
 
+static inline tb_page_addr_t tb_page_addr0(const TranslationBlock *tb)
+{
+#ifdef CONFIG_USER_ONLY
+    return tb->itree.start;
+#else
+    return tb->page_addr[0];
+#endif
+}
+
+static inline tb_page_addr_t tb_page_addr1(const TranslationBlock *tb)
+{
+#ifdef CONFIG_USER_ONLY
+    tb_page_addr_t next = tb->itree.last & TARGET_PAGE_MASK;
+    return next == (tb->itree.start & TARGET_PAGE_MASK) ? -1 : next;
+#else
+    return tb->page_addr[1];
+#endif
+}
+
+static inline void tb_set_page_addr0(TranslationBlock *tb,
+                                     tb_page_addr_t addr)
+{
+#ifdef CONFIG_USER_ONLY
+    tb->itree.start = addr;
+    /*
+     * To begin, we record an interval of one byte.  When the translation
+     * loop encounters a second page, the interval will be extended to
+     * include the first byte of the second page, which is sufficient to
+     * allow tb_page_addr1() above to work properly.  The final corrected
+     * interval will be set by tb_page_add() from tb->size before the
+     * node is added to the interval tree.
+     */
+    tb->itree.last = addr;
+#else
+    tb->page_addr[0] = addr;
+#endif
+}
+
+static inline void tb_set_page_addr1(TranslationBlock *tb,
+                                     tb_page_addr_t addr)
+{
+#ifdef CONFIG_USER_ONLY
+    /* Extend the interval to the first byte of the second page.  See above. */
+    tb->itree.last = addr;
+#else
+    tb->page_addr[1] = addr;
+#endif
+}
+
 #endif /* EXEC_TRANSLATION_BLOCK_H */

From aa6f138abada97176598c89a9e4e3a7c3d47cb1e Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 27 Mar 2025 16:28:08 -0500
Subject: [PATCH 0147/2760] accel/tcg: Move get_page_addr_code* declarations
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Move the declarations from exec/exec-all.h to the
private accel/tcg/internal-common.h.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/internal-common.h | 34 ++++++++++++++++++++++++++++++++++
 accel/tcg/translator.c      |  1 +
 include/exec/exec-all.h     | 34 ----------------------------------
 3 files changed, 35 insertions(+), 34 deletions(-)

diff --git a/accel/tcg/internal-common.h b/accel/tcg/internal-common.h
index 9b6ab3a8cc..2f00560d10 100644
--- a/accel/tcg/internal-common.h
+++ b/accel/tcg/internal-common.h
@@ -74,4 +74,38 @@ uint32_t curr_cflags(CPUState *cpu);
 
 void tb_check_watchpoint(CPUState *cpu, uintptr_t retaddr);
 
+/**
+ * get_page_addr_code_hostp()
+ * @env: CPUArchState
+ * @addr: guest virtual address of guest code
+ *
+ * See get_page_addr_code() (full-system version) for documentation on the
+ * return value.
+ *
+ * Sets *@hostp (when @hostp is non-NULL) as follows.
+ * If the return value is -1, sets *@hostp to NULL. Otherwise, sets *@hostp
+ * to the host address where @addr's content is kept.
+ *
+ * Note: this function can trigger an exception.
+ */
+tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, vaddr addr,
+                                        void **hostp);
+
+/**
+ * get_page_addr_code()
+ * @env: CPUArchState
+ * @addr: guest virtual address of guest code
+ *
+ * If we cannot translate and execute from the entire RAM page, or if
+ * the region is not backed by RAM, returns -1. Otherwise, returns the
+ * ram_addr_t corresponding to the guest code at @addr.
+ *
+ * Note: this function can trigger an exception.
+ */
+static inline tb_page_addr_t get_page_addr_code(CPUArchState *env,
+                                                vaddr addr)
+{
+    return get_page_addr_code_hostp(env, addr, NULL);
+}
+
 #endif
diff --git a/accel/tcg/translator.c b/accel/tcg/translator.c
index 2ab081b95f..5f0aa9d56a 100644
--- a/accel/tcg/translator.c
+++ b/accel/tcg/translator.c
@@ -17,6 +17,7 @@
 #include "exec/translator.h"
 #include "exec/plugin-gen.h"
 #include "tcg/tcg-op-common.h"
+#include "internal-common.h"
 #include "internal-target.h"
 #include "disas/disas.h"
 #include "tb-internal.h"
diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index fcad3446fe..f52a680f42 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -143,40 +143,6 @@ struct MemoryRegionSection *iotlb_to_section(CPUState *cpu,
                                              hwaddr index, MemTxAttrs attrs);
 #endif
 
-/**
- * get_page_addr_code_hostp()
- * @env: CPUArchState
- * @addr: guest virtual address of guest code
- *
- * See get_page_addr_code() (full-system version) for documentation on the
- * return value.
- *
- * Sets *@hostp (when @hostp is non-NULL) as follows.
- * If the return value is -1, sets *@hostp to NULL. Otherwise, sets *@hostp
- * to the host address where @addr's content is kept.
- *
- * Note: this function can trigger an exception.
- */
-tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, vaddr addr,
-                                        void **hostp);
-
-/**
- * get_page_addr_code()
- * @env: CPUArchState
- * @addr: guest virtual address of guest code
- *
- * If we cannot translate and execute from the entire RAM page, or if
- * the region is not backed by RAM, returns -1. Otherwise, returns the
- * ram_addr_t corresponding to the guest code at @addr.
- *
- * Note: this function can trigger an exception.
- */
-static inline tb_page_addr_t get_page_addr_code(CPUArchState *env,
-                                                vaddr addr)
-{
-    return get_page_addr_code_hostp(env, addr, NULL);
-}
-
 #if !defined(CONFIG_USER_ONLY)
 
 MemoryRegionSection *

From b103cc6e74ac92f070a0e004bd84334e845c20b5 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 27 Mar 2025 16:48:09 -0500
Subject: [PATCH 0148/2760] accel/tcg: Remove page_protect

Merge the user-only page_protect function with the user-only
implementation of tb_lock_page0.  This avoids pulling
page-protection.h into tb-internal.h.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/tb-internal.h        | 11 +++--------
 accel/tcg/user-exec.c          |  2 +-
 include/user/page-protection.h |  1 -
 3 files changed, 4 insertions(+), 10 deletions(-)

diff --git a/accel/tcg/tb-internal.h b/accel/tcg/tb-internal.h
index 68aa8d17f4..f7c2073e29 100644
--- a/accel/tcg/tb-internal.h
+++ b/accel/tcg/tb-internal.h
@@ -51,28 +51,23 @@
 
 #endif /* CONFIG_SOFTMMU */
 
+void tb_lock_page0(tb_page_addr_t);
+
 #ifdef CONFIG_USER_ONLY
-#include "user/page-protection.h"
 /*
  * For user-only, page_protect sets the page read-only.
  * Since most execution is already on read-only pages, and we'd need to
  * account for other TBs on the same page, defer undoing any page protection
  * until we receive the write fault.
  */
-static inline void tb_lock_page0(tb_page_addr_t p0)
-{
-    page_protect(p0);
-}
-
 static inline void tb_lock_page1(tb_page_addr_t p0, tb_page_addr_t p1)
 {
-    page_protect(p1);
+    tb_lock_page0(p1);
 }
 
 static inline void tb_unlock_page1(tb_page_addr_t p0, tb_page_addr_t p1) { }
 static inline void tb_unlock_pages(TranslationBlock *tb) { }
 #else
-void tb_lock_page0(tb_page_addr_t);
 void tb_lock_page1(tb_page_addr_t, tb_page_addr_t);
 void tb_unlock_page1(tb_page_addr_t, tb_page_addr_t);
 void tb_unlock_pages(TranslationBlock *);
diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index 667c5e0354..72a9809c2d 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -657,7 +657,7 @@ target_ulong page_find_range_empty(target_ulong min, target_ulong max,
     }
 }
 
-void page_protect(tb_page_addr_t address)
+void tb_lock_page0(tb_page_addr_t address)
 {
     PageFlagsNode *p;
     target_ulong start, last;
diff --git a/include/user/page-protection.h b/include/user/page-protection.h
index 51daa18648..d5c8748d49 100644
--- a/include/user/page-protection.h
+++ b/include/user/page-protection.h
@@ -16,7 +16,6 @@
 #include "exec/target_long.h"
 #include "exec/translation-block.h"
 
-void page_protect(tb_page_addr_t page_addr);
 int page_unprotect(tb_page_addr_t address, uintptr_t pc);
 
 int page_get_flags(target_ulong address);

From 7b18e3a727f46771f41eb764c2b40cebca81c3de Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 27 Mar 2025 17:07:09 -0500
Subject: [PATCH 0149/2760] accel/tcg: Remove cpu-all.h, exec-all.h from
 tb-internal.h
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Not used by tb-internal.h, but add an include for
target_page.h in tb-maint.c.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/tb-internal.h | 2 --
 accel/tcg/tb-maint.c    | 1 +
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/accel/tcg/tb-internal.h b/accel/tcg/tb-internal.h
index f7c2073e29..f9a06bcbab 100644
--- a/accel/tcg/tb-internal.h
+++ b/accel/tcg/tb-internal.h
@@ -9,8 +9,6 @@
 #ifndef ACCEL_TCG_TB_INTERNAL_TARGET_H
 #define ACCEL_TCG_TB_INTERNAL_TARGET_H
 
-#include "exec/cpu-all.h"
-#include "exec/exec-all.h"
 #include "exec/translation-block.h"
 
 /*
diff --git a/accel/tcg/tb-maint.c b/accel/tcg/tb-maint.c
index d5899ad047..df3438e190 100644
--- a/accel/tcg/tb-maint.c
+++ b/accel/tcg/tb-maint.c
@@ -26,6 +26,7 @@
 #include "exec/page-protection.h"
 #include "exec/mmap-lock.h"
 #include "exec/tb-flush.h"
+#include "exec/target_page.h"
 #include "tb-internal.h"
 #include "system/tcg.h"
 #include "tcg/tcg.h"

From f3ad026e359971729539c6af799859b003f81b9e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 1 Apr 2025 09:20:52 +0200
Subject: [PATCH 0150/2760] target/rx: Fix copy/paste typo (riscv -> rx)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Rename riscv_cpu_mmu_index() -> rx_cpu_mmu_index().

Fixes: ef5cc166da1 ("target/rx: Populate CPUClass.mmu_index")
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250401072052.25892-1-philmd@linaro.org>
---
 target/rx/cpu.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/rx/cpu.c b/target/rx/cpu.c
index 0ba0d55ab5..a240b3b3ce 100644
--- a/target/rx/cpu.c
+++ b/target/rx/cpu.c
@@ -66,7 +66,7 @@ static bool rx_cpu_has_work(CPUState *cs)
         (CPU_INTERRUPT_HARD | CPU_INTERRUPT_FIR);
 }
 
-static int riscv_cpu_mmu_index(CPUState *cs, bool ifunc)
+static int rx_cpu_mmu_index(CPUState *cs, bool ifunc)
 {
     return 0;
 }
@@ -227,7 +227,7 @@ static void rx_cpu_class_init(ObjectClass *klass, void *data)
                                        &rcc->parent_phases);
 
     cc->class_by_name = rx_cpu_class_by_name;
-    cc->mmu_index = riscv_cpu_mmu_index;
+    cc->mmu_index = rx_cpu_mmu_index;
     cc->dump_state = rx_cpu_dump_state;
     cc->set_pc = rx_cpu_set_pc;
     cc->get_pc = rx_cpu_get_pc;

From 6ca6310699f5a295115e090c489d411fd219dcf6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 1 Apr 2025 10:09:14 +0200
Subject: [PATCH 0151/2760] hw/core/cpu: Update CPUClass::mmu_index docstring
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since commits 32a8ea12fab..90b7022e698 (target: "Split out
TARGET_env_mmu_index"), target's memory_rw_debug() callbacks
use the target's TARGET_env_mmu_index(), not the generic
CPUClass::mmu_index() callback. Update the documentation.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250401080938.32278-2-philmd@linaro.org>
---
 include/hw/core/cpu.h | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index 6dcee5d0ba..29f6419050 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -104,8 +104,7 @@ struct SysemuCPUOps;
  *                 instantiatable CPU type.
  * @parse_features: Callback to parse command line arguments.
  * @reset_dump_flags: #CPUDumpFlags to use for reset logging.
- * @mmu_index: Callback for choosing softmmu mmu index;
- *       may be used internally by memory_rw_debug without TCG.
+ * @mmu_index: Callback for choosing softmmu mmu index.
  * @memory_rw_debug: Callback for GDB memory access.
  * @dump_state: Callback for dumping state.
  * @query_cpu_fast:

From 17fa8b6f039d79e91884ecc1af65a3e771536ca3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 1 Apr 2025 10:09:15 +0200
Subject: [PATCH 0152/2760] accel/tcg: Introduce TCGCPUOps::mmu_index()
 callback
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We'll move CPUClass::mmu_index() to TCGCPUOps::mmu_index().

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250401080938.32278-3-philmd@linaro.org>
---
 include/accel/tcg/cpu-mmu-index.h | 5 ++++-
 include/accel/tcg/cpu-ops.h       | 3 +++
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/include/accel/tcg/cpu-mmu-index.h b/include/accel/tcg/cpu-mmu-index.h
index 8d1cb53bfa..f1ca385d3c 100644
--- a/include/accel/tcg/cpu-mmu-index.h
+++ b/include/accel/tcg/cpu-mmu-index.h
@@ -10,6 +10,7 @@
 #define ACCEL_TCG_CPU_MMU_INDEX_H
 
 #include "hw/core/cpu.h"
+#include "accel/tcg/cpu-ops.h"
 #include "tcg/debug-assert.h"
 #ifdef COMPILING_PER_TARGET
 # ifdef CONFIG_USER_ONLY
@@ -33,7 +34,9 @@ static inline int cpu_mmu_index(CPUState *cs, bool ifetch)
 # endif
 #endif
 
-    int ret = cs->cc->mmu_index(cs, ifetch);
+    const TCGCPUOps *tcg_ops = cs->cc->tcg_ops;
+    int ret = tcg_ops->mmu_index ? tcg_ops->mmu_index(cs, ifetch)
+                                 : cs->cc->mmu_index(cs, ifetch);
     tcg_debug_assert(ret >= 0 && ret < NB_MMU_MODES);
     return ret;
 }
diff --git a/include/accel/tcg/cpu-ops.h b/include/accel/tcg/cpu-ops.h
index f60e5303f2..106a0688da 100644
--- a/include/accel/tcg/cpu-ops.h
+++ b/include/accel/tcg/cpu-ops.h
@@ -67,6 +67,9 @@ struct TCGCPUOps {
     /** @debug_excp_handler: Callback for handling debug exceptions */
     void (*debug_excp_handler)(CPUState *cpu);
 
+    /** @mmu_index: Callback for choosing softmmu mmu index */
+    int (*mmu_index)(CPUState *cpu, bool ifetch);
+
 #ifdef CONFIG_USER_ONLY
     /**
      * @fake_user_interrupt: Callback for 'fake exception' handling.

From 6ea8bce7ee60e3f6fd14a959effe2cc6f3be7d94 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 1 Apr 2025 10:09:16 +0200
Subject: [PATCH 0153/2760] target/alpha: Restrict SoftMMU mmu_index() to TCG
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250401080938.32278-4-philmd@linaro.org>
---
 target/alpha/cpu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/alpha/cpu.c b/target/alpha/cpu.c
index 584c2aa76b..56c96b1c4d 100644
--- a/target/alpha/cpu.c
+++ b/target/alpha/cpu.c
@@ -238,6 +238,7 @@ static const TCGCPUOps alpha_tcg_ops = {
     .translate_code = alpha_translate_code,
     .synchronize_from_tb = alpha_cpu_synchronize_from_tb,
     .restore_state_to_opc = alpha_restore_state_to_opc,
+    .mmu_index = alpha_cpu_mmu_index,
 
 #ifdef CONFIG_USER_ONLY
     .record_sigsegv = alpha_cpu_record_sigsegv,
@@ -262,7 +263,6 @@ static void alpha_cpu_class_init(ObjectClass *oc, void *data)
                                     &acc->parent_realize);
 
     cc->class_by_name = alpha_cpu_class_by_name;
-    cc->mmu_index = alpha_cpu_mmu_index;
     cc->dump_state = alpha_cpu_dump_state;
     cc->set_pc = alpha_cpu_set_pc;
     cc->get_pc = alpha_cpu_get_pc;

From 61dc4d0da8ae2c7dc46f5d69ef063b64726f841f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 1 Apr 2025 10:09:17 +0200
Subject: [PATCH 0154/2760] target/arm: Restrict SoftMMU mmu_index() to TCG
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Move arm_cpu_mmu_index() within CONFIG_TCG #ifdef'ry,
convert CPUClass::mmu_index() to TCGCPUOps::mmu_index().

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250401080938.32278-5-philmd@linaro.org>
---
 target/arm/cpu.c         | 13 +++++++------
 target/arm/internals.h   |  1 +
 target/arm/tcg/cpu-v7m.c |  1 +
 3 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index 01786ac787..21e8cf1400 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -121,6 +121,12 @@ void arm_restore_state_to_opc(CPUState *cs,
         env->exception.syndrome = data[2] << ARM_INSN_START_WORD2_SHIFT;
     }
 }
+
+int arm_cpu_mmu_index(CPUState *cs, bool ifetch)
+{
+    return arm_env_mmu_index(cpu_env(cs));
+}
+
 #endif /* CONFIG_TCG */
 
 #ifndef CONFIG_USER_ONLY
@@ -144,11 +150,6 @@ static bool arm_cpu_has_work(CPUState *cs)
 }
 #endif /* !CONFIG_USER_ONLY */
 
-static int arm_cpu_mmu_index(CPUState *cs, bool ifetch)
-{
-    return arm_env_mmu_index(cpu_env(cs));
-}
-
 void arm_register_pre_el_change_hook(ARMCPU *cpu, ARMELChangeHookFn *hook,
                                  void *opaque)
 {
@@ -2674,6 +2675,7 @@ static const TCGCPUOps arm_tcg_ops = {
     .synchronize_from_tb = arm_cpu_synchronize_from_tb,
     .debug_excp_handler = arm_debug_excp_handler,
     .restore_state_to_opc = arm_restore_state_to_opc,
+    .mmu_index = arm_cpu_mmu_index,
 
 #ifdef CONFIG_USER_ONLY
     .record_sigsegv = arm_cpu_record_sigsegv,
@@ -2708,7 +2710,6 @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
                                        &acc->parent_phases);
 
     cc->class_by_name = arm_cpu_class_by_name;
-    cc->mmu_index = arm_cpu_mmu_index;
     cc->dump_state = arm_cpu_dump_state;
     cc->set_pc = arm_cpu_set_pc;
     cc->get_pc = arm_cpu_get_pc;
diff --git a/target/arm/internals.h b/target/arm/internals.h
index 28585c0755..8756c24c08 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -373,6 +373,7 @@ void arm_cpu_synchronize_from_tb(CPUState *cs, const TranslationBlock *tb);
 
 /* Our implementation of TCGCPUOps::cpu_exec_halt */
 bool arm_cpu_exec_halt(CPUState *cs);
+int arm_cpu_mmu_index(CPUState *cs, bool ifetch);
 #endif /* CONFIG_TCG */
 
 typedef enum ARMFPRounding {
diff --git a/target/arm/tcg/cpu-v7m.c b/target/arm/tcg/cpu-v7m.c
index c4dd309272..1a913faa50 100644
--- a/target/arm/tcg/cpu-v7m.c
+++ b/target/arm/tcg/cpu-v7m.c
@@ -237,6 +237,7 @@ static const TCGCPUOps arm_v7m_tcg_ops = {
     .synchronize_from_tb = arm_cpu_synchronize_from_tb,
     .debug_excp_handler = arm_debug_excp_handler,
     .restore_state_to_opc = arm_restore_state_to_opc,
+    .mmu_index = arm_cpu_mmu_index,
 
 #ifdef CONFIG_USER_ONLY
     .record_sigsegv = arm_cpu_record_sigsegv,

From 364f4633b7bc917ef9b2ecd307b42276a6582fe0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 1 Apr 2025 10:09:18 +0200
Subject: [PATCH 0155/2760] target/avr: Restrict SoftMMU mmu_index() to TCG
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250401080938.32278-6-philmd@linaro.org>
---
 target/avr/cpu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/avr/cpu.c b/target/avr/cpu.c
index 1121822470..feb73e722b 100644
--- a/target/avr/cpu.c
+++ b/target/avr/cpu.c
@@ -228,6 +228,7 @@ static const TCGCPUOps avr_tcg_ops = {
     .translate_code = avr_cpu_translate_code,
     .synchronize_from_tb = avr_cpu_synchronize_from_tb,
     .restore_state_to_opc = avr_restore_state_to_opc,
+    .mmu_index = avr_cpu_mmu_index,
     .cpu_exec_interrupt = avr_cpu_exec_interrupt,
     .cpu_exec_halt = avr_cpu_has_work,
     .tlb_fill = avr_cpu_tlb_fill,
@@ -250,7 +251,6 @@ static void avr_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = avr_cpu_class_by_name;
 
-    cc->mmu_index = avr_cpu_mmu_index;
     cc->dump_state = avr_cpu_dump_state;
     cc->set_pc = avr_cpu_set_pc;
     cc->get_pc = avr_cpu_get_pc;

From 7856232a93aa9b768d3dd09882192f8fbbc4d708 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 1 Apr 2025 10:09:19 +0200
Subject: [PATCH 0156/2760] target/hppa: Restrict SoftMMU mmu_index() to TCG
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250401080938.32278-7-philmd@linaro.org>
---
 target/hppa/cpu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/hppa/cpu.c b/target/hppa/cpu.c
index 2a85495d02..09a6aaa3dd 100644
--- a/target/hppa/cpu.c
+++ b/target/hppa/cpu.c
@@ -256,6 +256,7 @@ static const TCGCPUOps hppa_tcg_ops = {
     .translate_code = hppa_translate_code,
     .synchronize_from_tb = hppa_cpu_synchronize_from_tb,
     .restore_state_to_opc = hppa_restore_state_to_opc,
+    .mmu_index = hppa_cpu_mmu_index,
 
 #ifndef CONFIG_USER_ONLY
     .tlb_fill_align = hppa_cpu_tlb_fill_align,
@@ -281,7 +282,6 @@ static void hppa_cpu_class_init(ObjectClass *oc, void *data)
                                        &acc->parent_phases);
 
     cc->class_by_name = hppa_cpu_class_by_name;
-    cc->mmu_index = hppa_cpu_mmu_index;
     cc->dump_state = hppa_cpu_dump_state;
     cc->set_pc = hppa_cpu_set_pc;
     cc->get_pc = hppa_cpu_get_pc;

From c8db986959942edd7bbc2f3d193cacd7f85c145b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 1 Apr 2025 10:09:20 +0200
Subject: [PATCH 0157/2760] target/i386: Remove unused cpu_(ldub, stb)_kernel
 macros
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250401080938.32278-8-philmd@linaro.org>
---
 target/i386/tcg/seg_helper.h | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/target/i386/tcg/seg_helper.h b/target/i386/tcg/seg_helper.h
index ebf1035277..6b8606cd6d 100644
--- a/target/i386/tcg/seg_helper.h
+++ b/target/i386/tcg/seg_helper.h
@@ -35,8 +35,6 @@
  * TODO: Convert callers to compute cpu_mmu_index_kernel once
  * and use *_mmuidx_ra directly.
  */
-#define cpu_ldub_kernel_ra(e, p, r) \
-    cpu_ldub_mmuidx_ra(e, p, cpu_mmu_index_kernel(e), r)
 #define cpu_lduw_kernel_ra(e, p, r) \
     cpu_lduw_mmuidx_ra(e, p, cpu_mmu_index_kernel(e), r)
 #define cpu_ldl_kernel_ra(e, p, r) \
@@ -44,8 +42,6 @@
 #define cpu_ldq_kernel_ra(e, p, r) \
     cpu_ldq_mmuidx_ra(e, p, cpu_mmu_index_kernel(e), r)
 
-#define cpu_stb_kernel_ra(e, p, v, r) \
-    cpu_stb_mmuidx_ra(e, p, v, cpu_mmu_index_kernel(e), r)
 #define cpu_stw_kernel_ra(e, p, v, r) \
     cpu_stw_mmuidx_ra(e, p, v, cpu_mmu_index_kernel(e), r)
 #define cpu_stl_kernel_ra(e, p, v, r) \
@@ -53,12 +49,10 @@
 #define cpu_stq_kernel_ra(e, p, v, r) \
     cpu_stq_mmuidx_ra(e, p, v, cpu_mmu_index_kernel(e), r)
 
-#define cpu_ldub_kernel(e, p)    cpu_ldub_kernel_ra(e, p, 0)
 #define cpu_lduw_kernel(e, p)    cpu_lduw_kernel_ra(e, p, 0)
 #define cpu_ldl_kernel(e, p)     cpu_ldl_kernel_ra(e, p, 0)
 #define cpu_ldq_kernel(e, p)     cpu_ldq_kernel_ra(e, p, 0)
 
-#define cpu_stb_kernel(e, p, v)  cpu_stb_kernel_ra(e, p, v, 0)
 #define cpu_stw_kernel(e, p, v)  cpu_stw_kernel_ra(e, p, v, 0)
 #define cpu_stl_kernel(e, p, v)  cpu_stl_kernel_ra(e, p, v, 0)
 #define cpu_stq_kernel(e, p, v)  cpu_stq_kernel_ra(e, p, v, 0)

From 611c34a745ee7ab98733175458378f94e03c23d8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 1 Apr 2025 10:09:21 +0200
Subject: [PATCH 0158/2760] target/i386: Restrict cpu_mmu_index_kernel() to TCG
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Move cpu_mmu_index_kernel() to seg_helper.c.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250401080938.32278-9-philmd@linaro.org>
---
 target/i386/cpu.c            | 16 ----------------
 target/i386/cpu.h            |  1 -
 target/i386/tcg/seg_helper.c | 16 ++++++++++++++++
 target/i386/tcg/seg_helper.h |  4 ++++
 4 files changed, 20 insertions(+), 17 deletions(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index c596e2174d..fd85663833 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -8681,22 +8681,6 @@ static int x86_cpu_mmu_index(CPUState *cs, bool ifetch)
     return x86_mmu_index_pl(env, env->hflags & HF_CPL_MASK);
 }
 
-static int x86_mmu_index_kernel_pl(CPUX86State *env, unsigned pl)
-{
-    int mmu_index_32 = (env->hflags & HF_LMA_MASK) ? 0 : 1;
-    int mmu_index_base =
-        !(env->hflags & HF_SMAP_MASK) ? MMU_KNOSMAP64_IDX :
-        (pl < 3 && (env->eflags & AC_MASK)
-         ? MMU_KNOSMAP64_IDX : MMU_KSMAP64_IDX);
-
-    return mmu_index_base + mmu_index_32;
-}
-
-int cpu_mmu_index_kernel(CPUX86State *env)
-{
-    return x86_mmu_index_kernel_pl(env, env->hflags & HF_CPL_MASK);
-}
-
 static void x86_disas_set_info(CPUState *cs, disassemble_info *info)
 {
     X86CPU *cpu = X86_CPU(cs);
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index 119efc6c60..c9f39e99d3 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -2598,7 +2598,6 @@ static inline bool is_mmu_index_32(int mmu_index)
 }
 
 int x86_mmu_index_pl(CPUX86State *env, unsigned pl);
-int cpu_mmu_index_kernel(CPUX86State *env);
 
 #define CC_DST  (env->cc_dst)
 #define CC_SRC  (env->cc_src)
diff --git a/target/i386/tcg/seg_helper.c b/target/i386/tcg/seg_helper.c
index 71962113fb..f4370202fe 100644
--- a/target/i386/tcg/seg_helper.c
+++ b/target/i386/tcg/seg_helper.c
@@ -128,6 +128,22 @@ int get_pg_mode(CPUX86State *env)
     return pg_mode;
 }
 
+static int x86_mmu_index_kernel_pl(CPUX86State *env, unsigned pl)
+{
+    int mmu_index_32 = (env->hflags & HF_LMA_MASK) ? 0 : 1;
+    int mmu_index_base =
+        !(env->hflags & HF_SMAP_MASK) ? MMU_KNOSMAP64_IDX :
+        (pl < 3 && (env->eflags & AC_MASK)
+         ? MMU_KNOSMAP64_IDX : MMU_KSMAP64_IDX);
+
+    return mmu_index_base + mmu_index_32;
+}
+
+int cpu_mmu_index_kernel(CPUX86State *env)
+{
+    return x86_mmu_index_kernel_pl(env, env->hflags & HF_CPL_MASK);
+}
+
 /* return non zero if error */
 static inline int load_segment_ra(CPUX86State *env, uint32_t *e1_ptr,
                                uint32_t *e2_ptr, int selector,
diff --git a/target/i386/tcg/seg_helper.h b/target/i386/tcg/seg_helper.h
index 6b8606cd6d..ea98e1a98e 100644
--- a/target/i386/tcg/seg_helper.h
+++ b/target/i386/tcg/seg_helper.h
@@ -20,6 +20,8 @@
 #ifndef SEG_HELPER_H
 #define SEG_HELPER_H
 
+#include "cpu.h"
+
 //#define DEBUG_PCALL
 
 #ifdef DEBUG_PCALL
@@ -31,6 +33,8 @@
 # define LOG_PCALL_STATE(cpu) do { } while (0)
 #endif
 
+int cpu_mmu_index_kernel(CPUX86State *env);
+
 /*
  * TODO: Convert callers to compute cpu_mmu_index_kernel once
  * and use *_mmuidx_ra directly.

From 8480f7c7454de9527e14eaa2430835684eb03bbe Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 1 Apr 2025 10:09:22 +0200
Subject: [PATCH 0159/2760] target/i386: Restrict SoftMMU mmu_index() to TCG
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Move x86_cpu_mmu_index() to tcg-cpu.c, convert
CPUClass::mmu_index() to TCGCPUOps::mmu_index().

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250401080938.32278-10-philmd@linaro.org>
---
 target/i386/cpu.c            | 18 ------------------
 target/i386/cpu.h            |  2 --
 target/i386/tcg/seg_helper.c |  1 +
 target/i386/tcg/tcg-cpu.c    | 18 ++++++++++++++++++
 target/i386/tcg/tcg-cpu.h    |  2 ++
 5 files changed, 21 insertions(+), 20 deletions(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index fd85663833..57f62cc869 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -8664,23 +8664,6 @@ static bool x86_cpu_has_work(CPUState *cs)
 }
 #endif /* !CONFIG_USER_ONLY */
 
-int x86_mmu_index_pl(CPUX86State *env, unsigned pl)
-{
-    int mmu_index_32 = (env->hflags & HF_CS64_MASK) ? 0 : 1;
-    int mmu_index_base =
-        pl == 3 ? MMU_USER64_IDX :
-        !(env->hflags & HF_SMAP_MASK) ? MMU_KNOSMAP64_IDX :
-        (env->eflags & AC_MASK) ? MMU_KNOSMAP64_IDX : MMU_KSMAP64_IDX;
-
-    return mmu_index_base + mmu_index_32;
-}
-
-static int x86_cpu_mmu_index(CPUState *cs, bool ifetch)
-{
-    CPUX86State *env = cpu_env(cs);
-    return x86_mmu_index_pl(env, env->hflags & HF_CPL_MASK);
-}
-
 static void x86_disas_set_info(CPUState *cs, disassemble_info *info)
 {
     X86CPU *cpu = X86_CPU(cs);
@@ -8922,7 +8905,6 @@ static void x86_cpu_common_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = x86_cpu_class_by_name;
     cc->parse_features = x86_cpu_parse_featurestr;
-    cc->mmu_index = x86_cpu_mmu_index;
     cc->dump_state = x86_cpu_dump_state;
     cc->set_pc = x86_cpu_set_pc;
     cc->get_pc = x86_cpu_get_pc;
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index c9f39e99d3..0ad67fe0fd 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -2597,8 +2597,6 @@ static inline bool is_mmu_index_32(int mmu_index)
     return mmu_index & 1;
 }
 
-int x86_mmu_index_pl(CPUX86State *env, unsigned pl);
-
 #define CC_DST  (env->cc_dst)
 #define CC_SRC  (env->cc_src)
 #define CC_SRC2 (env->cc_src2)
diff --git a/target/i386/tcg/seg_helper.c b/target/i386/tcg/seg_helper.c
index f4370202fe..9dfbc4208c 100644
--- a/target/i386/tcg/seg_helper.c
+++ b/target/i386/tcg/seg_helper.c
@@ -28,6 +28,7 @@
 #include "helper-tcg.h"
 #include "seg_helper.h"
 #include "access.h"
+#include "tcg-cpu.h"
 
 #ifdef TARGET_X86_64
 #define SET_ESP(val, sp_mask)                                   \
diff --git a/target/i386/tcg/tcg-cpu.c b/target/i386/tcg/tcg-cpu.c
index b8aff825ee..818653ee6d 100644
--- a/target/i386/tcg/tcg-cpu.c
+++ b/target/i386/tcg/tcg-cpu.c
@@ -94,6 +94,23 @@ static void x86_restore_state_to_opc(CPUState *cs,
     }
 }
 
+int x86_mmu_index_pl(CPUX86State *env, unsigned pl)
+{
+    int mmu_index_32 = (env->hflags & HF_CS64_MASK) ? 0 : 1;
+    int mmu_index_base =
+        pl == 3 ? MMU_USER64_IDX :
+        !(env->hflags & HF_SMAP_MASK) ? MMU_KNOSMAP64_IDX :
+        (env->eflags & AC_MASK) ? MMU_KNOSMAP64_IDX : MMU_KSMAP64_IDX;
+
+    return mmu_index_base + mmu_index_32;
+}
+
+static int x86_cpu_mmu_index(CPUState *cs, bool ifetch)
+{
+    CPUX86State *env = cpu_env(cs);
+    return x86_mmu_index_pl(env, env->hflags & HF_CPL_MASK);
+}
+
 #ifndef CONFIG_USER_ONLY
 static bool x86_debug_check_breakpoint(CPUState *cs)
 {
@@ -112,6 +129,7 @@ static const TCGCPUOps x86_tcg_ops = {
     .translate_code = x86_translate_code,
     .synchronize_from_tb = x86_cpu_synchronize_from_tb,
     .restore_state_to_opc = x86_restore_state_to_opc,
+    .mmu_index = x86_cpu_mmu_index,
     .cpu_exec_enter = x86_cpu_exec_enter,
     .cpu_exec_exit = x86_cpu_exec_exit,
 #ifdef CONFIG_USER_ONLY
diff --git a/target/i386/tcg/tcg-cpu.h b/target/i386/tcg/tcg-cpu.h
index 53a8494455..7580f8afb4 100644
--- a/target/i386/tcg/tcg-cpu.h
+++ b/target/i386/tcg/tcg-cpu.h
@@ -78,4 +78,6 @@ QEMU_BUILD_BUG_ON(offsetof(X86XSaveArea, pkru_state) != XSAVE_PKRU_OFFSET);
 
 bool tcg_cpu_realizefn(CPUState *cs, Error **errp);
 
+int x86_mmu_index_pl(CPUX86State *env, unsigned pl);
+
 #endif /* TCG_CPU_H */

From 3076af3441034a8050f660d5c294d26b2e2943b3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 1 Apr 2025 10:09:23 +0200
Subject: [PATCH 0160/2760] target/loongarch: Restrict SoftMMU mmu_index() to
 TCG
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250401080938.32278-11-philmd@linaro.org>
---
 target/loongarch/cpu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/loongarch/cpu.c b/target/loongarch/cpu.c
index ea1665e270..cb96b17911 100644
--- a/target/loongarch/cpu.c
+++ b/target/loongarch/cpu.c
@@ -868,6 +868,7 @@ static const TCGCPUOps loongarch_tcg_ops = {
     .translate_code = loongarch_translate_code,
     .synchronize_from_tb = loongarch_cpu_synchronize_from_tb,
     .restore_state_to_opc = loongarch_restore_state_to_opc,
+    .mmu_index = loongarch_cpu_mmu_index,
 
 #ifndef CONFIG_USER_ONLY
     .tlb_fill = loongarch_cpu_tlb_fill,
@@ -919,7 +920,6 @@ static void loongarch_cpu_class_init(ObjectClass *c, void *data)
                                        &lacc->parent_phases);
 
     cc->class_by_name = loongarch_cpu_class_by_name;
-    cc->mmu_index = loongarch_cpu_mmu_index;
     cc->dump_state = loongarch_cpu_dump_state;
     cc->set_pc = loongarch_cpu_set_pc;
     cc->get_pc = loongarch_cpu_get_pc;

From cc944932ecef3b7a56ae62d89dd92fb9e56c5cc8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 1 Apr 2025 10:09:24 +0200
Subject: [PATCH 0161/2760] target/m68k: Restrict SoftMMU mmu_index() to TCG
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250401080938.32278-12-philmd@linaro.org>
---
 target/m68k/cpu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/m68k/cpu.c b/target/m68k/cpu.c
index 0065e1c1ca..4409d8941c 100644
--- a/target/m68k/cpu.c
+++ b/target/m68k/cpu.c
@@ -592,6 +592,7 @@ static const TCGCPUOps m68k_tcg_ops = {
     .initialize = m68k_tcg_init,
     .translate_code = m68k_translate_code,
     .restore_state_to_opc = m68k_restore_state_to_opc,
+    .mmu_index = m68k_cpu_mmu_index,
 
 #ifndef CONFIG_USER_ONLY
     .tlb_fill = m68k_cpu_tlb_fill,
@@ -615,7 +616,6 @@ static void m68k_cpu_class_init(ObjectClass *c, void *data)
                                        &mcc->parent_phases);
 
     cc->class_by_name = m68k_cpu_class_by_name;
-    cc->mmu_index = m68k_cpu_mmu_index;
     cc->dump_state = m68k_cpu_dump_state;
     cc->set_pc = m68k_cpu_set_pc;
     cc->get_pc = m68k_cpu_get_pc;

From 2b08170ffeca77cb0f02a365f536a341dd857a7d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 1 Apr 2025 10:09:25 +0200
Subject: [PATCH 0162/2760] target/microblaze: Restrict SoftMMU mmu_index() to
 TCG
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250401080938.32278-13-philmd@linaro.org>
---
 target/microblaze/cpu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
index f3bebea856..88baeb6807 100644
--- a/target/microblaze/cpu.c
+++ b/target/microblaze/cpu.c
@@ -431,6 +431,7 @@ static const TCGCPUOps mb_tcg_ops = {
     .translate_code = mb_translate_code,
     .synchronize_from_tb = mb_cpu_synchronize_from_tb,
     .restore_state_to_opc = mb_restore_state_to_opc,
+    .mmu_index = mb_cpu_mmu_index,
 
 #ifndef CONFIG_USER_ONLY
     .tlb_fill = mb_cpu_tlb_fill,
@@ -455,7 +456,6 @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
                                        &mcc->parent_phases);
 
     cc->class_by_name = mb_cpu_class_by_name;
-    cc->mmu_index = mb_cpu_mmu_index;
     cc->dump_state = mb_cpu_dump_state;
     cc->set_pc = mb_cpu_set_pc;
     cc->get_pc = mb_cpu_get_pc;

From a433b2194ff32d80e4374f340673c5357984f9a1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 1 Apr 2025 10:09:26 +0200
Subject: [PATCH 0163/2760] target/mips: Restrict SoftMMU mmu_index() to TCG
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250401080938.32278-14-philmd@linaro.org>
---
 target/mips/cpu.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/target/mips/cpu.c b/target/mips/cpu.c
index 47df563e12..cb0d6dde0e 100644
--- a/target/mips/cpu.c
+++ b/target/mips/cpu.c
@@ -182,11 +182,6 @@ static bool mips_cpu_has_work(CPUState *cs)
 }
 #endif /* !CONFIG_USER_ONLY */
 
-static int mips_cpu_mmu_index(CPUState *cs, bool ifunc)
-{
-    return mips_env_mmu_index(cpu_env(cs));
-}
-
 #include "cpu-defs.c.inc"
 
 static void mips_cpu_reset_hold(Object *obj, ResetType type)
@@ -549,11 +544,18 @@ static const Property mips_cpu_properties[] = {
 
 #ifdef CONFIG_TCG
 #include "accel/tcg/cpu-ops.h"
+
+static int mips_cpu_mmu_index(CPUState *cs, bool ifunc)
+{
+    return mips_env_mmu_index(cpu_env(cs));
+}
+
 static const TCGCPUOps mips_tcg_ops = {
     .initialize = mips_tcg_init,
     .translate_code = mips_translate_code,
     .synchronize_from_tb = mips_cpu_synchronize_from_tb,
     .restore_state_to_opc = mips_restore_state_to_opc,
+    .mmu_index = mips_cpu_mmu_index,
 
 #if !defined(CONFIG_USER_ONLY)
     .tlb_fill = mips_cpu_tlb_fill,
@@ -581,7 +583,6 @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
                                        &mcc->parent_phases);
 
     cc->class_by_name = mips_cpu_class_by_name;
-    cc->mmu_index = mips_cpu_mmu_index;
     cc->dump_state = mips_cpu_dump_state;
     cc->set_pc = mips_cpu_set_pc;
     cc->get_pc = mips_cpu_get_pc;

From a53066a9d660ee187a06062c1c44639714195a72 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 1 Apr 2025 10:09:27 +0200
Subject: [PATCH 0164/2760] target/openrisc: Restrict SoftMMU mmu_index() to
 TCG
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250401080938.32278-15-philmd@linaro.org>
---
 target/openrisc/cpu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/openrisc/cpu.c b/target/openrisc/cpu.c
index e8abf1f8b5..dc55594a7d 100644
--- a/target/openrisc/cpu.c
+++ b/target/openrisc/cpu.c
@@ -247,6 +247,7 @@ static const TCGCPUOps openrisc_tcg_ops = {
     .translate_code = openrisc_translate_code,
     .synchronize_from_tb = openrisc_cpu_synchronize_from_tb,
     .restore_state_to_opc = openrisc_restore_state_to_opc,
+    .mmu_index = openrisc_cpu_mmu_index,
 
 #ifndef CONFIG_USER_ONLY
     .tlb_fill = openrisc_cpu_tlb_fill,
@@ -269,7 +270,6 @@ static void openrisc_cpu_class_init(ObjectClass *oc, void *data)
                                        &occ->parent_phases);
 
     cc->class_by_name = openrisc_cpu_class_by_name;
-    cc->mmu_index = openrisc_cpu_mmu_index;
     cc->dump_state = openrisc_cpu_dump_state;
     cc->set_pc = openrisc_cpu_set_pc;
     cc->get_pc = openrisc_cpu_get_pc;

From 853f9378a325dbeec78afe3478dea277be369a3e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 1 Apr 2025 10:09:28 +0200
Subject: [PATCH 0165/2760] target/ppc: Restrict SoftMMU mmu_index() to TCG
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Convert CPUClass::mmu_index() to TCGCPUOps::mmu_index(),
restricting ppc_cpu_mmu_index() to TCG #ifdef.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250401080938.32278-16-philmd@linaro.org>
---
 target/ppc/cpu_init.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
index 17f0f3d3ff..fd8c42069e 100644
--- a/target/ppc/cpu_init.c
+++ b/target/ppc/cpu_init.c
@@ -7216,6 +7216,11 @@ static void ppc_restore_state_to_opc(CPUState *cs,
 
     cpu->env.nip = data[0];
 }
+
+static int ppc_cpu_mmu_index(CPUState *cs, bool ifetch)
+{
+    return ppc_env_mmu_index(cpu_env(cs), ifetch);
+}
 #endif /* CONFIG_TCG */
 
 #ifndef CONFIG_USER_ONLY
@@ -7225,11 +7230,6 @@ static bool ppc_cpu_has_work(CPUState *cs)
 }
 #endif /* !CONFIG_USER_ONLY */
 
-static int ppc_cpu_mmu_index(CPUState *cs, bool ifetch)
-{
-    return ppc_env_mmu_index(cpu_env(cs), ifetch);
-}
-
 static void ppc_cpu_reset_hold(Object *obj, ResetType type)
 {
     CPUState *cs = CPU(obj);
@@ -7482,6 +7482,7 @@ static const TCGCPUOps ppc_tcg_ops = {
   .initialize = ppc_translate_init,
   .translate_code = ppc_translate_code,
   .restore_state_to_opc = ppc_restore_state_to_opc,
+  .mmu_index = ppc_cpu_mmu_index,
 
 #ifdef CONFIG_USER_ONLY
   .record_sigsegv = ppc_cpu_record_sigsegv,
@@ -7518,7 +7519,6 @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
                                        &pcc->parent_phases);
 
     cc->class_by_name = ppc_cpu_class_by_name;
-    cc->mmu_index = ppc_cpu_mmu_index;
     cc->dump_state = ppc_cpu_dump_state;
     cc->set_pc = ppc_cpu_set_pc;
     cc->get_pc = ppc_cpu_get_pc;

From bf8dc33bbca3d84251d40bd81fa1d832b3171ffa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 1 Apr 2025 10:09:29 +0200
Subject: [PATCH 0166/2760] target/riscv: Restrict SoftMMU mmu_index() to TCG
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Move riscv_cpu_mmu_index() to the TCG-specific file,
convert CPUClass::mmu_index() to TCGCPUOps::mmu_index().

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250401080938.32278-17-philmd@linaro.org>
---
 target/riscv/cpu.c         | 6 ------
 target/riscv/tcg/tcg-cpu.c | 6 ++++++
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 09ded6829a..430b02d2a5 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -1021,11 +1021,6 @@ bool riscv_cpu_has_work(CPUState *cs)
 }
 #endif /* !CONFIG_USER_ONLY */
 
-static int riscv_cpu_mmu_index(CPUState *cs, bool ifetch)
-{
-    return riscv_env_mmu_index(cpu_env(cs), ifetch);
-}
-
 static void riscv_cpu_reset_hold(Object *obj, ResetType type)
 {
 #ifndef CONFIG_USER_ONLY
@@ -3049,7 +3044,6 @@ static void riscv_cpu_common_class_init(ObjectClass *c, void *data)
                                        &mcc->parent_phases);
 
     cc->class_by_name = riscv_cpu_class_by_name;
-    cc->mmu_index = riscv_cpu_mmu_index;
     cc->dump_state = riscv_cpu_dump_state;
     cc->set_pc = riscv_cpu_set_pc;
     cc->get_pc = riscv_cpu_get_pc;
diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index 5aef9eef36..bee7dfd803 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -91,6 +91,11 @@ static const char *cpu_priv_ver_to_str(int priv_ver)
     return priv_spec_str;
 }
 
+static int riscv_cpu_mmu_index(CPUState *cs, bool ifetch)
+{
+    return riscv_env_mmu_index(cpu_env(cs), ifetch);
+}
+
 static void riscv_cpu_synchronize_from_tb(CPUState *cs,
                                           const TranslationBlock *tb)
 {
@@ -138,6 +143,7 @@ static const TCGCPUOps riscv_tcg_ops = {
     .translate_code = riscv_translate_code,
     .synchronize_from_tb = riscv_cpu_synchronize_from_tb,
     .restore_state_to_opc = riscv_restore_state_to_opc,
+    .mmu_index = riscv_cpu_mmu_index,
 
 #ifndef CONFIG_USER_ONLY
     .tlb_fill = riscv_cpu_tlb_fill,

From f1a1c2b9586f6402fa1447c611c9f2d77e648ce9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 1 Apr 2025 10:09:30 +0200
Subject: [PATCH 0167/2760] target/rx: Restrict SoftMMU mmu_index() to TCG
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250401080938.32278-18-philmd@linaro.org>
---
 target/rx/cpu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/rx/cpu.c b/target/rx/cpu.c
index a240b3b3ce..51743020d4 100644
--- a/target/rx/cpu.c
+++ b/target/rx/cpu.c
@@ -207,6 +207,7 @@ static const TCGCPUOps rx_tcg_ops = {
     .translate_code = rx_translate_code,
     .synchronize_from_tb = rx_cpu_synchronize_from_tb,
     .restore_state_to_opc = rx_restore_state_to_opc,
+    .mmu_index = rx_cpu_mmu_index,
     .tlb_fill = rx_cpu_tlb_fill,
 
     .cpu_exec_interrupt = rx_cpu_exec_interrupt,
@@ -227,7 +228,6 @@ static void rx_cpu_class_init(ObjectClass *klass, void *data)
                                        &rcc->parent_phases);
 
     cc->class_by_name = rx_cpu_class_by_name;
-    cc->mmu_index = rx_cpu_mmu_index;
     cc->dump_state = rx_cpu_dump_state;
     cc->set_pc = rx_cpu_set_pc;
     cc->get_pc = rx_cpu_get_pc;

From 96a786ed038f015c4f6293e2b3a641941a0e9f19 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 1 Apr 2025 10:09:31 +0200
Subject: [PATCH 0168/2760] target/s390x: Restrict SoftMMU mmu_index() to TCG
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Convert CPUClass::mmu_index() to TCGCPUOps::mmu_index(),
restricting s390x_cpu_mmu_index() to TCG #ifdef.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250401080938.32278-19-philmd@linaro.org>
---
 target/s390x/cpu.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
index 1f75629ddc..d15b1943e0 100644
--- a/target/s390x/cpu.c
+++ b/target/s390x/cpu.c
@@ -126,11 +126,6 @@ static vaddr s390_cpu_get_pc(CPUState *cs)
     return cpu->env.psw.addr;
 }
 
-static int s390x_cpu_mmu_index(CPUState *cs, bool ifetch)
-{
-    return s390x_env_mmu_index(cpu_env(cs), ifetch);
-}
-
 static void s390_query_cpu_fast(CPUState *cpu, CpuInfoFast *value)
 {
     S390CPU *s390_cpu = S390_CPU(cpu);
@@ -308,6 +303,11 @@ static const Property s390x_cpu_properties[] = {
 #ifdef CONFIG_TCG
 #include "accel/tcg/cpu-ops.h"
 
+static int s390x_cpu_mmu_index(CPUState *cs, bool ifetch)
+{
+    return s390x_env_mmu_index(cpu_env(cs), ifetch);
+}
+
 void cpu_get_tb_cpu_state(CPUS390XState *env, vaddr *pc,
                           uint64_t *cs_base, uint32_t *pflags)
 {
@@ -348,6 +348,7 @@ static const TCGCPUOps s390_tcg_ops = {
     .initialize = s390x_translate_init,
     .translate_code = s390x_translate_code,
     .restore_state_to_opc = s390x_restore_state_to_opc,
+    .mmu_index = s390x_cpu_mmu_index,
 
 #ifdef CONFIG_USER_ONLY
     .record_sigsegv = s390_cpu_record_sigsegv,
@@ -378,7 +379,6 @@ static void s390_cpu_class_init(ObjectClass *oc, void *data)
                                        &scc->parent_phases);
 
     cc->class_by_name = s390_cpu_class_by_name;
-    cc->mmu_index = s390x_cpu_mmu_index;
     cc->dump_state = s390_cpu_dump_state;
     cc->query_cpu_fast = s390_query_cpu_fast;
     cc->set_pc = s390_cpu_set_pc;

From 32a84b306fe216986d8c78f60571a073f224e4b2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 1 Apr 2025 10:09:32 +0200
Subject: [PATCH 0169/2760] target/sh4: Restrict SoftMMU mmu_index() to TCG
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250401080938.32278-20-philmd@linaro.org>
---
 target/sh4/cpu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
index ce84bdf539..df093988cb 100644
--- a/target/sh4/cpu.c
+++ b/target/sh4/cpu.c
@@ -266,6 +266,7 @@ static const TCGCPUOps superh_tcg_ops = {
     .translate_code = sh4_translate_code,
     .synchronize_from_tb = superh_cpu_synchronize_from_tb,
     .restore_state_to_opc = superh_restore_state_to_opc,
+    .mmu_index = sh4_cpu_mmu_index,
 
 #ifndef CONFIG_USER_ONLY
     .tlb_fill = superh_cpu_tlb_fill,
@@ -291,7 +292,6 @@ static void superh_cpu_class_init(ObjectClass *oc, void *data)
                                        &scc->parent_phases);
 
     cc->class_by_name = superh_cpu_class_by_name;
-    cc->mmu_index = sh4_cpu_mmu_index;
     cc->dump_state = superh_cpu_dump_state;
     cc->set_pc = superh_cpu_set_pc;
     cc->get_pc = superh_cpu_get_pc;

From f34769a536c80753442f14f40387e2a4c936fd67 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 1 Apr 2025 10:09:33 +0200
Subject: [PATCH 0170/2760] target/sparc: Restrict SoftMMU mmu_index() to TCG
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250401080938.32278-21-philmd@linaro.org>
---
 target/sparc/cpu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
index 57fbf16ad2..af3cec43e7 100644
--- a/target/sparc/cpu.c
+++ b/target/sparc/cpu.c
@@ -1005,6 +1005,7 @@ static const TCGCPUOps sparc_tcg_ops = {
     .translate_code = sparc_translate_code,
     .synchronize_from_tb = sparc_cpu_synchronize_from_tb,
     .restore_state_to_opc = sparc_restore_state_to_opc,
+    .mmu_index = sparc_cpu_mmu_index,
 
 #ifndef CONFIG_USER_ONLY
     .tlb_fill = sparc_cpu_tlb_fill,
@@ -1033,7 +1034,6 @@ static void sparc_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = sparc_cpu_class_by_name;
     cc->parse_features = sparc_cpu_parse_features;
-    cc->mmu_index = sparc_cpu_mmu_index;
     cc->dump_state = sparc_cpu_dump_state;
 #if !defined(TARGET_SPARC64) && !defined(CONFIG_USER_ONLY)
     cc->memory_rw_debug = sparc_cpu_memory_rw_debug;

From 46708ccec1cd4bb2c022bf97a67affb5a4bea6f7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 1 Apr 2025 10:09:34 +0200
Subject: [PATCH 0171/2760] target/tricore: Restrict SoftMMU mmu_index() to TCG
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250401080938.32278-22-philmd@linaro.org>
---
 target/tricore/cpu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/tricore/cpu.c b/target/tricore/cpu.c
index 16acc4ecb9..833a93d37a 100644
--- a/target/tricore/cpu.c
+++ b/target/tricore/cpu.c
@@ -176,6 +176,7 @@ static const TCGCPUOps tricore_tcg_ops = {
     .translate_code = tricore_translate_code,
     .synchronize_from_tb = tricore_cpu_synchronize_from_tb,
     .restore_state_to_opc = tricore_restore_state_to_opc,
+    .mmu_index = tricore_cpu_mmu_index,
     .tlb_fill = tricore_cpu_tlb_fill,
     .cpu_exec_interrupt = tricore_cpu_exec_interrupt,
     .cpu_exec_halt = tricore_cpu_has_work,
@@ -194,7 +195,6 @@ static void tricore_cpu_class_init(ObjectClass *c, void *data)
     resettable_class_set_parent_phases(rc, NULL, tricore_cpu_reset_hold, NULL,
                                        &mcc->parent_phases);
     cc->class_by_name = tricore_cpu_class_by_name;
-    cc->mmu_index = tricore_cpu_mmu_index;
 
     cc->gdb_read_register = tricore_cpu_gdb_read_register;
     cc->gdb_write_register = tricore_cpu_gdb_write_register;

From befb31d349e1761855a24023f21aab4207ce5392 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 1 Apr 2025 10:09:35 +0200
Subject: [PATCH 0172/2760] target/xtensa: Restrict SoftMMU mmu_index() to TCG
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250401080938.32278-23-philmd@linaro.org>
---
 target/xtensa/cpu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
index ec6a0a8b66..51f9ee9e89 100644
--- a/target/xtensa/cpu.c
+++ b/target/xtensa/cpu.c
@@ -236,6 +236,7 @@ static const TCGCPUOps xtensa_tcg_ops = {
     .translate_code = xtensa_translate_code,
     .debug_excp_handler = xtensa_breakpoint_handler,
     .restore_state_to_opc = xtensa_restore_state_to_opc,
+    .mmu_index = xtensa_cpu_mmu_index,
 
 #ifndef CONFIG_USER_ONLY
     .tlb_fill = xtensa_cpu_tlb_fill,
@@ -262,7 +263,6 @@ static void xtensa_cpu_class_init(ObjectClass *oc, void *data)
                                        &xcc->parent_phases);
 
     cc->class_by_name = xtensa_cpu_class_by_name;
-    cc->mmu_index = xtensa_cpu_mmu_index;
     cc->dump_state = xtensa_cpu_dump_state;
     cc->set_pc = xtensa_cpu_set_pc;
     cc->get_pc = xtensa_cpu_get_pc;

From 43d6a56a0574775c1b5ce5c5ad0c7f9dded83c87 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 3 Apr 2025 08:44:13 -0700
Subject: [PATCH 0173/2760] target/hexagon: Implement TCGCPUOps.mmu_index
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This hook is about to become mandatory.  Since hexagon
is still user-only, the implementation is trivial.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Brian Cain <brian.cain@oss.qualcomm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/hexagon/cpu.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/target/hexagon/cpu.c b/target/hexagon/cpu.c
index 766b678651..ad1f303fbc 100644
--- a/target/hexagon/cpu.c
+++ b/target/hexagon/cpu.c
@@ -313,6 +313,11 @@ static void hexagon_cpu_realize(DeviceState *dev, Error **errp)
     mcc->parent_realize(dev, errp);
 }
 
+static int hexagon_cpu_mmu_index(CPUState *cs, bool ifetch)
+{
+    return MMU_USER_IDX;
+}
+
 static void hexagon_cpu_init(Object *obj)
 {
 }
@@ -324,6 +329,7 @@ static const TCGCPUOps hexagon_tcg_ops = {
     .translate_code = hexagon_translate_code,
     .synchronize_from_tb = hexagon_cpu_synchronize_from_tb,
     .restore_state_to_opc = hexagon_restore_state_to_opc,
+    .mmu_index = hexagon_cpu_mmu_index,
 };
 
 static void hexagon_cpu_class_init(ObjectClass *c, void *data)

From 42fec1bbf58a288e86314e495716d609928712df Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 1 Apr 2025 10:09:36 +0200
Subject: [PATCH 0174/2760] hw/core/cpu: Remove CPUClass::mmu_index()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

All targets have been converted to TCGCPUOps::mmu_index(),
remove the now unused CPUClass::mmu_index().

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250401080938.32278-24-philmd@linaro.org>
---
 accel/tcg/cpu-exec.c              | 1 +
 include/accel/tcg/cpu-mmu-index.h | 4 +---
 include/hw/core/cpu.h             | 2 --
 3 files changed, 2 insertions(+), 5 deletions(-)

diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index 034c2ded6b..9e15105533 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -1075,6 +1075,7 @@ bool tcg_exec_realizefn(CPUState *cpu, Error **errp)
         assert(tcg_ops->cpu_exec_interrupt);
 #endif /* !CONFIG_USER_ONLY */
         assert(tcg_ops->translate_code);
+        assert(tcg_ops->mmu_index);
         tcg_ops->initialize();
         tcg_target_initialized = true;
     }
diff --git a/include/accel/tcg/cpu-mmu-index.h b/include/accel/tcg/cpu-mmu-index.h
index f1ca385d3c..e681a90844 100644
--- a/include/accel/tcg/cpu-mmu-index.h
+++ b/include/accel/tcg/cpu-mmu-index.h
@@ -34,9 +34,7 @@ static inline int cpu_mmu_index(CPUState *cs, bool ifetch)
 # endif
 #endif
 
-    const TCGCPUOps *tcg_ops = cs->cc->tcg_ops;
-    int ret = tcg_ops->mmu_index ? tcg_ops->mmu_index(cs, ifetch)
-                                 : cs->cc->mmu_index(cs, ifetch);
+    int ret = cs->cc->tcg_ops->mmu_index(cs, ifetch);
     tcg_debug_assert(ret >= 0 && ret < NB_MMU_MODES);
     return ret;
 }
diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index 29f6419050..28bd27b8ed 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -104,7 +104,6 @@ struct SysemuCPUOps;
  *                 instantiatable CPU type.
  * @parse_features: Callback to parse command line arguments.
  * @reset_dump_flags: #CPUDumpFlags to use for reset logging.
- * @mmu_index: Callback for choosing softmmu mmu index.
  * @memory_rw_debug: Callback for GDB memory access.
  * @dump_state: Callback for dumping state.
  * @query_cpu_fast:
@@ -151,7 +150,6 @@ struct CPUClass {
     ObjectClass *(*class_by_name)(const char *cpu_model);
     void (*parse_features)(const char *typename, char *str, Error **errp);
 
-    int (*mmu_index)(CPUState *cpu, bool ifetch);
     int (*memory_rw_debug)(CPUState *cpu, vaddr addr,
                            uint8_t *buf, size_t len, bool is_write);
     void (*dump_state)(CPUState *cpu, FILE *, int flags);

From 41fed3c99288451f0528752709151cef5822bd7e Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 27 Mar 2025 17:11:05 -0500
Subject: [PATCH 0175/2760] accel/tcg: Build translator.c twice
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Drop some unnecessary includes.  Change the offsetof expressions
to be based on CPUState instead of ArchCPU.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/meson.build  |  2 +-
 accel/tcg/translator.c | 14 ++++++--------
 2 files changed, 7 insertions(+), 9 deletions(-)

diff --git a/accel/tcg/meson.build b/accel/tcg/meson.build
index 72d4acfe5e..047afa49a2 100644
--- a/accel/tcg/meson.build
+++ b/accel/tcg/meson.build
@@ -8,6 +8,7 @@ tcg_ss.add(files(
   'cpu-exec-common.c',
   'tcg-runtime.c',
   'tcg-runtime-gvec.c',
+  'translator.c',
 ))
 if get_option('plugins')
   tcg_ss.add(files('plugin-gen.c'))
@@ -22,7 +23,6 @@ tcg_specific_ss.add(files(
   'cpu-exec.c',
   'tb-maint.c',
   'translate-all.c',
-  'translator.c',
 ))
 tcg_specific_ss.add(when: 'CONFIG_USER_ONLY', if_true: files('user-exec.c'))
 specific_ss.add_all(when: 'CONFIG_TCG', if_true: tcg_specific_ss)
diff --git a/accel/tcg/translator.c b/accel/tcg/translator.c
index 5f0aa9d56a..c53bbdef99 100644
--- a/accel/tcg/translator.c
+++ b/accel/tcg/translator.c
@@ -11,14 +11,13 @@
 #include "qemu/bswap.h"
 #include "qemu/log.h"
 #include "qemu/error-report.h"
-#include "exec/exec-all.h"
 #include "exec/cpu-ldst-common.h"
 #include "accel/tcg/cpu-mmu-index.h"
+#include "exec/target_page.h"
 #include "exec/translator.h"
 #include "exec/plugin-gen.h"
 #include "tcg/tcg-op-common.h"
 #include "internal-common.h"
-#include "internal-target.h"
 #include "disas/disas.h"
 #include "tb-internal.h"
 
@@ -26,8 +25,7 @@ static void set_can_do_io(DisasContextBase *db, bool val)
 {
     QEMU_BUILD_BUG_ON(sizeof_field(CPUState, neg.can_do_io) != 1);
     tcg_gen_st8_i32(tcg_constant_i32(val), tcg_env,
-                    offsetof(ArchCPU, parent_obj.neg.can_do_io) -
-                    offsetof(ArchCPU, env));
+                    offsetof(CPUState, neg.can_do_io) - sizeof(CPUState));
 }
 
 bool translator_io_start(DisasContextBase *db)
@@ -50,8 +48,8 @@ static TCGOp *gen_tb_start(DisasContextBase *db, uint32_t cflags)
     if ((cflags & CF_USE_ICOUNT) || !(cflags & CF_NOIRQ)) {
         count = tcg_temp_new_i32();
         tcg_gen_ld_i32(count, tcg_env,
-                       offsetof(ArchCPU, parent_obj.neg.icount_decr.u32)
-                       - offsetof(ArchCPU, env));
+                       offsetof(CPUState, neg.icount_decr.u32) -
+                       sizeof(CPUState));
     }
 
     if (cflags & CF_USE_ICOUNT) {
@@ -80,8 +78,8 @@ static TCGOp *gen_tb_start(DisasContextBase *db, uint32_t cflags)
 
     if (cflags & CF_USE_ICOUNT) {
         tcg_gen_st16_i32(count, tcg_env,
-                         offsetof(ArchCPU, parent_obj.neg.icount_decr.u16.low)
-                         - offsetof(ArchCPU, env));
+                         offsetof(CPUState, neg.icount_decr.u16.low) -
+                         sizeof(CPUState));
     }
 
     return icount_start_insn;

From 33646c72c75637fb3a4c5b225dea5d44ed2e4d44 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 27 Mar 2025 15:48:11 -0500
Subject: [PATCH 0176/2760] accel/tcg: Split out tlb-bounds.h
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The CPU_TLB_DYN_{MIN,MAX}_BITS definitions are not required
outside of cputlb.c and translate-all.c.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c        |  1 +
 accel/tcg/tb-internal.h   | 27 ---------------------------
 accel/tcg/tlb-bounds.h    | 32 ++++++++++++++++++++++++++++++++
 accel/tcg/translate-all.c |  1 +
 4 files changed, 34 insertions(+), 27 deletions(-)
 create mode 100644 accel/tcg/tlb-bounds.h

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index 28c47d4872..a717f357d5 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -41,6 +41,7 @@
 #include "trace.h"
 #include "tb-hash.h"
 #include "tb-internal.h"
+#include "tlb-bounds.h"
 #include "internal-common.h"
 #include "internal-target.h"
 #ifdef CONFIG_PLUGIN
diff --git a/accel/tcg/tb-internal.h b/accel/tcg/tb-internal.h
index f9a06bcbab..08538e2896 100644
--- a/accel/tcg/tb-internal.h
+++ b/accel/tcg/tb-internal.h
@@ -22,33 +22,6 @@
  */
 #define GETPC_ADJ   2
 
-#ifdef CONFIG_SOFTMMU
-
-#define CPU_TLB_DYN_MIN_BITS 6
-#define CPU_TLB_DYN_DEFAULT_BITS 8
-
-# if HOST_LONG_BITS == 32
-/* Make sure we do not require a double-word shift for the TLB load */
-#  define CPU_TLB_DYN_MAX_BITS (32 - TARGET_PAGE_BITS)
-# else /* HOST_LONG_BITS == 64 */
-/*
- * Assuming TARGET_PAGE_BITS==12, with 2**22 entries we can cover 2**(22+12) ==
- * 2**34 == 16G of address space. This is roughly what one would expect a
- * TLB to cover in a modern (as of 2018) x86_64 CPU. For instance, Intel
- * Skylake's Level-2 STLB has 16 1G entries.
- * Also, make sure we do not size the TLB past the guest's address space.
- */
-#  ifdef TARGET_PAGE_BITS_VARY
-#   define CPU_TLB_DYN_MAX_BITS                                  \
-    MIN(22, TARGET_VIRT_ADDR_SPACE_BITS - TARGET_PAGE_BITS)
-#  else
-#   define CPU_TLB_DYN_MAX_BITS                                  \
-    MIN_CONST(22, TARGET_VIRT_ADDR_SPACE_BITS - TARGET_PAGE_BITS)
-#  endif
-# endif
-
-#endif /* CONFIG_SOFTMMU */
-
 void tb_lock_page0(tb_page_addr_t);
 
 #ifdef CONFIG_USER_ONLY
diff --git a/accel/tcg/tlb-bounds.h b/accel/tcg/tlb-bounds.h
new file mode 100644
index 0000000000..efd34d4793
--- /dev/null
+++ b/accel/tcg/tlb-bounds.h
@@ -0,0 +1,32 @@
+/*
+ * softmmu size bounds
+ * SPDX-License-Identifier: LGPL-2.1-or-later
+ */
+
+#ifndef ACCEL_TCG_TLB_BOUNDS_H
+#define ACCEL_TCG_TLB_BOUNDS_H
+
+#define CPU_TLB_DYN_MIN_BITS 6
+#define CPU_TLB_DYN_DEFAULT_BITS 8
+
+# if HOST_LONG_BITS == 32
+/* Make sure we do not require a double-word shift for the TLB load */
+#  define CPU_TLB_DYN_MAX_BITS (32 - TARGET_PAGE_BITS)
+# else /* HOST_LONG_BITS == 64 */
+/*
+ * Assuming TARGET_PAGE_BITS==12, with 2**22 entries we can cover 2**(22+12) ==
+ * 2**34 == 16G of address space. This is roughly what one would expect a
+ * TLB to cover in a modern (as of 2018) x86_64 CPU. For instance, Intel
+ * Skylake's Level-2 STLB has 16 1G entries.
+ * Also, make sure we do not size the TLB past the guest's address space.
+ */
+#  ifdef TARGET_PAGE_BITS_VARY
+#   define CPU_TLB_DYN_MAX_BITS                                  \
+    MIN(22, TARGET_VIRT_ADDR_SPACE_BITS - TARGET_PAGE_BITS)
+#  else
+#   define CPU_TLB_DYN_MAX_BITS                                  \
+    MIN_CONST(22, TARGET_VIRT_ADDR_SPACE_BITS - TARGET_PAGE_BITS)
+#  endif
+# endif
+
+#endif /* ACCEL_TCG_TLB_BOUNDS_H */
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index bb161ae61a..87fb6c51d3 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -47,6 +47,7 @@
 #include "exec/page-protection.h"
 #include "exec/mmap-lock.h"
 #include "tb-internal.h"
+#include "tlb-bounds.h"
 #include "exec/translator.h"
 #include "exec/tb-flush.h"
 #include "qemu/bitmap.h"

From 6effa87475986093007e3f2dcfd1f781de0993b1 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 27 Mar 2025 15:05:12 -0500
Subject: [PATCH 0177/2760] include/exec: Redefine tlb-flags with absolute
 values
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Don't base the values on TARGET_PAGE_BITS_MIN, but do verify
that TLB_FLAGS_MASK does not overlap minimum page size.
All targets now have the same placement for these flags,
simplifying mmu management when we enable heterogeneous systems.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c       |  2 ++
 include/exec/tlb-flags.h | 68 +++++++++++++++++++---------------------
 2 files changed, 34 insertions(+), 36 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index a717f357d5..39314e86f3 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -49,6 +49,8 @@
 #endif
 #include "tcg/tcg-ldst.h"
 
+QEMU_BUILD_BUG_ON(TLB_FLAGS_MASK & ((1u < TARGET_PAGE_BITS_MIN) - 1));
+
 /* DEBUG defines, enable DEBUG_TLB_LOG to log to the CPU_LOG_MMU target */
 /* #define DEBUG_TLB */
 /* #define DEBUG_TLB_LOG */
diff --git a/include/exec/tlb-flags.h b/include/exec/tlb-flags.h
index 54a6bae768..357e79095c 100644
--- a/include/exec/tlb-flags.h
+++ b/include/exec/tlb-flags.h
@@ -19,54 +19,29 @@
 #ifndef TLB_FLAGS_H
 #define TLB_FLAGS_H
 
-#include "exec/cpu-defs.h"
+/*
+ * Flags returned for lookup of a TLB virtual address.
+ */
 
 #ifdef CONFIG_USER_ONLY
 
 /*
- * Allow some level of source compatibility with softmmu.  We do not
- * support any of the more exotic features, so only invalid pages may
- * be signaled by probe_access_flags().
+ * Allow some level of source compatibility with softmmu.
+ * Invalid is set when the page does not have requested permissions.
+ * MMIO is set when we want the target helper to use the functional
+ * interface for load/store so that plugins see the access.
  */
-#define TLB_INVALID_MASK    (1 << (TARGET_PAGE_BITS_MIN - 1))
-#define TLB_MMIO            (1 << (TARGET_PAGE_BITS_MIN - 2))
-#define TLB_WATCHPOINT      0
+#define TLB_INVALID_MASK     (1 << 0)
+#define TLB_MMIO             (1 << 1)
+#define TLB_WATCHPOINT       0
 
 #else
 
-/*
- * Flags stored in the low bits of the TLB virtual address.
- * These are defined so that fast path ram access is all zeros.
- * The flags all must be between TARGET_PAGE_BITS and
- * maximum address alignment bit.
- *
- * Use TARGET_PAGE_BITS_MIN so that these bits are constant
- * when TARGET_PAGE_BITS_VARY is in effect.
- *
- * The count, if not the placement of these bits is known
- * to tcg/tcg-op-ldst.c, check_max_alignment().
- */
-/* Zero if TLB entry is valid.  */
-#define TLB_INVALID_MASK    (1 << (TARGET_PAGE_BITS_MIN - 1))
-/*
- * Set if TLB entry references a clean RAM page.  The iotlb entry will
- * contain the page physical address.
- */
-#define TLB_NOTDIRTY        (1 << (TARGET_PAGE_BITS_MIN - 2))
-/* Set if the slow path must be used; more flags in CPUTLBEntryFull. */
-#define TLB_FORCE_SLOW      (1 << (TARGET_PAGE_BITS_MIN - 3))
-
-/*
- * Use this mask to check interception with an alignment mask
- * in a TCG backend.
- */
-#define TLB_FLAGS_MASK \
-    (TLB_INVALID_MASK | TLB_NOTDIRTY | TLB_FORCE_SLOW)
-
 /*
  * Flags stored in CPUTLBEntryFull.slow_flags[x].
  * TLB_FORCE_SLOW must be set in CPUTLBEntry.addr_idx[x].
  */
+
 /* Set if TLB entry requires byte swap.  */
 #define TLB_BSWAP            (1 << 0)
 /* Set if TLB entry contains a watchpoint.  */
@@ -82,6 +57,27 @@
     (TLB_BSWAP | TLB_WATCHPOINT | TLB_CHECK_ALIGNED | \
      TLB_DISCARD_WRITE | TLB_MMIO)
 
+/*
+ * Flags stored in CPUTLBEntry.addr_idx[x].
+ * These must be above the largest alignment (64 bytes),
+ * and below the smallest page size (1024 bytes).
+ * This leaves bits [9:6] available for use.
+ */
+
+/* Zero if TLB entry is valid.  */
+#define TLB_INVALID_MASK     (1 << 6)
+/* Set if TLB entry references a clean RAM page.  */
+#define TLB_NOTDIRTY         (1 << 7)
+/* Set if the slow path must be used; more flags in CPUTLBEntryFull. */
+#define TLB_FORCE_SLOW       (1 << 8)
+
+/*
+ * Use this mask to check interception with an alignment mask
+ * in a TCG backend.
+ */
+#define TLB_FLAGS_MASK \
+    (TLB_INVALID_MASK | TLB_NOTDIRTY | TLB_FORCE_SLOW)
+
 /* The two sets of flags must not overlap. */
 QEMU_BUILD_BUG_ON(TLB_FLAGS_MASK & TLB_SLOW_FLAGS_MASK);
 

From 12eeb04ab4dd98f802ffc503f0da948a8c843086 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 27 Mar 2025 18:52:13 -0500
Subject: [PATCH 0178/2760] page-vary: Move and rename
 qemu_target_page_bits_min

Rename to migration_legacy_page_bits, to make it clear that
we cannot change the value without causing a migration break.
Move to page-vary.h and page-vary-target.c.
Define via TARGET_PAGE_BITS if not TARGET_PAGE_BITS_VARY.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/page-vary.h   | 9 +++++++++
 include/exec/target_page.h | 1 -
 migration/savevm.c         | 6 +++---
 page-target.c              | 5 -----
 page-vary-target.c         | 9 +++++++++
 5 files changed, 21 insertions(+), 9 deletions(-)

diff --git a/include/exec/page-vary.h b/include/exec/page-vary.h
index 54ddde308a..101c25911c 100644
--- a/include/exec/page-vary.h
+++ b/include/exec/page-vary.h
@@ -49,4 +49,13 @@ bool set_preferred_target_page_bits(int bits);
  */
 void finalize_target_page_bits(void);
 
+/**
+ * migration_legacy_page_bits
+ *
+ * For migration compatibility with qemu v2.9, prior to the introduction
+ * of the configuration/target-page-bits section, return the value of
+ * TARGET_PAGE_BITS that the target had then.
+ */
+int migration_legacy_page_bits(void);
+
 #endif /* EXEC_PAGE_VARY_H */
diff --git a/include/exec/target_page.h b/include/exec/target_page.h
index 8e89e5cbe6..e4bd7f7767 100644
--- a/include/exec/target_page.h
+++ b/include/exec/target_page.h
@@ -63,7 +63,6 @@ static inline int qemu_target_page_bits(void)
     return TARGET_PAGE_BITS;
 }
 
-int qemu_target_page_bits_min(void);
 size_t qemu_target_pages_to_MiB(size_t pages);
 
 #endif
diff --git a/migration/savevm.c b/migration/savevm.c
index c33200a33f..0c12e373b4 100644
--- a/migration/savevm.c
+++ b/migration/savevm.c
@@ -50,6 +50,7 @@
 #include "system/cpus.h"
 #include "system/memory.h"
 #include "exec/target_page.h"
+#include "exec/page-vary.h"
 #include "trace.h"
 #include "qemu/iov.h"
 #include "qemu/job.h"
@@ -339,7 +340,7 @@ static int configuration_pre_load(void *opaque)
      * predates the variable-target-page-bits support and is using the
      * minimum possible value for this CPU.
      */
-    state->target_page_bits = qemu_target_page_bits_min();
+    state->target_page_bits = migration_legacy_page_bits();
     return 0;
 }
 
@@ -462,8 +463,7 @@ static const VMStateInfo vmstate_info_capability = {
  */
 static bool vmstate_target_page_bits_needed(void *opaque)
 {
-    return qemu_target_page_bits()
-        > qemu_target_page_bits_min();
+    return qemu_target_page_bits() > migration_legacy_page_bits();
 }
 
 static const VMStateDescription vmstate_target_page_bits = {
diff --git a/page-target.c b/page-target.c
index 321e43d06f..8fcd5443b5 100644
--- a/page-target.c
+++ b/page-target.c
@@ -9,11 +9,6 @@
 #include "qemu/osdep.h"
 #include "exec/target_page.h"
 
-int qemu_target_page_bits_min(void)
-{
-    return TARGET_PAGE_BITS_MIN;
-}
-
 /* Convert target pages to MiB (2**20). */
 size_t qemu_target_pages_to_MiB(size_t pages)
 {
diff --git a/page-vary-target.c b/page-vary-target.c
index 84ddeb7c26..6251d948cf 100644
--- a/page-vary-target.c
+++ b/page-vary-target.c
@@ -23,6 +23,15 @@
 #include "exec/page-vary.h"
 #include "exec/target_page.h"
 
+int migration_legacy_page_bits(void)
+{
+#ifdef TARGET_PAGE_BITS_VARY
+    return TARGET_PAGE_BITS_MIN;
+#else
+    return TARGET_PAGE_BITS;
+#endif
+}
+
 bool set_preferred_target_page_bits(int bits)
 {
 #ifdef TARGET_PAGE_BITS_VARY

From d11bf649d587dec050b6ba900a8f9baea1fe157d Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 28 Mar 2025 14:28:06 -0500
Subject: [PATCH 0179/2760] page-vary: Restrict scope of TARGET_PAGE_BITS_MIN

The only place we really need to know the minimum is within
page-vary-target.c.  Rename the target/arm TARGET_PAGE_BITS_MIN
to TARGET_PAGE_BITS_LEGACY to emphasize what it really means.
Move the assertions related to minimum page size as well.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c         |  1 -
 include/exec/cpu-defs.h    | 10 ++--------
 include/exec/target_page.h |  1 -
 page-vary-target.c         | 39 +++++++++++++++++++++++++++++++++++---
 target/alpha/cpu-param.h   |  1 -
 target/arm/cpu-param.h     |  3 +--
 target/ppc/cpu-param.h     |  1 -
 7 files changed, 39 insertions(+), 17 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index 39314e86f3..0de46903dd 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -49,7 +49,6 @@
 #endif
 #include "tcg/tcg-ldst.h"
 
-QEMU_BUILD_BUG_ON(TLB_FLAGS_MASK & ((1u < TARGET_PAGE_BITS_MIN) - 1));
 
 /* DEBUG defines, enable DEBUG_TLB_LOG to log to the CPU_LOG_MMU target */
 /* #define DEBUG_TLB */
diff --git a/include/exec/cpu-defs.h b/include/exec/cpu-defs.h
index 9f955f53fd..e01acb7c90 100644
--- a/include/exec/cpu-defs.h
+++ b/include/exec/cpu-defs.h
@@ -34,14 +34,8 @@
 #ifndef TARGET_VIRT_ADDR_SPACE_BITS
 # error TARGET_VIRT_ADDR_SPACE_BITS must be defined in cpu-param.h
 #endif
-#ifndef TARGET_PAGE_BITS
-# ifdef TARGET_PAGE_BITS_VARY
-#  ifndef TARGET_PAGE_BITS_MIN
-#   error TARGET_PAGE_BITS_MIN must be defined in cpu-param.h
-#  endif
-# else
-#  error TARGET_PAGE_BITS must be defined in cpu-param.h
-# endif
+#if !defined(TARGET_PAGE_BITS) && !defined(TARGET_PAGE_BITS_VARY)
+# error TARGET_PAGE_BITS must be defined in cpu-param.h
 #endif
 
 #include "exec/target_long.h"
diff --git a/include/exec/target_page.h b/include/exec/target_page.h
index e4bd7f7767..ca0ebbc8bb 100644
--- a/include/exec/target_page.h
+++ b/include/exec/target_page.h
@@ -41,7 +41,6 @@ extern const TargetPageBits target_page;
 # endif
 # define TARGET_PAGE_SIZE    (-(int)TARGET_PAGE_MASK)
 #else
-# define TARGET_PAGE_BITS_MIN TARGET_PAGE_BITS
 # define TARGET_PAGE_SIZE    (1 << TARGET_PAGE_BITS)
 # define TARGET_PAGE_MASK    ((TARGET_PAGE_TYPE)-1 << TARGET_PAGE_BITS)
 #endif
diff --git a/page-vary-target.c b/page-vary-target.c
index 6251d948cf..49a32b4fe5 100644
--- a/page-vary-target.c
+++ b/page-vary-target.c
@@ -23,19 +23,45 @@
 #include "exec/page-vary.h"
 #include "exec/target_page.h"
 
+
+/*
+ * For system mode, the minimum comes from the number of bits
+ * required for maximum alignment (6) and the number of bits
+ * required for TLB_FLAGS_MASK (3).
+ *
+ * For user mode, TARGET_PAGE_BITS_VARY is a hack to allow the target
+ * page size to match the host page size.  Mostly, this reduces the
+ * ordinary target page size to run on a host with 4KiB pages (i.e. x86).
+ * There is no true minimum required by the implementation, but keep the
+ * same minimum as for system mode for sanity.
+ * See linux-user/mmap.c, mmap_h_lt_g and mmap_h_gt_g.
+ */
+#define TARGET_PAGE_BITS_MIN 9
+
+#ifndef TARGET_PAGE_BITS_VARY
+QEMU_BUILD_BUG_ON(TARGET_PAGE_BITS < TARGET_PAGE_BITS_MIN);
+#endif
+
+#ifndef CONFIG_USER_ONLY
+#include "exec/tlb-flags.h"
+
+QEMU_BUILD_BUG_ON(TLB_FLAGS_MASK & ((1u < TARGET_PAGE_BITS_MIN) - 1));
+
 int migration_legacy_page_bits(void)
 {
 #ifdef TARGET_PAGE_BITS_VARY
-    return TARGET_PAGE_BITS_MIN;
+    QEMU_BUILD_BUG_ON(TARGET_PAGE_BITS_LEGACY < TARGET_PAGE_BITS_MIN);
+    return TARGET_PAGE_BITS_LEGACY;
 #else
     return TARGET_PAGE_BITS;
 #endif
 }
+#endif
 
 bool set_preferred_target_page_bits(int bits)
 {
-#ifdef TARGET_PAGE_BITS_VARY
     assert(bits >= TARGET_PAGE_BITS_MIN);
+#ifdef TARGET_PAGE_BITS_VARY
     return set_preferred_target_page_bits_common(bits);
 #else
     return true;
@@ -44,5 +70,12 @@ bool set_preferred_target_page_bits(int bits)
 
 void finalize_target_page_bits(void)
 {
-    finalize_target_page_bits_common(TARGET_PAGE_BITS_MIN);
+#ifndef TARGET_PAGE_BITS_VARY
+    finalize_target_page_bits_common(TARGET_PAGE_BITS);
+#elif defined(CONFIG_USER_ONLY)
+    assert(target_page.bits != 0);
+    finalize_target_page_bits_common(target_page.bits);
+#else
+    finalize_target_page_bits_common(TARGET_PAGE_BITS_LEGACY);
+#endif
 }
diff --git a/target/alpha/cpu-param.h b/target/alpha/cpu-param.h
index ff06e41497..63989e71c0 100644
--- a/target/alpha/cpu-param.h
+++ b/target/alpha/cpu-param.h
@@ -18,7 +18,6 @@
  * a 4k minimum to match x86 host, which can minimize emulation issues.
  */
 # define TARGET_PAGE_BITS_VARY
-# define TARGET_PAGE_BITS_MIN 12
 # define TARGET_VIRT_ADDR_SPACE_BITS  63
 #else
 # define TARGET_PAGE_BITS 13
diff --git a/target/arm/cpu-param.h b/target/arm/cpu-param.h
index 896b35bd6d..a7ae42d17d 100644
--- a/target/arm/cpu-param.h
+++ b/target/arm/cpu-param.h
@@ -24,7 +24,6 @@
 # else
 /* Allow user-only to vary page size from 4k */
 #  define TARGET_PAGE_BITS_VARY
-#  define TARGET_PAGE_BITS_MIN  12
 # endif
 # else
 #  define TARGET_PAGE_BITS 12
@@ -35,7 +34,7 @@
  * have to support 1K tiny pages.
  */
 # define TARGET_PAGE_BITS_VARY
-# define TARGET_PAGE_BITS_MIN  10
+# define TARGET_PAGE_BITS_LEGACY 10
 #endif /* !CONFIG_USER_ONLY */
 
 /* ARM processors have a weak memory model */
diff --git a/target/ppc/cpu-param.h b/target/ppc/cpu-param.h
index 6c4525fdf3..553ad2f4c6 100644
--- a/target/ppc/cpu-param.h
+++ b/target/ppc/cpu-param.h
@@ -33,7 +33,6 @@
 #ifdef CONFIG_USER_ONLY
 /* Allow user-only to vary page size from 4k */
 # define TARGET_PAGE_BITS_VARY
-# define TARGET_PAGE_BITS_MIN 12
 #else
 # define TARGET_PAGE_BITS 12
 #endif

From 33d2cca32b6822767c1f388f0b05b8a046aa556f Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 24 Mar 2025 21:58:47 -0700
Subject: [PATCH 0180/2760] exec/cpu-all: move cpu_copy to linux-user/qemu.h

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250325045915.994760-3-pierrick.bouvier@linaro.org>
---
 include/exec/cpu-all.h | 2 --
 linux-user/qemu.h      | 3 +++
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
index 5c4379f0d0..2aaaf0548d 100644
--- a/include/exec/cpu-all.h
+++ b/include/exec/cpu-all.h
@@ -31,8 +31,6 @@
 #endif
 
 
-CPUArchState *cpu_copy(CPUArchState *env);
-
 #include "cpu.h"
 
 /* Validate correct placement of CPUArchState. */
diff --git a/linux-user/qemu.h b/linux-user/qemu.h
index 5f00750151..948de8431a 100644
--- a/linux-user/qemu.h
+++ b/linux-user/qemu.h
@@ -362,4 +362,7 @@ void *lock_user_string(abi_ulong guest_addr);
 #define unlock_user_struct(host_ptr, guest_addr, copy)		\
     unlock_user(host_ptr, guest_addr, (copy) ? sizeof(*host_ptr) : 0)
 
+/* Clone cpu state */
+CPUArchState *cpu_copy(CPUArchState *env);
+
 #endif /* QEMU_H */

From 8d535c312ca5944622b3b74177eb12d8f6b7a7fa Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 24 Mar 2025 21:58:48 -0700
Subject: [PATCH 0181/2760] include/exec/cpu-all: move compile time check for
 CPUArchState to cpu-target.c
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250325045915.994760-4-pierrick.bouvier@linaro.org>
---
 cpu-target.c           | 5 +++++
 include/exec/cpu-all.h | 4 ----
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/cpu-target.c b/cpu-target.c
index 519b0f8900..7f3b244ed1 100644
--- a/cpu-target.c
+++ b/cpu-target.c
@@ -18,6 +18,7 @@
  */
 
 #include "qemu/osdep.h"
+#include "cpu.h"
 #include "qapi/error.h"
 #include "qemu/error-report.h"
 #include "qemu/qemu-print.h"
@@ -29,6 +30,10 @@
 #include "accel/accel-cpu-target.h"
 #include "trace/trace-root.h"
 
+/* Validate correct placement of CPUArchState. */
+QEMU_BUILD_BUG_ON(offsetof(ArchCPU, parent_obj) != 0);
+QEMU_BUILD_BUG_ON(offsetof(ArchCPU, env) != sizeof(CPUState));
+
 char *cpu_model_from_type(const char *typename)
 {
     const char *suffix = "-" CPU_RESOLVING_TYPE;
diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
index 2aaaf0548d..be462c4410 100644
--- a/include/exec/cpu-all.h
+++ b/include/exec/cpu-all.h
@@ -33,8 +33,4 @@
 
 #include "cpu.h"
 
-/* Validate correct placement of CPUArchState. */
-QEMU_BUILD_BUG_ON(offsetof(ArchCPU, parent_obj) != 0);
-QEMU_BUILD_BUG_ON(offsetof(ArchCPU, env) != sizeof(CPUState));
-
 #endif /* CPU_ALL_H */

From 342e313d6c1a8e6da758bd642777b85af1a0fc37 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 24 Mar 2025 21:58:49 -0700
Subject: [PATCH 0182/2760] exec/cpu-all: remove system/memory include

We include this header where needed. When includes set already have
ifdef CONFIG_USER_ONLY, we add it here, else, we don't condition the
include.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250325045915.994760-5-pierrick.bouvier@linaro.org>
---
 hw/ppc/spapr_ovec.c                  | 1 +
 hw/s390x/ipl.h                       | 1 +
 include/exec/cpu-all.h               | 5 -----
 target/alpha/helper.c                | 1 +
 target/arm/hvf/hvf.c                 | 1 +
 target/arm/internals.h               | 1 +
 target/hppa/cpu.h                    | 1 +
 target/i386/arch_memory_mapping.c    | 1 +
 target/i386/helper.c                 | 1 +
 target/i386/hvf/vmx.h                | 1 +
 target/i386/tcg/system/misc_helper.c | 1 +
 target/i386/tcg/system/tcg-cpu.c     | 1 +
 target/m68k/helper.c                 | 1 +
 target/ppc/excp_helper.c             | 1 +
 target/ppc/mmu-book3s-v3.c           | 1 +
 target/ppc/mmu-hash32.h              | 2 ++
 target/ppc/mmu-hash64.c              | 1 +
 target/ppc/mmu-radix64.c             | 1 +
 target/riscv/cpu_helper.c            | 1 +
 target/sparc/ldst_helper.c           | 1 +
 target/sparc/mmu_helper.c            | 1 +
 target/xtensa/mmu_helper.c           | 1 +
 target/xtensa/op_helper.c            | 1 +
 23 files changed, 23 insertions(+), 5 deletions(-)

diff --git a/hw/ppc/spapr_ovec.c b/hw/ppc/spapr_ovec.c
index 6d6eaf67cb..75ab4fe262 100644
--- a/hw/ppc/spapr_ovec.c
+++ b/hw/ppc/spapr_ovec.c
@@ -16,6 +16,7 @@
 #include "migration/vmstate.h"
 #include "qemu/bitmap.h"
 #include "system/address-spaces.h"
+#include "system/memory.h"
 #include "qemu/error-report.h"
 #include "trace.h"
 #include <libfdt.h>
diff --git a/hw/s390x/ipl.h b/hw/s390x/ipl.h
index c6ecb3433c..6557ac3be5 100644
--- a/hw/s390x/ipl.h
+++ b/hw/s390x/ipl.h
@@ -15,6 +15,7 @@
 
 #include "cpu.h"
 #include "system/address-spaces.h"
+#include "system/memory.h"
 #include "hw/qdev-core.h"
 #include "hw/s390x/ipl/qipl.h"
 #include "qom/object.h"
diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
index be462c4410..399fcbb9d1 100644
--- a/include/exec/cpu-all.h
+++ b/include/exec/cpu-all.h
@@ -26,11 +26,6 @@
 #include "hw/core/cpu.h"
 #include "exec/cpu-defs.h"
 #include "exec/target_page.h"
-#ifndef CONFIG_USER_ONLY
-#include "system/memory.h"
-#endif
-
-
 #include "cpu.h"
 
 #endif /* CPU_ALL_H */
diff --git a/target/alpha/helper.c b/target/alpha/helper.c
index 57cefcba14..f6261a3a53 100644
--- a/target/alpha/helper.c
+++ b/target/alpha/helper.c
@@ -25,6 +25,7 @@
 #include "fpu/softfloat-types.h"
 #include "exec/helper-proto.h"
 #include "qemu/qemu-print.h"
+#include "system/memory.h"
 
 
 #define CONVERT_BIT(X, SRC, DST) \
diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index 93a3f9b53d..34ca36fab5 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -23,6 +23,7 @@
 #include <mach/mach_time.h>
 
 #include "system/address-spaces.h"
+#include "system/memory.h"
 #include "hw/boards.h"
 #include "hw/irq.h"
 #include "qemu/main-loop.h"
diff --git a/target/arm/internals.h b/target/arm/internals.h
index 8756c24c08..01408e40a3 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -28,6 +28,7 @@
 #include "exec/breakpoint.h"
 #include "hw/registerfields.h"
 #include "tcg/tcg-gvec-desc.h"
+#include "system/memory.h"
 #include "syndrome.h"
 #include "cpu-features.h"
 
diff --git a/target/hppa/cpu.h b/target/hppa/cpu.h
index 8b36642b59..f6bf068776 100644
--- a/target/hppa/cpu.h
+++ b/target/hppa/cpu.h
@@ -22,6 +22,7 @@
 
 #include "cpu-qom.h"
 #include "exec/cpu-defs.h"
+#include "system/memory.h"
 #include "qemu/cpu-float.h"
 #include "qemu/interval-tree.h"
 #include "hw/registerfields.h"
diff --git a/target/i386/arch_memory_mapping.c b/target/i386/arch_memory_mapping.c
index ced199862d..a2398c2173 100644
--- a/target/i386/arch_memory_mapping.c
+++ b/target/i386/arch_memory_mapping.c
@@ -14,6 +14,7 @@
 #include "qemu/osdep.h"
 #include "cpu.h"
 #include "system/memory_mapping.h"
+#include "system/memory.h"
 
 /* PAE Paging or IA-32e Paging */
 static void walk_pte(MemoryMappingList *list, AddressSpace *as,
diff --git a/target/i386/helper.c b/target/i386/helper.c
index c07b1b16ea..64d9e8ab9c 100644
--- a/target/i386/helper.c
+++ b/target/i386/helper.c
@@ -25,6 +25,7 @@
 #include "system/runstate.h"
 #ifndef CONFIG_USER_ONLY
 #include "system/hw_accel.h"
+#include "system/memory.h"
 #include "monitor/monitor.h"
 #include "kvm/kvm_i386.h"
 #endif
diff --git a/target/i386/hvf/vmx.h b/target/i386/hvf/vmx.h
index 029516e5c0..26d6029fa5 100644
--- a/target/i386/hvf/vmx.h
+++ b/target/i386/hvf/vmx.h
@@ -34,6 +34,7 @@
 #include "system/hvf_int.h"
 
 #include "system/address-spaces.h"
+#include "system/memory.h"
 
 static inline uint64_t rreg(hv_vcpuid_t vcpu, hv_x86_reg_t reg)
 {
diff --git a/target/i386/tcg/system/misc_helper.c b/target/i386/tcg/system/misc_helper.c
index 0555cf2604..67896c8c87 100644
--- a/target/i386/tcg/system/misc_helper.c
+++ b/target/i386/tcg/system/misc_helper.c
@@ -23,6 +23,7 @@
 #include "exec/helper-proto.h"
 #include "exec/cpu_ldst.h"
 #include "system/address-spaces.h"
+#include "system/memory.h"
 #include "exec/cputlb.h"
 #include "tcg/helper-tcg.h"
 #include "hw/i386/apic.h"
diff --git a/target/i386/tcg/system/tcg-cpu.c b/target/i386/tcg/system/tcg-cpu.c
index ab1f3c7c59..0538a4fd51 100644
--- a/target/i386/tcg/system/tcg-cpu.c
+++ b/target/i386/tcg/system/tcg-cpu.c
@@ -24,6 +24,7 @@
 #include "system/system.h"
 #include "qemu/units.h"
 #include "system/address-spaces.h"
+#include "system/memory.h"
 
 #include "tcg/tcg-cpu.h"
 
diff --git a/target/m68k/helper.c b/target/m68k/helper.c
index 0bf574830f..8251272219 100644
--- a/target/m68k/helper.c
+++ b/target/m68k/helper.c
@@ -25,6 +25,7 @@
 #include "exec/page-protection.h"
 #include "exec/gdbstub.h"
 #include "exec/helper-proto.h"
+#include "system/memory.h"
 #include "gdbstub/helpers.h"
 #include "fpu/softfloat.h"
 #include "qemu/qemu-print.h"
diff --git a/target/ppc/excp_helper.c b/target/ppc/excp_helper.c
index c941c89806..da8b525a41 100644
--- a/target/ppc/excp_helper.c
+++ b/target/ppc/excp_helper.c
@@ -19,6 +19,7 @@
 #include "qemu/osdep.h"
 #include "qemu/main-loop.h"
 #include "qemu/log.h"
+#include "system/memory.h"
 #include "system/tcg.h"
 #include "system/system.h"
 #include "system/runstate.h"
diff --git a/target/ppc/mmu-book3s-v3.c b/target/ppc/mmu-book3s-v3.c
index a812cb5113..3865556310 100644
--- a/target/ppc/mmu-book3s-v3.c
+++ b/target/ppc/mmu-book3s-v3.c
@@ -18,6 +18,7 @@
  */
 
 #include "qemu/osdep.h"
+#include "system/memory.h"
 #include "cpu.h"
 #include "mmu-hash64.h"
 #include "mmu-book3s-v3.h"
diff --git a/target/ppc/mmu-hash32.h b/target/ppc/mmu-hash32.h
index 2838de031c..04c23ea75e 100644
--- a/target/ppc/mmu-hash32.h
+++ b/target/ppc/mmu-hash32.h
@@ -3,6 +3,8 @@
 
 #ifndef CONFIG_USER_ONLY
 
+#include "system/memory.h"
+
 bool ppc_hash32_xlate(PowerPCCPU *cpu, vaddr eaddr, MMUAccessType access_type,
                       hwaddr *raddrp, int *psizep, int *protp, int mmu_idx,
                       bool guest_visible);
diff --git a/target/ppc/mmu-hash64.c b/target/ppc/mmu-hash64.c
index 5ca4faee2a..3ba4810497 100644
--- a/target/ppc/mmu-hash64.c
+++ b/target/ppc/mmu-hash64.c
@@ -25,6 +25,7 @@
 #include "qemu/error-report.h"
 #include "qemu/qemu-print.h"
 #include "system/hw_accel.h"
+#include "system/memory.h"
 #include "kvm_ppc.h"
 #include "mmu-hash64.h"
 #include "exec/log.h"
diff --git a/target/ppc/mmu-radix64.c b/target/ppc/mmu-radix64.c
index 461eda4a3d..4ab5f3bb92 100644
--- a/target/ppc/mmu-radix64.c
+++ b/target/ppc/mmu-radix64.c
@@ -23,6 +23,7 @@
 #include "exec/page-protection.h"
 #include "qemu/error-report.h"
 #include "system/kvm.h"
+#include "system/memory.h"
 #include "kvm_ppc.h"
 #include "exec/log.h"
 #include "internal.h"
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index 0dd8645994..ca58094fb5 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -26,6 +26,7 @@
 #include "exec/cputlb.h"
 #include "exec/exec-all.h"
 #include "exec/page-protection.h"
+#include "system/memory.h"
 #include "instmap.h"
 #include "tcg/tcg-op.h"
 #include "accel/tcg/cpu-ops.h"
diff --git a/target/sparc/ldst_helper.c b/target/sparc/ldst_helper.c
index 45882e25db..8890d2b119 100644
--- a/target/sparc/ldst_helper.c
+++ b/target/sparc/ldst_helper.c
@@ -27,6 +27,7 @@
 #include "exec/cputlb.h"
 #include "exec/page-protection.h"
 #include "exec/cpu_ldst.h"
+#include "system/memory.h"
 #ifdef CONFIG_USER_ONLY
 #include "user/page-protection.h"
 #endif
diff --git a/target/sparc/mmu_helper.c b/target/sparc/mmu_helper.c
index 249b1f6c4c..c5d82a0854 100644
--- a/target/sparc/mmu_helper.c
+++ b/target/sparc/mmu_helper.c
@@ -24,6 +24,7 @@
 #include "accel/tcg/cpu-mmu-index.h"
 #include "exec/page-protection.h"
 #include "exec/tlb-flags.h"
+#include "system/memory.h"
 #include "qemu/qemu-print.h"
 #include "trace.h"
 
diff --git a/target/xtensa/mmu_helper.c b/target/xtensa/mmu_helper.c
index 40b02f0a2c..1ce125794d 100644
--- a/target/xtensa/mmu_helper.c
+++ b/target/xtensa/mmu_helper.c
@@ -36,6 +36,7 @@
 #include "accel/tcg/cpu-mmu-index.h"
 #include "exec/exec-all.h"
 #include "exec/page-protection.h"
+#include "system/memory.h"
 
 #define XTENSA_MPU_SEGMENT_MASK 0x0000001f
 #define XTENSA_MPU_ACC_RIGHTS_MASK 0x00000f00
diff --git a/target/xtensa/op_helper.c b/target/xtensa/op_helper.c
index 028d4e0a1c..c125fa4946 100644
--- a/target/xtensa/op_helper.c
+++ b/target/xtensa/op_helper.c
@@ -31,6 +31,7 @@
 #include "exec/page-protection.h"
 #include "qemu/host-utils.h"
 #include "exec/exec-all.h"
+#include "system/memory.h"
 #include "qemu/atomic.h"
 #include "qemu/timer.h"
 

From e33865f0484cf8f65e12e864d8dc825456174ddc Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 24 Mar 2025 21:58:50 -0700
Subject: [PATCH 0183/2760] exec/cpu-all: remove exec/page-protection include

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250325045915.994760-6-pierrick.bouvier@linaro.org>
---
 include/exec/cpu-all.h | 1 -
 1 file changed, 1 deletion(-)

diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
index 399fcbb9d1..957c86886e 100644
--- a/include/exec/cpu-all.h
+++ b/include/exec/cpu-all.h
@@ -19,7 +19,6 @@
 #ifndef CPU_ALL_H
 #define CPU_ALL_H
 
-#include "exec/page-protection.h"
 #include "exec/cpu-common.h"
 #include "exec/cpu-interrupt.h"
 #include "exec/tswap.h"

From 4533af18b2ed5a6852ffb2dc024784d243f64ba4 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 24 Mar 2025 21:58:51 -0700
Subject: [PATCH 0184/2760] exec/cpu-all: remove tswap include

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250325045915.994760-7-pierrick.bouvier@linaro.org>
---
 include/exec/cpu-all.h               | 1 -
 target/i386/tcg/system/excp_helper.c | 1 +
 target/i386/xsave_helper.c           | 1 +
 target/ppc/mmu-hash64.h              | 2 ++
 target/riscv/vector_helper.c         | 1 +
 5 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
index 957c86886e..bfa039ab76 100644
--- a/include/exec/cpu-all.h
+++ b/include/exec/cpu-all.h
@@ -21,7 +21,6 @@
 
 #include "exec/cpu-common.h"
 #include "exec/cpu-interrupt.h"
-#include "exec/tswap.h"
 #include "hw/core/cpu.h"
 #include "exec/cpu-defs.h"
 #include "exec/target_page.h"
diff --git a/target/i386/tcg/system/excp_helper.c b/target/i386/tcg/system/excp_helper.c
index b0b74df72f..4badd73943 100644
--- a/target/i386/tcg/system/excp_helper.c
+++ b/target/i386/tcg/system/excp_helper.c
@@ -23,6 +23,7 @@
 #include "exec/cputlb.h"
 #include "exec/page-protection.h"
 #include "exec/tlb-flags.h"
+#include "exec/tswap.h"
 #include "tcg/helper-tcg.h"
 
 typedef struct TranslateParams {
diff --git a/target/i386/xsave_helper.c b/target/i386/xsave_helper.c
index 996e9f3bfe..24ab7be8e9 100644
--- a/target/i386/xsave_helper.c
+++ b/target/i386/xsave_helper.c
@@ -5,6 +5,7 @@
 #include "qemu/osdep.h"
 
 #include "cpu.h"
+#include "exec/tswap.h"
 
 void x86_cpu_xsave_all_areas(X86CPU *cpu, void *buf, uint32_t buflen)
 {
diff --git a/target/ppc/mmu-hash64.h b/target/ppc/mmu-hash64.h
index ae8d4b37ae..b8fb12a970 100644
--- a/target/ppc/mmu-hash64.h
+++ b/target/ppc/mmu-hash64.h
@@ -1,6 +1,8 @@
 #ifndef MMU_HASH64_H
 #define MMU_HASH64_H
 
+#include "exec/tswap.h"
+
 #ifndef CONFIG_USER_ONLY
 
 #ifdef TARGET_PPC64
diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
index 83978be060..7fffa23bc8 100644
--- a/target/riscv/vector_helper.c
+++ b/target/riscv/vector_helper.c
@@ -26,6 +26,7 @@
 #include "exec/page-protection.h"
 #include "exec/helper-proto.h"
 #include "exec/tlb-flags.h"
+#include "exec/tswap.h"
 #include "fpu/softfloat.h"
 #include "tcg/tcg-gvec-desc.h"
 #include "internals.h"

From 22a7c2f239229b2ee9fcbac03cb598d9aebb9196 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 24 Mar 2025 21:58:52 -0700
Subject: [PATCH 0185/2760] exec/cpu-all: remove exec/cpu-interrupt include

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250325045915.994760-8-pierrick.bouvier@linaro.org>
---
 accel/tcg/cpu-exec.c    | 1 +
 hw/alpha/typhoon.c      | 1 +
 hw/m68k/next-cube.c     | 1 +
 hw/ppc/ppc.c            | 1 +
 hw/xtensa/pic_cpu.c     | 1 +
 include/exec/cpu-all.h  | 1 -
 target/alpha/cpu.h      | 1 +
 target/arm/cpu.h        | 1 +
 target/avr/cpu.h        | 1 +
 target/hppa/cpu.h       | 1 +
 target/i386/cpu.h       | 1 +
 target/loongarch/cpu.h  | 1 +
 target/m68k/cpu.h       | 1 +
 target/microblaze/cpu.h | 1 +
 target/mips/cpu.h       | 1 +
 target/openrisc/cpu.h   | 1 +
 target/ppc/cpu.h        | 1 +
 target/riscv/cpu.h      | 1 +
 target/rx/cpu.h         | 1 +
 target/s390x/cpu.h      | 1 +
 target/sh4/cpu.h        | 1 +
 target/sparc/cpu.h      | 1 +
 target/xtensa/cpu.h     | 1 +
 23 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index 9e15105533..d388be83d0 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -26,6 +26,7 @@
 #include "trace.h"
 #include "disas/disas.h"
 #include "exec/cpu-common.h"
+#include "exec/cpu-interrupt.h"
 #include "exec/page-protection.h"
 #include "exec/mmap-lock.h"
 #include "exec/translation-block.h"
diff --git a/hw/alpha/typhoon.c b/hw/alpha/typhoon.c
index e8711ae16a..9718e1a579 100644
--- a/hw/alpha/typhoon.c
+++ b/hw/alpha/typhoon.c
@@ -9,6 +9,7 @@
 #include "qemu/osdep.h"
 #include "qemu/module.h"
 #include "qemu/units.h"
+#include "exec/cpu-interrupt.h"
 #include "qapi/error.h"
 #include "hw/pci/pci_host.h"
 #include "cpu.h"
diff --git a/hw/m68k/next-cube.c b/hw/m68k/next-cube.c
index 0570e4a76f..4ae5668331 100644
--- a/hw/m68k/next-cube.c
+++ b/hw/m68k/next-cube.c
@@ -12,6 +12,7 @@
 
 #include "qemu/osdep.h"
 #include "exec/hwaddr.h"
+#include "exec/cpu-interrupt.h"
 #include "system/system.h"
 #include "system/qtest.h"
 #include "hw/irq.h"
diff --git a/hw/ppc/ppc.c b/hw/ppc/ppc.c
index 3a80931538..43d0d0e755 100644
--- a/hw/ppc/ppc.c
+++ b/hw/ppc/ppc.c
@@ -27,6 +27,7 @@
 #include "hw/ppc/ppc.h"
 #include "hw/ppc/ppc_e500.h"
 #include "qemu/timer.h"
+#include "exec/cpu-interrupt.h"
 #include "system/cpus.h"
 #include "qemu/log.h"
 #include "qemu/main-loop.h"
diff --git a/hw/xtensa/pic_cpu.c b/hw/xtensa/pic_cpu.c
index 8cef88c61b..e388531610 100644
--- a/hw/xtensa/pic_cpu.c
+++ b/hw/xtensa/pic_cpu.c
@@ -27,6 +27,7 @@
 
 #include "qemu/osdep.h"
 #include "cpu.h"
+#include "exec/cpu-interrupt.h"
 #include "hw/irq.h"
 #include "qemu/log.h"
 #include "qemu/timer.h"
diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
index bfa039ab76..7b712b2556 100644
--- a/include/exec/cpu-all.h
+++ b/include/exec/cpu-all.h
@@ -20,7 +20,6 @@
 #define CPU_ALL_H
 
 #include "exec/cpu-common.h"
-#include "exec/cpu-interrupt.h"
 #include "hw/core/cpu.h"
 #include "exec/cpu-defs.h"
 #include "exec/target_page.h"
diff --git a/target/alpha/cpu.h b/target/alpha/cpu.h
index 80562adfb5..42788a6a0b 100644
--- a/target/alpha/cpu.h
+++ b/target/alpha/cpu.h
@@ -22,6 +22,7 @@
 
 #include "cpu-qom.h"
 #include "exec/cpu-defs.h"
+#include "exec/cpu-interrupt.h"
 #include "qemu/cpu-float.h"
 
 #define ICACHE_LINE_SIZE 32
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index a8177c6c2e..958a921490 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -25,6 +25,7 @@
 #include "hw/registerfields.h"
 #include "cpu-qom.h"
 #include "exec/cpu-defs.h"
+#include "exec/cpu-interrupt.h"
 #include "exec/gdbstub.h"
 #include "exec/page-protection.h"
 #include "qapi/qapi-types-common.h"
diff --git a/target/avr/cpu.h b/target/avr/cpu.h
index b0518a1f60..c2cc2daa66 100644
--- a/target/avr/cpu.h
+++ b/target/avr/cpu.h
@@ -23,6 +23,7 @@
 
 #include "cpu-qom.h"
 #include "exec/cpu-defs.h"
+#include "exec/cpu-interrupt.h"
 #include "system/memory.h"
 
 #ifdef CONFIG_USER_ONLY
diff --git a/target/hppa/cpu.h b/target/hppa/cpu.h
index f6bf068776..dab58c227f 100644
--- a/target/hppa/cpu.h
+++ b/target/hppa/cpu.h
@@ -22,6 +22,7 @@
 
 #include "cpu-qom.h"
 #include "exec/cpu-defs.h"
+#include "exec/cpu-interrupt.h"
 #include "system/memory.h"
 #include "qemu/cpu-float.h"
 #include "qemu/interval-tree.h"
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index 0ad67fe0fd..778dfd9637 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -24,6 +24,7 @@
 #include "cpu-qom.h"
 #include "kvm/hyperv-proto.h"
 #include "exec/cpu-defs.h"
+#include "exec/cpu-interrupt.h"
 #include "exec/memop.h"
 #include "hw/i386/topology.h"
 #include "qapi/qapi-types-common.h"
diff --git a/target/loongarch/cpu.h b/target/loongarch/cpu.h
index 02ef6ddecb..a924aa01d7 100644
--- a/target/loongarch/cpu.h
+++ b/target/loongarch/cpu.h
@@ -10,6 +10,7 @@
 
 #include "qemu/int128.h"
 #include "exec/cpu-defs.h"
+#include "exec/cpu-interrupt.h"
 #include "fpu/softfloat-types.h"
 #include "hw/registerfields.h"
 #include "qemu/timer.h"
diff --git a/target/m68k/cpu.h b/target/m68k/cpu.h
index ddb0f29f4a..451644a05a 100644
--- a/target/m68k/cpu.h
+++ b/target/m68k/cpu.h
@@ -22,6 +22,7 @@
 #define M68K_CPU_H
 
 #include "exec/cpu-defs.h"
+#include "exec/cpu-interrupt.h"
 #include "qemu/cpu-float.h"
 #include "cpu-qom.h"
 
diff --git a/target/microblaze/cpu.h b/target/microblaze/cpu.h
index e44ddd5307..d29681abed 100644
--- a/target/microblaze/cpu.h
+++ b/target/microblaze/cpu.h
@@ -23,6 +23,7 @@
 #include "cpu-qom.h"
 #include "exec/cpu-defs.h"
 #include "qemu/cpu-float.h"
+#include "exec/cpu-interrupt.h"
 
 typedef struct CPUArchState CPUMBState;
 #if !defined(CONFIG_USER_ONLY)
diff --git a/target/mips/cpu.h b/target/mips/cpu.h
index 9ef72a95d7..29362498ec 100644
--- a/target/mips/cpu.h
+++ b/target/mips/cpu.h
@@ -3,6 +3,7 @@
 
 #include "cpu-qom.h"
 #include "exec/cpu-defs.h"
+#include "exec/cpu-interrupt.h"
 #ifndef CONFIG_USER_ONLY
 #include "system/memory.h"
 #endif
diff --git a/target/openrisc/cpu.h b/target/openrisc/cpu.h
index b97d2ffdd2..c153823b62 100644
--- a/target/openrisc/cpu.h
+++ b/target/openrisc/cpu.h
@@ -22,6 +22,7 @@
 
 #include "cpu-qom.h"
 #include "exec/cpu-defs.h"
+#include "exec/cpu-interrupt.h"
 #include "fpu/softfloat-types.h"
 
 /**
diff --git a/target/ppc/cpu.h b/target/ppc/cpu.h
index 3ee83517dc..7489ba9564 100644
--- a/target/ppc/cpu.h
+++ b/target/ppc/cpu.h
@@ -23,6 +23,7 @@
 #include "qemu/int128.h"
 #include "qemu/cpu-float.h"
 #include "exec/cpu-defs.h"
+#include "exec/cpu-interrupt.h"
 #include "cpu-qom.h"
 #include "qom/object.h"
 #include "hw/registerfields.h"
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index 51e49e03de..556eda57e9 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -24,6 +24,7 @@
 #include "hw/registerfields.h"
 #include "hw/qdev-properties.h"
 #include "exec/cpu-defs.h"
+#include "exec/cpu-interrupt.h"
 #include "exec/gdbstub.h"
 #include "qemu/cpu-float.h"
 #include "qom/object.h"
diff --git a/target/rx/cpu.h b/target/rx/cpu.h
index 349d61c4e4..5f2fcb6656 100644
--- a/target/rx/cpu.h
+++ b/target/rx/cpu.h
@@ -24,6 +24,7 @@
 #include "cpu-qom.h"
 
 #include "exec/cpu-defs.h"
+#include "exec/cpu-interrupt.h"
 #include "qemu/cpu-float.h"
 
 #ifdef CONFIG_USER_ONLY
diff --git a/target/s390x/cpu.h b/target/s390x/cpu.h
index 5b7992deda..0a32ad4c61 100644
--- a/target/s390x/cpu.h
+++ b/target/s390x/cpu.h
@@ -28,6 +28,7 @@
 #include "cpu-qom.h"
 #include "cpu_models.h"
 #include "exec/cpu-defs.h"
+#include "exec/cpu-interrupt.h"
 #include "qemu/cpu-float.h"
 #include "qapi/qapi-types-machine-common.h"
 
diff --git a/target/sh4/cpu.h b/target/sh4/cpu.h
index d536d5d715..18557d8c38 100644
--- a/target/sh4/cpu.h
+++ b/target/sh4/cpu.h
@@ -22,6 +22,7 @@
 
 #include "cpu-qom.h"
 #include "exec/cpu-defs.h"
+#include "exec/cpu-interrupt.h"
 #include "qemu/cpu-float.h"
 
 /* CPU Subtypes */
diff --git a/target/sparc/cpu.h b/target/sparc/cpu.h
index 68f8c21e7c..c0aab69b61 100644
--- a/target/sparc/cpu.h
+++ b/target/sparc/cpu.h
@@ -4,6 +4,7 @@
 #include "qemu/bswap.h"
 #include "cpu-qom.h"
 #include "exec/cpu-defs.h"
+#include "exec/cpu-interrupt.h"
 #include "qemu/cpu-float.h"
 
 #if !defined(TARGET_SPARC64)
diff --git a/target/xtensa/cpu.h b/target/xtensa/cpu.h
index 8d70bfc0cd..6684631478 100644
--- a/target/xtensa/cpu.h
+++ b/target/xtensa/cpu.h
@@ -31,6 +31,7 @@
 #include "cpu-qom.h"
 #include "qemu/cpu-float.h"
 #include "exec/cpu-defs.h"
+#include "exec/cpu-interrupt.h"
 #include "hw/clock.h"
 #include "xtensa-isa.h"
 

From 98c7c1469880e5430e709fd20c5d5daed6b3ad75 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 24 Mar 2025 21:58:56 -0700
Subject: [PATCH 0186/2760] accel/tcg: fix missing includes for
 TCG_GUEST_DEFAULT_MO

We prepare to remove cpu.h from cpu-all.h, which will transitively
remove it from accel/tcg/tb-internal.h, and thus from most of tcg
compilation units.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250325045915.994760-12-pierrick.bouvier@linaro.org>
---
 accel/tcg/internal-target.h | 1 +
 accel/tcg/translate-all.c   | 1 +
 include/exec/poison.h       | 1 +
 3 files changed, 3 insertions(+)

diff --git a/accel/tcg/internal-target.h b/accel/tcg/internal-target.h
index c88f007ffb..05abaeb8e0 100644
--- a/accel/tcg/internal-target.h
+++ b/accel/tcg/internal-target.h
@@ -9,6 +9,7 @@
 #ifndef ACCEL_TCG_INTERNAL_TARGET_H
 #define ACCEL_TCG_INTERNAL_TARGET_H
 
+#include "cpu-param.h"
 #include "exec/exec-all.h"
 #include "exec/translation-block.h"
 #include "tb-internal.h"
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index 87fb6c51d3..ed41fc5d0c 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -43,6 +43,7 @@
 #include "system/ram_addr.h"
 #endif
 
+#include "cpu-param.h"
 #include "exec/cputlb.h"
 #include "exec/page-protection.h"
 #include "exec/mmap-lock.h"
diff --git a/include/exec/poison.h b/include/exec/poison.h
index 4180a5a489..8ec02b40e8 100644
--- a/include/exec/poison.h
+++ b/include/exec/poison.h
@@ -37,6 +37,7 @@
 #pragma GCC poison TARGET_NAME
 #pragma GCC poison TARGET_SUPPORTS_MTTCG
 #pragma GCC poison TARGET_BIG_ENDIAN
+#pragma GCC poison TCG_GUEST_DEFAULT_MO
 
 #pragma GCC poison TARGET_LONG_BITS
 #pragma GCC poison TARGET_FMT_lx

From 4fadca8d649a2aeef8070b973b2a1d5da75dfefb Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 24 Mar 2025 21:58:57 -0700
Subject: [PATCH 0187/2760] accel/tcg: fix missing includes for
 TARGET_HAS_PRECISE_SMC

We prepare to remove cpu.h from cpu-all.h, which will transitively
remove it from accel/tcg/tb-internal.h, and thus from most of tcg
compilation units.

Note: this was caught by a test regression for s390x-softmmu.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250325045915.994760-13-pierrick.bouvier@linaro.org>
---
 accel/tcg/tb-maint.c  | 1 +
 accel/tcg/user-exec.c | 1 +
 include/exec/poison.h | 1 +
 3 files changed, 3 insertions(+)

diff --git a/accel/tcg/tb-maint.c b/accel/tcg/tb-maint.c
index df3438e190..d479f53ae0 100644
--- a/accel/tcg/tb-maint.c
+++ b/accel/tcg/tb-maint.c
@@ -20,6 +20,7 @@
 #include "qemu/osdep.h"
 #include "qemu/interval-tree.h"
 #include "qemu/qtree.h"
+#include "cpu.h"
 #include "exec/cputlb.h"
 #include "exec/log.h"
 #include "exec/exec-all.h"
diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index 72a9809c2d..7f57d8f1af 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -19,6 +19,7 @@
 #include "qemu/osdep.h"
 #include "accel/tcg/cpu-ops.h"
 #include "disas/disas.h"
+#include "cpu.h"
 #include "exec/vaddr.h"
 #include "exec/exec-all.h"
 #include "exec/tlb-flags.h"
diff --git a/include/exec/poison.h b/include/exec/poison.h
index 8ec02b40e8..f267da6083 100644
--- a/include/exec/poison.h
+++ b/include/exec/poison.h
@@ -38,6 +38,7 @@
 #pragma GCC poison TARGET_SUPPORTS_MTTCG
 #pragma GCC poison TARGET_BIG_ENDIAN
 #pragma GCC poison TCG_GUEST_DEFAULT_MO
+#pragma GCC poison TARGET_HAS_PRECISE_SMC
 
 #pragma GCC poison TARGET_LONG_BITS
 #pragma GCC poison TARGET_FMT_lx

From e9659a4da2e5d75b6d100007efe315150a943146 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 24 Mar 2025 21:58:58 -0700
Subject: [PATCH 0188/2760] exec/cpu-all: remove cpu include

Now we made sure important defines are included using their direct
path, we can remove cpu.h from cpu-all.h.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250325045915.994760-14-pierrick.bouvier@linaro.org>
---
 accel/tcg/cpu-exec.c   | 1 +
 include/exec/cpu-all.h | 1 -
 2 files changed, 1 insertion(+), 1 deletion(-)

diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index d388be83d0..8d2b957a3b 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -36,6 +36,7 @@
 #include "exec/log.h"
 #include "qemu/main-loop.h"
 #include "exec/cpu-all.h"
+#include "cpu.h"
 #include "exec/icount.h"
 #include "exec/replay-core.h"
 #include "system/tcg.h"
diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
index 7b712b2556..dae4fbcea8 100644
--- a/include/exec/cpu-all.h
+++ b/include/exec/cpu-all.h
@@ -23,6 +23,5 @@
 #include "hw/core/cpu.h"
 #include "exec/cpu-defs.h"
 #include "exec/target_page.h"
-#include "cpu.h"
 
 #endif /* CPU_ALL_H */

From 9c2ff9cdc9b33472333e9431cbf4417f5f228883 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 31 Mar 2025 16:40:55 -0500
Subject: [PATCH 0189/2760] exec/cpu-all: remove exec/target_page include

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/tb-hash.h                  | 1 +
 hw/alpha/dp264.c                     | 1 +
 hw/arm/boot.c                        | 1 +
 hw/arm/smmuv3.c                      | 1 +
 hw/avr/atmega.c                      | 1 +
 hw/hppa/machine.c                    | 1 +
 hw/hyperv/hyperv.c                   | 1 +
 hw/hyperv/syndbg.c                   | 1 +
 hw/hyperv/vmbus.c                    | 1 +
 hw/i386/multiboot.c                  | 1 +
 hw/i386/pc.c                         | 1 +
 hw/i386/pc_sysfw_ovmf.c              | 1 +
 hw/i386/vapic.c                      | 1 +
 hw/loongarch/virt.c                  | 1 +
 hw/m68k/q800.c                       | 1 +
 hw/m68k/virt.c                       | 1 +
 hw/openrisc/boot.c                   | 1 +
 hw/pci-host/astro.c                  | 1 +
 hw/ppc/e500.c                        | 1 +
 hw/ppc/mac_newworld.c                | 1 +
 hw/ppc/mac_oldworld.c                | 1 +
 hw/ppc/ppc_booke.c                   | 1 +
 hw/ppc/prep.c                        | 1 +
 hw/ppc/spapr_hcall.c                 | 1 +
 hw/riscv/riscv-iommu-pci.c           | 1 +
 hw/riscv/riscv-iommu.c               | 1 +
 hw/s390x/ipl.h                       | 1 +
 hw/s390x/s390-pci-bus.c              | 1 +
 hw/s390x/s390-pci-inst.c             | 1 +
 hw/s390x/s390-skeys.c                | 1 +
 hw/sparc/sun4m.c                     | 1 +
 hw/sparc64/sun4u.c                   | 1 +
 include/exec/cpu-all.h               | 1 -
 monitor/hmp-cmds-target.c            | 1 +
 semihosting/uaccess.c                | 1 +
 target/alpha/cpu.c                   | 1 +
 target/alpha/helper.c                | 1 +
 target/alpha/translate.c             | 1 +
 target/arm/cpu.c                     | 1 +
 target/arm/gdbstub64.c               | 1 +
 target/arm/ptw.c                     | 1 +
 target/arm/tcg/helper-a64.c          | 1 +
 target/arm/tcg/op_helper.c           | 1 +
 target/arm/tcg/sve_helper.c          | 1 +
 target/arm/tcg/tlb-insns.c           | 1 +
 target/arm/tcg/translate-a64.c       | 2 +-
 target/arm/tcg/translate.c           | 1 +
 target/avr/helper.c                  | 1 +
 target/avr/translate.c               | 1 +
 target/hppa/cpu.c                    | 1 +
 target/hppa/mem_helper.c             | 1 +
 target/hppa/translate.c              | 1 +
 target/i386/helper.c                 | 1 +
 target/i386/kvm/hyperv.c             | 1 +
 target/i386/kvm/kvm.c                | 1 +
 target/i386/kvm/xen-emu.c            | 1 +
 target/i386/sev.c                    | 1 +
 target/i386/tcg/access.c             | 1 +
 target/i386/tcg/mpx_helper.c         | 1 +
 target/i386/tcg/system/excp_helper.c | 1 +
 target/i386/tcg/tcg-cpu.c            | 2 +-
 target/i386/tcg/translate.c          | 1 +
 target/loongarch/cpu_helper.c        | 1 +
 target/loongarch/tcg/tlb_helper.c    | 1 +
 target/loongarch/tcg/translate.c     | 1 +
 target/m68k/helper.c                 | 1 +
 target/m68k/translate.c              | 1 +
 target/microblaze/helper.c           | 1 +
 target/microblaze/mmu.c              | 1 +
 target/microblaze/translate.c        | 1 +
 target/mips/tcg/msa_helper.c         | 1 +
 target/mips/tcg/system/cp0_helper.c  | 1 +
 target/mips/tcg/system/tlb_helper.c  | 1 +
 target/mips/tcg/translate.c          | 1 +
 target/openrisc/mmu.c                | 1 +
 target/openrisc/sys_helper.c         | 1 +
 target/openrisc/translate.c          | 2 +-
 target/ppc/mem_helper.c              | 1 +
 target/ppc/mmu-hash32.c              | 1 +
 target/ppc/mmu_common.c              | 1 +
 target/ppc/mmu_helper.c              | 1 +
 target/ppc/translate.c               | 1 +
 target/riscv/cpu_helper.c            | 1 +
 target/riscv/pmp.c                   | 1 +
 target/riscv/tcg/tcg-cpu.c           | 1 +
 target/riscv/translate.c             | 2 +-
 target/riscv/vector_helper.c         | 1 +
 target/rx/cpu.c                      | 1 +
 target/s390x/helper.c                | 1 +
 target/s390x/ioinst.c                | 1 +
 target/s390x/mmu_helper.c            | 1 +
 target/s390x/tcg/excp_helper.c       | 1 +
 target/s390x/tcg/mem_helper.c        | 1 +
 target/s390x/tcg/misc_helper.c       | 1 +
 target/sh4/helper.c                  | 1 +
 target/sh4/translate.c               | 1 +
 target/sparc/ldst_helper.c           | 1 +
 target/sparc/mmu_helper.c            | 1 +
 target/sparc/translate.c             | 1 +
 target/tricore/helper.c              | 1 +
 target/tricore/translate.c           | 1 +
 target/xtensa/helper.c               | 1 +
 target/xtensa/mmu_helper.c           | 1 +
 target/xtensa/translate.c            | 1 +
 target/xtensa/xtensa-semi.c          | 1 +
 105 files changed, 104 insertions(+), 5 deletions(-)

diff --git a/accel/tcg/tb-hash.h b/accel/tcg/tb-hash.h
index a5382f460d..3bc5042d9d 100644
--- a/accel/tcg/tb-hash.h
+++ b/accel/tcg/tb-hash.h
@@ -22,6 +22,7 @@
 
 #include "exec/cpu-defs.h"
 #include "exec/exec-all.h"
+#include "exec/target_page.h"
 #include "exec/translation-block.h"
 #include "qemu/xxhash.h"
 #include "tb-jmp-cache.h"
diff --git a/hw/alpha/dp264.c b/hw/alpha/dp264.c
index 570ea9edf2..19562b5967 100644
--- a/hw/alpha/dp264.c
+++ b/hw/alpha/dp264.c
@@ -8,6 +8,7 @@
 
 #include "qemu/osdep.h"
 #include "cpu.h"
+#include "exec/target_page.h"
 #include "elf.h"
 #include "hw/loader.h"
 #include "alpha_sys.h"
diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index e296b62fa1..d3811b896f 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -14,6 +14,7 @@
 #include <libfdt.h>
 #include "hw/arm/boot.h"
 #include "hw/arm/linux-boot-if.h"
+#include "exec/target_page.h"
 #include "system/kvm.h"
 #include "system/tcg.h"
 #include "system/system.h"
diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index 1a96287ba9..4362ae6aa1 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -25,6 +25,7 @@
 #include "hw/qdev-core.h"
 #include "hw/pci/pci.h"
 #include "cpu.h"
+#include "exec/target_page.h"
 #include "trace.h"
 #include "qemu/log.h"
 #include "qemu/error-report.h"
diff --git a/hw/avr/atmega.c b/hw/avr/atmega.c
index 2e8b8e8c67..c105d2a97c 100644
--- a/hw/avr/atmega.c
+++ b/hw/avr/atmega.c
@@ -12,6 +12,7 @@
 #include "qemu/module.h"
 #include "qemu/units.h"
 #include "qapi/error.h"
+#include "exec/target_page.h"
 #include "system/memory.h"
 #include "system/address-spaces.h"
 #include "system/system.h"
diff --git a/hw/hppa/machine.c b/hw/hppa/machine.c
index c5f247633e..c430bf28dd 100644
--- a/hw/hppa/machine.c
+++ b/hw/hppa/machine.c
@@ -11,6 +11,7 @@
 #include "elf.h"
 #include "hw/loader.h"
 #include "qemu/error-report.h"
+#include "exec/target_page.h"
 #include "system/reset.h"
 #include "system/system.h"
 #include "system/qtest.h"
diff --git a/hw/hyperv/hyperv.c b/hw/hyperv/hyperv.c
index d21e428eae..c487f13e2f 100644
--- a/hw/hyperv/hyperv.c
+++ b/hw/hyperv/hyperv.c
@@ -25,6 +25,7 @@
 #include "target/i386/kvm/hyperv-proto.h"
 #include "target/i386/cpu.h"
 #include "exec/cpu-all.h"
+#include "exec/target_page.h"
 
 struct SynICState {
     DeviceState parent_obj;
diff --git a/hw/hyperv/syndbg.c b/hw/hyperv/syndbg.c
index d3e3917077..a410b55b9a 100644
--- a/hw/hyperv/syndbg.c
+++ b/hw/hyperv/syndbg.c
@@ -15,6 +15,7 @@
 #include "hw/qdev-properties.h"
 #include "hw/loader.h"
 #include "cpu.h"
+#include "exec/target_page.h"
 #include "hw/hyperv/hyperv.h"
 #include "hw/hyperv/vmbus-bridge.h"
 #include "hw/hyperv/hyperv-proto.h"
diff --git a/hw/hyperv/vmbus.c b/hw/hyperv/vmbus.c
index 12a7dc4312..06649b2a2e 100644
--- a/hw/hyperv/vmbus.c
+++ b/hw/hyperv/vmbus.c
@@ -10,6 +10,7 @@
 #include "qemu/osdep.h"
 #include "qemu/error-report.h"
 #include "qemu/main-loop.h"
+#include "exec/target_page.h"
 #include "qapi/error.h"
 #include "migration/vmstate.h"
 #include "hw/qdev-properties.h"
diff --git a/hw/i386/multiboot.c b/hw/i386/multiboot.c
index cd07a05861..6e6b96bc34 100644
--- a/hw/i386/multiboot.c
+++ b/hw/i386/multiboot.c
@@ -29,6 +29,7 @@
 #include "multiboot.h"
 #include "hw/loader.h"
 #include "elf.h"
+#include "exec/target_page.h"
 #include "system/system.h"
 #include "qemu/error-report.h"
 
diff --git a/hw/i386/pc.c b/hw/i386/pc.c
index 1b5d55e96d..5481fe40be 100644
--- a/hw/i386/pc.c
+++ b/hw/i386/pc.c
@@ -24,6 +24,7 @@
 
 #include "qemu/osdep.h"
 #include "qemu/units.h"
+#include "exec/target_page.h"
 #include "hw/i386/pc.h"
 #include "hw/char/serial-isa.h"
 #include "hw/char/parallel.h"
diff --git a/hw/i386/pc_sysfw_ovmf.c b/hw/i386/pc_sysfw_ovmf.c
index 07a4c267fa..da947c3ca4 100644
--- a/hw/i386/pc_sysfw_ovmf.c
+++ b/hw/i386/pc_sysfw_ovmf.c
@@ -26,6 +26,7 @@
 #include "qemu/osdep.h"
 #include "qemu/error-report.h"
 #include "hw/i386/pc.h"
+#include "exec/target_page.h"
 #include "cpu.h"
 
 #define OVMF_TABLE_FOOTER_GUID "96b582de-1fb2-45f7-baea-a366c55a082d"
diff --git a/hw/i386/vapic.c b/hw/i386/vapic.c
index 26aae64e5d..347431eeef 100644
--- a/hw/i386/vapic.c
+++ b/hw/i386/vapic.c
@@ -11,6 +11,7 @@
 
 #include "qemu/osdep.h"
 #include "qemu/module.h"
+#include "exec/target_page.h"
 #include "system/system.h"
 #include "system/cpus.h"
 #include "system/hw_accel.h"
diff --git a/hw/loongarch/virt.c b/hw/loongarch/virt.c
index f1eb42c2c1..39ea5cadd6 100644
--- a/hw/loongarch/virt.c
+++ b/hw/loongarch/virt.c
@@ -8,6 +8,7 @@
 #include "qemu/units.h"
 #include "qemu/datadir.h"
 #include "qapi/error.h"
+#include "exec/target_page.h"
 #include "hw/boards.h"
 #include "hw/char/serial-mm.h"
 #include "system/kvm.h"
diff --git a/hw/m68k/q800.c b/hw/m68k/q800.c
index aeed4c8ddb..c2e365a820 100644
--- a/hw/m68k/q800.c
+++ b/hw/m68k/q800.c
@@ -24,6 +24,7 @@
 #include "qemu/units.h"
 #include "qemu/datadir.h"
 #include "qemu/guest-random.h"
+#include "exec/target_page.h"
 #include "system/system.h"
 #include "cpu.h"
 #include "hw/boards.h"
diff --git a/hw/m68k/virt.c b/hw/m68k/virt.c
index 295a614e16..e74d709a18 100644
--- a/hw/m68k/virt.c
+++ b/hw/m68k/virt.c
@@ -10,6 +10,7 @@
 #include "qemu/osdep.h"
 #include "qemu/units.h"
 #include "qemu/guest-random.h"
+#include "exec/target_page.h"
 #include "system/system.h"
 #include "cpu.h"
 #include "hw/boards.h"
diff --git a/hw/openrisc/boot.c b/hw/openrisc/boot.c
index 0a5881be31..c81efe8138 100644
--- a/hw/openrisc/boot.c
+++ b/hw/openrisc/boot.c
@@ -9,6 +9,7 @@
 #include "qemu/osdep.h"
 #include "cpu.h"
 #include "exec/cpu-defs.h"
+#include "exec/target_page.h"
 #include "elf.h"
 #include "hw/loader.h"
 #include "hw/openrisc/boot.h"
diff --git a/hw/pci-host/astro.c b/hw/pci-host/astro.c
index 039cc3ad01..c6f2d4f494 100644
--- a/hw/pci-host/astro.c
+++ b/hw/pci-host/astro.c
@@ -35,6 +35,7 @@
 #include "target/hppa/cpu.h"
 #include "trace.h"
 #include "qom/object.h"
+#include "exec/target_page.h"
 
 /*
  * Helper functions
diff --git a/hw/ppc/e500.c b/hw/ppc/e500.c
index 69269aa24c..809078a2c3 100644
--- a/hw/ppc/e500.c
+++ b/hw/ppc/e500.c
@@ -18,6 +18,7 @@
 #include "qemu/datadir.h"
 #include "qemu/units.h"
 #include "qemu/guest-random.h"
+#include "exec/target_page.h"
 #include "qapi/error.h"
 #include "e500.h"
 #include "e500-ccsr.h"
diff --git a/hw/ppc/mac_newworld.c b/hw/ppc/mac_newworld.c
index 2d5309d6f5..21b2fc569a 100644
--- a/hw/ppc/mac_newworld.c
+++ b/hw/ppc/mac_newworld.c
@@ -50,6 +50,7 @@
 #include "qemu/datadir.h"
 #include "qemu/units.h"
 #include "qapi/error.h"
+#include "exec/target_page.h"
 #include "hw/ppc/ppc.h"
 #include "hw/qdev-properties.h"
 #include "hw/nvram/mac_nvram.h"
diff --git a/hw/ppc/mac_oldworld.c b/hw/ppc/mac_oldworld.c
index b5814690f5..0d34e6bfda 100644
--- a/hw/ppc/mac_oldworld.c
+++ b/hw/ppc/mac_oldworld.c
@@ -28,6 +28,7 @@
 #include "qemu/datadir.h"
 #include "qemu/units.h"
 #include "qapi/error.h"
+#include "exec/target_page.h"
 #include "hw/ppc/ppc.h"
 #include "hw/qdev-properties.h"
 #include "hw/boards.h"
diff --git a/hw/ppc/ppc_booke.c b/hw/ppc/ppc_booke.c
index 925e670ba0..3872ae2822 100644
--- a/hw/ppc/ppc_booke.c
+++ b/hw/ppc/ppc_booke.c
@@ -24,6 +24,7 @@
 
 #include "qemu/osdep.h"
 #include "cpu.h"
+#include "exec/target_page.h"
 #include "hw/ppc/ppc.h"
 #include "qemu/timer.h"
 #include "system/reset.h"
diff --git a/hw/ppc/prep.c b/hw/ppc/prep.c
index 3e68d8e6e2..739526335c 100644
--- a/hw/ppc/prep.c
+++ b/hw/ppc/prep.c
@@ -39,6 +39,7 @@
 #include "hw/rtc/mc146818rtc.h"
 #include "hw/isa/pc87312.h"
 #include "hw/qdev-properties.h"
+#include "exec/target_page.h"
 #include "system/kvm.h"
 #include "system/reset.h"
 #include "trace.h"
diff --git a/hw/ppc/spapr_hcall.c b/hw/ppc/spapr_hcall.c
index 406aea4ecb..a4f399c4ff 100644
--- a/hw/ppc/spapr_hcall.c
+++ b/hw/ppc/spapr_hcall.c
@@ -9,6 +9,7 @@
 #include "qemu/module.h"
 #include "qemu/error-report.h"
 #include "exec/tb-flush.h"
+#include "exec/target_page.h"
 #include "helper_regs.h"
 #include "hw/ppc/ppc.h"
 #include "hw/ppc/spapr.h"
diff --git a/hw/riscv/riscv-iommu-pci.c b/hw/riscv/riscv-iommu-pci.c
index 12451869e4..a795464803 100644
--- a/hw/riscv/riscv-iommu-pci.c
+++ b/hw/riscv/riscv-iommu-pci.c
@@ -17,6 +17,7 @@
  */
 
 #include "qemu/osdep.h"
+#include "exec/target_page.h"
 #include "hw/pci/msi.h"
 #include "hw/pci/msix.h"
 #include "hw/pci/pci_bus.h"
diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c
index 76e0fcd873..65411b3e4c 100644
--- a/hw/riscv/riscv-iommu.c
+++ b/hw/riscv/riscv-iommu.c
@@ -18,6 +18,7 @@
 
 #include "qemu/osdep.h"
 #include "qom/object.h"
+#include "exec/target_page.h"
 #include "hw/pci/pci_bus.h"
 #include "hw/pci/pci_device.h"
 #include "hw/qdev-properties.h"
diff --git a/hw/s390x/ipl.h b/hw/s390x/ipl.h
index 6557ac3be5..cb55101f06 100644
--- a/hw/s390x/ipl.h
+++ b/hw/s390x/ipl.h
@@ -14,6 +14,7 @@
 #define HW_S390_IPL_H
 
 #include "cpu.h"
+#include "exec/target_page.h"
 #include "system/address-spaces.h"
 #include "system/memory.h"
 #include "hw/qdev-core.h"
diff --git a/hw/s390x/s390-pci-bus.c b/hw/s390x/s390-pci-bus.c
index 2591ee49c1..4365f8ed1e 100644
--- a/hw/s390x/s390-pci-bus.c
+++ b/hw/s390x/s390-pci-bus.c
@@ -14,6 +14,7 @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "qapi/visitor.h"
+#include "exec/target_page.h"
 #include "hw/s390x/s390-pci-bus.h"
 #include "hw/s390x/s390-pci-inst.h"
 #include "hw/s390x/s390-pci-kvm.h"
diff --git a/hw/s390x/s390-pci-inst.c b/hw/s390x/s390-pci-inst.c
index b4e003c19c..b5dddb22b8 100644
--- a/hw/s390x/s390-pci-inst.c
+++ b/hw/s390x/s390-pci-inst.c
@@ -13,6 +13,7 @@
 
 #include "qemu/osdep.h"
 #include "exec/memop.h"
+#include "exec/target_page.h"
 #include "system/memory.h"
 #include "qemu/error-report.h"
 #include "system/hw_accel.h"
diff --git a/hw/s390x/s390-skeys.c b/hw/s390x/s390-skeys.c
index 0bb90fed04..d437fe070d 100644
--- a/hw/s390x/s390-skeys.c
+++ b/hw/s390x/s390-skeys.c
@@ -11,6 +11,7 @@
 
 #include "qemu/osdep.h"
 #include "qemu/units.h"
+#include "exec/target_page.h"
 #include "hw/s390x/s390-virtio-ccw.h"
 #include "hw/qdev-properties.h"
 #include "hw/s390x/storage-keys.h"
diff --git a/hw/sparc/sun4m.c b/hw/sparc/sun4m.c
index 5aaafb40da..edbf19d958 100644
--- a/hw/sparc/sun4m.c
+++ b/hw/sparc/sun4m.c
@@ -27,6 +27,7 @@
 #include "qapi/error.h"
 #include "qemu/datadir.h"
 #include "cpu.h"
+#include "exec/target_page.h"
 #include "hw/sysbus.h"
 #include "qemu/error-report.h"
 #include "qemu/timer.h"
diff --git a/hw/sparc64/sun4u.c b/hw/sparc64/sun4u.c
index d3cb7270ff..becdf3ea98 100644
--- a/hw/sparc64/sun4u.c
+++ b/hw/sparc64/sun4u.c
@@ -28,6 +28,7 @@
 #include "qapi/error.h"
 #include "qemu/datadir.h"
 #include "cpu.h"
+#include "exec/target_page.h"
 #include "hw/irq.h"
 #include "hw/pci/pci.h"
 #include "hw/pci/pci_bridge.h"
diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
index dae4fbcea8..e7c8b8672f 100644
--- a/include/exec/cpu-all.h
+++ b/include/exec/cpu-all.h
@@ -22,6 +22,5 @@
 #include "exec/cpu-common.h"
 #include "hw/core/cpu.h"
 #include "exec/cpu-defs.h"
-#include "exec/target_page.h"
 
 #endif /* CPU_ALL_H */
diff --git a/monitor/hmp-cmds-target.c b/monitor/hmp-cmds-target.c
index 011a367357..8eaf70d9c9 100644
--- a/monitor/hmp-cmds-target.c
+++ b/monitor/hmp-cmds-target.c
@@ -31,6 +31,7 @@
 #include "qapi/error.h"
 #include "qobject/qdict.h"
 #include "system/hw_accel.h"
+#include "exec/target_page.h"
 
 /* Set the current CPU defined by the user. Callers must hold BQL. */
 int monitor_set_cpu(Monitor *mon, int cpu_index)
diff --git a/semihosting/uaccess.c b/semihosting/uaccess.c
index ccb0c96070..f51a253626 100644
--- a/semihosting/uaccess.c
+++ b/semihosting/uaccess.c
@@ -11,6 +11,7 @@
 #include "exec/cpu-all.h"
 #include "accel/tcg/cpu-mmu-index.h"
 #include "exec/exec-all.h"
+#include "exec/target_page.h"
 #include "exec/tlb-flags.h"
 #include "semihosting/uaccess.h"
 
diff --git a/target/alpha/cpu.c b/target/alpha/cpu.c
index 56c96b1c4d..99d839a279 100644
--- a/target/alpha/cpu.c
+++ b/target/alpha/cpu.c
@@ -25,6 +25,7 @@
 #include "cpu.h"
 #include "exec/exec-all.h"
 #include "exec/translation-block.h"
+#include "exec/target_page.h"
 #include "fpu/softfloat.h"
 
 
diff --git a/target/alpha/helper.c b/target/alpha/helper.c
index f6261a3a53..096eac3445 100644
--- a/target/alpha/helper.c
+++ b/target/alpha/helper.c
@@ -22,6 +22,7 @@
 #include "cpu.h"
 #include "exec/cputlb.h"
 #include "exec/page-protection.h"
+#include "exec/target_page.h"
 #include "fpu/softfloat-types.h"
 #include "exec/helper-proto.h"
 #include "qemu/qemu-print.h"
diff --git a/target/alpha/translate.c b/target/alpha/translate.c
index 2156c02214..7f3195a5dc 100644
--- a/target/alpha/translate.c
+++ b/target/alpha/translate.c
@@ -27,6 +27,7 @@
 #include "exec/helper-gen.h"
 #include "exec/translator.h"
 #include "exec/translation-block.h"
+#include "exec/target_page.h"
 #include "exec/log.h"
 
 #define HELPER_H "helper.h"
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index 21e8cf1400..c9e043bc9b 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -34,6 +34,7 @@
 #include "internals.h"
 #include "cpu-features.h"
 #include "exec/exec-all.h"
+#include "exec/target_page.h"
 #include "hw/qdev-properties.h"
 #if !defined(CONFIG_USER_ONLY)
 #include "hw/loader.h"
diff --git a/target/arm/gdbstub64.c b/target/arm/gdbstub64.c
index be38016fc7..64ee9b3b56 100644
--- a/target/arm/gdbstub64.c
+++ b/target/arm/gdbstub64.c
@@ -29,6 +29,7 @@
 #endif
 #ifdef CONFIG_TCG
 #include "accel/tcg/cpu-mmu-index.h"
+#include "exec/target_page.h"
 #endif
 
 int aarch64_cpu_gdb_read_register(CPUState *cs, GByteArray *mem_buf, int n)
diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index 8d4e9e07a9..e0e82ae507 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -12,6 +12,7 @@
 #include "qemu/main-loop.h"
 #include "exec/exec-all.h"
 #include "exec/page-protection.h"
+#include "exec/target_page.h"
 #include "exec/tlb-flags.h"
 #include "cpu.h"
 #include "internals.h"
diff --git a/target/arm/tcg/helper-a64.c b/target/arm/tcg/helper-a64.c
index fa79d19425..507dbc1a44 100644
--- a/target/arm/tcg/helper-a64.c
+++ b/target/arm/tcg/helper-a64.c
@@ -31,6 +31,7 @@
 #include "exec/cpu-common.h"
 #include "exec/exec-all.h"
 #include "exec/cpu_ldst.h"
+#include "exec/target_page.h"
 #include "exec/tlb-flags.h"
 #include "qemu/int128.h"
 #include "qemu/atomic128.h"
diff --git a/target/arm/tcg/op_helper.c b/target/arm/tcg/op_helper.c
index 30786fd1ff..71ba406782 100644
--- a/target/arm/tcg/op_helper.c
+++ b/target/arm/tcg/op_helper.c
@@ -20,6 +20,7 @@
 #include "qemu/main-loop.h"
 #include "cpu.h"
 #include "exec/helper-proto.h"
+#include "exec/target_page.h"
 #include "internals.h"
 #include "cpu-features.h"
 #include "exec/exec-all.h"
diff --git a/target/arm/tcg/sve_helper.c b/target/arm/tcg/sve_helper.c
index e3bed77b48..9b0d40c9e1 100644
--- a/target/arm/tcg/sve_helper.c
+++ b/target/arm/tcg/sve_helper.c
@@ -23,6 +23,7 @@
 #include "exec/exec-all.h"
 #include "exec/page-protection.h"
 #include "exec/helper-proto.h"
+#include "exec/target_page.h"
 #include "exec/tlb-flags.h"
 #include "tcg/tcg-gvec-desc.h"
 #include "fpu/softfloat.h"
diff --git a/target/arm/tcg/tlb-insns.c b/target/arm/tcg/tlb-insns.c
index 630a481f0f..0407ad5542 100644
--- a/target/arm/tcg/tlb-insns.c
+++ b/target/arm/tcg/tlb-insns.c
@@ -8,6 +8,7 @@
 #include "qemu/osdep.h"
 #include "qemu/log.h"
 #include "exec/cputlb.h"
+#include "exec/target_page.h"
 #include "cpu.h"
 #include "internals.h"
 #include "cpu-features.h"
diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index 39014325df..43408c71bb 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -17,8 +17,8 @@
  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  */
 #include "qemu/osdep.h"
-
 #include "exec/exec-all.h"
+#include "exec/target_page.h"
 #include "translate.h"
 #include "translate-a64.h"
 #include "qemu/log.h"
diff --git a/target/arm/tcg/translate.c b/target/arm/tcg/translate.c
index d280018138..273b860d57 100644
--- a/target/arm/tcg/translate.c
+++ b/target/arm/tcg/translate.c
@@ -27,6 +27,7 @@
 #include "semihosting/semihost.h"
 #include "cpregs.h"
 #include "exec/helper-proto.h"
+#include "exec/target_page.h"
 
 #define HELPER_H "helper.h"
 #include "exec/helper-info.c.inc"
diff --git a/target/avr/helper.c b/target/avr/helper.c
index f23fa3e8ba..32cbf17919 100644
--- a/target/avr/helper.c
+++ b/target/avr/helper.c
@@ -26,6 +26,7 @@
 #include "accel/tcg/getpc.h"
 #include "exec/cputlb.h"
 #include "exec/page-protection.h"
+#include "exec/target_page.h"
 #include "exec/cpu_ldst.h"
 #include "exec/helper-proto.h"
 
diff --git a/target/avr/translate.c b/target/avr/translate.c
index 0490936cd5..b9c592c899 100644
--- a/target/avr/translate.c
+++ b/target/avr/translate.c
@@ -29,6 +29,7 @@
 #include "exec/helper-gen.h"
 #include "exec/log.h"
 #include "exec/translator.h"
+#include "exec/target_page.h"
 
 #define HELPER_H "helper.h"
 #include "exec/helper-info.c.inc"
diff --git a/target/hppa/cpu.c b/target/hppa/cpu.c
index 09a6aaa3dd..51bff0c5d6 100644
--- a/target/hppa/cpu.c
+++ b/target/hppa/cpu.c
@@ -26,6 +26,7 @@
 #include "qemu/module.h"
 #include "exec/exec-all.h"
 #include "exec/translation-block.h"
+#include "exec/target_page.h"
 #include "fpu/softfloat.h"
 #include "tcg/tcg.h"
 #include "hw/hppa/hppa_hardware.h"
diff --git a/target/hppa/mem_helper.c b/target/hppa/mem_helper.c
index a1ade9079e..554d7bf4d1 100644
--- a/target/hppa/mem_helper.c
+++ b/target/hppa/mem_helper.c
@@ -24,6 +24,7 @@
 #include "exec/cputlb.h"
 #include "accel/tcg/cpu-mmu-index.h"
 #include "exec/page-protection.h"
+#include "exec/target_page.h"
 #include "exec/helper-proto.h"
 #include "hw/core/cpu.h"
 #include "trace.h"
diff --git a/target/hppa/translate.c b/target/hppa/translate.c
index 0d0d1bc99b..14f3833322 100644
--- a/target/hppa/translate.c
+++ b/target/hppa/translate.c
@@ -28,6 +28,7 @@
 #include "exec/helper-gen.h"
 #include "exec/translator.h"
 #include "exec/translation-block.h"
+#include "exec/target_page.h"
 #include "exec/log.h"
 
 #define HELPER_H "helper.h"
diff --git a/target/i386/helper.c b/target/i386/helper.c
index 64d9e8ab9c..197fdac7dd 100644
--- a/target/i386/helper.c
+++ b/target/i386/helper.c
@@ -22,6 +22,7 @@
 #include "cpu.h"
 #include "exec/cputlb.h"
 #include "exec/translation-block.h"
+#include "exec/target_page.h"
 #include "system/runstate.h"
 #ifndef CONFIG_USER_ONLY
 #include "system/hw_accel.h"
diff --git a/target/i386/kvm/hyperv.c b/target/i386/kvm/hyperv.c
index 70b89cacf9..9865120cc4 100644
--- a/target/i386/kvm/hyperv.c
+++ b/target/i386/kvm/hyperv.c
@@ -13,6 +13,7 @@
 
 #include "qemu/osdep.h"
 #include "qemu/main-loop.h"
+#include "exec/target_page.h"
 #include "hyperv.h"
 #include "hw/hyperv/hyperv.h"
 #include "hyperv-proto.h"
diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
index 6c749d4ee8..c9a3c02e3e 100644
--- a/target/i386/kvm/kvm.c
+++ b/target/i386/kvm/kvm.c
@@ -67,6 +67,7 @@
 #include "hw/pci/msix.h"
 #include "migration/blocker.h"
 #include "exec/memattrs.h"
+#include "exec/target_page.h"
 #include "trace.h"
 
 #include CONFIG_DEVICES
diff --git a/target/i386/kvm/xen-emu.c b/target/i386/kvm/xen-emu.c
index b23010374f..284c5ef6f6 100644
--- a/target/i386/kvm/xen-emu.c
+++ b/target/i386/kvm/xen-emu.c
@@ -13,6 +13,7 @@
 #include "qemu/log.h"
 #include "qemu/main-loop.h"
 #include "qemu/error-report.h"
+#include "exec/target_page.h"
 #include "hw/xen/xen.h"
 #include "system/kvm_int.h"
 #include "system/kvm_xen.h"
diff --git a/target/i386/sev.c b/target/i386/sev.c
index ba88976e9f..878dd20f2c 100644
--- a/target/i386/sev.c
+++ b/target/i386/sev.c
@@ -26,6 +26,7 @@
 #include "qemu/uuid.h"
 #include "qemu/error-report.h"
 #include "crypto/hash.h"
+#include "exec/target_page.h"
 #include "system/kvm.h"
 #include "kvm/kvm_i386.h"
 #include "sev.h"
diff --git a/target/i386/tcg/access.c b/target/i386/tcg/access.c
index e68b73a24b..5a4721dcee 100644
--- a/target/i386/tcg/access.c
+++ b/target/i386/tcg/access.c
@@ -5,6 +5,7 @@
 #include "cpu.h"
 #include "exec/cpu_ldst.h"
 #include "exec/exec-all.h"
+#include "exec/target_page.h"
 #include "access.h"
 
 
diff --git a/target/i386/tcg/mpx_helper.c b/target/i386/tcg/mpx_helper.c
index 22423eedcd..b942665adc 100644
--- a/target/i386/tcg/mpx_helper.c
+++ b/target/i386/tcg/mpx_helper.c
@@ -22,6 +22,7 @@
 #include "exec/helper-proto.h"
 #include "exec/cpu_ldst.h"
 #include "exec/exec-all.h"
+#include "exec/target_page.h"
 #include "helper-tcg.h"
 
 
diff --git a/target/i386/tcg/system/excp_helper.c b/target/i386/tcg/system/excp_helper.c
index 4badd73943..a563c9b35e 100644
--- a/target/i386/tcg/system/excp_helper.c
+++ b/target/i386/tcg/system/excp_helper.c
@@ -22,6 +22,7 @@
 #include "exec/cpu_ldst.h"
 #include "exec/cputlb.h"
 #include "exec/page-protection.h"
+#include "exec/target_page.h"
 #include "exec/tlb-flags.h"
 #include "exec/tswap.h"
 #include "tcg/helper-tcg.h"
diff --git a/target/i386/tcg/tcg-cpu.c b/target/i386/tcg/tcg-cpu.c
index 818653ee6d..35b17f2b18 100644
--- a/target/i386/tcg/tcg-cpu.c
+++ b/target/i386/tcg/tcg-cpu.c
@@ -23,7 +23,7 @@
 #include "qemu/accel.h"
 #include "accel/accel-cpu-target.h"
 #include "exec/translation-block.h"
-
+#include "exec/target_page.h"
 #include "tcg-cpu.h"
 
 /* Frob eflags into and out of the CPU temporary format.  */
diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
index 6418d4bb03..1dcc35f5df 100644
--- a/target/i386/tcg/translate.c
+++ b/target/i386/tcg/translate.c
@@ -26,6 +26,7 @@
 #include "tcg/tcg-op.h"
 #include "tcg/tcg-op-gvec.h"
 #include "exec/translator.h"
+#include "exec/target_page.h"
 #include "fpu/softfloat.h"
 
 #include "exec/helper-proto.h"
diff --git a/target/loongarch/cpu_helper.c b/target/loongarch/cpu_helper.c
index f8965cd155..bb343078bf 100644
--- a/target/loongarch/cpu_helper.c
+++ b/target/loongarch/cpu_helper.c
@@ -9,6 +9,7 @@
 #include "qemu/osdep.h"
 #include "cpu.h"
 #include "accel/tcg/cpu-mmu-index.h"
+#include "exec/target_page.h"
 #include "internals.h"
 #include "cpu-csr.h"
 
diff --git a/target/loongarch/tcg/tlb_helper.c b/target/loongarch/tcg/tlb_helper.c
index 70d1b5cf99..0d6c9844a6 100644
--- a/target/loongarch/tcg/tlb_helper.c
+++ b/target/loongarch/tcg/tlb_helper.c
@@ -15,6 +15,7 @@
 #include "exec/cputlb.h"
 #include "exec/exec-all.h"
 #include "exec/page-protection.h"
+#include "exec/target_page.h"
 #include "exec/cpu_ldst.h"
 #include "exec/log.h"
 #include "cpu-csr.h"
diff --git a/target/loongarch/tcg/translate.c b/target/loongarch/tcg/translate.c
index e59e4ed25b..53a0b4c3ce 100644
--- a/target/loongarch/tcg/translate.c
+++ b/target/loongarch/tcg/translate.c
@@ -11,6 +11,7 @@
 #include "tcg/tcg-op-gvec.h"
 #include "exec/translation-block.h"
 #include "exec/translator.h"
+#include "exec/target_page.h"
 #include "exec/helper-proto.h"
 #include "exec/helper-gen.h"
 #include "exec/log.h"
diff --git a/target/m68k/helper.c b/target/m68k/helper.c
index 8251272219..f73e0def23 100644
--- a/target/m68k/helper.c
+++ b/target/m68k/helper.c
@@ -23,6 +23,7 @@
 #include "exec/cputlb.h"
 #include "exec/exec-all.h"
 #include "exec/page-protection.h"
+#include "exec/target_page.h"
 #include "exec/gdbstub.h"
 #include "exec/helper-proto.h"
 #include "system/memory.h"
diff --git a/target/m68k/translate.c b/target/m68k/translate.c
index dec2967fce..b1266a7875 100644
--- a/target/m68k/translate.c
+++ b/target/m68k/translate.c
@@ -22,6 +22,7 @@
 #include "cpu.h"
 #include "exec/exec-all.h"
 #include "exec/translation-block.h"
+#include "exec/target_page.h"
 #include "tcg/tcg-op.h"
 #include "qemu/log.h"
 #include "qemu/qemu-print.h"
diff --git a/target/microblaze/helper.c b/target/microblaze/helper.c
index 022c98f0c3..9203192483 100644
--- a/target/microblaze/helper.c
+++ b/target/microblaze/helper.c
@@ -23,6 +23,7 @@
 #include "exec/cputlb.h"
 #include "accel/tcg/cpu-mmu-index.h"
 #include "exec/page-protection.h"
+#include "exec/target_page.h"
 #include "qemu/host-utils.h"
 #include "exec/log.h"
 
diff --git a/target/microblaze/mmu.c b/target/microblaze/mmu.c
index 2d18659b99..95a12e16f8 100644
--- a/target/microblaze/mmu.c
+++ b/target/microblaze/mmu.c
@@ -24,6 +24,7 @@
 #include "exec/cputlb.h"
 #include "accel/tcg/cpu-mmu-index.h"
 #include "exec/page-protection.h"
+#include "exec/target_page.h"
 
 static unsigned int tlb_decode_size(unsigned int f)
 {
diff --git a/target/microblaze/translate.c b/target/microblaze/translate.c
index b54e5ac4b2..4bb867c969 100644
--- a/target/microblaze/translate.c
+++ b/target/microblaze/translate.c
@@ -27,6 +27,7 @@
 #include "exec/helper-gen.h"
 #include "exec/translator.h"
 #include "exec/translation-block.h"
+#include "exec/target_page.h"
 #include "qemu/qemu-print.h"
 
 #include "exec/log.h"
diff --git a/target/mips/tcg/msa_helper.c b/target/mips/tcg/msa_helper.c
index 74fb80cc25..969dd34b3e 100644
--- a/target/mips/tcg/msa_helper.c
+++ b/target/mips/tcg/msa_helper.c
@@ -25,6 +25,7 @@
 #include "exec/cpu_ldst.h"
 #include "exec/helper-proto.h"
 #include "exec/memop.h"
+#include "exec/target_page.h"
 #include "fpu/softfloat.h"
 #include "fpu_helper.h"
 
diff --git a/target/mips/tcg/system/cp0_helper.c b/target/mips/tcg/system/cp0_helper.c
index 78e422b0ca..101b1e65fd 100644
--- a/target/mips/tcg/system/cp0_helper.c
+++ b/target/mips/tcg/system/cp0_helper.c
@@ -28,6 +28,7 @@
 #include "qemu/host-utils.h"
 #include "exec/helper-proto.h"
 #include "exec/cputlb.h"
+#include "exec/target_page.h"
 
 
 /* SMP helpers.  */
diff --git a/target/mips/tcg/system/tlb_helper.c b/target/mips/tcg/system/tlb_helper.c
index df80301a41..d239fa9353 100644
--- a/target/mips/tcg/system/tlb_helper.c
+++ b/target/mips/tcg/system/tlb_helper.c
@@ -24,6 +24,7 @@
 #include "exec/cputlb.h"
 #include "exec/exec-all.h"
 #include "exec/page-protection.h"
+#include "exec/target_page.h"
 #include "exec/cpu_ldst.h"
 #include "exec/log.h"
 #include "exec/helper-proto.h"
diff --git a/target/mips/tcg/translate.c b/target/mips/tcg/translate.c
index 78b848a6d9..8658315f93 100644
--- a/target/mips/tcg/translate.c
+++ b/target/mips/tcg/translate.c
@@ -27,6 +27,7 @@
 #include "internal.h"
 #include "exec/helper-proto.h"
 #include "exec/translation-block.h"
+#include "exec/target_page.h"
 #include "semihosting/semihost.h"
 #include "trace.h"
 #include "fpu_helper.h"
diff --git a/target/openrisc/mmu.c b/target/openrisc/mmu.c
index 47ac783c52..acea50c41e 100644
--- a/target/openrisc/mmu.c
+++ b/target/openrisc/mmu.c
@@ -23,6 +23,7 @@
 #include "cpu.h"
 #include "exec/cputlb.h"
 #include "exec/page-protection.h"
+#include "exec/target_page.h"
 #include "gdbstub/helpers.h"
 #include "qemu/host-utils.h"
 #include "hw/loader.h"
diff --git a/target/openrisc/sys_helper.c b/target/openrisc/sys_helper.c
index 21bc137ccc..92badf017f 100644
--- a/target/openrisc/sys_helper.c
+++ b/target/openrisc/sys_helper.c
@@ -22,6 +22,7 @@
 #include "cpu.h"
 #include "exec/exec-all.h"
 #include "exec/cputlb.h"
+#include "exec/target_page.h"
 #include "exec/helper-proto.h"
 #include "exception.h"
 #ifndef CONFIG_USER_ONLY
diff --git a/target/openrisc/translate.c b/target/openrisc/translate.c
index da033bffff..d4ce60188b 100644
--- a/target/openrisc/translate.c
+++ b/target/openrisc/translate.c
@@ -28,7 +28,7 @@
 #include "qemu/qemu-print.h"
 #include "exec/translator.h"
 #include "exec/translation-block.h"
-
+#include "exec/target_page.h"
 #include "exec/helper-proto.h"
 #include "exec/helper-gen.h"
 
diff --git a/target/ppc/mem_helper.c b/target/ppc/mem_helper.c
index 51b137febd..0967624afe 100644
--- a/target/ppc/mem_helper.c
+++ b/target/ppc/mem_helper.c
@@ -20,6 +20,7 @@
 #include "qemu/osdep.h"
 #include "cpu.h"
 #include "exec/exec-all.h"
+#include "exec/target_page.h"
 #include "qemu/host-utils.h"
 #include "exec/helper-proto.h"
 #include "helper_regs.h"
diff --git a/target/ppc/mmu-hash32.c b/target/ppc/mmu-hash32.c
index 1f791a7f2f..5bd3efe70e 100644
--- a/target/ppc/mmu-hash32.c
+++ b/target/ppc/mmu-hash32.c
@@ -22,6 +22,7 @@
 #include "cpu.h"
 #include "exec/exec-all.h"
 #include "exec/page-protection.h"
+#include "exec/target_page.h"
 #include "system/kvm.h"
 #include "kvm_ppc.h"
 #include "internal.h"
diff --git a/target/ppc/mmu_common.c b/target/ppc/mmu_common.c
index fb62b947f1..394a0c9bb6 100644
--- a/target/ppc/mmu_common.c
+++ b/target/ppc/mmu_common.c
@@ -26,6 +26,7 @@
 #include "mmu-hash32.h"
 #include "exec/exec-all.h"
 #include "exec/page-protection.h"
+#include "exec/target_page.h"
 #include "exec/log.h"
 #include "helper_regs.h"
 #include "qemu/error-report.h"
diff --git a/target/ppc/mmu_helper.c b/target/ppc/mmu_helper.c
index ad9ba8294c..c90ceb7d60 100644
--- a/target/ppc/mmu_helper.c
+++ b/target/ppc/mmu_helper.c
@@ -27,6 +27,7 @@
 #include "exec/cputlb.h"
 #include "exec/exec-all.h"
 #include "exec/page-protection.h"
+#include "exec/target_page.h"
 #include "exec/log.h"
 #include "helper_regs.h"
 #include "qemu/error-report.h"
diff --git a/target/ppc/translate.c b/target/ppc/translate.c
index a52cbc869a..399107d319 100644
--- a/target/ppc/translate.c
+++ b/target/ppc/translate.c
@@ -22,6 +22,7 @@
 #include "cpu.h"
 #include "internal.h"
 #include "exec/exec-all.h"
+#include "exec/target_page.h"
 #include "tcg/tcg-op.h"
 #include "tcg/tcg-op-gvec.h"
 #include "qemu/host-utils.h"
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index ca58094fb5..619c76cc00 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -26,6 +26,7 @@
 #include "exec/cputlb.h"
 #include "exec/exec-all.h"
 #include "exec/page-protection.h"
+#include "exec/target_page.h"
 #include "system/memory.h"
 #include "instmap.h"
 #include "tcg/tcg-op.h"
diff --git a/target/riscv/pmp.c b/target/riscv/pmp.c
index b0841d44f4..c13a117e3f 100644
--- a/target/riscv/pmp.c
+++ b/target/riscv/pmp.c
@@ -26,6 +26,7 @@
 #include "trace.h"
 #include "exec/cputlb.h"
 #include "exec/page-protection.h"
+#include "exec/target_page.h"
 
 static bool pmp_write_cfg(CPURISCVState *env, uint32_t addr_index,
                           uint8_t val);
diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index bee7dfd803..710449d17e 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -22,6 +22,7 @@
 #include "exec/translation-block.h"
 #include "tcg-cpu.h"
 #include "cpu.h"
+#include "exec/target_page.h"
 #include "internals.h"
 #include "pmu.h"
 #include "time_helper.h"
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index d6651f244f..cef61b5b29 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -23,7 +23,7 @@
 #include "exec/exec-all.h"
 #include "exec/helper-proto.h"
 #include "exec/helper-gen.h"
-
+#include "exec/target_page.h"
 #include "exec/translator.h"
 #include "exec/translation-block.h"
 #include "exec/log.h"
diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
index 7fffa23bc8..7de6cbae5c 100644
--- a/target/riscv/vector_helper.c
+++ b/target/riscv/vector_helper.c
@@ -26,6 +26,7 @@
 #include "exec/page-protection.h"
 #include "exec/helper-proto.h"
 #include "exec/tlb-flags.h"
+#include "exec/target_page.h"
 #include "exec/tswap.h"
 #include "fpu/softfloat.h"
 #include "tcg/tcg-gvec-desc.h"
diff --git a/target/rx/cpu.c b/target/rx/cpu.c
index 51743020d4..e14d9cbef9 100644
--- a/target/rx/cpu.c
+++ b/target/rx/cpu.c
@@ -24,6 +24,7 @@
 #include "exec/cputlb.h"
 #include "exec/page-protection.h"
 #include "exec/translation-block.h"
+#include "exec/target_page.h"
 #include "hw/loader.h"
 #include "fpu/softfloat.h"
 #include "tcg/debug-assert.h"
diff --git a/target/s390x/helper.c b/target/s390x/helper.c
index e660c69f60..3c57c32e47 100644
--- a/target/s390x/helper.c
+++ b/target/s390x/helper.c
@@ -27,6 +27,7 @@
 #include "target/s390x/kvm/pv.h"
 #include "system/hw_accel.h"
 #include "system/runstate.h"
+#include "exec/target_page.h"
 #include "exec/watchpoint.h"
 
 void s390x_tod_timer(void *opaque)
diff --git a/target/s390x/ioinst.c b/target/s390x/ioinst.c
index a944f16c25..fe62ba5b06 100644
--- a/target/s390x/ioinst.c
+++ b/target/s390x/ioinst.c
@@ -12,6 +12,7 @@
 #include "qemu/osdep.h"
 
 #include "cpu.h"
+#include "exec/target_page.h"
 #include "s390x-internal.h"
 #include "hw/s390x/ioinst.h"
 #include "trace.h"
diff --git a/target/s390x/mmu_helper.c b/target/s390x/mmu_helper.c
index b079d120db..0e133cb9a5 100644
--- a/target/s390x/mmu_helper.c
+++ b/target/s390x/mmu_helper.c
@@ -25,6 +25,7 @@
 #include "system/tcg.h"
 #include "exec/exec-all.h"
 #include "exec/page-protection.h"
+#include "exec/target_page.h"
 #include "hw/hw.h"
 #include "hw/s390x/storage-keys.h"
 #include "hw/boards.h"
diff --git a/target/s390x/tcg/excp_helper.c b/target/s390x/tcg/excp_helper.c
index 1d51043e88..6cd813e1ab 100644
--- a/target/s390x/tcg/excp_helper.c
+++ b/target/s390x/tcg/excp_helper.c
@@ -24,6 +24,7 @@
 #include "exec/helper-proto.h"
 #include "exec/cputlb.h"
 #include "exec/exec-all.h"
+#include "exec/target_page.h"
 #include "exec/watchpoint.h"
 #include "s390x-internal.h"
 #include "tcg_s390x.h"
diff --git a/target/s390x/tcg/mem_helper.c b/target/s390x/tcg/mem_helper.c
index 0ff2e10d81..d5eece4384 100644
--- a/target/s390x/tcg/mem_helper.c
+++ b/target/s390x/tcg/mem_helper.c
@@ -29,6 +29,7 @@
 #include "exec/cputlb.h"
 #include "exec/page-protection.h"
 #include "exec/cpu_ldst.h"
+#include "exec/target_page.h"
 #include "exec/tlb-flags.h"
 #include "accel/tcg/cpu-ops.h"
 #include "qemu/int128.h"
diff --git a/target/s390x/tcg/misc_helper.c b/target/s390x/tcg/misc_helper.c
index 31266aeda4..e02f443850 100644
--- a/target/s390x/tcg/misc_helper.c
+++ b/target/s390x/tcg/misc_helper.c
@@ -29,6 +29,7 @@
 #include "exec/exec-all.h"
 #include "exec/cputlb.h"
 #include "exec/cpu_ldst.h"
+#include "exec/target_page.h"
 #include "qapi/error.h"
 #include "tcg_s390x.h"
 #include "s390-tod.h"
diff --git a/target/sh4/helper.c b/target/sh4/helper.c
index 7567e6c8b6..b41d14d5d7 100644
--- a/target/sh4/helper.c
+++ b/target/sh4/helper.c
@@ -23,6 +23,7 @@
 #include "exec/cputlb.h"
 #include "exec/exec-all.h"
 #include "exec/page-protection.h"
+#include "exec/target_page.h"
 #include "exec/log.h"
 
 #if !defined(CONFIG_USER_ONLY)
diff --git a/target/sh4/translate.c b/target/sh4/translate.c
index bcdd558818..5ce477d0ad 100644
--- a/target/sh4/translate.c
+++ b/target/sh4/translate.c
@@ -25,6 +25,7 @@
 #include "exec/helper-gen.h"
 #include "exec/translation-block.h"
 #include "exec/translator.h"
+#include "exec/target_page.h"
 #include "exec/log.h"
 #include "qemu/qemu-print.h"
 
diff --git a/target/sparc/ldst_helper.c b/target/sparc/ldst_helper.c
index 8890d2b119..3fa5e78816 100644
--- a/target/sparc/ldst_helper.c
+++ b/target/sparc/ldst_helper.c
@@ -26,6 +26,7 @@
 #include "exec/exec-all.h"
 #include "exec/cputlb.h"
 #include "exec/page-protection.h"
+#include "exec/target_page.h"
 #include "exec/cpu_ldst.h"
 #include "system/memory.h"
 #ifdef CONFIG_USER_ONLY
diff --git a/target/sparc/mmu_helper.c b/target/sparc/mmu_helper.c
index c5d82a0854..217580a4d8 100644
--- a/target/sparc/mmu_helper.c
+++ b/target/sparc/mmu_helper.c
@@ -23,6 +23,7 @@
 #include "exec/cputlb.h"
 #include "accel/tcg/cpu-mmu-index.h"
 #include "exec/page-protection.h"
+#include "exec/target_page.h"
 #include "exec/tlb-flags.h"
 #include "system/memory.h"
 #include "qemu/qemu-print.h"
diff --git a/target/sparc/translate.c b/target/sparc/translate.c
index bfe63649db..adebddf27b 100644
--- a/target/sparc/translate.c
+++ b/target/sparc/translate.c
@@ -23,6 +23,7 @@
 #include "cpu.h"
 #include "exec/helper-proto.h"
 #include "exec/exec-all.h"
+#include "exec/target_page.h"
 #include "tcg/tcg-op.h"
 #include "tcg/tcg-op-gvec.h"
 #include "exec/helper-gen.h"
diff --git a/target/tricore/helper.c b/target/tricore/helper.c
index b1ee126112..e4c53d453d 100644
--- a/target/tricore/helper.c
+++ b/target/tricore/helper.c
@@ -22,6 +22,7 @@
 #include "exec/cputlb.h"
 #include "accel/tcg/cpu-mmu-index.h"
 #include "exec/page-protection.h"
+#include "exec/target_page.h"
 #include "fpu/softfloat-helpers.h"
 #include "qemu/qemu-print.h"
 
diff --git a/target/tricore/translate.c b/target/tricore/translate.c
index 6819b77668..5c7ed395ca 100644
--- a/target/tricore/translate.c
+++ b/target/tricore/translate.c
@@ -31,6 +31,7 @@
 #include "tricore-opcodes.h"
 #include "exec/translator.h"
 #include "exec/translation-block.h"
+#include "exec/target_page.h"
 #include "exec/log.h"
 
 #define HELPER_H "helper.h"
diff --git a/target/xtensa/helper.c b/target/xtensa/helper.c
index 4824b97e37..d02d16f9ec 100644
--- a/target/xtensa/helper.c
+++ b/target/xtensa/helper.c
@@ -29,6 +29,7 @@
 #include "qemu/log.h"
 #include "cpu.h"
 #include "exec/cputlb.h"
+#include "exec/target_page.h"
 #include "gdbstub/helpers.h"
 #include "exec/helper-proto.h"
 #include "qemu/error-report.h"
diff --git a/target/xtensa/mmu_helper.c b/target/xtensa/mmu_helper.c
index 1ce125794d..a7dd810055 100644
--- a/target/xtensa/mmu_helper.c
+++ b/target/xtensa/mmu_helper.c
@@ -36,6 +36,7 @@
 #include "accel/tcg/cpu-mmu-index.h"
 #include "exec/exec-all.h"
 #include "exec/page-protection.h"
+#include "exec/target_page.h"
 #include "system/memory.h"
 
 #define XTENSA_MPU_SEGMENT_MASK 0x0000001f
diff --git a/target/xtensa/translate.c b/target/xtensa/translate.c
index cb817b3119..5ebd4a512c 100644
--- a/target/xtensa/translate.c
+++ b/target/xtensa/translate.c
@@ -37,6 +37,7 @@
 #include "qemu/qemu-print.h"
 #include "exec/translator.h"
 #include "exec/translation-block.h"
+#include "exec/target_page.h"
 #include "exec/helper-proto.h"
 #include "exec/helper-gen.h"
 #include "exec/log.h"
diff --git a/target/xtensa/xtensa-semi.c b/target/xtensa/xtensa-semi.c
index 2ded8e5634..636f421da2 100644
--- a/target/xtensa/xtensa-semi.c
+++ b/target/xtensa/xtensa-semi.c
@@ -29,6 +29,7 @@
 #include "cpu.h"
 #include "chardev/char-fe.h"
 #include "exec/helper-proto.h"
+#include "exec/target_page.h"
 #include "semihosting/semihost.h"
 #include "semihosting/uaccess.h"
 #include "qapi/error.h"

From d97c3b06de5bdd885f0ee3d8153326acd3db480e Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 24 Mar 2025 21:58:59 -0700
Subject: [PATCH 0190/2760] exec/cpu-all: transfer exec/cpu-common include to
 cpu.h headers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250325045915.994760-15-pierrick.bouvier@linaro.org>
---
 cpu-target.c            | 1 +
 include/exec/cpu-all.h  | 1 -
 include/exec/cpu_ldst.h | 1 +
 target/alpha/cpu.h      | 1 +
 target/arm/cpu.h        | 1 +
 target/avr/cpu.h        | 1 +
 target/hexagon/cpu.h    | 1 +
 target/hppa/cpu.h       | 1 +
 target/i386/cpu.h       | 1 +
 target/loongarch/cpu.h  | 1 +
 target/m68k/cpu.h       | 1 +
 target/microblaze/cpu.h | 1 +
 target/mips/cpu.h       | 1 +
 target/openrisc/cpu.h   | 1 +
 target/ppc/cpu.h        | 1 +
 target/riscv/cpu.h      | 1 +
 target/rx/cpu.h         | 1 +
 target/s390x/cpu.h      | 1 +
 target/sh4/cpu.h        | 1 +
 target/sparc/cpu.h      | 1 +
 target/tricore/cpu.h    | 1 +
 target/xtensa/cpu.h     | 1 +
 22 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/cpu-target.c b/cpu-target.c
index 7f3b244ed1..14cd623bff 100644
--- a/cpu-target.c
+++ b/cpu-target.c
@@ -24,6 +24,7 @@
 #include "qemu/qemu-print.h"
 #include "system/accel-ops.h"
 #include "system/cpus.h"
+#include "exec/cpu-common.h"
 #include "exec/tswap.h"
 #include "exec/replay-core.h"
 #include "exec/log.h"
diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
index e7c8b8672f..5122fdbee3 100644
--- a/include/exec/cpu-all.h
+++ b/include/exec/cpu-all.h
@@ -19,7 +19,6 @@
 #ifndef CPU_ALL_H
 #define CPU_ALL_H
 
-#include "exec/cpu-common.h"
 #include "hw/core/cpu.h"
 #include "exec/cpu-defs.h"
 
diff --git a/include/exec/cpu_ldst.h b/include/exec/cpu_ldst.h
index 77dc5ac61c..63847f6e61 100644
--- a/include/exec/cpu_ldst.h
+++ b/include/exec/cpu_ldst.h
@@ -66,6 +66,7 @@
 #error Can only include this header with TCG
 #endif
 
+#include "exec/cpu-common.h"
 #include "exec/cpu-ldst-common.h"
 #include "accel/tcg/cpu-mmu-index.h"
 #include "exec/abi_ptr.h"
diff --git a/target/alpha/cpu.h b/target/alpha/cpu.h
index 42788a6a0b..fb1d63527e 100644
--- a/target/alpha/cpu.h
+++ b/target/alpha/cpu.h
@@ -21,6 +21,7 @@
 #define ALPHA_CPU_H
 
 #include "cpu-qom.h"
+#include "exec/cpu-common.h"
 #include "exec/cpu-defs.h"
 #include "exec/cpu-interrupt.h"
 #include "qemu/cpu-float.h"
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index 958a921490..ee92476814 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -24,6 +24,7 @@
 #include "qemu/cpu-float.h"
 #include "hw/registerfields.h"
 #include "cpu-qom.h"
+#include "exec/cpu-common.h"
 #include "exec/cpu-defs.h"
 #include "exec/cpu-interrupt.h"
 #include "exec/gdbstub.h"
diff --git a/target/avr/cpu.h b/target/avr/cpu.h
index c2cc2daa66..a0fb40141a 100644
--- a/target/avr/cpu.h
+++ b/target/avr/cpu.h
@@ -22,6 +22,7 @@
 #define QEMU_AVR_CPU_H
 
 #include "cpu-qom.h"
+#include "exec/cpu-common.h"
 #include "exec/cpu-defs.h"
 #include "exec/cpu-interrupt.h"
 #include "system/memory.h"
diff --git a/target/hexagon/cpu.h b/target/hexagon/cpu.h
index f78c8f9c2a..e4fc35b112 100644
--- a/target/hexagon/cpu.h
+++ b/target/hexagon/cpu.h
@@ -21,6 +21,7 @@
 #include "fpu/softfloat-types.h"
 
 #include "cpu-qom.h"
+#include "exec/cpu-common.h"
 #include "exec/cpu-defs.h"
 #include "hex_regs.h"
 #include "mmvec/mmvec.h"
diff --git a/target/hppa/cpu.h b/target/hppa/cpu.h
index dab58c227f..4e72ab025b 100644
--- a/target/hppa/cpu.h
+++ b/target/hppa/cpu.h
@@ -21,6 +21,7 @@
 #define HPPA_CPU_H
 
 #include "cpu-qom.h"
+#include "exec/cpu-common.h"
 #include "exec/cpu-defs.h"
 #include "exec/cpu-interrupt.h"
 #include "system/memory.h"
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index 778dfd9637..02ea87347a 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -23,6 +23,7 @@
 #include "system/tcg.h"
 #include "cpu-qom.h"
 #include "kvm/hyperv-proto.h"
+#include "exec/cpu-common.h"
 #include "exec/cpu-defs.h"
 #include "exec/cpu-interrupt.h"
 #include "exec/memop.h"
diff --git a/target/loongarch/cpu.h b/target/loongarch/cpu.h
index a924aa01d7..69117c602a 100644
--- a/target/loongarch/cpu.h
+++ b/target/loongarch/cpu.h
@@ -9,6 +9,7 @@
 #define LOONGARCH_CPU_H
 
 #include "qemu/int128.h"
+#include "exec/cpu-common.h"
 #include "exec/cpu-defs.h"
 #include "exec/cpu-interrupt.h"
 #include "fpu/softfloat-types.h"
diff --git a/target/m68k/cpu.h b/target/m68k/cpu.h
index 451644a05a..5347fbe397 100644
--- a/target/m68k/cpu.h
+++ b/target/m68k/cpu.h
@@ -21,6 +21,7 @@
 #ifndef M68K_CPU_H
 #define M68K_CPU_H
 
+#include "exec/cpu-common.h"
 #include "exec/cpu-defs.h"
 #include "exec/cpu-interrupt.h"
 #include "qemu/cpu-float.h"
diff --git a/target/microblaze/cpu.h b/target/microblaze/cpu.h
index d29681abed..90d820b90c 100644
--- a/target/microblaze/cpu.h
+++ b/target/microblaze/cpu.h
@@ -21,6 +21,7 @@
 #define MICROBLAZE_CPU_H
 
 #include "cpu-qom.h"
+#include "exec/cpu-common.h"
 #include "exec/cpu-defs.h"
 #include "qemu/cpu-float.h"
 #include "exec/cpu-interrupt.h"
diff --git a/target/mips/cpu.h b/target/mips/cpu.h
index 29362498ec..79f8041ced 100644
--- a/target/mips/cpu.h
+++ b/target/mips/cpu.h
@@ -2,6 +2,7 @@
 #define MIPS_CPU_H
 
 #include "cpu-qom.h"
+#include "exec/cpu-common.h"
 #include "exec/cpu-defs.h"
 #include "exec/cpu-interrupt.h"
 #ifndef CONFIG_USER_ONLY
diff --git a/target/openrisc/cpu.h b/target/openrisc/cpu.h
index c153823b62..f16a070ef6 100644
--- a/target/openrisc/cpu.h
+++ b/target/openrisc/cpu.h
@@ -21,6 +21,7 @@
 #define OPENRISC_CPU_H
 
 #include "cpu-qom.h"
+#include "exec/cpu-common.h"
 #include "exec/cpu-defs.h"
 #include "exec/cpu-interrupt.h"
 #include "fpu/softfloat-types.h"
diff --git a/target/ppc/cpu.h b/target/ppc/cpu.h
index 7489ba9564..aa5df47bda 100644
--- a/target/ppc/cpu.h
+++ b/target/ppc/cpu.h
@@ -22,6 +22,7 @@
 
 #include "qemu/int128.h"
 #include "qemu/cpu-float.h"
+#include "exec/cpu-common.h"
 #include "exec/cpu-defs.h"
 #include "exec/cpu-interrupt.h"
 #include "cpu-qom.h"
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index 556eda57e9..14a6779b4c 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -23,6 +23,7 @@
 #include "hw/core/cpu.h"
 #include "hw/registerfields.h"
 #include "hw/qdev-properties.h"
+#include "exec/cpu-common.h"
 #include "exec/cpu-defs.h"
 #include "exec/cpu-interrupt.h"
 #include "exec/gdbstub.h"
diff --git a/target/rx/cpu.h b/target/rx/cpu.h
index 5f2fcb6656..e2ec78835e 100644
--- a/target/rx/cpu.h
+++ b/target/rx/cpu.h
@@ -23,6 +23,7 @@
 #include "hw/registerfields.h"
 #include "cpu-qom.h"
 
+#include "exec/cpu-common.h"
 #include "exec/cpu-defs.h"
 #include "exec/cpu-interrupt.h"
 #include "qemu/cpu-float.h"
diff --git a/target/s390x/cpu.h b/target/s390x/cpu.h
index 0a32ad4c61..83d01d5c4e 100644
--- a/target/s390x/cpu.h
+++ b/target/s390x/cpu.h
@@ -27,6 +27,7 @@
 
 #include "cpu-qom.h"
 #include "cpu_models.h"
+#include "exec/cpu-common.h"
 #include "exec/cpu-defs.h"
 #include "exec/cpu-interrupt.h"
 #include "qemu/cpu-float.h"
diff --git a/target/sh4/cpu.h b/target/sh4/cpu.h
index 18557d8c38..7581f5eecb 100644
--- a/target/sh4/cpu.h
+++ b/target/sh4/cpu.h
@@ -21,6 +21,7 @@
 #define SH4_CPU_H
 
 #include "cpu-qom.h"
+#include "exec/cpu-common.h"
 #include "exec/cpu-defs.h"
 #include "exec/cpu-interrupt.h"
 #include "qemu/cpu-float.h"
diff --git a/target/sparc/cpu.h b/target/sparc/cpu.h
index c0aab69b61..b87351a666 100644
--- a/target/sparc/cpu.h
+++ b/target/sparc/cpu.h
@@ -3,6 +3,7 @@
 
 #include "qemu/bswap.h"
 #include "cpu-qom.h"
+#include "exec/cpu-common.h"
 #include "exec/cpu-defs.h"
 #include "exec/cpu-interrupt.h"
 #include "qemu/cpu-float.h"
diff --git a/target/tricore/cpu.h b/target/tricore/cpu.h
index cf9dbc6df8..abb9cba136 100644
--- a/target/tricore/cpu.h
+++ b/target/tricore/cpu.h
@@ -22,6 +22,7 @@
 
 #include "cpu-qom.h"
 #include "hw/registerfields.h"
+#include "exec/cpu-common.h"
 #include "exec/cpu-defs.h"
 #include "qemu/cpu-float.h"
 #include "tricore-defs.h"
diff --git a/target/xtensa/cpu.h b/target/xtensa/cpu.h
index 6684631478..c5d2042de1 100644
--- a/target/xtensa/cpu.h
+++ b/target/xtensa/cpu.h
@@ -30,6 +30,7 @@
 
 #include "cpu-qom.h"
 #include "qemu/cpu-float.h"
+#include "exec/cpu-common.h"
 #include "exec/cpu-defs.h"
 #include "exec/cpu-interrupt.h"
 #include "hw/clock.h"

From 0df783b2fbeca9aa3cc19adafb9a4ec7f97e3a6d Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 24 Mar 2025 21:59:00 -0700
Subject: [PATCH 0191/2760] exec/cpu-all: remove this header

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250325045915.994760-16-pierrick.bouvier@linaro.org>
---
 accel/tcg/cpu-exec.c    |  1 -
 hw/hyperv/hyperv.c      |  1 -
 include/exec/cpu-all.h  | 25 -------------------------
 include/hw/core/cpu.h   |  2 +-
 include/qemu/bswap.h    |  3 ---
 semihosting/uaccess.c   |  1 -
 target/alpha/cpu.h      |  2 --
 target/arm/cpu.h        |  2 --
 target/avr/cpu.h        |  2 --
 target/hexagon/cpu.h    |  2 --
 target/hppa/cpu.h       |  2 --
 target/i386/cpu.h       |  1 -
 target/loongarch/cpu.h  |  2 --
 target/m68k/cpu.h       |  2 --
 target/microblaze/cpu.h |  2 --
 target/mips/cpu.h       |  2 --
 target/openrisc/cpu.h   |  2 --
 target/ppc/cpu.h        |  2 --
 target/riscv/cpu.h      |  2 --
 target/rx/cpu.h         |  2 --
 target/s390x/cpu.h      |  2 --
 target/sh4/cpu.h        |  2 --
 target/sparc/cpu.h      |  2 --
 target/tricore/cpu.h    |  2 --
 target/xtensa/cpu.h     |  2 --
 tcg/tcg-op-ldst.c       |  2 +-
 26 files changed, 2 insertions(+), 70 deletions(-)
 delete mode 100644 include/exec/cpu-all.h

diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index 8d2b957a3b..5ced3879ac 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -35,7 +35,6 @@
 #include "qemu/rcu.h"
 #include "exec/log.h"
 #include "qemu/main-loop.h"
-#include "exec/cpu-all.h"
 #include "cpu.h"
 #include "exec/icount.h"
 #include "exec/replay-core.h"
diff --git a/hw/hyperv/hyperv.c b/hw/hyperv/hyperv.c
index c487f13e2f..8f193fd0bd 100644
--- a/hw/hyperv/hyperv.c
+++ b/hw/hyperv/hyperv.c
@@ -24,7 +24,6 @@
 #include "qom/object.h"
 #include "target/i386/kvm/hyperv-proto.h"
 #include "target/i386/cpu.h"
-#include "exec/cpu-all.h"
 #include "exec/target_page.h"
 
 struct SynICState {
diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
deleted file mode 100644
index 5122fdbee3..0000000000
--- a/include/exec/cpu-all.h
+++ /dev/null
@@ -1,25 +0,0 @@
-/*
- * defines common to all virtual CPUs
- *
- *  Copyright (c) 2003 Fabrice Bellard
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, see <http://www.gnu.org/licenses/>.
- */
-#ifndef CPU_ALL_H
-#define CPU_ALL_H
-
-#include "hw/core/cpu.h"
-#include "exec/cpu-defs.h"
-
-#endif /* CPU_ALL_H */
diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index 28bd27b8ed..10b6b25b34 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -579,7 +579,7 @@ QEMU_BUILD_BUG_ON(offsetof(CPUState, neg) !=
 
 static inline CPUArchState *cpu_env(CPUState *cpu)
 {
-    /* We validate that CPUArchState follows CPUState in cpu-all.h. */
+    /* We validate that CPUArchState follows CPUState in cpu-target.c */
     return (CPUArchState *)(cpu + 1);
 }
 
diff --git a/include/qemu/bswap.h b/include/qemu/bswap.h
index b915835bea..9a11764536 100644
--- a/include/qemu/bswap.h
+++ b/include/qemu/bswap.h
@@ -205,9 +205,6 @@ CPU_CONVERT(le, 64, uint64_t)
  *   te   : target endian
  * (except for byte accesses, which have no endian infix).
  *
- * The target endian accessors are obviously only available to source
- * files which are built per-target; they are defined in cpu-all.h.
- *
  * In all cases these functions take a host pointer.
  * For accessors that take a guest address rather than a
  * host address, see the cpu_{ld,st}_* accessors defined in
diff --git a/semihosting/uaccess.c b/semihosting/uaccess.c
index f51a253626..81ffecaaba 100644
--- a/semihosting/uaccess.c
+++ b/semihosting/uaccess.c
@@ -8,7 +8,6 @@
  */
 
 #include "qemu/osdep.h"
-#include "exec/cpu-all.h"
 #include "accel/tcg/cpu-mmu-index.h"
 #include "exec/exec-all.h"
 #include "exec/target_page.h"
diff --git a/target/alpha/cpu.h b/target/alpha/cpu.h
index fb1d63527e..849f673489 100644
--- a/target/alpha/cpu.h
+++ b/target/alpha/cpu.h
@@ -289,8 +289,6 @@ void alpha_cpu_dump_state(CPUState *cs, FILE *f, int flags);
 int alpha_cpu_gdb_read_register(CPUState *cpu, GByteArray *buf, int reg);
 int alpha_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
 
-#include "exec/cpu-all.h"
-
 enum {
     FEATURE_ASN    = 0x00000001,
     FEATURE_SPS    = 0x00000002,
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index ee92476814..ea9956395c 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -2968,8 +2968,6 @@ static inline bool arm_sctlr_b(CPUARMState *env)
 
 uint64_t arm_sctlr(CPUARMState *env, int el);
 
-#include "exec/cpu-all.h"
-
 /*
  * We have more than 32-bits worth of state per TB, so we split the data
  * between tb->flags and tb->cs_base, which is otherwise unused for ARM.
diff --git a/target/avr/cpu.h b/target/avr/cpu.h
index a0fb40141a..d6666175a9 100644
--- a/target/avr/cpu.h
+++ b/target/avr/cpu.h
@@ -259,6 +259,4 @@ bool avr_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
 extern const MemoryRegionOps avr_cpu_reg1;
 extern const MemoryRegionOps avr_cpu_reg2;
 
-#include "exec/cpu-all.h"
-
 #endif /* QEMU_AVR_CPU_H */
diff --git a/target/hexagon/cpu.h b/target/hexagon/cpu.h
index e4fc35b112..c065fa8ddc 100644
--- a/target/hexagon/cpu.h
+++ b/target/hexagon/cpu.h
@@ -158,6 +158,4 @@ void hexagon_translate_init(void);
 void hexagon_translate_code(CPUState *cs, TranslationBlock *tb,
                             int *max_insns, vaddr pc, void *host_pc);
 
-#include "exec/cpu-all.h"
-
 #endif /* HEXAGON_CPU_H */
diff --git a/target/hppa/cpu.h b/target/hppa/cpu.h
index 4e72ab025b..da5f8adcd5 100644
--- a/target/hppa/cpu.h
+++ b/target/hppa/cpu.h
@@ -306,8 +306,6 @@ struct HPPACPUClass {
     ResettablePhases parent_phases;
 };
 
-#include "exec/cpu-all.h"
-
 static inline bool hppa_is_pa20(const CPUHPPAState *env)
 {
     return env->is_pa20;
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index 02ea87347a..bd63036334 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -2604,7 +2604,6 @@ static inline bool is_mmu_index_32(int mmu_index)
 #define CC_SRC2 (env->cc_src2)
 #define CC_OP   (env->cc_op)
 
-#include "exec/cpu-all.h"
 #include "svm.h"
 
 #if !defined(CONFIG_USER_ONLY)
diff --git a/target/loongarch/cpu.h b/target/loongarch/cpu.h
index 69117c602a..ad8b0ed235 100644
--- a/target/loongarch/cpu.h
+++ b/target/loongarch/cpu.h
@@ -504,8 +504,6 @@ static inline void cpu_get_tb_cpu_state(CPULoongArchState *env, vaddr *pc,
     *flags |= is_va32(env) * HW_FLAGS_VA32;
 }
 
-#include "exec/cpu-all.h"
-
 #define CPU_RESOLVING_TYPE TYPE_LOONGARCH_CPU
 
 void loongarch_cpu_post_init(Object *obj);
diff --git a/target/m68k/cpu.h b/target/m68k/cpu.h
index 5347fbe397..0b70e8c6ab 100644
--- a/target/m68k/cpu.h
+++ b/target/m68k/cpu.h
@@ -596,8 +596,6 @@ void m68k_cpu_transaction_failed(CPUState *cs, hwaddr physaddr, vaddr addr,
                                  MemTxResult response, uintptr_t retaddr);
 #endif
 
-#include "exec/cpu-all.h"
-
 /* TB flags */
 #define TB_FLAGS_MACSR          0x0f
 #define TB_FLAGS_MSR_S_BIT      13
diff --git a/target/microblaze/cpu.h b/target/microblaze/cpu.h
index 90d820b90c..2bfa396c96 100644
--- a/target/microblaze/cpu.h
+++ b/target/microblaze/cpu.h
@@ -411,8 +411,6 @@ void mb_translate_code(CPUState *cs, TranslationBlock *tb,
 #define MMU_USER_IDX    2
 /* See NB_MMU_MODES in cpu-defs.h. */
 
-#include "exec/cpu-all.h"
-
 /* Ensure there is no overlap between the two masks. */
 QEMU_BUILD_BUG_ON(MSR_TB_MASK & IFLAGS_TB_MASK);
 
diff --git a/target/mips/cpu.h b/target/mips/cpu.h
index 79f8041ced..20f31370bc 100644
--- a/target/mips/cpu.h
+++ b/target/mips/cpu.h
@@ -1258,8 +1258,6 @@ static inline int mips_env_mmu_index(CPUMIPSState *env)
     return hflags_mmu_index(env->hflags);
 }
 
-#include "exec/cpu-all.h"
-
 /* Exceptions */
 enum {
     EXCP_NONE          = -1,
diff --git a/target/openrisc/cpu.h b/target/openrisc/cpu.h
index f16a070ef6..19ee85ff5a 100644
--- a/target/openrisc/cpu.h
+++ b/target/openrisc/cpu.h
@@ -334,8 +334,6 @@ void cpu_openrisc_count_stop(OpenRISCCPU *cpu);
 
 #define CPU_RESOLVING_TYPE TYPE_OPENRISC_CPU
 
-#include "exec/cpu-all.h"
-
 #define TB_FLAGS_SM    SR_SM
 #define TB_FLAGS_DME   SR_DME
 #define TB_FLAGS_IME   SR_IME
diff --git a/target/ppc/cpu.h b/target/ppc/cpu.h
index aa5df47bda..3c02f7f7d4 100644
--- a/target/ppc/cpu.h
+++ b/target/ppc/cpu.h
@@ -1704,8 +1704,6 @@ void ppc_compat_add_property(Object *obj, const char *name,
                              uint32_t *compat_pvr, const char *basedesc);
 #endif /* defined(TARGET_PPC64) */
 
-#include "exec/cpu-all.h"
-
 /*****************************************************************************/
 /* CRF definitions */
 #define CRF_LT_BIT    3
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index 14a6779b4c..867e539b53 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -634,8 +634,6 @@ G_NORETURN void riscv_raise_exception(CPURISCVState *env,
 target_ulong riscv_cpu_get_fflags(CPURISCVState *env);
 void riscv_cpu_set_fflags(CPURISCVState *env, target_ulong);
 
-#include "exec/cpu-all.h"
-
 FIELD(TB_FLAGS, MEM_IDX, 0, 3)
 FIELD(TB_FLAGS, FS, 3, 2)
 /* Vector flags */
diff --git a/target/rx/cpu.h b/target/rx/cpu.h
index e2ec78835e..5c19c83219 100644
--- a/target/rx/cpu.h
+++ b/target/rx/cpu.h
@@ -147,8 +147,6 @@ void rx_translate_code(CPUState *cs, TranslationBlock *tb,
                        int *max_insns, vaddr pc, void *host_pc);
 void rx_cpu_unpack_psw(CPURXState *env, uint32_t psw, int rte);
 
-#include "exec/cpu-all.h"
-
 #define CPU_INTERRUPT_SOFT CPU_INTERRUPT_TGT_INT_0
 #define CPU_INTERRUPT_FIR  CPU_INTERRUPT_TGT_INT_1
 
diff --git a/target/s390x/cpu.h b/target/s390x/cpu.h
index 83d01d5c4e..940eda8dd1 100644
--- a/target/s390x/cpu.h
+++ b/target/s390x/cpu.h
@@ -948,6 +948,4 @@ uint64_t s390_cpu_get_psw_mask(CPUS390XState *env);
 /* outside of target/s390x/ */
 S390CPU *s390_cpu_addr2state(uint16_t cpu_addr);
 
-#include "exec/cpu-all.h"
-
 #endif
diff --git a/target/sh4/cpu.h b/target/sh4/cpu.h
index 7581f5eecb..7752a0c2e1 100644
--- a/target/sh4/cpu.h
+++ b/target/sh4/cpu.h
@@ -288,8 +288,6 @@ void cpu_load_tlb(CPUSH4State * env);
 /* MMU modes definitions */
 #define MMU_USER_IDX 1
 
-#include "exec/cpu-all.h"
-
 /* MMU control register */
 #define MMUCR    0x1F000010
 #define MMUCR_AT (1<<0)
diff --git a/target/sparc/cpu.h b/target/sparc/cpu.h
index b87351a666..734dfdb1d3 100644
--- a/target/sparc/cpu.h
+++ b/target/sparc/cpu.h
@@ -729,8 +729,6 @@ static inline int cpu_pil_allowed(CPUSPARCState *env1, int pil)
 #endif
 }
 
-#include "exec/cpu-all.h"
-
 #ifdef TARGET_SPARC64
 /* sun4u.c */
 void cpu_tick_set_count(CPUTimer *timer, uint64_t count);
diff --git a/target/tricore/cpu.h b/target/tricore/cpu.h
index abb9cba136..c76e65f818 100644
--- a/target/tricore/cpu.h
+++ b/target/tricore/cpu.h
@@ -251,8 +251,6 @@ void fpu_set_state(CPUTriCoreState *env);
 
 #define MMU_USER_IDX 2
 
-#include "exec/cpu-all.h"
-
 FIELD(TB_FLAGS, PRIV, 0, 2)
 
 void cpu_state_reset(CPUTriCoreState *s);
diff --git a/target/xtensa/cpu.h b/target/xtensa/cpu.h
index c5d2042de1..c03ed71c94 100644
--- a/target/xtensa/cpu.h
+++ b/target/xtensa/cpu.h
@@ -733,8 +733,6 @@ static inline uint32_t xtensa_replicate_windowstart(CPUXtensaState *env)
 #define XTENSA_CSBASE_LBEG_OFF_MASK 0x00ff0000
 #define XTENSA_CSBASE_LBEG_OFF_SHIFT 16
 
-#include "exec/cpu-all.h"
-
 static inline void cpu_get_tb_cpu_state(CPUXtensaState *env, vaddr *pc,
                                         uint64_t *cs_base, uint32_t *flags)
 {
diff --git a/tcg/tcg-op-ldst.c b/tcg/tcg-op-ldst.c
index 73838e2701..3b073b4ce0 100644
--- a/tcg/tcg-op-ldst.c
+++ b/tcg/tcg-op-ldst.c
@@ -37,7 +37,7 @@ static void check_max_alignment(unsigned a_bits)
 {
     /*
      * The requested alignment cannot overlap the TLB flags.
-     * FIXME: Must keep the count up-to-date with "exec/cpu-all.h".
+     * FIXME: Must keep the count up-to-date with "exec/tlb-flags.h".
      */
     if (tcg_use_softmmu) {
         tcg_debug_assert(a_bits + 5 <= tcg_ctx->page_bits);

From f1d2a8e95383090c8b3a57138f742fbd9aedf678 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 24 Mar 2025 21:59:02 -0700
Subject: [PATCH 0192/2760] accel/kvm: move KVM_HAVE_MCE_INJECTION define to
 kvm-all.c

This define is used only in accel/kvm/kvm-all.c, so we push directly the
definition there. Add more visibility to kvm_arch_on_sigbus_vcpu() to
allow removing this define from any header.

The architectures defining KVM_HAVE_MCE_INJECTION are i386, x86_64 and
aarch64.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250325045915.994760-18-pierrick.bouvier@linaro.org>
---
 accel/kvm/kvm-all.c  | 5 +++++
 include/system/kvm.h | 2 --
 target/arm/cpu.h     | 4 ----
 target/i386/cpu.h    | 2 --
 4 files changed, 5 insertions(+), 8 deletions(-)

diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index a30b19f455..cba9c78d2f 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -57,6 +57,11 @@
 #include <sys/eventfd.h>
 #endif
 
+#if defined(__i386__) || defined(__x86_64__) || defined(__aarch64__)
+# define KVM_HAVE_MCE_INJECTION 1
+#endif
+
+
 /* KVM uses PAGE_SIZE in its definition of KVM_COALESCED_MMIO_MAX. We
  * need to use the real host PAGE_SIZE, as that's what KVM will use.
  */
diff --git a/include/system/kvm.h b/include/system/kvm.h
index 21da3b8b05..18811cad6f 100644
--- a/include/system/kvm.h
+++ b/include/system/kvm.h
@@ -390,9 +390,7 @@ bool kvm_vcpu_id_is_valid(int vcpu_id);
 /* Returns VCPU ID to be used on KVM_CREATE_VCPU ioctl() */
 unsigned long kvm_arch_vcpu_id(CPUState *cpu);
 
-#ifdef KVM_HAVE_MCE_INJECTION
 void kvm_arch_on_sigbus_vcpu(CPUState *cpu, int code, void *addr);
-#endif
 
 void kvm_arch_init_irq_routing(KVMState *s);
 
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index ea9956395c..a8a1a8faf6 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -33,10 +33,6 @@
 #include "target/arm/multiprocessing.h"
 #include "target/arm/gtimer.h"
 
-#ifdef TARGET_AARCH64
-#define KVM_HAVE_MCE_INJECTION 1
-#endif
-
 #define EXCP_UDEF            1   /* undefined instruction */
 #define EXCP_SWI             2   /* software interrupt */
 #define EXCP_PREFETCH_ABORT  3
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index bd63036334..17ad0b644b 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -35,8 +35,6 @@
 
 #define XEN_NR_VIRQS 24
 
-#define KVM_HAVE_MCE_INJECTION 1
-
 /* support for self modifying code even if the modified instruction is
    close to the modifying instruction */
 #define TARGET_HAS_PRECISE_SMC

From 5a9d472d01a3760a0bae7b93b5d67af8178fbed3 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 24 Mar 2025 21:59:03 -0700
Subject: [PATCH 0193/2760] exec/poison: KVM_HAVE_MCE_INJECTION can now be
 poisoned

We prevent common code to use this define by mistake.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250325045915.994760-19-pierrick.bouvier@linaro.org>
---
 include/exec/poison.h | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/include/exec/poison.h b/include/exec/poison.h
index f267da6083..a09e0c1263 100644
--- a/include/exec/poison.h
+++ b/include/exec/poison.h
@@ -73,4 +73,6 @@
 #pragma GCC poison CONFIG_SOFTMMU
 #endif
 
+#pragma GCC poison KVM_HAVE_MCE_INJECTION
+
 #endif

From a725f37102317d64f7f23895906f8c8c5f5f1be9 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 24 Mar 2025 21:59:04 -0700
Subject: [PATCH 0194/2760] target/arm/cpu: always define kvm related registers

This does not hurt, even if they are not used.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250325045915.994760-20-pierrick.bouvier@linaro.org>
---
 target/arm/cpu.h | 2 --
 1 file changed, 2 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index a8a1a8faf6..ab7412772b 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -971,7 +971,6 @@ struct ArchCPU {
      */
     uint32_t kvm_target;
 
-#ifdef CONFIG_KVM
     /* KVM init features for this CPU */
     uint32_t kvm_init_features[7];
 
@@ -984,7 +983,6 @@ struct ArchCPU {
 
     /* KVM steal time */
     OnOffAuto kvm_steal_time;
-#endif /* CONFIG_KVM */
 
     /* Uniprocessor system with MP extensions */
     bool mp_is_up;

From 9fac39750df766c154e0960eca1962159ed50660 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 24 Mar 2025 21:59:05 -0700
Subject: [PATCH 0195/2760] target/arm/cpu: flags2 is always uint64_t
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Do not rely on target dependent type, but use a fixed type instead.
Since the original type is unsigned, it is safe to extend its size
without any side effect.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250325045915.994760-21-pierrick.bouvier@linaro.org>
---
 target/arm/cpu.h        | 10 ++++------
 target/arm/tcg/hflags.c |  4 ++--
 2 files changed, 6 insertions(+), 8 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index ab7412772b..cc975175c6 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -194,7 +194,7 @@ typedef struct ARMPACKey {
 /* See the commentary above the TBFLAG field definitions.  */
 typedef struct CPUARMTBFlags {
     uint32_t flags;
-    target_ulong flags2;
+    uint64_t flags2;
 } CPUARMTBFlags;
 
 typedef struct ARMMMUFaultInfo ARMMMUFaultInfo;
@@ -2968,11 +2968,9 @@ uint64_t arm_sctlr(CPUARMState *env, int el);
  * We collect these two parts in CPUARMTBFlags where they are named
  * flags and flags2 respectively.
  *
- * The flags that are shared between all execution modes, TBFLAG_ANY,
- * are stored in flags.  The flags that are specific to a given mode
- * are stores in flags2.  Since cs_base is sized on the configured
- * address size, flags2 always has 64-bits for A64, and a minimum of
- * 32-bits for A32 and M32.
+ * The flags that are shared between all execution modes, TBFLAG_ANY, are stored
+ * in flags. The flags that are specific to a given mode are stored in flags2.
+ * flags2 always has 64-bits, even though only 32-bits are used for A32 and M32.
  *
  * The bits for 32-bit A-profile and M-profile partially overlap:
  *
diff --git a/target/arm/tcg/hflags.c b/target/arm/tcg/hflags.c
index 8d79b8b7ae..e51d9f7b15 100644
--- a/target/arm/tcg/hflags.c
+++ b/target/arm/tcg/hflags.c
@@ -506,8 +506,8 @@ void assert_hflags_rebuild_correctly(CPUARMState *env)
 
     if (unlikely(c.flags != r.flags || c.flags2 != r.flags2)) {
         fprintf(stderr, "TCG hflags mismatch "
-                        "(current:(0x%08x,0x" TARGET_FMT_lx ")"
-                        " rebuilt:(0x%08x,0x" TARGET_FMT_lx ")\n",
+                        "(current:(0x%08x,0x%016" PRIx64 ")"
+                        " rebuilt:(0x%08x,0x%016" PRIx64 ")\n",
                 c.flags, c.flags2, r.flags, r.flags2);
         abort();
     }

From 77b0893f60ecabdc796565d130343e50cfdf28f9 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 24 Mar 2025 21:59:06 -0700
Subject: [PATCH 0196/2760] target/arm/cpu: define same set of registers for
 aarch32 and aarch64

To eliminate TARGET_AARCH64, we need to make various definitions common
between 32 and 64 bit Arm targets.
Added registers are used only by aarch64 code, and the only impact is on
the size of CPUARMState, and added zarray
(ARMVectorReg zarray[ARM_MAX_VQ * 16]) member (+64KB)

It could be eventually possible to allocate this array only for aarch64
emulation, but I'm not sure it's worth the hassle to save a few KB per
vcpu. Running qemu-system takes already several hundreds of MB of
(resident) memory, and qemu-user takes dozens of MB of (resident) memory
anyway.

As part of this, we define ARM_MAX_VQ once for aarch32 and aarch64,
which will affect zregs field for aarch32.
This field is used for MVE and SVE implementations. MVE implementation
is clipping index value to 0 or 1 for zregs[*].d[],
so we should not touch the rest of data in this case anyway.

This change is safe regarding migration, because aarch64 registers still
have the same size, and for aarch32, only zregs is modified.
Migration code explicitly specify a size of 2 for env.vfp.zregs[0].d,
VMSTATE_UINT64_SUB_ARRAY(env.vfp.zregs[0].d, ARMCPU, 0, 2). So extending
the storage size has no impact.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250325045915.994760-22-pierrick.bouvier@linaro.org>
---
 target/arm/cpu.h | 12 +-----------
 1 file changed, 1 insertion(+), 11 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index cc975175c6..b1c3e46326 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -169,17 +169,12 @@ typedef struct ARMGenericTimer {
  * Align the data for use with TCG host vector operations.
  */
 
-#ifdef TARGET_AARCH64
-# define ARM_MAX_VQ    16
-#else
-# define ARM_MAX_VQ    1
-#endif
+#define ARM_MAX_VQ    16
 
 typedef struct ARMVectorReg {
     uint64_t d[2 * ARM_MAX_VQ] QEMU_ALIGNED(16);
 } ARMVectorReg;
 
-#ifdef TARGET_AARCH64
 /* In AArch32 mode, predicate registers do not exist at all.  */
 typedef struct ARMPredicateReg {
     uint64_t p[DIV_ROUND_UP(2 * ARM_MAX_VQ, 8)] QEMU_ALIGNED(16);
@@ -189,7 +184,6 @@ typedef struct ARMPredicateReg {
 typedef struct ARMPACKey {
     uint64_t lo, hi;
 } ARMPACKey;
-#endif
 
 /* See the commentary above the TBFLAG field definitions.  */
 typedef struct CPUARMTBFlags {
@@ -660,13 +654,11 @@ typedef struct CPUArchState {
     struct {
         ARMVectorReg zregs[32];
 
-#ifdef TARGET_AARCH64
         /* Store FFR as pregs[16] to make it easier to treat as any other.  */
 #define FFR_PRED_NUM 16
         ARMPredicateReg pregs[17];
         /* Scratch space for aa64 sve predicate temporary.  */
         ARMPredicateReg preg_tmp;
-#endif
 
         /* We store these fpcsr fields separately for convenience.  */
         uint32_t qc[4] QEMU_ALIGNED(16);
@@ -711,7 +703,6 @@ typedef struct CPUArchState {
         uint32_t cregs[16];
     } iwmmxt;
 
-#ifdef TARGET_AARCH64
     struct {
         ARMPACKey apia;
         ARMPACKey apib;
@@ -743,7 +734,6 @@ typedef struct CPUArchState {
      * to keep the offsets into the rest of the structure smaller.
      */
     ARMVectorReg zarray[ARM_MAX_VQ * 16];
-#endif
 
     struct CPUBreakpoint *cpu_breakpoint[16];
     struct CPUWatchpoint *cpu_watchpoint[16];

From 63de8825af77edd71450f6bacaa55fb88d7f86e2 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 24 Mar 2025 21:59:07 -0700
Subject: [PATCH 0197/2760] target/arm/cpu: remove inline stubs for aarch32
 emulation

Directly condition associated calls in target/arm/helper.c for now.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250325045915.994760-23-pierrick.bouvier@linaro.org>
---
 target/arm/cpu.h    | 8 --------
 target/arm/helper.c | 6 ++++++
 2 files changed, 6 insertions(+), 8 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index b1c3e46326..c1a0faed3a 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -1222,7 +1222,6 @@ int arm_cpu_write_elf32_note(WriteCoreDumpFunction f, CPUState *cs,
  */
 void arm_emulate_firmware_reset(CPUState *cpustate, int target_el);
 
-#ifdef TARGET_AARCH64
 int aarch64_cpu_gdb_read_register(CPUState *cpu, GByteArray *buf, int reg);
 int aarch64_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
 void aarch64_sve_narrow_vq(CPUARMState *env, unsigned vq);
@@ -1254,13 +1253,6 @@ static inline uint64_t *sve_bswap64(uint64_t *dst, uint64_t *src, int nr)
 #endif
 }
 
-#else
-static inline void aarch64_sve_narrow_vq(CPUARMState *env, unsigned vq) { }
-static inline void aarch64_sve_change_el(CPUARMState *env, int o,
-                                         int n, bool a)
-{ }
-#endif
-
 void aarch64_sync_32_to_64(CPUARMState *env);
 void aarch64_sync_64_to_32(CPUARMState *env);
 
diff --git a/target/arm/helper.c b/target/arm/helper.c
index becbbbd0d8..7fb6e88630 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -6563,7 +6563,9 @@ static void zcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
      */
     new_len = sve_vqm1_for_el(env, cur_el);
     if (new_len < old_len) {
+#ifdef TARGET_AARCH64
         aarch64_sve_narrow_vq(env, new_len + 1);
+#endif
     }
 }
 
@@ -10628,7 +10630,9 @@ static void arm_cpu_do_interrupt_aarch64(CPUState *cs)
          * Note that new_el can never be 0.  If cur_el is 0, then
          * el0_a64 is is_a64(), else el0_a64 is ignored.
          */
+#ifdef TARGET_AARCH64
         aarch64_sve_change_el(env, cur_el, new_el, is_a64(env));
+#endif
     }
 
     if (cur_el < new_el) {
@@ -11640,7 +11644,9 @@ void aarch64_sve_change_el(CPUARMState *env, int old_el,
 
     /* When changing vector length, clear inaccessible state.  */
     if (new_len < old_len) {
+#ifdef TARGET_AARCH64
         aarch64_sve_narrow_vq(env, new_len + 1);
+#endif
     }
 }
 #endif

From 652d19a642b34cd99fc2ce65267a216cb9de8f4f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 4 Apr 2025 01:58:18 +0200
Subject: [PATCH 0198/2760] target/arm: Expose Aarch64 helpers unconditionally
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

At worst, for 32-bit arm binary, using these methods will
now produce a link time error, instead of a compile time one.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250403235821.9909-37-philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/internals.h | 2 --
 1 file changed, 2 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index 01408e40a3..d24acdd672 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -1808,7 +1808,6 @@ static inline uint64_t pmu_counter_mask(CPUARMState *env)
   return (1ULL << 31) | ((1ULL << pmu_num_counters(env)) - 1);
 }
 
-#ifdef TARGET_AARCH64
 GDBFeature *arm_gen_dynamic_svereg_feature(CPUState *cpu, int base_reg);
 int aarch64_gdb_get_sve_reg(CPUState *cs, GByteArray *buf, int reg);
 int aarch64_gdb_set_sve_reg(CPUState *cs, uint8_t *buf, int reg);
@@ -1826,7 +1825,6 @@ void aarch64_max_tcg_initfn(Object *obj);
 void aarch64_add_pauth_properties(Object *obj);
 void aarch64_add_sve_properties(Object *obj);
 void aarch64_add_sme_properties(Object *obj);
-#endif
 
 /* Read the CONTROL register as the MRS instruction would. */
 uint32_t arm_v7m_mrs_control(CPUARMState *env, uint32_t secure);

From d4ecfc569dcfb33dd9f00afaa6e2bd883fcf1e4a Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 24 Mar 2025 21:59:08 -0700
Subject: [PATCH 0199/2760] meson: add common hw files

Those files will be compiled once per base architecture ("arm" in this
case), instead of being compiled for every variant/bitness of
architecture.

We make sure to not include target cpu definitions (exec/cpu-defs.h) by
defining header guard directly. This way, a given compilation unit can
access a specific cpu definition, but not access to compile time defines
associated.

Previous commits took care to clean up some headers to not rely on
cpu-defs.h content.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250325045915.994760-24-pierrick.bouvier@linaro.org>
---
 meson.build | 37 ++++++++++++++++++++++++++++++++++++-
 1 file changed, 36 insertions(+), 1 deletion(-)

diff --git a/meson.build b/meson.build
index 657949326b..bcb9d39a38 100644
--- a/meson.build
+++ b/meson.build
@@ -3682,6 +3682,7 @@ hw_arch = {}
 target_arch = {}
 target_system_arch = {}
 target_user_arch = {}
+hw_common_arch = {}
 
 # NOTE: the trace/ subdirectory needs the qapi_trace_events variable
 # that is filled in by qapi/.
@@ -4079,6 +4080,34 @@ common_all = static_library('common',
                             implicit_include_directories: false,
                             dependencies: common_ss.all_dependencies())
 
+# construct common libraries per base architecture
+hw_common_arch_libs = {}
+foreach target : target_dirs
+  config_target = config_target_mak[target]
+  target_base_arch = config_target['TARGET_BASE_ARCH']
+
+  # check if already generated
+  if target_base_arch in hw_common_arch_libs
+    continue
+  endif
+
+  if target_base_arch in hw_common_arch
+    target_inc = [include_directories('target' / target_base_arch)]
+    src = hw_common_arch[target_base_arch]
+    lib = static_library(
+      'hw_' + target_base_arch,
+      build_by_default: false,
+      sources: src.all_sources() + genh,
+      include_directories: common_user_inc + target_inc,
+      implicit_include_directories: false,
+      # prevent common code to access cpu compile time
+      # definition, but still allow access to cpu.h
+      c_args: ['-DCPU_DEFS_H', '-DCOMPILING_SYSTEM_VS_USER', '-DCONFIG_SOFTMMU'],
+      dependencies: src.all_dependencies())
+    hw_common_arch_libs += {target_base_arch: lib}
+  endif
+endforeach
+
 if have_rust
   # We would like to use --generate-cstr, but it is only available
   # starting with bindgen 0.66.0.  The oldest supported versions
@@ -4244,8 +4273,14 @@ foreach target : target_dirs
   arch_deps += t.dependencies()
 
   target_common = common_ss.apply(config_target, strict: false)
-  objects = common_all.extract_objects(target_common.sources())
+  objects = [common_all.extract_objects(target_common.sources())]
   arch_deps += target_common.dependencies()
+  if target_type == 'system' and target_base_arch in hw_common_arch_libs
+    src = hw_common_arch[target_base_arch].apply(config_target, strict: false)
+    lib = hw_common_arch_libs[target_base_arch]
+    objects += lib.extract_objects(src.sources())
+    arch_deps += src.dependencies()
+  endif
 
   target_specific = specific_ss.apply(config_target, strict: false)
   arch_srcs += target_specific.sources()

From acbebffdda13cf502d70037f0cf60b7eb858a459 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 24 Mar 2025 21:59:09 -0700
Subject: [PATCH 0200/2760] hw/arm/boot: make compilation unit hw common

Now we eliminated poisoned identifiers from headers, this file can now
be compiled once for all arm targets.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250325045915.994760-25-pierrick.bouvier@linaro.org>
---
 hw/arm/boot.c      | 1 +
 hw/arm/meson.build | 5 ++++-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index d3811b896f..f94b940bc3 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -14,6 +14,7 @@
 #include <libfdt.h>
 #include "hw/arm/boot.h"
 #include "hw/arm/linux-boot-if.h"
+#include "cpu.h"
 #include "exec/target_page.h"
 #include "system/kvm.h"
 #include "system/tcg.h"
diff --git a/hw/arm/meson.build b/hw/arm/meson.build
index ac473ce7cd..9e8c96059e 100644
--- a/hw/arm/meson.build
+++ b/hw/arm/meson.build
@@ -1,5 +1,5 @@
 arm_ss = ss.source_set()
-arm_ss.add(files('boot.c'))
+arm_common_ss = ss.source_set()
 arm_ss.add(when: 'CONFIG_ARM_VIRT', if_true: files('virt.c'))
 arm_ss.add(when: 'CONFIG_ACPI', if_true: files('virt-acpi-build.c'))
 arm_ss.add(when: 'CONFIG_DIGIC', if_true: files('digic_boards.c'))
@@ -75,4 +75,7 @@ system_ss.add(when: 'CONFIG_SX1', if_true: files('omap_sx1.c'))
 system_ss.add(when: 'CONFIG_VERSATILE', if_true: files('versatilepb.c'))
 system_ss.add(when: 'CONFIG_VEXPRESS', if_true: files('vexpress.c'))
 
+arm_common_ss.add(fdt, files('boot.c'))
+
 hw_arch += {'arm': arm_ss}
+hw_common_arch += {'arm': arm_common_ss}

From f55cc73dffcf2734d6bd54f4edaceb1b0ed64b0d Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 24 Mar 2025 21:59:11 -0700
Subject: [PATCH 0201/2760] hw/arm/digic_boards: prepare compilation unit to be
 common

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250325045915.994760-27-pierrick.bouvier@linaro.org>
---
 hw/arm/digic_boards.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/arm/digic_boards.c b/hw/arm/digic_boards.c
index 2492fafeb8..466b8b84c0 100644
--- a/hw/arm/digic_boards.c
+++ b/hw/arm/digic_boards.c
@@ -80,7 +80,7 @@ static void digic4_board_init(MachineState *machine, DigicBoard *board)
 static void digic_load_rom(DigicState *s, hwaddr addr,
                            hwaddr max_size, const char *filename)
 {
-    target_long rom_size;
+    ssize_t rom_size;
 
     if (qtest_enabled()) {
         /* qtest runs no code so don't attempt a ROM load which

From c16ee1384b3b4cddf9777ce76813e36247f6e895 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 24 Mar 2025 21:59:12 -0700
Subject: [PATCH 0202/2760] hw/arm/xlnx-zynqmp: prepare compilation unit to be
 common
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Remove kvm unused headers.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250325045915.994760-28-pierrick.bouvier@linaro.org>
---
 hw/arm/xlnx-zynqmp.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c
index d6022ff2d3..ec2b3a41ed 100644
--- a/hw/arm/xlnx-zynqmp.c
+++ b/hw/arm/xlnx-zynqmp.c
@@ -22,9 +22,7 @@
 #include "hw/intc/arm_gic_common.h"
 #include "hw/misc/unimp.h"
 #include "hw/boards.h"
-#include "system/kvm.h"
 #include "system/system.h"
-#include "kvm_arm.h"
 #include "target/arm/cpu-qom.h"
 #include "target/arm/gtimer.h"
 

From 51cc143e83875c3b90570e80d47d330dd502487a Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 24 Mar 2025 21:59:13 -0700
Subject: [PATCH 0203/2760] hw/arm/xlnx-versal: prepare compilation unit to be
 common
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Remove kvm unused headers.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250325045915.994760-29-pierrick.bouvier@linaro.org>
---
 hw/arm/xlnx-versal.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index 278545a3f7..f0b383b29e 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -17,9 +17,7 @@
 #include "hw/sysbus.h"
 #include "net/net.h"
 #include "system/system.h"
-#include "system/kvm.h"
 #include "hw/arm/boot.h"
-#include "kvm_arm.h"
 #include "hw/misc/unimp.h"
 #include "hw/arm/xlnx-versal.h"
 #include "qemu/log.h"

From 6f4e8a92bbd9590ff87eda638bda82ec1d255f81 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 24 Mar 2025 21:59:14 -0700
Subject: [PATCH 0204/2760] hw/arm: make most of the compilation units common

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250325045915.994760-30-pierrick.bouvier@linaro.org>
---
 hw/arm/meson.build | 112 ++++++++++++++++++++++-----------------------
 1 file changed, 56 insertions(+), 56 deletions(-)

diff --git a/hw/arm/meson.build b/hw/arm/meson.build
index 9e8c96059e..09b1cfe5b5 100644
--- a/hw/arm/meson.build
+++ b/hw/arm/meson.build
@@ -2,43 +2,43 @@ arm_ss = ss.source_set()
 arm_common_ss = ss.source_set()
 arm_ss.add(when: 'CONFIG_ARM_VIRT', if_true: files('virt.c'))
 arm_ss.add(when: 'CONFIG_ACPI', if_true: files('virt-acpi-build.c'))
-arm_ss.add(when: 'CONFIG_DIGIC', if_true: files('digic_boards.c'))
-arm_ss.add(when: 'CONFIG_EMCRAFT_SF2', if_true: files('msf2-som.c'))
-arm_ss.add(when: 'CONFIG_HIGHBANK', if_true: files('highbank.c'))
-arm_ss.add(when: 'CONFIG_INTEGRATOR', if_true: files('integratorcp.c'))
-arm_ss.add(when: 'CONFIG_MICROBIT', if_true: files('microbit.c'))
-arm_ss.add(when: 'CONFIG_MPS3R', if_true: files('mps3r.c'))
-arm_ss.add(when: 'CONFIG_MUSICPAL', if_true: files('musicpal.c'))
-arm_ss.add(when: 'CONFIG_NETDUINOPLUS2', if_true: files('netduinoplus2.c'))
-arm_ss.add(when: 'CONFIG_OLIMEX_STM32_H405', if_true: files('olimex-stm32-h405.c'))
-arm_ss.add(when: 'CONFIG_NPCM7XX', if_true: files('npcm7xx.c', 'npcm7xx_boards.c'))
-arm_ss.add(when: 'CONFIG_NPCM8XX', if_true: files('npcm8xx.c', 'npcm8xx_boards.c'))
-arm_ss.add(when: 'CONFIG_REALVIEW', if_true: files('realview.c'))
+arm_common_ss.add(when: 'CONFIG_DIGIC', if_true: files('digic_boards.c'))
+arm_common_ss.add(when: 'CONFIG_EMCRAFT_SF2', if_true: files('msf2-som.c'))
+arm_common_ss.add(when: 'CONFIG_HIGHBANK', if_true: files('highbank.c'))
+arm_common_ss.add(when: 'CONFIG_INTEGRATOR', if_true: files('integratorcp.c'))
+arm_common_ss.add(when: 'CONFIG_MICROBIT', if_true: files('microbit.c'))
+arm_common_ss.add(when: 'CONFIG_MPS3R', if_true: files('mps3r.c'))
+arm_common_ss.add(when: 'CONFIG_MUSICPAL', if_true: [pixman, files('musicpal.c')])
+arm_common_ss.add(when: 'CONFIG_NETDUINOPLUS2', if_true: files('netduinoplus2.c'))
+arm_common_ss.add(when: 'CONFIG_OLIMEX_STM32_H405', if_true: files('olimex-stm32-h405.c'))
+arm_common_ss.add(when: 'CONFIG_NPCM7XX', if_true: files('npcm7xx.c', 'npcm7xx_boards.c'))
+arm_common_ss.add(when: 'CONFIG_NPCM8XX', if_true: files('npcm8xx.c', 'npcm8xx_boards.c'))
+arm_common_ss.add(when: 'CONFIG_REALVIEW', if_true: files('realview.c'))
 arm_ss.add(when: 'CONFIG_SBSA_REF', if_true: files('sbsa-ref.c'))
-arm_ss.add(when: 'CONFIG_STELLARIS', if_true: files('stellaris.c'))
-arm_ss.add(when: 'CONFIG_STM32VLDISCOVERY', if_true: files('stm32vldiscovery.c'))
-arm_ss.add(when: 'CONFIG_ZYNQ', if_true: files('xilinx_zynq.c'))
-arm_ss.add(when: 'CONFIG_SABRELITE', if_true: files('sabrelite.c'))
+arm_common_ss.add(when: 'CONFIG_STELLARIS', if_true: files('stellaris.c'))
+arm_common_ss.add(when: 'CONFIG_STM32VLDISCOVERY', if_true: files('stm32vldiscovery.c'))
+arm_common_ss.add(when: 'CONFIG_ZYNQ', if_true: files('xilinx_zynq.c'))
+arm_common_ss.add(when: 'CONFIG_SABRELITE', if_true: files('sabrelite.c'))
 
-arm_ss.add(when: 'CONFIG_ARM_V7M', if_true: files('armv7m.c'))
-arm_ss.add(when: 'CONFIG_EXYNOS4', if_true: files('exynos4210.c'))
-arm_ss.add(when: 'CONFIG_DIGIC', if_true: files('digic.c'))
-arm_ss.add(when: 'CONFIG_OMAP', if_true: files('omap1.c'))
-arm_ss.add(when: 'CONFIG_ALLWINNER_A10', if_true: files('allwinner-a10.c', 'cubieboard.c'))
-arm_ss.add(when: 'CONFIG_ALLWINNER_H3', if_true: files('allwinner-h3.c', 'orangepi.c'))
-arm_ss.add(when: 'CONFIG_ALLWINNER_R40', if_true: files('allwinner-r40.c', 'bananapi_m2u.c'))
+arm_common_ss.add(when: 'CONFIG_ARM_V7M', if_true: files('armv7m.c'))
+arm_common_ss.add(when: 'CONFIG_EXYNOS4', if_true: files('exynos4210.c'))
+arm_common_ss.add(when: 'CONFIG_DIGIC', if_true: files('digic.c'))
+arm_common_ss.add(when: 'CONFIG_OMAP', if_true: files('omap1.c'))
+arm_common_ss.add(when: 'CONFIG_ALLWINNER_A10', if_true: files('allwinner-a10.c', 'cubieboard.c'))
+arm_common_ss.add(when: 'CONFIG_ALLWINNER_H3', if_true: files('allwinner-h3.c', 'orangepi.c'))
+arm_common_ss.add(when: 'CONFIG_ALLWINNER_R40', if_true: files('allwinner-r40.c', 'bananapi_m2u.c'))
 arm_ss.add(when: 'CONFIG_RASPI', if_true: files('bcm2836.c', 'raspi.c'))
-arm_ss.add(when: ['CONFIG_RASPI', 'TARGET_AARCH64'], if_true: files('bcm2838.c', 'raspi4b.c'))
-arm_ss.add(when: 'CONFIG_STM32F100_SOC', if_true: files('stm32f100_soc.c'))
-arm_ss.add(when: 'CONFIG_STM32F205_SOC', if_true: files('stm32f205_soc.c'))
-arm_ss.add(when: 'CONFIG_STM32F405_SOC', if_true: files('stm32f405_soc.c'))
-arm_ss.add(when: 'CONFIG_B_L475E_IOT01A', if_true: files('b-l475e-iot01a.c'))
-arm_ss.add(when: 'CONFIG_STM32L4X5_SOC', if_true: files('stm32l4x5_soc.c'))
-arm_ss.add(when: 'CONFIG_XLNX_ZYNQMP_ARM', if_true: files('xlnx-zynqmp.c', 'xlnx-zcu102.c'))
-arm_ss.add(when: 'CONFIG_XLNX_VERSAL', if_true: files('xlnx-versal.c', 'xlnx-versal-virt.c'))
-arm_ss.add(when: 'CONFIG_FSL_IMX25', if_true: files('fsl-imx25.c', 'imx25_pdk.c'))
-arm_ss.add(when: 'CONFIG_FSL_IMX31', if_true: files('fsl-imx31.c', 'kzm.c'))
-arm_ss.add(when: 'CONFIG_FSL_IMX6', if_true: files('fsl-imx6.c'))
+arm_common_ss.add(when: ['CONFIG_RASPI', 'TARGET_AARCH64'], if_true: files('bcm2838.c', 'raspi4b.c'))
+arm_common_ss.add(when: 'CONFIG_STM32F100_SOC', if_true: files('stm32f100_soc.c'))
+arm_common_ss.add(when: 'CONFIG_STM32F205_SOC', if_true: files('stm32f205_soc.c'))
+arm_common_ss.add(when: 'CONFIG_STM32F405_SOC', if_true: files('stm32f405_soc.c'))
+arm_common_ss.add(when: 'CONFIG_B_L475E_IOT01A', if_true: files('b-l475e-iot01a.c'))
+arm_common_ss.add(when: 'CONFIG_STM32L4X5_SOC', if_true: files('stm32l4x5_soc.c'))
+arm_common_ss.add(when: 'CONFIG_XLNX_ZYNQMP_ARM', if_true: files('xlnx-zynqmp.c', 'xlnx-zcu102.c'))
+arm_common_ss.add(when: 'CONFIG_XLNX_VERSAL', if_true: files('xlnx-versal.c', 'xlnx-versal-virt.c'))
+arm_common_ss.add(when: 'CONFIG_FSL_IMX25', if_true: files('fsl-imx25.c', 'imx25_pdk.c'))
+arm_common_ss.add(when: 'CONFIG_FSL_IMX31', if_true: files('fsl-imx31.c', 'kzm.c'))
+arm_common_ss.add(when: 'CONFIG_FSL_IMX6', if_true: files('fsl-imx6.c'))
 arm_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files(
   'aspeed.c',
   'aspeed_soc_common.c',
@@ -47,33 +47,33 @@ arm_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files(
   'aspeed_ast10x0.c',
   'aspeed_eeprom.c',
   'fby35.c'))
-arm_ss.add(when: ['CONFIG_ASPEED_SOC', 'TARGET_AARCH64'], if_true: files('aspeed_ast27x0.c'))
-arm_ss.add(when: 'CONFIG_MPS2', if_true: files('mps2.c'))
-arm_ss.add(when: 'CONFIG_MPS2', if_true: files('mps2-tz.c'))
-arm_ss.add(when: 'CONFIG_MSF2', if_true: files('msf2-soc.c'))
-arm_ss.add(when: 'CONFIG_MUSCA', if_true: files('musca.c'))
-arm_ss.add(when: 'CONFIG_ARMSSE', if_true: files('armsse.c'))
-arm_ss.add(when: 'CONFIG_FSL_IMX7', if_true: files('fsl-imx7.c', 'mcimx7d-sabre.c'))
-arm_ss.add(when: 'CONFIG_FSL_IMX8MP', if_true: files('fsl-imx8mp.c'))
-arm_ss.add(when: 'CONFIG_FSL_IMX8MP_EVK', if_true: files('imx8mp-evk.c'))
-arm_ss.add(when: 'CONFIG_ARM_SMMUV3', if_true: files('smmuv3.c'))
-arm_ss.add(when: 'CONFIG_FSL_IMX6UL', if_true: files('fsl-imx6ul.c', 'mcimx6ul-evk.c'))
-arm_ss.add(when: 'CONFIG_NRF51_SOC', if_true: files('nrf51_soc.c'))
+arm_common_ss.add(when: ['CONFIG_ASPEED_SOC', 'TARGET_AARCH64'], if_true: files('aspeed_ast27x0.c'))
+arm_common_ss.add(when: 'CONFIG_MPS2', if_true: files('mps2.c'))
+arm_common_ss.add(when: 'CONFIG_MPS2', if_true: files('mps2-tz.c'))
+arm_common_ss.add(when: 'CONFIG_MSF2', if_true: files('msf2-soc.c'))
+arm_common_ss.add(when: 'CONFIG_MUSCA', if_true: files('musca.c'))
+arm_common_ss.add(when: 'CONFIG_ARMSSE', if_true: files('armsse.c'))
+arm_common_ss.add(when: 'CONFIG_FSL_IMX7', if_true: files('fsl-imx7.c', 'mcimx7d-sabre.c'))
+arm_common_ss.add(when: 'CONFIG_FSL_IMX8MP', if_true: files('fsl-imx8mp.c'))
+arm_common_ss.add(when: 'CONFIG_FSL_IMX8MP_EVK', if_true: files('imx8mp-evk.c'))
+arm_common_ss.add(when: 'CONFIG_ARM_SMMUV3', if_true: files('smmuv3.c'))
+arm_common_ss.add(when: 'CONFIG_FSL_IMX6UL', if_true: files('fsl-imx6ul.c', 'mcimx6ul-evk.c'))
+arm_common_ss.add(when: 'CONFIG_NRF51_SOC', if_true: files('nrf51_soc.c'))
 arm_ss.add(when: 'CONFIG_XEN', if_true: files(
   'xen-stubs.c',
   'xen-pvh.c',
 ))
 
-system_ss.add(when: 'CONFIG_ARM_SMMUV3', if_true: files('smmu-common.c'))
-system_ss.add(when: 'CONFIG_COLLIE', if_true: files('collie.c'))
-system_ss.add(when: 'CONFIG_EXYNOS4', if_true: files('exynos4_boards.c'))
-system_ss.add(when: 'CONFIG_NETDUINO2', if_true: files('netduino2.c'))
-system_ss.add(when: 'CONFIG_RASPI', if_true: files('bcm2835_peripherals.c'))
-system_ss.add(when: 'CONFIG_RASPI', if_true: files('bcm2838_peripherals.c'))
-system_ss.add(when: 'CONFIG_STRONGARM', if_true: files('strongarm.c'))
-system_ss.add(when: 'CONFIG_SX1', if_true: files('omap_sx1.c'))
-system_ss.add(when: 'CONFIG_VERSATILE', if_true: files('versatilepb.c'))
-system_ss.add(when: 'CONFIG_VEXPRESS', if_true: files('vexpress.c'))
+arm_common_ss.add(when: 'CONFIG_ARM_SMMUV3', if_true: files('smmu-common.c'))
+arm_common_ss.add(when: 'CONFIG_COLLIE', if_true: files('collie.c'))
+arm_common_ss.add(when: 'CONFIG_EXYNOS4', if_true: files('exynos4_boards.c'))
+arm_common_ss.add(when: 'CONFIG_NETDUINO2', if_true: files('netduino2.c'))
+arm_common_ss.add(when: 'CONFIG_RASPI', if_true: files('bcm2835_peripherals.c'))
+arm_common_ss.add(when: 'CONFIG_RASPI', if_true: files('bcm2838_peripherals.c'))
+arm_common_ss.add(when: 'CONFIG_STRONGARM', if_true: files('strongarm.c'))
+arm_common_ss.add(when: 'CONFIG_SX1', if_true: files('omap_sx1.c'))
+arm_common_ss.add(when: 'CONFIG_VERSATILE', if_true: files('versatilepb.c'))
+arm_common_ss.add(when: 'CONFIG_VEXPRESS', if_true: files('vexpress.c'))
 
 arm_common_ss.add(fdt, files('boot.c'))
 

From 8280a8b86659bf3c6965ccdad8458ab366817d6b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 2 Apr 2025 15:37:26 +0100
Subject: [PATCH 0205/2760] target/riscv: Do not expose rv128 CPU on user mode
 emulation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

As Richard mentioned:

  We should allow RV128 in user-mode at all until there's a
  kernel abi for it.

Remove the experimental 'x-rv128' CPU on user emulation
(since it is experimental, no deprecation period is required).

Reported-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/riscv/cpu.c         | 10 ++++------
 target/riscv/tcg/tcg-cpu.c |  5 +++--
 2 files changed, 7 insertions(+), 8 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 430b02d2a5..ad534cee51 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -697,7 +697,7 @@ static void rv64_xiangshan_nanhu_cpu_init(Object *obj)
 #endif
 }
 
-#ifdef CONFIG_TCG
+#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
 static void rv128_base_cpu_init(Object *obj)
 {
     RISCVCPU *cpu = RISCV_CPU(obj);
@@ -708,11 +708,9 @@ static void rv128_base_cpu_init(Object *obj)
 
     /* Set latest version of privileged specification */
     env->priv_ver = PRIV_VERSION_LATEST;
-#ifndef CONFIG_USER_ONLY
     set_satp_mode_max_supported(RISCV_CPU(obj), VM_1_10_SV57);
-#endif
 }
-#endif /* CONFIG_TCG */
+#endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
 
 static void rv64i_bare_cpu_init(Object *obj)
 {
@@ -3255,9 +3253,9 @@ static const TypeInfo riscv_cpu_type_infos[] = {
     DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_VEYRON_V1,  MXL_RV64,  rv64_veyron_v1_cpu_init),
     DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_XIANGSHAN_NANHU,
                                                  MXL_RV64, rv64_xiangshan_nanhu_cpu_init),
-#ifdef CONFIG_TCG
+#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
     DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_BASE128,   MXL_RV128, rv128_base_cpu_init),
-#endif /* CONFIG_TCG */
+#endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
     DEFINE_BARE_CPU(TYPE_RISCV_CPU_RV64I,        MXL_RV64,  rv64i_bare_cpu_init),
     DEFINE_BARE_CPU(TYPE_RISCV_CPU_RV64E,        MXL_RV64,  rv64e_bare_cpu_init),
     DEFINE_PROFILE_CPU(TYPE_RISCV_CPU_RVA22U64,  MXL_RV64,  rva22u64_profile_cpu_init),
diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index 710449d17e..5d0429b4d0 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -1046,7 +1046,6 @@ static bool riscv_cpu_is_generic(Object *cpu_obj)
 static bool riscv_tcg_cpu_realize(CPUState *cs, Error **errp)
 {
     RISCVCPU *cpu = RISCV_CPU(cs);
-    RISCVCPUClass *mcc = RISCV_CPU_GET_CLASS(cpu);
 
     if (!riscv_cpu_tcg_compatible(cpu)) {
         g_autofree char *name = riscv_cpu_get_name(cpu);
@@ -1055,6 +1054,9 @@ static bool riscv_tcg_cpu_realize(CPUState *cs, Error **errp)
         return false;
     }
 
+#ifndef CONFIG_USER_ONLY
+    RISCVCPUClass *mcc = RISCV_CPU_GET_CLASS(cpu);
+
     if (mcc->misa_mxl_max >= MXL_RV128 && qemu_tcg_mttcg_enabled()) {
         /* Missing 128-bit aligned atomics */
         error_setg(errp,
@@ -1063,7 +1065,6 @@ static bool riscv_tcg_cpu_realize(CPUState *cs, Error **errp)
         return false;
     }
 
-#ifndef CONFIG_USER_ONLY
     CPURISCVState *env = &cpu->env;
 
     tcg_cflags_set(CPU(cs), CF_PCREL);

From 79b835f1395ea5cba9a1d5f02c0fb1a429d48e7d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 3 Apr 2025 23:37:54 +0200
Subject: [PATCH 0206/2760] tcg: Include missing 'cpu.h' in translate-all.c
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

tb_check_watchpoint() calls cpu_get_tb_cpu_state(),
which is declared in each "cpu.h" header. It is indirectly
included via "tcg/insn-start-words.h". Since we want to
rework "tcg/insn-start-words.h", removing "cpu.h" in the
next commit, add the missing header now, otherwise we'd
get:

  accel/tcg/translate-all.c:598:9: error: call to undeclared function 'cpu_get_tb_cpu_state' [-Wimplicit-function-declaration]
  598 |         cpu_get_tb_cpu_state(env, &pc, &cs_base, &flags);
      |         ^

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/translate-all.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index ed41fc5d0c..c5590eb695 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -69,6 +69,7 @@
 #include "internal-target.h"
 #include "tcg/perf.h"
 #include "tcg/insn-start-words.h"
+#include "cpu.h"
 
 TBContext tb_ctx;
 

From 21d41c566d0694a90836d5c7ae4c6b279f5312a8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 19 Mar 2025 12:46:47 +0100
Subject: [PATCH 0207/2760] tcg: Declare TARGET_INSN_START_EXTRA_WORDS in
 'cpu-param.h'
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

To avoid including the huge "cpu.h" for a simple definition,
move TARGET_INSN_START_EXTRA_WORDS to "cpu-param.h".

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/tcg/insn-start-words.h | 2 +-
 target/arm/cpu-param.h         | 7 +++++++
 target/arm/cpu.h               | 6 ------
 target/hppa/cpu-param.h        | 2 ++
 target/hppa/cpu.h              | 2 --
 target/i386/cpu-param.h        | 2 ++
 target/i386/cpu.h              | 2 --
 target/m68k/cpu-param.h        | 2 ++
 target/m68k/cpu.h              | 2 --
 target/microblaze/cpu-param.h  | 2 ++
 target/microblaze/cpu.h        | 2 --
 target/mips/cpu-param.h        | 2 ++
 target/mips/cpu.h              | 2 --
 target/openrisc/cpu-param.h    | 2 ++
 target/openrisc/cpu.h          | 2 --
 target/riscv/cpu-param.h       | 8 ++++++++
 target/riscv/cpu.h             | 6 ------
 target/s390x/cpu-param.h       | 2 ++
 target/s390x/cpu.h             | 2 --
 target/sh4/cpu-param.h         | 2 ++
 target/sh4/cpu.h               | 2 --
 target/sparc/cpu-param.h       | 2 ++
 target/sparc/cpu.h             | 1 -
 23 files changed, 34 insertions(+), 30 deletions(-)

diff --git a/include/tcg/insn-start-words.h b/include/tcg/insn-start-words.h
index 50c18bd326..c439c09f2f 100644
--- a/include/tcg/insn-start-words.h
+++ b/include/tcg/insn-start-words.h
@@ -6,7 +6,7 @@
 
 #ifndef TARGET_INSN_START_WORDS
 
-#include "cpu.h"
+#include "cpu-param.h"
 
 #ifndef TARGET_INSN_START_EXTRA_WORDS
 # define TARGET_INSN_START_WORDS 1
diff --git a/target/arm/cpu-param.h b/target/arm/cpu-param.h
index a7ae42d17d..2cee4be693 100644
--- a/target/arm/cpu-param.h
+++ b/target/arm/cpu-param.h
@@ -37,6 +37,13 @@
 # define TARGET_PAGE_BITS_LEGACY 10
 #endif /* !CONFIG_USER_ONLY */
 
+/*
+ * ARM-specific extra insn start words:
+ * 1: Conditional execution bits
+ * 2: Partial exception syndrome for data aborts
+ */
+#define TARGET_INSN_START_EXTRA_WORDS 2
+
 /* ARM processors have a weak memory model */
 #define TCG_GUEST_DEFAULT_MO      (0)
 
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index c1a0faed3a..3705b34285 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -98,12 +98,6 @@
 #define offsetofhigh32(S, M) (offsetof(S, M) + sizeof(uint32_t))
 #endif
 
-/* ARM-specific extra insn start words:
- * 1: Conditional execution bits
- * 2: Partial exception syndrome for data aborts
- */
-#define TARGET_INSN_START_EXTRA_WORDS 2
-
 /* The 2nd extra word holding syndrome info for data aborts does not use
  * the upper 6 bits nor the lower 13 bits. We mask and shift it down to
  * help the sleb128 encoder do a better job.
diff --git a/target/hppa/cpu-param.h b/target/hppa/cpu-param.h
index 7ed6b5741e..68ed84e84a 100644
--- a/target/hppa/cpu-param.h
+++ b/target/hppa/cpu-param.h
@@ -19,6 +19,8 @@
 
 #define TARGET_PAGE_BITS 12
 
+#define TARGET_INSN_START_EXTRA_WORDS 2
+
 /* PA-RISC 1.x processors have a strong memory model.  */
 /*
  * ??? While we do not yet implement PA-RISC 2.0, those processors have
diff --git a/target/hppa/cpu.h b/target/hppa/cpu.h
index da5f8adcd5..acc9937240 100644
--- a/target/hppa/cpu.h
+++ b/target/hppa/cpu.h
@@ -48,8 +48,6 @@
 #define PRIV_KERNEL       0
 #define PRIV_USER         3
 
-#define TARGET_INSN_START_EXTRA_WORDS 2
-
 /* No need to flush MMU_ABS*_IDX  */
 #define HPPA_MMU_FLUSH_MASK                             \
         (1 << MMU_KERNEL_IDX | 1 << MMU_KERNEL_P_IDX |  \
diff --git a/target/i386/cpu-param.h b/target/i386/cpu-param.h
index b0e884c5d7..0c8efce861 100644
--- a/target/i386/cpu-param.h
+++ b/target/i386/cpu-param.h
@@ -22,6 +22,8 @@
 #endif
 #define TARGET_PAGE_BITS 12
 
+#define TARGET_INSN_START_EXTRA_WORDS 1
+
 /* The x86 has a strong memory model with some store-after-load re-ordering */
 #define TCG_GUEST_DEFAULT_MO      (TCG_MO_ALL & ~TCG_MO_ST_LD)
 
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index 17ad0b644b..9866595cd0 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -1610,8 +1610,6 @@ typedef struct {
 #define MAX_FIXED_COUNTERS 3
 #define MAX_GP_COUNTERS    (MSR_IA32_PERF_STATUS - MSR_P6_EVNTSEL0)
 
-#define TARGET_INSN_START_EXTRA_WORDS 1
-
 #define NB_OPMASK_REGS 8
 
 /* CPU can't have 0xFFFFFFFF APIC ID, use that value to distinguish
diff --git a/target/m68k/cpu-param.h b/target/m68k/cpu-param.h
index 7afbf6d302..256a2b5f8b 100644
--- a/target/m68k/cpu-param.h
+++ b/target/m68k/cpu-param.h
@@ -17,4 +17,6 @@
 #define TARGET_PHYS_ADDR_SPACE_BITS 32
 #define TARGET_VIRT_ADDR_SPACE_BITS 32
 
+#define TARGET_INSN_START_EXTRA_WORDS 1
+
 #endif
diff --git a/target/m68k/cpu.h b/target/m68k/cpu.h
index 0b70e8c6ab..39d0b9d6d7 100644
--- a/target/m68k/cpu.h
+++ b/target/m68k/cpu.h
@@ -78,8 +78,6 @@
 #define M68K_MAX_TTR 2
 #define TTR(type, index) ttr[((type & ACCESS_CODE) == ACCESS_CODE) * 2 + index]
 
-#define TARGET_INSN_START_EXTRA_WORDS 1
-
 typedef CPU_LDoubleU FPReg;
 
 typedef struct CPUArchState {
diff --git a/target/microblaze/cpu-param.h b/target/microblaze/cpu-param.h
index c866ec6c14..5d55e0e3c4 100644
--- a/target/microblaze/cpu-param.h
+++ b/target/microblaze/cpu-param.h
@@ -27,6 +27,8 @@
 /* FIXME: MB uses variable pages down to 1K but linux only uses 4k.  */
 #define TARGET_PAGE_BITS 12
 
+#define TARGET_INSN_START_EXTRA_WORDS 1
+
 /* MicroBlaze is always in-order. */
 #define TCG_GUEST_DEFAULT_MO  TCG_MO_ALL
 
diff --git a/target/microblaze/cpu.h b/target/microblaze/cpu.h
index 2bfa396c96..d511f22a55 100644
--- a/target/microblaze/cpu.h
+++ b/target/microblaze/cpu.h
@@ -233,8 +233,6 @@ typedef struct CPUArchState CPUMBState;
 #define STREAM_CONTROL   (1 << 3)
 #define STREAM_NONBLOCK  (1 << 4)
 
-#define TARGET_INSN_START_EXTRA_WORDS 1
-
 /* use-non-secure property masks */
 #define USE_NON_SECURE_M_AXI_DP_MASK 0x1
 #define USE_NON_SECURE_M_AXI_IP_MASK 0x2
diff --git a/target/mips/cpu-param.h b/target/mips/cpu-param.h
index 8fcb1b4f5f..99ca8d1684 100644
--- a/target/mips/cpu-param.h
+++ b/target/mips/cpu-param.h
@@ -20,6 +20,8 @@
 #endif
 #define TARGET_PAGE_BITS 12
 
+#define TARGET_INSN_START_EXTRA_WORDS 2
+
 #define TCG_GUEST_DEFAULT_MO (0)
 
 #endif
diff --git a/target/mips/cpu.h b/target/mips/cpu.h
index 20f31370bc..d16f9a7220 100644
--- a/target/mips/cpu.h
+++ b/target/mips/cpu.h
@@ -100,8 +100,6 @@ struct CPUMIPSFPUContext {
 #define FP_UNIMPLEMENTED  32
 };
 
-#define TARGET_INSN_START_EXTRA_WORDS 2
-
 typedef struct CPUMIPSMVPContext CPUMIPSMVPContext;
 struct CPUMIPSMVPContext {
     int32_t CP0_MVPControl;
diff --git a/target/openrisc/cpu-param.h b/target/openrisc/cpu-param.h
index 37627f2c39..7ea0ecb55a 100644
--- a/target/openrisc/cpu-param.h
+++ b/target/openrisc/cpu-param.h
@@ -12,6 +12,8 @@
 #define TARGET_PHYS_ADDR_SPACE_BITS 32
 #define TARGET_VIRT_ADDR_SPACE_BITS 32
 
+#define TARGET_INSN_START_EXTRA_WORDS 1
+
 #define TCG_GUEST_DEFAULT_MO (0)
 
 #endif
diff --git a/target/openrisc/cpu.h b/target/openrisc/cpu.h
index 19ee85ff5a..569819bfb0 100644
--- a/target/openrisc/cpu.h
+++ b/target/openrisc/cpu.h
@@ -40,8 +40,6 @@ struct OpenRISCCPUClass {
     ResettablePhases parent_phases;
 };
 
-#define TARGET_INSN_START_EXTRA_WORDS 1
-
 enum {
     MMU_NOMMU_IDX = 0,
     MMU_SUPERVISOR_IDX = 1,
diff --git a/target/riscv/cpu-param.h b/target/riscv/cpu-param.h
index fba30e966a..ff4ba81965 100644
--- a/target/riscv/cpu-param.h
+++ b/target/riscv/cpu-param.h
@@ -16,6 +16,14 @@
 # define TARGET_VIRT_ADDR_SPACE_BITS 32 /* sv32 */
 #endif
 #define TARGET_PAGE_BITS 12 /* 4 KiB Pages */
+
+/*
+ * RISC-V-specific extra insn start words:
+ * 1: Original instruction opcode
+ * 2: more information about instruction
+ */
+#define TARGET_INSN_START_EXTRA_WORDS 2
+
 /*
  * The current MMU Modes are:
  *  - U mode 0b000
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index 867e539b53..167909c89b 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -45,12 +45,6 @@ typedef struct CPUArchState CPURISCVState;
 # define TYPE_RISCV_CPU_BASE            TYPE_RISCV_CPU_BASE64
 #endif
 
-/*
- * RISC-V-specific extra insn start words:
- * 1: Original instruction opcode
- * 2: more information about instruction
- */
-#define TARGET_INSN_START_EXTRA_WORDS 2
 /*
  * b0: Whether a instruction always raise a store AMO or not.
  */
diff --git a/target/s390x/cpu-param.h b/target/s390x/cpu-param.h
index 5c331ec424..a8a4377f4f 100644
--- a/target/s390x/cpu-param.h
+++ b/target/s390x/cpu-param.h
@@ -12,6 +12,8 @@
 #define TARGET_PHYS_ADDR_SPACE_BITS 64
 #define TARGET_VIRT_ADDR_SPACE_BITS 64
 
+#define TARGET_INSN_START_EXTRA_WORDS 2
+
 /*
  * The z/Architecture has a strong memory model with some
  * store-after-load re-ordering.
diff --git a/target/s390x/cpu.h b/target/s390x/cpu.h
index 940eda8dd1..90f64ee20c 100644
--- a/target/s390x/cpu.h
+++ b/target/s390x/cpu.h
@@ -37,8 +37,6 @@
 
 #define TARGET_HAS_PRECISE_SMC
 
-#define TARGET_INSN_START_EXTRA_WORDS 2
-
 #define MMU_USER_IDX 0
 
 #define S390_MAX_CPUS 248
diff --git a/target/sh4/cpu-param.h b/target/sh4/cpu-param.h
index 2b6e11dd0a..f328715ee8 100644
--- a/target/sh4/cpu-param.h
+++ b/target/sh4/cpu-param.h
@@ -16,4 +16,6 @@
 # define TARGET_VIRT_ADDR_SPACE_BITS 32
 #endif
 
+#define TARGET_INSN_START_EXTRA_WORDS 1
+
 #endif
diff --git a/target/sh4/cpu.h b/target/sh4/cpu.h
index 7752a0c2e1..906f99ddf0 100644
--- a/target/sh4/cpu.h
+++ b/target/sh4/cpu.h
@@ -127,8 +127,6 @@ typedef struct tlb_t {
 #define UTLB_SIZE 64
 #define ITLB_SIZE 4
 
-#define TARGET_INSN_START_EXTRA_WORDS 1
-
 enum sh_features {
     SH_FEATURE_SH4A = 1,
     SH_FEATURE_BCR3_AND_BCR4 = 2,
diff --git a/target/sparc/cpu-param.h b/target/sparc/cpu-param.h
index 6952ee2b82..62d47b804b 100644
--- a/target/sparc/cpu-param.h
+++ b/target/sparc/cpu-param.h
@@ -21,6 +21,8 @@
 # define TARGET_VIRT_ADDR_SPACE_BITS 32
 #endif
 
+#define TARGET_INSN_START_EXTRA_WORDS 1
+
 /*
  * From Oracle SPARC Architecture 2015:
  *
diff --git a/target/sparc/cpu.h b/target/sparc/cpu.h
index 734dfdb1d3..83ac818933 100644
--- a/target/sparc/cpu.h
+++ b/target/sparc/cpu.h
@@ -223,7 +223,6 @@ typedef struct trap_state {
     uint32_t tt;
 } trap_state;
 #endif
-#define TARGET_INSN_START_EXTRA_WORDS 1
 
 typedef struct sparc_def_t {
     const char *name;

From 4ff1b33edf95497a8e6f0615a3ae91f736cf1f8a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 19 Mar 2025 12:46:55 +0100
Subject: [PATCH 0208/2760] tcg: Always define TARGET_INSN_START_EXTRA_WORDS
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Do not define TARGET_INSN_START_EXTRA_WORDS under the
hood, have each target explicitly define it.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/tcg/insn-start-words.h | 4 ----
 include/tcg/tcg-op.h           | 2 +-
 target/alpha/cpu-param.h       | 2 ++
 target/avr/cpu-param.h         | 2 ++
 target/hexagon/cpu-param.h     | 2 ++
 target/loongarch/cpu-param.h   | 2 ++
 target/ppc/cpu-param.h         | 2 ++
 target/rx/cpu-param.h          | 2 ++
 target/tricore/cpu-param.h     | 2 ++
 target/xtensa/cpu-param.h      | 2 ++
 10 files changed, 17 insertions(+), 5 deletions(-)

diff --git a/include/tcg/insn-start-words.h b/include/tcg/insn-start-words.h
index c439c09f2f..d416d19bcf 100644
--- a/include/tcg/insn-start-words.h
+++ b/include/tcg/insn-start-words.h
@@ -8,10 +8,6 @@
 
 #include "cpu-param.h"
 
-#ifndef TARGET_INSN_START_EXTRA_WORDS
-# define TARGET_INSN_START_WORDS 1
-#else
 # define TARGET_INSN_START_WORDS (1 + TARGET_INSN_START_EXTRA_WORDS)
-#endif
 
 #endif /* TARGET_INSN_START_WORDS */
diff --git a/include/tcg/tcg-op.h b/include/tcg/tcg-op.h
index bc46b5570c..cded92a447 100644
--- a/include/tcg/tcg-op.h
+++ b/include/tcg/tcg-op.h
@@ -23,7 +23,7 @@
 # error
 #endif
 
-#ifndef TARGET_INSN_START_EXTRA_WORDS
+#if TARGET_INSN_START_EXTRA_WORDS == 0
 static inline void tcg_gen_insn_start(target_ulong pc)
 {
     TCGOp *op = tcg_emit_op(INDEX_op_insn_start, 64 / TCG_TARGET_REG_BITS);
diff --git a/target/alpha/cpu-param.h b/target/alpha/cpu-param.h
index 63989e71c0..dd44feb179 100644
--- a/target/alpha/cpu-param.h
+++ b/target/alpha/cpu-param.h
@@ -24,6 +24,8 @@
 # define TARGET_VIRT_ADDR_SPACE_BITS  (30 + TARGET_PAGE_BITS)
 #endif
 
+#define TARGET_INSN_START_EXTRA_WORDS 0
+
 /* Alpha processors have a weak memory model */
 #define TCG_GUEST_DEFAULT_MO      (0)
 
diff --git a/target/avr/cpu-param.h b/target/avr/cpu-param.h
index f5248ce9e7..9d37848d97 100644
--- a/target/avr/cpu-param.h
+++ b/target/avr/cpu-param.h
@@ -25,6 +25,8 @@
 #define TARGET_PHYS_ADDR_SPACE_BITS 24
 #define TARGET_VIRT_ADDR_SPACE_BITS 24
 
+#define TARGET_INSN_START_EXTRA_WORDS 0
+
 #define TCG_GUEST_DEFAULT_MO 0
 
 #endif
diff --git a/target/hexagon/cpu-param.h b/target/hexagon/cpu-param.h
index 45ee7b4640..635d509e74 100644
--- a/target/hexagon/cpu-param.h
+++ b/target/hexagon/cpu-param.h
@@ -23,4 +23,6 @@
 #define TARGET_PHYS_ADDR_SPACE_BITS 36
 #define TARGET_VIRT_ADDR_SPACE_BITS 32
 
+#define TARGET_INSN_START_EXTRA_WORDS 0
+
 #endif
diff --git a/target/loongarch/cpu-param.h b/target/loongarch/cpu-param.h
index 52437946e5..dbe414bb35 100644
--- a/target/loongarch/cpu-param.h
+++ b/target/loongarch/cpu-param.h
@@ -13,6 +13,8 @@
 
 #define TARGET_PAGE_BITS 12
 
+#define TARGET_INSN_START_EXTRA_WORDS 0
+
 #define TCG_GUEST_DEFAULT_MO (0)
 
 #endif
diff --git a/target/ppc/cpu-param.h b/target/ppc/cpu-param.h
index 553ad2f4c6..d0651d2ac8 100644
--- a/target/ppc/cpu-param.h
+++ b/target/ppc/cpu-param.h
@@ -37,6 +37,8 @@
 # define TARGET_PAGE_BITS 12
 #endif
 
+#define TARGET_INSN_START_EXTRA_WORDS 0
+
 #define TCG_GUEST_DEFAULT_MO 0
 
 #endif
diff --git a/target/rx/cpu-param.h b/target/rx/cpu-param.h
index ef1970a09e..84934f3bca 100644
--- a/target/rx/cpu-param.h
+++ b/target/rx/cpu-param.h
@@ -24,4 +24,6 @@
 #define TARGET_PHYS_ADDR_SPACE_BITS 32
 #define TARGET_VIRT_ADDR_SPACE_BITS 32
 
+#define TARGET_INSN_START_EXTRA_WORDS 0
+
 #endif
diff --git a/target/tricore/cpu-param.h b/target/tricore/cpu-param.h
index 790242ef3d..eb33a67c41 100644
--- a/target/tricore/cpu-param.h
+++ b/target/tricore/cpu-param.h
@@ -12,4 +12,6 @@
 #define TARGET_PHYS_ADDR_SPACE_BITS 32
 #define TARGET_VIRT_ADDR_SPACE_BITS 32
 
+#define TARGET_INSN_START_EXTRA_WORDS 0
+
 #endif
diff --git a/target/xtensa/cpu-param.h b/target/xtensa/cpu-param.h
index 5e4848ad05..e7cb747aaa 100644
--- a/target/xtensa/cpu-param.h
+++ b/target/xtensa/cpu-param.h
@@ -16,6 +16,8 @@
 #define TARGET_VIRT_ADDR_SPACE_BITS 32
 #endif
 
+#define TARGET_INSN_START_EXTRA_WORDS 0
+
 /* Xtensa processors have a weak memory model */
 #define TCG_GUEST_DEFAULT_MO      (0)
 

From 231a1c0ff46ae442431fb7a6e5d6f36765628b68 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 1 Apr 2025 10:13:20 +0200
Subject: [PATCH 0209/2760] exec: Restrict 'cpu-ldst-common.h' to accel/tcg/
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/translator.c                        | 2 +-
 include/{exec => accel/tcg}/cpu-ldst-common.h | 6 +++---
 include/exec/cpu_ldst.h                       | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)
 rename include/{exec => accel/tcg}/cpu-ldst-common.h (97%)

diff --git a/accel/tcg/translator.c b/accel/tcg/translator.c
index c53bbdef99..034f2f359e 100644
--- a/accel/tcg/translator.c
+++ b/accel/tcg/translator.c
@@ -11,7 +11,7 @@
 #include "qemu/bswap.h"
 #include "qemu/log.h"
 #include "qemu/error-report.h"
-#include "exec/cpu-ldst-common.h"
+#include "accel/tcg/cpu-ldst-common.h"
 #include "accel/tcg/cpu-mmu-index.h"
 #include "exec/target_page.h"
 #include "exec/translator.h"
diff --git a/include/exec/cpu-ldst-common.h b/include/accel/tcg/cpu-ldst-common.h
similarity index 97%
rename from include/exec/cpu-ldst-common.h
rename to include/accel/tcg/cpu-ldst-common.h
index c46a6ade5d..8bf17c2fab 100644
--- a/include/exec/cpu-ldst-common.h
+++ b/include/accel/tcg/cpu-ldst-common.h
@@ -4,8 +4,8 @@
  * SPDX-License-Identifier: LGPL-2.1-or-later
  */
 
-#ifndef CPU_LDST_COMMON_H
-#define CPU_LDST_COMMON_H
+#ifndef ACCEL_TCG_CPU_LDST_COMMON_H
+#define ACCEL_TCG_CPU_LDST_COMMON_H
 
 #ifndef CONFIG_TCG
 #error Can only include this header with TCG
@@ -119,4 +119,4 @@ uint32_t cpu_ldl_code_mmu(CPUArchState *env, vaddr addr,
 uint64_t cpu_ldq_code_mmu(CPUArchState *env, vaddr addr,
                           MemOpIdx oi, uintptr_t ra);
 
-#endif /* CPU_LDST_COMMON_H */
+#endif /* ACCEL_TCG_CPU_LDST_COMMON_H */
diff --git a/include/exec/cpu_ldst.h b/include/exec/cpu_ldst.h
index 63847f6e61..74761ba5f3 100644
--- a/include/exec/cpu_ldst.h
+++ b/include/exec/cpu_ldst.h
@@ -67,7 +67,7 @@
 #endif
 
 #include "exec/cpu-common.h"
-#include "exec/cpu-ldst-common.h"
+#include "accel/tcg/cpu-ldst-common.h"
 #include "accel/tcg/cpu-mmu-index.h"
 #include "exec/abi_ptr.h"
 

From 42fa9665e598c268a7ccfab5b92636618d9574ec Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 1 Apr 2025 10:14:36 +0200
Subject: [PATCH 0210/2760] exec: Restrict 'cpu_ldst.h' to accel/tcg/
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Mechanical change using:

  $ sed -i -e 's,exec/cpu_ldst,accel/tcg/cpu-ldst,' \
        $(git grep -l exec/cpu_ldst.h)

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c                                | 2 +-
 accel/tcg/user-exec.c                             | 2 +-
 bsd-user/qemu.h                                   | 2 +-
 include/{exec/cpu_ldst.h => accel/tcg/cpu-ldst.h} | 6 +++---
 include/exec/exec-all.h                           | 2 +-
 linux-user/qemu.h                                 | 2 +-
 target/alpha/mem_helper.c                         | 2 +-
 target/arm/tcg/helper-a64.c                       | 2 +-
 target/arm/tcg/m_helper.c                         | 2 +-
 target/arm/tcg/mte_helper.c                       | 2 +-
 target/arm/tcg/mve_helper.c                       | 2 +-
 target/arm/tcg/op_helper.c                        | 2 +-
 target/arm/tcg/pauth_helper.c                     | 2 +-
 target/arm/tcg/sme_helper.c                       | 2 +-
 target/arm/tcg/sve_ldst_internal.h                | 2 +-
 target/avr/helper.c                               | 2 +-
 target/hexagon/op_helper.c                        | 2 +-
 target/hexagon/translate.c                        | 2 +-
 target/hppa/op_helper.c                           | 2 +-
 target/i386/tcg/access.c                          | 2 +-
 target/i386/tcg/fpu_helper.c                      | 2 +-
 target/i386/tcg/mem_helper.c                      | 2 +-
 target/i386/tcg/mpx_helper.c                      | 2 +-
 target/i386/tcg/seg_helper.c                      | 2 +-
 target/i386/tcg/system/excp_helper.c              | 2 +-
 target/i386/tcg/system/misc_helper.c              | 2 +-
 target/i386/tcg/system/seg_helper.c               | 2 +-
 target/i386/tcg/system/svm_helper.c               | 2 +-
 target/i386/tcg/user/seg_helper.c                 | 2 +-
 target/loongarch/cpu.c                            | 2 +-
 target/loongarch/tcg/csr_helper.c                 | 2 +-
 target/loongarch/tcg/fpu_helper.c                 | 2 +-
 target/loongarch/tcg/iocsr_helper.c               | 2 +-
 target/loongarch/tcg/op_helper.c                  | 2 +-
 target/loongarch/tcg/tlb_helper.c                 | 2 +-
 target/m68k/fpu_helper.c                          | 2 +-
 target/m68k/op_helper.c                           | 2 +-
 target/microblaze/cpu.c                           | 2 +-
 target/microblaze/op_helper.c                     | 2 +-
 target/microblaze/translate.c                     | 2 +-
 target/mips/tcg/ldst_helper.c                     | 2 +-
 target/mips/tcg/msa_helper.c                      | 2 +-
 target/mips/tcg/system/tlb_helper.c               | 2 +-
 target/ppc/mem_helper.c                           | 2 +-
 target/ppc/mmu_helper.c                           | 2 +-
 target/ppc/tcg-excp_helper.c                      | 2 +-
 target/riscv/op_helper.c                          | 2 +-
 target/riscv/vector_helper.c                      | 2 +-
 target/riscv/zce_helper.c                         | 2 +-
 target/rx/helper.c                                | 2 +-
 target/rx/op_helper.c                             | 2 +-
 target/s390x/tcg/crypto_helper.c                  | 2 +-
 target/s390x/tcg/int_helper.c                     | 2 +-
 target/s390x/tcg/mem_helper.c                     | 2 +-
 target/s390x/tcg/misc_helper.c                    | 2 +-
 target/s390x/tcg/vec_helper.c                     | 2 +-
 target/sh4/op_helper.c                            | 2 +-
 target/sparc/int32_helper.c                       | 2 +-
 target/sparc/ldst_helper.c                        | 2 +-
 target/tricore/op_helper.c                        | 2 +-
 target/tricore/translate.c                        | 2 +-
 61 files changed, 63 insertions(+), 63 deletions(-)
 rename include/{exec/cpu_ldst.h => accel/tcg/cpu-ldst.h} (99%)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index 0de46903dd..2cafd38d2a 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -23,7 +23,7 @@
 #include "exec/exec-all.h"
 #include "exec/page-protection.h"
 #include "system/memory.h"
-#include "exec/cpu_ldst.h"
+#include "accel/tcg/cpu-ldst.h"
 #include "exec/cputlb.h"
 #include "exec/tb-flush.h"
 #include "system/ram_addr.h"
diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index 7f57d8f1af..1b878ead7a 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -26,7 +26,7 @@
 #include "tcg/tcg.h"
 #include "qemu/bitops.h"
 #include "qemu/rcu.h"
-#include "exec/cpu_ldst.h"
+#include "accel/tcg/cpu-ldst.h"
 #include "user/cpu_loop.h"
 #include "qemu/main-loop.h"
 #include "user/page-protection.h"
diff --git a/bsd-user/qemu.h b/bsd-user/qemu.h
index c1c508281a..244670dd24 100644
--- a/bsd-user/qemu.h
+++ b/bsd-user/qemu.h
@@ -22,7 +22,7 @@
 #include "qemu/int128.h"
 #include "cpu.h"
 #include "qemu/units.h"
-#include "exec/cpu_ldst.h"
+#include "accel/tcg/cpu-ldst.h"
 #include "exec/exec-all.h"
 
 #include "user/abitypes.h"
diff --git a/include/exec/cpu_ldst.h b/include/accel/tcg/cpu-ldst.h
similarity index 99%
rename from include/exec/cpu_ldst.h
rename to include/accel/tcg/cpu-ldst.h
index 74761ba5f3..f97a730703 100644
--- a/include/exec/cpu_ldst.h
+++ b/include/accel/tcg/cpu-ldst.h
@@ -59,8 +59,8 @@
  * The "mmu" suffix carries the full MemOpIdx, with both mmu_idx and the
  * MemOp including alignment requirements.  The alignment will be enforced.
  */
-#ifndef CPU_LDST_H
-#define CPU_LDST_H
+#ifndef ACCEL_TCG_CPU_LDST_H
+#define ACCEL_TCG_CPU_LDST_H
 
 #ifndef CONFIG_TCG
 #error Can only include this header with TCG
@@ -560,4 +560,4 @@ static inline void clear_helper_retaddr(void)
 #define clear_helper_retaddr()   do { } while (0)
 #endif
 
-#endif /* CPU_LDST_H */
+#endif /* ACCEL_TCG_CPU_LDST_H */
diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index f52a680f42..70608a11b6 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -21,7 +21,7 @@
 #define EXEC_ALL_H
 
 #if defined(CONFIG_USER_ONLY)
-#include "exec/cpu_ldst.h"
+#include "accel/tcg/cpu-ldst.h"
 #endif
 #include "exec/mmu-access-type.h"
 #include "exec/translation-block.h"
diff --git a/linux-user/qemu.h b/linux-user/qemu.h
index 948de8431a..0b19fa43e6 100644
--- a/linux-user/qemu.h
+++ b/linux-user/qemu.h
@@ -2,7 +2,7 @@
 #define QEMU_H
 
 #include "cpu.h"
-#include "exec/cpu_ldst.h"
+#include "accel/tcg/cpu-ldst.h"
 
 #include "user/abitypes.h"
 #include "user/page-protection.h"
diff --git a/target/alpha/mem_helper.c b/target/alpha/mem_helper.c
index 872955f5e7..a4d5adb40c 100644
--- a/target/alpha/mem_helper.c
+++ b/target/alpha/mem_helper.c
@@ -21,7 +21,7 @@
 #include "cpu.h"
 #include "exec/helper-proto.h"
 #include "exec/exec-all.h"
-#include "exec/cpu_ldst.h"
+#include "accel/tcg/cpu-ldst.h"
 
 static void do_unaligned_access(CPUAlphaState *env, vaddr addr, uintptr_t retaddr)
 {
diff --git a/target/arm/tcg/helper-a64.c b/target/arm/tcg/helper-a64.c
index 507dbc1a44..08d8f63ffe 100644
--- a/target/arm/tcg/helper-a64.c
+++ b/target/arm/tcg/helper-a64.c
@@ -30,7 +30,7 @@
 #include "qemu/crc32c.h"
 #include "exec/cpu-common.h"
 #include "exec/exec-all.h"
-#include "exec/cpu_ldst.h"
+#include "accel/tcg/cpu-ldst.h"
 #include "exec/target_page.h"
 #include "exec/tlb-flags.h"
 #include "qemu/int128.h"
diff --git a/target/arm/tcg/m_helper.c b/target/arm/tcg/m_helper.c
index f7354f3c6e..37dc98dc35 100644
--- a/target/arm/tcg/m_helper.c
+++ b/target/arm/tcg/m_helper.c
@@ -18,7 +18,7 @@
 #include "exec/exec-all.h"
 #include "exec/page-protection.h"
 #ifdef CONFIG_TCG
-#include "exec/cpu_ldst.h"
+#include "accel/tcg/cpu-ldst.h"
 #include "semihosting/common-semi.h"
 #endif
 #if !defined(CONFIG_USER_ONLY)
diff --git a/target/arm/tcg/mte_helper.c b/target/arm/tcg/mte_helper.c
index 888c670754..7dc5fb776b 100644
--- a/target/arm/tcg/mte_helper.c
+++ b/target/arm/tcg/mte_helper.c
@@ -29,7 +29,7 @@
 #else
 #include "system/ram_addr.h"
 #endif
-#include "exec/cpu_ldst.h"
+#include "accel/tcg/cpu-ldst.h"
 #include "exec/helper-proto.h"
 #include "exec/tlb-flags.h"
 #include "accel/tcg/cpu-ops.h"
diff --git a/target/arm/tcg/mve_helper.c b/target/arm/tcg/mve_helper.c
index 274003e2e5..f9f67d1f88 100644
--- a/target/arm/tcg/mve_helper.c
+++ b/target/arm/tcg/mve_helper.c
@@ -22,7 +22,7 @@
 #include "internals.h"
 #include "vec_internal.h"
 #include "exec/helper-proto.h"
-#include "exec/cpu_ldst.h"
+#include "accel/tcg/cpu-ldst.h"
 #include "exec/exec-all.h"
 #include "tcg/tcg.h"
 #include "fpu/softfloat.h"
diff --git a/target/arm/tcg/op_helper.c b/target/arm/tcg/op_helper.c
index 71ba406782..38d49cbb9d 100644
--- a/target/arm/tcg/op_helper.c
+++ b/target/arm/tcg/op_helper.c
@@ -24,7 +24,7 @@
 #include "internals.h"
 #include "cpu-features.h"
 #include "exec/exec-all.h"
-#include "exec/cpu_ldst.h"
+#include "accel/tcg/cpu-ldst.h"
 #include "cpregs.h"
 
 #define SIGNBIT (uint32_t)0x80000000
diff --git a/target/arm/tcg/pauth_helper.c b/target/arm/tcg/pauth_helper.c
index c4b143024f..59bf27541d 100644
--- a/target/arm/tcg/pauth_helper.c
+++ b/target/arm/tcg/pauth_helper.c
@@ -22,7 +22,7 @@
 #include "internals.h"
 #include "cpu-features.h"
 #include "exec/exec-all.h"
-#include "exec/cpu_ldst.h"
+#include "accel/tcg/cpu-ldst.h"
 #include "exec/helper-proto.h"
 #include "tcg/tcg-gvec-desc.h"
 #include "qemu/xxhash.h"
diff --git a/target/arm/tcg/sme_helper.c b/target/arm/tcg/sme_helper.c
index dcc48e43db..96b84c37a2 100644
--- a/target/arm/tcg/sme_helper.c
+++ b/target/arm/tcg/sme_helper.c
@@ -22,7 +22,7 @@
 #include "internals.h"
 #include "tcg/tcg-gvec-desc.h"
 #include "exec/helper-proto.h"
-#include "exec/cpu_ldst.h"
+#include "accel/tcg/cpu-ldst.h"
 #include "exec/exec-all.h"
 #include "qemu/int128.h"
 #include "fpu/softfloat.h"
diff --git a/target/arm/tcg/sve_ldst_internal.h b/target/arm/tcg/sve_ldst_internal.h
index 4f159ec4ad..f2243daf37 100644
--- a/target/arm/tcg/sve_ldst_internal.h
+++ b/target/arm/tcg/sve_ldst_internal.h
@@ -20,7 +20,7 @@
 #ifndef TARGET_ARM_SVE_LDST_INTERNAL_H
 #define TARGET_ARM_SVE_LDST_INTERNAL_H
 
-#include "exec/cpu_ldst.h"
+#include "accel/tcg/cpu-ldst.h"
 
 /*
  * Load one element into @vd + @reg_off from @host.
diff --git a/target/avr/helper.c b/target/avr/helper.c
index 32cbf17919..afa591470f 100644
--- a/target/avr/helper.c
+++ b/target/avr/helper.c
@@ -27,7 +27,7 @@
 #include "exec/cputlb.h"
 #include "exec/page-protection.h"
 #include "exec/target_page.h"
-#include "exec/cpu_ldst.h"
+#include "accel/tcg/cpu-ldst.h"
 #include "exec/helper-proto.h"
 
 bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
diff --git a/target/hexagon/op_helper.c b/target/hexagon/op_helper.c
index 6da8db8ea5..3f3d86db2b 100644
--- a/target/hexagon/op_helper.c
+++ b/target/hexagon/op_helper.c
@@ -18,7 +18,7 @@
 #include "qemu/osdep.h"
 #include "qemu/log.h"
 #include "exec/exec-all.h"
-#include "exec/cpu_ldst.h"
+#include "accel/tcg/cpu-ldst.h"
 #include "exec/helper-proto.h"
 #include "fpu/softfloat.h"
 #include "cpu.h"
diff --git a/target/hexagon/translate.c b/target/hexagon/translate.c
index fe7858703c..dd26801e64 100644
--- a/target/hexagon/translate.c
+++ b/target/hexagon/translate.c
@@ -23,7 +23,7 @@
 #include "exec/helper-gen.h"
 #include "exec/helper-proto.h"
 #include "exec/translation-block.h"
-#include "exec/cpu_ldst.h"
+#include "accel/tcg/cpu-ldst.h"
 #include "exec/log.h"
 #include "internal.h"
 #include "attribs.h"
diff --git a/target/hppa/op_helper.c b/target/hppa/op_helper.c
index beb8f88799..2398ce2c64 100644
--- a/target/hppa/op_helper.c
+++ b/target/hppa/op_helper.c
@@ -22,7 +22,7 @@
 #include "cpu.h"
 #include "exec/exec-all.h"
 #include "exec/helper-proto.h"
-#include "exec/cpu_ldst.h"
+#include "accel/tcg/cpu-ldst.h"
 #include "qemu/timer.h"
 #include "trace.h"
 #ifdef CONFIG_USER_ONLY
diff --git a/target/i386/tcg/access.c b/target/i386/tcg/access.c
index 5a4721dcee..0fdd587edd 100644
--- a/target/i386/tcg/access.c
+++ b/target/i386/tcg/access.c
@@ -3,7 +3,7 @@
 
 #include "qemu/osdep.h"
 #include "cpu.h"
-#include "exec/cpu_ldst.h"
+#include "accel/tcg/cpu-ldst.h"
 #include "exec/exec-all.h"
 #include "exec/target_page.h"
 #include "access.h"
diff --git a/target/i386/tcg/fpu_helper.c b/target/i386/tcg/fpu_helper.c
index c1184ca219..1cbadb1453 100644
--- a/target/i386/tcg/fpu_helper.c
+++ b/target/i386/tcg/fpu_helper.c
@@ -22,7 +22,7 @@
 #include "cpu.h"
 #include "tcg-cpu.h"
 #include "exec/cputlb.h"
-#include "exec/cpu_ldst.h"
+#include "accel/tcg/cpu-ldst.h"
 #include "exec/helper-proto.h"
 #include "fpu/softfloat.h"
 #include "fpu/softfloat-macros.h"
diff --git a/target/i386/tcg/mem_helper.c b/target/i386/tcg/mem_helper.c
index 3ef84e90d9..84a0815217 100644
--- a/target/i386/tcg/mem_helper.c
+++ b/target/i386/tcg/mem_helper.c
@@ -21,7 +21,7 @@
 #include "cpu.h"
 #include "exec/helper-proto.h"
 #include "exec/exec-all.h"
-#include "exec/cpu_ldst.h"
+#include "accel/tcg/cpu-ldst.h"
 #include "qemu/int128.h"
 #include "qemu/atomic128.h"
 #include "tcg/tcg.h"
diff --git a/target/i386/tcg/mpx_helper.c b/target/i386/tcg/mpx_helper.c
index b942665adc..a0f816dfae 100644
--- a/target/i386/tcg/mpx_helper.c
+++ b/target/i386/tcg/mpx_helper.c
@@ -20,7 +20,7 @@
 #include "qemu/osdep.h"
 #include "cpu.h"
 #include "exec/helper-proto.h"
-#include "exec/cpu_ldst.h"
+#include "accel/tcg/cpu-ldst.h"
 #include "exec/exec-all.h"
 #include "exec/target_page.h"
 #include "helper-tcg.h"
diff --git a/target/i386/tcg/seg_helper.c b/target/i386/tcg/seg_helper.c
index 9dfbc4208c..3af902e0ec 100644
--- a/target/i386/tcg/seg_helper.c
+++ b/target/i386/tcg/seg_helper.c
@@ -23,7 +23,7 @@
 #include "qemu/log.h"
 #include "exec/helper-proto.h"
 #include "exec/exec-all.h"
-#include "exec/cpu_ldst.h"
+#include "accel/tcg/cpu-ldst.h"
 #include "exec/log.h"
 #include "helper-tcg.h"
 #include "seg_helper.h"
diff --git a/target/i386/tcg/system/excp_helper.c b/target/i386/tcg/system/excp_helper.c
index a563c9b35e..93614aa3e5 100644
--- a/target/i386/tcg/system/excp_helper.c
+++ b/target/i386/tcg/system/excp_helper.c
@@ -19,7 +19,7 @@
 
 #include "qemu/osdep.h"
 #include "cpu.h"
-#include "exec/cpu_ldst.h"
+#include "accel/tcg/cpu-ldst.h"
 #include "exec/cputlb.h"
 #include "exec/page-protection.h"
 #include "exec/target_page.h"
diff --git a/target/i386/tcg/system/misc_helper.c b/target/i386/tcg/system/misc_helper.c
index 67896c8c87..9c3f5cc99b 100644
--- a/target/i386/tcg/system/misc_helper.c
+++ b/target/i386/tcg/system/misc_helper.c
@@ -21,7 +21,7 @@
 #include "qemu/main-loop.h"
 #include "cpu.h"
 #include "exec/helper-proto.h"
-#include "exec/cpu_ldst.h"
+#include "accel/tcg/cpu-ldst.h"
 #include "system/address-spaces.h"
 #include "system/memory.h"
 #include "exec/cputlb.h"
diff --git a/target/i386/tcg/system/seg_helper.c b/target/i386/tcg/system/seg_helper.c
index b07cc9f9b1..d4ea890c12 100644
--- a/target/i386/tcg/system/seg_helper.c
+++ b/target/i386/tcg/system/seg_helper.c
@@ -23,7 +23,7 @@
 #include "qemu/main-loop.h"
 #include "cpu.h"
 #include "exec/helper-proto.h"
-#include "exec/cpu_ldst.h"
+#include "accel/tcg/cpu-ldst.h"
 #include "tcg/helper-tcg.h"
 #include "../seg_helper.h"
 
diff --git a/target/i386/tcg/system/svm_helper.c b/target/i386/tcg/system/svm_helper.c
index f9982b72d1..b27049b9ed 100644
--- a/target/i386/tcg/system/svm_helper.c
+++ b/target/i386/tcg/system/svm_helper.c
@@ -22,7 +22,7 @@
 #include "cpu.h"
 #include "exec/helper-proto.h"
 #include "exec/cputlb.h"
-#include "exec/cpu_ldst.h"
+#include "accel/tcg/cpu-ldst.h"
 #include "tcg/helper-tcg.h"
 
 /* Secure Virtual Machine helpers */
diff --git a/target/i386/tcg/user/seg_helper.c b/target/i386/tcg/user/seg_helper.c
index c45f2ac2ba..5692dd5195 100644
--- a/target/i386/tcg/user/seg_helper.c
+++ b/target/i386/tcg/user/seg_helper.c
@@ -22,7 +22,7 @@
 #include "cpu.h"
 #include "exec/helper-proto.h"
 #include "exec/exec-all.h"
-#include "exec/cpu_ldst.h"
+#include "accel/tcg/cpu-ldst.h"
 #include "tcg/helper-tcg.h"
 #include "tcg/seg_helper.h"
 
diff --git a/target/loongarch/cpu.c b/target/loongarch/cpu.c
index cb96b17911..4cc8e02f70 100644
--- a/target/loongarch/cpu.c
+++ b/target/loongarch/cpu.c
@@ -29,7 +29,7 @@
 #include <linux/kvm.h>
 #endif
 #ifdef CONFIG_TCG
-#include "exec/cpu_ldst.h"
+#include "accel/tcg/cpu-ldst.h"
 #include "tcg/tcg.h"
 #endif
 
diff --git a/target/loongarch/tcg/csr_helper.c b/target/loongarch/tcg/csr_helper.c
index 6a7a65c860..2942d7feb8 100644
--- a/target/loongarch/tcg/csr_helper.c
+++ b/target/loongarch/tcg/csr_helper.c
@@ -13,7 +13,7 @@
 #include "qemu/host-utils.h"
 #include "exec/helper-proto.h"
 #include "exec/cputlb.h"
-#include "exec/cpu_ldst.h"
+#include "accel/tcg/cpu-ldst.h"
 #include "hw/irq.h"
 #include "cpu-csr.h"
 
diff --git a/target/loongarch/tcg/fpu_helper.c b/target/loongarch/tcg/fpu_helper.c
index a83acf64b0..fc3fd0561e 100644
--- a/target/loongarch/tcg/fpu_helper.c
+++ b/target/loongarch/tcg/fpu_helper.c
@@ -9,7 +9,7 @@
 #include "cpu.h"
 #include "exec/helper-proto.h"
 #include "exec/exec-all.h"
-#include "exec/cpu_ldst.h"
+#include "accel/tcg/cpu-ldst.h"
 #include "fpu/softfloat.h"
 #include "internals.h"
 
diff --git a/target/loongarch/tcg/iocsr_helper.c b/target/loongarch/tcg/iocsr_helper.c
index b6916f53d2..e62170de3c 100644
--- a/target/loongarch/tcg/iocsr_helper.c
+++ b/target/loongarch/tcg/iocsr_helper.c
@@ -10,7 +10,7 @@
 #include "qemu/host-utils.h"
 #include "exec/helper-proto.h"
 #include "exec/exec-all.h"
-#include "exec/cpu_ldst.h"
+#include "accel/tcg/cpu-ldst.h"
 
 #define GET_MEMTXATTRS(cas) \
         ((MemTxAttrs){.requester_id = env_cpu(cas)->cpu_index})
diff --git a/target/loongarch/tcg/op_helper.c b/target/loongarch/tcg/op_helper.c
index b17208e5b9..94e3b28016 100644
--- a/target/loongarch/tcg/op_helper.c
+++ b/target/loongarch/tcg/op_helper.c
@@ -11,7 +11,7 @@
 #include "qemu/host-utils.h"
 #include "exec/helper-proto.h"
 #include "exec/exec-all.h"
-#include "exec/cpu_ldst.h"
+#include "accel/tcg/cpu-ldst.h"
 #include "internals.h"
 #include "qemu/crc32c.h"
 #include <zlib.h> /* for crc32 */
diff --git a/target/loongarch/tcg/tlb_helper.c b/target/loongarch/tcg/tlb_helper.c
index 0d6c9844a6..9a76a2a205 100644
--- a/target/loongarch/tcg/tlb_helper.c
+++ b/target/loongarch/tcg/tlb_helper.c
@@ -16,7 +16,7 @@
 #include "exec/exec-all.h"
 #include "exec/page-protection.h"
 #include "exec/target_page.h"
-#include "exec/cpu_ldst.h"
+#include "accel/tcg/cpu-ldst.h"
 #include "exec/log.h"
 #include "cpu-csr.h"
 
diff --git a/target/m68k/fpu_helper.c b/target/m68k/fpu_helper.c
index eb1cb8c687..ac4a0d85be 100644
--- a/target/m68k/fpu_helper.c
+++ b/target/m68k/fpu_helper.c
@@ -22,7 +22,7 @@
 #include "cpu.h"
 #include "exec/helper-proto.h"
 #include "exec/exec-all.h"
-#include "exec/cpu_ldst.h"
+#include "accel/tcg/cpu-ldst.h"
 #include "softfloat.h"
 
 /*
diff --git a/target/m68k/op_helper.c b/target/m68k/op_helper.c
index 15bad5dd46..242aecccbb 100644
--- a/target/m68k/op_helper.c
+++ b/target/m68k/op_helper.c
@@ -21,7 +21,7 @@
 #include "cpu.h"
 #include "exec/helper-proto.h"
 #include "exec/exec-all.h"
-#include "exec/cpu_ldst.h"
+#include "accel/tcg/cpu-ldst.h"
 #include "semihosting/semihost.h"
 
 #if !defined(CONFIG_USER_ONLY)
diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
index 88baeb6807..d10ae0702a 100644
--- a/target/microblaze/cpu.c
+++ b/target/microblaze/cpu.c
@@ -28,7 +28,7 @@
 #include "qemu/module.h"
 #include "hw/qdev-properties.h"
 #include "exec/exec-all.h"
-#include "exec/cpu_ldst.h"
+#include "accel/tcg/cpu-ldst.h"
 #include "exec/gdbstub.h"
 #include "exec/translation-block.h"
 #include "fpu/softfloat-helpers.h"
diff --git a/target/microblaze/op_helper.c b/target/microblaze/op_helper.c
index f6378030b7..4624ce5b67 100644
--- a/target/microblaze/op_helper.c
+++ b/target/microblaze/op_helper.c
@@ -24,7 +24,7 @@
 #include "exec/helper-proto.h"
 #include "qemu/host-utils.h"
 #include "exec/exec-all.h"
-#include "exec/cpu_ldst.h"
+#include "accel/tcg/cpu-ldst.h"
 #include "fpu/softfloat.h"
 
 void helper_put(uint32_t id, uint32_t ctrl, uint32_t data)
diff --git a/target/microblaze/translate.c b/target/microblaze/translate.c
index 4bb867c969..7dcad6cf0d 100644
--- a/target/microblaze/translate.c
+++ b/target/microblaze/translate.c
@@ -21,7 +21,7 @@
 #include "qemu/osdep.h"
 #include "cpu.h"
 #include "exec/exec-all.h"
-#include "exec/cpu_ldst.h"
+#include "accel/tcg/cpu-ldst.h"
 #include "tcg/tcg-op.h"
 #include "exec/helper-proto.h"
 #include "exec/helper-gen.h"
diff --git a/target/mips/tcg/ldst_helper.c b/target/mips/tcg/ldst_helper.c
index f92a923d7a..2fb879fcbc 100644
--- a/target/mips/tcg/ldst_helper.c
+++ b/target/mips/tcg/ldst_helper.c
@@ -24,7 +24,7 @@
 #include "cpu.h"
 #include "exec/helper-proto.h"
 #include "exec/exec-all.h"
-#include "exec/cpu_ldst.h"
+#include "accel/tcg/cpu-ldst.h"
 #include "exec/memop.h"
 #include "internal.h"
 
diff --git a/target/mips/tcg/msa_helper.c b/target/mips/tcg/msa_helper.c
index 969dd34b3e..14de4a71ff 100644
--- a/target/mips/tcg/msa_helper.c
+++ b/target/mips/tcg/msa_helper.c
@@ -22,7 +22,7 @@
 #include "internal.h"
 #include "tcg/tcg.h"
 #include "exec/exec-all.h"
-#include "exec/cpu_ldst.h"
+#include "accel/tcg/cpu-ldst.h"
 #include "exec/helper-proto.h"
 #include "exec/memop.h"
 #include "exec/target_page.h"
diff --git a/target/mips/tcg/system/tlb_helper.c b/target/mips/tcg/system/tlb_helper.c
index d239fa9353..e477ef812a 100644
--- a/target/mips/tcg/system/tlb_helper.c
+++ b/target/mips/tcg/system/tlb_helper.c
@@ -25,7 +25,7 @@
 #include "exec/exec-all.h"
 #include "exec/page-protection.h"
 #include "exec/target_page.h"
-#include "exec/cpu_ldst.h"
+#include "accel/tcg/cpu-ldst.h"
 #include "exec/log.h"
 #include "exec/helper-proto.h"
 
diff --git a/target/ppc/mem_helper.c b/target/ppc/mem_helper.c
index 0967624afe..d7e8d678f4 100644
--- a/target/ppc/mem_helper.c
+++ b/target/ppc/mem_helper.c
@@ -24,7 +24,7 @@
 #include "qemu/host-utils.h"
 #include "exec/helper-proto.h"
 #include "helper_regs.h"
-#include "exec/cpu_ldst.h"
+#include "accel/tcg/cpu-ldst.h"
 #include "internal.h"
 #include "qemu/atomic128.h"
 
diff --git a/target/ppc/mmu_helper.c b/target/ppc/mmu_helper.c
index c90ceb7d60..2138666122 100644
--- a/target/ppc/mmu_helper.c
+++ b/target/ppc/mmu_helper.c
@@ -37,7 +37,7 @@
 #include "mmu-radix64.h"
 #include "mmu-booke.h"
 #include "exec/helper-proto.h"
-#include "exec/cpu_ldst.h"
+#include "accel/tcg/cpu-ldst.h"
 
 /* #define FLUSH_ALL_TLBS */
 
diff --git a/target/ppc/tcg-excp_helper.c b/target/ppc/tcg-excp_helper.c
index c422648cfd..2b15e5f2f0 100644
--- a/target/ppc/tcg-excp_helper.c
+++ b/target/ppc/tcg-excp_helper.c
@@ -20,7 +20,7 @@
 #include "qemu/main-loop.h"
 #include "qemu/log.h"
 #include "target/ppc/cpu.h"
-#include "exec/cpu_ldst.h"
+#include "accel/tcg/cpu-ldst.h"
 #include "exec/exec-all.h"
 #include "exec/helper-proto.h"
 #include "system/runstate.h"
diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
index f3d26b6b95..5b0db2c45a 100644
--- a/target/riscv/op_helper.c
+++ b/target/riscv/op_helper.c
@@ -23,7 +23,7 @@
 #include "internals.h"
 #include "exec/exec-all.h"
 #include "exec/cputlb.h"
-#include "exec/cpu_ldst.h"
+#include "accel/tcg/cpu-ldst.h"
 #include "exec/helper-proto.h"
 #include "exec/tlb-flags.h"
 #include "trace.h"
diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
index 7de6cbae5c..b8ae704457 100644
--- a/target/riscv/vector_helper.c
+++ b/target/riscv/vector_helper.c
@@ -22,7 +22,7 @@
 #include "cpu.h"
 #include "exec/memop.h"
 #include "exec/exec-all.h"
-#include "exec/cpu_ldst.h"
+#include "accel/tcg/cpu-ldst.h"
 #include "exec/page-protection.h"
 #include "exec/helper-proto.h"
 #include "exec/tlb-flags.h"
diff --git a/target/riscv/zce_helper.c b/target/riscv/zce_helper.c
index b433bda16d..50d65f386c 100644
--- a/target/riscv/zce_helper.c
+++ b/target/riscv/zce_helper.c
@@ -20,7 +20,7 @@
 #include "cpu.h"
 #include "exec/exec-all.h"
 #include "exec/helper-proto.h"
-#include "exec/cpu_ldst.h"
+#include "accel/tcg/cpu-ldst.h"
 
 target_ulong HELPER(cm_jalt)(CPURISCVState *env, uint32_t index)
 {
diff --git a/target/rx/helper.c b/target/rx/helper.c
index e8aabf40ff..0640ab322b 100644
--- a/target/rx/helper.c
+++ b/target/rx/helper.c
@@ -20,7 +20,7 @@
 #include "qemu/bitops.h"
 #include "cpu.h"
 #include "exec/log.h"
-#include "exec/cpu_ldst.h"
+#include "accel/tcg/cpu-ldst.h"
 #include "hw/irq.h"
 
 void rx_cpu_unpack_psw(CPURXState *env, uint32_t psw, int rte)
diff --git a/target/rx/op_helper.c b/target/rx/op_helper.c
index b3ed822dd1..a2f1f3824d 100644
--- a/target/rx/op_helper.c
+++ b/target/rx/op_helper.c
@@ -21,7 +21,7 @@
 #include "cpu.h"
 #include "exec/exec-all.h"
 #include "exec/helper-proto.h"
-#include "exec/cpu_ldst.h"
+#include "accel/tcg/cpu-ldst.h"
 #include "fpu/softfloat.h"
 #include "tcg/debug-assert.h"
 
diff --git a/target/s390x/tcg/crypto_helper.c b/target/s390x/tcg/crypto_helper.c
index 93aabd236f..642c1b18c4 100644
--- a/target/s390x/tcg/crypto_helper.c
+++ b/target/s390x/tcg/crypto_helper.c
@@ -18,7 +18,7 @@
 #include "tcg_s390x.h"
 #include "exec/helper-proto.h"
 #include "exec/exec-all.h"
-#include "exec/cpu_ldst.h"
+#include "accel/tcg/cpu-ldst.h"
 
 static uint64_t R(uint64_t x, int c)
 {
diff --git a/target/s390x/tcg/int_helper.c b/target/s390x/tcg/int_helper.c
index 2af970f2c8..253c036415 100644
--- a/target/s390x/tcg/int_helper.c
+++ b/target/s390x/tcg/int_helper.c
@@ -25,7 +25,7 @@
 #include "exec/exec-all.h"
 #include "qemu/host-utils.h"
 #include "exec/helper-proto.h"
-#include "exec/cpu_ldst.h"
+#include "accel/tcg/cpu-ldst.h"
 
 /* #define DEBUG_HELPER */
 #ifdef DEBUG_HELPER
diff --git a/target/s390x/tcg/mem_helper.c b/target/s390x/tcg/mem_helper.c
index d5eece4384..0cdfd380ce 100644
--- a/target/s390x/tcg/mem_helper.c
+++ b/target/s390x/tcg/mem_helper.c
@@ -28,7 +28,7 @@
 #include "exec/exec-all.h"
 #include "exec/cputlb.h"
 #include "exec/page-protection.h"
-#include "exec/cpu_ldst.h"
+#include "accel/tcg/cpu-ldst.h"
 #include "exec/target_page.h"
 #include "exec/tlb-flags.h"
 #include "accel/tcg/cpu-ops.h"
diff --git a/target/s390x/tcg/misc_helper.c b/target/s390x/tcg/misc_helper.c
index e02f443850..d5088493ea 100644
--- a/target/s390x/tcg/misc_helper.c
+++ b/target/s390x/tcg/misc_helper.c
@@ -28,7 +28,7 @@
 #include "qemu/timer.h"
 #include "exec/exec-all.h"
 #include "exec/cputlb.h"
-#include "exec/cpu_ldst.h"
+#include "accel/tcg/cpu-ldst.h"
 #include "exec/target_page.h"
 #include "qapi/error.h"
 #include "tcg_s390x.h"
diff --git a/target/s390x/tcg/vec_helper.c b/target/s390x/tcg/vec_helper.c
index dafc4c3582..781ccc565b 100644
--- a/target/s390x/tcg/vec_helper.c
+++ b/target/s390x/tcg/vec_helper.c
@@ -16,7 +16,7 @@
 #include "tcg/tcg.h"
 #include "tcg/tcg-gvec-desc.h"
 #include "exec/helper-proto.h"
-#include "exec/cpu_ldst.h"
+#include "accel/tcg/cpu-ldst.h"
 #include "exec/exec-all.h"
 
 void HELPER(gvec_vbperm)(void *v1, const void *v2, const void *v3,
diff --git a/target/sh4/op_helper.c b/target/sh4/op_helper.c
index 99394b714c..e7fcad3c1b 100644
--- a/target/sh4/op_helper.c
+++ b/target/sh4/op_helper.c
@@ -20,7 +20,7 @@
 #include "cpu.h"
 #include "exec/helper-proto.h"
 #include "exec/exec-all.h"
-#include "exec/cpu_ldst.h"
+#include "accel/tcg/cpu-ldst.h"
 #include "fpu/softfloat.h"
 
 #ifndef CONFIG_USER_ONLY
diff --git a/target/sparc/int32_helper.c b/target/sparc/int32_helper.c
index f026606102..39db4ffa70 100644
--- a/target/sparc/int32_helper.c
+++ b/target/sparc/int32_helper.c
@@ -21,7 +21,7 @@
 #include "qemu/main-loop.h"
 #include "cpu.h"
 #include "trace.h"
-#include "exec/cpu_ldst.h"
+#include "accel/tcg/cpu-ldst.h"
 #include "exec/log.h"
 #include "system/runstate.h"
 
diff --git a/target/sparc/ldst_helper.c b/target/sparc/ldst_helper.c
index 3fa5e78816..4c5dba19d1 100644
--- a/target/sparc/ldst_helper.c
+++ b/target/sparc/ldst_helper.c
@@ -27,7 +27,7 @@
 #include "exec/cputlb.h"
 #include "exec/page-protection.h"
 #include "exec/target_page.h"
-#include "exec/cpu_ldst.h"
+#include "accel/tcg/cpu-ldst.h"
 #include "system/memory.h"
 #ifdef CONFIG_USER_ONLY
 #include "user/page-protection.h"
diff --git a/target/tricore/op_helper.c b/target/tricore/op_helper.c
index a0d5a0da1d..ae559b6922 100644
--- a/target/tricore/op_helper.c
+++ b/target/tricore/op_helper.c
@@ -19,7 +19,7 @@
 #include "qemu/host-utils.h"
 #include "exec/helper-proto.h"
 #include "exec/exec-all.h"
-#include "exec/cpu_ldst.h"
+#include "accel/tcg/cpu-ldst.h"
 #include <zlib.h> /* for crc32 */
 
 
diff --git a/target/tricore/translate.c b/target/tricore/translate.c
index 5c7ed395ca..7cd26d8eab 100644
--- a/target/tricore/translate.c
+++ b/target/tricore/translate.c
@@ -22,7 +22,7 @@
 #include "cpu.h"
 #include "exec/exec-all.h"
 #include "tcg/tcg-op.h"
-#include "exec/cpu_ldst.h"
+#include "accel/tcg/cpu-ldst.h"
 #include "qemu/qemu-print.h"
 
 #include "exec/helper-proto.h"

From d864cbb65da2220038a9b3aff98ae7f73a3198d3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 1 Apr 2025 10:27:42 +0200
Subject: [PATCH 0211/2760] exec: Do not include 'accel/tcg/cpu-ldst.h' in
 'exec-all.h'
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Only 2 files requiring "accel/tcg/cpu-ldst.h" API do not
include it:
- accel/tcg/cpu-exec.c
- target/arm/tcg/sve_helper.c
Include it there and remove it from "exec/exec-all.h".

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cpu-exec.c        | 1 +
 include/exec/exec-all.h     | 3 ---
 target/arm/tcg/sve_helper.c | 1 +
 3 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index 5ced3879ac..b00f046b29 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -22,6 +22,7 @@
 #include "qapi/error.h"
 #include "qapi/type-helpers.h"
 #include "hw/core/cpu.h"
+#include "accel/tcg/cpu-ldst.h"
 #include "accel/tcg/cpu-ops.h"
 #include "trace.h"
 #include "disas/disas.h"
diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index 70608a11b6..944b579d91 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -20,9 +20,6 @@
 #ifndef EXEC_ALL_H
 #define EXEC_ALL_H
 
-#if defined(CONFIG_USER_ONLY)
-#include "accel/tcg/cpu-ldst.h"
-#endif
 #include "exec/mmu-access-type.h"
 #include "exec/translation-block.h"
 
diff --git a/target/arm/tcg/sve_helper.c b/target/arm/tcg/sve_helper.c
index 9b0d40c9e1..87b6b4b3e6 100644
--- a/target/arm/tcg/sve_helper.c
+++ b/target/arm/tcg/sve_helper.c
@@ -30,6 +30,7 @@
 #include "tcg/tcg.h"
 #include "vec_internal.h"
 #include "sve_ldst_internal.h"
+#include "accel/tcg/cpu-ldst.h"
 #include "accel/tcg/cpu-ops.h"
 #ifdef CONFIG_USER_ONLY
 #include "user/page-protection.h"

From c2ba9fea42391c316794c78f0f6f01760b1fb0f7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 21 Mar 2025 12:10:45 +0100
Subject: [PATCH 0212/2760] tcg: Always define TCG_GUEST_DEFAULT_MO
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We only require the TCG_GUEST_DEFAULT_MO for MTTCG-enabled
frontends, otherwise we use a default value of TCG_MO_ALL.

In order to simplify, require the definition for all targets,
defining it for hexagon, m68k, rx, sh4 and tricore.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Anton Johansson <anjo@rev.ng>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/translate-all.c  | 4 ----
 target/hexagon/cpu-param.h | 3 +++
 target/m68k/cpu-param.h    | 3 +++
 target/rx/cpu-param.h      | 3 +++
 target/sh4/cpu-param.h     | 3 +++
 target/tricore/cpu-param.h | 3 +++
 6 files changed, 15 insertions(+), 4 deletions(-)

diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index c5590eb695..7467255f6e 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -353,11 +353,7 @@ TranslationBlock *tb_gen_code(CPUState *cpu,
     tcg_ctx->tlb_dyn_max_bits = CPU_TLB_DYN_MAX_BITS;
 #endif
     tcg_ctx->insn_start_words = TARGET_INSN_START_WORDS;
-#ifdef TCG_GUEST_DEFAULT_MO
     tcg_ctx->guest_mo = TCG_GUEST_DEFAULT_MO;
-#else
-    tcg_ctx->guest_mo = TCG_MO_ALL;
-#endif
 
  restart_translate:
     trace_translate_block(tb, pc, tb->tc.ptr);
diff --git a/target/hexagon/cpu-param.h b/target/hexagon/cpu-param.h
index 635d509e74..7cc63a01d4 100644
--- a/target/hexagon/cpu-param.h
+++ b/target/hexagon/cpu-param.h
@@ -25,4 +25,7 @@
 
 #define TARGET_INSN_START_EXTRA_WORDS 0
 
+/* MTTCG not yet supported: require strict ordering */
+#define TCG_GUEST_DEFAULT_MO        TCG_MO_ALL
+
 #endif
diff --git a/target/m68k/cpu-param.h b/target/m68k/cpu-param.h
index 256a2b5f8b..10a8d74bfa 100644
--- a/target/m68k/cpu-param.h
+++ b/target/m68k/cpu-param.h
@@ -19,4 +19,7 @@
 
 #define TARGET_INSN_START_EXTRA_WORDS 1
 
+/* MTTCG not yet supported: require strict ordering */
+#define TCG_GUEST_DEFAULT_MO        TCG_MO_ALL
+
 #endif
diff --git a/target/rx/cpu-param.h b/target/rx/cpu-param.h
index 84934f3bca..fe39a77ca3 100644
--- a/target/rx/cpu-param.h
+++ b/target/rx/cpu-param.h
@@ -26,4 +26,7 @@
 
 #define TARGET_INSN_START_EXTRA_WORDS 0
 
+/* MTTCG not yet supported: require strict ordering */
+#define TCG_GUEST_DEFAULT_MO        TCG_MO_ALL
+
 #endif
diff --git a/target/sh4/cpu-param.h b/target/sh4/cpu-param.h
index f328715ee8..acdf239749 100644
--- a/target/sh4/cpu-param.h
+++ b/target/sh4/cpu-param.h
@@ -18,4 +18,7 @@
 
 #define TARGET_INSN_START_EXTRA_WORDS 1
 
+/* MTTCG not yet supported: require strict ordering */
+#define TCG_GUEST_DEFAULT_MO        TCG_MO_ALL
+
 #endif
diff --git a/target/tricore/cpu-param.h b/target/tricore/cpu-param.h
index eb33a67c41..45fde756b6 100644
--- a/target/tricore/cpu-param.h
+++ b/target/tricore/cpu-param.h
@@ -14,4 +14,7 @@
 
 #define TARGET_INSN_START_EXTRA_WORDS 0
 
+/* MTTCG not yet supported: require strict ordering */
+#define TCG_GUEST_DEFAULT_MO        TCG_MO_ALL
+
 #endif

From adb86e48ad3db9031a5963e03a8be2e2798bf9d1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 21 Mar 2025 12:16:28 +0100
Subject: [PATCH 0213/2760] tcg: Simplify tcg_req_mo() macro
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Now that TCG_GUEST_DEFAULT_MO is always defined,
simplify the tcg_req_mo() macro.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Anton Johansson <anjo@rev.ng>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/internal-target.h | 9 +--------
 accel/tcg/tcg-all.c         | 3 ---
 2 files changed, 1 insertion(+), 11 deletions(-)

diff --git a/accel/tcg/internal-target.h b/accel/tcg/internal-target.h
index 05abaeb8e0..1a46a7c87d 100644
--- a/accel/tcg/internal-target.h
+++ b/accel/tcg/internal-target.h
@@ -52,17 +52,10 @@ G_NORETURN void cpu_io_recompile(CPUState *cpu, uintptr_t retaddr);
  * memory ordering vs the host memory ordering.  A non-zero
  * result indicates that some barrier is required.
  *
- * If TCG_GUEST_DEFAULT_MO is not defined, assume that the
- * guest requires strict ordering.
- *
  * This is a macro so that it's constant even without optimization.
  */
-#ifdef TCG_GUEST_DEFAULT_MO
-# define tcg_req_mo(type) \
+#define tcg_req_mo(type) \
     ((type) & TCG_GUEST_DEFAULT_MO & ~TCG_TARGET_DEFAULT_MO)
-#else
-# define tcg_req_mo(type) ((type) & ~TCG_TARGET_DEFAULT_MO)
-#endif
 
 /**
  * cpu_req_mo:
diff --git a/accel/tcg/tcg-all.c b/accel/tcg/tcg-all.c
index 7a5b810b88..a5a1fd6a11 100644
--- a/accel/tcg/tcg-all.c
+++ b/accel/tcg/tcg-all.c
@@ -77,9 +77,6 @@ static bool default_mttcg_enabled(void)
         return false;
     }
 #ifdef TARGET_SUPPORTS_MTTCG
-# ifndef TCG_GUEST_DEFAULT_MO
-#  error "TARGET_SUPPORTS_MTTCG without TCG_GUEST_DEFAULT_MO"
-# endif
     return true;
 #else
     return false;

From 04583ce7e032ee8e0a12756b69dc67ad7b399997 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 21 Mar 2025 19:01:52 +0100
Subject: [PATCH 0214/2760] tcg: Define guest_default_memory_order in TCGCPUOps
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add the TCGCPUOps::guest_default_memory_order field and have
each target initialize it.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Anton Johansson <anjo@rev.ng>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/accel/tcg/cpu-ops.h | 8 ++++++++
 target/alpha/cpu.c          | 2 ++
 target/arm/cpu.c            | 2 ++
 target/arm/tcg/cpu-v7m.c    | 2 ++
 target/avr/cpu.c            | 1 +
 target/hexagon/cpu.c        | 1 +
 target/hppa/cpu.c           | 2 ++
 target/i386/tcg/tcg-cpu.c   | 1 +
 target/loongarch/cpu.c      | 2 ++
 target/m68k/cpu.c           | 2 ++
 target/microblaze/cpu.c     | 2 ++
 target/mips/cpu.c           | 2 ++
 target/openrisc/cpu.c       | 2 ++
 target/ppc/cpu_init.c       | 1 +
 target/riscv/tcg/tcg-cpu.c  | 2 ++
 target/rx/cpu.c             | 2 ++
 target/s390x/cpu.c          | 2 ++
 target/sh4/cpu.c            | 2 ++
 target/sparc/cpu.c          | 2 ++
 target/tricore/cpu.c        | 1 +
 target/xtensa/cpu.c         | 2 ++
 21 files changed, 43 insertions(+)

diff --git a/include/accel/tcg/cpu-ops.h b/include/accel/tcg/cpu-ops.h
index 106a0688da..a4932fc5d7 100644
--- a/include/accel/tcg/cpu-ops.h
+++ b/include/accel/tcg/cpu-ops.h
@@ -16,8 +16,16 @@
 #include "exec/memop.h"
 #include "exec/mmu-access-type.h"
 #include "exec/vaddr.h"
+#include "tcg/tcg-mo.h"
 
 struct TCGCPUOps {
+
+    /**
+     * @guest_default_memory_order: default barrier that is required
+     *                              for the guest memory ordering.
+     */
+    TCGBar guest_default_memory_order;
+
     /**
      * @initialize: Initialize TCG state
      *
diff --git a/target/alpha/cpu.c b/target/alpha/cpu.c
index 99d839a279..6f931117a2 100644
--- a/target/alpha/cpu.c
+++ b/target/alpha/cpu.c
@@ -235,6 +235,8 @@ static const struct SysemuCPUOps alpha_sysemu_ops = {
 #include "accel/tcg/cpu-ops.h"
 
 static const TCGCPUOps alpha_tcg_ops = {
+    .guest_default_memory_order = TCG_GUEST_DEFAULT_MO,
+
     .initialize = alpha_translate_init,
     .translate_code = alpha_translate_code,
     .synchronize_from_tb = alpha_cpu_synchronize_from_tb,
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index c9e043bc9b..3f20e258fd 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -2671,6 +2671,8 @@ static const struct SysemuCPUOps arm_sysemu_ops = {
 
 #ifdef CONFIG_TCG
 static const TCGCPUOps arm_tcg_ops = {
+    .guest_default_memory_order = TCG_GUEST_DEFAULT_MO,
+
     .initialize = arm_translate_init,
     .translate_code = arm_translate_code,
     .synchronize_from_tb = arm_cpu_synchronize_from_tb,
diff --git a/target/arm/tcg/cpu-v7m.c b/target/arm/tcg/cpu-v7m.c
index 1a913faa50..4553fe9de0 100644
--- a/target/arm/tcg/cpu-v7m.c
+++ b/target/arm/tcg/cpu-v7m.c
@@ -232,6 +232,8 @@ static void cortex_m55_initfn(Object *obj)
 }
 
 static const TCGCPUOps arm_v7m_tcg_ops = {
+    .guest_default_memory_order = TCG_GUEST_DEFAULT_MO,
+
     .initialize = arm_translate_init,
     .translate_code = arm_translate_code,
     .synchronize_from_tb = arm_cpu_synchronize_from_tb,
diff --git a/target/avr/cpu.c b/target/avr/cpu.c
index feb73e722b..67918684fa 100644
--- a/target/avr/cpu.c
+++ b/target/avr/cpu.c
@@ -224,6 +224,7 @@ static const struct SysemuCPUOps avr_sysemu_ops = {
 #include "accel/tcg/cpu-ops.h"
 
 static const TCGCPUOps avr_tcg_ops = {
+    .guest_default_memory_order = TCG_GUEST_DEFAULT_MO,
     .initialize = avr_cpu_tcg_init,
     .translate_code = avr_cpu_translate_code,
     .synchronize_from_tb = avr_cpu_synchronize_from_tb,
diff --git a/target/hexagon/cpu.c b/target/hexagon/cpu.c
index ad1f303fbc..b12e0dccd0 100644
--- a/target/hexagon/cpu.c
+++ b/target/hexagon/cpu.c
@@ -325,6 +325,7 @@ static void hexagon_cpu_init(Object *obj)
 #include "accel/tcg/cpu-ops.h"
 
 static const TCGCPUOps hexagon_tcg_ops = {
+    .guest_default_memory_order = TCG_GUEST_DEFAULT_MO,
     .initialize = hexagon_translate_init,
     .translate_code = hexagon_translate_code,
     .synchronize_from_tb = hexagon_cpu_synchronize_from_tb,
diff --git a/target/hppa/cpu.c b/target/hppa/cpu.c
index 51bff0c5d6..ac4560febe 100644
--- a/target/hppa/cpu.c
+++ b/target/hppa/cpu.c
@@ -253,6 +253,8 @@ static const struct SysemuCPUOps hppa_sysemu_ops = {
 #include "accel/tcg/cpu-ops.h"
 
 static const TCGCPUOps hppa_tcg_ops = {
+    .guest_default_memory_order = TCG_GUEST_DEFAULT_MO,
+
     .initialize = hppa_translate_init,
     .translate_code = hppa_translate_code,
     .synchronize_from_tb = hppa_cpu_synchronize_from_tb,
diff --git a/target/i386/tcg/tcg-cpu.c b/target/i386/tcg/tcg-cpu.c
index 35b17f2b18..3e1b315340 100644
--- a/target/i386/tcg/tcg-cpu.c
+++ b/target/i386/tcg/tcg-cpu.c
@@ -125,6 +125,7 @@ static bool x86_debug_check_breakpoint(CPUState *cs)
 #include "accel/tcg/cpu-ops.h"
 
 static const TCGCPUOps x86_tcg_ops = {
+    .guest_default_memory_order = TCG_GUEST_DEFAULT_MO,
     .initialize = tcg_x86_init,
     .translate_code = x86_translate_code,
     .synchronize_from_tb = x86_cpu_synchronize_from_tb,
diff --git a/target/loongarch/cpu.c b/target/loongarch/cpu.c
index 4cc8e02f70..ee74509a66 100644
--- a/target/loongarch/cpu.c
+++ b/target/loongarch/cpu.c
@@ -864,6 +864,8 @@ static void loongarch_cpu_dump_state(CPUState *cs, FILE *f, int flags)
 #include "accel/tcg/cpu-ops.h"
 
 static const TCGCPUOps loongarch_tcg_ops = {
+    .guest_default_memory_order = TCG_GUEST_DEFAULT_MO,
+
     .initialize = loongarch_translate_init,
     .translate_code = loongarch_translate_code,
     .synchronize_from_tb = loongarch_cpu_synchronize_from_tb,
diff --git a/target/m68k/cpu.c b/target/m68k/cpu.c
index 4409d8941c..bfde9b8594 100644
--- a/target/m68k/cpu.c
+++ b/target/m68k/cpu.c
@@ -589,6 +589,8 @@ static const struct SysemuCPUOps m68k_sysemu_ops = {
 #include "accel/tcg/cpu-ops.h"
 
 static const TCGCPUOps m68k_tcg_ops = {
+    .guest_default_memory_order = TCG_GUEST_DEFAULT_MO,
+
     .initialize = m68k_tcg_init,
     .translate_code = m68k_translate_code,
     .restore_state_to_opc = m68k_restore_state_to_opc,
diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
index d10ae0702a..e46863574c 100644
--- a/target/microblaze/cpu.c
+++ b/target/microblaze/cpu.c
@@ -427,6 +427,8 @@ static const struct SysemuCPUOps mb_sysemu_ops = {
 #include "accel/tcg/cpu-ops.h"
 
 static const TCGCPUOps mb_tcg_ops = {
+    .guest_default_memory_order = TCG_GUEST_DEFAULT_MO,
+
     .initialize = mb_tcg_init,
     .translate_code = mb_translate_code,
     .synchronize_from_tb = mb_cpu_synchronize_from_tb,
diff --git a/target/mips/cpu.c b/target/mips/cpu.c
index cb0d6dde0e..67a8550cc1 100644
--- a/target/mips/cpu.c
+++ b/target/mips/cpu.c
@@ -551,6 +551,8 @@ static int mips_cpu_mmu_index(CPUState *cs, bool ifunc)
 }
 
 static const TCGCPUOps mips_tcg_ops = {
+    .guest_default_memory_order = TCG_GUEST_DEFAULT_MO,
+
     .initialize = mips_tcg_init,
     .translate_code = mips_translate_code,
     .synchronize_from_tb = mips_cpu_synchronize_from_tb,
diff --git a/target/openrisc/cpu.c b/target/openrisc/cpu.c
index dc55594a7d..e62c698a40 100644
--- a/target/openrisc/cpu.c
+++ b/target/openrisc/cpu.c
@@ -243,6 +243,8 @@ static const struct SysemuCPUOps openrisc_sysemu_ops = {
 #include "accel/tcg/cpu-ops.h"
 
 static const TCGCPUOps openrisc_tcg_ops = {
+    .guest_default_memory_order = TCG_GUEST_DEFAULT_MO,
+
     .initialize = openrisc_translate_init,
     .translate_code = openrisc_translate_code,
     .synchronize_from_tb = openrisc_cpu_synchronize_from_tb,
diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
index fd8c42069e..1cf18e0dae 100644
--- a/target/ppc/cpu_init.c
+++ b/target/ppc/cpu_init.c
@@ -7479,6 +7479,7 @@ static const struct SysemuCPUOps ppc_sysemu_ops = {
 #include "accel/tcg/cpu-ops.h"
 
 static const TCGCPUOps ppc_tcg_ops = {
+  .guest_default_memory_order = TCG_GUEST_DEFAULT_MO,
   .initialize = ppc_translate_init,
   .translate_code = ppc_translate_code,
   .restore_state_to_opc = ppc_restore_state_to_opc,
diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index 5d0429b4d0..ded2d68ad7 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -140,6 +140,8 @@ static void riscv_restore_state_to_opc(CPUState *cs,
 }
 
 static const TCGCPUOps riscv_tcg_ops = {
+    .guest_default_memory_order = TCG_GUEST_DEFAULT_MO,
+
     .initialize = riscv_translate_init,
     .translate_code = riscv_translate_code,
     .synchronize_from_tb = riscv_cpu_synchronize_from_tb,
diff --git a/target/rx/cpu.c b/target/rx/cpu.c
index e14d9cbef9..d7eac551fd 100644
--- a/target/rx/cpu.c
+++ b/target/rx/cpu.c
@@ -204,6 +204,8 @@ static const struct SysemuCPUOps rx_sysemu_ops = {
 #include "accel/tcg/cpu-ops.h"
 
 static const TCGCPUOps rx_tcg_ops = {
+    .guest_default_memory_order = TCG_GUEST_DEFAULT_MO,
+
     .initialize = rx_translate_init,
     .translate_code = rx_translate_code,
     .synchronize_from_tb = rx_cpu_synchronize_from_tb,
diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
index d15b1943e0..f232d82fa3 100644
--- a/target/s390x/cpu.c
+++ b/target/s390x/cpu.c
@@ -345,6 +345,8 @@ void cpu_get_tb_cpu_state(CPUS390XState *env, vaddr *pc,
 }
 
 static const TCGCPUOps s390_tcg_ops = {
+    .guest_default_memory_order = TCG_GUEST_DEFAULT_MO,
+
     .initialize = s390x_translate_init,
     .translate_code = s390x_translate_code,
     .restore_state_to_opc = s390x_restore_state_to_opc,
diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
index df093988cb..29f4be7ba9 100644
--- a/target/sh4/cpu.c
+++ b/target/sh4/cpu.c
@@ -262,6 +262,8 @@ static const struct SysemuCPUOps sh4_sysemu_ops = {
 #include "accel/tcg/cpu-ops.h"
 
 static const TCGCPUOps superh_tcg_ops = {
+    .guest_default_memory_order = TCG_GUEST_DEFAULT_MO,
+
     .initialize = sh4_translate_init,
     .translate_code = sh4_translate_code,
     .synchronize_from_tb = superh_cpu_synchronize_from_tb,
diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
index af3cec43e7..ef04efcb18 100644
--- a/target/sparc/cpu.c
+++ b/target/sparc/cpu.c
@@ -1001,6 +1001,8 @@ static const struct SysemuCPUOps sparc_sysemu_ops = {
 #include "accel/tcg/cpu-ops.h"
 
 static const TCGCPUOps sparc_tcg_ops = {
+    .guest_default_memory_order = TCG_GUEST_DEFAULT_MO,
+
     .initialize = sparc_tcg_init,
     .translate_code = sparc_translate_code,
     .synchronize_from_tb = sparc_cpu_synchronize_from_tb,
diff --git a/target/tricore/cpu.c b/target/tricore/cpu.c
index 833a93d37a..3bf399335a 100644
--- a/target/tricore/cpu.c
+++ b/target/tricore/cpu.c
@@ -172,6 +172,7 @@ static const struct SysemuCPUOps tricore_sysemu_ops = {
 #include "accel/tcg/cpu-ops.h"
 
 static const TCGCPUOps tricore_tcg_ops = {
+    .guest_default_memory_order = TCG_GUEST_DEFAULT_MO,
     .initialize = tricore_tcg_init,
     .translate_code = tricore_translate_code,
     .synchronize_from_tb = tricore_cpu_synchronize_from_tb,
diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
index 51f9ee9e89..2347106495 100644
--- a/target/xtensa/cpu.c
+++ b/target/xtensa/cpu.c
@@ -232,6 +232,8 @@ static const struct SysemuCPUOps xtensa_sysemu_ops = {
 #include "accel/tcg/cpu-ops.h"
 
 static const TCGCPUOps xtensa_tcg_ops = {
+    .guest_default_memory_order = TCG_GUEST_DEFAULT_MO,
+
     .initialize = xtensa_translate_init,
     .translate_code = xtensa_translate_code,
     .debug_excp_handler = xtensa_breakpoint_handler,

From 9c1f8062d4d0ee47981bf1aead1b877bdf08296e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 21 Mar 2025 19:05:31 +0100
Subject: [PATCH 0215/2760] tcg: Remove use of TCG_GUEST_DEFAULT_MO in
 tb_gen_code()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Use TCGCPUOps::guest_default_memory_order to set TCGContext::guest_mo.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/translate-all.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index 7467255f6e..c007b9a190 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -353,7 +353,7 @@ TranslationBlock *tb_gen_code(CPUState *cpu,
     tcg_ctx->tlb_dyn_max_bits = CPU_TLB_DYN_MAX_BITS;
 #endif
     tcg_ctx->insn_start_words = TARGET_INSN_START_WORDS;
-    tcg_ctx->guest_mo = TCG_GUEST_DEFAULT_MO;
+    tcg_ctx->guest_mo = cpu->cc->tcg_ops->guest_default_memory_order;
 
  restart_translate:
     trace_translate_block(tb, pc, tb->tc.ptr);

From eacd8c7cef297bafa53deaf8d9b9d368acff3936 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 21 Mar 2025 18:52:37 +0100
Subject: [PATCH 0216/2760] tcg: Propagate CPUState argument to cpu_req_mo()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In preparation of having tcg_req_mo() access CPUState in
the next commit, pass it to cpu_req_mo(), its single caller.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c          | 20 ++++++++++----------
 accel/tcg/internal-target.h |  3 ++-
 accel/tcg/user-exec.c       | 20 ++++++++++----------
 3 files changed, 22 insertions(+), 21 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index 2cafd38d2a..35b1ff03a5 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -2324,7 +2324,7 @@ static uint8_t do_ld1_mmu(CPUState *cpu, vaddr addr, MemOpIdx oi,
     MMULookupLocals l;
     bool crosspage;
 
-    cpu_req_mo(TCG_MO_LD_LD | TCG_MO_ST_LD);
+    cpu_req_mo(cpu, TCG_MO_LD_LD | TCG_MO_ST_LD);
     crosspage = mmu_lookup(cpu, addr, oi, ra, access_type, &l);
     tcg_debug_assert(!crosspage);
 
@@ -2339,7 +2339,7 @@ static uint16_t do_ld2_mmu(CPUState *cpu, vaddr addr, MemOpIdx oi,
     uint16_t ret;
     uint8_t a, b;
 
-    cpu_req_mo(TCG_MO_LD_LD | TCG_MO_ST_LD);
+    cpu_req_mo(cpu, TCG_MO_LD_LD | TCG_MO_ST_LD);
     crosspage = mmu_lookup(cpu, addr, oi, ra, access_type, &l);
     if (likely(!crosspage)) {
         return do_ld_2(cpu, &l.page[0], l.mmu_idx, access_type, l.memop, ra);
@@ -2363,7 +2363,7 @@ static uint32_t do_ld4_mmu(CPUState *cpu, vaddr addr, MemOpIdx oi,
     bool crosspage;
     uint32_t ret;
 
-    cpu_req_mo(TCG_MO_LD_LD | TCG_MO_ST_LD);
+    cpu_req_mo(cpu, TCG_MO_LD_LD | TCG_MO_ST_LD);
     crosspage = mmu_lookup(cpu, addr, oi, ra, access_type, &l);
     if (likely(!crosspage)) {
         return do_ld_4(cpu, &l.page[0], l.mmu_idx, access_type, l.memop, ra);
@@ -2384,7 +2384,7 @@ static uint64_t do_ld8_mmu(CPUState *cpu, vaddr addr, MemOpIdx oi,
     bool crosspage;
     uint64_t ret;
 
-    cpu_req_mo(TCG_MO_LD_LD | TCG_MO_ST_LD);
+    cpu_req_mo(cpu, TCG_MO_LD_LD | TCG_MO_ST_LD);
     crosspage = mmu_lookup(cpu, addr, oi, ra, access_type, &l);
     if (likely(!crosspage)) {
         return do_ld_8(cpu, &l.page[0], l.mmu_idx, access_type, l.memop, ra);
@@ -2407,7 +2407,7 @@ static Int128 do_ld16_mmu(CPUState *cpu, vaddr addr,
     Int128 ret;
     int first;
 
-    cpu_req_mo(TCG_MO_LD_LD | TCG_MO_ST_LD);
+    cpu_req_mo(cpu, TCG_MO_LD_LD | TCG_MO_ST_LD);
     crosspage = mmu_lookup(cpu, addr, oi, ra, MMU_DATA_LOAD, &l);
     if (likely(!crosspage)) {
         if (unlikely(l.page[0].flags & TLB_MMIO)) {
@@ -2735,7 +2735,7 @@ static void do_st1_mmu(CPUState *cpu, vaddr addr, uint8_t val,
     MMULookupLocals l;
     bool crosspage;
 
-    cpu_req_mo(TCG_MO_LD_ST | TCG_MO_ST_ST);
+    cpu_req_mo(cpu, TCG_MO_LD_ST | TCG_MO_ST_ST);
     crosspage = mmu_lookup(cpu, addr, oi, ra, MMU_DATA_STORE, &l);
     tcg_debug_assert(!crosspage);
 
@@ -2749,7 +2749,7 @@ static void do_st2_mmu(CPUState *cpu, vaddr addr, uint16_t val,
     bool crosspage;
     uint8_t a, b;
 
-    cpu_req_mo(TCG_MO_LD_ST | TCG_MO_ST_ST);
+    cpu_req_mo(cpu, TCG_MO_LD_ST | TCG_MO_ST_ST);
     crosspage = mmu_lookup(cpu, addr, oi, ra, MMU_DATA_STORE, &l);
     if (likely(!crosspage)) {
         do_st_2(cpu, &l.page[0], val, l.mmu_idx, l.memop, ra);
@@ -2771,7 +2771,7 @@ static void do_st4_mmu(CPUState *cpu, vaddr addr, uint32_t val,
     MMULookupLocals l;
     bool crosspage;
 
-    cpu_req_mo(TCG_MO_LD_ST | TCG_MO_ST_ST);
+    cpu_req_mo(cpu, TCG_MO_LD_ST | TCG_MO_ST_ST);
     crosspage = mmu_lookup(cpu, addr, oi, ra, MMU_DATA_STORE, &l);
     if (likely(!crosspage)) {
         do_st_4(cpu, &l.page[0], val, l.mmu_idx, l.memop, ra);
@@ -2792,7 +2792,7 @@ static void do_st8_mmu(CPUState *cpu, vaddr addr, uint64_t val,
     MMULookupLocals l;
     bool crosspage;
 
-    cpu_req_mo(TCG_MO_LD_ST | TCG_MO_ST_ST);
+    cpu_req_mo(cpu, TCG_MO_LD_ST | TCG_MO_ST_ST);
     crosspage = mmu_lookup(cpu, addr, oi, ra, MMU_DATA_STORE, &l);
     if (likely(!crosspage)) {
         do_st_8(cpu, &l.page[0], val, l.mmu_idx, l.memop, ra);
@@ -2815,7 +2815,7 @@ static void do_st16_mmu(CPUState *cpu, vaddr addr, Int128 val,
     uint64_t a, b;
     int first;
 
-    cpu_req_mo(TCG_MO_LD_ST | TCG_MO_ST_ST);
+    cpu_req_mo(cpu, TCG_MO_LD_ST | TCG_MO_ST_ST);
     crosspage = mmu_lookup(cpu, addr, oi, ra, MMU_DATA_STORE, &l);
     if (likely(!crosspage)) {
         if (unlikely(l.page[0].flags & TLB_MMIO)) {
diff --git a/accel/tcg/internal-target.h b/accel/tcg/internal-target.h
index 1a46a7c87d..23aac39b57 100644
--- a/accel/tcg/internal-target.h
+++ b/accel/tcg/internal-target.h
@@ -59,12 +59,13 @@ G_NORETURN void cpu_io_recompile(CPUState *cpu, uintptr_t retaddr);
 
 /**
  * cpu_req_mo:
+ * @cpu: CPUState
  * @type: TCGBar
  *
  * If tcg_req_mo indicates a barrier for @type is required
  * for the guest memory model, issue a host memory barrier.
  */
-#define cpu_req_mo(type)          \
+#define cpu_req_mo(cpu, type)     \
     do {                          \
         if (tcg_req_mo(type)) {   \
             smp_mb();             \
diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index 1b878ead7a..3f4d682446 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -1061,7 +1061,7 @@ static uint8_t do_ld1_mmu(CPUState *cpu, vaddr addr, MemOpIdx oi,
     void *haddr;
     uint8_t ret;
 
-    cpu_req_mo(TCG_MO_LD_LD | TCG_MO_ST_LD);
+    cpu_req_mo(cpu, TCG_MO_LD_LD | TCG_MO_ST_LD);
     haddr = cpu_mmu_lookup(cpu, addr, get_memop(oi), ra, access_type);
     ret = ldub_p(haddr);
     clear_helper_retaddr();
@@ -1075,7 +1075,7 @@ static uint16_t do_ld2_mmu(CPUState *cpu, vaddr addr, MemOpIdx oi,
     uint16_t ret;
     MemOp mop = get_memop(oi);
 
-    cpu_req_mo(TCG_MO_LD_LD | TCG_MO_ST_LD);
+    cpu_req_mo(cpu, TCG_MO_LD_LD | TCG_MO_ST_LD);
     haddr = cpu_mmu_lookup(cpu, addr, mop, ra, access_type);
     ret = load_atom_2(cpu, ra, haddr, mop);
     clear_helper_retaddr();
@@ -1093,7 +1093,7 @@ static uint32_t do_ld4_mmu(CPUState *cpu, vaddr addr, MemOpIdx oi,
     uint32_t ret;
     MemOp mop = get_memop(oi);
 
-    cpu_req_mo(TCG_MO_LD_LD | TCG_MO_ST_LD);
+    cpu_req_mo(cpu, TCG_MO_LD_LD | TCG_MO_ST_LD);
     haddr = cpu_mmu_lookup(cpu, addr, mop, ra, access_type);
     ret = load_atom_4(cpu, ra, haddr, mop);
     clear_helper_retaddr();
@@ -1111,7 +1111,7 @@ static uint64_t do_ld8_mmu(CPUState *cpu, vaddr addr, MemOpIdx oi,
     uint64_t ret;
     MemOp mop = get_memop(oi);
 
-    cpu_req_mo(TCG_MO_LD_LD | TCG_MO_ST_LD);
+    cpu_req_mo(cpu, TCG_MO_LD_LD | TCG_MO_ST_LD);
     haddr = cpu_mmu_lookup(cpu, addr, mop, ra, access_type);
     ret = load_atom_8(cpu, ra, haddr, mop);
     clear_helper_retaddr();
@@ -1130,7 +1130,7 @@ static Int128 do_ld16_mmu(CPUState *cpu, abi_ptr addr,
     MemOp mop = get_memop(oi);
 
     tcg_debug_assert((mop & MO_SIZE) == MO_128);
-    cpu_req_mo(TCG_MO_LD_LD | TCG_MO_ST_LD);
+    cpu_req_mo(cpu, TCG_MO_LD_LD | TCG_MO_ST_LD);
     haddr = cpu_mmu_lookup(cpu, addr, mop, ra, MMU_DATA_LOAD);
     ret = load_atom_16(cpu, ra, haddr, mop);
     clear_helper_retaddr();
@@ -1146,7 +1146,7 @@ static void do_st1_mmu(CPUState *cpu, vaddr addr, uint8_t val,
 {
     void *haddr;
 
-    cpu_req_mo(TCG_MO_LD_ST | TCG_MO_ST_ST);
+    cpu_req_mo(cpu, TCG_MO_LD_ST | TCG_MO_ST_ST);
     haddr = cpu_mmu_lookup(cpu, addr, get_memop(oi), ra, MMU_DATA_STORE);
     stb_p(haddr, val);
     clear_helper_retaddr();
@@ -1158,7 +1158,7 @@ static void do_st2_mmu(CPUState *cpu, vaddr addr, uint16_t val,
     void *haddr;
     MemOp mop = get_memop(oi);
 
-    cpu_req_mo(TCG_MO_LD_ST | TCG_MO_ST_ST);
+    cpu_req_mo(cpu, TCG_MO_LD_ST | TCG_MO_ST_ST);
     haddr = cpu_mmu_lookup(cpu, addr, mop, ra, MMU_DATA_STORE);
 
     if (mop & MO_BSWAP) {
@@ -1174,7 +1174,7 @@ static void do_st4_mmu(CPUState *cpu, vaddr addr, uint32_t val,
     void *haddr;
     MemOp mop = get_memop(oi);
 
-    cpu_req_mo(TCG_MO_LD_ST | TCG_MO_ST_ST);
+    cpu_req_mo(cpu, TCG_MO_LD_ST | TCG_MO_ST_ST);
     haddr = cpu_mmu_lookup(cpu, addr, mop, ra, MMU_DATA_STORE);
 
     if (mop & MO_BSWAP) {
@@ -1190,7 +1190,7 @@ static void do_st8_mmu(CPUState *cpu, vaddr addr, uint64_t val,
     void *haddr;
     MemOp mop = get_memop(oi);
 
-    cpu_req_mo(TCG_MO_LD_ST | TCG_MO_ST_ST);
+    cpu_req_mo(cpu, TCG_MO_LD_ST | TCG_MO_ST_ST);
     haddr = cpu_mmu_lookup(cpu, addr, mop, ra, MMU_DATA_STORE);
 
     if (mop & MO_BSWAP) {
@@ -1206,7 +1206,7 @@ static void do_st16_mmu(CPUState *cpu, vaddr addr, Int128 val,
     void *haddr;
     MemOpIdx mop = get_memop(oi);
 
-    cpu_req_mo(TCG_MO_LD_ST | TCG_MO_ST_ST);
+    cpu_req_mo(cpu, TCG_MO_LD_ST | TCG_MO_ST_ST);
     haddr = cpu_mmu_lookup(cpu, addr, mop, ra, MMU_DATA_STORE);
 
     if (mop & MO_BSWAP) {

From 0eca13c29a0823850cf3308528b0de0ed4608c02 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 21 Mar 2025 12:18:26 +0100
Subject: [PATCH 0217/2760] tcg: Have tcg_req_mo() use
 TCGCPUOps::guest_default_memory_order
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In order to use TCG with multiple targets, replace the
compile time use of TCG_GUEST_DEFAULT_MO by a runtime access
to TCGCPUOps::guest_default_memory_order via CPUState.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/internal-target.h | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/accel/tcg/internal-target.h b/accel/tcg/internal-target.h
index 23aac39b57..f5a3fd7e40 100644
--- a/accel/tcg/internal-target.h
+++ b/accel/tcg/internal-target.h
@@ -46,16 +46,15 @@ G_NORETURN void cpu_io_recompile(CPUState *cpu, uintptr_t retaddr);
 
 /**
  * tcg_req_mo:
+ * @guest_mo: Guest default memory order
  * @type: TCGBar
  *
  * Filter @type to the barrier that is required for the guest
  * memory ordering vs the host memory ordering.  A non-zero
  * result indicates that some barrier is required.
- *
- * This is a macro so that it's constant even without optimization.
  */
-#define tcg_req_mo(type) \
-    ((type) & TCG_GUEST_DEFAULT_MO & ~TCG_TARGET_DEFAULT_MO)
+#define tcg_req_mo(guest_mo, type) \
+    ((type) & guest_mo & ~TCG_TARGET_DEFAULT_MO)
 
 /**
  * cpu_req_mo:
@@ -67,7 +66,7 @@ G_NORETURN void cpu_io_recompile(CPUState *cpu, uintptr_t retaddr);
  */
 #define cpu_req_mo(cpu, type)     \
     do {                          \
-        if (tcg_req_mo(type)) {   \
+        if (tcg_req_mo(cpu->cc->tcg_ops->guest_default_memory_order, type)) { \
             smp_mb();             \
         }                         \
     } while (0)

From 8201f1a29c95bca095bdd6e6c6eba42d8d06499b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 21 Mar 2025 19:02:35 +0100
Subject: [PATCH 0218/2760] tcg: Remove the TCG_GUEST_DEFAULT_MO definition
 globally
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

By directly using TCGCPUOps::guest_default_memory_order,
we don't need the TCG_GUEST_DEFAULT_MO definition anymore.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Anton Johansson <anjo@rev.ng>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 docs/devel/multi-thread-tcg.rst |  4 ++--
 target/alpha/cpu-param.h        |  3 ---
 target/alpha/cpu.c              |  3 ++-
 target/arm/cpu-param.h          |  3 ---
 target/arm/cpu.c                |  3 ++-
 target/arm/tcg/cpu-v7m.c        |  3 ++-
 target/avr/cpu-param.h          |  2 --
 target/avr/cpu.c                |  2 +-
 target/hexagon/cpu-param.h      |  3 ---
 target/hexagon/cpu.c            |  3 ++-
 target/hppa/cpu-param.h         |  8 --------
 target/hppa/cpu.c               |  8 +++++++-
 target/i386/cpu-param.h         |  3 ---
 target/i386/tcg/tcg-cpu.c       |  5 ++++-
 target/loongarch/cpu-param.h    |  2 --
 target/loongarch/cpu.c          |  2 +-
 target/m68k/cpu-param.h         |  3 ---
 target/m68k/cpu.c               |  3 ++-
 target/microblaze/cpu-param.h   |  3 ---
 target/microblaze/cpu.c         |  3 ++-
 target/mips/cpu-param.h         |  2 --
 target/mips/cpu.c               |  2 +-
 target/openrisc/cpu-param.h     |  2 --
 target/openrisc/cpu.c           |  2 +-
 target/ppc/cpu-param.h          |  2 --
 target/ppc/cpu_init.c           |  2 +-
 target/riscv/cpu-param.h        |  2 --
 target/riscv/tcg/tcg-cpu.c      |  2 +-
 target/rx/cpu-param.h           |  3 ---
 target/rx/cpu.c                 |  3 ++-
 target/s390x/cpu-param.h        |  6 ------
 target/s390x/cpu.c              |  6 +++++-
 target/sh4/cpu-param.h          |  3 ---
 target/sh4/cpu.c                |  3 ++-
 target/sparc/cpu-param.h        | 23 -----------------------
 target/sparc/cpu.c              | 23 ++++++++++++++++++++++-
 target/tricore/cpu-param.h      |  3 ---
 target/tricore/cpu.c            |  3 ++-
 target/xtensa/cpu-param.h       |  3 ---
 target/xtensa/cpu.c             |  3 ++-
 40 files changed, 66 insertions(+), 101 deletions(-)

diff --git a/docs/devel/multi-thread-tcg.rst b/docs/devel/multi-thread-tcg.rst
index b0f473961d..14a2a9dc7b 100644
--- a/docs/devel/multi-thread-tcg.rst
+++ b/docs/devel/multi-thread-tcg.rst
@@ -28,8 +28,8 @@ vCPU Scheduling
 We introduce a new running mode where each vCPU will run on its own
 user-space thread. This is enabled by default for all FE/BE
 combinations where the host memory model is able to accommodate the
-guest (TCG_GUEST_DEFAULT_MO & ~TCG_TARGET_DEFAULT_MO is zero) and the
-guest has had the required work done to support this safely
+guest (TCGCPUOps::guest_default_memory_order & ~TCG_TARGET_DEFAULT_MO is zero)
+and the guest has had the required work done to support this safely
 (TARGET_SUPPORTS_MTTCG).
 
 System emulation will fall back to the original round robin approach
diff --git a/target/alpha/cpu-param.h b/target/alpha/cpu-param.h
index dd44feb179..a799f42db3 100644
--- a/target/alpha/cpu-param.h
+++ b/target/alpha/cpu-param.h
@@ -26,7 +26,4 @@
 
 #define TARGET_INSN_START_EXTRA_WORDS 0
 
-/* Alpha processors have a weak memory model */
-#define TCG_GUEST_DEFAULT_MO      (0)
-
 #endif
diff --git a/target/alpha/cpu.c b/target/alpha/cpu.c
index 6f931117a2..eeaf3a81c1 100644
--- a/target/alpha/cpu.c
+++ b/target/alpha/cpu.c
@@ -235,7 +235,8 @@ static const struct SysemuCPUOps alpha_sysemu_ops = {
 #include "accel/tcg/cpu-ops.h"
 
 static const TCGCPUOps alpha_tcg_ops = {
-    .guest_default_memory_order = TCG_GUEST_DEFAULT_MO,
+    /* Alpha processors have a weak memory model */
+    .guest_default_memory_order = 0,
 
     .initialize = alpha_translate_init,
     .translate_code = alpha_translate_code,
diff --git a/target/arm/cpu-param.h b/target/arm/cpu-param.h
index 2cee4be693..5c5bc8a009 100644
--- a/target/arm/cpu-param.h
+++ b/target/arm/cpu-param.h
@@ -44,7 +44,4 @@
  */
 #define TARGET_INSN_START_EXTRA_WORDS 2
 
-/* ARM processors have a weak memory model */
-#define TCG_GUEST_DEFAULT_MO      (0)
-
 #endif
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index 3f20e258fd..3e9760b551 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -2671,7 +2671,8 @@ static const struct SysemuCPUOps arm_sysemu_ops = {
 
 #ifdef CONFIG_TCG
 static const TCGCPUOps arm_tcg_ops = {
-    .guest_default_memory_order = TCG_GUEST_DEFAULT_MO,
+    /* ARM processors have a weak memory model */
+    .guest_default_memory_order = 0,
 
     .initialize = arm_translate_init,
     .translate_code = arm_translate_code,
diff --git a/target/arm/tcg/cpu-v7m.c b/target/arm/tcg/cpu-v7m.c
index 4553fe9de0..89d4e4b4a2 100644
--- a/target/arm/tcg/cpu-v7m.c
+++ b/target/arm/tcg/cpu-v7m.c
@@ -232,7 +232,8 @@ static void cortex_m55_initfn(Object *obj)
 }
 
 static const TCGCPUOps arm_v7m_tcg_ops = {
-    .guest_default_memory_order = TCG_GUEST_DEFAULT_MO,
+    /* ARM processors have a weak memory model */
+    .guest_default_memory_order = 0,
 
     .initialize = arm_translate_init,
     .translate_code = arm_translate_code,
diff --git a/target/avr/cpu-param.h b/target/avr/cpu-param.h
index 9d37848d97..f74bfc2580 100644
--- a/target/avr/cpu-param.h
+++ b/target/avr/cpu-param.h
@@ -27,6 +27,4 @@
 
 #define TARGET_INSN_START_EXTRA_WORDS 0
 
-#define TCG_GUEST_DEFAULT_MO 0
-
 #endif
diff --git a/target/avr/cpu.c b/target/avr/cpu.c
index 67918684fa..8f79cf4c08 100644
--- a/target/avr/cpu.c
+++ b/target/avr/cpu.c
@@ -224,7 +224,7 @@ static const struct SysemuCPUOps avr_sysemu_ops = {
 #include "accel/tcg/cpu-ops.h"
 
 static const TCGCPUOps avr_tcg_ops = {
-    .guest_default_memory_order = TCG_GUEST_DEFAULT_MO,
+    .guest_default_memory_order = 0,
     .initialize = avr_cpu_tcg_init,
     .translate_code = avr_cpu_translate_code,
     .synchronize_from_tb = avr_cpu_synchronize_from_tb,
diff --git a/target/hexagon/cpu-param.h b/target/hexagon/cpu-param.h
index 7cc63a01d4..635d509e74 100644
--- a/target/hexagon/cpu-param.h
+++ b/target/hexagon/cpu-param.h
@@ -25,7 +25,4 @@
 
 #define TARGET_INSN_START_EXTRA_WORDS 0
 
-/* MTTCG not yet supported: require strict ordering */
-#define TCG_GUEST_DEFAULT_MO        TCG_MO_ALL
-
 #endif
diff --git a/target/hexagon/cpu.c b/target/hexagon/cpu.c
index b12e0dccd0..3d14e5cc6a 100644
--- a/target/hexagon/cpu.c
+++ b/target/hexagon/cpu.c
@@ -325,7 +325,8 @@ static void hexagon_cpu_init(Object *obj)
 #include "accel/tcg/cpu-ops.h"
 
 static const TCGCPUOps hexagon_tcg_ops = {
-    .guest_default_memory_order = TCG_GUEST_DEFAULT_MO,
+    /* MTTCG not yet supported: require strict ordering */
+    .guest_default_memory_order = TCG_MO_ALL,
     .initialize = hexagon_translate_init,
     .translate_code = hexagon_translate_code,
     .synchronize_from_tb = hexagon_cpu_synchronize_from_tb,
diff --git a/target/hppa/cpu-param.h b/target/hppa/cpu-param.h
index 68ed84e84a..9bf7ac76d0 100644
--- a/target/hppa/cpu-param.h
+++ b/target/hppa/cpu-param.h
@@ -21,12 +21,4 @@
 
 #define TARGET_INSN_START_EXTRA_WORDS 2
 
-/* PA-RISC 1.x processors have a strong memory model.  */
-/*
- * ??? While we do not yet implement PA-RISC 2.0, those processors have
- * a weak memory model, but with TLB bits that force ordering on a per-page
- * basis.  It's probably easier to fall back to a strong memory model.
- */
-#define TCG_GUEST_DEFAULT_MO        TCG_MO_ALL
-
 #endif
diff --git a/target/hppa/cpu.c b/target/hppa/cpu.c
index ac4560febe..dfbd933056 100644
--- a/target/hppa/cpu.c
+++ b/target/hppa/cpu.c
@@ -253,7 +253,13 @@ static const struct SysemuCPUOps hppa_sysemu_ops = {
 #include "accel/tcg/cpu-ops.h"
 
 static const TCGCPUOps hppa_tcg_ops = {
-    .guest_default_memory_order = TCG_GUEST_DEFAULT_MO,
+    /* PA-RISC 1.x processors have a strong memory model.  */
+    /*
+     * ??? While we do not yet implement PA-RISC 2.0, those processors have
+     * a weak memory model, but with TLB bits that force ordering on a per-page
+     * basis.  It's probably easier to fall back to a strong memory model.
+     */
+    .guest_default_memory_order = TCG_MO_ALL,
 
     .initialize = hppa_translate_init,
     .translate_code = hppa_translate_code,
diff --git a/target/i386/cpu-param.h b/target/i386/cpu-param.h
index 0c8efce861..ebb844bcc8 100644
--- a/target/i386/cpu-param.h
+++ b/target/i386/cpu-param.h
@@ -24,7 +24,4 @@
 
 #define TARGET_INSN_START_EXTRA_WORDS 1
 
-/* The x86 has a strong memory model with some store-after-load re-ordering */
-#define TCG_GUEST_DEFAULT_MO      (TCG_MO_ALL & ~TCG_MO_ST_LD)
-
 #endif
diff --git a/target/i386/tcg/tcg-cpu.c b/target/i386/tcg/tcg-cpu.c
index 3e1b315340..d941df0956 100644
--- a/target/i386/tcg/tcg-cpu.c
+++ b/target/i386/tcg/tcg-cpu.c
@@ -125,7 +125,10 @@ static bool x86_debug_check_breakpoint(CPUState *cs)
 #include "accel/tcg/cpu-ops.h"
 
 static const TCGCPUOps x86_tcg_ops = {
-    .guest_default_memory_order = TCG_GUEST_DEFAULT_MO,
+    /*
+     * The x86 has a strong memory model with some store-after-load re-ordering
+     */
+    .guest_default_memory_order = TCG_MO_ALL & ~TCG_MO_ST_LD,
     .initialize = tcg_x86_init,
     .translate_code = x86_translate_code,
     .synchronize_from_tb = x86_cpu_synchronize_from_tb,
diff --git a/target/loongarch/cpu-param.h b/target/loongarch/cpu-param.h
index dbe414bb35..58cc45a377 100644
--- a/target/loongarch/cpu-param.h
+++ b/target/loongarch/cpu-param.h
@@ -15,6 +15,4 @@
 
 #define TARGET_INSN_START_EXTRA_WORDS 0
 
-#define TCG_GUEST_DEFAULT_MO (0)
-
 #endif
diff --git a/target/loongarch/cpu.c b/target/loongarch/cpu.c
index ee74509a66..f5b8ef29ab 100644
--- a/target/loongarch/cpu.c
+++ b/target/loongarch/cpu.c
@@ -864,7 +864,7 @@ static void loongarch_cpu_dump_state(CPUState *cs, FILE *f, int flags)
 #include "accel/tcg/cpu-ops.h"
 
 static const TCGCPUOps loongarch_tcg_ops = {
-    .guest_default_memory_order = TCG_GUEST_DEFAULT_MO,
+    .guest_default_memory_order = 0,
 
     .initialize = loongarch_translate_init,
     .translate_code = loongarch_translate_code,
diff --git a/target/m68k/cpu-param.h b/target/m68k/cpu-param.h
index 10a8d74bfa..256a2b5f8b 100644
--- a/target/m68k/cpu-param.h
+++ b/target/m68k/cpu-param.h
@@ -19,7 +19,4 @@
 
 #define TARGET_INSN_START_EXTRA_WORDS 1
 
-/* MTTCG not yet supported: require strict ordering */
-#define TCG_GUEST_DEFAULT_MO        TCG_MO_ALL
-
 #endif
diff --git a/target/m68k/cpu.c b/target/m68k/cpu.c
index bfde9b8594..b2d8c8f1de 100644
--- a/target/m68k/cpu.c
+++ b/target/m68k/cpu.c
@@ -589,7 +589,8 @@ static const struct SysemuCPUOps m68k_sysemu_ops = {
 #include "accel/tcg/cpu-ops.h"
 
 static const TCGCPUOps m68k_tcg_ops = {
-    .guest_default_memory_order = TCG_GUEST_DEFAULT_MO,
+    /* MTTCG not yet supported: require strict ordering */
+    .guest_default_memory_order = TCG_MO_ALL,
 
     .initialize = m68k_tcg_init,
     .translate_code = m68k_translate_code,
diff --git a/target/microblaze/cpu-param.h b/target/microblaze/cpu-param.h
index 5d55e0e3c4..e0a3794513 100644
--- a/target/microblaze/cpu-param.h
+++ b/target/microblaze/cpu-param.h
@@ -29,7 +29,4 @@
 
 #define TARGET_INSN_START_EXTRA_WORDS 1
 
-/* MicroBlaze is always in-order. */
-#define TCG_GUEST_DEFAULT_MO  TCG_MO_ALL
-
 #endif
diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
index e46863574c..4efba0dddb 100644
--- a/target/microblaze/cpu.c
+++ b/target/microblaze/cpu.c
@@ -427,7 +427,8 @@ static const struct SysemuCPUOps mb_sysemu_ops = {
 #include "accel/tcg/cpu-ops.h"
 
 static const TCGCPUOps mb_tcg_ops = {
-    .guest_default_memory_order = TCG_GUEST_DEFAULT_MO,
+    /* MicroBlaze is always in-order. */
+    .guest_default_memory_order = TCG_MO_ALL,
 
     .initialize = mb_tcg_init,
     .translate_code = mb_translate_code,
diff --git a/target/mips/cpu-param.h b/target/mips/cpu-param.h
index 99ca8d1684..58f450827f 100644
--- a/target/mips/cpu-param.h
+++ b/target/mips/cpu-param.h
@@ -22,6 +22,4 @@
 
 #define TARGET_INSN_START_EXTRA_WORDS 2
 
-#define TCG_GUEST_DEFAULT_MO (0)
-
 #endif
diff --git a/target/mips/cpu.c b/target/mips/cpu.c
index 67a8550cc1..2ae7ba4407 100644
--- a/target/mips/cpu.c
+++ b/target/mips/cpu.c
@@ -551,7 +551,7 @@ static int mips_cpu_mmu_index(CPUState *cs, bool ifunc)
 }
 
 static const TCGCPUOps mips_tcg_ops = {
-    .guest_default_memory_order = TCG_GUEST_DEFAULT_MO,
+    .guest_default_memory_order = 0,
 
     .initialize = mips_tcg_init,
     .translate_code = mips_translate_code,
diff --git a/target/openrisc/cpu-param.h b/target/openrisc/cpu-param.h
index 7ea0ecb55a..b4f57bbe69 100644
--- a/target/openrisc/cpu-param.h
+++ b/target/openrisc/cpu-param.h
@@ -14,6 +14,4 @@
 
 #define TARGET_INSN_START_EXTRA_WORDS 1
 
-#define TCG_GUEST_DEFAULT_MO (0)
-
 #endif
diff --git a/target/openrisc/cpu.c b/target/openrisc/cpu.c
index e62c698a40..87fe779042 100644
--- a/target/openrisc/cpu.c
+++ b/target/openrisc/cpu.c
@@ -243,7 +243,7 @@ static const struct SysemuCPUOps openrisc_sysemu_ops = {
 #include "accel/tcg/cpu-ops.h"
 
 static const TCGCPUOps openrisc_tcg_ops = {
-    .guest_default_memory_order = TCG_GUEST_DEFAULT_MO,
+    .guest_default_memory_order = 0,
 
     .initialize = openrisc_translate_init,
     .translate_code = openrisc_translate_code,
diff --git a/target/ppc/cpu-param.h b/target/ppc/cpu-param.h
index d0651d2ac8..e4ed9080ee 100644
--- a/target/ppc/cpu-param.h
+++ b/target/ppc/cpu-param.h
@@ -39,6 +39,4 @@
 
 #define TARGET_INSN_START_EXTRA_WORDS 0
 
-#define TCG_GUEST_DEFAULT_MO 0
-
 #endif
diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
index 1cf18e0dae..9ba775971a 100644
--- a/target/ppc/cpu_init.c
+++ b/target/ppc/cpu_init.c
@@ -7479,7 +7479,7 @@ static const struct SysemuCPUOps ppc_sysemu_ops = {
 #include "accel/tcg/cpu-ops.h"
 
 static const TCGCPUOps ppc_tcg_ops = {
-  .guest_default_memory_order = TCG_GUEST_DEFAULT_MO,
+  .guest_default_memory_order = 0,
   .initialize = ppc_translate_init,
   .translate_code = ppc_translate_code,
   .restore_state_to_opc = ppc_restore_state_to_opc,
diff --git a/target/riscv/cpu-param.h b/target/riscv/cpu-param.h
index ff4ba81965..cfdc67c258 100644
--- a/target/riscv/cpu-param.h
+++ b/target/riscv/cpu-param.h
@@ -34,6 +34,4 @@
  *  - M mode HLV/HLVX/HSV 0b111
  */
 
-#define TCG_GUEST_DEFAULT_MO 0
-
 #endif
diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index ded2d68ad7..50e81b2e52 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -140,7 +140,7 @@ static void riscv_restore_state_to_opc(CPUState *cs,
 }
 
 static const TCGCPUOps riscv_tcg_ops = {
-    .guest_default_memory_order = TCG_GUEST_DEFAULT_MO,
+    .guest_default_memory_order = 0,
 
     .initialize = riscv_translate_init,
     .translate_code = riscv_translate_code,
diff --git a/target/rx/cpu-param.h b/target/rx/cpu-param.h
index fe39a77ca3..84934f3bca 100644
--- a/target/rx/cpu-param.h
+++ b/target/rx/cpu-param.h
@@ -26,7 +26,4 @@
 
 #define TARGET_INSN_START_EXTRA_WORDS 0
 
-/* MTTCG not yet supported: require strict ordering */
-#define TCG_GUEST_DEFAULT_MO        TCG_MO_ALL
-
 #endif
diff --git a/target/rx/cpu.c b/target/rx/cpu.c
index d7eac551fd..f073fe8fc9 100644
--- a/target/rx/cpu.c
+++ b/target/rx/cpu.c
@@ -204,7 +204,8 @@ static const struct SysemuCPUOps rx_sysemu_ops = {
 #include "accel/tcg/cpu-ops.h"
 
 static const TCGCPUOps rx_tcg_ops = {
-    .guest_default_memory_order = TCG_GUEST_DEFAULT_MO,
+    /* MTTCG not yet supported: require strict ordering */
+    .guest_default_memory_order = TCG_MO_ALL,
 
     .initialize = rx_translate_init,
     .translate_code = rx_translate_code,
diff --git a/target/s390x/cpu-param.h b/target/s390x/cpu-param.h
index a8a4377f4f..abfae3bedf 100644
--- a/target/s390x/cpu-param.h
+++ b/target/s390x/cpu-param.h
@@ -14,10 +14,4 @@
 
 #define TARGET_INSN_START_EXTRA_WORDS 2
 
-/*
- * The z/Architecture has a strong memory model with some
- * store-after-load re-ordering.
- */
-#define TCG_GUEST_DEFAULT_MO      (TCG_MO_ALL & ~TCG_MO_ST_LD)
-
 #endif
diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
index f232d82fa3..1e101b5afe 100644
--- a/target/s390x/cpu.c
+++ b/target/s390x/cpu.c
@@ -345,7 +345,11 @@ void cpu_get_tb_cpu_state(CPUS390XState *env, vaddr *pc,
 }
 
 static const TCGCPUOps s390_tcg_ops = {
-    .guest_default_memory_order = TCG_GUEST_DEFAULT_MO,
+    /*
+     * The z/Architecture has a strong memory model with some
+     * store-after-load re-ordering.
+     */
+    .guest_default_memory_order = TCG_MO_ALL & ~TCG_MO_ST_LD,
 
     .initialize = s390x_translate_init,
     .translate_code = s390x_translate_code,
diff --git a/target/sh4/cpu-param.h b/target/sh4/cpu-param.h
index acdf239749..f328715ee8 100644
--- a/target/sh4/cpu-param.h
+++ b/target/sh4/cpu-param.h
@@ -18,7 +18,4 @@
 
 #define TARGET_INSN_START_EXTRA_WORDS 1
 
-/* MTTCG not yet supported: require strict ordering */
-#define TCG_GUEST_DEFAULT_MO        TCG_MO_ALL
-
 #endif
diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
index 29f4be7ba9..7a05301c6f 100644
--- a/target/sh4/cpu.c
+++ b/target/sh4/cpu.c
@@ -262,7 +262,8 @@ static const struct SysemuCPUOps sh4_sysemu_ops = {
 #include "accel/tcg/cpu-ops.h"
 
 static const TCGCPUOps superh_tcg_ops = {
-    .guest_default_memory_order = TCG_GUEST_DEFAULT_MO,
+    /* MTTCG not yet supported: require strict ordering */
+    .guest_default_memory_order = TCG_MO_ALL,
 
     .initialize = sh4_translate_init,
     .translate_code = sh4_translate_code,
diff --git a/target/sparc/cpu-param.h b/target/sparc/cpu-param.h
index 62d47b804b..45eea9d6ba 100644
--- a/target/sparc/cpu-param.h
+++ b/target/sparc/cpu-param.h
@@ -23,27 +23,4 @@
 
 #define TARGET_INSN_START_EXTRA_WORDS 1
 
-/*
- * From Oracle SPARC Architecture 2015:
- *
- *   Compatibility notes: The PSO memory model described in SPARC V8 and
- *   SPARC V9 compatibility architecture specifications was never implemented
- *   in a SPARC V9 implementation and is not included in the Oracle SPARC
- *   Architecture specification.
- *
- *   The RMO memory model described in the SPARC V9 specification was
- *   implemented in some non-Sun SPARC V9 implementations, but is not
- *   directly supported in Oracle SPARC Architecture 2015 implementations.
- *
- * Therefore always use TSO in QEMU.
- *
- * D.5 Specification of Partial Store Order (PSO)
- *   ... [loads] are followed by an implied MEMBAR #LoadLoad | #LoadStore.
- *
- * D.6 Specification of Total Store Order (TSO)
- *   ... PSO with the additional requirement that all [stores] are followed
- *   by an implied MEMBAR #StoreStore.
- */
-#define TCG_GUEST_DEFAULT_MO  (TCG_MO_LD_LD | TCG_MO_LD_ST | TCG_MO_ST_ST)
-
 #endif
diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
index ef04efcb18..56d9417ae3 100644
--- a/target/sparc/cpu.c
+++ b/target/sparc/cpu.c
@@ -1001,7 +1001,28 @@ static const struct SysemuCPUOps sparc_sysemu_ops = {
 #include "accel/tcg/cpu-ops.h"
 
 static const TCGCPUOps sparc_tcg_ops = {
-    .guest_default_memory_order = TCG_GUEST_DEFAULT_MO,
+    /*
+     * From Oracle SPARC Architecture 2015:
+     *
+     *   Compatibility notes: The PSO memory model described in SPARC V8 and
+     *   SPARC V9 compatibility architecture specifications was never
+     *   implemented in a SPARC V9 implementation and is not included in the
+     *   Oracle SPARC Architecture specification.
+     *
+     *   The RMO memory model described in the SPARC V9 specification was
+     *   implemented in some non-Sun SPARC V9 implementations, but is not
+     *   directly supported in Oracle SPARC Architecture 2015 implementations.
+     *
+     * Therefore always use TSO in QEMU.
+     *
+     * D.5 Specification of Partial Store Order (PSO)
+     *   ... [loads] are followed by an implied MEMBAR #LoadLoad | #LoadStore.
+     *
+     * D.6 Specification of Total Store Order (TSO)
+     *   ... PSO with the additional requirement that all [stores] are followed
+     *   by an implied MEMBAR #StoreStore.
+     */
+    .guest_default_memory_order = TCG_MO_LD_LD | TCG_MO_LD_ST | TCG_MO_ST_ST,
 
     .initialize = sparc_tcg_init,
     .translate_code = sparc_translate_code,
diff --git a/target/tricore/cpu-param.h b/target/tricore/cpu-param.h
index 45fde756b6..eb33a67c41 100644
--- a/target/tricore/cpu-param.h
+++ b/target/tricore/cpu-param.h
@@ -14,7 +14,4 @@
 
 #define TARGET_INSN_START_EXTRA_WORDS 0
 
-/* MTTCG not yet supported: require strict ordering */
-#define TCG_GUEST_DEFAULT_MO        TCG_MO_ALL
-
 #endif
diff --git a/target/tricore/cpu.c b/target/tricore/cpu.c
index 3bf399335a..c68954b409 100644
--- a/target/tricore/cpu.c
+++ b/target/tricore/cpu.c
@@ -172,7 +172,8 @@ static const struct SysemuCPUOps tricore_sysemu_ops = {
 #include "accel/tcg/cpu-ops.h"
 
 static const TCGCPUOps tricore_tcg_ops = {
-    .guest_default_memory_order = TCG_GUEST_DEFAULT_MO,
+    /* MTTCG not yet supported: require strict ordering */
+    .guest_default_memory_order = TCG_MO_ALL,
     .initialize = tricore_tcg_init,
     .translate_code = tricore_translate_code,
     .synchronize_from_tb = tricore_cpu_synchronize_from_tb,
diff --git a/target/xtensa/cpu-param.h b/target/xtensa/cpu-param.h
index e7cb747aaa..7a0c22c900 100644
--- a/target/xtensa/cpu-param.h
+++ b/target/xtensa/cpu-param.h
@@ -18,7 +18,4 @@
 
 #define TARGET_INSN_START_EXTRA_WORDS 0
 
-/* Xtensa processors have a weak memory model */
-#define TCG_GUEST_DEFAULT_MO      (0)
-
 #endif
diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
index 2347106495..2cbf4e3010 100644
--- a/target/xtensa/cpu.c
+++ b/target/xtensa/cpu.c
@@ -232,7 +232,8 @@ static const struct SysemuCPUOps xtensa_sysemu_ops = {
 #include "accel/tcg/cpu-ops.h"
 
 static const TCGCPUOps xtensa_tcg_ops = {
-    .guest_default_memory_order = TCG_GUEST_DEFAULT_MO,
+    /* Xtensa processors have a weak memory model */
+    .guest_default_memory_order = 0,
 
     .initialize = xtensa_translate_init,
     .translate_code = xtensa_translate_code,

From 9638cb59ee3d3a505f4bb6b9a4bcc49c3df4edcc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Sun, 23 Mar 2025 18:45:29 +0100
Subject: [PATCH 0219/2760] tcg: Move cpu_req_mo() macro to target-agnostic
 'backend-ldst.h'
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/backend-ldst.h    | 41 +++++++++++++++++++++++++++++++++++++
 accel/tcg/cputlb.c          |  1 +
 accel/tcg/internal-target.h | 28 -------------------------
 accel/tcg/user-exec.c       |  1 +
 4 files changed, 43 insertions(+), 28 deletions(-)
 create mode 100644 accel/tcg/backend-ldst.h

diff --git a/accel/tcg/backend-ldst.h b/accel/tcg/backend-ldst.h
new file mode 100644
index 0000000000..9c3a407a5a
--- /dev/null
+++ b/accel/tcg/backend-ldst.h
@@ -0,0 +1,41 @@
+/*
+ * Internal memory barrier helpers for QEMU (target agnostic)
+ *
+ *  Copyright (c) 2003 Fabrice Bellard
+ *
+ * SPDX-License-Identifier: LGPL-2.1-or-later
+ */
+
+#ifndef ACCEL_TCG_BACKEND_LDST_H
+#define ACCEL_TCG_BACKEND_LDST_H
+
+#include "tcg-target-mo.h"
+
+/**
+ * tcg_req_mo:
+ * @guest_mo: Guest default memory order
+ * @type: TCGBar
+ *
+ * Filter @type to the barrier that is required for the guest
+ * memory ordering vs the host memory ordering.  A non-zero
+ * result indicates that some barrier is required.
+ */
+#define tcg_req_mo(guest_mo, type) \
+    ((type) & guest_mo & ~TCG_TARGET_DEFAULT_MO)
+
+/**
+ * cpu_req_mo:
+ * @cpu: CPUState
+ * @type: TCGBar
+ *
+ * If tcg_req_mo indicates a barrier for @type is required
+ * for the guest memory model, issue a host memory barrier.
+ */
+#define cpu_req_mo(cpu, type)     \
+    do {                          \
+        if (tcg_req_mo(cpu->cc->tcg_ops->guest_default_memory_order, type)) { \
+            smp_mb();             \
+        }                         \
+    } while (0)
+
+#endif
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index 35b1ff03a5..d9fb68d719 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -48,6 +48,7 @@
 #include "qemu/plugin-memory.h"
 #endif
 #include "tcg/tcg-ldst.h"
+#include "backend-ldst.h"
 
 
 /* DEBUG defines, enable DEBUG_TLB_LOG to log to the CPU_LOG_MMU target */
diff --git a/accel/tcg/internal-target.h b/accel/tcg/internal-target.h
index f5a3fd7e40..9a9cef3140 100644
--- a/accel/tcg/internal-target.h
+++ b/accel/tcg/internal-target.h
@@ -13,7 +13,6 @@
 #include "exec/exec-all.h"
 #include "exec/translation-block.h"
 #include "tb-internal.h"
-#include "tcg-target-mo.h"
 #include "exec/mmap-lock.h"
 
 /*
@@ -44,31 +43,4 @@ void page_table_config_init(void);
 G_NORETURN void cpu_io_recompile(CPUState *cpu, uintptr_t retaddr);
 #endif /* CONFIG_USER_ONLY */
 
-/**
- * tcg_req_mo:
- * @guest_mo: Guest default memory order
- * @type: TCGBar
- *
- * Filter @type to the barrier that is required for the guest
- * memory ordering vs the host memory ordering.  A non-zero
- * result indicates that some barrier is required.
- */
-#define tcg_req_mo(guest_mo, type) \
-    ((type) & guest_mo & ~TCG_TARGET_DEFAULT_MO)
-
-/**
- * cpu_req_mo:
- * @cpu: CPUState
- * @type: TCGBar
- *
- * If tcg_req_mo indicates a barrier for @type is required
- * for the guest memory model, issue a host memory barrier.
- */
-#define cpu_req_mo(cpu, type)     \
-    do {                          \
-        if (tcg_req_mo(cpu->cc->tcg_ops->guest_default_memory_order, type)) { \
-            smp_mb();             \
-        }                         \
-    } while (0)
-
 #endif /* ACCEL_TCG_INTERNAL_H */
diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index 3f4d682446..5eef8e7f18 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -37,6 +37,7 @@
 #include "qemu/int128.h"
 #include "trace.h"
 #include "tcg/tcg-ldst.h"
+#include "backend-ldst.h"
 #include "internal-common.h"
 #include "internal-target.h"
 #include "tb-internal.h"

From a9d107fa0eacf6c999c042b276e54a7058ae0bf9 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Apr 2025 16:30:57 -0700
Subject: [PATCH 0220/2760] tcg: Pass max_threads not max_cpus to tcg_init
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In effect, hoist the check for mttcg from tcg_n_regions()
to tcg_init_machine().

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/tcg-all.c   | 14 ++++++++------
 include/tcg/startup.h |  6 +++---
 tcg/region.c          | 27 ++++++++++++---------------
 tcg/tcg-internal.h    |  2 +-
 tcg/tcg.c             | 14 +++++++-------
 5 files changed, 31 insertions(+), 32 deletions(-)

diff --git a/accel/tcg/tcg-all.c b/accel/tcg/tcg-all.c
index a5a1fd6a11..3efc7350eb 100644
--- a/accel/tcg/tcg-all.c
+++ b/accel/tcg/tcg-all.c
@@ -103,18 +103,20 @@ bool one_insn_per_tb;
 static int tcg_init_machine(MachineState *ms)
 {
     TCGState *s = TCG_STATE(current_accel());
-#ifdef CONFIG_USER_ONLY
-    unsigned max_cpus = 1;
-#else
-    unsigned max_cpus = ms->smp.max_cpus;
-#endif
+    unsigned max_threads = 1;
 
     tcg_allowed = true;
     mttcg_enabled = s->mttcg_enabled;
 
     page_init();
     tb_htable_init();
-    tcg_init(s->tb_size * MiB, s->splitwx_enabled, max_cpus);
+
+#ifndef CONFIG_USER_ONLY
+    if (mttcg_enabled) {
+        max_threads = ms->smp.max_cpus;
+    }
+#endif
+    tcg_init(s->tb_size * MiB, s->splitwx_enabled, max_threads);
 
 #if defined(CONFIG_SOFTMMU)
     /*
diff --git a/include/tcg/startup.h b/include/tcg/startup.h
index f71305765c..95f574af2b 100644
--- a/include/tcg/startup.h
+++ b/include/tcg/startup.h
@@ -29,12 +29,12 @@
  * tcg_init: Initialize the TCG runtime
  * @tb_size: translation buffer size
  * @splitwx: use separate rw and rx mappings
- * @max_cpus: number of vcpus in system mode
+ * @max_threads: number of vcpu threads in system mode
  *
  * Allocate and initialize TCG resources, especially the JIT buffer.
- * In user-only mode, @max_cpus is unused.
+ * In user-only mode, @max_threads is unused.
  */
-void tcg_init(size_t tb_size, int splitwx, unsigned max_cpus);
+void tcg_init(size_t tb_size, int splitwx, unsigned max_threads);
 
 /**
  * tcg_register_thread: Register this thread with the TCG runtime
diff --git a/tcg/region.c b/tcg/region.c
index 478ec051c4..7ea0b37a84 100644
--- a/tcg/region.c
+++ b/tcg/region.c
@@ -422,7 +422,7 @@ void tcg_region_reset_all(void)
     tcg_region_tree_reset_all();
 }
 
-static size_t tcg_n_regions(size_t tb_size, unsigned max_cpus)
+static size_t tcg_n_regions(size_t tb_size, unsigned max_threads)
 {
 #ifdef CONFIG_USER_ONLY
     return 1;
@@ -431,24 +431,25 @@ static size_t tcg_n_regions(size_t tb_size, unsigned max_cpus)
 
     /*
      * It is likely that some vCPUs will translate more code than others,
-     * so we first try to set more regions than max_cpus, with those regions
+     * so we first try to set more regions than threads, with those regions
      * being of reasonable size. If that's not possible we make do by evenly
      * dividing the code_gen_buffer among the vCPUs.
+     *
+     * Use a single region if all we have is one vCPU thread.
      */
-    /* Use a single region if all we have is one vCPU thread */
-    if (max_cpus == 1 || !qemu_tcg_mttcg_enabled()) {
+    if (max_threads == 1) {
         return 1;
     }
 
     /*
-     * Try to have more regions than max_cpus, with each region being >= 2 MB.
+     * Try to have more regions than threads, with each region being >= 2 MB.
      * If we can't, then just allocate one region per vCPU thread.
      */
     n_regions = tb_size / (2 * MiB);
-    if (n_regions <= max_cpus) {
-        return max_cpus;
+    if (n_regions <= max_threads) {
+        return max_threads;
     }
-    return MIN(n_regions, max_cpus * 8);
+    return MIN(n_regions, max_threads * 8);
 #endif
 }
 
@@ -731,11 +732,7 @@ static int alloc_code_gen_buffer(size_t size, int splitwx, Error **errp)
  * and then assigning regions to TCG threads so that the threads can translate
  * code in parallel without synchronization.
  *
- * In system-mode the number of TCG threads is bounded by max_cpus, so we use at
- * least max_cpus regions in MTTCG. In !MTTCG we use a single region.
- * Note that the TCG options from the command-line (i.e. -accel accel=tcg,[...])
- * must have been parsed before calling this function, since it calls
- * qemu_tcg_mttcg_enabled().
+ * In system-mode the number of TCG threads is bounded by max_threads,
  *
  * In user-mode we use a single region.  Having multiple regions in user-mode
  * is not supported, because the number of vCPU threads (recall that each thread
@@ -749,7 +746,7 @@ static int alloc_code_gen_buffer(size_t size, int splitwx, Error **errp)
  * in practice. Multi-threaded guests share most if not all of their translated
  * code, which makes parallel code generation less appealing than in system-mode
  */
-void tcg_region_init(size_t tb_size, int splitwx, unsigned max_cpus)
+void tcg_region_init(size_t tb_size, int splitwx, unsigned max_threads)
 {
     const size_t page_size = qemu_real_host_page_size();
     size_t region_size;
@@ -787,7 +784,7 @@ void tcg_region_init(size_t tb_size, int splitwx, unsigned max_cpus)
      * As a result of this we might end up with a few extra pages at the end of
      * the buffer; we will assign those to the last region.
      */
-    region.n = tcg_n_regions(tb_size, max_cpus);
+    region.n = tcg_n_regions(tb_size, max_threads);
     region_size = tb_size / region.n;
     region_size = QEMU_ALIGN_DOWN(region_size, page_size);
 
diff --git a/tcg/tcg-internal.h b/tcg/tcg-internal.h
index a648ee7a0e..ff85fb23fa 100644
--- a/tcg/tcg-internal.h
+++ b/tcg/tcg-internal.h
@@ -34,7 +34,7 @@ extern TCGContext **tcg_ctxs;
 extern unsigned int tcg_cur_ctxs;
 extern unsigned int tcg_max_ctxs;
 
-void tcg_region_init(size_t tb_size, int splitwx, unsigned max_cpus);
+void tcg_region_init(size_t tb_size, int splitwx, unsigned max_threads);
 bool tcg_region_alloc(TCGContext *s);
 void tcg_region_initial_alloc(TCGContext *s);
 void tcg_region_prologue_set(TCGContext *s);
diff --git a/tcg/tcg.c b/tcg/tcg.c
index dfd48b8264..ec7f6743d7 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1499,7 +1499,7 @@ static void process_constraint_sets(void);
 static TCGTemp *tcg_global_reg_new_internal(TCGContext *s, TCGType type,
                                             TCGReg reg, const char *name);
 
-static void tcg_context_init(unsigned max_cpus)
+static void tcg_context_init(unsigned max_threads)
 {
     TCGContext *s = &tcg_init_ctx;
     int n, i;
@@ -1538,15 +1538,15 @@ static void tcg_context_init(unsigned max_cpus)
      * In user-mode we simply share the init context among threads, since we
      * use a single region. See the documentation tcg_region_init() for the
      * reasoning behind this.
-     * In system-mode we will have at most max_cpus TCG threads.
+     * In system-mode we will have at most max_threads TCG threads.
      */
 #ifdef CONFIG_USER_ONLY
     tcg_ctxs = &tcg_ctx;
     tcg_cur_ctxs = 1;
     tcg_max_ctxs = 1;
 #else
-    tcg_max_ctxs = max_cpus;
-    tcg_ctxs = g_new0(TCGContext *, max_cpus);
+    tcg_max_ctxs = max_threads;
+    tcg_ctxs = g_new0(TCGContext *, max_threads);
 #endif
 
     tcg_debug_assert(!tcg_regset_test_reg(s->reserved_regs, TCG_AREG0));
@@ -1554,10 +1554,10 @@ static void tcg_context_init(unsigned max_cpus)
     tcg_env = temp_tcgv_ptr(ts);
 }
 
-void tcg_init(size_t tb_size, int splitwx, unsigned max_cpus)
+void tcg_init(size_t tb_size, int splitwx, unsigned max_threads)
 {
-    tcg_context_init(max_cpus);
-    tcg_region_init(tb_size, splitwx, max_cpus);
+    tcg_context_init(max_threads);
+    tcg_region_init(tb_size, splitwx, max_threads);
 }
 
 /*

From 60b2c2e66b81c323c0bc70ea4233cdbf8cdae5b2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 4 Apr 2025 00:04:16 +0200
Subject: [PATCH 0221/2760] tcg: Move qemu_tcg_mttcg_enabled() to
 'system/tcg.h'
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

qemu_tcg_mttcg_enabled() is specific to 1/ TCG and
2/ system emulation. Move the prototype declaration
to "system/tcg.h", reducing 'mttcg_enabled' variable
scope.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250403220420.78937-17-philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/tcg-all.c        | 17 ++++++++++++++---
 include/hw/core/cpu.h      |  9 ---------
 include/system/tcg.h       |  8 ++++++++
 target/riscv/tcg/tcg-cpu.c |  1 +
 4 files changed, 23 insertions(+), 12 deletions(-)

diff --git a/accel/tcg/tcg-all.c b/accel/tcg/tcg-all.c
index 3efc7350eb..bb759cec07 100644
--- a/accel/tcg/tcg-all.c
+++ b/accel/tcg/tcg-all.c
@@ -38,6 +38,7 @@
 #include "hw/qdev-core.h"
 #else
 #include "hw/boards.h"
+#include "system/tcg.h"
 #endif
 #include "internal-common.h"
 #include "cpu-param.h"
@@ -58,6 +59,17 @@ typedef struct TCGState TCGState;
 DECLARE_INSTANCE_CHECKER(TCGState, TCG_STATE,
                          TYPE_TCG_ACCEL)
 
+#ifndef CONFIG_USER_ONLY
+
+static bool mttcg_enabled;
+
+bool qemu_tcg_mttcg_enabled(void)
+{
+    return mttcg_enabled;
+}
+
+#endif /* !CONFIG_USER_ONLY */
+
 /*
  * We default to false if we know other options have been enabled
  * which are currently incompatible with MTTCG. Otherwise when each
@@ -97,7 +109,6 @@ static void tcg_accel_instance_init(Object *obj)
 #endif
 }
 
-bool mttcg_enabled;
 bool one_insn_per_tb;
 
 static int tcg_init_machine(MachineState *ms)
@@ -106,14 +117,14 @@ static int tcg_init_machine(MachineState *ms)
     unsigned max_threads = 1;
 
     tcg_allowed = true;
-    mttcg_enabled = s->mttcg_enabled;
 
     page_init();
     tb_htable_init();
 
 #ifndef CONFIG_USER_ONLY
-    if (mttcg_enabled) {
+    if (s->mttcg_enabled) {
         max_threads = ms->smp.max_cpus;
+        mttcg_enabled = true;
     }
 #endif
     tcg_init(s->tb_size * MiB, s->splitwx_enabled, max_threads);
diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index 10b6b25b34..c8d6abff19 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -594,15 +594,6 @@ extern CPUTailQ cpus_queue;
 
 extern __thread CPUState *current_cpu;
 
-/**
- * qemu_tcg_mttcg_enabled:
- * Check whether we are running MultiThread TCG or not.
- *
- * Returns: %true if we are in MTTCG mode %false otherwise.
- */
-extern bool mttcg_enabled;
-#define qemu_tcg_mttcg_enabled() (mttcg_enabled)
-
 /**
  * cpu_paging_enabled:
  * @cpu: The CPU whose state is to be inspected.
diff --git a/include/system/tcg.h b/include/system/tcg.h
index 73229648c6..7622dcea30 100644
--- a/include/system/tcg.h
+++ b/include/system/tcg.h
@@ -17,4 +17,12 @@ extern bool tcg_allowed;
 #define tcg_enabled() 0
 #endif
 
+/**
+ * qemu_tcg_mttcg_enabled:
+ * Check whether we are running MultiThread TCG or not.
+ *
+ * Returns: %true if we are in MTTCG mode %false otherwise.
+ */
+bool qemu_tcg_mttcg_enabled(void);
+
 #endif
diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index 50e81b2e52..88f7cdb887 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -36,6 +36,7 @@
 #include "tcg/tcg.h"
 #ifndef CONFIG_USER_ONLY
 #include "hw/boards.h"
+#include "system/tcg.h"
 #endif
 
 /* Hash that stores user set extensions */

From 61fc4c2bfaee8f4da75ce217911f103da7a8a69e Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Apr 2025 18:10:53 -0700
Subject: [PATCH 0222/2760] accel/tcg: Remove mttcg_enabled

In qemu_tcg_mttcg_enabled, read the value from TCGState
and eliminate the separate global variable.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/tcg-all.c | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/accel/tcg/tcg-all.c b/accel/tcg/tcg-all.c
index bb759cec07..b754f92905 100644
--- a/accel/tcg/tcg-all.c
+++ b/accel/tcg/tcg-all.c
@@ -60,14 +60,11 @@ DECLARE_INSTANCE_CHECKER(TCGState, TCG_STATE,
                          TYPE_TCG_ACCEL)
 
 #ifndef CONFIG_USER_ONLY
-
-static bool mttcg_enabled;
-
 bool qemu_tcg_mttcg_enabled(void)
 {
-    return mttcg_enabled;
+    TCGState *s = TCG_STATE(current_accel());
+    return s->mttcg_enabled;
 }
-
 #endif /* !CONFIG_USER_ONLY */
 
 /*
@@ -124,7 +121,6 @@ static int tcg_init_machine(MachineState *ms)
 #ifndef CONFIG_USER_ONLY
     if (s->mttcg_enabled) {
         max_threads = ms->smp.max_cpus;
-        mttcg_enabled = true;
     }
 #endif
     tcg_init(s->tb_size * MiB, s->splitwx_enabled, max_threads);

From d1aa577228e6eeda3589c6480d994ee4bd0d23e5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 2 Apr 2025 16:48:24 +0200
Subject: [PATCH 0223/2760] tcg: Convert TCGState::mttcg_enabled to TriState
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Use the OnOffAuto type as 3-state.

Since the TCGState instance is zero-initialized, the
mttcg_enabled is initialzed as AUTO (ON_OFF_AUTO_AUTO).

In tcg_init_machine(), if mttcg_enabled is still AUTO,
set a default value (effectively inlining the
default_mttcg_enabled() method content).

In the tcg_get_thread() getter, consider AUTO / OFF states
as "single", otherwise ON is "multi".

Reviewed-by: Anton Johansson <anjo@rev.ng>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/tcg-all.c | 74 ++++++++++++++++++++++-----------------------
 1 file changed, 36 insertions(+), 38 deletions(-)

diff --git a/accel/tcg/tcg-all.c b/accel/tcg/tcg-all.c
index b754f92905..fa77a4c5a2 100644
--- a/accel/tcg/tcg-all.c
+++ b/accel/tcg/tcg-all.c
@@ -32,6 +32,7 @@
 #include "qemu/error-report.h"
 #include "qemu/accel.h"
 #include "qemu/atomic.h"
+#include "qapi/qapi-types-common.h"
 #include "qapi/qapi-builtin-visit.h"
 #include "qemu/units.h"
 #if defined(CONFIG_USER_ONLY)
@@ -47,7 +48,7 @@
 struct TCGState {
     AccelState parent_obj;
 
-    bool mttcg_enabled;
+    OnOffAuto mttcg_enabled;
     bool one_insn_per_tb;
     int splitwx_enabled;
     unsigned long tb_size;
@@ -63,41 +64,14 @@ DECLARE_INSTANCE_CHECKER(TCGState, TCG_STATE,
 bool qemu_tcg_mttcg_enabled(void)
 {
     TCGState *s = TCG_STATE(current_accel());
-    return s->mttcg_enabled;
+    return s->mttcg_enabled == ON_OFF_AUTO_ON;
 }
 #endif /* !CONFIG_USER_ONLY */
 
-/*
- * We default to false if we know other options have been enabled
- * which are currently incompatible with MTTCG. Otherwise when each
- * guest (target) has been updated to support:
- *   - atomic instructions
- *   - memory ordering primitives (barriers)
- * they can set the appropriate CONFIG flags in ${target}-softmmu.mak
- *
- * Once a guest architecture has been converted to the new primitives
- * there is one remaining limitation to check:
- *   - The guest can't be oversized (e.g. 64 bit guest on 32 bit host)
- */
-
-static bool default_mttcg_enabled(void)
-{
-    if (icount_enabled()) {
-        return false;
-    }
-#ifdef TARGET_SUPPORTS_MTTCG
-    return true;
-#else
-    return false;
-#endif
-}
-
 static void tcg_accel_instance_init(Object *obj)
 {
     TCGState *s = TCG_STATE(obj);
 
-    s->mttcg_enabled = default_mttcg_enabled();
-
     /* If debugging enabled, default "auto on", otherwise off. */
 #if defined(CONFIG_DEBUG_TCG) && !defined(CONFIG_USER_ONLY)
     s->splitwx_enabled = -1;
@@ -113,16 +87,40 @@ static int tcg_init_machine(MachineState *ms)
     TCGState *s = TCG_STATE(current_accel());
     unsigned max_threads = 1;
 
+#ifndef CONFIG_USER_ONLY
+# ifdef TARGET_SUPPORTS_MTTCG
+    bool mttcg_supported = true;
+# else
+    bool mttcg_supported = false;
+# endif
+    if (s->mttcg_enabled == ON_OFF_AUTO_AUTO) {
+        /*
+         * We default to false if we know other options have been enabled
+         * which are currently incompatible with MTTCG. Otherwise when each
+         * guest (target) has been updated to support:
+         *   - atomic instructions
+         *   - memory ordering primitives (barriers)
+         * they can set the appropriate CONFIG flags in ${target}-softmmu.mak
+         *
+         * Once a guest architecture has been converted to the new primitives
+         * there is one remaining limitation to check:
+         *   - The guest can't be oversized (e.g. 64 bit guest on 32 bit host)
+         */
+        if (mttcg_supported && !icount_enabled()) {
+            s->mttcg_enabled = ON_OFF_AUTO_ON;
+        } else {
+            s->mttcg_enabled = ON_OFF_AUTO_OFF;
+        }
+    }
+    if (s->mttcg_enabled == ON_OFF_AUTO_ON) {
+        max_threads = ms->smp.max_cpus;
+    }
+#endif
+
     tcg_allowed = true;
 
     page_init();
     tb_htable_init();
-
-#ifndef CONFIG_USER_ONLY
-    if (s->mttcg_enabled) {
-        max_threads = ms->smp.max_cpus;
-    }
-#endif
     tcg_init(s->tb_size * MiB, s->splitwx_enabled, max_threads);
 
 #if defined(CONFIG_SOFTMMU)
@@ -144,7 +142,7 @@ static char *tcg_get_thread(Object *obj, Error **errp)
 {
     TCGState *s = TCG_STATE(obj);
 
-    return g_strdup(s->mttcg_enabled ? "multi" : "single");
+    return g_strdup(s->mttcg_enabled == ON_OFF_AUTO_ON ? "multi" : "single");
 }
 
 static void tcg_set_thread(Object *obj, const char *value, Error **errp)
@@ -159,10 +157,10 @@ static void tcg_set_thread(Object *obj, const char *value, Error **errp)
             warn_report("Guest not yet converted to MTTCG - "
                         "you may get unexpected results");
 #endif
-            s->mttcg_enabled = true;
+            s->mttcg_enabled = ON_OFF_AUTO_ON;
         }
     } else if (strcmp(value, "single") == 0) {
-        s->mttcg_enabled = false;
+        s->mttcg_enabled = ON_OFF_AUTO_OFF;
     } else {
         error_setg(errp, "Invalid 'thread' setting %s", value);
     }

From 84cde4af081b9fa9c0fc82d3f1a8da406b4ba9e4 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Apr 2025 18:52:36 -0700
Subject: [PATCH 0224/2760] accel/tcg: Move mttcg warning to tcg_init_machine
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Delay the warning to tcg_init_machine, because we will
have resolved the CPUClass at that point.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/tcg-all.c | 21 ++++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

diff --git a/accel/tcg/tcg-all.c b/accel/tcg/tcg-all.c
index fa77a4c5a2..ecdd48847c 100644
--- a/accel/tcg/tcg-all.c
+++ b/accel/tcg/tcg-all.c
@@ -93,7 +93,8 @@ static int tcg_init_machine(MachineState *ms)
 # else
     bool mttcg_supported = false;
 # endif
-    if (s->mttcg_enabled == ON_OFF_AUTO_AUTO) {
+    switch (s->mttcg_enabled) {
+    case ON_OFF_AUTO_AUTO:
         /*
          * We default to false if we know other options have been enabled
          * which are currently incompatible with MTTCG. Otherwise when each
@@ -108,12 +109,22 @@ static int tcg_init_machine(MachineState *ms)
          */
         if (mttcg_supported && !icount_enabled()) {
             s->mttcg_enabled = ON_OFF_AUTO_ON;
+            max_threads = ms->smp.max_cpus;
         } else {
             s->mttcg_enabled = ON_OFF_AUTO_OFF;
         }
-    }
-    if (s->mttcg_enabled == ON_OFF_AUTO_ON) {
+        break;
+    case ON_OFF_AUTO_ON:
+        if (!mttcg_supported) {
+            warn_report("Guest not yet converted to MTTCG - "
+                        "you may get unexpected results");
+        }
         max_threads = ms->smp.max_cpus;
+        break;
+    case ON_OFF_AUTO_OFF:
+        break;
+    default:
+        g_assert_not_reached();
     }
 #endif
 
@@ -153,10 +164,6 @@ static void tcg_set_thread(Object *obj, const char *value, Error **errp)
         if (icount_enabled()) {
             error_setg(errp, "No MTTCG when icount is enabled");
         } else {
-#ifndef TARGET_SUPPORTS_MTTCG
-            warn_report("Guest not yet converted to MTTCG - "
-                        "you may get unexpected results");
-#endif
             s->mttcg_enabled = ON_OFF_AUTO_ON;
         }
     } else if (strcmp(value, "single") == 0) {

From f50d0f335a6e48ac757cb7e534542822a8db8211 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Sat, 5 Apr 2025 18:13:05 +0200
Subject: [PATCH 0225/2760] target/riscv: Remove AccelCPUClass::cpu_class_init
 need
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Expose riscv_tcg_ops symbol, then directly set it as
CPUClass::tcg_ops in TYPE_RISCV_CPU's class_init(),
using CONFIG_TCG #ifdef'ry. No need for the
AccelCPUClass::cpu_class_init() handler anymore.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250405161320.76854-2-philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/riscv/cpu.c         |  3 +++
 target/riscv/tcg/tcg-cpu.c | 16 +---------------
 target/riscv/tcg/tcg-cpu.h |  2 ++
 3 files changed, 6 insertions(+), 15 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index ad534cee51..2b830b3317 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -3054,6 +3054,9 @@ static void riscv_cpu_common_class_init(ObjectClass *c, void *data)
     cc->get_arch_id = riscv_get_arch_id;
 #endif
     cc->gdb_arch_name = riscv_gdb_arch_name;
+#ifdef CONFIG_TCG
+    cc->tcg_ops = &riscv_tcg_ops;
+#endif /* CONFIG_TCG */
 
     device_class_set_props(dc, riscv_cpu_properties);
 }
diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index 88f7cdb887..44fdf6c4cf 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -140,7 +140,7 @@ static void riscv_restore_state_to_opc(CPUState *cs,
     env->excp_uw2 = data[2];
 }
 
-static const TCGCPUOps riscv_tcg_ops = {
+const TCGCPUOps riscv_tcg_ops = {
     .guest_default_memory_order = 0,
 
     .initialize = riscv_translate_init,
@@ -1527,24 +1527,10 @@ static void riscv_tcg_cpu_instance_init(CPUState *cs)
     }
 }
 
-static void riscv_tcg_cpu_init_ops(AccelCPUClass *accel_cpu, CPUClass *cc)
-{
-    /*
-     * All cpus use the same set of operations.
-     */
-    cc->tcg_ops = &riscv_tcg_ops;
-}
-
-static void riscv_tcg_cpu_class_init(CPUClass *cc)
-{
-    cc->init_accel_cpu = riscv_tcg_cpu_init_ops;
-}
-
 static void riscv_tcg_cpu_accel_class_init(ObjectClass *oc, void *data)
 {
     AccelCPUClass *acc = ACCEL_CPU_CLASS(oc);
 
-    acc->cpu_class_init = riscv_tcg_cpu_class_init;
     acc->cpu_instance_init = riscv_tcg_cpu_instance_init;
     acc->cpu_target_realize = riscv_tcg_cpu_realize;
 }
diff --git a/target/riscv/tcg/tcg-cpu.h b/target/riscv/tcg/tcg-cpu.h
index ce94253fe4..a23716a5ac 100644
--- a/target/riscv/tcg/tcg-cpu.h
+++ b/target/riscv/tcg/tcg-cpu.h
@@ -26,6 +26,8 @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp);
 void riscv_tcg_cpu_finalize_features(RISCVCPU *cpu, Error **errp);
 bool riscv_cpu_tcg_compatible(RISCVCPU *cpu);
 
+extern const TCGCPUOps riscv_tcg_ops;
+
 struct DisasContext;
 struct RISCVCPUConfig;
 typedef struct RISCVDecoder {

From a522b04bb9cf67789116ad7a6165946d4b214bac Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Sat, 5 Apr 2025 18:13:06 +0200
Subject: [PATCH 0226/2760] target/i386: Remove AccelCPUClass::cpu_class_init
 need
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Expose x86_tcg_ops symbol, then directly set it as
CPUClass::tcg_ops in TYPE_X86_CPU's class_init(),
using CONFIG_TCG #ifdef'ry. No need for the
AccelCPUClass::cpu_class_init() handler anymore.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250405161320.76854-3-philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/i386/cpu.c         |  4 ++++
 target/i386/tcg/tcg-cpu.c | 14 +-------------
 target/i386/tcg/tcg-cpu.h |  4 ++++
 3 files changed, 9 insertions(+), 13 deletions(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 57f62cc869..1f970aa4da 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -43,6 +43,7 @@
 #include "hw/boards.h"
 #include "hw/i386/sgx-epc.h"
 #endif
+#include "tcg/tcg-cpu.h"
 
 #include "disas/capstone.h"
 #include "cpu-internal.h"
@@ -8915,6 +8916,9 @@ static void x86_cpu_common_class_init(ObjectClass *oc, void *data)
 #ifndef CONFIG_USER_ONLY
     cc->sysemu_ops = &i386_sysemu_ops;
 #endif /* !CONFIG_USER_ONLY */
+#ifdef CONFIG_TCG
+    cc->tcg_ops = &x86_tcg_ops;
+#endif /* CONFIG_TCG */
 
     cc->gdb_arch_name = x86_gdb_arch_name;
 #ifdef TARGET_X86_64
diff --git a/target/i386/tcg/tcg-cpu.c b/target/i386/tcg/tcg-cpu.c
index d941df0956..e13d0f6f86 100644
--- a/target/i386/tcg/tcg-cpu.c
+++ b/target/i386/tcg/tcg-cpu.c
@@ -124,7 +124,7 @@ static bool x86_debug_check_breakpoint(CPUState *cs)
 
 #include "accel/tcg/cpu-ops.h"
 
-static const TCGCPUOps x86_tcg_ops = {
+const TCGCPUOps x86_tcg_ops = {
     /*
      * The x86 has a strong memory model with some store-after-load re-ordering
      */
@@ -152,17 +152,6 @@ static const TCGCPUOps x86_tcg_ops = {
 #endif /* !CONFIG_USER_ONLY */
 };
 
-static void x86_tcg_cpu_init_ops(AccelCPUClass *accel_cpu, CPUClass *cc)
-{
-    /* for x86, all cpus use the same set of operations */
-    cc->tcg_ops = &x86_tcg_ops;
-}
-
-static void x86_tcg_cpu_class_init(CPUClass *cc)
-{
-    cc->init_accel_cpu = x86_tcg_cpu_init_ops;
-}
-
 static void x86_tcg_cpu_xsave_init(void)
 {
 #define XO(bit, field) \
@@ -211,7 +200,6 @@ static void x86_tcg_cpu_accel_class_init(ObjectClass *oc, void *data)
     acc->cpu_target_realize = tcg_cpu_realizefn;
 #endif /* CONFIG_USER_ONLY */
 
-    acc->cpu_class_init = x86_tcg_cpu_class_init;
     acc->cpu_instance_init = x86_tcg_cpu_instance_init;
 }
 static const TypeInfo x86_tcg_cpu_accel_type_info = {
diff --git a/target/i386/tcg/tcg-cpu.h b/target/i386/tcg/tcg-cpu.h
index 7580f8afb4..85bcd61678 100644
--- a/target/i386/tcg/tcg-cpu.h
+++ b/target/i386/tcg/tcg-cpu.h
@@ -19,6 +19,8 @@
 #ifndef TCG_CPU_H
 #define TCG_CPU_H
 
+#include "cpu.h"
+
 #define XSAVE_FCW_FSW_OFFSET    0x000
 #define XSAVE_FTW_FOP_OFFSET    0x004
 #define XSAVE_CWD_RIP_OFFSET    0x008
@@ -76,6 +78,8 @@ QEMU_BUILD_BUG_ON(offsetof(X86XSaveArea, zmm_hi256_state) != XSAVE_ZMM_HI256_OFF
 QEMU_BUILD_BUG_ON(offsetof(X86XSaveArea, hi16_zmm_state) != XSAVE_HI16_ZMM_OFFSET);
 QEMU_BUILD_BUG_ON(offsetof(X86XSaveArea, pkru_state) != XSAVE_PKRU_OFFSET);
 
+extern const TCGCPUOps x86_tcg_ops;
+
 bool tcg_cpu_realizefn(CPUState *cs, Error **errp);
 
 int x86_mmu_index_pl(CPUX86State *env, unsigned pl);

From a3d40b5effafdd299d1850f0c9956f60199b5b56 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Sat, 5 Apr 2025 18:13:20 +0200
Subject: [PATCH 0227/2760] tcg: Convert TARGET_SUPPORTS_MTTCG to
 TCGCPUOps::mttcg_supported field
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Instead of having a compile-time TARGET_SUPPORTS_MTTCG definition,
have each target set the 'mttcg_supported' field in the TCGCPUOps
structure.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Anton Johansson <anjo@rev.ng>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250405161320.76854-17-philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/tcg-all.c                      | 11 +++++------
 configs/targets/aarch64-softmmu.mak      |  1 -
 configs/targets/alpha-softmmu.mak        |  1 -
 configs/targets/arm-softmmu.mak          |  1 -
 configs/targets/hppa-softmmu.mak         |  1 -
 configs/targets/i386-softmmu.mak         |  1 -
 configs/targets/loongarch64-softmmu.mak  |  1 -
 configs/targets/microblaze-softmmu.mak   |  1 -
 configs/targets/microblazeel-softmmu.mak |  1 -
 configs/targets/mips-softmmu.mak         |  1 -
 configs/targets/mipsel-softmmu.mak       |  1 -
 configs/targets/or1k-softmmu.mak         |  1 -
 configs/targets/ppc64-softmmu.mak        |  1 -
 configs/targets/riscv32-softmmu.mak      |  1 -
 configs/targets/riscv64-softmmu.mak      |  1 -
 configs/targets/s390x-softmmu.mak        |  1 -
 configs/targets/sparc-softmmu.mak        |  1 -
 configs/targets/sparc64-softmmu.mak      |  1 -
 configs/targets/x86_64-softmmu.mak       |  1 -
 configs/targets/xtensa-softmmu.mak       |  1 -
 configs/targets/xtensaeb-softmmu.mak     |  1 -
 docs/devel/multi-thread-tcg.rst          |  2 +-
 include/accel/tcg/cpu-ops.h              |  8 ++++++++
 include/exec/poison.h                    |  1 -
 target/alpha/cpu.c                       |  1 +
 target/arm/cpu.c                         |  1 +
 target/arm/tcg/cpu-v7m.c                 |  1 +
 target/avr/cpu.c                         |  1 +
 target/hexagon/cpu.c                     |  1 +
 target/hppa/cpu.c                        |  1 +
 target/i386/tcg/tcg-cpu.c                |  1 +
 target/loongarch/cpu.c                   |  1 +
 target/m68k/cpu.c                        |  1 +
 target/microblaze/cpu.c                  |  1 +
 target/mips/cpu.c                        |  1 +
 target/openrisc/cpu.c                    |  1 +
 target/ppc/cpu_init.c                    |  1 +
 target/riscv/tcg/tcg-cpu.c               |  1 +
 target/rx/cpu.c                          |  1 +
 target/s390x/cpu.c                       |  1 +
 target/sh4/cpu.c                         |  1 +
 target/sparc/cpu.c                       |  1 +
 target/tricore/cpu.c                     |  1 +
 target/xtensa/cpu.c                      |  1 +
 44 files changed, 34 insertions(+), 28 deletions(-)

diff --git a/accel/tcg/tcg-all.c b/accel/tcg/tcg-all.c
index ecdd48847c..b0d4e3e136 100644
--- a/accel/tcg/tcg-all.c
+++ b/accel/tcg/tcg-all.c
@@ -41,8 +41,9 @@
 #include "hw/boards.h"
 #include "system/tcg.h"
 #endif
+#include "accel/tcg/cpu-ops.h"
 #include "internal-common.h"
-#include "cpu-param.h"
+#include "cpu.h"
 
 
 struct TCGState {
@@ -88,11 +89,9 @@ static int tcg_init_machine(MachineState *ms)
     unsigned max_threads = 1;
 
 #ifndef CONFIG_USER_ONLY
-# ifdef TARGET_SUPPORTS_MTTCG
-    bool mttcg_supported = true;
-# else
-    bool mttcg_supported = false;
-# endif
+    CPUClass *cc = CPU_CLASS(object_class_by_name(CPU_RESOLVING_TYPE));
+    bool mttcg_supported = cc->tcg_ops->mttcg_supported;
+
     switch (s->mttcg_enabled) {
     case ON_OFF_AUTO_AUTO:
         /*
diff --git a/configs/targets/aarch64-softmmu.mak b/configs/targets/aarch64-softmmu.mak
index 82cb72cb83..5dfeb35af9 100644
--- a/configs/targets/aarch64-softmmu.mak
+++ b/configs/targets/aarch64-softmmu.mak
@@ -1,6 +1,5 @@
 TARGET_ARCH=aarch64
 TARGET_BASE_ARCH=arm
-TARGET_SUPPORTS_MTTCG=y
 TARGET_KVM_HAVE_GUEST_DEBUG=y
 TARGET_XML_FILES= gdb-xml/aarch64-core.xml gdb-xml/aarch64-fpu.xml gdb-xml/arm-core.xml gdb-xml/arm-vfp.xml gdb-xml/arm-vfp3.xml gdb-xml/arm-vfp-sysregs.xml gdb-xml/arm-neon.xml gdb-xml/arm-m-profile.xml gdb-xml/arm-m-profile-mve.xml gdb-xml/aarch64-pauth.xml
 # needed by boot.c
diff --git a/configs/targets/alpha-softmmu.mak b/configs/targets/alpha-softmmu.mak
index 89f3517aca..5275076e50 100644
--- a/configs/targets/alpha-softmmu.mak
+++ b/configs/targets/alpha-softmmu.mak
@@ -1,3 +1,2 @@
 TARGET_ARCH=alpha
-TARGET_SUPPORTS_MTTCG=y
 TARGET_LONG_BITS=64
diff --git a/configs/targets/arm-softmmu.mak b/configs/targets/arm-softmmu.mak
index afc64f5927..6a5a8eda94 100644
--- a/configs/targets/arm-softmmu.mak
+++ b/configs/targets/arm-softmmu.mak
@@ -1,5 +1,4 @@
 TARGET_ARCH=arm
-TARGET_SUPPORTS_MTTCG=y
 TARGET_XML_FILES= gdb-xml/arm-core.xml gdb-xml/arm-vfp.xml gdb-xml/arm-vfp3.xml gdb-xml/arm-vfp-sysregs.xml gdb-xml/arm-neon.xml gdb-xml/arm-m-profile.xml gdb-xml/arm-m-profile-mve.xml
 # needed by boot.c
 TARGET_NEED_FDT=y
diff --git a/configs/targets/hppa-softmmu.mak b/configs/targets/hppa-softmmu.mak
index 63ca74ed5e..ea331107a0 100644
--- a/configs/targets/hppa-softmmu.mak
+++ b/configs/targets/hppa-softmmu.mak
@@ -1,4 +1,3 @@
 TARGET_ARCH=hppa
 TARGET_BIG_ENDIAN=y
-TARGET_SUPPORTS_MTTCG=y
 TARGET_LONG_BITS=64
diff --git a/configs/targets/i386-softmmu.mak b/configs/targets/i386-softmmu.mak
index 5dd8921756..e9d89e8ab4 100644
--- a/configs/targets/i386-softmmu.mak
+++ b/configs/targets/i386-softmmu.mak
@@ -1,5 +1,4 @@
 TARGET_ARCH=i386
-TARGET_SUPPORTS_MTTCG=y
 TARGET_KVM_HAVE_GUEST_DEBUG=y
 TARGET_KVM_HAVE_RESET_PARKED_VCPU=y
 TARGET_XML_FILES= gdb-xml/i386-32bit.xml
diff --git a/configs/targets/loongarch64-softmmu.mak b/configs/targets/loongarch64-softmmu.mak
index 351341132f..fc44c54233 100644
--- a/configs/targets/loongarch64-softmmu.mak
+++ b/configs/targets/loongarch64-softmmu.mak
@@ -1,7 +1,6 @@
 TARGET_ARCH=loongarch64
 TARGET_BASE_ARCH=loongarch
 TARGET_KVM_HAVE_GUEST_DEBUG=y
-TARGET_SUPPORTS_MTTCG=y
 TARGET_XML_FILES= gdb-xml/loongarch-base32.xml gdb-xml/loongarch-base64.xml gdb-xml/loongarch-fpu.xml gdb-xml/loongarch-lsx.xml gdb-xml/loongarch-lasx.xml
 # all boards require libfdt
 TARGET_NEED_FDT=y
diff --git a/configs/targets/microblaze-softmmu.mak b/configs/targets/microblaze-softmmu.mak
index 99a33ed44a..23457d0ae6 100644
--- a/configs/targets/microblaze-softmmu.mak
+++ b/configs/targets/microblaze-softmmu.mak
@@ -1,6 +1,5 @@
 TARGET_ARCH=microblaze
 TARGET_BIG_ENDIAN=y
-TARGET_SUPPORTS_MTTCG=y
 # needed by boot.c
 TARGET_NEED_FDT=y
 TARGET_XML_FILES=gdb-xml/microblaze-core.xml gdb-xml/microblaze-stack-protect.xml
diff --git a/configs/targets/microblazeel-softmmu.mak b/configs/targets/microblazeel-softmmu.mak
index 52cdeae1a2..c82c509623 100644
--- a/configs/targets/microblazeel-softmmu.mak
+++ b/configs/targets/microblazeel-softmmu.mak
@@ -1,5 +1,4 @@
 TARGET_ARCH=microblaze
-TARGET_SUPPORTS_MTTCG=y
 # needed by boot.c
 TARGET_NEED_FDT=y
 TARGET_XML_FILES=gdb-xml/microblaze-core.xml gdb-xml/microblaze-stack-protect.xml
diff --git a/configs/targets/mips-softmmu.mak b/configs/targets/mips-softmmu.mak
index b62a088249..c9588066b8 100644
--- a/configs/targets/mips-softmmu.mak
+++ b/configs/targets/mips-softmmu.mak
@@ -1,4 +1,3 @@
 TARGET_ARCH=mips
 TARGET_BIG_ENDIAN=y
-TARGET_SUPPORTS_MTTCG=y
 TARGET_LONG_BITS=32
diff --git a/configs/targets/mipsel-softmmu.mak b/configs/targets/mipsel-softmmu.mak
index 620ec68178..90e09bdc3e 100644
--- a/configs/targets/mipsel-softmmu.mak
+++ b/configs/targets/mipsel-softmmu.mak
@@ -1,3 +1,2 @@
 TARGET_ARCH=mips
-TARGET_SUPPORTS_MTTCG=y
 TARGET_LONG_BITS=32
diff --git a/configs/targets/or1k-softmmu.mak b/configs/targets/or1k-softmmu.mak
index adfddb1a8a..0e47d9878b 100644
--- a/configs/targets/or1k-softmmu.mak
+++ b/configs/targets/or1k-softmmu.mak
@@ -1,5 +1,4 @@
 TARGET_ARCH=openrisc
-TARGET_SUPPORTS_MTTCG=y
 TARGET_BIG_ENDIAN=y
 # needed by boot.c and all boards
 TARGET_NEED_FDT=y
diff --git a/configs/targets/ppc64-softmmu.mak b/configs/targets/ppc64-softmmu.mak
index 7cee0e97f4..74572864b3 100644
--- a/configs/targets/ppc64-softmmu.mak
+++ b/configs/targets/ppc64-softmmu.mak
@@ -1,7 +1,6 @@
 TARGET_ARCH=ppc64
 TARGET_BASE_ARCH=ppc
 TARGET_BIG_ENDIAN=y
-TARGET_SUPPORTS_MTTCG=y
 TARGET_KVM_HAVE_GUEST_DEBUG=y
 TARGET_XML_FILES= gdb-xml/power64-core.xml gdb-xml/power-fpu.xml gdb-xml/power-altivec.xml gdb-xml/power-spe.xml gdb-xml/power-vsx.xml
 # all boards require libfdt
diff --git a/configs/targets/riscv32-softmmu.mak b/configs/targets/riscv32-softmmu.mak
index c828066ce6..db55275b86 100644
--- a/configs/targets/riscv32-softmmu.mak
+++ b/configs/targets/riscv32-softmmu.mak
@@ -1,6 +1,5 @@
 TARGET_ARCH=riscv32
 TARGET_BASE_ARCH=riscv
-TARGET_SUPPORTS_MTTCG=y
 TARGET_XML_FILES= gdb-xml/riscv-32bit-cpu.xml gdb-xml/riscv-32bit-fpu.xml gdb-xml/riscv-64bit-fpu.xml gdb-xml/riscv-32bit-virtual.xml
 # needed by boot.c
 TARGET_NEED_FDT=y
diff --git a/configs/targets/riscv64-softmmu.mak b/configs/targets/riscv64-softmmu.mak
index 09f613d24a..2bdd4a62cd 100644
--- a/configs/targets/riscv64-softmmu.mak
+++ b/configs/targets/riscv64-softmmu.mak
@@ -1,6 +1,5 @@
 TARGET_ARCH=riscv64
 TARGET_BASE_ARCH=riscv
-TARGET_SUPPORTS_MTTCG=y
 TARGET_KVM_HAVE_GUEST_DEBUG=y
 TARGET_XML_FILES= gdb-xml/riscv-64bit-cpu.xml gdb-xml/riscv-32bit-fpu.xml gdb-xml/riscv-64bit-fpu.xml gdb-xml/riscv-64bit-virtual.xml gdb-xml/riscv-32bit-cpu.xml gdb-xml/riscv-32bit-virtual.xml
 # needed by boot.c
diff --git a/configs/targets/s390x-softmmu.mak b/configs/targets/s390x-softmmu.mak
index 5242ebe7c2..76dd5de658 100644
--- a/configs/targets/s390x-softmmu.mak
+++ b/configs/targets/s390x-softmmu.mak
@@ -1,6 +1,5 @@
 TARGET_ARCH=s390x
 TARGET_BIG_ENDIAN=y
-TARGET_SUPPORTS_MTTCG=y
 TARGET_KVM_HAVE_GUEST_DEBUG=y
 TARGET_XML_FILES= gdb-xml/s390x-core64.xml gdb-xml/s390-acr.xml gdb-xml/s390-fpr.xml gdb-xml/s390-vx.xml gdb-xml/s390-cr.xml gdb-xml/s390-virt.xml gdb-xml/s390-virt-kvm.xml gdb-xml/s390-gs.xml
 TARGET_LONG_BITS=64
diff --git a/configs/targets/sparc-softmmu.mak b/configs/targets/sparc-softmmu.mak
index 78c2e25bd1..57801faf1f 100644
--- a/configs/targets/sparc-softmmu.mak
+++ b/configs/targets/sparc-softmmu.mak
@@ -1,4 +1,3 @@
 TARGET_ARCH=sparc
 TARGET_BIG_ENDIAN=y
-TARGET_SUPPORTS_MTTCG=y
 TARGET_LONG_BITS=32
diff --git a/configs/targets/sparc64-softmmu.mak b/configs/targets/sparc64-softmmu.mak
index f7bab97a00..2504e31ae3 100644
--- a/configs/targets/sparc64-softmmu.mak
+++ b/configs/targets/sparc64-softmmu.mak
@@ -1,5 +1,4 @@
 TARGET_ARCH=sparc64
 TARGET_BASE_ARCH=sparc
 TARGET_BIG_ENDIAN=y
-TARGET_SUPPORTS_MTTCG=y
 TARGET_LONG_BITS=64
diff --git a/configs/targets/x86_64-softmmu.mak b/configs/targets/x86_64-softmmu.mak
index 1ceefde131..5619b2bc68 100644
--- a/configs/targets/x86_64-softmmu.mak
+++ b/configs/targets/x86_64-softmmu.mak
@@ -1,6 +1,5 @@
 TARGET_ARCH=x86_64
 TARGET_BASE_ARCH=i386
-TARGET_SUPPORTS_MTTCG=y
 TARGET_KVM_HAVE_GUEST_DEBUG=y
 TARGET_KVM_HAVE_RESET_PARKED_VCPU=y
 TARGET_XML_FILES= gdb-xml/i386-64bit.xml
diff --git a/configs/targets/xtensa-softmmu.mak b/configs/targets/xtensa-softmmu.mak
index 65845df4ff..2a9797338a 100644
--- a/configs/targets/xtensa-softmmu.mak
+++ b/configs/targets/xtensa-softmmu.mak
@@ -1,3 +1,2 @@
 TARGET_ARCH=xtensa
-TARGET_SUPPORTS_MTTCG=y
 TARGET_LONG_BITS=32
diff --git a/configs/targets/xtensaeb-softmmu.mak b/configs/targets/xtensaeb-softmmu.mak
index f1f789d697..5204729af8 100644
--- a/configs/targets/xtensaeb-softmmu.mak
+++ b/configs/targets/xtensaeb-softmmu.mak
@@ -1,4 +1,3 @@
 TARGET_ARCH=xtensa
 TARGET_BIG_ENDIAN=y
-TARGET_SUPPORTS_MTTCG=y
 TARGET_LONG_BITS=32
diff --git a/docs/devel/multi-thread-tcg.rst b/docs/devel/multi-thread-tcg.rst
index 14a2a9dc7b..da9a1530c9 100644
--- a/docs/devel/multi-thread-tcg.rst
+++ b/docs/devel/multi-thread-tcg.rst
@@ -30,7 +30,7 @@ user-space thread. This is enabled by default for all FE/BE
 combinations where the host memory model is able to accommodate the
 guest (TCGCPUOps::guest_default_memory_order & ~TCG_TARGET_DEFAULT_MO is zero)
 and the guest has had the required work done to support this safely
-(TARGET_SUPPORTS_MTTCG).
+(TCGCPUOps::mttcg_supported).
 
 System emulation will fall back to the original round robin approach
 if:
diff --git a/include/accel/tcg/cpu-ops.h b/include/accel/tcg/cpu-ops.h
index a4932fc5d7..0e4352513d 100644
--- a/include/accel/tcg/cpu-ops.h
+++ b/include/accel/tcg/cpu-ops.h
@@ -19,6 +19,14 @@
 #include "tcg/tcg-mo.h"
 
 struct TCGCPUOps {
+    /**
+     * mttcg_supported: multi-threaded TCG is supported
+     *
+     * Target (TCG frontend) supports:
+     *   - atomic instructions
+     *   - memory ordering primitives (barriers)
+     */
+    bool mttcg_supported;
 
     /**
      * @guest_default_memory_order: default barrier that is required
diff --git a/include/exec/poison.h b/include/exec/poison.h
index a09e0c1263..bc422719d8 100644
--- a/include/exec/poison.h
+++ b/include/exec/poison.h
@@ -35,7 +35,6 @@
 
 #pragma GCC poison TARGET_HAS_BFLT
 #pragma GCC poison TARGET_NAME
-#pragma GCC poison TARGET_SUPPORTS_MTTCG
 #pragma GCC poison TARGET_BIG_ENDIAN
 #pragma GCC poison TCG_GUEST_DEFAULT_MO
 #pragma GCC poison TARGET_HAS_PRECISE_SMC
diff --git a/target/alpha/cpu.c b/target/alpha/cpu.c
index eeaf3a81c1..35fb145d27 100644
--- a/target/alpha/cpu.c
+++ b/target/alpha/cpu.c
@@ -237,6 +237,7 @@ static const struct SysemuCPUOps alpha_sysemu_ops = {
 static const TCGCPUOps alpha_tcg_ops = {
     /* Alpha processors have a weak memory model */
     .guest_default_memory_order = 0,
+    .mttcg_supported = true,
 
     .initialize = alpha_translate_init,
     .translate_code = alpha_translate_code,
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index 3e9760b551..377791c84d 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -2671,6 +2671,7 @@ static const struct SysemuCPUOps arm_sysemu_ops = {
 
 #ifdef CONFIG_TCG
 static const TCGCPUOps arm_tcg_ops = {
+    .mttcg_supported = true,
     /* ARM processors have a weak memory model */
     .guest_default_memory_order = 0,
 
diff --git a/target/arm/tcg/cpu-v7m.c b/target/arm/tcg/cpu-v7m.c
index 89d4e4b4a2..f71560aa43 100644
--- a/target/arm/tcg/cpu-v7m.c
+++ b/target/arm/tcg/cpu-v7m.c
@@ -234,6 +234,7 @@ static void cortex_m55_initfn(Object *obj)
 static const TCGCPUOps arm_v7m_tcg_ops = {
     /* ARM processors have a weak memory model */
     .guest_default_memory_order = 0,
+    .mttcg_supported = true,
 
     .initialize = arm_translate_init,
     .translate_code = arm_translate_code,
diff --git a/target/avr/cpu.c b/target/avr/cpu.c
index 8f79cf4c08..84f3b839c9 100644
--- a/target/avr/cpu.c
+++ b/target/avr/cpu.c
@@ -225,6 +225,7 @@ static const struct SysemuCPUOps avr_sysemu_ops = {
 
 static const TCGCPUOps avr_tcg_ops = {
     .guest_default_memory_order = 0,
+    .mttcg_supported = false,
     .initialize = avr_cpu_tcg_init,
     .translate_code = avr_cpu_translate_code,
     .synchronize_from_tb = avr_cpu_synchronize_from_tb,
diff --git a/target/hexagon/cpu.c b/target/hexagon/cpu.c
index 3d14e5cc6a..3c5191282e 100644
--- a/target/hexagon/cpu.c
+++ b/target/hexagon/cpu.c
@@ -327,6 +327,7 @@ static void hexagon_cpu_init(Object *obj)
 static const TCGCPUOps hexagon_tcg_ops = {
     /* MTTCG not yet supported: require strict ordering */
     .guest_default_memory_order = TCG_MO_ALL,
+    .mttcg_supported = false,
     .initialize = hexagon_translate_init,
     .translate_code = hexagon_translate_code,
     .synchronize_from_tb = hexagon_cpu_synchronize_from_tb,
diff --git a/target/hppa/cpu.c b/target/hppa/cpu.c
index dfbd933056..10e18c945e 100644
--- a/target/hppa/cpu.c
+++ b/target/hppa/cpu.c
@@ -260,6 +260,7 @@ static const TCGCPUOps hppa_tcg_ops = {
      * basis.  It's probably easier to fall back to a strong memory model.
      */
     .guest_default_memory_order = TCG_MO_ALL,
+    .mttcg_supported = true,
 
     .initialize = hppa_translate_init,
     .translate_code = hppa_translate_code,
diff --git a/target/i386/tcg/tcg-cpu.c b/target/i386/tcg/tcg-cpu.c
index e13d0f6f86..621502c984 100644
--- a/target/i386/tcg/tcg-cpu.c
+++ b/target/i386/tcg/tcg-cpu.c
@@ -125,6 +125,7 @@ static bool x86_debug_check_breakpoint(CPUState *cs)
 #include "accel/tcg/cpu-ops.h"
 
 const TCGCPUOps x86_tcg_ops = {
+    .mttcg_supported = true,
     /*
      * The x86 has a strong memory model with some store-after-load re-ordering
      */
diff --git a/target/loongarch/cpu.c b/target/loongarch/cpu.c
index f5b8ef29ab..fe9462b3b7 100644
--- a/target/loongarch/cpu.c
+++ b/target/loongarch/cpu.c
@@ -865,6 +865,7 @@ static void loongarch_cpu_dump_state(CPUState *cs, FILE *f, int flags)
 
 static const TCGCPUOps loongarch_tcg_ops = {
     .guest_default_memory_order = 0,
+    .mttcg_supported = true,
 
     .initialize = loongarch_translate_init,
     .translate_code = loongarch_translate_code,
diff --git a/target/m68k/cpu.c b/target/m68k/cpu.c
index b2d8c8f1de..99adc5eb91 100644
--- a/target/m68k/cpu.c
+++ b/target/m68k/cpu.c
@@ -591,6 +591,7 @@ static const struct SysemuCPUOps m68k_sysemu_ops = {
 static const TCGCPUOps m68k_tcg_ops = {
     /* MTTCG not yet supported: require strict ordering */
     .guest_default_memory_order = TCG_MO_ALL,
+    .mttcg_supported = false,
 
     .initialize = m68k_tcg_init,
     .translate_code = m68k_translate_code,
diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
index 4efba0dddb..edfb05758b 100644
--- a/target/microblaze/cpu.c
+++ b/target/microblaze/cpu.c
@@ -429,6 +429,7 @@ static const struct SysemuCPUOps mb_sysemu_ops = {
 static const TCGCPUOps mb_tcg_ops = {
     /* MicroBlaze is always in-order. */
     .guest_default_memory_order = TCG_MO_ALL,
+    .mttcg_supported = true,
 
     .initialize = mb_tcg_init,
     .translate_code = mb_translate_code,
diff --git a/target/mips/cpu.c b/target/mips/cpu.c
index 2ae7ba4407..473cecdebc 100644
--- a/target/mips/cpu.c
+++ b/target/mips/cpu.c
@@ -551,6 +551,7 @@ static int mips_cpu_mmu_index(CPUState *cs, bool ifunc)
 }
 
 static const TCGCPUOps mips_tcg_ops = {
+    .mttcg_supported = TARGET_LONG_BITS == 32,
     .guest_default_memory_order = 0,
 
     .initialize = mips_tcg_init,
diff --git a/target/openrisc/cpu.c b/target/openrisc/cpu.c
index 87fe779042..6601e0c066 100644
--- a/target/openrisc/cpu.c
+++ b/target/openrisc/cpu.c
@@ -244,6 +244,7 @@ static const struct SysemuCPUOps openrisc_sysemu_ops = {
 
 static const TCGCPUOps openrisc_tcg_ops = {
     .guest_default_memory_order = 0,
+    .mttcg_supported = true,
 
     .initialize = openrisc_translate_init,
     .translate_code = openrisc_translate_code,
diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
index 9ba775971a..fde7d71fc6 100644
--- a/target/ppc/cpu_init.c
+++ b/target/ppc/cpu_init.c
@@ -7479,6 +7479,7 @@ static const struct SysemuCPUOps ppc_sysemu_ops = {
 #include "accel/tcg/cpu-ops.h"
 
 static const TCGCPUOps ppc_tcg_ops = {
+  .mttcg_supported = TARGET_LONG_BITS == 64,
   .guest_default_memory_order = 0,
   .initialize = ppc_translate_init,
   .translate_code = ppc_translate_code,
diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index 44fdf6c4cf..426145c3b9 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -141,6 +141,7 @@ static void riscv_restore_state_to_opc(CPUState *cs,
 }
 
 const TCGCPUOps riscv_tcg_ops = {
+    .mttcg_supported = true,
     .guest_default_memory_order = 0,
 
     .initialize = riscv_translate_init,
diff --git a/target/rx/cpu.c b/target/rx/cpu.c
index f073fe8fc9..0a7a2b55b5 100644
--- a/target/rx/cpu.c
+++ b/target/rx/cpu.c
@@ -206,6 +206,7 @@ static const struct SysemuCPUOps rx_sysemu_ops = {
 static const TCGCPUOps rx_tcg_ops = {
     /* MTTCG not yet supported: require strict ordering */
     .guest_default_memory_order = TCG_MO_ALL,
+    .mttcg_supported = false,
 
     .initialize = rx_translate_init,
     .translate_code = rx_translate_code,
diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
index 1e101b5afe..41cccc1e69 100644
--- a/target/s390x/cpu.c
+++ b/target/s390x/cpu.c
@@ -345,6 +345,7 @@ void cpu_get_tb_cpu_state(CPUS390XState *env, vaddr *pc,
 }
 
 static const TCGCPUOps s390_tcg_ops = {
+    .mttcg_supported = true,
     /*
      * The z/Architecture has a strong memory model with some
      * store-after-load re-ordering.
diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
index 7a05301c6f..861fdd47f7 100644
--- a/target/sh4/cpu.c
+++ b/target/sh4/cpu.c
@@ -264,6 +264,7 @@ static const struct SysemuCPUOps sh4_sysemu_ops = {
 static const TCGCPUOps superh_tcg_ops = {
     /* MTTCG not yet supported: require strict ordering */
     .guest_default_memory_order = TCG_MO_ALL,
+    .mttcg_supported = false,
 
     .initialize = sh4_translate_init,
     .translate_code = sh4_translate_code,
diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
index 56d9417ae3..f7d231c6f8 100644
--- a/target/sparc/cpu.c
+++ b/target/sparc/cpu.c
@@ -1023,6 +1023,7 @@ static const TCGCPUOps sparc_tcg_ops = {
      *   by an implied MEMBAR #StoreStore.
      */
     .guest_default_memory_order = TCG_MO_LD_LD | TCG_MO_LD_ST | TCG_MO_ST_ST,
+    .mttcg_supported = true,
 
     .initialize = sparc_tcg_init,
     .translate_code = sparc_translate_code,
diff --git a/target/tricore/cpu.c b/target/tricore/cpu.c
index c68954b409..a4f93e7d91 100644
--- a/target/tricore/cpu.c
+++ b/target/tricore/cpu.c
@@ -174,6 +174,7 @@ static const struct SysemuCPUOps tricore_sysemu_ops = {
 static const TCGCPUOps tricore_tcg_ops = {
     /* MTTCG not yet supported: require strict ordering */
     .guest_default_memory_order = TCG_MO_ALL,
+    .mttcg_supported = false,
     .initialize = tricore_tcg_init,
     .translate_code = tricore_translate_code,
     .synchronize_from_tb = tricore_cpu_synchronize_from_tb,
diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
index 2cbf4e3010..971e67ad97 100644
--- a/target/xtensa/cpu.c
+++ b/target/xtensa/cpu.c
@@ -234,6 +234,7 @@ static const struct SysemuCPUOps xtensa_sysemu_ops = {
 static const TCGCPUOps xtensa_tcg_ops = {
     /* Xtensa processors have a weak memory model */
     .guest_default_memory_order = 0,
+    .mttcg_supported = true,
 
     .initialize = xtensa_translate_init,
     .translate_code = xtensa_translate_code,

From 9d7a951e352e7b99b8d96826ac9fdd384412137a Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Thu, 10 Apr 2025 16:50:04 +0800
Subject: [PATCH 0228/2760] hw/intc/loongarch_pch_msi: Remove gpio input
 handler

MSI interrupt is triggered by writing message on specified memory address.
In generic it is used by PCI devices, and no device is connected pch MSI
irqchip with GPIO pin line method, here remove gpio input setting for MSI
controller.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
Tested-by: Song Gao <gaosong@loongson.cn>
Message-Id: <20250410085004.3577627-1-maobibo@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 hw/intc/loongarch_pch_msi.c | 9 ---------
 1 file changed, 9 deletions(-)

diff --git a/hw/intc/loongarch_pch_msi.c b/hw/intc/loongarch_pch_msi.c
index 66b5c1e660..bc93504ff7 100644
--- a/hw/intc/loongarch_pch_msi.c
+++ b/hw/intc/loongarch_pch_msi.c
@@ -42,13 +42,6 @@ static const MemoryRegionOps loongarch_pch_msi_ops = {
     .endianness = DEVICE_LITTLE_ENDIAN,
 };
 
-static void pch_msi_irq_handler(void *opaque, int irq, int level)
-{
-    LoongArchPCHMSI *s = LOONGARCH_PCH_MSI(opaque);
-
-    qemu_set_irq(s->pch_msi_irq[irq], level);
-}
-
 static void loongarch_pch_msi_realize(DeviceState *dev, Error **errp)
 {
     LoongArchPCHMSI *s = LOONGARCH_PCH_MSI(dev);
@@ -59,9 +52,7 @@ static void loongarch_pch_msi_realize(DeviceState *dev, Error **errp)
     }
 
     s->pch_msi_irq = g_new(qemu_irq, s->irq_num);
-
     qdev_init_gpio_out(dev, s->pch_msi_irq, s->irq_num);
-    qdev_init_gpio_in(dev, pch_msi_irq_handler, s->irq_num);
 }
 
 static void loongarch_pch_msi_unrealize(DeviceState *dev)

From 4ac7eecb7439f6a978b44a0504a446c95f1bcc76 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Wed, 23 Apr 2025 16:04:09 +0800
Subject: [PATCH 0229/2760] target/loongarch: Move header file helper.h to
 directory tcg
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Header file helper.h is specified for tcg mode, move this file to
directory tcg. And create new file helper.h to include header
file in tcg mode.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20250423080417.3739809-2-maobibo@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 target/loongarch/helper.h     | 720 +--------------------------------
 target/loongarch/tcg/helper.h | 722 ++++++++++++++++++++++++++++++++++
 2 files changed, 724 insertions(+), 718 deletions(-)
 create mode 100644 target/loongarch/tcg/helper.h

diff --git a/target/loongarch/helper.h b/target/loongarch/helper.h
index 1d5cb0198c..99981abd01 100644
--- a/target/loongarch/helper.h
+++ b/target/loongarch/helper.h
@@ -1,722 +1,6 @@
 /* SPDX-License-Identifier: GPL-2.0-or-later */
 /*
- * Copyright (c) 2021 Loongson Technology Corporation Limited
+ * Copyright (c) 2025 Loongson Technology Corporation Limited
  */
 
-DEF_HELPER_2(raise_exception, noreturn, env, i32)
-
-DEF_HELPER_FLAGS_1(bitrev_w, TCG_CALL_NO_RWG_SE, tl, tl)
-DEF_HELPER_FLAGS_1(bitrev_d, TCG_CALL_NO_RWG_SE, tl, tl)
-DEF_HELPER_FLAGS_1(bitswap, TCG_CALL_NO_RWG_SE, tl, tl)
-
-DEF_HELPER_FLAGS_3(asrtle_d, TCG_CALL_NO_WG, void, env, tl, tl)
-DEF_HELPER_FLAGS_3(asrtgt_d, TCG_CALL_NO_WG, void, env, tl, tl)
-
-DEF_HELPER_FLAGS_3(crc32, TCG_CALL_NO_RWG_SE, tl, tl, tl, tl)
-DEF_HELPER_FLAGS_3(crc32c, TCG_CALL_NO_RWG_SE, tl, tl, tl, tl)
-DEF_HELPER_FLAGS_2(cpucfg, TCG_CALL_NO_RWG_SE, tl, env, tl)
-
-/* Floating-point helper */
-DEF_HELPER_FLAGS_3(fadd_s, TCG_CALL_NO_WG, i64, env, i64, i64)
-DEF_HELPER_FLAGS_3(fadd_d, TCG_CALL_NO_WG, i64, env, i64, i64)
-DEF_HELPER_FLAGS_3(fsub_s, TCG_CALL_NO_WG, i64, env, i64, i64)
-DEF_HELPER_FLAGS_3(fsub_d, TCG_CALL_NO_WG, i64, env, i64, i64)
-DEF_HELPER_FLAGS_3(fmul_s, TCG_CALL_NO_WG, i64, env, i64, i64)
-DEF_HELPER_FLAGS_3(fmul_d, TCG_CALL_NO_WG, i64, env, i64, i64)
-DEF_HELPER_FLAGS_3(fdiv_s, TCG_CALL_NO_WG, i64, env, i64, i64)
-DEF_HELPER_FLAGS_3(fdiv_d, TCG_CALL_NO_WG, i64, env, i64, i64)
-DEF_HELPER_FLAGS_3(fmax_s, TCG_CALL_NO_WG, i64, env, i64, i64)
-DEF_HELPER_FLAGS_3(fmax_d, TCG_CALL_NO_WG, i64, env, i64, i64)
-DEF_HELPER_FLAGS_3(fmin_s, TCG_CALL_NO_WG, i64, env, i64, i64)
-DEF_HELPER_FLAGS_3(fmin_d, TCG_CALL_NO_WG, i64, env, i64, i64)
-DEF_HELPER_FLAGS_3(fmaxa_s, TCG_CALL_NO_WG, i64, env, i64, i64)
-DEF_HELPER_FLAGS_3(fmaxa_d, TCG_CALL_NO_WG, i64, env, i64, i64)
-DEF_HELPER_FLAGS_3(fmina_s, TCG_CALL_NO_WG, i64, env, i64, i64)
-DEF_HELPER_FLAGS_3(fmina_d, TCG_CALL_NO_WG, i64, env, i64, i64)
-
-DEF_HELPER_FLAGS_5(fmuladd_s, TCG_CALL_NO_WG, i64, env, i64, i64, i64, i32)
-DEF_HELPER_FLAGS_5(fmuladd_d, TCG_CALL_NO_WG, i64, env, i64, i64, i64, i32)
-
-DEF_HELPER_FLAGS_3(fscaleb_s, TCG_CALL_NO_WG, i64, env, i64, i64)
-DEF_HELPER_FLAGS_3(fscaleb_d, TCG_CALL_NO_WG, i64, env, i64, i64)
-
-DEF_HELPER_FLAGS_2(flogb_s, TCG_CALL_NO_WG, i64, env, i64)
-DEF_HELPER_FLAGS_2(flogb_d, TCG_CALL_NO_WG, i64, env, i64)
-
-DEF_HELPER_FLAGS_2(fsqrt_s, TCG_CALL_NO_WG, i64, env, i64)
-DEF_HELPER_FLAGS_2(fsqrt_d, TCG_CALL_NO_WG, i64, env, i64)
-DEF_HELPER_FLAGS_2(frsqrt_s, TCG_CALL_NO_WG, i64, env, i64)
-DEF_HELPER_FLAGS_2(frsqrt_d, TCG_CALL_NO_WG, i64, env, i64)
-DEF_HELPER_FLAGS_2(frecip_s, TCG_CALL_NO_WG, i64, env, i64)
-DEF_HELPER_FLAGS_2(frecip_d, TCG_CALL_NO_WG, i64, env, i64)
-
-DEF_HELPER_FLAGS_2(fclass_s, TCG_CALL_NO_RWG_SE, i64, env, i64)
-DEF_HELPER_FLAGS_2(fclass_d, TCG_CALL_NO_RWG_SE, i64, env, i64)
-
-/* fcmp.cXXX.s */
-DEF_HELPER_4(fcmp_c_s, i64, env, i64, i64, i32)
-/* fcmp.sXXX.s */
-DEF_HELPER_4(fcmp_s_s, i64, env, i64, i64, i32)
-/* fcmp.cXXX.d */
-DEF_HELPER_4(fcmp_c_d, i64, env, i64, i64, i32)
-/* fcmp.sXXX.d */
-DEF_HELPER_4(fcmp_s_d, i64, env, i64, i64, i32)
-
-DEF_HELPER_2(fcvt_d_s, i64, env, i64)
-DEF_HELPER_2(fcvt_s_d, i64, env, i64)
-DEF_HELPER_2(ffint_d_w, i64, env, i64)
-DEF_HELPER_2(ffint_d_l, i64, env, i64)
-DEF_HELPER_2(ffint_s_w, i64, env, i64)
-DEF_HELPER_2(ffint_s_l, i64, env, i64)
-DEF_HELPER_2(ftintrm_l_s, i64, env, i64)
-DEF_HELPER_2(ftintrm_l_d, i64, env, i64)
-DEF_HELPER_2(ftintrm_w_s, i64, env, i64)
-DEF_HELPER_2(ftintrm_w_d, i64, env, i64)
-DEF_HELPER_2(ftintrp_l_s, i64, env, i64)
-DEF_HELPER_2(ftintrp_l_d, i64, env, i64)
-DEF_HELPER_2(ftintrp_w_s, i64, env, i64)
-DEF_HELPER_2(ftintrp_w_d, i64, env, i64)
-DEF_HELPER_2(ftintrz_l_s, i64, env, i64)
-DEF_HELPER_2(ftintrz_l_d, i64, env, i64)
-DEF_HELPER_2(ftintrz_w_s, i64, env, i64)
-DEF_HELPER_2(ftintrz_w_d, i64, env, i64)
-DEF_HELPER_2(ftintrne_l_s, i64, env, i64)
-DEF_HELPER_2(ftintrne_l_d, i64, env, i64)
-DEF_HELPER_2(ftintrne_w_s, i64, env, i64)
-DEF_HELPER_2(ftintrne_w_d, i64, env, i64)
-DEF_HELPER_2(ftint_l_s, i64, env, i64)
-DEF_HELPER_2(ftint_l_d, i64, env, i64)
-DEF_HELPER_2(ftint_w_s, i64, env, i64)
-DEF_HELPER_2(ftint_w_d, i64, env, i64)
-DEF_HELPER_2(frint_s, i64, env, i64)
-DEF_HELPER_2(frint_d, i64, env, i64)
-
-DEF_HELPER_FLAGS_1(set_rounding_mode, TCG_CALL_NO_RWG, void, env)
-
-DEF_HELPER_1(rdtime_d, i64, env)
-
-#ifndef CONFIG_USER_ONLY
-/* CSRs helper */
-DEF_HELPER_1(csrrd_pgd, i64, env)
-DEF_HELPER_1(csrrd_cpuid, i64, env)
-DEF_HELPER_1(csrrd_tval, i64, env)
-DEF_HELPER_2(csrwr_stlbps, i64, env, tl)
-DEF_HELPER_2(csrwr_estat, i64, env, tl)
-DEF_HELPER_2(csrwr_asid, i64, env, tl)
-DEF_HELPER_2(csrwr_tcfg, i64, env, tl)
-DEF_HELPER_2(csrwr_ticlr, i64, env, tl)
-DEF_HELPER_2(csrwr_pwcl, i64, env, tl)
-DEF_HELPER_2(iocsrrd_b, i64, env, tl)
-DEF_HELPER_2(iocsrrd_h, i64, env, tl)
-DEF_HELPER_2(iocsrrd_w, i64, env, tl)
-DEF_HELPER_2(iocsrrd_d, i64, env, tl)
-DEF_HELPER_3(iocsrwr_b, void, env, tl, tl)
-DEF_HELPER_3(iocsrwr_h, void, env, tl, tl)
-DEF_HELPER_3(iocsrwr_w, void, env, tl, tl)
-DEF_HELPER_3(iocsrwr_d, void, env, tl, tl)
-
-/* TLB helper */
-DEF_HELPER_1(tlbwr, void, env)
-DEF_HELPER_1(tlbfill, void, env)
-DEF_HELPER_1(tlbsrch, void, env)
-DEF_HELPER_1(tlbrd, void, env)
-DEF_HELPER_1(tlbclr, void, env)
-DEF_HELPER_1(tlbflush, void, env)
-DEF_HELPER_1(invtlb_all, void, env)
-DEF_HELPER_2(invtlb_all_g, void, env, i32)
-DEF_HELPER_2(invtlb_all_asid, void, env, tl)
-DEF_HELPER_3(invtlb_page_asid, void, env, tl, tl)
-DEF_HELPER_3(invtlb_page_asid_or_g, void, env, tl, tl)
-
-DEF_HELPER_4(lddir, tl, env, tl, tl, i32)
-DEF_HELPER_4(ldpte, void, env, tl, tl, i32)
-DEF_HELPER_1(ertn, void, env)
-DEF_HELPER_1(idle, void, env)
-#endif
-
-/* LoongArch LSX  */
-DEF_HELPER_FLAGS_4(vhaddw_h_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vhaddw_w_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vhaddw_d_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vhaddw_q_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vhaddw_hu_bu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vhaddw_wu_hu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vhaddw_du_wu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vhaddw_qu_du, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vhsubw_h_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vhsubw_w_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vhsubw_d_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vhsubw_q_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vhsubw_hu_bu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vhsubw_wu_hu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vhsubw_du_wu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vhsubw_qu_du, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(vaddwev_h_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vaddwev_w_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vaddwev_d_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vaddwev_q_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vaddwod_h_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vaddwod_w_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vaddwod_d_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vaddwod_q_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(vsubwev_h_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vsubwev_w_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vsubwev_d_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vsubwev_q_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vsubwod_h_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vsubwod_w_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vsubwod_d_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vsubwod_q_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(vaddwev_h_bu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vaddwev_w_hu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vaddwev_d_wu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vaddwev_q_du, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vaddwod_h_bu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vaddwod_w_hu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vaddwod_d_wu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vaddwod_q_du, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(vsubwev_h_bu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vsubwev_w_hu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vsubwev_d_wu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vsubwev_q_du, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vsubwod_h_bu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vsubwod_w_hu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vsubwod_d_wu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vsubwod_q_du, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(vaddwev_h_bu_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vaddwev_w_hu_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vaddwev_d_wu_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vaddwev_q_du_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vaddwod_h_bu_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vaddwod_w_hu_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vaddwod_d_wu_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vaddwod_q_du_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(vavg_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vavg_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vavg_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vavg_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vavg_bu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vavg_hu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vavg_wu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vavg_du, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(vavgr_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vavgr_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vavgr_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vavgr_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vavgr_bu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vavgr_hu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vavgr_wu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vavgr_du, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(vabsd_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vabsd_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vabsd_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vabsd_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vabsd_bu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vabsd_hu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vabsd_wu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vabsd_du, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(vadda_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vadda_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vadda_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vadda_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(vmini_b, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vmini_h, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vmini_w, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vmini_d, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vmini_bu, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vmini_hu, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vmini_wu, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vmini_du, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-
-DEF_HELPER_FLAGS_4(vmaxi_b, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vmaxi_h, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vmaxi_w, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vmaxi_d, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vmaxi_bu, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vmaxi_hu, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vmaxi_wu, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vmaxi_du, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-
-DEF_HELPER_FLAGS_4(vmuh_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vmuh_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vmuh_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vmuh_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vmuh_bu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vmuh_hu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vmuh_wu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vmuh_du, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(vmulwev_h_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vmulwev_w_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vmulwev_d_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vmulwod_h_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vmulwod_w_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vmulwod_d_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(vmulwev_h_bu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vmulwev_w_hu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vmulwev_d_wu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vmulwod_h_bu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vmulwod_w_hu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vmulwod_d_wu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(vmulwev_h_bu_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vmulwev_w_hu_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vmulwev_d_wu_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vmulwod_h_bu_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vmulwod_w_hu_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vmulwod_d_wu_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(vmadd_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vmadd_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vmadd_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vmadd_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vmsub_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vmsub_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vmsub_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vmsub_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(vmaddwev_h_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vmaddwev_w_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vmaddwev_d_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vmaddwod_h_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vmaddwod_w_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vmaddwod_d_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(vmaddwev_h_bu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vmaddwev_w_hu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vmaddwev_d_wu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vmaddwod_h_bu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vmaddwod_w_hu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vmaddwod_d_wu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(vmaddwev_h_bu_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vmaddwev_w_hu_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vmaddwev_d_wu_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vmaddwod_h_bu_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vmaddwod_w_hu_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vmaddwod_d_wu_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(vdiv_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vdiv_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vdiv_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vdiv_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vdiv_bu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vdiv_hu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vdiv_wu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vdiv_du, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vmod_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vmod_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vmod_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vmod_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vmod_bu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vmod_hu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vmod_wu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vmod_du, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(vsat_b, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vsat_h, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vsat_w, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vsat_d, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vsat_bu, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vsat_hu, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vsat_wu, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vsat_du, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-
-DEF_HELPER_FLAGS_3(vexth_h_b, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(vexth_w_h, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(vexth_d_w, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(vexth_q_d, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(vexth_hu_bu, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(vexth_wu_hu, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(vexth_du_wu, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(vexth_qu_du, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_3(vext2xv_h_b, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(vext2xv_w_b, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(vext2xv_d_b, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(vext2xv_w_h, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(vext2xv_d_h, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(vext2xv_d_w, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(vext2xv_hu_bu, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(vext2xv_wu_bu, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(vext2xv_du_bu, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(vext2xv_wu_hu, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(vext2xv_du_hu, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(vext2xv_du_wu, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(vsigncov_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vsigncov_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vsigncov_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vsigncov_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_3(vmskltz_b, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(vmskltz_h, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(vmskltz_w, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(vmskltz_d, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(vmskgez_b, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(vmsknz_b, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(vnori_b, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-
-DEF_HELPER_FLAGS_4(vsllwil_h_b, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vsllwil_w_h, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vsllwil_d_w, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_3(vextl_q_d, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vsllwil_hu_bu, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vsllwil_wu_hu, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vsllwil_du_wu, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_3(vextl_qu_du, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(vsrlr_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vsrlr_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vsrlr_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vsrlr_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vsrlri_b, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vsrlri_h, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vsrlri_w, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vsrlri_d, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-
-DEF_HELPER_FLAGS_4(vsrar_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vsrar_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vsrar_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vsrar_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vsrari_b, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vsrari_h, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vsrari_w, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vsrari_d, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-
-DEF_HELPER_FLAGS_4(vsrln_b_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vsrln_h_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vsrln_w_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vsran_b_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vsran_h_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vsran_w_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(vsrlni_b_h, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vsrlni_h_w, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vsrlni_w_d, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vsrlni_d_q, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vsrani_b_h, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vsrani_h_w, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vsrani_w_d, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vsrani_d_q, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-
-DEF_HELPER_FLAGS_4(vsrlrn_b_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vsrlrn_h_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vsrlrn_w_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vsrarn_b_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vsrarn_h_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vsrarn_w_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(vsrlrni_b_h, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vsrlrni_h_w, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vsrlrni_w_d, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vsrlrni_d_q, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vsrarni_b_h, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vsrarni_h_w, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vsrarni_w_d, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vsrarni_d_q, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-
-DEF_HELPER_FLAGS_4(vssrln_b_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vssrln_h_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vssrln_w_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vssran_b_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vssran_h_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vssran_w_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vssrln_bu_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vssrln_hu_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vssrln_wu_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vssran_bu_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vssran_hu_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vssran_wu_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(vssrlni_b_h, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vssrlni_h_w, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vssrlni_w_d, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vssrlni_d_q, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vssrani_b_h, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vssrani_h_w, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vssrani_w_d, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vssrani_d_q, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vssrlni_bu_h, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vssrlni_hu_w, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vssrlni_wu_d, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vssrlni_du_q, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vssrani_bu_h, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vssrani_hu_w, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vssrani_wu_d, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vssrani_du_q, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-
-DEF_HELPER_FLAGS_4(vssrlrn_b_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vssrlrn_h_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vssrlrn_w_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vssrarn_b_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vssrarn_h_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vssrarn_w_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vssrlrn_bu_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vssrlrn_hu_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vssrlrn_wu_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vssrarn_bu_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vssrarn_hu_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vssrarn_wu_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(vssrlrni_b_h, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vssrlrni_h_w, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vssrlrni_w_d, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vssrlrni_d_q, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vssrarni_b_h, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vssrarni_h_w, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vssrarni_w_d, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vssrarni_d_q, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vssrlrni_bu_h, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vssrlrni_hu_w, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vssrlrni_wu_d, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vssrlrni_du_q, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vssrarni_bu_h, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vssrarni_hu_w, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vssrarni_wu_d, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vssrarni_du_q, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-
-DEF_HELPER_FLAGS_3(vclo_b, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(vclo_h, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(vclo_w, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(vclo_d, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(vclz_b, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(vclz_h, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(vclz_w, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(vclz_d, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_3(vpcnt_b, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(vpcnt_h, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(vpcnt_w, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(vpcnt_d, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(vbitclr_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vbitclr_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vbitclr_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vbitclr_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vbitclri_b, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vbitclri_h, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vbitclri_w, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vbitclri_d, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-
-DEF_HELPER_FLAGS_4(vbitset_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vbitset_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vbitset_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vbitset_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vbitseti_b, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vbitseti_h, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vbitseti_w, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vbitseti_d, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-
-DEF_HELPER_FLAGS_4(vbitrev_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vbitrev_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vbitrev_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vbitrev_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vbitrevi_b, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vbitrevi_h, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vbitrevi_w, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vbitrevi_d, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-
-DEF_HELPER_FLAGS_4(vfrstp_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vfrstp_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vfrstpi_b, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vfrstpi_h, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-
-DEF_HELPER_FLAGS_5(vfadd_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_5(vfadd_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_5(vfsub_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_5(vfsub_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_5(vfmul_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_5(vfmul_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_5(vfdiv_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_5(vfdiv_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
-
-DEF_HELPER_FLAGS_6(vfmadd_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_6(vfmadd_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_6(vfmsub_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_6(vfmsub_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_6(vfnmadd_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_6(vfnmadd_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_6(vfnmsub_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_6(vfnmsub_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, env, i32)
-
-DEF_HELPER_FLAGS_5(vfmax_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_5(vfmax_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_5(vfmin_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_5(vfmin_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
-
-DEF_HELPER_FLAGS_5(vfmaxa_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_5(vfmaxa_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_5(vfmina_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_5(vfmina_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
-
-DEF_HELPER_FLAGS_4(vflogb_s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_4(vflogb_d, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
-
-DEF_HELPER_FLAGS_4(vfclass_s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_4(vfclass_d, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
-
-DEF_HELPER_FLAGS_4(vfsqrt_s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_4(vfsqrt_d, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_4(vfrecip_s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_4(vfrecip_d, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_4(vfrsqrt_s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_4(vfrsqrt_d, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
-
-DEF_HELPER_FLAGS_4(vfcvtl_s_h, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_4(vfcvth_s_h, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_4(vfcvtl_d_s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_4(vfcvth_d_s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_5(vfcvt_h_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_5(vfcvt_s_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
-
-DEF_HELPER_FLAGS_4(vfrintrne_s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_4(vfrintrne_d, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_4(vfrintrz_s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_4(vfrintrz_d, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_4(vfrintrp_s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_4(vfrintrp_d, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_4(vfrintrm_s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_4(vfrintrm_d, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_4(vfrint_s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_4(vfrint_d, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
-
-DEF_HELPER_FLAGS_4(vftintrne_w_s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_4(vftintrne_l_d, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_4(vftintrz_w_s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_4(vftintrz_l_d, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_4(vftintrp_w_s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_4(vftintrp_l_d, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_4(vftintrm_w_s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_4(vftintrm_l_d, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_4(vftint_w_s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_4(vftint_l_d, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_4(vftintrz_wu_s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_4(vftintrz_lu_d, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_4(vftint_wu_s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_4(vftint_lu_d, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_5(vftintrne_w_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_5(vftintrz_w_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_5(vftintrp_w_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_5(vftintrm_w_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_5(vftint_w_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_4(vftintrnel_l_s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_4(vftintrneh_l_s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_4(vftintrzl_l_s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_4(vftintrzh_l_s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_4(vftintrpl_l_s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_4(vftintrph_l_s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_4(vftintrml_l_s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_4(vftintrmh_l_s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_4(vftintl_l_s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_4(vftinth_l_s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
-
-DEF_HELPER_FLAGS_4(vffint_s_w, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_4(vffint_d_l, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_4(vffint_s_wu, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_4(vffint_d_lu, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_4(vffintl_d_w, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_4(vffinth_d_w, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_5(vffint_s_l, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
-
-DEF_HELPER_FLAGS_4(vseqi_b, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vseqi_h, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vseqi_w, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vseqi_d, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-
-DEF_HELPER_FLAGS_4(vslei_b, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vslei_h, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vslei_w, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vslei_d, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vslei_bu, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vslei_hu, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vslei_wu, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vslei_du, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-
-DEF_HELPER_FLAGS_4(vslti_b, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vslti_h, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vslti_w, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vslti_d, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vslti_bu, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vslti_hu, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vslti_wu, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vslti_du, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-
-DEF_HELPER_6(vfcmp_c_s, void, env, i32, i32, i32, i32, i32)
-DEF_HELPER_6(vfcmp_s_s, void, env, i32, i32, i32, i32, i32)
-DEF_HELPER_6(vfcmp_c_d, void, env, i32, i32, i32, i32, i32)
-DEF_HELPER_6(vfcmp_s_d, void, env, i32, i32, i32, i32, i32)
-
-DEF_HELPER_FLAGS_4(vbitseli_b, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-
-DEF_HELPER_4(vsetanyeqz_b, void, env, i32, i32, i32)
-DEF_HELPER_4(vsetanyeqz_h, void, env, i32, i32, i32)
-DEF_HELPER_4(vsetanyeqz_w, void, env, i32, i32, i32)
-DEF_HELPER_4(vsetanyeqz_d, void, env, i32, i32, i32)
-DEF_HELPER_4(vsetallnez_b, void, env, i32, i32, i32)
-DEF_HELPER_4(vsetallnez_h, void, env, i32, i32, i32)
-DEF_HELPER_4(vsetallnez_w, void, env, i32, i32, i32)
-DEF_HELPER_4(vsetallnez_d, void, env, i32, i32, i32)
-
-DEF_HELPER_FLAGS_4(xvinsve0_w, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(xvinsve0_d, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(xvpickve_w, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(xvpickve_d, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-
-DEF_HELPER_FLAGS_4(vpackev_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vpackev_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vpackev_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vpackev_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vpackod_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vpackod_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vpackod_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vpackod_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(vpickev_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vpickev_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vpickev_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vpickev_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vpickod_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vpickod_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vpickod_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vpickod_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(vilvl_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vilvl_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vilvl_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vilvl_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vilvh_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vilvh_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vilvh_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vilvh_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_5(vshuf_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vshuf_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vshuf_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vshuf_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vshuf4i_b, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vshuf4i_h, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vshuf4i_w, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vshuf4i_d, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-
-DEF_HELPER_FLAGS_4(vperm_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(vpermi_w, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vpermi_d, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vpermi_q, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-
-DEF_HELPER_FLAGS_4(vextrins_b, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vextrins_h, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vextrins_w, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(vextrins_d, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+#include "tcg/helper.h"
diff --git a/target/loongarch/tcg/helper.h b/target/loongarch/tcg/helper.h
new file mode 100644
index 0000000000..1d5cb0198c
--- /dev/null
+++ b/target/loongarch/tcg/helper.h
@@ -0,0 +1,722 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * Copyright (c) 2021 Loongson Technology Corporation Limited
+ */
+
+DEF_HELPER_2(raise_exception, noreturn, env, i32)
+
+DEF_HELPER_FLAGS_1(bitrev_w, TCG_CALL_NO_RWG_SE, tl, tl)
+DEF_HELPER_FLAGS_1(bitrev_d, TCG_CALL_NO_RWG_SE, tl, tl)
+DEF_HELPER_FLAGS_1(bitswap, TCG_CALL_NO_RWG_SE, tl, tl)
+
+DEF_HELPER_FLAGS_3(asrtle_d, TCG_CALL_NO_WG, void, env, tl, tl)
+DEF_HELPER_FLAGS_3(asrtgt_d, TCG_CALL_NO_WG, void, env, tl, tl)
+
+DEF_HELPER_FLAGS_3(crc32, TCG_CALL_NO_RWG_SE, tl, tl, tl, tl)
+DEF_HELPER_FLAGS_3(crc32c, TCG_CALL_NO_RWG_SE, tl, tl, tl, tl)
+DEF_HELPER_FLAGS_2(cpucfg, TCG_CALL_NO_RWG_SE, tl, env, tl)
+
+/* Floating-point helper */
+DEF_HELPER_FLAGS_3(fadd_s, TCG_CALL_NO_WG, i64, env, i64, i64)
+DEF_HELPER_FLAGS_3(fadd_d, TCG_CALL_NO_WG, i64, env, i64, i64)
+DEF_HELPER_FLAGS_3(fsub_s, TCG_CALL_NO_WG, i64, env, i64, i64)
+DEF_HELPER_FLAGS_3(fsub_d, TCG_CALL_NO_WG, i64, env, i64, i64)
+DEF_HELPER_FLAGS_3(fmul_s, TCG_CALL_NO_WG, i64, env, i64, i64)
+DEF_HELPER_FLAGS_3(fmul_d, TCG_CALL_NO_WG, i64, env, i64, i64)
+DEF_HELPER_FLAGS_3(fdiv_s, TCG_CALL_NO_WG, i64, env, i64, i64)
+DEF_HELPER_FLAGS_3(fdiv_d, TCG_CALL_NO_WG, i64, env, i64, i64)
+DEF_HELPER_FLAGS_3(fmax_s, TCG_CALL_NO_WG, i64, env, i64, i64)
+DEF_HELPER_FLAGS_3(fmax_d, TCG_CALL_NO_WG, i64, env, i64, i64)
+DEF_HELPER_FLAGS_3(fmin_s, TCG_CALL_NO_WG, i64, env, i64, i64)
+DEF_HELPER_FLAGS_3(fmin_d, TCG_CALL_NO_WG, i64, env, i64, i64)
+DEF_HELPER_FLAGS_3(fmaxa_s, TCG_CALL_NO_WG, i64, env, i64, i64)
+DEF_HELPER_FLAGS_3(fmaxa_d, TCG_CALL_NO_WG, i64, env, i64, i64)
+DEF_HELPER_FLAGS_3(fmina_s, TCG_CALL_NO_WG, i64, env, i64, i64)
+DEF_HELPER_FLAGS_3(fmina_d, TCG_CALL_NO_WG, i64, env, i64, i64)
+
+DEF_HELPER_FLAGS_5(fmuladd_s, TCG_CALL_NO_WG, i64, env, i64, i64, i64, i32)
+DEF_HELPER_FLAGS_5(fmuladd_d, TCG_CALL_NO_WG, i64, env, i64, i64, i64, i32)
+
+DEF_HELPER_FLAGS_3(fscaleb_s, TCG_CALL_NO_WG, i64, env, i64, i64)
+DEF_HELPER_FLAGS_3(fscaleb_d, TCG_CALL_NO_WG, i64, env, i64, i64)
+
+DEF_HELPER_FLAGS_2(flogb_s, TCG_CALL_NO_WG, i64, env, i64)
+DEF_HELPER_FLAGS_2(flogb_d, TCG_CALL_NO_WG, i64, env, i64)
+
+DEF_HELPER_FLAGS_2(fsqrt_s, TCG_CALL_NO_WG, i64, env, i64)
+DEF_HELPER_FLAGS_2(fsqrt_d, TCG_CALL_NO_WG, i64, env, i64)
+DEF_HELPER_FLAGS_2(frsqrt_s, TCG_CALL_NO_WG, i64, env, i64)
+DEF_HELPER_FLAGS_2(frsqrt_d, TCG_CALL_NO_WG, i64, env, i64)
+DEF_HELPER_FLAGS_2(frecip_s, TCG_CALL_NO_WG, i64, env, i64)
+DEF_HELPER_FLAGS_2(frecip_d, TCG_CALL_NO_WG, i64, env, i64)
+
+DEF_HELPER_FLAGS_2(fclass_s, TCG_CALL_NO_RWG_SE, i64, env, i64)
+DEF_HELPER_FLAGS_2(fclass_d, TCG_CALL_NO_RWG_SE, i64, env, i64)
+
+/* fcmp.cXXX.s */
+DEF_HELPER_4(fcmp_c_s, i64, env, i64, i64, i32)
+/* fcmp.sXXX.s */
+DEF_HELPER_4(fcmp_s_s, i64, env, i64, i64, i32)
+/* fcmp.cXXX.d */
+DEF_HELPER_4(fcmp_c_d, i64, env, i64, i64, i32)
+/* fcmp.sXXX.d */
+DEF_HELPER_4(fcmp_s_d, i64, env, i64, i64, i32)
+
+DEF_HELPER_2(fcvt_d_s, i64, env, i64)
+DEF_HELPER_2(fcvt_s_d, i64, env, i64)
+DEF_HELPER_2(ffint_d_w, i64, env, i64)
+DEF_HELPER_2(ffint_d_l, i64, env, i64)
+DEF_HELPER_2(ffint_s_w, i64, env, i64)
+DEF_HELPER_2(ffint_s_l, i64, env, i64)
+DEF_HELPER_2(ftintrm_l_s, i64, env, i64)
+DEF_HELPER_2(ftintrm_l_d, i64, env, i64)
+DEF_HELPER_2(ftintrm_w_s, i64, env, i64)
+DEF_HELPER_2(ftintrm_w_d, i64, env, i64)
+DEF_HELPER_2(ftintrp_l_s, i64, env, i64)
+DEF_HELPER_2(ftintrp_l_d, i64, env, i64)
+DEF_HELPER_2(ftintrp_w_s, i64, env, i64)
+DEF_HELPER_2(ftintrp_w_d, i64, env, i64)
+DEF_HELPER_2(ftintrz_l_s, i64, env, i64)
+DEF_HELPER_2(ftintrz_l_d, i64, env, i64)
+DEF_HELPER_2(ftintrz_w_s, i64, env, i64)
+DEF_HELPER_2(ftintrz_w_d, i64, env, i64)
+DEF_HELPER_2(ftintrne_l_s, i64, env, i64)
+DEF_HELPER_2(ftintrne_l_d, i64, env, i64)
+DEF_HELPER_2(ftintrne_w_s, i64, env, i64)
+DEF_HELPER_2(ftintrne_w_d, i64, env, i64)
+DEF_HELPER_2(ftint_l_s, i64, env, i64)
+DEF_HELPER_2(ftint_l_d, i64, env, i64)
+DEF_HELPER_2(ftint_w_s, i64, env, i64)
+DEF_HELPER_2(ftint_w_d, i64, env, i64)
+DEF_HELPER_2(frint_s, i64, env, i64)
+DEF_HELPER_2(frint_d, i64, env, i64)
+
+DEF_HELPER_FLAGS_1(set_rounding_mode, TCG_CALL_NO_RWG, void, env)
+
+DEF_HELPER_1(rdtime_d, i64, env)
+
+#ifndef CONFIG_USER_ONLY
+/* CSRs helper */
+DEF_HELPER_1(csrrd_pgd, i64, env)
+DEF_HELPER_1(csrrd_cpuid, i64, env)
+DEF_HELPER_1(csrrd_tval, i64, env)
+DEF_HELPER_2(csrwr_stlbps, i64, env, tl)
+DEF_HELPER_2(csrwr_estat, i64, env, tl)
+DEF_HELPER_2(csrwr_asid, i64, env, tl)
+DEF_HELPER_2(csrwr_tcfg, i64, env, tl)
+DEF_HELPER_2(csrwr_ticlr, i64, env, tl)
+DEF_HELPER_2(csrwr_pwcl, i64, env, tl)
+DEF_HELPER_2(iocsrrd_b, i64, env, tl)
+DEF_HELPER_2(iocsrrd_h, i64, env, tl)
+DEF_HELPER_2(iocsrrd_w, i64, env, tl)
+DEF_HELPER_2(iocsrrd_d, i64, env, tl)
+DEF_HELPER_3(iocsrwr_b, void, env, tl, tl)
+DEF_HELPER_3(iocsrwr_h, void, env, tl, tl)
+DEF_HELPER_3(iocsrwr_w, void, env, tl, tl)
+DEF_HELPER_3(iocsrwr_d, void, env, tl, tl)
+
+/* TLB helper */
+DEF_HELPER_1(tlbwr, void, env)
+DEF_HELPER_1(tlbfill, void, env)
+DEF_HELPER_1(tlbsrch, void, env)
+DEF_HELPER_1(tlbrd, void, env)
+DEF_HELPER_1(tlbclr, void, env)
+DEF_HELPER_1(tlbflush, void, env)
+DEF_HELPER_1(invtlb_all, void, env)
+DEF_HELPER_2(invtlb_all_g, void, env, i32)
+DEF_HELPER_2(invtlb_all_asid, void, env, tl)
+DEF_HELPER_3(invtlb_page_asid, void, env, tl, tl)
+DEF_HELPER_3(invtlb_page_asid_or_g, void, env, tl, tl)
+
+DEF_HELPER_4(lddir, tl, env, tl, tl, i32)
+DEF_HELPER_4(ldpte, void, env, tl, tl, i32)
+DEF_HELPER_1(ertn, void, env)
+DEF_HELPER_1(idle, void, env)
+#endif
+
+/* LoongArch LSX  */
+DEF_HELPER_FLAGS_4(vhaddw_h_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vhaddw_w_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vhaddw_d_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vhaddw_q_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vhaddw_hu_bu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vhaddw_wu_hu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vhaddw_du_wu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vhaddw_qu_du, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vhsubw_h_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vhsubw_w_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vhsubw_d_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vhsubw_q_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vhsubw_hu_bu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vhsubw_wu_hu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vhsubw_du_wu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vhsubw_qu_du, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(vaddwev_h_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vaddwev_w_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vaddwev_d_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vaddwev_q_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vaddwod_h_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vaddwod_w_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vaddwod_d_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vaddwod_q_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(vsubwev_h_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vsubwev_w_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vsubwev_d_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vsubwev_q_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vsubwod_h_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vsubwod_w_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vsubwod_d_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vsubwod_q_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(vaddwev_h_bu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vaddwev_w_hu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vaddwev_d_wu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vaddwev_q_du, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vaddwod_h_bu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vaddwod_w_hu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vaddwod_d_wu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vaddwod_q_du, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(vsubwev_h_bu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vsubwev_w_hu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vsubwev_d_wu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vsubwev_q_du, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vsubwod_h_bu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vsubwod_w_hu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vsubwod_d_wu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vsubwod_q_du, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(vaddwev_h_bu_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vaddwev_w_hu_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vaddwev_d_wu_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vaddwev_q_du_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vaddwod_h_bu_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vaddwod_w_hu_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vaddwod_d_wu_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vaddwod_q_du_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(vavg_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vavg_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vavg_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vavg_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vavg_bu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vavg_hu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vavg_wu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vavg_du, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(vavgr_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vavgr_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vavgr_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vavgr_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vavgr_bu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vavgr_hu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vavgr_wu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vavgr_du, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(vabsd_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vabsd_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vabsd_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vabsd_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vabsd_bu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vabsd_hu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vabsd_wu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vabsd_du, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(vadda_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vadda_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vadda_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vadda_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(vmini_b, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vmini_h, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vmini_w, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vmini_d, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vmini_bu, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vmini_hu, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vmini_wu, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vmini_du, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+
+DEF_HELPER_FLAGS_4(vmaxi_b, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vmaxi_h, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vmaxi_w, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vmaxi_d, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vmaxi_bu, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vmaxi_hu, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vmaxi_wu, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vmaxi_du, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+
+DEF_HELPER_FLAGS_4(vmuh_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vmuh_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vmuh_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vmuh_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vmuh_bu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vmuh_hu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vmuh_wu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vmuh_du, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(vmulwev_h_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vmulwev_w_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vmulwev_d_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vmulwod_h_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vmulwod_w_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vmulwod_d_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(vmulwev_h_bu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vmulwev_w_hu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vmulwev_d_wu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vmulwod_h_bu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vmulwod_w_hu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vmulwod_d_wu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(vmulwev_h_bu_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vmulwev_w_hu_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vmulwev_d_wu_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vmulwod_h_bu_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vmulwod_w_hu_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vmulwod_d_wu_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(vmadd_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vmadd_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vmadd_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vmadd_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vmsub_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vmsub_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vmsub_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vmsub_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(vmaddwev_h_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vmaddwev_w_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vmaddwev_d_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vmaddwod_h_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vmaddwod_w_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vmaddwod_d_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(vmaddwev_h_bu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vmaddwev_w_hu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vmaddwev_d_wu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vmaddwod_h_bu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vmaddwod_w_hu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vmaddwod_d_wu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(vmaddwev_h_bu_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vmaddwev_w_hu_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vmaddwev_d_wu_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vmaddwod_h_bu_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vmaddwod_w_hu_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vmaddwod_d_wu_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(vdiv_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vdiv_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vdiv_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vdiv_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vdiv_bu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vdiv_hu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vdiv_wu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vdiv_du, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vmod_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vmod_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vmod_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vmod_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vmod_bu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vmod_hu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vmod_wu, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vmod_du, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(vsat_b, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vsat_h, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vsat_w, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vsat_d, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vsat_bu, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vsat_hu, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vsat_wu, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vsat_du, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+
+DEF_HELPER_FLAGS_3(vexth_h_b, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(vexth_w_h, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(vexth_d_w, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(vexth_q_d, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(vexth_hu_bu, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(vexth_wu_hu, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(vexth_du_wu, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(vexth_qu_du, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_3(vext2xv_h_b, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(vext2xv_w_b, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(vext2xv_d_b, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(vext2xv_w_h, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(vext2xv_d_h, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(vext2xv_d_w, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(vext2xv_hu_bu, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(vext2xv_wu_bu, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(vext2xv_du_bu, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(vext2xv_wu_hu, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(vext2xv_du_hu, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(vext2xv_du_wu, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(vsigncov_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vsigncov_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vsigncov_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vsigncov_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_3(vmskltz_b, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(vmskltz_h, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(vmskltz_w, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(vmskltz_d, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(vmskgez_b, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(vmsknz_b, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(vnori_b, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+
+DEF_HELPER_FLAGS_4(vsllwil_h_b, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vsllwil_w_h, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vsllwil_d_w, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_3(vextl_q_d, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vsllwil_hu_bu, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vsllwil_wu_hu, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vsllwil_du_wu, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_3(vextl_qu_du, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(vsrlr_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vsrlr_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vsrlr_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vsrlr_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vsrlri_b, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vsrlri_h, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vsrlri_w, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vsrlri_d, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+
+DEF_HELPER_FLAGS_4(vsrar_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vsrar_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vsrar_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vsrar_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vsrari_b, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vsrari_h, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vsrari_w, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vsrari_d, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+
+DEF_HELPER_FLAGS_4(vsrln_b_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vsrln_h_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vsrln_w_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vsran_b_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vsran_h_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vsran_w_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(vsrlni_b_h, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vsrlni_h_w, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vsrlni_w_d, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vsrlni_d_q, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vsrani_b_h, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vsrani_h_w, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vsrani_w_d, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vsrani_d_q, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+
+DEF_HELPER_FLAGS_4(vsrlrn_b_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vsrlrn_h_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vsrlrn_w_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vsrarn_b_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vsrarn_h_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vsrarn_w_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(vsrlrni_b_h, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vsrlrni_h_w, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vsrlrni_w_d, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vsrlrni_d_q, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vsrarni_b_h, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vsrarni_h_w, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vsrarni_w_d, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vsrarni_d_q, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+
+DEF_HELPER_FLAGS_4(vssrln_b_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vssrln_h_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vssrln_w_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vssran_b_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vssran_h_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vssran_w_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vssrln_bu_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vssrln_hu_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vssrln_wu_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vssran_bu_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vssran_hu_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vssran_wu_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(vssrlni_b_h, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vssrlni_h_w, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vssrlni_w_d, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vssrlni_d_q, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vssrani_b_h, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vssrani_h_w, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vssrani_w_d, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vssrani_d_q, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vssrlni_bu_h, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vssrlni_hu_w, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vssrlni_wu_d, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vssrlni_du_q, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vssrani_bu_h, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vssrani_hu_w, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vssrani_wu_d, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vssrani_du_q, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+
+DEF_HELPER_FLAGS_4(vssrlrn_b_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vssrlrn_h_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vssrlrn_w_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vssrarn_b_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vssrarn_h_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vssrarn_w_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vssrlrn_bu_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vssrlrn_hu_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vssrlrn_wu_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vssrarn_bu_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vssrarn_hu_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vssrarn_wu_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(vssrlrni_b_h, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vssrlrni_h_w, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vssrlrni_w_d, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vssrlrni_d_q, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vssrarni_b_h, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vssrarni_h_w, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vssrarni_w_d, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vssrarni_d_q, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vssrlrni_bu_h, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vssrlrni_hu_w, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vssrlrni_wu_d, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vssrlrni_du_q, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vssrarni_bu_h, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vssrarni_hu_w, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vssrarni_wu_d, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vssrarni_du_q, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+
+DEF_HELPER_FLAGS_3(vclo_b, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(vclo_h, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(vclo_w, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(vclo_d, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(vclz_b, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(vclz_h, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(vclz_w, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(vclz_d, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_3(vpcnt_b, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(vpcnt_h, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(vpcnt_w, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(vpcnt_d, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(vbitclr_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vbitclr_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vbitclr_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vbitclr_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vbitclri_b, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vbitclri_h, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vbitclri_w, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vbitclri_d, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+
+DEF_HELPER_FLAGS_4(vbitset_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vbitset_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vbitset_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vbitset_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vbitseti_b, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vbitseti_h, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vbitseti_w, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vbitseti_d, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+
+DEF_HELPER_FLAGS_4(vbitrev_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vbitrev_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vbitrev_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vbitrev_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vbitrevi_b, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vbitrevi_h, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vbitrevi_w, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vbitrevi_d, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+
+DEF_HELPER_FLAGS_4(vfrstp_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vfrstp_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vfrstpi_b, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vfrstpi_h, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+
+DEF_HELPER_FLAGS_5(vfadd_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_5(vfadd_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_5(vfsub_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_5(vfsub_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_5(vfmul_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_5(vfmul_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_5(vfdiv_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_5(vfdiv_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
+
+DEF_HELPER_FLAGS_6(vfmadd_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_6(vfmadd_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_6(vfmsub_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_6(vfmsub_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_6(vfnmadd_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_6(vfnmadd_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_6(vfnmsub_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_6(vfnmsub_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, env, i32)
+
+DEF_HELPER_FLAGS_5(vfmax_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_5(vfmax_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_5(vfmin_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_5(vfmin_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
+
+DEF_HELPER_FLAGS_5(vfmaxa_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_5(vfmaxa_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_5(vfmina_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_5(vfmina_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
+
+DEF_HELPER_FLAGS_4(vflogb_s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(vflogb_d, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+
+DEF_HELPER_FLAGS_4(vfclass_s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(vfclass_d, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+
+DEF_HELPER_FLAGS_4(vfsqrt_s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(vfsqrt_d, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(vfrecip_s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(vfrecip_d, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(vfrsqrt_s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(vfrsqrt_d, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+
+DEF_HELPER_FLAGS_4(vfcvtl_s_h, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(vfcvth_s_h, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(vfcvtl_d_s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(vfcvth_d_s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_5(vfcvt_h_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_5(vfcvt_s_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
+
+DEF_HELPER_FLAGS_4(vfrintrne_s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(vfrintrne_d, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(vfrintrz_s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(vfrintrz_d, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(vfrintrp_s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(vfrintrp_d, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(vfrintrm_s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(vfrintrm_d, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(vfrint_s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(vfrint_d, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+
+DEF_HELPER_FLAGS_4(vftintrne_w_s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(vftintrne_l_d, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(vftintrz_w_s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(vftintrz_l_d, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(vftintrp_w_s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(vftintrp_l_d, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(vftintrm_w_s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(vftintrm_l_d, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(vftint_w_s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(vftint_l_d, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(vftintrz_wu_s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(vftintrz_lu_d, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(vftint_wu_s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(vftint_lu_d, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_5(vftintrne_w_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_5(vftintrz_w_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_5(vftintrp_w_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_5(vftintrm_w_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_5(vftint_w_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(vftintrnel_l_s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(vftintrneh_l_s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(vftintrzl_l_s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(vftintrzh_l_s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(vftintrpl_l_s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(vftintrph_l_s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(vftintrml_l_s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(vftintrmh_l_s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(vftintl_l_s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(vftinth_l_s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+
+DEF_HELPER_FLAGS_4(vffint_s_w, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(vffint_d_l, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(vffint_s_wu, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(vffint_d_lu, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(vffintl_d_w, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(vffinth_d_w, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_5(vffint_s_l, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
+
+DEF_HELPER_FLAGS_4(vseqi_b, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vseqi_h, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vseqi_w, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vseqi_d, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+
+DEF_HELPER_FLAGS_4(vslei_b, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vslei_h, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vslei_w, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vslei_d, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vslei_bu, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vslei_hu, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vslei_wu, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vslei_du, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+
+DEF_HELPER_FLAGS_4(vslti_b, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vslti_h, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vslti_w, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vslti_d, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vslti_bu, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vslti_hu, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vslti_wu, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vslti_du, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+
+DEF_HELPER_6(vfcmp_c_s, void, env, i32, i32, i32, i32, i32)
+DEF_HELPER_6(vfcmp_s_s, void, env, i32, i32, i32, i32, i32)
+DEF_HELPER_6(vfcmp_c_d, void, env, i32, i32, i32, i32, i32)
+DEF_HELPER_6(vfcmp_s_d, void, env, i32, i32, i32, i32, i32)
+
+DEF_HELPER_FLAGS_4(vbitseli_b, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+
+DEF_HELPER_4(vsetanyeqz_b, void, env, i32, i32, i32)
+DEF_HELPER_4(vsetanyeqz_h, void, env, i32, i32, i32)
+DEF_HELPER_4(vsetanyeqz_w, void, env, i32, i32, i32)
+DEF_HELPER_4(vsetanyeqz_d, void, env, i32, i32, i32)
+DEF_HELPER_4(vsetallnez_b, void, env, i32, i32, i32)
+DEF_HELPER_4(vsetallnez_h, void, env, i32, i32, i32)
+DEF_HELPER_4(vsetallnez_w, void, env, i32, i32, i32)
+DEF_HELPER_4(vsetallnez_d, void, env, i32, i32, i32)
+
+DEF_HELPER_FLAGS_4(xvinsve0_w, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(xvinsve0_d, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(xvpickve_w, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(xvpickve_d, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+
+DEF_HELPER_FLAGS_4(vpackev_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vpackev_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vpackev_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vpackev_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vpackod_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vpackod_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vpackod_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vpackod_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(vpickev_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vpickev_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vpickev_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vpickev_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vpickod_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vpickod_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vpickod_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vpickod_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(vilvl_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vilvl_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vilvl_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vilvl_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vilvh_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vilvh_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vilvh_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vilvh_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_5(vshuf_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vshuf_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vshuf_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vshuf_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vshuf4i_b, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vshuf4i_h, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vshuf4i_w, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vshuf4i_d, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+
+DEF_HELPER_FLAGS_4(vperm_w, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(vpermi_w, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vpermi_d, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vpermi_q, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+
+DEF_HELPER_FLAGS_4(vextrins_b, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vextrins_h, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vextrins_w, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
+DEF_HELPER_FLAGS_4(vextrins_d, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)

From a8d1b5bca5d234bfeaf215c079696735e5aafe71 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Wed, 23 Apr 2025 16:04:10 +0800
Subject: [PATCH 0230/2760] target/loongarch: Add function
 loongarch_get_addr_from_tlb
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Function loongarch_get_addr_from_tlb() is added to get physical address
from TLB tables. TLB table only works in TCG mode, in future this
function will be moved to TCG directory.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20250423080417.3739809-3-maobibo@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 target/loongarch/cpu_helper.c | 32 ++++++++++++++++++++++++++------
 1 file changed, 26 insertions(+), 6 deletions(-)

diff --git a/target/loongarch/cpu_helper.c b/target/loongarch/cpu_helper.c
index 930466ca48..a326859000 100644
--- a/target/loongarch/cpu_helper.c
+++ b/target/loongarch/cpu_helper.c
@@ -7,6 +7,7 @@
  */
 
 #include "qemu/osdep.h"
+#include "system/tcg.h"
 #include "cpu.h"
 #include "internals.h"
 #include "cpu-csr.h"
@@ -141,6 +142,21 @@ bool loongarch_tlb_search(CPULoongArchState *env, target_ulong vaddr,
     return false;
 }
 
+static int loongarch_get_addr_from_tlb(CPULoongArchState *env, hwaddr *physical,
+                                       int *prot, target_ulong address,
+                                       MMUAccessType access_type, int mmu_idx)
+{
+    int index, match;
+
+    match = loongarch_tlb_search(env, address, &index);
+    if (match) {
+        return loongarch_map_tlb_entry(env, physical, prot,
+                                       address, access_type, index, mmu_idx);
+    }
+
+    return TLBRET_NOMATCH;
+}
+
 static int loongarch_page_table_walker(CPULoongArchState *env, hwaddr *physical,
                                  int *prot, target_ulong address)
 {
@@ -221,13 +237,17 @@ static int loongarch_map_address(CPULoongArchState *env, hwaddr *physical,
                                  MMUAccessType access_type, int mmu_idx,
                                  int is_debug)
 {
-    int index, match;
+    int ret;
 
-    match = loongarch_tlb_search(env, address, &index);
-    if (match) {
-        return loongarch_map_tlb_entry(env, physical, prot,
-                                       address, access_type, index, mmu_idx);
-    } else if (is_debug) {
+    if (tcg_enabled()) {
+        ret = loongarch_get_addr_from_tlb(env, physical, prot, address,
+                                          access_type, mmu_idx);
+        if (ret != TLBRET_NOMATCH) {
+            return ret;
+        }
+    }
+
+    if (is_debug) {
         /*
          * For debugger memory access, we want to do the map when there is a
          * legal mapping, even if the mapping is not yet in TLB. return 0 if

From 885398ee09b5ee3d26d2ee670f468282c9ce8512 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Wed, 23 Apr 2025 16:04:11 +0800
Subject: [PATCH 0231/2760] target/loongarch: Move function get_dir_base_width
 to common directory
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Function get_dir_base_width() is used by loongarch_page_table_walker(),
so it is used by KVM mode also, here move this function from directory
tcg to common directory.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20250423080417.3739809-4-maobibo@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 target/loongarch/cpu_helper.c     | 28 ++++++++++++++++++++++++++++
 target/loongarch/tcg/tlb_helper.c | 28 ----------------------------
 2 files changed, 28 insertions(+), 28 deletions(-)

diff --git a/target/loongarch/cpu_helper.c b/target/loongarch/cpu_helper.c
index a326859000..8ae9a448b4 100644
--- a/target/loongarch/cpu_helper.c
+++ b/target/loongarch/cpu_helper.c
@@ -157,6 +157,34 @@ static int loongarch_get_addr_from_tlb(CPULoongArchState *env, hwaddr *physical,
     return TLBRET_NOMATCH;
 }
 
+void get_dir_base_width(CPULoongArchState *env, uint64_t *dir_base,
+                        uint64_t *dir_width, target_ulong level)
+{
+    switch (level) {
+    case 1:
+        *dir_base = FIELD_EX64(env->CSR_PWCL, CSR_PWCL, DIR1_BASE);
+        *dir_width = FIELD_EX64(env->CSR_PWCL, CSR_PWCL, DIR1_WIDTH);
+        break;
+    case 2:
+        *dir_base = FIELD_EX64(env->CSR_PWCL, CSR_PWCL, DIR2_BASE);
+        *dir_width = FIELD_EX64(env->CSR_PWCL, CSR_PWCL, DIR2_WIDTH);
+        break;
+    case 3:
+        *dir_base = FIELD_EX64(env->CSR_PWCH, CSR_PWCH, DIR3_BASE);
+        *dir_width = FIELD_EX64(env->CSR_PWCH, CSR_PWCH, DIR3_WIDTH);
+        break;
+    case 4:
+        *dir_base = FIELD_EX64(env->CSR_PWCH, CSR_PWCH, DIR4_BASE);
+        *dir_width = FIELD_EX64(env->CSR_PWCH, CSR_PWCH, DIR4_WIDTH);
+        break;
+    default:
+        /* level may be zero for ldpte */
+        *dir_base = FIELD_EX64(env->CSR_PWCL, CSR_PWCL, PTBASE);
+        *dir_width = FIELD_EX64(env->CSR_PWCL, CSR_PWCL, PTWIDTH);
+        break;
+    }
+}
+
 static int loongarch_page_table_walker(CPULoongArchState *env, hwaddr *physical,
                                  int *prot, target_ulong address)
 {
diff --git a/target/loongarch/tcg/tlb_helper.c b/target/loongarch/tcg/tlb_helper.c
index 70d1b5cf99..e6cfcc55c8 100644
--- a/target/loongarch/tcg/tlb_helper.c
+++ b/target/loongarch/tcg/tlb_helper.c
@@ -27,34 +27,6 @@ bool check_ps(CPULoongArchState *env, uint8_t tlb_ps)
     return BIT_ULL(tlb_ps) & (env->CSR_PRCFG2);
 }
 
-void get_dir_base_width(CPULoongArchState *env, uint64_t *dir_base,
-                               uint64_t *dir_width, target_ulong level)
-{
-    switch (level) {
-    case 1:
-        *dir_base = FIELD_EX64(env->CSR_PWCL, CSR_PWCL, DIR1_BASE);
-        *dir_width = FIELD_EX64(env->CSR_PWCL, CSR_PWCL, DIR1_WIDTH);
-        break;
-    case 2:
-        *dir_base = FIELD_EX64(env->CSR_PWCL, CSR_PWCL, DIR2_BASE);
-        *dir_width = FIELD_EX64(env->CSR_PWCL, CSR_PWCL, DIR2_WIDTH);
-        break;
-    case 3:
-        *dir_base = FIELD_EX64(env->CSR_PWCH, CSR_PWCH, DIR3_BASE);
-        *dir_width = FIELD_EX64(env->CSR_PWCH, CSR_PWCH, DIR3_WIDTH);
-        break;
-    case 4:
-        *dir_base = FIELD_EX64(env->CSR_PWCH, CSR_PWCH, DIR4_BASE);
-        *dir_width = FIELD_EX64(env->CSR_PWCH, CSR_PWCH, DIR4_WIDTH);
-        break;
-    default:
-        /* level may be zero for ldpte */
-        *dir_base = FIELD_EX64(env->CSR_PWCL, CSR_PWCL, PTBASE);
-        *dir_width = FIELD_EX64(env->CSR_PWCL, CSR_PWCL, PTWIDTH);
-        break;
-    }
-}
-
 static void raise_mmu_exception(CPULoongArchState *env, target_ulong address,
                                 MMUAccessType access_type, int tlb_error)
 {

From 566bf2de87160a8a2fe5a1ba1a2f31f6869f4f80 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Wed, 23 Apr 2025 16:04:12 +0800
Subject: [PATCH 0232/2760] target/loongarch: Add stub function
 loongarch_get_addr_from_tlb
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Stub function loongarch_get_addr_from_tlb() is added if option
CONFIG_TCG is not enabled, so this function can be called in KVM
only mode.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20250423080417.3739809-5-maobibo@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 target/loongarch/cpu_helper.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/target/loongarch/cpu_helper.c b/target/loongarch/cpu_helper.c
index 8ae9a448b4..71180bc345 100644
--- a/target/loongarch/cpu_helper.c
+++ b/target/loongarch/cpu_helper.c
@@ -156,7 +156,16 @@ static int loongarch_get_addr_from_tlb(CPULoongArchState *env, hwaddr *physical,
 
     return TLBRET_NOMATCH;
 }
+#else
+static int loongarch_get_addr_from_tlb(CPULoongArchState *env, hwaddr *physical,
+                                       int *prot, target_ulong address,
+                                       MMUAccessType access_type, int mmu_idx)
+{
+    return TLBRET_NOMATCH;
+}
+#endif
 
+#ifdef CONFIG_TCG
 void get_dir_base_width(CPULoongArchState *env, uint64_t *dir_base,
                         uint64_t *dir_width, target_ulong level)
 {

From d192494a685ff6b132caec8ebdfdbcdcd04408b9 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Wed, 23 Apr 2025 16:04:13 +0800
Subject: [PATCH 0233/2760] target/loongarch: Set function
 loongarch_map_address() with common code
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Function loongarch_map_address is to get physical address from virtual
address, it is used by qmp commands to dump memory from virtual
address.

It is used by kvm mode also, here move function loongarch_map_address()
out of macro CONFIG_TCG. And it is common code, the similar with
function loongarch_page_table_walker().

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20250423080417.3739809-6-maobibo@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 target/loongarch/cpu_helper.c | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/target/loongarch/cpu_helper.c b/target/loongarch/cpu_helper.c
index 71180bc345..9a87cae358 100644
--- a/target/loongarch/cpu_helper.c
+++ b/target/loongarch/cpu_helper.c
@@ -165,7 +165,6 @@ static int loongarch_get_addr_from_tlb(CPULoongArchState *env, hwaddr *physical,
 }
 #endif
 
-#ifdef CONFIG_TCG
 void get_dir_base_width(CPULoongArchState *env, uint64_t *dir_base,
                         uint64_t *dir_width, target_ulong level)
 {
@@ -295,15 +294,6 @@ static int loongarch_map_address(CPULoongArchState *env, hwaddr *physical,
 
     return TLBRET_NOMATCH;
 }
-#else
-static int loongarch_map_address(CPULoongArchState *env, hwaddr *physical,
-                                 int *prot, target_ulong address,
-                                 MMUAccessType access_type, int mmu_idx,
-                                 int is_debug)
-{
-    return TLBRET_NOMATCH;
-}
-#endif
 
 static hwaddr dmw_va2pa(CPULoongArchState *env, target_ulong va,
                         target_ulong dmw)

From 9fd0cc4df871d762b91076410b6b6fb637cec0d4 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Wed, 23 Apr 2025 16:04:14 +0800
Subject: [PATCH 0234/2760] target/loongarch: Define function
 loongarch_get_addr_from_tlb() non-static
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Define function loongarch_get_addr_from_tlb() non-static, and add its
definition in header file tcg/tcg_loongarch.h

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20250423080417.3739809-7-maobibo@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 target/loongarch/cpu_helper.c        | 10 ++--------
 target/loongarch/tcg/tcg_loongarch.h |  5 +++++
 2 files changed, 7 insertions(+), 8 deletions(-)

diff --git a/target/loongarch/cpu_helper.c b/target/loongarch/cpu_helper.c
index 9a87cae358..97d9caa06e 100644
--- a/target/loongarch/cpu_helper.c
+++ b/target/loongarch/cpu_helper.c
@@ -11,6 +11,7 @@
 #include "cpu.h"
 #include "internals.h"
 #include "cpu-csr.h"
+#include "tcg/tcg_loongarch.h"
 
 #ifdef CONFIG_TCG
 static int loongarch_map_tlb_entry(CPULoongArchState *env, hwaddr *physical,
@@ -142,7 +143,7 @@ bool loongarch_tlb_search(CPULoongArchState *env, target_ulong vaddr,
     return false;
 }
 
-static int loongarch_get_addr_from_tlb(CPULoongArchState *env, hwaddr *physical,
+int loongarch_get_addr_from_tlb(CPULoongArchState *env, hwaddr *physical,
                                        int *prot, target_ulong address,
                                        MMUAccessType access_type, int mmu_idx)
 {
@@ -156,13 +157,6 @@ static int loongarch_get_addr_from_tlb(CPULoongArchState *env, hwaddr *physical,
 
     return TLBRET_NOMATCH;
 }
-#else
-static int loongarch_get_addr_from_tlb(CPULoongArchState *env, hwaddr *physical,
-                                       int *prot, target_ulong address,
-                                       MMUAccessType access_type, int mmu_idx)
-{
-    return TLBRET_NOMATCH;
-}
 #endif
 
 void get_dir_base_width(CPULoongArchState *env, uint64_t *dir_base,
diff --git a/target/loongarch/tcg/tcg_loongarch.h b/target/loongarch/tcg/tcg_loongarch.h
index da2539e995..b29427d981 100644
--- a/target/loongarch/tcg/tcg_loongarch.h
+++ b/target/loongarch/tcg/tcg_loongarch.h
@@ -6,7 +6,12 @@
  */
 #ifndef TARGET_LOONGARCH_TCG_LOONGARCH_H
 #define TARGET_LOONGARCH_TCG_LOONGARCH_H
+#include "cpu.h"
 
 void loongarch_csr_translate_init(void);
 
+int loongarch_get_addr_from_tlb(CPULoongArchState *env, hwaddr *physical,
+                                int *prot, target_ulong address,
+                                MMUAccessType access_type, int mmu_idx);
+
 #endif  /* TARGET_LOONGARCH_TCG_LOONGARCH_H */

From 9c9ffc013db126727d6121754e461550ba60a69f Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Wed, 23 Apr 2025 16:04:15 +0800
Subject: [PATCH 0235/2760] target/loongarch: Move function
 loongarch_tlb_search to directory tcg
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Function loongarch_tlb_search() and loongarch_map_tlb_entry() works
only in TCG mode, move these functions to directory tcg.

There is no any function change, only code moving.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20250423080417.3739809-8-maobibo@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 target/loongarch/cpu_helper.c     | 146 ------------------------------
 target/loongarch/tcg/tlb_helper.c | 145 +++++++++++++++++++++++++++++
 2 files changed, 145 insertions(+), 146 deletions(-)

diff --git a/target/loongarch/cpu_helper.c b/target/loongarch/cpu_helper.c
index 97d9caa06e..998857b8dc 100644
--- a/target/loongarch/cpu_helper.c
+++ b/target/loongarch/cpu_helper.c
@@ -13,152 +13,6 @@
 #include "cpu-csr.h"
 #include "tcg/tcg_loongarch.h"
 
-#ifdef CONFIG_TCG
-static int loongarch_map_tlb_entry(CPULoongArchState *env, hwaddr *physical,
-                                   int *prot, target_ulong address,
-                                   int access_type, int index, int mmu_idx)
-{
-    LoongArchTLB *tlb = &env->tlb[index];
-    uint64_t plv = mmu_idx;
-    uint64_t tlb_entry, tlb_ppn;
-    uint8_t tlb_ps, n, tlb_v, tlb_d, tlb_plv, tlb_nx, tlb_nr, tlb_rplv;
-
-    if (index >= LOONGARCH_STLB) {
-        tlb_ps = FIELD_EX64(tlb->tlb_misc, TLB_MISC, PS);
-    } else {
-        tlb_ps = FIELD_EX64(env->CSR_STLBPS, CSR_STLBPS, PS);
-    }
-    n = (address >> tlb_ps) & 0x1;/* Odd or even */
-
-    tlb_entry = n ? tlb->tlb_entry1 : tlb->tlb_entry0;
-    tlb_v = FIELD_EX64(tlb_entry, TLBENTRY, V);
-    tlb_d = FIELD_EX64(tlb_entry, TLBENTRY, D);
-    tlb_plv = FIELD_EX64(tlb_entry, TLBENTRY, PLV);
-    if (is_la64(env)) {
-        tlb_ppn = FIELD_EX64(tlb_entry, TLBENTRY_64, PPN);
-        tlb_nx = FIELD_EX64(tlb_entry, TLBENTRY_64, NX);
-        tlb_nr = FIELD_EX64(tlb_entry, TLBENTRY_64, NR);
-        tlb_rplv = FIELD_EX64(tlb_entry, TLBENTRY_64, RPLV);
-    } else {
-        tlb_ppn = FIELD_EX64(tlb_entry, TLBENTRY_32, PPN);
-        tlb_nx = 0;
-        tlb_nr = 0;
-        tlb_rplv = 0;
-    }
-
-    /* Remove sw bit between bit12 -- bit PS*/
-    tlb_ppn = tlb_ppn & ~(((0x1UL << (tlb_ps - 12)) -1));
-
-    /* Check access rights */
-    if (!tlb_v) {
-        return TLBRET_INVALID;
-    }
-
-    if (access_type == MMU_INST_FETCH && tlb_nx) {
-        return TLBRET_XI;
-    }
-
-    if (access_type == MMU_DATA_LOAD && tlb_nr) {
-        return TLBRET_RI;
-    }
-
-    if (((tlb_rplv == 0) && (plv > tlb_plv)) ||
-        ((tlb_rplv == 1) && (plv != tlb_plv))) {
-        return TLBRET_PE;
-    }
-
-    if ((access_type == MMU_DATA_STORE) && !tlb_d) {
-        return TLBRET_DIRTY;
-    }
-
-    *physical = (tlb_ppn << R_TLBENTRY_64_PPN_SHIFT) |
-                (address & MAKE_64BIT_MASK(0, tlb_ps));
-    *prot = PAGE_READ;
-    if (tlb_d) {
-        *prot |= PAGE_WRITE;
-    }
-    if (!tlb_nx) {
-        *prot |= PAGE_EXEC;
-    }
-    return TLBRET_MATCH;
-}
-
-/*
- * One tlb entry holds an adjacent odd/even pair, the vpn is the
- * content of the virtual page number divided by 2. So the
- * compare vpn is bit[47:15] for 16KiB page. while the vppn
- * field in tlb entry contains bit[47:13], so need adjust.
- * virt_vpn = vaddr[47:13]
- */
-bool loongarch_tlb_search(CPULoongArchState *env, target_ulong vaddr,
-                          int *index)
-{
-    LoongArchTLB *tlb;
-    uint16_t csr_asid, tlb_asid, stlb_idx;
-    uint8_t tlb_e, tlb_ps, tlb_g, stlb_ps;
-    int i, compare_shift;
-    uint64_t vpn, tlb_vppn;
-
-    csr_asid = FIELD_EX64(env->CSR_ASID, CSR_ASID, ASID);
-    stlb_ps = FIELD_EX64(env->CSR_STLBPS, CSR_STLBPS, PS);
-    vpn = (vaddr & TARGET_VIRT_MASK) >> (stlb_ps + 1);
-    stlb_idx = vpn & 0xff; /* VA[25:15] <==> TLBIDX.index for 16KiB Page */
-    compare_shift = stlb_ps + 1 - R_TLB_MISC_VPPN_SHIFT;
-
-    /* Search STLB */
-    for (i = 0; i < 8; ++i) {
-        tlb = &env->tlb[i * 256 + stlb_idx];
-        tlb_e = FIELD_EX64(tlb->tlb_misc, TLB_MISC, E);
-        if (tlb_e) {
-            tlb_vppn = FIELD_EX64(tlb->tlb_misc, TLB_MISC, VPPN);
-            tlb_asid = FIELD_EX64(tlb->tlb_misc, TLB_MISC, ASID);
-            tlb_g = FIELD_EX64(tlb->tlb_entry0, TLBENTRY, G);
-
-            if ((tlb_g == 1 || tlb_asid == csr_asid) &&
-                (vpn == (tlb_vppn >> compare_shift))) {
-                *index = i * 256 + stlb_idx;
-                return true;
-            }
-        }
-    }
-
-    /* Search MTLB */
-    for (i = LOONGARCH_STLB; i < LOONGARCH_TLB_MAX; ++i) {
-        tlb = &env->tlb[i];
-        tlb_e = FIELD_EX64(tlb->tlb_misc, TLB_MISC, E);
-        if (tlb_e) {
-            tlb_vppn = FIELD_EX64(tlb->tlb_misc, TLB_MISC, VPPN);
-            tlb_ps = FIELD_EX64(tlb->tlb_misc, TLB_MISC, PS);
-            tlb_asid = FIELD_EX64(tlb->tlb_misc, TLB_MISC, ASID);
-            tlb_g = FIELD_EX64(tlb->tlb_entry0, TLBENTRY, G);
-            compare_shift = tlb_ps + 1 - R_TLB_MISC_VPPN_SHIFT;
-            vpn = (vaddr & TARGET_VIRT_MASK) >> (tlb_ps + 1);
-            if ((tlb_g == 1 || tlb_asid == csr_asid) &&
-                (vpn == (tlb_vppn >> compare_shift))) {
-                *index = i;
-                return true;
-            }
-        }
-    }
-    return false;
-}
-
-int loongarch_get_addr_from_tlb(CPULoongArchState *env, hwaddr *physical,
-                                       int *prot, target_ulong address,
-                                       MMUAccessType access_type, int mmu_idx)
-{
-    int index, match;
-
-    match = loongarch_tlb_search(env, address, &index);
-    if (match) {
-        return loongarch_map_tlb_entry(env, physical, prot,
-                                       address, access_type, index, mmu_idx);
-    }
-
-    return TLBRET_NOMATCH;
-}
-#endif
-
 void get_dir_base_width(CPULoongArchState *env, uint64_t *dir_base,
                         uint64_t *dir_width, target_ulong level)
 {
diff --git a/target/loongarch/tcg/tlb_helper.c b/target/loongarch/tcg/tlb_helper.c
index e6cfcc55c8..8509aa99cf 100644
--- a/target/loongarch/tcg/tlb_helper.c
+++ b/target/loongarch/tcg/tlb_helper.c
@@ -18,6 +18,7 @@
 #include "exec/cpu_ldst.h"
 #include "exec/log.h"
 #include "cpu-csr.h"
+#include "tcg/tcg_loongarch.h"
 
 bool check_ps(CPULoongArchState *env, uint8_t tlb_ps)
 {
@@ -201,6 +202,66 @@ static uint32_t get_random_tlb(uint32_t low, uint32_t high)
     return val % (high - low + 1) + low;
 }
 
+/*
+ * One tlb entry holds an adjacent odd/even pair, the vpn is the
+ * content of the virtual page number divided by 2. So the
+ * compare vpn is bit[47:15] for 16KiB page. while the vppn
+ * field in tlb entry contains bit[47:13], so need adjust.
+ * virt_vpn = vaddr[47:13]
+ */
+bool loongarch_tlb_search(CPULoongArchState *env, target_ulong vaddr,
+                          int *index)
+{
+    LoongArchTLB *tlb;
+    uint16_t csr_asid, tlb_asid, stlb_idx;
+    uint8_t tlb_e, tlb_ps, tlb_g, stlb_ps;
+    int i, compare_shift;
+    uint64_t vpn, tlb_vppn;
+
+    csr_asid = FIELD_EX64(env->CSR_ASID, CSR_ASID, ASID);
+   stlb_ps = FIELD_EX64(env->CSR_STLBPS, CSR_STLBPS, PS);
+    vpn = (vaddr & TARGET_VIRT_MASK) >> (stlb_ps + 1);
+    stlb_idx = vpn & 0xff; /* VA[25:15] <==> TLBIDX.index for 16KiB Page */
+    compare_shift = stlb_ps + 1 - R_TLB_MISC_VPPN_SHIFT;
+
+    /* Search STLB */
+    for (i = 0; i < 8; ++i) {
+        tlb = &env->tlb[i * 256 + stlb_idx];
+        tlb_e = FIELD_EX64(tlb->tlb_misc, TLB_MISC, E);
+        if (tlb_e) {
+            tlb_vppn = FIELD_EX64(tlb->tlb_misc, TLB_MISC, VPPN);
+            tlb_asid = FIELD_EX64(tlb->tlb_misc, TLB_MISC, ASID);
+            tlb_g = FIELD_EX64(tlb->tlb_entry0, TLBENTRY, G);
+
+            if ((tlb_g == 1 || tlb_asid == csr_asid) &&
+                (vpn == (tlb_vppn >> compare_shift))) {
+                *index = i * 256 + stlb_idx;
+                return true;
+            }
+        }
+    }
+
+    /* Search MTLB */
+    for (i = LOONGARCH_STLB; i < LOONGARCH_TLB_MAX; ++i) {
+        tlb = &env->tlb[i];
+        tlb_e = FIELD_EX64(tlb->tlb_misc, TLB_MISC, E);
+        if (tlb_e) {
+            tlb_vppn = FIELD_EX64(tlb->tlb_misc, TLB_MISC, VPPN);
+            tlb_ps = FIELD_EX64(tlb->tlb_misc, TLB_MISC, PS);
+            tlb_asid = FIELD_EX64(tlb->tlb_misc, TLB_MISC, ASID);
+            tlb_g = FIELD_EX64(tlb->tlb_entry0, TLBENTRY, G);
+            compare_shift = tlb_ps + 1 - R_TLB_MISC_VPPN_SHIFT;
+            vpn = (vaddr & TARGET_VIRT_MASK) >> (tlb_ps + 1);
+            if ((tlb_g == 1 || tlb_asid == csr_asid) &&
+                (vpn == (tlb_vppn >> compare_shift))) {
+                *index = i;
+                return true;
+            }
+        }
+    }
+    return false;
+}
+
 void helper_tlbsrch(CPULoongArchState *env)
 {
     int index, match;
@@ -609,3 +670,87 @@ void helper_ldpte(CPULoongArchState *env, target_ulong base, target_ulong odd,
     }
     env->CSR_TLBREHI = FIELD_DP64(env->CSR_TLBREHI, CSR_TLBREHI, PS, ps);
 }
+
+static int loongarch_map_tlb_entry(CPULoongArchState *env, hwaddr *physical,
+                                   int *prot, target_ulong address,
+                                   int access_type, int index, int mmu_idx)
+{
+    LoongArchTLB *tlb = &env->tlb[index];
+    uint64_t plv = mmu_idx;
+    uint64_t tlb_entry, tlb_ppn;
+    uint8_t tlb_ps, n, tlb_v, tlb_d, tlb_plv, tlb_nx, tlb_nr, tlb_rplv;
+
+    if (index >= LOONGARCH_STLB) {
+        tlb_ps = FIELD_EX64(tlb->tlb_misc, TLB_MISC, PS);
+    } else {
+        tlb_ps = FIELD_EX64(env->CSR_STLBPS, CSR_STLBPS, PS);
+    }
+    n = (address >> tlb_ps) & 0x1;/* Odd or even */
+
+    tlb_entry = n ? tlb->tlb_entry1 : tlb->tlb_entry0;
+    tlb_v = FIELD_EX64(tlb_entry, TLBENTRY, V);
+    tlb_d = FIELD_EX64(tlb_entry, TLBENTRY, D);
+    tlb_plv = FIELD_EX64(tlb_entry, TLBENTRY, PLV);
+    if (is_la64(env)) {
+        tlb_ppn = FIELD_EX64(tlb_entry, TLBENTRY_64, PPN);
+        tlb_nx = FIELD_EX64(tlb_entry, TLBENTRY_64, NX);
+        tlb_nr = FIELD_EX64(tlb_entry, TLBENTRY_64, NR);
+        tlb_rplv = FIELD_EX64(tlb_entry, TLBENTRY_64, RPLV);
+    } else {
+        tlb_ppn = FIELD_EX64(tlb_entry, TLBENTRY_32, PPN);
+        tlb_nx = 0;
+        tlb_nr = 0;
+        tlb_rplv = 0;
+    }
+
+    /* Remove sw bit between bit12 -- bit PS*/
+    tlb_ppn = tlb_ppn & ~(((0x1UL << (tlb_ps - 12)) - 1));
+
+    /* Check access rights */
+    if (!tlb_v) {
+        return TLBRET_INVALID;
+    }
+
+    if (access_type == MMU_INST_FETCH && tlb_nx) {
+        return TLBRET_XI;
+    }
+
+    if (access_type == MMU_DATA_LOAD && tlb_nr) {
+        return TLBRET_RI;
+    }
+
+    if (((tlb_rplv == 0) && (plv > tlb_plv)) ||
+        ((tlb_rplv == 1) && (plv != tlb_plv))) {
+        return TLBRET_PE;
+    }
+
+    if ((access_type == MMU_DATA_STORE) && !tlb_d) {
+        return TLBRET_DIRTY;
+    }
+
+    *physical = (tlb_ppn << R_TLBENTRY_64_PPN_SHIFT) |
+                (address & MAKE_64BIT_MASK(0, tlb_ps));
+    *prot = PAGE_READ;
+    if (tlb_d) {
+        *prot |= PAGE_WRITE;
+    }
+    if (!tlb_nx) {
+        *prot |= PAGE_EXEC;
+    }
+    return TLBRET_MATCH;
+}
+
+int loongarch_get_addr_from_tlb(CPULoongArchState *env, hwaddr *physical,
+                                int *prot, target_ulong address,
+                                MMUAccessType access_type, int mmu_idx)
+{
+    int index, match;
+
+    match = loongarch_tlb_search(env, address, &index);
+    if (match) {
+        return loongarch_map_tlb_entry(env, physical, prot,
+                                       address, access_type, index, mmu_idx);
+    }
+
+    return TLBRET_NOMATCH;
+}

From ad5233ba5c7dcc92ee79d015f2168fb7e0279118 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Wed, 23 Apr 2025 16:04:16 +0800
Subject: [PATCH 0236/2760] target/loongarch: Add static definition with
 function loongarch_tlb_search()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Function loongarch_tlb_search() is only referenced in file tcg/tlb_helper.c,
define this function with static attribution.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20250423080417.3739809-9-maobibo@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 target/loongarch/internals.h      | 2 --
 target/loongarch/tcg/tlb_helper.c | 4 ++--
 2 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/target/loongarch/internals.h b/target/loongarch/internals.h
index 9fdc3059d8..3a079feb1d 100644
--- a/target/loongarch/internals.h
+++ b/target/loongarch/internals.h
@@ -54,8 +54,6 @@ uint64_t cpu_loongarch_get_constant_timer_counter(LoongArchCPU *cpu);
 uint64_t cpu_loongarch_get_constant_timer_ticks(LoongArchCPU *cpu);
 void cpu_loongarch_store_constant_timer_config(LoongArchCPU *cpu,
                                                uint64_t value);
-bool loongarch_tlb_search(CPULoongArchState *env, target_ulong vaddr,
-                          int *index);
 int get_physical_address(CPULoongArchState *env, hwaddr *physical,
                          int *prot, target_ulong address,
                          MMUAccessType access_type, int mmu_idx, int is_debug);
diff --git a/target/loongarch/tcg/tlb_helper.c b/target/loongarch/tcg/tlb_helper.c
index 8509aa99cf..2fdd10022b 100644
--- a/target/loongarch/tcg/tlb_helper.c
+++ b/target/loongarch/tcg/tlb_helper.c
@@ -209,8 +209,8 @@ static uint32_t get_random_tlb(uint32_t low, uint32_t high)
  * field in tlb entry contains bit[47:13], so need adjust.
  * virt_vpn = vaddr[47:13]
  */
-bool loongarch_tlb_search(CPULoongArchState *env, target_ulong vaddr,
-                          int *index)
+static bool loongarch_tlb_search(CPULoongArchState *env, target_ulong vaddr,
+                                 int *index)
 {
     LoongArchTLB *tlb;
     uint16_t csr_asid, tlb_asid, stlb_idx;

From 0d4c2e408d418ec5c412ec9f58e7b8f3aecc6948 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Wed, 23 Apr 2025 16:04:17 +0800
Subject: [PATCH 0237/2760] target/loongarch: Move definition of TCG specified
 function to tcg directory
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Function loongarch_cpu_tlb_fill() only works in TCG mode, move its
definition from header file internals.h to file tcg/tcg_loongarch.h

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20250423080417.3739809-10-maobibo@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 target/loongarch/cpu.c               | 1 +
 target/loongarch/internals.h         | 5 -----
 target/loongarch/tcg/tcg_loongarch.h | 4 ++++
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/target/loongarch/cpu.c b/target/loongarch/cpu.c
index ea1665e270..bf3d592574 100644
--- a/target/loongarch/cpu.c
+++ b/target/loongarch/cpu.c
@@ -32,6 +32,7 @@
 #include "exec/cpu_ldst.h"
 #include "tcg/tcg.h"
 #endif
+#include "tcg/tcg_loongarch.h"
 
 const char * const regnames[32] = {
     "r0", "r1", "r2", "r3", "r4", "r5", "r6", "r7",
diff --git a/target/loongarch/internals.h b/target/loongarch/internals.h
index 3a079feb1d..a7384b0d31 100644
--- a/target/loongarch/internals.h
+++ b/target/loongarch/internals.h
@@ -61,11 +61,6 @@ void get_dir_base_width(CPULoongArchState *env, uint64_t *dir_base,
                                uint64_t *dir_width, target_ulong level);
 hwaddr loongarch_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
 
-#ifdef CONFIG_TCG
-bool loongarch_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
-                            MMUAccessType access_type, int mmu_idx,
-                            bool probe, uintptr_t retaddr);
-#endif
 #endif /* !CONFIG_USER_ONLY */
 
 uint64_t read_fcc(CPULoongArchState *env);
diff --git a/target/loongarch/tcg/tcg_loongarch.h b/target/loongarch/tcg/tcg_loongarch.h
index b29427d981..fd4e116022 100644
--- a/target/loongarch/tcg/tcg_loongarch.h
+++ b/target/loongarch/tcg/tcg_loongarch.h
@@ -10,6 +10,10 @@
 
 void loongarch_csr_translate_init(void);
 
+bool loongarch_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
+                            MMUAccessType access_type, int mmu_idx,
+                            bool probe, uintptr_t retaddr);
+
 int loongarch_get_addr_from_tlb(CPULoongArchState *env, hwaddr *physical,
                                 int *prot, target_ulong address,
                                 MMUAccessType access_type, int mmu_idx);

From a9d3d1dff6f9e1544e8a84e74645b8e4fe08c0ad Mon Sep 17 00:00:00 2001
From: WANG Rui <wangrui@loongson.cn>
Date: Mon, 14 Apr 2025 15:49:52 +0800
Subject: [PATCH 0238/2760] linux-user/loongarch64: Decode BRK break codes for
 FPE signals

Handle specific LoongArch BRK break codes in user-mode emulation
to deliver accurate floating-point exception signals. Specifically,
BRK_OVERFLOW (6) triggers TARGET_FPE_INTOVF, and BRK_DIVZERO (7)
triggers TARGET_FPE_INTDIV. Other BRK codes fall back to a generic
SIGTRAP.

This improves correctness for programs that rely on BRK to signal
overflow or divide-by-zero conditions.

Signed-off-by: WANG Rui <wangrui@loongson.cn>
Acked-by: Song Gao <gaosong@loongson.cn>
Message-Id: <20250414074952.6253-1-wangrui@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 linux-user/loongarch64/cpu_loop.c | 25 ++++++++++++++++++++++++-
 1 file changed, 24 insertions(+), 1 deletion(-)

diff --git a/linux-user/loongarch64/cpu_loop.c b/linux-user/loongarch64/cpu_loop.c
index 0614d3de22..ec8a06c88c 100644
--- a/linux-user/loongarch64/cpu_loop.c
+++ b/linux-user/loongarch64/cpu_loop.c
@@ -11,6 +11,12 @@
 #include "user/cpu_loop.h"
 #include "signal-common.h"
 
+/* Break codes */
+enum {
+    BRK_OVERFLOW = 6,
+    BRK_DIVZERO = 7
+};
+
 void cpu_loop(CPULoongArchState *env)
 {
     CPUState *cs = env_cpu(env);
@@ -66,9 +72,26 @@ void cpu_loop(CPULoongArchState *env)
             force_sig_fault(TARGET_SIGFPE, si_code, env->pc);
             break;
         case EXCP_DEBUG:
-        case EXCCODE_BRK:
             force_sig_fault(TARGET_SIGTRAP, TARGET_TRAP_BRKPT, env->pc);
             break;
+        case EXCCODE_BRK:
+            {
+                unsigned int opcode;
+
+                get_user_u32(opcode, env->pc);
+
+                switch (opcode & 0x7fff) {
+                case BRK_OVERFLOW:
+                    force_sig_fault(TARGET_SIGFPE, TARGET_FPE_INTOVF, env->pc);
+                    break;
+                case BRK_DIVZERO:
+                    force_sig_fault(TARGET_SIGFPE, TARGET_FPE_INTDIV, env->pc);
+                    break;
+                default:
+                    force_sig_fault(TARGET_SIGTRAP, TARGET_TRAP_BRKPT, env->pc);
+                }
+            }
+            break;
         case EXCCODE_BCE:
             force_sig_fault(TARGET_SIGSYS, TARGET_SI_KERNEL, env->pc);
             break;

From 256df51e727235b3d5e937ca2784c45663c00f59 Mon Sep 17 00:00:00 2001
From: WANG Rui <wangrui@loongson.cn>
Date: Fri, 18 Apr 2025 16:21:01 +0800
Subject: [PATCH 0239/2760] target/loongarch: Add CRC feature flag and use it
 to gate CRC instructions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This patch replaces the obsolete IOCSR_BRD bit with CRC in cpucfg1[25],
in both LA464 and LA132 CPU initialization functions. The corresponding
field macro in `cpu.h` is updated to reflect this change.

Additionally, the availability macro `avail_CRC()` is introduced in
`translate.h` to check the CRC feature flag.

All CRC-related instruction translations are updated to be gated by
the new CRC feature flag instead of hardcoded CPU features.

This ensures correctness and configurability when enabling CRC
instructions based on hardware capabilities.

Signed-off-by: WANG Rui <wangrui@loongson.cn>
Reviewed-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20250418082103.447780-2-wangrui@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 target/loongarch/cpu.c                           |  4 ++--
 target/loongarch/cpu.h                           |  2 +-
 .../loongarch/tcg/insn_trans/trans_extra.c.inc   | 16 ++++++++--------
 target/loongarch/translate.h                     |  1 +
 4 files changed, 12 insertions(+), 11 deletions(-)

diff --git a/target/loongarch/cpu.c b/target/loongarch/cpu.c
index bf3d592574..588f5fd021 100644
--- a/target/loongarch/cpu.c
+++ b/target/loongarch/cpu.c
@@ -432,7 +432,7 @@ static void loongarch_la464_initfn(Object *obj)
     data = FIELD_DP32(data, CPUCFG1, EP, 1);
     data = FIELD_DP32(data, CPUCFG1, RPLV, 1);
     data = FIELD_DP32(data, CPUCFG1, HP, 1);
-    data = FIELD_DP32(data, CPUCFG1, IOCSR_BRD, 1);
+    data = FIELD_DP32(data, CPUCFG1, CRC, 1);
     env->cpucfg[1] = data;
 
     data = 0;
@@ -531,7 +531,7 @@ static void loongarch_la132_initfn(Object *obj)
     data = FIELD_DP32(data, CPUCFG1, EP, 0);
     data = FIELD_DP32(data, CPUCFG1, RPLV, 0);
     data = FIELD_DP32(data, CPUCFG1, HP, 1);
-    data = FIELD_DP32(data, CPUCFG1, IOCSR_BRD, 1);
+    data = FIELD_DP32(data, CPUCFG1, CRC, 1);
     env->cpucfg[1] = data;
 }
 
diff --git a/target/loongarch/cpu.h b/target/loongarch/cpu.h
index 254e4fbdcd..ab76a0b451 100644
--- a/target/loongarch/cpu.h
+++ b/target/loongarch/cpu.h
@@ -129,7 +129,7 @@ FIELD(CPUCFG1, RI, 21, 1)
 FIELD(CPUCFG1, EP, 22, 1)
 FIELD(CPUCFG1, RPLV, 23, 1)
 FIELD(CPUCFG1, HP, 24, 1)
-FIELD(CPUCFG1, IOCSR_BRD, 25, 1)
+FIELD(CPUCFG1, CRC, 25, 1)
 FIELD(CPUCFG1, MSG_INT, 26, 1)
 
 /* cpucfg[1].arch */
diff --git a/target/loongarch/tcg/insn_trans/trans_extra.c.inc b/target/loongarch/tcg/insn_trans/trans_extra.c.inc
index cfa361fecf..eda3d6e561 100644
--- a/target/loongarch/tcg/insn_trans/trans_extra.c.inc
+++ b/target/loongarch/tcg/insn_trans/trans_extra.c.inc
@@ -97,11 +97,11 @@ static bool gen_crc(DisasContext *ctx, arg_rrr *a,
     return true;
 }
 
-TRANS(crc_w_b_w, 64, gen_crc, gen_helper_crc32, tcg_constant_tl(1))
-TRANS(crc_w_h_w, 64, gen_crc, gen_helper_crc32, tcg_constant_tl(2))
-TRANS(crc_w_w_w, 64, gen_crc, gen_helper_crc32, tcg_constant_tl(4))
-TRANS(crc_w_d_w, 64, gen_crc, gen_helper_crc32, tcg_constant_tl(8))
-TRANS(crcc_w_b_w, 64, gen_crc, gen_helper_crc32c, tcg_constant_tl(1))
-TRANS(crcc_w_h_w, 64, gen_crc, gen_helper_crc32c, tcg_constant_tl(2))
-TRANS(crcc_w_w_w, 64, gen_crc, gen_helper_crc32c, tcg_constant_tl(4))
-TRANS(crcc_w_d_w, 64, gen_crc, gen_helper_crc32c, tcg_constant_tl(8))
+TRANS(crc_w_b_w, CRC, gen_crc, gen_helper_crc32, tcg_constant_tl(1))
+TRANS(crc_w_h_w, CRC, gen_crc, gen_helper_crc32, tcg_constant_tl(2))
+TRANS(crc_w_w_w, CRC, gen_crc, gen_helper_crc32, tcg_constant_tl(4))
+TRANS(crc_w_d_w, CRC, gen_crc, gen_helper_crc32, tcg_constant_tl(8))
+TRANS(crcc_w_b_w, CRC, gen_crc, gen_helper_crc32c, tcg_constant_tl(1))
+TRANS(crcc_w_h_w, CRC, gen_crc, gen_helper_crc32c, tcg_constant_tl(2))
+TRANS(crcc_w_w_w, CRC, gen_crc, gen_helper_crc32c, tcg_constant_tl(4))
+TRANS(crcc_w_d_w, CRC, gen_crc, gen_helper_crc32c, tcg_constant_tl(8))
diff --git a/target/loongarch/translate.h b/target/loongarch/translate.h
index 195f53573a..018dc5eb17 100644
--- a/target/loongarch/translate.h
+++ b/target/loongarch/translate.h
@@ -25,6 +25,7 @@
 #define avail_LSX(C)   (FIELD_EX32((C)->cpucfg2, CPUCFG2, LSX))
 #define avail_LASX(C)  (FIELD_EX32((C)->cpucfg2, CPUCFG2, LASX))
 #define avail_IOCSR(C) (FIELD_EX32((C)->cpucfg1, CPUCFG1, IOCSR))
+#define avail_CRC(C)   (FIELD_EX32((C)->cpucfg1, CPUCFG1, CRC))
 
 /*
  * If an operation is being performed on less than TARGET_LONG_BITS,

From 875caabdb1701a7c57ad0655a7963d74afc1b4d9 Mon Sep 17 00:00:00 2001
From: WANG Rui <wangrui@loongson.cn>
Date: Fri, 18 Apr 2025 16:21:02 +0800
Subject: [PATCH 0240/2760] target/loongarch: Guard BCEQZ/BCNEZ instructions
 with FP feature

The BCEQZ and BCNEZ instructions depend on access to condition codes
from floating-point comparisons. Previously, these instructions were
unconditionally enabled for 64-bit targets.

This patch updates their translation to be gated under the `FP` feature
flag instead, ensuring they are only available when the floating-point
unit is present.

This improves correctness for CPUs lacking floating-point support.

Signed-off-by: WANG Rui <wangrui@loongson.cn>
Reviewed-by: Bibo Mao <maobibo@loongson.cn>
Message-Id: <20250418082103.447780-3-wangrui@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 target/loongarch/tcg/insn_trans/trans_branch.c.inc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/loongarch/tcg/insn_trans/trans_branch.c.inc b/target/loongarch/tcg/insn_trans/trans_branch.c.inc
index 221e5159db..f94c1f37ab 100644
--- a/target/loongarch/tcg/insn_trans/trans_branch.c.inc
+++ b/target/loongarch/tcg/insn_trans/trans_branch.c.inc
@@ -80,5 +80,5 @@ TRANS(bltu, ALL, gen_rr_bc, TCG_COND_LTU)
 TRANS(bgeu, ALL, gen_rr_bc, TCG_COND_GEU)
 TRANS(beqz, ALL, gen_rz_bc, TCG_COND_EQ)
 TRANS(bnez, ALL, gen_rz_bc, TCG_COND_NE)
-TRANS(bceqz, 64, gen_cz_bc, TCG_COND_EQ)
-TRANS(bcnez, 64, gen_cz_bc, TCG_COND_NE)
+TRANS(bceqz, FP, gen_cz_bc, TCG_COND_EQ)
+TRANS(bcnez, FP, gen_cz_bc, TCG_COND_NE)

From 720a0e417ef0814d90aa884096a643b02ee854dc Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Mon, 7 Apr 2025 10:26:41 +0200
Subject: [PATCH 0241/2760] cleanup: Re-run return_directly.cocci
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Coccinelle's indentation of virt_create_plic() results in a long line.
Avoid that by mimicking the old indentation manually.

Don't touch tests/tcg/mips/user/.  I'm not sure these files are ours
to make style cleanups on.  They might be imported third-party code,
which we should leave as is to not complicate future updates.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250407082643.2310002-2-armbru@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/gpio/pca9554.c                     |  5 +----
 hw/i386/kvm/xen_xenstore.c            |  4 +---
 hw/riscv/virt.c                       | 25 ++++++++++---------------
 hw/scsi/esp.c                         |  5 +----
 hw/vfio/common.c                      |  7 ++-----
 plugins/api.c                         |  4 +---
 tests/qtest/cmsdk-apb-watchdog-test.c |  6 +-----
 tests/qtest/pnv-host-i2c-test.c       |  4 +---
 tests/qtest/stm32l4x5_usart-test.c    |  6 +-----
 tools/i386/qemu-vmsr-helper.c         |  5 +----
 10 files changed, 20 insertions(+), 51 deletions(-)

diff --git a/hw/gpio/pca9554.c b/hw/gpio/pca9554.c
index fe03bb4b5e..7301fce934 100644
--- a/hw/gpio/pca9554.c
+++ b/hw/gpio/pca9554.c
@@ -118,11 +118,8 @@ static void pca9554_write(PCA9554State *s, uint8_t reg, uint8_t data)
 static uint8_t pca9554_recv(I2CSlave *i2c)
 {
     PCA9554State *s = PCA9554(i2c);
-    uint8_t ret;
 
-    ret = pca9554_read(s, s->pointer & 0x3);
-
-    return ret;
+    return pca9554_read(s, s->pointer & 0x3);
 }
 
 static int pca9554_send(I2CSlave *i2c, uint8_t data)
diff --git a/hw/i386/kvm/xen_xenstore.c b/hw/i386/kvm/xen_xenstore.c
index 17802aa33d..227ad7ace3 100644
--- a/hw/i386/kvm/xen_xenstore.c
+++ b/hw/i386/kvm/xen_xenstore.c
@@ -209,7 +209,6 @@ static int xen_xenstore_post_load(void *opaque, int ver)
 {
     XenXenstoreState *s = opaque;
     GByteArray *save;
-    int ret;
 
     /*
      * As qemu/dom0, rebind to the guest's port. The Windows drivers may
@@ -231,8 +230,7 @@ static int xen_xenstore_post_load(void *opaque, int ver)
     s->impl_state = NULL;
     s->impl_state_size = 0;
 
-    ret = xs_impl_deserialize(s->impl, save, xen_domid, fire_watch_cb, s);
-    return ret;
+    return xs_impl_deserialize(s->impl, save, xen_domid, fire_watch_cb, s);
 }
 
 static const VMStateDescription xen_xenstore_vmstate = {
diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index e517002fdf..85849e604c 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -1276,27 +1276,22 @@ static FWCfgState *create_fw_cfg(const MachineState *ms)
 static DeviceState *virt_create_plic(const MemMapEntry *memmap, int socket,
                                      int base_hartid, int hart_count)
 {
-    DeviceState *ret;
     g_autofree char *plic_hart_config = NULL;
 
     /* Per-socket PLIC hart topology configuration string */
     plic_hart_config = riscv_plic_hart_config_string(hart_count);
 
     /* Per-socket PLIC */
-    ret = sifive_plic_create(
-            memmap[VIRT_PLIC].base + socket * memmap[VIRT_PLIC].size,
-            plic_hart_config, hart_count, base_hartid,
-            VIRT_IRQCHIP_NUM_SOURCES,
-            ((1U << VIRT_IRQCHIP_NUM_PRIO_BITS) - 1),
-            VIRT_PLIC_PRIORITY_BASE,
-            VIRT_PLIC_PENDING_BASE,
-            VIRT_PLIC_ENABLE_BASE,
-            VIRT_PLIC_ENABLE_STRIDE,
-            VIRT_PLIC_CONTEXT_BASE,
-            VIRT_PLIC_CONTEXT_STRIDE,
-            memmap[VIRT_PLIC].size);
-
-    return ret;
+    return sifive_plic_create(
+             memmap[VIRT_PLIC].base + socket * memmap[VIRT_PLIC].size,
+             plic_hart_config, hart_count, base_hartid,
+             VIRT_IRQCHIP_NUM_SOURCES,
+             ((1U << VIRT_IRQCHIP_NUM_PRIO_BITS) - 1),
+             VIRT_PLIC_PRIORITY_BASE, VIRT_PLIC_PENDING_BASE,
+             VIRT_PLIC_ENABLE_BASE, VIRT_PLIC_ENABLE_STRIDE,
+             VIRT_PLIC_CONTEXT_BASE,
+             VIRT_PLIC_CONTEXT_STRIDE,
+             memmap[VIRT_PLIC].size);
 }
 
 static DeviceState *virt_create_aia(RISCVVirtAIAType aia_type, int aia_guests,
diff --git a/hw/scsi/esp.c b/hw/scsi/esp.c
index ac841dc32e..01bdfe2701 100644
--- a/hw/scsi/esp.c
+++ b/hw/scsi/esp.c
@@ -242,10 +242,7 @@ static uint32_t esp_get_stc(ESPState *s)
 
 static uint8_t esp_pdma_read(ESPState *s)
 {
-    uint8_t val;
-
-    val = esp_fifo_pop(s);
-    return val;
+    return esp_fifo_pop(s);
 }
 
 static void esp_pdma_write(ESPState *s, uint8_t val)
diff --git a/hw/vfio/common.c b/hw/vfio/common.c
index 1a0d9290f8..d8aad4e1ce 100644
--- a/hw/vfio/common.c
+++ b/hw/vfio/common.c
@@ -110,8 +110,6 @@ static bool vfio_multiple_devices_migration_is_supported(void)
 
 int vfio_block_multiple_devices_migration(VFIODevice *vbasedev, Error **errp)
 {
-    int ret;
-
     if (vfio_multiple_devices_migration_is_supported()) {
         return 0;
     }
@@ -129,9 +127,8 @@ int vfio_block_multiple_devices_migration(VFIODevice *vbasedev, Error **errp)
     error_setg(&multiple_devices_migration_blocker,
                "Multiple VFIO devices migration is supported only if all of "
                "them support P2P migration");
-    ret = migrate_add_blocker_normal(&multiple_devices_migration_blocker, errp);
-
-    return ret;
+    return migrate_add_blocker_normal(&multiple_devices_migration_blocker,
+                                      errp);
 }
 
 void vfio_unblock_multiple_devices_migration(void)
diff --git a/plugins/api.c b/plugins/api.c
index 604ce06802..3c9d4832e9 100644
--- a/plugins/api.c
+++ b/plugins/api.c
@@ -237,12 +237,10 @@ uint64_t qemu_plugin_tb_vaddr(const struct qemu_plugin_tb *tb)
 struct qemu_plugin_insn *
 qemu_plugin_tb_get_insn(const struct qemu_plugin_tb *tb, size_t idx)
 {
-    struct qemu_plugin_insn *insn;
     if (unlikely(idx >= tb->n)) {
         return NULL;
     }
-    insn = g_ptr_array_index(tb->insns, idx);
-    return insn;
+    return g_ptr_array_index(tb->insns, idx);
 }
 
 /*
diff --git a/tests/qtest/cmsdk-apb-watchdog-test.c b/tests/qtest/cmsdk-apb-watchdog-test.c
index 53538f98c9..cd0c602361 100644
--- a/tests/qtest/cmsdk-apb-watchdog-test.c
+++ b/tests/qtest/cmsdk-apb-watchdog-test.c
@@ -364,8 +364,6 @@ static void test_watchdog_inten_luminary(const void *ptr)
 
 int main(int argc, char **argv)
 {
-    int r;
-
     g_test_init(&argc, &argv, NULL);
     g_test_set_nonfatal_assertions();
 
@@ -393,7 +391,5 @@ int main(int argc, char **argv)
                             test_watchdog_inten);
     }
 
-    r = g_test_run();
-
-    return r;
+    return g_test_run();
 }
diff --git a/tests/qtest/pnv-host-i2c-test.c b/tests/qtest/pnv-host-i2c-test.c
index 7f64d597ac..51e613ebdc 100644
--- a/tests/qtest/pnv-host-i2c-test.c
+++ b/tests/qtest/pnv-host-i2c-test.c
@@ -191,12 +191,10 @@ static uint8_t pnv_i2c_pca9554_read_pins(PnvI2cDev *dev)
 {
     uint8_t send_buf[1];
     uint8_t recv_buf[1];
-    uint8_t inputs;
     send_buf[0] = PCA9554_INPUT;
     pnv_i2c_send(dev, send_buf, 1);
     pnv_i2c_recv(dev, recv_buf, 1);
-    inputs = recv_buf[0];
-    return inputs;
+    return recv_buf[0];
 }
 
 static void pnv_i2c_pca9554_flip_polarity(PnvI2cDev *dev)
diff --git a/tests/qtest/stm32l4x5_usart-test.c b/tests/qtest/stm32l4x5_usart-test.c
index 927bab6361..98a7472307 100644
--- a/tests/qtest/stm32l4x5_usart-test.c
+++ b/tests/qtest/stm32l4x5_usart-test.c
@@ -360,8 +360,6 @@ static void test_clock_enable(void)
 
 int main(int argc, char **argv)
 {
-    int ret;
-
     g_test_init(&argc, &argv, NULL);
     g_test_set_nonfatal_assertions();
 
@@ -372,8 +370,6 @@ int main(int argc, char **argv)
     qtest_add_func("stm32l4x5/usart/send_str", test_send_str);
     qtest_add_func("stm32l4x5/usart/ack", test_ack);
     qtest_add_func("stm32l4x5/usart/clock_enable", test_clock_enable);
-    ret = g_test_run();
-
-    return ret;
+    return g_test_run();
 }
 
diff --git a/tools/i386/qemu-vmsr-helper.c b/tools/i386/qemu-vmsr-helper.c
index a35dcb88a3..5f19a48cbd 100644
--- a/tools/i386/qemu-vmsr-helper.c
+++ b/tools/i386/qemu-vmsr-helper.c
@@ -71,7 +71,6 @@ static void compute_default_paths(void)
 
 static int is_intel_processor(void)
 {
-    int result;
     int ebx, ecx, edx;
 
     /* Execute CPUID instruction with eax=0 (basic identification) */
@@ -87,9 +86,7 @@ static int is_intel_processor(void)
      *  0x49656e69 = "ineI"
      *  0x6c65746e = "ntel"
      */
-    result = (ebx == 0x756e6547) && (edx == 0x49656e69) && (ecx == 0x6c65746e);
-
-    return result;
+    return (ebx == 0x756e6547) && (edx == 0x49656e69) && (ecx == 0x6c65746e);
 }
 
 static int is_rapl_enabled(void)

From 8a2b516ba2855c4530388051de2b8d17bc780ea8 Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Mon, 7 Apr 2025 10:26:42 +0200
Subject: [PATCH 0242/2760] cleanup: Drop pointless return at end of function

A few functions now end with a label.  The next commit will clean them
up.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250407082643.2310002-3-armbru@redhat.com>
[Straightforward conflict with commit 988ad4ccebb6 (hw/loongarch/virt:
Fix cpuslot::cpu set at last in virt_cpu_plug()) resolved]
---
 accel/tcg/cpu-exec.c                |  1 -
 block/gluster.c                     |  4 ----
 block/rbd.c                         |  1 -
 block/replication.c                 |  1 -
 block/throttle-groups.c             |  1 -
 bsd-user/signal.c                   |  1 -
 dump/win_dump.c                     |  2 --
 event-loop-base.c                   |  2 --
 hw/acpi/acpi-cpu-hotplug-stub.c     |  8 --------
 hw/acpi/acpi-mem-hotplug-stub.c     |  5 -----
 hw/acpi/acpi-nvdimm-stub.c          |  1 -
 hw/acpi/acpi-pci-hotplug-stub.c     |  6 ------
 hw/arm/exynos4210.c                 |  1 -
 hw/arm/smmu-common.c                |  1 -
 hw/arm/xen-stubs.c                  |  1 -
 hw/audio/asc.c                      |  1 -
 hw/core/qdev-properties-system.c    |  1 -
 hw/cxl/cxl-host.c                   |  2 --
 hw/display/macfb.c                  |  1 -
 hw/display/tcx.c                    |  1 -
 hw/display/virtio-gpu-base.c        |  1 -
 hw/dma/sifive_pdma.c                |  1 -
 hw/gpio/aspeed_gpio.c               |  5 -----
 hw/gpio/bcm2838_gpio.c              |  1 -
 hw/gpio/imx_gpio.c                  |  2 --
 hw/gpio/pl061.c                     |  1 -
 hw/hyperv/vmbus.c                   |  1 -
 hw/i2c/pm_smbus.c                   |  1 -
 hw/i386/intel_iommu.c               |  2 --
 hw/i386/nitro_enclave.c             |  1 -
 hw/i386/xen/xen-hvm.c               |  2 --
 hw/input/virtio-input-host.c        |  1 -
 hw/intc/arm_gicv3_cpuif.c           |  1 -
 hw/intc/aspeed_intc.c               |  4 ----
 hw/intc/mips_gic.c                  |  1 -
 hw/ipmi/ipmi_bmc_extern.c           |  2 --
 hw/ipmi/ipmi_bmc_sim.c              |  2 --
 hw/ipmi/ipmi_bt.c                   |  1 -
 hw/ipmi/ipmi_kcs.c                  |  1 -
 hw/loongarch/virt.c                 |  2 --
 hw/m68k/next-cube.c                 |  1 -
 hw/m68k/q800.c                      |  2 --
 hw/mem/cxl_type3.c                  |  4 ----
 hw/mem/sparse-mem.c                 |  1 -
 hw/misc/i2c-echo.c                  |  2 --
 hw/misc/ivshmem-flat.c              |  2 --
 hw/misc/mips_cpc.c                  |  2 --
 hw/net/can/ctucan_core.c            |  2 --
 hw/net/can/xlnx-versal-canfd.c      |  2 --
 hw/net/imx_fec.c                    |  1 -
 hw/net/vmxnet3.c                    |  1 -
 hw/nvram/xlnx-versal-efuse-ctrl.c   |  1 -
 hw/ppc/mac_newworld.c               |  2 --
 hw/ppc/pnv_occ.c                    |  1 -
 hw/ppc/spapr_hcall.c                |  1 -
 hw/ppc/spapr_nested.c               |  1 -
 hw/ppc/spapr_nvdimm.c               |  2 --
 hw/s390x/s390-pci-bus.c             |  1 -
 hw/s390x/s390-pci-vfio.c            |  2 --
 hw/scsi/megasas.c                   |  1 -
 hw/scsi/vhost-scsi.c                |  1 -
 hw/ssi/ibex_spi_host.c              |  1 -
 hw/ssi/pnv_spi.c                    |  2 --
 hw/tpm/tpm_tis_i2c.c                |  4 ----
 hw/usb/dev-mtp.c                    |  2 --
 hw/usb/dev-serial.c                 |  2 --
 hw/usb/dev-smartcard-reader.c       |  1 -
 hw/usb/dev-uas.c                    |  1 -
 hw/vfio/display.c                   |  1 -
 hw/vfio/pci.c                       |  1 -
 hw/vfio/platform.c                  |  1 -
 hw/virtio/vhost-user-fs.c           |  1 -
 hw/virtio/vhost-user-scmi.c         |  2 --
 hw/virtio/vhost-user-vsock.c        |  1 -
 hw/virtio/vhost-user.c              |  2 --
 hw/virtio/vhost-vdpa.c              |  2 --
 hw/virtio/vhost.c                   |  1 -
 hw/virtio/virtio-nsm.c              |  1 -
 hw/virtio/virtio.c                  |  2 --
 hw/watchdog/sbsa_gwdt.c             |  1 -
 hw/watchdog/wdt_aspeed.c            |  1 -
 include/system/os-win32.h           |  1 -
 linux-user/xtensa/signal.c          |  1 -
 migration/multifd-nocomp.c          |  1 -
 migration/qemu-file.c               |  2 --
 migration/ram.c                     |  2 --
 net/colo-compare.c                  |  2 --
 qemu-keymap.c                       |  1 -
 qga/commands-win32.c                |  4 ----
 system/dirtylimit.c                 |  2 --
 target/arm/tcg/helper-a64.c         |  2 --
 target/i386/kvm/vmsr_energy.c       |  1 -
 target/i386/tcg/translate.c         |  1 -
 target/i386/whpx/whpx-all.c         | 11 -----------
 target/m68k/helper.c                |  1 -
 target/mips/tcg/system/mips-semi.c  |  1 -
 target/ppc/kvm.c                    |  1 -
 target/ppc/kvm_ppc.h                |  3 ---
 target/ppc/translate.c              |  1 -
 target/riscv/debug.c                |  6 ------
 target/s390x/cpu_models.c           |  1 -
 target/sh4/translate.c              |  1 -
 tests/qtest/ahci-test.c             |  1 -
 tests/qtest/fuzz/generic_fuzz.c     |  1 -
 tests/qtest/libqos/libqos-malloc.c  |  1 -
 tests/qtest/libqtest.c              |  1 -
 tests/qtest/test-x86-cpuid-compat.c |  1 -
 tests/unit/socket-helpers.c         |  1 -
 tests/unit/test-qgraph.c            |  1 -
 ui/input-linux.c                    |  1 -
 ui/vnc.c                            |  2 --
 util/main-loop.c                    |  1 -
 util/qht.c                          |  1 -
 113 files changed, 196 deletions(-)

diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index ef3d967e3a..8e28136392 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -665,7 +665,6 @@ static inline void tb_add_jump(TranslationBlock *tb, int n,
 
  out_unlock_next:
     qemu_spin_unlock(&tb_next->jmp_lock);
-    return;
 }
 
 static inline bool cpu_handle_halt(CPUState *cpu)
diff --git a/block/gluster.c b/block/gluster.c
index c6d25ae733..8712aa606a 100644
--- a/block/gluster.c
+++ b/block/gluster.c
@@ -972,8 +972,6 @@ static void qemu_gluster_reopen_commit(BDRVReopenState *state)
 
     g_free(state->opaque);
     state->opaque = NULL;
-
-    return;
 }
 
 
@@ -993,8 +991,6 @@ static void qemu_gluster_reopen_abort(BDRVReopenState *state)
 
     g_free(state->opaque);
     state->opaque = NULL;
-
-    return;
 }
 
 #ifdef CONFIG_GLUSTERFS_ZEROFILL
diff --git a/block/rbd.c b/block/rbd.c
index af984fb7db..7446e66659 100644
--- a/block/rbd.c
+++ b/block/rbd.c
@@ -254,7 +254,6 @@ static void qemu_rbd_parse_filename(const char *filename, QDict *options,
 done:
     g_free(buf);
     qobject_unref(keypairs);
-    return;
 }
 
 static int qemu_rbd_set_auth(rados_t cluster, BlockdevOptionsRbd *opts,
diff --git a/block/replication.c b/block/replication.c
index 0020f33843..d6625c51fe 100644
--- a/block/replication.c
+++ b/block/replication.c
@@ -176,7 +176,6 @@ static void replication_child_perm(BlockDriverState *bs, BdrvChild *c,
     *nshared = BLK_PERM_CONSISTENT_READ
                | BLK_PERM_WRITE
                | BLK_PERM_WRITE_UNCHANGED;
-    return;
 }
 
 static int64_t coroutine_fn GRAPH_RDLOCK
diff --git a/block/throttle-groups.c b/block/throttle-groups.c
index 32553b39e3..9f4d252c74 100644
--- a/block/throttle-groups.c
+++ b/block/throttle-groups.c
@@ -908,7 +908,6 @@ unlock:
     qemu_mutex_unlock(&tg->lock);
     qapi_free_ThrottleLimits(argp);
     error_propagate(errp, local_err);
-    return;
 }
 
 static void throttle_group_get_limits(Object *obj, Visitor *v,
diff --git a/bsd-user/signal.c b/bsd-user/signal.c
index a8cfcca130..1aa0fd79d6 100644
--- a/bsd-user/signal.c
+++ b/bsd-user/signal.c
@@ -441,7 +441,6 @@ void queue_signal(CPUArchState *env, int sig, int si_type,
     ts->sync_signal.pending = sig;
     /* Signal that a new signal is pending. */
     qatomic_set(&ts->signal_pending, 1);
-    return;
 }
 
 static int fatal_signal(int sig)
diff --git a/dump/win_dump.c b/dump/win_dump.c
index 2c2576672a..3162e8bd48 100644
--- a/dump/win_dump.c
+++ b/dump/win_dump.c
@@ -476,8 +476,6 @@ out_free:
     g_free(saved_ctx);
 out_cr3:
     first_x86_cpu->env.cr[3] = saved_cr3;
-
-    return;
 }
 
 #else /* !TARGET_X86_64 */
diff --git a/event-loop-base.c b/event-loop-base.c
index 0cfb1c9496..ddf8400a6b 100644
--- a/event-loop-base.c
+++ b/event-loop-base.c
@@ -73,8 +73,6 @@ static void event_loop_base_set_param(Object *obj, Visitor *v,
     if (bc->update_params) {
         bc->update_params(base, errp);
     }
-
-    return;
 }
 
 static void event_loop_base_complete(UserCreatable *uc, Error **errp)
diff --git a/hw/acpi/acpi-cpu-hotplug-stub.c b/hw/acpi/acpi-cpu-hotplug-stub.c
index c6c61bb9cd..9872dd55e4 100644
--- a/hw/acpi/acpi-cpu-hotplug-stub.c
+++ b/hw/acpi/acpi-cpu-hotplug-stub.c
@@ -10,47 +10,39 @@ void acpi_switch_to_modern_cphp(AcpiCpuHotplug *gpe_cpu,
                                 CPUHotplugState *cpuhp_state,
                                 uint16_t io_port)
 {
-    return;
 }
 
 void legacy_acpi_cpu_hotplug_init(MemoryRegion *parent, Object *owner,
                                   AcpiCpuHotplug *gpe_cpu, uint16_t base)
 {
-    return;
 }
 
 void cpu_hotplug_hw_init(MemoryRegion *as, Object *owner,
                          CPUHotplugState *state, hwaddr base_addr)
 {
-    return;
 }
 
 void acpi_cpu_ospm_status(CPUHotplugState *cpu_st, ACPIOSTInfoList ***list)
 {
-    return;
 }
 
 void acpi_cpu_plug_cb(HotplugHandler *hotplug_dev,
                       CPUHotplugState *cpu_st, DeviceState *dev, Error **errp)
 {
-    return;
 }
 
 void legacy_acpi_cpu_plug_cb(HotplugHandler *hotplug_dev,
                              AcpiCpuHotplug *g, DeviceState *dev, Error **errp)
 {
-    return;
 }
 
 void acpi_cpu_unplug_cb(CPUHotplugState *cpu_st,
                         DeviceState *dev, Error **errp)
 {
-    return;
 }
 
 void acpi_cpu_unplug_request_cb(HotplugHandler *hotplug_dev,
                                 CPUHotplugState *cpu_st,
                                 DeviceState *dev, Error **errp)
 {
-    return;
 }
diff --git a/hw/acpi/acpi-mem-hotplug-stub.c b/hw/acpi/acpi-mem-hotplug-stub.c
index 73a076a265..7ad0fdcdf2 100644
--- a/hw/acpi/acpi-mem-hotplug-stub.c
+++ b/hw/acpi/acpi-mem-hotplug-stub.c
@@ -7,29 +7,24 @@ const VMStateDescription vmstate_memory_hotplug;
 void acpi_memory_hotplug_init(MemoryRegion *as, Object *owner,
                               MemHotplugState *state, hwaddr io_base)
 {
-    return;
 }
 
 void acpi_memory_ospm_status(MemHotplugState *mem_st, ACPIOSTInfoList ***list)
 {
-    return;
 }
 
 void acpi_memory_plug_cb(HotplugHandler *hotplug_dev, MemHotplugState *mem_st,
                          DeviceState *dev, Error **errp)
 {
-    return;
 }
 
 void acpi_memory_unplug_cb(MemHotplugState *mem_st,
                            DeviceState *dev, Error **errp)
 {
-    return;
 }
 
 void acpi_memory_unplug_request_cb(HotplugHandler *hotplug_dev,
                                    MemHotplugState *mem_st,
                                    DeviceState *dev, Error **errp)
 {
-    return;
 }
diff --git a/hw/acpi/acpi-nvdimm-stub.c b/hw/acpi/acpi-nvdimm-stub.c
index 8baff9be6f..65f491d653 100644
--- a/hw/acpi/acpi-nvdimm-stub.c
+++ b/hw/acpi/acpi-nvdimm-stub.c
@@ -4,5 +4,4 @@
 
 void nvdimm_acpi_plug_cb(HotplugHandler *hotplug_dev, DeviceState *dev)
 {
-    return;
 }
diff --git a/hw/acpi/acpi-pci-hotplug-stub.c b/hw/acpi/acpi-pci-hotplug-stub.c
index dcee3ad7a1..b67b4a92da 100644
--- a/hw/acpi/acpi-pci-hotplug-stub.c
+++ b/hw/acpi/acpi-pci-hotplug-stub.c
@@ -7,37 +7,31 @@ const VMStateDescription vmstate_acpi_pcihp_pci_status;
 void acpi_pcihp_init(Object *owner, AcpiPciHpState *s, PCIBus *root_bus,
                      MemoryRegion *address_space_io, uint16_t io_base)
 {
-    return;
 }
 
 void acpi_pcihp_device_plug_cb(HotplugHandler *hotplug_dev, AcpiPciHpState *s,
                                DeviceState *dev, Error **errp)
 {
-    return;
 }
 
 void acpi_pcihp_device_pre_plug_cb(HotplugHandler *hotplug_dev,
                                    DeviceState *dev, Error **errp)
 {
-    return;
 }
 
 void acpi_pcihp_device_unplug_cb(HotplugHandler *hotplug_dev, AcpiPciHpState *s,
                                  DeviceState *dev, Error **errp)
 {
-    return;
 }
 
 void acpi_pcihp_device_unplug_request_cb(HotplugHandler *hotplug_dev,
                                          AcpiPciHpState *s, DeviceState *dev,
                                          Error **errp)
 {
-    return;
 }
 
 void acpi_pcihp_reset(AcpiPciHpState *s)
 {
-    return;
 }
 
 bool acpi_pcihp_is_hotpluggbale_bus(AcpiPciHpState *s, BusState *bus)
diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index b452470598..0c27588116 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -462,7 +462,6 @@ static uint64_t exynos4210_chipid_and_omr_read(void *opaque, hwaddr offset,
 static void exynos4210_chipid_and_omr_write(void *opaque, hwaddr offset,
                                             uint64_t value, unsigned size)
 {
-    return;
 }
 
 static const MemoryRegionOps exynos4210_chipid_and_omr_ops = {
diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c
index 6e720e1b9a..1aa2eabfbd 100644
--- a/hw/arm/smmu-common.c
+++ b/hw/arm/smmu-common.c
@@ -712,7 +712,6 @@ static void combine_tlb(SMMUTLBEntry *tlbe, SMMUTLBEntry *tlbe_s2,
     tlbe->entry.iova = iova & ~tlbe->entry.addr_mask;
     /* parent_perm has s2 perm while perm keeps s1 perm. */
     tlbe->parent_perm = tlbe_s2->entry.perm;
-    return;
 }
 
 /**
diff --git a/hw/arm/xen-stubs.c b/hw/arm/xen-stubs.c
index 5551584dc2..6a83043553 100644
--- a/hw/arm/xen-stubs.c
+++ b/hw/arm/xen-stubs.c
@@ -14,7 +14,6 @@
 void arch_handle_ioreq(XenIOState *state, ioreq_t *req)
 {
     hw_error("Invalid ioreq type 0x%x\n", req->type);
-    return;
 }
 
 void arch_xen_set_memory(XenIOState *state, MemoryRegionSection *section,
diff --git a/hw/audio/asc.c b/hw/audio/asc.c
index cc205bf063..cea7a1c053 100644
--- a/hw/audio/asc.c
+++ b/hw/audio/asc.c
@@ -406,7 +406,6 @@ static void asc_fifo_write(void *opaque, hwaddr addr, uint64_t value,
     } else {
         fs->fifo[addr] = value;
     }
-    return;
 }
 
 static const MemoryRegionOps asc_fifo_ops = {
diff --git a/hw/core/qdev-properties-system.c b/hw/core/qdev-properties-system.c
index a7dde73c29..8e11e6388b 100644
--- a/hw/core/qdev-properties-system.c
+++ b/hw/core/qdev-properties-system.c
@@ -793,7 +793,6 @@ separator_error:
     error_setg(errp, "reserved region fields must be separated with ':'");
 out:
     g_free(str);
-    return;
 }
 
 const PropertyInfo qdev_prop_reserved_region = {
diff --git a/hw/cxl/cxl-host.c b/hw/cxl/cxl-host.c
index 2c6b43cd0d..e010163174 100644
--- a/hw/cxl/cxl-host.c
+++ b/hw/cxl/cxl-host.c
@@ -67,8 +67,6 @@ static void cxl_fixed_memory_window_config(CXLState *cxl_state,
 
     cxl_state->fixed_windows = g_list_append(cxl_state->fixed_windows,
                                              g_steal_pointer(&fw));
-
-    return;
 }
 
 void cxl_fmws_link_targets(CXLState *cxl_state, Error **errp)
diff --git a/hw/display/macfb.c b/hw/display/macfb.c
index e83fc863be..b08eb06cbd 100644
--- a/hw/display/macfb.c
+++ b/hw/display/macfb.c
@@ -383,7 +383,6 @@ static void macfb_sense_write(MacfbState *s, uint32_t val)
     s->regs[DAFB_MODE_SENSE >> 2] = val;
 
     trace_macfb_sense_write(val);
-    return;
 }
 
 static void macfb_update_mode(MacfbState *s)
diff --git a/hw/display/tcx.c b/hw/display/tcx.c
index 2cfc1e8f01..5968d33e48 100644
--- a/hw/display/tcx.c
+++ b/hw/display/tcx.c
@@ -729,7 +729,6 @@ static uint64_t tcx_dummy_readl(void *opaque, hwaddr addr,
 static void tcx_dummy_writel(void *opaque, hwaddr addr,
                          uint64_t val, unsigned size)
 {
-    return;
 }
 
 static const MemoryRegionOps tcx_dummy_ops = {
diff --git a/hw/display/virtio-gpu-base.c b/hw/display/virtio-gpu-base.c
index 7827536ac4..321a6f4998 100644
--- a/hw/display/virtio-gpu-base.c
+++ b/hw/display/virtio-gpu-base.c
@@ -110,7 +110,6 @@ static void virtio_gpu_ui_info(void *opaque, uint32_t idx, QemuUIInfo *info)
 
     /* send event to guest */
     virtio_gpu_notify_event(g, VIRTIO_GPU_EVENT_DISPLAY);
-    return;
 }
 
 static void
diff --git a/hw/dma/sifive_pdma.c b/hw/dma/sifive_pdma.c
index 25b3d6a155..a115af8d60 100644
--- a/hw/dma/sifive_pdma.c
+++ b/hw/dma/sifive_pdma.c
@@ -152,7 +152,6 @@ done:
 error:
     s->chan[ch].state = DMA_CHAN_STATE_ERROR;
     s->chan[ch].control |= CONTROL_ERR;
-    return;
 }
 
 static inline void sifive_pdma_update_irq(SiFivePDMAState *s, int ch)
diff --git a/hw/gpio/aspeed_gpio.c b/hw/gpio/aspeed_gpio.c
index a5b3f454e8..aedaf5238b 100644
--- a/hw/gpio/aspeed_gpio.c
+++ b/hw/gpio/aspeed_gpio.c
@@ -800,7 +800,6 @@ static void aspeed_gpio_write_index_mode(void *opaque, hwaddr offset,
         return;
     }
     aspeed_gpio_update(s, set, set->data_value, UINT32_MAX);
-    return;
 }
 
 static void aspeed_gpio_write(void *opaque, hwaddr offset, uint64_t data,
@@ -928,7 +927,6 @@ static void aspeed_gpio_write(void *opaque, hwaddr offset, uint64_t data,
         return;
     }
     aspeed_gpio_update(s, set, set->data_value, UINT32_MAX);
-    return;
 }
 
 static int get_set_idx(AspeedGPIOState *s, const char *group, int *group_idx)
@@ -1183,7 +1181,6 @@ static void aspeed_gpio_2700_write_control_reg(AspeedGPIOState *s,
     }
 
     aspeed_gpio_update(s, set, set->data_value, UINT32_MAX);
-    return;
 }
 
 static uint64_t aspeed_gpio_2700_read(void *opaque, hwaddr offset,
@@ -1308,8 +1305,6 @@ static void aspeed_gpio_2700_write(void *opaque, hwaddr offset,
                       PRIx64"\n", __func__, offset);
         break;
     }
-
-    return;
 }
 
 /* Setup functions */
diff --git a/hw/gpio/bcm2838_gpio.c b/hw/gpio/bcm2838_gpio.c
index 0a1739fc46..53be8f2d23 100644
--- a/hw/gpio/bcm2838_gpio.c
+++ b/hw/gpio/bcm2838_gpio.c
@@ -293,7 +293,6 @@ static void bcm2838_gpio_write(void *opaque, hwaddr offset, uint64_t value,
         qemu_log_mask(LOG_GUEST_ERROR, "%s: %s: bad offset %"HWADDR_PRIx"\n",
                   TYPE_BCM2838_GPIO, __func__, offset);
     }
-    return;
 }
 
 static void bcm2838_gpio_reset(DeviceState *dev)
diff --git a/hw/gpio/imx_gpio.c b/hw/gpio/imx_gpio.c
index 549a281ed7..8c8299c4c4 100644
--- a/hw/gpio/imx_gpio.c
+++ b/hw/gpio/imx_gpio.c
@@ -257,8 +257,6 @@ static void imx_gpio_write(void *opaque, hwaddr offset, uint64_t value,
                       HWADDR_PRIx "\n", TYPE_IMX_GPIO, __func__, offset);
         break;
     }
-
-    return;
 }
 
 static const MemoryRegionOps imx_gpio_ops = {
diff --git a/hw/gpio/pl061.c b/hw/gpio/pl061.c
index 60ce4a7f62..2e69785f2a 100644
--- a/hw/gpio/pl061.c
+++ b/hw/gpio/pl061.c
@@ -443,7 +443,6 @@ static void pl061_write(void *opaque, hwaddr offset,
         return;
     }
     pl061_update(s);
-    return;
 }
 
 static void pl061_enter_reset(Object *obj, ResetType type)
diff --git a/hw/hyperv/vmbus.c b/hw/hyperv/vmbus.c
index 12a7dc4312..f195e56c83 100644
--- a/hw/hyperv/vmbus.c
+++ b/hw/hyperv/vmbus.c
@@ -2073,7 +2073,6 @@ static void send_unload(VMBus *vmbus)
     qemu_mutex_unlock(&vmbus->rx_queue_lock);
 
     post_msg(vmbus, &msg, sizeof(msg));
-    return;
 }
 
 static bool complete_unload(VMBus *vmbus)
diff --git a/hw/i2c/pm_smbus.c b/hw/i2c/pm_smbus.c
index 3eed8110b9..4e685fd26e 100644
--- a/hw/i2c/pm_smbus.c
+++ b/hw/i2c/pm_smbus.c
@@ -205,7 +205,6 @@ out:
 
 error:
     s->smb_stat |= STS_DEV_ERR;
-    return;
 }
 
 static void smb_transaction_start(PMSMBus *s)
diff --git a/hw/i386/intel_iommu.c b/hw/i386/intel_iommu.c
index dffd7ee885..0608aec8c5 100644
--- a/hw/i386/intel_iommu.c
+++ b/hw/i386/intel_iommu.c
@@ -4515,8 +4515,6 @@ static void vtd_iommu_replay(IOMMUMemoryRegion *iommu_mr, IOMMUNotifier *n)
         trace_vtd_replay_ce_invalid(bus_n, PCI_SLOT(vtd_as->devfn),
                                     PCI_FUNC(vtd_as->devfn));
     }
-
-    return;
 }
 
 static void vtd_cap_init(IntelIOMMUState *s)
diff --git a/hw/i386/nitro_enclave.c b/hw/i386/nitro_enclave.c
index a058608afc..4b69f265cc 100644
--- a/hw/i386/nitro_enclave.c
+++ b/hw/i386/nitro_enclave.c
@@ -203,7 +203,6 @@ static void x86_load_eif(X86MachineState *x86ms, FWCfgState *fw_cfg,
 
     unlink(machine->kernel_filename);
     unlink(machine->initrd_filename);
-    return;
 }
 
 static bool create_memfd_backend(MachineState *ms, const char *path,
diff --git a/hw/i386/xen/xen-hvm.c b/hw/i386/xen/xen-hvm.c
index d4516acec6..ceb2242aa7 100644
--- a/hw/i386/xen/xen-hvm.c
+++ b/hw/i386/xen/xen-hvm.c
@@ -758,6 +758,4 @@ void arch_handle_ioreq(XenIOState *state, ioreq_t *req)
     default:
         hw_error("Invalid ioreq type 0x%x\n", req->type);
     }
-
-    return;
 }
diff --git a/hw/input/virtio-input-host.c b/hw/input/virtio-input-host.c
index 8bfb17f3c4..b21a79046e 100644
--- a/hw/input/virtio-input-host.c
+++ b/hw/input/virtio-input-host.c
@@ -178,7 +178,6 @@ static void virtio_input_host_realize(DeviceState *dev, Error **errp)
 err_close:
     close(vih->fd);
     vih->fd = -1;
-    return;
 }
 
 static void virtio_input_host_unrealize(DeviceState *dev)
diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c
index de37465bc8..4b4cf09157 100644
--- a/hw/intc/arm_gicv3_cpuif.c
+++ b/hw/intc/arm_gicv3_cpuif.c
@@ -584,7 +584,6 @@ static void icv_ap_write(CPUARMState *env, const ARMCPRegInfo *ri,
     }
 
     gicv3_cpuif_virt_irq_fiq_update(cs);
-    return;
 }
 
 static uint64_t icv_bpr_read(CPUARMState *env, const ARMCPRegInfo *ri)
diff --git a/hw/intc/aspeed_intc.c b/hw/intc/aspeed_intc.c
index f17bf43925..bae7dc95ea 100644
--- a/hw/intc/aspeed_intc.c
+++ b/hw/intc/aspeed_intc.c
@@ -448,8 +448,6 @@ static void aspeed_intc_write(void *opaque, hwaddr offset, uint64_t data,
         s->regs[reg] = data;
         break;
     }
-
-    return;
 }
 
 static uint64_t aspeed_intcio_read(void *opaque, hwaddr offset,
@@ -496,8 +494,6 @@ static void aspeed_intcio_write(void *opaque, hwaddr offset, uint64_t data,
         s->regs[reg] = data;
         break;
     }
-
-    return;
 }
 
 
diff --git a/hw/intc/mips_gic.c b/hw/intc/mips_gic.c
index 5e3cbeabec..bd1dedd4b9 100644
--- a/hw/intc/mips_gic.c
+++ b/hw/intc/mips_gic.c
@@ -255,7 +255,6 @@ static void gic_write_vp(MIPSGICState *gic, uint32_t vp_index, hwaddr addr,
     return;
 bad_offset:
     qemu_log_mask(LOG_GUEST_ERROR, "Wrong GIC offset at 0x%" PRIx64 "\n", addr);
-    return;
 }
 
 static void gic_write(void *opaque, hwaddr addr, uint64_t data, unsigned size)
diff --git a/hw/ipmi/ipmi_bmc_extern.c b/hw/ipmi/ipmi_bmc_extern.c
index 3e9f8c5a50..22cb9b590b 100644
--- a/hw/ipmi/ipmi_bmc_extern.c
+++ b/hw/ipmi/ipmi_bmc_extern.c
@@ -142,7 +142,6 @@ static void continue_send(IPMIBmcExtern *ibe)
                          qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + 4000000000ULL);
         }
     }
-    return;
 }
 
 static void extern_timeout(void *opaque)
@@ -231,7 +230,6 @@ static void ipmi_bmc_extern_handle_command(IPMIBmc *b,
     continue_send(ibe);
 
  out:
-    return;
 }
 
 static void handle_hw_op(IPMIBmcExtern *ibe, unsigned char hw_op)
diff --git a/hw/ipmi/ipmi_bmc_sim.c b/hw/ipmi/ipmi_bmc_sim.c
index 1c60a71831..c6a85e8cd1 100644
--- a/hw/ipmi/ipmi_bmc_sim.c
+++ b/hw/ipmi/ipmi_bmc_sim.c
@@ -472,7 +472,6 @@ void ipmi_bmc_gen_event(IPMIBmc *b, uint8_t *evt, bool log)
     ibs->msg_flags |= IPMI_BMC_MSG_FLAG_EVT_BUF_FULL;
     k->set_atn(s, 1, attn_irq_enabled(ibs));
  out:
-    return;
 }
 static void gen_event(IPMIBmcSim *ibs, unsigned int sens_num, uint8_t deassert,
                       uint8_t evd1, uint8_t evd2, uint8_t evd3)
@@ -1014,7 +1013,6 @@ static void get_msg(IPMIBmcSim *ibs,
     }
 
 out:
-    return;
 }
 
 static unsigned char
diff --git a/hw/ipmi/ipmi_bt.c b/hw/ipmi/ipmi_bt.c
index 28cf6ab218..5cf12c59a8 100644
--- a/hw/ipmi/ipmi_bt.c
+++ b/hw/ipmi/ipmi_bt.c
@@ -146,7 +146,6 @@ static void ipmi_bt_handle_event(IPMIInterface *ii)
                            sizeof(ib->inmsg), ib->waiting_rsp);
     }
  out:
-    return;
 }
 
 static void ipmi_bt_handle_rsp(IPMIInterface *ii, uint8_t msg_id,
diff --git a/hw/ipmi/ipmi_kcs.c b/hw/ipmi/ipmi_kcs.c
index 578dd7cef3..ae549fb864 100644
--- a/hw/ipmi/ipmi_kcs.c
+++ b/hw/ipmi/ipmi_kcs.c
@@ -198,7 +198,6 @@ static void ipmi_kcs_handle_event(IPMIInterface *ii)
     ik->data_in_reg = -1;
     IPMI_KCS_SET_IBF(ik->status_reg, 0);
  out_noibf:
-    return;
 }
 
 static void ipmi_kcs_handle_rsp(IPMIInterface *ii, uint8_t msg_id,
diff --git a/hw/loongarch/virt.c b/hw/loongarch/virt.c
index 65c9027feb..b2793c803e 100644
--- a/hw/loongarch/virt.c
+++ b/hw/loongarch/virt.c
@@ -948,7 +948,6 @@ static void virt_cpu_unplug(HotplugHandler *hotplug_dev,
 
     cpu_slot = virt_find_cpu_slot(MACHINE(lvms), cpu->phy_id);
     cpu_slot->cpu = NULL;
-    return;
 }
 
 static void virt_cpu_plug(HotplugHandler *hotplug_dev,
@@ -973,7 +972,6 @@ static void virt_cpu_plug(HotplugHandler *hotplug_dev,
 
     cpu_slot = virt_find_cpu_slot(MACHINE(lvms), cpu->phy_id);
     cpu_slot->cpu = CPU(dev);
-    return;
 }
 
 static bool memhp_type_supported(DeviceState *dev)
diff --git a/hw/m68k/next-cube.c b/hw/m68k/next-cube.c
index 0570e4a76f..7ea7e91032 100644
--- a/hw/m68k/next-cube.c
+++ b/hw/m68k/next-cube.c
@@ -899,7 +899,6 @@ static void next_dummy_en_write(void *opaque, hwaddr addr, uint64_t val,
                                 unsigned size)
 {
     /* Do nothing */
-    return;
 }
 
 static uint64_t next_dummy_en_read(void *opaque, hwaddr addr, unsigned size)
diff --git a/hw/m68k/q800.c b/hw/m68k/q800.c
index aeed4c8ddb..1e5b0e21df 100644
--- a/hw/m68k/q800.c
+++ b/hw/m68k/q800.c
@@ -210,7 +210,6 @@ static uint64_t machine_id_read(void *opaque, hwaddr addr, unsigned size)
 static void machine_id_write(void *opaque, hwaddr addr, uint64_t val,
                              unsigned size)
 {
-    return;
 }
 
 static const MemoryRegionOps machine_id_ops = {
@@ -231,7 +230,6 @@ static uint64_t ramio_read(void *opaque, hwaddr addr, unsigned size)
 static void ramio_write(void *opaque, hwaddr addr, uint64_t val,
                         unsigned size)
 {
-    return;
 }
 
 static const MemoryRegionOps ramio_ops = {
diff --git a/hw/mem/cxl_type3.c b/hw/mem/cxl_type3.c
index 6fffa21ead..43aa02ab2a 100644
--- a/hw/mem/cxl_type3.c
+++ b/hw/mem/cxl_type3.c
@@ -957,7 +957,6 @@ err_free_special_ops:
     if (ct3d->hostvmem) {
         address_space_destroy(&ct3d->hostvmem_as);
     }
-    return;
 }
 
 static void ct3_exit(PCIDevice *pci_dev)
@@ -1511,8 +1510,6 @@ void qmp_cxl_inject_uncorrectable_errors(const char *path,
 
     stl_le_p(reg_state + R_CXL_RAS_UNC_ERR_STATUS, unc_err);
     pcie_aer_inject_error(PCI_DEVICE(obj), &err);
-
-    return;
 }
 
 void qmp_cxl_inject_correctable_error(const char *path, CxlCorErrorType type,
@@ -1788,7 +1785,6 @@ void qmp_cxl_inject_dram_event(const char *path, CxlEventLog log, uint8_t flags,
     if (cxl_event_insert(cxlds, enc_log, (CXLEventRecordRaw *)&dram)) {
         cxl_event_irq_assert(ct3d);
     }
-    return;
 }
 
 void qmp_cxl_inject_memory_module_event(const char *path, CxlEventLog log,
diff --git a/hw/mem/sparse-mem.c b/hw/mem/sparse-mem.c
index 6a9a591370..8bed5dbe16 100644
--- a/hw/mem/sparse-mem.c
+++ b/hw/mem/sparse-mem.c
@@ -82,7 +82,6 @@ static void sparse_mem_enter_reset(Object *obj, ResetType type)
 {
     SparseMemState *s = SPARSE_MEM(obj);
     g_hash_table_remove_all(s->mapped);
-    return;
 }
 
 static const MemoryRegionOps sparse_mem_ops = {
diff --git a/hw/misc/i2c-echo.c b/hw/misc/i2c-echo.c
index 65d10029dc..fcd407dfc6 100644
--- a/hw/misc/i2c-echo.c
+++ b/hw/misc/i2c-echo.c
@@ -143,8 +143,6 @@ static void i2c_echo_realize(DeviceState *dev, Error **errp)
 
     state->bus = I2C_BUS(bus);
     state->bh = qemu_bh_new(i2c_echo_bh, state);
-
-    return;
 }
 
 static void i2c_echo_class_init(ObjectClass *oc, void *data)
diff --git a/hw/misc/ivshmem-flat.c b/hw/misc/ivshmem-flat.c
index 40309a8ff3..a0ac7543a2 100644
--- a/hw/misc/ivshmem-flat.c
+++ b/hw/misc/ivshmem-flat.c
@@ -289,8 +289,6 @@ static void ivshmem_flat_iomem_write(void *opaque, hwaddr offset,
         trace_ivshmem_flat_read_write_mmr_invalid(offset);
         break;
     }
-
-    return;
 }
 
 static const MemoryRegionOps ivshmem_flat_ops = {
diff --git a/hw/misc/mips_cpc.c b/hw/misc/mips_cpc.c
index 772b8c0017..b7a13d1afb 100644
--- a/hw/misc/mips_cpc.c
+++ b/hw/misc/mips_cpc.c
@@ -92,8 +92,6 @@ static void cpc_write(void *opaque, hwaddr offset, uint64_t data,
                       "%s: Bad offset 0x%x\n",  __func__, (int)offset);
         break;
     }
-
-    return;
 }
 
 static uint64_t cpc_read(void *opaque, hwaddr offset, unsigned size)
diff --git a/hw/net/can/ctucan_core.c b/hw/net/can/ctucan_core.c
index 4402d4cb1f..17131a4e18 100644
--- a/hw/net/can/ctucan_core.c
+++ b/hw/net/can/ctucan_core.c
@@ -400,8 +400,6 @@ void ctucan_mem_write(CtuCanCoreState *s, hwaddr addr, uint64_t val,
 
         ctucan_update_irq(s);
     }
-
-    return;
 }
 
 uint64_t ctucan_mem_read(CtuCanCoreState *s, hwaddr addr, unsigned size)
diff --git a/hw/net/can/xlnx-versal-canfd.c b/hw/net/can/xlnx-versal-canfd.c
index dc242e9215..b5a4a4af7e 100644
--- a/hw/net/can/xlnx-versal-canfd.c
+++ b/hw/net/can/xlnx-versal-canfd.c
@@ -1298,8 +1298,6 @@ static void free_list(GSList *list)
     }
 
     g_slist_free(list);
-
-    return;
 }
 
 static GSList *prepare_tx_data(XlnxVersalCANFDState *s)
diff --git a/hw/net/imx_fec.c b/hw/net/imx_fec.c
index 0f0afda58a..b7c9ee0b9a 100644
--- a/hw/net/imx_fec.c
+++ b/hw/net/imx_fec.c
@@ -668,7 +668,6 @@ static void imx_default_write(IMXFECState *s, uint32_t index, uint32_t value)
 {
     qemu_log_mask(LOG_GUEST_ERROR, "[%s]%s: Bad address at offset 0x%"
                   PRIx32 "\n", TYPE_IMX_FEC, __func__, index * 4);
-    return;
 }
 
 static void imx_fec_write(IMXFECState *s, uint32_t index, uint32_t value)
diff --git a/hw/net/vmxnet3.c b/hw/net/vmxnet3.c
index 7abed66469..f370d4a2ec 100644
--- a/hw/net/vmxnet3.c
+++ b/hw/net/vmxnet3.c
@@ -932,7 +932,6 @@ static void vmxnet3_rx_update_descr(struct NetRxPkt *pkt,
 
 nocsum:
     rxcd->cnc = 1;
-    return;
 }
 
 static void
diff --git a/hw/nvram/xlnx-versal-efuse-ctrl.c b/hw/nvram/xlnx-versal-efuse-ctrl.c
index 3246eb3ca6..ff4d544ad6 100644
--- a/hw/nvram/xlnx-versal-efuse-ctrl.c
+++ b/hw/nvram/xlnx-versal-efuse-ctrl.c
@@ -494,7 +494,6 @@ static void efuse_rd_addr_postw(RegisterInfo *reg, uint64_t val64)
 
     ARRAY_FIELD_DP32(s->regs, EFUSE_ISR, RD_DONE, 1);
     efuse_imr_update_irq(s);
-    return;
 }
 
 static uint64_t efuse_cache_load_prew(RegisterInfo *reg, uint64_t val64)
diff --git a/hw/ppc/mac_newworld.c b/hw/ppc/mac_newworld.c
index 2d5309d6f5..8109e213a1 100644
--- a/hw/ppc/mac_newworld.c
+++ b/hw/ppc/mac_newworld.c
@@ -630,8 +630,6 @@ static void core99_instance_init(Object *obj)
     object_property_set_description(obj, "via",
                                     "Set VIA configuration. "
                                     "Valid values are cuda, pmu and pmu-adb");
-
-    return;
 }
 
 static const TypeInfo core99_machine_info = {
diff --git a/hw/ppc/pnv_occ.c b/hw/ppc/pnv_occ.c
index 177c5e514b..0c9d3daec2 100644
--- a/hw/ppc/pnv_occ.c
+++ b/hw/ppc/pnv_occ.c
@@ -150,7 +150,6 @@ static void pnv_occ_common_area_write(void *opaque, hwaddr addr,
                                              uint64_t val, unsigned width)
 {
     /* callback function defined to occ common area write */
-    return;
 }
 
 static const MemoryRegionOps pnv_occ_power8_xscom_ops = {
diff --git a/hw/ppc/spapr_hcall.c b/hw/ppc/spapr_hcall.c
index 406aea4ecb..29453a880e 100644
--- a/hw/ppc/spapr_hcall.c
+++ b/hw/ppc/spapr_hcall.c
@@ -981,7 +981,6 @@ static void spapr_check_setup_free_hpt(SpaprMachineState *spapr,
         /* RADIX->HASH || NOTHING->HASH : Allocate HPT */
         spapr_setup_hpt(spapr);
     }
-    return;
 }
 
 #define FLAGS_MASK              0x01FULL
diff --git a/hw/ppc/spapr_nested.c b/hw/ppc/spapr_nested.c
index 201f629203..3797220a29 100644
--- a/hw/ppc/spapr_nested.c
+++ b/hw/ppc/spapr_nested.c
@@ -1735,7 +1735,6 @@ static void exit_process_output_buffer(SpaprMachineState *spapr,
     getset_state(spapr, guest, vcpuid, &gsr);
 
     address_space_unmap(CPU(cpu)->as, gsb, len, true, len);
-    return;
 }
 
 static
diff --git a/hw/ppc/spapr_nvdimm.c b/hw/ppc/spapr_nvdimm.c
index 6f875d73b2..6e93ff9b33 100644
--- a/hw/ppc/spapr_nvdimm.c
+++ b/hw/ppc/spapr_nvdimm.c
@@ -235,8 +235,6 @@ void spapr_dt_persistent_memory(SpaprMachineState *spapr, void *fdt)
         spapr_dt_nvdimm(spapr, fdt, offset, nvdimm);
     }
     g_slist_free(nvdimms);
-
-    return;
 }
 
 static target_ulong h_scm_read_metadata(PowerPCCPU *cpu,
diff --git a/hw/s390x/s390-pci-bus.c b/hw/s390x/s390-pci-bus.c
index 2591ee49c1..d96819f1a4 100644
--- a/hw/s390x/s390-pci-bus.c
+++ b/hw/s390x/s390-pci-bus.c
@@ -597,7 +597,6 @@ static void s390_pci_iommu_replay(IOMMUMemoryRegion *iommu,
      * zpci device" construct. But when we support migration of vfio-pci
      * devices in future, we need to revisit this.
      */
-    return;
 }
 
 static S390PCIIOMMU *s390_pci_get_iommu(S390pciState *s, PCIBus *bus,
diff --git a/hw/s390x/s390-pci-vfio.c b/hw/s390x/s390-pci-vfio.c
index 6236ac7f1e..db152a6252 100644
--- a/hw/s390x/s390-pci-vfio.c
+++ b/hw/s390x/s390-pci-vfio.c
@@ -367,6 +367,4 @@ void s390_pci_get_clp_info(S390PCIBusDevice *pbdev)
     s390_pci_read_group(pbdev, info);
     s390_pci_read_util(pbdev, info);
     s390_pci_read_pfip(pbdev, info);
-
-    return;
 }
diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c
index 9f3b30e6ce..d56bfc711d 100644
--- a/hw/scsi/megasas.c
+++ b/hw/scsi/megasas.c
@@ -2226,7 +2226,6 @@ static uint64_t megasas_queue_read(void *opaque, hwaddr addr,
 static void megasas_queue_write(void *opaque, hwaddr addr,
                                uint64_t val, unsigned size)
 {
-    return;
 }
 
 static const MemoryRegionOps megasas_queue_ops = {
diff --git a/hw/scsi/vhost-scsi.c b/hw/scsi/vhost-scsi.c
index 8039d13fd9..66e0c21c22 100644
--- a/hw/scsi/vhost-scsi.c
+++ b/hw/scsi/vhost-scsi.c
@@ -314,7 +314,6 @@ static void vhost_scsi_realize(DeviceState *dev, Error **errp)
     if (vhostfd >= 0) {
         close(vhostfd);
     }
-    return;
 }
 
 static void vhost_scsi_unrealize(DeviceState *dev)
diff --git a/hw/ssi/ibex_spi_host.c b/hw/ssi/ibex_spi_host.c
index 46c7b633c2..6b28cda200 100644
--- a/hw/ssi/ibex_spi_host.c
+++ b/hw/ssi/ibex_spi_host.c
@@ -154,7 +154,6 @@ static void ibex_spi_host_reset(DeviceState *dev)
     ibex_spi_txfifo_reset(s);
 
     s->init_status = true;
-    return;
 }
 
 /*
diff --git a/hw/ssi/pnv_spi.c b/hw/ssi/pnv_spi.c
index 126070393e..367a2ff3bb 100644
--- a/hw/ssi/pnv_spi.c
+++ b/hw/ssi/pnv_spi.c
@@ -996,7 +996,6 @@ static void operation_sequencer(PnvSpi *s)
     } /* end of while */
     /* Update sequencer index field in status.*/
     s->status = SETFIELD(SPI_STS_SEQ_INDEX, s->status, seq_index);
-    return;
 } /* end of operation_sequencer() */
 
 /*
@@ -1142,7 +1141,6 @@ static void pnv_spi_xscom_write(void *opaque, hwaddr addr,
         qemu_log_mask(LOG_GUEST_ERROR, "pnv_spi_regs: Invalid xscom "
                  "write at 0x%" PRIx32 "\n", reg);
     }
-    return;
 }
 
 static const MemoryRegionOps pnv_spi_xscom_ops = {
diff --git a/hw/tpm/tpm_tis_i2c.c b/hw/tpm/tpm_tis_i2c.c
index 504328e3b0..92d3de1ea3 100644
--- a/hw/tpm/tpm_tis_i2c.c
+++ b/hw/tpm/tpm_tis_i2c.c
@@ -211,8 +211,6 @@ static inline void tpm_tis_i2c_clear_data(TPMStateI2C *i2cst)
     i2cst->tis_addr = 0xffffffff;
     i2cst->reg_name = NULL;
     memset(i2cst->data, 0, sizeof(i2cst->data));
-
-    return;
 }
 
 /* Send data to TPM */
@@ -281,8 +279,6 @@ static inline void tpm_tis_i2c_tpm_send(TPMStateI2C *i2cst)
 
         tpm_tis_i2c_clear_data(i2cst);
     }
-
-    return;
 }
 
 /* Callback from TPM to indicate that response is copied */
diff --git a/hw/usb/dev-mtp.c b/hw/usb/dev-mtp.c
index 326c92a43d..4cd14c3df4 100644
--- a/hw/usb/dev-mtp.c
+++ b/hw/usb/dev-mtp.c
@@ -1234,8 +1234,6 @@ static void usb_mtp_object_delete(MTPState *s, uint32_t handle,
     default:
         g_assert_not_reached();
     }
-
-    return;
 }
 
 static void usb_mtp_command(MTPState *s, MTPControl *c)
diff --git a/hw/usb/dev-serial.c b/hw/usb/dev-serial.c
index aa50a92e26..31f6cf5b31 100644
--- a/hw/usb/dev-serial.c
+++ b/hw/usb/dev-serial.c
@@ -472,8 +472,6 @@ static void usb_serial_token_in(USBSerialState *s, USBPacket *p)
         s->recv_ptr = (s->recv_ptr + len) % RECV_BUF;
         packet_len -= len + 2;
     }
-
-    return;
 }
 
 static void usb_serial_handle_data(USBDevice *dev, USBPacket *p)
diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c
index 73deb3ce83..84ca8c48e2 100644
--- a/hw/usb/dev-smartcard-reader.c
+++ b/hw/usb/dev-smartcard-reader.c
@@ -1069,7 +1069,6 @@ static void ccid_handle_bulk_out(USBCCIDState *s, USBPacket *p)
 err:
     p->status = USB_RET_STALL;
     s->bulk_out_pos = 0;
-    return;
 }
 
 static void ccid_bulk_in_copy_to_guest(USBCCIDState *s, USBPacket *p,
diff --git a/hw/usb/dev-uas.c b/hw/usb/dev-uas.c
index 44e30013d7..b1d6b6ecc3 100644
--- a/hw/usb/dev-uas.c
+++ b/hw/usb/dev-uas.c
@@ -914,7 +914,6 @@ static void usb_uas_handle_data(USBDevice *dev, USBPacket *p)
 err_stream:
     error_report("%s: invalid stream %d", __func__, p->stream);
     p->status = USB_RET_STALL;
-    return;
 }
 
 static void usb_uas_unrealize(USBDevice *dev)
diff --git a/hw/vfio/display.c b/hw/vfio/display.c
index ea87830fe0..4fdcef505d 100644
--- a/hw/vfio/display.c
+++ b/hw/vfio/display.c
@@ -104,7 +104,6 @@ static void vfio_display_edid_update(VFIOPCIDevice *vdev, bool enabled,
 
 err:
     trace_vfio_display_edid_write_error();
-    return;
 }
 
 static void vfio_display_edid_ui_info(void *opaque, uint32_t idx,
diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index 7f1532fbed..f87f3ccbe1 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -2383,7 +2383,6 @@ static void vfio_add_ext_cap(VFIOPCIDevice *vdev)
     }
 
     g_free(config);
-    return;
 }
 
 static bool vfio_add_capabilities(VFIOPCIDevice *vdev, Error **errp)
diff --git a/hw/vfio/platform.c b/hw/vfio/platform.c
index 67bc57409c..7b4e100e27 100644
--- a/hw/vfio/platform.c
+++ b/hw/vfio/platform.c
@@ -418,7 +418,6 @@ fail_vfio:
     abort();
 fail_irqfd:
     vfio_start_eventfd_injection(sbdev, irq);
-    return;
 }
 
 /* VFIO skeleton */
diff --git a/hw/virtio/vhost-user-fs.c b/hw/virtio/vhost-user-fs.c
index 3f00d79ed0..0e8d4b3823 100644
--- a/hw/virtio/vhost-user-fs.c
+++ b/hw/virtio/vhost-user-fs.c
@@ -267,7 +267,6 @@ err_virtio:
     g_free(fs->req_vqs);
     virtio_cleanup(vdev);
     g_free(fs->vhost_dev.vqs);
-    return;
 }
 
 static void vuf_device_unrealize(DeviceState *dev)
diff --git a/hw/virtio/vhost-user-scmi.c b/hw/virtio/vhost-user-scmi.c
index 410a936ca7..04cd36dd2e 100644
--- a/hw/virtio/vhost-user-scmi.c
+++ b/hw/virtio/vhost-user-scmi.c
@@ -258,8 +258,6 @@ static void vu_scmi_device_realize(DeviceState *dev, Error **errp)
 
     qemu_chr_fe_set_handlers(&scmi->chardev, NULL, NULL, vu_scmi_event, NULL,
                              dev, NULL, true);
-
-    return;
 }
 
 static void vu_scmi_device_unrealize(DeviceState *dev)
diff --git a/hw/virtio/vhost-user-vsock.c b/hw/virtio/vhost-user-vsock.c
index 293273080b..d21cd4b516 100644
--- a/hw/virtio/vhost-user-vsock.c
+++ b/hw/virtio/vhost-user-vsock.c
@@ -128,7 +128,6 @@ err_vhost_dev:
 err_virtio:
     vhost_vsock_common_unrealize(vdev);
     vhost_user_cleanup(&vsock->vhost_user);
-    return;
 }
 
 static void vuv_device_unrealize(DeviceState *dev)
diff --git a/hw/virtio/vhost-user.c b/hw/virtio/vhost-user.c
index 267b612587..fdc01ab99e 100644
--- a/hw/virtio/vhost-user.c
+++ b/hw/virtio/vhost-user.c
@@ -654,8 +654,6 @@ static void scrub_shadow_regions(struct vhost_dev *dev,
     }
     *nr_rem_reg = rm_idx;
     *nr_add_reg = add_idx;
-
-    return;
 }
 
 static int send_remove_regions(struct vhost_dev *dev,
diff --git a/hw/virtio/vhost-vdpa.c b/hw/virtio/vhost-vdpa.c
index 7efbde3d4c..8b45756ae7 100644
--- a/hw/virtio/vhost-vdpa.c
+++ b/hw/virtio/vhost-vdpa.c
@@ -288,8 +288,6 @@ static void vhost_vdpa_iommu_region_add(MemoryListener *listener,
 
     QLIST_INSERT_HEAD(&s->iommu_list, iommu, iommu_next);
     memory_region_iommu_replay(iommu->iommu_mr, &iommu->n);
-
-    return;
 }
 
 static void vhost_vdpa_iommu_region_del(MemoryListener *listener,
diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c
index 6aa72fd434..4cae7c1664 100644
--- a/hw/virtio/vhost.c
+++ b/hw/virtio/vhost.c
@@ -732,7 +732,6 @@ out:
         memory_region_unref(old_sections[n_old_sections].mr);
     }
     g_free(old_sections);
-    return;
 }
 
 /* Adds the section data to the tmp_section structure.
diff --git a/hw/virtio/virtio-nsm.c b/hw/virtio/virtio-nsm.c
index b22aa74e34..accf7334e3 100644
--- a/hw/virtio/virtio-nsm.c
+++ b/hw/virtio/virtio-nsm.c
@@ -1609,7 +1609,6 @@ static void handle_input(VirtIODevice *vdev, VirtQueue *vq)
     if (in_elem) {
         virtqueue_detach_element(vq, in_elem, 0);
     }
-    return;
 }
 
 static uint64_t get_features(VirtIODevice *vdev, uint64_t f, Error **errp)
diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
index 85110bce37..ffc12635ae 100644
--- a/hw/virtio/virtio.c
+++ b/hw/virtio/virtio.c
@@ -3648,7 +3648,6 @@ static void virtio_queue_packed_restore_last_avail_idx(VirtIODevice *vdev,
                                                        int n)
 {
     /* We don't have a reference like avail idx in shared memory */
-    return;
 }
 
 static void virtio_queue_split_restore_last_avail_idx(VirtIODevice *vdev,
@@ -3673,7 +3672,6 @@ void virtio_queue_restore_last_avail_idx(VirtIODevice *vdev, int n)
 static void virtio_queue_packed_update_used_idx(VirtIODevice *vdev, int n)
 {
     /* used idx was updated through set_last_avail_idx() */
-    return;
 }
 
 static void virtio_queue_split_update_used_idx(VirtIODevice *vdev, int n)
diff --git a/hw/watchdog/sbsa_gwdt.c b/hw/watchdog/sbsa_gwdt.c
index 65ac42a187..1dd21392a9 100644
--- a/hw/watchdog/sbsa_gwdt.c
+++ b/hw/watchdog/sbsa_gwdt.c
@@ -174,7 +174,6 @@ static void sbsa_gwdt_write(void *opaque, hwaddr offset, uint64_t data,
         qemu_log_mask(LOG_GUEST_ERROR, "bad address in control frame write :"
                 " 0x%x\n", (int)offset);
     }
-    return;
 }
 
 static void wdt_sbsa_gwdt_reset(DeviceState *dev)
diff --git a/hw/watchdog/wdt_aspeed.c b/hw/watchdog/wdt_aspeed.c
index d94b83c109..a503b2aea7 100644
--- a/hw/watchdog/wdt_aspeed.c
+++ b/hw/watchdog/wdt_aspeed.c
@@ -225,7 +225,6 @@ static void aspeed_wdt_write(void *opaque, hwaddr offset, uint64_t data,
                       "%s: Out-of-bounds write at offset 0x%" HWADDR_PRIx "\n",
                       __func__, offset);
     }
-    return;
 }
 
 static const VMStateDescription vmstate_aspeed_wdt = {
diff --git a/include/system/os-win32.h b/include/system/os-win32.h
index bc623061d8..3aa6cee4c2 100644
--- a/include/system/os-win32.h
+++ b/include/system/os-win32.h
@@ -130,7 +130,6 @@ static inline int os_mlock(bool on_fault G_GNUC_UNUSED)
 
 static inline void os_setup_limits(void)
 {
-    return;
 }
 
 #define fsync _commit
diff --git a/linux-user/xtensa/signal.c b/linux-user/xtensa/signal.c
index 6514b8dd57..ef8b0c3a27 100644
--- a/linux-user/xtensa/signal.c
+++ b/linux-user/xtensa/signal.c
@@ -241,7 +241,6 @@ void setup_rt_frame(int sig, struct target_sigaction *ka,
 
 give_sigsegv:
     force_sigsegv(sig);
-    return;
 }
 
 static void restore_sigcontext(CPUXtensaState *env,
diff --git a/migration/multifd-nocomp.c b/migration/multifd-nocomp.c
index ffe75256c9..d0f38b410c 100644
--- a/migration/multifd-nocomp.c
+++ b/migration/multifd-nocomp.c
@@ -82,7 +82,6 @@ static void multifd_nocomp_send_cleanup(MultiFDSendParams *p, Error **errp)
 {
     g_free(p->iov);
     p->iov = NULL;
-    return;
 }
 
 static void multifd_ram_prepare_header(MultiFDSendParams *p)
diff --git a/migration/qemu-file.c b/migration/qemu-file.c
index 1303a5bf58..b6ac190034 100644
--- a/migration/qemu-file.c
+++ b/migration/qemu-file.c
@@ -561,8 +561,6 @@ void qemu_put_buffer_at(QEMUFile *f, const uint8_t *buf, size_t buflen,
     }
 
     stat64_add(&mig_stats.qemu_file_transferred, buflen);
-
-    return;
 }
 
 
diff --git a/migration/ram.c b/migration/ram.c
index 424df6d9f1..dc909f5eef 100644
--- a/migration/ram.c
+++ b/migration/ram.c
@@ -3963,8 +3963,6 @@ static void parse_ramblock_mapped_ram(QEMUFile *f, RAMBlock *block,
 
     /* Skip pages array */
     qemu_set_offset(f, block->pages_offset + length, SEEK_SET);
-
-    return;
 }
 
 static int parse_ramblock(QEMUFile *f, RAMBlock *block, ram_addr_t length)
diff --git a/net/colo-compare.c b/net/colo-compare.c
index 165610bfe2..893beed528 100644
--- a/net/colo-compare.c
+++ b/net/colo-compare.c
@@ -1328,8 +1328,6 @@ static void colo_compare_complete(UserCreatable *uc, Error **errp)
     }
     QTAILQ_INSERT_TAIL(&net_compares, s, next);
     qemu_mutex_unlock(&colo_compare_mutex);
-
-    return;
 }
 
 static void colo_flush_packets(void *opaque, void *user_data)
diff --git a/qemu-keymap.c b/qemu-keymap.c
index 6707067fea..1c081db287 100644
--- a/qemu-keymap.c
+++ b/qemu-keymap.c
@@ -116,7 +116,6 @@ static void walk_map(struct xkb_keymap *map, xkb_keycode_t code, void *data)
     if (kshift != kaltgrshift && kaltgr != kaltgrshift) {
         print_sym(kaltgrshift, qcode, " shift altgr");
     }
-    return;
 }
 
 static void usage(FILE *out)
diff --git a/qga/commands-win32.c b/qga/commands-win32.c
index 749fdf8895..d4482538ec 100644
--- a/qga/commands-win32.c
+++ b/qga/commands-win32.c
@@ -826,8 +826,6 @@ static void get_disk_properties(HANDLE vol_h, GuestDiskAddress *disk,
     }
 out_free:
     g_free(dev_desc);
-
-    return;
 }
 
 static void get_single_disk_info(int disk_number,
@@ -891,7 +889,6 @@ static void get_single_disk_info(int disk_number,
 
 err_close:
     CloseHandle(disk_h);
-    return;
 }
 
 /* VSS provider works with volumes, thus there is no difference if
@@ -2117,7 +2114,6 @@ static void ga_get_win_version(RTL_OSVERSIONINFOEXW *info, Error **errp)
 
     rtl_get_version_t rtl_get_version = (rtl_get_version_t)fun;
     rtl_get_version(info);
-    return;
 }
 
 static char *ga_get_win_name(const OSVERSIONINFOEXW *os_version, bool id)
diff --git a/system/dirtylimit.c b/system/dirtylimit.c
index 7dedef8dd4..1626fa5617 100644
--- a/system/dirtylimit.c
+++ b/system/dirtylimit.c
@@ -337,8 +337,6 @@ static void dirtylimit_adjust_throttle(CPUState *cpu)
     if (!dirtylimit_done(quota, current)) {
         dirtylimit_set_throttle(cpu, quota, current);
     }
-
-    return;
 }
 
 void dirtylimit_process(void)
diff --git a/target/arm/tcg/helper-a64.c b/target/arm/tcg/helper-a64.c
index 9244848efe..ad3c4f38a1 100644
--- a/target/arm/tcg/helper-a64.c
+++ b/target/arm/tcg/helper-a64.c
@@ -1147,7 +1147,6 @@ static void do_setp(CPUARMState *env, uint32_t syndrome, uint32_t mtedesc,
     env->ZF = 1; /* our env->ZF encoding is inverted */
     env->CF = 0;
     env->VF = 0;
-    return;
 }
 
 void HELPER(setp)(CPUARMState *env, uint32_t syndrome, uint32_t mtedesc)
@@ -1547,7 +1546,6 @@ static void do_cpyp(CPUARMState *env, uint32_t syndrome, uint32_t wdesc,
     env->ZF = 1; /* our env->ZF encoding is inverted */
     env->CF = 0;
     env->VF = 0;
-    return;
 }
 
 void HELPER(cpyp)(CPUARMState *env, uint32_t syndrome, uint32_t wdesc,
diff --git a/target/i386/kvm/vmsr_energy.c b/target/i386/kvm/vmsr_energy.c
index f499ec6e8b..d6aad5246b 100644
--- a/target/i386/kvm/vmsr_energy.c
+++ b/target/i386/kvm/vmsr_energy.c
@@ -284,7 +284,6 @@ void vmsr_read_thread_stat(pid_t pid,
     }
 
     fclose(file);
-    return;
 }
 
 /* Read QEMU stat task folder to retrieve all QEMU threads ID */
diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
index abe210cc4e..1bbf09aca7 100644
--- a/target/i386/tcg/translate.c
+++ b/target/i386/tcg/translate.c
@@ -3640,7 +3640,6 @@ static void gen_multi0F(DisasContext *s, X86DecodedInsn *decode)
     return;
  illegal_op:
     gen_illegal_opcode(s);
-    return;
 }
 
 #include "decode-new.c.inc"
diff --git a/target/i386/whpx/whpx-all.c b/target/i386/whpx/whpx-all.c
index 41fb8c5a4e..e44d044ecb 100644
--- a/target/i386/whpx/whpx-all.c
+++ b/target/i386/whpx/whpx-all.c
@@ -549,8 +549,6 @@ static void whpx_set_registers(CPUState *cpu, int level)
         error_report("WHPX: Failed to set virtual processor context, hr=%08lx",
                      hr);
     }
-
-    return;
 }
 
 static int whpx_get_tsc(CPUState *cpu)
@@ -771,8 +769,6 @@ static void whpx_get_registers(CPUState *cpu)
     }
 
     x86_update_hflags(env);
-
-    return;
 }
 
 static HRESULT CALLBACK whpx_emu_ioport_callback(
@@ -1570,8 +1566,6 @@ static void whpx_vcpu_pre_run(CPUState *cpu)
                          " hr=%08lx", hr);
         }
     }
-
-    return;
 }
 
 static void whpx_vcpu_post_run(CPUState *cpu)
@@ -1595,8 +1589,6 @@ static void whpx_vcpu_post_run(CPUState *cpu)
 
     vcpu->interruptable =
         !vcpu->exit_ctx.VpContext.ExecutionState.InterruptShadow;
-
-    return;
 }
 
 static void whpx_vcpu_process_async_events(CPUState *cpu)
@@ -1634,8 +1626,6 @@ static void whpx_vcpu_process_async_events(CPUState *cpu)
         apic_handle_tpr_access_report(x86_cpu->apic_state, env->eip,
                                       env->tpr_access_type);
     }
-
-    return;
 }
 
 static int whpx_vcpu_run(CPUState *cpu)
@@ -2280,7 +2270,6 @@ void whpx_destroy_vcpu(CPUState *cpu)
     whp_dispatch.WHvDeleteVirtualProcessor(whpx->partition, cpu->cpu_index);
     whp_dispatch.WHvEmulatorDestroyEmulator(vcpu->emulator);
     g_free(cpu->accel);
-    return;
 }
 
 void whpx_vcpu_kick(CPUState *cpu)
diff --git a/target/m68k/helper.c b/target/m68k/helper.c
index 0bf574830f..a37d3f6a96 100644
--- a/target/m68k/helper.c
+++ b/target/m68k/helper.c
@@ -290,7 +290,6 @@ void HELPER(m68k_movec_to)(CPUM68KState *env, uint32_t reg, uint32_t val)
 
     /* Invalid control registers will generate an exception. */
     raise_exception_ra(env, EXCP_ILLEGAL, 0);
-    return;
 }
 
 uint32_t HELPER(m68k_movec_from)(CPUM68KState *env, uint32_t reg)
diff --git a/target/mips/tcg/system/mips-semi.c b/target/mips/tcg/system/mips-semi.c
index df0c3256d9..e822a42614 100644
--- a/target/mips/tcg/system/mips-semi.c
+++ b/target/mips/tcg/system/mips-semi.c
@@ -374,5 +374,4 @@ void mips_semihosting(CPUMIPSState *env)
         error_report("Unknown UHI operation %d", op);
         abort();
     }
-    return;
 }
diff --git a/target/ppc/kvm.c b/target/ppc/kvm.c
index 992356cb75..80f6c185bc 100644
--- a/target/ppc/kvm.c
+++ b/target/ppc/kvm.c
@@ -1332,7 +1332,6 @@ int kvmppc_set_interrupt(PowerPCCPU *cpu, int irq, int level)
 
 void kvm_arch_pre_run(CPUState *cs, struct kvm_run *run)
 {
-    return;
 }
 
 MemTxAttrs kvm_arch_post_run(CPUState *cs, struct kvm_run *run)
diff --git a/target/ppc/kvm_ppc.h b/target/ppc/kvm_ppc.h
index a8768c1dfd..a1d9ce9f9a 100644
--- a/target/ppc/kvm_ppc.h
+++ b/target/ppc/kvm_ppc.h
@@ -221,7 +221,6 @@ static inline int kvmppc_smt_threads(void)
 
 static inline void kvmppc_error_append_smt_possible_hint(Error *const *errp)
 {
-    return;
 }
 
 static inline int kvmppc_set_smt_threads(int smt)
@@ -259,7 +258,6 @@ static inline target_ulong kvmppc_configure_v3_mmu(PowerPCCPU *cpu,
 static inline void kvmppc_set_reg_ppc_online(PowerPCCPU *cpu,
                                              unsigned int online)
 {
-    return;
 }
 
 static inline void kvmppc_set_reg_tb_offset(PowerPCCPU *cpu, int64_t tb_offset)
@@ -456,7 +454,6 @@ static inline PowerPCCPUClass *kvm_ppc_get_host_cpu_class(void)
 
 static inline void kvmppc_check_papr_resize_hpt(Error **errp)
 {
-    return;
 }
 
 static inline int kvmppc_resize_hpt_prepare(PowerPCCPU *cpu,
diff --git a/target/ppc/translate.c b/target/ppc/translate.c
index a52cbc869a..a9ff5020a2 100644
--- a/target/ppc/translate.c
+++ b/target/ppc/translate.c
@@ -3627,7 +3627,6 @@ static void pmu_count_insns(DisasContext *ctx)
 #else
 static void pmu_count_insns(DisasContext *ctx)
 {
-    return;
 }
 #endif /* #if defined(TARGET_PPC64) */
 
diff --git a/target/riscv/debug.c b/target/riscv/debug.c
index 9db4048523..198d051521 100644
--- a/target/riscv/debug.c
+++ b/target/riscv/debug.c
@@ -551,8 +551,6 @@ static void type2_reg_write(CPURISCVState *env, target_ulong index,
     default:
         g_assert_not_reached();
     }
-
-    return;
 }
 
 /* type 6 trigger */
@@ -667,8 +665,6 @@ static void type6_reg_write(CPURISCVState *env, target_ulong index,
     default:
         g_assert_not_reached();
     }
-
-    return;
 }
 
 /* icount trigger type */
@@ -849,8 +845,6 @@ static void itrigger_reg_write(CPURISCVState *env, target_ulong index,
     default:
         g_assert_not_reached();
     }
-
-    return;
 }
 
 static int itrigger_get_adjust_count(CPURISCVState *env)
diff --git a/target/s390x/cpu_models.c b/target/s390x/cpu_models.c
index 93a05e43d7..8e0b01dc65 100644
--- a/target/s390x/cpu_models.c
+++ b/target/s390x/cpu_models.c
@@ -578,7 +578,6 @@ static void check_compat_model_failed(Error **errp,
     error_setg(errp, "%s. Maximum supported model in the current configuration: \'%s\'",
                msg, max_model->def->name);
     error_append_hint(errp, "Consider a different accelerator, try \"-accel help\"\n");
-    return;
 }
 
 static bool check_compatibility(const S390CPUModel *max_model,
diff --git a/target/sh4/translate.c b/target/sh4/translate.c
index bcdd558818..57b972e14f 100644
--- a/target/sh4/translate.c
+++ b/target/sh4/translate.c
@@ -1792,7 +1792,6 @@ static void _decode_opc(DisasContext * ctx)
         gen_helper_raise_fpu_disable(tcg_env);
     }
     ctx->base.is_jmp = DISAS_NORETURN;
-    return;
 }
 
 static void decode_opc(DisasContext * ctx)
diff --git a/tests/qtest/ahci-test.c b/tests/qtest/ahci-test.c
index 88ac6c66ce..e8aabfc13f 100644
--- a/tests/qtest/ahci-test.c
+++ b/tests/qtest/ahci-test.c
@@ -1881,7 +1881,6 @@ static void test_io_interface(gconstpointer opaque)
     sector = offset_sector(opts->offset, opts->address_type, bufsize);
     test_io_rw_interface(opts->address_type, opts->io_type, bufsize, sector);
     g_free(opts);
-    return;
 }
 
 static void create_ahci_io_test(enum IOMode type, enum AddrMode addr,
diff --git a/tests/qtest/fuzz/generic_fuzz.c b/tests/qtest/fuzz/generic_fuzz.c
index d107a496da..b42473d1ce 100644
--- a/tests/qtest/fuzz/generic_fuzz.c
+++ b/tests/qtest/fuzz/generic_fuzz.c
@@ -572,7 +572,6 @@ static void op_add_dma_pattern(QTestState *s,
     pattern p = {a.index, a.stride, len - sizeof(a), data + sizeof(a)};
     p.index = a.index % p.len;
     g_array_append_val(dma_patterns, p);
-    return;
 }
 
 static void op_clear_dma_patterns(QTestState *s,
diff --git a/tests/qtest/libqos/libqos-malloc.c b/tests/qtest/libqos/libqos-malloc.c
index d7566972c4..c90f8f03f4 100644
--- a/tests/qtest/libqos/libqos-malloc.c
+++ b/tests/qtest/libqos/libqos-malloc.c
@@ -342,5 +342,4 @@ void migrate_allocator(QGuestAllocator *src,
     QTAILQ_INIT(src->free);
     node = mlist_new(src->start, src->end - src->start);
     QTAILQ_INSERT_HEAD(src->free, node, MLIST_ENTNAME);
-    return;
 }
diff --git a/tests/qtest/libqtest.c b/tests/qtest/libqtest.c
index fad307d125..358580361d 100644
--- a/tests/qtest/libqtest.c
+++ b/tests/qtest/libqtest.c
@@ -2022,7 +2022,6 @@ void qtest_client_inproc_recv(void *opaque, const char *str)
         qts->rx = g_string_new(NULL);
     }
     g_string_append(qts->rx, str);
-    return;
 }
 
 void qtest_qom_set_bool(QTestState *s, const char *path, const char *property,
diff --git a/tests/qtest/test-x86-cpuid-compat.c b/tests/qtest/test-x86-cpuid-compat.c
index b9603d46fa..c9de47bb26 100644
--- a/tests/qtest/test-x86-cpuid-compat.c
+++ b/tests/qtest/test-x86-cpuid-compat.c
@@ -193,7 +193,6 @@ static void add_feature_test(const char *name, const char *cpu,
     args->bitnr = bitnr;
     args->expected_value = expected_value;
     qtest_add_data_func(name, args, test_feature_flag);
-    return;
 }
 
 static void test_plus_minus_subprocess(void)
diff --git a/tests/unit/socket-helpers.c b/tests/unit/socket-helpers.c
index f3439cc4e5..37db24f72a 100644
--- a/tests/unit/socket-helpers.c
+++ b/tests/unit/socket-helpers.c
@@ -170,5 +170,4 @@ void socket_check_afunix_support(bool *has_afunix)
     if (*has_afunix) {
         close(fd);
     }
-    return;
 }
diff --git a/tests/unit/test-qgraph.c b/tests/unit/test-qgraph.c
index 334c76c8e7..ca1d60fc18 100644
--- a/tests/unit/test-qgraph.c
+++ b/tests/unit/test-qgraph.c
@@ -44,7 +44,6 @@ static void *driverfunct(void *obj, QGuestAllocator *machine, void *arg)
 
 static void testfunct(void *obj, void *arg, QGuestAllocator *alloc)
 {
-    return;
 }
 
 static void check_interface(const char *interface)
diff --git a/ui/input-linux.c b/ui/input-linux.c
index 381148ea99..203e264212 100644
--- a/ui/input-linux.c
+++ b/ui/input-linux.c
@@ -412,7 +412,6 @@ err_read_event_bits:
 
 err_close:
     close(il->fd);
-    return;
 }
 
 static void input_linux_instance_finalize(Object *obj)
diff --git a/ui/vnc.c b/ui/vnc.c
index 9241caaad9..9e097dc4b4 100644
--- a/ui/vnc.c
+++ b/ui/vnc.c
@@ -146,8 +146,6 @@ static void vnc_init_basic_info(SocketAddress *addr,
     default:
         abort();
     }
-
-    return;
 }
 
 static void vnc_init_basic_info_from_server_addr(QIOChannelSocket *ioc,
diff --git a/util/main-loop.c b/util/main-loop.c
index acad8c2e6c..979db51a1f 100644
--- a/util/main-loop.c
+++ b/util/main-loop.c
@@ -212,7 +212,6 @@ static void main_loop_init(EventLoopBase *base, Error **errp)
     main_loop_update_params(base, errp);
 
     mloop = m;
-    return;
 }
 
 static bool main_loop_can_be_deleted(EventLoopBase *base)
diff --git a/util/qht.c b/util/qht.c
index 92c6b78759..208c2f4b32 100644
--- a/util/qht.c
+++ b/util/qht.c
@@ -367,7 +367,6 @@ void qht_map_lock_buckets__no_stale(struct qht *ht, struct qht_map **pmap)
     qht_map_lock_buckets(map);
     qht_unlock(ht);
     *pmap = map;
-    return;
 }
 
 /*

From abb55b1abaaa8521e93d8202dd67b9e70a4ca1a2 Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Mon, 7 Apr 2025 10:26:43 +0200
Subject: [PATCH 0243/2760] cleanup: Drop pointless label at end of function

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Acked-by: Corey Minyard <cminyard@mvista.com>
Message-ID: <20250407082643.2310002-4-armbru@redhat.com>
---
 hw/ipmi/ipmi_bmc_extern.c | 4 +---
 hw/ipmi/ipmi_bmc_sim.c    | 7 ++-----
 hw/ipmi/ipmi_bt.c         | 7 +++----
 hw/ipmi/ipmi_kcs.c        | 3 +--
 4 files changed, 7 insertions(+), 14 deletions(-)

diff --git a/hw/ipmi/ipmi_bmc_extern.c b/hw/ipmi/ipmi_bmc_extern.c
index 22cb9b590b..e563214390 100644
--- a/hw/ipmi/ipmi_bmc_extern.c
+++ b/hw/ipmi/ipmi_bmc_extern.c
@@ -213,7 +213,7 @@ static void ipmi_bmc_extern_handle_command(IPMIBmc *b,
         rsp[2] = err;
         ibe->waiting_rsp = false;
         k->handle_rsp(s, msg_id, rsp, 3);
-        goto out;
+        return;
     }
 
     addchar(ibe, msg_id);
@@ -228,8 +228,6 @@ static void ipmi_bmc_extern_handle_command(IPMIBmc *b,
 
     /* Start the transmit */
     continue_send(ibe);
-
- out:
 }
 
 static void handle_hw_op(IPMIBmcExtern *ibe, unsigned char hw_op)
diff --git a/hw/ipmi/ipmi_bmc_sim.c b/hw/ipmi/ipmi_bmc_sim.c
index c6a85e8cd1..41fe6835a7 100644
--- a/hw/ipmi/ipmi_bmc_sim.c
+++ b/hw/ipmi/ipmi_bmc_sim.c
@@ -465,13 +465,12 @@ void ipmi_bmc_gen_event(IPMIBmc *b, uint8_t *evt, bool log)
     }
 
     if (ibs->msg_flags & IPMI_BMC_MSG_FLAG_EVT_BUF_FULL) {
-        goto out;
+        return;
     }
 
     memcpy(ibs->evtbuf, evt, 16);
     ibs->msg_flags |= IPMI_BMC_MSG_FLAG_EVT_BUF_FULL;
     k->set_atn(s, 1, attn_irq_enabled(ibs));
- out:
 }
 static void gen_event(IPMIBmcSim *ibs, unsigned int sens_num, uint8_t deassert,
                       uint8_t evd1, uint8_t evd2, uint8_t evd3)
@@ -996,7 +995,7 @@ static void get_msg(IPMIBmcSim *ibs,
 
     if (QTAILQ_EMPTY(&ibs->rcvbufs)) {
         rsp_buffer_set_error(rsp, 0x80); /* Queue empty */
-        goto out;
+        return;
     }
     rsp_buffer_push(rsp, 0); /* Channel 0 */
     msg = QTAILQ_FIRST(&ibs->rcvbufs);
@@ -1011,8 +1010,6 @@ static void get_msg(IPMIBmcSim *ibs,
         ibs->msg_flags &= ~IPMI_BMC_MSG_FLAG_RCV_MSG_QUEUE;
         k->set_atn(s, attn_set(ibs), attn_irq_enabled(ibs));
     }
-
-out:
 }
 
 static unsigned char
diff --git a/hw/ipmi/ipmi_bt.c b/hw/ipmi/ipmi_bt.c
index 5cf12c59a8..e01d02fe52 100644
--- a/hw/ipmi/ipmi_bt.c
+++ b/hw/ipmi/ipmi_bt.c
@@ -98,14 +98,14 @@ static void ipmi_bt_handle_event(IPMIInterface *ii)
     IPMIBT *ib = iic->get_backend_data(ii);
 
     if (ib->inlen < 4) {
-        goto out;
+        return;
     }
     /* Note that overruns are handled by handle_command */
     if (ib->inmsg[0] != (ib->inlen - 1)) {
         /* Length mismatch, just ignore. */
         IPMI_BT_SET_BBUSY(ib->control_reg, 1);
         ib->inlen = 0;
-        goto out;
+        return;
     }
     if ((ib->inmsg[1] == (IPMI_NETFN_APP << 2)) &&
                         (ib->inmsg[3] == IPMI_CMD_GET_BT_INTF_CAP)) {
@@ -136,7 +136,7 @@ static void ipmi_bt_handle_event(IPMIInterface *ii)
             IPMI_BT_SET_B2H_IRQ(ib->mask_reg, 1);
             ipmi_bt_raise_irq(ib);
         }
-        goto out;
+        return;
     }
     ib->waiting_seq = ib->inmsg[2];
     ib->inmsg[2] = ib->inmsg[1];
@@ -145,7 +145,6 @@ static void ipmi_bt_handle_event(IPMIInterface *ii)
         bk->handle_command(ib->bmc, ib->inmsg + 2, ib->inlen - 2,
                            sizeof(ib->inmsg), ib->waiting_rsp);
     }
- out:
 }
 
 static void ipmi_bt_handle_rsp(IPMIInterface *ii, uint8_t msg_id,
diff --git a/hw/ipmi/ipmi_kcs.c b/hw/ipmi/ipmi_kcs.c
index ae549fb864..d5cfe6c068 100644
--- a/hw/ipmi/ipmi_kcs.c
+++ b/hw/ipmi/ipmi_kcs.c
@@ -168,7 +168,7 @@ static void ipmi_kcs_handle_event(IPMIInterface *ii)
             ik->outpos = 0;
             bk->handle_command(ik->bmc, ik->inmsg, ik->inlen, sizeof(ik->inmsg),
                                ik->waiting_rsp);
-            goto out_noibf;
+            return;
         } else if (ik->cmd_reg == IPMI_KCS_WRITE_END_CMD) {
             ik->cmd_reg = -1;
             ik->write_end = 1;
@@ -197,7 +197,6 @@ static void ipmi_kcs_handle_event(IPMIInterface *ii)
     ik->cmd_reg = -1;
     ik->data_in_reg = -1;
     IPMI_KCS_SET_IBF(ik->status_reg, 0);
- out_noibf:
 }
 
 static void ipmi_kcs_handle_rsp(IPMIInterface *ii, uint8_t msg_id,

From fdcb7483ae08f5d21d8b5588413c0b0f3e39cda8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 12 Mar 2025 10:16:53 +0100
Subject: [PATCH 0244/2760] target/hexagon: Explode MO_TExx -> MO_TE | MO_xx
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Extract the implicit MO_TE definition in order to replace
it in the next commit.

Mechanical change using:

  $ for n in UW UL UQ UO SW SL SQ; do \
      sed -i -e "s/MO_TE$n/MO_TE | MO_$n/" \
           $(git grep -l MO_TE$n target/hexagon); \
    done

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Anton Johansson <anjo@rev.ng>
Message-Id: <20250312103238.99981-2-philmd@linaro.org>
---
 target/hexagon/genptr.c    |  8 ++++----
 target/hexagon/macros.h    | 10 +++++-----
 target/hexagon/translate.c |  6 +++---
 3 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/target/hexagon/genptr.c b/target/hexagon/genptr.c
index 2c5e15cfcf..561e93c9fd 100644
--- a/target/hexagon/genptr.c
+++ b/target/hexagon/genptr.c
@@ -329,14 +329,14 @@ void gen_set_byte_i64(int N, TCGv_i64 result, TCGv src)
 
 static inline void gen_load_locked4u(TCGv dest, TCGv vaddr, int mem_index)
 {
-    tcg_gen_qemu_ld_tl(dest, vaddr, mem_index, MO_TEUL);
+    tcg_gen_qemu_ld_tl(dest, vaddr, mem_index, MO_TE | MO_UL);
     tcg_gen_mov_tl(hex_llsc_addr, vaddr);
     tcg_gen_mov_tl(hex_llsc_val, dest);
 }
 
 static inline void gen_load_locked8u(TCGv_i64 dest, TCGv vaddr, int mem_index)
 {
-    tcg_gen_qemu_ld_i64(dest, vaddr, mem_index, MO_TEUQ);
+    tcg_gen_qemu_ld_i64(dest, vaddr, mem_index, MO_TE | MO_UQ);
     tcg_gen_mov_tl(hex_llsc_addr, vaddr);
     tcg_gen_mov_i64(hex_llsc_val_i64, dest);
 }
@@ -756,7 +756,7 @@ static void gen_load_frame(DisasContext *ctx, TCGv_i64 frame, TCGv EA)
 {
     Insn *insn = ctx->insn;  /* Needed for CHECK_NOSHUF */
     CHECK_NOSHUF(EA, 8);
-    tcg_gen_qemu_ld_i64(frame, EA, ctx->mem_idx, MO_TEUQ);
+    tcg_gen_qemu_ld_i64(frame, EA, ctx->mem_idx, MO_TE | MO_UQ);
 }
 
 #ifndef CONFIG_HEXAGON_IDEF_PARSER
@@ -1230,7 +1230,7 @@ static void gen_vreg_load(DisasContext *ctx, intptr_t dstoff, TCGv src,
         tcg_gen_andi_tl(src, src, ~((int32_t)sizeof(MMVector) - 1));
     }
     for (int i = 0; i < sizeof(MMVector) / 8; i++) {
-        tcg_gen_qemu_ld_i64(tmp, src, ctx->mem_idx, MO_TEUQ);
+        tcg_gen_qemu_ld_i64(tmp, src, ctx->mem_idx, MO_TE | MO_UQ);
         tcg_gen_addi_tl(src, src, 8);
         tcg_gen_st_i64(tmp, tcg_env, dstoff + i * 8);
     }
diff --git a/target/hexagon/macros.h b/target/hexagon/macros.h
index ee3d4c88e7..57825efa55 100644
--- a/target/hexagon/macros.h
+++ b/target/hexagon/macros.h
@@ -115,27 +115,27 @@
 #define MEM_LOAD2s(DST, VA) \
     do { \
         CHECK_NOSHUF(VA, 2); \
-        tcg_gen_qemu_ld_tl(DST, VA, ctx->mem_idx, MO_TESW); \
+        tcg_gen_qemu_ld_tl(DST, VA, ctx->mem_idx, MO_TE | MO_SW); \
     } while (0)
 #define MEM_LOAD2u(DST, VA) \
     do { \
         CHECK_NOSHUF(VA, 2); \
-        tcg_gen_qemu_ld_tl(DST, VA, ctx->mem_idx, MO_TEUW); \
+        tcg_gen_qemu_ld_tl(DST, VA, ctx->mem_idx, MO_TE | MO_UW); \
     } while (0)
 #define MEM_LOAD4s(DST, VA) \
     do { \
         CHECK_NOSHUF(VA, 4); \
-        tcg_gen_qemu_ld_tl(DST, VA, ctx->mem_idx, MO_TESL); \
+        tcg_gen_qemu_ld_tl(DST, VA, ctx->mem_idx, MO_TE | MO_SL); \
     } while (0)
 #define MEM_LOAD4u(DST, VA) \
     do { \
         CHECK_NOSHUF(VA, 4); \
-        tcg_gen_qemu_ld_tl(DST, VA, ctx->mem_idx, MO_TEUL); \
+        tcg_gen_qemu_ld_tl(DST, VA, ctx->mem_idx, MO_TE | MO_UL); \
     } while (0)
 #define MEM_LOAD8u(DST, VA) \
     do { \
         CHECK_NOSHUF(VA, 8); \
-        tcg_gen_qemu_ld_i64(DST, VA, ctx->mem_idx, MO_TEUQ); \
+        tcg_gen_qemu_ld_i64(DST, VA, ctx->mem_idx, MO_TE | MO_UQ); \
     } while (0)
 
 #define MEM_STORE1_FUNC(X) \
diff --git a/target/hexagon/translate.c b/target/hexagon/translate.c
index dd26801e64..0109f31e19 100644
--- a/target/hexagon/translate.c
+++ b/target/hexagon/translate.c
@@ -656,17 +656,17 @@ void process_store(DisasContext *ctx, int slot_num)
         case 2:
             tcg_gen_qemu_st_tl(hex_store_val32[slot_num],
                                hex_store_addr[slot_num],
-                               ctx->mem_idx, MO_TEUW);
+                               ctx->mem_idx, MO_TE | MO_UW);
             break;
         case 4:
             tcg_gen_qemu_st_tl(hex_store_val32[slot_num],
                                hex_store_addr[slot_num],
-                               ctx->mem_idx, MO_TEUL);
+                               ctx->mem_idx, MO_TE | MO_UL);
             break;
         case 8:
             tcg_gen_qemu_st_i64(hex_store_val64[slot_num],
                                 hex_store_addr[slot_num],
-                                ctx->mem_idx, MO_TEUQ);
+                                ctx->mem_idx, MO_TE | MO_UQ);
             break;
         default:
             {

From beb38fda0f007b034ea7ff624b9f1db7699aa883 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 12 Mar 2025 10:42:31 +0100
Subject: [PATCH 0245/2760] target/hexagon: Replace MO_TE -> MO_LE
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We only build the Hexagon target using little endianness order.
The MO_TE definition always expands to MO_LE. Use the latter to
simplify.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Anton Johansson <anjo@rev.ng>
Message-Id: <20250312103238.99981-3-philmd@linaro.org>
---
 target/hexagon/genptr.c                     |  8 ++++----
 target/hexagon/idef-parser/parser-helpers.c |  2 +-
 target/hexagon/macros.h                     | 10 +++++-----
 target/hexagon/translate.c                  |  6 +++---
 4 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/target/hexagon/genptr.c b/target/hexagon/genptr.c
index 561e93c9fd..08fc5413de 100644
--- a/target/hexagon/genptr.c
+++ b/target/hexagon/genptr.c
@@ -329,14 +329,14 @@ void gen_set_byte_i64(int N, TCGv_i64 result, TCGv src)
 
 static inline void gen_load_locked4u(TCGv dest, TCGv vaddr, int mem_index)
 {
-    tcg_gen_qemu_ld_tl(dest, vaddr, mem_index, MO_TE | MO_UL);
+    tcg_gen_qemu_ld_tl(dest, vaddr, mem_index, MO_LE | MO_UL);
     tcg_gen_mov_tl(hex_llsc_addr, vaddr);
     tcg_gen_mov_tl(hex_llsc_val, dest);
 }
 
 static inline void gen_load_locked8u(TCGv_i64 dest, TCGv vaddr, int mem_index)
 {
-    tcg_gen_qemu_ld_i64(dest, vaddr, mem_index, MO_TE | MO_UQ);
+    tcg_gen_qemu_ld_i64(dest, vaddr, mem_index, MO_LE | MO_UQ);
     tcg_gen_mov_tl(hex_llsc_addr, vaddr);
     tcg_gen_mov_i64(hex_llsc_val_i64, dest);
 }
@@ -756,7 +756,7 @@ static void gen_load_frame(DisasContext *ctx, TCGv_i64 frame, TCGv EA)
 {
     Insn *insn = ctx->insn;  /* Needed for CHECK_NOSHUF */
     CHECK_NOSHUF(EA, 8);
-    tcg_gen_qemu_ld_i64(frame, EA, ctx->mem_idx, MO_TE | MO_UQ);
+    tcg_gen_qemu_ld_i64(frame, EA, ctx->mem_idx, MO_LE | MO_UQ);
 }
 
 #ifndef CONFIG_HEXAGON_IDEF_PARSER
@@ -1230,7 +1230,7 @@ static void gen_vreg_load(DisasContext *ctx, intptr_t dstoff, TCGv src,
         tcg_gen_andi_tl(src, src, ~((int32_t)sizeof(MMVector) - 1));
     }
     for (int i = 0; i < sizeof(MMVector) / 8; i++) {
-        tcg_gen_qemu_ld_i64(tmp, src, ctx->mem_idx, MO_TE | MO_UQ);
+        tcg_gen_qemu_ld_i64(tmp, src, ctx->mem_idx, MO_LE | MO_UQ);
         tcg_gen_addi_tl(src, src, 8);
         tcg_gen_st_i64(tmp, tcg_env, dstoff + i * 8);
     }
diff --git a/target/hexagon/idef-parser/parser-helpers.c b/target/hexagon/idef-parser/parser-helpers.c
index a7dcd85fe4..542af8d0a6 100644
--- a/target/hexagon/idef-parser/parser-helpers.c
+++ b/target/hexagon/idef-parser/parser-helpers.c
@@ -1761,7 +1761,7 @@ void gen_load(Context *c, YYLTYPE *locp, HexValue *width,
     if (signedness == SIGNED) {
         OUT(c, locp, " | MO_SIGN");
     }
-    OUT(c, locp, " | MO_TE);\n");
+    OUT(c, locp, " | MO_LE);\n");
 }
 
 void gen_store(Context *c, YYLTYPE *locp, HexValue *width, HexValue *ea,
diff --git a/target/hexagon/macros.h b/target/hexagon/macros.h
index 57825efa55..e5eb31e671 100644
--- a/target/hexagon/macros.h
+++ b/target/hexagon/macros.h
@@ -115,27 +115,27 @@
 #define MEM_LOAD2s(DST, VA) \
     do { \
         CHECK_NOSHUF(VA, 2); \
-        tcg_gen_qemu_ld_tl(DST, VA, ctx->mem_idx, MO_TE | MO_SW); \
+        tcg_gen_qemu_ld_tl(DST, VA, ctx->mem_idx, MO_LE | MO_SW); \
     } while (0)
 #define MEM_LOAD2u(DST, VA) \
     do { \
         CHECK_NOSHUF(VA, 2); \
-        tcg_gen_qemu_ld_tl(DST, VA, ctx->mem_idx, MO_TE | MO_UW); \
+        tcg_gen_qemu_ld_tl(DST, VA, ctx->mem_idx, MO_LE | MO_UW); \
     } while (0)
 #define MEM_LOAD4s(DST, VA) \
     do { \
         CHECK_NOSHUF(VA, 4); \
-        tcg_gen_qemu_ld_tl(DST, VA, ctx->mem_idx, MO_TE | MO_SL); \
+        tcg_gen_qemu_ld_tl(DST, VA, ctx->mem_idx, MO_LE | MO_SL); \
     } while (0)
 #define MEM_LOAD4u(DST, VA) \
     do { \
         CHECK_NOSHUF(VA, 4); \
-        tcg_gen_qemu_ld_tl(DST, VA, ctx->mem_idx, MO_TE | MO_UL); \
+        tcg_gen_qemu_ld_tl(DST, VA, ctx->mem_idx, MO_LE | MO_UL); \
     } while (0)
 #define MEM_LOAD8u(DST, VA) \
     do { \
         CHECK_NOSHUF(VA, 8); \
-        tcg_gen_qemu_ld_i64(DST, VA, ctx->mem_idx, MO_TE | MO_UQ); \
+        tcg_gen_qemu_ld_i64(DST, VA, ctx->mem_idx, MO_LE | MO_UQ); \
     } while (0)
 
 #define MEM_STORE1_FUNC(X) \
diff --git a/target/hexagon/translate.c b/target/hexagon/translate.c
index 0109f31e19..02fd40c160 100644
--- a/target/hexagon/translate.c
+++ b/target/hexagon/translate.c
@@ -656,17 +656,17 @@ void process_store(DisasContext *ctx, int slot_num)
         case 2:
             tcg_gen_qemu_st_tl(hex_store_val32[slot_num],
                                hex_store_addr[slot_num],
-                               ctx->mem_idx, MO_TE | MO_UW);
+                               ctx->mem_idx, MO_LE | MO_UW);
             break;
         case 4:
             tcg_gen_qemu_st_tl(hex_store_val32[slot_num],
                                hex_store_addr[slot_num],
-                               ctx->mem_idx, MO_TE | MO_UL);
+                               ctx->mem_idx, MO_LE | MO_UL);
             break;
         case 8:
             tcg_gen_qemu_st_i64(hex_store_val64[slot_num],
                                 hex_store_addr[slot_num],
-                                ctx->mem_idx, MO_TE | MO_UQ);
+                                ctx->mem_idx, MO_LE | MO_UQ);
             break;
         default:
             {

From 9ce6caa0d94a52a0ada77f494e8e23e62198aef0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 12 Mar 2025 10:18:42 +0100
Subject: [PATCH 0246/2760] target/i386: Replace MO_TE* -> MO_LE*
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The x86 architecture is only implemented as little-endian.
The MO_TE definition always expands to MO_LE.

Replace:
 - MO_TEUQ -> MO_LEUQ
 - MO_TE   -> MO_LE

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20250312142124.15138-1-philmd@linaro.org>
---
 target/i386/tcg/emit.c.inc | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/target/i386/tcg/emit.c.inc b/target/i386/tcg/emit.c.inc
index 4e09e96fc1..ca6bc2ea82 100644
--- a/target/i386/tcg/emit.c.inc
+++ b/target/i386/tcg/emit.c.inc
@@ -1813,7 +1813,7 @@ static void gen_CMPXCHG(DisasContext *s, X86DecodedInsn *decode)
 static void gen_CMPXCHG16B(DisasContext *s, X86DecodedInsn *decode)
 {
 #ifdef TARGET_X86_64
-    MemOp mop = MO_TE | MO_128 | MO_ALIGN;
+    MemOp mop = MO_LE | MO_128 | MO_ALIGN;
     TCGv_i64 t0, t1;
     TCGv_i128 cmp, val;
 
@@ -1870,10 +1870,10 @@ static void gen_CMPXCHG8B(DisasContext *s, X86DecodedInsn *decode)
 
     /* Only require atomic with LOCK; non-parallel handled in generator. */
     if (s->prefix & PREFIX_LOCK) {
-        tcg_gen_atomic_cmpxchg_i64(old, s->A0, cmp, val, s->mem_index, MO_TEUQ);
+        tcg_gen_atomic_cmpxchg_i64(old, s->A0, cmp, val, s->mem_index, MO_LEUQ);
     } else {
         tcg_gen_nonatomic_cmpxchg_i64(old, s->A0, cmp, val,
-                                      s->mem_index, MO_TEUQ);
+                                      s->mem_index, MO_LEUQ);
     }
 
     /* Compute the required value of Z. */

From 5dbe25e9db070ea87c173fd9a4dc0932ee6d1b41 Mon Sep 17 00:00:00 2001
From: Tomita Moeko <tomitamoeko@gmail.com>
Date: Thu, 13 Mar 2025 23:03:39 +0800
Subject: [PATCH 0247/2760] vfio/igd: Update IGD passthrough documentation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A previous change made the OpRegion and LPC quirks independent of the
existing legacy mode, update the documentation accordingly. More related
topics, like creating EFI Option ROM of IGD for OVMF, how to solve the
VFIO_DMA_MAP Invalid Argument warning, as well as details on IGD memory
internals, are also added.

Signed-off-by: Tomita Moeko <tomitamoeko@gmail.com>
Reviewed-by: Alex Williamson <alex.williamson@redhat.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250313150339.358621-1-tomitamoeko@gmail.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 docs/igd-assign.txt | 255 +++++++++++++++++++++++++++++++++-----------
 1 file changed, 191 insertions(+), 64 deletions(-)

diff --git a/docs/igd-assign.txt b/docs/igd-assign.txt
index e17bb50789..3aed7956d5 100644
--- a/docs/igd-assign.txt
+++ b/docs/igd-assign.txt
@@ -1,44 +1,69 @@
 Intel Graphics Device (IGD) assignment with vfio-pci
 ====================================================
 
-IGD has two different modes for assignment using vfio-pci:
+Using vfio-pci, we can passthrough Intel Graphics Device (IGD) to guest, either
+serve as primary and exclusive graphics adapter, or used in combination with an
+emulated primary graphics device, depending on the config and guest driver
+support. However, IGD devices are not "clean" PCI devices, they use extra
+memory regions other than BARs. Special handling is required to make them work
+properly, including:
 
-1) Universal Pass-Through (UPT) mode:
+* OpRegion for accessing Virtual BIOS Table (VBT) that contains display output
+  information.
+* Data Stolen Memory (DSM) region used as VRAM at early stage (BIOS/UEFI)
 
-   In this mode the IGD device is added as a *secondary* (ie. non-primary)
-   graphics device in combination with an emulated primary graphics device.
-   This mode *requires* guest driver support to remove the external
-   dependencies generally associated with IGD (see below).  Those guest
-   drivers only support this mode for Broadwell and newer IGD, according to
-   Intel.  Additionally, this mode by default, and as officially supported
-   by Intel, does not support direct video output.  The intention is to use
-   this mode either to provide hardware acceleration to the emulated graphics
-   or to use this mode in combination with guest-based remote access software,
-   for example VNC (see below for optional output support).  This mode
-   theoretically has no device specific handling dependencies on vfio-pci or
-   the VM firmware.
+Certain guest software also depends on following conditions to work:
+(*-Required by)
 
-2) "Legacy" mode:
+| Condition                                   | Linux | Windows | VBIOS | EFI GOP |
+|---------------------------------------------|-------|---------|-------|---------|
+| #1 IGD has a valid OpRegion containing VBT  |  * ^1 |    *    |   *   |    *    |
+| #2 VID/DID of LPC bridge at 00:1f.0 matches |       |         |   *   |    *    |
+| #3 IGD is assigned to BDF 00:02.0           |       |         |   *   |    *    |
+| #4 IGD has VGA controller device class      |       |         |   *   |    *    |
+| #5 Host's VGA ranges are mapped to IGD      |       |         |   *   |         |
+| #6 Guest has valid VBIOS or UEFI Option ROM |       |         |   *   |    *    |
 
-   In this mode the IGD device is intended to be the primary and exclusive
-   graphics device in the VM[1], as such QEMU does not facilitate any sort
-   of remote graphics to the VM in this mode.  A connected physical monitor
-   is the intended output device for IGD.  This mode includes several
-   requirements and restrictions:
+^1 Though i915 driver is able to mock a OpRegion, it is still recommended to
+   use the VBT copied from host OpRegion to prevent incorrect configuration.
 
-    * IGD must be given address 02.0 on the PCI root bus in the VM
-    * The host kernel must support vfio extensions for IGD (v4.6)
-    * vfio VGA support very likely needs to be enabled in the host kernel
-    * The VM firmware must support specific fw_cfg enablers for IGD
-    * The VM machine type must support a PCI host bridge at 00.0 (standard)
-    * The VM machine type must provide or allow to be created a special
-      ISA/LPC bridge device (vfio-pci-igd-lpc-bridge) on the root bus at
-      PCI address 1f.0.
-    * The IGD device must have a VGA ROM, either provided via the romfile
-      option or loaded automatically through vfio (standard).  rombar=0
-      will disable legacy mode support.
-    * Hotplug of the IGD device is not supported.
-    * The IGD device must be a SandyBridge or newer model device.
+For #1, the "x-igd-opregion=on" option exposes a copy of host IGD OpRegion to
+guest via fw_cfg, where guest firmware can set up guest OpRegion with it.
+
+For #2, "x-igd-lpc=on" option copies the IDs of host LPC bridge and host bridge
+to guest. Currently this is only supported on i440fx machines as there is
+already an ICH9 LPC bridge present on q35 machines, overwriting its IDs may
+lead to unexpected behavior.
+
+For #3, "addr=2.0" assigns IGD to 00:02.0.
+
+For #4, the primary display must be set to IGD in host BIOS.
+
+For #5, "x-vga=on" enables guest access to standard VGA IO/MMIO ranges.
+
+For #6, ROM either provided via the ROM BAR or romfile= option is needed, this
+Intel document [1] shows how to dump VBIOS to file. For UEFI Option ROM, see
+"Guest firmware" section.
+
+QEMU also provides a "Legacy" mode that implicitly enables full functionality
+on IGD, it is automatically enabled when
+* Machine type is i440fx
+* IGD is assigned to guest BDF 00:02.0
+* ROM BAR or romfile is present
+
+In "Legacy" mode, QEMU will automatically setup OpRegion, LPC bridge IDs and
+VGA range access, which is equivalent to:
+  x-igd-opregion=on,x-igd-lpc=on,x-vga=on
+
+By default, "Legacy" mode won't fail, it continues on error. User can set
+"x-igd-legacy-mode=on" to force enabling legacy mode, this also checks if the
+conditions above for legacy mode is met, and if any error occurs, QEMU will
+fail immediately. Users can also set "x-igd-legacy-mode=off" to disable legacy
+mode.
+
+In legacy mode, as the guest VGA ranges are assigned to IGD device, all other
+graphics devices should be removed, this can be done using "-nographic" or
+"-vga none" or "-nodefaults", along with adding the device using vfio-pci.
 
 For either mode, depending on the host kernel, the i915 driver in the host
 may generate faults and errors upon re-binding to an IGD device after it
@@ -73,31 +98,39 @@ DVI, or DisplayPort) may be unsupported in some use cases.  In the author's
 experience, even DP to VGA adapters can be troublesome while adapters between
 digital formats work well.
 
-Usage
-=====
-The intention is for IGD assignment to be transparent for users and thus for
-management tools like libvirt.  To make use of legacy mode, simply remove all
-other graphics options and use "-nographic" and either "-vga none" or
-"-nodefaults", along with adding the device using vfio-pci:
 
-    -device vfio-pci,host=00:02.0,id=hostdev0,bus=pci.0,addr=0x2
+Options
+=======
+* x-igd-opregion=[on|*off*]
+  Copy host IGD OpRegion and expose it to guest with fw_cfg
 
-For UPT mode, retain the default emulated graphics and simply add the vfio-pci
-device making use of any other bus address other than 02.0.  libvirt will
-default to assigning the device a UPT compatible address while legacy mode
-users will need to manually edit the XML if using a tool like virt-manager
-where the VM device address is not expressly specified.
+* x-igd-lpc=[on|*off*]
+  Creates a dummy LPC bridge at 00:1f:0 with host VID/DID (i440fx only)
 
-An experimental vfio-pci option also exists to enable OpRegion, and thus
-external monitor support, for UPT mode.  This can be enabled by adding
-"x-igd-opregion=on" to the vfio-pci device options for the IGD device.  As
-with legacy mode, this requires the host to support features introduced in
-the v4.6 kernel.  If Intel chooses to embrace this support, the option may
-be made non-experimental in the future, opening it to libvirt support.
+* x-igd-legacy-mode=[on|off|*auto*]
+  Enable/Disable legacy mode
 
-Developer ABI
-=============
-Legacy mode IGD support imposes two fw_cfg requirements on the VM firmware:
+* x-igd-gms=[hex, default 0]
+  Overriding DSM region size in GGC register, 0 means uses host value.
+  Use this only when the DSM size cannot be changed through the
+  'DVMT Pre-Allocated' option in host BIOS.
+
+
+Examples
+========
+* Adding IGD with automatically legacy mode support
+  -device vfio-pci,host=00:02.0,id=hostdev0,addr=2.0
+
+* Adding IGD with OpRegion and LPC ID hack, but without VGA ranges
+  (For UEFI guests)
+  -device vfio-pci,host=00:02.0,id=hostdev0,addr=2.0,x-igd-legacy-mode=off,x-igd-opregion=on,x-igd-lpc=on,romfile=efi_oprom.rom
+
+
+Guest firmware
+==============
+Guest firmware is responsible for setting up OpRegion and Base of Data Stolen
+Memory (BDSM) in guest address space. IGD passthrough support imposes two
+fw_cfg requirements on the VM firmware:
 
 1) "etc/igd-opregion"
 
@@ -117,17 +150,111 @@ Legacy mode IGD support imposes two fw_cfg requirements on the VM firmware:
    Firmware must allocate a reserved memory below 4GB with required 1MB
    alignment equal to this size.  Additionally the base address of this
    reserved region must be written to the dword BDSM register in PCI config
-   space of the IGD device at offset 0x5C.  As this support is related to
-   running the IGD ROM, which has other dependencies on the device appearing
-   at guest address 00:02.0, it's expected that this fw_cfg file is only
-   relevant to a single PCI class VGA device with Intel vendor ID, appearing
-   at PCI bus address 00:02.0.
+   space of the IGD device at offset 0x5C (or 0xC0 for Gen 11+ devices using
+   64-bit BDSM).  As this support is related to running the IGD ROM, which
+   has other dependencies on the device appearing at guest address 00:02.0,
+   it's expected that this fw_cfg file is only relevant to a single PCI
+   class VGA device with Intel vendor ID, appearing at PCI bus address 00:02.0.
+
+Upstream Seabios has OpRegion and BDSM (pre-Gen11 device only) support.
+However, the support is not accepted by upstream EDK2/OVMF. A recommended
+solution is to create a virtual OpRom with following DXE drivers:
+
+* IgdAssignmentDxe: Set up OpRegion and BDSM according to fw_cfg (must)
+* IntelGopDriver: Closed-source Intel GOP driver
+* PlatformGopPolicy: Protocol required by IntelGopDriver
+
+IntelGopDriver and PlatformGopPolicy is only required when enabling GOP on IGD.
+
+The original IgdAssignmentDxe can be found at [3]. A Intel maintained version
+with PlatformGopPolicy for industrial computing is at [4]. There is also an
+unofficially maintained version with newer Gen11+ device support at [5].
+You need to build them with EDK2.
+
+For the IntelGopDriver, Intel never released it to public. You may contact
+Intel support to get one as [4] said, if you are an Intel Premier Support
+customer, or you can try extracting it from your host firmware using
+"UEFI BIOS Updater"[6].
+
+Once you got all the required DXE drivers, a Option ROM can be generated with
+EfiRom utility in EDK2, using
+  EfiRom -f 0x8086 -i <Device ID of your IGD> -o output.rom \
+  -e IgdAssignmentDxe.efi PlatformGOPPolicy.efi IntelGopDriver.efi
+
+
+Known issues
+============
+When using OVMF as guest firmware, you may encounter the following warning:
+warning: vfio_container_dma_map(0x55fab36ce610, 0x380010000000, 0x108000, 0x7fd336000000) = -22 (Invalid argument)
+
+Solution:
+Set the host physical address bits to IOMMU address width using
+  -cpu host,host-phys-bits-limit=<IOMMU address width>
+Or in libvirt XML with
+  <cpu>
+    <maxphysaddr mode='passthrough' limit='<IOMMU address width>'/>
+  </cpu>
+The IOMMU address width can be determined with
+  echo $(( ((0x$(cat /sys/devices/virtual/iommu/dmar0/intel-iommu/cap) & 0x3F0000) >> 16) + 1 ))
+Refer https://edk2.groups.io/g/devel/topic/patch_v1/102359124 for more details
+
+
+Memory View
+===========
+IGD has it own address space. To use system RAM as VRAM, a single-level page
+table named Global Graphics Translation Table (GTT) is used for the address
+translation. Each page table entry points a 4KB page. Illustration below shows
+the translation flow on IGD with 64-bit GTT PTEs.
+
+(PTE_SIZE == 8)                +-------------+---+
+                               |   Address   | V |  V: Valid Bit
+                               +-------------+---+
+                               | ...         |   |
+IGD:0x01ae9010           0xd740| 0x70ffc000  | 1 |  Mem:0x42ba3e010^
+-----------------------> 0xd748| 0x42ba3e000 | 1 +------------------>
+(addr >> 12) * PTE_SIZE  0xd750| 0x42ba3f000 | 1 |
+                               | ...         |   |
+                               +-------------+---+
+^ The address may be remapped by IOMMU
+
+The memory region store GTT is called GTT Stolen Memory (GSM) it is located
+right below the Data Stolen Memory (DSM). Accessing this region directly is
+not allowed, any access will immediately freeze the whole system. The only way
+to access it is through the second half of MMIO BAR0.
+
+The Data Stolen Memory is reserved by firmware, and acts as the VRAM in pre-OS
+environments. In QEMU, guest firmware (Seabios/OVMF) is responsible for
+reserving a continuous region and program its base address to BDSM register,
+then let VBIOS/GOP driver initializing this region. Illustration below shows
+how DSM is mapped.
+
+       IGD Addr Space                 Host Addr Space         Guest Addr Space
+       +-------------+                +-------------+         +-------------+
+       |             |                |             |         |             |
+       |             |                |             |         |             |
+       |             |                +-------------+         +-------------+
+       |             |                | Data Stolen |         | Data Stolen |
+       |             |                |   (Guest)   |         |   (Guest)   |
+       |             |  +------------>+-------------+<------->+-------------+<--Guest BDSM
+       |             |  | Passthrough |             | EPT     |             |   Emulated by QEMU
+DSMSIZE+-------------+  | with IOMMU  |             | Mapping |             |   Programmed by guest FW
+       |             |  |             |             |         |             |
+       |             |  |             |             |         |             |
+      0+-------------+--+             |             |         |             |
+                        |             +-------------+         |             |
+                        |             | Data Stolen |         +-------------+
+                        |             |   (Host)    |
+                        +------------>+-------------+<--Host BDSM
+                          Non-        |             |   "real" one in HW
+                          Passthrough |             |   Programmed by host FW
+                                      +-------------+
 
 Footnotes
 =========
-[1] Nothing precludes adding additional emulated or assigned graphics devices
-    as non-primary, other than the combination typically not working.  I only
-    intend to set user expectations, others are welcome to find working
-    combinations or fix whatever issues prevent this from working in the common
-    case.
+[1] https://www.intel.com/content/www/us/en/docs/graphics-for-linux/developer-reference/1-0/dump-video-bios.html
 [2] # echo "vfio-pci" > /sys/bus/pci/devices/0000:00:02.0/driver_override
+[3] https://web.archive.org/web/20240827012422/https://bugzilla.tianocore.org/show_bug.cgi?id=935
+    Tianocore bugzilla was down since Jan 2025 :(
+[4] https://eci.intel.com/docs/3.3/components/kvm-hypervisor.html, Patch 0001-0004
+[5] https://github.com/tomitamoeko/VfioIgdPkg
+[6] https://winraid.level1techs.com/t/tool-guide-news-uefi-bios-updater-ubu/30357

From 10c7f1cf2c9d5af28dbc342634eb1f3979a7c379 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Mon, 24 Mar 2025 13:33:15 +0100
Subject: [PATCH 0248/2760] vfio: Open code vfio_migration_set_error()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

VFIO uses migration_file_set_error() in a couple of places where an
'Error **' parameter is not provided. In MemoryListener handlers :

  vfio_listener_region_add
  vfio_listener_log_global_stop
  vfio_listener_log_sync

and in callback routines for IOMMU notifiers :

  vfio_iommu_map_notify
  vfio_iommu_map_dirty_notify

Hopefully, one day, we will be able to extend these callbacks with an
'Error **' parameter and avoid setting the global migration error.
Until then, it seems sensible to clearly identify the use cases, which
are limited, and open code vfio_migration_set_error(). One other
benefit is an improved error reporting when migration is running.

While at it, slightly modify error reporting to only report errors
when migration is not active and not always as is currently done.

Cc: Prasad Pandit <pjp@fedoraproject.org>
Reviewed-by: Avihai Horon <avihaih@nvidia.com>
Link: https://lore.kernel.org/qemu-devel/20250324123315.637827-1-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/common.c | 60 +++++++++++++++++++++++++++++-------------------
 1 file changed, 36 insertions(+), 24 deletions(-)

diff --git a/hw/vfio/common.c b/hw/vfio/common.c
index 9b493451c5..5ef14931cd 100644
--- a/hw/vfio/common.c
+++ b/hw/vfio/common.c
@@ -145,13 +145,6 @@ bool vfio_viommu_preset(VFIODevice *vbasedev)
     return vbasedev->bcontainer->space->as != &address_space_memory;
 }
 
-static void vfio_set_migration_error(int ret)
-{
-    if (migration_is_running()) {
-        migration_file_set_error(ret, NULL);
-    }
-}
-
 bool vfio_device_state_is_running(VFIODevice *vbasedev)
 {
     VFIOMigration *migration = vbasedev->migration;
@@ -287,9 +280,14 @@ static void vfio_iommu_map_notify(IOMMUNotifier *n, IOMMUTLBEntry *iotlb)
                                 iova, iova + iotlb->addr_mask);
 
     if (iotlb->target_as != &address_space_memory) {
-        error_report("Wrong target AS \"%s\", only system memory is allowed",
-                     iotlb->target_as->name ? iotlb->target_as->name : "none");
-        vfio_set_migration_error(-EINVAL);
+        error_setg(&local_err,
+                   "Wrong target AS \"%s\", only system memory is allowed",
+                   iotlb->target_as->name ? iotlb->target_as->name : "none");
+        if (migration_is_running()) {
+            migration_file_set_error(-EINVAL, local_err);
+        } else {
+            error_report_err(local_err);
+        }
         return;
     }
 
@@ -322,11 +320,16 @@ static void vfio_iommu_map_notify(IOMMUNotifier *n, IOMMUTLBEntry *iotlb)
         ret = vfio_container_dma_unmap(bcontainer, iova,
                                        iotlb->addr_mask + 1, iotlb);
         if (ret) {
-            error_report("vfio_container_dma_unmap(%p, 0x%"HWADDR_PRIx", "
-                         "0x%"HWADDR_PRIx") = %d (%s)",
-                         bcontainer, iova,
-                         iotlb->addr_mask + 1, ret, strerror(-ret));
-            vfio_set_migration_error(ret);
+            error_setg(&local_err,
+                       "vfio_container_dma_unmap(%p, 0x%"HWADDR_PRIx", "
+                       "0x%"HWADDR_PRIx") = %d (%s)",
+                       bcontainer, iova,
+                       iotlb->addr_mask + 1, ret, strerror(-ret));
+            if (migration_is_running()) {
+                migration_file_set_error(ret, local_err);
+            } else {
+                error_report_err(local_err);
+            }
         }
     }
 out:
@@ -1108,8 +1111,11 @@ static void vfio_listener_log_global_stop(MemoryListener *listener)
     if (ret) {
         error_prepend(&local_err,
                       "vfio: Could not stop dirty page tracking - ");
-        error_report_err(local_err);
-        vfio_set_migration_error(ret);
+        if (migration_is_running()) {
+            migration_file_set_error(ret, local_err);
+        } else {
+            error_report_err(local_err);
+        }
     }
 }
 
@@ -1225,14 +1231,14 @@ static void vfio_iommu_map_dirty_notify(IOMMUNotifier *n, IOMMUTLBEntry *iotlb)
     trace_vfio_iommu_map_dirty_notify(iova, iova + iotlb->addr_mask);
 
     if (iotlb->target_as != &address_space_memory) {
-        error_report("Wrong target AS \"%s\", only system memory is allowed",
-                     iotlb->target_as->name ? iotlb->target_as->name : "none");
+        error_setg(&local_err,
+                   "Wrong target AS \"%s\", only system memory is allowed",
+                   iotlb->target_as->name ? iotlb->target_as->name : "none");
         goto out;
     }
 
     rcu_read_lock();
     if (!vfio_get_xlat_addr(iotlb, NULL, &translated_addr, NULL, &local_err)) {
-        error_report_err(local_err);
         goto out_unlock;
     }
 
@@ -1243,7 +1249,6 @@ static void vfio_iommu_map_dirty_notify(IOMMUNotifier *n, IOMMUTLBEntry *iotlb)
                       "vfio_iommu_map_dirty_notify(%p, 0x%"HWADDR_PRIx", "
                       "0x%"HWADDR_PRIx") failed - ", bcontainer, iova,
                       iotlb->addr_mask + 1);
-        error_report_err(local_err);
     }
 
 out_unlock:
@@ -1251,7 +1256,11 @@ out_unlock:
 
 out:
     if (ret) {
-        vfio_set_migration_error(ret);
+        if (migration_is_running()) {
+            migration_file_set_error(ret, local_err);
+        } else {
+            error_report_err(local_err);
+        }
     }
 }
 
@@ -1384,8 +1393,11 @@ static void vfio_listener_log_sync(MemoryListener *listener,
     if (vfio_log_sync_needed(bcontainer)) {
         ret = vfio_sync_dirty_bitmap(bcontainer, section, &local_err);
         if (ret) {
-            error_report_err(local_err);
-            vfio_set_migration_error(ret);
+            if (migration_is_running()) {
+                migration_file_set_error(ret, local_err);
+            } else {
+                error_report_err(local_err);
+            }
         }
     }
 }

From 6a7abe1c96bf5fbaa546c710b147f594c9db562e Mon Sep 17 00:00:00 2001
From: Amit Machhiwal <amachhiw@linux.ibm.com>
Date: Tue, 8 Apr 2025 18:10:41 +0530
Subject: [PATCH 0249/2760] vfio/spapr: Enhance error handling in
 vfio_spapr_create_window()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Introduce an Error ** parameter to vfio_spapr_create_window() to enable
structured error reporting. This allows the function to propagate
detailed errors back to callers.

Suggested-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Amit Machhiwal <amachhiw@linux.ibm.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250408124042.2695955-2-amachhiw@linux.ibm.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/spapr.c | 33 ++++++++++++++++-----------------
 1 file changed, 16 insertions(+), 17 deletions(-)

diff --git a/hw/vfio/spapr.c b/hw/vfio/spapr.c
index 66a2d2bb0d..3d6354134c 100644
--- a/hw/vfio/spapr.c
+++ b/hw/vfio/spapr.c
@@ -230,9 +230,9 @@ static int vfio_spapr_remove_window(VFIOContainer *container,
     return 0;
 }
 
-static int vfio_spapr_create_window(VFIOContainer *container,
+static bool vfio_spapr_create_window(VFIOContainer *container,
                                     MemoryRegionSection *section,
-                                    hwaddr *pgsize)
+                                    hwaddr *pgsize, Error **errp)
 {
     int ret = 0;
     VFIOContainerBase *bcontainer = &container->bcontainer;
@@ -252,11 +252,11 @@ static int vfio_spapr_create_window(VFIOContainer *container,
     pgmask = bcontainer->pgsizes & (pagesize | (pagesize - 1));
     pagesize = pgmask ? (1ULL << (63 - clz64(pgmask))) : 0;
     if (!pagesize) {
-        error_report("Host doesn't support page size 0x%"PRIx64
-                     ", the supported mask is 0x%lx",
-                     memory_region_iommu_get_min_page_size(iommu_mr),
-                     bcontainer->pgsizes);
-        return -EINVAL;
+        error_setg_errno(errp, EINVAL, "Host doesn't support page size 0x%"PRIx64
+                         ", the supported mask is 0x%lx",
+                         memory_region_iommu_get_min_page_size(iommu_mr),
+                         bcontainer->pgsizes);
+        return false;
     }
 
     /*
@@ -302,17 +302,17 @@ static int vfio_spapr_create_window(VFIOContainer *container,
         }
     }
     if (ret) {
-        error_report("Failed to create a window, ret = %d (%m)", ret);
-        return -errno;
+        error_setg_errno(errp, errno, "Failed to create a window, ret = %d", ret);
+        return false;
     }
 
     if (create.start_addr != section->offset_within_address_space) {
         vfio_spapr_remove_window(container, create.start_addr);
 
-        error_report("Host doesn't support DMA window at %"HWADDR_PRIx", must be %"PRIx64,
-                     section->offset_within_address_space,
-                     (uint64_t)create.start_addr);
-        return -EINVAL;
+        error_setg_errno(errp, EINVAL, "Host doesn't support DMA window at %"HWADDR_PRIx
+                         ", must be %"PRIx64, section->offset_within_address_space,
+                         (uint64_t)create.start_addr);
+        return false;
     }
     trace_vfio_spapr_create_window(create.page_shift,
                                    create.levels,
@@ -320,7 +320,7 @@ static int vfio_spapr_create_window(VFIOContainer *container,
                                    create.start_addr);
     *pgsize = pagesize;
 
-    return 0;
+    return true;
 }
 
 static bool
@@ -377,9 +377,8 @@ vfio_spapr_container_add_section_window(VFIOContainerBase *bcontainer,
         }
     }
 
-    ret = vfio_spapr_create_window(container, section, &pgsize);
-    if (ret) {
-        error_setg_errno(errp, -ret, "Failed to create SPAPR window");
+    ret = vfio_spapr_create_window(container, section, &pgsize, errp);
+    if (!ret) {
         return false;
     }
 

From d5e8e6195bcd37292657b5f69d7633b51670caf1 Mon Sep 17 00:00:00 2001
From: Amit Machhiwal <amachhiw@linux.ibm.com>
Date: Tue, 8 Apr 2025 18:10:42 +0530
Subject: [PATCH 0250/2760] vfio/spapr: Fix L2 crash with PCI device
 passthrough and memory > 128G
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

An L2 KVM guest fails to boot inside a pSeries LPAR when booted with a
memory more than 128 GB and PCI device passthrough. The L2 guest also
crashes when it is booted with a memory greater than 128 GB and a PCI
device is hotplugged later.

The issue arises from a conditional check for `levels > 1` in
`spapr_tce_create_table()` within L1 KVM. This check is meant to prevent
multi-level TCEs, which are not supported by the PowerVM hypervisor. As
a result, when QEMU makes a `VFIO_IOMMU_SPAPR_TCE_CREATE` ioctl call
with `levels > 1`, it triggers the conditional check and returns
`EINVAL`, causing the guest to crash with the following errors:

 2025-03-04T06:36:36.133117Z qemu-system-ppc64: Failed to create a window, ret = -1 (Invalid argument)
 2025-03-04T06:36:36.133176Z qemu-system-ppc64: Failed to create SPAPR window: Invalid argument
 qemu: hardware error: vfio: DMA mapping failed, unable to continue

Fix this by checking the supported DDW "levels" returned by the
VFIO_IOMMU_SPAPR_TCE_GET_INFO ioctl before attempting the TCE create
ioctl in KVM.

The patch has been tested on KVM guests with memory configurations of up
to 390GB, and 450GB on PowerVM and bare-metal environments respectively.

Signed-off-by: Amit Machhiwal <amachhiw@linux.ibm.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250408124042.2695955-3-amachhiw@linux.ibm.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/spapr.c | 36 +++++++++++++++++++++++++++---------
 1 file changed, 27 insertions(+), 9 deletions(-)

diff --git a/hw/vfio/spapr.c b/hw/vfio/spapr.c
index 3d6354134c..7e5cb95f6a 100644
--- a/hw/vfio/spapr.c
+++ b/hw/vfio/spapr.c
@@ -26,6 +26,7 @@ typedef struct VFIOSpaprContainer {
     VFIOContainer container;
     MemoryListener prereg_listener;
     QLIST_HEAD(, VFIOHostDMAWindow) hostwin_list;
+    unsigned int levels;
 } VFIOSpaprContainer;
 
 OBJECT_DECLARE_SIMPLE_TYPE(VFIOSpaprContainer, VFIO_IOMMU_SPAPR);
@@ -236,9 +237,11 @@ static bool vfio_spapr_create_window(VFIOContainer *container,
 {
     int ret = 0;
     VFIOContainerBase *bcontainer = &container->bcontainer;
+    VFIOSpaprContainer *scontainer = container_of(container, VFIOSpaprContainer,
+                                                  container);
     IOMMUMemoryRegion *iommu_mr = IOMMU_MEMORY_REGION(section->mr);
     uint64_t pagesize = memory_region_iommu_get_min_page_size(iommu_mr), pgmask;
-    unsigned entries, bits_total, bits_per_level, max_levels;
+    unsigned entries, bits_total, bits_per_level, max_levels, ddw_levels;
     struct vfio_iommu_spapr_tce_create create = { .argsz = sizeof(create) };
     long rampagesize = qemu_minrampagesize();
 
@@ -291,16 +294,29 @@ static bool vfio_spapr_create_window(VFIOContainer *container,
      */
     bits_per_level = ctz64(qemu_real_host_page_size()) + 8;
     create.levels = bits_total / bits_per_level;
-    if (bits_total % bits_per_level) {
-        ++create.levels;
-    }
-    max_levels = (64 - create.page_shift) / ctz64(qemu_real_host_page_size());
-    for ( ; create.levels <= max_levels; ++create.levels) {
-        ret = ioctl(container->fd, VFIO_IOMMU_SPAPR_TCE_CREATE, &create);
-        if (!ret) {
-            break;
+
+    ddw_levels = scontainer->levels;
+    if (ddw_levels > 1) {
+        if (bits_total % bits_per_level) {
+            ++create.levels;
         }
+        max_levels = (64 - create.page_shift) / ctz64(qemu_real_host_page_size());
+        for ( ; create.levels <= max_levels; ++create.levels) {
+            ret = ioctl(container->fd, VFIO_IOMMU_SPAPR_TCE_CREATE, &create);
+            if (!ret) {
+                break;
+            }
+        }
+    } else { /* ddw_levels == 1 */
+        if (create.levels > ddw_levels) {
+            error_setg_errno(errp, EINVAL, "Host doesn't support multi-level TCE tables"
+                             ". Use larger IO page size. Supported mask is 0x%lx",
+                             bcontainer->pgsizes);
+            return false;
+        }
+        ret = ioctl(container->fd, VFIO_IOMMU_SPAPR_TCE_CREATE, &create);
     }
+
     if (ret) {
         error_setg_errno(errp, errno, "Failed to create a window, ret = %d", ret);
         return false;
@@ -501,6 +517,8 @@ static bool vfio_spapr_container_setup(VFIOContainerBase *bcontainer,
         goto listener_unregister_exit;
     }
 
+    scontainer->levels = info.ddw.levels;
+
     if (v2) {
         bcontainer->pgsizes = info.ddw.pgsizes;
         /*

From acea0f0fafcf89f374fd7a69a4cd2c91d6d7d68a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Wed, 26 Mar 2025 08:50:46 +0100
Subject: [PATCH 0251/2760] vfio: Move vfio_mig_active() into migration.c
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

vfio_mig_active() is part of the VFIO migration API. Move the
definitions where VFIO migration is implemented.

Reviewed-by: Avihai Horon <avihaih@nvidia.com>
Reviewed-by: John Levon <john.levon@nutanix.com>
Link: https://lore.kernel.org/qemu-devel/20250318095415.670319-2-clg@redhat.com
Link: https://lore.kernel.org/qemu-devel/20250326075122.1299361-2-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/common.c    | 16 ----------------
 hw/vfio/migration.c | 16 ++++++++++++++++
 2 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/hw/vfio/common.c b/hw/vfio/common.c
index 5ef14931cd..2ea4e12c90 100644
--- a/hw/vfio/common.c
+++ b/hw/vfio/common.c
@@ -65,22 +65,6 @@ int vfio_kvm_device_fd = -1;
  * Device state interfaces
  */
 
-bool vfio_mig_active(void)
-{
-    VFIODevice *vbasedev;
-
-    if (QLIST_EMPTY(&vfio_device_list)) {
-        return false;
-    }
-
-    QLIST_FOREACH(vbasedev, &vfio_device_list, global_next) {
-        if (vbasedev->migration_blocker) {
-            return false;
-        }
-    }
-    return true;
-}
-
 static Error *multiple_devices_migration_blocker;
 
 /*
diff --git a/hw/vfio/migration.c b/hw/vfio/migration.c
index fbff46cfc3..b5fb0d2188 100644
--- a/hw/vfio/migration.c
+++ b/hw/vfio/migration.c
@@ -1062,6 +1062,22 @@ void vfio_mig_add_bytes_transferred(unsigned long val)
     qatomic_add(&bytes_transferred, val);
 }
 
+bool vfio_mig_active(void)
+{
+    VFIODevice *vbasedev;
+
+    if (QLIST_EMPTY(&vfio_device_list)) {
+        return false;
+    }
+
+    QLIST_FOREACH(vbasedev, &vfio_device_list, global_next) {
+        if (vbasedev->migration_blocker) {
+            return false;
+        }
+    }
+    return true;
+}
+
 /*
  * Return true when either migration initialized or blocker registered.
  * Currently only return false when adding blocker fails which will

From 426ffab477e22606473282c684b9239f8a30dd6d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Wed, 26 Mar 2025 08:50:47 +0100
Subject: [PATCH 0252/2760] vfio: Rename vfio_reset_bytes_transferred()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Enforce a 'vfio_mig_' prefix for the VFIO migration API to better
reflect the namespace these routines belong to.

Reviewed-by: Avihai Horon <avihaih@nvidia.com>
Reviewed-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/qemu-devel/20250318095415.670319-3-clg@redhat.com
Link: https://lore.kernel.org/qemu-devel/20250326075122.1299361-3-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/migration.c           | 2 +-
 include/hw/vfio/vfio-common.h | 2 +-
 migration/target.c            | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/hw/vfio/migration.c b/hw/vfio/migration.c
index b5fb0d2188..8bf65b8e11 100644
--- a/hw/vfio/migration.c
+++ b/hw/vfio/migration.c
@@ -1052,7 +1052,7 @@ int64_t vfio_mig_bytes_transferred(void)
     return MIN(qatomic_read(&bytes_transferred), INT64_MAX);
 }
 
-void vfio_reset_bytes_transferred(void)
+void vfio_mig_reset_bytes_transferred(void)
 {
     qatomic_set(&bytes_transferred, 0);
 }
diff --git a/include/hw/vfio/vfio-common.h b/include/hw/vfio/vfio-common.h
index f5b3f45a43..f58cae9e55 100644
--- a/include/hw/vfio/vfio-common.h
+++ b/include/hw/vfio/vfio-common.h
@@ -295,7 +295,7 @@ int vfio_block_multiple_devices_migration(VFIODevice *vbasedev, Error **errp);
 void vfio_unblock_multiple_devices_migration(void);
 bool vfio_viommu_preset(VFIODevice *vbasedev);
 int64_t vfio_mig_bytes_transferred(void);
-void vfio_reset_bytes_transferred(void);
+void vfio_mig_reset_bytes_transferred(void);
 void vfio_mig_add_bytes_transferred(unsigned long val);
 bool vfio_device_state_is_running(VFIODevice *vbasedev);
 bool vfio_device_state_is_precopy(VFIODevice *vbasedev);
diff --git a/migration/target.c b/migration/target.c
index a6ffa9a5ce..f5d8cfe7c2 100644
--- a/migration/target.c
+++ b/migration/target.c
@@ -25,7 +25,7 @@ void migration_populate_vfio_info(MigrationInfo *info)
 
 void migration_reset_vfio_bytes_transferred(void)
 {
-    vfio_reset_bytes_transferred();
+    vfio_mig_reset_bytes_transferred();
 }
 #else
 void migration_populate_vfio_info(MigrationInfo *info)

From e1d4ea53d6e393def88258a3badf8907db33608e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Wed, 26 Mar 2025 08:50:48 +0100
Subject: [PATCH 0253/2760] vfio: Introduce a new header file for external
 migration services
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The migration core subsystem makes use of the VFIO migration API to
collect statistics on the number of bytes transferred. These services
are declared in "hw/vfio/vfio-common.h" which also contains VFIO
internal declarations. Move the migration declarations into a new
header file "hw/vfio/vfio-migration.h" to reduce the exposure of VFIO
internals.

While at it, use a 'vfio_migration_' prefix for these services.

To be noted, vfio_migration_add_bytes_transferred() is a VFIO
migration internal service which we will be moved in the subsequent
patches.

Cc: Kirti Wankhede <kwankhede@nvidia.com>
Cc: Avihai Horon <avihaih@nvidia.com>
Reviewed-by: Prasad Pandit <pjp@fedoraproject.org>
Reviewed-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Avihai Horon <avihaih@nvidia.com>
Link: https://lore.kernel.org/qemu-devel/20250326075122.1299361-4-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/migration-multifd.c      |  5 +++--
 hw/vfio/migration.c              | 11 ++++++-----
 include/hw/vfio/vfio-common.h    |  5 +----
 include/hw/vfio/vfio-migration.h | 16 ++++++++++++++++
 migration/target.c               |  8 ++++----
 5 files changed, 30 insertions(+), 15 deletions(-)
 create mode 100644 include/hw/vfio/vfio-migration.h

diff --git a/hw/vfio/migration-multifd.c b/hw/vfio/migration-multifd.c
index 378f6f3bf0..09aa57f5f8 100644
--- a/hw/vfio/migration-multifd.c
+++ b/hw/vfio/migration-multifd.c
@@ -11,6 +11,7 @@
 
 #include "qemu/osdep.h"
 #include "hw/vfio/vfio-common.h"
+#include "hw/vfio/vfio-migration.h"
 #include "migration/misc.h"
 #include "qapi/error.h"
 #include "qemu/bswap.h"
@@ -575,7 +576,7 @@ vfio_save_complete_precopy_thread_config_state(VFIODevice *vbasedev,
         return false;
     }
 
-    vfio_mig_add_bytes_transferred(packet_len);
+    vfio_migration_add_bytes_transferred(packet_len);
 
     return true;
 }
@@ -645,7 +646,7 @@ vfio_multifd_save_complete_precopy_thread(SaveLiveCompletePrecopyThreadData *d,
             goto thread_exit;
         }
 
-        vfio_mig_add_bytes_transferred(packet_size);
+        vfio_migration_add_bytes_transferred(packet_size);
     }
 
     if (!vfio_save_complete_precopy_thread_config_state(vbasedev,
diff --git a/hw/vfio/migration.c b/hw/vfio/migration.c
index 8bf65b8e11..582d65932a 100644
--- a/hw/vfio/migration.c
+++ b/hw/vfio/migration.c
@@ -17,6 +17,7 @@
 
 #include "system/runstate.h"
 #include "hw/vfio/vfio-common.h"
+#include "hw/vfio/vfio-migration.h"
 #include "migration/misc.h"
 #include "migration/savevm.h"
 #include "migration/vmstate.h"
@@ -373,7 +374,7 @@ static ssize_t vfio_save_block(QEMUFile *f, VFIOMigration *migration)
     qemu_put_be64(f, VFIO_MIG_FLAG_DEV_DATA_STATE);
     qemu_put_be64(f, data_size);
     qemu_put_buffer(f, migration->data_buffer, data_size);
-    vfio_mig_add_bytes_transferred(data_size);
+    vfio_migration_add_bytes_transferred(data_size);
 
     trace_vfio_save_block(migration->vbasedev->name, data_size);
 
@@ -1047,22 +1048,22 @@ static int vfio_block_migration(VFIODevice *vbasedev, Error *err, Error **errp)
 
 /* ---------------------------------------------------------------------- */
 
-int64_t vfio_mig_bytes_transferred(void)
+int64_t vfio_migration_bytes_transferred(void)
 {
     return MIN(qatomic_read(&bytes_transferred), INT64_MAX);
 }
 
-void vfio_mig_reset_bytes_transferred(void)
+void vfio_migration_reset_bytes_transferred(void)
 {
     qatomic_set(&bytes_transferred, 0);
 }
 
-void vfio_mig_add_bytes_transferred(unsigned long val)
+void vfio_migration_add_bytes_transferred(unsigned long val)
 {
     qatomic_add(&bytes_transferred, val);
 }
 
-bool vfio_mig_active(void)
+bool vfio_migration_active(void)
 {
     VFIODevice *vbasedev;
 
diff --git a/include/hw/vfio/vfio-common.h b/include/hw/vfio/vfio-common.h
index f58cae9e55..7a551bb230 100644
--- a/include/hw/vfio/vfio-common.h
+++ b/include/hw/vfio/vfio-common.h
@@ -290,13 +290,10 @@ extern VFIODeviceList vfio_device_list;
 extern const MemoryListener vfio_memory_listener;
 extern int vfio_kvm_device_fd;
 
-bool vfio_mig_active(void);
 int vfio_block_multiple_devices_migration(VFIODevice *vbasedev, Error **errp);
 void vfio_unblock_multiple_devices_migration(void);
 bool vfio_viommu_preset(VFIODevice *vbasedev);
-int64_t vfio_mig_bytes_transferred(void);
-void vfio_mig_reset_bytes_transferred(void);
-void vfio_mig_add_bytes_transferred(unsigned long val);
+void vfio_migration_add_bytes_transferred(unsigned long val);
 bool vfio_device_state_is_running(VFIODevice *vbasedev);
 bool vfio_device_state_is_precopy(VFIODevice *vbasedev);
 
diff --git a/include/hw/vfio/vfio-migration.h b/include/hw/vfio/vfio-migration.h
new file mode 100644
index 0000000000..0d4ecd33d5
--- /dev/null
+++ b/include/hw/vfio/vfio-migration.h
@@ -0,0 +1,16 @@
+/*
+ * VFIO migration interface
+ *
+ * Copyright Red Hat, Inc. 2025
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef HW_VFIO_VFIO_MIGRATION_H
+#define HW_VFIO_VFIO_MIGRATION_H
+
+bool vfio_migration_active(void);
+int64_t vfio_migration_bytes_transferred(void);
+void vfio_migration_reset_bytes_transferred(void);
+
+#endif /* HW_VFIO_VFIO_MIGRATION_H */
diff --git a/migration/target.c b/migration/target.c
index f5d8cfe7c2..12fd399f0c 100644
--- a/migration/target.c
+++ b/migration/target.c
@@ -11,21 +11,21 @@
 #include CONFIG_DEVICES
 
 #ifdef CONFIG_VFIO
-#include "hw/vfio/vfio-common.h"
+#include "hw/vfio/vfio-migration.h"
 #endif
 
 #ifdef CONFIG_VFIO
 void migration_populate_vfio_info(MigrationInfo *info)
 {
-    if (vfio_mig_active()) {
+    if (vfio_migration_active()) {
         info->vfio = g_malloc0(sizeof(*info->vfio));
-        info->vfio->transferred = vfio_mig_bytes_transferred();
+        info->vfio->transferred = vfio_migration_bytes_transferred();
     }
 }
 
 void migration_reset_vfio_bytes_transferred(void)
 {
-    vfio_mig_reset_bytes_transferred();
+    vfio_migration_reset_bytes_transferred();
 }
 #else
 void migration_populate_vfio_info(MigrationInfo *info)

From 0a73045687edb6d4b0dac90ca7ae19bf6b3eeb6b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Wed, 26 Mar 2025 08:50:49 +0100
Subject: [PATCH 0254/2760] vfio: Make
 vfio_un/block_multiple_devices_migration() static
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Both of these routines are only used in file "migration.c". Move them
there.

Reviewed-by: Joao Martins <joao.m.martins@oracle.com>
Link: https://lore.kernel.org/qemu-devel/20250318095415.670319-5-clg@redhat.com
Reviewed-by: John Levon <john.levon@nutanix.com>
Link: https://lore.kernel.org/qemu-devel/20250326075122.1299361-5-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/common.c              | 59 -----------------------------------
 hw/vfio/migration.c           | 59 +++++++++++++++++++++++++++++++++++
 include/hw/vfio/vfio-common.h |  2 --
 3 files changed, 59 insertions(+), 61 deletions(-)

diff --git a/hw/vfio/common.c b/hw/vfio/common.c
index 2ea4e12c90..d65e77b93a 100644
--- a/hw/vfio/common.c
+++ b/hw/vfio/common.c
@@ -40,7 +40,6 @@
 #include "trace.h"
 #include "qapi/error.h"
 #include "migration/misc.h"
-#include "migration/blocker.h"
 #include "migration/qemu-file.h"
 #include "system/tcg.h"
 #include "system/tpm.h"
@@ -65,64 +64,6 @@ int vfio_kvm_device_fd = -1;
  * Device state interfaces
  */
 
-static Error *multiple_devices_migration_blocker;
-
-/*
- * Multiple devices migration is allowed only if all devices support P2P
- * migration. Single device migration is allowed regardless of P2P migration
- * support.
- */
-static bool vfio_multiple_devices_migration_is_supported(void)
-{
-    VFIODevice *vbasedev;
-    unsigned int device_num = 0;
-    bool all_support_p2p = true;
-
-    QLIST_FOREACH(vbasedev, &vfio_device_list, global_next) {
-        if (vbasedev->migration) {
-            device_num++;
-
-            if (!(vbasedev->migration->mig_flags & VFIO_MIGRATION_P2P)) {
-                all_support_p2p = false;
-            }
-        }
-    }
-
-    return all_support_p2p || device_num <= 1;
-}
-
-int vfio_block_multiple_devices_migration(VFIODevice *vbasedev, Error **errp)
-{
-    if (vfio_multiple_devices_migration_is_supported()) {
-        return 0;
-    }
-
-    if (vbasedev->enable_migration == ON_OFF_AUTO_ON) {
-        error_setg(errp, "Multiple VFIO devices migration is supported only if "
-                         "all of them support P2P migration");
-        return -EINVAL;
-    }
-
-    if (multiple_devices_migration_blocker) {
-        return 0;
-    }
-
-    error_setg(&multiple_devices_migration_blocker,
-               "Multiple VFIO devices migration is supported only if all of "
-               "them support P2P migration");
-    return migrate_add_blocker_normal(&multiple_devices_migration_blocker,
-                                      errp);
-}
-
-void vfio_unblock_multiple_devices_migration(void)
-{
-    if (!multiple_devices_migration_blocker ||
-        !vfio_multiple_devices_migration_is_supported()) {
-        return;
-    }
-
-    migrate_del_blocker(&multiple_devices_migration_blocker);
-}
 
 bool vfio_viommu_preset(VFIODevice *vbasedev)
 {
diff --git a/hw/vfio/migration.c b/hw/vfio/migration.c
index 582d65932a..ace3d8548e 100644
--- a/hw/vfio/migration.c
+++ b/hw/vfio/migration.c
@@ -1022,6 +1022,65 @@ static int vfio_migration_init(VFIODevice *vbasedev)
     return 0;
 }
 
+static Error *multiple_devices_migration_blocker;
+
+/*
+ * Multiple devices migration is allowed only if all devices support P2P
+ * migration. Single device migration is allowed regardless of P2P migration
+ * support.
+ */
+static bool vfio_multiple_devices_migration_is_supported(void)
+{
+    VFIODevice *vbasedev;
+    unsigned int device_num = 0;
+    bool all_support_p2p = true;
+
+    QLIST_FOREACH(vbasedev, &vfio_device_list, global_next) {
+        if (vbasedev->migration) {
+            device_num++;
+
+            if (!(vbasedev->migration->mig_flags & VFIO_MIGRATION_P2P)) {
+                all_support_p2p = false;
+            }
+        }
+    }
+
+    return all_support_p2p || device_num <= 1;
+}
+
+static int vfio_block_multiple_devices_migration(VFIODevice *vbasedev, Error **errp)
+{
+    if (vfio_multiple_devices_migration_is_supported()) {
+        return 0;
+    }
+
+    if (vbasedev->enable_migration == ON_OFF_AUTO_ON) {
+        error_setg(errp, "Multiple VFIO devices migration is supported only if "
+                         "all of them support P2P migration");
+        return -EINVAL;
+    }
+
+    if (multiple_devices_migration_blocker) {
+        return 0;
+    }
+
+    error_setg(&multiple_devices_migration_blocker,
+               "Multiple VFIO devices migration is supported only if all of "
+               "them support P2P migration");
+    return migrate_add_blocker_normal(&multiple_devices_migration_blocker,
+                                      errp);
+}
+
+static void vfio_unblock_multiple_devices_migration(void)
+{
+    if (!multiple_devices_migration_blocker ||
+        !vfio_multiple_devices_migration_is_supported()) {
+        return;
+    }
+
+    migrate_del_blocker(&multiple_devices_migration_blocker);
+}
+
 static void vfio_migration_deinit(VFIODevice *vbasedev)
 {
     VFIOMigration *migration = vbasedev->migration;
diff --git a/include/hw/vfio/vfio-common.h b/include/hw/vfio/vfio-common.h
index 7a551bb230..5f1c0bee9d 100644
--- a/include/hw/vfio/vfio-common.h
+++ b/include/hw/vfio/vfio-common.h
@@ -290,8 +290,6 @@ extern VFIODeviceList vfio_device_list;
 extern const MemoryListener vfio_memory_listener;
 extern int vfio_kvm_device_fd;
 
-int vfio_block_multiple_devices_migration(VFIODevice *vbasedev, Error **errp);
-void vfio_unblock_multiple_devices_migration(void);
 bool vfio_viommu_preset(VFIODevice *vbasedev);
 void vfio_migration_add_bytes_transferred(unsigned long val);
 bool vfio_device_state_is_running(VFIODevice *vbasedev);

From d04a35cb742e6e3b3682e31addb7b68b22b1c6c3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Wed, 26 Mar 2025 08:50:50 +0100
Subject: [PATCH 0255/2760] vfio: Make vfio_viommu_preset() static
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This routine is only used in file "migration.c". Move it there.

Reviewed-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Joao Martins <joao.m.martins@oracle.com>
Link: https://lore.kernel.org/qemu-devel/20250318095415.670319-6-clg@redhat.com
Link: https://lore.kernel.org/qemu-devel/20250326075122.1299361-6-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/common.c              | 5 -----
 hw/vfio/migration.c           | 5 +++++
 include/hw/vfio/vfio-common.h | 1 -
 3 files changed, 5 insertions(+), 6 deletions(-)

diff --git a/hw/vfio/common.c b/hw/vfio/common.c
index d65e77b93a..679076343a 100644
--- a/hw/vfio/common.c
+++ b/hw/vfio/common.c
@@ -65,11 +65,6 @@ int vfio_kvm_device_fd = -1;
  */
 
 
-bool vfio_viommu_preset(VFIODevice *vbasedev)
-{
-    return vbasedev->bcontainer->space->as != &address_space_memory;
-}
-
 bool vfio_device_state_is_running(VFIODevice *vbasedev)
 {
     VFIOMigration *migration = vbasedev->migration;
diff --git a/hw/vfio/migration.c b/hw/vfio/migration.c
index ace3d8548e..b5bb0cd092 100644
--- a/hw/vfio/migration.c
+++ b/hw/vfio/migration.c
@@ -1138,6 +1138,11 @@ bool vfio_migration_active(void)
     return true;
 }
 
+static bool vfio_viommu_preset(VFIODevice *vbasedev)
+{
+    return vbasedev->bcontainer->space->as != &address_space_memory;
+}
+
 /*
  * Return true when either migration initialized or blocker registered.
  * Currently only return false when adding blocker fails which will
diff --git a/include/hw/vfio/vfio-common.h b/include/hw/vfio/vfio-common.h
index 5f1c0bee9d..8c56921506 100644
--- a/include/hw/vfio/vfio-common.h
+++ b/include/hw/vfio/vfio-common.h
@@ -290,7 +290,6 @@ extern VFIODeviceList vfio_device_list;
 extern const MemoryListener vfio_memory_listener;
 extern int vfio_kvm_device_fd;
 
-bool vfio_viommu_preset(VFIODevice *vbasedev);
 void vfio_migration_add_bytes_transferred(unsigned long val);
 bool vfio_device_state_is_running(VFIODevice *vbasedev);
 bool vfio_device_state_is_precopy(VFIODevice *vbasedev);

From b553d2c414a1b5c5bd3bf8bce0b648ba7f8e2baf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Wed, 26 Mar 2025 08:50:51 +0100
Subject: [PATCH 0256/2760] vfio: Introduce a new header file for internal
 migration services
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Gather all VFIO migration related declarations into
"vfio-migration-internal.h" to reduce exposure of VFIO internals in
"hw/vfio/vfio-common.h".

Cc: Kirti Wankhede <kwankhede@nvidia.com>
Cc: Avihai Horon <avihaih@nvidia.com>
Reviewed-by: Prasad Pandit <pjp@fedoraproject.org>
Reviewed-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Avihai Horon <avihaih@nvidia.com>
Link: https://lore.kernel.org/qemu-devel/20250326075122.1299361-7-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/common.c                  |  1 +
 hw/vfio/migration-multifd.c       |  2 +-
 hw/vfio/migration.c               |  1 +
 hw/vfio/pci.c                     |  1 +
 hw/vfio/vfio-migration-internal.h | 72 +++++++++++++++++++++++++++++++
 include/hw/vfio/vfio-common.h     | 52 +---------------------
 6 files changed, 77 insertions(+), 52 deletions(-)
 create mode 100644 hw/vfio/vfio-migration-internal.h

diff --git a/hw/vfio/common.c b/hw/vfio/common.c
index 679076343a..bef5414dd7 100644
--- a/hw/vfio/common.c
+++ b/hw/vfio/common.c
@@ -43,6 +43,7 @@
 #include "migration/qemu-file.h"
 #include "system/tcg.h"
 #include "system/tpm.h"
+#include "vfio-migration-internal.h"
 
 VFIODeviceList vfio_device_list =
     QLIST_HEAD_INITIALIZER(vfio_device_list);
diff --git a/hw/vfio/migration-multifd.c b/hw/vfio/migration-multifd.c
index 09aa57f5f8..a3005226b9 100644
--- a/hw/vfio/migration-multifd.c
+++ b/hw/vfio/migration-multifd.c
@@ -11,7 +11,6 @@
 
 #include "qemu/osdep.h"
 #include "hw/vfio/vfio-common.h"
-#include "hw/vfio/vfio-migration.h"
 #include "migration/misc.h"
 #include "qapi/error.h"
 #include "qemu/bswap.h"
@@ -22,6 +21,7 @@
 #include "io/channel-buffer.h"
 #include "migration/qemu-file.h"
 #include "migration-multifd.h"
+#include "vfio-migration-internal.h"
 #include "trace.h"
 
 #define VFIO_DEVICE_STATE_CONFIG_STATE (1)
diff --git a/hw/vfio/migration.c b/hw/vfio/migration.c
index b5bb0cd092..54f6ca3e7c 100644
--- a/hw/vfio/migration.c
+++ b/hw/vfio/migration.c
@@ -31,6 +31,7 @@
 #include "pci.h"
 #include "trace.h"
 #include "hw/hw.h"
+#include "vfio-migration-internal.h"
 
 /*
  * This is an arbitrary size based on migration of mlx5 devices, where typically
diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index f87f3ccbe1..b0aac2f3a0 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -44,6 +44,7 @@
 #include "migration/blocker.h"
 #include "migration/qemu-file.h"
 #include "system/iommufd.h"
+#include "vfio-migration-internal.h"
 
 #define TYPE_VFIO_PCI_NOHOTPLUG "vfio-pci-nohotplug"
 
diff --git a/hw/vfio/vfio-migration-internal.h b/hw/vfio/vfio-migration-internal.h
new file mode 100644
index 0000000000..ab6a1bad9b
--- /dev/null
+++ b/hw/vfio/vfio-migration-internal.h
@@ -0,0 +1,72 @@
+/*
+ * VFIO migration
+ *
+ * Copyright Red Hat, Inc. 2025
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef HW_VFIO_VFIO_MIGRATION_INTERNAL_H
+#define HW_VFIO_VFIO_MIGRATION_INTERNAL_H
+
+#ifdef CONFIG_LINUX
+#include <linux/vfio.h>
+#endif
+
+#include "qemu/typedefs.h"
+#include "qemu/notify.h"
+
+/*
+ * Flags to be used as unique delimiters for VFIO devices in the migration
+ * stream. These flags are composed as:
+ * 0xffffffff => MSB 32-bit all 1s
+ * 0xef10     => Magic ID, represents emulated (virtual) function IO
+ * 0x0000     => 16-bits reserved for flags
+ *
+ * The beginning of state information is marked by _DEV_CONFIG_STATE,
+ * _DEV_SETUP_STATE, or _DEV_DATA_STATE, respectively. The end of a
+ * certain state information is marked by _END_OF_STATE.
+ */
+#define VFIO_MIG_FLAG_END_OF_STATE      (0xffffffffef100001ULL)
+#define VFIO_MIG_FLAG_DEV_CONFIG_STATE  (0xffffffffef100002ULL)
+#define VFIO_MIG_FLAG_DEV_SETUP_STATE   (0xffffffffef100003ULL)
+#define VFIO_MIG_FLAG_DEV_DATA_STATE    (0xffffffffef100004ULL)
+#define VFIO_MIG_FLAG_DEV_INIT_DATA_SENT (0xffffffffef100005ULL)
+
+typedef struct VFIODevice VFIODevice;
+typedef struct VFIOMultifd VFIOMultifd;
+
+typedef struct VFIOMigration {
+    struct VFIODevice *vbasedev;
+    VMChangeStateEntry *vm_state;
+    NotifierWithReturn migration_state;
+    uint32_t device_state;
+    int data_fd;
+    void *data_buffer;
+    size_t data_buffer_size;
+    uint64_t mig_flags;
+    uint64_t precopy_init_size;
+    uint64_t precopy_dirty_size;
+    bool multifd_transfer;
+    VFIOMultifd *multifd;
+    bool initial_data_sent;
+
+    bool event_save_iterate_started;
+    bool event_precopy_empty_hit;
+} VFIOMigration;
+
+bool vfio_migration_realize(VFIODevice *vbasedev, Error **errp);
+void vfio_migration_exit(VFIODevice *vbasedev);
+int vfio_save_device_config_state(QEMUFile *f, void *opaque, Error **errp);
+int vfio_load_device_config_state(QEMUFile *f, void *opaque);
+
+#ifdef CONFIG_LINUX
+int vfio_migration_set_state(VFIODevice *vbasedev,
+                             enum vfio_device_mig_state new_state,
+                             enum vfio_device_mig_state recover_state,
+                             Error **errp);
+#endif
+
+void vfio_migration_add_bytes_transferred(unsigned long val);
+
+#endif /* HW_VFIO_VFIO_MIGRATION_INTERNAL_H */
diff --git a/include/hw/vfio/vfio-common.h b/include/hw/vfio/vfio-common.h
index 8c56921506..05c88753ce 100644
--- a/include/hw/vfio/vfio-common.h
+++ b/include/hw/vfio/vfio-common.h
@@ -23,7 +23,6 @@
 
 #include "system/memory.h"
 #include "qemu/queue.h"
-#include "qemu/notify.h"
 #include "ui/console.h"
 #include "hw/display/ramfb.h"
 #ifdef CONFIG_LINUX
@@ -36,23 +35,6 @@
 
 #define VFIO_MSG_PREFIX "vfio %s: "
 
-/*
- * Flags to be used as unique delimiters for VFIO devices in the migration
- * stream. These flags are composed as:
- * 0xffffffff => MSB 32-bit all 1s
- * 0xef10     => Magic ID, represents emulated (virtual) function IO
- * 0x0000     => 16-bits reserved for flags
- *
- * The beginning of state information is marked by _DEV_CONFIG_STATE,
- * _DEV_SETUP_STATE, or _DEV_DATA_STATE, respectively. The end of a
- * certain state information is marked by _END_OF_STATE.
- */
-#define VFIO_MIG_FLAG_END_OF_STATE      (0xffffffffef100001ULL)
-#define VFIO_MIG_FLAG_DEV_CONFIG_STATE  (0xffffffffef100002ULL)
-#define VFIO_MIG_FLAG_DEV_SETUP_STATE   (0xffffffffef100003ULL)
-#define VFIO_MIG_FLAG_DEV_DATA_STATE    (0xffffffffef100004ULL)
-#define VFIO_MIG_FLAG_DEV_INIT_DATA_SENT (0xffffffffef100005ULL)
-
 enum {
     VFIO_DEVICE_TYPE_PCI = 0,
     VFIO_DEVICE_TYPE_PLATFORM = 1,
@@ -78,27 +60,6 @@ typedef struct VFIORegion {
     uint8_t nr; /* cache the region number for debug */
 } VFIORegion;
 
-typedef struct VFIOMultifd VFIOMultifd;
-
-typedef struct VFIOMigration {
-    struct VFIODevice *vbasedev;
-    VMChangeStateEntry *vm_state;
-    NotifierWithReturn migration_state;
-    uint32_t device_state;
-    int data_fd;
-    void *data_buffer;
-    size_t data_buffer_size;
-    uint64_t mig_flags;
-    uint64_t precopy_init_size;
-    uint64_t precopy_dirty_size;
-    bool multifd_transfer;
-    VFIOMultifd *multifd;
-    bool initial_data_sent;
-
-    bool event_save_iterate_started;
-    bool event_precopy_empty_hit;
-} VFIOMigration;
-
 struct VFIOGroup;
 
 typedef struct VFIOContainer {
@@ -136,6 +97,7 @@ typedef struct VFIOIOMMUFDContainer {
 OBJECT_DECLARE_SIMPLE_TYPE(VFIOIOMMUFDContainer, VFIO_IOMMU_IOMMUFD);
 
 typedef struct VFIODeviceOps VFIODeviceOps;
+typedef struct VFIOMigration VFIOMigration;
 
 typedef struct VFIODevice {
     QLIST_ENTRY(VFIODevice) next;
@@ -290,13 +252,9 @@ extern VFIODeviceList vfio_device_list;
 extern const MemoryListener vfio_memory_listener;
 extern int vfio_kvm_device_fd;
 
-void vfio_migration_add_bytes_transferred(unsigned long val);
 bool vfio_device_state_is_running(VFIODevice *vbasedev);
 bool vfio_device_state_is_precopy(VFIODevice *vbasedev);
 
-int vfio_save_device_config_state(QEMUFile *f, void *opaque, Error **errp);
-int vfio_load_device_config_state(QEMUFile *f, void *opaque);
-
 #ifdef CONFIG_LINUX
 int vfio_get_region_info(VFIODevice *vbasedev, int index,
                          struct vfio_region_info **info);
@@ -311,16 +269,8 @@ struct vfio_info_cap_header *
 vfio_get_device_info_cap(struct vfio_device_info *info, uint16_t id);
 struct vfio_info_cap_header *
 vfio_get_cap(void *ptr, uint32_t cap_offset, uint16_t id);
-
-int vfio_migration_set_state(VFIODevice *vbasedev,
-                             enum vfio_device_mig_state new_state,
-                             enum vfio_device_mig_state recover_state,
-                             Error **errp);
 #endif
 
-bool vfio_migration_realize(VFIODevice *vbasedev, Error **errp);
-void vfio_migration_exit(VFIODevice *vbasedev);
-
 int vfio_bitmap_alloc(VFIOBitmap *vbmap, hwaddr size);
 bool vfio_devices_all_dirty_tracking_started(
     const VFIOContainerBase *bcontainer);

From eb6caa79162a89a8dcbe6a6d4788acd813b687a2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Wed, 26 Mar 2025 08:50:52 +0100
Subject: [PATCH 0257/2760] vfio: Move vfio_device_state_is_running/precopy()
 into migration.c
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

These routines are migration related. Move their declaration and
implementation under the migration files.

Reviewed-by: Prasad Pandit <pjp@fedoraproject.org>
Reviewed-by: John Levon <john.levon@nutanix.com>
Link: https://lore.kernel.org/qemu-devel/20250326075122.1299361-8-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/common.c                  | 16 ----------------
 hw/vfio/migration.c               | 16 ++++++++++++++++
 hw/vfio/vfio-migration-internal.h |  2 ++
 include/hw/vfio/vfio-common.h     |  3 ---
 4 files changed, 18 insertions(+), 19 deletions(-)

diff --git a/hw/vfio/common.c b/hw/vfio/common.c
index bef5414dd7..8f55e7b212 100644
--- a/hw/vfio/common.c
+++ b/hw/vfio/common.c
@@ -66,22 +66,6 @@ int vfio_kvm_device_fd = -1;
  */
 
 
-bool vfio_device_state_is_running(VFIODevice *vbasedev)
-{
-    VFIOMigration *migration = vbasedev->migration;
-
-    return migration->device_state == VFIO_DEVICE_STATE_RUNNING ||
-           migration->device_state == VFIO_DEVICE_STATE_RUNNING_P2P;
-}
-
-bool vfio_device_state_is_precopy(VFIODevice *vbasedev)
-{
-    VFIOMigration *migration = vbasedev->migration;
-
-    return migration->device_state == VFIO_DEVICE_STATE_PRE_COPY ||
-           migration->device_state == VFIO_DEVICE_STATE_PRE_COPY_P2P;
-}
-
 static bool vfio_devices_all_device_dirty_tracking_started(
     const VFIOContainerBase *bcontainer)
 {
diff --git a/hw/vfio/migration.c b/hw/vfio/migration.c
index 54f6ca3e7c..4da0526325 100644
--- a/hw/vfio/migration.c
+++ b/hw/vfio/migration.c
@@ -1220,3 +1220,19 @@ void vfio_migration_exit(VFIODevice *vbasedev)
 
     migrate_del_blocker(&vbasedev->migration_blocker);
 }
+
+bool vfio_device_state_is_running(VFIODevice *vbasedev)
+{
+    VFIOMigration *migration = vbasedev->migration;
+
+    return migration->device_state == VFIO_DEVICE_STATE_RUNNING ||
+           migration->device_state == VFIO_DEVICE_STATE_RUNNING_P2P;
+}
+
+bool vfio_device_state_is_precopy(VFIODevice *vbasedev)
+{
+    VFIOMigration *migration = vbasedev->migration;
+
+    return migration->device_state == VFIO_DEVICE_STATE_PRE_COPY ||
+           migration->device_state == VFIO_DEVICE_STATE_PRE_COPY_P2P;
+}
diff --git a/hw/vfio/vfio-migration-internal.h b/hw/vfio/vfio-migration-internal.h
index ab6a1bad9b..a8b456b239 100644
--- a/hw/vfio/vfio-migration-internal.h
+++ b/hw/vfio/vfio-migration-internal.h
@@ -57,6 +57,8 @@ typedef struct VFIOMigration {
 
 bool vfio_migration_realize(VFIODevice *vbasedev, Error **errp);
 void vfio_migration_exit(VFIODevice *vbasedev);
+bool vfio_device_state_is_running(VFIODevice *vbasedev);
+bool vfio_device_state_is_precopy(VFIODevice *vbasedev);
 int vfio_save_device_config_state(QEMUFile *f, void *opaque, Error **errp);
 int vfio_load_device_config_state(QEMUFile *f, void *opaque);
 
diff --git a/include/hw/vfio/vfio-common.h b/include/hw/vfio/vfio-common.h
index 05c88753ce..fa0b74d5ea 100644
--- a/include/hw/vfio/vfio-common.h
+++ b/include/hw/vfio/vfio-common.h
@@ -252,9 +252,6 @@ extern VFIODeviceList vfio_device_list;
 extern const MemoryListener vfio_memory_listener;
 extern int vfio_kvm_device_fd;
 
-bool vfio_device_state_is_running(VFIODevice *vbasedev);
-bool vfio_device_state_is_precopy(VFIODevice *vbasedev);
-
 #ifdef CONFIG_LINUX
 int vfio_get_region_info(VFIODevice *vbasedev, int index,
                          struct vfio_region_info **info);

From aa173cb279e258ff591297fd0dedea43fd6f321d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Wed, 26 Mar 2025 08:50:53 +0100
Subject: [PATCH 0258/2760] vfio: Introduce a new header file for VFIOdisplay
 declarations
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Gather all VFIOdisplay related declarations into "vfio-display.h" to
reduce exposure of VFIO internals in "hw/vfio/vfio-common.h".

Reviewed-by: John Levon <john.levon@nutanix.com>
Link: https://lore.kernel.org/qemu-devel/20250318095415.670319-8-clg@redhat.com
Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Link: https://lore.kernel.org/qemu-devel/20250326075122.1299361-9-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/display.c             |  2 +-
 hw/vfio/pci.h                 |  1 +
 hw/vfio/vfio-display.h        | 41 +++++++++++++++++++++++++++++++++++
 include/hw/vfio/vfio-common.h | 28 ------------------------
 4 files changed, 43 insertions(+), 29 deletions(-)
 create mode 100644 hw/vfio/vfio-display.h

diff --git a/hw/vfio/display.c b/hw/vfio/display.c
index 4fdcef505d..70cfd685bd 100644
--- a/hw/vfio/display.c
+++ b/hw/vfio/display.c
@@ -16,9 +16,9 @@
 
 #include "qemu/error-report.h"
 #include "hw/display/edid.h"
-#include "ui/console.h"
 #include "qapi/error.h"
 #include "pci.h"
+#include "vfio-display.h"
 #include "trace.h"
 
 #ifndef DRM_PLANE_TYPE_PRIMARY
diff --git a/hw/vfio/pci.h b/hw/vfio/pci.h
index 6c59300248..62fd5f4997 100644
--- a/hw/vfio/pci.h
+++ b/hw/vfio/pci.h
@@ -20,6 +20,7 @@
 #include "qemu/timer.h"
 #include "qom/object.h"
 #include "system/kvm.h"
+#include "vfio-display.h"
 
 #define PCI_ANY_ID (~0)
 
diff --git a/hw/vfio/vfio-display.h b/hw/vfio/vfio-display.h
new file mode 100644
index 0000000000..99b8cb67ef
--- /dev/null
+++ b/hw/vfio/vfio-display.h
@@ -0,0 +1,41 @@
+/*
+ * VFIO display
+ *
+ * Copyright Red Hat, Inc. 2025
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef HW_VFIO_VFIO_DISPLAY_H
+#define HW_VFIO_VFIO_DISPLAY_H
+
+#include "ui/console.h"
+#include "hw/display/ramfb.h"
+
+typedef struct VFIODMABuf {
+    QemuDmaBuf *buf;
+    uint32_t pos_x, pos_y, pos_updates;
+    uint32_t hot_x, hot_y, hot_updates;
+    int dmabuf_id;
+    QTAILQ_ENTRY(VFIODMABuf) next;
+} VFIODMABuf;
+
+typedef struct VFIODisplay {
+    QemuConsole *con;
+    RAMFBState *ramfb;
+    struct vfio_region_info *edid_info;
+    struct vfio_region_gfx_edid *edid_regs;
+    uint8_t *edid_blob;
+    QEMUTimer *edid_link_timer;
+    struct {
+        VFIORegion buffer;
+        DisplaySurface *surface;
+    } region;
+    struct {
+        QTAILQ_HEAD(, VFIODMABuf) bufs;
+        VFIODMABuf *primary;
+        VFIODMABuf *cursor;
+    } dmabuf;
+} VFIODisplay;
+
+#endif /* HW_VFIO_VFIO_DISPLAY_H */
diff --git a/include/hw/vfio/vfio-common.h b/include/hw/vfio/vfio-common.h
index fa0b74d5ea..528eafadf9 100644
--- a/include/hw/vfio/vfio-common.h
+++ b/include/hw/vfio/vfio-common.h
@@ -23,8 +23,6 @@
 
 #include "system/memory.h"
 #include "qemu/queue.h"
-#include "ui/console.h"
-#include "hw/display/ramfb.h"
 #ifdef CONFIG_LINUX
 #include <linux/vfio.h>
 #endif
@@ -182,32 +180,6 @@ typedef struct VFIOGroup {
 #define TYPE_HOST_IOMMU_DEVICE_IOMMUFD_VFIO \
             TYPE_HOST_IOMMU_DEVICE_IOMMUFD "-vfio"
 
-typedef struct VFIODMABuf {
-    QemuDmaBuf *buf;
-    uint32_t pos_x, pos_y, pos_updates;
-    uint32_t hot_x, hot_y, hot_updates;
-    int dmabuf_id;
-    QTAILQ_ENTRY(VFIODMABuf) next;
-} VFIODMABuf;
-
-typedef struct VFIODisplay {
-    QemuConsole *con;
-    RAMFBState *ramfb;
-    struct vfio_region_info *edid_info;
-    struct vfio_region_gfx_edid *edid_regs;
-    uint8_t *edid_blob;
-    QEMUTimer *edid_link_timer;
-    struct {
-        VFIORegion buffer;
-        DisplaySurface *surface;
-    } region;
-    struct {
-        QTAILQ_HEAD(, VFIODMABuf) bufs;
-        VFIODMABuf *primary;
-        VFIODMABuf *cursor;
-    } dmabuf;
-} VFIODisplay;
-
 VFIOAddressSpace *vfio_get_address_space(AddressSpace *as);
 void vfio_put_address_space(VFIOAddressSpace *space);
 void vfio_address_space_insert(VFIOAddressSpace *space,

From 5a339dd8c1e34e13ae7f64477e20decdf381aae7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Wed, 26 Mar 2025 08:50:54 +0100
Subject: [PATCH 0259/2760] vfio: Move VFIOHostDMAWindow definition into
 spapr.c
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

VFIOHostDMAWindow is only used in file "spapr.c". Move it there.

Reviewed-by: John Levon <john.levon@nutanix.com>
Link: https://lore.kernel.org/qemu-devel/20250318095415.670319-9-clg@redhat.com
Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Link: https://lore.kernel.org/qemu-devel/20250326075122.1299361-10-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/spapr.c               | 7 +++++++
 include/hw/vfio/vfio-common.h | 7 -------
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/hw/vfio/spapr.c b/hw/vfio/spapr.c
index 7e5cb95f6a..f21955a344 100644
--- a/hw/vfio/spapr.c
+++ b/hw/vfio/spapr.c
@@ -22,6 +22,13 @@
 #include "qapi/error.h"
 #include "trace.h"
 
+typedef struct VFIOHostDMAWindow {
+    hwaddr min_iova;
+    hwaddr max_iova;
+    uint64_t iova_pgsizes;
+    QLIST_ENTRY(VFIOHostDMAWindow) hostwin_next;
+} VFIOHostDMAWindow;
+
 typedef struct VFIOSpaprContainer {
     VFIOContainer container;
     MemoryListener prereg_listener;
diff --git a/include/hw/vfio/vfio-common.h b/include/hw/vfio/vfio-common.h
index 528eafadf9..83b1f7be80 100644
--- a/include/hw/vfio/vfio-common.h
+++ b/include/hw/vfio/vfio-common.h
@@ -69,13 +69,6 @@ typedef struct VFIOContainer {
 
 OBJECT_DECLARE_SIMPLE_TYPE(VFIOContainer, VFIO_IOMMU_LEGACY);
 
-typedef struct VFIOHostDMAWindow {
-    hwaddr min_iova;
-    hwaddr max_iova;
-    uint64_t iova_pgsizes;
-    QLIST_ENTRY(VFIOHostDMAWindow) hostwin_next;
-} VFIOHostDMAWindow;
-
 typedef struct IOMMUFDBackend IOMMUFDBackend;
 
 typedef struct VFIOIOASHwpt {

From d4a8f286e991c468489b19e45b959a1920d6890c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Wed, 26 Mar 2025 08:50:55 +0100
Subject: [PATCH 0260/2760] vfio: Introduce a new header file for VFIOIOMMUFD
 declarations
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Gather all VFIOIOMMUFD related declarations introduced by commits
5ee3dc7af785 ("vfio/iommufd: Implement the iommufd backend") and
5b1e96e65403 ("vfio/iommufd: Introduce auto domain creation") into
"vfio-iommufd.h". This to reduce exposure of VFIO internals in
"hw/vfio/vfio-common.h".

Cc: Joao Martins <joao.m.martins@oracle.com>
Cc: Yi Liu <yi.l.liu@intel.com>
Reviewed-by: John Levon <john.levon@nutanix.com>
Link: https://lore.kernel.org/qemu-devel/20250318095415.670319-10-clg@redhat.com
Reviewed-by: Joao Martins <joao.m.martins@oracle.com>
Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Link: https://lore.kernel.org/qemu-devel/20250326075122.1299361-11-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/iommufd.c             |  1 +
 hw/vfio/vfio-iommufd.h        | 34 ++++++++++++++++++++++++++++++++++
 include/hw/vfio/vfio-common.h | 21 +++------------------
 3 files changed, 38 insertions(+), 18 deletions(-)
 create mode 100644 hw/vfio/vfio-iommufd.h

diff --git a/hw/vfio/iommufd.c b/hw/vfio/iommufd.c
index 42c8412bbf..7196c40801 100644
--- a/hw/vfio/iommufd.c
+++ b/hw/vfio/iommufd.c
@@ -25,6 +25,7 @@
 #include "qemu/cutils.h"
 #include "qemu/chardev_open.h"
 #include "pci.h"
+#include "vfio-iommufd.h"
 
 static int iommufd_cdev_map(const VFIOContainerBase *bcontainer, hwaddr iova,
                             ram_addr_t size, void *vaddr, bool readonly)
diff --git a/hw/vfio/vfio-iommufd.h b/hw/vfio/vfio-iommufd.h
new file mode 100644
index 0000000000..07ea0f4304
--- /dev/null
+++ b/hw/vfio/vfio-iommufd.h
@@ -0,0 +1,34 @@
+/*
+ * VFIO iommufd
+ *
+ * Copyright Red Hat, Inc. 2025
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef HW_VFIO_VFIO_IOMMUFD_H
+#define HW_VFIO_VFIO_IOMMUFD_H
+
+#include "hw/vfio/vfio-container-base.h"
+
+typedef struct VFIODevice VFIODevice;
+
+typedef struct VFIOIOASHwpt {
+    uint32_t hwpt_id;
+    uint32_t hwpt_flags;
+    QLIST_HEAD(, VFIODevice) device_list;
+    QLIST_ENTRY(VFIOIOASHwpt) next;
+} VFIOIOASHwpt;
+
+typedef struct IOMMUFDBackend IOMMUFDBackend;
+
+typedef struct VFIOIOMMUFDContainer {
+    VFIOContainerBase bcontainer;
+    IOMMUFDBackend *be;
+    uint32_t ioas_id;
+    QLIST_HEAD(, VFIOIOASHwpt) hwpt_list;
+} VFIOIOMMUFDContainer;
+
+OBJECT_DECLARE_SIMPLE_TYPE(VFIOIOMMUFDContainer, VFIO_IOMMU_IOMMUFD);
+
+#endif /* HW_VFIO_VFIO_IOMMUFD_H */
diff --git a/include/hw/vfio/vfio-common.h b/include/hw/vfio/vfio-common.h
index 83b1f7be80..9ec90fbac0 100644
--- a/include/hw/vfio/vfio-common.h
+++ b/include/hw/vfio/vfio-common.h
@@ -69,27 +69,12 @@ typedef struct VFIOContainer {
 
 OBJECT_DECLARE_SIMPLE_TYPE(VFIOContainer, VFIO_IOMMU_LEGACY);
 
-typedef struct IOMMUFDBackend IOMMUFDBackend;
-
-typedef struct VFIOIOASHwpt {
-    uint32_t hwpt_id;
-    uint32_t hwpt_flags;
-    QLIST_HEAD(, VFIODevice) device_list;
-    QLIST_ENTRY(VFIOIOASHwpt) next;
-} VFIOIOASHwpt;
-
-typedef struct VFIOIOMMUFDContainer {
-    VFIOContainerBase bcontainer;
-    IOMMUFDBackend *be;
-    uint32_t ioas_id;
-    QLIST_HEAD(, VFIOIOASHwpt) hwpt_list;
-} VFIOIOMMUFDContainer;
-
-OBJECT_DECLARE_SIMPLE_TYPE(VFIOIOMMUFDContainer, VFIO_IOMMU_IOMMUFD);
-
 typedef struct VFIODeviceOps VFIODeviceOps;
 typedef struct VFIOMigration VFIOMigration;
 
+typedef struct IOMMUFDBackend IOMMUFDBackend;
+typedef struct VFIOIOASHwpt VFIOIOASHwpt;
+
 typedef struct VFIODevice {
     QLIST_ENTRY(VFIODevice) next;
     QLIST_ENTRY(VFIODevice) container_next;

From 499e53cce9445d23ee1bf54562de558562fc8d22 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Wed, 26 Mar 2025 08:50:56 +0100
Subject: [PATCH 0261/2760] vfio: Introduce new files for VFIORegion
 definitions and declarations
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Gather all VFIORegion related declarations and definitions into their
own files to reduce exposure of VFIO internals in "hw/vfio/vfio-common.h".
They were introduced for 'vfio-platform' support in commits
db0da029a185 ("vfio: Generalize region support") and a664477db8da
("hw/vfio/pci: Introduce VFIORegion").

To be noted that the 'vfio-platform' devices have been deprecated and
will be removed in QEMU 10.2. Until then, make the declarations
available externally for 'sysbus-fdt.c'.

Cc: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Link: https://lore.kernel.org/qemu-devel/20250326075122.1299361-12-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/core/sysbus-fdt.c            |   1 +
 hw/vfio/helpers.c               | 363 -----------------------------
 hw/vfio/meson.build             |   1 +
 hw/vfio/pci.h                   |   1 +
 hw/vfio/platform.c              |   1 +
 hw/vfio/region.c                | 394 ++++++++++++++++++++++++++++++++
 hw/vfio/trace-events            |  16 +-
 hw/vfio/vfio-display.h          |   1 +
 include/hw/vfio/vfio-common.h   |  32 +--
 include/hw/vfio/vfio-platform.h |   2 +
 include/hw/vfio/vfio-region.h   |  47 ++++
 11 files changed, 458 insertions(+), 401 deletions(-)
 create mode 100644 hw/vfio/region.c
 create mode 100644 include/hw/vfio/vfio-region.h

diff --git a/hw/core/sysbus-fdt.c b/hw/core/sysbus-fdt.c
index e85066b905..c339a27875 100644
--- a/hw/core/sysbus-fdt.c
+++ b/hw/core/sysbus-fdt.c
@@ -35,6 +35,7 @@
 #include "hw/vfio/vfio-platform.h"
 #include "hw/vfio/vfio-calxeda-xgmac.h"
 #include "hw/vfio/vfio-amd-xgbe.h"
+#include "hw/vfio/vfio-region.h"
 #include "hw/display/ramfb.h"
 #include "hw/uefi/var-service-api.h"
 #include "hw/arm/fdt.h"
diff --git a/hw/vfio/helpers.c b/hw/vfio/helpers.c
index 4b255d4f3a..89403943a7 100644
--- a/hw/vfio/helpers.c
+++ b/hw/vfio/helpers.c
@@ -147,118 +147,6 @@ bool vfio_set_irq_signaling(VFIODevice *vbasedev, int index, int subindex,
     return false;
 }
 
-/*
- * IO Port/MMIO - Beware of the endians, VFIO is always little endian
- */
-void vfio_region_write(void *opaque, hwaddr addr,
-                       uint64_t data, unsigned size)
-{
-    VFIORegion *region = opaque;
-    VFIODevice *vbasedev = region->vbasedev;
-    union {
-        uint8_t byte;
-        uint16_t word;
-        uint32_t dword;
-        uint64_t qword;
-    } buf;
-
-    switch (size) {
-    case 1:
-        buf.byte = data;
-        break;
-    case 2:
-        buf.word = cpu_to_le16(data);
-        break;
-    case 4:
-        buf.dword = cpu_to_le32(data);
-        break;
-    case 8:
-        buf.qword = cpu_to_le64(data);
-        break;
-    default:
-        hw_error("vfio: unsupported write size, %u bytes", size);
-        break;
-    }
-
-    if (pwrite(vbasedev->fd, &buf, size, region->fd_offset + addr) != size) {
-        error_report("%s(%s:region%d+0x%"HWADDR_PRIx", 0x%"PRIx64
-                     ",%d) failed: %m",
-                     __func__, vbasedev->name, region->nr,
-                     addr, data, size);
-    }
-
-    trace_vfio_region_write(vbasedev->name, region->nr, addr, data, size);
-
-    /*
-     * A read or write to a BAR always signals an INTx EOI.  This will
-     * do nothing if not pending (including not in INTx mode).  We assume
-     * that a BAR access is in response to an interrupt and that BAR
-     * accesses will service the interrupt.  Unfortunately, we don't know
-     * which access will service the interrupt, so we're potentially
-     * getting quite a few host interrupts per guest interrupt.
-     */
-    vbasedev->ops->vfio_eoi(vbasedev);
-}
-
-uint64_t vfio_region_read(void *opaque,
-                          hwaddr addr, unsigned size)
-{
-    VFIORegion *region = opaque;
-    VFIODevice *vbasedev = region->vbasedev;
-    union {
-        uint8_t byte;
-        uint16_t word;
-        uint32_t dword;
-        uint64_t qword;
-    } buf;
-    uint64_t data = 0;
-
-    if (pread(vbasedev->fd, &buf, size, region->fd_offset + addr) != size) {
-        error_report("%s(%s:region%d+0x%"HWADDR_PRIx", %d) failed: %m",
-                     __func__, vbasedev->name, region->nr,
-                     addr, size);
-        return (uint64_t)-1;
-    }
-    switch (size) {
-    case 1:
-        data = buf.byte;
-        break;
-    case 2:
-        data = le16_to_cpu(buf.word);
-        break;
-    case 4:
-        data = le32_to_cpu(buf.dword);
-        break;
-    case 8:
-        data = le64_to_cpu(buf.qword);
-        break;
-    default:
-        hw_error("vfio: unsupported read size, %u bytes", size);
-        break;
-    }
-
-    trace_vfio_region_read(vbasedev->name, region->nr, addr, size, data);
-
-    /* Same as write above */
-    vbasedev->ops->vfio_eoi(vbasedev);
-
-    return data;
-}
-
-const MemoryRegionOps vfio_region_ops = {
-    .read = vfio_region_read,
-    .write = vfio_region_write,
-    .endianness = DEVICE_LITTLE_ENDIAN,
-    .valid = {
-        .min_access_size = 1,
-        .max_access_size = 8,
-    },
-    .impl = {
-        .min_access_size = 1,
-        .max_access_size = 8,
-    },
-};
-
 int vfio_bitmap_alloc(VFIOBitmap *vbmap, hwaddr size)
 {
     vbmap->pages = REAL_HOST_PAGE_ALIGN(size) / qemu_real_host_page_size();
@@ -306,257 +194,6 @@ vfio_get_device_info_cap(struct vfio_device_info *info, uint16_t id)
     return vfio_get_cap((void *)info, info->cap_offset, id);
 }
 
-static int vfio_setup_region_sparse_mmaps(VFIORegion *region,
-                                          struct vfio_region_info *info)
-{
-    struct vfio_info_cap_header *hdr;
-    struct vfio_region_info_cap_sparse_mmap *sparse;
-    int i, j;
-
-    hdr = vfio_get_region_info_cap(info, VFIO_REGION_INFO_CAP_SPARSE_MMAP);
-    if (!hdr) {
-        return -ENODEV;
-    }
-
-    sparse = container_of(hdr, struct vfio_region_info_cap_sparse_mmap, header);
-
-    trace_vfio_region_sparse_mmap_header(region->vbasedev->name,
-                                         region->nr, sparse->nr_areas);
-
-    region->mmaps = g_new0(VFIOMmap, sparse->nr_areas);
-
-    for (i = 0, j = 0; i < sparse->nr_areas; i++) {
-        if (sparse->areas[i].size) {
-            trace_vfio_region_sparse_mmap_entry(i, sparse->areas[i].offset,
-                                            sparse->areas[i].offset +
-                                            sparse->areas[i].size - 1);
-            region->mmaps[j].offset = sparse->areas[i].offset;
-            region->mmaps[j].size = sparse->areas[i].size;
-            j++;
-        }
-    }
-
-    region->nr_mmaps = j;
-    region->mmaps = g_realloc(region->mmaps, j * sizeof(VFIOMmap));
-
-    return 0;
-}
-
-int vfio_region_setup(Object *obj, VFIODevice *vbasedev, VFIORegion *region,
-                      int index, const char *name)
-{
-    g_autofree struct vfio_region_info *info = NULL;
-    int ret;
-
-    ret = vfio_get_region_info(vbasedev, index, &info);
-    if (ret) {
-        return ret;
-    }
-
-    region->vbasedev = vbasedev;
-    region->flags = info->flags;
-    region->size = info->size;
-    region->fd_offset = info->offset;
-    region->nr = index;
-
-    if (region->size) {
-        region->mem = g_new0(MemoryRegion, 1);
-        memory_region_init_io(region->mem, obj, &vfio_region_ops,
-                              region, name, region->size);
-
-        if (!vbasedev->no_mmap &&
-            region->flags & VFIO_REGION_INFO_FLAG_MMAP) {
-
-            ret = vfio_setup_region_sparse_mmaps(region, info);
-
-            if (ret) {
-                region->nr_mmaps = 1;
-                region->mmaps = g_new0(VFIOMmap, region->nr_mmaps);
-                region->mmaps[0].offset = 0;
-                region->mmaps[0].size = region->size;
-            }
-        }
-    }
-
-    trace_vfio_region_setup(vbasedev->name, index, name,
-                            region->flags, region->fd_offset, region->size);
-    return 0;
-}
-
-static void vfio_subregion_unmap(VFIORegion *region, int index)
-{
-    trace_vfio_region_unmap(memory_region_name(&region->mmaps[index].mem),
-                            region->mmaps[index].offset,
-                            region->mmaps[index].offset +
-                            region->mmaps[index].size - 1);
-    memory_region_del_subregion(region->mem, &region->mmaps[index].mem);
-    munmap(region->mmaps[index].mmap, region->mmaps[index].size);
-    object_unparent(OBJECT(&region->mmaps[index].mem));
-    region->mmaps[index].mmap = NULL;
-}
-
-int vfio_region_mmap(VFIORegion *region)
-{
-    int i, ret, prot = 0;
-    char *name;
-
-    if (!region->mem) {
-        return 0;
-    }
-
-    prot |= region->flags & VFIO_REGION_INFO_FLAG_READ ? PROT_READ : 0;
-    prot |= region->flags & VFIO_REGION_INFO_FLAG_WRITE ? PROT_WRITE : 0;
-
-    for (i = 0; i < region->nr_mmaps; i++) {
-        size_t align = MIN(1ULL << ctz64(region->mmaps[i].size), 1 * GiB);
-        void *map_base, *map_align;
-
-        /*
-         * Align the mmap for more efficient mapping in the kernel.  Ideally
-         * we'd know the PMD and PUD mapping sizes to use as discrete alignment
-         * intervals, but we don't.  As of Linux v6.12, the largest PUD size
-         * supporting huge pfnmap is 1GiB (ARCH_SUPPORTS_PUD_PFNMAP is only set
-         * on x86_64).  Align by power-of-two size, capped at 1GiB.
-         *
-         * NB. qemu_memalign() and friends actually allocate memory, whereas
-         * the region size here can exceed host memory, therefore we manually
-         * create an oversized anonymous mapping and clean it up for alignment.
-         */
-        map_base = mmap(0, region->mmaps[i].size + align, PROT_NONE,
-                        MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
-        if (map_base == MAP_FAILED) {
-            ret = -errno;
-            goto no_mmap;
-        }
-
-        map_align = (void *)ROUND_UP((uintptr_t)map_base, (uintptr_t)align);
-        munmap(map_base, map_align - map_base);
-        munmap(map_align + region->mmaps[i].size,
-               align - (map_align - map_base));
-
-        region->mmaps[i].mmap = mmap(map_align, region->mmaps[i].size, prot,
-                                     MAP_SHARED | MAP_FIXED,
-                                     region->vbasedev->fd,
-                                     region->fd_offset +
-                                     region->mmaps[i].offset);
-        if (region->mmaps[i].mmap == MAP_FAILED) {
-            ret = -errno;
-            goto no_mmap;
-        }
-
-        name = g_strdup_printf("%s mmaps[%d]",
-                               memory_region_name(region->mem), i);
-        memory_region_init_ram_device_ptr(&region->mmaps[i].mem,
-                                          memory_region_owner(region->mem),
-                                          name, region->mmaps[i].size,
-                                          region->mmaps[i].mmap);
-        g_free(name);
-        memory_region_add_subregion(region->mem, region->mmaps[i].offset,
-                                    &region->mmaps[i].mem);
-
-        trace_vfio_region_mmap(memory_region_name(&region->mmaps[i].mem),
-                               region->mmaps[i].offset,
-                               region->mmaps[i].offset +
-                               region->mmaps[i].size - 1);
-    }
-
-    return 0;
-
-no_mmap:
-    trace_vfio_region_mmap_fault(memory_region_name(region->mem), i,
-                                 region->fd_offset + region->mmaps[i].offset,
-                                 region->fd_offset + region->mmaps[i].offset +
-                                 region->mmaps[i].size - 1, ret);
-
-    region->mmaps[i].mmap = NULL;
-
-    for (i--; i >= 0; i--) {
-        vfio_subregion_unmap(region, i);
-    }
-
-    return ret;
-}
-
-void vfio_region_unmap(VFIORegion *region)
-{
-    int i;
-
-    if (!region->mem) {
-        return;
-    }
-
-    for (i = 0; i < region->nr_mmaps; i++) {
-        if (region->mmaps[i].mmap) {
-            vfio_subregion_unmap(region, i);
-        }
-    }
-}
-
-void vfio_region_exit(VFIORegion *region)
-{
-    int i;
-
-    if (!region->mem) {
-        return;
-    }
-
-    for (i = 0; i < region->nr_mmaps; i++) {
-        if (region->mmaps[i].mmap) {
-            memory_region_del_subregion(region->mem, &region->mmaps[i].mem);
-        }
-    }
-
-    trace_vfio_region_exit(region->vbasedev->name, region->nr);
-}
-
-void vfio_region_finalize(VFIORegion *region)
-{
-    int i;
-
-    if (!region->mem) {
-        return;
-    }
-
-    for (i = 0; i < region->nr_mmaps; i++) {
-        if (region->mmaps[i].mmap) {
-            munmap(region->mmaps[i].mmap, region->mmaps[i].size);
-            object_unparent(OBJECT(&region->mmaps[i].mem));
-        }
-    }
-
-    object_unparent(OBJECT(region->mem));
-
-    g_free(region->mem);
-    g_free(region->mmaps);
-
-    trace_vfio_region_finalize(region->vbasedev->name, region->nr);
-
-    region->mem = NULL;
-    region->mmaps = NULL;
-    region->nr_mmaps = 0;
-    region->size = 0;
-    region->flags = 0;
-    region->nr = 0;
-}
-
-void vfio_region_mmaps_set_enabled(VFIORegion *region, bool enabled)
-{
-    int i;
-
-    if (!region->mem) {
-        return;
-    }
-
-    for (i = 0; i < region->nr_mmaps; i++) {
-        if (region->mmaps[i].mmap) {
-            memory_region_set_enabled(&region->mmaps[i].mem, enabled);
-        }
-    }
-
-    trace_vfio_region_mmaps_set_enabled(memory_region_name(region->mem),
-                                        enabled);
-}
-
 int vfio_get_region_info(VFIODevice *vbasedev, int index,
                          struct vfio_region_info **info)
 {
diff --git a/hw/vfio/meson.build b/hw/vfio/meson.build
index a8939c8386..07010c7c9e 100644
--- a/hw/vfio/meson.build
+++ b/hw/vfio/meson.build
@@ -23,6 +23,7 @@ system_ss.add(when: 'CONFIG_VFIO', if_true: files(
   'migration.c',
   'migration-multifd.c',
   'cpr.c',
+  'region.c',
 ))
 system_ss.add(when: ['CONFIG_VFIO', 'CONFIG_IOMMUFD'], if_true: files(
   'iommufd.c',
diff --git a/hw/vfio/pci.h b/hw/vfio/pci.h
index 62fd5f4997..801ea445b8 100644
--- a/hw/vfio/pci.h
+++ b/hw/vfio/pci.h
@@ -15,6 +15,7 @@
 #include "system/memory.h"
 #include "hw/pci/pci_device.h"
 #include "hw/vfio/vfio-common.h"
+#include "hw/vfio/vfio-region.h"
 #include "qemu/event_notifier.h"
 #include "qemu/queue.h"
 #include "qemu/timer.h"
diff --git a/hw/vfio/platform.c b/hw/vfio/platform.c
index f273ae9a51..ca6528cc56 100644
--- a/hw/vfio/platform.c
+++ b/hw/vfio/platform.c
@@ -37,6 +37,7 @@
 #include "hw/platform-bus.h"
 #include "hw/qdev-properties.h"
 #include "system/kvm.h"
+#include "hw/vfio/vfio-region.h"
 
 /*
  * Functions used whatever the injection method
diff --git a/hw/vfio/region.c b/hw/vfio/region.c
new file mode 100644
index 0000000000..08cd69e704
--- /dev/null
+++ b/hw/vfio/region.c
@@ -0,0 +1,394 @@
+/*
+ * VFIO regions
+ *
+ * Copyright Red Hat, Inc. 2012
+ *
+ * Authors:
+ *  Alex Williamson <alex.williamson@redhat.com>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2.  See
+ * the COPYING file in the top-level directory.
+ *
+ * Based on qemu-kvm device-assignment:
+ *  Adapted for KVM by Qumranet.
+ *  Copyright (c) 2007, Neocleus, Alex Novik (alex@neocleus.com)
+ *  Copyright (c) 2007, Neocleus, Guy Zana (guy@neocleus.com)
+ *  Copyright (C) 2008, Qumranet, Amit Shah (amit.shah@qumranet.com)
+ *  Copyright (C) 2008, Red Hat, Amit Shah (amit.shah@redhat.com)
+ *  Copyright (C) 2008, IBM, Muli Ben-Yehuda (muli@il.ibm.com)
+ */
+
+#include "qemu/osdep.h"
+#include <sys/ioctl.h>
+
+#include "hw/vfio/vfio-common.h"
+#include "hw/vfio/pci.h"
+#include "hw/hw.h"
+#include "trace.h"
+#include "qapi/error.h"
+#include "qemu/error-report.h"
+#include "qemu/units.h"
+#include "monitor/monitor.h"
+
+/*
+ * IO Port/MMIO - Beware of the endians, VFIO is always little endian
+ */
+void vfio_region_write(void *opaque, hwaddr addr,
+                       uint64_t data, unsigned size)
+{
+    VFIORegion *region = opaque;
+    VFIODevice *vbasedev = region->vbasedev;
+    union {
+        uint8_t byte;
+        uint16_t word;
+        uint32_t dword;
+        uint64_t qword;
+    } buf;
+
+    switch (size) {
+    case 1:
+        buf.byte = data;
+        break;
+    case 2:
+        buf.word = cpu_to_le16(data);
+        break;
+    case 4:
+        buf.dword = cpu_to_le32(data);
+        break;
+    case 8:
+        buf.qword = cpu_to_le64(data);
+        break;
+    default:
+        hw_error("vfio: unsupported write size, %u bytes", size);
+        break;
+    }
+
+    if (pwrite(vbasedev->fd, &buf, size, region->fd_offset + addr) != size) {
+        error_report("%s(%s:region%d+0x%"HWADDR_PRIx", 0x%"PRIx64
+                     ",%d) failed: %m",
+                     __func__, vbasedev->name, region->nr,
+                     addr, data, size);
+    }
+
+    trace_vfio_region_write(vbasedev->name, region->nr, addr, data, size);
+
+    /*
+     * A read or write to a BAR always signals an INTx EOI.  This will
+     * do nothing if not pending (including not in INTx mode).  We assume
+     * that a BAR access is in response to an interrupt and that BAR
+     * accesses will service the interrupt.  Unfortunately, we don't know
+     * which access will service the interrupt, so we're potentially
+     * getting quite a few host interrupts per guest interrupt.
+     */
+    vbasedev->ops->vfio_eoi(vbasedev);
+}
+
+uint64_t vfio_region_read(void *opaque,
+                          hwaddr addr, unsigned size)
+{
+    VFIORegion *region = opaque;
+    VFIODevice *vbasedev = region->vbasedev;
+    union {
+        uint8_t byte;
+        uint16_t word;
+        uint32_t dword;
+        uint64_t qword;
+    } buf;
+    uint64_t data = 0;
+
+    if (pread(vbasedev->fd, &buf, size, region->fd_offset + addr) != size) {
+        error_report("%s(%s:region%d+0x%"HWADDR_PRIx", %d) failed: %m",
+                     __func__, vbasedev->name, region->nr,
+                     addr, size);
+        return (uint64_t)-1;
+    }
+    switch (size) {
+    case 1:
+        data = buf.byte;
+        break;
+    case 2:
+        data = le16_to_cpu(buf.word);
+        break;
+    case 4:
+        data = le32_to_cpu(buf.dword);
+        break;
+    case 8:
+        data = le64_to_cpu(buf.qword);
+        break;
+    default:
+        hw_error("vfio: unsupported read size, %u bytes", size);
+        break;
+    }
+
+    trace_vfio_region_read(vbasedev->name, region->nr, addr, size, data);
+
+    /* Same as write above */
+    vbasedev->ops->vfio_eoi(vbasedev);
+
+    return data;
+}
+
+static const MemoryRegionOps vfio_region_ops = {
+    .read = vfio_region_read,
+    .write = vfio_region_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+    .valid = {
+        .min_access_size = 1,
+        .max_access_size = 8,
+    },
+    .impl = {
+        .min_access_size = 1,
+        .max_access_size = 8,
+    },
+};
+
+static int vfio_setup_region_sparse_mmaps(VFIORegion *region,
+                                          struct vfio_region_info *info)
+{
+    struct vfio_info_cap_header *hdr;
+    struct vfio_region_info_cap_sparse_mmap *sparse;
+    int i, j;
+
+    hdr = vfio_get_region_info_cap(info, VFIO_REGION_INFO_CAP_SPARSE_MMAP);
+    if (!hdr) {
+        return -ENODEV;
+    }
+
+    sparse = container_of(hdr, struct vfio_region_info_cap_sparse_mmap, header);
+
+    trace_vfio_region_sparse_mmap_header(region->vbasedev->name,
+                                         region->nr, sparse->nr_areas);
+
+    region->mmaps = g_new0(VFIOMmap, sparse->nr_areas);
+
+    for (i = 0, j = 0; i < sparse->nr_areas; i++) {
+        if (sparse->areas[i].size) {
+            trace_vfio_region_sparse_mmap_entry(i, sparse->areas[i].offset,
+                                            sparse->areas[i].offset +
+                                            sparse->areas[i].size - 1);
+            region->mmaps[j].offset = sparse->areas[i].offset;
+            region->mmaps[j].size = sparse->areas[i].size;
+            j++;
+        }
+    }
+
+    region->nr_mmaps = j;
+    region->mmaps = g_realloc(region->mmaps, j * sizeof(VFIOMmap));
+
+    return 0;
+}
+
+int vfio_region_setup(Object *obj, VFIODevice *vbasedev, VFIORegion *region,
+                      int index, const char *name)
+{
+    g_autofree struct vfio_region_info *info = NULL;
+    int ret;
+
+    ret = vfio_get_region_info(vbasedev, index, &info);
+    if (ret) {
+        return ret;
+    }
+
+    region->vbasedev = vbasedev;
+    region->flags = info->flags;
+    region->size = info->size;
+    region->fd_offset = info->offset;
+    region->nr = index;
+
+    if (region->size) {
+        region->mem = g_new0(MemoryRegion, 1);
+        memory_region_init_io(region->mem, obj, &vfio_region_ops,
+                              region, name, region->size);
+
+        if (!vbasedev->no_mmap &&
+            region->flags & VFIO_REGION_INFO_FLAG_MMAP) {
+
+            ret = vfio_setup_region_sparse_mmaps(region, info);
+
+            if (ret) {
+                region->nr_mmaps = 1;
+                region->mmaps = g_new0(VFIOMmap, region->nr_mmaps);
+                region->mmaps[0].offset = 0;
+                region->mmaps[0].size = region->size;
+            }
+        }
+    }
+
+    trace_vfio_region_setup(vbasedev->name, index, name,
+                            region->flags, region->fd_offset, region->size);
+    return 0;
+}
+
+static void vfio_subregion_unmap(VFIORegion *region, int index)
+{
+    trace_vfio_region_unmap(memory_region_name(&region->mmaps[index].mem),
+                            region->mmaps[index].offset,
+                            region->mmaps[index].offset +
+                            region->mmaps[index].size - 1);
+    memory_region_del_subregion(region->mem, &region->mmaps[index].mem);
+    munmap(region->mmaps[index].mmap, region->mmaps[index].size);
+    object_unparent(OBJECT(&region->mmaps[index].mem));
+    region->mmaps[index].mmap = NULL;
+}
+
+int vfio_region_mmap(VFIORegion *region)
+{
+    int i, ret, prot = 0;
+    char *name;
+
+    if (!region->mem) {
+        return 0;
+    }
+
+    prot |= region->flags & VFIO_REGION_INFO_FLAG_READ ? PROT_READ : 0;
+    prot |= region->flags & VFIO_REGION_INFO_FLAG_WRITE ? PROT_WRITE : 0;
+
+    for (i = 0; i < region->nr_mmaps; i++) {
+        size_t align = MIN(1ULL << ctz64(region->mmaps[i].size), 1 * GiB);
+        void *map_base, *map_align;
+
+        /*
+         * Align the mmap for more efficient mapping in the kernel.  Ideally
+         * we'd know the PMD and PUD mapping sizes to use as discrete alignment
+         * intervals, but we don't.  As of Linux v6.12, the largest PUD size
+         * supporting huge pfnmap is 1GiB (ARCH_SUPPORTS_PUD_PFNMAP is only set
+         * on x86_64).  Align by power-of-two size, capped at 1GiB.
+         *
+         * NB. qemu_memalign() and friends actually allocate memory, whereas
+         * the region size here can exceed host memory, therefore we manually
+         * create an oversized anonymous mapping and clean it up for alignment.
+         */
+        map_base = mmap(0, region->mmaps[i].size + align, PROT_NONE,
+                        MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+        if (map_base == MAP_FAILED) {
+            ret = -errno;
+            goto no_mmap;
+        }
+
+        map_align = (void *)ROUND_UP((uintptr_t)map_base, (uintptr_t)align);
+        munmap(map_base, map_align - map_base);
+        munmap(map_align + region->mmaps[i].size,
+               align - (map_align - map_base));
+
+        region->mmaps[i].mmap = mmap(map_align, region->mmaps[i].size, prot,
+                                     MAP_SHARED | MAP_FIXED,
+                                     region->vbasedev->fd,
+                                     region->fd_offset +
+                                     region->mmaps[i].offset);
+        if (region->mmaps[i].mmap == MAP_FAILED) {
+            ret = -errno;
+            goto no_mmap;
+        }
+
+        name = g_strdup_printf("%s mmaps[%d]",
+                               memory_region_name(region->mem), i);
+        memory_region_init_ram_device_ptr(&region->mmaps[i].mem,
+                                          memory_region_owner(region->mem),
+                                          name, region->mmaps[i].size,
+                                          region->mmaps[i].mmap);
+        g_free(name);
+        memory_region_add_subregion(region->mem, region->mmaps[i].offset,
+                                    &region->mmaps[i].mem);
+
+        trace_vfio_region_mmap(memory_region_name(&region->mmaps[i].mem),
+                               region->mmaps[i].offset,
+                               region->mmaps[i].offset +
+                               region->mmaps[i].size - 1);
+    }
+
+    return 0;
+
+no_mmap:
+    trace_vfio_region_mmap_fault(memory_region_name(region->mem), i,
+                                 region->fd_offset + region->mmaps[i].offset,
+                                 region->fd_offset + region->mmaps[i].offset +
+                                 region->mmaps[i].size - 1, ret);
+
+    region->mmaps[i].mmap = NULL;
+
+    for (i--; i >= 0; i--) {
+        vfio_subregion_unmap(region, i);
+    }
+
+    return ret;
+}
+
+void vfio_region_unmap(VFIORegion *region)
+{
+    int i;
+
+    if (!region->mem) {
+        return;
+    }
+
+    for (i = 0; i < region->nr_mmaps; i++) {
+        if (region->mmaps[i].mmap) {
+            vfio_subregion_unmap(region, i);
+        }
+    }
+}
+
+void vfio_region_exit(VFIORegion *region)
+{
+    int i;
+
+    if (!region->mem) {
+        return;
+    }
+
+    for (i = 0; i < region->nr_mmaps; i++) {
+        if (region->mmaps[i].mmap) {
+            memory_region_del_subregion(region->mem, &region->mmaps[i].mem);
+        }
+    }
+
+    trace_vfio_region_exit(region->vbasedev->name, region->nr);
+}
+
+void vfio_region_finalize(VFIORegion *region)
+{
+    int i;
+
+    if (!region->mem) {
+        return;
+    }
+
+    for (i = 0; i < region->nr_mmaps; i++) {
+        if (region->mmaps[i].mmap) {
+            munmap(region->mmaps[i].mmap, region->mmaps[i].size);
+            object_unparent(OBJECT(&region->mmaps[i].mem));
+        }
+    }
+
+    object_unparent(OBJECT(region->mem));
+
+    g_free(region->mem);
+    g_free(region->mmaps);
+
+    trace_vfio_region_finalize(region->vbasedev->name, region->nr);
+
+    region->mem = NULL;
+    region->mmaps = NULL;
+    region->nr_mmaps = 0;
+    region->size = 0;
+    region->flags = 0;
+    region->nr = 0;
+}
+
+void vfio_region_mmaps_set_enabled(VFIORegion *region, bool enabled)
+{
+    int i;
+
+    if (!region->mem) {
+        return;
+    }
+
+    for (i = 0; i < region->nr_mmaps; i++) {
+        if (region->mmaps[i].mmap) {
+            memory_region_set_enabled(&region->mmaps[i].mem, enabled);
+        }
+    }
+
+    trace_vfio_region_mmaps_set_enabled(memory_region_name(region->mem),
+                                        enabled);
+}
diff --git a/hw/vfio/trace-events b/hw/vfio/trace-events
index 9347e3a5f6..81f4130100 100644
--- a/hw/vfio/trace-events
+++ b/hw/vfio/trace-events
@@ -90,8 +90,6 @@ vfio_pci_igd_host_bridge_enabled(const char *name) "%s"
 vfio_pci_igd_lpc_bridge_enabled(const char *name) "%s"
 
 # common.c
-vfio_region_write(const char *name, int index, uint64_t addr, uint64_t data, unsigned size) " (%s:region%d+0x%"PRIx64", 0x%"PRIx64 ", %d)"
-vfio_region_read(char *name, int index, uint64_t addr, unsigned size, uint64_t data) " (%s:region%d+0x%"PRIx64", %d) = 0x%"PRIx64
 vfio_iommu_map_notify(const char *op, uint64_t iova_start, uint64_t iova_end) "iommu %s @ 0x%"PRIx64" - 0x%"PRIx64
 vfio_listener_region_skip(const char *name, uint64_t start, uint64_t end) "SKIPPING %s 0x%"PRIx64" - 0x%"PRIx64
 vfio_spapr_group_attach(int groupfd, int tablefd) "Attached groupfd %d to liobn fd %d"
@@ -107,6 +105,15 @@ vfio_disconnect_container(int fd) "close container->fd=%d"
 vfio_put_group(int fd) "close group->fd=%d"
 vfio_get_device(const char * name, unsigned int flags, unsigned int num_regions, unsigned int num_irqs) "Device %s flags: %u, regions: %u, irqs: %u"
 vfio_put_base_device(int fd) "close vdev->fd=%d"
+vfio_get_dev_region(const char *name, int index, uint32_t type, uint32_t subtype) "%s index %d, %08x/%08x"
+vfio_legacy_dma_unmap_overflow_workaround(void) ""
+vfio_get_dirty_bitmap(uint64_t iova, uint64_t size, uint64_t bitmap_size, uint64_t start, uint64_t dirty_pages) "iova=0x%"PRIx64" size= 0x%"PRIx64" bitmap_size=0x%"PRIx64" start=0x%"PRIx64" dirty_pages=%"PRIu64
+vfio_iommu_map_dirty_notify(uint64_t iova_start, uint64_t iova_end) "iommu dirty @ 0x%"PRIx64" - 0x%"PRIx64
+vfio_reset_handler(void) ""
+
+# region.c
+vfio_region_write(const char *name, int index, uint64_t addr, uint64_t data, unsigned size) " (%s:region%d+0x%"PRIx64", 0x%"PRIx64 ", %d)"
+vfio_region_read(char *name, int index, uint64_t addr, unsigned size, uint64_t data) " (%s:region%d+0x%"PRIx64", %d) = 0x%"PRIx64
 vfio_region_setup(const char *dev, int index, const char *name, unsigned long flags, unsigned long offset, unsigned long size) "Device %s, region %d \"%s\", flags: 0x%lx, offset: 0x%lx, size: 0x%lx"
 vfio_region_mmap_fault(const char *name, int index, unsigned long offset, unsigned long size, int fault) "Region %s mmaps[%d], [0x%lx - 0x%lx], fault: %d"
 vfio_region_mmap(const char *name, unsigned long offset, unsigned long end) "Region %s [0x%lx - 0x%lx]"
@@ -116,11 +123,6 @@ vfio_region_mmaps_set_enabled(const char *name, bool enabled) "Region %s mmaps e
 vfio_region_unmap(const char *name, unsigned long offset, unsigned long end) "Region %s unmap [0x%lx - 0x%lx]"
 vfio_region_sparse_mmap_header(const char *name, int index, int nr_areas) "Device %s region %d: %d sparse mmap entries"
 vfio_region_sparse_mmap_entry(int i, unsigned long start, unsigned long end) "sparse entry %d [0x%lx - 0x%lx]"
-vfio_get_dev_region(const char *name, int index, uint32_t type, uint32_t subtype) "%s index %d, %08x/%08x"
-vfio_legacy_dma_unmap_overflow_workaround(void) ""
-vfio_get_dirty_bitmap(uint64_t iova, uint64_t size, uint64_t bitmap_size, uint64_t start, uint64_t dirty_pages) "iova=0x%"PRIx64" size= 0x%"PRIx64" bitmap_size=0x%"PRIx64" start=0x%"PRIx64" dirty_pages=%"PRIu64
-vfio_iommu_map_dirty_notify(uint64_t iova_start, uint64_t iova_end) "iommu dirty @ 0x%"PRIx64" - 0x%"PRIx64
-vfio_reset_handler(void) ""
 
 # platform.c
 vfio_platform_realize(char *name, char *compat) "vfio device %s, compat = %s"
diff --git a/hw/vfio/vfio-display.h b/hw/vfio/vfio-display.h
index 99b8cb67ef..2606c34b39 100644
--- a/hw/vfio/vfio-display.h
+++ b/hw/vfio/vfio-display.h
@@ -11,6 +11,7 @@
 
 #include "ui/console.h"
 #include "hw/display/ramfb.h"
+#include "hw/vfio/vfio-region.h"
 
 typedef struct VFIODMABuf {
     QemuDmaBuf *buf;
diff --git a/include/hw/vfio/vfio-common.h b/include/hw/vfio/vfio-common.h
index 9ec90fbac0..b372033741 100644
--- a/include/hw/vfio/vfio-common.h
+++ b/include/hw/vfio/vfio-common.h
@@ -39,25 +39,6 @@ enum {
     VFIO_DEVICE_TYPE_CCW = 2,
     VFIO_DEVICE_TYPE_AP = 3,
 };
-
-typedef struct VFIOMmap {
-    MemoryRegion mem;
-    void *mmap;
-    off_t offset;
-    size_t size;
-} VFIOMmap;
-
-typedef struct VFIORegion {
-    struct VFIODevice *vbasedev;
-    off_t fd_offset; /* offset of region within device fd */
-    MemoryRegion *mem; /* slow, read/write access */
-    size_t size;
-    uint32_t flags; /* VFIO region flags (rd/wr/mmap) */
-    uint32_t nr_mmaps;
-    VFIOMmap *mmaps;
-    uint8_t nr; /* cache the region number for debug */
-} VFIORegion;
-
 struct VFIOGroup;
 
 typedef struct VFIOContainer {
@@ -168,17 +149,7 @@ void vfio_unmask_single_irqindex(VFIODevice *vbasedev, int index);
 void vfio_mask_single_irqindex(VFIODevice *vbasedev, int index);
 bool vfio_set_irq_signaling(VFIODevice *vbasedev, int index, int subindex,
                             int action, int fd, Error **errp);
-void vfio_region_write(void *opaque, hwaddr addr,
-                           uint64_t data, unsigned size);
-uint64_t vfio_region_read(void *opaque,
-                          hwaddr addr, unsigned size);
-int vfio_region_setup(Object *obj, VFIODevice *vbasedev, VFIORegion *region,
-                      int index, const char *name);
-int vfio_region_mmap(VFIORegion *region);
-void vfio_region_mmaps_set_enabled(VFIORegion *region, bool enabled);
-void vfio_region_unmap(VFIORegion *region);
-void vfio_region_exit(VFIORegion *region);
-void vfio_region_finalize(VFIORegion *region);
+
 void vfio_reset_handler(void *opaque);
 struct vfio_device_info *vfio_get_device_info(int fd);
 bool vfio_device_is_mdev(VFIODevice *vbasedev);
@@ -194,7 +165,6 @@ int vfio_kvm_device_del_fd(int fd, Error **errp);
 bool vfio_cpr_register_container(VFIOContainerBase *bcontainer, Error **errp);
 void vfio_cpr_unregister_container(VFIOContainerBase *bcontainer);
 
-extern const MemoryRegionOps vfio_region_ops;
 typedef QLIST_HEAD(VFIOGroupList, VFIOGroup) VFIOGroupList;
 typedef QLIST_HEAD(VFIODeviceList, VFIODevice) VFIODeviceList;
 extern VFIOGroupList vfio_group_list;
diff --git a/include/hw/vfio/vfio-platform.h b/include/hw/vfio/vfio-platform.h
index c414c3dffc..3191545717 100644
--- a/include/hw/vfio/vfio-platform.h
+++ b/include/hw/vfio/vfio-platform.h
@@ -47,6 +47,8 @@ typedef struct VFIOINTp {
 /* function type for user side eventfd handler */
 typedef void (*eventfd_user_side_handler_t)(VFIOINTp *intp);
 
+typedef struct VFIORegion VFIORegion;
+
 struct VFIOPlatformDevice {
     SysBusDevice sbdev;
     VFIODevice vbasedev; /* not a QOM object */
diff --git a/include/hw/vfio/vfio-region.h b/include/hw/vfio/vfio-region.h
new file mode 100644
index 0000000000..cbffb26962
--- /dev/null
+++ b/include/hw/vfio/vfio-region.h
@@ -0,0 +1,47 @@
+/*
+ * VFIO region
+ *
+ * Copyright Red Hat, Inc. 2025
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef HW_VFIO_REGION_H
+#define HW_VFIO_REGION_H
+
+#include "system/memory.h"
+
+typedef struct VFIOMmap {
+    MemoryRegion mem;
+    void *mmap;
+    off_t offset;
+    size_t size;
+} VFIOMmap;
+
+typedef struct VFIODevice VFIODevice;
+
+typedef struct VFIORegion {
+    struct VFIODevice *vbasedev;
+    off_t fd_offset; /* offset of region within device fd */
+    MemoryRegion *mem; /* slow, read/write access */
+    size_t size;
+    uint32_t flags; /* VFIO region flags (rd/wr/mmap) */
+    uint32_t nr_mmaps;
+    VFIOMmap *mmaps;
+    uint8_t nr; /* cache the region number for debug */
+} VFIORegion;
+
+
+void vfio_region_write(void *opaque, hwaddr addr,
+                           uint64_t data, unsigned size);
+uint64_t vfio_region_read(void *opaque,
+                          hwaddr addr, unsigned size);
+int vfio_region_setup(Object *obj, VFIODevice *vbasedev, VFIORegion *region,
+                      int index, const char *name);
+int vfio_region_mmap(VFIORegion *region);
+void vfio_region_mmaps_set_enabled(VFIORegion *region, bool enabled);
+void vfio_region_unmap(VFIORegion *region);
+void vfio_region_exit(VFIORegion *region);
+void vfio_region_finalize(VFIORegion *region);
+
+#endif /* HW_VFIO_REGION_H */

From aa90d775f0f568239f2a6bd3ead7e8d3b4a35a57 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Wed, 26 Mar 2025 08:50:57 +0100
Subject: [PATCH 0262/2760] vfio: Introduce a new header file for VFIOcontainer
 declarations
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Gather all VFIOcontainer related declarations into
"hw/vfio/vfio-container.h" to reduce exposure of VFIO internals in
"hw/vfio/vfio-common.h". These declarations were initially introduced
in commit 65501a745dba ("vfio: vfio-pci device assignment driver").
They are made available externally for PPC and s390x.

Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: John Levon <john.levon@nutanix.com>
Link: https://lore.kernel.org/qemu-devel/20250318095415.670319-12-clg@redhat.com
Link: https://lore.kernel.org/qemu-devel/20250326075122.1299361-13-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/ppc/spapr_pci_vfio.c          |  1 +
 hw/s390x/s390-pci-vfio.c         |  2 +-
 hw/vfio/container.c              |  1 +
 hw/vfio/spapr.c                  |  1 +
 include/hw/vfio/vfio-common.h    | 19 -----------------
 include/hw/vfio/vfio-container.h | 36 ++++++++++++++++++++++++++++++++
 6 files changed, 40 insertions(+), 20 deletions(-)
 create mode 100644 include/hw/vfio/vfio-container.h

diff --git a/hw/ppc/spapr_pci_vfio.c b/hw/ppc/spapr_pci_vfio.c
index 76b2a3487b..1722a5bfa3 100644
--- a/hw/ppc/spapr_pci_vfio.c
+++ b/hw/ppc/spapr_pci_vfio.c
@@ -25,6 +25,7 @@
 #include "hw/pci/msix.h"
 #include "hw/pci/pci_device.h"
 #include "hw/vfio/vfio-common.h"
+#include "hw/vfio/vfio-container.h"
 #include "qemu/error-report.h"
 #include CONFIG_DEVICES /* CONFIG_VFIO_PCI */
 
diff --git a/hw/s390x/s390-pci-vfio.c b/hw/s390x/s390-pci-vfio.c
index db152a6252..748a51fd8c 100644
--- a/hw/s390x/s390-pci-vfio.c
+++ b/hw/s390x/s390-pci-vfio.c
@@ -20,7 +20,7 @@
 #include "hw/s390x/s390-pci-clp.h"
 #include "hw/s390x/s390-pci-vfio.h"
 #include "hw/vfio/pci.h"
-#include "hw/vfio/vfio-common.h"
+#include "hw/vfio/vfio-container.h"
 
 /*
  * Get the current DMA available count from vfio.  Returns true if vfio is
diff --git a/hw/vfio/container.c b/hw/vfio/container.c
index 812d5edbcf..bda1942662 100644
--- a/hw/vfio/container.c
+++ b/hw/vfio/container.c
@@ -32,6 +32,7 @@
 #include "trace.h"
 #include "qapi/error.h"
 #include "pci.h"
+#include "hw/vfio/vfio-container.h"
 
 VFIOGroupList vfio_group_list =
     QLIST_HEAD_INITIALIZER(vfio_group_list);
diff --git a/hw/vfio/spapr.c b/hw/vfio/spapr.c
index f21955a344..31e4dddc9e 100644
--- a/hw/vfio/spapr.c
+++ b/hw/vfio/spapr.c
@@ -16,6 +16,7 @@
 #include "system/address-spaces.h"
 
 #include "hw/vfio/vfio-common.h"
+#include "hw/vfio/vfio-container.h"
 #include "hw/hw.h"
 #include "system/ram_addr.h"
 #include "qemu/error-report.h"
diff --git a/include/hw/vfio/vfio-common.h b/include/hw/vfio/vfio-common.h
index b372033741..bcdbc9de57 100644
--- a/include/hw/vfio/vfio-common.h
+++ b/include/hw/vfio/vfio-common.h
@@ -39,16 +39,6 @@ enum {
     VFIO_DEVICE_TYPE_CCW = 2,
     VFIO_DEVICE_TYPE_AP = 3,
 };
-struct VFIOGroup;
-
-typedef struct VFIOContainer {
-    VFIOContainerBase bcontainer;
-    int fd; /* /dev/vfio/vfio, empowered by the attached groups */
-    unsigned iommu_type;
-    QLIST_HEAD(, VFIOGroup) group_list;
-} VFIOContainer;
-
-OBJECT_DECLARE_SIMPLE_TYPE(VFIOContainer, VFIO_IOMMU_LEGACY);
 
 typedef struct VFIODeviceOps VFIODeviceOps;
 typedef struct VFIOMigration VFIOMigration;
@@ -125,15 +115,6 @@ struct VFIODeviceOps {
     int (*vfio_load_config)(VFIODevice *vdev, QEMUFile *f);
 };
 
-typedef struct VFIOGroup {
-    int fd;
-    int groupid;
-    VFIOContainer *container;
-    QLIST_HEAD(, VFIODevice) device_list;
-    QLIST_ENTRY(VFIOGroup) next;
-    QLIST_ENTRY(VFIOGroup) container_next;
-    bool ram_block_discard_allowed;
-} VFIOGroup;
 
 #define TYPE_HOST_IOMMU_DEVICE_LEGACY_VFIO TYPE_HOST_IOMMU_DEVICE "-legacy-vfio"
 #define TYPE_HOST_IOMMU_DEVICE_IOMMUFD_VFIO \
diff --git a/include/hw/vfio/vfio-container.h b/include/hw/vfio/vfio-container.h
new file mode 100644
index 0000000000..afc498da49
--- /dev/null
+++ b/include/hw/vfio/vfio-container.h
@@ -0,0 +1,36 @@
+/*
+ * VFIO container
+ *
+ * Copyright Red Hat, Inc. 2025
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef HW_VFIO_CONTAINER_H
+#define HW_VFIO_CONTAINER_H
+
+#include "hw/vfio/vfio-container-base.h"
+
+typedef struct VFIOContainer VFIOContainer;
+typedef struct VFIODevice VFIODevice;
+
+typedef struct VFIOGroup {
+    int fd;
+    int groupid;
+    VFIOContainer *container;
+    QLIST_HEAD(, VFIODevice) device_list;
+    QLIST_ENTRY(VFIOGroup) next;
+    QLIST_ENTRY(VFIOGroup) container_next;
+    bool ram_block_discard_allowed;
+} VFIOGroup;
+
+typedef struct VFIOContainer {
+    VFIOContainerBase bcontainer;
+    int fd; /* /dev/vfio/vfio, empowered by the attached groups */
+    unsigned iommu_type;
+    QLIST_HEAD(, VFIOGroup) group_list;
+} VFIOContainer;
+
+OBJECT_DECLARE_SIMPLE_TYPE(VFIOContainer, VFIO_IOMMU_LEGACY);
+
+#endif /* HW_VFIO_CONTAINER_H */

From 0778f9b3bef0438530e1dd0d277571405637d880 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Wed, 26 Mar 2025 08:50:58 +0100
Subject: [PATCH 0263/2760] vfio: Make vfio_group_list static
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

vfio_group_list is only used in file "container.c".

Reviewed-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Link: https://lore.kernel.org/qemu-devel/20250318095415.670319-13-clg@redhat.com
Link: https://lore.kernel.org/qemu-devel/20250326075122.1299361-14-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/container.c           | 3 ++-
 include/hw/vfio/vfio-common.h | 2 --
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/hw/vfio/container.c b/hw/vfio/container.c
index bda1942662..8a216b24b5 100644
--- a/hw/vfio/container.c
+++ b/hw/vfio/container.c
@@ -34,7 +34,8 @@
 #include "pci.h"
 #include "hw/vfio/vfio-container.h"
 
-VFIOGroupList vfio_group_list =
+typedef QLIST_HEAD(VFIOGroupList, VFIOGroup) VFIOGroupList;
+static VFIOGroupList vfio_group_list =
     QLIST_HEAD_INITIALIZER(vfio_group_list);
 
 static int vfio_ram_block_discard_disable(VFIOContainer *container, bool state)
diff --git a/include/hw/vfio/vfio-common.h b/include/hw/vfio/vfio-common.h
index bcdbc9de57..d806349475 100644
--- a/include/hw/vfio/vfio-common.h
+++ b/include/hw/vfio/vfio-common.h
@@ -146,9 +146,7 @@ int vfio_kvm_device_del_fd(int fd, Error **errp);
 bool vfio_cpr_register_container(VFIOContainerBase *bcontainer, Error **errp);
 void vfio_cpr_unregister_container(VFIOContainerBase *bcontainer);
 
-typedef QLIST_HEAD(VFIOGroupList, VFIOGroup) VFIOGroupList;
 typedef QLIST_HEAD(VFIODeviceList, VFIODevice) VFIODeviceList;
-extern VFIOGroupList vfio_group_list;
 extern VFIODeviceList vfio_device_list;
 extern const MemoryListener vfio_memory_listener;
 extern int vfio_kvm_device_fd;

From d158ed092332d8c79193921112ea5e7b5e62cd6d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Wed, 26 Mar 2025 08:50:59 +0100
Subject: [PATCH 0264/2760] vfio: Move VFIOAddressSpace helpers into
 container-base.c
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

VFIOAddressSpace is a common object used by VFIOContainerBase which is
declared in "hw/vfio/vfio-container-base.h". Move the VFIOAddressSpace
related services into "container-base.c".

While at it, rename :

  vfio_get_address_space -> vfio_address_space_get
  vfio_put_address_space -> vfio_address_space_put

to better reflect the namespace these routines belong to.

Reviewed-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Link: https://lore.kernel.org/qemu-devel/20250326075122.1299361-15-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/ppc/spapr_pci_vfio.c               |  5 ++-
 hw/vfio/common.c                      | 47 -------------------------
 hw/vfio/container-base.c              | 50 +++++++++++++++++++++++++++
 hw/vfio/container.c                   |  6 ++--
 hw/vfio/iommufd.c                     |  6 ++--
 include/hw/vfio/vfio-common.h         |  5 ---
 include/hw/vfio/vfio-container-base.h |  6 ++++
 7 files changed, 64 insertions(+), 61 deletions(-)

diff --git a/hw/ppc/spapr_pci_vfio.c b/hw/ppc/spapr_pci_vfio.c
index 1722a5bfa3..e318d0d912 100644
--- a/hw/ppc/spapr_pci_vfio.c
+++ b/hw/ppc/spapr_pci_vfio.c
@@ -24,7 +24,6 @@
 #include "hw/pci-host/spapr.h"
 #include "hw/pci/msix.h"
 #include "hw/pci/pci_device.h"
-#include "hw/vfio/vfio-common.h"
 #include "hw/vfio/vfio-container.h"
 #include "qemu/error-report.h"
 #include CONFIG_DEVICES /* CONFIG_VFIO_PCI */
@@ -86,7 +85,7 @@ static int vfio_eeh_container_op(VFIOContainer *container, uint32_t op)
 
 static VFIOContainer *vfio_eeh_as_container(AddressSpace *as)
 {
-    VFIOAddressSpace *space = vfio_get_address_space(as);
+    VFIOAddressSpace *space = vfio_address_space_get(as);
     VFIOContainerBase *bcontainer = NULL;
 
     if (QLIST_EMPTY(&space->containers)) {
@@ -106,7 +105,7 @@ static VFIOContainer *vfio_eeh_as_container(AddressSpace *as)
     }
 
 out:
-    vfio_put_address_space(space);
+    vfio_address_space_put(space);
     return container_of(bcontainer, VFIOContainer, bcontainer);
 }
 
diff --git a/hw/vfio/common.c b/hw/vfio/common.c
index 8f55e7b212..c099d4d24d 100644
--- a/hw/vfio/common.c
+++ b/hw/vfio/common.c
@@ -47,8 +47,6 @@
 
 VFIODeviceList vfio_device_list =
     QLIST_HEAD_INITIALIZER(vfio_device_list);
-static QLIST_HEAD(, VFIOAddressSpace) vfio_address_spaces =
-    QLIST_HEAD_INITIALIZER(vfio_address_spaces);
 
 #ifdef CONFIG_KVM
 /*
@@ -1392,51 +1390,6 @@ int vfio_kvm_device_del_fd(int fd, Error **errp)
     return 0;
 }
 
-VFIOAddressSpace *vfio_get_address_space(AddressSpace *as)
-{
-    VFIOAddressSpace *space;
-
-    QLIST_FOREACH(space, &vfio_address_spaces, list) {
-        if (space->as == as) {
-            return space;
-        }
-    }
-
-    /* No suitable VFIOAddressSpace, create a new one */
-    space = g_malloc0(sizeof(*space));
-    space->as = as;
-    QLIST_INIT(&space->containers);
-
-    if (QLIST_EMPTY(&vfio_address_spaces)) {
-        qemu_register_reset(vfio_reset_handler, NULL);
-    }
-
-    QLIST_INSERT_HEAD(&vfio_address_spaces, space, list);
-
-    return space;
-}
-
-void vfio_put_address_space(VFIOAddressSpace *space)
-{
-    if (!QLIST_EMPTY(&space->containers)) {
-        return;
-    }
-
-    QLIST_REMOVE(space, list);
-    g_free(space);
-
-    if (QLIST_EMPTY(&vfio_address_spaces)) {
-        qemu_unregister_reset(vfio_reset_handler, NULL);
-    }
-}
-
-void vfio_address_space_insert(VFIOAddressSpace *space,
-                               VFIOContainerBase *bcontainer)
-{
-    QLIST_INSERT_HEAD(&space->containers, bcontainer, next);
-    bcontainer->space = space;
-}
-
 struct vfio_device_info *vfio_get_device_info(int fd)
 {
     struct vfio_device_info *info;
diff --git a/hw/vfio/container-base.c b/hw/vfio/container-base.c
index 749a3fd29d..2c2d8329e3 100644
--- a/hw/vfio/container-base.c
+++ b/hw/vfio/container-base.c
@@ -14,6 +14,56 @@
 #include "qapi/error.h"
 #include "qemu/error-report.h"
 #include "hw/vfio/vfio-container-base.h"
+#include "hw/vfio/vfio-common.h" /* vfio_reset_handler */
+#include "system/reset.h"
+
+static QLIST_HEAD(, VFIOAddressSpace) vfio_address_spaces =
+    QLIST_HEAD_INITIALIZER(vfio_address_spaces);
+
+VFIOAddressSpace *vfio_address_space_get(AddressSpace *as)
+{
+    VFIOAddressSpace *space;
+
+    QLIST_FOREACH(space, &vfio_address_spaces, list) {
+        if (space->as == as) {
+            return space;
+        }
+    }
+
+    /* No suitable VFIOAddressSpace, create a new one */
+    space = g_malloc0(sizeof(*space));
+    space->as = as;
+    QLIST_INIT(&space->containers);
+
+    if (QLIST_EMPTY(&vfio_address_spaces)) {
+        qemu_register_reset(vfio_reset_handler, NULL);
+    }
+
+    QLIST_INSERT_HEAD(&vfio_address_spaces, space, list);
+
+    return space;
+}
+
+void vfio_address_space_put(VFIOAddressSpace *space)
+{
+    if (!QLIST_EMPTY(&space->containers)) {
+        return;
+    }
+
+    QLIST_REMOVE(space, list);
+    g_free(space);
+
+    if (QLIST_EMPTY(&vfio_address_spaces)) {
+        qemu_unregister_reset(vfio_reset_handler, NULL);
+    }
+}
+
+void vfio_address_space_insert(VFIOAddressSpace *space,
+                               VFIOContainerBase *bcontainer)
+{
+    QLIST_INSERT_HEAD(&space->containers, bcontainer, next);
+    bcontainer->space = space;
+}
 
 int vfio_container_dma_map(VFIOContainerBase *bcontainer,
                            hwaddr iova, ram_addr_t size,
diff --git a/hw/vfio/container.c b/hw/vfio/container.c
index 8a216b24b5..cc8cc0f272 100644
--- a/hw/vfio/container.c
+++ b/hw/vfio/container.c
@@ -546,7 +546,7 @@ static bool vfio_connect_container(VFIOGroup *group, AddressSpace *as,
     VFIOAddressSpace *space;
     VFIOIOMMUClass *vioc;
 
-    space = vfio_get_address_space(as);
+    space = vfio_address_space_get(as);
 
     /*
      * VFIO is currently incompatible with discarding of RAM insofar as the
@@ -675,7 +675,7 @@ close_fd_exit:
     close(fd);
 
 put_space_exit:
-    vfio_put_address_space(space);
+    vfio_address_space_put(space);
 
     return false;
 }
@@ -714,7 +714,7 @@ static void vfio_disconnect_container(VFIOGroup *group)
         close(container->fd);
         object_unref(container);
 
-        vfio_put_address_space(space);
+        vfio_address_space_put(space);
     }
 }
 
diff --git a/hw/vfio/iommufd.c b/hw/vfio/iommufd.c
index 7196c40801..a520d40afc 100644
--- a/hw/vfio/iommufd.c
+++ b/hw/vfio/iommufd.c
@@ -486,7 +486,7 @@ static bool iommufd_cdev_attach(const char *name, VFIODevice *vbasedev,
         goto err_connect_bind;
     }
 
-    space = vfio_get_address_space(as);
+    space = vfio_address_space_get(as);
 
     /*
      * The HostIOMMUDevice data from legacy backend is static and doesn't need
@@ -606,7 +606,7 @@ err_discard_disable:
 err_attach_container:
     iommufd_cdev_container_destroy(container);
 err_alloc_ioas:
-    vfio_put_address_space(space);
+    vfio_address_space_put(space);
     iommufd_cdev_unbind_and_disconnect(vbasedev);
 err_connect_bind:
     close(vbasedev->fd);
@@ -631,7 +631,7 @@ static void iommufd_cdev_detach(VFIODevice *vbasedev)
     vfio_cpr_unregister_container(bcontainer);
     iommufd_cdev_detach_container(vbasedev, container);
     iommufd_cdev_container_destroy(container);
-    vfio_put_address_space(space);
+    vfio_address_space_put(space);
 
     iommufd_cdev_unbind_and_disconnect(vbasedev);
     close(vbasedev->fd);
diff --git a/include/hw/vfio/vfio-common.h b/include/hw/vfio/vfio-common.h
index d806349475..7d78eb85da 100644
--- a/include/hw/vfio/vfio-common.h
+++ b/include/hw/vfio/vfio-common.h
@@ -120,11 +120,6 @@ struct VFIODeviceOps {
 #define TYPE_HOST_IOMMU_DEVICE_IOMMUFD_VFIO \
             TYPE_HOST_IOMMU_DEVICE_IOMMUFD "-vfio"
 
-VFIOAddressSpace *vfio_get_address_space(AddressSpace *as);
-void vfio_put_address_space(VFIOAddressSpace *space);
-void vfio_address_space_insert(VFIOAddressSpace *space,
-                               VFIOContainerBase *bcontainer);
-
 void vfio_disable_irqindex(VFIODevice *vbasedev, int index);
 void vfio_unmask_single_irqindex(VFIODevice *vbasedev, int index);
 void vfio_mask_single_irqindex(VFIODevice *vbasedev, int index);
diff --git a/include/hw/vfio/vfio-container-base.h b/include/hw/vfio/vfio-container-base.h
index 6aca02fb3d..e0c458d487 100644
--- a/include/hw/vfio/vfio-container-base.h
+++ b/include/hw/vfio/vfio-container-base.h
@@ -71,6 +71,11 @@ typedef struct VFIORamDiscardListener {
     QLIST_ENTRY(VFIORamDiscardListener) next;
 } VFIORamDiscardListener;
 
+VFIOAddressSpace *vfio_address_space_get(AddressSpace *as);
+void vfio_address_space_put(VFIOAddressSpace *space);
+void vfio_address_space_insert(VFIOAddressSpace *space,
+                               VFIOContainerBase *bcontainer);
+
 int vfio_container_dma_map(VFIOContainerBase *bcontainer,
                            hwaddr iova, ram_addr_t size,
                            void *vaddr, bool readonly);
@@ -163,4 +168,5 @@ struct VFIOIOMMUClass {
                        MemoryRegionSection *section);
     void (*release)(VFIOContainerBase *bcontainer);
 };
+
 #endif /* HW_VFIO_VFIO_CONTAINER_BASE_H */

From 5cf52416e428836b1328ed47173a41948e1643bd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Wed, 26 Mar 2025 08:51:00 +0100
Subject: [PATCH 0265/2760] vfio: Move Host IOMMU type declarations into their
 respective files
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

These definitions don't have any use outside of their respective
submodules. There is no need to expose them externally. Keep them
private.

Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: John Levon <john.levon@nutanix.com>
Link: https://lore.kernel.org/qemu-devel/20250318095415.670319-15-clg@redhat.com
Link: https://lore.kernel.org/qemu-devel/20250326075122.1299361-16-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/container.c           | 2 ++
 hw/vfio/iommufd.c             | 3 +++
 include/hw/vfio/vfio-common.h | 5 -----
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/hw/vfio/container.c b/hw/vfio/container.c
index cc8cc0f272..6ef53ee187 100644
--- a/hw/vfio/container.c
+++ b/hw/vfio/container.c
@@ -34,6 +34,8 @@
 #include "pci.h"
 #include "hw/vfio/vfio-container.h"
 
+#define TYPE_HOST_IOMMU_DEVICE_LEGACY_VFIO TYPE_HOST_IOMMU_DEVICE "-legacy-vfio"
+
 typedef QLIST_HEAD(VFIOGroupList, VFIOGroup) VFIOGroupList;
 static VFIOGroupList vfio_group_list =
     QLIST_HEAD_INITIALIZER(vfio_group_list);
diff --git a/hw/vfio/iommufd.c b/hw/vfio/iommufd.c
index a520d40afc..2ec15bc269 100644
--- a/hw/vfio/iommufd.c
+++ b/hw/vfio/iommufd.c
@@ -27,6 +27,9 @@
 #include "pci.h"
 #include "vfio-iommufd.h"
 
+#define TYPE_HOST_IOMMU_DEVICE_IOMMUFD_VFIO             \
+            TYPE_HOST_IOMMU_DEVICE_IOMMUFD "-vfio"
+
 static int iommufd_cdev_map(const VFIOContainerBase *bcontainer, hwaddr iova,
                             ram_addr_t size, void *vaddr, bool readonly)
 {
diff --git a/include/hw/vfio/vfio-common.h b/include/hw/vfio/vfio-common.h
index 7d78eb85da..bb11b8215a 100644
--- a/include/hw/vfio/vfio-common.h
+++ b/include/hw/vfio/vfio-common.h
@@ -115,11 +115,6 @@ struct VFIODeviceOps {
     int (*vfio_load_config)(VFIODevice *vdev, QEMUFile *f);
 };
 
-
-#define TYPE_HOST_IOMMU_DEVICE_LEGACY_VFIO TYPE_HOST_IOMMU_DEVICE "-legacy-vfio"
-#define TYPE_HOST_IOMMU_DEVICE_IOMMUFD_VFIO \
-            TYPE_HOST_IOMMU_DEVICE_IOMMUFD "-vfio"
-
 void vfio_disable_irqindex(VFIODevice *vbasedev, int index);
 void vfio_unmask_single_irqindex(VFIODevice *vbasedev, int index);
 void vfio_mask_single_irqindex(VFIODevice *vbasedev, int index);

From ac28680d5e7a84943cd9f55a4aae245d6d7fdcae Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Wed, 26 Mar 2025 08:51:01 +0100
Subject: [PATCH 0266/2760] vfio: Introduce a new header file for helper
 services
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Gather all helper routine declarations into "vfio-helpers.h" to reduce
exposure of VFIO internals in "hw/vfio/vfio-common.h".

Reviewed-by: John Levon <john.levon@nutanix.com>
Link: https://lore.kernel.org/qemu-devel/20250318095415.670319-16-clg@redhat.com
Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Link: https://lore.kernel.org/qemu-devel/20250326075122.1299361-17-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/s390x/s390-pci-vfio.c      |  1 +
 hw/vfio/common.c              |  1 +
 hw/vfio/container.c           |  1 +
 hw/vfio/helpers.c             |  1 +
 hw/vfio/pci.c                 |  1 +
 hw/vfio/region.c              |  1 +
 hw/vfio/vfio-helpers.h        | 26 ++++++++++++++++++++++++++
 include/hw/vfio/vfio-common.h |  7 -------
 8 files changed, 32 insertions(+), 7 deletions(-)
 create mode 100644 hw/vfio/vfio-helpers.h

diff --git a/hw/s390x/s390-pci-vfio.c b/hw/s390x/s390-pci-vfio.c
index 748a51fd8c..aaf91319b4 100644
--- a/hw/s390x/s390-pci-vfio.c
+++ b/hw/s390x/s390-pci-vfio.c
@@ -21,6 +21,7 @@
 #include "hw/s390x/s390-pci-vfio.h"
 #include "hw/vfio/pci.h"
 #include "hw/vfio/vfio-container.h"
+#include "hw/vfio/vfio-helpers.h"
 
 /*
  * Get the current DMA available count from vfio.  Returns true if vfio is
diff --git a/hw/vfio/common.c b/hw/vfio/common.c
index c099d4d24d..18e5aacbd1 100644
--- a/hw/vfio/common.c
+++ b/hw/vfio/common.c
@@ -44,6 +44,7 @@
 #include "system/tcg.h"
 #include "system/tpm.h"
 #include "vfio-migration-internal.h"
+#include "vfio-helpers.h"
 
 VFIODeviceList vfio_device_list =
     QLIST_HEAD_INITIALIZER(vfio_device_list);
diff --git a/hw/vfio/container.c b/hw/vfio/container.c
index 6ef53ee187..b2d72f5036 100644
--- a/hw/vfio/container.c
+++ b/hw/vfio/container.c
@@ -33,6 +33,7 @@
 #include "qapi/error.h"
 #include "pci.h"
 #include "hw/vfio/vfio-container.h"
+#include "vfio-helpers.h"
 
 #define TYPE_HOST_IOMMU_DEVICE_LEGACY_VFIO TYPE_HOST_IOMMU_DEVICE "-legacy-vfio"
 
diff --git a/hw/vfio/helpers.c b/hw/vfio/helpers.c
index 89403943a7..054ee6e31e 100644
--- a/hw/vfio/helpers.c
+++ b/hw/vfio/helpers.c
@@ -30,6 +30,7 @@
 #include "qemu/error-report.h"
 #include "qemu/units.h"
 #include "monitor/monitor.h"
+#include "vfio-helpers.h"
 
 /*
  * Common VFIO interrupt disable
diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index b0aac2f3a0..bade3b80d7 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -45,6 +45,7 @@
 #include "migration/qemu-file.h"
 #include "system/iommufd.h"
 #include "vfio-migration-internal.h"
+#include "vfio-helpers.h"
 
 #define TYPE_VFIO_PCI_NOHOTPLUG "vfio-pci-nohotplug"
 
diff --git a/hw/vfio/region.c b/hw/vfio/region.c
index 08cd69e704..9049143abf 100644
--- a/hw/vfio/region.c
+++ b/hw/vfio/region.c
@@ -29,6 +29,7 @@
 #include "qemu/error-report.h"
 #include "qemu/units.h"
 #include "monitor/monitor.h"
+#include "vfio-helpers.h"
 
 /*
  * IO Port/MMIO - Beware of the endians, VFIO is always little endian
diff --git a/hw/vfio/vfio-helpers.h b/hw/vfio/vfio-helpers.h
new file mode 100644
index 0000000000..d7e4dcba51
--- /dev/null
+++ b/hw/vfio/vfio-helpers.h
@@ -0,0 +1,26 @@
+/*
+ * VFIO helpers
+ *
+ * Copyright Red Hat, Inc. 2025
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef HW_VFIO_VFIO_HELPERS_H
+#define HW_VFIO_VFIO_HELPERS_H
+
+#ifdef CONFIG_LINUX
+#include <linux/vfio.h>
+
+struct vfio_info_cap_header *
+vfio_get_cap(void *ptr, uint32_t cap_offset, uint16_t id);
+struct vfio_info_cap_header *
+vfio_get_device_info_cap(struct vfio_device_info *info, uint16_t id);
+struct vfio_info_cap_header *
+vfio_get_region_info_cap(struct vfio_region_info *info, uint16_t id);
+
+#endif
+
+int vfio_bitmap_alloc(VFIOBitmap *vbmap, hwaddr size);
+
+#endif /* HW_VFIO_VFIO_HELPERS_H */
diff --git a/include/hw/vfio/vfio-common.h b/include/hw/vfio/vfio-common.h
index bb11b8215a..8e465111d2 100644
--- a/include/hw/vfio/vfio-common.h
+++ b/include/hw/vfio/vfio-common.h
@@ -147,17 +147,10 @@ int vfio_get_region_info(VFIODevice *vbasedev, int index,
 int vfio_get_dev_region_info(VFIODevice *vbasedev, uint32_t type,
                              uint32_t subtype, struct vfio_region_info **info);
 bool vfio_has_region_cap(VFIODevice *vbasedev, int region, uint16_t cap_type);
-struct vfio_info_cap_header *
-vfio_get_region_info_cap(struct vfio_region_info *info, uint16_t id);
 bool vfio_get_info_dma_avail(struct vfio_iommu_type1_info *info,
                              unsigned int *avail);
-struct vfio_info_cap_header *
-vfio_get_device_info_cap(struct vfio_device_info *info, uint16_t id);
-struct vfio_info_cap_header *
-vfio_get_cap(void *ptr, uint32_t cap_offset, uint16_t id);
 #endif
 
-int vfio_bitmap_alloc(VFIOBitmap *vbmap, hwaddr size);
 bool vfio_devices_all_dirty_tracking_started(
     const VFIOContainerBase *bcontainer);
 bool

From f6d7f5d02bbb57b5b469863afe89278d64598d81 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Wed, 26 Mar 2025 08:51:02 +0100
Subject: [PATCH 0267/2760] vfio: Move vfio_get_info_dma_avail() into helpers.c
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

vfio_get_info_dma_avail() is a low level routine similar to the other
routines extracting capabilities from 'struct vfio_iommu_type1_info'.
It belongs to file "helpers.c".

Reviewed-by: John Levon <john.levon@nutanix.com>
Link: https://lore.kernel.org/qemu-devel/20250318095415.670319-17-clg@redhat.com
Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Link: https://lore.kernel.org/qemu-devel/20250326075122.1299361-18-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/container.c           | 31 -------------------------------
 hw/vfio/helpers.c             | 31 +++++++++++++++++++++++++++++++
 hw/vfio/vfio-helpers.h        |  5 ++++-
 include/hw/vfio/vfio-common.h |  2 --
 4 files changed, 35 insertions(+), 34 deletions(-)

diff --git a/hw/vfio/container.c b/hw/vfio/container.c
index b2d72f5036..3fdd5dac37 100644
--- a/hw/vfio/container.c
+++ b/hw/vfio/container.c
@@ -278,37 +278,6 @@ static int vfio_legacy_query_dirty_bitmap(const VFIOContainerBase *bcontainer,
     return ret;
 }
 
-static struct vfio_info_cap_header *
-vfio_get_iommu_type1_info_cap(struct vfio_iommu_type1_info *info, uint16_t id)
-{
-    if (!(info->flags & VFIO_IOMMU_INFO_CAPS)) {
-        return NULL;
-    }
-
-    return vfio_get_cap((void *)info, info->cap_offset, id);
-}
-
-bool vfio_get_info_dma_avail(struct vfio_iommu_type1_info *info,
-                             unsigned int *avail)
-{
-    struct vfio_info_cap_header *hdr;
-    struct vfio_iommu_type1_info_dma_avail *cap;
-
-    /* If the capability cannot be found, assume no DMA limiting */
-    hdr = vfio_get_iommu_type1_info_cap(info,
-                                        VFIO_IOMMU_TYPE1_INFO_DMA_AVAIL);
-    if (!hdr) {
-        return false;
-    }
-
-    if (avail != NULL) {
-        cap = (void *) hdr;
-        *avail = cap->avail;
-    }
-
-    return true;
-}
-
 static bool vfio_get_info_iova_range(struct vfio_iommu_type1_info *info,
                                      VFIOContainerBase *bcontainer)
 {
diff --git a/hw/vfio/helpers.c b/hw/vfio/helpers.c
index 054ee6e31e..1a584ba5f0 100644
--- a/hw/vfio/helpers.c
+++ b/hw/vfio/helpers.c
@@ -222,6 +222,37 @@ retry:
     return 0;
 }
 
+struct vfio_info_cap_header *
+vfio_get_iommu_type1_info_cap(struct vfio_iommu_type1_info *info, uint16_t id)
+{
+    if (!(info->flags & VFIO_IOMMU_INFO_CAPS)) {
+        return NULL;
+    }
+
+    return vfio_get_cap((void *)info, info->cap_offset, id);
+}
+
+bool vfio_get_info_dma_avail(struct vfio_iommu_type1_info *info,
+                             unsigned int *avail)
+{
+    struct vfio_info_cap_header *hdr;
+    struct vfio_iommu_type1_info_dma_avail *cap;
+
+    /* If the capability cannot be found, assume no DMA limiting */
+    hdr = vfio_get_iommu_type1_info_cap(info,
+                                        VFIO_IOMMU_TYPE1_INFO_DMA_AVAIL);
+    if (!hdr) {
+        return false;
+    }
+
+    if (avail != NULL) {
+        cap = (void *) hdr;
+        *avail = cap->avail;
+    }
+
+    return true;
+}
+
 int vfio_get_dev_region_info(VFIODevice *vbasedev, uint32_t type,
                              uint32_t subtype, struct vfio_region_info **info)
 {
diff --git a/hw/vfio/vfio-helpers.h b/hw/vfio/vfio-helpers.h
index d7e4dcba51..9af43878b8 100644
--- a/hw/vfio/vfio-helpers.h
+++ b/hw/vfio/vfio-helpers.h
@@ -18,7 +18,10 @@ struct vfio_info_cap_header *
 vfio_get_device_info_cap(struct vfio_device_info *info, uint16_t id);
 struct vfio_info_cap_header *
 vfio_get_region_info_cap(struct vfio_region_info *info, uint16_t id);
-
+struct vfio_info_cap_header *
+vfio_get_iommu_type1_info_cap(struct vfio_iommu_type1_info *info, uint16_t id);
+bool vfio_get_info_dma_avail(struct vfio_iommu_type1_info *info,
+                             unsigned int *avail);
 #endif
 
 int vfio_bitmap_alloc(VFIOBitmap *vbmap, hwaddr size);
diff --git a/include/hw/vfio/vfio-common.h b/include/hw/vfio/vfio-common.h
index 8e465111d2..be2558f7e4 100644
--- a/include/hw/vfio/vfio-common.h
+++ b/include/hw/vfio/vfio-common.h
@@ -147,8 +147,6 @@ int vfio_get_region_info(VFIODevice *vbasedev, int index,
 int vfio_get_dev_region_info(VFIODevice *vbasedev, uint32_t type,
                              uint32_t subtype, struct vfio_region_info **info);
 bool vfio_has_region_cap(VFIODevice *vbasedev, int region, uint16_t cap_type);
-bool vfio_get_info_dma_avail(struct vfio_iommu_type1_info *info,
-                             unsigned int *avail);
 #endif
 
 bool vfio_devices_all_dirty_tracking_started(

From 545256134fdcac6c342f8e7f45eb591e3b12c700 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Wed, 26 Mar 2025 08:51:03 +0100
Subject: [PATCH 0268/2760] vfio: Move vfio_kvm_device_add/del_fd() to
 helpers.c
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

vfio_kvm_device_add/del_fd() are low level routines. Move them with
the other helpers.

Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: John Levon <john.levon@nutanix.com>
Link: https://lore.kernel.org/qemu-devel/20250318095415.670319-18-clg@redhat.com
Link: https://lore.kernel.org/qemu-devel/20250326075122.1299361-19-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/common.c              | 58 ----------------------------------
 hw/vfio/helpers.c             | 59 +++++++++++++++++++++++++++++++++++
 hw/vfio/iommufd.c             |  1 +
 hw/vfio/meson.build           |  2 +-
 hw/vfio/vfio-helpers.h        |  3 ++
 include/hw/vfio/vfio-common.h |  3 --
 6 files changed, 64 insertions(+), 62 deletions(-)

diff --git a/hw/vfio/common.c b/hw/vfio/common.c
index 18e5aacbd1..2b3af051cc 100644
--- a/hw/vfio/common.c
+++ b/hw/vfio/common.c
@@ -1333,64 +1333,6 @@ void vfio_reset_handler(void *opaque)
     }
 }
 
-int vfio_kvm_device_add_fd(int fd, Error **errp)
-{
-#ifdef CONFIG_KVM
-    struct kvm_device_attr attr = {
-        .group = KVM_DEV_VFIO_FILE,
-        .attr = KVM_DEV_VFIO_FILE_ADD,
-        .addr = (uint64_t)(unsigned long)&fd,
-    };
-
-    if (!kvm_enabled()) {
-        return 0;
-    }
-
-    if (vfio_kvm_device_fd < 0) {
-        struct kvm_create_device cd = {
-            .type = KVM_DEV_TYPE_VFIO,
-        };
-
-        if (kvm_vm_ioctl(kvm_state, KVM_CREATE_DEVICE, &cd)) {
-            error_setg_errno(errp, errno, "Failed to create KVM VFIO device");
-            return -errno;
-        }
-
-        vfio_kvm_device_fd = cd.fd;
-    }
-
-    if (ioctl(vfio_kvm_device_fd, KVM_SET_DEVICE_ATTR, &attr)) {
-        error_setg_errno(errp, errno, "Failed to add fd %d to KVM VFIO device",
-                         fd);
-        return -errno;
-    }
-#endif
-    return 0;
-}
-
-int vfio_kvm_device_del_fd(int fd, Error **errp)
-{
-#ifdef CONFIG_KVM
-    struct kvm_device_attr attr = {
-        .group = KVM_DEV_VFIO_FILE,
-        .attr = KVM_DEV_VFIO_FILE_DEL,
-        .addr = (uint64_t)(unsigned long)&fd,
-    };
-
-    if (vfio_kvm_device_fd < 0) {
-        error_setg(errp, "KVM VFIO device isn't created yet");
-        return -EINVAL;
-    }
-
-    if (ioctl(vfio_kvm_device_fd, KVM_SET_DEVICE_ATTR, &attr)) {
-        error_setg_errno(errp, errno,
-                         "Failed to remove fd %d from KVM VFIO device", fd);
-        return -errno;
-    }
-#endif
-    return 0;
-}
-
 struct vfio_device_info *vfio_get_device_info(int fd)
 {
     struct vfio_device_info *info;
diff --git a/hw/vfio/helpers.c b/hw/vfio/helpers.c
index 1a584ba5f0..e6b75baa80 100644
--- a/hw/vfio/helpers.c
+++ b/hw/vfio/helpers.c
@@ -22,6 +22,7 @@
 #include "qemu/osdep.h"
 #include <sys/ioctl.h>
 
+#include "system/kvm.h"
 #include "hw/vfio/vfio-common.h"
 #include "hw/vfio/pci.h"
 #include "hw/hw.h"
@@ -253,6 +254,64 @@ bool vfio_get_info_dma_avail(struct vfio_iommu_type1_info *info,
     return true;
 }
 
+int vfio_kvm_device_add_fd(int fd, Error **errp)
+{
+#ifdef CONFIG_KVM
+    struct kvm_device_attr attr = {
+        .group = KVM_DEV_VFIO_FILE,
+        .attr = KVM_DEV_VFIO_FILE_ADD,
+        .addr = (uint64_t)(unsigned long)&fd,
+    };
+
+    if (!kvm_enabled()) {
+        return 0;
+    }
+
+    if (vfio_kvm_device_fd < 0) {
+        struct kvm_create_device cd = {
+            .type = KVM_DEV_TYPE_VFIO,
+        };
+
+        if (kvm_vm_ioctl(kvm_state, KVM_CREATE_DEVICE, &cd)) {
+            error_setg_errno(errp, errno, "Failed to create KVM VFIO device");
+            return -errno;
+        }
+
+        vfio_kvm_device_fd = cd.fd;
+    }
+
+    if (ioctl(vfio_kvm_device_fd, KVM_SET_DEVICE_ATTR, &attr)) {
+        error_setg_errno(errp, errno, "Failed to add fd %d to KVM VFIO device",
+                         fd);
+        return -errno;
+    }
+#endif
+    return 0;
+}
+
+int vfio_kvm_device_del_fd(int fd, Error **errp)
+{
+#ifdef CONFIG_KVM
+    struct kvm_device_attr attr = {
+        .group = KVM_DEV_VFIO_FILE,
+        .attr = KVM_DEV_VFIO_FILE_DEL,
+        .addr = (uint64_t)(unsigned long)&fd,
+    };
+
+    if (vfio_kvm_device_fd < 0) {
+        error_setg(errp, "KVM VFIO device isn't created yet");
+        return -EINVAL;
+    }
+
+    if (ioctl(vfio_kvm_device_fd, KVM_SET_DEVICE_ATTR, &attr)) {
+        error_setg_errno(errp, errno,
+                         "Failed to remove fd %d from KVM VFIO device", fd);
+        return -errno;
+    }
+#endif
+    return 0;
+}
+
 int vfio_get_dev_region_info(VFIODevice *vbasedev, uint32_t type,
                              uint32_t subtype, struct vfio_region_info **info)
 {
diff --git a/hw/vfio/iommufd.c b/hw/vfio/iommufd.c
index 2ec15bc269..85b5a8146a 100644
--- a/hw/vfio/iommufd.c
+++ b/hw/vfio/iommufd.c
@@ -26,6 +26,7 @@
 #include "qemu/chardev_open.h"
 #include "pci.h"
 #include "vfio-iommufd.h"
+#include "vfio-helpers.h"
 
 #define TYPE_HOST_IOMMU_DEVICE_IOMMUFD_VFIO             \
             TYPE_HOST_IOMMU_DEVICE_IOMMUFD "-vfio"
diff --git a/hw/vfio/meson.build b/hw/vfio/meson.build
index 07010c7c9e..21795b3d19 100644
--- a/hw/vfio/meson.build
+++ b/hw/vfio/meson.build
@@ -2,6 +2,7 @@ vfio_ss = ss.source_set()
 vfio_ss.add(files(
   'common.c',
   'container.c',
+  'helpers.c',
 ))
 vfio_ss.add(when: 'CONFIG_PSERIES', if_true: files('spapr.c'))
 vfio_ss.add(when: 'CONFIG_VFIO_PCI', if_true: files(
@@ -18,7 +19,6 @@ specific_ss.add_all(when: 'CONFIG_VFIO', if_true: vfio_ss)
 system_ss.add(when: 'CONFIG_VFIO_XGMAC', if_true: files('calxeda-xgmac.c'))
 system_ss.add(when: 'CONFIG_VFIO_AMD_XGBE', if_true: files('amd-xgbe.c'))
 system_ss.add(when: 'CONFIG_VFIO', if_true: files(
-  'helpers.c',
   'container-base.c',
   'migration.c',
   'migration-multifd.c',
diff --git a/hw/vfio/vfio-helpers.h b/hw/vfio/vfio-helpers.h
index 9af43878b8..5d91e33d27 100644
--- a/hw/vfio/vfio-helpers.h
+++ b/hw/vfio/vfio-helpers.h
@@ -26,4 +26,7 @@ bool vfio_get_info_dma_avail(struct vfio_iommu_type1_info *info,
 
 int vfio_bitmap_alloc(VFIOBitmap *vbmap, hwaddr size);
 
+int vfio_kvm_device_add_fd(int fd, Error **errp);
+int vfio_kvm_device_del_fd(int fd, Error **errp);
+
 #endif /* HW_VFIO_VFIO_HELPERS_H */
diff --git a/include/hw/vfio/vfio-common.h b/include/hw/vfio/vfio-common.h
index be2558f7e4..442ec287d7 100644
--- a/include/hw/vfio/vfio-common.h
+++ b/include/hw/vfio/vfio-common.h
@@ -130,9 +130,6 @@ bool vfio_attach_device(char *name, VFIODevice *vbasedev,
 void vfio_detach_device(VFIODevice *vbasedev);
 VFIODevice *vfio_get_vfio_device(Object *obj);
 
-int vfio_kvm_device_add_fd(int fd, Error **errp);
-int vfio_kvm_device_del_fd(int fd, Error **errp);
-
 bool vfio_cpr_register_container(VFIOContainerBase *bcontainer, Error **errp);
 void vfio_cpr_unregister_container(VFIOContainerBase *bcontainer);
 

From 005b8d10450d2d41e9c1bcf8da4085f23cb85b76 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Wed, 26 Mar 2025 08:51:04 +0100
Subject: [PATCH 0269/2760] vfio: Move vfio_get_device_info() to helpers.c
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

vfio_get_device_info() is a low level routine. Move it with the other
helpers.

Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: John Levon <john.levon@nutanix.com>
Link: https://lore.kernel.org/qemu-devel/20250318095415.670319-19-clg@redhat.com
Link: https://lore.kernel.org/qemu-devel/20250326075122.1299361-20-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/common.c              | 24 ------------------------
 hw/vfio/helpers.c             | 24 ++++++++++++++++++++++++
 hw/vfio/vfio-helpers.h        |  1 +
 include/hw/vfio/vfio-common.h |  1 -
 4 files changed, 25 insertions(+), 25 deletions(-)

diff --git a/hw/vfio/common.c b/hw/vfio/common.c
index 2b3af051cc..f80c0ef229 100644
--- a/hw/vfio/common.c
+++ b/hw/vfio/common.c
@@ -1333,30 +1333,6 @@ void vfio_reset_handler(void *opaque)
     }
 }
 
-struct vfio_device_info *vfio_get_device_info(int fd)
-{
-    struct vfio_device_info *info;
-    uint32_t argsz = sizeof(*info);
-
-    info = g_malloc0(argsz);
-
-retry:
-    info->argsz = argsz;
-
-    if (ioctl(fd, VFIO_DEVICE_GET_INFO, info)) {
-        g_free(info);
-        return NULL;
-    }
-
-    if (info->argsz > argsz) {
-        argsz = info->argsz;
-        info = g_realloc(info, argsz);
-        goto retry;
-    }
-
-    return info;
-}
-
 bool vfio_attach_device(char *name, VFIODevice *vbasedev,
                         AddressSpace *as, Error **errp)
 {
diff --git a/hw/vfio/helpers.c b/hw/vfio/helpers.c
index e6b75baa80..b7f75b47af 100644
--- a/hw/vfio/helpers.c
+++ b/hw/vfio/helpers.c
@@ -312,6 +312,30 @@ int vfio_kvm_device_del_fd(int fd, Error **errp)
     return 0;
 }
 
+struct vfio_device_info *vfio_get_device_info(int fd)
+{
+    struct vfio_device_info *info;
+    uint32_t argsz = sizeof(*info);
+
+    info = g_malloc0(argsz);
+
+retry:
+    info->argsz = argsz;
+
+    if (ioctl(fd, VFIO_DEVICE_GET_INFO, info)) {
+        g_free(info);
+        return NULL;
+    }
+
+    if (info->argsz > argsz) {
+        argsz = info->argsz;
+        info = g_realloc(info, argsz);
+        goto retry;
+    }
+
+    return info;
+}
+
 int vfio_get_dev_region_info(VFIODevice *vbasedev, uint32_t type,
                              uint32_t subtype, struct vfio_region_info **info)
 {
diff --git a/hw/vfio/vfio-helpers.h b/hw/vfio/vfio-helpers.h
index 5d91e33d27..dbcb68bbb0 100644
--- a/hw/vfio/vfio-helpers.h
+++ b/hw/vfio/vfio-helpers.h
@@ -25,6 +25,7 @@ bool vfio_get_info_dma_avail(struct vfio_iommu_type1_info *info,
 #endif
 
 int vfio_bitmap_alloc(VFIOBitmap *vbmap, hwaddr size);
+struct vfio_device_info *vfio_get_device_info(int fd);
 
 int vfio_kvm_device_add_fd(int fd, Error **errp);
 int vfio_kvm_device_del_fd(int fd, Error **errp);
diff --git a/include/hw/vfio/vfio-common.h b/include/hw/vfio/vfio-common.h
index 442ec287d7..dca7a6a4b3 100644
--- a/include/hw/vfio/vfio-common.h
+++ b/include/hw/vfio/vfio-common.h
@@ -122,7 +122,6 @@ bool vfio_set_irq_signaling(VFIODevice *vbasedev, int index, int subindex,
                             int action, int fd, Error **errp);
 
 void vfio_reset_handler(void *opaque);
-struct vfio_device_info *vfio_get_device_info(int fd);
 bool vfio_device_is_mdev(VFIODevice *vbasedev);
 bool vfio_device_hiod_realize(VFIODevice *vbasedev, Error **errp);
 bool vfio_attach_device(char *name, VFIODevice *vbasedev,

From 68c07d76359589c9de2aa190d247afca7eb8cb8f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Wed, 26 Mar 2025 08:51:05 +0100
Subject: [PATCH 0270/2760] vfio: Introduce a new file for VFIODevice
 definitions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Move all VFIODevice related routines of "helpers.c" into a new "device.c"
file.

Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: John Levon <john.levon@nutanix.com>
Link: https://lore.kernel.org/qemu-devel/20250326075122.1299361-21-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/device.c     | 330 +++++++++++++++++++++++++++++++++++++++++++
 hw/vfio/helpers.c    | 303 ---------------------------------------
 hw/vfio/meson.build  |   1 +
 hw/vfio/trace-events |   4 +-
 4 files changed, 334 insertions(+), 304 deletions(-)
 create mode 100644 hw/vfio/device.c

diff --git a/hw/vfio/device.c b/hw/vfio/device.c
new file mode 100644
index 0000000000..21c6824430
--- /dev/null
+++ b/hw/vfio/device.c
@@ -0,0 +1,330 @@
+/*
+ * VFIO device
+ *
+ * Copyright Red Hat, Inc. 2012
+ *
+ * Authors:
+ *  Alex Williamson <alex.williamson@redhat.com>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2.  See
+ * the COPYING file in the top-level directory.
+ *
+ * Based on qemu-kvm device-assignment:
+ *  Adapted for KVM by Qumranet.
+ *  Copyright (c) 2007, Neocleus, Alex Novik (alex@neocleus.com)
+ *  Copyright (c) 2007, Neocleus, Guy Zana (guy@neocleus.com)
+ *  Copyright (C) 2008, Qumranet, Amit Shah (amit.shah@qumranet.com)
+ *  Copyright (C) 2008, Red Hat, Amit Shah (amit.shah@redhat.com)
+ *  Copyright (C) 2008, IBM, Muli Ben-Yehuda (muli@il.ibm.com)
+ */
+
+#include "qemu/osdep.h"
+#include <sys/ioctl.h>
+
+#include "hw/vfio/vfio-common.h"
+#include "hw/vfio/pci.h"
+#include "hw/hw.h"
+#include "trace.h"
+#include "qapi/error.h"
+#include "qemu/error-report.h"
+#include "qemu/units.h"
+#include "monitor/monitor.h"
+#include "vfio-helpers.h"
+
+/*
+ * Common VFIO interrupt disable
+ */
+void vfio_disable_irqindex(VFIODevice *vbasedev, int index)
+{
+    struct vfio_irq_set irq_set = {
+        .argsz = sizeof(irq_set),
+        .flags = VFIO_IRQ_SET_DATA_NONE | VFIO_IRQ_SET_ACTION_TRIGGER,
+        .index = index,
+        .start = 0,
+        .count = 0,
+    };
+
+    ioctl(vbasedev->fd, VFIO_DEVICE_SET_IRQS, &irq_set);
+}
+
+void vfio_unmask_single_irqindex(VFIODevice *vbasedev, int index)
+{
+    struct vfio_irq_set irq_set = {
+        .argsz = sizeof(irq_set),
+        .flags = VFIO_IRQ_SET_DATA_NONE | VFIO_IRQ_SET_ACTION_UNMASK,
+        .index = index,
+        .start = 0,
+        .count = 1,
+    };
+
+    ioctl(vbasedev->fd, VFIO_DEVICE_SET_IRQS, &irq_set);
+}
+
+void vfio_mask_single_irqindex(VFIODevice *vbasedev, int index)
+{
+    struct vfio_irq_set irq_set = {
+        .argsz = sizeof(irq_set),
+        .flags = VFIO_IRQ_SET_DATA_NONE | VFIO_IRQ_SET_ACTION_MASK,
+        .index = index,
+        .start = 0,
+        .count = 1,
+    };
+
+    ioctl(vbasedev->fd, VFIO_DEVICE_SET_IRQS, &irq_set);
+}
+
+static inline const char *action_to_str(int action)
+{
+    switch (action) {
+    case VFIO_IRQ_SET_ACTION_MASK:
+        return "MASK";
+    case VFIO_IRQ_SET_ACTION_UNMASK:
+        return "UNMASK";
+    case VFIO_IRQ_SET_ACTION_TRIGGER:
+        return "TRIGGER";
+    default:
+        return "UNKNOWN ACTION";
+    }
+}
+
+static const char *index_to_str(VFIODevice *vbasedev, int index)
+{
+    if (vbasedev->type != VFIO_DEVICE_TYPE_PCI) {
+        return NULL;
+    }
+
+    switch (index) {
+    case VFIO_PCI_INTX_IRQ_INDEX:
+        return "INTX";
+    case VFIO_PCI_MSI_IRQ_INDEX:
+        return "MSI";
+    case VFIO_PCI_MSIX_IRQ_INDEX:
+        return "MSIX";
+    case VFIO_PCI_ERR_IRQ_INDEX:
+        return "ERR";
+    case VFIO_PCI_REQ_IRQ_INDEX:
+        return "REQ";
+    default:
+        return NULL;
+    }
+}
+
+bool vfio_set_irq_signaling(VFIODevice *vbasedev, int index, int subindex,
+                            int action, int fd, Error **errp)
+{
+    ERRP_GUARD();
+    g_autofree struct vfio_irq_set *irq_set = NULL;
+    int argsz;
+    const char *name;
+    int32_t *pfd;
+
+    argsz = sizeof(*irq_set) + sizeof(*pfd);
+
+    irq_set = g_malloc0(argsz);
+    irq_set->argsz = argsz;
+    irq_set->flags = VFIO_IRQ_SET_DATA_EVENTFD | action;
+    irq_set->index = index;
+    irq_set->start = subindex;
+    irq_set->count = 1;
+    pfd = (int32_t *)&irq_set->data;
+    *pfd = fd;
+
+    if (!ioctl(vbasedev->fd, VFIO_DEVICE_SET_IRQS, irq_set)) {
+        return true;
+    }
+
+    error_setg_errno(errp, errno, "VFIO_DEVICE_SET_IRQS failure");
+
+    name = index_to_str(vbasedev, index);
+    if (name) {
+        error_prepend(errp, "%s-%d: ", name, subindex);
+    } else {
+        error_prepend(errp, "index %d-%d: ", index, subindex);
+    }
+    error_prepend(errp,
+                  "Failed to %s %s eventfd signaling for interrupt ",
+                  fd < 0 ? "tear down" : "set up", action_to_str(action));
+    return false;
+}
+
+int vfio_get_region_info(VFIODevice *vbasedev, int index,
+                         struct vfio_region_info **info)
+{
+    size_t argsz = sizeof(struct vfio_region_info);
+
+    *info = g_malloc0(argsz);
+
+    (*info)->index = index;
+retry:
+    (*info)->argsz = argsz;
+
+    if (ioctl(vbasedev->fd, VFIO_DEVICE_GET_REGION_INFO, *info)) {
+        g_free(*info);
+        *info = NULL;
+        return -errno;
+    }
+
+    if ((*info)->argsz > argsz) {
+        argsz = (*info)->argsz;
+        *info = g_realloc(*info, argsz);
+
+        goto retry;
+    }
+
+    return 0;
+}
+
+int vfio_get_dev_region_info(VFIODevice *vbasedev, uint32_t type,
+                             uint32_t subtype, struct vfio_region_info **info)
+{
+    int i;
+
+    for (i = 0; i < vbasedev->num_regions; i++) {
+        struct vfio_info_cap_header *hdr;
+        struct vfio_region_info_cap_type *cap_type;
+
+        if (vfio_get_region_info(vbasedev, i, info)) {
+            continue;
+        }
+
+        hdr = vfio_get_region_info_cap(*info, VFIO_REGION_INFO_CAP_TYPE);
+        if (!hdr) {
+            g_free(*info);
+            continue;
+        }
+
+        cap_type = container_of(hdr, struct vfio_region_info_cap_type, header);
+
+        trace_vfio_get_dev_region(vbasedev->name, i,
+                                  cap_type->type, cap_type->subtype);
+
+        if (cap_type->type == type && cap_type->subtype == subtype) {
+            return 0;
+        }
+
+        g_free(*info);
+    }
+
+    *info = NULL;
+    return -ENODEV;
+}
+
+bool vfio_has_region_cap(VFIODevice *vbasedev, int region, uint16_t cap_type)
+{
+    g_autofree struct vfio_region_info *info = NULL;
+    bool ret = false;
+
+    if (!vfio_get_region_info(vbasedev, region, &info)) {
+        if (vfio_get_region_info_cap(info, cap_type)) {
+            ret = true;
+        }
+    }
+
+    return ret;
+}
+
+bool vfio_device_get_name(VFIODevice *vbasedev, Error **errp)
+{
+    ERRP_GUARD();
+    struct stat st;
+
+    if (vbasedev->fd < 0) {
+        if (stat(vbasedev->sysfsdev, &st) < 0) {
+            error_setg_errno(errp, errno, "no such host device");
+            error_prepend(errp, VFIO_MSG_PREFIX, vbasedev->sysfsdev);
+            return false;
+        }
+        /* User may specify a name, e.g: VFIO platform device */
+        if (!vbasedev->name) {
+            vbasedev->name = g_path_get_basename(vbasedev->sysfsdev);
+        }
+    } else {
+        if (!vbasedev->iommufd) {
+            error_setg(errp, "Use FD passing only with iommufd backend");
+            return false;
+        }
+        /*
+         * Give a name with fd so any function printing out vbasedev->name
+         * will not break.
+         */
+        if (!vbasedev->name) {
+            vbasedev->name = g_strdup_printf("VFIO_FD%d", vbasedev->fd);
+        }
+    }
+
+    return true;
+}
+
+void vfio_device_set_fd(VFIODevice *vbasedev, const char *str, Error **errp)
+{
+    ERRP_GUARD();
+    int fd = monitor_fd_param(monitor_cur(), str, errp);
+
+    if (fd < 0) {
+        error_prepend(errp, "Could not parse remote object fd %s:", str);
+        return;
+    }
+    vbasedev->fd = fd;
+}
+
+void vfio_device_init(VFIODevice *vbasedev, int type, VFIODeviceOps *ops,
+                      DeviceState *dev, bool ram_discard)
+{
+    vbasedev->type = type;
+    vbasedev->ops = ops;
+    vbasedev->dev = dev;
+    vbasedev->fd = -1;
+
+    vbasedev->ram_block_discard_allowed = ram_discard;
+}
+
+int vfio_device_get_aw_bits(VFIODevice *vdev)
+{
+    /*
+     * iova_ranges is a sorted list. For old kernels that support
+     * VFIO but not support query of iova ranges, iova_ranges is NULL,
+     * in this case HOST_IOMMU_DEVICE_CAP_AW_BITS_MAX(64) is returned.
+     */
+    GList *l = g_list_last(vdev->bcontainer->iova_ranges);
+
+    if (l) {
+        Range *range = l->data;
+        return range_get_last_bit(range) + 1;
+    }
+
+    return HOST_IOMMU_DEVICE_CAP_AW_BITS_MAX;
+}
+
+bool vfio_device_is_mdev(VFIODevice *vbasedev)
+{
+    g_autofree char *subsys = NULL;
+    g_autofree char *tmp = NULL;
+
+    if (!vbasedev->sysfsdev) {
+        return false;
+    }
+
+    tmp = g_strdup_printf("%s/subsystem", vbasedev->sysfsdev);
+    subsys = realpath(tmp, NULL);
+    return subsys && (strcmp(subsys, "/sys/bus/mdev") == 0);
+}
+
+bool vfio_device_hiod_realize(VFIODevice *vbasedev, Error **errp)
+{
+    HostIOMMUDevice *hiod = vbasedev->hiod;
+
+    if (!hiod) {
+        return true;
+    }
+
+    return HOST_IOMMU_DEVICE_GET_CLASS(hiod)->realize(hiod, vbasedev, errp);
+}
+
+VFIODevice *vfio_get_vfio_device(Object *obj)
+{
+    if (object_dynamic_cast(obj, TYPE_VFIO_PCI)) {
+        return &VFIO_PCI(obj)->vbasedev;
+    } else {
+        return NULL;
+    }
+}
diff --git a/hw/vfio/helpers.c b/hw/vfio/helpers.c
index b7f75b47af..7ddc9797ef 100644
--- a/hw/vfio/helpers.c
+++ b/hw/vfio/helpers.c
@@ -24,131 +24,10 @@
 
 #include "system/kvm.h"
 #include "hw/vfio/vfio-common.h"
-#include "hw/vfio/pci.h"
 #include "hw/hw.h"
-#include "trace.h"
 #include "qapi/error.h"
-#include "qemu/error-report.h"
-#include "qemu/units.h"
-#include "monitor/monitor.h"
 #include "vfio-helpers.h"
 
-/*
- * Common VFIO interrupt disable
- */
-void vfio_disable_irqindex(VFIODevice *vbasedev, int index)
-{
-    struct vfio_irq_set irq_set = {
-        .argsz = sizeof(irq_set),
-        .flags = VFIO_IRQ_SET_DATA_NONE | VFIO_IRQ_SET_ACTION_TRIGGER,
-        .index = index,
-        .start = 0,
-        .count = 0,
-    };
-
-    ioctl(vbasedev->fd, VFIO_DEVICE_SET_IRQS, &irq_set);
-}
-
-void vfio_unmask_single_irqindex(VFIODevice *vbasedev, int index)
-{
-    struct vfio_irq_set irq_set = {
-        .argsz = sizeof(irq_set),
-        .flags = VFIO_IRQ_SET_DATA_NONE | VFIO_IRQ_SET_ACTION_UNMASK,
-        .index = index,
-        .start = 0,
-        .count = 1,
-    };
-
-    ioctl(vbasedev->fd, VFIO_DEVICE_SET_IRQS, &irq_set);
-}
-
-void vfio_mask_single_irqindex(VFIODevice *vbasedev, int index)
-{
-    struct vfio_irq_set irq_set = {
-        .argsz = sizeof(irq_set),
-        .flags = VFIO_IRQ_SET_DATA_NONE | VFIO_IRQ_SET_ACTION_MASK,
-        .index = index,
-        .start = 0,
-        .count = 1,
-    };
-
-    ioctl(vbasedev->fd, VFIO_DEVICE_SET_IRQS, &irq_set);
-}
-
-static inline const char *action_to_str(int action)
-{
-    switch (action) {
-    case VFIO_IRQ_SET_ACTION_MASK:
-        return "MASK";
-    case VFIO_IRQ_SET_ACTION_UNMASK:
-        return "UNMASK";
-    case VFIO_IRQ_SET_ACTION_TRIGGER:
-        return "TRIGGER";
-    default:
-        return "UNKNOWN ACTION";
-    }
-}
-
-static const char *index_to_str(VFIODevice *vbasedev, int index)
-{
-    if (vbasedev->type != VFIO_DEVICE_TYPE_PCI) {
-        return NULL;
-    }
-
-    switch (index) {
-    case VFIO_PCI_INTX_IRQ_INDEX:
-        return "INTX";
-    case VFIO_PCI_MSI_IRQ_INDEX:
-        return "MSI";
-    case VFIO_PCI_MSIX_IRQ_INDEX:
-        return "MSIX";
-    case VFIO_PCI_ERR_IRQ_INDEX:
-        return "ERR";
-    case VFIO_PCI_REQ_IRQ_INDEX:
-        return "REQ";
-    default:
-        return NULL;
-    }
-}
-
-bool vfio_set_irq_signaling(VFIODevice *vbasedev, int index, int subindex,
-                            int action, int fd, Error **errp)
-{
-    ERRP_GUARD();
-    g_autofree struct vfio_irq_set *irq_set = NULL;
-    int argsz;
-    const char *name;
-    int32_t *pfd;
-
-    argsz = sizeof(*irq_set) + sizeof(*pfd);
-
-    irq_set = g_malloc0(argsz);
-    irq_set->argsz = argsz;
-    irq_set->flags = VFIO_IRQ_SET_DATA_EVENTFD | action;
-    irq_set->index = index;
-    irq_set->start = subindex;
-    irq_set->count = 1;
-    pfd = (int32_t *)&irq_set->data;
-    *pfd = fd;
-
-    if (!ioctl(vbasedev->fd, VFIO_DEVICE_SET_IRQS, irq_set)) {
-        return true;
-    }
-
-    error_setg_errno(errp, errno, "VFIO_DEVICE_SET_IRQS failure");
-
-    name = index_to_str(vbasedev, index);
-    if (name) {
-        error_prepend(errp, "%s-%d: ", name, subindex);
-    } else {
-        error_prepend(errp, "index %d-%d: ", index, subindex);
-    }
-    error_prepend(errp,
-                  "Failed to %s %s eventfd signaling for interrupt ",
-                  fd < 0 ? "tear down" : "set up", action_to_str(action));
-    return false;
-}
-
 int vfio_bitmap_alloc(VFIOBitmap *vbmap, hwaddr size)
 {
     vbmap->pages = REAL_HOST_PAGE_ALIGN(size) / qemu_real_host_page_size();
@@ -196,33 +75,6 @@ vfio_get_device_info_cap(struct vfio_device_info *info, uint16_t id)
     return vfio_get_cap((void *)info, info->cap_offset, id);
 }
 
-int vfio_get_region_info(VFIODevice *vbasedev, int index,
-                         struct vfio_region_info **info)
-{
-    size_t argsz = sizeof(struct vfio_region_info);
-
-    *info = g_malloc0(argsz);
-
-    (*info)->index = index;
-retry:
-    (*info)->argsz = argsz;
-
-    if (ioctl(vbasedev->fd, VFIO_DEVICE_GET_REGION_INFO, *info)) {
-        g_free(*info);
-        *info = NULL;
-        return -errno;
-    }
-
-    if ((*info)->argsz > argsz) {
-        argsz = (*info)->argsz;
-        *info = g_realloc(*info, argsz);
-
-        goto retry;
-    }
-
-    return 0;
-}
-
 struct vfio_info_cap_header *
 vfio_get_iommu_type1_info_cap(struct vfio_iommu_type1_info *info, uint16_t id)
 {
@@ -335,158 +187,3 @@ retry:
 
     return info;
 }
-
-int vfio_get_dev_region_info(VFIODevice *vbasedev, uint32_t type,
-                             uint32_t subtype, struct vfio_region_info **info)
-{
-    int i;
-
-    for (i = 0; i < vbasedev->num_regions; i++) {
-        struct vfio_info_cap_header *hdr;
-        struct vfio_region_info_cap_type *cap_type;
-
-        if (vfio_get_region_info(vbasedev, i, info)) {
-            continue;
-        }
-
-        hdr = vfio_get_region_info_cap(*info, VFIO_REGION_INFO_CAP_TYPE);
-        if (!hdr) {
-            g_free(*info);
-            continue;
-        }
-
-        cap_type = container_of(hdr, struct vfio_region_info_cap_type, header);
-
-        trace_vfio_get_dev_region(vbasedev->name, i,
-                                  cap_type->type, cap_type->subtype);
-
-        if (cap_type->type == type && cap_type->subtype == subtype) {
-            return 0;
-        }
-
-        g_free(*info);
-    }
-
-    *info = NULL;
-    return -ENODEV;
-}
-
-bool vfio_has_region_cap(VFIODevice *vbasedev, int region, uint16_t cap_type)
-{
-    g_autofree struct vfio_region_info *info = NULL;
-    bool ret = false;
-
-    if (!vfio_get_region_info(vbasedev, region, &info)) {
-        if (vfio_get_region_info_cap(info, cap_type)) {
-            ret = true;
-        }
-    }
-
-    return ret;
-}
-
-bool vfio_device_get_name(VFIODevice *vbasedev, Error **errp)
-{
-    ERRP_GUARD();
-    struct stat st;
-
-    if (vbasedev->fd < 0) {
-        if (stat(vbasedev->sysfsdev, &st) < 0) {
-            error_setg_errno(errp, errno, "no such host device");
-            error_prepend(errp, VFIO_MSG_PREFIX, vbasedev->sysfsdev);
-            return false;
-        }
-        /* User may specify a name, e.g: VFIO platform device */
-        if (!vbasedev->name) {
-            vbasedev->name = g_path_get_basename(vbasedev->sysfsdev);
-        }
-    } else {
-        if (!vbasedev->iommufd) {
-            error_setg(errp, "Use FD passing only with iommufd backend");
-            return false;
-        }
-        /*
-         * Give a name with fd so any function printing out vbasedev->name
-         * will not break.
-         */
-        if (!vbasedev->name) {
-            vbasedev->name = g_strdup_printf("VFIO_FD%d", vbasedev->fd);
-        }
-    }
-
-    return true;
-}
-
-void vfio_device_set_fd(VFIODevice *vbasedev, const char *str, Error **errp)
-{
-    ERRP_GUARD();
-    int fd = monitor_fd_param(monitor_cur(), str, errp);
-
-    if (fd < 0) {
-        error_prepend(errp, "Could not parse remote object fd %s:", str);
-        return;
-    }
-    vbasedev->fd = fd;
-}
-
-void vfio_device_init(VFIODevice *vbasedev, int type, VFIODeviceOps *ops,
-                      DeviceState *dev, bool ram_discard)
-{
-    vbasedev->type = type;
-    vbasedev->ops = ops;
-    vbasedev->dev = dev;
-    vbasedev->fd = -1;
-
-    vbasedev->ram_block_discard_allowed = ram_discard;
-}
-
-int vfio_device_get_aw_bits(VFIODevice *vdev)
-{
-    /*
-     * iova_ranges is a sorted list. For old kernels that support
-     * VFIO but not support query of iova ranges, iova_ranges is NULL,
-     * in this case HOST_IOMMU_DEVICE_CAP_AW_BITS_MAX(64) is returned.
-     */
-    GList *l = g_list_last(vdev->bcontainer->iova_ranges);
-
-    if (l) {
-        Range *range = l->data;
-        return range_get_last_bit(range) + 1;
-    }
-
-    return HOST_IOMMU_DEVICE_CAP_AW_BITS_MAX;
-}
-
-bool vfio_device_is_mdev(VFIODevice *vbasedev)
-{
-    g_autofree char *subsys = NULL;
-    g_autofree char *tmp = NULL;
-
-    if (!vbasedev->sysfsdev) {
-        return false;
-    }
-
-    tmp = g_strdup_printf("%s/subsystem", vbasedev->sysfsdev);
-    subsys = realpath(tmp, NULL);
-    return subsys && (strcmp(subsys, "/sys/bus/mdev") == 0);
-}
-
-bool vfio_device_hiod_realize(VFIODevice *vbasedev, Error **errp)
-{
-    HostIOMMUDevice *hiod = vbasedev->hiod;
-
-    if (!hiod) {
-        return true;
-    }
-
-    return HOST_IOMMU_DEVICE_GET_CLASS(hiod)->realize(hiod, vbasedev, errp);
-}
-
-VFIODevice *vfio_get_vfio_device(Object *obj)
-{
-    if (object_dynamic_cast(obj, TYPE_VFIO_PCI)) {
-        return &VFIO_PCI(obj)->vbasedev;
-    } else {
-        return NULL;
-    }
-}
diff --git a/hw/vfio/meson.build b/hw/vfio/meson.build
index 21795b3d19..60caa36617 100644
--- a/hw/vfio/meson.build
+++ b/hw/vfio/meson.build
@@ -20,6 +20,7 @@ system_ss.add(when: 'CONFIG_VFIO_XGMAC', if_true: files('calxeda-xgmac.c'))
 system_ss.add(when: 'CONFIG_VFIO_AMD_XGBE', if_true: files('amd-xgbe.c'))
 system_ss.add(when: 'CONFIG_VFIO', if_true: files(
   'container-base.c',
+  'device.c',
   'migration.c',
   'migration-multifd.c',
   'cpr.c',
diff --git a/hw/vfio/trace-events b/hw/vfio/trace-events
index 81f4130100..590d9674cf 100644
--- a/hw/vfio/trace-events
+++ b/hw/vfio/trace-events
@@ -105,7 +105,6 @@ vfio_disconnect_container(int fd) "close container->fd=%d"
 vfio_put_group(int fd) "close group->fd=%d"
 vfio_get_device(const char * name, unsigned int flags, unsigned int num_regions, unsigned int num_irqs) "Device %s flags: %u, regions: %u, irqs: %u"
 vfio_put_base_device(int fd) "close vdev->fd=%d"
-vfio_get_dev_region(const char *name, int index, uint32_t type, uint32_t subtype) "%s index %d, %08x/%08x"
 vfio_legacy_dma_unmap_overflow_workaround(void) ""
 vfio_get_dirty_bitmap(uint64_t iova, uint64_t size, uint64_t bitmap_size, uint64_t start, uint64_t dirty_pages) "iova=0x%"PRIx64" size= 0x%"PRIx64" bitmap_size=0x%"PRIx64" start=0x%"PRIx64" dirty_pages=%"PRIu64
 vfio_iommu_map_dirty_notify(uint64_t iova_start, uint64_t iova_end) "iommu dirty @ 0x%"PRIx64" - 0x%"PRIx64
@@ -194,3 +193,6 @@ iommufd_cdev_fail_attach_existing_container(const char *msg) " %s"
 iommufd_cdev_alloc_ioas(int iommufd, int ioas_id) " [iommufd=%d] new IOMMUFD container with ioasid=%d"
 iommufd_cdev_device_info(char *name, int devfd, int num_irqs, int num_regions, int flags) " %s (%d) num_irqs=%d num_regions=%d flags=%d"
 iommufd_cdev_pci_hot_reset_dep_devices(int domain, int bus, int slot, int function, int dev_id) "\t%04x:%02x:%02x.%x devid %d"
+
+# device.c
+vfio_get_dev_region(const char *name, int index, uint32_t type, uint32_t subtype) "%s index %d, %08x/%08x"

From 8140d45b108c2b48960bbfb0a215f586f2d1d9e5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Wed, 26 Mar 2025 08:51:06 +0100
Subject: [PATCH 0271/2760] vfio: Introduce new files for CPR definitions and
 declarations
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Gather all CPR related declarations into "vfio-cpr.h" to reduce exposure
of VFIO internals in "hw/vfio/vfio-common.h". These were introduced in
commit d9fa4223b30a ("vfio: register container for cpr").

Order file list in meson.build while at it.

Cc: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Steve Sistare <steven.sistare@oracle.com>
Link: https://lore.kernel.org/qemu-devel/20250326075122.1299361-22-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/container.c           |  1 +
 hw/vfio/cpr.c                 |  1 +
 hw/vfio/iommufd.c             |  1 +
 hw/vfio/meson.build           |  2 +-
 hw/vfio/vfio-cpr.h            | 15 +++++++++++++++
 include/hw/vfio/vfio-common.h |  3 ---
 6 files changed, 19 insertions(+), 4 deletions(-)
 create mode 100644 hw/vfio/vfio-cpr.h

diff --git a/hw/vfio/container.c b/hw/vfio/container.c
index 3fdd5dac37..c55fe8e4be 100644
--- a/hw/vfio/container.c
+++ b/hw/vfio/container.c
@@ -34,6 +34,7 @@
 #include "pci.h"
 #include "hw/vfio/vfio-container.h"
 #include "vfio-helpers.h"
+#include "vfio-cpr.h"
 
 #define TYPE_HOST_IOMMU_DEVICE_LEGACY_VFIO TYPE_HOST_IOMMU_DEVICE "-legacy-vfio"
 
diff --git a/hw/vfio/cpr.c b/hw/vfio/cpr.c
index 3d1c8d290a..696987006b 100644
--- a/hw/vfio/cpr.c
+++ b/hw/vfio/cpr.c
@@ -10,6 +10,7 @@
 #include "migration/misc.h"
 #include "qapi/error.h"
 #include "system/runstate.h"
+#include "vfio-cpr.h"
 
 static int vfio_cpr_reboot_notifier(NotifierWithReturn *notifier,
                                     MigrationEvent *e, Error **errp)
diff --git a/hw/vfio/iommufd.c b/hw/vfio/iommufd.c
index 85b5a8146a..a5bd189a86 100644
--- a/hw/vfio/iommufd.c
+++ b/hw/vfio/iommufd.c
@@ -27,6 +27,7 @@
 #include "pci.h"
 #include "vfio-iommufd.h"
 #include "vfio-helpers.h"
+#include "vfio-cpr.h"
 
 #define TYPE_HOST_IOMMU_DEVICE_IOMMUFD_VFIO             \
             TYPE_HOST_IOMMU_DEVICE_IOMMUFD "-vfio"
diff --git a/hw/vfio/meson.build b/hw/vfio/meson.build
index 60caa36617..1f89bd28c1 100644
--- a/hw/vfio/meson.build
+++ b/hw/vfio/meson.build
@@ -20,10 +20,10 @@ system_ss.add(when: 'CONFIG_VFIO_XGMAC', if_true: files('calxeda-xgmac.c'))
 system_ss.add(when: 'CONFIG_VFIO_AMD_XGBE', if_true: files('amd-xgbe.c'))
 system_ss.add(when: 'CONFIG_VFIO', if_true: files(
   'container-base.c',
+  'cpr.c',
   'device.c',
   'migration.c',
   'migration-multifd.c',
-  'cpr.c',
   'region.c',
 ))
 system_ss.add(when: ['CONFIG_VFIO', 'CONFIG_IOMMUFD'], if_true: files(
diff --git a/hw/vfio/vfio-cpr.h b/hw/vfio/vfio-cpr.h
new file mode 100644
index 0000000000..134b83a624
--- /dev/null
+++ b/hw/vfio/vfio-cpr.h
@@ -0,0 +1,15 @@
+/*
+ * VFIO CPR
+ *
+ * Copyright (c) 2025 Oracle and/or its affiliates.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef HW_VFIO_CPR_H
+#define HW_VFIO_CPR_H
+
+bool vfio_cpr_register_container(VFIOContainerBase *bcontainer, Error **errp);
+void vfio_cpr_unregister_container(VFIOContainerBase *bcontainer);
+
+#endif /* HW_VFIO_CPR_H */
diff --git a/include/hw/vfio/vfio-common.h b/include/hw/vfio/vfio-common.h
index dca7a6a4b3..2065c2f9e4 100644
--- a/include/hw/vfio/vfio-common.h
+++ b/include/hw/vfio/vfio-common.h
@@ -129,9 +129,6 @@ bool vfio_attach_device(char *name, VFIODevice *vbasedev,
 void vfio_detach_device(VFIODevice *vbasedev);
 VFIODevice *vfio_get_vfio_device(Object *obj);
 
-bool vfio_cpr_register_container(VFIOContainerBase *bcontainer, Error **errp);
-void vfio_cpr_unregister_container(VFIOContainerBase *bcontainer);
-
 typedef QLIST_HEAD(VFIODeviceList, VFIODevice) VFIODeviceList;
 extern VFIODeviceList vfio_device_list;
 extern const MemoryListener vfio_memory_listener;

From c3fbdba15a8b3d80c1f5e6026e636030b3692437 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Wed, 26 Mar 2025 08:51:07 +0100
Subject: [PATCH 0272/2760] vfio: Move vfio_kvm_device_fd() into helpers.c
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The vfio_kvm_device_add/del_fd() routines opening the VFIO pseudo
device are defined in "helpers.c". Move 'vfio_kvm_device_fd'
definition there and its declaration into "vfio-helpers.h" to reduce
exposure of VFIO internals in "hw/vfio/vfio-common.h".

Reviewed-by: John Levon <john.levon@nutanix.com>
Link: https://lore.kernel.org/qemu-devel/20250318095415.670319-22-clg@redhat.com
Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Link: https://lore.kernel.org/qemu-devel/20250326075122.1299361-23-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/common.c              | 11 -----------
 hw/vfio/helpers.c             | 11 +++++++++++
 hw/vfio/spapr.c               |  2 +-
 hw/vfio/vfio-helpers.h        |  2 ++
 include/hw/vfio/vfio-common.h |  1 -
 5 files changed, 14 insertions(+), 13 deletions(-)

diff --git a/hw/vfio/common.c b/hw/vfio/common.c
index f80c0ef229..84a9a37d9d 100644
--- a/hw/vfio/common.c
+++ b/hw/vfio/common.c
@@ -49,17 +49,6 @@
 VFIODeviceList vfio_device_list =
     QLIST_HEAD_INITIALIZER(vfio_device_list);
 
-#ifdef CONFIG_KVM
-/*
- * We have a single VFIO pseudo device per KVM VM.  Once created it lives
- * for the life of the VM.  Closing the file descriptor only drops our
- * reference to it and the device's reference to kvm.  Therefore once
- * initialized, this file descriptor is only released on QEMU exit and
- * we'll re-use it should another vfio device be attached before then.
- */
-int vfio_kvm_device_fd = -1;
-#endif
-
 /*
  * Device state interfaces
  */
diff --git a/hw/vfio/helpers.c b/hw/vfio/helpers.c
index 7ddc9797ef..48bd61d528 100644
--- a/hw/vfio/helpers.c
+++ b/hw/vfio/helpers.c
@@ -106,6 +106,17 @@ bool vfio_get_info_dma_avail(struct vfio_iommu_type1_info *info,
     return true;
 }
 
+#ifdef CONFIG_KVM
+/*
+ * We have a single VFIO pseudo device per KVM VM.  Once created it lives
+ * for the life of the VM.  Closing the file descriptor only drops our
+ * reference to it and the device's reference to kvm.  Therefore once
+ * initialized, this file descriptor is only released on QEMU exit and
+ * we'll re-use it should another vfio device be attached before then.
+ */
+int vfio_kvm_device_fd = -1;
+#endif
+
 int vfio_kvm_device_add_fd(int fd, Error **errp)
 {
 #ifdef CONFIG_KVM
diff --git a/hw/vfio/spapr.c b/hw/vfio/spapr.c
index 31e4dddc9e..95ccbad418 100644
--- a/hw/vfio/spapr.c
+++ b/hw/vfio/spapr.c
@@ -15,13 +15,13 @@
 #include "system/hostmem.h"
 #include "system/address-spaces.h"
 
-#include "hw/vfio/vfio-common.h"
 #include "hw/vfio/vfio-container.h"
 #include "hw/hw.h"
 #include "system/ram_addr.h"
 #include "qemu/error-report.h"
 #include "qapi/error.h"
 #include "trace.h"
+#include "vfio-helpers.h"
 
 typedef struct VFIOHostDMAWindow {
     hwaddr min_iova;
diff --git a/hw/vfio/vfio-helpers.h b/hw/vfio/vfio-helpers.h
index dbcb68bbb0..54a327ffbc 100644
--- a/hw/vfio/vfio-helpers.h
+++ b/hw/vfio/vfio-helpers.h
@@ -12,6 +12,8 @@
 #ifdef CONFIG_LINUX
 #include <linux/vfio.h>
 
+extern int vfio_kvm_device_fd;
+
 struct vfio_info_cap_header *
 vfio_get_cap(void *ptr, uint32_t cap_offset, uint16_t id);
 struct vfio_info_cap_header *
diff --git a/include/hw/vfio/vfio-common.h b/include/hw/vfio/vfio-common.h
index 2065c2f9e4..06178cf282 100644
--- a/include/hw/vfio/vfio-common.h
+++ b/include/hw/vfio/vfio-common.h
@@ -132,7 +132,6 @@ VFIODevice *vfio_get_vfio_device(Object *obj);
 typedef QLIST_HEAD(VFIODeviceList, VFIODevice) VFIODeviceList;
 extern VFIODeviceList vfio_device_list;
 extern const MemoryListener vfio_memory_listener;
-extern int vfio_kvm_device_fd;
 
 #ifdef CONFIG_LINUX
 int vfio_get_region_info(VFIODevice *vbasedev, int index,

From a997b506e715d96549869e2d0fca28a1a9f110dc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Wed, 26 Mar 2025 08:51:08 +0100
Subject: [PATCH 0273/2760] vfio: Move vfio_device_list into device.c
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

'vfio_device_list' is VFIODevice related. Move its definitions into
"device.c".

Reviewed-by: John Levon <john.levon@nutanix.com>
Link: https://lore.kernel.org/qemu-devel/20250318095415.670319-23-clg@redhat.com
Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Link: https://lore.kernel.org/qemu-devel/20250326075122.1299361-24-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/common.c | 3 ---
 hw/vfio/device.c | 3 +++
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/hw/vfio/common.c b/hw/vfio/common.c
index 84a9a37d9d..4e7d8e83ac 100644
--- a/hw/vfio/common.c
+++ b/hw/vfio/common.c
@@ -46,9 +46,6 @@
 #include "vfio-migration-internal.h"
 #include "vfio-helpers.h"
 
-VFIODeviceList vfio_device_list =
-    QLIST_HEAD_INITIALIZER(vfio_device_list);
-
 /*
  * Device state interfaces
  */
diff --git a/hw/vfio/device.c b/hw/vfio/device.c
index 21c6824430..25fdba10a8 100644
--- a/hw/vfio/device.c
+++ b/hw/vfio/device.c
@@ -31,6 +31,9 @@
 #include "monitor/monitor.h"
 #include "vfio-helpers.h"
 
+VFIODeviceList vfio_device_list =
+    QLIST_HEAD_INITIALIZER(vfio_device_list);
+
 /*
  * Common VFIO interrupt disable
  */

From 923b11411e0e68b460f6fd8e6a7f8ff11554e48c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Wed, 26 Mar 2025 08:51:09 +0100
Subject: [PATCH 0274/2760] vfio: Move vfio_de/attach_device() into device.c
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

These routines are VFIODevice related. Move their definitions into
"device.c".

Reviewed-by: John Levon <john.levon@nutanix.com>
Link: https://lore.kernel.org/qemu-devel/20250318095415.670319-24-clg@redhat.com
Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Link: https://lore.kernel.org/qemu-devel/20250326075122.1299361-25-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/common.c | 37 -------------------------------------
 hw/vfio/device.c | 37 +++++++++++++++++++++++++++++++++++++
 2 files changed, 37 insertions(+), 37 deletions(-)

diff --git a/hw/vfio/common.c b/hw/vfio/common.c
index 4e7d8e83ac..a85ed36409 100644
--- a/hw/vfio/common.c
+++ b/hw/vfio/common.c
@@ -1318,40 +1318,3 @@ void vfio_reset_handler(void *opaque)
         }
     }
 }
-
-bool vfio_attach_device(char *name, VFIODevice *vbasedev,
-                        AddressSpace *as, Error **errp)
-{
-    const VFIOIOMMUClass *ops =
-        VFIO_IOMMU_CLASS(object_class_by_name(TYPE_VFIO_IOMMU_LEGACY));
-    HostIOMMUDevice *hiod = NULL;
-
-    if (vbasedev->iommufd) {
-        ops = VFIO_IOMMU_CLASS(object_class_by_name(TYPE_VFIO_IOMMU_IOMMUFD));
-    }
-
-    assert(ops);
-
-
-    if (!vbasedev->mdev) {
-        hiod = HOST_IOMMU_DEVICE(object_new(ops->hiod_typename));
-        vbasedev->hiod = hiod;
-    }
-
-    if (!ops->attach_device(name, vbasedev, as, errp)) {
-        object_unref(hiod);
-        vbasedev->hiod = NULL;
-        return false;
-    }
-
-    return true;
-}
-
-void vfio_detach_device(VFIODevice *vbasedev)
-{
-    if (!vbasedev->bcontainer) {
-        return;
-    }
-    object_unref(vbasedev->hiod);
-    VFIO_IOMMU_GET_CLASS(vbasedev->bcontainer)->detach_device(vbasedev);
-}
diff --git a/hw/vfio/device.c b/hw/vfio/device.c
index 25fdba10a8..179c9fb8de 100644
--- a/hw/vfio/device.c
+++ b/hw/vfio/device.c
@@ -331,3 +331,40 @@ VFIODevice *vfio_get_vfio_device(Object *obj)
         return NULL;
     }
 }
+
+bool vfio_attach_device(char *name, VFIODevice *vbasedev,
+                        AddressSpace *as, Error **errp)
+{
+    const VFIOIOMMUClass *ops =
+        VFIO_IOMMU_CLASS(object_class_by_name(TYPE_VFIO_IOMMU_LEGACY));
+    HostIOMMUDevice *hiod = NULL;
+
+    if (vbasedev->iommufd) {
+        ops = VFIO_IOMMU_CLASS(object_class_by_name(TYPE_VFIO_IOMMU_IOMMUFD));
+    }
+
+    assert(ops);
+
+
+    if (!vbasedev->mdev) {
+        hiod = HOST_IOMMU_DEVICE(object_new(ops->hiod_typename));
+        vbasedev->hiod = hiod;
+    }
+
+    if (!ops->attach_device(name, vbasedev, as, errp)) {
+        object_unref(hiod);
+        vbasedev->hiod = NULL;
+        return false;
+    }
+
+    return true;
+}
+
+void vfio_detach_device(VFIODevice *vbasedev)
+{
+    if (!vbasedev->bcontainer) {
+        return;
+    }
+    object_unref(vbasedev->hiod);
+    VFIO_IOMMU_GET_CLASS(vbasedev->bcontainer)->detach_device(vbasedev);
+}

From 819a5865c0524c4bfcf1906955c9d15952fdbcc7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Wed, 26 Mar 2025 08:51:10 +0100
Subject: [PATCH 0275/2760] vfio: Move vfio_reset_handler() into device.c
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Pass-through devices of a VM are not necessarily in the same group and
all groups/address_spaces need to be scanned when the machine is
reset. Commit f16f39c3fc97 ("Implement PCI hot reset") introduced a VM
reset handler for this purpose. Move it under device.c

Also reintroduce the comment which explained the context and was lost
along the way.

Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: John Levon <john.levon@nutanix.com>
Link: https://lore.kernel.org/qemu-devel/20250326075122.1299361-26-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/common.c     | 18 ------------------
 hw/vfio/device.c     | 35 +++++++++++++++++++++++++++++++++++
 hw/vfio/trace-events |  2 +-
 3 files changed, 36 insertions(+), 19 deletions(-)

diff --git a/hw/vfio/common.c b/hw/vfio/common.c
index a85ed36409..45ac8b7d8b 100644
--- a/hw/vfio/common.c
+++ b/hw/vfio/common.c
@@ -1300,21 +1300,3 @@ const MemoryListener vfio_memory_listener = {
     .log_global_stop = vfio_listener_log_global_stop,
     .log_sync = vfio_listener_log_sync,
 };
-
-void vfio_reset_handler(void *opaque)
-{
-    VFIODevice *vbasedev;
-
-    trace_vfio_reset_handler();
-    QLIST_FOREACH(vbasedev, &vfio_device_list, global_next) {
-        if (vbasedev->dev->realized) {
-            vbasedev->ops->vfio_compute_needs_reset(vbasedev);
-        }
-    }
-
-    QLIST_FOREACH(vbasedev, &vfio_device_list, global_next) {
-        if (vbasedev->dev->realized && vbasedev->needs_reset) {
-            vbasedev->ops->vfio_hot_reset_multi(vbasedev);
-        }
-    }
-}
diff --git a/hw/vfio/device.c b/hw/vfio/device.c
index 179c9fb8de..e122c797c2 100644
--- a/hw/vfio/device.c
+++ b/hw/vfio/device.c
@@ -34,6 +34,41 @@
 VFIODeviceList vfio_device_list =
     QLIST_HEAD_INITIALIZER(vfio_device_list);
 
+/*
+ * We want to differentiate hot reset of multiple in-use devices vs
+ * hot reset of a single in-use device. VFIO_DEVICE_RESET will already
+ * handle the case of doing hot resets when there is only a single
+ * device per bus. The in-use here refers to how many VFIODevices are
+ * affected. A hot reset that affects multiple devices, but only a
+ * single in-use device, means that we can call it from our bus
+ * ->reset() callback since the extent is effectively a single
+ * device. This allows us to make use of it in the hotplug path. When
+ * there are multiple in-use devices, we can only trigger the hot
+ * reset during a system reset and thus from our reset handler. We
+ * separate _one vs _multi here so that we don't overlap and do a
+ * double reset on the system reset path where both our reset handler
+ * and ->reset() callback are used. Calling _one() will only do a hot
+ * reset for the one in-use devices case, calling _multi() will do
+ * nothing if a _one() would have been sufficient.
+ */
+void vfio_reset_handler(void *opaque)
+{
+    VFIODevice *vbasedev;
+
+    trace_vfio_reset_handler();
+    QLIST_FOREACH(vbasedev, &vfio_device_list, global_next) {
+        if (vbasedev->dev->realized) {
+            vbasedev->ops->vfio_compute_needs_reset(vbasedev);
+        }
+    }
+
+    QLIST_FOREACH(vbasedev, &vfio_device_list, global_next) {
+        if (vbasedev->dev->realized && vbasedev->needs_reset) {
+            vbasedev->ops->vfio_hot_reset_multi(vbasedev);
+        }
+    }
+}
+
 /*
  * Common VFIO interrupt disable
  */
diff --git a/hw/vfio/trace-events b/hw/vfio/trace-events
index 590d9674cf..9fee7df876 100644
--- a/hw/vfio/trace-events
+++ b/hw/vfio/trace-events
@@ -108,7 +108,6 @@ vfio_put_base_device(int fd) "close vdev->fd=%d"
 vfio_legacy_dma_unmap_overflow_workaround(void) ""
 vfio_get_dirty_bitmap(uint64_t iova, uint64_t size, uint64_t bitmap_size, uint64_t start, uint64_t dirty_pages) "iova=0x%"PRIx64" size= 0x%"PRIx64" bitmap_size=0x%"PRIx64" start=0x%"PRIx64" dirty_pages=%"PRIu64
 vfio_iommu_map_dirty_notify(uint64_t iova_start, uint64_t iova_end) "iommu dirty @ 0x%"PRIx64" - 0x%"PRIx64
-vfio_reset_handler(void) ""
 
 # region.c
 vfio_region_write(const char *name, int index, uint64_t addr, uint64_t data, unsigned size) " (%s:region%d+0x%"PRIx64", 0x%"PRIx64 ", %d)"
@@ -196,3 +195,4 @@ iommufd_cdev_pci_hot_reset_dep_devices(int domain, int bus, int slot, int functi
 
 # device.c
 vfio_get_dev_region(const char *name, int index, uint32_t type, uint32_t subtype) "%s index %d, %08x/%08x"
+vfio_reset_handler(void) ""

From 6b7c812972a697c412f81497999af267e0c6333a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Wed, 26 Mar 2025 08:51:11 +0100
Subject: [PATCH 0276/2760] vfio: Move dirty tracking related services into
 container-base.c
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Routines of common.c :

 vfio_devices_all_dirty_tracking_started
 vfio_devices_all_device_dirty_tracking
 vfio_devices_query_dirty_bitmap
 vfio_get_dirty_bitmap

are all related to dirty page tracking directly at the container level
or at the container device level. Naming is a bit confusing. We will
propose new names in the following changes.

Reviewed-by: Joao Martins <joao.m.martins@oracle.com>
Reviewed-by: Avihai Horon <avihaih@nvidia.com>
Link: https://lore.kernel.org/qemu-devel/20250326075122.1299361-27-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/common.c                      | 130 ------------------------
 hw/vfio/container-base.c              | 138 ++++++++++++++++++++++++++
 hw/vfio/meson.build                   |   2 +-
 hw/vfio/trace-events                  |   4 +-
 include/hw/vfio/vfio-common.h         |   9 --
 include/hw/vfio/vfio-container-base.h |   7 ++
 6 files changed, 149 insertions(+), 141 deletions(-)

diff --git a/hw/vfio/common.c b/hw/vfio/common.c
index 45ac8b7d8b..ed49ef88a8 100644
--- a/hw/vfio/common.c
+++ b/hw/vfio/common.c
@@ -51,27 +51,6 @@
  */
 
 
-static bool vfio_devices_all_device_dirty_tracking_started(
-    const VFIOContainerBase *bcontainer)
-{
-    VFIODevice *vbasedev;
-
-    QLIST_FOREACH(vbasedev, &bcontainer->device_list, container_next) {
-        if (!vbasedev->dirty_tracking) {
-            return false;
-        }
-    }
-
-    return true;
-}
-
-bool vfio_devices_all_dirty_tracking_started(
-    const VFIOContainerBase *bcontainer)
-{
-    return vfio_devices_all_device_dirty_tracking_started(bcontainer) ||
-           bcontainer->dirty_pages_started;
-}
-
 static bool vfio_log_sync_needed(const VFIOContainerBase *bcontainer)
 {
     VFIODevice *vbasedev;
@@ -96,22 +75,6 @@ static bool vfio_log_sync_needed(const VFIOContainerBase *bcontainer)
     return true;
 }
 
-bool vfio_devices_all_device_dirty_tracking(const VFIOContainerBase *bcontainer)
-{
-    VFIODevice *vbasedev;
-
-    QLIST_FOREACH(vbasedev, &bcontainer->device_list, container_next) {
-        if (vbasedev->device_dirty_page_tracking == ON_OFF_AUTO_OFF) {
-            return false;
-        }
-        if (!vbasedev->dirty_pages_supported) {
-            return false;
-        }
-    }
-
-    return true;
-}
-
 static bool vfio_listener_skipped_section(MemoryRegionSection *section)
 {
     return (!memory_region_is_ram(section->mr) &&
@@ -1009,99 +972,6 @@ static void vfio_listener_log_global_stop(MemoryListener *listener)
     }
 }
 
-static int vfio_device_dma_logging_report(VFIODevice *vbasedev, hwaddr iova,
-                                          hwaddr size, void *bitmap)
-{
-    uint64_t buf[DIV_ROUND_UP(sizeof(struct vfio_device_feature) +
-                        sizeof(struct vfio_device_feature_dma_logging_report),
-                        sizeof(uint64_t))] = {};
-    struct vfio_device_feature *feature = (struct vfio_device_feature *)buf;
-    struct vfio_device_feature_dma_logging_report *report =
-        (struct vfio_device_feature_dma_logging_report *)feature->data;
-
-    report->iova = iova;
-    report->length = size;
-    report->page_size = qemu_real_host_page_size();
-    report->bitmap = (uintptr_t)bitmap;
-
-    feature->argsz = sizeof(buf);
-    feature->flags = VFIO_DEVICE_FEATURE_GET |
-                     VFIO_DEVICE_FEATURE_DMA_LOGGING_REPORT;
-
-    if (ioctl(vbasedev->fd, VFIO_DEVICE_FEATURE, feature)) {
-        return -errno;
-    }
-
-    return 0;
-}
-
-int vfio_devices_query_dirty_bitmap(const VFIOContainerBase *bcontainer,
-                 VFIOBitmap *vbmap, hwaddr iova, hwaddr size, Error **errp)
-{
-    VFIODevice *vbasedev;
-    int ret;
-
-    QLIST_FOREACH(vbasedev, &bcontainer->device_list, container_next) {
-        ret = vfio_device_dma_logging_report(vbasedev, iova, size,
-                                             vbmap->bitmap);
-        if (ret) {
-            error_setg_errno(errp, -ret,
-                             "%s: Failed to get DMA logging report, iova: "
-                             "0x%" HWADDR_PRIx ", size: 0x%" HWADDR_PRIx,
-                             vbasedev->name, iova, size);
-
-            return ret;
-        }
-    }
-
-    return 0;
-}
-
-int vfio_get_dirty_bitmap(const VFIOContainerBase *bcontainer, uint64_t iova,
-                          uint64_t size, ram_addr_t ram_addr, Error **errp)
-{
-    bool all_device_dirty_tracking =
-        vfio_devices_all_device_dirty_tracking(bcontainer);
-    uint64_t dirty_pages;
-    VFIOBitmap vbmap;
-    int ret;
-
-    if (!bcontainer->dirty_pages_supported && !all_device_dirty_tracking) {
-        cpu_physical_memory_set_dirty_range(ram_addr, size,
-                                            tcg_enabled() ? DIRTY_CLIENTS_ALL :
-                                            DIRTY_CLIENTS_NOCODE);
-        return 0;
-    }
-
-    ret = vfio_bitmap_alloc(&vbmap, size);
-    if (ret) {
-        error_setg_errno(errp, -ret,
-                         "Failed to allocate dirty tracking bitmap");
-        return ret;
-    }
-
-    if (all_device_dirty_tracking) {
-        ret = vfio_devices_query_dirty_bitmap(bcontainer, &vbmap, iova, size,
-                                              errp);
-    } else {
-        ret = vfio_container_query_dirty_bitmap(bcontainer, &vbmap, iova, size,
-                                                errp);
-    }
-
-    if (ret) {
-        goto out;
-    }
-
-    dirty_pages = cpu_physical_memory_set_dirty_lebitmap(vbmap.bitmap, ram_addr,
-                                                         vbmap.pages);
-
-    trace_vfio_get_dirty_bitmap(iova, size, vbmap.size, ram_addr, dirty_pages);
-out:
-    g_free(vbmap.bitmap);
-
-    return ret;
-}
-
 typedef struct {
     IOMMUNotifier n;
     VFIOGuestIOMMU *giommu;
diff --git a/hw/vfio/container-base.c b/hw/vfio/container-base.c
index 2c2d8329e3..f9cf317018 100644
--- a/hw/vfio/container-base.c
+++ b/hw/vfio/container-base.c
@@ -10,12 +10,20 @@
  * SPDX-License-Identifier: GPL-2.0-or-later
  */
 
+#include <sys/ioctl.h>
+#include <linux/vfio.h>
+
 #include "qemu/osdep.h"
+#include "system/tcg.h"
+#include "system/ram_addr.h"
 #include "qapi/error.h"
 #include "qemu/error-report.h"
 #include "hw/vfio/vfio-container-base.h"
 #include "hw/vfio/vfio-common.h" /* vfio_reset_handler */
 #include "system/reset.h"
+#include "vfio-helpers.h"
+
+#include "trace.h"
 
 static QLIST_HEAD(, VFIOAddressSpace) vfio_address_spaces =
     QLIST_HEAD_INITIALIZER(vfio_address_spaces);
@@ -143,6 +151,136 @@ int vfio_container_query_dirty_bitmap(const VFIOContainerBase *bcontainer,
                                                errp);
 }
 
+static bool vfio_devices_all_device_dirty_tracking_started(
+    const VFIOContainerBase *bcontainer)
+{
+    VFIODevice *vbasedev;
+
+    QLIST_FOREACH(vbasedev, &bcontainer->device_list, container_next) {
+        if (!vbasedev->dirty_tracking) {
+            return false;
+        }
+    }
+
+    return true;
+}
+
+bool vfio_devices_all_dirty_tracking_started(
+    const VFIOContainerBase *bcontainer)
+{
+    return vfio_devices_all_device_dirty_tracking_started(bcontainer) ||
+           bcontainer->dirty_pages_started;
+}
+
+bool vfio_devices_all_device_dirty_tracking(const VFIOContainerBase *bcontainer)
+{
+    VFIODevice *vbasedev;
+
+    QLIST_FOREACH(vbasedev, &bcontainer->device_list, container_next) {
+        if (vbasedev->device_dirty_page_tracking == ON_OFF_AUTO_OFF) {
+            return false;
+        }
+        if (!vbasedev->dirty_pages_supported) {
+            return false;
+        }
+    }
+
+    return true;
+}
+
+static int vfio_device_dma_logging_report(VFIODevice *vbasedev, hwaddr iova,
+                                          hwaddr size, void *bitmap)
+{
+    uint64_t buf[DIV_ROUND_UP(sizeof(struct vfio_device_feature) +
+                        sizeof(struct vfio_device_feature_dma_logging_report),
+                        sizeof(uint64_t))] = {};
+    struct vfio_device_feature *feature = (struct vfio_device_feature *)buf;
+    struct vfio_device_feature_dma_logging_report *report =
+        (struct vfio_device_feature_dma_logging_report *)feature->data;
+
+    report->iova = iova;
+    report->length = size;
+    report->page_size = qemu_real_host_page_size();
+    report->bitmap = (uintptr_t)bitmap;
+
+    feature->argsz = sizeof(buf);
+    feature->flags = VFIO_DEVICE_FEATURE_GET |
+                     VFIO_DEVICE_FEATURE_DMA_LOGGING_REPORT;
+
+    if (ioctl(vbasedev->fd, VFIO_DEVICE_FEATURE, feature)) {
+        return -errno;
+    }
+
+    return 0;
+}
+
+int vfio_devices_query_dirty_bitmap(const VFIOContainerBase *bcontainer,
+                 VFIOBitmap *vbmap, hwaddr iova, hwaddr size, Error **errp)
+{
+    VFIODevice *vbasedev;
+    int ret;
+
+    QLIST_FOREACH(vbasedev, &bcontainer->device_list, container_next) {
+        ret = vfio_device_dma_logging_report(vbasedev, iova, size,
+                                             vbmap->bitmap);
+        if (ret) {
+            error_setg_errno(errp, -ret,
+                             "%s: Failed to get DMA logging report, iova: "
+                             "0x%" HWADDR_PRIx ", size: 0x%" HWADDR_PRIx,
+                             vbasedev->name, iova, size);
+
+            return ret;
+        }
+    }
+
+    return 0;
+}
+
+int vfio_get_dirty_bitmap(const VFIOContainerBase *bcontainer, uint64_t iova,
+                          uint64_t size, ram_addr_t ram_addr, Error **errp)
+{
+    bool all_device_dirty_tracking =
+        vfio_devices_all_device_dirty_tracking(bcontainer);
+    uint64_t dirty_pages;
+    VFIOBitmap vbmap;
+    int ret;
+
+    if (!bcontainer->dirty_pages_supported && !all_device_dirty_tracking) {
+        cpu_physical_memory_set_dirty_range(ram_addr, size,
+                                            tcg_enabled() ? DIRTY_CLIENTS_ALL :
+                                            DIRTY_CLIENTS_NOCODE);
+        return 0;
+    }
+
+    ret = vfio_bitmap_alloc(&vbmap, size);
+    if (ret) {
+        error_setg_errno(errp, -ret,
+                         "Failed to allocate dirty tracking bitmap");
+        return ret;
+    }
+
+    if (all_device_dirty_tracking) {
+        ret = vfio_devices_query_dirty_bitmap(bcontainer, &vbmap, iova, size,
+                                              errp);
+    } else {
+        ret = vfio_container_query_dirty_bitmap(bcontainer, &vbmap, iova, size,
+                                                errp);
+    }
+
+    if (ret) {
+        goto out;
+    }
+
+    dirty_pages = cpu_physical_memory_set_dirty_lebitmap(vbmap.bitmap, ram_addr,
+                                                         vbmap.pages);
+
+    trace_vfio_get_dirty_bitmap(iova, size, vbmap.size, ram_addr, dirty_pages);
+out:
+    g_free(vbmap.bitmap);
+
+    return ret;
+}
+
 static gpointer copy_iova_range(gconstpointer src, gpointer data)
 {
      Range *source = (Range *)src;
diff --git a/hw/vfio/meson.build b/hw/vfio/meson.build
index 1f89bd28c1..9c8a989db2 100644
--- a/hw/vfio/meson.build
+++ b/hw/vfio/meson.build
@@ -1,6 +1,7 @@
 vfio_ss = ss.source_set()
 vfio_ss.add(files(
   'common.c',
+  'container-base.c',
   'container.c',
   'helpers.c',
 ))
@@ -19,7 +20,6 @@ specific_ss.add_all(when: 'CONFIG_VFIO', if_true: vfio_ss)
 system_ss.add(when: 'CONFIG_VFIO_XGMAC', if_true: files('calxeda-xgmac.c'))
 system_ss.add(when: 'CONFIG_VFIO_AMD_XGBE', if_true: files('amd-xgbe.c'))
 system_ss.add(when: 'CONFIG_VFIO', if_true: files(
-  'container-base.c',
   'cpr.c',
   'device.c',
   'migration.c',
diff --git a/hw/vfio/trace-events b/hw/vfio/trace-events
index 9fee7df876..d4cd09cb0f 100644
--- a/hw/vfio/trace-events
+++ b/hw/vfio/trace-events
@@ -106,9 +106,11 @@ vfio_put_group(int fd) "close group->fd=%d"
 vfio_get_device(const char * name, unsigned int flags, unsigned int num_regions, unsigned int num_irqs) "Device %s flags: %u, regions: %u, irqs: %u"
 vfio_put_base_device(int fd) "close vdev->fd=%d"
 vfio_legacy_dma_unmap_overflow_workaround(void) ""
-vfio_get_dirty_bitmap(uint64_t iova, uint64_t size, uint64_t bitmap_size, uint64_t start, uint64_t dirty_pages) "iova=0x%"PRIx64" size= 0x%"PRIx64" bitmap_size=0x%"PRIx64" start=0x%"PRIx64" dirty_pages=%"PRIu64
 vfio_iommu_map_dirty_notify(uint64_t iova_start, uint64_t iova_end) "iommu dirty @ 0x%"PRIx64" - 0x%"PRIx64
 
+# container-base.c
+vfio_get_dirty_bitmap(uint64_t iova, uint64_t size, uint64_t bitmap_size, uint64_t start, uint64_t dirty_pages) "iova=0x%"PRIx64" size= 0x%"PRIx64" bitmap_size=0x%"PRIx64" start=0x%"PRIx64" dirty_pages=%"PRIu64
+
 # region.c
 vfio_region_write(const char *name, int index, uint64_t addr, uint64_t data, unsigned size) " (%s:region%d+0x%"PRIx64", 0x%"PRIx64 ", %d)"
 vfio_region_read(char *name, int index, uint64_t addr, unsigned size, uint64_t data) " (%s:region%d+0x%"PRIx64", %d) = 0x%"PRIx64
diff --git a/include/hw/vfio/vfio-common.h b/include/hw/vfio/vfio-common.h
index 06178cf282..0dfae24b72 100644
--- a/include/hw/vfio/vfio-common.h
+++ b/include/hw/vfio/vfio-common.h
@@ -141,15 +141,6 @@ int vfio_get_dev_region_info(VFIODevice *vbasedev, uint32_t type,
 bool vfio_has_region_cap(VFIODevice *vbasedev, int region, uint16_t cap_type);
 #endif
 
-bool vfio_devices_all_dirty_tracking_started(
-    const VFIOContainerBase *bcontainer);
-bool
-vfio_devices_all_device_dirty_tracking(const VFIOContainerBase *bcontainer);
-int vfio_devices_query_dirty_bitmap(const VFIOContainerBase *bcontainer,
-                VFIOBitmap *vbmap, hwaddr iova, hwaddr size, Error **errp);
-int vfio_get_dirty_bitmap(const VFIOContainerBase *bcontainer, uint64_t iova,
-                          uint64_t size, ram_addr_t ram_addr, Error **errp);
-
 /* Returns 0 on success, or a negative errno. */
 bool vfio_device_get_name(VFIODevice *vbasedev, Error **errp);
 void vfio_device_set_fd(VFIODevice *vbasedev, const char *str, Error **errp);
diff --git a/include/hw/vfio/vfio-container-base.h b/include/hw/vfio/vfio-container-base.h
index e0c458d487..41ca27b3f0 100644
--- a/include/hw/vfio/vfio-container-base.h
+++ b/include/hw/vfio/vfio-container-base.h
@@ -91,6 +91,13 @@ int vfio_container_set_dirty_page_tracking(VFIOContainerBase *bcontainer,
                                            bool start, Error **errp);
 int vfio_container_query_dirty_bitmap(const VFIOContainerBase *bcontainer,
                    VFIOBitmap *vbmap, hwaddr iova, hwaddr size, Error **errp);
+bool vfio_devices_all_dirty_tracking_started(const VFIOContainerBase *bcontainer);
+bool vfio_devices_all_device_dirty_tracking(const VFIOContainerBase *bcontainer);
+int vfio_devices_query_dirty_bitmap(const VFIOContainerBase *bcontainer,
+                                    VFIOBitmap *vbmap, hwaddr iova, hwaddr size,
+                                    Error **errp);
+int vfio_get_dirty_bitmap(const VFIOContainerBase *bcontainer, uint64_t iova,
+                          uint64_t size, ram_addr_t ram_addr, Error **errp);
 
 GList *vfio_container_get_iova_ranges(const VFIOContainerBase *bcontainer);
 

From d90aa1b8627b6a2a1e55fc559ce9082598bd47ff Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Wed, 26 Mar 2025 08:51:12 +0100
Subject: [PATCH 0277/2760] vfio: Make vfio_devices_query_dirty_bitmap() static
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

vfio_devices_query_dirty_bitmap() is only used in "container-base.c".
Also, rename to vfio_container_devices_query_dirty_bitmap() to reflect
with the prefix 'vfio_container_devices_' that it simply loops over
the container's device list.

Reviewed-by: Joao Martins <joao.m.martins@oracle.com>
Reviewed-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Avihai Horon <avihaih@nvidia.com>
Link: https://lore.kernel.org/qemu-devel/20250326075122.1299361-28-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/container-base.c              | 6 +++---
 include/hw/vfio/vfio-container-base.h | 3 ---
 2 files changed, 3 insertions(+), 6 deletions(-)

diff --git a/hw/vfio/container-base.c b/hw/vfio/container-base.c
index f9cf317018..eb7ab8461e 100644
--- a/hw/vfio/container-base.c
+++ b/hw/vfio/container-base.c
@@ -214,7 +214,7 @@ static int vfio_device_dma_logging_report(VFIODevice *vbasedev, hwaddr iova,
     return 0;
 }
 
-int vfio_devices_query_dirty_bitmap(const VFIOContainerBase *bcontainer,
+static int vfio_container_devices_query_dirty_bitmap(const VFIOContainerBase *bcontainer,
                  VFIOBitmap *vbmap, hwaddr iova, hwaddr size, Error **errp)
 {
     VFIODevice *vbasedev;
@@ -260,8 +260,8 @@ int vfio_get_dirty_bitmap(const VFIOContainerBase *bcontainer, uint64_t iova,
     }
 
     if (all_device_dirty_tracking) {
-        ret = vfio_devices_query_dirty_bitmap(bcontainer, &vbmap, iova, size,
-                                              errp);
+        ret = vfio_container_devices_query_dirty_bitmap(bcontainer, &vbmap, iova, size,
+                                                        errp);
     } else {
         ret = vfio_container_query_dirty_bitmap(bcontainer, &vbmap, iova, size,
                                                 errp);
diff --git a/include/hw/vfio/vfio-container-base.h b/include/hw/vfio/vfio-container-base.h
index 41ca27b3f0..60975194a3 100644
--- a/include/hw/vfio/vfio-container-base.h
+++ b/include/hw/vfio/vfio-container-base.h
@@ -93,9 +93,6 @@ int vfio_container_query_dirty_bitmap(const VFIOContainerBase *bcontainer,
                    VFIOBitmap *vbmap, hwaddr iova, hwaddr size, Error **errp);
 bool vfio_devices_all_dirty_tracking_started(const VFIOContainerBase *bcontainer);
 bool vfio_devices_all_device_dirty_tracking(const VFIOContainerBase *bcontainer);
-int vfio_devices_query_dirty_bitmap(const VFIOContainerBase *bcontainer,
-                                    VFIOBitmap *vbmap, hwaddr iova, hwaddr size,
-                                    Error **errp);
 int vfio_get_dirty_bitmap(const VFIOContainerBase *bcontainer, uint64_t iova,
                           uint64_t size, ram_addr_t ram_addr, Error **errp);
 

From 35e6d2c1d07dfd45c8b00019a98499d2cd6442ca Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Wed, 26 Mar 2025 08:51:13 +0100
Subject: [PATCH 0278/2760] vfio: Make vfio_container_query_dirty_bitmap()
 static
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

vfio_container_query_dirty_bitmap() is only used in "container-base.c".
Also, rename to vfio_container_iommu_query_dirty_bitmap() to reflect it
is using the VFIO IOMMU backend device ->query_dirty_bitmap() handler.

Reviewed-by: Joao Martins <joao.m.martins@oracle.com>
Reviewed-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Avihai Horon <avihaih@nvidia.com>
Link: https://lore.kernel.org/qemu-devel/20250326075122.1299361-29-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/container-base.c              | 24 ++++++++++++------------
 include/hw/vfio/vfio-container-base.h |  2 --
 2 files changed, 12 insertions(+), 14 deletions(-)

diff --git a/hw/vfio/container-base.c b/hw/vfio/container-base.c
index eb7ab8461e..3c8039d52a 100644
--- a/hw/vfio/container-base.c
+++ b/hw/vfio/container-base.c
@@ -141,16 +141,6 @@ int vfio_container_set_dirty_page_tracking(VFIOContainerBase *bcontainer,
     return ret;
 }
 
-int vfio_container_query_dirty_bitmap(const VFIOContainerBase *bcontainer,
-                   VFIOBitmap *vbmap, hwaddr iova, hwaddr size, Error **errp)
-{
-    VFIOIOMMUClass *vioc = VFIO_IOMMU_GET_CLASS(bcontainer);
-
-    g_assert(vioc->query_dirty_bitmap);
-    return vioc->query_dirty_bitmap(bcontainer, vbmap, iova, size,
-                                               errp);
-}
-
 static bool vfio_devices_all_device_dirty_tracking_started(
     const VFIOContainerBase *bcontainer)
 {
@@ -214,6 +204,16 @@ static int vfio_device_dma_logging_report(VFIODevice *vbasedev, hwaddr iova,
     return 0;
 }
 
+static int vfio_container_iommu_query_dirty_bitmap(const VFIOContainerBase *bcontainer,
+                   VFIOBitmap *vbmap, hwaddr iova, hwaddr size, Error **errp)
+{
+    VFIOIOMMUClass *vioc = VFIO_IOMMU_GET_CLASS(bcontainer);
+
+    g_assert(vioc->query_dirty_bitmap);
+    return vioc->query_dirty_bitmap(bcontainer, vbmap, iova, size,
+                                               errp);
+}
+
 static int vfio_container_devices_query_dirty_bitmap(const VFIOContainerBase *bcontainer,
                  VFIOBitmap *vbmap, hwaddr iova, hwaddr size, Error **errp)
 {
@@ -263,8 +263,8 @@ int vfio_get_dirty_bitmap(const VFIOContainerBase *bcontainer, uint64_t iova,
         ret = vfio_container_devices_query_dirty_bitmap(bcontainer, &vbmap, iova, size,
                                                         errp);
     } else {
-        ret = vfio_container_query_dirty_bitmap(bcontainer, &vbmap, iova, size,
-                                                errp);
+        ret = vfio_container_iommu_query_dirty_bitmap(bcontainer, &vbmap, iova, size,
+                                                     errp);
     }
 
     if (ret) {
diff --git a/include/hw/vfio/vfio-container-base.h b/include/hw/vfio/vfio-container-base.h
index 60975194a3..69fb698bc1 100644
--- a/include/hw/vfio/vfio-container-base.h
+++ b/include/hw/vfio/vfio-container-base.h
@@ -89,8 +89,6 @@ void vfio_container_del_section_window(VFIOContainerBase *bcontainer,
                                        MemoryRegionSection *section);
 int vfio_container_set_dirty_page_tracking(VFIOContainerBase *bcontainer,
                                            bool start, Error **errp);
-int vfio_container_query_dirty_bitmap(const VFIOContainerBase *bcontainer,
-                   VFIOBitmap *vbmap, hwaddr iova, hwaddr size, Error **errp);
 bool vfio_devices_all_dirty_tracking_started(const VFIOContainerBase *bcontainer);
 bool vfio_devices_all_device_dirty_tracking(const VFIOContainerBase *bcontainer);
 int vfio_get_dirty_bitmap(const VFIOContainerBase *bcontainer, uint64_t iova,

From e17c281e7c12d0bbe5de841f0a910687cdaaedd1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Wed, 26 Mar 2025 08:51:14 +0100
Subject: [PATCH 0279/2760] vfio: Rename
 vfio_devices_all_dirty_tracking_started()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Also rename vfio_devices_all_device_dirty_tracking_started() while at
it and use the prefix 'vfio_container_devices_' for routines simply
looping over the container's device list.

Reviewed-by: Joao Martins <joao.m.martins@oracle.com>
Reviewed-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Avihai Horon <avihaih@nvidia.com>
Link: https://lore.kernel.org/qemu-devel/20250326075122.1299361-30-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/common.c                      | 2 +-
 hw/vfio/container-base.c              | 6 +++---
 hw/vfio/container.c                   | 2 +-
 include/hw/vfio/vfio-container-base.h | 3 ++-
 4 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/hw/vfio/common.c b/hw/vfio/common.c
index ed49ef88a8..89b7a71385 100644
--- a/hw/vfio/common.c
+++ b/hw/vfio/common.c
@@ -55,7 +55,7 @@ static bool vfio_log_sync_needed(const VFIOContainerBase *bcontainer)
 {
     VFIODevice *vbasedev;
 
-    if (!vfio_devices_all_dirty_tracking_started(bcontainer)) {
+    if (!vfio_container_dirty_tracking_is_started(bcontainer)) {
         return false;
     }
 
diff --git a/hw/vfio/container-base.c b/hw/vfio/container-base.c
index 3c8039d52a..1beba37a77 100644
--- a/hw/vfio/container-base.c
+++ b/hw/vfio/container-base.c
@@ -141,7 +141,7 @@ int vfio_container_set_dirty_page_tracking(VFIOContainerBase *bcontainer,
     return ret;
 }
 
-static bool vfio_devices_all_device_dirty_tracking_started(
+static bool vfio_container_devices_dirty_tracking_is_started(
     const VFIOContainerBase *bcontainer)
 {
     VFIODevice *vbasedev;
@@ -155,10 +155,10 @@ static bool vfio_devices_all_device_dirty_tracking_started(
     return true;
 }
 
-bool vfio_devices_all_dirty_tracking_started(
+bool vfio_container_dirty_tracking_is_started(
     const VFIOContainerBase *bcontainer)
 {
-    return vfio_devices_all_device_dirty_tracking_started(bcontainer) ||
+    return vfio_container_devices_dirty_tracking_is_started(bcontainer) ||
            bcontainer->dirty_pages_started;
 }
 
diff --git a/hw/vfio/container.c b/hw/vfio/container.c
index c55fe8e4be..e8cd927136 100644
--- a/hw/vfio/container.c
+++ b/hw/vfio/container.c
@@ -137,7 +137,7 @@ static int vfio_legacy_dma_unmap(const VFIOContainerBase *bcontainer,
     int ret;
     Error *local_err = NULL;
 
-    if (iotlb && vfio_devices_all_dirty_tracking_started(bcontainer)) {
+    if (iotlb && vfio_container_dirty_tracking_is_started(bcontainer)) {
         if (!vfio_devices_all_device_dirty_tracking(bcontainer) &&
             bcontainer->dirty_pages_supported) {
             return vfio_dma_unmap_bitmap(container, iova, size, iotlb);
diff --git a/include/hw/vfio/vfio-container-base.h b/include/hw/vfio/vfio-container-base.h
index 69fb698bc1..9b33e71f59 100644
--- a/include/hw/vfio/vfio-container-base.h
+++ b/include/hw/vfio/vfio-container-base.h
@@ -89,7 +89,8 @@ void vfio_container_del_section_window(VFIOContainerBase *bcontainer,
                                        MemoryRegionSection *section);
 int vfio_container_set_dirty_page_tracking(VFIOContainerBase *bcontainer,
                                            bool start, Error **errp);
-bool vfio_devices_all_dirty_tracking_started(const VFIOContainerBase *bcontainer);
+bool vfio_container_dirty_tracking_is_started(
+    const VFIOContainerBase *bcontainer);
 bool vfio_devices_all_device_dirty_tracking(const VFIOContainerBase *bcontainer);
 int vfio_get_dirty_bitmap(const VFIOContainerBase *bcontainer, uint64_t iova,
                           uint64_t size, ram_addr_t ram_addr, Error **errp);

From 60f29d08237b6184009d0b00b933a5a788da5f94 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Wed, 26 Mar 2025 08:51:15 +0100
Subject: [PATCH 0280/2760] vfio: Rename
 vfio_devices_all_device_dirty_tracking()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Use the prefix 'vfio_container_devices_' to reflect the routine simply
loops over the container's device list.

Reviewed-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Avihai Horon <avihaih@nvidia.com>
Link: https://lore.kernel.org/qemu-devel/20250326075122.1299361-31-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/common.c                      | 4 ++--
 hw/vfio/container-base.c              | 5 +++--
 hw/vfio/container.c                   | 2 +-
 include/hw/vfio/vfio-container-base.h | 3 ++-
 4 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/hw/vfio/common.c b/hw/vfio/common.c
index 89b7a71385..5a7327979d 100644
--- a/hw/vfio/common.c
+++ b/hw/vfio/common.c
@@ -935,7 +935,7 @@ static bool vfio_listener_log_global_start(MemoryListener *listener,
                                                  listener);
     bool ret;
 
-    if (vfio_devices_all_device_dirty_tracking(bcontainer)) {
+    if (vfio_container_devices_dirty_tracking_is_supported(bcontainer)) {
         ret = vfio_devices_dma_logging_start(bcontainer, errp);
     } else {
         ret = vfio_container_set_dirty_page_tracking(bcontainer, true, errp) == 0;
@@ -954,7 +954,7 @@ static void vfio_listener_log_global_stop(MemoryListener *listener)
     Error *local_err = NULL;
     int ret = 0;
 
-    if (vfio_devices_all_device_dirty_tracking(bcontainer)) {
+    if (vfio_container_devices_dirty_tracking_is_supported(bcontainer)) {
         vfio_devices_dma_logging_stop(bcontainer);
     } else {
         ret = vfio_container_set_dirty_page_tracking(bcontainer, false,
diff --git a/hw/vfio/container-base.c b/hw/vfio/container-base.c
index 1beba37a77..2627908e3f 100644
--- a/hw/vfio/container-base.c
+++ b/hw/vfio/container-base.c
@@ -162,7 +162,8 @@ bool vfio_container_dirty_tracking_is_started(
            bcontainer->dirty_pages_started;
 }
 
-bool vfio_devices_all_device_dirty_tracking(const VFIOContainerBase *bcontainer)
+bool vfio_container_devices_dirty_tracking_is_supported(
+    const VFIOContainerBase *bcontainer)
 {
     VFIODevice *vbasedev;
 
@@ -240,7 +241,7 @@ int vfio_get_dirty_bitmap(const VFIOContainerBase *bcontainer, uint64_t iova,
                           uint64_t size, ram_addr_t ram_addr, Error **errp)
 {
     bool all_device_dirty_tracking =
-        vfio_devices_all_device_dirty_tracking(bcontainer);
+        vfio_container_devices_dirty_tracking_is_supported(bcontainer);
     uint64_t dirty_pages;
     VFIOBitmap vbmap;
     int ret;
diff --git a/hw/vfio/container.c b/hw/vfio/container.c
index e8cd927136..8e4a2cae03 100644
--- a/hw/vfio/container.c
+++ b/hw/vfio/container.c
@@ -138,7 +138,7 @@ static int vfio_legacy_dma_unmap(const VFIOContainerBase *bcontainer,
     Error *local_err = NULL;
 
     if (iotlb && vfio_container_dirty_tracking_is_started(bcontainer)) {
-        if (!vfio_devices_all_device_dirty_tracking(bcontainer) &&
+        if (!vfio_container_devices_dirty_tracking_is_supported(bcontainer) &&
             bcontainer->dirty_pages_supported) {
             return vfio_dma_unmap_bitmap(container, iova, size, iotlb);
         }
diff --git a/include/hw/vfio/vfio-container-base.h b/include/hw/vfio/vfio-container-base.h
index 9b33e71f59..395ace02e4 100644
--- a/include/hw/vfio/vfio-container-base.h
+++ b/include/hw/vfio/vfio-container-base.h
@@ -91,7 +91,8 @@ int vfio_container_set_dirty_page_tracking(VFIOContainerBase *bcontainer,
                                            bool start, Error **errp);
 bool vfio_container_dirty_tracking_is_started(
     const VFIOContainerBase *bcontainer);
-bool vfio_devices_all_device_dirty_tracking(const VFIOContainerBase *bcontainer);
+bool vfio_container_devices_dirty_tracking_is_supported(
+    const VFIOContainerBase *bcontainer);
 int vfio_get_dirty_bitmap(const VFIOContainerBase *bcontainer, uint64_t iova,
                           uint64_t size, ram_addr_t ram_addr, Error **errp);
 

From c51358bd17c324dae65f745df9c954e3a7137219 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Wed, 26 Mar 2025 08:51:16 +0100
Subject: [PATCH 0281/2760] vfio: Rename vfio_get_dirty_bitmap()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Rename to vfio_container_query_dirty_bitmap() to be consistent with
the VFIO container routine naming scheme.

Reviewed-by: Joao Martins <joao.m.martins@oracle.com>
Reviewed-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Avihai Horon <avihaih@nvidia.com>
Link: https://lore.kernel.org/qemu-devel/20250326075122.1299361-32-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/common.c                      | 6 +++---
 hw/vfio/container-base.c              | 5 +++--
 hw/vfio/container.c                   | 2 +-
 hw/vfio/trace-events                  | 2 +-
 include/hw/vfio/vfio-container-base.h | 4 ++--
 5 files changed, 10 insertions(+), 9 deletions(-)

diff --git a/hw/vfio/common.c b/hw/vfio/common.c
index 5a7327979d..bde1bb3c13 100644
--- a/hw/vfio/common.c
+++ b/hw/vfio/common.c
@@ -1002,7 +1002,7 @@ static void vfio_iommu_map_dirty_notify(IOMMUNotifier *n, IOMMUTLBEntry *iotlb)
         goto out_unlock;
     }
 
-    ret = vfio_get_dirty_bitmap(bcontainer, iova, iotlb->addr_mask + 1,
+    ret = vfio_container_query_dirty_bitmap(bcontainer, iova, iotlb->addr_mask + 1,
                                 translated_addr, &local_err);
     if (ret) {
         error_prepend(&local_err,
@@ -1039,7 +1039,7 @@ static int vfio_ram_discard_get_dirty_bitmap(MemoryRegionSection *section,
      * Sync the whole mapped region (spanning multiple individual mappings)
      * in one go.
      */
-    ret = vfio_get_dirty_bitmap(vrdl->bcontainer, iova, size, ram_addr,
+    ret = vfio_container_query_dirty_bitmap(vrdl->bcontainer, iova, size, ram_addr,
                                 &local_err);
     if (ret) {
         error_report_err(local_err);
@@ -1133,7 +1133,7 @@ static int vfio_sync_dirty_bitmap(VFIOContainerBase *bcontainer,
     ram_addr = memory_region_get_ram_addr(section->mr) +
                section->offset_within_region;
 
-    return vfio_get_dirty_bitmap(bcontainer,
+    return vfio_container_query_dirty_bitmap(bcontainer,
                    REAL_HOST_PAGE_ALIGN(section->offset_within_address_space),
                                  int128_get64(section->size), ram_addr, errp);
 }
diff --git a/hw/vfio/container-base.c b/hw/vfio/container-base.c
index 2627908e3f..fb86bc41bf 100644
--- a/hw/vfio/container-base.c
+++ b/hw/vfio/container-base.c
@@ -237,7 +237,7 @@ static int vfio_container_devices_query_dirty_bitmap(const VFIOContainerBase *bc
     return 0;
 }
 
-int vfio_get_dirty_bitmap(const VFIOContainerBase *bcontainer, uint64_t iova,
+int vfio_container_query_dirty_bitmap(const VFIOContainerBase *bcontainer, uint64_t iova,
                           uint64_t size, ram_addr_t ram_addr, Error **errp)
 {
     bool all_device_dirty_tracking =
@@ -275,7 +275,8 @@ int vfio_get_dirty_bitmap(const VFIOContainerBase *bcontainer, uint64_t iova,
     dirty_pages = cpu_physical_memory_set_dirty_lebitmap(vbmap.bitmap, ram_addr,
                                                          vbmap.pages);
 
-    trace_vfio_get_dirty_bitmap(iova, size, vbmap.size, ram_addr, dirty_pages);
+    trace_vfio_container_query_dirty_bitmap(iova, size, vbmap.size, ram_addr,
+                                            dirty_pages);
 out:
     g_free(vbmap.bitmap);
 
diff --git a/hw/vfio/container.c b/hw/vfio/container.c
index 8e4a2cae03..bb3990aece 100644
--- a/hw/vfio/container.c
+++ b/hw/vfio/container.c
@@ -169,7 +169,7 @@ static int vfio_legacy_dma_unmap(const VFIOContainerBase *bcontainer,
     }
 
     if (need_dirty_sync) {
-        ret = vfio_get_dirty_bitmap(bcontainer, iova, size,
+        ret = vfio_container_query_dirty_bitmap(bcontainer, iova, size,
                                     iotlb->translated_addr, &local_err);
         if (ret) {
             error_report_err(local_err);
diff --git a/hw/vfio/trace-events b/hw/vfio/trace-events
index d4cd09cb0f..aa0ba695fa 100644
--- a/hw/vfio/trace-events
+++ b/hw/vfio/trace-events
@@ -109,7 +109,7 @@ vfio_legacy_dma_unmap_overflow_workaround(void) ""
 vfio_iommu_map_dirty_notify(uint64_t iova_start, uint64_t iova_end) "iommu dirty @ 0x%"PRIx64" - 0x%"PRIx64
 
 # container-base.c
-vfio_get_dirty_bitmap(uint64_t iova, uint64_t size, uint64_t bitmap_size, uint64_t start, uint64_t dirty_pages) "iova=0x%"PRIx64" size= 0x%"PRIx64" bitmap_size=0x%"PRIx64" start=0x%"PRIx64" dirty_pages=%"PRIu64
+vfio_container_query_dirty_bitmap(uint64_t iova, uint64_t size, uint64_t bitmap_size, uint64_t start, uint64_t dirty_pages) "iova=0x%"PRIx64" size= 0x%"PRIx64" bitmap_size=0x%"PRIx64" start=0x%"PRIx64" dirty_pages=%"PRIu64
 
 # region.c
 vfio_region_write(const char *name, int index, uint64_t addr, uint64_t data, unsigned size) " (%s:region%d+0x%"PRIx64", 0x%"PRIx64 ", %d)"
diff --git a/include/hw/vfio/vfio-container-base.h b/include/hw/vfio/vfio-container-base.h
index 395ace02e4..af63373c92 100644
--- a/include/hw/vfio/vfio-container-base.h
+++ b/include/hw/vfio/vfio-container-base.h
@@ -93,8 +93,8 @@ bool vfio_container_dirty_tracking_is_started(
     const VFIOContainerBase *bcontainer);
 bool vfio_container_devices_dirty_tracking_is_supported(
     const VFIOContainerBase *bcontainer);
-int vfio_get_dirty_bitmap(const VFIOContainerBase *bcontainer, uint64_t iova,
-                          uint64_t size, ram_addr_t ram_addr, Error **errp);
+int vfio_container_query_dirty_bitmap(const VFIOContainerBase *bcontainer,
+    uint64_t iova, uint64_t size, ram_addr_t ram_addr, Error **errp);
 
 GList *vfio_container_get_iova_ranges(const VFIOContainerBase *bcontainer);
 

From 6b62a90c24eb766b331343f9ad80104a7f16e7a2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Wed, 26 Mar 2025 08:51:17 +0100
Subject: [PATCH 0282/2760] vfio: Introduce new files for VFIO MemoryListener
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

File "common.c" has been emptied of most of its definitions by the
previous changes and the only definitions left are related to the VFIO
MemoryListener handlers. Rename it to "listener.c" and introduce its
associated "vfio-listener.h" header file for the declarations.

Cleanup a little the includes while at it.

Reviewed-by: Joao Martins <joao.m.martins@oracle.com>
Reviewed-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Avihai Horon <avihaih@nvidia.com>
Link: https://lore.kernel.org/qemu-devel/20250326075122.1299361-33-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/container.c              |  1 +
 hw/vfio/iommufd.c                |  1 +
 hw/vfio/{common.c => listener.c} |  0
 hw/vfio/meson.build              |  2 +-
 hw/vfio/trace-events             |  2 +-
 hw/vfio/vfio-listener.h          | 14 ++++++++++++++
 include/hw/vfio/vfio-common.h    |  1 -
 7 files changed, 18 insertions(+), 3 deletions(-)
 rename hw/vfio/{common.c => listener.c} (100%)
 create mode 100644 hw/vfio/vfio-listener.h

diff --git a/hw/vfio/container.c b/hw/vfio/container.c
index bb3990aece..ff540e1c59 100644
--- a/hw/vfio/container.c
+++ b/hw/vfio/container.c
@@ -35,6 +35,7 @@
 #include "hw/vfio/vfio-container.h"
 #include "vfio-helpers.h"
 #include "vfio-cpr.h"
+#include "vfio-listener.h"
 
 #define TYPE_HOST_IOMMU_DEVICE_LEGACY_VFIO TYPE_HOST_IOMMU_DEVICE "-legacy-vfio"
 
diff --git a/hw/vfio/iommufd.c b/hw/vfio/iommufd.c
index a5bd189a86..7488d21215 100644
--- a/hw/vfio/iommufd.c
+++ b/hw/vfio/iommufd.c
@@ -28,6 +28,7 @@
 #include "vfio-iommufd.h"
 #include "vfio-helpers.h"
 #include "vfio-cpr.h"
+#include "vfio-listener.h"
 
 #define TYPE_HOST_IOMMU_DEVICE_IOMMUFD_VFIO             \
             TYPE_HOST_IOMMU_DEVICE_IOMMUFD "-vfio"
diff --git a/hw/vfio/common.c b/hw/vfio/listener.c
similarity index 100%
rename from hw/vfio/common.c
rename to hw/vfio/listener.c
diff --git a/hw/vfio/meson.build b/hw/vfio/meson.build
index 9c8a989db2..bccb05098c 100644
--- a/hw/vfio/meson.build
+++ b/hw/vfio/meson.build
@@ -1,6 +1,6 @@
 vfio_ss = ss.source_set()
 vfio_ss.add(files(
-  'common.c',
+  'listener.c',
   'container-base.c',
   'container.c',
   'helpers.c',
diff --git a/hw/vfio/trace-events b/hw/vfio/trace-events
index aa0ba695fa..ddb1bcc24a 100644
--- a/hw/vfio/trace-events
+++ b/hw/vfio/trace-events
@@ -89,7 +89,7 @@ vfio_pci_igd_bdsm_enabled(const char *name, int size) "%s %dMB"
 vfio_pci_igd_host_bridge_enabled(const char *name) "%s"
 vfio_pci_igd_lpc_bridge_enabled(const char *name) "%s"
 
-# common.c
+# listener.c
 vfio_iommu_map_notify(const char *op, uint64_t iova_start, uint64_t iova_end) "iommu %s @ 0x%"PRIx64" - 0x%"PRIx64
 vfio_listener_region_skip(const char *name, uint64_t start, uint64_t end) "SKIPPING %s 0x%"PRIx64" - 0x%"PRIx64
 vfio_spapr_group_attach(int groupfd, int tablefd) "Attached groupfd %d to liobn fd %d"
diff --git a/hw/vfio/vfio-listener.h b/hw/vfio/vfio-listener.h
new file mode 100644
index 0000000000..93af6747b2
--- /dev/null
+++ b/hw/vfio/vfio-listener.h
@@ -0,0 +1,14 @@
+/*
+ * VFIO MemoryListener services
+ *
+ * Copyright Red Hat, Inc. 2025
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef HW_VFIO_VFIO_LISTENER_H
+#define HW_VFIO_VFIO_LISTENER_H
+
+extern const MemoryListener vfio_memory_listener;
+
+#endif /* HW_VFIO_VFIO_LISTENER_H */
diff --git a/include/hw/vfio/vfio-common.h b/include/hw/vfio/vfio-common.h
index 0dfae24b72..92381c6160 100644
--- a/include/hw/vfio/vfio-common.h
+++ b/include/hw/vfio/vfio-common.h
@@ -131,7 +131,6 @@ VFIODevice *vfio_get_vfio_device(Object *obj);
 
 typedef QLIST_HEAD(VFIODeviceList, VFIODevice) VFIODeviceList;
 extern VFIODeviceList vfio_device_list;
-extern const MemoryListener vfio_memory_listener;
 
 #ifdef CONFIG_LINUX
 int vfio_get_region_info(VFIODevice *vbasedev, int index,

From 74d376378e2a41392a36f34cef7d2c89ac2dfb33 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Wed, 26 Mar 2025 08:51:18 +0100
Subject: [PATCH 0283/2760] vfio: Rename RAM discard related services
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Rename some routines to better reflect the namespace they belong to.

Reviewed-by: Avihai Horon <avihaih@nvidia.com>
Link: https://lore.kernel.org/qemu-devel/20250326075122.1299361-34-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/listener.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/hw/vfio/listener.c b/hw/vfio/listener.c
index bde1bb3c13..70bdeb3ce7 100644
--- a/hw/vfio/listener.c
+++ b/hw/vfio/listener.c
@@ -242,7 +242,7 @@ static int vfio_ram_discard_notify_populate(RamDiscardListener *rdl,
     return 0;
 }
 
-static void vfio_register_ram_discard_listener(VFIOContainerBase *bcontainer,
+static void vfio_ram_discard_register_listener(VFIOContainerBase *bcontainer,
                                                MemoryRegionSection *section)
 {
     RamDiscardManager *rdm = memory_region_get_ram_discard_manager(section->mr);
@@ -317,7 +317,7 @@ static void vfio_register_ram_discard_listener(VFIOContainerBase *bcontainer,
     }
 }
 
-static void vfio_unregister_ram_discard_listener(VFIOContainerBase *bcontainer,
+static void vfio_ram_discard_unregister_listener(VFIOContainerBase *bcontainer,
                                                  MemoryRegionSection *section)
 {
     RamDiscardManager *rdm = memory_region_get_ram_discard_manager(section->mr);
@@ -504,7 +504,7 @@ static void vfio_listener_region_add(MemoryListener *listener,
      * about changes.
      */
     if (memory_region_has_ram_discard_manager(section->mr)) {
-        vfio_register_ram_discard_listener(bcontainer, section);
+        vfio_ram_discard_register_listener(bcontainer, section);
         return;
     }
 
@@ -627,7 +627,7 @@ static void vfio_listener_region_del(MemoryListener *listener,
         pgmask = (1ULL << ctz64(bcontainer->pgsizes)) - 1;
         try_unmap = !((iova & pgmask) || (int128_get64(llsize) & pgmask));
     } else if (memory_region_has_ram_discard_manager(section->mr)) {
-        vfio_unregister_ram_discard_listener(bcontainer, section);
+        vfio_ram_discard_unregister_listener(bcontainer, section);
         /* Unregistering will trigger an unmap. */
         try_unmap = false;
     }
@@ -1024,7 +1024,7 @@ out:
     }
 }
 
-static int vfio_ram_discard_get_dirty_bitmap(MemoryRegionSection *section,
+static int vfio_ram_discard_query_dirty_bitmap(MemoryRegionSection *section,
                                              void *opaque)
 {
     const hwaddr size = int128_get64(section->size);
@@ -1071,7 +1071,7 @@ vfio_sync_ram_discard_listener_dirty_bitmap(VFIOContainerBase *bcontainer,
      * which correspond to populated parts. Replay all populated parts.
      */
     return ram_discard_manager_replay_populated(rdm, section,
-                                              vfio_ram_discard_get_dirty_bitmap,
+                                                vfio_ram_discard_query_dirty_bitmap,
                                                 &vrdl);
 }
 

From a9183378f54969c8b11f08fdb3063925de8d77c3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Wed, 26 Mar 2025 08:51:19 +0100
Subject: [PATCH 0284/2760] vfio: Introduce vfio_listener_un/register()
 routines
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This hides the MemoryListener implementation and makes the code common
to both IOMMU backends, legacy and IOMMUFD.

Reviewed-by: Joao Martins <joao.m.martins@oracle.com>
Reviewed-by: John Levon <john.levon@nutanix.com>
Link: https://lore.kernel.org/qemu-devel/20250326075122.1299361-35-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/container.c     | 11 +++--------
 hw/vfio/iommufd.c       |  9 ++-------
 hw/vfio/listener.c      | 22 +++++++++++++++++++++-
 hw/vfio/vfio-listener.h |  3 ++-
 4 files changed, 28 insertions(+), 17 deletions(-)

diff --git a/hw/vfio/container.c b/hw/vfio/container.c
index ff540e1c59..e4fcb1ad8b 100644
--- a/hw/vfio/container.c
+++ b/hw/vfio/container.c
@@ -616,12 +616,7 @@ static bool vfio_connect_container(VFIOGroup *group, AddressSpace *as,
     group->container = container;
     QLIST_INSERT_HEAD(&container->group_list, group, container_next);
 
-    bcontainer->listener = vfio_memory_listener;
-    memory_listener_register(&bcontainer->listener, bcontainer->space->as);
-
-    if (bcontainer->error) {
-        error_propagate_prepend(errp, bcontainer->error,
-            "memory listener initialization failed: ");
+    if (!vfio_listener_register(bcontainer, errp)) {
         goto listener_release_exit;
     }
 
@@ -631,7 +626,7 @@ static bool vfio_connect_container(VFIOGroup *group, AddressSpace *as,
 listener_release_exit:
     QLIST_REMOVE(group, container_next);
     vfio_kvm_device_del_group(group);
-    memory_listener_unregister(&bcontainer->listener);
+    vfio_listener_unregister(bcontainer);
     if (vioc->release) {
         vioc->release(bcontainer);
     }
@@ -669,7 +664,7 @@ static void vfio_disconnect_container(VFIOGroup *group)
      * group.
      */
     if (QLIST_EMPTY(&container->group_list)) {
-        memory_listener_unregister(&bcontainer->listener);
+        vfio_listener_unregister(bcontainer);
         if (vioc->release) {
             vioc->release(bcontainer);
         }
diff --git a/hw/vfio/iommufd.c b/hw/vfio/iommufd.c
index 7488d21215..e47720247d 100644
--- a/hw/vfio/iommufd.c
+++ b/hw/vfio/iommufd.c
@@ -410,7 +410,7 @@ static void iommufd_cdev_container_destroy(VFIOIOMMUFDContainer *container)
     if (!QLIST_EMPTY(&bcontainer->device_list)) {
         return;
     }
-    memory_listener_unregister(&bcontainer->listener);
+    vfio_listener_unregister(bcontainer);
     iommufd_backend_free_id(container->be, container->ioas_id);
     object_unref(container);
 }
@@ -562,12 +562,7 @@ static bool iommufd_cdev_attach(const char *name, VFIODevice *vbasedev,
         bcontainer->pgsizes = qemu_real_host_page_size();
     }
 
-    bcontainer->listener = vfio_memory_listener;
-    memory_listener_register(&bcontainer->listener, bcontainer->space->as);
-
-    if (bcontainer->error) {
-        error_propagate_prepend(errp, bcontainer->error,
-                                "memory listener initialization failed: ");
+    if (!vfio_listener_register(bcontainer, errp)) {
         goto err_listener_register;
     }
 
diff --git a/hw/vfio/listener.c b/hw/vfio/listener.c
index 70bdeb3ce7..d19674503c 100644
--- a/hw/vfio/listener.c
+++ b/hw/vfio/listener.c
@@ -45,6 +45,7 @@
 #include "system/tpm.h"
 #include "vfio-migration-internal.h"
 #include "vfio-helpers.h"
+#include "vfio-listener.h"
 
 /*
  * Device state interfaces
@@ -1162,7 +1163,7 @@ static void vfio_listener_log_sync(MemoryListener *listener,
     }
 }
 
-const MemoryListener vfio_memory_listener = {
+static const MemoryListener vfio_memory_listener = {
     .name = "vfio",
     .region_add = vfio_listener_region_add,
     .region_del = vfio_listener_region_del,
@@ -1170,3 +1171,22 @@ const MemoryListener vfio_memory_listener = {
     .log_global_stop = vfio_listener_log_global_stop,
     .log_sync = vfio_listener_log_sync,
 };
+
+bool vfio_listener_register(VFIOContainerBase *bcontainer, Error **errp)
+{
+    bcontainer->listener = vfio_memory_listener;
+    memory_listener_register(&bcontainer->listener, bcontainer->space->as);
+
+    if (bcontainer->error) {
+        error_propagate_prepend(errp, bcontainer->error,
+                                "memory listener initialization failed: ");
+        return false;
+    }
+
+    return true;
+}
+
+void vfio_listener_unregister(VFIOContainerBase *bcontainer)
+{
+    memory_listener_unregister(&bcontainer->listener);
+}
diff --git a/hw/vfio/vfio-listener.h b/hw/vfio/vfio-listener.h
index 93af6747b2..eb69ddd374 100644
--- a/hw/vfio/vfio-listener.h
+++ b/hw/vfio/vfio-listener.h
@@ -9,6 +9,7 @@
 #ifndef HW_VFIO_VFIO_LISTENER_H
 #define HW_VFIO_VFIO_LISTENER_H
 
-extern const MemoryListener vfio_memory_listener;
+bool vfio_listener_register(VFIOContainerBase *bcontainer, Error **errp);
+void vfio_listener_unregister(VFIOContainerBase *bcontainer);
 
 #endif /* HW_VFIO_VFIO_LISTENER_H */

From 11b8b9d53d8b30bf1823e9d2e303c28fe13acf34 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Wed, 26 Mar 2025 08:51:20 +0100
Subject: [PATCH 0285/2760] vfio: Rename vfio-common.h to vfio-device.h
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

"hw/vfio/vfio-common.h" has been emptied of most of its declarations
by the previous changes and the only declarations left are related to
VFIODevice. Rename it to "hw/vfio/vfio-device.h" and make the
necessary adjustments.

Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Link: https://lore.kernel.org/qemu-devel/20250326075122.1299361-36-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 backends/iommufd.c                               | 2 +-
 hw/vfio/ap.c                                     | 2 +-
 hw/vfio/ccw.c                                    | 2 +-
 hw/vfio/container-base.c                         | 2 +-
 hw/vfio/container.c                              | 2 +-
 hw/vfio/cpr.c                                    | 2 +-
 hw/vfio/device.c                                 | 2 +-
 hw/vfio/helpers.c                                | 2 +-
 hw/vfio/iommufd.c                                | 2 +-
 hw/vfio/listener.c                               | 2 +-
 hw/vfio/migration-multifd.c                      | 2 +-
 hw/vfio/migration-multifd.h                      | 2 +-
 hw/vfio/migration.c                              | 2 +-
 hw/vfio/pci.h                                    | 2 +-
 hw/vfio/region.c                                 | 4 ++--
 include/hw/s390x/vfio-ccw.h                      | 2 +-
 include/hw/vfio/{vfio-common.h => vfio-device.h} | 2 +-
 include/hw/vfio/vfio-platform.h                  | 2 +-
 18 files changed, 19 insertions(+), 19 deletions(-)
 rename include/hw/vfio/{vfio-common.h => vfio-device.h} (98%)

diff --git a/backends/iommufd.c b/backends/iommufd.c
index d57da44755..9587e4d99b 100644
--- a/backends/iommufd.c
+++ b/backends/iommufd.c
@@ -18,7 +18,7 @@
 #include "qemu/error-report.h"
 #include "monitor/monitor.h"
 #include "trace.h"
-#include "hw/vfio/vfio-common.h"
+#include "hw/vfio/vfio-device.h"
 #include <sys/ioctl.h>
 #include <linux/iommufd.h>
 
diff --git a/hw/vfio/ap.c b/hw/vfio/ap.c
index d6575d7c44..9e2251437e 100644
--- a/hw/vfio/ap.c
+++ b/hw/vfio/ap.c
@@ -15,7 +15,7 @@
 #include <linux/vfio.h>
 #include <sys/ioctl.h>
 #include "qapi/error.h"
-#include "hw/vfio/vfio-common.h"
+#include "hw/vfio/vfio-device.h"
 #include "system/iommufd.h"
 #include "hw/s390x/ap-device.h"
 #include "qemu/error-report.h"
diff --git a/hw/vfio/ccw.c b/hw/vfio/ccw.c
index 29e804e122..d0713ca4c7 100644
--- a/hw/vfio/ccw.c
+++ b/hw/vfio/ccw.c
@@ -21,7 +21,7 @@
 #include <sys/ioctl.h>
 
 #include "qapi/error.h"
-#include "hw/vfio/vfio-common.h"
+#include "hw/vfio/vfio-device.h"
 #include "system/iommufd.h"
 #include "hw/s390x/s390-ccw.h"
 #include "hw/s390x/vfio-ccw.h"
diff --git a/hw/vfio/container-base.c b/hw/vfio/container-base.c
index fb86bc41bf..c037bafe21 100644
--- a/hw/vfio/container-base.c
+++ b/hw/vfio/container-base.c
@@ -19,7 +19,7 @@
 #include "qapi/error.h"
 #include "qemu/error-report.h"
 #include "hw/vfio/vfio-container-base.h"
-#include "hw/vfio/vfio-common.h" /* vfio_reset_handler */
+#include "hw/vfio/vfio-device.h" /* vfio_reset_handler */
 #include "system/reset.h"
 #include "vfio-helpers.h"
 
diff --git a/hw/vfio/container.c b/hw/vfio/container.c
index e4fcb1ad8b..ef14046072 100644
--- a/hw/vfio/container.c
+++ b/hw/vfio/container.c
@@ -22,7 +22,7 @@
 #include <sys/ioctl.h>
 #include <linux/vfio.h>
 
-#include "hw/vfio/vfio-common.h"
+#include "hw/vfio/vfio-device.h"
 #include "system/address-spaces.h"
 #include "system/memory.h"
 #include "system/ram_addr.h"
diff --git a/hw/vfio/cpr.c b/hw/vfio/cpr.c
index 696987006b..3214184f97 100644
--- a/hw/vfio/cpr.c
+++ b/hw/vfio/cpr.c
@@ -6,7 +6,7 @@
  */
 
 #include "qemu/osdep.h"
-#include "hw/vfio/vfio-common.h"
+#include "hw/vfio/vfio-device.h"
 #include "migration/misc.h"
 #include "qapi/error.h"
 #include "system/runstate.h"
diff --git a/hw/vfio/device.c b/hw/vfio/device.c
index e122c797c2..543750c3b1 100644
--- a/hw/vfio/device.c
+++ b/hw/vfio/device.c
@@ -21,7 +21,7 @@
 #include "qemu/osdep.h"
 #include <sys/ioctl.h>
 
-#include "hw/vfio/vfio-common.h"
+#include "hw/vfio/vfio-device.h"
 #include "hw/vfio/pci.h"
 #include "hw/hw.h"
 #include "trace.h"
diff --git a/hw/vfio/helpers.c b/hw/vfio/helpers.c
index 48bd61d528..d0dbab1d17 100644
--- a/hw/vfio/helpers.c
+++ b/hw/vfio/helpers.c
@@ -23,7 +23,7 @@
 #include <sys/ioctl.h>
 
 #include "system/kvm.h"
-#include "hw/vfio/vfio-common.h"
+#include "hw/vfio/vfio-device.h"
 #include "hw/hw.h"
 #include "qapi/error.h"
 #include "vfio-helpers.h"
diff --git a/hw/vfio/iommufd.c b/hw/vfio/iommufd.c
index e47720247d..48db105422 100644
--- a/hw/vfio/iommufd.c
+++ b/hw/vfio/iommufd.c
@@ -15,7 +15,7 @@
 #include <linux/vfio.h>
 #include <linux/iommufd.h>
 
-#include "hw/vfio/vfio-common.h"
+#include "hw/vfio/vfio-device.h"
 #include "qemu/error-report.h"
 #include "trace.h"
 #include "qapi/error.h"
diff --git a/hw/vfio/listener.c b/hw/vfio/listener.c
index d19674503c..6f77e18a7a 100644
--- a/hw/vfio/listener.c
+++ b/hw/vfio/listener.c
@@ -25,7 +25,7 @@
 #endif
 #include <linux/vfio.h>
 
-#include "hw/vfio/vfio-common.h"
+#include "hw/vfio/vfio-device.h"
 #include "hw/vfio/pci.h"
 #include "system/address-spaces.h"
 #include "system/memory.h"
diff --git a/hw/vfio/migration-multifd.c b/hw/vfio/migration-multifd.c
index a3005226b9..850a319488 100644
--- a/hw/vfio/migration-multifd.c
+++ b/hw/vfio/migration-multifd.c
@@ -10,7 +10,7 @@
  */
 
 #include "qemu/osdep.h"
-#include "hw/vfio/vfio-common.h"
+#include "hw/vfio/vfio-device.h"
 #include "migration/misc.h"
 #include "qapi/error.h"
 #include "qemu/bswap.h"
diff --git a/hw/vfio/migration-multifd.h b/hw/vfio/migration-multifd.h
index a664051eb8..0bab63211d 100644
--- a/hw/vfio/migration-multifd.h
+++ b/hw/vfio/migration-multifd.h
@@ -12,7 +12,7 @@
 #ifndef HW_VFIO_MIGRATION_MULTIFD_H
 #define HW_VFIO_MIGRATION_MULTIFD_H
 
-#include "hw/vfio/vfio-common.h"
+#include "hw/vfio/vfio-device.h"
 
 bool vfio_multifd_setup(VFIODevice *vbasedev, bool alloc_multifd, Error **errp);
 void vfio_multifd_cleanup(VFIODevice *vbasedev);
diff --git a/hw/vfio/migration.c b/hw/vfio/migration.c
index 4da0526325..1dceab1b19 100644
--- a/hw/vfio/migration.c
+++ b/hw/vfio/migration.c
@@ -16,7 +16,7 @@
 #include <sys/ioctl.h>
 
 #include "system/runstate.h"
-#include "hw/vfio/vfio-common.h"
+#include "hw/vfio/vfio-device.h"
 #include "hw/vfio/vfio-migration.h"
 #include "migration/misc.h"
 #include "migration/savevm.h"
diff --git a/hw/vfio/pci.h b/hw/vfio/pci.h
index 801ea445b8..f835b1dbc2 100644
--- a/hw/vfio/pci.h
+++ b/hw/vfio/pci.h
@@ -14,7 +14,7 @@
 
 #include "system/memory.h"
 #include "hw/pci/pci_device.h"
-#include "hw/vfio/vfio-common.h"
+#include "hw/vfio/vfio-device.h"
 #include "hw/vfio/vfio-region.h"
 #include "qemu/event_notifier.h"
 #include "qemu/queue.h"
diff --git a/hw/vfio/region.c b/hw/vfio/region.c
index 9049143abf..010b5241e1 100644
--- a/hw/vfio/region.c
+++ b/hw/vfio/region.c
@@ -21,8 +21,8 @@
 #include "qemu/osdep.h"
 #include <sys/ioctl.h>
 
-#include "hw/vfio/vfio-common.h"
-#include "hw/vfio/pci.h"
+#include "hw/vfio/vfio-region.h"
+#include "hw/vfio/vfio-device.h"
 #include "hw/hw.h"
 #include "trace.h"
 #include "qapi/error.h"
diff --git a/include/hw/s390x/vfio-ccw.h b/include/hw/s390x/vfio-ccw.h
index 4209d27657..1e0922dca1 100644
--- a/include/hw/s390x/vfio-ccw.h
+++ b/include/hw/s390x/vfio-ccw.h
@@ -14,7 +14,7 @@
 #ifndef HW_VFIO_CCW_H
 #define HW_VFIO_CCW_H
 
-#include "hw/vfio/vfio-common.h"
+#include "hw/vfio/vfio-device.h"
 #include "hw/s390x/s390-ccw.h"
 #include "hw/s390x/ccw-device.h"
 #include "qom/object.h"
diff --git a/include/hw/vfio/vfio-common.h b/include/hw/vfio/vfio-device.h
similarity index 98%
rename from include/hw/vfio/vfio-common.h
rename to include/hw/vfio/vfio-device.h
index 92381c6160..cfbe254e31 100644
--- a/include/hw/vfio/vfio-common.h
+++ b/include/hw/vfio/vfio-device.h
@@ -1,5 +1,5 @@
 /*
- * common header for vfio based device assignment support
+ * VFIO Device interface
  *
  * Copyright Red Hat, Inc. 2012
  *
diff --git a/include/hw/vfio/vfio-platform.h b/include/hw/vfio/vfio-platform.h
index 3191545717..256d8500b7 100644
--- a/include/hw/vfio/vfio-platform.h
+++ b/include/hw/vfio/vfio-platform.h
@@ -17,7 +17,7 @@
 #define HW_VFIO_VFIO_PLATFORM_H
 
 #include "hw/sysbus.h"
-#include "hw/vfio/vfio-common.h"
+#include "hw/vfio/vfio-device.h"
 #include "qemu/event_notifier.h"
 #include "qemu/queue.h"
 #include "qom/object.h"

From e218ccf0c94b6fe26b333e2bdad87da85fe1c428 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Wed, 26 Mar 2025 08:51:21 +0100
Subject: [PATCH 0286/2760] vfio: Rename VFIODevice related services
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Rename these routines :

  vfio_disable_irqindex       -> vfio_device_irq_disable
  vfio_unmask_single_irqindex -> vfio_device_irq_unmask
  vfio_mask_single_irqindex   -> vfio_device_irq_mask
  vfio_set_irq_signaling      -> vfio_device_irq_set_signaling
  vfio_attach_device          -> vfio_device_attach
  vfio_detach_device          -> vfio_device_detach
  vfio_get_region_info        -> vfio_device_get_region_info
  vfio_get_dev_region_info    -> vfio_device_get_region_info_type
  vfio_has_region_cap         -> vfio_device_has_region_cap
  vfio_reset_handler          -> vfio_device_reset_hander

to better reflect the namespace they belong to.

Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Link: https://lore.kernel.org/qemu-devel/20250326075122.1299361-37-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/ap.c                  | 12 +++----
 hw/vfio/ccw.c                 | 28 +++++++--------
 hw/vfio/container-base.c      |  6 ++--
 hw/vfio/container.c           |  6 ++--
 hw/vfio/device.c              | 36 +++++++++----------
 hw/vfio/display.c             |  8 ++---
 hw/vfio/igd.c                 | 10 +++---
 hw/vfio/pci.c                 | 68 +++++++++++++++++------------------
 hw/vfio/platform.c            | 14 ++++----
 hw/vfio/region.c              |  2 +-
 hw/vfio/trace-events          |  8 ++---
 include/hw/vfio/vfio-device.h | 26 +++++++-------
 12 files changed, 112 insertions(+), 112 deletions(-)

diff --git a/hw/vfio/ap.c b/hw/vfio/ap.c
index 9e2251437e..be2e2927c2 100644
--- a/hw/vfio/ap.c
+++ b/hw/vfio/ap.c
@@ -117,8 +117,8 @@ static bool vfio_ap_register_irq_notifier(VFIOAPDevice *vapdev,
     fd = event_notifier_get_fd(notifier);
     qemu_set_fd_handler(fd, fd_read, NULL, vapdev);
 
-    if (!vfio_set_irq_signaling(vdev, irq, 0, VFIO_IRQ_SET_ACTION_TRIGGER, fd,
-                                errp)) {
+    if (!vfio_device_irq_set_signaling(vdev, irq, 0, VFIO_IRQ_SET_ACTION_TRIGGER, fd,
+                                       errp)) {
         qemu_set_fd_handler(fd, NULL, NULL, vapdev);
         event_notifier_cleanup(notifier);
     }
@@ -141,8 +141,8 @@ static void vfio_ap_unregister_irq_notifier(VFIOAPDevice *vapdev,
         return;
     }
 
-    if (!vfio_set_irq_signaling(&vapdev->vdev, irq, 0,
-                                VFIO_IRQ_SET_ACTION_TRIGGER, -1, &err)) {
+    if (!vfio_device_irq_set_signaling(&vapdev->vdev, irq, 0,
+                                       VFIO_IRQ_SET_ACTION_TRIGGER, -1, &err)) {
         warn_reportf_err(err, VFIO_MSG_PREFIX, vapdev->vdev.name);
     }
 
@@ -162,7 +162,7 @@ static void vfio_ap_realize(DeviceState *dev, Error **errp)
         return;
     }
 
-    if (!vfio_attach_device(vbasedev->name, vbasedev,
+    if (!vfio_device_attach(vbasedev->name, vbasedev,
                             &address_space_memory, errp)) {
         goto error;
     }
@@ -187,7 +187,7 @@ static void vfio_ap_unrealize(DeviceState *dev)
     VFIOAPDevice *vapdev = VFIO_AP_DEVICE(dev);
 
     vfio_ap_unregister_irq_notifier(vapdev, VFIO_AP_REQ_IRQ_INDEX);
-    vfio_detach_device(&vapdev->vdev);
+    vfio_device_detach(&vapdev->vdev);
     g_free(vapdev->vdev.name);
 }
 
diff --git a/hw/vfio/ccw.c b/hw/vfio/ccw.c
index d0713ca4c7..3a91efce81 100644
--- a/hw/vfio/ccw.c
+++ b/hw/vfio/ccw.c
@@ -426,8 +426,8 @@ static bool vfio_ccw_register_irq_notifier(VFIOCCWDevice *vcdev,
     fd = event_notifier_get_fd(notifier);
     qemu_set_fd_handler(fd, fd_read, NULL, vcdev);
 
-    if (!vfio_set_irq_signaling(vdev, irq, 0,
-                                VFIO_IRQ_SET_ACTION_TRIGGER, fd, errp)) {
+    if (!vfio_device_irq_set_signaling(vdev, irq, 0,
+                                       VFIO_IRQ_SET_ACTION_TRIGGER, fd, errp)) {
         qemu_set_fd_handler(fd, NULL, NULL, vcdev);
         event_notifier_cleanup(notifier);
     }
@@ -456,8 +456,8 @@ static void vfio_ccw_unregister_irq_notifier(VFIOCCWDevice *vcdev,
         return;
     }
 
-    if (!vfio_set_irq_signaling(&vcdev->vdev, irq, 0,
-                                VFIO_IRQ_SET_ACTION_TRIGGER, -1, &err)) {
+    if (!vfio_device_irq_set_signaling(&vcdev->vdev, irq, 0,
+                                       VFIO_IRQ_SET_ACTION_TRIGGER, -1, &err)) {
         warn_reportf_err(err, VFIO_MSG_PREFIX, vcdev->vdev.name);
     }
 
@@ -488,7 +488,7 @@ static bool vfio_ccw_get_region(VFIOCCWDevice *vcdev, Error **errp)
         return false;
     }
 
-    ret = vfio_get_region_info(vdev, VFIO_CCW_CONFIG_REGION_INDEX, &info);
+    ret = vfio_device_get_region_info(vdev, VFIO_CCW_CONFIG_REGION_INDEX, &info);
     if (ret) {
         error_setg_errno(errp, -ret, "vfio: Error getting config info");
         return false;
@@ -505,8 +505,8 @@ static bool vfio_ccw_get_region(VFIOCCWDevice *vcdev, Error **errp)
     g_free(info);
 
     /* check for the optional async command region */
-    ret = vfio_get_dev_region_info(vdev, VFIO_REGION_TYPE_CCW,
-                                   VFIO_REGION_SUBTYPE_CCW_ASYNC_CMD, &info);
+    ret = vfio_device_get_region_info_type(vdev, VFIO_REGION_TYPE_CCW,
+                                           VFIO_REGION_SUBTYPE_CCW_ASYNC_CMD, &info);
     if (!ret) {
         vcdev->async_cmd_region_size = info->size;
         if (sizeof(*vcdev->async_cmd_region) != vcdev->async_cmd_region_size) {
@@ -518,8 +518,8 @@ static bool vfio_ccw_get_region(VFIOCCWDevice *vcdev, Error **errp)
         g_free(info);
     }
 
-    ret = vfio_get_dev_region_info(vdev, VFIO_REGION_TYPE_CCW,
-                                   VFIO_REGION_SUBTYPE_CCW_SCHIB, &info);
+    ret = vfio_device_get_region_info_type(vdev, VFIO_REGION_TYPE_CCW,
+                                           VFIO_REGION_SUBTYPE_CCW_SCHIB, &info);
     if (!ret) {
         vcdev->schib_region_size = info->size;
         if (sizeof(*vcdev->schib_region) != vcdev->schib_region_size) {
@@ -531,8 +531,8 @@ static bool vfio_ccw_get_region(VFIOCCWDevice *vcdev, Error **errp)
         g_free(info);
     }
 
-    ret = vfio_get_dev_region_info(vdev, VFIO_REGION_TYPE_CCW,
-                                   VFIO_REGION_SUBTYPE_CCW_CRW, &info);
+    ret = vfio_device_get_region_info_type(vdev, VFIO_REGION_TYPE_CCW,
+                                           VFIO_REGION_SUBTYPE_CCW_CRW, &info);
 
     if (!ret) {
         vcdev->crw_region_size = info->size;
@@ -583,7 +583,7 @@ static void vfio_ccw_realize(DeviceState *dev, Error **errp)
         goto out_unrealize;
     }
 
-    if (!vfio_attach_device(cdev->mdevid, vbasedev,
+    if (!vfio_device_attach(cdev->mdevid, vbasedev,
                             &address_space_memory, errp)) {
         goto out_attach_dev_err;
     }
@@ -620,7 +620,7 @@ out_irq_notifier_err:
 out_io_notifier_err:
     vfio_ccw_put_region(vcdev);
 out_region_err:
-    vfio_detach_device(vbasedev);
+    vfio_device_detach(vbasedev);
 out_attach_dev_err:
     g_free(vbasedev->name);
 out_unrealize:
@@ -639,7 +639,7 @@ static void vfio_ccw_unrealize(DeviceState *dev)
     vfio_ccw_unregister_irq_notifier(vcdev, VFIO_CCW_CRW_IRQ_INDEX);
     vfio_ccw_unregister_irq_notifier(vcdev, VFIO_CCW_IO_IRQ_INDEX);
     vfio_ccw_put_region(vcdev);
-    vfio_detach_device(&vcdev->vdev);
+    vfio_device_detach(&vcdev->vdev);
     g_free(vcdev->vdev.name);
 
     if (cdc->unrealize) {
diff --git a/hw/vfio/container-base.c b/hw/vfio/container-base.c
index c037bafe21..09340fd97a 100644
--- a/hw/vfio/container-base.c
+++ b/hw/vfio/container-base.c
@@ -19,7 +19,7 @@
 #include "qapi/error.h"
 #include "qemu/error-report.h"
 #include "hw/vfio/vfio-container-base.h"
-#include "hw/vfio/vfio-device.h" /* vfio_reset_handler */
+#include "hw/vfio/vfio-device.h" /* vfio_device_reset_handler */
 #include "system/reset.h"
 #include "vfio-helpers.h"
 
@@ -44,7 +44,7 @@ VFIOAddressSpace *vfio_address_space_get(AddressSpace *as)
     QLIST_INIT(&space->containers);
 
     if (QLIST_EMPTY(&vfio_address_spaces)) {
-        qemu_register_reset(vfio_reset_handler, NULL);
+        qemu_register_reset(vfio_device_reset_handler, NULL);
     }
 
     QLIST_INSERT_HEAD(&vfio_address_spaces, space, list);
@@ -62,7 +62,7 @@ void vfio_address_space_put(VFIOAddressSpace *space)
     g_free(space);
 
     if (QLIST_EMPTY(&vfio_address_spaces)) {
-        qemu_unregister_reset(vfio_reset_handler, NULL);
+        qemu_unregister_reset(vfio_device_reset_handler, NULL);
     }
 }
 
diff --git a/hw/vfio/container.c b/hw/vfio/container.c
index ef14046072..149ea26aff 100644
--- a/hw/vfio/container.c
+++ b/hw/vfio/container.c
@@ -865,7 +865,7 @@ static int vfio_device_groupid(VFIODevice *vbasedev, Error **errp)
 }
 
 /*
- * vfio_attach_device: attach a device to a security context
+ * vfio_device_attach: attach a device to a security context
  * @name and @vbasedev->name are likely to be different depending
  * on the type of the device, hence the need for passing @name
  */
@@ -881,7 +881,7 @@ static bool vfio_legacy_attach_device(const char *name, VFIODevice *vbasedev,
         return false;
     }
 
-    trace_vfio_attach_device(vbasedev->name, groupid);
+    trace_vfio_device_attach(vbasedev->name, groupid);
 
     if (!vfio_device_hiod_realize(vbasedev, errp)) {
         return false;
@@ -919,7 +919,7 @@ static void vfio_legacy_detach_device(VFIODevice *vbasedev)
     QLIST_REMOVE(vbasedev, global_next);
     QLIST_REMOVE(vbasedev, container_next);
     vbasedev->bcontainer = NULL;
-    trace_vfio_detach_device(vbasedev->name, group->groupid);
+    trace_vfio_device_detach(vbasedev->name, group->groupid);
     vfio_put_base_device(vbasedev);
     vfio_put_group(group);
 }
diff --git a/hw/vfio/device.c b/hw/vfio/device.c
index 543750c3b1..4de6948cf4 100644
--- a/hw/vfio/device.c
+++ b/hw/vfio/device.c
@@ -51,11 +51,11 @@ VFIODeviceList vfio_device_list =
  * reset for the one in-use devices case, calling _multi() will do
  * nothing if a _one() would have been sufficient.
  */
-void vfio_reset_handler(void *opaque)
+void vfio_device_reset_handler(void *opaque)
 {
     VFIODevice *vbasedev;
 
-    trace_vfio_reset_handler();
+    trace_vfio_device_reset_handler();
     QLIST_FOREACH(vbasedev, &vfio_device_list, global_next) {
         if (vbasedev->dev->realized) {
             vbasedev->ops->vfio_compute_needs_reset(vbasedev);
@@ -72,7 +72,7 @@ void vfio_reset_handler(void *opaque)
 /*
  * Common VFIO interrupt disable
  */
-void vfio_disable_irqindex(VFIODevice *vbasedev, int index)
+void vfio_device_irq_disable(VFIODevice *vbasedev, int index)
 {
     struct vfio_irq_set irq_set = {
         .argsz = sizeof(irq_set),
@@ -85,7 +85,7 @@ void vfio_disable_irqindex(VFIODevice *vbasedev, int index)
     ioctl(vbasedev->fd, VFIO_DEVICE_SET_IRQS, &irq_set);
 }
 
-void vfio_unmask_single_irqindex(VFIODevice *vbasedev, int index)
+void vfio_device_irq_unmask(VFIODevice *vbasedev, int index)
 {
     struct vfio_irq_set irq_set = {
         .argsz = sizeof(irq_set),
@@ -98,7 +98,7 @@ void vfio_unmask_single_irqindex(VFIODevice *vbasedev, int index)
     ioctl(vbasedev->fd, VFIO_DEVICE_SET_IRQS, &irq_set);
 }
 
-void vfio_mask_single_irqindex(VFIODevice *vbasedev, int index)
+void vfio_device_irq_mask(VFIODevice *vbasedev, int index)
 {
     struct vfio_irq_set irq_set = {
         .argsz = sizeof(irq_set),
@@ -147,8 +147,8 @@ static const char *index_to_str(VFIODevice *vbasedev, int index)
     }
 }
 
-bool vfio_set_irq_signaling(VFIODevice *vbasedev, int index, int subindex,
-                            int action, int fd, Error **errp)
+bool vfio_device_irq_set_signaling(VFIODevice *vbasedev, int index, int subindex,
+                                   int action, int fd, Error **errp)
 {
     ERRP_GUARD();
     g_autofree struct vfio_irq_set *irq_set = NULL;
@@ -185,8 +185,8 @@ bool vfio_set_irq_signaling(VFIODevice *vbasedev, int index, int subindex,
     return false;
 }
 
-int vfio_get_region_info(VFIODevice *vbasedev, int index,
-                         struct vfio_region_info **info)
+int vfio_device_get_region_info(VFIODevice *vbasedev, int index,
+                                struct vfio_region_info **info)
 {
     size_t argsz = sizeof(struct vfio_region_info);
 
@@ -212,8 +212,8 @@ retry:
     return 0;
 }
 
-int vfio_get_dev_region_info(VFIODevice *vbasedev, uint32_t type,
-                             uint32_t subtype, struct vfio_region_info **info)
+int vfio_device_get_region_info_type(VFIODevice *vbasedev, uint32_t type,
+                                     uint32_t subtype, struct vfio_region_info **info)
 {
     int i;
 
@@ -221,7 +221,7 @@ int vfio_get_dev_region_info(VFIODevice *vbasedev, uint32_t type,
         struct vfio_info_cap_header *hdr;
         struct vfio_region_info_cap_type *cap_type;
 
-        if (vfio_get_region_info(vbasedev, i, info)) {
+        if (vfio_device_get_region_info(vbasedev, i, info)) {
             continue;
         }
 
@@ -233,8 +233,8 @@ int vfio_get_dev_region_info(VFIODevice *vbasedev, uint32_t type,
 
         cap_type = container_of(hdr, struct vfio_region_info_cap_type, header);
 
-        trace_vfio_get_dev_region(vbasedev->name, i,
-                                  cap_type->type, cap_type->subtype);
+        trace_vfio_device_get_region_info_type(vbasedev->name, i,
+                                               cap_type->type, cap_type->subtype);
 
         if (cap_type->type == type && cap_type->subtype == subtype) {
             return 0;
@@ -247,12 +247,12 @@ int vfio_get_dev_region_info(VFIODevice *vbasedev, uint32_t type,
     return -ENODEV;
 }
 
-bool vfio_has_region_cap(VFIODevice *vbasedev, int region, uint16_t cap_type)
+bool vfio_device_has_region_cap(VFIODevice *vbasedev, int region, uint16_t cap_type)
 {
     g_autofree struct vfio_region_info *info = NULL;
     bool ret = false;
 
-    if (!vfio_get_region_info(vbasedev, region, &info)) {
+    if (!vfio_device_get_region_info(vbasedev, region, &info)) {
         if (vfio_get_region_info_cap(info, cap_type)) {
             ret = true;
         }
@@ -367,7 +367,7 @@ VFIODevice *vfio_get_vfio_device(Object *obj)
     }
 }
 
-bool vfio_attach_device(char *name, VFIODevice *vbasedev,
+bool vfio_device_attach(char *name, VFIODevice *vbasedev,
                         AddressSpace *as, Error **errp)
 {
     const VFIOIOMMUClass *ops =
@@ -395,7 +395,7 @@ bool vfio_attach_device(char *name, VFIODevice *vbasedev,
     return true;
 }
 
-void vfio_detach_device(VFIODevice *vbasedev)
+void vfio_device_detach(VFIODevice *vbasedev)
 {
     if (!vbasedev->bcontainer) {
         return;
diff --git a/hw/vfio/display.c b/hw/vfio/display.c
index 70cfd685bd..f3e6581f15 100644
--- a/hw/vfio/display.c
+++ b/hw/vfio/display.c
@@ -129,10 +129,10 @@ static bool vfio_display_edid_init(VFIOPCIDevice *vdev, Error **errp)
     int fd = vdev->vbasedev.fd;
     int ret;
 
-    ret = vfio_get_dev_region_info(&vdev->vbasedev,
-                                   VFIO_REGION_TYPE_GFX,
-                                   VFIO_REGION_SUBTYPE_GFX_EDID,
-                                   &dpy->edid_info);
+    ret = vfio_device_get_region_info_type(&vdev->vbasedev,
+                                           VFIO_REGION_TYPE_GFX,
+                                           VFIO_REGION_SUBTYPE_GFX_EDID,
+                                           &dpy->edid_info);
     if (ret) {
         /* Failed to get GFX edid info, allow to go through without edid. */
         return true;
diff --git a/hw/vfio/igd.c b/hw/vfio/igd.c
index 265fffc2aa..6678e0e5cd 100644
--- a/hw/vfio/igd.c
+++ b/hw/vfio/igd.c
@@ -200,7 +200,7 @@ static bool vfio_pci_igd_setup_opregion(VFIOPCIDevice *vdev, Error **errp)
         return false;
     }
 
-    ret = vfio_get_dev_region_info(&vdev->vbasedev,
+    ret = vfio_device_get_region_info_type(&vdev->vbasedev,
                     VFIO_REGION_TYPE_PCI_VENDOR_TYPE | PCI_VENDOR_ID_INTEL,
                     VFIO_REGION_SUBTYPE_INTEL_IGD_OPREGION, &opregion);
     if (ret) {
@@ -385,7 +385,7 @@ static bool vfio_pci_igd_setup_lpc_bridge(VFIOPCIDevice *vdev, Error **errp)
      * Check whether we have all the vfio device specific regions to
      * support LPC quirk (added in Linux v4.6).
      */
-    ret = vfio_get_dev_region_info(&vdev->vbasedev,
+    ret = vfio_device_get_region_info_type(&vdev->vbasedev,
                         VFIO_REGION_TYPE_PCI_VENDOR_TYPE | PCI_VENDOR_ID_INTEL,
                         VFIO_REGION_SUBTYPE_INTEL_IGD_LPC_CFG, &lpc);
     if (ret) {
@@ -393,7 +393,7 @@ static bool vfio_pci_igd_setup_lpc_bridge(VFIOPCIDevice *vdev, Error **errp)
         return false;
     }
 
-    ret = vfio_get_dev_region_info(&vdev->vbasedev,
+    ret = vfio_device_get_region_info_type(&vdev->vbasedev,
                         VFIO_REGION_TYPE_PCI_VENDOR_TYPE | PCI_VENDOR_ID_INTEL,
                         VFIO_REGION_SUBTYPE_INTEL_IGD_HOST_CFG, &host);
     if (ret) {
@@ -542,8 +542,8 @@ static bool vfio_pci_igd_config_quirk(VFIOPCIDevice *vdev, Error **errp)
          * there's no ROM, there's no point in setting up this quirk.
          * NB. We only seem to get BIOS ROMs, so UEFI VM would need CSM support.
          */
-        ret = vfio_get_region_info(&vdev->vbasedev,
-                                   VFIO_PCI_ROM_REGION_INDEX, &rom);
+        ret = vfio_device_get_region_info(&vdev->vbasedev,
+                                          VFIO_PCI_ROM_REGION_INDEX, &rom);
         if ((ret || !rom->size) && !vdev->pdev.romfile) {
             error_setg(&err, "Device has no ROM");
             goto error;
diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index bade3b80d7..6fa7217db8 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -115,7 +115,7 @@ static void vfio_intx_eoi(VFIODevice *vbasedev)
 
     vdev->intx.pending = false;
     pci_irq_deassert(&vdev->pdev);
-    vfio_unmask_single_irqindex(vbasedev, VFIO_PCI_INTX_IRQ_INDEX);
+    vfio_device_irq_unmask(vbasedev, VFIO_PCI_INTX_IRQ_INDEX);
 }
 
 static bool vfio_intx_enable_kvm(VFIOPCIDevice *vdev, Error **errp)
@@ -131,7 +131,7 @@ static bool vfio_intx_enable_kvm(VFIOPCIDevice *vdev, Error **errp)
 
     /* Get to a known interrupt state */
     qemu_set_fd_handler(irq_fd, NULL, NULL, vdev);
-    vfio_mask_single_irqindex(&vdev->vbasedev, VFIO_PCI_INTX_IRQ_INDEX);
+    vfio_device_irq_mask(&vdev->vbasedev, VFIO_PCI_INTX_IRQ_INDEX);
     vdev->intx.pending = false;
     pci_irq_deassert(&vdev->pdev);
 
@@ -149,15 +149,15 @@ static bool vfio_intx_enable_kvm(VFIOPCIDevice *vdev, Error **errp)
         goto fail_irqfd;
     }
 
-    if (!vfio_set_irq_signaling(&vdev->vbasedev, VFIO_PCI_INTX_IRQ_INDEX, 0,
-                                VFIO_IRQ_SET_ACTION_UNMASK,
-                                event_notifier_get_fd(&vdev->intx.unmask),
-                                errp)) {
+    if (!vfio_device_irq_set_signaling(&vdev->vbasedev, VFIO_PCI_INTX_IRQ_INDEX, 0,
+                                       VFIO_IRQ_SET_ACTION_UNMASK,
+                                       event_notifier_get_fd(&vdev->intx.unmask),
+                                       errp)) {
         goto fail_vfio;
     }
 
     /* Let'em rip */
-    vfio_unmask_single_irqindex(&vdev->vbasedev, VFIO_PCI_INTX_IRQ_INDEX);
+    vfio_device_irq_unmask(&vdev->vbasedev, VFIO_PCI_INTX_IRQ_INDEX);
 
     vdev->intx.kvm_accel = true;
 
@@ -172,7 +172,7 @@ fail_irqfd:
     event_notifier_cleanup(&vdev->intx.unmask);
 fail:
     qemu_set_fd_handler(irq_fd, vfio_intx_interrupt, NULL, vdev);
-    vfio_unmask_single_irqindex(&vdev->vbasedev, VFIO_PCI_INTX_IRQ_INDEX);
+    vfio_device_irq_unmask(&vdev->vbasedev, VFIO_PCI_INTX_IRQ_INDEX);
     return false;
 #else
     return true;
@@ -190,7 +190,7 @@ static void vfio_intx_disable_kvm(VFIOPCIDevice *vdev)
      * Get to a known state, hardware masked, QEMU ready to accept new
      * interrupts, QEMU IRQ de-asserted.
      */
-    vfio_mask_single_irqindex(&vdev->vbasedev, VFIO_PCI_INTX_IRQ_INDEX);
+    vfio_device_irq_mask(&vdev->vbasedev, VFIO_PCI_INTX_IRQ_INDEX);
     vdev->intx.pending = false;
     pci_irq_deassert(&vdev->pdev);
 
@@ -210,7 +210,7 @@ static void vfio_intx_disable_kvm(VFIOPCIDevice *vdev)
     vdev->intx.kvm_accel = false;
 
     /* If we've missed an event, let it re-fire through QEMU */
-    vfio_unmask_single_irqindex(&vdev->vbasedev, VFIO_PCI_INTX_IRQ_INDEX);
+    vfio_device_irq_unmask(&vdev->vbasedev, VFIO_PCI_INTX_IRQ_INDEX);
 
     trace_vfio_intx_disable_kvm(vdev->vbasedev.name);
 #endif
@@ -299,7 +299,7 @@ static bool vfio_intx_enable(VFIOPCIDevice *vdev, Error **errp)
     fd = event_notifier_get_fd(&vdev->intx.interrupt);
     qemu_set_fd_handler(fd, vfio_intx_interrupt, NULL, vdev);
 
-    if (!vfio_set_irq_signaling(&vdev->vbasedev, VFIO_PCI_INTX_IRQ_INDEX, 0,
+    if (!vfio_device_irq_set_signaling(&vdev->vbasedev, VFIO_PCI_INTX_IRQ_INDEX, 0,
                                 VFIO_IRQ_SET_ACTION_TRIGGER, fd, errp)) {
         qemu_set_fd_handler(fd, NULL, NULL, vdev);
         event_notifier_cleanup(&vdev->intx.interrupt);
@@ -322,7 +322,7 @@ static void vfio_intx_disable(VFIOPCIDevice *vdev)
 
     timer_del(vdev->intx.mmap_timer);
     vfio_intx_disable_kvm(vdev);
-    vfio_disable_irqindex(&vdev->vbasedev, VFIO_PCI_INTX_IRQ_INDEX);
+    vfio_device_irq_disable(&vdev->vbasedev, VFIO_PCI_INTX_IRQ_INDEX);
     vdev->intx.pending = false;
     pci_irq_deassert(&vdev->pdev);
     vfio_mmap_set_enabled(vdev, true);
@@ -578,7 +578,7 @@ static int vfio_msix_vector_do_use(PCIDevice *pdev, unsigned int nr,
 
     if (!vdev->defer_kvm_irq_routing) {
         if (vdev->msix->noresize && resizing) {
-            vfio_disable_irqindex(&vdev->vbasedev, VFIO_PCI_MSIX_IRQ_INDEX);
+            vfio_device_irq_disable(&vdev->vbasedev, VFIO_PCI_MSIX_IRQ_INDEX);
             ret = vfio_enable_vectors(vdev, true);
             if (ret) {
                 error_report("vfio: failed to enable vectors, %d", ret);
@@ -593,7 +593,7 @@ static int vfio_msix_vector_do_use(PCIDevice *pdev, unsigned int nr,
                 fd = event_notifier_get_fd(&vector->interrupt);
             }
 
-            if (!vfio_set_irq_signaling(&vdev->vbasedev,
+            if (!vfio_device_irq_set_signaling(&vdev->vbasedev,
                                         VFIO_PCI_MSIX_IRQ_INDEX, nr,
                                         VFIO_IRQ_SET_ACTION_TRIGGER, fd,
                                         &err)) {
@@ -638,7 +638,7 @@ static void vfio_msix_vector_release(PCIDevice *pdev, unsigned int nr)
         int32_t fd = event_notifier_get_fd(&vector->interrupt);
         Error *err = NULL;
 
-        if (!vfio_set_irq_signaling(&vdev->vbasedev, VFIO_PCI_MSIX_IRQ_INDEX,
+        if (!vfio_device_irq_set_signaling(&vdev->vbasedev, VFIO_PCI_MSIX_IRQ_INDEX,
                                     nr, VFIO_IRQ_SET_ACTION_TRIGGER, fd,
                                     &err)) {
             error_reportf_err(err, VFIO_MSG_PREFIX, vdev->vbasedev.name);
@@ -835,7 +835,7 @@ static void vfio_msix_disable(VFIOPCIDevice *vdev)
      * Always clear MSI-X IRQ index. A PF device could have enabled
      * MSI-X with no vectors. See vfio_msix_enable().
      */
-    vfio_disable_irqindex(&vdev->vbasedev, VFIO_PCI_MSIX_IRQ_INDEX);
+    vfio_device_irq_disable(&vdev->vbasedev, VFIO_PCI_MSIX_IRQ_INDEX);
 
     vfio_msi_disable_common(vdev);
     if (!vfio_intx_enable(vdev, &err)) {
@@ -852,7 +852,7 @@ static void vfio_msi_disable(VFIOPCIDevice *vdev)
 {
     Error *err = NULL;
 
-    vfio_disable_irqindex(&vdev->vbasedev, VFIO_PCI_MSI_IRQ_INDEX);
+    vfio_device_irq_disable(&vdev->vbasedev, VFIO_PCI_MSI_IRQ_INDEX);
     vfio_msi_disable_common(vdev);
     vfio_intx_enable(vdev, &err);
     if (err) {
@@ -886,8 +886,8 @@ static void vfio_pci_load_rom(VFIOPCIDevice *vdev)
     off_t off = 0;
     ssize_t bytes;
 
-    if (vfio_get_region_info(&vdev->vbasedev,
-                             VFIO_PCI_ROM_REGION_INDEX, &reg_info)) {
+    if (vfio_device_get_region_info(&vdev->vbasedev,
+                                    VFIO_PCI_ROM_REGION_INDEX, &reg_info)) {
         error_report("vfio: Error getting ROM info: %m");
         return;
     }
@@ -1380,8 +1380,8 @@ static void vfio_pci_fixup_msix_region(VFIOPCIDevice *vdev)
      * If the host driver allows mapping of a MSIX data, we are going to
      * do map the entire BAR and emulate MSIX table on top of that.
      */
-    if (vfio_has_region_cap(&vdev->vbasedev, region->nr,
-                            VFIO_REGION_INFO_CAP_MSIX_MAPPABLE)) {
+    if (vfio_device_has_region_cap(&vdev->vbasedev, region->nr,
+                                   VFIO_REGION_INFO_CAP_MSIX_MAPPABLE)) {
         return;
     }
 
@@ -2673,7 +2673,7 @@ bool vfio_populate_vga(VFIOPCIDevice *vdev, Error **errp)
     g_autofree struct vfio_region_info *reg_info = NULL;
     int ret;
 
-    ret = vfio_get_region_info(vbasedev, VFIO_PCI_VGA_REGION_INDEX, &reg_info);
+    ret = vfio_device_get_region_info(vbasedev, VFIO_PCI_VGA_REGION_INDEX, &reg_info);
     if (ret) {
         error_setg_errno(errp, -ret,
                          "failed getting region info for VGA region index %d",
@@ -2771,8 +2771,8 @@ static bool vfio_populate_device(VFIOPCIDevice *vdev, Error **errp)
         QLIST_INIT(&vdev->bars[i].quirks);
     }
 
-    ret = vfio_get_region_info(vbasedev,
-                               VFIO_PCI_CONFIG_REGION_INDEX, &reg_info);
+    ret = vfio_device_get_region_info(vbasedev,
+                                      VFIO_PCI_CONFIG_REGION_INDEX, &reg_info);
     if (ret) {
         error_setg_errno(errp, -ret, "failed to get config info");
         return false;
@@ -2816,7 +2816,7 @@ static bool vfio_populate_device(VFIOPCIDevice *vdev, Error **errp)
 
 static void vfio_pci_put_device(VFIOPCIDevice *vdev)
 {
-    vfio_detach_device(&vdev->vbasedev);
+    vfio_device_detach(&vdev->vbasedev);
 
     g_free(vdev->vbasedev.name);
     g_free(vdev->msix);
@@ -2868,8 +2868,8 @@ static void vfio_register_err_notifier(VFIOPCIDevice *vdev)
     fd = event_notifier_get_fd(&vdev->err_notifier);
     qemu_set_fd_handler(fd, vfio_err_notifier_handler, NULL, vdev);
 
-    if (!vfio_set_irq_signaling(&vdev->vbasedev, VFIO_PCI_ERR_IRQ_INDEX, 0,
-                                VFIO_IRQ_SET_ACTION_TRIGGER, fd, &err)) {
+    if (!vfio_device_irq_set_signaling(&vdev->vbasedev, VFIO_PCI_ERR_IRQ_INDEX, 0,
+                                       VFIO_IRQ_SET_ACTION_TRIGGER, fd, &err)) {
         error_reportf_err(err, VFIO_MSG_PREFIX, vdev->vbasedev.name);
         qemu_set_fd_handler(fd, NULL, NULL, vdev);
         event_notifier_cleanup(&vdev->err_notifier);
@@ -2885,8 +2885,8 @@ static void vfio_unregister_err_notifier(VFIOPCIDevice *vdev)
         return;
     }
 
-    if (!vfio_set_irq_signaling(&vdev->vbasedev, VFIO_PCI_ERR_IRQ_INDEX, 0,
-                                VFIO_IRQ_SET_ACTION_TRIGGER, -1, &err)) {
+    if (!vfio_device_irq_set_signaling(&vdev->vbasedev, VFIO_PCI_ERR_IRQ_INDEX, 0,
+                                       VFIO_IRQ_SET_ACTION_TRIGGER, -1, &err)) {
         error_reportf_err(err, VFIO_MSG_PREFIX, vdev->vbasedev.name);
     }
     qemu_set_fd_handler(event_notifier_get_fd(&vdev->err_notifier),
@@ -2933,8 +2933,8 @@ static void vfio_register_req_notifier(VFIOPCIDevice *vdev)
     fd = event_notifier_get_fd(&vdev->req_notifier);
     qemu_set_fd_handler(fd, vfio_req_notifier_handler, NULL, vdev);
 
-    if (!vfio_set_irq_signaling(&vdev->vbasedev, VFIO_PCI_REQ_IRQ_INDEX, 0,
-                                VFIO_IRQ_SET_ACTION_TRIGGER, fd, &err)) {
+    if (!vfio_device_irq_set_signaling(&vdev->vbasedev, VFIO_PCI_REQ_IRQ_INDEX, 0,
+                                       VFIO_IRQ_SET_ACTION_TRIGGER, fd, &err)) {
         error_reportf_err(err, VFIO_MSG_PREFIX, vdev->vbasedev.name);
         qemu_set_fd_handler(fd, NULL, NULL, vdev);
         event_notifier_cleanup(&vdev->req_notifier);
@@ -2951,8 +2951,8 @@ static void vfio_unregister_req_notifier(VFIOPCIDevice *vdev)
         return;
     }
 
-    if (!vfio_set_irq_signaling(&vdev->vbasedev, VFIO_PCI_REQ_IRQ_INDEX, 0,
-                                VFIO_IRQ_SET_ACTION_TRIGGER, -1, &err)) {
+    if (!vfio_device_irq_set_signaling(&vdev->vbasedev, VFIO_PCI_REQ_IRQ_INDEX, 0,
+                                       VFIO_IRQ_SET_ACTION_TRIGGER, -1, &err)) {
         error_reportf_err(err, VFIO_MSG_PREFIX, vdev->vbasedev.name);
     }
     qemu_set_fd_handler(event_notifier_get_fd(&vdev->req_notifier),
@@ -3015,7 +3015,7 @@ static void vfio_realize(PCIDevice *pdev, Error **errp)
         name = g_strdup(vbasedev->name);
     }
 
-    if (!vfio_attach_device(name, vbasedev,
+    if (!vfio_device_attach(name, vbasedev,
                             pci_device_iommu_address_space(pdev), errp)) {
         goto error;
     }
diff --git a/hw/vfio/platform.c b/hw/vfio/platform.c
index ca6528cc56..49cd9816c3 100644
--- a/hw/vfio/platform.c
+++ b/hw/vfio/platform.c
@@ -119,8 +119,8 @@ static int vfio_set_trigger_eventfd(VFIOINTp *intp,
 
     qemu_set_fd_handler(fd, (IOHandler *)handler, NULL, intp);
 
-    if (!vfio_set_irq_signaling(vbasedev, intp->pin, 0,
-                                VFIO_IRQ_SET_ACTION_TRIGGER, fd, &err)) {
+    if (!vfio_device_irq_set_signaling(vbasedev, intp->pin, 0,
+                                       VFIO_IRQ_SET_ACTION_TRIGGER, fd, &err)) {
         error_reportf_err(err, VFIO_MSG_PREFIX, vbasedev->name);
         qemu_set_fd_handler(fd, NULL, NULL, NULL);
         return -EINVAL;
@@ -301,7 +301,7 @@ static void vfio_platform_eoi(VFIODevice *vbasedev)
 
             if (vfio_irq_is_automasked(intp)) {
                 /* unmasks the physical level-sensitive IRQ */
-                vfio_unmask_single_irqindex(vbasedev, intp->pin);
+                vfio_device_irq_unmask(vbasedev, intp->pin);
             }
 
             /* a single IRQ can be active at a time */
@@ -357,8 +357,8 @@ static int vfio_set_resample_eventfd(VFIOINTp *intp)
     Error *err = NULL;
 
     qemu_set_fd_handler(fd, NULL, NULL, NULL);
-    if (!vfio_set_irq_signaling(vbasedev, intp->pin, 0,
-                                VFIO_IRQ_SET_ACTION_UNMASK, fd, &err)) {
+    if (!vfio_device_irq_set_signaling(vbasedev, intp->pin, 0,
+                                       VFIO_IRQ_SET_ACTION_UNMASK, fd, &err)) {
         error_reportf_err(err, VFIO_MSG_PREFIX, vbasedev->name);
         return -EINVAL;
     }
@@ -546,7 +546,7 @@ static bool vfio_base_device_init(VFIODevice *vbasedev, Error **errp)
         return false;
     }
 
-    if (!vfio_attach_device(vbasedev->name, vbasedev,
+    if (!vfio_device_attach(vbasedev->name, vbasedev,
                             &address_space_memory, errp)) {
         return false;
     }
@@ -555,7 +555,7 @@ static bool vfio_base_device_init(VFIODevice *vbasedev, Error **errp)
         return true;
     }
 
-    vfio_detach_device(vbasedev);
+    vfio_device_detach(vbasedev);
     return false;
 }
 
diff --git a/hw/vfio/region.c b/hw/vfio/region.c
index 010b5241e1..04bf9eb098 100644
--- a/hw/vfio/region.c
+++ b/hw/vfio/region.c
@@ -185,7 +185,7 @@ int vfio_region_setup(Object *obj, VFIODevice *vbasedev, VFIORegion *region,
     g_autofree struct vfio_region_info *info = NULL;
     int ret;
 
-    ret = vfio_get_region_info(vbasedev, index, &info);
+    ret = vfio_device_get_region_info(vbasedev, index, &info);
     if (ret) {
         return ret;
     }
diff --git a/hw/vfio/trace-events b/hw/vfio/trace-events
index ddb1bcc24a..8843560576 100644
--- a/hw/vfio/trace-events
+++ b/hw/vfio/trace-events
@@ -37,8 +37,6 @@ vfio_pci_hot_reset_dep_devices(int domain, int bus, int slot, int function, int
 vfio_pci_hot_reset_result(const char *name, const char *result) "%s hot reset: %s"
 vfio_populate_device_config(const char *name, unsigned long size, unsigned long offset, unsigned long flags) "Device '%s' config: size: 0x%lx, offset: 0x%lx, flags: 0x%lx"
 vfio_populate_device_get_irq_info_failure(const char *errstr) "VFIO_DEVICE_GET_IRQ_INFO failure: %s"
-vfio_attach_device(const char *name, int group_id) " (%s) group %d"
-vfio_detach_device(const char *name, int group_id) " (%s) group %d"
 vfio_mdev(const char *name, bool is_mdev) " (%s) is_mdev %d"
 vfio_add_ext_cap_dropped(const char *name, uint16_t cap, uint16_t offset) "%s 0x%x@0x%x"
 vfio_pci_reset(const char *name) " (%s)"
@@ -196,5 +194,7 @@ iommufd_cdev_device_info(char *name, int devfd, int num_irqs, int num_regions, i
 iommufd_cdev_pci_hot_reset_dep_devices(int domain, int bus, int slot, int function, int dev_id) "\t%04x:%02x:%02x.%x devid %d"
 
 # device.c
-vfio_get_dev_region(const char *name, int index, uint32_t type, uint32_t subtype) "%s index %d, %08x/%08x"
-vfio_reset_handler(void) ""
+vfio_device_get_region_info_type(const char *name, int index, uint32_t type, uint32_t subtype) "%s index %d, %08x/%08x"
+vfio_device_reset_handler(void) ""
+vfio_device_attach(const char *name, int group_id) " (%s) group %d"
+vfio_device_detach(const char *name, int group_id) " (%s) group %d"
diff --git a/include/hw/vfio/vfio-device.h b/include/hw/vfio/vfio-device.h
index cfbe254e31..696ed87f01 100644
--- a/include/hw/vfio/vfio-device.h
+++ b/include/hw/vfio/vfio-device.h
@@ -115,29 +115,29 @@ struct VFIODeviceOps {
     int (*vfio_load_config)(VFIODevice *vdev, QEMUFile *f);
 };
 
-void vfio_disable_irqindex(VFIODevice *vbasedev, int index);
-void vfio_unmask_single_irqindex(VFIODevice *vbasedev, int index);
-void vfio_mask_single_irqindex(VFIODevice *vbasedev, int index);
-bool vfio_set_irq_signaling(VFIODevice *vbasedev, int index, int subindex,
-                            int action, int fd, Error **errp);
+void vfio_device_irq_disable(VFIODevice *vbasedev, int index);
+void vfio_device_irq_unmask(VFIODevice *vbasedev, int index);
+void vfio_device_irq_mask(VFIODevice *vbasedev, int index);
+bool vfio_device_irq_set_signaling(VFIODevice *vbasedev, int index, int subindex,
+                                   int action, int fd, Error **errp);
 
-void vfio_reset_handler(void *opaque);
+void vfio_device_reset_handler(void *opaque);
 bool vfio_device_is_mdev(VFIODevice *vbasedev);
 bool vfio_device_hiod_realize(VFIODevice *vbasedev, Error **errp);
-bool vfio_attach_device(char *name, VFIODevice *vbasedev,
+bool vfio_device_attach(char *name, VFIODevice *vbasedev,
                         AddressSpace *as, Error **errp);
-void vfio_detach_device(VFIODevice *vbasedev);
+void vfio_device_detach(VFIODevice *vbasedev);
 VFIODevice *vfio_get_vfio_device(Object *obj);
 
 typedef QLIST_HEAD(VFIODeviceList, VFIODevice) VFIODeviceList;
 extern VFIODeviceList vfio_device_list;
 
 #ifdef CONFIG_LINUX
-int vfio_get_region_info(VFIODevice *vbasedev, int index,
-                         struct vfio_region_info **info);
-int vfio_get_dev_region_info(VFIODevice *vbasedev, uint32_t type,
-                             uint32_t subtype, struct vfio_region_info **info);
-bool vfio_has_region_cap(VFIODevice *vbasedev, int region, uint16_t cap_type);
+int vfio_device_get_region_info(VFIODevice *vbasedev, int index,
+                                struct vfio_region_info **info);
+int vfio_device_get_region_info_type(VFIODevice *vbasedev, uint32_t type,
+                                     uint32_t subtype, struct vfio_region_info **info);
+bool vfio_device_has_region_cap(VFIODevice *vbasedev, int region, uint16_t cap_type);
 #endif
 
 /* Returns 0 on success, or a negative errno. */

From 7d810bb166820237f57b8e20272a366af2641f35 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Wed, 26 Mar 2025 08:51:22 +0100
Subject: [PATCH 0287/2760] vfio: Rename VFIOContainer related services
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Rename these routines :

  vfio_put_group -> vfio_group_put
  vfio_get_group -> vfio_group_get
  vfio_kvm_device_del_group -> vfio_group_del_kvm_device
  vfio_kvm_device_add_group -> vfio_group_add_kvm_device
  vfio_get_device -> vfio_device_get
  vfio_put_base_device -> vfio_device_put
  vfio_device_groupid -> vfio_device_get_groupid
  vfio_connect_container -> vfio_container_connect
  vfio_disconnect_container -> vfio_container_disconnect

to better reflect the namespace they belong to.

Reviewed-by: John Levon <john.levon@nutanix.com>
Link: https://lore.kernel.org/qemu-devel/20250318095415.670319-30-clg@redhat.com
Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Link: https://lore.kernel.org/qemu-devel/20250326075122.1299361-38-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/container.c  | 52 ++++++++++++++++++++++----------------------
 hw/vfio/trace-events | 12 +++++-----
 2 files changed, 33 insertions(+), 31 deletions(-)

diff --git a/hw/vfio/container.c b/hw/vfio/container.c
index 149ea26aff..7177747603 100644
--- a/hw/vfio/container.c
+++ b/hw/vfio/container.c
@@ -306,7 +306,7 @@ static bool vfio_get_info_iova_range(struct vfio_iommu_type1_info *info,
     return true;
 }
 
-static void vfio_kvm_device_add_group(VFIOGroup *group)
+static void vfio_group_add_kvm_device(VFIOGroup *group)
 {
     Error *err = NULL;
 
@@ -315,7 +315,7 @@ static void vfio_kvm_device_add_group(VFIOGroup *group)
     }
 }
 
-static void vfio_kvm_device_del_group(VFIOGroup *group)
+static void vfio_group_del_kvm_device(VFIOGroup *group)
 {
     Error *err = NULL;
 
@@ -511,7 +511,7 @@ static bool vfio_legacy_setup(VFIOContainerBase *bcontainer, Error **errp)
     return true;
 }
 
-static bool vfio_connect_container(VFIOGroup *group, AddressSpace *as,
+static bool vfio_container_connect(VFIOGroup *group, AddressSpace *as,
                                    Error **errp)
 {
     VFIOContainer *container;
@@ -569,7 +569,7 @@ static bool vfio_connect_container(VFIOGroup *group, AddressSpace *as,
             }
             group->container = container;
             QLIST_INSERT_HEAD(&container->group_list, group, container_next);
-            vfio_kvm_device_add_group(group);
+            vfio_group_add_kvm_device(group);
             return true;
         }
     }
@@ -609,7 +609,7 @@ static bool vfio_connect_container(VFIOGroup *group, AddressSpace *as,
         goto enable_discards_exit;
     }
 
-    vfio_kvm_device_add_group(group);
+    vfio_group_add_kvm_device(group);
 
     vfio_address_space_insert(space, bcontainer);
 
@@ -625,7 +625,7 @@ static bool vfio_connect_container(VFIOGroup *group, AddressSpace *as,
     return true;
 listener_release_exit:
     QLIST_REMOVE(group, container_next);
-    vfio_kvm_device_del_group(group);
+    vfio_group_del_kvm_device(group);
     vfio_listener_unregister(bcontainer);
     if (vioc->release) {
         vioc->release(bcontainer);
@@ -649,7 +649,7 @@ put_space_exit:
     return false;
 }
 
-static void vfio_disconnect_container(VFIOGroup *group)
+static void vfio_container_disconnect(VFIOGroup *group)
 {
     VFIOContainer *container = group->container;
     VFIOContainerBase *bcontainer = &container->bcontainer;
@@ -678,7 +678,7 @@ static void vfio_disconnect_container(VFIOGroup *group)
     if (QLIST_EMPTY(&container->group_list)) {
         VFIOAddressSpace *space = bcontainer->space;
 
-        trace_vfio_disconnect_container(container->fd);
+        trace_vfio_container_disconnect(container->fd);
         vfio_cpr_unregister_container(bcontainer);
         close(container->fd);
         object_unref(container);
@@ -687,7 +687,7 @@ static void vfio_disconnect_container(VFIOGroup *group)
     }
 }
 
-static VFIOGroup *vfio_get_group(int groupid, AddressSpace *as, Error **errp)
+static VFIOGroup *vfio_group_get(int groupid, AddressSpace *as, Error **errp)
 {
     ERRP_GUARD();
     VFIOGroup *group;
@@ -731,7 +731,7 @@ static VFIOGroup *vfio_get_group(int groupid, AddressSpace *as, Error **errp)
     group->groupid = groupid;
     QLIST_INIT(&group->device_list);
 
-    if (!vfio_connect_container(group, as, errp)) {
+    if (!vfio_container_connect(group, as, errp)) {
         error_prepend(errp, "failed to setup container for group %d: ",
                       groupid);
         goto close_fd_exit;
@@ -750,7 +750,7 @@ free_group_exit:
     return NULL;
 }
 
-static void vfio_put_group(VFIOGroup *group)
+static void vfio_group_put(VFIOGroup *group)
 {
     if (!group || !QLIST_EMPTY(&group->device_list)) {
         return;
@@ -759,15 +759,15 @@ static void vfio_put_group(VFIOGroup *group)
     if (!group->ram_block_discard_allowed) {
         vfio_ram_block_discard_disable(group->container, false);
     }
-    vfio_kvm_device_del_group(group);
-    vfio_disconnect_container(group);
+    vfio_group_del_kvm_device(group);
+    vfio_container_disconnect(group);
     QLIST_REMOVE(group, next);
-    trace_vfio_put_group(group->fd);
+    trace_vfio_group_put(group->fd);
     close(group->fd);
     g_free(group);
 }
 
-static bool vfio_get_device(VFIOGroup *group, const char *name,
+static bool vfio_device_get(VFIOGroup *group, const char *name,
                             VFIODevice *vbasedev, Error **errp)
 {
     g_autofree struct vfio_device_info *info = NULL;
@@ -819,25 +819,25 @@ static bool vfio_get_device(VFIOGroup *group, const char *name,
     vbasedev->num_regions = info->num_regions;
     vbasedev->flags = info->flags;
 
-    trace_vfio_get_device(name, info->flags, info->num_regions, info->num_irqs);
+    trace_vfio_device_get(name, info->flags, info->num_regions, info->num_irqs);
 
     vbasedev->reset_works = !!(info->flags & VFIO_DEVICE_FLAGS_RESET);
 
     return true;
 }
 
-static void vfio_put_base_device(VFIODevice *vbasedev)
+static void vfio_device_put(VFIODevice *vbasedev)
 {
     if (!vbasedev->group) {
         return;
     }
     QLIST_REMOVE(vbasedev, next);
     vbasedev->group = NULL;
-    trace_vfio_put_base_device(vbasedev->fd);
+    trace_vfio_device_put(vbasedev->fd);
     close(vbasedev->fd);
 }
 
-static int vfio_device_groupid(VFIODevice *vbasedev, Error **errp)
+static int vfio_device_get_groupid(VFIODevice *vbasedev, Error **errp)
 {
     char *tmp, group_path[PATH_MAX];
     g_autofree char *group_name = NULL;
@@ -872,7 +872,7 @@ static int vfio_device_groupid(VFIODevice *vbasedev, Error **errp)
 static bool vfio_legacy_attach_device(const char *name, VFIODevice *vbasedev,
                                       AddressSpace *as, Error **errp)
 {
-    int groupid = vfio_device_groupid(vbasedev, errp);
+    int groupid = vfio_device_get_groupid(vbasedev, errp);
     VFIODevice *vbasedev_iter;
     VFIOGroup *group;
     VFIOContainerBase *bcontainer;
@@ -887,7 +887,7 @@ static bool vfio_legacy_attach_device(const char *name, VFIODevice *vbasedev,
         return false;
     }
 
-    group = vfio_get_group(groupid, as, errp);
+    group = vfio_group_get(groupid, as, errp);
     if (!group) {
         return false;
     }
@@ -895,12 +895,12 @@ static bool vfio_legacy_attach_device(const char *name, VFIODevice *vbasedev,
     QLIST_FOREACH(vbasedev_iter, &group->device_list, next) {
         if (strcmp(vbasedev_iter->name, vbasedev->name) == 0) {
             error_setg(errp, "device is already attached");
-            vfio_put_group(group);
+            vfio_group_put(group);
             return false;
         }
     }
-    if (!vfio_get_device(group, name, vbasedev, errp)) {
-        vfio_put_group(group);
+    if (!vfio_device_get(group, name, vbasedev, errp)) {
+        vfio_group_put(group);
         return false;
     }
 
@@ -920,8 +920,8 @@ static void vfio_legacy_detach_device(VFIODevice *vbasedev)
     QLIST_REMOVE(vbasedev, container_next);
     vbasedev->bcontainer = NULL;
     trace_vfio_device_detach(vbasedev->name, group->groupid);
-    vfio_put_base_device(vbasedev);
-    vfio_put_group(group);
+    vfio_device_put(vbasedev);
+    vfio_group_put(group);
 }
 
 static int vfio_legacy_pci_hot_reset(VFIODevice *vbasedev, bool single)
diff --git a/hw/vfio/trace-events b/hw/vfio/trace-events
index 8843560576..e90ec9bff8 100644
--- a/hw/vfio/trace-events
+++ b/hw/vfio/trace-events
@@ -99,16 +99,18 @@ vfio_listener_region_add_no_dma_map(const char *name, uint64_t iova, uint64_t si
 vfio_listener_region_del(uint64_t start, uint64_t end) "region_del 0x%"PRIx64" - 0x%"PRIx64
 vfio_device_dirty_tracking_update(uint64_t start, uint64_t end, uint64_t min, uint64_t max) "section 0x%"PRIx64" - 0x%"PRIx64" -> update [0x%"PRIx64" - 0x%"PRIx64"]"
 vfio_device_dirty_tracking_start(int nr_ranges, uint64_t min32, uint64_t max32, uint64_t min64, uint64_t max64, uint64_t minpci, uint64_t maxpci) "nr_ranges %d 32:[0x%"PRIx64" - 0x%"PRIx64"], 64:[0x%"PRIx64" - 0x%"PRIx64"], pci64:[0x%"PRIx64" - 0x%"PRIx64"]"
-vfio_disconnect_container(int fd) "close container->fd=%d"
-vfio_put_group(int fd) "close group->fd=%d"
-vfio_get_device(const char * name, unsigned int flags, unsigned int num_regions, unsigned int num_irqs) "Device %s flags: %u, regions: %u, irqs: %u"
-vfio_put_base_device(int fd) "close vdev->fd=%d"
-vfio_legacy_dma_unmap_overflow_workaround(void) ""
 vfio_iommu_map_dirty_notify(uint64_t iova_start, uint64_t iova_end) "iommu dirty @ 0x%"PRIx64" - 0x%"PRIx64
 
 # container-base.c
 vfio_container_query_dirty_bitmap(uint64_t iova, uint64_t size, uint64_t bitmap_size, uint64_t start, uint64_t dirty_pages) "iova=0x%"PRIx64" size= 0x%"PRIx64" bitmap_size=0x%"PRIx64" start=0x%"PRIx64" dirty_pages=%"PRIu64
 
+# container.c
+vfio_container_disconnect(int fd) "close container->fd=%d"
+vfio_group_put(int fd) "close group->fd=%d"
+vfio_device_get(const char * name, unsigned int flags, unsigned int num_regions, unsigned int num_irqs) "Device %s flags: %u, regions: %u, irqs: %u"
+vfio_device_put(int fd) "close vdev->fd=%d"
+vfio_legacy_dma_unmap_overflow_workaround(void) ""
+
 # region.c
 vfio_region_write(const char *name, int index, uint64_t addr, uint64_t data, unsigned size) " (%s:region%d+0x%"PRIx64", 0x%"PRIx64 ", %d)"
 vfio_region_read(char *name, int index, uint64_t addr, unsigned size, uint64_t data) " (%s:region%d+0x%"PRIx64", %d) = 0x%"PRIx64

From 85ae745edd2815c504a3198410a545e50f583e6a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Tue, 22 Apr 2025 18:29:54 +0200
Subject: [PATCH 0288/2760] MAINTAINERS: Add a maintainer for
 util/vfio-helpers.c
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The NVMe Block device driver makes use of a reduced VFIO library
managing the host interface. These routines are VFIO related and do
not have a maintainer. Move util/vfio-helpers.c under VFIO jurisdiction.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/qemu-devel/20250422162954.210706-1-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 MAINTAINERS | 1 +
 1 file changed, 1 insertion(+)

diff --git a/MAINTAINERS b/MAINTAINERS
index 661a47db5a..a316907e76 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2197,6 +2197,7 @@ M: Alex Williamson <alex.williamson@redhat.com>
 M: Cédric Le Goater <clg@redhat.com>
 S: Supported
 F: hw/vfio/*
+F: util/vfio-helpers.c
 F: include/hw/vfio/
 F: docs/devel/migration/vfio.rst
 F: qapi/vfio.json

From 436114cc4390ff46535229e67e43056196a971c1 Mon Sep 17 00:00:00 2001
From: Zhenzhong Duan <zhenzhong.duan@intel.com>
Date: Wed, 23 Apr 2025 15:28:20 +0800
Subject: [PATCH 0289/2760] vfio/iommufd: Make a separate call to get IOMMU
 capabilities
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Currently we depend on .realize() calling iommufd_backend_get_device_info()
to get IOMMU capabilities and check for dirty page tracking support.

By make a extra separate call, this dependency is removed. This happens
only during device attach, it's not a hot path.

Suggested-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: Joao Martins <joao.m.martins@oracle.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250423072824.3647952-2-zhenzhong.duan@intel.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/iommufd.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/hw/vfio/iommufd.c b/hw/vfio/iommufd.c
index 48db105422..2253778b3a 100644
--- a/hw/vfio/iommufd.c
+++ b/hw/vfio/iommufd.c
@@ -287,7 +287,8 @@ static bool iommufd_cdev_autodomains_get(VFIODevice *vbasedev,
 {
     ERRP_GUARD();
     IOMMUFDBackend *iommufd = vbasedev->iommufd;
-    uint32_t flags = 0;
+    uint32_t type, flags = 0;
+    uint64_t hw_caps;
     VFIOIOASHwpt *hwpt;
     uint32_t hwpt_id;
     int ret;
@@ -324,7 +325,12 @@ static bool iommufd_cdev_autodomains_get(VFIODevice *vbasedev,
      * vfio_migration_realize() may decide to use VF dirty tracking
      * instead.
      */
-    if (vbasedev->hiod->caps.hw_caps & IOMMU_HW_CAP_DIRTY_TRACKING) {
+    if (!iommufd_backend_get_device_info(vbasedev->iommufd, vbasedev->devid,
+                                         &type, NULL, 0, &hw_caps, errp)) {
+        return false;
+    }
+
+    if (hw_caps & IOMMU_HW_CAP_DIRTY_TRACKING) {
         flags = IOMMU_HWPT_ALLOC_DIRTY_TRACKING;
     }
 

From c45d88b8a2f25600c69748bfcf37911412c396ab Mon Sep 17 00:00:00 2001
From: Zhenzhong Duan <zhenzhong.duan@intel.com>
Date: Wed, 23 Apr 2025 15:28:21 +0800
Subject: [PATCH 0290/2760] vfio/iommufd: Move realize() after attachment
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Previously device attaching depends on realize() getting host IOMMU
capabilities to check dirty tracking support.

Now we have a separate call to ioctl(IOMMU_GET_HW_INFO) to get host
IOMMU capabilities and check that for dirty tracking support, there
is no dependency any more, move realize() call after attachment
succeed.

Suggested-by: Cédric Le Goater <clg@redhat.com>
Suggested-by: Donald Dutile <ddutile@redhat.com>
Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: Joao Martins <joao.m.martins@oracle.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250423072824.3647952-3-zhenzhong.duan@intel.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/iommufd.c | 17 ++++++-----------
 1 file changed, 6 insertions(+), 11 deletions(-)

diff --git a/hw/vfio/iommufd.c b/hw/vfio/iommufd.c
index 2253778b3a..f273dc8712 100644
--- a/hw/vfio/iommufd.c
+++ b/hw/vfio/iommufd.c
@@ -500,17 +500,6 @@ static bool iommufd_cdev_attach(const char *name, VFIODevice *vbasedev,
 
     space = vfio_address_space_get(as);
 
-    /*
-     * The HostIOMMUDevice data from legacy backend is static and doesn't need
-     * any information from the (type1-iommu) backend to be initialized. In
-     * contrast however, the IOMMUFD HostIOMMUDevice data requires the iommufd
-     * FD to be connected and having a devid to be able to successfully call
-     * iommufd_backend_get_device_info().
-     */
-    if (!vfio_device_hiod_realize(vbasedev, errp)) {
-        goto err_alloc_ioas;
-    }
-
     /* try to attach to an existing container in this space */
     QLIST_FOREACH(bcontainer, &space->containers, next) {
         container = container_of(bcontainer, VFIOIOMMUFDContainer, bcontainer);
@@ -585,6 +574,10 @@ found_container:
         goto err_listener_register;
     }
 
+    if (!vfio_device_hiod_realize(vbasedev, errp)) {
+        goto err_hiod_realize;
+    }
+
     /*
      * TODO: examine RAM_BLOCK_DISCARD stuff, should we do group level
      * for discarding incompatibility check as well?
@@ -606,6 +599,8 @@ found_container:
                                    vbasedev->num_regions, vbasedev->flags);
     return true;
 
+err_hiod_realize:
+    vfio_cpr_unregister_container(bcontainer);
 err_listener_register:
     iommufd_cdev_ram_block_discard_disable(false);
 err_discard_disable:

From 0327ffc8530e9733526fab6c790ad5f0661b008d Mon Sep 17 00:00:00 2001
From: Zhenzhong Duan <zhenzhong.duan@intel.com>
Date: Wed, 23 Apr 2025 15:28:22 +0800
Subject: [PATCH 0291/2760] vfio/container: Move realize() after attachment
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

To match the change for IOMMUFD backend, move realize() after attachment
for legacy backend too.

Suggested-by: Cédric Le Goater <clg@redhat.com>
Suggested-by: Donald Dutile <ddutile@redhat.com>
Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250423072824.3647952-4-zhenzhong.duan@intel.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/container.c | 20 ++++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/hw/vfio/container.c b/hw/vfio/container.c
index 7177747603..652a6197ce 100644
--- a/hw/vfio/container.c
+++ b/hw/vfio/container.c
@@ -883,10 +883,6 @@ static bool vfio_legacy_attach_device(const char *name, VFIODevice *vbasedev,
 
     trace_vfio_device_attach(vbasedev->name, groupid);
 
-    if (!vfio_device_hiod_realize(vbasedev, errp)) {
-        return false;
-    }
-
     group = vfio_group_get(groupid, as, errp);
     if (!group) {
         return false;
@@ -895,13 +891,15 @@ static bool vfio_legacy_attach_device(const char *name, VFIODevice *vbasedev,
     QLIST_FOREACH(vbasedev_iter, &group->device_list, next) {
         if (strcmp(vbasedev_iter->name, vbasedev->name) == 0) {
             error_setg(errp, "device is already attached");
-            vfio_group_put(group);
-            return false;
+            goto group_put_exit;
         }
     }
     if (!vfio_device_get(group, name, vbasedev, errp)) {
-        vfio_group_put(group);
-        return false;
+        goto group_put_exit;
+    }
+
+    if (!vfio_device_hiod_realize(vbasedev, errp)) {
+        goto device_put_exit;
     }
 
     bcontainer = &group->container->bcontainer;
@@ -910,6 +908,12 @@ static bool vfio_legacy_attach_device(const char *name, VFIODevice *vbasedev,
     QLIST_INSERT_HEAD(&vfio_device_list, vbasedev, global_next);
 
     return true;
+
+device_put_exit:
+    vfio_device_put(vbasedev);
+group_put_exit:
+    vfio_group_put(group);
+    return false;
 }
 
 static void vfio_legacy_detach_device(VFIODevice *vbasedev)

From 0805f829a1aa07888fa7378f9421d37c521c4193 Mon Sep 17 00:00:00 2001
From: Zhenzhong Duan <zhenzhong.duan@intel.com>
Date: Wed, 23 Apr 2025 15:28:23 +0800
Subject: [PATCH 0292/2760] vfio: Cleanup host IOMMU device creation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

realize() is now moved after attachment, do the same for hiod creation.
Introduce a new function vfio_device_hiod_create_and_realize() to do
them all in one go.

Suggested-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250423072824.3647952-5-zhenzhong.duan@intel.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/container.c           |  5 ++++-
 hw/vfio/device.c              | 33 ++++++++++++++-------------------
 hw/vfio/iommufd.c             |  4 +++-
 include/hw/vfio/vfio-device.h |  3 ++-
 4 files changed, 23 insertions(+), 22 deletions(-)

diff --git a/hw/vfio/container.c b/hw/vfio/container.c
index 652a6197ce..78f70e63d6 100644
--- a/hw/vfio/container.c
+++ b/hw/vfio/container.c
@@ -898,7 +898,9 @@ static bool vfio_legacy_attach_device(const char *name, VFIODevice *vbasedev,
         goto group_put_exit;
     }
 
-    if (!vfio_device_hiod_realize(vbasedev, errp)) {
+    if (!vfio_device_hiod_create_and_realize(vbasedev,
+                                             TYPE_HOST_IOMMU_DEVICE_LEGACY_VFIO,
+                                             errp)) {
         goto device_put_exit;
     }
 
@@ -924,6 +926,7 @@ static void vfio_legacy_detach_device(VFIODevice *vbasedev)
     QLIST_REMOVE(vbasedev, container_next);
     vbasedev->bcontainer = NULL;
     trace_vfio_device_detach(vbasedev->name, group->groupid);
+    object_unref(vbasedev->hiod);
     vfio_device_put(vbasedev);
     vfio_group_put(group);
 }
diff --git a/hw/vfio/device.c b/hw/vfio/device.c
index 4de6948cf4..d625a7c4db 100644
--- a/hw/vfio/device.c
+++ b/hw/vfio/device.c
@@ -347,15 +347,24 @@ bool vfio_device_is_mdev(VFIODevice *vbasedev)
     return subsys && (strcmp(subsys, "/sys/bus/mdev") == 0);
 }
 
-bool vfio_device_hiod_realize(VFIODevice *vbasedev, Error **errp)
+bool vfio_device_hiod_create_and_realize(VFIODevice *vbasedev,
+                                         const char *typename, Error **errp)
 {
-    HostIOMMUDevice *hiod = vbasedev->hiod;
+    HostIOMMUDevice *hiod;
 
-    if (!hiod) {
+    if (vbasedev->mdev) {
         return true;
     }
 
-    return HOST_IOMMU_DEVICE_GET_CLASS(hiod)->realize(hiod, vbasedev, errp);
+    hiod = HOST_IOMMU_DEVICE(object_new(typename));
+
+    if (!HOST_IOMMU_DEVICE_GET_CLASS(hiod)->realize(hiod, vbasedev, errp)) {
+        object_unref(hiod);
+        return false;
+    }
+
+    vbasedev->hiod = hiod;
+    return true;
 }
 
 VFIODevice *vfio_get_vfio_device(Object *obj)
@@ -372,7 +381,6 @@ bool vfio_device_attach(char *name, VFIODevice *vbasedev,
 {
     const VFIOIOMMUClass *ops =
         VFIO_IOMMU_CLASS(object_class_by_name(TYPE_VFIO_IOMMU_LEGACY));
-    HostIOMMUDevice *hiod = NULL;
 
     if (vbasedev->iommufd) {
         ops = VFIO_IOMMU_CLASS(object_class_by_name(TYPE_VFIO_IOMMU_IOMMUFD));
@@ -380,19 +388,7 @@ bool vfio_device_attach(char *name, VFIODevice *vbasedev,
 
     assert(ops);
 
-
-    if (!vbasedev->mdev) {
-        hiod = HOST_IOMMU_DEVICE(object_new(ops->hiod_typename));
-        vbasedev->hiod = hiod;
-    }
-
-    if (!ops->attach_device(name, vbasedev, as, errp)) {
-        object_unref(hiod);
-        vbasedev->hiod = NULL;
-        return false;
-    }
-
-    return true;
+    return ops->attach_device(name, vbasedev, as, errp);
 }
 
 void vfio_device_detach(VFIODevice *vbasedev)
@@ -400,6 +396,5 @@ void vfio_device_detach(VFIODevice *vbasedev)
     if (!vbasedev->bcontainer) {
         return;
     }
-    object_unref(vbasedev->hiod);
     VFIO_IOMMU_GET_CLASS(vbasedev->bcontainer)->detach_device(vbasedev);
 }
diff --git a/hw/vfio/iommufd.c b/hw/vfio/iommufd.c
index f273dc8712..8a010a51ea 100644
--- a/hw/vfio/iommufd.c
+++ b/hw/vfio/iommufd.c
@@ -574,7 +574,8 @@ found_container:
         goto err_listener_register;
     }
 
-    if (!vfio_device_hiod_realize(vbasedev, errp)) {
+    if (!vfio_device_hiod_create_and_realize(vbasedev,
+                     TYPE_HOST_IOMMU_DEVICE_IOMMUFD_VFIO, errp)) {
         goto err_hiod_realize;
     }
 
@@ -630,6 +631,7 @@ static void iommufd_cdev_detach(VFIODevice *vbasedev)
         iommufd_cdev_ram_block_discard_disable(false);
     }
 
+    object_unref(vbasedev->hiod);
     vfio_cpr_unregister_container(bcontainer);
     iommufd_cdev_detach_container(vbasedev, container);
     iommufd_cdev_container_destroy(container);
diff --git a/include/hw/vfio/vfio-device.h b/include/hw/vfio/vfio-device.h
index 696ed87f01..81c95bb51e 100644
--- a/include/hw/vfio/vfio-device.h
+++ b/include/hw/vfio/vfio-device.h
@@ -123,7 +123,8 @@ bool vfio_device_irq_set_signaling(VFIODevice *vbasedev, int index, int subindex
 
 void vfio_device_reset_handler(void *opaque);
 bool vfio_device_is_mdev(VFIODevice *vbasedev);
-bool vfio_device_hiod_realize(VFIODevice *vbasedev, Error **errp);
+bool vfio_device_hiod_create_and_realize(VFIODevice *vbasedev,
+                                         const char *typename, Error **errp);
 bool vfio_device_attach(char *name, VFIODevice *vbasedev,
                         AddressSpace *as, Error **errp);
 void vfio_device_detach(VFIODevice *vbasedev);

From fdd75967836ca1affa29ad5a50a690851d310cd9 Mon Sep 17 00:00:00 2001
From: Zhenzhong Duan <zhenzhong.duan@intel.com>
Date: Wed, 23 Apr 2025 15:28:24 +0800
Subject: [PATCH 0293/2760] vfio: Remove hiod_typename property
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Because we handle host IOMMU device creation in each container backend,
we know which type name to use, so hiod_typename property is useless
now, just remove it.

Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250423072824.3647952-6-zhenzhong.duan@intel.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/container.c                   | 2 --
 hw/vfio/iommufd.c                     | 2 --
 include/hw/vfio/vfio-container-base.h | 3 ---
 3 files changed, 7 deletions(-)

diff --git a/hw/vfio/container.c b/hw/vfio/container.c
index 78f70e63d6..29170f0634 100644
--- a/hw/vfio/container.c
+++ b/hw/vfio/container.c
@@ -1103,8 +1103,6 @@ static void vfio_iommu_legacy_class_init(ObjectClass *klass, void *data)
 {
     VFIOIOMMUClass *vioc = VFIO_IOMMU_CLASS(klass);
 
-    vioc->hiod_typename = TYPE_HOST_IOMMU_DEVICE_LEGACY_VFIO;
-
     vioc->setup = vfio_legacy_setup;
     vioc->dma_map = vfio_legacy_dma_map;
     vioc->dma_unmap = vfio_legacy_dma_unmap;
diff --git a/hw/vfio/iommufd.c b/hw/vfio/iommufd.c
index 8a010a51ea..f24054a6a5 100644
--- a/hw/vfio/iommufd.c
+++ b/hw/vfio/iommufd.c
@@ -795,8 +795,6 @@ static void vfio_iommu_iommufd_class_init(ObjectClass *klass, void *data)
 {
     VFIOIOMMUClass *vioc = VFIO_IOMMU_CLASS(klass);
 
-    vioc->hiod_typename = TYPE_HOST_IOMMU_DEVICE_IOMMUFD_VFIO;
-
     vioc->dma_map = iommufd_cdev_map;
     vioc->dma_unmap = iommufd_cdev_unmap;
     vioc->attach_device = iommufd_cdev_attach;
diff --git a/include/hw/vfio/vfio-container-base.h b/include/hw/vfio/vfio-container-base.h
index af63373c92..5527e02722 100644
--- a/include/hw/vfio/vfio-container-base.h
+++ b/include/hw/vfio/vfio-container-base.h
@@ -115,9 +115,6 @@ OBJECT_DECLARE_TYPE(VFIOContainerBase, VFIOIOMMUClass, VFIO_IOMMU)
 struct VFIOIOMMUClass {
     ObjectClass parent_class;
 
-    /* Properties */
-    const char *hiod_typename;
-
     /* basic feature */
     bool (*setup)(VFIOContainerBase *bcontainer, Error **errp);
     int (*dma_map)(const VFIOContainerBase *bcontainer,

From f3028b7d2d9895799159433ccb18180c2d4d1516 Mon Sep 17 00:00:00 2001
From: Zhenzhong Duan <zhenzhong.duan@intel.com>
Date: Thu, 24 Apr 2025 14:33:55 +0800
Subject: [PATCH 0294/2760] vfio: Register/unregister container for CPR only
 once for each container
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

vfio_cpr_register_container and vfio_cpr_unregister_container are container
scoped function. Calling them for each device attaching/detaching would
corrupt CPR reboot notifier list, i.e., when two VFIO devices are attached
to same container and have same notifier registered twice.

Fixes: d9fa4223b30a ("vfio: register container for cpr")
Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250424063355.3855174-1-zhenzhong.duan@intel.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/iommufd.c | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/hw/vfio/iommufd.c b/hw/vfio/iommufd.c
index f24054a6a5..b2f72dc8c3 100644
--- a/hw/vfio/iommufd.c
+++ b/hw/vfio/iommufd.c
@@ -416,6 +416,7 @@ static void iommufd_cdev_container_destroy(VFIOIOMMUFDContainer *container)
     if (!QLIST_EMPTY(&bcontainer->device_list)) {
         return;
     }
+    vfio_cpr_unregister_container(bcontainer);
     vfio_listener_unregister(bcontainer);
     iommufd_backend_free_id(container->be, container->ioas_id);
     object_unref(container);
@@ -561,6 +562,10 @@ static bool iommufd_cdev_attach(const char *name, VFIODevice *vbasedev,
         goto err_listener_register;
     }
 
+    if (!vfio_cpr_register_container(bcontainer, errp)) {
+        goto err_listener_register;
+    }
+
     bcontainer->initialized = true;
 
 found_container:
@@ -570,13 +575,9 @@ found_container:
         goto err_listener_register;
     }
 
-    if (!vfio_cpr_register_container(bcontainer, errp)) {
-        goto err_listener_register;
-    }
-
     if (!vfio_device_hiod_create_and_realize(vbasedev,
                      TYPE_HOST_IOMMU_DEVICE_IOMMUFD_VFIO, errp)) {
-        goto err_hiod_realize;
+        goto err_listener_register;
     }
 
     /*
@@ -600,8 +601,6 @@ found_container:
                                    vbasedev->num_regions, vbasedev->flags);
     return true;
 
-err_hiod_realize:
-    vfio_cpr_unregister_container(bcontainer);
 err_listener_register:
     iommufd_cdev_ram_block_discard_disable(false);
 err_discard_disable:
@@ -632,7 +631,6 @@ static void iommufd_cdev_detach(VFIODevice *vbasedev)
     }
 
     object_unref(vbasedev->hiod);
-    vfio_cpr_unregister_container(bcontainer);
     iommufd_cdev_detach_container(vbasedev, container);
     iommufd_cdev_container_destroy(container);
     vfio_address_space_put(space);

From 54594b520862682d846cb6fa91705a927290eec5 Mon Sep 17 00:00:00 2001
From: John Levon <john.levon@nutanix.com>
Date: Wed, 9 Apr 2025 15:48:01 +0200
Subject: [PATCH 0295/2760] vfio: refactor out vfio_interrupt_setup()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Refactor the interrupt setup code out of vfio_realize() for readability.

Signed-off-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250409134814.478903-2-john.levon@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/pci.c | 55 +++++++++++++++++++++++++++++++--------------------
 1 file changed, 34 insertions(+), 21 deletions(-)

diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index 6fa7217db8..27cc6426a5 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -2962,6 +2962,38 @@ static void vfio_unregister_req_notifier(VFIOPCIDevice *vdev)
     vdev->req_enabled = false;
 }
 
+static bool vfio_interrupt_setup(VFIOPCIDevice *vdev, Error **errp)
+{
+    PCIDevice *pdev = &vdev->pdev;
+
+    /* QEMU emulates all of MSI & MSIX */
+    if (pdev->cap_present & QEMU_PCI_CAP_MSIX) {
+        memset(vdev->emulated_config_bits + pdev->msix_cap, 0xff,
+               MSIX_CAP_LENGTH);
+    }
+
+    if (pdev->cap_present & QEMU_PCI_CAP_MSI) {
+        memset(vdev->emulated_config_bits + pdev->msi_cap, 0xff,
+               vdev->msi_cap_size);
+    }
+
+    if (vfio_pci_read_config(&vdev->pdev, PCI_INTERRUPT_PIN, 1)) {
+        vdev->intx.mmap_timer = timer_new_ms(QEMU_CLOCK_VIRTUAL,
+                                             vfio_intx_mmap_enable, vdev);
+        pci_device_set_intx_routing_notifier(&vdev->pdev,
+                                             vfio_intx_routing_notifier);
+        vdev->irqchip_change_notifier.notify = vfio_irqchip_change;
+        kvm_irqchip_add_change_notifier(&vdev->irqchip_change_notifier);
+        if (!vfio_intx_enable(vdev, errp)) {
+            timer_free(vdev->intx.mmap_timer);
+            pci_device_set_intx_routing_notifier(&vdev->pdev, NULL);
+            kvm_irqchip_remove_change_notifier(&vdev->irqchip_change_notifier);
+            return false;
+        }
+    }
+    return true;
+}
+
 static void vfio_realize(PCIDevice *pdev, Error **errp)
 {
     ERRP_GUARD();
@@ -3141,27 +3173,8 @@ static void vfio_realize(PCIDevice *pdev, Error **errp)
         vfio_bar_quirk_setup(vdev, i);
     }
 
-    /* QEMU emulates all of MSI & MSIX */
-    if (pdev->cap_present & QEMU_PCI_CAP_MSIX) {
-        memset(vdev->emulated_config_bits + pdev->msix_cap, 0xff,
-               MSIX_CAP_LENGTH);
-    }
-
-    if (pdev->cap_present & QEMU_PCI_CAP_MSI) {
-        memset(vdev->emulated_config_bits + pdev->msi_cap, 0xff,
-               vdev->msi_cap_size);
-    }
-
-    if (vfio_pci_read_config(&vdev->pdev, PCI_INTERRUPT_PIN, 1)) {
-        vdev->intx.mmap_timer = timer_new_ms(QEMU_CLOCK_VIRTUAL,
-                                                  vfio_intx_mmap_enable, vdev);
-        pci_device_set_intx_routing_notifier(&vdev->pdev,
-                                             vfio_intx_routing_notifier);
-        vdev->irqchip_change_notifier.notify = vfio_irqchip_change;
-        kvm_irqchip_add_change_notifier(&vdev->irqchip_change_notifier);
-        if (!vfio_intx_enable(vdev, errp)) {
-            goto out_deregister;
-        }
+    if (!vfio_interrupt_setup(vdev, errp)) {
+        goto out_unset_idev;
     }
 
     if (vdev->display != ON_OFF_AUTO_OFF) {

From a9d270f6b85bab40d388fe5244f02d145759cc08 Mon Sep 17 00:00:00 2001
From: John Levon <john.levon@nutanix.com>
Date: Wed, 9 Apr 2025 15:48:02 +0200
Subject: [PATCH 0296/2760] vfio: refactor out vfio_pci_config_setup()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Refactor the PCI config setup code out of vfio_realize() for
readability.

Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: John Levon <john.levon@nutanix.com>
Link: https://lore.kernel.org/qemu-devel/20250409134814.478903-3-john.levon@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/pci.c | 176 +++++++++++++++++++++++++++-----------------------
 1 file changed, 94 insertions(+), 82 deletions(-)

diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index 27cc6426a5..4a9484dfbe 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -2962,6 +2962,99 @@ static void vfio_unregister_req_notifier(VFIOPCIDevice *vdev)
     vdev->req_enabled = false;
 }
 
+static bool vfio_pci_config_setup(VFIOPCIDevice *vdev, Error **errp)
+{
+    PCIDevice *pdev = &vdev->pdev;
+    VFIODevice *vbasedev = &vdev->vbasedev;
+
+    /* vfio emulates a lot for us, but some bits need extra love */
+    vdev->emulated_config_bits = g_malloc0(vdev->config_size);
+
+    /* QEMU can choose to expose the ROM or not */
+    memset(vdev->emulated_config_bits + PCI_ROM_ADDRESS, 0xff, 4);
+    /* QEMU can also add or extend BARs */
+    memset(vdev->emulated_config_bits + PCI_BASE_ADDRESS_0, 0xff, 6 * 4);
+
+    /*
+     * The PCI spec reserves vendor ID 0xffff as an invalid value.  The
+     * device ID is managed by the vendor and need only be a 16-bit value.
+     * Allow any 16-bit value for subsystem so they can be hidden or changed.
+     */
+    if (vdev->vendor_id != PCI_ANY_ID) {
+        if (vdev->vendor_id >= 0xffff) {
+            error_setg(errp, "invalid PCI vendor ID provided");
+            return false;
+        }
+        vfio_add_emulated_word(vdev, PCI_VENDOR_ID, vdev->vendor_id, ~0);
+        trace_vfio_pci_emulated_vendor_id(vbasedev->name, vdev->vendor_id);
+    } else {
+        vdev->vendor_id = pci_get_word(pdev->config + PCI_VENDOR_ID);
+    }
+
+    if (vdev->device_id != PCI_ANY_ID) {
+        if (vdev->device_id > 0xffff) {
+            error_setg(errp, "invalid PCI device ID provided");
+            return false;
+        }
+        vfio_add_emulated_word(vdev, PCI_DEVICE_ID, vdev->device_id, ~0);
+        trace_vfio_pci_emulated_device_id(vbasedev->name, vdev->device_id);
+    } else {
+        vdev->device_id = pci_get_word(pdev->config + PCI_DEVICE_ID);
+    }
+
+    if (vdev->sub_vendor_id != PCI_ANY_ID) {
+        if (vdev->sub_vendor_id > 0xffff) {
+            error_setg(errp, "invalid PCI subsystem vendor ID provided");
+            return false;
+        }
+        vfio_add_emulated_word(vdev, PCI_SUBSYSTEM_VENDOR_ID,
+                               vdev->sub_vendor_id, ~0);
+        trace_vfio_pci_emulated_sub_vendor_id(vbasedev->name,
+                                              vdev->sub_vendor_id);
+    }
+
+    if (vdev->sub_device_id != PCI_ANY_ID) {
+        if (vdev->sub_device_id > 0xffff) {
+            error_setg(errp, "invalid PCI subsystem device ID provided");
+            return false;
+        }
+        vfio_add_emulated_word(vdev, PCI_SUBSYSTEM_ID, vdev->sub_device_id, ~0);
+        trace_vfio_pci_emulated_sub_device_id(vbasedev->name,
+                                              vdev->sub_device_id);
+    }
+
+    /* QEMU can change multi-function devices to single function, or reverse */
+    vdev->emulated_config_bits[PCI_HEADER_TYPE] =
+                                              PCI_HEADER_TYPE_MULTI_FUNCTION;
+
+    /* Restore or clear multifunction, this is always controlled by QEMU */
+    if (vdev->pdev.cap_present & QEMU_PCI_CAP_MULTIFUNCTION) {
+        vdev->pdev.config[PCI_HEADER_TYPE] |= PCI_HEADER_TYPE_MULTI_FUNCTION;
+    } else {
+        vdev->pdev.config[PCI_HEADER_TYPE] &= ~PCI_HEADER_TYPE_MULTI_FUNCTION;
+    }
+
+    /*
+     * Clear host resource mapping info.  If we choose not to register a
+     * BAR, such as might be the case with the option ROM, we can get
+     * confusing, unwritable, residual addresses from the host here.
+     */
+    memset(&vdev->pdev.config[PCI_BASE_ADDRESS_0], 0, 24);
+    memset(&vdev->pdev.config[PCI_ROM_ADDRESS], 0, 4);
+
+    vfio_pci_size_rom(vdev);
+
+    vfio_bars_prepare(vdev);
+
+    if (!vfio_msix_early_setup(vdev, errp)) {
+        return false;
+    }
+
+    vfio_bars_register(vdev);
+
+    return true;
+}
+
 static bool vfio_interrupt_setup(VFIOPCIDevice *vdev, Error **errp)
 {
     PCIDevice *pdev = &vdev->pdev;
@@ -3066,91 +3159,10 @@ static void vfio_realize(PCIDevice *pdev, Error **errp)
         goto error;
     }
 
-    /* vfio emulates a lot for us, but some bits need extra love */
-    vdev->emulated_config_bits = g_malloc0(vdev->config_size);
-
-    /* QEMU can choose to expose the ROM or not */
-    memset(vdev->emulated_config_bits + PCI_ROM_ADDRESS, 0xff, 4);
-    /* QEMU can also add or extend BARs */
-    memset(vdev->emulated_config_bits + PCI_BASE_ADDRESS_0, 0xff, 6 * 4);
-
-    /*
-     * The PCI spec reserves vendor ID 0xffff as an invalid value.  The
-     * device ID is managed by the vendor and need only be a 16-bit value.
-     * Allow any 16-bit value for subsystem so they can be hidden or changed.
-     */
-    if (vdev->vendor_id != PCI_ANY_ID) {
-        if (vdev->vendor_id >= 0xffff) {
-            error_setg(errp, "invalid PCI vendor ID provided");
-            goto error;
-        }
-        vfio_add_emulated_word(vdev, PCI_VENDOR_ID, vdev->vendor_id, ~0);
-        trace_vfio_pci_emulated_vendor_id(vbasedev->name, vdev->vendor_id);
-    } else {
-        vdev->vendor_id = pci_get_word(pdev->config + PCI_VENDOR_ID);
-    }
-
-    if (vdev->device_id != PCI_ANY_ID) {
-        if (vdev->device_id > 0xffff) {
-            error_setg(errp, "invalid PCI device ID provided");
-            goto error;
-        }
-        vfio_add_emulated_word(vdev, PCI_DEVICE_ID, vdev->device_id, ~0);
-        trace_vfio_pci_emulated_device_id(vbasedev->name, vdev->device_id);
-    } else {
-        vdev->device_id = pci_get_word(pdev->config + PCI_DEVICE_ID);
-    }
-
-    if (vdev->sub_vendor_id != PCI_ANY_ID) {
-        if (vdev->sub_vendor_id > 0xffff) {
-            error_setg(errp, "invalid PCI subsystem vendor ID provided");
-            goto error;
-        }
-        vfio_add_emulated_word(vdev, PCI_SUBSYSTEM_VENDOR_ID,
-                               vdev->sub_vendor_id, ~0);
-        trace_vfio_pci_emulated_sub_vendor_id(vbasedev->name,
-                                              vdev->sub_vendor_id);
-    }
-
-    if (vdev->sub_device_id != PCI_ANY_ID) {
-        if (vdev->sub_device_id > 0xffff) {
-            error_setg(errp, "invalid PCI subsystem device ID provided");
-            goto error;
-        }
-        vfio_add_emulated_word(vdev, PCI_SUBSYSTEM_ID, vdev->sub_device_id, ~0);
-        trace_vfio_pci_emulated_sub_device_id(vbasedev->name,
-                                              vdev->sub_device_id);
-    }
-
-    /* QEMU can change multi-function devices to single function, or reverse */
-    vdev->emulated_config_bits[PCI_HEADER_TYPE] =
-                                              PCI_HEADER_TYPE_MULTI_FUNCTION;
-
-    /* Restore or clear multifunction, this is always controlled by QEMU */
-    if (vdev->pdev.cap_present & QEMU_PCI_CAP_MULTIFUNCTION) {
-        vdev->pdev.config[PCI_HEADER_TYPE] |= PCI_HEADER_TYPE_MULTI_FUNCTION;
-    } else {
-        vdev->pdev.config[PCI_HEADER_TYPE] &= ~PCI_HEADER_TYPE_MULTI_FUNCTION;
-    }
-
-    /*
-     * Clear host resource mapping info.  If we choose not to register a
-     * BAR, such as might be the case with the option ROM, we can get
-     * confusing, unwritable, residual addresses from the host here.
-     */
-    memset(&vdev->pdev.config[PCI_BASE_ADDRESS_0], 0, 24);
-    memset(&vdev->pdev.config[PCI_ROM_ADDRESS], 0, 4);
-
-    vfio_pci_size_rom(vdev);
-
-    vfio_bars_prepare(vdev);
-
-    if (!vfio_msix_early_setup(vdev, errp)) {
+    if (!vfio_pci_config_setup(vdev, errp)) {
         goto error;
     }
 
-    vfio_bars_register(vdev);
-
     if (!vbasedev->mdev &&
         !pci_device_set_iommu_device(pdev, vbasedev->hiod, errp)) {
         error_prepend(errp, "Failed to set vIOMMU: ");

From 0a5692fecc76c6fee9a4fc86dbe8faf84ce30ce8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Sun, 23 Mar 2025 16:09:06 +0100
Subject: [PATCH 0297/2760] cpus: Introduce CPUClass::list_cpus() callback
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Some targets define cpu_list to a method listing their
CPUs on stdout. In order to make list_cpus() generic,
introduce the CPUClass::list_cpus() callback.
When no callback is registered, list_cpus() defaults
to the cpu_list definition.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Message-Id: <20250324185837.46506-2-philmd@linaro.org>
---
 cpu-target.c          | 8 +++++++-
 include/hw/core/cpu.h | 2 ++
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/cpu-target.c b/cpu-target.c
index 14cd623bff..d139a18f5b 100644
--- a/cpu-target.c
+++ b/cpu-target.c
@@ -104,7 +104,13 @@ static void cpu_list(void)
 
 void list_cpus(void)
 {
-    cpu_list();
+    CPUClass *cc = CPU_CLASS(object_class_by_name(CPU_RESOLVING_TYPE));
+
+    if (cc->list_cpus) {
+        cc->list_cpus();
+    } else {
+        cpu_list();
+    }
 }
 
 /* enable or disable single step mode. EXCP_DEBUG is returned by the
diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index c8d6abff19..5b645df59f 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -102,6 +102,7 @@ struct SysemuCPUOps;
  * CPUClass:
  * @class_by_name: Callback to map -cpu command line model name to an
  *                 instantiatable CPU type.
+ * @list_cpus: list available CPU models and flags.
  * @parse_features: Callback to parse command line arguments.
  * @reset_dump_flags: #CPUDumpFlags to use for reset logging.
  * @memory_rw_debug: Callback for GDB memory access.
@@ -148,6 +149,7 @@ struct CPUClass {
     /*< public >*/
 
     ObjectClass *(*class_by_name)(const char *cpu_model);
+    void (*list_cpus)(void);
     void (*parse_features)(const char *typename, char *str, Error **errp);
 
     int (*memory_rw_debug)(CPUState *cpu, vaddr addr,

From 0bc15e47f000e83f81ac5b1aeccaee1bbfaa0d40 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Sun, 23 Mar 2025 16:18:00 +0100
Subject: [PATCH 0298/2760] target/i386: Register CPUClass:list_cpus
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Register x86_cpu_list() as CPUClass:list_cpus callback.
Reduce its scope and remove the cpu_list definition.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Message-Id: <20250324185837.46506-3-philmd@linaro.org>
---
 target/i386/cpu.c | 3 ++-
 target/i386/cpu.h | 3 ---
 2 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 1f970aa4da..955295fe79 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -6319,7 +6319,7 @@ static void x86_cpu_list_entry(gpointer data, gpointer user_data)
 }
 
 /* list available CPU models and flags */
-void x86_cpu_list(void)
+static void x86_cpu_list(void)
 {
     int i, j;
     GSList *list;
@@ -8905,6 +8905,7 @@ static void x86_cpu_common_class_init(ObjectClass *oc, void *data)
     cc->reset_dump_flags = CPU_DUMP_FPU | CPU_DUMP_CCOP;
 
     cc->class_by_name = x86_cpu_class_by_name;
+    cc->list_cpus = x86_cpu_list;
     cc->parse_features = x86_cpu_parse_featurestr;
     cc->dump_state = x86_cpu_dump_state;
     cc->set_pc = x86_cpu_set_pc;
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index 9866595cd0..54bf9639f1 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -2365,7 +2365,6 @@ int x86_cpu_gdb_read_register(CPUState *cpu, GByteArray *buf, int reg);
 int x86_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
 void x86_cpu_gdb_init(CPUState *cs);
 
-void x86_cpu_list(void);
 int cpu_x86_support_mca_broadcast(CPUX86State *env);
 
 #ifndef CONFIG_USER_ONLY
@@ -2559,8 +2558,6 @@ uint64_t cpu_get_tsc(CPUX86State *env);
 #define TARGET_DEFAULT_CPU_TYPE X86_CPU_TYPE_NAME("qemu32")
 #endif
 
-#define cpu_list x86_cpu_list
-
 /* MMU modes definitions */
 #define MMU_KSMAP64_IDX    0
 #define MMU_KSMAP32_IDX    1

From 53c895fbb2d31b0de6a04a6f7e86e17b48324dc8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Sun, 23 Mar 2025 16:22:41 +0100
Subject: [PATCH 0299/2760] target/ppc: Register CPUClass:list_cpus
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Register ppc_cpu_list() as CPUClass:list_cpus callback.
Reduce its scope and remove the cpu_list definition.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Message-Id: <20250324185837.46506-4-philmd@linaro.org>
---
 target/ppc/cpu.h      | 4 ----
 target/ppc/cpu_init.c | 3 ++-
 2 files changed, 2 insertions(+), 5 deletions(-)

diff --git a/target/ppc/cpu.h b/target/ppc/cpu.h
index 3c02f7f7d4..f4cc823c5c 100644
--- a/target/ppc/cpu.h
+++ b/target/ppc/cpu.h
@@ -1610,8 +1610,6 @@ void ppc_store_dawrx1(CPUPPCState *env, uint32_t value);
 #endif /* !defined(CONFIG_USER_ONLY) */
 void ppc_store_msr(CPUPPCState *env, target_ulong value);
 
-void ppc_cpu_list(void);
-
 /* Time-base and decrementer management */
 uint64_t cpu_ppc_load_tbl(CPUPPCState *env);
 uint32_t cpu_ppc_load_tbu(CPUPPCState *env);
@@ -1673,8 +1671,6 @@ static inline uint64_t ppc_dump_gpr(CPUPPCState *env, int gprn)
 int ppc_dcr_read(ppc_dcr_t *dcr_env, int dcrn, uint32_t *valp);
 int ppc_dcr_write(ppc_dcr_t *dcr_env, int dcrn, uint32_t val);
 
-#define cpu_list ppc_cpu_list
-
 /* MMU modes definitions */
 #define MMU_USER_IDX 0
 static inline int ppc_env_mmu_index(CPUPPCState *env, bool ifetch)
diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
index fde7d71fc6..077991ed53 100644
--- a/target/ppc/cpu_init.c
+++ b/target/ppc/cpu_init.c
@@ -7177,7 +7177,7 @@ static void ppc_cpu_list_entry(gpointer data, gpointer user_data)
     g_free(name);
 }
 
-void ppc_cpu_list(void)
+static void ppc_cpu_list(void)
 {
     GSList *list;
 
@@ -7521,6 +7521,7 @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
                                        &pcc->parent_phases);
 
     cc->class_by_name = ppc_cpu_class_by_name;
+    cc->list_cpus = ppc_cpu_list;
     cc->dump_state = ppc_cpu_dump_state;
     cc->set_pc = ppc_cpu_set_pc;
     cc->get_pc = ppc_cpu_get_pc;

From 8b54467fb61eb507651ea8be6d786b0f2b0a1524 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Sun, 23 Mar 2025 16:15:35 +0100
Subject: [PATCH 0300/2760] target/sparc: Register CPUClass:list_cpus
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Register sparc_cpu_list() as CPUClass:list_cpus callback.
Reduce its scope and remove the cpu_list definition.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Message-Id: <20250324185837.46506-5-philmd@linaro.org>
---
 target/sparc/cpu.c | 3 ++-
 target/sparc/cpu.h | 3 ---
 2 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
index f7d231c6f8..174b76f762 100644
--- a/target/sparc/cpu.c
+++ b/target/sparc/cpu.c
@@ -580,7 +580,7 @@ static void print_features(uint32_t features, const char *prefix)
     }
 }
 
-void sparc_cpu_list(void)
+static void sparc_cpu_list(void)
 {
     unsigned int i;
 
@@ -1057,6 +1057,7 @@ static void sparc_cpu_class_init(ObjectClass *oc, void *data)
                                        &scc->parent_phases);
 
     cc->class_by_name = sparc_cpu_class_by_name;
+    cc->list_cpus = sparc_cpu_list,
     cc->parse_features = sparc_cpu_parse_features;
     cc->dump_state = sparc_cpu_dump_state;
 #if !defined(TARGET_SPARC64) && !defined(CONFIG_USER_ONLY)
diff --git a/target/sparc/cpu.h b/target/sparc/cpu.h
index 83ac818933..37fd1e066e 100644
--- a/target/sparc/cpu.h
+++ b/target/sparc/cpu.h
@@ -595,7 +595,6 @@ G_NORETURN void cpu_raise_exception_ra(CPUSPARCState *, int, uintptr_t);
 
 /* cpu_init.c */
 void cpu_sparc_set_id(CPUSPARCState *env, unsigned int cpu);
-void sparc_cpu_list(void);
 /* mmu_helper.c */
 bool sparc_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
                         MMUAccessType access_type, int mmu_idx,
@@ -666,8 +665,6 @@ hwaddr cpu_get_phys_page_nofault(CPUSPARCState *env, target_ulong addr,
 
 #define CPU_RESOLVING_TYPE TYPE_SPARC_CPU
 
-#define cpu_list sparc_cpu_list
-
 /* MMU modes definitions */
 #if defined (TARGET_SPARC64)
 #define MMU_USER_IDX   0

From e828206a0f63867deb9eedc194c49cc40a3b249b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 24 Mar 2025 19:29:03 +0100
Subject: [PATCH 0301/2760] target/s390x: Register CPUClass:list_cpus
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Both s390_cpu_list() and s390_set_qemu_cpu_model() are
defined in cpu_models.c, move their declarations in the
related "cpu_models.h" header. Use full path to header
in s390-virtio-ccw.c file.

Register s390_cpu_list() as CPUClass:list_cpus callback
and remove the cpu_list definition.

Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Reviewed-by: Eric Farman <farman@linux.ibm.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20250324185837.46506-6-philmd@linaro.org>
---
 hw/s390x/s390-virtio-ccw.c | 2 +-
 target/s390x/cpu.c         | 1 +
 target/s390x/cpu.h         | 7 -------
 target/s390x/cpu_models.h  | 3 +++
 4 files changed, 5 insertions(+), 8 deletions(-)

diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
index 52c273b3de..cf5b9974c5 100644
--- a/hw/s390x/s390-virtio-ccw.c
+++ b/hw/s390x/s390-virtio-ccw.c
@@ -35,7 +35,7 @@
 #include "hw/s390x/css-bridge.h"
 #include "hw/s390x/ap-bridge.h"
 #include "migration/register.h"
-#include "cpu_models.h"
+#include "target/s390x/cpu_models.h"
 #include "hw/nmi.h"
 #include "hw/qdev-properties.h"
 #include "hw/s390x/tod.h"
diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
index 41cccc1e69..43fc3194bc 100644
--- a/target/s390x/cpu.c
+++ b/target/s390x/cpu.c
@@ -386,6 +386,7 @@ static void s390_cpu_class_init(ObjectClass *oc, void *data)
                                        &scc->parent_phases);
 
     cc->class_by_name = s390_cpu_class_by_name;
+    cc->list_cpus = s390_cpu_list;
     cc->dump_state = s390_cpu_dump_state;
     cc->query_cpu_fast = s390_query_cpu_fast;
     cc->set_pc = s390_cpu_set_pc;
diff --git a/target/s390x/cpu.h b/target/s390x/cpu.h
index 90f64ee20c..d9ca2506e2 100644
--- a/target/s390x/cpu.h
+++ b/target/s390x/cpu.h
@@ -900,13 +900,6 @@ static inline uint8_t s390_cpu_get_state(S390CPU *cpu)
 }
 
 
-/* cpu_models.c */
-void s390_cpu_list(void);
-#define cpu_list s390_cpu_list
-void s390_set_qemu_cpu_model(uint16_t type, uint8_t gen, uint8_t ec_ga,
-                             const S390FeatInit feat_init);
-
-
 /* helper.c */
 #define CPU_RESOLVING_TYPE TYPE_S390_CPU
 
diff --git a/target/s390x/cpu_models.h b/target/s390x/cpu_models.h
index 71d4bc2dd4..f701bc0b53 100644
--- a/target/s390x/cpu_models.h
+++ b/target/s390x/cpu_models.h
@@ -113,6 +113,9 @@ static inline uint64_t s390_cpuid_from_cpu_model(const S390CPUModel *model)
 }
 S390CPUDef const *s390_find_cpu_def(uint16_t type, uint8_t gen, uint8_t ec_ga,
                                     S390FeatBitmap features);
+void s390_set_qemu_cpu_model(uint16_t type, uint8_t gen, uint8_t ec_ga,
+                             const S390FeatInit feat_init);
+void s390_cpu_list(void);
 
 bool kvm_s390_cpu_models_supported(void);
 bool kvm_s390_get_host_cpu_model(S390CPUModel *model, Error **errp);

From edbb66bb305b7d7f9b13734d222cc5e333180948 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Sun, 23 Mar 2025 16:24:29 +0100
Subject: [PATCH 0302/2760] cpus: Remove #ifdef check on cpu_list definition
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since we removed all definitions of cpu_list, the #ifdef
check is always true. Remove it, inlining cpu_list().

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Message-Id: <20250324185837.46506-7-philmd@linaro.org>
---
 cpu-target.c | 19 ++++++-------------
 1 file changed, 6 insertions(+), 13 deletions(-)

diff --git a/cpu-target.c b/cpu-target.c
index d139a18f5b..c99d208a7c 100644
--- a/cpu-target.c
+++ b/cpu-target.c
@@ -77,7 +77,6 @@ const char *parse_cpu_option(const char *cpu_option)
     return cpu_type;
 }
 
-#ifndef cpu_list
 static void cpu_list_entry(gpointer data, gpointer user_data)
 {
     CPUClass *cc = CPU_CLASS(OBJECT_CLASS(data));
@@ -91,17 +90,6 @@ static void cpu_list_entry(gpointer data, gpointer user_data)
     }
 }
 
-static void cpu_list(void)
-{
-    GSList *list;
-
-    list = object_class_get_list_sorted(TYPE_CPU, false);
-    qemu_printf("Available CPUs:\n");
-    g_slist_foreach(list, cpu_list_entry, NULL);
-    g_slist_free(list);
-}
-#endif
-
 void list_cpus(void)
 {
     CPUClass *cc = CPU_CLASS(object_class_by_name(CPU_RESOLVING_TYPE));
@@ -109,7 +97,12 @@ void list_cpus(void)
     if (cc->list_cpus) {
         cc->list_cpus();
     } else {
-        cpu_list();
+        GSList *list;
+
+        list = object_class_get_list_sorted(TYPE_CPU, false);
+        qemu_printf("Available CPUs:\n");
+        g_slist_foreach(list, cpu_list_entry, NULL);
+        g_slist_free(list);
     }
 }
 

From f605796aae42885034400c83ed6a9b07cd6d6481 Mon Sep 17 00:00:00 2001
From: Stefan Hajnoczi <stefanha@redhat.com>
Date: Thu, 17 Apr 2025 11:05:27 -0400
Subject: [PATCH 0303/2760] file-posix: probe discard alignment on Linux block
 devices

Populate the pdiscard_alignment block limit so the block layer is able
align discard requests correctly.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-ID: <20250417150528.76470-2-stefanha@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/file-posix.c | 67 +++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 66 insertions(+), 1 deletion(-)

diff --git a/block/file-posix.c b/block/file-posix.c
index 56d1972d15..0d6e12f880 100644
--- a/block/file-posix.c
+++ b/block/file-posix.c
@@ -1276,10 +1276,10 @@ static int get_sysfs_zoned_model(struct stat *st, BlockZoneModel *zoned)
 }
 #endif /* defined(CONFIG_BLKZONED) */
 
+#ifdef CONFIG_LINUX
 /*
  * Get a sysfs attribute value as a long integer.
  */
-#ifdef CONFIG_LINUX
 static long get_sysfs_long_val(struct stat *st, const char *attribute)
 {
     g_autofree char *str = NULL;
@@ -1299,6 +1299,30 @@ static long get_sysfs_long_val(struct stat *st, const char *attribute)
     }
     return ret;
 }
+
+/*
+ * Get a sysfs attribute value as a uint32_t.
+ */
+static int get_sysfs_u32_val(struct stat *st, const char *attribute,
+                             uint32_t *u32)
+{
+    g_autofree char *str = NULL;
+    const char *end;
+    unsigned int val;
+    int ret;
+
+    ret = get_sysfs_str_val(st, attribute, &str);
+    if (ret < 0) {
+        return ret;
+    }
+
+    /* The file is ended with '\n', pass 'end' to accept that. */
+    ret = qemu_strtoui(str, &end, 10, &val);
+    if (ret == 0 && end && *end == '\0') {
+        *u32 = val;
+    }
+    return ret;
+}
 #endif
 
 static int hdev_get_max_segments(int fd, struct stat *st)
@@ -1318,6 +1342,23 @@ static int hdev_get_max_segments(int fd, struct stat *st)
 #endif
 }
 
+/*
+ * Fills in *dalign with the discard alignment and returns 0 on success,
+ * -errno otherwise.
+ */
+static int hdev_get_pdiscard_alignment(struct stat *st, uint32_t *dalign)
+{
+#ifdef CONFIG_LINUX
+    /*
+     * Note that Linux "discard_granularity" is QEMU "discard_alignment". Linux
+     * "discard_alignment" is something else.
+     */
+    return get_sysfs_u32_val(st, "discard_granularity", dalign);
+#else
+    return -ENOTSUP;
+#endif
+}
+
 #if defined(CONFIG_BLKZONED)
 /*
  * If the reset_all flag is true, then the wps of zone whose state is
@@ -1527,6 +1568,30 @@ static void raw_refresh_limits(BlockDriverState *bs, Error **errp)
         }
     }
 
+    if (S_ISBLK(st.st_mode)) {
+        uint32_t dalign = 0;
+        int ret;
+
+        ret = hdev_get_pdiscard_alignment(&st, &dalign);
+        if (ret == 0) {
+            uint32_t ralign = bs->bl.request_alignment;
+
+            /* Probably never happens, but handle it just in case */
+            if (dalign < ralign && (ralign % dalign == 0)) {
+                dalign = ralign;
+            }
+
+            /* The block layer requires a multiple of request_alignment */
+            if (dalign % ralign != 0) {
+                error_setg(errp, "Invalid pdiscard_alignment limit %u is not a "
+                        "multiple of request_alignment %u", dalign, ralign);
+                return;
+            }
+
+            bs->bl.pdiscard_alignment = dalign;
+        }
+    }
+
     raw_refresh_zoned_limits(bs, &st, errp);
 }
 

From 4733cb0833c4b223f92ec0136980eeb5239ecb87 Mon Sep 17 00:00:00 2001
From: Stefan Hajnoczi <stefanha@redhat.com>
Date: Thu, 17 Apr 2025 11:05:28 -0400
Subject: [PATCH 0304/2760] block/io: skip head/tail requests on EINVAL

When guests send misaligned discard requests, the block layer breaks
them up into a misaligned head, an aligned main body, and a misaligned
tail.

The file-posix block driver on Linux returns -EINVAL on misaligned
discard requests. This causes bdrv_co_pdiscard() to fail and guests
configured with werror=stop will pause.

Add a special case for misaligned head/tail requests. Simply continue
when EINVAL is encountered so that the aligned main body of the request
can be completed and the guest is not paused. This is the best we can do
when guest discard limits do not match the host discard limits.

Fixes: https://issues.redhat.com/browse/RHEL-86032
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Hanna Czenczek <hreitz@redhat.com>
Message-ID: <20250417150528.76470-3-stefanha@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/io.c | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/block/io.c b/block/io.c
index 1ba8d1aeea..ccec11386b 100644
--- a/block/io.c
+++ b/block/io.c
@@ -3109,11 +3109,12 @@ int coroutine_fn bdrv_co_pdiscard(BdrvChild *child, int64_t offset,
     /* Invalidate the cached block-status data range if this discard overlaps */
     bdrv_bsc_invalidate_range(bs, offset, bytes);
 
-    /* Discard is advisory, but some devices track and coalesce
+    /*
+     * Discard is advisory, but some devices track and coalesce
      * unaligned requests, so we must pass everything down rather than
-     * round here.  Still, most devices will just silently ignore
-     * unaligned requests (by returning -ENOTSUP), so we must fragment
-     * the request accordingly.  */
+     * round here.  Still, most devices reject unaligned requests with
+     * -EINVAL or -ENOTSUP, so we must fragment the request accordingly.
+     */
     align = MAX(bs->bl.pdiscard_alignment, bs->bl.request_alignment);
     assert(align % bs->bl.request_alignment == 0);
     head = offset % align;
@@ -3180,7 +3181,11 @@ int coroutine_fn bdrv_co_pdiscard(BdrvChild *child, int64_t offset,
             }
         }
         if (ret && ret != -ENOTSUP) {
-            goto out;
+            if (ret == -EINVAL && (offset % align != 0 || num % align != 0)) {
+                /* Silently skip rejected unaligned head/tail requests */
+            } else {
+                goto out; /* bail out */
+            }
         }
 
         offset += num;

From 6970f91ac7819e186dc0e2efea08120450fb5404 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 31 Mar 2025 17:15:47 +0200
Subject: [PATCH 0305/2760] hw/pci-host/designware: Use deposit/extract API
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Prefer the safer (less bug-prone) deposit/extract API
to access lower/upper 32-bit of 64-bit registers.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Gustavo Romero <gustavo.romero@linaro.org>
Message-Id: <20250331152041.74533-3-philmd@linaro.org>
---
 hw/pci-host/designware.c | 48 ++++++++++++++--------------------------
 1 file changed, 17 insertions(+), 31 deletions(-)

diff --git a/hw/pci-host/designware.c b/hw/pci-host/designware.c
index 5598d18f47..9c3a5f8d91 100644
--- a/hw/pci-host/designware.c
+++ b/hw/pci-host/designware.c
@@ -22,6 +22,7 @@
 #include "qapi/error.h"
 #include "qemu/module.h"
 #include "qemu/log.h"
+#include "qemu/bitops.h"
 #include "hw/pci/msi.h"
 #include "hw/pci/pci_bridge.h"
 #include "hw/pci/pci_host.h"
@@ -162,11 +163,9 @@ designware_pcie_root_config_read(PCIDevice *d, uint32_t address, int len)
         break;
 
     case DESIGNWARE_PCIE_MSI_ADDR_LO:
-        val = root->msi.base;
-        break;
-
     case DESIGNWARE_PCIE_MSI_ADDR_HI:
-        val = root->msi.base >> 32;
+        val = extract64(root->msi.base,
+                        address == DESIGNWARE_PCIE_MSI_ADDR_LO ? 0 : 32, 32);
         break;
 
     case DESIGNWARE_PCIE_MSI_INTR0_ENABLE:
@@ -190,19 +189,16 @@ designware_pcie_root_config_read(PCIDevice *d, uint32_t address, int len)
         break;
 
     case DESIGNWARE_PCIE_ATU_LOWER_BASE:
-        val = viewport->base;
-        break;
-
     case DESIGNWARE_PCIE_ATU_UPPER_BASE:
-        val = viewport->base >> 32;
+        val = extract64(viewport->base,
+                        address == DESIGNWARE_PCIE_ATU_LOWER_BASE ? 0 : 32, 32);
         break;
 
     case DESIGNWARE_PCIE_ATU_LOWER_TARGET:
-        val = viewport->target;
-        break;
-
     case DESIGNWARE_PCIE_ATU_UPPER_TARGET:
-        val = viewport->target >> 32;
+        val = extract64(viewport->target,
+                        address == DESIGNWARE_PCIE_ATU_LOWER_TARGET ? 0 : 32,
+                        32);
         break;
 
     case DESIGNWARE_PCIE_ATU_LIMIT:
@@ -321,14 +317,10 @@ static void designware_pcie_root_config_write(PCIDevice *d, uint32_t address,
         break;
 
     case DESIGNWARE_PCIE_MSI_ADDR_LO:
-        root->msi.base &= 0xFFFFFFFF00000000ULL;
-        root->msi.base |= val;
-        designware_pcie_root_update_msi_mapping(root);
-        break;
-
     case DESIGNWARE_PCIE_MSI_ADDR_HI:
-        root->msi.base &= 0x00000000FFFFFFFFULL;
-        root->msi.base |= (uint64_t)val << 32;
+        root->msi.base = deposit64(root->msi.base,
+                                   address == DESIGNWARE_PCIE_MSI_ADDR_LO
+                                   ? 0 : 32, 32, val);
         designware_pcie_root_update_msi_mapping(root);
         break;
 
@@ -355,23 +347,17 @@ static void designware_pcie_root_config_write(PCIDevice *d, uint32_t address,
         break;
 
     case DESIGNWARE_PCIE_ATU_LOWER_BASE:
-        viewport->base &= 0xFFFFFFFF00000000ULL;
-        viewport->base |= val;
-        break;
-
     case DESIGNWARE_PCIE_ATU_UPPER_BASE:
-        viewport->base &= 0x00000000FFFFFFFFULL;
-        viewport->base |= (uint64_t)val << 32;
+        viewport->base = deposit64(root->msi.base,
+                                   address == DESIGNWARE_PCIE_ATU_LOWER_BASE
+                                   ? 0 : 32, 32, val);
         break;
 
     case DESIGNWARE_PCIE_ATU_LOWER_TARGET:
-        viewport->target &= 0xFFFFFFFF00000000ULL;
-        viewport->target |= val;
-        break;
-
     case DESIGNWARE_PCIE_ATU_UPPER_TARGET:
-        viewport->target &= 0x00000000FFFFFFFFULL;
-        viewport->target |= (uint64_t)val << 32;
+        viewport->target = deposit64(root->msi.base,
+                                     address == DESIGNWARE_PCIE_ATU_LOWER_TARGET
+                                     ? 0 : 32, 32, val);
         break;
 
     case DESIGNWARE_PCIE_ATU_LIMIT:

From fbb23135d691d20f713bf2318e1cf6575e77cda7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 23 Apr 2025 19:00:39 +0200
Subject: [PATCH 0306/2760] hw/misc/edu: Convert type_init() -> DEFINE_TYPES()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Prefer DEFINE_TYPES() macro over type_init() to register
QOM types.

Initialize the .interfaces struct field as compound literal
casted to InterfaceInfo type like the rest of our code base.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250424194905.82506-2-philmd@linaro.org>
---
 hw/misc/edu.c | 21 +++++++++------------
 1 file changed, 9 insertions(+), 12 deletions(-)

diff --git a/hw/misc/edu.c b/hw/misc/edu.c
index 504178b4a2..5723ef0ed1 100644
--- a/hw/misc/edu.c
+++ b/hw/misc/edu.c
@@ -429,21 +429,18 @@ static void edu_class_init(ObjectClass *class, void *data)
     set_bit(DEVICE_CATEGORY_MISC, dc->categories);
 }
 
-static void pci_edu_register_types(void)
-{
-    static InterfaceInfo interfaces[] = {
-        { INTERFACE_CONVENTIONAL_PCI_DEVICE },
-        { },
-    };
-    static const TypeInfo edu_info = {
+static const TypeInfo edu_types[] = {
+    {
         .name          = TYPE_PCI_EDU_DEVICE,
         .parent        = TYPE_PCI_DEVICE,
         .instance_size = sizeof(EduState),
         .instance_init = edu_instance_init,
         .class_init    = edu_class_init,
-        .interfaces = interfaces,
-    };
+        .interfaces    = (InterfaceInfo[]) {
+            { INTERFACE_CONVENTIONAL_PCI_DEVICE },
+            { },
+        },
+    }
+};
 
-    type_register_static(&edu_info);
-}
-type_init(pci_edu_register_types)
+DEFINE_TYPES(edu_types)

From f1fa787b92c52d1034de164d2a26771ff969454e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Sun, 9 Feb 2025 22:15:54 +0100
Subject: [PATCH 0307/2760] qom: Have class_base_init() take a const data
 argument
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250424194905.82506-3-philmd@linaro.org>
---
 hw/core/machine.c        | 2 +-
 hw/core/qdev.c           | 2 +-
 hw/pci/pci.c             | 2 +-
 include/qom/object.h     | 2 +-
 qom/object.c             | 2 +-
 rust/qemu-api/src/qom.rs | 2 +-
 6 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/hw/core/machine.c b/hw/core/machine.c
index abfcedd4a5..bbff84855a 100644
--- a/hw/core/machine.c
+++ b/hw/core/machine.c
@@ -1243,7 +1243,7 @@ static void machine_class_init(ObjectClass *oc, void *data)
         "Memory size configuration");
 }
 
-static void machine_class_base_init(ObjectClass *oc, void *data)
+static void machine_class_base_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     mc->max_cpus = mc->max_cpus ?: 1;
diff --git a/hw/core/qdev.c b/hw/core/qdev.c
index 2745b5e092..1e0f47cc84 100644
--- a/hw/core/qdev.c
+++ b/hw/core/qdev.c
@@ -693,7 +693,7 @@ static void device_finalize(Object *obj)
     g_free(dev->id);
 }
 
-static void device_class_base_init(ObjectClass *class, void *data)
+static void device_class_base_init(ObjectClass *class, const void *data)
 {
     DeviceClass *klass = DEVICE_CLASS(class);
 
diff --git a/hw/pci/pci.c b/hw/pci/pci.c
index 2844ec5556..475b97c649 100644
--- a/hw/pci/pci.c
+++ b/hw/pci/pci.c
@@ -2809,7 +2809,7 @@ static void pci_device_class_init(ObjectClass *klass, void *data)
         "access to indirect DMA memory");
 }
 
-static void pci_device_class_base_init(ObjectClass *klass, void *data)
+static void pci_device_class_base_init(ObjectClass *klass, const void *data)
 {
     if (!object_class_is_abstract(klass)) {
         ObjectClass *conventional =
diff --git a/include/qom/object.h b/include/qom/object.h
index 9192265db7..7bb14ca706 100644
--- a/include/qom/object.h
+++ b/include/qom/object.h
@@ -487,7 +487,7 @@ struct TypeInfo
     size_t class_size;
 
     void (*class_init)(ObjectClass *klass, void *data);
-    void (*class_base_init)(ObjectClass *klass, void *data);
+    void (*class_base_init)(ObjectClass *klass, const void *data);
     void *class_data;
 
     InterfaceInfo *interfaces;
diff --git a/qom/object.c b/qom/object.c
index 01618d06bd..dfd59502d1 100644
--- a/qom/object.c
+++ b/qom/object.c
@@ -55,7 +55,7 @@ struct TypeImpl
     size_t instance_align;
 
     void (*class_init)(ObjectClass *klass, void *data);
-    void (*class_base_init)(ObjectClass *klass, void *data);
+    void (*class_base_init)(ObjectClass *klass, const void *data);
 
     void *class_data;
 
diff --git a/rust/qemu-api/src/qom.rs b/rust/qemu-api/src/qom.rs
index 34d7bc0ef9..03fe6247ff 100644
--- a/rust/qemu-api/src/qom.rs
+++ b/rust/qemu-api/src/qom.rs
@@ -492,7 +492,7 @@ pub trait ObjectImpl: ObjectType + IsA<Object> {
     /// the effects of copying the contents of the parent's class struct
     /// to the descendants.
     const CLASS_BASE_INIT: Option<
-        unsafe extern "C" fn(klass: *mut ObjectClass, data: *mut c_void),
+        unsafe extern "C" fn(klass: *mut ObjectClass, data: *const c_void),
     > = None;
 
     const TYPE_INFO: TypeInfo = TypeInfo {

From 12d1a768bdfea6e27a3a829228840d72507613a1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Sun, 9 Feb 2025 23:47:35 +0100
Subject: [PATCH 0308/2760] qom: Have class_init() take a const data argument
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Mechanical change using gsed, then style manually adapted
to pass checkpatch.pl script.

Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250424194905.82506-4-philmd@linaro.org>
---
 accel/hvf/hvf-accel-ops.c                     |  4 +-
 accel/kvm/kvm-accel-ops.c                     |  2 +-
 accel/kvm/kvm-all.c                           |  2 +-
 accel/qtest/qtest.c                           |  4 +-
 accel/tcg/tcg-accel-ops.c                     |  2 +-
 accel/tcg/tcg-all.c                           |  2 +-
 accel/xen/xen-all.c                           |  4 +-
 authz/list.c                                  |  2 +-
 authz/listfile.c                              |  2 +-
 authz/pamacct.c                               |  2 +-
 authz/simple.c                                |  2 +-
 backends/confidential-guest-support.c         |  3 +-
 backends/cryptodev-builtin.c                  |  2 +-
 backends/cryptodev-lkcf.c                     |  2 +-
 backends/cryptodev-vhost-user.c               |  2 +-
 backends/cryptodev.c                          |  2 +-
 backends/dbus-vmstate.c                       |  2 +-
 backends/host_iommu_device.c                  |  2 +-
 backends/hostmem-epc.c                        |  2 +-
 backends/hostmem-file.c                       |  2 +-
 backends/hostmem-memfd.c                      |  2 +-
 backends/hostmem-ram.c                        |  2 +-
 backends/hostmem-shm.c                        |  2 +-
 backends/hostmem.c                            |  2 +-
 backends/iommufd.c                            |  4 +-
 backends/rng-builtin.c                        |  2 +-
 backends/rng-egd.c                            |  2 +-
 backends/rng-random.c                         |  2 +-
 backends/rng.c                                |  2 +-
 backends/tpm/tpm_emulator.c                   |  2 +-
 backends/tpm/tpm_passthrough.c                |  2 +-
 backends/vhost-user.c                         |  2 +-
 block/throttle-groups.c                       |  3 +-
 chardev/baum.c                                |  2 +-
 chardev/char-console.c                        |  2 +-
 chardev/char-fd.c                             |  2 +-
 chardev/char-file.c                           |  2 +-
 chardev/char-hub.c                            |  2 +-
 chardev/char-mux.c                            |  2 +-
 chardev/char-null.c                           |  2 +-
 chardev/char-parallel.c                       |  2 +-
 chardev/char-pipe.c                           |  2 +-
 chardev/char-pty.c                            |  2 +-
 chardev/char-ringbuf.c                        |  2 +-
 chardev/char-serial.c                         |  2 +-
 chardev/char-socket.c                         |  2 +-
 chardev/char-stdio.c                          |  2 +-
 chardev/char-udp.c                            |  2 +-
 chardev/char-win-stdio.c                      |  2 +-
 chardev/char-win.c                            |  2 +-
 chardev/char.c                                |  2 +-
 chardev/msmouse.c                             |  2 +-
 chardev/spice.c                               |  6 +-
 chardev/testdev.c                             |  2 +-
 chardev/wctablet.c                            |  2 +-
 crypto/secret.c                               |  2 +-
 crypto/secret_common.c                        |  2 +-
 crypto/secret_keyring.c                       |  2 +-
 crypto/tls-cipher-suites.c                    |  3 +-
 crypto/tlscreds.c                             |  2 +-
 crypto/tlscredsanon.c                         |  2 +-
 crypto/tlscredspsk.c                          |  2 +-
 crypto/tlscredsx509.c                         |  2 +-
 docs/devel/qom.rst                            |  8 +-
 docs/devel/reset.rst                          |  2 +-
 docs/devel/virtio-backends.rst                |  2 +-
 event-loop-base.c                             |  3 +-
 gdbstub/system.c                              |  2 +-
 hw/9pfs/virtio-9p-device.c                    |  2 +-
 hw/acpi/erst.c                                |  2 +-
 hw/acpi/generic_event_device.c                |  2 +-
 hw/acpi/pci.c                                 |  4 +-
 hw/acpi/piix4.c                               |  2 +-
 hw/acpi/vmclock.c                             |  2 +-
 hw/acpi/vmgenid.c                             |  2 +-
 hw/adc/aspeed_adc.c                           | 10 +--
 hw/adc/npcm7xx_adc.c                          |  2 +-
 hw/adc/stm32f2xx_adc.c                        |  2 +-
 hw/adc/zynq-xadc.c                            |  2 +-
 hw/alpha/typhoon.c                            |  2 +-
 hw/arm/allwinner-a10.c                        |  2 +-
 hw/arm/allwinner-h3.c                         |  2 +-
 hw/arm/allwinner-r40.c                        |  2 +-
 hw/arm/armsse.c                               |  2 +-
 hw/arm/armv7m.c                               |  4 +-
 hw/arm/aspeed.c                               | 59 +++++++-----
 hw/arm/aspeed_ast10x0.c                       |  2 +-
 hw/arm/aspeed_ast2400.c                       |  4 +-
 hw/arm/aspeed_ast2600.c                       |  2 +-
 hw/arm/aspeed_ast27x0.c                       |  4 +-
 hw/arm/aspeed_soc_common.c                    |  2 +-
 hw/arm/b-l475e-iot01a.c                       |  2 +-
 hw/arm/bcm2835_peripherals.c                  |  2 +-
 hw/arm/bcm2836.c                              |  8 +-
 hw/arm/bcm2838.c                              |  2 +-
 hw/arm/bcm2838_peripherals.c                  |  2 +-
 hw/arm/collie.c                               |  2 +-
 hw/arm/digic.c                                |  2 +-
 hw/arm/exynos4210.c                           |  2 +-
 hw/arm/exynos4_boards.c                       |  4 +-
 hw/arm/fby35.c                                |  2 +-
 hw/arm/fsl-imx25.c                            |  2 +-
 hw/arm/fsl-imx31.c                            |  2 +-
 hw/arm/fsl-imx6.c                             |  2 +-
 hw/arm/fsl-imx6ul.c                           |  2 +-
 hw/arm/fsl-imx7.c                             |  2 +-
 hw/arm/fsl-imx8mp.c                           |  2 +-
 hw/arm/highbank.c                             |  6 +-
 hw/arm/integratorcp.c                         |  6 +-
 hw/arm/microbit.c                             |  2 +-
 hw/arm/mps2-tz.c                              | 10 +--
 hw/arm/mps2.c                                 | 10 +--
 hw/arm/mps3r.c                                |  4 +-
 hw/arm/msf2-soc.c                             |  2 +-
 hw/arm/musca.c                                |  6 +-
 hw/arm/musicpal.c                             | 14 +--
 hw/arm/npcm7xx.c                              |  6 +-
 hw/arm/npcm7xx_boards.c                       | 12 +--
 hw/arm/npcm8xx.c                              |  2 +-
 hw/arm/npcm8xx_boards.c                       |  4 +-
 hw/arm/nrf51_soc.c                            |  2 +-
 hw/arm/omap_sx1.c                             |  4 +-
 hw/arm/raspi.c                                | 10 +--
 hw/arm/raspi4b.c                              |  2 +-
 hw/arm/realview.c                             |  8 +-
 hw/arm/sbsa-ref.c                             |  2 +-
 hw/arm/smmu-common.c                          |  2 +-
 hw/arm/smmuv3.c                               |  4 +-
 hw/arm/stellaris.c                            | 10 +--
 hw/arm/stm32f100_soc.c                        |  2 +-
 hw/arm/stm32f205_soc.c                        |  2 +-
 hw/arm/stm32f405_soc.c                        |  2 +-
 hw/arm/stm32l4x5_soc.c                        |  8 +-
 hw/arm/strongarm.c                            | 13 +--
 hw/arm/versatilepb.c                          |  6 +-
 hw/arm/vexpress.c                             |  6 +-
 hw/arm/virt.c                                 |  4 +-
 hw/arm/xen-pvh.c                              |  2 +-
 hw/arm/xilinx_zynq.c                          |  2 +-
 hw/arm/xlnx-versal-virt.c                     |  2 +-
 hw/arm/xlnx-versal.c                          |  2 +-
 hw/arm/xlnx-zcu102.c                          |  2 +-
 hw/arm/xlnx-zynqmp.c                          |  2 +-
 hw/audio/ac97.c                               |  2 +-
 hw/audio/adlib.c                              |  2 +-
 hw/audio/asc.c                                |  2 +-
 hw/audio/cs4231.c                             |  2 +-
 hw/audio/cs4231a.c                            |  2 +-
 hw/audio/es1370.c                             |  2 +-
 hw/audio/gus.c                                |  2 +-
 hw/audio/hda-codec.c                          |  8 +-
 hw/audio/intel-hda.c                          |  8 +-
 hw/audio/marvell_88w8618.c                    |  2 +-
 hw/audio/pcspk.c                              |  2 +-
 hw/audio/pl041.c                              |  2 +-
 hw/audio/sb16.c                               |  2 +-
 hw/audio/via-ac97.c                           |  4 +-
 hw/audio/virtio-snd-pci.c                     |  2 +-
 hw/audio/virtio-snd.c                         |  2 +-
 hw/audio/wm8750.c                             |  2 +-
 hw/avr/arduino.c                              | 10 +--
 hw/avr/atmega.c                               | 10 +--
 hw/block/fdc-isa.c                            |  2 +-
 hw/block/fdc-sysbus.c                         |  6 +-
 hw/block/fdc.c                                |  2 +-
 hw/block/m25p80.c                             |  4 +-
 hw/block/nand.c                               |  2 +-
 hw/block/pflash_cfi01.c                       |  2 +-
 hw/block/pflash_cfi02.c                       |  2 +-
 hw/block/swim.c                               |  4 +-
 hw/block/vhost-user-blk.c                     |  2 +-
 hw/block/virtio-blk.c                         |  2 +-
 hw/block/xen-block.c                          |  6 +-
 hw/char/avr_usart.c                           |  2 +-
 hw/char/bcm2835_aux.c                         |  2 +-
 hw/char/cadence_uart.c                        |  2 +-
 hw/char/cmsdk-apb-uart.c                      |  2 +-
 hw/char/debugcon.c                            |  2 +-
 hw/char/digic-uart.c                          |  2 +-
 hw/char/diva-gsp.c                            |  4 +-
 hw/char/escc.c                                |  2 +-
 hw/char/exynos4210_uart.c                     |  2 +-
 hw/char/goldfish_tty.c                        |  2 +-
 hw/char/grlib_apbuart.c                       |  2 +-
 hw/char/ibex_uart.c                           |  2 +-
 hw/char/imx_serial.c                          |  2 +-
 hw/char/ipoctal232.c                          |  2 +-
 hw/char/mcf_uart.c                            |  2 +-
 hw/char/mchp_pfsoc_mmuart.c                   |  2 +-
 hw/char/nrf51_uart.c                          |  2 +-
 hw/char/parallel.c                            |  2 +-
 hw/char/pl011.c                               |  2 +-
 hw/char/renesas_sci.c                         |  2 +-
 hw/char/sclpconsole-lm.c                      |  2 +-
 hw/char/sclpconsole.c                         |  2 +-
 hw/char/serial-isa.c                          |  2 +-
 hw/char/serial-mm.c                           |  2 +-
 hw/char/serial-pci-multi.c                    |  6 +-
 hw/char/serial-pci.c                          |  2 +-
 hw/char/serial.c                              |  2 +-
 hw/char/sh_serial.c                           |  2 +-
 hw/char/shakti_uart.c                         |  2 +-
 hw/char/sifive_uart.c                         |  2 +-
 hw/char/spapr_vty.c                           |  2 +-
 hw/char/stm32f2xx_usart.c                     |  2 +-
 hw/char/stm32l4x5_usart.c                     |  9 +-
 hw/char/terminal3270.c                        |  2 +-
 hw/char/virtio-console.c                      |  4 +-
 hw/char/virtio-serial-bus.c                   |  6 +-
 hw/char/xen_console.c                         |  2 +-
 hw/char/xilinx_uartlite.c                     |  2 +-
 hw/core/bus.c                                 |  2 +-
 hw/core/clock.c                               |  2 +-
 hw/core/cpu-common.c                          |  2 +-
 hw/core/generic-loader.c                      |  2 +-
 hw/core/guest-loader.c                        |  2 +-
 hw/core/machine.c                             |  2 +-
 hw/core/or-irq.c                              |  2 +-
 hw/core/platform-bus.c                        |  2 +-
 hw/core/qdev.c                                |  2 +-
 hw/core/register.c                            |  2 +-
 hw/core/reset.c                               |  2 +-
 hw/core/resetcontainer.c                      |  3 +-
 hw/core/split-irq.c                           |  2 +-
 hw/core/sysbus.c                              |  7 +-
 hw/cpu/a15mpcore.c                            |  2 +-
 hw/cpu/a9mpcore.c                             |  2 +-
 hw/cpu/arm11mpcore.c                          |  2 +-
 hw/cpu/cluster.c                              |  2 +-
 hw/cpu/core.c                                 |  2 +-
 hw/cpu/realview_mpcore.c                      |  2 +-
 hw/cxl/switch-mailbox-cci.c                   |  2 +-
 hw/display/apple-gfx-mmio.m                   |  2 +-
 hw/display/apple-gfx-pci.m                    |  2 +-
 hw/display/artist.c                           |  2 +-
 hw/display/ati.c                              |  2 +-
 hw/display/bcm2835_fb.c                       |  2 +-
 hw/display/bochs-display.c                    |  2 +-
 hw/display/cg3.c                              |  2 +-
 hw/display/cirrus_vga.c                       |  2 +-
 hw/display/cirrus_vga_isa.c                   |  2 +-
 hw/display/dm163.c                            |  2 +-
 hw/display/dpcd.c                             |  2 +-
 hw/display/exynos4210_fimd.c                  |  2 +-
 hw/display/g364fb.c                           |  2 +-
 hw/display/i2c-ddc.c                          |  2 +-
 hw/display/jazz_led.c                         |  2 +-
 hw/display/macfb.c                            |  4 +-
 hw/display/next-fb.c                          |  2 +-
 hw/display/pl110.c                            |  2 +-
 hw/display/qxl.c                              |  6 +-
 hw/display/ramfb-standalone.c                 |  2 +-
 hw/display/sii9022.c                          |  2 +-
 hw/display/sm501.c                            |  4 +-
 hw/display/ssd0303.c                          |  2 +-
 hw/display/ssd0323.c                          |  2 +-
 hw/display/tcx.c                              |  2 +-
 hw/display/vga-isa.c                          |  2 +-
 hw/display/vga-mmio.c                         |  2 +-
 hw/display/vga-pci.c                          |  6 +-
 hw/display/vhost-user-gpu.c                   |  2 +-
 hw/display/virtio-gpu-base.c                  |  2 +-
 hw/display/virtio-gpu-gl.c                    |  2 +-
 hw/display/virtio-gpu-pci.c                   |  2 +-
 hw/display/virtio-gpu-rutabaga.c              |  2 +-
 hw/display/virtio-gpu.c                       |  2 +-
 hw/display/virtio-vga.c                       |  2 +-
 hw/display/vmware_vga.c                       |  2 +-
 hw/display/xlnx_dp.c                          |  2 +-
 hw/dma/bcm2835_dma.c                          |  2 +-
 hw/dma/i82374.c                               |  2 +-
 hw/dma/i8257.c                                |  2 +-
 hw/dma/pl080.c                                |  2 +-
 hw/dma/pl330.c                                |  2 +-
 hw/dma/rc4030.c                               |  4 +-
 hw/dma/sifive_pdma.c                          |  2 +-
 hw/dma/sparc32_dma.c                          | 10 ++-
 hw/dma/xilinx_axidma.c                        |  5 +-
 hw/dma/xlnx-zdma.c                            |  2 +-
 hw/dma/xlnx-zynq-devcfg.c                     |  2 +-
 hw/dma/xlnx_csu_dma.c                         |  2 +-
 hw/dma/xlnx_dpdma.c                           |  2 +-
 hw/fsi/aspeed_apb2opb.c                       |  2 +-
 hw/fsi/cfam.c                                 |  2 +-
 hw/fsi/fsi-master.c                           |  2 +-
 hw/fsi/fsi.c                                  |  2 +-
 hw/fsi/lbus.c                                 |  2 +-
 hw/gpio/aspeed_gpio.c                         | 16 ++--
 hw/gpio/bcm2835_gpio.c                        |  2 +-
 hw/gpio/bcm2838_gpio.c                        |  2 +-
 hw/gpio/gpio_key.c                            |  2 +-
 hw/gpio/imx_gpio.c                            |  2 +-
 hw/gpio/mpc8xxx.c                             |  2 +-
 hw/gpio/npcm7xx_gpio.c                        |  2 +-
 hw/gpio/nrf51_gpio.c                          |  2 +-
 hw/gpio/omap_gpio.c                           |  2 +-
 hw/gpio/pca9552.c                             |  4 +-
 hw/gpio/pca9554.c                             |  2 +-
 hw/gpio/pcf8574.c                             |  2 +-
 hw/gpio/pl061.c                               |  2 +-
 hw/gpio/sifive_gpio.c                         |  2 +-
 hw/gpio/stm32l4x5_gpio.c                      |  2 +-
 hw/gpio/zaurus.c                              |  2 +-
 hw/hppa/machine.c                             |  4 +-
 hw/hyperv/hv-balloon.c                        |  2 +-
 hw/hyperv/hyperv.c                            |  2 +-
 hw/hyperv/hyperv_testdev.c                    |  2 +-
 hw/hyperv/syndbg.c                            |  2 +-
 hw/hyperv/vmbus.c                             |  6 +-
 hw/i2c/allwinner-i2c.c                        |  2 +-
 hw/i2c/aspeed_i2c.c                           | 17 ++--
 hw/i2c/bcm2835_i2c.c                          |  2 +-
 hw/i2c/bitbang_i2c.c                          |  2 +-
 hw/i2c/core.c                                 |  2 +-
 hw/i2c/exynos4210_i2c.c                       |  2 +-
 hw/i2c/i2c_mux_pca954x.c                      |  6 +-
 hw/i2c/imx_i2c.c                              |  2 +-
 hw/i2c/microbit_i2c.c                         |  2 +-
 hw/i2c/mpc_i2c.c                              |  2 +-
 hw/i2c/npcm7xx_smbus.c                        |  2 +-
 hw/i2c/omap_i2c.c                             |  2 +-
 hw/i2c/pmbus_device.c                         |  2 +-
 hw/i2c/ppc4xx_i2c.c                           |  2 +-
 hw/i2c/smbus_eeprom.c                         |  2 +-
 hw/i2c/smbus_ich9.c                           |  2 +-
 hw/i2c/smbus_slave.c                          |  2 +-
 hw/i386/amd_iommu.c                           |  7 +-
 hw/i386/intel_iommu.c                         |  4 +-
 hw/i386/kvm/apic.c                            |  2 +-
 hw/i386/kvm/clock.c                           |  2 +-
 hw/i386/kvm/i8254.c                           |  2 +-
 hw/i386/kvm/i8259.c                           |  2 +-
 hw/i386/kvm/ioapic.c                          |  2 +-
 hw/i386/kvm/xen_evtchn.c                      |  2 +-
 hw/i386/kvm/xen_gnttab.c                      |  2 +-
 hw/i386/kvm/xen_overlay.c                     |  2 +-
 hw/i386/kvm/xen_primary_console.c             |  2 +-
 hw/i386/kvm/xen_xenstore.c                    |  2 +-
 hw/i386/microvm.c                             |  2 +-
 hw/i386/nitro_enclave.c                       |  2 +-
 hw/i386/pc.c                                  |  2 +-
 hw/i386/port92.c                              |  2 +-
 hw/i386/sgx-epc.c                             |  2 +-
 hw/i386/vapic.c                               |  2 +-
 hw/i386/vmmouse.c                             |  2 +-
 hw/i386/vmport.c                              |  2 +-
 hw/i386/x86-iommu.c                           |  2 +-
 hw/i386/x86.c                                 |  2 +-
 hw/i386/xen/xen-pvh.c                         |  2 +-
 hw/i386/xen/xen_apic.c                        |  2 +-
 hw/i386/xen/xen_platform.c                    |  2 +-
 hw/i386/xen/xen_pvdevice.c                    |  2 +-
 hw/ide/ahci-allwinner.c                       |  2 +-
 hw/ide/ahci-sysbus.c                          |  2 +-
 hw/ide/cf.c                                   |  2 +-
 hw/ide/cmd646.c                               |  2 +-
 hw/ide/ich.c                                  |  2 +-
 hw/ide/ide-bus.c                              |  2 +-
 hw/ide/ide-dev.c                              |  6 +-
 hw/ide/isa.c                                  |  2 +-
 hw/ide/macio.c                                |  2 +-
 hw/ide/mmio.c                                 |  2 +-
 hw/ide/piix.c                                 |  4 +-
 hw/ide/sii3112.c                              |  2 +-
 hw/ide/via.c                                  |  2 +-
 hw/input/adb-kbd.c                            |  2 +-
 hw/input/adb-mouse.c                          |  2 +-
 hw/input/adb.c                                |  4 +-
 hw/input/lasips2.c                            |  8 +-
 hw/input/pckbd.c                              |  4 +-
 hw/input/pl050.c                              |  6 +-
 hw/input/ps2.c                                |  6 +-
 hw/input/stellaris_gamepad.c                  |  2 +-
 hw/input/virtio-input-hid.c                   |  6 +-
 hw/input/virtio-input-host.c                  |  2 +-
 hw/input/virtio-input.c                       |  2 +-
 hw/intc/allwinner-a10-pic.c                   |  2 +-
 hw/intc/apic.c                                |  2 +-
 hw/intc/apic_common.c                         |  2 +-
 hw/intc/arm_gic.c                             |  2 +-
 hw/intc/arm_gic_common.c                      |  2 +-
 hw/intc/arm_gic_kvm.c                         |  2 +-
 hw/intc/arm_gicv2m.c                          |  2 +-
 hw/intc/arm_gicv3.c                           |  2 +-
 hw/intc/arm_gicv3_common.c                    |  2 +-
 hw/intc/arm_gicv3_its.c                       |  2 +-
 hw/intc/arm_gicv3_its_common.c                |  2 +-
 hw/intc/arm_gicv3_its_kvm.c                   |  2 +-
 hw/intc/arm_gicv3_kvm.c                       |  2 +-
 hw/intc/armv7m_nvic.c                         |  2 +-
 hw/intc/aspeed_intc.c                         |  6 +-
 hw/intc/aspeed_vic.c                          |  2 +-
 hw/intc/bcm2835_ic.c                          |  2 +-
 hw/intc/bcm2836_control.c                     |  2 +-
 hw/intc/exynos4210_combiner.c                 |  2 +-
 hw/intc/exynos4210_gic.c                      |  2 +-
 hw/intc/goldfish_pic.c                        |  2 +-
 hw/intc/grlib_irqmp.c                         |  2 +-
 hw/intc/heathrow_pic.c                        |  2 +-
 hw/intc/i8259.c                               |  2 +-
 hw/intc/i8259_common.c                        |  2 +-
 hw/intc/imx_avic.c                            |  2 +-
 hw/intc/imx_gpcv2.c                           |  2 +-
 hw/intc/ioapic.c                              |  2 +-
 hw/intc/ioapic_common.c                       |  2 +-
 hw/intc/loongarch_extioi.c                    |  2 +-
 hw/intc/loongarch_extioi_common.c             |  3 +-
 hw/intc/loongarch_ipi.c                       |  2 +-
 hw/intc/loongarch_pch_msi.c                   |  2 +-
 hw/intc/loongarch_pch_pic.c                   |  2 +-
 hw/intc/loongarch_pic_common.c                |  3 +-
 hw/intc/loongson_ipi.c                        |  2 +-
 hw/intc/loongson_ipi_common.c                 |  2 +-
 hw/intc/m68k_irqc.c                           |  2 +-
 hw/intc/mips_gic.c                            |  2 +-
 hw/intc/omap_intc.c                           |  2 +-
 hw/intc/ompic.c                               |  2 +-
 hw/intc/openpic.c                             |  2 +-
 hw/intc/openpic_kvm.c                         |  2 +-
 hw/intc/pl190.c                               |  2 +-
 hw/intc/pnv_xive.c                            |  2 +-
 hw/intc/pnv_xive2.c                           |  2 +-
 hw/intc/ppc-uic.c                             |  2 +-
 hw/intc/realview_gic.c                        |  2 +-
 hw/intc/riscv_aclint.c                        |  4 +-
 hw/intc/riscv_aplic.c                         |  2 +-
 hw/intc/riscv_imsic.c                         |  2 +-
 hw/intc/rx_icu.c                              |  2 +-
 hw/intc/s390_flic.c                           |  4 +-
 hw/intc/s390_flic_kvm.c                       |  2 +-
 hw/intc/sifive_plic.c                         |  2 +-
 hw/intc/slavio_intctl.c                       |  2 +-
 hw/intc/spapr_xive.c                          |  2 +-
 hw/intc/xics.c                                |  4 +-
 hw/intc/xics_pnv.c                            |  2 +-
 hw/intc/xics_spapr.c                          |  2 +-
 hw/intc/xilinx_intc.c                         |  2 +-
 hw/intc/xive.c                                |  8 +-
 hw/intc/xive2.c                               |  4 +-
 hw/intc/xlnx-pmu-iomod-intc.c                 |  2 +-
 hw/intc/xlnx-zynqmp-ipi.c                     |  2 +-
 hw/ipack/ipack.c                              |  2 +-
 hw/ipack/tpci200.c                            |  2 +-
 hw/ipmi/ipmi.c                                |  4 +-
 hw/ipmi/ipmi_bmc_extern.c                     |  2 +-
 hw/ipmi/ipmi_bmc_sim.c                        |  2 +-
 hw/ipmi/isa_ipmi_bt.c                         |  2 +-
 hw/ipmi/isa_ipmi_kcs.c                        |  2 +-
 hw/ipmi/pci_ipmi_bt.c                         |  2 +-
 hw/ipmi/pci_ipmi_kcs.c                        |  2 +-
 hw/ipmi/smbus_ipmi.c                          |  2 +-
 hw/isa/fdc37m81x-superio.c                    |  2 +-
 hw/isa/i82378.c                               |  2 +-
 hw/isa/isa-bus.c                              |  6 +-
 hw/isa/isa-superio.c                          |  2 +-
 hw/isa/lpc_ich9.c                             |  2 +-
 hw/isa/pc87312.c                              |  2 +-
 hw/isa/piix.c                                 |  6 +-
 hw/isa/smc37c669-superio.c                    |  2 +-
 hw/isa/vt82c686.c                             | 12 +--
 hw/loongarch/virt.c                           |  2 +-
 hw/m68k/mcf5206.c                             |  2 +-
 hw/m68k/mcf_intc.c                            |  2 +-
 hw/m68k/next-cube.c                           |  8 +-
 hw/m68k/next-kbd.c                            |  2 +-
 hw/m68k/q800-glue.c                           |  2 +-
 hw/m68k/q800.c                                |  2 +-
 hw/m68k/virt.c                                |  4 +-
 hw/mem/cxl_type3.c                            |  2 +-
 hw/mem/npcm7xx_mc.c                           |  2 +-
 hw/mem/nvdimm.c                               |  2 +-
 hw/mem/pc-dimm.c                              |  2 +-
 hw/mem/sparse-mem.c                           |  2 +-
 hw/microblaze/petalogix_s3adsp1800_mmu.c      |  3 +-
 hw/microblaze/xlnx-zynqmp-pmu.c               |  2 +-
 hw/mips/cps.c                                 |  2 +-
 hw/mips/jazz.c                                |  4 +-
 hw/mips/loongson3_virt.c                      |  2 +-
 hw/misc/a9scu.c                               |  2 +-
 hw/misc/allwinner-a10-ccm.c                   |  2 +-
 hw/misc/allwinner-a10-dramc.c                 |  2 +-
 hw/misc/allwinner-cpucfg.c                    |  2 +-
 hw/misc/allwinner-h3-ccu.c                    |  2 +-
 hw/misc/allwinner-h3-dramc.c                  |  2 +-
 hw/misc/allwinner-h3-sysctrl.c                |  3 +-
 hw/misc/allwinner-r40-ccu.c                   |  2 +-
 hw/misc/allwinner-r40-dramc.c                 |  2 +-
 hw/misc/allwinner-sid.c                       |  2 +-
 hw/misc/allwinner-sramc.c                     |  4 +-
 hw/misc/applesmc.c                            |  2 +-
 hw/misc/arm11scu.c                            |  2 +-
 hw/misc/arm_l2x0.c                            |  2 +-
 hw/misc/arm_sysctl.c                          |  2 +-
 hw/misc/armsse-cpu-pwrctrl.c                  |  2 +-
 hw/misc/armsse-cpuid.c                        |  2 +-
 hw/misc/armsse-mhu.c                          |  2 +-
 hw/misc/armv7m_ras.c                          |  2 +-
 hw/misc/aspeed_hace.c                         | 12 +--
 hw/misc/aspeed_i3c.c                          |  4 +-
 hw/misc/aspeed_lpc.c                          |  2 +-
 hw/misc/aspeed_peci.c                         |  2 +-
 hw/misc/aspeed_sbc.c                          |  4 +-
 hw/misc/aspeed_scu.c                          | 14 +--
 hw/misc/aspeed_sdmc.c                         | 10 +--
 hw/misc/aspeed_sli.c                          |  6 +-
 hw/misc/aspeed_xdma.c                         |  8 +-
 hw/misc/auxbus.c                              |  6 +-
 hw/misc/avr_power.c                           |  2 +-
 hw/misc/axp2xx.c                              |  6 +-
 hw/misc/bcm2835_cprman.c                      | 10 +--
 hw/misc/bcm2835_mbox.c                        |  2 +-
 hw/misc/bcm2835_mphi.c                        |  2 +-
 hw/misc/bcm2835_powermgt.c                    |  2 +-
 hw/misc/bcm2835_property.c                    |  2 +-
 hw/misc/bcm2835_rng.c                         |  2 +-
 hw/misc/bcm2835_thermal.c                     |  2 +-
 hw/misc/debugexit.c                           |  2 +-
 hw/misc/djmemc.c                              |  2 +-
 hw/misc/eccmemctl.c                           |  2 +-
 hw/misc/edu.c                                 |  2 +-
 hw/misc/empty_slot.c                          |  2 +-
 hw/misc/exynos4210_clk.c                      |  2 +-
 hw/misc/exynos4210_pmu.c                      |  2 +-
 hw/misc/exynos4210_rng.c                      |  2 +-
 hw/misc/grlib_ahb_apb_pnp.c                   |  4 +-
 hw/misc/i2c-echo.c                            |  2 +-
 hw/misc/imx25_ccm.c                           |  2 +-
 hw/misc/imx31_ccm.c                           |  2 +-
 hw/misc/imx6_ccm.c                            |  2 +-
 hw/misc/imx6_src.c                            |  2 +-
 hw/misc/imx6ul_ccm.c                          |  2 +-
 hw/misc/imx7_ccm.c                            |  4 +-
 hw/misc/imx7_gpr.c                            |  2 +-
 hw/misc/imx7_snvs.c                           |  2 +-
 hw/misc/imx7_src.c                            |  2 +-
 hw/misc/imx8mp_analog.c                       |  2 +-
 hw/misc/imx8mp_ccm.c                          |  2 +-
 hw/misc/imx_rngc.c                            |  2 +-
 hw/misc/iosb.c                                |  2 +-
 hw/misc/iotkit-secctl.c                       |  2 +-
 hw/misc/iotkit-sysctl.c                       |  2 +-
 hw/misc/iotkit-sysinfo.c                      |  2 +-
 hw/misc/ivshmem-flat.c                        |  2 +-
 hw/misc/ivshmem-pci.c                         |  6 +-
 hw/misc/lasi.c                                |  2 +-
 hw/misc/led.c                                 |  2 +-
 hw/misc/mac_via.c                             |  4 +-
 hw/misc/macio/cuda.c                          |  4 +-
 hw/misc/macio/gpio.c                          |  2 +-
 hw/misc/macio/mac_dbdma.c                     |  2 +-
 hw/misc/macio/macio.c                         |  6 +-
 hw/misc/macio/pmu.c                           |  4 +-
 hw/misc/mchp_pfsoc_dmc.c                      |  5 +-
 hw/misc/mchp_pfsoc_ioscb.c                    |  2 +-
 hw/misc/mchp_pfsoc_sysreg.c                   |  2 +-
 hw/misc/mips_cmgcr.c                          |  2 +-
 hw/misc/mips_cpc.c                            |  2 +-
 hw/misc/mips_itu.c                            |  2 +-
 hw/misc/mos6522.c                             |  2 +-
 hw/misc/mps2-fpgaio.c                         |  2 +-
 hw/misc/mps2-scc.c                            |  2 +-
 hw/misc/msf2-sysreg.c                         |  2 +-
 hw/misc/npcm7xx_mft.c                         |  2 +-
 hw/misc/npcm7xx_pwm.c                         |  2 +-
 hw/misc/npcm7xx_rng.c                         |  2 +-
 hw/misc/npcm_clk.c                            | 12 +--
 hw/misc/npcm_gcr.c                            |  6 +-
 hw/misc/nrf51_rng.c                           |  2 +-
 hw/misc/pc-testdev.c                          |  2 +-
 hw/misc/pci-testdev.c                         |  2 +-
 hw/misc/pvpanic-isa.c                         |  2 +-
 hw/misc/pvpanic-mmio.c                        |  2 +-
 hw/misc/pvpanic-pci.c                         |  2 +-
 hw/misc/sbsa_ec.c                             |  2 +-
 hw/misc/sifive_e_aon.c                        |  2 +-
 hw/misc/sifive_u_otp.c                        |  2 +-
 hw/misc/sifive_u_prci.c                       |  2 +-
 hw/misc/slavio_misc.c                         |  2 +-
 hw/misc/stm32_rcc.c                           |  2 +-
 hw/misc/stm32f2xx_syscfg.c                    |  2 +-
 hw/misc/stm32f4xx_exti.c                      |  2 +-
 hw/misc/stm32f4xx_syscfg.c                    |  2 +-
 hw/misc/stm32l4x5_exti.c                      |  2 +-
 hw/misc/stm32l4x5_rcc.c                       |  6 +-
 hw/misc/stm32l4x5_syscfg.c                    |  2 +-
 hw/misc/tz-mpc.c                              |  4 +-
 hw/misc/tz-msc.c                              |  2 +-
 hw/misc/tz-ppc.c                              |  2 +-
 hw/misc/unimp.c                               |  2 +-
 hw/misc/virt_ctrl.c                           |  2 +-
 hw/misc/vmcoreinfo.c                          |  2 +-
 hw/misc/xlnx-versal-cframe-reg.c              |  4 +-
 hw/misc/xlnx-versal-cfu.c                     |  6 +-
 hw/misc/xlnx-versal-crl.c                     |  2 +-
 hw/misc/xlnx-versal-pmc-iou-slcr.c            |  3 +-
 hw/misc/xlnx-versal-trng.c                    |  2 +-
 hw/misc/xlnx-versal-xramc.c                   |  2 +-
 hw/misc/xlnx-zynqmp-apu-ctrl.c                |  2 +-
 hw/misc/xlnx-zynqmp-crf.c                     |  2 +-
 hw/misc/zynq_slcr.c                           |  2 +-
 hw/net/allwinner-sun8i-emac.c                 |  3 +-
 hw/net/allwinner_emac.c                       |  2 +-
 hw/net/cadence_gem.c                          |  2 +-
 hw/net/can/can_kvaser_pci.c                   |  2 +-
 hw/net/can/can_mioe3680_pci.c                 |  2 +-
 hw/net/can/can_pcm3680_pci.c                  |  2 +-
 hw/net/can/ctucan_pci.c                       |  2 +-
 hw/net/can/xlnx-versal-canfd.c                |  2 +-
 hw/net/can/xlnx-zynqmp-can.c                  |  2 +-
 hw/net/dp8393x.c                              |  2 +-
 hw/net/e1000.c                                |  2 +-
 hw/net/e1000e.c                               |  2 +-
 hw/net/eepro100.c                             |  2 +-
 hw/net/fsl_etsec/etsec.c                      |  2 +-
 hw/net/ftgmac100.c                            |  4 +-
 hw/net/igb.c                                  |  2 +-
 hw/net/igbvf.c                                |  2 +-
 hw/net/imx_fec.c                              |  2 +-
 hw/net/lan9118.c                              |  2 +-
 hw/net/lan9118_phy.c                          |  2 +-
 hw/net/lance.c                                |  2 +-
 hw/net/lasi_i82596.c                          |  2 +-
 hw/net/mcf_fec.c                              |  2 +-
 hw/net/mipsnet.c                              |  2 +-
 hw/net/msf2-emac.c                            |  2 +-
 hw/net/mv88w8618_eth.c                        |  2 +-
 hw/net/ne2000-isa.c                           |  2 +-
 hw/net/ne2000-pci.c                           |  2 +-
 hw/net/npcm7xx_emc.c                          |  2 +-
 hw/net/npcm_gmac.c                            |  2 +-
 hw/net/npcm_pcs.c                             |  2 +-
 hw/net/opencores_eth.c                        |  2 +-
 hw/net/pcnet-pci.c                            |  2 +-
 hw/net/rocker/rocker.c                        |  2 +-
 hw/net/rtl8139.c                              |  2 +-
 hw/net/smc91c111.c                            |  2 +-
 hw/net/spapr_llan.c                           |  2 +-
 hw/net/stellaris_enet.c                       |  2 +-
 hw/net/sungem.c                               |  2 +-
 hw/net/sunhme.c                               |  2 +-
 hw/net/tulip.c                                |  2 +-
 hw/net/virtio-net.c                           |  2 +-
 hw/net/vmxnet3.c                              |  2 +-
 hw/net/xen_nic.c                              |  2 +-
 hw/net/xgmac.c                                |  2 +-
 hw/net/xilinx_axienet.c                       |  7 +-
 hw/net/xilinx_ethlite.c                       |  2 +-
 hw/nubus/mac-nubus-bridge.c                   |  2 +-
 hw/nubus/nubus-bridge.c                       |  2 +-
 hw/nubus/nubus-bus.c                          |  2 +-
 hw/nubus/nubus-device.c                       |  2 +-
 hw/nubus/nubus-virtio-mmio.c                  |  2 +-
 hw/nvme/ctrl.c                                |  2 +-
 hw/nvme/ns.c                                  |  2 +-
 hw/nvme/subsys.c                              |  2 +-
 hw/nvram/bcm2835_otp.c                        |  2 +-
 hw/nvram/ds1225y.c                            |  2 +-
 hw/nvram/eeprom_at24c.c                       |  2 +-
 hw/nvram/fw_cfg.c                             |  6 +-
 hw/nvram/mac_nvram.c                          |  2 +-
 hw/nvram/npcm7xx_otp.c                        |  6 +-
 hw/nvram/nrf51_nvm.c                          |  2 +-
 hw/nvram/spapr_nvram.c                        |  2 +-
 hw/nvram/xlnx-bbram.c                         |  2 +-
 hw/nvram/xlnx-efuse.c                         |  2 +-
 hw/nvram/xlnx-versal-efuse-cache.c            |  2 +-
 hw/nvram/xlnx-versal-efuse-ctrl.c             |  2 +-
 hw/nvram/xlnx-zynqmp-efuse.c                  |  2 +-
 hw/openrisc/openrisc_sim.c                    |  2 +-
 hw/openrisc/virt.c                            |  2 +-
 hw/pci-bridge/cxl_downstream.c                |  2 +-
 hw/pci-bridge/cxl_root_port.c                 |  2 +-
 hw/pci-bridge/cxl_upstream.c                  |  2 +-
 hw/pci-bridge/gen_pcie_root_port.c            |  2 +-
 hw/pci-bridge/i82801b11.c                     |  2 +-
 hw/pci-bridge/ioh3420.c                       |  2 +-
 hw/pci-bridge/pci_bridge_dev.c                |  4 +-
 hw/pci-bridge/pci_expander_bridge.c           | 12 +--
 hw/pci-bridge/pcie_pci_bridge.c               |  2 +-
 hw/pci-bridge/pcie_root_port.c                |  2 +-
 hw/pci-bridge/simba.c                         |  2 +-
 hw/pci-bridge/xio3130_downstream.c            |  2 +-
 hw/pci-bridge/xio3130_upstream.c              |  2 +-
 hw/pci-host/articia.c                         |  6 +-
 hw/pci-host/astro.c                           |  6 +-
 hw/pci-host/bonito.c                          |  4 +-
 hw/pci-host/designware.c                      |  9 +-
 hw/pci-host/dino.c                            |  2 +-
 hw/pci-host/fsl_imx8m_phy.c                   |  2 +-
 hw/pci-host/gpex.c                            |  4 +-
 hw/pci-host/grackle.c                         |  4 +-
 hw/pci-host/gt64120.c                         |  4 +-
 hw/pci-host/i440fx.c                          |  4 +-
 hw/pci-host/mv64361.c                         |  6 +-
 hw/pci-host/pnv_phb.c                         |  4 +-
 hw/pci-host/pnv_phb3.c                        |  6 +-
 hw/pci-host/pnv_phb3_msi.c                    |  2 +-
 hw/pci-host/pnv_phb3_pbcq.c                   |  2 +-
 hw/pci-host/pnv_phb4.c                        |  6 +-
 hw/pci-host/pnv_phb4_pec.c                    |  4 +-
 hw/pci-host/ppc440_pcix.c                     |  2 +-
 hw/pci-host/ppc4xx_pci.c                      |  4 +-
 hw/pci-host/ppce500.c                         |  4 +-
 hw/pci-host/q35.c                             |  4 +-
 hw/pci-host/raven.c                           |  4 +-
 hw/pci-host/remote.c                          |  2 +-
 hw/pci-host/sabre.c                           |  4 +-
 hw/pci-host/sh_pci.c                          |  4 +-
 hw/pci-host/uninorth.c                        | 19 ++--
 hw/pci-host/versatile.c                       |  4 +-
 hw/pci-host/xen_igd_pt.c                      |  3 +-
 hw/pci-host/xilinx-pcie.c                     |  4 +-
 hw/pci/pci.c                                  |  6 +-
 hw/pci/pci_bridge.c                           |  2 +-
 hw/pci/pci_host.c                             |  2 +-
 hw/pci/pcie_port.c                            |  4 +-
 hw/ppc/amigaone.c                             |  2 +-
 hw/ppc/e500plat.c                             |  2 +-
 hw/ppc/mac_newworld.c                         |  2 +-
 hw/ppc/mac_oldworld.c                         |  2 +-
 hw/ppc/mpc8544ds.c                            |  2 +-
 hw/ppc/pef.c                                  |  2 +-
 hw/ppc/pegasos2.c                             |  2 +-
 hw/ppc/pnv.c                                  | 25 +++---
 hw/ppc/pnv_adu.c                              |  2 +-
 hw/ppc/pnv_chiptod.c                          |  6 +-
 hw/ppc/pnv_core.c                             | 14 +--
 hw/ppc/pnv_homer.c                            |  8 +-
 hw/ppc/pnv_i2c.c                              |  2 +-
 hw/ppc/pnv_lpc.c                              |  8 +-
 hw/ppc/pnv_n1_chiplet.c                       |  2 +-
 hw/ppc/pnv_nest_pervasive.c                   |  2 +-
 hw/ppc/pnv_occ.c                              |  8 +-
 hw/ppc/pnv_pnor.c                             |  2 +-
 hw/ppc/pnv_psi.c                              |  8 +-
 hw/ppc/pnv_sbe.c                              |  6 +-
 hw/ppc/ppc440_uc.c                            |  2 +-
 hw/ppc/ppc4xx_devs.c                          |  8 +-
 hw/ppc/ppc4xx_sdram.c                         |  4 +-
 hw/ppc/ppce500_spin.c                         |  2 +-
 hw/ppc/prep_systemio.c                        |  2 +-
 hw/ppc/rs6000_mc.c                            |  2 +-
 hw/ppc/spapr.c                                |  4 +-
 hw/ppc/spapr_cpu_core.c                       |  2 +-
 hw/ppc/spapr_drc.c                            | 16 ++--
 hw/ppc/spapr_iommu.c                          |  5 +-
 hw/ppc/spapr_nvdimm.c                         |  2 +-
 hw/ppc/spapr_pci.c                            |  2 +-
 hw/ppc/spapr_rng.c                            |  2 +-
 hw/ppc/spapr_rtc.c                            |  2 +-
 hw/ppc/spapr_tpm_proxy.c                      |  2 +-
 hw/ppc/spapr_vio.c                            |  6 +-
 hw/remote/machine.c                           |  2 +-
 hw/remote/proxy.c                             |  2 +-
 hw/remote/remote-obj.c                        |  2 +-
 hw/remote/vfio-user-obj.c                     |  2 +-
 hw/riscv/microchip_pfsoc.c                    |  5 +-
 hw/riscv/opentitan.c                          |  4 +-
 hw/riscv/riscv-iommu-pci.c                    |  2 +-
 hw/riscv/riscv-iommu-sys.c                    |  2 +-
 hw/riscv/riscv-iommu.c                        |  4 +-
 hw/riscv/riscv_hart.c                         |  2 +-
 hw/riscv/shakti_c.c                           |  4 +-
 hw/riscv/sifive_e.c                           |  4 +-
 hw/riscv/sifive_u.c                           |  4 +-
 hw/riscv/spike.c                              |  2 +-
 hw/riscv/virt.c                               |  2 +-
 hw/rtc/allwinner-rtc.c                        |  8 +-
 hw/rtc/aspeed_rtc.c                           |  2 +-
 hw/rtc/ds1338.c                               |  2 +-
 hw/rtc/exynos4210_rtc.c                       |  2 +-
 hw/rtc/goldfish_rtc.c                         |  2 +-
 hw/rtc/ls7a_rtc.c                             |  2 +-
 hw/rtc/m41t80.c                               |  2 +-
 hw/rtc/m48t59-isa.c                           |  4 +-
 hw/rtc/m48t59.c                               |  5 +-
 hw/rtc/mc146818rtc.c                          |  2 +-
 hw/rtc/pl031.c                                |  2 +-
 hw/rtc/rs5c372.c                              |  2 +-
 hw/rtc/sun4v-rtc.c                            |  2 +-
 hw/rtc/xlnx-zynqmp-rtc.c                      |  2 +-
 hw/rx/rx-gdbsim.c                             |  6 +-
 hw/rx/rx62n.c                                 |  6 +-
 hw/s390x/3270-ccw.c                           |  2 +-
 hw/s390x/ap-bridge.c                          |  4 +-
 hw/s390x/ap-device.c                          |  2 +-
 hw/s390x/ccw-device.c                         |  2 +-
 hw/s390x/css-bridge.c                         |  4 +-
 hw/s390x/event-facility.c                     |  4 +-
 hw/s390x/ipl.c                                |  2 +-
 hw/s390x/s390-ccw.c                           |  2 +-
 hw/s390x/s390-pci-bus.c                       |  7 +-
 hw/s390x/s390-skeys-kvm.c                     |  2 +-
 hw/s390x/s390-skeys.c                         |  4 +-
 hw/s390x/s390-stattrib-kvm.c                  |  2 +-
 hw/s390x/s390-stattrib.c                      |  4 +-
 hw/s390x/s390-virtio-ccw.c                    |  4 +-
 hw/s390x/sclp.c                               |  2 +-
 hw/s390x/sclpcpu.c                            |  2 +-
 hw/s390x/sclpquiesce.c                        |  2 +-
 hw/s390x/tod-kvm.c                            |  2 +-
 hw/s390x/tod-tcg.c                            |  2 +-
 hw/s390x/tod.c                                |  2 +-
 hw/s390x/vhost-scsi-ccw.c                     |  2 +-
 hw/s390x/vhost-user-fs-ccw.c                  |  2 +-
 hw/s390x/vhost-vsock-ccw.c                    |  2 +-
 hw/s390x/virtio-ccw-9p.c                      |  2 +-
 hw/s390x/virtio-ccw-balloon.c                 |  2 +-
 hw/s390x/virtio-ccw-blk.c                     |  2 +-
 hw/s390x/virtio-ccw-crypto.c                  |  2 +-
 hw/s390x/virtio-ccw-gpu.c                     |  2 +-
 hw/s390x/virtio-ccw-input.c                   |  2 +-
 hw/s390x/virtio-ccw-mem.c                     |  2 +-
 hw/s390x/virtio-ccw-net.c                     |  2 +-
 hw/s390x/virtio-ccw-rng.c                     |  2 +-
 hw/s390x/virtio-ccw-scsi.c                    |  2 +-
 hw/s390x/virtio-ccw-serial.c                  |  2 +-
 hw/s390x/virtio-ccw.c                         |  4 +-
 hw/scsi/esp-pci.c                             |  4 +-
 hw/scsi/esp.c                                 |  4 +-
 hw/scsi/lsi53c895a.c                          |  4 +-
 hw/scsi/megasas.c                             |  2 +-
 hw/scsi/mptsas.c                              |  2 +-
 hw/scsi/scsi-bus.c                            |  4 +-
 hw/scsi/scsi-disk.c                           |  8 +-
 hw/scsi/scsi-generic.c                        |  2 +-
 hw/scsi/spapr_vscsi.c                         |  2 +-
 hw/scsi/vhost-scsi.c                          |  2 +-
 hw/scsi/vhost-user-scsi.c                     |  2 +-
 hw/scsi/virtio-scsi.c                         |  4 +-
 hw/scsi/vmw_pvscsi.c                          |  2 +-
 hw/sd/allwinner-sdhost.c                      | 15 ++--
 hw/sd/aspeed_sdhci.c                          | 10 +--
 hw/sd/bcm2835_sdhost.c                        |  2 +-
 hw/sd/cadence_sdhci.c                         |  2 +-
 hw/sd/npcm7xx_sdhci.c                         |  2 +-
 hw/sd/omap_mmc.c                              |  2 +-
 hw/sd/pl181.c                                 |  4 +-
 hw/sd/sd.c                                    |  8 +-
 hw/sd/sdhci-pci.c                             |  2 +-
 hw/sd/sdhci.c                                 |  4 +-
 hw/sd/ssi-sd.c                                |  2 +-
 hw/sensor/adm1266.c                           |  2 +-
 hw/sensor/adm1272.c                           |  2 +-
 hw/sensor/dps310.c                            |  2 +-
 hw/sensor/emc141x.c                           |  4 +-
 hw/sensor/isl_pmbus_vr.c                      |  8 +-
 hw/sensor/lsm303dlhc_mag.c                    |  2 +-
 hw/sensor/max31785.c                          |  2 +-
 hw/sensor/max34451.c                          |  2 +-
 hw/sensor/tmp105.c                            |  2 +-
 hw/sensor/tmp421.c                            |  2 +-
 hw/sparc/sun4m.c                              | 28 +++---
 hw/sparc/sun4m_iommu.c                        |  5 +-
 hw/sparc64/niagara.c                          |  2 +-
 hw/sparc64/sun4u.c                            | 12 +--
 hw/sparc64/sun4u_iommu.c                      |  5 +-
 hw/ssi/allwinner-a10-spi.c                    |  2 +-
 hw/ssi/aspeed_smc.c                           | 36 ++++----
 hw/ssi/bcm2835_spi.c                          |  2 +-
 hw/ssi/ibex_spi_host.c                        |  2 +-
 hw/ssi/imx_spi.c                              |  2 +-
 hw/ssi/mss-spi.c                              |  2 +-
 hw/ssi/npcm7xx_fiu.c                          |  2 +-
 hw/ssi/npcm_pspi.c                            |  2 +-
 hw/ssi/pl022.c                                |  2 +-
 hw/ssi/pnv_spi.c                              |  2 +-
 hw/ssi/sifive_spi.c                           |  2 +-
 hw/ssi/ssi.c                                  |  4 +-
 hw/ssi/stm32f2xx_spi.c                        |  2 +-
 hw/ssi/xilinx_spi.c                           |  2 +-
 hw/ssi/xilinx_spips.c                         |  6 +-
 hw/ssi/xlnx-versal-ospi.c                     |  2 +-
 hw/timer/a9gtimer.c                           |  2 +-
 hw/timer/allwinner-a10-pit.c                  |  2 +-
 hw/timer/arm_mptimer.c                        |  2 +-
 hw/timer/arm_timer.c                          |  2 +-
 hw/timer/armv7m_systick.c                     |  2 +-
 hw/timer/aspeed_timer.c                       | 12 +--
 hw/timer/avr_timer16.c                        |  2 +-
 hw/timer/bcm2835_systmr.c                     |  2 +-
 hw/timer/cadence_ttc.c                        |  2 +-
 hw/timer/cmsdk-apb-dualtimer.c                |  2 +-
 hw/timer/cmsdk-apb-timer.c                    |  2 +-
 hw/timer/digic-timer.c                        |  2 +-
 hw/timer/exynos4210_mct.c                     |  2 +-
 hw/timer/exynos4210_pwm.c                     |  2 +-
 hw/timer/grlib_gptimer.c                      |  2 +-
 hw/timer/hpet.c                               |  2 +-
 hw/timer/i8254.c                              |  2 +-
 hw/timer/i8254_common.c                       |  2 +-
 hw/timer/ibex_timer.c                         |  2 +-
 hw/timer/imx_epit.c                           |  2 +-
 hw/timer/imx_gpt.c                            |  2 +-
 hw/timer/mss-timer.c                          |  2 +-
 hw/timer/npcm7xx_timer.c                      |  2 +-
 hw/timer/nrf51_timer.c                        |  2 +-
 hw/timer/pxa2xx_timer.c                       |  4 +-
 hw/timer/renesas_cmt.c                        |  2 +-
 hw/timer/renesas_tmr.c                        |  2 +-
 hw/timer/sifive_pwm.c                         |  2 +-
 hw/timer/slavio_timer.c                       |  2 +-
 hw/timer/sse-counter.c                        |  2 +-
 hw/timer/sse-timer.c                          |  2 +-
 hw/timer/stellaris-gptm.c                     |  2 +-
 hw/timer/stm32f2xx_timer.c                    |  2 +-
 hw/timer/xilinx_timer.c                       |  2 +-
 hw/tpm/tpm_crb.c                              |  2 +-
 hw/tpm/tpm_spapr.c                            |  2 +-
 hw/tpm/tpm_tis_i2c.c                          |  2 +-
 hw/tpm/tpm_tis_isa.c                          |  2 +-
 hw/tpm/tpm_tis_sysbus.c                       |  2 +-
 hw/tricore/tc27x_soc.c                        |  4 +-
 hw/tricore/triboard.c                         |  2 +-
 hw/tricore/tricore_testdevice.c               |  2 +-
 hw/uefi/var-service-sysbus.c                  |  4 +-
 hw/ufs/lu.c                                   |  2 +-
 hw/ufs/ufs.c                                  |  4 +-
 hw/usb/bus.c                                  |  4 +-
 hw/usb/canokey.c                              |  2 +-
 hw/usb/ccid-card-emulated.c                   |  2 +-
 hw/usb/ccid-card-passthru.c                   |  2 +-
 hw/usb/chipidea.c                             |  2 +-
 hw/usb/dev-audio.c                            |  2 +-
 hw/usb/dev-hid.c                              |  8 +-
 hw/usb/dev-hub.c                              |  2 +-
 hw/usb/dev-mtp.c                              |  2 +-
 hw/usb/dev-network.c                          |  2 +-
 hw/usb/dev-serial.c                           |  6 +-
 hw/usb/dev-smartcard-reader.c                 |  4 +-
 hw/usb/dev-storage-bot.c                      |  2 +-
 hw/usb/dev-storage-classic.c                  |  2 +-
 hw/usb/dev-storage.c                          |  2 +-
 hw/usb/dev-uas.c                              |  2 +-
 hw/usb/dev-wacom.c                            |  2 +-
 hw/usb/hcd-dwc2.c                             |  2 +-
 hw/usb/hcd-dwc3.c                             |  2 +-
 hw/usb/hcd-ehci-pci.c                         |  4 +-
 hw/usb/hcd-ehci-sysbus.c                      | 16 ++--
 hw/usb/hcd-ohci-pci.c                         |  2 +-
 hw/usb/hcd-ohci-sysbus.c                      |  2 +-
 hw/usb/hcd-uhci.c                             |  4 +-
 hw/usb/hcd-uhci.h                             |  2 +-
 hw/usb/hcd-xhci-nec.c                         |  2 +-
 hw/usb/hcd-xhci-pci.c                         |  4 +-
 hw/usb/hcd-xhci-sysbus.c                      |  2 +-
 hw/usb/hcd-xhci.c                             |  2 +-
 hw/usb/host-libusb.c                          |  2 +-
 hw/usb/imx-usb-phy.c                          |  2 +-
 hw/usb/redirect.c                             |  2 +-
 hw/usb/u2f-emulated.c                         |  2 +-
 hw/usb/u2f-passthru.c                         |  2 +-
 hw/usb/u2f.c                                  |  2 +-
 hw/usb/xlnx-usb-subsystem.c                   |  2 +-
 hw/usb/xlnx-versal-usb2-ctrl-regs.c           |  2 +-
 hw/vfio/amd-xgbe.c                            |  2 +-
 hw/vfio/ap.c                                  |  2 +-
 hw/vfio/calxeda-xgmac.c                       |  2 +-
 hw/vfio/ccw.c                                 |  2 +-
 hw/vfio/container.c                           |  4 +-
 hw/vfio/igd.c                                 |  3 +-
 hw/vfio/iommufd.c                             |  4 +-
 hw/vfio/pci.c                                 |  5 +-
 hw/vfio/platform.c                            |  2 +-
 hw/vfio/spapr.c                               |  2 +-
 hw/virtio/vdpa-dev-pci.c                      |  3 +-
 hw/virtio/vdpa-dev.c                          |  2 +-
 hw/virtio/vhost-scsi-pci.c                    |  2 +-
 hw/virtio/vhost-user-base.c                   |  2 +-
 hw/virtio/vhost-user-blk-pci.c                |  2 +-
 hw/virtio/vhost-user-device-pci.c             |  3 +-
 hw/virtio/vhost-user-device.c                 |  2 +-
 hw/virtio/vhost-user-fs-pci.c                 |  2 +-
 hw/virtio/vhost-user-fs.c                     |  2 +-
 hw/virtio/vhost-user-gpio-pci.c               |  2 +-
 hw/virtio/vhost-user-gpio.c                   |  2 +-
 hw/virtio/vhost-user-i2c-pci.c                |  2 +-
 hw/virtio/vhost-user-i2c.c                    |  2 +-
 hw/virtio/vhost-user-input.c                  |  2 +-
 hw/virtio/vhost-user-rng-pci.c                |  2 +-
 hw/virtio/vhost-user-rng.c                    |  2 +-
 hw/virtio/vhost-user-scmi-pci.c               |  2 +-
 hw/virtio/vhost-user-scmi.c                   |  2 +-
 hw/virtio/vhost-user-scsi-pci.c               |  2 +-
 hw/virtio/vhost-user-snd-pci.c                |  2 +-
 hw/virtio/vhost-user-snd.c                    |  2 +-
 hw/virtio/vhost-user-vsock-pci.c              |  3 +-
 hw/virtio/vhost-user-vsock.c                  |  2 +-
 hw/virtio/vhost-vsock-common.c                |  2 +-
 hw/virtio/vhost-vsock-pci.c                   |  2 +-
 hw/virtio/vhost-vsock.c                       |  2 +-
 hw/virtio/virtio-9p-pci.c                     |  2 +-
 hw/virtio/virtio-balloon-pci.c                |  2 +-
 hw/virtio/virtio-balloon.c                    |  2 +-
 hw/virtio/virtio-blk-pci.c                    |  2 +-
 hw/virtio/virtio-bus.c                        |  2 +-
 hw/virtio/virtio-crypto-pci.c                 |  2 +-
 hw/virtio/virtio-crypto.c                     |  2 +-
 hw/virtio/virtio-input-pci.c                  |  7 +-
 hw/virtio/virtio-iommu-pci.c                  |  2 +-
 hw/virtio/virtio-iommu.c                      |  4 +-
 hw/virtio/virtio-mem-pci.c                    |  2 +-
 hw/virtio/virtio-mem.c                        |  5 +-
 hw/virtio/virtio-mmio.c                       |  4 +-
 hw/virtio/virtio-net-pci.c                    |  2 +-
 hw/virtio/virtio-nsm-pci.c                    |  2 +-
 hw/virtio/virtio-nsm.c                        |  2 +-
 hw/virtio/virtio-pci.c                        |  8 +-
 hw/virtio/virtio-pmem-pci.c                   |  2 +-
 hw/virtio/virtio-pmem.c                       |  2 +-
 hw/virtio/virtio-rng-pci.c                    |  2 +-
 hw/virtio/virtio-rng.c                        |  2 +-
 hw/virtio/virtio-scsi-pci.c                   |  2 +-
 hw/virtio/virtio-serial-pci.c                 |  2 +-
 hw/virtio/virtio.c                            |  2 +-
 hw/vmapple/aes.c                              |  2 +-
 hw/vmapple/bdif.c                             |  2 +-
 hw/vmapple/cfg.c                              |  2 +-
 hw/vmapple/virtio-blk.c                       |  5 +-
 hw/vmapple/vmapple.c                          |  2 +-
 hw/watchdog/allwinner-wdt.c                   |  6 +-
 hw/watchdog/cmsdk-apb-watchdog.c              |  2 +-
 hw/watchdog/sbsa_gwdt.c                       |  2 +-
 hw/watchdog/spapr_watchdog.c                  |  2 +-
 hw/watchdog/wdt_aspeed.c                      | 12 +--
 hw/watchdog/wdt_diag288.c                     |  2 +-
 hw/watchdog/wdt_i6300esb.c                    |  2 +-
 hw/watchdog/wdt_ib700.c                       |  2 +-
 hw/watchdog/wdt_imx2.c                        |  2 +-
 hw/xen/xen-bus.c                              |  4 +-
 hw/xen/xen-legacy-backend.c                   |  4 +-
 hw/xen/xen-pvh-common.c                       |  2 +-
 hw/xen/xen_pt.c                               |  2 +-
 hw/xen/xen_pt_graphics.c                      |  2 +-
 hw/xtensa/xtfpga.c                            | 16 ++--
 include/hw/boards.h                           |  2 +-
 include/hw/i386/pc.h                          |  5 +-
 include/hw/virtio/virtio-pci.h                |  2 +-
 include/qom/object.h                          |  4 +-
 io/channel-buffer.c                           |  2 +-
 io/channel-command.c                          |  2 +-
 io/channel-file.c                             |  2 +-
 io/channel-null.c                             |  2 +-
 io/channel-socket.c                           |  2 +-
 io/channel-tls.c                              |  2 +-
 io/channel-websock.c                          |  2 +-
 iothread.c                                    |  2 +-
 migration/channel-block.c                     |  2 +-
 migration/migration.c                         |  2 +-
 migration/rdma.c                              |  2 +-
 net/can/can_core.c                            |  2 +-
 net/can/can_host.c                            |  2 +-
 net/can/can_socketcan.c                       |  2 +-
 net/colo-compare.c                            |  2 +-
 net/dump.c                                    |  2 +-
 net/filter-buffer.c                           |  2 +-
 net/filter-mirror.c                           |  4 +-
 net/filter-replay.c                           |  2 +-
 net/filter-rewriter.c                         |  2 +-
 net/filter.c                                  |  2 +-
 qom/object.c                                  |  4 +-
 rust/qemu-api/src/qom.rs                      |  2 +-
 .../codeconverter/qom_type_info.py            |  3 +-
 scsi/pr-manager-helper.c                      |  2 +-
 system/qtest.c                                |  2 +-
 target/alpha/cpu.c                            |  2 +-
 target/arm/cpu.c                              |  4 +-
 target/arm/cpu.h                              |  2 +-
 target/arm/cpu64.c                            |  4 +-
 target/arm/tcg/cpu-v7m.c                      |  2 +-
 target/avr/cpu.c                              |  2 +-
 target/hexagon/cpu.c                          |  2 +-
 target/hppa/cpu.c                             |  2 +-
 target/i386/confidential-guest.c              |  2 +-
 target/i386/cpu.c                             |  8 +-
 target/i386/host-cpu.c                        |  2 +-
 target/i386/hvf/hvf-cpu.c                     |  2 +-
 target/i386/kvm/kvm-cpu.c                     |  2 +-
 target/i386/nvmm/nvmm-accel-ops.c             |  2 +-
 target/i386/nvmm/nvmm-all.c                   |  2 +-
 target/i386/sev.c                             |  6 +-
 target/i386/tcg/tcg-cpu.c                     |  2 +-
 target/i386/whpx/whpx-accel-ops.c             |  2 +-
 target/i386/whpx/whpx-all.c                   |  2 +-
 target/i386/whpx/whpx-apic.c                  |  2 +-
 target/loongarch/cpu.c                        |  6 +-
 target/m68k/cpu.c                             |  6 +-
 target/microblaze/cpu.c                       |  2 +-
 target/mips/cpu.c                             |  4 +-
 target/openrisc/cpu.c                         |  2 +-
 target/ppc/cpu-models.c                       |  2 +-
 target/ppc/cpu.h                              |  3 +-
 target/ppc/cpu_init.c                         | 90 +++++++++----------
 target/ppc/kvm.c                              |  4 +-
 target/riscv/cpu.c                            |  4 +-
 target/riscv/kvm/kvm-cpu.c                    |  4 +-
 target/riscv/tcg/tcg-cpu.c                    |  2 +-
 target/rx/cpu.c                               |  2 +-
 target/s390x/cpu.c                            |  2 +-
 target/s390x/cpu_models.c                     | 10 +--
 target/s390x/kvm/pv.c                         |  2 +-
 target/sh4/cpu.c                              |  8 +-
 target/sparc/cpu.c                            |  4 +-
 target/tricore/cpu.c                          |  2 +-
 target/xtensa/cpu.c                           |  2 +-
 target/xtensa/helper.c                        |  2 +-
 tests/unit/check-qom-interface.c              |  2 +-
 tests/unit/check-qom-proplist.c               |  6 +-
 tests/unit/test-qdev-global-props.c           |  8 +-
 tests/unit/test-smp-parse.c                   | 23 ++---
 ui/console-vc.c                               |  6 +-
 ui/console.c                                  |  4 +-
 ui/dbus-chardev.c                             |  2 +-
 ui/dbus.c                                     |  4 +-
 ui/gtk.c                                      |  2 +-
 ui/input-barrier.c                            |  2 +-
 ui/input-linux.c                              |  2 +-
 ui/spice-app.c                                |  2 +-
 ui/vdagent.c                                  |  2 +-
 util/main-loop.c                              |  2 +-
 util/thread-context.c                         |  2 +-
 1121 files changed, 1774 insertions(+), 1707 deletions(-)

diff --git a/accel/hvf/hvf-accel-ops.c b/accel/hvf/hvf-accel-ops.c
index 601c3bc0ac..5375de7bcf 100644
--- a/accel/hvf/hvf-accel-ops.c
+++ b/accel/hvf/hvf-accel-ops.c
@@ -355,7 +355,7 @@ static inline int hvf_gdbstub_sstep_flags(void)
     return SSTEP_ENABLE | SSTEP_NOIRQ;
 }
 
-static void hvf_accel_class_init(ObjectClass *oc, void *data)
+static void hvf_accel_class_init(ObjectClass *oc, const void *data)
 {
     AccelClass *ac = ACCEL_CLASS(oc);
     ac->name = "HVF";
@@ -578,7 +578,7 @@ static void hvf_remove_all_breakpoints(CPUState *cpu)
     }
 }
 
-static void hvf_accel_ops_class_init(ObjectClass *oc, void *data)
+static void hvf_accel_ops_class_init(ObjectClass *oc, const void *data)
 {
     AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
 
diff --git a/accel/kvm/kvm-accel-ops.c b/accel/kvm/kvm-accel-ops.c
index 54ea60909e..e5c15449aa 100644
--- a/accel/kvm/kvm-accel-ops.c
+++ b/accel/kvm/kvm-accel-ops.c
@@ -90,7 +90,7 @@ static int kvm_update_guest_debug_ops(CPUState *cpu)
 }
 #endif
 
-static void kvm_accel_ops_class_init(ObjectClass *oc, void *data)
+static void kvm_accel_ops_class_init(ObjectClass *oc, const void *data)
 {
     AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
 
diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index cba9c78d2f..b8c68c7819 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -3964,7 +3964,7 @@ static int kvm_gdbstub_sstep_flags(void)
     return kvm_sstep_flags;
 }
 
-static void kvm_accel_class_init(ObjectClass *oc, void *data)
+static void kvm_accel_class_init(ObjectClass *oc, const void *data)
 {
     AccelClass *ac = ACCEL_CLASS(oc);
     ac->name = "KVM";
diff --git a/accel/qtest/qtest.c b/accel/qtest/qtest.c
index 7fae80f6a1..92bed9264c 100644
--- a/accel/qtest/qtest.c
+++ b/accel/qtest/qtest.c
@@ -42,7 +42,7 @@ static int qtest_init_accel(MachineState *ms)
     return 0;
 }
 
-static void qtest_accel_class_init(ObjectClass *oc, void *data)
+static void qtest_accel_class_init(ObjectClass *oc, const void *data)
 {
     AccelClass *ac = ACCEL_CLASS(oc);
     ac->name = "QTest";
@@ -59,7 +59,7 @@ static const TypeInfo qtest_accel_type = {
 };
 module_obj(TYPE_QTEST_ACCEL);
 
-static void qtest_accel_ops_class_init(ObjectClass *oc, void *data)
+static void qtest_accel_ops_class_init(ObjectClass *oc, const void *data)
 {
     AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
 
diff --git a/accel/tcg/tcg-accel-ops.c b/accel/tcg/tcg-accel-ops.c
index ccdb781eef..b24d6a7562 100644
--- a/accel/tcg/tcg-accel-ops.c
+++ b/accel/tcg/tcg-accel-ops.c
@@ -224,7 +224,7 @@ static void tcg_accel_ops_init(AccelOpsClass *ops)
     ops->remove_all_breakpoints = tcg_remove_all_breakpoints;
 }
 
-static void tcg_accel_ops_class_init(ObjectClass *oc, void *data)
+static void tcg_accel_ops_class_init(ObjectClass *oc, const void *data)
 {
     AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
 
diff --git a/accel/tcg/tcg-all.c b/accel/tcg/tcg-all.c
index b0d4e3e136..40d7364979 100644
--- a/accel/tcg/tcg-all.c
+++ b/accel/tcg/tcg-all.c
@@ -237,7 +237,7 @@ static int tcg_gdbstub_supported_sstep_flags(void)
     }
 }
 
-static void tcg_accel_class_init(ObjectClass *oc, void *data)
+static void tcg_accel_class_init(ObjectClass *oc, const void *data)
 {
     AccelClass *ac = ACCEL_CLASS(oc);
     ac->name = "tcg";
diff --git a/accel/xen/xen-all.c b/accel/xen/xen-all.c
index 7aa28b9ab9..de52a8f882 100644
--- a/accel/xen/xen-all.c
+++ b/accel/xen/xen-all.c
@@ -116,7 +116,7 @@ static int xen_init(MachineState *ms)
     return 0;
 }
 
-static void xen_accel_class_init(ObjectClass *oc, void *data)
+static void xen_accel_class_init(ObjectClass *oc, const void *data)
 {
     AccelClass *ac = ACCEL_CLASS(oc);
     static GlobalProperty compat[] = {
@@ -147,7 +147,7 @@ static const TypeInfo xen_accel_type = {
     .class_init = xen_accel_class_init,
 };
 
-static void xen_accel_ops_class_init(ObjectClass *oc, void *data)
+static void xen_accel_ops_class_init(ObjectClass *oc, const void *data)
 {
     AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
 
diff --git a/authz/list.c b/authz/list.c
index 0e17eed897..bbd99f2b7f 100644
--- a/authz/list.c
+++ b/authz/list.c
@@ -116,7 +116,7 @@ qauthz_list_finalize(Object *obj)
 
 
 static void
-qauthz_list_class_init(ObjectClass *oc, void *data)
+qauthz_list_class_init(ObjectClass *oc, const void *data)
 {
     QAuthZClass *authz = QAUTHZ_CLASS(oc);
 
diff --git a/authz/listfile.c b/authz/listfile.c
index d31d9103f7..b58d4ebd1d 100644
--- a/authz/listfile.c
+++ b/authz/listfile.c
@@ -220,7 +220,7 @@ qauthz_list_file_finalize(Object *obj)
 
 
 static void
-qauthz_list_file_class_init(ObjectClass *oc, void *data)
+qauthz_list_file_class_init(ObjectClass *oc, const void *data)
 {
     UserCreatableClass *ucc = USER_CREATABLE_CLASS(oc);
     QAuthZClass *authz = QAUTHZ_CLASS(oc);
diff --git a/authz/pamacct.c b/authz/pamacct.c
index c862d9ff39..07b8aad497 100644
--- a/authz/pamacct.c
+++ b/authz/pamacct.c
@@ -103,7 +103,7 @@ qauthz_pam_finalize(Object *obj)
 
 
 static void
-qauthz_pam_class_init(ObjectClass *oc, void *data)
+qauthz_pam_class_init(ObjectClass *oc, const void *data)
 {
     UserCreatableClass *ucc = USER_CREATABLE_CLASS(oc);
     QAuthZClass *authz = QAUTHZ_CLASS(oc);
diff --git a/authz/simple.c b/authz/simple.c
index 0597dcd8ea..f6985b840e 100644
--- a/authz/simple.c
+++ b/authz/simple.c
@@ -78,7 +78,7 @@ qauthz_simple_complete(UserCreatable *uc, Error **errp)
 
 
 static void
-qauthz_simple_class_init(ObjectClass *oc, void *data)
+qauthz_simple_class_init(ObjectClass *oc, const void *data)
 {
     QAuthZClass *authz = QAUTHZ_CLASS(oc);
     UserCreatableClass *ucc = USER_CREATABLE_CLASS(oc);
diff --git a/backends/confidential-guest-support.c b/backends/confidential-guest-support.c
index 1cd9bed505..8ff7bfa857 100644
--- a/backends/confidential-guest-support.c
+++ b/backends/confidential-guest-support.c
@@ -20,7 +20,8 @@ OBJECT_DEFINE_ABSTRACT_TYPE(ConfidentialGuestSupport,
                             CONFIDENTIAL_GUEST_SUPPORT,
                             OBJECT)
 
-static void confidential_guest_support_class_init(ObjectClass *oc, void *data)
+static void confidential_guest_support_class_init(ObjectClass *oc,
+                                                  const void *data)
 {
 }
 
diff --git a/backends/cryptodev-builtin.c b/backends/cryptodev-builtin.c
index 764cee4311..0414c01e06 100644
--- a/backends/cryptodev-builtin.c
+++ b/backends/cryptodev-builtin.c
@@ -608,7 +608,7 @@ static void cryptodev_builtin_cleanup(
 }
 
 static void
-cryptodev_builtin_class_init(ObjectClass *oc, void *data)
+cryptodev_builtin_class_init(ObjectClass *oc, const void *data)
 {
     CryptoDevBackendClass *bc = CRYPTODEV_BACKEND_CLASS(oc);
 
diff --git a/backends/cryptodev-lkcf.c b/backends/cryptodev-lkcf.c
index 352c3e8958..bb7a81d5d0 100644
--- a/backends/cryptodev-lkcf.c
+++ b/backends/cryptodev-lkcf.c
@@ -619,7 +619,7 @@ static int cryptodev_lkcf_close_session(CryptoDevBackend *backend,
     return 0;
 }
 
-static void cryptodev_lkcf_class_init(ObjectClass *oc, void *data)
+static void cryptodev_lkcf_class_init(ObjectClass *oc, const void *data)
 {
     CryptoDevBackendClass *bc = CRYPTODEV_BACKEND_CLASS(oc);
 
diff --git a/backends/cryptodev-vhost-user.c b/backends/cryptodev-vhost-user.c
index 3295c6198a..cb04e68b02 100644
--- a/backends/cryptodev-vhost-user.c
+++ b/backends/cryptodev-vhost-user.c
@@ -393,7 +393,7 @@ static void cryptodev_vhost_user_finalize(Object *obj)
 }
 
 static void
-cryptodev_vhost_user_class_init(ObjectClass *oc, void *data)
+cryptodev_vhost_user_class_init(ObjectClass *oc, const void *data)
 {
     CryptoDevBackendClass *bc = CRYPTODEV_BACKEND_CLASS(oc);
 
diff --git a/backends/cryptodev.c b/backends/cryptodev.c
index 1187b08dac..51bbe5ce40 100644
--- a/backends/cryptodev.c
+++ b/backends/cryptodev.c
@@ -608,7 +608,7 @@ static void cryptodev_backend_schemas_cb(StatsSchemaList **result,
 }
 
 static void
-cryptodev_backend_class_init(ObjectClass *oc, void *data)
+cryptodev_backend_class_init(ObjectClass *oc, const void *data)
 {
     UserCreatableClass *ucc = USER_CREATABLE_CLASS(oc);
 
diff --git a/backends/dbus-vmstate.c b/backends/dbus-vmstate.c
index be6c4d8e0a..8c2deef43d 100644
--- a/backends/dbus-vmstate.c
+++ b/backends/dbus-vmstate.c
@@ -485,7 +485,7 @@ dbus_vmstate_get_id(VMStateIf *vmif)
 }
 
 static void
-dbus_vmstate_class_init(ObjectClass *oc, void *data)
+dbus_vmstate_class_init(ObjectClass *oc, const void *data)
 {
     UserCreatableClass *ucc = USER_CREATABLE_CLASS(oc);
     VMStateIfClass *vc = VMSTATE_IF_CLASS(oc);
diff --git a/backends/host_iommu_device.c b/backends/host_iommu_device.c
index cea76c6925..f6965e4027 100644
--- a/backends/host_iommu_device.c
+++ b/backends/host_iommu_device.c
@@ -17,7 +17,7 @@ OBJECT_DEFINE_ABSTRACT_TYPE(HostIOMMUDevice,
                             HOST_IOMMU_DEVICE,
                             OBJECT)
 
-static void host_iommu_device_class_init(ObjectClass *oc, void *data)
+static void host_iommu_device_class_init(ObjectClass *oc, const void *data)
 {
 }
 
diff --git a/backends/hostmem-epc.c b/backends/hostmem-epc.c
index 1fa2d031e4..ab20b18233 100644
--- a/backends/hostmem-epc.c
+++ b/backends/hostmem-epc.c
@@ -50,7 +50,7 @@ static void sgx_epc_backend_instance_init(Object *obj)
     m->dump = false;
 }
 
-static void sgx_epc_backend_class_init(ObjectClass *oc, void *data)
+static void sgx_epc_backend_class_init(ObjectClass *oc, const void *data)
 {
     HostMemoryBackendClass *bc = MEMORY_BACKEND_CLASS(oc);
 
diff --git a/backends/hostmem-file.c b/backends/hostmem-file.c
index 691a827819..8e3219c061 100644
--- a/backends/hostmem-file.c
+++ b/backends/hostmem-file.c
@@ -270,7 +270,7 @@ static void file_backend_unparent(Object *obj)
 }
 
 static void
-file_backend_class_init(ObjectClass *oc, void *data)
+file_backend_class_init(ObjectClass *oc, const void *data)
 {
     HostMemoryBackendClass *bc = MEMORY_BACKEND_CLASS(oc);
 
diff --git a/backends/hostmem-memfd.c b/backends/hostmem-memfd.c
index 85daa1432c..923239f9cf 100644
--- a/backends/hostmem-memfd.c
+++ b/backends/hostmem-memfd.c
@@ -133,7 +133,7 @@ memfd_backend_instance_init(Object *obj)
 }
 
 static void
-memfd_backend_class_init(ObjectClass *oc, void *data)
+memfd_backend_class_init(ObjectClass *oc, const void *data)
 {
     HostMemoryBackendClass *bc = MEMORY_BACKEND_CLASS(oc);
 
diff --git a/backends/hostmem-ram.c b/backends/hostmem-ram.c
index 868ae6ca80..062b1abb11 100644
--- a/backends/hostmem-ram.c
+++ b/backends/hostmem-ram.c
@@ -37,7 +37,7 @@ ram_backend_memory_alloc(HostMemoryBackend *backend, Error **errp)
 }
 
 static void
-ram_backend_class_init(ObjectClass *oc, void *data)
+ram_backend_class_init(ObjectClass *oc, const void *data)
 {
     HostMemoryBackendClass *bc = MEMORY_BACKEND_CLASS(oc);
 
diff --git a/backends/hostmem-shm.c b/backends/hostmem-shm.c
index f67ad2740b..f66211a2ec 100644
--- a/backends/hostmem-shm.c
+++ b/backends/hostmem-shm.c
@@ -69,7 +69,7 @@ shm_backend_instance_init(Object *obj)
 }
 
 static void
-shm_backend_class_init(ObjectClass *oc, void *data)
+shm_backend_class_init(ObjectClass *oc, const void *data)
 {
     HostMemoryBackendClass *bc = MEMORY_BACKEND_CLASS(oc);
 
diff --git a/backends/hostmem.c b/backends/hostmem.c
index bceca1a8d9..195f37fa44 100644
--- a/backends/hostmem.c
+++ b/backends/hostmem.c
@@ -501,7 +501,7 @@ host_memory_backend_set_use_canonical_path(Object *obj, bool value,
 }
 
 static void
-host_memory_backend_class_init(ObjectClass *oc, void *data)
+host_memory_backend_class_init(ObjectClass *oc, const void *data)
 {
     UserCreatableClass *ucc = USER_CREATABLE_CLASS(oc);
 
diff --git a/backends/iommufd.c b/backends/iommufd.c
index d57da44755..17f7ae3809 100644
--- a/backends/iommufd.c
+++ b/backends/iommufd.c
@@ -64,7 +64,7 @@ static bool iommufd_backend_can_be_deleted(UserCreatable *uc)
     return !be->users;
 }
 
-static void iommufd_backend_class_init(ObjectClass *oc, void *data)
+static void iommufd_backend_class_init(ObjectClass *oc, const void *data)
 {
     UserCreatableClass *ucc = USER_CREATABLE_CLASS(oc);
 
@@ -326,7 +326,7 @@ static int hiod_iommufd_get_cap(HostIOMMUDevice *hiod, int cap, Error **errp)
     }
 }
 
-static void hiod_iommufd_class_init(ObjectClass *oc, void *data)
+static void hiod_iommufd_class_init(ObjectClass *oc, const void *data)
 {
     HostIOMMUDeviceClass *hioc = HOST_IOMMU_DEVICE_CLASS(oc);
 
diff --git a/backends/rng-builtin.c b/backends/rng-builtin.c
index 4cfa7e578b..41b7bfaa27 100644
--- a/backends/rng-builtin.c
+++ b/backends/rng-builtin.c
@@ -55,7 +55,7 @@ static void rng_builtin_finalize(Object *obj)
     qemu_bh_delete(s->bh);
 }
 
-static void rng_builtin_class_init(ObjectClass *klass, void *data)
+static void rng_builtin_class_init(ObjectClass *klass, const void *data)
 {
     RngBackendClass *rbc = RNG_BACKEND_CLASS(klass);
 
diff --git a/backends/rng-egd.c b/backends/rng-egd.c
index 82da46365d..9fd3393ede 100644
--- a/backends/rng-egd.c
+++ b/backends/rng-egd.c
@@ -143,7 +143,7 @@ static void rng_egd_finalize(Object *obj)
     g_free(s->chr_name);
 }
 
-static void rng_egd_class_init(ObjectClass *klass, void *data)
+static void rng_egd_class_init(ObjectClass *klass, const void *data)
 {
     RngBackendClass *rbc = RNG_BACKEND_CLASS(klass);
 
diff --git a/backends/rng-random.c b/backends/rng-random.c
index 3ce6cc9b4a..820bf48c9b 100644
--- a/backends/rng-random.c
+++ b/backends/rng-random.c
@@ -121,7 +121,7 @@ static void rng_random_finalize(Object *obj)
     g_free(s->filename);
 }
 
-static void rng_random_class_init(ObjectClass *klass, void *data)
+static void rng_random_class_init(ObjectClass *klass, const void *data)
 {
     RngBackendClass *rbc = RNG_BACKEND_CLASS(klass);
 
diff --git a/backends/rng.c b/backends/rng.c
index 1f6fb106ae..b3480d27a1 100644
--- a/backends/rng.c
+++ b/backends/rng.c
@@ -99,7 +99,7 @@ static void rng_backend_finalize(Object *obj)
     rng_backend_free_requests(s);
 }
 
-static void rng_backend_class_init(ObjectClass *oc, void *data)
+static void rng_backend_class_init(ObjectClass *oc, const void *data)
 {
     UserCreatableClass *ucc = USER_CREATABLE_CLASS(oc);
 
diff --git a/backends/tpm/tpm_emulator.c b/backends/tpm/tpm_emulator.c
index 00fe015a94..43d350e895 100644
--- a/backends/tpm/tpm_emulator.c
+++ b/backends/tpm/tpm_emulator.c
@@ -1056,7 +1056,7 @@ static void tpm_emulator_inst_finalize(Object *obj)
     vmstate_unregister(NULL, &vmstate_tpm_emulator, obj);
 }
 
-static void tpm_emulator_class_init(ObjectClass *klass, void *data)
+static void tpm_emulator_class_init(ObjectClass *klass, const void *data)
 {
     TPMBackendClass *tbc = TPM_BACKEND_CLASS(klass);
 
diff --git a/backends/tpm/tpm_passthrough.c b/backends/tpm/tpm_passthrough.c
index 09a6abf02d..b7c7074c2a 100644
--- a/backends/tpm/tpm_passthrough.c
+++ b/backends/tpm/tpm_passthrough.c
@@ -364,7 +364,7 @@ static void tpm_passthrough_inst_finalize(Object *obj)
     qapi_free_TPMPassthroughOptions(tpm_pt->options);
 }
 
-static void tpm_passthrough_class_init(ObjectClass *klass, void *data)
+static void tpm_passthrough_class_init(ObjectClass *klass, const void *data)
 {
     TPMBackendClass *tbc = TPM_BACKEND_CLASS(klass);
 
diff --git a/backends/vhost-user.c b/backends/vhost-user.c
index d0e4d71a63..94274a619d 100644
--- a/backends/vhost-user.c
+++ b/backends/vhost-user.c
@@ -163,7 +163,7 @@ static char *get_chardev(Object *obj, Error **errp)
     return NULL;
 }
 
-static void vhost_user_backend_class_init(ObjectClass *oc, void *data)
+static void vhost_user_backend_class_init(ObjectClass *oc, const void *data)
 {
     object_class_property_add_str(oc, "chardev", get_chardev, set_chardev);
 }
diff --git a/block/throttle-groups.c b/block/throttle-groups.c
index 9f4d252c74..9720cafb96 100644
--- a/block/throttle-groups.c
+++ b/block/throttle-groups.c
@@ -933,7 +933,8 @@ static bool throttle_group_can_be_deleted(UserCreatable *uc)
     return OBJECT(uc)->ref == 1;
 }
 
-static void throttle_group_obj_class_init(ObjectClass *klass, void *class_data)
+static void throttle_group_obj_class_init(ObjectClass *klass,
+                                          const void *class_data)
 {
     size_t i = 0;
     UserCreatableClass *ucc = USER_CREATABLE_CLASS(klass);
diff --git a/chardev/baum.c b/chardev/baum.c
index a1d9784d92..f3e8cd27f0 100644
--- a/chardev/baum.c
+++ b/chardev/baum.c
@@ -668,7 +668,7 @@ static void baum_chr_open(Chardev *chr,
     qemu_set_fd_handler(baum->brlapi_fd, baum_chr_read, NULL, baum);
 }
 
-static void char_braille_class_init(ObjectClass *oc, void *data)
+static void char_braille_class_init(ObjectClass *oc, const void *data)
 {
     ChardevClass *cc = CHARDEV_CLASS(oc);
 
diff --git a/chardev/char-console.c b/chardev/char-console.c
index 6c4ce5dbce..7e1bf642eb 100644
--- a/chardev/char-console.c
+++ b/chardev/char-console.c
@@ -34,7 +34,7 @@ static void qemu_chr_open_win_con(Chardev *chr,
     win_chr_set_file(chr, GetStdHandle(STD_OUTPUT_HANDLE), true);
 }
 
-static void char_console_class_init(ObjectClass *oc, void *data)
+static void char_console_class_init(ObjectClass *oc, const void *data)
 {
     ChardevClass *cc = CHARDEV_CLASS(oc);
 
diff --git a/chardev/char-fd.c b/chardev/char-fd.c
index d2c4923359..23bfe3c0b1 100644
--- a/chardev/char-fd.c
+++ b/chardev/char-fd.c
@@ -238,7 +238,7 @@ void qemu_chr_open_fd(Chardev *chr,
     }
 }
 
-static void char_fd_class_init(ObjectClass *oc, void *data)
+static void char_fd_class_init(ObjectClass *oc, const void *data)
 {
     ChardevClass *cc = CHARDEV_CLASS(oc);
 
diff --git a/chardev/char-file.c b/chardev/char-file.c
index 263e6da563..a9e8c5e0d7 100644
--- a/chardev/char-file.c
+++ b/chardev/char-file.c
@@ -123,7 +123,7 @@ static void qemu_chr_parse_file_out(QemuOpts *opts, ChardevBackend *backend,
     file->append = qemu_opt_get_bool(opts, "append", false);
 }
 
-static void char_file_class_init(ObjectClass *oc, void *data)
+static void char_file_class_init(ObjectClass *oc, const void *data)
 {
     ChardevClass *cc = CHARDEV_CLASS(oc);
 
diff --git a/chardev/char-hub.c b/chardev/char-hub.c
index 3a4aae3289..16ffee2017 100644
--- a/chardev/char-hub.c
+++ b/chardev/char-hub.c
@@ -272,7 +272,7 @@ static void qemu_chr_parse_hub(QemuOpts *opts, ChardevBackend *backend,
     }
 }
 
-static void char_hub_class_init(ObjectClass *oc, void *data)
+static void char_hub_class_init(ObjectClass *oc, const void *data)
 {
     ChardevClass *cc = CHARDEV_CLASS(oc);
 
diff --git a/chardev/char-mux.c b/chardev/char-mux.c
index d5f7e1a9cf..6b36290e2c 100644
--- a/chardev/char-mux.c
+++ b/chardev/char-mux.c
@@ -447,7 +447,7 @@ void resume_mux_open(void)
                          chardev_options_parsed_cb, NULL);
 }
 
-static void char_mux_class_init(ObjectClass *oc, void *data)
+static void char_mux_class_init(ObjectClass *oc, const void *data)
 {
     ChardevClass *cc = CHARDEV_CLASS(oc);
 
diff --git a/chardev/char-null.c b/chardev/char-null.c
index 1c6a2900f9..89cb85da79 100644
--- a/chardev/char-null.c
+++ b/chardev/char-null.c
@@ -34,7 +34,7 @@ static void null_chr_open(Chardev *chr,
     *be_opened = false;
 }
 
-static void char_null_class_init(ObjectClass *oc, void *data)
+static void char_null_class_init(ObjectClass *oc, const void *data)
 {
     ChardevClass *cc = CHARDEV_CLASS(oc);
 
diff --git a/chardev/char-parallel.c b/chardev/char-parallel.c
index 78697d7522..62a44b2f96 100644
--- a/chardev/char-parallel.c
+++ b/chardev/char-parallel.c
@@ -270,7 +270,7 @@ static void qemu_chr_parse_parallel(QemuOpts *opts, ChardevBackend *backend,
     parallel->device = g_strdup(device);
 }
 
-static void char_parallel_class_init(ObjectClass *oc, void *data)
+static void char_parallel_class_init(ObjectClass *oc, const void *data)
 {
     ChardevClass *cc = CHARDEV_CLASS(oc);
 
diff --git a/chardev/char-pipe.c b/chardev/char-pipe.c
index 5ad30bcc59..3d1b0ce2d2 100644
--- a/chardev/char-pipe.c
+++ b/chardev/char-pipe.c
@@ -171,7 +171,7 @@ static void qemu_chr_parse_pipe(QemuOpts *opts, ChardevBackend *backend,
     dev->device = g_strdup(device);
 }
 
-static void char_pipe_class_init(ObjectClass *oc, void *data)
+static void char_pipe_class_init(ObjectClass *oc, const void *data)
 {
     ChardevClass *cc = CHARDEV_CLASS(oc);
 
diff --git a/chardev/char-pty.c b/chardev/char-pty.c
index 6a2c1dc13a..c28554e6e0 100644
--- a/chardev/char-pty.c
+++ b/chardev/char-pty.c
@@ -390,7 +390,7 @@ static void char_pty_parse(QemuOpts *opts, ChardevBackend *backend,
     pty->path = g_strdup(path);
 }
 
-static void char_pty_class_init(ObjectClass *oc, void *data)
+static void char_pty_class_init(ObjectClass *oc, const void *data)
 {
     ChardevClass *cc = CHARDEV_CLASS(oc);
 
diff --git a/chardev/char-ringbuf.c b/chardev/char-ringbuf.c
index d40d21d3cf..98aadb6acf 100644
--- a/chardev/char-ringbuf.c
+++ b/chardev/char-ringbuf.c
@@ -223,7 +223,7 @@ static void qemu_chr_parse_ringbuf(QemuOpts *opts, ChardevBackend *backend,
     }
 }
 
-static void char_ringbuf_class_init(ObjectClass *oc, void *data)
+static void char_ringbuf_class_init(ObjectClass *oc, const void *data)
 {
     ChardevClass *cc = CHARDEV_CLASS(oc);
 
diff --git a/chardev/char-serial.c b/chardev/char-serial.c
index 4b0b83d5b4..0a68b4b4e0 100644
--- a/chardev/char-serial.c
+++ b/chardev/char-serial.c
@@ -298,7 +298,7 @@ static void qemu_chr_parse_serial(QemuOpts *opts, ChardevBackend *backend,
     serial->device = g_strdup(device);
 }
 
-static void char_serial_class_init(ObjectClass *oc, void *data)
+static void char_serial_class_init(ObjectClass *oc, const void *data)
 {
     ChardevClass *cc = CHARDEV_CLASS(oc);
 
diff --git a/chardev/char-socket.c b/chardev/char-socket.c
index 2f842f9f88..e8dd2931dc 100644
--- a/chardev/char-socket.c
+++ b/chardev/char-socket.c
@@ -1581,7 +1581,7 @@ char_socket_get_connected(Object *obj, Error **errp)
     return s->state == TCP_CHARDEV_STATE_CONNECTED;
 }
 
-static void char_socket_class_init(ObjectClass *oc, void *data)
+static void char_socket_class_init(ObjectClass *oc, const void *data)
 {
     ChardevClass *cc = CHARDEV_CLASS(oc);
 
diff --git a/chardev/char-stdio.c b/chardev/char-stdio.c
index b960ddd4e4..48db8d2f30 100644
--- a/chardev/char-stdio.c
+++ b/chardev/char-stdio.c
@@ -136,7 +136,7 @@ static void qemu_chr_parse_stdio(QemuOpts *opts, ChardevBackend *backend,
     stdio->signal = qemu_opt_get_bool(opts, "signal", true);
 }
 
-static void char_stdio_class_init(ObjectClass *oc, void *data)
+static void char_stdio_class_init(ObjectClass *oc, const void *data)
 {
     ChardevClass *cc = CHARDEV_CLASS(oc);
 
diff --git a/chardev/char-udp.c b/chardev/char-udp.c
index 3d9a2d5e77..572fab0ad1 100644
--- a/chardev/char-udp.c
+++ b/chardev/char-udp.c
@@ -219,7 +219,7 @@ static void qmp_chardev_open_udp(Chardev *chr,
     *be_opened = false;
 }
 
-static void char_udp_class_init(ObjectClass *oc, void *data)
+static void char_udp_class_init(ObjectClass *oc, const void *data)
 {
     ChardevClass *cc = CHARDEV_CLASS(oc);
 
diff --git a/chardev/char-win-stdio.c b/chardev/char-win-stdio.c
index 13325ca967..fb802a00b1 100644
--- a/chardev/char-win-stdio.c
+++ b/chardev/char-win-stdio.c
@@ -256,7 +256,7 @@ static int win_stdio_write(Chardev *chr, const uint8_t *buf, int len)
     return len - len1;
 }
 
-static void char_win_stdio_class_init(ObjectClass *oc, void *data)
+static void char_win_stdio_class_init(ObjectClass *oc, const void *data)
 {
     ChardevClass *cc = CHARDEV_CLASS(oc);
 
diff --git a/chardev/char-win.c b/chardev/char-win.c
index d4fb44c4dc..fef45e83aa 100644
--- a/chardev/char-win.c
+++ b/chardev/char-win.c
@@ -220,7 +220,7 @@ void win_chr_set_file(Chardev *chr, HANDLE file, bool keep_open)
     s->file = file;
 }
 
-static void char_win_class_init(ObjectClass *oc, void *data)
+static void char_win_class_init(ObjectClass *oc, const void *data)
 {
     ChardevClass *cc = CHARDEV_CLASS(oc);
 
diff --git a/chardev/char.c b/chardev/char.c
index 5a9e9762ad..bbebd246c3 100644
--- a/chardev/char.c
+++ b/chardev/char.c
@@ -295,7 +295,7 @@ static int null_chr_write(Chardev *chr, const uint8_t *buf, int len)
     return len;
 }
 
-static void char_class_init(ObjectClass *oc, void *data)
+static void char_class_init(ObjectClass *oc, const void *data)
 {
     ChardevClass *cc = CHARDEV_CLASS(oc);
 
diff --git a/chardev/msmouse.c b/chardev/msmouse.c
index 2279694cfa..1a55755d39 100644
--- a/chardev/msmouse.c
+++ b/chardev/msmouse.c
@@ -267,7 +267,7 @@ static void msmouse_chr_open(Chardev *chr,
     fifo8_create(&mouse->outbuf, MSMOUSE_BUF_SZ);
 }
 
-static void char_msmouse_class_init(ObjectClass *oc, void *data)
+static void char_msmouse_class_init(ObjectClass *oc, const void *data)
 {
     ChardevClass *cc = CHARDEV_CLASS(oc);
 
diff --git a/chardev/spice.c b/chardev/spice.c
index e843d961a7..db53b49da2 100644
--- a/chardev/spice.c
+++ b/chardev/spice.c
@@ -347,7 +347,7 @@ static void qemu_chr_parse_spice_port(QemuOpts *opts, ChardevBackend *backend,
     spiceport->fqdn = g_strdup(name);
 }
 
-static void char_spice_class_init(ObjectClass *oc, void *data)
+static void char_spice_class_init(ObjectClass *oc, const void *data)
 {
     ChardevClass *cc = CHARDEV_CLASS(oc);
 
@@ -366,7 +366,7 @@ static const TypeInfo char_spice_type_info = {
 };
 module_obj(TYPE_CHARDEV_SPICE);
 
-static void char_spicevmc_class_init(ObjectClass *oc, void *data)
+static void char_spicevmc_class_init(ObjectClass *oc, const void *data)
 {
     ChardevClass *cc = CHARDEV_CLASS(oc);
 
@@ -382,7 +382,7 @@ static const TypeInfo char_spicevmc_type_info = {
 };
 module_obj(TYPE_CHARDEV_SPICEVMC);
 
-static void char_spiceport_class_init(ObjectClass *oc, void *data)
+static void char_spiceport_class_init(ObjectClass *oc, const void *data)
 {
     ChardevClass *cc = CHARDEV_CLASS(oc);
 
diff --git a/chardev/testdev.c b/chardev/testdev.c
index a92caca3c3..e91f4e8343 100644
--- a/chardev/testdev.c
+++ b/chardev/testdev.c
@@ -110,7 +110,7 @@ static int testdev_chr_write(Chardev *chr, const uint8_t *buf, int len)
     return orig_len;
 }
 
-static void char_testdev_class_init(ObjectClass *oc, void *data)
+static void char_testdev_class_init(ObjectClass *oc, const void *data)
 {
     ChardevClass *cc = CHARDEV_CLASS(oc);
 
diff --git a/chardev/wctablet.c b/chardev/wctablet.c
index f4008bf35b..0dc6ef08f5 100644
--- a/chardev/wctablet.c
+++ b/chardev/wctablet.c
@@ -342,7 +342,7 @@ static void wctablet_chr_open(Chardev *chr,
                                              &wctablet_handler);
 }
 
-static void wctablet_chr_class_init(ObjectClass *oc, void *data)
+static void wctablet_chr_class_init(ObjectClass *oc, const void *data)
 {
     ChardevClass *cc = CHARDEV_CLASS(oc);
 
diff --git a/crypto/secret.c b/crypto/secret.c
index 44eaff16f6..61a4584286 100644
--- a/crypto/secret.c
+++ b/crypto/secret.c
@@ -117,7 +117,7 @@ qcrypto_secret_finalize(Object *obj)
 }
 
 static void
-qcrypto_secret_class_init(ObjectClass *oc, void *data)
+qcrypto_secret_class_init(ObjectClass *oc, const void *data)
 {
     QCryptoSecretCommonClass *sic = QCRYPTO_SECRET_COMMON_CLASS(oc);
     sic->load_data = qcrypto_secret_load_data;
diff --git a/crypto/secret_common.c b/crypto/secret_common.c
index dbda998940..2399ce412b 100644
--- a/crypto/secret_common.c
+++ b/crypto/secret_common.c
@@ -263,7 +263,7 @@ qcrypto_secret_finalize(Object *obj)
 }
 
 static void
-qcrypto_secret_class_init(ObjectClass *oc, void *data)
+qcrypto_secret_class_init(ObjectClass *oc, const void *data)
 {
     UserCreatableClass *ucc = USER_CREATABLE_CLASS(oc);
 
diff --git a/crypto/secret_keyring.c b/crypto/secret_keyring.c
index 1b7edec84a..78d7f09b3b 100644
--- a/crypto/secret_keyring.c
+++ b/crypto/secret_keyring.c
@@ -103,7 +103,7 @@ qcrypto_secret_prop_get_key(Object *obj, Visitor *v,
 
 
 static void
-qcrypto_secret_keyring_class_init(ObjectClass *oc, void *data)
+qcrypto_secret_keyring_class_init(ObjectClass *oc, const void *data)
 {
     QCryptoSecretCommonClass *sic = QCRYPTO_SECRET_COMMON_CLASS(oc);
     sic->load_data = qcrypto_secret_keyring_load_data;
diff --git a/crypto/tls-cipher-suites.c b/crypto/tls-cipher-suites.c
index d0df4badc0..e546cc7c0e 100644
--- a/crypto/tls-cipher-suites.c
+++ b/crypto/tls-cipher-suites.c
@@ -102,7 +102,8 @@ static GByteArray *qcrypto_tls_cipher_suites_fw_cfg_gen_data(Object *obj,
                                               errp);
 }
 
-static void qcrypto_tls_cipher_suites_class_init(ObjectClass *oc, void *data)
+static void qcrypto_tls_cipher_suites_class_init(ObjectClass *oc,
+                                                 const void *data)
 {
     UserCreatableClass *ucc = USER_CREATABLE_CLASS(oc);
     FWCfgDataGeneratorClass *fwgc = FW_CFG_DATA_GENERATOR_CLASS(oc);
diff --git a/crypto/tlscreds.c b/crypto/tlscreds.c
index 084ce0d51a..9e59594d67 100644
--- a/crypto/tlscreds.c
+++ b/crypto/tlscreds.c
@@ -223,7 +223,7 @@ qcrypto_tls_creds_prop_get_endpoint(Object *obj,
 
 
 static void
-qcrypto_tls_creds_class_init(ObjectClass *oc, void *data)
+qcrypto_tls_creds_class_init(ObjectClass *oc, const void *data)
 {
     object_class_property_add_bool(oc, "verify-peer",
                                    qcrypto_tls_creds_prop_get_verify,
diff --git a/crypto/tlscredsanon.c b/crypto/tlscredsanon.c
index 476cf89c96..0e2d133821 100644
--- a/crypto/tlscredsanon.c
+++ b/crypto/tlscredsanon.c
@@ -137,7 +137,7 @@ qcrypto_tls_creds_anon_finalize(Object *obj)
 
 
 static void
-qcrypto_tls_creds_anon_class_init(ObjectClass *oc, void *data)
+qcrypto_tls_creds_anon_class_init(ObjectClass *oc, const void *data)
 {
     UserCreatableClass *ucc = USER_CREATABLE_CLASS(oc);
 
diff --git a/crypto/tlscredspsk.c b/crypto/tlscredspsk.c
index aa270d7988..287c2a3c96 100644
--- a/crypto/tlscredspsk.c
+++ b/crypto/tlscredspsk.c
@@ -236,7 +236,7 @@ qcrypto_tls_creds_psk_prop_get_username(Object *obj,
 }
 
 static void
-qcrypto_tls_creds_psk_class_init(ObjectClass *oc, void *data)
+qcrypto_tls_creds_psk_class_init(ObjectClass *oc, const void *data)
 {
     UserCreatableClass *ucc = USER_CREATABLE_CLASS(oc);
 
diff --git a/crypto/tlscredsx509.c b/crypto/tlscredsx509.c
index 24ec584922..143993f539 100644
--- a/crypto/tlscredsx509.c
+++ b/crypto/tlscredsx509.c
@@ -802,7 +802,7 @@ qcrypto_tls_creds_x509_finalize(Object *obj)
 
 
 static void
-qcrypto_tls_creds_x509_class_init(ObjectClass *oc, void *data)
+qcrypto_tls_creds_x509_class_init(ObjectClass *oc, const void *data)
 {
     UserCreatableClass *ucc = USER_CREATABLE_CLASS(oc);
     QCryptoTLSCredsClass *ctcc = QCRYPTO_TLS_CREDS_CLASS(oc);
diff --git a/docs/devel/qom.rst b/docs/devel/qom.rst
index 0889ca949c..5870745ba2 100644
--- a/docs/devel/qom.rst
+++ b/docs/devel/qom.rst
@@ -147,7 +147,7 @@ to introduce an overridden virtual function:
 
    #include "qdev.h"
 
-   void my_device_class_init(ObjectClass *klass, void *class_data)
+   void my_device_class_init(ObjectClass *klass, const void *class_data)
    {
        DeviceClass *dc = DEVICE_CLASS(klass);
        dc->reset = my_device_reset;
@@ -249,7 +249,7 @@ class, which someone might choose to change at some point.
        // do something
    }
 
-   static void my_class_init(ObjectClass *oc, void *data)
+   static void my_class_init(ObjectClass *oc, const void *data)
    {
        MyClass *mc = MY_CLASS(oc);
 
@@ -279,7 +279,7 @@ class, which someone might choose to change at some point.
        // do something else here
    }
 
-   static void derived_class_init(ObjectClass *oc, void *data)
+   static void derived_class_init(ObjectClass *oc, const void *data)
    {
        MyClass *mc = MY_CLASS(oc);
        DerivedClass *dc = DERIVED_CLASS(oc);
@@ -363,7 +363,7 @@ This is equivalent to the following:
    :caption: Expansion from defining a simple type
 
    static void my_device_finalize(Object *obj);
-   static void my_device_class_init(ObjectClass *oc, void *data);
+   static void my_device_class_init(ObjectClass *oc, const void *data);
    static void my_device_init(Object *obj);
 
    static const TypeInfo my_device_info = {
diff --git a/docs/devel/reset.rst b/docs/devel/reset.rst
index 0b8b2fa5f4..c02fe0a405 100644
--- a/docs/devel/reset.rst
+++ b/docs/devel/reset.rst
@@ -216,7 +216,7 @@ in reset.
         ResettablePhases parent_phases;
     } MyDevClass;
 
-    static void mydev_class_init(ObjectClass *class, void *data)
+    static void mydev_class_init(ObjectClass *class, const void *data)
     {
         MyDevClass *myclass = MYDEV_CLASS(class);
         ResettableClass *rc = RESETTABLE_CLASS(class);
diff --git a/docs/devel/virtio-backends.rst b/docs/devel/virtio-backends.rst
index 679d7544b8..ebddc3b9f5 100644
--- a/docs/devel/virtio-backends.rst
+++ b/docs/devel/virtio-backends.rst
@@ -119,7 +119,7 @@ manually instantiated:
       qdev_realize(vdev, BUS(&vpci_dev->bus), errp);
   }
 
-  static void virtio_blk_pci_class_init(ObjectClass *klass, void *data)
+  static void virtio_blk_pci_class_init(ObjectClass *klass, const void *data)
   {
       DeviceClass *dc = DEVICE_CLASS(klass);
       VirtioPCIClass *k = VIRTIO_PCI_CLASS(klass);
diff --git a/event-loop-base.c b/event-loop-base.c
index ddf8400a6b..733c54486c 100644
--- a/event-loop-base.c
+++ b/event-loop-base.c
@@ -97,7 +97,8 @@ static bool event_loop_base_can_be_deleted(UserCreatable *uc)
     return true;
 }
 
-static void event_loop_base_class_init(ObjectClass *klass, void *class_data)
+static void event_loop_base_class_init(ObjectClass *klass,
+                                       const void *class_data)
 {
     UserCreatableClass *ucc = USER_CREATABLE_CLASS(klass);
     ucc->complete = event_loop_base_complete;
diff --git a/gdbstub/system.c b/gdbstub/system.c
index dd22ff0fb3..8a32d8e1a1 100644
--- a/gdbstub/system.c
+++ b/gdbstub/system.c
@@ -243,7 +243,7 @@ static void gdb_monitor_open(Chardev *chr, ChardevBackend *backend,
     *be_opened = false;
 }
 
-static void char_gdb_class_init(ObjectClass *oc, void *data)
+static void char_gdb_class_init(ObjectClass *oc, const void *data)
 {
     ChardevClass *cc = CHARDEV_CLASS(oc);
 
diff --git a/hw/9pfs/virtio-9p-device.c b/hw/9pfs/virtio-9p-device.c
index bb2843da0f..81b91e47c6 100644
--- a/hw/9pfs/virtio-9p-device.c
+++ b/hw/9pfs/virtio-9p-device.c
@@ -248,7 +248,7 @@ static const Property virtio_9p_properties[] = {
     DEFINE_PROP_STRING("fsdev", V9fsVirtioState, state.fsconf.fsdev_id),
 };
 
-static void virtio_9p_class_init(ObjectClass *klass, void *data)
+static void virtio_9p_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
diff --git a/hw/acpi/erst.c b/hw/acpi/erst.c
index 2e49b551f2..90148ec9dc 100644
--- a/hw/acpi/erst.c
+++ b/hw/acpi/erst.c
@@ -1018,7 +1018,7 @@ static const Property erst_properties[] = {
                      default_record_size, ERST_RECORD_SIZE),
 };
 
-static void erst_class_init(ObjectClass *klass, void *data)
+static void erst_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
diff --git a/hw/acpi/generic_event_device.c b/hw/acpi/generic_event_device.c
index c85d97ca37..f589e79a2b 100644
--- a/hw/acpi/generic_event_device.c
+++ b/hw/acpi/generic_event_device.c
@@ -469,7 +469,7 @@ static void acpi_ged_initfn(Object *obj)
     sysbus_init_mmio(sbd, &ged_st->regs);
 }
 
-static void acpi_ged_class_init(ObjectClass *class, void *data)
+static void acpi_ged_class_init(ObjectClass *class, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(class);
     HotplugHandlerClass *hc = HOTPLUG_HANDLER_CLASS(class);
diff --git a/hw/acpi/pci.c b/hw/acpi/pci.c
index f88f450af3..d511a85029 100644
--- a/hw/acpi/pci.c
+++ b/hw/acpi/pci.c
@@ -133,7 +133,7 @@ static void acpi_generic_initiator_set_node(Object *obj, Visitor *v,
     ms->numa_state->nodes[gi->node].has_gi = true;
 }
 
-static void acpi_generic_initiator_class_init(ObjectClass *oc, void *data)
+static void acpi_generic_initiator_class_init(ObjectClass *oc, const void *data)
 {
     object_class_property_add_str(oc, "pci-dev", NULL,
         acpi_generic_initiator_set_pci_device);
@@ -247,7 +247,7 @@ static void acpi_generic_port_set_node(Object *obj, Visitor *v,
     gp->node = value;
 }
 
-static void acpi_generic_port_class_init(ObjectClass *oc, void *data)
+static void acpi_generic_port_class_init(ObjectClass *oc, const void *data)
 {
     object_class_property_add_str(oc, "pci-bus", NULL,
         acpi_generic_port_set_pci_bus);
diff --git a/hw/acpi/piix4.c b/hw/acpi/piix4.c
index 6d023e595b..5860e8408b 100644
--- a/hw/acpi/piix4.c
+++ b/hw/acpi/piix4.c
@@ -619,7 +619,7 @@ static const Property piix4_pm_properties[] = {
                       not_migrate_acpi_index, false),
 };
 
-static void piix4_pm_class_init(ObjectClass *klass, void *data)
+static void piix4_pm_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
diff --git a/hw/acpi/vmclock.c b/hw/acpi/vmclock.c
index 7387e5c9ca..c582c0c1f8 100644
--- a/hw/acpi/vmclock.c
+++ b/hw/acpi/vmclock.c
@@ -154,7 +154,7 @@ static void vmclock_realize(DeviceState *dev, Error **errp)
     vmclock_update_guest(vms);
 }
 
-static void vmclock_device_class_init(ObjectClass *klass, void *data)
+static void vmclock_device_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/acpi/vmgenid.c b/hw/acpi/vmgenid.c
index 008768e036..fac3d6d97e 100644
--- a/hw/acpi/vmgenid.c
+++ b/hw/acpi/vmgenid.c
@@ -218,7 +218,7 @@ static const Property vmgenid_device_properties[] = {
     DEFINE_PROP_UUID(VMGENID_GUID, VmGenIdState, guid),
 };
 
-static void vmgenid_device_class_init(ObjectClass *klass, void *data)
+static void vmgenid_device_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/adc/aspeed_adc.c b/hw/adc/aspeed_adc.c
index 1cc554f179..3e820cae1e 100644
--- a/hw/adc/aspeed_adc.c
+++ b/hw/adc/aspeed_adc.c
@@ -291,7 +291,7 @@ static const Property aspeed_adc_engine_properties[] = {
     DEFINE_PROP_UINT32("nr-channels", AspeedADCEngineState, nr_channels, 0),
 };
 
-static void aspeed_adc_engine_class_init(ObjectClass *klass, void *data)
+static void aspeed_adc_engine_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -369,7 +369,7 @@ static void aspeed_adc_realize(DeviceState *dev, Error **errp)
     }
 }
 
-static void aspeed_adc_class_init(ObjectClass *klass, void *data)
+static void aspeed_adc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     AspeedADCClass *aac = ASPEED_ADC_CLASS(klass);
@@ -379,7 +379,7 @@ static void aspeed_adc_class_init(ObjectClass *klass, void *data)
     aac->nr_engines = 1;
 }
 
-static void aspeed_2600_adc_class_init(ObjectClass *klass, void *data)
+static void aspeed_2600_adc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     AspeedADCClass *aac = ASPEED_ADC_CLASS(klass);
@@ -388,7 +388,7 @@ static void aspeed_2600_adc_class_init(ObjectClass *klass, void *data)
     aac->nr_engines = 2;
 }
 
-static void aspeed_1030_adc_class_init(ObjectClass *klass, void *data)
+static void aspeed_1030_adc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     AspeedADCClass *aac = ASPEED_ADC_CLASS(klass);
@@ -397,7 +397,7 @@ static void aspeed_1030_adc_class_init(ObjectClass *klass, void *data)
     aac->nr_engines = 2;
 }
 
-static void aspeed_2700_adc_class_init(ObjectClass *klass, void *data)
+static void aspeed_2700_adc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     AspeedADCClass *aac = ASPEED_ADC_CLASS(klass);
diff --git a/hw/adc/npcm7xx_adc.c b/hw/adc/npcm7xx_adc.c
index 0a83d28605..ddb219d456 100644
--- a/hw/adc/npcm7xx_adc.c
+++ b/hw/adc/npcm7xx_adc.c
@@ -271,7 +271,7 @@ static const Property npcm7xx_timer_properties[] = {
     DEFINE_PROP_UINT32("iref", NPCM7xxADCState, iref, NPCM7XX_ADC_DEFAULT_IREF),
 };
 
-static void npcm7xx_adc_class_init(ObjectClass *klass, void *data)
+static void npcm7xx_adc_class_init(ObjectClass *klass, const void *data)
 {
     ResettableClass *rc = RESETTABLE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
diff --git a/hw/adc/stm32f2xx_adc.c b/hw/adc/stm32f2xx_adc.c
index e3b21f9077..a490ae640d 100644
--- a/hw/adc/stm32f2xx_adc.c
+++ b/hw/adc/stm32f2xx_adc.c
@@ -284,7 +284,7 @@ static void stm32f2xx_adc_init(Object *obj)
     sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
 }
 
-static void stm32f2xx_adc_class_init(ObjectClass *klass, void *data)
+static void stm32f2xx_adc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/adc/zynq-xadc.c b/hw/adc/zynq-xadc.c
index 26d9a7b9a5..748a51ba78 100644
--- a/hw/adc/zynq-xadc.c
+++ b/hw/adc/zynq-xadc.c
@@ -281,7 +281,7 @@ static const VMStateDescription vmstate_zynq_xadc = {
     }
 };
 
-static void zynq_xadc_class_init(ObjectClass *klass, void *data)
+static void zynq_xadc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/alpha/typhoon.c b/hw/alpha/typhoon.c
index 9718e1a579..4c56f981d7 100644
--- a/hw/alpha/typhoon.c
+++ b/hw/alpha/typhoon.c
@@ -935,7 +935,7 @@ static const TypeInfo typhoon_pcihost_info = {
 };
 
 static void typhoon_iommu_memory_region_class_init(ObjectClass *klass,
-                                                   void *data)
+                                                   const void *data)
 {
     IOMMUMemoryRegionClass *imrc = IOMMU_MEMORY_REGION_CLASS(klass);
 
diff --git a/hw/arm/allwinner-a10.c b/hw/arm/allwinner-a10.c
index f1b399759a..dc910d4177 100644
--- a/hw/arm/allwinner-a10.c
+++ b/hw/arm/allwinner-a10.c
@@ -208,7 +208,7 @@ static void aw_a10_realize(DeviceState *dev, Error **errp)
     sysbus_mmio_map_overlap(SYS_BUS_DEVICE(&s->wdt), 0, AW_A10_WDT_BASE, 1);
 }
 
-static void aw_a10_class_init(ObjectClass *oc, void *data)
+static void aw_a10_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
diff --git a/hw/arm/allwinner-h3.c b/hw/arm/allwinner-h3.c
index 1b1afa4fb6..edffc21dd8 100644
--- a/hw/arm/allwinner-h3.c
+++ b/hw/arm/allwinner-h3.c
@@ -466,7 +466,7 @@ static void allwinner_h3_realize(DeviceState *dev, Error **errp)
     }
 }
 
-static void allwinner_h3_class_init(ObjectClass *oc, void *data)
+static void allwinner_h3_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
diff --git a/hw/arm/allwinner-r40.c b/hw/arm/allwinner-r40.c
index cef6e4d18c..0bf700865c 100644
--- a/hw/arm/allwinner-r40.c
+++ b/hw/arm/allwinner-r40.c
@@ -539,7 +539,7 @@ static void allwinner_r40_realize(DeviceState *dev, Error **errp)
     }
 }
 
-static void allwinner_r40_class_init(ObjectClass *oc, void *data)
+static void allwinner_r40_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
index ffd732f806..d65a46b8d8 100644
--- a/hw/arm/armsse.c
+++ b/hw/arm/armsse.c
@@ -1691,7 +1691,7 @@ static void armsse_reset(DeviceState *dev)
     s->nsccfg = 0;
 }
 
-static void armsse_class_init(ObjectClass *klass, void *data)
+static void armsse_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     IDAUInterfaceClass *iic = IDAU_INTERFACE_CLASS(klass);
diff --git a/hw/arm/armv7m.c b/hw/arm/armv7m.c
index 64009174b9..cea3eb49ee 100644
--- a/hw/arm/armv7m.c
+++ b/hw/arm/armv7m.c
@@ -565,7 +565,7 @@ static const VMStateDescription vmstate_armv7m = {
     }
 };
 
-static void armv7m_class_init(ObjectClass *klass, void *data)
+static void armv7m_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -636,7 +636,7 @@ static const Property bitband_properties[] = {
                      TYPE_MEMORY_REGION, MemoryRegion *),
 };
 
-static void bitband_class_init(ObjectClass *klass, void *data)
+static void bitband_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index 82f42582fa..20f418fb63 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -1227,7 +1227,7 @@ static void aspeed_machine_ast2600_class_emmc_init(ObjectClass *oc)
                                           "Set or unset boot from EMMC");
 }
 
-static void aspeed_machine_class_init(ObjectClass *oc, void *data)
+static void aspeed_machine_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
@@ -1243,7 +1243,8 @@ static void aspeed_machine_class_init(ObjectClass *oc, void *data)
     aspeed_machine_class_props_init(oc);
 }
 
-static void aspeed_machine_palmetto_class_init(ObjectClass *oc, void *data)
+static void aspeed_machine_palmetto_class_init(ObjectClass *oc,
+                                               const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
@@ -1260,7 +1261,8 @@ static void aspeed_machine_palmetto_class_init(ObjectClass *oc, void *data)
     aspeed_machine_class_init_cpus_defaults(mc);
 };
 
-static void aspeed_machine_quanta_q71l_class_init(ObjectClass *oc, void *data)
+static void aspeed_machine_quanta_q71l_class_init(ObjectClass *oc,
+                                                  const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
@@ -1278,7 +1280,7 @@ static void aspeed_machine_quanta_q71l_class_init(ObjectClass *oc, void *data)
 }
 
 static void aspeed_machine_supermicrox11_bmc_class_init(ObjectClass *oc,
-                                                        void *data)
+                                                        const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
@@ -1297,7 +1299,7 @@ static void aspeed_machine_supermicrox11_bmc_class_init(ObjectClass *oc,
 }
 
 static void aspeed_machine_supermicro_x11spi_bmc_class_init(ObjectClass *oc,
-                                                            void *data)
+                                                            const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
@@ -1315,7 +1317,8 @@ static void aspeed_machine_supermicro_x11spi_bmc_class_init(ObjectClass *oc,
     aspeed_machine_class_init_cpus_defaults(mc);
 }
 
-static void aspeed_machine_ast2500_evb_class_init(ObjectClass *oc, void *data)
+static void aspeed_machine_ast2500_evb_class_init(ObjectClass *oc,
+                                                  const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
@@ -1332,7 +1335,8 @@ static void aspeed_machine_ast2500_evb_class_init(ObjectClass *oc, void *data)
     aspeed_machine_class_init_cpus_defaults(mc);
 };
 
-static void aspeed_machine_yosemitev2_class_init(ObjectClass *oc, void *data)
+static void aspeed_machine_yosemitev2_class_init(ObjectClass *oc,
+                                                 const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
@@ -1350,7 +1354,8 @@ static void aspeed_machine_yosemitev2_class_init(ObjectClass *oc, void *data)
     aspeed_machine_class_init_cpus_defaults(mc);
 };
 
-static void aspeed_machine_romulus_class_init(ObjectClass *oc, void *data)
+static void aspeed_machine_romulus_class_init(ObjectClass *oc,
+                                              const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
@@ -1367,7 +1372,8 @@ static void aspeed_machine_romulus_class_init(ObjectClass *oc, void *data)
     aspeed_machine_class_init_cpus_defaults(mc);
 };
 
-static void aspeed_machine_tiogapass_class_init(ObjectClass *oc, void *data)
+static void aspeed_machine_tiogapass_class_init(ObjectClass *oc,
+                                                const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
@@ -1385,7 +1391,8 @@ static void aspeed_machine_tiogapass_class_init(ObjectClass *oc, void *data)
     aspeed_machine_class_init_cpus_defaults(mc);
 };
 
-static void aspeed_machine_sonorapass_class_init(ObjectClass *oc, void *data)
+static void aspeed_machine_sonorapass_class_init(ObjectClass *oc,
+                                                 const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
@@ -1402,7 +1409,8 @@ static void aspeed_machine_sonorapass_class_init(ObjectClass *oc, void *data)
     aspeed_machine_class_init_cpus_defaults(mc);
 };
 
-static void aspeed_machine_witherspoon_class_init(ObjectClass *oc, void *data)
+static void aspeed_machine_witherspoon_class_init(ObjectClass *oc,
+                                                  const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
@@ -1419,7 +1427,8 @@ static void aspeed_machine_witherspoon_class_init(ObjectClass *oc, void *data)
     aspeed_machine_class_init_cpus_defaults(mc);
 };
 
-static void aspeed_machine_ast2600_evb_class_init(ObjectClass *oc, void *data)
+static void aspeed_machine_ast2600_evb_class_init(ObjectClass *oc,
+                                                  const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
@@ -1441,7 +1450,7 @@ static void aspeed_machine_ast2600_evb_class_init(ObjectClass *oc, void *data)
     aspeed_machine_ast2600_class_emmc_init(oc);
 };
 
-static void aspeed_machine_g220a_class_init(ObjectClass *oc, void *data)
+static void aspeed_machine_g220a_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
@@ -1459,7 +1468,8 @@ static void aspeed_machine_g220a_class_init(ObjectClass *oc, void *data)
     aspeed_machine_class_init_cpus_defaults(mc);
 };
 
-static void aspeed_machine_fp5280g2_class_init(ObjectClass *oc, void *data)
+static void aspeed_machine_fp5280g2_class_init(ObjectClass *oc,
+                                               const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
@@ -1477,7 +1487,7 @@ static void aspeed_machine_fp5280g2_class_init(ObjectClass *oc, void *data)
     aspeed_machine_class_init_cpus_defaults(mc);
 };
 
-static void aspeed_machine_rainier_class_init(ObjectClass *oc, void *data)
+static void aspeed_machine_rainier_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
@@ -1499,7 +1509,7 @@ static void aspeed_machine_rainier_class_init(ObjectClass *oc, void *data)
 
 #define FUJI_BMC_RAM_SIZE ASPEED_RAM_SIZE(2 * GiB)
 
-static void aspeed_machine_fuji_class_init(ObjectClass *oc, void *data)
+static void aspeed_machine_fuji_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
@@ -1521,7 +1531,8 @@ static void aspeed_machine_fuji_class_init(ObjectClass *oc, void *data)
 
 #define BLETCHLEY_BMC_RAM_SIZE ASPEED_RAM_SIZE(2 * GiB)
 
-static void aspeed_machine_bletchley_class_init(ObjectClass *oc, void *data)
+static void aspeed_machine_bletchley_class_init(ObjectClass *oc,
+                                                const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
@@ -1566,7 +1577,7 @@ static void fby35_reset(MachineState *state, ResetType type)
     object_property_set_bool(OBJECT(gpio), "gpioB5", false, &error_fatal);
 }
 
-static void aspeed_machine_fby35_class_init(ObjectClass *oc, void *data)
+static void aspeed_machine_fby35_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
@@ -1644,7 +1655,7 @@ static void ast1030_evb_i2c_init(AspeedMachineState *bmc)
 }
 
 static void aspeed_minibmc_machine_ast1030_evb_class_init(ObjectClass *oc,
-                                                          void *data)
+                                                          const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
@@ -1673,7 +1684,8 @@ static void ast2700_evb_i2c_init(AspeedMachineState *bmc)
                             TYPE_TMP105, 0x4d);
 }
 
-static void aspeed_machine_ast2700a0_evb_class_init(ObjectClass *oc, void *data)
+static void aspeed_machine_ast2700a0_evb_class_init(ObjectClass *oc,
+                                                    const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
@@ -1694,7 +1706,8 @@ static void aspeed_machine_ast2700a0_evb_class_init(ObjectClass *oc, void *data)
     aspeed_machine_class_init_cpus_defaults(mc);
 }
 
-static void aspeed_machine_ast2700a1_evb_class_init(ObjectClass *oc, void *data)
+static void aspeed_machine_ast2700a1_evb_class_init(ObjectClass *oc,
+                                                    const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
@@ -1716,7 +1729,7 @@ static void aspeed_machine_ast2700a1_evb_class_init(ObjectClass *oc, void *data)
 #endif
 
 static void aspeed_machine_qcom_dc_scm_v1_class_init(ObjectClass *oc,
-                                                     void *data)
+                                                     const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
@@ -1736,7 +1749,7 @@ static void aspeed_machine_qcom_dc_scm_v1_class_init(ObjectClass *oc,
 };
 
 static void aspeed_machine_qcom_firework_class_init(ObjectClass *oc,
-                                                    void *data)
+                                                    const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
diff --git a/hw/arm/aspeed_ast10x0.c b/hw/arm/aspeed_ast10x0.c
index 21ffab10f3..e6e1ee63c1 100644
--- a/hw/arm/aspeed_ast10x0.c
+++ b/hw/arm/aspeed_ast10x0.c
@@ -415,7 +415,7 @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
                                   sc->memmap[ASPEED_DEV_JTAG1], 0x20);
 }
 
-static void aspeed_soc_ast1030_class_init(ObjectClass *klass, void *data)
+static void aspeed_soc_ast1030_class_init(ObjectClass *klass, const void *data)
 {
     static const char * const valid_cpu_types[] = {
         ARM_CPU_TYPE_NAME("cortex-m4"), /* TODO cortex-m4f */
diff --git a/hw/arm/aspeed_ast2400.c b/hw/arm/aspeed_ast2400.c
index 0158f6e9c2..c7b0f21887 100644
--- a/hw/arm/aspeed_ast2400.c
+++ b/hw/arm/aspeed_ast2400.c
@@ -502,7 +502,7 @@ static void aspeed_ast2400_soc_realize(DeviceState *dev, Error **errp)
                        aspeed_soc_get_irq(s, ASPEED_DEV_HACE));
 }
 
-static void aspeed_soc_ast2400_class_init(ObjectClass *oc, void *data)
+static void aspeed_soc_ast2400_class_init(ObjectClass *oc, const void *data)
 {
     static const char * const valid_cpu_types[] = {
         ARM_CPU_TYPE_NAME("arm926"),
@@ -530,7 +530,7 @@ static void aspeed_soc_ast2400_class_init(ObjectClass *oc, void *data)
     sc->get_irq      = aspeed_soc_ast2400_get_irq;
 }
 
-static void aspeed_soc_ast2500_class_init(ObjectClass *oc, void *data)
+static void aspeed_soc_ast2500_class_init(ObjectClass *oc, const void *data)
 {
     static const char * const valid_cpu_types[] = {
         ARM_CPU_TYPE_NAME("arm1176"),
diff --git a/hw/arm/aspeed_ast2600.c b/hw/arm/aspeed_ast2600.c
index 1f994ba26c..d12707f0ab 100644
--- a/hw/arm/aspeed_ast2600.c
+++ b/hw/arm/aspeed_ast2600.c
@@ -653,7 +653,7 @@ static bool aspeed_soc_ast2600_boot_from_emmc(AspeedSoCState *s)
     return !!(hw_strap1 & SCU_AST2600_HW_STRAP_BOOT_SRC_EMMC);
 }
 
-static void aspeed_soc_ast2600_class_init(ObjectClass *oc, void *data)
+static void aspeed_soc_ast2600_class_init(ObjectClass *oc, const void *data)
 {
     static const char * const valid_cpu_types[] = {
         ARM_CPU_TYPE_NAME("cortex-a7"),
diff --git a/hw/arm/aspeed_ast27x0.c b/hw/arm/aspeed_ast27x0.c
index dce7255a2c..63a366f7e8 100644
--- a/hw/arm/aspeed_ast27x0.c
+++ b/hw/arm/aspeed_ast27x0.c
@@ -883,7 +883,7 @@ static void aspeed_soc_ast2700_realize(DeviceState *dev, Error **errp)
     create_unimplemented_device("ast2700.io", 0x0, 0x4000000);
 }
 
-static void aspeed_soc_ast2700a0_class_init(ObjectClass *oc, void *data)
+static void aspeed_soc_ast2700a0_class_init(ObjectClass *oc, const void *data)
 {
     static const char * const valid_cpu_types[] = {
         ARM_CPU_TYPE_NAME("cortex-a35"),
@@ -910,7 +910,7 @@ static void aspeed_soc_ast2700a0_class_init(ObjectClass *oc, void *data)
     sc->get_irq      = aspeed_soc_ast2700_get_irq;
 }
 
-static void aspeed_soc_ast2700a1_class_init(ObjectClass *oc, void *data)
+static void aspeed_soc_ast2700a1_class_init(ObjectClass *oc, const void *data)
 {
     static const char * const valid_cpu_types[] = {
         ARM_CPU_TYPE_NAME("cortex-a35"),
diff --git a/hw/arm/aspeed_soc_common.c b/hw/arm/aspeed_soc_common.c
index 1ddcb26c1e..1c4ac93a0f 100644
--- a/hw/arm/aspeed_soc_common.c
+++ b/hw/arm/aspeed_soc_common.c
@@ -146,7 +146,7 @@ static const Property aspeed_soc_properties[] = {
                      MemoryRegion *),
 };
 
-static void aspeed_soc_class_init(ObjectClass *oc, void *data)
+static void aspeed_soc_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     AspeedSoCClass *sc = ASPEED_SOC_CLASS(oc);
diff --git a/hw/arm/b-l475e-iot01a.c b/hw/arm/b-l475e-iot01a.c
index c9a5209216..34ed2e0851 100644
--- a/hw/arm/b-l475e-iot01a.c
+++ b/hw/arm/b-l475e-iot01a.c
@@ -110,7 +110,7 @@ static void bl475e_init(MachineState *machine)
     }
 }
 
-static void bl475e_machine_init(ObjectClass *oc, void *data)
+static void bl475e_machine_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     static const char *machine_valid_cpu_types[] = {
diff --git a/hw/arm/bcm2835_peripherals.c b/hw/arm/bcm2835_peripherals.c
index adc9730c2e..8a1e72dfab 100644
--- a/hw/arm/bcm2835_peripherals.c
+++ b/hw/arm/bcm2835_peripherals.c
@@ -520,7 +520,7 @@ void bcm_soc_peripherals_common_realize(DeviceState *dev, Error **errp)
     create_unimp(s, &s->sdramc, "bcm2835-sdramc", SDRAMC_OFFSET, 0x100);
 }
 
-static void bcm2835_peripherals_class_init(ObjectClass *oc, void *data)
+static void bcm2835_peripherals_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     BCMSocPeripheralBaseClass *bc = BCM_SOC_PERIPHERALS_BASE_CLASS(oc);
diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
index 95e16806fa..cd61ba1505 100644
--- a/hw/arm/bcm2836.c
+++ b/hw/arm/bcm2836.c
@@ -163,7 +163,7 @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
     }
 }
 
-static void bcm283x_base_class_init(ObjectClass *oc, void *data)
+static void bcm283x_base_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
@@ -171,7 +171,7 @@ static void bcm283x_base_class_init(ObjectClass *oc, void *data)
     dc->user_creatable = false;
 }
 
-static void bcm2835_class_init(ObjectClass *oc, void *data)
+static void bcm2835_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     BCM283XBaseClass *bc = BCM283X_BASE_CLASS(oc);
@@ -182,7 +182,7 @@ static void bcm2835_class_init(ObjectClass *oc, void *data)
     dc->realize = bcm2835_realize;
 };
 
-static void bcm2836_class_init(ObjectClass *oc, void *data)
+static void bcm2836_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     BCM283XBaseClass *bc = BCM283X_BASE_CLASS(oc);
@@ -196,7 +196,7 @@ static void bcm2836_class_init(ObjectClass *oc, void *data)
 };
 
 #ifdef TARGET_AARCH64
-static void bcm2837_class_init(ObjectClass *oc, void *data)
+static void bcm2837_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     BCM283XBaseClass *bc = BCM283X_BASE_CLASS(oc);
diff --git a/hw/arm/bcm2838.c b/hw/arm/bcm2838.c
index ddb7c5f757..22aa754613 100644
--- a/hw/arm/bcm2838.c
+++ b/hw/arm/bcm2838.c
@@ -233,7 +233,7 @@ static void bcm2838_realize(DeviceState *dev, Error **errp)
     qdev_pass_gpios(DEVICE(&s->gic), DEVICE(&s->peripherals), NULL);
 }
 
-static void bcm2838_class_init(ObjectClass *oc, void *data)
+static void bcm2838_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     BCM283XBaseClass *bc_base = BCM283X_BASE_CLASS(oc);
diff --git a/hw/arm/bcm2838_peripherals.c b/hw/arm/bcm2838_peripherals.c
index e28bef4a37..812b5b8480 100644
--- a/hw/arm/bcm2838_peripherals.c
+++ b/hw/arm/bcm2838_peripherals.c
@@ -196,7 +196,7 @@ static void bcm2838_peripherals_realize(DeviceState *dev, Error **errp)
     create_unimp(s_base, &s->asb, "bcm2838-asb", BRDG_OFFSET, 0x24);
 }
 
-static void bcm2838_peripherals_class_init(ObjectClass *oc, void *data)
+static void bcm2838_peripherals_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     BCM2838PeripheralClass *bc = BCM2838_PERIPHERALS_CLASS(oc);
diff --git a/hw/arm/collie.c b/hw/arm/collie.c
index e83aee58c6..93bb190f1f 100644
--- a/hw/arm/collie.c
+++ b/hw/arm/collie.c
@@ -69,7 +69,7 @@ static void collie_init(MachineState *machine)
     arm_load_kernel(cms->sa1110->cpu, machine, &collie_binfo);
 }
 
-static void collie_machine_class_init(ObjectClass *oc, void *data)
+static void collie_machine_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
 
diff --git a/hw/arm/digic.c b/hw/arm/digic.c
index 5836619d9f..d831bc974d 100644
--- a/hw/arm/digic.c
+++ b/hw/arm/digic.c
@@ -79,7 +79,7 @@ static void digic_realize(DeviceState *dev, Error **errp)
     sysbus_mmio_map(sbd, 0, DIGIC_UART_BASE);
 }
 
-static void digic_class_init(ObjectClass *oc, void *data)
+static void digic_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index 0c27588116..76001ff0df 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -842,7 +842,7 @@ static void exynos4210_init(Object *obj)
                             TYPE_EXYNOS4210_COMBINER);
 }
 
-static void exynos4210_class_init(ObjectClass *klass, void *data)
+static void exynos4210_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
index 2d8f2d7326..7304974131 100644
--- a/hw/arm/exynos4_boards.c
+++ b/hw/arm/exynos4_boards.c
@@ -154,7 +154,7 @@ static const char * const valid_cpu_types[] = {
     NULL
 };
 
-static void nuri_class_init(ObjectClass *oc, void *data)
+static void nuri_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
 
@@ -174,7 +174,7 @@ static const TypeInfo nuri_type = {
     .class_init = nuri_class_init,
 };
 
-static void smdkc210_class_init(ObjectClass *oc, void *data)
+static void smdkc210_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
 
diff --git a/hw/arm/fby35.c b/hw/arm/fby35.c
index 6d3663f14a..e123fa69e1 100644
--- a/hw/arm/fby35.c
+++ b/hw/arm/fby35.c
@@ -162,7 +162,7 @@ static void fby35_instance_init(Object *obj)
     FBY35(obj)->mmio_exec = false;
 }
 
-static void fby35_class_init(ObjectClass *oc, void *data)
+static void fby35_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
 
diff --git a/hw/arm/fsl-imx25.c b/hw/arm/fsl-imx25.c
index 02214ca1a1..7aad6359ea 100644
--- a/hw/arm/fsl-imx25.c
+++ b/hw/arm/fsl-imx25.c
@@ -311,7 +311,7 @@ static const Property fsl_imx25_properties[] = {
     DEFINE_PROP_UINT32("fec-phy-num", FslIMX25State, phy_num, 0),
 };
 
-static void fsl_imx25_class_init(ObjectClass *oc, void *data)
+static void fsl_imx25_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
diff --git a/hw/arm/fsl-imx31.c b/hw/arm/fsl-imx31.c
index 2a8ffb15f7..e9f70ad94b 100644
--- a/hw/arm/fsl-imx31.c
+++ b/hw/arm/fsl-imx31.c
@@ -218,7 +218,7 @@ static void fsl_imx31_realize(DeviceState *dev, Error **errp)
                                 &s->iram_alias);
 }
 
-static void fsl_imx31_class_init(ObjectClass *oc, void *data)
+static void fsl_imx31_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
diff --git a/hw/arm/fsl-imx6.c b/hw/arm/fsl-imx6.c
index a114dc0d63..f3a60022d8 100644
--- a/hw/arm/fsl-imx6.c
+++ b/hw/arm/fsl-imx6.c
@@ -484,7 +484,7 @@ static const Property fsl_imx6_properties[] = {
     DEFINE_PROP_UINT32("fec-phy-num", FslIMX6State, phy_num, 0),
 };
 
-static void fsl_imx6_class_init(ObjectClass *oc, void *data)
+static void fsl_imx6_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
diff --git a/hw/arm/fsl-imx6ul.c b/hw/arm/fsl-imx6ul.c
index ce8d3ef535..883c7fc534 100644
--- a/hw/arm/fsl-imx6ul.c
+++ b/hw/arm/fsl-imx6ul.c
@@ -715,7 +715,7 @@ static const Property fsl_imx6ul_properties[] = {
                      true),
 };
 
-static void fsl_imx6ul_class_init(ObjectClass *oc, void *data)
+static void fsl_imx6ul_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
diff --git a/hw/arm/fsl-imx7.c b/hw/arm/fsl-imx7.c
index ed1f10bca2..02f7602077 100644
--- a/hw/arm/fsl-imx7.c
+++ b/hw/arm/fsl-imx7.c
@@ -748,7 +748,7 @@ static const Property fsl_imx7_properties[] = {
                      true),
 };
 
-static void fsl_imx7_class_init(ObjectClass *oc, void *data)
+static void fsl_imx7_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
diff --git a/hw/arm/fsl-imx8mp.c b/hw/arm/fsl-imx8mp.c
index af7a7e6745..23e662c16c 100644
--- a/hw/arm/fsl-imx8mp.c
+++ b/hw/arm/fsl-imx8mp.c
@@ -689,7 +689,7 @@ static const Property fsl_imx8mp_properties[] = {
     DEFINE_PROP_BOOL("fec1-phy-connected", FslImx8mpState, phy_connected, true),
 };
 
-static void fsl_imx8mp_class_init(ObjectClass *oc, void *data)
+static void fsl_imx8mp_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
diff --git a/hw/arm/highbank.c b/hw/arm/highbank.c
index 0f3c207d54..3ae26ebebd 100644
--- a/hw/arm/highbank.c
+++ b/hw/arm/highbank.c
@@ -139,7 +139,7 @@ static void highbank_regs_init(Object *obj)
     sysbus_init_mmio(dev, &s->iomem);
 }
 
-static void highbank_regs_class_init(ObjectClass *klass, void *data)
+static void highbank_regs_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -341,7 +341,7 @@ static void midway_init(MachineState *machine)
     calxeda_init(machine, CALXEDA_MIDWAY);
 }
 
-static void highbank_class_init(ObjectClass *oc, void *data)
+static void highbank_class_init(ObjectClass *oc, const void *data)
 {
     static const char * const valid_cpu_types[] = {
         ARM_CPU_TYPE_NAME("cortex-a9"),
@@ -365,7 +365,7 @@ static const TypeInfo highbank_type = {
     .class_init = highbank_class_init,
 };
 
-static void midway_class_init(ObjectClass *oc, void *data)
+static void midway_class_init(ObjectClass *oc, const void *data)
 {
     static const char * const valid_cpu_types[] = {
         ARM_CPU_TYPE_NAME("cortex-a15"),
diff --git a/hw/arm/integratorcp.c b/hw/arm/integratorcp.c
index ac0c6c6096..b1d8fbd470 100644
--- a/hw/arm/integratorcp.c
+++ b/hw/arm/integratorcp.c
@@ -699,7 +699,7 @@ static const Property core_properties[] = {
     DEFINE_PROP_UINT32("memsz", IntegratorCMState, memsz, 0),
 };
 
-static void core_class_init(ObjectClass *klass, void *data)
+static void core_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -708,14 +708,14 @@ static void core_class_init(ObjectClass *klass, void *data)
     dc->vmsd = &vmstate_integratorcm;
 }
 
-static void icp_pic_class_init(ObjectClass *klass, void *data)
+static void icp_pic_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
     dc->vmsd = &vmstate_icp_pic;
 }
 
-static void icp_control_class_init(ObjectClass *klass, void *data)
+static void icp_control_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/arm/microbit.c b/hw/arm/microbit.c
index ade363daaa..525443fdb9 100644
--- a/hw/arm/microbit.c
+++ b/hw/arm/microbit.c
@@ -60,7 +60,7 @@ static void microbit_init(MachineState *machine)
                        0, s->nrf51.flash_size);
 }
 
-static void microbit_machine_class_init(ObjectClass *oc, void *data)
+static void microbit_machine_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
 
diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
index b0633a5a69..8474549f5f 100644
--- a/hw/arm/mps2-tz.c
+++ b/hw/arm/mps2-tz.c
@@ -1267,7 +1267,7 @@ static void mps2_machine_reset(MachineState *machine, ResetType type)
     qemu_devices_reset(type);
 }
 
-static void mps2tz_class_init(ObjectClass *oc, void *data)
+static void mps2tz_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     IDAUInterfaceClass *iic = IDAU_INTERFACE_CLASS(oc);
@@ -1304,7 +1304,7 @@ static void mps2tz_set_default_ram_info(MPS2TZMachineClass *mmc)
     g_assert_not_reached();
 }
 
-static void mps2tz_an505_class_init(ObjectClass *oc, void *data)
+static void mps2tz_an505_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_CLASS(oc);
@@ -1338,7 +1338,7 @@ static void mps2tz_an505_class_init(ObjectClass *oc, void *data)
     mps2tz_set_default_ram_info(mmc);
 }
 
-static void mps2tz_an521_class_init(ObjectClass *oc, void *data)
+static void mps2tz_an521_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_CLASS(oc);
@@ -1372,7 +1372,7 @@ static void mps2tz_an521_class_init(ObjectClass *oc, void *data)
     mps2tz_set_default_ram_info(mmc);
 }
 
-static void mps3tz_an524_class_init(ObjectClass *oc, void *data)
+static void mps3tz_an524_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_CLASS(oc);
@@ -1411,7 +1411,7 @@ static void mps3tz_an524_class_init(ObjectClass *oc, void *data)
                                           "are BRAM (default) and QSPI.");
 }
 
-static void mps3tz_an547_class_init(ObjectClass *oc, void *data)
+static void mps3tz_an547_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_CLASS(oc);
diff --git a/hw/arm/mps2.c b/hw/arm/mps2.c
index 6958485a66..58efb41e6d 100644
--- a/hw/arm/mps2.c
+++ b/hw/arm/mps2.c
@@ -464,7 +464,7 @@ static void mps2_common_init(MachineState *machine)
                        0, 0x400000);
 }
 
-static void mps2_class_init(ObjectClass *oc, void *data)
+static void mps2_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
 
@@ -474,7 +474,7 @@ static void mps2_class_init(ObjectClass *oc, void *data)
     mc->default_ram_id = "mps.ram";
 }
 
-static void mps2_an385_class_init(ObjectClass *oc, void *data)
+static void mps2_an385_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     MPS2MachineClass *mmc = MPS2_MACHINE_CLASS(oc);
@@ -493,7 +493,7 @@ static void mps2_an385_class_init(ObjectClass *oc, void *data)
     mmc->has_block_ram = true;
 }
 
-static void mps2_an386_class_init(ObjectClass *oc, void *data)
+static void mps2_an386_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     MPS2MachineClass *mmc = MPS2_MACHINE_CLASS(oc);
@@ -512,7 +512,7 @@ static void mps2_an386_class_init(ObjectClass *oc, void *data)
     mmc->has_block_ram = true;
 }
 
-static void mps2_an500_class_init(ObjectClass *oc, void *data)
+static void mps2_an500_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     MPS2MachineClass *mmc = MPS2_MACHINE_CLASS(oc);
@@ -531,7 +531,7 @@ static void mps2_an500_class_init(ObjectClass *oc, void *data)
     mmc->has_block_ram = false;
 }
 
-static void mps2_an511_class_init(ObjectClass *oc, void *data)
+static void mps2_an511_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     MPS2MachineClass *mmc = MPS2_MACHINE_CLASS(oc);
diff --git a/hw/arm/mps3r.c b/hw/arm/mps3r.c
index 4dd1e8a718..48c73acc62 100644
--- a/hw/arm/mps3r.c
+++ b/hw/arm/mps3r.c
@@ -583,14 +583,14 @@ static void mps3r_set_default_ram_info(MPS3RMachineClass *mmc)
     g_assert_not_reached();
 }
 
-static void mps3r_class_init(ObjectClass *oc, void *data)
+static void mps3r_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
 
     mc->init = mps3r_common_init;
 }
 
-static void mps3r_an536_class_init(ObjectClass *oc, void *data)
+static void mps3r_an536_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     MPS3RMachineClass *mmc = MPS3R_MACHINE_CLASS(oc);
diff --git a/hw/arm/msf2-soc.c b/hw/arm/msf2-soc.c
index bc9b419e37..c5e9c7175a 100644
--- a/hw/arm/msf2-soc.c
+++ b/hw/arm/msf2-soc.c
@@ -236,7 +236,7 @@ static const Property m2sxxx_soc_properties[] = {
     DEFINE_PROP_UINT8("apb1div", MSF2State, apb1div, 2),
 };
 
-static void m2sxxx_soc_class_init(ObjectClass *klass, void *data)
+static void m2sxxx_soc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/arm/musca.c b/hw/arm/musca.c
index a4f43f1992..250b3b5bf8 100644
--- a/hw/arm/musca.c
+++ b/hw/arm/musca.c
@@ -594,7 +594,7 @@ static void musca_init(MachineState *machine)
                        0, 0x2000000);
 }
 
-static void musca_class_init(ObjectClass *oc, void *data)
+static void musca_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     static const char * const valid_cpu_types[] = {
@@ -609,7 +609,7 @@ static void musca_class_init(ObjectClass *oc, void *data)
     mc->init = musca_init;
 }
 
-static void musca_a_class_init(ObjectClass *oc, void *data)
+static void musca_a_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     MuscaMachineClass *mmc = MUSCA_MACHINE_CLASS(oc);
@@ -623,7 +623,7 @@ static void musca_a_class_init(ObjectClass *oc, void *data)
     mmc->num_mpcs = ARRAY_SIZE(a_mpc_info);
 }
 
-static void musca_b1_class_init(ObjectClass *oc, void *data)
+static void musca_b1_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     MuscaMachineClass *mmc = MUSCA_MACHINE_CLASS(oc);
diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
index 48a32c2407..329b162eb2 100644
--- a/hw/arm/musicpal.c
+++ b/hw/arm/musicpal.c
@@ -286,7 +286,7 @@ static const VMStateDescription musicpal_lcd_vmsd = {
     }
 };
 
-static void musicpal_lcd_class_init(ObjectClass *klass, void *data)
+static void musicpal_lcd_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -407,7 +407,7 @@ static const VMStateDescription mv88w8618_pic_vmsd = {
     }
 };
 
-static void mv88w8618_pic_class_init(ObjectClass *klass, void *data)
+static void mv88w8618_pic_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -601,7 +601,7 @@ static const VMStateDescription mv88w8618_pit_vmsd = {
     }
 };
 
-static void mv88w8618_pit_class_init(ObjectClass *klass, void *data)
+static void mv88w8618_pit_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -687,7 +687,7 @@ static const VMStateDescription mv88w8618_flashcfg_vmsd = {
     }
 };
 
-static void mv88w8618_flashcfg_class_init(ObjectClass *klass, void *data)
+static void mv88w8618_flashcfg_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -1026,7 +1026,7 @@ static const VMStateDescription musicpal_gpio_vmsd = {
     }
 };
 
-static void musicpal_gpio_class_init(ObjectClass *klass, void *data)
+static void musicpal_gpio_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -1171,7 +1171,7 @@ static const VMStateDescription musicpal_key_vmsd = {
     }
 };
 
-static void musicpal_key_class_init(ObjectClass *klass, void *data)
+static void musicpal_key_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -1348,7 +1348,7 @@ static void musicpal_machine_init(MachineClass *mc)
 
 DEFINE_MACHINE("musicpal", musicpal_machine_init)
 
-static void mv88w8618_wlan_class_init(ObjectClass *klass, void *data)
+static void mv88w8618_wlan_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/arm/npcm7xx.c b/hw/arm/npcm7xx.c
index 2d6e08b72b..2f30c49df5 100644
--- a/hw/arm/npcm7xx.c
+++ b/hw/arm/npcm7xx.c
@@ -821,7 +821,7 @@ static const Property npcm7xx_properties[] = {
                      MemoryRegion *),
 };
 
-static void npcm7xx_class_init(ObjectClass *oc, void *data)
+static void npcm7xx_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
@@ -830,7 +830,7 @@ static void npcm7xx_class_init(ObjectClass *oc, void *data)
     device_class_set_props(dc, npcm7xx_properties);
 }
 
-static void npcm730_class_init(ObjectClass *oc, void *data)
+static void npcm730_class_init(ObjectClass *oc, const void *data)
 {
     NPCM7xxClass *nc = NPCM7XX_CLASS(oc);
 
@@ -839,7 +839,7 @@ static void npcm730_class_init(ObjectClass *oc, void *data)
     nc->num_cpus = 2;
 }
 
-static void npcm750_class_init(ObjectClass *oc, void *data)
+static void npcm750_class_init(ObjectClass *oc, const void *data)
 {
     NPCM7xxClass *nc = NPCM7XX_CLASS(oc);
 
diff --git a/hw/arm/npcm7xx_boards.c b/hw/arm/npcm7xx_boards.c
index eb28b97ad8..465a0e5ace 100644
--- a/hw/arm/npcm7xx_boards.c
+++ b/hw/arm/npcm7xx_boards.c
@@ -453,7 +453,7 @@ static void npcm7xx_set_soc_type(NPCM7xxMachineClass *nmc, const char *type)
     mc->default_cpus = mc->min_cpus = mc->max_cpus = sc->num_cpus;
 }
 
-static void npcm7xx_machine_class_init(ObjectClass *oc, void *data)
+static void npcm7xx_machine_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     static const char * const valid_cpu_types[] = {
@@ -472,7 +472,7 @@ static void npcm7xx_machine_class_init(ObjectClass *oc, void *data)
  * Schematics:
  * https://github.com/Nuvoton-Israel/nuvoton-info/blob/master/npcm7xx-poleg/evaluation-board/board_deliverables/NPCM750x_EB_ver.A1.1_COMPLETE.pdf
  */
-static void npcm750_evb_machine_class_init(ObjectClass *oc, void *data)
+static void npcm750_evb_machine_class_init(ObjectClass *oc, const void *data)
 {
     NPCM7xxMachineClass *nmc = NPCM7XX_MACHINE_CLASS(oc);
     MachineClass *mc = MACHINE_CLASS(oc);
@@ -485,7 +485,7 @@ static void npcm750_evb_machine_class_init(ObjectClass *oc, void *data)
     mc->default_ram_size = 512 * MiB;
 };
 
-static void gsj_machine_class_init(ObjectClass *oc, void *data)
+static void gsj_machine_class_init(ObjectClass *oc, const void *data)
 {
     NPCM7xxMachineClass *nmc = NPCM7XX_MACHINE_CLASS(oc);
     MachineClass *mc = MACHINE_CLASS(oc);
@@ -498,7 +498,7 @@ static void gsj_machine_class_init(ObjectClass *oc, void *data)
     mc->default_ram_size = 512 * MiB;
 };
 
-static void gbs_bmc_machine_class_init(ObjectClass *oc, void *data)
+static void gbs_bmc_machine_class_init(ObjectClass *oc, const void *data)
 {
     NPCM7xxMachineClass *nmc = NPCM7XX_MACHINE_CLASS(oc);
     MachineClass *mc = MACHINE_CLASS(oc);
@@ -511,7 +511,7 @@ static void gbs_bmc_machine_class_init(ObjectClass *oc, void *data)
     mc->default_ram_size = 1 * GiB;
 }
 
-static void kudo_bmc_machine_class_init(ObjectClass *oc, void *data)
+static void kudo_bmc_machine_class_init(ObjectClass *oc, const void *data)
 {
     NPCM7xxMachineClass *nmc = NPCM7XX_MACHINE_CLASS(oc);
     MachineClass *mc = MACHINE_CLASS(oc);
@@ -524,7 +524,7 @@ static void kudo_bmc_machine_class_init(ObjectClass *oc, void *data)
     mc->default_ram_size = 1 * GiB;
 };
 
-static void mori_bmc_machine_class_init(ObjectClass *oc, void *data)
+static void mori_bmc_machine_class_init(ObjectClass *oc, const void *data)
 {
     NPCM7xxMachineClass *nmc = NPCM7XX_MACHINE_CLASS(oc);
     MachineClass *mc = MACHINE_CLASS(oc);
diff --git a/hw/arm/npcm8xx.c b/hw/arm/npcm8xx.c
index f182accc47..5cc67b132f 100644
--- a/hw/arm/npcm8xx.c
+++ b/hw/arm/npcm8xx.c
@@ -779,7 +779,7 @@ static const Property npcm8xx_properties[] = {
                      MemoryRegion *),
 };
 
-static void npcm8xx_class_init(ObjectClass *oc, void *data)
+static void npcm8xx_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     NPCM8xxClass *nc = NPCM8XX_CLASS(oc);
diff --git a/hw/arm/npcm8xx_boards.c b/hw/arm/npcm8xx_boards.c
index 3fb8478e72..9d9f6d0c9a 100644
--- a/hw/arm/npcm8xx_boards.c
+++ b/hw/arm/npcm8xx_boards.c
@@ -209,7 +209,7 @@ static void npcm8xx_set_soc_type(NPCM8xxMachineClass *nmc, const char *type)
     mc->default_cpus = mc->min_cpus = mc->max_cpus = sc->num_cpus;
 }
 
-static void npcm8xx_machine_class_init(ObjectClass *oc, void *data)
+static void npcm8xx_machine_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     static const char * const valid_cpu_types[] = {
@@ -224,7 +224,7 @@ static void npcm8xx_machine_class_init(ObjectClass *oc, void *data)
     mc->valid_cpu_types = valid_cpu_types;
 }
 
-static void npcm845_evb_machine_class_init(ObjectClass *oc, void *data)
+static void npcm845_evb_machine_class_init(ObjectClass *oc, const void *data)
 {
     NPCM8xxMachineClass *nmc = NPCM8XX_MACHINE_CLASS(oc);
     MachineClass *mc = MACHINE_CLASS(oc);
diff --git a/hw/arm/nrf51_soc.c b/hw/arm/nrf51_soc.c
index dee06ab565..d8cc3214ed 100644
--- a/hw/arm/nrf51_soc.c
+++ b/hw/arm/nrf51_soc.c
@@ -216,7 +216,7 @@ static const Property nrf51_soc_properties[] = {
                        NRF51822_FLASH_SIZE),
 };
 
-static void nrf51_soc_class_init(ObjectClass *klass, void *data)
+static void nrf51_soc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/arm/omap_sx1.c b/hw/arm/omap_sx1.c
index aa1e96b3ad..1d89a202bb 100644
--- a/hw/arm/omap_sx1.c
+++ b/hw/arm/omap_sx1.c
@@ -202,7 +202,7 @@ static void sx1_init_v2(MachineState *machine)
     sx1_init(machine, 2);
 }
 
-static void sx1_machine_v2_class_init(ObjectClass *oc, void *data)
+static void sx1_machine_v2_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
 
@@ -221,7 +221,7 @@ static const TypeInfo sx1_machine_v2_type = {
     .class_init = sx1_machine_v2_class_init,
 };
 
-static void sx1_machine_v1_class_init(ObjectClass *oc, void *data)
+static void sx1_machine_v1_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
 
diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index dce35ca11a..9d9af63d65 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -337,7 +337,7 @@ static void raspi_machine_class_init(MachineClass *mc,
     mc->init = raspi_machine_init;
 };
 
-static void raspi0_machine_class_init(ObjectClass *oc, void *data)
+static void raspi0_machine_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     RaspiBaseMachineClass *rmc = RASPI_BASE_MACHINE_CLASS(oc);
@@ -347,7 +347,7 @@ static void raspi0_machine_class_init(ObjectClass *oc, void *data)
     raspi_machine_class_init(mc, rmc->board_rev);
 };
 
-static void raspi1ap_machine_class_init(ObjectClass *oc, void *data)
+static void raspi1ap_machine_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     RaspiBaseMachineClass *rmc = RASPI_BASE_MACHINE_CLASS(oc);
@@ -357,7 +357,7 @@ static void raspi1ap_machine_class_init(ObjectClass *oc, void *data)
     raspi_machine_class_init(mc, rmc->board_rev);
 };
 
-static void raspi2b_machine_class_init(ObjectClass *oc, void *data)
+static void raspi2b_machine_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     RaspiBaseMachineClass *rmc = RASPI_BASE_MACHINE_CLASS(oc);
@@ -368,7 +368,7 @@ static void raspi2b_machine_class_init(ObjectClass *oc, void *data)
 };
 
 #ifdef TARGET_AARCH64
-static void raspi3ap_machine_class_init(ObjectClass *oc, void *data)
+static void raspi3ap_machine_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     RaspiBaseMachineClass *rmc = RASPI_BASE_MACHINE_CLASS(oc);
@@ -378,7 +378,7 @@ static void raspi3ap_machine_class_init(ObjectClass *oc, void *data)
     raspi_machine_class_init(mc, rmc->board_rev);
 };
 
-static void raspi3b_machine_class_init(ObjectClass *oc, void *data)
+static void raspi3b_machine_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     RaspiBaseMachineClass *rmc = RASPI_BASE_MACHINE_CLASS(oc);
diff --git a/hw/arm/raspi4b.c b/hw/arm/raspi4b.c
index f6de103a3e..20082d5266 100644
--- a/hw/arm/raspi4b.c
+++ b/hw/arm/raspi4b.c
@@ -107,7 +107,7 @@ static void raspi4b_machine_init(MachineState *machine)
     raspi_base_machine_init(machine, &soc->parent_obj);
 }
 
-static void raspi4b_machine_class_init(ObjectClass *oc, void *data)
+static void raspi4b_machine_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     RaspiBaseMachineClass *rmc = RASPI_BASE_MACHINE_CLASS(oc);
diff --git a/hw/arm/realview.c b/hw/arm/realview.c
index 008eeaf049..5c9050490b 100644
--- a/hw/arm/realview.c
+++ b/hw/arm/realview.c
@@ -413,7 +413,7 @@ static void realview_pbx_a9_init(MachineState *machine)
     realview_init(machine, BOARD_PBX_A9);
 }
 
-static void realview_eb_class_init(ObjectClass *oc, void *data)
+static void realview_eb_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
 
@@ -433,7 +433,7 @@ static const TypeInfo realview_eb_type = {
     .class_init = realview_eb_class_init,
 };
 
-static void realview_eb_mpcore_class_init(ObjectClass *oc, void *data)
+static void realview_eb_mpcore_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
 
@@ -454,7 +454,7 @@ static const TypeInfo realview_eb_mpcore_type = {
     .class_init = realview_eb_mpcore_class_init,
 };
 
-static void realview_pb_a8_class_init(ObjectClass *oc, void *data)
+static void realview_pb_a8_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
 
@@ -473,7 +473,7 @@ static const TypeInfo realview_pb_a8_type = {
     .class_init = realview_pb_a8_class_init,
 };
 
-static void realview_pbx_a9_class_init(ObjectClass *oc, void *data)
+static void realview_pbx_a9_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
 
diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c
index aa09d7a091..deae5cf986 100644
--- a/hw/arm/sbsa-ref.c
+++ b/hw/arm/sbsa-ref.c
@@ -880,7 +880,7 @@ static void sbsa_ref_instance_init(Object *obj)
     sbsa_flash_create(sms);
 }
 
-static void sbsa_ref_class_init(ObjectClass *oc, void *data)
+static void sbsa_ref_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     static const char * const valid_cpu_types[] = {
diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c
index 1aa2eabfbd..f39b99e526 100644
--- a/hw/arm/smmu-common.c
+++ b/hw/arm/smmu-common.c
@@ -965,7 +965,7 @@ static const Property smmu_dev_properties[] = {
                      TYPE_PCI_BUS, PCIBus *),
 };
 
-static void smmu_base_class_init(ObjectClass *klass, void *data)
+static void smmu_base_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     ResettableClass *rc = RESETTABLE_CLASS(klass);
diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index 4362ae6aa1..ab67972353 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -1984,7 +1984,7 @@ static void smmuv3_instance_init(Object *obj)
     /* Nothing much to do here as of now */
 }
 
-static void smmuv3_class_init(ObjectClass *klass, void *data)
+static void smmuv3_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     ResettableClass *rc = RESETTABLE_CLASS(klass);
@@ -2031,7 +2031,7 @@ static int smmuv3_notify_flag_changed(IOMMUMemoryRegion *iommu,
 }
 
 static void smmuv3_iommu_memory_region_class_init(ObjectClass *klass,
-                                                  void *data)
+                                                  const void *data)
 {
     IOMMUMemoryRegionClass *imrc = IOMMU_MEMORY_REGION_CLASS(klass);
 
diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
index cbe914c93e..031ea3a24e 100644
--- a/hw/arm/stellaris.c
+++ b/hw/arm/stellaris.c
@@ -1413,7 +1413,7 @@ static void lm3s6965evb_init(MachineState *machine)
  * Stellaris LM3S811 Evaluation Board Schematics:
  * https://www.ti.com/lit/ug/symlink/spmu030.pdf
  */
-static void lm3s811evb_class_init(ObjectClass *oc, void *data)
+static void lm3s811evb_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
 
@@ -1433,7 +1433,7 @@ static const TypeInfo lm3s811evb_type = {
  * Stellaris: LM3S6965 Evaluation Board Schematics:
  * https://www.ti.com/lit/ug/symlink/spmu029.pdf
  */
-static void lm3s6965evb_class_init(ObjectClass *oc, void *data)
+static void lm3s6965evb_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
 
@@ -1458,7 +1458,7 @@ static void stellaris_machine_init(void)
 
 type_init(stellaris_machine_init)
 
-static void stellaris_i2c_class_init(ObjectClass *klass, void *data)
+static void stellaris_i2c_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     ResettableClass *rc = RESETTABLE_CLASS(klass);
@@ -1477,7 +1477,7 @@ static const TypeInfo stellaris_i2c_info = {
     .class_init    = stellaris_i2c_class_init,
 };
 
-static void stellaris_adc_class_init(ObjectClass *klass, void *data)
+static void stellaris_adc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     ResettableClass *rc = RESETTABLE_CLASS(klass);
@@ -1494,7 +1494,7 @@ static const TypeInfo stellaris_adc_info = {
     .class_init    = stellaris_adc_class_init,
 };
 
-static void stellaris_sys_class_init(ObjectClass *klass, void *data)
+static void stellaris_sys_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     ResettableClass *rc = RESETTABLE_CLASS(klass);
diff --git a/hw/arm/stm32f100_soc.c b/hw/arm/stm32f100_soc.c
index 0eabaf8d9b..0702d51cc3 100644
--- a/hw/arm/stm32f100_soc.c
+++ b/hw/arm/stm32f100_soc.c
@@ -181,7 +181,7 @@ static void stm32f100_soc_realize(DeviceState *dev_soc, Error **errp)
     create_unimplemented_device("CRC",       0x40023000, 0x400);
 }
 
-static void stm32f100_soc_class_init(ObjectClass *klass, void *data)
+static void stm32f100_soc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/arm/stm32f205_soc.c b/hw/arm/stm32f205_soc.c
index 32e96912f0..229af7fb10 100644
--- a/hw/arm/stm32f205_soc.c
+++ b/hw/arm/stm32f205_soc.c
@@ -202,7 +202,7 @@ static void stm32f205_soc_realize(DeviceState *dev_soc, Error **errp)
     }
 }
 
-static void stm32f205_soc_class_init(ObjectClass *klass, void *data)
+static void stm32f205_soc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/arm/stm32f405_soc.c b/hw/arm/stm32f405_soc.c
index bba9060daf..c8684e2b4c 100644
--- a/hw/arm/stm32f405_soc.c
+++ b/hw/arm/stm32f405_soc.c
@@ -298,7 +298,7 @@ static void stm32f405_soc_realize(DeviceState *dev_soc, Error **errp)
     create_unimplemented_device("RNG",         0x50060800, 0x400);
 }
 
-static void stm32f405_soc_class_init(ObjectClass *klass, void *data)
+static void stm32f405_soc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/arm/stm32l4x5_soc.c b/hw/arm/stm32l4x5_soc.c
index 6278d354c8..64da5559c0 100644
--- a/hw/arm/stm32l4x5_soc.c
+++ b/hw/arm/stm32l4x5_soc.c
@@ -435,7 +435,7 @@ static void stm32l4x5_soc_realize(DeviceState *dev_soc, Error **errp)
     create_unimplemented_device("QUADSPI",   0xA0001000, 0x400);
 }
 
-static void stm32l4x5_soc_class_init(ObjectClass *klass, void *data)
+static void stm32l4x5_soc_class_init(ObjectClass *klass, const void *data)
 {
 
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -446,21 +446,21 @@ static void stm32l4x5_soc_class_init(ObjectClass *klass, void *data)
     /* No vmstate or reset required: device has no internal state */
 }
 
-static void stm32l4x5xc_soc_class_init(ObjectClass *oc, void *data)
+static void stm32l4x5xc_soc_class_init(ObjectClass *oc, const void *data)
 {
     Stm32l4x5SocClass *ssc = STM32L4X5_SOC_CLASS(oc);
 
     ssc->flash_size = 256 * KiB;
 }
 
-static void stm32l4x5xe_soc_class_init(ObjectClass *oc, void *data)
+static void stm32l4x5xe_soc_class_init(ObjectClass *oc, const void *data)
 {
     Stm32l4x5SocClass *ssc = STM32L4X5_SOC_CLASS(oc);
 
     ssc->flash_size = 512 * KiB;
 }
 
-static void stm32l4x5xg_soc_class_init(ObjectClass *oc, void *data)
+static void stm32l4x5xg_soc_class_init(ObjectClass *oc, const void *data)
 {
     Stm32l4x5SocClass *ssc = STM32L4X5_SOC_CLASS(oc);
 
diff --git a/hw/arm/strongarm.c b/hw/arm/strongarm.c
index a31f4b4c65..229c98ddd9 100644
--- a/hw/arm/strongarm.c
+++ b/hw/arm/strongarm.c
@@ -215,7 +215,7 @@ static const VMStateDescription vmstate_strongarm_pic_regs = {
     },
 };
 
-static void strongarm_pic_class_init(ObjectClass *klass, void *data)
+static void strongarm_pic_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -448,7 +448,8 @@ static const VMStateDescription vmstate_strongarm_rtc_regs = {
     },
 };
 
-static void strongarm_rtc_sysbus_class_init(ObjectClass *klass, void *data)
+static void strongarm_rtc_sysbus_class_init(ObjectClass *klass,
+                                            const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -693,7 +694,7 @@ static const VMStateDescription vmstate_strongarm_gpio_regs = {
     },
 };
 
-static void strongarm_gpio_class_init(ObjectClass *klass, void *data)
+static void strongarm_gpio_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -865,7 +866,7 @@ static const VMStateDescription vmstate_strongarm_ppc_regs = {
     },
 };
 
-static void strongarm_ppc_class_init(ObjectClass *klass, void *data)
+static void strongarm_ppc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -1336,7 +1337,7 @@ static const Property strongarm_uart_properties[] = {
     DEFINE_PROP_CHR("chardev", StrongARMUARTState, chr),
 };
 
-static void strongarm_uart_class_init(ObjectClass *klass, void *data)
+static void strongarm_uart_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -1589,7 +1590,7 @@ static const VMStateDescription vmstate_strongarm_ssp_regs = {
     },
 };
 
-static void strongarm_ssp_class_init(ObjectClass *klass, void *data)
+static void strongarm_ssp_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/arm/versatilepb.c b/hw/arm/versatilepb.c
index 35766445fa..5cf1a70d10 100644
--- a/hw/arm/versatilepb.c
+++ b/hw/arm/versatilepb.c
@@ -412,7 +412,7 @@ static void vab_init(MachineState *machine)
     versatile_init(machine, 0x25e);
 }
 
-static void versatilepb_class_init(ObjectClass *oc, void *data)
+static void versatilepb_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
 
@@ -433,7 +433,7 @@ static const TypeInfo versatilepb_type = {
     .class_init = versatilepb_class_init,
 };
 
-static void versatileab_class_init(ObjectClass *oc, void *data)
+static void versatileab_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
 
@@ -462,7 +462,7 @@ static void versatile_machine_init(void)
 
 type_init(versatile_machine_init)
 
-static void vpb_sic_class_init(ObjectClass *klass, void *data)
+static void vpb_sic_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/arm/vexpress.c b/hw/arm/vexpress.c
index 76c6107766..35f8d05ea1 100644
--- a/hw/arm/vexpress.c
+++ b/hw/arm/vexpress.c
@@ -777,7 +777,7 @@ static void vexpress_a9_instance_init(Object *obj)
     vms->virt = false;
 }
 
-static void vexpress_class_init(ObjectClass *oc, void *data)
+static void vexpress_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
 
@@ -795,7 +795,7 @@ static void vexpress_class_init(ObjectClass *oc, void *data)
                                           "Security Extensions (TrustZone)");
 }
 
-static void vexpress_a9_class_init(ObjectClass *oc, void *data)
+static void vexpress_a9_class_init(ObjectClass *oc, const void *data)
 {
     static const char * const valid_cpu_types[] = {
         ARM_CPU_TYPE_NAME("cortex-a9"),
@@ -811,7 +811,7 @@ static void vexpress_a9_class_init(ObjectClass *oc, void *data)
     vmc->daughterboard = &a9_daughterboard;
 }
 
-static void vexpress_a15_class_init(ObjectClass *oc, void *data)
+static void vexpress_a15_class_init(ObjectClass *oc, const void *data)
 {
     static const char * const valid_cpu_types[] = {
         ARM_CPU_TYPE_NAME("cortex-a15"),
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index 3e72adaa91..17faf34aae 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -107,7 +107,7 @@ static void arm_virt_compat_set(MachineClass *mc)
 #define DEFINE_VIRT_MACHINE_IMPL(latest, ...) \
     static void MACHINE_VER_SYM(class_init, virt, __VA_ARGS__)( \
         ObjectClass *oc, \
-        void *data) \
+        const void *data) \
     { \
         MachineClass *mc = MACHINE_CLASS(oc); \
         arm_virt_compat_set(mc); \
@@ -3124,7 +3124,7 @@ static int virt_hvf_get_physical_address_range(MachineState *ms)
     return requested_ipa_size;
 }
 
-static void virt_machine_class_init(ObjectClass *oc, void *data)
+static void virt_machine_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     HotplugHandlerClass *hc = HOTPLUG_HANDLER_CLASS(oc);
diff --git a/hw/arm/xen-pvh.c b/hw/arm/xen-pvh.c
index d1509bd235..4b26bcff7a 100644
--- a/hw/arm/xen-pvh.c
+++ b/hw/arm/xen-pvh.c
@@ -49,7 +49,7 @@ static void xen_pvh_set_pci_intx_irq(void *opaque, int intx_irq, int level)
     }
 }
 
-static void xen_arm_machine_class_init(ObjectClass *oc, void *data)
+static void xen_arm_machine_class_init(ObjectClass *oc, const void *data)
 {
     XenPVHMachineClass *xpc = XEN_PVH_MACHINE_CLASS(oc);
     MachineClass *mc = MACHINE_CLASS(oc);
diff --git a/hw/arm/xilinx_zynq.c b/hw/arm/xilinx_zynq.c
index b8916665ed..0372cd0ac4 100644
--- a/hw/arm/xilinx_zynq.c
+++ b/hw/arm/xilinx_zynq.c
@@ -453,7 +453,7 @@ static void zynq_init(MachineState *machine)
     arm_load_kernel(zynq_machine->cpu[0], machine, &zynq_binfo);
 }
 
-static void zynq_machine_class_init(ObjectClass *oc, void *data)
+static void zynq_machine_class_init(ObjectClass *oc, const void *data)
 {
     static const char * const valid_cpu_types[] = {
         ARM_CPU_TYPE_NAME("cortex-a9"),
diff --git a/hw/arm/xlnx-versal-virt.c b/hw/arm/xlnx-versal-virt.c
index 0c6f0359e3..adadbb7290 100644
--- a/hw/arm/xlnx-versal-virt.c
+++ b/hw/arm/xlnx-versal-virt.c
@@ -808,7 +808,7 @@ static void versal_virt_machine_finalize(Object *obj)
     g_free(s->ospi_model);
 }
 
-static void versal_virt_machine_class_init(ObjectClass *oc, void *data)
+static void versal_virt_machine_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
 
diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index f0b383b29e..a42b9e7140 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -975,7 +975,7 @@ static const Property versal_properties[] = {
                       TYPE_CAN_BUS, CanBusState *),
 };
 
-static void versal_class_init(ObjectClass *klass, void *data)
+static void versal_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c
index 4fdb153e4d..14b6641a71 100644
--- a/hw/arm/xlnx-zcu102.c
+++ b/hw/arm/xlnx-zcu102.c
@@ -267,7 +267,7 @@ static void xlnx_zcu102_machine_instance_init(Object *obj)
                              0);
 }
 
-static void xlnx_zcu102_machine_class_init(ObjectClass *oc, void *data)
+static void xlnx_zcu102_machine_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
 
diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c
index ec2b3a41ed..ec96a46eec 100644
--- a/hw/arm/xlnx-zynqmp.c
+++ b/hw/arm/xlnx-zynqmp.c
@@ -853,7 +853,7 @@ static const Property xlnx_zynqmp_props[] = {
                      CanBusState *),
 };
 
-static void xlnx_zynqmp_class_init(ObjectClass *oc, void *data)
+static void xlnx_zynqmp_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
diff --git a/hw/audio/ac97.c b/hw/audio/ac97.c
index 05c573776e..7454cc60de 100644
--- a/hw/audio/ac97.c
+++ b/hw/audio/ac97.c
@@ -1328,7 +1328,7 @@ static const Property ac97_properties[] = {
     DEFINE_AUDIO_PROPERTIES(AC97LinkState, card),
 };
 
-static void ac97_class_init(ObjectClass *klass, void *data)
+static void ac97_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
diff --git a/hw/audio/adlib.c b/hw/audio/adlib.c
index 8c9767b537..1f29a7e319 100644
--- a/hw/audio/adlib.c
+++ b/hw/audio/adlib.c
@@ -303,7 +303,7 @@ static const Property adlib_properties[] = {
     DEFINE_PROP_UINT32 ("freq",    AdlibState, freq,  44100),
 };
 
-static void adlib_class_initfn (ObjectClass *klass, void *data)
+static void adlib_class_initfn(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS (klass);
 
diff --git a/hw/audio/asc.c b/hw/audio/asc.c
index cea7a1c053..18382ccf6a 100644
--- a/hw/audio/asc.c
+++ b/hw/audio/asc.c
@@ -699,7 +699,7 @@ static const Property asc_properties[] = {
     DEFINE_PROP_UINT8("asctype", ASCState, type, ASC_TYPE_ASC),
 };
 
-static void asc_class_init(ObjectClass *oc, void *data)
+static void asc_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     ResettableClass *rc = RESETTABLE_CLASS(oc);
diff --git a/hw/audio/cs4231.c b/hw/audio/cs4231.c
index 8321f89c88..97cceb44d8 100644
--- a/hw/audio/cs4231.c
+++ b/hw/audio/cs4231.c
@@ -160,7 +160,7 @@ static void cs4231_init(Object *obj)
     sysbus_init_irq(dev, &s->irq);
 }
 
-static void cs4231_class_init(ObjectClass *klass, void *data)
+static void cs4231_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/audio/cs4231a.c b/hw/audio/cs4231a.c
index 5a9be80ba3..06b44da869 100644
--- a/hw/audio/cs4231a.c
+++ b/hw/audio/cs4231a.c
@@ -696,7 +696,7 @@ static const Property cs4231a_properties[] = {
     DEFINE_PROP_UINT32 ("dma",     CSState, dma,  3),
 };
 
-static void cs4231a_class_initfn (ObjectClass *klass, void *data)
+static void cs4231a_class_initfn(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS (klass);
 
diff --git a/hw/audio/es1370.c b/hw/audio/es1370.c
index 75f71e5d78..322b779814 100644
--- a/hw/audio/es1370.c
+++ b/hw/audio/es1370.c
@@ -872,7 +872,7 @@ static const Property es1370_properties[] = {
     DEFINE_AUDIO_PROPERTIES(ES1370State, card),
 };
 
-static void es1370_class_init (ObjectClass *klass, void *data)
+static void es1370_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS (klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS (klass);
diff --git a/hw/audio/gus.c b/hw/audio/gus.c
index e718c1183e..87e8634893 100644
--- a/hw/audio/gus.c
+++ b/hw/audio/gus.c
@@ -298,7 +298,7 @@ static const Property gus_properties[] = {
     DEFINE_PROP_UINT32 ("dma",     GUSState, emu.gusdma,  3),
 };
 
-static void gus_class_initfn (ObjectClass *klass, void *data)
+static void gus_class_initfn(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS (klass);
 
diff --git a/hw/audio/hda-codec.c b/hw/audio/hda-codec.c
index 6f3a8f691b..66edad280f 100644
--- a/hw/audio/hda-codec.c
+++ b/hw/audio/hda-codec.c
@@ -900,7 +900,7 @@ static void hda_audio_init_micro(HDACodecDevice *hda, Error **errp)
     hda_audio_init(hda, desc, errp);
 }
 
-static void hda_audio_base_class_init(ObjectClass *klass, void *data)
+static void hda_audio_base_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     HDACodecDeviceClass *k = HDA_CODEC_DEVICE_CLASS(klass);
@@ -922,7 +922,7 @@ static const TypeInfo hda_audio_info = {
     .abstract      = true,
 };
 
-static void hda_audio_output_class_init(ObjectClass *klass, void *data)
+static void hda_audio_output_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     HDACodecDeviceClass *k = HDA_CODEC_DEVICE_CLASS(klass);
@@ -937,7 +937,7 @@ static const TypeInfo hda_audio_output_info = {
     .class_init    = hda_audio_output_class_init,
 };
 
-static void hda_audio_duplex_class_init(ObjectClass *klass, void *data)
+static void hda_audio_duplex_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     HDACodecDeviceClass *k = HDA_CODEC_DEVICE_CLASS(klass);
@@ -952,7 +952,7 @@ static const TypeInfo hda_audio_duplex_info = {
     .class_init    = hda_audio_duplex_class_init,
 };
 
-static void hda_audio_micro_class_init(ObjectClass *klass, void *data)
+static void hda_audio_micro_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     HDACodecDeviceClass *k = HDA_CODEC_DEVICE_CLASS(klass);
diff --git a/hw/audio/intel-hda.c b/hw/audio/intel-hda.c
index 3214992ddc..2f1b08e9c1 100644
--- a/hw/audio/intel-hda.c
+++ b/hw/audio/intel-hda.c
@@ -1220,7 +1220,7 @@ static const Property intel_hda_properties[] = {
     DEFINE_PROP_BOOL("old_msi_addr", IntelHDAState, old_msi_addr, false),
 };
 
-static void intel_hda_class_init(ObjectClass *klass, void *data)
+static void intel_hda_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
@@ -1234,7 +1234,7 @@ static void intel_hda_class_init(ObjectClass *klass, void *data)
     device_class_set_props(dc, intel_hda_properties);
 }
 
-static void intel_hda_class_init_ich6(ObjectClass *klass, void *data)
+static void intel_hda_class_init_ich6(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
@@ -1245,7 +1245,7 @@ static void intel_hda_class_init_ich6(ObjectClass *klass, void *data)
     dc->desc = "Intel HD Audio Controller (ich6)";
 }
 
-static void intel_hda_class_init_ich9(ObjectClass *klass, void *data)
+static void intel_hda_class_init_ich9(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
@@ -1280,7 +1280,7 @@ static const TypeInfo intel_hda_info_ich9 = {
     .class_init    = intel_hda_class_init_ich9,
 };
 
-static void hda_codec_device_class_init(ObjectClass *klass, void *data)
+static void hda_codec_device_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *k = DEVICE_CLASS(klass);
     k->realize = hda_codec_dev_realize;
diff --git a/hw/audio/marvell_88w8618.c b/hw/audio/marvell_88w8618.c
index 28f9af320d..6d3ebbb0c8 100644
--- a/hw/audio/marvell_88w8618.c
+++ b/hw/audio/marvell_88w8618.c
@@ -287,7 +287,7 @@ static const VMStateDescription mv88w8618_audio_vmsd = {
     }
 };
 
-static void mv88w8618_audio_class_init(ObjectClass *klass, void *data)
+static void mv88w8618_audio_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/audio/pcspk.c b/hw/audio/pcspk.c
index 17be185547..a419161b5b 100644
--- a/hw/audio/pcspk.c
+++ b/hw/audio/pcspk.c
@@ -221,7 +221,7 @@ static const Property pcspk_properties[] = {
     DEFINE_PROP_BOOL("migrate", PCSpkState, migrate,  true),
 };
 
-static void pcspk_class_initfn(ObjectClass *klass, void *data)
+static void pcspk_class_initfn(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/audio/pl041.c b/hw/audio/pl041.c
index f771d725fa..5d9d6c1178 100644
--- a/hw/audio/pl041.c
+++ b/hw/audio/pl041.c
@@ -632,7 +632,7 @@ static const Property pl041_device_properties[] = {
                        DEFAULT_FIFO_DEPTH),
 };
 
-static void pl041_device_class_init(ObjectClass *klass, void *data)
+static void pl041_device_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/audio/sb16.c b/hw/audio/sb16.c
index 0c661b4947..19fd3b9020 100644
--- a/hw/audio/sb16.c
+++ b/hw/audio/sb16.c
@@ -1449,7 +1449,7 @@ static const Property sb16_properties[] = {
     DEFINE_PROP_UINT32 ("dma16",   SB16State, hdma, 5),
 };
 
-static void sb16_class_initfn (ObjectClass *klass, void *data)
+static void sb16_class_initfn(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS (klass);
 
diff --git a/hw/audio/via-ac97.c b/hw/audio/via-ac97.c
index 4e115e011e..5feef663d8 100644
--- a/hw/audio/via-ac97.c
+++ b/hw/audio/via-ac97.c
@@ -463,7 +463,7 @@ static const Property via_ac97_properties[] = {
     DEFINE_AUDIO_PROPERTIES(ViaAC97State, card),
 };
 
-static void via_ac97_class_init(ObjectClass *klass, void *data)
+static void via_ac97_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
@@ -501,7 +501,7 @@ static void via_mc97_realize(PCIDevice *pci_dev, Error **errp)
     pci_set_long(pci_dev->config + PCI_INTERRUPT_PIN, 0x03);
 }
 
-static void via_mc97_class_init(ObjectClass *klass, void *data)
+static void via_mc97_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
diff --git a/hw/audio/virtio-snd-pci.c b/hw/audio/virtio-snd-pci.c
index 74d93f4e9c..9eb0007392 100644
--- a/hw/audio/virtio-snd-pci.c
+++ b/hw/audio/virtio-snd-pci.c
@@ -42,7 +42,7 @@ static void virtio_snd_pci_realize(VirtIOPCIProxy *vpci_dev, Error **errp)
     qdev_realize(vdev, BUS(&vpci_dev->bus), errp);
 }
 
-static void virtio_snd_pci_class_init(ObjectClass *klass, void *data)
+static void virtio_snd_pci_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtioPCIClass *vpciklass = VIRTIO_PCI_CLASS(klass);
diff --git a/hw/audio/virtio-snd.c b/hw/audio/virtio-snd.c
index 0b47741f01..eca3319e59 100644
--- a/hw/audio/virtio-snd.c
+++ b/hw/audio/virtio-snd.c
@@ -1361,7 +1361,7 @@ static void virtio_snd_reset(VirtIODevice *vdev)
     }
 }
 
-static void virtio_snd_class_init(ObjectClass *klass, void *data)
+static void virtio_snd_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
diff --git a/hw/audio/wm8750.c b/hw/audio/wm8750.c
index 8d381dbc65..2846b55fe2 100644
--- a/hw/audio/wm8750.c
+++ b/hw/audio/wm8750.c
@@ -710,7 +710,7 @@ static const Property wm8750_properties[] = {
     DEFINE_AUDIO_PROPERTIES(WM8750State, card),
 };
 
-static void wm8750_class_init(ObjectClass *klass, void *data)
+static void wm8750_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     I2CSlaveClass *sc = I2C_SLAVE_CLASS(klass);
diff --git a/hw/avr/arduino.c b/hw/avr/arduino.c
index 48ef478346..e166ca18e1 100644
--- a/hw/avr/arduino.c
+++ b/hw/avr/arduino.c
@@ -56,7 +56,7 @@ static void arduino_machine_init(MachineState *machine)
     }
 }
 
-static void arduino_machine_class_init(ObjectClass *oc, void *data)
+static void arduino_machine_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
 
@@ -69,7 +69,7 @@ static void arduino_machine_class_init(ObjectClass *oc, void *data)
     mc->no_parallel = 1;
 }
 
-static void arduino_duemilanove_class_init(ObjectClass *oc, void *data)
+static void arduino_duemilanove_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     ArduinoMachineClass *amc = ARDUINO_MACHINE_CLASS(oc);
@@ -84,7 +84,7 @@ static void arduino_duemilanove_class_init(ObjectClass *oc, void *data)
     amc->xtal_hz    = 16 * 1000 * 1000;
 };
 
-static void arduino_uno_class_init(ObjectClass *oc, void *data)
+static void arduino_uno_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     ArduinoMachineClass *amc = ARDUINO_MACHINE_CLASS(oc);
@@ -99,7 +99,7 @@ static void arduino_uno_class_init(ObjectClass *oc, void *data)
     amc->xtal_hz    = 16 * 1000 * 1000;
 };
 
-static void arduino_mega_class_init(ObjectClass *oc, void *data)
+static void arduino_mega_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     ArduinoMachineClass *amc = ARDUINO_MACHINE_CLASS(oc);
@@ -114,7 +114,7 @@ static void arduino_mega_class_init(ObjectClass *oc, void *data)
     amc->xtal_hz    = 16 * 1000 * 1000;
 };
 
-static void arduino_mega2560_class_init(ObjectClass *oc, void *data)
+static void arduino_mega2560_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     ArduinoMachineClass *amc = ARDUINO_MACHINE_CLASS(oc);
diff --git a/hw/avr/atmega.c b/hw/avr/atmega.c
index c105d2a97c..95b6da5e34 100644
--- a/hw/avr/atmega.c
+++ b/hw/avr/atmega.c
@@ -386,7 +386,7 @@ static const Property atmega_props[] = {
                        xtal_freq_hz, 0),
 };
 
-static void atmega_class_init(ObjectClass *oc, void *data)
+static void atmega_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
@@ -396,7 +396,7 @@ static void atmega_class_init(ObjectClass *oc, void *data)
     dc->user_creatable = false;
 }
 
-static void atmega168_class_init(ObjectClass *oc, void *data)
+static void atmega168_class_init(ObjectClass *oc, const void *data)
 {
     AtmegaMcuClass *amc = ATMEGA_MCU_CLASS(oc);
 
@@ -411,7 +411,7 @@ static void atmega168_class_init(ObjectClass *oc, void *data)
     amc->dev = dev168_328;
 };
 
-static void atmega328_class_init(ObjectClass *oc, void *data)
+static void atmega328_class_init(ObjectClass *oc, const void *data)
 {
     AtmegaMcuClass *amc = ATMEGA_MCU_CLASS(oc);
 
@@ -426,7 +426,7 @@ static void atmega328_class_init(ObjectClass *oc, void *data)
     amc->dev = dev168_328;
 };
 
-static void atmega1280_class_init(ObjectClass *oc, void *data)
+static void atmega1280_class_init(ObjectClass *oc, const void *data)
 {
     AtmegaMcuClass *amc = ATMEGA_MCU_CLASS(oc);
 
@@ -441,7 +441,7 @@ static void atmega1280_class_init(ObjectClass *oc, void *data)
     amc->dev = dev1280_2560;
 };
 
-static void atmega2560_class_init(ObjectClass *oc, void *data)
+static void atmega2560_class_init(ObjectClass *oc, const void *data)
 {
     AtmegaMcuClass *amc = ATMEGA_MCU_CLASS(oc);
 
diff --git a/hw/block/fdc-isa.c b/hw/block/fdc-isa.c
index 561cfa47c1..fbba2ab629 100644
--- a/hw/block/fdc-isa.c
+++ b/hw/block/fdc-isa.c
@@ -298,7 +298,7 @@ static const Property isa_fdc_properties[] = {
                         FloppyDriveType),
 };
 
-static void isabus_fdc_class_init(ObjectClass *klass, void *data)
+static void isabus_fdc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     AcpiDevAmlIfClass *adevc = ACPI_DEV_AML_IF_CLASS(klass);
diff --git a/hw/block/fdc-sysbus.c b/hw/block/fdc-sysbus.c
index 4955e478cd..956860ab29 100644
--- a/hw/block/fdc-sysbus.c
+++ b/hw/block/fdc-sysbus.c
@@ -176,7 +176,7 @@ static const VMStateDescription vmstate_sysbus_fdc = {
     }
 };
 
-static void sysbus_fdc_common_class_init(ObjectClass *klass, void *data)
+static void sysbus_fdc_common_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -208,7 +208,7 @@ static const Property sysbus_fdc_properties[] = {
                         FloppyDriveType),
 };
 
-static void sysbus_fdc_class_init(ObjectClass *klass, void *data)
+static void sysbus_fdc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -231,7 +231,7 @@ static const Property sun4m_fdc_properties[] = {
                         FloppyDriveType),
 };
 
-static void sun4m_fdc_class_init(ObjectClass *klass, void *data)
+static void sun4m_fdc_class_init(ObjectClass *klass, const void *data)
 {
     FDCtrlSysBusClass *sbdc = SYSBUS_FDC_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
diff --git a/hw/block/fdc.c b/hw/block/fdc.c
index 2df941d3f4..d0f08c7be5 100644
--- a/hw/block/fdc.c
+++ b/hw/block/fdc.c
@@ -553,7 +553,7 @@ static void floppy_drive_realize(DeviceState *qdev, Error **errp)
     fd_revalidate(drive);
 }
 
-static void floppy_drive_class_init(ObjectClass *klass, void *data)
+static void floppy_drive_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *k = DEVICE_CLASS(klass);
     k->realize = floppy_drive_realize;
diff --git a/hw/block/m25p80.c b/hw/block/m25p80.c
index 0887c103e4..75b9d71251 100644
--- a/hw/block/m25p80.c
+++ b/hw/block/m25p80.c
@@ -528,7 +528,7 @@ struct Flash {
 
 struct M25P80Class {
     SSIPeripheralClass parent_class;
-    FlashPartInfo *pi;
+    const FlashPartInfo *pi;
 };
 
 OBJECT_DECLARE_TYPE(Flash, M25P80Class, M25P80)
@@ -1857,7 +1857,7 @@ static const VMStateDescription vmstate_m25p80 = {
     }
 };
 
-static void m25p80_class_init(ObjectClass *klass, void *data)
+static void m25p80_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     SSIPeripheralClass *k = SSI_PERIPHERAL_CLASS(klass);
diff --git a/hw/block/nand.c b/hw/block/nand.c
index e98c55b729..c80bf78fe5 100644
--- a/hw/block/nand.c
+++ b/hw/block/nand.c
@@ -451,7 +451,7 @@ static const Property nand_properties[] = {
     DEFINE_PROP_DRIVE("drive", NANDFlashState, blk),
 };
 
-static void nand_class_init(ObjectClass *klass, void *data)
+static void nand_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/block/pflash_cfi01.c b/hw/block/pflash_cfi01.c
index b5ea927f36..168101d8df 100644
--- a/hw/block/pflash_cfi01.c
+++ b/hw/block/pflash_cfi01.c
@@ -934,7 +934,7 @@ static const Property pflash_cfi01_properties[] = {
                      old_multiple_chip_handling, false),
 };
 
-static void pflash_cfi01_class_init(ObjectClass *klass, void *data)
+static void pflash_cfi01_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/block/pflash_cfi02.c b/hw/block/pflash_cfi02.c
index 315a53629a..3244b699b9 100644
--- a/hw/block/pflash_cfi02.c
+++ b/hw/block/pflash_cfi02.c
@@ -968,7 +968,7 @@ static void pflash_cfi02_unrealize(DeviceState *dev)
     g_free(pfl->sector_erase_map);
 }
 
-static void pflash_cfi02_class_init(ObjectClass *klass, void *data)
+static void pflash_cfi02_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/block/swim.c b/hw/block/swim.c
index 4645468dcf..ad047362f8 100644
--- a/hw/block/swim.c
+++ b/hw/block/swim.c
@@ -253,7 +253,7 @@ static void swim_drive_realize(DeviceState *qdev, Error **errp)
     blk_set_dev_ops(drive->blk, &swim_block_ops, drive);
 }
 
-static void swim_drive_class_init(ObjectClass *klass, void *data)
+static void swim_drive_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *k = DEVICE_CLASS(klass);
     k->realize = swim_drive_realize;
@@ -550,7 +550,7 @@ static const VMStateDescription vmstate_sysbus_swim = {
     }
 };
 
-static void sysbus_swim_class_init(ObjectClass *oc, void *data)
+static void sysbus_swim_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
diff --git a/hw/block/vhost-user-blk.c b/hw/block/vhost-user-blk.c
index ae42327cf8..4bb5ed299e 100644
--- a/hw/block/vhost-user-blk.c
+++ b/hw/block/vhost-user-blk.c
@@ -583,7 +583,7 @@ static const Property vhost_user_blk_properties[] = {
                       VIRTIO_BLK_F_WRITE_ZEROES, true),
 };
 
-static void vhost_user_blk_class_init(ObjectClass *klass, void *data)
+static void vhost_user_blk_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
index 5077793e5e..b54d01d3a2 100644
--- a/hw/block/virtio-blk.c
+++ b/hw/block/virtio-blk.c
@@ -1886,7 +1886,7 @@ static const Property virtio_blk_properties[] = {
                      conf.x_enable_wce_if_config_wce, true),
 };
 
-static void virtio_blk_class_init(ObjectClass *klass, void *data)
+static void virtio_blk_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
diff --git a/hw/block/xen-block.c b/hw/block/xen-block.c
index ec04102b66..74de897c79 100644
--- a/hw/block/xen-block.c
+++ b/hw/block/xen-block.c
@@ -679,7 +679,7 @@ static const Property xen_block_props[] = {
                      TYPE_IOTHREAD, IOThread *),
 };
 
-static void xen_block_class_init(ObjectClass *class, void *data)
+static void xen_block_class_init(ObjectClass *class, const void *data)
 {
     DeviceClass *dev_class = DEVICE_CLASS(class);
     XenDeviceClass *xendev_class = XEN_DEVICE_CLASS(class);
@@ -724,7 +724,7 @@ static void xen_disk_realize(XenBlockDevice *blockdev, Error **errp)
     blockdev->info = blk_supports_write_perm(conf->blk) ? 0 : VDISK_READONLY;
 }
 
-static void xen_disk_class_init(ObjectClass *class, void *data)
+static void xen_disk_class_init(ObjectClass *class, const void *data)
 {
     DeviceClass *dev_class = DEVICE_CLASS(class);
     XenBlockDeviceClass *blockdev_class = XEN_BLOCK_DEVICE_CLASS(class);
@@ -771,7 +771,7 @@ static void xen_cdrom_realize(XenBlockDevice *blockdev, Error **errp)
     blockdev->info = VDISK_READONLY | VDISK_CDROM;
 }
 
-static void xen_cdrom_class_init(ObjectClass *class, void *data)
+static void xen_cdrom_class_init(ObjectClass *class, const void *data)
 {
     DeviceClass *dev_class = DEVICE_CLASS(class);
     XenBlockDeviceClass *blockdev_class = XEN_BLOCK_DEVICE_CLASS(class);
diff --git a/hw/char/avr_usart.c b/hw/char/avr_usart.c
index e8012cae3a..fae15217e9 100644
--- a/hw/char/avr_usart.c
+++ b/hw/char/avr_usart.c
@@ -295,7 +295,7 @@ static void avr_usart_realize(DeviceState *dev, Error **errp)
     avr_usart_reset(dev);
 }
 
-static void avr_usart_class_init(ObjectClass *klass, void *data)
+static void avr_usart_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/char/bcm2835_aux.c b/hw/char/bcm2835_aux.c
index 9b073fc330..2b397f2ff3 100644
--- a/hw/char/bcm2835_aux.c
+++ b/hw/char/bcm2835_aux.c
@@ -296,7 +296,7 @@ static const Property bcm2835_aux_props[] = {
     DEFINE_PROP_CHR("chardev", BCM2835AuxState, chr),
 };
 
-static void bcm2835_aux_class_init(ObjectClass *oc, void *data)
+static void bcm2835_aux_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
diff --git a/hw/char/cadence_uart.c b/hw/char/cadence_uart.c
index ebd846a083..0dfa356b6d 100644
--- a/hw/char/cadence_uart.c
+++ b/hw/char/cadence_uart.c
@@ -621,7 +621,7 @@ static const Property cadence_uart_properties[] = {
     DEFINE_PROP_CHR("chardev", CadenceUARTState, chr),
 };
 
-static void cadence_uart_class_init(ObjectClass *klass, void *data)
+static void cadence_uart_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     ResettableClass *rc = RESETTABLE_CLASS(klass);
diff --git a/hw/char/cmsdk-apb-uart.c b/hw/char/cmsdk-apb-uart.c
index 0506500215..32090f3516 100644
--- a/hw/char/cmsdk-apb-uart.c
+++ b/hw/char/cmsdk-apb-uart.c
@@ -382,7 +382,7 @@ static const Property cmsdk_apb_uart_properties[] = {
     DEFINE_PROP_UINT32("pclk-frq", CMSDKAPBUART, pclk_frq, 0),
 };
 
-static void cmsdk_apb_uart_class_init(ObjectClass *klass, void *data)
+static void cmsdk_apb_uart_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/char/debugcon.c b/hw/char/debugcon.c
index 1bc3bf85fe..bf44aaf9e4 100644
--- a/hw/char/debugcon.c
+++ b/hw/char/debugcon.c
@@ -120,7 +120,7 @@ static const Property debugcon_isa_properties[] = {
     DEFINE_PROP_UINT32("readback", ISADebugconState, state.readback, 0xe9),
 };
 
-static void debugcon_isa_class_initfn(ObjectClass *klass, void *data)
+static void debugcon_isa_class_initfn(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/char/digic-uart.c b/hw/char/digic-uart.c
index b0b0714e0f..0f6af51bb7 100644
--- a/hw/char/digic-uart.c
+++ b/hw/char/digic-uart.c
@@ -176,7 +176,7 @@ static const Property digic_uart_properties[] = {
     DEFINE_PROP_CHR("chardev", DigicUartState, chr),
 };
 
-static void digic_uart_class_init(ObjectClass *klass, void *data)
+static void digic_uart_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/char/diva-gsp.c b/hw/char/diva-gsp.c
index ecec1f7bb1..9a623d680b 100644
--- a/hw/char/diva-gsp.c
+++ b/hw/char/diva-gsp.c
@@ -183,7 +183,7 @@ static const Property diva_serial_properties[] = {
                                     PCI_DEVICE_ID_HP_DIVA_TOSCA1),
 };
 
-static void diva_serial_class_initfn(ObjectClass *klass, void *data)
+static void diva_serial_class_initfn(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *pc = PCI_DEVICE_CLASS(klass);
@@ -242,7 +242,7 @@ static void diva_aux_exit(PCIDevice *dev)
     qemu_free_irq(pci->irq);
 }
 
-static void diva_aux_class_initfn(ObjectClass *klass, void *data)
+static void diva_aux_class_initfn(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *pc = PCI_DEVICE_CLASS(klass);
diff --git a/hw/char/escc.c b/hw/char/escc.c
index a5fdd8f698..afe4ca483e 100644
--- a/hw/char/escc.c
+++ b/hw/char/escc.c
@@ -1101,7 +1101,7 @@ static const Property escc_properties[] = {
     DEFINE_PROP_STRING("chnA-sunkbd-layout", ESCCState, chn[1].sunkbd_layout),
 };
 
-static void escc_class_init(ObjectClass *klass, void *data)
+static void escc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/char/exynos4210_uart.c b/hw/char/exynos4210_uart.c
index a1a9a12caf..6521b4cedd 100644
--- a/hw/char/exynos4210_uart.c
+++ b/hw/char/exynos4210_uart.c
@@ -711,7 +711,7 @@ static const Property exynos4210_uart_properties[] = {
     DEFINE_PROP_UINT32("tx-size", Exynos4210UartState, tx.size, 16),
 };
 
-static void exynos4210_uart_class_init(ObjectClass *klass, void *data)
+static void exynos4210_uart_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/char/goldfish_tty.c b/hw/char/goldfish_tty.c
index f0891ffa4d..a37408adae 100644
--- a/hw/char/goldfish_tty.c
+++ b/hw/char/goldfish_tty.c
@@ -256,7 +256,7 @@ static void goldfish_tty_instance_init(Object *obj)
     sysbus_init_irq(dev, &s->irq);
 }
 
-static void goldfish_tty_class_init(ObjectClass *oc, void *data)
+static void goldfish_tty_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
diff --git a/hw/char/grlib_apbuart.c b/hw/char/grlib_apbuart.c
index db6bcdad41..81c26e3389 100644
--- a/hw/char/grlib_apbuart.c
+++ b/hw/char/grlib_apbuart.c
@@ -281,7 +281,7 @@ static const Property grlib_apbuart_properties[] = {
     DEFINE_PROP_CHR("chrdev", UART, chr),
 };
 
-static void grlib_apbuart_class_init(ObjectClass *klass, void *data)
+static void grlib_apbuart_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/char/ibex_uart.c b/hw/char/ibex_uart.c
index 392375ad55..d6f0d18c77 100644
--- a/hw/char/ibex_uart.c
+++ b/hw/char/ibex_uart.c
@@ -542,7 +542,7 @@ static void ibex_uart_realize(DeviceState *dev, Error **errp)
                              s, NULL, true);
 }
 
-static void ibex_uart_class_init(ObjectClass *klass, void *data)
+static void ibex_uart_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/char/imx_serial.c b/hw/char/imx_serial.c
index 6f14f8403a..509b0141d0 100644
--- a/hw/char/imx_serial.c
+++ b/hw/char/imx_serial.c
@@ -467,7 +467,7 @@ static const Property imx_serial_properties[] = {
     DEFINE_PROP_CHR("chardev", IMXSerialState, chr),
 };
 
-static void imx_serial_class_init(ObjectClass *klass, void *data)
+static void imx_serial_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/char/ipoctal232.c b/hw/char/ipoctal232.c
index a2879977fb..752c6c818a 100644
--- a/hw/char/ipoctal232.c
+++ b/hw/char/ipoctal232.c
@@ -569,7 +569,7 @@ static const Property ipoctal_properties[] = {
     DEFINE_PROP_CHR("chardev7", IPOctalState, ch[7].dev),
 };
 
-static void ipoctal_class_init(ObjectClass *klass, void *data)
+static void ipoctal_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     IPackDeviceClass *ic = IPACK_DEVICE_CLASS(klass);
diff --git a/hw/char/mcf_uart.c b/hw/char/mcf_uart.c
index 529c26be93..87bfcbebdc 100644
--- a/hw/char/mcf_uart.c
+++ b/hw/char/mcf_uart.c
@@ -322,7 +322,7 @@ static const Property mcf_uart_properties[] = {
     DEFINE_PROP_CHR("chardev", mcf_uart_state, chr),
 };
 
-static void mcf_uart_class_init(ObjectClass *oc, void *data)
+static void mcf_uart_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
diff --git a/hw/char/mchp_pfsoc_mmuart.c b/hw/char/mchp_pfsoc_mmuart.c
index 3c3224c05d..6149f9d204 100644
--- a/hw/char/mchp_pfsoc_mmuart.c
+++ b/hw/char/mchp_pfsoc_mmuart.c
@@ -121,7 +121,7 @@ static const VMStateDescription mchp_pfsoc_mmuart_vmstate = {
     }
 };
 
-static void mchp_pfsoc_mmuart_class_init(ObjectClass *oc, void *data)
+static void mchp_pfsoc_mmuart_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
diff --git a/hw/char/nrf51_uart.c b/hw/char/nrf51_uart.c
index 82a61ee95f..41d423446f 100644
--- a/hw/char/nrf51_uart.c
+++ b/hw/char/nrf51_uart.c
@@ -308,7 +308,7 @@ static const Property nrf51_uart_properties[] = {
     DEFINE_PROP_CHR("chardev", NRF51UARTState, chr),
 };
 
-static void nrf51_uart_class_init(ObjectClass *klass, void *data)
+static void nrf51_uart_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/char/parallel.c b/hw/char/parallel.c
index e1651d52a4..217ddaf2e3 100644
--- a/hw/char/parallel.c
+++ b/hw/char/parallel.c
@@ -610,7 +610,7 @@ static const Property parallel_isa_properties[] = {
     DEFINE_PROP_CHR("chardev",  ISAParallelState, state.chr),
 };
 
-static void parallel_isa_class_initfn(ObjectClass *klass, void *data)
+static void parallel_isa_class_initfn(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     AcpiDevAmlIfClass *adevc = ACPI_DEV_AML_IF_CLASS(klass);
diff --git a/hw/char/pl011.c b/hw/char/pl011.c
index 0e9ec1301d..01335d9437 100644
--- a/hw/char/pl011.c
+++ b/hw/char/pl011.c
@@ -669,7 +669,7 @@ static void pl011_reset(DeviceState *dev)
     pl011_reset_tx_fifo(s);
 }
 
-static void pl011_class_init(ObjectClass *oc, void *data)
+static void pl011_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
diff --git a/hw/char/renesas_sci.c b/hw/char/renesas_sci.c
index ea94494932..b9d0ed1c89 100644
--- a/hw/char/renesas_sci.c
+++ b/hw/char/renesas_sci.c
@@ -324,7 +324,7 @@ static const Property rsci_properties[] = {
     DEFINE_PROP_CHR("chardev", RSCIState, chr),
 };
 
-static void rsci_class_init(ObjectClass *klass, void *data)
+static void rsci_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/char/sclpconsole-lm.c b/hw/char/sclpconsole-lm.c
index ddb9a726d5..e9580aacba 100644
--- a/hw/char/sclpconsole-lm.c
+++ b/hw/char/sclpconsole-lm.c
@@ -339,7 +339,7 @@ static const Property console_properties[] = {
     DEFINE_PROP_BOOL("echo", SCLPConsoleLM, echo, true),
 };
 
-static void console_class_init(ObjectClass *klass, void *data)
+static void console_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     SCLPEventClass *ec = SCLP_EVENT_CLASS(klass);
diff --git a/hw/char/sclpconsole.c b/hw/char/sclpconsole.c
index 01233b933d..95e3045178 100644
--- a/hw/char/sclpconsole.c
+++ b/hw/char/sclpconsole.c
@@ -255,7 +255,7 @@ static const Property console_properties[] = {
     DEFINE_PROP_CHR("chardev", SCLPConsole, chr),
 };
 
-static void console_class_init(ObjectClass *klass, void *data)
+static void console_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     SCLPEventClass *ec = SCLP_EVENT_CLASS(klass);
diff --git a/hw/char/serial-isa.c b/hw/char/serial-isa.c
index 3d913891dc..fe7fb1625b 100644
--- a/hw/char/serial-isa.c
+++ b/hw/char/serial-isa.c
@@ -119,7 +119,7 @@ static const Property serial_isa_properties[] = {
     DEFINE_PROP_UINT32("irq",    ISASerialState, isairq,  -1),
 };
 
-static void serial_isa_class_initfn(ObjectClass *klass, void *data)
+static void serial_isa_class_initfn(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     AcpiDevAmlIfClass *adevc = ACPI_DEV_AML_IF_CLASS(klass);
diff --git a/hw/char/serial-mm.c b/hw/char/serial-mm.c
index 6338e7c0ba..13aba780ec 100644
--- a/hw/char/serial-mm.c
+++ b/hw/char/serial-mm.c
@@ -134,7 +134,7 @@ static const Property serial_mm_properties[] = {
     DEFINE_PROP_UINT8("endianness", SerialMM, endianness, DEVICE_NATIVE_ENDIAN),
 };
 
-static void serial_mm_class_init(ObjectClass *oc, void *data)
+static void serial_mm_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
diff --git a/hw/char/serial-pci-multi.c b/hw/char/serial-pci-multi.c
index 718ae25131..ee1c0f7dc4 100644
--- a/hw/char/serial-pci-multi.c
+++ b/hw/char/serial-pci-multi.c
@@ -144,7 +144,8 @@ static const Property multi_4x_serial_pci_properties[] = {
     DEFINE_PROP_UINT8("prog_if",  PCIMultiSerialState, prog_if, 0x02),
 };
 
-static void multi_2x_serial_pci_class_initfn(ObjectClass *klass, void *data)
+static void multi_2x_serial_pci_class_initfn(ObjectClass *klass,
+                                             const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *pc = PCI_DEVICE_CLASS(klass);
@@ -159,7 +160,8 @@ static void multi_2x_serial_pci_class_initfn(ObjectClass *klass, void *data)
     set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
 }
 
-static void multi_4x_serial_pci_class_initfn(ObjectClass *klass, void *data)
+static void multi_4x_serial_pci_class_initfn(ObjectClass *klass,
+                                             const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *pc = PCI_DEVICE_CLASS(klass);
diff --git a/hw/char/serial-pci.c b/hw/char/serial-pci.c
index 6659cef5d4..bd38c7428c 100644
--- a/hw/char/serial-pci.c
+++ b/hw/char/serial-pci.c
@@ -85,7 +85,7 @@ static const Property serial_pci_properties[] = {
     DEFINE_PROP_UINT8("prog_if",  PCISerialState, prog_if, 0x02),
 };
 
-static void serial_pci_class_initfn(ObjectClass *klass, void *data)
+static void serial_pci_class_initfn(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *pc = PCI_DEVICE_CLASS(klass);
diff --git a/hw/char/serial.c b/hw/char/serial.c
index 70044e14a0..03fec3fe75 100644
--- a/hw/char/serial.c
+++ b/hw/char/serial.c
@@ -970,7 +970,7 @@ static const Property serial_properties[] = {
     DEFINE_PROP_BOOL("wakeup", SerialState, wakeup, false),
 };
 
-static void serial_class_init(ObjectClass *klass, void* data)
+static void serial_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/char/sh_serial.c b/hw/char/sh_serial.c
index 41c8175a63..6abd80386f 100644
--- a/hw/char/sh_serial.c
+++ b/hw/char/sh_serial.c
@@ -450,7 +450,7 @@ static const Property sh_serial_properties[] = {
     DEFINE_PROP_UINT8("features", SHSerialState, feat, 0),
 };
 
-static void sh_serial_class_init(ObjectClass *oc, void *data)
+static void sh_serial_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
diff --git a/hw/char/shakti_uart.c b/hw/char/shakti_uart.c
index 09975d9d34..6e216edb0f 100644
--- a/hw/char/shakti_uart.c
+++ b/hw/char/shakti_uart.c
@@ -161,7 +161,7 @@ static const Property shakti_uart_properties[] = {
     DEFINE_PROP_CHR("chardev", ShaktiUartState, chr),
 };
 
-static void shakti_uart_class_init(ObjectClass *klass, void *data)
+static void shakti_uart_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     device_class_set_legacy_reset(dc, shakti_uart_reset);
diff --git a/hw/char/sifive_uart.c b/hw/char/sifive_uart.c
index b45e6c098c..0fc89e76d1 100644
--- a/hw/char/sifive_uart.c
+++ b/hw/char/sifive_uart.c
@@ -334,7 +334,7 @@ static const VMStateDescription vmstate_sifive_uart = {
 };
 
 
-static void sifive_uart_class_init(ObjectClass *oc, void *data)
+static void sifive_uart_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     ResettableClass *rc = RESETTABLE_CLASS(oc);
diff --git a/hw/char/spapr_vty.c b/hw/char/spapr_vty.c
index 6451d010ac..fc8ea604f8 100644
--- a/hw/char/spapr_vty.c
+++ b/hw/char/spapr_vty.c
@@ -182,7 +182,7 @@ static const VMStateDescription vmstate_spapr_vty = {
     },
 };
 
-static void spapr_vty_class_init(ObjectClass *klass, void *data)
+static void spapr_vty_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     SpaprVioDeviceClass *k = VIO_SPAPR_DEVICE_CLASS(klass);
diff --git a/hw/char/stm32f2xx_usart.c b/hw/char/stm32f2xx_usart.c
index 87882daa71..45c30643a7 100644
--- a/hw/char/stm32f2xx_usart.c
+++ b/hw/char/stm32f2xx_usart.c
@@ -220,7 +220,7 @@ static void stm32f2xx_usart_realize(DeviceState *dev, Error **errp)
                              s, NULL, true);
 }
 
-static void stm32f2xx_usart_class_init(ObjectClass *klass, void *data)
+static void stm32f2xx_usart_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/char/stm32l4x5_usart.c b/hw/char/stm32l4x5_usart.c
index bcc310bd97..afbe4bab29 100644
--- a/hw/char/stm32l4x5_usart.c
+++ b/hw/char/stm32l4x5_usart.c
@@ -594,7 +594,8 @@ static void stm32l4x5_usart_base_realize(DeviceState *dev, Error **errp)
                              s, NULL, true);
 }
 
-static void stm32l4x5_usart_base_class_init(ObjectClass *klass, void *data)
+static void stm32l4x5_usart_base_class_init(ObjectClass *klass,
+                                            const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     ResettableClass *rc = RESETTABLE_CLASS(klass);
@@ -605,21 +606,21 @@ static void stm32l4x5_usart_base_class_init(ObjectClass *klass, void *data)
     dc->vmsd = &vmstate_stm32l4x5_usart_base;
 }
 
-static void stm32l4x5_usart_class_init(ObjectClass *oc, void *data)
+static void stm32l4x5_usart_class_init(ObjectClass *oc, const void *data)
 {
     Stm32l4x5UsartBaseClass *subc = STM32L4X5_USART_BASE_CLASS(oc);
 
     subc->type = STM32L4x5_USART;
 }
 
-static void stm32l4x5_uart_class_init(ObjectClass *oc, void *data)
+static void stm32l4x5_uart_class_init(ObjectClass *oc, const void *data)
 {
     Stm32l4x5UsartBaseClass *subc = STM32L4X5_USART_BASE_CLASS(oc);
 
     subc->type = STM32L4x5_UART;
 }
 
-static void stm32l4x5_lpuart_class_init(ObjectClass *oc, void *data)
+static void stm32l4x5_lpuart_class_init(ObjectClass *oc, const void *data)
 {
     Stm32l4x5UsartBaseClass *subc = STM32L4X5_USART_BASE_CLASS(oc);
 
diff --git a/hw/char/terminal3270.c b/hw/char/terminal3270.c
index 04ee26dcbd..d950c17292 100644
--- a/hw/char/terminal3270.c
+++ b/hw/char/terminal3270.c
@@ -292,7 +292,7 @@ static const VMStateDescription terminal3270_vmstate = {
     .unmigratable = 1,
 };
 
-static void terminal_class_init(ObjectClass *klass, void *data)
+static void terminal_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     EmulatedCcw3270Class *ck = EMULATED_CCW_3270_CLASS(klass);
diff --git a/hw/char/virtio-console.c b/hw/char/virtio-console.c
index aa6d611a47..0932a3572b 100644
--- a/hw/char/virtio-console.c
+++ b/hw/char/virtio-console.c
@@ -261,7 +261,7 @@ static void virtconsole_unrealize(DeviceState *dev)
     }
 }
 
-static void virtconsole_class_init(ObjectClass *klass, void *data)
+static void virtconsole_class_init(ObjectClass *klass, const void *data)
 {
     VirtIOSerialPortClass *k = VIRTIO_SERIAL_PORT_CLASS(klass);
 
@@ -278,7 +278,7 @@ static const Property virtserialport_properties[] = {
     DEFINE_PROP_CHR("chardev", VirtConsole, chr),
 };
 
-static void virtserialport_class_init(ObjectClass *klass, void *data)
+static void virtserialport_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtIOSerialPortClass *k = VIRTIO_SERIAL_PORT_CLASS(klass);
diff --git a/hw/char/virtio-serial-bus.c b/hw/char/virtio-serial-bus.c
index b6d2743a9c..00572873d2 100644
--- a/hw/char/virtio-serial-bus.c
+++ b/hw/char/virtio-serial-bus.c
@@ -840,7 +840,7 @@ static const Property virtser_props[] = {
     DEFINE_PROP_STRING("name", VirtIOSerialPort, name),
 };
 
-static void virtser_bus_class_init(ObjectClass *klass, void *data)
+static void virtser_bus_class_init(ObjectClass *klass, const void *data)
 {
     BusClass *k = BUS_CLASS(klass);
     k->print_dev = virtser_bus_dev_print;
@@ -1092,7 +1092,7 @@ static void virtio_serial_device_realize(DeviceState *dev, Error **errp)
     QLIST_INSERT_HEAD(&vserdevices.devices, vser, next);
 }
 
-static void virtio_serial_port_class_init(ObjectClass *klass, void *data)
+static void virtio_serial_port_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *k = DEVICE_CLASS(klass);
 
@@ -1159,7 +1159,7 @@ static const Property virtio_serial_properties[] = {
                       VIRTIO_CONSOLE_F_EMERG_WRITE, true),
 };
 
-static void virtio_serial_class_init(ObjectClass *klass, void *data)
+static void virtio_serial_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
diff --git a/hw/char/xen_console.c b/hw/char/xen_console.c
index d03c188d1d..9c34a554bf 100644
--- a/hw/char/xen_console.c
+++ b/hw/char/xen_console.c
@@ -492,7 +492,7 @@ static const Property xen_console_properties[] = {
     DEFINE_PROP_INT32("idx", XenConsole, dev, -1),
 };
 
-static void xen_console_class_init(ObjectClass *class, void *data)
+static void xen_console_class_init(ObjectClass *class, const void *data)
 {
     DeviceClass *dev_class = DEVICE_CLASS(class);
     XenDeviceClass *xendev_class = XEN_DEVICE_CLASS(class);
diff --git a/hw/char/xilinx_uartlite.c b/hw/char/xilinx_uartlite.c
index 4037c937ee..8008171eea 100644
--- a/hw/char/xilinx_uartlite.c
+++ b/hw/char/xilinx_uartlite.c
@@ -241,7 +241,7 @@ static void xilinx_uartlite_init(Object *obj)
     sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
 }
 
-static void xilinx_uartlite_class_init(ObjectClass *klass, void *data)
+static void xilinx_uartlite_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/core/bus.c b/hw/core/bus.c
index b9d89495cd..c3b431a014 100644
--- a/hw/core/bus.c
+++ b/hw/core/bus.c
@@ -232,7 +232,7 @@ static char *default_bus_get_fw_dev_path(DeviceState *dev)
     return g_strdup(object_get_typename(OBJECT(dev)));
 }
 
-static void bus_class_init(ObjectClass *class, void *data)
+static void bus_class_init(ObjectClass *class, const void *data)
 {
     BusClass *bc = BUS_CLASS(class);
     ResettableClass *rc = RESETTABLE_CLASS(class);
diff --git a/hw/core/clock.c b/hw/core/clock.c
index a81f888e62..9c906761e1 100644
--- a/hw/core/clock.c
+++ b/hw/core/clock.c
@@ -206,7 +206,7 @@ static void clock_finalizefn(Object *obj)
     g_free(clk->canonical_path);
 }
 
-static void clock_class_init(ObjectClass *klass, void *data)
+static void clock_class_init(ObjectClass *klass, const void *data)
 {
     klass->unparent = clock_unparent;
 }
diff --git a/hw/core/cpu-common.c b/hw/core/cpu-common.c
index 9064dd24f8..1fb6ea3892 100644
--- a/hw/core/cpu-common.c
+++ b/hw/core/cpu-common.c
@@ -320,7 +320,7 @@ static int64_t cpu_common_get_arch_id(CPUState *cpu)
     return cpu->cpu_index;
 }
 
-static void cpu_common_class_init(ObjectClass *klass, void *data)
+static void cpu_common_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     ResettableClass *rc = RESETTABLE_CLASS(klass);
diff --git a/hw/core/generic-loader.c b/hw/core/generic-loader.c
index d3a426a1a2..e72bbde2a2 100644
--- a/hw/core/generic-loader.c
+++ b/hw/core/generic-loader.c
@@ -182,7 +182,7 @@ static const Property generic_loader_props[] = {
     DEFINE_PROP_STRING("file", GenericLoaderState, file),
 };
 
-static void generic_loader_class_init(ObjectClass *klass, void *data)
+static void generic_loader_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/core/guest-loader.c b/hw/core/guest-loader.c
index 76271df9f5..3db89d7a2e 100644
--- a/hw/core/guest-loader.c
+++ b/hw/core/guest-loader.c
@@ -118,7 +118,7 @@ static const Property guest_loader_props[] = {
     DEFINE_PROP_STRING("initrd", GuestLoaderState, initrd),
 };
 
-static void guest_loader_class_init(ObjectClass *klass, void *data)
+static void guest_loader_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/core/machine.c b/hw/core/machine.c
index bbff84855a..ed01798d37 100644
--- a/hw/core/machine.c
+++ b/hw/core/machine.c
@@ -1100,7 +1100,7 @@ out:
     return r;
 }
 
-static void machine_class_init(ObjectClass *oc, void *data)
+static void machine_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
 
diff --git a/hw/core/or-irq.c b/hw/core/or-irq.c
index 4d0d3cabf1..3942c70993 100644
--- a/hw/core/or-irq.c
+++ b/hw/core/or-irq.c
@@ -119,7 +119,7 @@ static const Property or_irq_properties[] = {
     DEFINE_PROP_UINT16("num-lines", OrIRQState, num_lines, 1),
 };
 
-static void or_irq_class_init(ObjectClass *klass, void *data)
+static void or_irq_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/core/platform-bus.c b/hw/core/platform-bus.c
index 1d00c4d36d..6950063de4 100644
--- a/hw/core/platform-bus.c
+++ b/hw/core/platform-bus.c
@@ -209,7 +209,7 @@ static const Property platform_bus_properties[] = {
     DEFINE_PROP_UINT32("mmio_size", PlatformBusDevice, mmio_size, 0),
 };
 
-static void platform_bus_class_init(ObjectClass *klass, void *data)
+static void platform_bus_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/core/qdev.c b/hw/core/qdev.c
index 1e0f47cc84..4a3760c101 100644
--- a/hw/core/qdev.c
+++ b/hw/core/qdev.c
@@ -731,7 +731,7 @@ device_vmstate_if_get_id(VMStateIf *obj)
     return qdev_get_dev_path(dev);
 }
 
-static void device_class_init(ObjectClass *class, void *data)
+static void device_class_init(ObjectClass *class, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(class);
     VMStateIfClass *vc = VMSTATE_IF_CLASS(class);
diff --git a/hw/core/register.c b/hw/core/register.c
index 95b0150c0a..8f63d9f227 100644
--- a/hw/core/register.c
+++ b/hw/core/register.c
@@ -319,7 +319,7 @@ void register_finalize_block(RegisterInfoArray *r_array)
     g_free(r_array);
 }
 
-static void register_class_init(ObjectClass *oc, void *data)
+static void register_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
diff --git a/hw/core/reset.c b/hw/core/reset.c
index 8a3e0e518f..65f82fa43d 100644
--- a/hw/core/reset.c
+++ b/hw/core/reset.c
@@ -84,7 +84,7 @@ static void legacy_reset_finalize(Object *obj)
 {
 }
 
-static void legacy_reset_class_init(ObjectClass *klass, void *data)
+static void legacy_reset_class_init(ObjectClass *klass, const void *data)
 {
     ResettableClass *rc = RESETTABLE_CLASS(klass);
 
diff --git a/hw/core/resetcontainer.c b/hw/core/resetcontainer.c
index e4ece68e83..5ff17002e7 100644
--- a/hw/core/resetcontainer.c
+++ b/hw/core/resetcontainer.c
@@ -68,7 +68,8 @@ static void resettable_container_finalize(Object *obj)
 {
 }
 
-static void resettable_container_class_init(ObjectClass *klass, void *data)
+static void resettable_container_class_init(ObjectClass *klass,
+                                            const void *data)
 {
     ResettableClass *rc = RESETTABLE_CLASS(klass);
 
diff --git a/hw/core/split-irq.c b/hw/core/split-irq.c
index fc12274811..f8b48750c5 100644
--- a/hw/core/split-irq.c
+++ b/hw/core/split-irq.c
@@ -63,7 +63,7 @@ static const Property split_irq_properties[] = {
     DEFINE_PROP_UINT16("num-lines", SplitIRQ, num_lines, 1),
 };
 
-static void split_irq_class_init(ObjectClass *klass, void *data)
+static void split_irq_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/core/sysbus.c b/hw/core/sysbus.c
index 6eb4c0f15a..e71367adfb 100644
--- a/hw/core/sysbus.c
+++ b/hw/core/sysbus.c
@@ -71,7 +71,7 @@ void foreach_dynamic_sysbus_device(FindSysbusDeviceFunc *func, void *opaque)
 }
 
 
-static void system_bus_class_init(ObjectClass *klass, void *data)
+static void system_bus_class_init(ObjectClass *klass, const void *data)
 {
     BusClass *k = BUS_CLASS(klass);
 
@@ -280,7 +280,7 @@ static char *sysbus_get_fw_dev_path(DeviceState *dev)
     return g_strdup(qdev_fw_name(dev));
 }
 
-static void sysbus_device_class_init(ObjectClass *klass, void *data)
+static void sysbus_device_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *k = DEVICE_CLASS(klass);
     k->realize = sysbus_device_realize;
@@ -320,7 +320,8 @@ BusState *sysbus_get_default(void)
     return main_system_bus;
 }
 
-static void dynamic_sysbus_device_class_init(ObjectClass *klass, void *data)
+static void dynamic_sysbus_device_class_init(ObjectClass *klass,
+                                             const void *data)
 {
     DeviceClass *k = DEVICE_CLASS(klass);
 
diff --git a/hw/cpu/a15mpcore.c b/hw/cpu/a15mpcore.c
index 676f65a0af..bd36dd94d4 100644
--- a/hw/cpu/a15mpcore.c
+++ b/hw/cpu/a15mpcore.c
@@ -161,7 +161,7 @@ static const Property a15mp_priv_properties[] = {
     DEFINE_PROP_UINT32("num-irq", A15MPPrivState, num_irq, 0),
 };
 
-static void a15mp_priv_class_init(ObjectClass *klass, void *data)
+static void a15mp_priv_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/cpu/a9mpcore.c b/hw/cpu/a9mpcore.c
index 1b9f2bef93..64bebbd19c 100644
--- a/hw/cpu/a9mpcore.c
+++ b/hw/cpu/a9mpcore.c
@@ -175,7 +175,7 @@ static const Property a9mp_priv_properties[] = {
     DEFINE_PROP_UINT32("num-irq", A9MPPrivState, num_irq, 0),
 };
 
-static void a9mp_priv_class_init(ObjectClass *klass, void *data)
+static void a9mp_priv_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/cpu/arm11mpcore.c b/hw/cpu/arm11mpcore.c
index b56bee6d54..01772e7f77 100644
--- a/hw/cpu/arm11mpcore.c
+++ b/hw/cpu/arm11mpcore.c
@@ -144,7 +144,7 @@ static const Property mpcore_priv_properties[] = {
     DEFINE_PROP_UINT32("num-irq", ARM11MPCorePriveState, num_irq, 64),
 };
 
-static void mpcore_priv_class_init(ObjectClass *klass, void *data)
+static void mpcore_priv_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/cpu/cluster.c b/hw/cpu/cluster.c
index 9da5221f88..ef3b3d1e94 100644
--- a/hw/cpu/cluster.c
+++ b/hw/cpu/cluster.c
@@ -72,7 +72,7 @@ static void cpu_cluster_realize(DeviceState *dev, Error **errp)
     assert(cbdata.cpu_count > 0);
 }
 
-static void cpu_cluster_class_init(ObjectClass *klass, void *data)
+static void cpu_cluster_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/cpu/core.c b/hw/cpu/core.c
index 495a5c30ff..5cb2e9a7f5 100644
--- a/hw/cpu/core.c
+++ b/hw/cpu/core.c
@@ -77,7 +77,7 @@ static void cpu_core_instance_init(Object *obj)
     }
 }
 
-static void cpu_core_class_init(ObjectClass *oc, void *data)
+static void cpu_core_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
diff --git a/hw/cpu/realview_mpcore.c b/hw/cpu/realview_mpcore.c
index b140888618..099b71a9ef 100644
--- a/hw/cpu/realview_mpcore.c
+++ b/hw/cpu/realview_mpcore.c
@@ -107,7 +107,7 @@ static void mpcore_rirq_init(Object *obj)
     }
 }
 
-static void mpcore_rirq_class_init(ObjectClass *klass, void *data)
+static void mpcore_rirq_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/cxl/switch-mailbox-cci.c b/hw/cxl/switch-mailbox-cci.c
index 833b824619..b92bbeb16e 100644
--- a/hw/cxl/switch-mailbox-cci.c
+++ b/hw/cxl/switch-mailbox-cci.c
@@ -72,7 +72,7 @@ static const Property cxl_switch_cci_props[] = {
                      target, TYPE_CXL_USP, PCIDevice *),
 };
 
-static void cswmbcci_class_init(ObjectClass *oc, void *data)
+static void cswmbcci_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     PCIDeviceClass *pc = PCI_DEVICE_CLASS(oc);
diff --git a/hw/display/apple-gfx-mmio.m b/hw/display/apple-gfx-mmio.m
index b2e0e7a30f..b0b6e2993e 100644
--- a/hw/display/apple-gfx-mmio.m
+++ b/hw/display/apple-gfx-mmio.m
@@ -261,7 +261,7 @@ static const Property apple_gfx_mmio_properties[] = {
                       qdev_prop_apple_gfx_display_mode, AppleGFXDisplayMode),
 };
 
-static void apple_gfx_mmio_class_init(ObjectClass *klass, void *data)
+static void apple_gfx_mmio_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     ResettableClass *rc = RESETTABLE_CLASS(klass);
diff --git a/hw/display/apple-gfx-pci.m b/hw/display/apple-gfx-pci.m
index b939bb9b23..2f0d24f7fe 100644
--- a/hw/display/apple-gfx-pci.m
+++ b/hw/display/apple-gfx-pci.m
@@ -121,7 +121,7 @@ static const Property apple_gfx_pci_properties[] = {
                       qdev_prop_apple_gfx_display_mode, AppleGFXDisplayMode),
 };
 
-static void apple_gfx_pci_class_init(ObjectClass *klass, void *data)
+static void apple_gfx_pci_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *pci = PCI_DEVICE_CLASS(klass);
diff --git a/hw/display/artist.c b/hw/display/artist.c
index f24c1d83dd..3fafc8a222 100644
--- a/hw/display/artist.c
+++ b/hw/display/artist.c
@@ -1487,7 +1487,7 @@ static void artist_reset(DeviceState *qdev)
 {
 }
 
-static void artist_class_init(ObjectClass *klass, void *data)
+static void artist_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/display/ati.c b/hw/display/ati.c
index 864fa4fc2c..4e88d09943 100644
--- a/hw/display/ati.c
+++ b/hw/display/ati.c
@@ -1049,7 +1049,7 @@ static const Property ati_vga_properties[] = {
     DEFINE_PROP_UINT8("x-pixman", ATIVGAState, use_pixman, DEFAULT_X_PIXMAN),
 };
 
-static void ati_vga_class_init(ObjectClass *klass, void *data)
+static void ati_vga_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
diff --git a/hw/display/bcm2835_fb.c b/hw/display/bcm2835_fb.c
index a5bded5156..820e67ac8b 100644
--- a/hw/display/bcm2835_fb.c
+++ b/hw/display/bcm2835_fb.c
@@ -442,7 +442,7 @@ static const Property bcm2835_fb_props[] = {
                        initial_config.alpha, 2), /* alpha ignored */
 };
 
-static void bcm2835_fb_class_init(ObjectClass *klass, void *data)
+static void bcm2835_fb_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/display/bochs-display.c b/hw/display/bochs-display.c
index 086f7a0f06..1d329fc9cc 100644
--- a/hw/display/bochs-display.c
+++ b/hw/display/bochs-display.c
@@ -351,7 +351,7 @@ static const Property bochs_display_properties[] = {
     DEFINE_EDID_PROPERTIES(BochsDisplayState, edid_info),
 };
 
-static void bochs_display_class_init(ObjectClass *klass, void *data)
+static void bochs_display_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
diff --git a/hw/display/cg3.c b/hw/display/cg3.c
index 3f971d875f..daeef15217 100644
--- a/hw/display/cg3.c
+++ b/hw/display/cg3.c
@@ -368,7 +368,7 @@ static const Property cg3_properties[] = {
     DEFINE_PROP_UINT16("depth",        CG3State, depth,     -1),
 };
 
-static void cg3_class_init(ObjectClass *klass, void *data)
+static void cg3_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c
index 76124d3656..4e5ae04af0 100644
--- a/hw/display/cirrus_vga.c
+++ b/hw/display/cirrus_vga.c
@@ -2991,7 +2991,7 @@ static const Property pci_vga_cirrus_properties[] = {
                      cirrus_vga.vga.global_vmstate, false),
 };
 
-static void cirrus_vga_class_init(ObjectClass *klass, void *data)
+static void cirrus_vga_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
diff --git a/hw/display/cirrus_vga_isa.c b/hw/display/cirrus_vga_isa.c
index 60b7fd20f1..4b55c48eff 100644
--- a/hw/display/cirrus_vga_isa.c
+++ b/hw/display/cirrus_vga_isa.c
@@ -76,7 +76,7 @@ static const Property isa_cirrus_vga_properties[] = {
                      cirrus_vga.enable_blitter, true),
 };
 
-static void isa_cirrus_vga_class_init(ObjectClass *klass, void *data)
+static void isa_cirrus_vga_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/display/dm163.c b/hw/display/dm163.c
index f6f0ec0c63..f8340d8275 100644
--- a/hw/display/dm163.c
+++ b/hw/display/dm163.c
@@ -325,7 +325,7 @@ static void dm163_realize(DeviceState *dev, Error **errp)
                         RGB_MATRIX_NUM_ROWS * LED_SQUARE_SIZE);
 }
 
-static void dm163_class_init(ObjectClass *klass, void *data)
+static void dm163_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     ResettableClass *rc = RESETTABLE_CLASS(klass);
diff --git a/hw/display/dpcd.c b/hw/display/dpcd.c
index 108faf7887..a157dc64e7 100644
--- a/hw/display/dpcd.c
+++ b/hw/display/dpcd.c
@@ -141,7 +141,7 @@ static const VMStateDescription vmstate_dpcd = {
     }
 };
 
-static void dpcd_class_init(ObjectClass *oc, void *data)
+static void dpcd_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
diff --git a/hw/display/exynos4210_fimd.c b/hw/display/exynos4210_fimd.c
index 04c864a308..c61e0280a7 100644
--- a/hw/display/exynos4210_fimd.c
+++ b/hw/display/exynos4210_fimd.c
@@ -1958,7 +1958,7 @@ static void exynos4210_fimd_realize(DeviceState *dev, Error **errp)
     s->console = graphic_console_init(dev, 0, &exynos4210_fimd_ops, s);
 }
 
-static void exynos4210_fimd_class_init(ObjectClass *klass, void *data)
+static void exynos4210_fimd_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/display/g364fb.c b/hw/display/g364fb.c
index 30b5ea67f2..a6ddc21d3e 100644
--- a/hw/display/g364fb.c
+++ b/hw/display/g364fb.c
@@ -526,7 +526,7 @@ static const VMStateDescription vmstate_g364fb_sysbus = {
     }
 };
 
-static void g364fb_sysbus_class_init(ObjectClass *klass, void *data)
+static void g364fb_sysbus_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/display/i2c-ddc.c b/hw/display/i2c-ddc.c
index d8ab9eee40..2adfc1a147 100644
--- a/hw/display/i2c-ddc.c
+++ b/hw/display/i2c-ddc.c
@@ -99,7 +99,7 @@ static const Property i2c_ddc_properties[] = {
     DEFINE_EDID_PROPERTIES(I2CDDCState, edid_info),
 };
 
-static void i2c_ddc_class_init(ObjectClass *oc, void *data)
+static void i2c_ddc_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     I2CSlaveClass *isc = I2C_SLAVE_CLASS(oc);
diff --git a/hw/display/jazz_led.c b/hw/display/jazz_led.c
index 1448488d06..90e82b58be 100644
--- a/hw/display/jazz_led.c
+++ b/hw/display/jazz_led.c
@@ -294,7 +294,7 @@ static void jazz_led_reset(DeviceState *d)
     qemu_console_resize(s->con, 60, 80);
 }
 
-static void jazz_led_class_init(ObjectClass *klass, void *data)
+static void jazz_led_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/display/macfb.c b/hw/display/macfb.c
index b08eb06cbd..574d667173 100644
--- a/hw/display/macfb.c
+++ b/hw/display/macfb.c
@@ -793,7 +793,7 @@ static const VMStateDescription vmstate_macfb_nubus = {
     }
 };
 
-static void macfb_sysbus_class_init(ObjectClass *klass, void *data)
+static void macfb_sysbus_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -804,7 +804,7 @@ static void macfb_sysbus_class_init(ObjectClass *klass, void *data)
     device_class_set_props(dc, macfb_sysbus_properties);
 }
 
-static void macfb_nubus_class_init(ObjectClass *klass, void *data)
+static void macfb_nubus_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     MacfbNubusDeviceClass *ndc = NUBUS_MACFB_CLASS(klass);
diff --git a/hw/display/next-fb.c b/hw/display/next-fb.c
index 8446ff3c00..ec81b766a7 100644
--- a/hw/display/next-fb.c
+++ b/hw/display/next-fb.c
@@ -119,7 +119,7 @@ static void nextfb_realize(DeviceState *dev, Error **errp)
     qemu_console_resize(s->con, s->cols, s->rows);
 }
 
-static void nextfb_class_init(ObjectClass *oc, void *data)
+static void nextfb_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
diff --git a/hw/display/pl110.c b/hw/display/pl110.c
index 4d4f477b94..09c3c59e0e 100644
--- a/hw/display/pl110.c
+++ b/hw/display/pl110.c
@@ -580,7 +580,7 @@ static void pl111_init(Object *obj)
     s->version = VERSION_PL111;
 }
 
-static void pl110_class_init(ObjectClass *klass, void *data)
+static void pl110_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/display/qxl.c b/hw/display/qxl.c
index da14da5209..6c820bcdb5 100644
--- a/hw/display/qxl.c
+++ b/hw/display/qxl.c
@@ -2498,7 +2498,7 @@ static const Property qxl_properties[] = {
         DEFINE_PROP_BOOL("global-vmstate", PCIQXLDevice, vga.global_vmstate, false),
 };
 
-static void qxl_pci_class_init(ObjectClass *klass, void *data)
+static void qxl_pci_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
@@ -2523,7 +2523,7 @@ static const TypeInfo qxl_pci_type_info = {
     },
 };
 
-static void qxl_primary_class_init(ObjectClass *klass, void *data)
+static void qxl_primary_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
@@ -2543,7 +2543,7 @@ static const TypeInfo qxl_primary_info = {
 module_obj("qxl-vga");
 module_kconfig(QXL);
 
-static void qxl_secondary_class_init(ObjectClass *klass, void *data)
+static void qxl_secondary_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
diff --git a/hw/display/ramfb-standalone.c b/hw/display/ramfb-standalone.c
index 1be106b57f..08f2d5db4e 100644
--- a/hw/display/ramfb-standalone.c
+++ b/hw/display/ramfb-standalone.c
@@ -64,7 +64,7 @@ static const Property ramfb_properties[] = {
     DEFINE_PROP_BOOL("x-migrate", RAMFBStandaloneState, migrate,  true),
 };
 
-static void ramfb_class_initfn(ObjectClass *klass, void *data)
+static void ramfb_class_initfn(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/display/sii9022.c b/hw/display/sii9022.c
index 16f8cb487c..d00d3e9fc5 100644
--- a/hw/display/sii9022.c
+++ b/hw/display/sii9022.c
@@ -167,7 +167,7 @@ static void sii9022_realize(DeviceState *dev, Error **errp)
     i2c_slave_create_simple(bus, TYPE_I2CDDC, 0x50);
 }
 
-static void sii9022_class_init(ObjectClass *klass, void *data)
+static void sii9022_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     I2CSlaveClass *k = I2C_SLAVE_CLASS(klass);
diff --git a/hw/display/sm501.c b/hw/display/sm501.c
index 09edcf86f8..dcff1e978e 100644
--- a/hw/display/sm501.c
+++ b/hw/display/sm501.c
@@ -2077,7 +2077,7 @@ static const VMStateDescription vmstate_sm501_sysbus = {
      }
 };
 
-static void sm501_sysbus_class_init(ObjectClass *klass, void *data)
+static void sm501_sysbus_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -2167,7 +2167,7 @@ static const VMStateDescription vmstate_sm501_pci = {
      }
 };
 
-static void sm501_pci_class_init(ObjectClass *klass, void *data)
+static void sm501_pci_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
diff --git a/hw/display/ssd0303.c b/hw/display/ssd0303.c
index e292cff44e..87781438cd 100644
--- a/hw/display/ssd0303.c
+++ b/hw/display/ssd0303.c
@@ -311,7 +311,7 @@ static void ssd0303_realize(DeviceState *dev, Error **errp)
     qemu_console_resize(s->con, 96 * MAGNIFY, 16 * MAGNIFY);
 }
 
-static void ssd0303_class_init(ObjectClass *klass, void *data)
+static void ssd0303_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     I2CSlaveClass *k = I2C_SLAVE_CLASS(klass);
diff --git a/hw/display/ssd0323.c b/hw/display/ssd0323.c
index 96cf0dc662..af5ff4fecd 100644
--- a/hw/display/ssd0323.c
+++ b/hw/display/ssd0323.c
@@ -361,7 +361,7 @@ static void ssd0323_realize(SSIPeripheral *d, Error **errp)
     qdev_init_gpio_in(dev, ssd0323_cd, 1);
 }
 
-static void ssd0323_class_init(ObjectClass *klass, void *data)
+static void ssd0323_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     SSIPeripheralClass *k = SSI_PERIPHERAL_CLASS(klass);
diff --git a/hw/display/tcx.c b/hw/display/tcx.c
index 5968d33e48..4853c5e142 100644
--- a/hw/display/tcx.c
+++ b/hw/display/tcx.c
@@ -885,7 +885,7 @@ static const Property tcx_properties[] = {
     DEFINE_PROP_UINT16("depth",    TCXState, depth,     -1),
 };
 
-static void tcx_class_init(ObjectClass *klass, void *data)
+static void tcx_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/display/vga-isa.c b/hw/display/vga-isa.c
index 2920628f78..3618913b3b 100644
--- a/hw/display/vga-isa.c
+++ b/hw/display/vga-isa.c
@@ -92,7 +92,7 @@ static const Property vga_isa_properties[] = {
     DEFINE_PROP_UINT32("vgamem_mb", ISAVGAState, state.vram_size_mb, 8),
 };
 
-static void vga_isa_class_initfn(ObjectClass *klass, void *data)
+static void vga_isa_class_initfn(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/display/vga-mmio.c b/hw/display/vga-mmio.c
index 1e0c2dbf74..33263856b7 100644
--- a/hw/display/vga-mmio.c
+++ b/hw/display/vga-mmio.c
@@ -116,7 +116,7 @@ static const Property vga_mmio_properties[] = {
     DEFINE_PROP_UINT32("vgamem_mb", VGAMmioState, vga.vram_size_mb, 8),
 };
 
-static void vga_mmio_class_initfn(ObjectClass *klass, void *data)
+static void vga_mmio_class_initfn(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/display/vga-pci.c b/hw/display/vga-pci.c
index dd084c20b1..a860197274 100644
--- a/hw/display/vga-pci.c
+++ b/hw/display/vga-pci.c
@@ -350,7 +350,7 @@ static const Property secondary_pci_properties[] = {
     DEFINE_EDID_PROPERTIES(PCIVGAState, edid_info),
 };
 
-static void vga_pci_class_init(ObjectClass *klass, void *data)
+static void vga_pci_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
@@ -376,7 +376,7 @@ static const TypeInfo vga_pci_type_info = {
     },
 };
 
-static void vga_class_init(ObjectClass *klass, void *data)
+static void vga_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
@@ -392,7 +392,7 @@ static void vga_class_init(ObjectClass *klass, void *data)
                                    vga_get_big_endian_fb, vga_set_big_endian_fb);
 }
 
-static void secondary_class_init(ObjectClass *klass, void *data)
+static void secondary_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
diff --git a/hw/display/vhost-user-gpu.c b/hw/display/vhost-user-gpu.c
index 2aed6243f6..06c4e7e190 100644
--- a/hw/display/vhost-user-gpu.c
+++ b/hw/display/vhost-user-gpu.c
@@ -658,7 +658,7 @@ static const Property vhost_user_gpu_properties[] = {
 };
 
 static void
-vhost_user_gpu_class_init(ObjectClass *klass, void *data)
+vhost_user_gpu_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
diff --git a/hw/display/virtio-gpu-base.c b/hw/display/virtio-gpu-base.c
index 321a6f4998..9eb806b71f 100644
--- a/hw/display/virtio-gpu-base.c
+++ b/hw/display/virtio-gpu-base.c
@@ -262,7 +262,7 @@ virtio_gpu_base_device_unrealize(DeviceState *qdev)
 }
 
 static void
-virtio_gpu_base_class_init(ObjectClass *klass, void *data)
+virtio_gpu_base_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
diff --git a/hw/display/virtio-gpu-gl.c b/hw/display/virtio-gpu-gl.c
index 683fad3bf8..c06a078fb3 100644
--- a/hw/display/virtio-gpu-gl.c
+++ b/hw/display/virtio-gpu-gl.c
@@ -182,7 +182,7 @@ static void virtio_gpu_gl_device_unrealize(DeviceState *qdev)
     g_array_unref(g->capset_ids);
 }
 
-static void virtio_gpu_gl_class_init(ObjectClass *klass, void *data)
+static void virtio_gpu_gl_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
diff --git a/hw/display/virtio-gpu-pci.c b/hw/display/virtio-gpu-pci.c
index 6d789701a3..c0d71b6254 100644
--- a/hw/display/virtio-gpu-pci.c
+++ b/hw/display/virtio-gpu-pci.c
@@ -57,7 +57,7 @@ static void virtio_gpu_pci_base_realize(VirtIOPCIProxy *vpci_dev, Error **errp)
     }
 }
 
-static void virtio_gpu_pci_base_class_init(ObjectClass *klass, void *data)
+static void virtio_gpu_pci_base_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtioPCIClass *k = VIRTIO_PCI_CLASS(klass);
diff --git a/hw/display/virtio-gpu-rutabaga.c b/hw/display/virtio-gpu-rutabaga.c
index f6eb29472e..ed5ae52acb 100644
--- a/hw/display/virtio-gpu-rutabaga.c
+++ b/hw/display/virtio-gpu-rutabaga.c
@@ -1110,7 +1110,7 @@ static const Property virtio_gpu_rutabaga_properties[] = {
     DEFINE_PROP_STRING("wsi", VirtIOGPURutabaga, wsi),
 };
 
-static void virtio_gpu_rutabaga_class_init(ObjectClass *klass, void *data)
+static void virtio_gpu_rutabaga_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c
index 11a7a85750..0a1a625b0e 100644
--- a/hw/display/virtio-gpu.c
+++ b/hw/display/virtio-gpu.c
@@ -1684,7 +1684,7 @@ static const Property virtio_gpu_properties[] = {
     DEFINE_PROP_UINT8("x-scanout-vmstate-version", VirtIOGPU, scanout_vmstate_version, 2),
 };
 
-static void virtio_gpu_class_init(ObjectClass *klass, void *data)
+static void virtio_gpu_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
diff --git a/hw/display/virtio-vga.c b/hw/display/virtio-vga.c
index fefbdb61e1..40e60f70fc 100644
--- a/hw/display/virtio-vga.c
+++ b/hw/display/virtio-vga.c
@@ -213,7 +213,7 @@ static const Property virtio_vga_base_properties[] = {
     DEFINE_VIRTIO_GPU_PCI_PROPERTIES(VirtIOPCIProxy),
 };
 
-static void virtio_vga_base_class_init(ObjectClass *klass, void *data)
+static void virtio_vga_base_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtioPCIClass *k = VIRTIO_PCI_CLASS(klass);
diff --git a/hw/display/vmware_vga.c b/hw/display/vmware_vga.c
index 2dd661e3c1..7777deb17d 100644
--- a/hw/display/vmware_vga.c
+++ b/hw/display/vmware_vga.c
@@ -1339,7 +1339,7 @@ static const Property vga_vmware_properties[] = {
                      chip.vga.global_vmstate, false),
 };
 
-static void vmsvga_class_init(ObjectClass *klass, void *data)
+static void vmsvga_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
diff --git a/hw/display/xlnx_dp.c b/hw/display/xlnx_dp.c
index 1272da0133..7c980ee642 100644
--- a/hw/display/xlnx_dp.c
+++ b/hw/display/xlnx_dp.c
@@ -1391,7 +1391,7 @@ static const Property xlnx_dp_device_properties[] = {
     DEFINE_AUDIO_PROPERTIES(XlnxDPState, aud_card),
 };
 
-static void xlnx_dp_class_init(ObjectClass *oc, void *data)
+static void xlnx_dp_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
diff --git a/hw/dma/bcm2835_dma.c b/hw/dma/bcm2835_dma.c
index 9b2fca2c7c..a2771ddcb5 100644
--- a/hw/dma/bcm2835_dma.c
+++ b/hw/dma/bcm2835_dma.c
@@ -385,7 +385,7 @@ static void bcm2835_dma_realize(DeviceState *dev, Error **errp)
     bcm2835_dma_reset(dev);
 }
 
-static void bcm2835_dma_class_init(ObjectClass *klass, void *data)
+static void bcm2835_dma_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/dma/i82374.c b/hw/dma/i82374.c
index 0bf69ef399..e226eda6d1 100644
--- a/hw/dma/i82374.c
+++ b/hw/dma/i82374.c
@@ -143,7 +143,7 @@ static const Property i82374_properties[] = {
     DEFINE_PROP_UINT32("iobase", I82374State, iobase, 0x400),
 };
 
-static void i82374_class_init(ObjectClass *klass, void *data)
+static void i82374_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     
diff --git a/hw/dma/i8257.c b/hw/dma/i8257.c
index 74c38d2ee8..1d67e50536 100644
--- a/hw/dma/i8257.c
+++ b/hw/dma/i8257.c
@@ -592,7 +592,7 @@ static const Property i8257_properties[] = {
     DEFINE_PROP_INT32("dshift", I8257State, dshift, 0),
 };
 
-static void i8257_class_init(ObjectClass *klass, void *data)
+static void i8257_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     IsaDmaClass *idc = ISADMA_CLASS(klass);
diff --git a/hw/dma/pl080.c b/hw/dma/pl080.c
index 8a9b073b24..277d934322 100644
--- a/hw/dma/pl080.c
+++ b/hw/dma/pl080.c
@@ -413,7 +413,7 @@ static const Property pl080_properties[] = {
                      TYPE_MEMORY_REGION, MemoryRegion *),
 };
 
-static void pl080_class_init(ObjectClass *oc, void *data)
+static void pl080_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
diff --git a/hw/dma/pl330.c b/hw/dma/pl330.c
index 545aa44e45..a570bb08ec 100644
--- a/hw/dma/pl330.c
+++ b/hw/dma/pl330.c
@@ -1671,7 +1671,7 @@ static const Property pl330_properties[] = {
                      TYPE_MEMORY_REGION, MemoryRegion *),
 };
 
-static void pl330_class_init(ObjectClass *klass, void *data)
+static void pl330_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/dma/rc4030.c b/hw/dma/rc4030.c
index 6842e7d491..b6ed1d4643 100644
--- a/hw/dma/rc4030.c
+++ b/hw/dma/rc4030.c
@@ -701,7 +701,7 @@ static void rc4030_unrealize(DeviceState *dev)
     object_unparent(OBJECT(&s->dma_mr));
 }
 
-static void rc4030_class_init(ObjectClass *klass, void *class_data)
+static void rc4030_class_init(ObjectClass *klass, const void *class_data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -720,7 +720,7 @@ static const TypeInfo rc4030_info = {
 };
 
 static void rc4030_iommu_memory_region_class_init(ObjectClass *klass,
-                                                  void *data)
+                                                  const void *data)
 {
     IOMMUMemoryRegionClass *imrc = IOMMU_MEMORY_REGION_CLASS(klass);
 
diff --git a/hw/dma/sifive_pdma.c b/hw/dma/sifive_pdma.c
index a115af8d60..48de3a2478 100644
--- a/hw/dma/sifive_pdma.c
+++ b/hw/dma/sifive_pdma.c
@@ -464,7 +464,7 @@ static void sifive_pdma_realize(DeviceState *dev, Error **errp)
     }
 }
 
-static void sifive_pdma_class_init(ObjectClass *klass, void *data)
+static void sifive_pdma_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/dma/sparc32_dma.c b/hw/dma/sparc32_dma.c
index 280b747521..60c23b69e5 100644
--- a/hw/dma/sparc32_dma.c
+++ b/hw/dma/sparc32_dma.c
@@ -274,7 +274,7 @@ static void sparc32_dma_device_init(Object *obj)
     qdev_init_gpio_out(dev, s->gpio, 2);
 }
 
-static void sparc32_dma_device_class_init(ObjectClass *klass, void *data)
+static void sparc32_dma_device_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -316,7 +316,8 @@ static void sparc32_espdma_device_realize(DeviceState *dev, Error **errp)
     sysbus_realize(SYS_BUS_DEVICE(sysbus), &error_fatal);
 }
 
-static void sparc32_espdma_device_class_init(ObjectClass *klass, void *data)
+static void sparc32_espdma_device_class_init(ObjectClass *klass,
+                                             const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -351,7 +352,8 @@ static void sparc32_ledma_device_realize(DeviceState *dev, Error **errp)
     sysbus_realize(SYS_BUS_DEVICE(lance), &error_fatal);
 }
 
-static void sparc32_ledma_device_class_init(ObjectClass *klass, void *data)
+static void sparc32_ledma_device_class_init(ObjectClass *klass,
+                                            const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -426,7 +428,7 @@ static void sparc32_dma_init(Object *obj)
                             TYPE_SPARC32_LEDMA_DEVICE);
 }
 
-static void sparc32_dma_class_init(ObjectClass *klass, void *data)
+static void sparc32_dma_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/dma/xilinx_axidma.c b/hw/dma/xilinx_axidma.c
index 22fe35751a..bf1b523ac8 100644
--- a/hw/dma/xilinx_axidma.c
+++ b/hw/dma/xilinx_axidma.c
@@ -621,7 +621,7 @@ static const Property axidma_properties[] = {
                      TYPE_MEMORY_REGION, MemoryRegion *),
 };
 
-static void axidma_class_init(ObjectClass *klass, void *data)
+static void axidma_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -639,7 +639,8 @@ static StreamSinkClass xilinx_axidma_control_stream_class = {
     .push = xilinx_axidma_control_stream_push,
 };
 
-static void xilinx_axidma_stream_class_init(ObjectClass *klass, void *data)
+static void xilinx_axidma_stream_class_init(ObjectClass *klass,
+                                            const void *data)
 {
     StreamSinkClass *ssc = STREAM_SINK_CLASS(klass);
 
diff --git a/hw/dma/xlnx-zdma.c b/hw/dma/xlnx-zdma.c
index bb27cb2e64..0c075e7d0d 100644
--- a/hw/dma/xlnx-zdma.c
+++ b/hw/dma/xlnx-zdma.c
@@ -816,7 +816,7 @@ static const Property zdma_props[] = {
                      TYPE_MEMORY_REGION, MemoryRegion *),
 };
 
-static void zdma_class_init(ObjectClass *klass, void *data)
+static void zdma_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/dma/xlnx-zynq-devcfg.c b/hw/dma/xlnx-zynq-devcfg.c
index 0fd0d23f57..26845713ee 100644
--- a/hw/dma/xlnx-zynq-devcfg.c
+++ b/hw/dma/xlnx-zynq-devcfg.c
@@ -380,7 +380,7 @@ static void xlnx_zynq_devcfg_init(Object *obj)
     sysbus_init_mmio(sbd, &s->iomem);
 }
 
-static void xlnx_zynq_devcfg_class_init(ObjectClass *klass, void *data)
+static void xlnx_zynq_devcfg_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/dma/xlnx_csu_dma.c b/hw/dma/xlnx_csu_dma.c
index 1afaa0bf51..6943c927d0 100644
--- a/hw/dma/xlnx_csu_dma.c
+++ b/hw/dma/xlnx_csu_dma.c
@@ -712,7 +712,7 @@ static const Property xlnx_csu_dma_properties[] = {
                      TYPE_MEMORY_REGION, MemoryRegion *),
 };
 
-static void xlnx_csu_dma_class_init(ObjectClass *klass, void *data)
+static void xlnx_csu_dma_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     StreamSinkClass *ssc = STREAM_SINK_CLASS(klass);
diff --git a/hw/dma/xlnx_dpdma.c b/hw/dma/xlnx_dpdma.c
index 2657808d37..3d88ccc8da 100644
--- a/hw/dma/xlnx_dpdma.c
+++ b/hw/dma/xlnx_dpdma.c
@@ -593,7 +593,7 @@ static void xlnx_dpdma_reset(DeviceState *dev)
     }
 }
 
-static void xlnx_dpdma_class_init(ObjectClass *oc, void *data)
+static void xlnx_dpdma_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
diff --git a/hw/fsi/aspeed_apb2opb.c b/hw/fsi/aspeed_apb2opb.c
index 0e2cc143f1..172ba16b0c 100644
--- a/hw/fsi/aspeed_apb2opb.c
+++ b/hw/fsi/aspeed_apb2opb.c
@@ -320,7 +320,7 @@ static void fsi_aspeed_apb2opb_reset(DeviceState *dev)
     memcpy(s->regs, aspeed_apb2opb_reset, ASPEED_APB2OPB_NR_REGS);
 }
 
-static void fsi_aspeed_apb2opb_class_init(ObjectClass *klass, void *data)
+static void fsi_aspeed_apb2opb_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/fsi/cfam.c b/hw/fsi/cfam.c
index c62f0f78de..e2145c5934 100644
--- a/hw/fsi/cfam.c
+++ b/hw/fsi/cfam.c
@@ -145,7 +145,7 @@ static void fsi_cfam_realize(DeviceState *dev, Error **errp)
     memory_region_add_subregion(&cfam->lbus.mr, 0, &fsi_dev->iomem);
 }
 
-static void fsi_cfam_class_init(ObjectClass *klass, void *data)
+static void fsi_cfam_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     dc->bus_type = TYPE_FSI_BUS;
diff --git a/hw/fsi/fsi-master.c b/hw/fsi/fsi-master.c
index 50fb1cd467..083a5507ab 100644
--- a/hw/fsi/fsi-master.c
+++ b/hw/fsi/fsi-master.c
@@ -144,7 +144,7 @@ static void fsi_master_reset(DeviceState *dev)
     s->regs[FSI_MVER] = 0xe0050101;
 }
 
-static void fsi_master_class_init(ObjectClass *klass, void *data)
+static void fsi_master_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/fsi/fsi.c b/hw/fsi/fsi.c
index 83ddb17ae6..6c52d5e745 100644
--- a/hw/fsi/fsi.c
+++ b/hw/fsi/fsi.c
@@ -76,7 +76,7 @@ static void fsi_slave_init(Object *o)
                           s, TYPE_FSI_SLAVE, 0x400);
 }
 
-static void fsi_slave_class_init(ObjectClass *klass, void *data)
+static void fsi_slave_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/fsi/lbus.c b/hw/fsi/lbus.c
index 4f87b28a22..8ec7f5fd78 100644
--- a/hw/fsi/lbus.c
+++ b/hw/fsi/lbus.c
@@ -91,7 +91,7 @@ static void fsi_scratchpad_reset(DeviceState *dev)
     memset(s->regs, 0, sizeof(s->regs));
 }
 
-static void fsi_scratchpad_class_init(ObjectClass *klass, void *data)
+static void fsi_scratchpad_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/gpio/aspeed_gpio.c b/hw/gpio/aspeed_gpio.c
index aedaf5238b..609a556908 100644
--- a/hw/gpio/aspeed_gpio.c
+++ b/hw/gpio/aspeed_gpio.c
@@ -1473,7 +1473,7 @@ static const VMStateDescription vmstate_aspeed_gpio = {
    }
 };
 
-static void aspeed_gpio_class_init(ObjectClass *klass, void *data)
+static void aspeed_gpio_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -1483,7 +1483,7 @@ static void aspeed_gpio_class_init(ObjectClass *klass, void *data)
     dc->vmsd = &vmstate_aspeed_gpio;
 }
 
-static void aspeed_gpio_ast2400_class_init(ObjectClass *klass, void *data)
+static void aspeed_gpio_ast2400_class_init(ObjectClass *klass, const void *data)
 {
     AspeedGPIOClass *agc = ASPEED_GPIO_CLASS(klass);
 
@@ -1496,7 +1496,7 @@ static void aspeed_gpio_ast2400_class_init(ObjectClass *klass, void *data)
     agc->reg_ops = &aspeed_gpio_ops;
 }
 
-static void aspeed_gpio_2500_class_init(ObjectClass *klass, void *data)
+static void aspeed_gpio_2500_class_init(ObjectClass *klass, const void *data)
 {
     AspeedGPIOClass *agc = ASPEED_GPIO_CLASS(klass);
 
@@ -1509,7 +1509,8 @@ static void aspeed_gpio_2500_class_init(ObjectClass *klass, void *data)
     agc->reg_ops = &aspeed_gpio_ops;
 }
 
-static void aspeed_gpio_ast2600_3_3v_class_init(ObjectClass *klass, void *data)
+static void aspeed_gpio_ast2600_3_3v_class_init(ObjectClass *klass,
+                                                const void *data)
 {
     AspeedGPIOClass *agc = ASPEED_GPIO_CLASS(klass);
 
@@ -1522,7 +1523,8 @@ static void aspeed_gpio_ast2600_3_3v_class_init(ObjectClass *klass, void *data)
     agc->reg_ops = &aspeed_gpio_ops;
 }
 
-static void aspeed_gpio_ast2600_1_8v_class_init(ObjectClass *klass, void *data)
+static void aspeed_gpio_ast2600_1_8v_class_init(ObjectClass *klass,
+                                                const void *data)
 {
     AspeedGPIOClass *agc = ASPEED_GPIO_CLASS(klass);
 
@@ -1535,7 +1537,7 @@ static void aspeed_gpio_ast2600_1_8v_class_init(ObjectClass *klass, void *data)
     agc->reg_ops = &aspeed_gpio_ops;
 }
 
-static void aspeed_gpio_1030_class_init(ObjectClass *klass, void *data)
+static void aspeed_gpio_1030_class_init(ObjectClass *klass, const void *data)
 {
     AspeedGPIOClass *agc = ASPEED_GPIO_CLASS(klass);
 
@@ -1548,7 +1550,7 @@ static void aspeed_gpio_1030_class_init(ObjectClass *klass, void *data)
     agc->reg_ops = &aspeed_gpio_ops;
 }
 
-static void aspeed_gpio_2700_class_init(ObjectClass *klass, void *data)
+static void aspeed_gpio_2700_class_init(ObjectClass *klass, const void *data)
 {
     AspeedGPIOClass *agc = ASPEED_GPIO_CLASS(klass);
 
diff --git a/hw/gpio/bcm2835_gpio.c b/hw/gpio/bcm2835_gpio.c
index 5a5f1df5e8..dfb5d5cb57 100644
--- a/hw/gpio/bcm2835_gpio.c
+++ b/hw/gpio/bcm2835_gpio.c
@@ -319,7 +319,7 @@ static void bcm2835_gpio_realize(DeviceState *dev, Error **errp)
     s->sdbus_sdhost = SD_BUS(obj);
 }
 
-static void bcm2835_gpio_class_init(ObjectClass *klass, void *data)
+static void bcm2835_gpio_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/gpio/bcm2838_gpio.c b/hw/gpio/bcm2838_gpio.c
index 53be8f2d23..1069e7811b 100644
--- a/hw/gpio/bcm2838_gpio.c
+++ b/hw/gpio/bcm2838_gpio.c
@@ -364,7 +364,7 @@ static void bcm2838_gpio_realize(DeviceState *dev, Error **errp)
     s->sdbus_sdhost = SD_BUS(obj);
 }
 
-static void bcm2838_gpio_class_init(ObjectClass *klass, void *data)
+static void bcm2838_gpio_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/gpio/gpio_key.c b/hw/gpio/gpio_key.c
index 2fcab9ead6..40c028bed9 100644
--- a/hw/gpio/gpio_key.c
+++ b/hw/gpio/gpio_key.c
@@ -85,7 +85,7 @@ static void gpio_key_realize(DeviceState *dev, Error **errp)
     s->timer = timer_new_ms(QEMU_CLOCK_VIRTUAL, gpio_key_timer_expired, s);
 }
 
-static void gpio_key_class_init(ObjectClass *klass, void *data)
+static void gpio_key_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/gpio/imx_gpio.c b/hw/gpio/imx_gpio.c
index 8c8299c4c4..f23c52af26 100644
--- a/hw/gpio/imx_gpio.c
+++ b/hw/gpio/imx_gpio.c
@@ -321,7 +321,7 @@ static void imx_gpio_realize(DeviceState *dev, Error **errp)
     sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->iomem);
 }
 
-static void imx_gpio_class_init(ObjectClass *klass, void *data)
+static void imx_gpio_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/gpio/mpc8xxx.c b/hw/gpio/mpc8xxx.c
index a3c1d2fbf4..257497af58 100644
--- a/hw/gpio/mpc8xxx.c
+++ b/hw/gpio/mpc8xxx.c
@@ -199,7 +199,7 @@ static void mpc8xxx_gpio_initfn(Object *obj)
     qdev_init_gpio_out(dev, s->out, 32);
 }
 
-static void mpc8xxx_gpio_class_init(ObjectClass *klass, void *data)
+static void mpc8xxx_gpio_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/gpio/npcm7xx_gpio.c b/hw/gpio/npcm7xx_gpio.c
index 2916056fae..66f8256a7a 100644
--- a/hw/gpio/npcm7xx_gpio.c
+++ b/hw/gpio/npcm7xx_gpio.c
@@ -396,7 +396,7 @@ static const Property npcm7xx_gpio_properties[] = {
     DEFINE_PROP_UINT32("reset-odsc", NPCM7xxGPIOState, reset_odsc, 0),
 };
 
-static void npcm7xx_gpio_class_init(ObjectClass *klass, void *data)
+static void npcm7xx_gpio_class_init(ObjectClass *klass, const void *data)
 {
     ResettableClass *reset = RESETTABLE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
diff --git a/hw/gpio/nrf51_gpio.c b/hw/gpio/nrf51_gpio.c
index d08c254e36..d94c0c47da 100644
--- a/hw/gpio/nrf51_gpio.c
+++ b/hw/gpio/nrf51_gpio.c
@@ -304,7 +304,7 @@ static void nrf51_gpio_init(Object *obj)
     qdev_init_gpio_out_named(DEVICE(s), &s->detect, "detect", 1);
 }
 
-static void nrf51_gpio_class_init(ObjectClass *klass, void *data)
+static void nrf51_gpio_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/gpio/omap_gpio.c b/hw/gpio/omap_gpio.c
index 8a9f14ba15..61ea7862af 100644
--- a/hw/gpio/omap_gpio.c
+++ b/hw/gpio/omap_gpio.c
@@ -229,7 +229,7 @@ static const Property omap_gpio_properties[] = {
     DEFINE_PROP_INT32("mpu_model", Omap1GpioState, mpu_model, 0),
 };
 
-static void omap_gpio_class_init(ObjectClass *klass, void *data)
+static void omap_gpio_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/gpio/pca9552.c b/hw/gpio/pca9552.c
index 1ac0cf6c46..d65c0a2e90 100644
--- a/hw/gpio/pca9552.c
+++ b/hw/gpio/pca9552.c
@@ -432,7 +432,7 @@ static const Property pca955x_properties[] = {
     DEFINE_PROP_STRING("description", PCA955xState, description),
 };
 
-static void pca955x_class_init(ObjectClass *klass, void *data)
+static void pca955x_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     I2CSlaveClass *k = I2C_SLAVE_CLASS(klass);
@@ -454,7 +454,7 @@ static const TypeInfo pca955x_info = {
     .abstract      = true,
 };
 
-static void pca9552_class_init(ObjectClass *oc, void *data)
+static void pca9552_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     PCA955xClass *pc = PCA955X_CLASS(oc);
diff --git a/hw/gpio/pca9554.c b/hw/gpio/pca9554.c
index 7301fce934..de3f883aee 100644
--- a/hw/gpio/pca9554.c
+++ b/hw/gpio/pca9554.c
@@ -292,7 +292,7 @@ static const Property pca9554_properties[] = {
     DEFINE_PROP_STRING("description", PCA9554State, description),
 };
 
-static void pca9554_class_init(ObjectClass *klass, void *data)
+static void pca9554_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     I2CSlaveClass *k = I2C_SLAVE_CLASS(klass);
diff --git a/hw/gpio/pcf8574.c b/hw/gpio/pcf8574.c
index 208efe69ea..274b44bb61 100644
--- a/hw/gpio/pcf8574.c
+++ b/hw/gpio/pcf8574.c
@@ -138,7 +138,7 @@ static void pcf8574_realize(DeviceState *dev, Error **errp)
     qdev_init_gpio_out_named(dev, &s->intrq, "nINT", 1);
 }
 
-static void pcf8574_class_init(ObjectClass *klass, void *data)
+static void pcf8574_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass   *dc = DEVICE_CLASS(klass);
     I2CSlaveClass *k  = I2C_SLAVE_CLASS(klass);
diff --git a/hw/gpio/pl061.c b/hw/gpio/pl061.c
index 2e69785f2a..1acca3f2f8 100644
--- a/hw/gpio/pl061.c
+++ b/hw/gpio/pl061.c
@@ -566,7 +566,7 @@ static const Property pl061_props[] = {
     DEFINE_PROP_UINT32("pulldowns", PL061State, pulldowns, 0x0),
 };
 
-static void pl061_class_init(ObjectClass *klass, void *data)
+static void pl061_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     ResettableClass *rc = RESETTABLE_CLASS(klass);
diff --git a/hw/gpio/sifive_gpio.c b/hw/gpio/sifive_gpio.c
index 0d5206ae6b..5831647b4d 100644
--- a/hw/gpio/sifive_gpio.c
+++ b/hw/gpio/sifive_gpio.c
@@ -370,7 +370,7 @@ static void sifive_gpio_realize(DeviceState *dev, Error **errp)
     qdev_init_gpio_out(DEVICE(s), s->output, s->ngpio);
 }
 
-static void sifive_gpio_class_init(ObjectClass *klass, void *data)
+static void sifive_gpio_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/gpio/stm32l4x5_gpio.c b/hw/gpio/stm32l4x5_gpio.c
index f69fc1db4f..414ce83039 100644
--- a/hw/gpio/stm32l4x5_gpio.c
+++ b/hw/gpio/stm32l4x5_gpio.c
@@ -454,7 +454,7 @@ static const Property stm32l4x5_gpio_properties[] = {
     DEFINE_PROP_UINT32("pupd-reset", Stm32l4x5GpioState, pupdr_reset, 0),
 };
 
-static void stm32l4x5_gpio_class_init(ObjectClass *klass, void *data)
+static void stm32l4x5_gpio_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     ResettableClass *rc = RESETTABLE_CLASS(klass);
diff --git a/hw/gpio/zaurus.c b/hw/gpio/zaurus.c
index 7342440b95..b8d27f5973 100644
--- a/hw/gpio/zaurus.c
+++ b/hw/gpio/zaurus.c
@@ -243,7 +243,7 @@ static const VMStateDescription vmstate_scoop_regs = {
     },
 };
 
-static void scoop_sysbus_class_init(ObjectClass *klass, void *data)
+static void scoop_sysbus_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/hppa/machine.c b/hw/hppa/machine.c
index c430bf28dd..1812276678 100644
--- a/hw/hppa/machine.c
+++ b/hw/hppa/machine.c
@@ -683,7 +683,7 @@ static void hppa_nmi(NMIState *n, int cpu_index, Error **errp)
     }
 }
 
-static void HP_B160L_machine_init_class_init(ObjectClass *oc, void *data)
+static void HP_B160L_machine_init_class_init(ObjectClass *oc, const void *data)
 {
     static const char * const valid_cpu_types[] = {
         TYPE_HPPA_CPU,
@@ -719,7 +719,7 @@ static const TypeInfo HP_B160L_machine_init_typeinfo = {
     },
 };
 
-static void HP_C3700_machine_init_class_init(ObjectClass *oc, void *data)
+static void HP_C3700_machine_init_class_init(ObjectClass *oc, const void *data)
 {
     static const char * const valid_cpu_types[] = {
         TYPE_HPPA64_CPU,
diff --git a/hw/hyperv/hv-balloon.c b/hw/hyperv/hv-balloon.c
index acabff2c4a..94b0abbd68 100644
--- a/hw/hyperv/hv-balloon.c
+++ b/hw/hyperv/hv-balloon.c
@@ -1743,7 +1743,7 @@ static const Property hv_balloon_properties[] = {
     DEFINE_PROP_UINT64(HV_BALLOON_ADDR_PROP, HvBalloon, addr, 0),
 };
 
-static void hv_balloon_class_init(ObjectClass *klass, void *data)
+static void hv_balloon_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VMBusDeviceClass *vdc = VMBUS_DEVICE_CLASS(klass);
diff --git a/hw/hyperv/hyperv.c b/hw/hyperv/hyperv.c
index 8f193fd0bd..0271cfd271 100644
--- a/hw/hyperv/hyperv.c
+++ b/hw/hyperv/hyperv.c
@@ -133,7 +133,7 @@ static void synic_reset(DeviceState *dev)
     assert(QLIST_EMPTY(&synic->sint_routes));
 }
 
-static void synic_class_init(ObjectClass *klass, void *data)
+static void synic_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/hyperv/hyperv_testdev.c b/hw/hyperv/hyperv_testdev.c
index a630ca7047..2d4a63693b 100644
--- a/hw/hyperv/hyperv_testdev.c
+++ b/hw/hyperv/hyperv_testdev.c
@@ -303,7 +303,7 @@ static void hv_test_dev_realizefn(DeviceState *d, Error **errp)
     memory_region_add_subregion(io, 0x3000, &dev->sint_control);
 }
 
-static void hv_test_dev_class_init(ObjectClass *klass, void *data)
+static void hv_test_dev_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/hyperv/syndbg.c b/hw/hyperv/syndbg.c
index a410b55b9a..ca291826a0 100644
--- a/hw/hyperv/syndbg.c
+++ b/hw/hyperv/syndbg.c
@@ -373,7 +373,7 @@ static const Property hv_syndbg_properties[] = {
     DEFINE_PROP_BOOL("use_hcalls", HvSynDbg, use_hcalls, false),
 };
 
-static void hv_syndbg_class_init(ObjectClass *klass, void *data)
+static void hv_syndbg_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/hyperv/vmbus.c b/hw/hyperv/vmbus.c
index 98ea968e51..b147ea06d8 100644
--- a/hw/hyperv/vmbus.c
+++ b/hw/hyperv/vmbus.c
@@ -2351,7 +2351,7 @@ static const Property vmbus_dev_props[] = {
 };
 
 
-static void vmbus_dev_class_init(ObjectClass *klass, void *data)
+static void vmbus_dev_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *kdev = DEVICE_CLASS(klass);
     device_class_set_props(kdev, vmbus_dev_props);
@@ -2469,7 +2469,7 @@ static char *vmbus_get_fw_dev_path(DeviceState *dev)
     return g_strdup_printf("%s@%s", qdev_fw_name(dev), uuid);
 }
 
-static void vmbus_class_init(ObjectClass *klass, void *data)
+static void vmbus_class_init(ObjectClass *klass, const void *data)
 {
     BusClass *k = BUS_CLASS(klass);
     ResettableClass *rc = RESETTABLE_CLASS(klass);
@@ -2656,7 +2656,7 @@ static const Property vmbus_bridge_props[] = {
     DEFINE_PROP_UINT8("irq", VMBusBridge, irq, 7),
 };
 
-static void vmbus_bridge_class_init(ObjectClass *klass, void *data)
+static void vmbus_bridge_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *k = DEVICE_CLASS(klass);
     SysBusDeviceClass *sk = SYS_BUS_DEVICE_CLASS(klass);
diff --git a/hw/i2c/allwinner-i2c.c b/hw/i2c/allwinner-i2c.c
index 66d6431c50..fe887e1c6a 100644
--- a/hw/i2c/allwinner-i2c.c
+++ b/hw/i2c/allwinner-i2c.c
@@ -438,7 +438,7 @@ static void allwinner_i2c_realize(DeviceState *dev, Error **errp)
     s->bus = i2c_init_bus(dev, "i2c");
 }
 
-static void allwinner_i2c_class_init(ObjectClass *klass, void *data)
+static void allwinner_i2c_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     ResettableClass *rc = RESETTABLE_CLASS(klass);
diff --git a/hw/i2c/aspeed_i2c.c b/hw/i2c/aspeed_i2c.c
index a8fbb9f44a..83fb906bdc 100644
--- a/hw/i2c/aspeed_i2c.c
+++ b/hw/i2c/aspeed_i2c.c
@@ -1263,7 +1263,7 @@ static const Property aspeed_i2c_properties[] = {
                      TYPE_MEMORY_REGION, MemoryRegion *),
 };
 
-static void aspeed_i2c_class_init(ObjectClass *klass, void *data)
+static void aspeed_i2c_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -1390,7 +1390,8 @@ static void aspeed_i2c_bus_slave_send_async(I2CSlave *slave, uint8_t data)
     aspeed_i2c_bus_raise_interrupt(bus);
 }
 
-static void aspeed_i2c_bus_slave_class_init(ObjectClass *klass, void *data)
+static void aspeed_i2c_bus_slave_class_init(ObjectClass *klass,
+                                            const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     I2CSlaveClass *sc = I2C_SLAVE_CLASS(klass);
@@ -1451,7 +1452,7 @@ static const Property aspeed_i2c_bus_properties[] = {
                      AspeedI2CState *),
 };
 
-static void aspeed_i2c_bus_class_init(ObjectClass *klass, void *data)
+static void aspeed_i2c_bus_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -1483,7 +1484,7 @@ static uint8_t *aspeed_2400_i2c_bus_pool_base(AspeedI2CBus *bus)
     return &pool_page[ARRAY_FIELD_EX32(bus->regs, I2CD_POOL_CTRL, OFFSET)];
 }
 
-static void aspeed_2400_i2c_class_init(ObjectClass *klass, void *data)
+static void aspeed_2400_i2c_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     AspeedI2CClass *aic = ASPEED_I2C_CLASS(klass);
@@ -1517,7 +1518,7 @@ static uint8_t *aspeed_2500_i2c_bus_pool_base(AspeedI2CBus *bus)
     return bus->pool;
 }
 
-static void aspeed_2500_i2c_class_init(ObjectClass *klass, void *data)
+static void aspeed_2500_i2c_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     AspeedI2CClass *aic = ASPEED_I2C_CLASS(klass);
@@ -1547,7 +1548,7 @@ static qemu_irq aspeed_2600_i2c_bus_get_irq(AspeedI2CBus *bus)
     return bus->irq;
 }
 
-static void aspeed_2600_i2c_class_init(ObjectClass *klass, void *data)
+static void aspeed_2600_i2c_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     AspeedI2CClass *aic = ASPEED_I2C_CLASS(klass);
@@ -1571,7 +1572,7 @@ static const TypeInfo aspeed_2600_i2c_info = {
     .class_init = aspeed_2600_i2c_class_init,
 };
 
-static void aspeed_1030_i2c_class_init(ObjectClass *klass, void *data)
+static void aspeed_1030_i2c_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     AspeedI2CClass *aic = ASPEED_I2C_CLASS(klass);
@@ -1595,7 +1596,7 @@ static const TypeInfo aspeed_1030_i2c_info = {
     .class_init = aspeed_1030_i2c_class_init,
 };
 
-static void aspeed_2700_i2c_class_init(ObjectClass *klass, void *data)
+static void aspeed_2700_i2c_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     AspeedI2CClass *aic = ASPEED_I2C_CLASS(klass);
diff --git a/hw/i2c/bcm2835_i2c.c b/hw/i2c/bcm2835_i2c.c
index 67bfdef3b4..be11cca2a9 100644
--- a/hw/i2c/bcm2835_i2c.c
+++ b/hw/i2c/bcm2835_i2c.c
@@ -258,7 +258,7 @@ static const VMStateDescription vmstate_bcm2835_i2c = {
     }
 };
 
-static void bcm2835_i2c_class_init(ObjectClass *klass, void *data)
+static void bcm2835_i2c_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/i2c/bitbang_i2c.c b/hw/i2c/bitbang_i2c.c
index de5f5aacf5..e020f314e2 100644
--- a/hw/i2c/bitbang_i2c.c
+++ b/hw/i2c/bitbang_i2c.c
@@ -222,7 +222,7 @@ static void gpio_i2c_init(Object *obj)
     qdev_init_gpio_out(dev, &s->out, 1);
 }
 
-static void gpio_i2c_class_init(ObjectClass *klass, void *data)
+static void gpio_i2c_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/i2c/core.c b/hw/i2c/core.c
index 26bb18514a..4b6345b588 100644
--- a/hw/i2c/core.c
+++ b/hw/i2c/core.c
@@ -401,7 +401,7 @@ static bool i2c_slave_match(I2CSlave *candidate, uint8_t address,
     return false;
 }
 
-static void i2c_slave_class_init(ObjectClass *klass, void *data)
+static void i2c_slave_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *k = DEVICE_CLASS(klass);
     I2CSlaveClass *sc = I2C_SLAVE_CLASS(klass);
diff --git a/hw/i2c/exynos4210_i2c.c b/hw/i2c/exynos4210_i2c.c
index b1d00096ee..9d0c1cdaa8 100644
--- a/hw/i2c/exynos4210_i2c.c
+++ b/hw/i2c/exynos4210_i2c.c
@@ -309,7 +309,7 @@ static void exynos4210_i2c_init(Object *obj)
     s->bus = i2c_init_bus(dev, "i2c");
 }
 
-static void exynos4210_i2c_class_init(ObjectClass *klass, void *data)
+static void exynos4210_i2c_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/i2c/i2c_mux_pca954x.c b/hw/i2c/i2c_mux_pca954x.c
index 779cc4e66e..a8ef640cd2 100644
--- a/hw/i2c/i2c_mux_pca954x.c
+++ b/hw/i2c/i2c_mux_pca954x.c
@@ -172,13 +172,13 @@ I2CBus *pca954x_i2c_get_bus(I2CSlave *mux, uint8_t channel)
     return pca954x->bus[channel];
 }
 
-static void pca9546_class_init(ObjectClass *klass, void *data)
+static void pca9546_class_init(ObjectClass *klass, const void *data)
 {
     Pca954xClass *s = PCA954X_CLASS(klass);
     s->nchans = PCA9546_CHANNEL_COUNT;
 }
 
-static void pca9548_class_init(ObjectClass *klass, void *data)
+static void pca9548_class_init(ObjectClass *klass, const void *data)
 {
     Pca954xClass *s = PCA954X_CLASS(klass);
     s->nchans = PCA9548_CHANNEL_COUNT;
@@ -215,7 +215,7 @@ static const Property pca954x_props[] = {
     DEFINE_PROP_STRING("name", Pca954xState, name),
 };
 
-static void pca954x_class_init(ObjectClass *klass, void *data)
+static void pca954x_class_init(ObjectClass *klass, const void *data)
 {
     I2CSlaveClass *sc = I2C_SLAVE_CLASS(klass);
     ResettableClass *rc = RESETTABLE_CLASS(klass);
diff --git a/hw/i2c/imx_i2c.c b/hw/i2c/imx_i2c.c
index d62213b9e0..91f84c2ad7 100644
--- a/hw/i2c/imx_i2c.c
+++ b/hw/i2c/imx_i2c.c
@@ -297,7 +297,7 @@ static void imx_i2c_realize(DeviceState *dev, Error **errp)
     s->bus = i2c_init_bus(dev, NULL);
 }
 
-static void imx_i2c_class_init(ObjectClass *klass, void *data)
+static void imx_i2c_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/i2c/microbit_i2c.c b/hw/i2c/microbit_i2c.c
index 06fbd18a78..2291d6370e 100644
--- a/hw/i2c/microbit_i2c.c
+++ b/hw/i2c/microbit_i2c.c
@@ -105,7 +105,7 @@ static void microbit_i2c_realize(DeviceState *dev, Error **errp)
     sysbus_init_mmio(sbd, &s->iomem);
 }
 
-static void microbit_i2c_class_init(ObjectClass *klass, void *data)
+static void microbit_i2c_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/i2c/mpc_i2c.c b/hw/i2c/mpc_i2c.c
index 913d044ac1..25f91b7bc8 100644
--- a/hw/i2c/mpc_i2c.c
+++ b/hw/i2c/mpc_i2c.c
@@ -334,7 +334,7 @@ static void mpc_i2c_realize(DeviceState *dev, Error **errp)
     i2c->bus = i2c_init_bus(dev, "i2c");
 }
 
-static void mpc_i2c_class_init(ObjectClass *klass, void *data)
+static void mpc_i2c_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/i2c/npcm7xx_smbus.c b/hw/i2c/npcm7xx_smbus.c
index 22d68fc67d..179852a4fd 100644
--- a/hw/i2c/npcm7xx_smbus.c
+++ b/hw/i2c/npcm7xx_smbus.c
@@ -1075,7 +1075,7 @@ static const VMStateDescription vmstate_npcm7xx_smbus = {
     },
 };
 
-static void npcm7xx_smbus_class_init(ObjectClass *klass, void *data)
+static void npcm7xx_smbus_class_init(ObjectClass *klass, const void *data)
 {
     ResettableClass *rc = RESETTABLE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
diff --git a/hw/i2c/omap_i2c.c b/hw/i2c/omap_i2c.c
index a641db2348..2e45266e74 100644
--- a/hw/i2c/omap_i2c.c
+++ b/hw/i2c/omap_i2c.c
@@ -515,7 +515,7 @@ static const Property omap_i2c_properties[] = {
     DEFINE_PROP_UINT8("revision", OMAPI2CState, revision, 0),
 };
 
-static void omap_i2c_class_init(ObjectClass *klass, void *data)
+static void omap_i2c_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/i2c/pmbus_device.c b/hw/i2c/pmbus_device.c
index ba1d2fd716..853dc4b434 100644
--- a/hw/i2c/pmbus_device.c
+++ b/hw/i2c/pmbus_device.c
@@ -1902,7 +1902,7 @@ static void pmbus_device_finalize(Object *obj)
     g_free(pmdev->pages);
 }
 
-static void pmbus_device_class_init(ObjectClass *klass, void *data)
+static void pmbus_device_class_init(ObjectClass *klass, const void *data)
 {
     SMBusDeviceClass *k = SMBUS_DEVICE_CLASS(klass);
 
diff --git a/hw/i2c/ppc4xx_i2c.c b/hw/i2c/ppc4xx_i2c.c
index 7b124a7e33..09d4c49d65 100644
--- a/hw/i2c/ppc4xx_i2c.c
+++ b/hw/i2c/ppc4xx_i2c.c
@@ -354,7 +354,7 @@ static void ppc4xx_i2c_init(Object *o)
     bitbang_i2c_init(&s->bitbang, s->bus);
 }
 
-static void ppc4xx_i2c_class_init(ObjectClass *klass, void *data)
+static void ppc4xx_i2c_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/i2c/smbus_eeprom.c b/hw/i2c/smbus_eeprom.c
index e3e96d4a2d..0a1088fbb0 100644
--- a/hw/i2c/smbus_eeprom.c
+++ b/hw/i2c/smbus_eeprom.c
@@ -137,7 +137,7 @@ static void smbus_eeprom_realize(DeviceState *dev, Error **errp)
     }
 }
 
-static void smbus_eeprom_class_initfn(ObjectClass *klass, void *data)
+static void smbus_eeprom_class_initfn(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     SMBusDeviceClass *sc = SMBUS_DEVICE_CLASS(klass);
diff --git a/hw/i2c/smbus_ich9.c b/hw/i2c/smbus_ich9.c
index 208f263ac5..f1fca30fea 100644
--- a/hw/i2c/smbus_ich9.c
+++ b/hw/i2c/smbus_ich9.c
@@ -118,7 +118,7 @@ static void build_ich9_smb_aml(AcpiDevAmlIf *adev, Aml *scope)
     qbus_build_aml(bus, scope);
 }
 
-static void ich9_smb_class_init(ObjectClass *klass, void *data)
+static void ich9_smb_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
diff --git a/hw/i2c/smbus_slave.c b/hw/i2c/smbus_slave.c
index 9f9afc25a4..cfb61c879e 100644
--- a/hw/i2c/smbus_slave.c
+++ b/hw/i2c/smbus_slave.c
@@ -201,7 +201,7 @@ static int smbus_i2c_send(I2CSlave *s, uint8_t data)
     return 0;
 }
 
-static void smbus_device_class_init(ObjectClass *klass, void *data)
+static void smbus_device_class_init(ObjectClass *klass, const void *data)
 {
     I2CSlaveClass *sc = I2C_SLAVE_CLASS(klass);
 
diff --git a/hw/i386/amd_iommu.c b/hw/i386/amd_iommu.c
index 5f9b952799..b94802e21a 100644
--- a/hw/i386/amd_iommu.c
+++ b/hw/i386/amd_iommu.c
@@ -1677,7 +1677,7 @@ static void amdvi_sysbus_instance_init(Object *klass)
     object_initialize(&s->pci, sizeof(s->pci), TYPE_AMD_IOMMU_PCI);
 }
 
-static void amdvi_sysbus_class_init(ObjectClass *klass, void *data)
+static void amdvi_sysbus_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     X86IOMMUClass *dc_class = X86_IOMMU_DEVICE_CLASS(klass);
@@ -1700,7 +1700,7 @@ static const TypeInfo amdvi_sysbus = {
     .class_init = amdvi_sysbus_class_init
 };
 
-static void amdvi_pci_class_init(ObjectClass *klass, void *data)
+static void amdvi_pci_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
@@ -1725,7 +1725,8 @@ static const TypeInfo amdvi_pci = {
     },
 };
 
-static void amdvi_iommu_memory_region_class_init(ObjectClass *klass, void *data)
+static void amdvi_iommu_memory_region_class_init(ObjectClass *klass,
+                                                 const void *data)
 {
     IOMMUMemoryRegionClass *imrc = IOMMU_MEMORY_REGION_CLASS(klass);
 
diff --git a/hw/i386/intel_iommu.c b/hw/i386/intel_iommu.c
index 0608aec8c5..5f8ed1243d 100644
--- a/hw/i386/intel_iommu.c
+++ b/hw/i386/intel_iommu.c
@@ -4859,7 +4859,7 @@ static void vtd_realize(DeviceState *dev, Error **errp)
     qemu_add_machine_init_done_notifier(&vtd_machine_done_notify);
 }
 
-static void vtd_class_init(ObjectClass *klass, void *data)
+static void vtd_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     X86IOMMUClass *x86_class = X86_IOMMU_DEVICE_CLASS(klass);
@@ -4887,7 +4887,7 @@ static const TypeInfo vtd_info = {
 };
 
 static void vtd_iommu_memory_region_class_init(ObjectClass *klass,
-                                                     void *data)
+                                               const void *data)
 {
     IOMMUMemoryRegionClass *imrc = IOMMU_MEMORY_REGION_CLASS(klass);
 
diff --git a/hw/i386/kvm/apic.c b/hw/i386/kvm/apic.c
index 7575106000..39035db042 100644
--- a/hw/i386/kvm/apic.c
+++ b/hw/i386/kvm/apic.c
@@ -240,7 +240,7 @@ static void kvm_apic_unrealize(DeviceState *dev)
 {
 }
 
-static void kvm_apic_class_init(ObjectClass *klass, void *data)
+static void kvm_apic_class_init(ObjectClass *klass, const void *data)
 {
     APICCommonClass *k = APIC_COMMON_CLASS(klass);
 
diff --git a/hw/i386/kvm/clock.c b/hw/i386/kvm/clock.c
index 17443552e9..f56382717f 100644
--- a/hw/i386/kvm/clock.c
+++ b/hw/i386/kvm/clock.c
@@ -309,7 +309,7 @@ static const Property kvmclock_properties[] = {
                       mach_use_reliable_get_clock, true),
 };
 
-static void kvmclock_class_init(ObjectClass *klass, void *data)
+static void kvmclock_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/i386/kvm/i8254.c b/hw/i386/kvm/i8254.c
index 3b92771c79..14b78f30a8 100644
--- a/hw/i386/kvm/i8254.c
+++ b/hw/i386/kvm/i8254.c
@@ -292,7 +292,7 @@ static const Property kvm_pit_properties[] = {
                                lost_tick_policy, LOST_TICK_POLICY_DELAY),
 };
 
-static void kvm_pit_class_init(ObjectClass *klass, void *data)
+static void kvm_pit_class_init(ObjectClass *klass, const void *data)
 {
     KVMPITClass *kpc = KVM_PIT_CLASS(klass);
     PITCommonClass *k = PIT_COMMON_CLASS(klass);
diff --git a/hw/i386/kvm/i8259.c b/hw/i386/kvm/i8259.c
index 272c04df0b..8a72d6e4dd 100644
--- a/hw/i386/kvm/i8259.c
+++ b/hw/i386/kvm/i8259.c
@@ -139,7 +139,7 @@ qemu_irq *kvm_i8259_init(ISABus *bus)
     return qemu_allocate_irqs(kvm_pic_set_irq, NULL, ISA_NUM_IRQS);
 }
 
-static void kvm_i8259_class_init(ObjectClass *klass, void *data)
+static void kvm_i8259_class_init(ObjectClass *klass, const void *data)
 {
     KVMPICClass *kpc = KVM_PIC_CLASS(klass);
     PICCommonClass *k = PIC_COMMON_CLASS(klass);
diff --git a/hw/i386/kvm/ioapic.c b/hw/i386/kvm/ioapic.c
index 5419e191b5..693ee978a1 100644
--- a/hw/i386/kvm/ioapic.c
+++ b/hw/i386/kvm/ioapic.c
@@ -137,7 +137,7 @@ static const Property kvm_ioapic_properties[] = {
     DEFINE_PROP_UINT32("gsi_base", KVMIOAPICState, kvm_gsi_base, 0),
 };
 
-static void kvm_ioapic_class_init(ObjectClass *klass, void *data)
+static void kvm_ioapic_class_init(ObjectClass *klass, const void *data)
 {
     IOAPICCommonClass *k = IOAPIC_COMMON_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
diff --git a/hw/i386/kvm/xen_evtchn.c b/hw/i386/kvm/xen_evtchn.c
index f9223ef1a1..b5190549a8 100644
--- a/hw/i386/kvm/xen_evtchn.c
+++ b/hw/i386/kvm/xen_evtchn.c
@@ -271,7 +271,7 @@ static const VMStateDescription xen_evtchn_vmstate = {
     }
 };
 
-static void xen_evtchn_class_init(ObjectClass *klass, void *data)
+static void xen_evtchn_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/i386/kvm/xen_gnttab.c b/hw/i386/kvm/xen_gnttab.c
index 430ba62896..4b9e272c5e 100644
--- a/hw/i386/kvm/xen_gnttab.c
+++ b/hw/i386/kvm/xen_gnttab.c
@@ -135,7 +135,7 @@ static const VMStateDescription xen_gnttab_vmstate = {
     }
 };
 
-static void xen_gnttab_class_init(ObjectClass *klass, void *data)
+static void xen_gnttab_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/i386/kvm/xen_overlay.c b/hw/i386/kvm/xen_overlay.c
index a2b26e9906..3cb7361937 100644
--- a/hw/i386/kvm/xen_overlay.c
+++ b/hw/i386/kvm/xen_overlay.c
@@ -151,7 +151,7 @@ static void xen_overlay_reset(DeviceState *dev)
     kvm_xen_soft_reset();
 }
 
-static void xen_overlay_class_init(ObjectClass *klass, void *data)
+static void xen_overlay_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/i386/kvm/xen_primary_console.c b/hw/i386/kvm/xen_primary_console.c
index 8ad2363d18..6e9d6417c3 100644
--- a/hw/i386/kvm/xen_primary_console.c
+++ b/hw/i386/kvm/xen_primary_console.c
@@ -67,7 +67,7 @@ static void xen_primary_console_realize(DeviceState *dev, Error **errp)
     xen_primary_console_singleton = s;
 }
 
-static void xen_primary_console_class_init(ObjectClass *klass, void *data)
+static void xen_primary_console_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/i386/kvm/xen_xenstore.c b/hw/i386/kvm/xen_xenstore.c
index 227ad7ace3..42955cccd9 100644
--- a/hw/i386/kvm/xen_xenstore.c
+++ b/hw/i386/kvm/xen_xenstore.c
@@ -259,7 +259,7 @@ static const VMStateDescription xen_xenstore_vmstate = {
     }
 };
 
-static void xen_xenstore_class_init(ObjectClass *klass, void *data)
+static void xen_xenstore_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/i386/microvm.c b/hw/i386/microvm.c
index d0a236c74f..14a918a531 100644
--- a/hw/i386/microvm.c
+++ b/hw/i386/microvm.c
@@ -635,7 +635,7 @@ GlobalProperty microvm_properties[] = {
     { "pcie-root-port", "io-reserve", "0" },
 };
 
-static void microvm_class_init(ObjectClass *oc, void *data)
+static void microvm_class_init(ObjectClass *oc, const void *data)
 {
     X86MachineClass *x86mc = X86_MACHINE_CLASS(oc);
     MicrovmMachineClass *mmc = MICROVM_MACHINE_CLASS(oc);
diff --git a/hw/i386/nitro_enclave.c b/hw/i386/nitro_enclave.c
index 4b69f265cc..5ee50f3b85 100644
--- a/hw/i386/nitro_enclave.c
+++ b/hw/i386/nitro_enclave.c
@@ -293,7 +293,7 @@ static void nitro_enclave_set_parent_id(Object *obj, const char *value,
     nems->parent_id = g_strdup(value);
 }
 
-static void nitro_enclave_class_init(ObjectClass *oc, void *data)
+static void nitro_enclave_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     MicrovmMachineClass *mmc = MICROVM_MACHINE_CLASS(oc);
diff --git a/hw/i386/pc.c b/hw/i386/pc.c
index 5481fe40be..49753bf0b3 100644
--- a/hw/i386/pc.c
+++ b/hw/i386/pc.c
@@ -1766,7 +1766,7 @@ static bool pc_hotplug_allowed(MachineState *ms, DeviceState *dev, Error **errp)
     return true;
 }
 
-static void pc_machine_class_init(ObjectClass *oc, void *data)
+static void pc_machine_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     X86MachineClass *x86mc = X86_MACHINE_CLASS(oc);
diff --git a/hw/i386/port92.c b/hw/i386/port92.c
index 1ba3f32887..39b6f3178f 100644
--- a/hw/i386/port92.c
+++ b/hw/i386/port92.c
@@ -97,7 +97,7 @@ static void port92_realizefn(DeviceState *dev, Error **errp)
     isa_register_ioport(isadev, &s->io, 0x92);
 }
 
-static void port92_class_initfn(ObjectClass *klass, void *data)
+static void port92_class_initfn(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/i386/sgx-epc.c b/hw/i386/sgx-epc.c
index 00b220d4d6..8fb80900b7 100644
--- a/hw/i386/sgx-epc.c
+++ b/hw/i386/sgx-epc.c
@@ -147,7 +147,7 @@ static void sgx_epc_md_fill_device_info(const MemoryDeviceState *md,
     info->type = MEMORY_DEVICE_INFO_KIND_SGX_EPC;
 }
 
-static void sgx_epc_class_init(ObjectClass *oc, void *data)
+static void sgx_epc_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     MemoryDeviceClass *mdc = MEMORY_DEVICE_CLASS(oc);
diff --git a/hw/i386/vapic.c b/hw/i386/vapic.c
index 347431eeef..0c1c92c479 100644
--- a/hw/i386/vapic.c
+++ b/hw/i386/vapic.c
@@ -847,7 +847,7 @@ static const VMStateDescription vmstate_vapic = {
     }
 };
 
-static void vapic_class_init(ObjectClass *klass, void *data)
+static void vapic_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/i386/vmmouse.c b/hw/i386/vmmouse.c
index 3e07d12512..3896159b05 100644
--- a/hw/i386/vmmouse.c
+++ b/hw/i386/vmmouse.c
@@ -321,7 +321,7 @@ static const Property vmmouse_properties[] = {
     DEFINE_PROP_LINK("i8042", VMMouseState, i8042, TYPE_I8042, ISAKBDState *),
 };
 
-static void vmmouse_class_initfn(ObjectClass *klass, void *data)
+static void vmmouse_class_initfn(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/i386/vmport.c b/hw/i386/vmport.c
index 2f19b970b5..6d93457c52 100644
--- a/hw/i386/vmport.c
+++ b/hw/i386/vmport.c
@@ -286,7 +286,7 @@ static const Property vmport_properties[] = {
     DEFINE_PROP_UINT8("vmware-vmx-type", VMPortState, vmware_vmx_type, 2),
 };
 
-static void vmport_class_initfn(ObjectClass *klass, void *data)
+static void vmport_class_initfn(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/i386/x86-iommu.c b/hw/i386/x86-iommu.c
index 5cdd165af0..d34a6849f4 100644
--- a/hw/i386/x86-iommu.c
+++ b/hw/i386/x86-iommu.c
@@ -132,7 +132,7 @@ static const Property x86_iommu_properties[] = {
     DEFINE_PROP_BOOL("pt", X86IOMMUState, pt_supported, true),
 };
 
-static void x86_iommu_class_init(ObjectClass *klass, void *data)
+static void x86_iommu_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     dc->realize = x86_iommu_realize;
diff --git a/hw/i386/x86.c b/hw/i386/x86.c
index 69bfc00b9a..c8e2551b2b 100644
--- a/hw/i386/x86.c
+++ b/hw/i386/x86.c
@@ -372,7 +372,7 @@ static void x86_machine_initfn(Object *obj)
     x86ms->above_4g_mem_start = 4 * GiB;
 }
 
-static void x86_machine_class_init(ObjectClass *oc, void *data)
+static void x86_machine_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     X86MachineClass *x86mc = X86_MACHINE_CLASS(oc);
diff --git a/hw/i386/xen/xen-pvh.c b/hw/i386/xen/xen-pvh.c
index f6356f2a7e..067f73e977 100644
--- a/hw/i386/xen/xen-pvh.c
+++ b/hw/i386/xen/xen-pvh.c
@@ -76,7 +76,7 @@ static void xen_pvh_set_pci_intx_irq(void *opaque, int irq, int level)
     }
 }
 
-static void xen_pvh_machine_class_init(ObjectClass *oc, void *data)
+static void xen_pvh_machine_class_init(ObjectClass *oc, const void *data)
 {
     XenPVHMachineClass *xpc = XEN_PVH_MACHINE_CLASS(oc);
     MachineClass *mc = MACHINE_CLASS(oc);
diff --git a/hw/i386/xen/xen_apic.c b/hw/i386/xen/xen_apic.c
index a94e9005cb..f30398fa4a 100644
--- a/hw/i386/xen/xen_apic.c
+++ b/hw/i386/xen/xen_apic.c
@@ -76,7 +76,7 @@ static void xen_send_msi(MSIMessage *msi)
     xen_hvm_inject_msi(msi->address, msi->data);
 }
 
-static void xen_apic_class_init(ObjectClass *klass, void *data)
+static void xen_apic_class_init(ObjectClass *klass, const void *data)
 {
     APICCommonClass *k = APIC_COMMON_CLASS(klass);
 
diff --git a/hw/i386/xen/xen_platform.c b/hw/i386/xen/xen_platform.c
index dd648a2ee9..7c0d345f96 100644
--- a/hw/i386/xen/xen_platform.c
+++ b/hw/i386/xen/xen_platform.c
@@ -581,7 +581,7 @@ static void platform_reset(DeviceState *dev)
     platform_fixed_ioport_reset(s);
 }
 
-static void xen_platform_class_init(ObjectClass *klass, void *data)
+static void xen_platform_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
diff --git a/hw/i386/xen/xen_pvdevice.c b/hw/i386/xen/xen_pvdevice.c
index 9453da97bd..65868bd5e5 100644
--- a/hw/i386/xen/xen_pvdevice.c
+++ b/hw/i386/xen/xen_pvdevice.c
@@ -122,7 +122,7 @@ static const Property xen_pv_props[] = {
     DEFINE_PROP_UINT32("size", XenPVDevice, size, 0x400000),
 };
 
-static void xen_pv_class_init(ObjectClass *klass, void *data)
+static void xen_pv_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
diff --git a/hw/ide/ahci-allwinner.c b/hw/ide/ahci-allwinner.c
index 575be36fc5..bc7a116a89 100644
--- a/hw/ide/ahci-allwinner.c
+++ b/hw/ide/ahci-allwinner.c
@@ -103,7 +103,7 @@ static const VMStateDescription vmstate_allwinner_ahci = {
     }
 };
 
-static void allwinner_ahci_class_init(ObjectClass *klass, void *data)
+static void allwinner_ahci_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/ide/ahci-sysbus.c b/hw/ide/ahci-sysbus.c
index 3c1935d81c..210818d047 100644
--- a/hw/ide/ahci-sysbus.c
+++ b/hw/ide/ahci-sysbus.c
@@ -66,7 +66,7 @@ static const Property sysbus_ahci_properties[] = {
     DEFINE_PROP_UINT32("num-ports", SysbusAHCIState, ahci.ports, 1),
 };
 
-static void sysbus_ahci_class_init(ObjectClass *klass, void *data)
+static void sysbus_ahci_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/ide/cf.c b/hw/ide/cf.c
index cfb4394f80..f87cd413b6 100644
--- a/hw/ide/cf.c
+++ b/hw/ide/cf.c
@@ -31,7 +31,7 @@ static const Property ide_cf_properties[] = {
                 IDEDrive, dev.chs_trans, BIOS_ATA_TRANSLATION_AUTO),
 };
 
-static void ide_cf_class_init(ObjectClass *klass, void *data)
+static void ide_cf_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     IDEDeviceClass *k = IDE_DEVICE_CLASS(klass);
diff --git a/hw/ide/cmd646.c b/hw/ide/cmd646.c
index 8e568e4c35..2a59516a9d 100644
--- a/hw/ide/cmd646.c
+++ b/hw/ide/cmd646.c
@@ -317,7 +317,7 @@ static const Property cmd646_ide_properties[] = {
     DEFINE_PROP_UINT32("secondary", PCIIDEState, secondary, 0),
 };
 
-static void cmd646_ide_class_init(ObjectClass *klass, void *data)
+static void cmd646_ide_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
diff --git a/hw/ide/ich.c b/hw/ide/ich.c
index a83128465f..f2773ab462 100644
--- a/hw/ide/ich.c
+++ b/hw/ide/ich.c
@@ -175,7 +175,7 @@ static void pci_ich9_uninit(PCIDevice *dev)
     ahci_uninit(&d->ahci);
 }
 
-static void ich_ahci_class_init(ObjectClass *klass, void *data)
+static void ich_ahci_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
diff --git a/hw/ide/ide-bus.c b/hw/ide/ide-bus.c
index 437502b5b4..b24e4d17b4 100644
--- a/hw/ide/ide-bus.c
+++ b/hw/ide/ide-bus.c
@@ -29,7 +29,7 @@
 static char *idebus_get_fw_dev_path(DeviceState *dev);
 static void idebus_unrealize(BusState *qdev);
 
-static void ide_bus_class_init(ObjectClass *klass, void *data)
+static void ide_bus_class_init(ObjectClass *klass, const void *data)
 {
     BusClass *k = BUS_CLASS(klass);
 
diff --git a/hw/ide/ide-dev.c b/hw/ide/ide-dev.c
index 26f0517019..5d478588c6 100644
--- a/hw/ide/ide-dev.c
+++ b/hw/ide/ide-dev.c
@@ -198,7 +198,7 @@ static const Property ide_hd_properties[] = {
     DEFINE_PROP_UINT16("rotation_rate", IDEDrive, dev.rotation_rate, 0),
 };
 
-static void ide_hd_class_init(ObjectClass *klass, void *data)
+static void ide_hd_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     IDEDeviceClass *k = IDE_DEVICE_CLASS(klass);
@@ -220,7 +220,7 @@ static const Property ide_cd_properties[] = {
     DEFINE_IDE_DEV_PROPERTIES(),
 };
 
-static void ide_cd_class_init(ObjectClass *klass, void *data)
+static void ide_cd_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     IDEDeviceClass *k = IDE_DEVICE_CLASS(klass);
@@ -238,7 +238,7 @@ static const TypeInfo ide_cd_info = {
     .class_init    = ide_cd_class_init,
 };
 
-static void ide_device_class_init(ObjectClass *klass, void *data)
+static void ide_device_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *k = DEVICE_CLASS(klass);
     k->realize = ide_qdev_realize;
diff --git a/hw/ide/isa.c b/hw/ide/isa.c
index 4863ad8080..5f418413c1 100644
--- a/hw/ide/isa.c
+++ b/hw/ide/isa.c
@@ -107,7 +107,7 @@ static const Property isa_ide_properties[] = {
     DEFINE_PROP_UINT32("irq",     ISAIDEState, irqnum,  14),
 };
 
-static void isa_ide_class_initfn(ObjectClass *klass, void *data)
+static void isa_ide_class_initfn(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/ide/macio.c b/hw/ide/macio.c
index c8e8e44cc9..c23bf32d2b 100644
--- a/hw/ide/macio.c
+++ b/hw/ide/macio.c
@@ -463,7 +463,7 @@ static const Property macio_ide_properties[] = {
     DEFINE_PROP_UINT32("addr", MACIOIDEState, addr, -1),
 };
 
-static void macio_ide_class_init(ObjectClass *oc, void *data)
+static void macio_ide_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
diff --git a/hw/ide/mmio.c b/hw/ide/mmio.c
index 13f16170ff..699874db78 100644
--- a/hw/ide/mmio.c
+++ b/hw/ide/mmio.c
@@ -145,7 +145,7 @@ static const Property mmio_ide_properties[] = {
     DEFINE_PROP_UINT32("shift", MMIOIDEState, shift, 0),
 };
 
-static void mmio_ide_class_init(ObjectClass *oc, void *data)
+static void mmio_ide_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
diff --git a/hw/ide/piix.c b/hw/ide/piix.c
index 818ff60d6f..a0f2709c69 100644
--- a/hw/ide/piix.c
+++ b/hw/ide/piix.c
@@ -178,7 +178,7 @@ static void pci_piix_ide_exitfn(PCIDevice *dev)
 }
 
 /* NOTE: for the PIIX3, the IRQs and IOports are hardcoded */
-static void piix3_ide_class_init(ObjectClass *klass, void *data)
+static void piix3_ide_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
@@ -201,7 +201,7 @@ static const TypeInfo piix3_ide_info = {
 };
 
 /* NOTE: for the PIIX4, the IRQs and IOports are hardcoded */
-static void piix4_ide_class_init(ObjectClass *klass, void *data)
+static void piix4_ide_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
diff --git a/hw/ide/sii3112.c b/hw/ide/sii3112.c
index ce8a1e4cba..9b28c691fd 100644
--- a/hw/ide/sii3112.c
+++ b/hw/ide/sii3112.c
@@ -290,7 +290,7 @@ static void sii3112_pci_realize(PCIDevice *dev, Error **errp)
     }
 }
 
-static void sii3112_pci_class_init(ObjectClass *klass, void *data)
+static void sii3112_pci_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *pd = PCI_DEVICE_CLASS(klass);
diff --git a/hw/ide/via.c b/hw/ide/via.c
index 89fd28f646..dedc2674c0 100644
--- a/hw/ide/via.c
+++ b/hw/ide/via.c
@@ -245,7 +245,7 @@ static void via_ide_exitfn(PCIDevice *dev)
     }
 }
 
-static void via_ide_class_init(ObjectClass *klass, void *data)
+static void via_ide_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
diff --git a/hw/input/adb-kbd.c b/hw/input/adb-kbd.c
index 3649d03ef2..507557deec 100644
--- a/hw/input/adb-kbd.c
+++ b/hw/input/adb-kbd.c
@@ -375,7 +375,7 @@ static void adb_kbd_initfn(Object *obj)
     d->devaddr = ADB_DEVID_KEYBOARD;
 }
 
-static void adb_kbd_class_init(ObjectClass *oc, void *data)
+static void adb_kbd_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     ADBDeviceClass *adc = ADB_DEVICE_CLASS(oc);
diff --git a/hw/input/adb-mouse.c b/hw/input/adb-mouse.c
index 77b280d242..373ef3f953 100644
--- a/hw/input/adb-mouse.c
+++ b/hw/input/adb-mouse.c
@@ -287,7 +287,7 @@ static void adb_mouse_initfn(Object *obj)
     d->devaddr = ADB_DEVID_MOUSE;
 }
 
-static void adb_mouse_class_init(ObjectClass *oc, void *data)
+static void adb_mouse_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     ADBDeviceClass *adc = ADB_DEVICE_CLASS(oc);
diff --git a/hw/input/adb.c b/hw/input/adb.c
index aff7130fd0..bcb11edca3 100644
--- a/hw/input/adb.c
+++ b/hw/input/adb.c
@@ -259,7 +259,7 @@ static void adb_bus_unrealize(BusState *qbus)
     vmstate_unregister(NULL, &vmstate_adb_bus, adb_bus);
 }
 
-static void adb_bus_class_init(ObjectClass *klass, void *data)
+static void adb_bus_class_init(ObjectClass *klass, const void *data)
 {
     BusClass *k = BUS_CLASS(klass);
     ResettableClass *rc = RESETTABLE_CLASS(klass);
@@ -299,7 +299,7 @@ static void adb_device_realizefn(DeviceState *dev, Error **errp)
     bus->devices[bus->nb_devices++] = d;
 }
 
-static void adb_device_class_init(ObjectClass *oc, void *data)
+static void adb_device_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
diff --git a/hw/input/lasips2.c b/hw/input/lasips2.c
index 987034efd3..de625723c7 100644
--- a/hw/input/lasips2.c
+++ b/hw/input/lasips2.c
@@ -306,7 +306,7 @@ static void lasips2_init(Object *obj)
                             "lasips2-port-input-irq", 2);
 }
 
-static void lasips2_class_init(ObjectClass *klass, void *data)
+static void lasips2_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -347,7 +347,7 @@ static void lasips2_port_init(Object *obj)
                             "ps2-input-irq", 1);
 }
 
-static void lasips2_port_class_init(ObjectClass *klass, void *data)
+static void lasips2_port_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -397,7 +397,7 @@ static void lasips2_kbd_port_init(Object *obj)
     lp->lasips2 = container_of(s, LASIPS2State, kbd_port);
 }
 
-static void lasips2_kbd_port_class_init(ObjectClass *klass, void *data)
+static void lasips2_kbd_port_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     LASIPS2PortDeviceClass *lpdc = LASIPS2_PORT_CLASS(klass);
@@ -447,7 +447,7 @@ static void lasips2_mouse_port_init(Object *obj)
     lp->lasips2 = container_of(s, LASIPS2State, mouse_port);
 }
 
-static void lasips2_mouse_port_class_init(ObjectClass *klass, void *data)
+static void lasips2_mouse_port_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     LASIPS2PortDeviceClass *lpdc = LASIPS2_PORT_CLASS(klass);
diff --git a/hw/input/pckbd.c b/hw/input/pckbd.c
index fa0c549eb9..83930dd50c 100644
--- a/hw/input/pckbd.c
+++ b/hw/input/pckbd.c
@@ -750,7 +750,7 @@ static const VMStateDescription vmstate_kbd_mmio = {
     }
 };
 
-static void i8042_mmio_class_init(ObjectClass *klass, void *data)
+static void i8042_mmio_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -939,7 +939,7 @@ static const Property i8042_properties[] = {
     DEFINE_PROP_UINT8("mouse-irq", ISAKBDState, mouse_irq, 12),
 };
 
-static void i8042_class_initfn(ObjectClass *klass, void *data)
+static void i8042_class_initfn(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     AcpiDevAmlIfClass *adevc = ACPI_DEV_AML_IF_CLASS(klass);
diff --git a/hw/input/pl050.c b/hw/input/pl050.c
index 6519e260ed..c5f4a3fa84 100644
--- a/hw/input/pl050.c
+++ b/hw/input/pl050.c
@@ -203,7 +203,7 @@ static void pl050_mouse_init(Object *obj)
     object_initialize_child(obj, "mouse", &s->mouse, TYPE_PS2_MOUSE_DEVICE);
 }
 
-static void pl050_kbd_class_init(ObjectClass *oc, void *data)
+static void pl050_kbd_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     PL050DeviceClass *pdc = PL050_CLASS(oc);
@@ -220,7 +220,7 @@ static const TypeInfo pl050_kbd_info = {
     .class_init    = pl050_kbd_class_init,
 };
 
-static void pl050_mouse_class_init(ObjectClass *oc, void *data)
+static void pl050_mouse_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     PL050DeviceClass *pdc = PL050_CLASS(oc);
@@ -249,7 +249,7 @@ static void pl050_init(Object *obj)
     qdev_init_gpio_in_named(DEVICE(obj), pl050_set_irq, "ps2-input-irq", 1);
 }
 
-static void pl050_class_init(ObjectClass *oc, void *data)
+static void pl050_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
diff --git a/hw/input/ps2.c b/hw/input/ps2.c
index 6a41b024c8..7f7b1fce2e 100644
--- a/hw/input/ps2.c
+++ b/hw/input/ps2.c
@@ -1254,7 +1254,7 @@ static void ps2_mouse_realize(DeviceState *dev, Error **errp)
     qemu_input_handler_register(dev, &ps2_mouse_handler);
 }
 
-static void ps2_kbd_class_init(ObjectClass *klass, void *data)
+static void ps2_kbd_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     ResettableClass *rc = RESETTABLE_CLASS(klass);
@@ -1273,7 +1273,7 @@ static const TypeInfo ps2_kbd_info = {
     .class_init    = ps2_kbd_class_init
 };
 
-static void ps2_mouse_class_init(ObjectClass *klass, void *data)
+static void ps2_mouse_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     ResettableClass *rc = RESETTABLE_CLASS(klass);
@@ -1299,7 +1299,7 @@ static void ps2_init(Object *obj)
     qdev_init_gpio_out(DEVICE(obj), &s->irq, 1);
 }
 
-static void ps2_class_init(ObjectClass *klass, void *data)
+static void ps2_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     ResettableClass *rc = RESETTABLE_CLASS(klass);
diff --git a/hw/input/stellaris_gamepad.c b/hw/input/stellaris_gamepad.c
index 98382a0e15..fec1161c9c 100644
--- a/hw/input/stellaris_gamepad.c
+++ b/hw/input/stellaris_gamepad.c
@@ -82,7 +82,7 @@ static const Property stellaris_gamepad_properties[] = {
                       keycodes, qdev_prop_uint32, uint32_t),
 };
 
-static void stellaris_gamepad_class_init(ObjectClass *klass, void *data)
+static void stellaris_gamepad_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     ResettableClass *rc = RESETTABLE_CLASS(klass);
diff --git a/hw/input/virtio-input-hid.c b/hw/input/virtio-input-hid.c
index 812faaef8f..d986c3c16e 100644
--- a/hw/input/virtio-input-hid.c
+++ b/hw/input/virtio-input-hid.c
@@ -242,7 +242,7 @@ static const Property virtio_input_hid_properties[] = {
     DEFINE_PROP_UINT32("head", VirtIOInputHID, head, 0),
 };
 
-static void virtio_input_hid_class_init(ObjectClass *klass, void *data)
+static void virtio_input_hid_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtIOInputClass *vic = VIRTIO_INPUT_CLASS(klass);
@@ -383,7 +383,7 @@ static const Property virtio_mouse_properties[] = {
     DEFINE_PROP_BOOL("wheel-axis", VirtIOInputHID, wheel_axis, true),
 };
 
-static void virtio_mouse_class_init(ObjectClass *klass, void *data)
+static void virtio_mouse_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -507,7 +507,7 @@ static const Property virtio_tablet_properties[] = {
     DEFINE_PROP_BOOL("wheel-axis", VirtIOInputHID, wheel_axis, true),
 };
 
-static void virtio_tablet_class_init(ObjectClass *klass, void *data)
+static void virtio_tablet_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/input/virtio-input-host.c b/hw/input/virtio-input-host.c
index b21a79046e..bbfee9d3b9 100644
--- a/hw/input/virtio-input-host.c
+++ b/hw/input/virtio-input-host.c
@@ -224,7 +224,7 @@ static const Property virtio_input_host_properties[] = {
     DEFINE_PROP_STRING("evdev", VirtIOInputHost, evdev),
 };
 
-static void virtio_input_host_class_init(ObjectClass *klass, void *data)
+static void virtio_input_host_class_init(ObjectClass *klass, const void *data)
 {
     VirtIOInputClass *vic = VIRTIO_INPUT_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
diff --git a/hw/input/virtio-input.c b/hw/input/virtio-input.c
index 1394d99c6b..1818cbddc7 100644
--- a/hw/input/virtio-input.c
+++ b/hw/input/virtio-input.c
@@ -304,7 +304,7 @@ static const Property virtio_input_properties[] = {
     DEFINE_PROP_STRING("serial", VirtIOInput, serial),
 };
 
-static void virtio_input_class_init(ObjectClass *klass, void *data)
+static void virtio_input_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
diff --git a/hw/intc/allwinner-a10-pic.c b/hw/intc/allwinner-a10-pic.c
index 93a604f7a0..0409734155 100644
--- a/hw/intc/allwinner-a10-pic.c
+++ b/hw/intc/allwinner-a10-pic.c
@@ -187,7 +187,7 @@ static void aw_a10_pic_reset(DeviceState *d)
     }
 }
 
-static void aw_a10_pic_class_init(ObjectClass *klass, void *data)
+static void aw_a10_pic_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/intc/apic.c b/hw/intc/apic.c
index d18c1dbf2c..bcb103560c 100644
--- a/hw/intc/apic.c
+++ b/hw/intc/apic.c
@@ -1176,7 +1176,7 @@ static void apic_unrealize(DeviceState *dev)
     local_apics[s->initial_apic_id] = NULL;
 }
 
-static void apic_class_init(ObjectClass *klass, void *data)
+static void apic_class_init(ObjectClass *klass, const void *data)
 {
     APICCommonClass *k = APIC_COMMON_CLASS(klass);
 
diff --git a/hw/intc/apic_common.c b/hw/intc/apic_common.c
index 2a3e878c4d..37a7a7019d 100644
--- a/hw/intc/apic_common.c
+++ b/hw/intc/apic_common.c
@@ -466,7 +466,7 @@ static void apic_common_initfn(Object *obj)
                         apic_common_set_id, NULL, NULL);
 }
 
-static void apic_common_class_init(ObjectClass *klass, void *data)
+static void apic_common_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/intc/arm_gic.c b/hw/intc/arm_gic.c
index 3581ff8e8a..d18bef40fc 100644
--- a/hw/intc/arm_gic.c
+++ b/hw/intc/arm_gic.c
@@ -2162,7 +2162,7 @@ static void arm_gic_realize(DeviceState *dev, Error **errp)
 
 }
 
-static void arm_gic_class_init(ObjectClass *klass, void *data)
+static void arm_gic_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     ARMGICClass *agc = ARM_GIC_CLASS(klass);
diff --git a/hw/intc/arm_gic_common.c b/hw/intc/arm_gic_common.c
index 5ac56e3389..f61d1c1fe6 100644
--- a/hw/intc/arm_gic_common.c
+++ b/hw/intc/arm_gic_common.c
@@ -362,7 +362,7 @@ static const Property arm_gic_common_properties[] = {
     DEFINE_PROP_UINT32("num-priority-bits", GICState, n_prio_bits, 8),
 };
 
-static void arm_gic_common_class_init(ObjectClass *klass, void *data)
+static void arm_gic_common_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     ResettableClass *rc = RESETTABLE_CLASS(klass);
diff --git a/hw/intc/arm_gic_kvm.c b/hw/intc/arm_gic_kvm.c
index 40adb02865..1e9232f47c 100644
--- a/hw/intc/arm_gic_kvm.c
+++ b/hw/intc/arm_gic_kvm.c
@@ -584,7 +584,7 @@ static void kvm_arm_gic_realize(DeviceState *dev, Error **errp)
     }
 }
 
-static void kvm_arm_gic_class_init(ObjectClass *klass, void *data)
+static void kvm_arm_gic_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     ResettableClass *rc = RESETTABLE_CLASS(klass);
diff --git a/hw/intc/arm_gicv2m.c b/hw/intc/arm_gicv2m.c
index 3a8c62698c..cef0688221 100644
--- a/hw/intc/arm_gicv2m.c
+++ b/hw/intc/arm_gicv2m.c
@@ -175,7 +175,7 @@ static const Property gicv2m_properties[] = {
     DEFINE_PROP_UINT32("num-spi", ARMGICv2mState, num_spi, 64),
 };
 
-static void gicv2m_class_init(ObjectClass *klass, void *data)
+static void gicv2m_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/intc/arm_gicv3.c b/hw/intc/arm_gicv3.c
index 58e18fff54..6059ce926a 100644
--- a/hw/intc/arm_gicv3.c
+++ b/hw/intc/arm_gicv3.c
@@ -452,7 +452,7 @@ static void arm_gic_realize(DeviceState *dev, Error **errp)
     gicv3_init_cpuif(s);
 }
 
-static void arm_gicv3_class_init(ObjectClass *klass, void *data)
+static void arm_gicv3_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     ARMGICv3CommonClass *agcc = ARM_GICV3_COMMON_CLASS(klass);
diff --git a/hw/intc/arm_gicv3_common.c b/hw/intc/arm_gicv3_common.c
index 76b2283c92..dd86a50300 100644
--- a/hw/intc/arm_gicv3_common.c
+++ b/hw/intc/arm_gicv3_common.c
@@ -623,7 +623,7 @@ static const Property arm_gicv3_common_properties[] = {
                      MemoryRegion *),
 };
 
-static void arm_gicv3_common_class_init(ObjectClass *klass, void *data)
+static void arm_gicv3_common_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     ResettableClass *rc = RESETTABLE_CLASS(klass);
diff --git a/hw/intc/arm_gicv3_its.c b/hw/intc/arm_gicv3_its.c
index 936368c901..577b445405 100644
--- a/hw/intc/arm_gicv3_its.c
+++ b/hw/intc/arm_gicv3_its.c
@@ -2007,7 +2007,7 @@ static const Property gicv3_its_props[] = {
                      GICv3State *),
 };
 
-static void gicv3_its_class_init(ObjectClass *klass, void *data)
+static void gicv3_its_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     ResettableClass *rc = RESETTABLE_CLASS(klass);
diff --git a/hw/intc/arm_gicv3_its_common.c b/hw/intc/arm_gicv3_its_common.c
index 70dbee83a6..e946e3fb87 100644
--- a/hw/intc/arm_gicv3_its_common.c
+++ b/hw/intc/arm_gicv3_its_common.c
@@ -135,7 +135,7 @@ static void gicv3_its_common_reset_hold(Object *obj, ResetType type)
     memset(&s->baser, 0, sizeof(s->baser));
 }
 
-static void gicv3_its_common_class_init(ObjectClass *klass, void *data)
+static void gicv3_its_common_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     ResettableClass *rc = RESETTABLE_CLASS(klass);
diff --git a/hw/intc/arm_gicv3_its_kvm.c b/hw/intc/arm_gicv3_its_kvm.c
index e198974560..9812d50859 100644
--- a/hw/intc/arm_gicv3_its_kvm.c
+++ b/hw/intc/arm_gicv3_its_kvm.c
@@ -239,7 +239,7 @@ static const Property kvm_arm_its_props[] = {
                      GICv3State *),
 };
 
-static void kvm_arm_its_class_init(ObjectClass *klass, void *data)
+static void kvm_arm_its_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     ResettableClass *rc = RESETTABLE_CLASS(klass);
diff --git a/hw/intc/arm_gicv3_kvm.c b/hw/intc/arm_gicv3_kvm.c
index 8e17cab2a0..3be3bf6c28 100644
--- a/hw/intc/arm_gicv3_kvm.c
+++ b/hw/intc/arm_gicv3_kvm.c
@@ -893,7 +893,7 @@ static void kvm_arm_gicv3_realize(DeviceState *dev, Error **errp)
     }
 }
 
-static void kvm_arm_gicv3_class_init(ObjectClass *klass, void *data)
+static void kvm_arm_gicv3_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     ResettableClass *rc = RESETTABLE_CLASS(klass);
diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index 7212c87c68..83ff74f899 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -2730,7 +2730,7 @@ static void armv7m_nvic_instance_init(Object *obj)
     qdev_init_gpio_in_named(dev, nvic_nmi_trigger, "NMI", 1);
 }
 
-static void armv7m_nvic_class_init(ObjectClass *klass, void *data)
+static void armv7m_nvic_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/intc/aspeed_intc.c b/hw/intc/aspeed_intc.c
index bae7dc95ea..be7f516a3b 100644
--- a/hw/intc/aspeed_intc.c
+++ b/hw/intc/aspeed_intc.c
@@ -583,7 +583,7 @@ static void aspeed_intc_unrealize(DeviceState *dev)
     s->regs = NULL;
 }
 
-static void aspeed_intc_class_init(ObjectClass *klass, void *data)
+static void aspeed_intc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     AspeedINTCClass *aic = ASPEED_INTC_CLASS(klass);
@@ -620,7 +620,7 @@ static AspeedINTCIRQ aspeed_2700_intc_irqs[ASPEED_INTC_MAX_INPINS] = {
     {9, 18, 1, R_GICINT136_EN, R_GICINT136_STATUS},
 };
 
-static void aspeed_2700_intc_class_init(ObjectClass *klass, void *data)
+static void aspeed_2700_intc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     AspeedINTCClass *aic = ASPEED_INTC_CLASS(klass);
@@ -651,7 +651,7 @@ static AspeedINTCIRQ aspeed_2700_intcio_irqs[ASPEED_INTC_MAX_INPINS] = {
     {5, 5, 1, R_GICINT197_EN, R_GICINT197_STATUS},
 };
 
-static void aspeed_2700_intcio_class_init(ObjectClass *klass, void *data)
+static void aspeed_2700_intcio_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     AspeedINTCClass *aic = ASPEED_INTC_CLASS(klass);
diff --git a/hw/intc/aspeed_vic.c b/hw/intc/aspeed_vic.c
index 55fe51a667..7120088454 100644
--- a/hw/intc/aspeed_vic.c
+++ b/hw/intc/aspeed_vic.c
@@ -339,7 +339,7 @@ static const VMStateDescription vmstate_aspeed_vic = {
     }
 };
 
-static void aspeed_vic_class_init(ObjectClass *klass, void *data)
+static void aspeed_vic_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     dc->realize = aspeed_vic_realize;
diff --git a/hw/intc/bcm2835_ic.c b/hw/intc/bcm2835_ic.c
index 4a42fcf60d..55e0a5a503 100644
--- a/hw/intc/bcm2835_ic.c
+++ b/hw/intc/bcm2835_ic.c
@@ -219,7 +219,7 @@ static const VMStateDescription vmstate_bcm2835_ic = {
     }
 };
 
-static void bcm2835_ic_class_init(ObjectClass *klass, void *data)
+static void bcm2835_ic_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/intc/bcm2836_control.c b/hw/intc/bcm2836_control.c
index 197a0e2ccf..1c02853669 100644
--- a/hw/intc/bcm2836_control.c
+++ b/hw/intc/bcm2836_control.c
@@ -384,7 +384,7 @@ static const VMStateDescription vmstate_bcm2836_control = {
     }
 };
 
-static void bcm2836_control_class_init(ObjectClass *klass, void *data)
+static void bcm2836_control_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/intc/exynos4210_combiner.c b/hw/intc/exynos4210_combiner.c
index 6ddbcd4c6d..ebbe23436f 100644
--- a/hw/intc/exynos4210_combiner.c
+++ b/hw/intc/exynos4210_combiner.c
@@ -329,7 +329,7 @@ static const Property exynos4210_combiner_properties[] = {
     DEFINE_PROP_UINT32("external", Exynos4210CombinerState, external, 0),
 };
 
-static void exynos4210_combiner_class_init(ObjectClass *klass, void *data)
+static void exynos4210_combiner_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/intc/exynos4210_gic.c b/hw/intc/exynos4210_gic.c
index 01a53936d3..7e2d79d00c 100644
--- a/hw/intc/exynos4210_gic.c
+++ b/hw/intc/exynos4210_gic.c
@@ -115,7 +115,7 @@ static const Property exynos4210_gic_properties[] = {
     DEFINE_PROP_UINT32("num-cpu", Exynos4210GicState, num_cpu, 1),
 };
 
-static void exynos4210_gic_class_init(ObjectClass *klass, void *data)
+static void exynos4210_gic_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/intc/goldfish_pic.c b/hw/intc/goldfish_pic.c
index aa5162c18f..b80538cdeb 100644
--- a/hw/intc/goldfish_pic.c
+++ b/hw/intc/goldfish_pic.c
@@ -185,7 +185,7 @@ static const Property goldfish_pic_properties[] = {
     DEFINE_PROP_UINT8("index", GoldfishPICState, idx, 0),
 };
 
-static void goldfish_pic_class_init(ObjectClass *oc, void *data)
+static void goldfish_pic_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     InterruptStatsProviderClass *ic = INTERRUPT_STATS_PROVIDER_CLASS(oc);
diff --git a/hw/intc/grlib_irqmp.c b/hw/intc/grlib_irqmp.c
index 95cdb411d2..e0f26466ba 100644
--- a/hw/intc/grlib_irqmp.c
+++ b/hw/intc/grlib_irqmp.c
@@ -380,7 +380,7 @@ static const Property grlib_irqmp_properties[] = {
     DEFINE_PROP_UINT32("ncpus", IRQMP, ncpus, 1),
 };
 
-static void grlib_irqmp_class_init(ObjectClass *klass, void *data)
+static void grlib_irqmp_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/intc/heathrow_pic.c b/hw/intc/heathrow_pic.c
index 729498f1df..447e8c25d8 100644
--- a/hw/intc/heathrow_pic.c
+++ b/hw/intc/heathrow_pic.c
@@ -184,7 +184,7 @@ static void heathrow_init(Object *obj)
     sysbus_init_mmio(sbd, &s->mem);
 }
 
-static void heathrow_class_init(ObjectClass *oc, void *data)
+static void heathrow_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
diff --git a/hw/intc/i8259.c b/hw/intc/i8259.c
index d88b20f40b..2359dd8253 100644
--- a/hw/intc/i8259.c
+++ b/hw/intc/i8259.c
@@ -436,7 +436,7 @@ qemu_irq *i8259_init(ISABus *bus, qemu_irq parent_irq_in)
     return irq_set;
 }
 
-static void i8259_class_init(ObjectClass *klass, void *data)
+static void i8259_class_init(ObjectClass *klass, const void *data)
 {
     PICClass *k = PIC_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
diff --git a/hw/intc/i8259_common.c b/hw/intc/i8259_common.c
index c77ff683bb..4a92e0da90 100644
--- a/hw/intc/i8259_common.c
+++ b/hw/intc/i8259_common.c
@@ -200,7 +200,7 @@ static const Property pic_properties_common[] = {
     DEFINE_PROP_BIT("master", PICCommonState, master,  0, false),
 };
 
-static void pic_common_class_init(ObjectClass *klass, void *data)
+static void pic_common_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     InterruptStatsProviderClass *ic = INTERRUPT_STATS_PROVIDER_CLASS(klass);
diff --git a/hw/intc/imx_avic.c b/hw/intc/imx_avic.c
index e1c9ce769d..09c3bfac0b 100644
--- a/hw/intc/imx_avic.c
+++ b/hw/intc/imx_avic.c
@@ -341,7 +341,7 @@ static void imx_avic_init(Object *obj)
 }
 
 
-static void imx_avic_class_init(ObjectClass *klass, void *data)
+static void imx_avic_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/intc/imx_gpcv2.c b/hw/intc/imx_gpcv2.c
index 9e5cf28371..58d286c1cf 100644
--- a/hw/intc/imx_gpcv2.c
+++ b/hw/intc/imx_gpcv2.c
@@ -102,7 +102,7 @@ static const VMStateDescription vmstate_imx_gpcv2 = {
     },
 };
 
-static void imx_gpcv2_class_init(ObjectClass *klass, void *data)
+static void imx_gpcv2_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/intc/ioapic.c b/hw/intc/ioapic.c
index 8cd1d85e06..133bef852d 100644
--- a/hw/intc/ioapic.c
+++ b/hw/intc/ioapic.c
@@ -480,7 +480,7 @@ static const Property ioapic_properties[] = {
     DEFINE_PROP_UINT8("version", IOAPICCommonState, version, IOAPIC_VER_DEF),
 };
 
-static void ioapic_class_init(ObjectClass *klass, void *data)
+static void ioapic_class_init(ObjectClass *klass, const void *data)
 {
     IOAPICCommonClass *k = IOAPIC_COMMON_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
diff --git a/hw/intc/ioapic_common.c b/hw/intc/ioapic_common.c
index 769896353a..b0381c7990 100644
--- a/hw/intc/ioapic_common.c
+++ b/hw/intc/ioapic_common.c
@@ -197,7 +197,7 @@ static const VMStateDescription vmstate_ioapic_common = {
     }
 };
 
-static void ioapic_common_class_init(ObjectClass *klass, void *data)
+static void ioapic_common_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     InterruptStatsProviderClass *ic = INTERRUPT_STATS_PROVIDER_CLASS(klass);
diff --git a/hw/intc/loongarch_extioi.c b/hw/intc/loongarch_extioi.c
index a558c50185..f4fe961a98 100644
--- a/hw/intc/loongarch_extioi.c
+++ b/hw/intc/loongarch_extioi.c
@@ -401,7 +401,7 @@ static int vmstate_extioi_post_load(void *opaque, int version_id)
     return 0;
 }
 
-static void loongarch_extioi_class_init(ObjectClass *klass, void *data)
+static void loongarch_extioi_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     LoongArchExtIOIClass *lec = LOONGARCH_EXTIOI_CLASS(klass);
diff --git a/hw/intc/loongarch_extioi_common.c b/hw/intc/loongarch_extioi_common.c
index ff3974f2a1..126f13d12c 100644
--- a/hw/intc/loongarch_extioi_common.c
+++ b/hw/intc/loongarch_extioi_common.c
@@ -174,7 +174,8 @@ static const Property extioi_properties[] = {
                     features, EXTIOI_HAS_VIRT_EXTENSION, 0),
 };
 
-static void loongarch_extioi_common_class_init(ObjectClass *klass, void *data)
+static void loongarch_extioi_common_class_init(ObjectClass *klass,
+                                               const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     LoongArchExtIOICommonClass *lecc = LOONGARCH_EXTIOI_COMMON_CLASS(klass);
diff --git a/hw/intc/loongarch_ipi.c b/hw/intc/loongarch_ipi.c
index b10641dd03..4dad240689 100644
--- a/hw/intc/loongarch_ipi.c
+++ b/hw/intc/loongarch_ipi.c
@@ -140,7 +140,7 @@ static void loongarch_ipi_cpu_unplug(HotplugHandler *hotplug_dev,
     core->cpu = NULL;
 }
 
-static void loongarch_ipi_class_init(ObjectClass *klass, void *data)
+static void loongarch_ipi_class_init(ObjectClass *klass, const void *data)
 {
     LoongsonIPICommonClass *licc = LOONGSON_IPI_COMMON_CLASS(klass);
     HotplugHandlerClass *hc = HOTPLUG_HANDLER_CLASS(klass);
diff --git a/hw/intc/loongarch_pch_msi.c b/hw/intc/loongarch_pch_msi.c
index bc93504ff7..06eb944da0 100644
--- a/hw/intc/loongarch_pch_msi.c
+++ b/hw/intc/loongarch_pch_msi.c
@@ -79,7 +79,7 @@ static const Property loongarch_msi_properties[] = {
     DEFINE_PROP_UINT32("msi_irq_num",  LoongArchPCHMSI, irq_num, 0),
 };
 
-static void loongarch_pch_msi_class_init(ObjectClass *klass, void *data)
+static void loongarch_pch_msi_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/intc/loongarch_pch_pic.c b/hw/intc/loongarch_pch_pic.c
index acd75ccb0c..6c2b6de3f0 100644
--- a/hw/intc/loongarch_pch_pic.c
+++ b/hw/intc/loongarch_pch_pic.c
@@ -404,7 +404,7 @@ static void loongarch_pic_realize(DeviceState *dev, Error **errp)
 
 }
 
-static void loongarch_pic_class_init(ObjectClass *klass, void *data)
+static void loongarch_pic_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     LoongarchPICClass *lpc = LOONGARCH_PIC_CLASS(klass);
diff --git a/hw/intc/loongarch_pic_common.c b/hw/intc/loongarch_pic_common.c
index e7f541db4b..fdb250c418 100644
--- a/hw/intc/loongarch_pic_common.c
+++ b/hw/intc/loongarch_pic_common.c
@@ -71,7 +71,8 @@ static const VMStateDescription vmstate_loongarch_pic_common = {
     }
 };
 
-static void loongarch_pic_common_class_init(ObjectClass *klass, void *data)
+static void loongarch_pic_common_class_init(ObjectClass *klass,
+                                            const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     LoongArchPICCommonClass *lpcc = LOONGARCH_PIC_COMMON_CLASS(klass);
diff --git a/hw/intc/loongson_ipi.c b/hw/intc/loongson_ipi.c
index d2268a27f8..fbc73e8b00 100644
--- a/hw/intc/loongson_ipi.c
+++ b/hw/intc/loongson_ipi.c
@@ -101,7 +101,7 @@ static const Property loongson_ipi_properties[] = {
     DEFINE_PROP_UINT32("num-cpu", LoongsonIPICommonState, num_cpu, 1),
 };
 
-static void loongson_ipi_class_init(ObjectClass *klass, void *data)
+static void loongson_ipi_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     LoongsonIPIClass *lic = LOONGSON_IPI_CLASS(klass);
diff --git a/hw/intc/loongson_ipi_common.c b/hw/intc/loongson_ipi_common.c
index f5ab5024c0..f32661c40f 100644
--- a/hw/intc/loongson_ipi_common.c
+++ b/hw/intc/loongson_ipi_common.c
@@ -303,7 +303,7 @@ static const VMStateDescription vmstate_loongson_ipi_common = {
     }
 };
 
-static void loongson_ipi_common_class_init(ObjectClass *klass, void *data)
+static void loongson_ipi_common_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     LoongsonIPICommonClass *licc = LOONGSON_IPI_COMMON_CLASS(klass);
diff --git a/hw/intc/m68k_irqc.c b/hw/intc/m68k_irqc.c
index a82b80f5c6..215e1a6ed5 100644
--- a/hw/intc/m68k_irqc.c
+++ b/hw/intc/m68k_irqc.c
@@ -90,7 +90,7 @@ static const Property m68k_irqc_properties[] = {
                      TYPE_M68K_CPU, ArchCPU *),
 };
 
-static void m68k_irqc_class_init(ObjectClass *oc, void *data)
+static void m68k_irqc_class_init(ObjectClass *oc, const void *data)
  {
     DeviceClass *dc = DEVICE_CLASS(oc);
     NMIClass *nc = NMI_CLASS(oc);
diff --git a/hw/intc/mips_gic.c b/hw/intc/mips_gic.c
index 627a76ba7b..0c50ba41f6 100644
--- a/hw/intc/mips_gic.c
+++ b/hw/intc/mips_gic.c
@@ -442,7 +442,7 @@ static const Property mips_gic_properties[] = {
     DEFINE_PROP_UINT32("num-irq", MIPSGICState, num_irq, 256),
 };
 
-static void mips_gic_class_init(ObjectClass *klass, void *data)
+static void mips_gic_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/intc/omap_intc.c b/hw/intc/omap_intc.c
index 095a3d504f..9e8737be33 100644
--- a/hw/intc/omap_intc.c
+++ b/hw/intc/omap_intc.c
@@ -379,7 +379,7 @@ static const Property omap_intc_properties[] = {
     DEFINE_PROP_UINT32("size", OMAPIntcState, size, 0x100),
 };
 
-static void omap_intc_class_init(ObjectClass *klass, void *data)
+static void omap_intc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/intc/ompic.c b/hw/intc/ompic.c
index 169baf2ded..047c367478 100644
--- a/hw/intc/ompic.c
+++ b/hw/intc/ompic.c
@@ -155,7 +155,7 @@ static const VMStateDescription vmstate_or1k_ompic = {
     }
 };
 
-static void or1k_ompic_class_init(ObjectClass *klass, void *data)
+static void or1k_ompic_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/intc/openpic.c b/hw/intc/openpic.c
index 78a82d0d30..87733eb7c3 100644
--- a/hw/intc/openpic.c
+++ b/hw/intc/openpic.c
@@ -1611,7 +1611,7 @@ static const Property openpic_properties[] = {
     DEFINE_PROP_UINT32("nb_cpus", OpenPICState, nb_cpus, 1),
 };
 
-static void openpic_class_init(ObjectClass *oc, void *data)
+static void openpic_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
diff --git a/hw/intc/openpic_kvm.c b/hw/intc/openpic_kvm.c
index 9cdaa97004..673ea9ca05 100644
--- a/hw/intc/openpic_kvm.c
+++ b/hw/intc/openpic_kvm.c
@@ -267,7 +267,7 @@ static const Property kvm_openpic_properties[] = {
                        OPENPIC_MODEL_FSL_MPIC_20),
 };
 
-static void kvm_openpic_class_init(ObjectClass *oc, void *data)
+static void kvm_openpic_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
diff --git a/hw/intc/pl190.c b/hw/intc/pl190.c
index a5e2d76315..838c21c4a0 100644
--- a/hw/intc/pl190.c
+++ b/hw/intc/pl190.c
@@ -273,7 +273,7 @@ static const VMStateDescription vmstate_pl190 = {
     }
 };
 
-static void pl190_class_init(ObjectClass *klass, void *data)
+static void pl190_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/intc/pnv_xive.c b/hw/intc/pnv_xive.c
index ccbe95a58e..cd73881b5b 100644
--- a/hw/intc/pnv_xive.c
+++ b/hw/intc/pnv_xive.c
@@ -2068,7 +2068,7 @@ static const Property pnv_xive_properties[] = {
     DEFINE_PROP_LINK("chip", PnvXive, chip, TYPE_PNV_CHIP, PnvChip *),
 };
 
-static void pnv_xive_class_init(ObjectClass *klass, void *data)
+static void pnv_xive_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PnvXScomInterfaceClass *xdc = PNV_XSCOM_INTERFACE_CLASS(klass);
diff --git a/hw/intc/pnv_xive2.c b/hw/intc/pnv_xive2.c
index 0b81dad6ba..02437dddac 100644
--- a/hw/intc/pnv_xive2.c
+++ b/hw/intc/pnv_xive2.c
@@ -2505,7 +2505,7 @@ static int pnv_xive2_dt_xscom(PnvXScomInterface *dev, void *fdt,
     return 0;
 }
 
-static void pnv_xive2_class_init(ObjectClass *klass, void *data)
+static void pnv_xive2_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PnvXScomInterfaceClass *xdc = PNV_XSCOM_INTERFACE_CLASS(klass);
diff --git a/hw/intc/ppc-uic.c b/hw/intc/ppc-uic.c
index 7de4bf9885..bc4dc90ade 100644
--- a/hw/intc/ppc-uic.c
+++ b/hw/intc/ppc-uic.c
@@ -281,7 +281,7 @@ static const VMStateDescription ppc_uic_vmstate = {
     },
 };
 
-static void ppc_uic_class_init(ObjectClass *klass, void *data)
+static void ppc_uic_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/intc/realview_gic.c b/hw/intc/realview_gic.c
index 9b12116b2a..63e25c2a78 100644
--- a/hw/intc/realview_gic.c
+++ b/hw/intc/realview_gic.c
@@ -63,7 +63,7 @@ static void realview_gic_init(Object *obj)
     qdev_prop_set_uint32(DEVICE(&s->gic), "num-cpu", 1);
 }
 
-static void realview_gic_class_init(ObjectClass *oc, void *data)
+static void realview_gic_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
diff --git a/hw/intc/riscv_aclint.c b/hw/intc/riscv_aclint.c
index db374a7c2d..b0139f03f5 100644
--- a/hw/intc/riscv_aclint.c
+++ b/hw/intc/riscv_aclint.c
@@ -328,7 +328,7 @@ static const VMStateDescription vmstate_riscv_mtimer = {
         }
 };
 
-static void riscv_aclint_mtimer_class_init(ObjectClass *klass, void *data)
+static void riscv_aclint_mtimer_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     dc->realize = riscv_aclint_mtimer_realize;
@@ -509,7 +509,7 @@ static void riscv_aclint_swi_reset_enter(Object *obj, ResetType type)
     }
 }
 
-static void riscv_aclint_swi_class_init(ObjectClass *klass, void *data)
+static void riscv_aclint_swi_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     dc->realize = riscv_aclint_swi_realize;
diff --git a/hw/intc/riscv_aplic.c b/hw/intc/riscv_aplic.c
index 789c4a4d6e..8bcd9f4697 100644
--- a/hw/intc/riscv_aplic.c
+++ b/hw/intc/riscv_aplic.c
@@ -997,7 +997,7 @@ static const VMStateDescription vmstate_riscv_aplic = {
         }
 };
 
-static void riscv_aplic_class_init(ObjectClass *klass, void *data)
+static void riscv_aplic_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/intc/riscv_imsic.c b/hw/intc/riscv_imsic.c
index 852f413e5a..2169988167 100644
--- a/hw/intc/riscv_imsic.c
+++ b/hw/intc/riscv_imsic.c
@@ -416,7 +416,7 @@ static const VMStateDescription vmstate_riscv_imsic = {
         }
 };
 
-static void riscv_imsic_class_init(ObjectClass *klass, void *data)
+static void riscv_imsic_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/intc/rx_icu.c b/hw/intc/rx_icu.c
index ca13c5fb37..f8615527b7 100644
--- a/hw/intc/rx_icu.c
+++ b/hw/intc/rx_icu.c
@@ -368,7 +368,7 @@ static const Property rxicu_properties[] = {
                       qdev_prop_uint8, uint8_t),
 };
 
-static void rxicu_class_init(ObjectClass *klass, void *data)
+static void rxicu_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/intc/s390_flic.c b/hw/intc/s390_flic.c
index 4fae023197..8f4c9fd52e 100644
--- a/hw/intc/s390_flic.c
+++ b/hw/intc/s390_flic.c
@@ -450,7 +450,7 @@ static const Property qemu_s390_flic_properties[] = {
                      migrate_all_state, true),
 };
 
-static void qemu_s390_flic_class_init(ObjectClass *oc, void *data)
+static void qemu_s390_flic_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     S390FLICStateClass *fsc = S390_FLIC_COMMON_CLASS(oc);
@@ -477,7 +477,7 @@ static void s390_flic_common_realize(DeviceState *dev, Error **errp)
     fs->ais_supported = s390_has_feat(S390_FEAT_ADAPTER_INT_SUPPRESSION);
 }
 
-static void s390_flic_class_init(ObjectClass *oc, void *data)
+static void s390_flic_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
diff --git a/hw/intc/s390_flic_kvm.c b/hw/intc/s390_flic_kvm.c
index 10aaafbb31..f833a3996a 100644
--- a/hw/intc/s390_flic_kvm.c
+++ b/hw/intc/s390_flic_kvm.c
@@ -670,7 +670,7 @@ static void kvm_s390_flic_reset(DeviceState *dev)
     flic_enable_pfault(flic);
 }
 
-static void kvm_s390_flic_class_init(ObjectClass *oc, void *data)
+static void kvm_s390_flic_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     S390FLICStateClass *fsc = S390_FLIC_COMMON_CLASS(oc);
diff --git a/hw/intc/sifive_plic.c b/hw/intc/sifive_plic.c
index a5b0f6ef1b..3160b216fd 100644
--- a/hw/intc/sifive_plic.c
+++ b/hw/intc/sifive_plic.c
@@ -446,7 +446,7 @@ static const Property sifive_plic_properties[] = {
     DEFINE_PROP_UINT32("aperture-size", SiFivePLICState, aperture_size, 0),
 };
 
-static void sifive_plic_class_init(ObjectClass *klass, void *data)
+static void sifive_plic_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/intc/slavio_intctl.c b/hw/intc/slavio_intctl.c
index f83709a857..5776055a8b 100644
--- a/hw/intc/slavio_intctl.c
+++ b/hw/intc/slavio_intctl.c
@@ -441,7 +441,7 @@ static void slavio_intctl_init(Object *obj)
     }
 }
 
-static void slavio_intctl_class_init(ObjectClass *klass, void *data)
+static void slavio_intctl_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     InterruptStatsProviderClass *ic = INTERRUPT_STATS_PROVIDER_CLASS(klass);
diff --git a/hw/intc/spapr_xive.c b/hw/intc/spapr_xive.c
index ce734b03ab..7fde6059bf 100644
--- a/hw/intc/spapr_xive.c
+++ b/hw/intc/spapr_xive.c
@@ -809,7 +809,7 @@ static bool spapr_xive_in_kernel_xptr(const XivePresenter *xptr)
     return spapr_xive_in_kernel(SPAPR_XIVE(xptr));
 }
 
-static void spapr_xive_class_init(ObjectClass *klass, void *data)
+static void spapr_xive_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     XiveRouterClass *xrc = XIVE_ROUTER_CLASS(klass);
diff --git a/hw/intc/xics.c b/hw/intc/xics.c
index 9c1b7bbe9e..d9a199e883 100644
--- a/hw/intc/xics.c
+++ b/hw/intc/xics.c
@@ -350,7 +350,7 @@ static const Property icp_properties[] = {
     DEFINE_PROP_LINK(ICP_PROP_CPU, ICPState, cs, TYPE_CPU, CPUState *),
 };
 
-static void icp_class_init(ObjectClass *klass, void *data)
+static void icp_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -681,7 +681,7 @@ static const Property ics_properties[] = {
                      XICSFabric *),
 };
 
-static void ics_class_init(ObjectClass *klass, void *data)
+static void ics_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     ResettableClass *rc = RESETTABLE_CLASS(klass);
diff --git a/hw/intc/xics_pnv.c b/hw/intc/xics_pnv.c
index 753c067f17..ff602d9a34 100644
--- a/hw/intc/xics_pnv.c
+++ b/hw/intc/xics_pnv.c
@@ -176,7 +176,7 @@ static void pnv_icp_realize(DeviceState *dev, Error **errp)
                           icp, "icp-thread", 0x1000);
 }
 
-static void pnv_icp_class_init(ObjectClass *klass, void *data)
+static void pnv_icp_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     ICPStateClass *icpc = ICP_CLASS(klass);
diff --git a/hw/intc/xics_spapr.c b/hw/intc/xics_spapr.c
index a0d97bdefe..9e465fb8f3 100644
--- a/hw/intc/xics_spapr.c
+++ b/hw/intc/xics_spapr.c
@@ -436,7 +436,7 @@ static void xics_spapr_deactivate(SpaprInterruptController *intc)
     }
 }
 
-static void ics_spapr_class_init(ObjectClass *klass, void *data)
+static void ics_spapr_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     ICSStateClass *isc = ICS_CLASS(klass);
diff --git a/hw/intc/xilinx_intc.c b/hw/intc/xilinx_intc.c
index ab1c4a3222..5257ad54b1 100644
--- a/hw/intc/xilinx_intc.c
+++ b/hw/intc/xilinx_intc.c
@@ -214,7 +214,7 @@ static const Property xilinx_intc_properties[] = {
     DEFINE_PROP_UINT32("kind-of-intr", XpsIntc, c_kind_of_intr, 0),
 };
 
-static void xilinx_intc_class_init(ObjectClass *klass, void *data)
+static void xilinx_intc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/intc/xive.c b/hw/intc/xive.c
index 3eb28c2265..069c1e9a5e 100644
--- a/hw/intc/xive.c
+++ b/hw/intc/xive.c
@@ -930,7 +930,7 @@ static const Property xive_tctx_properties[] = {
                      XivePresenter *),
 };
 
-static void xive_tctx_class_init(ObjectClass *klass, void *data)
+static void xive_tctx_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -1412,7 +1412,7 @@ static const Property xive_source_properties[] = {
                      XiveNotifier *),
 };
 
-static void xive_source_class_init(ObjectClass *klass, void *data)
+static void xive_source_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -2085,7 +2085,7 @@ static const Property xive_router_properties[] = {
                      TYPE_XIVE_FABRIC, XiveFabric *),
 };
 
-static void xive_router_class_init(ObjectClass *klass, void *data)
+static void xive_router_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     XiveNotifierClass *xnc = XIVE_NOTIFIER_CLASS(klass);
@@ -2254,7 +2254,7 @@ static const Property xive_end_source_properties[] = {
                      XiveRouter *),
 };
 
-static void xive_end_source_class_init(ObjectClass *klass, void *data)
+static void xive_end_source_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/intc/xive2.c b/hw/intc/xive2.c
index 7d584dfafa..3337a943fb 100644
--- a/hw/intc/xive2.c
+++ b/hw/intc/xive2.c
@@ -1590,7 +1590,7 @@ static const Property xive2_router_properties[] = {
                      TYPE_XIVE_FABRIC, XiveFabric *),
 };
 
-static void xive2_router_class_init(ObjectClass *klass, void *data)
+static void xive2_router_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     XiveNotifierClass *xnc = XIVE_NOTIFIER_CLASS(klass);
@@ -1805,7 +1805,7 @@ static const Property xive2_end_source_properties[] = {
                      Xive2Router *),
 };
 
-static void xive2_end_source_class_init(ObjectClass *klass, void *data)
+static void xive2_end_source_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/intc/xlnx-pmu-iomod-intc.c b/hw/intc/xlnx-pmu-iomod-intc.c
index ccdab244b3..9200585e32 100644
--- a/hw/intc/xlnx-pmu-iomod-intc.c
+++ b/hw/intc/xlnx-pmu-iomod-intc.c
@@ -531,7 +531,7 @@ static const VMStateDescription vmstate_xlnx_pmu_io_intc = {
     }
 };
 
-static void xlnx_pmu_io_intc_class_init(ObjectClass *klass, void *data)
+static void xlnx_pmu_io_intc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/intc/xlnx-zynqmp-ipi.c b/hw/intc/xlnx-zynqmp-ipi.c
index 7241377298..610cd0e316 100644
--- a/hw/intc/xlnx-zynqmp-ipi.c
+++ b/hw/intc/xlnx-zynqmp-ipi.c
@@ -355,7 +355,7 @@ static const VMStateDescription vmstate_zynqmp_pmu_ipi = {
     }
 };
 
-static void xlnx_zynqmp_ipi_class_init(ObjectClass *klass, void *data)
+static void xlnx_zynqmp_ipi_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/ipack/ipack.c b/hw/ipack/ipack.c
index b6defae602..ab602bff73 100644
--- a/hw/ipack/ipack.c
+++ b/hw/ipack/ipack.c
@@ -74,7 +74,7 @@ static const Property ipack_device_props[] = {
     DEFINE_PROP_INT32("slot", IPackDevice, slot, -1),
 };
 
-static void ipack_device_class_init(ObjectClass *klass, void *data)
+static void ipack_device_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *k = DEVICE_CLASS(klass);
 
diff --git a/hw/ipack/tpci200.c b/hw/ipack/tpci200.c
index 470a4203ae..f6993330d2 100644
--- a/hw/ipack/tpci200.c
+++ b/hw/ipack/tpci200.c
@@ -629,7 +629,7 @@ static const VMStateDescription vmstate_tpci200 = {
     }
 };
 
-static void tpci200_class_init(ObjectClass *klass, void *data)
+static void tpci200_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
diff --git a/hw/ipmi/ipmi.c b/hw/ipmi/ipmi.c
index fdeaa5269f..b91e487e1b 100644
--- a/hw/ipmi/ipmi.c
+++ b/hw/ipmi/ipmi.c
@@ -78,7 +78,7 @@ static int ipmi_do_hw_op(IPMIInterface *s, enum ipmi_op op, int checkonly)
     }
 }
 
-static void ipmi_interface_class_init(ObjectClass *class, void *data)
+static void ipmi_interface_class_init(ObjectClass *class, const void *data)
 {
     IPMIInterfaceClass *ik = IPMI_INTERFACE_CLASS(class);
 
@@ -112,7 +112,7 @@ static const Property ipmi_bmc_properties[] = {
     DEFINE_PROP_UINT8("slave_addr",  IPMIBmc, slave_addr, 0x20),
 };
 
-static void bmc_class_init(ObjectClass *oc, void *data)
+static void bmc_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
diff --git a/hw/ipmi/ipmi_bmc_extern.c b/hw/ipmi/ipmi_bmc_extern.c
index e563214390..9f1ba7b2f8 100644
--- a/hw/ipmi/ipmi_bmc_extern.c
+++ b/hw/ipmi/ipmi_bmc_extern.c
@@ -513,7 +513,7 @@ static const Property ipmi_bmc_extern_properties[] = {
     DEFINE_PROP_CHR("chardev", IPMIBmcExtern, chr),
 };
 
-static void ipmi_bmc_extern_class_init(ObjectClass *oc, void *data)
+static void ipmi_bmc_extern_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     IPMIBmcClass *bk = IPMI_BMC_CLASS(oc);
diff --git a/hw/ipmi/ipmi_bmc_sim.c b/hw/ipmi/ipmi_bmc_sim.c
index 41fe6835a7..04e1dcd0e7 100644
--- a/hw/ipmi/ipmi_bmc_sim.c
+++ b/hw/ipmi/ipmi_bmc_sim.c
@@ -2278,7 +2278,7 @@ static const Property ipmi_sim_properties[] = {
     DEFINE_PROP_UUID_NODEFAULT("guid", IPMIBmcSim, uuid),
 };
 
-static void ipmi_sim_class_init(ObjectClass *oc, void *data)
+static void ipmi_sim_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     IPMIBmcClass *bk = IPMI_BMC_CLASS(oc);
diff --git a/hw/ipmi/isa_ipmi_bt.c b/hw/ipmi/isa_ipmi_bt.c
index 76585e786e..db539e68ae 100644
--- a/hw/ipmi/isa_ipmi_bt.c
+++ b/hw/ipmi/isa_ipmi_bt.c
@@ -139,7 +139,7 @@ static const Property ipmi_isa_properties[] = {
     DEFINE_PROP_INT32("irq",   ISAIPMIBTDevice, isairq,  5),
 };
 
-static void isa_ipmi_bt_class_init(ObjectClass *oc, void *data)
+static void isa_ipmi_bt_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     IPMIInterfaceClass *iic = IPMI_INTERFACE_CLASS(oc);
diff --git a/hw/ipmi/isa_ipmi_kcs.c b/hw/ipmi/isa_ipmi_kcs.c
index ba3ae208b2..4cbc6c577c 100644
--- a/hw/ipmi/isa_ipmi_kcs.c
+++ b/hw/ipmi/isa_ipmi_kcs.c
@@ -145,7 +145,7 @@ static const Property ipmi_isa_properties[] = {
     DEFINE_PROP_INT32("irq",   ISAIPMIKCSDevice, isairq,  5),
 };
 
-static void isa_ipmi_kcs_class_init(ObjectClass *oc, void *data)
+static void isa_ipmi_kcs_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     IPMIInterfaceClass *iic = IPMI_INTERFACE_CLASS(oc);
diff --git a/hw/ipmi/pci_ipmi_bt.c b/hw/ipmi/pci_ipmi_bt.c
index 7ba8b3ab96..23f65c6886 100644
--- a/hw/ipmi/pci_ipmi_bt.c
+++ b/hw/ipmi/pci_ipmi_bt.c
@@ -119,7 +119,7 @@ static void *pci_ipmi_bt_get_backend_data(IPMIInterface *ii)
     return &pib->bt;
 }
 
-static void pci_ipmi_bt_class_init(ObjectClass *oc, void *data)
+static void pci_ipmi_bt_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     PCIDeviceClass *pdc = PCI_DEVICE_CLASS(oc);
diff --git a/hw/ipmi/pci_ipmi_kcs.c b/hw/ipmi/pci_ipmi_kcs.c
index 0aa35143e9..4077b6a7b0 100644
--- a/hw/ipmi/pci_ipmi_kcs.c
+++ b/hw/ipmi/pci_ipmi_kcs.c
@@ -118,7 +118,7 @@ static void *pci_ipmi_kcs_get_backend_data(IPMIInterface *ii)
     return &pik->kcs;
 }
 
-static void pci_ipmi_kcs_class_init(ObjectClass *oc, void *data)
+static void pci_ipmi_kcs_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     PCIDeviceClass *pdc = PCI_DEVICE_CLASS(oc);
diff --git a/hw/ipmi/smbus_ipmi.c b/hw/ipmi/smbus_ipmi.c
index 56865df7db..7345844a3a 100644
--- a/hw/ipmi/smbus_ipmi.c
+++ b/hw/ipmi/smbus_ipmi.c
@@ -351,7 +351,7 @@ static void smbus_ipmi_get_fwinfo(struct IPMIInterface *ii, IPMIFwInfo *info)
     info->uuid = sid->uuid;
 }
 
-static void smbus_ipmi_class_init(ObjectClass *oc, void *data)
+static void smbus_ipmi_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     IPMIInterfaceClass *iic = IPMI_INTERFACE_CLASS(oc);
diff --git a/hw/isa/fdc37m81x-superio.c b/hw/isa/fdc37m81x-superio.c
index 55e91fbca1..c2a38f04b1 100644
--- a/hw/isa/fdc37m81x-superio.c
+++ b/hw/isa/fdc37m81x-superio.c
@@ -11,7 +11,7 @@
 #include "qemu/osdep.h"
 #include "hw/isa/superio.h"
 
-static void fdc37m81x_class_init(ObjectClass *klass, void *data)
+static void fdc37m81x_class_init(ObjectClass *klass, const void *data)
 {
     ISASuperIOClass *sc = ISA_SUPERIO_CLASS(klass);
 
diff --git a/hw/isa/i82378.c b/hw/isa/i82378.c
index cbaa152a89..26c8ec4f77 100644
--- a/hw/isa/i82378.c
+++ b/hw/isa/i82378.c
@@ -122,7 +122,7 @@ static void i82378_init(Object *obj)
     qdev_init_gpio_in(dev, i82378_request_pic_irq, 16);
 }
 
-static void i82378_class_init(ObjectClass *klass, void *data)
+static void i82378_class_init(ObjectClass *klass, const void *data)
 {
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
diff --git a/hw/isa/isa-bus.c b/hw/isa/isa-bus.c
index 2599c1219a..6c9802eb7a 100644
--- a/hw/isa/isa-bus.c
+++ b/hw/isa/isa-bus.c
@@ -29,7 +29,7 @@ static ISABus *isabus;
 
 static char *isabus_get_fw_dev_path(DeviceState *dev);
 
-static void isa_bus_class_init(ObjectClass *klass, void *data)
+static void isa_bus_class_init(ObjectClass *klass, const void *data)
 {
     BusClass *k = BUS_CLASS(klass);
 
@@ -205,7 +205,7 @@ ISADevice *isa_vga_init(ISABus *bus)
     }
 }
 
-static void isabus_bridge_class_init(ObjectClass *klass, void *data)
+static void isabus_bridge_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -220,7 +220,7 @@ static const TypeInfo isabus_bridge_info = {
     .class_init    = isabus_bridge_class_init,
 };
 
-static void isa_device_class_init(ObjectClass *klass, void *data)
+static void isa_device_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *k = DEVICE_CLASS(klass);
     k->bus_type = TYPE_ISA_BUS;
diff --git a/hw/isa/isa-superio.c b/hw/isa/isa-superio.c
index 4260da547c..2853485977 100644
--- a/hw/isa/isa-superio.c
+++ b/hw/isa/isa-superio.c
@@ -172,7 +172,7 @@ static void isa_superio_realize(DeviceState *dev, Error **errp)
     }
 }
 
-static void isa_superio_class_init(ObjectClass *oc, void *data)
+static void isa_superio_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
diff --git a/hw/isa/lpc_ich9.c b/hw/isa/lpc_ich9.c
index dcb0ac2848..d3e623b1e8 100644
--- a/hw/isa/lpc_ich9.c
+++ b/hw/isa/lpc_ich9.c
@@ -875,7 +875,7 @@ static void build_ich9_isa_aml(AcpiDevAmlIf *adev, Aml *scope)
     qbus_build_aml(bus, scope);
 }
 
-static void ich9_lpc_class_init(ObjectClass *klass, void *data)
+static void ich9_lpc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
diff --git a/hw/isa/pc87312.c b/hw/isa/pc87312.c
index 5f5868442a..388da8f590 100644
--- a/hw/isa/pc87312.c
+++ b/hw/isa/pc87312.c
@@ -332,7 +332,7 @@ static const Property pc87312_properties[] = {
     DEFINE_PROP_UINT8("config", PC87312State, config, 1),
 };
 
-static void pc87312_class_init(ObjectClass *klass, void *data)
+static void pc87312_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     ISASuperIOClass *sc = ISA_SUPERIO_CLASS(klass);
diff --git a/hw/isa/piix.c b/hw/isa/piix.c
index 7fc9e3ec9d..2c6e76f97c 100644
--- a/hw/isa/piix.c
+++ b/hw/isa/piix.c
@@ -417,7 +417,7 @@ static const Property pci_piix_props[] = {
     DEFINE_PROP_BOOL("smm-enabled", PIIXState, smm_enabled, false),
 };
 
-static void pci_piix_class_init(ObjectClass *klass, void *data)
+static void pci_piix_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
@@ -464,7 +464,7 @@ static void piix3_init(Object *obj)
     object_initialize_child(obj, "ide", &d->ide, TYPE_PIIX3_IDE);
 }
 
-static void piix3_class_init(ObjectClass *klass, void *data)
+static void piix3_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
@@ -494,7 +494,7 @@ static void piix4_init(Object *obj)
     object_initialize_child(obj, "ide", &s->ide, TYPE_PIIX4_IDE);
 }
 
-static void piix4_class_init(ObjectClass *klass, void *data)
+static void piix4_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
diff --git a/hw/isa/smc37c669-superio.c b/hw/isa/smc37c669-superio.c
index d2e58c9a89..0ec63f520c 100644
--- a/hw/isa/smc37c669-superio.c
+++ b/hw/isa/smc37c669-superio.c
@@ -58,7 +58,7 @@ static unsigned int get_fdc_dma(ISASuperIODevice *sio, uint8_t index)
     return 2;
 }
 
-static void smc37c669_class_init(ObjectClass *klass, void *data)
+static void smc37c669_class_init(ObjectClass *klass, const void *data)
 {
     ISASuperIOClass *sc = ISA_SUPERIO_CLASS(klass);
 
diff --git a/hw/isa/vt82c686.c b/hw/isa/vt82c686.c
index 43bd67eeef..80366aaf64 100644
--- a/hw/isa/vt82c686.c
+++ b/hw/isa/vt82c686.c
@@ -220,7 +220,7 @@ typedef struct via_pm_init_info {
     uint16_t device_id;
 } ViaPMInitInfo;
 
-static void via_pm_class_init(ObjectClass *klass, void *data)
+static void via_pm_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
@@ -337,7 +337,7 @@ static void via_superio_devices_enable(ViaSuperIOState *s, uint8_t data)
     isa_fdc_set_enabled(s->superio.floppy, data & BIT(4));
 }
 
-static void via_superio_class_init(ObjectClass *klass, void *data)
+static void via_superio_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     ISASuperIOClass *sc = ISA_SUPERIO_CLASS(klass);
@@ -456,7 +456,7 @@ static void vt82c686b_superio_init(Object *obj)
     VIA_SUPERIO(obj)->io_ops = &vt82c686b_superio_cfg_ops;
 }
 
-static void vt82c686b_superio_class_init(ObjectClass *klass, void *data)
+static void vt82c686b_superio_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     ISASuperIOClass *sc = ISA_SUPERIO_CLASS(klass);
@@ -565,7 +565,7 @@ static void vt8231_superio_init(Object *obj)
     VIA_SUPERIO(obj)->io_ops = &vt8231_superio_cfg_ops;
 }
 
-static void vt8231_superio_class_init(ObjectClass *klass, void *data)
+static void vt8231_superio_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     ISASuperIOClass *sc = ISA_SUPERIO_CLASS(klass);
@@ -833,7 +833,7 @@ static void vt82c686b_init(Object *obj)
     object_initialize_child(obj, "pm", &s->pm, TYPE_VT82C686B_PM);
 }
 
-static void vt82c686b_class_init(ObjectClass *klass, void *data)
+static void vt82c686b_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
@@ -898,7 +898,7 @@ static void vt8231_init(Object *obj)
     object_initialize_child(obj, "pm", &s->pm, TYPE_VT8231_PM);
 }
 
-static void vt8231_class_init(ObjectClass *klass, void *data)
+static void vt8231_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
diff --git a/hw/loongarch/virt.c b/hw/loongarch/virt.c
index aaaea64c4c..fde25e9409 100644
--- a/hw/loongarch/virt.c
+++ b/hw/loongarch/virt.c
@@ -1133,7 +1133,7 @@ static int64_t virt_get_default_cpu_node_id(const MachineState *ms, int idx)
     }
 }
 
-static void virt_class_init(ObjectClass *oc, void *data)
+static void virt_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     HotplugHandlerClass *hc = HOTPLUG_HANDLER_CLASS(oc);
diff --git a/hw/m68k/mcf5206.c b/hw/m68k/mcf5206.c
index c22e615f7a..a25e782403 100644
--- a/hw/m68k/mcf5206.c
+++ b/hw/m68k/mcf5206.c
@@ -605,7 +605,7 @@ static const Property mcf5206_mbar_properties[] = {
                      TYPE_M68K_CPU, M68kCPU *),
 };
 
-static void mcf5206_mbar_class_init(ObjectClass *oc, void *data)
+static void mcf5206_mbar_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
diff --git a/hw/m68k/mcf_intc.c b/hw/m68k/mcf_intc.c
index 7b9213947d..e3055b841e 100644
--- a/hw/m68k/mcf_intc.c
+++ b/hw/m68k/mcf_intc.c
@@ -182,7 +182,7 @@ static const Property mcf_intc_properties[] = {
                      TYPE_M68K_CPU, M68kCPU *),
 };
 
-static void mcf_intc_class_init(ObjectClass *oc, void *data)
+static void mcf_intc_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
diff --git a/hw/m68k/next-cube.c b/hw/m68k/next-cube.c
index 1d5925c17b..957644b2d1 100644
--- a/hw/m68k/next-cube.c
+++ b/hw/m68k/next-cube.c
@@ -794,7 +794,7 @@ static const VMStateDescription next_scsi_vmstate = {
     },
 };
 
-static void next_scsi_class_init(ObjectClass *klass, void *data)
+static void next_scsi_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -1064,7 +1064,7 @@ static const VMStateDescription next_rtc_vmstate = {
     },
 };
 
-static void next_rtc_class_init(ObjectClass *klass, void *data)
+static void next_rtc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     ResettableClass *rc = RESETTABLE_CLASS(klass);
@@ -1228,7 +1228,7 @@ static const VMStateDescription next_pc_vmstate = {
     },
 };
 
-static void next_pc_class_init(ObjectClass *klass, void *data)
+static void next_pc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     ResettableClass *rc = RESETTABLE_CLASS(klass);
@@ -1348,7 +1348,7 @@ static void next_cube_init(MachineState *machine)
     memory_region_add_subregion(sysmem, 0x02000000, &m->dmamem);
 }
 
-static void next_machine_class_init(ObjectClass *oc, void *data)
+static void next_machine_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
 
diff --git a/hw/m68k/next-kbd.c b/hw/m68k/next-kbd.c
index 68b17786b2..2bec945acf 100644
--- a/hw/m68k/next-kbd.c
+++ b/hw/m68k/next-kbd.c
@@ -312,7 +312,7 @@ static const VMStateDescription nextkbd_vmstate = {
     .unmigratable = 1,    /* TODO: Implement this when m68k CPU is migratable */
 };
 
-static void nextkbd_class_init(ObjectClass *oc, void *data)
+static void nextkbd_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
diff --git a/hw/m68k/q800-glue.c b/hw/m68k/q800-glue.c
index 168665b382..b428e7c833 100644
--- a/hw/m68k/q800-glue.c
+++ b/hw/m68k/q800-glue.c
@@ -228,7 +228,7 @@ static void glue_init(Object *obj)
     s->nmi_release = timer_new_ms(QEMU_CLOCK_VIRTUAL, glue_nmi_release, s);
 }
 
-static void glue_class_init(ObjectClass *klass, void *data)
+static void glue_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     ResettableClass *rc = RESETTABLE_CLASS(klass);
diff --git a/hw/m68k/q800.c b/hw/m68k/q800.c
index 46435238d2..793b23f815 100644
--- a/hw/m68k/q800.c
+++ b/hw/m68k/q800.c
@@ -727,7 +727,7 @@ static GlobalProperty hw_compat_q800[] = {
 };
 static const size_t hw_compat_q800_len = G_N_ELEMENTS(hw_compat_q800);
 
-static void q800_machine_class_init(ObjectClass *oc, void *data)
+static void q800_machine_class_init(ObjectClass *oc, const void *data)
 {
     static const char * const valid_cpu_types[] = {
         M68K_CPU_TYPE_NAME("m68040"),
diff --git a/hw/m68k/virt.c b/hw/m68k/virt.c
index e74d709a18..875fd00ef8 100644
--- a/hw/m68k/virt.c
+++ b/hw/m68k/virt.c
@@ -310,7 +310,7 @@ static void virt_init(MachineState *machine)
     }
 }
 
-static void virt_machine_class_init(ObjectClass *oc, void *data)
+static void virt_machine_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     mc->desc = "QEMU M68K Virtual Machine";
@@ -339,7 +339,7 @@ type_init(virt_machine_register_types)
 #define DEFINE_VIRT_MACHINE_IMPL(latest, ...) \
     static void MACHINE_VER_SYM(class_init, virt, __VA_ARGS__)( \
         ObjectClass *oc, \
-        void *data) \
+        const void *data) \
     { \
         MachineClass *mc = MACHINE_CLASS(oc); \
         MACHINE_VER_SYM(options, virt, __VA_ARGS__)(mc); \
diff --git a/hw/mem/cxl_type3.c b/hw/mem/cxl_type3.c
index 43aa02ab2a..c95722a2ae 100644
--- a/hw/mem/cxl_type3.c
+++ b/hw/mem/cxl_type3.c
@@ -2141,7 +2141,7 @@ void qmp_cxl_release_dynamic_capacity(const char *path, uint16_t host_id,
     }
 }
 
-static void ct3_class_init(ObjectClass *oc, void *data)
+static void ct3_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     PCIDeviceClass *pc = PCI_DEVICE_CLASS(oc);
diff --git a/hw/mem/npcm7xx_mc.c b/hw/mem/npcm7xx_mc.c
index abc5af5620..07fc108e0a 100644
--- a/hw/mem/npcm7xx_mc.c
+++ b/hw/mem/npcm7xx_mc.c
@@ -65,7 +65,7 @@ static void npcm7xx_mc_realize(DeviceState *dev, Error **errp)
     sysbus_init_mmio(SYS_BUS_DEVICE(s), &s->mmio);
 }
 
-static void npcm7xx_mc_class_init(ObjectClass *klass, void *data)
+static void npcm7xx_mc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/mem/nvdimm.c b/hw/mem/nvdimm.c
index c05007ab21..23ab143ef8 100644
--- a/hw/mem/nvdimm.c
+++ b/hw/mem/nvdimm.c
@@ -250,7 +250,7 @@ static const Property nvdimm_properties[] = {
     DEFINE_PROP_BOOL(NVDIMM_UNARMED_PROP, NVDIMMDevice, unarmed, false),
 };
 
-static void nvdimm_class_init(ObjectClass *oc, void *data)
+static void nvdimm_class_init(ObjectClass *oc, const void *data)
 {
     PCDIMMDeviceClass *ddc = PC_DIMM_CLASS(oc);
     MemoryDeviceClass *mdc = MEMORY_DEVICE_CLASS(oc);
diff --git a/hw/mem/pc-dimm.c b/hw/mem/pc-dimm.c
index 799a618c1c..6f68171442 100644
--- a/hw/mem/pc-dimm.c
+++ b/hw/mem/pc-dimm.c
@@ -276,7 +276,7 @@ static void pc_dimm_md_fill_device_info(const MemoryDeviceState *md,
     }
 }
 
-static void pc_dimm_class_init(ObjectClass *oc, void *data)
+static void pc_dimm_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     MemoryDeviceClass *mdc = MEMORY_DEVICE_CLASS(oc);
diff --git a/hw/mem/sparse-mem.c b/hw/mem/sparse-mem.c
index 8bed5dbe16..d7b00e563a 100644
--- a/hw/mem/sparse-mem.c
+++ b/hw/mem/sparse-mem.c
@@ -136,7 +136,7 @@ static void sparse_mem_realize(DeviceState *dev, Error **errp)
     sysbus_init_mmio(sbd, &s->mmio);
 }
 
-static void sparse_mem_class_init(ObjectClass *klass, void *data)
+static void sparse_mem_class_init(ObjectClass *klass, const void *data)
 {
     ResettableClass *rc = RESETTABLE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
diff --git a/hw/microblaze/petalogix_s3adsp1800_mmu.c b/hw/microblaze/petalogix_s3adsp1800_mmu.c
index f976c90bd2..032f6f70ea 100644
--- a/hw/microblaze/petalogix_s3adsp1800_mmu.c
+++ b/hw/microblaze/petalogix_s3adsp1800_mmu.c
@@ -141,7 +141,8 @@ petalogix_s3adsp1800_init(MachineState *machine)
                            NULL);
 }
 
-static void petalogix_s3adsp1800_machine_class_init(ObjectClass *oc, void *data)
+static void petalogix_s3adsp1800_machine_class_init(ObjectClass *oc,
+                                                    const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
 
diff --git a/hw/microblaze/xlnx-zynqmp-pmu.c b/hw/microblaze/xlnx-zynqmp-pmu.c
index 0922c65295..ea1430f408 100644
--- a/hw/microblaze/xlnx-zynqmp-pmu.c
+++ b/hw/microblaze/xlnx-zynqmp-pmu.c
@@ -121,7 +121,7 @@ static void xlnx_zynqmp_pmu_soc_realize(DeviceState *dev, Error **errp)
     }
 }
 
-static void xlnx_zynqmp_pmu_soc_class_init(ObjectClass *oc, void *data)
+static void xlnx_zynqmp_pmu_soc_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
diff --git a/hw/mips/cps.c b/hw/mips/cps.c
index 0d8cbdc892..2a3ba3f58d 100644
--- a/hw/mips/cps.c
+++ b/hw/mips/cps.c
@@ -173,7 +173,7 @@ static const Property mips_cps_properties[] = {
     DEFINE_PROP_BOOL("cpu-big-endian", MIPSCPSState, cpu_is_bigendian, false),
 };
 
-static void mips_cps_class_init(ObjectClass *klass, void *data)
+static void mips_cps_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/mips/jazz.c b/hw/mips/jazz.c
index 1700c3765d..cee92e1825 100644
--- a/hw/mips/jazz.c
+++ b/hw/mips/jazz.c
@@ -415,7 +415,7 @@ void mips_pica61_init(MachineState *machine)
     mips_jazz_init(machine, JAZZ_PICA61);
 }
 
-static void mips_magnum_class_init(ObjectClass *oc, void *data)
+static void mips_magnum_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
 
@@ -432,7 +432,7 @@ static const TypeInfo mips_magnum_type = {
     .class_init = mips_magnum_class_init,
 };
 
-static void mips_pica61_class_init(ObjectClass *oc, void *data)
+static void mips_pica61_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
 
diff --git a/hw/mips/loongson3_virt.c b/hw/mips/loongson3_virt.c
index 1da20dccec..de6fbcc0cb 100644
--- a/hw/mips/loongson3_virt.c
+++ b/hw/mips/loongson3_virt.c
@@ -667,7 +667,7 @@ static void mips_loongson3_virt_init(MachineState *machine)
     loongson3_virt_devices_init(machine, liointc);
 }
 
-static void loongson3v_machine_class_init(ObjectClass *oc, void *data)
+static void loongson3v_machine_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
 
diff --git a/hw/misc/a9scu.c b/hw/misc/a9scu.c
index 088d4adb0d..bb00ae2969 100644
--- a/hw/misc/a9scu.c
+++ b/hw/misc/a9scu.c
@@ -127,7 +127,7 @@ static const Property a9_scu_properties[] = {
     DEFINE_PROP_UINT32("num-cpu", A9SCUState, num_cpu, 1),
 };
 
-static void a9_scu_class_init(ObjectClass *klass, void *data)
+static void a9_scu_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/allwinner-a10-ccm.c b/hw/misc/allwinner-a10-ccm.c
index 6ca1daaff8..6b188c25a5 100644
--- a/hw/misc/allwinner-a10-ccm.c
+++ b/hw/misc/allwinner-a10-ccm.c
@@ -199,7 +199,7 @@ static const VMStateDescription allwinner_a10_ccm_vmstate = {
     }
 };
 
-static void allwinner_a10_ccm_class_init(ObjectClass *klass, void *data)
+static void allwinner_a10_ccm_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     ResettableClass *rc = RESETTABLE_CLASS(klass);
diff --git a/hw/misc/allwinner-a10-dramc.c b/hw/misc/allwinner-a10-dramc.c
index badc4c56eb..c16814cc5b 100644
--- a/hw/misc/allwinner-a10-dramc.c
+++ b/hw/misc/allwinner-a10-dramc.c
@@ -154,7 +154,7 @@ static const VMStateDescription allwinner_a10_dramc_vmstate = {
     }
 };
 
-static void allwinner_a10_dramc_class_init(ObjectClass *klass, void *data)
+static void allwinner_a10_dramc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     ResettableClass *rc = RESETTABLE_CLASS(klass);
diff --git a/hw/misc/allwinner-cpucfg.c b/hw/misc/allwinner-cpucfg.c
index a4f7a01141..90dd872abf 100644
--- a/hw/misc/allwinner-cpucfg.c
+++ b/hw/misc/allwinner-cpucfg.c
@@ -258,7 +258,7 @@ static const VMStateDescription allwinner_cpucfg_vmstate = {
     }
 };
 
-static void allwinner_cpucfg_class_init(ObjectClass *klass, void *data)
+static void allwinner_cpucfg_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/allwinner-h3-ccu.c b/hw/misc/allwinner-h3-ccu.c
index e765f4c54b..be91c0c1ca 100644
--- a/hw/misc/allwinner-h3-ccu.c
+++ b/hw/misc/allwinner-h3-ccu.c
@@ -218,7 +218,7 @@ static const VMStateDescription allwinner_h3_ccu_vmstate = {
     }
 };
 
-static void allwinner_h3_ccu_class_init(ObjectClass *klass, void *data)
+static void allwinner_h3_ccu_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/allwinner-h3-dramc.c b/hw/misc/allwinner-h3-dramc.c
index 74ff71b753..8834524c30 100644
--- a/hw/misc/allwinner-h3-dramc.c
+++ b/hw/misc/allwinner-h3-dramc.c
@@ -331,7 +331,7 @@ static const VMStateDescription allwinner_h3_dramc_vmstate = {
     }
 };
 
-static void allwinner_h3_dramc_class_init(ObjectClass *klass, void *data)
+static void allwinner_h3_dramc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/allwinner-h3-sysctrl.c b/hw/misc/allwinner-h3-sysctrl.c
index 32a0ceb01a..6b86524606 100644
--- a/hw/misc/allwinner-h3-sysctrl.c
+++ b/hw/misc/allwinner-h3-sysctrl.c
@@ -116,7 +116,8 @@ static const VMStateDescription allwinner_h3_sysctrl_vmstate = {
     }
 };
 
-static void allwinner_h3_sysctrl_class_init(ObjectClass *klass, void *data)
+static void allwinner_h3_sysctrl_class_init(ObjectClass *klass,
+                                            const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/allwinner-r40-ccu.c b/hw/misc/allwinner-r40-ccu.c
index 8f37a9213c..4e21eeafdd 100644
--- a/hw/misc/allwinner-r40-ccu.c
+++ b/hw/misc/allwinner-r40-ccu.c
@@ -185,7 +185,7 @@ static const VMStateDescription allwinner_r40_ccu_vmstate = {
     }
 };
 
-static void allwinner_r40_ccu_class_init(ObjectClass *klass, void *data)
+static void allwinner_r40_ccu_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/allwinner-r40-dramc.c b/hw/misc/allwinner-r40-dramc.c
index 5908a059e8..1c8e17e3c0 100644
--- a/hw/misc/allwinner-r40-dramc.c
+++ b/hw/misc/allwinner-r40-dramc.c
@@ -484,7 +484,7 @@ static const VMStateDescription allwinner_r40_dramc_vmstate = {
     }
 };
 
-static void allwinner_r40_dramc_class_init(ObjectClass *klass, void *data)
+static void allwinner_r40_dramc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/allwinner-sid.c b/hw/misc/allwinner-sid.c
index 2bb81f9c54..1e66c14567 100644
--- a/hw/misc/allwinner-sid.c
+++ b/hw/misc/allwinner-sid.c
@@ -143,7 +143,7 @@ static const VMStateDescription allwinner_sid_vmstate = {
     }
 };
 
-static void allwinner_sid_class_init(ObjectClass *klass, void *data)
+static void allwinner_sid_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/allwinner-sramc.c b/hw/misc/allwinner-sramc.c
index 51df5e45aa..ed299ecaae 100644
--- a/hw/misc/allwinner-sramc.c
+++ b/hw/misc/allwinner-sramc.c
@@ -135,7 +135,7 @@ static void allwinner_sramc_reset(DeviceState *dev)
     }
 }
 
-static void allwinner_sramc_class_init(ObjectClass *klass, void *data)
+static void allwinner_sramc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -163,7 +163,7 @@ static const TypeInfo allwinner_sramc_info = {
     .class_init    = allwinner_sramc_class_init,
 };
 
-static void allwinner_r40_sramc_class_init(ObjectClass *klass, void *data)
+static void allwinner_r40_sramc_class_init(ObjectClass *klass, const void *data)
 {
     AwSRAMCClass *sc = AW_SRAMC_CLASS(klass);
 
diff --git a/hw/misc/applesmc.c b/hw/misc/applesmc.c
index 97ea842d60..d83a81b60d 100644
--- a/hw/misc/applesmc.c
+++ b/hw/misc/applesmc.c
@@ -375,7 +375,7 @@ static void build_applesmc_aml(AcpiDevAmlIf *adev, Aml *scope)
     aml_append(scope, dev);
 }
 
-static void qdev_applesmc_class_init(ObjectClass *klass, void *data)
+static void qdev_applesmc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     AcpiDevAmlIfClass *adevc = ACPI_DEV_AML_IF_CLASS(klass);
diff --git a/hw/misc/arm11scu.c b/hw/misc/arm11scu.c
index 02493cec31..2ad4fd1d21 100644
--- a/hw/misc/arm11scu.c
+++ b/hw/misc/arm11scu.c
@@ -79,7 +79,7 @@ static const Property arm11_scu_properties[] = {
     DEFINE_PROP_UINT32("num-cpu", ARM11SCUState, num_cpu, 1),
 };
 
-static void arm11_scu_class_init(ObjectClass *oc, void *data)
+static void arm11_scu_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
diff --git a/hw/misc/arm_l2x0.c b/hw/misc/arm_l2x0.c
index 39b4642da7..8b4b61eed0 100644
--- a/hw/misc/arm_l2x0.c
+++ b/hw/misc/arm_l2x0.c
@@ -177,7 +177,7 @@ static const Property l2x0_properties[] = {
     DEFINE_PROP_UINT32("cache-type", L2x0State, cache_type, 0x1c100100),
 };
 
-static void l2x0_class_init(ObjectClass *klass, void *data)
+static void l2x0_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/arm_sysctl.c b/hw/misc/arm_sysctl.c
index 01663407ec..0f4e37cd47 100644
--- a/hw/misc/arm_sysctl.c
+++ b/hw/misc/arm_sysctl.c
@@ -634,7 +634,7 @@ static const Property arm_sysctl_properties[] = {
                       db_clock_reset, qdev_prop_uint32, uint32_t),
 };
 
-static void arm_sysctl_class_init(ObjectClass *klass, void *data)
+static void arm_sysctl_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/armsse-cpu-pwrctrl.c b/hw/misc/armsse-cpu-pwrctrl.c
index 2d3a0ac29c..66e9218f27 100644
--- a/hw/misc/armsse-cpu-pwrctrl.c
+++ b/hw/misc/armsse-cpu-pwrctrl.c
@@ -125,7 +125,7 @@ static void pwrctrl_init(Object *obj)
     sysbus_init_mmio(sbd, &s->iomem);
 }
 
-static void pwrctrl_class_init(ObjectClass *klass, void *data)
+static void pwrctrl_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/armsse-cpuid.c b/hw/misc/armsse-cpuid.c
index 58cb37333f..a57764d731 100644
--- a/hw/misc/armsse-cpuid.c
+++ b/hw/misc/armsse-cpuid.c
@@ -106,7 +106,7 @@ static void armsse_cpuid_init(Object *obj)
     sysbus_init_mmio(sbd, &s->iomem);
 }
 
-static void armsse_cpuid_class_init(ObjectClass *klass, void *data)
+static void armsse_cpuid_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/armsse-mhu.c b/hw/misc/armsse-mhu.c
index 91c49108b0..d5d307a186 100644
--- a/hw/misc/armsse-mhu.c
+++ b/hw/misc/armsse-mhu.c
@@ -176,7 +176,7 @@ static void armsse_mhu_init(Object *obj)
     sysbus_init_irq(sbd, &s->cpu1irq);
 }
 
-static void armsse_mhu_class_init(ObjectClass *klass, void *data)
+static void armsse_mhu_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/armv7m_ras.c b/hw/misc/armv7m_ras.c
index de24922c94..7bf5acd0a5 100644
--- a/hw/misc/armv7m_ras.c
+++ b/hw/misc/armv7m_ras.c
@@ -72,7 +72,7 @@ static void armv7m_ras_init(Object *obj)
     sysbus_init_mmio(sbd, &s->iomem);
 }
 
-static void armv7m_ras_class_init(ObjectClass *klass, void *data)
+static void armv7m_ras_class_init(ObjectClass *klass, const void *data)
 {
     /* This device has no state: no need for vmstate or reset */
 }
diff --git a/hw/misc/aspeed_hace.c b/hw/misc/aspeed_hace.c
index d75da33353..f4bff32a00 100644
--- a/hw/misc/aspeed_hace.c
+++ b/hw/misc/aspeed_hace.c
@@ -479,7 +479,7 @@ static const VMStateDescription vmstate_aspeed_hace = {
     }
 };
 
-static void aspeed_hace_class_init(ObjectClass *klass, void *data)
+static void aspeed_hace_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -497,7 +497,7 @@ static const TypeInfo aspeed_hace_info = {
     .class_size = sizeof(AspeedHACEClass)
 };
 
-static void aspeed_ast2400_hace_class_init(ObjectClass *klass, void *data)
+static void aspeed_ast2400_hace_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     AspeedHACEClass *ahc = ASPEED_HACE_CLASS(klass);
@@ -516,7 +516,7 @@ static const TypeInfo aspeed_ast2400_hace_info = {
     .class_init = aspeed_ast2400_hace_class_init,
 };
 
-static void aspeed_ast2500_hace_class_init(ObjectClass *klass, void *data)
+static void aspeed_ast2500_hace_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     AspeedHACEClass *ahc = ASPEED_HACE_CLASS(klass);
@@ -535,7 +535,7 @@ static const TypeInfo aspeed_ast2500_hace_info = {
     .class_init = aspeed_ast2500_hace_class_init,
 };
 
-static void aspeed_ast2600_hace_class_init(ObjectClass *klass, void *data)
+static void aspeed_ast2600_hace_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     AspeedHACEClass *ahc = ASPEED_HACE_CLASS(klass);
@@ -554,7 +554,7 @@ static const TypeInfo aspeed_ast2600_hace_info = {
     .class_init = aspeed_ast2600_hace_class_init,
 };
 
-static void aspeed_ast1030_hace_class_init(ObjectClass *klass, void *data)
+static void aspeed_ast1030_hace_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     AspeedHACEClass *ahc = ASPEED_HACE_CLASS(klass);
@@ -573,7 +573,7 @@ static const TypeInfo aspeed_ast1030_hace_info = {
     .class_init = aspeed_ast1030_hace_class_init,
 };
 
-static void aspeed_ast2700_hace_class_init(ObjectClass *klass, void *data)
+static void aspeed_ast2700_hace_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     AspeedHACEClass *ahc = ASPEED_HACE_CLASS(klass);
diff --git a/hw/misc/aspeed_i3c.c b/hw/misc/aspeed_i3c.c
index ab39c6435b..3bef1c84dd 100644
--- a/hw/misc/aspeed_i3c.c
+++ b/hw/misc/aspeed_i3c.c
@@ -327,7 +327,7 @@ static const Property aspeed_i3c_device_properties[] = {
     DEFINE_PROP_UINT8("device-id", AspeedI3CDevice, id, 0),
 };
 
-static void aspeed_i3c_device_class_init(ObjectClass *klass, void *data)
+static void aspeed_i3c_device_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -356,7 +356,7 @@ static const VMStateDescription vmstate_aspeed_i3c = {
     }
 };
 
-static void aspeed_i3c_class_init(ObjectClass *klass, void *data)
+static void aspeed_i3c_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/aspeed_lpc.c b/hw/misc/aspeed_lpc.c
index 228d250dc0..78406dae24 100644
--- a/hw/misc/aspeed_lpc.c
+++ b/hw/misc/aspeed_lpc.c
@@ -458,7 +458,7 @@ static const Property aspeed_lpc_properties[] = {
     DEFINE_PROP_UINT32("hicr7", AspeedLPCState, hicr7, 0),
 };
 
-static void aspeed_lpc_class_init(ObjectClass *klass, void *data)
+static void aspeed_lpc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/aspeed_peci.c b/hw/misc/aspeed_peci.c
index 9025b35f83..a7a449a923 100644
--- a/hw/misc/aspeed_peci.c
+++ b/hw/misc/aspeed_peci.c
@@ -130,7 +130,7 @@ static void aspeed_peci_reset(DeviceState *dev)
     memset(s->regs, 0, sizeof(s->regs));
 }
 
-static void aspeed_peci_class_init(ObjectClass *klass, void *data)
+static void aspeed_peci_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/aspeed_sbc.c b/hw/misc/aspeed_sbc.c
index e4a6bd1581..a7d101ba71 100644
--- a/hw/misc/aspeed_sbc.c
+++ b/hw/misc/aspeed_sbc.c
@@ -141,7 +141,7 @@ static const Property aspeed_sbc_properties[] = {
     DEFINE_PROP_UINT32("signing-settings", AspeedSBCState, signing_settings, 0),
 };
 
-static void aspeed_sbc_class_init(ObjectClass *klass, void *data)
+static void aspeed_sbc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -159,7 +159,7 @@ static const TypeInfo aspeed_sbc_info = {
     .class_size = sizeof(AspeedSBCClass)
 };
 
-static void aspeed_ast2600_sbc_class_init(ObjectClass *klass, void *data)
+static void aspeed_ast2600_sbc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/aspeed_scu.c b/hw/misc/aspeed_scu.c
index 1af1a35a08..4930e00fed 100644
--- a/hw/misc/aspeed_scu.c
+++ b/hw/misc/aspeed_scu.c
@@ -618,7 +618,7 @@ static const Property aspeed_scu_properties[] = {
     DEFINE_PROP_UINT32("hw-prot-key", AspeedSCUState, hw_prot_key, 0),
 };
 
-static void aspeed_scu_class_init(ObjectClass *klass, void *data)
+static void aspeed_scu_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     dc->realize = aspeed_scu_realize;
@@ -637,7 +637,7 @@ static const TypeInfo aspeed_scu_info = {
     .abstract      = true,
 };
 
-static void aspeed_2400_scu_class_init(ObjectClass *klass, void *data)
+static void aspeed_2400_scu_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     AspeedSCUClass *asc = ASPEED_SCU_CLASS(klass);
@@ -659,7 +659,7 @@ static const TypeInfo aspeed_2400_scu_info = {
     .class_init = aspeed_2400_scu_class_init,
 };
 
-static void aspeed_2500_scu_class_init(ObjectClass *klass, void *data)
+static void aspeed_2500_scu_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     AspeedSCUClass *asc = ASPEED_SCU_CLASS(klass);
@@ -835,7 +835,7 @@ static void aspeed_ast2600_scu_reset(DeviceState *dev)
     s->regs[PROT_KEY] = s->hw_prot_key;
 }
 
-static void aspeed_2600_scu_class_init(ObjectClass *klass, void *data)
+static void aspeed_2600_scu_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     AspeedSCUClass *asc = ASPEED_SCU_CLASS(klass);
@@ -954,7 +954,7 @@ static void aspeed_ast2700_scu_reset(DeviceState *dev)
     s->regs[AST2700_HW_STRAP1] = s->hw_strap1;
 }
 
-static void aspeed_2700_scu_class_init(ObjectClass *klass, void *data)
+static void aspeed_2700_scu_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     AspeedSCUClass *asc = ASPEED_SCU_CLASS(klass);
@@ -1068,7 +1068,7 @@ static const uint32_t ast2700_a0_resets_io[ASPEED_AST2700_SCU_NR_REGS] = {
     [AST2700_SCUIO_CLK_DUTY_MEAS_RST]   = 0x0c9100d2,
 };
 
-static void aspeed_2700_scuio_class_init(ObjectClass *klass, void *data)
+static void aspeed_2700_scuio_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     AspeedSCUClass *asc = ASPEED_SCU_CLASS(klass);
@@ -1126,7 +1126,7 @@ static void aspeed_ast1030_scu_reset(DeviceState *dev)
     s->regs[PROT_KEY] = s->hw_prot_key;
 }
 
-static void aspeed_1030_scu_class_init(ObjectClass *klass, void *data)
+static void aspeed_1030_scu_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     AspeedSCUClass *asc = ASPEED_SCU_CLASS(klass);
diff --git a/hw/misc/aspeed_sdmc.c b/hw/misc/aspeed_sdmc.c
index f359640a9a..f04d9930dd 100644
--- a/hw/misc/aspeed_sdmc.c
+++ b/hw/misc/aspeed_sdmc.c
@@ -299,7 +299,7 @@ static const Property aspeed_sdmc_properties[] = {
     DEFINE_PROP_BOOL("unlocked", AspeedSDMCState, unlocked, false),
 };
 
-static void aspeed_sdmc_class_init(ObjectClass *klass, void *data)
+static void aspeed_sdmc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     dc->realize = aspeed_sdmc_realize;
@@ -380,7 +380,7 @@ static void aspeed_2400_sdmc_write(AspeedSDMCState *s, uint32_t reg,
 static const uint64_t
 aspeed_2400_ram_sizes[] = { 64 * MiB, 128 * MiB, 256 * MiB, 512 * MiB, 0};
 
-static void aspeed_2400_sdmc_class_init(ObjectClass *klass, void *data)
+static void aspeed_2400_sdmc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     AspeedSDMCClass *asc = ASPEED_SDMC_CLASS(klass);
@@ -448,7 +448,7 @@ static void aspeed_2500_sdmc_write(AspeedSDMCState *s, uint32_t reg,
 static const uint64_t
 aspeed_2500_ram_sizes[] = { 128 * MiB, 256 * MiB, 512 * MiB, 1024 * MiB, 0};
 
-static void aspeed_2500_sdmc_class_init(ObjectClass *klass, void *data)
+static void aspeed_2500_sdmc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     AspeedSDMCClass *asc = ASPEED_SDMC_CLASS(klass);
@@ -542,7 +542,7 @@ static void aspeed_2600_sdmc_write(AspeedSDMCState *s, uint32_t reg,
 static const uint64_t
 aspeed_2600_ram_sizes[] = { 256 * MiB, 512 * MiB, 1024 * MiB, 2048 * MiB, 0};
 
-static void aspeed_2600_sdmc_class_init(ObjectClass *klass, void *data)
+static void aspeed_2600_sdmc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     AspeedSDMCClass *asc = ASPEED_SDMC_CLASS(klass);
@@ -670,7 +670,7 @@ static const uint64_t
     aspeed_2700_ram_sizes[] = { 256 * MiB, 512 * MiB, 1024 * MiB,
                                 2048 * MiB, 4096 * MiB, 8192 * MiB, 0};
 
-static void aspeed_2700_sdmc_class_init(ObjectClass *klass, void *data)
+static void aspeed_2700_sdmc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     AspeedSDMCClass *asc = ASPEED_SDMC_CLASS(klass);
diff --git a/hw/misc/aspeed_sli.c b/hw/misc/aspeed_sli.c
index fe720ead50..c51484035e 100644
--- a/hw/misc/aspeed_sli.c
+++ b/hw/misc/aspeed_sli.c
@@ -124,7 +124,7 @@ static void aspeed_sliio_realize(DeviceState *dev, Error **errp)
     sysbus_init_mmio(sbd, &s->iomem);
 }
 
-static void aspeed_sli_class_init(ObjectClass *klass, void *data)
+static void aspeed_sli_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -140,14 +140,14 @@ static const TypeInfo aspeed_sli_info = {
     .abstract      = true,
 };
 
-static void aspeed_2700_sli_class_init(ObjectClass *klass, void *data)
+static void aspeed_2700_sli_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
     dc->desc = "AST2700 SLI Controller";
 }
 
-static void aspeed_2700_sliio_class_init(ObjectClass *klass, void *data)
+static void aspeed_2700_sliio_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/aspeed_xdma.c b/hw/misc/aspeed_xdma.c
index 1dd32f72f4..cc03c422b0 100644
--- a/hw/misc/aspeed_xdma.c
+++ b/hw/misc/aspeed_xdma.c
@@ -150,7 +150,7 @@ static const VMStateDescription aspeed_xdma_vmstate = {
     },
 };
 
-static void aspeed_2600_xdma_class_init(ObjectClass *klass, void *data)
+static void aspeed_2600_xdma_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     AspeedXDMAClass *axc = ASPEED_XDMA_CLASS(klass);
@@ -173,7 +173,7 @@ static const TypeInfo aspeed_2600_xdma_info = {
     .class_init = aspeed_2600_xdma_class_init,
 };
 
-static void aspeed_2500_xdma_class_init(ObjectClass *klass, void *data)
+static void aspeed_2500_xdma_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     AspeedXDMAClass *axc = ASPEED_XDMA_CLASS(klass);
@@ -195,7 +195,7 @@ static const TypeInfo aspeed_2500_xdma_info = {
     .class_init = aspeed_2500_xdma_class_init,
 };
 
-static void aspeed_2400_xdma_class_init(ObjectClass *klass, void *data)
+static void aspeed_2400_xdma_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     AspeedXDMAClass *axc = ASPEED_XDMA_CLASS(klass);
@@ -217,7 +217,7 @@ static const TypeInfo aspeed_2400_xdma_info = {
     .class_init = aspeed_2400_xdma_class_init,
 };
 
-static void aspeed_xdma_class_init(ObjectClass *classp, void *data)
+static void aspeed_xdma_class_init(ObjectClass *classp, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(classp);
 
diff --git a/hw/misc/auxbus.c b/hw/misc/auxbus.c
index 28d50d9d09..877f345606 100644
--- a/hw/misc/auxbus.c
+++ b/hw/misc/auxbus.c
@@ -50,7 +50,7 @@ static void aux_slave_dev_print(Monitor *mon, DeviceState *dev, int indent);
 static inline I2CBus *aux_bridge_get_i2c_bus(AUXTOI2CState *bridge);
 
 /* aux-bus implementation (internal not public) */
-static void aux_bus_class_init(ObjectClass *klass, void *data)
+static void aux_bus_class_init(ObjectClass *klass, const void *data)
 {
     BusClass *k = BUS_CLASS(klass);
 
@@ -256,7 +256,7 @@ struct AUXTOI2CState {
     I2CBus *i2c_bus;
 };
 
-static void aux_bridge_class_init(ObjectClass *oc, void *data)
+static void aux_bridge_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
@@ -311,7 +311,7 @@ void aux_init_mmio(AUXSlave *aux_slave, MemoryRegion *mmio)
     aux_slave->mmio = mmio;
 }
 
-static void aux_slave_class_init(ObjectClass *klass, void *data)
+static void aux_slave_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *k = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/avr_power.c b/hw/misc/avr_power.c
index ac7b96f53e..411f016c99 100644
--- a/hw/misc/avr_power.c
+++ b/hw/misc/avr_power.c
@@ -90,7 +90,7 @@ static void avr_mask_init(Object *dev)
     s->val = 0x00;
 }
 
-static void avr_mask_class_init(ObjectClass *klass, void *data)
+static void avr_mask_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/axp2xx.c b/hw/misc/axp2xx.c
index af646878cd..46d17712dd 100644
--- a/hw/misc/axp2xx.c
+++ b/hw/misc/axp2xx.c
@@ -225,7 +225,7 @@ static const VMStateDescription vmstate_axp2xx = {
     }
 };
 
-static void axp2xx_class_init(ObjectClass *oc, void *data)
+static void axp2xx_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     I2CSlaveClass *isc = I2C_SLAVE_CLASS(oc);
@@ -247,7 +247,7 @@ static const TypeInfo axp2xx_info = {
     .abstract = true,
 };
 
-static void axp209_class_init(ObjectClass *oc, void *data)
+static void axp209_class_init(ObjectClass *oc, const void *data)
 {
     AXP2xxClass *sc = AXP2XX_CLASS(oc);
 
@@ -260,7 +260,7 @@ static const TypeInfo axp209_info = {
     .class_init = axp209_class_init
 };
 
-static void axp221_class_init(ObjectClass *oc, void *data)
+static void axp221_class_init(ObjectClass *oc, const void *data)
 {
     AXP2xxClass *sc = AXP2XX_CLASS(oc);
 
diff --git a/hw/misc/bcm2835_cprman.c b/hw/misc/bcm2835_cprman.c
index 0c4d4b7de5..efe6f900db 100644
--- a/hw/misc/bcm2835_cprman.c
+++ b/hw/misc/bcm2835_cprman.c
@@ -131,7 +131,7 @@ static const VMStateDescription pll_vmstate = {
     }
 };
 
-static void pll_class_init(ObjectClass *klass, void *data)
+static void pll_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -237,7 +237,7 @@ static const VMStateDescription pll_channel_vmstate = {
     }
 };
 
-static void pll_channel_class_init(ObjectClass *klass, void *data)
+static void pll_channel_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -360,7 +360,7 @@ static const VMStateDescription clock_mux_vmstate = {
     }
 };
 
-static void clock_mux_class_init(ObjectClass *klass, void *data)
+static void clock_mux_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -417,7 +417,7 @@ static const VMStateDescription dsi0hsck_mux_vmstate = {
     }
 };
 
-static void dsi0hsck_mux_class_init(ObjectClass *klass, void *data)
+static void dsi0hsck_mux_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -790,7 +790,7 @@ static const Property cprman_properties[] = {
     DEFINE_PROP_UINT32("xosc-freq-hz", BCM2835CprmanState, xosc_freq, 19200000),
 };
 
-static void cprman_class_init(ObjectClass *klass, void *data)
+static void cprman_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/bcm2835_mbox.c b/hw/misc/bcm2835_mbox.c
index ed6dbea191..603eaaa710 100644
--- a/hw/misc/bcm2835_mbox.c
+++ b/hw/misc/bcm2835_mbox.c
@@ -314,7 +314,7 @@ static void bcm2835_mbox_realize(DeviceState *dev, Error **errp)
     bcm2835_mbox_reset(dev);
 }
 
-static void bcm2835_mbox_class_init(ObjectClass *klass, void *data)
+static void bcm2835_mbox_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/bcm2835_mphi.c b/hw/misc/bcm2835_mphi.c
index 7309cf22fc..55d79e7e87 100644
--- a/hw/misc/bcm2835_mphi.c
+++ b/hw/misc/bcm2835_mphi.c
@@ -166,7 +166,7 @@ const VMStateDescription vmstate_mphi_state = {
     }
 };
 
-static void mphi_class_init(ObjectClass *klass, void *data)
+static void mphi_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/bcm2835_powermgt.c b/hw/misc/bcm2835_powermgt.c
index e4e9bae374..3ec7abad0e 100644
--- a/hw/misc/bcm2835_powermgt.c
+++ b/hw/misc/bcm2835_powermgt.c
@@ -136,7 +136,7 @@ static void bcm2835_powermgt_reset(DeviceState *dev)
     s->wdog = 0x00000000;
 }
 
-static void bcm2835_powermgt_class_init(ObjectClass *klass, void *data)
+static void bcm2835_powermgt_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/bcm2835_property.c b/hw/misc/bcm2835_property.c
index 2bae64b64c..a21c6a541c 100644
--- a/hw/misc/bcm2835_property.c
+++ b/hw/misc/bcm2835_property.c
@@ -556,7 +556,7 @@ static const Property bcm2835_property_props[] = {
     DEFINE_PROP_STRING("command-line", BCM2835PropertyState, command_line),
 };
 
-static void bcm2835_property_class_init(ObjectClass *klass, void *data)
+static void bcm2835_property_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/bcm2835_rng.c b/hw/misc/bcm2835_rng.c
index 06f40817df..e4d2c224c8 100644
--- a/hw/misc/bcm2835_rng.c
+++ b/hw/misc/bcm2835_rng.c
@@ -123,7 +123,7 @@ static void bcm2835_rng_reset(DeviceState *dev)
     s->rng_status = 0;
 }
 
-static void bcm2835_rng_class_init(ObjectClass *klass, void *data)
+static void bcm2835_rng_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/bcm2835_thermal.c b/hw/misc/bcm2835_thermal.c
index 1c1b0671cc..33bfc91c7a 100644
--- a/hw/misc/bcm2835_thermal.c
+++ b/hw/misc/bcm2835_thermal.c
@@ -113,7 +113,7 @@ static const VMStateDescription bcm2835_thermal_vmstate = {
     }
 };
 
-static void bcm2835_thermal_class_init(ObjectClass *klass, void *data)
+static void bcm2835_thermal_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/debugexit.c b/hw/misc/debugexit.c
index 577b884494..04a9fc3122 100644
--- a/hw/misc/debugexit.c
+++ b/hw/misc/debugexit.c
@@ -61,7 +61,7 @@ static const Property debug_exit_properties[] = {
     DEFINE_PROP_UINT32("iosize", ISADebugExitState, iosize, 0x02),
 };
 
-static void debug_exit_class_initfn(ObjectClass *klass, void *data)
+static void debug_exit_class_initfn(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/djmemc.c b/hw/misc/djmemc.c
index 96d5efb5e3..c5b09f551b 100644
--- a/hw/misc/djmemc.c
+++ b/hw/misc/djmemc.c
@@ -113,7 +113,7 @@ static const VMStateDescription vmstate_djmemc = {
     }
 };
 
-static void djmemc_class_init(ObjectClass *oc, void *data)
+static void djmemc_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     ResettableClass *rc = RESETTABLE_CLASS(oc);
diff --git a/hw/misc/eccmemctl.c b/hw/misc/eccmemctl.c
index d7452c4cc8..81fc536131 100644
--- a/hw/misc/eccmemctl.c
+++ b/hw/misc/eccmemctl.c
@@ -329,7 +329,7 @@ static const Property ecc_properties[] = {
     DEFINE_PROP_UINT32("version", ECCState, version, -1),
 };
 
-static void ecc_class_init(ObjectClass *klass, void *data)
+static void ecc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/edu.c b/hw/misc/edu.c
index 5723ef0ed1..8224603593 100644
--- a/hw/misc/edu.c
+++ b/hw/misc/edu.c
@@ -415,7 +415,7 @@ static void edu_instance_init(Object *obj)
                                    &edu->dma_mask, OBJ_PROP_FLAG_READWRITE);
 }
 
-static void edu_class_init(ObjectClass *class, void *data)
+static void edu_class_init(ObjectClass *class, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(class);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(class);
diff --git a/hw/misc/empty_slot.c b/hw/misc/empty_slot.c
index 221ea7cb54..239d760320 100644
--- a/hw/misc/empty_slot.c
+++ b/hw/misc/empty_slot.c
@@ -84,7 +84,7 @@ static const Property empty_slot_properties[] = {
     DEFINE_PROP_STRING("name", EmptySlot, name),
 };
 
-static void empty_slot_class_init(ObjectClass *klass, void *data)
+static void empty_slot_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/exynos4210_clk.c b/hw/misc/exynos4210_clk.c
index 886d10bbab..fdf5bdd603 100644
--- a/hw/misc/exynos4210_clk.c
+++ b/hw/misc/exynos4210_clk.c
@@ -141,7 +141,7 @@ static const VMStateDescription exynos4210_clk_vmstate = {
     }
 };
 
-static void exynos4210_clk_class_init(ObjectClass *klass, void *data)
+static void exynos4210_clk_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/exynos4210_pmu.c b/hw/misc/exynos4210_pmu.c
index d44aac3af5..a86ec9aba8 100644
--- a/hw/misc/exynos4210_pmu.c
+++ b/hw/misc/exynos4210_pmu.c
@@ -498,7 +498,7 @@ static const VMStateDescription exynos4210_pmu_vmstate = {
     }
 };
 
-static void exynos4210_pmu_class_init(ObjectClass *klass, void *data)
+static void exynos4210_pmu_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/exynos4210_rng.c b/hw/misc/exynos4210_rng.c
index a741cf176b..2d0ebc457b 100644
--- a/hw/misc/exynos4210_rng.c
+++ b/hw/misc/exynos4210_rng.c
@@ -255,7 +255,7 @@ static const VMStateDescription exynos4210_rng_vmstate = {
     }
 };
 
-static void exynos4210_rng_class_init(ObjectClass *klass, void *data)
+static void exynos4210_rng_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/grlib_ahb_apb_pnp.c b/hw/misc/grlib_ahb_apb_pnp.c
index 5b05f15859..cdca00ad54 100644
--- a/hw/misc/grlib_ahb_apb_pnp.c
+++ b/hw/misc/grlib_ahb_apb_pnp.c
@@ -168,7 +168,7 @@ static void grlib_ahb_pnp_realize(DeviceState *dev, Error **errp)
     sysbus_init_mmio(sbd, &ahb_pnp->iomem);
 }
 
-static void grlib_ahb_pnp_class_init(ObjectClass *klass, void *data)
+static void grlib_ahb_pnp_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -280,7 +280,7 @@ static void grlib_apb_pnp_realize(DeviceState *dev, Error **errp)
     sysbus_init_mmio(sbd, &apb_pnp->iomem);
 }
 
-static void grlib_apb_pnp_class_init(ObjectClass *klass, void *data)
+static void grlib_apb_pnp_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/i2c-echo.c b/hw/misc/i2c-echo.c
index fcd407dfc6..2bb99ec0db 100644
--- a/hw/misc/i2c-echo.c
+++ b/hw/misc/i2c-echo.c
@@ -145,7 +145,7 @@ static void i2c_echo_realize(DeviceState *dev, Error **errp)
     state->bh = qemu_bh_new(i2c_echo_bh, state);
 }
 
-static void i2c_echo_class_init(ObjectClass *oc, void *data)
+static void i2c_echo_class_init(ObjectClass *oc, const void *data)
 {
     I2CSlaveClass *sc = I2C_SLAVE_CLASS(oc);
     DeviceClass *dc = DEVICE_CLASS(oc);
diff --git a/hw/misc/imx25_ccm.c b/hw/misc/imx25_ccm.c
index 9654d23f19..a6665d5535 100644
--- a/hw/misc/imx25_ccm.c
+++ b/hw/misc/imx25_ccm.c
@@ -292,7 +292,7 @@ static void imx25_ccm_init(Object *obj)
     sysbus_init_mmio(sd, &s->iomem);
 }
 
-static void imx25_ccm_class_init(ObjectClass *klass, void *data)
+static void imx25_ccm_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     IMXCCMClass *ccm = IMX_CCM_CLASS(klass);
diff --git a/hw/misc/imx31_ccm.c b/hw/misc/imx31_ccm.c
index 93130b24e5..339458e859 100644
--- a/hw/misc/imx31_ccm.c
+++ b/hw/misc/imx31_ccm.c
@@ -319,7 +319,7 @@ static void imx31_ccm_init(Object *obj)
     sysbus_init_mmio(sd, &s->iomem);
 }
 
-static void imx31_ccm_class_init(ObjectClass *klass, void *data)
+static void imx31_ccm_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc  = DEVICE_CLASS(klass);
     IMXCCMClass *ccm = IMX_CCM_CLASS(klass);
diff --git a/hw/misc/imx6_ccm.c b/hw/misc/imx6_ccm.c
index 7d522ed7c5..a10b67d396 100644
--- a/hw/misc/imx6_ccm.c
+++ b/hw/misc/imx6_ccm.c
@@ -741,7 +741,7 @@ static void imx6_ccm_init(Object *obj)
     sysbus_init_mmio(sd, &s->container);
 }
 
-static void imx6_ccm_class_init(ObjectClass *klass, void *data)
+static void imx6_ccm_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     IMXCCMClass *ccm = IMX_CCM_CLASS(klass);
diff --git a/hw/misc/imx6_src.c b/hw/misc/imx6_src.c
index 06cc46292e..8d2c4175e4 100644
--- a/hw/misc/imx6_src.c
+++ b/hw/misc/imx6_src.c
@@ -273,7 +273,7 @@ static void imx6_src_realize(DeviceState *dev, Error **errp)
     sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->iomem);
 }
 
-static void imx6_src_class_init(ObjectClass *klass, void *data)
+static void imx6_src_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/imx6ul_ccm.c b/hw/misc/imx6ul_ccm.c
index c836dfe494..7f3ae61710 100644
--- a/hw/misc/imx6ul_ccm.c
+++ b/hw/misc/imx6ul_ccm.c
@@ -904,7 +904,7 @@ static void imx6ul_ccm_init(Object *obj)
     sysbus_init_mmio(sd, &s->container);
 }
 
-static void imx6ul_ccm_class_init(ObjectClass *klass, void *data)
+static void imx6ul_ccm_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     IMXCCMClass *ccm = IMX_CCM_CLASS(klass);
diff --git a/hw/misc/imx7_ccm.c b/hw/misc/imx7_ccm.c
index c3ecfd78c1..c061a584e4 100644
--- a/hw/misc/imx7_ccm.c
+++ b/hw/misc/imx7_ccm.c
@@ -262,7 +262,7 @@ static uint32_t imx7_ccm_get_clock_frequency(IMXCCMState *dev, IMXClk clock)
     return freq;
 }
 
-static void imx7_ccm_class_init(ObjectClass *klass, void *data)
+static void imx7_ccm_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     IMXCCMClass *ccm = IMX_CCM_CLASS(klass);
@@ -293,7 +293,7 @@ static const VMStateDescription vmstate_imx7_analog = {
     },
 };
 
-static void imx7_analog_class_init(ObjectClass *klass, void *data)
+static void imx7_analog_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/imx7_gpr.c b/hw/misc/imx7_gpr.c
index b03341a2eb..e12b496273 100644
--- a/hw/misc/imx7_gpr.c
+++ b/hw/misc/imx7_gpr.c
@@ -102,7 +102,7 @@ static void imx7_gpr_init(Object *obj)
     sysbus_init_mmio(sd, &s->mmio);
 }
 
-static void imx7_gpr_class_init(ObjectClass *klass, void *data)
+static void imx7_gpr_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/imx7_snvs.c b/hw/misc/imx7_snvs.c
index c8a096bc13..6a8733d23d 100644
--- a/hw/misc/imx7_snvs.c
+++ b/hw/misc/imx7_snvs.c
@@ -143,7 +143,7 @@ static void imx7_snvs_init(Object *obj)
         qemu_clock_get_ns(rtc_clock) / NANOSECONDS_PER_SECOND;
 }
 
-static void imx7_snvs_class_init(ObjectClass *klass, void *data)
+static void imx7_snvs_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/imx7_src.c b/hw/misc/imx7_src.c
index 35341c6819..df0b0a6905 100644
--- a/hw/misc/imx7_src.c
+++ b/hw/misc/imx7_src.c
@@ -251,7 +251,7 @@ static void imx7_src_realize(DeviceState *dev, Error **errp)
     sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->iomem);
 }
 
-static void imx7_src_class_init(ObjectClass *klass, void *data)
+static void imx7_src_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/imx8mp_analog.c b/hw/misc/imx8mp_analog.c
index f7e7c83cc4..23ffae84f8 100644
--- a/hw/misc/imx8mp_analog.c
+++ b/hw/misc/imx8mp_analog.c
@@ -138,7 +138,7 @@ static const VMStateDescription imx8mp_analog_vmstate = {
     },
 };
 
-static void imx8mp_analog_class_init(ObjectClass *klass, void *data)
+static void imx8mp_analog_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/imx8mp_ccm.c b/hw/misc/imx8mp_ccm.c
index 1a1c932427..911911ed86 100644
--- a/hw/misc/imx8mp_ccm.c
+++ b/hw/misc/imx8mp_ccm.c
@@ -150,7 +150,7 @@ static uint32_t imx8mp_ccm_get_clock_frequency(IMXCCMState *dev, IMXClk clock)
     return freq;
 }
 
-static void imx8mp_ccm_class_init(ObjectClass *klass, void *data)
+static void imx8mp_ccm_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     IMXCCMClass *ccm = IMX_CCM_CLASS(klass);
diff --git a/hw/misc/imx_rngc.c b/hw/misc/imx_rngc.c
index 0cbf28db5d..630f6cb54b 100644
--- a/hw/misc/imx_rngc.c
+++ b/hw/misc/imx_rngc.c
@@ -254,7 +254,7 @@ static const VMStateDescription vmstate_imx_rngc = {
     }
 };
 
-static void imx_rngc_class_init(ObjectClass *klass, void *data)
+static void imx_rngc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/iosb.c b/hw/misc/iosb.c
index 31927eaedb..96221e1ee5 100644
--- a/hw/misc/iosb.c
+++ b/hw/misc/iosb.c
@@ -111,7 +111,7 @@ static const VMStateDescription vmstate_iosb = {
     }
 };
 
-static void iosb_class_init(ObjectClass *oc, void *data)
+static void iosb_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     ResettableClass *rc = RESETTABLE_CLASS(oc);
diff --git a/hw/misc/iotkit-secctl.c b/hw/misc/iotkit-secctl.c
index 04ced3559c..afd9ab48df 100644
--- a/hw/misc/iotkit-secctl.c
+++ b/hw/misc/iotkit-secctl.c
@@ -818,7 +818,7 @@ static const Property iotkit_secctl_props[] = {
     DEFINE_PROP_UINT32("sse-version", IoTKitSecCtl, sse_version, 0),
 };
 
-static void iotkit_secctl_class_init(ObjectClass *klass, void *data)
+static void iotkit_secctl_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/iotkit-sysctl.c b/hw/misc/iotkit-sysctl.c
index c654af2e88..d70e51ab2e 100644
--- a/hw/misc/iotkit-sysctl.c
+++ b/hw/misc/iotkit-sysctl.c
@@ -844,7 +844,7 @@ static const Property iotkit_sysctl_props[] = {
                        0x10000000),
 };
 
-static void iotkit_sysctl_class_init(ObjectClass *klass, void *data)
+static void iotkit_sysctl_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/iotkit-sysinfo.c b/hw/misc/iotkit-sysinfo.c
index 75260f7fab..57405cb7e1 100644
--- a/hw/misc/iotkit-sysinfo.c
+++ b/hw/misc/iotkit-sysinfo.c
@@ -158,7 +158,7 @@ static void iotkit_sysinfo_realize(DeviceState *dev, Error **errp)
     }
 }
 
-static void iotkit_sysinfo_class_init(ObjectClass *klass, void *data)
+static void iotkit_sysinfo_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/ivshmem-flat.c b/hw/misc/ivshmem-flat.c
index c4e82a0827..be28c24d73 100644
--- a/hw/misc/ivshmem-flat.c
+++ b/hw/misc/ivshmem-flat.c
@@ -431,7 +431,7 @@ static const Property ivshmem_flat_props[] = {
     DEFINE_PROP_UINT32("shmem-size", IvshmemFTState, shmem_size, 4 * MiB),
 };
 
-static void ivshmem_flat_class_init(ObjectClass *klass, void *data)
+static void ivshmem_flat_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/ivshmem-pci.c b/hw/misc/ivshmem-pci.c
index 900d523334..2844b6f909 100644
--- a/hw/misc/ivshmem-pci.c
+++ b/hw/misc/ivshmem-pci.c
@@ -979,7 +979,7 @@ static int ivshmem_post_load(void *opaque, int version_id)
     return 0;
 }
 
-static void ivshmem_common_class_init(ObjectClass *klass, void *data)
+static void ivshmem_common_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
@@ -1044,7 +1044,7 @@ static void ivshmem_plain_realize(PCIDevice *dev, Error **errp)
     ivshmem_common_realize(dev, errp);
 }
 
-static void ivshmem_plain_class_init(ObjectClass *klass, void *data)
+static void ivshmem_plain_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
@@ -1103,7 +1103,7 @@ static void ivshmem_doorbell_realize(PCIDevice *dev, Error **errp)
     ivshmem_common_realize(dev, errp);
 }
 
-static void ivshmem_doorbell_class_init(ObjectClass *klass, void *data)
+static void ivshmem_doorbell_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
diff --git a/hw/misc/lasi.c b/hw/misc/lasi.c
index 24d20ffcb8..9f758c6a86 100644
--- a/hw/misc/lasi.c
+++ b/hw/misc/lasi.c
@@ -263,7 +263,7 @@ static void lasi_init(Object *obj)
     qdev_init_gpio_in(DEVICE(obj), lasi_set_irq, LASI_IRQS);
 }
 
-static void lasi_class_init(ObjectClass *klass, void *data)
+static void lasi_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/led.c b/hw/misc/led.c
index 9364d9945e..f7f709072a 100644
--- a/hw/misc/led.c
+++ b/hw/misc/led.c
@@ -107,7 +107,7 @@ static const Property led_properties[] = {
     DEFINE_PROP_BOOL("gpio-active-high", LEDState, gpio_active_high, true),
 };
 
-static void led_class_init(ObjectClass *klass, void *data)
+static void led_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/mac_via.c b/hw/misc/mac_via.c
index 3c0819c58a..bc37e2a2cb 100644
--- a/hw/misc/mac_via.c
+++ b/hw/misc/mac_via.c
@@ -1326,7 +1326,7 @@ static const Property mos6522_q800_via1_properties[] = {
     DEFINE_PROP_DRIVE("drive", MOS6522Q800VIA1State, blk),
 };
 
-static void mos6522_q800_via1_class_init(ObjectClass *oc, void *data)
+static void mos6522_q800_via1_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     ResettableClass *rc = RESETTABLE_CLASS(oc);
@@ -1415,7 +1415,7 @@ static const VMStateDescription vmstate_q800_via2 = {
     }
 };
 
-static void mos6522_q800_via2_class_init(ObjectClass *oc, void *data)
+static void mos6522_q800_via2_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     ResettableClass *rc = RESETTABLE_CLASS(oc);
diff --git a/hw/misc/macio/cuda.c b/hw/misc/macio/cuda.c
index 34731ae560..bcd00c9bb1 100644
--- a/hw/misc/macio/cuda.c
+++ b/hw/misc/macio/cuda.c
@@ -558,7 +558,7 @@ static const Property cuda_properties[] = {
     DEFINE_PROP_UINT64("timebase-frequency", CUDAState, tb_frequency, 0),
 };
 
-static void cuda_class_init(ObjectClass *oc, void *data)
+static void cuda_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
@@ -598,7 +598,7 @@ static void mos6522_cuda_reset_hold(Object *obj, ResetType type)
     ms->timers[1].frequency = (SCALE_US * 6000) / 4700;
 }
 
-static void mos6522_cuda_class_init(ObjectClass *oc, void *data)
+static void mos6522_cuda_class_init(ObjectClass *oc, const void *data)
 {
     ResettableClass *rc = RESETTABLE_CLASS(oc);
     MOS6522DeviceClass *mdc = MOS6522_CLASS(oc);
diff --git a/hw/misc/macio/gpio.c b/hw/misc/macio/gpio.c
index e87bfca1f5..e5d1e1168e 100644
--- a/hw/misc/macio/gpio.c
+++ b/hw/misc/macio/gpio.c
@@ -194,7 +194,7 @@ static void macio_gpio_nmi(NMIState *n, int cpu_index, Error **errp)
     macio_set_gpio(MACIO_GPIO(n), 9, false);
 }
 
-static void macio_gpio_class_init(ObjectClass *oc, void *data)
+static void macio_gpio_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     NMIClass *nc = NMI_CLASS(oc);
diff --git a/hw/misc/macio/mac_dbdma.c b/hw/misc/macio/mac_dbdma.c
index de0f934f7d..b2b42dd562 100644
--- a/hw/misc/macio/mac_dbdma.c
+++ b/hw/misc/macio/mac_dbdma.c
@@ -917,7 +917,7 @@ static void mac_dbdma_realize(DeviceState *dev, Error **errp)
     s->bh = qemu_bh_new_guarded(DBDMA_run_bh, s, &dev->mem_reentrancy_guard);
 }
 
-static void mac_dbdma_class_init(ObjectClass *oc, void *data)
+static void mac_dbdma_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
diff --git a/hw/misc/macio/macio.c b/hw/misc/macio/macio.c
index 194b152eff..b0418db49e 100644
--- a/hw/misc/macio/macio.c
+++ b/hw/misc/macio/macio.c
@@ -385,7 +385,7 @@ static const VMStateDescription vmstate_macio_oldworld = {
     }
 };
 
-static void macio_oldworld_class_init(ObjectClass *oc, void *data)
+static void macio_oldworld_class_init(ObjectClass *oc, const void *data)
 {
     PCIDeviceClass *pdc = PCI_DEVICE_CLASS(oc);
     DeviceClass *dc = DEVICE_CLASS(oc);
@@ -410,7 +410,7 @@ static const Property macio_newworld_properties[] = {
     DEFINE_PROP_BOOL("has-adb", NewWorldMacIOState, has_adb, false),
 };
 
-static void macio_newworld_class_init(ObjectClass *oc, void *data)
+static void macio_newworld_class_init(ObjectClass *oc, const void *data)
 {
     PCIDeviceClass *pdc = PCI_DEVICE_CLASS(oc);
     DeviceClass *dc = DEVICE_CLASS(oc);
@@ -425,7 +425,7 @@ static const Property macio_properties[] = {
     DEFINE_PROP_UINT64("frequency", MacIOState, frequency, 0),
 };
 
-static void macio_class_init(ObjectClass *klass, void *data)
+static void macio_class_init(ObjectClass *klass, const void *data)
 {
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
diff --git a/hw/misc/macio/pmu.c b/hw/misc/macio/pmu.c
index 73190559a8..3734913994 100644
--- a/hw/misc/macio/pmu.c
+++ b/hw/misc/macio/pmu.c
@@ -764,7 +764,7 @@ static const Property pmu_properties[] = {
     DEFINE_PROP_BOOL("has-adb", PMUState, has_adb, true),
 };
 
-static void pmu_class_init(ObjectClass *oc, void *data)
+static void pmu_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
@@ -808,7 +808,7 @@ static void mos6522_pmu_reset_hold(Object *obj, ResetType type)
     s->last_b = ms->b = TACK | TREQ;
 }
 
-static void mos6522_pmu_class_init(ObjectClass *oc, void *data)
+static void mos6522_pmu_class_init(ObjectClass *oc, const void *data)
 {
     ResettableClass *rc = RESETTABLE_CLASS(oc);
     MOS6522DeviceClass *mdc = MOS6522_CLASS(oc);
diff --git a/hw/misc/mchp_pfsoc_dmc.c b/hw/misc/mchp_pfsoc_dmc.c
index 43d8e970ab..599f845f45 100644
--- a/hw/misc/mchp_pfsoc_dmc.c
+++ b/hw/misc/mchp_pfsoc_dmc.c
@@ -110,7 +110,8 @@ static void mchp_pfsoc_ddr_sgmii_phy_realize(DeviceState *dev, Error **errp)
     sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->sgmii_phy);
 }
 
-static void mchp_pfsoc_ddr_sgmii_phy_class_init(ObjectClass *klass, void *data)
+static void mchp_pfsoc_ddr_sgmii_phy_class_init(ObjectClass *klass,
+                                                const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -192,7 +193,7 @@ static void mchp_pfsoc_ddr_cfg_realize(DeviceState *dev, Error **errp)
     sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->cfg);
 }
 
-static void mchp_pfsoc_ddr_cfg_class_init(ObjectClass *klass, void *data)
+static void mchp_pfsoc_ddr_cfg_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/mchp_pfsoc_ioscb.c b/hw/misc/mchp_pfsoc_ioscb.c
index a71d134295..10fc7ea2a9 100644
--- a/hw/misc/mchp_pfsoc_ioscb.c
+++ b/hw/misc/mchp_pfsoc_ioscb.c
@@ -292,7 +292,7 @@ static void mchp_pfsoc_ioscb_realize(DeviceState *dev, Error **errp)
     sysbus_init_irq(SYS_BUS_DEVICE(dev), &s->irq);
 }
 
-static void mchp_pfsoc_ioscb_class_init(ObjectClass *klass, void *data)
+static void mchp_pfsoc_ioscb_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/mchp_pfsoc_sysreg.c b/hw/misc/mchp_pfsoc_sysreg.c
index 7876fe0c5b..bfa78d3d2f 100644
--- a/hw/misc/mchp_pfsoc_sysreg.c
+++ b/hw/misc/mchp_pfsoc_sysreg.c
@@ -85,7 +85,7 @@ static void mchp_pfsoc_sysreg_realize(DeviceState *dev, Error **errp)
     sysbus_init_irq(SYS_BUS_DEVICE(dev), &s->irq);
 }
 
-static void mchp_pfsoc_sysreg_class_init(ObjectClass *klass, void *data)
+static void mchp_pfsoc_sysreg_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/mips_cmgcr.c b/hw/misc/mips_cmgcr.c
index 95f19912b4..5484b73967 100644
--- a/hw/misc/mips_cmgcr.c
+++ b/hw/misc/mips_cmgcr.c
@@ -229,7 +229,7 @@ static void mips_gcr_realize(DeviceState *dev, Error **errp)
     s->vps = g_new(MIPSGCRVPState, s->num_vps);
 }
 
-static void mips_gcr_class_init(ObjectClass *klass, void *data)
+static void mips_gcr_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     device_class_set_props(dc, mips_gcr_properties);
diff --git a/hw/misc/mips_cpc.c b/hw/misc/mips_cpc.c
index b7a13d1afb..9bfb7c9721 100644
--- a/hw/misc/mips_cpc.c
+++ b/hw/misc/mips_cpc.c
@@ -166,7 +166,7 @@ static const Property mips_cpc_properties[] = {
     DEFINE_PROP_UINT64("vp-start-running", MIPSCPCState, vp_start_running, 0x1),
 };
 
-static void mips_cpc_class_init(ObjectClass *klass, void *data)
+static void mips_cpc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/mips_itu.c b/hw/misc/mips_itu.c
index 2d126ebaf8..fc17385cde 100644
--- a/hw/misc/mips_itu.c
+++ b/hw/misc/mips_itu.c
@@ -540,7 +540,7 @@ static const Property mips_itu_properties[] = {
                       ITC_SEMAPH_NUM_MAX),
 };
 
-static void mips_itu_class_init(ObjectClass *klass, void *data)
+static void mips_itu_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/mos6522.c b/hw/misc/mos6522.c
index 0b8f6a4cb4..8dd6b82ac5 100644
--- a/hw/misc/mos6522.c
+++ b/hw/misc/mos6522.c
@@ -700,7 +700,7 @@ static const Property mos6522_properties[] = {
     DEFINE_PROP_UINT64("frequency", MOS6522State, frequency, 0),
 };
 
-static void mos6522_class_init(ObjectClass *oc, void *data)
+static void mos6522_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     ResettableClass *rc = RESETTABLE_CLASS(oc);
diff --git a/hw/misc/mps2-fpgaio.c b/hw/misc/mps2-fpgaio.c
index 04a3da5db0..bee1309f5a 100644
--- a/hw/misc/mps2-fpgaio.c
+++ b/hw/misc/mps2-fpgaio.c
@@ -328,7 +328,7 @@ static const Property mps2_fpgaio_properties[] = {
     DEFINE_PROP_BOOL("has-dbgctrl", MPS2FPGAIO, has_dbgctrl, false),
 };
 
-static void mps2_fpgaio_class_init(ObjectClass *klass, void *data)
+static void mps2_fpgaio_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/mps2-scc.c b/hw/misc/mps2-scc.c
index 5f8d6bca43..a9a5d4a535 100644
--- a/hw/misc/mps2-scc.c
+++ b/hw/misc/mps2-scc.c
@@ -474,7 +474,7 @@ static const Property mps2_scc_properties[] = {
                       qdev_prop_uint32, uint32_t),
 };
 
-static void mps2_scc_class_init(ObjectClass *klass, void *data)
+static void mps2_scc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/msf2-sysreg.c b/hw/misc/msf2-sysreg.c
index 20009adbd9..ce0ad50c1b 100644
--- a/hw/misc/msf2-sysreg.c
+++ b/hw/misc/msf2-sysreg.c
@@ -136,7 +136,7 @@ static void msf2_sysreg_realize(DeviceState *dev, Error **errp)
     }
 }
 
-static void msf2_sysreg_class_init(ObjectClass *klass, void *data)
+static void msf2_sysreg_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/npcm7xx_mft.c b/hw/misc/npcm7xx_mft.c
index e565cac05d..b35e971fe5 100644
--- a/hw/misc/npcm7xx_mft.c
+++ b/hw/misc/npcm7xx_mft.c
@@ -515,7 +515,7 @@ static const VMStateDescription vmstate_npcm7xx_mft = {
     },
 };
 
-static void npcm7xx_mft_class_init(ObjectClass *klass, void *data)
+static void npcm7xx_mft_class_init(ObjectClass *klass, const void *data)
 {
     ResettableClass *rc = RESETTABLE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
diff --git a/hw/misc/npcm7xx_pwm.c b/hw/misc/npcm7xx_pwm.c
index f7f77e30a2..2de18d09b8 100644
--- a/hw/misc/npcm7xx_pwm.c
+++ b/hw/misc/npcm7xx_pwm.c
@@ -543,7 +543,7 @@ static const VMStateDescription vmstate_npcm7xx_pwm_module = {
     },
 };
 
-static void npcm7xx_pwm_class_init(ObjectClass *klass, void *data)
+static void npcm7xx_pwm_class_init(ObjectClass *klass, const void *data)
 {
     ResettableClass *rc = RESETTABLE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
diff --git a/hw/misc/npcm7xx_rng.c b/hw/misc/npcm7xx_rng.c
index 7f7e5eca62..7d47a1caa0 100644
--- a/hw/misc/npcm7xx_rng.c
+++ b/hw/misc/npcm7xx_rng.c
@@ -158,7 +158,7 @@ static const VMStateDescription vmstate_npcm7xx_rng = {
     },
 };
 
-static void npcm7xx_rng_class_init(ObjectClass *klass, void *data)
+static void npcm7xx_rng_class_init(ObjectClass *klass, const void *data)
 {
     ResettableClass *rc = RESETTABLE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
diff --git a/hw/misc/npcm_clk.c b/hw/misc/npcm_clk.c
index b6a893ffb2..c48d40b446 100644
--- a/hw/misc/npcm_clk.c
+++ b/hw/misc/npcm_clk.c
@@ -1102,7 +1102,7 @@ static const VMStateDescription vmstate_npcm_clk = {
     },
 };
 
-static void npcm7xx_clk_pll_class_init(ObjectClass *klass, void *data)
+static void npcm7xx_clk_pll_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -1112,7 +1112,7 @@ static void npcm7xx_clk_pll_class_init(ObjectClass *klass, void *data)
     dc->user_creatable = false;
 }
 
-static void npcm7xx_clk_sel_class_init(ObjectClass *klass, void *data)
+static void npcm7xx_clk_sel_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -1122,7 +1122,7 @@ static void npcm7xx_clk_sel_class_init(ObjectClass *klass, void *data)
     dc->user_creatable = false;
 }
 
-static void npcm7xx_clk_divider_class_init(ObjectClass *klass, void *data)
+static void npcm7xx_clk_divider_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -1132,7 +1132,7 @@ static void npcm7xx_clk_divider_class_init(ObjectClass *klass, void *data)
     dc->user_creatable = false;
 }
 
-static void npcm_clk_class_init(ObjectClass *klass, void *data)
+static void npcm_clk_class_init(ObjectClass *klass, const void *data)
 {
     ResettableClass *rc = RESETTABLE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -1142,7 +1142,7 @@ static void npcm_clk_class_init(ObjectClass *klass, void *data)
     rc->phases.enter = npcm_clk_enter_reset;
 }
 
-static void npcm7xx_clk_class_init(ObjectClass *klass, void *data)
+static void npcm7xx_clk_class_init(ObjectClass *klass, const void *data)
 {
     NPCMCLKClass *c = NPCM_CLK_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -1152,7 +1152,7 @@ static void npcm7xx_clk_class_init(ObjectClass *klass, void *data)
     c->cold_reset_values = npcm7xx_cold_reset_values;
 }
 
-static void npcm8xx_clk_class_init(ObjectClass *klass, void *data)
+static void npcm8xx_clk_class_init(ObjectClass *klass, const void *data)
 {
     NPCMCLKClass *c = NPCM_CLK_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
diff --git a/hw/misc/npcm_gcr.c b/hw/misc/npcm_gcr.c
index 4e8ce2cb89..2acaa16771 100644
--- a/hw/misc/npcm_gcr.c
+++ b/hw/misc/npcm_gcr.c
@@ -422,7 +422,7 @@ static const Property npcm_gcr_properties[] = {
     DEFINE_PROP_UINT32("power-on-straps", NPCMGCRState, reset_pwron, 0),
 };
 
-static void npcm_gcr_class_init(ObjectClass *klass, void *data)
+static void npcm_gcr_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -432,7 +432,7 @@ static void npcm_gcr_class_init(ObjectClass *klass, void *data)
     device_class_set_props(dc, npcm_gcr_properties);
 }
 
-static void npcm7xx_gcr_class_init(ObjectClass *klass, void *data)
+static void npcm7xx_gcr_class_init(ObjectClass *klass, const void *data)
 {
     NPCMGCRClass *c = NPCM_GCR_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -446,7 +446,7 @@ static void npcm7xx_gcr_class_init(ObjectClass *klass, void *data)
     rc->phases.enter = npcm7xx_gcr_enter_reset;
 }
 
-static void npcm8xx_gcr_class_init(ObjectClass *klass, void *data)
+static void npcm8xx_gcr_class_init(ObjectClass *klass, const void *data)
 {
     NPCMGCRClass *c = NPCM_GCR_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
diff --git a/hw/misc/nrf51_rng.c b/hw/misc/nrf51_rng.c
index 1e67acdf23..8cd7ffe3f5 100644
--- a/hw/misc/nrf51_rng.c
+++ b/hw/misc/nrf51_rng.c
@@ -240,7 +240,7 @@ static const VMStateDescription vmstate_rng = {
     }
 };
 
-static void nrf51_rng_class_init(ObjectClass *klass, void *data)
+static void nrf51_rng_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/pc-testdev.c b/hw/misc/pc-testdev.c
index e389651869..67c486f347 100644
--- a/hw/misc/pc-testdev.c
+++ b/hw/misc/pc-testdev.c
@@ -193,7 +193,7 @@ static void testdev_realizefn(DeviceState *d, Error **errp)
     memory_region_add_subregion(mem, 0xff000000, &dev->iomem);
 }
 
-static void testdev_class_init(ObjectClass *klass, void *data)
+static void testdev_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/pci-testdev.c b/hw/misc/pci-testdev.c
index f6718a7c37..0ea26451f1 100644
--- a/hw/misc/pci-testdev.c
+++ b/hw/misc/pci-testdev.c
@@ -323,7 +323,7 @@ static const Property pci_testdev_properties[] = {
     DEFINE_PROP_SIZE("membar", PCITestDevState, membar_size, 0),
 };
 
-static void pci_testdev_class_init(ObjectClass *klass, void *data)
+static void pci_testdev_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
diff --git a/hw/misc/pvpanic-isa.c b/hw/misc/pvpanic-isa.c
index c3713dc5c4..55522ee56c 100644
--- a/hw/misc/pvpanic-isa.c
+++ b/hw/misc/pvpanic-isa.c
@@ -104,7 +104,7 @@ static const Property pvpanic_isa_properties[] = {
                       PVPANIC_EVENTS),
 };
 
-static void pvpanic_isa_class_init(ObjectClass *klass, void *data)
+static void pvpanic_isa_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     AcpiDevAmlIfClass *adevc = ACPI_DEV_AML_IF_CLASS(klass);
diff --git a/hw/misc/pvpanic-mmio.c b/hw/misc/pvpanic-mmio.c
index 70097cecc7..2a363106b2 100644
--- a/hw/misc/pvpanic-mmio.c
+++ b/hw/misc/pvpanic-mmio.c
@@ -36,7 +36,7 @@ static const Property pvpanic_mmio_properties[] = {
                       PVPANIC_PANICKED | PVPANIC_CRASH_LOADED),
 };
 
-static void pvpanic_mmio_class_init(ObjectClass *klass, void *data)
+static void pvpanic_mmio_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/pvpanic-pci.c b/hw/misc/pvpanic-pci.c
index e5f0788ec0..51ebf66107 100644
--- a/hw/misc/pvpanic-pci.c
+++ b/hw/misc/pvpanic-pci.c
@@ -58,7 +58,7 @@ static const Property pvpanic_pci_properties[] = {
                       PVPANIC_EVENTS),
 };
 
-static void pvpanic_pci_class_init(ObjectClass *klass, void *data)
+static void pvpanic_pci_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *pc = PCI_DEVICE_CLASS(klass);
diff --git a/hw/misc/sbsa_ec.c b/hw/misc/sbsa_ec.c
index a1e813691e..dfee1af5ad 100644
--- a/hw/misc/sbsa_ec.c
+++ b/hw/misc/sbsa_ec.c
@@ -73,7 +73,7 @@ static void sbsa_ec_init(Object *obj)
     sysbus_init_mmio(dev, &s->iomem);
 }
 
-static void sbsa_ec_class_init(ObjectClass *klass, void *data)
+static void sbsa_ec_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/sifive_e_aon.c b/hw/misc/sifive_e_aon.c
index 17a522ccf9..6eef38d622 100644
--- a/hw/misc/sifive_e_aon.c
+++ b/hw/misc/sifive_e_aon.c
@@ -294,7 +294,7 @@ static const Property sifive_e_aon_properties[] = {
                        SIFIVE_E_LFCLK_DEFAULT_FREQ),
 };
 
-static void sifive_e_aon_class_init(ObjectClass *oc, void *data)
+static void sifive_e_aon_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
diff --git a/hw/misc/sifive_u_otp.c b/hw/misc/sifive_u_otp.c
index d6df867fbd..1ebed2fd8b 100644
--- a/hw/misc/sifive_u_otp.c
+++ b/hw/misc/sifive_u_otp.c
@@ -270,7 +270,7 @@ static void sifive_u_otp_realize(DeviceState *dev, Error **errp)
     memset(s->fuse_wo, 0x00, sizeof(s->fuse_wo));
 }
 
-static void sifive_u_otp_class_init(ObjectClass *klass, void *data)
+static void sifive_u_otp_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/sifive_u_prci.c b/hw/misc/sifive_u_prci.c
index cafe6a66f4..6e75cb6d0d 100644
--- a/hw/misc/sifive_u_prci.c
+++ b/hw/misc/sifive_u_prci.c
@@ -146,7 +146,7 @@ static void sifive_u_prci_reset(DeviceState *dev)
     s->coreclksel = SIFIVE_U_PRCI_CORECLKSEL_HFCLK;
 }
 
-static void sifive_u_prci_class_init(ObjectClass *klass, void *data)
+static void sifive_u_prci_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/slavio_misc.c b/hw/misc/slavio_misc.c
index dace6d28cc..a034df3592 100644
--- a/hw/misc/slavio_misc.c
+++ b/hw/misc/slavio_misc.c
@@ -483,7 +483,7 @@ static void slavio_misc_init(Object *obj)
     qdev_init_gpio_in(dev, slavio_set_power_fail, 1);
 }
 
-static void slavio_misc_class_init(ObjectClass *klass, void *data)
+static void slavio_misc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/stm32_rcc.c b/hw/misc/stm32_rcc.c
index 26672b5b24..94e8dae441 100644
--- a/hw/misc/stm32_rcc.c
+++ b/hw/misc/stm32_rcc.c
@@ -138,7 +138,7 @@ static const VMStateDescription vmstate_stm32_rcc = {
     }
 };
 
-static void stm32_rcc_class_init(ObjectClass *klass, void *data)
+static void stm32_rcc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/stm32f2xx_syscfg.c b/hw/misc/stm32f2xx_syscfg.c
index 6c7b722274..d285896ea7 100644
--- a/hw/misc/stm32f2xx_syscfg.c
+++ b/hw/misc/stm32f2xx_syscfg.c
@@ -138,7 +138,7 @@ static void stm32f2xx_syscfg_init(Object *obj)
     sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
 }
 
-static void stm32f2xx_syscfg_class_init(ObjectClass *klass, void *data)
+static void stm32f2xx_syscfg_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/stm32f4xx_exti.c b/hw/misc/stm32f4xx_exti.c
index efd996df94..0688e6e73e 100644
--- a/hw/misc/stm32f4xx_exti.c
+++ b/hw/misc/stm32f4xx_exti.c
@@ -164,7 +164,7 @@ static const VMStateDescription vmstate_stm32f4xx_exti = {
     }
 };
 
-static void stm32f4xx_exti_class_init(ObjectClass *klass, void *data)
+static void stm32f4xx_exti_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/stm32f4xx_syscfg.c b/hw/misc/stm32f4xx_syscfg.c
index 7d0f3eb5f5..addfb031e8 100644
--- a/hw/misc/stm32f4xx_syscfg.c
+++ b/hw/misc/stm32f4xx_syscfg.c
@@ -147,7 +147,7 @@ static const VMStateDescription vmstate_stm32f4xx_syscfg = {
     }
 };
 
-static void stm32f4xx_syscfg_class_init(ObjectClass *klass, void *data)
+static void stm32f4xx_syscfg_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/stm32l4x5_exti.c b/hw/misc/stm32l4x5_exti.c
index e281841dcf..9c002164c8 100644
--- a/hw/misc/stm32l4x5_exti.c
+++ b/hw/misc/stm32l4x5_exti.c
@@ -271,7 +271,7 @@ static const VMStateDescription vmstate_stm32l4x5_exti = {
     }
 };
 
-static void stm32l4x5_exti_class_init(ObjectClass *klass, void *data)
+static void stm32l4x5_exti_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     ResettableClass *rc = RESETTABLE_CLASS(klass);
diff --git a/hw/misc/stm32l4x5_rcc.c b/hw/misc/stm32l4x5_rcc.c
index 158b743cae..0e1f27fbdd 100644
--- a/hw/misc/stm32l4x5_rcc.c
+++ b/hw/misc/stm32l4x5_rcc.c
@@ -141,7 +141,7 @@ static const VMStateDescription clock_mux_vmstate = {
     }
 };
 
-static void clock_mux_class_init(ObjectClass *klass, void *data)
+static void clock_mux_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     ResettableClass *rc = RESETTABLE_CLASS(klass);
@@ -295,7 +295,7 @@ static const VMStateDescription pll_vmstate = {
     }
 };
 
-static void pll_class_init(ObjectClass *klass, void *data)
+static void pll_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     ResettableClass *rc = RESETTABLE_CLASS(klass);
@@ -1439,7 +1439,7 @@ static const Property stm32l4x5_rcc_properties[] = {
         sai2_extclk_frequency, 0),
 };
 
-static void stm32l4x5_rcc_class_init(ObjectClass *klass, void *data)
+static void stm32l4x5_rcc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     ResettableClass *rc = RESETTABLE_CLASS(klass);
diff --git a/hw/misc/stm32l4x5_syscfg.c b/hw/misc/stm32l4x5_syscfg.c
index a947a9e036..4e21756e0b 100644
--- a/hw/misc/stm32l4x5_syscfg.c
+++ b/hw/misc/stm32l4x5_syscfg.c
@@ -259,7 +259,7 @@ static const VMStateDescription vmstate_stm32l4x5_syscfg = {
     }
 };
 
-static void stm32l4x5_syscfg_class_init(ObjectClass *klass, void *data)
+static void stm32l4x5_syscfg_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     ResettableClass *rc = RESETTABLE_CLASS(klass);
diff --git a/hw/misc/tz-mpc.c b/hw/misc/tz-mpc.c
index 6d827d21dc..a158d4a294 100644
--- a/hw/misc/tz-mpc.c
+++ b/hw/misc/tz-mpc.c
@@ -592,7 +592,7 @@ static const Property tz_mpc_properties[] = {
                      TYPE_MEMORY_REGION, MemoryRegion *),
 };
 
-static void tz_mpc_class_init(ObjectClass *klass, void *data)
+static void tz_mpc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -611,7 +611,7 @@ static const TypeInfo tz_mpc_info = {
 };
 
 static void tz_mpc_iommu_memory_region_class_init(ObjectClass *klass,
-                                                  void *data)
+                                                  const void *data)
 {
     IOMMUMemoryRegionClass *imrc = IOMMU_MEMORY_REGION_CLASS(klass);
 
diff --git a/hw/misc/tz-msc.c b/hw/misc/tz-msc.c
index 505df4e190..af0cc5d471 100644
--- a/hw/misc/tz-msc.c
+++ b/hw/misc/tz-msc.c
@@ -285,7 +285,7 @@ static const Property tz_msc_properties[] = {
                      TYPE_IDAU_INTERFACE, IDAUInterface *),
 };
 
-static void tz_msc_class_init(ObjectClass *klass, void *data)
+static void tz_msc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/tz-ppc.c b/hw/misc/tz-ppc.c
index 1daa54c5e6..e4235a846d 100644
--- a/hw/misc/tz-ppc.c
+++ b/hw/misc/tz-ppc.c
@@ -325,7 +325,7 @@ static const Property tz_ppc_properties[] = {
     DEFINE_PORT(15),
 };
 
-static void tz_ppc_class_init(ObjectClass *klass, void *data)
+static void tz_ppc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/unimp.c b/hw/misc/unimp.c
index 257282a3a9..4370c14ef1 100644
--- a/hw/misc/unimp.c
+++ b/hw/misc/unimp.c
@@ -75,7 +75,7 @@ static const Property unimp_properties[] = {
     DEFINE_PROP_STRING("name", UnimplementedDeviceState, name),
 };
 
-static void unimp_class_init(ObjectClass *klass, void *data)
+static void unimp_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/misc/virt_ctrl.c b/hw/misc/virt_ctrl.c
index a210a5924c..9f16093ca2 100644
--- a/hw/misc/virt_ctrl.c
+++ b/hw/misc/virt_ctrl.c
@@ -125,7 +125,7 @@ static void virt_ctrl_instance_init(Object *obj)
     sysbus_init_irq(dev, &s->irq);
 }
 
-static void virt_ctrl_class_init(ObjectClass *oc, void *data)
+static void virt_ctrl_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
diff --git a/hw/misc/vmcoreinfo.c b/hw/misc/vmcoreinfo.c
index b0145fa504..9c2e9005ad 100644
--- a/hw/misc/vmcoreinfo.c
+++ b/hw/misc/vmcoreinfo.c
@@ -83,7 +83,7 @@ static const VMStateDescription vmstate_vmcoreinfo = {
     },
 };
 
-static void vmcoreinfo_device_class_init(ObjectClass *klass, void *data)
+static void vmcoreinfo_device_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     ResettableClass *rc = RESETTABLE_CLASS(klass);
diff --git a/hw/misc/xlnx-versal-cframe-reg.c b/hw/misc/xlnx-versal-cframe-reg.c
index 8db0f7e658..e28d569ebe 100644
--- a/hw/misc/xlnx-versal-cframe-reg.c
+++ b/hw/misc/xlnx-versal-cframe-reg.c
@@ -803,7 +803,7 @@ static const Property cframe_bcast_regs_props[] = {
                      TYPE_XLNX_CFI_IF, XlnxCfiIf *),
 };
 
-static void cframe_reg_class_init(ObjectClass *klass, void *data)
+static void cframe_reg_class_init(ObjectClass *klass, const void *data)
 {
     ResettableClass *rc = RESETTABLE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -817,7 +817,7 @@ static void cframe_reg_class_init(ObjectClass *klass, void *data)
     xcic->cfi_transfer_packet = cframe_reg_cfi_transfer_packet;
 }
 
-static void cframe_bcast_reg_class_init(ObjectClass *klass, void *data)
+static void cframe_bcast_reg_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     ResettableClass *rc = RESETTABLE_CLASS(klass);
diff --git a/hw/misc/xlnx-versal-cfu.c b/hw/misc/xlnx-versal-cfu.c
index 26d06e2557..02e4fed05b 100644
--- a/hw/misc/xlnx-versal-cfu.c
+++ b/hw/misc/xlnx-versal-cfu.c
@@ -496,7 +496,7 @@ static const VMStateDescription vmstate_cfu_sfr = {
     }
 };
 
-static void cfu_apb_class_init(ObjectClass *klass, void *data)
+static void cfu_apb_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -505,7 +505,7 @@ static void cfu_apb_class_init(ObjectClass *klass, void *data)
     device_class_set_props(dc, cfu_props);
 }
 
-static void cfu_fdro_class_init(ObjectClass *klass, void *data)
+static void cfu_fdro_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     ResettableClass *rc = RESETTABLE_CLASS(klass);
@@ -516,7 +516,7 @@ static void cfu_fdro_class_init(ObjectClass *klass, void *data)
     rc->phases.enter = cfu_fdro_reset_enter;
 }
 
-static void cfu_sfr_class_init(ObjectClass *klass, void *data)
+static void cfu_sfr_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     ResettableClass *rc = RESETTABLE_CLASS(klass);
diff --git a/hw/misc/xlnx-versal-crl.c b/hw/misc/xlnx-versal-crl.c
index f143900d5b..08ff2fcc24 100644
--- a/hw/misc/xlnx-versal-crl.c
+++ b/hw/misc/xlnx-versal-crl.c
@@ -394,7 +394,7 @@ static const VMStateDescription vmstate_crl = {
     }
 };
 
-static void crl_class_init(ObjectClass *klass, void *data)
+static void crl_class_init(ObjectClass *klass, const void *data)
 {
     ResettableClass *rc = RESETTABLE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
diff --git a/hw/misc/xlnx-versal-pmc-iou-slcr.c b/hw/misc/xlnx-versal-pmc-iou-slcr.c
index e469c04d76..d76df468d4 100644
--- a/hw/misc/xlnx-versal-pmc-iou-slcr.c
+++ b/hw/misc/xlnx-versal-pmc-iou-slcr.c
@@ -1419,7 +1419,8 @@ static const VMStateDescription vmstate_pmc_iou_slcr = {
     }
 };
 
-static void xlnx_versal_pmc_iou_slcr_class_init(ObjectClass *klass, void *data)
+static void xlnx_versal_pmc_iou_slcr_class_init(ObjectClass *klass,
+                                                const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     ResettableClass *rc = RESETTABLE_CLASS(klass);
diff --git a/hw/misc/xlnx-versal-trng.c b/hw/misc/xlnx-versal-trng.c
index ba93f93cab..f34dd3ef35 100644
--- a/hw/misc/xlnx-versal-trng.c
+++ b/hw/misc/xlnx-versal-trng.c
@@ -682,7 +682,7 @@ static const VMStateDescription vmstate_trng = {
     }
 };
 
-static void trng_class_init(ObjectClass *klass, void *data)
+static void trng_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     ResettableClass *rc = RESETTABLE_CLASS(klass);
diff --git a/hw/misc/xlnx-versal-xramc.c b/hw/misc/xlnx-versal-xramc.c
index d1e76be027..07370b80c0 100644
--- a/hw/misc/xlnx-versal-xramc.c
+++ b/hw/misc/xlnx-versal-xramc.c
@@ -222,7 +222,7 @@ static const Property xram_ctrl_properties[] = {
     DEFINE_PROP_UINT64("size", XlnxXramCtrl, cfg.size, 1 * MiB),
 };
 
-static void xram_ctrl_class_init(ObjectClass *klass, void *data)
+static void xram_ctrl_class_init(ObjectClass *klass, const void *data)
 {
     ResettableClass *rc = RESETTABLE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
diff --git a/hw/misc/xlnx-zynqmp-apu-ctrl.c b/hw/misc/xlnx-zynqmp-apu-ctrl.c
index 87e4a14067..e85da32d99 100644
--- a/hw/misc/xlnx-zynqmp-apu-ctrl.c
+++ b/hw/misc/xlnx-zynqmp-apu-ctrl.c
@@ -224,7 +224,7 @@ static const VMStateDescription vmstate_zynqmp_apu = {
     }
 };
 
-static void zynqmp_apu_class_init(ObjectClass *klass, void *data)
+static void zynqmp_apu_class_init(ObjectClass *klass, const void *data)
 {
     ResettableClass *rc = RESETTABLE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
diff --git a/hw/misc/xlnx-zynqmp-crf.c b/hw/misc/xlnx-zynqmp-crf.c
index e5aba56f69..cccca0e814 100644
--- a/hw/misc/xlnx-zynqmp-crf.c
+++ b/hw/misc/xlnx-zynqmp-crf.c
@@ -239,7 +239,7 @@ static const VMStateDescription vmstate_crf = {
     }
 };
 
-static void crf_class_init(ObjectClass *klass, void *data)
+static void crf_class_init(ObjectClass *klass, const void *data)
 {
     ResettableClass *rc = RESETTABLE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
diff --git a/hw/misc/zynq_slcr.c b/hw/misc/zynq_slcr.c
index a766bab182..010387beec 100644
--- a/hw/misc/zynq_slcr.c
+++ b/hw/misc/zynq_slcr.c
@@ -627,7 +627,7 @@ static const Property zynq_slcr_props[] = {
     DEFINE_PROP_UINT8("boot-mode", ZynqSLCRState, boot_mode, 1),
 };
 
-static void zynq_slcr_class_init(ObjectClass *klass, void *data)
+static void zynq_slcr_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     ResettableClass *rc = RESETTABLE_CLASS(klass);
diff --git a/hw/net/allwinner-sun8i-emac.c b/hw/net/allwinner-sun8i-emac.c
index 5adb41dc46..30a81576b4 100644
--- a/hw/net/allwinner-sun8i-emac.c
+++ b/hw/net/allwinner-sun8i-emac.c
@@ -875,7 +875,8 @@ static const VMStateDescription vmstate_aw_emac = {
     }
 };
 
-static void allwinner_sun8i_emac_class_init(ObjectClass *klass, void *data)
+static void allwinner_sun8i_emac_class_init(ObjectClass *klass,
+                                            const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/net/allwinner_emac.c b/hw/net/allwinner_emac.c
index 47f1e7f086..77d089d988 100644
--- a/hw/net/allwinner_emac.c
+++ b/hw/net/allwinner_emac.c
@@ -514,7 +514,7 @@ static const VMStateDescription vmstate_aw_emac = {
     }
 };
 
-static void aw_emac_class_init(ObjectClass *klass, void *data)
+static void aw_emac_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
index 80fbbacc1e..50025d5a6f 100644
--- a/hw/net/cadence_gem.c
+++ b/hw/net/cadence_gem.c
@@ -1817,7 +1817,7 @@ static const Property gem_properties[] = {
                      TYPE_MEMORY_REGION, MemoryRegion *),
 };
 
-static void gem_class_init(ObjectClass *klass, void *data)
+static void gem_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/net/can/can_kvaser_pci.c b/hw/net/can/can_kvaser_pci.c
index 9e363d532f..c0bb598bae 100644
--- a/hw/net/can/can_kvaser_pci.c
+++ b/hw/net/can/can_kvaser_pci.c
@@ -282,7 +282,7 @@ static void kvaser_pci_instance_init(Object *obj)
                              0);
 }
 
-static void kvaser_pci_class_init(ObjectClass *klass, void *data)
+static void kvaser_pci_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
diff --git a/hw/net/can/can_mioe3680_pci.c b/hw/net/can/can_mioe3680_pci.c
index 580f099e00..9aac70dccd 100644
--- a/hw/net/can/can_mioe3680_pci.c
+++ b/hw/net/can/can_mioe3680_pci.c
@@ -223,7 +223,7 @@ static void mioe3680_pci_instance_init(Object *obj)
                              0);
 }
 
-static void mioe3680_pci_class_init(ObjectClass *klass, void *data)
+static void mioe3680_pci_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
diff --git a/hw/net/can/can_pcm3680_pci.c b/hw/net/can/can_pcm3680_pci.c
index 3195b79954..b305f7e9b7 100644
--- a/hw/net/can/can_pcm3680_pci.c
+++ b/hw/net/can/can_pcm3680_pci.c
@@ -224,7 +224,7 @@ static void pcm3680i_pci_instance_init(Object *obj)
                              0);
 }
 
-static void pcm3680i_pci_class_init(ObjectClass *klass, void *data)
+static void pcm3680i_pci_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
diff --git a/hw/net/can/ctucan_pci.c b/hw/net/can/ctucan_pci.c
index a8c77b9194..0dee9b59d1 100644
--- a/hw/net/can/ctucan_pci.c
+++ b/hw/net/can/ctucan_pci.c
@@ -237,7 +237,7 @@ static void ctucan_pci_instance_init(Object *obj)
 #endif
 }
 
-static void ctucan_pci_class_init(ObjectClass *klass, void *data)
+static void ctucan_pci_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
diff --git a/hw/net/can/xlnx-versal-canfd.c b/hw/net/can/xlnx-versal-canfd.c
index b5a4a4af7e..79ccc10098 100644
--- a/hw/net/can/xlnx-versal-canfd.c
+++ b/hw/net/can/xlnx-versal-canfd.c
@@ -2052,7 +2052,7 @@ static const Property canfd_core_properties[] = {
                      CanBusState *),
 };
 
-static void canfd_class_init(ObjectClass *klass, void *data)
+static void canfd_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/net/can/xlnx-zynqmp-can.c b/hw/net/can/xlnx-zynqmp-can.c
index 9fbdeea368..ca9edd4a5b 100644
--- a/hw/net/can/xlnx-zynqmp-can.c
+++ b/hw/net/can/xlnx-zynqmp-can.c
@@ -1176,7 +1176,7 @@ static const Property xlnx_zynqmp_can_properties[] = {
                      CanBusState *),
 };
 
-static void xlnx_zynqmp_can_class_init(ObjectClass *klass, void *data)
+static void xlnx_zynqmp_can_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     ResettableClass *rc = RESETTABLE_CLASS(klass);
diff --git a/hw/net/dp8393x.c b/hw/net/dp8393x.c
index c80ddb12e3..d49032059b 100644
--- a/hw/net/dp8393x.c
+++ b/hw/net/dp8393x.c
@@ -939,7 +939,7 @@ static const Property dp8393x_properties[] = {
     DEFINE_PROP_BOOL("big_endian", dp8393xState, big_endian, false),
 };
 
-static void dp8393x_class_init(ObjectClass *klass, void *data)
+static void dp8393x_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/net/e1000.c b/hw/net/e1000.c
index 3d0b227703..d49730f4ad 100644
--- a/hw/net/e1000.c
+++ b/hw/net/e1000.c
@@ -1694,7 +1694,7 @@ typedef struct E1000Info {
     uint16_t   phy_id2;
 } E1000Info;
 
-static void e1000_class_init(ObjectClass *klass, void *data)
+static void e1000_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     ResettableClass *rc = RESETTABLE_CLASS(klass);
diff --git a/hw/net/e1000e.c b/hw/net/e1000e.c
index b72cbab7e8..f38249a6a9 100644
--- a/hw/net/e1000e.c
+++ b/hw/net/e1000e.c
@@ -673,7 +673,7 @@ static const Property e1000e_properties[] = {
     DEFINE_PROP_BOOL("migrate-timadj", E1000EState, timadj, true),
 };
 
-static void e1000e_class_init(ObjectClass *class, void *data)
+static void e1000e_class_init(ObjectClass *class, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(class);
     ResettableClass *rc = RESETTABLE_CLASS(class);
diff --git a/hw/net/eepro100.c b/hw/net/eepro100.c
index 29a39865a6..ef0f9337a0 100644
--- a/hw/net/eepro100.c
+++ b/hw/net/eepro100.c
@@ -2060,7 +2060,7 @@ static const Property e100_properties[] = {
     DEFINE_NIC_PROPERTIES(EEPRO100State, conf),
 };
 
-static void eepro100_class_init(ObjectClass *klass, void *data)
+static void eepro100_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
diff --git a/hw/net/fsl_etsec/etsec.c b/hw/net/fsl_etsec/etsec.c
index adde644892..d14cb2a101 100644
--- a/hw/net/fsl_etsec/etsec.c
+++ b/hw/net/fsl_etsec/etsec.c
@@ -418,7 +418,7 @@ static const Property etsec_properties[] = {
     DEFINE_NIC_PROPERTIES(eTSEC, conf),
 };
 
-static void etsec_class_init(ObjectClass *klass, void *data)
+static void etsec_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/net/ftgmac100.c b/hw/net/ftgmac100.c
index 1f524d7a01..c41ce889cf 100644
--- a/hw/net/ftgmac100.c
+++ b/hw/net/ftgmac100.c
@@ -1260,7 +1260,7 @@ static const Property ftgmac100_properties[] = {
     DEFINE_PROP_BOOL("dma64", FTGMAC100State, dma64, false),
 };
 
-static void ftgmac100_class_init(ObjectClass *klass, void *data)
+static void ftgmac100_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -1419,7 +1419,7 @@ static const Property aspeed_mii_properties[] = {
                      FTGMAC100State *),
 };
 
-static void aspeed_mii_class_init(ObjectClass *klass, void *data)
+static void aspeed_mii_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/net/igb.c b/hw/net/igb.c
index e318df40e0..ba30433a50 100644
--- a/hw/net/igb.c
+++ b/hw/net/igb.c
@@ -599,7 +599,7 @@ static const Property igb_properties[] = {
     DEFINE_PROP_BOOL("x-pcie-flr-init", IGBState, has_flr, true),
 };
 
-static void igb_class_init(ObjectClass *class, void *data)
+static void igb_class_init(ObjectClass *class, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(class);
     ResettableClass *rc = RESETTABLE_CLASS(class);
diff --git a/hw/net/igbvf.c b/hw/net/igbvf.c
index 21a97d4d61..91e7ccf931 100644
--- a/hw/net/igbvf.c
+++ b/hw/net/igbvf.c
@@ -299,7 +299,7 @@ static void igbvf_pci_uninit(PCIDevice *dev)
     msix_uninit(dev, &s->msix, &s->msix);
 }
 
-static void igbvf_class_init(ObjectClass *class, void *data)
+static void igbvf_class_init(ObjectClass *class, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(class);
     PCIDeviceClass *c = PCI_DEVICE_CLASS(class);
diff --git a/hw/net/imx_fec.c b/hw/net/imx_fec.c
index b7c9ee0b9a..e5e34dd1a4 100644
--- a/hw/net/imx_fec.c
+++ b/hw/net/imx_fec.c
@@ -1230,7 +1230,7 @@ static const Property imx_eth_properties[] = {
                      IMXFECState *),
 };
 
-static void imx_eth_class_init(ObjectClass *klass, void *data)
+static void imx_eth_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/net/lan9118.c b/hw/net/lan9118.c
index afee68c7db..6dda1e5c94 100644
--- a/hw/net/lan9118.c
+++ b/hw/net/lan9118.c
@@ -1309,7 +1309,7 @@ static const Property lan9118_properties[] = {
     DEFINE_PROP_UINT32("mode_16bit", lan9118_state, mode_16bit, 0),
 };
 
-static void lan9118_class_init(ObjectClass *klass, void *data)
+static void lan9118_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/net/lan9118_phy.c b/hw/net/lan9118_phy.c
index 5c53a4a1e3..4c4e03df11 100644
--- a/hw/net/lan9118_phy.c
+++ b/hw/net/lan9118_phy.c
@@ -200,7 +200,7 @@ static const VMStateDescription vmstate_lan9118_phy = {
     }
 };
 
-static void lan9118_phy_class_init(ObjectClass *klass, void *data)
+static void lan9118_phy_class_init(ObjectClass *klass, const void *data)
 {
     ResettableClass *rc = RESETTABLE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
diff --git a/hw/net/lance.c b/hw/net/lance.c
index 15492382f9..dfb855c23a 100644
--- a/hw/net/lance.c
+++ b/hw/net/lance.c
@@ -143,7 +143,7 @@ static const Property lance_properties[] = {
     DEFINE_NIC_PROPERTIES(SysBusPCNetState, state.conf),
 };
 
-static void lance_class_init(ObjectClass *klass, void *data)
+static void lance_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/net/lasi_i82596.c b/hw/net/lasi_i82596.c
index cad01f5351..9e1dd21546 100644
--- a/hw/net/lasi_i82596.c
+++ b/hw/net/lasi_i82596.c
@@ -162,7 +162,7 @@ static const Property lasi_82596_properties[] = {
     DEFINE_NIC_PROPERTIES(SysBusI82596State, state.conf),
 };
 
-static void lasi_82596_class_init(ObjectClass *klass, void *data)
+static void lasi_82596_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/net/mcf_fec.c b/hw/net/mcf_fec.c
index d5572a81d3..ae128fa311 100644
--- a/hw/net/mcf_fec.c
+++ b/hw/net/mcf_fec.c
@@ -664,7 +664,7 @@ static const Property mcf_fec_properties[] = {
     DEFINE_NIC_PROPERTIES(mcf_fec_state, conf),
 };
 
-static void mcf_fec_class_init(ObjectClass *oc, void *data)
+static void mcf_fec_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
diff --git a/hw/net/mipsnet.c b/hw/net/mipsnet.c
index 8852b6f3a1..583aa1c7de 100644
--- a/hw/net/mipsnet.c
+++ b/hw/net/mipsnet.c
@@ -270,7 +270,7 @@ static const Property mipsnet_properties[] = {
     DEFINE_NIC_PROPERTIES(MIPSnetState, conf),
 };
 
-static void mipsnet_class_init(ObjectClass *klass, void *data)
+static void mipsnet_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/net/msf2-emac.c b/hw/net/msf2-emac.c
index 80f75f19dd..59045973ab 100644
--- a/hw/net/msf2-emac.c
+++ b/hw/net/msf2-emac.c
@@ -565,7 +565,7 @@ static const VMStateDescription vmstate_msf2_emac = {
     }
 };
 
-static void msf2_emac_class_init(ObjectClass *klass, void *data)
+static void msf2_emac_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/net/mv88w8618_eth.c b/hw/net/mv88w8618_eth.c
index 5a9d14bef6..6f08846c81 100644
--- a/hw/net/mv88w8618_eth.c
+++ b/hw/net/mv88w8618_eth.c
@@ -377,7 +377,7 @@ static const Property mv88w8618_eth_properties[] = {
                      TYPE_MEMORY_REGION, MemoryRegion *),
 };
 
-static void mv88w8618_eth_class_init(ObjectClass *klass, void *data)
+static void mv88w8618_eth_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/net/ne2000-isa.c b/hw/net/ne2000-isa.c
index 20973651f3..673c785abc 100644
--- a/hw/net/ne2000-isa.c
+++ b/hw/net/ne2000-isa.c
@@ -85,7 +85,7 @@ static const Property ne2000_isa_properties[] = {
     DEFINE_NIC_PROPERTIES(ISANE2000State, ne2000.c),
 };
 
-static void isa_ne2000_class_initfn(ObjectClass *klass, void *data)
+static void isa_ne2000_class_initfn(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/net/ne2000-pci.c b/hw/net/ne2000-pci.c
index 6840d0e720..2153973af4 100644
--- a/hw/net/ne2000-pci.c
+++ b/hw/net/ne2000-pci.c
@@ -100,7 +100,7 @@ static const Property ne2000_properties[] = {
     DEFINE_NIC_PROPERTIES(PCINE2000State, ne2000.c),
 };
 
-static void ne2000_class_init(ObjectClass *klass, void *data)
+static void ne2000_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
diff --git a/hw/net/npcm7xx_emc.c b/hw/net/npcm7xx_emc.c
index e06f652629..9ba35e2c81 100644
--- a/hw/net/npcm7xx_emc.c
+++ b/hw/net/npcm7xx_emc.c
@@ -849,7 +849,7 @@ static const Property npcm7xx_emc_properties[] = {
     DEFINE_NIC_PROPERTIES(NPCM7xxEMCState, conf),
 };
 
-static void npcm7xx_emc_class_init(ObjectClass *klass, void *data)
+static void npcm7xx_emc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/net/npcm_gmac.c b/hw/net/npcm_gmac.c
index e1fb383772..a434112580 100644
--- a/hw/net/npcm_gmac.c
+++ b/hw/net/npcm_gmac.c
@@ -916,7 +916,7 @@ static const Property npcm_gmac_properties[] = {
     DEFINE_NIC_PROPERTIES(NPCMGMACState, conf),
 };
 
-static void npcm_gmac_class_init(ObjectClass *klass, void *data)
+static void npcm_gmac_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/net/npcm_pcs.c b/hw/net/npcm_pcs.c
index ce5034e234..6aec105271 100644
--- a/hw/net/npcm_pcs.c
+++ b/hw/net/npcm_pcs.c
@@ -387,7 +387,7 @@ static const VMStateDescription vmstate_npcm_pcs = {
     },
 };
 
-static void npcm_pcs_class_init(ObjectClass *klass, void *data)
+static void npcm_pcs_class_init(ObjectClass *klass, const void *data)
 {
     ResettableClass *rc = RESETTABLE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
diff --git a/hw/net/opencores_eth.c b/hw/net/opencores_eth.c
index 54daab7b04..7e955c0132 100644
--- a/hw/net/opencores_eth.c
+++ b/hw/net/opencores_eth.c
@@ -747,7 +747,7 @@ static const Property open_eth_properties[] = {
     DEFINE_NIC_PROPERTIES(OpenEthState, conf),
 };
 
-static void open_eth_class_init(ObjectClass *klass, void *data)
+static void open_eth_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/net/pcnet-pci.c b/hw/net/pcnet-pci.c
index b314ea7d6d..429c217180 100644
--- a/hw/net/pcnet-pci.c
+++ b/hw/net/pcnet-pci.c
@@ -256,7 +256,7 @@ static const Property pcnet_properties[] = {
     DEFINE_NIC_PROPERTIES(PCIPCNetState, state.conf),
 };
 
-static void pcnet_class_init(ObjectClass *klass, void *data)
+static void pcnet_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
diff --git a/hw/net/rocker/rocker.c b/hw/net/rocker/rocker.c
index aa5d87fbc5..3d307f4ab1 100644
--- a/hw/net/rocker/rocker.c
+++ b/hw/net/rocker/rocker.c
@@ -1475,7 +1475,7 @@ static const VMStateDescription rocker_vmsd = {
     .unmigratable = 1,
 };
 
-static void rocker_class_init(ObjectClass *klass, void *data)
+static void rocker_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
diff --git a/hw/net/rtl8139.c b/hw/net/rtl8139.c
index 135ab57160..ad812954cf 100644
--- a/hw/net/rtl8139.c
+++ b/hw/net/rtl8139.c
@@ -3414,7 +3414,7 @@ static const Property rtl8139_properties[] = {
     DEFINE_NIC_PROPERTIES(RTL8139State, conf),
 };
 
-static void rtl8139_class_init(ObjectClass *klass, void *data)
+static void rtl8139_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
diff --git a/hw/net/smc91c111.c b/hw/net/smc91c111.c
index 9ce42b5615..5cd78e334b 100644
--- a/hw/net/smc91c111.c
+++ b/hw/net/smc91c111.c
@@ -913,7 +913,7 @@ static const Property smc91c111_properties[] = {
     DEFINE_NIC_PROPERTIES(smc91c111_state, conf),
 };
 
-static void smc91c111_class_init(ObjectClass *klass, void *data)
+static void smc91c111_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/net/spapr_llan.c b/hw/net/spapr_llan.c
index 13fc6565f0..f6f217d632 100644
--- a/hw/net/spapr_llan.c
+++ b/hw/net/spapr_llan.c
@@ -848,7 +848,7 @@ static const VMStateDescription vmstate_spapr_llan = {
     }
 };
 
-static void spapr_vlan_class_init(ObjectClass *klass, void *data)
+static void spapr_vlan_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     SpaprVioDeviceClass *k = VIO_SPAPR_DEVICE_CLASS(klass);
diff --git a/hw/net/stellaris_enet.c b/hw/net/stellaris_enet.c
index a420732d48..2fc51e1e16 100644
--- a/hw/net/stellaris_enet.c
+++ b/hw/net/stellaris_enet.c
@@ -501,7 +501,7 @@ static const Property stellaris_enet_properties[] = {
     DEFINE_NIC_PROPERTIES(stellaris_enet_state, conf),
 };
 
-static void stellaris_enet_class_init(ObjectClass *klass, void *data)
+static void stellaris_enet_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/net/sungem.c b/hw/net/sungem.c
index 12a9a9df46..123d08ee8e 100644
--- a/hw/net/sungem.c
+++ b/hw/net/sungem.c
@@ -1454,7 +1454,7 @@ static const VMStateDescription vmstate_sungem = {
     }
 };
 
-static void sungem_class_init(ObjectClass *klass, void *data)
+static void sungem_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
diff --git a/hw/net/sunhme.c b/hw/net/sunhme.c
index fa234d0da1..46c9f5020b 100644
--- a/hw/net/sunhme.c
+++ b/hw/net/sunhme.c
@@ -937,7 +937,7 @@ static const VMStateDescription vmstate_hme = {
     }
 };
 
-static void sunhme_class_init(ObjectClass *klass, void *data)
+static void sunhme_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
diff --git a/hw/net/tulip.c b/hw/net/tulip.c
index a0646bb84c..fb3366d8ee 100644
--- a/hw/net/tulip.c
+++ b/hw/net/tulip.c
@@ -1011,7 +1011,7 @@ static const Property tulip_properties[] = {
     DEFINE_NIC_PROPERTIES(TULIPState, c),
 };
 
-static void tulip_class_init(ObjectClass *klass, void *data)
+static void tulip_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index bd37651dab..2de037c273 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -4134,7 +4134,7 @@ static const Property virtio_net_properties[] = {
                       VIRTIO_NET_F_HOST_USO, true),
 };
 
-static void virtio_net_class_init(ObjectClass *klass, void *data)
+static void virtio_net_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
diff --git a/hw/net/vmxnet3.c b/hw/net/vmxnet3.c
index f370d4a2ec..4bcf1f902f 100644
--- a/hw/net/vmxnet3.c
+++ b/hw/net/vmxnet3.c
@@ -2491,7 +2491,7 @@ static void vmxnet3_realize(DeviceState *qdev, Error **errp)
     vc->parent_dc_realize(qdev, errp);
 }
 
-static void vmxnet3_class_init(ObjectClass *class, void *data)
+static void vmxnet3_class_init(ObjectClass *class, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(class);
     PCIDeviceClass *c = PCI_DEVICE_CLASS(class);
diff --git a/hw/net/xen_nic.c b/hw/net/xen_nic.c
index c48691207d..34c6a1d0b0 100644
--- a/hw/net/xen_nic.c
+++ b/hw/net/xen_nic.c
@@ -559,7 +559,7 @@ static const Property xen_netdev_properties[] = {
     DEFINE_PROP_INT32("idx", XenNetDev, dev, -1),
 };
 
-static void xen_netdev_class_init(ObjectClass *class, void *data)
+static void xen_netdev_class_init(ObjectClass *class, const void *data)
 {
     DeviceClass *dev_class = DEVICE_CLASS(class);
     XenDeviceClass *xendev_class = XEN_DEVICE_CLASS(class);
diff --git a/hw/net/xgmac.c b/hw/net/xgmac.c
index e3cc4c60eb..9c87c4e70f 100644
--- a/hw/net/xgmac.c
+++ b/hw/net/xgmac.c
@@ -418,7 +418,7 @@ static const Property xgmac_properties[] = {
     DEFINE_NIC_PROPERTIES(XgmacState, conf),
 };
 
-static void xgmac_enet_class_init(ObjectClass *klass, void *data)
+static void xgmac_enet_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/net/xilinx_axienet.c b/hw/net/xilinx_axienet.c
index 457952af19..e45bc048e0 100644
--- a/hw/net/xilinx_axienet.c
+++ b/hw/net/xilinx_axienet.c
@@ -1007,7 +1007,7 @@ static const Property xilinx_enet_properties[] = {
                      tx_control_dev, TYPE_STREAM_SINK, StreamSink *),
 };
 
-static void xilinx_enet_class_init(ObjectClass *klass, void *data)
+static void xilinx_enet_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -1017,14 +1017,15 @@ static void xilinx_enet_class_init(ObjectClass *klass, void *data)
 }
 
 static void xilinx_enet_control_stream_class_init(ObjectClass *klass,
-                                                  void *data)
+                                                  const void *data)
 {
     StreamSinkClass *ssc = STREAM_SINK_CLASS(klass);
 
     ssc->push = xilinx_axienet_control_stream_push;
 }
 
-static void xilinx_enet_data_stream_class_init(ObjectClass *klass, void *data)
+static void xilinx_enet_data_stream_class_init(ObjectClass *klass,
+                                               const void *data)
 {
     StreamSinkClass *ssc = STREAM_SINK_CLASS(klass);
 
diff --git a/hw/net/xilinx_ethlite.c b/hw/net/xilinx_ethlite.c
index 15d9b95aa8..42b19d07c7 100644
--- a/hw/net/xilinx_ethlite.c
+++ b/hw/net/xilinx_ethlite.c
@@ -385,7 +385,7 @@ static const Property xilinx_ethlite_properties[] = {
     DEFINE_NIC_PROPERTIES(XlnxXpsEthLite, conf),
 };
 
-static void xilinx_ethlite_class_init(ObjectClass *klass, void *data)
+static void xilinx_ethlite_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/nubus/mac-nubus-bridge.c b/hw/nubus/mac-nubus-bridge.c
index a0da5a8b2f..0dac8d19b3 100644
--- a/hw/nubus/mac-nubus-bridge.c
+++ b/hw/nubus/mac-nubus-bridge.c
@@ -40,7 +40,7 @@ static void mac_nubus_bridge_init(Object *obj)
     sysbus_init_mmio(sbd, &s->slot_alias);
 }
 
-static void mac_nubus_bridge_class_init(ObjectClass *klass, void *data)
+static void mac_nubus_bridge_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/nubus/nubus-bridge.c b/hw/nubus/nubus-bridge.c
index 8fe4362723..fb14402c4f 100644
--- a/hw/nubus/nubus-bridge.c
+++ b/hw/nubus/nubus-bridge.c
@@ -28,7 +28,7 @@ static const Property nubus_bridge_properties[] = {
                        bus.slot_available_mask, 0xffff),
 };
 
-static void nubus_bridge_class_init(ObjectClass *klass, void *data)
+static void nubus_bridge_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/nubus/nubus-bus.c b/hw/nubus/nubus-bus.c
index 07c279bde5..44820f13a8 100644
--- a/hw/nubus/nubus-bus.c
+++ b/hw/nubus/nubus-bus.c
@@ -162,7 +162,7 @@ static bool nubus_check_address(BusState *bus, DeviceState *dev, Error **errp)
     return true;
 }
 
-static void nubus_class_init(ObjectClass *oc, void *data)
+static void nubus_class_init(ObjectClass *oc, const void *data)
 {
     BusClass *bc = BUS_CLASS(oc);
 
diff --git a/hw/nubus/nubus-device.c b/hw/nubus/nubus-device.c
index 6755c3dc43..7797e61c7f 100644
--- a/hw/nubus/nubus-device.c
+++ b/hw/nubus/nubus-device.c
@@ -112,7 +112,7 @@ static const Property nubus_device_properties[] = {
     DEFINE_PROP_STRING("romfile", NubusDevice, romfile),
 };
 
-static void nubus_device_class_init(ObjectClass *oc, void *data)
+static void nubus_device_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
diff --git a/hw/nubus/nubus-virtio-mmio.c b/hw/nubus/nubus-virtio-mmio.c
index 7a98731c45..63aeca5b12 100644
--- a/hw/nubus/nubus-virtio-mmio.c
+++ b/hw/nubus/nubus-virtio-mmio.c
@@ -81,7 +81,7 @@ static void nubus_virtio_mmio_init(Object *obj)
                             "pic-input-irq", 1);
 }
 
-static void nubus_virtio_mmio_class_init(ObjectClass *oc, void *data)
+static void nubus_virtio_mmio_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     NubusVirtioMMIODeviceClass *nvmdc = NUBUS_VIRTIO_MMIO_CLASS(oc);
diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c
index d6b77d4fbc..e87295f5f8 100644
--- a/hw/nvme/ctrl.c
+++ b/hw/nvme/ctrl.c
@@ -9183,7 +9183,7 @@ static const VMStateDescription nvme_vmstate = {
     .unmigratable = 1,
 };
 
-static void nvme_class_init(ObjectClass *oc, void *data)
+static void nvme_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     PCIDeviceClass *pc = PCI_DEVICE_CLASS(oc);
diff --git a/hw/nvme/ns.c b/hw/nvme/ns.c
index 4ab8ba74f5..6df2e8e7c5 100644
--- a/hw/nvme/ns.c
+++ b/hw/nvme/ns.c
@@ -806,7 +806,7 @@ static const Property nvme_ns_props[] = {
     DEFINE_PROP_STRING("fdp.ruhs", NvmeNamespace, params.fdp.ruhs),
 };
 
-static void nvme_ns_class_init(ObjectClass *oc, void *data)
+static void nvme_ns_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
diff --git a/hw/nvme/subsys.c b/hw/nvme/subsys.c
index b617ac3892..38271d78c8 100644
--- a/hw/nvme/subsys.c
+++ b/hw/nvme/subsys.c
@@ -218,7 +218,7 @@ static const Property nvme_subsystem_props[] = {
     DEFINE_PROP_UINT16("fdp.nruh", NvmeSubsystem, params.fdp.nruh, 0),
 };
 
-static void nvme_subsys_class_init(ObjectClass *oc, void *data)
+static void nvme_subsys_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
diff --git a/hw/nvram/bcm2835_otp.c b/hw/nvram/bcm2835_otp.c
index c4aed28472..6816b53417 100644
--- a/hw/nvram/bcm2835_otp.c
+++ b/hw/nvram/bcm2835_otp.c
@@ -164,7 +164,7 @@ static const VMStateDescription vmstate_bcm2835_otp = {
     }
 };
 
-static void bcm2835_otp_class_init(ObjectClass *klass, void *data)
+static void bcm2835_otp_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/nvram/ds1225y.c b/hw/nvram/ds1225y.c
index 6b2aa8c7d2..dbfd0d2e53 100644
--- a/hw/nvram/ds1225y.c
+++ b/hw/nvram/ds1225y.c
@@ -147,7 +147,7 @@ static const Property nvram_sysbus_properties[] = {
     DEFINE_PROP_STRING("filename", SysBusNvRamState, nvram.filename),
 };
 
-static void nvram_sysbus_class_init(ObjectClass *klass, void *data)
+static void nvram_sysbus_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/nvram/eeprom_at24c.c b/hw/nvram/eeprom_at24c.c
index ff7a21eee7..82ea97e552 100644
--- a/hw/nvram/eeprom_at24c.c
+++ b/hw/nvram/eeprom_at24c.c
@@ -235,7 +235,7 @@ static const Property at24c_eeprom_props[] = {
 };
 
 static
-void at24c_eeprom_class_init(ObjectClass *klass, void *data)
+void at24c_eeprom_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     I2CSlaveClass *k = I2C_SLAVE_CLASS(klass);
diff --git a/hw/nvram/fw_cfg.c b/hw/nvram/fw_cfg.c
index cbfb2b5303..237b9f7d1f 100644
--- a/hw/nvram/fw_cfg.c
+++ b/hw/nvram/fw_cfg.c
@@ -1228,7 +1228,7 @@ void load_image_to_fw_cfg(FWCfgState *fw_cfg, uint16_t size_key,
     fw_cfg_add_bytes(fw_cfg, data_key, data, size);
 }
 
-static void fw_cfg_class_init(ObjectClass *klass, void *data)
+static void fw_cfg_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -1303,7 +1303,7 @@ static void fw_cfg_io_realize(DeviceState *dev, Error **errp)
     fw_cfg_common_realize(dev, errp);
 }
 
-static void fw_cfg_io_class_init(ObjectClass *klass, void *data)
+static void fw_cfg_io_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -1364,7 +1364,7 @@ static void fw_cfg_mem_realize(DeviceState *dev, Error **errp)
     fw_cfg_common_realize(dev, errp);
 }
 
-static void fw_cfg_mem_class_init(ObjectClass *klass, void *data)
+static void fw_cfg_mem_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/nvram/mac_nvram.c b/hw/nvram/mac_nvram.c
index 0d82e5a128..66526a2291 100644
--- a/hw/nvram/mac_nvram.c
+++ b/hw/nvram/mac_nvram.c
@@ -140,7 +140,7 @@ static const Property macio_nvram_properties[] = {
     DEFINE_PROP_DRIVE("drive", MacIONVRAMState, blk),
 };
 
-static void macio_nvram_class_init(ObjectClass *oc, void *data)
+static void macio_nvram_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
diff --git a/hw/nvram/npcm7xx_otp.c b/hw/nvram/npcm7xx_otp.c
index f00ebfa931..1fb752b20f 100644
--- a/hw/nvram/npcm7xx_otp.c
+++ b/hw/nvram/npcm7xx_otp.c
@@ -391,7 +391,7 @@ static const VMStateDescription vmstate_npcm7xx_otp = {
     },
 };
 
-static void npcm7xx_otp_class_init(ObjectClass *klass, void *data)
+static void npcm7xx_otp_class_init(ObjectClass *klass, const void *data)
 {
     ResettableClass *rc = RESETTABLE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -403,14 +403,14 @@ static void npcm7xx_otp_class_init(ObjectClass *klass, void *data)
     rc->phases.enter = npcm7xx_otp_enter_reset;
 }
 
-static void npcm7xx_key_storage_class_init(ObjectClass *klass, void *data)
+static void npcm7xx_key_storage_class_init(ObjectClass *klass, const void *data)
 {
     NPCM7xxOTPClass *oc = NPCM7XX_OTP_CLASS(klass);
 
     oc->mmio_ops = &npcm7xx_key_storage_ops;
 }
 
-static void npcm7xx_fuse_array_class_init(ObjectClass *klass, void *data)
+static void npcm7xx_fuse_array_class_init(ObjectClass *klass, const void *data)
 {
     NPCM7xxOTPClass *oc = NPCM7XX_OTP_CLASS(klass);
 
diff --git a/hw/nvram/nrf51_nvm.c b/hw/nvram/nrf51_nvm.c
index 2ed4078858..23cc9fe9b3 100644
--- a/hw/nvram/nrf51_nvm.c
+++ b/hw/nvram/nrf51_nvm.c
@@ -370,7 +370,7 @@ static const VMStateDescription vmstate_nvm = {
     }
 };
 
-static void nrf51_nvm_class_init(ObjectClass *klass, void *data)
+static void nrf51_nvm_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/nvram/spapr_nvram.c b/hw/nvram/spapr_nvram.c
index a45827f6aa..d0ac4e5735 100644
--- a/hw/nvram/spapr_nvram.c
+++ b/hw/nvram/spapr_nvram.c
@@ -257,7 +257,7 @@ static const Property spapr_nvram_properties[] = {
     DEFINE_PROP_DRIVE("drive", SpaprNvram, blk),
 };
 
-static void spapr_nvram_class_init(ObjectClass *klass, void *data)
+static void spapr_nvram_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     SpaprVioDeviceClass *k = VIO_SPAPR_DEVICE_CLASS(klass);
diff --git a/hw/nvram/xlnx-bbram.c b/hw/nvram/xlnx-bbram.c
index 14cc9073c7..5702bb3f31 100644
--- a/hw/nvram/xlnx-bbram.c
+++ b/hw/nvram/xlnx-bbram.c
@@ -525,7 +525,7 @@ static const Property bbram_ctrl_props[] = {
     DEFINE_PROP_UINT32("crc-zpads", XlnxBBRam, crc_zpads, 1),
 };
 
-static void bbram_ctrl_class_init(ObjectClass *klass, void *data)
+static void bbram_ctrl_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     ResettableClass *rc = RESETTABLE_CLASS(klass);
diff --git a/hw/nvram/xlnx-efuse.c b/hw/nvram/xlnx-efuse.c
index 176e88fcd1..4c23f8b931 100644
--- a/hw/nvram/xlnx-efuse.c
+++ b/hw/nvram/xlnx-efuse.c
@@ -274,7 +274,7 @@ static const Property efuse_properties[] = {
                       qdev_prop_uint32, uint32_t),
 };
 
-static void efuse_class_init(ObjectClass *klass, void *data)
+static void efuse_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/nvram/xlnx-versal-efuse-cache.c b/hw/nvram/xlnx-versal-efuse-cache.c
index 2fb599422c..d4ec96a626 100644
--- a/hw/nvram/xlnx-versal-efuse-cache.c
+++ b/hw/nvram/xlnx-versal-efuse-cache.c
@@ -89,7 +89,7 @@ static const Property efuse_cache_props[] = {
                      TYPE_XLNX_EFUSE, XlnxEFuse *),
 };
 
-static void efuse_cache_class_init(ObjectClass *klass, void *data)
+static void efuse_cache_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/nvram/xlnx-versal-efuse-ctrl.c b/hw/nvram/xlnx-versal-efuse-ctrl.c
index ff4d544ad6..9096219800 100644
--- a/hw/nvram/xlnx-versal-efuse-ctrl.c
+++ b/hw/nvram/xlnx-versal-efuse-ctrl.c
@@ -751,7 +751,7 @@ static const Property efuse_ctrl_props[] = {
                       extra_pg0_lock_spec, qdev_prop_uint16, uint16_t),
 };
 
-static void efuse_ctrl_class_init(ObjectClass *klass, void *data)
+static void efuse_ctrl_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     ResettableClass *rc = RESETTABLE_CLASS(klass);
diff --git a/hw/nvram/xlnx-zynqmp-efuse.c b/hw/nvram/xlnx-zynqmp-efuse.c
index 15024daf4f..5a218c32e8 100644
--- a/hw/nvram/xlnx-zynqmp-efuse.c
+++ b/hw/nvram/xlnx-zynqmp-efuse.c
@@ -839,7 +839,7 @@ static const Property zynqmp_efuse_props[] = {
                      TYPE_XLNX_EFUSE, XlnxEFuse *),
 };
 
-static void zynqmp_efuse_class_init(ObjectClass *klass, void *data)
+static void zynqmp_efuse_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     ResettableClass *rc = RESETTABLE_CLASS(klass);
diff --git a/hw/openrisc/openrisc_sim.c b/hw/openrisc/openrisc_sim.c
index c2284a7d41..880c8ebbb8 100644
--- a/hw/openrisc/openrisc_sim.c
+++ b/hw/openrisc/openrisc_sim.c
@@ -357,7 +357,7 @@ static void openrisc_sim_init(MachineState *machine)
     }
 }
 
-static void openrisc_sim_machine_init(ObjectClass *oc, void *data)
+static void openrisc_sim_machine_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
 
diff --git a/hw/openrisc/virt.c b/hw/openrisc/virt.c
index 0d1c1f103c..a98071c936 100644
--- a/hw/openrisc/virt.c
+++ b/hw/openrisc/virt.c
@@ -543,7 +543,7 @@ static void openrisc_virt_init(MachineState *machine)
     }
 }
 
-static void openrisc_virt_machine_init(ObjectClass *oc, void *data)
+static void openrisc_virt_machine_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
 
diff --git a/hw/pci-bridge/cxl_downstream.c b/hw/pci-bridge/cxl_downstream.c
index e337f1ac50..ab3b550a88 100644
--- a/hw/pci-bridge/cxl_downstream.c
+++ b/hw/pci-bridge/cxl_downstream.c
@@ -219,7 +219,7 @@ static const Property cxl_dsp_props[] = {
                                 width, PCIE_LINK_WIDTH_16),
 };
 
-static void cxl_dsp_class_init(ObjectClass *oc, void *data)
+static void cxl_dsp_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(oc);
diff --git a/hw/pci-bridge/cxl_root_port.c b/hw/pci-bridge/cxl_root_port.c
index c0037f2cfb..8b1e149e9b 100644
--- a/hw/pci-bridge/cxl_root_port.c
+++ b/hw/pci-bridge/cxl_root_port.c
@@ -262,7 +262,7 @@ static void cxl_rp_write_config(PCIDevice *d, uint32_t address, uint32_t val,
     cxl_rp_dvsec_write_config(d, address, val, len);
 }
 
-static void cxl_root_port_class_init(ObjectClass *oc, void *data)
+static void cxl_root_port_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc        = DEVICE_CLASS(oc);
     PCIDeviceClass *k      = PCI_DEVICE_CLASS(oc);
diff --git a/hw/pci-bridge/cxl_upstream.c b/hw/pci-bridge/cxl_upstream.c
index 28b109c49a..822a828555 100644
--- a/hw/pci-bridge/cxl_upstream.c
+++ b/hw/pci-bridge/cxl_upstream.c
@@ -371,7 +371,7 @@ static const Property cxl_upstream_props[] = {
                                 width, PCIE_LINK_WIDTH_16),
 };
 
-static void cxl_upstream_class_init(ObjectClass *oc, void *data)
+static void cxl_upstream_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(oc);
diff --git a/hw/pci-bridge/gen_pcie_root_port.c b/hw/pci-bridge/gen_pcie_root_port.c
index 3c0b41ef1a..d9078e783b 100644
--- a/hw/pci-bridge/gen_pcie_root_port.c
+++ b/hw/pci-bridge/gen_pcie_root_port.c
@@ -147,7 +147,7 @@ static const Property gen_rp_props[] = {
                                 width, PCIE_LINK_WIDTH_32),
 };
 
-static void gen_rp_dev_class_init(ObjectClass *klass, void *data)
+static void gen_rp_dev_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
diff --git a/hw/pci-bridge/i82801b11.c b/hw/pci-bridge/i82801b11.c
index 00d2fbd7cf..f2b294aee2 100644
--- a/hw/pci-bridge/i82801b11.c
+++ b/hw/pci-bridge/i82801b11.c
@@ -87,7 +87,7 @@ static const VMStateDescription i82801b11_bridge_dev_vmstate = {
     }
 };
 
-static void i82801b11_bridge_class_init(ObjectClass *klass, void *data)
+static void i82801b11_bridge_class_init(ObjectClass *klass, const void *data)
 {
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
diff --git a/hw/pci-bridge/ioh3420.c b/hw/pci-bridge/ioh3420.c
index be752a4bda..bba640f495 100644
--- a/hw/pci-bridge/ioh3420.c
+++ b/hw/pci-bridge/ioh3420.c
@@ -96,7 +96,7 @@ static const VMStateDescription vmstate_ioh3420 = {
     }
 };
 
-static void ioh3420_class_init(ObjectClass *klass, void *data)
+static void ioh3420_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
diff --git a/hw/pci-bridge/pci_bridge_dev.c b/hw/pci-bridge/pci_bridge_dev.c
index 4931ea24f6..3b57583199 100644
--- a/hw/pci-bridge/pci_bridge_dev.c
+++ b/hw/pci-bridge/pci_bridge_dev.c
@@ -240,7 +240,7 @@ void pci_bridge_dev_unplug_request_cb(HotplugHandler *hotplug_dev,
     shpc_device_unplug_request_cb(hotplug_dev, dev, errp);
 }
 
-static void pci_bridge_dev_class_init(ObjectClass *klass, void *data)
+static void pci_bridge_dev_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
@@ -280,7 +280,7 @@ static const TypeInfo pci_bridge_dev_info = {
  * different pci id, so we can match it easily in the guest for
  * automagic multiseat configuration.  See docs/multiseat.txt for more.
  */
-static void pci_bridge_dev_seat_class_init(ObjectClass *klass, void *data)
+static void pci_bridge_dev_seat_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
diff --git a/hw/pci-bridge/pci_expander_bridge.c b/hw/pci-bridge/pci_expander_bridge.c
index 3396ab4bdd..1e2e394ee8 100644
--- a/hw/pci-bridge/pci_expander_bridge.c
+++ b/hw/pci-bridge/pci_expander_bridge.c
@@ -92,7 +92,7 @@ static void prop_pxb_uid_get(Object *obj, Visitor *v, const char *name,
     visit_type_uint32(v, name, &uid, errp);
 }
 
-static void pxb_bus_class_init(ObjectClass *class, void *data)
+static void pxb_bus_class_init(ObjectClass *class, const void *data)
 {
     PCIBusClass *pbc = PCI_BUS_CLASS(class);
 
@@ -169,7 +169,7 @@ static char *pxb_host_ofw_unit_address(const SysBusDevice *dev)
     return NULL;
 }
 
-static void pxb_host_class_init(ObjectClass *class, void *data)
+static void pxb_host_class_init(ObjectClass *class, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(class);
     SysBusDeviceClass *sbc = SYS_BUS_DEVICE_CLASS(class);
@@ -224,7 +224,7 @@ void pxb_cxl_hook_up_registers(CXLState *cxl_state, PCIBus *bus, Error **errp)
     cxl_state->next_mr_idx++;
 }
 
-static void pxb_cxl_host_class_init(ObjectClass *class, void *data)
+static void pxb_cxl_host_class_init(ObjectClass *class, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(class);
     PCIHostBridgeClass *hc = PCI_HOST_BRIDGE_CLASS(class);
@@ -427,7 +427,7 @@ static const Property pxb_dev_properties[] = {
     DEFINE_PROP_BOOL("bypass_iommu", PXBDev, bypass_iommu, false),
 };
 
-static void pxb_dev_class_init(ObjectClass *klass, void *data)
+static void pxb_dev_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
@@ -465,7 +465,7 @@ static void pxb_pcie_dev_realize(PCIDevice *dev, Error **errp)
     pxb_dev_realize_common(dev, PCIE, errp);
 }
 
-static void pxb_pcie_dev_class_init(ObjectClass *klass, void *data)
+static void pxb_pcie_dev_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
@@ -510,7 +510,7 @@ static const Property pxb_cxl_dev_properties[] = {
     DEFINE_PROP_BOOL("hdm_for_passthrough", PXBCXLDev, hdm_for_passthrough, false),
 };
 
-static void pxb_cxl_dev_class_init(ObjectClass *klass, void *data)
+static void pxb_cxl_dev_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc   = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
diff --git a/hw/pci-bridge/pcie_pci_bridge.c b/hw/pci-bridge/pcie_pci_bridge.c
index 2429503cfb..833fe35cd5 100644
--- a/hw/pci-bridge/pcie_pci_bridge.c
+++ b/hw/pci-bridge/pcie_pci_bridge.c
@@ -137,7 +137,7 @@ static const VMStateDescription pcie_pci_bridge_dev_vmstate = {
         }
 };
 
-static void pcie_pci_bridge_class_init(ObjectClass *klass, void *data)
+static void pcie_pci_bridge_class_init(ObjectClass *klass, const void *data)
 {
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
diff --git a/hw/pci-bridge/pcie_root_port.c b/hw/pci-bridge/pcie_root_port.c
index dd40b366bf..512c2ab305 100644
--- a/hw/pci-bridge/pcie_root_port.c
+++ b/hw/pci-bridge/pcie_root_port.c
@@ -167,7 +167,7 @@ static void rp_instance_post_init(Object *obj)
     }
 }
 
-static void rp_class_init(ObjectClass *klass, void *data)
+static void rp_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
diff --git a/hw/pci-bridge/simba.c b/hw/pci-bridge/simba.c
index 5fe090df6c..c7565d9e94 100644
--- a/hw/pci-bridge/simba.c
+++ b/hw/pci-bridge/simba.c
@@ -66,7 +66,7 @@ static void simba_pci_bridge_realize(PCIDevice *dev, Error **errp)
     pci_bridge_update_mappings(PCI_BRIDGE(br));
 }
 
-static void simba_pci_bridge_class_init(ObjectClass *klass, void *data)
+static void simba_pci_bridge_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
diff --git a/hw/pci-bridge/xio3130_downstream.c b/hw/pci-bridge/xio3130_downstream.c
index d4e94f2657..d85c23fe4a 100644
--- a/hw/pci-bridge/xio3130_downstream.c
+++ b/hw/pci-bridge/xio3130_downstream.c
@@ -153,7 +153,7 @@ static const VMStateDescription vmstate_xio3130_downstream = {
     }
 };
 
-static void xio3130_downstream_class_init(ObjectClass *klass, void *data)
+static void xio3130_downstream_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
diff --git a/hw/pci-bridge/xio3130_upstream.c b/hw/pci-bridge/xio3130_upstream.c
index fb1547b74a..d7a2715812 100644
--- a/hw/pci-bridge/xio3130_upstream.c
+++ b/hw/pci-bridge/xio3130_upstream.c
@@ -123,7 +123,7 @@ static const VMStateDescription vmstate_xio3130_upstream = {
     }
 };
 
-static void xio3130_upstream_class_init(ObjectClass *klass, void *data)
+static void xio3130_upstream_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
diff --git a/hw/pci-host/articia.c b/hw/pci-host/articia.c
index f3fcc49f81..043fb85e84 100644
--- a/hw/pci-host/articia.c
+++ b/hw/pci-host/articia.c
@@ -195,7 +195,7 @@ static void articia_realize(DeviceState *dev, Error **errp)
     qdev_init_gpio_out(dev, s->irq, ARRAY_SIZE(s->irq));
 }
 
-static void articia_class_init(ObjectClass *klass, void *data)
+static void articia_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -228,7 +228,7 @@ static void articia_pci_host_cfg_write(PCIDevice *d, uint32_t addr,
     }
 }
 
-static void articia_pci_host_class_init(ObjectClass *klass, void *data)
+static void articia_pci_host_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
@@ -246,7 +246,7 @@ static void articia_pci_host_class_init(ObjectClass *klass, void *data)
 
 /* TYPE_ARTICIA_PCI_BRIDGE */
 
-static void articia_pci_bridge_class_init(ObjectClass *klass, void *data)
+static void articia_pci_bridge_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
diff --git a/hw/pci-host/astro.c b/hw/pci-host/astro.c
index c6f2d4f494..859e308c57 100644
--- a/hw/pci-host/astro.c
+++ b/hw/pci-host/astro.c
@@ -482,7 +482,7 @@ static const VMStateDescription vmstate_elroy = {
     }
 };
 
-static void elroy_pcihost_class_init(ObjectClass *klass, void *data)
+static void elroy_pcihost_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -909,7 +909,7 @@ static void astro_realize(DeviceState *obj, Error **errp)
     }
 }
 
-static void astro_class_init(ObjectClass *klass, void *data)
+static void astro_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -932,7 +932,7 @@ static const TypeInfo astro_chip_info = {
 };
 
 static void astro_iommu_memory_region_class_init(ObjectClass *klass,
-                                                   void *data)
+                                                 const void *data)
 {
     IOMMUMemoryRegionClass *imrc = IOMMU_MEMORY_REGION_CLASS(klass);
 
diff --git a/hw/pci-host/bonito.c b/hw/pci-host/bonito.c
index 4966914892..4508cdd21a 100644
--- a/hw/pci-host/bonito.c
+++ b/hw/pci-host/bonito.c
@@ -757,7 +757,7 @@ PCIBus *bonito_init(qemu_irq *pic)
     return phb->bus;
 }
 
-static void bonito_pci_class_init(ObjectClass *klass, void *data)
+static void bonito_pci_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
@@ -789,7 +789,7 @@ static const TypeInfo bonito_pci_info = {
     },
 };
 
-static void bonito_host_class_init(ObjectClass *klass, void *data)
+static void bonito_host_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/pci-host/designware.c b/hw/pci-host/designware.c
index 9c3a5f8d91..d03c998e3a 100644
--- a/hw/pci-host/designware.c
+++ b/hw/pci-host/designware.c
@@ -56,7 +56,8 @@
 #define DESIGNWARE_PCIE_ATU_DEVFN(x)               (((x) >> 16) & 0xff)
 #define DESIGNWARE_PCIE_ATU_UPPER_TARGET           0x91C
 
-static void designware_pcie_root_bus_class_init(ObjectClass *klass, void *data)
+static void designware_pcie_root_bus_class_init(ObjectClass *klass,
+                                                const void *data)
 {
     BusClass *k = BUS_CLASS(klass);
 
@@ -587,7 +588,8 @@ static const VMStateDescription vmstate_designware_pcie_root = {
     }
 };
 
-static void designware_pcie_root_class_init(ObjectClass *klass, void *data)
+static void designware_pcie_root_class_init(ObjectClass *klass,
+                                            const void *data)
 {
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -727,7 +729,8 @@ static const VMStateDescription vmstate_designware_pcie_host = {
     }
 };
 
-static void designware_pcie_host_class_init(ObjectClass *klass, void *data)
+static void designware_pcie_host_class_init(ObjectClass *klass,
+                                            const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIHostBridgeClass *hc = PCI_HOST_BRIDGE_CLASS(klass);
diff --git a/hw/pci-host/dino.c b/hw/pci-host/dino.c
index 58fdbf7bc9..11b353be2e 100644
--- a/hw/pci-host/dino.c
+++ b/hw/pci-host/dino.c
@@ -497,7 +497,7 @@ static const Property dino_pcihost_properties[] = {
                      MemoryRegion *),
 };
 
-static void dino_pcihost_class_init(ObjectClass *klass, void *data)
+static void dino_pcihost_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/pci-host/fsl_imx8m_phy.c b/hw/pci-host/fsl_imx8m_phy.c
index aa304b102b..04da3f99a0 100644
--- a/hw/pci-host/fsl_imx8m_phy.c
+++ b/hw/pci-host/fsl_imx8m_phy.c
@@ -76,7 +76,7 @@ static const VMStateDescription fsl_imx8m_pcie_phy_vmstate = {
     }
 };
 
-static void fsl_imx8m_pcie_phy_class_init(ObjectClass *klass, void *data)
+static void fsl_imx8m_pcie_phy_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     ResettableClass *rc = RESETTABLE_CLASS(klass);
diff --git a/hw/pci-host/gpex.c b/hw/pci-host/gpex.c
index 9fcedd7fc5..7dcac4ee3c 100644
--- a/hw/pci-host/gpex.c
+++ b/hw/pci-host/gpex.c
@@ -192,7 +192,7 @@ static const Property gpex_host_properties[] = {
     DEFINE_PROP_UINT8("num-irqs", GPEXHost, num_irqs, PCI_NUM_PINS),
 };
 
-static void gpex_host_class_init(ObjectClass *klass, void *data)
+static void gpex_host_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIHostBridgeClass *hc = PCI_HOST_BRIDGE_CLASS(klass);
@@ -237,7 +237,7 @@ static const VMStateDescription vmstate_gpex_root = {
     }
 };
 
-static void gpex_root_class_init(ObjectClass *klass, void *data)
+static void gpex_root_class_init(ObjectClass *klass, const void *data)
 {
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
diff --git a/hw/pci-host/grackle.c b/hw/pci-host/grackle.c
index 84e5ee8c6e..b48d44623d 100644
--- a/hw/pci-host/grackle.c
+++ b/hw/pci-host/grackle.c
@@ -94,7 +94,7 @@ static void grackle_pci_realize(PCIDevice *d, Error **errp)
     d->config[PCI_CLASS_PROG] = 0x01;
 }
 
-static void grackle_pci_class_init(ObjectClass *klass, void *data)
+static void grackle_pci_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
@@ -133,7 +133,7 @@ static const Property grackle_properties[] = {
     DEFINE_PROP_UINT32("ofw-addr", GrackleState, ofw_addr, -1),
 };
 
-static void grackle_class_init(ObjectClass *klass, void *data)
+static void grackle_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     SysBusDeviceClass *sbc = SYS_BUS_DEVICE_CLASS(klass);
diff --git a/hw/pci-host/gt64120.c b/hw/pci-host/gt64120.c
index d5c13a89b6..bd74b6e871 100644
--- a/hw/pci-host/gt64120.c
+++ b/hw/pci-host/gt64120.c
@@ -1244,7 +1244,7 @@ static void gt64120_pci_reset_hold(Object *obj, ResetType type)
     pci_set_byte(d->config + 0x3d, 0x01);
 }
 
-static void gt64120_pci_class_init(ObjectClass *klass, void *data)
+static void gt64120_pci_class_init(ObjectClass *klass, const void *data)
 {
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -1279,7 +1279,7 @@ static const Property gt64120_properties[] = {
                      cpu_little_endian, false),
 };
 
-static void gt64120_class_init(ObjectClass *klass, void *data)
+static void gt64120_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/pci-host/i440fx.c b/hw/pci-host/i440fx.c
index 1e69691c6d..fcc9f3818a 100644
--- a/hw/pci-host/i440fx.c
+++ b/hw/pci-host/i440fx.c
@@ -315,7 +315,7 @@ static void i440fx_pcihost_realize(DeviceState *dev, Error **errp)
     i440fx_update_memory_mappings(f);
 }
 
-static void i440fx_class_init(ObjectClass *klass, void *data)
+static void i440fx_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
@@ -364,7 +364,7 @@ static const Property i440fx_props[] = {
     DEFINE_PROP_STRING(I440FX_HOST_PROP_PCI_TYPE, I440FXState, pci_type),
 };
 
-static void i440fx_pcihost_class_init(ObjectClass *klass, void *data)
+static void i440fx_pcihost_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIHostBridgeClass *hc = PCI_HOST_BRIDGE_CLASS(klass);
diff --git a/hw/pci-host/mv64361.c b/hw/pci-host/mv64361.c
index a297318c6e..f51f385b22 100644
--- a/hw/pci-host/mv64361.c
+++ b/hw/pci-host/mv64361.c
@@ -26,7 +26,7 @@
 
 #define TYPE_MV64361_PCI_BRIDGE "mv64361-pcibridge"
 
-static void mv64361_pcibridge_class_init(ObjectClass *klass, void *data)
+static void mv64361_pcibridge_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
@@ -102,7 +102,7 @@ static const Property mv64361_pcihost_props[] = {
     DEFINE_PROP_UINT8("index", MV64361PCIState, index, 0),
 };
 
-static void mv64361_pcihost_class_init(ObjectClass *klass, void *data)
+static void mv64361_pcihost_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -923,7 +923,7 @@ static void mv64361_reset(DeviceState *dev)
     set_mem_windows(s, 0xfbfff);
 }
 
-static void mv64361_class_init(ObjectClass *klass, void *data)
+static void mv64361_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/pci-host/pnv_phb.c b/hw/pci-host/pnv_phb.c
index 6c1e76fbbb..4b0ced79b0 100644
--- a/hw/pci-host/pnv_phb.c
+++ b/hw/pci-host/pnv_phb.c
@@ -194,7 +194,7 @@ static const Property pnv_phb_properties[] = {
                      PnvPhb4PecState *),
 };
 
-static void pnv_phb_class_init(ObjectClass *klass, void *data)
+static void pnv_phb_class_init(ObjectClass *klass, const void *data)
 {
     PCIHostBridgeClass *hc = PCI_HOST_BRIDGE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -304,7 +304,7 @@ static const Property pnv_phb_root_port_properties[] = {
     DEFINE_PROP_UINT32("version", PnvPHBRootPort, version, 0),
 };
 
-static void pnv_phb_root_port_class_init(ObjectClass *klass, void *data)
+static void pnv_phb_root_port_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     ResettableClass *rc = RESETTABLE_CLASS(klass);
diff --git a/hw/pci-host/pnv_phb3.c b/hw/pci-host/pnv_phb3.c
index 82884e1e92..a4335f44f2 100644
--- a/hw/pci-host/pnv_phb3.c
+++ b/hw/pci-host/pnv_phb3.c
@@ -888,7 +888,7 @@ DECLARE_INSTANCE_CHECKER(IOMMUMemoryRegion, PNV_PHB3_IOMMU_MEMORY_REGION,
                          TYPE_PNV_PHB3_IOMMU_MEMORY_REGION)
 
 static void pnv_phb3_iommu_memory_region_class_init(ObjectClass *klass,
-                                                    void *data)
+                                                    const void *data)
 {
     IOMMUMemoryRegionClass *imrc = IOMMU_MEMORY_REGION_CLASS(klass);
 
@@ -1097,7 +1097,7 @@ static const Property pnv_phb3_properties[] = {
     DEFINE_PROP_LINK("phb-base", PnvPHB3, phb_base, TYPE_PNV_PHB, PnvPHB *),
 };
 
-static void pnv_phb3_class_init(ObjectClass *klass, void *data)
+static void pnv_phb3_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -1149,7 +1149,7 @@ static void pnv_phb3_root_bus_set_prop(Object *obj, Visitor *v,
     }
 }
 
-static void pnv_phb3_root_bus_class_init(ObjectClass *klass, void *data)
+static void pnv_phb3_root_bus_class_init(ObjectClass *klass, const void *data)
 {
     BusClass *k = BUS_CLASS(klass);
 
diff --git a/hw/pci-host/pnv_phb3_msi.c b/hw/pci-host/pnv_phb3_msi.c
index 81986644b1..3a83311faf 100644
--- a/hw/pci-host/pnv_phb3_msi.c
+++ b/hw/pci-host/pnv_phb3_msi.c
@@ -284,7 +284,7 @@ static void phb3_msi_instance_init(Object *obj)
     ics->offset = 0;
 }
 
-static void phb3_msi_class_init(ObjectClass *klass, void *data)
+static void phb3_msi_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     ICSStateClass *isc = ICS_CLASS(klass);
diff --git a/hw/pci-host/pnv_phb3_pbcq.c b/hw/pci-host/pnv_phb3_pbcq.c
index 82f70efa43..4e24b1449d 100644
--- a/hw/pci-host/pnv_phb3_pbcq.c
+++ b/hw/pci-host/pnv_phb3_pbcq.c
@@ -337,7 +337,7 @@ static void phb3_pbcq_instance_init(Object *obj)
                              OBJ_PROP_LINK_STRONG);
 }
 
-static void pnv_pbcq_class_init(ObjectClass *klass, void *data)
+static void pnv_pbcq_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PnvXScomInterfaceClass *xdc = PNV_XSCOM_INTERFACE_CLASS(klass);
diff --git a/hw/pci-host/pnv_phb4.c b/hw/pci-host/pnv_phb4.c
index 178c73f519..feb812dc1a 100644
--- a/hw/pci-host/pnv_phb4.c
+++ b/hw/pci-host/pnv_phb4.c
@@ -1362,7 +1362,7 @@ DECLARE_INSTANCE_CHECKER(IOMMUMemoryRegion, PNV_PHB4_IOMMU_MEMORY_REGION,
                          TYPE_PNV_PHB4_IOMMU_MEMORY_REGION)
 
 static void pnv_phb4_iommu_memory_region_class_init(ObjectClass *klass,
-                                                    void *data)
+                                                    const void *data)
 {
     IOMMUMemoryRegionClass *imrc = IOMMU_MEMORY_REGION_CLASS(klass);
 
@@ -1696,7 +1696,7 @@ static const Property pnv_phb4_properties[] = {
     DEFINE_PROP_LINK("phb-base", PnvPHB4, phb_base, TYPE_PNV_PHB, PnvPHB *),
 };
 
-static void pnv_phb4_class_init(ObjectClass *klass, void *data)
+static void pnv_phb4_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     XiveNotifierClass *xfc = XIVE_NOTIFIER_CLASS(klass);
@@ -1761,7 +1761,7 @@ static void pnv_phb4_root_bus_set_prop(Object *obj, Visitor *v,
     }
 }
 
-static void pnv_phb4_root_bus_class_init(ObjectClass *klass, void *data)
+static void pnv_phb4_root_bus_class_init(ObjectClass *klass, const void *data)
 {
     BusClass *k = BUS_CLASS(klass);
 
diff --git a/hw/pci-host/pnv_phb4_pec.c b/hw/pci-host/pnv_phb4_pec.c
index cb8a7e3afa..cc46641cdf 100644
--- a/hw/pci-host/pnv_phb4_pec.c
+++ b/hw/pci-host/pnv_phb4_pec.c
@@ -354,7 +354,7 @@ static uint32_t pnv_pec_xscom_nest_base(PnvPhb4PecState *pec)
  */
 static const uint32_t pnv_pec_num_phbs[] = { 1, 2, 3 };
 
-static void pnv_pec_class_init(ObjectClass *klass, void *data)
+static void pnv_pec_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PnvXScomInterfaceClass *xdc = PNV_XSCOM_INTERFACE_CLASS(klass);
@@ -419,7 +419,7 @@ static uint32_t pnv_phb5_pec_xscom_nest_base(PnvPhb4PecState *pec)
  */
 static const uint32_t pnv_phb5_pec_num_stacks[] = { 3, 3 };
 
-static void pnv_phb5_pec_class_init(ObjectClass *klass, void *data)
+static void pnv_phb5_pec_class_init(ObjectClass *klass, const void *data)
 {
     PnvPhb4PecClass *pecc = PNV_PHB4_PEC_CLASS(klass);
     static const char compat[] = "ibm,power10-pbcq";
diff --git a/hw/pci-host/ppc440_pcix.c b/hw/pci-host/ppc440_pcix.c
index 07924bce28..744b85e49c 100644
--- a/hw/pci-host/ppc440_pcix.c
+++ b/hw/pci-host/ppc440_pcix.c
@@ -519,7 +519,7 @@ static void ppc440_pcix_realize(DeviceState *dev, Error **errp)
     sysbus_init_mmio(sbd, &s->iomem);
 }
 
-static void ppc440_pcix_class_init(ObjectClass *klass, void *data)
+static void ppc440_pcix_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/pci-host/ppc4xx_pci.c b/hw/pci-host/ppc4xx_pci.c
index 292cb308ba..dcc4b78660 100644
--- a/hw/pci-host/ppc4xx_pci.c
+++ b/hw/pci-host/ppc4xx_pci.c
@@ -349,7 +349,7 @@ static void ppc4xx_pcihost_realize(DeviceState *dev, Error **errp)
     qemu_register_reset(ppc4xx_pci_reset, s);
 }
 
-static void ppc4xx_host_bridge_class_init(ObjectClass *klass, void *data)
+static void ppc4xx_host_bridge_class_init(ObjectClass *klass, const void *data)
 {
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -376,7 +376,7 @@ static const TypeInfo ppc4xx_host_bridge_info = {
     },
 };
 
-static void ppc4xx_pcihost_class_init(ObjectClass *klass, void *data)
+static void ppc4xx_pcihost_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/pci-host/ppce500.c b/hw/pci-host/ppce500.c
index 9b905d1971..2f6354c931 100644
--- a/hw/pci-host/ppce500.c
+++ b/hw/pci-host/ppce500.c
@@ -490,7 +490,7 @@ static void e500_pcihost_realize(DeviceState *dev, Error **errp)
     pci_bus_set_route_irq_fn(b, e500_route_intx_pin_to_irq);
 }
 
-static void e500_host_bridge_class_init(ObjectClass *klass, void *data)
+static void e500_host_bridge_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
@@ -512,7 +512,7 @@ static const Property pcihost_properties[] = {
     DEFINE_PROP_UINT32("first_pin_irq", PPCE500PCIState, first_pin_irq, 0x1),
 };
 
-static void e500_pcihost_class_init(ObjectClass *klass, void *data)
+static void e500_pcihost_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c
index 06be3d77cb..c2a71108f2 100644
--- a/hw/pci-host/q35.c
+++ b/hw/pci-host/q35.c
@@ -184,7 +184,7 @@ static const Property q35_host_props[] = {
     DEFINE_PROP_BOOL("x-pci-hole64-fix", Q35PCIHost, pci_hole64_fix, true),
 };
 
-static void q35_host_class_init(ObjectClass *klass, void *data)
+static void q35_host_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIHostBridgeClass *hc = PCI_HOST_BRIDGE_CLASS(klass);
@@ -667,7 +667,7 @@ static const Property mch_props[] = {
     DEFINE_PROP_BOOL("smbase-smram", MCHPCIState, has_smram_at_smbase, true),
 };
 
-static void mch_class_init(ObjectClass *klass, void *data)
+static void mch_class_init(ObjectClass *klass, const void *data)
 {
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
diff --git a/hw/pci-host/raven.c b/hw/pci-host/raven.c
index e3d8d206b7..3f158838a0 100644
--- a/hw/pci-host/raven.c
+++ b/hw/pci-host/raven.c
@@ -392,7 +392,7 @@ static const VMStateDescription vmstate_raven = {
     },
 };
 
-static void raven_class_init(ObjectClass *klass, void *data)
+static void raven_class_init(ObjectClass *klass, const void *data)
 {
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -431,7 +431,7 @@ static const Property raven_pcihost_properties[] = {
                      false),
 };
 
-static void raven_pcihost_class_init(ObjectClass *klass, void *data)
+static void raven_pcihost_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/pci-host/remote.c b/hw/pci-host/remote.c
index be077d075e..e6d2af4502 100644
--- a/hw/pci-host/remote.c
+++ b/hw/pci-host/remote.c
@@ -46,7 +46,7 @@ static void remote_pcihost_realize(DeviceState *dev, Error **errp)
                                 0, TYPE_PCIE_BUS);
 }
 
-static void remote_pcihost_class_init(ObjectClass *klass, void *data)
+static void remote_pcihost_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIHostBridgeClass *hc = PCI_HOST_BRIDGE_CLASS(klass);
diff --git a/hw/pci-host/sabre.c b/hw/pci-host/sabre.c
index be6641de15..f7086086f9 100644
--- a/hw/pci-host/sabre.c
+++ b/hw/pci-host/sabre.c
@@ -456,7 +456,7 @@ static void sabre_pci_realize(PCIDevice *d, Error **errp)
                  PCI_STATUS_DEVSEL_MEDIUM);
 }
 
-static void sabre_pci_class_init(ObjectClass *klass, void *data)
+static void sabre_pci_class_init(ObjectClass *klass, const void *data)
 {
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -497,7 +497,7 @@ static const Property sabre_properties[] = {
     DEFINE_PROP_UINT64("mem-base", SabreState, mem_base, 0),
 };
 
-static void sabre_class_init(ObjectClass *klass, void *data)
+static void sabre_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     SysBusDeviceClass *sbc = SYS_BUS_DEVICE_CLASS(klass);
diff --git a/hw/pci-host/sh_pci.c b/hw/pci-host/sh_pci.c
index 4edebced5e..52bff66d6a 100644
--- a/hw/pci-host/sh_pci.c
+++ b/hw/pci-host/sh_pci.c
@@ -153,7 +153,7 @@ static void sh_pcic_pci_realize(PCIDevice *d, Error **errp)
                  PCI_STATUS_FAST_BACK | PCI_STATUS_DEVSEL_MEDIUM);
 }
 
-static void sh_pcic_pci_class_init(ObjectClass *klass, void *data)
+static void sh_pcic_pci_class_init(ObjectClass *klass, const void *data)
 {
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -168,7 +168,7 @@ static void sh_pcic_pci_class_init(ObjectClass *klass, void *data)
     dc->user_creatable = false;
 }
 
-static void sh_pcic_host_class_init(ObjectClass *klass, void *data)
+static void sh_pcic_host_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/pci-host/uninorth.c b/hw/pci-host/uninorth.c
index 37e2461bbb..7cb37e01d8 100644
--- a/hw/pci-host/uninorth.c
+++ b/hw/pci-host/uninorth.c
@@ -311,7 +311,7 @@ static void unin_internal_pci_host_realize(PCIDevice *d, Error **errp)
     d->config[PCI_CAPABILITY_LIST] = 0x00;
 }
 
-static void unin_main_pci_host_class_init(ObjectClass *klass, void *data)
+static void unin_main_pci_host_class_init(ObjectClass *klass, const void *data)
 {
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -339,7 +339,7 @@ static const TypeInfo unin_main_pci_host_info = {
     },
 };
 
-static void u3_agp_pci_host_class_init(ObjectClass *klass, void *data)
+static void u3_agp_pci_host_class_init(ObjectClass *klass, const void *data)
 {
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -367,7 +367,7 @@ static const TypeInfo u3_agp_pci_host_info = {
     },
 };
 
-static void unin_agp_pci_host_class_init(ObjectClass *klass, void *data)
+static void unin_agp_pci_host_class_init(ObjectClass *klass, const void *data)
 {
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -395,7 +395,8 @@ static const TypeInfo unin_agp_pci_host_info = {
     },
 };
 
-static void unin_internal_pci_host_class_init(ObjectClass *klass, void *data)
+static void unin_internal_pci_host_class_init(ObjectClass *klass,
+                                              const void *data)
 {
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -427,7 +428,7 @@ static const Property pci_unin_main_pci_host_props[] = {
     DEFINE_PROP_UINT32("ofw-addr", UNINHostState, ofw_addr, -1),
 };
 
-static void pci_unin_main_class_init(ObjectClass *klass, void *data)
+static void pci_unin_main_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     SysBusDeviceClass *sbc = SYS_BUS_DEVICE_CLASS(klass);
@@ -447,7 +448,7 @@ static const TypeInfo pci_unin_main_info = {
     .class_init    = pci_unin_main_class_init,
 };
 
-static void pci_u3_agp_class_init(ObjectClass *klass, void *data)
+static void pci_u3_agp_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -463,7 +464,7 @@ static const TypeInfo pci_u3_agp_info = {
     .class_init    = pci_u3_agp_class_init,
 };
 
-static void pci_unin_agp_class_init(ObjectClass *klass, void *data)
+static void pci_unin_agp_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -479,7 +480,7 @@ static const TypeInfo pci_unin_agp_info = {
     .class_init    = pci_unin_agp_class_init,
 };
 
-static void pci_unin_internal_class_init(ObjectClass *klass, void *data)
+static void pci_unin_internal_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -535,7 +536,7 @@ static void unin_init(Object *obj)
     sysbus_init_mmio(sbd, &s->mem);
 }
 
-static void unin_class_init(ObjectClass *klass, void *data)
+static void unin_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/pci-host/versatile.c b/hw/pci-host/versatile.c
index 33a8ceb3b5..b333158e10 100644
--- a/hw/pci-host/versatile.c
+++ b/hw/pci-host/versatile.c
@@ -471,7 +471,7 @@ static void versatile_pci_host_realize(PCIDevice *d, Error **errp)
     pci_set_byte(d->config + PCI_LATENCY_TIMER, 0x10);
 }
 
-static void versatile_pci_host_class_init(ObjectClass *klass, void *data)
+static void versatile_pci_host_class_init(ObjectClass *klass, const void *data)
 {
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -503,7 +503,7 @@ static const Property pci_vpb_properties[] = {
                       PCI_VPB_IRQMAP_ASSUME_OK),
 };
 
-static void pci_vpb_class_init(ObjectClass *klass, void *data)
+static void pci_vpb_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/pci-host/xen_igd_pt.c b/hw/pci-host/xen_igd_pt.c
index d094b675d6..5dd17ef236 100644
--- a/hw/pci-host/xen_igd_pt.c
+++ b/hw/pci-host/xen_igd_pt.c
@@ -95,7 +95,8 @@ static void igd_pt_i440fx_realize(PCIDevice *pci_dev, Error **errp)
     }
 }
 
-static void igd_passthrough_i440fx_class_init(ObjectClass *klass, void *data)
+static void igd_passthrough_i440fx_class_init(ObjectClass *klass,
+                                              const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
diff --git a/hw/pci-host/xilinx-pcie.c b/hw/pci-host/xilinx-pcie.c
index 18688485f4..70e9b2b981 100644
--- a/hw/pci-host/xilinx-pcie.c
+++ b/hw/pci-host/xilinx-pcie.c
@@ -165,7 +165,7 @@ static const Property xilinx_pcie_host_props[] = {
     DEFINE_PROP_BOOL("link_up", XilinxPCIEHost, link_up, true),
 };
 
-static void xilinx_pcie_host_class_init(ObjectClass *klass, void *data)
+static void xilinx_pcie_host_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIHostBridgeClass *hc = PCI_HOST_BRIDGE_CLASS(klass);
@@ -286,7 +286,7 @@ static void xilinx_pcie_root_realize(PCIDevice *pci_dev, Error **errp)
     }
 }
 
-static void xilinx_pcie_root_class_init(ObjectClass *klass, void *data)
+static void xilinx_pcie_root_class_init(ObjectClass *klass, const void *data)
 {
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
diff --git a/hw/pci/pci.c b/hw/pci/pci.c
index 475b97c649..c60991def8 100644
--- a/hw/pci/pci.c
+++ b/hw/pci/pci.c
@@ -261,7 +261,7 @@ static GByteArray *pci_bus_fw_cfg_gen_data(Object *obj, Error **errp)
     return byte_array;
 }
 
-static void pci_bus_class_init(ObjectClass *klass, void *data)
+static void pci_bus_class_init(ObjectClass *klass, const void *data)
 {
     BusClass *k = BUS_CLASS(klass);
     PCIBusClass *pbc = PCI_BUS_CLASS(klass);
@@ -309,7 +309,7 @@ static const TypeInfo conventional_pci_interface_info = {
     .parent        = TYPE_INTERFACE,
 };
 
-static void pcie_bus_class_init(ObjectClass *klass, void *data)
+static void pcie_bus_class_init(ObjectClass *klass, const void *data)
 {
     BusClass *k = BUS_CLASS(klass);
 
@@ -2795,7 +2795,7 @@ MemoryRegion *pci_address_space_io(PCIDevice *dev)
     return pci_get_bus(dev)->address_space_io;
 }
 
-static void pci_device_class_init(ObjectClass *klass, void *data)
+static void pci_device_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *k = DEVICE_CLASS(klass);
 
diff --git a/hw/pci/pci_bridge.c b/hw/pci/pci_bridge.c
index aee4dd7d1f..0fe66e8b12 100644
--- a/hw/pci/pci_bridge.c
+++ b/hw/pci/pci_bridge.c
@@ -482,7 +482,7 @@ static const Property pci_bridge_properties[] = {
                      pcie_writeable_slt_bug, false),
 };
 
-static void pci_bridge_class_init(ObjectClass *klass, void *data)
+static void pci_bridge_class_init(ObjectClass *klass, const void *data)
 {
     AcpiDevAmlIfClass *adevc = ACPI_DEV_AML_IF_CLASS(klass);
     DeviceClass *k = DEVICE_CLASS(klass);
diff --git a/hw/pci/pci_host.c b/hw/pci/pci_host.c
index 80f91f409f..abe83bbab8 100644
--- a/hw/pci/pci_host.c
+++ b/hw/pci/pci_host.c
@@ -246,7 +246,7 @@ static const Property pci_host_properties_common[] = {
     DEFINE_PROP_BOOL(PCI_HOST_BYPASS_IOMMU, PCIHostState, bypass_iommu, false),
 };
 
-static void pci_host_class_init(ObjectClass *klass, void *data)
+static void pci_host_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     device_class_set_props(dc, pci_host_properties_common);
diff --git a/hw/pci/pcie_port.c b/hw/pci/pcie_port.c
index c73db30e98..8629b3aafd 100644
--- a/hw/pci/pcie_port.c
+++ b/hw/pci/pcie_port.c
@@ -118,7 +118,7 @@ static const Property pcie_port_props[] = {
                        PCIE_AER_LOG_MAX_DEFAULT),
 };
 
-static void pcie_port_class_init(ObjectClass *oc, void *data)
+static void pcie_port_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
@@ -211,7 +211,7 @@ static const Property pcie_slot_props[] = {
                      hide_native_hotplug_cap, false),
 };
 
-static void pcie_slot_class_init(ObjectClass *oc, void *data)
+static void pcie_slot_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     HotplugHandlerClass *hc = HOTPLUG_HANDLER_CLASS(oc);
diff --git a/hw/ppc/amigaone.c b/hw/ppc/amigaone.c
index e9407a51b5..12279f42bc 100644
--- a/hw/ppc/amigaone.c
+++ b/hw/ppc/amigaone.c
@@ -173,7 +173,7 @@ static const Property nvram_properties[] = {
     DEFINE_PROP_DRIVE("drive", A1NVRAMState, blk),
 };
 
-static void nvram_class_init(ObjectClass *oc, void *data)
+static void nvram_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
diff --git a/hw/ppc/e500plat.c b/hw/ppc/e500plat.c
index 70a8033373..cd594eeb3e 100644
--- a/hw/ppc/e500plat.c
+++ b/hw/ppc/e500plat.c
@@ -68,7 +68,7 @@ HotplugHandler *e500plat_machine_get_hotpug_handler(MachineState *machine,
 
 #define TYPE_E500PLAT_MACHINE  MACHINE_TYPE_NAME("ppce500")
 
-static void e500plat_machine_class_init(ObjectClass *oc, void *data)
+static void e500plat_machine_class_init(ObjectClass *oc, const void *data)
 {
     PPCE500MachineClass *pmc = PPCE500_MACHINE_CLASS(oc);
     HotplugHandlerClass *hc = HOTPLUG_HANDLER_CLASS(oc);
diff --git a/hw/ppc/mac_newworld.c b/hw/ppc/mac_newworld.c
index 5a827846ed..92fe60b2a2 100644
--- a/hw/ppc/mac_newworld.c
+++ b/hw/ppc/mac_newworld.c
@@ -563,7 +563,7 @@ static int core99_kvm_type(MachineState *machine, const char *arg)
     return 2;
 }
 
-static void core99_machine_class_init(ObjectClass *oc, void *data)
+static void core99_machine_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     FWPathProviderClass *fwc = FW_PATH_PROVIDER_CLASS(oc);
diff --git a/hw/ppc/mac_oldworld.c b/hw/ppc/mac_oldworld.c
index 0d34e6bfda..5c5bf99b4d 100644
--- a/hw/ppc/mac_oldworld.c
+++ b/hw/ppc/mac_oldworld.c
@@ -402,7 +402,7 @@ static int heathrow_kvm_type(MachineState *machine, const char *arg)
     return 2;
 }
 
-static void heathrow_class_init(ObjectClass *oc, void *data)
+static void heathrow_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     FWPathProviderClass *fwc = FW_PATH_PROVIDER_CLASS(oc);
diff --git a/hw/ppc/mpc8544ds.c b/hw/ppc/mpc8544ds.c
index d74af766ee..97fb0f35ba 100644
--- a/hw/ppc/mpc8544ds.c
+++ b/hw/ppc/mpc8544ds.c
@@ -37,7 +37,7 @@ static void mpc8544ds_init(MachineState *machine)
     ppce500_init(machine);
 }
 
-static void mpc8544ds_machine_class_init(ObjectClass *oc, void *data)
+static void mpc8544ds_machine_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     PPCE500MachineClass *pmc = PPCE500_MACHINE_CLASS(oc);
diff --git a/hw/ppc/pef.c b/hw/ppc/pef.c
index 8b2d726e00..254f570787 100644
--- a/hw/ppc/pef.c
+++ b/hw/ppc/pef.c
@@ -128,7 +128,7 @@ OBJECT_DEFINE_TYPE_WITH_INTERFACES(PefGuest,
                                    { TYPE_USER_CREATABLE },
                                    { NULL })
 
-static void pef_guest_class_init(ObjectClass *oc, void *data)
+static void pef_guest_class_init(ObjectClass *oc, const void *data)
 {
     ConfidentialGuestSupportClass *klass = CONFIDENTIAL_GUEST_SUPPORT_CLASS(oc);
 
diff --git a/hw/ppc/pegasos2.c b/hw/ppc/pegasos2.c
index 7b2dc6985c..bb6f94f502 100644
--- a/hw/ppc/pegasos2.c
+++ b/hw/ppc/pegasos2.c
@@ -588,7 +588,7 @@ static bool pegasos2_setprop(MachineState *ms, const char *path,
     return true;
 }
 
-static void pegasos2_machine_class_init(ObjectClass *oc, void *data)
+static void pegasos2_machine_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     PPCVirtualHypervisorClass *vhc = PPC_VIRTUAL_HYPERVISOR_CLASS(oc);
diff --git a/hw/ppc/pnv.c b/hw/ppc/pnv.c
index 63f2232f32..4590231f88 100644
--- a/hw/ppc/pnv.c
+++ b/hw/ppc/pnv.c
@@ -1618,7 +1618,7 @@ static uint32_t pnv_chip_power8_xscom_pcba(PnvChip *chip, uint64_t addr)
     return ((addr >> 4) & ~0xfull) | ((addr >> 3) & 0xf);
 }
 
-static void pnv_chip_power8e_class_init(ObjectClass *klass, void *data)
+static void pnv_chip_power8e_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PnvChipClass *k = PNV_CHIP_CLASS(klass);
@@ -1642,7 +1642,7 @@ static void pnv_chip_power8e_class_init(ObjectClass *klass, void *data)
                                     &k->parent_realize);
 }
 
-static void pnv_chip_power8_class_init(ObjectClass *klass, void *data)
+static void pnv_chip_power8_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PnvChipClass *k = PNV_CHIP_CLASS(klass);
@@ -1666,7 +1666,7 @@ static void pnv_chip_power8_class_init(ObjectClass *klass, void *data)
                                     &k->parent_realize);
 }
 
-static void pnv_chip_power8nvl_class_init(ObjectClass *klass, void *data)
+static void pnv_chip_power8nvl_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PnvChipClass *k = PNV_CHIP_CLASS(klass);
@@ -1954,7 +1954,7 @@ static uint32_t pnv_chip_power9_xscom_pcba(PnvChip *chip, uint64_t addr)
     return addr >> 3;
 }
 
-static void pnv_chip_power9_class_init(ObjectClass *klass, void *data)
+static void pnv_chip_power9_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PnvChipClass *k = PNV_CHIP_CLASS(klass);
@@ -2302,7 +2302,7 @@ static uint32_t pnv_chip_power10_xscom_pcba(PnvChip *chip, uint64_t addr)
     return addr >> 3;
 }
 
-static void pnv_chip_power10_class_init(ObjectClass *klass, void *data)
+static void pnv_chip_power10_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PnvChipClass *k = PNV_CHIP_CLASS(klass);
@@ -2461,7 +2461,7 @@ static const Property pnv_chip_properties[] = {
     DEFINE_PROP_BOOL("lpar-per-core", PnvChip, lpar_per_core, false),
 };
 
-static void pnv_chip_class_init(ObjectClass *klass, void *data)
+static void pnv_chip_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -2724,7 +2724,7 @@ static void pnv_machine_set_hb(Object *obj, bool value, Error **errp)
     }
 }
 
-static void pnv_machine_power8_class_init(ObjectClass *oc, void *data)
+static void pnv_machine_power8_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     XICSFabricClass *xic = XICS_FABRIC_CLASS(oc);
@@ -2753,7 +2753,7 @@ static void pnv_machine_power8_class_init(ObjectClass *oc, void *data)
     machine_class_allow_dynamic_sysbus_dev(mc, TYPE_PNV_PHB);
 }
 
-static void pnv_machine_power9_class_init(ObjectClass *oc, void *data)
+static void pnv_machine_power9_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     XiveFabricClass *xfc = XIVE_FABRIC_CLASS(oc);
@@ -2792,7 +2792,7 @@ static void pnv_machine_power9_class_init(ObjectClass *oc, void *data)
                               "Use 1 LPAR per core mode");
 }
 
-static void pnv_machine_p10_common_class_init(ObjectClass *oc, void *data)
+static void pnv_machine_p10_common_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     PnvMachineClass *pmc = PNV_MACHINE_CLASS(oc);
@@ -2822,7 +2822,7 @@ static void pnv_machine_p10_common_class_init(ObjectClass *oc, void *data)
     machine_class_allow_dynamic_sysbus_dev(mc, TYPE_PNV_PHB);
 }
 
-static void pnv_machine_power10_class_init(ObjectClass *oc, void *data)
+static void pnv_machine_power10_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
 
@@ -2847,7 +2847,8 @@ static void pnv_machine_power10_class_init(ObjectClass *oc, void *data)
                               "Use 1 LPAR per core mode");
 }
 
-static void pnv_machine_p10_rainier_class_init(ObjectClass *oc, void *data)
+static void pnv_machine_p10_rainier_class_init(ObjectClass *oc,
+                                               const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     PnvMachineClass *pmc = PNV_MACHINE_CLASS(oc);
@@ -2912,7 +2913,7 @@ static void pnv_nmi(NMIState *n, int cpu_index, Error **errp)
     }
 }
 
-static void pnv_machine_class_init(ObjectClass *oc, void *data)
+static void pnv_machine_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     InterruptStatsProviderClass *ispc = INTERRUPT_STATS_PROVIDER_CLASS(oc);
diff --git a/hw/ppc/pnv_adu.c b/hw/ppc/pnv_adu.c
index d09a167466..f9620806ec 100644
--- a/hw/ppc/pnv_adu.c
+++ b/hw/ppc/pnv_adu.c
@@ -189,7 +189,7 @@ static const Property pnv_adu_properties[] = {
     DEFINE_PROP_LINK("lpc", PnvADU, lpc, TYPE_PNV_LPC, PnvLpcController *),
 };
 
-static void pnv_adu_class_init(ObjectClass *klass, void *data)
+static void pnv_adu_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/ppc/pnv_chiptod.c b/hw/ppc/pnv_chiptod.c
index c8987ae67a..4ca511a4de 100644
--- a/hw/ppc/pnv_chiptod.c
+++ b/hw/ppc/pnv_chiptod.c
@@ -456,7 +456,7 @@ static const Property pnv_chiptod_properties[] = {
     DEFINE_PROP_LINK("chip", PnvChipTOD , chip, TYPE_PNV_CHIP, PnvChip *),
 };
 
-static void pnv_chiptod_power9_class_init(ObjectClass *klass, void *data)
+static void pnv_chiptod_power9_class_init(ObjectClass *klass, const void *data)
 {
     PnvChipTODClass *pctc = PNV_CHIPTOD_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -492,7 +492,7 @@ static int pnv_chiptod_power10_dt_xscom(PnvXScomInterface *dev, void *fdt,
     return pnv_chiptod_dt_xscom(dev, fdt, xscom_offset, compat, sizeof(compat));
 }
 
-static void pnv_chiptod_power10_class_init(ObjectClass *klass, void *data)
+static void pnv_chiptod_power10_class_init(ObjectClass *klass, const void *data)
 {
     PnvChipTODClass *pctc = PNV_CHIPTOD_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -555,7 +555,7 @@ static void pnv_chiptod_unrealize(DeviceState *dev)
     qemu_unregister_reset(pnv_chiptod_reset, chiptod);
 }
 
-static void pnv_chiptod_class_init(ObjectClass *klass, void *data)
+static void pnv_chiptod_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/ppc/pnv_core.c b/hw/ppc/pnv_core.c
index a33977da18..08c20224b9 100644
--- a/hw/ppc/pnv_core.c
+++ b/hw/ppc/pnv_core.c
@@ -449,7 +449,7 @@ static const Property pnv_core_properties[] = {
     DEFINE_PROP_LINK("chip", PnvCore, chip, TYPE_PNV_CHIP, PnvChip *),
 };
 
-static void pnv_core_power8_class_init(ObjectClass *oc, void *data)
+static void pnv_core_power8_class_init(ObjectClass *oc, const void *data)
 {
     PnvCoreClass *pcc = PNV_CORE_CLASS(oc);
 
@@ -457,7 +457,7 @@ static void pnv_core_power8_class_init(ObjectClass *oc, void *data)
     pcc->xscom_size = PNV_XSCOM_EX_SIZE;
 }
 
-static void pnv_core_power9_class_init(ObjectClass *oc, void *data)
+static void pnv_core_power9_class_init(ObjectClass *oc, const void *data)
 {
     PnvCoreClass *pcc = PNV_CORE_CLASS(oc);
 
@@ -465,7 +465,7 @@ static void pnv_core_power9_class_init(ObjectClass *oc, void *data)
     pcc->xscom_size = PNV_XSCOM_EX_SIZE;
 }
 
-static void pnv_core_power10_class_init(ObjectClass *oc, void *data)
+static void pnv_core_power10_class_init(ObjectClass *oc, const void *data)
 {
     PnvCoreClass *pcc = PNV_CORE_CLASS(oc);
 
@@ -473,7 +473,7 @@ static void pnv_core_power10_class_init(ObjectClass *oc, void *data)
     pcc->xscom_size = PNV10_XSCOM_EC_SIZE;
 }
 
-static void pnv_core_class_init(ObjectClass *oc, void *data)
+static void pnv_core_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
@@ -700,7 +700,7 @@ static const Property pnv_quad_properties[] = {
     DEFINE_PROP_UINT32("quad-id", PnvQuad, quad_id, 0),
 };
 
-static void pnv_quad_power9_class_init(ObjectClass *oc, void *data)
+static void pnv_quad_power9_class_init(ObjectClass *oc, const void *data)
 {
     PnvQuadClass *pqc = PNV_QUAD_CLASS(oc);
     DeviceClass *dc = DEVICE_CLASS(oc);
@@ -711,7 +711,7 @@ static void pnv_quad_power9_class_init(ObjectClass *oc, void *data)
     pqc->xscom_size = PNV9_XSCOM_EQ_SIZE;
 }
 
-static void pnv_quad_power10_class_init(ObjectClass *oc, void *data)
+static void pnv_quad_power10_class_init(ObjectClass *oc, const void *data)
 {
     PnvQuadClass *pqc = PNV_QUAD_CLASS(oc);
     DeviceClass *dc = DEVICE_CLASS(oc);
@@ -725,7 +725,7 @@ static void pnv_quad_power10_class_init(ObjectClass *oc, void *data)
     pqc->xscom_qme_size = PNV10_XSCOM_QME_SIZE;
 }
 
-static void pnv_quad_class_init(ObjectClass *oc, void *data)
+static void pnv_quad_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
diff --git a/hw/ppc/pnv_homer.c b/hw/ppc/pnv_homer.c
index 0521f9a428..2208ffe632 100644
--- a/hw/ppc/pnv_homer.c
+++ b/hw/ppc/pnv_homer.c
@@ -89,7 +89,7 @@ static hwaddr pnv_homer_power8_get_base(PnvChip *chip)
     return PNV_HOMER_BASE(chip);
 }
 
-static void pnv_homer_power8_class_init(ObjectClass *klass, void *data)
+static void pnv_homer_power8_class_init(ObjectClass *klass, const void *data)
 {
     PnvHomerClass *homer = PNV_HOMER_CLASS(klass);
 
@@ -156,7 +156,7 @@ static hwaddr pnv_homer_power9_get_base(PnvChip *chip)
     return PNV9_HOMER_BASE(chip);
 }
 
-static void pnv_homer_power9_class_init(ObjectClass *klass, void *data)
+static void pnv_homer_power9_class_init(ObjectClass *klass, const void *data)
 {
     PnvHomerClass *homer = PNV_HOMER_CLASS(klass);
 
@@ -223,7 +223,7 @@ static hwaddr pnv_homer_power10_get_base(PnvChip *chip)
     return PNV10_HOMER_BASE(chip);
 }
 
-static void pnv_homer_power10_class_init(ObjectClass *klass, void *data)
+static void pnv_homer_power10_class_init(ObjectClass *klass, const void *data)
 {
     PnvHomerClass *homer = PNV_HOMER_CLASS(klass);
 
@@ -266,7 +266,7 @@ static const Property pnv_homer_properties[] = {
     DEFINE_PROP_LINK("chip", PnvHomer, chip, TYPE_PNV_CHIP, PnvChip *),
 };
 
-static void pnv_homer_class_init(ObjectClass *klass, void *data)
+static void pnv_homer_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/ppc/pnv_i2c.c b/hw/ppc/pnv_i2c.c
index 8d35f452a2..b2f372c874 100644
--- a/hw/ppc/pnv_i2c.c
+++ b/hw/ppc/pnv_i2c.c
@@ -549,7 +549,7 @@ static const Property pnv_i2c_properties[] = {
     DEFINE_PROP_UINT32("num-busses", PnvI2C, num_busses, 1),
 };
 
-static void pnv_i2c_class_init(ObjectClass *klass, void *data)
+static void pnv_i2c_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PnvXScomInterfaceClass *xscomc = PNV_XSCOM_INTERFACE_CLASS(klass);
diff --git a/hw/ppc/pnv_lpc.c b/hw/ppc/pnv_lpc.c
index d812dc8268..d92347bcd2 100644
--- a/hw/ppc/pnv_lpc.c
+++ b/hw/ppc/pnv_lpc.c
@@ -714,7 +714,7 @@ static void pnv_lpc_power8_realize(DeviceState *dev, Error **errp)
                           PNV_XSCOM_LPC_SIZE);
 }
 
-static void pnv_lpc_power8_class_init(ObjectClass *klass, void *data)
+static void pnv_lpc_power8_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PnvXScomInterfaceClass *xdc = PNV_XSCOM_INTERFACE_CLASS(klass);
@@ -760,7 +760,7 @@ static void pnv_lpc_power9_realize(DeviceState *dev, Error **errp)
     qdev_init_gpio_out_named(dev, lpc->psi_irq_serirq, "SERIRQ", 4);
 }
 
-static void pnv_lpc_power9_class_init(ObjectClass *klass, void *data)
+static void pnv_lpc_power9_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PnvLpcClass *plc = PNV_LPC_CLASS(klass);
@@ -777,7 +777,7 @@ static const TypeInfo pnv_lpc_power9_info = {
     .class_init    = pnv_lpc_power9_class_init,
 };
 
-static void pnv_lpc_power10_class_init(ObjectClass *klass, void *data)
+static void pnv_lpc_power10_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -843,7 +843,7 @@ static const Property pnv_lpc_properties[] = {
     DEFINE_PROP_BOOL("psi-serirq", PnvLpcController, psi_has_serirq, false),
 };
 
-static void pnv_lpc_class_init(ObjectClass *klass, void *data)
+static void pnv_lpc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/ppc/pnv_n1_chiplet.c b/hw/ppc/pnv_n1_chiplet.c
index 03ff9fbad0..05e3fd6f73 100644
--- a/hw/ppc/pnv_n1_chiplet.c
+++ b/hw/ppc/pnv_n1_chiplet.c
@@ -136,7 +136,7 @@ static void pnv_n1_chiplet_realize(DeviceState *dev, Error **errp)
                           PNV10_XSCOM_N1_PB_SCOM_ES_SIZE);
 }
 
-static void pnv_n1_chiplet_class_init(ObjectClass *klass, void *data)
+static void pnv_n1_chiplet_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/ppc/pnv_nest_pervasive.c b/hw/ppc/pnv_nest_pervasive.c
index 780fa69dde..b5182d54fa 100644
--- a/hw/ppc/pnv_nest_pervasive.c
+++ b/hw/ppc/pnv_nest_pervasive.c
@@ -181,7 +181,7 @@ static void pnv_nest_pervasive_realize(DeviceState *dev, Error **errp)
                           PNV10_XSCOM_CHIPLET_CTRL_REGS_SIZE);
 }
 
-static void pnv_nest_pervasive_class_init(ObjectClass *klass, void *data)
+static void pnv_nest_pervasive_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/ppc/pnv_occ.c b/hw/ppc/pnv_occ.c
index 0c9d3daec2..fa6f31cb8d 100644
--- a/hw/ppc/pnv_occ.c
+++ b/hw/ppc/pnv_occ.c
@@ -172,7 +172,7 @@ const MemoryRegionOps pnv_occ_sram_ops = {
     .endianness = DEVICE_BIG_ENDIAN,
 };
 
-static void pnv_occ_power8_class_init(ObjectClass *klass, void *data)
+static void pnv_occ_power8_class_init(ObjectClass *klass, const void *data)
 {
     PnvOCCClass *poc = PNV_OCC_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -246,7 +246,7 @@ static const MemoryRegionOps pnv_occ_power9_xscom_ops = {
     .endianness = DEVICE_BIG_ENDIAN,
 };
 
-static void pnv_occ_power9_class_init(ObjectClass *klass, void *data)
+static void pnv_occ_power9_class_init(ObjectClass *klass, const void *data)
 {
     PnvOCCClass *poc = PNV_OCC_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -266,7 +266,7 @@ static const TypeInfo pnv_occ_power9_type_info = {
     .class_init    = pnv_occ_power9_class_init,
 };
 
-static void pnv_occ_power10_class_init(ObjectClass *klass, void *data)
+static void pnv_occ_power10_class_init(ObjectClass *klass, const void *data)
 {
     PnvOCCClass *poc = PNV_OCC_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -335,7 +335,7 @@ static const Property pnv_occ_properties[] = {
     DEFINE_PROP_LINK("homer", PnvOCC, homer, TYPE_PNV_HOMER, PnvHomer *),
 };
 
-static void pnv_occ_class_init(ObjectClass *klass, void *data)
+static void pnv_occ_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/ppc/pnv_pnor.c b/hw/ppc/pnv_pnor.c
index 9db44ca21d..af7cfd028b 100644
--- a/hw/ppc/pnv_pnor.c
+++ b/hw/ppc/pnv_pnor.c
@@ -119,7 +119,7 @@ static const Property pnv_pnor_properties[] = {
     DEFINE_PROP_DRIVE("drive", PnvPnor, blk),
 };
 
-static void pnv_pnor_class_init(ObjectClass *klass, void *data)
+static void pnv_pnor_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/ppc/pnv_psi.c b/hw/ppc/pnv_psi.c
index f832ee61e8..0fd247e6ad 100644
--- a/hw/ppc/pnv_psi.c
+++ b/hw/ppc/pnv_psi.c
@@ -557,7 +557,7 @@ static const Property pnv_psi_properties[] = {
     DEFINE_PROP_UINT64("fsp-bar", PnvPsi, fsp_bar, 0),
 };
 
-static void pnv_psi_power8_class_init(ObjectClass *klass, void *data)
+static void pnv_psi_power8_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PnvPsiClass *ppc = PNV_PSI_CLASS(klass);
@@ -887,7 +887,7 @@ static void pnv_psi_power9_realize(DeviceState *dev, Error **errp)
     pnv_psi_realize(dev, errp);
 }
 
-static void pnv_psi_power9_class_init(ObjectClass *klass, void *data)
+static void pnv_psi_power9_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PnvPsiClass *ppc = PNV_PSI_CLASS(klass);
@@ -919,7 +919,7 @@ static const TypeInfo pnv_psi_power9_info = {
     },
 };
 
-static void pnv_psi_power10_class_init(ObjectClass *klass, void *data)
+static void pnv_psi_power10_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PnvPsiClass *ppc = PNV_PSI_CLASS(klass);
@@ -939,7 +939,7 @@ static const TypeInfo pnv_psi_power10_info = {
     .class_init    = pnv_psi_power10_class_init,
 };
 
-static void pnv_psi_class_init(ObjectClass *klass, void *data)
+static void pnv_psi_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PnvXScomInterfaceClass *xdc = PNV_XSCOM_INTERFACE_CLASS(klass);
diff --git a/hw/ppc/pnv_sbe.c b/hw/ppc/pnv_sbe.c
index 74cee4eea7..34dc013d47 100644
--- a/hw/ppc/pnv_sbe.c
+++ b/hw/ppc/pnv_sbe.c
@@ -331,7 +331,7 @@ static const MemoryRegionOps pnv_sbe_power9_xscom_mbox_ops = {
     .endianness = DEVICE_BIG_ENDIAN,
 };
 
-static void pnv_sbe_power9_class_init(ObjectClass *klass, void *data)
+static void pnv_sbe_power9_class_init(ObjectClass *klass, const void *data)
 {
     PnvSBEClass *psc = PNV_SBE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -350,7 +350,7 @@ static const TypeInfo pnv_sbe_power9_type_info = {
     .class_init    = pnv_sbe_power9_class_init,
 };
 
-static void pnv_sbe_power10_class_init(ObjectClass *klass, void *data)
+static void pnv_sbe_power10_class_init(ObjectClass *klass, const void *data)
 {
     PnvSBEClass *psc = PNV_SBE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -386,7 +386,7 @@ static void pnv_sbe_realize(DeviceState *dev, Error **errp)
     sbe->timer = timer_new_us(QEMU_CLOCK_VIRTUAL, sbe_timer, sbe);
 }
 
-static void pnv_sbe_class_init(ObjectClass *klass, void *data)
+static void pnv_sbe_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/ppc/ppc440_uc.c b/hw/ppc/ppc440_uc.c
index 9da30a1724..89e3fae08d 100644
--- a/hw/ppc/ppc440_uc.c
+++ b/hw/ppc/ppc440_uc.c
@@ -1027,7 +1027,7 @@ static const Property ppc460ex_pcie_props[] = {
                      PowerPCCPU *),
 };
 
-static void ppc460ex_pcie_class_init(ObjectClass *klass, void *data)
+static void ppc460ex_pcie_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/ppc/ppc4xx_devs.c b/hw/ppc/ppc4xx_devs.c
index 9ce9777510..f36c519c8b 100644
--- a/hw/ppc/ppc4xx_devs.c
+++ b/hw/ppc/ppc4xx_devs.c
@@ -236,7 +236,7 @@ static const Property ppc4xx_mal_properties[] = {
     DEFINE_PROP_UINT8("rxc-num", Ppc4xxMalState, rxcnum, 0),
 };
 
-static void ppc4xx_mal_class_init(ObjectClass *oc, void *data)
+static void ppc4xx_mal_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
@@ -326,7 +326,7 @@ static void ppc405_plb_realize(DeviceState *dev, Error **errp)
     ppc4xx_dcr_register(dcr, PLB4A1_ACR, plb, &dcr_read_plb, &dcr_write_plb);
 }
 
-static void ppc405_plb_class_init(ObjectClass *oc, void *data)
+static void ppc405_plb_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
@@ -512,7 +512,7 @@ static void ppc405_ebc_realize(DeviceState *dev, Error **errp)
     ppc4xx_dcr_register(dcr, EBC0_CFGDATA, ebc, &dcr_read_ebc, &dcr_write_ebc);
 }
 
-static void ppc405_ebc_class_init(ObjectClass *oc, void *data)
+static void ppc405_ebc_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
@@ -543,7 +543,7 @@ static const Property ppc4xx_dcr_properties[] = {
                      PowerPCCPU *),
 };
 
-static void ppc4xx_dcr_class_init(ObjectClass *oc, void *data)
+static void ppc4xx_dcr_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
diff --git a/hw/ppc/ppc4xx_sdram.c b/hw/ppc/ppc4xx_sdram.c
index bf0faad9e7..592769826b 100644
--- a/hw/ppc/ppc4xx_sdram.c
+++ b/hw/ppc/ppc4xx_sdram.c
@@ -431,7 +431,7 @@ static const Property ppc4xx_sdram_ddr_props[] = {
     DEFINE_PROP_UINT32("nbanks", Ppc4xxSdramDdrState, nbanks, 4),
 };
 
-static void ppc4xx_sdram_ddr_class_init(ObjectClass *oc, void *data)
+static void ppc4xx_sdram_ddr_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
@@ -715,7 +715,7 @@ static const Property ppc4xx_sdram_ddr2_props[] = {
     DEFINE_PROP_UINT32("nbanks", Ppc4xxSdramDdr2State, nbanks, 4),
 };
 
-static void ppc4xx_sdram_ddr2_class_init(ObjectClass *oc, void *data)
+static void ppc4xx_sdram_ddr2_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
diff --git a/hw/ppc/ppce500_spin.c b/hw/ppc/ppce500_spin.c
index baab74c4ed..2310f62a91 100644
--- a/hw/ppc/ppce500_spin.c
+++ b/hw/ppc/ppce500_spin.c
@@ -175,7 +175,7 @@ static void ppce500_spin_initfn(Object *obj)
     sysbus_init_mmio(dev, &s->iomem);
 }
 
-static void ppce500_spin_class_init(ObjectClass *klass, void *data)
+static void ppce500_spin_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/ppc/prep_systemio.c b/hw/ppc/prep_systemio.c
index 08f29e72e4..41cd923b94 100644
--- a/hw/ppc/prep_systemio.c
+++ b/hw/ppc/prep_systemio.c
@@ -290,7 +290,7 @@ static const Property prep_systemio_properties[] = {
     DEFINE_PROP_UINT8("equipment", PrepSystemIoState, equipment, 0),
 };
 
-static void prep_systemio_class_initfn(ObjectClass *klass, void *data)
+static void prep_systemio_class_initfn(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/ppc/rs6000_mc.c b/hw/ppc/rs6000_mc.c
index 27f1c90f06..a0964051d1 100644
--- a/hw/ppc/rs6000_mc.c
+++ b/hw/ppc/rs6000_mc.c
@@ -212,7 +212,7 @@ static const Property rs6000mc_properties[] = {
     DEFINE_PROP_BOOL("auto-configure", RS6000MCState, autoconfigure, true),
 };
 
-static void rs6000mc_class_initfn(ObjectClass *klass, void *data)
+static void rs6000mc_class_initfn(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index c1a7ac3536..02663851ae 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -4595,7 +4595,7 @@ static void spapr_cpu_exec_exit(PPCVirtualHypervisor *vhyp, PowerPCCPU *cpu)
     }
 }
 
-static void spapr_machine_class_init(ObjectClass *oc, void *data)
+static void spapr_machine_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(oc);
@@ -4739,7 +4739,7 @@ static void spapr_machine_latest_class_options(MachineClass *mc)
 #define DEFINE_SPAPR_MACHINE_IMPL(latest, ...)                       \
     static void MACHINE_VER_SYM(class_init, spapr, __VA_ARGS__)(     \
         ObjectClass *oc,                                             \
-        void *data)                                                  \
+        const void *data)                                            \
     {                                                                \
         MachineClass *mc = MACHINE_CLASS(oc);                        \
         MACHINE_VER_SYM(class_options, spapr, __VA_ARGS__)(mc);      \
diff --git a/hw/ppc/spapr_cpu_core.c b/hw/ppc/spapr_cpu_core.c
index faf9170ba6..b4b926d759 100644
--- a/hw/ppc/spapr_cpu_core.c
+++ b/hw/ppc/spapr_cpu_core.c
@@ -373,7 +373,7 @@ static const Property spapr_cpu_core_properties[] = {
     DEFINE_PROP_INT32("node-id", SpaprCpuCore, node_id, CPU_UNSET_NUMA_NODE_ID),
 };
 
-static void spapr_cpu_core_class_init(ObjectClass *oc, void *data)
+static void spapr_cpu_core_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     SpaprCpuCoreClass *scc = SPAPR_CPU_CORE_CLASS(oc);
diff --git a/hw/ppc/spapr_drc.c b/hw/ppc/spapr_drc.c
index 549b652c20..d2044b4fb5 100644
--- a/hw/ppc/spapr_drc.c
+++ b/hw/ppc/spapr_drc.c
@@ -589,7 +589,7 @@ static void spapr_dr_connector_instance_init(Object *obj)
     drc->state = drck->empty_state;
 }
 
-static void spapr_dr_connector_class_init(ObjectClass *k, void *data)
+static void spapr_dr_connector_class_init(ObjectClass *k, const void *data)
 {
     DeviceClass *dk = DEVICE_CLASS(k);
 
@@ -665,7 +665,7 @@ static void unrealize_physical(DeviceState *d)
     qemu_unregister_reset(drc_physical_reset, drcp);
 }
 
-static void spapr_drc_physical_class_init(ObjectClass *k, void *data)
+static void spapr_drc_physical_class_init(ObjectClass *k, const void *data)
 {
     DeviceClass *dk = DEVICE_CLASS(k);
     SpaprDrcClass *drck = SPAPR_DR_CONNECTOR_CLASS(k);
@@ -679,7 +679,7 @@ static void spapr_drc_physical_class_init(ObjectClass *k, void *data)
     drck->empty_state = SPAPR_DRC_STATE_PHYSICAL_POWERON;
 }
 
-static void spapr_drc_logical_class_init(ObjectClass *k, void *data)
+static void spapr_drc_logical_class_init(ObjectClass *k, const void *data)
 {
     SpaprDrcClass *drck = SPAPR_DR_CONNECTOR_CLASS(k);
 
@@ -690,7 +690,7 @@ static void spapr_drc_logical_class_init(ObjectClass *k, void *data)
     drck->empty_state = SPAPR_DRC_STATE_LOGICAL_UNUSABLE;
 }
 
-static void spapr_drc_cpu_class_init(ObjectClass *k, void *data)
+static void spapr_drc_cpu_class_init(ObjectClass *k, const void *data)
 {
     SpaprDrcClass *drck = SPAPR_DR_CONNECTOR_CLASS(k);
 
@@ -701,7 +701,7 @@ static void spapr_drc_cpu_class_init(ObjectClass *k, void *data)
     drck->dt_populate = spapr_core_dt_populate;
 }
 
-static void spapr_drc_pci_class_init(ObjectClass *k, void *data)
+static void spapr_drc_pci_class_init(ObjectClass *k, const void *data)
 {
     SpaprDrcClass *drck = SPAPR_DR_CONNECTOR_CLASS(k);
 
@@ -712,7 +712,7 @@ static void spapr_drc_pci_class_init(ObjectClass *k, void *data)
     drck->dt_populate = spapr_pci_dt_populate;
 }
 
-static void spapr_drc_lmb_class_init(ObjectClass *k, void *data)
+static void spapr_drc_lmb_class_init(ObjectClass *k, const void *data)
 {
     SpaprDrcClass *drck = SPAPR_DR_CONNECTOR_CLASS(k);
 
@@ -723,7 +723,7 @@ static void spapr_drc_lmb_class_init(ObjectClass *k, void *data)
     drck->dt_populate = spapr_lmb_dt_populate;
 }
 
-static void spapr_drc_phb_class_init(ObjectClass *k, void *data)
+static void spapr_drc_phb_class_init(ObjectClass *k, const void *data)
 {
     SpaprDrcClass *drck = SPAPR_DR_CONNECTOR_CLASS(k);
 
@@ -734,7 +734,7 @@ static void spapr_drc_phb_class_init(ObjectClass *k, void *data)
     drck->dt_populate = spapr_phb_dt_populate;
 }
 
-static void spapr_drc_pmem_class_init(ObjectClass *k, void *data)
+static void spapr_drc_pmem_class_init(ObjectClass *k, const void *data)
 {
     SpaprDrcClass *drck = SPAPR_DR_CONNECTOR_CLASS(k);
 
diff --git a/hw/ppc/spapr_iommu.c b/hw/ppc/spapr_iommu.c
index db3a14c1df..c2432a0c00 100644
--- a/hw/ppc/spapr_iommu.c
+++ b/hw/ppc/spapr_iommu.c
@@ -668,7 +668,7 @@ int spapr_tcet_dma_dt(void *fdt, int node_off, const char *propname,
                         tcet->liobn, 0, tcet->nb_table << tcet->page_shift);
 }
 
-static void spapr_tce_table_class_init(ObjectClass *klass, void *data)
+static void spapr_tce_table_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     dc->realize = spapr_tce_table_realize;
@@ -693,7 +693,8 @@ static const TypeInfo spapr_tce_table_info = {
     .class_init = spapr_tce_table_class_init,
 };
 
-static void spapr_iommu_memory_region_class_init(ObjectClass *klass, void *data)
+static void spapr_iommu_memory_region_class_init(ObjectClass *klass,
+                                                 const void *data)
 {
     IOMMUMemoryRegionClass *imrc = IOMMU_MEMORY_REGION_CLASS(klass);
 
diff --git a/hw/ppc/spapr_nvdimm.c b/hw/ppc/spapr_nvdimm.c
index 6e93ff9b33..72b4a6329f 100644
--- a/hw/ppc/spapr_nvdimm.c
+++ b/hw/ppc/spapr_nvdimm.c
@@ -888,7 +888,7 @@ static const Property spapr_nvdimm_properties[] = {
 };
 #endif
 
-static void spapr_nvdimm_class_init(ObjectClass *oc, void *data)
+static void spapr_nvdimm_class_init(ObjectClass *oc, const void *data)
 {
     NVDIMMClass *nvc = NVDIMM_CLASS(oc);
 
diff --git a/hw/ppc/spapr_pci.c b/hw/ppc/spapr_pci.c
index 384269b831..d0468e3fe6 100644
--- a/hw/ppc/spapr_pci.c
+++ b/hw/ppc/spapr_pci.c
@@ -2173,7 +2173,7 @@ static const char *spapr_phb_root_bus_path(PCIHostState *host_bridge,
     return sphb->dtbusname;
 }
 
-static void spapr_phb_class_init(ObjectClass *klass, void *data)
+static void spapr_phb_class_init(ObjectClass *klass, const void *data)
 {
     PCIHostBridgeClass *hc = PCI_HOST_BRIDGE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
diff --git a/hw/ppc/spapr_rng.c b/hw/ppc/spapr_rng.c
index 95def5b1e5..6fec607037 100644
--- a/hw/ppc/spapr_rng.c
+++ b/hw/ppc/spapr_rng.c
@@ -136,7 +136,7 @@ static const Property spapr_rng_properties[] = {
                      RngBackend *),
 };
 
-static void spapr_rng_class_init(ObjectClass *oc, void *data)
+static void spapr_rng_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
diff --git a/hw/ppc/spapr_rtc.c b/hw/ppc/spapr_rtc.c
index 46fbc78900..1f7d2d8f89 100644
--- a/hw/ppc/spapr_rtc.c
+++ b/hw/ppc/spapr_rtc.c
@@ -163,7 +163,7 @@ static const VMStateDescription vmstate_spapr_rtc = {
     },
 };
 
-static void spapr_rtc_class_init(ObjectClass *oc, void *data)
+static void spapr_rtc_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
diff --git a/hw/ppc/spapr_tpm_proxy.c b/hw/ppc/spapr_tpm_proxy.c
index ceaa0acaa1..862eeaa50a 100644
--- a/hw/ppc/spapr_tpm_proxy.c
+++ b/hw/ppc/spapr_tpm_proxy.c
@@ -149,7 +149,7 @@ static const Property spapr_tpm_proxy_properties[] = {
     DEFINE_PROP_STRING("host-path", SpaprTpmProxy, host_path),
 };
 
-static void spapr_tpm_proxy_class_init(ObjectClass *k, void *data)
+static void spapr_tpm_proxy_class_init(ObjectClass *k, const void *data)
 {
     DeviceClass *dk = DEVICE_CLASS(k);
 
diff --git a/hw/ppc/spapr_vio.c b/hw/ppc/spapr_vio.c
index 09243c183b..7759436a4f 100644
--- a/hw/ppc/spapr_vio.c
+++ b/hw/ppc/spapr_vio.c
@@ -50,7 +50,7 @@ static char *spapr_vio_get_dev_name(DeviceState *qdev)
     return g_strdup_printf("%s@%x", pc->dt_name, dev->reg);
 }
 
-static void spapr_vio_bus_class_init(ObjectClass *klass, void *data)
+static void spapr_vio_bus_class_init(ObjectClass *klass, const void *data)
 {
     BusClass *k = BUS_CLASS(klass);
 
@@ -599,7 +599,7 @@ SpaprVioBus *spapr_vio_bus_init(void)
     return bus;
 }
 
-static void spapr_vio_bridge_class_init(ObjectClass *klass, void *data)
+static void spapr_vio_bridge_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -631,7 +631,7 @@ const VMStateDescription vmstate_spapr_vio = {
     },
 };
 
-static void vio_spapr_device_class_init(ObjectClass *klass, void *data)
+static void vio_spapr_device_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *k = DEVICE_CLASS(klass);
     k->realize = spapr_vio_busdev_realize;
diff --git a/hw/remote/machine.c b/hw/remote/machine.c
index d4616025e8..9fb92ec6f1 100644
--- a/hw/remote/machine.c
+++ b/hw/remote/machine.c
@@ -121,7 +121,7 @@ static void remote_machine_dev_unplug_cb(HotplugHandler *hotplug_dev,
     }
 }
 
-static void remote_machine_class_init(ObjectClass *oc, void *data)
+static void remote_machine_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     HotplugHandlerClass *hc = HOTPLUG_HANDLER_CLASS(oc);
diff --git a/hw/remote/proxy.c b/hw/remote/proxy.c
index 96d831a579..d2de48c9e3 100644
--- a/hw/remote/proxy.c
+++ b/hw/remote/proxy.c
@@ -195,7 +195,7 @@ static const Property proxy_properties[] = {
     DEFINE_PROP_STRING("fd", PCIProxyDev, fd),
 };
 
-static void pci_proxy_dev_class_init(ObjectClass *klass, void *data)
+static void pci_proxy_dev_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
diff --git a/hw/remote/remote-obj.c b/hw/remote/remote-obj.c
index 2f25f92dcd..75f8d6df8a 100644
--- a/hw/remote/remote-obj.c
+++ b/hw/remote/remote-obj.c
@@ -163,7 +163,7 @@ static void remote_object_finalize(Object *obj)
     g_free(o->devid);
 }
 
-static void remote_object_class_init(ObjectClass *klass, void *data)
+static void remote_object_class_init(ObjectClass *klass, const void *data)
 {
     RemoteObjectClass *k = REMOTE_OBJECT_CLASS(klass);
 
diff --git a/hw/remote/vfio-user-obj.c b/hw/remote/vfio-user-obj.c
index 9bdd0a465b..b0ae403f06 100644
--- a/hw/remote/vfio-user-obj.c
+++ b/hw/remote/vfio-user-obj.c
@@ -917,7 +917,7 @@ static void vfu_object_finalize(Object *obj)
     }
 }
 
-static void vfu_object_class_init(ObjectClass *klass, void *data)
+static void vfu_object_class_init(ObjectClass *klass, const void *data)
 {
     VfuObjectClass *k = VFU_OBJECT_CLASS(klass);
 
diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
index 9c846f9b5b..e39ee657cd 100644
--- a/hw/riscv/microchip_pfsoc.c
+++ b/hw/riscv/microchip_pfsoc.c
@@ -479,7 +479,7 @@ static void microchip_pfsoc_soc_realize(DeviceState *dev, Error **errp)
                                 qspi_xip_mem);
 }
 
-static void microchip_pfsoc_soc_class_init(ObjectClass *oc, void *data)
+static void microchip_pfsoc_soc_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
@@ -639,7 +639,8 @@ static void microchip_icicle_kit_machine_init(MachineState *machine)
     }
 }
 
-static void microchip_icicle_kit_machine_class_init(ObjectClass *oc, void *data)
+static void microchip_icicle_kit_machine_class_init(ObjectClass *oc,
+                                                    const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
 
diff --git a/hw/riscv/opentitan.c b/hw/riscv/opentitan.c
index 019d6b3986..d369a8a7dc 100644
--- a/hw/riscv/opentitan.c
+++ b/hw/riscv/opentitan.c
@@ -112,7 +112,7 @@ static void opentitan_machine_init(MachineState *machine)
     }
 }
 
-static void opentitan_machine_class_init(ObjectClass *oc, void *data)
+static void opentitan_machine_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
 
@@ -313,7 +313,7 @@ static const Property lowrisc_ibex_soc_props[] = {
     DEFINE_PROP_UINT32("resetvec", LowRISCIbexSoCState, resetvec, 0x20000400),
 };
 
-static void lowrisc_ibex_soc_class_init(ObjectClass *oc, void *data)
+static void lowrisc_ibex_soc_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
diff --git a/hw/riscv/riscv-iommu-pci.c b/hw/riscv/riscv-iommu-pci.c
index a795464803..d93cf7521b 100644
--- a/hw/riscv/riscv-iommu-pci.c
+++ b/hw/riscv/riscv-iommu-pci.c
@@ -184,7 +184,7 @@ static void riscv_iommu_pci_reset_hold(Object *obj, ResetType type)
     trace_riscv_iommu_pci_reset_hold(type);
 }
 
-static void riscv_iommu_pci_class_init(ObjectClass *klass, void *data)
+static void riscv_iommu_pci_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
diff --git a/hw/riscv/riscv-iommu-sys.c b/hw/riscv/riscv-iommu-sys.c
index 65b24fb07d..be2e3944dc 100644
--- a/hw/riscv/riscv-iommu-sys.c
+++ b/hw/riscv/riscv-iommu-sys.c
@@ -227,7 +227,7 @@ static void riscv_iommu_sys_reset_hold(Object *obj, ResetType type)
     trace_riscv_iommu_sys_reset_hold(type);
 }
 
-static void riscv_iommu_sys_class_init(ObjectClass *klass, void *data)
+static void riscv_iommu_sys_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     ResettableClass *rc = RESETTABLE_CLASS(klass);
diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c
index 65411b3e4c..a877e5da84 100644
--- a/hw/riscv/riscv-iommu.c
+++ b/hw/riscv/riscv-iommu.c
@@ -2513,7 +2513,7 @@ static const Property riscv_iommu_properties[] = {
                       RISCV_IOMMU_IOCOUNT_NUM),
 };
 
-static void riscv_iommu_class_init(ObjectClass *klass, void* data)
+static void riscv_iommu_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -2654,7 +2654,7 @@ static int riscv_iommu_memory_region_index_len(IOMMUMemoryRegion *iommu_mr)
     return 1 << as->iommu->pid_bits;
 }
 
-static void riscv_iommu_memory_region_init(ObjectClass *klass, void *data)
+static void riscv_iommu_memory_region_init(ObjectClass *klass, const void *data)
 {
     IOMMUMemoryRegionClass *imrc = IOMMU_MEMORY_REGION_CLASS(klass);
 
diff --git a/hw/riscv/riscv_hart.c b/hw/riscv/riscv_hart.c
index a55d156668..ac6539bd3e 100644
--- a/hw/riscv/riscv_hart.c
+++ b/hw/riscv/riscv_hart.c
@@ -160,7 +160,7 @@ static void riscv_harts_realize(DeviceState *dev, Error **errp)
     }
 }
 
-static void riscv_harts_class_init(ObjectClass *klass, void *data)
+static void riscv_harts_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/riscv/shakti_c.c b/hw/riscv/shakti_c.c
index 17c5c72102..3e7f441172 100644
--- a/hw/riscv/shakti_c.c
+++ b/hw/riscv/shakti_c.c
@@ -71,7 +71,7 @@ static void shakti_c_machine_instance_init(Object *obj)
 {
 }
 
-static void shakti_c_machine_class_init(ObjectClass *klass, void *data)
+static void shakti_c_machine_class_init(ObjectClass *klass, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(klass);
     static const char * const valid_cpu_types[] = {
@@ -142,7 +142,7 @@ static void shakti_c_soc_state_realize(DeviceState *dev, Error **errp)
         shakti_c_memmap[SHAKTI_C_ROM].base, &sss->rom);
 }
 
-static void shakti_c_soc_class_init(ObjectClass *klass, void *data)
+static void shakti_c_soc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     dc->realize = shakti_c_soc_state_realize;
diff --git a/hw/riscv/sifive_e.c b/hw/riscv/sifive_e.c
index 73d3b74281..7baed1958e 100644
--- a/hw/riscv/sifive_e.c
+++ b/hw/riscv/sifive_e.c
@@ -143,7 +143,7 @@ static void sifive_e_machine_instance_init(Object *obj)
     s->revb = false;
 }
 
-static void sifive_e_machine_class_init(ObjectClass *oc, void *data)
+static void sifive_e_machine_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
 
@@ -284,7 +284,7 @@ static void sifive_e_soc_realize(DeviceState *dev, Error **errp)
         &s->xip_mem);
 }
 
-static void sifive_e_soc_class_init(ObjectClass *oc, void *data)
+static void sifive_e_soc_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
diff --git a/hw/riscv/sifive_u.c b/hw/riscv/sifive_u.c
index 679f2024bc..d69f942cfb 100644
--- a/hw/riscv/sifive_u.c
+++ b/hw/riscv/sifive_u.c
@@ -713,7 +713,7 @@ static void sifive_u_machine_instance_init(Object *obj)
     object_property_set_description(obj, "serial", "Board serial number");
 }
 
-static void sifive_u_machine_class_init(ObjectClass *oc, void *data)
+static void sifive_u_machine_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
 
@@ -946,7 +946,7 @@ static const Property sifive_u_soc_props[] = {
     DEFINE_PROP_STRING("cpu-type", SiFiveUSoCState, cpu_type),
 };
 
-static void sifive_u_soc_class_init(ObjectClass *oc, void *data)
+static void sifive_u_soc_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
diff --git a/hw/riscv/spike.c b/hw/riscv/spike.c
index 74a20016f1..641aae8c01 100644
--- a/hw/riscv/spike.c
+++ b/hw/riscv/spike.c
@@ -342,7 +342,7 @@ static void spike_machine_instance_init(Object *obj)
 {
 }
 
-static void spike_machine_class_init(ObjectClass *oc, void *data)
+static void spike_machine_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
 
diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index 85849e604c..557efd15a1 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -1906,7 +1906,7 @@ static void virt_machine_device_plug_cb(HotplugHandler *hotplug_dev,
     }
 }
 
-static void virt_machine_class_init(ObjectClass *oc, void *data)
+static void virt_machine_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     HotplugHandlerClass *hc = HOTPLUG_HANDLER_CLASS(oc);
diff --git a/hw/rtc/allwinner-rtc.c b/hw/rtc/allwinner-rtc.c
index fd8355a867..a747bff534 100644
--- a/hw/rtc/allwinner-rtc.c
+++ b/hw/rtc/allwinner-rtc.c
@@ -315,7 +315,7 @@ static const Property allwinner_rtc_properties[] = {
     DEFINE_PROP_INT32("base-year", AwRtcState, base_year, 0),
 };
 
-static void allwinner_rtc_class_init(ObjectClass *klass, void *data)
+static void allwinner_rtc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -330,7 +330,7 @@ static void allwinner_rtc_sun4i_init(Object *obj)
     s->base_year = 2010;
 }
 
-static void allwinner_rtc_sun4i_class_init(ObjectClass *klass, void *data)
+static void allwinner_rtc_sun4i_class_init(ObjectClass *klass, const void *data)
 {
     AwRtcClass *arc = AW_RTC_CLASS(klass);
 
@@ -346,7 +346,7 @@ static void allwinner_rtc_sun6i_init(Object *obj)
     s->base_year = 1970;
 }
 
-static void allwinner_rtc_sun6i_class_init(ObjectClass *klass, void *data)
+static void allwinner_rtc_sun6i_class_init(ObjectClass *klass, const void *data)
 {
     AwRtcClass *arc = AW_RTC_CLASS(klass);
 
@@ -362,7 +362,7 @@ static void allwinner_rtc_sun7i_init(Object *obj)
     s->base_year = 1970;
 }
 
-static void allwinner_rtc_sun7i_class_init(ObjectClass *klass, void *data)
+static void allwinner_rtc_sun7i_class_init(ObjectClass *klass, const void *data)
 {
     AwRtcClass *arc = AW_RTC_CLASS(klass);
     allwinner_rtc_sun4i_class_init(klass, arc);
diff --git a/hw/rtc/aspeed_rtc.c b/hw/rtc/aspeed_rtc.c
index fbdeb0781f..c4feea23a0 100644
--- a/hw/rtc/aspeed_rtc.c
+++ b/hw/rtc/aspeed_rtc.c
@@ -156,7 +156,7 @@ static void aspeed_rtc_realize(DeviceState *dev, Error **errp)
     sysbus_init_mmio(sbd, &s->iomem);
 }
 
-static void aspeed_rtc_class_init(ObjectClass *klass, void *data)
+static void aspeed_rtc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/rtc/ds1338.c b/hw/rtc/ds1338.c
index 8dd17fdc07..5f1ee2e410 100644
--- a/hw/rtc/ds1338.c
+++ b/hw/rtc/ds1338.c
@@ -220,7 +220,7 @@ static void ds1338_reset(DeviceState *dev)
     s->addr_byte = false;
 }
 
-static void ds1338_class_init(ObjectClass *klass, void *data)
+static void ds1338_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     I2CSlaveClass *k = I2C_SLAVE_CLASS(klass);
diff --git a/hw/rtc/exynos4210_rtc.c b/hw/rtc/exynos4210_rtc.c
index aa1b3cd115..624b4f61a8 100644
--- a/hw/rtc/exynos4210_rtc.c
+++ b/hw/rtc/exynos4210_rtc.c
@@ -592,7 +592,7 @@ static void exynos4210_rtc_finalize(Object *obj)
     ptimer_free(s->ptimer_1Hz);
 }
 
-static void exynos4210_rtc_class_init(ObjectClass *klass, void *data)
+static void exynos4210_rtc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/rtc/goldfish_rtc.c b/hw/rtc/goldfish_rtc.c
index d83cc26481..78df031cf2 100644
--- a/hw/rtc/goldfish_rtc.c
+++ b/hw/rtc/goldfish_rtc.c
@@ -273,7 +273,7 @@ static const Property goldfish_rtc_properties[] = {
                       false),
 };
 
-static void goldfish_rtc_class_init(ObjectClass *klass, void *data)
+static void goldfish_rtc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/rtc/ls7a_rtc.c b/hw/rtc/ls7a_rtc.c
index fce23a3dbe..10097b2db7 100644
--- a/hw/rtc/ls7a_rtc.c
+++ b/hw/rtc/ls7a_rtc.c
@@ -464,7 +464,7 @@ static const VMStateDescription vmstate_ls7a_rtc = {
     }
 };
 
-static void ls7a_rtc_class_init(ObjectClass *klass, void *data)
+static void ls7a_rtc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     dc->vmsd = &vmstate_ls7a_rtc;
diff --git a/hw/rtc/m41t80.c b/hw/rtc/m41t80.c
index 9600695679..c631ec3ea1 100644
--- a/hw/rtc/m41t80.c
+++ b/hw/rtc/m41t80.c
@@ -94,7 +94,7 @@ static int m41t80_event(I2CSlave *i2c, enum i2c_event event)
     return 0;
 }
 
-static void m41t80_class_init(ObjectClass *klass, void *data)
+static void m41t80_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     I2CSlaveClass *sc = I2C_SLAVE_CLASS(klass);
diff --git a/hw/rtc/m48t59-isa.c b/hw/rtc/m48t59-isa.c
index 9c3855a3ef..4a7c0af9f0 100644
--- a/hw/rtc/m48t59-isa.c
+++ b/hw/rtc/m48t59-isa.c
@@ -113,7 +113,7 @@ static void m48t59_isa_realize(DeviceState *dev, Error **errp)
     }
 }
 
-static void m48txx_isa_class_init(ObjectClass *klass, void *data)
+static void m48txx_isa_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     NvramClass *nc = NVRAM_CLASS(klass);
@@ -126,7 +126,7 @@ static void m48txx_isa_class_init(ObjectClass *klass, void *data)
     nc->toggle_lock = m48txx_isa_toggle_lock;
 }
 
-static void m48txx_isa_concrete_class_init(ObjectClass *klass, void *data)
+static void m48txx_isa_concrete_class_init(ObjectClass *klass, const void *data)
 {
     M48txxISADeviceClass *u = M48TXX_ISA_CLASS(klass);
     const M48txxInfo *info = data;
diff --git a/hw/rtc/m48t59.c b/hw/rtc/m48t59.c
index 3fb2f27d9d..821472a680 100644
--- a/hw/rtc/m48t59.c
+++ b/hw/rtc/m48t59.c
@@ -622,7 +622,7 @@ static const Property m48t59_sysbus_properties[] = {
     DEFINE_PROP_INT32("base-year", M48txxSysBusState, state.base_year, 0),
 };
 
-static void m48txx_sysbus_class_init(ObjectClass *klass, void *data)
+static void m48txx_sysbus_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     NvramClass *nc = NVRAM_CLASS(klass);
@@ -636,7 +636,8 @@ static void m48txx_sysbus_class_init(ObjectClass *klass, void *data)
     nc->toggle_lock = m48txx_sysbus_toggle_lock;
 }
 
-static void m48txx_sysbus_concrete_class_init(ObjectClass *klass, void *data)
+static void m48txx_sysbus_concrete_class_init(ObjectClass *klass,
+                                              const void *data)
 {
     M48txxSysBusDeviceClass *u = M48TXX_SYS_BUS_CLASS(klass);
     const M48txxInfo *info = data;
diff --git a/hw/rtc/mc146818rtc.c b/hw/rtc/mc146818rtc.c
index e322fc2ffb..93b632bdf4 100644
--- a/hw/rtc/mc146818rtc.c
+++ b/hw/rtc/mc146818rtc.c
@@ -1018,7 +1018,7 @@ static void rtc_build_aml(AcpiDevAmlIf *adev, Aml *scope)
     aml_append(scope, dev);
 }
 
-static void rtc_class_initfn(ObjectClass *klass, void *data)
+static void rtc_class_initfn(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     ResettableClass *rc = RESETTABLE_CLASS(klass);
diff --git a/hw/rtc/pl031.c b/hw/rtc/pl031.c
index ed439bd3ad..e545b9dfd6 100644
--- a/hw/rtc/pl031.c
+++ b/hw/rtc/pl031.c
@@ -332,7 +332,7 @@ static const Property pl031_properties[] = {
                      PL031State, migrate_tick_offset, true),
 };
 
-static void pl031_class_init(ObjectClass *klass, void *data)
+static void pl031_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/rtc/rs5c372.c b/hw/rtc/rs5c372.c
index 5542f74085..bb924534a7 100644
--- a/hw/rtc/rs5c372.c
+++ b/hw/rtc/rs5c372.c
@@ -210,7 +210,7 @@ static void rs5c372_init(Object *obj)
     qdev_prop_set_uint8(DEVICE(obj), "address", 0x32);
 }
 
-static void rs5c372_class_init(ObjectClass *klass, void *data)
+static void rs5c372_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     I2CSlaveClass *k = I2C_SLAVE_CLASS(klass);
diff --git a/hw/rtc/sun4v-rtc.c b/hw/rtc/sun4v-rtc.c
index ffcc0aa25d..29e24ef6be 100644
--- a/hw/rtc/sun4v-rtc.c
+++ b/hw/rtc/sun4v-rtc.c
@@ -75,7 +75,7 @@ static void sun4v_rtc_realize(DeviceState *dev, Error **errp)
     sysbus_init_mmio(sbd, &s->iomem);
 }
 
-static void sun4v_rtc_class_init(ObjectClass *klass, void *data)
+static void sun4v_rtc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/rtc/xlnx-zynqmp-rtc.c b/hw/rtc/xlnx-zynqmp-rtc.c
index b596b608c5..500982a801 100644
--- a/hw/rtc/xlnx-zynqmp-rtc.c
+++ b/hw/rtc/xlnx-zynqmp-rtc.c
@@ -251,7 +251,7 @@ static const VMStateDescription vmstate_rtc = {
     }
 };
 
-static void rtc_class_init(ObjectClass *klass, void *data)
+static void rtc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/rx/rx-gdbsim.c b/hw/rx/rx-gdbsim.c
index 4afd77efd5..5b9004e9e1 100644
--- a/hw/rx/rx-gdbsim.c
+++ b/hw/rx/rx-gdbsim.c
@@ -155,7 +155,7 @@ static void rx_gdbsim_init(MachineState *machine)
     }
 }
 
-static void rx_gdbsim_class_init(ObjectClass *oc, void *data)
+static void rx_gdbsim_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
 
@@ -165,7 +165,7 @@ static void rx_gdbsim_class_init(ObjectClass *oc, void *data)
     mc->default_ram_id = "ext-sdram";
 }
 
-static void rx62n7_class_init(ObjectClass *oc, void *data)
+static void rx62n7_class_init(ObjectClass *oc, const void *data)
 {
     RxGdbSimMachineClass *rxc = RX_GDBSIM_MACHINE_CLASS(oc);
     MachineClass *mc = MACHINE_CLASS(oc);
@@ -175,7 +175,7 @@ static void rx62n7_class_init(ObjectClass *oc, void *data)
     mc->desc = "gdb simulator (R5F562N7 MCU and external RAM)";
 };
 
-static void rx62n8_class_init(ObjectClass *oc, void *data)
+static void rx62n8_class_init(ObjectClass *oc, const void *data)
 {
     RxGdbSimMachineClass *rxc = RX_GDBSIM_MACHINE_CLASS(oc);
     MachineClass *mc = MACHINE_CLASS(oc);
diff --git a/hw/rx/rx62n.c b/hw/rx/rx62n.c
index e6bac4f053..a2a243afa4 100644
--- a/hw/rx/rx62n.c
+++ b/hw/rx/rx62n.c
@@ -264,7 +264,7 @@ static const Property rx62n_properties[] = {
     DEFINE_PROP_UINT32("xtal-frequency-hz", RX62NState, xtal_freq_hz, 0),
 };
 
-static void rx62n_class_init(ObjectClass *klass, void *data)
+static void rx62n_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -272,7 +272,7 @@ static void rx62n_class_init(ObjectClass *klass, void *data)
     device_class_set_props(dc, rx62n_properties);
 }
 
-static void r5f562n7_class_init(ObjectClass *oc, void *data)
+static void r5f562n7_class_init(ObjectClass *oc, const void *data)
 {
     RX62NClass *rxc = RX62N_MCU_CLASS(oc);
 
@@ -281,7 +281,7 @@ static void r5f562n7_class_init(ObjectClass *oc, void *data)
     rxc->data_flash_size = 32 * KiB;
 };
 
-static void r5f562n8_class_init(ObjectClass *oc, void *data)
+static void r5f562n8_class_init(ObjectClass *oc, const void *data)
 {
     RX62NClass *rxc = RX62N_MCU_CLASS(oc);
 
diff --git a/hw/s390x/3270-ccw.c b/hw/s390x/3270-ccw.c
index 3a8930dfd1..3f0d384fd8 100644
--- a/hw/s390x/3270-ccw.c
+++ b/hw/s390x/3270-ccw.c
@@ -150,7 +150,7 @@ out_err:
     g_free(sch);
 }
 
-static void emulated_ccw_3270_class_init(ObjectClass *klass, void *data)
+static void emulated_ccw_3270_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/s390x/ap-bridge.c b/hw/s390x/ap-bridge.c
index ef8fa2b15b..4aa7d5a90d 100644
--- a/hw/s390x/ap-bridge.c
+++ b/hw/s390x/ap-bridge.c
@@ -22,7 +22,7 @@ static char *ap_bus_get_dev_path(DeviceState *dev)
     return g_strdup_printf("/1");
 }
 
-static void ap_bus_class_init(ObjectClass *oc, void *data)
+static void ap_bus_class_init(ObjectClass *oc, const void *data)
 {
     BusClass *k = BUS_CLASS(oc);
 
@@ -61,7 +61,7 @@ void s390_init_ap(void)
     qbus_set_hotplug_handler(bus, OBJECT(dev));
  }
 
-static void ap_bridge_class_init(ObjectClass *oc, void *data)
+static void ap_bridge_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     HotplugHandlerClass *hc = HOTPLUG_HANDLER_CLASS(oc);
diff --git a/hw/s390x/ap-device.c b/hw/s390x/ap-device.c
index 237d1f19c5..733104403e 100644
--- a/hw/s390x/ap-device.c
+++ b/hw/s390x/ap-device.c
@@ -12,7 +12,7 @@
 #include "qapi/error.h"
 #include "hw/s390x/ap-device.h"
 
-static void ap_class_init(ObjectClass *klass, void *data)
+static void ap_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/s390x/ccw-device.c b/hw/s390x/ccw-device.c
index 1ea9934f6c..19c2238f76 100644
--- a/hw/s390x/ccw-device.c
+++ b/hw/s390x/ccw-device.c
@@ -94,7 +94,7 @@ static void ccw_device_reset_hold(Object *obj, ResetType type)
     css_reset_sch(ccw_dev->sch);
 }
 
-static void ccw_device_class_init(ObjectClass *klass, void *data)
+static void ccw_device_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     CCWDeviceClass *k = CCW_DEVICE_CLASS(klass);
diff --git a/hw/s390x/css-bridge.c b/hw/s390x/css-bridge.c
index c48d5571b5..9d91e5a5fe 100644
--- a/hw/s390x/css-bridge.c
+++ b/hw/s390x/css-bridge.c
@@ -70,7 +70,7 @@ static char *virtual_css_bus_get_dev_path(DeviceState *dev)
     return g_strdup_printf("/%02x.%1x.%04x", sch->cssid, sch->ssid, sch->devno);
 }
 
-static void virtual_css_bus_class_init(ObjectClass *klass, void *data)
+static void virtual_css_bus_class_init(ObjectClass *klass, const void *data)
 {
     BusClass *k = BUS_CLASS(klass);
     ResettableClass *rc = RESETTABLE_CLASS(klass);
@@ -117,7 +117,7 @@ static bool prop_get_true(Object *obj, Error **errp)
     return true;
 }
 
-static void virtual_css_bridge_class_init(ObjectClass *klass, void *data)
+static void virtual_css_bridge_class_init(ObjectClass *klass, const void *data)
 {
     HotplugHandlerClass *hc = HOTPLUG_HANDLER_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
diff --git a/hw/s390x/event-facility.c b/hw/s390x/event-facility.c
index 2b0332c20e..1afe364573 100644
--- a/hw/s390x/event-facility.c
+++ b/hw/s390x/event-facility.c
@@ -460,7 +460,7 @@ static void reset_event_facility(DeviceState *dev)
     sdev->receive_mask = 0;
 }
 
-static void init_event_facility_class(ObjectClass *klass, void *data)
+static void init_event_facility_class(ObjectClass *klass, const void *data)
 {
     SysBusDeviceClass *sbdc = SYS_BUS_DEVICE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(sbdc);
@@ -497,7 +497,7 @@ static void event_realize(DeviceState *qdev, Error **errp)
     }
 }
 
-static void event_class_init(ObjectClass *klass, void *data)
+static void event_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c
index ce6f6078d7..716a6b7869 100644
--- a/hw/s390x/ipl.c
+++ b/hw/s390x/ipl.c
@@ -736,7 +736,7 @@ static void s390_ipl_reset(DeviceState *dev)
     }
 }
 
-static void s390_ipl_class_init(ObjectClass *klass, void *data)
+static void s390_ipl_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/s390x/s390-ccw.c b/hw/s390x/s390-ccw.c
index 909475f048..10c81a4c89 100644
--- a/hw/s390x/s390-ccw.c
+++ b/hw/s390x/s390-ccw.c
@@ -175,7 +175,7 @@ static void s390_ccw_instance_init(Object *obj)
                                   "/disk@0,0", DEVICE(obj));
 }
 
-static void s390_ccw_class_init(ObjectClass *klass, void *data)
+static void s390_ccw_class_init(ObjectClass *klass, const void *data)
 {
     S390CCWDeviceClass *cdc = S390_CCW_DEVICE_CLASS(klass);
 
diff --git a/hw/s390x/s390-pci-bus.c b/hw/s390x/s390-pci-bus.c
index 501330bfa7..838b7e6484 100644
--- a/hw/s390x/s390-pci-bus.c
+++ b/hw/s390x/s390-pci-bus.c
@@ -1373,7 +1373,7 @@ static void s390_pcihost_reset(DeviceState *dev)
     pci_for_each_device_under_bus(bus, s390_pci_enumerate_bridge, s);
 }
 
-static void s390_pcihost_class_init(ObjectClass *klass, void *data)
+static void s390_pcihost_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     HotplugHandlerClass *hc = HOTPLUG_HANDLER_CLASS(klass);
@@ -1557,7 +1557,7 @@ static const VMStateDescription s390_pci_device_vmstate = {
     .unmigratable = 1,
 };
 
-static void s390_pci_device_class_init(ObjectClass *klass, void *data)
+static void s390_pci_device_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -1583,7 +1583,8 @@ static const TypeInfo s390_pci_iommu_info = {
     .instance_size = sizeof(S390PCIIOMMU),
 };
 
-static void s390_iommu_memory_region_class_init(ObjectClass *klass, void *data)
+static void s390_iommu_memory_region_class_init(ObjectClass *klass,
+                                                const void *data)
 {
     IOMMUMemoryRegionClass *imrc = IOMMU_MEMORY_REGION_CLASS(klass);
 
diff --git a/hw/s390x/s390-skeys-kvm.c b/hw/s390x/s390-skeys-kvm.c
index 0215e94388..f3056d6d25 100644
--- a/hw/s390x/s390-skeys-kvm.c
+++ b/hw/s390x/s390-skeys-kvm.c
@@ -52,7 +52,7 @@ static int kvm_s390_skeys_set(S390SKeysState *ss, uint64_t start_gfn,
     return kvm_vm_ioctl(kvm_state, KVM_S390_SET_SKEYS, &args);
 }
 
-static void kvm_s390_skeys_class_init(ObjectClass *oc, void *data)
+static void kvm_s390_skeys_class_init(ObjectClass *oc, const void *data)
 {
     S390SKeysClass *skeyclass = S390_SKEYS_CLASS(oc);
     DeviceClass *dc = DEVICE_CLASS(oc);
diff --git a/hw/s390x/s390-skeys.c b/hw/s390x/s390-skeys.c
index d437fe070d..aedb62b2d3 100644
--- a/hw/s390x/s390-skeys.c
+++ b/hw/s390x/s390-skeys.c
@@ -304,7 +304,7 @@ static int qemu_s390_skeys_get(S390SKeysState *ss, uint64_t start_gfn,
     return 0;
 }
 
-static void qemu_s390_skeys_class_init(ObjectClass *oc, void *data)
+static void qemu_s390_skeys_class_init(ObjectClass *oc, const void *data)
 {
     S390SKeysClass *skeyclass = S390_SKEYS_CLASS(oc);
     DeviceClass *dc = DEVICE_CLASS(oc);
@@ -466,7 +466,7 @@ static void s390_skeys_realize(DeviceState *dev, Error **errp)
     register_savevm_live(TYPE_S390_SKEYS, 0, 1, &savevm_s390_storage_keys, ss);
 }
 
-static void s390_skeys_class_init(ObjectClass *oc, void *data)
+static void s390_skeys_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
diff --git a/hw/s390x/s390-stattrib-kvm.c b/hw/s390x/s390-stattrib-kvm.c
index ebcd56368f..e1fee361dc 100644
--- a/hw/s390x/s390-stattrib-kvm.c
+++ b/hw/s390x/s390-stattrib-kvm.c
@@ -188,7 +188,7 @@ static int kvm_s390_stattrib_get_active(S390StAttribState *sa)
     return kvm_s390_cmma_active();
 }
 
-static void kvm_s390_stattrib_class_init(ObjectClass *oc, void *data)
+static void kvm_s390_stattrib_class_init(ObjectClass *oc, const void *data)
 {
     S390StAttribClass *sac = S390_STATTRIB_CLASS(oc);
     DeviceClass *dc = DEVICE_CLASS(oc);
diff --git a/hw/s390x/s390-stattrib.c b/hw/s390x/s390-stattrib.c
index a86002be6a..f74cf32636 100644
--- a/hw/s390x/s390-stattrib.c
+++ b/hw/s390x/s390-stattrib.c
@@ -307,7 +307,7 @@ static int qemu_s390_get_active(S390StAttribState *sa)
     return true;
 }
 
-static void qemu_s390_stattrib_class_init(ObjectClass *oc, void *data)
+static void qemu_s390_stattrib_class_init(ObjectClass *oc, const void *data)
 {
     S390StAttribClass *sa_cl = S390_STATTRIB_CLASS(oc);
     DeviceClass *dc = DEVICE_CLASS(oc);
@@ -360,7 +360,7 @@ static void s390_stattrib_realize(DeviceState *dev, Error **errp)
                          &savevm_s390_stattrib_handlers, dev);
 }
 
-static void s390_stattrib_class_init(ObjectClass *oc, void *data)
+static void s390_stattrib_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
index cf5b9974c5..00e9e46aef 100644
--- a/hw/s390x/s390-virtio-ccw.c
+++ b/hw/s390x/s390-virtio-ccw.c
@@ -804,7 +804,7 @@ static void machine_set_loadparm(Object *obj, Visitor *v,
     s390_ipl_fmt_loadparm(ms->loadparm, val, errp);
 }
 
-static void ccw_machine_class_init(ObjectClass *oc, void *data)
+static void ccw_machine_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     NMIClass *nc = NMI_CLASS(oc);
@@ -892,7 +892,7 @@ static const TypeInfo ccw_machine_info = {
     }                                                                         \
     static void MACHINE_VER_SYM(class_init, ccw, __VA_ARGS__)(                \
         ObjectClass *oc,                                                      \
-        void *data)                                                           \
+        const void *data)                                                     \
     {                                                                         \
         MachineClass *mc = MACHINE_CLASS(oc);                                 \
         MACHINE_VER_SYM(class_options, ccw, __VA_ARGS__)(mc);                 \
diff --git a/hw/s390x/sclp.c b/hw/s390x/sclp.c
index 5945c9b1d8..9718564fa4 100644
--- a/hw/s390x/sclp.c
+++ b/hw/s390x/sclp.c
@@ -424,7 +424,7 @@ static void sclp_init(Object *obj)
     sclp_memory_init(sclp);
 }
 
-static void sclp_class_init(ObjectClass *oc, void *data)
+static void sclp_class_init(ObjectClass *oc, const void *data)
 {
     SCLPDeviceClass *sc = SCLP_CLASS(oc);
     DeviceClass *dc = DEVICE_CLASS(oc);
diff --git a/hw/s390x/sclpcpu.c b/hw/s390x/sclpcpu.c
index a178a9dd4c..4b6ebfed46 100644
--- a/hw/s390x/sclpcpu.c
+++ b/hw/s390x/sclpcpu.c
@@ -73,7 +73,7 @@ static int read_event_data(SCLPEvent *event, EventBufferHeader *evt_buf_hdr,
     return 1;
 }
 
-static void sclp_cpu_class_init(ObjectClass *oc, void *data)
+static void sclp_cpu_class_init(ObjectClass *oc, const void *data)
 {
     SCLPEventClass *k = SCLP_EVENT_CLASS(oc);
     DeviceClass *dc = DEVICE_CLASS(oc);
diff --git a/hw/s390x/sclpquiesce.c b/hw/s390x/sclpquiesce.c
index 7bb5aad520..da4c8f3e36 100644
--- a/hw/s390x/sclpquiesce.c
+++ b/hw/s390x/sclpquiesce.c
@@ -112,7 +112,7 @@ static void quiesce_reset(DeviceState *dev)
    event->event_pending = false;
 }
 
-static void quiesce_class_init(ObjectClass *klass, void *data)
+static void quiesce_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     SCLPEventClass *k = SCLP_EVENT_CLASS(klass);
diff --git a/hw/s390x/tod-kvm.c b/hw/s390x/tod-kvm.c
index 5da9037e0c..c9b8896b63 100644
--- a/hw/s390x/tod-kvm.c
+++ b/hw/s390x/tod-kvm.c
@@ -133,7 +133,7 @@ static void kvm_s390_tod_realize(DeviceState *dev, Error **errp)
     qemu_add_vm_change_state_handler(kvm_s390_tod_vm_state_change, td);
 }
 
-static void kvm_s390_tod_class_init(ObjectClass *oc, void *data)
+static void kvm_s390_tod_class_init(ObjectClass *oc, const void *data)
 {
     S390TODClass *tdc = S390_TOD_CLASS(oc);
 
diff --git a/hw/s390x/tod-tcg.c b/hw/s390x/tod-tcg.c
index 3b3ef8843e..0cc96624e1 100644
--- a/hw/s390x/tod-tcg.c
+++ b/hw/s390x/tod-tcg.c
@@ -52,7 +52,7 @@ static void qemu_s390_tod_set(S390TODState *td, const S390TOD *tod,
     }
 }
 
-static void qemu_s390_tod_class_init(ObjectClass *oc, void *data)
+static void qemu_s390_tod_class_init(ObjectClass *oc, const void *data)
 {
     S390TODClass *tdc = S390_TOD_CLASS(oc);
 
diff --git a/hw/s390x/tod.c b/hw/s390x/tod.c
index 6afbb23fc7..3f913cc88a 100644
--- a/hw/s390x/tod.c
+++ b/hw/s390x/tod.c
@@ -111,7 +111,7 @@ static void s390_tod_realize(DeviceState *dev, Error **errp)
     register_savevm_live("todclock", 0, 1, &savevm_tod, td);
 }
 
-static void s390_tod_class_init(ObjectClass *oc, void *data)
+static void s390_tod_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
diff --git a/hw/s390x/vhost-scsi-ccw.c b/hw/s390x/vhost-scsi-ccw.c
index e6bf0c55bc..8341b23a95 100644
--- a/hw/s390x/vhost-scsi-ccw.c
+++ b/hw/s390x/vhost-scsi-ccw.c
@@ -46,7 +46,7 @@ static const Property vhost_ccw_scsi_properties[] = {
                        VIRTIO_CCW_MAX_REV),
 };
 
-static void vhost_ccw_scsi_class_init(ObjectClass *klass, void *data)
+static void vhost_ccw_scsi_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtIOCCWDeviceClass *k = VIRTIO_CCW_DEVICE_CLASS(klass);
diff --git a/hw/s390x/vhost-user-fs-ccw.c b/hw/s390x/vhost-user-fs-ccw.c
index 6a9654d77b..cc1b8227fc 100644
--- a/hw/s390x/vhost-user-fs-ccw.c
+++ b/hw/s390x/vhost-user-fs-ccw.c
@@ -48,7 +48,7 @@ static void vhost_user_fs_ccw_instance_init(Object *obj)
                                 TYPE_VHOST_USER_FS);
 }
 
-static void vhost_user_fs_ccw_class_init(ObjectClass *klass, void *data)
+static void vhost_user_fs_ccw_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtIOCCWDeviceClass *k = VIRTIO_CCW_DEVICE_CLASS(klass);
diff --git a/hw/s390x/vhost-vsock-ccw.c b/hw/s390x/vhost-vsock-ccw.c
index 875ccf3485..552e9e86a4 100644
--- a/hw/s390x/vhost-vsock-ccw.c
+++ b/hw/s390x/vhost-vsock-ccw.c
@@ -35,7 +35,7 @@ static void vhost_vsock_ccw_realize(VirtioCcwDevice *ccw_dev, Error **errp)
     qdev_realize(vdev, BUS(&ccw_dev->bus), errp);
 }
 
-static void vhost_vsock_ccw_class_init(ObjectClass *klass, void *data)
+static void vhost_vsock_ccw_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtIOCCWDeviceClass *k = VIRTIO_CCW_DEVICE_CLASS(klass);
diff --git a/hw/s390x/virtio-ccw-9p.c b/hw/s390x/virtio-ccw-9p.c
index 287ae2ba76..72bf6ec80c 100644
--- a/hw/s390x/virtio-ccw-9p.c
+++ b/hw/s390x/virtio-ccw-9p.c
@@ -48,7 +48,7 @@ static const Property virtio_ccw_9p_properties[] = {
                        VIRTIO_CCW_MAX_REV),
 };
 
-static void virtio_ccw_9p_class_init(ObjectClass *klass, void *data)
+static void virtio_ccw_9p_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtIOCCWDeviceClass *k = VIRTIO_CCW_DEVICE_CLASS(klass);
diff --git a/hw/s390x/virtio-ccw-balloon.c b/hw/s390x/virtio-ccw-balloon.c
index 1180efaf6d..399b40f366 100644
--- a/hw/s390x/virtio-ccw-balloon.c
+++ b/hw/s390x/virtio-ccw-balloon.c
@@ -53,7 +53,7 @@ static const Property virtio_ccw_balloon_properties[] = {
                        VIRTIO_CCW_MAX_REV),
 };
 
-static void virtio_ccw_balloon_class_init(ObjectClass *klass, void *data)
+static void virtio_ccw_balloon_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtIOCCWDeviceClass *k = VIRTIO_CCW_DEVICE_CLASS(klass);
diff --git a/hw/s390x/virtio-ccw-blk.c b/hw/s390x/virtio-ccw-blk.c
index db9d442ffb..7d8c4a75ce 100644
--- a/hw/s390x/virtio-ccw-blk.c
+++ b/hw/s390x/virtio-ccw-blk.c
@@ -51,7 +51,7 @@ static const Property virtio_ccw_blk_properties[] = {
     DEFINE_PROP_CCW_LOADPARM("loadparm", CcwDevice, loadparm),
 };
 
-static void virtio_ccw_blk_class_init(ObjectClass *klass, void *data)
+static void virtio_ccw_blk_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtIOCCWDeviceClass *k = VIRTIO_CCW_DEVICE_CLASS(klass);
diff --git a/hw/s390x/virtio-ccw-crypto.c b/hw/s390x/virtio-ccw-crypto.c
index b693f87c70..75e714603b 100644
--- a/hw/s390x/virtio-ccw-crypto.c
+++ b/hw/s390x/virtio-ccw-crypto.c
@@ -51,7 +51,7 @@ static const Property virtio_ccw_crypto_properties[] = {
                        VIRTIO_CCW_MAX_REV),
 };
 
-static void virtio_ccw_crypto_class_init(ObjectClass *klass, void *data)
+static void virtio_ccw_crypto_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtIOCCWDeviceClass *k = VIRTIO_CCW_DEVICE_CLASS(klass);
diff --git a/hw/s390x/virtio-ccw-gpu.c b/hw/s390x/virtio-ccw-gpu.c
index a6b14c25d9..edb6a47d37 100644
--- a/hw/s390x/virtio-ccw-gpu.c
+++ b/hw/s390x/virtio-ccw-gpu.c
@@ -49,7 +49,7 @@ static const Property virtio_ccw_gpu_properties[] = {
                        VIRTIO_CCW_MAX_REV),
 };
 
-static void virtio_ccw_gpu_class_init(ObjectClass *klass, void *data)
+static void virtio_ccw_gpu_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtIOCCWDeviceClass *k = VIRTIO_CCW_DEVICE_CLASS(klass);
diff --git a/hw/s390x/virtio-ccw-input.c b/hw/s390x/virtio-ccw-input.c
index 6ca10d58ee..2250d8cf98 100644
--- a/hw/s390x/virtio-ccw-input.c
+++ b/hw/s390x/virtio-ccw-input.c
@@ -50,7 +50,7 @@ static const Property virtio_ccw_input_properties[] = {
                        VIRTIO_CCW_MAX_REV),
 };
 
-static void virtio_ccw_input_class_init(ObjectClass *klass, void *data)
+static void virtio_ccw_input_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtIOCCWDeviceClass *k = VIRTIO_CCW_DEVICE_CLASS(klass);
diff --git a/hw/s390x/virtio-ccw-mem.c b/hw/s390x/virtio-ccw-mem.c
index 90fd89f015..daa485d189 100644
--- a/hw/s390x/virtio-ccw-mem.c
+++ b/hw/s390x/virtio-ccw-mem.c
@@ -160,7 +160,7 @@ static const Property virtio_ccw_mem_properties[] = {
                        VIRTIO_CCW_MAX_REV),
 };
 
-static void virtio_ccw_mem_class_init(ObjectClass *klass, void *data)
+static void virtio_ccw_mem_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtIOCCWDeviceClass *k = VIRTIO_CCW_DEVICE_CLASS(klass);
diff --git a/hw/s390x/virtio-ccw-net.c b/hw/s390x/virtio-ccw-net.c
index 80a5581baf..a7d4afbeb9 100644
--- a/hw/s390x/virtio-ccw-net.c
+++ b/hw/s390x/virtio-ccw-net.c
@@ -54,7 +54,7 @@ static const Property virtio_ccw_net_properties[] = {
     DEFINE_PROP_CCW_LOADPARM("loadparm", CcwDevice, loadparm),
 };
 
-static void virtio_ccw_net_class_init(ObjectClass *klass, void *data)
+static void virtio_ccw_net_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtIOCCWDeviceClass *k = VIRTIO_CCW_DEVICE_CLASS(klass);
diff --git a/hw/s390x/virtio-ccw-rng.c b/hw/s390x/virtio-ccw-rng.c
index ccd124ee91..3263287d45 100644
--- a/hw/s390x/virtio-ccw-rng.c
+++ b/hw/s390x/virtio-ccw-rng.c
@@ -50,7 +50,7 @@ static const Property virtio_ccw_rng_properties[] = {
                        VIRTIO_CCW_MAX_REV),
 };
 
-static void virtio_ccw_rng_class_init(ObjectClass *klass, void *data)
+static void virtio_ccw_rng_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtIOCCWDeviceClass *k = VIRTIO_CCW_DEVICE_CLASS(klass);
diff --git a/hw/s390x/virtio-ccw-scsi.c b/hw/s390x/virtio-ccw-scsi.c
index bfcea3cfe7..06b4c6c4a5 100644
--- a/hw/s390x/virtio-ccw-scsi.c
+++ b/hw/s390x/virtio-ccw-scsi.c
@@ -60,7 +60,7 @@ static const Property virtio_ccw_scsi_properties[] = {
                        VIRTIO_CCW_MAX_REV),
 };
 
-static void virtio_ccw_scsi_class_init(ObjectClass *klass, void *data)
+static void virtio_ccw_scsi_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtIOCCWDeviceClass *k = VIRTIO_CCW_DEVICE_CLASS(klass);
diff --git a/hw/s390x/virtio-ccw-serial.c b/hw/s390x/virtio-ccw-serial.c
index 59743d1e25..0dac590c08 100644
--- a/hw/s390x/virtio-ccw-serial.c
+++ b/hw/s390x/virtio-ccw-serial.c
@@ -60,7 +60,7 @@ static const Property virtio_ccw_serial_properties[] = {
                        VIRTIO_CCW_MAX_REV),
 };
 
-static void virtio_ccw_serial_class_init(ObjectClass *klass, void *data)
+static void virtio_ccw_serial_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtIOCCWDeviceClass *k = VIRTIO_CCW_DEVICE_CLASS(klass);
diff --git a/hw/s390x/virtio-ccw.c b/hw/s390x/virtio-ccw.c
index e8ecb90826..d2f85b39f3 100644
--- a/hw/s390x/virtio-ccw.c
+++ b/hw/s390x/virtio-ccw.c
@@ -1228,7 +1228,7 @@ static void virtio_ccw_busdev_unplug(HotplugHandler *hotplug_dev,
     virtio_ccw_stop_ioeventfd(_dev);
 }
 
-static void virtio_ccw_device_class_init(ObjectClass *klass, void *data)
+static void virtio_ccw_device_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     CCWDeviceClass *k = CCW_DEVICE_CLASS(dc);
@@ -1262,7 +1262,7 @@ static void virtio_ccw_bus_new(VirtioBusState *bus, size_t bus_size,
     qbus_init(bus, bus_size, TYPE_VIRTIO_CCW_BUS, qdev, virtio_bus_name);
 }
 
-static void virtio_ccw_bus_class_init(ObjectClass *klass, void *data)
+static void virtio_ccw_bus_class_init(ObjectClass *klass, const void *data)
 {
     VirtioBusClass *k = VIRTIO_BUS_CLASS(klass);
     BusClass *bus_class = BUS_CLASS(klass);
diff --git a/hw/scsi/esp-pci.c b/hw/scsi/esp-pci.c
index fe4e045a6f..74e9af0b5d 100644
--- a/hw/scsi/esp-pci.c
+++ b/hw/scsi/esp-pci.c
@@ -427,7 +427,7 @@ static void esp_pci_init(Object *obj)
     object_initialize_child(obj, "esp", &pci->esp, TYPE_ESP);
 }
 
-static void esp_pci_class_init(ObjectClass *klass, void *data)
+static void esp_pci_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
@@ -557,7 +557,7 @@ static void dc390_scsi_realize(PCIDevice *dev, Error **errp)
     contents[EE_CHKSUM2] = chksum >> 8;
 }
 
-static void dc390_class_init(ObjectClass *klass, void *data)
+static void dc390_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
diff --git a/hw/scsi/esp.c b/hw/scsi/esp.c
index 01bdfe2701..f24991fd16 100644
--- a/hw/scsi/esp.c
+++ b/hw/scsi/esp.c
@@ -1568,7 +1568,7 @@ static const VMStateDescription vmstate_sysbus_esp_scsi = {
     }
 };
 
-static void sysbus_esp_class_init(ObjectClass *klass, void *data)
+static void sysbus_esp_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -1594,7 +1594,7 @@ static void esp_init(Object *obj)
     fifo8_create(&s->cmdfifo, ESP_CMDFIFO_SZ);
 }
 
-static void esp_class_init(ObjectClass *klass, void *data)
+static void esp_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/scsi/lsi53c895a.c b/hw/scsi/lsi53c895a.c
index 6689ebba25..0ad61565bf 100644
--- a/hw/scsi/lsi53c895a.c
+++ b/hw/scsi/lsi53c895a.c
@@ -2375,7 +2375,7 @@ static void lsi_scsi_exit(PCIDevice *dev)
     timer_free(s->scripts_timer);
 }
 
-static void lsi_class_init(ObjectClass *klass, void *data)
+static void lsi_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
@@ -2402,7 +2402,7 @@ static const TypeInfo lsi_info = {
     },
 };
 
-static void lsi53c810_class_init(ObjectClass *klass, void *data)
+static void lsi53c810_class_init(ObjectClass *klass, const void *data)
 {
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
 
diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c
index d56bfc711d..ffcabd5a8e 100644
--- a/hw/scsi/megasas.c
+++ b/hw/scsi/megasas.c
@@ -2527,7 +2527,7 @@ static struct MegasasInfo megasas_devices[] = {
     }
 };
 
-static void megasas_class_init(ObjectClass *oc, void *data)
+static void megasas_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     PCIDeviceClass *pc = PCI_DEVICE_CLASS(oc);
diff --git a/hw/scsi/mptsas.c b/hw/scsi/mptsas.c
index ba7a7d0770..17f73ce381 100644
--- a/hw/scsi/mptsas.c
+++ b/hw/scsi/mptsas.c
@@ -1416,7 +1416,7 @@ static const Property mptsas_properties[] = {
     DEFINE_PROP_ON_OFF_AUTO("msi", MPTSASState, msi, ON_OFF_AUTO_AUTO),
 };
 
-static void mptsas1068_class_init(ObjectClass *oc, void *data)
+static void mptsas1068_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     PCIDeviceClass *pc = PCI_DEVICE_CLASS(oc);
diff --git a/hw/scsi/scsi-bus.c b/hw/scsi/scsi-bus.c
index ece1107ee8..0456b4de0a 100644
--- a/hw/scsi/scsi-bus.c
+++ b/hw/scsi/scsi-bus.c
@@ -2001,7 +2001,7 @@ static const Property scsi_props[] = {
     DEFINE_PROP_UINT32("lun", SCSIDevice, lun, -1),
 };
 
-static void scsi_device_class_init(ObjectClass *klass, void *data)
+static void scsi_device_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *k = DEVICE_CLASS(klass);
     set_bit(DEVICE_CATEGORY_STORAGE, k->categories);
@@ -2030,7 +2030,7 @@ static const TypeInfo scsi_device_type_info = {
     .instance_init = scsi_dev_instance_init,
 };
 
-static void scsi_bus_class_init(ObjectClass *klass, void *data)
+static void scsi_bus_class_init(ObjectClass *klass, const void *data)
 {
     BusClass *k = BUS_CLASS(klass);
     HotplugHandlerClass *hc = HOTPLUG_HANDLER_CLASS(klass);
diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c
index e59632e9b1..cb4af1b715 100644
--- a/hw/scsi/scsi-disk.c
+++ b/hw/scsi/scsi-disk.c
@@ -3177,7 +3177,7 @@ static void scsi_property_add_specifics(DeviceClass *dc)
     }
 }
 
-static void scsi_disk_base_class_initfn(ObjectClass *klass, void *data)
+static void scsi_disk_base_class_initfn(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     SCSIDiskClass *sdc = SCSI_DISK_BASE_CLASS(klass);
@@ -3247,7 +3247,7 @@ static const VMStateDescription vmstate_scsi_disk_state = {
     }
 };
 
-static void scsi_hd_class_initfn(ObjectClass *klass, void *data)
+static void scsi_hd_class_initfn(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     SCSIDeviceClass *sc = SCSI_DEVICE_CLASS(klass);
@@ -3289,7 +3289,7 @@ static const Property scsi_cd_properties[] = {
                     SCSI_DISK_QUIRK_MODE_PAGE_TRUNCATED, 0),
 };
 
-static void scsi_cd_class_initfn(ObjectClass *klass, void *data)
+static void scsi_cd_class_initfn(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     SCSIDeviceClass *sc = SCSI_DEVICE_CLASS(klass);
@@ -3326,7 +3326,7 @@ static const Property scsi_block_properties[] = {
                        DEFAULT_IO_TIMEOUT),
 };
 
-static void scsi_block_class_initfn(ObjectClass *klass, void *data)
+static void scsi_block_class_initfn(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     SCSIDeviceClass *sc = SCSI_DEVICE_CLASS(klass);
diff --git a/hw/scsi/scsi-generic.c b/hw/scsi/scsi-generic.c
index 6566720064..9e380a2109 100644
--- a/hw/scsi/scsi-generic.c
+++ b/hw/scsi/scsi-generic.c
@@ -786,7 +786,7 @@ static int scsi_generic_parse_cdb(SCSIDevice *dev, SCSICommand *cmd,
     return scsi_bus_parse_cdb(dev, cmd, buf, buf_len, hba_private);
 }
 
-static void scsi_generic_class_initfn(ObjectClass *klass, void *data)
+static void scsi_generic_class_initfn(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     SCSIDeviceClass *sc = SCSI_DEVICE_CLASS(klass);
diff --git a/hw/scsi/spapr_vscsi.c b/hw/scsi/spapr_vscsi.c
index 6962194eaa..20f70fb272 100644
--- a/hw/scsi/spapr_vscsi.c
+++ b/hw/scsi/spapr_vscsi.c
@@ -1267,7 +1267,7 @@ static const VMStateDescription vmstate_spapr_vscsi = {
     },
 };
 
-static void spapr_vscsi_class_init(ObjectClass *klass, void *data)
+static void spapr_vscsi_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     SpaprVioDeviceClass *k = VIO_SPAPR_DEVICE_CLASS(klass);
diff --git a/hw/scsi/vhost-scsi.c b/hw/scsi/vhost-scsi.c
index 66e0c21c22..be5a416c1d 100644
--- a/hw/scsi/vhost-scsi.c
+++ b/hw/scsi/vhost-scsi.c
@@ -363,7 +363,7 @@ static const Property vhost_scsi_properties[] = {
                      conf.worker_per_virtqueue, false),
 };
 
-static void vhost_scsi_class_init(ObjectClass *klass, void *data)
+static void vhost_scsi_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
diff --git a/hw/scsi/vhost-user-scsi.c b/hw/scsi/vhost-user-scsi.c
index adb41b9816..807a58ecf4 100644
--- a/hw/scsi/vhost-user-scsi.c
+++ b/hw/scsi/vhost-user-scsi.c
@@ -386,7 +386,7 @@ static const VMStateDescription vmstate_vhost_scsi = {
     },
 };
 
-static void vhost_user_scsi_class_init(ObjectClass *klass, void *data)
+static void vhost_user_scsi_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c
index f5a3aa2366..ae67a7682a 100644
--- a/hw/scsi/virtio-scsi.c
+++ b/hw/scsi/virtio-scsi.c
@@ -1395,7 +1395,7 @@ static const VMStateDescription vmstate_virtio_scsi = {
     },
 };
 
-static void virtio_scsi_common_class_init(ObjectClass *klass, void *data)
+static void virtio_scsi_common_class_init(ObjectClass *klass, const void *data)
 {
     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -1404,7 +1404,7 @@ static void virtio_scsi_common_class_init(ObjectClass *klass, void *data)
     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
 }
 
-static void virtio_scsi_class_init(ObjectClass *klass, void *data)
+static void virtio_scsi_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
diff --git a/hw/scsi/vmw_pvscsi.c b/hw/scsi/vmw_pvscsi.c
index f07e377cb8..a8ea57ffad 100644
--- a/hw/scsi/vmw_pvscsi.c
+++ b/hw/scsi/vmw_pvscsi.c
@@ -1317,7 +1317,7 @@ static void pvscsi_realize(DeviceState *qdev, Error **errp)
     pvs_c->parent_dc_realize(qdev, errp);
 }
 
-static void pvscsi_class_init(ObjectClass *klass, void *data)
+static void pvscsi_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
diff --git a/hw/sd/allwinner-sdhost.c b/hw/sd/allwinner-sdhost.c
index 03980d2716..b31da5c399 100644
--- a/hw/sd/allwinner-sdhost.c
+++ b/hw/sd/allwinner-sdhost.c
@@ -888,14 +888,15 @@ static void allwinner_sdhost_reset(DeviceState *dev)
     }
 }
 
-static void allwinner_sdhost_bus_class_init(ObjectClass *klass, void *data)
+static void allwinner_sdhost_bus_class_init(ObjectClass *klass,
+                                            const void *data)
 {
     SDBusClass *sbc = SD_BUS_CLASS(klass);
 
     sbc->set_inserted = allwinner_sdhost_set_inserted;
 }
 
-static void allwinner_sdhost_class_init(ObjectClass *klass, void *data)
+static void allwinner_sdhost_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -905,7 +906,8 @@ static void allwinner_sdhost_class_init(ObjectClass *klass, void *data)
     device_class_set_props(dc, allwinner_sdhost_properties);
 }
 
-static void allwinner_sdhost_sun4i_class_init(ObjectClass *klass, void *data)
+static void allwinner_sdhost_sun4i_class_init(ObjectClass *klass,
+                                              const void *data)
 {
     AwSdHostClass *sc = AW_SDHOST_CLASS(klass);
     sc->max_desc_size = 8 * KiB;
@@ -913,7 +915,8 @@ static void allwinner_sdhost_sun4i_class_init(ObjectClass *klass, void *data)
     sc->can_calibrate = false;
 }
 
-static void allwinner_sdhost_sun5i_class_init(ObjectClass *klass, void *data)
+static void allwinner_sdhost_sun5i_class_init(ObjectClass *klass,
+                                              const void *data)
 {
     AwSdHostClass *sc = AW_SDHOST_CLASS(klass);
     sc->max_desc_size = 64 * KiB;
@@ -922,7 +925,7 @@ static void allwinner_sdhost_sun5i_class_init(ObjectClass *klass, void *data)
 }
 
 static void allwinner_sdhost_sun50i_a64_class_init(ObjectClass *klass,
-                                                   void *data)
+                                                   const void *data)
 {
     AwSdHostClass *sc = AW_SDHOST_CLASS(klass);
     sc->max_desc_size = 64 * KiB;
@@ -931,7 +934,7 @@ static void allwinner_sdhost_sun50i_a64_class_init(ObjectClass *klass,
 }
 
 static void allwinner_sdhost_sun50i_a64_emmc_class_init(ObjectClass *klass,
-                                                        void *data)
+                                                        const void *data)
 {
     AwSdHostClass *sc = AW_SDHOST_CLASS(klass);
     sc->max_desc_size = 8 * KiB;
diff --git a/hw/sd/aspeed_sdhci.c b/hw/sd/aspeed_sdhci.c
index 12cbbae5e7..fc38ad39ce 100644
--- a/hw/sd/aspeed_sdhci.c
+++ b/hw/sd/aspeed_sdhci.c
@@ -208,7 +208,7 @@ static const Property aspeed_sdhci_properties[] = {
     DEFINE_PROP_UINT8("num-slots", AspeedSDHCIState, num_slots, 0),
 };
 
-static void aspeed_sdhci_class_init(ObjectClass *classp, void *data)
+static void aspeed_sdhci_class_init(ObjectClass *classp, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(classp);
 
@@ -218,7 +218,7 @@ static void aspeed_sdhci_class_init(ObjectClass *classp, void *data)
     device_class_set_props(dc, aspeed_sdhci_properties);
 }
 
-static void aspeed_2400_sdhci_class_init(ObjectClass *klass, void *data)
+static void aspeed_2400_sdhci_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     AspeedSDHCIClass *asc = ASPEED_SDHCI_CLASS(klass);
@@ -227,7 +227,7 @@ static void aspeed_2400_sdhci_class_init(ObjectClass *klass, void *data)
     asc->capareg = 0x0000000001e80080;
 }
 
-static void aspeed_2500_sdhci_class_init(ObjectClass *klass, void *data)
+static void aspeed_2500_sdhci_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     AspeedSDHCIClass *asc = ASPEED_SDHCI_CLASS(klass);
@@ -236,7 +236,7 @@ static void aspeed_2500_sdhci_class_init(ObjectClass *klass, void *data)
     asc->capareg = 0x0000000001e80080;
 }
 
-static void aspeed_2600_sdhci_class_init(ObjectClass *klass, void *data)
+static void aspeed_2600_sdhci_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     AspeedSDHCIClass *asc = ASPEED_SDHCI_CLASS(klass);
@@ -245,7 +245,7 @@ static void aspeed_2600_sdhci_class_init(ObjectClass *klass, void *data)
     asc->capareg = 0x0000000701f80080;
 }
 
-static void aspeed_2700_sdhci_class_init(ObjectClass *klass, void *data)
+static void aspeed_2700_sdhci_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     AspeedSDHCIClass *asc = ASPEED_SDHCI_CLASS(klass);
diff --git a/hw/sd/bcm2835_sdhost.c b/hw/sd/bcm2835_sdhost.c
index 0724949d0c..29debdf59e 100644
--- a/hw/sd/bcm2835_sdhost.c
+++ b/hw/sd/bcm2835_sdhost.c
@@ -428,7 +428,7 @@ static void bcm2835_sdhost_reset(DeviceState *dev)
     s->fifo_len = 0;
 }
 
-static void bcm2835_sdhost_class_init(ObjectClass *klass, void *data)
+static void bcm2835_sdhost_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/sd/cadence_sdhci.c b/hw/sd/cadence_sdhci.c
index ad9daa20ed..d576855a1a 100644
--- a/hw/sd/cadence_sdhci.c
+++ b/hw/sd/cadence_sdhci.c
@@ -165,7 +165,7 @@ static const VMStateDescription vmstate_cadence_sdhci = {
     },
 };
 
-static void cadence_sdhci_class_init(ObjectClass *classp, void *data)
+static void cadence_sdhci_class_init(ObjectClass *classp, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(classp);
 
diff --git a/hw/sd/npcm7xx_sdhci.c b/hw/sd/npcm7xx_sdhci.c
index 99028c1a2c..0233d7bd4d 100644
--- a/hw/sd/npcm7xx_sdhci.c
+++ b/hw/sd/npcm7xx_sdhci.c
@@ -149,7 +149,7 @@ static const VMStateDescription vmstate_npcm7xx_sdhci = {
     },
 };
 
-static void npcm7xx_sdhci_class_init(ObjectClass *classp, void *data)
+static void npcm7xx_sdhci_class_init(ObjectClass *classp, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(classp);
 
diff --git a/hw/sd/omap_mmc.c b/hw/sd/omap_mmc.c
index bbe7b971bb..b7648d41cc 100644
--- a/hw/sd/omap_mmc.c
+++ b/hw/sd/omap_mmc.c
@@ -612,7 +612,7 @@ static void omap_mmc_initfn(Object *obj)
     qbus_init(&s->sdbus, sizeof(s->sdbus), TYPE_SD_BUS, DEVICE(obj), "sd-bus");
 }
 
-static void omap_mmc_class_init(ObjectClass *oc, void *data)
+static void omap_mmc_class_init(ObjectClass *oc, const void *data)
 {
     ResettableClass *rc = RESETTABLE_CLASS(oc);
 
diff --git a/hw/sd/pl181.c b/hw/sd/pl181.c
index 03d2ae7d21..b8fc9f86f1 100644
--- a/hw/sd/pl181.c
+++ b/hw/sd/pl181.c
@@ -509,7 +509,7 @@ static void pl181_init(Object *obj)
     qbus_init(&s->sdbus, sizeof(s->sdbus), TYPE_PL181_BUS, dev, "sd-bus");
 }
 
-static void pl181_class_init(ObjectClass *klass, void *data)
+static void pl181_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *k = DEVICE_CLASS(klass);
 
@@ -519,7 +519,7 @@ static void pl181_class_init(ObjectClass *klass, void *data)
     k->user_creatable = false;
 }
 
-static void pl181_bus_class_init(ObjectClass *klass, void *data)
+static void pl181_bus_class_init(ObjectClass *klass, const void *data)
 {
     SDBusClass *sbc = SD_BUS_CLASS(klass);
 
diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index e541c57f8c..c275fdda2d 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -2751,7 +2751,7 @@ static const Property emmc_properties[] = {
     DEFINE_PROP_UINT8("boot-config", SDState, boot_config, 0x0),
 };
 
-static void sdmmc_common_class_init(ObjectClass *klass, void *data)
+static void sdmmc_common_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     SDCardClass *sc = SDMMC_COMMON_CLASS(klass);
@@ -2774,7 +2774,7 @@ static void sdmmc_common_class_init(ObjectClass *klass, void *data)
     sc->get_readonly = sd_get_readonly;
 }
 
-static void sd_class_init(ObjectClass *klass, void *data)
+static void sd_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     SDCardClass *sc = SDMMC_COMMON_CLASS(klass);
@@ -2793,7 +2793,7 @@ static void sd_class_init(ObjectClass *klass, void *data)
  * board to ensure that ssi transfers only occur when the chip select
  * is asserted.
  */
-static void sd_spi_class_init(ObjectClass *klass, void *data)
+static void sd_spi_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     SDCardClass *sc = SDMMC_COMMON_CLASS(klass);
@@ -2802,7 +2802,7 @@ static void sd_spi_class_init(ObjectClass *klass, void *data)
     sc->proto = &sd_proto_spi;
 }
 
-static void emmc_class_init(ObjectClass *klass, void *data)
+static void emmc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     SDCardClass *sc = SDMMC_COMMON_CLASS(klass);
diff --git a/hw/sd/sdhci-pci.c b/hw/sd/sdhci-pci.c
index bca149e811..2a56fbf2cd 100644
--- a/hw/sd/sdhci-pci.c
+++ b/hw/sd/sdhci-pci.c
@@ -54,7 +54,7 @@ static void sdhci_pci_exit(PCIDevice *dev)
     sdhci_uninitfn(s);
 }
 
-static void sdhci_pci_class_init(ObjectClass *klass, void *data)
+static void sdhci_pci_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
index 69baf73ae9..226ff133ff 100644
--- a/hw/sd/sdhci.c
+++ b/hw/sd/sdhci.c
@@ -1620,7 +1620,7 @@ static void sdhci_sysbus_unrealize(DeviceState *dev)
     }
 }
 
-static void sdhci_sysbus_class_init(ObjectClass *klass, void *data)
+static void sdhci_sysbus_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -1633,7 +1633,7 @@ static void sdhci_sysbus_class_init(ObjectClass *klass, void *data)
 
 /* --- qdev bus master --- */
 
-static void sdhci_bus_class_init(ObjectClass *klass, void *data)
+static void sdhci_bus_class_init(ObjectClass *klass, const void *data)
 {
     SDBusClass *sbc = SD_BUS_CLASS(klass);
 
diff --git a/hw/sd/ssi-sd.c b/hw/sd/ssi-sd.c
index c4a58da0ab..6c90a86ab4 100644
--- a/hw/sd/ssi-sd.c
+++ b/hw/sd/ssi-sd.c
@@ -389,7 +389,7 @@ static void ssi_sd_reset(DeviceState *dev)
     s->stopping = 0;
 }
 
-static void ssi_sd_class_init(ObjectClass *klass, void *data)
+static void ssi_sd_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     SSIPeripheralClass *k = SSI_PERIPHERAL_CLASS(klass);
diff --git a/hw/sensor/adm1266.c b/hw/sensor/adm1266.c
index 25b87a7296..9017ce6116 100644
--- a/hw/sensor/adm1266.c
+++ b/hw/sensor/adm1266.c
@@ -223,7 +223,7 @@ static void adm1266_init(Object *obj)
     }
 }
 
-static void adm1266_class_init(ObjectClass *klass, void *data)
+static void adm1266_class_init(ObjectClass *klass, const void *data)
 {
     ResettableClass *rc = RESETTABLE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
diff --git a/hw/sensor/adm1272.c b/hw/sensor/adm1272.c
index 3fc1e5d0ad..0c739aa0d8 100644
--- a/hw/sensor/adm1272.c
+++ b/hw/sensor/adm1272.c
@@ -511,7 +511,7 @@ static void adm1272_init(Object *obj)
 
 }
 
-static void adm1272_class_init(ObjectClass *klass, void *data)
+static void adm1272_class_init(ObjectClass *klass, const void *data)
 {
     ResettableClass *rc = RESETTABLE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
diff --git a/hw/sensor/dps310.c b/hw/sensor/dps310.c
index 6966a53248..bcf615423a 100644
--- a/hw/sensor/dps310.c
+++ b/hw/sensor/dps310.c
@@ -197,7 +197,7 @@ static const VMStateDescription vmstate_dps310 = {
     }
 };
 
-static void dps310_class_init(ObjectClass *klass, void *data)
+static void dps310_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     I2CSlaveClass *k = I2C_SLAVE_CLASS(klass);
diff --git a/hw/sensor/emc141x.c b/hw/sensor/emc141x.c
index 33c1bd330f..7b2ce383a1 100644
--- a/hw/sensor/emc141x.c
+++ b/hw/sensor/emc141x.c
@@ -277,7 +277,7 @@ static void emc141x_class_init(ObjectClass *klass, const void *data)
     dc->vmsd = &vmstate_emc141x;
 }
 
-static void emc1413_class_init(ObjectClass *klass, void *data)
+static void emc1413_class_init(ObjectClass *klass, const void *data)
 {
     EMC141XClass *ec = EMC141X_CLASS(klass);
 
@@ -286,7 +286,7 @@ static void emc1413_class_init(ObjectClass *klass, void *data)
     ec->sensors_count = 3;
 }
 
-static void emc1414_class_init(ObjectClass *klass, void *data)
+static void emc1414_class_init(ObjectClass *klass, const void *data)
 {
     EMC141XClass *ec = EMC141X_CLASS(klass);
 
diff --git a/hw/sensor/isl_pmbus_vr.c b/hw/sensor/isl_pmbus_vr.c
index c60282cfe7..e8d29b08ff 100644
--- a/hw/sensor/isl_pmbus_vr.c
+++ b/hw/sensor/isl_pmbus_vr.c
@@ -242,7 +242,7 @@ static void isl_pmbus_vr_class_init(ObjectClass *klass, const void *data,
     k->device_num_pages = pages;
 }
 
-static void isl69260_class_init(ObjectClass *klass, void *data)
+static void isl69260_class_init(ObjectClass *klass, const void *data)
 {
     ResettableClass *rc = RESETTABLE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -251,7 +251,7 @@ static void isl69260_class_init(ObjectClass *klass, void *data)
     isl_pmbus_vr_class_init(klass, data, 2);
 }
 
-static void raa228000_class_init(ObjectClass *klass, void *data)
+static void raa228000_class_init(ObjectClass *klass, const void *data)
 {
     ResettableClass *rc = RESETTABLE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -260,7 +260,7 @@ static void raa228000_class_init(ObjectClass *klass, void *data)
     isl_pmbus_vr_class_init(klass, data, 1);
 }
 
-static void raa229004_class_init(ObjectClass *klass, void *data)
+static void raa229004_class_init(ObjectClass *klass, const void *data)
 {
     ResettableClass *rc = RESETTABLE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -269,7 +269,7 @@ static void raa229004_class_init(ObjectClass *klass, void *data)
     isl_pmbus_vr_class_init(klass, data, 2);
 }
 
-static void isl69259_class_init(ObjectClass *klass, void *data)
+static void isl69259_class_init(ObjectClass *klass, const void *data)
 {
     ResettableClass *rc = RESETTABLE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
diff --git a/hw/sensor/lsm303dlhc_mag.c b/hw/sensor/lsm303dlhc_mag.c
index 04471539b5..f9e501da84 100644
--- a/hw/sensor/lsm303dlhc_mag.c
+++ b/hw/sensor/lsm303dlhc_mag.c
@@ -530,7 +530,7 @@ static void lsm303dlhc_mag_initfn(Object *obj)
 /*
  * Set the virtual method pointers (bus state change, tx/rx, etc.).
  */
-static void lsm303dlhc_mag_class_init(ObjectClass *klass, void *data)
+static void lsm303dlhc_mag_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     I2CSlaveClass *k = I2C_SLAVE_CLASS(klass);
diff --git a/hw/sensor/max31785.c b/hw/sensor/max31785.c
index 3577a7c218..c75581455a 100644
--- a/hw/sensor/max31785.c
+++ b/hw/sensor/max31785.c
@@ -544,7 +544,7 @@ static void max31785_init(Object *obj)
     }
 }
 
-static void max31785_class_init(ObjectClass *klass, void *data)
+static void max31785_class_init(ObjectClass *klass, const void *data)
 {
     ResettableClass *rc = RESETTABLE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
diff --git a/hw/sensor/max34451.c b/hw/sensor/max34451.c
index 93b53f3db2..a369d2b531 100644
--- a/hw/sensor/max34451.c
+++ b/hw/sensor/max34451.c
@@ -746,7 +746,7 @@ static void max34451_init(Object *obj)
 
 }
 
-static void max34451_class_init(ObjectClass *klass, void *data)
+static void max34451_class_init(ObjectClass *klass, const void *data)
 {
     ResettableClass *rc = RESETTABLE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
diff --git a/hw/sensor/tmp105.c b/hw/sensor/tmp105.c
index ef2824f3e1..f5b61109e3 100644
--- a/hw/sensor/tmp105.c
+++ b/hw/sensor/tmp105.c
@@ -313,7 +313,7 @@ static void tmp105_initfn(Object *obj)
                         tmp105_set_temperature, NULL, NULL);
 }
 
-static void tmp105_class_init(ObjectClass *klass, void *data)
+static void tmp105_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     I2CSlaveClass *k = I2C_SLAVE_CLASS(klass);
diff --git a/hw/sensor/tmp421.c b/hw/sensor/tmp421.c
index 007f7cd018..263bfa1bbd 100644
--- a/hw/sensor/tmp421.c
+++ b/hw/sensor/tmp421.c
@@ -337,7 +337,7 @@ static void tmp421_realize(DeviceState *dev, Error **errp)
     tmp421_reset(&s->i2c);
 }
 
-static void tmp421_class_init(ObjectClass *klass, void *data)
+static void tmp421_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     I2CSlaveClass *k = I2C_SLAVE_CLASS(klass);
diff --git a/hw/sparc/sun4m.c b/hw/sparc/sun4m.c
index edbf19d958..8ac7e625ef 100644
--- a/hw/sparc/sun4m.c
+++ b/hw/sparc/sun4m.c
@@ -595,7 +595,7 @@ static void idreg_realize(DeviceState *ds, Error **errp)
     sysbus_init_mmio(dev, &s->mem);
 }
 
-static void idreg_class_init(ObjectClass *oc, void *data)
+static void idreg_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
@@ -645,7 +645,7 @@ static void afx_realize(DeviceState *ds, Error **errp)
     sysbus_init_mmio(dev, &s->mem);
 }
 
-static void afx_class_init(ObjectClass *oc, void *data)
+static void afx_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
@@ -727,7 +727,7 @@ static void prom_realize(DeviceState *ds, Error **errp)
     sysbus_init_mmio(dev, &s->prom);
 }
 
-static void prom_class_init(ObjectClass *klass, void *data)
+static void prom_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -771,7 +771,7 @@ static void ram_initfn(Object *obj)
                                     "Valid value is ID of a hostmem backend");
 }
 
-static void ram_class_init(ObjectClass *klass, void *data)
+static void ram_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -1098,7 +1098,7 @@ enum {
     ss600mp_id,
 };
 
-static void sun4m_machine_class_init(ObjectClass *oc, void *data)
+static void sun4m_machine_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
 
@@ -1109,7 +1109,7 @@ static void sun4m_machine_class_init(ObjectClass *oc, void *data)
     mc->default_ram_id = "sun4m.ram";
 }
 
-static void ss5_class_init(ObjectClass *oc, void *data)
+static void ss5_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     Sun4mMachineClass *smc = SUN4M_MACHINE_CLASS(mc);
@@ -1146,7 +1146,7 @@ static void ss5_class_init(ObjectClass *oc, void *data)
     smc->hwdef = &ss5_hwdef;
 }
 
-static void ss10_class_init(ObjectClass *oc, void *data)
+static void ss10_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     Sun4mMachineClass *smc = SUN4M_MACHINE_CLASS(mc);
@@ -1181,7 +1181,7 @@ static void ss10_class_init(ObjectClass *oc, void *data)
     smc->hwdef = &ss10_hwdef;
 }
 
-static void ss600mp_class_init(ObjectClass *oc, void *data)
+static void ss600mp_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     Sun4mMachineClass *smc = SUN4M_MACHINE_CLASS(mc);
@@ -1214,7 +1214,7 @@ static void ss600mp_class_init(ObjectClass *oc, void *data)
     smc->hwdef = &ss600mp_hwdef;
 }
 
-static void ss20_class_init(ObjectClass *oc, void *data)
+static void ss20_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     Sun4mMachineClass *smc = SUN4M_MACHINE_CLASS(mc);
@@ -1265,7 +1265,7 @@ static void ss20_class_init(ObjectClass *oc, void *data)
     smc->hwdef = &ss20_hwdef;
 }
 
-static void voyager_class_init(ObjectClass *oc, void *data)
+static void voyager_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     Sun4mMachineClass *smc = SUN4M_MACHINE_CLASS(mc);
@@ -1297,7 +1297,7 @@ static void voyager_class_init(ObjectClass *oc, void *data)
     smc->hwdef = &voyager_hwdef;
 }
 
-static void ss_lx_class_init(ObjectClass *oc, void *data)
+static void ss_lx_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     Sun4mMachineClass *smc = SUN4M_MACHINE_CLASS(mc);
@@ -1330,7 +1330,7 @@ static void ss_lx_class_init(ObjectClass *oc, void *data)
     smc->hwdef = &ss_lx_hwdef;
 }
 
-static void ss4_class_init(ObjectClass *oc, void *data)
+static void ss4_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     Sun4mMachineClass *smc = SUN4M_MACHINE_CLASS(mc);
@@ -1363,7 +1363,7 @@ static void ss4_class_init(ObjectClass *oc, void *data)
     smc->hwdef = &ss4_hwdef;
 }
 
-static void scls_class_init(ObjectClass *oc, void *data)
+static void scls_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     Sun4mMachineClass *smc = SUN4M_MACHINE_CLASS(mc);
@@ -1395,7 +1395,7 @@ static void scls_class_init(ObjectClass *oc, void *data)
     smc->hwdef = &scls_hwdef;
 }
 
-static void sbook_class_init(ObjectClass *oc, void *data)
+static void sbook_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     Sun4mMachineClass *smc = SUN4M_MACHINE_CLASS(mc);
diff --git a/hw/sparc/sun4m_iommu.c b/hw/sparc/sun4m_iommu.c
index 4a542b18d2..a7ff36ee78 100644
--- a/hw/sparc/sun4m_iommu.c
+++ b/hw/sparc/sun4m_iommu.c
@@ -372,7 +372,7 @@ static const Property iommu_properties[] = {
     DEFINE_PROP_UINT32("version", IOMMUState, version, 0),
 };
 
-static void iommu_class_init(ObjectClass *klass, void *data)
+static void iommu_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -389,7 +389,8 @@ static const TypeInfo iommu_info = {
     .class_init    = iommu_class_init,
 };
 
-static void sun4m_iommu_memory_region_class_init(ObjectClass *klass, void *data)
+static void sun4m_iommu_memory_region_class_init(ObjectClass *klass,
+                                                 const void *data)
 {
     IOMMUMemoryRegionClass *imrc = IOMMU_MEMORY_REGION_CLASS(klass);
 
diff --git a/hw/sparc64/niagara.c b/hw/sparc64/niagara.c
index 805ba6b1e3..1ffe92060a 100644
--- a/hw/sparc64/niagara.c
+++ b/hw/sparc64/niagara.c
@@ -157,7 +157,7 @@ static void niagara_init(MachineState *machine)
     sun4v_rtc_init(NIAGARA_RTC_BASE);
 }
 
-static void niagara_class_init(ObjectClass *oc, void *data)
+static void niagara_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
 
diff --git a/hw/sparc64/sun4u.c b/hw/sparc64/sun4u.c
index becdf3ea98..0e5fb4e1b5 100644
--- a/hw/sparc64/sun4u.c
+++ b/hw/sparc64/sun4u.c
@@ -266,7 +266,7 @@ static void power_realize(DeviceState *dev, Error **errp)
     sysbus_init_mmio(sbd, &d->power_mmio);
 }
 
-static void power_class_init(ObjectClass *klass, void *data)
+static void power_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -373,7 +373,7 @@ static const Property ebus_properties[] = {
                        console_serial_base, 0),
 };
 
-static void ebus_class_init(ObjectClass *klass, void *data)
+static void ebus_class_init(ObjectClass *klass, const void *data)
 {
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -464,7 +464,7 @@ static void prom_realize(DeviceState *ds, Error **errp)
     sysbus_init_mmio(dev, &s->prom);
 }
 
-static void prom_class_init(ObjectClass *klass, void *data)
+static void prom_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -524,7 +524,7 @@ static const Property ram_properties[] = {
     DEFINE_PROP_UINT64("size", RamDevice, size, 0),
 };
 
-static void ram_class_init(ObjectClass *klass, void *data)
+static void ram_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -787,7 +787,7 @@ static GlobalProperty hw_compat_sparc64[] = {
 };
 static const size_t hw_compat_sparc64_len = G_N_ELEMENTS(hw_compat_sparc64);
 
-static void sun4u_class_init(ObjectClass *oc, void *data)
+static void sun4u_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     FWPathProviderClass *fwc = FW_PATH_PROVIDER_CLASS(oc);
@@ -817,7 +817,7 @@ static const TypeInfo sun4u_type = {
     },
 };
 
-static void sun4v_class_init(ObjectClass *oc, void *data)
+static void sun4v_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
 
diff --git a/hw/sparc64/sun4u_iommu.c b/hw/sparc64/sun4u_iommu.c
index 533fcae1fb..14645f475a 100644
--- a/hw/sparc64/sun4u_iommu.c
+++ b/hw/sparc64/sun4u_iommu.c
@@ -305,7 +305,7 @@ static void iommu_init(Object *obj)
     sysbus_init_mmio(sbd, &s->iomem);
 }
 
-static void iommu_class_init(ObjectClass *klass, void *data)
+static void iommu_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -320,7 +320,8 @@ static const TypeInfo iommu_info = {
     .class_init    = iommu_class_init,
 };
 
-static void sun4u_iommu_memory_region_class_init(ObjectClass *klass, void *data)
+static void sun4u_iommu_memory_region_class_init(ObjectClass *klass,
+                                                 const void *data)
 {
     IOMMUMemoryRegionClass *imrc = IOMMU_MEMORY_REGION_CLASS(klass);
 
diff --git a/hw/ssi/allwinner-a10-spi.c b/hw/ssi/allwinner-a10-spi.c
index d2f6bb9cdc..6b7cca8d32 100644
--- a/hw/ssi/allwinner-a10-spi.c
+++ b/hw/ssi/allwinner-a10-spi.c
@@ -535,7 +535,7 @@ static void allwinner_a10_spi_realize(DeviceState *dev, Error **errp)
     fifo8_create(&s->rx_fifo, AW_A10_SPI_FIFO_SIZE);
 }
 
-static void allwinner_a10_spi_class_init(ObjectClass *klass, void *data)
+static void allwinner_a10_spi_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     ResettableClass *rc = RESETTABLE_CLASS(klass);
diff --git a/hw/ssi/aspeed_smc.c b/hw/ssi/aspeed_smc.c
index faef1a8e5b..0d38f95c7a 100644
--- a/hw/ssi/aspeed_smc.c
+++ b/hw/ssi/aspeed_smc.c
@@ -1294,7 +1294,7 @@ static const Property aspeed_smc_properties[] = {
                      TYPE_MEMORY_REGION, MemoryRegion *),
 };
 
-static void aspeed_smc_class_init(ObjectClass *klass, void *data)
+static void aspeed_smc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -1341,7 +1341,7 @@ static const Property aspeed_smc_flash_properties[] = {
                      AspeedSMCState *),
 };
 
-static void aspeed_smc_flash_class_init(ObjectClass *klass, void *data)
+static void aspeed_smc_flash_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -1383,7 +1383,7 @@ static const AspeedSegments aspeed_2400_smc_segments[] = {
     { 0x10000000, 32 * MiB },
 };
 
-static void aspeed_2400_smc_class_init(ObjectClass *klass, void *data)
+static void aspeed_2400_smc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
@@ -1429,7 +1429,7 @@ static const AspeedSegments aspeed_2400_fmc_segments[] = {
     { 0x2A000000, 32 * MiB }
 };
 
-static void aspeed_2400_fmc_class_init(ObjectClass *klass, void *data)
+static void aspeed_2400_fmc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
@@ -1473,7 +1473,7 @@ static int aspeed_2400_spi1_addr_width(const AspeedSMCState *s)
     return s->regs[R_SPI_CTRL0] & CTRL_AST2400_SPI_4BYTE ? 4 : 3;
 }
 
-static void aspeed_2400_spi1_class_init(ObjectClass *klass, void *data)
+static void aspeed_2400_spi1_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
@@ -1515,7 +1515,7 @@ static const AspeedSegments aspeed_2500_fmc_segments[] = {
     { 0x2A000000,  32 * MiB },
 };
 
-static void aspeed_2500_fmc_class_init(ObjectClass *klass, void *data)
+static void aspeed_2500_fmc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
@@ -1555,7 +1555,7 @@ static const AspeedSegments aspeed_2500_spi1_segments[] = {
     { 0x32000000, 96 * MiB }, /* end address is readonly */
 };
 
-static void aspeed_2500_spi1_class_init(ObjectClass *klass, void *data)
+static void aspeed_2500_spi1_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
@@ -1591,7 +1591,7 @@ static const AspeedSegments aspeed_2500_spi2_segments[] = {
     { 0x3A000000, 96 * MiB }, /* end address is readonly */
 };
 
-static void aspeed_2500_spi2_class_init(ObjectClass *klass, void *data)
+static void aspeed_2500_spi2_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
@@ -1674,7 +1674,7 @@ static const AspeedSegments aspeed_2600_fmc_segments[] = {
     { 0x0, 0 }, /* disabled */
 };
 
-static void aspeed_2600_fmc_class_init(ObjectClass *klass, void *data)
+static void aspeed_2600_fmc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
@@ -1715,7 +1715,7 @@ static const AspeedSegments aspeed_2600_spi1_segments[] = {
     { 0x0, 0 }, /* disabled */
 };
 
-static void aspeed_2600_spi1_class_init(ObjectClass *klass, void *data)
+static void aspeed_2600_spi1_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
@@ -1756,7 +1756,7 @@ static const AspeedSegments aspeed_2600_spi2_segments[] = {
     { 0x0, 0 }, /* disabled */
 };
 
-static void aspeed_2600_spi2_class_init(ObjectClass *klass, void *data)
+static void aspeed_2600_spi2_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
@@ -1839,7 +1839,7 @@ static const AspeedSegments aspeed_1030_fmc_segments[] = {
     { 0x0, 0 }, /* disabled */
 };
 
-static void aspeed_1030_fmc_class_init(ObjectClass *klass, void *data)
+static void aspeed_1030_fmc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
@@ -1879,7 +1879,7 @@ static const AspeedSegments aspeed_1030_spi1_segments[] = {
     { 0x0, 0 }, /* disabled */
 };
 
-static void aspeed_1030_spi1_class_init(ObjectClass *klass, void *data)
+static void aspeed_1030_spi1_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
@@ -1917,7 +1917,7 @@ static const AspeedSegments aspeed_1030_spi2_segments[] = {
     { 0x0, 0 }, /* disabled */
 };
 
-static void aspeed_1030_spi2_class_init(ObjectClass *klass, void *data)
+static void aspeed_1030_spi2_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
@@ -2022,7 +2022,7 @@ static const AspeedSegments aspeed_2700_fmc_segments[] = {
     { 0x0, 0 }, /* disabled */
 };
 
-static void aspeed_2700_fmc_class_init(ObjectClass *klass, void *data)
+static void aspeed_2700_fmc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
@@ -2064,7 +2064,7 @@ static const AspeedSegments aspeed_2700_spi0_segments[] = {
     { 0x0, 0 }, /* disabled */
 };
 
-static void aspeed_2700_spi0_class_init(ObjectClass *klass, void *data)
+static void aspeed_2700_spi0_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
@@ -2104,7 +2104,7 @@ static const AspeedSegments aspeed_2700_spi1_segments[] = {
     { 0x0, 0 }, /* disabled */
 };
 
-static void aspeed_2700_spi1_class_init(ObjectClass *klass, void *data)
+static void aspeed_2700_spi1_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
@@ -2144,7 +2144,7 @@ static const AspeedSegments aspeed_2700_spi2_segments[] = {
     { 0x0, 0 }, /* disabled */
 };
 
-static void aspeed_2700_spi2_class_init(ObjectClass *klass, void *data)
+static void aspeed_2700_spi2_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
diff --git a/hw/ssi/bcm2835_spi.c b/hw/ssi/bcm2835_spi.c
index ebd8809f7c..bf8ba35e04 100644
--- a/hw/ssi/bcm2835_spi.c
+++ b/hw/ssi/bcm2835_spi.c
@@ -264,7 +264,7 @@ static const VMStateDescription vmstate_bcm2835_spi = {
     }
 };
 
-static void bcm2835_spi_class_init(ObjectClass *klass, void *data)
+static void bcm2835_spi_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/ssi/ibex_spi_host.c b/hw/ssi/ibex_spi_host.c
index 6b28cda200..f05be68748 100644
--- a/hw/ssi/ibex_spi_host.c
+++ b/hw/ssi/ibex_spi_host.c
@@ -622,7 +622,7 @@ static void ibex_spi_host_init(Object *obj)
     sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
 }
 
-static void ibex_spi_host_class_init(ObjectClass *klass, void *data)
+static void ibex_spi_host_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     dc->realize = ibex_spi_host_realize;
diff --git a/hw/ssi/imx_spi.c b/hw/ssi/imx_spi.c
index 2e317879b4..1312f588d2 100644
--- a/hw/ssi/imx_spi.c
+++ b/hw/ssi/imx_spi.c
@@ -475,7 +475,7 @@ static void imx_spi_realize(DeviceState *dev, Error **errp)
     fifo32_create(&s->rx_fifo, ECSPI_FIFO_SIZE);
 }
 
-static void imx_spi_class_init(ObjectClass *klass, void *data)
+static void imx_spi_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/ssi/mss-spi.c b/hw/ssi/mss-spi.c
index 340adcdd3f..fd7ba7eeb0 100644
--- a/hw/ssi/mss-spi.c
+++ b/hw/ssi/mss-spi.c
@@ -398,7 +398,7 @@ static const VMStateDescription vmstate_mss_spi = {
     }
 };
 
-static void mss_spi_class_init(ObjectClass *klass, void *data)
+static void mss_spi_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/ssi/npcm7xx_fiu.c b/hw/ssi/npcm7xx_fiu.c
index 8df4bec3f1..056ce13394 100644
--- a/hw/ssi/npcm7xx_fiu.c
+++ b/hw/ssi/npcm7xx_fiu.c
@@ -557,7 +557,7 @@ static const Property npcm7xx_fiu_properties[] = {
     DEFINE_PROP_SIZE("flash-size", NPCM7xxFIUState, flash_size, 0),
 };
 
-static void npcm7xx_fiu_class_init(ObjectClass *klass, void *data)
+static void npcm7xx_fiu_class_init(ObjectClass *klass, const void *data)
 {
     ResettableClass *rc = RESETTABLE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
diff --git a/hw/ssi/npcm_pspi.c b/hw/ssi/npcm_pspi.c
index 41a5323530..a31dcc050e 100644
--- a/hw/ssi/npcm_pspi.c
+++ b/hw/ssi/npcm_pspi.c
@@ -199,7 +199,7 @@ static const VMStateDescription vmstate_npcm_pspi = {
 };
 
 
-static void npcm_pspi_class_init(ObjectClass *klass, void *data)
+static void npcm_pspi_class_init(ObjectClass *klass, const void *data)
 {
     ResettableClass *rc = RESETTABLE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
diff --git a/hw/ssi/pl022.c b/hw/ssi/pl022.c
index 53c9c225ad..1dc0bcbcc0 100644
--- a/hw/ssi/pl022.c
+++ b/hw/ssi/pl022.c
@@ -292,7 +292,7 @@ static void pl022_realize(DeviceState *dev, Error **errp)
     s->ssi = ssi_create_bus(dev, "ssi");
 }
 
-static void pl022_class_init(ObjectClass *klass, void *data)
+static void pl022_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/ssi/pnv_spi.c b/hw/ssi/pnv_spi.c
index 367a2ff3bb..0bb6b0d935 100644
--- a/hw/ssi/pnv_spi.c
+++ b/hw/ssi/pnv_spi.c
@@ -1199,7 +1199,7 @@ static int pnv_spi_dt_xscom(PnvXScomInterface *dev, void *fdt,
     return 0;
 }
 
-static void pnv_spi_class_init(ObjectClass *klass, void *data)
+static void pnv_spi_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PnvXScomInterfaceClass *xscomc = PNV_XSCOM_INTERFACE_CLASS(klass);
diff --git a/hw/ssi/sifive_spi.c b/hw/ssi/sifive_spi.c
index 76f8654f41..3e01fef61c 100644
--- a/hw/ssi/sifive_spi.c
+++ b/hw/ssi/sifive_spi.c
@@ -332,7 +332,7 @@ static const Property sifive_spi_properties[] = {
     DEFINE_PROP_UINT32("num-cs", SiFiveSPIState, num_cs, 1),
 };
 
-static void sifive_spi_class_init(ObjectClass *klass, void *data)
+static void sifive_spi_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/ssi/ssi.c b/hw/ssi/ssi.c
index 872c4e8036..d0de640fe6 100644
--- a/hw/ssi/ssi.c
+++ b/hw/ssi/ssi.c
@@ -55,7 +55,7 @@ static bool ssi_bus_check_address(BusState *b, DeviceState *dev, Error **errp)
     return true;
 }
 
-static void ssi_bus_class_init(ObjectClass *klass, void *data)
+static void ssi_bus_class_init(ObjectClass *klass, const void *data)
 {
     BusClass *k = BUS_CLASS(klass);
 
@@ -112,7 +112,7 @@ static const Property ssi_peripheral_properties[] = {
     DEFINE_PROP_UINT8("cs", SSIPeripheral, cs_index, 0),
 };
 
-static void ssi_peripheral_class_init(ObjectClass *klass, void *data)
+static void ssi_peripheral_class_init(ObjectClass *klass, const void *data)
 {
     SSIPeripheralClass *ssc = SSI_PERIPHERAL_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
diff --git a/hw/ssi/stm32f2xx_spi.c b/hw/ssi/stm32f2xx_spi.c
index ea9b74a409..871d57324d 100644
--- a/hw/ssi/stm32f2xx_spi.c
+++ b/hw/ssi/stm32f2xx_spi.c
@@ -202,7 +202,7 @@ static void stm32f2xx_spi_init(Object *obj)
     s->ssi = ssi_create_bus(dev, "ssi");
 }
 
-static void stm32f2xx_spi_class_init(ObjectClass *klass, void *data)
+static void stm32f2xx_spi_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/ssi/xilinx_spi.c b/hw/ssi/xilinx_spi.c
index be5baa6b35..4144c8a627 100644
--- a/hw/ssi/xilinx_spi.c
+++ b/hw/ssi/xilinx_spi.c
@@ -379,7 +379,7 @@ static const Property xilinx_spi_properties[] = {
     DEFINE_PROP_UINT8("num-ss-bits", XilinxSPI, num_cs, 1),
 };
 
-static void xilinx_spi_class_init(ObjectClass *klass, void *data)
+static void xilinx_spi_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/ssi/xilinx_spips.c b/hw/ssi/xilinx_spips.c
index 60d092039f..a79f3b8e49 100644
--- a/hw/ssi/xilinx_spips.c
+++ b/hw/ssi/xilinx_spips.c
@@ -1430,7 +1430,7 @@ static const Property xilinx_spips_properties[] = {
     DEFINE_PROP_UINT8("num-txrx-bytes", XilinxSPIPS, num_txrx_bytes, 1),
 };
 
-static void xilinx_qspips_class_init(ObjectClass *klass, void * data)
+static void xilinx_qspips_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     XilinxSPIPSClass *xsc = XILINX_SPIPS_CLASS(klass);
@@ -1442,7 +1442,7 @@ static void xilinx_qspips_class_init(ObjectClass *klass, void * data)
     xsc->tx_fifo_size = TXFF_A_Q;
 }
 
-static void xilinx_spips_class_init(ObjectClass *klass, void *data)
+static void xilinx_spips_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     XilinxSPIPSClass *xsc = XILINX_SPIPS_CLASS(klass);
@@ -1458,7 +1458,7 @@ static void xilinx_spips_class_init(ObjectClass *klass, void *data)
     xsc->tx_fifo_size = TXFF_A;
 }
 
-static void xlnx_zynqmp_qspips_class_init(ObjectClass *klass, void * data)
+static void xlnx_zynqmp_qspips_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     XilinxSPIPSClass *xsc = XILINX_SPIPS_CLASS(klass);
diff --git a/hw/ssi/xlnx-versal-ospi.c b/hw/ssi/xlnx-versal-ospi.c
index 9e96c9b69a..56d51ce0e3 100644
--- a/hw/ssi/xlnx-versal-ospi.c
+++ b/hw/ssi/xlnx-versal-ospi.c
@@ -1831,7 +1831,7 @@ static const Property xlnx_versal_ospi_properties[] = {
                      ind_write_disabled, false),
 };
 
-static void xlnx_versal_ospi_class_init(ObjectClass *klass, void *data)
+static void xlnx_versal_ospi_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/timer/a9gtimer.c b/hw/timer/a9gtimer.c
index 9835c35483..690140f5a6 100644
--- a/hw/timer/a9gtimer.c
+++ b/hw/timer/a9gtimer.c
@@ -377,7 +377,7 @@ static const Property a9_gtimer_properties[] = {
     DEFINE_PROP_UINT32("num-cpu", A9GTimerState, num_cpu, 0),
 };
 
-static void a9_gtimer_class_init(ObjectClass *klass, void *data)
+static void a9_gtimer_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/timer/allwinner-a10-pit.c b/hw/timer/allwinner-a10-pit.c
index da3d7173ef..e4c353273a 100644
--- a/hw/timer/allwinner-a10-pit.c
+++ b/hw/timer/allwinner-a10-pit.c
@@ -288,7 +288,7 @@ static void a10_pit_finalize(Object *obj)
     }
 }
 
-static void a10_pit_class_init(ObjectClass *klass, void *data)
+static void a10_pit_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/timer/arm_mptimer.c b/hw/timer/arm_mptimer.c
index 803dad1e8a..7cc5915e9e 100644
--- a/hw/timer/arm_mptimer.c
+++ b/hw/timer/arm_mptimer.c
@@ -304,7 +304,7 @@ static const Property arm_mptimer_properties[] = {
     DEFINE_PROP_UINT32("num-cpu", ARMMPTimerState, num_cpu, 0),
 };
 
-static void arm_mptimer_class_init(ObjectClass *klass, void *data)
+static void arm_mptimer_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/timer/arm_timer.c b/hw/timer/arm_timer.c
index 1213b77aa0..56638ff5cd 100644
--- a/hw/timer/arm_timer.c
+++ b/hw/timer/arm_timer.c
@@ -392,7 +392,7 @@ static const Property sp804_properties[] = {
     DEFINE_PROP_UINT32("freq1", SP804State, freq1, 1000000),
 };
 
-static void sp804_class_init(ObjectClass *klass, void *data)
+static void sp804_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *k = DEVICE_CLASS(klass);
 
diff --git a/hw/timer/armv7m_systick.c b/hw/timer/armv7m_systick.c
index a07febd1d1..7e4ddcd405 100644
--- a/hw/timer/armv7m_systick.c
+++ b/hw/timer/armv7m_systick.c
@@ -285,7 +285,7 @@ static const VMStateDescription vmstate_systick = {
     }
 };
 
-static void systick_class_init(ObjectClass *klass, void *data)
+static void systick_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/timer/aspeed_timer.c b/hw/timer/aspeed_timer.c
index ecda49574e..57db03512f 100644
--- a/hw/timer/aspeed_timer.c
+++ b/hw/timer/aspeed_timer.c
@@ -895,7 +895,7 @@ static const Property aspeed_timer_properties[] = {
                      AspeedSCUState *),
 };
 
-static void timer_class_init(ObjectClass *klass, void *data)
+static void timer_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -915,7 +915,7 @@ static const TypeInfo aspeed_timer_info = {
     .abstract   = true,
 };
 
-static void aspeed_2400_timer_class_init(ObjectClass *klass, void *data)
+static void aspeed_2400_timer_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     AspeedTimerClass *awc = ASPEED_TIMER_CLASS(klass);
@@ -931,7 +931,7 @@ static const TypeInfo aspeed_2400_timer_info = {
     .class_init = aspeed_2400_timer_class_init,
 };
 
-static void aspeed_2500_timer_class_init(ObjectClass *klass, void *data)
+static void aspeed_2500_timer_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     AspeedTimerClass *awc = ASPEED_TIMER_CLASS(klass);
@@ -947,7 +947,7 @@ static const TypeInfo aspeed_2500_timer_info = {
     .class_init = aspeed_2500_timer_class_init,
 };
 
-static void aspeed_2600_timer_class_init(ObjectClass *klass, void *data)
+static void aspeed_2600_timer_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     AspeedTimerClass *awc = ASPEED_TIMER_CLASS(klass);
@@ -963,7 +963,7 @@ static const TypeInfo aspeed_2600_timer_info = {
     .class_init = aspeed_2600_timer_class_init,
 };
 
-static void aspeed_1030_timer_class_init(ObjectClass *klass, void *data)
+static void aspeed_1030_timer_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     AspeedTimerClass *awc = ASPEED_TIMER_CLASS(klass);
@@ -979,7 +979,7 @@ static const TypeInfo aspeed_1030_timer_info = {
     .class_init = aspeed_1030_timer_class_init,
 };
 
-static void aspeed_2700_timer_class_init(ObjectClass *klass, void *data)
+static void aspeed_2700_timer_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     AspeedTimerClass *awc = ASPEED_TIMER_CLASS(klass);
diff --git a/hw/timer/avr_timer16.c b/hw/timer/avr_timer16.c
index 96baf9cf60..012d829001 100644
--- a/hw/timer/avr_timer16.c
+++ b/hw/timer/avr_timer16.c
@@ -595,7 +595,7 @@ static void avr_timer16_realize(DeviceState *dev, Error **errp)
     s->enabled = true;
 }
 
-static void avr_timer16_class_init(ObjectClass *klass, void *data)
+static void avr_timer16_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/timer/bcm2835_systmr.c b/hw/timer/bcm2835_systmr.c
index 2f0fee3342..7929aaa882 100644
--- a/hw/timer/bcm2835_systmr.c
+++ b/hw/timer/bcm2835_systmr.c
@@ -154,7 +154,7 @@ static const VMStateDescription bcm2835_systmr_vmstate = {
     }
 };
 
-static void bcm2835_systmr_class_init(ObjectClass *klass, void *data)
+static void bcm2835_systmr_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/timer/cadence_ttc.c b/hw/timer/cadence_ttc.c
index 54dbd4c564..9c7ba16876 100644
--- a/hw/timer/cadence_ttc.c
+++ b/hw/timer/cadence_ttc.c
@@ -451,7 +451,7 @@ static const VMStateDescription vmstate_cadence_ttc = {
     }
 };
 
-static void cadence_ttc_class_init(ObjectClass *klass, void *data)
+static void cadence_ttc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/timer/cmsdk-apb-dualtimer.c b/hw/timer/cmsdk-apb-dualtimer.c
index 2ecd8dfe3c..34c550a3f9 100644
--- a/hw/timer/cmsdk-apb-dualtimer.c
+++ b/hw/timer/cmsdk-apb-dualtimer.c
@@ -534,7 +534,7 @@ static const VMStateDescription cmsdk_apb_dualtimer_vmstate = {
     }
 };
 
-static void cmsdk_apb_dualtimer_class_init(ObjectClass *klass, void *data)
+static void cmsdk_apb_dualtimer_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/timer/cmsdk-apb-timer.c b/hw/timer/cmsdk-apb-timer.c
index 16d0b2170e..4095267b4a 100644
--- a/hw/timer/cmsdk-apb-timer.c
+++ b/hw/timer/cmsdk-apb-timer.c
@@ -261,7 +261,7 @@ static const VMStateDescription cmsdk_apb_timer_vmstate = {
     }
 };
 
-static void cmsdk_apb_timer_class_init(ObjectClass *klass, void *data)
+static void cmsdk_apb_timer_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/timer/digic-timer.c b/hw/timer/digic-timer.c
index 00c32978d2..355138d354 100644
--- a/hw/timer/digic-timer.c
+++ b/hw/timer/digic-timer.c
@@ -161,7 +161,7 @@ static void digic_timer_finalize(Object *obj)
     ptimer_free(s->ptimer);
 }
 
-static void digic_timer_class_init(ObjectClass *klass, void *class_data)
+static void digic_timer_class_init(ObjectClass *klass, const void *class_data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/timer/exynos4210_mct.c b/hw/timer/exynos4210_mct.c
index 5c6e139b20..bb0f9c8b9a 100644
--- a/hw/timer/exynos4210_mct.c
+++ b/hw/timer/exynos4210_mct.c
@@ -1546,7 +1546,7 @@ static void exynos4210_mct_finalize(Object *obj)
     }
 }
 
-static void exynos4210_mct_class_init(ObjectClass *klass, void *data)
+static void exynos4210_mct_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/timer/exynos4210_pwm.c b/hw/timer/exynos4210_pwm.c
index 703d1d2b4a..69f737a8e6 100644
--- a/hw/timer/exynos4210_pwm.c
+++ b/hw/timer/exynos4210_pwm.c
@@ -420,7 +420,7 @@ static void exynos4210_pwm_finalize(Object *obj)
     }
 }
 
-static void exynos4210_pwm_class_init(ObjectClass *klass, void *data)
+static void exynos4210_pwm_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/timer/grlib_gptimer.c b/hw/timer/grlib_gptimer.c
index f0802b6eb6..0e06fa09e9 100644
--- a/hw/timer/grlib_gptimer.c
+++ b/hw/timer/grlib_gptimer.c
@@ -409,7 +409,7 @@ static const Property grlib_gptimer_properties[] = {
     DEFINE_PROP_UINT32("nr-timers", GPTimerUnit, nr_timers, 2),
 };
 
-static void grlib_gptimer_class_init(ObjectClass *klass, void *data)
+static void grlib_gptimer_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/timer/hpet.c b/hw/timer/hpet.c
index ea82472105..d1b7bc52b7 100644
--- a/hw/timer/hpet.c
+++ b/hw/timer/hpet.c
@@ -736,7 +736,7 @@ static const Property hpet_device_properties[] = {
     DEFINE_PROP_BOOL("hpet-offset-saved", HPETState, hpet_offset_saved, true),
 };
 
-static void hpet_device_class_init(ObjectClass *klass, void *data)
+static void hpet_device_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/timer/i8254.c b/hw/timer/i8254.c
index 058fc61ce9..4b25c487f7 100644
--- a/hw/timer/i8254.c
+++ b/hw/timer/i8254.c
@@ -350,7 +350,7 @@ static void pit_realizefn(DeviceState *dev, Error **errp)
     pc->parent_realize(dev, errp);
 }
 
-static void pit_class_initfn(ObjectClass *klass, void *data)
+static void pit_class_initfn(ObjectClass *klass, const void *data)
 {
     PITClass *pc = PIT_CLASS(klass);
     PITCommonClass *k = PIT_COMMON_CLASS(klass);
diff --git a/hw/timer/i8254_common.c b/hw/timer/i8254_common.c
index 29105afcc3..ad091594cd 100644
--- a/hw/timer/i8254_common.c
+++ b/hw/timer/i8254_common.c
@@ -242,7 +242,7 @@ static const Property pit_common_properties[] = {
     DEFINE_PROP_UINT32("iobase", PITCommonState, iobase,  -1),
 };
 
-static void pit_common_class_init(ObjectClass *klass, void *data)
+static void pit_common_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/timer/ibex_timer.c b/hw/timer/ibex_timer.c
index 3ebc870097..c7320ef30f 100644
--- a/hw/timer/ibex_timer.c
+++ b/hw/timer/ibex_timer.c
@@ -286,7 +286,7 @@ static void ibex_timer_realize(DeviceState *dev, Error **errp)
 }
 
 
-static void ibex_timer_class_init(ObjectClass *klass, void *data)
+static void ibex_timer_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/timer/imx_epit.c b/hw/timer/imx_epit.c
index f40ab16697..6123321c35 100644
--- a/hw/timer/imx_epit.c
+++ b/hw/timer/imx_epit.c
@@ -427,7 +427,7 @@ static void imx_epit_dev_reset(DeviceState *dev)
     imx_epit_reset(s, true);
 }
 
-static void imx_epit_class_init(ObjectClass *klass, void *data)
+static void imx_epit_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc  = DEVICE_CLASS(klass);
 
diff --git a/hw/timer/imx_gpt.c b/hw/timer/imx_gpt.c
index 200a89225b..8c7cbfdeac 100644
--- a/hw/timer/imx_gpt.c
+++ b/hw/timer/imx_gpt.c
@@ -518,7 +518,7 @@ static void imx_gpt_realize(DeviceState *dev, Error **errp)
     s->timer = ptimer_init(imx_gpt_timeout, s, PTIMER_POLICY_LEGACY);
 }
 
-static void imx_gpt_class_init(ObjectClass *klass, void *data)
+static void imx_gpt_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/timer/mss-timer.c b/hw/timer/mss-timer.c
index 594da64eae..2ce821178b 100644
--- a/hw/timer/mss-timer.c
+++ b/hw/timer/mss-timer.c
@@ -285,7 +285,7 @@ static const Property mss_timer_properties[] = {
                       100 * 1000000),
 };
 
-static void mss_timer_class_init(ObjectClass *klass, void *data)
+static void mss_timer_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/timer/npcm7xx_timer.c b/hw/timer/npcm7xx_timer.c
index c55ba02235..6a116ad54b 100644
--- a/hw/timer/npcm7xx_timer.c
+++ b/hw/timer/npcm7xx_timer.c
@@ -689,7 +689,7 @@ static const VMStateDescription vmstate_npcm7xx_timer_ctrl = {
     },
 };
 
-static void npcm7xx_timer_class_init(ObjectClass *klass, void *data)
+static void npcm7xx_timer_class_init(ObjectClass *klass, const void *data)
 {
     ResettableClass *rc = RESETTABLE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
diff --git a/hw/timer/nrf51_timer.c b/hw/timer/nrf51_timer.c
index 11ad8b575e..e228fdebc3 100644
--- a/hw/timer/nrf51_timer.c
+++ b/hw/timer/nrf51_timer.c
@@ -383,7 +383,7 @@ static const Property nrf51_timer_properties[] = {
     DEFINE_PROP_UINT8("id", NRF51TimerState, id, 0),
 };
 
-static void nrf51_timer_class_init(ObjectClass *klass, void *data)
+static void nrf51_timer_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/timer/pxa2xx_timer.c b/hw/timer/pxa2xx_timer.c
index 9e4dd0fd9f..7a94366b0f 100644
--- a/hw/timer/pxa2xx_timer.c
+++ b/hw/timer/pxa2xx_timer.c
@@ -555,7 +555,7 @@ static const Property pxa25x_timer_dev_properties[] = {
                     PXA2XX_TIMER_HAVE_TM4, false),
 };
 
-static void pxa25x_timer_dev_class_init(ObjectClass *klass, void *data)
+static void pxa25x_timer_dev_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -570,7 +570,7 @@ static const TypeInfo pxa25x_timer_dev_info = {
     .class_init    = pxa25x_timer_dev_class_init,
 };
 
-static void pxa2xx_timer_class_init(ObjectClass *oc, void *data)
+static void pxa2xx_timer_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
diff --git a/hw/timer/renesas_cmt.c b/hw/timer/renesas_cmt.c
index 93e7f58cc2..cdff7f47f1 100644
--- a/hw/timer/renesas_cmt.c
+++ b/hw/timer/renesas_cmt.c
@@ -257,7 +257,7 @@ static const Property rcmt_properties[] = {
     DEFINE_PROP_UINT64("input-freq", RCMTState, input_freq, 0),
 };
 
-static void rcmt_class_init(ObjectClass *klass, void *data)
+static void rcmt_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/timer/renesas_tmr.c b/hw/timer/renesas_tmr.c
index 884349c2cc..95707f2b8c 100644
--- a/hw/timer/renesas_tmr.c
+++ b/hw/timer/renesas_tmr.c
@@ -467,7 +467,7 @@ static const Property rtmr_properties[] = {
     DEFINE_PROP_UINT64("input-freq", RTMRState, input_freq, 0),
 };
 
-static void rtmr_class_init(ObjectClass *klass, void *data)
+static void rtmr_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/timer/sifive_pwm.c b/hw/timer/sifive_pwm.c
index fc796e9bc3..e85e389f7a 100644
--- a/hw/timer/sifive_pwm.c
+++ b/hw/timer/sifive_pwm.c
@@ -441,7 +441,7 @@ static void sifive_pwm_realize(DeviceState *dev, Error **errp)
                   sifive_pwm_interrupt_3, s);
 }
 
-static void sifive_pwm_class_init(ObjectClass *klass, void *data)
+static void sifive_pwm_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/timer/slavio_timer.c b/hw/timer/slavio_timer.c
index 65b24e4f06..3e071fbdb4 100644
--- a/hw/timer/slavio_timer.c
+++ b/hw/timer/slavio_timer.c
@@ -424,7 +424,7 @@ static const Property slavio_timer_properties[] = {
     DEFINE_PROP_UINT32("num_cpus",  SLAVIO_TIMERState, num_cpus,  0),
 };
 
-static void slavio_timer_class_init(ObjectClass *klass, void *data)
+static void slavio_timer_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/timer/sse-counter.c b/hw/timer/sse-counter.c
index f17064abe3..31f77acf61 100644
--- a/hw/timer/sse-counter.c
+++ b/hw/timer/sse-counter.c
@@ -448,7 +448,7 @@ static const VMStateDescription sse_counter_vmstate = {
     }
 };
 
-static void sse_counter_class_init(ObjectClass *klass, void *data)
+static void sse_counter_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/timer/sse-timer.c b/hw/timer/sse-timer.c
index e106739ea9..866d5eef8a 100644
--- a/hw/timer/sse-timer.c
+++ b/hw/timer/sse-timer.c
@@ -444,7 +444,7 @@ static const Property sse_timer_properties[] = {
     DEFINE_PROP_LINK("counter", SSETimer, counter, TYPE_SSE_COUNTER, SSECounter *),
 };
 
-static void sse_timer_class_init(ObjectClass *klass, void *data)
+static void sse_timer_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/timer/stellaris-gptm.c b/hw/timer/stellaris-gptm.c
index f28958cefc..d97b2f8309 100644
--- a/hw/timer/stellaris-gptm.c
+++ b/hw/timer/stellaris-gptm.c
@@ -308,7 +308,7 @@ static void stellaris_gptm_realize(DeviceState *dev, Error **errp)
     s->timer[1] = timer_new_ns(QEMU_CLOCK_VIRTUAL, gptm_tick, &s->opaque[1]);
 }
 
-static void stellaris_gptm_class_init(ObjectClass *klass, void *data)
+static void stellaris_gptm_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/timer/stm32f2xx_timer.c b/hw/timer/stm32f2xx_timer.c
index 4707190d6a..be844e7f5a 100644
--- a/hw/timer/stm32f2xx_timer.c
+++ b/hw/timer/stm32f2xx_timer.c
@@ -320,7 +320,7 @@ static void stm32f2xx_timer_realize(DeviceState *dev, Error **errp)
     s->timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, stm32f2xx_timer_interrupt, s);
 }
 
-static void stm32f2xx_timer_class_init(ObjectClass *klass, void *data)
+static void stm32f2xx_timer_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/timer/xilinx_timer.c b/hw/timer/xilinx_timer.c
index 4620528f98..ff4a224d08 100644
--- a/hw/timer/xilinx_timer.c
+++ b/hw/timer/xilinx_timer.c
@@ -268,7 +268,7 @@ static const Property xilinx_timer_properties[] = {
     DEFINE_PROP_UINT8("one-timer-only", XpsTimerState, one_timer_only, 0),
 };
 
-static void xilinx_timer_class_init(ObjectClass *klass, void *data)
+static void xilinx_timer_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/tpm/tpm_crb.c b/hw/tpm/tpm_crb.c
index b668aee97a..9aff4d1a6f 100644
--- a/hw/tpm/tpm_crb.c
+++ b/hw/tpm/tpm_crb.c
@@ -315,7 +315,7 @@ static void tpm_crb_realize(DeviceState *dev, Error **errp)
     }
 }
 
-static void tpm_crb_class_init(ObjectClass *klass, void *data)
+static void tpm_crb_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     TPMIfClass *tc = TPM_IF_CLASS(klass);
diff --git a/hw/tpm/tpm_spapr.c b/hw/tpm/tpm_spapr.c
index 9a031e1e75..1cad9a88ea 100644
--- a/hw/tpm/tpm_spapr.c
+++ b/hw/tpm/tpm_spapr.c
@@ -387,7 +387,7 @@ static void tpm_spapr_realizefn(SpaprVioDevice *dev, Error **errp)
     s->buffer = g_malloc(TPM_SPAPR_BUFFER_MAX);
 }
 
-static void tpm_spapr_class_init(ObjectClass *klass, void *data)
+static void tpm_spapr_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     SpaprVioDeviceClass *k = VIO_SPAPR_DEVICE_CLASS(klass);
diff --git a/hw/tpm/tpm_tis_i2c.c b/hw/tpm/tpm_tis_i2c.c
index 92d3de1ea3..b97d768a5b 100644
--- a/hw/tpm/tpm_tis_i2c.c
+++ b/hw/tpm/tpm_tis_i2c.c
@@ -526,7 +526,7 @@ static void tpm_tis_i2c_reset(DeviceState *dev)
     return tpm_tis_reset(s);
 }
 
-static void tpm_tis_i2c_class_init(ObjectClass *klass, void *data)
+static void tpm_tis_i2c_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     I2CSlaveClass *k = I2C_SLAVE_CLASS(klass);
diff --git a/hw/tpm/tpm_tis_isa.c b/hw/tpm/tpm_tis_isa.c
index 876cb02cb5..c0098a26e8 100644
--- a/hw/tpm/tpm_tis_isa.c
+++ b/hw/tpm/tpm_tis_isa.c
@@ -166,7 +166,7 @@ static void build_tpm_tis_isa_aml(AcpiDevAmlIf *adev, Aml *scope)
     aml_append(scope, dev);
 }
 
-static void tpm_tis_isa_class_init(ObjectClass *klass, void *data)
+static void tpm_tis_isa_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     TPMIfClass *tc = TPM_IF_CLASS(klass);
diff --git a/hw/tpm/tpm_tis_sysbus.c b/hw/tpm/tpm_tis_sysbus.c
index 4f187690a2..19abf0b948 100644
--- a/hw/tpm/tpm_tis_sysbus.c
+++ b/hw/tpm/tpm_tis_sysbus.c
@@ -124,7 +124,7 @@ static void tpm_tis_sysbus_realizefn(DeviceState *dev, Error **errp)
     }
 }
 
-static void tpm_tis_sysbus_class_init(ObjectClass *klass, void *data)
+static void tpm_tis_sysbus_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     TPMIfClass *tc = TPM_IF_CLASS(klass);
diff --git a/hw/tricore/tc27x_soc.c b/hw/tricore/tc27x_soc.c
index 81bb16d89b..f3b84980e5 100644
--- a/hw/tricore/tc27x_soc.c
+++ b/hw/tricore/tc27x_soc.c
@@ -201,14 +201,14 @@ static void tc27x_soc_init(Object *obj)
     object_initialize_child(obj, "tc27x", &s->cpu, sc->cpu_type);
 }
 
-static void tc27x_soc_class_init(ObjectClass *klass, void *data)
+static void tc27x_soc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
     dc->realize = tc27x_soc_realize;
 }
 
-static void tc277d_soc_class_init(ObjectClass *oc, void *data)
+static void tc277d_soc_class_init(ObjectClass *oc, const void *data)
 {
     TC27XSoCClass *sc = TC27X_SOC_CLASS(oc);
 
diff --git a/hw/tricore/triboard.c b/hw/tricore/triboard.c
index f5baa8ccbb..cb45b01d2d 100644
--- a/hw/tricore/triboard.c
+++ b/hw/tricore/triboard.c
@@ -65,7 +65,7 @@ static void triboard_machine_init(MachineState *machine)
 }
 
 static void triboard_machine_tc277d_class_init(ObjectClass *oc,
-        void *data)
+                                               const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     TriBoardMachineClass *amc = TRIBOARD_MACHINE_CLASS(oc);
diff --git a/hw/tricore/tricore_testdevice.c b/hw/tricore/tricore_testdevice.c
index d2da74e384..e8daf95298 100644
--- a/hw/tricore/tricore_testdevice.c
+++ b/hw/tricore/tricore_testdevice.c
@@ -58,7 +58,7 @@ static void tricore_testdevice_init(Object *obj)
                           "tricore_testdevice", 0x4);
 }
 
-static void tricore_testdevice_class_init(ObjectClass *klass, void *data)
+static void tricore_testdevice_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/uefi/var-service-sysbus.c b/hw/uefi/var-service-sysbus.c
index 97da8672ee..a5aa218e26 100644
--- a/hw/uefi/var-service-sysbus.c
+++ b/hw/uefi/var-service-sysbus.c
@@ -64,7 +64,7 @@ static void uefi_vars_sysbus_realize(DeviceState *dev, Error **errp)
     uefi_vars_realize(&uv->state, errp);
 }
 
-static void uefi_vars_sysbus_class_init(ObjectClass *klass, void *data)
+static void uefi_vars_sysbus_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -100,7 +100,7 @@ static void uefi_vars_x64_realize(DeviceState *dev, Error **errp)
     sysbus_mmio_map(sysbus, 0, hwinfo.mmio_address);
 }
 
-static void uefi_vars_x64_class_init(ObjectClass *klass, void *data)
+static void uefi_vars_x64_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/ufs/lu.c b/hw/ufs/lu.c
index 1c3794b2d4..57b307ea56 100644
--- a/hw/ufs/lu.c
+++ b/hw/ufs/lu.c
@@ -419,7 +419,7 @@ static void ufs_lu_unrealize(DeviceState *dev)
     }
 }
 
-static void ufs_lu_class_init(ObjectClass *oc, void *data)
+static void ufs_lu_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
diff --git a/hw/ufs/ufs.c b/hw/ufs/ufs.c
index 542f13b10e..749519760f 100644
--- a/hw/ufs/ufs.c
+++ b/hw/ufs/ufs.c
@@ -1844,7 +1844,7 @@ static const VMStateDescription ufs_vmstate = {
     .unmigratable = 1,
 };
 
-static void ufs_class_init(ObjectClass *oc, void *data)
+static void ufs_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     PCIDeviceClass *pc = PCI_DEVICE_CLASS(oc);
@@ -1880,7 +1880,7 @@ static char *ufs_bus_get_dev_path(DeviceState *dev)
     return qdev_get_dev_path(bus->parent);
 }
 
-static void ufs_bus_class_init(ObjectClass *class, void *data)
+static void ufs_bus_class_init(ObjectClass *class, const void *data)
 {
     BusClass *bc = BUS_CLASS(class);
     bc->get_dev_path = ufs_bus_get_dev_path;
diff --git a/hw/usb/bus.c b/hw/usb/bus.c
index f45b82c776..d8446cf50e 100644
--- a/hw/usb/bus.c
+++ b/hw/usb/bus.c
@@ -26,7 +26,7 @@ static const Property usb_props[] = {
     DEFINE_PROP_STRING("pcap", USBDevice, pcap_filename),
 };
 
-static void usb_bus_class_init(ObjectClass *klass, void *data)
+static void usb_bus_class_init(ObjectClass *klass, const void *data)
 {
     BusClass *k = BUS_CLASS(klass);
     HotplugHandlerClass *hc = HOTPLUG_HANDLER_CLASS(klass);
@@ -713,7 +713,7 @@ static void usb_device_instance_init(Object *obj)
     }
 }
 
-static void usb_device_class_init(ObjectClass *klass, void *data)
+static void usb_device_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *k = DEVICE_CLASS(klass);
     k->bus_type = TYPE_USB_BUS;
diff --git a/hw/usb/canokey.c b/hw/usb/canokey.c
index e2d66179e0..cbefbb5daf 100644
--- a/hw/usb/canokey.c
+++ b/hw/usb/canokey.c
@@ -300,7 +300,7 @@ static const Property canokey_properties[] = {
     DEFINE_PROP_STRING("file", CanoKeyState, file),
 };
 
-static void canokey_class_init(ObjectClass *klass, void *data)
+static void canokey_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     USBDeviceClass *uc = USB_DEVICE_CLASS(klass);
diff --git a/hw/usb/ccid-card-emulated.c b/hw/usb/ccid-card-emulated.c
index b1e330f21d..c21cefd82d 100644
--- a/hw/usb/ccid-card-emulated.c
+++ b/hw/usb/ccid-card-emulated.c
@@ -591,7 +591,7 @@ static const Property emulated_card_properties[] = {
     DEFINE_PROP_UINT8("debug", EmulatedState, debug, 0),
 };
 
-static void emulated_class_initfn(ObjectClass *klass, void *data)
+static void emulated_class_initfn(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     CCIDCardClass *cc = CCID_CARD_CLASS(klass);
diff --git a/hw/usb/ccid-card-passthru.c b/hw/usb/ccid-card-passthru.c
index bf81485f87..1eea21a733 100644
--- a/hw/usb/ccid-card-passthru.c
+++ b/hw/usb/ccid-card-passthru.c
@@ -393,7 +393,7 @@ static const Property passthru_card_properties[] = {
     DEFINE_PROP_UINT8("debug", PassthruState, debug, 0),
 };
 
-static void passthru_class_initfn(ObjectClass *klass, void *data)
+static void passthru_class_initfn(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     CCIDCardClass *cc = CCID_CARD_CLASS(klass);
diff --git a/hw/usb/chipidea.c b/hw/usb/chipidea.c
index b1c85404d6..250c2b3bca 100644
--- a/hw/usb/chipidea.c
+++ b/hw/usb/chipidea.c
@@ -144,7 +144,7 @@ static void chipidea_init(Object *obj)
     }
 }
 
-static void chipidea_class_init(ObjectClass *klass, void *data)
+static void chipidea_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     SysBusEHCIClass *sec = SYS_BUS_EHCI_CLASS(klass);
diff --git a/hw/usb/dev-audio.c b/hw/usb/dev-audio.c
index 40f031252a..26af709f31 100644
--- a/hw/usb/dev-audio.c
+++ b/hw/usb/dev-audio.c
@@ -997,7 +997,7 @@ static const Property usb_audio_properties[] = {
     DEFINE_PROP_BOOL("multi", USBAudioState, multi, false),
 };
 
-static void usb_audio_class_init(ObjectClass *klass, void *data)
+static void usb_audio_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     USBDeviceClass *k = USB_DEVICE_CLASS(klass);
diff --git a/hw/usb/dev-hid.c b/hw/usb/dev-hid.c
index accdd460e3..54d064e54e 100644
--- a/hw/usb/dev-hid.c
+++ b/hw/usb/dev-hid.c
@@ -774,7 +774,7 @@ static const VMStateDescription vmstate_usb_kbd = {
     }
 };
 
-static void usb_hid_class_initfn(ObjectClass *klass, void *data)
+static void usb_hid_class_initfn(ObjectClass *klass, const void *data)
 {
     USBDeviceClass *uc = USB_DEVICE_CLASS(klass);
 
@@ -799,7 +799,7 @@ static const Property usb_tablet_properties[] = {
         DEFINE_PROP_UINT32("head", USBHIDState, head, 0),
 };
 
-static void usb_tablet_class_initfn(ObjectClass *klass, void *data)
+static void usb_tablet_class_initfn(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     USBDeviceClass *uc = USB_DEVICE_CLASS(klass);
@@ -821,7 +821,7 @@ static const Property usb_mouse_properties[] = {
         DEFINE_PROP_UINT32("usb_version", USBHIDState, usb_version, 2),
 };
 
-static void usb_mouse_class_initfn(ObjectClass *klass, void *data)
+static void usb_mouse_class_initfn(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     USBDeviceClass *uc = USB_DEVICE_CLASS(klass);
@@ -844,7 +844,7 @@ static const Property usb_keyboard_properties[] = {
         DEFINE_PROP_STRING("display", USBHIDState, display),
 };
 
-static void usb_keyboard_class_initfn(ObjectClass *klass, void *data)
+static void usb_keyboard_class_initfn(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     USBDeviceClass *uc = USB_DEVICE_CLASS(klass);
diff --git a/hw/usb/dev-hub.c b/hw/usb/dev-hub.c
index 3880e2aca8..a19350d9c4 100644
--- a/hw/usb/dev-hub.c
+++ b/hw/usb/dev-hub.c
@@ -670,7 +670,7 @@ static const Property usb_hub_properties[] = {
     DEFINE_PROP_BOOL("port-power", USBHubState, port_power, false),
 };
 
-static void usb_hub_class_initfn(ObjectClass *klass, void *data)
+static void usb_hub_class_initfn(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     USBDeviceClass *uc = USB_DEVICE_CLASS(klass);
diff --git a/hw/usb/dev-mtp.c b/hw/usb/dev-mtp.c
index 4cd14c3df4..ce45c9cd06 100644
--- a/hw/usb/dev-mtp.c
+++ b/hw/usb/dev-mtp.c
@@ -2082,7 +2082,7 @@ static const Property mtp_properties[] = {
     DEFINE_PROP_BOOL("readonly", MTPState, readonly, true),
 };
 
-static void usb_mtp_class_initfn(ObjectClass *klass, void *data)
+static void usb_mtp_class_initfn(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     USBDeviceClass *uc = USB_DEVICE_CLASS(klass);
diff --git a/hw/usb/dev-network.c b/hw/usb/dev-network.c
index a87a0ffb95..81cc09dcac 100644
--- a/hw/usb/dev-network.c
+++ b/hw/usb/dev-network.c
@@ -1411,7 +1411,7 @@ static const Property net_properties[] = {
     DEFINE_NIC_PROPERTIES(USBNetState, conf),
 };
 
-static void usb_net_class_initfn(ObjectClass *klass, void *data)
+static void usb_net_class_initfn(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     USBDeviceClass *uc = USB_DEVICE_CLASS(klass);
diff --git a/hw/usb/dev-serial.c b/hw/usb/dev-serial.c
index 31f6cf5b31..1c116d8b0f 100644
--- a/hw/usb/dev-serial.c
+++ b/hw/usb/dev-serial.c
@@ -637,7 +637,7 @@ static const Property serial_properties[] = {
     DEFINE_PROP_BOOL("always-plugged", USBSerialState, always_plugged, false),
 };
 
-static void usb_serial_dev_class_init(ObjectClass *klass, void *data)
+static void usb_serial_dev_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     USBDeviceClass *uc = USB_DEVICE_CLASS(klass);
@@ -658,7 +658,7 @@ static const TypeInfo usb_serial_dev_type_info = {
     .class_init = usb_serial_dev_class_init,
 };
 
-static void usb_serial_class_initfn(ObjectClass *klass, void *data)
+static void usb_serial_class_initfn(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     USBDeviceClass *uc = USB_DEVICE_CLASS(klass);
@@ -678,7 +678,7 @@ static const Property braille_properties[] = {
     DEFINE_PROP_CHR("chardev", USBSerialState, cs),
 };
 
-static void usb_braille_class_initfn(ObjectClass *klass, void *data)
+static void usb_braille_class_initfn(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     USBDeviceClass *uc = USB_DEVICE_CLASS(klass);
diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c
index 84ca8c48e2..87018a3f01 100644
--- a/hw/usb/dev-smartcard-reader.c
+++ b/hw/usb/dev-smartcard-reader.c
@@ -1433,7 +1433,7 @@ static const Property ccid_properties[] = {
     DEFINE_PROP_UINT8("debug", USBCCIDState, debug, 0),
 };
 
-static void ccid_class_initfn(ObjectClass *klass, void *data)
+static void ccid_class_initfn(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     USBDeviceClass *uc = USB_DEVICE_CLASS(klass);
@@ -1464,7 +1464,7 @@ static const TypeInfo ccid_info = {
     }
 };
 
-static void ccid_card_class_init(ObjectClass *klass, void *data)
+static void ccid_card_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *k = DEVICE_CLASS(klass);
     k->bus_type = TYPE_CCID_BUS;
diff --git a/hw/usb/dev-storage-bot.c b/hw/usb/dev-storage-bot.c
index 1e5c5c711f..df6ab7f656 100644
--- a/hw/usb/dev-storage-bot.c
+++ b/hw/usb/dev-storage-bot.c
@@ -40,7 +40,7 @@ static void usb_msd_bot_realize(USBDevice *dev, Error **errp)
     usb_msd_handle_reset(dev);
 }
 
-static void usb_msd_class_bot_initfn(ObjectClass *klass, void *data)
+static void usb_msd_class_bot_initfn(ObjectClass *klass, const void *data)
 {
     USBDeviceClass *uc = USB_DEVICE_CLASS(klass);
 
diff --git a/hw/usb/dev-storage-classic.c b/hw/usb/dev-storage-classic.c
index 56ef39da2e..dabe156359 100644
--- a/hw/usb/dev-storage-classic.c
+++ b/hw/usb/dev-storage-classic.c
@@ -74,7 +74,7 @@ static const Property msd_properties[] = {
     DEFINE_PROP_BOOL("commandlog", MSDState, commandlog, false),
 };
 
-static void usb_msd_class_storage_initfn(ObjectClass *klass, void *data)
+static void usb_msd_class_storage_initfn(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     USBDeviceClass *uc = USB_DEVICE_CLASS(klass);
diff --git a/hw/usb/dev-storage.c b/hw/usb/dev-storage.c
index 4f1e8b7f6c..b13fe345c4 100644
--- a/hw/usb/dev-storage.c
+++ b/hw/usb/dev-storage.c
@@ -585,7 +585,7 @@ static const VMStateDescription vmstate_usb_msd = {
     }
 };
 
-static void usb_msd_class_initfn_common(ObjectClass *klass, void *data)
+static void usb_msd_class_initfn_common(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     USBDeviceClass *uc = USB_DEVICE_CLASS(klass);
diff --git a/hw/usb/dev-uas.c b/hw/usb/dev-uas.c
index b1d6b6ecc3..21cc2835c6 100644
--- a/hw/usb/dev-uas.c
+++ b/hw/usb/dev-uas.c
@@ -956,7 +956,7 @@ static const Property uas_properties[] = {
     DEFINE_PROP_UINT32("log-scsi-req", UASDevice, requestlog, 0),
 };
 
-static void usb_uas_class_initfn(ObjectClass *klass, void *data)
+static void usb_uas_class_initfn(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     USBDeviceClass *uc = USB_DEVICE_CLASS(klass);
diff --git a/hw/usb/dev-wacom.c b/hw/usb/dev-wacom.c
index 7177c17f03..f4b71a2147 100644
--- a/hw/usb/dev-wacom.c
+++ b/hw/usb/dev-wacom.c
@@ -420,7 +420,7 @@ static const VMStateDescription vmstate_usb_wacom = {
     .unmigratable = 1,
 };
 
-static void usb_wacom_class_init(ObjectClass *klass, void *data)
+static void usb_wacom_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     USBDeviceClass *uc = USB_DEVICE_CLASS(klass);
diff --git a/hw/usb/hcd-dwc2.c b/hw/usb/hcd-dwc2.c
index e8152719f8..83864505bb 100644
--- a/hw/usb/hcd-dwc2.c
+++ b/hw/usb/hcd-dwc2.c
@@ -1452,7 +1452,7 @@ static const Property dwc2_usb_properties[] = {
     DEFINE_PROP_UINT32("usb_version", DWC2State, usb_version, 2),
 };
 
-static void dwc2_class_init(ObjectClass *klass, void *data)
+static void dwc2_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     DWC2Class *c = DWC2_USB_CLASS(klass);
diff --git a/hw/usb/hcd-dwc3.c b/hw/usb/hcd-dwc3.c
index 0bceee2712..98a342b8b8 100644
--- a/hw/usb/hcd-dwc3.c
+++ b/hw/usb/hcd-dwc3.c
@@ -666,7 +666,7 @@ static const Property usb_dwc3_properties[] = {
                        0x12345678),
 };
 
-static void usb_dwc3_class_init(ObjectClass *klass, void *data)
+static void usb_dwc3_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/usb/hcd-ehci-pci.c b/hw/usb/hcd-ehci-pci.c
index e00316721a..73122aa797 100644
--- a/hw/usb/hcd-ehci-pci.c
+++ b/hw/usb/hcd-ehci-pci.c
@@ -150,7 +150,7 @@ static const VMStateDescription vmstate_ehci_pci = {
     }
 };
 
-static void ehci_class_init(ObjectClass *klass, void *data)
+static void ehci_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
@@ -178,7 +178,7 @@ static const TypeInfo ehci_pci_type_info = {
     },
 };
 
-static void ehci_data_class_init(ObjectClass *klass, void *data)
+static void ehci_data_class_init(ObjectClass *klass, const void *data)
 {
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
diff --git a/hw/usb/hcd-ehci-sysbus.c b/hw/usb/hcd-ehci-sysbus.c
index 768c3dd797..0449f5fa6d 100644
--- a/hw/usb/hcd-ehci-sysbus.c
+++ b/hw/usb/hcd-ehci-sysbus.c
@@ -80,7 +80,7 @@ static void ehci_sysbus_finalize(Object *obj)
     usb_ehci_finalize(s);
 }
 
-static void ehci_sysbus_class_init(ObjectClass *klass, void *data)
+static void ehci_sysbus_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     SysBusEHCIClass *sec = SYS_BUS_EHCI_CLASS(klass);
@@ -95,7 +95,7 @@ static void ehci_sysbus_class_init(ObjectClass *klass, void *data)
     set_bit(DEVICE_CATEGORY_USB, dc->categories);
 }
 
-static void ehci_platform_class_init(ObjectClass *oc, void *data)
+static void ehci_platform_class_init(ObjectClass *oc, const void *data)
 {
     SysBusEHCIClass *sec = SYS_BUS_EHCI_CLASS(oc);
     DeviceClass *dc = DEVICE_CLASS(oc);
@@ -105,7 +105,7 @@ static void ehci_platform_class_init(ObjectClass *oc, void *data)
     set_bit(DEVICE_CATEGORY_USB, dc->categories);
 }
 
-static void ehci_exynos4210_class_init(ObjectClass *oc, void *data)
+static void ehci_exynos4210_class_init(ObjectClass *oc, const void *data)
 {
     SysBusEHCIClass *sec = SYS_BUS_EHCI_CLASS(oc);
     DeviceClass *dc = DEVICE_CLASS(oc);
@@ -115,7 +115,7 @@ static void ehci_exynos4210_class_init(ObjectClass *oc, void *data)
     set_bit(DEVICE_CATEGORY_USB, dc->categories);
 }
 
-static void ehci_aw_h3_class_init(ObjectClass *oc, void *data)
+static void ehci_aw_h3_class_init(ObjectClass *oc, const void *data)
 {
     SysBusEHCIClass *sec = SYS_BUS_EHCI_CLASS(oc);
     DeviceClass *dc = DEVICE_CLASS(oc);
@@ -125,7 +125,7 @@ static void ehci_aw_h3_class_init(ObjectClass *oc, void *data)
     set_bit(DEVICE_CATEGORY_USB, dc->categories);
 }
 
-static void ehci_npcm7xx_class_init(ObjectClass *oc, void *data)
+static void ehci_npcm7xx_class_init(ObjectClass *oc, const void *data)
 {
     SysBusEHCIClass *sec = SYS_BUS_EHCI_CLASS(oc);
     DeviceClass *dc = DEVICE_CLASS(oc);
@@ -137,7 +137,7 @@ static void ehci_npcm7xx_class_init(ObjectClass *oc, void *data)
     set_bit(DEVICE_CATEGORY_USB, dc->categories);
 }
 
-static void ehci_tegra2_class_init(ObjectClass *oc, void *data)
+static void ehci_tegra2_class_init(ObjectClass *oc, const void *data)
 {
     SysBusEHCIClass *sec = SYS_BUS_EHCI_CLASS(oc);
     DeviceClass *dc = DEVICE_CLASS(oc);
@@ -154,7 +154,7 @@ static void ehci_ppc4xx_init(Object *o)
     s->ehci.companion_enable = true;
 }
 
-static void ehci_ppc4xx_class_init(ObjectClass *oc, void *data)
+static void ehci_ppc4xx_class_init(ObjectClass *oc, const void *data)
 {
     SysBusEHCIClass *sec = SYS_BUS_EHCI_CLASS(oc);
     DeviceClass *dc = DEVICE_CLASS(oc);
@@ -220,7 +220,7 @@ static void fusbh200_ehci_init(Object *obj)
                                 &f->mem_vendor);
 }
 
-static void fusbh200_ehci_class_init(ObjectClass *oc, void *data)
+static void fusbh200_ehci_class_init(ObjectClass *oc, const void *data)
 {
     SysBusEHCIClass *sec = SYS_BUS_EHCI_CLASS(oc);
     DeviceClass *dc = DEVICE_CLASS(oc);
diff --git a/hw/usb/hcd-ohci-pci.c b/hw/usb/hcd-ohci-pci.c
index b3684a2ef6..3c82525a1e 100644
--- a/hw/usb/hcd-ohci-pci.c
+++ b/hw/usb/hcd-ohci-pci.c
@@ -126,7 +126,7 @@ static const VMStateDescription vmstate_ohci = {
     }
 };
 
-static void ohci_pci_class_init(ObjectClass *klass, void *data)
+static void ohci_pci_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
diff --git a/hw/usb/hcd-ohci-sysbus.c b/hw/usb/hcd-ohci-sysbus.c
index 15311949b3..3fc6cce44b 100644
--- a/hw/usb/hcd-ohci-sysbus.c
+++ b/hw/usb/hcd-ohci-sysbus.c
@@ -64,7 +64,7 @@ static const Property ohci_sysbus_properties[] = {
     DEFINE_PROP_DMAADDR("dma-offset", OHCISysBusState, dma_offset, 0),
 };
 
-static void ohci_sysbus_class_init(ObjectClass *klass, void *data)
+static void ohci_sysbus_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/usb/hcd-uhci.c b/hw/usb/hcd-uhci.c
index 0561a6d801..2b1aee1f21 100644
--- a/hw/usb/hcd-uhci.c
+++ b/hw/usb/hcd-uhci.c
@@ -1260,7 +1260,7 @@ static const Property uhci_properties_standalone[] = {
     DEFINE_PROP_UINT32("maxframes", UHCIState, maxframes, 128),
 };
 
-static void uhci_class_init(ObjectClass *klass, void *data)
+static void uhci_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
@@ -1284,7 +1284,7 @@ static const TypeInfo uhci_pci_type_info = {
     },
 };
 
-void uhci_data_class_init(ObjectClass *klass, void *data)
+void uhci_data_class_init(ObjectClass *klass, const void *data)
 {
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
diff --git a/hw/usb/hcd-uhci.h b/hw/usb/hcd-uhci.h
index d4664297cf..e0a6525505 100644
--- a/hw/usb/hcd-uhci.h
+++ b/hw/usb/hcd-uhci.h
@@ -88,7 +88,7 @@ typedef struct UHCIInfo {
     bool       notuser; /* disallow user_creatable */
 } UHCIInfo;
 
-void uhci_data_class_init(ObjectClass *klass, void *data);
+void uhci_data_class_init(ObjectClass *klass, const void *data);
 void usb_uhci_common_realize(PCIDevice *dev, Error **errp);
 
 #define TYPE_PIIX3_USB_UHCI "piix3-usb-uhci"
diff --git a/hw/usb/hcd-xhci-nec.c b/hw/usb/hcd-xhci-nec.c
index 1df518baf5..9e0fea26f4 100644
--- a/hw/usb/hcd-xhci-nec.c
+++ b/hw/usb/hcd-xhci-nec.c
@@ -50,7 +50,7 @@ static void nec_xhci_instance_init(Object *obj)
     pci->xhci.numslots = nec->slots;
 }
 
-static void nec_xhci_class_init(ObjectClass *klass, void *data)
+static void nec_xhci_class_init(ObjectClass *klass, const void *data)
 {
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
diff --git a/hw/usb/hcd-xhci-pci.c b/hw/usb/hcd-xhci-pci.c
index d908eb787d..6167bb9100 100644
--- a/hw/usb/hcd-xhci-pci.c
+++ b/hw/usb/hcd-xhci-pci.c
@@ -223,7 +223,7 @@ static const Property xhci_pci_properties[] = {
                      conditional_intr_mapping, false),
 };
 
-static void xhci_class_init(ObjectClass *klass, void *data)
+static void xhci_class_init(ObjectClass *klass, const void *data)
 {
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -255,7 +255,7 @@ static const TypeInfo xhci_pci_info = {
     },
 };
 
-static void qemu_xhci_class_init(ObjectClass *klass, void *data)
+static void qemu_xhci_class_init(ObjectClass *klass, const void *data)
 {
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
 
diff --git a/hw/usb/hcd-xhci-sysbus.c b/hw/usb/hcd-xhci-sysbus.c
index ce43322396..244698e5f2 100644
--- a/hw/usb/hcd-xhci-sysbus.c
+++ b/hw/usb/hcd-xhci-sysbus.c
@@ -96,7 +96,7 @@ static const VMStateDescription vmstate_xhci_sysbus = {
     }
 };
 
-static void xhci_sysbus_class_init(ObjectClass *klass, void *data)
+static void xhci_sysbus_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
index 64c3a23b9b..b3785b8ba6 100644
--- a/hw/usb/hcd-xhci.c
+++ b/hw/usb/hcd-xhci.c
@@ -3638,7 +3638,7 @@ static const Property xhci_properties[] = {
                      DeviceState *),
 };
 
-static void xhci_class_init(ObjectClass *klass, void *data)
+static void xhci_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/usb/host-libusb.c b/hw/usb/host-libusb.c
index c3d642c9d3..b74670ae25 100644
--- a/hw/usb/host-libusb.c
+++ b/hw/usb/host-libusb.c
@@ -1781,7 +1781,7 @@ static const Property usb_host_dev_properties[] = {
                      suppress_remote_wake, true),
 };
 
-static void usb_host_class_initfn(ObjectClass *klass, void *data)
+static void usb_host_class_initfn(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     USBDeviceClass *uc = USB_DEVICE_CLASS(klass);
diff --git a/hw/usb/imx-usb-phy.c b/hw/usb/imx-usb-phy.c
index f519250567..c25566d0fa 100644
--- a/hw/usb/imx-usb-phy.c
+++ b/hw/usb/imx-usb-phy.c
@@ -214,7 +214,7 @@ static void imx_usbphy_realize(DeviceState *dev, Error **errp)
     sysbus_init_mmio(SYS_BUS_DEVICE(s), &s->iomem);
 }
 
-static void imx_usbphy_class_init(ObjectClass *klass, void *data)
+static void imx_usbphy_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/usb/redirect.c b/hw/usb/redirect.c
index f3a83b3f4c..f516ff42a1 100644
--- a/hw/usb/redirect.c
+++ b/hw/usb/redirect.c
@@ -2582,7 +2582,7 @@ static const Property usbredir_properties[] = {
                      suppress_remote_wake, true),
 };
 
-static void usbredir_class_initfn(ObjectClass *klass, void *data)
+static void usbredir_class_initfn(ObjectClass *klass, const void *data)
 {
     USBDeviceClass *uc = USB_DEVICE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
diff --git a/hw/usb/u2f-emulated.c b/hw/usb/u2f-emulated.c
index e1dd19ee92..ace5eceadd 100644
--- a/hw/usb/u2f-emulated.c
+++ b/hw/usb/u2f-emulated.c
@@ -377,7 +377,7 @@ static const Property u2f_emulated_properties[] = {
     DEFINE_PROP_STRING("counter", U2FEmulatedState, counter),
 };
 
-static void u2f_emulated_class_init(ObjectClass *klass, void *data)
+static void u2f_emulated_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     U2FKeyClass *kc = U2F_KEY_CLASS(klass);
diff --git a/hw/usb/u2f-passthru.c b/hw/usb/u2f-passthru.c
index 8df5215a1f..fa8d9cdda8 100644
--- a/hw/usb/u2f-passthru.c
+++ b/hw/usb/u2f-passthru.c
@@ -520,7 +520,7 @@ static const Property u2f_passthru_properties[] = {
     DEFINE_PROP_STRING("hidraw", U2FPassthruState, hidraw),
 };
 
-static void u2f_passthru_class_init(ObjectClass *klass, void *data)
+static void u2f_passthru_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     U2FKeyClass *kc = U2F_KEY_CLASS(klass);
diff --git a/hw/usb/u2f.c b/hw/usb/u2f.c
index 1fb59cf404..b051a999d3 100644
--- a/hw/usb/u2f.c
+++ b/hw/usb/u2f.c
@@ -317,7 +317,7 @@ const VMStateDescription vmstate_u2f_key = {
     }
 };
 
-static void u2f_key_class_init(ObjectClass *klass, void *data)
+static void u2f_key_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     USBDeviceClass *uc = USB_DEVICE_CLASS(klass);
diff --git a/hw/usb/xlnx-usb-subsystem.c b/hw/usb/xlnx-usb-subsystem.c
index d8deeb6ced..98967ef49f 100644
--- a/hw/usb/xlnx-usb-subsystem.c
+++ b/hw/usb/xlnx-usb-subsystem.c
@@ -69,7 +69,7 @@ static void versal_usb2_init(Object *obj)
     object_property_add_alias(obj, "dma", OBJECT(&s->dwc3.sysbus_xhci), "dma");
 }
 
-static void versal_usb2_class_init(ObjectClass *klass, void *data)
+static void versal_usb2_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/usb/xlnx-versal-usb2-ctrl-regs.c b/hw/usb/xlnx-versal-usb2-ctrl-regs.c
index 66c793a602..4114672d4f 100644
--- a/hw/usb/xlnx-versal-usb2-ctrl-regs.c
+++ b/hw/usb/xlnx-versal-usb2-ctrl-regs.c
@@ -202,7 +202,7 @@ static const VMStateDescription vmstate_usb2_ctrl_regs = {
     }
 };
 
-static void usb2_ctrl_regs_class_init(ObjectClass *klass, void *data)
+static void usb2_ctrl_regs_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     ResettableClass *rc = RESETTABLE_CLASS(klass);
diff --git a/hw/vfio/amd-xgbe.c b/hw/vfio/amd-xgbe.c
index 5927503b5c..58f590e385 100644
--- a/hw/vfio/amd-xgbe.c
+++ b/hw/vfio/amd-xgbe.c
@@ -34,7 +34,7 @@ static const VMStateDescription vfio_platform_amd_xgbe_vmstate = {
     .unmigratable = 1,
 };
 
-static void vfio_amd_xgbe_class_init(ObjectClass *klass, void *data)
+static void vfio_amd_xgbe_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VFIOAmdXgbeDeviceClass *vcxc =
diff --git a/hw/vfio/ap.c b/hw/vfio/ap.c
index d6575d7c44..a8f0e6ae14 100644
--- a/hw/vfio/ap.c
+++ b/hw/vfio/ap.c
@@ -241,7 +241,7 @@ static void vfio_ap_set_fd(Object *obj, const char *str, Error **errp)
 }
 #endif
 
-static void vfio_ap_class_init(ObjectClass *klass, void *data)
+static void vfio_ap_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/vfio/calxeda-xgmac.c b/hw/vfio/calxeda-xgmac.c
index a5ef262def..03f2ff5763 100644
--- a/hw/vfio/calxeda-xgmac.c
+++ b/hw/vfio/calxeda-xgmac.c
@@ -34,7 +34,7 @@ static const VMStateDescription vfio_platform_calxeda_xgmac_vmstate = {
     .unmigratable = 1,
 };
 
-static void vfio_calxeda_xgmac_class_init(ObjectClass *klass, void *data)
+static void vfio_calxeda_xgmac_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VFIOCalxedaXgmacDeviceClass *vcxc =
diff --git a/hw/vfio/ccw.c b/hw/vfio/ccw.c
index 29e804e122..a381ab09ff 100644
--- a/hw/vfio/ccw.c
+++ b/hw/vfio/ccw.c
@@ -689,7 +689,7 @@ static void vfio_ccw_set_fd(Object *obj, const char *str, Error **errp)
 }
 #endif
 
-static void vfio_ccw_class_init(ObjectClass *klass, void *data)
+static void vfio_ccw_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     S390CCWDeviceClass *cdc = S390_CCW_DEVICE_CLASS(klass);
diff --git a/hw/vfio/container.c b/hw/vfio/container.c
index 812d5edbcf..63fbe2b054 100644
--- a/hw/vfio/container.c
+++ b/hw/vfio/container.c
@@ -1121,7 +1121,7 @@ out_single:
     return ret;
 }
 
-static void vfio_iommu_legacy_class_init(ObjectClass *klass, void *data)
+static void vfio_iommu_legacy_class_init(ObjectClass *klass, const void *data)
 {
     VFIOIOMMUClass *vioc = VFIO_IOMMU_CLASS(klass);
 
@@ -1185,7 +1185,7 @@ static void vfio_iommu_legacy_instance_init(Object *obj)
     QLIST_INIT(&container->group_list);
 }
 
-static void hiod_legacy_vfio_class_init(ObjectClass *oc, void *data)
+static void hiod_legacy_vfio_class_init(ObjectClass *oc, const void *data)
 {
     HostIOMMUDeviceClass *hioc = HOST_IOMMU_DEVICE_CLASS(oc);
 
diff --git a/hw/vfio/igd.c b/hw/vfio/igd.c
index 265fffc2aa..fd55b8d884 100644
--- a/hw/vfio/igd.c
+++ b/hw/vfio/igd.c
@@ -301,7 +301,8 @@ static void vfio_pci_igd_lpc_bridge_realize(PCIDevice *pdev, Error **errp)
     }
 }
 
-static void vfio_pci_igd_lpc_bridge_class_init(ObjectClass *klass, void *data)
+static void vfio_pci_igd_lpc_bridge_class_init(ObjectClass *klass,
+                                               const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
diff --git a/hw/vfio/iommufd.c b/hw/vfio/iommufd.c
index 42c8412bbf..911da7d86d 100644
--- a/hw/vfio/iommufd.c
+++ b/hw/vfio/iommufd.c
@@ -786,7 +786,7 @@ out_single:
     return ret;
 }
 
-static void vfio_iommu_iommufd_class_init(ObjectClass *klass, void *data)
+static void vfio_iommu_iommufd_class_init(ObjectClass *klass, const void *data)
 {
     VFIOIOMMUClass *vioc = VFIO_IOMMU_CLASS(klass);
 
@@ -846,7 +846,7 @@ hiod_iommufd_vfio_get_page_size_mask(HostIOMMUDevice *hiod)
 }
 
 
-static void hiod_iommufd_vfio_class_init(ObjectClass *oc, void *data)
+static void hiod_iommufd_vfio_class_init(ObjectClass *oc, const void *data)
 {
     HostIOMMUDeviceClass *hiodc = HOST_IOMMU_DEVICE_CLASS(oc);
 
diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index f87f3ccbe1..0db9f03846 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -3409,7 +3409,7 @@ static void vfio_pci_set_fd(Object *obj, const char *str, Error **errp)
 }
 #endif
 
-static void vfio_pci_dev_class_init(ObjectClass *klass, void *data)
+static void vfio_pci_dev_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *pdc = PCI_DEVICE_CLASS(klass);
@@ -3567,7 +3567,8 @@ static const Property vfio_pci_dev_nohotplug_properties[] = {
                             ON_OFF_AUTO_AUTO),
 };
 
-static void vfio_pci_nohotplug_dev_class_init(ObjectClass *klass, void *data)
+static void vfio_pci_nohotplug_dev_class_init(ObjectClass *klass,
+                                              const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/vfio/platform.c b/hw/vfio/platform.c
index f273ae9a51..3f8d092f7f 100644
--- a/hw/vfio/platform.c
+++ b/hw/vfio/platform.c
@@ -658,7 +658,7 @@ static void vfio_platform_set_fd(Object *obj, const char *str, Error **errp)
 }
 #endif
 
-static void vfio_platform_class_init(ObjectClass *klass, void *data)
+static void vfio_platform_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     SysBusDeviceClass *sbc = SYS_BUS_DEVICE_CLASS(klass);
diff --git a/hw/vfio/spapr.c b/hw/vfio/spapr.c
index 66a2d2bb0d..bc795bdaf1 100644
--- a/hw/vfio/spapr.c
+++ b/hw/vfio/spapr.c
@@ -534,7 +534,7 @@ listener_unregister_exit:
     return false;
 }
 
-static void vfio_iommu_spapr_class_init(ObjectClass *klass, void *data)
+static void vfio_iommu_spapr_class_init(ObjectClass *klass, const void *data)
 {
     VFIOIOMMUClass *vioc = VFIO_IOMMU_CLASS(klass);
 
diff --git a/hw/virtio/vdpa-dev-pci.c b/hw/virtio/vdpa-dev-pci.c
index 787926801a..3068112146 100644
--- a/hw/virtio/vdpa-dev-pci.c
+++ b/hw/virtio/vdpa-dev-pci.c
@@ -70,7 +70,8 @@ vhost_vdpa_device_pci_realize(VirtIOPCIProxy *vpci_dev, Error **errp)
     qdev_realize(DEVICE(&dev->vdev), BUS(&vpci_dev->bus), errp);
 }
 
-static void vhost_vdpa_device_pci_class_init(ObjectClass *klass, void *data)
+static void vhost_vdpa_device_pci_class_init(ObjectClass *klass,
+                                             const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtioPCIClass *k = VIRTIO_PCI_CLASS(klass);
diff --git a/hw/virtio/vdpa-dev.c b/hw/virtio/vdpa-dev.c
index a7e73b1c99..dd8837ce4e 100644
--- a/hw/virtio/vdpa-dev.c
+++ b/hw/virtio/vdpa-dev.c
@@ -353,7 +353,7 @@ static const VMStateDescription vmstate_vhost_vdpa_device = {
     },
 };
 
-static void vhost_vdpa_device_class_init(ObjectClass *klass, void *data)
+static void vhost_vdpa_device_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
diff --git a/hw/virtio/vhost-scsi-pci.c b/hw/virtio/vhost-scsi-pci.c
index 3778f6131e..7399acef8e 100644
--- a/hw/virtio/vhost-scsi-pci.c
+++ b/hw/virtio/vhost-scsi-pci.c
@@ -61,7 +61,7 @@ static void vhost_scsi_pci_realize(VirtIOPCIProxy *vpci_dev, Error **errp)
     qdev_realize(vdev, BUS(&vpci_dev->bus), errp);
 }
 
-static void vhost_scsi_pci_class_init(ObjectClass *klass, void *data)
+static void vhost_scsi_pci_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtioPCIClass *k = VIRTIO_PCI_CLASS(klass);
diff --git a/hw/virtio/vhost-user-base.c b/hw/virtio/vhost-user-base.c
index 2bc3423326..77143320a2 100644
--- a/hw/virtio/vhost-user-base.c
+++ b/hw/virtio/vhost-user-base.c
@@ -348,7 +348,7 @@ static void vub_device_unrealize(DeviceState *dev)
     do_vhost_user_cleanup(vdev, vub);
 }
 
-static void vub_class_init(ObjectClass *klass, void *data)
+static void vub_class_init(ObjectClass *klass, const void *data)
 {
     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
 
diff --git a/hw/virtio/vhost-user-blk-pci.c b/hw/virtio/vhost-user-blk-pci.c
index 1767ef2c9c..904369f5a3 100644
--- a/hw/virtio/vhost-user-blk-pci.c
+++ b/hw/virtio/vhost-user-blk-pci.c
@@ -65,7 +65,7 @@ static void vhost_user_blk_pci_realize(VirtIOPCIProxy *vpci_dev, Error **errp)
     qdev_realize(vdev, BUS(&vpci_dev->bus), errp);
 }
 
-static void vhost_user_blk_pci_class_init(ObjectClass *klass, void *data)
+static void vhost_user_blk_pci_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtioPCIClass *k = VIRTIO_PCI_CLASS(klass);
diff --git a/hw/virtio/vhost-user-device-pci.c b/hw/virtio/vhost-user-device-pci.c
index efaf55d3dd..f10bac874e 100644
--- a/hw/virtio/vhost-user-device-pci.c
+++ b/hw/virtio/vhost-user-device-pci.c
@@ -31,7 +31,8 @@ static void vhost_user_device_pci_realize(VirtIOPCIProxy *vpci_dev, Error **errp
     qdev_realize(vdev, BUS(&vpci_dev->bus), errp);
 }
 
-static void vhost_user_device_pci_class_init(ObjectClass *klass, void *data)
+static void vhost_user_device_pci_class_init(ObjectClass *klass,
+                                             const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtioPCIClass *k = VIRTIO_PCI_CLASS(klass);
diff --git a/hw/virtio/vhost-user-device.c b/hw/virtio/vhost-user-device.c
index 86eba138b4..3939bdf755 100644
--- a/hw/virtio/vhost-user-device.c
+++ b/hw/virtio/vhost-user-device.c
@@ -37,7 +37,7 @@ static const Property vud_properties[] = {
     DEFINE_PROP_UINT32("config_size", VHostUserBase, config_size, 0),
 };
 
-static void vud_class_init(ObjectClass *klass, void *data)
+static void vud_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/virtio/vhost-user-fs-pci.c b/hw/virtio/vhost-user-fs-pci.c
index 116eaab907..1490c118bc 100644
--- a/hw/virtio/vhost-user-fs-pci.c
+++ b/hw/virtio/vhost-user-fs-pci.c
@@ -47,7 +47,7 @@ static void vhost_user_fs_pci_realize(VirtIOPCIProxy *vpci_dev, Error **errp)
     qdev_realize(vdev, BUS(&vpci_dev->bus), errp);
 }
 
-static void vhost_user_fs_pci_class_init(ObjectClass *klass, void *data)
+static void vhost_user_fs_pci_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtioPCIClass *k = VIRTIO_PCI_CLASS(klass);
diff --git a/hw/virtio/vhost-user-fs.c b/hw/virtio/vhost-user-fs.c
index 0e8d4b3823..f6d1fc8804 100644
--- a/hw/virtio/vhost-user-fs.c
+++ b/hw/virtio/vhost-user-fs.c
@@ -418,7 +418,7 @@ static void vuf_instance_init(Object *obj)
                                   "/filesystem@0", DEVICE(obj));
 }
 
-static void vuf_class_init(ObjectClass *klass, void *data)
+static void vuf_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
diff --git a/hw/virtio/vhost-user-gpio-pci.c b/hw/virtio/vhost-user-gpio-pci.c
index b3028a24a1..9b165b54f8 100644
--- a/hw/virtio/vhost-user-gpio-pci.c
+++ b/hw/virtio/vhost-user-gpio-pci.c
@@ -32,7 +32,7 @@ static void vhost_user_gpio_pci_realize(VirtIOPCIProxy *vpci_dev, Error **errp)
     qdev_realize(vdev, BUS(&vpci_dev->bus), errp);
 }
 
-static void vhost_user_gpio_pci_class_init(ObjectClass *klass, void *data)
+static void vhost_user_gpio_pci_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtioPCIClass *k = VIRTIO_PCI_CLASS(klass);
diff --git a/hw/virtio/vhost-user-gpio.c b/hw/virtio/vhost-user-gpio.c
index 4a08814904..a7fd49b10a 100644
--- a/hw/virtio/vhost-user-gpio.c
+++ b/hw/virtio/vhost-user-gpio.c
@@ -36,7 +36,7 @@ static const VMStateDescription vu_gpio_vmstate = {
     .unmigratable = 1,
 };
 
-static void vu_gpio_class_init(ObjectClass *klass, void *data)
+static void vu_gpio_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VHostUserBaseClass *vubc = VHOST_USER_BASE_CLASS(klass);
diff --git a/hw/virtio/vhost-user-i2c-pci.c b/hw/virtio/vhost-user-i2c-pci.c
index 00ac10941f..692cd66fde 100644
--- a/hw/virtio/vhost-user-i2c-pci.c
+++ b/hw/virtio/vhost-user-i2c-pci.c
@@ -32,7 +32,7 @@ static void vhost_user_i2c_pci_realize(VirtIOPCIProxy *vpci_dev, Error **errp)
     qdev_realize(vdev, BUS(&vpci_dev->bus), errp);
 }
 
-static void vhost_user_i2c_pci_class_init(ObjectClass *klass, void *data)
+static void vhost_user_i2c_pci_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtioPCIClass *k = VIRTIO_PCI_CLASS(klass);
diff --git a/hw/virtio/vhost-user-i2c.c b/hw/virtio/vhost-user-i2c.c
index 1c7cde503c..ae007fe97d 100644
--- a/hw/virtio/vhost-user-i2c.c
+++ b/hw/virtio/vhost-user-i2c.c
@@ -36,7 +36,7 @@ static const VMStateDescription vu_i2c_vmstate = {
     .unmigratable = 1,
 };
 
-static void vu_i2c_class_init(ObjectClass *klass, void *data)
+static void vu_i2c_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VHostUserBaseClass *vubc = VHOST_USER_BASE_CLASS(klass);
diff --git a/hw/virtio/vhost-user-input.c b/hw/virtio/vhost-user-input.c
index 917405329f..5cfc5bbb56 100644
--- a/hw/virtio/vhost-user-input.c
+++ b/hw/virtio/vhost-user-input.c
@@ -30,7 +30,7 @@ static const VMStateDescription vmstate_vhost_input = {
     .unmigratable = 1,
 };
 
-static void vhost_input_class_init(ObjectClass *klass, void *data)
+static void vhost_input_class_init(ObjectClass *klass, const void *data)
 {
     VHostUserBaseClass *vubc = VHOST_USER_BASE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
diff --git a/hw/virtio/vhost-user-rng-pci.c b/hw/virtio/vhost-user-rng-pci.c
index a4e690148d..9f45fc6f35 100644
--- a/hw/virtio/vhost-user-rng-pci.c
+++ b/hw/virtio/vhost-user-rng-pci.c
@@ -40,7 +40,7 @@ static void vhost_user_rng_pci_realize(VirtIOPCIProxy *vpci_dev, Error **errp)
     qdev_realize(vdev, BUS(&vpci_dev->bus), errp);
 }
 
-static void vhost_user_rng_pci_class_init(ObjectClass *klass, void *data)
+static void vhost_user_rng_pci_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtioPCIClass *k = VIRTIO_PCI_CLASS(klass);
diff --git a/hw/virtio/vhost-user-rng.c b/hw/virtio/vhost-user-rng.c
index 5aa432e5e1..61dadcda05 100644
--- a/hw/virtio/vhost-user-rng.c
+++ b/hw/virtio/vhost-user-rng.c
@@ -37,7 +37,7 @@ static void vu_rng_base_realize(DeviceState *dev, Error **errp)
     vubs->parent_realize(dev, errp);
 }
 
-static void vu_rng_class_init(ObjectClass *klass, void *data)
+static void vu_rng_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VHostUserBaseClass *vubc = VHOST_USER_BASE_CLASS(klass);
diff --git a/hw/virtio/vhost-user-scmi-pci.c b/hw/virtio/vhost-user-scmi-pci.c
index 7f53af7fce..0ab56a50bb 100644
--- a/hw/virtio/vhost-user-scmi-pci.c
+++ b/hw/virtio/vhost-user-scmi-pci.c
@@ -31,7 +31,7 @@ static void vhost_user_scmi_pci_realize(VirtIOPCIProxy *vpci_dev, Error **errp)
     qdev_realize(vdev, BUS(&vpci_dev->bus), errp);
 }
 
-static void vhost_user_scmi_pci_class_init(ObjectClass *klass, void *data)
+static void vhost_user_scmi_pci_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtioPCIClass *k = VIRTIO_PCI_CLASS(klass);
diff --git a/hw/virtio/vhost-user-scmi.c b/hw/virtio/vhost-user-scmi.c
index 04cd36dd2e..7a0f622181 100644
--- a/hw/virtio/vhost-user-scmi.c
+++ b/hw/virtio/vhost-user-scmi.c
@@ -279,7 +279,7 @@ static const Property vu_scmi_properties[] = {
     DEFINE_PROP_CHR("chardev", VHostUserSCMI, chardev),
 };
 
-static void vu_scmi_class_init(ObjectClass *klass, void *data)
+static void vu_scmi_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
diff --git a/hw/virtio/vhost-user-scsi-pci.c b/hw/virtio/vhost-user-scsi-pci.c
index 4a4128d961..994e51a37b 100644
--- a/hw/virtio/vhost-user-scsi-pci.c
+++ b/hw/virtio/vhost-user-scsi-pci.c
@@ -67,7 +67,7 @@ static void vhost_user_scsi_pci_realize(VirtIOPCIProxy *vpci_dev, Error **errp)
     qdev_realize(vdev, BUS(&vpci_dev->bus), errp);
 }
 
-static void vhost_user_scsi_pci_class_init(ObjectClass *klass, void *data)
+static void vhost_user_scsi_pci_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtioPCIClass *k = VIRTIO_PCI_CLASS(klass);
diff --git a/hw/virtio/vhost-user-snd-pci.c b/hw/virtio/vhost-user-snd-pci.c
index 0cb86b7d85..f5015fb6c4 100644
--- a/hw/virtio/vhost-user-snd-pci.c
+++ b/hw/virtio/vhost-user-snd-pci.c
@@ -33,7 +33,7 @@ static void vhost_user_snd_pci_realize(VirtIOPCIProxy *vpci_dev, Error **errp)
     qdev_realize(vdev, BUS(&vpci_dev->bus), errp);
 }
 
-static void vhost_user_snd_pci_class_init(ObjectClass *klass, void *data)
+static void vhost_user_snd_pci_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtioPCIClass *k = VIRTIO_PCI_CLASS(klass);
diff --git a/hw/virtio/vhost-user-snd.c b/hw/virtio/vhost-user-snd.c
index b414c75c06..732411c655 100644
--- a/hw/virtio/vhost-user-snd.c
+++ b/hw/virtio/vhost-user-snd.c
@@ -54,7 +54,7 @@ static void vu_snd_base_realize(DeviceState *dev, Error **errp)
     vubs->parent_realize(dev, errp);
 }
 
-static void vu_snd_class_init(ObjectClass *klass, void *data)
+static void vu_snd_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VHostUserBaseClass *vubc = VHOST_USER_BASE_CLASS(klass);
diff --git a/hw/virtio/vhost-user-vsock-pci.c b/hw/virtio/vhost-user-vsock-pci.c
index f730a05e78..adb877b6e0 100644
--- a/hw/virtio/vhost-user-vsock-pci.c
+++ b/hw/virtio/vhost-user-vsock-pci.c
@@ -46,7 +46,8 @@ static void vhost_user_vsock_pci_realize(VirtIOPCIProxy *vpci_dev, Error **errp)
     qdev_realize(vdev, BUS(&vpci_dev->bus), errp);
 }
 
-static void vhost_user_vsock_pci_class_init(ObjectClass *klass, void *data)
+static void vhost_user_vsock_pci_class_init(ObjectClass *klass,
+                                            const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtioPCIClass *k = VIRTIO_PCI_CLASS(klass);
diff --git a/hw/virtio/vhost-user-vsock.c b/hw/virtio/vhost-user-vsock.c
index d21cd4b516..2776792f59 100644
--- a/hw/virtio/vhost-user-vsock.c
+++ b/hw/virtio/vhost-user-vsock.c
@@ -151,7 +151,7 @@ static const Property vuv_properties[] = {
     DEFINE_PROP_CHR("chardev", VHostUserVSock, conf.chardev),
 };
 
-static void vuv_class_init(ObjectClass *klass, void *data)
+static void vuv_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
diff --git a/hw/virtio/vhost-vsock-common.c b/hw/virtio/vhost-vsock-common.c
index 9ac587d20c..4b4fbb45cc 100644
--- a/hw/virtio/vhost-vsock-common.c
+++ b/hw/virtio/vhost-vsock-common.c
@@ -290,7 +290,7 @@ static const Property vhost_vsock_common_properties[] = {
                             ON_OFF_AUTO_AUTO),
 };
 
-static void vhost_vsock_common_class_init(ObjectClass *klass, void *data)
+static void vhost_vsock_common_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
diff --git a/hw/virtio/vhost-vsock-pci.c b/hw/virtio/vhost-vsock-pci.c
index 6c618ee908..0022a713d4 100644
--- a/hw/virtio/vhost-vsock-pci.c
+++ b/hw/virtio/vhost-vsock-pci.c
@@ -56,7 +56,7 @@ static void vhost_vsock_pci_realize(VirtIOPCIProxy *vpci_dev, Error **errp)
     qdev_realize(vdev, BUS(&vpci_dev->bus), errp);
 }
 
-static void vhost_vsock_pci_class_init(ObjectClass *klass, void *data)
+static void vhost_vsock_pci_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtioPCIClass *k = VIRTIO_PCI_CLASS(klass);
diff --git a/hw/virtio/vhost-vsock.c b/hw/virtio/vhost-vsock.c
index 940b30fa27..b73dc723c2 100644
--- a/hw/virtio/vhost-vsock.c
+++ b/hw/virtio/vhost-vsock.c
@@ -210,7 +210,7 @@ static const Property vhost_vsock_properties[] = {
     DEFINE_PROP_STRING("vhostfd", VHostVSock, conf.vhostfd),
 };
 
-static void vhost_vsock_class_init(ObjectClass *klass, void *data)
+static void vhost_vsock_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
diff --git a/hw/virtio/virtio-9p-pci.c b/hw/virtio/virtio-9p-pci.c
index aa1dce8f28..594742ff65 100644
--- a/hw/virtio/virtio-9p-pci.c
+++ b/hw/virtio/virtio-9p-pci.c
@@ -49,7 +49,7 @@ static const Property virtio_9p_pci_properties[] = {
     DEFINE_PROP_UINT32("vectors", VirtIOPCIProxy, nvectors, 2),
 };
 
-static void virtio_9p_pci_class_init(ObjectClass *klass, void *data)
+static void virtio_9p_pci_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *pcidev_k = PCI_DEVICE_CLASS(klass);
diff --git a/hw/virtio/virtio-balloon-pci.c b/hw/virtio/virtio-balloon-pci.c
index db7e1cb475..96e88b6b86 100644
--- a/hw/virtio/virtio-balloon-pci.c
+++ b/hw/virtio/virtio-balloon-pci.c
@@ -55,7 +55,7 @@ static void virtio_balloon_pci_realize(VirtIOPCIProxy *vpci_dev, Error **errp)
     qdev_realize(vdev, BUS(&vpci_dev->bus), errp);
 }
 
-static void virtio_balloon_pci_class_init(ObjectClass *klass, void *data)
+static void virtio_balloon_pci_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtioPCIClass *k = VIRTIO_PCI_CLASS(klass);
diff --git a/hw/virtio/virtio-balloon.c b/hw/virtio/virtio-balloon.c
index 0d0603c674..91510ec2e2 100644
--- a/hw/virtio/virtio-balloon.c
+++ b/hw/virtio/virtio-balloon.c
@@ -1058,7 +1058,7 @@ static const Property virtio_balloon_properties[] = {
                      IOThread *),
 };
 
-static void virtio_balloon_class_init(ObjectClass *klass, void *data)
+static void virtio_balloon_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
diff --git a/hw/virtio/virtio-blk-pci.c b/hw/virtio/virtio-blk-pci.c
index fc06cec656..fd33bbd7e8 100644
--- a/hw/virtio/virtio-blk-pci.c
+++ b/hw/virtio/virtio-blk-pci.c
@@ -63,7 +63,7 @@ static void virtio_blk_pci_realize(VirtIOPCIProxy *vpci_dev, Error **errp)
     qdev_realize(vdev, BUS(&vpci_dev->bus), errp);
 }
 
-static void virtio_blk_pci_class_init(ObjectClass *klass, void *data)
+static void virtio_blk_pci_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtioPCIClass *k = VIRTIO_PCI_CLASS(klass);
diff --git a/hw/virtio/virtio-bus.c b/hw/virtio/virtio-bus.c
index d1c79c567b..11adfbf3ab 100644
--- a/hw/virtio/virtio-bus.c
+++ b/hw/virtio/virtio-bus.c
@@ -348,7 +348,7 @@ bool virtio_bus_device_iommu_enabled(VirtIODevice *vdev)
     return klass->iommu_enabled(qbus->parent);
 }
 
-static void virtio_bus_class_init(ObjectClass *klass, void *data)
+static void virtio_bus_class_init(ObjectClass *klass, const void *data)
 {
     BusClass *bus_class = BUS_CLASS(klass);
     bus_class->get_dev_path = virtio_bus_get_dev_path;
diff --git a/hw/virtio/virtio-crypto-pci.c b/hw/virtio/virtio-crypto-pci.c
index 8699481375..868abc03a9 100644
--- a/hw/virtio/virtio-crypto-pci.c
+++ b/hw/virtio/virtio-crypto-pci.c
@@ -59,7 +59,7 @@ static void virtio_crypto_pci_realize(VirtIOPCIProxy *vpci_dev, Error **errp)
     }
 }
 
-static void virtio_crypto_pci_class_init(ObjectClass *klass, void *data)
+static void virtio_crypto_pci_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtioPCIClass *k = VIRTIO_PCI_CLASS(klass);
diff --git a/hw/virtio/virtio-crypto.c b/hw/virtio/virtio-crypto.c
index a1b3c90618..e24d6914b6 100644
--- a/hw/virtio/virtio-crypto.c
+++ b/hw/virtio/virtio-crypto.c
@@ -1264,7 +1264,7 @@ static struct vhost_dev *virtio_crypto_get_vhost(VirtIODevice *vdev)
     return &vhost_crypto->dev;
 }
 
-static void virtio_crypto_class_init(ObjectClass *klass, void *data)
+static void virtio_crypto_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
diff --git a/hw/virtio/virtio-input-pci.c b/hw/virtio/virtio-input-pci.c
index 9e3c106777..3be5358b4c 100644
--- a/hw/virtio/virtio-input-pci.c
+++ b/hw/virtio/virtio-input-pci.c
@@ -50,7 +50,7 @@ static void virtio_input_pci_realize(VirtIOPCIProxy *vpci_dev, Error **errp)
     qdev_realize(vdev, BUS(&vpci_dev->bus), errp);
 }
 
-static void virtio_input_pci_class_init(ObjectClass *klass, void *data)
+static void virtio_input_pci_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtioPCIClass *k = VIRTIO_PCI_CLASS(klass);
@@ -63,7 +63,8 @@ static void virtio_input_pci_class_init(ObjectClass *klass, void *data)
     pcidev_k->class_id = PCI_CLASS_INPUT_OTHER;
 }
 
-static void virtio_input_hid_kbd_pci_class_init(ObjectClass *klass, void *data)
+static void virtio_input_hid_kbd_pci_class_init(ObjectClass *klass,
+                                                const void *data)
 {
     PCIDeviceClass *pcidev_k = PCI_DEVICE_CLASS(klass);
 
@@ -71,7 +72,7 @@ static void virtio_input_hid_kbd_pci_class_init(ObjectClass *klass, void *data)
 }
 
 static void virtio_input_hid_mouse_pci_class_init(ObjectClass *klass,
-                                                  void *data)
+                                                  const void *data)
 {
     PCIDeviceClass *pcidev_k = PCI_DEVICE_CLASS(klass);
 
diff --git a/hw/virtio/virtio-iommu-pci.c b/hw/virtio/virtio-iommu-pci.c
index 97e03ce803..8123c6f83a 100644
--- a/hw/virtio/virtio-iommu-pci.c
+++ b/hw/virtio/virtio-iommu-pci.c
@@ -73,7 +73,7 @@ static void virtio_iommu_pci_realize(VirtIOPCIProxy *vpci_dev, Error **errp)
     qdev_realize(vdev, BUS(&vpci_dev->bus), errp);
 }
 
-static void virtio_iommu_pci_class_init(ObjectClass *klass, void *data)
+static void virtio_iommu_pci_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtioPCIClass *k = VIRTIO_PCI_CLASS(klass);
diff --git a/hw/virtio/virtio-iommu.c b/hw/virtio/virtio-iommu.c
index b6e7e01ef7..54060988ef 100644
--- a/hw/virtio/virtio-iommu.c
+++ b/hw/virtio/virtio-iommu.c
@@ -1664,7 +1664,7 @@ static const Property virtio_iommu_properties[] = {
     DEFINE_PROP_UINT8("aw-bits", VirtIOIOMMU, aw_bits, 64),
 };
 
-static void virtio_iommu_class_init(ObjectClass *klass, void *data)
+static void virtio_iommu_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
@@ -1690,7 +1690,7 @@ static void virtio_iommu_class_init(ObjectClass *klass, void *data)
 }
 
 static void virtio_iommu_memory_region_class_init(ObjectClass *klass,
-                                                  void *data)
+                                                  const void *data)
 {
     IOMMUMemoryRegionClass *imrc = IOMMU_MEMORY_REGION_CLASS(klass);
 
diff --git a/hw/virtio/virtio-mem-pci.c b/hw/virtio/virtio-mem-pci.c
index 6cc5f0fd3b..f592eb1a78 100644
--- a/hw/virtio/virtio-mem-pci.c
+++ b/hw/virtio/virtio-mem-pci.c
@@ -163,7 +163,7 @@ static const Property virtio_mem_pci_class_properties[] = {
                        DEV_NVECTORS_UNSPECIFIED),
 };
 
-static void virtio_mem_pci_class_init(ObjectClass *klass, void *data)
+static void virtio_mem_pci_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtioPCIClass *k = VIRTIO_PCI_CLASS(klass);
diff --git a/hw/virtio/virtio-mem.c b/hw/virtio/virtio-mem.c
index c7968ee0c6..0e14dd37d6 100644
--- a/hw/virtio/virtio-mem.c
+++ b/hw/virtio/virtio-mem.c
@@ -1865,7 +1865,7 @@ static void virtio_mem_unplug_request_check(VirtIOMEM *vmem, Error **errp)
     }
 }
 
-static void virtio_mem_class_init(ObjectClass *klass, void *data)
+static void virtio_mem_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
@@ -1957,7 +1957,8 @@ static void virtio_mem_system_reset_hold(Object *obj, ResetType type)
     virtio_mem_unplug_all(vmem);
 }
 
-static void virtio_mem_system_reset_class_init(ObjectClass *klass, void *data)
+static void virtio_mem_system_reset_class_init(ObjectClass *klass,
+                                               const void *data)
 {
     ResettableClass *rc = RESETTABLE_CLASS(klass);
 
diff --git a/hw/virtio/virtio-mmio.c b/hw/virtio/virtio-mmio.c
index 029817139b..532c67107b 100644
--- a/hw/virtio/virtio-mmio.c
+++ b/hw/virtio/virtio-mmio.c
@@ -784,7 +784,7 @@ static void virtio_mmio_realizefn(DeviceState *d, Error **errp)
     sysbus_init_mmio(sbd, &proxy->iomem);
 }
 
-static void virtio_mmio_class_init(ObjectClass *klass, void *data)
+static void virtio_mmio_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -855,7 +855,7 @@ static void virtio_mmio_vmstate_change(DeviceState *d, bool running)
     }
 }
 
-static void virtio_mmio_bus_class_init(ObjectClass *klass, void *data)
+static void virtio_mmio_bus_class_init(ObjectClass *klass, const void *data)
 {
     BusClass *bus_class = BUS_CLASS(klass);
     VirtioBusClass *k = VIRTIO_BUS_CLASS(klass);
diff --git a/hw/virtio/virtio-net-pci.c b/hw/virtio/virtio-net-pci.c
index e18953ad67..8cf9788bc3 100644
--- a/hw/virtio/virtio-net-pci.c
+++ b/hw/virtio/virtio-net-pci.c
@@ -63,7 +63,7 @@ static void virtio_net_pci_realize(VirtIOPCIProxy *vpci_dev, Error **errp)
     qdev_realize(vdev, BUS(&vpci_dev->bus), errp);
 }
 
-static void virtio_net_pci_class_init(ObjectClass *klass, void *data)
+static void virtio_net_pci_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
diff --git a/hw/virtio/virtio-nsm-pci.c b/hw/virtio/virtio-nsm-pci.c
index dca797315a..ec243963e1 100644
--- a/hw/virtio/virtio-nsm-pci.c
+++ b/hw/virtio/virtio-nsm-pci.c
@@ -40,7 +40,7 @@ static void virtio_nsm_pci_realize(VirtIOPCIProxy *vpci_dev, Error **errp)
     }
 }
 
-static void virtio_nsm_pci_class_init(ObjectClass *klass, void *data)
+static void virtio_nsm_pci_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtioPCIClass *k = VIRTIO_PCI_CLASS(klass);
diff --git a/hw/virtio/virtio-nsm.c b/hw/virtio/virtio-nsm.c
index accf7334e3..3bf5e7009a 100644
--- a/hw/virtio/virtio-nsm.c
+++ b/hw/virtio/virtio-nsm.c
@@ -1708,7 +1708,7 @@ static const Property virtio_nsm_properties[] = {
     DEFINE_PROP_STRING("module-id", VirtIONSM, module_id),
 };
 
-static void virtio_nsm_class_init(ObjectClass *klass, void *data)
+static void virtio_nsm_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
diff --git a/hw/virtio/virtio-pci.c b/hw/virtio/virtio-pci.c
index 3ca3f849d3..c0fd3db063 100644
--- a/hw/virtio/virtio-pci.c
+++ b/hw/virtio/virtio-pci.c
@@ -2399,7 +2399,7 @@ static int virtio_pci_sync_config(DeviceState *dev, Error **errp)
     return qdev_sync_config(DEVICE(vdev), errp);
 }
 
-static void virtio_pci_class_init(ObjectClass *klass, void *data)
+static void virtio_pci_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
@@ -2433,7 +2433,7 @@ static const Property virtio_pci_generic_properties[] = {
     DEFINE_PROP_BOOL("disable-modern", VirtIOPCIProxy, disable_modern, false),
 };
 
-static void virtio_pci_base_class_init(ObjectClass *klass, void *data)
+static void virtio_pci_base_class_init(ObjectClass *klass, const void *data)
 {
     const VirtioPCIDeviceTypeInfo *t = data;
     if (t->class_init) {
@@ -2441,7 +2441,7 @@ static void virtio_pci_base_class_init(ObjectClass *klass, void *data)
     }
 }
 
-static void virtio_pci_generic_class_init(ObjectClass *klass, void *data)
+static void virtio_pci_generic_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -2586,7 +2586,7 @@ static void virtio_pci_bus_new(VirtioBusState *bus, size_t bus_size,
     qbus_init(bus, bus_size, TYPE_VIRTIO_PCI_BUS, qdev, virtio_bus_name);
 }
 
-static void virtio_pci_bus_class_init(ObjectClass *klass, void *data)
+static void virtio_pci_bus_class_init(ObjectClass *klass, const void *data)
 {
     BusClass *bus_class = BUS_CLASS(klass);
     VirtioBusClass *k = VIRTIO_BUS_CLASS(klass);
diff --git a/hw/virtio/virtio-pmem-pci.c b/hw/virtio/virtio-pmem-pci.c
index cfe7f3b67c..babd91c21f 100644
--- a/hw/virtio/virtio-pmem-pci.c
+++ b/hw/virtio/virtio-pmem-pci.c
@@ -80,7 +80,7 @@ static void virtio_pmem_pci_fill_device_info(const MemoryDeviceState *md,
     info->type = MEMORY_DEVICE_INFO_KIND_VIRTIO_PMEM;
 }
 
-static void virtio_pmem_pci_class_init(ObjectClass *klass, void *data)
+static void virtio_pmem_pci_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtioPCIClass *k = VIRTIO_PCI_CLASS(klass);
diff --git a/hw/virtio/virtio-pmem.c b/hw/virtio/virtio-pmem.c
index adb3268bd4..3416ea1827 100644
--- a/hw/virtio/virtio-pmem.c
+++ b/hw/virtio/virtio-pmem.c
@@ -161,7 +161,7 @@ static const Property virtio_pmem_properties[] = {
                      TYPE_MEMORY_BACKEND, HostMemoryBackend *),
 };
 
-static void virtio_pmem_class_init(ObjectClass *klass, void *data)
+static void virtio_pmem_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
diff --git a/hw/virtio/virtio-rng-pci.c b/hw/virtio/virtio-rng-pci.c
index a94ff767b2..39b600356e 100644
--- a/hw/virtio/virtio-rng-pci.c
+++ b/hw/virtio/virtio-rng-pci.c
@@ -53,7 +53,7 @@ static void virtio_rng_pci_realize(VirtIOPCIProxy *vpci_dev, Error **errp)
     }
 }
 
-static void virtio_rng_pci_class_init(ObjectClass *klass, void *data)
+static void virtio_rng_pci_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtioPCIClass *k = VIRTIO_PCI_CLASS(klass);
diff --git a/hw/virtio/virtio-rng.c b/hw/virtio/virtio-rng.c
index a515fc5cd9..dcb3c71d6a 100644
--- a/hw/virtio/virtio-rng.c
+++ b/hw/virtio/virtio-rng.c
@@ -260,7 +260,7 @@ static const Property virtio_rng_properties[] = {
     DEFINE_PROP_LINK("rng", VirtIORNG, conf.rng, TYPE_RNG_BACKEND, RngBackend *),
 };
 
-static void virtio_rng_class_init(ObjectClass *klass, void *data)
+static void virtio_rng_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
diff --git a/hw/virtio/virtio-scsi-pci.c b/hw/virtio/virtio-scsi-pci.c
index d44fd2fffb..af87759207 100644
--- a/hw/virtio/virtio-scsi-pci.c
+++ b/hw/virtio/virtio-scsi-pci.c
@@ -72,7 +72,7 @@ static void virtio_scsi_pci_realize(VirtIOPCIProxy *vpci_dev, Error **errp)
     qdev_realize(vdev, BUS(&vpci_dev->bus), errp);
 }
 
-static void virtio_scsi_pci_class_init(ObjectClass *klass, void *data)
+static void virtio_scsi_pci_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtioPCIClass *k = VIRTIO_PCI_CLASS(klass);
diff --git a/hw/virtio/virtio-serial-pci.c b/hw/virtio/virtio-serial-pci.c
index b5b77eb266..3f212ffe52 100644
--- a/hw/virtio/virtio-serial-pci.c
+++ b/hw/virtio/virtio-serial-pci.c
@@ -76,7 +76,7 @@ static const Property virtio_serial_pci_properties[] = {
     DEFINE_PROP_UINT32("class", VirtIOPCIProxy, class_code, 0),
 };
 
-static void virtio_serial_pci_class_init(ObjectClass *klass, void *data)
+static void virtio_serial_pci_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtioPCIClass *k = VIRTIO_PCI_CLASS(klass);
diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
index ffc12635ae..f0fa36f8ce 100644
--- a/hw/virtio/virtio.c
+++ b/hw/virtio/virtio.c
@@ -4138,7 +4138,7 @@ void virtio_device_release_ioeventfd(VirtIODevice *vdev)
     virtio_bus_release_ioeventfd(vbus);
 }
 
-static void virtio_device_class_init(ObjectClass *klass, void *data)
+static void virtio_device_class_init(ObjectClass *klass, const void *data)
 {
     /* Set the default value here. */
     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
diff --git a/hw/vmapple/aes.c b/hw/vmapple/aes.c
index 3a7641ab4b..a4853a98f8 100644
--- a/hw/vmapple/aes.c
+++ b/hw/vmapple/aes.c
@@ -558,7 +558,7 @@ static void aes_init(Object *obj)
     s->as = &address_space_memory;
 }
 
-static void aes_class_init(ObjectClass *klass, void *data)
+static void aes_class_init(ObjectClass *klass, const void *data)
 {
     ResettableClass *rc = RESETTABLE_CLASS(klass);
 
diff --git a/hw/vmapple/bdif.c b/hw/vmapple/bdif.c
index 5827dd2aab..5ccd374581 100644
--- a/hw/vmapple/bdif.c
+++ b/hw/vmapple/bdif.c
@@ -250,7 +250,7 @@ static const Property bdif_properties[] = {
     DEFINE_PROP_DRIVE("root", VMAppleBdifState, root),
 };
 
-static void bdif_class_init(ObjectClass *klass, void *data)
+static void bdif_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/vmapple/cfg.c b/hw/vmapple/cfg.c
index 63414d801f..3d58a29f69 100644
--- a/hw/vmapple/cfg.c
+++ b/hw/vmapple/cfg.c
@@ -168,7 +168,7 @@ static const Property vmapple_cfg_properties[] = {
     DEFINE_PROP_STRING("soc_name", VMAppleCfgState, soc_name),
 };
 
-static void vmapple_cfg_class_init(ObjectClass *klass, void *data)
+static void vmapple_cfg_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     ResettableClass *rc = RESETTABLE_CLASS(klass);
diff --git a/hw/vmapple/virtio-blk.c b/hw/vmapple/virtio-blk.c
index aa3f18c47d..532b5649ab 100644
--- a/hw/vmapple/virtio-blk.c
+++ b/hw/vmapple/virtio-blk.c
@@ -82,7 +82,7 @@ static void vmapple_virtio_blk_get_config(VirtIODevice *vdev, uint8_t *config)
     stl_he_p(&blkcfg->max_secure_erase_sectors, dev->apple_type);
 }
 
-static void vmapple_virtio_blk_class_init(ObjectClass *klass, void *data)
+static void vmapple_virtio_blk_class_init(ObjectClass *klass, const void *data)
 {
     VirtIOBlkClass *vbk = VIRTIO_BLK_CLASS(klass);
     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
@@ -165,7 +165,8 @@ static void vmapple_virtio_blk_pci_realize(VirtIOPCIProxy *vpci_dev, Error **err
                              PCI_DEVICE_ID_APPLE_VIRTIO_BLK);
 }
 
-static void vmapple_virtio_blk_pci_class_init(ObjectClass *klass, void *data)
+static void vmapple_virtio_blk_pci_class_init(ObjectClass *klass,
+                                              const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtioPCIClass *k = VIRTIO_PCI_CLASS(klass);
diff --git a/hw/vmapple/vmapple.c b/hw/vmapple/vmapple.c
index fa117bf151..16e6110b68 100644
--- a/hw/vmapple/vmapple.c
+++ b/hw/vmapple/vmapple.c
@@ -570,7 +570,7 @@ static GlobalProperty vmapple_compat_defaults[] = {
     { TYPE_XHCI_PCI, "conditional-intr-mapping", "on" },
 };
 
-static void vmapple_machine_class_init(ObjectClass *oc, void *data)
+static void vmapple_machine_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
 
diff --git a/hw/watchdog/allwinner-wdt.c b/hw/watchdog/allwinner-wdt.c
index 78f4f9d6f6..8fcd776675 100644
--- a/hw/watchdog/allwinner-wdt.c
+++ b/hw/watchdog/allwinner-wdt.c
@@ -348,7 +348,7 @@ static void allwinner_wdt_realize(DeviceState *dev, Error **errp)
     ptimer_transaction_commit(s->timer);
 }
 
-static void allwinner_wdt_class_init(ObjectClass *klass, void *data)
+static void allwinner_wdt_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     ResettableClass *rc = RESETTABLE_CLASS(klass);
@@ -358,7 +358,7 @@ static void allwinner_wdt_class_init(ObjectClass *klass, void *data)
     dc->vmsd = &allwinner_wdt_vmstate;
 }
 
-static void allwinner_wdt_sun4i_class_init(ObjectClass *klass, void *data)
+static void allwinner_wdt_sun4i_class_init(ObjectClass *klass, const void *data)
 {
     AwWdtClass *awc = AW_WDT_CLASS(klass);
 
@@ -371,7 +371,7 @@ static void allwinner_wdt_sun4i_class_init(ObjectClass *klass, void *data)
     awc->get_intv_value = allwinner_wdt_sun4i_get_intv_value;
 }
 
-static void allwinner_wdt_sun6i_class_init(ObjectClass *klass, void *data)
+static void allwinner_wdt_sun6i_class_init(ObjectClass *klass, const void *data)
 {
     AwWdtClass *awc = AW_WDT_CLASS(klass);
 
diff --git a/hw/watchdog/cmsdk-apb-watchdog.c b/hw/watchdog/cmsdk-apb-watchdog.c
index a52121dc44..6a8d07ca56 100644
--- a/hw/watchdog/cmsdk-apb-watchdog.c
+++ b/hw/watchdog/cmsdk-apb-watchdog.c
@@ -394,7 +394,7 @@ static const VMStateDescription cmsdk_apb_watchdog_vmstate = {
     }
 };
 
-static void cmsdk_apb_watchdog_class_init(ObjectClass *klass, void *data)
+static void cmsdk_apb_watchdog_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/watchdog/sbsa_gwdt.c b/hw/watchdog/sbsa_gwdt.c
index 1dd21392a9..ce84849df0 100644
--- a/hw/watchdog/sbsa_gwdt.c
+++ b/hw/watchdog/sbsa_gwdt.c
@@ -271,7 +271,7 @@ static const Property wdt_sbsa_gwdt_props[] = {
                        62500000),
 };
 
-static void wdt_sbsa_gwdt_class_init(ObjectClass *klass, void *data)
+static void wdt_sbsa_gwdt_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/watchdog/spapr_watchdog.c b/hw/watchdog/spapr_watchdog.c
index 2bb1d3c532..5b3f50de3a 100644
--- a/hw/watchdog/spapr_watchdog.c
+++ b/hw/watchdog/spapr_watchdog.c
@@ -249,7 +249,7 @@ static void spapr_wdt_realize(DeviceState *dev, Error **errp)
                                   &w->leave_others, OBJ_PROP_FLAG_READ);
 }
 
-static void spapr_wdt_class_init(ObjectClass *oc, void *data)
+static void spapr_wdt_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
diff --git a/hw/watchdog/wdt_aspeed.c b/hw/watchdog/wdt_aspeed.c
index a503b2aea7..30226435ef 100644
--- a/hw/watchdog/wdt_aspeed.c
+++ b/hw/watchdog/wdt_aspeed.c
@@ -307,7 +307,7 @@ static const Property aspeed_wdt_properties[] = {
                      AspeedSCUState *),
 };
 
-static void aspeed_wdt_class_init(ObjectClass *klass, void *data)
+static void aspeed_wdt_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -329,7 +329,7 @@ static const TypeInfo aspeed_wdt_info = {
     .abstract      = true,
 };
 
-static void aspeed_2400_wdt_class_init(ObjectClass *klass, void *data)
+static void aspeed_2400_wdt_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     AspeedWDTClass *awc = ASPEED_WDT_CLASS(klass);
@@ -366,7 +366,7 @@ static void aspeed_2500_wdt_reset_pulse(AspeedWDTState *s, uint32_t property)
     }
 }
 
-static void aspeed_2500_wdt_class_init(ObjectClass *klass, void *data)
+static void aspeed_2500_wdt_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     AspeedWDTClass *awc = ASPEED_WDT_CLASS(klass);
@@ -389,7 +389,7 @@ static const TypeInfo aspeed_2500_wdt_info = {
     .class_init = aspeed_2500_wdt_class_init,
 };
 
-static void aspeed_2600_wdt_class_init(ObjectClass *klass, void *data)
+static void aspeed_2600_wdt_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     AspeedWDTClass *awc = ASPEED_WDT_CLASS(klass);
@@ -412,7 +412,7 @@ static const TypeInfo aspeed_2600_wdt_info = {
     .class_init = aspeed_2600_wdt_class_init,
 };
 
-static void aspeed_1030_wdt_class_init(ObjectClass *klass, void *data)
+static void aspeed_1030_wdt_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     AspeedWDTClass *awc = ASPEED_WDT_CLASS(klass);
@@ -435,7 +435,7 @@ static const TypeInfo aspeed_1030_wdt_info = {
     .class_init = aspeed_1030_wdt_class_init,
 };
 
-static void aspeed_2700_wdt_class_init(ObjectClass *klass, void *data)
+static void aspeed_2700_wdt_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     AspeedWDTClass *awc = ASPEED_WDT_CLASS(klass);
diff --git a/hw/watchdog/wdt_diag288.c b/hw/watchdog/wdt_diag288.c
index 39f2894f21..1275353e8e 100644
--- a/hw/watchdog/wdt_diag288.c
+++ b/hw/watchdog/wdt_diag288.c
@@ -108,7 +108,7 @@ static void wdt_diag288_unrealize(DeviceState *dev)
     timer_free(diag288->timer);
 }
 
-static void wdt_diag288_class_init(ObjectClass *klass, void *data)
+static void wdt_diag288_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     DIAG288Class *diag288 = DIAG288_CLASS(klass);
diff --git a/hw/watchdog/wdt_i6300esb.c b/hw/watchdog/wdt_i6300esb.c
index aa1d0866c8..1536e1fe03 100644
--- a/hw/watchdog/wdt_i6300esb.c
+++ b/hw/watchdog/wdt_i6300esb.c
@@ -457,7 +457,7 @@ static void i6300esb_exit(PCIDevice *dev)
     timer_free(d->timer);
 }
 
-static void i6300esb_class_init(ObjectClass *klass, void *data)
+static void i6300esb_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
diff --git a/hw/watchdog/wdt_ib700.c b/hw/watchdog/wdt_ib700.c
index 23519e058e..51a26a4cbb 100644
--- a/hw/watchdog/wdt_ib700.c
+++ b/hw/watchdog/wdt_ib700.c
@@ -128,7 +128,7 @@ static void wdt_ib700_reset(DeviceState *dev)
     timer_del(s->timer);
 }
 
-static void wdt_ib700_class_init(ObjectClass *klass, void *data)
+static void wdt_ib700_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/watchdog/wdt_imx2.c b/hw/watchdog/wdt_imx2.c
index 18e40bd466..10151a15d0 100644
--- a/hw/watchdog/wdt_imx2.c
+++ b/hw/watchdog/wdt_imx2.c
@@ -286,7 +286,7 @@ static const Property imx2_wdt_properties[] = {
                      false),
 };
 
-static void imx2_wdt_class_init(ObjectClass *klass, void *data)
+static void imx2_wdt_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/hw/xen/xen-bus.c b/hw/xen/xen-bus.c
index f808a01813..e6272282cd 100644
--- a/hw/xen/xen-bus.c
+++ b/hw/xen/xen-bus.c
@@ -380,7 +380,7 @@ static void xen_bus_unplug_request(HotplugHandler *hotplug,
     xen_device_unplug(xendev, errp);
 }
 
-static void xen_bus_class_init(ObjectClass *class, void *data)
+static void xen_bus_class_init(ObjectClass *class, const void *data)
 {
     BusClass *bus_class = BUS_CLASS(class);
     HotplugHandlerClass *hotplug_class = HOTPLUG_HANDLER_CLASS(class);
@@ -1107,7 +1107,7 @@ static const Property xen_device_props[] = {
                        DOMID_INVALID),
 };
 
-static void xen_device_class_init(ObjectClass *class, void *data)
+static void xen_device_class_init(ObjectClass *class, const void *data)
 {
     DeviceClass *dev_class = DEVICE_CLASS(class);
 
diff --git a/hw/xen/xen-legacy-backend.c b/hw/xen/xen-legacy-backend.c
index bf58db0ca6..d6fe7d4f3e 100644
--- a/hw/xen/xen-legacy-backend.c
+++ b/hw/xen/xen-legacy-backend.c
@@ -635,7 +635,7 @@ int xen_be_bind_evtchn(struct XenLegacyDevice *xendev)
 }
 
 
-static void xendev_class_init(ObjectClass *klass, void *data)
+static void xendev_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -650,7 +650,7 @@ static const TypeInfo xendev_type_info = {
     .instance_size = sizeof(XenLegacyDevice),
 };
 
-static void xen_sysbus_class_init(ObjectClass *klass, void *data)
+static void xen_sysbus_class_init(ObjectClass *klass, const void *data)
 {
     HotplugHandlerClass *hc = HOTPLUG_HANDLER_CLASS(klass);
 
diff --git a/hw/xen/xen-pvh-common.c b/hw/xen/xen-pvh-common.c
index d675f7a8ae..b93ff80c85 100644
--- a/hw/xen/xen-pvh-common.c
+++ b/hw/xen/xen-pvh-common.c
@@ -369,7 +369,7 @@ do {                                                                      \
 #endif
 }
 
-static void xen_pvh_class_init(ObjectClass *oc, void *data)
+static void xen_pvh_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
 
diff --git a/hw/xen/xen_pt.c b/hw/xen/xen_pt.c
index 9487f68f2e..7f9c351d96 100644
--- a/hw/xen/xen_pt.c
+++ b/hw/xen/xen_pt.c
@@ -1047,7 +1047,7 @@ static void xen_igd_clear_slot(DeviceState *qdev, Error **errp)
     xpdc->pci_qdev_realize(qdev, errp);
 }
 
-static void xen_pci_passthrough_class_init(ObjectClass *klass, void *data)
+static void xen_pci_passthrough_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
diff --git a/hw/xen/xen_pt_graphics.c b/hw/xen/xen_pt_graphics.c
index 6c2e3f4840..264851ece3 100644
--- a/hw/xen/xen_pt_graphics.c
+++ b/hw/xen/xen_pt_graphics.c
@@ -347,7 +347,7 @@ static const IGDDeviceIDInfo igd_combo_id_infos[] = {
     {0x162D, 0x9cc3, 0x03}, /* BDWGT3SRVR, BDWM_w7 */
 };
 
-static void isa_bridge_class_init(ObjectClass *klass, void *data)
+static void isa_bridge_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
diff --git a/hw/xtensa/xtfpga.c b/hw/xtensa/xtfpga.c
index 3bd0ef8268..6efffae466 100644
--- a/hw/xtensa/xtfpga.c
+++ b/hw/xtensa/xtfpga.c
@@ -585,7 +585,7 @@ static void xtfpga_kc705_nommu_init(MachineState *machine)
     xtfpga_init(&kc705_board, machine);
 }
 
-static void xtfpga_lx60_class_init(ObjectClass *oc, void *data)
+static void xtfpga_lx60_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
 
@@ -602,7 +602,7 @@ static const TypeInfo xtfpga_lx60_type = {
     .class_init = xtfpga_lx60_class_init,
 };
 
-static void xtfpga_lx60_nommu_class_init(ObjectClass *oc, void *data)
+static void xtfpga_lx60_nommu_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
 
@@ -619,7 +619,7 @@ static const TypeInfo xtfpga_lx60_nommu_type = {
     .class_init = xtfpga_lx60_nommu_class_init,
 };
 
-static void xtfpga_lx200_class_init(ObjectClass *oc, void *data)
+static void xtfpga_lx200_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
 
@@ -636,7 +636,7 @@ static const TypeInfo xtfpga_lx200_type = {
     .class_init = xtfpga_lx200_class_init,
 };
 
-static void xtfpga_lx200_nommu_class_init(ObjectClass *oc, void *data)
+static void xtfpga_lx200_nommu_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
 
@@ -653,7 +653,7 @@ static const TypeInfo xtfpga_lx200_nommu_type = {
     .class_init = xtfpga_lx200_nommu_class_init,
 };
 
-static void xtfpga_ml605_class_init(ObjectClass *oc, void *data)
+static void xtfpga_ml605_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
 
@@ -670,7 +670,7 @@ static const TypeInfo xtfpga_ml605_type = {
     .class_init = xtfpga_ml605_class_init,
 };
 
-static void xtfpga_ml605_nommu_class_init(ObjectClass *oc, void *data)
+static void xtfpga_ml605_nommu_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
 
@@ -687,7 +687,7 @@ static const TypeInfo xtfpga_ml605_nommu_type = {
     .class_init = xtfpga_ml605_nommu_class_init,
 };
 
-static void xtfpga_kc705_class_init(ObjectClass *oc, void *data)
+static void xtfpga_kc705_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
 
@@ -704,7 +704,7 @@ static const TypeInfo xtfpga_kc705_type = {
     .class_init = xtfpga_kc705_class_init,
 };
 
-static void xtfpga_kc705_nommu_class_init(ObjectClass *oc, void *data)
+static void xtfpga_kc705_nommu_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
 
diff --git a/include/hw/boards.h b/include/hw/boards.h
index 8556e01e21..765dc8dd35 100644
--- a/include/hw/boards.h
+++ b/include/hw/boards.h
@@ -745,7 +745,7 @@ struct MachineState {
     } while (0)
 
 #define DEFINE_MACHINE(namestr, machine_initfn) \
-    static void machine_initfn##_class_init(ObjectClass *oc, void *data) \
+    static void machine_initfn##_class_init(ObjectClass *oc, const void *data) \
     { \
         MachineClass *mc = MACHINE_CLASS(oc); \
         machine_initfn(mc); \
diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
index 8677dc8950..9563674e2d 100644
--- a/include/hw/i386/pc.h
+++ b/include/hw/i386/pc.h
@@ -306,7 +306,8 @@ extern GlobalProperty pc_compat_2_4[];
 extern const size_t pc_compat_2_4_len;
 
 #define DEFINE_PC_MACHINE(suffix, namestr, initfn, optsfn) \
-    static void pc_machine_##suffix##_class_init(ObjectClass *oc, void *data) \
+    static void pc_machine_##suffix##_class_init(ObjectClass *oc, \
+                                                 const void *data) \
     { \
         MachineClass *mc = MACHINE_CLASS(oc); \
         optsfn(mc); \
@@ -331,7 +332,7 @@ extern const size_t pc_compat_2_4_len;
     } \
     static void MACHINE_VER_SYM(class_init, namesym, __VA_ARGS__)( \
         ObjectClass *oc, \
-        void *data) \
+        const void *data) \
     { \
         MachineClass *mc = MACHINE_CLASS(oc); \
         MACHINE_VER_SYM(options, namesym, __VA_ARGS__)(mc); \
diff --git a/include/hw/virtio/virtio-pci.h b/include/hw/virtio/virtio-pci.h
index 971c5fabd4..567a9b0a9d 100644
--- a/include/hw/virtio/virtio-pci.h
+++ b/include/hw/virtio/virtio-pci.h
@@ -255,7 +255,7 @@ typedef struct VirtioPCIDeviceTypeInfo {
     size_t class_size;
     void (*instance_init)(Object *obj);
     void (*instance_finalize)(Object *obj);
-    void (*class_init)(ObjectClass *klass, void *data);
+    void (*class_init)(ObjectClass *klass, const void *data);
     InterfaceInfo *interfaces;
 } VirtioPCIDeviceTypeInfo;
 
diff --git a/include/qom/object.h b/include/qom/object.h
index 7bb14ca706..2fb86f00a6 100644
--- a/include/qom/object.h
+++ b/include/qom/object.h
@@ -280,7 +280,7 @@ struct Object
     static void \
     module_obj_name##_finalize(Object *obj); \
     static void \
-    module_obj_name##_class_init(ObjectClass *oc, void *data); \
+    module_obj_name##_class_init(ObjectClass *oc, const void *data); \
     static void \
     module_obj_name##_init(Object *obj); \
     \
@@ -486,7 +486,7 @@ struct TypeInfo
     bool abstract;
     size_t class_size;
 
-    void (*class_init)(ObjectClass *klass, void *data);
+    void (*class_init)(ObjectClass *klass, const void *data);
     void (*class_base_init)(ObjectClass *klass, const void *data);
     void *class_data;
 
diff --git a/io/channel-buffer.c b/io/channel-buffer.c
index 8096180f85..189fa67ac2 100644
--- a/io/channel-buffer.c
+++ b/io/channel-buffer.c
@@ -225,7 +225,7 @@ static GSource *qio_channel_buffer_create_watch(QIOChannel *ioc,
 
 
 static void qio_channel_buffer_class_init(ObjectClass *klass,
-                                          void *class_data G_GNUC_UNUSED)
+                                          const void *class_data G_GNUC_UNUSED)
 {
     QIOChannelClass *ioc_klass = QIO_CHANNEL_CLASS(klass);
 
diff --git a/io/channel-command.c b/io/channel-command.c
index 6d5f64e146..8966dd3a2b 100644
--- a/io/channel-command.c
+++ b/io/channel-command.c
@@ -358,7 +358,7 @@ static GSource *qio_channel_command_create_watch(QIOChannel *ioc,
 
 
 static void qio_channel_command_class_init(ObjectClass *klass,
-                                           void *class_data G_GNUC_UNUSED)
+                                           const void *class_data G_GNUC_UNUSED)
 {
     QIOChannelClass *ioc_klass = QIO_CHANNEL_CLASS(klass);
 
diff --git a/io/channel-file.c b/io/channel-file.c
index 2ea8d08360..ca3f180cc2 100644
--- a/io/channel-file.c
+++ b/io/channel-file.c
@@ -290,7 +290,7 @@ static GSource *qio_channel_file_create_watch(QIOChannel *ioc,
 }
 
 static void qio_channel_file_class_init(ObjectClass *klass,
-                                        void *class_data G_GNUC_UNUSED)
+                                        const void *class_data G_GNUC_UNUSED)
 {
     QIOChannelClass *ioc_klass = QIO_CHANNEL_CLASS(klass);
 
diff --git a/io/channel-null.c b/io/channel-null.c
index ef99586348..49f1c80a54 100644
--- a/io/channel-null.c
+++ b/io/channel-null.c
@@ -207,7 +207,7 @@ qio_channel_null_create_watch(QIOChannel *ioc,
 
 static void
 qio_channel_null_class_init(ObjectClass *klass,
-                            void *class_data G_GNUC_UNUSED)
+                            const void *class_data G_GNUC_UNUSED)
 {
     QIOChannelClass *ioc_klass = QIO_CHANNEL_CLASS(klass);
 
diff --git a/io/channel-socket.c b/io/channel-socket.c
index 608bcf066e..088b49ffdb 100644
--- a/io/channel-socket.c
+++ b/io/channel-socket.c
@@ -949,7 +949,7 @@ static GSource *qio_channel_socket_create_watch(QIOChannel *ioc,
 }
 
 static void qio_channel_socket_class_init(ObjectClass *klass,
-                                          void *class_data G_GNUC_UNUSED)
+                                          const void *class_data G_GNUC_UNUSED)
 {
     QIOChannelClass *ioc_klass = QIO_CHANNEL_CLASS(klass);
 
diff --git a/io/channel-tls.c b/io/channel-tls.c
index caf8301a9e..db2ac1deae 100644
--- a/io/channel-tls.c
+++ b/io/channel-tls.c
@@ -561,7 +561,7 @@ qio_channel_tls_get_session(QIOChannelTLS *ioc)
 }
 
 static void qio_channel_tls_class_init(ObjectClass *klass,
-                                       void *class_data G_GNUC_UNUSED)
+                                       const void *class_data G_GNUC_UNUSED)
 {
     QIOChannelClass *ioc_klass = QIO_CHANNEL_CLASS(klass);
 
diff --git a/io/channel-websock.c b/io/channel-websock.c
index 55192b770a..08ddb274f0 100644
--- a/io/channel-websock.c
+++ b/io/channel-websock.c
@@ -1308,7 +1308,7 @@ static GSource *qio_channel_websock_create_watch(QIOChannel *ioc,
 }
 
 static void qio_channel_websock_class_init(ObjectClass *klass,
-                                           void *class_data G_GNUC_UNUSED)
+                                           const void *class_data G_GNUC_UNUSED)
 {
     QIOChannelClass *ioc_klass = QIO_CHANNEL_CLASS(klass);
 
diff --git a/iothread.c b/iothread.c
index 589bcd3552..8810376dce 100644
--- a/iothread.c
+++ b/iothread.c
@@ -292,7 +292,7 @@ static void iothread_set_poll_param(Object *obj, Visitor *v,
     }
 }
 
-static void iothread_class_init(ObjectClass *klass, void *class_data)
+static void iothread_class_init(ObjectClass *klass, const void *class_data)
 {
     EventLoopBaseClass *bc = EVENT_LOOP_BASE_CLASS(klass);
 
diff --git a/migration/channel-block.c b/migration/channel-block.c
index b0477f5b6d..97de5a691b 100644
--- a/migration/channel-block.c
+++ b/migration/channel-block.c
@@ -170,7 +170,7 @@ qio_channel_block_set_aio_fd_handler(QIOChannel *ioc,
 
 static void
 qio_channel_block_class_init(ObjectClass *klass,
-                             void *class_data G_GNUC_UNUSED)
+                             const void *class_data G_GNUC_UNUSED)
 {
     QIOChannelClass *ioc_klass = QIO_CHANNEL_CLASS(klass);
 
diff --git a/migration/migration.c b/migration/migration.c
index d46e776e24..55ec4bfab6 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -4016,7 +4016,7 @@ fail:
     migration_cleanup(s);
 }
 
-static void migration_class_init(ObjectClass *klass, void *data)
+static void migration_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
diff --git a/migration/rdma.c b/migration/rdma.c
index d9603ab603..b31652baac 100644
--- a/migration/rdma.c
+++ b/migration/rdma.c
@@ -3985,7 +3985,7 @@ static void qio_channel_rdma_finalize(Object *obj)
 }
 
 static void qio_channel_rdma_class_init(ObjectClass *klass,
-                                        void *class_data G_GNUC_UNUSED)
+                                        const void *class_data G_GNUC_UNUSED)
 {
     QIOChannelClass *ioc_klass = QIO_CHANNEL_CLASS(klass);
 
diff --git a/net/can/can_core.c b/net/can/can_core.c
index 0115d78794..e16e15c036 100644
--- a/net/can/can_core.c
+++ b/net/can/can_core.c
@@ -149,7 +149,7 @@ static bool can_bus_can_be_deleted(UserCreatable *uc)
 }
 
 static void can_bus_class_init(ObjectClass *klass,
-                                void *class_data G_GNUC_UNUSED)
+                               const void *class_data G_GNUC_UNUSED)
 {
     UserCreatableClass *uc_klass = USER_CREATABLE_CLASS(klass);
 
diff --git a/net/can/can_host.c b/net/can/can_host.c
index b2fe553f91..ca5fcf1ea1 100644
--- a/net/can/can_host.c
+++ b/net/can/can_host.c
@@ -72,7 +72,7 @@ static void can_host_complete(UserCreatable *uc, Error **errp)
 }
 
 static void can_host_class_init(ObjectClass *klass,
-                                void *class_data G_GNUC_UNUSED)
+                                const void *class_data G_GNUC_UNUSED)
 {
     UserCreatableClass *uc_klass = USER_CREATABLE_CLASS(klass);
 
diff --git a/net/can/can_socketcan.c b/net/can/can_socketcan.c
index c1a1ad0563..8a57ae0717 100644
--- a/net/can/can_socketcan.c
+++ b/net/can/can_socketcan.c
@@ -308,7 +308,7 @@ static void can_host_socketcan_instance_init(Object *obj)
 }
 
 static void can_host_socketcan_class_init(ObjectClass *klass,
-                                          void *class_data G_GNUC_UNUSED)
+                                          const void *class_data G_GNUC_UNUSED)
 {
     CanHostClass *chc = CAN_HOST_CLASS(klass);
 
diff --git a/net/colo-compare.c b/net/colo-compare.c
index 893beed528..425eb6e971 100644
--- a/net/colo-compare.c
+++ b/net/colo-compare.c
@@ -1352,7 +1352,7 @@ static void colo_flush_packets(void *opaque, void *user_data)
     }
 }
 
-static void colo_compare_class_init(ObjectClass *oc, void *data)
+static void colo_compare_class_init(ObjectClass *oc, const void *data)
 {
     UserCreatableClass *ucc = USER_CREATABLE_CLASS(oc);
 
diff --git a/net/dump.c b/net/dump.c
index 140215aa10..581234b775 100644
--- a/net/dump.c
+++ b/net/dump.c
@@ -234,7 +234,7 @@ static void filter_dump_instance_finalize(Object *obj)
     g_free(nfds->filename);
 }
 
-static void filter_dump_class_init(ObjectClass *oc, void *data)
+static void filter_dump_class_init(ObjectClass *oc, const void *data)
 {
     NetFilterClass *nfc = NETFILTER_CLASS(oc);
 
diff --git a/net/filter-buffer.c b/net/filter-buffer.c
index 283dc9cbe6..a36be31dc8 100644
--- a/net/filter-buffer.c
+++ b/net/filter-buffer.c
@@ -172,7 +172,7 @@ static void filter_buffer_set_interval(Object *obj, Visitor *v,
     s->interval = value;
 }
 
-static void filter_buffer_class_init(ObjectClass *oc, void *data)
+static void filter_buffer_class_init(ObjectClass *oc, const void *data)
 {
     NetFilterClass *nfc = NETFILTER_CLASS(oc);
 
diff --git a/net/filter-mirror.c b/net/filter-mirror.c
index 34a63b5dbb..27734c91a7 100644
--- a/net/filter-mirror.c
+++ b/net/filter-mirror.c
@@ -410,7 +410,7 @@ static void filter_redirector_set_vnet_hdr(Object *obj,
     s->vnet_hdr = value;
 }
 
-static void filter_mirror_class_init(ObjectClass *oc, void *data)
+static void filter_mirror_class_init(ObjectClass *oc, const void *data)
 {
     NetFilterClass *nfc = NETFILTER_CLASS(oc);
 
@@ -425,7 +425,7 @@ static void filter_mirror_class_init(ObjectClass *oc, void *data)
     nfc->receive_iov = filter_mirror_receive_iov;
 }
 
-static void filter_redirector_class_init(ObjectClass *oc, void *data)
+static void filter_redirector_class_init(ObjectClass *oc, const void *data)
 {
     NetFilterClass *nfc = NETFILTER_CLASS(oc);
 
diff --git a/net/filter-replay.c b/net/filter-replay.c
index 81b71afe35..451663c5a5 100644
--- a/net/filter-replay.c
+++ b/net/filter-replay.c
@@ -65,7 +65,7 @@ static void filter_replay_instance_finalize(Object *obj)
     replay_unregister_net(nfrs->rns);
 }
 
-static void filter_replay_class_init(ObjectClass *oc, void *data)
+static void filter_replay_class_init(ObjectClass *oc, const void *data)
 {
     NetFilterClass *nfc = NETFILTER_CLASS(oc);
 
diff --git a/net/filter-rewriter.c b/net/filter-rewriter.c
index c18c4c2019..cdf85aa5ee 100644
--- a/net/filter-rewriter.c
+++ b/net/filter-rewriter.c
@@ -411,7 +411,7 @@ static void filter_rewriter_init(Object *obj)
     s->failover_mode = FAILOVER_MODE_OFF;
 }
 
-static void colo_rewriter_class_init(ObjectClass *oc, void *data)
+static void colo_rewriter_class_init(ObjectClass *oc, const void *data)
 {
     NetFilterClass *nfc = NETFILTER_CLASS(oc);
 
diff --git a/net/filter.c b/net/filter.c
index 3335908771..03b3c793f7 100644
--- a/net/filter.c
+++ b/net/filter.c
@@ -333,7 +333,7 @@ static void default_handle_event(NetFilterState *nf, int event, Error **errp)
     }
 }
 
-static void netfilter_class_init(ObjectClass *oc, void *data)
+static void netfilter_class_init(ObjectClass *oc, const void *data)
 {
     UserCreatableClass *ucc = USER_CREATABLE_CLASS(oc);
     NetFilterClass *nfc = NETFILTER_CLASS(oc);
diff --git a/qom/object.c b/qom/object.c
index dfd59502d1..06d7367032 100644
--- a/qom/object.c
+++ b/qom/object.c
@@ -54,7 +54,7 @@ struct TypeImpl
     size_t instance_size;
     size_t instance_align;
 
-    void (*class_init)(ObjectClass *klass, void *data);
+    void (*class_init)(ObjectClass *klass, const void *data);
     void (*class_base_init)(ObjectClass *klass, const void *data);
 
     void *class_data;
@@ -2891,7 +2891,7 @@ void object_class_property_set_description(ObjectClass *klass,
     op->description = g_strdup(description);
 }
 
-static void object_class_init(ObjectClass *klass, void *data)
+static void object_class_init(ObjectClass *klass, const void *data)
 {
     object_class_property_add_str(klass, "type", object_get_type,
                                   NULL);
diff --git a/rust/qemu-api/src/qom.rs b/rust/qemu-api/src/qom.rs
index 03fe6247ff..f385cb7275 100644
--- a/rust/qemu-api/src/qom.rs
+++ b/rust/qemu-api/src/qom.rs
@@ -227,7 +227,7 @@ unsafe extern "C" fn rust_instance_post_init<T: ObjectImpl>(obj: *mut bindings::
 
 unsafe extern "C" fn rust_class_init<T: ObjectType + ObjectImpl>(
     klass: *mut ObjectClass,
-    _data: *mut c_void,
+    _data: *const c_void,
 ) {
     let mut klass = NonNull::new(klass)
         .unwrap()
diff --git a/scripts/codeconverter/codeconverter/qom_type_info.py b/scripts/codeconverter/codeconverter/qom_type_info.py
index f92c3a4730..22a2556076 100644
--- a/scripts/codeconverter/codeconverter/qom_type_info.py
+++ b/scripts/codeconverter/codeconverter/qom_type_info.py
@@ -798,7 +798,8 @@ class RedundantTypeSizes(TypeInfoVar):
 #
 #
 #            if 'class_init' not in fields:
-#                yield self.prepend(('static void %s_class_init(ObjectClass *oc, void *data)\n'
+#                yield self.prepend(('static void %s_class_init(ObjectClass *oc,\n'
+#                                                              'const void *data)\n'
 #                                    '{\n'
 #                                    '}\n\n') % (ids.lowercase))
 #                yield self.append_field('class_init', ids.lowercase+'_class_init')
diff --git a/scsi/pr-manager-helper.c b/scsi/pr-manager-helper.c
index 3be52a98d5..6b86f01b01 100644
--- a/scsi/pr-manager-helper.c
+++ b/scsi/pr-manager-helper.c
@@ -300,7 +300,7 @@ static void pr_manager_helper_instance_init(Object *obj)
 }
 
 static void pr_manager_helper_class_init(ObjectClass *klass,
-                                         void *class_data G_GNUC_UNUSED)
+                                         const void *class_data G_GNUC_UNUSED)
 {
     PRManagerClass *prmgr_klass = PR_MANAGER_CLASS(klass);
     UserCreatableClass *uc_klass = USER_CREATABLE_CLASS(klass);
diff --git a/system/qtest.c b/system/qtest.c
index 523a047995..b7689088a4 100644
--- a/system/qtest.c
+++ b/system/qtest.c
@@ -994,7 +994,7 @@ static char *qtest_get_chardev(Object *obj, Error **errp)
     return g_strdup(q->chr_name);
 }
 
-static void qtest_class_init(ObjectClass *oc, void *data)
+static void qtest_class_init(ObjectClass *oc, const void *data)
 {
     UserCreatableClass *ucc = USER_CREATABLE_CLASS(oc);
 
diff --git a/target/alpha/cpu.c b/target/alpha/cpu.c
index 35fb145d27..27e2008a4e 100644
--- a/target/alpha/cpu.c
+++ b/target/alpha/cpu.c
@@ -258,7 +258,7 @@ static const TCGCPUOps alpha_tcg_ops = {
 #endif /* !CONFIG_USER_ONLY */
 };
 
-static void alpha_cpu_class_init(ObjectClass *oc, void *data)
+static void alpha_cpu_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     CPUClass *cc = CPU_CLASS(oc);
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index 377791c84d..81257f20fd 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -2699,7 +2699,7 @@ static const TCGCPUOps arm_tcg_ops = {
 };
 #endif /* CONFIG_TCG */
 
-static void arm_cpu_class_init(ObjectClass *oc, void *data)
+static void arm_cpu_class_init(ObjectClass *oc, const void *data)
 {
     ARMCPUClass *acc = ARM_CPU_CLASS(oc);
     CPUClass *cc = CPU_CLASS(acc);
@@ -2740,7 +2740,7 @@ static void arm_cpu_instance_init(Object *obj)
     arm_cpu_post_init(obj);
 }
 
-static void cpu_register_class_init(ObjectClass *oc, void *data)
+static void cpu_register_class_init(ObjectClass *oc, const void *data)
 {
     ARMCPUClass *acc = ARM_CPU_CLASS(oc);
     CPUClass *cc = CPU_CLASS(acc);
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index 3705b34285..fdcf8cd1ae 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -1123,7 +1123,7 @@ typedef struct ARMCPUInfo {
     const char *name;
     const char *deprecation_note;
     void (*initfn)(Object *obj);
-    void (*class_init)(ObjectClass *oc, void *data);
+    void (*class_init)(ObjectClass *oc, const void *data);
 } ARMCPUInfo;
 
 /**
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index 8188ede5cc..1184c92b4c 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -818,7 +818,7 @@ static const gchar *aarch64_gdb_arch_name(CPUState *cs)
     return "aarch64";
 }
 
-static void aarch64_cpu_class_init(ObjectClass *oc, void *data)
+static void aarch64_cpu_class_init(ObjectClass *oc, const void *data)
 {
     CPUClass *cc = CPU_CLASS(oc);
 
@@ -842,7 +842,7 @@ static void aarch64_cpu_instance_init(Object *obj)
     arm_cpu_post_init(obj);
 }
 
-static void cpu_register_class_init(ObjectClass *oc, void *data)
+static void cpu_register_class_init(ObjectClass *oc, const void *data)
 {
     ARMCPUClass *acc = ARM_CPU_CLASS(oc);
 
diff --git a/target/arm/tcg/cpu-v7m.c b/target/arm/tcg/cpu-v7m.c
index f71560aa43..7426aac0dc 100644
--- a/target/arm/tcg/cpu-v7m.c
+++ b/target/arm/tcg/cpu-v7m.c
@@ -259,7 +259,7 @@ static const TCGCPUOps arm_v7m_tcg_ops = {
 #endif /* !CONFIG_USER_ONLY */
 };
 
-static void arm_v7m_class_init(ObjectClass *oc, void *data)
+static void arm_v7m_class_init(ObjectClass *oc, const void *data)
 {
     ARMCPUClass *acc = ARM_CPU_CLASS(oc);
     CPUClass *cc = CPU_CLASS(oc);
diff --git a/target/avr/cpu.c b/target/avr/cpu.c
index 84f3b839c9..3f261c6fec 100644
--- a/target/avr/cpu.c
+++ b/target/avr/cpu.c
@@ -237,7 +237,7 @@ static const TCGCPUOps avr_tcg_ops = {
     .do_interrupt = avr_cpu_do_interrupt,
 };
 
-static void avr_cpu_class_init(ObjectClass *oc, void *data)
+static void avr_cpu_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     CPUClass *cc = CPU_CLASS(oc);
diff --git a/target/hexagon/cpu.c b/target/hexagon/cpu.c
index 3c5191282e..a5d31c33bd 100644
--- a/target/hexagon/cpu.c
+++ b/target/hexagon/cpu.c
@@ -335,7 +335,7 @@ static const TCGCPUOps hexagon_tcg_ops = {
     .mmu_index = hexagon_cpu_mmu_index,
 };
 
-static void hexagon_cpu_class_init(ObjectClass *c, void *data)
+static void hexagon_cpu_class_init(ObjectClass *c, const void *data)
 {
     HexagonCPUClass *mcc = HEXAGON_CPU_CLASS(c);
     CPUClass *cc = CPU_CLASS(c);
diff --git a/target/hppa/cpu.c b/target/hppa/cpu.c
index 10e18c945e..b792cb247a 100644
--- a/target/hppa/cpu.c
+++ b/target/hppa/cpu.c
@@ -278,7 +278,7 @@ static const TCGCPUOps hppa_tcg_ops = {
 #endif /* !CONFIG_USER_ONLY */
 };
 
-static void hppa_cpu_class_init(ObjectClass *oc, void *data)
+static void hppa_cpu_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     CPUClass *cc = CPU_CLASS(oc);
diff --git a/target/i386/confidential-guest.c b/target/i386/confidential-guest.c
index b3727845ad..cfb71bf034 100644
--- a/target/i386/confidential-guest.c
+++ b/target/i386/confidential-guest.c
@@ -20,7 +20,7 @@ OBJECT_DEFINE_ABSTRACT_TYPE(X86ConfidentialGuest,
                             X86_CONFIDENTIAL_GUEST,
                             CONFIDENTIAL_GUEST_SUPPORT)
 
-static void x86_confidential_guest_class_init(ObjectClass *oc, void *data)
+static void x86_confidential_guest_class_init(ObjectClass *oc, const void *data)
 {
 }
 
diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 955295fe79..6f21d5ed22 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -5703,7 +5703,7 @@ static void max_x86_cpu_realize(DeviceState *dev, Error **errp)
     x86_cpu_realizefn(dev, errp);
 }
 
-static void max_x86_cpu_class_init(ObjectClass *oc, void *data)
+static void max_x86_cpu_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     X86CPUClass *xcc = X86_CPU_CLASS(oc);
@@ -6702,7 +6702,7 @@ static const gchar *x86_gdb_arch_name(CPUState *cs)
 #endif
 }
 
-static void x86_cpu_cpudef_class_init(ObjectClass *oc, void *data)
+static void x86_cpu_cpudef_class_init(ObjectClass *oc, const void *data)
 {
     const X86CPUModel *model = data;
     X86CPUClass *xcc = X86_CPU_CLASS(oc);
@@ -8886,7 +8886,7 @@ static const struct SysemuCPUOps i386_sysemu_ops = {
 };
 #endif
 
-static void x86_cpu_common_class_init(ObjectClass *oc, void *data)
+static void x86_cpu_common_class_init(ObjectClass *oc, const void *data)
 {
     X86CPUClass *xcc = X86_CPU_CLASS(oc);
     CPUClass *cc = CPU_CLASS(oc);
@@ -8986,7 +8986,7 @@ static const TypeInfo x86_cpu_type_info = {
 };
 
 /* "base" CPU model, used by query-cpu-model-expansion */
-static void x86_cpu_base_class_init(ObjectClass *oc, void *data)
+static void x86_cpu_base_class_init(ObjectClass *oc, const void *data)
 {
     X86CPUClass *xcc = X86_CPU_CLASS(oc);
 
diff --git a/target/i386/host-cpu.c b/target/i386/host-cpu.c
index 072731a4dd..a2d3830f5b 100644
--- a/target/i386/host-cpu.c
+++ b/target/i386/host-cpu.c
@@ -161,7 +161,7 @@ void host_cpu_max_instance_init(X86CPU *cpu)
                             &error_abort);
 }
 
-static void host_cpu_class_init(ObjectClass *oc, void *data)
+static void host_cpu_class_init(ObjectClass *oc, const void *data)
 {
     X86CPUClass *xcc = X86_CPU_CLASS(oc);
 
diff --git a/target/i386/hvf/hvf-cpu.c b/target/i386/hvf/hvf-cpu.c
index b5f4c80028..dfdda70126 100644
--- a/target/i386/hvf/hvf-cpu.c
+++ b/target/i386/hvf/hvf-cpu.c
@@ -74,7 +74,7 @@ static void hvf_cpu_instance_init(CPUState *cs)
     hvf_cpu_xsave_init();
 }
 
-static void hvf_cpu_accel_class_init(ObjectClass *oc, void *data)
+static void hvf_cpu_accel_class_init(ObjectClass *oc, const void *data)
 {
     AccelCPUClass *acc = ACCEL_CPU_CLASS(oc);
 
diff --git a/target/i386/kvm/kvm-cpu.c b/target/i386/kvm/kvm-cpu.c
index 6269fa8045..16bde4de01 100644
--- a/target/i386/kvm/kvm-cpu.c
+++ b/target/i386/kvm/kvm-cpu.c
@@ -223,7 +223,7 @@ static void kvm_cpu_instance_init(CPUState *cs)
     kvm_cpu_xsave_init();
 }
 
-static void kvm_cpu_accel_class_init(ObjectClass *oc, void *data)
+static void kvm_cpu_accel_class_init(ObjectClass *oc, const void *data)
 {
     AccelCPUClass *acc = ACCEL_CPU_CLASS(oc);
 
diff --git a/target/i386/nvmm/nvmm-accel-ops.c b/target/i386/nvmm/nvmm-accel-ops.c
index 4e4e63de78..21443078b7 100644
--- a/target/i386/nvmm/nvmm-accel-ops.c
+++ b/target/i386/nvmm/nvmm-accel-ops.c
@@ -81,7 +81,7 @@ static void nvmm_kick_vcpu_thread(CPUState *cpu)
     cpus_kick_thread(cpu);
 }
 
-static void nvmm_accel_ops_class_init(ObjectClass *oc, void *data)
+static void nvmm_accel_ops_class_init(ObjectClass *oc, const void *data)
 {
     AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
 
diff --git a/target/i386/nvmm/nvmm-all.c b/target/i386/nvmm/nvmm-all.c
index 17394d073d..f1c6120ccf 100644
--- a/target/i386/nvmm/nvmm-all.c
+++ b/target/i386/nvmm/nvmm-all.c
@@ -1200,7 +1200,7 @@ nvmm_enabled(void)
 }
 
 static void
-nvmm_accel_class_init(ObjectClass *oc, void *data)
+nvmm_accel_class_init(ObjectClass *oc, const void *data)
 {
     AccelClass *ac = ACCEL_CLASS(oc);
     ac->name = "NVMM";
diff --git a/target/i386/sev.c b/target/i386/sev.c
index 878dd20f2c..7ef4801d5f 100644
--- a/target/i386/sev.c
+++ b/target/i386/sev.c
@@ -2046,7 +2046,7 @@ static void sev_common_set_kernel_hashes(Object *obj, bool value, Error **errp)
 }
 
 static void
-sev_common_class_init(ObjectClass *oc, void *data)
+sev_common_class_init(ObjectClass *oc, const void *data)
 {
     ConfidentialGuestSupportClass *klass = CONFIDENTIAL_GUEST_SUPPORT_CLASS(oc);
 
@@ -2141,7 +2141,7 @@ static void sev_guest_set_legacy_vm_type(Object *obj, Visitor *v,
 }
 
 static void
-sev_guest_class_init(ObjectClass *oc, void *data)
+sev_guest_class_init(ObjectClass *oc, const void *data)
 {
     SevCommonStateClass *klass = SEV_COMMON_CLASS(oc);
     X86ConfidentialGuestClass *x86_klass = X86_CONFIDENTIAL_GUEST_CLASS(oc);
@@ -2395,7 +2395,7 @@ sev_snp_guest_set_host_data(Object *obj, const char *value, Error **errp)
 }
 
 static void
-sev_snp_guest_class_init(ObjectClass *oc, void *data)
+sev_snp_guest_class_init(ObjectClass *oc, const void *data)
 {
     SevCommonStateClass *klass = SEV_COMMON_CLASS(oc);
     X86ConfidentialGuestClass *x86_klass = X86_CONFIDENTIAL_GUEST_CLASS(oc);
diff --git a/target/i386/tcg/tcg-cpu.c b/target/i386/tcg/tcg-cpu.c
index 621502c984..e53aaa31bf 100644
--- a/target/i386/tcg/tcg-cpu.c
+++ b/target/i386/tcg/tcg-cpu.c
@@ -193,7 +193,7 @@ static void x86_tcg_cpu_instance_init(CPUState *cs)
     x86_tcg_cpu_xsave_init();
 }
 
-static void x86_tcg_cpu_accel_class_init(ObjectClass *oc, void *data)
+static void x86_tcg_cpu_accel_class_init(ObjectClass *oc, const void *data)
 {
     AccelCPUClass *acc = ACCEL_CPU_CLASS(oc);
 
diff --git a/target/i386/whpx/whpx-accel-ops.c b/target/i386/whpx/whpx-accel-ops.c
index 81fdd06e48..b8bebe403c 100644
--- a/target/i386/whpx/whpx-accel-ops.c
+++ b/target/i386/whpx/whpx-accel-ops.c
@@ -83,7 +83,7 @@ static bool whpx_vcpu_thread_is_idle(CPUState *cpu)
     return !whpx_apic_in_platform();
 }
 
-static void whpx_accel_ops_class_init(ObjectClass *oc, void *data)
+static void whpx_accel_ops_class_init(ObjectClass *oc, const void *data)
 {
     AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
 
diff --git a/target/i386/whpx/whpx-all.c b/target/i386/whpx/whpx-all.c
index 2e1c03b20e..cf6d3e4cdd 100644
--- a/target/i386/whpx/whpx-all.c
+++ b/target/i386/whpx/whpx-all.c
@@ -2698,7 +2698,7 @@ bool whpx_apic_in_platform(void) {
     return whpx_global.apic_in_platform;
 }
 
-static void whpx_accel_class_init(ObjectClass *oc, void *data)
+static void whpx_accel_class_init(ObjectClass *oc, const void *data)
 {
     AccelClass *ac = ACCEL_CLASS(oc);
     ac->name = "WHPX";
diff --git a/target/i386/whpx/whpx-apic.c b/target/i386/whpx/whpx-apic.c
index 630a9616d7..e1ef6d4e6d 100644
--- a/target/i386/whpx/whpx-apic.c
+++ b/target/i386/whpx/whpx-apic.c
@@ -252,7 +252,7 @@ static void whpx_apic_realize(DeviceState *dev, Error **errp)
     msi_nonbroken = true;
 }
 
-static void whpx_apic_class_init(ObjectClass *klass, void *data)
+static void whpx_apic_class_init(ObjectClass *klass, const void *data)
 {
     APICCommonClass *k = APIC_COMMON_CLASS(klass);
 
diff --git a/target/loongarch/cpu.c b/target/loongarch/cpu.c
index 0e6c89eb1b..8ad45b453d 100644
--- a/target/loongarch/cpu.c
+++ b/target/loongarch/cpu.c
@@ -908,7 +908,7 @@ static const Property loongarch_cpu_properties[] = {
     DEFINE_PROP_INT32("node-id", LoongArchCPU, node_id, CPU_UNSET_NUMA_NODE_ID),
 };
 
-static void loongarch_cpu_class_init(ObjectClass *c, void *data)
+static void loongarch_cpu_class_init(ObjectClass *c, const void *data)
 {
     LoongArchCPUClass *lacc = LOONGARCH_CPU_CLASS(c);
     CPUClass *cc = CPU_CLASS(c);
@@ -948,7 +948,7 @@ static const gchar *loongarch32_gdb_arch_name(CPUState *cs)
     return "loongarch32";
 }
 
-static void loongarch32_cpu_class_init(ObjectClass *c, void *data)
+static void loongarch32_cpu_class_init(ObjectClass *c, const void *data)
 {
     CPUClass *cc = CPU_CLASS(c);
 
@@ -961,7 +961,7 @@ static const gchar *loongarch64_gdb_arch_name(CPUState *cs)
     return "loongarch64";
 }
 
-static void loongarch64_cpu_class_init(ObjectClass *c, void *data)
+static void loongarch64_cpu_class_init(ObjectClass *c, const void *data)
 {
     CPUClass *cc = CPU_CLASS(c);
 
diff --git a/target/m68k/cpu.c b/target/m68k/cpu.c
index 99adc5eb91..6f33b86c7d 100644
--- a/target/m68k/cpu.c
+++ b/target/m68k/cpu.c
@@ -607,7 +607,7 @@ static const TCGCPUOps m68k_tcg_ops = {
 #endif /* !CONFIG_USER_ONLY */
 };
 
-static void m68k_cpu_class_init(ObjectClass *c, void *data)
+static void m68k_cpu_class_init(ObjectClass *c, const void *data)
 {
     M68kCPUClass *mcc = M68K_CPU_CLASS(c);
     CPUClass *cc = CPU_CLASS(c);
@@ -634,7 +634,7 @@ static void m68k_cpu_class_init(ObjectClass *c, void *data)
     cc->tcg_ops = &m68k_tcg_ops;
 }
 
-static void m68k_cpu_class_init_cf_core(ObjectClass *c, void *data)
+static void m68k_cpu_class_init_cf_core(ObjectClass *c, const void *data)
 {
     CPUClass *cc = CPU_CLASS(c);
 
@@ -649,7 +649,7 @@ static void m68k_cpu_class_init_cf_core(ObjectClass *c, void *data)
         .class_init = m68k_cpu_class_init_cf_core    \
     }
 
-static void m68k_cpu_class_init_m68k_core(ObjectClass *c, void *data)
+static void m68k_cpu_class_init_m68k_core(ObjectClass *c, const void *data)
 {
     CPUClass *cc = CPU_CLASS(c);
 
diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
index edfb05758b..00a2730de4 100644
--- a/target/microblaze/cpu.c
+++ b/target/microblaze/cpu.c
@@ -447,7 +447,7 @@ static const TCGCPUOps mb_tcg_ops = {
 #endif /* !CONFIG_USER_ONLY */
 };
 
-static void mb_cpu_class_init(ObjectClass *oc, void *data)
+static void mb_cpu_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     CPUClass *cc = CPU_CLASS(oc);
diff --git a/target/mips/cpu.c b/target/mips/cpu.c
index 473cecdebc..29611a0a1c 100644
--- a/target/mips/cpu.c
+++ b/target/mips/cpu.c
@@ -572,7 +572,7 @@ static const TCGCPUOps mips_tcg_ops = {
 };
 #endif /* CONFIG_TCG */
 
-static void mips_cpu_class_init(ObjectClass *c, void *data)
+static void mips_cpu_class_init(ObjectClass *c, const void *data)
 {
     MIPSCPUClass *mcc = MIPS_CPU_CLASS(c);
     CPUClass *cc = CPU_CLASS(c);
@@ -613,7 +613,7 @@ static const TypeInfo mips_cpu_type_info = {
     .class_init = mips_cpu_class_init,
 };
 
-static void mips_cpu_cpudef_class_init(ObjectClass *oc, void *data)
+static void mips_cpu_cpudef_class_init(ObjectClass *oc, const void *data)
 {
     MIPSCPUClass *mcc = MIPS_CPU_CLASS(oc);
     mcc->cpu_def = data;
diff --git a/target/openrisc/cpu.c b/target/openrisc/cpu.c
index 6601e0c066..2ec267efec 100644
--- a/target/openrisc/cpu.c
+++ b/target/openrisc/cpu.c
@@ -260,7 +260,7 @@ static const TCGCPUOps openrisc_tcg_ops = {
 #endif /* !CONFIG_USER_ONLY */
 };
 
-static void openrisc_cpu_class_init(ObjectClass *oc, void *data)
+static void openrisc_cpu_class_init(ObjectClass *oc, const void *data)
 {
     OpenRISCCPUClass *occ = OPENRISC_CPU_CLASS(oc);
     CPUClass *cc = CPU_CLASS(occ);
diff --git a/target/ppc/cpu-models.c b/target/ppc/cpu-models.c
index ece3481781..ea86ea202a 100644
--- a/target/ppc/cpu-models.c
+++ b/target/ppc/cpu-models.c
@@ -35,7 +35,7 @@
 #define POWERPC_DEF_SVR(_name, _desc, _pvr, _svr, _type)                    \
     static void                                                             \
     glue(POWERPC_DEF_PREFIX(_pvr, _svr, _type), _cpu_class_init)            \
-    (ObjectClass *oc, void *data)                                           \
+    (ObjectClass *oc, const void *data)                                     \
     {                                                                       \
         DeviceClass *dc = DEVICE_CLASS(oc);                                 \
         PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);                       \
diff --git a/target/ppc/cpu.h b/target/ppc/cpu.h
index f4cc823c5c..13115a89ff 100644
--- a/target/ppc/cpu.h
+++ b/target/ppc/cpu.h
@@ -3047,7 +3047,8 @@ static inline int check_attn_none(CPUPPCState *env)
 
 #define POWERPC_FAMILY(_name)                                               \
     static void                                                             \
-    glue(glue(ppc_, _name), _cpu_family_class_init)(ObjectClass *, void *); \
+    glue(glue(ppc_, _name), _cpu_family_class_init)(ObjectClass *,          \
+                                                    const void *);          \
                                                                             \
     static const TypeInfo                                                   \
     glue(glue(ppc_, _name), _cpu_family_type_info) = {                      \
diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
index 077991ed53..90b21b9c93 100644
--- a/target/ppc/cpu_init.c
+++ b/target/ppc/cpu_init.c
@@ -2167,7 +2167,7 @@ static void init_proc_405(CPUPPCState *env)
     SET_WDT_PERIOD(16, 20, 24, 28);
 }
 
-POWERPC_FAMILY(405)(ObjectClass *oc, void *data)
+POWERPC_FAMILY(405)(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
@@ -2235,7 +2235,7 @@ static void init_proc_440EP(CPUPPCState *env)
     SET_WDT_PERIOD(20, 24, 28, 32);
 }
 
-POWERPC_FAMILY(440EP)(ObjectClass *oc, void *data)
+POWERPC_FAMILY(440EP)(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
@@ -2274,7 +2274,7 @@ POWERPC_FAMILY(440EP)(ObjectClass *oc, void *data)
                  POWERPC_FLAG_DE | POWERPC_FLAG_BUS_CLK;
 }
 
-POWERPC_FAMILY(460EX)(ObjectClass *oc, void *data)
+POWERPC_FAMILY(460EX)(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
@@ -2329,7 +2329,7 @@ static void init_proc_440GP(CPUPPCState *env)
     SET_WDT_PERIOD(20, 24, 28, 32);
 }
 
-POWERPC_FAMILY(440GP)(ObjectClass *oc, void *data)
+POWERPC_FAMILY(440GP)(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
@@ -2399,7 +2399,7 @@ static void init_proc_440x5(CPUPPCState *env)
     SET_WDT_PERIOD(20, 24, 28, 32);
 }
 
-POWERPC_FAMILY(440x5)(ObjectClass *oc, void *data)
+POWERPC_FAMILY(440x5)(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
@@ -2435,7 +2435,7 @@ POWERPC_FAMILY(440x5)(ObjectClass *oc, void *data)
                  POWERPC_FLAG_DE | POWERPC_FLAG_BUS_CLK;
 }
 
-POWERPC_FAMILY(440x5wDFPU)(ObjectClass *oc, void *data)
+POWERPC_FAMILY(440x5wDFPU)(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
@@ -2484,7 +2484,7 @@ static void init_proc_MPC5xx(CPUPPCState *env)
     /* XXX: TODO: allocate internal IRQ controller */
 }
 
-POWERPC_FAMILY(MPC5xx)(ObjectClass *oc, void *data)
+POWERPC_FAMILY(MPC5xx)(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
@@ -2527,7 +2527,7 @@ static void init_proc_MPC8xx(CPUPPCState *env)
     /* XXX: TODO: allocate internal IRQ controller */
 }
 
-POWERPC_FAMILY(MPC8xx)(ObjectClass *oc, void *data)
+POWERPC_FAMILY(MPC8xx)(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
@@ -2578,7 +2578,7 @@ static void init_proc_G2(CPUPPCState *env)
     ppc6xx_irq_init(env_archcpu(env));
 }
 
-POWERPC_FAMILY(G2)(ObjectClass *oc, void *data)
+POWERPC_FAMILY(G2)(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
@@ -2617,7 +2617,7 @@ POWERPC_FAMILY(G2)(ObjectClass *oc, void *data)
                  POWERPC_FLAG_BE | POWERPC_FLAG_BUS_CLK;
 }
 
-POWERPC_FAMILY(G2LE)(ObjectClass *oc, void *data)
+POWERPC_FAMILY(G2LE)(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
@@ -2752,7 +2752,7 @@ static void init_proc_e200(CPUPPCState *env)
     /* XXX: TODO: allocate internal IRQ controller */
 }
 
-POWERPC_FAMILY(e200)(ObjectClass *oc, void *data)
+POWERPC_FAMILY(e200)(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
@@ -3045,7 +3045,7 @@ static void init_proc_e500v1(CPUPPCState *env)
     init_proc_e500(env, fsl_e500v1);
 }
 
-POWERPC_FAMILY(e500v1)(ObjectClass *oc, void *data)
+POWERPC_FAMILY(e500v1)(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
@@ -3089,7 +3089,7 @@ static void init_proc_e500v2(CPUPPCState *env)
     init_proc_e500(env, fsl_e500v2);
 }
 
-POWERPC_FAMILY(e500v2)(ObjectClass *oc, void *data)
+POWERPC_FAMILY(e500v2)(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
@@ -3133,7 +3133,7 @@ static void init_proc_e500mc(CPUPPCState *env)
     init_proc_e500(env, fsl_e500mc);
 }
 
-POWERPC_FAMILY(e500mc)(ObjectClass *oc, void *data)
+POWERPC_FAMILY(e500mc)(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
@@ -3180,7 +3180,7 @@ static void init_proc_e5500(CPUPPCState *env)
     init_proc_e500(env, fsl_e5500);
 }
 
-POWERPC_FAMILY(e5500)(ObjectClass *oc, void *data)
+POWERPC_FAMILY(e5500)(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
@@ -3229,7 +3229,7 @@ static void init_proc_e6500(CPUPPCState *env)
     init_proc_e500(env, fsl_e6500);
 }
 
-POWERPC_FAMILY(e6500)(ObjectClass *oc, void *data)
+POWERPC_FAMILY(e6500)(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
@@ -3292,7 +3292,7 @@ static void init_proc_603(CPUPPCState *env)
     ppc6xx_irq_init(env_archcpu(env));
 }
 
-POWERPC_FAMILY(603)(ObjectClass *oc, void *data)
+POWERPC_FAMILY(603)(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
@@ -3332,7 +3332,7 @@ POWERPC_FAMILY(603)(ObjectClass *oc, void *data)
                  POWERPC_FLAG_BE | POWERPC_FLAG_BUS_CLK;
 }
 
-POWERPC_FAMILY(603E)(ObjectClass *oc, void *data)
+POWERPC_FAMILY(603E)(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
@@ -3378,7 +3378,7 @@ static void init_proc_e300(CPUPPCState *env)
     register_e300_sprs(env);
 }
 
-POWERPC_FAMILY(e300)(ObjectClass *oc, void *data)
+POWERPC_FAMILY(e300)(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
@@ -3434,7 +3434,7 @@ static void init_proc_604(CPUPPCState *env)
     ppc6xx_irq_init(env_archcpu(env));
 }
 
-POWERPC_FAMILY(604)(ObjectClass *oc, void *data)
+POWERPC_FAMILY(604)(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
@@ -3480,7 +3480,7 @@ static void init_proc_604E(CPUPPCState *env)
     register_604e_sprs(env);
 }
 
-POWERPC_FAMILY(604E)(ObjectClass *oc, void *data)
+POWERPC_FAMILY(604E)(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
@@ -3537,7 +3537,7 @@ static void init_proc_740(CPUPPCState *env)
     ppc6xx_irq_init(env_archcpu(env));
 }
 
-POWERPC_FAMILY(740)(ObjectClass *oc, void *data)
+POWERPC_FAMILY(740)(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
@@ -3603,7 +3603,7 @@ static void init_proc_750(CPUPPCState *env)
     ppc6xx_irq_init(env_archcpu(env));
 }
 
-POWERPC_FAMILY(750)(ObjectClass *oc, void *data)
+POWERPC_FAMILY(750)(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
@@ -3750,7 +3750,7 @@ static void init_proc_750cl(CPUPPCState *env)
     ppc6xx_irq_init(env_archcpu(env));
 }
 
-POWERPC_FAMILY(750cl)(ObjectClass *oc, void *data)
+POWERPC_FAMILY(750cl)(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
@@ -3858,7 +3858,7 @@ static void init_proc_750cx(CPUPPCState *env)
     ppc6xx_irq_init(env_archcpu(env));
 }
 
-POWERPC_FAMILY(750cx)(ObjectClass *oc, void *data)
+POWERPC_FAMILY(750cx)(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
@@ -3931,7 +3931,7 @@ static void init_proc_750fx(CPUPPCState *env)
     ppc6xx_irq_init(env_archcpu(env));
 }
 
-POWERPC_FAMILY(750fx)(ObjectClass *oc, void *data)
+POWERPC_FAMILY(750fx)(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
@@ -4004,7 +4004,7 @@ static void init_proc_750gx(CPUPPCState *env)
     ppc6xx_irq_init(env_archcpu(env));
 }
 
-POWERPC_FAMILY(750gx)(ObjectClass *oc, void *data)
+POWERPC_FAMILY(750gx)(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
@@ -4064,7 +4064,7 @@ static void init_proc_745(CPUPPCState *env)
     ppc6xx_irq_init(env_archcpu(env));
 }
 
-POWERPC_FAMILY(745)(ObjectClass *oc, void *data)
+POWERPC_FAMILY(745)(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
@@ -4110,7 +4110,7 @@ static void init_proc_755(CPUPPCState *env)
     register_755_sprs(env);
 }
 
-POWERPC_FAMILY(755)(ObjectClass *oc, void *data)
+POWERPC_FAMILY(755)(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
@@ -4177,7 +4177,7 @@ static void init_proc_7400(CPUPPCState *env)
     ppc6xx_irq_init(env_archcpu(env));
 }
 
-POWERPC_FAMILY(7400)(ObjectClass *oc, void *data)
+POWERPC_FAMILY(7400)(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
@@ -4257,7 +4257,7 @@ static void init_proc_7410(CPUPPCState *env)
     ppc6xx_irq_init(env_archcpu(env));
 }
 
-POWERPC_FAMILY(7410)(ObjectClass *oc, void *data)
+POWERPC_FAMILY(7410)(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
@@ -4358,7 +4358,7 @@ static void init_proc_7440(CPUPPCState *env)
     ppc6xx_irq_init(env_archcpu(env));
 }
 
-POWERPC_FAMILY(7440)(ObjectClass *oc, void *data)
+POWERPC_FAMILY(7440)(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
@@ -4481,7 +4481,7 @@ static void init_proc_7450(CPUPPCState *env)
     ppc6xx_irq_init(env_archcpu(env));
 }
 
-POWERPC_FAMILY(7450)(ObjectClass *oc, void *data)
+POWERPC_FAMILY(7450)(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
@@ -4611,7 +4611,7 @@ static void init_proc_7445(CPUPPCState *env)
     ppc6xx_irq_init(env_archcpu(env));
 }
 
-POWERPC_FAMILY(7445)(ObjectClass *oc, void *data)
+POWERPC_FAMILY(7445)(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
@@ -4743,7 +4743,7 @@ static void init_proc_7455(CPUPPCState *env)
     ppc6xx_irq_init(env_archcpu(env));
 }
 
-POWERPC_FAMILY(7455)(ObjectClass *oc, void *data)
+POWERPC_FAMILY(7455)(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
@@ -4895,7 +4895,7 @@ static void init_proc_7457(CPUPPCState *env)
     ppc6xx_irq_init(env_archcpu(env));
 }
 
-POWERPC_FAMILY(7457)(ObjectClass *oc, void *data)
+POWERPC_FAMILY(7457)(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
@@ -5030,7 +5030,7 @@ static void init_proc_e600(CPUPPCState *env)
     ppc6xx_irq_init(env_archcpu(env));
 }
 
-POWERPC_FAMILY(e600)(ObjectClass *oc, void *data)
+POWERPC_FAMILY(e600)(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
@@ -5995,7 +5995,7 @@ static void init_proc_970(CPUPPCState *env)
     ppc970_irq_init(env_archcpu(env));
 }
 
-POWERPC_FAMILY(970)(ObjectClass *oc, void *data)
+POWERPC_FAMILY(970)(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
@@ -6070,7 +6070,7 @@ static void init_proc_power5plus(CPUPPCState *env)
     ppc970_irq_init(env_archcpu(env));
 }
 
-POWERPC_FAMILY(POWER5P)(ObjectClass *oc, void *data)
+POWERPC_FAMILY(POWER5P)(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
@@ -6176,7 +6176,7 @@ static bool ppc_pvr_match_power7(PowerPCCPUClass *pcc, uint32_t pvr, bool best)
     return true;
 }
 
-POWERPC_FAMILY(POWER7)(ObjectClass *oc, void *data)
+POWERPC_FAMILY(POWER7)(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
@@ -6340,7 +6340,7 @@ static bool ppc_pvr_match_power8(PowerPCCPUClass *pcc, uint32_t pvr, bool best)
     return true;
 }
 
-POWERPC_FAMILY(POWER8)(ObjectClass *oc, void *data)
+POWERPC_FAMILY(POWER8)(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
@@ -6549,7 +6549,7 @@ static bool ppc_pvr_match_power9(PowerPCCPUClass *pcc, uint32_t pvr, bool best)
     return false;
 }
 
-POWERPC_FAMILY(POWER9)(ObjectClass *oc, void *data)
+POWERPC_FAMILY(POWER9)(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
@@ -6647,7 +6647,7 @@ static bool ppc_pvr_match_power10(PowerPCCPUClass *pcc, uint32_t pvr, bool best)
     return false;
 }
 
-POWERPC_FAMILY(POWER10)(ObjectClass *oc, void *data)
+POWERPC_FAMILY(POWER10)(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
@@ -6707,7 +6707,7 @@ static bool ppc_pvr_match_power11(PowerPCCPUClass *pcc, uint32_t pvr, bool best)
     return false;
 }
 
-POWERPC_FAMILY(POWER11)(ObjectClass *oc, void *data)
+POWERPC_FAMILY(POWER11)(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
@@ -7504,7 +7504,7 @@ static const TCGCPUOps ppc_tcg_ops = {
 };
 #endif /* CONFIG_TCG */
 
-static void ppc_cpu_class_init(ObjectClass *oc, void *data)
+static void ppc_cpu_class_init(ObjectClass *oc, const void *data)
 {
     PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
     CPUClass *cc = CPU_CLASS(oc);
diff --git a/target/ppc/kvm.c b/target/ppc/kvm.c
index 3fe54798c6..8a957c3c7d 100644
--- a/target/ppc/kvm.c
+++ b/target/ppc/kvm.c
@@ -2383,7 +2383,7 @@ static bool kvmppc_cpu_realize(CPUState *cs, Error **errp)
     return true;
 }
 
-static void kvmppc_host_cpu_class_init(ObjectClass *oc, void *data)
+static void kvmppc_host_cpu_class_init(ObjectClass *oc, const void *data)
 {
     PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
     uint32_t dcache_size = kvmppc_read_int_cpu_dt("d-cache-size");
@@ -3004,7 +3004,7 @@ void kvm_arch_accel_class_init(ObjectClass *oc)
 {
 }
 
-static void kvm_cpu_accel_class_init(ObjectClass *oc, void *data)
+static void kvm_cpu_accel_class_init(ObjectClass *oc, const void *data)
 {
     AccelCPUClass *acc = ACCEL_CPU_CLASS(oc);
 
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 2b830b3317..e0604f4c78 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -3028,7 +3028,7 @@ static const struct SysemuCPUOps riscv_sysemu_ops = {
 };
 #endif
 
-static void riscv_cpu_common_class_init(ObjectClass *c, void *data)
+static void riscv_cpu_common_class_init(ObjectClass *c, const void *data)
 {
     RISCVCPUClass *mcc = RISCV_CPU_CLASS(c);
     CPUClass *cc = CPU_CLASS(c);
@@ -3061,7 +3061,7 @@ static void riscv_cpu_common_class_init(ObjectClass *c, void *data)
     device_class_set_props(dc, riscv_cpu_properties);
 }
 
-static void riscv_cpu_class_init(ObjectClass *c, void *data)
+static void riscv_cpu_class_init(ObjectClass *c, const void *data)
 {
     RISCVCPUClass *mcc = RISCV_CPU_CLASS(c);
 
diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
index 5315134e08..75724b6af4 100644
--- a/target/riscv/kvm/kvm-cpu.c
+++ b/target/riscv/kvm/kvm-cpu.c
@@ -1976,7 +1976,7 @@ void riscv_kvm_cpu_finalize_features(RISCVCPU *cpu, Error **errp)
     kvm_riscv_destroy_scratch_vcpu(&kvmcpu);
 }
 
-static void kvm_cpu_accel_class_init(ObjectClass *oc, void *data)
+static void kvm_cpu_accel_class_init(ObjectClass *oc, const void *data)
 {
     AccelCPUClass *acc = ACCEL_CPU_CLASS(oc);
 
@@ -1997,7 +1997,7 @@ static void kvm_cpu_accel_register_types(void)
 }
 type_init(kvm_cpu_accel_register_types);
 
-static void riscv_host_cpu_class_init(ObjectClass *c, void *data)
+static void riscv_host_cpu_class_init(ObjectClass *c, const void *data)
 {
     RISCVCPUClass *mcc = RISCV_CPU_CLASS(c);
 
diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index 426145c3b9..54ac54f2e1 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -1528,7 +1528,7 @@ static void riscv_tcg_cpu_instance_init(CPUState *cs)
     }
 }
 
-static void riscv_tcg_cpu_accel_class_init(ObjectClass *oc, void *data)
+static void riscv_tcg_cpu_accel_class_init(ObjectClass *oc, const void *data)
 {
     AccelCPUClass *acc = ACCEL_CPU_CLASS(oc);
 
diff --git a/target/rx/cpu.c b/target/rx/cpu.c
index 0a7a2b55b5..a51b543028 100644
--- a/target/rx/cpu.c
+++ b/target/rx/cpu.c
@@ -220,7 +220,7 @@ static const TCGCPUOps rx_tcg_ops = {
     .do_interrupt = rx_cpu_do_interrupt,
 };
 
-static void rx_cpu_class_init(ObjectClass *klass, void *data)
+static void rx_cpu_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     CPUClass *cc = CPU_CLASS(klass);
diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
index 43fc3194bc..3d644f5e23 100644
--- a/target/s390x/cpu.c
+++ b/target/s390x/cpu.c
@@ -371,7 +371,7 @@ static const TCGCPUOps s390_tcg_ops = {
 };
 #endif /* CONFIG_TCG */
 
-static void s390_cpu_class_init(ObjectClass *oc, void *data)
+static void s390_cpu_class_init(ObjectClass *oc, const void *data)
 {
     S390CPUClass *scc = S390_CPU_CLASS(oc);
     CPUClass *cc = CPU_CLASS(scc);
diff --git a/target/s390x/cpu_models.c b/target/s390x/cpu_models.c
index 8e0b01dc65..b097ed55d9 100644
--- a/target/s390x/cpu_models.c
+++ b/target/s390x/cpu_models.c
@@ -919,7 +919,7 @@ void s390_cpu_model_class_register_props(ObjectClass *oc)
 }
 
 #ifdef CONFIG_KVM
-static void s390_host_cpu_model_class_init(ObjectClass *oc, void *data)
+static void s390_host_cpu_model_class_init(ObjectClass *oc, const void *data)
 {
     S390CPUClass *xcc = S390_CPU_CLASS(oc);
 
@@ -928,7 +928,7 @@ static void s390_host_cpu_model_class_init(ObjectClass *oc, void *data)
 }
 #endif
 
-static void s390_base_cpu_model_class_init(ObjectClass *oc, void *data)
+static void s390_base_cpu_model_class_init(ObjectClass *oc, const void *data)
 {
     S390CPUClass *xcc = S390_CPU_CLASS(oc);
 
@@ -939,7 +939,7 @@ static void s390_base_cpu_model_class_init(ObjectClass *oc, void *data)
     xcc->desc = xcc->cpu_def->desc;
 }
 
-static void s390_cpu_model_class_init(ObjectClass *oc, void *data)
+static void s390_cpu_model_class_init(ObjectClass *oc, const void *data)
 {
     S390CPUClass *xcc = S390_CPU_CLASS(oc);
 
@@ -949,7 +949,7 @@ static void s390_cpu_model_class_init(ObjectClass *oc, void *data)
     xcc->desc = xcc->cpu_def->desc;
 }
 
-static void s390_qemu_cpu_model_class_init(ObjectClass *oc, void *data)
+static void s390_qemu_cpu_model_class_init(ObjectClass *oc, const void *data)
 {
     S390CPUClass *xcc = S390_CPU_CLASS(oc);
 
@@ -958,7 +958,7 @@ static void s390_qemu_cpu_model_class_init(ObjectClass *oc, void *data)
                                 qemu_hw_version());
 }
 
-static void s390_max_cpu_model_class_init(ObjectClass *oc, void *data)
+static void s390_max_cpu_model_class_init(ObjectClass *oc, const void *data)
 {
     S390CPUClass *xcc = S390_CPU_CLASS(oc);
 
diff --git a/target/s390x/kvm/pv.c b/target/s390x/kvm/pv.c
index b191a4a68a..fe0a72c416 100644
--- a/target/s390x/kvm/pv.c
+++ b/target/s390x/kvm/pv.c
@@ -367,7 +367,7 @@ OBJECT_DEFINE_TYPE_WITH_INTERFACES(S390PVGuest,
                                    { TYPE_USER_CREATABLE },
                                    { NULL })
 
-static void s390_pv_guest_class_init(ObjectClass *oc, void *data)
+static void s390_pv_guest_class_init(ObjectClass *oc, const void *data)
 {
     ConfidentialGuestSupportClass *klass = CONFIDENTIAL_GUEST_SUPPORT_CLASS(oc);
 
diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
index 861fdd47f7..57d7b5fbc8 100644
--- a/target/sh4/cpu.c
+++ b/target/sh4/cpu.c
@@ -177,7 +177,7 @@ static void sh7750r_cpu_initfn(Object *obj)
     env->features = SH_FEATURE_BCR3_AND_BCR4;
 }
 
-static void sh7750r_class_init(ObjectClass *oc, void *data)
+static void sh7750r_class_init(ObjectClass *oc, const void *data)
 {
     SuperHCPUClass *scc = SUPERH_CPU_CLASS(oc);
 
@@ -194,7 +194,7 @@ static void sh7751r_cpu_initfn(Object *obj)
     env->features = SH_FEATURE_BCR3_AND_BCR4;
 }
 
-static void sh7751r_class_init(ObjectClass *oc, void *data)
+static void sh7751r_class_init(ObjectClass *oc, const void *data)
 {
     SuperHCPUClass *scc = SUPERH_CPU_CLASS(oc);
 
@@ -211,7 +211,7 @@ static void sh7785_cpu_initfn(Object *obj)
     env->features = SH_FEATURE_SH4A;
 }
 
-static void sh7785_class_init(ObjectClass *oc, void *data)
+static void sh7785_class_init(ObjectClass *oc, const void *data)
 {
     SuperHCPUClass *scc = SUPERH_CPU_CLASS(oc);
 
@@ -282,7 +282,7 @@ static const TCGCPUOps superh_tcg_ops = {
 #endif /* !CONFIG_USER_ONLY */
 };
 
-static void superh_cpu_class_init(ObjectClass *oc, void *data)
+static void superh_cpu_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     CPUClass *cc = CPU_CLASS(oc);
diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
index 174b76f762..981aa86e0e 100644
--- a/target/sparc/cpu.c
+++ b/target/sparc/cpu.c
@@ -1042,7 +1042,7 @@ static const TCGCPUOps sparc_tcg_ops = {
 };
 #endif /* CONFIG_TCG */
 
-static void sparc_cpu_class_init(ObjectClass *oc, void *data)
+static void sparc_cpu_class_init(ObjectClass *oc, const void *data)
 {
     SPARCCPUClass *scc = SPARC_CPU_CLASS(oc);
     CPUClass *cc = CPU_CLASS(oc);
@@ -1091,7 +1091,7 @@ static const TypeInfo sparc_cpu_type_info = {
     .class_init = sparc_cpu_class_init,
 };
 
-static void sparc_cpu_cpudef_class_init(ObjectClass *oc, void *data)
+static void sparc_cpu_cpudef_class_init(ObjectClass *oc, const void *data)
 {
     SPARCCPUClass *scc = SPARC_CPU_CLASS(oc);
     scc->cpu_def = data;
diff --git a/target/tricore/cpu.c b/target/tricore/cpu.c
index a4f93e7d91..098cd06c54 100644
--- a/target/tricore/cpu.c
+++ b/target/tricore/cpu.c
@@ -185,7 +185,7 @@ static const TCGCPUOps tricore_tcg_ops = {
     .cpu_exec_halt = tricore_cpu_has_work,
 };
 
-static void tricore_cpu_class_init(ObjectClass *c, void *data)
+static void tricore_cpu_class_init(ObjectClass *c, const void *data)
 {
     TriCoreCPUClass *mcc = TRICORE_CPU_CLASS(c);
     CPUClass *cc = CPU_CLASS(c);
diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
index 971e67ad97..27d6e40195 100644
--- a/target/xtensa/cpu.c
+++ b/target/xtensa/cpu.c
@@ -253,7 +253,7 @@ static const TCGCPUOps xtensa_tcg_ops = {
 #endif /* !CONFIG_USER_ONLY */
 };
 
-static void xtensa_cpu_class_init(ObjectClass *oc, void *data)
+static void xtensa_cpu_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     CPUClass *cc = CPU_CLASS(oc);
diff --git a/target/xtensa/helper.c b/target/xtensa/helper.c
index d02d16f9ec..0459787981 100644
--- a/target/xtensa/helper.c
+++ b/target/xtensa/helper.c
@@ -170,7 +170,7 @@ static void xtensa_finalize_config(XtensaConfig *config)
     }
 }
 
-static void xtensa_core_class_init(ObjectClass *oc, void *data)
+static void xtensa_core_class_init(ObjectClass *oc, const void *data)
 {
     CPUClass *cc = CPU_CLASS(oc);
     XtensaCPUClass *xcc = XTENSA_CPU_CLASS(oc);
diff --git a/tests/unit/check-qom-interface.c b/tests/unit/check-qom-interface.c
index c99be97ed8..4e1c4d6729 100644
--- a/tests/unit/check-qom-interface.c
+++ b/tests/unit/check-qom-interface.c
@@ -38,7 +38,7 @@ static const TypeInfo test_if_info = {
 
 #define PATTERN 0xFAFBFCFD
 
-static void test_class_init(ObjectClass *oc, void *data)
+static void test_class_init(ObjectClass *oc, const void *data)
 {
     TestIfClass *tc = TEST_IF_CLASS(oc);
 
diff --git a/tests/unit/check-qom-proplist.c b/tests/unit/check-qom-proplist.c
index 13d632cfed..f1de1618f6 100644
--- a/tests/unit/check-qom-proplist.c
+++ b/tests/unit/check-qom-proplist.c
@@ -135,7 +135,7 @@ static void dummy_init(Object *obj)
 }
 
 
-static void dummy_class_init(ObjectClass *cls, void *data)
+static void dummy_class_init(ObjectClass *cls, const void *data)
 {
     object_class_property_add_str(cls, "sv",
                                   dummy_get_sv,
@@ -264,7 +264,7 @@ static void dummy_dev_unparent(Object *obj)
     object_unparent(OBJECT(dev->bus));
 }
 
-static void dummy_dev_class_init(ObjectClass *klass, void *opaque)
+static void dummy_dev_class_init(ObjectClass *klass, const void *opaque)
 {
     klass->unparent = dummy_dev_unparent;
 }
@@ -288,7 +288,7 @@ static void dummy_bus_unparent(Object *obj)
     object_unparent(OBJECT(bus->backend));
 }
 
-static void dummy_bus_class_init(ObjectClass *klass, void *opaque)
+static void dummy_bus_class_init(ObjectClass *klass, const void *opaque)
 {
     klass->unparent = dummy_bus_unparent;
 }
diff --git a/tests/unit/test-qdev-global-props.c b/tests/unit/test-qdev-global-props.c
index 6f6a306788..33062762a6 100644
--- a/tests/unit/test-qdev-global-props.c
+++ b/tests/unit/test-qdev-global-props.c
@@ -51,7 +51,7 @@ static const Property static_props[] = {
     DEFINE_PROP_UINT32("prop2", MyType, prop2, PROP_DEFAULT),
 };
 
-static void static_prop_class_init(ObjectClass *oc, void *data)
+static void static_prop_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
@@ -177,7 +177,7 @@ static void dynamic_instance_init(Object *obj)
                         NULL, NULL);
 }
 
-static void dynamic_class_init(ObjectClass *oc, void *data)
+static void dynamic_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
@@ -193,7 +193,7 @@ static const TypeInfo dynamic_prop_type = {
     .class_init = dynamic_class_init,
 };
 
-static void hotplug_class_init(ObjectClass *oc, void *data)
+static void hotplug_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
@@ -209,7 +209,7 @@ static const TypeInfo hotplug_type = {
     .class_init = hotplug_class_init,
 };
 
-static void nohotplug_class_init(ObjectClass *oc, void *data)
+static void nohotplug_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
diff --git a/tests/unit/test-smp-parse.c b/tests/unit/test-smp-parse.c
index f9bccb56ab..326045ecbb 100644
--- a/tests/unit/test-smp-parse.c
+++ b/tests/unit/test-smp-parse.c
@@ -924,7 +924,7 @@ static void unsupported_params_init(const MachineClass *mc, SMPTestData *data)
     }
 }
 
-static void machine_base_class_init(ObjectClass *oc, void *data)
+static void machine_base_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
 
@@ -934,7 +934,8 @@ static void machine_base_class_init(ObjectClass *oc, void *data)
     mc->name = g_strdup(SMP_MACHINE_NAME);
 }
 
-static void machine_generic_invalid_class_init(ObjectClass *oc, void *data)
+static void machine_generic_invalid_class_init(ObjectClass *oc,
+                                               const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
 
@@ -943,21 +944,22 @@ static void machine_generic_invalid_class_init(ObjectClass *oc, void *data)
     mc->max_cpus = MAX_CPUS - 1;
 }
 
-static void machine_with_modules_class_init(ObjectClass *oc, void *data)
+static void machine_with_modules_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
 
     mc->smp_props.modules_supported = true;
 }
 
-static void machine_with_dies_class_init(ObjectClass *oc, void *data)
+static void machine_with_dies_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
 
     mc->smp_props.dies_supported = true;
 }
 
-static void machine_with_modules_dies_class_init(ObjectClass *oc, void *data)
+static void machine_with_modules_dies_class_init(ObjectClass *oc,
+                                                 const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
 
@@ -965,28 +967,29 @@ static void machine_with_modules_dies_class_init(ObjectClass *oc, void *data)
     mc->smp_props.dies_supported = true;
 }
 
-static void machine_with_clusters_class_init(ObjectClass *oc, void *data)
+static void machine_with_clusters_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
 
     mc->smp_props.clusters_supported = true;
 }
 
-static void machine_with_books_class_init(ObjectClass *oc, void *data)
+static void machine_with_books_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
 
     mc->smp_props.books_supported = true;
 }
 
-static void machine_with_drawers_class_init(ObjectClass *oc, void *data)
+static void machine_with_drawers_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
 
     mc->smp_props.drawers_supported = true;
 }
 
-static void machine_with_drawers_books_class_init(ObjectClass *oc, void *data)
+static void machine_with_drawers_books_class_init(ObjectClass *oc,
+                                                  const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
 
@@ -994,7 +997,7 @@ static void machine_with_drawers_books_class_init(ObjectClass *oc, void *data)
     mc->smp_props.books_supported = true;
 }
 
-static void machine_full_topo_class_init(ObjectClass *oc, void *data)
+static void machine_full_topo_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
 
diff --git a/ui/console-vc.c b/ui/console-vc.c
index df1341513d..830842064d 100644
--- a/ui/console-vc.c
+++ b/ui/console-vc.c
@@ -1036,7 +1036,7 @@ qemu_text_console_finalize(Object *obj)
 }
 
 static void
-qemu_text_console_class_init(ObjectClass *oc, void *data)
+qemu_text_console_class_init(ObjectClass *oc, const void *data)
 {
     if (!cursor_timer) {
         cursor_timer = timer_new_ms(QEMU_CLOCK_REALTIME, cursor_timer_cb, NULL);
@@ -1065,7 +1065,7 @@ qemu_fixed_text_console_finalize(Object *obj)
 }
 
 static void
-qemu_fixed_text_console_class_init(ObjectClass *oc, void *data)
+qemu_fixed_text_console_class_init(ObjectClass *oc, const void *data)
 {
 }
 
@@ -1181,7 +1181,7 @@ static void vc_chr_parse(QemuOpts *opts, ChardevBackend *backend, Error **errp)
     }
 }
 
-static void char_vc_class_init(ObjectClass *oc, void *data)
+static void char_vc_class_init(ObjectClass *oc, const void *data)
 {
     ChardevClass *cc = CHARDEV_CLASS(oc);
 
diff --git a/ui/console.c b/ui/console.c
index 6cd122cf40..2d00828c53 100644
--- a/ui/console.c
+++ b/ui/console.c
@@ -401,7 +401,7 @@ qemu_console_finalize(Object *obj)
 }
 
 static void
-qemu_console_class_init(ObjectClass *oc, void *data)
+qemu_console_class_init(ObjectClass *oc, const void *data)
 {
 }
 
@@ -437,7 +437,7 @@ qemu_graphic_console_prop_get_head(Object *obj, Visitor *v, const char *name,
 }
 
 static void
-qemu_graphic_console_class_init(ObjectClass *oc, void *data)
+qemu_graphic_console_class_init(ObjectClass *oc, const void *data)
 {
     object_class_property_add_link(oc, "device", TYPE_DEVICE,
                                    offsetof(QemuGraphicConsole, device),
diff --git a/ui/dbus-chardev.c b/ui/dbus-chardev.c
index bf061cbc93..d05dddaf81 100644
--- a/ui/dbus-chardev.c
+++ b/ui/dbus-chardev.c
@@ -269,7 +269,7 @@ dbus_chr_parse(QemuOpts *opts, ChardevBackend *backend,
 }
 
 static void
-char_dbus_class_init(ObjectClass *oc, void *data)
+char_dbus_class_init(ObjectClass *oc, const void *data)
 {
     DBusChardevClass *klass = DBUS_CHARDEV_CLASS(oc);
     ChardevClass *cc = CHARDEV_CLASS(oc);
diff --git a/ui/dbus.c b/ui/dbus.c
index 2eb03aa247..0c0f86eaa6 100644
--- a/ui/dbus.c
+++ b/ui/dbus.c
@@ -404,7 +404,7 @@ set_gl_mode(Object *o, int val, Error **errp)
 }
 
 static void
-dbus_display_class_init(ObjectClass *oc, void *data)
+dbus_display_class_init(ObjectClass *oc, const void *data)
 {
     UserCreatableClass *ucc = USER_CREATABLE_CLASS(oc);
 
@@ -453,7 +453,7 @@ dbus_vc_parse(QemuOpts *opts, ChardevBackend *backend,
 }
 
 static void
-dbus_vc_class_init(ObjectClass *oc, void *data)
+dbus_vc_class_init(ObjectClass *oc, const void *data)
 {
     DBusVCClass *klass = DBUS_VC_CLASS(oc);
     ChardevClass *cc = CHARDEV_CLASS(oc);
diff --git a/ui/gtk.c b/ui/gtk.c
index 59bda83da6..982037b2c0 100644
--- a/ui/gtk.c
+++ b/ui/gtk.c
@@ -1879,7 +1879,7 @@ static void gd_vc_open(Chardev *chr,
     *be_opened = false;
 }
 
-static void char_gd_vc_class_init(ObjectClass *oc, void *data)
+static void char_gd_vc_class_init(ObjectClass *oc, const void *data)
 {
     ChardevClass *cc = CHARDEV_CLASS(oc);
 
diff --git a/ui/input-barrier.c b/ui/input-barrier.c
index c86e5d67eb..9dce31ea9a 100644
--- a/ui/input-barrier.c
+++ b/ui/input-barrier.c
@@ -696,7 +696,7 @@ static void input_barrier_instance_init(Object *obj)
     ib->height = 1080;
 }
 
-static void input_barrier_class_init(ObjectClass *oc, void *data)
+static void input_barrier_class_init(ObjectClass *oc, const void *data)
 {
     UserCreatableClass *ucc = USER_CREATABLE_CLASS(oc);
 
diff --git a/ui/input-linux.c b/ui/input-linux.c
index 203e264212..2f5adb82d2 100644
--- a/ui/input-linux.c
+++ b/ui/input-linux.c
@@ -494,7 +494,7 @@ static void input_linux_instance_init(Object *obj)
 {
 }
 
-static void input_linux_class_init(ObjectClass *oc, void *data)
+static void input_linux_class_init(ObjectClass *oc, const void *data)
 {
     UserCreatableClass *ucc = USER_CREATABLE_CLASS(oc);
 
diff --git a/ui/spice-app.c b/ui/spice-app.c
index 91e258a621..24f78f305c 100644
--- a/ui/spice-app.c
+++ b/ui/spice-app.c
@@ -101,7 +101,7 @@ static void vc_chr_parse(QemuOpts *opts, ChardevBackend *backend, Error **errp)
     /* fqdn is dealt with in vc_chr_open() */
 }
 
-static void char_vc_class_init(ObjectClass *oc, void *data)
+static void char_vc_class_init(ObjectClass *oc, const void *data)
 {
     VCChardevClass *vc = CHARDEV_VC_CLASS(oc);
     ChardevClass *cc = CHARDEV_CLASS(oc);
diff --git a/ui/vdagent.c b/ui/vdagent.c
index 724eff972f..04513ded29 100644
--- a/ui/vdagent.c
+++ b/ui/vdagent.c
@@ -905,7 +905,7 @@ static void vdagent_chr_parse(QemuOpts *opts, ChardevBackend *backend,
 
 /* ------------------------------------------------------------------ */
 
-static void vdagent_chr_class_init(ObjectClass *oc, void *data)
+static void vdagent_chr_class_init(ObjectClass *oc, const void *data)
 {
     ChardevClass *cc = CHARDEV_CLASS(oc);
 
diff --git a/util/main-loop.c b/util/main-loop.c
index 4683db1888..51aeb2432e 100644
--- a/util/main-loop.c
+++ b/util/main-loop.c
@@ -220,7 +220,7 @@ static bool main_loop_can_be_deleted(EventLoopBase *base)
     return false;
 }
 
-static void main_loop_class_init(ObjectClass *oc, void *class_data)
+static void main_loop_class_init(ObjectClass *oc, const void *class_data)
 {
     EventLoopBaseClass *bc = EVENT_LOOP_BASE_CLASS(oc);
 
diff --git a/util/thread-context.c b/util/thread-context.c
index 2bc7883b9e..95228a3d4f 100644
--- a/util/thread-context.c
+++ b/util/thread-context.c
@@ -273,7 +273,7 @@ static void thread_context_instance_complete(UserCreatable *uc, Error **errp)
     }
 }
 
-static void thread_context_class_init(ObjectClass *oc, void *data)
+static void thread_context_class_init(ObjectClass *oc, const void *data)
 {
     UserCreatableClass *ucc = USER_CREATABLE_CLASS(oc);
 

From b282b859cf3442d922644e2cd2bee68272baafd5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 10 Feb 2025 09:56:56 +0100
Subject: [PATCH 0309/2760] qom: Constify TypeInfo::class_data
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

All callers now correctly expect a const class data.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250424194905.82506-5-philmd@linaro.org>
---
 hw/arm/armsse.c                                     | 2 +-
 hw/block/m25p80.c                                   | 2 +-
 hw/isa/vt82c686.c                                   | 4 ++--
 hw/net/e1000.c                                      | 2 +-
 hw/ppc/spapr_cpu_core.c                             | 2 +-
 hw/scsi/megasas.c                                   | 2 +-
 hw/sensor/tmp421.c                                  | 2 +-
 hw/virtio/virtio-pci.c                              | 4 ++--
 include/qom/object.h                                | 2 +-
 qom/object.c                                        | 2 +-
 rust/qemu-api/src/qom.rs                            | 2 +-
 scripts/codeconverter/codeconverter/test_regexps.py | 2 +-
 target/arm/cpu.c                                    | 2 +-
 target/arm/cpu64.c                                  | 2 +-
 target/mips/cpu.c                                   | 2 +-
 target/s390x/cpu_models.c                           | 4 ++--
 target/sparc/cpu.c                                  | 2 +-
 target/xtensa/helper.c                              | 2 +-
 18 files changed, 21 insertions(+), 21 deletions(-)

diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
index d65a46b8d8..9403b65ddb 100644
--- a/hw/arm/armsse.c
+++ b/hw/arm/armsse.c
@@ -1730,7 +1730,7 @@ static void armsse_register_types(void)
             .name = armsse_variants[i].name,
             .parent = TYPE_ARM_SSE,
             .class_init = armsse_class_init,
-            .class_data = (void *)&armsse_variants[i],
+            .class_data = &armsse_variants[i],
         };
         type_register_static(&ti);
     }
diff --git a/hw/block/m25p80.c b/hw/block/m25p80.c
index 75b9d71251..a5336d92ff 100644
--- a/hw/block/m25p80.c
+++ b/hw/block/m25p80.c
@@ -1893,7 +1893,7 @@ static void m25p80_register_types(void)
             .name       = known_devices[i].part_name,
             .parent     = TYPE_M25P80,
             .class_init = m25p80_class_init,
-            .class_data = (void *)&known_devices[i],
+            .class_data = &known_devices[i],
         };
         type_register_static(&ti);
     }
diff --git a/hw/isa/vt82c686.c b/hw/isa/vt82c686.c
index 80366aaf64..c62afc907b 100644
--- a/hw/isa/vt82c686.c
+++ b/hw/isa/vt82c686.c
@@ -259,7 +259,7 @@ static const TypeInfo vt82c686b_pm_info = {
     .name          = TYPE_VT82C686B_PM,
     .parent        = TYPE_VIA_PM,
     .class_init    = via_pm_class_init,
-    .class_data    = (void *)&vt82c686b_pm_init_info,
+    .class_data    = &vt82c686b_pm_init_info,
 };
 
 static const ViaPMInitInfo vt8231_pm_init_info = {
@@ -272,7 +272,7 @@ static const TypeInfo vt8231_pm_info = {
     .name          = TYPE_VT8231_PM,
     .parent        = TYPE_VIA_PM,
     .class_init    = via_pm_class_init,
-    .class_data    = (void *)&vt8231_pm_init_info,
+    .class_data    = &vt8231_pm_init_info,
 };
 
 
diff --git a/hw/net/e1000.c b/hw/net/e1000.c
index d49730f4ad..13814e84d1 100644
--- a/hw/net/e1000.c
+++ b/hw/net/e1000.c
@@ -1770,7 +1770,7 @@ static void e1000_register_types(void)
 
         type_info.name = info->name;
         type_info.parent = TYPE_E1000_BASE;
-        type_info.class_data = (void *)info;
+        type_info.class_data = info;
         type_info.class_init = e1000_class_init;
 
         type_register_static(&type_info);
diff --git a/hw/ppc/spapr_cpu_core.c b/hw/ppc/spapr_cpu_core.c
index b4b926d759..4952f9bd2c 100644
--- a/hw/ppc/spapr_cpu_core.c
+++ b/hw/ppc/spapr_cpu_core.c
@@ -388,7 +388,7 @@ static void spapr_cpu_core_class_init(ObjectClass *oc, const void *data)
 #define DEFINE_SPAPR_CPU_CORE_TYPE(cpu_model) \
     {                                                   \
         .parent = TYPE_SPAPR_CPU_CORE,                  \
-        .class_data = (void *) POWERPC_CPU_TYPE_NAME(cpu_model), \
+        .class_data = POWERPC_CPU_TYPE_NAME(cpu_model), \
         .class_init = spapr_cpu_core_class_init,        \
         .name = SPAPR_CPU_CORE_TYPE_NAME(cpu_model),    \
     }
diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c
index ffcabd5a8e..b024905a01 100644
--- a/hw/scsi/megasas.c
+++ b/hw/scsi/megasas.c
@@ -2572,7 +2572,7 @@ static void megasas_register_types(void)
 
         type_info.name = info->name;
         type_info.parent = TYPE_MEGASAS_BASE;
-        type_info.class_data = (void *)info;
+        type_info.class_data = info;
         type_info.class_init = megasas_class_init;
         type_info.interfaces = info->interfaces;
 
diff --git a/hw/sensor/tmp421.c b/hw/sensor/tmp421.c
index 263bfa1bbd..3421c44086 100644
--- a/hw/sensor/tmp421.c
+++ b/hw/sensor/tmp421.c
@@ -382,7 +382,7 @@ static void tmp421_register_types(void)
             .name       = devices[i].name,
             .parent     = TYPE_TMP421,
             .class_init = tmp421_class_init,
-            .class_data = (void *) &devices[i],
+            .class_data = &devices[i],
         };
         type_register_static(&ti);
     }
diff --git a/hw/virtio/virtio-pci.c b/hw/virtio/virtio-pci.c
index c0fd3db063..95bf7ddd97 100644
--- a/hw/virtio/virtio-pci.c
+++ b/hw/virtio/virtio-pci.c
@@ -2497,13 +2497,13 @@ void virtio_pci_types_register(const VirtioPCIDeviceTypeInfo *t)
 
         generic_type_info.parent = base_name;
         generic_type_info.class_init = virtio_pci_base_class_init;
-        generic_type_info.class_data = (void *)t;
+        generic_type_info.class_data = t;
 
         assert(!t->non_transitional_name);
         assert(!t->transitional_name);
     } else {
         base_type_info.class_init = virtio_pci_base_class_init;
-        base_type_info.class_data = (void *)t;
+        base_type_info.class_data = t;
     }
 
     type_register_static(&base_type_info);
diff --git a/include/qom/object.h b/include/qom/object.h
index 2fb86f00a6..42b75d10a4 100644
--- a/include/qom/object.h
+++ b/include/qom/object.h
@@ -488,7 +488,7 @@ struct TypeInfo
 
     void (*class_init)(ObjectClass *klass, const void *data);
     void (*class_base_init)(ObjectClass *klass, const void *data);
-    void *class_data;
+    const void *class_data;
 
     InterfaceInfo *interfaces;
 };
diff --git a/qom/object.c b/qom/object.c
index 06d7367032..425ee2f0ee 100644
--- a/qom/object.c
+++ b/qom/object.c
@@ -57,7 +57,7 @@ struct TypeImpl
     void (*class_init)(ObjectClass *klass, const void *data);
     void (*class_base_init)(ObjectClass *klass, const void *data);
 
-    void *class_data;
+    const void *class_data;
 
     void (*instance_init)(Object *obj);
     void (*instance_post_init)(Object *obj);
diff --git a/rust/qemu-api/src/qom.rs b/rust/qemu-api/src/qom.rs
index f385cb7275..f0a79f96d5 100644
--- a/rust/qemu-api/src/qom.rs
+++ b/rust/qemu-api/src/qom.rs
@@ -513,7 +513,7 @@ pub trait ObjectImpl: ObjectType + IsA<Object> {
         class_size: core::mem::size_of::<Self::Class>(),
         class_init: Some(rust_class_init::<Self>),
         class_base_init: Self::CLASS_BASE_INIT,
-        class_data: core::ptr::null_mut(),
+        class_data: core::ptr::null(),
         interfaces: core::ptr::null_mut(),
     };
 
diff --git a/scripts/codeconverter/codeconverter/test_regexps.py b/scripts/codeconverter/codeconverter/test_regexps.py
index 7211392796..08857c5008 100644
--- a/scripts/codeconverter/codeconverter/test_regexps.py
+++ b/scripts/codeconverter/codeconverter/test_regexps.py
@@ -70,7 +70,7 @@ static const TypeInfo char_file_type_info = {
             .name = armsse_variants[i].name,
             .parent = TYPE_ARMSSE,
             .class_init = armsse_class_init,
-            .class_data = (void *)&armsse_variants[i],
+            .class_data = &armsse_variants[i],
         };''', re.MULTILINE)
 
     print(RE_ARRAY_ITEM)
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index 81257f20fd..00577f97eb 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -2758,7 +2758,7 @@ void arm_cpu_register(const ARMCPUInfo *info)
         .parent = TYPE_ARM_CPU,
         .instance_init = arm_cpu_instance_init,
         .class_init = info->class_init ?: cpu_register_class_init,
-        .class_data = (void *)info,
+        .class_data = info,
     };
 
     type_info.name = g_strdup_printf("%s-" TYPE_ARM_CPU, info->name);
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index 1184c92b4c..eaf5705cdc 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -855,7 +855,7 @@ void aarch64_cpu_register(const ARMCPUInfo *info)
         .parent = TYPE_AARCH64_CPU,
         .instance_init = aarch64_cpu_instance_init,
         .class_init = info->class_init ?: cpu_register_class_init,
-        .class_data = (void *)info,
+        .class_data = info,
     };
 
     type_info.name = g_strdup_printf("%s-" TYPE_ARM_CPU, info->name);
diff --git a/target/mips/cpu.c b/target/mips/cpu.c
index 29611a0a1c..d13361a150 100644
--- a/target/mips/cpu.c
+++ b/target/mips/cpu.c
@@ -626,7 +626,7 @@ static void mips_register_cpudef_type(const struct mips_def_t *def)
         .name = typename,
         .parent = TYPE_MIPS_CPU,
         .class_init = mips_cpu_cpudef_class_init,
-        .class_data = (void *)def,
+        .class_data = def,
     };
 
     type_register_static(&ti);
diff --git a/target/s390x/cpu_models.c b/target/s390x/cpu_models.c
index b097ed55d9..8951f1b36f 100644
--- a/target/s390x/cpu_models.c
+++ b/target/s390x/cpu_models.c
@@ -1072,7 +1072,7 @@ static void register_types(void)
             .instance_init = s390_cpu_model_initfn,
             .instance_finalize = s390_cpu_model_finalize,
             .class_init = s390_base_cpu_model_class_init,
-            .class_data = (void *) &s390_cpu_defs[i],
+            .class_data = &s390_cpu_defs[i],
         };
         char *name = s390_cpu_type_name(s390_cpu_defs[i].name);
         TypeInfo ti = {
@@ -1081,7 +1081,7 @@ static void register_types(void)
             .instance_init = s390_cpu_model_initfn,
             .instance_finalize = s390_cpu_model_finalize,
             .class_init = s390_cpu_model_class_init,
-            .class_data = (void *) &s390_cpu_defs[i],
+            .class_data = &s390_cpu_defs[i],
         };
 
         type_register_static(&ti_base);
diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
index 981aa86e0e..bc753d5f62 100644
--- a/target/sparc/cpu.c
+++ b/target/sparc/cpu.c
@@ -1104,7 +1104,7 @@ static void sparc_register_cpudef_type(const struct sparc_def_t *def)
         .name = typename,
         .parent = TYPE_SPARC_CPU,
         .class_init = sparc_cpu_cpudef_class_init,
-        .class_data = (void *)def,
+        .class_data = def,
     };
 
     type_register_static(&ti);
diff --git a/target/xtensa/helper.c b/target/xtensa/helper.c
index 0459787981..2d93b45036 100644
--- a/target/xtensa/helper.c
+++ b/target/xtensa/helper.c
@@ -192,7 +192,7 @@ void xtensa_register_core(XtensaConfigList *node)
     TypeInfo type = {
         .parent = TYPE_XTENSA_CPU,
         .class_init = xtensa_core_class_init,
-        .class_data = (void *)node->config,
+        .class_data = node->config,
     };
 
     xtensa_finalize_config(node->config);

From 231bf6dda1ef7b4894ba374efb248c65b1841e34 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 23 Apr 2025 18:44:12 +0200
Subject: [PATCH 0310/2760] qom: Constify TypeInfo::interfaces
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20250424194905.82506-6-philmd@linaro.org>
---
 hw/scsi/megasas.c              | 2 +-
 include/hw/virtio/virtio-pci.h | 2 +-
 include/qom/object.h           | 2 +-
 rust/qemu-api/src/qom.rs       | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c
index b024905a01..a39e3e0e4f 100644
--- a/hw/scsi/megasas.c
+++ b/hw/scsi/megasas.c
@@ -2486,7 +2486,7 @@ typedef struct MegasasInfo {
     const VMStateDescription *vmsd;
     const Property *props;
     size_t props_count;
-    InterfaceInfo *interfaces;
+    const InterfaceInfo *interfaces;
 } MegasasInfo;
 
 static struct MegasasInfo megasas_devices[] = {
diff --git a/include/hw/virtio/virtio-pci.h b/include/hw/virtio/virtio-pci.h
index 567a9b0a9d..31ec144509 100644
--- a/include/hw/virtio/virtio-pci.h
+++ b/include/hw/virtio/virtio-pci.h
@@ -256,7 +256,7 @@ typedef struct VirtioPCIDeviceTypeInfo {
     void (*instance_init)(Object *obj);
     void (*instance_finalize)(Object *obj);
     void (*class_init)(ObjectClass *klass, const void *data);
-    InterfaceInfo *interfaces;
+    const InterfaceInfo *interfaces;
 } VirtioPCIDeviceTypeInfo;
 
 /* Register virtio-pci type(s).  @t must be static. */
diff --git a/include/qom/object.h b/include/qom/object.h
index 42b75d10a4..26a45f638c 100644
--- a/include/qom/object.h
+++ b/include/qom/object.h
@@ -490,7 +490,7 @@ struct TypeInfo
     void (*class_base_init)(ObjectClass *klass, const void *data);
     const void *class_data;
 
-    InterfaceInfo *interfaces;
+    const InterfaceInfo *interfaces;
 };
 
 /**
diff --git a/rust/qemu-api/src/qom.rs b/rust/qemu-api/src/qom.rs
index f0a79f96d5..f1b4022157 100644
--- a/rust/qemu-api/src/qom.rs
+++ b/rust/qemu-api/src/qom.rs
@@ -514,7 +514,7 @@ pub trait ObjectImpl: ObjectType + IsA<Object> {
         class_init: Some(rust_class_init::<Self>),
         class_base_init: Self::CLASS_BASE_INIT,
         class_data: core::ptr::null(),
-        interfaces: core::ptr::null_mut(),
+        interfaces: core::ptr::null(),
     };
 
     // methods on ObjectClass

From 2cd09e47aa522dfc7bb206f13d6dccb68dd09887 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 23 Apr 2025 18:46:19 +0200
Subject: [PATCH 0311/2760] qom: Make InterfaceInfo[] uses const
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Mechanical change using:

  $ sed -i -E 's/\(InterfaceInfo.?\[/\(const InterfaceInfo\[/g' \
              $(git grep -lE '\(InterfaceInfo.?\[\]\)')

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20250424194905.82506-7-philmd@linaro.org>
---
 authz/list.c                                        |  2 +-
 authz/listfile.c                                    |  2 +-
 authz/pamacct.c                                     |  2 +-
 authz/simple.c                                      |  2 +-
 backends/cryptodev.c                                |  2 +-
 backends/dbus-vmstate.c                             |  2 +-
 backends/hostmem.c                                  |  2 +-
 backends/iommufd.c                                  |  2 +-
 backends/rng.c                                      |  2 +-
 block/throttle-groups.c                             |  2 +-
 crypto/secret_common.c                              |  2 +-
 crypto/tls-cipher-suites.c                          |  2 +-
 crypto/tlscredsanon.c                               |  2 +-
 crypto/tlscredspsk.c                                |  2 +-
 crypto/tlscredsx509.c                               |  2 +-
 event-loop-base.c                                   |  2 +-
 hw/acpi/erst.c                                      |  2 +-
 hw/acpi/generic_event_device.c                      |  2 +-
 hw/acpi/piix4.c                                     |  2 +-
 hw/arm/armsse.c                                     |  2 +-
 hw/arm/mps2-tz.c                                    |  2 +-
 hw/arm/virt.c                                       |  2 +-
 hw/audio/ac97.c                                     |  2 +-
 hw/audio/es1370.c                                   |  2 +-
 hw/audio/intel-hda.c                                |  2 +-
 hw/audio/via-ac97.c                                 |  4 ++--
 hw/block/fdc-isa.c                                  |  2 +-
 hw/char/diva-gsp.c                                  |  4 ++--
 hw/char/parallel.c                                  |  2 +-
 hw/char/serial-isa.c                                |  2 +-
 hw/char/serial-pci-multi.c                          |  4 ++--
 hw/char/serial-pci.c                                |  2 +-
 hw/char/virtio-serial-bus.c                         |  2 +-
 hw/core/bus.c                                       |  2 +-
 hw/core/qdev.c                                      |  2 +-
 hw/cxl/switch-mailbox-cci.c                         |  2 +-
 hw/display/apple-gfx-pci.m                          |  2 +-
 hw/display/ati.c                                    |  2 +-
 hw/display/bochs-display.c                          |  2 +-
 hw/display/cirrus_vga.c                             |  2 +-
 hw/display/qxl.c                                    |  2 +-
 hw/display/sm501.c                                  |  2 +-
 hw/display/vga-pci.c                                |  2 +-
 hw/display/virtio-gpu-pci-rutabaga.c                |  2 +-
 hw/display/vmware_vga.c                             |  2 +-
 hw/dma/i8257.c                                      |  2 +-
 hw/dma/xilinx_axidma.c                              |  4 ++--
 hw/dma/xlnx_csu_dma.c                               |  2 +-
 hw/hppa/machine.c                                   |  4 ++--
 hw/i2c/smbus_ich9.c                                 |  2 +-
 hw/i386/amd_iommu.c                                 |  2 +-
 hw/i386/microvm.c                                   |  2 +-
 hw/i386/pc.c                                        |  2 +-
 hw/i386/sgx-epc.c                                   |  2 +-
 hw/i386/x86.c                                       |  2 +-
 hw/i386/xen/xen_platform.c                          |  2 +-
 hw/i386/xen/xen_pvdevice.c                          |  2 +-
 hw/ide/ich.c                                        |  2 +-
 hw/ide/pci.c                                        |  2 +-
 hw/input/pckbd.c                                    |  2 +-
 hw/intc/arm_gic_common.c                            |  2 +-
 hw/intc/arm_gicv3_common.c                          |  2 +-
 hw/intc/goldfish_pic.c                              |  2 +-
 hw/intc/i8259_common.c                              |  2 +-
 hw/intc/ioapic_common.c                             |  2 +-
 hw/intc/loongarch_extioi_common.c                   |  2 +-
 hw/intc/loongarch_ipi.c                             |  2 +-
 hw/intc/m68k_irqc.c                                 |  2 +-
 hw/intc/pnv_xive.c                                  |  2 +-
 hw/intc/pnv_xive2.c                                 |  2 +-
 hw/intc/slavio_intctl.c                             |  2 +-
 hw/intc/spapr_xive.c                                |  2 +-
 hw/intc/xics_spapr.c                                |  2 +-
 hw/intc/xive.c                                      |  2 +-
 hw/intc/xive2.c                                     |  2 +-
 hw/ipack/tpci200.c                                  |  2 +-
 hw/ipmi/isa_ipmi_bt.c                               |  2 +-
 hw/ipmi/isa_ipmi_kcs.c                              |  2 +-
 hw/ipmi/pci_ipmi_bt.c                               |  2 +-
 hw/ipmi/pci_ipmi_kcs.c                              |  2 +-
 hw/ipmi/smbus_ipmi.c                                |  2 +-
 hw/isa/i82378.c                                     |  2 +-
 hw/isa/lpc_ich9.c                                   |  2 +-
 hw/isa/piix.c                                       |  2 +-
 hw/isa/vt82c686.c                                   |  4 ++--
 hw/loongarch/virt.c                                 |  2 +-
 hw/m68k/q800-glue.c                                 |  2 +-
 hw/mem/cxl_type3.c                                  |  2 +-
 hw/mem/pc-dimm.c                                    |  2 +-
 hw/misc/applesmc.c                                  |  2 +-
 hw/misc/edu.c                                       |  2 +-
 hw/misc/ivshmem-pci.c                               |  2 +-
 hw/misc/macio/gpio.c                                |  2 +-
 hw/misc/macio/macio.c                               |  2 +-
 hw/misc/pci-testdev.c                               |  2 +-
 hw/misc/pvpanic-isa.c                               |  2 +-
 hw/misc/pvpanic-pci.c                               |  2 +-
 hw/misc/xlnx-versal-cframe-reg.c                    |  2 +-
 hw/misc/xlnx-versal-cfu.c                           |  4 ++--
 hw/net/can/can_kvaser_pci.c                         |  2 +-
 hw/net/can/can_mioe3680_pci.c                       |  2 +-
 hw/net/can/can_pcm3680_pci.c                        |  2 +-
 hw/net/can/ctucan_pci.c                             |  2 +-
 hw/net/e1000.c                                      |  2 +-
 hw/net/e1000e.c                                     |  2 +-
 hw/net/eepro100.c                                   |  2 +-
 hw/net/igb.c                                        |  2 +-
 hw/net/igbvf.c                                      |  2 +-
 hw/net/ne2000-pci.c                                 |  2 +-
 hw/net/pcnet-pci.c                                  |  2 +-
 hw/net/rocker/rocker.c                              |  2 +-
 hw/net/rtl8139.c                                    |  2 +-
 hw/net/sungem.c                                     |  2 +-
 hw/net/sunhme.c                                     |  2 +-
 hw/net/tulip.c                                      |  2 +-
 hw/net/vmxnet3.c                                    |  2 +-
 hw/net/xilinx_axienet.c                             |  4 ++--
 hw/nvme/ctrl.c                                      |  2 +-
 hw/pci-bridge/cxl_downstream.c                      |  2 +-
 hw/pci-bridge/cxl_root_port.c                       |  2 +-
 hw/pci-bridge/cxl_upstream.c                        |  2 +-
 hw/pci-bridge/i82801b11.c                           |  2 +-
 hw/pci-bridge/pci_bridge_dev.c                      |  2 +-
 hw/pci-bridge/pci_expander_bridge.c                 |  6 +++---
 hw/pci-bridge/pcie_pci_bridge.c                     |  2 +-
 hw/pci-bridge/pcie_root_port.c                      |  2 +-
 hw/pci-bridge/simba.c                               |  2 +-
 hw/pci-bridge/xio3130_downstream.c                  |  2 +-
 hw/pci-bridge/xio3130_upstream.c                    |  2 +-
 hw/pci-host/articia.c                               |  4 ++--
 hw/pci-host/bonito.c                                |  2 +-
 hw/pci-host/designware.c                            |  2 +-
 hw/pci-host/gpex.c                                  |  2 +-
 hw/pci-host/grackle.c                               |  2 +-
 hw/pci-host/gt64120.c                               |  2 +-
 hw/pci-host/i440fx.c                                |  2 +-
 hw/pci-host/mv64361.c                               |  2 +-
 hw/pci-host/pnv_phb3_pbcq.c                         |  2 +-
 hw/pci-host/pnv_phb4.c                              |  2 +-
 hw/pci-host/pnv_phb4_pec.c                          |  4 ++--
 hw/pci-host/ppc4xx_pci.c                            |  2 +-
 hw/pci-host/ppce500.c                               |  2 +-
 hw/pci-host/q35.c                                   |  2 +-
 hw/pci-host/raven.c                                 |  2 +-
 hw/pci-host/sabre.c                                 |  2 +-
 hw/pci-host/sh_pci.c                                |  2 +-
 hw/pci-host/uninorth.c                              |  8 ++++----
 hw/pci-host/versatile.c                             |  2 +-
 hw/pci-host/xilinx-pcie.c                           |  2 +-
 hw/pci/pci.c                                        |  2 +-
 hw/pci/pci_bridge.c                                 |  2 +-
 hw/pci/pcie_port.c                                  |  2 +-
 hw/ppc/e500plat.c                                   |  2 +-
 hw/ppc/mac_newworld.c                               |  2 +-
 hw/ppc/mac_oldworld.c                               |  2 +-
 hw/ppc/pegasos2.c                                   |  2 +-
 hw/ppc/pnv.c                                        |  8 ++++----
 hw/ppc/pnv_adu.c                                    |  2 +-
 hw/ppc/pnv_chiptod.c                                |  4 ++--
 hw/ppc/pnv_i2c.c                                    |  2 +-
 hw/ppc/pnv_lpc.c                                    |  2 +-
 hw/ppc/pnv_n1_chiplet.c                             |  2 +-
 hw/ppc/pnv_nest_pervasive.c                         |  2 +-
 hw/ppc/pnv_psi.c                                    |  4 ++--
 hw/ppc/spapr.c                                      |  2 +-
 hw/ppc/spapr_pci.c                                  |  2 +-
 hw/remote/machine.c                                 |  2 +-
 hw/remote/proxy.c                                   |  2 +-
 hw/remote/remote-obj.c                              |  2 +-
 hw/remote/vfio-user-obj.c                           |  2 +-
 hw/riscv/riscv-iommu-pci.c                          |  2 +-
 hw/riscv/virt.c                                     |  2 +-
 hw/rtc/m48t59-isa.c                                 |  2 +-
 hw/rtc/m48t59.c                                     |  2 +-
 hw/rtc/mc146818rtc.c                                |  2 +-
 hw/s390x/ap-bridge.c                                |  2 +-
 hw/s390x/css-bridge.c                               |  2 +-
 hw/s390x/s390-pci-bus.c                             |  2 +-
 hw/s390x/s390-virtio-ccw.c                          |  2 +-
 hw/s390x/virtio-ccw-md.c                            |  2 +-
 hw/scsi/esp-pci.c                                   |  2 +-
 hw/scsi/lsi53c895a.c                                |  2 +-
 hw/scsi/megasas.c                                   |  4 ++--
 hw/scsi/mptsas.c                                    |  2 +-
 hw/scsi/scsi-bus.c                                  |  2 +-
 hw/scsi/vhost-scsi.c                                |  2 +-
 hw/scsi/vhost-user-scsi.c                           |  2 +-
 hw/scsi/virtio-scsi.c                               |  2 +-
 hw/scsi/vmw_pvscsi.c                                |  2 +-
 hw/sd/sdhci-pci.c                                   |  2 +-
 hw/sparc64/sun4u.c                                  |  4 ++--
 hw/ssi/pnv_spi.c                                    |  2 +-
 hw/tpm/tpm_crb.c                                    |  2 +-
 hw/tpm/tpm_spapr.c                                  |  2 +-
 hw/tpm/tpm_tis_i2c.c                                |  2 +-
 hw/tpm/tpm_tis_isa.c                                |  2 +-
 hw/tpm/tpm_tis_sysbus.c                             |  2 +-
 hw/ufs/ufs.c                                        |  2 +-
 hw/usb/bus.c                                        |  2 +-
 hw/usb/dev-smartcard-reader.c                       |  2 +-
 hw/usb/hcd-ehci-pci.c                               |  2 +-
 hw/usb/hcd-ohci-pci.c                               |  2 +-
 hw/usb/hcd-uhci.c                                   |  2 +-
 hw/usb/hcd-xhci-pci.c                               |  2 +-
 hw/vfio/igd.c                                       |  2 +-
 hw/vfio/pci.c                                       |  2 +-
 hw/virtio/virtio-md-pci.c                           |  2 +-
 hw/virtio/virtio-mem.c                              |  2 +-
 hw/virtio/virtio-pci.c                              |  6 +++---
 hw/watchdog/wdt_i6300esb.c                          |  2 +-
 hw/xen/xen-bus.c                                    |  2 +-
 hw/xen/xen-legacy-backend.c                         |  2 +-
 hw/xen/xen_pt.c                                     |  2 +-
 hw/xen/xen_pt_graphics.c                            |  2 +-
 include/qom/object.h                                |  2 +-
 net/can/can_core.c                                  |  2 +-
 net/can/can_host.c                                  |  2 +-
 net/colo-compare.c                                  |  2 +-
 net/filter.c                                        |  2 +-
 scripts/codeconverter/codeconverter/test_regexps.py | 10 +++++-----
 scsi/pr-manager.c                                   |  2 +-
 system/qtest.c                                      |  2 +-
 target/i386/sev.c                                   |  2 +-
 target/ppc/cpu_init.c                               |  2 +-
 tests/unit/check-qom-interface.c                    |  2 +-
 tests/unit/check-qom-proplist.c                     |  2 +-
 ui/dbus.c                                           |  2 +-
 ui/input-barrier.c                                  |  2 +-
 ui/input-linux.c                                    |  2 +-
 util/thread-context.c                               |  2 +-
 230 files changed, 258 insertions(+), 258 deletions(-)

diff --git a/authz/list.c b/authz/list.c
index bbd99f2b7f..17aa0efd80 100644
--- a/authz/list.c
+++ b/authz/list.c
@@ -253,7 +253,7 @@ static const TypeInfo qauthz_list_info = {
     .instance_size = sizeof(QAuthZList),
     .instance_finalize = qauthz_list_finalize,
     .class_init = qauthz_list_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_USER_CREATABLE },
         { }
     }
diff --git a/authz/listfile.c b/authz/listfile.c
index b58d4ebd1d..13741d5a72 100644
--- a/authz/listfile.c
+++ b/authz/listfile.c
@@ -272,7 +272,7 @@ static const TypeInfo qauthz_list_file_info = {
     .instance_size = sizeof(QAuthZListFile),
     .instance_finalize = qauthz_list_file_finalize,
     .class_init = qauthz_list_file_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_USER_CREATABLE },
         { }
     }
diff --git a/authz/pamacct.c b/authz/pamacct.c
index 07b8aad497..c0ad67479a 100644
--- a/authz/pamacct.c
+++ b/authz/pamacct.c
@@ -136,7 +136,7 @@ static const TypeInfo qauthz_pam_info = {
     .instance_size = sizeof(QAuthZPAM),
     .instance_finalize = qauthz_pam_finalize,
     .class_init = qauthz_pam_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_USER_CREATABLE },
         { }
     }
diff --git a/authz/simple.c b/authz/simple.c
index f6985b840e..f8f2b98518 100644
--- a/authz/simple.c
+++ b/authz/simple.c
@@ -111,7 +111,7 @@ static const TypeInfo qauthz_simple_info = {
     .instance_size = sizeof(QAuthZSimple),
     .instance_finalize = qauthz_simple_finalize,
     .class_init = qauthz_simple_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_USER_CREATABLE },
         { }
     }
diff --git a/backends/cryptodev.c b/backends/cryptodev.c
index 51bbe5ce40..79f8882d3b 100644
--- a/backends/cryptodev.c
+++ b/backends/cryptodev.c
@@ -641,7 +641,7 @@ static const TypeInfo cryptodev_backend_info = {
     .instance_finalize = cryptodev_backend_finalize,
     .class_size = sizeof(CryptoDevBackendClass),
     .class_init = cryptodev_backend_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_USER_CREATABLE },
         { }
     }
diff --git a/backends/dbus-vmstate.c b/backends/dbus-vmstate.c
index 8c2deef43d..7d5b58b4c9 100644
--- a/backends/dbus-vmstate.c
+++ b/backends/dbus-vmstate.c
@@ -505,7 +505,7 @@ static const TypeInfo dbus_vmstate_info = {
     .instance_size = sizeof(DBusVMState),
     .instance_finalize = dbus_vmstate_finalize,
     .class_init = dbus_vmstate_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_USER_CREATABLE },
         { TYPE_VMSTATE_IF },
         { }
diff --git a/backends/hostmem.c b/backends/hostmem.c
index 195f37fa44..35734d6f4d 100644
--- a/backends/hostmem.c
+++ b/backends/hostmem.c
@@ -586,7 +586,7 @@ static const TypeInfo host_memory_backend_info = {
     .instance_size = sizeof(HostMemoryBackend),
     .instance_init = host_memory_backend_init,
     .instance_post_init = host_memory_backend_post_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_USER_CREATABLE },
         { }
     }
diff --git a/backends/iommufd.c b/backends/iommufd.c
index 17f7ae3809..1498102099 100644
--- a/backends/iommufd.c
+++ b/backends/iommufd.c
@@ -342,7 +342,7 @@ static const TypeInfo types[] = {
         .instance_finalize = iommufd_backend_finalize,
         .class_size = sizeof(IOMMUFDBackendClass),
         .class_init = iommufd_backend_class_init,
-        .interfaces = (InterfaceInfo[]) {
+        .interfaces = (const InterfaceInfo[]) {
             { TYPE_USER_CREATABLE },
             { }
         }
diff --git a/backends/rng.c b/backends/rng.c
index b3480d27a1..ab94dfea85 100644
--- a/backends/rng.c
+++ b/backends/rng.c
@@ -119,7 +119,7 @@ static const TypeInfo rng_backend_info = {
     .class_size = sizeof(RngBackendClass),
     .class_init = rng_backend_class_init,
     .abstract = true,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_USER_CREATABLE },
         { }
     }
diff --git a/block/throttle-groups.c b/block/throttle-groups.c
index 9720cafb96..66fdce9a90 100644
--- a/block/throttle-groups.c
+++ b/block/throttle-groups.c
@@ -967,7 +967,7 @@ static const TypeInfo throttle_group_info = {
     .instance_size = sizeof(ThrottleGroup),
     .instance_init = throttle_group_obj_init,
     .instance_finalize = throttle_group_obj_finalize,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_USER_CREATABLE },
         { }
     },
diff --git a/crypto/secret_common.c b/crypto/secret_common.c
index 2399ce412b..a5ecb876ae 100644
--- a/crypto/secret_common.c
+++ b/crypto/secret_common.c
@@ -375,7 +375,7 @@ static const TypeInfo qcrypto_secret_info = {
     .class_size = sizeof(QCryptoSecretCommonClass),
     .class_init = qcrypto_secret_class_init,
     .abstract = true,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_USER_CREATABLE },
         { }
     }
diff --git a/crypto/tls-cipher-suites.c b/crypto/tls-cipher-suites.c
index e546cc7c0e..d9b61d0c08 100644
--- a/crypto/tls-cipher-suites.c
+++ b/crypto/tls-cipher-suites.c
@@ -118,7 +118,7 @@ static const TypeInfo qcrypto_tls_cipher_suites_info = {
     .instance_size = sizeof(QCryptoTLSCipherSuites),
     .class_size = sizeof(QCryptoTLSCredsClass),
     .class_init = qcrypto_tls_cipher_suites_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_USER_CREATABLE },
         { TYPE_FW_CFG_DATA_GENERATOR_INTERFACE },
         { }
diff --git a/crypto/tlscredsanon.c b/crypto/tlscredsanon.c
index 0e2d133821..44af9e6c9a 100644
--- a/crypto/tlscredsanon.c
+++ b/crypto/tlscredsanon.c
@@ -152,7 +152,7 @@ static const TypeInfo qcrypto_tls_creds_anon_info = {
     .instance_finalize = qcrypto_tls_creds_anon_finalize,
     .class_size = sizeof(QCryptoTLSCredsAnonClass),
     .class_init = qcrypto_tls_creds_anon_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_USER_CREATABLE },
         { }
     }
diff --git a/crypto/tlscredspsk.c b/crypto/tlscredspsk.c
index 287c2a3c96..5b68a6b7ba 100644
--- a/crypto/tlscredspsk.c
+++ b/crypto/tlscredspsk.c
@@ -255,7 +255,7 @@ static const TypeInfo qcrypto_tls_creds_psk_info = {
     .instance_finalize = qcrypto_tls_creds_psk_finalize,
     .class_size = sizeof(QCryptoTLSCredsPSKClass),
     .class_init = qcrypto_tls_creds_psk_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_USER_CREATABLE },
         { }
     }
diff --git a/crypto/tlscredsx509.c b/crypto/tlscredsx509.c
index 143993f539..63a72fe47c 100644
--- a/crypto/tlscredsx509.c
+++ b/crypto/tlscredsx509.c
@@ -828,7 +828,7 @@ static const TypeInfo qcrypto_tls_creds_x509_info = {
     .instance_finalize = qcrypto_tls_creds_x509_finalize,
     .class_size = sizeof(QCryptoTLSCredsX509Class),
     .class_init = qcrypto_tls_creds_x509_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_USER_CREATABLE },
         { }
     }
diff --git a/event-loop-base.c b/event-loop-base.c
index 733c54486c..8ca143bea4 100644
--- a/event-loop-base.c
+++ b/event-loop-base.c
@@ -126,7 +126,7 @@ static const TypeInfo event_loop_base_info = {
     .class_size = sizeof(EventLoopBaseClass),
     .class_init = event_loop_base_class_init,
     .abstract = true,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_USER_CREATABLE },
         { }
     }
diff --git a/hw/acpi/erst.c b/hw/acpi/erst.c
index 90148ec9dc..099cabb7ab 100644
--- a/hw/acpi/erst.c
+++ b/hw/acpi/erst.c
@@ -1044,7 +1044,7 @@ static const TypeInfo erst_type_info = {
     .parent        = TYPE_PCI_DEVICE,
     .class_init    = erst_class_init,
     .instance_size = sizeof(ERSTDeviceState),
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { }
     }
diff --git a/hw/acpi/generic_event_device.c b/hw/acpi/generic_event_device.c
index f589e79a2b..d8adfea648 100644
--- a/hw/acpi/generic_event_device.c
+++ b/hw/acpi/generic_event_device.c
@@ -494,7 +494,7 @@ static const TypeInfo acpi_ged_info = {
     .instance_size = sizeof(AcpiGedState),
     .instance_init  = acpi_ged_initfn,
     .class_init    = acpi_ged_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_HOTPLUG_HANDLER },
         { TYPE_ACPI_DEVICE_IF },
         { }
diff --git a/hw/acpi/piix4.c b/hw/acpi/piix4.c
index 5860e8408b..b16d45f03e 100644
--- a/hw/acpi/piix4.c
+++ b/hw/acpi/piix4.c
@@ -657,7 +657,7 @@ static const TypeInfo piix4_pm_info = {
     .instance_init  = piix4_pm_init,
     .instance_size = sizeof(PIIX4PMState),
     .class_init    = piix4_pm_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_HOTPLUG_HANDLER },
         { TYPE_ACPI_DEVICE_IF },
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
index 9403b65ddb..50ab7f4810 100644
--- a/hw/arm/armsse.c
+++ b/hw/arm/armsse.c
@@ -1713,7 +1713,7 @@ static const TypeInfo armsse_info = {
     .class_size = sizeof(ARMSSEClass),
     .instance_init = armsse_init,
     .abstract = true,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_IDAU_INTERFACE },
         { }
     }
diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
index 8474549f5f..5dd87cc028 100644
--- a/hw/arm/mps2-tz.c
+++ b/hw/arm/mps2-tz.c
@@ -1453,7 +1453,7 @@ static const TypeInfo mps2tz_info = {
     .instance_size = sizeof(MPS2TZMachineState),
     .class_size = sizeof(MPS2TZMachineClass),
     .class_init = mps2tz_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_IDAU_INTERFACE },
         { }
     },
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index 17faf34aae..177f3dd22c 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -3396,7 +3396,7 @@ static const TypeInfo virt_machine_info = {
     .class_size    = sizeof(VirtMachineClass),
     .class_init    = virt_machine_class_init,
     .instance_init = virt_instance_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
          { TYPE_HOTPLUG_HANDLER },
          { }
     },
diff --git a/hw/audio/ac97.c b/hw/audio/ac97.c
index 7454cc60de..669a0463cc 100644
--- a/hw/audio/ac97.c
+++ b/hw/audio/ac97.c
@@ -1351,7 +1351,7 @@ static const TypeInfo ac97_info = {
     .parent        = TYPE_PCI_DEVICE,
     .instance_size = sizeof(AC97LinkState),
     .class_init    = ac97_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { },
     },
diff --git a/hw/audio/es1370.c b/hw/audio/es1370.c
index 322b779814..8efb969212 100644
--- a/hw/audio/es1370.c
+++ b/hw/audio/es1370.c
@@ -896,7 +896,7 @@ static const TypeInfo es1370_info = {
     .parent        = TYPE_PCI_DEVICE,
     .instance_size = sizeof (ES1370State),
     .class_init    = es1370_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { },
     },
diff --git a/hw/audio/intel-hda.c b/hw/audio/intel-hda.c
index 2f1b08e9c1..b256c8ccea 100644
--- a/hw/audio/intel-hda.c
+++ b/hw/audio/intel-hda.c
@@ -1262,7 +1262,7 @@ static const TypeInfo intel_hda_info = {
     .instance_size = sizeof(IntelHDAState),
     .class_init    = intel_hda_class_init,
     .abstract      = true,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { },
     },
diff --git a/hw/audio/via-ac97.c b/hw/audio/via-ac97.c
index 5feef663d8..1e0a5c7398 100644
--- a/hw/audio/via-ac97.c
+++ b/hw/audio/via-ac97.c
@@ -487,7 +487,7 @@ static const TypeInfo via_ac97_info = {
     .parent        = TYPE_PCI_DEVICE,
     .instance_size = sizeof(ViaAC97State),
     .class_init    = via_ac97_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { },
     },
@@ -522,7 +522,7 @@ static const TypeInfo via_mc97_info = {
     .parent        = TYPE_PCI_DEVICE,
     .instance_size = sizeof(PCIDevice),
     .class_init    = via_mc97_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { },
     },
diff --git a/hw/block/fdc-isa.c b/hw/block/fdc-isa.c
index fbba2ab629..6d1790e0e6 100644
--- a/hw/block/fdc-isa.c
+++ b/hw/block/fdc-isa.c
@@ -331,7 +331,7 @@ static const TypeInfo isa_fdc_info = {
     .instance_size = sizeof(FDCtrlISABus),
     .class_init    = isabus_fdc_class_init,
     .instance_init = isabus_fdc_instance_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_ACPI_DEV_AML_IF },
         { },
     },
diff --git a/hw/char/diva-gsp.c b/hw/char/diva-gsp.c
index 9a623d680b..60f933191d 100644
--- a/hw/char/diva-gsp.c
+++ b/hw/char/diva-gsp.c
@@ -268,7 +268,7 @@ static const TypeInfo diva_aux_info = {
     .instance_size = sizeof(DivaAuxState),
     .instance_init = diva_aux_init,
     .class_init    = diva_aux_class_initfn,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { },
     },
@@ -282,7 +282,7 @@ static const TypeInfo diva_serial_pci_info = {
     .instance_size = sizeof(PCIDivaSerialState),
     .instance_init = diva_serial_init,
     .class_init    = diva_serial_class_initfn,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { },
     },
diff --git a/hw/char/parallel.c b/hw/char/parallel.c
index 217ddaf2e3..8732e4e9f9 100644
--- a/hw/char/parallel.c
+++ b/hw/char/parallel.c
@@ -627,7 +627,7 @@ static const TypeInfo parallel_isa_info = {
     .parent        = TYPE_ISA_DEVICE,
     .instance_size = sizeof(ISAParallelState),
     .class_init    = parallel_isa_class_initfn,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_ACPI_DEV_AML_IF },
         { },
     },
diff --git a/hw/char/serial-isa.c b/hw/char/serial-isa.c
index fe7fb1625b..0ea59a3d5c 100644
--- a/hw/char/serial-isa.c
+++ b/hw/char/serial-isa.c
@@ -146,7 +146,7 @@ static const TypeInfo serial_isa_info = {
     .instance_size = sizeof(ISASerialState),
     .instance_init = serial_isa_initfn,
     .class_init    = serial_isa_class_initfn,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_ACPI_DEV_AML_IF },
         { },
     },
diff --git a/hw/char/serial-pci-multi.c b/hw/char/serial-pci-multi.c
index ee1c0f7dc4..fb184c2e6d 100644
--- a/hw/char/serial-pci-multi.c
+++ b/hw/char/serial-pci-multi.c
@@ -194,7 +194,7 @@ static const TypeInfo multi_2x_serial_pci_info = {
     .instance_size = sizeof(PCIMultiSerialState),
     .instance_init = multi_serial_init,
     .class_init    = multi_2x_serial_pci_class_initfn,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { },
     },
@@ -206,7 +206,7 @@ static const TypeInfo multi_4x_serial_pci_info = {
     .instance_size = sizeof(PCIMultiSerialState),
     .instance_init = multi_serial_init,
     .class_init    = multi_4x_serial_pci_class_initfn,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { },
     },
diff --git a/hw/char/serial-pci.c b/hw/char/serial-pci.c
index bd38c7428c..8707e81914 100644
--- a/hw/char/serial-pci.c
+++ b/hw/char/serial-pci.c
@@ -115,7 +115,7 @@ static const TypeInfo serial_pci_info = {
     .instance_size = sizeof(PCISerialState),
     .instance_init = serial_pci_init,
     .class_init    = serial_pci_class_initfn,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { },
     },
diff --git a/hw/char/virtio-serial-bus.c b/hw/char/virtio-serial-bus.c
index 00572873d2..eb79f5258b 100644
--- a/hw/char/virtio-serial-bus.c
+++ b/hw/char/virtio-serial-bus.c
@@ -1188,7 +1188,7 @@ static const TypeInfo virtio_device_info = {
     .parent = TYPE_VIRTIO_DEVICE,
     .instance_size = sizeof(VirtIOSerial),
     .class_init = virtio_serial_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_HOTPLUG_HANDLER },
         { }
     }
diff --git a/hw/core/bus.c b/hw/core/bus.c
index c3b431a014..bddfc22d38 100644
--- a/hw/core/bus.c
+++ b/hw/core/bus.c
@@ -260,7 +260,7 @@ static const TypeInfo bus_info = {
     .instance_init = qbus_initfn,
     .instance_finalize = qbus_finalize,
     .class_init = bus_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_RESETTABLE_INTERFACE },
         { }
     },
diff --git a/hw/core/qdev.c b/hw/core/qdev.c
index 4a3760c101..f600226176 100644
--- a/hw/core/qdev.c
+++ b/hw/core/qdev.c
@@ -870,7 +870,7 @@ static const TypeInfo device_type_info = {
     .class_init = device_class_init,
     .abstract = true,
     .class_size = sizeof(DeviceClass),
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_VMSTATE_IF },
         { TYPE_RESETTABLE_INTERFACE },
         { }
diff --git a/hw/cxl/switch-mailbox-cci.c b/hw/cxl/switch-mailbox-cci.c
index b92bbeb16e..223f220433 100644
--- a/hw/cxl/switch-mailbox-cci.c
+++ b/hw/cxl/switch-mailbox-cci.c
@@ -99,7 +99,7 @@ static const TypeInfo cswmbcci_info = {
     .parent = TYPE_PCI_DEVICE,
     .class_init = cswmbcci_class_init,
     .instance_size = sizeof(CSWMBCCIDev),
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_PCIE_DEVICE },
         { }
     },
diff --git a/hw/display/apple-gfx-pci.m b/hw/display/apple-gfx-pci.m
index 2f0d24f7fe..b0694f4cb8 100644
--- a/hw/display/apple-gfx-pci.m
+++ b/hw/display/apple-gfx-pci.m
@@ -147,7 +147,7 @@ static const TypeInfo apple_gfx_pci_types[] = {
         .instance_size = sizeof(AppleGFXPCIState),
         .class_init    = apple_gfx_pci_class_init,
         .instance_init = apple_gfx_pci_init,
-        .interfaces = (InterfaceInfo[]) {
+        .interfaces = (const InterfaceInfo[]) {
             { INTERFACE_PCIE_DEVICE },
             { },
         },
diff --git a/hw/display/ati.c b/hw/display/ati.c
index 4e88d09943..7de27732cd 100644
--- a/hw/display/ati.c
+++ b/hw/display/ati.c
@@ -1079,7 +1079,7 @@ static const TypeInfo ati_vga_info = {
     .instance_size = sizeof(ATIVGAState),
     .class_init = ati_vga_class_init,
     .instance_init = ati_vga_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
           { INTERFACE_CONVENTIONAL_PCI_DEVICE },
           { },
     },
diff --git a/hw/display/bochs-display.c b/hw/display/bochs-display.c
index 1d329fc9cc..ad2821c974 100644
--- a/hw/display/bochs-display.c
+++ b/hw/display/bochs-display.c
@@ -374,7 +374,7 @@ static const TypeInfo bochs_display_type_info = {
     .instance_size  = sizeof(BochsDisplayState),
     .instance_init  = bochs_display_init,
     .class_init     = bochs_display_class_init,
-    .interfaces     = (InterfaceInfo[]) {
+    .interfaces     = (const InterfaceInfo[]) {
         { INTERFACE_PCIE_DEVICE },
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { },
diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c
index 4e5ae04af0..ef08694626 100644
--- a/hw/display/cirrus_vga.c
+++ b/hw/display/cirrus_vga.c
@@ -3013,7 +3013,7 @@ static const TypeInfo cirrus_vga_info = {
     .parent        = TYPE_PCI_DEVICE,
     .instance_size = sizeof(PCICirrusVGAState),
     .class_init    = cirrus_vga_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { },
     },
diff --git a/hw/display/qxl.c b/hw/display/qxl.c
index 6c820bcdb5..18f482ca7f 100644
--- a/hw/display/qxl.c
+++ b/hw/display/qxl.c
@@ -2517,7 +2517,7 @@ static const TypeInfo qxl_pci_type_info = {
     .instance_size = sizeof(PCIQXLDevice),
     .abstract = true,
     .class_init = qxl_pci_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { },
     },
diff --git a/hw/display/sm501.c b/hw/display/sm501.c
index dcff1e978e..6d2f18684c 100644
--- a/hw/display/sm501.c
+++ b/hw/display/sm501.c
@@ -2196,7 +2196,7 @@ static const TypeInfo sm501_pci_info = {
     .instance_size = sizeof(SM501PCIState),
     .class_init    = sm501_pci_class_init,
     .instance_init = sm501_pci_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { },
     },
diff --git a/hw/display/vga-pci.c b/hw/display/vga-pci.c
index a860197274..b81f7fd2d0 100644
--- a/hw/display/vga-pci.c
+++ b/hw/display/vga-pci.c
@@ -369,7 +369,7 @@ static const TypeInfo vga_pci_type_info = {
     .instance_size = sizeof(PCIVGAState),
     .abstract = true,
     .class_init = vga_pci_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { TYPE_ACPI_DEV_AML_IF },
         { },
diff --git a/hw/display/virtio-gpu-pci-rutabaga.c b/hw/display/virtio-gpu-pci-rutabaga.c
index abbb898c65..5fdff37f2c 100644
--- a/hw/display/virtio-gpu-pci-rutabaga.c
+++ b/hw/display/virtio-gpu-pci-rutabaga.c
@@ -34,7 +34,7 @@ static const TypeInfo virtio_gpu_rutabaga_pci_info[] = {
         .parent = TYPE_VIRTIO_GPU_PCI_BASE,
         .instance_size = sizeof(VirtIOGPURutabagaPCI),
         .instance_init = virtio_gpu_rutabaga_initfn,
-        .interfaces = (InterfaceInfo[]) {
+        .interfaces = (const InterfaceInfo[]) {
             { INTERFACE_CONVENTIONAL_PCI_DEVICE },
             { },
         }
diff --git a/hw/display/vmware_vga.c b/hw/display/vmware_vga.c
index 7777deb17d..544bb65320 100644
--- a/hw/display/vmware_vga.c
+++ b/hw/display/vmware_vga.c
@@ -1363,7 +1363,7 @@ static const TypeInfo vmsvga_info = {
     .parent        = TYPE_PCI_DEVICE,
     .instance_size = sizeof(struct pci_vmsvga_state_s),
     .class_init    = vmsvga_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { },
     },
diff --git a/hw/dma/i8257.c b/hw/dma/i8257.c
index 1d67e50536..2463952ada 100644
--- a/hw/dma/i8257.c
+++ b/hw/dma/i8257.c
@@ -618,7 +618,7 @@ static const TypeInfo i8257_info = {
     .parent = TYPE_ISA_DEVICE,
     .instance_size = sizeof(I8257State),
     .class_init = i8257_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_ISADMA },
         { }
     }
diff --git a/hw/dma/xilinx_axidma.c b/hw/dma/xilinx_axidma.c
index bf1b523ac8..2020399fd5 100644
--- a/hw/dma/xilinx_axidma.c
+++ b/hw/dma/xilinx_axidma.c
@@ -662,7 +662,7 @@ static const TypeInfo xilinx_axidma_data_stream_info = {
     .instance_size = sizeof(XilinxAXIDMAStreamSink),
     .class_init    = xilinx_axidma_stream_class_init,
     .class_data    = &xilinx_axidma_data_stream_class,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_STREAM_SINK },
         { }
     }
@@ -674,7 +674,7 @@ static const TypeInfo xilinx_axidma_control_stream_info = {
     .instance_size = sizeof(XilinxAXIDMAStreamSink),
     .class_init    = xilinx_axidma_stream_class_init,
     .class_data    = &xilinx_axidma_control_stream_class,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_STREAM_SINK },
         { }
     }
diff --git a/hw/dma/xlnx_csu_dma.c b/hw/dma/xlnx_csu_dma.c
index 6943c927d0..3db3904d83 100644
--- a/hw/dma/xlnx_csu_dma.c
+++ b/hw/dma/xlnx_csu_dma.c
@@ -744,7 +744,7 @@ static const TypeInfo xlnx_csu_dma_info = {
     .class_init    = xlnx_csu_dma_class_init,
     .class_size    = sizeof(XlnxCSUDMAClass),
     .instance_init = xlnx_csu_dma_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_STREAM_SINK },
         { }
     }
diff --git a/hw/hppa/machine.c b/hw/hppa/machine.c
index 1812276678..dacedc5409 100644
--- a/hw/hppa/machine.c
+++ b/hw/hppa/machine.c
@@ -713,7 +713,7 @@ static const TypeInfo HP_B160L_machine_init_typeinfo = {
     .name = MACHINE_TYPE_NAME("B160L"),
     .parent = TYPE_MACHINE,
     .class_init = HP_B160L_machine_init_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_NMI },
         { }
     },
@@ -749,7 +749,7 @@ static const TypeInfo HP_C3700_machine_init_typeinfo = {
     .name = MACHINE_TYPE_NAME("C3700"),
     .parent = TYPE_MACHINE,
     .class_init = HP_C3700_machine_init_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_NMI },
         { }
     },
diff --git a/hw/i2c/smbus_ich9.c b/hw/i2c/smbus_ich9.c
index f1fca30fea..956c9b59bb 100644
--- a/hw/i2c/smbus_ich9.c
+++ b/hw/i2c/smbus_ich9.c
@@ -145,7 +145,7 @@ static const TypeInfo ich9_smb_info = {
     .parent = TYPE_PCI_DEVICE,
     .instance_size = sizeof(ICH9SMBState),
     .class_init = ich9_smb_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { TYPE_ACPI_DEV_AML_IF },
         { },
diff --git a/hw/i386/amd_iommu.c b/hw/i386/amd_iommu.c
index b94802e21a..2cf7e24a21 100644
--- a/hw/i386/amd_iommu.c
+++ b/hw/i386/amd_iommu.c
@@ -1719,7 +1719,7 @@ static const TypeInfo amdvi_pci = {
     .parent = TYPE_PCI_DEVICE,
     .instance_size = sizeof(AMDVIPCIState),
     .class_init = amdvi_pci_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { },
     },
diff --git a/hw/i386/microvm.c b/hw/i386/microvm.c
index 14a918a531..e0daf0d4fc 100644
--- a/hw/i386/microvm.c
+++ b/hw/i386/microvm.c
@@ -726,7 +726,7 @@ static const TypeInfo microvm_machine_info = {
     .instance_init = microvm_machine_initfn,
     .class_size    = sizeof(MicrovmMachineClass),
     .class_init    = microvm_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
          { TYPE_HOTPLUG_HANDLER },
          { }
     },
diff --git a/hw/i386/pc.c b/hw/i386/pc.c
index 49753bf0b3..70656157ca 100644
--- a/hw/i386/pc.c
+++ b/hw/i386/pc.c
@@ -1870,7 +1870,7 @@ static const TypeInfo pc_machine_info = {
     .instance_init = pc_machine_initfn,
     .class_size = sizeof(PCMachineClass),
     .class_init = pc_machine_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
          { TYPE_HOTPLUG_HANDLER },
          { }
     },
diff --git a/hw/i386/sgx-epc.c b/hw/i386/sgx-epc.c
index 8fb80900b7..2b3b2823b5 100644
--- a/hw/i386/sgx-epc.c
+++ b/hw/i386/sgx-epc.c
@@ -173,7 +173,7 @@ static const TypeInfo sgx_epc_info = {
     .instance_init = sgx_epc_init,
     .class_init    = sgx_epc_class_init,
     .class_size    = sizeof(DeviceClass),
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_MEMORY_DEVICE },
         { }
     },
diff --git a/hw/i386/x86.c b/hw/i386/x86.c
index c8e2551b2b..e2d0409299 100644
--- a/hw/i386/x86.c
+++ b/hw/i386/x86.c
@@ -450,7 +450,7 @@ static const TypeInfo x86_machine_info = {
     .instance_init = x86_machine_initfn,
     .class_size = sizeof(X86MachineClass),
     .class_init = x86_machine_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
          { TYPE_NMI },
          { }
     },
diff --git a/hw/i386/xen/xen_platform.c b/hw/i386/xen/xen_platform.c
index 7c0d345f96..c8b852be0c 100644
--- a/hw/i386/xen/xen_platform.c
+++ b/hw/i386/xen/xen_platform.c
@@ -604,7 +604,7 @@ static const TypeInfo xen_platform_info = {
     .parent        = TYPE_PCI_DEVICE,
     .instance_size = sizeof(PCIXenPlatformState),
     .class_init    = xen_platform_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { },
     },
diff --git a/hw/i386/xen/xen_pvdevice.c b/hw/i386/xen/xen_pvdevice.c
index 65868bd5e5..87a974ae5a 100644
--- a/hw/i386/xen/xen_pvdevice.c
+++ b/hw/i386/xen/xen_pvdevice.c
@@ -139,7 +139,7 @@ static const TypeInfo xen_pv_type_info = {
     .parent        = TYPE_PCI_DEVICE,
     .instance_size = sizeof(XenPVDevice),
     .class_init    = xen_pv_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { },
     },
diff --git a/hw/ide/ich.c b/hw/ide/ich.c
index f2773ab462..4cade0d121 100644
--- a/hw/ide/ich.c
+++ b/hw/ide/ich.c
@@ -197,7 +197,7 @@ static const TypeInfo ich_ahci_info = {
     .instance_size = sizeof(AHCIPCIState),
     .instance_init = pci_ich9_ahci_init,
     .class_init    = ich_ahci_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { },
     },
diff --git a/hw/ide/pci.c b/hw/ide/pci.c
index 0ed72e4223..1e50bb9e48 100644
--- a/hw/ide/pci.c
+++ b/hw/ide/pci.c
@@ -625,7 +625,7 @@ static const TypeInfo pci_ide_type_info = {
     .instance_size = sizeof(PCIIDEState),
     .instance_init = pci_ide_init,
     .abstract = true,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { },
     },
diff --git a/hw/input/pckbd.c b/hw/input/pckbd.c
index 83930dd50c..71f5f976e9 100644
--- a/hw/input/pckbd.c
+++ b/hw/input/pckbd.c
@@ -958,7 +958,7 @@ static const TypeInfo i8042_info = {
     .instance_size = sizeof(ISAKBDState),
     .instance_init = i8042_initfn,
     .class_init    = i8042_class_initfn,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_ACPI_DEV_AML_IF },
         { },
     },
diff --git a/hw/intc/arm_gic_common.c b/hw/intc/arm_gic_common.c
index f61d1c1fe6..0f0c48d89a 100644
--- a/hw/intc/arm_gic_common.c
+++ b/hw/intc/arm_gic_common.c
@@ -382,7 +382,7 @@ static const TypeInfo arm_gic_common_type = {
     .class_size = sizeof(ARMGICCommonClass),
     .class_init = arm_gic_common_class_init,
     .abstract = true,
-    .interfaces = (InterfaceInfo []) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_ARM_LINUX_BOOT_IF },
         { },
     },
diff --git a/hw/intc/arm_gicv3_common.c b/hw/intc/arm_gicv3_common.c
index dd86a50300..1cee68193c 100644
--- a/hw/intc/arm_gicv3_common.c
+++ b/hw/intc/arm_gicv3_common.c
@@ -644,7 +644,7 @@ static const TypeInfo arm_gicv3_common_type = {
     .class_init = arm_gicv3_common_class_init,
     .instance_finalize = arm_gicv3_finalize,
     .abstract = true,
-    .interfaces = (InterfaceInfo []) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_ARM_LINUX_BOOT_IF },
         { },
     },
diff --git a/hw/intc/goldfish_pic.c b/hw/intc/goldfish_pic.c
index b80538cdeb..2359861785 100644
--- a/hw/intc/goldfish_pic.c
+++ b/hw/intc/goldfish_pic.c
@@ -204,7 +204,7 @@ static const TypeInfo goldfish_pic_info = {
     .class_init = goldfish_pic_class_init,
     .instance_init = goldfish_pic_instance_init,
     .instance_size = sizeof(GoldfishPICState),
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
          { TYPE_INTERRUPT_STATS_PROVIDER },
          { }
     },
diff --git a/hw/intc/i8259_common.c b/hw/intc/i8259_common.c
index 4a92e0da90..602e44c8ea 100644
--- a/hw/intc/i8259_common.c
+++ b/hw/intc/i8259_common.c
@@ -226,7 +226,7 @@ static const TypeInfo pic_common_type = {
     .class_size = sizeof(PICCommonClass),
     .class_init = pic_common_class_init,
     .abstract = true,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_INTERRUPT_STATS_PROVIDER },
         { }
     },
diff --git a/hw/intc/ioapic_common.c b/hw/intc/ioapic_common.c
index b0381c7990..fce3486e51 100644
--- a/hw/intc/ioapic_common.c
+++ b/hw/intc/ioapic_common.c
@@ -215,7 +215,7 @@ static const TypeInfo ioapic_common_type = {
     .class_size = sizeof(IOAPICCommonClass),
     .class_init = ioapic_common_class_init,
     .abstract = true,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_INTERRUPT_STATS_PROVIDER },
         { }
     },
diff --git a/hw/intc/loongarch_extioi_common.c b/hw/intc/loongarch_extioi_common.c
index 126f13d12c..9e1589060c 100644
--- a/hw/intc/loongarch_extioi_common.c
+++ b/hw/intc/loongarch_extioi_common.c
@@ -196,7 +196,7 @@ static const TypeInfo loongarch_extioi_common_types[] = {
         .instance_size      = sizeof(LoongArchExtIOICommonState),
         .class_size         = sizeof(LoongArchExtIOICommonClass),
         .class_init         = loongarch_extioi_common_class_init,
-        .interfaces         = (InterfaceInfo[]) {
+        .interfaces         = (const InterfaceInfo[]) {
             { TYPE_HOTPLUG_HANDLER },
             { }
         },
diff --git a/hw/intc/loongarch_ipi.c b/hw/intc/loongarch_ipi.c
index 4dad240689..2f8bb57828 100644
--- a/hw/intc/loongarch_ipi.c
+++ b/hw/intc/loongarch_ipi.c
@@ -162,7 +162,7 @@ static const TypeInfo loongarch_ipi_types[] = {
         .instance_size      = sizeof(LoongarchIPIState),
         .class_size         = sizeof(LoongarchIPIClass),
         .class_init         = loongarch_ipi_class_init,
-        .interfaces         = (InterfaceInfo[]) {
+        .interfaces         = (const InterfaceInfo[]) {
             { TYPE_HOTPLUG_HANDLER },
             { }
         },
diff --git a/hw/intc/m68k_irqc.c b/hw/intc/m68k_irqc.c
index 215e1a6ed5..2532322618 100644
--- a/hw/intc/m68k_irqc.c
+++ b/hw/intc/m68k_irqc.c
@@ -110,7 +110,7 @@ static const TypeInfo m68k_irqc_type_info = {
     .instance_size = sizeof(M68KIRQCState),
     .instance_init = m68k_irqc_instance_init,
     .class_init = m68k_irqc_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
          { TYPE_NMI },
          { TYPE_INTERRUPT_STATS_PROVIDER },
          { }
diff --git a/hw/intc/pnv_xive.c b/hw/intc/pnv_xive.c
index cd73881b5b..935c0e4742 100644
--- a/hw/intc/pnv_xive.c
+++ b/hw/intc/pnv_xive.c
@@ -2106,7 +2106,7 @@ static const TypeInfo pnv_xive_info = {
     .instance_size = sizeof(PnvXive),
     .class_init    = pnv_xive_class_init,
     .class_size    = sizeof(PnvXiveClass),
-    .interfaces    = (InterfaceInfo[]) {
+    .interfaces    = (const InterfaceInfo[]) {
         { TYPE_PNV_XSCOM_INTERFACE },
         { }
     }
diff --git a/hw/intc/pnv_xive2.c b/hw/intc/pnv_xive2.c
index 02437dddac..ec8b0c68f1 100644
--- a/hw/intc/pnv_xive2.c
+++ b/hw/intc/pnv_xive2.c
@@ -2547,7 +2547,7 @@ static const TypeInfo pnv_xive2_info = {
     .instance_size = sizeof(PnvXive2),
     .class_init    = pnv_xive2_class_init,
     .class_size    = sizeof(PnvXive2Class),
-    .interfaces    = (InterfaceInfo[]) {
+    .interfaces    = (const InterfaceInfo[]) {
         { TYPE_PNV_XSCOM_INTERFACE },
         { }
     }
diff --git a/hw/intc/slavio_intctl.c b/hw/intc/slavio_intctl.c
index 5776055a8b..00b80bb177 100644
--- a/hw/intc/slavio_intctl.c
+++ b/hw/intc/slavio_intctl.c
@@ -460,7 +460,7 @@ static const TypeInfo slavio_intctl_info = {
     .instance_size = sizeof(SLAVIO_INTCTLState),
     .instance_init = slavio_intctl_init,
     .class_init    = slavio_intctl_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_INTERRUPT_STATS_PROVIDER },
         { }
     },
diff --git a/hw/intc/spapr_xive.c b/hw/intc/spapr_xive.c
index 7fde6059bf..440edb97d8 100644
--- a/hw/intc/spapr_xive.c
+++ b/hw/intc/spapr_xive.c
@@ -856,7 +856,7 @@ static const TypeInfo spapr_xive_info = {
     .instance_size = sizeof(SpaprXive),
     .class_init = spapr_xive_class_init,
     .class_size = sizeof(SpaprXiveClass),
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_SPAPR_INTC },
         { }
     },
diff --git a/hw/intc/xics_spapr.c b/hw/intc/xics_spapr.c
index 9e465fb8f3..7663596a4a 100644
--- a/hw/intc/xics_spapr.c
+++ b/hw/intc/xics_spapr.c
@@ -461,7 +461,7 @@ static const TypeInfo ics_spapr_info = {
     .name = TYPE_ICS_SPAPR,
     .parent = TYPE_ICS,
     .class_init = ics_spapr_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_SPAPR_INTC },
         { }
     },
diff --git a/hw/intc/xive.c b/hw/intc/xive.c
index 069c1e9a5e..27b473e4d7 100644
--- a/hw/intc/xive.c
+++ b/hw/intc/xive.c
@@ -2108,7 +2108,7 @@ static const TypeInfo xive_router_info = {
     .instance_size = sizeof(XiveRouter),
     .class_size    = sizeof(XiveRouterClass),
     .class_init    = xive_router_class_init,
-    .interfaces    = (InterfaceInfo[]) {
+    .interfaces    = (const InterfaceInfo[]) {
         { TYPE_XIVE_NOTIFIER },
         { TYPE_XIVE_PRESENTER },
         { }
diff --git a/hw/intc/xive2.c b/hw/intc/xive2.c
index 3337a943fb..a08cf906d0 100644
--- a/hw/intc/xive2.c
+++ b/hw/intc/xive2.c
@@ -1609,7 +1609,7 @@ static const TypeInfo xive2_router_info = {
     .instance_size = sizeof(Xive2Router),
     .class_size    = sizeof(Xive2RouterClass),
     .class_init    = xive2_router_class_init,
-    .interfaces    = (InterfaceInfo[]) {
+    .interfaces    = (const InterfaceInfo[]) {
         { TYPE_XIVE_NOTIFIER },
         { TYPE_XIVE_PRESENTER },
         { }
diff --git a/hw/ipack/tpci200.c b/hw/ipack/tpci200.c
index f6993330d2..40b30517c7 100644
--- a/hw/ipack/tpci200.c
+++ b/hw/ipack/tpci200.c
@@ -650,7 +650,7 @@ static const TypeInfo tpci200_info = {
     .parent        = TYPE_PCI_DEVICE,
     .instance_size = sizeof(TPCI200State),
     .class_init    = tpci200_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { },
     },
diff --git a/hw/ipmi/isa_ipmi_bt.c b/hw/ipmi/isa_ipmi_bt.c
index db539e68ae..0ad91ccf68 100644
--- a/hw/ipmi/isa_ipmi_bt.c
+++ b/hw/ipmi/isa_ipmi_bt.c
@@ -161,7 +161,7 @@ static const TypeInfo isa_ipmi_bt_info = {
     .instance_size = sizeof(ISAIPMIBTDevice),
     .instance_init = isa_ipmi_bt_init,
     .class_init    = isa_ipmi_bt_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_IPMI_INTERFACE },
         { TYPE_ACPI_DEV_AML_IF },
         { }
diff --git a/hw/ipmi/isa_ipmi_kcs.c b/hw/ipmi/isa_ipmi_kcs.c
index 4cbc6c577c..418d234e0f 100644
--- a/hw/ipmi/isa_ipmi_kcs.c
+++ b/hw/ipmi/isa_ipmi_kcs.c
@@ -167,7 +167,7 @@ static const TypeInfo isa_ipmi_kcs_info = {
     .instance_size = sizeof(ISAIPMIKCSDevice),
     .instance_init = isa_ipmi_kcs_init,
     .class_init    = isa_ipmi_kcs_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_IPMI_INTERFACE },
         { TYPE_ACPI_DEV_AML_IF },
         { }
diff --git a/hw/ipmi/pci_ipmi_bt.c b/hw/ipmi/pci_ipmi_bt.c
index 23f65c6886..905101dcaf 100644
--- a/hw/ipmi/pci_ipmi_bt.c
+++ b/hw/ipmi/pci_ipmi_bt.c
@@ -145,7 +145,7 @@ static const TypeInfo pci_ipmi_bt_info = {
     .instance_size = sizeof(PCIIPMIBTDevice),
     .instance_init = pci_ipmi_bt_instance_init,
     .class_init    = pci_ipmi_bt_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_IPMI_INTERFACE },
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { }
diff --git a/hw/ipmi/pci_ipmi_kcs.c b/hw/ipmi/pci_ipmi_kcs.c
index 4077b6a7b0..4d6cde826e 100644
--- a/hw/ipmi/pci_ipmi_kcs.c
+++ b/hw/ipmi/pci_ipmi_kcs.c
@@ -144,7 +144,7 @@ static const TypeInfo pci_ipmi_kcs_info = {
     .instance_size = sizeof(PCIIPMIKCSDevice),
     .instance_init = pci_ipmi_kcs_instance_init,
     .class_init    = pci_ipmi_kcs_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_IPMI_INTERFACE },
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { }
diff --git a/hw/ipmi/smbus_ipmi.c b/hw/ipmi/smbus_ipmi.c
index 7345844a3a..78c332de54 100644
--- a/hw/ipmi/smbus_ipmi.c
+++ b/hw/ipmi/smbus_ipmi.c
@@ -376,7 +376,7 @@ static const TypeInfo smbus_ipmi_info = {
     .instance_size = sizeof(SMBusIPMIDevice),
     .instance_init = smbus_ipmi_init,
     .class_init    = smbus_ipmi_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_IPMI_INTERFACE },
         { TYPE_ACPI_DEV_AML_IF },
         { }
diff --git a/hw/isa/i82378.c b/hw/isa/i82378.c
index 26c8ec4f77..06e8f0ce3e 100644
--- a/hw/isa/i82378.c
+++ b/hw/isa/i82378.c
@@ -142,7 +142,7 @@ static const TypeInfo i82378_type_info = {
     .instance_size = sizeof(I82378State),
     .instance_init = i82378_init,
     .class_init = i82378_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { },
     },
diff --git a/hw/isa/lpc_ich9.c b/hw/isa/lpc_ich9.c
index d3e623b1e8..71afb45b63 100644
--- a/hw/isa/lpc_ich9.c
+++ b/hw/isa/lpc_ich9.c
@@ -915,7 +915,7 @@ static const TypeInfo ich9_lpc_info = {
     .instance_size = sizeof(ICH9LPCState),
     .instance_init = ich9_lpc_initfn,
     .class_init  = ich9_lpc_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_HOTPLUG_HANDLER },
         { TYPE_ACPI_DEVICE_IF },
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
diff --git a/hw/isa/piix.c b/hw/isa/piix.c
index 2c6e76f97c..52c14d3cd5 100644
--- a/hw/isa/piix.c
+++ b/hw/isa/piix.c
@@ -445,7 +445,7 @@ static const TypeInfo piix_pci_type_info = {
     .instance_init = pci_piix_init,
     .abstract = true,
     .class_init = pci_piix_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { TYPE_ACPI_DEV_AML_IF },
         { },
diff --git a/hw/isa/vt82c686.c b/hw/isa/vt82c686.c
index c62afc907b..337958617a 100644
--- a/hw/isa/vt82c686.c
+++ b/hw/isa/vt82c686.c
@@ -243,7 +243,7 @@ static const TypeInfo via_pm_info = {
     .parent        = TYPE_PCI_DEVICE,
     .instance_size = sizeof(ViaPMState),
     .abstract      = true,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { },
     },
@@ -634,7 +634,7 @@ static const TypeInfo via_isa_info = {
     .instance_size = sizeof(ViaISAState),
     .instance_init = via_isa_init,
     .abstract      = true,
-    .interfaces    = (InterfaceInfo[]) {
+    .interfaces    = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { },
     },
diff --git a/hw/loongarch/virt.c b/hw/loongarch/virt.c
index fde25e9409..779544fada 100644
--- a/hw/loongarch/virt.c
+++ b/hw/loongarch/virt.c
@@ -1186,7 +1186,7 @@ static const TypeInfo virt_machine_types[] = {
         .instance_size  = sizeof(LoongArchVirtMachineState),
         .class_init     = virt_class_init,
         .instance_init  = virt_initfn,
-        .interfaces = (InterfaceInfo[]) {
+        .interfaces = (const InterfaceInfo[]) {
          { TYPE_HOTPLUG_HANDLER },
          { }
         },
diff --git a/hw/m68k/q800-glue.c b/hw/m68k/q800-glue.c
index b428e7c833..36de67c328 100644
--- a/hw/m68k/q800-glue.c
+++ b/hw/m68k/q800-glue.c
@@ -248,7 +248,7 @@ static const TypeInfo glue_info_types[] = {
         .instance_init = glue_init,
         .instance_finalize = glue_finalize,
         .class_init = glue_class_init,
-        .interfaces = (InterfaceInfo[]) {
+        .interfaces = (const InterfaceInfo[]) {
              { TYPE_NMI },
              { }
         },
diff --git a/hw/mem/cxl_type3.c b/hw/mem/cxl_type3.c
index c95722a2ae..bba923f8ea 100644
--- a/hw/mem/cxl_type3.c
+++ b/hw/mem/cxl_type3.c
@@ -2174,7 +2174,7 @@ static const TypeInfo ct3d_info = {
     .class_size = sizeof(struct CXLType3Class),
     .class_init = ct3_class_init,
     .instance_size = sizeof(CXLType3Dev),
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CXL_DEVICE },
         { INTERFACE_PCIE_DEVICE },
         {}
diff --git a/hw/mem/pc-dimm.c b/hw/mem/pc-dimm.c
index 6f68171442..f701d5b5f9 100644
--- a/hw/mem/pc-dimm.c
+++ b/hw/mem/pc-dimm.c
@@ -301,7 +301,7 @@ static const TypeInfo pc_dimm_info = {
     .instance_init = pc_dimm_init,
     .class_init    = pc_dimm_class_init,
     .class_size    = sizeof(PCDIMMDeviceClass),
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_MEMORY_DEVICE },
         { }
     },
diff --git a/hw/misc/applesmc.c b/hw/misc/applesmc.c
index d83a81b60d..a015d4a9b8 100644
--- a/hw/misc/applesmc.c
+++ b/hw/misc/applesmc.c
@@ -393,7 +393,7 @@ static const TypeInfo applesmc_isa_info = {
     .parent        = TYPE_ISA_DEVICE,
     .instance_size = sizeof(AppleSMCState),
     .class_init    = qdev_applesmc_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_ACPI_DEV_AML_IF },
         { },
     },
diff --git a/hw/misc/edu.c b/hw/misc/edu.c
index 8224603593..cece633e11 100644
--- a/hw/misc/edu.c
+++ b/hw/misc/edu.c
@@ -436,7 +436,7 @@ static const TypeInfo edu_types[] = {
         .instance_size = sizeof(EduState),
         .instance_init = edu_instance_init,
         .class_init    = edu_class_init,
-        .interfaces    = (InterfaceInfo[]) {
+        .interfaces    = (const InterfaceInfo[]) {
             { INTERFACE_CONVENTIONAL_PCI_DEVICE },
             { },
         },
diff --git a/hw/misc/ivshmem-pci.c b/hw/misc/ivshmem-pci.c
index 2844b6f909..5a10bca633 100644
--- a/hw/misc/ivshmem-pci.c
+++ b/hw/misc/ivshmem-pci.c
@@ -1002,7 +1002,7 @@ static const TypeInfo ivshmem_common_info = {
     .instance_size = sizeof(IVShmemState),
     .abstract      = true,
     .class_init    = ivshmem_common_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { },
     },
diff --git a/hw/misc/macio/gpio.c b/hw/misc/macio/gpio.c
index e5d1e1168e..990551f91f 100644
--- a/hw/misc/macio/gpio.c
+++ b/hw/misc/macio/gpio.c
@@ -210,7 +210,7 @@ static const TypeInfo macio_gpio_init_info = {
     .instance_size = sizeof(MacIOGPIOState),
     .instance_init = macio_gpio_init,
     .class_init    = macio_gpio_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_NMI },
         { }
     },
diff --git a/hw/misc/macio/macio.c b/hw/misc/macio/macio.c
index b0418db49e..6710485d72 100644
--- a/hw/misc/macio/macio.c
+++ b/hw/misc/macio/macio.c
@@ -465,7 +465,7 @@ static const TypeInfo macio_type_info = {
     .instance_init = macio_instance_init,
     .abstract      = true,
     .class_init    = macio_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { },
     },
diff --git a/hw/misc/pci-testdev.c b/hw/misc/pci-testdev.c
index 0ea26451f1..3f6a8bba84 100644
--- a/hw/misc/pci-testdev.c
+++ b/hw/misc/pci-testdev.c
@@ -345,7 +345,7 @@ static const TypeInfo pci_testdev_info = {
     .parent        = TYPE_PCI_DEVICE,
     .instance_size = sizeof(PCITestDevState),
     .class_init    = pci_testdev_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { },
     },
diff --git a/hw/misc/pvpanic-isa.c b/hw/misc/pvpanic-isa.c
index 55522ee56c..f7b421c713 100644
--- a/hw/misc/pvpanic-isa.c
+++ b/hw/misc/pvpanic-isa.c
@@ -121,7 +121,7 @@ static const TypeInfo pvpanic_isa_info = {
     .instance_size = sizeof(PVPanicISAState),
     .instance_init = pvpanic_isa_initfn,
     .class_init    = pvpanic_isa_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_ACPI_DEV_AML_IF },
         { },
     },
diff --git a/hw/misc/pvpanic-pci.c b/hw/misc/pvpanic-pci.c
index 51ebf66107..2869b6a7ff 100644
--- a/hw/misc/pvpanic-pci.c
+++ b/hw/misc/pvpanic-pci.c
@@ -80,7 +80,7 @@ static const TypeInfo pvpanic_pci_info = {
     .parent        = TYPE_PCI_DEVICE,
     .instance_size = sizeof(PVPanicPCIState),
     .class_init    = pvpanic_pci_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { }
     }
diff --git a/hw/misc/xlnx-versal-cframe-reg.c b/hw/misc/xlnx-versal-cframe-reg.c
index e28d569ebe..1ce083e240 100644
--- a/hw/misc/xlnx-versal-cframe-reg.c
+++ b/hw/misc/xlnx-versal-cframe-reg.c
@@ -833,7 +833,7 @@ static const TypeInfo cframe_reg_info = {
     .instance_size = sizeof(XlnxVersalCFrameReg),
     .class_init    = cframe_reg_class_init,
     .instance_init = cframe_reg_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_XLNX_CFI_IF },
         { }
     }
diff --git a/hw/misc/xlnx-versal-cfu.c b/hw/misc/xlnx-versal-cfu.c
index 02e4fed05b..b920fc77c3 100644
--- a/hw/misc/xlnx-versal-cfu.c
+++ b/hw/misc/xlnx-versal-cfu.c
@@ -532,7 +532,7 @@ static const TypeInfo cfu_apb_info = {
     .instance_size = sizeof(XlnxVersalCFUAPB),
     .class_init    = cfu_apb_class_init,
     .instance_init = cfu_apb_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_XLNX_CFI_IF },
         { }
     }
@@ -545,7 +545,7 @@ static const TypeInfo cfu_fdro_info = {
     .class_init    = cfu_fdro_class_init,
     .instance_init = cfu_fdro_init,
     .instance_finalize = cfu_fdro_finalize,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_XLNX_CFI_IF },
         { }
     }
diff --git a/hw/net/can/can_kvaser_pci.c b/hw/net/can/can_kvaser_pci.c
index c0bb598bae..be16769de2 100644
--- a/hw/net/can/can_kvaser_pci.c
+++ b/hw/net/can/can_kvaser_pci.c
@@ -305,7 +305,7 @@ static const TypeInfo kvaser_pci_info = {
     .instance_size = sizeof(KvaserPCIState),
     .class_init    = kvaser_pci_class_init,
     .instance_init = kvaser_pci_instance_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { },
     },
diff --git a/hw/net/can/can_mioe3680_pci.c b/hw/net/can/can_mioe3680_pci.c
index 9aac70dccd..44f3ba370d 100644
--- a/hw/net/can/can_mioe3680_pci.c
+++ b/hw/net/can/can_mioe3680_pci.c
@@ -248,7 +248,7 @@ static const TypeInfo mioe3680_pci_info = {
     .instance_size = sizeof(Mioe3680PCIState),
     .class_init    = mioe3680_pci_class_init,
     .instance_init = mioe3680_pci_instance_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { },
     },
diff --git a/hw/net/can/can_pcm3680_pci.c b/hw/net/can/can_pcm3680_pci.c
index b305f7e9b7..7296d63be7 100644
--- a/hw/net/can/can_pcm3680_pci.c
+++ b/hw/net/can/can_pcm3680_pci.c
@@ -249,7 +249,7 @@ static const TypeInfo pcm3680i_pci_info = {
     .instance_size = sizeof(Pcm3680iPCIState),
     .class_init    = pcm3680i_pci_class_init,
     .instance_init = pcm3680i_pci_instance_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { },
     },
diff --git a/hw/net/can/ctucan_pci.c b/hw/net/can/ctucan_pci.c
index 0dee9b59d1..bed6785433 100644
--- a/hw/net/can/ctucan_pci.c
+++ b/hw/net/can/ctucan_pci.c
@@ -262,7 +262,7 @@ static const TypeInfo ctucan_pci_info = {
     .instance_size = sizeof(CtuCanPCIState),
     .class_init    = ctucan_pci_class_init,
     .instance_init = ctucan_pci_instance_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { },
     },
diff --git a/hw/net/e1000.c b/hw/net/e1000.c
index 13814e84d1..cba4999e6d 100644
--- a/hw/net/e1000.c
+++ b/hw/net/e1000.c
@@ -1732,7 +1732,7 @@ static const TypeInfo e1000_base_info = {
     .instance_init = e1000_instance_init,
     .class_size    = sizeof(E1000BaseClass),
     .abstract      = true,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { },
     },
diff --git a/hw/net/e1000e.c b/hw/net/e1000e.c
index f38249a6a9..89e6d52ba0 100644
--- a/hw/net/e1000e.c
+++ b/hw/net/e1000e.c
@@ -721,7 +721,7 @@ static const TypeInfo e1000e_info = {
     .instance_size = sizeof(E1000EState),
     .class_init = e1000e_class_init,
     .instance_init = e1000e_instance_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_PCIE_DEVICE },
         { }
     },
diff --git a/hw/net/eepro100.c b/hw/net/eepro100.c
index ef0f9337a0..d47df5a97f 100644
--- a/hw/net/eepro100.c
+++ b/hw/net/eepro100.c
@@ -2094,7 +2094,7 @@ static void eepro100_register_types(void)
         type_info.class_init = eepro100_class_init;
         type_info.instance_size = sizeof(EEPRO100State);
         type_info.instance_init = eepro100_instance_init;
-        type_info.interfaces = (InterfaceInfo[]) {
+        type_info.interfaces = (const InterfaceInfo[]) {
             { INTERFACE_CONVENTIONAL_PCI_DEVICE },
             { },
         };
diff --git a/hw/net/igb.c b/hw/net/igb.c
index ba30433a50..e4c02365d6 100644
--- a/hw/net/igb.c
+++ b/hw/net/igb.c
@@ -635,7 +635,7 @@ static const TypeInfo igb_info = {
     .instance_size = sizeof(IGBState),
     .class_init = igb_class_init,
     .instance_init = igb_instance_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_PCIE_DEVICE },
         { }
     },
diff --git a/hw/net/igbvf.c b/hw/net/igbvf.c
index 91e7ccf931..31d72c4977 100644
--- a/hw/net/igbvf.c
+++ b/hw/net/igbvf.c
@@ -325,7 +325,7 @@ static const TypeInfo igbvf_info = {
     .parent = TYPE_PCI_DEVICE,
     .instance_size = sizeof(IgbVfState),
     .class_init = igbvf_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_PCIE_DEVICE },
         { }
     },
diff --git a/hw/net/ne2000-pci.c b/hw/net/ne2000-pci.c
index 2153973af4..ce937e1b61 100644
--- a/hw/net/ne2000-pci.c
+++ b/hw/net/ne2000-pci.c
@@ -122,7 +122,7 @@ static const TypeInfo ne2000_info = {
     .instance_size = sizeof(PCINE2000State),
     .class_init    = ne2000_class_init,
     .instance_init = ne2000_instance_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { },
     },
diff --git a/hw/net/pcnet-pci.c b/hw/net/pcnet-pci.c
index 429c217180..0ca5bc2193 100644
--- a/hw/net/pcnet-pci.c
+++ b/hw/net/pcnet-pci.c
@@ -280,7 +280,7 @@ static const TypeInfo pcnet_info = {
     .instance_size = sizeof(PCIPCNetState),
     .class_init    = pcnet_class_init,
     .instance_init = pcnet_instance_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { },
     },
diff --git a/hw/net/rocker/rocker.c b/hw/net/rocker/rocker.c
index 3d307f4ab1..cc49701dd3 100644
--- a/hw/net/rocker/rocker.c
+++ b/hw/net/rocker/rocker.c
@@ -1498,7 +1498,7 @@ static const TypeInfo rocker_info = {
     .parent        = TYPE_PCI_DEVICE,
     .instance_size = sizeof(Rocker),
     .class_init    = rocker_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { },
     },
diff --git a/hw/net/rtl8139.c b/hw/net/rtl8139.c
index ad812954cf..15b8f7501a 100644
--- a/hw/net/rtl8139.c
+++ b/hw/net/rtl8139.c
@@ -3438,7 +3438,7 @@ static const TypeInfo rtl8139_info = {
     .instance_size = sizeof(RTL8139State),
     .class_init    = rtl8139_class_init,
     .instance_init = rtl8139_instance_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { },
     },
diff --git a/hw/net/sungem.c b/hw/net/sungem.c
index 123d08ee8e..b405eb89fa 100644
--- a/hw/net/sungem.c
+++ b/hw/net/sungem.c
@@ -1477,7 +1477,7 @@ static const TypeInfo sungem_info = {
     .instance_size = sizeof(SunGEMState),
     .class_init    = sungem_class_init,
     .instance_init = sungem_instance_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { }
     }
diff --git a/hw/net/sunhme.c b/hw/net/sunhme.c
index 46c9f5020b..c2f7a8483d 100644
--- a/hw/net/sunhme.c
+++ b/hw/net/sunhme.c
@@ -958,7 +958,7 @@ static const TypeInfo sunhme_info = {
     .class_init    = sunhme_class_init,
     .instance_size = sizeof(SunHMEState),
     .instance_init = sunhme_instance_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { }
     }
diff --git a/hw/net/tulip.c b/hw/net/tulip.c
index fb3366d8ee..63fe513458 100644
--- a/hw/net/tulip.c
+++ b/hw/net/tulip.c
@@ -1035,7 +1035,7 @@ static const TypeInfo tulip_info = {
     .instance_size = sizeof(TULIPState),
     .class_init    = tulip_class_init,
     .instance_init = tulip_instance_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { },
     },
diff --git a/hw/net/vmxnet3.c b/hw/net/vmxnet3.c
index 4bcf1f902f..83d942af17 100644
--- a/hw/net/vmxnet3.c
+++ b/hw/net/vmxnet3.c
@@ -2522,7 +2522,7 @@ static const TypeInfo vmxnet3_info = {
     .instance_size = sizeof(VMXNET3State),
     .class_init    = vmxnet3_class_init,
     .instance_init = vmxnet3_instance_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_PCIE_DEVICE },
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { }
diff --git a/hw/net/xilinx_axienet.c b/hw/net/xilinx_axienet.c
index e45bc048e0..1f5c748047 100644
--- a/hw/net/xilinx_axienet.c
+++ b/hw/net/xilinx_axienet.c
@@ -1045,7 +1045,7 @@ static const TypeInfo xilinx_enet_data_stream_info = {
     .parent        = TYPE_OBJECT,
     .instance_size = sizeof(XilinxAXIEnetStreamSink),
     .class_init    = xilinx_enet_data_stream_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
             { TYPE_STREAM_SINK },
             { }
     }
@@ -1056,7 +1056,7 @@ static const TypeInfo xilinx_enet_control_stream_info = {
     .parent        = TYPE_OBJECT,
     .instance_size = sizeof(XilinxAXIEnetStreamSink),
     .class_init    = xilinx_enet_control_stream_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
             { TYPE_STREAM_SINK },
             { }
     }
diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c
index e87295f5f8..fd935507bc 100644
--- a/hw/nvme/ctrl.c
+++ b/hw/nvme/ctrl.c
@@ -9221,7 +9221,7 @@ static const TypeInfo nvme_info = {
     .instance_size = sizeof(NvmeCtrl),
     .instance_init = nvme_instance_init,
     .class_init    = nvme_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_PCIE_DEVICE },
         { }
     },
diff --git a/hw/pci-bridge/cxl_downstream.c b/hw/pci-bridge/cxl_downstream.c
index ab3b550a88..1065245a8b 100644
--- a/hw/pci-bridge/cxl_downstream.c
+++ b/hw/pci-bridge/cxl_downstream.c
@@ -241,7 +241,7 @@ static const TypeInfo cxl_dsp_info = {
     .instance_size = sizeof(CXLDownstreamPort),
     .parent = TYPE_PCIE_SLOT,
     .class_init = cxl_dsp_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_PCIE_DEVICE },
         { INTERFACE_CXL_DEVICE },
         { }
diff --git a/hw/pci-bridge/cxl_root_port.c b/hw/pci-bridge/cxl_root_port.c
index 8b1e149e9b..e6a4035d26 100644
--- a/hw/pci-bridge/cxl_root_port.c
+++ b/hw/pci-bridge/cxl_root_port.c
@@ -294,7 +294,7 @@ static const TypeInfo cxl_root_port_info = {
     .parent = TYPE_PCIE_ROOT_PORT,
     .instance_size = sizeof(CXLRootPort),
     .class_init = cxl_root_port_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CXL_DEVICE },
         { }
     },
diff --git a/hw/pci-bridge/cxl_upstream.c b/hw/pci-bridge/cxl_upstream.c
index 822a828555..208e0c6172 100644
--- a/hw/pci-bridge/cxl_upstream.c
+++ b/hw/pci-bridge/cxl_upstream.c
@@ -394,7 +394,7 @@ static const TypeInfo cxl_usp_info = {
     .parent = TYPE_PCIE_PORT,
     .instance_size = sizeof(CXLUpstreamPort),
     .class_init = cxl_upstream_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_PCIE_DEVICE },
         { INTERFACE_CXL_DEVICE },
         { }
diff --git a/hw/pci-bridge/i82801b11.c b/hw/pci-bridge/i82801b11.c
index f2b294aee2..1d73c14c1f 100644
--- a/hw/pci-bridge/i82801b11.c
+++ b/hw/pci-bridge/i82801b11.c
@@ -107,7 +107,7 @@ static const TypeInfo i82801b11_bridge_info = {
     .parent        = TYPE_PCI_BRIDGE,
     .instance_size = sizeof(I82801b11Bridge),
     .class_init    = i82801b11_bridge_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { },
     },
diff --git a/hw/pci-bridge/pci_bridge_dev.c b/hw/pci-bridge/pci_bridge_dev.c
index 3b57583199..b328e50ab3 100644
--- a/hw/pci-bridge/pci_bridge_dev.c
+++ b/hw/pci-bridge/pci_bridge_dev.c
@@ -268,7 +268,7 @@ static const TypeInfo pci_bridge_dev_info = {
     .instance_size     = sizeof(PCIBridgeDev),
     .class_init        = pci_bridge_dev_class_init,
     .instance_finalize = pci_bridge_dev_instance_finalize,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_HOTPLUG_HANDLER },
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { }
diff --git a/hw/pci-bridge/pci_expander_bridge.c b/hw/pci-bridge/pci_expander_bridge.c
index 1e2e394ee8..3a29dfefc2 100644
--- a/hw/pci-bridge/pci_expander_bridge.c
+++ b/hw/pci-bridge/pci_expander_bridge.c
@@ -449,7 +449,7 @@ static const TypeInfo pxb_dev_info = {
     .parent        = TYPE_PCI_DEVICE,
     .instance_size = sizeof(PXBDev),
     .class_init    = pxb_dev_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { },
     },
@@ -486,7 +486,7 @@ static const TypeInfo pxb_pcie_dev_info = {
     .parent        = TYPE_PXB_DEV,
     .instance_size = sizeof(PXBPCIEDev),
     .class_init    = pxb_pcie_dev_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { },
     },
@@ -537,7 +537,7 @@ static const TypeInfo pxb_cxl_dev_info = {
     .instance_size = sizeof(PXBCXLDev),
     .class_init    = pxb_cxl_dev_class_init,
     .interfaces =
-        (InterfaceInfo[]){
+        (const InterfaceInfo[]){
             { INTERFACE_CONVENTIONAL_PCI_DEVICE },
             {},
         },
diff --git a/hw/pci-bridge/pcie_pci_bridge.c b/hw/pci-bridge/pcie_pci_bridge.c
index 833fe35cd5..fce292a519 100644
--- a/hw/pci-bridge/pcie_pci_bridge.c
+++ b/hw/pci-bridge/pcie_pci_bridge.c
@@ -162,7 +162,7 @@ static const TypeInfo pcie_pci_bridge_info = {
         .parent = TYPE_PCI_BRIDGE,
         .instance_size = sizeof(PCIEPCIBridge),
         .class_init = pcie_pci_bridge_class_init,
-        .interfaces = (InterfaceInfo[]) {
+        .interfaces = (const InterfaceInfo[]) {
             { TYPE_HOTPLUG_HANDLER },
             { INTERFACE_PCIE_DEVICE },
             { },
diff --git a/hw/pci-bridge/pcie_root_port.c b/hw/pci-bridge/pcie_root_port.c
index 512c2ab305..22c2fdb71e 100644
--- a/hw/pci-bridge/pcie_root_port.c
+++ b/hw/pci-bridge/pcie_root_port.c
@@ -188,7 +188,7 @@ static const TypeInfo rp_info = {
     .class_init    = rp_class_init,
     .abstract      = true,
     .class_size = sizeof(PCIERootPortClass),
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_PCIE_DEVICE },
         { }
     },
diff --git a/hw/pci-bridge/simba.c b/hw/pci-bridge/simba.c
index c7565d9e94..bbae594e11 100644
--- a/hw/pci-bridge/simba.c
+++ b/hw/pci-bridge/simba.c
@@ -87,7 +87,7 @@ static const TypeInfo simba_pci_bridge_info = {
     .parent        = TYPE_PCI_BRIDGE,
     .class_init    = simba_pci_bridge_class_init,
     .instance_size = sizeof(SimbaPCIBridge),
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { },
     },
diff --git a/hw/pci-bridge/xio3130_downstream.c b/hw/pci-bridge/xio3130_downstream.c
index d85c23fe4a..dc7d1aa7d7 100644
--- a/hw/pci-bridge/xio3130_downstream.c
+++ b/hw/pci-bridge/xio3130_downstream.c
@@ -175,7 +175,7 @@ static const TypeInfo xio3130_downstream_info = {
     .name          = TYPE_XIO3130_DOWNSTREAM,
     .parent        = TYPE_PCIE_SLOT,
     .class_init    = xio3130_downstream_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_PCIE_DEVICE },
         { }
     },
diff --git a/hw/pci-bridge/xio3130_upstream.c b/hw/pci-bridge/xio3130_upstream.c
index d7a2715812..40057b749b 100644
--- a/hw/pci-bridge/xio3130_upstream.c
+++ b/hw/pci-bridge/xio3130_upstream.c
@@ -144,7 +144,7 @@ static const TypeInfo xio3130_upstream_info = {
     .name          = "x3130-upstream",
     .parent        = TYPE_PCIE_PORT,
     .class_init    = xio3130_upstream_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_PCIE_DEVICE },
         { }
     },
diff --git a/hw/pci-host/articia.c b/hw/pci-host/articia.c
index 043fb85e84..cc65aac2a8 100644
--- a/hw/pci-host/articia.c
+++ b/hw/pci-host/articia.c
@@ -273,7 +273,7 @@ static const TypeInfo articia_types[] = {
         .parent        = TYPE_PCI_DEVICE,
         .instance_size = sizeof(ArticiaHostState),
         .class_init    = articia_pci_host_class_init,
-        .interfaces = (InterfaceInfo[]) {
+        .interfaces = (const InterfaceInfo[]) {
               { INTERFACE_CONVENTIONAL_PCI_DEVICE },
               { },
         },
@@ -283,7 +283,7 @@ static const TypeInfo articia_types[] = {
         .parent        = TYPE_PCI_DEVICE,
         .instance_size = sizeof(PCIDevice),
         .class_init    = articia_pci_bridge_class_init,
-        .interfaces = (InterfaceInfo[]) {
+        .interfaces = (const InterfaceInfo[]) {
               { INTERFACE_CONVENTIONAL_PCI_DEVICE },
               { },
         },
diff --git a/hw/pci-host/bonito.c b/hw/pci-host/bonito.c
index 4508cdd21a..7d6251a78d 100644
--- a/hw/pci-host/bonito.c
+++ b/hw/pci-host/bonito.c
@@ -783,7 +783,7 @@ static const TypeInfo bonito_pci_info = {
     .parent        = TYPE_PCI_DEVICE,
     .instance_size = sizeof(PCIBonitoState),
     .class_init    = bonito_pci_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { },
     },
diff --git a/hw/pci-host/designware.c b/hw/pci-host/designware.c
index d03c998e3a..183f838392 100644
--- a/hw/pci-host/designware.c
+++ b/hw/pci-host/designware.c
@@ -769,7 +769,7 @@ static const TypeInfo designware_pcie_types[] = {
         .parent         = TYPE_PCI_BRIDGE,
         .instance_size  = sizeof(DesignwarePCIERoot),
         .class_init     = designware_pcie_root_class_init,
-        .interfaces     = (InterfaceInfo[]) {
+        .interfaces     = (const InterfaceInfo[]) {
             { INTERFACE_PCIE_DEVICE },
             { }
         },
diff --git a/hw/pci-host/gpex.c b/hw/pci-host/gpex.c
index 7dcac4ee3c..b806a2286f 100644
--- a/hw/pci-host/gpex.c
+++ b/hw/pci-host/gpex.c
@@ -261,7 +261,7 @@ static const TypeInfo gpex_root_info = {
     .parent = TYPE_PCI_DEVICE,
     .instance_size = sizeof(GPEXRootState),
     .class_init = gpex_root_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { },
     },
diff --git a/hw/pci-host/grackle.c b/hw/pci-host/grackle.c
index b48d44623d..f9da5a908c 100644
--- a/hw/pci-host/grackle.c
+++ b/hw/pci-host/grackle.c
@@ -116,7 +116,7 @@ static const TypeInfo grackle_pci_info = {
     .parent        = TYPE_PCI_DEVICE,
     .instance_size = sizeof(PCIDevice),
     .class_init = grackle_pci_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { },
     },
diff --git a/hw/pci-host/gt64120.c b/hw/pci-host/gt64120.c
index bd74b6e871..56a6ef93b7 100644
--- a/hw/pci-host/gt64120.c
+++ b/hw/pci-host/gt64120.c
@@ -1268,7 +1268,7 @@ static const TypeInfo gt64120_pci_info = {
     .parent        = TYPE_PCI_DEVICE,
     .instance_size = sizeof(PCIDevice),
     .class_init    = gt64120_pci_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { },
     },
diff --git a/hw/pci-host/i440fx.c b/hw/pci-host/i440fx.c
index fcc9f3818a..e13bb1b53e 100644
--- a/hw/pci-host/i440fx.c
+++ b/hw/pci-host/i440fx.c
@@ -341,7 +341,7 @@ static const TypeInfo i440fx_info = {
     .parent        = TYPE_PCI_DEVICE,
     .instance_size = sizeof(PCII440FXState),
     .class_init    = i440fx_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { },
     },
diff --git a/hw/pci-host/mv64361.c b/hw/pci-host/mv64361.c
index f51f385b22..e05b677010 100644
--- a/hw/pci-host/mv64361.c
+++ b/hw/pci-host/mv64361.c
@@ -46,7 +46,7 @@ static const TypeInfo mv64361_pcibridge_info = {
     .parent        = TYPE_PCI_DEVICE,
     .instance_size = sizeof(PCIDevice),
     .class_init    = mv64361_pcibridge_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { },
     },
diff --git a/hw/pci-host/pnv_phb3_pbcq.c b/hw/pci-host/pnv_phb3_pbcq.c
index 4e24b1449d..1f7a149580 100644
--- a/hw/pci-host/pnv_phb3_pbcq.c
+++ b/hw/pci-host/pnv_phb3_pbcq.c
@@ -354,7 +354,7 @@ static const TypeInfo pnv_pbcq_type_info = {
     .instance_size = sizeof(PnvPBCQState),
     .instance_init = phb3_pbcq_instance_init,
     .class_init    = pnv_pbcq_class_init,
-    .interfaces    = (InterfaceInfo[]) {
+    .interfaces    = (const InterfaceInfo[]) {
         { TYPE_PNV_XSCOM_INTERFACE },
         { }
     }
diff --git a/hw/pci-host/pnv_phb4.c b/hw/pci-host/pnv_phb4.c
index feb812dc1a..77ea35299d 100644
--- a/hw/pci-host/pnv_phb4.c
+++ b/hw/pci-host/pnv_phb4.c
@@ -1714,7 +1714,7 @@ static const TypeInfo pnv_phb4_type_info = {
     .instance_init = pnv_phb4_instance_init,
     .instance_size = sizeof(PnvPHB4),
     .class_init    = pnv_phb4_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
             { TYPE_XIVE_NOTIFIER },
             { },
     }
diff --git a/hw/pci-host/pnv_phb4_pec.c b/hw/pci-host/pnv_phb4_pec.c
index cc46641cdf..5bac1c42ed 100644
--- a/hw/pci-host/pnv_phb4_pec.c
+++ b/hw/pci-host/pnv_phb4_pec.c
@@ -388,7 +388,7 @@ static const TypeInfo pnv_pec_type_info = {
     .instance_size = sizeof(PnvPhb4PecState),
     .class_init    = pnv_pec_class_init,
     .class_size    = sizeof(PnvPhb4PecClass),
-    .interfaces    = (InterfaceInfo[]) {
+    .interfaces    = (const InterfaceInfo[]) {
         { TYPE_PNV_XSCOM_INTERFACE },
         { }
     }
@@ -445,7 +445,7 @@ static const TypeInfo pnv_phb5_pec_type_info = {
     .instance_size = sizeof(PnvPhb4PecState),
     .class_init    = pnv_phb5_pec_class_init,
     .class_size    = sizeof(PnvPhb4PecClass),
-    .interfaces    = (InterfaceInfo[]) {
+    .interfaces    = (const InterfaceInfo[]) {
         { TYPE_PNV_XSCOM_INTERFACE },
         { }
     }
diff --git a/hw/pci-host/ppc4xx_pci.c b/hw/pci-host/ppc4xx_pci.c
index dcc4b78660..2547817688 100644
--- a/hw/pci-host/ppc4xx_pci.c
+++ b/hw/pci-host/ppc4xx_pci.c
@@ -370,7 +370,7 @@ static const TypeInfo ppc4xx_host_bridge_info = {
     .parent        = TYPE_PCI_DEVICE,
     .instance_size = sizeof(PCIDevice),
     .class_init    = ppc4xx_host_bridge_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { },
     },
diff --git a/hw/pci-host/ppce500.c b/hw/pci-host/ppce500.c
index 2f6354c931..e97a515d5f 100644
--- a/hw/pci-host/ppce500.c
+++ b/hw/pci-host/ppce500.c
@@ -528,7 +528,7 @@ static const TypeInfo e500_pci_types[] = {
         .parent        = TYPE_PCI_DEVICE,
         .instance_size = sizeof(PPCE500PCIBridgeState),
         .class_init    = e500_host_bridge_class_init,
-        .interfaces    = (InterfaceInfo[]) {
+        .interfaces    = (const InterfaceInfo[]) {
             { INTERFACE_CONVENTIONAL_PCI_DEVICE },
             { },
         },
diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c
index c2a71108f2..1951ae440c 100644
--- a/hw/pci-host/q35.c
+++ b/hw/pci-host/q35.c
@@ -703,7 +703,7 @@ static const TypeInfo mch_info = {
     .parent = TYPE_PCI_DEVICE,
     .instance_size = sizeof(MCHPCIState),
     .class_init = mch_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { },
     },
diff --git a/hw/pci-host/raven.c b/hw/pci-host/raven.c
index 3f158838a0..21f7ca65e0 100644
--- a/hw/pci-host/raven.c
+++ b/hw/pci-host/raven.c
@@ -416,7 +416,7 @@ static const TypeInfo raven_info = {
     .parent = TYPE_PCI_DEVICE,
     .instance_size = sizeof(RavenPCIState),
     .class_init = raven_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { },
     },
diff --git a/hw/pci-host/sabre.c b/hw/pci-host/sabre.c
index f7086086f9..538624c507 100644
--- a/hw/pci-host/sabre.c
+++ b/hw/pci-host/sabre.c
@@ -477,7 +477,7 @@ static const TypeInfo sabre_pci_info = {
     .parent        = TYPE_PCI_DEVICE,
     .instance_size = sizeof(SabrePCIState),
     .class_init    = sabre_pci_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { },
     },
diff --git a/hw/pci-host/sh_pci.c b/hw/pci-host/sh_pci.c
index 52bff66d6a..de8f6a84aa 100644
--- a/hw/pci-host/sh_pci.c
+++ b/hw/pci-host/sh_pci.c
@@ -186,7 +186,7 @@ static const TypeInfo sh_pcic_types[] = {
         .parent         = TYPE_PCI_DEVICE,
         .instance_size  = sizeof(PCIDevice),
         .class_init     = sh_pcic_pci_class_init,
-        .interfaces = (InterfaceInfo[]) {
+        .interfaces = (const InterfaceInfo[]) {
             { INTERFACE_CONVENTIONAL_PCI_DEVICE },
             { },
         },
diff --git a/hw/pci-host/uninorth.c b/hw/pci-host/uninorth.c
index 7cb37e01d8..194037d6e7 100644
--- a/hw/pci-host/uninorth.c
+++ b/hw/pci-host/uninorth.c
@@ -333,7 +333,7 @@ static const TypeInfo unin_main_pci_host_info = {
     .parent = TYPE_PCI_DEVICE,
     .instance_size = sizeof(PCIDevice),
     .class_init = unin_main_pci_host_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { },
     },
@@ -361,7 +361,7 @@ static const TypeInfo u3_agp_pci_host_info = {
     .parent = TYPE_PCI_DEVICE,
     .instance_size = sizeof(PCIDevice),
     .class_init = u3_agp_pci_host_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { },
     },
@@ -389,7 +389,7 @@ static const TypeInfo unin_agp_pci_host_info = {
     .parent = TYPE_PCI_DEVICE,
     .instance_size = sizeof(PCIDevice),
     .class_init = unin_agp_pci_host_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { },
     },
@@ -418,7 +418,7 @@ static const TypeInfo unin_internal_pci_host_info = {
     .parent = TYPE_PCI_DEVICE,
     .instance_size = sizeof(PCIDevice),
     .class_init = unin_internal_pci_host_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { },
     },
diff --git a/hw/pci-host/versatile.c b/hw/pci-host/versatile.c
index b333158e10..8ea26e3ff0 100644
--- a/hw/pci-host/versatile.c
+++ b/hw/pci-host/versatile.c
@@ -492,7 +492,7 @@ static const TypeInfo versatile_pci_host_info = {
     .parent        = TYPE_PCI_DEVICE,
     .instance_size = sizeof(PCIDevice),
     .class_init    = versatile_pci_host_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { },
     },
diff --git a/hw/pci-host/xilinx-pcie.c b/hw/pci-host/xilinx-pcie.c
index 70e9b2b981..c71492de9e 100644
--- a/hw/pci-host/xilinx-pcie.c
+++ b/hw/pci-host/xilinx-pcie.c
@@ -314,7 +314,7 @@ static const TypeInfo xilinx_pcie_root_info = {
     .parent = TYPE_PCI_BRIDGE,
     .instance_size = sizeof(XilinxPCIERoot),
     .class_init = xilinx_pcie_root_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_PCIE_DEVICE },
         { }
     },
diff --git a/hw/pci/pci.c b/hw/pci/pci.c
index c60991def8..fe38c4c028 100644
--- a/hw/pci/pci.c
+++ b/hw/pci/pci.c
@@ -288,7 +288,7 @@ static const TypeInfo pci_bus_info = {
     .instance_size = sizeof(PCIBus),
     .class_size = sizeof(PCIBusClass),
     .class_init = pci_bus_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_FW_CFG_DATA_GENERATOR_INTERFACE },
         { }
     }
diff --git a/hw/pci/pci_bridge.c b/hw/pci/pci_bridge.c
index 0fe66e8b12..76255c4cd8 100644
--- a/hw/pci/pci_bridge.c
+++ b/hw/pci/pci_bridge.c
@@ -497,7 +497,7 @@ static const TypeInfo pci_bridge_type_info = {
     .instance_size = sizeof(PCIBridge),
     .class_init = pci_bridge_class_init,
     .abstract = true,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_ACPI_DEV_AML_IF },
         { },
     },
diff --git a/hw/pci/pcie_port.c b/hw/pci/pcie_port.c
index 8629b3aafd..54f639e3d4 100644
--- a/hw/pci/pcie_port.c
+++ b/hw/pci/pcie_port.c
@@ -230,7 +230,7 @@ static const TypeInfo pcie_slot_type_info = {
     .instance_size = sizeof(PCIESlot),
     .abstract = true,
     .class_init = pcie_slot_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_HOTPLUG_HANDLER },
         { }
     }
diff --git a/hw/ppc/e500plat.c b/hw/ppc/e500plat.c
index cd594eeb3e..775b9d8da0 100644
--- a/hw/ppc/e500plat.c
+++ b/hw/ppc/e500plat.c
@@ -107,7 +107,7 @@ static const TypeInfo e500plat_info = {
     .name          = TYPE_E500PLAT_MACHINE,
     .parent        = TYPE_PPCE500_MACHINE,
     .class_init    = e500plat_machine_class_init,
-    .interfaces    = (InterfaceInfo[]) {
+    .interfaces    = (const InterfaceInfo[]) {
          { TYPE_HOTPLUG_HANDLER },
          { }
     }
diff --git a/hw/ppc/mac_newworld.c b/hw/ppc/mac_newworld.c
index 92fe60b2a2..0b6e096116 100644
--- a/hw/ppc/mac_newworld.c
+++ b/hw/ppc/mac_newworld.c
@@ -639,7 +639,7 @@ static const TypeInfo core99_machine_info = {
     .class_init    = core99_machine_class_init,
     .instance_init = core99_instance_init,
     .instance_size = sizeof(Core99MachineState),
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_FW_PATH_PROVIDER },
         { }
     },
diff --git a/hw/ppc/mac_oldworld.c b/hw/ppc/mac_oldworld.c
index 5c5bf99b4d..40ae936ad8 100644
--- a/hw/ppc/mac_oldworld.c
+++ b/hw/ppc/mac_oldworld.c
@@ -430,7 +430,7 @@ static const TypeInfo ppc_heathrow_machine_info = {
     .name          = MACHINE_TYPE_NAME("g3beige"),
     .parent        = TYPE_MACHINE,
     .class_init    = heathrow_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_FW_PATH_PROVIDER },
         { }
     },
diff --git a/hw/ppc/pegasos2.c b/hw/ppc/pegasos2.c
index bb6f94f502..e15cf96427 100644
--- a/hw/ppc/pegasos2.c
+++ b/hw/ppc/pegasos2.c
@@ -619,7 +619,7 @@ static const TypeInfo pegasos2_machine_info = {
     .parent        = TYPE_MACHINE,
     .class_init    = pegasos2_machine_class_init,
     .instance_size = sizeof(Pegasos2MachineState),
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_PPC_VIRTUAL_HYPERVISOR },
         { TYPE_VOF_MACHINE_IF },
         { }
diff --git a/hw/ppc/pnv.c b/hw/ppc/pnv.c
index 4590231f88..4a49e9d1a8 100644
--- a/hw/ppc/pnv.c
+++ b/hw/ppc/pnv.c
@@ -2973,7 +2973,7 @@ static const TypeInfo types[] = {
         .name          = MACHINE_TYPE_NAME("powernv10"),
         .parent        = TYPE_PNV_MACHINE,
         .class_init    = pnv_machine_power10_class_init,
-        .interfaces = (InterfaceInfo[]) {
+        .interfaces = (const InterfaceInfo[]) {
             { TYPE_XIVE_FABRIC },
             { },
         },
@@ -2982,7 +2982,7 @@ static const TypeInfo types[] = {
         .name          = MACHINE_TYPE_NAME("powernv9"),
         .parent        = TYPE_PNV_MACHINE,
         .class_init    = pnv_machine_power9_class_init,
-        .interfaces = (InterfaceInfo[]) {
+        .interfaces = (const InterfaceInfo[]) {
             { TYPE_XIVE_FABRIC },
             { },
         },
@@ -2991,7 +2991,7 @@ static const TypeInfo types[] = {
         .name          = MACHINE_TYPE_NAME("powernv8"),
         .parent        = TYPE_PNV_MACHINE,
         .class_init    = pnv_machine_power8_class_init,
-        .interfaces = (InterfaceInfo[]) {
+        .interfaces = (const InterfaceInfo[]) {
             { TYPE_XICS_FABRIC },
             { },
         },
@@ -3003,7 +3003,7 @@ static const TypeInfo types[] = {
         .instance_size = sizeof(PnvMachineState),
         .class_init    = pnv_machine_class_init,
         .class_size    = sizeof(PnvMachineClass),
-        .interfaces = (InterfaceInfo[]) {
+        .interfaces = (const InterfaceInfo[]) {
             { TYPE_INTERRUPT_STATS_PROVIDER },
             { TYPE_NMI },
             { },
diff --git a/hw/ppc/pnv_adu.c b/hw/ppc/pnv_adu.c
index f9620806ec..005fbda475 100644
--- a/hw/ppc/pnv_adu.c
+++ b/hw/ppc/pnv_adu.c
@@ -204,7 +204,7 @@ static const TypeInfo pnv_adu_type_info = {
     .parent        = TYPE_DEVICE,
     .instance_size = sizeof(PnvADU),
     .class_init    = pnv_adu_class_init,
-    .interfaces    = (InterfaceInfo[]) {
+    .interfaces    = (const InterfaceInfo[]) {
         { TYPE_PNV_XSCOM_INTERFACE },
         { } },
 };
diff --git a/hw/ppc/pnv_chiptod.c b/hw/ppc/pnv_chiptod.c
index 4ca511a4de..b9e9c7ba3d 100644
--- a/hw/ppc/pnv_chiptod.c
+++ b/hw/ppc/pnv_chiptod.c
@@ -478,7 +478,7 @@ static const TypeInfo pnv_chiptod_power9_type_info = {
     .parent        = TYPE_PNV_CHIPTOD,
     .instance_size = sizeof(PnvChipTOD),
     .class_init    = pnv_chiptod_power9_class_init,
-    .interfaces    = (InterfaceInfo[]) {
+    .interfaces    = (const InterfaceInfo[]) {
         { TYPE_PNV_XSCOM_INTERFACE },
         { }
     }
@@ -514,7 +514,7 @@ static const TypeInfo pnv_chiptod_power10_type_info = {
     .parent        = TYPE_PNV_CHIPTOD,
     .instance_size = sizeof(PnvChipTOD),
     .class_init    = pnv_chiptod_power10_class_init,
-    .interfaces    = (InterfaceInfo[]) {
+    .interfaces    = (const InterfaceInfo[]) {
         { TYPE_PNV_XSCOM_INTERFACE },
         { }
     }
diff --git a/hw/ppc/pnv_i2c.c b/hw/ppc/pnv_i2c.c
index b2f372c874..60de479491 100644
--- a/hw/ppc/pnv_i2c.c
+++ b/hw/ppc/pnv_i2c.c
@@ -569,7 +569,7 @@ static const TypeInfo pnv_i2c_info = {
     .parent        = TYPE_DEVICE,
     .instance_size = sizeof(PnvI2C),
     .class_init    = pnv_i2c_class_init,
-    .interfaces    = (InterfaceInfo[]) {
+    .interfaces    = (const InterfaceInfo[]) {
         { TYPE_PNV_XSCOM_INTERFACE },
         { }
     }
diff --git a/hw/ppc/pnv_lpc.c b/hw/ppc/pnv_lpc.c
index d92347bcd2..f6beba0917 100644
--- a/hw/ppc/pnv_lpc.c
+++ b/hw/ppc/pnv_lpc.c
@@ -732,7 +732,7 @@ static const TypeInfo pnv_lpc_power8_info = {
     .name          = TYPE_PNV8_LPC,
     .parent        = TYPE_PNV_LPC,
     .class_init    = pnv_lpc_power8_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_PNV_XSCOM_INTERFACE },
         { }
     }
diff --git a/hw/ppc/pnv_n1_chiplet.c b/hw/ppc/pnv_n1_chiplet.c
index 05e3fd6f73..053f6473f2 100644
--- a/hw/ppc/pnv_n1_chiplet.c
+++ b/hw/ppc/pnv_n1_chiplet.c
@@ -159,7 +159,7 @@ static const TypeInfo pnv_n1_chiplet_info = {
     .instance_init = pnv_n1_chiplet_instance_init,
     .instance_size = sizeof(PnvN1Chiplet),
     .class_init    = pnv_n1_chiplet_class_init,
-    .interfaces    = (InterfaceInfo[]) {
+    .interfaces    = (const InterfaceInfo[]) {
         { TYPE_PNV_XSCOM_INTERFACE },
         { }
     }
diff --git a/hw/ppc/pnv_nest_pervasive.c b/hw/ppc/pnv_nest_pervasive.c
index b5182d54fa..1b1b14fed9 100644
--- a/hw/ppc/pnv_nest_pervasive.c
+++ b/hw/ppc/pnv_nest_pervasive.c
@@ -194,7 +194,7 @@ static const TypeInfo pnv_nest_pervasive_info = {
     .parent        = TYPE_DEVICE,
     .instance_size = sizeof(PnvNestChipletPervasive),
     .class_init    = pnv_nest_pervasive_class_init,
-    .interfaces    = (InterfaceInfo[]) {
+    .interfaces    = (const InterfaceInfo[]) {
         { TYPE_PNV_XSCOM_INTERFACE },
         { }
     }
diff --git a/hw/ppc/pnv_psi.c b/hw/ppc/pnv_psi.c
index 0fd247e6ad..5d947d8b52 100644
--- a/hw/ppc/pnv_psi.c
+++ b/hw/ppc/pnv_psi.c
@@ -913,7 +913,7 @@ static const TypeInfo pnv_psi_power9_info = {
     .instance_size = sizeof(Pnv9Psi),
     .instance_init = pnv_psi_power9_instance_init,
     .class_init    = pnv_psi_power9_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
             { TYPE_XIVE_NOTIFIER },
             { },
     },
@@ -959,7 +959,7 @@ static const TypeInfo pnv_psi_info = {
     .class_init    = pnv_psi_class_init,
     .class_size    = sizeof(PnvPsiClass),
     .abstract      = true,
-    .interfaces    = (InterfaceInfo[]) {
+    .interfaces    = (const InterfaceInfo[]) {
         { TYPE_PNV_XSCOM_INTERFACE },
         { }
     }
diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index 02663851ae..702f774cda 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -4717,7 +4717,7 @@ static const TypeInfo spapr_machine_info = {
     .instance_finalize = spapr_machine_finalizefn,
     .class_size    = sizeof(SpaprMachineClass),
     .class_init    = spapr_machine_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_FW_PATH_PROVIDER },
         { TYPE_NMI },
         { TYPE_HOTPLUG_HANDLER },
diff --git a/hw/ppc/spapr_pci.c b/hw/ppc/spapr_pci.c
index d0468e3fe6..1ac1185825 100644
--- a/hw/ppc/spapr_pci.c
+++ b/hw/ppc/spapr_pci.c
@@ -2200,7 +2200,7 @@ static const TypeInfo spapr_phb_info = {
     .instance_size = sizeof(SpaprPhbState),
     .instance_finalize = spapr_phb_finalizefn,
     .class_init    = spapr_phb_class_init,
-    .interfaces    = (InterfaceInfo[]) {
+    .interfaces    = (const InterfaceInfo[]) {
         { TYPE_HOTPLUG_HANDLER },
         { }
     }
diff --git a/hw/remote/machine.c b/hw/remote/machine.c
index 9fb92ec6f1..e4b47838ba 100644
--- a/hw/remote/machine.c
+++ b/hw/remote/machine.c
@@ -146,7 +146,7 @@ static const TypeInfo remote_machine = {
     .instance_size = sizeof(RemoteMachineState),
     .instance_init = remote_machine_instance_init,
     .class_init = remote_machine_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_HOTPLUG_HANDLER },
         { }
     }
diff --git a/hw/remote/proxy.c b/hw/remote/proxy.c
index d2de48c9e3..b0165aa2a1 100644
--- a/hw/remote/proxy.c
+++ b/hw/remote/proxy.c
@@ -215,7 +215,7 @@ static const TypeInfo pci_proxy_dev_type_info = {
     .parent        = TYPE_PCI_DEVICE,
     .instance_size = sizeof(PCIProxyDev),
     .class_init    = pci_proxy_dev_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { },
     },
diff --git a/hw/remote/remote-obj.c b/hw/remote/remote-obj.c
index 75f8d6df8a..85882902d7 100644
--- a/hw/remote/remote-obj.c
+++ b/hw/remote/remote-obj.c
@@ -188,7 +188,7 @@ static const TypeInfo remote_object_info = {
     .instance_finalize = remote_object_finalize,
     .class_size = sizeof(RemoteObjectClass),
     .class_init = remote_object_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_USER_CREATABLE },
         { }
     }
diff --git a/hw/remote/vfio-user-obj.c b/hw/remote/vfio-user-obj.c
index b0ae403f06..ea6165ebdc 100644
--- a/hw/remote/vfio-user-obj.c
+++ b/hw/remote/vfio-user-obj.c
@@ -944,7 +944,7 @@ static const TypeInfo vfu_object_info = {
     .instance_finalize = vfu_object_finalize,
     .class_size = sizeof(VfuObjectClass),
     .class_init = vfu_object_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_USER_CREATABLE },
         { }
     }
diff --git a/hw/riscv/riscv-iommu-pci.c b/hw/riscv/riscv-iommu-pci.c
index d93cf7521b..1f44eef74e 100644
--- a/hw/riscv/riscv-iommu-pci.c
+++ b/hw/riscv/riscv-iommu-pci.c
@@ -209,7 +209,7 @@ static const TypeInfo riscv_iommu_pci = {
     .class_init = riscv_iommu_pci_class_init,
     .instance_init = riscv_iommu_pci_init,
     .instance_size = sizeof(RISCVIOMMUStatePci),
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_PCIE_DEVICE },
         { },
     },
diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index 557efd15a1..be1bf0f646 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -1980,7 +1980,7 @@ static const TypeInfo virt_machine_typeinfo = {
     .class_init = virt_machine_class_init,
     .instance_init = virt_machine_instance_init,
     .instance_size = sizeof(RISCVVirtState),
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
          { TYPE_HOTPLUG_HANDLER },
          { }
     },
diff --git a/hw/rtc/m48t59-isa.c b/hw/rtc/m48t59-isa.c
index 4a7c0af9f0..9e2f6563a0 100644
--- a/hw/rtc/m48t59-isa.c
+++ b/hw/rtc/m48t59-isa.c
@@ -140,7 +140,7 @@ static const TypeInfo m48txx_isa_type_info = {
     .instance_size = sizeof(M48txxISAState),
     .abstract = true,
     .class_init = m48txx_isa_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_NVRAM },
         { }
     }
diff --git a/hw/rtc/m48t59.c b/hw/rtc/m48t59.c
index 821472a680..68be2dad6f 100644
--- a/hw/rtc/m48t59.c
+++ b/hw/rtc/m48t59.c
@@ -658,7 +658,7 @@ static const TypeInfo m48txx_sysbus_type_info = {
     .instance_init = m48t59_init1,
     .abstract = true,
     .class_init = m48txx_sysbus_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_NVRAM },
         { }
     }
diff --git a/hw/rtc/mc146818rtc.c b/hw/rtc/mc146818rtc.c
index 93b632bdf4..6f787be7af 100644
--- a/hw/rtc/mc146818rtc.c
+++ b/hw/rtc/mc146818rtc.c
@@ -1038,7 +1038,7 @@ static const TypeInfo mc146818rtc_info = {
     .parent        = TYPE_ISA_DEVICE,
     .instance_size = sizeof(MC146818RtcState),
     .class_init    = rtc_class_initfn,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_ACPI_DEV_AML_IF },
         { },
     },
diff --git a/hw/s390x/ap-bridge.c b/hw/s390x/ap-bridge.c
index 4aa7d5a90d..edeb3dbef3 100644
--- a/hw/s390x/ap-bridge.c
+++ b/hw/s390x/ap-bridge.c
@@ -75,7 +75,7 @@ static const TypeInfo ap_bridge_info = {
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = 0,
     .class_init    = ap_bridge_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_HOTPLUG_HANDLER },
         { }
     }
diff --git a/hw/s390x/css-bridge.c b/hw/s390x/css-bridge.c
index 9d91e5a5fe..0f87b8c5c4 100644
--- a/hw/s390x/css-bridge.c
+++ b/hw/s390x/css-bridge.c
@@ -136,7 +136,7 @@ static const TypeInfo virtual_css_bridge_info = {
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(VirtualCssBridge),
     .class_init    = virtual_css_bridge_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_HOTPLUG_HANDLER },
         { }
     }
diff --git a/hw/s390x/s390-pci-bus.c b/hw/s390x/s390-pci-bus.c
index 838b7e6484..e6aa44531f 100644
--- a/hw/s390x/s390-pci-bus.c
+++ b/hw/s390x/s390-pci-bus.c
@@ -1393,7 +1393,7 @@ static const TypeInfo s390_pcihost_info = {
     .parent        = TYPE_PCI_HOST_BRIDGE,
     .instance_size = sizeof(S390pciState),
     .class_init    = s390_pcihost_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_HOTPLUG_HANDLER },
         { }
     }
diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
index 00e9e46aef..94edd42dd2 100644
--- a/hw/s390x/s390-virtio-ccw.c
+++ b/hw/s390x/s390-virtio-ccw.c
@@ -875,7 +875,7 @@ static const TypeInfo ccw_machine_info = {
     .instance_init = s390_machine_initfn,
     .class_size = sizeof(S390CcwMachineClass),
     .class_init    = ccw_machine_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_NMI },
         { TYPE_HOTPLUG_HANDLER},
         { TYPE_DUMP_SKEYS_INTERFACE},
diff --git a/hw/s390x/virtio-ccw-md.c b/hw/s390x/virtio-ccw-md.c
index de333282df..0370f58450 100644
--- a/hw/s390x/virtio-ccw-md.c
+++ b/hw/s390x/virtio-ccw-md.c
@@ -140,7 +140,7 @@ static const TypeInfo virtio_ccw_md_info = {
     .instance_size = sizeof(VirtIOMDCcw),
     .class_size = sizeof(VirtIOMDCcwClass),
     .abstract = true,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_MEMORY_DEVICE },
         { }
     },
diff --git a/hw/scsi/esp-pci.c b/hw/scsi/esp-pci.c
index 74e9af0b5d..12c86eb7aa 100644
--- a/hw/scsi/esp-pci.c
+++ b/hw/scsi/esp-pci.c
@@ -450,7 +450,7 @@ static const TypeInfo esp_pci_info = {
     .instance_init = esp_pci_init,
     .instance_size = sizeof(PCIESPState),
     .class_init = esp_pci_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { },
     },
diff --git a/hw/scsi/lsi53c895a.c b/hw/scsi/lsi53c895a.c
index 0ad61565bf..f4f2ef321e 100644
--- a/hw/scsi/lsi53c895a.c
+++ b/hw/scsi/lsi53c895a.c
@@ -2396,7 +2396,7 @@ static const TypeInfo lsi_info = {
     .parent        = TYPE_PCI_DEVICE,
     .instance_size = sizeof(LSIState),
     .class_init    = lsi_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { },
     },
diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c
index a39e3e0e4f..55cd188bd5 100644
--- a/hw/scsi/megasas.c
+++ b/hw/scsi/megasas.c
@@ -2503,7 +2503,7 @@ static struct MegasasInfo megasas_devices[] = {
         .vmsd = &vmstate_megasas_gen1,
         .props = megasas_properties_gen1,
         .props_count = ARRAY_SIZE(megasas_properties_gen1),
-        .interfaces = (InterfaceInfo[]) {
+        .interfaces = (const InterfaceInfo[]) {
             { INTERFACE_CONVENTIONAL_PCI_DEVICE },
             { },
         },
@@ -2520,7 +2520,7 @@ static struct MegasasInfo megasas_devices[] = {
         .vmsd = &vmstate_megasas_gen2,
         .props = megasas_properties_gen2,
         .props_count = ARRAY_SIZE(megasas_properties_gen2),
-        .interfaces = (InterfaceInfo[]) {
+        .interfaces = (const InterfaceInfo[]) {
             { INTERFACE_PCIE_DEVICE },
             { }
         },
diff --git a/hw/scsi/mptsas.c b/hw/scsi/mptsas.c
index 17f73ce381..1ebe0b82a7 100644
--- a/hw/scsi/mptsas.c
+++ b/hw/scsi/mptsas.c
@@ -1441,7 +1441,7 @@ static const TypeInfo mptsas_info = {
     .parent = TYPE_PCI_DEVICE,
     .instance_size = sizeof(MPTSASState),
     .class_init = mptsas1068_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { },
     },
diff --git a/hw/scsi/scsi-bus.c b/hw/scsi/scsi-bus.c
index 0456b4de0a..70be4a7367 100644
--- a/hw/scsi/scsi-bus.c
+++ b/hw/scsi/scsi-bus.c
@@ -2046,7 +2046,7 @@ static const TypeInfo scsi_bus_info = {
     .parent = TYPE_BUS,
     .instance_size = sizeof(SCSIBus),
     .class_init = scsi_bus_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_HOTPLUG_HANDLER },
         { }
     }
diff --git a/hw/scsi/vhost-scsi.c b/hw/scsi/vhost-scsi.c
index be5a416c1d..10fde8eee0 100644
--- a/hw/scsi/vhost-scsi.c
+++ b/hw/scsi/vhost-scsi.c
@@ -397,7 +397,7 @@ static const TypeInfo vhost_scsi_info = {
     .instance_size = sizeof(VHostSCSI),
     .class_init = vhost_scsi_class_init,
     .instance_init = vhost_scsi_instance_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_FW_PATH_PROVIDER },
         { }
     },
diff --git a/hw/scsi/vhost-user-scsi.c b/hw/scsi/vhost-user-scsi.c
index 807a58ecf4..8298e8cc6d 100644
--- a/hw/scsi/vhost-user-scsi.c
+++ b/hw/scsi/vhost-user-scsi.c
@@ -422,7 +422,7 @@ static const TypeInfo vhost_user_scsi_info = {
     .instance_size = sizeof(VHostUserSCSI),
     .class_init = vhost_user_scsi_class_init,
     .instance_init = vhost_user_scsi_instance_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_FW_PATH_PROVIDER },
         { }
     },
diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c
index ae67a7682a..34ae14f7bf 100644
--- a/hw/scsi/virtio-scsi.c
+++ b/hw/scsi/virtio-scsi.c
@@ -1438,7 +1438,7 @@ static const TypeInfo virtio_scsi_info = {
     .parent = TYPE_VIRTIO_SCSI_COMMON,
     .instance_size = sizeof(VirtIOSCSI),
     .class_init = virtio_scsi_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_HOTPLUG_HANDLER },
         { }
     }
diff --git a/hw/scsi/vmw_pvscsi.c b/hw/scsi/vmw_pvscsi.c
index a8ea57ffad..d5825b6786 100644
--- a/hw/scsi/vmw_pvscsi.c
+++ b/hw/scsi/vmw_pvscsi.c
@@ -1346,7 +1346,7 @@ static const TypeInfo pvscsi_info = {
     .class_size    = sizeof(PVSCSIClass),
     .instance_size = sizeof(PVSCSIState),
     .class_init    = pvscsi_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_HOTPLUG_HANDLER },
         { INTERFACE_PCIE_DEVICE },
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
diff --git a/hw/sd/sdhci-pci.c b/hw/sd/sdhci-pci.c
index 2a56fbf2cd..c18b91fe63 100644
--- a/hw/sd/sdhci-pci.c
+++ b/hw/sd/sdhci-pci.c
@@ -75,7 +75,7 @@ static const TypeInfo sdhci_pci_types[] = {
         .parent         = TYPE_PCI_DEVICE,
         .instance_size  = sizeof(SDHCIState),
         .class_init     = sdhci_pci_class_init,
-        .interfaces     = (InterfaceInfo[]) {
+        .interfaces     = (const InterfaceInfo[]) {
             { INTERFACE_CONVENTIONAL_PCI_DEVICE },
             { },
         },
diff --git a/hw/sparc64/sun4u.c b/hw/sparc64/sun4u.c
index 0e5fb4e1b5..e9f9b0a4cb 100644
--- a/hw/sparc64/sun4u.c
+++ b/hw/sparc64/sun4u.c
@@ -391,7 +391,7 @@ static const TypeInfo ebus_info = {
     .parent        = TYPE_PCI_DEVICE,
     .class_init    = ebus_class_init,
     .instance_size = sizeof(EbusState),
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { },
     },
@@ -811,7 +811,7 @@ static const TypeInfo sun4u_type = {
     .name = MACHINE_TYPE_NAME("sun4u"),
     .parent = TYPE_MACHINE,
     .class_init = sun4u_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_FW_PATH_PROVIDER },
         { }
     },
diff --git a/hw/ssi/pnv_spi.c b/hw/ssi/pnv_spi.c
index 0bb6b0d935..f40e8836b9 100644
--- a/hw/ssi/pnv_spi.c
+++ b/hw/ssi/pnv_spi.c
@@ -1217,7 +1217,7 @@ static const TypeInfo pnv_spi_info = {
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(PnvSpi),
     .class_init    = pnv_spi_class_init,
-    .interfaces    = (InterfaceInfo[]) {
+    .interfaces    = (const InterfaceInfo[]) {
         { TYPE_PNV_XSCOM_INTERFACE },
         { }
     }
diff --git a/hw/tpm/tpm_crb.c b/hw/tpm/tpm_crb.c
index 9aff4d1a6f..bc7a78f898 100644
--- a/hw/tpm/tpm_crb.c
+++ b/hw/tpm/tpm_crb.c
@@ -337,7 +337,7 @@ static const TypeInfo tpm_crb_info = {
     .parent = TYPE_DEVICE,
     .instance_size = sizeof(CRBState),
     .class_init  = tpm_crb_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_TPM_IF },
         { }
     }
diff --git a/hw/tpm/tpm_spapr.c b/hw/tpm/tpm_spapr.c
index 1cad9a88ea..ea608ba4c8 100644
--- a/hw/tpm/tpm_spapr.c
+++ b/hw/tpm/tpm_spapr.c
@@ -414,7 +414,7 @@ static const TypeInfo tpm_spapr_info = {
     .parent        = TYPE_VIO_SPAPR_DEVICE,
     .instance_size = sizeof(SpaprTpmState),
     .class_init    = tpm_spapr_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_TPM_IF },
         { }
     }
diff --git a/hw/tpm/tpm_tis_i2c.c b/hw/tpm/tpm_tis_i2c.c
index b97d768a5b..5ce84dc7a4 100644
--- a/hw/tpm/tpm_tis_i2c.c
+++ b/hw/tpm/tpm_tis_i2c.c
@@ -552,7 +552,7 @@ static const TypeInfo tpm_tis_i2c_info = {
     .parent        = TYPE_I2C_SLAVE,
     .instance_size = sizeof(TPMStateI2C),
     .class_init    = tpm_tis_i2c_class_init,
-        .interfaces = (InterfaceInfo[]) {
+        .interfaces = (const InterfaceInfo[]) {
         { TYPE_TPM_IF },
         { }
     }
diff --git a/hw/tpm/tpm_tis_isa.c b/hw/tpm/tpm_tis_isa.c
index c0098a26e8..dce83057a9 100644
--- a/hw/tpm/tpm_tis_isa.c
+++ b/hw/tpm/tpm_tis_isa.c
@@ -189,7 +189,7 @@ static const TypeInfo tpm_tis_isa_info = {
     .instance_size = sizeof(TPMStateISA),
     .instance_init = tpm_tis_isa_initfn,
     .class_init  = tpm_tis_isa_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_TPM_IF },
         { TYPE_ACPI_DEV_AML_IF },
         { }
diff --git a/hw/tpm/tpm_tis_sysbus.c b/hw/tpm/tpm_tis_sysbus.c
index 19abf0b948..2ffa85852a 100644
--- a/hw/tpm/tpm_tis_sysbus.c
+++ b/hw/tpm/tpm_tis_sysbus.c
@@ -145,7 +145,7 @@ static const TypeInfo tpm_tis_sysbus_info = {
     .instance_size = sizeof(TPMStateSysBus),
     .instance_init = tpm_tis_sysbus_initfn,
     .class_init  = tpm_tis_sysbus_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_TPM_IF },
         { }
     }
diff --git a/hw/ufs/ufs.c b/hw/ufs/ufs.c
index 749519760f..0577747f46 100644
--- a/hw/ufs/ufs.c
+++ b/hw/ufs/ufs.c
@@ -1892,7 +1892,7 @@ static const TypeInfo ufs_info = {
     .parent = TYPE_PCI_DEVICE,
     .class_init = ufs_class_init,
     .instance_size = sizeof(UfsHc),
-    .interfaces = (InterfaceInfo[]){ { INTERFACE_PCIE_DEVICE }, {} },
+    .interfaces = (const InterfaceInfo[]){ { INTERFACE_PCIE_DEVICE }, {} },
 };
 
 static const TypeInfo ufs_bus_info = {
diff --git a/hw/usb/bus.c b/hw/usb/bus.c
index d8446cf50e..8dd2ce415e 100644
--- a/hw/usb/bus.c
+++ b/hw/usb/bus.c
@@ -42,7 +42,7 @@ static const TypeInfo usb_bus_info = {
     .parent = TYPE_BUS,
     .instance_size = sizeof(USBBus),
     .class_init = usb_bus_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_HOTPLUG_HANDLER },
         { }
     }
diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c
index 87018a3f01..6ce7154fee 100644
--- a/hw/usb/dev-smartcard-reader.c
+++ b/hw/usb/dev-smartcard-reader.c
@@ -1458,7 +1458,7 @@ static const TypeInfo ccid_info = {
     .parent        = TYPE_USB_DEVICE,
     .instance_size = sizeof(USBCCIDState),
     .class_init    = ccid_class_initfn,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_HOTPLUG_HANDLER },
         { }
     }
diff --git a/hw/usb/hcd-ehci-pci.c b/hw/usb/hcd-ehci-pci.c
index 73122aa797..38ad3406b3 100644
--- a/hw/usb/hcd-ehci-pci.c
+++ b/hw/usb/hcd-ehci-pci.c
@@ -172,7 +172,7 @@ static const TypeInfo ehci_pci_type_info = {
     .instance_finalize = usb_ehci_pci_finalize,
     .abstract = true,
     .class_init = ehci_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { },
     },
diff --git a/hw/usb/hcd-ohci-pci.c b/hw/usb/hcd-ohci-pci.c
index 3c82525a1e..94d1077eb9 100644
--- a/hw/usb/hcd-ohci-pci.c
+++ b/hw/usb/hcd-ohci-pci.c
@@ -149,7 +149,7 @@ static const TypeInfo ohci_pci_info = {
     .parent        = TYPE_PCI_DEVICE,
     .instance_size = sizeof(OHCIPCIState),
     .class_init    = ohci_pci_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { },
     },
diff --git a/hw/usb/hcd-uhci.c b/hw/usb/hcd-uhci.c
index 2b1aee1f21..4822c704f6 100644
--- a/hw/usb/hcd-uhci.c
+++ b/hw/usb/hcd-uhci.c
@@ -1278,7 +1278,7 @@ static const TypeInfo uhci_pci_type_info = {
     .class_size    = sizeof(UHCIPCIDeviceClass),
     .abstract = true,
     .class_init = uhci_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { },
     },
diff --git a/hw/usb/hcd-xhci-pci.c b/hw/usb/hcd-xhci-pci.c
index 6167bb9100..b93c80b09d 100644
--- a/hw/usb/hcd-xhci-pci.c
+++ b/hw/usb/hcd-xhci-pci.c
@@ -248,7 +248,7 @@ static const TypeInfo xhci_pci_info = {
     .class_init    = xhci_class_init,
     .instance_init = xhci_instance_init,
     .abstract      = true,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_PCIE_DEVICE },
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { }
diff --git a/hw/vfio/igd.c b/hw/vfio/igd.c
index fd55b8d884..0a13b185fe 100644
--- a/hw/vfio/igd.c
+++ b/hw/vfio/igd.c
@@ -318,7 +318,7 @@ static const TypeInfo vfio_pci_igd_lpc_bridge_info = {
     .name = "vfio-pci-igd-lpc-bridge",
     .parent = TYPE_PCI_DEVICE,
     .class_init = vfio_pci_igd_lpc_bridge_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { },
     },
diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index 0db9f03846..c3d9360710 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -3554,7 +3554,7 @@ static const TypeInfo vfio_pci_dev_info = {
     .class_init = vfio_pci_dev_class_init,
     .instance_init = vfio_instance_init,
     .instance_finalize = vfio_instance_finalize,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_PCIE_DEVICE },
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { }
diff --git a/hw/virtio/virtio-md-pci.c b/hw/virtio/virtio-md-pci.c
index 9ec5067662..9278b32cf8 100644
--- a/hw/virtio/virtio-md-pci.c
+++ b/hw/virtio/virtio-md-pci.c
@@ -138,7 +138,7 @@ static const TypeInfo virtio_md_pci_info = {
     .instance_size = sizeof(VirtIOMDPCI),
     .class_size = sizeof(VirtIOMDPCIClass),
     .abstract = true,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_MEMORY_DEVICE },
         { }
     },
diff --git a/hw/virtio/virtio-mem.c b/hw/virtio/virtio-mem.c
index 0e14dd37d6..a3d1a676e7 100644
--- a/hw/virtio/virtio-mem.c
+++ b/hw/virtio/virtio-mem.c
@@ -1907,7 +1907,7 @@ static const TypeInfo virtio_mem_info = {
     .instance_finalize = virtio_mem_instance_finalize,
     .class_init = virtio_mem_class_init,
     .class_size = sizeof(VirtIOMEMClass),
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_RAM_DISCARD_MANAGER },
         { }
     },
diff --git a/hw/virtio/virtio-pci.c b/hw/virtio/virtio-pci.c
index 95bf7ddd97..0fa8fe4955 100644
--- a/hw/virtio/virtio-pci.c
+++ b/hw/virtio/virtio-pci.c
@@ -2481,7 +2481,7 @@ void virtio_pci_types_register(const VirtioPCIDeviceTypeInfo *t)
         .name = t->generic_name,
         .parent = base_type_info.name,
         .class_init = virtio_pci_generic_class_init,
-        .interfaces = (InterfaceInfo[]) {
+        .interfaces = (const InterfaceInfo[]) {
             { INTERFACE_PCIE_DEVICE },
             { INTERFACE_CONVENTIONAL_PCI_DEVICE },
             { }
@@ -2516,7 +2516,7 @@ void virtio_pci_types_register(const VirtioPCIDeviceTypeInfo *t)
             .name          = t->non_transitional_name,
             .parent        = base_type_info.name,
             .instance_init = virtio_pci_non_transitional_instance_init,
-            .interfaces = (InterfaceInfo[]) {
+            .interfaces = (const InterfaceInfo[]) {
                 { INTERFACE_PCIE_DEVICE },
                 { INTERFACE_CONVENTIONAL_PCI_DEVICE },
                 { }
@@ -2530,7 +2530,7 @@ void virtio_pci_types_register(const VirtioPCIDeviceTypeInfo *t)
             .name          = t->transitional_name,
             .parent        = base_type_info.name,
             .instance_init = virtio_pci_transitional_instance_init,
-            .interfaces = (InterfaceInfo[]) {
+            .interfaces = (const InterfaceInfo[]) {
                 /*
                  * Transitional virtio devices work only as Conventional PCI
                  * devices because they require PIO ports.
diff --git a/hw/watchdog/wdt_i6300esb.c b/hw/watchdog/wdt_i6300esb.c
index 1536e1fe03..bb8a2766b6 100644
--- a/hw/watchdog/wdt_i6300esb.c
+++ b/hw/watchdog/wdt_i6300esb.c
@@ -480,7 +480,7 @@ static const TypeInfo i6300esb_info = {
     .parent        = TYPE_PCI_DEVICE,
     .instance_size = sizeof(I6300State),
     .class_init    = i6300esb_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { },
     },
diff --git a/hw/xen/xen-bus.c b/hw/xen/xen-bus.c
index e6272282cd..6bd2e546f6 100644
--- a/hw/xen/xen-bus.c
+++ b/hw/xen/xen-bus.c
@@ -399,7 +399,7 @@ static const TypeInfo xen_bus_type_info = {
     .instance_size = sizeof(XenBus),
     .class_size = sizeof(XenBusClass),
     .class_init = xen_bus_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_HOTPLUG_HANDLER },
         { }
     },
diff --git a/hw/xen/xen-legacy-backend.c b/hw/xen/xen-legacy-backend.c
index d6fe7d4f3e..5ed53f8943 100644
--- a/hw/xen/xen-legacy-backend.c
+++ b/hw/xen/xen-legacy-backend.c
@@ -661,7 +661,7 @@ static const TypeInfo xensysbus_info = {
     .name       = TYPE_XENSYSBUS,
     .parent     = TYPE_BUS,
     .class_init = xen_sysbus_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_HOTPLUG_HANDLER },
         { }
     }
diff --git a/hw/xen/xen_pt.c b/hw/xen/xen_pt.c
index 7f9c351d96..9d16644d82 100644
--- a/hw/xen/xen_pt.c
+++ b/hw/xen/xen_pt.c
@@ -1079,7 +1079,7 @@ static const TypeInfo xen_pci_passthrough_info = {
     .class_init = xen_pci_passthrough_class_init,
     .class_size = sizeof(XenPTDeviceClass),
     .instance_init = xen_pci_passthrough_instance_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { INTERFACE_PCIE_DEVICE },
         { },
diff --git a/hw/xen/xen_pt_graphics.c b/hw/xen/xen_pt_graphics.c
index 264851ece3..2c0cec9723 100644
--- a/hw/xen/xen_pt_graphics.c
+++ b/hw/xen/xen_pt_graphics.c
@@ -363,7 +363,7 @@ static const TypeInfo isa_bridge_info = {
     .parent        = TYPE_PCI_DEVICE,
     .instance_size = sizeof(PCIDevice),
     .class_init = isa_bridge_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
         { },
     },
diff --git a/include/qom/object.h b/include/qom/object.h
index 26a45f638c..1d5b033724 100644
--- a/include/qom/object.h
+++ b/include/qom/object.h
@@ -294,7 +294,7 @@ struct Object
         .class_size = CLASS_SIZE, \
         .class_init = module_obj_name##_class_init, \
         .abstract = ABSTRACT, \
-        .interfaces = (InterfaceInfo[]) { __VA_ARGS__ } , \
+        .interfaces = (const InterfaceInfo[]) { __VA_ARGS__ } , \
     }; \
     \
     static void \
diff --git a/net/can/can_core.c b/net/can/can_core.c
index e16e15c036..77fe2b8ba4 100644
--- a/net/can/can_core.c
+++ b/net/can/can_core.c
@@ -162,7 +162,7 @@ static const TypeInfo can_bus_info = {
     .instance_size = sizeof(CanBusState),
     .instance_init = can_bus_instance_init,
     .class_init = can_bus_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_USER_CREATABLE },
         { }
     }
diff --git a/net/can/can_host.c b/net/can/can_host.c
index ca5fcf1ea1..3f9bb33e47 100644
--- a/net/can/can_host.c
+++ b/net/can/can_host.c
@@ -92,7 +92,7 @@ static const TypeInfo can_host_info = {
     .class_size = sizeof(CanHostClass),
     .abstract = true,
     .class_init = can_host_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_USER_CREATABLE },
         { }
     }
diff --git a/net/colo-compare.c b/net/colo-compare.c
index 425eb6e971..0e1844ee4c 100644
--- a/net/colo-compare.c
+++ b/net/colo-compare.c
@@ -1476,7 +1476,7 @@ static const TypeInfo colo_compare_info = {
     .instance_finalize = colo_compare_finalize,
     .class_size = sizeof(CompareClass),
     .class_init = colo_compare_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_USER_CREATABLE },
         { }
     }
diff --git a/net/filter.c b/net/filter.c
index 03b3c793f7..c7cc6615dc 100644
--- a/net/filter.c
+++ b/net/filter.c
@@ -363,7 +363,7 @@ static const TypeInfo netfilter_info = {
     .instance_size = sizeof(NetFilterState),
     .instance_init = netfilter_init,
     .instance_finalize = netfilter_finalize,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_USER_CREATABLE },
         { }
     }
diff --git a/scripts/codeconverter/codeconverter/test_regexps.py b/scripts/codeconverter/codeconverter/test_regexps.py
index 08857c5008..4526268ae8 100644
--- a/scripts/codeconverter/codeconverter/test_regexps.py
+++ b/scripts/codeconverter/codeconverter/test_regexps.py
@@ -77,8 +77,8 @@ static const TypeInfo char_file_type_info = {
     assert fullmatch(RE_ARRAY_ITEM, '{ TYPE_HOTPLUG_HANDLER },')
     assert fullmatch(RE_ARRAY_ITEM, '{ TYPE_ACPI_DEVICE_IF },')
     assert fullmatch(RE_ARRAY_ITEM, '{ }')
-    assert fullmatch(RE_ARRAY_CAST, '(InterfaceInfo[])')
-    assert fullmatch(RE_ARRAY, '''(InterfaceInfo[]) {
+    assert fullmatch(RE_ARRAY_CAST, '(const InterfaceInfo[])')
+    assert fullmatch(RE_ARRAY, '''(const InterfaceInfo[]) {
             { TYPE_HOTPLUG_HANDLER },
             { TYPE_ACPI_DEVICE_IF },
             { }
@@ -98,7 +98,7 @@ static const TypeInfo char_file_type_info = {
         .parent = TYPE_DEVICE,
         .instance_size = sizeof(CRBState),
         .class_init  = tpm_crb_class_init,
-        .interfaces = (InterfaceInfo[]) {
+        .interfaces = (const InterfaceInfo[]) {
             { TYPE_TPM_IF },
             { }
         }
@@ -134,7 +134,7 @@ static const TypeInfo char_file_type_info = {
         .instance_size = sizeof(AcpiGedState),
         .instance_init  = acpi_ged_initfn,
         .class_init    = acpi_ged_class_init,
-        .interfaces = (InterfaceInfo[]) {
+        .interfaces = (const InterfaceInfo[]) {
             { TYPE_HOTPLUG_HANDLER },
             { TYPE_ACPI_DEVICE_IF },
             { }
@@ -164,7 +164,7 @@ static const TypeInfo char_file_type_info = {
         .parent = TYPE_DEVICE,
         .instance_size = sizeof(CRBState),
         .class_init  = tpm_crb_class_init,
-        .interfaces = (InterfaceInfo[]) {
+        .interfaces = (const InterfaceInfo[]) {
             { TYPE_TPM_IF },
             { }
         }
diff --git a/scsi/pr-manager.c b/scsi/pr-manager.c
index 1977d99ce0..40e1210eb2 100644
--- a/scsi/pr-manager.c
+++ b/scsi/pr-manager.c
@@ -77,7 +77,7 @@ static const TypeInfo pr_manager_info = {
     .name = TYPE_PR_MANAGER,
     .class_size = sizeof(PRManagerClass),
     .abstract = true,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_USER_CREATABLE },
         { }
     }
diff --git a/system/qtest.c b/system/qtest.c
index b7689088a4..ade3eb3221 100644
--- a/system/qtest.c
+++ b/system/qtest.c
@@ -1012,7 +1012,7 @@ static const TypeInfo qtest_info = {
     .parent = TYPE_OBJECT,
     .class_init = qtest_class_init,
     .instance_size = sizeof(QTest),
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_USER_CREATABLE },
         { }
     }
diff --git a/target/i386/sev.c b/target/i386/sev.c
index 7ef4801d5f..7ee700d6a3 100644
--- a/target/i386/sev.c
+++ b/target/i386/sev.c
@@ -2089,7 +2089,7 @@ static const TypeInfo sev_common_info = {
     .class_size = sizeof(SevCommonStateClass),
     .class_init = sev_common_class_init,
     .abstract = true,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_USER_CREATABLE },
         { }
     }
diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
index 90b21b9c93..aed9e26599 100644
--- a/target/ppc/cpu_init.c
+++ b/target/ppc/cpu_init.c
@@ -7570,7 +7570,7 @@ static const TypeInfo ppc_cpu_type_info = {
     .class_size = sizeof(PowerPCCPUClass),
     .class_init = ppc_cpu_class_init,
 #ifndef CONFIG_USER_ONLY
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
           { TYPE_INTERRUPT_STATS_PROVIDER },
           { }
     },
diff --git a/tests/unit/check-qom-interface.c b/tests/unit/check-qom-interface.c
index 4e1c4d6729..86ae5f6c3b 100644
--- a/tests/unit/check-qom-interface.c
+++ b/tests/unit/check-qom-interface.c
@@ -52,7 +52,7 @@ static const TypeInfo direct_impl_info = {
     .name = TYPE_DIRECT_IMPL,
     .parent = TYPE_OBJECT,
     .class_init = test_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_TEST_IF },
         { }
     }
diff --git a/tests/unit/check-qom-proplist.c b/tests/unit/check-qom-proplist.c
index f1de1618f6..ee3c6fb32b 100644
--- a/tests/unit/check-qom-proplist.c
+++ b/tests/unit/check-qom-proplist.c
@@ -164,7 +164,7 @@ static const TypeInfo dummy_info = {
     .instance_finalize = dummy_finalize,
     .class_size = sizeof(DummyObjectClass),
     .class_init = dummy_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_USER_CREATABLE },
         { }
     }
diff --git a/ui/dbus.c b/ui/dbus.c
index 0c0f86eaa6..dd0336702d 100644
--- a/ui/dbus.c
+++ b/ui/dbus.c
@@ -514,7 +514,7 @@ static const TypeInfo dbus_display_info = {
     .instance_init = dbus_display_init,
     .instance_finalize = dbus_display_finalize,
     .class_init = dbus_display_class_init,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_USER_CREATABLE },
         { }
     }
diff --git a/ui/input-barrier.c b/ui/input-barrier.c
index 9dce31ea9a..9793258aac 100644
--- a/ui/input-barrier.c
+++ b/ui/input-barrier.c
@@ -732,7 +732,7 @@ static const TypeInfo input_barrier_info = {
     .instance_size = sizeof(InputBarrier),
     .instance_init = input_barrier_instance_init,
     .instance_finalize = input_barrier_instance_finalize,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_USER_CREATABLE },
         { }
     }
diff --git a/ui/input-linux.c b/ui/input-linux.c
index 2f5adb82d2..92e1a1aa64 100644
--- a/ui/input-linux.c
+++ b/ui/input-linux.c
@@ -522,7 +522,7 @@ static const TypeInfo input_linux_info = {
     .instance_size = sizeof(InputLinux),
     .instance_init = input_linux_instance_init,
     .instance_finalize = input_linux_instance_finalize,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_USER_CREATABLE },
         { }
     }
diff --git a/util/thread-context.c b/util/thread-context.c
index 95228a3d4f..0146154fa5 100644
--- a/util/thread-context.c
+++ b/util/thread-context.c
@@ -319,7 +319,7 @@ static const TypeInfo thread_context_info = {
     .instance_size = sizeof(ThreadContext),
     .instance_init = thread_context_instance_init,
     .instance_finalize = thread_context_instance_finalize,
-    .interfaces = (InterfaceInfo[]) {
+    .interfaces = (const InterfaceInfo[]) {
         { TYPE_USER_CREATABLE },
         { }
     }

From 7748cdbae899f54f672e2e5ecd2c556c256b2b08 Mon Sep 17 00:00:00 2001
From: Kohei Tokunaga <ktokunaga.mail@gmail.com>
Date: Tue, 22 Apr 2025 14:27:06 +0900
Subject: [PATCH 0312/2760] qom/object: Fix type conflict of GLib function
 pointers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

On Emscripten, function pointer casts can result in runtime failures due to
strict function signature checks. This affects the use of g_list_sort and
g_slist_sort, which internally perform function pointer casts that are not
supported by Emscripten. To avoid these issues, g_list_sort_with_data and
g_slist_sort_with_data should be used instead, as they do not rely on
function pointer casting.

Signed-off-by: Kohei Tokunaga <ktokunaga.mail@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <8ca13f4e2b9eba9d1f6030b0afb442a24330e463.1745295397.git.ktokunaga.mail@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 qom/object.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/qom/object.c b/qom/object.c
index 425ee2f0ee..664f0f24ae 100644
--- a/qom/object.c
+++ b/qom/object.c
@@ -1191,7 +1191,7 @@ GSList *object_class_get_list(const char *implements_type,
     return list;
 }
 
-static gint object_class_cmp(gconstpointer a, gconstpointer b)
+static gint object_class_cmp(gconstpointer a, gconstpointer b, gpointer d)
 {
     return strcasecmp(object_class_get_name((ObjectClass *)a),
                       object_class_get_name((ObjectClass *)b));
@@ -1200,8 +1200,9 @@ static gint object_class_cmp(gconstpointer a, gconstpointer b)
 GSList *object_class_get_list_sorted(const char *implements_type,
                                      bool include_abstract)
 {
-    return g_slist_sort(object_class_get_list(implements_type, include_abstract),
-                        object_class_cmp);
+    return g_slist_sort_with_data(
+        object_class_get_list(implements_type, include_abstract),
+        object_class_cmp, NULL);
 }
 
 Object *object_ref(void *objptr)

From d5f241834be1b323ea697a469ff0f1335a1823fe Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 22 Apr 2025 10:32:31 +0200
Subject: [PATCH 0313/2760] hw/core: Get default_cpu_type calling
 machine_class_default_cpu_type()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since commit 62b4a227a33 the default cpu type can come from the
valid_cpu_types[] array. Call the machine_class_default_cpu_type()
instead of accessing MachineClass::default_cpu_type field.

Cc: qemu-stable@nongnu.org
Fixes: 62b4a227a33 ("hw/core: Add machine_class_default_cpu_type()")
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Message-Id: <20250422084114.39499-1-philmd@linaro.org>
---
 hw/core/machine-qmp-cmds.c | 5 +++--
 target/ppc/cpu_init.c      | 2 +-
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/hw/core/machine-qmp-cmds.c b/hw/core/machine-qmp-cmds.c
index fd8b4e0b44..9447e345b3 100644
--- a/hw/core/machine-qmp-cmds.c
+++ b/hw/core/machine-qmp-cmds.c
@@ -73,6 +73,7 @@ MachineInfoList *qmp_query_machines(bool has_compat_props, bool compat_props,
 
     for (el = machines; el; el = el->next) {
         MachineClass *mc = el->data;
+        const char *default_cpu_type = machine_class_default_cpu_type(mc);
         MachineInfo *info;
 
         info = g_malloc0(sizeof(*info));
@@ -91,8 +92,8 @@ MachineInfoList *qmp_query_machines(bool has_compat_props, bool compat_props,
         info->numa_mem_supported = mc->numa_mem_supported;
         info->deprecated = !!mc->deprecation_reason;
         info->acpi = !!object_class_property_find(OBJECT_CLASS(mc), "acpi");
-        if (mc->default_cpu_type) {
-            info->default_cpu_type = g_strdup(mc->default_cpu_type);
+        if (default_cpu_type) {
+            info->default_cpu_type = g_strdup(default_cpu_type);
         }
         if (mc->default_ram_id) {
             info->default_ram_id = g_strdup(mc->default_ram_id);
diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
index aed9e26599..b0973b6df9 100644
--- a/target/ppc/cpu_init.c
+++ b/target/ppc/cpu_init.c
@@ -7082,7 +7082,7 @@ ObjectClass *ppc_cpu_class_by_name(const char *name)
     if (strcmp(name, "max") == 0) {
         MachineClass *mc = MACHINE_GET_CLASS(qdev_get_machine());
         if (mc) {
-            return object_class_by_name(mc->default_cpu_type);
+            return object_class_by_name(machine_class_default_cpu_type(mc));
         }
     }
 #endif

From 56a9f0d4c4a483ce217e5290db69cb1788586787 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Mon, 17 Mar 2025 14:28:11 +0000
Subject: [PATCH 0314/2760] hw/core/cpu: gdb_arch_name string should not be
 freed
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The documentation for the CPUClass::gdb_arch_name method claims that
the returned string should be freed with g_free().  This is not
correct: in commit a650683871ba728 we changed this method to
instead return a simple constant string, but forgot to update
the documentation.

Make the documentation match the new semantics.

Fixes: a650683871ba728 ("hw/core/cpu: Return static value with gdb_arch_name()")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250317142819.900029-2-peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 include/hw/core/cpu.h | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index 5b645df59f..6ea246514e 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -134,7 +134,8 @@ struct SysemuCPUOps;
  * @gdb_stop_before_watchpoint: Indicates whether GDB expects the CPU to stop
  *           before the insn which triggers a watchpoint rather than after it.
  * @gdb_arch_name: Optional callback that returns the architecture name known
- * to GDB. The caller must free the returned string with g_free.
+ * to GDB. The returned value is expected to be a simple constant string:
+ * the caller will not g_free() it.
  * @disas_set_info: Setup architecture specific components of disassembly info
  * @adjust_watchpoint_address: Perform a target-specific adjustment to an
  * address before attempting to match it against watchpoints.

From a1f728ecc90cf6c6db24df53cc951713fca8b94d Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Mon, 17 Mar 2025 14:28:12 +0000
Subject: [PATCH 0315/2760] gdbstub: Allow gdb_core_xml_file to be set at
 runtime
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Currently the CPUClass:gdb_core_xml_file setting is a simple 'const
char *' which the CPU class must set to a fixed string.  Allow the
CPU class to instead set a new method gdb_get_core_xml_file() which
returns this string.

This will allow Arm CPUs to use different XML files for AArch32 vs
AArch64 without having to have an extra AArch64-specific class type
purely to give somewhere to set cc->gdb_core_xml_file differently.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Acked-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250317142819.900029-3-peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 gdbstub/gdbstub.c     | 23 +++++++++++++++++++----
 include/hw/core/cpu.h |  5 +++++
 2 files changed, 24 insertions(+), 4 deletions(-)

diff --git a/gdbstub/gdbstub.c b/gdbstub/gdbstub.c
index 282e13e163..565f6b33a9 100644
--- a/gdbstub/gdbstub.c
+++ b/gdbstub/gdbstub.c
@@ -565,15 +565,30 @@ static void gdb_register_feature(CPUState *cpu, int base_reg,
     g_array_append_val(cpu->gdb_regs, s);
 }
 
+static const char *gdb_get_core_xml_file(CPUState *cpu)
+{
+    CPUClass *cc = cpu->cc;
+
+    /*
+     * The CPU class can provide the XML filename via a method,
+     * or as a simple fixed string field.
+     */
+    if (cc->gdb_get_core_xml_file) {
+        return cc->gdb_get_core_xml_file(cpu);
+    }
+    return cc->gdb_core_xml_file;
+}
+
 void gdb_init_cpu(CPUState *cpu)
 {
     CPUClass *cc = cpu->cc;
     const GDBFeature *feature;
+    const char *xmlfile = gdb_get_core_xml_file(cpu);
 
     cpu->gdb_regs = g_array_new(false, false, sizeof(GDBRegisterState));
 
-    if (cc->gdb_core_xml_file) {
-        feature = gdb_find_static_feature(cc->gdb_core_xml_file);
+    if (xmlfile) {
+        feature = gdb_find_static_feature(xmlfile);
         gdb_register_feature(cpu, 0,
                              cc->gdb_read_register, cc->gdb_write_register,
                              feature);
@@ -1644,7 +1659,7 @@ void gdb_extend_qsupported_features(char *qflags)
 static void handle_query_supported(GArray *params, void *user_ctx)
 {
     g_string_printf(gdbserver_state.str_buf, "PacketSize=%x", MAX_PACKET_LENGTH);
-    if (first_cpu->cc->gdb_core_xml_file) {
+    if (gdb_get_core_xml_file(first_cpu)) {
         g_string_append(gdbserver_state.str_buf, ";qXfer:features:read+");
     }
 
@@ -1701,7 +1716,7 @@ static void handle_query_xfer_features(GArray *params, void *user_ctx)
     }
 
     process = gdb_get_cpu_process(gdbserver_state.g_cpu);
-    if (!gdbserver_state.g_cpu->cc->gdb_core_xml_file) {
+    if (!gdb_get_core_xml_file(gdbserver_state.g_cpu)) {
         gdb_put_packet("");
         return;
     }
diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index 6ea246514e..2a02d4f078 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -131,6 +131,10 @@ struct SysemuCPUOps;
  * @gdb_num_core_regs: Number of core registers accessible to GDB or 0 to infer
  *                     from @gdb_core_xml_file.
  * @gdb_core_xml_file: File name for core registers GDB XML description.
+ * @gdb_get_core_xml_file: Optional callback that returns the file name for
+ * the core registers GDB XML description. The returned value is expected to
+ * be a simple constant string: the caller will not g_free() it. If this
+ * is NULL then @gdb_core_xml_file will be used instead.
  * @gdb_stop_before_watchpoint: Indicates whether GDB expects the CPU to stop
  *           before the insn which triggers a watchpoint rather than after it.
  * @gdb_arch_name: Optional callback that returns the architecture name known
@@ -166,6 +170,7 @@ struct CPUClass {
 
     const char *gdb_core_xml_file;
     const gchar * (*gdb_arch_name)(CPUState *cpu);
+    const char * (*gdb_get_core_xml_file)(CPUState *cpu);
 
     void (*disas_set_info)(CPUState *cpu, disassemble_info *info);
 

From bae9fb4b016b1927f6e0cdea9213e33e3a70c9ae Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Mon, 17 Mar 2025 14:28:13 +0000
Subject: [PATCH 0316/2760] target/arm: Handle AArch64 in TYPE_ARM_CPU
 gdb_arch_name
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Instead of having the TYPE_AARCH64_CPU subclass set
CPUClass::gdb_arch_name to a different function, make the
TYPE_ARM_CPU implementation of the method handle AArch64.

For the moment we make the "is this AArch64?" function test "is the
CPU of TYPE_AARCH64_CPU?", so that this produces no behavioural
change.  When we've moved all the gdbstub related methods across to
the base class, we will be able to change this to be "does the CPU
have the ARM_FEATURE_AARCH64 feature?".

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250317142819.900029-4-peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/arm/cpu.c       | 3 +++
 target/arm/cpu64.c     | 6 ------
 target/arm/internals.h | 6 ++++++
 3 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index 00577f97eb..bed0e58f3c 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -2649,6 +2649,9 @@ static const gchar *arm_gdb_arch_name(CPUState *cs)
     ARMCPU *cpu = ARM_CPU(cs);
     CPUARMState *env = &cpu->env;
 
+    if (arm_gdbstub_is_aarch64(cpu)) {
+        return "aarch64";
+    }
     if (arm_feature(env, ARM_FEATURE_IWMMXT)) {
         return "iwmmxt";
     }
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index eaf5705cdc..fbb7e7b3d6 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -813,11 +813,6 @@ static void aarch64_cpu_finalizefn(Object *obj)
 {
 }
 
-static const gchar *aarch64_gdb_arch_name(CPUState *cs)
-{
-    return "aarch64";
-}
-
 static void aarch64_cpu_class_init(ObjectClass *oc, const void *data)
 {
     CPUClass *cc = CPU_CLASS(oc);
@@ -825,7 +820,6 @@ static void aarch64_cpu_class_init(ObjectClass *oc, const void *data)
     cc->gdb_read_register = aarch64_cpu_gdb_read_register;
     cc->gdb_write_register = aarch64_cpu_gdb_write_register;
     cc->gdb_core_xml_file = "aarch64-core.xml";
-    cc->gdb_arch_name = aarch64_gdb_arch_name;
 
     object_class_property_add_bool(oc, "aarch64", aarch64_cpu_get_aarch64,
                                    aarch64_cpu_set_aarch64);
diff --git a/target/arm/internals.h b/target/arm/internals.h
index d24acdd672..08f4bd1679 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -1826,6 +1826,12 @@ void aarch64_add_pauth_properties(Object *obj);
 void aarch64_add_sve_properties(Object *obj);
 void aarch64_add_sme_properties(Object *obj);
 
+/* Return true if the gdbstub is presenting an AArch64 CPU */
+static inline bool arm_gdbstub_is_aarch64(ARMCPU *cpu)
+{
+    return object_dynamic_cast(OBJECT(cpu), TYPE_AARCH64_CPU);
+}
+
 /* Read the CONTROL register as the MRS instruction would. */
 uint32_t arm_v7m_mrs_control(CPUARMState *env, uint32_t secure);
 

From 984ea94818000618c4ff95d0b63f63aba8f2a95e Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Mon, 17 Mar 2025 14:28:14 +0000
Subject: [PATCH 0317/2760] target/arm: Handle gdb_core_xml_file in
 TYPE_ARM_CPU
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Instead of having the TYPE_AARCH64_CPU subclass set
CPUClass:gdb_core_xml_file to a different value from that that
TYPE_ARM_CPU uses, implement the gdb_get_core_xml_file method in the
TYPE_ARM_CPU class to return either the AArch64 or AArch32 XML file
name.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250317142819.900029-5-peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/arm/cpu.c         | 16 +++++++++++++++-
 target/arm/cpu64.c       |  1 -
 target/arm/tcg/cpu-v7m.c |  1 -
 3 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index bed0e58f3c..5e951675c6 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -2658,6 +2658,20 @@ static const gchar *arm_gdb_arch_name(CPUState *cs)
     return "arm";
 }
 
+static const char *arm_gdb_get_core_xml_file(CPUState *cs)
+{
+    ARMCPU *cpu = ARM_CPU(cs);
+    CPUARMState *env = &cpu->env;
+
+    if (arm_gdbstub_is_aarch64(cpu)) {
+        return "aarch64-core.xml";
+    }
+    if (arm_feature(env, ARM_FEATURE_M)) {
+        return "arm-m-profile.xml";
+    }
+    return "arm-core.xml";
+}
+
 #ifndef CONFIG_USER_ONLY
 #include "hw/core/sysemu-cpu-ops.h"
 
@@ -2727,6 +2741,7 @@ static void arm_cpu_class_init(ObjectClass *oc, const void *data)
     cc->sysemu_ops = &arm_sysemu_ops;
 #endif
     cc->gdb_arch_name = arm_gdb_arch_name;
+    cc->gdb_get_core_xml_file = arm_gdb_get_core_xml_file;
     cc->gdb_stop_before_watchpoint = true;
     cc->disas_set_info = arm_disas_set_info;
 
@@ -2749,7 +2764,6 @@ static void cpu_register_class_init(ObjectClass *oc, const void *data)
     CPUClass *cc = CPU_CLASS(acc);
 
     acc->info = data;
-    cc->gdb_core_xml_file = "arm-core.xml";
     if (acc->info->deprecation_note) {
         cc->deprecation_note = acc->info->deprecation_note;
     }
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index fbb7e7b3d6..5135ef63cb 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -819,7 +819,6 @@ static void aarch64_cpu_class_init(ObjectClass *oc, const void *data)
 
     cc->gdb_read_register = aarch64_cpu_gdb_read_register;
     cc->gdb_write_register = aarch64_cpu_gdb_write_register;
-    cc->gdb_core_xml_file = "aarch64-core.xml";
 
     object_class_property_add_bool(oc, "aarch64", aarch64_cpu_get_aarch64,
                                    aarch64_cpu_set_aarch64);
diff --git a/target/arm/tcg/cpu-v7m.c b/target/arm/tcg/cpu-v7m.c
index 7426aac0dc..b34b657857 100644
--- a/target/arm/tcg/cpu-v7m.c
+++ b/target/arm/tcg/cpu-v7m.c
@@ -266,7 +266,6 @@ static void arm_v7m_class_init(ObjectClass *oc, const void *data)
 
     acc->info = data;
     cc->tcg_ops = &arm_v7m_tcg_ops;
-    cc->gdb_core_xml_file = "arm-m-profile.xml";
 }
 
 static const ARMCPUInfo arm_v7m_cpus[] = {

From 4b6f74d86c4d4f179643ae2c5f7bbfcf7c1a7725 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Mon, 17 Mar 2025 14:28:15 +0000
Subject: [PATCH 0318/2760] target/arm: Handle AArch64 gdb read/write regs in
 TYPE_ARM_CPU
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Instead of having the TYPE_AARCH64_CPU subclass set
CPUClass::gdb_read_register and ::gdb_write_register to different
methods from those of the TYPE_ARM_CPU parent class, have the
TYPE_ARM_CPU methods handle either AArch32 or AArch64 at runtime.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250317142819.900029-6-peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/arm/cpu64.c   |  5 -----
 target/arm/gdbstub.c | 12 ++++++++++++
 2 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index 5135ef63cb..00629a5d1d 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -815,11 +815,6 @@ static void aarch64_cpu_finalizefn(Object *obj)
 
 static void aarch64_cpu_class_init(ObjectClass *oc, const void *data)
 {
-    CPUClass *cc = CPU_CLASS(oc);
-
-    cc->gdb_read_register = aarch64_cpu_gdb_read_register;
-    cc->gdb_write_register = aarch64_cpu_gdb_write_register;
-
     object_class_property_add_bool(oc, "aarch64", aarch64_cpu_get_aarch64,
                                    aarch64_cpu_set_aarch64);
     object_class_property_set_description(oc, "aarch64",
diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c
index 30068c2262..ce4497ad7c 100644
--- a/target/arm/gdbstub.c
+++ b/target/arm/gdbstub.c
@@ -44,6 +44,12 @@ int arm_cpu_gdb_read_register(CPUState *cs, GByteArray *mem_buf, int n)
     ARMCPU *cpu = ARM_CPU(cs);
     CPUARMState *env = &cpu->env;
 
+#ifdef TARGET_AARCH64
+    if (arm_gdbstub_is_aarch64(cpu)) {
+        return aarch64_cpu_gdb_read_register(cs, mem_buf, n);
+    }
+#endif
+
     if (n < 16) {
         /* Core integer register.  */
         return gdb_get_reg32(mem_buf, env->regs[n]);
@@ -66,6 +72,12 @@ int arm_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n)
     CPUARMState *env = &cpu->env;
     uint32_t tmp;
 
+#ifdef TARGET_AARCH64
+    if (arm_gdbstub_is_aarch64(cpu)) {
+        return aarch64_cpu_gdb_write_register(cs, mem_buf, n);
+    }
+#endif
+
     tmp = ldl_p(mem_buf);
 
     /*

From 35ca9d14c173bf7593367d19048ce7784fd122c3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 4 Apr 2025 00:19:59 +0200
Subject: [PATCH 0319/2760] target/arm: Replace target_ulong -> hwaddr in
 ARMMMUFaultInfo
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250415172246.79470-2-philmd@linaro.org>
---
 target/arm/internals.h | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index 08f4bd1679..0818de530b 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -25,6 +25,7 @@
 #ifndef TARGET_ARM_INTERNALS_H
 #define TARGET_ARM_INTERNALS_H
 
+#include "exec/hwaddr.h"
 #include "exec/breakpoint.h"
 #include "hw/registerfields.h"
 #include "tcg/tcg-gvec-desc.h"
@@ -726,8 +727,8 @@ typedef struct ARMMMUFaultInfo ARMMMUFaultInfo;
 struct ARMMMUFaultInfo {
     ARMFaultType type;
     ARMGPCF gpcf;
-    target_ulong s2addr;
-    target_ulong paddr;
+    hwaddr s2addr;
+    hwaddr paddr;
     ARMSecuritySpace paddr_space;
     int level;
     int domain;

From 6fa103069d13edb0875242e10dbcc47df19ba412 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 4 Apr 2025 00:25:06 +0200
Subject: [PATCH 0320/2760] target/arm: Replace target_ulong -> vaddr for
 CPUWatchpoint
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

CPUWatchpoint::vaddr/len are of type vaddr.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250415172246.79470-4-philmd@linaro.org>
---
 target/arm/hyp_gdbstub.c | 8 ++++----
 target/arm/internals.h   | 9 +++++----
 2 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/target/arm/hyp_gdbstub.c b/target/arm/hyp_gdbstub.c
index 1e861263b3..0512d67f8c 100644
--- a/target/arm/hyp_gdbstub.c
+++ b/target/arm/hyp_gdbstub.c
@@ -125,7 +125,7 @@ int delete_hw_breakpoint(target_ulong pc)
  * need to ensure you mask the address as required and set BAS=0xff
  */
 
-int insert_hw_watchpoint(target_ulong addr, target_ulong len, int type)
+int insert_hw_watchpoint(vaddr addr, vaddr len, int type)
 {
     HWWatchpoint wp = {
         .wcr = R_DBGWCR_E_MASK, /* E=1, enable */
@@ -182,7 +182,7 @@ int insert_hw_watchpoint(target_ulong addr, target_ulong len, int type)
     return 0;
 }
 
-bool check_watchpoint_in_range(int i, target_ulong addr)
+bool check_watchpoint_in_range(int i, vaddr addr)
 {
     HWWatchpoint *wp = get_hw_wp(i);
     uint64_t addr_top, addr_bottom = wp->wvr;
@@ -214,7 +214,7 @@ bool check_watchpoint_in_range(int i, target_ulong addr)
  * Delete a breakpoint and shuffle any above down
  */
 
-int delete_hw_watchpoint(target_ulong addr, target_ulong len, int type)
+int delete_hw_watchpoint(vaddr addr, vaddr len, int type)
 {
     int i;
     for (i = 0; i < cur_hw_wps; i++) {
@@ -239,7 +239,7 @@ bool find_hw_breakpoint(CPUState *cpu, target_ulong pc)
     return false;
 }
 
-CPUWatchpoint *find_hw_watchpoint(CPUState *cpu, target_ulong addr)
+CPUWatchpoint *find_hw_watchpoint(CPUState *cpu, vaddr addr)
 {
     int i;
 
diff --git a/target/arm/internals.h b/target/arm/internals.h
index 0818de530b..4d3d84ffeb 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -26,6 +26,7 @@
 #define TARGET_ARM_INTERNALS_H
 
 #include "exec/hwaddr.h"
+#include "exec/vaddr.h"
 #include "exec/breakpoint.h"
 #include "hw/registerfields.h"
 #include "tcg/tcg-gvec-desc.h"
@@ -1952,10 +1953,10 @@ bool find_hw_breakpoint(CPUState *cpu, target_ulong pc);
 int insert_hw_breakpoint(target_ulong pc);
 int delete_hw_breakpoint(target_ulong pc);
 
-bool check_watchpoint_in_range(int i, target_ulong addr);
-CPUWatchpoint *find_hw_watchpoint(CPUState *cpu, target_ulong addr);
-int insert_hw_watchpoint(target_ulong addr, target_ulong len, int type);
-int delete_hw_watchpoint(target_ulong addr, target_ulong len, int type);
+bool check_watchpoint_in_range(int i, vaddr addr);
+CPUWatchpoint *find_hw_watchpoint(CPUState *cpu, vaddr addr);
+int insert_hw_watchpoint(vaddr addr, vaddr len, int type);
+int delete_hw_watchpoint(vaddr addr, vaddr len, int type);
 
 /* Return the current value of the system counter in ticks */
 uint64_t gt_get_countervalue(CPUARMState *env);

From d4a785ba30ce6d8acf0206f049fb4a7494e0898a Mon Sep 17 00:00:00 2001
From: Hauke Mehrtens <hauke@hauke-m.de>
Date: Sat, 12 Apr 2025 21:40:03 +0200
Subject: [PATCH 0321/2760] target/mips: Fix MIPS16e translation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fix a wrong conversion to gen_op_addr_addi(). The framesize should be
added like it was done before.

This bug broke booting OpenWrt MIPS32 BE malta Linux system images
generated by OpenWrt.

Cc: qemu-stable@nongnu.org
Fixes: d0b24b7f50e1 ("target/mips: Use gen_op_addr_addi() when possible")
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250412194003.181411-1-hauke@hauke-m.de>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/mips/tcg/mips16e_translate.c.inc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/mips/tcg/mips16e_translate.c.inc b/target/mips/tcg/mips16e_translate.c.inc
index a9af8f1e74..97da3456ea 100644
--- a/target/mips/tcg/mips16e_translate.c.inc
+++ b/target/mips/tcg/mips16e_translate.c.inc
@@ -306,7 +306,7 @@ static void gen_mips16_restore(DisasContext *ctx,
     int astatic;
     TCGv t0 = tcg_temp_new();
 
-    gen_op_addr_addi(ctx, t0, cpu_gpr[29], -framesize);
+    gen_op_addr_addi(ctx, t0, cpu_gpr[29], framesize);
 
     if (do_ra) {
         decr_and_load(ctx, 31, t0);
@@ -386,7 +386,7 @@ static void gen_mips16_restore(DisasContext *ctx,
         }
     }
 
-    gen_op_addr_addi(ctx, cpu_gpr[29], cpu_gpr[29], -framesize);
+    gen_op_addr_addi(ctx, cpu_gpr[29], cpu_gpr[29], framesize);
 }
 
 #if defined(TARGET_MIPS64)

From b939b8e42acedc2ff35534f96fae026f8fe2efcf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 17 Apr 2025 09:31:24 +0200
Subject: [PATCH 0322/2760] exec: Rename target_words_bigendian() ->
 target_big_endian()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In commit 98ed8ecfc9d ("exec: introduce target_words_bigendian()
helper") target_words_bigendian() was matching the definition it
was depending on (TARGET_WORDS_BIGENDIAN). Later in commit
ee3eb3a7ce7 ("Replace TARGET_WORDS_BIGENDIAN") the definition was
renamed as TARGET_BIG_ENDIAN but we didn't update the helper.
Do it now mechanically using:

  $ sed -i -e s/target_words_bigendian/target_big_endian/g \
        $(git grep -wl target_words_bigendian)

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20250417210025.68322-1-philmd@linaro.org>
---
 cpu-target.c             |  4 ++--
 hw/core/cpu-system.c     |  2 +-
 hw/display/vga.c         |  2 +-
 hw/virtio/virtio.c       |  2 +-
 include/exec/tswap.h     | 12 ++++++------
 system/memory-internal.h |  2 +-
 system/memory.c          |  4 ++--
 system/qtest.c           |  2 +-
 8 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/cpu-target.c b/cpu-target.c
index c99d208a7c..d68cbab5da 100644
--- a/cpu-target.c
+++ b/cpu-target.c
@@ -160,8 +160,8 @@ void cpu_abort(CPUState *cpu, const char *fmt, ...)
     abort();
 }
 
-#undef target_words_bigendian
-bool target_words_bigendian(void)
+#undef target_big_endian
+bool target_big_endian(void)
 {
     return TARGET_BIG_ENDIAN;
 }
diff --git a/hw/core/cpu-system.c b/hw/core/cpu-system.c
index 82b68b8927..3c84176a0c 100644
--- a/hw/core/cpu-system.c
+++ b/hw/core/cpu-system.c
@@ -133,7 +133,7 @@ bool cpu_virtio_is_big_endian(CPUState *cpu)
     if (cpu->cc->sysemu_ops->virtio_is_big_endian) {
         return cpu->cc->sysemu_ops->virtio_is_big_endian(cpu);
     }
-    return target_words_bigendian();
+    return target_big_endian();
 }
 
 GuestPanicInformation *cpu_get_crash_info(CPUState *cpu)
diff --git a/hw/display/vga.c b/hw/display/vga.c
index b01f67c65f..20475ebbd3 100644
--- a/hw/display/vga.c
+++ b/hw/display/vga.c
@@ -2264,7 +2264,7 @@ bool vga_common_init(VGACommonState *s, Object *obj, Error **errp)
      * into a device attribute set by the machine/platform to remove
      * all target endian dependencies from this file.
      */
-    s->default_endian_fb = target_words_bigendian();
+    s->default_endian_fb = target_big_endian();
     s->big_endian_fb = s->default_endian_fb;
 
     vga_dirty_log_start(s);
diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
index f0fa36f8ce..480c2e5036 100644
--- a/hw/virtio/virtio.c
+++ b/hw/virtio/virtio.c
@@ -2248,7 +2248,7 @@ int virtio_set_status(VirtIODevice *vdev, uint8_t val)
 
 static enum virtio_device_endian virtio_default_endian(void)
 {
-    if (target_words_bigendian()) {
+    if (target_big_endian()) {
         return VIRTIO_DEVICE_ENDIAN_BIG;
     } else {
         return VIRTIO_DEVICE_ENDIAN_LITTLE;
diff --git a/include/exec/tswap.h b/include/exec/tswap.h
index 84060a4999..49511f2611 100644
--- a/include/exec/tswap.h
+++ b/include/exec/tswap.h
@@ -11,15 +11,15 @@
 #include "qemu/bswap.h"
 
 /**
- * target_words_bigendian:
+ * target_big_endian:
  * Returns true if the (default) endianness of the target is big endian,
  * false otherwise. Common code should normally never need to know about the
  * endianness of the target, so please do *not* use this function unless you
  * know very well what you are doing!
  */
-bool target_words_bigendian(void);
+bool target_big_endian(void);
 #ifdef COMPILING_PER_TARGET
-#define target_words_bigendian()  TARGET_BIG_ENDIAN
+#define target_big_endian()   TARGET_BIG_ENDIAN
 #endif
 
 /*
@@ -29,7 +29,7 @@ bool target_words_bigendian(void);
 #ifdef COMPILING_PER_TARGET
 #define target_needs_bswap()  (HOST_BIG_ENDIAN != TARGET_BIG_ENDIAN)
 #else
-#define target_needs_bswap()  (HOST_BIG_ENDIAN != target_words_bigendian())
+#define target_needs_bswap()  (HOST_BIG_ENDIAN != target_big_endian())
 #endif /* COMPILING_PER_TARGET */
 
 static inline uint16_t tswap16(uint16_t s)
@@ -83,7 +83,7 @@ static inline void tswap64s(uint64_t *s)
 /* Return ld{word}_{le,be}_p following target endianness. */
 #define LOAD_IMPL(word, args...)                    \
 do {                                                \
-    if (target_words_bigendian()) {                 \
+    if (target_big_endian()) {                      \
         return glue(glue(ld, word), _be_p)(args);   \
     } else {                                        \
         return glue(glue(ld, word), _le_p)(args);   \
@@ -120,7 +120,7 @@ static inline uint64_t ldn_p(const void *ptr, int sz)
 /* Call st{word}_{le,be}_p following target endianness. */
 #define STORE_IMPL(word, args...)           \
 do {                                        \
-    if (target_words_bigendian()) {         \
+    if (target_big_endian()) {              \
         glue(glue(st, word), _be_p)(args);  \
     } else {                                \
         glue(glue(st, word), _le_p)(args);  \
diff --git a/system/memory-internal.h b/system/memory-internal.h
index 085e81a9fe..29717b3c58 100644
--- a/system/memory-internal.h
+++ b/system/memory-internal.h
@@ -45,7 +45,7 @@ static inline bool devend_big_endian(enum device_endian end)
                       DEVICE_HOST_ENDIAN != DEVICE_BIG_ENDIAN);
 
     if (end == DEVICE_NATIVE_ENDIAN) {
-        return target_words_bigendian();
+        return target_big_endian();
     }
     return end == DEVICE_BIG_ENDIAN;
 }
diff --git a/system/memory.c b/system/memory.c
index 7e2f16f4e9..67e433095b 100644
--- a/system/memory.c
+++ b/system/memory.c
@@ -2575,7 +2575,7 @@ void memory_region_add_eventfd(MemoryRegion *mr,
     unsigned i;
 
     if (size) {
-        MemOp mop = (target_words_bigendian() ? MO_BE : MO_LE) | size_memop(size);
+        MemOp mop = (target_big_endian() ? MO_BE : MO_LE) | size_memop(size);
         adjust_endianness(mr, &mrfd.data, mop);
     }
     memory_region_transaction_begin();
@@ -2611,7 +2611,7 @@ void memory_region_del_eventfd(MemoryRegion *mr,
     unsigned i;
 
     if (size) {
-        MemOp mop = (target_words_bigendian() ? MO_BE : MO_LE) | size_memop(size);
+        MemOp mop = (target_big_endian() ? MO_BE : MO_LE) | size_memop(size);
         adjust_endianness(mr, &mrfd.data, mop);
     }
     memory_region_transaction_begin();
diff --git a/system/qtest.c b/system/qtest.c
index ade3eb3221..301b03be2d 100644
--- a/system/qtest.c
+++ b/system/qtest.c
@@ -693,7 +693,7 @@ static void qtest_process_command(CharBackend *chr, gchar **words)
 
         qtest_send(chr, "OK\n");
     } else if (strcmp(words[0], "endianness") == 0) {
-        if (target_words_bigendian()) {
+        if (target_big_endian()) {
             qtest_sendf(chr, "OK big\n");
         } else {
             qtest_sendf(chr, "OK little\n");

From aca4967567aaa168ce51d54145ba970aafb135de Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <akihiko.odaki@daynix.com>
Date: Fri, 18 Apr 2025 14:51:48 +0900
Subject: [PATCH 0323/2760] hw/usb/hcd-xhci: Unmap canceled packet
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When the Stop Endpoint Command is received, packets running
asynchronously are canceled and then all packets are cleaned up. Packets
running asynchronously hold the DMA mapping so cleaning the packets leak
the mapping. Remove the mapping after canceling packets to fix the leak.

Fixes: 62c6ae04cf43 ("xhci: Initial xHCI implementation")
Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250418-xhc-v1-1-bb32dab6a67e@daynix.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/usb/hcd-xhci.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
index b3785b8ba6..292c378bfc 100644
--- a/hw/usb/hcd-xhci.c
+++ b/hw/usb/hcd-xhci.c
@@ -1187,6 +1187,12 @@ static void xhci_ep_free_xfer(XHCITransfer *xfer)
     g_free(xfer);
 }
 
+static void xhci_xfer_unmap(XHCITransfer *xfer)
+{
+    usb_packet_unmap(&xfer->packet, &xfer->sgl);
+    qemu_sglist_destroy(&xfer->sgl);
+}
+
 static int xhci_ep_nuke_one_xfer(XHCITransfer *t, TRBCCode report)
 {
     int killed = 0;
@@ -1198,6 +1204,7 @@ static int xhci_ep_nuke_one_xfer(XHCITransfer *t, TRBCCode report)
 
     if (t->running_async) {
         usb_cancel_packet(&t->packet);
+        xhci_xfer_unmap(t);
         t->running_async = 0;
         killed = 1;
     }
@@ -1480,12 +1487,6 @@ err:
     return -1;
 }
 
-static void xhci_xfer_unmap(XHCITransfer *xfer)
-{
-    usb_packet_unmap(&xfer->packet, &xfer->sgl);
-    qemu_sglist_destroy(&xfer->sgl);
-}
-
 static void xhci_xfer_report(XHCITransfer *xfer)
 {
     uint32_t edtla = 0;

From 8cd3b84c8aa8d22c130377ac65e2aac7151a8d27 Mon Sep 17 00:00:00 2001
From: BALATON Zoltan <balaton@eik.bme.hu>
Date: Wed, 23 Apr 2025 12:11:25 +0200
Subject: [PATCH 0324/2760] hw/intc/i8259: Remove unused DEBUG_PIC define
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The debug printfs were converted to traces so this define is now unused.

Fixes: 0880a87300 (i8259: convert DPRINTFs into trace)
Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Message-ID: <20250423101125.B243A55C592@zero.eik.bme.hu>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/intc/i8259.c | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/hw/intc/i8259.c b/hw/intc/i8259.c
index 2359dd8253..b6f96bf208 100644
--- a/hw/intc/i8259.c
+++ b/hw/intc/i8259.c
@@ -32,10 +32,7 @@
 #include "trace.h"
 #include "qom/object.h"
 
-/* debug PIC */
-//#define DEBUG_PIC
-
-//#define DEBUG_IRQ_LATENCY
+/*#define DEBUG_IRQ_LATENCY*/
 
 #define TYPE_I8259 "isa-i8259"
 typedef struct PICClass PICClass;

From 604ac1d87bd650db2c25adcac238577c6aeb5bee Mon Sep 17 00:00:00 2001
From: Kohei Tokunaga <ktokunaga.mail@gmail.com>
Date: Tue, 22 Apr 2025 14:27:05 +0900
Subject: [PATCH 0325/2760] hw/core/loader: Fix type conflict of GLib function
 pointers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

On Emscripten, function pointer casts can result in runtime failures due to
strict function signature checks. This affects the use of g_list_sort and
g_slist_sort, which internally perform function pointer casts that are not
supported by Emscripten. To avoid these issues, g_list_sort_with_data and
g_slist_sort_with_data should be used instead, as they do not rely on
function pointer casting.

Signed-off-by: Kohei Tokunaga <ktokunaga.mail@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <26dfe9191154ca65dca6ef51ce768ad2a0c30d5f.1745295397.git.ktokunaga.mail@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/core/loader.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/core/loader.c b/hw/core/loader.c
index a3aa62d132..b792a54bb0 100644
--- a/hw/core/loader.c
+++ b/hw/core/loader.c
@@ -1410,7 +1410,7 @@ typedef struct RomSec {
  * work, but this way saves a little work later by avoiding
  * dealing with "gaps" of 0 length.
  */
-static gint sort_secs(gconstpointer a, gconstpointer b)
+static gint sort_secs(gconstpointer a, gconstpointer b, gpointer d)
 {
     RomSec *ra = (RomSec *) a;
     RomSec *rb = (RomSec *) b;
@@ -1463,7 +1463,7 @@ RomGap rom_find_largest_gap_between(hwaddr base, size_t size)
     /* sentinel */
     secs = add_romsec_to_list(secs, base + size, 1);
 
-    secs = g_list_sort(secs, sort_secs);
+    secs = g_list_sort_with_data(secs, sort_secs, NULL);
 
     for (it = g_list_first(secs); it; it = g_list_next(it)) {
         cand = (RomSec *) it->data;

From ed1aef171671ef49761017cb1d8d10bf67d05c57 Mon Sep 17 00:00:00 2001
From: Sunny Zhu <sunnyzhyy@qq.com>
Date: Tue, 22 Apr 2025 02:21:26 +0800
Subject: [PATCH 0326/2760] block: Remove unused callback function
 *bdrv_aio_pdiscard
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The bytes type in *bdrv_aio_pdiscard should be int64_t rather than int.

There are no drivers implementing the *bdrv_aio_pdiscard() callback,
it appears to be an unused function. Therefore, we'll simply remove it
instead of fixing it.

Additionally, coroutine-based callbacks are preferred. If someone needs
to implement bdrv_aio_pdiscard, a coroutine-based version would be
straightforward to implement.

Signed-off-by: Sunny Zhu <sunnyzhyy@qq.com>
Message-ID: <tencent_7140D2E54157D98CF3D9E64B1A007A1A7906@qq.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/io.c                       | 20 ++------------------
 include/block/block_int-common.h |  4 ----
 2 files changed, 2 insertions(+), 22 deletions(-)

diff --git a/block/io.c b/block/io.c
index ccec11386b..6d98b0abb9 100644
--- a/block/io.c
+++ b/block/io.c
@@ -3102,7 +3102,7 @@ int coroutine_fn bdrv_co_pdiscard(BdrvChild *child, int64_t offset,
         return 0;
     }
 
-    if (!bs->drv->bdrv_co_pdiscard && !bs->drv->bdrv_aio_pdiscard) {
+    if (!bs->drv->bdrv_co_pdiscard) {
         return 0;
     }
 
@@ -3162,24 +3162,8 @@ int coroutine_fn bdrv_co_pdiscard(BdrvChild *child, int64_t offset,
             ret = -ENOMEDIUM;
             goto out;
         }
-        if (bs->drv->bdrv_co_pdiscard) {
-            ret = bs->drv->bdrv_co_pdiscard(bs, offset, num);
-        } else {
-            BlockAIOCB *acb;
-            CoroutineIOCompletion co = {
-                .coroutine = qemu_coroutine_self(),
-            };
 
-            acb = bs->drv->bdrv_aio_pdiscard(bs, offset, num,
-                                             bdrv_co_io_em_complete, &co);
-            if (acb == NULL) {
-                ret = -EIO;
-                goto out;
-            } else {
-                qemu_coroutine_yield();
-                ret = co.ret;
-            }
-        }
+        ret = bs->drv->bdrv_co_pdiscard(bs, offset, num);
         if (ret && ret != -ENOTSUP) {
             if (ret == -EINVAL && (offset % align != 0 || num % align != 0)) {
                 /* Silently skip rejected unaligned head/tail requests */
diff --git a/include/block/block_int-common.h b/include/block/block_int-common.h
index ebb4e56a50..0d8187f656 100644
--- a/include/block/block_int-common.h
+++ b/include/block/block_int-common.h
@@ -506,10 +506,6 @@ struct BlockDriver {
     BlockAIOCB * GRAPH_RDLOCK_PTR (*bdrv_aio_flush)(
         BlockDriverState *bs, BlockCompletionFunc *cb, void *opaque);
 
-    BlockAIOCB * GRAPH_RDLOCK_PTR (*bdrv_aio_pdiscard)(
-        BlockDriverState *bs, int64_t offset, int bytes,
-        BlockCompletionFunc *cb, void *opaque);
-
     int coroutine_fn GRAPH_RDLOCK_PTR (*bdrv_co_readv)(BlockDriverState *bs,
         int64_t sector_num, int nb_sectors, QEMUIOVector *qiov);
 

From 141af1b31b10764dcc03a5854ff767b692545e7c Mon Sep 17 00:00:00 2001
From: Kohei Tokunaga <ktokunaga.mail@gmail.com>
Date: Tue, 22 Apr 2025 14:27:11 +0900
Subject: [PATCH 0327/2760] hw/net/can: Fix type conflict of GLib function
 pointers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

On Emscripten, function pointer casts can result in runtime failures due to
strict function signature checks. This affects the use of g_list_sort and
g_slist_sort, which internally perform function pointer casts that are not
supported by Emscripten. To avoid these issues, g_list_sort_with_data and
g_slist_sort_with_data should be used instead, as they do not rely on
function pointer casting.

Signed-off-by: Kohei Tokunaga <ktokunaga.mail@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Acked-by: Francisco Iglesias <francisco.iglesias@amd.com>
Message-ID: <4d47a75c5768c9a6dc5d8b3504e78837577ad70d.1745295397.git.ktokunaga.mail@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/net/can/xlnx-versal-canfd.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/net/can/xlnx-versal-canfd.c b/hw/net/can/xlnx-versal-canfd.c
index 79ccc10098..3eb111949f 100644
--- a/hw/net/can/xlnx-versal-canfd.c
+++ b/hw/net/can/xlnx-versal-canfd.c
@@ -1278,7 +1278,7 @@ static void tx_fifo_stamp(XlnxVersalCANFDState *s, uint32_t tb0_regid)
     }
 }
 
-static gint g_cmp_ids(gconstpointer data1, gconstpointer data2)
+static gint g_cmp_ids(gconstpointer data1, gconstpointer data2, gpointer d)
 {
     tx_ready_reg_info *tx_reg_1 = (tx_ready_reg_info *) data1;
     tx_ready_reg_info *tx_reg_2 = (tx_ready_reg_info *) data2;
@@ -1316,7 +1316,7 @@ static GSList *prepare_tx_data(XlnxVersalCANFDState *s)
             temp->can_id = s->regs[reg_num];
             temp->reg_num = reg_num;
             list = g_slist_prepend(list, temp);
-            list = g_slist_sort(list, g_cmp_ids);
+            list = g_slist_sort_with_data(list, g_cmp_ids, NULL);
         }
 
         reg_ready >>= 1;

From 01499add2ae6529589002860e1880ff193a6578a Mon Sep 17 00:00:00 2001
From: Kohei Tokunaga <ktokunaga.mail@gmail.com>
Date: Tue, 22 Apr 2025 14:27:10 +0900
Subject: [PATCH 0328/2760] contrib/plugins: Fix type conflict of GLib function
 pointers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

On Emscripten, function pointer casts can result in runtime failures due to
strict function signature checks. This affects the use of g_list_sort and
g_slist_sort, which internally perform function pointer casts that are not
supported by Emscripten. To avoid these issues, g_list_sort_with_data and
g_slist_sort_with_data should be used instead, as they do not rely on
function pointer casting.

Signed-off-by: Kohei Tokunaga <ktokunaga.mail@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <0fcddfca16ca8da2bdaa7b2c114476f5b73d032b.1745295397.git.ktokunaga.mail@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 contrib/plugins/cache.c     | 12 ++++++------
 contrib/plugins/cflow.c     | 10 +++++-----
 contrib/plugins/hotblocks.c |  4 ++--
 contrib/plugins/hotpages.c  |  4 ++--
 contrib/plugins/howvec.c    |  4 ++--
 contrib/plugins/hwprofile.c |  8 ++++----
 tests/tcg/plugins/mem.c     |  4 ++--
 tests/tcg/plugins/syscall.c |  4 ++--
 8 files changed, 25 insertions(+), 25 deletions(-)

diff --git a/contrib/plugins/cache.c b/contrib/plugins/cache.c
index 7cfd3df249..56508587d3 100644
--- a/contrib/plugins/cache.c
+++ b/contrib/plugins/cache.c
@@ -576,7 +576,7 @@ static void sum_stats(void)
     }
 }
 
-static int dcmp(gconstpointer a, gconstpointer b)
+static int dcmp(gconstpointer a, gconstpointer b, gpointer d)
 {
     InsnData *insn_a = (InsnData *) a;
     InsnData *insn_b = (InsnData *) b;
@@ -584,7 +584,7 @@ static int dcmp(gconstpointer a, gconstpointer b)
     return insn_a->l1_dmisses < insn_b->l1_dmisses ? 1 : -1;
 }
 
-static int icmp(gconstpointer a, gconstpointer b)
+static int icmp(gconstpointer a, gconstpointer b, gpointer d)
 {
     InsnData *insn_a = (InsnData *) a;
     InsnData *insn_b = (InsnData *) b;
@@ -592,7 +592,7 @@ static int icmp(gconstpointer a, gconstpointer b)
     return insn_a->l1_imisses < insn_b->l1_imisses ? 1 : -1;
 }
 
-static int l2_cmp(gconstpointer a, gconstpointer b)
+static int l2_cmp(gconstpointer a, gconstpointer b, gpointer d)
 {
     InsnData *insn_a = (InsnData *) a;
     InsnData *insn_b = (InsnData *) b;
@@ -645,7 +645,7 @@ static void log_top_insns(void)
     InsnData *insn;
 
     miss_insns = g_hash_table_get_values(miss_ht);
-    miss_insns = g_list_sort(miss_insns, dcmp);
+    miss_insns = g_list_sort_with_data(miss_insns, dcmp, NULL);
     g_autoptr(GString) rep = g_string_new("");
     g_string_append_printf(rep, "%s", "address, data misses, instruction\n");
 
@@ -659,7 +659,7 @@ static void log_top_insns(void)
                                insn->l1_dmisses, insn->disas_str);
     }
 
-    miss_insns = g_list_sort(miss_insns, icmp);
+    miss_insns = g_list_sort_with_data(miss_insns, icmp, NULL);
     g_string_append_printf(rep, "%s", "\naddress, fetch misses, instruction\n");
 
     for (curr = miss_insns, i = 0; curr && i < limit; i++, curr = curr->next) {
@@ -676,7 +676,7 @@ static void log_top_insns(void)
         goto finish;
     }
 
-    miss_insns = g_list_sort(miss_insns, l2_cmp);
+    miss_insns = g_list_sort_with_data(miss_insns, l2_cmp, NULL);
     g_string_append_printf(rep, "%s", "\naddress, L2 misses, instruction\n");
 
     for (curr = miss_insns, i = 0; curr && i < limit; i++, curr = curr->next) {
diff --git a/contrib/plugins/cflow.c b/contrib/plugins/cflow.c
index 930ecb46fc..b5e33f25f9 100644
--- a/contrib/plugins/cflow.c
+++ b/contrib/plugins/cflow.c
@@ -98,7 +98,7 @@ static GHashTable *nodes;
 struct qemu_plugin_scoreboard *state;
 
 /* SORT_HOTTEST */
-static gint hottest(gconstpointer a, gconstpointer b)
+static gint hottest(gconstpointer a, gconstpointer b, gpointer d)
 {
     NodeData *na = (NodeData *) a;
     NodeData *nb = (NodeData *) b;
@@ -107,7 +107,7 @@ static gint hottest(gconstpointer a, gconstpointer b)
         na->dest_count == nb->dest_count ? 0 : 1;
 }
 
-static gint exception(gconstpointer a, gconstpointer b)
+static gint exception(gconstpointer a, gconstpointer b, gpointer d)
 {
     NodeData *na = (NodeData *) a;
     NodeData *nb = (NodeData *) b;
@@ -116,7 +116,7 @@ static gint exception(gconstpointer a, gconstpointer b)
         na->early_exit == nb->early_exit ? 0 : 1;
 }
 
-static gint popular(gconstpointer a, gconstpointer b)
+static gint popular(gconstpointer a, gconstpointer b, gpointer d)
 {
     NodeData *na = (NodeData *) a;
     NodeData *nb = (NodeData *) b;
@@ -138,7 +138,7 @@ static void plugin_exit(qemu_plugin_id_t id, void *p)
 {
     g_autoptr(GString) result = g_string_new("collected ");
     GList *data;
-    GCompareFunc sort = &hottest;
+    GCompareDataFunc sort = &hottest;
     int i = 0;
 
     g_mutex_lock(&node_lock);
@@ -162,7 +162,7 @@ static void plugin_exit(qemu_plugin_id_t id, void *p)
         break;
     }
 
-    data = g_list_sort(data, sort);
+    data = g_list_sort_with_data(data, sort, NULL);
 
     for (GList *l = data;
          l != NULL && i < topn;
diff --git a/contrib/plugins/hotblocks.c b/contrib/plugins/hotblocks.c
index f12bfb7a26..98404b6885 100644
--- a/contrib/plugins/hotblocks.c
+++ b/contrib/plugins/hotblocks.c
@@ -39,7 +39,7 @@ typedef struct {
     unsigned long insns;
 } ExecCount;
 
-static gint cmp_exec_count(gconstpointer a, gconstpointer b)
+static gint cmp_exec_count(gconstpointer a, gconstpointer b, gpointer d)
 {
     ExecCount *ea = (ExecCount *) a;
     ExecCount *eb = (ExecCount *) b;
@@ -79,7 +79,7 @@ static void plugin_exit(qemu_plugin_id_t id, void *p)
     g_string_append_printf(report, "%d entries in the hash table\n",
                            g_hash_table_size(hotblocks));
     counts = g_hash_table_get_values(hotblocks);
-    it = g_list_sort(counts, cmp_exec_count);
+    it = g_list_sort_with_data(counts, cmp_exec_count, NULL);
 
     if (it) {
         g_string_append_printf(report, "pc, tcount, icount, ecount\n");
diff --git a/contrib/plugins/hotpages.c b/contrib/plugins/hotpages.c
index c6e6493719..9d48ac969e 100644
--- a/contrib/plugins/hotpages.c
+++ b/contrib/plugins/hotpages.c
@@ -48,7 +48,7 @@ typedef struct {
 static GMutex lock;
 static GHashTable *pages;
 
-static gint cmp_access_count(gconstpointer a, gconstpointer b)
+static gint cmp_access_count(gconstpointer a, gconstpointer b, gpointer d)
 {
     PageCounters *ea = (PageCounters *) a;
     PageCounters *eb = (PageCounters *) b;
@@ -83,7 +83,7 @@ static void plugin_exit(qemu_plugin_id_t id, void *p)
     if (counts && g_list_next(counts)) {
         GList *it;
 
-        it = g_list_sort(counts, cmp_access_count);
+        it = g_list_sort_with_data(counts, cmp_access_count, NULL);
 
         for (i = 0; i < limit && it->next; i++, it = it->next) {
             PageCounters *rec = (PageCounters *) it->data;
diff --git a/contrib/plugins/howvec.c b/contrib/plugins/howvec.c
index 2aa9029c3f..42bddb6566 100644
--- a/contrib/plugins/howvec.c
+++ b/contrib/plugins/howvec.c
@@ -155,7 +155,7 @@ static ClassSelector class_tables[] = {
 static InsnClassExecCount *class_table;
 static int class_table_sz;
 
-static gint cmp_exec_count(gconstpointer a, gconstpointer b)
+static gint cmp_exec_count(gconstpointer a, gconstpointer b, gpointer d)
 {
     InsnExecCount *ea = (InsnExecCount *) a;
     InsnExecCount *eb = (InsnExecCount *) b;
@@ -208,7 +208,7 @@ static void plugin_exit(qemu_plugin_id_t id, void *p)
     counts = g_hash_table_get_values(insns);
     if (counts && g_list_next(counts)) {
         g_string_append_printf(report, "Individual Instructions:\n");
-        counts = g_list_sort(counts, cmp_exec_count);
+        counts = g_list_sort_with_data(counts, cmp_exec_count, NULL);
 
         for (i = 0; i < limit && g_list_next(counts);
              i++, counts = g_list_next(counts)) {
diff --git a/contrib/plugins/hwprofile.c b/contrib/plugins/hwprofile.c
index 2a4cbc47d4..a9838ccc87 100644
--- a/contrib/plugins/hwprofile.c
+++ b/contrib/plugins/hwprofile.c
@@ -71,7 +71,7 @@ static void plugin_init(void)
     devices = g_hash_table_new(NULL, NULL);
 }
 
-static gint sort_cmp(gconstpointer a, gconstpointer b)
+static gint sort_cmp(gconstpointer a, gconstpointer b, gpointer d)
 {
     DeviceCounts *ea = (DeviceCounts *) a;
     DeviceCounts *eb = (DeviceCounts *) b;
@@ -79,7 +79,7 @@ static gint sort_cmp(gconstpointer a, gconstpointer b)
            eb->totals.reads + eb->totals.writes ? -1 : 1;
 }
 
-static gint sort_loc(gconstpointer a, gconstpointer b)
+static gint sort_loc(gconstpointer a, gconstpointer b, gpointer d)
 {
     IOLocationCounts *ea = (IOLocationCounts *) a;
     IOLocationCounts *eb = (IOLocationCounts *) b;
@@ -126,13 +126,13 @@ static void plugin_exit(qemu_plugin_id_t id, void *p)
     if (counts && g_list_next(counts)) {
         GList *it;
 
-        it = g_list_sort(counts, sort_cmp);
+        it = g_list_sort_with_data(counts, sort_cmp, NULL);
 
         while (it) {
             DeviceCounts *rec = (DeviceCounts *) it->data;
             if (rec->detail) {
                 GList *accesses = g_hash_table_get_values(rec->detail);
-                GList *io_it = g_list_sort(accesses, sort_loc);
+                GList *io_it = g_list_sort_with_data(accesses, sort_loc, NULL);
                 const char *prefix = pattern ? "off" : "pc";
                 g_string_append_printf(report, "%s @ 0x%"PRIx64"\n",
                                        rec->name, rec->base);
diff --git a/tests/tcg/plugins/mem.c b/tests/tcg/plugins/mem.c
index d87d6628e0..ca4e8883dd 100644
--- a/tests/tcg/plugins/mem.c
+++ b/tests/tcg/plugins/mem.c
@@ -67,7 +67,7 @@ static enum qemu_plugin_mem_rw rw = QEMU_PLUGIN_MEM_RW;
 static GMutex lock;
 static GHashTable *regions;
 
-static gint addr_order(gconstpointer a, gconstpointer b)
+static gint addr_order(gconstpointer a, gconstpointer b, gpointer d)
 {
     RegionInfo *na = (RegionInfo *) a;
     RegionInfo *nb = (RegionInfo *) b;
@@ -94,7 +94,7 @@ static void plugin_exit(qemu_plugin_id_t id, void *p)
     if (do_region_summary) {
         GList *counts = g_hash_table_get_values(regions);
 
-        counts = g_list_sort(counts, addr_order);
+        counts = g_list_sort_with_data(counts, addr_order, NULL);
 
         g_string_printf(out, "Region Base, Reads, Writes, Seen all\n");
 
diff --git a/tests/tcg/plugins/syscall.c b/tests/tcg/plugins/syscall.c
index 47aad55fc1..42801f5c86 100644
--- a/tests/tcg/plugins/syscall.c
+++ b/tests/tcg/plugins/syscall.c
@@ -180,7 +180,7 @@ static void print_entry(gpointer val, gpointer user_data)
     qemu_plugin_outs(out);
 }
 
-static gint comp_func(gconstpointer ea, gconstpointer eb)
+static gint comp_func(gconstpointer ea, gconstpointer eb, gpointer d)
 {
     SyscallStats *ent_a = (SyscallStats *) ea;
     SyscallStats *ent_b = (SyscallStats *) eb;
@@ -197,7 +197,7 @@ static void plugin_exit(qemu_plugin_id_t id, void *p)
 
     g_mutex_lock(&lock);
     GList *entries = g_hash_table_get_values(statistics);
-    entries = g_list_sort(entries, comp_func);
+    entries = g_list_sort_with_data(entries, comp_func, NULL);
     qemu_plugin_outs("syscall no.  calls  errors\n");
 
     g_list_foreach(entries, print_entry, NULL);

From 16704598bf3fa8578880e7146a0196d9411ea098 Mon Sep 17 00:00:00 2001
From: Kohei Tokunaga <ktokunaga.mail@gmail.com>
Date: Tue, 22 Apr 2025 14:27:07 +0900
Subject: [PATCH 0329/2760] system/vl: Fix type conflict of GLib function
 pointers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

On Emscripten, function pointer casts can result in runtime failures due to
strict function signature checks. This affects the use of g_list_sort and
g_slist_sort, which internally perform function pointer casts that are not
supported by Emscripten. To avoid these issues, g_list_sort_with_data and
g_slist_sort_with_data should be used instead, as they do not rely on
function pointer casting.

Signed-off-by: Kohei Tokunaga <ktokunaga.mail@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <e9a50b76c54cc64fc9985186f0aef3fcc2024da6.1745295397.git.ktokunaga.mail@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 system/vl.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/system/vl.c b/system/vl.c
index c17945c493..4ab2001df7 100644
--- a/system/vl.c
+++ b/system/vl.c
@@ -1524,7 +1524,7 @@ static bool debugcon_parse(const char *devname, Error **errp)
     return true;
 }
 
-static gint machine_class_cmp(gconstpointer a, gconstpointer b)
+static gint machine_class_cmp(gconstpointer a, gconstpointer b, gpointer d)
 {
     const MachineClass *mc1 = a, *mc2 = b;
     int res;
@@ -1574,7 +1574,7 @@ static void machine_help_func(const QDict *qdict)
     }
 
     printf("Supported machines are:\n");
-    machines = g_slist_sort(machines, machine_class_cmp);
+    machines = g_slist_sort_with_data(machines, machine_class_cmp, NULL);
     for (el = machines; el; el = el->next) {
         MachineClass *mc = el->data;
         if (mc->alias) {

From 8af0e52b28c553c901e7c564c3380cd56d363053 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 23 Apr 2025 13:11:31 +0200
Subject: [PATCH 0330/2760] system/memory: Remove DEVICE_HOST_ENDIAN definition
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since the previous commit ("exec/memory.h: make devend_memop
"target defines" agnostic") there is a single use of the
DEVICE_HOST_ENDIAN definition in ram_device_mem_ops: inline
it and remove its definition altogether.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250423111625.10424-1-philmd@linaro.org>
---
 include/exec/cpu-common.h | 6 ------
 system/memory-internal.h  | 3 ---
 system/memory.c           | 2 +-
 3 files changed, 1 insertion(+), 10 deletions(-)

diff --git a/include/exec/cpu-common.h b/include/exec/cpu-common.h
index 9b83fd7ac8..dab1e7e580 100644
--- a/include/exec/cpu-common.h
+++ b/include/exec/cpu-common.h
@@ -44,12 +44,6 @@ enum device_endian {
     DEVICE_LITTLE_ENDIAN,
 };
 
-#if HOST_BIG_ENDIAN
-#define DEVICE_HOST_ENDIAN DEVICE_BIG_ENDIAN
-#else
-#define DEVICE_HOST_ENDIAN DEVICE_LITTLE_ENDIAN
-#endif
-
 /* address in the RAM (different from a physical address) */
 #if defined(CONFIG_XEN_BACKEND)
 typedef uint64_t ram_addr_t;
diff --git a/system/memory-internal.h b/system/memory-internal.h
index 29717b3c58..46f758fa7e 100644
--- a/system/memory-internal.h
+++ b/system/memory-internal.h
@@ -41,9 +41,6 @@ void mtree_print_dispatch(struct AddressSpaceDispatch *d,
 /* returns true if end is big endian. */
 static inline bool devend_big_endian(enum device_endian end)
 {
-    QEMU_BUILD_BUG_ON(DEVICE_HOST_ENDIAN != DEVICE_LITTLE_ENDIAN &&
-                      DEVICE_HOST_ENDIAN != DEVICE_BIG_ENDIAN);
-
     if (end == DEVICE_NATIVE_ENDIAN) {
         return target_big_endian();
     }
diff --git a/system/memory.c b/system/memory.c
index 67e433095b..71434e7ad0 100644
--- a/system/memory.c
+++ b/system/memory.c
@@ -1382,7 +1382,7 @@ static void memory_region_ram_device_write(void *opaque, hwaddr addr,
 static const MemoryRegionOps ram_device_mem_ops = {
     .read = memory_region_ram_device_read,
     .write = memory_region_ram_device_write,
-    .endianness = DEVICE_HOST_ENDIAN,
+    .endianness = HOST_BIG_ENDIAN ? DEVICE_BIG_ENDIAN : DEVICE_LITTLE_ENDIAN,
     .valid = {
         .min_access_size = 1,
         .max_access_size = 8,

From fcb1ad456c58ba2304127b0131ac0b48895b2a3b Mon Sep 17 00:00:00 2001
From: BALATON Zoltan <balaton@eik.bme.hu>
Date: Wed, 23 Apr 2025 12:02:20 +0200
Subject: [PATCH 0331/2760] system/datadir: Add new type constant for DTB files
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Currently DTB files are mixed with ROMs under BIOS type. Separate them
under a new type constant and turn defines into an enum while at it.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <ae793d1f81e3577605759c43871722324a1ef2cb.1745402140.git.balaton@eik.bme.hu>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/microblaze/boot.c   |  2 +-
 hw/ppc/ppc440_bamboo.c |  2 +-
 hw/ppc/sam460ex.c      |  2 +-
 hw/ppc/virtex_ml507.c  |  2 +-
 include/qemu/datadir.h | 11 ++++++++---
 system/datadir.c       |  3 ++-
 6 files changed, 14 insertions(+), 8 deletions(-)

diff --git a/hw/microblaze/boot.c b/hw/microblaze/boot.c
index 60b4ef0abe..4a9c9df318 100644
--- a/hw/microblaze/boot.c
+++ b/hw/microblaze/boot.c
@@ -130,7 +130,7 @@ void microblaze_load_kernel(MicroBlazeCPU *cpu, bool is_little_endian,
     dtb_arg = current_machine->dtb;
     /* default to pcbios dtb as passed by machine_init */
     if (!dtb_arg && dtb_filename) {
-        filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, dtb_filename);
+        filename = qemu_find_file(QEMU_FILE_TYPE_DTB, dtb_filename);
     }
 
     boot_info.machine_cpu_reset = machine_cpu_reset;
diff --git a/hw/ppc/ppc440_bamboo.c b/hw/ppc/ppc440_bamboo.c
index 099fda3909..6fff0d8afb 100644
--- a/hw/ppc/ppc440_bamboo.c
+++ b/hw/ppc/ppc440_bamboo.c
@@ -64,7 +64,7 @@ static int bamboo_load_device_tree(MachineState *machine,
     uint32_t tb_freq = 400000000;
     uint32_t clock_freq = 400000000;
 
-    filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, BINARY_DEVICE_TREE_FILE);
+    filename = qemu_find_file(QEMU_FILE_TYPE_DTB, BINARY_DEVICE_TREE_FILE);
     if (!filename) {
         return -1;
     }
diff --git a/hw/ppc/sam460ex.c b/hw/ppc/sam460ex.c
index a070de23cf..ee31bd8f34 100644
--- a/hw/ppc/sam460ex.c
+++ b/hw/ppc/sam460ex.c
@@ -142,7 +142,7 @@ static int sam460ex_load_device_tree(MachineState *machine,
     uint32_t clock_freq = CPU_FREQ;
     int offset;
 
-    filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, BINARY_DEVICE_TREE_FILE);
+    filename = qemu_find_file(QEMU_FILE_TYPE_DTB, BINARY_DEVICE_TREE_FILE);
     if (!filename) {
         error_report("Couldn't find dtb file `%s'", BINARY_DEVICE_TREE_FILE);
         exit(1);
diff --git a/hw/ppc/virtex_ml507.c b/hw/ppc/virtex_ml507.c
index 17115be74d..c9969ae48a 100644
--- a/hw/ppc/virtex_ml507.c
+++ b/hw/ppc/virtex_ml507.c
@@ -146,7 +146,7 @@ static int xilinx_load_device_tree(MachineState *machine,
         /* Try the local "ppc.dtb" override.  */
         fdt = load_device_tree("ppc.dtb", &fdt_size);
         if (!fdt) {
-            path = qemu_find_file(QEMU_FILE_TYPE_BIOS, BINARY_DEVICE_TREE_FILE);
+            path = qemu_find_file(QEMU_FILE_TYPE_DTB, BINARY_DEVICE_TREE_FILE);
             if (path) {
                 fdt = load_device_tree(path, &fdt_size);
                 g_free(path);
diff --git a/include/qemu/datadir.h b/include/qemu/datadir.h
index 21f9097f58..cca32af300 100644
--- a/include/qemu/datadir.h
+++ b/include/qemu/datadir.h
@@ -1,11 +1,16 @@
 #ifndef QEMU_DATADIR_H
 #define QEMU_DATADIR_H
 
-#define QEMU_FILE_TYPE_BIOS   0
-#define QEMU_FILE_TYPE_KEYMAP 1
+typedef enum {
+    QEMU_FILE_TYPE_BIOS,
+    QEMU_FILE_TYPE_DTB,
+    QEMU_FILE_TYPE_KEYMAP,
+} QemuFileType;
+
 /**
  * qemu_find_file:
  * @type: QEMU_FILE_TYPE_BIOS (for BIOS, VGA BIOS)
+ *        QEMU_FILE_TYPE_DTB (for device tree blobs)
  *        or QEMU_FILE_TYPE_KEYMAP (for keymaps).
  * @name: Relative or absolute file name
  *
@@ -20,7 +25,7 @@
  *
  * Returns: a path that can access @name, or NULL if no matching file exists.
  */
-char *qemu_find_file(int type, const char *name);
+char *qemu_find_file(QemuFileType type, const char *name);
 void qemu_add_default_firmwarepath(void);
 void qemu_add_data_dir(char *path);
 void qemu_list_data_dirs(void);
diff --git a/system/datadir.c b/system/datadir.c
index c9237cb5d4..e450b84ce9 100644
--- a/system/datadir.c
+++ b/system/datadir.c
@@ -30,7 +30,7 @@
 static const char *data_dir[16];
 static int data_dir_idx;
 
-char *qemu_find_file(int type, const char *name)
+char *qemu_find_file(QemuFileType type, const char *name)
 {
     int i;
     const char *subdir;
@@ -44,6 +44,7 @@ char *qemu_find_file(int type, const char *name)
 
     switch (type) {
     case QEMU_FILE_TYPE_BIOS:
+    case QEMU_FILE_TYPE_DTB:
         subdir = "";
         break;
     case QEMU_FILE_TYPE_KEYMAP:

From 12963e79ca461db7b098c8eb00bb21cf88a250a4 Mon Sep 17 00:00:00 2001
From: BALATON Zoltan <balaton@eik.bme.hu>
Date: Wed, 23 Apr 2025 12:02:21 +0200
Subject: [PATCH 0332/2760] pc-bios: Move device tree files in their own subdir
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We have several device tree files already and may have more in the
future so add a new dtb subdirectory and move device tree files there
so they are not mixed with ROM binaries.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <57f179bd3904c1f2ca062ca4d4ff9592bb4f4daa.1745402140.git.balaton@eik.bme.hu>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 MAINTAINERS                                |   2 +-
 pc-bios/{ => dtb}/bamboo.dtb               | Bin
 pc-bios/{ => dtb}/bamboo.dts               |   0
 pc-bios/{ => dtb}/canyonlands.dtb          | Bin
 pc-bios/{ => dtb}/canyonlands.dts          |   0
 pc-bios/dtb/meson.build                    |  23 +++++++++++++++++++++
 pc-bios/{ => dtb}/petalogix-ml605.dtb      | Bin
 pc-bios/{ => dtb}/petalogix-ml605.dts      |   0
 pc-bios/{ => dtb}/petalogix-s3adsp1800.dtb | Bin
 pc-bios/{ => dtb}/petalogix-s3adsp1800.dts |   0
 pc-bios/meson.build                        |  23 +--------------------
 qemu.nsi                                   |   2 +-
 system/datadir.c                           |   4 +++-
 13 files changed, 29 insertions(+), 25 deletions(-)
 rename pc-bios/{ => dtb}/bamboo.dtb (100%)
 rename pc-bios/{ => dtb}/bamboo.dts (100%)
 rename pc-bios/{ => dtb}/canyonlands.dtb (100%)
 rename pc-bios/{ => dtb}/canyonlands.dts (100%)
 create mode 100644 pc-bios/dtb/meson.build
 rename pc-bios/{ => dtb}/petalogix-ml605.dtb (100%)
 rename pc-bios/{ => dtb}/petalogix-ml605.dts (100%)
 rename pc-bios/{ => dtb}/petalogix-s3adsp1800.dtb (100%)
 rename pc-bios/{ => dtb}/petalogix-s3adsp1800.dts (100%)

diff --git a/MAINTAINERS b/MAINTAINERS
index 661a47db5a..d82d962f1a 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1581,7 +1581,7 @@ F: hw/pci-host/ppc440_pcix.c
 F: hw/display/sm501*
 F: hw/ide/sii3112.c
 F: hw/rtc/m41t80.c
-F: pc-bios/canyonlands.dt[sb]
+F: pc-bios/dtb/canyonlands.dt[sb]
 F: pc-bios/u-boot-sam460ex-20100605.bin
 F: roms/u-boot-sam460ex
 F: docs/system/ppc/amigang.rst
diff --git a/pc-bios/bamboo.dtb b/pc-bios/dtb/bamboo.dtb
similarity index 100%
rename from pc-bios/bamboo.dtb
rename to pc-bios/dtb/bamboo.dtb
diff --git a/pc-bios/bamboo.dts b/pc-bios/dtb/bamboo.dts
similarity index 100%
rename from pc-bios/bamboo.dts
rename to pc-bios/dtb/bamboo.dts
diff --git a/pc-bios/canyonlands.dtb b/pc-bios/dtb/canyonlands.dtb
similarity index 100%
rename from pc-bios/canyonlands.dtb
rename to pc-bios/dtb/canyonlands.dtb
diff --git a/pc-bios/canyonlands.dts b/pc-bios/dtb/canyonlands.dts
similarity index 100%
rename from pc-bios/canyonlands.dts
rename to pc-bios/dtb/canyonlands.dts
diff --git a/pc-bios/dtb/meson.build b/pc-bios/dtb/meson.build
new file mode 100644
index 0000000000..7a71835bca
--- /dev/null
+++ b/pc-bios/dtb/meson.build
@@ -0,0 +1,23 @@
+dtbs = [
+  'bamboo.dtb',
+  'canyonlands.dtb',
+  'petalogix-ml605.dtb',
+  'petalogix-s3adsp1800.dtb',
+]
+
+dtc = find_program('dtc', required: false)
+if dtc.found()
+  foreach out : dtbs
+    f = fs.replace_suffix(out, '.dts')
+    custom_target(f,
+        build_by_default: have_system,
+        input: files(f),
+        output: out,
+        install: get_option('install_blobs'),
+        install_dir: qemu_datadir / 'dtb',
+        command: [ dtc, '-q', '-I', 'dts', '-O', 'dtb',
+                        '-o', '@OUTPUT@', '@INPUT0@' ])
+  endforeach
+else
+    install_data(dtbs, install_dir: qemu_datadir / 'dtb')
+endif
diff --git a/pc-bios/petalogix-ml605.dtb b/pc-bios/dtb/petalogix-ml605.dtb
similarity index 100%
rename from pc-bios/petalogix-ml605.dtb
rename to pc-bios/dtb/petalogix-ml605.dtb
diff --git a/pc-bios/petalogix-ml605.dts b/pc-bios/dtb/petalogix-ml605.dts
similarity index 100%
rename from pc-bios/petalogix-ml605.dts
rename to pc-bios/dtb/petalogix-ml605.dts
diff --git a/pc-bios/petalogix-s3adsp1800.dtb b/pc-bios/dtb/petalogix-s3adsp1800.dtb
similarity index 100%
rename from pc-bios/petalogix-s3adsp1800.dtb
rename to pc-bios/dtb/petalogix-s3adsp1800.dtb
diff --git a/pc-bios/petalogix-s3adsp1800.dts b/pc-bios/dtb/petalogix-s3adsp1800.dts
similarity index 100%
rename from pc-bios/petalogix-s3adsp1800.dts
rename to pc-bios/dtb/petalogix-s3adsp1800.dts
diff --git a/pc-bios/meson.build b/pc-bios/meson.build
index 34d6616c32..34d8cc4f33 100644
--- a/pc-bios/meson.build
+++ b/pc-bios/meson.build
@@ -86,31 +86,10 @@ blobs = [
   'vof-nvram.bin',
 ]
 
-dtc = find_program('dtc', required: false)
-foreach f : [
-  'bamboo.dts',
-  'canyonlands.dts',
-  'petalogix-s3adsp1800.dts',
-  'petalogix-ml605.dts',
-]
-  out = fs.replace_suffix(f, '.dtb')
-  if dtc.found()
-    custom_target(f,
-        build_by_default: have_system,
-        input: files(f),
-        output: out,
-        install: get_option('install_blobs'),
-        install_dir: qemu_datadir,
-        command: [ dtc, '-q', '-I', 'dts', '-O', 'dtb',
-                        '-o', '@OUTPUT@', '@INPUT0@' ])
-  else
-    blobs += out
-  endif
-endforeach
-
 if get_option('install_blobs')
   install_data(blobs, install_dir: qemu_datadir)
 endif
 
 subdir('descriptors')
+subdir('dtb')
 subdir('keymaps')
diff --git a/qemu.nsi b/qemu.nsi
index b186f223e1..d419986ca0 100644
--- a/qemu.nsi
+++ b/qemu.nsi
@@ -204,7 +204,6 @@ Section "Uninstall"
     Delete "$INSTDIR\*.bmp"
     Delete "$INSTDIR\*.bin"
     Delete "$INSTDIR\*.dll"
-    Delete "$INSTDIR\*.dtb"
     Delete "$INSTDIR\*.fd"
     Delete "$INSTDIR\*.img"
     Delete "$INSTDIR\*.lid"
@@ -215,6 +214,7 @@ Section "Uninstall"
     Delete "$INSTDIR\qemu-io.exe"
     Delete "$INSTDIR\qemu.exe"
     Delete "$INSTDIR\qemu-system-*.exe"
+    RMDir /r "$INSTDIR\dtb"
     RMDir /r "$INSTDIR\doc"
     RMDir /r "$INSTDIR\share"
     ; Remove generated files
diff --git a/system/datadir.c b/system/datadir.c
index e450b84ce9..f96f8fc264 100644
--- a/system/datadir.c
+++ b/system/datadir.c
@@ -44,9 +44,11 @@ char *qemu_find_file(QemuFileType type, const char *name)
 
     switch (type) {
     case QEMU_FILE_TYPE_BIOS:
-    case QEMU_FILE_TYPE_DTB:
         subdir = "";
         break;
+    case QEMU_FILE_TYPE_DTB:
+        subdir = "dtb/";
+        break;
     case QEMU_FILE_TYPE_KEYMAP:
         subdir = "keymaps/";
         break;

From 563cd698dffb977eea0ccfef3b95f6f9786766f3 Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <akihiko.odaki@daynix.com>
Date: Thu, 24 Apr 2025 13:50:11 +0900
Subject: [PATCH 0333/2760] meson: Use has_header_symbol() to check getcpu()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The use of gnu_source_prefix in the detection of getcpu() was
ineffective because the header file that declares getcpu() when
_GNU_SOURCE is defined was not included. Pass sched.h to
has_header_symbol() so that the existence of the declaration will be
properly checked.

Cc: qemu-stable@nongnu.org
Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250424-buildsys-v1-1-97655e3b25d7@daynix.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 meson.build | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/meson.build b/meson.build
index bcb9d39a38..f77a9ce569 100644
--- a/meson.build
+++ b/meson.build
@@ -2635,7 +2635,6 @@ config_host_data.set('CONFIG_CLOCK_ADJTIME', cc.has_function('clock_adjtime'))
 config_host_data.set('CONFIG_DUP3', cc.has_function('dup3'))
 config_host_data.set('CONFIG_FALLOCATE', cc.has_function('fallocate'))
 config_host_data.set('CONFIG_POSIX_FALLOCATE', cc.has_function('posix_fallocate'))
-config_host_data.set('CONFIG_GETCPU', cc.has_function('getcpu', prefix: gnu_source_prefix))
 config_host_data.set('CONFIG_SCHED_GETCPU', cc.has_function('sched_getcpu', prefix: '#include <sched.h>'))
 # Note that we need to specify prefix: here to avoid incorrectly
 # thinking that Windows has posix_memalign()
@@ -2713,6 +2712,8 @@ config_host_data.set('CONFIG_FALLOCATE_ZERO_RANGE',
 config_host_data.set('CONFIG_FIEMAP',
                      cc.has_header('linux/fiemap.h') and
                      cc.has_header_symbol('linux/fs.h', 'FS_IOC_FIEMAP'))
+config_host_data.set('CONFIG_GETCPU',
+                     cc.has_header_symbol('sched.h', 'getcpu', prefix: gnu_source_prefix))
 config_host_data.set('CONFIG_GETRANDOM',
                      cc.has_function('getrandom') and
                      cc.has_header_symbol('sys/random.h', 'GRND_NONBLOCK'))

From 6804b89fb531f5dd49c1e038214c89272383e220 Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <akihiko.odaki@daynix.com>
Date: Thu, 24 Apr 2025 13:50:12 +0900
Subject: [PATCH 0334/2760] meson: Remove CONFIG_STATX and CONFIG_STATX_MNT_ID
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

CONFIG_STATX and CONFIG_STATX_MNT_ID are not used since commit
e0dc2631ec4 ("virtiofsd: Remove source").

Cc: qemu-stable@nongnu.org
Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250424-buildsys-v1-2-97655e3b25d7@daynix.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 meson.build | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/meson.build b/meson.build
index f77a9ce569..35dcec8ce5 100644
--- a/meson.build
+++ b/meson.build
@@ -2191,14 +2191,6 @@ gnu_source_prefix = '''
   #endif
 '''
 
-# Check whether the glibc provides STATX_BASIC_STATS
-
-has_statx = cc.has_header_symbol('sys/stat.h', 'STATX_BASIC_STATS', prefix: gnu_source_prefix)
-
-# Check whether statx() provides mount ID information
-
-has_statx_mnt_id = cc.has_header_symbol('sys/stat.h', 'STATX_MNT_ID', prefix: gnu_source_prefix)
-
 have_vhost_user_blk_server = get_option('vhost_user_blk_server') \
   .require(host_os == 'linux',
            error_message: 'vhost_user_blk_server requires linux') \
@@ -2560,8 +2552,6 @@ config_host_data.set('CONFIG_CRYPTO_SM3', crypto_sm3.found())
 config_host_data.set('CONFIG_HOGWEED', hogweed.found())
 config_host_data.set('CONFIG_QEMU_PRIVATE_XTS', xts == 'private')
 config_host_data.set('CONFIG_MALLOC_TRIM', has_malloc_trim)
-config_host_data.set('CONFIG_STATX', has_statx)
-config_host_data.set('CONFIG_STATX_MNT_ID', has_statx_mnt_id)
 config_host_data.set('CONFIG_ZSTD', zstd.found())
 config_host_data.set('CONFIG_QPL', qpl.found())
 config_host_data.set('CONFIG_UADK', uadk.found())

From 797150d69d2edba8b1bd4a7d8c7ba2df1219c503 Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <akihiko.odaki@daynix.com>
Date: Thu, 24 Apr 2025 13:50:13 +0900
Subject: [PATCH 0335/2760] meson: Share common C source prefixes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

gnu_source_prefix defines _GNU_SOURCE for compiler object functions.
The definition is universally available in the code base.

docs/devel/style.rst also says that the "qemu/osdep.h" header is
always included, so files included in the file is also universally
available in the code base.

Rename gnu_source_prefix to osdep_prefix, and add #include directives
that are referred by the users of gnu_source_prefix and contained in
qemu/osdep.h to safely de-duplicate #include directives.

Cc: qemu-stable@nongnu.org
Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250424-buildsys-v1-3-97655e3b25d7@daynix.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 meson.build | 68 +++++++++++++++++++++++++----------------------------
 1 file changed, 32 insertions(+), 36 deletions(-)

diff --git a/meson.build b/meson.build
index 35dcec8ce5..d93dbde194 100644
--- a/meson.build
+++ b/meson.build
@@ -2185,10 +2185,21 @@ if not has_malloc_trim and get_option('malloc_trim').enabled()
   endif
 endif
 
-gnu_source_prefix = '''
+osdep_prefix = '''
   #ifndef _GNU_SOURCE
   #define _GNU_SOURCE
   #endif
+
+  #include <stddef.h>
+  #include <sys/types.h>
+
+  #include <limits.h>
+  /* Put unistd.h before time.h as that triggers localtime_r/gmtime_r
+   * function availability on recentish Mingw-w64 platforms. */
+  #include <unistd.h>
+  #include <time.h>
+  #include <errno.h>
+  #include <fcntl.h>
 '''
 
 have_vhost_user_blk_server = get_option('vhost_user_blk_server') \
@@ -2703,7 +2714,7 @@ config_host_data.set('CONFIG_FIEMAP',
                      cc.has_header('linux/fiemap.h') and
                      cc.has_header_symbol('linux/fs.h', 'FS_IOC_FIEMAP'))
 config_host_data.set('CONFIG_GETCPU',
-                     cc.has_header_symbol('sched.h', 'getcpu', prefix: gnu_source_prefix))
+                     cc.has_header_symbol('sched.h', 'getcpu', prefix: osdep_prefix))
 config_host_data.set('CONFIG_GETRANDOM',
                      cc.has_function('getrandom') and
                      cc.has_header_symbol('sys/random.h', 'GRND_NONBLOCK'))
@@ -2748,8 +2759,7 @@ config_host_data.set('HAVE_UTMPX',
 config_host_data.set('CONFIG_EVENTFD', cc.links('''
   #include <sys/eventfd.h>
   int main(void) { return eventfd(0, EFD_NONBLOCK | EFD_CLOEXEC); }'''))
-config_host_data.set('CONFIG_FDATASYNC', cc.links(gnu_source_prefix + '''
-  #include <unistd.h>
+config_host_data.set('CONFIG_FDATASYNC', cc.links(osdep_prefix + '''
   int main(void) {
   #if defined(_POSIX_SYNCHRONIZED_IO) && _POSIX_SYNCHRONIZED_IO > 0
   return fdatasync(0);
@@ -2758,10 +2768,8 @@ config_host_data.set('CONFIG_FDATASYNC', cc.links(gnu_source_prefix + '''
   #endif
   }'''))
 
-has_madvise = cc.links(gnu_source_prefix + '''
-  #include <sys/types.h>
+has_madvise = cc.links(osdep_prefix + '''
   #include <sys/mman.h>
-  #include <stddef.h>
   int main(void) { return madvise(NULL, 0, MADV_DONTNEED); }''')
 missing_madvise_proto = false
 if has_madvise
@@ -2771,21 +2779,18 @@ if has_madvise
   # missing-prototype case, we try again with a definitely-bogus prototype.
   # This will only compile if the system headers don't provide the prototype;
   # otherwise the conflicting prototypes will cause a compiler error.
-  missing_madvise_proto = cc.links(gnu_source_prefix + '''
-    #include <sys/types.h>
+  missing_madvise_proto = cc.links(osdep_prefix + '''>
     #include <sys/mman.h>
-    #include <stddef.h>
     extern int madvise(int);
     int main(void) { return madvise(0); }''')
 endif
 config_host_data.set('CONFIG_MADVISE', has_madvise)
 config_host_data.set('HAVE_MADVISE_WITHOUT_PROTOTYPE', missing_madvise_proto)
 
-config_host_data.set('CONFIG_MEMFD', cc.links(gnu_source_prefix + '''
+config_host_data.set('CONFIG_MEMFD', cc.links(osdep_prefix + '''
   #include <sys/mman.h>
   int main(void) { return memfd_create("foo", MFD_ALLOW_SEALING); }'''))
-config_host_data.set('CONFIG_OPEN_BY_HANDLE', cc.links(gnu_source_prefix + '''
-  #include <fcntl.h>
+config_host_data.set('CONFIG_OPEN_BY_HANDLE', cc.links(osdep_prefix + '''
   #if !defined(AT_EMPTY_PATH)
   # error missing definition
   #else
@@ -2796,13 +2801,12 @@ config_host_data.set('CONFIG_OPEN_BY_HANDLE', cc.links(gnu_source_prefix + '''
 # i.e. errno is set and -1 is returned. That's not really how POSIX defines the
 # function. On the flip side, it has madvise() which is preferred anyways.
 if host_os != 'darwin'
-  config_host_data.set('CONFIG_POSIX_MADVISE', cc.links(gnu_source_prefix + '''
+  config_host_data.set('CONFIG_POSIX_MADVISE', cc.links(osdep_prefix + '''
     #include <sys/mman.h>
-    #include <stddef.h>
     int main(void) { return posix_madvise(NULL, 0, POSIX_MADV_DONTNEED); }'''))
 endif
 
-config_host_data.set('CONFIG_PTHREAD_SETNAME_NP_W_TID', cc.links(gnu_source_prefix + '''
+config_host_data.set('CONFIG_PTHREAD_SETNAME_NP_W_TID', cc.links(osdep_prefix + '''
   #include <pthread.h>
 
   static void *f(void *p) { return NULL; }
@@ -2813,7 +2817,7 @@ config_host_data.set('CONFIG_PTHREAD_SETNAME_NP_W_TID', cc.links(gnu_source_pref
     pthread_setname_np(thread, "QEMU");
     return 0;
   }''', dependencies: threads))
-config_host_data.set('CONFIG_PTHREAD_SETNAME_NP_WO_TID', cc.links(gnu_source_prefix + '''
+config_host_data.set('CONFIG_PTHREAD_SETNAME_NP_WO_TID', cc.links(osdep_prefix + '''
   #include <pthread.h>
 
   static void *f(void *p) { pthread_setname_np("QEMU"); return NULL; }
@@ -2823,7 +2827,7 @@ config_host_data.set('CONFIG_PTHREAD_SETNAME_NP_WO_TID', cc.links(gnu_source_pre
     pthread_create(&thread, 0, f, 0);
     return 0;
   }''', dependencies: threads))
-config_host_data.set('CONFIG_PTHREAD_SET_NAME_NP', cc.links(gnu_source_prefix + '''
+config_host_data.set('CONFIG_PTHREAD_SET_NAME_NP', cc.links(osdep_prefix + '''
   #include <pthread.h>
   #include <pthread_np.h>
 
@@ -2835,9 +2839,8 @@ config_host_data.set('CONFIG_PTHREAD_SET_NAME_NP', cc.links(gnu_source_prefix +
     pthread_set_name_np(thread, "QEMU");
     return 0;
   }''', dependencies: threads))
-config_host_data.set('CONFIG_PTHREAD_CONDATTR_SETCLOCK', cc.links(gnu_source_prefix + '''
+config_host_data.set('CONFIG_PTHREAD_CONDATTR_SETCLOCK', cc.links(osdep_prefix + '''
   #include <pthread.h>
-  #include <time.h>
 
   int main(void)
   {
@@ -2846,7 +2849,7 @@ config_host_data.set('CONFIG_PTHREAD_CONDATTR_SETCLOCK', cc.links(gnu_source_pre
     pthread_condattr_setclock(&attr, CLOCK_MONOTONIC);
     return 0;
   }''', dependencies: threads))
-config_host_data.set('CONFIG_PTHREAD_AFFINITY_NP', cc.links(gnu_source_prefix + '''
+config_host_data.set('CONFIG_PTHREAD_AFFINITY_NP', cc.links(osdep_prefix + '''
   #include <pthread.h>
 
   static void *f(void *p) { return NULL; }
@@ -2863,15 +2866,10 @@ config_host_data.set('CONFIG_PTHREAD_AFFINITY_NP', cc.links(gnu_source_prefix +
     CPU_FREE(cpuset);
     return 0;
   }''', dependencies: threads))
-config_host_data.set('CONFIG_SIGNALFD', cc.links(gnu_source_prefix + '''
+config_host_data.set('CONFIG_SIGNALFD', cc.links(osdep_prefix + '''
   #include <sys/signalfd.h>
-  #include <stddef.h>
   int main(void) { return signalfd(-1, NULL, SFD_CLOEXEC); }'''))
-config_host_data.set('CONFIG_SPLICE', cc.links(gnu_source_prefix + '''
-  #include <unistd.h>
-  #include <fcntl.h>
-  #include <limits.h>
-
+config_host_data.set('CONFIG_SPLICE', cc.links(osdep_prefix + '''
   int main(void)
   {
     int len, fd = 0;
@@ -2880,13 +2878,13 @@ config_host_data.set('CONFIG_SPLICE', cc.links(gnu_source_prefix + '''
     return 0;
   }'''))
 
-config_host_data.set('HAVE_MLOCKALL', cc.links(gnu_source_prefix + '''
+config_host_data.set('HAVE_MLOCKALL', cc.links(osdep_prefix + '''
   #include <sys/mman.h>
   int main(void) {
     return mlockall(MCL_FUTURE);
   }'''))
 
-config_host_data.set('HAVE_MLOCK_ONFAULT', cc.links(gnu_source_prefix + '''
+config_host_data.set('HAVE_MLOCK_ONFAULT', cc.links(osdep_prefix + '''
   #include <sys/mman.h>
   int main(void) {
       return mlockall(MCL_FUTURE | MCL_ONFAULT);
@@ -2895,7 +2893,7 @@ config_host_data.set('HAVE_MLOCK_ONFAULT', cc.links(gnu_source_prefix + '''
 have_l2tpv3 = false
 if get_option('l2tpv3').allowed() and have_system
   have_l2tpv3 = cc.has_type('struct mmsghdr',
-    prefix: gnu_source_prefix + '''
+    prefix: osdep_prefix + '''
       #include <sys/socket.h>
       #include <linux/ip.h>''')
 endif
@@ -3011,13 +3009,13 @@ if has_int128_type
   endif
 endif
 
-config_host_data.set('CONFIG_GETAUXVAL', cc.links(gnu_source_prefix + '''
+config_host_data.set('CONFIG_GETAUXVAL', cc.links(osdep_prefix + '''
   #include <sys/auxv.h>
   int main(void) {
     return getauxval(AT_HWCAP) == 0;
   }'''))
 
-config_host_data.set('CONFIG_ELF_AUX_INFO', cc.links(gnu_source_prefix + '''
+config_host_data.set('CONFIG_ELF_AUX_INFO', cc.links(osdep_prefix + '''
   #include <sys/auxv.h>
   int main(void) {
     unsigned long hwcap = 0;
@@ -3130,9 +3128,7 @@ config_host_data.set('CONFIG_MEMBARRIER', get_option('membarrier') \
   .allowed())
 
 have_afalg = get_option('crypto_afalg') \
-  .require(cc.compiles(gnu_source_prefix + '''
-    #include <errno.h>
-    #include <sys/types.h>
+  .require(cc.compiles(osdep_prefix + '''
     #include <sys/socket.h>
     #include <linux/if_alg.h>
     int main(void) {

From a5b30be534538dc6e44a68ce9734e45dd08f52ec Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <akihiko.odaki@daynix.com>
Date: Thu, 24 Apr 2025 13:50:14 +0900
Subject: [PATCH 0336/2760] meson: Use osdep_prefix for strchrnul()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

macOS SDK may have the symbol of strchrnul(), but it is actually
available only on macOS 15.4 or later and that fact is codified in
string.h. Include the header file using osdep_prefix to check if the
function is available on the deployment target.

Cc: qemu-stable@nongnu.org
Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250424-buildsys-v1-4-97655e3b25d7@daynix.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 meson.build | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/meson.build b/meson.build
index d93dbde194..c736a6f4c4 100644
--- a/meson.build
+++ b/meson.build
@@ -2193,6 +2193,7 @@ osdep_prefix = '''
   #include <stddef.h>
   #include <sys/types.h>
 
+  #include <string.h>
   #include <limits.h>
   /* Put unistd.h before time.h as that triggers localtime_r/gmtime_r
    * function availability on recentish Mingw-w64 platforms. */
@@ -2657,7 +2658,7 @@ config_host_data.set('HAVE_GETIFADDRS', cc.has_function('getifaddrs'))
 config_host_data.set('HAVE_GLIB_WITH_SLICE_ALLOCATOR', glib_has_gslice)
 config_host_data.set('HAVE_GLIB_WITH_ALIGNED_ALLOC', glib_has_aligned_alloc)
 config_host_data.set('HAVE_OPENPTY', cc.has_function('openpty', dependencies: util))
-config_host_data.set('HAVE_STRCHRNUL', cc.has_function('strchrnul'))
+config_host_data.set('HAVE_STRCHRNUL', cc.has_function('strchrnul', prefix: osdep_prefix))
 config_host_data.set('HAVE_SYSTEM_FUNCTION', cc.has_function('system', prefix: '#include <stdlib.h>'))
 if rbd.found()
   config_host_data.set('HAVE_RBD_NAMESPACE_EXISTS',

From 2ef9faf03720a40eae7fc8956f1941dddfb0eea7 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Thu, 24 Apr 2025 16:28:28 -0700
Subject: [PATCH 0337/2760] system/kvm: make functions accessible from common
 code
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250424232829.141163-8-pierrick.bouvier@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 include/system/kvm.h | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/include/system/kvm.h b/include/system/kvm.h
index 18811cad6f..b690dda137 100644
--- a/include/system/kvm.h
+++ b/include/system/kvm.h
@@ -210,6 +210,10 @@ bool kvm_arm_supports_user_irq(void);
 int kvm_on_sigbus_vcpu(CPUState *cpu, int code, void *addr);
 int kvm_on_sigbus(int code, void *addr);
 
+int kvm_check_extension(KVMState *s, unsigned int extension);
+
+int kvm_vm_ioctl(KVMState *s, unsigned long type, ...);
+
 void kvm_flush_coalesced_mmio_buffer(void);
 
 #ifdef COMPILING_PER_TARGET
@@ -237,8 +241,6 @@ static inline int kvm_update_guest_debug(CPUState *cpu, unsigned long reinject_t
 
 int kvm_ioctl(KVMState *s, unsigned long type, ...);
 
-int kvm_vm_ioctl(KVMState *s, unsigned long type, ...);
-
 int kvm_vcpu_ioctl(CPUState *cpu, unsigned long type, ...);
 
 /**
@@ -441,8 +443,6 @@ void kvm_arch_update_guest_debug(CPUState *cpu, struct kvm_guest_debug *dbg);
 
 bool kvm_arch_stop_on_emulation_error(CPUState *cpu);
 
-int kvm_check_extension(KVMState *s, unsigned int extension);
-
 int kvm_vm_check_extension(KVMState *s, unsigned int extension);
 
 #define kvm_vm_enable_cap(s, capability, cap_flags, ...)             \

From 58bc9db84af4e1bf3a8c55fa18277acbfaeb1caf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 24 Apr 2025 09:48:42 +0200
Subject: [PATCH 0338/2760] accel/tcg: Correct list of included headers in
 tcg-stub.c
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In commit 3549118b498 we moved cpu_loop_exit*() declarations to
"exec/cpu-common.h" but neglected to update tcg-stub.c. We missed
it because "exec/cpu-common.h" is indirectly pulled in via
"exec/exec-all.h" -> "exec/translation-block.h". Include it
directly instead of the not necessary "exec/exec-all.h".

Commit bb6cf6f0168 ("accel/tcg: Factor tcg_cpu_reset_hold() out")
removed the need for "exec/tb-flush.h", so remote it too.

Fixes: 3549118b498 ("exec: Move cpu_loop_foo() functions to 'cpu-common.h'")
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Message-Id: <20250424094653.35932-4-philmd@linaro.org>
---
 accel/stubs/tcg-stub.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/accel/stubs/tcg-stub.c b/accel/stubs/tcg-stub.c
index b2b9881bdf..3b76b8b17c 100644
--- a/accel/stubs/tcg-stub.c
+++ b/accel/stubs/tcg-stub.c
@@ -11,8 +11,7 @@
  */
 
 #include "qemu/osdep.h"
-#include "exec/tb-flush.h"
-#include "exec/exec-all.h"
+#include "exec/cpu-common.h"
 
 G_NORETURN void cpu_loop_exit(CPUState *cpu)
 {

From f56159e82885bb7cbbe5d28698a486c7ccbfb2ca Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 24 Apr 2025 10:18:58 +0200
Subject: [PATCH 0339/2760] target/hexagon: Include missing 'accel/tcg/getpc.h'
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since the macros.h headers call GETPC(), they need to
include "accel/tcg/getpc.h", which defines it.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Brian Cain <brian.cain@oss.qualcomm.com>
Message-Id: <20250424094653.35932-9-philmd@linaro.org>
---
 target/hexagon/macros.h       | 1 +
 target/hexagon/mmvec/macros.h | 1 +
 2 files changed, 2 insertions(+)

diff --git a/target/hexagon/macros.h b/target/hexagon/macros.h
index e5eb31e671..9ba9be408d 100644
--- a/target/hexagon/macros.h
+++ b/target/hexagon/macros.h
@@ -21,6 +21,7 @@
 #include "cpu.h"
 #include "hex_regs.h"
 #include "reg_fields.h"
+#include "accel/tcg/getpc.h"
 
 #define GET_FIELD(FIELD, REGIN) \
     fEXTRACTU_BITS(REGIN, reg_field_info[FIELD].width, \
diff --git a/target/hexagon/mmvec/macros.h b/target/hexagon/mmvec/macros.h
index bcd4a1e897..c1a88392c0 100644
--- a/target/hexagon/mmvec/macros.h
+++ b/target/hexagon/mmvec/macros.h
@@ -21,6 +21,7 @@
 #include "qemu/host-utils.h"
 #include "arch.h"
 #include "mmvec/system_ext_mmvec.h"
+#include "accel/tcg/getpc.h"
 
 #ifndef QEMU_GENERATE
 #define VdV      (*(MMVector *restrict)(VdV_void))

From 4e442406fde1957a8c4eebbcd878fb5f25cc49c1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 17 Apr 2025 10:38:10 +0200
Subject: [PATCH 0340/2760] linux-user/elfload: Use target_needs_bswap()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Check whether we need to swap at runtime using
target_needs_bswap().

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250417131004.47205-2-philmd@linaro.org>
---
 linux-user/elfload.c | 63 +++++++++++++++++++++++++++-----------------
 1 file changed, 39 insertions(+), 24 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 99811af5e7..fbfdec2f17 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -12,6 +12,7 @@
 #include "exec/page-protection.h"
 #include "exec/mmap-lock.h"
 #include "exec/translation-block.h"
+#include "exec/tswap.h"
 #include "user/guest-base.h"
 #include "user-internals.h"
 #include "signal-common.h"
@@ -2122,9 +2123,12 @@ static inline void memcpy_fromfs(void * to, const void * from, unsigned long n)
     memcpy(to, from, n);
 }
 
-#if HOST_BIG_ENDIAN != TARGET_BIG_ENDIAN
 static void bswap_ehdr(struct elfhdr *ehdr)
 {
+    if (!target_needs_bswap()) {
+        return;
+    }
+
     bswap16s(&ehdr->e_type);            /* Object file type */
     bswap16s(&ehdr->e_machine);         /* Architecture */
     bswap32s(&ehdr->e_version);         /* Object file version */
@@ -2142,8 +2146,11 @@ static void bswap_ehdr(struct elfhdr *ehdr)
 
 static void bswap_phdr(struct elf_phdr *phdr, int phnum)
 {
-    int i;
-    for (i = 0; i < phnum; ++i, ++phdr) {
+    if (!target_needs_bswap()) {
+        return;
+    }
+
+    for (int i = 0; i < phnum; ++i, ++phdr) {
         bswap32s(&phdr->p_type);        /* Segment type */
         bswap32s(&phdr->p_flags);       /* Segment flags */
         bswaptls(&phdr->p_offset);      /* Segment file offset */
@@ -2157,8 +2164,11 @@ static void bswap_phdr(struct elf_phdr *phdr, int phnum)
 
 static void bswap_shdr(struct elf_shdr *shdr, int shnum)
 {
-    int i;
-    for (i = 0; i < shnum; ++i, ++shdr) {
+    if (!target_needs_bswap()) {
+        return;
+    }
+
+    for (int i = 0; i < shnum; ++i, ++shdr) {
         bswap32s(&shdr->sh_name);
         bswap32s(&shdr->sh_type);
         bswaptls(&shdr->sh_flags);
@@ -2174,6 +2184,10 @@ static void bswap_shdr(struct elf_shdr *shdr, int shnum)
 
 static void bswap_sym(struct elf_sym *sym)
 {
+    if (!target_needs_bswap()) {
+        return;
+    }
+
     bswap32s(&sym->st_name);
     bswaptls(&sym->st_value);
     bswaptls(&sym->st_size);
@@ -2183,6 +2197,10 @@ static void bswap_sym(struct elf_sym *sym)
 #ifdef TARGET_MIPS
 static void bswap_mips_abiflags(Mips_elf_abiflags_v0 *abiflags)
 {
+    if (!target_needs_bswap()) {
+        return;
+    }
+
     bswap16s(&abiflags->version);
     bswap32s(&abiflags->ases);
     bswap32s(&abiflags->isa_ext);
@@ -2190,15 +2208,6 @@ static void bswap_mips_abiflags(Mips_elf_abiflags_v0 *abiflags)
     bswap32s(&abiflags->flags2);
 }
 #endif
-#else
-static inline void bswap_ehdr(struct elfhdr *ehdr) { }
-static inline void bswap_phdr(struct elf_phdr *phdr, int phnum) { }
-static inline void bswap_shdr(struct elf_shdr *shdr, int shnum) { }
-static inline void bswap_sym(struct elf_sym *sym) { }
-#ifdef TARGET_MIPS
-static inline void bswap_mips_abiflags(Mips_elf_abiflags_v0 *abiflags) { }
-#endif
-#endif
 
 #ifdef USE_ELF_CORE_DUMP
 static int elf_core_dump(int, const CPUArchState *);
@@ -3144,11 +3153,11 @@ static bool parse_elf_properties(const ImageSource *src,
      * The contents of a valid PT_GNU_PROPERTY is a sequence of uint32_t.
      * Swap most of them now, beyond the header and namesz.
      */
-#if HOST_BIG_ENDIAN != TARGET_BIG_ENDIAN
-    for (int i = 4; i < n / 4; i++) {
-        bswap32s(note.data + i);
+    if (target_needs_bswap()) {
+        for (int i = 4; i < n / 4; i++) {
+            bswap32s(note.data + i);
+        }
     }
-#endif
 
     /*
      * Note that nhdr is 3 words, and that the "name" described by namesz
@@ -4000,9 +4009,12 @@ struct target_elf_prpsinfo {
     char    pr_psargs[ELF_PRARGSZ]; /* initial part of arg list */
 };
 
-#if HOST_BIG_ENDIAN != TARGET_BIG_ENDIAN
 static void bswap_prstatus(struct target_elf_prstatus *prstatus)
 {
+    if (!target_needs_bswap()) {
+        return;
+    }
+
     prstatus->pr_info.si_signo = tswap32(prstatus->pr_info.si_signo);
     prstatus->pr_info.si_code = tswap32(prstatus->pr_info.si_code);
     prstatus->pr_info.si_errno = tswap32(prstatus->pr_info.si_errno);
@@ -4020,6 +4032,10 @@ static void bswap_prstatus(struct target_elf_prstatus *prstatus)
 
 static void bswap_psinfo(struct target_elf_prpsinfo *psinfo)
 {
+    if (!target_needs_bswap()) {
+        return;
+    }
+
     psinfo->pr_flag = tswapal(psinfo->pr_flag);
     psinfo->pr_uid = tswap16(psinfo->pr_uid);
     psinfo->pr_gid = tswap16(psinfo->pr_gid);
@@ -4031,15 +4047,14 @@ static void bswap_psinfo(struct target_elf_prpsinfo *psinfo)
 
 static void bswap_note(struct elf_note *en)
 {
+    if (!target_needs_bswap()) {
+        return;
+    }
+
     bswap32s(&en->n_namesz);
     bswap32s(&en->n_descsz);
     bswap32s(&en->n_type);
 }
-#else
-static inline void bswap_prstatus(struct target_elf_prstatus *p) { }
-static inline void bswap_psinfo(struct target_elf_prpsinfo *p) {}
-static inline void bswap_note(struct elf_note *en) { }
-#endif /* HOST_BIG_ENDIAN != TARGET_BIG_ENDIAN */
 
 /*
  * Calculate file (dump) size of given memory region.

From 56f8fb6886c49a99962d50912a8dde9e8dbfc306 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 17 Apr 2025 10:37:53 +0200
Subject: [PATCH 0341/2760] accel/kvm: Use target_needs_bswap()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Check whether we need to swap at runtime using
target_needs_bswap().

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250417131004.47205-3-philmd@linaro.org>
---
 accel/kvm/kvm-all.c | 30 ++++++++++++++++--------------
 1 file changed, 16 insertions(+), 14 deletions(-)

diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index b8c68c7819..278a50690c 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -33,6 +33,7 @@
 #include "system/cpus.h"
 #include "system/accel-blocker.h"
 #include "qemu/bswap.h"
+#include "exec/tswap.h"
 #include "system/memory.h"
 #include "system/ram_addr.h"
 #include "qemu/event_notifier.h"
@@ -1318,21 +1319,22 @@ bool kvm_hwpoisoned_mem(void)
 
 static uint32_t adjust_ioeventfd_endianness(uint32_t val, uint32_t size)
 {
-#if HOST_BIG_ENDIAN != TARGET_BIG_ENDIAN
-    /* The kernel expects ioeventfd values in HOST_BIG_ENDIAN
-     * endianness, but the memory core hands them in target endianness.
-     * For example, PPC is always treated as big-endian even if running
-     * on KVM and on PPC64LE.  Correct here.
-     */
-    switch (size) {
-    case 2:
-        val = bswap16(val);
-        break;
-    case 4:
-        val = bswap32(val);
-        break;
+    if (target_needs_bswap()) {
+        /*
+         * The kernel expects ioeventfd values in HOST_BIG_ENDIAN
+         * endianness, but the memory core hands them in target endianness.
+         * For example, PPC is always treated as big-endian even if running
+         * on KVM and on PPC64LE.  Correct here, swapping back.
+         */
+        switch (size) {
+        case 2:
+            val = bswap16(val);
+            break;
+        case 4:
+            val = bswap32(val);
+            break;
+        }
     }
-#endif
     return val;
 }
 

From 33fa8f02a91986c6c3e7de748964a312c14a5a0d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 17 Apr 2025 10:47:00 +0200
Subject: [PATCH 0342/2760] target/mips: Check CPU endianness at runtime using
 env_is_bigendian()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since CPU endianness can be toggled at runtime before resetting,
checking the endianness at build time preprocessing the
TARGET_BIG_ENDIAN definition isn't correct. We have to call
mips_env_is_bigendian() to get the CPU endianness at runtime.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250417131004.47205-4-philmd@linaro.org>
---
 target/mips/tcg/msa_helper.c | 34 ++++++++++++++++------------------
 1 file changed, 16 insertions(+), 18 deletions(-)

diff --git a/target/mips/tcg/msa_helper.c b/target/mips/tcg/msa_helper.c
index 14de4a71ff..e349344647 100644
--- a/target/mips/tcg/msa_helper.c
+++ b/target/mips/tcg/msa_helper.c
@@ -8212,7 +8212,6 @@ void helper_msa_ffint_u_df(CPUMIPSState *env, uint32_t df, uint32_t wd,
 /* Element-by-element access macros */
 #define DF_ELEMENTS(df) (MSA_WRLEN / DF_BITS(df))
 
-#if TARGET_BIG_ENDIAN
 static inline uint64_t bswap16x4(uint64_t x)
 {
     uint64_t m = 0x00ff00ff00ff00ffull;
@@ -8223,7 +8222,6 @@ static inline uint64_t bswap32x2(uint64_t x)
 {
     return ror64(bswap64(x), 32);
 }
-#endif
 
 void helper_msa_ld_b(CPUMIPSState *env, uint32_t wd,
                      target_ulong addr)
@@ -8252,10 +8250,10 @@ void helper_msa_ld_h(CPUMIPSState *env, uint32_t wd,
      */
     d0 = cpu_ldq_le_data_ra(env, addr + 0, ra);
     d1 = cpu_ldq_le_data_ra(env, addr + 8, ra);
-#if TARGET_BIG_ENDIAN
-    d0 = bswap16x4(d0);
-    d1 = bswap16x4(d1);
-#endif
+    if (mips_env_is_bigendian(env)) {
+        d0 = bswap16x4(d0);
+        d1 = bswap16x4(d1);
+    }
     pwd->d[0] = d0;
     pwd->d[1] = d1;
 }
@@ -8273,10 +8271,10 @@ void helper_msa_ld_w(CPUMIPSState *env, uint32_t wd,
      */
     d0 = cpu_ldq_le_data_ra(env, addr + 0, ra);
     d1 = cpu_ldq_le_data_ra(env, addr + 8, ra);
-#if TARGET_BIG_ENDIAN
-    d0 = bswap32x2(d0);
-    d1 = bswap32x2(d1);
-#endif
+    if (mips_env_is_bigendian(env)) {
+        d0 = bswap32x2(d0);
+        d1 = bswap32x2(d1);
+    }
     pwd->d[0] = d0;
     pwd->d[1] = d1;
 }
@@ -8339,10 +8337,10 @@ void helper_msa_st_h(CPUMIPSState *env, uint32_t wd,
     /* Store 8 bytes at a time.  See helper_msa_ld_h. */
     d0 = pwd->d[0];
     d1 = pwd->d[1];
-#if TARGET_BIG_ENDIAN
-    d0 = bswap16x4(d0);
-    d1 = bswap16x4(d1);
-#endif
+    if (mips_env_is_bigendian(env)) {
+        d0 = bswap16x4(d0);
+        d1 = bswap16x4(d1);
+    }
     cpu_stq_le_data_ra(env, addr + 0, d0, ra);
     cpu_stq_le_data_ra(env, addr + 8, d1, ra);
 }
@@ -8360,10 +8358,10 @@ void helper_msa_st_w(CPUMIPSState *env, uint32_t wd,
     /* Store 8 bytes at a time.  See helper_msa_ld_w. */
     d0 = pwd->d[0];
     d1 = pwd->d[1];
-#if TARGET_BIG_ENDIAN
-    d0 = bswap32x2(d0);
-    d1 = bswap32x2(d1);
-#endif
+    if (mips_env_is_bigendian(env)) {
+        d0 = bswap32x2(d0);
+        d1 = bswap32x2(d1);
+    }
     cpu_stq_le_data_ra(env, addr + 0, d0, ra);
     cpu_stq_le_data_ra(env, addr + 8, d1, ra);
 }

From 770f2e64b6a6ae13c00cd1cc083eaf9728c0f934 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 17 Apr 2025 10:40:29 +0200
Subject: [PATCH 0343/2760] target/xtensa: Evaluate TARGET_BIG_ENDIAN at
 compile time
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Rather than evaluating TARGET_BIG_ENDIAN at preprocessing
time via #ifdef'ry, do it in C at compile time

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250417131004.47205-6-philmd@linaro.org>
---
 target/xtensa/translate.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/target/xtensa/translate.c b/target/xtensa/translate.c
index 5ebd4a512c..2af83c07c2 100644
--- a/target/xtensa/translate.c
+++ b/target/xtensa/translate.c
@@ -1395,11 +1395,11 @@ static void translate_bbi(DisasContext *dc, const OpcodeArg arg[],
                           const uint32_t par[])
 {
     TCGv_i32 tmp = tcg_temp_new_i32();
-#if TARGET_BIG_ENDIAN
-    tcg_gen_andi_i32(tmp, arg[0].in, 0x80000000u >> arg[1].imm);
-#else
-    tcg_gen_andi_i32(tmp, arg[0].in, 0x00000001u << arg[1].imm);
-#endif
+    if (TARGET_BIG_ENDIAN) {
+        tcg_gen_andi_i32(tmp, arg[0].in, 0x80000000u >> arg[1].imm);
+    } else {
+        tcg_gen_andi_i32(tmp, arg[0].in, 0x00000001u << arg[1].imm);
+    }
     gen_brcondi(dc, par[0], tmp, 0, arg[2].imm);
 }
 

From 1b079a6eebb879d14da193919afafc303e938427 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 16 Apr 2025 14:33:06 +0200
Subject: [PATCH 0344/2760] hw/mips: Evaluate TARGET_BIG_ENDIAN at compile time
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Rather than evaluating TARGET_BIG_ENDIAN at preprocessing
time via #ifdef'ry, do it in C at compile time

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250417131004.47205-7-philmd@linaro.org>
---
 hw/mips/jazz.c    | 11 ++++-------
 hw/mips/malta.c   | 21 ++++++---------------
 hw/mips/mipssim.c | 11 ++++-------
 3 files changed, 14 insertions(+), 29 deletions(-)

diff --git a/hw/mips/jazz.c b/hw/mips/jazz.c
index cee92e1825..7fb0b97a38 100644
--- a/hw/mips/jazz.c
+++ b/hw/mips/jazz.c
@@ -59,12 +59,6 @@ enum jazz_model_e {
     JAZZ_PICA61,
 };
 
-#if TARGET_BIG_ENDIAN
-#define BIOS_FILENAME "mips_bios.bin"
-#else
-#define BIOS_FILENAME "mipsel_bios.bin"
-#endif
-
 static void main_cpu_reset(void *opaque)
 {
     MIPSCPU *cpu = opaque;
@@ -168,6 +162,8 @@ static void mips_jazz_init_net(IOMMUMemoryRegion *rc4030_dma_mr,
 static void mips_jazz_init(MachineState *machine,
                            enum jazz_model_e jazz_model)
 {
+    const char *bios_name = TARGET_BIG_ENDIAN ? "mips_bios.bin"
+                                              : "mipsel_bios.bin";
     MemoryRegion *address_space = get_system_memory();
     char *filename;
     int bios_size, n;
@@ -245,7 +241,8 @@ static void mips_jazz_init(MachineState *machine,
     memory_region_add_subregion(address_space, 0xfff00000LL, bios2);
 
     /* load the BIOS image. */
-    filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, machine->firmware ?: BIOS_FILENAME);
+    filename = qemu_find_file(QEMU_FILE_TYPE_BIOS,
+                              machine->firmware ?: bios_name);
     if (filename) {
         bios_size = load_image_targphys(filename, 0xfff00000LL,
                                         MAGNUM_BIOS_SIZE);
diff --git a/hw/mips/malta.c b/hw/mips/malta.c
index 8e9cea70b1..cbdbb21056 100644
--- a/hw/mips/malta.c
+++ b/hw/mips/malta.c
@@ -94,12 +94,6 @@ typedef struct {
     bool display_inited;
 } MaltaFPGAState;
 
-#if TARGET_BIG_ENDIAN
-#define BIOS_FILENAME "mips_bios.bin"
-#else
-#define BIOS_FILENAME "mipsel_bios.bin"
-#endif
-
 #define TYPE_MIPS_MALTA "mips-malta"
 OBJECT_DECLARE_SIMPLE_TYPE(MaltaState, MIPS_MALTA)
 
@@ -383,11 +377,7 @@ static uint64_t malta_fpga_read(void *opaque, hwaddr addr,
 
     /* STATUS Register */
     case 0x00208:
-#if TARGET_BIG_ENDIAN
-        val = 0x00000012;
-#else
-        val = 0x00000010;
-#endif
+        val = TARGET_BIG_ENDIAN ? 0x00000012 : 0x00000010;
         break;
 
     /* JMPRS Register */
@@ -1177,9 +1167,12 @@ void mips_malta_init(MachineState *machine)
         target_long bios_size = FLASH_SIZE;
         /* Load firmware from flash. */
         if (!dinfo) {
+            const char *bios_name = TARGET_BIG_ENDIAN ? "mips_bios.bin"
+                                                        : "mipsel_bios.bin";
+
             /* Load a BIOS image. */
             filename = qemu_find_file(QEMU_FILE_TYPE_BIOS,
-                                      machine->firmware ?: BIOS_FILENAME);
+                                      machine->firmware ?: bios_name);
             if (filename) {
                 bios_size = load_image_targphys(filename, FLASH_ADDRESS,
                                                 BIOS_SIZE);
@@ -1197,8 +1190,7 @@ void mips_malta_init(MachineState *machine)
          * In little endian mode the 32bit words in the bios are swapped,
          * a neat trick which allows bi-endian firmware.
          */
-#if !TARGET_BIG_ENDIAN
-        {
+        if (!TARGET_BIG_ENDIAN) {
             uint32_t *end, *addr;
             const size_t swapsize = MIN(bios_size, 0x3e0000);
             addr = rom_ptr(FLASH_ADDRESS, swapsize);
@@ -1211,7 +1203,6 @@ void mips_malta_init(MachineState *machine)
                 addr++;
             }
         }
-#endif
     }
 
     /*
diff --git a/hw/mips/mipssim.c b/hw/mips/mipssim.c
index b6dabf2893..e843307b9b 100644
--- a/hw/mips/mipssim.c
+++ b/hw/mips/mipssim.c
@@ -46,12 +46,6 @@
 
 #define BIOS_SIZE (4 * MiB)
 
-#if TARGET_BIG_ENDIAN
-#define BIOS_FILENAME "mips_bios.bin"
-#else
-#define BIOS_FILENAME "mipsel_bios.bin"
-#endif
-
 static struct _loaderparams {
     int ram_size;
     const char *kernel_filename;
@@ -143,6 +137,8 @@ mips_mipssim_init(MachineState *machine)
     const char *kernel_filename = machine->kernel_filename;
     const char *kernel_cmdline = machine->kernel_cmdline;
     const char *initrd_filename = machine->initrd_filename;
+    const char *bios_name = TARGET_BIG_ENDIAN ? "mips_bios.bin"
+                                              : "mipsel_bios.bin";
     char *filename;
     MemoryRegion *address_space_mem = get_system_memory();
     MemoryRegion *isa = g_new(MemoryRegion, 1);
@@ -179,7 +175,8 @@ mips_mipssim_init(MachineState *machine)
     /* Map the BIOS / boot exception handler. */
     memory_region_add_subregion(address_space_mem, 0x1fc00000LL, bios);
     /* Load a BIOS / boot exception handler image. */
-    filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, machine->firmware ?: BIOS_FILENAME);
+    filename = qemu_find_file(QEMU_FILE_TYPE_BIOS,
+                              machine->firmware ?: bios_name);
     if (filename) {
         bios_size = load_image_targphys(filename, 0x1fc00000LL, BIOS_SIZE);
         g_free(filename);

From eb3020b6ed2baca63c2a3fad012335670841ead6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 17 Apr 2025 10:18:35 +0200
Subject: [PATCH 0345/2760] hw/microblaze: Evaluate TARGET_BIG_ENDIAN at
 compile time
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Rather than evaluating TARGET_BIG_ENDIAN at preprocessing
time via #ifdef'ry, do it in C at compile time

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250417131004.47205-8-philmd@linaro.org>
---
 hw/microblaze/petalogix_ml605_mmu.c | 12 ++++++------
 hw/microblaze/xlnx-zynqmp-pmu.c     | 12 ++++++------
 2 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/hw/microblaze/petalogix_ml605_mmu.c b/hw/microblaze/petalogix_ml605_mmu.c
index c887c7a99e..bea6b689fd 100644
--- a/hw/microblaze/petalogix_ml605_mmu.c
+++ b/hw/microblaze/petalogix_ml605_mmu.c
@@ -218,12 +218,12 @@ petalogix_ml605_init(MachineState *machine)
 
 static void petalogix_ml605_machine_init(MachineClass *mc)
 {
-#if TARGET_BIG_ENDIAN
-    mc->desc = "PetaLogix linux refdesign for xilinx ml605 (big endian)";
-    mc->deprecation_reason = "big endian support is not tested";
-#else
-    mc->desc = "PetaLogix linux refdesign for xilinx ml605 (little endian)";
-#endif
+    if (TARGET_BIG_ENDIAN) {
+        mc->desc = "PetaLogix linux refdesign for xilinx ml605 (big endian)";
+        mc->deprecation_reason = "big endian support is not tested";
+    } else {
+        mc->desc = "PetaLogix linux refdesign for xilinx ml605 (little endian)";
+    }
     mc->init = petalogix_ml605_init;
 }
 
diff --git a/hw/microblaze/xlnx-zynqmp-pmu.c b/hw/microblaze/xlnx-zynqmp-pmu.c
index ea1430f408..ed40b5f2e0 100644
--- a/hw/microblaze/xlnx-zynqmp-pmu.c
+++ b/hw/microblaze/xlnx-zynqmp-pmu.c
@@ -181,12 +181,12 @@ static void xlnx_zynqmp_pmu_init(MachineState *machine)
 
 static void xlnx_zynqmp_pmu_machine_init(MachineClass *mc)
 {
-#if TARGET_BIG_ENDIAN
-    mc->desc = "Xilinx ZynqMP PMU machine (big endian)";
-    mc->deprecation_reason = "big endian support is not tested";
-#else
-    mc->desc = "Xilinx ZynqMP PMU machine (little endian)";
-#endif
+    if (TARGET_BIG_ENDIAN) {
+        mc->desc = "Xilinx ZynqMP PMU machine (big endian)";
+        mc->deprecation_reason = "big endian support is not tested";
+    } else {
+        mc->desc = "Xilinx ZynqMP PMU machine (little endian)";
+    }
     mc->init = xlnx_zynqmp_pmu_init;
 }
 

From 0c9d76f519c0f67506d276c0ee5637bac0b40121 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 16 Apr 2025 13:25:23 +0200
Subject: [PATCH 0346/2760] qapi: Rename TargetInfo structure as QemuTargetInfo
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The QAPI-generated 'TargetInfo' structure name is only used
in a single file. We want to heavily use another structure
similarly named. Rename the QAPI one, since structure names
are not part of the public API.

Suggested-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Message-Id: <20250422145502.70770-2-philmd@linaro.org>
---
 hw/core/machine-qmp-cmds.c |  4 ++--
 qapi/machine.json          | 10 +++++-----
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/hw/core/machine-qmp-cmds.c b/hw/core/machine-qmp-cmds.c
index 9447e345b3..a5e635152d 100644
--- a/hw/core/machine-qmp-cmds.c
+++ b/hw/core/machine-qmp-cmds.c
@@ -134,9 +134,9 @@ CurrentMachineParams *qmp_query_current_machine(Error **errp)
     return params;
 }
 
-TargetInfo *qmp_query_target(Error **errp)
+QemuTargetInfo *qmp_query_target(Error **errp)
 {
-    TargetInfo *info = g_malloc0(sizeof(*info));
+    QemuTargetInfo *info = g_malloc0(sizeof(*info));
 
     info->arch = qapi_enum_parse(&SysEmuTarget_lookup, target_name(), -1,
                                  &error_abort);
diff --git a/qapi/machine.json b/qapi/machine.json
index a9ff807631..c8feb9fe17 100644
--- a/qapi/machine.json
+++ b/qapi/machine.json
@@ -275,15 +275,15 @@
 { 'command': 'query-current-machine', 'returns': 'CurrentMachineParams' }
 
 ##
-# @TargetInfo:
+# @QemuTargetInfo:
 #
-# Information describing the QEMU target.
+# Information on the target configuration built into the QEMU binary.
 #
 # @arch: the target architecture
 #
 # Since: 1.2
 ##
-{ 'struct': 'TargetInfo',
+{ 'struct': 'QemuTargetInfo',
   'data': { 'arch': 'SysEmuTarget' } }
 
 ##
@@ -291,11 +291,11 @@
 #
 # Return information about the target for this QEMU
 #
-# Returns: TargetInfo
+# Returns: QemuTargetInfo
 #
 # Since: 1.2
 ##
-{ 'command': 'query-target', 'returns': 'TargetInfo' }
+{ 'command': 'query-target', 'returns': 'QemuTargetInfo' }
 
 ##
 # @UuidInfo:

From 2b7ae6e0f645f3c3676152f3aa7b8c50a091c486 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 17 Apr 2025 17:59:35 +0200
Subject: [PATCH 0347/2760] qemu: Introduce target_cpu_type()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Introduce the target_cpu_type() helper to access the
CPU_RESOLVING_TYPE target-specific definition from
target-agnostic code.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20250417165430.58213-2-philmd@linaro.org>
---
 MAINTAINERS                |  2 ++
 include/qemu/target-info.h | 19 +++++++++++++++++++
 meson.build                |  2 ++
 target-info-stub.c         | 16 ++++++++++++++++
 4 files changed, 39 insertions(+)
 create mode 100644 include/qemu/target-info.h
 create mode 100644 target-info-stub.c

diff --git a/MAINTAINERS b/MAINTAINERS
index d82d962f1a..28b1e9ba44 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -496,6 +496,7 @@ F: include/exec/cpu*.h
 F: include/exec/exec-all.h
 F: include/exec/target_long.h
 F: include/qemu/accel.h
+F: include/qemu/target-info*.h
 F: include/system/accel-*.h
 F: include/system/cpus.h
 F: include/accel/accel-cpu-target.h
@@ -504,6 +505,7 @@ F: accel/Makefile.objs
 F: accel/stubs/Makefile.objs
 F: cpu-common.c
 F: cpu-target.c
+F: target-info*.c
 F: system/cpus.c
 
 Apple Silicon HVF CPUs
diff --git a/include/qemu/target-info.h b/include/qemu/target-info.h
new file mode 100644
index 0000000000..b4cc4888ca
--- /dev/null
+++ b/include/qemu/target-info.h
@@ -0,0 +1,19 @@
+/*
+ * QEMU target info API
+ *
+ *  Copyright (c) Linaro
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef QEMU_TARGET_INFO_H
+#define QEMU_TARGET_INFO_H
+
+/**
+ * target_cpu_type:
+ *
+ * Returns: target CPU base QOM type name (i.e. TYPE_X86_CPU).
+ */
+const char *target_cpu_type(void);
+
+#endif
diff --git a/meson.build b/meson.build
index c736a6f4c4..185c2fb0d1 100644
--- a/meson.build
+++ b/meson.build
@@ -3795,6 +3795,8 @@ endif
 common_ss.add(pagevary)
 specific_ss.add(files('page-target.c', 'page-vary-target.c'))
 
+specific_ss.add(files('target-info-stub.c'))
+
 subdir('backends')
 subdir('disas')
 subdir('migration')
diff --git a/target-info-stub.c b/target-info-stub.c
new file mode 100644
index 0000000000..e5d2195e89
--- /dev/null
+++ b/target-info-stub.c
@@ -0,0 +1,16 @@
+/*
+ * QEMU target info stubs (target specific)
+ *
+ *  Copyright (c) Linaro
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/target-info.h"
+#include "cpu.h"
+
+const char *target_cpu_type(void)
+{
+    return CPU_RESOLVING_TYPE;
+}

From 5e15bb7d66d63cbcd863b6b3f69d3fa6715fb75c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Sun, 23 Mar 2025 17:42:37 +0100
Subject: [PATCH 0348/2760] cpus: Replace CPU_RESOLVING_TYPE ->
 target_cpu_type()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Replace the target-specific CPU_RESOLVING_TYPE definition
by a call to the target-agnostic target_cpu_type() runtime
helper.

Since the big "cpu.h" is not required anymore in tcg-all.c,
remove it, using the tinier "cpu-param.h" header.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20250417165430.58213-3-philmd@linaro.org>
---
 accel/accel-target.c | 6 ++++--
 accel/tcg/tcg-all.c  | 5 +++--
 cpu-target.c         | 7 ++++---
 3 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/accel/accel-target.c b/accel/accel-target.c
index 33a539b4cb..08d4e450bd 100644
--- a/accel/accel-target.c
+++ b/accel/accel-target.c
@@ -25,6 +25,7 @@
 
 #include "qemu/osdep.h"
 #include "qemu/accel.h"
+#include "qemu/target-info.h"
 
 #include "cpu.h"
 #include "accel/accel-cpu-target.h"
@@ -88,17 +89,18 @@ static void accel_init_cpu_interfaces(AccelClass *ac)
     const char *ac_name; /* AccelClass name */
     char *acc_name;      /* AccelCPUClass name */
     ObjectClass *acc;    /* AccelCPUClass */
+    const char *cpu_resolving_type = target_cpu_type();
 
     ac_name = object_class_get_name(OBJECT_CLASS(ac));
     g_assert(ac_name != NULL);
 
-    acc_name = g_strdup_printf("%s-%s", ac_name, CPU_RESOLVING_TYPE);
+    acc_name = g_strdup_printf("%s-%s", ac_name, cpu_resolving_type);
     acc = object_class_by_name(acc_name);
     g_free(acc_name);
 
     if (acc) {
         object_class_foreach(accel_init_cpu_int_aux,
-                             CPU_RESOLVING_TYPE, false, acc);
+                             cpu_resolving_type, false, acc);
     }
 }
 
diff --git a/accel/tcg/tcg-all.c b/accel/tcg/tcg-all.c
index 40d7364979..0ce34ac912 100644
--- a/accel/tcg/tcg-all.c
+++ b/accel/tcg/tcg-all.c
@@ -35,6 +35,7 @@
 #include "qapi/qapi-types-common.h"
 #include "qapi/qapi-builtin-visit.h"
 #include "qemu/units.h"
+#include "qemu/target-info.h"
 #if defined(CONFIG_USER_ONLY)
 #include "hw/qdev-core.h"
 #else
@@ -43,7 +44,7 @@
 #endif
 #include "accel/tcg/cpu-ops.h"
 #include "internal-common.h"
-#include "cpu.h"
+#include "cpu-param.h"
 
 
 struct TCGState {
@@ -89,7 +90,7 @@ static int tcg_init_machine(MachineState *ms)
     unsigned max_threads = 1;
 
 #ifndef CONFIG_USER_ONLY
-    CPUClass *cc = CPU_CLASS(object_class_by_name(CPU_RESOLVING_TYPE));
+    CPUClass *cc = CPU_CLASS(object_class_by_name(target_cpu_type()));
     bool mttcg_supported = cc->tcg_ops->mttcg_supported;
 
     switch (s->mttcg_enabled) {
diff --git a/cpu-target.c b/cpu-target.c
index d68cbab5da..c2dd590d48 100644
--- a/cpu-target.c
+++ b/cpu-target.c
@@ -22,6 +22,7 @@
 #include "qapi/error.h"
 #include "qemu/error-report.h"
 #include "qemu/qemu-print.h"
+#include "qemu/target-info.h"
 #include "system/accel-ops.h"
 #include "system/cpus.h"
 #include "exec/cpu-common.h"
@@ -37,7 +38,7 @@ QEMU_BUILD_BUG_ON(offsetof(ArchCPU, env) != sizeof(CPUState));
 
 char *cpu_model_from_type(const char *typename)
 {
-    const char *suffix = "-" CPU_RESOLVING_TYPE;
+    g_autofree char *suffix = g_strdup_printf("-%s", target_cpu_type());
 
     if (!object_class_by_name(typename)) {
         return NULL;
@@ -63,7 +64,7 @@ const char *parse_cpu_option(const char *cpu_option)
         exit(1);
     }
 
-    oc = cpu_class_by_name(CPU_RESOLVING_TYPE, model_pieces[0]);
+    oc = cpu_class_by_name(target_cpu_type(), model_pieces[0]);
     if (oc == NULL) {
         error_report("unable to find CPU model '%s'", model_pieces[0]);
         g_strfreev(model_pieces);
@@ -92,7 +93,7 @@ static void cpu_list_entry(gpointer data, gpointer user_data)
 
 void list_cpus(void)
 {
-    CPUClass *cc = CPU_CLASS(object_class_by_name(CPU_RESOLVING_TYPE));
+    CPUClass *cc = CPU_CLASS(object_class_by_name(target_cpu_type()));
 
     if (cc->list_cpus) {
         cc->list_cpus();

From 2492008d0de0380ee910730dc10159a8e29b13a9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 2 Apr 2025 05:32:03 +0200
Subject: [PATCH 0349/2760] cpus: Move target-agnostic methods out of
 cpu-target.c
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Various methods of cpu-target.c don't use any target-specific
knowledge at all and can be built once in the target-agnostic
cpu-common.c file.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20250417165430.58213-4-philmd@linaro.org>
---
 cpu-target.c         | 77 +-------------------------------------------
 hw/core/cpu-common.c | 74 ++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 75 insertions(+), 76 deletions(-)

diff --git a/cpu-target.c b/cpu-target.c
index c2dd590d48..b5645ff0db 100644
--- a/cpu-target.c
+++ b/cpu-target.c
@@ -19,94 +19,19 @@
 
 #include "qemu/osdep.h"
 #include "cpu.h"
-#include "qapi/error.h"
-#include "qemu/error-report.h"
-#include "qemu/qemu-print.h"
-#include "qemu/target-info.h"
 #include "system/accel-ops.h"
 #include "system/cpus.h"
 #include "exec/cpu-common.h"
 #include "exec/tswap.h"
 #include "exec/replay-core.h"
 #include "exec/log.h"
-#include "accel/accel-cpu-target.h"
+#include "hw/core/cpu.h"
 #include "trace/trace-root.h"
 
 /* Validate correct placement of CPUArchState. */
 QEMU_BUILD_BUG_ON(offsetof(ArchCPU, parent_obj) != 0);
 QEMU_BUILD_BUG_ON(offsetof(ArchCPU, env) != sizeof(CPUState));
 
-char *cpu_model_from_type(const char *typename)
-{
-    g_autofree char *suffix = g_strdup_printf("-%s", target_cpu_type());
-
-    if (!object_class_by_name(typename)) {
-        return NULL;
-    }
-
-    if (g_str_has_suffix(typename, suffix)) {
-        return g_strndup(typename, strlen(typename) - strlen(suffix));
-    }
-
-    return g_strdup(typename);
-}
-
-const char *parse_cpu_option(const char *cpu_option)
-{
-    ObjectClass *oc;
-    CPUClass *cc;
-    gchar **model_pieces;
-    const char *cpu_type;
-
-    model_pieces = g_strsplit(cpu_option, ",", 2);
-    if (!model_pieces[0]) {
-        error_report("-cpu option cannot be empty");
-        exit(1);
-    }
-
-    oc = cpu_class_by_name(target_cpu_type(), model_pieces[0]);
-    if (oc == NULL) {
-        error_report("unable to find CPU model '%s'", model_pieces[0]);
-        g_strfreev(model_pieces);
-        exit(EXIT_FAILURE);
-    }
-
-    cpu_type = object_class_get_name(oc);
-    cc = CPU_CLASS(oc);
-    cc->parse_features(cpu_type, model_pieces[1], &error_fatal);
-    g_strfreev(model_pieces);
-    return cpu_type;
-}
-
-static void cpu_list_entry(gpointer data, gpointer user_data)
-{
-    CPUClass *cc = CPU_CLASS(OBJECT_CLASS(data));
-    const char *typename = object_class_get_name(OBJECT_CLASS(data));
-    g_autofree char *model = cpu_model_from_type(typename);
-
-    if (cc->deprecation_note) {
-        qemu_printf("  %s (deprecated)\n", model);
-    } else {
-        qemu_printf("  %s\n", model);
-    }
-}
-
-void list_cpus(void)
-{
-    CPUClass *cc = CPU_CLASS(object_class_by_name(target_cpu_type()));
-
-    if (cc->list_cpus) {
-        cc->list_cpus();
-    } else {
-        GSList *list;
-
-        list = object_class_get_list_sorted(TYPE_CPU, false);
-        qemu_printf("Available CPUs:\n");
-        g_slist_foreach(list, cpu_list_entry, NULL);
-        g_slist_free(list);
-    }
-}
-
 /* enable or disable single step mode. EXCP_DEBUG is returned by the
    CPU loop after each instruction */
 void cpu_single_step(CPUState *cpu, int enabled)
diff --git a/hw/core/cpu-common.c b/hw/core/cpu-common.c
index 1fb6ea3892..92c40b6bf8 100644
--- a/hw/core/cpu-common.c
+++ b/hw/core/cpu-common.c
@@ -25,6 +25,9 @@
 #include "qemu/log.h"
 #include "qemu/main-loop.h"
 #include "qemu/lockcnt.h"
+#include "qemu/error-report.h"
+#include "qemu/qemu-print.h"
+#include "qemu/target-info.h"
 #include "exec/log.h"
 #include "exec/gdbstub.h"
 #include "system/tcg.h"
@@ -152,6 +155,21 @@ ObjectClass *cpu_class_by_name(const char *typename, const char *cpu_model)
     return NULL;
 }
 
+char *cpu_model_from_type(const char *typename)
+{
+    g_autofree char *suffix = g_strdup_printf("-%s", target_cpu_type());
+
+    if (!object_class_by_name(typename)) {
+        return NULL;
+    }
+
+    if (g_str_has_suffix(typename, suffix)) {
+        return g_strndup(typename, strlen(typename) - strlen(suffix));
+    }
+
+    return g_strdup(typename);
+}
+
 static void cpu_common_parse_features(const char *typename, char *features,
                                       Error **errp)
 {
@@ -183,6 +201,33 @@ static void cpu_common_parse_features(const char *typename, char *features,
     }
 }
 
+const char *parse_cpu_option(const char *cpu_option)
+{
+    ObjectClass *oc;
+    CPUClass *cc;
+    gchar **model_pieces;
+    const char *cpu_type;
+
+    model_pieces = g_strsplit(cpu_option, ",", 2);
+    if (!model_pieces[0]) {
+        error_report("-cpu option cannot be empty");
+        exit(1);
+    }
+
+    oc = cpu_class_by_name(target_cpu_type(), model_pieces[0]);
+    if (oc == NULL) {
+        error_report("unable to find CPU model '%s'", model_pieces[0]);
+        g_strfreev(model_pieces);
+        exit(EXIT_FAILURE);
+    }
+
+    cpu_type = object_class_get_name(oc);
+    cc = CPU_CLASS(oc);
+    cc->parse_features(cpu_type, model_pieces[1], &error_fatal);
+    g_strfreev(model_pieces);
+    return cpu_type;
+}
+
 bool cpu_exec_realizefn(CPUState *cpu, Error **errp)
 {
     if (!accel_cpu_common_realize(cpu, errp)) {
@@ -359,3 +404,32 @@ static void cpu_register_types(void)
 }
 
 type_init(cpu_register_types)
+
+static void cpu_list_entry(gpointer data, gpointer user_data)
+{
+    CPUClass *cc = CPU_CLASS(OBJECT_CLASS(data));
+    const char *typename = object_class_get_name(OBJECT_CLASS(data));
+    g_autofree char *model = cpu_model_from_type(typename);
+
+    if (cc->deprecation_note) {
+        qemu_printf("  %s (deprecated)\n", model);
+    } else {
+        qemu_printf("  %s\n", model);
+    }
+}
+
+void list_cpus(void)
+{
+    CPUClass *cc = CPU_CLASS(object_class_by_name(target_cpu_type()));
+
+    if (cc->list_cpus) {
+        cc->list_cpus();
+    } else {
+        GSList *list;
+
+        list = object_class_get_list_sorted(TYPE_CPU, false);
+        qemu_printf("Available CPUs:\n");
+        g_slist_foreach(list, cpu_list_entry, NULL);
+        g_slist_free(list);
+    }
+}

From 64cbcf1d9782c340cf59868a1be97f0054c4ec44 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Sun, 23 Mar 2025 18:17:15 +0100
Subject: [PATCH 0350/2760] accel: Implement accel_init_ops_interfaces() for
 both system/user mode
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We want to build more common code, moving objects from meson's
specific_ss[] set to common_ss[]. Since the CONFIG_USER_ONLY
definitions isn't applied on the common_ss[] set, it is simpler
to add an empty accel_init_ops_interfaces() stub on user emulation,
removing any CONFIG_USER_ONLY use in accel-target.c.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20250417165430.58213-5-philmd@linaro.org>
---
 MAINTAINERS                                |  2 +-
 accel/{accel-system.h => accel-internal.h} |  8 ++++----
 accel/accel-system.c                       |  4 ++--
 accel/accel-target.c                       | 10 ++--------
 accel/accel-user.c                         |  6 ++++++
 5 files changed, 15 insertions(+), 15 deletions(-)
 rename accel/{accel-system.h => accel-internal.h} (56%)

diff --git a/MAINTAINERS b/MAINTAINERS
index 28b1e9ba44..07711cfd38 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -500,7 +500,7 @@ F: include/qemu/target-info*.h
 F: include/system/accel-*.h
 F: include/system/cpus.h
 F: include/accel/accel-cpu-target.h
-F: accel/accel-*.c
+F: accel/accel-*.?
 F: accel/Makefile.objs
 F: accel/stubs/Makefile.objs
 F: cpu-common.c
diff --git a/accel/accel-system.h b/accel/accel-internal.h
similarity index 56%
rename from accel/accel-system.h
rename to accel/accel-internal.h
index 2d37c73c97..03426aa21e 100644
--- a/accel/accel-system.h
+++ b/accel/accel-internal.h
@@ -1,5 +1,5 @@
 /*
- * QEMU System Emulation accel internal functions
+ * QEMU accel internal functions
  *
  * Copyright 2021 SUSE LLC
  *
@@ -7,9 +7,9 @@
  * See the COPYING file in the top-level directory.
  */
 
-#ifndef ACCEL_SYSTEM_H
-#define ACCEL_SYSTEM_H
+#ifndef ACCEL_INTERNAL_H
+#define ACCEL_INTERNAL_H
 
-void accel_system_init_ops_interfaces(AccelClass *ac);
+void accel_init_ops_interfaces(AccelClass *ac);
 
 #endif /* ACCEL_SYSTEM_H */
diff --git a/accel/accel-system.c b/accel/accel-system.c
index 5df49fbe83..a0f562ae9f 100644
--- a/accel/accel-system.c
+++ b/accel/accel-system.c
@@ -29,7 +29,7 @@
 #include "system/accel-ops.h"
 #include "system/cpus.h"
 #include "qemu/error-report.h"
-#include "accel-system.h"
+#include "accel-internal.h"
 
 int accel_init_machine(AccelState *accel, MachineState *ms)
 {
@@ -63,7 +63,7 @@ void accel_setup_post(MachineState *ms)
 }
 
 /* initialize the arch-independent accel operation interfaces */
-void accel_system_init_ops_interfaces(AccelClass *ac)
+void accel_init_ops_interfaces(AccelClass *ac)
 {
     const char *ac_name;
     char *ops_name;
diff --git a/accel/accel-target.c b/accel/accel-target.c
index 08d4e450bd..7f3bbf31a8 100644
--- a/accel/accel-target.c
+++ b/accel/accel-target.c
@@ -29,10 +29,7 @@
 
 #include "cpu.h"
 #include "accel/accel-cpu-target.h"
-
-#ifndef CONFIG_USER_ONLY
-#include "accel-system.h"
-#endif /* !CONFIG_USER_ONLY */
+#include "accel-internal.h"
 
 static const TypeInfo accel_type = {
     .name = TYPE_ACCEL,
@@ -106,10 +103,7 @@ static void accel_init_cpu_interfaces(AccelClass *ac)
 
 void accel_init_interfaces(AccelClass *ac)
 {
-#ifndef CONFIG_USER_ONLY
-    accel_system_init_ops_interfaces(ac);
-#endif /* !CONFIG_USER_ONLY */
-
+    accel_init_ops_interfaces(ac);
     accel_init_cpu_interfaces(ac);
 }
 
diff --git a/accel/accel-user.c b/accel/accel-user.c
index 22b6a1a1a8..7d192306a6 100644
--- a/accel/accel-user.c
+++ b/accel/accel-user.c
@@ -9,6 +9,12 @@
 
 #include "qemu/osdep.h"
 #include "qemu/accel.h"
+#include "accel-internal.h"
+
+void accel_init_ops_interfaces(AccelClass *ac)
+{
+    /* nothing */
+}
 
 AccelState *current_accel(void)
 {

From 559fe89916a3e000317ba7fa8ca495c620a17beb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Sun, 23 Mar 2025 18:29:31 +0100
Subject: [PATCH 0351/2760] accel: Include missing 'qemu/accel.h' header in
 accel-internal.h
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The "qemu/accel.h" header is implicitly pulled in. Include
it explicitly in order to avoid when refactoring unrelated
headers:

  accel/accel-internal.h:13:32: error: unknown type name 'AccelClass'
     13 | void accel_init_ops_interfaces(AccelClass *ac);
        |                                ^

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20250417165430.58213-6-philmd@linaro.org>
---
 accel/accel-internal.h | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/accel/accel-internal.h b/accel/accel-internal.h
index 03426aa21e..d3a4422cbf 100644
--- a/accel/accel-internal.h
+++ b/accel/accel-internal.h
@@ -10,6 +10,8 @@
 #ifndef ACCEL_INTERNAL_H
 #define ACCEL_INTERNAL_H
 
+#include "qemu/accel.h"
+
 void accel_init_ops_interfaces(AccelClass *ac);
 
 #endif /* ACCEL_SYSTEM_H */

From 44246e717018b30ee40db45fe2dd34765df61c7f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Sun, 23 Mar 2025 18:18:24 +0100
Subject: [PATCH 0352/2760] accel: Make AccelCPUClass structure target-agnostic
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Move the target-agnostic parts of "accel/accel-cpu-target.h"
to "accel/accel-cpu.h".

Doing so we need to include missing "hw/core/cpu.h" header
in "accel/accel-cpu.h" otherwise we get:

  include/accel/accel-cpu-target.h:39:28: error: unknown type name 'CPUClass'
     39 |     void (*cpu_class_init)(CPUClass *cc);
        |                            ^

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20250417165430.58213-7-philmd@linaro.org>
---
 MAINTAINERS                      |  2 +-
 accel/accel-target.c             |  1 -
 include/accel/accel-cpu-target.h | 12 +-----------
 include/accel/accel-cpu.h        | 23 +++++++++++++++++++++++
 4 files changed, 25 insertions(+), 13 deletions(-)
 create mode 100644 include/accel/accel-cpu.h

diff --git a/MAINTAINERS b/MAINTAINERS
index 07711cfd38..59d9712819 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -499,7 +499,7 @@ F: include/qemu/accel.h
 F: include/qemu/target-info*.h
 F: include/system/accel-*.h
 F: include/system/cpus.h
-F: include/accel/accel-cpu-target.h
+F: include/accel/accel-cpu*.h
 F: accel/accel-*.?
 F: accel/Makefile.objs
 F: accel/stubs/Makefile.objs
diff --git a/accel/accel-target.c b/accel/accel-target.c
index 7f3bbf31a8..82a29e6147 100644
--- a/accel/accel-target.c
+++ b/accel/accel-target.c
@@ -27,7 +27,6 @@
 #include "qemu/accel.h"
 #include "qemu/target-info.h"
 
-#include "cpu.h"
 #include "accel/accel-cpu-target.h"
 #include "accel-internal.h"
 
diff --git a/include/accel/accel-cpu-target.h b/include/accel/accel-cpu-target.h
index 37dde7fae3..6feb344e29 100644
--- a/include/accel/accel-cpu-target.h
+++ b/include/accel/accel-cpu-target.h
@@ -21,21 +21,11 @@
  */
 
 #include "qom/object.h"
+#include "accel/accel-cpu.h"
 #include "cpu.h"
 
 #define TYPE_ACCEL_CPU "accel-" CPU_RESOLVING_TYPE
 #define ACCEL_CPU_NAME(name) (name "-" TYPE_ACCEL_CPU)
-typedef struct AccelCPUClass AccelCPUClass;
 DECLARE_CLASS_CHECKERS(AccelCPUClass, ACCEL_CPU, TYPE_ACCEL_CPU)
 
-typedef struct AccelCPUClass {
-    /*< private >*/
-    ObjectClass parent_class;
-    /*< public >*/
-
-    void (*cpu_class_init)(CPUClass *cc);
-    void (*cpu_instance_init)(CPUState *cpu);
-    bool (*cpu_target_realize)(CPUState *cpu, Error **errp);
-} AccelCPUClass;
-
 #endif /* ACCEL_CPU_H */
diff --git a/include/accel/accel-cpu.h b/include/accel/accel-cpu.h
new file mode 100644
index 0000000000..9e7eede7c3
--- /dev/null
+++ b/include/accel/accel-cpu.h
@@ -0,0 +1,23 @@
+/*
+ * Accelerator interface, specializes CPUClass
+ *
+ * Copyright 2021 SUSE LLC
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef ACCEL_CPU_H
+#define ACCEL_CPU_H
+
+#include "qom/object.h"
+#include "hw/core/cpu.h"
+
+typedef struct AccelCPUClass {
+    ObjectClass parent_class;
+
+    void (*cpu_class_init)(CPUClass *cc);
+    void (*cpu_instance_init)(CPUState *cpu);
+    bool (*cpu_target_realize)(CPUState *cpu, Error **errp);
+} AccelCPUClass;
+
+#endif /* ACCEL_CPU_H */

From 802c4daf331339085823f2fc81917967da4b4c12 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Sun, 23 Mar 2025 18:20:40 +0100
Subject: [PATCH 0353/2760] accel: Move target-agnostic code from
 accel-target.c -> accel-common.c
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Various methods of accel-target.c don't use any target-specific
knowledge at all and can be built once in the target-agnostic
accel-common.c file.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20250417165430.58213-8-philmd@linaro.org>
---
 accel/accel-common.c | 142 +++++++++++++++++++++++++++++++++++++++++++
 accel/accel-target.c | 129 ---------------------------------------
 accel/meson.build    |   1 +
 3 files changed, 143 insertions(+), 129 deletions(-)
 create mode 100644 accel/accel-common.c

diff --git a/accel/accel-common.c b/accel/accel-common.c
new file mode 100644
index 0000000000..4894b98d64
--- /dev/null
+++ b/accel/accel-common.c
@@ -0,0 +1,142 @@
+/*
+ * QEMU accel class, components common to system emulation and user mode
+ *
+ * Copyright (c) 2003-2008 Fabrice Bellard
+ * Copyright (c) 2014 Red Hat Inc.
+ *
+ * SPDX-License-Identifier: MIT
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/accel.h"
+#include "qemu/target-info.h"
+#include "accel/accel-cpu.h"
+#include "accel-internal.h"
+
+/* Lookup AccelClass from opt_name. Returns NULL if not found */
+AccelClass *accel_find(const char *opt_name)
+{
+    char *class_name = g_strdup_printf(ACCEL_CLASS_NAME("%s"), opt_name);
+    AccelClass *ac = ACCEL_CLASS(module_object_class_by_name(class_name));
+    g_free(class_name);
+    return ac;
+}
+
+/* Return the name of the current accelerator */
+const char *current_accel_name(void)
+{
+    AccelClass *ac = ACCEL_GET_CLASS(current_accel());
+
+    return ac->name;
+}
+
+static void accel_init_cpu_int_aux(ObjectClass *klass, void *opaque)
+{
+    CPUClass *cc = CPU_CLASS(klass);
+    AccelCPUClass *accel_cpu = opaque;
+
+    /*
+     * The first callback allows accel-cpu to run initializations
+     * for the CPU, customizing CPU behavior according to the accelerator.
+     *
+     * The second one allows the CPU to customize the accel-cpu
+     * behavior according to the CPU.
+     *
+     * The second is currently only used by TCG, to specialize the
+     * TCGCPUOps depending on the CPU type.
+     */
+    cc->accel_cpu = accel_cpu;
+    if (accel_cpu->cpu_class_init) {
+        accel_cpu->cpu_class_init(cc);
+    }
+    if (cc->init_accel_cpu) {
+        cc->init_accel_cpu(accel_cpu, cc);
+    }
+}
+
+/* initialize the arch-specific accel CpuClass interfaces */
+static void accel_init_cpu_interfaces(AccelClass *ac)
+{
+    const char *ac_name; /* AccelClass name */
+    char *acc_name;      /* AccelCPUClass name */
+    ObjectClass *acc;    /* AccelCPUClass */
+    const char *cpu_resolving_type = target_cpu_type();
+
+    ac_name = object_class_get_name(OBJECT_CLASS(ac));
+    g_assert(ac_name != NULL);
+
+    acc_name = g_strdup_printf("%s-%s", ac_name, cpu_resolving_type);
+    acc = object_class_by_name(acc_name);
+    g_free(acc_name);
+
+    if (acc) {
+        object_class_foreach(accel_init_cpu_int_aux,
+                             cpu_resolving_type, false, acc);
+    }
+}
+
+void accel_init_interfaces(AccelClass *ac)
+{
+    accel_init_ops_interfaces(ac);
+    accel_init_cpu_interfaces(ac);
+}
+
+void accel_cpu_instance_init(CPUState *cpu)
+{
+    if (cpu->cc->accel_cpu && cpu->cc->accel_cpu->cpu_instance_init) {
+        cpu->cc->accel_cpu->cpu_instance_init(cpu);
+    }
+}
+
+bool accel_cpu_common_realize(CPUState *cpu, Error **errp)
+{
+    AccelState *accel = current_accel();
+    AccelClass *acc = ACCEL_GET_CLASS(accel);
+
+    /* target specific realization */
+    if (cpu->cc->accel_cpu
+        && cpu->cc->accel_cpu->cpu_target_realize
+        && !cpu->cc->accel_cpu->cpu_target_realize(cpu, errp)) {
+        return false;
+    }
+
+    /* generic realization */
+    if (acc->cpu_common_realize && !acc->cpu_common_realize(cpu, errp)) {
+        return false;
+    }
+
+    return true;
+}
+
+void accel_cpu_common_unrealize(CPUState *cpu)
+{
+    AccelState *accel = current_accel();
+    AccelClass *acc = ACCEL_GET_CLASS(accel);
+
+    /* generic unrealization */
+    if (acc->cpu_common_unrealize) {
+        acc->cpu_common_unrealize(cpu);
+    }
+}
+
+int accel_supported_gdbstub_sstep_flags(void)
+{
+    AccelState *accel = current_accel();
+    AccelClass *acc = ACCEL_GET_CLASS(accel);
+    if (acc->gdbstub_supported_sstep_flags) {
+        return acc->gdbstub_supported_sstep_flags();
+    }
+    return 0;
+}
+
+static const TypeInfo accel_types[] = {
+    {
+        .name           = TYPE_ACCEL,
+        .parent         = TYPE_OBJECT,
+        .class_size     = sizeof(AccelClass),
+        .instance_size  = sizeof(AccelState),
+        .abstract       = true,
+    },
+};
+
+DEFINE_TYPES(accel_types)
diff --git a/accel/accel-target.c b/accel/accel-target.c
index 82a29e6147..7fd392fbc4 100644
--- a/accel/accel-target.c
+++ b/accel/accel-target.c
@@ -24,135 +24,7 @@
  */
 
 #include "qemu/osdep.h"
-#include "qemu/accel.h"
-#include "qemu/target-info.h"
-
 #include "accel/accel-cpu-target.h"
-#include "accel-internal.h"
-
-static const TypeInfo accel_type = {
-    .name = TYPE_ACCEL,
-    .parent = TYPE_OBJECT,
-    .class_size = sizeof(AccelClass),
-    .instance_size = sizeof(AccelState),
-    .abstract = true,
-};
-
-/* Lookup AccelClass from opt_name. Returns NULL if not found */
-AccelClass *accel_find(const char *opt_name)
-{
-    char *class_name = g_strdup_printf(ACCEL_CLASS_NAME("%s"), opt_name);
-    AccelClass *ac = ACCEL_CLASS(module_object_class_by_name(class_name));
-    g_free(class_name);
-    return ac;
-}
-
-/* Return the name of the current accelerator */
-const char *current_accel_name(void)
-{
-    AccelClass *ac = ACCEL_GET_CLASS(current_accel());
-
-    return ac->name;
-}
-
-static void accel_init_cpu_int_aux(ObjectClass *klass, void *opaque)
-{
-    CPUClass *cc = CPU_CLASS(klass);
-    AccelCPUClass *accel_cpu = opaque;
-
-    /*
-     * The first callback allows accel-cpu to run initializations
-     * for the CPU, customizing CPU behavior according to the accelerator.
-     *
-     * The second one allows the CPU to customize the accel-cpu
-     * behavior according to the CPU.
-     *
-     * The second is currently only used by TCG, to specialize the
-     * TCGCPUOps depending on the CPU type.
-     */
-    cc->accel_cpu = accel_cpu;
-    if (accel_cpu->cpu_class_init) {
-        accel_cpu->cpu_class_init(cc);
-    }
-    if (cc->init_accel_cpu) {
-        cc->init_accel_cpu(accel_cpu, cc);
-    }
-}
-
-/* initialize the arch-specific accel CpuClass interfaces */
-static void accel_init_cpu_interfaces(AccelClass *ac)
-{
-    const char *ac_name; /* AccelClass name */
-    char *acc_name;      /* AccelCPUClass name */
-    ObjectClass *acc;    /* AccelCPUClass */
-    const char *cpu_resolving_type = target_cpu_type();
-
-    ac_name = object_class_get_name(OBJECT_CLASS(ac));
-    g_assert(ac_name != NULL);
-
-    acc_name = g_strdup_printf("%s-%s", ac_name, cpu_resolving_type);
-    acc = object_class_by_name(acc_name);
-    g_free(acc_name);
-
-    if (acc) {
-        object_class_foreach(accel_init_cpu_int_aux,
-                             cpu_resolving_type, false, acc);
-    }
-}
-
-void accel_init_interfaces(AccelClass *ac)
-{
-    accel_init_ops_interfaces(ac);
-    accel_init_cpu_interfaces(ac);
-}
-
-void accel_cpu_instance_init(CPUState *cpu)
-{
-    if (cpu->cc->accel_cpu && cpu->cc->accel_cpu->cpu_instance_init) {
-        cpu->cc->accel_cpu->cpu_instance_init(cpu);
-    }
-}
-
-bool accel_cpu_common_realize(CPUState *cpu, Error **errp)
-{
-    AccelState *accel = current_accel();
-    AccelClass *acc = ACCEL_GET_CLASS(accel);
-
-    /* target specific realization */
-    if (cpu->cc->accel_cpu
-        && cpu->cc->accel_cpu->cpu_target_realize
-        && !cpu->cc->accel_cpu->cpu_target_realize(cpu, errp)) {
-        return false;
-    }
-
-    /* generic realization */
-    if (acc->cpu_common_realize && !acc->cpu_common_realize(cpu, errp)) {
-        return false;
-    }
-
-    return true;
-}
-
-void accel_cpu_common_unrealize(CPUState *cpu)
-{
-    AccelState *accel = current_accel();
-    AccelClass *acc = ACCEL_GET_CLASS(accel);
-
-    /* generic unrealization */
-    if (acc->cpu_common_unrealize) {
-        acc->cpu_common_unrealize(cpu);
-    }
-}
-
-int accel_supported_gdbstub_sstep_flags(void)
-{
-    AccelState *accel = current_accel();
-    AccelClass *acc = ACCEL_GET_CLASS(accel);
-    if (acc->gdbstub_supported_sstep_flags) {
-        return acc->gdbstub_supported_sstep_flags();
-    }
-    return 0;
-}
 
 static const TypeInfo accel_cpu_type = {
     .name = TYPE_ACCEL_CPU,
@@ -163,7 +35,6 @@ static const TypeInfo accel_cpu_type = {
 
 static void register_accel_types(void)
 {
-    type_register_static(&accel_type);
     type_register_static(&accel_cpu_type);
 }
 
diff --git a/accel/meson.build b/accel/meson.build
index 5eaeb68338..52909314bf 100644
--- a/accel/meson.build
+++ b/accel/meson.build
@@ -1,3 +1,4 @@
+common_ss.add(files('accel-common.c'))
 specific_ss.add(files('accel-target.c'))
 system_ss.add(files('accel-system.c', 'accel-blocker.c'))
 user_ss.add(files('accel-user.c'))

From 3d881164d4fb2b0f6791cf28d9725926b8ded0d6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Sun, 23 Mar 2025 12:47:37 +0100
Subject: [PATCH 0354/2760] qemu: Convert target_name() to TargetInfo API
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Have target_name() be a target-agnostic method, dispatching
to a per-target TargetInfo singleton structure.
By default a stub singleton is used. No logical change
expected.

Inspired-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250424222112.36194-3-philmd@linaro.org>
---
 MAINTAINERS                     |  9 +++++++--
 cpu-target.c                    |  5 -----
 hw/core/machine-qmp-cmds.c      |  1 +
 include/hw/core/cpu.h           |  2 --
 include/qemu/target-info-impl.h | 26 ++++++++++++++++++++++++++
 include/qemu/target-info.h      |  7 +++++++
 meson.build                     |  1 +
 plugins/loader.c                |  2 +-
 system/vl.c                     |  2 +-
 target-info-stub.c              | 10 ++++++++++
 target-info.c                   | 16 ++++++++++++++++
 11 files changed, 70 insertions(+), 11 deletions(-)
 create mode 100644 include/qemu/target-info-impl.h
 create mode 100644 target-info.c

diff --git a/MAINTAINERS b/MAINTAINERS
index 59d9712819..f8fee87c70 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -496,7 +496,6 @@ F: include/exec/cpu*.h
 F: include/exec/exec-all.h
 F: include/exec/target_long.h
 F: include/qemu/accel.h
-F: include/qemu/target-info*.h
 F: include/system/accel-*.h
 F: include/system/cpus.h
 F: include/accel/accel-cpu*.h
@@ -505,7 +504,6 @@ F: accel/Makefile.objs
 F: accel/stubs/Makefile.objs
 F: cpu-common.c
 F: cpu-target.c
-F: target-info*.c
 F: system/cpus.c
 
 Apple Silicon HVF CPUs
@@ -1928,6 +1926,13 @@ F: tests/functional/test_empty_cpu_model.py
 F: tests/unit/test-smp-parse.c
 T: git https://gitlab.com/ehabkost/qemu.git machine-next
 
+TargetInfo API
+M: Pierrick Bouvier <pierrick.bouvier@linaro.org>
+M: Philippe Mathieu-Daudé <philmd@linaro.org>
+S: Supported
+F: include/qemu/target-info*.h
+F: target-info*.c
+
 Xtensa Machines
 ---------------
 sim
diff --git a/cpu-target.c b/cpu-target.c
index b5645ff0db..1c90a30759 100644
--- a/cpu-target.c
+++ b/cpu-target.c
@@ -91,8 +91,3 @@ bool target_big_endian(void)
 {
     return TARGET_BIG_ENDIAN;
 }
-
-const char *target_name(void)
-{
-    return TARGET_NAME;
-}
diff --git a/hw/core/machine-qmp-cmds.c b/hw/core/machine-qmp-cmds.c
index a5e635152d..d82043e1c6 100644
--- a/hw/core/machine-qmp-cmds.c
+++ b/hw/core/machine-qmp-cmds.c
@@ -19,6 +19,7 @@
 #include "qapi/qobject-input-visitor.h"
 #include "qapi/type-helpers.h"
 #include "qemu/uuid.h"
+#include "qemu/target-info.h"
 #include "qom/qom-qobject.h"
 #include "system/hostmem.h"
 #include "system/hw_accel.h"
diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index 2a02d4f078..12b2ff1f7d 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -1121,8 +1121,6 @@ bool cpu_exec_realizefn(CPUState *cpu, Error **errp);
 void cpu_exec_unrealizefn(CPUState *cpu);
 void cpu_exec_reset_hold(CPUState *cpu);
 
-const char *target_name(void);
-
 #ifdef COMPILING_PER_TARGET
 
 extern const VMStateDescription vmstate_cpu_common;
diff --git a/include/qemu/target-info-impl.h b/include/qemu/target-info-impl.h
new file mode 100644
index 0000000000..d30805f7f2
--- /dev/null
+++ b/include/qemu/target-info-impl.h
@@ -0,0 +1,26 @@
+/*
+ * QEMU TargetInfo structure definition
+ *
+ *  Copyright (c) Linaro
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef QEMU_TARGET_INFO_IMPL_H
+#define QEMU_TARGET_INFO_IMPL_H
+
+#include "qemu/target-info.h"
+
+typedef struct TargetInfo {
+    /* runtime equivalent of TARGET_NAME definition */
+    const char *target_name;
+} TargetInfo;
+
+/**
+ * target_info:
+ *
+ * Returns: The TargetInfo structure definition for this target binary.
+ */
+const TargetInfo *target_info(void);
+
+#endif
diff --git a/include/qemu/target-info.h b/include/qemu/target-info.h
index b4cc4888ca..58d4136897 100644
--- a/include/qemu/target-info.h
+++ b/include/qemu/target-info.h
@@ -9,6 +9,13 @@
 #ifndef QEMU_TARGET_INFO_H
 #define QEMU_TARGET_INFO_H
 
+/**
+ * target_name:
+ *
+ * Returns: Canonical target name (i.e. "i386").
+ */
+const char *target_name(void);
+
 /**
  * target_cpu_type:
  *
diff --git a/meson.build b/meson.build
index 185c2fb0d1..8ae70dbe45 100644
--- a/meson.build
+++ b/meson.build
@@ -3795,6 +3795,7 @@ endif
 common_ss.add(pagevary)
 specific_ss.add(files('page-target.c', 'page-vary-target.c'))
 
+common_ss.add(files('target-info.c'))
 specific_ss.add(files('target-info-stub.c'))
 
 subdir('backends')
diff --git a/plugins/loader.c b/plugins/loader.c
index 0d6e082e17..8f0d75c904 100644
--- a/plugins/loader.c
+++ b/plugins/loader.c
@@ -29,7 +29,7 @@
 #include "qemu/xxhash.h"
 #include "qemu/plugin.h"
 #include "qemu/memalign.h"
-#include "hw/core/cpu.h"
+#include "qemu/target-info.h"
 #include "exec/tb-flush.h"
 
 #include "plugin.h"
diff --git a/system/vl.c b/system/vl.c
index 4ab2001df7..520956f4a1 100644
--- a/system/vl.c
+++ b/system/vl.c
@@ -40,6 +40,7 @@
 #include "qemu/help_option.h"
 #include "qemu/hw-version.h"
 #include "qemu/uuid.h"
+#include "qemu/target-info.h"
 #include "system/reset.h"
 #include "system/runstate.h"
 #include "system/runstate-action.h"
@@ -79,7 +80,6 @@
 #include "hw/block/block.h"
 #include "hw/i386/x86.h"
 #include "hw/i386/pc.h"
-#include "hw/core/cpu.h"
 #include "migration/cpr.h"
 #include "migration/misc.h"
 #include "migration/snapshot.h"
diff --git a/target-info-stub.c b/target-info-stub.c
index e5d2195e89..773a10188c 100644
--- a/target-info-stub.c
+++ b/target-info-stub.c
@@ -8,8 +8,18 @@
 
 #include "qemu/osdep.h"
 #include "qemu/target-info.h"
+#include "qemu/target-info-impl.h"
 #include "cpu.h"
 
+static const TargetInfo target_info_stub = {
+    .target_name = TARGET_NAME,
+};
+
+const TargetInfo *target_info(void)
+{
+    return &target_info_stub;
+}
+
 const char *target_cpu_type(void)
 {
     return CPU_RESOLVING_TYPE;
diff --git a/target-info.c b/target-info.c
new file mode 100644
index 0000000000..84b18931e7
--- /dev/null
+++ b/target-info.c
@@ -0,0 +1,16 @@
+/*
+ * QEMU target info helpers
+ *
+ *  Copyright (c) Linaro
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/target-info.h"
+#include "qemu/target-info-impl.h"
+
+const char *target_name(void)
+{
+    return target_info()->target_name;
+}

From 2b689db0bedd24eda8b491cb1fcfb015dfec5a31 Mon Sep 17 00:00:00 2001
From: Denis Rastyogin <gerben@altlinux.org>
Date: Thu, 27 Mar 2025 19:24:23 +0300
Subject: [PATCH 0355/2760] qemu-img: improve queue depth validation in
 img_bench

This error was discovered by fuzzing qemu-img.

Currently, running `qemu-img bench -d 0` in img_bench is allowed,
which is a pointless operation and causes qemu-img to hang.

Signed-off-by: Denis Rastyogin <gerben@altlinux.org>
Message-ID: <20250327162423.25154-5-gerben@altlinux.org>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 qemu-img.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/qemu-img.c b/qemu-img.c
index 2044c22a4c..76ac5d3028 100644
--- a/qemu-img.c
+++ b/qemu-img.c
@@ -4571,7 +4571,7 @@ static int img_bench(int argc, char **argv)
         {
             unsigned long res;
 
-            if (qemu_strtoul(optarg, NULL, 0, &res) < 0 || res > INT_MAX) {
+            if (qemu_strtoul(optarg, NULL, 0, &res) <= 0 || res > INT_MAX) {
                 error_report("Invalid queue depth specified");
                 return 1;
             }

From a079836005fb92eb1fee19e59654b337a41fd0ff Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 24 Apr 2025 18:23:36 +0000
Subject: [PATCH 0356/2760] tcg/loongarch64: Fix vec_val computation in
 tcg_target_const_match
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Only use vece for a vector constant.  This avoids an assertion
failure in sextract64 when vece contains garbage.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/loongarch64/tcg-target.c.inc | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index cbd7642b58..740b7c264d 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -211,12 +211,14 @@ static bool tcg_target_const_match(int64_t val, int ct,
     if ((ct & TCG_CT_CONST_WSZ) && val == (type == TCG_TYPE_I32 ? 32 : 64)) {
         return true;
     }
-    int64_t vec_val = sextract64(val, 0, 8 << vece);
-    if ((ct & TCG_CT_CONST_VCMP) && -0x10 <= vec_val && vec_val <= 0x1f) {
-        return true;
-    }
-    if ((ct & TCG_CT_CONST_VADD) && -0x1f <= vec_val && vec_val <= 0x1f) {
-        return true;
+    if (ct & (TCG_CT_CONST_VCMP | TCG_CT_CONST_VADD)) {
+        int64_t vec_val = sextract64(val, 0, 8 << vece);
+        if ((ct & TCG_CT_CONST_VCMP) && -0x10 <= vec_val && vec_val <= 0x1f) {
+            return true;
+        }
+        if ((ct & TCG_CT_CONST_VADD) && -0x1f <= vec_val && vec_val <= 0x1f) {
+            return true;
+        }
     }
     return false;
 }

From 911f7328e9e9de80bf6b1a4697ecf83cc3661f5f Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 24 Apr 2025 18:45:28 +0000
Subject: [PATCH 0357/2760] tcg/loongarch64: Improve constraints for
 TCG_CT_CONST_VCMP
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Use the TCGCond given to tcg_target_const_match to exactly match
the supported constant.  Adjust the code generation to assume this
has been done -- recall that encode_*_insn contain assertions that
the constants are valid.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/loongarch64/tcg-target.c.inc | 38 ++++++++++++++++++--------------
 1 file changed, 21 insertions(+), 17 deletions(-)

diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index 740b7c264d..879f66f255 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -213,8 +213,18 @@ static bool tcg_target_const_match(int64_t val, int ct,
     }
     if (ct & (TCG_CT_CONST_VCMP | TCG_CT_CONST_VADD)) {
         int64_t vec_val = sextract64(val, 0, 8 << vece);
-        if ((ct & TCG_CT_CONST_VCMP) && -0x10 <= vec_val && vec_val <= 0x1f) {
-            return true;
+        if (ct & TCG_CT_CONST_VCMP) {
+            switch (cond) {
+            case TCG_COND_EQ:
+            case TCG_COND_LE:
+            case TCG_COND_LT:
+                return -0x10 <= vec_val && vec_val <= 0x0f;
+            case TCG_COND_LEU:
+            case TCG_COND_LTU:
+                return 0x00 <= vec_val && vec_val <= 0x1f;
+            default:
+                return false;
+            }
         }
         if ((ct & TCG_CT_CONST_VADD) && -0x1f <= vec_val && vec_val <= 0x1f) {
             return true;
@@ -2029,28 +2039,22 @@ static void tcg_out_vec_op(TCGContext *s, TCGOpcode opc,
                  * Try vseqi/vslei/vslti
                  */
                 int64_t value = sextract64(a2, 0, 8 << vece);
-                if ((cond == TCG_COND_EQ ||
-                     cond == TCG_COND_LE ||
-                     cond == TCG_COND_LT) &&
-                    (-0x10 <= value && value <= 0x0f)) {
+                switch (cond) {
+                case TCG_COND_EQ:
+                case TCG_COND_LE:
+                case TCG_COND_LT:
                     insn = cmp_vec_imm_insn[cond][lasx][vece];
                     tcg_out32(s, encode_vdvjsk5_insn(insn, a0, a1, value));
                     break;
-                } else if ((cond == TCG_COND_LEU ||
-                            cond == TCG_COND_LTU) &&
-                           (0x00 <= value && value <= 0x1f)) {
+                case TCG_COND_LEU:
+                case TCG_COND_LTU:
                     insn = cmp_vec_imm_insn[cond][lasx][vece];
                     tcg_out32(s, encode_vdvjuk5_insn(insn, a0, a1, value));
                     break;
+                default:
+                    g_assert_not_reached();
                 }
-
-                /*
-                 * Fallback to:
-                 * dupi_vec temp, a2
-                 * cmp_vec a0, a1, temp, cond
-                 */
-                tcg_out_dupi_vec(s, type, vece, TCG_VEC_TMP0, a2);
-                a2 = TCG_VEC_TMP0;
+                break;
             }
 
             insn = cmp_vec_insn[cond][lasx][vece];

From a3c1c579baf511a2b95f7b233187a981b6ef46ea Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 21 Apr 2025 11:05:29 -0700
Subject: [PATCH 0358/2760] tcg/optimize: Introduce opt_insert_{before,after}
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Consolidate the places we call tcg_op_insert_{before,after}
within the optimization pass.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 30 +++++++++++++++++++++---------
 1 file changed, 21 insertions(+), 9 deletions(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index f922f86a1d..a4d4ad3005 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -344,6 +344,18 @@ static TCGArg arg_new_temp(OptContext *ctx)
     return temp_arg(ts);
 }
 
+static TCGOp *opt_insert_after(OptContext *ctx, TCGOp *op,
+                               TCGOpcode opc, unsigned narg)
+{
+    return tcg_op_insert_after(ctx->tcg, op, opc, narg);
+}
+
+static TCGOp *opt_insert_before(OptContext *ctx, TCGOp *op,
+                                TCGOpcode opc, unsigned narg)
+{
+    return tcg_op_insert_before(ctx->tcg, op, opc, narg);
+}
+
 static bool tcg_opt_gen_mov(OptContext *ctx, TCGOp *op, TCGArg dst, TCGArg src)
 {
     TCGTemp *dst_ts = arg_temp(dst);
@@ -808,7 +820,7 @@ static int do_constant_folding_cond1(OptContext *ctx, TCGOp *op, TCGArg dest,
     if (!TCG_TARGET_HAS_tst) {
         TCGOpcode and_opc = (ctx->type == TCG_TYPE_I32
                              ? INDEX_op_and_i32 : INDEX_op_and_i64);
-        TCGOp *op2 = tcg_op_insert_before(ctx->tcg, op, and_opc, 3);
+        TCGOp *op2 = opt_insert_before(ctx, op, and_opc, 3);
         TCGArg tmp = arg_new_temp(ctx);
 
         op2->args[0] = tmp;
@@ -901,8 +913,8 @@ static int do_constant_folding_cond2(OptContext *ctx, TCGOp *op, TCGArg *args)
 
     /* Expand to AND with a temporary if no backend support. */
     if (!TCG_TARGET_HAS_tst && is_tst_cond(c)) {
-        TCGOp *op1 = tcg_op_insert_before(ctx->tcg, op, INDEX_op_and_i32, 3);
-        TCGOp *op2 = tcg_op_insert_before(ctx->tcg, op, INDEX_op_and_i32, 3);
+        TCGOp *op1 = opt_insert_before(ctx, op, INDEX_op_and_i32, 3);
+        TCGOp *op2 = opt_insert_before(ctx, op, INDEX_op_and_i32, 3);
         TCGArg t1 = arg_new_temp(ctx);
         TCGArg t2 = arg_new_temp(ctx);
 
@@ -1263,7 +1275,7 @@ static bool fold_addsub2(OptContext *ctx, TCGOp *op, bool add)
         rh = op->args[1];
 
         /* The proper opcode is supplied by tcg_opt_gen_mov. */
-        op2 = tcg_op_insert_before(ctx->tcg, op, 0, 2);
+        op2 = opt_insert_before(ctx, op, 0, 2);
 
         tcg_opt_gen_movi(ctx, op, rl, al);
         tcg_opt_gen_movi(ctx, op2, rh, ah);
@@ -2096,7 +2108,7 @@ static bool fold_multiply2(OptContext *ctx, TCGOp *op)
         rh = op->args[1];
 
         /* The proper opcode is supplied by tcg_opt_gen_mov. */
-        op2 = tcg_op_insert_before(ctx->tcg, op, 0, 2);
+        op2 = opt_insert_before(ctx, op, 0, 2);
 
         tcg_opt_gen_movi(ctx, op, rl, l);
         tcg_opt_gen_movi(ctx, op2, rh, h);
@@ -2406,7 +2418,7 @@ static void fold_setcond_tst_pow2(OptContext *ctx, TCGOp *op, bool neg)
         op->args[3] = 1;
     } else {
         if (sh) {
-            op2 = tcg_op_insert_before(ctx->tcg, op, shr_opc, 3);
+            op2 = opt_insert_before(ctx, op, shr_opc, 3);
             op2->args[0] = ret;
             op2->args[1] = src1;
             op2->args[2] = arg_new_constant(ctx, sh);
@@ -2418,17 +2430,17 @@ static void fold_setcond_tst_pow2(OptContext *ctx, TCGOp *op, bool neg)
     }
 
     if (neg && inv) {
-        op2 = tcg_op_insert_after(ctx->tcg, op, sub_opc, 3);
+        op2 = opt_insert_after(ctx, op, sub_opc, 3);
         op2->args[0] = ret;
         op2->args[1] = ret;
         op2->args[2] = arg_new_constant(ctx, 1);
     } else if (inv) {
-        op2 = tcg_op_insert_after(ctx->tcg, op, xor_opc, 3);
+        op2 = opt_insert_after(ctx, op, xor_opc, 3);
         op2->args[0] = ret;
         op2->args[1] = ret;
         op2->args[2] = arg_new_constant(ctx, 1);
     } else if (neg) {
-        op2 = tcg_op_insert_after(ctx->tcg, op, neg_opc, 2);
+        op2 = opt_insert_after(ctx, op, neg_opc, 2);
         op2->args[0] = ret;
         op2->args[1] = ret;
     }

From cf5c9f697f2025880e8555467ddb6debc6349cd8 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 21 Jan 2025 20:34:41 -0800
Subject: [PATCH 0359/2760] tcg: Add TCGType to tcg_op_insert_{after,before}
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We cannot rely on the value copied from TCGOP_TYPE(op), because
the relevant op could be typeless, such as INDEX_op_call.

Fixes: fb744ece3a78 ("tcg: Copy TCGOP_TYPE in tcg_op_insert_{after,before}")
Suggested-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c     |  4 ++--
 tcg/tcg-internal.h |  4 ++--
 tcg/tcg.c          | 17 ++++++++++-------
 3 files changed, 14 insertions(+), 11 deletions(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index a4d4ad3005..3bd4ee4d58 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -347,13 +347,13 @@ static TCGArg arg_new_temp(OptContext *ctx)
 static TCGOp *opt_insert_after(OptContext *ctx, TCGOp *op,
                                TCGOpcode opc, unsigned narg)
 {
-    return tcg_op_insert_after(ctx->tcg, op, opc, narg);
+    return tcg_op_insert_after(ctx->tcg, op, opc, ctx->type, narg);
 }
 
 static TCGOp *opt_insert_before(OptContext *ctx, TCGOp *op,
                                 TCGOpcode opc, unsigned narg)
 {
-    return tcg_op_insert_before(ctx->tcg, op, opc, narg);
+    return tcg_op_insert_before(ctx->tcg, op, opc, ctx->type, narg);
 }
 
 static bool tcg_opt_gen_mov(OptContext *ctx, TCGOp *op, TCGArg dst, TCGArg src)
diff --git a/tcg/tcg-internal.h b/tcg/tcg-internal.h
index ff85fb23fa..d6a12afe06 100644
--- a/tcg/tcg-internal.h
+++ b/tcg/tcg-internal.h
@@ -107,8 +107,8 @@ void vec_gen_6(TCGOpcode opc, TCGType type, unsigned vece, TCGArg r,
                TCGArg a, TCGArg b, TCGArg c, TCGArg d, TCGArg e);
 
 TCGOp *tcg_op_insert_before(TCGContext *s, TCGOp *op,
-                            TCGOpcode opc, unsigned nargs);
+                            TCGOpcode, TCGType, unsigned nargs);
 TCGOp *tcg_op_insert_after(TCGContext *s, TCGOp *op,
-                           TCGOpcode opc, unsigned nargs);
+                           TCGOpcode, TCGType, unsigned nargs);
 
 #endif /* TCG_INTERNAL_H */
diff --git a/tcg/tcg.c b/tcg/tcg.c
index ec7f6743d7..198d6181d9 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -3449,21 +3449,21 @@ TCGOp *tcg_emit_op(TCGOpcode opc, unsigned nargs)
 }
 
 TCGOp *tcg_op_insert_before(TCGContext *s, TCGOp *old_op,
-                            TCGOpcode opc, unsigned nargs)
+                            TCGOpcode opc, TCGType type, unsigned nargs)
 {
     TCGOp *new_op = tcg_op_alloc(opc, nargs);
 
-    TCGOP_TYPE(new_op) = TCGOP_TYPE(old_op);
+    TCGOP_TYPE(new_op) = type;
     QTAILQ_INSERT_BEFORE(old_op, new_op, link);
     return new_op;
 }
 
 TCGOp *tcg_op_insert_after(TCGContext *s, TCGOp *old_op,
-                           TCGOpcode opc, unsigned nargs)
+                           TCGOpcode opc, TCGType type, unsigned nargs)
 {
     TCGOp *new_op = tcg_op_alloc(opc, nargs);
 
-    TCGOP_TYPE(new_op) = TCGOP_TYPE(old_op);
+    TCGOP_TYPE(new_op) = type;
     QTAILQ_INSERT_AFTER(&s->ops, old_op, new_op, link);
     return new_op;
 }
@@ -4214,7 +4214,8 @@ liveness_pass_2(TCGContext *s)
                 TCGOpcode lopc = (arg_ts->type == TCG_TYPE_I32
                                   ? INDEX_op_ld_i32
                                   : INDEX_op_ld_i64);
-                TCGOp *lop = tcg_op_insert_before(s, op, lopc, 3);
+                TCGOp *lop = tcg_op_insert_before(s, op, lopc,
+                                                  arg_ts->type, 3);
 
                 lop->args[0] = temp_arg(dir_ts);
                 lop->args[1] = temp_arg(arg_ts->mem_base);
@@ -4277,7 +4278,8 @@ liveness_pass_2(TCGContext *s)
                     TCGOpcode sopc = (arg_ts->type == TCG_TYPE_I32
                                       ? INDEX_op_st_i32
                                       : INDEX_op_st_i64);
-                    TCGOp *sop = tcg_op_insert_after(s, op, sopc, 3);
+                    TCGOp *sop = tcg_op_insert_after(s, op, sopc,
+                                                     arg_ts->type, 3);
                     TCGTemp *out_ts = dir_ts;
 
                     if (IS_DEAD_ARG(0)) {
@@ -4313,7 +4315,8 @@ liveness_pass_2(TCGContext *s)
                     TCGOpcode sopc = (arg_ts->type == TCG_TYPE_I32
                                       ? INDEX_op_st_i32
                                       : INDEX_op_st_i64);
-                    TCGOp *sop = tcg_op_insert_after(s, op, sopc, 3);
+                    TCGOp *sop = tcg_op_insert_after(s, op, sopc,
+                                                     arg_ts->type, 3);
 
                     sop->args[0] = temp_arg(dir_ts);
                     sop->args[1] = temp_arg(arg_ts->mem_base);

From 5500bd9e2ec5ec85858fcca06c04a57337aa14c7 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 3 Jan 2025 14:55:56 -0800
Subject: [PATCH 0360/2760] tcg: Add all_outop[]
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add infrastructure for more consolidated output of opcodes.
The base structure allows for constraints to be either static
or dynamic, and for the existence of those constraints to
replace TCG_TARGET_HAS_* and the bulk of tcg_op_supported.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tcg.c | 76 +++++++++++++++++++++++++++++++++++++++++++++++++------
 1 file changed, 68 insertions(+), 8 deletions(-)

diff --git a/tcg/tcg.c b/tcg/tcg.c
index 198d6181d9..5090cdb3c6 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -861,6 +861,7 @@ static int tcg_out_pool_finalize(TCGContext *s)
 #define C_N1_O1_I4(O1, O2, I1, I2, I3, I4) C_PFX6(c_n1_o1_i4_, O1, O2, I1, I2, I3, I4),
 
 typedef enum {
+    C_Dynamic = -2,
     C_NotImplemented = -1,
 #include "tcg-target-con-set.h"
 } TCGConstraintSetIndex;
@@ -954,6 +955,29 @@ static const TCGConstraintSet constraint_sets[] = {
 #define C_O2_I4(O1, O2, I1, I2, I3, I4) C_PFX6(c_o2_i4_, O1, O2, I1, I2, I3, I4)
 #define C_N1_O1_I4(O1, O2, I1, I2, I3, I4) C_PFX6(c_n1_o1_i4_, O1, O2, I1, I2, I3, I4)
 
+/*
+ * TCGOutOp is the base class for a set of structures that describe how
+ * to generate code for a given TCGOpcode.
+ *
+ * @static_constraint:
+ *   C_NotImplemented: The TCGOpcode is not supported by the backend.
+ *   C_Dynamic:        Use @dynamic_constraint to select a constraint set
+ *                     based on any of @type, @flags, or host isa.
+ *   Otherwise:        The register allocation constrains for the TCGOpcode.
+ *
+ * Subclasses of TCGOutOp will define a set of output routines that may
+ * be used.  Such routines will often be selected by the set of registers
+ * and constants that come out of register allocation.  The set of
+ * routines that are provided will guide the set of constraints that are
+ * legal.  In particular, assume that tcg_optimize() has done its job in
+ * swapping commutative operands and folding operations for which all
+ * operands are constant.
+ */
+typedef struct TCGOutOp {
+    TCGConstraintSetIndex static_constraint;
+    TCGConstraintSetIndex (*dynamic_constraint)(TCGType type, unsigned flags);
+} TCGOutOp;
+
 #include "tcg-target.c.inc"
 
 #ifndef CONFIG_TCG_INTERPRETER
@@ -963,6 +987,10 @@ QEMU_BUILD_BUG_ON((int)(offsetof(CPUNegativeOffsetState, tlb.f[0]) -
                   < MIN_TLB_MASK_TABLE_OFS);
 #endif
 
+/* Register allocation descriptions for every TCGOpcode. */
+static const TCGOutOp * const all_outop[NB_OPS] = {
+};
+
 /*
  * All TCG threads except the parent (i.e. the one that called tcg_context_init
  * and registered the target's TCG globals) must register with this function
@@ -2416,8 +2444,32 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
         return has_type && TCG_TARGET_HAS_cmpsel_vec;
 
     default:
-        tcg_debug_assert(op > INDEX_op_last_generic && op < NB_OPS);
+        if (op < INDEX_op_last_generic) {
+            const TCGOutOp *outop;
+            TCGConstraintSetIndex con_set;
+
+            if (!has_type) {
+                return false;
+            }
+
+            outop = all_outop[op];
+            tcg_debug_assert(outop != NULL);
+
+            con_set = outop->static_constraint;
+            if (con_set == C_Dynamic) {
+                con_set = outop->dynamic_constraint(type, flags);
+            }
+            if (con_set >= 0) {
+                return true;
+            }
+            tcg_debug_assert(con_set == C_NotImplemented);
+            return false;
+        }
+        tcg_debug_assert(op < NB_OPS);
         return true;
+
+    case INDEX_op_last_generic:
+        g_assert_not_reached();
     }
 }
 
@@ -3335,19 +3387,27 @@ static void process_constraint_sets(void)
 
 static const TCGArgConstraint *opcode_args_ct(const TCGOp *op)
 {
-    const TCGOpDef *def = &tcg_op_defs[op->opc];
+    TCGOpcode opc = op->opc;
+    TCGType type = TCGOP_TYPE(op);
+    unsigned flags = TCGOP_FLAGS(op);
+    const TCGOpDef *def = &tcg_op_defs[opc];
+    const TCGOutOp *outop = all_outop[opc];
     TCGConstraintSetIndex con_set;
 
-#ifdef CONFIG_DEBUG_TCG
-    assert(tcg_op_supported(op->opc, TCGOP_TYPE(op), TCGOP_FLAGS(op)));
-#endif
-
     if (def->flags & TCG_OPF_NOT_PRESENT) {
         return empty_cts;
     }
 
-    con_set = tcg_target_op_def(op->opc, TCGOP_TYPE(op), TCGOP_FLAGS(op));
-    tcg_debug_assert(con_set >= 0 && con_set < ARRAY_SIZE(constraint_sets));
+    if (outop) {
+        con_set = outop->static_constraint;
+        if (con_set == C_Dynamic) {
+            con_set = outop->dynamic_constraint(type, flags);
+        }
+    } else {
+        con_set = tcg_target_op_def(opc, type, flags);
+    }
+    tcg_debug_assert(con_set >= 0);
+    tcg_debug_assert(con_set < ARRAY_SIZE(constraint_sets));
 
     /* The constraint arguments must match TCGOpcode arguments. */
     tcg_debug_assert(constraint_sets[con_set].nb_oargs == def->nb_oargs);

From 2225fa242c5d95c5cd83bb6f8566d43dd7a00211 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 22 Feb 2025 09:36:21 -0800
Subject: [PATCH 0361/2760] tcg: Use extract2 for cross-word 64-bit extract on
 32-bit host
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tcg-op.c | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index fec6d678a2..f68c4f9702 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -2804,9 +2804,18 @@ void tcg_gen_extract_i64(TCGv_i64 ret, TCGv_i64 arg,
             tcg_gen_movi_i32(TCGV_HIGH(ret), 0);
             return;
         }
-        /* The field is split across two words.  One double-word
-           shift is better than two double-word shifts.  */
-        goto do_shift_and;
+
+        /* The field is split across two words. */
+        tcg_gen_extract2_i32(TCGV_LOW(ret), TCGV_LOW(arg),
+                             TCGV_HIGH(arg), ofs);
+        if (len <= 32) {
+            tcg_gen_extract_i32(TCGV_LOW(ret), TCGV_LOW(ret), 0, len);
+            tcg_gen_movi_i32(TCGV_HIGH(ret), 0);
+        } else {
+            tcg_gen_extract_i32(TCGV_HIGH(ret), TCGV_HIGH(arg),
+                                ofs, len - 32);
+        }
+        return;
     }
 
     if (TCG_TARGET_extract_valid(TCG_TYPE_I64, ofs, len)) {
@@ -2844,7 +2853,6 @@ void tcg_gen_extract_i64(TCGv_i64 ret, TCGv_i64 arg,
        so that we get ext8u, ext16u, and ext32u.  */
     switch (len) {
     case 1 ... 8: case 16: case 32:
-    do_shift_and:
         tcg_gen_shri_i64(ret, arg, ofs);
         tcg_gen_andi_i64(ret, ret, (1ull << len) - 1);
         break;

From 48e8de684aff7ad112aafcf74f776d2a66ef192e Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 26 Dec 2024 12:01:57 -0800
Subject: [PATCH 0362/2760] tcg: Remove INDEX_op_ext{8,16,32}*
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Use the fully general extract opcodes instead.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 docs/devel/tcg-ops.rst           |  14 --
 include/tcg/tcg-opc.h            |  10 -
 tcg/aarch64/tcg-target-has.h     |  10 -
 tcg/aarch64/tcg-target.c.inc     |  22 +-
 tcg/arm/tcg-target-has.h         |   4 -
 tcg/arm/tcg-target.c.inc         |   7 -
 tcg/i386/tcg-target-has.h        |  10 -
 tcg/i386/tcg-target.c.inc        |  24 +-
 tcg/loongarch64/tcg-target-has.h |  10 -
 tcg/loongarch64/tcg-target.c.inc |  22 +-
 tcg/mips/tcg-target-has.h        |  13 -
 tcg/mips/tcg-target.c.inc        |  20 +-
 tcg/optimize.c                   |  61 +----
 tcg/ppc/tcg-target-has.h         |  12 -
 tcg/ppc/tcg-target.c.inc         |  17 +-
 tcg/riscv/tcg-target-has.h       |  10 -
 tcg/riscv/tcg-target.c.inc       |  22 +-
 tcg/s390x/tcg-target-has.h       |  10 -
 tcg/s390x/tcg-target.c.inc       |  22 +-
 tcg/sparc64/tcg-target-has.h     |  10 -
 tcg/sparc64/tcg-target.c.inc     |  14 +-
 tcg/tcg-has.h                    |   6 -
 tcg/tcg-op.c                     | 414 +++++++------------------------
 tcg/tcg.c                        |  46 ----
 tcg/tci.c                        |  36 ---
 tcg/tci/tcg-target-has.h         |  10 -
 tcg/tci/tcg-target.c.inc         | 102 +++-----
 27 files changed, 135 insertions(+), 823 deletions(-)

diff --git a/docs/devel/tcg-ops.rst b/docs/devel/tcg-ops.rst
index 688984fd39..3db7b81637 100644
--- a/docs/devel/tcg-ops.rst
+++ b/docs/devel/tcg-ops.rst
@@ -396,20 +396,6 @@ Misc
      - | *t0* = *t1*
        | Move *t1* to *t0* (both operands must have the same type).
 
-   * - ext8s_i32/i64 *t0*, *t1*
-
-       ext8u_i32/i64 *t0*, *t1*
-
-       ext16s_i32/i64 *t0*, *t1*
-
-       ext16u_i32/i64 *t0*, *t1*
-
-       ext32s_i64 *t0*, *t1*
-
-       ext32u_i64 *t0*, *t1*
-
-     - | 8, 16 or 32 bit sign/zero extension (both operands must have the same type)
-
    * - bswap16_i32/i64 *t0*, *t1*, *flags*
 
      - | 16 bit byte swap on the low bits of a 32/64 bit input.
diff --git a/include/tcg/tcg-opc.h b/include/tcg/tcg-opc.h
index 5bf78b0764..c26cffaa3f 100644
--- a/include/tcg/tcg-opc.h
+++ b/include/tcg/tcg-opc.h
@@ -85,10 +85,6 @@ DEF(mulsh_i32, 1, 2, 0, 0)
 DEF(brcond2_i32, 0, 4, 2, TCG_OPF_BB_END | TCG_OPF_COND_BRANCH)
 DEF(setcond2_i32, 1, 4, 1, 0)
 
-DEF(ext8s_i32, 1, 1, 0, 0)
-DEF(ext16s_i32, 1, 1, 0, 0)
-DEF(ext8u_i32, 1, 1, 0, 0)
-DEF(ext16u_i32, 1, 1, 0, 0)
 DEF(bswap16_i32, 1, 1, 1, 0)
 DEF(bswap32_i32, 1, 1, 1, 0)
 DEF(not_i32, 1, 1, 0, 0)
@@ -149,12 +145,6 @@ DEF(extrl_i64_i32, 1, 1, 0, 0)
 DEF(extrh_i64_i32, 1, 1, 0, 0)
 
 DEF(brcond_i64, 0, 2, 2, TCG_OPF_BB_END | TCG_OPF_COND_BRANCH)
-DEF(ext8s_i64, 1, 1, 0, 0)
-DEF(ext16s_i64, 1, 1, 0, 0)
-DEF(ext32s_i64, 1, 1, 0, 0)
-DEF(ext8u_i64, 1, 1, 0, 0)
-DEF(ext16u_i64, 1, 1, 0, 0)
-DEF(ext32u_i64, 1, 1, 0, 0)
 DEF(bswap16_i64, 1, 1, 1, 0)
 DEF(bswap32_i64, 1, 1, 1, 0)
 DEF(bswap64_i64, 1, 1, 1, 0)
diff --git a/tcg/aarch64/tcg-target-has.h b/tcg/aarch64/tcg-target-has.h
index 39f01c14cd..bfd587c0fc 100644
--- a/tcg/aarch64/tcg-target-has.h
+++ b/tcg/aarch64/tcg-target-has.h
@@ -15,10 +15,6 @@
 /* optional instructions */
 #define TCG_TARGET_HAS_div_i32          1
 #define TCG_TARGET_HAS_rem_i32          1
-#define TCG_TARGET_HAS_ext8s_i32        1
-#define TCG_TARGET_HAS_ext16s_i32       1
-#define TCG_TARGET_HAS_ext8u_i32        1
-#define TCG_TARGET_HAS_ext16u_i32       1
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
 #define TCG_TARGET_HAS_not_i32          1
@@ -44,12 +40,6 @@
 
 #define TCG_TARGET_HAS_div_i64          1
 #define TCG_TARGET_HAS_rem_i64          1
-#define TCG_TARGET_HAS_ext8s_i64        1
-#define TCG_TARGET_HAS_ext16s_i64       1
-#define TCG_TARGET_HAS_ext32s_i64       1
-#define TCG_TARGET_HAS_ext8u_i64        1
-#define TCG_TARGET_HAS_ext16u_i64       1
-#define TCG_TARGET_HAS_ext32u_i64       1
 #define TCG_TARGET_HAS_bswap16_i64      1
 #define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1
diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index 4645242d85..b8b26c1c93 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -2493,17 +2493,7 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType ext,
     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
-    case INDEX_op_ext8s_i32:  /* Always emitted via tcg_reg_alloc_op.  */
-    case INDEX_op_ext8s_i64:
-    case INDEX_op_ext8u_i32:
-    case INDEX_op_ext8u_i64:
-    case INDEX_op_ext16s_i64:
-    case INDEX_op_ext16s_i32:
-    case INDEX_op_ext16u_i64:
-    case INDEX_op_ext16u_i32:
-    case INDEX_op_ext32s_i64:
-    case INDEX_op_ext32u_i64:
-    case INDEX_op_ext_i32_i64:
+    case INDEX_op_ext_i32_i64:  /* Always emitted via tcg_reg_alloc_op.  */
     case INDEX_op_extu_i32_i64:
     case INDEX_op_extrl_i64_i32:
     default:
@@ -2979,16 +2969,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_bswap16_i64:
     case INDEX_op_bswap32_i64:
     case INDEX_op_bswap64_i64:
-    case INDEX_op_ext8s_i32:
-    case INDEX_op_ext16s_i32:
-    case INDEX_op_ext8u_i32:
-    case INDEX_op_ext16u_i32:
-    case INDEX_op_ext8s_i64:
-    case INDEX_op_ext16s_i64:
-    case INDEX_op_ext32s_i64:
-    case INDEX_op_ext8u_i64:
-    case INDEX_op_ext16u_i64:
-    case INDEX_op_ext32u_i64:
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
     case INDEX_op_extract_i32:
diff --git a/tcg/arm/tcg-target-has.h b/tcg/arm/tcg-target-has.h
index e3510a8f7a..8398c80c8e 100644
--- a/tcg/arm/tcg-target-has.h
+++ b/tcg/arm/tcg-target-has.h
@@ -24,10 +24,6 @@ extern bool use_neon_instructions;
 #endif
 
 /* optional instructions */
-#define TCG_TARGET_HAS_ext8s_i32        1
-#define TCG_TARGET_HAS_ext16s_i32       1
-#define TCG_TARGET_HAS_ext8u_i32        0 /* and r0, r1, #0xff */
-#define TCG_TARGET_HAS_ext16u_i32       1
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
 #define TCG_TARGET_HAS_not_i32          1
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index cec3d761d4..0e48f790f9 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -2113,10 +2113,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
-    case INDEX_op_ext8s_i32:  /* Always emitted via tcg_reg_alloc_op.  */
-    case INDEX_op_ext8u_i32:
-    case INDEX_op_ext16s_i32:
-    case INDEX_op_ext16u_i32:
     default:
         g_assert_not_reached();
     }
@@ -2138,9 +2134,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_not_i32:
     case INDEX_op_bswap16_i32:
     case INDEX_op_bswap32_i32:
-    case INDEX_op_ext8s_i32:
-    case INDEX_op_ext16s_i32:
-    case INDEX_op_ext16u_i32:
     case INDEX_op_extract_i32:
     case INDEX_op_sextract_i32:
         return C_O1_I1(r, r);
diff --git a/tcg/i386/tcg-target-has.h b/tcg/i386/tcg-target-has.h
index 63768ff058..bbf55c86b6 100644
--- a/tcg/i386/tcg-target-has.h
+++ b/tcg/i386/tcg-target-has.h
@@ -28,10 +28,6 @@
 /* optional instructions */
 #define TCG_TARGET_HAS_div2_i32         1
 #define TCG_TARGET_HAS_rot_i32          1
-#define TCG_TARGET_HAS_ext8s_i32        1
-#define TCG_TARGET_HAS_ext16s_i32       1
-#define TCG_TARGET_HAS_ext8u_i32        1
-#define TCG_TARGET_HAS_ext16u_i32       1
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
 #define TCG_TARGET_HAS_not_i32          1
@@ -57,12 +53,6 @@
 #define TCG_TARGET_HAS_extr_i64_i32     1
 #define TCG_TARGET_HAS_div2_i64         1
 #define TCG_TARGET_HAS_rot_i64          1
-#define TCG_TARGET_HAS_ext8s_i64        1
-#define TCG_TARGET_HAS_ext16s_i64       1
-#define TCG_TARGET_HAS_ext32s_i64       1
-#define TCG_TARGET_HAS_ext8u_i64        1
-#define TCG_TARGET_HAS_ext16u_i64       1
-#define TCG_TARGET_HAS_ext32u_i64       1
 #define TCG_TARGET_HAS_bswap16_i64      1
 #define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index 33d303a123..02024018cb 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -3016,17 +3016,7 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
-    case INDEX_op_ext8s_i32:  /* Always emitted via tcg_reg_alloc_op.  */
-    case INDEX_op_ext8s_i64:
-    case INDEX_op_ext8u_i32:
-    case INDEX_op_ext8u_i64:
-    case INDEX_op_ext16s_i32:
-    case INDEX_op_ext16s_i64:
-    case INDEX_op_ext16u_i32:
-    case INDEX_op_ext16u_i64:
-    case INDEX_op_ext32s_i64:
-    case INDEX_op_ext32u_i64:
-    case INDEX_op_ext_i32_i64:
+    case INDEX_op_ext_i32_i64:  /* Always emitted via tcg_reg_alloc_op.  */
     case INDEX_op_extu_i32_i64:
     case INDEX_op_extrl_i64_i32:
     default:
@@ -3663,18 +3653,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_extrh_i64_i32:
         return C_O1_I1(r, 0);
 
-    case INDEX_op_ext8s_i32:
-    case INDEX_op_ext8s_i64:
-    case INDEX_op_ext8u_i32:
-    case INDEX_op_ext8u_i64:
-        return C_O1_I1(r, q);
-
-    case INDEX_op_ext16s_i32:
-    case INDEX_op_ext16s_i64:
-    case INDEX_op_ext16u_i32:
-    case INDEX_op_ext16u_i64:
-    case INDEX_op_ext32s_i64:
-    case INDEX_op_ext32u_i64:
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
     case INDEX_op_extrl_i64_i32:
diff --git a/tcg/loongarch64/tcg-target-has.h b/tcg/loongarch64/tcg-target-has.h
index 188b00799f..166c9d7e41 100644
--- a/tcg/loongarch64/tcg-target-has.h
+++ b/tcg/loongarch64/tcg-target-has.h
@@ -22,10 +22,6 @@
 #define TCG_TARGET_HAS_muls2_i32        0
 #define TCG_TARGET_HAS_muluh_i32        1
 #define TCG_TARGET_HAS_mulsh_i32        1
-#define TCG_TARGET_HAS_ext8s_i32        1
-#define TCG_TARGET_HAS_ext16s_i32       1
-#define TCG_TARGET_HAS_ext8u_i32        1
-#define TCG_TARGET_HAS_ext16u_i32       1
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
 #define TCG_TARGET_HAS_not_i32          1
@@ -47,12 +43,6 @@
 #define TCG_TARGET_HAS_rot_i64          1
 #define TCG_TARGET_HAS_extract2_i64     0
 #define TCG_TARGET_HAS_extr_i64_i32     1
-#define TCG_TARGET_HAS_ext8s_i64        1
-#define TCG_TARGET_HAS_ext16s_i64       1
-#define TCG_TARGET_HAS_ext32s_i64       1
-#define TCG_TARGET_HAS_ext8u_i64        1
-#define TCG_TARGET_HAS_ext16u_i64       1
-#define TCG_TARGET_HAS_ext32u_i64       1
 #define TCG_TARGET_HAS_bswap16_i64      1
 #define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index 879f66f255..6e77d3e79b 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -1707,17 +1707,7 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
-    case INDEX_op_ext8s_i32:  /* Always emitted via tcg_reg_alloc_op.  */
-    case INDEX_op_ext8s_i64:
-    case INDEX_op_ext8u_i32:
-    case INDEX_op_ext8u_i64:
-    case INDEX_op_ext16s_i32:
-    case INDEX_op_ext16s_i64:
-    case INDEX_op_ext16u_i32:
-    case INDEX_op_ext16u_i64:
-    case INDEX_op_ext32s_i64:
-    case INDEX_op_ext32u_i64:
-    case INDEX_op_ext_i32_i64:
+    case INDEX_op_ext_i32_i64:  /* Always emitted via tcg_reg_alloc_op.  */
     case INDEX_op_extu_i32_i64:
     case INDEX_op_extrl_i64_i32:
     default:
@@ -2243,16 +2233,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_brcond_i64:
         return C_O0_I2(rz, rz);
 
-    case INDEX_op_ext8s_i32:
-    case INDEX_op_ext8s_i64:
-    case INDEX_op_ext8u_i32:
-    case INDEX_op_ext8u_i64:
-    case INDEX_op_ext16s_i32:
-    case INDEX_op_ext16s_i64:
-    case INDEX_op_ext16u_i32:
-    case INDEX_op_ext16u_i64:
-    case INDEX_op_ext32s_i64:
-    case INDEX_op_ext32u_i64:
     case INDEX_op_extu_i32_i64:
     case INDEX_op_extrl_i64_i32:
     case INDEX_op_extrh_i64_i32:
diff --git a/tcg/mips/tcg-target-has.h b/tcg/mips/tcg-target-has.h
index df6960fe9a..fd96905484 100644
--- a/tcg/mips/tcg-target-has.h
+++ b/tcg/mips/tcg-target-has.h
@@ -80,8 +80,6 @@ extern bool use_mips32r2_instructions;
 
 /* optional instructions detected at runtime */
 #define TCG_TARGET_HAS_extract2_i32     0
-#define TCG_TARGET_HAS_ext8s_i32        use_mips32r2_instructions
-#define TCG_TARGET_HAS_ext16s_i32       use_mips32r2_instructions
 #define TCG_TARGET_HAS_rot_i32          use_mips32r2_instructions
 #define TCG_TARGET_HAS_clz_i32          use_mips32r2_instructions
 #define TCG_TARGET_HAS_ctz_i32          0
@@ -93,23 +91,12 @@ extern bool use_mips32r2_instructions;
 #define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1
 #define TCG_TARGET_HAS_extract2_i64     0
-#define TCG_TARGET_HAS_ext8s_i64        use_mips32r2_instructions
-#define TCG_TARGET_HAS_ext16s_i64       use_mips32r2_instructions
 #define TCG_TARGET_HAS_rot_i64          use_mips32r2_instructions
 #define TCG_TARGET_HAS_clz_i64          use_mips32r2_instructions
 #define TCG_TARGET_HAS_ctz_i64          0
 #define TCG_TARGET_HAS_ctpop_i64        0
 #endif
 
-/* optional instructions automatically implemented */
-#define TCG_TARGET_HAS_ext8u_i32        0 /* andi rt, rs, 0xff   */
-#define TCG_TARGET_HAS_ext16u_i32       0 /* andi rt, rs, 0xffff */
-
-#if TCG_TARGET_REG_BITS == 64
-#define TCG_TARGET_HAS_ext8u_i64        0 /* andi rt, rs, 0xff   */
-#define TCG_TARGET_HAS_ext16u_i64       0 /* andi rt, rs, 0xffff */
-#endif
-
 #define TCG_TARGET_HAS_qemu_ldst_i128   0
 #define TCG_TARGET_HAS_tst              0
 
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index f8c105ba37..f77159bdc7 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -647,7 +647,7 @@ static void tcg_out_movi(TCGContext *s, TCGType type,
 
 static void tcg_out_ext8s(TCGContext *s, TCGType type, TCGReg rd, TCGReg rs)
 {
-    tcg_debug_assert(TCG_TARGET_HAS_ext8s_i32);
+    tcg_debug_assert(use_mips32r2_instructions);
     tcg_out_opc_reg(s, OPC_SEB, rd, TCG_REG_ZERO, rs);
 }
 
@@ -658,7 +658,7 @@ static void tcg_out_ext8u(TCGContext *s, TCGReg rd, TCGReg rs)
 
 static void tcg_out_ext16s(TCGContext *s, TCGType type, TCGReg rd, TCGReg rs)
 {
-    tcg_debug_assert(TCG_TARGET_HAS_ext16s_i32);
+    tcg_debug_assert(use_mips32r2_instructions);
     tcg_out_opc_reg(s, OPC_SEH, rd, TCG_REG_ZERO, rs);
 }
 
@@ -2106,15 +2106,7 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
-    case INDEX_op_ext8s_i32:  /* Always emitted via tcg_reg_alloc_op.  */
-    case INDEX_op_ext8s_i64:
-    case INDEX_op_ext8u_i32:
-    case INDEX_op_ext8u_i64:
-    case INDEX_op_ext16s_i32:
-    case INDEX_op_ext16s_i64:
-    case INDEX_op_ext32s_i64:
-    case INDEX_op_ext32u_i64:
-    case INDEX_op_ext_i32_i64:
+    case INDEX_op_ext_i32_i64:  /* Always emitted via tcg_reg_alloc_op.  */
     case INDEX_op_extu_i32_i64:
     case INDEX_op_extrl_i64_i32:
     default:
@@ -2138,8 +2130,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_not_i32:
     case INDEX_op_bswap16_i32:
     case INDEX_op_bswap32_i32:
-    case INDEX_op_ext8s_i32:
-    case INDEX_op_ext16s_i32:
     case INDEX_op_extract_i32:
     case INDEX_op_sextract_i32:
     case INDEX_op_ld8u_i64:
@@ -2154,10 +2144,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_bswap16_i64:
     case INDEX_op_bswap32_i64:
     case INDEX_op_bswap64_i64:
-    case INDEX_op_ext8s_i64:
-    case INDEX_op_ext16s_i64:
-    case INDEX_op_ext32s_i64:
-    case INDEX_op_ext32u_i64:
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
     case INDEX_op_extrl_i64_i32:
diff --git a/tcg/optimize.c b/tcg/optimize.c
index 3bd4ee4d58..e9e654597d 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -513,18 +513,6 @@ static uint64_t do_constant_folding_2(TCGOpcode op, uint64_t x, uint64_t y)
     case INDEX_op_ctpop_i64:
         return ctpop64(x);
 
-    CASE_OP_32_64(ext8s):
-        return (int8_t)x;
-
-    CASE_OP_32_64(ext16s):
-        return (int16_t)x;
-
-    CASE_OP_32_64(ext8u):
-        return (uint8_t)x;
-
-    CASE_OP_32_64(ext16u):
-        return (uint16_t)x;
-
     CASE_OP_32_64(bswap16):
         x = bswap16(x);
         return y & TCG_BSWAP_OS ? (int16_t)x : x;
@@ -537,12 +525,10 @@ static uint64_t do_constant_folding_2(TCGOpcode op, uint64_t x, uint64_t y)
         return bswap64(x);
 
     case INDEX_op_ext_i32_i64:
-    case INDEX_op_ext32s_i64:
         return (int32_t)x;
 
     case INDEX_op_extu_i32_i64:
     case INDEX_op_extrl_i64_i32:
-    case INDEX_op_ext32u_i64:
         return (uint32_t)x;
 
     case INDEX_op_extrh_i64_i32:
@@ -1869,8 +1855,7 @@ static bool fold_extract2(OptContext *ctx, TCGOp *op)
 
 static bool fold_exts(OptContext *ctx, TCGOp *op)
 {
-    uint64_t s_mask_old, s_mask, z_mask;
-    bool type_change = false;
+    uint64_t s_mask, z_mask;
     TempOptInfo *t1;
 
     if (fold_const1(ctx, op)) {
@@ -1880,72 +1865,38 @@ static bool fold_exts(OptContext *ctx, TCGOp *op)
     t1 = arg_info(op->args[1]);
     z_mask = t1->z_mask;
     s_mask = t1->s_mask;
-    s_mask_old = s_mask;
 
     switch (op->opc) {
-    CASE_OP_32_64(ext8s):
-        s_mask |= INT8_MIN;
-        z_mask = (int8_t)z_mask;
-        break;
-    CASE_OP_32_64(ext16s):
-        s_mask |= INT16_MIN;
-        z_mask = (int16_t)z_mask;
-        break;
     case INDEX_op_ext_i32_i64:
-        type_change = true;
-        QEMU_FALLTHROUGH;
-    case INDEX_op_ext32s_i64:
         s_mask |= INT32_MIN;
         z_mask = (int32_t)z_mask;
         break;
     default:
         g_assert_not_reached();
     }
-
-    if (!type_change && fold_affected_mask(ctx, op, s_mask & ~s_mask_old)) {
-        return true;
-    }
-
     return fold_masks_zs(ctx, op, z_mask, s_mask);
 }
 
 static bool fold_extu(OptContext *ctx, TCGOp *op)
 {
-    uint64_t z_mask_old, z_mask;
-    bool type_change = false;
+    uint64_t z_mask;
 
     if (fold_const1(ctx, op)) {
         return true;
     }
 
-    z_mask_old = z_mask = arg_info(op->args[1])->z_mask;
-
+    z_mask = arg_info(op->args[1])->z_mask;
     switch (op->opc) {
-    CASE_OP_32_64(ext8u):
-        z_mask = (uint8_t)z_mask;
-        break;
-    CASE_OP_32_64(ext16u):
-        z_mask = (uint16_t)z_mask;
-        break;
     case INDEX_op_extrl_i64_i32:
     case INDEX_op_extu_i32_i64:
-        type_change = true;
-        QEMU_FALLTHROUGH;
-    case INDEX_op_ext32u_i64:
         z_mask = (uint32_t)z_mask;
         break;
     case INDEX_op_extrh_i64_i32:
-        type_change = true;
         z_mask >>= 32;
         break;
     default:
         g_assert_not_reached();
     }
-
-    if (!type_change && fold_affected_mask(ctx, op, z_mask_old ^ z_mask)) {
-        return true;
-    }
-
     return fold_masks_z(ctx, op, z_mask);
 }
 
@@ -2948,15 +2899,9 @@ void tcg_optimize(TCGContext *s)
         CASE_OP_32_64(extract2):
             done = fold_extract2(&ctx, op);
             break;
-        CASE_OP_32_64(ext8s):
-        CASE_OP_32_64(ext16s):
-        case INDEX_op_ext32s_i64:
         case INDEX_op_ext_i32_i64:
             done = fold_exts(&ctx, op);
             break;
-        CASE_OP_32_64(ext8u):
-        CASE_OP_32_64(ext16u):
-        case INDEX_op_ext32u_i64:
         case INDEX_op_extu_i32_i64:
         case INDEX_op_extrl_i64_i32:
         case INDEX_op_extrh_i64_i32:
diff --git a/tcg/ppc/tcg-target-has.h b/tcg/ppc/tcg-target-has.h
index 6db91f78ce..9acfc574c5 100644
--- a/tcg/ppc/tcg-target-has.h
+++ b/tcg/ppc/tcg-target-has.h
@@ -16,16 +16,10 @@
 #define have_altivec   (cpuinfo & CPUINFO_ALTIVEC)
 #define have_vsx       (cpuinfo & CPUINFO_VSX)
 
-/* optional instructions automatically implemented */
-#define TCG_TARGET_HAS_ext8u_i32        0 /* andi */
-#define TCG_TARGET_HAS_ext16u_i32       0
-
 /* optional instructions */
 #define TCG_TARGET_HAS_div_i32          1
 #define TCG_TARGET_HAS_rem_i32          have_isa_3_00
 #define TCG_TARGET_HAS_rot_i32          1
-#define TCG_TARGET_HAS_ext8s_i32        1
-#define TCG_TARGET_HAS_ext16s_i32       1
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
 #define TCG_TARGET_HAS_not_i32          1
@@ -52,12 +46,6 @@
 #define TCG_TARGET_HAS_div_i64          1
 #define TCG_TARGET_HAS_rem_i64          have_isa_3_00
 #define TCG_TARGET_HAS_rot_i64          1
-#define TCG_TARGET_HAS_ext8s_i64        1
-#define TCG_TARGET_HAS_ext16s_i64       1
-#define TCG_TARGET_HAS_ext32s_i64       1
-#define TCG_TARGET_HAS_ext8u_i64        0
-#define TCG_TARGET_HAS_ext16u_i64       0
-#define TCG_TARGET_HAS_ext32u_i64       0
 #define TCG_TARGET_HAS_bswap16_i64      1
 #define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index 822925a19b..e10c1c5162 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -3473,17 +3473,7 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     case INDEX_op_call:      /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:   /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:   /* Always emitted via tcg_out_goto_tb.  */
-    case INDEX_op_ext8s_i32:  /* Always emitted via tcg_reg_alloc_op.  */
-    case INDEX_op_ext8s_i64:
-    case INDEX_op_ext8u_i32:
-    case INDEX_op_ext8u_i64:
-    case INDEX_op_ext16s_i32:
-    case INDEX_op_ext16s_i64:
-    case INDEX_op_ext16u_i32:
-    case INDEX_op_ext16u_i64:
-    case INDEX_op_ext32s_i64:
-    case INDEX_op_ext32u_i64:
-    case INDEX_op_ext_i32_i64:
+    case INDEX_op_ext_i32_i64:  /* Always emitted via tcg_reg_alloc_op.  */
     case INDEX_op_extu_i32_i64:
     case INDEX_op_extrl_i64_i32:
     default:
@@ -4109,8 +4099,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ctpop_i32:
     case INDEX_op_neg_i32:
     case INDEX_op_not_i32:
-    case INDEX_op_ext8s_i32:
-    case INDEX_op_ext16s_i32:
     case INDEX_op_bswap16_i32:
     case INDEX_op_bswap32_i32:
     case INDEX_op_extract_i32:
@@ -4125,9 +4113,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ctpop_i64:
     case INDEX_op_neg_i64:
     case INDEX_op_not_i64:
-    case INDEX_op_ext8s_i64:
-    case INDEX_op_ext16s_i64:
-    case INDEX_op_ext32s_i64:
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
     case INDEX_op_bswap16_i64:
diff --git a/tcg/riscv/tcg-target-has.h b/tcg/riscv/tcg-target-has.h
index 98081084f2..fc62049c78 100644
--- a/tcg/riscv/tcg-target-has.h
+++ b/tcg/riscv/tcg-target-has.h
@@ -22,10 +22,6 @@
 #define TCG_TARGET_HAS_muls2_i32        0
 #define TCG_TARGET_HAS_muluh_i32        0
 #define TCG_TARGET_HAS_mulsh_i32        0
-#define TCG_TARGET_HAS_ext8s_i32        1
-#define TCG_TARGET_HAS_ext16s_i32       1
-#define TCG_TARGET_HAS_ext8u_i32        1
-#define TCG_TARGET_HAS_ext16u_i32       1
 #define TCG_TARGET_HAS_bswap16_i32      (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_bswap32_i32      (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_not_i32          1
@@ -46,12 +42,6 @@
 #define TCG_TARGET_HAS_rot_i64          (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_extract2_i64     0
 #define TCG_TARGET_HAS_extr_i64_i32     1
-#define TCG_TARGET_HAS_ext8s_i64        1
-#define TCG_TARGET_HAS_ext16s_i64       1
-#define TCG_TARGET_HAS_ext32s_i64       1
-#define TCG_TARGET_HAS_ext8u_i64        1
-#define TCG_TARGET_HAS_ext16u_i64       1
-#define TCG_TARGET_HAS_ext32u_i64       1
 #define TCG_TARGET_HAS_bswap16_i64      (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_bswap32_i64      (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_bswap64_i64      (cpuinfo & CPUINFO_ZBB)
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index f7e1ca5a56..d525df4e1d 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -2385,17 +2385,7 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
-    case INDEX_op_ext8s_i32:  /* Always emitted via tcg_reg_alloc_op.  */
-    case INDEX_op_ext8s_i64:
-    case INDEX_op_ext8u_i32:
-    case INDEX_op_ext8u_i64:
-    case INDEX_op_ext16s_i32:
-    case INDEX_op_ext16s_i64:
-    case INDEX_op_ext16u_i32:
-    case INDEX_op_ext16u_i64:
-    case INDEX_op_ext32s_i64:
-    case INDEX_op_ext32u_i64:
-    case INDEX_op_ext_i32_i64:
+    case INDEX_op_ext_i32_i64:  /* Always emitted via tcg_reg_alloc_op.  */
     case INDEX_op_extu_i32_i64:
     case INDEX_op_extrl_i64_i32:
     default:
@@ -2643,17 +2633,7 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld_i64:
     case INDEX_op_not_i64:
     case INDEX_op_neg_i64:
-    case INDEX_op_ext8u_i32:
-    case INDEX_op_ext8u_i64:
-    case INDEX_op_ext16u_i32:
-    case INDEX_op_ext16u_i64:
-    case INDEX_op_ext32u_i64:
     case INDEX_op_extu_i32_i64:
-    case INDEX_op_ext8s_i32:
-    case INDEX_op_ext8s_i64:
-    case INDEX_op_ext16s_i32:
-    case INDEX_op_ext16s_i64:
-    case INDEX_op_ext32s_i64:
     case INDEX_op_extrl_i64_i32:
     case INDEX_op_extrh_i64_i32:
     case INDEX_op_ext_i32_i64:
diff --git a/tcg/s390x/tcg-target-has.h b/tcg/s390x/tcg-target-has.h
index e99e671642..aea805455f 100644
--- a/tcg/s390x/tcg-target-has.h
+++ b/tcg/s390x/tcg-target-has.h
@@ -31,10 +31,6 @@ extern uint64_t s390_facilities[3];
 /* optional instructions */
 #define TCG_TARGET_HAS_div2_i32       1
 #define TCG_TARGET_HAS_rot_i32        1
-#define TCG_TARGET_HAS_ext8s_i32      1
-#define TCG_TARGET_HAS_ext16s_i32     1
-#define TCG_TARGET_HAS_ext8u_i32      1
-#define TCG_TARGET_HAS_ext16u_i32     1
 #define TCG_TARGET_HAS_bswap16_i32    1
 #define TCG_TARGET_HAS_bswap32_i32    1
 #define TCG_TARGET_HAS_not_i32        HAVE_FACILITY(MISC_INSN_EXT3)
@@ -59,12 +55,6 @@ extern uint64_t s390_facilities[3];
 
 #define TCG_TARGET_HAS_div2_i64       1
 #define TCG_TARGET_HAS_rot_i64        1
-#define TCG_TARGET_HAS_ext8s_i64      1
-#define TCG_TARGET_HAS_ext16s_i64     1
-#define TCG_TARGET_HAS_ext32s_i64     1
-#define TCG_TARGET_HAS_ext8u_i64      1
-#define TCG_TARGET_HAS_ext16u_i64     1
-#define TCG_TARGET_HAS_ext32u_i64     1
 #define TCG_TARGET_HAS_bswap16_i64    1
 #define TCG_TARGET_HAS_bswap32_i64    1
 #define TCG_TARGET_HAS_bswap64_i64    1
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index b2e1cd60ff..8421320928 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -2781,17 +2781,7 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
-    case INDEX_op_ext8s_i32:  /* Always emitted via tcg_reg_alloc_op.  */
-    case INDEX_op_ext8s_i64:
-    case INDEX_op_ext8u_i32:
-    case INDEX_op_ext8u_i64:
-    case INDEX_op_ext16s_i32:
-    case INDEX_op_ext16s_i64:
-    case INDEX_op_ext16u_i32:
-    case INDEX_op_ext16u_i64:
-    case INDEX_op_ext32s_i64:
-    case INDEX_op_ext32u_i64:
-    case INDEX_op_ext_i32_i64:
+    case INDEX_op_ext_i32_i64:  /* Always emitted via tcg_reg_alloc_op.  */
     case INDEX_op_extu_i32_i64:
     case INDEX_op_extrl_i64_i32:
     default:
@@ -3340,16 +3330,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_neg_i64:
     case INDEX_op_not_i32:
     case INDEX_op_not_i64:
-    case INDEX_op_ext8s_i32:
-    case INDEX_op_ext8s_i64:
-    case INDEX_op_ext8u_i32:
-    case INDEX_op_ext8u_i64:
-    case INDEX_op_ext16s_i32:
-    case INDEX_op_ext16s_i64:
-    case INDEX_op_ext16u_i32:
-    case INDEX_op_ext16u_i64:
-    case INDEX_op_ext32s_i64:
-    case INDEX_op_ext32u_i64:
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
     case INDEX_op_extract_i32:
diff --git a/tcg/sparc64/tcg-target-has.h b/tcg/sparc64/tcg-target-has.h
index 2f46df8c61..ad6f35da17 100644
--- a/tcg/sparc64/tcg-target-has.h
+++ b/tcg/sparc64/tcg-target-has.h
@@ -17,10 +17,6 @@ extern bool use_vis3_instructions;
 #define TCG_TARGET_HAS_div_i32		1
 #define TCG_TARGET_HAS_rem_i32		0
 #define TCG_TARGET_HAS_rot_i32          0
-#define TCG_TARGET_HAS_ext8s_i32        0
-#define TCG_TARGET_HAS_ext16s_i32       0
-#define TCG_TARGET_HAS_ext8u_i32        0
-#define TCG_TARGET_HAS_ext16u_i32       0
 #define TCG_TARGET_HAS_bswap16_i32      0
 #define TCG_TARGET_HAS_bswap32_i32      0
 #define TCG_TARGET_HAS_not_i32          1
@@ -46,12 +42,6 @@ extern bool use_vis3_instructions;
 #define TCG_TARGET_HAS_div_i64          1
 #define TCG_TARGET_HAS_rem_i64          0
 #define TCG_TARGET_HAS_rot_i64          0
-#define TCG_TARGET_HAS_ext8s_i64        0
-#define TCG_TARGET_HAS_ext16s_i64       0
-#define TCG_TARGET_HAS_ext32s_i64       1
-#define TCG_TARGET_HAS_ext8u_i64        0
-#define TCG_TARGET_HAS_ext16u_i64       0
-#define TCG_TARGET_HAS_ext32u_i64       1
 #define TCG_TARGET_HAS_bswap16_i64      0
 #define TCG_TARGET_HAS_bswap32_i64      0
 #define TCG_TARGET_HAS_bswap64_i64      0
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index 7c722f59a8..787e0d896c 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -1517,17 +1517,7 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
-    case INDEX_op_ext8s_i32:  /* Always emitted via tcg_reg_alloc_op.  */
-    case INDEX_op_ext8s_i64:
-    case INDEX_op_ext8u_i32:
-    case INDEX_op_ext8u_i64:
-    case INDEX_op_ext16s_i32:
-    case INDEX_op_ext16s_i64:
-    case INDEX_op_ext16u_i32:
-    case INDEX_op_ext16u_i64:
-    case INDEX_op_ext32s_i64:
-    case INDEX_op_ext32u_i64:
-    case INDEX_op_ext_i32_i64:
+    case INDEX_op_ext_i32_i64:  /* Always emitted via tcg_reg_alloc_op.  */
     case INDEX_op_extu_i32_i64:
     default:
         g_assert_not_reached();
@@ -1557,8 +1547,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_neg_i64:
     case INDEX_op_not_i32:
     case INDEX_op_not_i64:
-    case INDEX_op_ext32s_i64:
-    case INDEX_op_ext32u_i64:
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
     case INDEX_op_extract_i64:
diff --git a/tcg/tcg-has.h b/tcg/tcg-has.h
index 418e4673eb..4ccdc6bbee 100644
--- a/tcg/tcg-has.h
+++ b/tcg/tcg-has.h
@@ -16,12 +16,6 @@
 #define TCG_TARGET_HAS_rem_i64          0
 #define TCG_TARGET_HAS_div2_i64         0
 #define TCG_TARGET_HAS_rot_i64          0
-#define TCG_TARGET_HAS_ext8s_i64        0
-#define TCG_TARGET_HAS_ext16s_i64       0
-#define TCG_TARGET_HAS_ext32s_i64       0
-#define TCG_TARGET_HAS_ext8u_i64        0
-#define TCG_TARGET_HAS_ext16u_i64       0
-#define TCG_TARGET_HAS_ext32u_i64       0
 #define TCG_TARGET_HAS_bswap16_i64      0
 #define TCG_TARGET_HAS_bswap32_i64      0
 #define TCG_TARGET_HAS_bswap64_i64      0
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index f68c4f9702..48793ed439 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -414,17 +414,19 @@ void tcg_gen_andi_i32(TCGv_i32 ret, TCGv_i32 arg1, int32_t arg2)
     case -1:
         tcg_gen_mov_i32(ret, arg1);
         return;
-    case 0xff:
-        /* Don't recurse with tcg_gen_ext8u_i32.  */
-        if (TCG_TARGET_HAS_ext8u_i32) {
-            tcg_gen_op2_i32(INDEX_op_ext8u_i32, ret, arg1);
-            return;
-        }
-        break;
-    case 0xffff:
-        if (TCG_TARGET_HAS_ext16u_i32) {
-            tcg_gen_op2_i32(INDEX_op_ext16u_i32, ret, arg1);
-            return;
+    default:
+        /*
+         * Canonicalize on extract, if valid.  This aids x86 with its
+         * 2 operand MOVZBL and 2 operand AND, selecting the TCGOpcode
+         * which does not require matching operands.  Other backends can
+         * trivially expand the extract to AND during code generation.
+         */
+        if (!(arg2 & (arg2 + 1))) {
+            unsigned len = ctz32(~arg2);
+            if (TCG_TARGET_extract_valid(TCG_TYPE_I32, 0, len)) {
+                tcg_gen_extract_i32(ret, arg1, 0, len);
+                return;
+            }
         }
         break;
     }
@@ -955,40 +957,20 @@ void tcg_gen_deposit_z_i32(TCGv_i32 ret, TCGv_i32 arg,
         TCGv_i32 zero = tcg_constant_i32(0);
         tcg_gen_op5ii_i32(INDEX_op_deposit_i32, ret, zero, arg, ofs, len);
     } else {
-        /* To help two-operand hosts we prefer to zero-extend first,
-           which allows ARG to stay live.  */
-        switch (len) {
-        case 16:
-            if (TCG_TARGET_HAS_ext16u_i32) {
-                tcg_gen_ext16u_i32(ret, arg);
-                tcg_gen_shli_i32(ret, ret, ofs);
-                return;
-            }
-            break;
-        case 8:
-            if (TCG_TARGET_HAS_ext8u_i32) {
-                tcg_gen_ext8u_i32(ret, arg);
-                tcg_gen_shli_i32(ret, ret, ofs);
-                return;
-            }
-            break;
+        /*
+         * To help two-operand hosts we prefer to zero-extend first,
+         * which allows ARG to stay live.
+         */
+        if (TCG_TARGET_extract_valid(TCG_TYPE_I32, 0, len)) {
+            tcg_gen_extract_i32(ret, arg, 0, len);
+            tcg_gen_shli_i32(ret, ret, ofs);
+            return;
         }
         /* Otherwise prefer zero-extension over AND for code size.  */
-        switch (ofs + len) {
-        case 16:
-            if (TCG_TARGET_HAS_ext16u_i32) {
-                tcg_gen_shli_i32(ret, arg, ofs);
-                tcg_gen_ext16u_i32(ret, ret);
-                return;
-            }
-            break;
-        case 8:
-            if (TCG_TARGET_HAS_ext8u_i32) {
-                tcg_gen_shli_i32(ret, arg, ofs);
-                tcg_gen_ext8u_i32(ret, ret);
-                return;
-            }
-            break;
+        if (TCG_TARGET_extract_valid(TCG_TYPE_I32, 0, ofs + len)) {
+            tcg_gen_shli_i32(ret, arg, ofs);
+            tcg_gen_extract_i32(ret, ret, 0, ofs + len);
+            return;
         }
         tcg_gen_andi_i32(ret, arg, (1u << len) - 1);
         tcg_gen_shli_i32(ret, ret, ofs);
@@ -1008,32 +990,21 @@ void tcg_gen_extract_i32(TCGv_i32 ret, TCGv_i32 arg,
         tcg_gen_shri_i32(ret, arg, 32 - len);
         return;
     }
-    if (ofs == 0) {
-        tcg_gen_andi_i32(ret, arg, (1u << len) - 1);
-        return;
-    }
 
     if (TCG_TARGET_extract_valid(TCG_TYPE_I32, ofs, len)) {
         tcg_gen_op4ii_i32(INDEX_op_extract_i32, ret, arg, ofs, len);
         return;
     }
+    if (ofs == 0) {
+        tcg_gen_andi_i32(ret, arg, (1u << len) - 1);
+        return;
+    }
 
     /* Assume that zero-extension, if available, is cheaper than a shift.  */
-    switch (ofs + len) {
-    case 16:
-        if (TCG_TARGET_HAS_ext16u_i32) {
-            tcg_gen_ext16u_i32(ret, arg);
-            tcg_gen_shri_i32(ret, ret, ofs);
-            return;
-        }
-        break;
-    case 8:
-        if (TCG_TARGET_HAS_ext8u_i32) {
-            tcg_gen_ext8u_i32(ret, arg);
-            tcg_gen_shri_i32(ret, ret, ofs);
-            return;
-        }
-        break;
+    if (TCG_TARGET_extract_valid(TCG_TYPE_I32, 0, ofs + len)) {
+        tcg_gen_op4ii_i32(INDEX_op_extract_i32, ret, arg, 0, ofs + len);
+        tcg_gen_shri_i32(ret, ret, ofs);
+        return;
     }
 
     /* ??? Ideally we'd know what values are available for immediate AND.
@@ -1064,16 +1035,6 @@ void tcg_gen_sextract_i32(TCGv_i32 ret, TCGv_i32 arg,
         tcg_gen_sari_i32(ret, arg, 32 - len);
         return;
     }
-    if (ofs == 0) {
-        switch (len) {
-        case 16:
-            tcg_gen_ext16s_i32(ret, arg);
-            return;
-        case 8:
-            tcg_gen_ext8s_i32(ret, arg);
-            return;
-        }
-    }
 
     if (TCG_TARGET_sextract_valid(TCG_TYPE_I32, ofs, len)) {
         tcg_gen_op4ii_i32(INDEX_op_sextract_i32, ret, arg, ofs, len);
@@ -1081,37 +1042,15 @@ void tcg_gen_sextract_i32(TCGv_i32 ret, TCGv_i32 arg,
     }
 
     /* Assume that sign-extension, if available, is cheaper than a shift.  */
-    switch (ofs + len) {
-    case 16:
-        if (TCG_TARGET_HAS_ext16s_i32) {
-            tcg_gen_ext16s_i32(ret, arg);
-            tcg_gen_sari_i32(ret, ret, ofs);
-            return;
-        }
-        break;
-    case 8:
-        if (TCG_TARGET_HAS_ext8s_i32) {
-            tcg_gen_ext8s_i32(ret, arg);
-            tcg_gen_sari_i32(ret, ret, ofs);
-            return;
-        }
-        break;
+    if (TCG_TARGET_sextract_valid(TCG_TYPE_I32, 0, ofs + len)) {
+        tcg_gen_op4ii_i32(INDEX_op_sextract_i32, ret, arg, 0, ofs + len);
+        tcg_gen_sari_i32(ret, ret, ofs);
+        return;
     }
-    switch (len) {
-    case 16:
-        if (TCG_TARGET_HAS_ext16s_i32) {
-            tcg_gen_shri_i32(ret, arg, ofs);
-            tcg_gen_ext16s_i32(ret, ret);
-            return;
-        }
-        break;
-    case 8:
-        if (TCG_TARGET_HAS_ext8s_i32) {
-            tcg_gen_shri_i32(ret, arg, ofs);
-            tcg_gen_ext8s_i32(ret, ret);
-            return;
-        }
-        break;
+    if (TCG_TARGET_sextract_valid(TCG_TYPE_I32, 0, len)) {
+        tcg_gen_shri_i32(ret, arg, ofs);
+        tcg_gen_op4ii_i32(INDEX_op_sextract_i32, ret, ret, 0, len);
+        return;
     }
 
     tcg_gen_shli_i32(ret, arg, 32 - len - ofs);
@@ -1281,40 +1220,22 @@ void tcg_gen_mulsu2_i32(TCGv_i32 rl, TCGv_i32 rh, TCGv_i32 arg1, TCGv_i32 arg2)
 
 void tcg_gen_ext8s_i32(TCGv_i32 ret, TCGv_i32 arg)
 {
-    if (TCG_TARGET_HAS_ext8s_i32) {
-        tcg_gen_op2_i32(INDEX_op_ext8s_i32, ret, arg);
-    } else {
-        tcg_gen_shli_i32(ret, arg, 24);
-        tcg_gen_sari_i32(ret, ret, 24);
-    }
+    tcg_gen_sextract_i32(ret, arg, 0, 8);
 }
 
 void tcg_gen_ext16s_i32(TCGv_i32 ret, TCGv_i32 arg)
 {
-    if (TCG_TARGET_HAS_ext16s_i32) {
-        tcg_gen_op2_i32(INDEX_op_ext16s_i32, ret, arg);
-    } else {
-        tcg_gen_shli_i32(ret, arg, 16);
-        tcg_gen_sari_i32(ret, ret, 16);
-    }
+    tcg_gen_sextract_i32(ret, arg, 0, 16);
 }
 
 void tcg_gen_ext8u_i32(TCGv_i32 ret, TCGv_i32 arg)
 {
-    if (TCG_TARGET_HAS_ext8u_i32) {
-        tcg_gen_op2_i32(INDEX_op_ext8u_i32, ret, arg);
-    } else {
-        tcg_gen_andi_i32(ret, arg, 0xffu);
-    }
+    tcg_gen_extract_i32(ret, arg, 0, 8);
 }
 
 void tcg_gen_ext16u_i32(TCGv_i32 ret, TCGv_i32 arg)
 {
-    if (TCG_TARGET_HAS_ext16u_i32) {
-        tcg_gen_op2_i32(INDEX_op_ext16u_i32, ret, arg);
-    } else {
-        tcg_gen_andi_i32(ret, arg, 0xffffu);
-    }
+    tcg_gen_extract_i32(ret, arg, 0, 16);
 }
 
 /*
@@ -1794,23 +1715,19 @@ void tcg_gen_andi_i64(TCGv_i64 ret, TCGv_i64 arg1, int64_t arg2)
     case -1:
         tcg_gen_mov_i64(ret, arg1);
         return;
-    case 0xff:
-        /* Don't recurse with tcg_gen_ext8u_i64.  */
-        if (TCG_TARGET_HAS_ext8u_i64) {
-            tcg_gen_op2_i64(INDEX_op_ext8u_i64, ret, arg1);
-            return;
-        }
-        break;
-    case 0xffff:
-        if (TCG_TARGET_HAS_ext16u_i64) {
-            tcg_gen_op2_i64(INDEX_op_ext16u_i64, ret, arg1);
-            return;
-        }
-        break;
-    case 0xffffffffu:
-        if (TCG_TARGET_HAS_ext32u_i64) {
-            tcg_gen_op2_i64(INDEX_op_ext32u_i64, ret, arg1);
-            return;
+    default:
+        /*
+         * Canonicalize on extract, if valid.  This aids x86 with its
+         * 2 operand MOVZBL and 2 operand AND, selecting the TCGOpcode
+         * which does not require matching operands.  Other backends can
+         * trivially expand the extract to AND during code generation.
+         */
+        if (!(arg2 & (arg2 + 1))) {
+            unsigned len = ctz64(~arg2);
+            if (TCG_TARGET_extract_valid(TCG_TYPE_I64, 0, len)) {
+                tcg_gen_extract_i64(ret, arg1, 0, len);
+                return;
+            }
         }
         break;
     }
@@ -2118,77 +2035,32 @@ void tcg_gen_remu_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
 
 void tcg_gen_ext8s_i64(TCGv_i64 ret, TCGv_i64 arg)
 {
-    if (TCG_TARGET_REG_BITS == 32) {
-        tcg_gen_ext8s_i32(TCGV_LOW(ret), TCGV_LOW(arg));
-        tcg_gen_sari_i32(TCGV_HIGH(ret), TCGV_LOW(ret), 31);
-    } else if (TCG_TARGET_HAS_ext8s_i64) {
-        tcg_gen_op2_i64(INDEX_op_ext8s_i64, ret, arg);
-    } else {
-        tcg_gen_shli_i64(ret, arg, 56);
-        tcg_gen_sari_i64(ret, ret, 56);
-    }
+    tcg_gen_sextract_i64(ret, arg, 0, 8);
 }
 
 void tcg_gen_ext16s_i64(TCGv_i64 ret, TCGv_i64 arg)
 {
-    if (TCG_TARGET_REG_BITS == 32) {
-        tcg_gen_ext16s_i32(TCGV_LOW(ret), TCGV_LOW(arg));
-        tcg_gen_sari_i32(TCGV_HIGH(ret), TCGV_LOW(ret), 31);
-    } else if (TCG_TARGET_HAS_ext16s_i64) {
-        tcg_gen_op2_i64(INDEX_op_ext16s_i64, ret, arg);
-    } else {
-        tcg_gen_shli_i64(ret, arg, 48);
-        tcg_gen_sari_i64(ret, ret, 48);
-    }
+    tcg_gen_sextract_i64(ret, arg, 0, 16);
 }
 
 void tcg_gen_ext32s_i64(TCGv_i64 ret, TCGv_i64 arg)
 {
-    if (TCG_TARGET_REG_BITS == 32) {
-        tcg_gen_mov_i32(TCGV_LOW(ret), TCGV_LOW(arg));
-        tcg_gen_sari_i32(TCGV_HIGH(ret), TCGV_LOW(ret), 31);
-    } else if (TCG_TARGET_HAS_ext32s_i64) {
-        tcg_gen_op2_i64(INDEX_op_ext32s_i64, ret, arg);
-    } else {
-        tcg_gen_shli_i64(ret, arg, 32);
-        tcg_gen_sari_i64(ret, ret, 32);
-    }
+    tcg_gen_sextract_i64(ret, arg, 0, 32);
 }
 
 void tcg_gen_ext8u_i64(TCGv_i64 ret, TCGv_i64 arg)
 {
-    if (TCG_TARGET_REG_BITS == 32) {
-        tcg_gen_ext8u_i32(TCGV_LOW(ret), TCGV_LOW(arg));
-        tcg_gen_movi_i32(TCGV_HIGH(ret), 0);
-    } else if (TCG_TARGET_HAS_ext8u_i64) {
-        tcg_gen_op2_i64(INDEX_op_ext8u_i64, ret, arg);
-    } else {
-        tcg_gen_andi_i64(ret, arg, 0xffu);
-    }
+    tcg_gen_extract_i64(ret, arg, 0, 8);
 }
 
 void tcg_gen_ext16u_i64(TCGv_i64 ret, TCGv_i64 arg)
 {
-    if (TCG_TARGET_REG_BITS == 32) {
-        tcg_gen_ext16u_i32(TCGV_LOW(ret), TCGV_LOW(arg));
-        tcg_gen_movi_i32(TCGV_HIGH(ret), 0);
-    } else if (TCG_TARGET_HAS_ext16u_i64) {
-        tcg_gen_op2_i64(INDEX_op_ext16u_i64, ret, arg);
-    } else {
-        tcg_gen_andi_i64(ret, arg, 0xffffu);
-    }
+    tcg_gen_extract_i64(ret, arg, 0, 16);
 }
 
 void tcg_gen_ext32u_i64(TCGv_i64 ret, TCGv_i64 arg)
 {
-    if (TCG_TARGET_REG_BITS == 32) {
-        tcg_gen_mov_i32(TCGV_LOW(ret), TCGV_LOW(arg));
-        tcg_gen_movi_i32(TCGV_HIGH(ret), 0);
-    } else if (TCG_TARGET_HAS_ext32u_i64) {
-        tcg_gen_op2_i64(INDEX_op_ext32u_i64, ret, arg);
-    } else {
-        tcg_gen_andi_i64(ret, arg, 0xffffffffu);
-    }
+    tcg_gen_extract_i64(ret, arg, 0, 32);
 }
 
 /*
@@ -2720,54 +2592,20 @@ void tcg_gen_deposit_z_i64(TCGv_i64 ret, TCGv_i64 arg,
                 return;
             }
         }
-        /* To help two-operand hosts we prefer to zero-extend first,
-           which allows ARG to stay live.  */
-        switch (len) {
-        case 32:
-            if (TCG_TARGET_HAS_ext32u_i64) {
-                tcg_gen_ext32u_i64(ret, arg);
-                tcg_gen_shli_i64(ret, ret, ofs);
-                return;
-            }
-            break;
-        case 16:
-            if (TCG_TARGET_HAS_ext16u_i64) {
-                tcg_gen_ext16u_i64(ret, arg);
-                tcg_gen_shli_i64(ret, ret, ofs);
-                return;
-            }
-            break;
-        case 8:
-            if (TCG_TARGET_HAS_ext8u_i64) {
-                tcg_gen_ext8u_i64(ret, arg);
-                tcg_gen_shli_i64(ret, ret, ofs);
-                return;
-            }
-            break;
+        /*
+         * To help two-operand hosts we prefer to zero-extend first,
+         * which allows ARG to stay live.
+         */
+        if (TCG_TARGET_extract_valid(TCG_TYPE_I64, 0, len)) {
+            tcg_gen_extract_i64(ret, arg, 0, len);
+            tcg_gen_shli_i64(ret, ret, ofs);
+            return;
         }
         /* Otherwise prefer zero-extension over AND for code size.  */
-        switch (ofs + len) {
-        case 32:
-            if (TCG_TARGET_HAS_ext32u_i64) {
-                tcg_gen_shli_i64(ret, arg, ofs);
-                tcg_gen_ext32u_i64(ret, ret);
-                return;
-            }
-            break;
-        case 16:
-            if (TCG_TARGET_HAS_ext16u_i64) {
-                tcg_gen_shli_i64(ret, arg, ofs);
-                tcg_gen_ext16u_i64(ret, ret);
-                return;
-            }
-            break;
-        case 8:
-            if (TCG_TARGET_HAS_ext8u_i64) {
-                tcg_gen_shli_i64(ret, arg, ofs);
-                tcg_gen_ext8u_i64(ret, ret);
-                return;
-            }
-            break;
+        if (TCG_TARGET_extract_valid(TCG_TYPE_I64, 0, ofs + len)) {
+            tcg_gen_shli_i64(ret, arg, ofs);
+            tcg_gen_extract_i64(ret, ret, 0, ofs + len);
+            return;
         }
         tcg_gen_andi_i64(ret, arg, (1ull << len) - 1);
         tcg_gen_shli_i64(ret, ret, ofs);
@@ -2787,10 +2625,6 @@ void tcg_gen_extract_i64(TCGv_i64 ret, TCGv_i64 arg,
         tcg_gen_shri_i64(ret, arg, 64 - len);
         return;
     }
-    if (ofs == 0) {
-        tcg_gen_andi_i64(ret, arg, (1ull << len) - 1);
-        return;
-    }
 
     if (TCG_TARGET_REG_BITS == 32) {
         /* Look for a 32-bit extract within one of the two words.  */
@@ -2822,30 +2656,16 @@ void tcg_gen_extract_i64(TCGv_i64 ret, TCGv_i64 arg,
         tcg_gen_op4ii_i64(INDEX_op_extract_i64, ret, arg, ofs, len);
         return;
     }
+    if (ofs == 0) {
+        tcg_gen_andi_i64(ret, arg, (1ull << len) - 1);
+        return;
+    }
 
     /* Assume that zero-extension, if available, is cheaper than a shift.  */
-    switch (ofs + len) {
-    case 32:
-        if (TCG_TARGET_HAS_ext32u_i64) {
-            tcg_gen_ext32u_i64(ret, arg);
-            tcg_gen_shri_i64(ret, ret, ofs);
-            return;
-        }
-        break;
-    case 16:
-        if (TCG_TARGET_HAS_ext16u_i64) {
-            tcg_gen_ext16u_i64(ret, arg);
-            tcg_gen_shri_i64(ret, ret, ofs);
-            return;
-        }
-        break;
-    case 8:
-        if (TCG_TARGET_HAS_ext8u_i64) {
-            tcg_gen_ext8u_i64(ret, arg);
-            tcg_gen_shri_i64(ret, ret, ofs);
-            return;
-        }
-        break;
+    if (TCG_TARGET_extract_valid(TCG_TYPE_I64, 0, ofs + len)) {
+        tcg_gen_op4ii_i64(INDEX_op_extract_i64, ret, arg, 0, ofs + len);
+        tcg_gen_shri_i64(ret, ret, ofs);
+        return;
     }
 
     /* ??? Ideally we'd know what values are available for immediate AND.
@@ -2876,19 +2696,6 @@ void tcg_gen_sextract_i64(TCGv_i64 ret, TCGv_i64 arg,
         tcg_gen_sari_i64(ret, arg, 64 - len);
         return;
     }
-    if (ofs == 0) {
-        switch (len) {
-        case 32:
-            tcg_gen_ext32s_i64(ret, arg);
-            return;
-        case 16:
-            tcg_gen_ext16s_i64(ret, arg);
-            return;
-        case 8:
-            tcg_gen_ext8s_i64(ret, arg);
-            return;
-        }
-    }
 
     if (TCG_TARGET_REG_BITS == 32) {
         /* Look for a 32-bit extract within one of the two words.  */
@@ -2928,52 +2735,17 @@ void tcg_gen_sextract_i64(TCGv_i64 ret, TCGv_i64 arg,
     }
 
     /* Assume that sign-extension, if available, is cheaper than a shift.  */
-    switch (ofs + len) {
-    case 32:
-        if (TCG_TARGET_HAS_ext32s_i64) {
-            tcg_gen_ext32s_i64(ret, arg);
-            tcg_gen_sari_i64(ret, ret, ofs);
-            return;
-        }
-        break;
-    case 16:
-        if (TCG_TARGET_HAS_ext16s_i64) {
-            tcg_gen_ext16s_i64(ret, arg);
-            tcg_gen_sari_i64(ret, ret, ofs);
-            return;
-        }
-        break;
-    case 8:
-        if (TCG_TARGET_HAS_ext8s_i64) {
-            tcg_gen_ext8s_i64(ret, arg);
-            tcg_gen_sari_i64(ret, ret, ofs);
-            return;
-        }
-        break;
+    if (TCG_TARGET_sextract_valid(TCG_TYPE_I64, 0, ofs + len)) {
+        tcg_gen_op4ii_i64(INDEX_op_sextract_i64, ret, arg, 0, ofs + len);
+        tcg_gen_sari_i64(ret, ret, ofs);
+        return;
     }
-    switch (len) {
-    case 32:
-        if (TCG_TARGET_HAS_ext32s_i64) {
-            tcg_gen_shri_i64(ret, arg, ofs);
-            tcg_gen_ext32s_i64(ret, ret);
-            return;
-        }
-        break;
-    case 16:
-        if (TCG_TARGET_HAS_ext16s_i64) {
-            tcg_gen_shri_i64(ret, arg, ofs);
-            tcg_gen_ext16s_i64(ret, ret);
-            return;
-        }
-        break;
-    case 8:
-        if (TCG_TARGET_HAS_ext8s_i64) {
-            tcg_gen_shri_i64(ret, arg, ofs);
-            tcg_gen_ext8s_i64(ret, ret);
-            return;
-        }
-        break;
+    if (TCG_TARGET_sextract_valid(TCG_TYPE_I64, 0, len)) {
+        tcg_gen_shri_i64(ret, arg, ofs);
+        tcg_gen_op4ii_i64(INDEX_op_sextract_i64, ret, ret, 0, len);
+        return;
     }
+
     tcg_gen_shli_i64(ret, arg, 64 - len - ofs);
     tcg_gen_sari_i64(ret, ret, 64 - len);
 }
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 5090cdb3c6..e8fd89e4c8 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -2242,14 +2242,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
         return TCG_TARGET_HAS_muluh_i32;
     case INDEX_op_mulsh_i32:
         return TCG_TARGET_HAS_mulsh_i32;
-    case INDEX_op_ext8s_i32:
-        return TCG_TARGET_HAS_ext8s_i32;
-    case INDEX_op_ext16s_i32:
-        return TCG_TARGET_HAS_ext16s_i32;
-    case INDEX_op_ext8u_i32:
-        return TCG_TARGET_HAS_ext8u_i32;
-    case INDEX_op_ext16u_i32:
-        return TCG_TARGET_HAS_ext16u_i32;
     case INDEX_op_bswap16_i32:
         return TCG_TARGET_HAS_bswap16_i32;
     case INDEX_op_bswap32_i32:
@@ -2328,18 +2320,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_extrl_i64_i32:
     case INDEX_op_extrh_i64_i32:
         return TCG_TARGET_HAS_extr_i64_i32;
-    case INDEX_op_ext8s_i64:
-        return TCG_TARGET_HAS_ext8s_i64;
-    case INDEX_op_ext16s_i64:
-        return TCG_TARGET_HAS_ext16s_i64;
-    case INDEX_op_ext32s_i64:
-        return TCG_TARGET_HAS_ext32s_i64;
-    case INDEX_op_ext8u_i64:
-        return TCG_TARGET_HAS_ext8u_i64;
-    case INDEX_op_ext16u_i64:
-        return TCG_TARGET_HAS_ext16u_i64;
-    case INDEX_op_ext32u_i64:
-        return TCG_TARGET_HAS_ext32u_i64;
     case INDEX_op_bswap16_i64:
         return TCG_TARGET_HAS_bswap16_i64;
     case INDEX_op_bswap32_i64:
@@ -5430,32 +5410,6 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
 
     /* emit instruction */
     switch (op->opc) {
-    case INDEX_op_ext8s_i32:
-        tcg_out_ext8s(s, TCG_TYPE_I32, new_args[0], new_args[1]);
-        break;
-    case INDEX_op_ext8s_i64:
-        tcg_out_ext8s(s, TCG_TYPE_I64, new_args[0], new_args[1]);
-        break;
-    case INDEX_op_ext8u_i32:
-    case INDEX_op_ext8u_i64:
-        tcg_out_ext8u(s, new_args[0], new_args[1]);
-        break;
-    case INDEX_op_ext16s_i32:
-        tcg_out_ext16s(s, TCG_TYPE_I32, new_args[0], new_args[1]);
-        break;
-    case INDEX_op_ext16s_i64:
-        tcg_out_ext16s(s, TCG_TYPE_I64, new_args[0], new_args[1]);
-        break;
-    case INDEX_op_ext16u_i32:
-    case INDEX_op_ext16u_i64:
-        tcg_out_ext16u(s, new_args[0], new_args[1]);
-        break;
-    case INDEX_op_ext32s_i64:
-        tcg_out_ext32s(s, new_args[0], new_args[1]);
-        break;
-    case INDEX_op_ext32u_i64:
-        tcg_out_ext32u(s, new_args[0], new_args[1]);
-        break;
     case INDEX_op_ext_i32_i64:
         tcg_out_exts_i32_i64(s, new_args[0], new_args[1]);
         break;
diff --git a/tcg/tci.c b/tcg/tci.c
index d223258efe..531cd83aae 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -689,31 +689,6 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_write_reg64(regs, r1, r0, tmp64);
             break;
 #endif
-#if TCG_TARGET_HAS_ext8s_i32 || TCG_TARGET_HAS_ext8s_i64
-        CASE_32_64(ext8s)
-            tci_args_rr(insn, &r0, &r1);
-            regs[r0] = (int8_t)regs[r1];
-            break;
-#endif
-#if TCG_TARGET_HAS_ext16s_i32 || TCG_TARGET_HAS_ext16s_i64 || \
-    TCG_TARGET_HAS_bswap16_i32 || TCG_TARGET_HAS_bswap16_i64
-        CASE_32_64(ext16s)
-            tci_args_rr(insn, &r0, &r1);
-            regs[r0] = (int16_t)regs[r1];
-            break;
-#endif
-#if TCG_TARGET_HAS_ext8u_i32 || TCG_TARGET_HAS_ext8u_i64
-        CASE_32_64(ext8u)
-            tci_args_rr(insn, &r0, &r1);
-            regs[r0] = (uint8_t)regs[r1];
-            break;
-#endif
-#if TCG_TARGET_HAS_ext16u_i32 || TCG_TARGET_HAS_ext16u_i64
-        CASE_32_64(ext16u)
-            tci_args_rr(insn, &r0, &r1);
-            regs[r0] = (uint16_t)regs[r1];
-            break;
-#endif
 #if TCG_TARGET_HAS_bswap16_i32 || TCG_TARGET_HAS_bswap16_i64
         CASE_32_64(bswap16)
             tci_args_rr(insn, &r0, &r1);
@@ -864,12 +839,10 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
                 tb_ptr = ptr;
             }
             break;
-        case INDEX_op_ext32s_i64:
         case INDEX_op_ext_i32_i64:
             tci_args_rr(insn, &r0, &r1);
             regs[r0] = (int32_t)regs[r1];
             break;
-        case INDEX_op_ext32u_i64:
         case INDEX_op_extu_i32_i64:
             tci_args_rr(insn, &r0, &r1);
             regs[r0] = (uint32_t)regs[r1];
@@ -1092,15 +1065,6 @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
 
     case INDEX_op_mov_i32:
     case INDEX_op_mov_i64:
-    case INDEX_op_ext8s_i32:
-    case INDEX_op_ext8s_i64:
-    case INDEX_op_ext8u_i32:
-    case INDEX_op_ext8u_i64:
-    case INDEX_op_ext16s_i32:
-    case INDEX_op_ext16s_i64:
-    case INDEX_op_ext16u_i32:
-    case INDEX_op_ext32s_i64:
-    case INDEX_op_ext32u_i64:
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
     case INDEX_op_bswap16_i32:
diff --git a/tcg/tci/tcg-target-has.h b/tcg/tci/tcg-target-has.h
index c8785ca8dc..cb0964c3d4 100644
--- a/tcg/tci/tcg-target-has.h
+++ b/tcg/tci/tcg-target-has.h
@@ -11,10 +11,6 @@
 #define TCG_TARGET_HAS_bswap32_i32      1
 #define TCG_TARGET_HAS_div_i32          1
 #define TCG_TARGET_HAS_rem_i32          1
-#define TCG_TARGET_HAS_ext8s_i32        1
-#define TCG_TARGET_HAS_ext16s_i32       1
-#define TCG_TARGET_HAS_ext8u_i32        1
-#define TCG_TARGET_HAS_ext16u_i32       1
 #define TCG_TARGET_HAS_andc_i32         1
 #define TCG_TARGET_HAS_extract2_i32     0
 #define TCG_TARGET_HAS_eqv_i32          1
@@ -40,12 +36,6 @@
 #define TCG_TARGET_HAS_extract2_i64     0
 #define TCG_TARGET_HAS_div_i64          1
 #define TCG_TARGET_HAS_rem_i64          1
-#define TCG_TARGET_HAS_ext8s_i64        1
-#define TCG_TARGET_HAS_ext16s_i64       1
-#define TCG_TARGET_HAS_ext32s_i64       1
-#define TCG_TARGET_HAS_ext8u_i64        1
-#define TCG_TARGET_HAS_ext16u_i64       1
-#define TCG_TARGET_HAS_ext32u_i64       1
 #define TCG_TARGET_HAS_andc_i64         1
 #define TCG_TARGET_HAS_eqv_i64          1
 #define TCG_TARGET_HAS_nand_i64         1
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index 36e018dd19..6f8f1dd8ae 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -59,16 +59,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_not_i64:
     case INDEX_op_neg_i32:
     case INDEX_op_neg_i64:
-    case INDEX_op_ext8s_i32:
-    case INDEX_op_ext8s_i64:
-    case INDEX_op_ext16s_i32:
-    case INDEX_op_ext16s_i64:
-    case INDEX_op_ext8u_i32:
-    case INDEX_op_ext8u_i64:
-    case INDEX_op_ext16u_i32:
-    case INDEX_op_ext16u_i64:
-    case INDEX_op_ext32s_i64:
-    case INDEX_op_ext32u_i64:
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
     case INDEX_op_bswap16_i32:
@@ -535,76 +525,54 @@ static void tcg_out_movi(TCGContext *s, TCGType type,
     }
 }
 
+static void tcg_out_extract(TCGContext *s, TCGType type, TCGReg rd,
+                            TCGReg rs, unsigned pos, unsigned len)
+{
+    TCGOpcode opc = type == TCG_TYPE_I32 ?
+                    INDEX_op_extract_i32 :
+                    INDEX_op_extract_i64;
+    tcg_out_op_rrbb(s, opc, rd, rs, pos, len);
+}
+
+static void tcg_out_sextract(TCGContext *s, TCGType type, TCGReg rd,
+                             TCGReg rs, unsigned pos, unsigned len)
+{
+    TCGOpcode opc = type == TCG_TYPE_I32 ?
+                    INDEX_op_sextract_i32 :
+                    INDEX_op_sextract_i64;
+    tcg_out_op_rrbb(s, opc, rd, rs, pos, len);
+}
+
 static void tcg_out_ext8s(TCGContext *s, TCGType type, TCGReg rd, TCGReg rs)
 {
-    switch (type) {
-    case TCG_TYPE_I32:
-        tcg_debug_assert(TCG_TARGET_HAS_ext8s_i32);
-        tcg_out_op_rr(s, INDEX_op_ext8s_i32, rd, rs);
-        break;
-#if TCG_TARGET_REG_BITS == 64
-    case TCG_TYPE_I64:
-        tcg_debug_assert(TCG_TARGET_HAS_ext8s_i64);
-        tcg_out_op_rr(s, INDEX_op_ext8s_i64, rd, rs);
-        break;
-#endif
-    default:
-        g_assert_not_reached();
-    }
+    tcg_out_sextract(s, type, rd, rs, 0, 8);
 }
 
 static void tcg_out_ext8u(TCGContext *s, TCGReg rd, TCGReg rs)
 {
-    if (TCG_TARGET_REG_BITS == 64) {
-        tcg_debug_assert(TCG_TARGET_HAS_ext8u_i64);
-        tcg_out_op_rr(s, INDEX_op_ext8u_i64, rd, rs);
-    } else {
-        tcg_debug_assert(TCG_TARGET_HAS_ext8u_i32);
-        tcg_out_op_rr(s, INDEX_op_ext8u_i32, rd, rs);
-    }
+    tcg_out_extract(s, TCG_TYPE_REG, rd, rs, 0, 8);
 }
 
 static void tcg_out_ext16s(TCGContext *s, TCGType type, TCGReg rd, TCGReg rs)
 {
-    switch (type) {
-    case TCG_TYPE_I32:
-        tcg_debug_assert(TCG_TARGET_HAS_ext16s_i32);
-        tcg_out_op_rr(s, INDEX_op_ext16s_i32, rd, rs);
-        break;
-#if TCG_TARGET_REG_BITS == 64
-    case TCG_TYPE_I64:
-        tcg_debug_assert(TCG_TARGET_HAS_ext16s_i64);
-        tcg_out_op_rr(s, INDEX_op_ext16s_i64, rd, rs);
-        break;
-#endif
-    default:
-        g_assert_not_reached();
-    }
+    tcg_out_sextract(s, type, rd, rs, 0, 16);
 }
 
 static void tcg_out_ext16u(TCGContext *s, TCGReg rd, TCGReg rs)
 {
-    if (TCG_TARGET_REG_BITS == 64) {
-        tcg_debug_assert(TCG_TARGET_HAS_ext16u_i64);
-        tcg_out_op_rr(s, INDEX_op_ext16u_i64, rd, rs);
-    } else {
-        tcg_debug_assert(TCG_TARGET_HAS_ext16u_i32);
-        tcg_out_op_rr(s, INDEX_op_ext16u_i32, rd, rs);
-    }
+    tcg_out_extract(s, TCG_TYPE_REG, rd, rs, 0, 16);
 }
 
 static void tcg_out_ext32s(TCGContext *s, TCGReg rd, TCGReg rs)
 {
     tcg_debug_assert(TCG_TARGET_REG_BITS == 64);
-    tcg_debug_assert(TCG_TARGET_HAS_ext32s_i64);
-    tcg_out_op_rr(s, INDEX_op_ext32s_i64, rd, rs);
+    tcg_out_sextract(s, TCG_TYPE_I64, rd, rs, 0, 32);
 }
 
 static void tcg_out_ext32u(TCGContext *s, TCGReg rd, TCGReg rs)
 {
     tcg_debug_assert(TCG_TARGET_REG_BITS == 64);
-    tcg_debug_assert(TCG_TARGET_HAS_ext32u_i64);
-    tcg_out_op_rr(s, INDEX_op_ext32u_i64, rd, rs);
+    tcg_out_extract(s, TCG_TYPE_I64, rd, rs, 0, 32);
 }
 
 static void tcg_out_exts_i32_i64(TCGContext *s, TCGReg rd, TCGReg rs)
@@ -690,7 +658,7 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
                        const int const_args[TCG_MAX_OP_ARGS])
 {
-    TCGOpcode exts;
+    int width;
 
     switch (opc) {
     case INDEX_op_goto_ptr:
@@ -777,18 +745,16 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         break;
 
     case INDEX_op_bswap16_i32: /* Optional (TCG_TARGET_HAS_bswap16_i32). */
-        exts = INDEX_op_ext16s_i32;
-        goto do_bswap;
     case INDEX_op_bswap16_i64: /* Optional (TCG_TARGET_HAS_bswap16_i64). */
-        exts = INDEX_op_ext16s_i64;
+        width = 16;
         goto do_bswap;
     case INDEX_op_bswap32_i64: /* Optional (TCG_TARGET_HAS_bswap32_i64). */
-        exts = INDEX_op_ext32s_i64;
+        width = 32;
     do_bswap:
         /* The base tci bswaps zero-extend, and ignore high bits. */
         tcg_out_op_rr(s, opc, args[0], args[1]);
         if (args[2] & TCG_BSWAP_OS) {
-            tcg_out_op_rr(s, exts, args[0], args[0]);
+            tcg_out_sextract(s, TCG_TYPE_REG, args[0], args[0], 0, width);
         }
         break;
 
@@ -838,17 +804,7 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
-    case INDEX_op_ext8s_i32:  /* Always emitted via tcg_reg_alloc_op.  */
-    case INDEX_op_ext8s_i64:
-    case INDEX_op_ext8u_i32:
-    case INDEX_op_ext8u_i64:
-    case INDEX_op_ext16s_i32:
-    case INDEX_op_ext16s_i64:
-    case INDEX_op_ext16u_i32:
-    case INDEX_op_ext16u_i64:
-    case INDEX_op_ext32s_i64:
-    case INDEX_op_ext32u_i64:
-    case INDEX_op_ext_i32_i64:
+    case INDEX_op_ext_i32_i64:  /* Always emitted via tcg_reg_alloc_op.  */
     case INDEX_op_extu_i32_i64:
     case INDEX_op_extrl_i64_i32:
     default:

From b5701261da6607e61ef1fe605d85bf31806fcd34 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 28 Dec 2024 15:58:24 -0800
Subject: [PATCH 0363/2760] tcg: Merge INDEX_op_mov_{i32,i64}
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Begin to rely on TCGOp.type to discriminate operations,
rather than two different opcodes.  Convert mov first.
Introduce TCG_OPF_INT in order to keep opcode dumps the same.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 docs/devel/tcg-ops.rst           |  4 ++--
 include/tcg/tcg-opc.h            |  4 ++--
 include/tcg/tcg.h                |  2 ++
 tcg/aarch64/tcg-target.c.inc     |  2 --
 tcg/arm/tcg-target.c.inc         |  1 -
 tcg/i386/tcg-target.c.inc        |  2 --
 tcg/loongarch64/tcg-target.c.inc |  2 --
 tcg/mips/tcg-target.c.inc        |  2 --
 tcg/optimize.c                   |  7 +++----
 tcg/ppc/tcg-target.c.inc         |  2 --
 tcg/riscv/tcg-target.c.inc       |  2 --
 tcg/s390x/tcg-target.c.inc       |  2 --
 tcg/sparc64/tcg-target.c.inc     |  2 --
 tcg/tcg-op.c                     |  4 ++--
 tcg/tcg.c                        | 32 ++++++++++++++++++--------------
 tcg/tci.c                        |  5 ++---
 tcg/tci/tcg-target.c.inc         | 15 +--------------
 17 files changed, 32 insertions(+), 58 deletions(-)

diff --git a/docs/devel/tcg-ops.rst b/docs/devel/tcg-ops.rst
index 3db7b81637..e6ccc78fa1 100644
--- a/docs/devel/tcg-ops.rst
+++ b/docs/devel/tcg-ops.rst
@@ -391,10 +391,10 @@ Misc
 
 .. list-table::
 
-   * - mov_i32/i64 *t0*, *t1*
+   * - mov *t0*, *t1*
 
      - | *t0* = *t1*
-       | Move *t1* to *t0* (both operands must have the same type).
+       | Move *t1* to *t0*.
 
    * - bswap16_i32/i64 *t0*, *t1*, *flags*
 
diff --git a/include/tcg/tcg-opc.h b/include/tcg/tcg-opc.h
index c26cffaa3f..766fd00d99 100644
--- a/include/tcg/tcg-opc.h
+++ b/include/tcg/tcg-opc.h
@@ -37,7 +37,8 @@ DEF(br, 0, 0, 1, TCG_OPF_BB_END | TCG_OPF_NOT_PRESENT)
 
 DEF(mb, 0, 0, 1, TCG_OPF_NOT_PRESENT)
 
-DEF(mov_i32, 1, 1, 0, TCG_OPF_NOT_PRESENT)
+DEF(mov, 1, 1, 0, TCG_OPF_INT | TCG_OPF_NOT_PRESENT)
+
 DEF(setcond_i32, 1, 2, 1, 0)
 DEF(negsetcond_i32, 1, 2, 1, 0)
 DEF(movcond_i32, 1, 4, 1, 0)
@@ -98,7 +99,6 @@ DEF(clz_i32, 1, 2, 0, 0)
 DEF(ctz_i32, 1, 2, 0, 0)
 DEF(ctpop_i32, 1, 1, 0, 0)
 
-DEF(mov_i64, 1, 1, 0, TCG_OPF_NOT_PRESENT)
 DEF(setcond_i64, 1, 2, 1, 0)
 DEF(negsetcond_i64, 1, 2, 1, 0)
 DEF(movcond_i64, 1, 4, 1, 0)
diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
index 84d99508b6..c6b50b5226 100644
--- a/include/tcg/tcg.h
+++ b/include/tcg/tcg.h
@@ -741,6 +741,8 @@ enum {
     /* Instruction has side effects: it cannot be removed if its outputs
        are not used, and might trigger exceptions.  */
     TCG_OPF_SIDE_EFFECTS = 0x08,
+    /* Instruction operands may be I32 or I64 */
+    TCG_OPF_INT          = 0x10,
     /* Instruction is optional and not implemented by the host, or insn
        is generic and should not be implemented by the host.  */
     TCG_OPF_NOT_PRESENT  = 0x20,
diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index b8b26c1c93..466042a577 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -2488,8 +2488,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType ext,
         tcg_out_mb(s, a0);
         break;
 
-    case INDEX_op_mov_i32:  /* Always emitted via tcg_out_mov.  */
-    case INDEX_op_mov_i64:
     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index 0e48f790f9..0fafe97230 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -2109,7 +2109,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_mb(s, args[0]);
         break;
 
-    case INDEX_op_mov_i32:  /* Always emitted via tcg_out_mov.  */
     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index 02024018cb..75c8665d74 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -3011,8 +3011,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     case INDEX_op_mb:
         tcg_out_mb(s, a0);
         break;
-    case INDEX_op_mov_i32:  /* Always emitted via tcg_out_mov.  */
-    case INDEX_op_mov_i64:
     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index 6e77d3e79b..b0a4ec4c13 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -1702,8 +1702,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_qemu_ldst_i128(s, a0, a1, a2, a3, false);
         break;
 
-    case INDEX_op_mov_i32:  /* Always emitted via tcg_out_mov.  */
-    case INDEX_op_mov_i64:
     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index f77159bdc7..4d52e0bde0 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -2101,8 +2101,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     case INDEX_op_mb:
         tcg_out_mb(s, a0);
         break;
-    case INDEX_op_mov_i32:  /* Always emitted via tcg_out_mov.  */
-    case INDEX_op_mov_i64:
     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
diff --git a/tcg/optimize.c b/tcg/optimize.c
index e9e654597d..8d5bad07aa 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -375,10 +375,8 @@ static bool tcg_opt_gen_mov(OptContext *ctx, TCGOp *op, TCGArg dst, TCGArg src)
 
     switch (ctx->type) {
     case TCG_TYPE_I32:
-        new_op = INDEX_op_mov_i32;
-        break;
     case TCG_TYPE_I64:
-        new_op = INDEX_op_mov_i64;
+        new_op = INDEX_op_mov;
         break;
     case TCG_TYPE_V64:
     case TCG_TYPE_V128:
@@ -2933,7 +2931,8 @@ void tcg_optimize(TCGContext *s)
         case INDEX_op_mb:
             done = fold_mb(&ctx, op);
             break;
-        CASE_OP_32_64_VEC(mov):
+        case INDEX_op_mov:
+        case INDEX_op_mov_vec:
             done = fold_mov(&ctx, op);
             break;
         CASE_OP_32_64(movcond):
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index e10c1c5162..11dcfe66f3 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -3468,8 +3468,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_mb(s, args[0]);
         break;
 
-    case INDEX_op_mov_i32:   /* Always emitted via tcg_out_mov.  */
-    case INDEX_op_mov_i64:
     case INDEX_op_call:      /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:   /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:   /* Always emitted via tcg_out_goto_tb.  */
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index d525df4e1d..6f9d87df48 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -2380,8 +2380,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    case INDEX_op_mov_i32:  /* Always emitted via tcg_out_mov.  */
-    case INDEX_op_mov_i64:
     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index 8421320928..30fa26e884 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -2776,8 +2776,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    case INDEX_op_mov_i32:  /* Always emitted via tcg_out_mov.  */
-    case INDEX_op_mov_i64:
     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index 787e0d896c..cb5e8d554d 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -1512,8 +1512,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_arithi(s, a0, a1, a2, SHIFT_SRA);
         break;
 
-    case INDEX_op_mov_i32:  /* Always emitted via tcg_out_mov.  */
-    case INDEX_op_mov_i64:
     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index 48793ed439..108dc61e9a 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -351,7 +351,7 @@ void tcg_gen_discard_i32(TCGv_i32 arg)
 void tcg_gen_mov_i32(TCGv_i32 ret, TCGv_i32 arg)
 {
     if (ret != arg) {
-        tcg_gen_op2_i32(INDEX_op_mov_i32, ret, arg);
+        tcg_gen_op2_i32(INDEX_op_mov, ret, arg);
     }
 }
 
@@ -1411,7 +1411,7 @@ void tcg_gen_mov_i64(TCGv_i64 ret, TCGv_i64 arg)
         return;
     }
     if (TCG_TARGET_REG_BITS == 64) {
-        tcg_gen_op2_i64(INDEX_op_mov_i64, ret, arg);
+        tcg_gen_op2_i64(INDEX_op_mov, ret, arg);
     } else {
         TCGTemp *ts = tcgv_i64_temp(arg);
 
diff --git a/tcg/tcg.c b/tcg/tcg.c
index e8fd89e4c8..7ff211081d 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -2187,7 +2187,9 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_qemu_st_i128:
         return TCG_TARGET_HAS_qemu_ldst_i128;
 
-    case INDEX_op_mov_i32:
+    case INDEX_op_mov:
+        return has_type;
+
     case INDEX_op_setcond_i32:
     case INDEX_op_brcond_i32:
     case INDEX_op_movcond_i32:
@@ -2269,7 +2271,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_setcond2_i32:
         return TCG_TARGET_REG_BITS == 32;
 
-    case INDEX_op_mov_i64:
     case INDEX_op_setcond_i64:
     case INDEX_op_brcond_i64:
     case INDEX_op_movcond_i64:
@@ -2840,18 +2841,23 @@ void tcg_dump_ops(TCGContext *s, FILE *f, bool have_prefs)
                 col += ne_fprintf(f, ",%s", t);
             }
         } else {
-            col += ne_fprintf(f, " %s ", def->name);
+            if (def->flags & TCG_OPF_INT) {
+                col += ne_fprintf(f, " %s_i%d ",
+                                  def->name,
+                                  8 * tcg_type_size(TCGOP_TYPE(op)));
+            } else if (def->flags & TCG_OPF_VECTOR) {
+                col += ne_fprintf(f, "%s v%d,e%d,",
+                                  def->name,
+                                  8 * tcg_type_size(TCGOP_TYPE(op)),
+                                  8 << TCGOP_VECE(op));
+            } else {
+                col += ne_fprintf(f, " %s ", def->name);
+            }
 
             nb_oargs = def->nb_oargs;
             nb_iargs = def->nb_iargs;
             nb_cargs = def->nb_cargs;
 
-            if (def->flags & TCG_OPF_VECTOR) {
-                col += ne_fprintf(f, "v%d,e%d,",
-                                  8 * tcg_type_size(TCGOP_TYPE(op)),
-                                  8 << TCGOP_VECE(op));
-            }
-
             k = 0;
             for (i = 0; i < nb_oargs; i++) {
                 const char *sep =  k ? "," : "";
@@ -4144,8 +4150,7 @@ liveness_pass_1(TCGContext *s)
 
             /* Incorporate constraints for this operand.  */
             switch (opc) {
-            case INDEX_op_mov_i32:
-            case INDEX_op_mov_i64:
+            case INDEX_op_mov:
                 /* Note that these are TCG_OPF_NOT_PRESENT and do not
                    have proper constraints.  That said, special case
                    moves to propagate preferences backward.  */
@@ -4304,7 +4309,7 @@ liveness_pass_2(TCGContext *s)
         }
 
         /* Outputs become available.  */
-        if (opc == INDEX_op_mov_i32 || opc == INDEX_op_mov_i64) {
+        if (opc == INDEX_op_mov) {
             arg_ts = arg_temp(op->args[0]);
             dir_ts = arg_ts->state_ptr;
             if (dir_ts) {
@@ -6435,8 +6440,7 @@ int tcg_gen_code(TCGContext *s, TranslationBlock *tb, uint64_t pc_start)
         TCGOpcode opc = op->opc;
 
         switch (opc) {
-        case INDEX_op_mov_i32:
-        case INDEX_op_mov_i64:
+        case INDEX_op_mov:
         case INDEX_op_mov_vec:
             tcg_reg_alloc_mov(s, op);
             break;
diff --git a/tcg/tci.c b/tcg/tci.c
index 531cd83aae..78183ea47d 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -463,7 +463,7 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             regs[r0] = regs[tmp32 ? r3 : r4];
             break;
 #endif
-        CASE_32_64(mov)
+        case INDEX_op_mov:
             tci_args_rr(insn, &r0, &r1);
             regs[r0] = regs[r1];
             break;
@@ -1063,8 +1063,7 @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
                            op_name, str_r(r0), str_r(r1), s2);
         break;
 
-    case INDEX_op_mov_i32:
-    case INDEX_op_mov_i64:
+    case INDEX_op_mov:
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
     case INDEX_op_bswap16_i32:
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index 6f8f1dd8ae..9a5d3c2875 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -483,18 +483,7 @@ static void tcg_out_ld(TCGContext *s, TCGType type, TCGReg val, TCGReg base,
 
 static bool tcg_out_mov(TCGContext *s, TCGType type, TCGReg ret, TCGReg arg)
 {
-    switch (type) {
-    case TCG_TYPE_I32:
-        tcg_out_op_rr(s, INDEX_op_mov_i32, ret, arg);
-        break;
-#if TCG_TARGET_REG_BITS == 64
-    case TCG_TYPE_I64:
-        tcg_out_op_rr(s, INDEX_op_mov_i64, ret, arg);
-        break;
-#endif
-    default:
-        g_assert_not_reached();
-    }
+    tcg_out_op_rr(s, INDEX_op_mov, ret, arg);
     return true;
 }
 
@@ -799,8 +788,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_op_v(s, opc);
         break;
 
-    case INDEX_op_mov_i32:  /* Always emitted via tcg_out_mov.  */
-    case INDEX_op_mov_i64:
     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */

From 662cdbcf0073c4de8456f5e573523571e3d9da5b Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 6 Jan 2025 09:00:07 -0800
Subject: [PATCH 0364/2760] tcg: Convert add to TCGOutOpBinary
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Drop all backend support for an immediate as the first operand.
This should never happen in any case, as we swap commutative
operands to place immediates as the second operand.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target.c.inc     |  51 +++++++-------
 tcg/arm/tcg-target.c.inc         |  43 ++++++++----
 tcg/i386/tcg-target.c.inc        |  56 +++++++++-------
 tcg/loongarch64/tcg-target.c.inc |  38 +++++------
 tcg/mips/tcg-target.c.inc        |  31 ++++++---
 tcg/ppc/tcg-target.c.inc         |  47 +++++++------
 tcg/riscv/tcg-target.c.inc       |  39 ++++++-----
 tcg/s390x/tcg-target.c.inc       | 110 +++++++++++++++----------------
 tcg/sparc64/tcg-target-con-set.h |   1 +
 tcg/sparc64/tcg-target.c.inc     |  25 +++++--
 tcg/tcg.c                        |  41 +++++++++++-
 tcg/tci/tcg-target.c.inc         |  15 ++++-
 12 files changed, 302 insertions(+), 195 deletions(-)

diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index 466042a577..a181b7e65a 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -1592,16 +1592,6 @@ static void tcg_out_extrl_i64_i32(TCGContext *s, TCGReg rd, TCGReg rn)
     tcg_out_mov(s, TCG_TYPE_I32, rd, rn);
 }
 
-static void tcg_out_addsubi(TCGContext *s, int ext, TCGReg rd,
-                            TCGReg rn, int64_t aimm)
-{
-    if (aimm >= 0) {
-        tcg_out_insn(s, 3401, ADDI, ext, rd, rn, aimm);
-    } else {
-        tcg_out_insn(s, 3401, SUBI, ext, rd, rn, -aimm);
-    }
-}
-
 static void tcg_out_addsub2(TCGContext *s, TCGType ext, TCGReg rl,
                             TCGReg rh, TCGReg al, TCGReg ah,
                             tcg_target_long bl, tcg_target_long bh,
@@ -2115,6 +2105,30 @@ void tb_target_set_jmp_target(const TranslationBlock *tb, int n,
     flush_idcache_range(jmp_rx, jmp_rw, 4);
 }
 
+
+static void tgen_add(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_insn(s, 3502, ADD, type, a0, a1, a2);
+}
+
+static void tgen_addi(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    if (a2 >= 0) {
+        tcg_out_insn(s, 3401, ADDI, type, a0, a1, a2);
+    } else {
+        tcg_out_insn(s, 3401, SUBI, type, a0, a1, -a2);
+    }
+}
+
+static const TCGOutOpBinary outop_add = {
+    .base.static_constraint = C_O1_I2(r, r, rA),
+    .out_rrr = tgen_add,
+    .out_rri = tgen_addi,
+};
+
+
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType ext,
                        const TCGArg args[TCG_MAX_OP_ARGS],
                        const int const_args[TCG_MAX_OP_ARGS])
@@ -2181,23 +2195,10 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType ext,
         tcg_out_ldst(s, I3312_STRX, a0, a1, a2, 3);
         break;
 
-    case INDEX_op_add_i32:
-        a2 = (int32_t)a2;
-        /* FALLTHRU */
-    case INDEX_op_add_i64:
-        if (c2) {
-            tcg_out_addsubi(s, ext, a0, a1, a2);
-        } else {
-            tcg_out_insn(s, 3502, ADD, ext, a0, a1, a2);
-        }
-        break;
-
     case INDEX_op_sub_i32:
-        a2 = (int32_t)a2;
-        /* FALLTHRU */
     case INDEX_op_sub_i64:
         if (c2) {
-            tcg_out_addsubi(s, ext, a0, a1, -a2);
+            tgen_addi(s, ext, a0, a1, -a2);
         } else {
             tcg_out_insn(s, 3502, SUB, ext, a0, a1, a2);
         }
@@ -2984,8 +2985,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(rz, r);
 
-    case INDEX_op_add_i32:
-    case INDEX_op_add_i64:
     case INDEX_op_sub_i32:
     case INDEX_op_sub_i64:
         return C_O1_I2(r, r, rA);
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index 0fafe97230..a1f2184ac4 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -890,6 +890,17 @@ static void tcg_out_dat_rIK(TCGContext *s, ARMCond cond, ARMInsn opc,
     }
 }
 
+static void tcg_out_dat_IN(TCGContext *s, ARMCond cond, ARMInsn opc,
+                           ARMInsn opneg, TCGReg dst, TCGReg lhs, TCGArg rhs)
+{
+    int imm12 = encode_imm(rhs);
+    if (imm12 < 0) {
+        imm12 = encode_imm_nofail(-rhs);
+        opc = opneg;
+    }
+    tcg_out_dat_imm(s, cond, opc, dst, lhs, imm12);
+}
+
 static void tcg_out_dat_rIN(TCGContext *s, ARMCond cond, ARMInsn opc,
                             ARMInsn opneg, TCGReg dst, TCGReg lhs, TCGArg rhs,
                             bool rhs_is_const)
@@ -898,12 +909,7 @@ static void tcg_out_dat_rIN(TCGContext *s, ARMCond cond, ARMInsn opc,
      * rhs must satisfy the "rIN" constraint.
      */
     if (rhs_is_const) {
-        int imm12 = encode_imm(rhs);
-        if (imm12 < 0) {
-            imm12 = encode_imm_nofail(-rhs);
-            opc = opneg;
-        }
-        tcg_out_dat_imm(s, cond, opc, dst, lhs, imm12);
+        tcg_out_dat_IN(s, cond, opc, opneg, dst, lhs, rhs);
     } else {
         tcg_out_dat_reg(s, cond, opc, dst, lhs, rhs, SHIFT_IMM_LSL(0));
     }
@@ -1821,6 +1827,26 @@ void tb_target_set_jmp_target(const TranslationBlock *tb, int n,
     flush_idcache_range(jmp_rx, jmp_rw, 4);
 }
 
+
+static void tgen_add(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_dat_reg(s, COND_AL, ARITH_ADD, a0, a1, a2, SHIFT_IMM_LSL(0));
+}
+
+static void tgen_addi(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    tcg_out_dat_IN(s, COND_AL, ARITH_ADD, ARITH_SUB, a0, a1, a2);
+}
+
+static const TCGOutOpBinary outop_add = {
+    .base.static_constraint = C_O1_I2(r, r, rIN),
+    .out_rrr = tgen_add,
+    .out_rri = tgen_addi,
+};
+
+
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
                        const int const_args[TCG_MAX_OP_ARGS])
@@ -1869,10 +1895,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_dat_rIK(s, tcg_cond_to_arm_cond[c], ARITH_MOV,
                         ARITH_MVN, args[0], 0, args[3], const_args[3]);
         break;
-    case INDEX_op_add_i32:
-        tcg_out_dat_rIN(s, COND_AL, ARITH_ADD, ARITH_SUB,
-                        args[0], args[1], args[2], const_args[2]);
-        break;
     case INDEX_op_sub_i32:
         if (const_args[1]) {
             if (const_args[2]) {
@@ -2142,7 +2164,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i32:
         return C_O0_I2(r, r);
 
-    case INDEX_op_add_i32:
     case INDEX_op_sub_i32:
     case INDEX_op_setcond_i32:
     case INDEX_op_negsetcond_i32:
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index 75c8665d74..1115d1e38d 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -2562,6 +2562,40 @@ void tb_target_set_jmp_target(const TranslationBlock *tb, int n,
     /* no need to flush icache explicitly */
 }
 
+
+static void tgen_add(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    int rexw = type == TCG_TYPE_I32 ? 0 : P_REXW;
+
+    if (a0 == a1) {
+        tgen_arithr(s, ARITH_ADD + rexw, a0, a2);
+    } else if (a0 == a2) {
+        tgen_arithr(s, ARITH_ADD + rexw, a0, a1);
+    } else {
+        tcg_out_modrm_sib_offset(s, OPC_LEA + rexw, a0, a1, a2, 0, 0);
+    }
+}
+
+static void tgen_addi(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    int rexw = type == TCG_TYPE_I32 ? 0 : P_REXW;
+
+    if (a0 == a1) {
+        tgen_arithi(s, ARITH_ADD + rexw, a0, a2, false);
+    } else {
+        tcg_out_modrm_sib_offset(s, OPC_LEA + rexw, a0, a1, -1, 0, a2);
+    }
+}
+
+static const TCGOutOpBinary outop_add = {
+    .base.static_constraint = C_O1_I2(r, r, re),
+    .out_rrr = tgen_add,
+    .out_rri = tgen_addi,
+};
+
+
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
                        const int const_args[TCG_MAX_OP_ARGS])
@@ -2642,24 +2676,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    OP_32_64(add):
-        /* For 3-operand addition, use LEA.  */
-        if (a0 != a1) {
-            TCGArg c3 = 0;
-            if (const_a2) {
-                c3 = a2, a2 = -1;
-            } else if (a0 == a2) {
-                /* Watch out for dest = src + dest, since we've removed
-                   the matching constraint on the add.  */
-                tgen_arithr(s, ARITH_ADD + rexw, a0, a1);
-                break;
-            }
-
-            tcg_out_modrm_sib_offset(s, OPC_LEA + rexw, a0, a1, a2, 0, c3);
-            break;
-        }
-        c = ARITH_ADD;
-        goto gen_arith;
     OP_32_64(sub):
         c = ARITH_SUB;
         goto gen_arith;
@@ -3599,10 +3615,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(re, r);
 
-    case INDEX_op_add_i32:
-    case INDEX_op_add_i64:
-        return C_O1_I2(r, r, re);
-
     case INDEX_op_sub_i32:
     case INDEX_op_sub_i64:
     case INDEX_op_mul_i32:
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index b0a4ec4c13..fee5e7c577 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -1286,6 +1286,24 @@ void tb_target_set_jmp_target(const TranslationBlock *tb, int n,
     flush_idcache_range(jmp_rx, jmp_rw, 4);
 }
 
+
+static void tgen_add(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    if (type == TCG_TYPE_I32) {
+        tcg_out_opc_add_w(s, a0, a1, a2);
+    } else {
+        tcg_out_opc_add_d(s, a0, a1, a2);
+    }
+}
+
+static const TCGOutOpBinary outop_add = {
+    .base.static_constraint = C_O1_I2(r, r, rJ),
+    .out_rrr = tgen_add,
+    .out_rri = tcg_out_addi,
+};
+
+
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
                        const int const_args[TCG_MAX_OP_ARGS])
@@ -1544,21 +1562,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    case INDEX_op_add_i32:
-        if (c2) {
-            tcg_out_addi(s, TCG_TYPE_I32, a0, a1, a2);
-        } else {
-            tcg_out_opc_add_w(s, a0, a1, a2);
-        }
-        break;
-    case INDEX_op_add_i64:
-        if (c2) {
-            tcg_out_addi(s, TCG_TYPE_I64, a0, a1, a2);
-        } else {
-            tcg_out_opc_add_d(s, a0, a1, a2);
-        }
-        break;
-
     case INDEX_op_sub_i32:
         if (c2) {
             tcg_out_addi(s, TCG_TYPE_I32, a0, a1, -a2);
@@ -2287,11 +2290,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_rotr_i64:
         return C_O1_I2(r, r, ri);
 
-    case INDEX_op_add_i32:
-        return C_O1_I2(r, r, ri);
-    case INDEX_op_add_i64:
-        return C_O1_I2(r, r, rJ);
-
     case INDEX_op_and_i32:
     case INDEX_op_and_i64:
     case INDEX_op_nor_i32:
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index 4d52e0bde0..263e7e66c9 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -1655,6 +1655,28 @@ void tb_target_set_jmp_target(const TranslationBlock *tb, int n,
     /* Always indirect, nothing to do */
 }
 
+
+static void tgen_add(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    MIPSInsn insn = type == TCG_TYPE_I32 ? OPC_ADDU : OPC_DADDU;
+    tcg_out_opc_reg(s, insn, a0, a1, a2);
+}
+
+static void tgen_addi(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    MIPSInsn insn = type == TCG_TYPE_I32 ? OPC_ADDIU : OPC_DADDIU;
+    tcg_out_opc_imm(s, insn, a0, a1, a2);
+}
+
+static const TCGOutOpBinary outop_add = {
+    .base.static_constraint = C_O1_I2(r, r, rJ),
+    .out_rrr = tgen_add,
+    .out_rri = tgen_addi,
+};
+
+
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
                        const int const_args[TCG_MAX_OP_ARGS])
@@ -1727,12 +1749,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_ldst(s, i1, a0, a1, a2);
         break;
 
-    case INDEX_op_add_i32:
-        i1 = OPC_ADDU, i2 = OPC_ADDIU;
-        goto do_binary;
-    case INDEX_op_add_i64:
-        i1 = OPC_DADDU, i2 = OPC_DADDIU;
-        goto do_binary;
     case INDEX_op_or_i32:
     case INDEX_op_or_i64:
         i1 = OPC_OR, i2 = OPC_ORI;
@@ -2159,9 +2175,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(rz, r);
 
-    case INDEX_op_add_i32:
-    case INDEX_op_add_i64:
-        return C_O1_I2(r, r, rJ);
     case INDEX_op_sub_i32:
     case INDEX_op_sub_i64:
         return C_O1_I2(r, rz, rN);
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index 11dcfe66f3..6b27238499 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -2902,6 +2902,26 @@ void tb_target_set_jmp_target(const TranslationBlock *tb, int n,
     flush_idcache_range(jmp_rx, jmp_rw, 4);
 }
 
+
+static void tgen_add(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out32(s, ADD | TAB(a0, a1, a2));
+}
+
+static void tgen_addi(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    tcg_out_mem_long(s, ADDI, ADD, a0, a1, a2);
+}
+
+static const TCGOutOpBinary outop_add = {
+    .base.static_constraint = C_O1_I2(r, r, rT),
+    .out_rrr = tgen_add,
+    .out_rri = tgen_addi,
+};
+
+
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
                        const int const_args[TCG_MAX_OP_ARGS])
@@ -2971,15 +2991,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_mem_long(s, STD, STDX, args[0], args[1], args[2]);
         break;
 
-    case INDEX_op_add_i32:
-        a0 = args[0], a1 = args[1], a2 = args[2];
-        if (const_args[2]) {
-        do_addi_32:
-            tcg_out_mem_long(s, ADDI, ADD, a0, a1, (int32_t)a2);
-        } else {
-            tcg_out32(s, ADD | TAB(a0, a1, a2));
-        }
-        break;
     case INDEX_op_sub_i32:
         a0 = args[0], a1 = args[1], a2 = args[2];
         if (const_args[1]) {
@@ -2989,8 +3000,7 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                 tcg_out32(s, SUBFIC | TAI(a0, a2, a1));
             }
         } else if (const_args[2]) {
-            a2 = -a2;
-            goto do_addi_32;
+            tgen_addi(s, type, a0, a1, (int32_t)-a2);
         } else {
             tcg_out32(s, SUBF | TAB(a0, a2, a1));
         }
@@ -3185,15 +3195,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out32(s, NOR | SAB(args[1], args[0], args[1]));
         break;
 
-    case INDEX_op_add_i64:
-        a0 = args[0], a1 = args[1], a2 = args[2];
-        if (const_args[2]) {
-        do_addi_64:
-            tcg_out_mem_long(s, ADDI, ADD, a0, a1, a2);
-        } else {
-            tcg_out32(s, ADD | TAB(a0, a1, a2));
-        }
-        break;
     case INDEX_op_sub_i64:
         a0 = args[0], a1 = args[1], a2 = args[2];
         if (const_args[1]) {
@@ -3203,8 +3204,7 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                 tcg_out32(s, SUBFIC | TAI(a0, a2, a1));
             }
         } else if (const_args[2]) {
-            a2 = -a2;
-            goto do_addi_64;
+            tgen_addi(s, type, a0, a1, -a2);
         } else {
             tcg_out32(s, SUBF | TAB(a0, a2, a1));
         }
@@ -4129,7 +4129,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(r, r);
 
-    case INDEX_op_add_i32:
     case INDEX_op_and_i32:
     case INDEX_op_or_i32:
     case INDEX_op_xor_i32:
@@ -4176,8 +4175,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 
     case INDEX_op_sub_i32:
         return C_O1_I2(r, rI, ri);
-    case INDEX_op_add_i64:
-        return C_O1_I2(r, r, rT);
     case INDEX_op_or_i64:
     case INDEX_op_xor_i64:
         return C_O1_I2(r, r, rU);
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index 6f9d87df48..135137ff53 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -1957,6 +1957,28 @@ void tb_target_set_jmp_target(const TranslationBlock *tb, int n,
     flush_idcache_range(jmp_rx, jmp_rw, 4);
 }
 
+
+static void tgen_add(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    RISCVInsn insn = type == TCG_TYPE_I32 ? OPC_ADDW : OPC_ADD;
+    tcg_out_opc_reg(s, insn, a0, a1, a2);
+}
+
+static void tgen_addi(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    RISCVInsn insn = type == TCG_TYPE_I32 ? OPC_ADDIW : OPC_ADDI;
+    tcg_out_opc_imm(s, insn, a0, a1, a2);
+}
+
+static const TCGOutOpBinary outop_add = {
+    .base.static_constraint = C_O1_I2(r, r, rI),
+    .out_rrr = tgen_add,
+    .out_rri = tgen_addi,
+};
+
+
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
                        const int const_args[TCG_MAX_OP_ARGS])
@@ -2019,21 +2041,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_ldst(s, OPC_SD, a0, a1, a2);
         break;
 
-    case INDEX_op_add_i32:
-        if (c2) {
-            tcg_out_opc_imm(s, OPC_ADDIW, a0, a1, a2);
-        } else {
-            tcg_out_opc_reg(s, OPC_ADDW, a0, a1, a2);
-        }
-        break;
-    case INDEX_op_add_i64:
-        if (c2) {
-            tcg_out_opc_imm(s, OPC_ADDI, a0, a1, a2);
-        } else {
-            tcg_out_opc_reg(s, OPC_ADD, a0, a1, a2);
-        }
-        break;
-
     case INDEX_op_sub_i32:
         if (c2) {
             tcg_out_opc_imm(s, OPC_ADDIW, a0, a1, -a2);
@@ -2657,11 +2664,9 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(rz, r);
 
-    case INDEX_op_add_i32:
     case INDEX_op_and_i32:
     case INDEX_op_or_i32:
     case INDEX_op_xor_i32:
-    case INDEX_op_add_i64:
     case INDEX_op_and_i64:
     case INDEX_op_or_i64:
     case INDEX_op_xor_i64:
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index 30fa26e884..f5441d2033 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -2145,6 +2145,58 @@ void tb_target_set_jmp_target(const TranslationBlock *tb, int n,
     /* no need to flush icache explicitly */
 }
 
+
+static void tgen_add(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    if (a0 != a1) {
+        tcg_out_insn(s, RX, LA, a0, a1, a2, 0);
+    } else if (type == TCG_TYPE_I32) {
+        tcg_out_insn(s, RR, AR, a0, a2);
+    } else {
+        tcg_out_insn(s, RRE, AGR, a0, a2);
+    }
+}
+
+static void tgen_addi(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    if (a0 == a1) {
+        if (type == TCG_TYPE_I32) {
+            if (a2 == (int16_t)a2) {
+                tcg_out_insn(s, RI, AHI, a0, a2);
+            } else {
+                tcg_out_insn(s, RIL, AFI, a0, a2);
+            }
+            return;
+        }
+        if (a2 == (int16_t)a2) {
+            tcg_out_insn(s, RI, AGHI, a0, a2);
+            return;
+        }
+        if (a2 == (int32_t)a2) {
+            tcg_out_insn(s, RIL, AGFI, a0, a2);
+            return;
+        }
+        if (a2 == (uint32_t)a2) {
+            tcg_out_insn(s, RIL, ALGFI, a0, a2);
+            return;
+        }
+        if (-a2 == (uint32_t)-a2) {
+            tcg_out_insn(s, RIL, SLGFI, a0, -a2);
+            return;
+        }
+    }
+    tcg_out_mem(s, RX_LA, RXY_LAY, a0, a1, TCG_REG_NONE, a2);
+}
+
+static const TCGOutOpBinary outop_add = {
+    .base.static_constraint = C_O1_I2(r, r, ri),
+    .out_rrr = tgen_add,
+    .out_rri = tgen_addi,
+};
+
+
 # define OP_32_64(x) \
         case glue(glue(INDEX_op_,x),_i32): \
         case glue(glue(INDEX_op_,x),_i64)
@@ -2201,30 +2253,10 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_st(s, TCG_TYPE_I32, args[0], args[1], args[2]);
         break;
 
-    case INDEX_op_add_i32:
-        a0 = args[0], a1 = args[1], a2 = (int32_t)args[2];
-        if (const_args[2]) {
-        do_addi_32:
-            if (a0 == a1) {
-                if (a2 == (int16_t)a2) {
-                    tcg_out_insn(s, RI, AHI, a0, a2);
-                    break;
-                }
-                tcg_out_insn(s, RIL, AFI, a0, a2);
-                break;
-            }
-            tcg_out_mem(s, RX_LA, RXY_LAY, a0, a1, TCG_REG_NONE, a2);
-        } else if (a0 == a1) {
-            tcg_out_insn(s, RR, AR, a0, a2);
-        } else {
-            tcg_out_insn(s, RX, LA, a0, a1, a2, 0);
-        }
-        break;
     case INDEX_op_sub_i32:
-        a0 = args[0], a1 = args[1], a2 = (int32_t)args[2];
+        a0 = args[0], a1 = args[1], a2 = args[2];
         if (const_args[2]) {
-            a2 = -a2;
-            goto do_addi_32;
+            tgen_addi(s, type, a0, a1, (int32_t)-a2);
         } else if (a0 == a1) {
             tcg_out_insn(s, RR, SR, a0, a2);
         } else {
@@ -2494,40 +2526,10 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_st(s, TCG_TYPE_I64, args[0], args[1], args[2]);
         break;
 
-    case INDEX_op_add_i64:
-        a0 = args[0], a1 = args[1], a2 = args[2];
-        if (const_args[2]) {
-        do_addi_64:
-            if (a0 == a1) {
-                if (a2 == (int16_t)a2) {
-                    tcg_out_insn(s, RI, AGHI, a0, a2);
-                    break;
-                }
-                if (a2 == (int32_t)a2) {
-                    tcg_out_insn(s, RIL, AGFI, a0, a2);
-                    break;
-                }
-                if (a2 == (uint32_t)a2) {
-                    tcg_out_insn(s, RIL, ALGFI, a0, a2);
-                    break;
-                }
-                if (-a2 == (uint32_t)-a2) {
-                    tcg_out_insn(s, RIL, SLGFI, a0, -a2);
-                    break;
-                }
-            }
-            tcg_out_mem(s, RX_LA, RXY_LAY, a0, a1, TCG_REG_NONE, a2);
-        } else if (a0 == a1) {
-            tcg_out_insn(s, RRE, AGR, a0, a2);
-        } else {
-            tcg_out_insn(s, RX, LA, a0, a1, a2, 0);
-        }
-        break;
     case INDEX_op_sub_i64:
         a0 = args[0], a1 = args[1], a2 = args[2];
         if (const_args[2]) {
-            a2 = -a2;
-            goto do_addi_64;
+            tgen_addi(s, type, a0, a1, -a2);
         } else {
             tcg_out_insn(s, RRFa, SGRK, a0, a1, a2);
         }
@@ -3253,8 +3255,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(r, r);
 
-    case INDEX_op_add_i32:
-    case INDEX_op_add_i64:
     case INDEX_op_shl_i64:
     case INDEX_op_shr_i64:
     case INDEX_op_sar_i64:
diff --git a/tcg/sparc64/tcg-target-con-set.h b/tcg/sparc64/tcg-target-con-set.h
index 61f9fa3d9f..d90ba11443 100644
--- a/tcg/sparc64/tcg-target-con-set.h
+++ b/tcg/sparc64/tcg-target-con-set.h
@@ -14,6 +14,7 @@ C_O0_I2(rz, r)
 C_O0_I2(rz, rJ)
 C_O1_I1(r, r)
 C_O1_I2(r, r, r)
+C_O1_I2(r, r, rJ)
 C_O1_I2(r, rz, rJ)
 C_O1_I4(r, rz, rJ, rI, 0)
 C_O2_I2(r, r, rz, rJ)
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index cb5e8d554d..f43d95b025 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -1285,6 +1285,26 @@ void tb_target_set_jmp_target(const TranslationBlock *tb, int n,
 {
 }
 
+
+static void tgen_add(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_arith(s, a0, a1, a2, ARITH_ADD);
+}
+
+static void tgen_addi(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    tcg_out_arithi(s, a0, a1, a2, ARITH_ADD);
+}
+
+static const TCGOutOpBinary outop_add = {
+    .base.static_constraint = C_O1_I2(r, r, rJ),
+    .out_rrr = tgen_add,
+    .out_rri = tgen_addi,
+};
+
+
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
                        const int const_args[TCG_MAX_OP_ARGS])
@@ -1338,9 +1358,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     case INDEX_op_st32_i64:
         tcg_out_ldst(s, a0, a1, a2, STW);
         break;
-    OP_32_64(add):
-        c = ARITH_ADD;
-        goto gen_arith;
     OP_32_64(sub):
         c = ARITH_SUB;
         goto gen_arith;
@@ -1564,8 +1581,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_qemu_st_i64:
         return C_O0_I2(rz, r);
 
-    case INDEX_op_add_i32:
-    case INDEX_op_add_i64:
     case INDEX_op_mul_i32:
     case INDEX_op_mul_i64:
     case INDEX_op_div_i32:
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 7ff211081d..18b2981c79 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -978,6 +978,14 @@ typedef struct TCGOutOp {
     TCGConstraintSetIndex (*dynamic_constraint)(TCGType type, unsigned flags);
 } TCGOutOp;
 
+typedef struct TCGOutOpBinary {
+    TCGOutOp base;
+    void (*out_rrr)(TCGContext *s, TCGType type,
+                    TCGReg a0, TCGReg a1, TCGReg a2);
+    void (*out_rri)(TCGContext *s, TCGType type,
+                    TCGReg a0, TCGReg a1, tcg_target_long a2);
+} TCGOutOpBinary;
+
 #include "tcg-target.c.inc"
 
 #ifndef CONFIG_TCG_INTERPRETER
@@ -987,10 +995,21 @@ QEMU_BUILD_BUG_ON((int)(offsetof(CPUNegativeOffsetState, tlb.f[0]) -
                   < MIN_TLB_MASK_TABLE_OFS);
 #endif
 
+/*
+ * Register V as the TCGOutOp for O.
+ * This verifies that V is of type T, otherwise give a nice compiler error.
+ * This prevents trivial mistakes within each arch/tcg-target.c.inc.
+ */
+#define OUTOP(O, T, V)  [O] = _Generic(V, T: &V.base)
+
 /* Register allocation descriptions for every TCGOpcode. */
 static const TCGOutOp * const all_outop[NB_OPS] = {
+    OUTOP(INDEX_op_add_i32, TCGOutOpBinary, outop_add),
+    OUTOP(INDEX_op_add_i64, TCGOutOpBinary, outop_add),
 };
 
+#undef OUTOP
+
 /*
  * All TCG threads except the parent (i.e. the one that called tcg_context_init
  * and registered the target's TCG globals) must register with this function
@@ -5414,6 +5433,7 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
     }
 
     /* emit instruction */
+    TCGType type = TCGOP_TYPE(op);
     switch (op->opc) {
     case INDEX_op_ext_i32_i64:
         tcg_out_exts_i32_i64(s, new_args[0], new_args[1]);
@@ -5424,12 +5444,29 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
     case INDEX_op_extrl_i64_i32:
         tcg_out_extrl_i64_i32(s, new_args[0], new_args[1]);
         break;
+
+    case INDEX_op_add_i32:
+    case INDEX_op_add_i64:
+        {
+            const TCGOutOpBinary *out =
+                container_of(all_outop[op->opc], TCGOutOpBinary, base);
+
+            /* Constants should never appear in the first source operand. */
+            tcg_debug_assert(!const_args[1]);
+            if (const_args[2]) {
+                out->out_rri(s, type, new_args[0], new_args[1], new_args[2]);
+            } else {
+                out->out_rrr(s, type, new_args[0], new_args[1], new_args[2]);
+            }
+        }
+        break;
+
     default:
         if (def->flags & TCG_OPF_VECTOR) {
-            tcg_out_vec_op(s, op->opc, TCGOP_TYPE(op) - TCG_TYPE_V64,
+            tcg_out_vec_op(s, op->opc, type - TCG_TYPE_V64,
                            TCGOP_VECE(op), new_args, const_args);
         } else {
-            tcg_out_op(s, op->opc, TCGOP_TYPE(op), new_args, const_args);
+            tcg_out_op(s, op->opc, type, new_args, const_args);
         }
         break;
     }
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index 9a5d3c2875..e6ec31e351 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -91,8 +91,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_rem_i64:
     case INDEX_op_remu_i32:
     case INDEX_op_remu_i64:
-    case INDEX_op_add_i32:
-    case INDEX_op_add_i64:
     case INDEX_op_sub_i32:
     case INDEX_op_sub_i64:
     case INDEX_op_mul_i32:
@@ -643,6 +641,18 @@ void tb_target_set_jmp_target(const TranslationBlock *tb, int n,
     /* Always indirect, nothing to do */
 }
 
+static void tgen_add(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_op_rrr(s, glue(INDEX_op_add_i,TCG_TARGET_REG_BITS), a0, a1, a2);
+}
+
+static const TCGOutOpBinary outop_add = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_add,
+};
+
+
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
                        const int const_args[TCG_MAX_OP_ARGS])
@@ -684,7 +694,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_ldst(s, opc, args[0], args[1], args[2]);
         break;
 
-    CASE_32_64(add)
     CASE_32_64(sub)
     CASE_32_64(mul)
     CASE_32_64(and)

From 79602f632a20228fc963161cd53f7d5f6a3bd953 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 6 Jan 2025 09:11:39 -0800
Subject: [PATCH 0365/2760] tcg: Merge INDEX_op_add_{i32,i64}
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Rely on TCGOP_TYPE instead of opcodes specific to each type.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 docs/devel/tcg-ops.rst   |  2 +-
 include/tcg/tcg-opc.h    |  4 ++--
 target/sh4/translate.c   |  6 +++---
 tcg/optimize.c           | 13 +++++--------
 tcg/tcg-op.c             |  4 ++--
 tcg/tcg.c                | 15 +++++----------
 tcg/tci.c                |  5 ++---
 tcg/tci/tcg-target.c.inc |  6 ++----
 8 files changed, 22 insertions(+), 33 deletions(-)

diff --git a/docs/devel/tcg-ops.rst b/docs/devel/tcg-ops.rst
index e6ccc78fa1..67387bfddf 100644
--- a/docs/devel/tcg-ops.rst
+++ b/docs/devel/tcg-ops.rst
@@ -261,7 +261,7 @@ Arithmetic
 
 .. list-table::
 
-   * - add_i32/i64 *t0*, *t1*, *t2*
+   * - add *t0*, *t1*, *t2*
 
      - | *t0* = *t1* + *t2*
 
diff --git a/include/tcg/tcg-opc.h b/include/tcg/tcg-opc.h
index 766fd00d99..0282779468 100644
--- a/include/tcg/tcg-opc.h
+++ b/include/tcg/tcg-opc.h
@@ -39,6 +39,8 @@ DEF(mb, 0, 0, 1, TCG_OPF_NOT_PRESENT)
 
 DEF(mov, 1, 1, 0, TCG_OPF_INT | TCG_OPF_NOT_PRESENT)
 
+DEF(add, 1, 2, 0, TCG_OPF_INT)
+
 DEF(setcond_i32, 1, 2, 1, 0)
 DEF(negsetcond_i32, 1, 2, 1, 0)
 DEF(movcond_i32, 1, 4, 1, 0)
@@ -52,7 +54,6 @@ DEF(st8_i32, 0, 2, 1, 0)
 DEF(st16_i32, 0, 2, 1, 0)
 DEF(st_i32, 0, 2, 1, 0)
 /* arith */
-DEF(add_i32, 1, 2, 0, 0)
 DEF(sub_i32, 1, 2, 0, 0)
 DEF(mul_i32, 1, 2, 0, 0)
 DEF(div_i32, 1, 2, 0, 0)
@@ -115,7 +116,6 @@ DEF(st16_i64, 0, 2, 1, 0)
 DEF(st32_i64, 0, 2, 1, 0)
 DEF(st_i64, 0, 2, 1, 0)
 /* arith */
-DEF(add_i64, 1, 2, 0, 0)
 DEF(sub_i64, 1, 2, 0, 0)
 DEF(mul_i64, 1, 2, 0, 0)
 DEF(div_i64, 1, 2, 0, 0)
diff --git a/target/sh4/translate.c b/target/sh4/translate.c
index d796ad52c4..c20204cb52 100644
--- a/target/sh4/translate.c
+++ b/target/sh4/translate.c
@@ -1940,7 +1940,7 @@ static void decode_gusa(DisasContext *ctx, CPUSH4State *env)
     NEXT_INSN;
     switch (ctx->opcode & 0xf00f) {
     case 0x300c: /* add Rm,Rn */
-        op_opc = INDEX_op_add_i32;
+        op_opc = INDEX_op_add;
         goto do_reg_op;
     case 0x2009: /* and Rm,Rn */
         op_opc = INDEX_op_and_i32;
@@ -1984,7 +1984,7 @@ static void decode_gusa(DisasContext *ctx, CPUSH4State *env)
         if (op_dst != B11_8 || mv_src >= 0) {
             goto fail;
         }
-        op_opc = INDEX_op_add_i32;
+        op_opc = INDEX_op_add;
         op_arg = tcg_constant_i32(B7_0s);
         break;
 
@@ -2087,7 +2087,7 @@ static void decode_gusa(DisasContext *ctx, CPUSH4State *env)
                                 ctx->memidx, ld_mop);
         break;
 
-    case INDEX_op_add_i32:
+    case INDEX_op_add:
         if (op_dst != st_src) {
             goto fail;
         }
diff --git a/tcg/optimize.c b/tcg/optimize.c
index 8d5bad07aa..a53e4f4675 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -424,7 +424,7 @@ static uint64_t do_constant_folding_2(TCGOpcode op, uint64_t x, uint64_t y)
     uint64_t l64, h64;
 
     switch (op) {
-    CASE_OP_32_64(add):
+    case INDEX_op_add:
         return x + y;
 
     CASE_OP_32_64(sub):
@@ -2261,7 +2261,7 @@ static int fold_setcond_zmask(OptContext *ctx, TCGOp *op, bool neg)
             break;
         }
         if (convert) {
-            TCGOpcode add_opc, xor_opc, neg_opc;
+            TCGOpcode xor_opc, neg_opc;
 
             if (!inv && !neg) {
                 return tcg_opt_gen_mov(ctx, op, op->args[0], op->args[1]);
@@ -2269,12 +2269,10 @@ static int fold_setcond_zmask(OptContext *ctx, TCGOp *op, bool neg)
 
             switch (ctx->type) {
             case TCG_TYPE_I32:
-                add_opc = INDEX_op_add_i32;
                 neg_opc = INDEX_op_neg_i32;
                 xor_opc = INDEX_op_xor_i32;
                 break;
             case TCG_TYPE_I64:
-                add_opc = INDEX_op_add_i64;
                 neg_opc = INDEX_op_neg_i64;
                 xor_opc = INDEX_op_xor_i64;
                 break;
@@ -2285,7 +2283,7 @@ static int fold_setcond_zmask(OptContext *ctx, TCGOp *op, bool neg)
             if (!inv) {
                 op->opc = neg_opc;
             } else if (neg) {
-                op->opc = add_opc;
+                op->opc = INDEX_op_add;
                 op->args[2] = arg_new_constant(ctx, -1);
             } else {
                 op->opc = xor_opc;
@@ -2650,8 +2648,7 @@ static bool fold_sub(OptContext *ctx, TCGOp *op)
     if (arg_is_const(op->args[2])) {
         uint64_t val = arg_info(op->args[2])->val;
 
-        op->opc = (ctx->type == TCG_TYPE_I32
-                   ? INDEX_op_add_i32 : INDEX_op_add_i64);
+        op->opc = INDEX_op_add;
         op->args[2] = arg_new_constant(ctx, -val);
     }
     return finish_folding(ctx, op);
@@ -2842,7 +2839,7 @@ void tcg_optimize(TCGContext *s)
          * Sorted alphabetically by opcode as much as possible.
          */
         switch (opc) {
-        CASE_OP_32_64(add):
+        case INDEX_op_add:
             done = fold_add(&ctx, op);
             break;
         case INDEX_op_add_vec:
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index 108dc61e9a..344d490966 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -362,7 +362,7 @@ void tcg_gen_movi_i32(TCGv_i32 ret, int32_t arg)
 
 void tcg_gen_add_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 {
-    tcg_gen_op3_i32(INDEX_op_add_i32, ret, arg1, arg2);
+    tcg_gen_op3_i32(INDEX_op_add, ret, arg1, arg2);
 }
 
 void tcg_gen_addi_i32(TCGv_i32 ret, TCGv_i32 arg1, int32_t arg2)
@@ -1555,7 +1555,7 @@ void tcg_gen_st_i64(TCGv_i64 arg1, TCGv_ptr arg2, tcg_target_long offset)
 void tcg_gen_add_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
 {
     if (TCG_TARGET_REG_BITS == 64) {
-        tcg_gen_op3_i64(INDEX_op_add_i64, ret, arg1, arg2);
+        tcg_gen_op3_i64(INDEX_op_add, ret, arg1, arg2);
     } else {
         tcg_gen_add2_i32(TCGV_LOW(ret), TCGV_HIGH(ret), TCGV_LOW(arg1),
                          TCGV_HIGH(arg1), TCGV_LOW(arg2), TCGV_HIGH(arg2));
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 18b2981c79..0f0a3f56d8 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1004,8 +1004,7 @@ QEMU_BUILD_BUG_ON((int)(offsetof(CPUNegativeOffsetState, tlb.f[0]) -
 
 /* Register allocation descriptions for every TCGOpcode. */
 static const TCGOutOp * const all_outop[NB_OPS] = {
-    OUTOP(INDEX_op_add_i32, TCGOutOpBinary, outop_add),
-    OUTOP(INDEX_op_add_i64, TCGOutOpBinary, outop_add),
+    OUTOP(INDEX_op_add, TCGOutOpBinary, outop_add),
 };
 
 #undef OUTOP
@@ -2206,6 +2205,7 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_qemu_st_i128:
         return TCG_TARGET_HAS_qemu_ldst_i128;
 
+    case INDEX_op_add:
     case INDEX_op_mov:
         return has_type;
 
@@ -2220,7 +2220,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st8_i32:
     case INDEX_op_st16_i32:
     case INDEX_op_st_i32:
-    case INDEX_op_add_i32:
     case INDEX_op_sub_i32:
     case INDEX_op_neg_i32:
     case INDEX_op_mul_i32:
@@ -2304,7 +2303,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st16_i64:
     case INDEX_op_st32_i64:
     case INDEX_op_st_i64:
-    case INDEX_op_add_i64:
     case INDEX_op_sub_i64:
     case INDEX_op_neg_i64:
     case INDEX_op_mul_i64:
@@ -4015,14 +4013,12 @@ liveness_pass_1(TCGContext *s)
             break;
 
         case INDEX_op_add2_i32:
-            opc_new = INDEX_op_add_i32;
+        case INDEX_op_add2_i64:
+            opc_new = INDEX_op_add;
             goto do_addsub2;
         case INDEX_op_sub2_i32:
             opc_new = INDEX_op_sub_i32;
             goto do_addsub2;
-        case INDEX_op_add2_i64:
-            opc_new = INDEX_op_add_i64;
-            goto do_addsub2;
         case INDEX_op_sub2_i64:
             opc_new = INDEX_op_sub_i64;
         do_addsub2:
@@ -5445,8 +5441,7 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
         tcg_out_extrl_i64_i32(s, new_args[0], new_args[1]);
         break;
 
-    case INDEX_op_add_i32:
-    case INDEX_op_add_i64:
+    case INDEX_op_add:
         {
             const TCGOutOpBinary *out =
                 container_of(all_outop[op->opc], TCGOutOpBinary, base);
diff --git a/tcg/tci.c b/tcg/tci.c
index 78183ea47d..ceb791a735 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -523,7 +523,7 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
 
             /* Arithmetic operations (mixed 32/64 bit). */
 
-        CASE_32_64(add)
+        case INDEX_op_add:
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = regs[r1] + regs[r2];
             break;
@@ -1082,8 +1082,7 @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
                            op_name, str_r(r0), str_r(r1));
         break;
 
-    case INDEX_op_add_i32:
-    case INDEX_op_add_i64:
+    case INDEX_op_add:
     case INDEX_op_sub_i32:
     case INDEX_op_sub_i64:
     case INDEX_op_mul_i32:
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index e6ec31e351..726b645da8 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -453,9 +453,7 @@ static void tcg_out_ldst(TCGContext *s, TCGOpcode op, TCGReg val,
     stack_bounds_check(base, offset);
     if (offset != sextract32(offset, 0, 16)) {
         tcg_out_movi(s, TCG_TYPE_PTR, TCG_REG_TMP, offset);
-        tcg_out_op_rrr(s, (TCG_TARGET_REG_BITS == 32
-                           ? INDEX_op_add_i32 : INDEX_op_add_i64),
-                       TCG_REG_TMP, TCG_REG_TMP, base);
+        tcg_out_op_rrr(s, INDEX_op_add, TCG_REG_TMP, TCG_REG_TMP, base);
         base = TCG_REG_TMP;
         offset = 0;
     }
@@ -644,7 +642,7 @@ void tb_target_set_jmp_target(const TranslationBlock *tb, int n,
 static void tgen_add(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
-    tcg_out_op_rrr(s, glue(INDEX_op_add_i,TCG_TARGET_REG_BITS), a0, a1, a2);
+    tcg_out_op_rrr(s, INDEX_op_add, a0, a1, a2);
 }
 
 static const TCGOutOpBinary outop_add = {

From bf40f915fc24b97e27e852f0eae5f59eaf63de59 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 6 Jan 2025 10:22:29 -0800
Subject: [PATCH 0366/2760] tcg: Convert and to TCGOutOpBinary
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Drop all backend support for an immediate as the first operand.
This should never happen in any case, as we swap commutative
operands to place immediates as the second operand.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target.c.inc     | 31 ++++++++++--------
 tcg/arm/tcg-target.c.inc         | 41 +++++++++++++++++-------
 tcg/i386/tcg-target.c.inc        | 27 ++++++++++++----
 tcg/loongarch64/tcg-target.c.inc | 29 ++++++++++-------
 tcg/mips/tcg-target.c.inc        | 55 +++++++++++++++++++-------------
 tcg/ppc/tcg-target.c.inc         | 40 ++++++++++++-----------
 tcg/riscv/tcg-target.c.inc       | 29 ++++++++++-------
 tcg/s390x/tcg-target.c.inc       | 48 +++++++++++++++-------------
 tcg/sparc64/tcg-target.c.inc     | 23 ++++++++++---
 tcg/tcg.c                        |  4 +++
 tcg/tci/tcg-target.c.inc         | 14 ++++++--
 11 files changed, 216 insertions(+), 125 deletions(-)

diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index a181b7e65a..b7d11887e3 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -2128,6 +2128,24 @@ static const TCGOutOpBinary outop_add = {
     .out_rri = tgen_addi,
 };
 
+static void tgen_and(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_insn(s, 3510, AND, type, a0, a1, a2);
+}
+
+static void tgen_andi(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    tcg_out_logicali(s, I3404_ANDI, type, a0, a1, a2);
+}
+
+static const TCGOutOpBinary outop_and = {
+    .base.static_constraint = C_O1_I2(r, r, rL),
+    .out_rrr = tgen_and,
+    .out_rri = tgen_andi,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType ext,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -2209,17 +2227,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType ext,
         tcg_out_insn(s, 3502, SUB, ext, a0, TCG_REG_XZR, a1);
         break;
 
-    case INDEX_op_and_i32:
-        a2 = (int32_t)a2;
-        /* FALLTHRU */
-    case INDEX_op_and_i64:
-        if (c2) {
-            tcg_out_logicali(s, I3404_ANDI, ext, a0, a1, a2);
-        } else {
-            tcg_out_insn(s, 3510, AND, ext, a0, a1, a2);
-        }
-        break;
-
     case INDEX_op_andc_i32:
         a2 = (int32_t)a2;
         /* FALLTHRU */
@@ -3009,8 +3016,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_mulsh_i64:
         return C_O1_I2(r, r, r);
 
-    case INDEX_op_and_i32:
-    case INDEX_op_and_i64:
     case INDEX_op_or_i32:
     case INDEX_op_or_i64:
     case INDEX_op_xor_i32:
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index a1f2184ac4..cb4b2becef 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -874,17 +874,23 @@ static void tcg_out_dat_rI(TCGContext *s, ARMCond cond, ARMInsn opc,
  * Emit either the reg,imm or reg,reg form of a data-processing insn.
  * rhs must satisfy the "rIK" constraint.
  */
+static void tcg_out_dat_IK(TCGContext *s, ARMCond cond, ARMInsn opc,
+                            ARMInsn opinv, TCGReg dst, TCGReg lhs, TCGArg rhs)
+{
+    int imm12 = encode_imm(rhs);
+    if (imm12 < 0) {
+        imm12 = encode_imm_nofail(~rhs);
+        opc = opinv;
+    }
+    tcg_out_dat_imm(s, cond, opc, dst, lhs, imm12);
+}
+
 static void tcg_out_dat_rIK(TCGContext *s, ARMCond cond, ARMInsn opc,
                             ARMInsn opinv, TCGReg dst, TCGReg lhs, TCGArg rhs,
                             bool rhs_is_const)
 {
     if (rhs_is_const) {
-        int imm12 = encode_imm(rhs);
-        if (imm12 < 0) {
-            imm12 = encode_imm_nofail(~rhs);
-            opc = opinv;
-        }
-        tcg_out_dat_imm(s, cond, opc, dst, lhs, imm12);
+        tcg_out_dat_IK(s, cond, opc, opinv, dst, lhs, rhs);
     } else {
         tcg_out_dat_reg(s, cond, opc, dst, lhs, rhs, SHIFT_IMM_LSL(0));
     }
@@ -1846,6 +1852,24 @@ static const TCGOutOpBinary outop_add = {
     .out_rri = tgen_addi,
 };
 
+static void tgen_and(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_dat_reg(s, COND_AL, ARITH_AND, a0, a1, a2, SHIFT_IMM_LSL(0));
+}
+
+static void tgen_andi(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    tcg_out_dat_IK(s, COND_AL, ARITH_AND, ARITH_BIC, a0, a1, a2);
+}
+
+static const TCGOutOpBinary outop_and = {
+    .base.static_constraint = C_O1_I2(r, r, rIK),
+    .out_rrr = tgen_and,
+    .out_rri = tgen_andi,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -1908,10 +1932,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                             args[0], args[1], args[2], const_args[2]);
         }
         break;
-    case INDEX_op_and_i32:
-        tcg_out_dat_rIK(s, COND_AL, ARITH_AND, ARITH_BIC,
-                        args[0], args[1], args[2], const_args[2]);
-        break;
     case INDEX_op_andc_i32:
         tcg_out_dat_rIK(s, COND_AL, ARITH_BIC, ARITH_AND,
                         args[0], args[1], args[2], const_args[2]);
@@ -2169,7 +2189,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_negsetcond_i32:
         return C_O1_I2(r, r, rIN);
 
-    case INDEX_op_and_i32:
     case INDEX_op_andc_i32:
     case INDEX_op_clz_i32:
     case INDEX_op_ctz_i32:
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index 1115d1e38d..4f4c5ebbb1 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -2595,6 +2595,26 @@ static const TCGOutOpBinary outop_add = {
     .out_rri = tgen_addi,
 };
 
+static void tgen_and(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    int rexw = type == TCG_TYPE_I32 ? 0 : P_REXW;
+    tgen_arithr(s, ARITH_AND + rexw, a0, a2);
+}
+
+static void tgen_andi(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    int rexw = type == TCG_TYPE_I32 ? 0 : P_REXW;
+    tgen_arithi(s, ARITH_AND + rexw, a0, a2, false);
+}
+
+static const TCGOutOpBinary outop_and = {
+    .base.static_constraint = C_O1_I2(r, 0, reZ),
+    .out_rrr = tgen_and,
+    .out_rri = tgen_andi,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -2679,9 +2699,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     OP_32_64(sub):
         c = ARITH_SUB;
         goto gen_arith;
-    OP_32_64(and):
-        c = ARITH_AND;
-        goto gen_arith;
     OP_32_64(or):
         c = ARITH_OR;
         goto gen_arith;
@@ -3625,10 +3642,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_xor_i64:
         return C_O1_I2(r, 0, re);
 
-    case INDEX_op_and_i32:
-    case INDEX_op_and_i64:
-        return C_O1_I2(r, 0, reZ);
-
     case INDEX_op_andc_i32:
     case INDEX_op_andc_i64:
         return C_O1_I2(r, r, rI);
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index fee5e7c577..b9c6e0d017 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -1303,6 +1303,24 @@ static const TCGOutOpBinary outop_add = {
     .out_rri = tcg_out_addi,
 };
 
+static void tgen_and(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_opc_and(s, a0, a1, a2);
+}
+
+static void tgen_andi(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    tcg_out_opc_andi(s, a0, a1, a2);
+}
+
+static const TCGOutOpBinary outop_and = {
+    .base.static_constraint = C_O1_I2(r, r, rU),
+    .out_rrr = tgen_and,
+    .out_rri = tgen_andi,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -1373,15 +1391,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    case INDEX_op_and_i32:
-    case INDEX_op_and_i64:
-        if (c2) {
-            tcg_out_opc_andi(s, a0, a1, a2);
-        } else {
-            tcg_out_opc_and(s, a0, a1, a2);
-        }
-        break;
-
     case INDEX_op_or_i32:
     case INDEX_op_or_i64:
         if (c2) {
@@ -2290,8 +2299,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_rotr_i64:
         return C_O1_I2(r, r, ri);
 
-    case INDEX_op_and_i32:
-    case INDEX_op_and_i64:
     case INDEX_op_nor_i32:
     case INDEX_op_nor_i64:
     case INDEX_op_or_i32:
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index 263e7e66c9..460f73d06a 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -1676,6 +1676,38 @@ static const TCGOutOpBinary outop_add = {
     .out_rri = tgen_addi,
 };
 
+static void tgen_and(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_opc_reg(s, OPC_AND, a0, a1, a2);
+}
+
+static void tgen_andi(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    int msb;
+
+    if (a2 == (uint16_t)a2) {
+        tcg_out_opc_imm(s, OPC_ANDI, a0, a1, a2);
+        return;
+    }
+
+    tcg_debug_assert(use_mips32r2_instructions);
+    tcg_debug_assert(is_p2m1(a2));
+    msb = ctz64(~a2) - 1;
+    if (type == TCG_TYPE_I32) {
+        tcg_out_opc_bf(s, OPC_EXT, a0, a1, msb, 0);
+    } else {
+        tcg_out_opc_bf64(s, OPC_DEXT, OPC_DEXTM, OPC_DEXTU, a0, a1, msb, 0);
+    }
+}
+
+static const TCGOutOpBinary outop_and = {
+    .base.static_constraint = C_O1_I2(r, r, rIK),
+    .out_rrr = tgen_and,
+    .out_rri = tgen_andi,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -1776,26 +1808,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
             break;
         }
         goto do_binaryv;
-    case INDEX_op_and_i32:
-        if (c2 && a2 != (uint16_t)a2) {
-            int msb = ctz32(~a2) - 1;
-            tcg_debug_assert(use_mips32r2_instructions);
-            tcg_debug_assert(is_p2m1(a2));
-            tcg_out_opc_bf(s, OPC_EXT, a0, a1, msb, 0);
-            break;
-        }
-        i1 = OPC_AND, i2 = OPC_ANDI;
-        goto do_binary;
-    case INDEX_op_and_i64:
-        if (c2 && a2 != (uint16_t)a2) {
-            int msb = ctz64(~a2) - 1;
-            tcg_debug_assert(use_mips32r2_instructions);
-            tcg_debug_assert(is_p2m1(a2));
-            tcg_out_opc_bf64(s, OPC_DEXT, OPC_DEXTM, OPC_DEXTU, a0, a1, msb, 0);
-            break;
-        }
-        i1 = OPC_AND, i2 = OPC_ANDI;
-        goto do_binary;
     case INDEX_op_nor_i32:
     case INDEX_op_nor_i64:
         i1 = OPC_NOR;
@@ -2202,9 +2214,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_muls2_i64:
     case INDEX_op_mulu2_i64:
         return C_O2_I2(r, r, r, r);
-    case INDEX_op_and_i32:
-    case INDEX_op_and_i64:
-        return C_O1_I2(r, r, rIK);
     case INDEX_op_or_i32:
     case INDEX_op_xor_i32:
     case INDEX_op_or_i64:
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index 6b27238499..3d34edfa79 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -2921,6 +2921,28 @@ static const TCGOutOpBinary outop_add = {
     .out_rri = tgen_addi,
 };
 
+static void tgen_and(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out32(s, AND | SAB(a1, a0, a2));
+}
+
+static void tgen_andi(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    if (type == TCG_TYPE_I32) {
+        tcg_out_andi32(s, a0, a1, a2);
+    } else {
+        tcg_out_andi64(s, a0, a1, a2);
+    }
+}
+
+static const TCGOutOpBinary outop_and = {
+    .base.static_constraint = C_O1_I2(r, r, ri),
+    .out_rrr = tgen_and,
+    .out_rri = tgen_andi,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -3006,22 +3028,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    case INDEX_op_and_i32:
-        a0 = args[0], a1 = args[1], a2 = args[2];
-        if (const_args[2]) {
-            tcg_out_andi32(s, a0, a1, a2);
-        } else {
-            tcg_out32(s, AND | SAB(a1, a0, a2));
-        }
-        break;
-    case INDEX_op_and_i64:
-        a0 = args[0], a1 = args[1], a2 = args[2];
-        if (const_args[2]) {
-            tcg_out_andi64(s, a0, a1, a2);
-        } else {
-            tcg_out32(s, AND | SAB(a1, a0, a2));
-        }
-        break;
     case INDEX_op_or_i64:
     case INDEX_op_or_i32:
         a0 = args[0], a1 = args[1], a2 = args[2];
@@ -4129,7 +4135,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(r, r);
 
-    case INDEX_op_and_i32:
     case INDEX_op_or_i32:
     case INDEX_op_xor_i32:
     case INDEX_op_andc_i32:
@@ -4140,7 +4145,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_sar_i32:
     case INDEX_op_rotl_i32:
     case INDEX_op_rotr_i32:
-    case INDEX_op_and_i64:
     case INDEX_op_andc_i64:
     case INDEX_op_shl_i64:
     case INDEX_op_shr_i64:
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index 135137ff53..7f585bc4f9 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -1978,6 +1978,24 @@ static const TCGOutOpBinary outop_add = {
     .out_rri = tgen_addi,
 };
 
+static void tgen_and(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_opc_reg(s, OPC_AND, a0, a1, a2);
+}
+
+static void tgen_andi(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    tcg_out_opc_imm(s, OPC_ANDI, a0, a1, a2);
+}
+
+static const TCGOutOpBinary outop_and = {
+    .base.static_constraint = C_O1_I2(r, r, rI),
+    .out_rrr = tgen_and,
+    .out_rri = tgen_andi,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -2056,15 +2074,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    case INDEX_op_and_i32:
-    case INDEX_op_and_i64:
-        if (c2) {
-            tcg_out_opc_imm(s, OPC_ANDI, a0, a1, a2);
-        } else {
-            tcg_out_opc_reg(s, OPC_AND, a0, a1, a2);
-        }
-        break;
-
     case INDEX_op_or_i32:
     case INDEX_op_or_i64:
         if (c2) {
@@ -2664,10 +2673,8 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(rz, r);
 
-    case INDEX_op_and_i32:
     case INDEX_op_or_i32:
     case INDEX_op_xor_i32:
-    case INDEX_op_and_i64:
     case INDEX_op_or_i64:
     case INDEX_op_xor_i64:
     case INDEX_op_setcond_i32:
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index f5441d2033..d60bdaba25 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -2196,6 +2196,31 @@ static const TCGOutOpBinary outop_add = {
     .out_rri = tgen_addi,
 };
 
+static void tgen_and(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    if (type != TCG_TYPE_I32) {
+        tcg_out_insn(s, RRFa, NGRK, a0, a1, a2);
+    } else if (a0 == a1) {
+        tcg_out_insn(s, RR, NR, a0, a2);
+    } else {
+        tcg_out_insn(s, RRFa, NRK, a0, a1, a2);
+    }
+}
+
+static void tgen_andi_3(TCGContext *s, TCGType type,
+                        TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    tcg_out_mov(s, type, a0, a1);
+    tgen_andi(s, type, a0, a2);
+}
+
+static const TCGOutOpBinary outop_and = {
+    .base.static_constraint = C_O1_I2(r, r, rNKR),
+    .out_rrr = tgen_and,
+    .out_rri = tgen_andi_3,
+};
+
 
 # define OP_32_64(x) \
         case glue(glue(INDEX_op_,x),_i32): \
@@ -2264,17 +2289,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    case INDEX_op_and_i32:
-        a0 = args[0], a1 = args[1], a2 = (uint32_t)args[2];
-        if (const_args[2]) {
-            tcg_out_mov(s, TCG_TYPE_I32, a0, a1);
-            tgen_andi(s, TCG_TYPE_I32, a0, a2);
-        } else if (a0 == a1) {
-            tcg_out_insn(s, RR, NR, a0, a2);
-        } else {
-            tcg_out_insn(s, RRFa, NRK, a0, a1, a2);
-        }
-        break;
     case INDEX_op_or_i32:
         a0 = args[0], a1 = args[1], a2 = (uint32_t)args[2];
         if (const_args[2]) {
@@ -2535,15 +2549,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    case INDEX_op_and_i64:
-        a0 = args[0], a1 = args[1], a2 = args[2];
-        if (const_args[2]) {
-            tcg_out_mov(s, TCG_TYPE_I64, a0, a1);
-            tgen_andi(s, TCG_TYPE_I64, args[0], args[2]);
-        } else {
-            tcg_out_insn(s, RRFa, NGRK, a0, a1, a2);
-        }
-        break;
     case INDEX_op_or_i64:
         a0 = args[0], a1 = args[1], a2 = args[2];
         if (const_args[2]) {
@@ -3274,12 +3279,9 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 
     case INDEX_op_sub_i32:
     case INDEX_op_sub_i64:
-    case INDEX_op_and_i32:
     case INDEX_op_or_i32:
     case INDEX_op_xor_i32:
         return C_O1_I2(r, r, ri);
-    case INDEX_op_and_i64:
-        return C_O1_I2(r, r, rNKR);
     case INDEX_op_or_i64:
     case INDEX_op_xor_i64:
         return C_O1_I2(r, r, rK);
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index f43d95b025..b3fbe127c0 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -1304,6 +1304,24 @@ static const TCGOutOpBinary outop_add = {
     .out_rri = tgen_addi,
 };
 
+static void tgen_and(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_arith(s, a0, a1, a2, ARITH_AND);
+}
+
+static void tgen_andi(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    tcg_out_arithi(s, a0, a1, a2, ARITH_AND);
+}
+
+static const TCGOutOpBinary outop_and = {
+    .base.static_constraint = C_O1_I2(r, r, rJ),
+    .out_rrr = tgen_and,
+    .out_rri = tgen_andi,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -1361,9 +1379,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     OP_32_64(sub):
         c = ARITH_SUB;
         goto gen_arith;
-    OP_32_64(and):
-        c = ARITH_AND;
-        goto gen_arith;
     OP_32_64(andc):
         c = ARITH_ANDN;
         goto gen_arith;
@@ -1589,8 +1604,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_divu_i64:
     case INDEX_op_sub_i32:
     case INDEX_op_sub_i64:
-    case INDEX_op_and_i32:
-    case INDEX_op_and_i64:
     case INDEX_op_andc_i32:
     case INDEX_op_andc_i64:
     case INDEX_op_or_i32:
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 0f0a3f56d8..94574c90c5 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1005,6 +1005,8 @@ QEMU_BUILD_BUG_ON((int)(offsetof(CPUNegativeOffsetState, tlb.f[0]) -
 /* Register allocation descriptions for every TCGOpcode. */
 static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_add, TCGOutOpBinary, outop_add),
+    OUTOP(INDEX_op_and_i32, TCGOutOpBinary, outop_and),
+    OUTOP(INDEX_op_and_i64, TCGOutOpBinary, outop_and),
 };
 
 #undef OUTOP
@@ -5442,6 +5444,8 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
         break;
 
     case INDEX_op_add:
+    case INDEX_op_and_i32:
+    case INDEX_op_and_i64:
         {
             const TCGOutOpBinary *out =
                 container_of(all_outop[op->opc], TCGOutOpBinary, base);
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index 726b645da8..fd38ecad39 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -95,8 +95,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_sub_i64:
     case INDEX_op_mul_i32:
     case INDEX_op_mul_i64:
-    case INDEX_op_and_i32:
-    case INDEX_op_and_i64:
     case INDEX_op_andc_i32:
     case INDEX_op_andc_i64:
     case INDEX_op_eqv_i32:
@@ -650,6 +648,17 @@ static const TCGOutOpBinary outop_add = {
     .out_rrr = tgen_add,
 };
 
+static void tgen_and(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_op_rrr(s, glue(INDEX_op_and_i,TCG_TARGET_REG_BITS), a0, a1, a2);
+}
+
+static const TCGOutOpBinary outop_and = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_and,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -694,7 +703,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
 
     CASE_32_64(sub)
     CASE_32_64(mul)
-    CASE_32_64(and)
     CASE_32_64(or)
     CASE_32_64(xor)
     CASE_32_64(andc)     /* Optional (TCG_TARGET_HAS_andc_*). */

From c3b920b3d6a685484904d3060f3eb69401051bf0 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 6 Jan 2025 10:32:44 -0800
Subject: [PATCH 0367/2760] tcg: Merge INDEX_op_and_{i32,i64}
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 docs/devel/tcg-ops.rst   |  2 +-
 include/tcg/tcg-opc.h    |  3 +--
 target/sh4/translate.c   |  4 ++--
 tcg/optimize.c           | 40 ++++++++++++----------------------------
 tcg/tcg-op.c             |  4 ++--
 tcg/tcg.c                |  9 +++------
 tcg/tci.c                |  5 ++---
 tcg/tci/tcg-target.c.inc |  2 +-
 8 files changed, 24 insertions(+), 45 deletions(-)

diff --git a/docs/devel/tcg-ops.rst b/docs/devel/tcg-ops.rst
index 67387bfddf..6a8025c0bf 100644
--- a/docs/devel/tcg-ops.rst
+++ b/docs/devel/tcg-ops.rst
@@ -303,7 +303,7 @@ Logical
 
 .. list-table::
 
-   * - and_i32/i64 *t0*, *t1*, *t2*
+   * - and *t0*, *t1*, *t2*
 
      - | *t0* = *t1* & *t2*
 
diff --git a/include/tcg/tcg-opc.h b/include/tcg/tcg-opc.h
index 0282779468..f45029caa7 100644
--- a/include/tcg/tcg-opc.h
+++ b/include/tcg/tcg-opc.h
@@ -40,6 +40,7 @@ DEF(mb, 0, 0, 1, TCG_OPF_NOT_PRESENT)
 DEF(mov, 1, 1, 0, TCG_OPF_INT | TCG_OPF_NOT_PRESENT)
 
 DEF(add, 1, 2, 0, TCG_OPF_INT)
+DEF(and, 1, 2, 0, TCG_OPF_INT)
 
 DEF(setcond_i32, 1, 2, 1, 0)
 DEF(negsetcond_i32, 1, 2, 1, 0)
@@ -62,7 +63,6 @@ DEF(rem_i32, 1, 2, 0, 0)
 DEF(remu_i32, 1, 2, 0, 0)
 DEF(div2_i32, 2, 3, 0, 0)
 DEF(divu2_i32, 2, 3, 0, 0)
-DEF(and_i32, 1, 2, 0, 0)
 DEF(or_i32, 1, 2, 0, 0)
 DEF(xor_i32, 1, 2, 0, 0)
 /* shifts/rotates */
@@ -124,7 +124,6 @@ DEF(rem_i64, 1, 2, 0, 0)
 DEF(remu_i64, 1, 2, 0, 0)
 DEF(div2_i64, 2, 3, 0, 0)
 DEF(divu2_i64, 2, 3, 0, 0)
-DEF(and_i64, 1, 2, 0, 0)
 DEF(or_i64, 1, 2, 0, 0)
 DEF(xor_i64, 1, 2, 0, 0)
 /* shifts/rotates */
diff --git a/target/sh4/translate.c b/target/sh4/translate.c
index c20204cb52..3d0eda2128 100644
--- a/target/sh4/translate.c
+++ b/target/sh4/translate.c
@@ -1943,7 +1943,7 @@ static void decode_gusa(DisasContext *ctx, CPUSH4State *env)
         op_opc = INDEX_op_add;
         goto do_reg_op;
     case 0x2009: /* and Rm,Rn */
-        op_opc = INDEX_op_and_i32;
+        op_opc = INDEX_op_and;
         goto do_reg_op;
     case 0x200a: /* xor Rm,Rn */
         op_opc = INDEX_op_xor_i32;
@@ -2105,7 +2105,7 @@ static void decode_gusa(DisasContext *ctx, CPUSH4State *env)
         }
         break;
 
-    case INDEX_op_and_i32:
+    case INDEX_op_and:
         if (op_dst != st_src) {
             goto fail;
         }
diff --git a/tcg/optimize.c b/tcg/optimize.c
index a53e4f4675..20cde598fb 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -433,7 +433,8 @@ static uint64_t do_constant_folding_2(TCGOpcode op, uint64_t x, uint64_t y)
     CASE_OP_32_64(mul):
         return x * y;
 
-    CASE_OP_32_64_VEC(and):
+    case INDEX_op_and:
+    case INDEX_op_and_vec:
         return x & y;
 
     CASE_OP_32_64_VEC(or):
@@ -802,9 +803,7 @@ static int do_constant_folding_cond1(OptContext *ctx, TCGOp *op, TCGArg dest,
 
     /* Expand to AND with a temporary if no backend support. */
     if (!TCG_TARGET_HAS_tst) {
-        TCGOpcode and_opc = (ctx->type == TCG_TYPE_I32
-                             ? INDEX_op_and_i32 : INDEX_op_and_i64);
-        TCGOp *op2 = opt_insert_before(ctx, op, and_opc, 3);
+        TCGOp *op2 = opt_insert_before(ctx, op, INDEX_op_and, 3);
         TCGArg tmp = arg_new_temp(ctx);
 
         op2->args[0] = tmp;
@@ -897,8 +896,8 @@ static int do_constant_folding_cond2(OptContext *ctx, TCGOp *op, TCGArg *args)
 
     /* Expand to AND with a temporary if no backend support. */
     if (!TCG_TARGET_HAS_tst && is_tst_cond(c)) {
-        TCGOp *op1 = opt_insert_before(ctx, op, INDEX_op_and_i32, 3);
-        TCGOp *op2 = opt_insert_before(ctx, op, INDEX_op_and_i32, 3);
+        TCGOp *op1 = opt_insert_before(ctx, op, INDEX_op_and, 3);
+        TCGOp *op2 = opt_insert_before(ctx, op, INDEX_op_and, 3);
         TCGArg t1 = arg_new_temp(ctx);
         TCGArg t2 = arg_new_temp(ctx);
 
@@ -1709,8 +1708,7 @@ static bool fold_deposit(OptContext *ctx, TCGOp *op)
     TempOptInfo *t2 = arg_info(op->args[2]);
     int ofs = op->args[3];
     int len = op->args[4];
-    int width;
-    TCGOpcode and_opc;
+    int width = 8 * tcg_type_size(ctx->type);
     uint64_t z_mask, s_mask;
 
     if (ti_is_const(t1) && ti_is_const(t2)) {
@@ -1719,24 +1717,11 @@ static bool fold_deposit(OptContext *ctx, TCGOp *op)
                                           ti_const_val(t2)));
     }
 
-    switch (ctx->type) {
-    case TCG_TYPE_I32:
-        and_opc = INDEX_op_and_i32;
-        width = 32;
-        break;
-    case TCG_TYPE_I64:
-        and_opc = INDEX_op_and_i64;
-        width = 64;
-        break;
-    default:
-        g_assert_not_reached();
-    }
-
     /* Inserting a value into zero at offset 0. */
     if (ti_is_const_val(t1, 0) && ofs == 0) {
         uint64_t mask = MAKE_64BIT_MASK(0, len);
 
-        op->opc = and_opc;
+        op->opc = INDEX_op_and;
         op->args[1] = op->args[2];
         op->args[2] = arg_new_constant(ctx, mask);
         return fold_and(ctx, op);
@@ -1746,7 +1731,7 @@ static bool fold_deposit(OptContext *ctx, TCGOp *op)
     if (ti_is_const_val(t2, 0)) {
         uint64_t mask = deposit64(-1, ofs, len, 0);
 
-        op->opc = and_opc;
+        op->opc = INDEX_op_and;
         op->args[2] = arg_new_constant(ctx, mask);
         return fold_and(ctx, op);
     }
@@ -2297,7 +2282,7 @@ static int fold_setcond_zmask(OptContext *ctx, TCGOp *op, bool neg)
 
 static void fold_setcond_tst_pow2(OptContext *ctx, TCGOp *op, bool neg)
 {
-    TCGOpcode and_opc, sub_opc, xor_opc, neg_opc, shr_opc;
+    TCGOpcode sub_opc, xor_opc, neg_opc, shr_opc;
     TCGOpcode uext_opc = 0, sext_opc = 0;
     TCGCond cond = op->args[3];
     TCGArg ret, src1, src2;
@@ -2319,7 +2304,6 @@ static void fold_setcond_tst_pow2(OptContext *ctx, TCGOp *op, bool neg)
 
     switch (ctx->type) {
     case TCG_TYPE_I32:
-        and_opc = INDEX_op_and_i32;
         sub_opc = INDEX_op_sub_i32;
         xor_opc = INDEX_op_xor_i32;
         shr_opc = INDEX_op_shr_i32;
@@ -2332,7 +2316,6 @@ static void fold_setcond_tst_pow2(OptContext *ctx, TCGOp *op, bool neg)
         }
         break;
     case TCG_TYPE_I64:
-        and_opc = INDEX_op_and_i64;
         sub_opc = INDEX_op_sub_i64;
         xor_opc = INDEX_op_xor_i64;
         shr_opc = INDEX_op_shr_i64;
@@ -2371,7 +2354,7 @@ static void fold_setcond_tst_pow2(OptContext *ctx, TCGOp *op, bool neg)
             op2->args[2] = arg_new_constant(ctx, sh);
             src1 = ret;
         }
-        op->opc = and_opc;
+        op->opc = INDEX_op_and;
         op->args[1] = src1;
         op->args[2] = arg_new_constant(ctx, 1);
     }
@@ -2848,7 +2831,8 @@ void tcg_optimize(TCGContext *s)
         CASE_OP_32_64(add2):
             done = fold_add2(&ctx, op);
             break;
-        CASE_OP_32_64_VEC(and):
+        case INDEX_op_and:
+        case INDEX_op_and_vec:
             done = fold_and(&ctx, op);
             break;
         CASE_OP_32_64_VEC(andc):
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index 344d490966..82f3ad501f 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -401,7 +401,7 @@ void tcg_gen_neg_i32(TCGv_i32 ret, TCGv_i32 arg)
 
 void tcg_gen_and_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 {
-    tcg_gen_op3_i32(INDEX_op_and_i32, ret, arg1, arg2);
+    tcg_gen_op3_i32(INDEX_op_and, ret, arg1, arg2);
 }
 
 void tcg_gen_andi_i32(TCGv_i32 ret, TCGv_i32 arg1, int32_t arg2)
@@ -1575,7 +1575,7 @@ void tcg_gen_sub_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
 void tcg_gen_and_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
 {
     if (TCG_TARGET_REG_BITS == 64) {
-        tcg_gen_op3_i64(INDEX_op_and_i64, ret, arg1, arg2);
+        tcg_gen_op3_i64(INDEX_op_and, ret, arg1, arg2);
     } else {
         tcg_gen_and_i32(TCGV_LOW(ret), TCGV_LOW(arg1), TCGV_LOW(arg2));
         tcg_gen_and_i32(TCGV_HIGH(ret), TCGV_HIGH(arg1), TCGV_HIGH(arg2));
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 94574c90c5..d60427eb7f 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1005,8 +1005,7 @@ QEMU_BUILD_BUG_ON((int)(offsetof(CPUNegativeOffsetState, tlb.f[0]) -
 /* Register allocation descriptions for every TCGOpcode. */
 static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_add, TCGOutOpBinary, outop_add),
-    OUTOP(INDEX_op_and_i32, TCGOutOpBinary, outop_and),
-    OUTOP(INDEX_op_and_i64, TCGOutOpBinary, outop_and),
+    OUTOP(INDEX_op_and, TCGOutOpBinary, outop_and),
 };
 
 #undef OUTOP
@@ -2208,6 +2207,7 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
         return TCG_TARGET_HAS_qemu_ldst_i128;
 
     case INDEX_op_add:
+    case INDEX_op_and:
     case INDEX_op_mov:
         return has_type;
 
@@ -2225,7 +2225,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_sub_i32:
     case INDEX_op_neg_i32:
     case INDEX_op_mul_i32:
-    case INDEX_op_and_i32:
     case INDEX_op_or_i32:
     case INDEX_op_xor_i32:
     case INDEX_op_shl_i32:
@@ -2308,7 +2307,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_sub_i64:
     case INDEX_op_neg_i64:
     case INDEX_op_mul_i64:
-    case INDEX_op_and_i64:
     case INDEX_op_or_i64:
     case INDEX_op_xor_i64:
     case INDEX_op_shl_i64:
@@ -5444,8 +5442,7 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
         break;
 
     case INDEX_op_add:
-    case INDEX_op_and_i32:
-    case INDEX_op_and_i64:
+    case INDEX_op_and:
         {
             const TCGOutOpBinary *out =
                 container_of(all_outop[op->opc], TCGOutOpBinary, base);
diff --git a/tcg/tci.c b/tcg/tci.c
index ceb791a735..8762a99fb6 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -535,7 +535,7 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = regs[r1] * regs[r2];
             break;
-        CASE_32_64(and)
+        case INDEX_op_and:
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = regs[r1] & regs[r2];
             break;
@@ -1083,12 +1083,11 @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
         break;
 
     case INDEX_op_add:
+    case INDEX_op_and:
     case INDEX_op_sub_i32:
     case INDEX_op_sub_i64:
     case INDEX_op_mul_i32:
     case INDEX_op_mul_i64:
-    case INDEX_op_and_i32:
-    case INDEX_op_and_i64:
     case INDEX_op_or_i32:
     case INDEX_op_or_i64:
     case INDEX_op_xor_i32:
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index fd38ecad39..b0141f8ed6 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -651,7 +651,7 @@ static const TCGOutOpBinary outop_add = {
 static void tgen_and(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
-    tcg_out_op_rrr(s, glue(INDEX_op_and_i,TCG_TARGET_REG_BITS), a0, a1, a2);
+    tcg_out_op_rrr(s, INDEX_op_and, a0, a1, a2);
 }
 
 static const TCGOutOpBinary outop_and = {

From 899281c8f589cce55951e13307661a7253eb4909 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 15 Nov 2023 11:18:55 -0800
Subject: [PATCH 0368/2760] tcg/optimize: Fold andc with immediate to and
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index 20cde598fb..1f6fdee734 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -1343,6 +1343,25 @@ static bool fold_andc(OptContext *ctx, TCGOp *op)
     t2 = arg_info(op->args[2]);
     z_mask = t1->z_mask;
 
+    if (ti_is_const(t2)) {
+        /* Fold andc r,x,i to and r,x,~i. */
+        switch (ctx->type) {
+        case TCG_TYPE_I32:
+        case TCG_TYPE_I64:
+            op->opc = INDEX_op_and;
+            break;
+        case TCG_TYPE_V64:
+        case TCG_TYPE_V128:
+        case TCG_TYPE_V256:
+            op->opc = INDEX_op_and_vec;
+            break;
+        default:
+            g_assert_not_reached();
+        }
+        op->args[2] = arg_new_constant(ctx, ~ti_const_val(t2));
+        return fold_and(ctx, op);
+    }
+
     /*
      * Known-zeros does not imply known-ones.  Therefore unless
      * arg2 is constant, we can't infer anything from it.

From 93a9ddb84ae534a04e8d7764caa9e29b8285b2b1 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 6 Jan 2025 22:06:08 -0800
Subject: [PATCH 0369/2760] tcg/optimize: Emit add r,r,-1 in
 fold_setcond_tst_pow2
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We canonicalize subtract with constant to add with constant.
Fix this missed instance.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index 1f6fdee734..6c7b6af624 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -2301,7 +2301,7 @@ static int fold_setcond_zmask(OptContext *ctx, TCGOp *op, bool neg)
 
 static void fold_setcond_tst_pow2(OptContext *ctx, TCGOp *op, bool neg)
 {
-    TCGOpcode sub_opc, xor_opc, neg_opc, shr_opc;
+    TCGOpcode xor_opc, neg_opc, shr_opc;
     TCGOpcode uext_opc = 0, sext_opc = 0;
     TCGCond cond = op->args[3];
     TCGArg ret, src1, src2;
@@ -2323,7 +2323,6 @@ static void fold_setcond_tst_pow2(OptContext *ctx, TCGOp *op, bool neg)
 
     switch (ctx->type) {
     case TCG_TYPE_I32:
-        sub_opc = INDEX_op_sub_i32;
         xor_opc = INDEX_op_xor_i32;
         shr_opc = INDEX_op_shr_i32;
         neg_opc = INDEX_op_neg_i32;
@@ -2335,7 +2334,6 @@ static void fold_setcond_tst_pow2(OptContext *ctx, TCGOp *op, bool neg)
         }
         break;
     case TCG_TYPE_I64:
-        sub_opc = INDEX_op_sub_i64;
         xor_opc = INDEX_op_xor_i64;
         shr_opc = INDEX_op_shr_i64;
         neg_opc = INDEX_op_neg_i64;
@@ -2379,10 +2377,10 @@ static void fold_setcond_tst_pow2(OptContext *ctx, TCGOp *op, bool neg)
     }
 
     if (neg && inv) {
-        op2 = opt_insert_after(ctx, op, sub_opc, 3);
+        op2 = opt_insert_after(ctx, op, INDEX_op_add, 3);
         op2->args[0] = ret;
         op2->args[1] = ret;
-        op2->args[2] = arg_new_constant(ctx, 1);
+        op2->args[2] = arg_new_constant(ctx, -1);
     } else if (inv) {
         op2 = opt_insert_after(ctx, op, xor_opc, 3);
         op2->args[0] = ret;

From a341c84e8153b7282b083e871ca534f15fa70898 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 6 Jan 2025 12:26:28 -0800
Subject: [PATCH 0370/2760] tcg: Convert andc to TCGOutOpBinary
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

At the same time, drop all backend support for immediate
operands, as we now transform andc to and during optimize.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target-has.h         |  2 --
 tcg/aarch64/tcg-target.c.inc         | 24 ++++++++--------
 tcg/arm/tcg-target-has.h             |  1 -
 tcg/arm/tcg-target.c.inc             | 16 +++++++----
 tcg/i386/tcg-target-con-set.h        |  2 +-
 tcg/i386/tcg-target-has.h            |  2 --
 tcg/i386/tcg-target.c.inc            | 31 +++++++++++---------
 tcg/loongarch64/tcg-target-con-set.h |  1 +
 tcg/loongarch64/tcg-target-has.h     |  2 --
 tcg/loongarch64/tcg-target.c.inc     | 23 ++++++++-------
 tcg/mips/tcg-target-has.h            |  2 --
 tcg/mips/tcg-target.c.inc            |  4 +++
 tcg/ppc/tcg-target-has.h             |  2 --
 tcg/ppc/tcg-target.c.inc             | 29 ++++++++-----------
 tcg/riscv/tcg-target-con-set.h       |  1 +
 tcg/riscv/tcg-target-has.h           |  2 --
 tcg/riscv/tcg-target.c.inc           | 27 +++++++++++-------
 tcg/s390x/tcg-target-con-set.h       |  1 -
 tcg/s390x/tcg-target-has.h           |  2 --
 tcg/s390x/tcg-target.c.inc           | 42 ++++++++++++++--------------
 tcg/sparc64/tcg-target-has.h         |  2 --
 tcg/sparc64/tcg-target.c.inc         | 16 +++++++----
 tcg/tcg-has.h                        |  1 -
 tcg/tcg-op.c                         |  4 +--
 tcg/tcg.c                            |  8 +++---
 tcg/tci.c                            |  2 --
 tcg/tci/tcg-target-has.h             |  2 --
 tcg/tci/tcg-target.c.inc             | 14 ++++++++--
 28 files changed, 135 insertions(+), 130 deletions(-)

diff --git a/tcg/aarch64/tcg-target-has.h b/tcg/aarch64/tcg-target-has.h
index bfd587c0fc..851f6b01b4 100644
--- a/tcg/aarch64/tcg-target-has.h
+++ b/tcg/aarch64/tcg-target-has.h
@@ -19,7 +19,6 @@
 #define TCG_TARGET_HAS_bswap32_i32      1
 #define TCG_TARGET_HAS_not_i32          1
 #define TCG_TARGET_HAS_rot_i32          1
-#define TCG_TARGET_HAS_andc_i32         1
 #define TCG_TARGET_HAS_orc_i32          1
 #define TCG_TARGET_HAS_eqv_i32          1
 #define TCG_TARGET_HAS_nand_i32         0
@@ -45,7 +44,6 @@
 #define TCG_TARGET_HAS_bswap64_i64      1
 #define TCG_TARGET_HAS_not_i64          1
 #define TCG_TARGET_HAS_rot_i64          1
-#define TCG_TARGET_HAS_andc_i64         1
 #define TCG_TARGET_HAS_orc_i64          1
 #define TCG_TARGET_HAS_eqv_i64          1
 #define TCG_TARGET_HAS_nand_i64         0
diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index b7d11887e3..c7167cad15 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -2146,6 +2146,17 @@ static const TCGOutOpBinary outop_and = {
     .out_rri = tgen_andi,
 };
 
+static void tgen_andc(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_insn(s, 3510, BIC, type, a0, a1, a2);
+}
+
+static const TCGOutOpBinary outop_andc = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_andc,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType ext,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -2227,17 +2238,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType ext,
         tcg_out_insn(s, 3502, SUB, ext, a0, TCG_REG_XZR, a1);
         break;
 
-    case INDEX_op_andc_i32:
-        a2 = (int32_t)a2;
-        /* FALLTHRU */
-    case INDEX_op_andc_i64:
-        if (c2) {
-            tcg_out_logicali(s, I3404_ANDI, ext, a0, a1, ~a2);
-        } else {
-            tcg_out_insn(s, 3510, BIC, ext, a0, a1, a2);
-        }
-        break;
-
     case INDEX_op_or_i32:
         a2 = (int32_t)a2;
         /* FALLTHRU */
@@ -3020,8 +3020,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_or_i64:
     case INDEX_op_xor_i32:
     case INDEX_op_xor_i64:
-    case INDEX_op_andc_i32:
-    case INDEX_op_andc_i64:
     case INDEX_op_orc_i32:
     case INDEX_op_orc_i64:
     case INDEX_op_eqv_i32:
diff --git a/tcg/arm/tcg-target-has.h b/tcg/arm/tcg-target-has.h
index 8398c80c8e..0268858a3b 100644
--- a/tcg/arm/tcg-target-has.h
+++ b/tcg/arm/tcg-target-has.h
@@ -28,7 +28,6 @@ extern bool use_neon_instructions;
 #define TCG_TARGET_HAS_bswap32_i32      1
 #define TCG_TARGET_HAS_not_i32          1
 #define TCG_TARGET_HAS_rot_i32          1
-#define TCG_TARGET_HAS_andc_i32         1
 #define TCG_TARGET_HAS_orc_i32          0
 #define TCG_TARGET_HAS_eqv_i32          0
 #define TCG_TARGET_HAS_nand_i32         0
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index cb4b2becef..feea82145a 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -1870,6 +1870,17 @@ static const TCGOutOpBinary outop_and = {
     .out_rri = tgen_andi,
 };
 
+static void tgen_andc(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_dat_reg(s, COND_AL, ARITH_BIC, a0, a1, a2, SHIFT_IMM_LSL(0));
+}
+
+static const TCGOutOpBinary outop_andc = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_andc,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -1932,10 +1943,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                             args[0], args[1], args[2], const_args[2]);
         }
         break;
-    case INDEX_op_andc_i32:
-        tcg_out_dat_rIK(s, COND_AL, ARITH_BIC, ARITH_AND,
-                        args[0], args[1], args[2], const_args[2]);
-        break;
     case INDEX_op_or_i32:
         c = ARITH_ORR;
         goto gen_arith;
@@ -2189,7 +2196,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_negsetcond_i32:
         return C_O1_I2(r, r, rIN);
 
-    case INDEX_op_andc_i32:
     case INDEX_op_clz_i32:
     case INDEX_op_ctz_i32:
         return C_O1_I2(r, r, rIK);
diff --git a/tcg/i386/tcg-target-con-set.h b/tcg/i386/tcg-target-con-set.h
index 06e6521001..0ae9775944 100644
--- a/tcg/i386/tcg-target-con-set.h
+++ b/tcg/i386/tcg-target-con-set.h
@@ -42,9 +42,9 @@ C_O1_I2(r, 0, reZ)
 C_O1_I2(r, 0, ri)
 C_O1_I2(r, 0, rI)
 C_O1_I2(r, L, L)
+C_O1_I2(r, r, r)
 C_O1_I2(r, r, re)
 C_O1_I2(r, r, ri)
-C_O1_I2(r, r, rI)
 C_O1_I2(x, x, x)
 C_N1_I2(r, r, r)
 C_N1_I2(r, r, rW)
diff --git a/tcg/i386/tcg-target-has.h b/tcg/i386/tcg-target-has.h
index bbf55c86b6..b29b70357a 100644
--- a/tcg/i386/tcg-target-has.h
+++ b/tcg/i386/tcg-target-has.h
@@ -31,7 +31,6 @@
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
 #define TCG_TARGET_HAS_not_i32          1
-#define TCG_TARGET_HAS_andc_i32         have_bmi1
 #define TCG_TARGET_HAS_orc_i32          0
 #define TCG_TARGET_HAS_eqv_i32          0
 #define TCG_TARGET_HAS_nand_i32         0
@@ -57,7 +56,6 @@
 #define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1
 #define TCG_TARGET_HAS_not_i64          1
-#define TCG_TARGET_HAS_andc_i64         have_bmi1
 #define TCG_TARGET_HAS_orc_i64          0
 #define TCG_TARGET_HAS_eqv_i64          0
 #define TCG_TARGET_HAS_nand_i64         0
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index 4f4c5ebbb1..33c1fcc717 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -2615,6 +2615,24 @@ static const TCGOutOpBinary outop_and = {
     .out_rri = tgen_andi,
 };
 
+static void tgen_andc(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    int rexw = type == TCG_TYPE_I32 ? 0 : P_REXW;
+    tcg_out_vex_modrm(s, OPC_ANDN + rexw, a0, a2, a1);
+}
+
+static TCGConstraintSetIndex cset_andc(TCGType type, unsigned flags)
+{
+    return have_bmi1 ? C_O1_I2(r, r, r) : C_NotImplemented;
+}
+
+static const TCGOutOpBinary outop_andc = {
+    .base.static_constraint = C_Dynamic,
+    .base.dynamic_constraint = cset_andc,
+    .out_rrr = tgen_andc,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -2713,15 +2731,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    OP_32_64(andc):
-        if (const_a2) {
-            tcg_out_mov(s, rexw ? TCG_TYPE_I64 : TCG_TYPE_I32, a0, a1);
-            tgen_arithi(s, ARITH_AND + rexw, a0, ~a2, 0);
-        } else {
-            tcg_out_vex_modrm(s, OPC_ANDN + rexw, a0, a2, a1);
-        }
-        break;
-
     OP_32_64(mul):
         if (const_a2) {
             int32_t val;
@@ -3642,10 +3651,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_xor_i64:
         return C_O1_I2(r, 0, re);
 
-    case INDEX_op_andc_i32:
-    case INDEX_op_andc_i64:
-        return C_O1_I2(r, r, rI);
-
     case INDEX_op_shl_i32:
     case INDEX_op_shl_i64:
     case INDEX_op_shr_i32:
diff --git a/tcg/loongarch64/tcg-target-con-set.h b/tcg/loongarch64/tcg-target-con-set.h
index 8afaee9476..b7c9b89e9e 100644
--- a/tcg/loongarch64/tcg-target-con-set.h
+++ b/tcg/loongarch64/tcg-target-con-set.h
@@ -22,6 +22,7 @@ C_O0_I3(r, r, r)
 C_O1_I1(r, r)
 C_O1_I1(w, r)
 C_O1_I1(w, w)
+C_O1_I2(r, r, r)
 C_O1_I2(r, r, rC)
 C_O1_I2(r, r, ri)
 C_O1_I2(r, r, rI)
diff --git a/tcg/loongarch64/tcg-target-has.h b/tcg/loongarch64/tcg-target-has.h
index 166c9d7e41..71d91fec19 100644
--- a/tcg/loongarch64/tcg-target-has.h
+++ b/tcg/loongarch64/tcg-target-has.h
@@ -25,7 +25,6 @@
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
 #define TCG_TARGET_HAS_not_i32          1
-#define TCG_TARGET_HAS_andc_i32         1
 #define TCG_TARGET_HAS_orc_i32          1
 #define TCG_TARGET_HAS_eqv_i32          0
 #define TCG_TARGET_HAS_nand_i32         0
@@ -47,7 +46,6 @@
 #define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1
 #define TCG_TARGET_HAS_not_i64          1
-#define TCG_TARGET_HAS_andc_i64         1
 #define TCG_TARGET_HAS_orc_i64          1
 #define TCG_TARGET_HAS_eqv_i64          0
 #define TCG_TARGET_HAS_nand_i64         0
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index b9c6e0d017..b7d2984a8a 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -1321,6 +1321,17 @@ static const TCGOutOpBinary outop_and = {
     .out_rri = tgen_andi,
 };
 
+static void tgen_andc(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_opc_andn(s, a0, a1, a2);
+}
+
+static const TCGOutOpBinary outop_andc = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_andc,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -1371,16 +1382,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    case INDEX_op_andc_i32:
-    case INDEX_op_andc_i64:
-        if (c2) {
-            /* guaranteed to fit due to constraint */
-            tcg_out_opc_andi(s, a0, a1, ~a2);
-        } else {
-            tcg_out_opc_andn(s, a0, a1, a2);
-        }
-        break;
-
     case INDEX_op_orc_i32:
     case INDEX_op_orc_i64:
         if (c2) {
@@ -2276,8 +2277,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_qemu_ld_i64:
         return C_O1_I1(r, r);
 
-    case INDEX_op_andc_i32:
-    case INDEX_op_andc_i64:
     case INDEX_op_orc_i32:
     case INDEX_op_orc_i64:
         /*
diff --git a/tcg/mips/tcg-target-has.h b/tcg/mips/tcg-target-has.h
index fd96905484..6a6d4377e7 100644
--- a/tcg/mips/tcg-target-has.h
+++ b/tcg/mips/tcg-target-has.h
@@ -43,7 +43,6 @@ extern bool use_mips32r2_instructions;
 #define TCG_TARGET_HAS_rem_i32          1
 #define TCG_TARGET_HAS_not_i32          1
 #define TCG_TARGET_HAS_nor_i32          1
-#define TCG_TARGET_HAS_andc_i32         0
 #define TCG_TARGET_HAS_orc_i32          0
 #define TCG_TARGET_HAS_eqv_i32          0
 #define TCG_TARGET_HAS_nand_i32         0
@@ -63,7 +62,6 @@ extern bool use_mips32r2_instructions;
 #define TCG_TARGET_HAS_rem_i64          1
 #define TCG_TARGET_HAS_not_i64          1
 #define TCG_TARGET_HAS_nor_i64          1
-#define TCG_TARGET_HAS_andc_i64         0
 #define TCG_TARGET_HAS_orc_i64          0
 #define TCG_TARGET_HAS_eqv_i64          0
 #define TCG_TARGET_HAS_nand_i64         0
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index 460f73d06a..ab57c78095 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -1708,6 +1708,10 @@ static const TCGOutOpBinary outop_and = {
     .out_rri = tgen_andi,
 };
 
+static const TCGOutOpBinary outop_andc = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
diff --git a/tcg/ppc/tcg-target-has.h b/tcg/ppc/tcg-target-has.h
index 9acfc574c5..63bb66f446 100644
--- a/tcg/ppc/tcg-target-has.h
+++ b/tcg/ppc/tcg-target-has.h
@@ -23,7 +23,6 @@
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
 #define TCG_TARGET_HAS_not_i32          1
-#define TCG_TARGET_HAS_andc_i32         1
 #define TCG_TARGET_HAS_orc_i32          1
 #define TCG_TARGET_HAS_eqv_i32          1
 #define TCG_TARGET_HAS_nand_i32         1
@@ -50,7 +49,6 @@
 #define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1
 #define TCG_TARGET_HAS_not_i64          1
-#define TCG_TARGET_HAS_andc_i64         1
 #define TCG_TARGET_HAS_orc_i64          1
 #define TCG_TARGET_HAS_eqv_i64          1
 #define TCG_TARGET_HAS_nand_i64         1
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index 3d34edfa79..7b1a82c9fa 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -2943,6 +2943,17 @@ static const TCGOutOpBinary outop_and = {
     .out_rri = tgen_andi,
 };
 
+static void tgen_andc(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out32(s, ANDC | SAB(a1, a0, a2));
+}
+
+static const TCGOutOpBinary outop_andc = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_andc,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -3046,22 +3057,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
             tcg_out32(s, XOR | SAB(a1, a0, a2));
         }
         break;
-    case INDEX_op_andc_i32:
-        a0 = args[0], a1 = args[1], a2 = args[2];
-        if (const_args[2]) {
-            tcg_out_andi32(s, a0, a1, ~a2);
-        } else {
-            tcg_out32(s, ANDC | SAB(a1, a0, a2));
-        }
-        break;
-    case INDEX_op_andc_i64:
-        a0 = args[0], a1 = args[1], a2 = args[2];
-        if (const_args[2]) {
-            tcg_out_andi64(s, a0, a1, ~a2);
-        } else {
-            tcg_out32(s, ANDC | SAB(a1, a0, a2));
-        }
-        break;
     case INDEX_op_orc_i32:
         if (const_args[2]) {
             tcg_out_ori32(s, args[0], args[1], ~args[2]);
@@ -4137,7 +4132,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 
     case INDEX_op_or_i32:
     case INDEX_op_xor_i32:
-    case INDEX_op_andc_i32:
     case INDEX_op_orc_i32:
     case INDEX_op_eqv_i32:
     case INDEX_op_shl_i32:
@@ -4145,7 +4139,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_sar_i32:
     case INDEX_op_rotl_i32:
     case INDEX_op_rotr_i32:
-    case INDEX_op_andc_i64:
     case INDEX_op_shl_i64:
     case INDEX_op_shr_i64:
     case INDEX_op_sar_i64:
diff --git a/tcg/riscv/tcg-target-con-set.h b/tcg/riscv/tcg-target-con-set.h
index e92e815491..f1f5d415f7 100644
--- a/tcg/riscv/tcg-target-con-set.h
+++ b/tcg/riscv/tcg-target-con-set.h
@@ -13,6 +13,7 @@ C_O0_I1(r)
 C_O0_I2(rz, r)
 C_O0_I2(rz, rz)
 C_O1_I1(r, r)
+C_O1_I2(r, r, r)
 C_O1_I2(r, r, ri)
 C_O1_I2(r, r, rI)
 C_O1_I2(r, r, rJ)
diff --git a/tcg/riscv/tcg-target-has.h b/tcg/riscv/tcg-target-has.h
index fc62049c78..a3918bf7f5 100644
--- a/tcg/riscv/tcg-target-has.h
+++ b/tcg/riscv/tcg-target-has.h
@@ -25,7 +25,6 @@
 #define TCG_TARGET_HAS_bswap16_i32      (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_bswap32_i32      (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_not_i32          1
-#define TCG_TARGET_HAS_andc_i32         (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_orc_i32          (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_eqv_i32          (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_nand_i32         0
@@ -46,7 +45,6 @@
 #define TCG_TARGET_HAS_bswap32_i64      (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_bswap64_i64      (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_not_i64          1
-#define TCG_TARGET_HAS_andc_i64         (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_orc_i64          (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_eqv_i64          (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_nand_i64         0
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index 7f585bc4f9..f637604e98 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -1996,6 +1996,23 @@ static const TCGOutOpBinary outop_and = {
     .out_rri = tgen_andi,
 };
 
+static void tgen_andc(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_opc_reg(s, OPC_ANDN, a0, a1, a2);
+}
+
+static TCGConstraintSetIndex cset_zbb_rrr(TCGType type, unsigned flags)
+{
+    return cpuinfo & CPUINFO_ZBB ? C_O1_I2(r, r, r) : C_NotImplemented;
+}
+
+static const TCGOutOpBinary outop_andc = {
+    .base.static_constraint = C_Dynamic,
+    .base.dynamic_constraint = cset_zbb_rrr,
+    .out_rrr = tgen_andc,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -2092,14 +2109,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    case INDEX_op_andc_i32:
-    case INDEX_op_andc_i64:
-        if (c2) {
-            tcg_out_opc_imm(s, OPC_ANDI, a0, a1, ~a2);
-        } else {
-            tcg_out_opc_reg(s, OPC_ANDN, a0, a1, a2);
-        }
-        break;
     case INDEX_op_orc_i32:
     case INDEX_op_orc_i64:
         if (c2) {
@@ -2683,8 +2692,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_negsetcond_i64:
         return C_O1_I2(r, r, rI);
 
-    case INDEX_op_andc_i32:
-    case INDEX_op_andc_i64:
     case INDEX_op_orc_i32:
     case INDEX_op_orc_i64:
     case INDEX_op_eqv_i32:
diff --git a/tcg/s390x/tcg-target-con-set.h b/tcg/s390x/tcg-target-con-set.h
index 370e4b1295..39903a60ad 100644
--- a/tcg/s390x/tcg-target-con-set.h
+++ b/tcg/s390x/tcg-target-con-set.h
@@ -31,7 +31,6 @@ C_O1_I2(r, r, rC)
 C_O1_I2(r, r, rI)
 C_O1_I2(r, r, rJ)
 C_O1_I2(r, r, rK)
-C_O1_I2(r, r, rKR)
 C_O1_I2(r, r, rNK)
 C_O1_I2(r, r, rNKR)
 C_O1_I2(r, rZ, r)
diff --git a/tcg/s390x/tcg-target-has.h b/tcg/s390x/tcg-target-has.h
index aea805455f..15ec0dc2ff 100644
--- a/tcg/s390x/tcg-target-has.h
+++ b/tcg/s390x/tcg-target-has.h
@@ -34,7 +34,6 @@ extern uint64_t s390_facilities[3];
 #define TCG_TARGET_HAS_bswap16_i32    1
 #define TCG_TARGET_HAS_bswap32_i32    1
 #define TCG_TARGET_HAS_not_i32        HAVE_FACILITY(MISC_INSN_EXT3)
-#define TCG_TARGET_HAS_andc_i32       HAVE_FACILITY(MISC_INSN_EXT3)
 #define TCG_TARGET_HAS_orc_i32        HAVE_FACILITY(MISC_INSN_EXT3)
 #define TCG_TARGET_HAS_eqv_i32        HAVE_FACILITY(MISC_INSN_EXT3)
 #define TCG_TARGET_HAS_nand_i32       HAVE_FACILITY(MISC_INSN_EXT3)
@@ -59,7 +58,6 @@ extern uint64_t s390_facilities[3];
 #define TCG_TARGET_HAS_bswap32_i64    1
 #define TCG_TARGET_HAS_bswap64_i64    1
 #define TCG_TARGET_HAS_not_i64        HAVE_FACILITY(MISC_INSN_EXT3)
-#define TCG_TARGET_HAS_andc_i64       HAVE_FACILITY(MISC_INSN_EXT3)
 #define TCG_TARGET_HAS_orc_i64        HAVE_FACILITY(MISC_INSN_EXT3)
 #define TCG_TARGET_HAS_eqv_i64        HAVE_FACILITY(MISC_INSN_EXT3)
 #define TCG_TARGET_HAS_nand_i64       HAVE_FACILITY(MISC_INSN_EXT3)
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index d60bdaba25..e4b60d1924 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -2221,6 +2221,27 @@ static const TCGOutOpBinary outop_and = {
     .out_rri = tgen_andi_3,
 };
 
+static void tgen_andc(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    if (type == TCG_TYPE_I32) {
+        tcg_out_insn(s, RRFa, NCRK, a0, a1, a2);
+    } else {
+        tcg_out_insn(s, RRFa, NCGRK, a0, a1, a2);
+    }
+}
+
+static TCGConstraintSetIndex cset_misc3_rrr(TCGType type, unsigned flags)
+{
+    return HAVE_FACILITY(MISC_INSN_EXT3) ? C_O1_I2(r, r, r) : C_NotImplemented;
+}
+
+static const TCGOutOpBinary outop_andc = {
+    .base.static_constraint = C_Dynamic,
+    .base.dynamic_constraint = cset_misc3_rrr,
+    .out_rrr = tgen_andc,
+};
+
 
 # define OP_32_64(x) \
         case glue(glue(INDEX_op_,x),_i32): \
@@ -2312,15 +2333,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    case INDEX_op_andc_i32:
-        a0 = args[0], a1 = args[1], a2 = (uint32_t)args[2];
-        if (const_args[2]) {
-            tcg_out_mov(s, TCG_TYPE_I32, a0, a1);
-            tgen_andi(s, TCG_TYPE_I32, a0, (uint32_t)~a2);
-	} else {
-            tcg_out_insn(s, RRFa, NCRK, a0, a1, a2);
-	}
-        break;
     case INDEX_op_orc_i32:
         a0 = args[0], a1 = args[1], a2 = (uint32_t)args[2];
         if (const_args[2]) {
@@ -2568,15 +2580,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    case INDEX_op_andc_i64:
-        a0 = args[0], a1 = args[1], a2 = args[2];
-        if (const_args[2]) {
-            tcg_out_mov(s, TCG_TYPE_I64, a0, a1);
-            tgen_andi(s, TCG_TYPE_I64, a0, ~a2);
-        } else {
-            tcg_out_insn(s, RRFa, NCGRK, a0, a1, a2);
-        }
-        break;
     case INDEX_op_orc_i64:
         a0 = args[0], a1 = args[1], a2 = args[2];
         if (const_args[2]) {
@@ -3286,12 +3289,9 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_xor_i64:
         return C_O1_I2(r, r, rK);
 
-    case INDEX_op_andc_i32:
     case INDEX_op_orc_i32:
     case INDEX_op_eqv_i32:
         return C_O1_I2(r, r, ri);
-    case INDEX_op_andc_i64:
-        return C_O1_I2(r, r, rKR);
     case INDEX_op_orc_i64:
     case INDEX_op_eqv_i64:
         return C_O1_I2(r, r, rNK);
diff --git a/tcg/sparc64/tcg-target-has.h b/tcg/sparc64/tcg-target-has.h
index ad6f35da17..510b9e64a4 100644
--- a/tcg/sparc64/tcg-target-has.h
+++ b/tcg/sparc64/tcg-target-has.h
@@ -20,7 +20,6 @@ extern bool use_vis3_instructions;
 #define TCG_TARGET_HAS_bswap16_i32      0
 #define TCG_TARGET_HAS_bswap32_i32      0
 #define TCG_TARGET_HAS_not_i32          1
-#define TCG_TARGET_HAS_andc_i32         1
 #define TCG_TARGET_HAS_orc_i32          1
 #define TCG_TARGET_HAS_eqv_i32          0
 #define TCG_TARGET_HAS_nand_i32         0
@@ -46,7 +45,6 @@ extern bool use_vis3_instructions;
 #define TCG_TARGET_HAS_bswap32_i64      0
 #define TCG_TARGET_HAS_bswap64_i64      0
 #define TCG_TARGET_HAS_not_i64          1
-#define TCG_TARGET_HAS_andc_i64         1
 #define TCG_TARGET_HAS_orc_i64          1
 #define TCG_TARGET_HAS_eqv_i64          0
 #define TCG_TARGET_HAS_nand_i64         0
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index b3fbe127c0..fe9175aa1a 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -1322,6 +1322,17 @@ static const TCGOutOpBinary outop_and = {
     .out_rri = tgen_andi,
 };
 
+static void tgen_andc(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_arith(s, a0, a1, a2, ARITH_ANDN);
+}
+
+static const TCGOutOpBinary outop_andc = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_andc,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -1379,9 +1390,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     OP_32_64(sub):
         c = ARITH_SUB;
         goto gen_arith;
-    OP_32_64(andc):
-        c = ARITH_ANDN;
-        goto gen_arith;
     OP_32_64(or):
         c = ARITH_OR;
         goto gen_arith;
@@ -1604,8 +1612,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_divu_i64:
     case INDEX_op_sub_i32:
     case INDEX_op_sub_i64:
-    case INDEX_op_andc_i32:
-    case INDEX_op_andc_i64:
     case INDEX_op_or_i32:
     case INDEX_op_or_i64:
     case INDEX_op_orc_i32:
diff --git a/tcg/tcg-has.h b/tcg/tcg-has.h
index 4ccdc6bbee..7e4301521e 100644
--- a/tcg/tcg-has.h
+++ b/tcg/tcg-has.h
@@ -20,7 +20,6 @@
 #define TCG_TARGET_HAS_bswap32_i64      0
 #define TCG_TARGET_HAS_bswap64_i64      0
 #define TCG_TARGET_HAS_not_i64          0
-#define TCG_TARGET_HAS_andc_i64         0
 #define TCG_TARGET_HAS_orc_i64          0
 #define TCG_TARGET_HAS_eqv_i64          0
 #define TCG_TARGET_HAS_nand_i64         0
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index 82f3ad501f..68818cbb0c 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -668,7 +668,7 @@ void tcg_gen_remu_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 
 void tcg_gen_andc_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 {
-    if (TCG_TARGET_HAS_andc_i32) {
+    if (tcg_op_supported(INDEX_op_andc_i32, TCG_TYPE_I32, 0)) {
         tcg_gen_op3_i32(INDEX_op_andc_i32, ret, arg1, arg2);
     } else {
         TCGv_i32 t0 = tcg_temp_ebb_new_i32();
@@ -2264,7 +2264,7 @@ void tcg_gen_andc_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
     if (TCG_TARGET_REG_BITS == 32) {
         tcg_gen_andc_i32(TCGV_LOW(ret), TCGV_LOW(arg1), TCGV_LOW(arg2));
         tcg_gen_andc_i32(TCGV_HIGH(ret), TCGV_HIGH(arg1), TCGV_HIGH(arg2));
-    } else if (TCG_TARGET_HAS_andc_i64) {
+    } else if (tcg_op_supported(INDEX_op_andc_i64, TCG_TYPE_I64, 0)) {
         tcg_gen_op3_i64(INDEX_op_andc_i64, ret, arg1, arg2);
     } else {
         TCGv_i64 t0 = tcg_temp_ebb_new_i64();
diff --git a/tcg/tcg.c b/tcg/tcg.c
index d60427eb7f..3d6dc9d1ca 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1006,6 +1006,8 @@ QEMU_BUILD_BUG_ON((int)(offsetof(CPUNegativeOffsetState, tlb.f[0]) -
 static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_add, TCGOutOpBinary, outop_add),
     OUTOP(INDEX_op_and, TCGOutOpBinary, outop_and),
+    OUTOP(INDEX_op_andc_i32, TCGOutOpBinary, outop_andc),
+    OUTOP(INDEX_op_andc_i64, TCGOutOpBinary, outop_andc),
 };
 
 #undef OUTOP
@@ -2269,8 +2271,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
         return TCG_TARGET_HAS_bswap32_i32;
     case INDEX_op_not_i32:
         return TCG_TARGET_HAS_not_i32;
-    case INDEX_op_andc_i32:
-        return TCG_TARGET_HAS_andc_i32;
     case INDEX_op_orc_i32:
         return TCG_TARGET_HAS_orc_i32;
     case INDEX_op_eqv_i32:
@@ -2346,8 +2346,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
         return TCG_TARGET_HAS_bswap64_i64;
     case INDEX_op_not_i64:
         return TCG_TARGET_HAS_not_i64;
-    case INDEX_op_andc_i64:
-        return TCG_TARGET_HAS_andc_i64;
     case INDEX_op_orc_i64:
         return TCG_TARGET_HAS_orc_i64;
     case INDEX_op_eqv_i64:
@@ -5443,6 +5441,8 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
 
     case INDEX_op_add:
     case INDEX_op_and:
+    case INDEX_op_andc_i32:
+    case INDEX_op_andc_i64:
         {
             const TCGOutOpBinary *out =
                 container_of(all_outop[op->opc], TCGOutOpBinary, base);
diff --git a/tcg/tci.c b/tcg/tci.c
index 8762a99fb6..95a61e9df1 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -547,12 +547,10 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = regs[r1] ^ regs[r2];
             break;
-#if TCG_TARGET_HAS_andc_i32 || TCG_TARGET_HAS_andc_i64
         CASE_32_64(andc)
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = regs[r1] & ~regs[r2];
             break;
-#endif
 #if TCG_TARGET_HAS_orc_i32 || TCG_TARGET_HAS_orc_i64
         CASE_32_64(orc)
             tci_args_rrr(insn, &r0, &r1, &r2);
diff --git a/tcg/tci/tcg-target-has.h b/tcg/tci/tcg-target-has.h
index cb0964c3d4..e09d366517 100644
--- a/tcg/tci/tcg-target-has.h
+++ b/tcg/tci/tcg-target-has.h
@@ -11,7 +11,6 @@
 #define TCG_TARGET_HAS_bswap32_i32      1
 #define TCG_TARGET_HAS_div_i32          1
 #define TCG_TARGET_HAS_rem_i32          1
-#define TCG_TARGET_HAS_andc_i32         1
 #define TCG_TARGET_HAS_extract2_i32     0
 #define TCG_TARGET_HAS_eqv_i32          1
 #define TCG_TARGET_HAS_nand_i32         1
@@ -36,7 +35,6 @@
 #define TCG_TARGET_HAS_extract2_i64     0
 #define TCG_TARGET_HAS_div_i64          1
 #define TCG_TARGET_HAS_rem_i64          1
-#define TCG_TARGET_HAS_andc_i64         1
 #define TCG_TARGET_HAS_eqv_i64          1
 #define TCG_TARGET_HAS_nand_i64         1
 #define TCG_TARGET_HAS_nor_i64          1
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index b0141f8ed6..fb7c648b63 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -95,8 +95,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_sub_i64:
     case INDEX_op_mul_i32:
     case INDEX_op_mul_i64:
-    case INDEX_op_andc_i32:
-    case INDEX_op_andc_i64:
     case INDEX_op_eqv_i32:
     case INDEX_op_eqv_i64:
     case INDEX_op_nand_i32:
@@ -659,6 +657,17 @@ static const TCGOutOpBinary outop_and = {
     .out_rrr = tgen_and,
 };
 
+static void tgen_andc(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_op_rrr(s, glue(INDEX_op_andc_i,TCG_TARGET_REG_BITS), a0, a1, a2);
+}
+
+static const TCGOutOpBinary outop_andc = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_andc,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -705,7 +714,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     CASE_32_64(mul)
     CASE_32_64(or)
     CASE_32_64(xor)
-    CASE_32_64(andc)     /* Optional (TCG_TARGET_HAS_andc_*). */
     CASE_32_64(orc)      /* Optional (TCG_TARGET_HAS_orc_*). */
     CASE_32_64(eqv)      /* Optional (TCG_TARGET_HAS_eqv_*). */
     CASE_32_64(nand)     /* Optional (TCG_TARGET_HAS_nand_*). */

From 46f96bff163512f9f8f9959de4a18c0799001422 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 6 Jan 2025 12:37:02 -0800
Subject: [PATCH 0371/2760] tcg: Merge INDEX_op_andc_{i32,i64}
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 docs/devel/tcg-ops.rst         | 2 +-
 include/tcg/tcg-opc.h          | 3 +--
 target/arm/tcg/translate-a64.c | 2 +-
 target/tricore/translate.c     | 2 +-
 tcg/optimize.c                 | 6 ++++--
 tcg/tcg-op.c                   | 8 ++++----
 tcg/tcg.c                      | 6 ++----
 tcg/tci.c                      | 5 ++---
 tcg/tci/tcg-target.c.inc       | 2 +-
 9 files changed, 17 insertions(+), 19 deletions(-)

diff --git a/docs/devel/tcg-ops.rst b/docs/devel/tcg-ops.rst
index 6a8025c0bf..116a0438b1 100644
--- a/docs/devel/tcg-ops.rst
+++ b/docs/devel/tcg-ops.rst
@@ -319,7 +319,7 @@ Logical
 
      - | *t0* = ~\ *t1*
 
-   * - andc_i32/i64 *t0*, *t1*, *t2*
+   * - andc *t0*, *t1*, *t2*
 
      - | *t0* = *t1* & ~\ *t2*
 
diff --git a/include/tcg/tcg-opc.h b/include/tcg/tcg-opc.h
index f45029caa7..9bc511992d 100644
--- a/include/tcg/tcg-opc.h
+++ b/include/tcg/tcg-opc.h
@@ -41,6 +41,7 @@ DEF(mov, 1, 1, 0, TCG_OPF_INT | TCG_OPF_NOT_PRESENT)
 
 DEF(add, 1, 2, 0, TCG_OPF_INT)
 DEF(and, 1, 2, 0, TCG_OPF_INT)
+DEF(andc, 1, 2, 0, TCG_OPF_INT)
 
 DEF(setcond_i32, 1, 2, 1, 0)
 DEF(negsetcond_i32, 1, 2, 1, 0)
@@ -91,7 +92,6 @@ DEF(bswap16_i32, 1, 1, 1, 0)
 DEF(bswap32_i32, 1, 1, 1, 0)
 DEF(not_i32, 1, 1, 0, 0)
 DEF(neg_i32, 1, 1, 0, 0)
-DEF(andc_i32, 1, 2, 0, 0)
 DEF(orc_i32, 1, 2, 0, 0)
 DEF(eqv_i32, 1, 2, 0, 0)
 DEF(nand_i32, 1, 2, 0, 0)
@@ -149,7 +149,6 @@ DEF(bswap32_i64, 1, 1, 1, 0)
 DEF(bswap64_i64, 1, 1, 1, 0)
 DEF(not_i64, 1, 1, 0, 0)
 DEF(neg_i64, 1, 1, 0, 0)
-DEF(andc_i64, 1, 2, 0, 0)
 DEF(orc_i64, 1, 2, 0, 0)
 DEF(eqv_i64, 1, 2, 0, 0)
 DEF(nand_i64, 1, 2, 0, 0)
diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index 43408c71bb..e076d4aa05 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -8600,7 +8600,7 @@ static bool trans_CCMP(DisasContext *s, arg_CCMP *a)
     tcg_gen_subi_i32(tcg_t2, tcg_t0, 1);
 
     nzcv = a->nzcv;
-    has_andc = tcg_op_supported(INDEX_op_andc_i32, TCG_TYPE_I32, 0);
+    has_andc = tcg_op_supported(INDEX_op_andc, TCG_TYPE_I32, 0);
     if (nzcv & 8) { /* N */
         tcg_gen_or_i32(cpu_NF, cpu_NF, tcg_t1);
     } else {
diff --git a/target/tricore/translate.c b/target/tricore/translate.c
index 7cd26d8eab..2d0cde0268 100644
--- a/target/tricore/translate.c
+++ b/target/tricore/translate.c
@@ -3981,7 +3981,7 @@ static void decode_bit_andacc(DisasContext *ctx)
                     pos1, pos2, &tcg_gen_andc_tl, &tcg_gen_and_tl);
         break;
     case OPC2_32_BIT_AND_NOR_T:
-        if (tcg_op_supported(INDEX_op_andc_i32, TCG_TYPE_I32, 0)) {
+        if (tcg_op_supported(INDEX_op_andc, TCG_TYPE_I32, 0)) {
             gen_bit_2op(cpu_gpr_d[r3], cpu_gpr_d[r1], cpu_gpr_d[r2],
                         pos1, pos2, &tcg_gen_or_tl, &tcg_gen_andc_tl);
         } else {
diff --git a/tcg/optimize.c b/tcg/optimize.c
index 6c7b6af624..875d80c254 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -479,7 +479,8 @@ static uint64_t do_constant_folding_2(TCGOpcode op, uint64_t x, uint64_t y)
     CASE_OP_32_64(neg):
         return -x;
 
-    CASE_OP_32_64_VEC(andc):
+    case INDEX_op_andc:
+    case INDEX_op_andc_vec:
         return x & ~y;
 
     CASE_OP_32_64_VEC(orc):
@@ -2852,7 +2853,8 @@ void tcg_optimize(TCGContext *s)
         case INDEX_op_and_vec:
             done = fold_and(&ctx, op);
             break;
-        CASE_OP_32_64_VEC(andc):
+        case INDEX_op_andc:
+        case INDEX_op_andc_vec:
             done = fold_andc(&ctx, op);
             break;
         CASE_OP_32_64(brcond):
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index 68818cbb0c..d87bd13375 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -668,8 +668,8 @@ void tcg_gen_remu_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 
 void tcg_gen_andc_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 {
-    if (tcg_op_supported(INDEX_op_andc_i32, TCG_TYPE_I32, 0)) {
-        tcg_gen_op3_i32(INDEX_op_andc_i32, ret, arg1, arg2);
+    if (tcg_op_supported(INDEX_op_andc, TCG_TYPE_I32, 0)) {
+        tcg_gen_op3_i32(INDEX_op_andc, ret, arg1, arg2);
     } else {
         TCGv_i32 t0 = tcg_temp_ebb_new_i32();
         tcg_gen_not_i32(t0, arg2);
@@ -2264,8 +2264,8 @@ void tcg_gen_andc_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
     if (TCG_TARGET_REG_BITS == 32) {
         tcg_gen_andc_i32(TCGV_LOW(ret), TCGV_LOW(arg1), TCGV_LOW(arg2));
         tcg_gen_andc_i32(TCGV_HIGH(ret), TCGV_HIGH(arg1), TCGV_HIGH(arg2));
-    } else if (tcg_op_supported(INDEX_op_andc_i64, TCG_TYPE_I64, 0)) {
-        tcg_gen_op3_i64(INDEX_op_andc_i64, ret, arg1, arg2);
+    } else if (tcg_op_supported(INDEX_op_andc, TCG_TYPE_I64, 0)) {
+        tcg_gen_op3_i64(INDEX_op_andc, ret, arg1, arg2);
     } else {
         TCGv_i64 t0 = tcg_temp_ebb_new_i64();
         tcg_gen_not_i64(t0, arg2);
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 3d6dc9d1ca..38b2dd1c44 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1006,8 +1006,7 @@ QEMU_BUILD_BUG_ON((int)(offsetof(CPUNegativeOffsetState, tlb.f[0]) -
 static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_add, TCGOutOpBinary, outop_add),
     OUTOP(INDEX_op_and, TCGOutOpBinary, outop_and),
-    OUTOP(INDEX_op_andc_i32, TCGOutOpBinary, outop_andc),
-    OUTOP(INDEX_op_andc_i64, TCGOutOpBinary, outop_andc),
+    OUTOP(INDEX_op_andc, TCGOutOpBinary, outop_andc),
 };
 
 #undef OUTOP
@@ -5441,8 +5440,7 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
 
     case INDEX_op_add:
     case INDEX_op_and:
-    case INDEX_op_andc_i32:
-    case INDEX_op_andc_i64:
+    case INDEX_op_andc:
         {
             const TCGOutOpBinary *out =
                 container_of(all_outop[op->opc], TCGOutOpBinary, base);
diff --git a/tcg/tci.c b/tcg/tci.c
index 95a61e9df1..e4a0408fec 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -547,7 +547,7 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = regs[r1] ^ regs[r2];
             break;
-        CASE_32_64(andc)
+        case INDEX_op_andc:
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = regs[r1] & ~regs[r2];
             break;
@@ -1082,6 +1082,7 @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
 
     case INDEX_op_add:
     case INDEX_op_and:
+    case INDEX_op_andc:
     case INDEX_op_sub_i32:
     case INDEX_op_sub_i64:
     case INDEX_op_mul_i32:
@@ -1090,8 +1091,6 @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
     case INDEX_op_or_i64:
     case INDEX_op_xor_i32:
     case INDEX_op_xor_i64:
-    case INDEX_op_andc_i32:
-    case INDEX_op_andc_i64:
     case INDEX_op_orc_i32:
     case INDEX_op_orc_i64:
     case INDEX_op_eqv_i32:
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index fb7c648b63..92c588305a 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -660,7 +660,7 @@ static const TCGOutOpBinary outop_and = {
 static void tgen_andc(TCGContext *s, TCGType type,
                       TCGReg a0, TCGReg a1, TCGReg a2)
 {
-    tcg_out_op_rrr(s, glue(INDEX_op_andc_i,TCG_TARGET_REG_BITS), a0, a1, a2);
+    tcg_out_op_rrr(s, INDEX_op_andc, a0, a1, a2);
 }
 
 static const TCGOutOpBinary outop_andc = {

From 6497af5b0d76819475839de9ea1ef9faad6215c0 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 6 Jan 2025 13:54:22 -0800
Subject: [PATCH 0372/2760] tcg: Convert or to TCGOutOpBinary
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target.c.inc     | 31 ++++++++++++---------
 tcg/arm/tcg-target.c.inc         | 24 ++++++++++++----
 tcg/i386/tcg-target.c.inc        | 25 +++++++++++++----
 tcg/loongarch64/tcg-target.c.inc | 29 ++++++++++++--------
 tcg/mips/tcg-target.c.inc        | 25 ++++++++++++-----
 tcg/ppc/tcg-target.c.inc         | 29 ++++++++++++--------
 tcg/riscv/tcg-target.c.inc       | 29 ++++++++++++--------
 tcg/s390x/tcg-target.c.inc       | 47 +++++++++++++++++---------------
 tcg/sparc64/tcg-target.c.inc     | 23 ++++++++++++----
 tcg/tcg.c                        |  4 +++
 tcg/tci/tcg-target.c.inc         | 14 ++++++++--
 11 files changed, 186 insertions(+), 94 deletions(-)

diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index c7167cad15..4b62e4e382 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -2157,6 +2157,24 @@ static const TCGOutOpBinary outop_andc = {
     .out_rrr = tgen_andc,
 };
 
+static void tgen_or(TCGContext *s, TCGType type,
+                    TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_insn(s, 3510, ORR, type, a0, a1, a2);
+}
+
+static void tgen_ori(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    tcg_out_logicali(s, I3404_ORRI, type, a0, a1, a2);
+}
+
+static const TCGOutOpBinary outop_or = {
+    .base.static_constraint = C_O1_I2(r, r, rL),
+    .out_rrr = tgen_or,
+    .out_rri = tgen_ori,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType ext,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -2238,17 +2256,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType ext,
         tcg_out_insn(s, 3502, SUB, ext, a0, TCG_REG_XZR, a1);
         break;
 
-    case INDEX_op_or_i32:
-        a2 = (int32_t)a2;
-        /* FALLTHRU */
-    case INDEX_op_or_i64:
-        if (c2) {
-            tcg_out_logicali(s, I3404_ORRI, ext, a0, a1, a2);
-        } else {
-            tcg_out_insn(s, 3510, ORR, ext, a0, a1, a2);
-        }
-        break;
-
     case INDEX_op_orc_i32:
         a2 = (int32_t)a2;
         /* FALLTHRU */
@@ -3016,8 +3023,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_mulsh_i64:
         return C_O1_I2(r, r, r);
 
-    case INDEX_op_or_i32:
-    case INDEX_op_or_i64:
     case INDEX_op_xor_i32:
     case INDEX_op_xor_i64:
     case INDEX_op_orc_i32:
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index feea82145a..0575d397c9 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -1881,6 +1881,24 @@ static const TCGOutOpBinary outop_andc = {
     .out_rrr = tgen_andc,
 };
 
+static void tgen_or(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_dat_reg(s, COND_AL, ARITH_ORR, a0, a1, a2, SHIFT_IMM_LSL(0));
+}
+
+static void tgen_ori(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    tcg_out_dat_imm(s, COND_AL, ARITH_ORR, a0, a1, encode_imm_nofail(a2));
+}
+
+static const TCGOutOpBinary outop_or = {
+    .base.static_constraint = C_O1_I2(r, r, rI),
+    .out_rrr = tgen_or,
+    .out_rri = tgen_ori,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -1943,13 +1961,8 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                             args[0], args[1], args[2], const_args[2]);
         }
         break;
-    case INDEX_op_or_i32:
-        c = ARITH_ORR;
-        goto gen_arith;
     case INDEX_op_xor_i32:
         c = ARITH_EOR;
-        /* Fall through.  */
-    gen_arith:
         tcg_out_dat_rI(s, COND_AL, c, args[0], args[1], args[2], const_args[2]);
         break;
     case INDEX_op_add2_i32:
@@ -2209,7 +2222,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_muls2_i32:
         return C_O2_I2(r, r, r, r);
 
-    case INDEX_op_or_i32:
     case INDEX_op_xor_i32:
         return C_O1_I2(r, r, rI);
 
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index 33c1fcc717..813092622c 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -2633,6 +2633,26 @@ static const TCGOutOpBinary outop_andc = {
     .out_rrr = tgen_andc,
 };
 
+static void tgen_or(TCGContext *s, TCGType type,
+                    TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    int rexw = type == TCG_TYPE_I32 ? 0 : P_REXW;
+    tgen_arithr(s, ARITH_OR + rexw, a0, a2);
+}
+
+static void tgen_ori(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    int rexw = type == TCG_TYPE_I32 ? 0 : P_REXW;
+    tgen_arithi(s, ARITH_OR + rexw, a0, a2, false);
+}
+
+static const TCGOutOpBinary outop_or = {
+    .base.static_constraint = C_O1_I2(r, 0, re),
+    .out_rrr = tgen_or,
+    .out_rri = tgen_ori,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -2717,9 +2737,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     OP_32_64(sub):
         c = ARITH_SUB;
         goto gen_arith;
-    OP_32_64(or):
-        c = ARITH_OR;
-        goto gen_arith;
     OP_32_64(xor):
         c = ARITH_XOR;
         goto gen_arith;
@@ -3645,8 +3662,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_sub_i64:
     case INDEX_op_mul_i32:
     case INDEX_op_mul_i64:
-    case INDEX_op_or_i32:
-    case INDEX_op_or_i64:
     case INDEX_op_xor_i32:
     case INDEX_op_xor_i64:
         return C_O1_I2(r, 0, re);
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index b7d2984a8a..a7ead51263 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -1332,6 +1332,24 @@ static const TCGOutOpBinary outop_andc = {
     .out_rrr = tgen_andc,
 };
 
+static void tgen_or(TCGContext *s, TCGType type,
+                    TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_opc_or(s, a0, a1, a2);
+}
+
+static void tgen_ori(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    tcg_out_opc_ori(s, a0, a1, a2);
+}
+
+static const TCGOutOpBinary outop_or = {
+    .base.static_constraint = C_O1_I2(r, r, rU),
+    .out_rrr = tgen_or,
+    .out_rri = tgen_ori,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -1392,15 +1410,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    case INDEX_op_or_i32:
-    case INDEX_op_or_i64:
-        if (c2) {
-            tcg_out_opc_ori(s, a0, a1, a2);
-        } else {
-            tcg_out_opc_or(s, a0, a1, a2);
-        }
-        break;
-
     case INDEX_op_xor_i32:
     case INDEX_op_xor_i64:
         if (c2) {
@@ -2300,8 +2309,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 
     case INDEX_op_nor_i32:
     case INDEX_op_nor_i64:
-    case INDEX_op_or_i32:
-    case INDEX_op_or_i64:
     case INDEX_op_xor_i32:
     case INDEX_op_xor_i64:
         /* LoongArch reg-imm bitops have their imms ZERO-extended */
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index ab57c78095..74eef1d3b3 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -1712,6 +1712,24 @@ static const TCGOutOpBinary outop_andc = {
     .base.static_constraint = C_NotImplemented,
 };
 
+static void tgen_or(TCGContext *s, TCGType type,
+                    TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_opc_reg(s, OPC_OR, a0, a1, a2);
+}
+
+static void tgen_ori(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    tcg_out_opc_imm(s, OPC_ORI, a0, a1, a2);
+}
+
+static const TCGOutOpBinary outop_or = {
+    .base.static_constraint = C_O1_I2(r, r, rI),
+    .out_rrr = tgen_or,
+    .out_rri = tgen_ori,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -1785,14 +1803,9 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_ldst(s, i1, a0, a1, a2);
         break;
 
-    case INDEX_op_or_i32:
-    case INDEX_op_or_i64:
-        i1 = OPC_OR, i2 = OPC_ORI;
-        goto do_binary;
     case INDEX_op_xor_i32:
     case INDEX_op_xor_i64:
         i1 = OPC_XOR, i2 = OPC_XORI;
-    do_binary:
         if (c2) {
             tcg_out_opc_imm(s, i2, a0, a1, a2);
             break;
@@ -2218,9 +2231,7 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_muls2_i64:
     case INDEX_op_mulu2_i64:
         return C_O2_I2(r, r, r, r);
-    case INDEX_op_or_i32:
     case INDEX_op_xor_i32:
-    case INDEX_op_or_i64:
     case INDEX_op_xor_i64:
         return C_O1_I2(r, r, rI);
     case INDEX_op_shl_i32:
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index 7b1a82c9fa..b638a5f813 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -2954,6 +2954,24 @@ static const TCGOutOpBinary outop_andc = {
     .out_rrr = tgen_andc,
 };
 
+static void tgen_or(TCGContext *s, TCGType type,
+                    TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out32(s, OR | SAB(a1, a0, a2));
+}
+
+static void tgen_ori(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    tcg_out_ori32(s, a0, a1, a2);
+}
+
+static const TCGOutOpBinary outop_or = {
+    .base.static_constraint = C_O1_I2(r, r, rU),
+    .out_rrr = tgen_or,
+    .out_rri = tgen_ori,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -3039,15 +3057,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    case INDEX_op_or_i64:
-    case INDEX_op_or_i32:
-        a0 = args[0], a1 = args[1], a2 = args[2];
-        if (const_args[2]) {
-            tcg_out_ori32(s, a0, a1, a2);
-        } else {
-            tcg_out32(s, OR | SAB(a1, a0, a2));
-        }
-        break;
     case INDEX_op_xor_i64:
     case INDEX_op_xor_i32:
         a0 = args[0], a1 = args[1], a2 = args[2];
@@ -4130,7 +4139,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(r, r);
 
-    case INDEX_op_or_i32:
     case INDEX_op_xor_i32:
     case INDEX_op_orc_i32:
     case INDEX_op_eqv_i32:
@@ -4172,7 +4180,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 
     case INDEX_op_sub_i32:
         return C_O1_I2(r, rI, ri);
-    case INDEX_op_or_i64:
     case INDEX_op_xor_i64:
         return C_O1_I2(r, r, rU);
     case INDEX_op_sub_i64:
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index f637604e98..9bacd109d4 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -2013,6 +2013,24 @@ static const TCGOutOpBinary outop_andc = {
     .out_rrr = tgen_andc,
 };
 
+static void tgen_or(TCGContext *s, TCGType type,
+                    TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_opc_reg(s, OPC_OR, a0, a1, a2);
+}
+
+static void tgen_ori(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    tcg_out_opc_imm(s, OPC_ORI, a0, a1, a2);
+}
+
+static const TCGOutOpBinary outop_or = {
+    .base.static_constraint = C_O1_I2(r, r, rI),
+    .out_rrr = tgen_or,
+    .out_rri = tgen_ori,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -2091,15 +2109,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    case INDEX_op_or_i32:
-    case INDEX_op_or_i64:
-        if (c2) {
-            tcg_out_opc_imm(s, OPC_ORI, a0, a1, a2);
-        } else {
-            tcg_out_opc_reg(s, OPC_OR, a0, a1, a2);
-        }
-        break;
-
     case INDEX_op_xor_i32:
     case INDEX_op_xor_i64:
         if (c2) {
@@ -2682,9 +2691,7 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(rz, r);
 
-    case INDEX_op_or_i32:
     case INDEX_op_xor_i32:
-    case INDEX_op_or_i64:
     case INDEX_op_xor_i64:
     case INDEX_op_setcond_i32:
     case INDEX_op_setcond_i64:
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index e4b60d1924..9267aef544 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -2242,6 +2242,31 @@ static const TCGOutOpBinary outop_andc = {
     .out_rrr = tgen_andc,
 };
 
+static void tgen_or(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    if (type != TCG_TYPE_I32) {
+        tcg_out_insn(s, RRFa, OGRK, a0, a1, a2);
+    } else if (a0 == a1) {
+        tcg_out_insn(s, RR, OR, a0, a2);
+    } else {
+        tcg_out_insn(s, RRFa, ORK, a0, a1, a2);
+    }
+}
+
+static void tgen_ori_3(TCGContext *s, TCGType type,
+                        TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    tcg_out_mov(s, type, a0, a1);
+    tgen_ori(s, a0, type == TCG_TYPE_I32 ? (uint32_t)a2 : a2);
+}
+
+static const TCGOutOpBinary outop_or = {
+    .base.static_constraint = C_O1_I2(r, r, rK),
+    .out_rrr = tgen_or,
+    .out_rri = tgen_ori_3,
+};
+
 
 # define OP_32_64(x) \
         case glue(glue(INDEX_op_,x),_i32): \
@@ -2310,17 +2335,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    case INDEX_op_or_i32:
-        a0 = args[0], a1 = args[1], a2 = (uint32_t)args[2];
-        if (const_args[2]) {
-            tcg_out_mov(s, TCG_TYPE_I32, a0, a1);
-            tgen_ori(s, a0, a2);
-        } else if (a0 == a1) {
-            tcg_out_insn(s, RR, OR, a0, a2);
-        } else {
-            tcg_out_insn(s, RRFa, ORK, a0, a1, a2);
-        }
-        break;
     case INDEX_op_xor_i32:
         a0 = args[0], a1 = args[1], a2 = (uint32_t)args[2];
         if (const_args[2]) {
@@ -2561,15 +2575,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    case INDEX_op_or_i64:
-        a0 = args[0], a1 = args[1], a2 = args[2];
-        if (const_args[2]) {
-            tcg_out_mov(s, TCG_TYPE_I64, a0, a1);
-            tgen_ori(s, a0, a2);
-        } else {
-            tcg_out_insn(s, RRFa, OGRK, a0, a1, a2);
-        }
-        break;
     case INDEX_op_xor_i64:
         a0 = args[0], a1 = args[1], a2 = args[2];
         if (const_args[2]) {
@@ -3282,10 +3287,8 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 
     case INDEX_op_sub_i32:
     case INDEX_op_sub_i64:
-    case INDEX_op_or_i32:
     case INDEX_op_xor_i32:
         return C_O1_I2(r, r, ri);
-    case INDEX_op_or_i64:
     case INDEX_op_xor_i64:
         return C_O1_I2(r, r, rK);
 
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index fe9175aa1a..b01d55c80b 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -1333,6 +1333,24 @@ static const TCGOutOpBinary outop_andc = {
     .out_rrr = tgen_andc,
 };
 
+static void tgen_or(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_arith(s, a0, a1, a2, ARITH_OR);
+}
+
+static void tgen_ori(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    tcg_out_arithi(s, a0, a1, a2, ARITH_OR);
+}
+
+static const TCGOutOpBinary outop_or = {
+    .base.static_constraint = C_O1_I2(r, r, rJ),
+    .out_rrr = tgen_or,
+    .out_rri = tgen_ori,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -1390,9 +1408,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     OP_32_64(sub):
         c = ARITH_SUB;
         goto gen_arith;
-    OP_32_64(or):
-        c = ARITH_OR;
-        goto gen_arith;
     OP_32_64(orc):
         c = ARITH_ORN;
         goto gen_arith;
@@ -1612,8 +1627,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_divu_i64:
     case INDEX_op_sub_i32:
     case INDEX_op_sub_i64:
-    case INDEX_op_or_i32:
-    case INDEX_op_or_i64:
     case INDEX_op_orc_i32:
     case INDEX_op_orc_i64:
     case INDEX_op_xor_i32:
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 38b2dd1c44..7357b5c127 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1007,6 +1007,8 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_add, TCGOutOpBinary, outop_add),
     OUTOP(INDEX_op_and, TCGOutOpBinary, outop_and),
     OUTOP(INDEX_op_andc, TCGOutOpBinary, outop_andc),
+    OUTOP(INDEX_op_or_i32, TCGOutOpBinary, outop_or),
+    OUTOP(INDEX_op_or_i64, TCGOutOpBinary, outop_or),
 };
 
 #undef OUTOP
@@ -5441,6 +5443,8 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
     case INDEX_op_add:
     case INDEX_op_and:
     case INDEX_op_andc:
+    case INDEX_op_or_i32:
+    case INDEX_op_or_i64:
         {
             const TCGOutOpBinary *out =
                 container_of(all_outop[op->opc], TCGOutOpBinary, base);
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index 92c588305a..6fdfcab061 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -101,8 +101,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_nand_i64:
     case INDEX_op_nor_i32:
     case INDEX_op_nor_i64:
-    case INDEX_op_or_i32:
-    case INDEX_op_or_i64:
     case INDEX_op_orc_i32:
     case INDEX_op_orc_i64:
     case INDEX_op_xor_i32:
@@ -668,6 +666,17 @@ static const TCGOutOpBinary outop_andc = {
     .out_rrr = tgen_andc,
 };
 
+static void tgen_or(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_op_rrr(s, glue(INDEX_op_or_i,TCG_TARGET_REG_BITS), a0, a1, a2);
+}
+
+static const TCGOutOpBinary outop_or = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_or,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -712,7 +721,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
 
     CASE_32_64(sub)
     CASE_32_64(mul)
-    CASE_32_64(or)
     CASE_32_64(xor)
     CASE_32_64(orc)      /* Optional (TCG_TARGET_HAS_orc_*). */
     CASE_32_64(eqv)      /* Optional (TCG_TARGET_HAS_eqv_*). */

From 49bd751497f3b71550b152ef9da0e265a94a64c1 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 6 Jan 2025 14:00:40 -0800
Subject: [PATCH 0373/2760] tcg: Merge INDEX_op_or_{i32,i64}
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 docs/devel/tcg-ops.rst   | 2 +-
 include/tcg/tcg-opc.h    | 3 +--
 target/sh4/translate.c   | 4 ++--
 tcg/optimize.c           | 6 ++++--
 tcg/tcg-op.c             | 4 ++--
 tcg/tcg.c                | 9 +++------
 tcg/tci.c                | 5 ++---
 tcg/tci/tcg-target.c.inc | 2 +-
 8 files changed, 16 insertions(+), 19 deletions(-)

diff --git a/docs/devel/tcg-ops.rst b/docs/devel/tcg-ops.rst
index 116a0438b1..8d67b0cdeb 100644
--- a/docs/devel/tcg-ops.rst
+++ b/docs/devel/tcg-ops.rst
@@ -307,7 +307,7 @@ Logical
 
      - | *t0* = *t1* & *t2*
 
-   * - or_i32/i64 *t0*, *t1*, *t2*
+   * - or *t0*, *t1*, *t2*
 
      - | *t0* = *t1* | *t2*
 
diff --git a/include/tcg/tcg-opc.h b/include/tcg/tcg-opc.h
index 9bc511992d..95608d6d31 100644
--- a/include/tcg/tcg-opc.h
+++ b/include/tcg/tcg-opc.h
@@ -42,6 +42,7 @@ DEF(mov, 1, 1, 0, TCG_OPF_INT | TCG_OPF_NOT_PRESENT)
 DEF(add, 1, 2, 0, TCG_OPF_INT)
 DEF(and, 1, 2, 0, TCG_OPF_INT)
 DEF(andc, 1, 2, 0, TCG_OPF_INT)
+DEF(or, 1, 2, 0, TCG_OPF_INT)
 
 DEF(setcond_i32, 1, 2, 1, 0)
 DEF(negsetcond_i32, 1, 2, 1, 0)
@@ -64,7 +65,6 @@ DEF(rem_i32, 1, 2, 0, 0)
 DEF(remu_i32, 1, 2, 0, 0)
 DEF(div2_i32, 2, 3, 0, 0)
 DEF(divu2_i32, 2, 3, 0, 0)
-DEF(or_i32, 1, 2, 0, 0)
 DEF(xor_i32, 1, 2, 0, 0)
 /* shifts/rotates */
 DEF(shl_i32, 1, 2, 0, 0)
@@ -124,7 +124,6 @@ DEF(rem_i64, 1, 2, 0, 0)
 DEF(remu_i64, 1, 2, 0, 0)
 DEF(div2_i64, 2, 3, 0, 0)
 DEF(divu2_i64, 2, 3, 0, 0)
-DEF(or_i64, 1, 2, 0, 0)
 DEF(xor_i64, 1, 2, 0, 0)
 /* shifts/rotates */
 DEF(shl_i64, 1, 2, 0, 0)
diff --git a/target/sh4/translate.c b/target/sh4/translate.c
index 3d0eda2128..094613d312 100644
--- a/target/sh4/translate.c
+++ b/target/sh4/translate.c
@@ -1949,7 +1949,7 @@ static void decode_gusa(DisasContext *ctx, CPUSH4State *env)
         op_opc = INDEX_op_xor_i32;
         goto do_reg_op;
     case 0x200b: /* or Rm,Rn */
-        op_opc = INDEX_op_or_i32;
+        op_opc = INDEX_op_or;
     do_reg_op:
         /* The operation register should be as expected, and the
            other input cannot depend on the load.  */
@@ -2119,7 +2119,7 @@ static void decode_gusa(DisasContext *ctx, CPUSH4State *env)
         }
         break;
 
-    case INDEX_op_or_i32:
+    case INDEX_op_or:
         if (op_dst != st_src) {
             goto fail;
         }
diff --git a/tcg/optimize.c b/tcg/optimize.c
index 875d80c254..7d5f7af223 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -437,7 +437,8 @@ static uint64_t do_constant_folding_2(TCGOpcode op, uint64_t x, uint64_t y)
     case INDEX_op_and_vec:
         return x & y;
 
-    CASE_OP_32_64_VEC(or):
+    case INDEX_op_or:
+    case INDEX_op_or_vec:
         return x | y;
 
     CASE_OP_32_64_VEC(xor):
@@ -2961,7 +2962,8 @@ void tcg_optimize(TCGContext *s)
         CASE_OP_32_64_VEC(not):
             done = fold_not(&ctx, op);
             break;
-        CASE_OP_32_64_VEC(or):
+        case INDEX_op_or:
+        case INDEX_op_or_vec:
             done = fold_or(&ctx, op);
             break;
         CASE_OP_32_64_VEC(orc):
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index d87bd13375..6807f4eebd 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -436,7 +436,7 @@ void tcg_gen_andi_i32(TCGv_i32 ret, TCGv_i32 arg1, int32_t arg2)
 
 void tcg_gen_or_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 {
-    tcg_gen_op3_i32(INDEX_op_or_i32, ret, arg1, arg2);
+    tcg_gen_op3_i32(INDEX_op_or, ret, arg1, arg2);
 }
 
 void tcg_gen_ori_i32(TCGv_i32 ret, TCGv_i32 arg1, int32_t arg2)
@@ -1585,7 +1585,7 @@ void tcg_gen_and_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
 void tcg_gen_or_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
 {
     if (TCG_TARGET_REG_BITS == 64) {
-        tcg_gen_op3_i64(INDEX_op_or_i64, ret, arg1, arg2);
+        tcg_gen_op3_i64(INDEX_op_or, ret, arg1, arg2);
     } else {
         tcg_gen_or_i32(TCGV_LOW(ret), TCGV_LOW(arg1), TCGV_LOW(arg2));
         tcg_gen_or_i32(TCGV_HIGH(ret), TCGV_HIGH(arg1), TCGV_HIGH(arg2));
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 7357b5c127..f31ae4e56b 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1007,8 +1007,7 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_add, TCGOutOpBinary, outop_add),
     OUTOP(INDEX_op_and, TCGOutOpBinary, outop_and),
     OUTOP(INDEX_op_andc, TCGOutOpBinary, outop_andc),
-    OUTOP(INDEX_op_or_i32, TCGOutOpBinary, outop_or),
-    OUTOP(INDEX_op_or_i64, TCGOutOpBinary, outop_or),
+    OUTOP(INDEX_op_or, TCGOutOpBinary, outop_or),
 };
 
 #undef OUTOP
@@ -2212,6 +2211,7 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_add:
     case INDEX_op_and:
     case INDEX_op_mov:
+    case INDEX_op_or:
         return has_type;
 
     case INDEX_op_setcond_i32:
@@ -2228,7 +2228,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_sub_i32:
     case INDEX_op_neg_i32:
     case INDEX_op_mul_i32:
-    case INDEX_op_or_i32:
     case INDEX_op_xor_i32:
     case INDEX_op_shl_i32:
     case INDEX_op_shr_i32:
@@ -2308,7 +2307,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_sub_i64:
     case INDEX_op_neg_i64:
     case INDEX_op_mul_i64:
-    case INDEX_op_or_i64:
     case INDEX_op_xor_i64:
     case INDEX_op_shl_i64:
     case INDEX_op_shr_i64:
@@ -5443,8 +5441,7 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
     case INDEX_op_add:
     case INDEX_op_and:
     case INDEX_op_andc:
-    case INDEX_op_or_i32:
-    case INDEX_op_or_i64:
+    case INDEX_op_or:
         {
             const TCGOutOpBinary *out =
                 container_of(all_outop[op->opc], TCGOutOpBinary, base);
diff --git a/tcg/tci.c b/tcg/tci.c
index e4a0408fec..3e361be6bd 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -539,7 +539,7 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = regs[r1] & regs[r2];
             break;
-        CASE_32_64(or)
+        case INDEX_op_or:
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = regs[r1] | regs[r2];
             break;
@@ -1083,12 +1083,11 @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
     case INDEX_op_add:
     case INDEX_op_and:
     case INDEX_op_andc:
+    case INDEX_op_or:
     case INDEX_op_sub_i32:
     case INDEX_op_sub_i64:
     case INDEX_op_mul_i32:
     case INDEX_op_mul_i64:
-    case INDEX_op_or_i32:
-    case INDEX_op_or_i64:
     case INDEX_op_xor_i32:
     case INDEX_op_xor_i64:
     case INDEX_op_orc_i32:
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index 6fdfcab061..4214b76b34 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -669,7 +669,7 @@ static const TCGOutOpBinary outop_andc = {
 static void tgen_or(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
-    tcg_out_op_rrr(s, glue(INDEX_op_or_i,TCG_TARGET_REG_BITS), a0, a1, a2);
+    tcg_out_op_rrr(s, INDEX_op_or, a0, a1, a2);
 }
 
 static const TCGOutOpBinary outop_or = {

From 50e40ecd7a5eb803a67d02aa586b5671968ac58b Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 10 Dec 2024 08:13:10 -0600
Subject: [PATCH 0374/2760] tcg/optimize: Fold orc with immediate to or
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 25 +++++++++++++++++++++++--
 1 file changed, 23 insertions(+), 2 deletions(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index 7d5f7af223..684b1099d0 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -2143,6 +2143,7 @@ static bool fold_or(OptContext *ctx, TCGOp *op)
 static bool fold_orc(OptContext *ctx, TCGOp *op)
 {
     uint64_t s_mask;
+    TempOptInfo *t1, *t2;
 
     if (fold_const2(ctx, op) ||
         fold_xx_to_i(ctx, op, -1) ||
@@ -2151,8 +2152,28 @@ static bool fold_orc(OptContext *ctx, TCGOp *op)
         return true;
     }
 
-    s_mask = arg_info(op->args[1])->s_mask
-           & arg_info(op->args[2])->s_mask;
+    t2 = arg_info(op->args[2]);
+    if (ti_is_const(t2)) {
+        /* Fold orc r,x,i to or r,x,~i. */
+        switch (ctx->type) {
+        case TCG_TYPE_I32:
+        case TCG_TYPE_I64:
+            op->opc = INDEX_op_or;
+            break;
+        case TCG_TYPE_V64:
+        case TCG_TYPE_V128:
+        case TCG_TYPE_V256:
+            op->opc = INDEX_op_or_vec;
+            break;
+        default:
+            g_assert_not_reached();
+        }
+        op->args[2] = arg_new_constant(ctx, ~ti_const_val(t2));
+        return fold_or(ctx, op);
+    }
+
+    t1 = arg_info(op->args[1]);
+    s_mask = t1->s_mask & t2->s_mask;
     return fold_masks_s(ctx, op, s_mask);
 }
 

From d262ae608115d2e6fc61ba6998d9813a5208b0e5 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 6 Jan 2025 14:30:50 -0800
Subject: [PATCH 0375/2760] tcg: Convert orc to TCGOutOpBinary
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

At the same time, drop all backend support for immediate
operands, as we now transform orc to or during optimize.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target-has.h         |  2 --
 tcg/aarch64/tcg-target.c.inc         | 24 ++++++++---------
 tcg/arm/tcg-target-has.h             |  1 -
 tcg/arm/tcg-target.c.inc             |  4 +++
 tcg/i386/tcg-target-has.h            |  2 --
 tcg/i386/tcg-target.c.inc            |  4 +++
 tcg/loongarch64/tcg-target-con-set.h |  1 -
 tcg/loongarch64/tcg-target-con-str.h |  1 -
 tcg/loongarch64/tcg-target-has.h     |  2 --
 tcg/loongarch64/tcg-target.c.inc     | 40 ++++++++++------------------
 tcg/mips/tcg-target-has.h            |  2 --
 tcg/mips/tcg-target.c.inc            |  4 +++
 tcg/ppc/tcg-target-has.h             |  2 --
 tcg/ppc/tcg-target.c.inc             | 22 +++++++--------
 tcg/riscv/tcg-target-has.h           |  2 --
 tcg/riscv/tcg-target.c.inc           | 22 ++++++++-------
 tcg/s390x/tcg-target-has.h           |  2 --
 tcg/s390x/tcg-target.c.inc           | 36 +++++++++++--------------
 tcg/sparc64/tcg-target-has.h         |  2 --
 tcg/sparc64/tcg-target.c.inc         | 16 +++++++----
 tcg/tcg-has.h                        |  1 -
 tcg/tcg-op.c                         |  4 +--
 tcg/tcg.c                            |  8 +++---
 tcg/tci.c                            |  2 --
 tcg/tci/tcg-target-has.h             |  2 --
 tcg/tci/tcg-target.c.inc             | 14 +++++++---
 26 files changed, 104 insertions(+), 118 deletions(-)

diff --git a/tcg/aarch64/tcg-target-has.h b/tcg/aarch64/tcg-target-has.h
index 851f6b01b4..8469a9446f 100644
--- a/tcg/aarch64/tcg-target-has.h
+++ b/tcg/aarch64/tcg-target-has.h
@@ -19,7 +19,6 @@
 #define TCG_TARGET_HAS_bswap32_i32      1
 #define TCG_TARGET_HAS_not_i32          1
 #define TCG_TARGET_HAS_rot_i32          1
-#define TCG_TARGET_HAS_orc_i32          1
 #define TCG_TARGET_HAS_eqv_i32          1
 #define TCG_TARGET_HAS_nand_i32         0
 #define TCG_TARGET_HAS_nor_i32          0
@@ -44,7 +43,6 @@
 #define TCG_TARGET_HAS_bswap64_i64      1
 #define TCG_TARGET_HAS_not_i64          1
 #define TCG_TARGET_HAS_rot_i64          1
-#define TCG_TARGET_HAS_orc_i64          1
 #define TCG_TARGET_HAS_eqv_i64          1
 #define TCG_TARGET_HAS_nand_i64         0
 #define TCG_TARGET_HAS_nor_i64          0
diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index 4b62e4e382..13592303a8 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -2175,6 +2175,17 @@ static const TCGOutOpBinary outop_or = {
     .out_rri = tgen_ori,
 };
 
+static void tgen_orc(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_insn(s, 3510, ORN, type, a0, a1, a2);
+}
+
+static const TCGOutOpBinary outop_orc = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_orc,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType ext,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -2256,17 +2267,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType ext,
         tcg_out_insn(s, 3502, SUB, ext, a0, TCG_REG_XZR, a1);
         break;
 
-    case INDEX_op_orc_i32:
-        a2 = (int32_t)a2;
-        /* FALLTHRU */
-    case INDEX_op_orc_i64:
-        if (c2) {
-            tcg_out_logicali(s, I3404_ORRI, ext, a0, a1, ~a2);
-        } else {
-            tcg_out_insn(s, 3510, ORN, ext, a0, a1, a2);
-        }
-        break;
-
     case INDEX_op_xor_i32:
         a2 = (int32_t)a2;
         /* FALLTHRU */
@@ -3025,8 +3025,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 
     case INDEX_op_xor_i32:
     case INDEX_op_xor_i64:
-    case INDEX_op_orc_i32:
-    case INDEX_op_orc_i64:
     case INDEX_op_eqv_i32:
     case INDEX_op_eqv_i64:
         return C_O1_I2(r, r, rL);
diff --git a/tcg/arm/tcg-target-has.h b/tcg/arm/tcg-target-has.h
index 0268858a3b..39dcc87fe8 100644
--- a/tcg/arm/tcg-target-has.h
+++ b/tcg/arm/tcg-target-has.h
@@ -28,7 +28,6 @@ extern bool use_neon_instructions;
 #define TCG_TARGET_HAS_bswap32_i32      1
 #define TCG_TARGET_HAS_not_i32          1
 #define TCG_TARGET_HAS_rot_i32          1
-#define TCG_TARGET_HAS_orc_i32          0
 #define TCG_TARGET_HAS_eqv_i32          0
 #define TCG_TARGET_HAS_nand_i32         0
 #define TCG_TARGET_HAS_nor_i32          0
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index 0575d397c9..48cbcd67b9 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -1899,6 +1899,10 @@ static const TCGOutOpBinary outop_or = {
     .out_rri = tgen_ori,
 };
 
+static const TCGOutOpBinary outop_orc = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
diff --git a/tcg/i386/tcg-target-has.h b/tcg/i386/tcg-target-has.h
index b29b70357a..e525f23c05 100644
--- a/tcg/i386/tcg-target-has.h
+++ b/tcg/i386/tcg-target-has.h
@@ -31,7 +31,6 @@
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
 #define TCG_TARGET_HAS_not_i32          1
-#define TCG_TARGET_HAS_orc_i32          0
 #define TCG_TARGET_HAS_eqv_i32          0
 #define TCG_TARGET_HAS_nand_i32         0
 #define TCG_TARGET_HAS_nor_i32          0
@@ -56,7 +55,6 @@
 #define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1
 #define TCG_TARGET_HAS_not_i64          1
-#define TCG_TARGET_HAS_orc_i64          0
 #define TCG_TARGET_HAS_eqv_i64          0
 #define TCG_TARGET_HAS_nand_i64         0
 #define TCG_TARGET_HAS_nor_i64          0
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index 813092622c..3fe1d9d9cc 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -2653,6 +2653,10 @@ static const TCGOutOpBinary outop_or = {
     .out_rri = tgen_ori,
 };
 
+static const TCGOutOpBinary outop_orc = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
diff --git a/tcg/loongarch64/tcg-target-con-set.h b/tcg/loongarch64/tcg-target-con-set.h
index b7c9b89e9e..b4af4f5423 100644
--- a/tcg/loongarch64/tcg-target-con-set.h
+++ b/tcg/loongarch64/tcg-target-con-set.h
@@ -23,7 +23,6 @@ C_O1_I1(r, r)
 C_O1_I1(w, r)
 C_O1_I1(w, w)
 C_O1_I2(r, r, r)
-C_O1_I2(r, r, rC)
 C_O1_I2(r, r, ri)
 C_O1_I2(r, r, rI)
 C_O1_I2(r, r, rJ)
diff --git a/tcg/loongarch64/tcg-target-con-str.h b/tcg/loongarch64/tcg-target-con-str.h
index 99759120b4..e5e57452d6 100644
--- a/tcg/loongarch64/tcg-target-con-str.h
+++ b/tcg/loongarch64/tcg-target-con-str.h
@@ -23,7 +23,6 @@ REGS('w', ALL_VECTOR_REGS)
 CONST('I', TCG_CT_CONST_S12)
 CONST('J', TCG_CT_CONST_S32)
 CONST('U', TCG_CT_CONST_U12)
-CONST('C', TCG_CT_CONST_C12)
 CONST('W', TCG_CT_CONST_WSZ)
 CONST('M', TCG_CT_CONST_VCMP)
 CONST('A', TCG_CT_CONST_VADD)
diff --git a/tcg/loongarch64/tcg-target-has.h b/tcg/loongarch64/tcg-target-has.h
index 71d91fec19..fb1142958c 100644
--- a/tcg/loongarch64/tcg-target-has.h
+++ b/tcg/loongarch64/tcg-target-has.h
@@ -25,7 +25,6 @@
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
 #define TCG_TARGET_HAS_not_i32          1
-#define TCG_TARGET_HAS_orc_i32          1
 #define TCG_TARGET_HAS_eqv_i32          0
 #define TCG_TARGET_HAS_nand_i32         0
 #define TCG_TARGET_HAS_nor_i32          1
@@ -46,7 +45,6 @@
 #define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1
 #define TCG_TARGET_HAS_not_i64          1
-#define TCG_TARGET_HAS_orc_i64          1
 #define TCG_TARGET_HAS_eqv_i64          0
 #define TCG_TARGET_HAS_nand_i64         0
 #define TCG_TARGET_HAS_nor_i64          1
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index a7ead51263..b6f13090b9 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -176,10 +176,9 @@ static TCGReg tcg_target_call_oarg_reg(TCGCallReturnKind kind, int slot)
 #define TCG_CT_CONST_S12   0x100
 #define TCG_CT_CONST_S32   0x200
 #define TCG_CT_CONST_U12   0x400
-#define TCG_CT_CONST_C12   0x800
-#define TCG_CT_CONST_WSZ   0x1000
-#define TCG_CT_CONST_VCMP  0x2000
-#define TCG_CT_CONST_VADD  0x4000
+#define TCG_CT_CONST_WSZ   0x800
+#define TCG_CT_CONST_VCMP  0x1000
+#define TCG_CT_CONST_VADD  0x2000
 
 #define ALL_GENERAL_REGS   MAKE_64BIT_MASK(0, 32)
 #define ALL_VECTOR_REGS    MAKE_64BIT_MASK(32, 32)
@@ -205,9 +204,6 @@ static bool tcg_target_const_match(int64_t val, int ct,
     if ((ct & TCG_CT_CONST_U12) && val >= 0 && val <= 0xfff) {
         return true;
     }
-    if ((ct & TCG_CT_CONST_C12) && ~val >= 0 && ~val <= 0xfff) {
-        return true;
-    }
     if ((ct & TCG_CT_CONST_WSZ) && val == (type == TCG_TYPE_I32 ? 32 : 64)) {
         return true;
     }
@@ -1350,6 +1346,17 @@ static const TCGOutOpBinary outop_or = {
     .out_rri = tgen_ori,
 };
 
+static void tgen_orc(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_opc_orn(s, a0, a1, a2);
+}
+
+static const TCGOutOpBinary outop_orc = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_orc,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -1400,16 +1407,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    case INDEX_op_orc_i32:
-    case INDEX_op_orc_i64:
-        if (c2) {
-            /* guaranteed to fit due to constraint */
-            tcg_out_opc_ori(s, a0, a1, ~a2);
-        } else {
-            tcg_out_opc_orn(s, a0, a1, a2);
-        }
-        break;
-
     case INDEX_op_xor_i32:
     case INDEX_op_xor_i64:
         if (c2) {
@@ -2286,15 +2283,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_qemu_ld_i64:
         return C_O1_I1(r, r);
 
-    case INDEX_op_orc_i32:
-    case INDEX_op_orc_i64:
-        /*
-         * LoongArch insns for these ops don't have reg-imm forms, but we
-         * can express using andi/ori if ~constant satisfies
-         * TCG_CT_CONST_U12.
-         */
-        return C_O1_I2(r, r, rC);
-
     case INDEX_op_shl_i32:
     case INDEX_op_shl_i64:
     case INDEX_op_shr_i32:
diff --git a/tcg/mips/tcg-target-has.h b/tcg/mips/tcg-target-has.h
index 6a6d4377e7..b3dfa390f9 100644
--- a/tcg/mips/tcg-target-has.h
+++ b/tcg/mips/tcg-target-has.h
@@ -43,7 +43,6 @@ extern bool use_mips32r2_instructions;
 #define TCG_TARGET_HAS_rem_i32          1
 #define TCG_TARGET_HAS_not_i32          1
 #define TCG_TARGET_HAS_nor_i32          1
-#define TCG_TARGET_HAS_orc_i32          0
 #define TCG_TARGET_HAS_eqv_i32          0
 #define TCG_TARGET_HAS_nand_i32         0
 #define TCG_TARGET_HAS_mulu2_i32        (!use_mips32r6_instructions)
@@ -62,7 +61,6 @@ extern bool use_mips32r2_instructions;
 #define TCG_TARGET_HAS_rem_i64          1
 #define TCG_TARGET_HAS_not_i64          1
 #define TCG_TARGET_HAS_nor_i64          1
-#define TCG_TARGET_HAS_orc_i64          0
 #define TCG_TARGET_HAS_eqv_i64          0
 #define TCG_TARGET_HAS_nand_i64         0
 #define TCG_TARGET_HAS_add2_i64         0
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index 74eef1d3b3..f6987963ec 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -1730,6 +1730,10 @@ static const TCGOutOpBinary outop_or = {
     .out_rri = tgen_ori,
 };
 
+static const TCGOutOpBinary outop_orc = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
diff --git a/tcg/ppc/tcg-target-has.h b/tcg/ppc/tcg-target-has.h
index 63bb66f446..6f3ab41ebb 100644
--- a/tcg/ppc/tcg-target-has.h
+++ b/tcg/ppc/tcg-target-has.h
@@ -23,7 +23,6 @@
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
 #define TCG_TARGET_HAS_not_i32          1
-#define TCG_TARGET_HAS_orc_i32          1
 #define TCG_TARGET_HAS_eqv_i32          1
 #define TCG_TARGET_HAS_nand_i32         1
 #define TCG_TARGET_HAS_nor_i32          1
@@ -49,7 +48,6 @@
 #define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1
 #define TCG_TARGET_HAS_not_i64          1
-#define TCG_TARGET_HAS_orc_i64          1
 #define TCG_TARGET_HAS_eqv_i64          1
 #define TCG_TARGET_HAS_nand_i64         1
 #define TCG_TARGET_HAS_nor_i64          1
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index b638a5f813..ccd7812016 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -2972,6 +2972,17 @@ static const TCGOutOpBinary outop_or = {
     .out_rri = tgen_ori,
 };
 
+static void tgen_orc(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out32(s, ORC | SAB(a1, a0, a2));
+}
+
+static const TCGOutOpBinary outop_orc = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_orc,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -3066,15 +3077,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
             tcg_out32(s, XOR | SAB(a1, a0, a2));
         }
         break;
-    case INDEX_op_orc_i32:
-        if (const_args[2]) {
-            tcg_out_ori32(s, args[0], args[1], ~args[2]);
-            break;
-        }
-        /* FALLTHRU */
-    case INDEX_op_orc_i64:
-        tcg_out32(s, ORC | SAB(args[1], args[0], args[2]));
-        break;
     case INDEX_op_eqv_i32:
         if (const_args[2]) {
             tcg_out_xori32(s, args[0], args[1], ~args[2]);
@@ -4140,7 +4142,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
         return C_O0_I2(r, r);
 
     case INDEX_op_xor_i32:
-    case INDEX_op_orc_i32:
     case INDEX_op_eqv_i32:
     case INDEX_op_shl_i32:
     case INDEX_op_shr_i32:
@@ -4166,7 +4167,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_nor_i32:
     case INDEX_op_muluh_i32:
     case INDEX_op_mulsh_i32:
-    case INDEX_op_orc_i64:
     case INDEX_op_eqv_i64:
     case INDEX_op_nand_i64:
     case INDEX_op_nor_i64:
diff --git a/tcg/riscv/tcg-target-has.h b/tcg/riscv/tcg-target-has.h
index a3918bf7f5..7b8f4386c9 100644
--- a/tcg/riscv/tcg-target-has.h
+++ b/tcg/riscv/tcg-target-has.h
@@ -25,7 +25,6 @@
 #define TCG_TARGET_HAS_bswap16_i32      (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_bswap32_i32      (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_not_i32          1
-#define TCG_TARGET_HAS_orc_i32          (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_eqv_i32          (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_nand_i32         0
 #define TCG_TARGET_HAS_nor_i32          0
@@ -45,7 +44,6 @@
 #define TCG_TARGET_HAS_bswap32_i64      (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_bswap64_i64      (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_not_i64          1
-#define TCG_TARGET_HAS_orc_i64          (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_eqv_i64          (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_nand_i64         0
 #define TCG_TARGET_HAS_nor_i64          0
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index 9bacd109d4..14216e9dff 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -2031,6 +2031,18 @@ static const TCGOutOpBinary outop_or = {
     .out_rri = tgen_ori,
 };
 
+static void tgen_orc(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_opc_reg(s, OPC_ORN, a0, a1, a2);
+}
+
+static const TCGOutOpBinary outop_orc = {
+    .base.static_constraint = C_Dynamic,
+    .base.dynamic_constraint = cset_zbb_rrr,
+    .out_rrr = tgen_orc,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -2118,14 +2130,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    case INDEX_op_orc_i32:
-    case INDEX_op_orc_i64:
-        if (c2) {
-            tcg_out_opc_imm(s, OPC_ORI, a0, a1, ~a2);
-        } else {
-            tcg_out_opc_reg(s, OPC_ORN, a0, a1, a2);
-        }
-        break;
     case INDEX_op_eqv_i32:
     case INDEX_op_eqv_i64:
         if (c2) {
@@ -2699,8 +2703,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_negsetcond_i64:
         return C_O1_I2(r, r, rI);
 
-    case INDEX_op_orc_i32:
-    case INDEX_op_orc_i64:
     case INDEX_op_eqv_i32:
     case INDEX_op_eqv_i64:
         return C_O1_I2(r, r, rJ);
diff --git a/tcg/s390x/tcg-target-has.h b/tcg/s390x/tcg-target-has.h
index 15ec0dc2ff..850c16a164 100644
--- a/tcg/s390x/tcg-target-has.h
+++ b/tcg/s390x/tcg-target-has.h
@@ -34,7 +34,6 @@ extern uint64_t s390_facilities[3];
 #define TCG_TARGET_HAS_bswap16_i32    1
 #define TCG_TARGET_HAS_bswap32_i32    1
 #define TCG_TARGET_HAS_not_i32        HAVE_FACILITY(MISC_INSN_EXT3)
-#define TCG_TARGET_HAS_orc_i32        HAVE_FACILITY(MISC_INSN_EXT3)
 #define TCG_TARGET_HAS_eqv_i32        HAVE_FACILITY(MISC_INSN_EXT3)
 #define TCG_TARGET_HAS_nand_i32       HAVE_FACILITY(MISC_INSN_EXT3)
 #define TCG_TARGET_HAS_nor_i32        HAVE_FACILITY(MISC_INSN_EXT3)
@@ -58,7 +57,6 @@ extern uint64_t s390_facilities[3];
 #define TCG_TARGET_HAS_bswap32_i64    1
 #define TCG_TARGET_HAS_bswap64_i64    1
 #define TCG_TARGET_HAS_not_i64        HAVE_FACILITY(MISC_INSN_EXT3)
-#define TCG_TARGET_HAS_orc_i64        HAVE_FACILITY(MISC_INSN_EXT3)
 #define TCG_TARGET_HAS_eqv_i64        HAVE_FACILITY(MISC_INSN_EXT3)
 #define TCG_TARGET_HAS_nand_i64       HAVE_FACILITY(MISC_INSN_EXT3)
 #define TCG_TARGET_HAS_nor_i64        HAVE_FACILITY(MISC_INSN_EXT3)
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index 9267aef544..97587939bd 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -2267,6 +2267,22 @@ static const TCGOutOpBinary outop_or = {
     .out_rri = tgen_ori_3,
 };
 
+static void tgen_orc(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    if (type == TCG_TYPE_I32) {
+        tcg_out_insn(s, RRFa, OCRK, a0, a1, a2);
+    } else {
+        tcg_out_insn(s, RRFa, OCGRK, a0, a1, a2);
+    }
+}
+
+static const TCGOutOpBinary outop_orc = {
+    .base.static_constraint = C_Dynamic,
+    .base.dynamic_constraint = cset_misc3_rrr,
+    .out_rrr = tgen_orc,
+};
+
 
 # define OP_32_64(x) \
         case glue(glue(INDEX_op_,x),_i32): \
@@ -2347,15 +2363,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    case INDEX_op_orc_i32:
-        a0 = args[0], a1 = args[1], a2 = (uint32_t)args[2];
-        if (const_args[2]) {
-            tcg_out_mov(s, TCG_TYPE_I32, a0, a1);
-            tgen_ori(s, a0, (uint32_t)~a2);
-        } else {
-            tcg_out_insn(s, RRFa, OCRK, a0, a1, a2);
-        }
-        break;
     case INDEX_op_eqv_i32:
         a0 = args[0], a1 = args[1], a2 = (uint32_t)args[2];
         if (const_args[2]) {
@@ -2585,15 +2592,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    case INDEX_op_orc_i64:
-        a0 = args[0], a1 = args[1], a2 = args[2];
-        if (const_args[2]) {
-            tcg_out_mov(s, TCG_TYPE_I64, a0, a1);
-            tgen_ori(s, a0, ~a2);
-        } else {
-            tcg_out_insn(s, RRFa, OCGRK, a0, a1, a2);
-        }
-        break;
     case INDEX_op_eqv_i64:
         a0 = args[0], a1 = args[1], a2 = args[2];
         if (const_args[2]) {
@@ -3292,10 +3290,8 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_xor_i64:
         return C_O1_I2(r, r, rK);
 
-    case INDEX_op_orc_i32:
     case INDEX_op_eqv_i32:
         return C_O1_I2(r, r, ri);
-    case INDEX_op_orc_i64:
     case INDEX_op_eqv_i64:
         return C_O1_I2(r, r, rNK);
 
diff --git a/tcg/sparc64/tcg-target-has.h b/tcg/sparc64/tcg-target-has.h
index 510b9e64a4..8e20e4cdeb 100644
--- a/tcg/sparc64/tcg-target-has.h
+++ b/tcg/sparc64/tcg-target-has.h
@@ -20,7 +20,6 @@ extern bool use_vis3_instructions;
 #define TCG_TARGET_HAS_bswap16_i32      0
 #define TCG_TARGET_HAS_bswap32_i32      0
 #define TCG_TARGET_HAS_not_i32          1
-#define TCG_TARGET_HAS_orc_i32          1
 #define TCG_TARGET_HAS_eqv_i32          0
 #define TCG_TARGET_HAS_nand_i32         0
 #define TCG_TARGET_HAS_nor_i32          0
@@ -45,7 +44,6 @@ extern bool use_vis3_instructions;
 #define TCG_TARGET_HAS_bswap32_i64      0
 #define TCG_TARGET_HAS_bswap64_i64      0
 #define TCG_TARGET_HAS_not_i64          1
-#define TCG_TARGET_HAS_orc_i64          1
 #define TCG_TARGET_HAS_eqv_i64          0
 #define TCG_TARGET_HAS_nand_i64         0
 #define TCG_TARGET_HAS_nor_i64          0
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index b01d55c80b..38b325e8a9 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -1351,6 +1351,17 @@ static const TCGOutOpBinary outop_or = {
     .out_rri = tgen_ori,
 };
 
+static void tgen_orc(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_arith(s, a0, a1, a2, ARITH_ORN);
+}
+
+static const TCGOutOpBinary outop_orc = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_orc,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -1408,9 +1419,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     OP_32_64(sub):
         c = ARITH_SUB;
         goto gen_arith;
-    OP_32_64(orc):
-        c = ARITH_ORN;
-        goto gen_arith;
     OP_32_64(xor):
         c = ARITH_XOR;
         goto gen_arith;
@@ -1627,8 +1635,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_divu_i64:
     case INDEX_op_sub_i32:
     case INDEX_op_sub_i64:
-    case INDEX_op_orc_i32:
-    case INDEX_op_orc_i64:
     case INDEX_op_xor_i32:
     case INDEX_op_xor_i64:
     case INDEX_op_shl_i32:
diff --git a/tcg/tcg-has.h b/tcg/tcg-has.h
index 7e4301521e..df9c951262 100644
--- a/tcg/tcg-has.h
+++ b/tcg/tcg-has.h
@@ -20,7 +20,6 @@
 #define TCG_TARGET_HAS_bswap32_i64      0
 #define TCG_TARGET_HAS_bswap64_i64      0
 #define TCG_TARGET_HAS_not_i64          0
-#define TCG_TARGET_HAS_orc_i64          0
 #define TCG_TARGET_HAS_eqv_i64          0
 #define TCG_TARGET_HAS_nand_i64         0
 #define TCG_TARGET_HAS_nor_i64          0
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index 6807f4eebd..503d395ac8 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -710,7 +710,7 @@ void tcg_gen_nor_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 
 void tcg_gen_orc_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 {
-    if (TCG_TARGET_HAS_orc_i32) {
+    if (tcg_op_supported(INDEX_op_orc_i32, TCG_TYPE_I32, 0)) {
         tcg_gen_op3_i32(INDEX_op_orc_i32, ret, arg1, arg2);
     } else {
         TCGv_i32 t0 = tcg_temp_ebb_new_i32();
@@ -2318,7 +2318,7 @@ void tcg_gen_orc_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
     if (TCG_TARGET_REG_BITS == 32) {
         tcg_gen_orc_i32(TCGV_LOW(ret), TCGV_LOW(arg1), TCGV_LOW(arg2));
         tcg_gen_orc_i32(TCGV_HIGH(ret), TCGV_HIGH(arg1), TCGV_HIGH(arg2));
-    } else if (TCG_TARGET_HAS_orc_i64) {
+    } else if (tcg_op_supported(INDEX_op_orc_i64, TCG_TYPE_I64, 0)) {
         tcg_gen_op3_i64(INDEX_op_orc_i64, ret, arg1, arg2);
     } else {
         TCGv_i64 t0 = tcg_temp_ebb_new_i64();
diff --git a/tcg/tcg.c b/tcg/tcg.c
index f31ae4e56b..4737a6b2cc 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1008,6 +1008,8 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_and, TCGOutOpBinary, outop_and),
     OUTOP(INDEX_op_andc, TCGOutOpBinary, outop_andc),
     OUTOP(INDEX_op_or, TCGOutOpBinary, outop_or),
+    OUTOP(INDEX_op_orc_i32, TCGOutOpBinary, outop_orc),
+    OUTOP(INDEX_op_orc_i64, TCGOutOpBinary, outop_orc),
 };
 
 #undef OUTOP
@@ -2271,8 +2273,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
         return TCG_TARGET_HAS_bswap32_i32;
     case INDEX_op_not_i32:
         return TCG_TARGET_HAS_not_i32;
-    case INDEX_op_orc_i32:
-        return TCG_TARGET_HAS_orc_i32;
     case INDEX_op_eqv_i32:
         return TCG_TARGET_HAS_eqv_i32;
     case INDEX_op_nand_i32:
@@ -2345,8 +2345,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
         return TCG_TARGET_HAS_bswap64_i64;
     case INDEX_op_not_i64:
         return TCG_TARGET_HAS_not_i64;
-    case INDEX_op_orc_i64:
-        return TCG_TARGET_HAS_orc_i64;
     case INDEX_op_eqv_i64:
         return TCG_TARGET_HAS_eqv_i64;
     case INDEX_op_nand_i64:
@@ -5442,6 +5440,8 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
     case INDEX_op_and:
     case INDEX_op_andc:
     case INDEX_op_or:
+    case INDEX_op_orc_i32:
+    case INDEX_op_orc_i64:
         {
             const TCGOutOpBinary *out =
                 container_of(all_outop[op->opc], TCGOutOpBinary, base);
diff --git a/tcg/tci.c b/tcg/tci.c
index 3e361be6bd..7a926b30db 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -551,12 +551,10 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = regs[r1] & ~regs[r2];
             break;
-#if TCG_TARGET_HAS_orc_i32 || TCG_TARGET_HAS_orc_i64
         CASE_32_64(orc)
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = regs[r1] | ~regs[r2];
             break;
-#endif
 #if TCG_TARGET_HAS_eqv_i32 || TCG_TARGET_HAS_eqv_i64
         CASE_32_64(eqv)
             tci_args_rrr(insn, &r0, &r1, &r2);
diff --git a/tcg/tci/tcg-target-has.h b/tcg/tci/tcg-target-has.h
index e09d366517..d247774e52 100644
--- a/tcg/tci/tcg-target-has.h
+++ b/tcg/tci/tcg-target-has.h
@@ -19,7 +19,6 @@
 #define TCG_TARGET_HAS_ctz_i32          1
 #define TCG_TARGET_HAS_ctpop_i32        1
 #define TCG_TARGET_HAS_not_i32          1
-#define TCG_TARGET_HAS_orc_i32          1
 #define TCG_TARGET_HAS_rot_i32          1
 #define TCG_TARGET_HAS_negsetcond_i32   0
 #define TCG_TARGET_HAS_muls2_i32        1
@@ -42,7 +41,6 @@
 #define TCG_TARGET_HAS_ctz_i64          1
 #define TCG_TARGET_HAS_ctpop_i64        1
 #define TCG_TARGET_HAS_not_i64          1
-#define TCG_TARGET_HAS_orc_i64          1
 #define TCG_TARGET_HAS_rot_i64          1
 #define TCG_TARGET_HAS_negsetcond_i64   0
 #define TCG_TARGET_HAS_muls2_i64        1
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index 4214b76b34..2e45cc4768 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -101,8 +101,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_nand_i64:
     case INDEX_op_nor_i32:
     case INDEX_op_nor_i64:
-    case INDEX_op_orc_i32:
-    case INDEX_op_orc_i64:
     case INDEX_op_xor_i32:
     case INDEX_op_xor_i64:
     case INDEX_op_shl_i32:
@@ -677,6 +675,17 @@ static const TCGOutOpBinary outop_or = {
     .out_rrr = tgen_or,
 };
 
+static void tgen_orc(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_op_rrr(s, glue(INDEX_op_orc_i,TCG_TARGET_REG_BITS), a0, a1, a2);
+}
+
+static const TCGOutOpBinary outop_orc = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_orc,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -722,7 +731,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     CASE_32_64(sub)
     CASE_32_64(mul)
     CASE_32_64(xor)
-    CASE_32_64(orc)      /* Optional (TCG_TARGET_HAS_orc_*). */
     CASE_32_64(eqv)      /* Optional (TCG_TARGET_HAS_eqv_*). */
     CASE_32_64(nand)     /* Optional (TCG_TARGET_HAS_nand_*). */
     CASE_32_64(nor)      /* Optional (TCG_TARGET_HAS_nor_*). */

From 6aba25ebb9eb6e1e86398294694aa0ab1f12076f Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 6 Jan 2025 14:46:26 -0800
Subject: [PATCH 0376/2760] tcg: Merge INDEX_op_orc_{i32,i64}
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 docs/devel/tcg-ops.rst         | 2 +-
 include/tcg/tcg-opc.h          | 3 +--
 target/arm/tcg/translate-sve.c | 2 +-
 target/tricore/translate.c     | 2 +-
 tcg/optimize.c                 | 6 ++++--
 tcg/tcg-op.c                   | 8 ++++----
 tcg/tcg.c                      | 6 ++----
 tcg/tci.c                      | 5 ++---
 tcg/tci/tcg-target.c.inc       | 2 +-
 9 files changed, 17 insertions(+), 19 deletions(-)

diff --git a/docs/devel/tcg-ops.rst b/docs/devel/tcg-ops.rst
index 8d67b0cdeb..c5c5a4d19e 100644
--- a/docs/devel/tcg-ops.rst
+++ b/docs/devel/tcg-ops.rst
@@ -335,7 +335,7 @@ Logical
 
      - | *t0* = ~(*t1* | *t2*)
 
-   * - orc_i32/i64 *t0*, *t1*, *t2*
+   * - orc *t0*, *t1*, *t2*
 
      - | *t0* = *t1* | ~\ *t2*
 
diff --git a/include/tcg/tcg-opc.h b/include/tcg/tcg-opc.h
index 95608d6d31..caf0f01042 100644
--- a/include/tcg/tcg-opc.h
+++ b/include/tcg/tcg-opc.h
@@ -43,6 +43,7 @@ DEF(add, 1, 2, 0, TCG_OPF_INT)
 DEF(and, 1, 2, 0, TCG_OPF_INT)
 DEF(andc, 1, 2, 0, TCG_OPF_INT)
 DEF(or, 1, 2, 0, TCG_OPF_INT)
+DEF(orc, 1, 2, 0, TCG_OPF_INT)
 
 DEF(setcond_i32, 1, 2, 1, 0)
 DEF(negsetcond_i32, 1, 2, 1, 0)
@@ -92,7 +93,6 @@ DEF(bswap16_i32, 1, 1, 1, 0)
 DEF(bswap32_i32, 1, 1, 1, 0)
 DEF(not_i32, 1, 1, 0, 0)
 DEF(neg_i32, 1, 1, 0, 0)
-DEF(orc_i32, 1, 2, 0, 0)
 DEF(eqv_i32, 1, 2, 0, 0)
 DEF(nand_i32, 1, 2, 0, 0)
 DEF(nor_i32, 1, 2, 0, 0)
@@ -148,7 +148,6 @@ DEF(bswap32_i64, 1, 1, 1, 0)
 DEF(bswap64_i64, 1, 1, 1, 0)
 DEF(not_i64, 1, 1, 0, 0)
 DEF(neg_i64, 1, 1, 0, 0)
-DEF(orc_i64, 1, 2, 0, 0)
 DEF(eqv_i64, 1, 2, 0, 0)
 DEF(nand_i64, 1, 2, 0, 0)
 DEF(nor_i64, 1, 2, 0, 0)
diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
index d23be477b4..f3cf028cb9 100644
--- a/target/arm/tcg/translate-sve.c
+++ b/target/arm/tcg/translate-sve.c
@@ -629,7 +629,7 @@ static void gen_bsl2n_i64(TCGv_i64 d, TCGv_i64 n, TCGv_i64 m, TCGv_i64 k)
      *       =         | ~(m | k)
      */
     tcg_gen_and_i64(n, n, k);
-    if (tcg_op_supported(INDEX_op_orc_i64, TCG_TYPE_I64, 0)) {
+    if (tcg_op_supported(INDEX_op_orc, TCG_TYPE_I64, 0)) {
         tcg_gen_or_i64(m, m, k);
         tcg_gen_orc_i64(d, n, m);
     } else {
diff --git a/target/tricore/translate.c b/target/tricore/translate.c
index 2d0cde0268..ede0c92c1e 100644
--- a/target/tricore/translate.c
+++ b/target/tricore/translate.c
@@ -4114,7 +4114,7 @@ static void decode_bit_orand(DisasContext *ctx)
                     pos1, pos2, &tcg_gen_andc_tl, &tcg_gen_or_tl);
         break;
     case OPC2_32_BIT_OR_NOR_T:
-        if (tcg_op_supported(INDEX_op_orc_i32, TCG_TYPE_I32, 0)) {
+        if (tcg_op_supported(INDEX_op_orc, TCG_TYPE_I32, 0)) {
             gen_bit_2op(cpu_gpr_d[r3], cpu_gpr_d[r1], cpu_gpr_d[r2],
                         pos1, pos2, &tcg_gen_or_tl, &tcg_gen_orc_tl);
         } else {
diff --git a/tcg/optimize.c b/tcg/optimize.c
index 684b1099d0..5f0ab354d6 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -484,7 +484,8 @@ static uint64_t do_constant_folding_2(TCGOpcode op, uint64_t x, uint64_t y)
     case INDEX_op_andc_vec:
         return x & ~y;
 
-    CASE_OP_32_64_VEC(orc):
+    case INDEX_op_orc:
+    case INDEX_op_orc_vec:
         return x | ~y;
 
     CASE_OP_32_64_VEC(eqv):
@@ -2987,7 +2988,8 @@ void tcg_optimize(TCGContext *s)
         case INDEX_op_or_vec:
             done = fold_or(&ctx, op);
             break;
-        CASE_OP_32_64_VEC(orc):
+        case INDEX_op_orc:
+        case INDEX_op_orc_vec:
             done = fold_orc(&ctx, op);
             break;
         case INDEX_op_qemu_ld_i32:
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index 503d395ac8..bf481060fa 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -710,8 +710,8 @@ void tcg_gen_nor_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 
 void tcg_gen_orc_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 {
-    if (tcg_op_supported(INDEX_op_orc_i32, TCG_TYPE_I32, 0)) {
-        tcg_gen_op3_i32(INDEX_op_orc_i32, ret, arg1, arg2);
+    if (tcg_op_supported(INDEX_op_orc, TCG_TYPE_I32, 0)) {
+        tcg_gen_op3_i32(INDEX_op_orc, ret, arg1, arg2);
     } else {
         TCGv_i32 t0 = tcg_temp_ebb_new_i32();
         tcg_gen_not_i32(t0, arg2);
@@ -2318,8 +2318,8 @@ void tcg_gen_orc_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
     if (TCG_TARGET_REG_BITS == 32) {
         tcg_gen_orc_i32(TCGV_LOW(ret), TCGV_LOW(arg1), TCGV_LOW(arg2));
         tcg_gen_orc_i32(TCGV_HIGH(ret), TCGV_HIGH(arg1), TCGV_HIGH(arg2));
-    } else if (tcg_op_supported(INDEX_op_orc_i64, TCG_TYPE_I64, 0)) {
-        tcg_gen_op3_i64(INDEX_op_orc_i64, ret, arg1, arg2);
+    } else if (tcg_op_supported(INDEX_op_orc, TCG_TYPE_I64, 0)) {
+        tcg_gen_op3_i64(INDEX_op_orc, ret, arg1, arg2);
     } else {
         TCGv_i64 t0 = tcg_temp_ebb_new_i64();
         tcg_gen_not_i64(t0, arg2);
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 4737a6b2cc..1b7e230219 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1008,8 +1008,7 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_and, TCGOutOpBinary, outop_and),
     OUTOP(INDEX_op_andc, TCGOutOpBinary, outop_andc),
     OUTOP(INDEX_op_or, TCGOutOpBinary, outop_or),
-    OUTOP(INDEX_op_orc_i32, TCGOutOpBinary, outop_orc),
-    OUTOP(INDEX_op_orc_i64, TCGOutOpBinary, outop_orc),
+    OUTOP(INDEX_op_orc, TCGOutOpBinary, outop_orc),
 };
 
 #undef OUTOP
@@ -5440,8 +5439,7 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
     case INDEX_op_and:
     case INDEX_op_andc:
     case INDEX_op_or:
-    case INDEX_op_orc_i32:
-    case INDEX_op_orc_i64:
+    case INDEX_op_orc:
         {
             const TCGOutOpBinary *out =
                 container_of(all_outop[op->opc], TCGOutOpBinary, base);
diff --git a/tcg/tci.c b/tcg/tci.c
index 7a926b30db..68636e70da 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -551,7 +551,7 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = regs[r1] & ~regs[r2];
             break;
-        CASE_32_64(orc)
+        case INDEX_op_orc:
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = regs[r1] | ~regs[r2];
             break;
@@ -1082,14 +1082,13 @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
     case INDEX_op_and:
     case INDEX_op_andc:
     case INDEX_op_or:
+    case INDEX_op_orc:
     case INDEX_op_sub_i32:
     case INDEX_op_sub_i64:
     case INDEX_op_mul_i32:
     case INDEX_op_mul_i64:
     case INDEX_op_xor_i32:
     case INDEX_op_xor_i64:
-    case INDEX_op_orc_i32:
-    case INDEX_op_orc_i64:
     case INDEX_op_eqv_i32:
     case INDEX_op_eqv_i64:
     case INDEX_op_nand_i32:
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index 2e45cc4768..b9309e2fb9 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -678,7 +678,7 @@ static const TCGOutOpBinary outop_or = {
 static void tgen_orc(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
-    tcg_out_op_rrr(s, glue(INDEX_op_orc_i,TCG_TARGET_REG_BITS), a0, a1, a2);
+    tcg_out_op_rrr(s, INDEX_op_orc, a0, a1, a2);
 }
 
 static const TCGOutOpBinary outop_orc = {

From d3e56f382493540b3a46a432a7e09261f4f5dbe7 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 6 Jan 2025 15:11:22 -0800
Subject: [PATCH 0377/2760] tcg: Convert xor to TCGOutOpBinary
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target.c.inc     | 31 +++++++++++---------
 tcg/arm/tcg-target.c.inc         | 25 +++++++++++-----
 tcg/i386/tcg-target.c.inc        | 27 ++++++++++++-----
 tcg/loongarch64/tcg-target.c.inc | 29 +++++++++++-------
 tcg/mips/tcg-target.c.inc        | 28 +++++++++++-------
 tcg/ppc/tcg-target.c.inc         | 30 +++++++++++--------
 tcg/riscv/tcg-target.c.inc       | 29 +++++++++++-------
 tcg/s390x/tcg-target.c.inc       | 50 ++++++++++++++++----------------
 tcg/sparc64/tcg-target.c.inc     | 23 +++++++++++----
 tcg/tcg.c                        |  4 +++
 tcg/tci/tcg-target.c.inc         | 14 +++++++--
 11 files changed, 186 insertions(+), 104 deletions(-)

diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index 13592303a8..d575635fe0 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -2186,6 +2186,24 @@ static const TCGOutOpBinary outop_orc = {
     .out_rrr = tgen_orc,
 };
 
+static void tgen_xor(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_insn(s, 3510, EOR, type, a0, a1, a2);
+}
+
+static void tgen_xori(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    tcg_out_logicali(s, I3404_EORI, type, a0, a1, a2);
+}
+
+static const TCGOutOpBinary outop_xor = {
+    .base.static_constraint = C_O1_I2(r, r, rL),
+    .out_rrr = tgen_xor,
+    .out_rri = tgen_xori,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType ext,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -2267,17 +2285,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType ext,
         tcg_out_insn(s, 3502, SUB, ext, a0, TCG_REG_XZR, a1);
         break;
 
-    case INDEX_op_xor_i32:
-        a2 = (int32_t)a2;
-        /* FALLTHRU */
-    case INDEX_op_xor_i64:
-        if (c2) {
-            tcg_out_logicali(s, I3404_EORI, ext, a0, a1, a2);
-        } else {
-            tcg_out_insn(s, 3510, EOR, ext, a0, a1, a2);
-        }
-        break;
-
     case INDEX_op_eqv_i32:
         a2 = (int32_t)a2;
         /* FALLTHRU */
@@ -3023,8 +3030,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_mulsh_i64:
         return C_O1_I2(r, r, r);
 
-    case INDEX_op_xor_i32:
-    case INDEX_op_xor_i64:
     case INDEX_op_eqv_i32:
     case INDEX_op_eqv_i64:
         return C_O1_I2(r, r, rL);
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index 48cbcd67b9..98cb3cf5e2 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -1903,6 +1903,24 @@ static const TCGOutOpBinary outop_orc = {
     .base.static_constraint = C_NotImplemented,
 };
 
+static void tgen_xor(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_dat_reg(s, COND_AL, ARITH_EOR, a0, a1, a2, SHIFT_IMM_LSL(0));
+}
+
+static void tgen_xori(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    tcg_out_dat_imm(s, COND_AL, ARITH_EOR, a0, a1, encode_imm_nofail(a2));
+}
+
+static const TCGOutOpBinary outop_xor = {
+    .base.static_constraint = C_O1_I2(r, r, rI),
+    .out_rrr = tgen_xor,
+    .out_rri = tgen_xori,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -1965,10 +1983,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                             args[0], args[1], args[2], const_args[2]);
         }
         break;
-    case INDEX_op_xor_i32:
-        c = ARITH_EOR;
-        tcg_out_dat_rI(s, COND_AL, c, args[0], args[1], args[2], const_args[2]);
-        break;
     case INDEX_op_add2_i32:
         a0 = args[0], a1 = args[1], a2 = args[2];
         a3 = args[3], a4 = args[4], a5 = args[5];
@@ -2226,9 +2240,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_muls2_i32:
         return C_O2_I2(r, r, r, r);
 
-    case INDEX_op_xor_i32:
-        return C_O1_I2(r, r, rI);
-
     case INDEX_op_shl_i32:
     case INDEX_op_shr_i32:
     case INDEX_op_sar_i32:
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index 3fe1d9d9cc..9126f9aeff 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -2657,6 +2657,26 @@ static const TCGOutOpBinary outop_orc = {
     .base.static_constraint = C_NotImplemented,
 };
 
+static void tgen_xor(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    int rexw = type == TCG_TYPE_I32 ? 0 : P_REXW;
+    tgen_arithr(s, ARITH_XOR + rexw, a0, a2);
+}
+
+static void tgen_xori(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    int rexw = type == TCG_TYPE_I32 ? 0 : P_REXW;
+    tgen_arithi(s, ARITH_XOR + rexw, a0, a2, false);
+}
+
+static const TCGOutOpBinary outop_xor = {
+    .base.static_constraint = C_O1_I2(r, 0, re),
+    .out_rrr = tgen_xor,
+    .out_rri = tgen_xori,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -2740,11 +2760,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
 
     OP_32_64(sub):
         c = ARITH_SUB;
-        goto gen_arith;
-    OP_32_64(xor):
-        c = ARITH_XOR;
-        goto gen_arith;
-    gen_arith:
         if (const_a2) {
             tgen_arithi(s, c + rexw, a0, a2, 0);
         } else {
@@ -3666,8 +3681,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_sub_i64:
     case INDEX_op_mul_i32:
     case INDEX_op_mul_i64:
-    case INDEX_op_xor_i32:
-    case INDEX_op_xor_i64:
         return C_O1_I2(r, 0, re);
 
     case INDEX_op_shl_i32:
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index b6f13090b9..296a84af79 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -1357,6 +1357,24 @@ static const TCGOutOpBinary outop_orc = {
     .out_rrr = tgen_orc,
 };
 
+static void tgen_xor(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_opc_xor(s, a0, a1, a2);
+}
+
+static void tgen_xori(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    tcg_out_opc_xori(s, a0, a1, a2);
+}
+
+static const TCGOutOpBinary outop_xor = {
+    .base.static_constraint = C_O1_I2(r, r, rU),
+    .out_rrr = tgen_xor,
+    .out_rri = tgen_xori,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -1407,15 +1425,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    case INDEX_op_xor_i32:
-    case INDEX_op_xor_i64:
-        if (c2) {
-            tcg_out_opc_xori(s, a0, a1, a2);
-        } else {
-            tcg_out_opc_xor(s, a0, a1, a2);
-        }
-        break;
-
     case INDEX_op_extract_i32:
         if (a2 == 0 && args[3] <= 12) {
             tcg_out_opc_andi(s, a0, a1, (1 << args[3]) - 1);
@@ -2297,8 +2306,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 
     case INDEX_op_nor_i32:
     case INDEX_op_nor_i64:
-    case INDEX_op_xor_i32:
-    case INDEX_op_xor_i64:
         /* LoongArch reg-imm bitops have their imms ZERO-extended */
         return C_O1_I2(r, r, rU);
 
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index f6987963ec..30fb01cb0a 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -1734,6 +1734,24 @@ static const TCGOutOpBinary outop_orc = {
     .base.static_constraint = C_NotImplemented,
 };
 
+static void tgen_xor(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_opc_reg(s, OPC_XOR, a0, a1, a2);
+}
+
+static void tgen_xori(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    tcg_out_opc_imm(s, OPC_XORI, a0, a1, a2);
+}
+
+static const TCGOutOpBinary outop_xor = {
+    .base.static_constraint = C_O1_I2(r, r, rI),
+    .out_rrr = tgen_xor,
+    .out_rri = tgen_xori,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -1807,13 +1825,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_ldst(s, i1, a0, a1, a2);
         break;
 
-    case INDEX_op_xor_i32:
-    case INDEX_op_xor_i64:
-        i1 = OPC_XOR, i2 = OPC_XORI;
-        if (c2) {
-            tcg_out_opc_imm(s, i2, a0, a1, a2);
-            break;
-        }
     do_binaryv:
         tcg_out_opc_reg(s, i1, a0, a1, a2);
         break;
@@ -2235,9 +2246,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_muls2_i64:
     case INDEX_op_mulu2_i64:
         return C_O2_I2(r, r, r, r);
-    case INDEX_op_xor_i32:
-    case INDEX_op_xor_i64:
-        return C_O1_I2(r, r, rI);
     case INDEX_op_shl_i32:
     case INDEX_op_shr_i32:
     case INDEX_op_sar_i32:
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index ccd7812016..16d3dbd841 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -2983,6 +2983,24 @@ static const TCGOutOpBinary outop_orc = {
     .out_rrr = tgen_orc,
 };
 
+static void tgen_xor(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out32(s, XOR | SAB(a1, a0, a2));
+}
+
+static void tgen_xori(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    tcg_out_xori32(s, a0, a1, a2);
+}
+
+static const TCGOutOpBinary outop_xor = {
+    .base.static_constraint = C_O1_I2(r, r, rU),
+    .out_rrr = tgen_xor,
+    .out_rri = tgen_xori,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -3068,15 +3086,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    case INDEX_op_xor_i64:
-    case INDEX_op_xor_i32:
-        a0 = args[0], a1 = args[1], a2 = args[2];
-        if (const_args[2]) {
-            tcg_out_xori32(s, a0, a1, a2);
-        } else {
-            tcg_out32(s, XOR | SAB(a1, a0, a2));
-        }
-        break;
     case INDEX_op_eqv_i32:
         if (const_args[2]) {
             tcg_out_xori32(s, args[0], args[1], ~args[2]);
@@ -4141,7 +4150,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(r, r);
 
-    case INDEX_op_xor_i32:
     case INDEX_op_eqv_i32:
     case INDEX_op_shl_i32:
     case INDEX_op_shr_i32:
@@ -4180,8 +4188,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 
     case INDEX_op_sub_i32:
         return C_O1_I2(r, rI, ri);
-    case INDEX_op_xor_i64:
-        return C_O1_I2(r, r, rU);
     case INDEX_op_sub_i64:
         return C_O1_I2(r, rI, rT);
     case INDEX_op_clz_i32:
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index 14216e9dff..c981ea389a 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -2043,6 +2043,24 @@ static const TCGOutOpBinary outop_orc = {
     .out_rrr = tgen_orc,
 };
 
+static void tgen_xor(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_opc_reg(s, OPC_XOR, a0, a1, a2);
+}
+
+static void tgen_xori(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    tcg_out_opc_imm(s, OPC_XORI, a0, a1, a2);
+}
+
+static const TCGOutOpBinary outop_xor = {
+    .base.static_constraint = C_O1_I2(r, r, rI),
+    .out_rrr = tgen_xor,
+    .out_rri = tgen_xori,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -2121,15 +2139,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    case INDEX_op_xor_i32:
-    case INDEX_op_xor_i64:
-        if (c2) {
-            tcg_out_opc_imm(s, OPC_XORI, a0, a1, a2);
-        } else {
-            tcg_out_opc_reg(s, OPC_XOR, a0, a1, a2);
-        }
-        break;
-
     case INDEX_op_eqv_i32:
     case INDEX_op_eqv_i64:
         if (c2) {
@@ -2695,8 +2704,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(rz, r);
 
-    case INDEX_op_xor_i32:
-    case INDEX_op_xor_i64:
     case INDEX_op_setcond_i32:
     case INDEX_op_setcond_i64:
     case INDEX_op_negsetcond_i32:
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index 97587939bd..bedad7137b 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -2283,6 +2283,31 @@ static const TCGOutOpBinary outop_orc = {
     .out_rrr = tgen_orc,
 };
 
+static void tgen_xor(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    if (type != TCG_TYPE_I32) {
+        tcg_out_insn(s, RRFa, XGRK, a0, a1, a2);
+    } else if (a0 == a1) {
+        tcg_out_insn(s, RR, XR, a0, a2);
+    } else {
+        tcg_out_insn(s, RRFa, XRK, a0, a1, a2);
+    }
+}
+
+static void tgen_xori_3(TCGContext *s, TCGType type,
+                        TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    tcg_out_mov(s, type, a0, a1);
+    tgen_xori(s, a0, type == TCG_TYPE_I32 ? (uint32_t)a2 : a2);
+}
+
+static const TCGOutOpBinary outop_xor = {
+    .base.static_constraint = C_O1_I2(r, r, rK),
+    .out_rrr = tgen_xor,
+    .out_rri = tgen_xori_3,
+};
+
 
 # define OP_32_64(x) \
         case glue(glue(INDEX_op_,x),_i32): \
@@ -2351,18 +2376,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    case INDEX_op_xor_i32:
-        a0 = args[0], a1 = args[1], a2 = (uint32_t)args[2];
-        if (const_args[2]) {
-            tcg_out_mov(s, TCG_TYPE_I32, a0, a1);
-            tcg_out_insn(s, RIL, XILF, a0, a2);
-        } else if (a0 == a1) {
-            tcg_out_insn(s, RR, XR, args[0], args[2]);
-        } else {
-            tcg_out_insn(s, RRFa, XRK, a0, a1, a2);
-        }
-        break;
-
     case INDEX_op_eqv_i32:
         a0 = args[0], a1 = args[1], a2 = (uint32_t)args[2];
         if (const_args[2]) {
@@ -2582,16 +2595,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    case INDEX_op_xor_i64:
-        a0 = args[0], a1 = args[1], a2 = args[2];
-        if (const_args[2]) {
-            tcg_out_mov(s, TCG_TYPE_I64, a0, a1);
-            tgen_xori(s, a0, a2);
-        } else {
-            tcg_out_insn(s, RRFa, XGRK, a0, a1, a2);
-        }
-        break;
-
     case INDEX_op_eqv_i64:
         a0 = args[0], a1 = args[1], a2 = args[2];
         if (const_args[2]) {
@@ -3285,10 +3288,7 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 
     case INDEX_op_sub_i32:
     case INDEX_op_sub_i64:
-    case INDEX_op_xor_i32:
         return C_O1_I2(r, r, ri);
-    case INDEX_op_xor_i64:
-        return C_O1_I2(r, r, rK);
 
     case INDEX_op_eqv_i32:
         return C_O1_I2(r, r, ri);
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index 38b325e8a9..8a6c9852d2 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -1362,6 +1362,24 @@ static const TCGOutOpBinary outop_orc = {
     .out_rrr = tgen_orc,
 };
 
+static void tgen_xor(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_arith(s, a0, a1, a2, ARITH_XOR);
+}
+
+static void tgen_xori(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    tcg_out_arithi(s, a0, a1, a2, ARITH_XOR);
+}
+
+static const TCGOutOpBinary outop_xor = {
+    .base.static_constraint = C_O1_I2(r, r, rJ),
+    .out_rrr = tgen_xor,
+    .out_rri = tgen_xori,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -1419,9 +1437,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     OP_32_64(sub):
         c = ARITH_SUB;
         goto gen_arith;
-    OP_32_64(xor):
-        c = ARITH_XOR;
-        goto gen_arith;
     case INDEX_op_shl_i32:
         c = SHIFT_SLL;
     do_shift32:
@@ -1635,8 +1650,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_divu_i64:
     case INDEX_op_sub_i32:
     case INDEX_op_sub_i64:
-    case INDEX_op_xor_i32:
-    case INDEX_op_xor_i64:
     case INDEX_op_shl_i32:
     case INDEX_op_shl_i64:
     case INDEX_op_shr_i32:
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 1b7e230219..042f177966 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1009,6 +1009,8 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_andc, TCGOutOpBinary, outop_andc),
     OUTOP(INDEX_op_or, TCGOutOpBinary, outop_or),
     OUTOP(INDEX_op_orc, TCGOutOpBinary, outop_orc),
+    OUTOP(INDEX_op_xor_i32, TCGOutOpBinary, outop_xor),
+    OUTOP(INDEX_op_xor_i64, TCGOutOpBinary, outop_xor),
 };
 
 #undef OUTOP
@@ -5440,6 +5442,8 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
     case INDEX_op_andc:
     case INDEX_op_or:
     case INDEX_op_orc:
+    case INDEX_op_xor_i32:
+    case INDEX_op_xor_i64:
         {
             const TCGOutOpBinary *out =
                 container_of(all_outop[op->opc], TCGOutOpBinary, base);
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index b9309e2fb9..85caff300f 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -101,8 +101,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_nand_i64:
     case INDEX_op_nor_i32:
     case INDEX_op_nor_i64:
-    case INDEX_op_xor_i32:
-    case INDEX_op_xor_i64:
     case INDEX_op_shl_i32:
     case INDEX_op_shl_i64:
     case INDEX_op_shr_i32:
@@ -686,6 +684,17 @@ static const TCGOutOpBinary outop_orc = {
     .out_rrr = tgen_orc,
 };
 
+static void tgen_xor(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_op_rrr(s, glue(INDEX_op_xor_i,TCG_TARGET_REG_BITS), a0, a1, a2);
+}
+
+static const TCGOutOpBinary outop_xor = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_xor,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -730,7 +739,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
 
     CASE_32_64(sub)
     CASE_32_64(mul)
-    CASE_32_64(xor)
     CASE_32_64(eqv)      /* Optional (TCG_TARGET_HAS_eqv_*). */
     CASE_32_64(nand)     /* Optional (TCG_TARGET_HAS_nand_*). */
     CASE_32_64(nor)      /* Optional (TCG_TARGET_HAS_nor_*). */

From fffd3dc9022efe89b9196d738127c294cf43a4d6 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 6 Jan 2025 15:18:35 -0800
Subject: [PATCH 0378/2760] tcg: Merge INDEX_op_xor_{i32,i64}
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 docs/devel/tcg-ops.rst   |  2 +-
 include/tcg/tcg-opc.h    |  3 +--
 target/sh4/translate.c   |  6 +++---
 tcg/optimize.c           | 18 ++++++++----------
 tcg/tcg-op.c             |  4 ++--
 tcg/tcg.c                |  9 +++------
 tcg/tci.c                |  5 ++---
 tcg/tci/tcg-target.c.inc |  2 +-
 8 files changed, 21 insertions(+), 28 deletions(-)

diff --git a/docs/devel/tcg-ops.rst b/docs/devel/tcg-ops.rst
index c5c5a4d19e..a4aa4f8824 100644
--- a/docs/devel/tcg-ops.rst
+++ b/docs/devel/tcg-ops.rst
@@ -311,7 +311,7 @@ Logical
 
      - | *t0* = *t1* | *t2*
 
-   * - xor_i32/i64 *t0*, *t1*, *t2*
+   * - xor *t0*, *t1*, *t2*
 
      - | *t0* = *t1* ^ *t2*
 
diff --git a/include/tcg/tcg-opc.h b/include/tcg/tcg-opc.h
index caf0f01042..8f6115bedb 100644
--- a/include/tcg/tcg-opc.h
+++ b/include/tcg/tcg-opc.h
@@ -44,6 +44,7 @@ DEF(and, 1, 2, 0, TCG_OPF_INT)
 DEF(andc, 1, 2, 0, TCG_OPF_INT)
 DEF(or, 1, 2, 0, TCG_OPF_INT)
 DEF(orc, 1, 2, 0, TCG_OPF_INT)
+DEF(xor, 1, 2, 0, TCG_OPF_INT)
 
 DEF(setcond_i32, 1, 2, 1, 0)
 DEF(negsetcond_i32, 1, 2, 1, 0)
@@ -66,7 +67,6 @@ DEF(rem_i32, 1, 2, 0, 0)
 DEF(remu_i32, 1, 2, 0, 0)
 DEF(div2_i32, 2, 3, 0, 0)
 DEF(divu2_i32, 2, 3, 0, 0)
-DEF(xor_i32, 1, 2, 0, 0)
 /* shifts/rotates */
 DEF(shl_i32, 1, 2, 0, 0)
 DEF(shr_i32, 1, 2, 0, 0)
@@ -124,7 +124,6 @@ DEF(rem_i64, 1, 2, 0, 0)
 DEF(remu_i64, 1, 2, 0, 0)
 DEF(div2_i64, 2, 3, 0, 0)
 DEF(divu2_i64, 2, 3, 0, 0)
-DEF(xor_i64, 1, 2, 0, 0)
 /* shifts/rotates */
 DEF(shl_i64, 1, 2, 0, 0)
 DEF(shr_i64, 1, 2, 0, 0)
diff --git a/target/sh4/translate.c b/target/sh4/translate.c
index 094613d312..8248648c0c 100644
--- a/target/sh4/translate.c
+++ b/target/sh4/translate.c
@@ -1946,7 +1946,7 @@ static void decode_gusa(DisasContext *ctx, CPUSH4State *env)
         op_opc = INDEX_op_and;
         goto do_reg_op;
     case 0x200a: /* xor Rm,Rn */
-        op_opc = INDEX_op_xor_i32;
+        op_opc = INDEX_op_xor;
         goto do_reg_op;
     case 0x200b: /* or Rm,Rn */
         op_opc = INDEX_op_or;
@@ -1976,7 +1976,7 @@ static void decode_gusa(DisasContext *ctx, CPUSH4State *env)
             goto fail;
         }
         op_dst = B11_8;
-        op_opc = INDEX_op_xor_i32;
+        op_opc = INDEX_op_xor;
         op_arg = tcg_constant_i32(-1);
         break;
 
@@ -2133,7 +2133,7 @@ static void decode_gusa(DisasContext *ctx, CPUSH4State *env)
         }
         break;
 
-    case INDEX_op_xor_i32:
+    case INDEX_op_xor:
         if (op_dst != st_src) {
             goto fail;
         }
diff --git a/tcg/optimize.c b/tcg/optimize.c
index 5f0ab354d6..9303bb5b64 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -441,7 +441,8 @@ static uint64_t do_constant_folding_2(TCGOpcode op, uint64_t x, uint64_t y)
     case INDEX_op_or_vec:
         return x | y;
 
-    CASE_OP_32_64_VEC(xor):
+    case INDEX_op_xor:
+    case INDEX_op_xor_vec:
         return x ^ y;
 
     case INDEX_op_shl_i32:
@@ -2289,7 +2290,7 @@ static int fold_setcond_zmask(OptContext *ctx, TCGOp *op, bool neg)
             break;
         }
         if (convert) {
-            TCGOpcode xor_opc, neg_opc;
+            TCGOpcode neg_opc;
 
             if (!inv && !neg) {
                 return tcg_opt_gen_mov(ctx, op, op->args[0], op->args[1]);
@@ -2298,11 +2299,9 @@ static int fold_setcond_zmask(OptContext *ctx, TCGOp *op, bool neg)
             switch (ctx->type) {
             case TCG_TYPE_I32:
                 neg_opc = INDEX_op_neg_i32;
-                xor_opc = INDEX_op_xor_i32;
                 break;
             case TCG_TYPE_I64:
                 neg_opc = INDEX_op_neg_i64;
-                xor_opc = INDEX_op_xor_i64;
                 break;
             default:
                 g_assert_not_reached();
@@ -2314,7 +2313,7 @@ static int fold_setcond_zmask(OptContext *ctx, TCGOp *op, bool neg)
                 op->opc = INDEX_op_add;
                 op->args[2] = arg_new_constant(ctx, -1);
             } else {
-                op->opc = xor_opc;
+                op->opc = INDEX_op_xor;
                 op->args[2] = arg_new_constant(ctx, 1);
             }
             return -1;
@@ -2325,7 +2324,7 @@ static int fold_setcond_zmask(OptContext *ctx, TCGOp *op, bool neg)
 
 static void fold_setcond_tst_pow2(OptContext *ctx, TCGOp *op, bool neg)
 {
-    TCGOpcode xor_opc, neg_opc, shr_opc;
+    TCGOpcode neg_opc, shr_opc;
     TCGOpcode uext_opc = 0, sext_opc = 0;
     TCGCond cond = op->args[3];
     TCGArg ret, src1, src2;
@@ -2347,7 +2346,6 @@ static void fold_setcond_tst_pow2(OptContext *ctx, TCGOp *op, bool neg)
 
     switch (ctx->type) {
     case TCG_TYPE_I32:
-        xor_opc = INDEX_op_xor_i32;
         shr_opc = INDEX_op_shr_i32;
         neg_opc = INDEX_op_neg_i32;
         if (TCG_TARGET_extract_valid(TCG_TYPE_I32, sh, 1)) {
@@ -2358,7 +2356,6 @@ static void fold_setcond_tst_pow2(OptContext *ctx, TCGOp *op, bool neg)
         }
         break;
     case TCG_TYPE_I64:
-        xor_opc = INDEX_op_xor_i64;
         shr_opc = INDEX_op_shr_i64;
         neg_opc = INDEX_op_neg_i64;
         if (TCG_TARGET_extract_valid(TCG_TYPE_I64, sh, 1)) {
@@ -2406,7 +2403,7 @@ static void fold_setcond_tst_pow2(OptContext *ctx, TCGOp *op, bool neg)
         op2->args[1] = ret;
         op2->args[2] = arg_new_constant(ctx, -1);
     } else if (inv) {
-        op2 = opt_insert_after(ctx, op, xor_opc, 3);
+        op2 = opt_insert_after(ctx, op, INDEX_op_xor, 3);
         op2->args[0] = ret;
         op2->args[1] = ret;
         op2->args[2] = arg_new_constant(ctx, 1);
@@ -3051,7 +3048,8 @@ void tcg_optimize(TCGContext *s)
         CASE_OP_32_64(sub2):
             done = fold_sub2(&ctx, op);
             break;
-        CASE_OP_32_64_VEC(xor):
+        case INDEX_op_xor:
+        case INDEX_op_xor_vec:
             done = fold_xor(&ctx, op);
             break;
         case INDEX_op_set_label:
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index bf481060fa..b10f61435c 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -453,7 +453,7 @@ void tcg_gen_ori_i32(TCGv_i32 ret, TCGv_i32 arg1, int32_t arg2)
 
 void tcg_gen_xor_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 {
-    tcg_gen_op3_i32(INDEX_op_xor_i32, ret, arg1, arg2);
+    tcg_gen_op3_i32(INDEX_op_xor, ret, arg1, arg2);
 }
 
 void tcg_gen_xori_i32(TCGv_i32 ret, TCGv_i32 arg1, int32_t arg2)
@@ -1595,7 +1595,7 @@ void tcg_gen_or_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
 void tcg_gen_xor_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
 {
     if (TCG_TARGET_REG_BITS == 64) {
-        tcg_gen_op3_i64(INDEX_op_xor_i64, ret, arg1, arg2);
+        tcg_gen_op3_i64(INDEX_op_xor, ret, arg1, arg2);
     } else {
         tcg_gen_xor_i32(TCGV_LOW(ret), TCGV_LOW(arg1), TCGV_LOW(arg2));
         tcg_gen_xor_i32(TCGV_HIGH(ret), TCGV_HIGH(arg1), TCGV_HIGH(arg2));
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 042f177966..3c4905aa68 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1009,8 +1009,7 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_andc, TCGOutOpBinary, outop_andc),
     OUTOP(INDEX_op_or, TCGOutOpBinary, outop_or),
     OUTOP(INDEX_op_orc, TCGOutOpBinary, outop_orc),
-    OUTOP(INDEX_op_xor_i32, TCGOutOpBinary, outop_xor),
-    OUTOP(INDEX_op_xor_i64, TCGOutOpBinary, outop_xor),
+    OUTOP(INDEX_op_xor, TCGOutOpBinary, outop_xor),
 };
 
 #undef OUTOP
@@ -2215,6 +2214,7 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_and:
     case INDEX_op_mov:
     case INDEX_op_or:
+    case INDEX_op_xor:
         return has_type;
 
     case INDEX_op_setcond_i32:
@@ -2231,7 +2231,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_sub_i32:
     case INDEX_op_neg_i32:
     case INDEX_op_mul_i32:
-    case INDEX_op_xor_i32:
     case INDEX_op_shl_i32:
     case INDEX_op_shr_i32:
     case INDEX_op_sar_i32:
@@ -2308,7 +2307,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_sub_i64:
     case INDEX_op_neg_i64:
     case INDEX_op_mul_i64:
-    case INDEX_op_xor_i64:
     case INDEX_op_shl_i64:
     case INDEX_op_shr_i64:
     case INDEX_op_sar_i64:
@@ -5442,8 +5440,7 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
     case INDEX_op_andc:
     case INDEX_op_or:
     case INDEX_op_orc:
-    case INDEX_op_xor_i32:
-    case INDEX_op_xor_i64:
+    case INDEX_op_xor:
         {
             const TCGOutOpBinary *out =
                 container_of(all_outop[op->opc], TCGOutOpBinary, base);
diff --git a/tcg/tci.c b/tcg/tci.c
index 68636e70da..cb300c4846 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -543,7 +543,7 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = regs[r1] | regs[r2];
             break;
-        CASE_32_64(xor)
+        case INDEX_op_xor:
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = regs[r1] ^ regs[r2];
             break;
@@ -1083,12 +1083,11 @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
     case INDEX_op_andc:
     case INDEX_op_or:
     case INDEX_op_orc:
+    case INDEX_op_xor:
     case INDEX_op_sub_i32:
     case INDEX_op_sub_i64:
     case INDEX_op_mul_i32:
     case INDEX_op_mul_i64:
-    case INDEX_op_xor_i32:
-    case INDEX_op_xor_i64:
     case INDEX_op_eqv_i32:
     case INDEX_op_eqv_i64:
     case INDEX_op_nand_i32:
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index 85caff300f..0a912744b3 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -687,7 +687,7 @@ static const TCGOutOpBinary outop_orc = {
 static void tgen_xor(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
-    tcg_out_op_rrr(s, glue(INDEX_op_xor_i,TCG_TARGET_REG_BITS), a0, a1, a2);
+    tcg_out_op_rrr(s, INDEX_op_xor, a0, a1, a2);
 }
 
 static const TCGOutOpBinary outop_xor = {

From 46c68d75063d2d1119d5907e24e64e068ff64ba4 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 15 Nov 2023 11:51:28 -0800
Subject: [PATCH 0379/2760] tcg/optimize: Fold eqv with immediate to xor
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 25 +++++++++++++++++++++++--
 1 file changed, 23 insertions(+), 2 deletions(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index 9303bb5b64..e18fe37ad2 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -1807,6 +1807,7 @@ static bool fold_dup2(OptContext *ctx, TCGOp *op)
 static bool fold_eqv(OptContext *ctx, TCGOp *op)
 {
     uint64_t s_mask;
+    TempOptInfo *t1, *t2;
 
     if (fold_const2_commutative(ctx, op) ||
         fold_xi_to_x(ctx, op, -1) ||
@@ -1814,8 +1815,28 @@ static bool fold_eqv(OptContext *ctx, TCGOp *op)
         return true;
     }
 
-    s_mask = arg_info(op->args[1])->s_mask
-           & arg_info(op->args[2])->s_mask;
+    t2 = arg_info(op->args[2]);
+    if (ti_is_const(t2)) {
+        /* Fold eqv r,x,i to xor r,x,~i. */
+        switch (ctx->type) {
+        case TCG_TYPE_I32:
+        case TCG_TYPE_I64:
+            op->opc = INDEX_op_xor;
+            break;
+        case TCG_TYPE_V64:
+        case TCG_TYPE_V128:
+        case TCG_TYPE_V256:
+            op->opc = INDEX_op_xor_vec;
+            break;
+        default:
+            g_assert_not_reached();
+        }
+        op->args[2] = arg_new_constant(ctx, ~ti_const_val(t2));
+        return fold_xor(ctx, op);
+    }
+
+    t1 = arg_info(op->args[1]);
+    s_mask = t1->s_mask & t2->s_mask;
     return fold_masks_s(ctx, op, s_mask);
 }
 

From 18bc92091641880121d43584093ff207b0c44cfb Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 6 Jan 2025 15:37:43 -0800
Subject: [PATCH 0380/2760] tcg: Convert eqv to TCGOutOpBinary
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target-has.h     |  2 --
 tcg/aarch64/tcg-target.c.inc     | 26 +++++++++------------
 tcg/arm/tcg-target-has.h         |  1 -
 tcg/arm/tcg-target.c.inc         |  4 ++++
 tcg/i386/tcg-target-has.h        |  2 --
 tcg/i386/tcg-target.c.inc        |  4 ++++
 tcg/loongarch64/tcg-target-has.h |  2 --
 tcg/loongarch64/tcg-target.c.inc |  4 ++++
 tcg/mips/tcg-target-has.h        |  2 --
 tcg/mips/tcg-target.c.inc        |  4 ++++
 tcg/ppc/tcg-target-has.h         |  2 --
 tcg/ppc/tcg-target.c.inc         | 22 +++++++++---------
 tcg/riscv/tcg-target-con-set.h   |  1 -
 tcg/riscv/tcg-target-con-str.h   |  1 -
 tcg/riscv/tcg-target-has.h       |  2 --
 tcg/riscv/tcg-target.c.inc       | 37 ++++++++++++------------------
 tcg/s390x/tcg-target-con-set.h   |  1 -
 tcg/s390x/tcg-target-has.h       |  2 --
 tcg/s390x/tcg-target.c.inc       | 39 +++++++++++++-------------------
 tcg/sparc64/tcg-target-has.h     |  2 --
 tcg/sparc64/tcg-target.c.inc     |  4 ++++
 tcg/tcg-has.h                    |  1 -
 tcg/tcg-op.c                     |  4 ++--
 tcg/tcg.c                        |  8 +++----
 tcg/tci.c                        |  2 --
 tcg/tci/tcg-target-has.h         |  2 --
 tcg/tci/tcg-target.c.inc         | 14 +++++++++---
 27 files changed, 89 insertions(+), 106 deletions(-)

diff --git a/tcg/aarch64/tcg-target-has.h b/tcg/aarch64/tcg-target-has.h
index 8469a9446f..c17aafc3bb 100644
--- a/tcg/aarch64/tcg-target-has.h
+++ b/tcg/aarch64/tcg-target-has.h
@@ -19,7 +19,6 @@
 #define TCG_TARGET_HAS_bswap32_i32      1
 #define TCG_TARGET_HAS_not_i32          1
 #define TCG_TARGET_HAS_rot_i32          1
-#define TCG_TARGET_HAS_eqv_i32          1
 #define TCG_TARGET_HAS_nand_i32         0
 #define TCG_TARGET_HAS_nor_i32          0
 #define TCG_TARGET_HAS_clz_i32          1
@@ -43,7 +42,6 @@
 #define TCG_TARGET_HAS_bswap64_i64      1
 #define TCG_TARGET_HAS_not_i64          1
 #define TCG_TARGET_HAS_rot_i64          1
-#define TCG_TARGET_HAS_eqv_i64          1
 #define TCG_TARGET_HAS_nand_i64         0
 #define TCG_TARGET_HAS_nor_i64          0
 #define TCG_TARGET_HAS_clz_i64          1
diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index d575635fe0..83813af63e 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -2157,6 +2157,17 @@ static const TCGOutOpBinary outop_andc = {
     .out_rrr = tgen_andc,
 };
 
+static void tgen_eqv(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_insn(s, 3510, EON, type, a0, a1, a2);
+}
+
+static const TCGOutOpBinary outop_eqv = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_eqv,
+};
+
 static void tgen_or(TCGContext *s, TCGType type,
                     TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -2285,17 +2296,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType ext,
         tcg_out_insn(s, 3502, SUB, ext, a0, TCG_REG_XZR, a1);
         break;
 
-    case INDEX_op_eqv_i32:
-        a2 = (int32_t)a2;
-        /* FALLTHRU */
-    case INDEX_op_eqv_i64:
-        if (c2) {
-            tcg_out_logicali(s, I3404_EORI, ext, a0, a1, ~a2);
-        } else {
-            tcg_out_insn(s, 3510, EON, ext, a0, a1, a2);
-        }
-        break;
-
     case INDEX_op_not_i64:
     case INDEX_op_not_i32:
         tcg_out_insn(s, 3510, ORN, ext, a0, TCG_REG_XZR, a1);
@@ -3030,10 +3030,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_mulsh_i64:
         return C_O1_I2(r, r, r);
 
-    case INDEX_op_eqv_i32:
-    case INDEX_op_eqv_i64:
-        return C_O1_I2(r, r, rL);
-
     case INDEX_op_shl_i32:
     case INDEX_op_shr_i32:
     case INDEX_op_sar_i32:
diff --git a/tcg/arm/tcg-target-has.h b/tcg/arm/tcg-target-has.h
index 39dcc87fe8..9ed85798e7 100644
--- a/tcg/arm/tcg-target-has.h
+++ b/tcg/arm/tcg-target-has.h
@@ -28,7 +28,6 @@ extern bool use_neon_instructions;
 #define TCG_TARGET_HAS_bswap32_i32      1
 #define TCG_TARGET_HAS_not_i32          1
 #define TCG_TARGET_HAS_rot_i32          1
-#define TCG_TARGET_HAS_eqv_i32          0
 #define TCG_TARGET_HAS_nand_i32         0
 #define TCG_TARGET_HAS_nor_i32          0
 #define TCG_TARGET_HAS_clz_i32          1
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index 98cb3cf5e2..57acb44c7a 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -1881,6 +1881,10 @@ static const TCGOutOpBinary outop_andc = {
     .out_rrr = tgen_andc,
 };
 
+static const TCGOutOpBinary outop_eqv = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static void tgen_or(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
diff --git a/tcg/i386/tcg-target-has.h b/tcg/i386/tcg-target-has.h
index e525f23c05..0183cafe61 100644
--- a/tcg/i386/tcg-target-has.h
+++ b/tcg/i386/tcg-target-has.h
@@ -31,7 +31,6 @@
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
 #define TCG_TARGET_HAS_not_i32          1
-#define TCG_TARGET_HAS_eqv_i32          0
 #define TCG_TARGET_HAS_nand_i32         0
 #define TCG_TARGET_HAS_nor_i32          0
 #define TCG_TARGET_HAS_clz_i32          1
@@ -55,7 +54,6 @@
 #define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1
 #define TCG_TARGET_HAS_not_i64          1
-#define TCG_TARGET_HAS_eqv_i64          0
 #define TCG_TARGET_HAS_nand_i64         0
 #define TCG_TARGET_HAS_nor_i64          0
 #define TCG_TARGET_HAS_clz_i64          1
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index 9126f9aeff..1fd53cb94f 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -2633,6 +2633,10 @@ static const TCGOutOpBinary outop_andc = {
     .out_rrr = tgen_andc,
 };
 
+static const TCGOutOpBinary outop_eqv = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static void tgen_or(TCGContext *s, TCGType type,
                     TCGReg a0, TCGReg a1, TCGReg a2)
 {
diff --git a/tcg/loongarch64/tcg-target-has.h b/tcg/loongarch64/tcg-target-has.h
index fb1142958c..d3697ee0f2 100644
--- a/tcg/loongarch64/tcg-target-has.h
+++ b/tcg/loongarch64/tcg-target-has.h
@@ -25,7 +25,6 @@
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
 #define TCG_TARGET_HAS_not_i32          1
-#define TCG_TARGET_HAS_eqv_i32          0
 #define TCG_TARGET_HAS_nand_i32         0
 #define TCG_TARGET_HAS_nor_i32          1
 #define TCG_TARGET_HAS_clz_i32          1
@@ -45,7 +44,6 @@
 #define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1
 #define TCG_TARGET_HAS_not_i64          1
-#define TCG_TARGET_HAS_eqv_i64          0
 #define TCG_TARGET_HAS_nand_i64         0
 #define TCG_TARGET_HAS_nor_i64          1
 #define TCG_TARGET_HAS_clz_i64          1
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index 296a84af79..6bd1826ef9 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -1328,6 +1328,10 @@ static const TCGOutOpBinary outop_andc = {
     .out_rrr = tgen_andc,
 };
 
+static const TCGOutOpBinary outop_eqv = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static void tgen_or(TCGContext *s, TCGType type,
                     TCGReg a0, TCGReg a1, TCGReg a2)
 {
diff --git a/tcg/mips/tcg-target-has.h b/tcg/mips/tcg-target-has.h
index b3dfa390f9..9745c64db1 100644
--- a/tcg/mips/tcg-target-has.h
+++ b/tcg/mips/tcg-target-has.h
@@ -43,7 +43,6 @@ extern bool use_mips32r2_instructions;
 #define TCG_TARGET_HAS_rem_i32          1
 #define TCG_TARGET_HAS_not_i32          1
 #define TCG_TARGET_HAS_nor_i32          1
-#define TCG_TARGET_HAS_eqv_i32          0
 #define TCG_TARGET_HAS_nand_i32         0
 #define TCG_TARGET_HAS_mulu2_i32        (!use_mips32r6_instructions)
 #define TCG_TARGET_HAS_muls2_i32        (!use_mips32r6_instructions)
@@ -61,7 +60,6 @@ extern bool use_mips32r2_instructions;
 #define TCG_TARGET_HAS_rem_i64          1
 #define TCG_TARGET_HAS_not_i64          1
 #define TCG_TARGET_HAS_nor_i64          1
-#define TCG_TARGET_HAS_eqv_i64          0
 #define TCG_TARGET_HAS_nand_i64         0
 #define TCG_TARGET_HAS_add2_i64         0
 #define TCG_TARGET_HAS_sub2_i64         0
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index 30fb01cb0a..3a3c72cb11 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -1712,6 +1712,10 @@ static const TCGOutOpBinary outop_andc = {
     .base.static_constraint = C_NotImplemented,
 };
 
+static const TCGOutOpBinary outop_eqv = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static void tgen_or(TCGContext *s, TCGType type,
                     TCGReg a0, TCGReg a1, TCGReg a2)
 {
diff --git a/tcg/ppc/tcg-target-has.h b/tcg/ppc/tcg-target-has.h
index 6f3ab41ebb..8ede19bfad 100644
--- a/tcg/ppc/tcg-target-has.h
+++ b/tcg/ppc/tcg-target-has.h
@@ -23,7 +23,6 @@
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
 #define TCG_TARGET_HAS_not_i32          1
-#define TCG_TARGET_HAS_eqv_i32          1
 #define TCG_TARGET_HAS_nand_i32         1
 #define TCG_TARGET_HAS_nor_i32          1
 #define TCG_TARGET_HAS_clz_i32          1
@@ -48,7 +47,6 @@
 #define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1
 #define TCG_TARGET_HAS_not_i64          1
-#define TCG_TARGET_HAS_eqv_i64          1
 #define TCG_TARGET_HAS_nand_i64         1
 #define TCG_TARGET_HAS_nor_i64          1
 #define TCG_TARGET_HAS_clz_i64          1
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index 16d3dbd841..203f089cd7 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -2954,6 +2954,17 @@ static const TCGOutOpBinary outop_andc = {
     .out_rrr = tgen_andc,
 };
 
+static void tgen_eqv(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out32(s, EQV | SAB(a1, a0, a2));
+}
+
+static const TCGOutOpBinary outop_eqv = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_eqv,
+};
+
 static void tgen_or(TCGContext *s, TCGType type,
                     TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -3086,15 +3097,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    case INDEX_op_eqv_i32:
-        if (const_args[2]) {
-            tcg_out_xori32(s, args[0], args[1], ~args[2]);
-            break;
-        }
-        /* FALLTHRU */
-    case INDEX_op_eqv_i64:
-        tcg_out32(s, EQV | SAB(args[1], args[0], args[2]));
-        break;
     case INDEX_op_nand_i32:
     case INDEX_op_nand_i64:
         tcg_out32(s, NAND | SAB(args[1], args[0], args[2]));
@@ -4150,7 +4152,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(r, r);
 
-    case INDEX_op_eqv_i32:
     case INDEX_op_shl_i32:
     case INDEX_op_shr_i32:
     case INDEX_op_sar_i32:
@@ -4175,7 +4176,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_nor_i32:
     case INDEX_op_muluh_i32:
     case INDEX_op_mulsh_i32:
-    case INDEX_op_eqv_i64:
     case INDEX_op_nand_i64:
     case INDEX_op_nor_i64:
     case INDEX_op_div_i64:
diff --git a/tcg/riscv/tcg-target-con-set.h b/tcg/riscv/tcg-target-con-set.h
index f1f5d415f7..21f8833b3b 100644
--- a/tcg/riscv/tcg-target-con-set.h
+++ b/tcg/riscv/tcg-target-con-set.h
@@ -16,7 +16,6 @@ C_O1_I1(r, r)
 C_O1_I2(r, r, r)
 C_O1_I2(r, r, ri)
 C_O1_I2(r, r, rI)
-C_O1_I2(r, r, rJ)
 C_O1_I2(r, rz, rN)
 C_O1_I2(r, rz, rz)
 C_N1_I2(r, r, rM)
diff --git a/tcg/riscv/tcg-target-con-str.h b/tcg/riscv/tcg-target-con-str.h
index 2f9700638c..1956f75f9a 100644
--- a/tcg/riscv/tcg-target-con-str.h
+++ b/tcg/riscv/tcg-target-con-str.h
@@ -16,7 +16,6 @@ REGS('v', ALL_VECTOR_REGS)
  * CONST(letter, TCG_CT_CONST_* bit set)
  */
 CONST('I', TCG_CT_CONST_S12)
-CONST('J', TCG_CT_CONST_J12)
 CONST('K', TCG_CT_CONST_S5)
 CONST('L', TCG_CT_CONST_CMP_VI)
 CONST('N', TCG_CT_CONST_N12)
diff --git a/tcg/riscv/tcg-target-has.h b/tcg/riscv/tcg-target-has.h
index 7b8f4386c9..2faa2895e3 100644
--- a/tcg/riscv/tcg-target-has.h
+++ b/tcg/riscv/tcg-target-has.h
@@ -25,7 +25,6 @@
 #define TCG_TARGET_HAS_bswap16_i32      (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_bswap32_i32      (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_not_i32          1
-#define TCG_TARGET_HAS_eqv_i32          (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_nand_i32         0
 #define TCG_TARGET_HAS_nor_i32          0
 #define TCG_TARGET_HAS_clz_i32          (cpuinfo & CPUINFO_ZBB)
@@ -44,7 +43,6 @@
 #define TCG_TARGET_HAS_bswap32_i64      (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_bswap64_i64      (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_not_i64          1
-#define TCG_TARGET_HAS_eqv_i64          (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_nand_i64         0
 #define TCG_TARGET_HAS_nor_i64          0
 #define TCG_TARGET_HAS_clz_i64          (cpuinfo & CPUINFO_ZBB)
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index c981ea389a..ff2a412821 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -115,9 +115,8 @@ static TCGReg tcg_target_call_oarg_reg(TCGCallReturnKind kind, int slot)
 #define TCG_CT_CONST_S12     0x100
 #define TCG_CT_CONST_N12     0x200
 #define TCG_CT_CONST_M12     0x400
-#define TCG_CT_CONST_J12     0x800
-#define TCG_CT_CONST_S5     0x1000
-#define TCG_CT_CONST_CMP_VI 0x2000
+#define TCG_CT_CONST_S5      0x800
+#define TCG_CT_CONST_CMP_VI 0x1000
 
 #define ALL_GENERAL_REGS   MAKE_64BIT_MASK(0, 32)
 #define ALL_VECTOR_REGS    MAKE_64BIT_MASK(32, 32)
@@ -416,13 +415,6 @@ static bool tcg_target_const_match(int64_t val, int ct,
     if ((ct & TCG_CT_CONST_M12) && val >= -0x7ff && val <= 0x7ff) {
         return 1;
     }
-    /*
-     * Inverse of sign extended from 12 bits: ~[-0x800, 0x7ff].
-     * Used to map ANDN back to ANDI, etc.
-     */
-    if ((ct & TCG_CT_CONST_J12) && ~val >= -0x800 && ~val <= 0x7ff) {
-        return 1;
-    }
     /*
      * Sign extended from 5 bits: [-0x10, 0x0f].
      * Used for vector-immediate.
@@ -2013,6 +2005,18 @@ static const TCGOutOpBinary outop_andc = {
     .out_rrr = tgen_andc,
 };
 
+static void tgen_eqv(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_opc_reg(s, OPC_XNOR, a0, a1, a2);
+}
+
+static const TCGOutOpBinary outop_eqv = {
+    .base.static_constraint = C_Dynamic,
+    .base.dynamic_constraint = cset_zbb_rrr,
+    .out_rrr = tgen_eqv,
+};
+
 static void tgen_or(TCGContext *s, TCGType type,
                     TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -2139,15 +2143,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    case INDEX_op_eqv_i32:
-    case INDEX_op_eqv_i64:
-        if (c2) {
-            tcg_out_opc_imm(s, OPC_XORI, a0, a1, ~a2);
-        } else {
-            tcg_out_opc_reg(s, OPC_XNOR, a0, a1, a2);
-        }
-        break;
-
     case INDEX_op_not_i32:
     case INDEX_op_not_i64:
         tcg_out_opc_imm(s, OPC_XORI, a0, a1, -1);
@@ -2710,10 +2705,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_negsetcond_i64:
         return C_O1_I2(r, r, rI);
 
-    case INDEX_op_eqv_i32:
-    case INDEX_op_eqv_i64:
-        return C_O1_I2(r, r, rJ);
-
     case INDEX_op_sub_i32:
     case INDEX_op_sub_i64:
         return C_O1_I2(r, rz, rN);
diff --git a/tcg/s390x/tcg-target-con-set.h b/tcg/s390x/tcg-target-con-set.h
index 39903a60ad..86af067965 100644
--- a/tcg/s390x/tcg-target-con-set.h
+++ b/tcg/s390x/tcg-target-con-set.h
@@ -31,7 +31,6 @@ C_O1_I2(r, r, rC)
 C_O1_I2(r, r, rI)
 C_O1_I2(r, r, rJ)
 C_O1_I2(r, r, rK)
-C_O1_I2(r, r, rNK)
 C_O1_I2(r, r, rNKR)
 C_O1_I2(r, rZ, r)
 C_O1_I2(v, v, r)
diff --git a/tcg/s390x/tcg-target-has.h b/tcg/s390x/tcg-target-has.h
index 850c16a164..722a2ede1c 100644
--- a/tcg/s390x/tcg-target-has.h
+++ b/tcg/s390x/tcg-target-has.h
@@ -34,7 +34,6 @@ extern uint64_t s390_facilities[3];
 #define TCG_TARGET_HAS_bswap16_i32    1
 #define TCG_TARGET_HAS_bswap32_i32    1
 #define TCG_TARGET_HAS_not_i32        HAVE_FACILITY(MISC_INSN_EXT3)
-#define TCG_TARGET_HAS_eqv_i32        HAVE_FACILITY(MISC_INSN_EXT3)
 #define TCG_TARGET_HAS_nand_i32       HAVE_FACILITY(MISC_INSN_EXT3)
 #define TCG_TARGET_HAS_nor_i32        HAVE_FACILITY(MISC_INSN_EXT3)
 #define TCG_TARGET_HAS_clz_i32        0
@@ -57,7 +56,6 @@ extern uint64_t s390_facilities[3];
 #define TCG_TARGET_HAS_bswap32_i64    1
 #define TCG_TARGET_HAS_bswap64_i64    1
 #define TCG_TARGET_HAS_not_i64        HAVE_FACILITY(MISC_INSN_EXT3)
-#define TCG_TARGET_HAS_eqv_i64        HAVE_FACILITY(MISC_INSN_EXT3)
 #define TCG_TARGET_HAS_nand_i64       HAVE_FACILITY(MISC_INSN_EXT3)
 #define TCG_TARGET_HAS_nor_i64        HAVE_FACILITY(MISC_INSN_EXT3)
 #define TCG_TARGET_HAS_clz_i64        1
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index bedad7137b..6c32aa286d 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -2242,6 +2242,22 @@ static const TCGOutOpBinary outop_andc = {
     .out_rrr = tgen_andc,
 };
 
+static void tgen_eqv(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    if (type == TCG_TYPE_I32) {
+        tcg_out_insn(s, RRFa, NXRK, a0, a1, a2);
+    } else {
+        tcg_out_insn(s, RRFa, NXGRK, a0, a1, a2);
+    }
+}
+
+static const TCGOutOpBinary outop_eqv = {
+    .base.static_constraint = C_Dynamic,
+    .base.dynamic_constraint = cset_misc3_rrr,
+    .out_rrr = tgen_eqv,
+};
+
 static void tgen_or(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -2376,15 +2392,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    case INDEX_op_eqv_i32:
-        a0 = args[0], a1 = args[1], a2 = (uint32_t)args[2];
-        if (const_args[2]) {
-            tcg_out_mov(s, TCG_TYPE_I32, a0, a1);
-            tcg_out_insn(s, RIL, XILF, a0, ~a2);
-        } else {
-            tcg_out_insn(s, RRFa, NXRK, a0, a1, a2);
-        }
-        break;
     case INDEX_op_nand_i32:
         tcg_out_insn(s, RRFa, NNRK, args[0], args[1], args[2]);
         break;
@@ -2595,15 +2602,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    case INDEX_op_eqv_i64:
-        a0 = args[0], a1 = args[1], a2 = args[2];
-        if (const_args[2]) {
-            tcg_out_mov(s, TCG_TYPE_I64, a0, a1);
-            tgen_xori(s, a0, ~a2);
-        } else {
-            tcg_out_insn(s, RRFa, NXGRK, a0, a1, a2);
-        }
-        break;
     case INDEX_op_nand_i64:
         tcg_out_insn(s, RRFa, NNGRK, args[0], args[1], args[2]);
         break;
@@ -3290,11 +3288,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_sub_i64:
         return C_O1_I2(r, r, ri);
 
-    case INDEX_op_eqv_i32:
-        return C_O1_I2(r, r, ri);
-    case INDEX_op_eqv_i64:
-        return C_O1_I2(r, r, rNK);
-
     case INDEX_op_nand_i32:
     case INDEX_op_nand_i64:
     case INDEX_op_nor_i32:
diff --git a/tcg/sparc64/tcg-target-has.h b/tcg/sparc64/tcg-target-has.h
index 8e20e4cdeb..2ec5f5657c 100644
--- a/tcg/sparc64/tcg-target-has.h
+++ b/tcg/sparc64/tcg-target-has.h
@@ -20,7 +20,6 @@ extern bool use_vis3_instructions;
 #define TCG_TARGET_HAS_bswap16_i32      0
 #define TCG_TARGET_HAS_bswap32_i32      0
 #define TCG_TARGET_HAS_not_i32          1
-#define TCG_TARGET_HAS_eqv_i32          0
 #define TCG_TARGET_HAS_nand_i32         0
 #define TCG_TARGET_HAS_nor_i32          0
 #define TCG_TARGET_HAS_clz_i32          0
@@ -44,7 +43,6 @@ extern bool use_vis3_instructions;
 #define TCG_TARGET_HAS_bswap32_i64      0
 #define TCG_TARGET_HAS_bswap64_i64      0
 #define TCG_TARGET_HAS_not_i64          1
-#define TCG_TARGET_HAS_eqv_i64          0
 #define TCG_TARGET_HAS_nand_i64         0
 #define TCG_TARGET_HAS_nor_i64          0
 #define TCG_TARGET_HAS_clz_i64          0
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index 8a6c9852d2..6d7ee19db1 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -1333,6 +1333,10 @@ static const TCGOutOpBinary outop_andc = {
     .out_rrr = tgen_andc,
 };
 
+static const TCGOutOpBinary outop_eqv = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static void tgen_or(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
diff --git a/tcg/tcg-has.h b/tcg/tcg-has.h
index df9c951262..a5808dcc0a 100644
--- a/tcg/tcg-has.h
+++ b/tcg/tcg-has.h
@@ -20,7 +20,6 @@
 #define TCG_TARGET_HAS_bswap32_i64      0
 #define TCG_TARGET_HAS_bswap64_i64      0
 #define TCG_TARGET_HAS_not_i64          0
-#define TCG_TARGET_HAS_eqv_i64          0
 #define TCG_TARGET_HAS_nand_i64         0
 #define TCG_TARGET_HAS_nor_i64          0
 #define TCG_TARGET_HAS_clz_i64          0
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index b10f61435c..8008b0d3e0 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -680,7 +680,7 @@ void tcg_gen_andc_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 
 void tcg_gen_eqv_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 {
-    if (TCG_TARGET_HAS_eqv_i32) {
+    if (tcg_op_supported(INDEX_op_eqv_i32, TCG_TYPE_I32, 0)) {
         tcg_gen_op3_i32(INDEX_op_eqv_i32, ret, arg1, arg2);
     } else {
         tcg_gen_xor_i32(ret, arg1, arg2);
@@ -2279,7 +2279,7 @@ void tcg_gen_eqv_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
     if (TCG_TARGET_REG_BITS == 32) {
         tcg_gen_eqv_i32(TCGV_LOW(ret), TCGV_LOW(arg1), TCGV_LOW(arg2));
         tcg_gen_eqv_i32(TCGV_HIGH(ret), TCGV_HIGH(arg1), TCGV_HIGH(arg2));
-    } else if (TCG_TARGET_HAS_eqv_i64) {
+    } else if (tcg_op_supported(INDEX_op_eqv_i64, TCG_TYPE_I64, 0)) {
         tcg_gen_op3_i64(INDEX_op_eqv_i64, ret, arg1, arg2);
     } else {
         tcg_gen_xor_i64(ret, arg1, arg2);
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 3c4905aa68..53158a292b 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1007,6 +1007,8 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_add, TCGOutOpBinary, outop_add),
     OUTOP(INDEX_op_and, TCGOutOpBinary, outop_and),
     OUTOP(INDEX_op_andc, TCGOutOpBinary, outop_andc),
+    OUTOP(INDEX_op_eqv_i32, TCGOutOpBinary, outop_eqv),
+    OUTOP(INDEX_op_eqv_i64, TCGOutOpBinary, outop_eqv),
     OUTOP(INDEX_op_or, TCGOutOpBinary, outop_or),
     OUTOP(INDEX_op_orc, TCGOutOpBinary, outop_orc),
     OUTOP(INDEX_op_xor, TCGOutOpBinary, outop_xor),
@@ -2273,8 +2275,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
         return TCG_TARGET_HAS_bswap32_i32;
     case INDEX_op_not_i32:
         return TCG_TARGET_HAS_not_i32;
-    case INDEX_op_eqv_i32:
-        return TCG_TARGET_HAS_eqv_i32;
     case INDEX_op_nand_i32:
         return TCG_TARGET_HAS_nand_i32;
     case INDEX_op_nor_i32:
@@ -2344,8 +2344,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
         return TCG_TARGET_HAS_bswap64_i64;
     case INDEX_op_not_i64:
         return TCG_TARGET_HAS_not_i64;
-    case INDEX_op_eqv_i64:
-        return TCG_TARGET_HAS_eqv_i64;
     case INDEX_op_nand_i64:
         return TCG_TARGET_HAS_nand_i64;
     case INDEX_op_nor_i64:
@@ -5438,6 +5436,8 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
     case INDEX_op_add:
     case INDEX_op_and:
     case INDEX_op_andc:
+    case INDEX_op_eqv_i32:
+    case INDEX_op_eqv_i64:
     case INDEX_op_or:
     case INDEX_op_orc:
     case INDEX_op_xor:
diff --git a/tcg/tci.c b/tcg/tci.c
index cb300c4846..26a271e71f 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -555,12 +555,10 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = regs[r1] | ~regs[r2];
             break;
-#if TCG_TARGET_HAS_eqv_i32 || TCG_TARGET_HAS_eqv_i64
         CASE_32_64(eqv)
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = ~(regs[r1] ^ regs[r2]);
             break;
-#endif
 #if TCG_TARGET_HAS_nand_i32 || TCG_TARGET_HAS_nand_i64
         CASE_32_64(nand)
             tci_args_rrr(insn, &r0, &r1, &r2);
diff --git a/tcg/tci/tcg-target-has.h b/tcg/tci/tcg-target-has.h
index d247774e52..2c0876a0fd 100644
--- a/tcg/tci/tcg-target-has.h
+++ b/tcg/tci/tcg-target-has.h
@@ -12,7 +12,6 @@
 #define TCG_TARGET_HAS_div_i32          1
 #define TCG_TARGET_HAS_rem_i32          1
 #define TCG_TARGET_HAS_extract2_i32     0
-#define TCG_TARGET_HAS_eqv_i32          1
 #define TCG_TARGET_HAS_nand_i32         1
 #define TCG_TARGET_HAS_nor_i32          1
 #define TCG_TARGET_HAS_clz_i32          1
@@ -34,7 +33,6 @@
 #define TCG_TARGET_HAS_extract2_i64     0
 #define TCG_TARGET_HAS_div_i64          1
 #define TCG_TARGET_HAS_rem_i64          1
-#define TCG_TARGET_HAS_eqv_i64          1
 #define TCG_TARGET_HAS_nand_i64         1
 #define TCG_TARGET_HAS_nor_i64          1
 #define TCG_TARGET_HAS_clz_i64          1
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index 0a912744b3..4c9e055614 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -95,8 +95,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_sub_i64:
     case INDEX_op_mul_i32:
     case INDEX_op_mul_i64:
-    case INDEX_op_eqv_i32:
-    case INDEX_op_eqv_i64:
     case INDEX_op_nand_i32:
     case INDEX_op_nand_i64:
     case INDEX_op_nor_i32:
@@ -662,6 +660,17 @@ static const TCGOutOpBinary outop_andc = {
     .out_rrr = tgen_andc,
 };
 
+static void tgen_eqv(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_op_rrr(s, glue(INDEX_op_eqv_i,TCG_TARGET_REG_BITS), a0, a1, a2);
+}
+
+static const TCGOutOpBinary outop_eqv = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_eqv,
+};
+
 static void tgen_or(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -739,7 +748,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
 
     CASE_32_64(sub)
     CASE_32_64(mul)
-    CASE_32_64(eqv)      /* Optional (TCG_TARGET_HAS_eqv_*). */
     CASE_32_64(nand)     /* Optional (TCG_TARGET_HAS_nand_*). */
     CASE_32_64(nor)      /* Optional (TCG_TARGET_HAS_nor_*). */
     CASE_32_64(shl)

From 5c0968a7e1da73f91f148d563a29af529427c5a5 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 6 Jan 2025 15:47:53 -0800
Subject: [PATCH 0381/2760] tcg: Merge INDEX_op_eqv_{i32,i64}
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 docs/devel/tcg-ops.rst   | 2 +-
 include/tcg/tcg-opc.h    | 3 +--
 tcg/optimize.c           | 6 ++++--
 tcg/tcg-op.c             | 8 ++++----
 tcg/tcg.c                | 6 ++----
 tcg/tci.c                | 5 ++---
 tcg/tci/tcg-target.c.inc | 2 +-
 7 files changed, 15 insertions(+), 17 deletions(-)

diff --git a/docs/devel/tcg-ops.rst b/docs/devel/tcg-ops.rst
index a4aa4f8824..fe149e012d 100644
--- a/docs/devel/tcg-ops.rst
+++ b/docs/devel/tcg-ops.rst
@@ -323,7 +323,7 @@ Logical
 
      - | *t0* = *t1* & ~\ *t2*
 
-   * - eqv_i32/i64 *t0*, *t1*, *t2*
+   * - eqv *t0*, *t1*, *t2*
 
      - | *t0* = ~(*t1* ^ *t2*), or equivalently, *t0* = *t1* ^ ~\ *t2*
 
diff --git a/include/tcg/tcg-opc.h b/include/tcg/tcg-opc.h
index 8f6115bedb..c6869de244 100644
--- a/include/tcg/tcg-opc.h
+++ b/include/tcg/tcg-opc.h
@@ -42,6 +42,7 @@ DEF(mov, 1, 1, 0, TCG_OPF_INT | TCG_OPF_NOT_PRESENT)
 DEF(add, 1, 2, 0, TCG_OPF_INT)
 DEF(and, 1, 2, 0, TCG_OPF_INT)
 DEF(andc, 1, 2, 0, TCG_OPF_INT)
+DEF(eqv, 1, 2, 0, TCG_OPF_INT)
 DEF(or, 1, 2, 0, TCG_OPF_INT)
 DEF(orc, 1, 2, 0, TCG_OPF_INT)
 DEF(xor, 1, 2, 0, TCG_OPF_INT)
@@ -93,7 +94,6 @@ DEF(bswap16_i32, 1, 1, 1, 0)
 DEF(bswap32_i32, 1, 1, 1, 0)
 DEF(not_i32, 1, 1, 0, 0)
 DEF(neg_i32, 1, 1, 0, 0)
-DEF(eqv_i32, 1, 2, 0, 0)
 DEF(nand_i32, 1, 2, 0, 0)
 DEF(nor_i32, 1, 2, 0, 0)
 DEF(clz_i32, 1, 2, 0, 0)
@@ -147,7 +147,6 @@ DEF(bswap32_i64, 1, 1, 1, 0)
 DEF(bswap64_i64, 1, 1, 1, 0)
 DEF(not_i64, 1, 1, 0, 0)
 DEF(neg_i64, 1, 1, 0, 0)
-DEF(eqv_i64, 1, 2, 0, 0)
 DEF(nand_i64, 1, 2, 0, 0)
 DEF(nor_i64, 1, 2, 0, 0)
 DEF(clz_i64, 1, 2, 0, 0)
diff --git a/tcg/optimize.c b/tcg/optimize.c
index e18fe37ad2..47898b7086 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -489,7 +489,8 @@ static uint64_t do_constant_folding_2(TCGOpcode op, uint64_t x, uint64_t y)
     case INDEX_op_orc_vec:
         return x | ~y;
 
-    CASE_OP_32_64_VEC(eqv):
+    case INDEX_op_eqv:
+    case INDEX_op_eqv_vec:
         return ~(x ^ y);
 
     CASE_OP_32_64_VEC(nand):
@@ -2929,7 +2930,8 @@ void tcg_optimize(TCGContext *s)
         case INDEX_op_dup2_vec:
             done = fold_dup2(&ctx, op);
             break;
-        CASE_OP_32_64_VEC(eqv):
+        case INDEX_op_eqv:
+        case INDEX_op_eqv_vec:
             done = fold_eqv(&ctx, op);
             break;
         CASE_OP_32_64(extract):
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index 8008b0d3e0..2520a60cee 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -680,8 +680,8 @@ void tcg_gen_andc_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 
 void tcg_gen_eqv_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 {
-    if (tcg_op_supported(INDEX_op_eqv_i32, TCG_TYPE_I32, 0)) {
-        tcg_gen_op3_i32(INDEX_op_eqv_i32, ret, arg1, arg2);
+    if (tcg_op_supported(INDEX_op_eqv, TCG_TYPE_I32, 0)) {
+        tcg_gen_op3_i32(INDEX_op_eqv, ret, arg1, arg2);
     } else {
         tcg_gen_xor_i32(ret, arg1, arg2);
         tcg_gen_not_i32(ret, ret);
@@ -2279,8 +2279,8 @@ void tcg_gen_eqv_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
     if (TCG_TARGET_REG_BITS == 32) {
         tcg_gen_eqv_i32(TCGV_LOW(ret), TCGV_LOW(arg1), TCGV_LOW(arg2));
         tcg_gen_eqv_i32(TCGV_HIGH(ret), TCGV_HIGH(arg1), TCGV_HIGH(arg2));
-    } else if (tcg_op_supported(INDEX_op_eqv_i64, TCG_TYPE_I64, 0)) {
-        tcg_gen_op3_i64(INDEX_op_eqv_i64, ret, arg1, arg2);
+    } else if (tcg_op_supported(INDEX_op_eqv, TCG_TYPE_I64, 0)) {
+        tcg_gen_op3_i64(INDEX_op_eqv, ret, arg1, arg2);
     } else {
         tcg_gen_xor_i64(ret, arg1, arg2);
         tcg_gen_not_i64(ret, ret);
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 53158a292b..6642429df6 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1007,8 +1007,7 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_add, TCGOutOpBinary, outop_add),
     OUTOP(INDEX_op_and, TCGOutOpBinary, outop_and),
     OUTOP(INDEX_op_andc, TCGOutOpBinary, outop_andc),
-    OUTOP(INDEX_op_eqv_i32, TCGOutOpBinary, outop_eqv),
-    OUTOP(INDEX_op_eqv_i64, TCGOutOpBinary, outop_eqv),
+    OUTOP(INDEX_op_eqv, TCGOutOpBinary, outop_eqv),
     OUTOP(INDEX_op_or, TCGOutOpBinary, outop_or),
     OUTOP(INDEX_op_orc, TCGOutOpBinary, outop_orc),
     OUTOP(INDEX_op_xor, TCGOutOpBinary, outop_xor),
@@ -5436,8 +5435,7 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
     case INDEX_op_add:
     case INDEX_op_and:
     case INDEX_op_andc:
-    case INDEX_op_eqv_i32:
-    case INDEX_op_eqv_i64:
+    case INDEX_op_eqv:
     case INDEX_op_or:
     case INDEX_op_orc:
     case INDEX_op_xor:
diff --git a/tcg/tci.c b/tcg/tci.c
index 26a271e71f..d2baa8d3fc 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -555,7 +555,7 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = regs[r1] | ~regs[r2];
             break;
-        CASE_32_64(eqv)
+        case INDEX_op_eqv:
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = ~(regs[r1] ^ regs[r2]);
             break;
@@ -1079,6 +1079,7 @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
     case INDEX_op_add:
     case INDEX_op_and:
     case INDEX_op_andc:
+    case INDEX_op_eqv:
     case INDEX_op_or:
     case INDEX_op_orc:
     case INDEX_op_xor:
@@ -1086,8 +1087,6 @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
     case INDEX_op_sub_i64:
     case INDEX_op_mul_i32:
     case INDEX_op_mul_i64:
-    case INDEX_op_eqv_i32:
-    case INDEX_op_eqv_i64:
     case INDEX_op_nand_i32:
     case INDEX_op_nand_i64:
     case INDEX_op_nor_i32:
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index 4c9e055614..fe3450373e 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -663,7 +663,7 @@ static const TCGOutOpBinary outop_andc = {
 static void tgen_eqv(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
-    tcg_out_op_rrr(s, glue(INDEX_op_eqv_i,TCG_TARGET_REG_BITS), a0, a1, a2);
+    tcg_out_op_rrr(s, INDEX_op_eqv, a0, a1, a2);
 }
 
 static const TCGOutOpBinary outop_eqv = {

From e5a3162cb6c1aec4f47c6b51671e989b5975f345 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 6 Jan 2025 16:18:19 -0800
Subject: [PATCH 0382/2760] tcg: Convert nand to TCGOutOpBinary
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target-has.h     |  2 --
 tcg/aarch64/tcg-target.c.inc     |  4 ++++
 tcg/arm/tcg-target-has.h         |  1 -
 tcg/arm/tcg-target.c.inc         |  4 ++++
 tcg/i386/tcg-target-has.h        |  2 --
 tcg/i386/tcg-target.c.inc        |  4 ++++
 tcg/loongarch64/tcg-target-has.h |  2 --
 tcg/loongarch64/tcg-target.c.inc |  4 ++++
 tcg/mips/tcg-target-has.h        |  2 --
 tcg/mips/tcg-target.c.inc        |  4 ++++
 tcg/ppc/tcg-target-has.h         |  2 --
 tcg/ppc/tcg-target.c.inc         | 17 +++++++++++------
 tcg/riscv/tcg-target-has.h       |  2 --
 tcg/riscv/tcg-target.c.inc       |  4 ++++
 tcg/s390x/tcg-target-has.h       |  2 --
 tcg/s390x/tcg-target.c.inc       | 24 ++++++++++++++++--------
 tcg/sparc64/tcg-target-has.h     |  2 --
 tcg/sparc64/tcg-target.c.inc     |  4 ++++
 tcg/tcg-has.h                    |  1 -
 tcg/tcg-op.c                     |  4 ++--
 tcg/tcg.c                        |  8 ++++----
 tcg/tci.c                        |  2 --
 tcg/tci/tcg-target-has.h         |  2 --
 tcg/tci/tcg-target.c.inc         | 14 +++++++++++---
 24 files changed, 72 insertions(+), 45 deletions(-)

diff --git a/tcg/aarch64/tcg-target-has.h b/tcg/aarch64/tcg-target-has.h
index c17aafc3bb..2acc9bd3b7 100644
--- a/tcg/aarch64/tcg-target-has.h
+++ b/tcg/aarch64/tcg-target-has.h
@@ -19,7 +19,6 @@
 #define TCG_TARGET_HAS_bswap32_i32      1
 #define TCG_TARGET_HAS_not_i32          1
 #define TCG_TARGET_HAS_rot_i32          1
-#define TCG_TARGET_HAS_nand_i32         0
 #define TCG_TARGET_HAS_nor_i32          0
 #define TCG_TARGET_HAS_clz_i32          1
 #define TCG_TARGET_HAS_ctz_i32          1
@@ -42,7 +41,6 @@
 #define TCG_TARGET_HAS_bswap64_i64      1
 #define TCG_TARGET_HAS_not_i64          1
 #define TCG_TARGET_HAS_rot_i64          1
-#define TCG_TARGET_HAS_nand_i64         0
 #define TCG_TARGET_HAS_nor_i64          0
 #define TCG_TARGET_HAS_clz_i64          1
 #define TCG_TARGET_HAS_ctz_i64          1
diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index 83813af63e..093bb0afb7 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -2168,6 +2168,10 @@ static const TCGOutOpBinary outop_eqv = {
     .out_rrr = tgen_eqv,
 };
 
+static const TCGOutOpBinary outop_nand = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static void tgen_or(TCGContext *s, TCGType type,
                     TCGReg a0, TCGReg a1, TCGReg a2)
 {
diff --git a/tcg/arm/tcg-target-has.h b/tcg/arm/tcg-target-has.h
index 9ed85798e7..8d7b176993 100644
--- a/tcg/arm/tcg-target-has.h
+++ b/tcg/arm/tcg-target-has.h
@@ -28,7 +28,6 @@ extern bool use_neon_instructions;
 #define TCG_TARGET_HAS_bswap32_i32      1
 #define TCG_TARGET_HAS_not_i32          1
 #define TCG_TARGET_HAS_rot_i32          1
-#define TCG_TARGET_HAS_nand_i32         0
 #define TCG_TARGET_HAS_nor_i32          0
 #define TCG_TARGET_HAS_clz_i32          1
 #define TCG_TARGET_HAS_ctz_i32          use_armv7_instructions
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index 57acb44c7a..55d28be15b 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -1885,6 +1885,10 @@ static const TCGOutOpBinary outop_eqv = {
     .base.static_constraint = C_NotImplemented,
 };
 
+static const TCGOutOpBinary outop_nand = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static void tgen_or(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
diff --git a/tcg/i386/tcg-target-has.h b/tcg/i386/tcg-target-has.h
index 0183cafe61..93552f2337 100644
--- a/tcg/i386/tcg-target-has.h
+++ b/tcg/i386/tcg-target-has.h
@@ -31,7 +31,6 @@
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
 #define TCG_TARGET_HAS_not_i32          1
-#define TCG_TARGET_HAS_nand_i32         0
 #define TCG_TARGET_HAS_nor_i32          0
 #define TCG_TARGET_HAS_clz_i32          1
 #define TCG_TARGET_HAS_ctz_i32          1
@@ -54,7 +53,6 @@
 #define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1
 #define TCG_TARGET_HAS_not_i64          1
-#define TCG_TARGET_HAS_nand_i64         0
 #define TCG_TARGET_HAS_nor_i64          0
 #define TCG_TARGET_HAS_clz_i64          1
 #define TCG_TARGET_HAS_ctz_i64          1
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index 1fd53cb94f..51c3711ee5 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -2637,6 +2637,10 @@ static const TCGOutOpBinary outop_eqv = {
     .base.static_constraint = C_NotImplemented,
 };
 
+static const TCGOutOpBinary outop_nand = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static void tgen_or(TCGContext *s, TCGType type,
                     TCGReg a0, TCGReg a1, TCGReg a2)
 {
diff --git a/tcg/loongarch64/tcg-target-has.h b/tcg/loongarch64/tcg-target-has.h
index d3697ee0f2..55249de465 100644
--- a/tcg/loongarch64/tcg-target-has.h
+++ b/tcg/loongarch64/tcg-target-has.h
@@ -25,7 +25,6 @@
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
 #define TCG_TARGET_HAS_not_i32          1
-#define TCG_TARGET_HAS_nand_i32         0
 #define TCG_TARGET_HAS_nor_i32          1
 #define TCG_TARGET_HAS_clz_i32          1
 #define TCG_TARGET_HAS_ctz_i32          1
@@ -44,7 +43,6 @@
 #define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1
 #define TCG_TARGET_HAS_not_i64          1
-#define TCG_TARGET_HAS_nand_i64         0
 #define TCG_TARGET_HAS_nor_i64          1
 #define TCG_TARGET_HAS_clz_i64          1
 #define TCG_TARGET_HAS_ctz_i64          1
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index 6bd1826ef9..814596608a 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -1332,6 +1332,10 @@ static const TCGOutOpBinary outop_eqv = {
     .base.static_constraint = C_NotImplemented,
 };
 
+static const TCGOutOpBinary outop_nand = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static void tgen_or(TCGContext *s, TCGType type,
                     TCGReg a0, TCGReg a1, TCGReg a2)
 {
diff --git a/tcg/mips/tcg-target-has.h b/tcg/mips/tcg-target-has.h
index 9745c64db1..2f8325d56f 100644
--- a/tcg/mips/tcg-target-has.h
+++ b/tcg/mips/tcg-target-has.h
@@ -43,7 +43,6 @@ extern bool use_mips32r2_instructions;
 #define TCG_TARGET_HAS_rem_i32          1
 #define TCG_TARGET_HAS_not_i32          1
 #define TCG_TARGET_HAS_nor_i32          1
-#define TCG_TARGET_HAS_nand_i32         0
 #define TCG_TARGET_HAS_mulu2_i32        (!use_mips32r6_instructions)
 #define TCG_TARGET_HAS_muls2_i32        (!use_mips32r6_instructions)
 #define TCG_TARGET_HAS_muluh_i32        1
@@ -60,7 +59,6 @@ extern bool use_mips32r2_instructions;
 #define TCG_TARGET_HAS_rem_i64          1
 #define TCG_TARGET_HAS_not_i64          1
 #define TCG_TARGET_HAS_nor_i64          1
-#define TCG_TARGET_HAS_nand_i64         0
 #define TCG_TARGET_HAS_add2_i64         0
 #define TCG_TARGET_HAS_sub2_i64         0
 #define TCG_TARGET_HAS_mulu2_i64        (!use_mips32r6_instructions)
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index 3a3c72cb11..46cf393041 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -1716,6 +1716,10 @@ static const TCGOutOpBinary outop_eqv = {
     .base.static_constraint = C_NotImplemented,
 };
 
+static const TCGOutOpBinary outop_nand = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static void tgen_or(TCGContext *s, TCGType type,
                     TCGReg a0, TCGReg a1, TCGReg a2)
 {
diff --git a/tcg/ppc/tcg-target-has.h b/tcg/ppc/tcg-target-has.h
index 8ede19bfad..810f20d120 100644
--- a/tcg/ppc/tcg-target-has.h
+++ b/tcg/ppc/tcg-target-has.h
@@ -23,7 +23,6 @@
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
 #define TCG_TARGET_HAS_not_i32          1
-#define TCG_TARGET_HAS_nand_i32         1
 #define TCG_TARGET_HAS_nor_i32          1
 #define TCG_TARGET_HAS_clz_i32          1
 #define TCG_TARGET_HAS_ctz_i32          have_isa_3_00
@@ -47,7 +46,6 @@
 #define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1
 #define TCG_TARGET_HAS_not_i64          1
-#define TCG_TARGET_HAS_nand_i64         1
 #define TCG_TARGET_HAS_nor_i64          1
 #define TCG_TARGET_HAS_clz_i64          1
 #define TCG_TARGET_HAS_ctz_i64          have_isa_3_00
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index 203f089cd7..29341aff2c 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -2965,6 +2965,17 @@ static const TCGOutOpBinary outop_eqv = {
     .out_rrr = tgen_eqv,
 };
 
+static void tgen_nand(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out32(s, NAND | SAB(a1, a0, a2));
+}
+
+static const TCGOutOpBinary outop_nand = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_nand,
+};
+
 static void tgen_or(TCGContext *s, TCGType type,
                     TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -3097,10 +3108,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    case INDEX_op_nand_i32:
-    case INDEX_op_nand_i64:
-        tcg_out32(s, NAND | SAB(args[1], args[0], args[2]));
-        break;
     case INDEX_op_nor_i32:
     case INDEX_op_nor_i64:
         tcg_out32(s, NOR | SAB(args[1], args[0], args[2]));
@@ -4172,11 +4179,9 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_divu_i32:
     case INDEX_op_rem_i32:
     case INDEX_op_remu_i32:
-    case INDEX_op_nand_i32:
     case INDEX_op_nor_i32:
     case INDEX_op_muluh_i32:
     case INDEX_op_mulsh_i32:
-    case INDEX_op_nand_i64:
     case INDEX_op_nor_i64:
     case INDEX_op_div_i64:
     case INDEX_op_divu_i64:
diff --git a/tcg/riscv/tcg-target-has.h b/tcg/riscv/tcg-target-has.h
index 2faa2895e3..3736a52d56 100644
--- a/tcg/riscv/tcg-target-has.h
+++ b/tcg/riscv/tcg-target-has.h
@@ -25,7 +25,6 @@
 #define TCG_TARGET_HAS_bswap16_i32      (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_bswap32_i32      (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_not_i32          1
-#define TCG_TARGET_HAS_nand_i32         0
 #define TCG_TARGET_HAS_nor_i32          0
 #define TCG_TARGET_HAS_clz_i32          (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_ctz_i32          (cpuinfo & CPUINFO_ZBB)
@@ -43,7 +42,6 @@
 #define TCG_TARGET_HAS_bswap32_i64      (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_bswap64_i64      (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_not_i64          1
-#define TCG_TARGET_HAS_nand_i64         0
 #define TCG_TARGET_HAS_nor_i64          0
 #define TCG_TARGET_HAS_clz_i64          (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_ctz_i64          (cpuinfo & CPUINFO_ZBB)
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index ff2a412821..cb2b58e495 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -2017,6 +2017,10 @@ static const TCGOutOpBinary outop_eqv = {
     .out_rrr = tgen_eqv,
 };
 
+static const TCGOutOpBinary outop_nand = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static void tgen_or(TCGContext *s, TCGType type,
                     TCGReg a0, TCGReg a1, TCGReg a2)
 {
diff --git a/tcg/s390x/tcg-target-has.h b/tcg/s390x/tcg-target-has.h
index 722a2ede1c..d8afd73814 100644
--- a/tcg/s390x/tcg-target-has.h
+++ b/tcg/s390x/tcg-target-has.h
@@ -34,7 +34,6 @@ extern uint64_t s390_facilities[3];
 #define TCG_TARGET_HAS_bswap16_i32    1
 #define TCG_TARGET_HAS_bswap32_i32    1
 #define TCG_TARGET_HAS_not_i32        HAVE_FACILITY(MISC_INSN_EXT3)
-#define TCG_TARGET_HAS_nand_i32       HAVE_FACILITY(MISC_INSN_EXT3)
 #define TCG_TARGET_HAS_nor_i32        HAVE_FACILITY(MISC_INSN_EXT3)
 #define TCG_TARGET_HAS_clz_i32        0
 #define TCG_TARGET_HAS_ctz_i32        0
@@ -56,7 +55,6 @@ extern uint64_t s390_facilities[3];
 #define TCG_TARGET_HAS_bswap32_i64    1
 #define TCG_TARGET_HAS_bswap64_i64    1
 #define TCG_TARGET_HAS_not_i64        HAVE_FACILITY(MISC_INSN_EXT3)
-#define TCG_TARGET_HAS_nand_i64       HAVE_FACILITY(MISC_INSN_EXT3)
 #define TCG_TARGET_HAS_nor_i64        HAVE_FACILITY(MISC_INSN_EXT3)
 #define TCG_TARGET_HAS_clz_i64        1
 #define TCG_TARGET_HAS_ctz_i64        0
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index 6c32aa286d..33eece6e5d 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -2258,6 +2258,22 @@ static const TCGOutOpBinary outop_eqv = {
     .out_rrr = tgen_eqv,
 };
 
+static void tgen_nand(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    if (type == TCG_TYPE_I32) {
+        tcg_out_insn(s, RRFa, NNRK, a0, a1, a2);
+    } else {
+        tcg_out_insn(s, RRFa, NNGRK, a0, a1, a2);
+    }
+}
+
+static const TCGOutOpBinary outop_nand = {
+    .base.static_constraint = C_Dynamic,
+    .base.dynamic_constraint = cset_misc3_rrr,
+    .out_rrr = tgen_nand,
+};
+
 static void tgen_or(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -2392,9 +2408,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    case INDEX_op_nand_i32:
-        tcg_out_insn(s, RRFa, NNRK, args[0], args[1], args[2]);
-        break;
     case INDEX_op_nor_i32:
         tcg_out_insn(s, RRFa, NORK, args[0], args[1], args[2]);
         break;
@@ -2602,9 +2615,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    case INDEX_op_nand_i64:
-        tcg_out_insn(s, RRFa, NNGRK, args[0], args[1], args[2]);
-        break;
     case INDEX_op_nor_i64:
         tcg_out_insn(s, RRFa, NOGRK, args[0], args[1], args[2]);
         break;
@@ -3288,8 +3298,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_sub_i64:
         return C_O1_I2(r, r, ri);
 
-    case INDEX_op_nand_i32:
-    case INDEX_op_nand_i64:
     case INDEX_op_nor_i32:
     case INDEX_op_nor_i64:
         return C_O1_I2(r, r, r);
diff --git a/tcg/sparc64/tcg-target-has.h b/tcg/sparc64/tcg-target-has.h
index 2ec5f5657c..9bc0474107 100644
--- a/tcg/sparc64/tcg-target-has.h
+++ b/tcg/sparc64/tcg-target-has.h
@@ -20,7 +20,6 @@ extern bool use_vis3_instructions;
 #define TCG_TARGET_HAS_bswap16_i32      0
 #define TCG_TARGET_HAS_bswap32_i32      0
 #define TCG_TARGET_HAS_not_i32          1
-#define TCG_TARGET_HAS_nand_i32         0
 #define TCG_TARGET_HAS_nor_i32          0
 #define TCG_TARGET_HAS_clz_i32          0
 #define TCG_TARGET_HAS_ctz_i32          0
@@ -43,7 +42,6 @@ extern bool use_vis3_instructions;
 #define TCG_TARGET_HAS_bswap32_i64      0
 #define TCG_TARGET_HAS_bswap64_i64      0
 #define TCG_TARGET_HAS_not_i64          1
-#define TCG_TARGET_HAS_nand_i64         0
 #define TCG_TARGET_HAS_nor_i64          0
 #define TCG_TARGET_HAS_clz_i64          0
 #define TCG_TARGET_HAS_ctz_i64          0
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index 6d7ee19db1..02c443efb9 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -1337,6 +1337,10 @@ static const TCGOutOpBinary outop_eqv = {
     .base.static_constraint = C_NotImplemented,
 };
 
+static const TCGOutOpBinary outop_nand = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static void tgen_or(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
diff --git a/tcg/tcg-has.h b/tcg/tcg-has.h
index a5808dcc0a..e2a99067ac 100644
--- a/tcg/tcg-has.h
+++ b/tcg/tcg-has.h
@@ -20,7 +20,6 @@
 #define TCG_TARGET_HAS_bswap32_i64      0
 #define TCG_TARGET_HAS_bswap64_i64      0
 #define TCG_TARGET_HAS_not_i64          0
-#define TCG_TARGET_HAS_nand_i64         0
 #define TCG_TARGET_HAS_nor_i64          0
 #define TCG_TARGET_HAS_clz_i64          0
 #define TCG_TARGET_HAS_ctz_i64          0
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index 2520a60cee..3921bac48d 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -690,7 +690,7 @@ void tcg_gen_eqv_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 
 void tcg_gen_nand_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 {
-    if (TCG_TARGET_HAS_nand_i32) {
+    if (tcg_op_supported(INDEX_op_nand_i32, TCG_TYPE_I32, 0)) {
         tcg_gen_op3_i32(INDEX_op_nand_i32, ret, arg1, arg2);
     } else {
         tcg_gen_and_i32(ret, arg1, arg2);
@@ -2292,7 +2292,7 @@ void tcg_gen_nand_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
     if (TCG_TARGET_REG_BITS == 32) {
         tcg_gen_nand_i32(TCGV_LOW(ret), TCGV_LOW(arg1), TCGV_LOW(arg2));
         tcg_gen_nand_i32(TCGV_HIGH(ret), TCGV_HIGH(arg1), TCGV_HIGH(arg2));
-    } else if (TCG_TARGET_HAS_nand_i64) {
+    } else if (tcg_op_supported(INDEX_op_nand_i64, TCG_TYPE_I64, 0)) {
         tcg_gen_op3_i64(INDEX_op_nand_i64, ret, arg1, arg2);
     } else {
         tcg_gen_and_i64(ret, arg1, arg2);
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 6642429df6..50361864aa 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1008,6 +1008,8 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_and, TCGOutOpBinary, outop_and),
     OUTOP(INDEX_op_andc, TCGOutOpBinary, outop_andc),
     OUTOP(INDEX_op_eqv, TCGOutOpBinary, outop_eqv),
+    OUTOP(INDEX_op_nand_i32, TCGOutOpBinary, outop_nand),
+    OUTOP(INDEX_op_nand_i64, TCGOutOpBinary, outop_nand),
     OUTOP(INDEX_op_or, TCGOutOpBinary, outop_or),
     OUTOP(INDEX_op_orc, TCGOutOpBinary, outop_orc),
     OUTOP(INDEX_op_xor, TCGOutOpBinary, outop_xor),
@@ -2274,8 +2276,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
         return TCG_TARGET_HAS_bswap32_i32;
     case INDEX_op_not_i32:
         return TCG_TARGET_HAS_not_i32;
-    case INDEX_op_nand_i32:
-        return TCG_TARGET_HAS_nand_i32;
     case INDEX_op_nor_i32:
         return TCG_TARGET_HAS_nor_i32;
     case INDEX_op_clz_i32:
@@ -2343,8 +2343,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
         return TCG_TARGET_HAS_bswap64_i64;
     case INDEX_op_not_i64:
         return TCG_TARGET_HAS_not_i64;
-    case INDEX_op_nand_i64:
-        return TCG_TARGET_HAS_nand_i64;
     case INDEX_op_nor_i64:
         return TCG_TARGET_HAS_nor_i64;
     case INDEX_op_clz_i64:
@@ -5436,6 +5434,8 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
     case INDEX_op_and:
     case INDEX_op_andc:
     case INDEX_op_eqv:
+    case INDEX_op_nand_i32:
+    case INDEX_op_nand_i64:
     case INDEX_op_or:
     case INDEX_op_orc:
     case INDEX_op_xor:
diff --git a/tcg/tci.c b/tcg/tci.c
index d2baa8d3fc..8be59a0193 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -559,12 +559,10 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = ~(regs[r1] ^ regs[r2]);
             break;
-#if TCG_TARGET_HAS_nand_i32 || TCG_TARGET_HAS_nand_i64
         CASE_32_64(nand)
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = ~(regs[r1] & regs[r2]);
             break;
-#endif
 #if TCG_TARGET_HAS_nor_i32 || TCG_TARGET_HAS_nor_i64
         CASE_32_64(nor)
             tci_args_rrr(insn, &r0, &r1, &r2);
diff --git a/tcg/tci/tcg-target-has.h b/tcg/tci/tcg-target-has.h
index 2c0876a0fd..8be70297f5 100644
--- a/tcg/tci/tcg-target-has.h
+++ b/tcg/tci/tcg-target-has.h
@@ -12,7 +12,6 @@
 #define TCG_TARGET_HAS_div_i32          1
 #define TCG_TARGET_HAS_rem_i32          1
 #define TCG_TARGET_HAS_extract2_i32     0
-#define TCG_TARGET_HAS_nand_i32         1
 #define TCG_TARGET_HAS_nor_i32          1
 #define TCG_TARGET_HAS_clz_i32          1
 #define TCG_TARGET_HAS_ctz_i32          1
@@ -33,7 +32,6 @@
 #define TCG_TARGET_HAS_extract2_i64     0
 #define TCG_TARGET_HAS_div_i64          1
 #define TCG_TARGET_HAS_rem_i64          1
-#define TCG_TARGET_HAS_nand_i64         1
 #define TCG_TARGET_HAS_nor_i64          1
 #define TCG_TARGET_HAS_clz_i64          1
 #define TCG_TARGET_HAS_ctz_i64          1
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index fe3450373e..2a5c72705d 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -95,8 +95,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_sub_i64:
     case INDEX_op_mul_i32:
     case INDEX_op_mul_i64:
-    case INDEX_op_nand_i32:
-    case INDEX_op_nand_i64:
     case INDEX_op_nor_i32:
     case INDEX_op_nor_i64:
     case INDEX_op_shl_i32:
@@ -671,6 +669,17 @@ static const TCGOutOpBinary outop_eqv = {
     .out_rrr = tgen_eqv,
 };
 
+static void tgen_nand(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_op_rrr(s, glue(INDEX_op_nand_i,TCG_TARGET_REG_BITS), a0, a1, a2);
+}
+
+static const TCGOutOpBinary outop_nand = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_nand,
+};
+
 static void tgen_or(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -748,7 +757,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
 
     CASE_32_64(sub)
     CASE_32_64(mul)
-    CASE_32_64(nand)     /* Optional (TCG_TARGET_HAS_nand_*). */
     CASE_32_64(nor)      /* Optional (TCG_TARGET_HAS_nor_*). */
     CASE_32_64(shl)
     CASE_32_64(shr)

From 59379a45af1f4d62fc8c1ae0ddee988f47075787 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 6 Jan 2025 20:32:54 -0800
Subject: [PATCH 0383/2760] tcg: Merge INDEX_op_nand_{i32,i64}
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 docs/devel/tcg-ops.rst   | 2 +-
 include/tcg/tcg-opc.h    | 3 +--
 tcg/optimize.c           | 6 ++++--
 tcg/tcg-op.c             | 8 ++++----
 tcg/tcg.c                | 6 ++----
 tcg/tci.c                | 5 ++---
 tcg/tci/tcg-target.c.inc | 2 +-
 7 files changed, 15 insertions(+), 17 deletions(-)

diff --git a/docs/devel/tcg-ops.rst b/docs/devel/tcg-ops.rst
index fe149e012d..7703dfbc51 100644
--- a/docs/devel/tcg-ops.rst
+++ b/docs/devel/tcg-ops.rst
@@ -327,7 +327,7 @@ Logical
 
      - | *t0* = ~(*t1* ^ *t2*), or equivalently, *t0* = *t1* ^ ~\ *t2*
 
-   * - nand_i32/i64 *t0*, *t1*, *t2*
+   * - nand *t0*, *t1*, *t2*
 
      - | *t0* = ~(*t1* & *t2*)
 
diff --git a/include/tcg/tcg-opc.h b/include/tcg/tcg-opc.h
index c6869de244..1acdd7cfda 100644
--- a/include/tcg/tcg-opc.h
+++ b/include/tcg/tcg-opc.h
@@ -43,6 +43,7 @@ DEF(add, 1, 2, 0, TCG_OPF_INT)
 DEF(and, 1, 2, 0, TCG_OPF_INT)
 DEF(andc, 1, 2, 0, TCG_OPF_INT)
 DEF(eqv, 1, 2, 0, TCG_OPF_INT)
+DEF(nand, 1, 2, 0, TCG_OPF_INT)
 DEF(or, 1, 2, 0, TCG_OPF_INT)
 DEF(orc, 1, 2, 0, TCG_OPF_INT)
 DEF(xor, 1, 2, 0, TCG_OPF_INT)
@@ -94,7 +95,6 @@ DEF(bswap16_i32, 1, 1, 1, 0)
 DEF(bswap32_i32, 1, 1, 1, 0)
 DEF(not_i32, 1, 1, 0, 0)
 DEF(neg_i32, 1, 1, 0, 0)
-DEF(nand_i32, 1, 2, 0, 0)
 DEF(nor_i32, 1, 2, 0, 0)
 DEF(clz_i32, 1, 2, 0, 0)
 DEF(ctz_i32, 1, 2, 0, 0)
@@ -147,7 +147,6 @@ DEF(bswap32_i64, 1, 1, 1, 0)
 DEF(bswap64_i64, 1, 1, 1, 0)
 DEF(not_i64, 1, 1, 0, 0)
 DEF(neg_i64, 1, 1, 0, 0)
-DEF(nand_i64, 1, 2, 0, 0)
 DEF(nor_i64, 1, 2, 0, 0)
 DEF(clz_i64, 1, 2, 0, 0)
 DEF(ctz_i64, 1, 2, 0, 0)
diff --git a/tcg/optimize.c b/tcg/optimize.c
index 47898b7086..e8e6a0c2ce 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -493,7 +493,8 @@ static uint64_t do_constant_folding_2(TCGOpcode op, uint64_t x, uint64_t y)
     case INDEX_op_eqv_vec:
         return ~(x ^ y);
 
-    CASE_OP_32_64_VEC(nand):
+    case INDEX_op_nand:
+    case INDEX_op_nand_vec:
         return ~(x & y);
 
     CASE_OP_32_64_VEC(nor):
@@ -2992,7 +2993,8 @@ void tcg_optimize(TCGContext *s)
         CASE_OP_32_64(mulu2):
             done = fold_multiply2(&ctx, op);
             break;
-        CASE_OP_32_64_VEC(nand):
+        case INDEX_op_nand:
+        case INDEX_op_nand_vec:
             done = fold_nand(&ctx, op);
             break;
         CASE_OP_32_64(neg):
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index 3921bac48d..57782864fa 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -690,8 +690,8 @@ void tcg_gen_eqv_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 
 void tcg_gen_nand_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 {
-    if (tcg_op_supported(INDEX_op_nand_i32, TCG_TYPE_I32, 0)) {
-        tcg_gen_op3_i32(INDEX_op_nand_i32, ret, arg1, arg2);
+    if (tcg_op_supported(INDEX_op_nand, TCG_TYPE_I32, 0)) {
+        tcg_gen_op3_i32(INDEX_op_nand, ret, arg1, arg2);
     } else {
         tcg_gen_and_i32(ret, arg1, arg2);
         tcg_gen_not_i32(ret, ret);
@@ -2292,8 +2292,8 @@ void tcg_gen_nand_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
     if (TCG_TARGET_REG_BITS == 32) {
         tcg_gen_nand_i32(TCGV_LOW(ret), TCGV_LOW(arg1), TCGV_LOW(arg2));
         tcg_gen_nand_i32(TCGV_HIGH(ret), TCGV_HIGH(arg1), TCGV_HIGH(arg2));
-    } else if (tcg_op_supported(INDEX_op_nand_i64, TCG_TYPE_I64, 0)) {
-        tcg_gen_op3_i64(INDEX_op_nand_i64, ret, arg1, arg2);
+    } else if (tcg_op_supported(INDEX_op_nand, TCG_TYPE_I64, 0)) {
+        tcg_gen_op3_i64(INDEX_op_nand, ret, arg1, arg2);
     } else {
         tcg_gen_and_i64(ret, arg1, arg2);
         tcg_gen_not_i64(ret, ret);
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 50361864aa..72e9175d06 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1008,8 +1008,7 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_and, TCGOutOpBinary, outop_and),
     OUTOP(INDEX_op_andc, TCGOutOpBinary, outop_andc),
     OUTOP(INDEX_op_eqv, TCGOutOpBinary, outop_eqv),
-    OUTOP(INDEX_op_nand_i32, TCGOutOpBinary, outop_nand),
-    OUTOP(INDEX_op_nand_i64, TCGOutOpBinary, outop_nand),
+    OUTOP(INDEX_op_nand, TCGOutOpBinary, outop_nand),
     OUTOP(INDEX_op_or, TCGOutOpBinary, outop_or),
     OUTOP(INDEX_op_orc, TCGOutOpBinary, outop_orc),
     OUTOP(INDEX_op_xor, TCGOutOpBinary, outop_xor),
@@ -5434,8 +5433,7 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
     case INDEX_op_and:
     case INDEX_op_andc:
     case INDEX_op_eqv:
-    case INDEX_op_nand_i32:
-    case INDEX_op_nand_i64:
+    case INDEX_op_nand:
     case INDEX_op_or:
     case INDEX_op_orc:
     case INDEX_op_xor:
diff --git a/tcg/tci.c b/tcg/tci.c
index 8be59a0193..9886ddf001 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -559,7 +559,7 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = ~(regs[r1] ^ regs[r2]);
             break;
-        CASE_32_64(nand)
+        case INDEX_op_nand:
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = ~(regs[r1] & regs[r2]);
             break;
@@ -1078,6 +1078,7 @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
     case INDEX_op_and:
     case INDEX_op_andc:
     case INDEX_op_eqv:
+    case INDEX_op_nand:
     case INDEX_op_or:
     case INDEX_op_orc:
     case INDEX_op_xor:
@@ -1085,8 +1086,6 @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
     case INDEX_op_sub_i64:
     case INDEX_op_mul_i32:
     case INDEX_op_mul_i64:
-    case INDEX_op_nand_i32:
-    case INDEX_op_nand_i64:
     case INDEX_op_nor_i32:
     case INDEX_op_nor_i64:
     case INDEX_op_div_i32:
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index 2a5c72705d..34a44a7674 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -672,7 +672,7 @@ static const TCGOutOpBinary outop_eqv = {
 static void tgen_nand(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
-    tcg_out_op_rrr(s, glue(INDEX_op_nand_i,TCG_TARGET_REG_BITS), a0, a1, a2);
+    tcg_out_op_rrr(s, INDEX_op_nand, a0, a1, a2);
 }
 
 static const TCGOutOpBinary outop_nand = {

From 8fb04b8295994e7416a222906939696d496638f3 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 6 Jan 2025 20:37:25 -0800
Subject: [PATCH 0384/2760] tcg/loongarch64: Do not accept constant argument to
 nor
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The instruction set does not implement nor with immediate.
There is no reason to pretend that we do.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/loongarch64/tcg-target.c.inc | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index 814596608a..e74c7d8a87 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -1425,12 +1425,7 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
 
     case INDEX_op_nor_i32:
     case INDEX_op_nor_i64:
-        if (c2) {
-            tcg_out_opc_ori(s, a0, a1, a2);
-            tcg_out_opc_nor(s, a0, a0, TCG_REG_ZERO);
-        } else {
-            tcg_out_opc_nor(s, a0, a1, a2);
-        }
+        tcg_out_opc_nor(s, a0, a1, a2);
         break;
 
     case INDEX_op_extract_i32:
@@ -2314,8 +2309,7 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 
     case INDEX_op_nor_i32:
     case INDEX_op_nor_i64:
-        /* LoongArch reg-imm bitops have their imms ZERO-extended */
-        return C_O1_I2(r, r, rU);
+        return C_O1_I2(r, r, r);
 
     case INDEX_op_clz_i32:
     case INDEX_op_clz_i64:

From 3f6b223012f62bb3f73552bea4489383f08cdc23 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 6 Jan 2025 20:57:21 -0800
Subject: [PATCH 0385/2760] tcg: Convert nor to TCGOutOpBinary
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target-has.h     |  2 --
 tcg/aarch64/tcg-target.c.inc     |  4 ++++
 tcg/arm/tcg-target-has.h         |  1 -
 tcg/arm/tcg-target.c.inc         |  4 ++++
 tcg/i386/tcg-target-has.h        |  2 --
 tcg/i386/tcg-target.c.inc        |  4 ++++
 tcg/loongarch64/tcg-target-has.h |  2 --
 tcg/loongarch64/tcg-target.c.inc | 20 +++++++++++---------
 tcg/mips/tcg-target-has.h        |  2 --
 tcg/mips/tcg-target.c.inc        | 17 +++++++++++------
 tcg/ppc/tcg-target-has.h         |  2 --
 tcg/ppc/tcg-target.c.inc         | 18 +++++++++++-------
 tcg/riscv/tcg-target-has.h       |  2 --
 tcg/riscv/tcg-target.c.inc       |  4 ++++
 tcg/s390x/tcg-target-has.h       |  2 --
 tcg/s390x/tcg-target.c.inc       | 28 ++++++++++++++++------------
 tcg/sparc64/tcg-target-has.h     |  2 --
 tcg/sparc64/tcg-target.c.inc     |  4 ++++
 tcg/tcg-has.h                    |  1 -
 tcg/tcg-op.c                     |  4 ++--
 tcg/tcg.c                        |  8 ++++----
 tcg/tci.c                        |  2 --
 tcg/tci/tcg-target-has.h         |  2 --
 tcg/tci/tcg-target.c.inc         | 14 +++++++++++---
 24 files changed, 86 insertions(+), 65 deletions(-)

diff --git a/tcg/aarch64/tcg-target-has.h b/tcg/aarch64/tcg-target-has.h
index 2acc9bd3b7..240fcac2cc 100644
--- a/tcg/aarch64/tcg-target-has.h
+++ b/tcg/aarch64/tcg-target-has.h
@@ -19,7 +19,6 @@
 #define TCG_TARGET_HAS_bswap32_i32      1
 #define TCG_TARGET_HAS_not_i32          1
 #define TCG_TARGET_HAS_rot_i32          1
-#define TCG_TARGET_HAS_nor_i32          0
 #define TCG_TARGET_HAS_clz_i32          1
 #define TCG_TARGET_HAS_ctz_i32          1
 #define TCG_TARGET_HAS_ctpop_i32        0
@@ -41,7 +40,6 @@
 #define TCG_TARGET_HAS_bswap64_i64      1
 #define TCG_TARGET_HAS_not_i64          1
 #define TCG_TARGET_HAS_rot_i64          1
-#define TCG_TARGET_HAS_nor_i64          0
 #define TCG_TARGET_HAS_clz_i64          1
 #define TCG_TARGET_HAS_ctz_i64          1
 #define TCG_TARGET_HAS_ctpop_i64        0
diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index 093bb0afb7..30cad937b7 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -2172,6 +2172,10 @@ static const TCGOutOpBinary outop_nand = {
     .base.static_constraint = C_NotImplemented,
 };
 
+static const TCGOutOpBinary outop_nor = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static void tgen_or(TCGContext *s, TCGType type,
                     TCGReg a0, TCGReg a1, TCGReg a2)
 {
diff --git a/tcg/arm/tcg-target-has.h b/tcg/arm/tcg-target-has.h
index 8d7b176993..e80711ee40 100644
--- a/tcg/arm/tcg-target-has.h
+++ b/tcg/arm/tcg-target-has.h
@@ -28,7 +28,6 @@ extern bool use_neon_instructions;
 #define TCG_TARGET_HAS_bswap32_i32      1
 #define TCG_TARGET_HAS_not_i32          1
 #define TCG_TARGET_HAS_rot_i32          1
-#define TCG_TARGET_HAS_nor_i32          0
 #define TCG_TARGET_HAS_clz_i32          1
 #define TCG_TARGET_HAS_ctz_i32          use_armv7_instructions
 #define TCG_TARGET_HAS_ctpop_i32        0
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index 55d28be15b..8e9edeb7c6 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -1889,6 +1889,10 @@ static const TCGOutOpBinary outop_nand = {
     .base.static_constraint = C_NotImplemented,
 };
 
+static const TCGOutOpBinary outop_nor = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static void tgen_or(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
diff --git a/tcg/i386/tcg-target-has.h b/tcg/i386/tcg-target-has.h
index 93552f2337..b27f853dcd 100644
--- a/tcg/i386/tcg-target-has.h
+++ b/tcg/i386/tcg-target-has.h
@@ -31,7 +31,6 @@
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
 #define TCG_TARGET_HAS_not_i32          1
-#define TCG_TARGET_HAS_nor_i32          0
 #define TCG_TARGET_HAS_clz_i32          1
 #define TCG_TARGET_HAS_ctz_i32          1
 #define TCG_TARGET_HAS_ctpop_i32        have_popcnt
@@ -53,7 +52,6 @@
 #define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1
 #define TCG_TARGET_HAS_not_i64          1
-#define TCG_TARGET_HAS_nor_i64          0
 #define TCG_TARGET_HAS_clz_i64          1
 #define TCG_TARGET_HAS_ctz_i64          1
 #define TCG_TARGET_HAS_ctpop_i64        have_popcnt
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index 51c3711ee5..9185f6879c 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -2641,6 +2641,10 @@ static const TCGOutOpBinary outop_nand = {
     .base.static_constraint = C_NotImplemented,
 };
 
+static const TCGOutOpBinary outop_nor = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static void tgen_or(TCGContext *s, TCGType type,
                     TCGReg a0, TCGReg a1, TCGReg a2)
 {
diff --git a/tcg/loongarch64/tcg-target-has.h b/tcg/loongarch64/tcg-target-has.h
index 55249de465..7860432489 100644
--- a/tcg/loongarch64/tcg-target-has.h
+++ b/tcg/loongarch64/tcg-target-has.h
@@ -25,7 +25,6 @@
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
 #define TCG_TARGET_HAS_not_i32          1
-#define TCG_TARGET_HAS_nor_i32          1
 #define TCG_TARGET_HAS_clz_i32          1
 #define TCG_TARGET_HAS_ctz_i32          1
 #define TCG_TARGET_HAS_ctpop_i32        0
@@ -43,7 +42,6 @@
 #define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1
 #define TCG_TARGET_HAS_not_i64          1
-#define TCG_TARGET_HAS_nor_i64          1
 #define TCG_TARGET_HAS_clz_i64          1
 #define TCG_TARGET_HAS_ctz_i64          1
 #define TCG_TARGET_HAS_ctpop_i64        0
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index e74c7d8a87..dc4ed0e8b0 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -1336,6 +1336,17 @@ static const TCGOutOpBinary outop_nand = {
     .base.static_constraint = C_NotImplemented,
 };
 
+static void tgen_nor(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_opc_nor(s, a0, a1, a2);
+}
+
+static const TCGOutOpBinary outop_nor = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_nor,
+};
+
 static void tgen_or(TCGContext *s, TCGType type,
                     TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -1423,11 +1434,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_opc_nor(s, a0, a1, TCG_REG_ZERO);
         break;
 
-    case INDEX_op_nor_i32:
-    case INDEX_op_nor_i64:
-        tcg_out_opc_nor(s, a0, a1, a2);
-        break;
-
     case INDEX_op_extract_i32:
         if (a2 == 0 && args[3] <= 12) {
             tcg_out_opc_andi(s, a0, a1, (1 << args[3]) - 1);
@@ -2307,10 +2313,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_rotr_i64:
         return C_O1_I2(r, r, ri);
 
-    case INDEX_op_nor_i32:
-    case INDEX_op_nor_i64:
-        return C_O1_I2(r, r, r);
-
     case INDEX_op_clz_i32:
     case INDEX_op_clz_i64:
     case INDEX_op_ctz_i32:
diff --git a/tcg/mips/tcg-target-has.h b/tcg/mips/tcg-target-has.h
index 2f8325d56f..987f83f761 100644
--- a/tcg/mips/tcg-target-has.h
+++ b/tcg/mips/tcg-target-has.h
@@ -42,7 +42,6 @@ extern bool use_mips32r2_instructions;
 #define TCG_TARGET_HAS_div_i32          1
 #define TCG_TARGET_HAS_rem_i32          1
 #define TCG_TARGET_HAS_not_i32          1
-#define TCG_TARGET_HAS_nor_i32          1
 #define TCG_TARGET_HAS_mulu2_i32        (!use_mips32r6_instructions)
 #define TCG_TARGET_HAS_muls2_i32        (!use_mips32r6_instructions)
 #define TCG_TARGET_HAS_muluh_i32        1
@@ -58,7 +57,6 @@ extern bool use_mips32r2_instructions;
 #define TCG_TARGET_HAS_div_i64          1
 #define TCG_TARGET_HAS_rem_i64          1
 #define TCG_TARGET_HAS_not_i64          1
-#define TCG_TARGET_HAS_nor_i64          1
 #define TCG_TARGET_HAS_add2_i64         0
 #define TCG_TARGET_HAS_sub2_i64         0
 #define TCG_TARGET_HAS_mulu2_i64        (!use_mips32r6_instructions)
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index 46cf393041..bfe329b3ef 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -1720,6 +1720,17 @@ static const TCGOutOpBinary outop_nand = {
     .base.static_constraint = C_NotImplemented,
 };
 
+static void tgen_nor(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_opc_reg(s, OPC_NOR, a0, a1, a2);
+}
+
+static const TCGOutOpBinary outop_nor = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_nor,
+};
+
 static void tgen_or(TCGContext *s, TCGType type,
                     TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -1848,10 +1859,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
             break;
         }
         goto do_binaryv;
-    case INDEX_op_nor_i32:
-    case INDEX_op_nor_i64:
-        i1 = OPC_NOR;
-        goto do_binaryv;
 
     case INDEX_op_mul_i32:
         if (use_mips32_instructions) {
@@ -2237,7 +2244,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_divu_i32:
     case INDEX_op_rem_i32:
     case INDEX_op_remu_i32:
-    case INDEX_op_nor_i32:
     case INDEX_op_setcond_i32:
     case INDEX_op_mul_i64:
     case INDEX_op_mulsh_i64:
@@ -2246,7 +2252,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_divu_i64:
     case INDEX_op_rem_i64:
     case INDEX_op_remu_i64:
-    case INDEX_op_nor_i64:
     case INDEX_op_setcond_i64:
         return C_O1_I2(r, rz, rz);
     case INDEX_op_muls2_i32:
diff --git a/tcg/ppc/tcg-target-has.h b/tcg/ppc/tcg-target-has.h
index 810f20d120..6be6d7f994 100644
--- a/tcg/ppc/tcg-target-has.h
+++ b/tcg/ppc/tcg-target-has.h
@@ -23,7 +23,6 @@
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
 #define TCG_TARGET_HAS_not_i32          1
-#define TCG_TARGET_HAS_nor_i32          1
 #define TCG_TARGET_HAS_clz_i32          1
 #define TCG_TARGET_HAS_ctz_i32          have_isa_3_00
 #define TCG_TARGET_HAS_ctpop_i32        have_isa_2_06
@@ -46,7 +45,6 @@
 #define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1
 #define TCG_TARGET_HAS_not_i64          1
-#define TCG_TARGET_HAS_nor_i64          1
 #define TCG_TARGET_HAS_clz_i64          1
 #define TCG_TARGET_HAS_ctz_i64          have_isa_3_00
 #define TCG_TARGET_HAS_ctpop_i64        have_isa_2_06
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index 29341aff2c..c3366e4316 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -2976,6 +2976,17 @@ static const TCGOutOpBinary outop_nand = {
     .out_rrr = tgen_nand,
 };
 
+static void tgen_nor(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out32(s, NOR | SAB(a1, a0, a2));
+}
+
+static const TCGOutOpBinary outop_nor = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_nor,
+};
+
 static void tgen_or(TCGContext *s, TCGType type,
                     TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -3108,11 +3119,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    case INDEX_op_nor_i32:
-    case INDEX_op_nor_i64:
-        tcg_out32(s, NOR | SAB(args[1], args[0], args[2]));
-        break;
-
     case INDEX_op_clz_i32:
         tcg_out_cntxz(s, TCG_TYPE_I32, CNTLZW, args[0], args[1],
                       args[2], const_args[2]);
@@ -4179,10 +4185,8 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_divu_i32:
     case INDEX_op_rem_i32:
     case INDEX_op_remu_i32:
-    case INDEX_op_nor_i32:
     case INDEX_op_muluh_i32:
     case INDEX_op_mulsh_i32:
-    case INDEX_op_nor_i64:
     case INDEX_op_div_i64:
     case INDEX_op_divu_i64:
     case INDEX_op_rem_i64:
diff --git a/tcg/riscv/tcg-target-has.h b/tcg/riscv/tcg-target-has.h
index 3736a52d56..0fcf940a8a 100644
--- a/tcg/riscv/tcg-target-has.h
+++ b/tcg/riscv/tcg-target-has.h
@@ -25,7 +25,6 @@
 #define TCG_TARGET_HAS_bswap16_i32      (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_bswap32_i32      (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_not_i32          1
-#define TCG_TARGET_HAS_nor_i32          0
 #define TCG_TARGET_HAS_clz_i32          (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_ctz_i32          (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_ctpop_i32        (cpuinfo & CPUINFO_ZBB)
@@ -42,7 +41,6 @@
 #define TCG_TARGET_HAS_bswap32_i64      (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_bswap64_i64      (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_not_i64          1
-#define TCG_TARGET_HAS_nor_i64          0
 #define TCG_TARGET_HAS_clz_i64          (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_ctz_i64          (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_ctpop_i64        (cpuinfo & CPUINFO_ZBB)
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index cb2b58e495..887f20d4cb 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -2021,6 +2021,10 @@ static const TCGOutOpBinary outop_nand = {
     .base.static_constraint = C_NotImplemented,
 };
 
+static const TCGOutOpBinary outop_nor = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static void tgen_or(TCGContext *s, TCGType type,
                     TCGReg a0, TCGReg a1, TCGReg a2)
 {
diff --git a/tcg/s390x/tcg-target-has.h b/tcg/s390x/tcg-target-has.h
index d8afd73814..374db3cf9d 100644
--- a/tcg/s390x/tcg-target-has.h
+++ b/tcg/s390x/tcg-target-has.h
@@ -34,7 +34,6 @@ extern uint64_t s390_facilities[3];
 #define TCG_TARGET_HAS_bswap16_i32    1
 #define TCG_TARGET_HAS_bswap32_i32    1
 #define TCG_TARGET_HAS_not_i32        HAVE_FACILITY(MISC_INSN_EXT3)
-#define TCG_TARGET_HAS_nor_i32        HAVE_FACILITY(MISC_INSN_EXT3)
 #define TCG_TARGET_HAS_clz_i32        0
 #define TCG_TARGET_HAS_ctz_i32        0
 #define TCG_TARGET_HAS_ctpop_i32      1
@@ -55,7 +54,6 @@ extern uint64_t s390_facilities[3];
 #define TCG_TARGET_HAS_bswap32_i64    1
 #define TCG_TARGET_HAS_bswap64_i64    1
 #define TCG_TARGET_HAS_not_i64        HAVE_FACILITY(MISC_INSN_EXT3)
-#define TCG_TARGET_HAS_nor_i64        HAVE_FACILITY(MISC_INSN_EXT3)
 #define TCG_TARGET_HAS_clz_i64        1
 #define TCG_TARGET_HAS_ctz_i64        0
 #define TCG_TARGET_HAS_ctpop_i64      1
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index 33eece6e5d..29570d3be1 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -2274,6 +2274,22 @@ static const TCGOutOpBinary outop_nand = {
     .out_rrr = tgen_nand,
 };
 
+static void tgen_nor(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    if (type == TCG_TYPE_I32) {
+        tcg_out_insn(s, RRFa, NORK, a0, a1, a2);
+    } else {
+        tcg_out_insn(s, RRFa, NOGRK, a0, a1, a2);
+    }
+}
+
+static const TCGOutOpBinary outop_nor = {
+    .base.static_constraint = C_Dynamic,
+    .base.dynamic_constraint = cset_misc3_rrr,
+    .out_rrr = tgen_nor,
+};
+
 static void tgen_or(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -2408,10 +2424,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    case INDEX_op_nor_i32:
-        tcg_out_insn(s, RRFa, NORK, args[0], args[1], args[2]);
-        break;
-
     case INDEX_op_neg_i32:
         tcg_out_insn(s, RR, LCR, args[0], args[1]);
         break;
@@ -2615,10 +2627,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    case INDEX_op_nor_i64:
-        tcg_out_insn(s, RRFa, NOGRK, args[0], args[1], args[2]);
-        break;
-
     case INDEX_op_neg_i64:
         tcg_out_insn(s, RRE, LCGR, args[0], args[1]);
         break;
@@ -3298,10 +3306,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_sub_i64:
         return C_O1_I2(r, r, ri);
 
-    case INDEX_op_nor_i32:
-    case INDEX_op_nor_i64:
-        return C_O1_I2(r, r, r);
-
     case INDEX_op_mul_i32:
         return (HAVE_FACILITY(MISC_INSN_EXT2)
                 ? C_O1_I2(r, r, ri)
diff --git a/tcg/sparc64/tcg-target-has.h b/tcg/sparc64/tcg-target-has.h
index 9bc0474107..35ae536879 100644
--- a/tcg/sparc64/tcg-target-has.h
+++ b/tcg/sparc64/tcg-target-has.h
@@ -20,7 +20,6 @@ extern bool use_vis3_instructions;
 #define TCG_TARGET_HAS_bswap16_i32      0
 #define TCG_TARGET_HAS_bswap32_i32      0
 #define TCG_TARGET_HAS_not_i32          1
-#define TCG_TARGET_HAS_nor_i32          0
 #define TCG_TARGET_HAS_clz_i32          0
 #define TCG_TARGET_HAS_ctz_i32          0
 #define TCG_TARGET_HAS_ctpop_i32        0
@@ -42,7 +41,6 @@ extern bool use_vis3_instructions;
 #define TCG_TARGET_HAS_bswap32_i64      0
 #define TCG_TARGET_HAS_bswap64_i64      0
 #define TCG_TARGET_HAS_not_i64          1
-#define TCG_TARGET_HAS_nor_i64          0
 #define TCG_TARGET_HAS_clz_i64          0
 #define TCG_TARGET_HAS_ctz_i64          0
 #define TCG_TARGET_HAS_ctpop_i64        0
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index 02c443efb9..1ebff04af4 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -1341,6 +1341,10 @@ static const TCGOutOpBinary outop_nand = {
     .base.static_constraint = C_NotImplemented,
 };
 
+static const TCGOutOpBinary outop_nor = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static void tgen_or(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
diff --git a/tcg/tcg-has.h b/tcg/tcg-has.h
index e2a99067ac..7de13ef383 100644
--- a/tcg/tcg-has.h
+++ b/tcg/tcg-has.h
@@ -20,7 +20,6 @@
 #define TCG_TARGET_HAS_bswap32_i64      0
 #define TCG_TARGET_HAS_bswap64_i64      0
 #define TCG_TARGET_HAS_not_i64          0
-#define TCG_TARGET_HAS_nor_i64          0
 #define TCG_TARGET_HAS_clz_i64          0
 #define TCG_TARGET_HAS_ctz_i64          0
 #define TCG_TARGET_HAS_ctpop_i64        0
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index 57782864fa..ac939bb4ea 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -700,7 +700,7 @@ void tcg_gen_nand_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 
 void tcg_gen_nor_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 {
-    if (TCG_TARGET_HAS_nor_i32) {
+    if (tcg_op_supported(INDEX_op_nor_i32, TCG_TYPE_I32, 0)) {
         tcg_gen_op3_i32(INDEX_op_nor_i32, ret, arg1, arg2);
     } else {
         tcg_gen_or_i32(ret, arg1, arg2);
@@ -2305,7 +2305,7 @@ void tcg_gen_nor_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
     if (TCG_TARGET_REG_BITS == 32) {
         tcg_gen_nor_i32(TCGV_LOW(ret), TCGV_LOW(arg1), TCGV_LOW(arg2));
         tcg_gen_nor_i32(TCGV_HIGH(ret), TCGV_HIGH(arg1), TCGV_HIGH(arg2));
-    } else if (TCG_TARGET_HAS_nor_i64) {
+    } else if (tcg_op_supported(INDEX_op_nor_i64, TCG_TYPE_I64, 0)) {
         tcg_gen_op3_i64(INDEX_op_nor_i64, ret, arg1, arg2);
     } else {
         tcg_gen_or_i64(ret, arg1, arg2);
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 72e9175d06..d9807b77dc 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1009,6 +1009,8 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_andc, TCGOutOpBinary, outop_andc),
     OUTOP(INDEX_op_eqv, TCGOutOpBinary, outop_eqv),
     OUTOP(INDEX_op_nand, TCGOutOpBinary, outop_nand),
+    OUTOP(INDEX_op_nor_i32, TCGOutOpBinary, outop_nor),
+    OUTOP(INDEX_op_nor_i64, TCGOutOpBinary, outop_nor),
     OUTOP(INDEX_op_or, TCGOutOpBinary, outop_or),
     OUTOP(INDEX_op_orc, TCGOutOpBinary, outop_orc),
     OUTOP(INDEX_op_xor, TCGOutOpBinary, outop_xor),
@@ -2275,8 +2277,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
         return TCG_TARGET_HAS_bswap32_i32;
     case INDEX_op_not_i32:
         return TCG_TARGET_HAS_not_i32;
-    case INDEX_op_nor_i32:
-        return TCG_TARGET_HAS_nor_i32;
     case INDEX_op_clz_i32:
         return TCG_TARGET_HAS_clz_i32;
     case INDEX_op_ctz_i32:
@@ -2342,8 +2342,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
         return TCG_TARGET_HAS_bswap64_i64;
     case INDEX_op_not_i64:
         return TCG_TARGET_HAS_not_i64;
-    case INDEX_op_nor_i64:
-        return TCG_TARGET_HAS_nor_i64;
     case INDEX_op_clz_i64:
         return TCG_TARGET_HAS_clz_i64;
     case INDEX_op_ctz_i64:
@@ -5434,6 +5432,8 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
     case INDEX_op_andc:
     case INDEX_op_eqv:
     case INDEX_op_nand:
+    case INDEX_op_nor_i32:
+    case INDEX_op_nor_i64:
     case INDEX_op_or:
     case INDEX_op_orc:
     case INDEX_op_xor:
diff --git a/tcg/tci.c b/tcg/tci.c
index 9886ddf001..3ea93fa5a6 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -563,12 +563,10 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = ~(regs[r1] & regs[r2]);
             break;
-#if TCG_TARGET_HAS_nor_i32 || TCG_TARGET_HAS_nor_i64
         CASE_32_64(nor)
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = ~(regs[r1] | regs[r2]);
             break;
-#endif
 
             /* Arithmetic operations (32 bit). */
 
diff --git a/tcg/tci/tcg-target-has.h b/tcg/tci/tcg-target-has.h
index 8be70297f5..13c9dc3dfa 100644
--- a/tcg/tci/tcg-target-has.h
+++ b/tcg/tci/tcg-target-has.h
@@ -12,7 +12,6 @@
 #define TCG_TARGET_HAS_div_i32          1
 #define TCG_TARGET_HAS_rem_i32          1
 #define TCG_TARGET_HAS_extract2_i32     0
-#define TCG_TARGET_HAS_nor_i32          1
 #define TCG_TARGET_HAS_clz_i32          1
 #define TCG_TARGET_HAS_ctz_i32          1
 #define TCG_TARGET_HAS_ctpop_i32        1
@@ -32,7 +31,6 @@
 #define TCG_TARGET_HAS_extract2_i64     0
 #define TCG_TARGET_HAS_div_i64          1
 #define TCG_TARGET_HAS_rem_i64          1
-#define TCG_TARGET_HAS_nor_i64          1
 #define TCG_TARGET_HAS_clz_i64          1
 #define TCG_TARGET_HAS_ctz_i64          1
 #define TCG_TARGET_HAS_ctpop_i64        1
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index 34a44a7674..a0f4c58be8 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -95,8 +95,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_sub_i64:
     case INDEX_op_mul_i32:
     case INDEX_op_mul_i64:
-    case INDEX_op_nor_i32:
-    case INDEX_op_nor_i64:
     case INDEX_op_shl_i32:
     case INDEX_op_shl_i64:
     case INDEX_op_shr_i32:
@@ -680,6 +678,17 @@ static const TCGOutOpBinary outop_nand = {
     .out_rrr = tgen_nand,
 };
 
+static void tgen_nor(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_op_rrr(s, glue(INDEX_op_nor_i,TCG_TARGET_REG_BITS), a0, a1, a2);
+}
+
+static const TCGOutOpBinary outop_nor = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_nor,
+};
+
 static void tgen_or(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -757,7 +766,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
 
     CASE_32_64(sub)
     CASE_32_64(mul)
-    CASE_32_64(nor)      /* Optional (TCG_TARGET_HAS_nor_*). */
     CASE_32_64(shl)
     CASE_32_64(shr)
     CASE_32_64(sar)

From 3a8c4e9e53c6f4aa7c590971950000b174e74fa1 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 6 Jan 2025 21:02:17 -0800
Subject: [PATCH 0386/2760] tcg: Merge INDEX_op_nor_{i32,i64}
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 docs/devel/tcg-ops.rst   | 2 +-
 include/tcg/tcg-opc.h    | 3 +--
 tcg/optimize.c           | 6 ++++--
 tcg/tcg-op.c             | 8 ++++----
 tcg/tcg.c                | 6 ++----
 tcg/tci.c                | 5 ++---
 tcg/tci/tcg-target.c.inc | 2 +-
 7 files changed, 15 insertions(+), 17 deletions(-)

diff --git a/docs/devel/tcg-ops.rst b/docs/devel/tcg-ops.rst
index 7703dfbc51..26d464fa38 100644
--- a/docs/devel/tcg-ops.rst
+++ b/docs/devel/tcg-ops.rst
@@ -331,7 +331,7 @@ Logical
 
      - | *t0* = ~(*t1* & *t2*)
 
-   * - nor_i32/i64 *t0*, *t1*, *t2*
+   * - nor *t0*, *t1*, *t2*
 
      - | *t0* = ~(*t1* | *t2*)
 
diff --git a/include/tcg/tcg-opc.h b/include/tcg/tcg-opc.h
index 1acdd7cfda..aa9ed393c9 100644
--- a/include/tcg/tcg-opc.h
+++ b/include/tcg/tcg-opc.h
@@ -44,6 +44,7 @@ DEF(and, 1, 2, 0, TCG_OPF_INT)
 DEF(andc, 1, 2, 0, TCG_OPF_INT)
 DEF(eqv, 1, 2, 0, TCG_OPF_INT)
 DEF(nand, 1, 2, 0, TCG_OPF_INT)
+DEF(nor, 1, 2, 0, TCG_OPF_INT)
 DEF(or, 1, 2, 0, TCG_OPF_INT)
 DEF(orc, 1, 2, 0, TCG_OPF_INT)
 DEF(xor, 1, 2, 0, TCG_OPF_INT)
@@ -95,7 +96,6 @@ DEF(bswap16_i32, 1, 1, 1, 0)
 DEF(bswap32_i32, 1, 1, 1, 0)
 DEF(not_i32, 1, 1, 0, 0)
 DEF(neg_i32, 1, 1, 0, 0)
-DEF(nor_i32, 1, 2, 0, 0)
 DEF(clz_i32, 1, 2, 0, 0)
 DEF(ctz_i32, 1, 2, 0, 0)
 DEF(ctpop_i32, 1, 1, 0, 0)
@@ -147,7 +147,6 @@ DEF(bswap32_i64, 1, 1, 1, 0)
 DEF(bswap64_i64, 1, 1, 1, 0)
 DEF(not_i64, 1, 1, 0, 0)
 DEF(neg_i64, 1, 1, 0, 0)
-DEF(nor_i64, 1, 2, 0, 0)
 DEF(clz_i64, 1, 2, 0, 0)
 DEF(ctz_i64, 1, 2, 0, 0)
 DEF(ctpop_i64, 1, 1, 0, 0)
diff --git a/tcg/optimize.c b/tcg/optimize.c
index e8e6a0c2ce..e4c319fe45 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -497,7 +497,8 @@ static uint64_t do_constant_folding_2(TCGOpcode op, uint64_t x, uint64_t y)
     case INDEX_op_nand_vec:
         return ~(x & y);
 
-    CASE_OP_32_64_VEC(nor):
+    case INDEX_op_nor:
+    case INDEX_op_nor_vec:
         return ~(x | y);
 
     case INDEX_op_clz_i32:
@@ -3000,7 +3001,8 @@ void tcg_optimize(TCGContext *s)
         CASE_OP_32_64(neg):
             done = fold_neg(&ctx, op);
             break;
-        CASE_OP_32_64_VEC(nor):
+        case INDEX_op_nor:
+        case INDEX_op_nor_vec:
             done = fold_nor(&ctx, op);
             break;
         CASE_OP_32_64_VEC(not):
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index ac939bb4ea..228aa8f088 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -700,8 +700,8 @@ void tcg_gen_nand_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 
 void tcg_gen_nor_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 {
-    if (tcg_op_supported(INDEX_op_nor_i32, TCG_TYPE_I32, 0)) {
-        tcg_gen_op3_i32(INDEX_op_nor_i32, ret, arg1, arg2);
+    if (tcg_op_supported(INDEX_op_nor, TCG_TYPE_I32, 0)) {
+        tcg_gen_op3_i32(INDEX_op_nor, ret, arg1, arg2);
     } else {
         tcg_gen_or_i32(ret, arg1, arg2);
         tcg_gen_not_i32(ret, ret);
@@ -2305,8 +2305,8 @@ void tcg_gen_nor_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
     if (TCG_TARGET_REG_BITS == 32) {
         tcg_gen_nor_i32(TCGV_LOW(ret), TCGV_LOW(arg1), TCGV_LOW(arg2));
         tcg_gen_nor_i32(TCGV_HIGH(ret), TCGV_HIGH(arg1), TCGV_HIGH(arg2));
-    } else if (tcg_op_supported(INDEX_op_nor_i64, TCG_TYPE_I64, 0)) {
-        tcg_gen_op3_i64(INDEX_op_nor_i64, ret, arg1, arg2);
+    } else if (tcg_op_supported(INDEX_op_nor, TCG_TYPE_I64, 0)) {
+        tcg_gen_op3_i64(INDEX_op_nor, ret, arg1, arg2);
     } else {
         tcg_gen_or_i64(ret, arg1, arg2);
         tcg_gen_not_i64(ret, ret);
diff --git a/tcg/tcg.c b/tcg/tcg.c
index d9807b77dc..c0178030ce 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1009,8 +1009,7 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_andc, TCGOutOpBinary, outop_andc),
     OUTOP(INDEX_op_eqv, TCGOutOpBinary, outop_eqv),
     OUTOP(INDEX_op_nand, TCGOutOpBinary, outop_nand),
-    OUTOP(INDEX_op_nor_i32, TCGOutOpBinary, outop_nor),
-    OUTOP(INDEX_op_nor_i64, TCGOutOpBinary, outop_nor),
+    OUTOP(INDEX_op_nor, TCGOutOpBinary, outop_nor),
     OUTOP(INDEX_op_or, TCGOutOpBinary, outop_or),
     OUTOP(INDEX_op_orc, TCGOutOpBinary, outop_orc),
     OUTOP(INDEX_op_xor, TCGOutOpBinary, outop_xor),
@@ -5432,8 +5431,7 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
     case INDEX_op_andc:
     case INDEX_op_eqv:
     case INDEX_op_nand:
-    case INDEX_op_nor_i32:
-    case INDEX_op_nor_i64:
+    case INDEX_op_nor:
     case INDEX_op_or:
     case INDEX_op_orc:
     case INDEX_op_xor:
diff --git a/tcg/tci.c b/tcg/tci.c
index 3ea93fa5a6..ff129266c2 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -563,7 +563,7 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = ~(regs[r1] & regs[r2]);
             break;
-        CASE_32_64(nor)
+        case INDEX_op_nor:
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = ~(regs[r1] | regs[r2]);
             break;
@@ -1077,6 +1077,7 @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
     case INDEX_op_andc:
     case INDEX_op_eqv:
     case INDEX_op_nand:
+    case INDEX_op_nor:
     case INDEX_op_or:
     case INDEX_op_orc:
     case INDEX_op_xor:
@@ -1084,8 +1085,6 @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
     case INDEX_op_sub_i64:
     case INDEX_op_mul_i32:
     case INDEX_op_mul_i64:
-    case INDEX_op_nor_i32:
-    case INDEX_op_nor_i64:
     case INDEX_op_div_i32:
     case INDEX_op_div_i64:
     case INDEX_op_rem_i32:
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index a0f4c58be8..dec51692f0 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -681,7 +681,7 @@ static const TCGOutOpBinary outop_nand = {
 static void tgen_nor(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
-    tcg_out_op_rrr(s, glue(INDEX_op_nor_i,TCG_TARGET_REG_BITS), a0, a1, a2);
+    tcg_out_op_rrr(s, INDEX_op_nor, a0, a1, a2);
 }
 
 static const TCGOutOpBinary outop_nor = {

From a3b37bc6faafe5932739c997b2b34a8f6dd57bfd Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 2 Jan 2025 13:25:15 -0800
Subject: [PATCH 0387/2760] tcg/arm: Fix constraints for sub
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In 7536b82d288 we lost the rI constraint that allowed the use of
RSB to perform reg = imm - reg.  At the same time, drop support
for reg = reg - imm, which is now transformed generically to
addition, and need not be handled by the backend.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/arm/tcg-target-con-set.h |  1 +
 tcg/arm/tcg-target.c.inc     | 11 ++++-------
 2 files changed, 5 insertions(+), 7 deletions(-)

diff --git a/tcg/arm/tcg-target-con-set.h b/tcg/arm/tcg-target-con-set.h
index 229ae258ac..f46a8444fb 100644
--- a/tcg/arm/tcg-target-con-set.h
+++ b/tcg/arm/tcg-target-con-set.h
@@ -30,6 +30,7 @@ C_O1_I2(r, r, rI)
 C_O1_I2(r, r, rIK)
 C_O1_I2(r, r, rIN)
 C_O1_I2(r, r, ri)
+C_O1_I2(r, rI, r)
 C_O1_I2(r, rZ, rZ)
 C_O1_I2(w, 0, w)
 C_O1_I2(w, w, w)
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index 8e9edeb7c6..47c09ff2b1 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -1984,12 +1984,8 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         break;
     case INDEX_op_sub_i32:
         if (const_args[1]) {
-            if (const_args[2]) {
-                tcg_out_movi32(s, COND_AL, args[0], args[1] - args[2]);
-            } else {
-                tcg_out_dat_rI(s, COND_AL, ARITH_RSB,
-                               args[0], args[2], args[1], 1);
-            }
+            tcg_out_dat_imm(s, COND_AL, ARITH_RSB,
+                            args[0], args[2], encode_imm_nofail(args[1]));
         } else {
             tcg_out_dat_rIN(s, COND_AL, ARITH_SUB, ARITH_ADD,
                             args[0], args[1], args[2], const_args[2]);
@@ -2234,10 +2230,11 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i32:
         return C_O0_I2(r, r);
 
-    case INDEX_op_sub_i32:
     case INDEX_op_setcond_i32:
     case INDEX_op_negsetcond_i32:
         return C_O1_I2(r, r, rIN);
+    case INDEX_op_sub_i32:
+        return C_O1_I2(r, rI, r);
 
     case INDEX_op_clz_i32:
     case INDEX_op_ctz_i32:

From 3f057e24006fbc5eaf42278ba9368d383a1c7bed Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 6 Jan 2025 21:57:43 -0800
Subject: [PATCH 0388/2760] tcg: Convert sub to TCGOutOpSubtract

Create a special subclass for sub, because two backends can
support "subtract from immediate".  Drop all backend support
for an immediate as the second operand, as we transform sub
to add during optimize.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target.c.inc     | 24 +++++++--------
 tcg/arm/tcg-target.c.inc         | 29 +++++++++++-------
 tcg/i386/tcg-target.c.inc        | 23 +++++++-------
 tcg/loongarch64/tcg-target.c.inc | 32 +++++++++-----------
 tcg/mips/tcg-target-con-set.h    |  1 -
 tcg/mips/tcg-target.c.inc        | 31 ++++++++-----------
 tcg/ppc/tcg-target-con-set.h     |  3 +-
 tcg/ppc/tcg-target.c.inc         | 52 +++++++++++---------------------
 tcg/riscv/tcg-target-con-set.h   |  1 -
 tcg/riscv/tcg-target-con-str.h   |  1 -
 tcg/riscv/tcg-target.c.inc       | 45 +++++++++------------------
 tcg/s390x/tcg-target.c.inc       | 41 +++++++++++--------------
 tcg/sparc64/tcg-target.c.inc     | 16 +++++++---
 tcg/tcg.c                        | 30 ++++++++++++++++--
 tcg/tci/tcg-target.c.inc         | 14 +++++++--
 15 files changed, 169 insertions(+), 174 deletions(-)

diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index 30cad937b7..dfe67c1261 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -2205,6 +2205,17 @@ static const TCGOutOpBinary outop_orc = {
     .out_rrr = tgen_orc,
 };
 
+static void tgen_sub(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_insn(s, 3502, SUB, type, a0, a1, a2);
+}
+
+static const TCGOutOpSubtract outop_sub = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_sub,
+};
+
 static void tgen_xor(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -2290,15 +2301,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType ext,
         tcg_out_ldst(s, I3312_STRX, a0, a1, a2, 3);
         break;
 
-    case INDEX_op_sub_i32:
-    case INDEX_op_sub_i64:
-        if (c2) {
-            tgen_addi(s, ext, a0, a1, -a2);
-        } else {
-            tcg_out_insn(s, 3502, SUB, ext, a0, a1, a2);
-        }
-        break;
-
     case INDEX_op_neg_i64:
     case INDEX_op_neg_i32:
         tcg_out_insn(s, 3502, SUB, ext, a0, TCG_REG_XZR, a1);
@@ -3014,10 +3016,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(rz, r);
 
-    case INDEX_op_sub_i32:
-    case INDEX_op_sub_i64:
-        return C_O1_I2(r, r, rA);
-
     case INDEX_op_setcond_i32:
     case INDEX_op_setcond_i64:
     case INDEX_op_negsetcond_i32:
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index 47c09ff2b1..13b78f0ada 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -1915,6 +1915,24 @@ static const TCGOutOpBinary outop_orc = {
     .base.static_constraint = C_NotImplemented,
 };
 
+static void tgen_sub(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_dat_reg(s, COND_AL, ARITH_SUB, a0, a1, a2, SHIFT_IMM_LSL(0));
+}
+
+static void tgen_subfi(TCGContext *s, TCGType type,
+                       TCGReg a0, tcg_target_long a1, TCGReg a2)
+{
+    tcg_out_dat_imm(s, COND_AL, ARITH_RSB, a0, a2, encode_imm_nofail(a1));
+}
+
+static const TCGOutOpSubtract outop_sub = {
+    .base.static_constraint = C_O1_I2(r, rI, r),
+    .out_rrr = tgen_sub,
+    .out_rir = tgen_subfi,
+};
+
 static void tgen_xor(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -1982,15 +2000,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_dat_rIK(s, tcg_cond_to_arm_cond[c], ARITH_MOV,
                         ARITH_MVN, args[0], 0, args[3], const_args[3]);
         break;
-    case INDEX_op_sub_i32:
-        if (const_args[1]) {
-            tcg_out_dat_imm(s, COND_AL, ARITH_RSB,
-                            args[0], args[2], encode_imm_nofail(args[1]));
-        } else {
-            tcg_out_dat_rIN(s, COND_AL, ARITH_SUB, ARITH_ADD,
-                            args[0], args[1], args[2], const_args[2]);
-        }
-        break;
     case INDEX_op_add2_i32:
         a0 = args[0], a1 = args[1], a2 = args[2];
         a3 = args[3], a4 = args[4], a5 = args[5];
@@ -2233,8 +2242,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_setcond_i32:
     case INDEX_op_negsetcond_i32:
         return C_O1_I2(r, r, rIN);
-    case INDEX_op_sub_i32:
-        return C_O1_I2(r, rI, r);
 
     case INDEX_op_clz_i32:
     case INDEX_op_ctz_i32:
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index 9185f6879c..104f1b010a 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -2669,6 +2669,18 @@ static const TCGOutOpBinary outop_orc = {
     .base.static_constraint = C_NotImplemented,
 };
 
+static void tgen_sub(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    int rexw = type == TCG_TYPE_I32 ? 0 : P_REXW;
+    tgen_arithr(s, ARITH_SUB + rexw, a0, a2);
+}
+
+static const TCGOutOpSubtract outop_sub = {
+    .base.static_constraint = C_O1_I2(r, 0, r),
+    .out_rrr = tgen_sub,
+};
+
 static void tgen_xor(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -2770,15 +2782,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    OP_32_64(sub):
-        c = ARITH_SUB;
-        if (const_a2) {
-            tgen_arithi(s, c + rexw, a0, a2, 0);
-        } else {
-            tgen_arithr(s, c + rexw, a0, a2);
-        }
-        break;
-
     OP_32_64(mul):
         if (const_a2) {
             int32_t val;
@@ -3689,8 +3692,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(re, r);
 
-    case INDEX_op_sub_i32:
-    case INDEX_op_sub_i64:
     case INDEX_op_mul_i32:
     case INDEX_op_mul_i64:
         return C_O1_I2(r, 0, re);
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index dc4ed0e8b0..f01b19463b 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -1376,6 +1376,21 @@ static const TCGOutOpBinary outop_orc = {
     .out_rrr = tgen_orc,
 };
 
+static void tgen_sub(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    if (type == TCG_TYPE_I32) {
+        tcg_out_opc_sub_w(s, a0, a1, a2);
+    } else {
+        tcg_out_opc_sub_d(s, a0, a1, a2);
+    }
+}
+
+static const TCGOutOpSubtract outop_sub = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_sub,
+};
+
 static void tgen_xor(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -1596,21 +1611,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    case INDEX_op_sub_i32:
-        if (c2) {
-            tcg_out_addi(s, TCG_TYPE_I32, a0, a1, -a2);
-        } else {
-            tcg_out_opc_sub_w(s, a0, a1, a2);
-        }
-        break;
-    case INDEX_op_sub_i64:
-        if (c2) {
-            tcg_out_addi(s, TCG_TYPE_I64, a0, a1, -a2);
-        } else {
-            tcg_out_opc_sub_d(s, a0, a1, a2);
-        }
-        break;
-
     case INDEX_op_neg_i32:
         tcg_out_opc_sub_w(s, a0, TCG_REG_ZERO, a1);
         break;
@@ -2324,10 +2324,8 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
         /* Must deposit into the same register as input */
         return C_O1_I2(r, 0, rz);
 
-    case INDEX_op_sub_i32:
     case INDEX_op_setcond_i32:
         return C_O1_I2(r, rz, ri);
-    case INDEX_op_sub_i64:
     case INDEX_op_setcond_i64:
         return C_O1_I2(r, rz, rJ);
 
diff --git a/tcg/mips/tcg-target-con-set.h b/tcg/mips/tcg-target-con-set.h
index 06ab04cc4d..248bc95d9b 100644
--- a/tcg/mips/tcg-target-con-set.h
+++ b/tcg/mips/tcg-target-con-set.h
@@ -24,7 +24,6 @@ C_O1_I2(r, r, rI)
 C_O1_I2(r, r, rIK)
 C_O1_I2(r, r, rJ)
 C_O1_I2(r, r, rzW)
-C_O1_I2(r, rz, rN)
 C_O1_I2(r, rz, rz)
 C_O1_I4(r, rz, rz, rz, 0)
 C_O1_I4(r, rz, rz, rz, rz)
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index bfe329b3ef..15c5661fb8 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -1753,6 +1753,18 @@ static const TCGOutOpBinary outop_orc = {
     .base.static_constraint = C_NotImplemented,
 };
 
+static void tgen_sub(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    MIPSInsn insn = type == TCG_TYPE_I32 ? OPC_SUBU : OPC_DSUBU;
+    tcg_out_opc_reg(s, insn, a0, a1, a2);
+}
+
+static const TCGOutOpSubtract outop_sub = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_sub,
+};
+
 static void tgen_xor(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -1844,22 +1856,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_ldst(s, i1, a0, a1, a2);
         break;
 
-    do_binaryv:
-        tcg_out_opc_reg(s, i1, a0, a1, a2);
-        break;
-
-    case INDEX_op_sub_i32:
-        i1 = OPC_SUBU, i2 = OPC_ADDIU;
-        goto do_subtract;
-    case INDEX_op_sub_i64:
-        i1 = OPC_DSUBU, i2 = OPC_DADDIU;
-    do_subtract:
-        if (c2) {
-            tcg_out_opc_imm(s, i2, a0, a1, -a2);
-            break;
-        }
-        goto do_binaryv;
-
     case INDEX_op_mul_i32:
         if (use_mips32_instructions) {
             tcg_out_opc_reg(s, OPC_MUL, a0, a1, a2);
@@ -2234,9 +2230,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(rz, r);
 
-    case INDEX_op_sub_i32:
-    case INDEX_op_sub_i64:
-        return C_O1_I2(r, rz, rN);
     case INDEX_op_mul_i32:
     case INDEX_op_mulsh_i32:
     case INDEX_op_muluh_i32:
diff --git a/tcg/ppc/tcg-target-con-set.h b/tcg/ppc/tcg-target-con-set.h
index 453abde6c1..77a1038d51 100644
--- a/tcg/ppc/tcg-target-con-set.h
+++ b/tcg/ppc/tcg-target-con-set.h
@@ -22,8 +22,7 @@ C_O1_I1(v, r)
 C_O1_I1(v, v)
 C_O1_I1(v, vr)
 C_O1_I2(r, 0, rZ)
-C_O1_I2(r, rI, ri)
-C_O1_I2(r, rI, rT)
+C_O1_I2(r, rI, r)
 C_O1_I2(r, r, r)
 C_O1_I2(r, r, ri)
 C_O1_I2(r, r, rC)
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index c3366e4316..bfbfdc2dfa 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -3016,6 +3016,24 @@ static const TCGOutOpBinary outop_orc = {
     .out_rrr = tgen_orc,
 };
 
+static void tgen_sub(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out32(s, SUBF | TAB(a0, a2, a1));
+}
+
+static void tgen_subfi(TCGContext *s, TCGType type,
+                       TCGReg a0, tcg_target_long a1, TCGReg a2)
+{
+    tcg_out32(s, SUBFIC | TAI(a0, a2, a1));
+}
+
+static const TCGOutOpSubtract outop_sub = {
+    .base.static_constraint = C_O1_I2(r, rI, r),
+    .out_rrr = tgen_sub,
+    .out_rir = tgen_subfi,
+};
+
 static void tgen_xor(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -3104,21 +3122,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_mem_long(s, STD, STDX, args[0], args[1], args[2]);
         break;
 
-    case INDEX_op_sub_i32:
-        a0 = args[0], a1 = args[1], a2 = args[2];
-        if (const_args[1]) {
-            if (const_args[2]) {
-                tcg_out_movi(s, TCG_TYPE_I32, a0, a1 - a2);
-            } else {
-                tcg_out32(s, SUBFIC | TAI(a0, a2, a1));
-            }
-        } else if (const_args[2]) {
-            tgen_addi(s, type, a0, a1, (int32_t)-a2);
-        } else {
-            tcg_out32(s, SUBF | TAB(a0, a2, a1));
-        }
-        break;
-
     case INDEX_op_clz_i32:
         tcg_out_cntxz(s, TCG_TYPE_I32, CNTLZW, args[0], args[1],
                       args[2], const_args[2]);
@@ -3231,21 +3234,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out32(s, NOR | SAB(args[1], args[0], args[1]));
         break;
 
-    case INDEX_op_sub_i64:
-        a0 = args[0], a1 = args[1], a2 = args[2];
-        if (const_args[1]) {
-            if (const_args[2]) {
-                tcg_out_movi(s, TCG_TYPE_I64, a0, a1 - a2);
-            } else {
-                tcg_out32(s, SUBFIC | TAI(a0, a2, a1));
-            }
-        } else if (const_args[2]) {
-            tgen_addi(s, type, a0, a1, -a2);
-        } else {
-            tcg_out32(s, SUBF | TAB(a0, a2, a1));
-        }
-        break;
-
     case INDEX_op_shl_i64:
         if (const_args[2]) {
             /* Limit immediate shift count lest we create an illegal insn.  */
@@ -4195,10 +4183,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_muluh_i64:
         return C_O1_I2(r, r, r);
 
-    case INDEX_op_sub_i32:
-        return C_O1_I2(r, rI, ri);
-    case INDEX_op_sub_i64:
-        return C_O1_I2(r, rI, rT);
     case INDEX_op_clz_i32:
     case INDEX_op_ctz_i32:
     case INDEX_op_clz_i64:
diff --git a/tcg/riscv/tcg-target-con-set.h b/tcg/riscv/tcg-target-con-set.h
index 21f8833b3b..f3a6f7a7ed 100644
--- a/tcg/riscv/tcg-target-con-set.h
+++ b/tcg/riscv/tcg-target-con-set.h
@@ -16,7 +16,6 @@ C_O1_I1(r, r)
 C_O1_I2(r, r, r)
 C_O1_I2(r, r, ri)
 C_O1_I2(r, r, rI)
-C_O1_I2(r, rz, rN)
 C_O1_I2(r, rz, rz)
 C_N1_I2(r, r, rM)
 C_O1_I4(r, r, rI, rM, rM)
diff --git a/tcg/riscv/tcg-target-con-str.h b/tcg/riscv/tcg-target-con-str.h
index 1956f75f9a..c04e15ddfa 100644
--- a/tcg/riscv/tcg-target-con-str.h
+++ b/tcg/riscv/tcg-target-con-str.h
@@ -18,5 +18,4 @@ REGS('v', ALL_VECTOR_REGS)
 CONST('I', TCG_CT_CONST_S12)
 CONST('K', TCG_CT_CONST_S5)
 CONST('L', TCG_CT_CONST_CMP_VI)
-CONST('N', TCG_CT_CONST_N12)
 CONST('M', TCG_CT_CONST_M12)
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index 887f20d4cb..54da432ab1 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -113,10 +113,9 @@ static TCGReg tcg_target_call_oarg_reg(TCGCallReturnKind kind, int slot)
 }
 
 #define TCG_CT_CONST_S12     0x100
-#define TCG_CT_CONST_N12     0x200
-#define TCG_CT_CONST_M12     0x400
-#define TCG_CT_CONST_S5      0x800
-#define TCG_CT_CONST_CMP_VI 0x1000
+#define TCG_CT_CONST_M12     0x200
+#define TCG_CT_CONST_S5      0x400
+#define TCG_CT_CONST_CMP_VI  0x800
 
 #define ALL_GENERAL_REGS   MAKE_64BIT_MASK(0, 32)
 #define ALL_VECTOR_REGS    MAKE_64BIT_MASK(32, 32)
@@ -400,13 +399,6 @@ static bool tcg_target_const_match(int64_t val, int ct,
     if ((ct & TCG_CT_CONST_S12) && val >= -0x800 && val <= 0x7ff) {
         return 1;
     }
-    /*
-     * Sign extended from 12 bits, negated: [-0x7ff, 0x800].
-     * Used for subtraction, where a constant must be handled by ADDI.
-     */
-    if ((ct & TCG_CT_CONST_N12) && val >= -0x7ff && val <= 0x800) {
-        return 1;
-    }
     /*
      * Sign extended from 12 bits, +/- matching: [-0x7ff, 0x7ff].
      * Used by addsub2 and movcond, which may need the negative value,
@@ -2055,6 +2047,18 @@ static const TCGOutOpBinary outop_orc = {
     .out_rrr = tgen_orc,
 };
 
+static void tgen_sub(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    RISCVInsn insn = type == TCG_TYPE_I32 ? OPC_SUBW : OPC_SUB;
+    tcg_out_opc_reg(s, insn, a0, a1, a2);
+}
+
+static const TCGOutOpSubtract outop_sub = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_sub,
+};
+
 static void tgen_xor(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -2136,21 +2140,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_ldst(s, OPC_SD, a0, a1, a2);
         break;
 
-    case INDEX_op_sub_i32:
-        if (c2) {
-            tcg_out_opc_imm(s, OPC_ADDIW, a0, a1, -a2);
-        } else {
-            tcg_out_opc_reg(s, OPC_SUBW, a0, a1, a2);
-        }
-        break;
-    case INDEX_op_sub_i64:
-        if (c2) {
-            tcg_out_opc_imm(s, OPC_ADDI, a0, a1, -a2);
-        } else {
-            tcg_out_opc_reg(s, OPC_SUB, a0, a1, a2);
-        }
-        break;
-
     case INDEX_op_not_i32:
     case INDEX_op_not_i64:
         tcg_out_opc_imm(s, OPC_XORI, a0, a1, -1);
@@ -2713,10 +2702,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_negsetcond_i64:
         return C_O1_I2(r, r, rI);
 
-    case INDEX_op_sub_i32:
-    case INDEX_op_sub_i64:
-        return C_O1_I2(r, rz, rN);
-
     case INDEX_op_mul_i32:
     case INDEX_op_mulsh_i32:
     case INDEX_op_muluh_i32:
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index 29570d3be1..662984f733 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -2331,6 +2331,23 @@ static const TCGOutOpBinary outop_orc = {
     .out_rrr = tgen_orc,
 };
 
+static void tgen_sub(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    if (type != TCG_TYPE_I32) {
+        tcg_out_insn(s, RRFa, SGRK, a0, a1, a2);
+    } else if (a0 == a1) {
+        tcg_out_insn(s, RR, SR, a0, a2);
+    } else {
+        tcg_out_insn(s, RRFa, SRK, a0, a1, a2);
+    }
+}
+
+static const TCGOutOpSubtract outop_sub = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_sub,
+};
+
 static void tgen_xor(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -2413,17 +2430,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_st(s, TCG_TYPE_I32, args[0], args[1], args[2]);
         break;
 
-    case INDEX_op_sub_i32:
-        a0 = args[0], a1 = args[1], a2 = args[2];
-        if (const_args[2]) {
-            tgen_addi(s, type, a0, a1, (int32_t)-a2);
-        } else if (a0 == a1) {
-            tcg_out_insn(s, RR, SR, a0, a2);
-        } else {
-            tcg_out_insn(s, RRFa, SRK, a0, a1, a2);
-        }
-        break;
-
     case INDEX_op_neg_i32:
         tcg_out_insn(s, RR, LCR, args[0], args[1]);
         break;
@@ -2618,15 +2624,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_st(s, TCG_TYPE_I64, args[0], args[1], args[2]);
         break;
 
-    case INDEX_op_sub_i64:
-        a0 = args[0], a1 = args[1], a2 = args[2];
-        if (const_args[2]) {
-            tgen_addi(s, type, a0, a1, -a2);
-        } else {
-            tcg_out_insn(s, RRFa, SGRK, a0, a1, a2);
-        }
-        break;
-
     case INDEX_op_neg_i64:
         tcg_out_insn(s, RRE, LCGR, args[0], args[1]);
         break;
@@ -3302,10 +3299,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_clz_i64:
         return C_O1_I2(r, r, rI);
 
-    case INDEX_op_sub_i32:
-    case INDEX_op_sub_i64:
-        return C_O1_I2(r, r, ri);
-
     case INDEX_op_mul_i32:
         return (HAVE_FACILITY(MISC_INSN_EXT2)
                 ? C_O1_I2(r, r, ri)
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index 1ebff04af4..04b2b3b195 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -1374,6 +1374,17 @@ static const TCGOutOpBinary outop_orc = {
     .out_rrr = tgen_orc,
 };
 
+static void tgen_sub(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_arith(s, a0, a1, a2, ARITH_SUB);
+}
+
+static const TCGOutOpSubtract outop_sub = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_sub,
+};
+
 static void tgen_xor(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -1446,9 +1457,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     case INDEX_op_st32_i64:
         tcg_out_ldst(s, a0, a1, a2, STW);
         break;
-    OP_32_64(sub):
-        c = ARITH_SUB;
-        goto gen_arith;
     case INDEX_op_shl_i32:
         c = SHIFT_SLL;
     do_shift32:
@@ -1660,8 +1668,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_div_i64:
     case INDEX_op_divu_i32:
     case INDEX_op_divu_i64:
-    case INDEX_op_sub_i32:
-    case INDEX_op_sub_i64:
     case INDEX_op_shl_i32:
     case INDEX_op_shl_i64:
     case INDEX_op_shr_i32:
diff --git a/tcg/tcg.c b/tcg/tcg.c
index c0178030ce..d7a44ac1b1 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -986,6 +986,14 @@ typedef struct TCGOutOpBinary {
                     TCGReg a0, TCGReg a1, tcg_target_long a2);
 } TCGOutOpBinary;
 
+typedef struct TCGOutOpSubtract {
+    TCGOutOp base;
+    void (*out_rrr)(TCGContext *s, TCGType type,
+                    TCGReg a0, TCGReg a1, TCGReg a2);
+    void (*out_rir)(TCGContext *s, TCGType type,
+                    TCGReg a0, tcg_target_long a1, TCGReg a2);
+} TCGOutOpSubtract;
+
 #include "tcg-target.c.inc"
 
 #ifndef CONFIG_TCG_INTERPRETER
@@ -1012,6 +1020,8 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_nor, TCGOutOpBinary, outop_nor),
     OUTOP(INDEX_op_or, TCGOutOpBinary, outop_or),
     OUTOP(INDEX_op_orc, TCGOutOpBinary, outop_orc),
+    OUTOP(INDEX_op_sub_i32, TCGOutOpSubtract, outop_sub),
+    OUTOP(INDEX_op_sub_i64, TCGOutOpSubtract, outop_sub),
     OUTOP(INDEX_op_xor, TCGOutOpBinary, outop_xor),
 };
 
@@ -2231,7 +2241,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st8_i32:
     case INDEX_op_st16_i32:
     case INDEX_op_st_i32:
-    case INDEX_op_sub_i32:
     case INDEX_op_neg_i32:
     case INDEX_op_mul_i32:
     case INDEX_op_shl_i32:
@@ -2301,7 +2310,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st16_i64:
     case INDEX_op_st32_i64:
     case INDEX_op_st_i64:
-    case INDEX_op_sub_i64:
     case INDEX_op_neg_i64:
     case INDEX_op_mul_i64:
     case INDEX_op_shl_i64:
@@ -5449,6 +5457,24 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
         }
         break;
 
+    case INDEX_op_sub_i32:
+    case INDEX_op_sub_i64:
+        {
+            const TCGOutOpSubtract *out = &outop_sub;
+
+            /*
+             * Constants should never appear in the second source operand.
+             * These are folded to add with negative constant.
+             */
+            tcg_debug_assert(!const_args[2]);
+            if (const_args[1]) {
+                out->out_rir(s, type, new_args[0], new_args[1], new_args[2]);
+            } else {
+                out->out_rrr(s, type, new_args[0], new_args[1], new_args[2]);
+            }
+        }
+        break;
+
     default:
         if (def->flags & TCG_OPF_VECTOR) {
             tcg_out_vec_op(s, op->opc, type - TCG_TYPE_V64,
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index dec51692f0..353994e83f 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -91,8 +91,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_rem_i64:
     case INDEX_op_remu_i32:
     case INDEX_op_remu_i64:
-    case INDEX_op_sub_i32:
-    case INDEX_op_sub_i64:
     case INDEX_op_mul_i32:
     case INDEX_op_mul_i64:
     case INDEX_op_shl_i32:
@@ -711,6 +709,17 @@ static const TCGOutOpBinary outop_orc = {
     .out_rrr = tgen_orc,
 };
 
+static void tgen_sub(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_op_rrr(s, glue(INDEX_op_sub_i,TCG_TARGET_REG_BITS), a0, a1, a2);
+}
+
+static const TCGOutOpSubtract outop_sub = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_sub,
+};
+
 static void tgen_xor(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -764,7 +773,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_ldst(s, opc, args[0], args[1], args[2]);
         break;
 
-    CASE_32_64(sub)
     CASE_32_64(mul)
     CASE_32_64(shl)
     CASE_32_64(shr)

From 60f34f55f1a708c071774bd7f837163d6b686867 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 6 Jan 2025 22:06:32 -0800
Subject: [PATCH 0389/2760] tcg: Merge INDEX_op_sub_{i32,i64}
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 docs/devel/tcg-ops.rst   |  2 +-
 include/tcg/tcg-opc.h    |  3 +--
 tcg/optimize.c           |  4 ++--
 tcg/tcg-op.c             |  4 ++--
 tcg/tcg.c                | 10 +++-------
 tcg/tci.c                |  5 ++---
 tcg/tci/tcg-target.c.inc |  2 +-
 7 files changed, 12 insertions(+), 18 deletions(-)

diff --git a/docs/devel/tcg-ops.rst b/docs/devel/tcg-ops.rst
index 26d464fa38..96b7f05919 100644
--- a/docs/devel/tcg-ops.rst
+++ b/docs/devel/tcg-ops.rst
@@ -265,7 +265,7 @@ Arithmetic
 
      - | *t0* = *t1* + *t2*
 
-   * - sub_i32/i64 *t0*, *t1*, *t2*
+   * - sub *t0*, *t1*, *t2*
 
      - | *t0* = *t1* - *t2*
 
diff --git a/include/tcg/tcg-opc.h b/include/tcg/tcg-opc.h
index aa9ed393c9..1be9b01caf 100644
--- a/include/tcg/tcg-opc.h
+++ b/include/tcg/tcg-opc.h
@@ -47,6 +47,7 @@ DEF(nand, 1, 2, 0, TCG_OPF_INT)
 DEF(nor, 1, 2, 0, TCG_OPF_INT)
 DEF(or, 1, 2, 0, TCG_OPF_INT)
 DEF(orc, 1, 2, 0, TCG_OPF_INT)
+DEF(sub, 1, 2, 0, TCG_OPF_INT)
 DEF(xor, 1, 2, 0, TCG_OPF_INT)
 
 DEF(setcond_i32, 1, 2, 1, 0)
@@ -62,7 +63,6 @@ DEF(st8_i32, 0, 2, 1, 0)
 DEF(st16_i32, 0, 2, 1, 0)
 DEF(st_i32, 0, 2, 1, 0)
 /* arith */
-DEF(sub_i32, 1, 2, 0, 0)
 DEF(mul_i32, 1, 2, 0, 0)
 DEF(div_i32, 1, 2, 0, 0)
 DEF(divu_i32, 1, 2, 0, 0)
@@ -116,7 +116,6 @@ DEF(st16_i64, 0, 2, 1, 0)
 DEF(st32_i64, 0, 2, 1, 0)
 DEF(st_i64, 0, 2, 1, 0)
 /* arith */
-DEF(sub_i64, 1, 2, 0, 0)
 DEF(mul_i64, 1, 2, 0, 0)
 DEF(div_i64, 1, 2, 0, 0)
 DEF(divu_i64, 1, 2, 0, 0)
diff --git a/tcg/optimize.c b/tcg/optimize.c
index e4c319fe45..718809ab8d 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -427,7 +427,7 @@ static uint64_t do_constant_folding_2(TCGOpcode op, uint64_t x, uint64_t y)
     case INDEX_op_add:
         return x + y;
 
-    CASE_OP_32_64(sub):
+    case INDEX_op_sub:
         return x - y;
 
     CASE_OP_32_64(mul):
@@ -3066,7 +3066,7 @@ void tcg_optimize(TCGContext *s)
         CASE_OP_32_64(sextract):
             done = fold_sextract(&ctx, op);
             break;
-        CASE_OP_32_64(sub):
+        case INDEX_op_sub:
             done = fold_sub(&ctx, op);
             break;
         case INDEX_op_sub_vec:
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index 228aa8f088..15faf4dc57 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -377,7 +377,7 @@ void tcg_gen_addi_i32(TCGv_i32 ret, TCGv_i32 arg1, int32_t arg2)
 
 void tcg_gen_sub_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 {
-    tcg_gen_op3_i32(INDEX_op_sub_i32, ret, arg1, arg2);
+    tcg_gen_op3_i32(INDEX_op_sub, ret, arg1, arg2);
 }
 
 void tcg_gen_subfi_i32(TCGv_i32 ret, int32_t arg1, TCGv_i32 arg2)
@@ -1565,7 +1565,7 @@ void tcg_gen_add_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
 void tcg_gen_sub_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
 {
     if (TCG_TARGET_REG_BITS == 64) {
-        tcg_gen_op3_i64(INDEX_op_sub_i64, ret, arg1, arg2);
+        tcg_gen_op3_i64(INDEX_op_sub, ret, arg1, arg2);
     } else {
         tcg_gen_sub2_i32(TCGV_LOW(ret), TCGV_HIGH(ret), TCGV_LOW(arg1),
                          TCGV_HIGH(arg1), TCGV_LOW(arg2), TCGV_HIGH(arg2));
diff --git a/tcg/tcg.c b/tcg/tcg.c
index d7a44ac1b1..b31e9798c5 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1020,8 +1020,7 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_nor, TCGOutOpBinary, outop_nor),
     OUTOP(INDEX_op_or, TCGOutOpBinary, outop_or),
     OUTOP(INDEX_op_orc, TCGOutOpBinary, outop_orc),
-    OUTOP(INDEX_op_sub_i32, TCGOutOpSubtract, outop_sub),
-    OUTOP(INDEX_op_sub_i64, TCGOutOpSubtract, outop_sub),
+    OUTOP(INDEX_op_sub, TCGOutOpSubtract, outop_sub),
     OUTOP(INDEX_op_xor, TCGOutOpBinary, outop_xor),
 };
 
@@ -4010,10 +4009,8 @@ liveness_pass_1(TCGContext *s)
             opc_new = INDEX_op_add;
             goto do_addsub2;
         case INDEX_op_sub2_i32:
-            opc_new = INDEX_op_sub_i32;
-            goto do_addsub2;
         case INDEX_op_sub2_i64:
-            opc_new = INDEX_op_sub_i64;
+            opc_new = INDEX_op_sub;
         do_addsub2:
             nb_iargs = 4;
             nb_oargs = 2;
@@ -5457,8 +5454,7 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
         }
         break;
 
-    case INDEX_op_sub_i32:
-    case INDEX_op_sub_i64:
+    case INDEX_op_sub:
         {
             const TCGOutOpSubtract *out = &outop_sub;
 
diff --git a/tcg/tci.c b/tcg/tci.c
index ff129266c2..508d1405cd 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -527,7 +527,7 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = regs[r1] + regs[r2];
             break;
-        CASE_32_64(sub)
+        case INDEX_op_sub:
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = regs[r1] - regs[r2];
             break;
@@ -1080,9 +1080,8 @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
     case INDEX_op_nor:
     case INDEX_op_or:
     case INDEX_op_orc:
+    case INDEX_op_sub:
     case INDEX_op_xor:
-    case INDEX_op_sub_i32:
-    case INDEX_op_sub_i64:
     case INDEX_op_mul_i32:
     case INDEX_op_mul_i64:
     case INDEX_op_div_i32:
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index 353994e83f..67a46c6321 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -712,7 +712,7 @@ static const TCGOutOpBinary outop_orc = {
 static void tgen_sub(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
-    tcg_out_op_rrr(s, glue(INDEX_op_sub_i,TCG_TARGET_REG_BITS), a0, a1, a2);
+    tcg_out_op_rrr(s, INDEX_op_sub, a0, a1, a2);
 }
 
 static const TCGOutOpSubtract outop_sub = {

From e126a91c38f85750d84cabf27f44c055e17ef6df Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 6 Jan 2025 22:37:07 -0800
Subject: [PATCH 0390/2760] tcg: Convert neg to TCGOutOpUnary
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target.c.inc     | 18 +++++++++++-------
 tcg/arm/tcg-target.c.inc         | 14 ++++++++++----
 tcg/i386/tcg-target.c.inc        | 16 +++++++++++-----
 tcg/loongarch64/tcg-target.c.inc | 19 ++++++++++---------
 tcg/mips/tcg-target.c.inc        | 18 ++++++++++--------
 tcg/ppc/tcg-target.c.inc         | 17 ++++++++++-------
 tcg/riscv/tcg-target.c.inc       | 19 ++++++++++---------
 tcg/s390x/tcg-target.c.inc       | 22 ++++++++++++++--------
 tcg/sparc64/tcg-target.c.inc     | 15 ++++++++++-----
 tcg/tcg.c                        | 21 +++++++++++++++++++--
 tcg/tci/tcg-target.c.inc         | 13 ++++++++++---
 11 files changed, 125 insertions(+), 67 deletions(-)

diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index dfe67c1261..cf7a3f2632 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -2235,6 +2235,17 @@ static const TCGOutOpBinary outop_xor = {
 };
 
 
+static void tgen_neg(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1)
+{
+    tgen_sub(s, type, a0, TCG_REG_XZR, a1);
+}
+
+static const TCGOutOpUnary outop_neg = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = tgen_neg,
+};
+
+
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType ext,
                        const TCGArg args[TCG_MAX_OP_ARGS],
                        const int const_args[TCG_MAX_OP_ARGS])
@@ -2301,11 +2312,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType ext,
         tcg_out_ldst(s, I3312_STRX, a0, a1, a2, 3);
         break;
 
-    case INDEX_op_neg_i64:
-    case INDEX_op_neg_i32:
-        tcg_out_insn(s, 3502, SUB, ext, a0, TCG_REG_XZR, a1);
-        break;
-
     case INDEX_op_not_i64:
     case INDEX_op_not_i32:
         tcg_out_insn(s, 3510, ORN, ext, a0, TCG_REG_XZR, a1);
@@ -2990,8 +2996,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld32u_i64:
     case INDEX_op_ld32s_i64:
     case INDEX_op_ld_i64:
-    case INDEX_op_neg_i32:
-    case INDEX_op_neg_i64:
     case INDEX_op_not_i32:
     case INDEX_op_not_i64:
     case INDEX_op_bswap16_i32:
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index 13b78f0ada..5ea4488606 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -1951,6 +1951,16 @@ static const TCGOutOpBinary outop_xor = {
     .out_rri = tgen_xori,
 };
 
+static void tgen_neg(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1)
+{
+    tgen_subfi(s, type, a0, 0, a1);
+}
+
+static const TCGOutOpUnary outop_neg = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = tgen_neg,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -2040,9 +2050,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         tcg_out_mov_reg(s, COND_AL, args[0], a0);
         break;
-    case INDEX_op_neg_i32:
-        tcg_out_dat_imm(s, COND_AL, ARITH_RSB, args[0], args[1], 0);
-        break;
     case INDEX_op_not_i32:
         tcg_out_dat_reg(s, COND_AL,
                         ARITH_MVN, args[0], 0, args[1], SHIFT_IMM_LSL(0));
@@ -2226,7 +2233,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld16u_i32:
     case INDEX_op_ld16s_i32:
     case INDEX_op_ld_i32:
-    case INDEX_op_neg_i32:
     case INDEX_op_not_i32:
     case INDEX_op_bswap16_i32:
     case INDEX_op_bswap32_i32:
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index 104f1b010a..082aa982fb 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -2701,6 +2701,17 @@ static const TCGOutOpBinary outop_xor = {
     .out_rri = tgen_xori,
 };
 
+static void tgen_neg(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1)
+{
+    int rexw = type == TCG_TYPE_I32 ? 0 : P_REXW;
+    tcg_out_modrm(s, OPC_GRP3_Ev + rexw, EXT3_NEG, a0);
+}
+
+static const TCGOutOpUnary outop_neg = {
+    .base.static_constraint = C_O1_I1(r, 0),
+    .out_rr = tgen_neg,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -2900,9 +2911,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    OP_32_64(neg):
-        tcg_out_modrm(s, OPC_GRP3_Ev + rexw, EXT3_NEG, a0);
-        break;
     OP_32_64(not):
         tcg_out_modrm(s, OPC_GRP3_Ev + rexw, EXT3_NOT, a0);
         break;
@@ -3719,8 +3727,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_bswap32_i32:
     case INDEX_op_bswap32_i64:
     case INDEX_op_bswap64_i64:
-    case INDEX_op_neg_i32:
-    case INDEX_op_neg_i64:
     case INDEX_op_not_i32:
     case INDEX_op_not_i64:
     case INDEX_op_extrh_i64_i32:
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index f01b19463b..31ec7262e0 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -1409,6 +1409,16 @@ static const TCGOutOpBinary outop_xor = {
     .out_rri = tgen_xori,
 };
 
+static void tgen_neg(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1)
+{
+    tgen_sub(s, type, a0, TCG_REG_ZERO, a1);
+}
+
+static const TCGOutOpUnary outop_neg = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = tgen_neg,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -1611,13 +1621,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    case INDEX_op_neg_i32:
-        tcg_out_opc_sub_w(s, a0, TCG_REG_ZERO, a1);
-        break;
-    case INDEX_op_neg_i64:
-        tcg_out_opc_sub_d(s, a0, TCG_REG_ZERO, a1);
-        break;
-
     case INDEX_op_mul_i32:
         tcg_out_opc_mul_w(s, a0, a1, a2);
         break;
@@ -2272,8 +2275,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_extrl_i64_i32:
     case INDEX_op_extrh_i64_i32:
     case INDEX_op_ext_i32_i64:
-    case INDEX_op_neg_i32:
-    case INDEX_op_neg_i64:
     case INDEX_op_not_i32:
     case INDEX_op_not_i64:
     case INDEX_op_extract_i32:
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index 15c5661fb8..0fda255a7b 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -1783,6 +1783,16 @@ static const TCGOutOpBinary outop_xor = {
     .out_rri = tgen_xori,
 };
 
+static void tgen_neg(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1)
+{
+    tgen_sub(s, type, a0, TCG_REG_ZERO, a1);
+}
+
+static const TCGOutOpUnary outop_neg = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = tgen_neg,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -1975,12 +1985,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_opc_reg(s, OPC_MFHI, a1, 0, 0);
         break;
 
-    case INDEX_op_neg_i32:
-        i1 = OPC_SUBU;
-        goto do_unary;
-    case INDEX_op_neg_i64:
-        i1 = OPC_DSUBU;
-        goto do_unary;
     case INDEX_op_not_i32:
     case INDEX_op_not_i64:
         i1 = OPC_NOR;
@@ -2195,7 +2199,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld16u_i32:
     case INDEX_op_ld16s_i32:
     case INDEX_op_ld_i32:
-    case INDEX_op_neg_i32:
     case INDEX_op_not_i32:
     case INDEX_op_bswap16_i32:
     case INDEX_op_bswap32_i32:
@@ -2208,7 +2211,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld32s_i64:
     case INDEX_op_ld32u_i64:
     case INDEX_op_ld_i64:
-    case INDEX_op_neg_i64:
     case INDEX_op_not_i64:
     case INDEX_op_bswap16_i64:
     case INDEX_op_bswap32_i64:
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index bfbfdc2dfa..da45436a5a 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -3052,6 +3052,16 @@ static const TCGOutOpBinary outop_xor = {
     .out_rri = tgen_xori,
 };
 
+static void tgen_neg(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1)
+{
+    tcg_out32(s, NEG | RT(a0) | RA(a1));
+}
+
+static const TCGOutOpUnary outop_neg = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = tgen_neg,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -3224,11 +3234,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_brcond2(s, args, const_args);
         break;
 
-    case INDEX_op_neg_i32:
-    case INDEX_op_neg_i64:
-        tcg_out32(s, NEG | RT(args[0]) | RA(args[1]));
-        break;
-
     case INDEX_op_not_i32:
     case INDEX_op_not_i64:
         tcg_out32(s, NOR | SAB(args[1], args[0], args[1]));
@@ -4119,7 +4124,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld16s_i32:
     case INDEX_op_ld_i32:
     case INDEX_op_ctpop_i32:
-    case INDEX_op_neg_i32:
     case INDEX_op_not_i32:
     case INDEX_op_bswap16_i32:
     case INDEX_op_bswap32_i32:
@@ -4133,7 +4137,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld32s_i64:
     case INDEX_op_ld_i64:
     case INDEX_op_ctpop_i64:
-    case INDEX_op_neg_i64:
     case INDEX_op_not_i64:
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index 54da432ab1..4e16c44aa5 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -2077,6 +2077,16 @@ static const TCGOutOpBinary outop_xor = {
     .out_rri = tgen_xori,
 };
 
+static void tgen_neg(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1)
+{
+    tgen_sub(s, type, a0, TCG_REG_ZERO, a1);
+}
+
+static const TCGOutOpUnary outop_neg = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = tgen_neg,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -2145,13 +2155,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_opc_imm(s, OPC_XORI, a0, a1, -1);
         break;
 
-    case INDEX_op_neg_i32:
-        tcg_out_opc_reg(s, OPC_SUBW, a0, TCG_REG_ZERO, a1);
-        break;
-    case INDEX_op_neg_i64:
-        tcg_out_opc_reg(s, OPC_SUB, a0, TCG_REG_ZERO, a1);
-        break;
-
     case INDEX_op_mul_i32:
         tcg_out_opc_reg(s, OPC_MULW, a0, a1, a2);
         break;
@@ -2660,7 +2663,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld16s_i32:
     case INDEX_op_ld_i32:
     case INDEX_op_not_i32:
-    case INDEX_op_neg_i32:
     case INDEX_op_ld8u_i64:
     case INDEX_op_ld8s_i64:
     case INDEX_op_ld16u_i64:
@@ -2669,7 +2671,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld32u_i64:
     case INDEX_op_ld_i64:
     case INDEX_op_not_i64:
-    case INDEX_op_neg_i64:
     case INDEX_op_extu_i32_i64:
     case INDEX_op_extrl_i64_i32:
     case INDEX_op_extrh_i64_i32:
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index 662984f733..08e65834d7 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -2373,6 +2373,20 @@ static const TCGOutOpBinary outop_xor = {
     .out_rri = tgen_xori_3,
 };
 
+static void tgen_neg(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1)
+{
+    if (type == TCG_TYPE_I32) {
+        tcg_out_insn(s, RR, LCR, a0, a1);
+    } else {
+        tcg_out_insn(s, RRE, LCGR, a0, a1);
+    }
+}
+
+static const TCGOutOpUnary outop_neg = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = tgen_neg,
+};
+
 
 # define OP_32_64(x) \
         case glue(glue(INDEX_op_,x),_i32): \
@@ -2430,9 +2444,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_st(s, TCG_TYPE_I32, args[0], args[1], args[2]);
         break;
 
-    case INDEX_op_neg_i32:
-        tcg_out_insn(s, RR, LCR, args[0], args[1]);
-        break;
     case INDEX_op_not_i32:
         tcg_out_insn(s, RRFa, NORK, args[0], args[1], args[1]);
         break;
@@ -2624,9 +2635,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_st(s, TCG_TYPE_I64, args[0], args[1], args[2]);
         break;
 
-    case INDEX_op_neg_i64:
-        tcg_out_insn(s, RRE, LCGR, args[0], args[1]);
-        break;
     case INDEX_op_not_i64:
         tcg_out_insn(s, RRFa, NOGRK, args[0], args[1], args[1]);
         break;
@@ -3323,8 +3331,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_bswap32_i32:
     case INDEX_op_bswap32_i64:
     case INDEX_op_bswap64_i64:
-    case INDEX_op_neg_i32:
-    case INDEX_op_neg_i64:
     case INDEX_op_not_i32:
     case INDEX_op_not_i64:
     case INDEX_op_ext_i32_i64:
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index 04b2b3b195..a3926ea1c3 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -1403,6 +1403,16 @@ static const TCGOutOpBinary outop_xor = {
     .out_rri = tgen_xori,
 };
 
+static void tgen_neg(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1)
+{
+     tgen_sub(s, type, a0, TCG_REG_G0, a1);
+}
+
+static const TCGOutOpUnary outop_neg = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = tgen_neg,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -1473,9 +1483,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         c = ARITH_UMUL;
         goto gen_arith;
 
-    OP_32_64(neg):
-	c = ARITH_SUB;
-	goto gen_arith1;
     OP_32_64(not):
 	c = ARITH_ORN;
 	goto gen_arith1;
@@ -1639,8 +1646,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld32u_i64:
     case INDEX_op_ld32s_i64:
     case INDEX_op_ld_i64:
-    case INDEX_op_neg_i32:
-    case INDEX_op_neg_i64:
     case INDEX_op_not_i32:
     case INDEX_op_not_i64:
     case INDEX_op_ext_i32_i64:
diff --git a/tcg/tcg.c b/tcg/tcg.c
index b31e9798c5..b5de69e4a9 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -986,6 +986,11 @@ typedef struct TCGOutOpBinary {
                     TCGReg a0, TCGReg a1, tcg_target_long a2);
 } TCGOutOpBinary;
 
+typedef struct TCGOutOpUnary {
+    TCGOutOp base;
+    void (*out_rr)(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1);
+} TCGOutOpUnary;
+
 typedef struct TCGOutOpSubtract {
     TCGOutOp base;
     void (*out_rrr)(TCGContext *s, TCGType type,
@@ -1017,6 +1022,8 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_andc, TCGOutOpBinary, outop_andc),
     OUTOP(INDEX_op_eqv, TCGOutOpBinary, outop_eqv),
     OUTOP(INDEX_op_nand, TCGOutOpBinary, outop_nand),
+    OUTOP(INDEX_op_neg_i32, TCGOutOpUnary, outop_neg),
+    OUTOP(INDEX_op_neg_i64, TCGOutOpUnary, outop_neg),
     OUTOP(INDEX_op_nor, TCGOutOpBinary, outop_nor),
     OUTOP(INDEX_op_or, TCGOutOpBinary, outop_or),
     OUTOP(INDEX_op_orc, TCGOutOpBinary, outop_orc),
@@ -2240,7 +2247,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st8_i32:
     case INDEX_op_st16_i32:
     case INDEX_op_st_i32:
-    case INDEX_op_neg_i32:
     case INDEX_op_mul_i32:
     case INDEX_op_shl_i32:
     case INDEX_op_shr_i32:
@@ -2309,7 +2315,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st16_i64:
     case INDEX_op_st32_i64:
     case INDEX_op_st_i64:
-    case INDEX_op_neg_i64:
     case INDEX_op_mul_i64:
     case INDEX_op_shl_i64:
     case INDEX_op_shr_i64:
@@ -5471,6 +5476,18 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
         }
         break;
 
+    case INDEX_op_neg_i32:
+    case INDEX_op_neg_i64:
+        {
+            const TCGOutOpUnary *out =
+                container_of(all_outop[op->opc], TCGOutOpUnary, base);
+
+            /* Constants should have been folded. */
+            tcg_debug_assert(!const_args[1]);
+            out->out_rr(s, type, new_args[0], new_args[1]);
+        }
+        break;
+
     default:
         if (def->flags & TCG_OPF_VECTOR) {
             tcg_out_vec_op(s, op->opc, type - TCG_TYPE_V64,
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index 67a46c6321..200b256e73 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -57,8 +57,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld_i64:
     case INDEX_op_not_i32:
     case INDEX_op_not_i64:
-    case INDEX_op_neg_i32:
-    case INDEX_op_neg_i64:
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
     case INDEX_op_bswap16_i32:
@@ -731,6 +729,16 @@ static const TCGOutOpBinary outop_xor = {
     .out_rrr = tgen_xor,
 };
 
+static void tgen_neg(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1)
+{
+    tcg_out_op_rr(s, glue(INDEX_op_neg_i,TCG_TARGET_REG_BITS), a0, a1);
+}
+
+static const TCGOutOpUnary outop_neg = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = tgen_neg,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -804,7 +812,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_op_rl(s, opc, TCG_REG_TMP, arg_label(args[3]));
         break;
 
-    CASE_32_64(neg)      /* Optional (TCG_TARGET_HAS_neg_*). */
     CASE_32_64(not)      /* Optional (TCG_TARGET_HAS_not_*). */
     CASE_32_64(ctpop)    /* Optional (TCG_TARGET_HAS_ctpop_*). */
     case INDEX_op_bswap32_i32: /* Optional (TCG_TARGET_HAS_bswap32_i32). */

From 6971358747d8998a5770d1bf997495d3061d6c6a Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 6 Jan 2025 22:48:57 -0800
Subject: [PATCH 0391/2760] tcg: Merge INDEX_op_neg_{i32,i64}
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 docs/devel/tcg-ops.rst   |  2 +-
 include/tcg/tcg-opc.h    |  3 +--
 tcg/optimize.c           | 30 ++++++------------------------
 tcg/tcg-op.c             |  4 ++--
 tcg/tcg.c                |  6 ++----
 tcg/tci.c                | 11 +++++------
 tcg/tci/tcg-target.c.inc |  2 +-
 7 files changed, 18 insertions(+), 40 deletions(-)

diff --git a/docs/devel/tcg-ops.rst b/docs/devel/tcg-ops.rst
index 96b7f05919..fb51691538 100644
--- a/docs/devel/tcg-ops.rst
+++ b/docs/devel/tcg-ops.rst
@@ -269,7 +269,7 @@ Arithmetic
 
      - | *t0* = *t1* - *t2*
 
-   * - neg_i32/i64 *t0*, *t1*
+   * - neg *t0*, *t1*
 
      - | *t0* = -*t1* (two's complement)
 
diff --git a/include/tcg/tcg-opc.h b/include/tcg/tcg-opc.h
index 1be9b01caf..13b7650cec 100644
--- a/include/tcg/tcg-opc.h
+++ b/include/tcg/tcg-opc.h
@@ -44,6 +44,7 @@ DEF(and, 1, 2, 0, TCG_OPF_INT)
 DEF(andc, 1, 2, 0, TCG_OPF_INT)
 DEF(eqv, 1, 2, 0, TCG_OPF_INT)
 DEF(nand, 1, 2, 0, TCG_OPF_INT)
+DEF(neg, 1, 1, 0, TCG_OPF_INT)
 DEF(nor, 1, 2, 0, TCG_OPF_INT)
 DEF(or, 1, 2, 0, TCG_OPF_INT)
 DEF(orc, 1, 2, 0, TCG_OPF_INT)
@@ -95,7 +96,6 @@ DEF(setcond2_i32, 1, 4, 1, 0)
 DEF(bswap16_i32, 1, 1, 1, 0)
 DEF(bswap32_i32, 1, 1, 1, 0)
 DEF(not_i32, 1, 1, 0, 0)
-DEF(neg_i32, 1, 1, 0, 0)
 DEF(clz_i32, 1, 2, 0, 0)
 DEF(ctz_i32, 1, 2, 0, 0)
 DEF(ctpop_i32, 1, 1, 0, 0)
@@ -145,7 +145,6 @@ DEF(bswap16_i64, 1, 1, 1, 0)
 DEF(bswap32_i64, 1, 1, 1, 0)
 DEF(bswap64_i64, 1, 1, 1, 0)
 DEF(not_i64, 1, 1, 0, 0)
-DEF(neg_i64, 1, 1, 0, 0)
 DEF(clz_i64, 1, 2, 0, 0)
 DEF(ctz_i64, 1, 2, 0, 0)
 DEF(ctpop_i64, 1, 1, 0, 0)
diff --git a/tcg/optimize.c b/tcg/optimize.c
index 718809ab8d..eb360e2b63 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -478,7 +478,7 @@ static uint64_t do_constant_folding_2(TCGOpcode op, uint64_t x, uint64_t y)
     CASE_OP_32_64_VEC(not):
         return ~x;
 
-    CASE_OP_32_64(neg):
+    case INDEX_op_neg:
         return -x;
 
     case INDEX_op_andc:
@@ -2314,25 +2314,12 @@ static int fold_setcond_zmask(OptContext *ctx, TCGOp *op, bool neg)
             break;
         }
         if (convert) {
-            TCGOpcode neg_opc;
-
             if (!inv && !neg) {
                 return tcg_opt_gen_mov(ctx, op, op->args[0], op->args[1]);
             }
 
-            switch (ctx->type) {
-            case TCG_TYPE_I32:
-                neg_opc = INDEX_op_neg_i32;
-                break;
-            case TCG_TYPE_I64:
-                neg_opc = INDEX_op_neg_i64;
-                break;
-            default:
-                g_assert_not_reached();
-            }
-
             if (!inv) {
-                op->opc = neg_opc;
+                op->opc = INDEX_op_neg;
             } else if (neg) {
                 op->opc = INDEX_op_add;
                 op->args[2] = arg_new_constant(ctx, -1);
@@ -2348,7 +2335,7 @@ static int fold_setcond_zmask(OptContext *ctx, TCGOp *op, bool neg)
 
 static void fold_setcond_tst_pow2(OptContext *ctx, TCGOp *op, bool neg)
 {
-    TCGOpcode neg_opc, shr_opc;
+    TCGOpcode shr_opc;
     TCGOpcode uext_opc = 0, sext_opc = 0;
     TCGCond cond = op->args[3];
     TCGArg ret, src1, src2;
@@ -2371,7 +2358,6 @@ static void fold_setcond_tst_pow2(OptContext *ctx, TCGOp *op, bool neg)
     switch (ctx->type) {
     case TCG_TYPE_I32:
         shr_opc = INDEX_op_shr_i32;
-        neg_opc = INDEX_op_neg_i32;
         if (TCG_TARGET_extract_valid(TCG_TYPE_I32, sh, 1)) {
             uext_opc = INDEX_op_extract_i32;
         }
@@ -2381,7 +2367,6 @@ static void fold_setcond_tst_pow2(OptContext *ctx, TCGOp *op, bool neg)
         break;
     case TCG_TYPE_I64:
         shr_opc = INDEX_op_shr_i64;
-        neg_opc = INDEX_op_neg_i64;
         if (TCG_TARGET_extract_valid(TCG_TYPE_I64, sh, 1)) {
             uext_opc = INDEX_op_extract_i64;
         }
@@ -2432,7 +2417,7 @@ static void fold_setcond_tst_pow2(OptContext *ctx, TCGOp *op, bool neg)
         op2->args[1] = ret;
         op2->args[2] = arg_new_constant(ctx, 1);
     } else if (neg) {
-        op2 = opt_insert_after(ctx, op, neg_opc, 2);
+        op2 = opt_insert_after(ctx, op, INDEX_op_neg, 2);
         op2->args[0] = ret;
         op2->args[1] = ret;
     }
@@ -2644,11 +2629,8 @@ static bool fold_sub_to_neg(OptContext *ctx, TCGOp *op)
 
     switch (ctx->type) {
     case TCG_TYPE_I32:
-        neg_op = INDEX_op_neg_i32;
-        have_neg = true;
-        break;
     case TCG_TYPE_I64:
-        neg_op = INDEX_op_neg_i64;
+        neg_op = INDEX_op_neg;
         have_neg = true;
         break;
     case TCG_TYPE_V64:
@@ -2998,7 +2980,7 @@ void tcg_optimize(TCGContext *s)
         case INDEX_op_nand_vec:
             done = fold_nand(&ctx, op);
             break;
-        CASE_OP_32_64(neg):
+        case INDEX_op_neg:
             done = fold_neg(&ctx, op);
             break;
         case INDEX_op_nor:
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index 15faf4dc57..cb2eb9ae52 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -396,7 +396,7 @@ void tcg_gen_subi_i32(TCGv_i32 ret, TCGv_i32 arg1, int32_t arg2)
 
 void tcg_gen_neg_i32(TCGv_i32 ret, TCGv_i32 arg)
 {
-    tcg_gen_op2_i32(INDEX_op_neg_i32, ret, arg);
+    tcg_gen_op2_i32(INDEX_op_neg, ret, arg);
 }
 
 void tcg_gen_and_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
@@ -1691,7 +1691,7 @@ void tcg_gen_subi_i64(TCGv_i64 ret, TCGv_i64 arg1, int64_t arg2)
 void tcg_gen_neg_i64(TCGv_i64 ret, TCGv_i64 arg)
 {
     if (TCG_TARGET_REG_BITS == 64) {
-        tcg_gen_op2_i64(INDEX_op_neg_i64, ret, arg);
+        tcg_gen_op2_i64(INDEX_op_neg, ret, arg);
     } else {
         TCGv_i32 zero = tcg_constant_i32(0);
         tcg_gen_sub2_i32(TCGV_LOW(ret), TCGV_HIGH(ret),
diff --git a/tcg/tcg.c b/tcg/tcg.c
index b5de69e4a9..92d185558f 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1022,8 +1022,7 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_andc, TCGOutOpBinary, outop_andc),
     OUTOP(INDEX_op_eqv, TCGOutOpBinary, outop_eqv),
     OUTOP(INDEX_op_nand, TCGOutOpBinary, outop_nand),
-    OUTOP(INDEX_op_neg_i32, TCGOutOpUnary, outop_neg),
-    OUTOP(INDEX_op_neg_i64, TCGOutOpUnary, outop_neg),
+    OUTOP(INDEX_op_neg, TCGOutOpUnary, outop_neg),
     OUTOP(INDEX_op_nor, TCGOutOpBinary, outop_nor),
     OUTOP(INDEX_op_or, TCGOutOpBinary, outop_or),
     OUTOP(INDEX_op_orc, TCGOutOpBinary, outop_orc),
@@ -5476,8 +5475,7 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
         }
         break;
 
-    case INDEX_op_neg_i32:
-    case INDEX_op_neg_i64:
+    case INDEX_op_neg:
         {
             const TCGOutOpUnary *out =
                 container_of(all_outop[op->opc], TCGOutOpUnary, base);
diff --git a/tcg/tci.c b/tcg/tci.c
index 508d1405cd..c736691e9f 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -567,6 +567,10 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = ~(regs[r1] | regs[r2]);
             break;
+        case INDEX_op_neg:
+            tci_args_rr(insn, &r0, &r1);
+            regs[r0] = -regs[r1];
+            break;
 
             /* Arithmetic operations (32 bit). */
 
@@ -697,10 +701,6 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             regs[r0] = ~regs[r1];
             break;
 #endif
-        CASE_32_64(neg)
-            tci_args_rr(insn, &r0, &r1);
-            regs[r0] = -regs[r1];
-            break;
 #if TCG_TARGET_REG_BITS == 64
             /* Load/store operations (64 bit). */
 
@@ -1054,6 +1054,7 @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
         break;
 
     case INDEX_op_mov:
+    case INDEX_op_neg:
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
     case INDEX_op_bswap16_i32:
@@ -1063,8 +1064,6 @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
     case INDEX_op_bswap64_i64:
     case INDEX_op_not_i32:
     case INDEX_op_not_i64:
-    case INDEX_op_neg_i32:
-    case INDEX_op_neg_i64:
     case INDEX_op_ctpop_i32:
     case INDEX_op_ctpop_i64:
         tci_args_rr(insn, &r0, &r1);
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index 200b256e73..c42f9dff11 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -731,7 +731,7 @@ static const TCGOutOpBinary outop_xor = {
 
 static void tgen_neg(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1)
 {
-    tcg_out_op_rr(s, glue(INDEX_op_neg_i,TCG_TARGET_REG_BITS), a0, a1);
+    tcg_out_op_rr(s, INDEX_op_neg, a0, a1);
 }
 
 static const TCGOutOpUnary outop_neg = {

From 592982bf04cfa92dc4c992056c7330ac46f4882f Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 6 Jan 2025 23:37:54 -0800
Subject: [PATCH 0392/2760] tcg: Convert not to TCGOutOpUnary
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target-has.h     |  2 --
 tcg/aarch64/tcg-target.c.inc     | 17 ++++++++++-------
 tcg/arm/tcg-target-has.h         |  1 -
 tcg/arm/tcg-target.c.inc         | 15 ++++++++++-----
 tcg/i386/tcg-target-has.h        |  2 --
 tcg/i386/tcg-target.c.inc        | 17 +++++++++++------
 tcg/loongarch64/tcg-target-has.h |  2 --
 tcg/loongarch64/tcg-target.c.inc | 17 ++++++++++-------
 tcg/mips/tcg-target-has.h        |  2 --
 tcg/mips/tcg-target.c.inc        | 20 ++++++++++----------
 tcg/optimize.c                   |  4 ++--
 tcg/ppc/tcg-target-has.h         |  2 --
 tcg/ppc/tcg-target.c.inc         | 17 ++++++++++-------
 tcg/riscv/tcg-target-has.h       |  2 --
 tcg/riscv/tcg-target.c.inc       | 17 ++++++++++-------
 tcg/s390x/tcg-target-has.h       |  2 --
 tcg/s390x/tcg-target.c.inc       | 25 ++++++++++++++++---------
 tcg/sparc64/tcg-target-has.h     |  2 --
 tcg/sparc64/tcg-target.c.inc     | 20 ++++++++++----------
 tcg/tcg-has.h                    |  1 -
 tcg/tcg-op.c                     | 10 ++++++----
 tcg/tcg.c                        |  8 ++++----
 tcg/tci.c                        |  2 --
 tcg/tci/tcg-target-has.h         |  2 --
 tcg/tci/tcg-target.c.inc         | 13 ++++++++++---
 25 files changed, 119 insertions(+), 103 deletions(-)

diff --git a/tcg/aarch64/tcg-target-has.h b/tcg/aarch64/tcg-target-has.h
index 240fcac2cc..7f18727686 100644
--- a/tcg/aarch64/tcg-target-has.h
+++ b/tcg/aarch64/tcg-target-has.h
@@ -17,7 +17,6 @@
 #define TCG_TARGET_HAS_rem_i32          1
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
-#define TCG_TARGET_HAS_not_i32          1
 #define TCG_TARGET_HAS_rot_i32          1
 #define TCG_TARGET_HAS_clz_i32          1
 #define TCG_TARGET_HAS_ctz_i32          1
@@ -38,7 +37,6 @@
 #define TCG_TARGET_HAS_bswap16_i64      1
 #define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1
-#define TCG_TARGET_HAS_not_i64          1
 #define TCG_TARGET_HAS_rot_i64          1
 #define TCG_TARGET_HAS_clz_i64          1
 #define TCG_TARGET_HAS_ctz_i64          1
diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index cf7a3f2632..97b444bc17 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -2245,6 +2245,16 @@ static const TCGOutOpUnary outop_neg = {
     .out_rr = tgen_neg,
 };
 
+static void tgen_not(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1)
+{
+    tgen_orc(s, type, a0, TCG_REG_XZR, a1);
+}
+
+static const TCGOutOpUnary outop_not = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = tgen_not,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType ext,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -2312,11 +2322,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType ext,
         tcg_out_ldst(s, I3312_STRX, a0, a1, a2, 3);
         break;
 
-    case INDEX_op_not_i64:
-    case INDEX_op_not_i32:
-        tcg_out_insn(s, 3510, ORN, ext, a0, TCG_REG_XZR, a1);
-        break;
-
     case INDEX_op_mul_i64:
     case INDEX_op_mul_i32:
         tcg_out_insn(s, 3509, MADD, ext, a0, a1, a2, TCG_REG_XZR);
@@ -2996,8 +3001,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld32u_i64:
     case INDEX_op_ld32s_i64:
     case INDEX_op_ld_i64:
-    case INDEX_op_not_i32:
-    case INDEX_op_not_i64:
     case INDEX_op_bswap16_i32:
     case INDEX_op_bswap32_i32:
     case INDEX_op_bswap16_i64:
diff --git a/tcg/arm/tcg-target-has.h b/tcg/arm/tcg-target-has.h
index e80711ee40..e766c6d628 100644
--- a/tcg/arm/tcg-target-has.h
+++ b/tcg/arm/tcg-target-has.h
@@ -26,7 +26,6 @@ extern bool use_neon_instructions;
 /* optional instructions */
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
-#define TCG_TARGET_HAS_not_i32          1
 #define TCG_TARGET_HAS_rot_i32          1
 #define TCG_TARGET_HAS_clz_i32          1
 #define TCG_TARGET_HAS_ctz_i32          use_armv7_instructions
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index 5ea4488606..2477b1c4ab 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -1961,6 +1961,16 @@ static const TCGOutOpUnary outop_neg = {
     .out_rr = tgen_neg,
 };
 
+static void tgen_not(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1)
+{
+    tcg_out_dat_reg(s, COND_AL, ARITH_MVN, a0, 0, a1, SHIFT_IMM_LSL(0));
+}
+
+static const TCGOutOpUnary outop_not = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = tgen_not,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -2050,10 +2060,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         tcg_out_mov_reg(s, COND_AL, args[0], a0);
         break;
-    case INDEX_op_not_i32:
-        tcg_out_dat_reg(s, COND_AL,
-                        ARITH_MVN, args[0], 0, args[1], SHIFT_IMM_LSL(0));
-        break;
     case INDEX_op_mul_i32:
         tcg_out_mul32(s, COND_AL, args[0], args[1], args[2]);
         break;
@@ -2233,7 +2239,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld16u_i32:
     case INDEX_op_ld16s_i32:
     case INDEX_op_ld_i32:
-    case INDEX_op_not_i32:
     case INDEX_op_bswap16_i32:
     case INDEX_op_bswap32_i32:
     case INDEX_op_extract_i32:
diff --git a/tcg/i386/tcg-target-has.h b/tcg/i386/tcg-target-has.h
index b27f853dcd..3d36fe58f2 100644
--- a/tcg/i386/tcg-target-has.h
+++ b/tcg/i386/tcg-target-has.h
@@ -30,7 +30,6 @@
 #define TCG_TARGET_HAS_rot_i32          1
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
-#define TCG_TARGET_HAS_not_i32          1
 #define TCG_TARGET_HAS_clz_i32          1
 #define TCG_TARGET_HAS_ctz_i32          1
 #define TCG_TARGET_HAS_ctpop_i32        have_popcnt
@@ -51,7 +50,6 @@
 #define TCG_TARGET_HAS_bswap16_i64      1
 #define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1
-#define TCG_TARGET_HAS_not_i64          1
 #define TCG_TARGET_HAS_clz_i64          1
 #define TCG_TARGET_HAS_ctz_i64          1
 #define TCG_TARGET_HAS_ctpop_i64        have_popcnt
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index 082aa982fb..24fef09c9e 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -2712,6 +2712,17 @@ static const TCGOutOpUnary outop_neg = {
     .out_rr = tgen_neg,
 };
 
+static void tgen_not(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1)
+{
+    int rexw = type == TCG_TYPE_I32 ? 0 : P_REXW;
+    tcg_out_modrm(s, OPC_GRP3_Ev + rexw, EXT3_NOT, a0);
+}
+
+static const TCGOutOpUnary outop_not = {
+    .base.static_constraint = C_O1_I1(r, 0),
+    .out_rr = tgen_not,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -2911,10 +2922,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    OP_32_64(not):
-        tcg_out_modrm(s, OPC_GRP3_Ev + rexw, EXT3_NOT, a0);
-        break;
-
     case INDEX_op_qemu_ld_i32:
         tcg_out_qemu_ld(s, a0, -1, a1, a2, TCG_TYPE_I32);
         break;
@@ -3727,8 +3734,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_bswap32_i32:
     case INDEX_op_bswap32_i64:
     case INDEX_op_bswap64_i64:
-    case INDEX_op_not_i32:
-    case INDEX_op_not_i64:
     case INDEX_op_extrh_i64_i32:
         return C_O1_I1(r, 0);
 
diff --git a/tcg/loongarch64/tcg-target-has.h b/tcg/loongarch64/tcg-target-has.h
index 7860432489..ffacb41e80 100644
--- a/tcg/loongarch64/tcg-target-has.h
+++ b/tcg/loongarch64/tcg-target-has.h
@@ -24,7 +24,6 @@
 #define TCG_TARGET_HAS_mulsh_i32        1
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
-#define TCG_TARGET_HAS_not_i32          1
 #define TCG_TARGET_HAS_clz_i32          1
 #define TCG_TARGET_HAS_ctz_i32          1
 #define TCG_TARGET_HAS_ctpop_i32        0
@@ -41,7 +40,6 @@
 #define TCG_TARGET_HAS_bswap16_i64      1
 #define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1
-#define TCG_TARGET_HAS_not_i64          1
 #define TCG_TARGET_HAS_clz_i64          1
 #define TCG_TARGET_HAS_ctz_i64          1
 #define TCG_TARGET_HAS_ctpop_i64        0
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index 31ec7262e0..c24882b6ba 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -1419,6 +1419,16 @@ static const TCGOutOpUnary outop_neg = {
     .out_rr = tgen_neg,
 };
 
+static void tgen_not(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1)
+{
+    tgen_nor(s, type, a0, a1, TCG_REG_ZERO);
+}
+
+static const TCGOutOpUnary outop_not = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = tgen_not,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -1454,11 +1464,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_opc_srai_d(s, a0, a1, 32);
         break;
 
-    case INDEX_op_not_i32:
-    case INDEX_op_not_i64:
-        tcg_out_opc_nor(s, a0, a1, TCG_REG_ZERO);
-        break;
-
     case INDEX_op_extract_i32:
         if (a2 == 0 && args[3] <= 12) {
             tcg_out_opc_andi(s, a0, a1, (1 << args[3]) - 1);
@@ -2275,8 +2280,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_extrl_i64_i32:
     case INDEX_op_extrh_i64_i32:
     case INDEX_op_ext_i32_i64:
-    case INDEX_op_not_i32:
-    case INDEX_op_not_i64:
     case INDEX_op_extract_i32:
     case INDEX_op_extract_i64:
     case INDEX_op_sextract_i32:
diff --git a/tcg/mips/tcg-target-has.h b/tcg/mips/tcg-target-has.h
index 987f83f761..9d8e0fb8df 100644
--- a/tcg/mips/tcg-target-has.h
+++ b/tcg/mips/tcg-target-has.h
@@ -41,7 +41,6 @@ extern bool use_mips32r2_instructions;
 /* optional instructions */
 #define TCG_TARGET_HAS_div_i32          1
 #define TCG_TARGET_HAS_rem_i32          1
-#define TCG_TARGET_HAS_not_i32          1
 #define TCG_TARGET_HAS_mulu2_i32        (!use_mips32r6_instructions)
 #define TCG_TARGET_HAS_muls2_i32        (!use_mips32r6_instructions)
 #define TCG_TARGET_HAS_muluh_i32        1
@@ -56,7 +55,6 @@ extern bool use_mips32r2_instructions;
 #define TCG_TARGET_HAS_extr_i64_i32     1
 #define TCG_TARGET_HAS_div_i64          1
 #define TCG_TARGET_HAS_rem_i64          1
-#define TCG_TARGET_HAS_not_i64          1
 #define TCG_TARGET_HAS_add2_i64         0
 #define TCG_TARGET_HAS_sub2_i64         0
 #define TCG_TARGET_HAS_mulu2_i64        (!use_mips32r6_instructions)
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index 0fda255a7b..4942855189 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -1793,6 +1793,16 @@ static const TCGOutOpUnary outop_neg = {
     .out_rr = tgen_neg,
 };
 
+static void tgen_not(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1)
+{
+    tgen_nor(s, type, a0, TCG_REG_ZERO, a1);
+}
+
+static const TCGOutOpUnary outop_not = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = tgen_not,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -1985,14 +1995,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_opc_reg(s, OPC_MFHI, a1, 0, 0);
         break;
 
-    case INDEX_op_not_i32:
-    case INDEX_op_not_i64:
-        i1 = OPC_NOR;
-        goto do_unary;
-    do_unary:
-        tcg_out_opc_reg(s, i1, a0, TCG_REG_ZERO, a1);
-        break;
-
     case INDEX_op_bswap16_i32:
     case INDEX_op_bswap16_i64:
         tcg_out_bswap16(s, a0, a1, a2);
@@ -2199,7 +2201,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld16u_i32:
     case INDEX_op_ld16s_i32:
     case INDEX_op_ld_i32:
-    case INDEX_op_not_i32:
     case INDEX_op_bswap16_i32:
     case INDEX_op_bswap32_i32:
     case INDEX_op_extract_i32:
@@ -2211,7 +2212,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld32s_i64:
     case INDEX_op_ld32u_i64:
     case INDEX_op_ld_i64:
-    case INDEX_op_not_i64:
     case INDEX_op_bswap16_i64:
     case INDEX_op_bswap32_i64:
     case INDEX_op_bswap64_i64:
diff --git a/tcg/optimize.c b/tcg/optimize.c
index eb360e2b63..b4a675ea37 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -1104,11 +1104,11 @@ static bool fold_to_not(OptContext *ctx, TCGOp *op, int idx)
     switch (ctx->type) {
     case TCG_TYPE_I32:
         not_op = INDEX_op_not_i32;
-        have_not = TCG_TARGET_HAS_not_i32;
+        have_not = tcg_op_supported(INDEX_op_not_i32, TCG_TYPE_I32, 0);
         break;
     case TCG_TYPE_I64:
         not_op = INDEX_op_not_i64;
-        have_not = TCG_TARGET_HAS_not_i64;
+        have_not = tcg_op_supported(INDEX_op_not_i64, TCG_TYPE_I64, 0);
         break;
     case TCG_TYPE_V64:
     case TCG_TYPE_V128:
diff --git a/tcg/ppc/tcg-target-has.h b/tcg/ppc/tcg-target-has.h
index 6be6d7f994..7ebcb49a19 100644
--- a/tcg/ppc/tcg-target-has.h
+++ b/tcg/ppc/tcg-target-has.h
@@ -22,7 +22,6 @@
 #define TCG_TARGET_HAS_rot_i32          1
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
-#define TCG_TARGET_HAS_not_i32          1
 #define TCG_TARGET_HAS_clz_i32          1
 #define TCG_TARGET_HAS_ctz_i32          have_isa_3_00
 #define TCG_TARGET_HAS_ctpop_i32        have_isa_2_06
@@ -44,7 +43,6 @@
 #define TCG_TARGET_HAS_bswap16_i64      1
 #define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1
-#define TCG_TARGET_HAS_not_i64          1
 #define TCG_TARGET_HAS_clz_i64          1
 #define TCG_TARGET_HAS_ctz_i64          have_isa_3_00
 #define TCG_TARGET_HAS_ctpop_i64        have_isa_2_06
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index da45436a5a..38cbe5223b 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -3062,6 +3062,16 @@ static const TCGOutOpUnary outop_neg = {
     .out_rr = tgen_neg,
 };
 
+static void tgen_not(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1)
+{
+    tgen_nor(s, type, a0, a1, a1);
+}
+
+static const TCGOutOpUnary outop_not = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = tgen_not,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -3234,11 +3244,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_brcond2(s, args, const_args);
         break;
 
-    case INDEX_op_not_i32:
-    case INDEX_op_not_i64:
-        tcg_out32(s, NOR | SAB(args[1], args[0], args[1]));
-        break;
-
     case INDEX_op_shl_i64:
         if (const_args[2]) {
             /* Limit immediate shift count lest we create an illegal insn.  */
@@ -4124,7 +4129,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld16s_i32:
     case INDEX_op_ld_i32:
     case INDEX_op_ctpop_i32:
-    case INDEX_op_not_i32:
     case INDEX_op_bswap16_i32:
     case INDEX_op_bswap32_i32:
     case INDEX_op_extract_i32:
@@ -4137,7 +4141,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld32s_i64:
     case INDEX_op_ld_i64:
     case INDEX_op_ctpop_i64:
-    case INDEX_op_not_i64:
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
     case INDEX_op_bswap16_i64:
diff --git a/tcg/riscv/tcg-target-has.h b/tcg/riscv/tcg-target-has.h
index 0fcf940a8a..e3018717ea 100644
--- a/tcg/riscv/tcg-target-has.h
+++ b/tcg/riscv/tcg-target-has.h
@@ -24,7 +24,6 @@
 #define TCG_TARGET_HAS_mulsh_i32        0
 #define TCG_TARGET_HAS_bswap16_i32      (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_bswap32_i32      (cpuinfo & CPUINFO_ZBB)
-#define TCG_TARGET_HAS_not_i32          1
 #define TCG_TARGET_HAS_clz_i32          (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_ctz_i32          (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_ctpop_i32        (cpuinfo & CPUINFO_ZBB)
@@ -40,7 +39,6 @@
 #define TCG_TARGET_HAS_bswap16_i64      (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_bswap32_i64      (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_bswap64_i64      (cpuinfo & CPUINFO_ZBB)
-#define TCG_TARGET_HAS_not_i64          1
 #define TCG_TARGET_HAS_clz_i64          (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_ctz_i64          (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_ctpop_i64        (cpuinfo & CPUINFO_ZBB)
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index 4e16c44aa5..5e9e14815d 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -2087,6 +2087,16 @@ static const TCGOutOpUnary outop_neg = {
     .out_rr = tgen_neg,
 };
 
+static void tgen_not(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1)
+{
+    tgen_xori(s, type, a0, a1, -1);
+}
+
+static const TCGOutOpUnary outop_not = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = tgen_not,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -2150,11 +2160,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_ldst(s, OPC_SD, a0, a1, a2);
         break;
 
-    case INDEX_op_not_i32:
-    case INDEX_op_not_i64:
-        tcg_out_opc_imm(s, OPC_XORI, a0, a1, -1);
-        break;
-
     case INDEX_op_mul_i32:
         tcg_out_opc_reg(s, OPC_MULW, a0, a1, a2);
         break;
@@ -2662,7 +2667,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld16u_i32:
     case INDEX_op_ld16s_i32:
     case INDEX_op_ld_i32:
-    case INDEX_op_not_i32:
     case INDEX_op_ld8u_i64:
     case INDEX_op_ld8s_i64:
     case INDEX_op_ld16u_i64:
@@ -2670,7 +2674,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld32s_i64:
     case INDEX_op_ld32u_i64:
     case INDEX_op_ld_i64:
-    case INDEX_op_not_i64:
     case INDEX_op_extu_i32_i64:
     case INDEX_op_extrl_i64_i32:
     case INDEX_op_extrh_i64_i32:
diff --git a/tcg/s390x/tcg-target-has.h b/tcg/s390x/tcg-target-has.h
index 374db3cf9d..e5c132cf12 100644
--- a/tcg/s390x/tcg-target-has.h
+++ b/tcg/s390x/tcg-target-has.h
@@ -33,7 +33,6 @@ extern uint64_t s390_facilities[3];
 #define TCG_TARGET_HAS_rot_i32        1
 #define TCG_TARGET_HAS_bswap16_i32    1
 #define TCG_TARGET_HAS_bswap32_i32    1
-#define TCG_TARGET_HAS_not_i32        HAVE_FACILITY(MISC_INSN_EXT3)
 #define TCG_TARGET_HAS_clz_i32        0
 #define TCG_TARGET_HAS_ctz_i32        0
 #define TCG_TARGET_HAS_ctpop_i32      1
@@ -53,7 +52,6 @@ extern uint64_t s390_facilities[3];
 #define TCG_TARGET_HAS_bswap16_i64    1
 #define TCG_TARGET_HAS_bswap32_i64    1
 #define TCG_TARGET_HAS_bswap64_i64    1
-#define TCG_TARGET_HAS_not_i64        HAVE_FACILITY(MISC_INSN_EXT3)
 #define TCG_TARGET_HAS_clz_i64        1
 #define TCG_TARGET_HAS_ctz_i64        0
 #define TCG_TARGET_HAS_ctpop_i64      1
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index 08e65834d7..98bf3ee19e 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -2387,6 +2387,22 @@ static const TCGOutOpUnary outop_neg = {
     .out_rr = tgen_neg,
 };
 
+static void tgen_not(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1)
+{
+    tgen_nor(s, type, a0, a1, a1);
+}
+
+static TCGConstraintSetIndex cset_not(TCGType type, unsigned flags)
+{
+    return HAVE_FACILITY(MISC_INSN_EXT3) ? C_O1_I1(r, r) : C_NotImplemented;
+}
+
+static const TCGOutOpUnary outop_not = {
+    .base.static_constraint = C_Dynamic,
+    .base.dynamic_constraint = cset_not,
+    .out_rr = tgen_not,
+};
+
 
 # define OP_32_64(x) \
         case glue(glue(INDEX_op_,x),_i32): \
@@ -2444,10 +2460,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_st(s, TCG_TYPE_I32, args[0], args[1], args[2]);
         break;
 
-    case INDEX_op_not_i32:
-        tcg_out_insn(s, RRFa, NORK, args[0], args[1], args[1]);
-        break;
-
     case INDEX_op_mul_i32:
         a0 = args[0], a1 = args[1], a2 = (int32_t)args[2];
         if (const_args[2]) {
@@ -2635,9 +2647,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_st(s, TCG_TYPE_I64, args[0], args[1], args[2]);
         break;
 
-    case INDEX_op_not_i64:
-        tcg_out_insn(s, RRFa, NOGRK, args[0], args[1], args[1]);
-        break;
     case INDEX_op_bswap64_i64:
         tcg_out_insn(s, RRE, LRVGR, args[0], args[1]);
         break;
@@ -3331,8 +3340,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_bswap32_i32:
     case INDEX_op_bswap32_i64:
     case INDEX_op_bswap64_i64:
-    case INDEX_op_not_i32:
-    case INDEX_op_not_i64:
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
     case INDEX_op_extract_i32:
diff --git a/tcg/sparc64/tcg-target-has.h b/tcg/sparc64/tcg-target-has.h
index 35ae536879..df87249df2 100644
--- a/tcg/sparc64/tcg-target-has.h
+++ b/tcg/sparc64/tcg-target-has.h
@@ -19,7 +19,6 @@ extern bool use_vis3_instructions;
 #define TCG_TARGET_HAS_rot_i32          0
 #define TCG_TARGET_HAS_bswap16_i32      0
 #define TCG_TARGET_HAS_bswap32_i32      0
-#define TCG_TARGET_HAS_not_i32          1
 #define TCG_TARGET_HAS_clz_i32          0
 #define TCG_TARGET_HAS_ctz_i32          0
 #define TCG_TARGET_HAS_ctpop_i32        0
@@ -40,7 +39,6 @@ extern bool use_vis3_instructions;
 #define TCG_TARGET_HAS_bswap16_i64      0
 #define TCG_TARGET_HAS_bswap32_i64      0
 #define TCG_TARGET_HAS_bswap64_i64      0
-#define TCG_TARGET_HAS_not_i64          1
 #define TCG_TARGET_HAS_clz_i64          0
 #define TCG_TARGET_HAS_ctz_i64          0
 #define TCG_TARGET_HAS_ctpop_i64        0
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index a3926ea1c3..5819dc44fe 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -1413,6 +1413,16 @@ static const TCGOutOpUnary outop_neg = {
     .out_rr = tgen_neg,
 };
 
+static void tgen_not(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1)
+{
+     tgen_orc(s, type, a0, TCG_REG_G0, a1);
+}
+
+static const TCGOutOpUnary outop_not = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = tgen_not,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -1483,10 +1493,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         c = ARITH_UMUL;
         goto gen_arith;
 
-    OP_32_64(not):
-	c = ARITH_ORN;
-	goto gen_arith1;
-
     case INDEX_op_div_i32:
         tcg_out_div32(s, a0, a1, a2, c2, 0);
         break;
@@ -1600,10 +1606,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_arithc(s, a0, a1, a2, c2, c);
         break;
 
-    gen_arith1:
-	tcg_out_arithc(s, a0, TCG_REG_G0, a1, const_args[1], c);
-	break;
-
     case INDEX_op_mb:
         tcg_out_mb(s, a0);
         break;
@@ -1646,8 +1648,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld32u_i64:
     case INDEX_op_ld32s_i64:
     case INDEX_op_ld_i64:
-    case INDEX_op_not_i32:
-    case INDEX_op_not_i64:
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
     case INDEX_op_extract_i64:
diff --git a/tcg/tcg-has.h b/tcg/tcg-has.h
index 7de13ef383..a84ed1313a 100644
--- a/tcg/tcg-has.h
+++ b/tcg/tcg-has.h
@@ -19,7 +19,6 @@
 #define TCG_TARGET_HAS_bswap16_i64      0
 #define TCG_TARGET_HAS_bswap32_i64      0
 #define TCG_TARGET_HAS_bswap64_i64      0
-#define TCG_TARGET_HAS_not_i64          0
 #define TCG_TARGET_HAS_clz_i64          0
 #define TCG_TARGET_HAS_ctz_i64          0
 #define TCG_TARGET_HAS_ctpop_i64        0
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index cb2eb9ae52..e0f8ab28b8 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -461,7 +461,8 @@ void tcg_gen_xori_i32(TCGv_i32 ret, TCGv_i32 arg1, int32_t arg2)
     /* Some cases can be optimized here.  */
     if (arg2 == 0) {
         tcg_gen_mov_i32(ret, arg1);
-    } else if (arg2 == -1 && TCG_TARGET_HAS_not_i32) {
+    } else if (arg2 == -1 &&
+               tcg_op_supported(INDEX_op_not_i32, TCG_TYPE_I32, 0)) {
         /* Don't recurse with tcg_gen_not_i32.  */
         tcg_gen_op2_i32(INDEX_op_not_i32, ret, arg1);
     } else {
@@ -471,7 +472,7 @@ void tcg_gen_xori_i32(TCGv_i32 ret, TCGv_i32 arg1, int32_t arg2)
 
 void tcg_gen_not_i32(TCGv_i32 ret, TCGv_i32 arg)
 {
-    if (TCG_TARGET_HAS_not_i32) {
+    if (tcg_op_supported(INDEX_op_not_i32, TCG_TYPE_I32, 0)) {
         tcg_gen_op2_i32(INDEX_op_not_i32, ret, arg);
     } else {
         tcg_gen_xori_i32(ret, arg, -1);
@@ -1762,7 +1763,8 @@ void tcg_gen_xori_i64(TCGv_i64 ret, TCGv_i64 arg1, int64_t arg2)
     /* Some cases can be optimized here.  */
     if (arg2 == 0) {
         tcg_gen_mov_i64(ret, arg1);
-    } else if (arg2 == -1 && TCG_TARGET_HAS_not_i64) {
+    } else if (arg2 == -1 &&
+               tcg_op_supported(INDEX_op_not_i64, TCG_TYPE_I64, 0)) {
         /* Don't recurse with tcg_gen_not_i64.  */
         tcg_gen_op2_i64(INDEX_op_not_i64, ret, arg1);
     } else {
@@ -2252,7 +2254,7 @@ void tcg_gen_not_i64(TCGv_i64 ret, TCGv_i64 arg)
     if (TCG_TARGET_REG_BITS == 32) {
         tcg_gen_not_i32(TCGV_LOW(ret), TCGV_LOW(arg));
         tcg_gen_not_i32(TCGV_HIGH(ret), TCGV_HIGH(arg));
-    } else if (TCG_TARGET_HAS_not_i64) {
+    } else if (tcg_op_supported(INDEX_op_not_i64, TCG_TYPE_I64, 0)) {
         tcg_gen_op2_i64(INDEX_op_not_i64, ret, arg);
     } else {
         tcg_gen_xori_i64(ret, arg, -1);
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 92d185558f..acd666d30b 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1024,6 +1024,8 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_nand, TCGOutOpBinary, outop_nand),
     OUTOP(INDEX_op_neg, TCGOutOpUnary, outop_neg),
     OUTOP(INDEX_op_nor, TCGOutOpBinary, outop_nor),
+    OUTOP(INDEX_op_not_i32, TCGOutOpUnary, outop_not),
+    OUTOP(INDEX_op_not_i64, TCGOutOpUnary, outop_not),
     OUTOP(INDEX_op_or, TCGOutOpBinary, outop_or),
     OUTOP(INDEX_op_orc, TCGOutOpBinary, outop_orc),
     OUTOP(INDEX_op_sub, TCGOutOpSubtract, outop_sub),
@@ -2287,8 +2289,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
         return TCG_TARGET_HAS_bswap16_i32;
     case INDEX_op_bswap32_i32:
         return TCG_TARGET_HAS_bswap32_i32;
-    case INDEX_op_not_i32:
-        return TCG_TARGET_HAS_not_i32;
     case INDEX_op_clz_i32:
         return TCG_TARGET_HAS_clz_i32;
     case INDEX_op_ctz_i32:
@@ -2350,8 +2350,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
         return TCG_TARGET_HAS_bswap32_i64;
     case INDEX_op_bswap64_i64:
         return TCG_TARGET_HAS_bswap64_i64;
-    case INDEX_op_not_i64:
-        return TCG_TARGET_HAS_not_i64;
     case INDEX_op_clz_i64:
         return TCG_TARGET_HAS_clz_i64;
     case INDEX_op_ctz_i64:
@@ -5476,6 +5474,8 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
         break;
 
     case INDEX_op_neg:
+    case INDEX_op_not_i32:
+    case INDEX_op_not_i64:
         {
             const TCGOutOpUnary *out =
                 container_of(all_outop[op->opc], TCGOutOpUnary, base);
diff --git a/tcg/tci.c b/tcg/tci.c
index c736691e9f..25ad37fcd5 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -695,12 +695,10 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             regs[r0] = bswap32(regs[r1]);
             break;
 #endif
-#if TCG_TARGET_HAS_not_i32 || TCG_TARGET_HAS_not_i64
         CASE_32_64(not)
             tci_args_rr(insn, &r0, &r1);
             regs[r0] = ~regs[r1];
             break;
-#endif
 #if TCG_TARGET_REG_BITS == 64
             /* Load/store operations (64 bit). */
 
diff --git a/tcg/tci/tcg-target-has.h b/tcg/tci/tcg-target-has.h
index 13c9dc3dfa..f147da5c0e 100644
--- a/tcg/tci/tcg-target-has.h
+++ b/tcg/tci/tcg-target-has.h
@@ -15,7 +15,6 @@
 #define TCG_TARGET_HAS_clz_i32          1
 #define TCG_TARGET_HAS_ctz_i32          1
 #define TCG_TARGET_HAS_ctpop_i32        1
-#define TCG_TARGET_HAS_not_i32          1
 #define TCG_TARGET_HAS_rot_i32          1
 #define TCG_TARGET_HAS_negsetcond_i32   0
 #define TCG_TARGET_HAS_muls2_i32        1
@@ -34,7 +33,6 @@
 #define TCG_TARGET_HAS_clz_i64          1
 #define TCG_TARGET_HAS_ctz_i64          1
 #define TCG_TARGET_HAS_ctpop_i64        1
-#define TCG_TARGET_HAS_not_i64          1
 #define TCG_TARGET_HAS_rot_i64          1
 #define TCG_TARGET_HAS_negsetcond_i64   0
 #define TCG_TARGET_HAS_muls2_i64        1
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index c42f9dff11..d3da498098 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -55,8 +55,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld32u_i64:
     case INDEX_op_ld32s_i64:
     case INDEX_op_ld_i64:
-    case INDEX_op_not_i32:
-    case INDEX_op_not_i64:
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
     case INDEX_op_bswap16_i32:
@@ -739,6 +737,16 @@ static const TCGOutOpUnary outop_neg = {
     .out_rr = tgen_neg,
 };
 
+static void tgen_not(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1)
+{
+    tcg_out_op_rr(s, glue(INDEX_op_not_i,TCG_TARGET_REG_BITS), a0, a1);
+}
+
+static const TCGOutOpUnary outop_not = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = tgen_not,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -812,7 +820,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_op_rl(s, opc, TCG_REG_TMP, arg_label(args[3]));
         break;
 
-    CASE_32_64(not)      /* Optional (TCG_TARGET_HAS_not_*). */
     CASE_32_64(ctpop)    /* Optional (TCG_TARGET_HAS_ctpop_*). */
     case INDEX_op_bswap32_i32: /* Optional (TCG_TARGET_HAS_bswap32_i32). */
     case INDEX_op_bswap64_i64: /* Optional (TCG_TARGET_HAS_bswap64_i64). */

From 5c62d3779b8b1075782672751165c0e4f716762f Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 6 Jan 2025 23:46:47 -0800
Subject: [PATCH 0393/2760] tcg: Merge INDEX_op_not_{i32,i64}
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 docs/devel/tcg-ops.rst   |  2 +-
 include/tcg/tcg-opc.h    |  3 +--
 tcg/optimize.c           | 13 ++++++-------
 tcg/tcg-op.c             | 16 ++++++++--------
 tcg/tcg.c                |  6 ++----
 tcg/tci.c                | 11 +++++------
 tcg/tci/tcg-target.c.inc |  2 +-
 7 files changed, 24 insertions(+), 29 deletions(-)

diff --git a/docs/devel/tcg-ops.rst b/docs/devel/tcg-ops.rst
index fb51691538..96dddc5fd3 100644
--- a/docs/devel/tcg-ops.rst
+++ b/docs/devel/tcg-ops.rst
@@ -315,7 +315,7 @@ Logical
 
      - | *t0* = *t1* ^ *t2*
 
-   * - not_i32/i64 *t0*, *t1*
+   * - not *t0*, *t1*
 
      - | *t0* = ~\ *t1*
 
diff --git a/include/tcg/tcg-opc.h b/include/tcg/tcg-opc.h
index 13b7650cec..d0fcdfd241 100644
--- a/include/tcg/tcg-opc.h
+++ b/include/tcg/tcg-opc.h
@@ -46,6 +46,7 @@ DEF(eqv, 1, 2, 0, TCG_OPF_INT)
 DEF(nand, 1, 2, 0, TCG_OPF_INT)
 DEF(neg, 1, 1, 0, TCG_OPF_INT)
 DEF(nor, 1, 2, 0, TCG_OPF_INT)
+DEF(not, 1, 1, 0, TCG_OPF_INT)
 DEF(or, 1, 2, 0, TCG_OPF_INT)
 DEF(orc, 1, 2, 0, TCG_OPF_INT)
 DEF(sub, 1, 2, 0, TCG_OPF_INT)
@@ -95,7 +96,6 @@ DEF(setcond2_i32, 1, 4, 1, 0)
 
 DEF(bswap16_i32, 1, 1, 1, 0)
 DEF(bswap32_i32, 1, 1, 1, 0)
-DEF(not_i32, 1, 1, 0, 0)
 DEF(clz_i32, 1, 2, 0, 0)
 DEF(ctz_i32, 1, 2, 0, 0)
 DEF(ctpop_i32, 1, 1, 0, 0)
@@ -144,7 +144,6 @@ DEF(brcond_i64, 0, 2, 2, TCG_OPF_BB_END | TCG_OPF_COND_BRANCH)
 DEF(bswap16_i64, 1, 1, 1, 0)
 DEF(bswap32_i64, 1, 1, 1, 0)
 DEF(bswap64_i64, 1, 1, 1, 0)
-DEF(not_i64, 1, 1, 0, 0)
 DEF(clz_i64, 1, 2, 0, 0)
 DEF(ctz_i64, 1, 2, 0, 0)
 DEF(ctpop_i64, 1, 1, 0, 0)
diff --git a/tcg/optimize.c b/tcg/optimize.c
index b4a675ea37..315ee0a8bc 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -475,7 +475,8 @@ static uint64_t do_constant_folding_2(TCGOpcode op, uint64_t x, uint64_t y)
     case INDEX_op_rotl_i64:
         return rol64(x, y & 63);
 
-    CASE_OP_32_64_VEC(not):
+    case INDEX_op_not:
+    case INDEX_op_not_vec:
         return ~x;
 
     case INDEX_op_neg:
@@ -1103,12 +1104,9 @@ static bool fold_to_not(OptContext *ctx, TCGOp *op, int idx)
 
     switch (ctx->type) {
     case TCG_TYPE_I32:
-        not_op = INDEX_op_not_i32;
-        have_not = tcg_op_supported(INDEX_op_not_i32, TCG_TYPE_I32, 0);
-        break;
     case TCG_TYPE_I64:
-        not_op = INDEX_op_not_i64;
-        have_not = tcg_op_supported(INDEX_op_not_i64, TCG_TYPE_I64, 0);
+        not_op = INDEX_op_not;
+        have_not = tcg_op_supported(INDEX_op_not, ctx->type, 0);
         break;
     case TCG_TYPE_V64:
     case TCG_TYPE_V128:
@@ -2987,7 +2985,8 @@ void tcg_optimize(TCGContext *s)
         case INDEX_op_nor_vec:
             done = fold_nor(&ctx, op);
             break;
-        CASE_OP_32_64_VEC(not):
+        case INDEX_op_not:
+        case INDEX_op_not_vec:
             done = fold_not(&ctx, op);
             break;
         case INDEX_op_or:
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index e0f8ab28b8..ddc1f465a4 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -462,9 +462,9 @@ void tcg_gen_xori_i32(TCGv_i32 ret, TCGv_i32 arg1, int32_t arg2)
     if (arg2 == 0) {
         tcg_gen_mov_i32(ret, arg1);
     } else if (arg2 == -1 &&
-               tcg_op_supported(INDEX_op_not_i32, TCG_TYPE_I32, 0)) {
+               tcg_op_supported(INDEX_op_not, TCG_TYPE_I32, 0)) {
         /* Don't recurse with tcg_gen_not_i32.  */
-        tcg_gen_op2_i32(INDEX_op_not_i32, ret, arg1);
+        tcg_gen_op2_i32(INDEX_op_not, ret, arg1);
     } else {
         tcg_gen_xor_i32(ret, arg1, tcg_constant_i32(arg2));
     }
@@ -472,8 +472,8 @@ void tcg_gen_xori_i32(TCGv_i32 ret, TCGv_i32 arg1, int32_t arg2)
 
 void tcg_gen_not_i32(TCGv_i32 ret, TCGv_i32 arg)
 {
-    if (tcg_op_supported(INDEX_op_not_i32, TCG_TYPE_I32, 0)) {
-        tcg_gen_op2_i32(INDEX_op_not_i32, ret, arg);
+    if (tcg_op_supported(INDEX_op_not, TCG_TYPE_I32, 0)) {
+        tcg_gen_op2_i32(INDEX_op_not, ret, arg);
     } else {
         tcg_gen_xori_i32(ret, arg, -1);
     }
@@ -1764,9 +1764,9 @@ void tcg_gen_xori_i64(TCGv_i64 ret, TCGv_i64 arg1, int64_t arg2)
     if (arg2 == 0) {
         tcg_gen_mov_i64(ret, arg1);
     } else if (arg2 == -1 &&
-               tcg_op_supported(INDEX_op_not_i64, TCG_TYPE_I64, 0)) {
+               tcg_op_supported(INDEX_op_not, TCG_TYPE_I64, 0)) {
         /* Don't recurse with tcg_gen_not_i64.  */
-        tcg_gen_op2_i64(INDEX_op_not_i64, ret, arg1);
+        tcg_gen_op2_i64(INDEX_op_not, ret, arg1);
     } else {
         tcg_gen_xor_i64(ret, arg1, tcg_constant_i64(arg2));
     }
@@ -2254,8 +2254,8 @@ void tcg_gen_not_i64(TCGv_i64 ret, TCGv_i64 arg)
     if (TCG_TARGET_REG_BITS == 32) {
         tcg_gen_not_i32(TCGV_LOW(ret), TCGV_LOW(arg));
         tcg_gen_not_i32(TCGV_HIGH(ret), TCGV_HIGH(arg));
-    } else if (tcg_op_supported(INDEX_op_not_i64, TCG_TYPE_I64, 0)) {
-        tcg_gen_op2_i64(INDEX_op_not_i64, ret, arg);
+    } else if (tcg_op_supported(INDEX_op_not, TCG_TYPE_I64, 0)) {
+        tcg_gen_op2_i64(INDEX_op_not, ret, arg);
     } else {
         tcg_gen_xori_i64(ret, arg, -1);
     }
diff --git a/tcg/tcg.c b/tcg/tcg.c
index acd666d30b..5e43a304c0 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1024,8 +1024,7 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_nand, TCGOutOpBinary, outop_nand),
     OUTOP(INDEX_op_neg, TCGOutOpUnary, outop_neg),
     OUTOP(INDEX_op_nor, TCGOutOpBinary, outop_nor),
-    OUTOP(INDEX_op_not_i32, TCGOutOpUnary, outop_not),
-    OUTOP(INDEX_op_not_i64, TCGOutOpUnary, outop_not),
+    OUTOP(INDEX_op_not, TCGOutOpUnary, outop_not),
     OUTOP(INDEX_op_or, TCGOutOpBinary, outop_or),
     OUTOP(INDEX_op_orc, TCGOutOpBinary, outop_orc),
     OUTOP(INDEX_op_sub, TCGOutOpSubtract, outop_sub),
@@ -5474,8 +5473,7 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
         break;
 
     case INDEX_op_neg:
-    case INDEX_op_not_i32:
-    case INDEX_op_not_i64:
+    case INDEX_op_not:
         {
             const TCGOutOpUnary *out =
                 container_of(all_outop[op->opc], TCGOutOpUnary, base);
diff --git a/tcg/tci.c b/tcg/tci.c
index 25ad37fcd5..96e3667ab2 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -571,6 +571,10 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_args_rr(insn, &r0, &r1);
             regs[r0] = -regs[r1];
             break;
+        case INDEX_op_not:
+            tci_args_rr(insn, &r0, &r1);
+            regs[r0] = ~regs[r1];
+            break;
 
             /* Arithmetic operations (32 bit). */
 
@@ -695,10 +699,6 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             regs[r0] = bswap32(regs[r1]);
             break;
 #endif
-        CASE_32_64(not)
-            tci_args_rr(insn, &r0, &r1);
-            regs[r0] = ~regs[r1];
-            break;
 #if TCG_TARGET_REG_BITS == 64
             /* Load/store operations (64 bit). */
 
@@ -1053,6 +1053,7 @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
 
     case INDEX_op_mov:
     case INDEX_op_neg:
+    case INDEX_op_not:
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
     case INDEX_op_bswap16_i32:
@@ -1060,8 +1061,6 @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
     case INDEX_op_bswap32_i32:
     case INDEX_op_bswap32_i64:
     case INDEX_op_bswap64_i64:
-    case INDEX_op_not_i32:
-    case INDEX_op_not_i64:
     case INDEX_op_ctpop_i32:
     case INDEX_op_ctpop_i64:
         tci_args_rr(insn, &r0, &r1);
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index d3da498098..a1f9a3a2f0 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -739,7 +739,7 @@ static const TCGOutOpUnary outop_neg = {
 
 static void tgen_not(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1)
 {
-    tcg_out_op_rr(s, glue(INDEX_op_not_i,TCG_TARGET_REG_BITS), a0, a1);
+    tcg_out_op_rr(s, INDEX_op_not, a0, a1);
 }
 
 static const TCGOutOpUnary outop_not = {

From 1e4ac0ea5dc86c54e97bbc4db9638f2febdfde8b Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 7 Jan 2025 09:15:09 -0800
Subject: [PATCH 0394/2760] tcg: Convert mul to TCGOutOpBinary
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target.c.inc     | 18 ++++---
 tcg/arm/tcg-target.c.inc         | 23 ++++----
 tcg/i386/tcg-target.c.inc        | 47 +++++++++-------
 tcg/loongarch64/tcg-target.c.inc | 24 +++++----
 tcg/mips/tcg-target.c.inc        | 43 +++++++++------
 tcg/ppc/tcg-target.c.inc         | 42 +++++++--------
 tcg/riscv/tcg-target.c.inc       | 21 ++++----
 tcg/s390x/tcg-target.c.inc       | 92 ++++++++++++++++++--------------
 tcg/sparc64/tcg-target.c.inc     | 28 +++++++---
 tcg/tcg.c                        |  6 ++-
 tcg/tci/tcg-target.c.inc         | 14 +++--
 11 files changed, 210 insertions(+), 148 deletions(-)

diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index 97b444bc17..4513140f58 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -2168,6 +2168,17 @@ static const TCGOutOpBinary outop_eqv = {
     .out_rrr = tgen_eqv,
 };
 
+static void tgen_mul(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_insn(s, 3509, MADD, type, a0, a1, a2, TCG_REG_XZR);
+}
+
+static const TCGOutOpBinary outop_mul = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_mul,
+};
+
 static const TCGOutOpBinary outop_nand = {
     .base.static_constraint = C_NotImplemented,
 };
@@ -2322,11 +2333,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType ext,
         tcg_out_ldst(s, I3312_STRX, a0, a1, a2, 3);
         break;
 
-    case INDEX_op_mul_i64:
-    case INDEX_op_mul_i32:
-        tcg_out_insn(s, 3509, MADD, ext, a0, a1, a2, TCG_REG_XZR);
-        break;
-
     case INDEX_op_div_i64:
     case INDEX_op_div_i32:
         tcg_out_insn(s, 3508, SDIV, ext, a0, a1, a2);
@@ -3029,8 +3035,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_negsetcond_i64:
         return C_O1_I2(r, r, rC);
 
-    case INDEX_op_mul_i32:
-    case INDEX_op_mul_i64:
     case INDEX_op_div_i32:
     case INDEX_op_div_i64:
     case INDEX_op_divu_i32:
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index 2477b1c4ab..93e5c70ae3 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -921,13 +921,6 @@ static void tcg_out_dat_rIN(TCGContext *s, ARMCond cond, ARMInsn opc,
     }
 }
 
-static void tcg_out_mul32(TCGContext *s, ARMCond cond, TCGReg rd,
-                          TCGReg rn, TCGReg rm)
-{
-    /* mul */
-    tcg_out32(s, (cond << 28) | 0x90 | (rd << 16) | (rm << 8) | rn);
-}
-
 static void tcg_out_umull32(TCGContext *s, ARMCond cond, TCGReg rd0,
                             TCGReg rd1, TCGReg rn, TCGReg rm)
 {
@@ -1885,6 +1878,18 @@ static const TCGOutOpBinary outop_eqv = {
     .base.static_constraint = C_NotImplemented,
 };
 
+static void tgen_mul(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    /* mul */
+    tcg_out32(s, (COND_AL << 28) | 0x90 | (a0 << 16) | (a1 << 8) | a2);
+}
+
+static const TCGOutOpBinary outop_mul = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_mul,
+};
+
 static const TCGOutOpBinary outop_nand = {
     .base.static_constraint = C_NotImplemented,
 };
@@ -2060,9 +2065,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         tcg_out_mov_reg(s, COND_AL, args[0], a0);
         break;
-    case INDEX_op_mul_i32:
-        tcg_out_mul32(s, COND_AL, args[0], args[1], args[2]);
-        break;
     case INDEX_op_mulu2_i32:
         tcg_out_umull32(s, COND_AL, args[0], args[1], args[2], args[3]);
         break;
@@ -2258,7 +2260,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ctz_i32:
         return C_O1_I2(r, r, rIK);
 
-    case INDEX_op_mul_i32:
     case INDEX_op_div_i32:
     case INDEX_op_divu_i32:
         return C_O1_I2(r, r, r);
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index 24fef09c9e..4abe89d06e 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -2637,6 +2637,33 @@ static const TCGOutOpBinary outop_eqv = {
     .base.static_constraint = C_NotImplemented,
 };
 
+static void tgen_mul(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    int rexw = type == TCG_TYPE_I32 ? 0 : P_REXW;
+    tcg_out_modrm(s, OPC_IMUL_GvEv + rexw, a0, a2);
+}
+
+static void tgen_muli(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    int rexw = type == TCG_TYPE_I32 ? 0 : P_REXW;
+
+    if (a2 == (int8_t)a2) {
+        tcg_out_modrm(s, OPC_IMUL_GvEvIb + rexw, a0, a0);
+        tcg_out8(s, a2);
+    } else {
+        tcg_out_modrm(s, OPC_IMUL_GvEvIz + rexw, a0, a0);
+        tcg_out32(s, a2);
+    }
+}
+
+static const TCGOutOpBinary outop_mul = {
+    .base.static_constraint = C_O1_I2(r, 0, re),
+    .out_rrr = tgen_mul,
+    .out_rri = tgen_muli,
+};
+
 static const TCGOutOpBinary outop_nand = {
     .base.static_constraint = C_NotImplemented,
 };
@@ -2804,22 +2831,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    OP_32_64(mul):
-        if (const_a2) {
-            int32_t val;
-            val = a2;
-            if (val == (int8_t)val) {
-                tcg_out_modrm(s, OPC_IMUL_GvEvIb + rexw, a0, a0);
-                tcg_out8(s, val);
-            } else {
-                tcg_out_modrm(s, OPC_IMUL_GvEvIz + rexw, a0, a0);
-                tcg_out32(s, val);
-            }
-        } else {
-            tcg_out_modrm(s, OPC_IMUL_GvEv + rexw, a0, a2);
-        }
-        break;
-
     OP_32_64(div2):
         tcg_out_modrm(s, OPC_GRP3_Ev + rexw, EXT3_IDIV, args[4]);
         break;
@@ -3707,10 +3718,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(re, r);
 
-    case INDEX_op_mul_i32:
-    case INDEX_op_mul_i64:
-        return C_O1_I2(r, 0, re);
-
     case INDEX_op_shl_i32:
     case INDEX_op_shl_i64:
     case INDEX_op_shr_i32:
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index c24882b6ba..448896ac0d 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -1332,6 +1332,21 @@ static const TCGOutOpBinary outop_eqv = {
     .base.static_constraint = C_NotImplemented,
 };
 
+static void tgen_mul(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    if (type == TCG_TYPE_I32) {
+        tcg_out_opc_mul_w(s, a0, a1, a2);
+    } else {
+        tcg_out_opc_mul_d(s, a0, a1, a2);
+    }
+}
+
+static const TCGOutOpBinary outop_mul = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_mul,
+};
+
 static const TCGOutOpBinary outop_nand = {
     .base.static_constraint = C_NotImplemented,
 };
@@ -1626,13 +1641,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    case INDEX_op_mul_i32:
-        tcg_out_opc_mul_w(s, a0, a1, a2);
-        break;
-    case INDEX_op_mul_i64:
-        tcg_out_opc_mul_d(s, a0, a1, a2);
-        break;
-
     case INDEX_op_mulsh_i32:
         tcg_out_opc_mulh_w(s, a0, a1, a2);
         break;
@@ -2333,8 +2341,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_setcond_i64:
         return C_O1_I2(r, rz, rJ);
 
-    case INDEX_op_mul_i32:
-    case INDEX_op_mul_i64:
     case INDEX_op_mulsh_i32:
     case INDEX_op_mulsh_i64:
     case INDEX_op_muluh_i32:
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index 4942855189..95c2645226 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -1716,6 +1716,33 @@ static const TCGOutOpBinary outop_eqv = {
     .base.static_constraint = C_NotImplemented,
 };
 
+static void tgen_mul(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    MIPSInsn insn;
+
+    if (type == TCG_TYPE_I32) {
+        if (use_mips32_instructions) {
+            tcg_out_opc_reg(s, OPC_MUL, a0, a1, a2);
+            return;
+        }
+        insn = OPC_MULT;
+    } else {
+        if (use_mips32r6_instructions) {
+            tcg_out_opc_reg(s, OPC_DMUL, a0, a1, a2);
+            return;
+        }
+        insn = OPC_DMULT;
+    }
+    tcg_out_opc_reg(s, insn, 0, a1, a2);
+    tcg_out_opc_reg(s, OPC_MFLO, a0, 0, 0);
+}
+
+static const TCGOutOpBinary outop_mul = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_mul,
+};
+
 static const TCGOutOpBinary outop_nand = {
     .base.static_constraint = C_NotImplemented,
 };
@@ -1876,13 +1903,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_ldst(s, i1, a0, a1, a2);
         break;
 
-    case INDEX_op_mul_i32:
-        if (use_mips32_instructions) {
-            tcg_out_opc_reg(s, OPC_MUL, a0, a1, a2);
-            break;
-        }
-        i1 = OPC_MULT, i2 = OPC_MFLO;
-        goto do_hilo1;
     case INDEX_op_mulsh_i32:
         if (use_mips32r6_instructions) {
             tcg_out_opc_reg(s, OPC_MUH, a0, a1, a2);
@@ -1925,13 +1945,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         i1 = OPC_DIVU, i2 = OPC_MFHI;
         goto do_hilo1;
-    case INDEX_op_mul_i64:
-        if (use_mips32r6_instructions) {
-            tcg_out_opc_reg(s, OPC_DMUL, a0, a1, a2);
-            break;
-        }
-        i1 = OPC_DMULT, i2 = OPC_MFLO;
-        goto do_hilo1;
     case INDEX_op_mulsh_i64:
         if (use_mips32r6_instructions) {
             tcg_out_opc_reg(s, OPC_DMUH, a0, a1, a2);
@@ -2232,7 +2245,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(rz, r);
 
-    case INDEX_op_mul_i32:
     case INDEX_op_mulsh_i32:
     case INDEX_op_muluh_i32:
     case INDEX_op_div_i32:
@@ -2240,7 +2252,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_rem_i32:
     case INDEX_op_remu_i32:
     case INDEX_op_setcond_i32:
-    case INDEX_op_mul_i64:
     case INDEX_op_mulsh_i64:
     case INDEX_op_muluh_i64:
     case INDEX_op_div_i64:
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index 38cbe5223b..a7cc9d0bc7 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -2965,6 +2965,25 @@ static const TCGOutOpBinary outop_eqv = {
     .out_rrr = tgen_eqv,
 };
 
+static void tgen_mul(TCGContext *s, TCGType type,
+                    TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    uint32_t insn = type == TCG_TYPE_I32 ? MULLW : MULLD;
+    tcg_out32(s, insn | TAB(a0, a1, a2));
+}
+
+static void tgen_muli(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    tcg_out32(s, MULLI | TAI(a0, a1, a2));
+}
+
+static const TCGOutOpBinary outop_mul = {
+    .base.static_constraint = C_O1_I2(r, r, rI),
+    .out_rrr = tgen_mul,
+    .out_rri = tgen_muli,
+};
+
 static void tgen_nand(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -3077,7 +3096,7 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
                        const int const_args[TCG_MAX_OP_ARGS])
 {
-    TCGArg a0, a1, a2;
+    TCGArg a0, a1;
 
     switch (opc) {
     case INDEX_op_goto_ptr:
@@ -3166,15 +3185,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out32(s, CNTPOPD | SAB(args[1], args[0], 0));
         break;
 
-    case INDEX_op_mul_i32:
-        a0 = args[0], a1 = args[1], a2 = args[2];
-        if (const_args[2]) {
-            tcg_out32(s, MULLI | TAI(a0, a1, a2));
-        } else {
-            tcg_out32(s, MULLW | TAB(a0, a1, a2));
-        }
-        break;
-
     case INDEX_op_div_i32:
         tcg_out32(s, DIVW | TAB(args[0], args[1], args[2]));
         break;
@@ -3283,14 +3293,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    case INDEX_op_mul_i64:
-        a0 = args[0], a1 = args[1], a2 = args[2];
-        if (const_args[2]) {
-            tcg_out32(s, MULLI | TAI(a0, a1, a2));
-        } else {
-            tcg_out32(s, MULLD | TAB(a0, a1, a2));
-        }
-        break;
     case INDEX_op_div_i64:
         tcg_out32(s, DIVD | TAB(args[0], args[1], args[2]));
         break;
@@ -4171,10 +4173,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_rotr_i64:
         return C_O1_I2(r, r, ri);
 
-    case INDEX_op_mul_i32:
-    case INDEX_op_mul_i64:
-        return C_O1_I2(r, r, rI);
-
     case INDEX_op_div_i32:
     case INDEX_op_divu_i32:
     case INDEX_op_rem_i32:
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index 5e9e14815d..ff685037d7 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -2009,6 +2009,18 @@ static const TCGOutOpBinary outop_eqv = {
     .out_rrr = tgen_eqv,
 };
 
+static void tgen_mul(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    RISCVInsn insn = type == TCG_TYPE_I32 ? OPC_MULW : OPC_MUL;
+    tcg_out_opc_reg(s, insn, a0, a1, a2);
+}
+
+static const TCGOutOpBinary outop_mul = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_mul,
+};
+
 static const TCGOutOpBinary outop_nand = {
     .base.static_constraint = C_NotImplemented,
 };
@@ -2160,13 +2172,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_ldst(s, OPC_SD, a0, a1, a2);
         break;
 
-    case INDEX_op_mul_i32:
-        tcg_out_opc_reg(s, OPC_MULW, a0, a1, a2);
-        break;
-    case INDEX_op_mul_i64:
-        tcg_out_opc_reg(s, OPC_MUL, a0, a1, a2);
-        break;
-
     case INDEX_op_div_i32:
         tcg_out_opc_reg(s, OPC_DIVW, a0, a1, a2);
         break;
@@ -2706,14 +2711,12 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_negsetcond_i64:
         return C_O1_I2(r, r, rI);
 
-    case INDEX_op_mul_i32:
     case INDEX_op_mulsh_i32:
     case INDEX_op_muluh_i32:
     case INDEX_op_div_i32:
     case INDEX_op_divu_i32:
     case INDEX_op_rem_i32:
     case INDEX_op_remu_i32:
-    case INDEX_op_mul_i64:
     case INDEX_op_mulsh_i64:
     case INDEX_op_muluh_i64:
     case INDEX_op_div_i64:
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index 98bf3ee19e..1ba9741fdd 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -2258,6 +2258,57 @@ static const TCGOutOpBinary outop_eqv = {
     .out_rrr = tgen_eqv,
 };
 
+static void tgen_mul(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    if (type == TCG_TYPE_I32) {
+        if (a0 == a1) {
+            tcg_out_insn(s, RRE, MSR, a0, a2);
+        } else {
+            tcg_out_insn(s, RRFa, MSRKC, a0, a1, a2);
+        }
+    } else {
+        if (a0 == a1) {
+            tcg_out_insn(s, RRE, MSGR, a0, a2);
+        } else {
+            tcg_out_insn(s, RRFa, MSGRKC, a0, a1, a2);
+        }
+    }
+}
+
+static void tgen_muli(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    tcg_out_mov(s, type, a0, a1);
+    if (type == TCG_TYPE_I32) {
+        if (a2 == (int16_t)a2) {
+            tcg_out_insn(s, RI, MHI, a0, a2);
+        } else {
+            tcg_out_insn(s, RIL, MSFI, a0, a2);
+        }
+    } else {
+        if (a2 == (int16_t)a2) {
+            tcg_out_insn(s, RI, MGHI, a0, a2);
+        } else {
+            tcg_out_insn(s, RIL, MSGFI, a0, a2);
+        }
+    }
+}
+
+static TCGConstraintSetIndex cset_mul(TCGType type, unsigned flags)
+{
+    return (HAVE_FACILITY(MISC_INSN_EXT2)
+            ? C_O1_I2(r, r, rJ)
+            : C_O1_I2(r, 0, rJ));
+}
+
+static const TCGOutOpBinary outop_mul = {
+    .base.static_constraint = C_Dynamic,
+    .base.dynamic_constraint = cset_mul,
+    .out_rrr = tgen_mul,
+    .out_rri = tgen_muli,
+};
+
 static void tgen_nand(TCGContext *s, TCGType type,
                       TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -2460,22 +2511,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_st(s, TCG_TYPE_I32, args[0], args[1], args[2]);
         break;
 
-    case INDEX_op_mul_i32:
-        a0 = args[0], a1 = args[1], a2 = (int32_t)args[2];
-        if (const_args[2]) {
-            tcg_out_mov(s, TCG_TYPE_I32, a0, a1);
-            if (a2 == (int16_t)a2) {
-                tcg_out_insn(s, RI, MHI, a0, a2);
-            } else {
-                tcg_out_insn(s, RIL, MSFI, a0, a2);
-            }
-        } else if (a0 == a1) {
-            tcg_out_insn(s, RRE, MSR, a0, a2);
-        } else {
-            tcg_out_insn(s, RRFa, MSRKC, a0, a1, a2);
-        }
-        break;
-
     case INDEX_op_div2_i32:
         tcg_debug_assert(args[0] == args[2]);
         tcg_debug_assert(args[1] == args[3]);
@@ -2651,22 +2686,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_insn(s, RRE, LRVGR, args[0], args[1]);
         break;
 
-    case INDEX_op_mul_i64:
-        a0 = args[0], a1 = args[1], a2 = args[2];
-        if (const_args[2]) {
-            tcg_out_mov(s, TCG_TYPE_I64, a0, a1);
-            if (a2 == (int16_t)a2) {
-                tcg_out_insn(s, RI, MGHI, a0, a2);
-            } else {
-                tcg_out_insn(s, RIL, MSGFI, a0, a2);
-            }
-        } else if (a0 == a1) {
-            tcg_out_insn(s, RRE, MSGR, a0, a2);
-        } else {
-            tcg_out_insn(s, RRFa, MSGRKC, a0, a1, a2);
-        }
-        break;
-
     case INDEX_op_div2_i64:
         /*
          * ??? We get an unnecessary sign-extension of the dividend
@@ -3316,15 +3335,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_clz_i64:
         return C_O1_I2(r, r, rI);
 
-    case INDEX_op_mul_i32:
-        return (HAVE_FACILITY(MISC_INSN_EXT2)
-                ? C_O1_I2(r, r, ri)
-                : C_O1_I2(r, 0, ri));
-    case INDEX_op_mul_i64:
-        return (HAVE_FACILITY(MISC_INSN_EXT2)
-                ? C_O1_I2(r, r, rJ)
-                : C_O1_I2(r, 0, rJ));
-
     case INDEX_op_shl_i32:
     case INDEX_op_shr_i32:
     case INDEX_op_sar_i32:
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index 5819dc44fe..0a13a91166 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -1337,6 +1337,26 @@ static const TCGOutOpBinary outop_eqv = {
     .base.static_constraint = C_NotImplemented,
 };
 
+static void tgen_mul(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    uint32_t insn = type == TCG_TYPE_I32 ? ARITH_UMUL : ARITH_MULX;
+    tcg_out_arith(s, a0, a1, a2, insn);
+}
+
+static void tgen_muli(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    uint32_t insn = type == TCG_TYPE_I32 ? ARITH_UMUL : ARITH_MULX;
+    tcg_out_arithi(s, a0, a1, a2, insn);
+}
+
+static const TCGOutOpBinary outop_mul = {
+    .base.static_constraint = C_O1_I2(r, r, rJ),
+    .out_rrr = tgen_mul,
+    .out_rri = tgen_muli,
+};
+
 static const TCGOutOpBinary outop_nand = {
     .base.static_constraint = C_NotImplemented,
 };
@@ -1489,9 +1509,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     case INDEX_op_sar_i32:
         c = SHIFT_SRA;
         goto do_shift32;
-    case INDEX_op_mul_i32:
-        c = ARITH_UMUL;
-        goto gen_arith;
 
     case INDEX_op_div_i32:
         tcg_out_div32(s, a0, a1, a2, c2, 0);
@@ -1568,9 +1585,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     case INDEX_op_sar_i64:
         c = SHIFT_SRAX;
         goto do_shift64;
-    case INDEX_op_mul_i64:
-        c = ARITH_MULX;
-        goto gen_arith;
     case INDEX_op_div_i64:
         c = ARITH_SDIVX;
         goto gen_arith;
@@ -1667,8 +1681,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_qemu_st_i64:
         return C_O0_I2(rz, r);
 
-    case INDEX_op_mul_i32:
-    case INDEX_op_mul_i64:
     case INDEX_op_div_i32:
     case INDEX_op_div_i64:
     case INDEX_op_divu_i32:
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 5e43a304c0..4d221cea6f 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1021,6 +1021,8 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_and, TCGOutOpBinary, outop_and),
     OUTOP(INDEX_op_andc, TCGOutOpBinary, outop_andc),
     OUTOP(INDEX_op_eqv, TCGOutOpBinary, outop_eqv),
+    OUTOP(INDEX_op_mul_i32, TCGOutOpBinary, outop_mul),
+    OUTOP(INDEX_op_mul_i64, TCGOutOpBinary, outop_mul),
     OUTOP(INDEX_op_nand, TCGOutOpBinary, outop_nand),
     OUTOP(INDEX_op_neg, TCGOutOpUnary, outop_neg),
     OUTOP(INDEX_op_nor, TCGOutOpBinary, outop_nor),
@@ -2247,7 +2249,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st8_i32:
     case INDEX_op_st16_i32:
     case INDEX_op_st_i32:
-    case INDEX_op_mul_i32:
     case INDEX_op_shl_i32:
     case INDEX_op_shr_i32:
     case INDEX_op_sar_i32:
@@ -2313,7 +2314,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st16_i64:
     case INDEX_op_st32_i64:
     case INDEX_op_st_i64:
-    case INDEX_op_mul_i64:
     case INDEX_op_shl_i64:
     case INDEX_op_shr_i64:
     case INDEX_op_sar_i64:
@@ -5436,6 +5436,8 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
     case INDEX_op_and:
     case INDEX_op_andc:
     case INDEX_op_eqv:
+    case INDEX_op_mul_i32:
+    case INDEX_op_mul_i64:
     case INDEX_op_nand:
     case INDEX_op_nor:
     case INDEX_op_or:
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index a1f9a3a2f0..ce17079ffc 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -87,8 +87,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_rem_i64:
     case INDEX_op_remu_i32:
     case INDEX_op_remu_i64:
-    case INDEX_op_mul_i32:
-    case INDEX_op_mul_i64:
     case INDEX_op_shl_i32:
     case INDEX_op_shl_i64:
     case INDEX_op_shr_i32:
@@ -661,6 +659,17 @@ static const TCGOutOpBinary outop_eqv = {
     .out_rrr = tgen_eqv,
 };
 
+static void tgen_mul(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_op_rrr(s, glue(INDEX_op_mul_i,TCG_TARGET_REG_BITS), a0, a1, a2);
+}
+
+static const TCGOutOpBinary outop_mul = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_mul,
+};
+
 static void tgen_nand(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -789,7 +798,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_ldst(s, opc, args[0], args[1], args[2]);
         break;
 
-    CASE_32_64(mul)
     CASE_32_64(shl)
     CASE_32_64(shr)
     CASE_32_64(sar)

From d2c3ecadea89832ab82566e881bc3a288b020473 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 7 Jan 2025 09:32:18 -0800
Subject: [PATCH 0395/2760] tcg: Merge INDEX_op_mul_{i32,i64}
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 docs/devel/tcg-ops.rst   |  2 +-
 include/tcg/tcg-opc.h    |  3 +--
 tcg/optimize.c           |  4 ++--
 tcg/tcg-op.c             | 12 ++++++------
 tcg/tcg.c                | 14 ++++++--------
 tcg/tci.c                |  5 ++---
 tcg/tci/tcg-target.c.inc |  2 +-
 7 files changed, 19 insertions(+), 23 deletions(-)

diff --git a/docs/devel/tcg-ops.rst b/docs/devel/tcg-ops.rst
index 96dddc5fd3..6c36e72242 100644
--- a/docs/devel/tcg-ops.rst
+++ b/docs/devel/tcg-ops.rst
@@ -273,7 +273,7 @@ Arithmetic
 
      - | *t0* = -*t1* (two's complement)
 
-   * - mul_i32/i64 *t0*, *t1*, *t2*
+   * - mul *t0*, *t1*, *t2*
 
      - | *t0* = *t1* * *t2*
 
diff --git a/include/tcg/tcg-opc.h b/include/tcg/tcg-opc.h
index d0fcdfd241..4ecba62fda 100644
--- a/include/tcg/tcg-opc.h
+++ b/include/tcg/tcg-opc.h
@@ -43,6 +43,7 @@ DEF(add, 1, 2, 0, TCG_OPF_INT)
 DEF(and, 1, 2, 0, TCG_OPF_INT)
 DEF(andc, 1, 2, 0, TCG_OPF_INT)
 DEF(eqv, 1, 2, 0, TCG_OPF_INT)
+DEF(mul, 1, 2, 0, TCG_OPF_INT)
 DEF(nand, 1, 2, 0, TCG_OPF_INT)
 DEF(neg, 1, 1, 0, TCG_OPF_INT)
 DEF(nor, 1, 2, 0, TCG_OPF_INT)
@@ -65,7 +66,6 @@ DEF(st8_i32, 0, 2, 1, 0)
 DEF(st16_i32, 0, 2, 1, 0)
 DEF(st_i32, 0, 2, 1, 0)
 /* arith */
-DEF(mul_i32, 1, 2, 0, 0)
 DEF(div_i32, 1, 2, 0, 0)
 DEF(divu_i32, 1, 2, 0, 0)
 DEF(rem_i32, 1, 2, 0, 0)
@@ -116,7 +116,6 @@ DEF(st16_i64, 0, 2, 1, 0)
 DEF(st32_i64, 0, 2, 1, 0)
 DEF(st_i64, 0, 2, 1, 0)
 /* arith */
-DEF(mul_i64, 1, 2, 0, 0)
 DEF(div_i64, 1, 2, 0, 0)
 DEF(divu_i64, 1, 2, 0, 0)
 DEF(rem_i64, 1, 2, 0, 0)
diff --git a/tcg/optimize.c b/tcg/optimize.c
index 315ee0a8bc..653246f3d2 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -430,7 +430,7 @@ static uint64_t do_constant_folding_2(TCGOpcode op, uint64_t x, uint64_t y)
     case INDEX_op_sub:
         return x - y;
 
-    CASE_OP_32_64(mul):
+    case INDEX_op_mul:
         return x * y;
 
     case INDEX_op_and:
@@ -2963,7 +2963,7 @@ void tcg_optimize(TCGContext *s)
         CASE_OP_32_64(movcond):
             done = fold_movcond(&ctx, op);
             break;
-        CASE_OP_32_64(mul):
+        case INDEX_op_mul:
             done = fold_mul(&ctx, op);
             break;
         CASE_OP_32_64(mulsh):
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index ddc1f465a4..76d5b67fba 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -585,7 +585,7 @@ void tcg_gen_negsetcondi_i32(TCGCond cond, TCGv_i32 ret,
 
 void tcg_gen_mul_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 {
-    tcg_gen_op3_i32(INDEX_op_mul_i32, ret, arg1, arg2);
+    tcg_gen_op3_i32(INDEX_op_mul, ret, arg1, arg2);
 }
 
 void tcg_gen_muli_i32(TCGv_i32 ret, TCGv_i32 arg1, int32_t arg2)
@@ -1134,7 +1134,7 @@ void tcg_gen_mulu2_i32(TCGv_i32 rl, TCGv_i32 rh, TCGv_i32 arg1, TCGv_i32 arg2)
         tcg_gen_op4_i32(INDEX_op_mulu2_i32, rl, rh, arg1, arg2);
     } else if (TCG_TARGET_HAS_muluh_i32) {
         TCGv_i32 t = tcg_temp_ebb_new_i32();
-        tcg_gen_op3_i32(INDEX_op_mul_i32, t, arg1, arg2);
+        tcg_gen_op3_i32(INDEX_op_mul, t, arg1, arg2);
         tcg_gen_op3_i32(INDEX_op_muluh_i32, rh, arg1, arg2);
         tcg_gen_mov_i32(rl, t);
         tcg_temp_free_i32(t);
@@ -1158,7 +1158,7 @@ void tcg_gen_muls2_i32(TCGv_i32 rl, TCGv_i32 rh, TCGv_i32 arg1, TCGv_i32 arg2)
         tcg_gen_op4_i32(INDEX_op_muls2_i32, rl, rh, arg1, arg2);
     } else if (TCG_TARGET_HAS_mulsh_i32) {
         TCGv_i32 t = tcg_temp_ebb_new_i32();
-        tcg_gen_op3_i32(INDEX_op_mul_i32, t, arg1, arg2);
+        tcg_gen_op3_i32(INDEX_op_mul, t, arg1, arg2);
         tcg_gen_op3_i32(INDEX_op_mulsh_i32, rh, arg1, arg2);
         tcg_gen_mov_i32(rl, t);
         tcg_temp_free_i32(t);
@@ -1636,7 +1636,7 @@ void tcg_gen_mul_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
     TCGv_i32 t1;
 
     if (TCG_TARGET_REG_BITS == 64) {
-        tcg_gen_op3_i64(INDEX_op_mul_i64, ret, arg1, arg2);
+        tcg_gen_op3_i64(INDEX_op_mul, ret, arg1, arg2);
         return;
     }
 
@@ -2844,7 +2844,7 @@ void tcg_gen_mulu2_i64(TCGv_i64 rl, TCGv_i64 rh, TCGv_i64 arg1, TCGv_i64 arg2)
         tcg_gen_op4_i64(INDEX_op_mulu2_i64, rl, rh, arg1, arg2);
     } else if (TCG_TARGET_HAS_muluh_i64) {
         TCGv_i64 t = tcg_temp_ebb_new_i64();
-        tcg_gen_op3_i64(INDEX_op_mul_i64, t, arg1, arg2);
+        tcg_gen_op3_i64(INDEX_op_mul, t, arg1, arg2);
         tcg_gen_op3_i64(INDEX_op_muluh_i64, rh, arg1, arg2);
         tcg_gen_mov_i64(rl, t);
         tcg_temp_free_i64(t);
@@ -2863,7 +2863,7 @@ void tcg_gen_muls2_i64(TCGv_i64 rl, TCGv_i64 rh, TCGv_i64 arg1, TCGv_i64 arg2)
         tcg_gen_op4_i64(INDEX_op_muls2_i64, rl, rh, arg1, arg2);
     } else if (TCG_TARGET_HAS_mulsh_i64) {
         TCGv_i64 t = tcg_temp_ebb_new_i64();
-        tcg_gen_op3_i64(INDEX_op_mul_i64, t, arg1, arg2);
+        tcg_gen_op3_i64(INDEX_op_mul, t, arg1, arg2);
         tcg_gen_op3_i64(INDEX_op_mulsh_i64, rh, arg1, arg2);
         tcg_gen_mov_i64(rl, t);
         tcg_temp_free_i64(t);
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 4d221cea6f..d16ed332c8 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1021,8 +1021,7 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_and, TCGOutOpBinary, outop_and),
     OUTOP(INDEX_op_andc, TCGOutOpBinary, outop_andc),
     OUTOP(INDEX_op_eqv, TCGOutOpBinary, outop_eqv),
-    OUTOP(INDEX_op_mul_i32, TCGOutOpBinary, outop_mul),
-    OUTOP(INDEX_op_mul_i64, TCGOutOpBinary, outop_mul),
+    OUTOP(INDEX_op_mul, TCGOutOpBinary, outop_mul),
     OUTOP(INDEX_op_nand, TCGOutOpBinary, outop_nand),
     OUTOP(INDEX_op_neg, TCGOutOpUnary, outop_neg),
     OUTOP(INDEX_op_nor, TCGOutOpBinary, outop_nor),
@@ -4035,22 +4034,22 @@ liveness_pass_1(TCGContext *s)
             goto do_not_remove;
 
         case INDEX_op_mulu2_i32:
-            opc_new = INDEX_op_mul_i32;
+            opc_new = INDEX_op_mul;
             opc_new2 = INDEX_op_muluh_i32;
             have_opc_new2 = TCG_TARGET_HAS_muluh_i32;
             goto do_mul2;
         case INDEX_op_muls2_i32:
-            opc_new = INDEX_op_mul_i32;
+            opc_new = INDEX_op_mul;
             opc_new2 = INDEX_op_mulsh_i32;
             have_opc_new2 = TCG_TARGET_HAS_mulsh_i32;
             goto do_mul2;
         case INDEX_op_mulu2_i64:
-            opc_new = INDEX_op_mul_i64;
+            opc_new = INDEX_op_mul;
             opc_new2 = INDEX_op_muluh_i64;
             have_opc_new2 = TCG_TARGET_HAS_muluh_i64;
             goto do_mul2;
         case INDEX_op_muls2_i64:
-            opc_new = INDEX_op_mul_i64;
+            opc_new = INDEX_op_mul;
             opc_new2 = INDEX_op_mulsh_i64;
             have_opc_new2 = TCG_TARGET_HAS_mulsh_i64;
             goto do_mul2;
@@ -5436,8 +5435,7 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
     case INDEX_op_and:
     case INDEX_op_andc:
     case INDEX_op_eqv:
-    case INDEX_op_mul_i32:
-    case INDEX_op_mul_i64:
+    case INDEX_op_mul:
     case INDEX_op_nand:
     case INDEX_op_nor:
     case INDEX_op_or:
diff --git a/tcg/tci.c b/tcg/tci.c
index 96e3667ab2..61c0ccf21e 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -531,7 +531,7 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = regs[r1] - regs[r2];
             break;
-        CASE_32_64(mul)
+        case INDEX_op_mul:
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = regs[r1] * regs[r2];
             break;
@@ -1072,14 +1072,13 @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
     case INDEX_op_and:
     case INDEX_op_andc:
     case INDEX_op_eqv:
+    case INDEX_op_mul:
     case INDEX_op_nand:
     case INDEX_op_nor:
     case INDEX_op_or:
     case INDEX_op_orc:
     case INDEX_op_sub:
     case INDEX_op_xor:
-    case INDEX_op_mul_i32:
-    case INDEX_op_mul_i64:
     case INDEX_op_div_i32:
     case INDEX_op_div_i64:
     case INDEX_op_rem_i32:
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index ce17079ffc..ffc8654427 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -662,7 +662,7 @@ static const TCGOutOpBinary outop_eqv = {
 static void tgen_mul(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
-    tcg_out_op_rrr(s, glue(INDEX_op_mul_i,TCG_TARGET_REG_BITS), a0, a1, a2);
+    tcg_out_op_rrr(s, INDEX_op_mul, a0, a1, a2);
 }
 
 static const TCGOutOpBinary outop_mul = {

From 937246f2ee87d01062bac7c356c1766b8c5038a8 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 7 Jan 2025 10:16:03 -0800
Subject: [PATCH 0396/2760] tcg: Convert muluh to TCGOutOpBinary
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Remove unreachable mul[su]h_i32 leftovers from commit aeb6326ec5e
("tcg/riscv: Require TCG_TARGET_REG_BITS == 64").

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target-has.h     |  2 --
 tcg/aarch64/tcg-target.c.inc     | 21 ++++++++++++++++----
 tcg/arm/tcg-target-has.h         |  1 -
 tcg/arm/tcg-target.c.inc         |  4 ++++
 tcg/i386/tcg-target-has.h        |  2 --
 tcg/i386/tcg-target.c.inc        |  4 ++++
 tcg/loongarch64/tcg-target-has.h |  2 --
 tcg/loongarch64/tcg-target.c.inc | 24 +++++++++++++---------
 tcg/mips/tcg-target-has.h        |  2 --
 tcg/mips/tcg-target.c.inc        | 34 +++++++++++++++++---------------
 tcg/ppc/tcg-target-has.h         |  2 --
 tcg/ppc/tcg-target.c.inc         | 20 +++++++++++--------
 tcg/riscv/tcg-target-has.h       |  2 --
 tcg/riscv/tcg-target.c.inc       | 24 +++++++++++++++-------
 tcg/s390x/tcg-target-has.h       |  2 --
 tcg/s390x/tcg-target.c.inc       |  4 ++++
 tcg/sparc64/tcg-target-has.h     |  2 --
 tcg/sparc64/tcg-target.c.inc     | 23 ++++++++++++++++-----
 tcg/tcg-has.h                    |  1 -
 tcg/tcg-op.c                     |  7 ++++---
 tcg/tcg.c                        | 16 ++++++---------
 tcg/tci/tcg-target-has.h         |  2 --
 tcg/tci/tcg-target.c.inc         |  4 ++++
 23 files changed, 123 insertions(+), 82 deletions(-)

diff --git a/tcg/aarch64/tcg-target-has.h b/tcg/aarch64/tcg-target-has.h
index 7f18727686..207a85ed61 100644
--- a/tcg/aarch64/tcg-target-has.h
+++ b/tcg/aarch64/tcg-target-has.h
@@ -27,7 +27,6 @@
 #define TCG_TARGET_HAS_sub2_i32         1
 #define TCG_TARGET_HAS_mulu2_i32        0
 #define TCG_TARGET_HAS_muls2_i32        0
-#define TCG_TARGET_HAS_muluh_i32        0
 #define TCG_TARGET_HAS_mulsh_i32        0
 #define TCG_TARGET_HAS_extr_i64_i32     0
 #define TCG_TARGET_HAS_qemu_st8_i32     0
@@ -47,7 +46,6 @@
 #define TCG_TARGET_HAS_sub2_i64         1
 #define TCG_TARGET_HAS_mulu2_i64        0
 #define TCG_TARGET_HAS_muls2_i64        0
-#define TCG_TARGET_HAS_muluh_i64        1
 #define TCG_TARGET_HAS_mulsh_i64        1
 
 /*
diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index 4513140f58..bd0b7938c8 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -2179,6 +2179,23 @@ static const TCGOutOpBinary outop_mul = {
     .out_rrr = tgen_mul,
 };
 
+static TCGConstraintSetIndex cset_mulh(TCGType type, unsigned flags)
+{
+    return type == TCG_TYPE_I64 ? C_O1_I2(r, r, r) : C_NotImplemented;
+}
+
+static void tgen_muluh(TCGContext *s, TCGType type,
+                       TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_insn(s, 3508, UMULH, TCG_TYPE_I64, a0, a1, a2);
+}
+
+static const TCGOutOpBinary outop_muluh = {
+    .base.static_constraint = C_Dynamic,
+    .base.dynamic_constraint = cset_mulh,
+    .out_rrr = tgen_muluh,
+};
+
 static const TCGOutOpBinary outop_nand = {
     .base.static_constraint = C_NotImplemented,
 };
@@ -2526,9 +2543,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType ext,
                         args[5], const_args[4], const_args[5], true);
         break;
 
-    case INDEX_op_muluh_i64:
-        tcg_out_insn(s, 3508, UMULH, TCG_TYPE_I64, a0, a1, a2);
-        break;
     case INDEX_op_mulsh_i64:
         tcg_out_insn(s, 3508, SMULH, TCG_TYPE_I64, a0, a1, a2);
         break;
@@ -3043,7 +3057,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_rem_i64:
     case INDEX_op_remu_i32:
     case INDEX_op_remu_i64:
-    case INDEX_op_muluh_i64:
     case INDEX_op_mulsh_i64:
         return C_O1_I2(r, r, r);
 
diff --git a/tcg/arm/tcg-target-has.h b/tcg/arm/tcg-target-has.h
index e766c6d628..d6b06e96bf 100644
--- a/tcg/arm/tcg-target-has.h
+++ b/tcg/arm/tcg-target-has.h
@@ -34,7 +34,6 @@ extern bool use_neon_instructions;
 #define TCG_TARGET_HAS_negsetcond_i32   1
 #define TCG_TARGET_HAS_mulu2_i32        1
 #define TCG_TARGET_HAS_muls2_i32        1
-#define TCG_TARGET_HAS_muluh_i32        0
 #define TCG_TARGET_HAS_mulsh_i32        0
 #define TCG_TARGET_HAS_div_i32          use_idiv_instructions
 #define TCG_TARGET_HAS_rem_i32          0
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index 93e5c70ae3..b08e23d0dc 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -1890,6 +1890,10 @@ static const TCGOutOpBinary outop_mul = {
     .out_rrr = tgen_mul,
 };
 
+static const TCGOutOpBinary outop_muluh = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static const TCGOutOpBinary outop_nand = {
     .base.static_constraint = C_NotImplemented,
 };
diff --git a/tcg/i386/tcg-target-has.h b/tcg/i386/tcg-target-has.h
index 3d36fe58f2..f4487ac1fc 100644
--- a/tcg/i386/tcg-target-has.h
+++ b/tcg/i386/tcg-target-has.h
@@ -39,7 +39,6 @@
 #define TCG_TARGET_HAS_sub2_i32         1
 #define TCG_TARGET_HAS_mulu2_i32        1
 #define TCG_TARGET_HAS_muls2_i32        1
-#define TCG_TARGET_HAS_muluh_i32        0
 #define TCG_TARGET_HAS_mulsh_i32        0
 
 #if TCG_TARGET_REG_BITS == 64
@@ -59,7 +58,6 @@
 #define TCG_TARGET_HAS_sub2_i64         1
 #define TCG_TARGET_HAS_mulu2_i64        1
 #define TCG_TARGET_HAS_muls2_i64        1
-#define TCG_TARGET_HAS_muluh_i64        0
 #define TCG_TARGET_HAS_mulsh_i64        0
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 #else
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index 4abe89d06e..5fdca05c9d 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -2664,6 +2664,10 @@ static const TCGOutOpBinary outop_mul = {
     .out_rri = tgen_muli,
 };
 
+static const TCGOutOpBinary outop_muluh = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static const TCGOutOpBinary outop_nand = {
     .base.static_constraint = C_NotImplemented,
 };
diff --git a/tcg/loongarch64/tcg-target-has.h b/tcg/loongarch64/tcg-target-has.h
index ffacb41e80..53335b2cdb 100644
--- a/tcg/loongarch64/tcg-target-has.h
+++ b/tcg/loongarch64/tcg-target-has.h
@@ -20,7 +20,6 @@
 #define TCG_TARGET_HAS_sub2_i32         0
 #define TCG_TARGET_HAS_mulu2_i32        0
 #define TCG_TARGET_HAS_muls2_i32        0
-#define TCG_TARGET_HAS_muluh_i32        1
 #define TCG_TARGET_HAS_mulsh_i32        1
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
@@ -47,7 +46,6 @@
 #define TCG_TARGET_HAS_sub2_i64         0
 #define TCG_TARGET_HAS_mulu2_i64        0
 #define TCG_TARGET_HAS_muls2_i64        0
-#define TCG_TARGET_HAS_muluh_i64        1
 #define TCG_TARGET_HAS_mulsh_i64        1
 
 #define TCG_TARGET_HAS_qemu_ldst_i128   (cpuinfo & CPUINFO_LSX)
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index 448896ac0d..738fdd1a9e 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -1347,6 +1347,21 @@ static const TCGOutOpBinary outop_mul = {
     .out_rrr = tgen_mul,
 };
 
+static void tgen_muluh(TCGContext *s, TCGType type,
+                       TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    if (type == TCG_TYPE_I32) {
+        tcg_out_opc_mulh_wu(s, a0, a1, a2);
+    } else {
+        tcg_out_opc_mulh_du(s, a0, a1, a2);
+    }
+}
+
+static const TCGOutOpBinary outop_muluh = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_muluh,
+};
+
 static const TCGOutOpBinary outop_nand = {
     .base.static_constraint = C_NotImplemented,
 };
@@ -1648,13 +1663,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_opc_mulh_d(s, a0, a1, a2);
         break;
 
-    case INDEX_op_muluh_i32:
-        tcg_out_opc_mulh_wu(s, a0, a1, a2);
-        break;
-    case INDEX_op_muluh_i64:
-        tcg_out_opc_mulh_du(s, a0, a1, a2);
-        break;
-
     case INDEX_op_div_i32:
         tcg_out_opc_div_w(s, a0, a1, a2);
         break;
@@ -2343,8 +2351,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 
     case INDEX_op_mulsh_i32:
     case INDEX_op_mulsh_i64:
-    case INDEX_op_muluh_i32:
-    case INDEX_op_muluh_i64:
     case INDEX_op_div_i32:
     case INDEX_op_div_i64:
     case INDEX_op_divu_i32:
diff --git a/tcg/mips/tcg-target-has.h b/tcg/mips/tcg-target-has.h
index 9d8e0fb8df..b559ab3846 100644
--- a/tcg/mips/tcg-target-has.h
+++ b/tcg/mips/tcg-target-has.h
@@ -43,7 +43,6 @@ extern bool use_mips32r2_instructions;
 #define TCG_TARGET_HAS_rem_i32          1
 #define TCG_TARGET_HAS_mulu2_i32        (!use_mips32r6_instructions)
 #define TCG_TARGET_HAS_muls2_i32        (!use_mips32r6_instructions)
-#define TCG_TARGET_HAS_muluh_i32        1
 #define TCG_TARGET_HAS_mulsh_i32        1
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
@@ -59,7 +58,6 @@ extern bool use_mips32r2_instructions;
 #define TCG_TARGET_HAS_sub2_i64         0
 #define TCG_TARGET_HAS_mulu2_i64        (!use_mips32r6_instructions)
 #define TCG_TARGET_HAS_muls2_i64        (!use_mips32r6_instructions)
-#define TCG_TARGET_HAS_muluh_i64        1
 #define TCG_TARGET_HAS_mulsh_i64        1
 #define TCG_TARGET_HAS_ext32s_i64       1
 #define TCG_TARGET_HAS_ext32u_i64       1
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index 95c2645226..24f8184c33 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -1743,6 +1743,24 @@ static const TCGOutOpBinary outop_mul = {
     .out_rrr = tgen_mul,
 };
 
+static void tgen_muluh(TCGContext *s, TCGType type,
+                       TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    if (use_mips32r6_instructions) {
+        MIPSInsn insn = type == TCG_TYPE_I32 ? OPC_MUHU : OPC_DMUHU;
+        tcg_out_opc_reg(s, insn, a0, a1, a2);
+    } else {
+        MIPSInsn insn = type == TCG_TYPE_I32 ? OPC_MULTU : OPC_DMULTU;
+        tcg_out_opc_reg(s, insn, 0, a1, a2);
+        tcg_out_opc_reg(s, OPC_MFHI, a0, 0, 0);
+    }
+}
+
+static const TCGOutOpBinary outop_muluh = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_muluh,
+};
+
 static const TCGOutOpBinary outop_nand = {
     .base.static_constraint = C_NotImplemented,
 };
@@ -1910,13 +1928,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         i1 = OPC_MULT, i2 = OPC_MFHI;
         goto do_hilo1;
-    case INDEX_op_muluh_i32:
-        if (use_mips32r6_instructions) {
-            tcg_out_opc_reg(s, OPC_MUHU, a0, a1, a2);
-            break;
-        }
-        i1 = OPC_MULTU, i2 = OPC_MFHI;
-        goto do_hilo1;
     case INDEX_op_div_i32:
         if (use_mips32r6_instructions) {
             tcg_out_opc_reg(s, OPC_DIV_R6, a0, a1, a2);
@@ -1952,13 +1963,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         i1 = OPC_DMULT, i2 = OPC_MFHI;
         goto do_hilo1;
-    case INDEX_op_muluh_i64:
-        if (use_mips32r6_instructions) {
-            tcg_out_opc_reg(s, OPC_DMUHU, a0, a1, a2);
-            break;
-        }
-        i1 = OPC_DMULTU, i2 = OPC_MFHI;
-        goto do_hilo1;
     case INDEX_op_div_i64:
         if (use_mips32r6_instructions) {
             tcg_out_opc_reg(s, OPC_DDIV_R6, a0, a1, a2);
@@ -2246,14 +2250,12 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
         return C_O0_I2(rz, r);
 
     case INDEX_op_mulsh_i32:
-    case INDEX_op_muluh_i32:
     case INDEX_op_div_i32:
     case INDEX_op_divu_i32:
     case INDEX_op_rem_i32:
     case INDEX_op_remu_i32:
     case INDEX_op_setcond_i32:
     case INDEX_op_mulsh_i64:
-    case INDEX_op_muluh_i64:
     case INDEX_op_div_i64:
     case INDEX_op_divu_i64:
     case INDEX_op_rem_i64:
diff --git a/tcg/ppc/tcg-target-has.h b/tcg/ppc/tcg-target-has.h
index 7ebcb49a19..18ec573f7e 100644
--- a/tcg/ppc/tcg-target-has.h
+++ b/tcg/ppc/tcg-target-has.h
@@ -29,7 +29,6 @@
 #define TCG_TARGET_HAS_negsetcond_i32   1
 #define TCG_TARGET_HAS_mulu2_i32        0
 #define TCG_TARGET_HAS_muls2_i32        0
-#define TCG_TARGET_HAS_muluh_i32        1
 #define TCG_TARGET_HAS_mulsh_i32        1
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
@@ -52,7 +51,6 @@
 #define TCG_TARGET_HAS_sub2_i64         1
 #define TCG_TARGET_HAS_mulu2_i64        0
 #define TCG_TARGET_HAS_muls2_i64        0
-#define TCG_TARGET_HAS_muluh_i64        1
 #define TCG_TARGET_HAS_mulsh_i64        1
 #endif
 
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index a7cc9d0bc7..06a7abf2ba 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -2984,6 +2984,18 @@ static const TCGOutOpBinary outop_mul = {
     .out_rri = tgen_muli,
 };
 
+static void tgen_muluh(TCGContext *s, TCGType type,
+                       TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    uint32_t insn = type == TCG_TYPE_I32 ? MULHWU : MULHDU;
+    tcg_out32(s, insn | TAB(a0, a1, a2));
+}
+
+static const TCGOutOpBinary outop_muluh = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_muluh,
+};
+
 static void tgen_nand(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -3487,15 +3499,9 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    case INDEX_op_muluh_i32:
-        tcg_out32(s, MULHWU | TAB(args[0], args[1], args[2]));
-        break;
     case INDEX_op_mulsh_i32:
         tcg_out32(s, MULHW | TAB(args[0], args[1], args[2]));
         break;
-    case INDEX_op_muluh_i64:
-        tcg_out32(s, MULHDU | TAB(args[0], args[1], args[2]));
-        break;
     case INDEX_op_mulsh_i64:
         tcg_out32(s, MULHD | TAB(args[0], args[1], args[2]));
         break;
@@ -4177,14 +4183,12 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_divu_i32:
     case INDEX_op_rem_i32:
     case INDEX_op_remu_i32:
-    case INDEX_op_muluh_i32:
     case INDEX_op_mulsh_i32:
     case INDEX_op_div_i64:
     case INDEX_op_divu_i64:
     case INDEX_op_rem_i64:
     case INDEX_op_remu_i64:
     case INDEX_op_mulsh_i64:
-    case INDEX_op_muluh_i64:
         return C_O1_I2(r, r, r);
 
     case INDEX_op_clz_i32:
diff --git a/tcg/riscv/tcg-target-has.h b/tcg/riscv/tcg-target-has.h
index e3018717ea..453942a6a5 100644
--- a/tcg/riscv/tcg-target-has.h
+++ b/tcg/riscv/tcg-target-has.h
@@ -20,7 +20,6 @@
 #define TCG_TARGET_HAS_sub2_i32         1
 #define TCG_TARGET_HAS_mulu2_i32        0
 #define TCG_TARGET_HAS_muls2_i32        0
-#define TCG_TARGET_HAS_muluh_i32        0
 #define TCG_TARGET_HAS_mulsh_i32        0
 #define TCG_TARGET_HAS_bswap16_i32      (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_bswap32_i32      (cpuinfo & CPUINFO_ZBB)
@@ -46,7 +45,6 @@
 #define TCG_TARGET_HAS_sub2_i64         1
 #define TCG_TARGET_HAS_mulu2_i64        0
 #define TCG_TARGET_HAS_muls2_i64        0
-#define TCG_TARGET_HAS_muluh_i64        1
 #define TCG_TARGET_HAS_mulsh_i64        1
 
 #define TCG_TARGET_HAS_qemu_ldst_i128   0
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index ff685037d7..65246cc450 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -2021,6 +2021,23 @@ static const TCGOutOpBinary outop_mul = {
     .out_rrr = tgen_mul,
 };
 
+static TCGConstraintSetIndex cset_mulh(TCGType type, unsigned flags)
+{
+    return type == TCG_TYPE_I32 ? C_NotImplemented : C_O1_I2(r, r, r);
+}
+
+static void tgen_muluh(TCGContext *s, TCGType type,
+                       TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_opc_reg(s, OPC_MULHU, a0, a1, a2);
+}
+
+static const TCGOutOpBinary outop_muluh = {
+    .base.static_constraint = C_Dynamic,
+    .base.dynamic_constraint = cset_mulh,
+    .out_rrr = tgen_muluh,
+};
+
 static const TCGOutOpBinary outop_nand = {
     .base.static_constraint = C_NotImplemented,
 };
@@ -2379,11 +2396,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_opc_reg(s, OPC_MULH, a0, a1, a2);
         break;
 
-    case INDEX_op_muluh_i32:
-    case INDEX_op_muluh_i64:
-        tcg_out_opc_reg(s, OPC_MULHU, a0, a1, a2);
-        break;
-
     case INDEX_op_mb:
         tcg_out_mb(s, a0);
         break;
@@ -2712,13 +2724,11 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
         return C_O1_I2(r, r, rI);
 
     case INDEX_op_mulsh_i32:
-    case INDEX_op_muluh_i32:
     case INDEX_op_div_i32:
     case INDEX_op_divu_i32:
     case INDEX_op_rem_i32:
     case INDEX_op_remu_i32:
     case INDEX_op_mulsh_i64:
-    case INDEX_op_muluh_i64:
     case INDEX_op_div_i64:
     case INDEX_op_divu_i64:
     case INDEX_op_rem_i64:
diff --git a/tcg/s390x/tcg-target-has.h b/tcg/s390x/tcg-target-has.h
index e5c132cf12..ac808e21e5 100644
--- a/tcg/s390x/tcg-target-has.h
+++ b/tcg/s390x/tcg-target-has.h
@@ -42,7 +42,6 @@ extern uint64_t s390_facilities[3];
 #define TCG_TARGET_HAS_sub2_i32       1
 #define TCG_TARGET_HAS_mulu2_i32      0
 #define TCG_TARGET_HAS_muls2_i32      0
-#define TCG_TARGET_HAS_muluh_i32      0
 #define TCG_TARGET_HAS_mulsh_i32      0
 #define TCG_TARGET_HAS_extr_i64_i32   0
 #define TCG_TARGET_HAS_qemu_st8_i32   0
@@ -61,7 +60,6 @@ extern uint64_t s390_facilities[3];
 #define TCG_TARGET_HAS_sub2_i64       1
 #define TCG_TARGET_HAS_mulu2_i64      1
 #define TCG_TARGET_HAS_muls2_i64      HAVE_FACILITY(MISC_INSN_EXT2)
-#define TCG_TARGET_HAS_muluh_i64      0
 #define TCG_TARGET_HAS_mulsh_i64      0
 
 #define TCG_TARGET_HAS_qemu_ldst_i128 1
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index 1ba9741fdd..e3d70ca236 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -2309,6 +2309,10 @@ static const TCGOutOpBinary outop_mul = {
     .out_rri = tgen_muli,
 };
 
+static const TCGOutOpBinary outop_muluh = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static void tgen_nand(TCGContext *s, TCGType type,
                       TCGReg a0, TCGReg a1, TCGReg a2)
 {
diff --git a/tcg/sparc64/tcg-target-has.h b/tcg/sparc64/tcg-target-has.h
index df87249df2..093de87a1d 100644
--- a/tcg/sparc64/tcg-target-has.h
+++ b/tcg/sparc64/tcg-target-has.h
@@ -28,7 +28,6 @@ extern bool use_vis3_instructions;
 #define TCG_TARGET_HAS_sub2_i32         1
 #define TCG_TARGET_HAS_mulu2_i32        1
 #define TCG_TARGET_HAS_muls2_i32        1
-#define TCG_TARGET_HAS_muluh_i32        0
 #define TCG_TARGET_HAS_mulsh_i32        0
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
@@ -48,7 +47,6 @@ extern bool use_vis3_instructions;
 #define TCG_TARGET_HAS_sub2_i64         1
 #define TCG_TARGET_HAS_mulu2_i64        0
 #define TCG_TARGET_HAS_muls2_i64        0
-#define TCG_TARGET_HAS_muluh_i64        use_vis3_instructions
 #define TCG_TARGET_HAS_mulsh_i64        0
 
 #define TCG_TARGET_HAS_qemu_ldst_i128   0
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index 0a13a91166..31bdaecafa 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -1357,6 +1357,24 @@ static const TCGOutOpBinary outop_mul = {
     .out_rri = tgen_muli,
 };
 
+static void tgen_muluh(TCGContext *s, TCGType type,
+                       TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_arith(s, a0, a1, a2, ARITH_UMULXHI);
+}
+
+static TCGConstraintSetIndex cset_muluh(TCGType type, unsigned flags)
+{
+    return (type == TCG_TYPE_I64 && use_vis3_instructions
+            ? C_O1_I2(r, r, r) : C_NotImplemented);
+}
+
+static const TCGOutOpBinary outop_muluh = {
+    .base.static_constraint = C_Dynamic,
+    .base.dynamic_constraint = cset_muluh,
+    .out_rrr = tgen_muluh,
+};
+
 static const TCGOutOpBinary outop_nand = {
     .base.static_constraint = C_NotImplemented,
 };
@@ -1612,9 +1630,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_addsub2_i64(s, args[0], args[1], args[2], args[3], args[4],
                             const_args[4], args[5], const_args[5], true);
         break;
-    case INDEX_op_muluh_i64:
-        tcg_out_arith(s, args[0], args[1], args[2], ARITH_UMULXHI);
-        break;
 
     gen_arith:
         tcg_out_arithc(s, a0, a1, a2, c2, c);
@@ -1711,8 +1726,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_mulu2_i32:
     case INDEX_op_muls2_i32:
         return C_O2_I2(r, r, rz, rJ);
-    case INDEX_op_muluh_i64:
-        return C_O1_I2(r, r, r);
 
     default:
         return C_NotImplemented;
diff --git a/tcg/tcg-has.h b/tcg/tcg-has.h
index a84ed1313a..7f3ef73f2e 100644
--- a/tcg/tcg-has.h
+++ b/tcg/tcg-has.h
@@ -28,7 +28,6 @@
 #define TCG_TARGET_HAS_sub2_i64         0
 #define TCG_TARGET_HAS_mulu2_i64        0
 #define TCG_TARGET_HAS_muls2_i64        0
-#define TCG_TARGET_HAS_muluh_i64        0
 #define TCG_TARGET_HAS_mulsh_i64        0
 /* Turn some undef macros into true macros.  */
 #define TCG_TARGET_HAS_add2_i32         1
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index 76d5b67fba..39581465f2 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -1132,7 +1132,7 @@ void tcg_gen_mulu2_i32(TCGv_i32 rl, TCGv_i32 rh, TCGv_i32 arg1, TCGv_i32 arg2)
 {
     if (TCG_TARGET_HAS_mulu2_i32) {
         tcg_gen_op4_i32(INDEX_op_mulu2_i32, rl, rh, arg1, arg2);
-    } else if (TCG_TARGET_HAS_muluh_i32) {
+    } else if (tcg_op_supported(INDEX_op_muluh_i32, TCG_TYPE_I32, 0)) {
         TCGv_i32 t = tcg_temp_ebb_new_i32();
         tcg_gen_op3_i32(INDEX_op_mul, t, arg1, arg2);
         tcg_gen_op3_i32(INDEX_op_muluh_i32, rh, arg1, arg2);
@@ -2842,7 +2842,7 @@ void tcg_gen_mulu2_i64(TCGv_i64 rl, TCGv_i64 rh, TCGv_i64 arg1, TCGv_i64 arg2)
 {
     if (TCG_TARGET_HAS_mulu2_i64) {
         tcg_gen_op4_i64(INDEX_op_mulu2_i64, rl, rh, arg1, arg2);
-    } else if (TCG_TARGET_HAS_muluh_i64) {
+    } else if (tcg_op_supported(INDEX_op_muluh_i64, TCG_TYPE_I64, 0)) {
         TCGv_i64 t = tcg_temp_ebb_new_i64();
         tcg_gen_op3_i64(INDEX_op_mul, t, arg1, arg2);
         tcg_gen_op3_i64(INDEX_op_muluh_i64, rh, arg1, arg2);
@@ -2867,7 +2867,8 @@ void tcg_gen_muls2_i64(TCGv_i64 rl, TCGv_i64 rh, TCGv_i64 arg1, TCGv_i64 arg2)
         tcg_gen_op3_i64(INDEX_op_mulsh_i64, rh, arg1, arg2);
         tcg_gen_mov_i64(rl, t);
         tcg_temp_free_i64(t);
-    } else if (TCG_TARGET_HAS_mulu2_i64 || TCG_TARGET_HAS_muluh_i64) {
+    } else if (TCG_TARGET_HAS_mulu2_i64 ||
+               tcg_op_supported(INDEX_op_muluh_i64, TCG_TYPE_I64, 0)) {
         TCGv_i64 t0 = tcg_temp_ebb_new_i64();
         TCGv_i64 t1 = tcg_temp_ebb_new_i64();
         TCGv_i64 t2 = tcg_temp_ebb_new_i64();
diff --git a/tcg/tcg.c b/tcg/tcg.c
index d16ed332c8..cd85967229 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1022,6 +1022,8 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_andc, TCGOutOpBinary, outop_andc),
     OUTOP(INDEX_op_eqv, TCGOutOpBinary, outop_eqv),
     OUTOP(INDEX_op_mul, TCGOutOpBinary, outop_mul),
+    OUTOP(INDEX_op_muluh_i32, TCGOutOpBinary, outop_muluh),
+    OUTOP(INDEX_op_muluh_i64, TCGOutOpBinary, outop_muluh),
     OUTOP(INDEX_op_nand, TCGOutOpBinary, outop_nand),
     OUTOP(INDEX_op_neg, TCGOutOpUnary, outop_neg),
     OUTOP(INDEX_op_nor, TCGOutOpBinary, outop_nor),
@@ -2280,8 +2282,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
         return TCG_TARGET_HAS_mulu2_i32;
     case INDEX_op_muls2_i32:
         return TCG_TARGET_HAS_muls2_i32;
-    case INDEX_op_muluh_i32:
-        return TCG_TARGET_HAS_muluh_i32;
     case INDEX_op_mulsh_i32:
         return TCG_TARGET_HAS_mulsh_i32;
     case INDEX_op_bswap16_i32:
@@ -2362,8 +2362,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
         return TCG_TARGET_HAS_mulu2_i64;
     case INDEX_op_muls2_i64:
         return TCG_TARGET_HAS_muls2_i64;
-    case INDEX_op_muluh_i64:
-        return TCG_TARGET_HAS_muluh_i64;
     case INDEX_op_mulsh_i64:
         return TCG_TARGET_HAS_mulsh_i64;
 
@@ -3876,7 +3874,6 @@ liveness_pass_1(TCGContext *s)
     QTAILQ_FOREACH_REVERSE_SAFE(op, &s->ops, link, op_prev) {
         int nb_iargs, nb_oargs;
         TCGOpcode opc_new, opc_new2;
-        bool have_opc_new2;
         TCGLifeData arg_life = 0;
         TCGTemp *ts;
         TCGOpcode opc = op->opc;
@@ -4036,22 +4033,18 @@ liveness_pass_1(TCGContext *s)
         case INDEX_op_mulu2_i32:
             opc_new = INDEX_op_mul;
             opc_new2 = INDEX_op_muluh_i32;
-            have_opc_new2 = TCG_TARGET_HAS_muluh_i32;
             goto do_mul2;
         case INDEX_op_muls2_i32:
             opc_new = INDEX_op_mul;
             opc_new2 = INDEX_op_mulsh_i32;
-            have_opc_new2 = TCG_TARGET_HAS_mulsh_i32;
             goto do_mul2;
         case INDEX_op_mulu2_i64:
             opc_new = INDEX_op_mul;
             opc_new2 = INDEX_op_muluh_i64;
-            have_opc_new2 = TCG_TARGET_HAS_muluh_i64;
             goto do_mul2;
         case INDEX_op_muls2_i64:
             opc_new = INDEX_op_mul;
             opc_new2 = INDEX_op_mulsh_i64;
-            have_opc_new2 = TCG_TARGET_HAS_mulsh_i64;
             goto do_mul2;
         do_mul2:
             nb_iargs = 2;
@@ -4065,7 +4058,8 @@ liveness_pass_1(TCGContext *s)
                 op->opc = opc = opc_new;
                 op->args[1] = op->args[2];
                 op->args[2] = op->args[3];
-            } else if (arg_temp(op->args[0])->state == TS_DEAD && have_opc_new2) {
+            } else if (arg_temp(op->args[0])->state == TS_DEAD &&
+                       tcg_op_supported(opc_new2, TCGOP_TYPE(op), 0)) {
                 /* The low part of the operation is dead; generate the high. */
                 op->opc = opc = opc_new2;
                 op->args[0] = op->args[1];
@@ -5436,6 +5430,8 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
     case INDEX_op_andc:
     case INDEX_op_eqv:
     case INDEX_op_mul:
+    case INDEX_op_muluh_i32:
+    case INDEX_op_muluh_i64:
     case INDEX_op_nand:
     case INDEX_op_nor:
     case INDEX_op_or:
diff --git a/tcg/tci/tcg-target-has.h b/tcg/tci/tcg-target-has.h
index f147da5c0e..b99b12c24c 100644
--- a/tcg/tci/tcg-target-has.h
+++ b/tcg/tci/tcg-target-has.h
@@ -18,7 +18,6 @@
 #define TCG_TARGET_HAS_rot_i32          1
 #define TCG_TARGET_HAS_negsetcond_i32   0
 #define TCG_TARGET_HAS_muls2_i32        1
-#define TCG_TARGET_HAS_muluh_i32        0
 #define TCG_TARGET_HAS_mulsh_i32        0
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
@@ -42,7 +41,6 @@
 #define TCG_TARGET_HAS_add2_i64         1
 #define TCG_TARGET_HAS_sub2_i64         1
 #define TCG_TARGET_HAS_mulu2_i64        1
-#define TCG_TARGET_HAS_muluh_i64        0
 #define TCG_TARGET_HAS_mulsh_i64        0
 #else
 #define TCG_TARGET_HAS_mulu2_i32        1
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index ffc8654427..e4a2b171df 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -670,6 +670,10 @@ static const TCGOutOpBinary outop_mul = {
     .out_rrr = tgen_mul,
 };
 
+static const TCGOutOpBinary outop_muluh = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static void tgen_nand(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {

From aa28c9ef8e109db40d4781d82452805486f2a2bf Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 7 Jan 2025 10:36:24 -0800
Subject: [PATCH 0397/2760] tcg: Merge INDEX_op_muluh_{i32,i64}
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 docs/devel/tcg-ops.rst |  2 +-
 include/tcg/tcg-opc.h  |  3 +--
 tcg/optimize.c         | 19 +++++++++++--------
 tcg/tcg-op.c           | 10 +++++-----
 tcg/tcg.c              | 13 ++++---------
 5 files changed, 22 insertions(+), 25 deletions(-)

diff --git a/docs/devel/tcg-ops.rst b/docs/devel/tcg-ops.rst
index 6c36e72242..4fed5a77c6 100644
--- a/docs/devel/tcg-ops.rst
+++ b/docs/devel/tcg-ops.rst
@@ -591,7 +591,7 @@ Multiword arithmetic support
 
    * - mulsh_i32/i64 *t0*, *t1*, *t2*
 
-       muluh_i32/i64 *t0*, *t1*, *t2*
+       muluh *t0*, *t1*, *t2*
 
      - | Provide the high part of a signed or unsigned multiply, respectively.
        |
diff --git a/include/tcg/tcg-opc.h b/include/tcg/tcg-opc.h
index 4ecba62fda..28a5128537 100644
--- a/include/tcg/tcg-opc.h
+++ b/include/tcg/tcg-opc.h
@@ -44,6 +44,7 @@ DEF(and, 1, 2, 0, TCG_OPF_INT)
 DEF(andc, 1, 2, 0, TCG_OPF_INT)
 DEF(eqv, 1, 2, 0, TCG_OPF_INT)
 DEF(mul, 1, 2, 0, TCG_OPF_INT)
+DEF(muluh, 1, 2, 0, TCG_OPF_INT)
 DEF(nand, 1, 2, 0, TCG_OPF_INT)
 DEF(neg, 1, 1, 0, TCG_OPF_INT)
 DEF(nor, 1, 2, 0, TCG_OPF_INT)
@@ -89,7 +90,6 @@ DEF(add2_i32, 2, 4, 0, 0)
 DEF(sub2_i32, 2, 4, 0, 0)
 DEF(mulu2_i32, 2, 2, 0, 0)
 DEF(muls2_i32, 2, 2, 0, 0)
-DEF(muluh_i32, 1, 2, 0, 0)
 DEF(mulsh_i32, 1, 2, 0, 0)
 DEF(brcond2_i32, 0, 4, 2, TCG_OPF_BB_END | TCG_OPF_COND_BRANCH)
 DEF(setcond2_i32, 1, 4, 1, 0)
@@ -151,7 +151,6 @@ DEF(add2_i64, 2, 4, 0, 0)
 DEF(sub2_i64, 2, 4, 0, 0)
 DEF(mulu2_i64, 2, 2, 0, 0)
 DEF(muls2_i64, 2, 2, 0, 0)
-DEF(muluh_i64, 1, 2, 0, 0)
 DEF(mulsh_i64, 1, 2, 0, 0)
 
 #define DATA64_ARGS  (TCG_TARGET_REG_BITS == 64 ? 1 : 2)
diff --git a/tcg/optimize.c b/tcg/optimize.c
index 653246f3d2..e19bccf906 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -419,7 +419,8 @@ static bool tcg_opt_gen_movi(OptContext *ctx, TCGOp *op,
     return tcg_opt_gen_mov(ctx, op, dst, arg_new_constant(ctx, val));
 }
 
-static uint64_t do_constant_folding_2(TCGOpcode op, uint64_t x, uint64_t y)
+static uint64_t do_constant_folding_2(TCGOpcode op, TCGType type,
+                                      uint64_t x, uint64_t y)
 {
     uint64_t l64, h64;
 
@@ -541,14 +542,16 @@ static uint64_t do_constant_folding_2(TCGOpcode op, uint64_t x, uint64_t y)
     case INDEX_op_extrh_i64_i32:
         return (uint64_t)x >> 32;
 
-    case INDEX_op_muluh_i32:
-        return ((uint64_t)(uint32_t)x * (uint32_t)y) >> 32;
+    case INDEX_op_muluh:
+        if (type == TCG_TYPE_I32) {
+            return ((uint64_t)(uint32_t)x * (uint32_t)y) >> 32;
+        }
+        mulu64(&l64, &h64, x, y);
+        return h64;
+
     case INDEX_op_mulsh_i32:
         return ((int64_t)(int32_t)x * (int32_t)y) >> 32;
 
-    case INDEX_op_muluh_i64:
-        mulu64(&l64, &h64, x, y);
-        return h64;
     case INDEX_op_mulsh_i64:
         muls64(&l64, &h64, x, y);
         return h64;
@@ -580,7 +583,7 @@ static uint64_t do_constant_folding_2(TCGOpcode op, uint64_t x, uint64_t y)
 static uint64_t do_constant_folding(TCGOpcode op, TCGType type,
                                     uint64_t x, uint64_t y)
 {
-    uint64_t res = do_constant_folding_2(op, x, y);
+    uint64_t res = do_constant_folding_2(op, type, x, y);
     if (type == TCG_TYPE_I32) {
         res = (int32_t)res;
     }
@@ -2967,7 +2970,7 @@ void tcg_optimize(TCGContext *s)
             done = fold_mul(&ctx, op);
             break;
         CASE_OP_32_64(mulsh):
-        CASE_OP_32_64(muluh):
+        case INDEX_op_muluh:
             done = fold_mul_highpart(&ctx, op);
             break;
         CASE_OP_32_64(muls2):
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index 39581465f2..7a37b21c56 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -1132,10 +1132,10 @@ void tcg_gen_mulu2_i32(TCGv_i32 rl, TCGv_i32 rh, TCGv_i32 arg1, TCGv_i32 arg2)
 {
     if (TCG_TARGET_HAS_mulu2_i32) {
         tcg_gen_op4_i32(INDEX_op_mulu2_i32, rl, rh, arg1, arg2);
-    } else if (tcg_op_supported(INDEX_op_muluh_i32, TCG_TYPE_I32, 0)) {
+    } else if (tcg_op_supported(INDEX_op_muluh, TCG_TYPE_I32, 0)) {
         TCGv_i32 t = tcg_temp_ebb_new_i32();
         tcg_gen_op3_i32(INDEX_op_mul, t, arg1, arg2);
-        tcg_gen_op3_i32(INDEX_op_muluh_i32, rh, arg1, arg2);
+        tcg_gen_op3_i32(INDEX_op_muluh, rh, arg1, arg2);
         tcg_gen_mov_i32(rl, t);
         tcg_temp_free_i32(t);
     } else if (TCG_TARGET_REG_BITS == 64) {
@@ -2842,10 +2842,10 @@ void tcg_gen_mulu2_i64(TCGv_i64 rl, TCGv_i64 rh, TCGv_i64 arg1, TCGv_i64 arg2)
 {
     if (TCG_TARGET_HAS_mulu2_i64) {
         tcg_gen_op4_i64(INDEX_op_mulu2_i64, rl, rh, arg1, arg2);
-    } else if (tcg_op_supported(INDEX_op_muluh_i64, TCG_TYPE_I64, 0)) {
+    } else if (tcg_op_supported(INDEX_op_muluh, TCG_TYPE_I64, 0)) {
         TCGv_i64 t = tcg_temp_ebb_new_i64();
         tcg_gen_op3_i64(INDEX_op_mul, t, arg1, arg2);
-        tcg_gen_op3_i64(INDEX_op_muluh_i64, rh, arg1, arg2);
+        tcg_gen_op3_i64(INDEX_op_muluh, rh, arg1, arg2);
         tcg_gen_mov_i64(rl, t);
         tcg_temp_free_i64(t);
     } else {
@@ -2868,7 +2868,7 @@ void tcg_gen_muls2_i64(TCGv_i64 rl, TCGv_i64 rh, TCGv_i64 arg1, TCGv_i64 arg2)
         tcg_gen_mov_i64(rl, t);
         tcg_temp_free_i64(t);
     } else if (TCG_TARGET_HAS_mulu2_i64 ||
-               tcg_op_supported(INDEX_op_muluh_i64, TCG_TYPE_I64, 0)) {
+               tcg_op_supported(INDEX_op_muluh, TCG_TYPE_I64, 0)) {
         TCGv_i64 t0 = tcg_temp_ebb_new_i64();
         TCGv_i64 t1 = tcg_temp_ebb_new_i64();
         TCGv_i64 t2 = tcg_temp_ebb_new_i64();
diff --git a/tcg/tcg.c b/tcg/tcg.c
index cd85967229..808ac8c431 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1022,8 +1022,7 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_andc, TCGOutOpBinary, outop_andc),
     OUTOP(INDEX_op_eqv, TCGOutOpBinary, outop_eqv),
     OUTOP(INDEX_op_mul, TCGOutOpBinary, outop_mul),
-    OUTOP(INDEX_op_muluh_i32, TCGOutOpBinary, outop_muluh),
-    OUTOP(INDEX_op_muluh_i64, TCGOutOpBinary, outop_muluh),
+    OUTOP(INDEX_op_muluh, TCGOutOpBinary, outop_muluh),
     OUTOP(INDEX_op_nand, TCGOutOpBinary, outop_nand),
     OUTOP(INDEX_op_neg, TCGOutOpUnary, outop_neg),
     OUTOP(INDEX_op_nor, TCGOutOpBinary, outop_nor),
@@ -4030,17 +4029,14 @@ liveness_pass_1(TCGContext *s)
             }
             goto do_not_remove;
 
-        case INDEX_op_mulu2_i32:
-            opc_new = INDEX_op_mul;
-            opc_new2 = INDEX_op_muluh_i32;
-            goto do_mul2;
         case INDEX_op_muls2_i32:
             opc_new = INDEX_op_mul;
             opc_new2 = INDEX_op_mulsh_i32;
             goto do_mul2;
+        case INDEX_op_mulu2_i32:
         case INDEX_op_mulu2_i64:
             opc_new = INDEX_op_mul;
-            opc_new2 = INDEX_op_muluh_i64;
+            opc_new2 = INDEX_op_muluh;
             goto do_mul2;
         case INDEX_op_muls2_i64:
             opc_new = INDEX_op_mul;
@@ -5430,8 +5426,7 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
     case INDEX_op_andc:
     case INDEX_op_eqv:
     case INDEX_op_mul:
-    case INDEX_op_muluh_i32:
-    case INDEX_op_muluh_i64:
+    case INDEX_op_muluh:
     case INDEX_op_nand:
     case INDEX_op_nor:
     case INDEX_op_or:

From a9983f81290d41ed614a193a33d03be936f6435c Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 7 Jan 2025 11:13:05 -0800
Subject: [PATCH 0398/2760] tcg: Convert mulsh to TCGOutOpBinary
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target-has.h     |  2 --
 tcg/aarch64/tcg-target.c.inc     | 17 +++++++++++-----
 tcg/arm/tcg-target-has.h         |  1 -
 tcg/arm/tcg-target.c.inc         |  4 ++++
 tcg/i386/tcg-target-has.h        |  2 --
 tcg/i386/tcg-target.c.inc        |  4 ++++
 tcg/loongarch64/tcg-target-has.h |  2 --
 tcg/loongarch64/tcg-target.c.inc | 24 +++++++++++++---------
 tcg/mips/tcg-target-has.h        |  2 --
 tcg/mips/tcg-target.c.inc        | 34 +++++++++++++++++---------------
 tcg/ppc/tcg-target-has.h         |  2 --
 tcg/ppc/tcg-target.c.inc         | 21 +++++++++++---------
 tcg/riscv/tcg-target-has.h       |  2 --
 tcg/riscv/tcg-target.c.inc       | 19 +++++++++++-------
 tcg/s390x/tcg-target-has.h       |  2 --
 tcg/s390x/tcg-target.c.inc       |  4 ++++
 tcg/sparc64/tcg-target-has.h     |  2 --
 tcg/sparc64/tcg-target.c.inc     |  4 ++++
 tcg/tcg-has.h                    |  1 -
 tcg/tcg-op.c                     |  4 ++--
 tcg/tcg.c                        |  8 ++++----
 tcg/tci/tcg-target-has.h         |  2 --
 tcg/tci/tcg-target.c.inc         |  4 ++++
 23 files changed, 95 insertions(+), 72 deletions(-)

diff --git a/tcg/aarch64/tcg-target-has.h b/tcg/aarch64/tcg-target-has.h
index 207a85ed61..bde6db8f2a 100644
--- a/tcg/aarch64/tcg-target-has.h
+++ b/tcg/aarch64/tcg-target-has.h
@@ -27,7 +27,6 @@
 #define TCG_TARGET_HAS_sub2_i32         1
 #define TCG_TARGET_HAS_mulu2_i32        0
 #define TCG_TARGET_HAS_muls2_i32        0
-#define TCG_TARGET_HAS_mulsh_i32        0
 #define TCG_TARGET_HAS_extr_i64_i32     0
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
@@ -46,7 +45,6 @@
 #define TCG_TARGET_HAS_sub2_i64         1
 #define TCG_TARGET_HAS_mulu2_i64        0
 #define TCG_TARGET_HAS_muls2_i64        0
-#define TCG_TARGET_HAS_mulsh_i64        1
 
 /*
  * Without FEAT_LSE2, we must use LDXP+STXP to implement atomic 128-bit load,
diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index bd0b7938c8..493c504682 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -2184,6 +2184,18 @@ static TCGConstraintSetIndex cset_mulh(TCGType type, unsigned flags)
     return type == TCG_TYPE_I64 ? C_O1_I2(r, r, r) : C_NotImplemented;
 }
 
+static void tgen_mulsh(TCGContext *s, TCGType type,
+                       TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_insn(s, 3508, SMULH, TCG_TYPE_I64, a0, a1, a2);
+}
+
+static const TCGOutOpBinary outop_mulsh = {
+    .base.static_constraint = C_Dynamic,
+    .base.dynamic_constraint = cset_mulh,
+    .out_rrr = tgen_mulsh,
+};
+
 static void tgen_muluh(TCGContext *s, TCGType type,
                        TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -2543,10 +2555,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType ext,
                         args[5], const_args[4], const_args[5], true);
         break;
 
-    case INDEX_op_mulsh_i64:
-        tcg_out_insn(s, 3508, SMULH, TCG_TYPE_I64, a0, a1, a2);
-        break;
-
     case INDEX_op_mb:
         tcg_out_mb(s, a0);
         break;
@@ -3057,7 +3065,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_rem_i64:
     case INDEX_op_remu_i32:
     case INDEX_op_remu_i64:
-    case INDEX_op_mulsh_i64:
         return C_O1_I2(r, r, r);
 
     case INDEX_op_shl_i32:
diff --git a/tcg/arm/tcg-target-has.h b/tcg/arm/tcg-target-has.h
index d6b06e96bf..ab9b7b6162 100644
--- a/tcg/arm/tcg-target-has.h
+++ b/tcg/arm/tcg-target-has.h
@@ -34,7 +34,6 @@ extern bool use_neon_instructions;
 #define TCG_TARGET_HAS_negsetcond_i32   1
 #define TCG_TARGET_HAS_mulu2_i32        1
 #define TCG_TARGET_HAS_muls2_i32        1
-#define TCG_TARGET_HAS_mulsh_i32        0
 #define TCG_TARGET_HAS_div_i32          use_idiv_instructions
 #define TCG_TARGET_HAS_rem_i32          0
 #define TCG_TARGET_HAS_qemu_st8_i32     0
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index b08e23d0dc..1c19004e6e 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -1890,6 +1890,10 @@ static const TCGOutOpBinary outop_mul = {
     .out_rrr = tgen_mul,
 };
 
+static const TCGOutOpBinary outop_mulsh = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static const TCGOutOpBinary outop_muluh = {
     .base.static_constraint = C_NotImplemented,
 };
diff --git a/tcg/i386/tcg-target-has.h b/tcg/i386/tcg-target-has.h
index f4487ac1fc..121fb95ee0 100644
--- a/tcg/i386/tcg-target-has.h
+++ b/tcg/i386/tcg-target-has.h
@@ -39,7 +39,6 @@
 #define TCG_TARGET_HAS_sub2_i32         1
 #define TCG_TARGET_HAS_mulu2_i32        1
 #define TCG_TARGET_HAS_muls2_i32        1
-#define TCG_TARGET_HAS_mulsh_i32        0
 
 #if TCG_TARGET_REG_BITS == 64
 /* Keep 32-bit values zero-extended in a register.  */
@@ -58,7 +57,6 @@
 #define TCG_TARGET_HAS_sub2_i64         1
 #define TCG_TARGET_HAS_mulu2_i64        1
 #define TCG_TARGET_HAS_muls2_i64        1
-#define TCG_TARGET_HAS_mulsh_i64        0
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 #else
 #define TCG_TARGET_HAS_qemu_st8_i32     1
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index 5fdca05c9d..d0391157a4 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -2664,6 +2664,10 @@ static const TCGOutOpBinary outop_mul = {
     .out_rri = tgen_muli,
 };
 
+static const TCGOutOpBinary outop_mulsh = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static const TCGOutOpBinary outop_muluh = {
     .base.static_constraint = C_NotImplemented,
 };
diff --git a/tcg/loongarch64/tcg-target-has.h b/tcg/loongarch64/tcg-target-has.h
index 53335b2cdb..e29c892756 100644
--- a/tcg/loongarch64/tcg-target-has.h
+++ b/tcg/loongarch64/tcg-target-has.h
@@ -20,7 +20,6 @@
 #define TCG_TARGET_HAS_sub2_i32         0
 #define TCG_TARGET_HAS_mulu2_i32        0
 #define TCG_TARGET_HAS_muls2_i32        0
-#define TCG_TARGET_HAS_mulsh_i32        1
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
 #define TCG_TARGET_HAS_clz_i32          1
@@ -46,7 +45,6 @@
 #define TCG_TARGET_HAS_sub2_i64         0
 #define TCG_TARGET_HAS_mulu2_i64        0
 #define TCG_TARGET_HAS_muls2_i64        0
-#define TCG_TARGET_HAS_mulsh_i64        1
 
 #define TCG_TARGET_HAS_qemu_ldst_i128   (cpuinfo & CPUINFO_LSX)
 
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index 738fdd1a9e..7503270ca3 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -1347,6 +1347,21 @@ static const TCGOutOpBinary outop_mul = {
     .out_rrr = tgen_mul,
 };
 
+static void tgen_mulsh(TCGContext *s, TCGType type,
+                       TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    if (type == TCG_TYPE_I32) {
+        tcg_out_opc_mulh_w(s, a0, a1, a2);
+    } else {
+        tcg_out_opc_mulh_d(s, a0, a1, a2);
+    }
+}
+
+static const TCGOutOpBinary outop_mulsh = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_mulsh,
+};
+
 static void tgen_muluh(TCGContext *s, TCGType type,
                        TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -1656,13 +1671,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    case INDEX_op_mulsh_i32:
-        tcg_out_opc_mulh_w(s, a0, a1, a2);
-        break;
-    case INDEX_op_mulsh_i64:
-        tcg_out_opc_mulh_d(s, a0, a1, a2);
-        break;
-
     case INDEX_op_div_i32:
         tcg_out_opc_div_w(s, a0, a1, a2);
         break;
@@ -2349,8 +2357,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_setcond_i64:
         return C_O1_I2(r, rz, rJ);
 
-    case INDEX_op_mulsh_i32:
-    case INDEX_op_mulsh_i64:
     case INDEX_op_div_i32:
     case INDEX_op_div_i64:
     case INDEX_op_divu_i32:
diff --git a/tcg/mips/tcg-target-has.h b/tcg/mips/tcg-target-has.h
index b559ab3846..ebaaa49cdd 100644
--- a/tcg/mips/tcg-target-has.h
+++ b/tcg/mips/tcg-target-has.h
@@ -43,7 +43,6 @@ extern bool use_mips32r2_instructions;
 #define TCG_TARGET_HAS_rem_i32          1
 #define TCG_TARGET_HAS_mulu2_i32        (!use_mips32r6_instructions)
 #define TCG_TARGET_HAS_muls2_i32        (!use_mips32r6_instructions)
-#define TCG_TARGET_HAS_mulsh_i32        1
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
 #define TCG_TARGET_HAS_negsetcond_i32   0
@@ -58,7 +57,6 @@ extern bool use_mips32r2_instructions;
 #define TCG_TARGET_HAS_sub2_i64         0
 #define TCG_TARGET_HAS_mulu2_i64        (!use_mips32r6_instructions)
 #define TCG_TARGET_HAS_muls2_i64        (!use_mips32r6_instructions)
-#define TCG_TARGET_HAS_mulsh_i64        1
 #define TCG_TARGET_HAS_ext32s_i64       1
 #define TCG_TARGET_HAS_ext32u_i64       1
 #define TCG_TARGET_HAS_negsetcond_i64   0
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index 24f8184c33..a1c215c25d 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -1743,6 +1743,24 @@ static const TCGOutOpBinary outop_mul = {
     .out_rrr = tgen_mul,
 };
 
+static void tgen_mulsh(TCGContext *s, TCGType type,
+                       TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    if (use_mips32r6_instructions) {
+        MIPSInsn insn = type == TCG_TYPE_I32 ? OPC_MUH : OPC_DMUH;
+        tcg_out_opc_reg(s, insn, a0, a1, a2);
+    } else {
+        MIPSInsn insn = type == TCG_TYPE_I32 ? OPC_MULT : OPC_DMULT;
+        tcg_out_opc_reg(s, insn, 0, a1, a2);
+        tcg_out_opc_reg(s, OPC_MFHI, a0, 0, 0);
+    }
+}
+
+static const TCGOutOpBinary outop_mulsh = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_mulsh,
+};
+
 static void tgen_muluh(TCGContext *s, TCGType type,
                        TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -1921,13 +1939,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_ldst(s, i1, a0, a1, a2);
         break;
 
-    case INDEX_op_mulsh_i32:
-        if (use_mips32r6_instructions) {
-            tcg_out_opc_reg(s, OPC_MUH, a0, a1, a2);
-            break;
-        }
-        i1 = OPC_MULT, i2 = OPC_MFHI;
-        goto do_hilo1;
     case INDEX_op_div_i32:
         if (use_mips32r6_instructions) {
             tcg_out_opc_reg(s, OPC_DIV_R6, a0, a1, a2);
@@ -1956,13 +1967,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         i1 = OPC_DIVU, i2 = OPC_MFHI;
         goto do_hilo1;
-    case INDEX_op_mulsh_i64:
-        if (use_mips32r6_instructions) {
-            tcg_out_opc_reg(s, OPC_DMUH, a0, a1, a2);
-            break;
-        }
-        i1 = OPC_DMULT, i2 = OPC_MFHI;
-        goto do_hilo1;
     case INDEX_op_div_i64:
         if (use_mips32r6_instructions) {
             tcg_out_opc_reg(s, OPC_DDIV_R6, a0, a1, a2);
@@ -2249,13 +2253,11 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(rz, r);
 
-    case INDEX_op_mulsh_i32:
     case INDEX_op_div_i32:
     case INDEX_op_divu_i32:
     case INDEX_op_rem_i32:
     case INDEX_op_remu_i32:
     case INDEX_op_setcond_i32:
-    case INDEX_op_mulsh_i64:
     case INDEX_op_div_i64:
     case INDEX_op_divu_i64:
     case INDEX_op_rem_i64:
diff --git a/tcg/ppc/tcg-target-has.h b/tcg/ppc/tcg-target-has.h
index 18ec573f7e..bbbd8de2c7 100644
--- a/tcg/ppc/tcg-target-has.h
+++ b/tcg/ppc/tcg-target-has.h
@@ -29,7 +29,6 @@
 #define TCG_TARGET_HAS_negsetcond_i32   1
 #define TCG_TARGET_HAS_mulu2_i32        0
 #define TCG_TARGET_HAS_muls2_i32        0
-#define TCG_TARGET_HAS_mulsh_i32        1
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
 #if TCG_TARGET_REG_BITS == 64
@@ -51,7 +50,6 @@
 #define TCG_TARGET_HAS_sub2_i64         1
 #define TCG_TARGET_HAS_mulu2_i64        0
 #define TCG_TARGET_HAS_muls2_i64        0
-#define TCG_TARGET_HAS_mulsh_i64        1
 #endif
 
 #define TCG_TARGET_HAS_qemu_ldst_i128   \
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index 06a7abf2ba..7ebadf396a 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -2984,6 +2984,18 @@ static const TCGOutOpBinary outop_mul = {
     .out_rri = tgen_muli,
 };
 
+static void tgen_mulsh(TCGContext *s, TCGType type,
+                       TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    uint32_t insn = type == TCG_TYPE_I32 ? MULHW : MULHD;
+    tcg_out32(s, insn | TAB(a0, a1, a2));
+}
+
+static const TCGOutOpBinary outop_mulsh = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_mulsh,
+};
+
 static void tgen_muluh(TCGContext *s, TCGType type,
                        TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -3499,13 +3511,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    case INDEX_op_mulsh_i32:
-        tcg_out32(s, MULHW | TAB(args[0], args[1], args[2]));
-        break;
-    case INDEX_op_mulsh_i64:
-        tcg_out32(s, MULHD | TAB(args[0], args[1], args[2]));
-        break;
-
     case INDEX_op_mb:
         tcg_out_mb(s, args[0]);
         break;
@@ -4183,12 +4188,10 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_divu_i32:
     case INDEX_op_rem_i32:
     case INDEX_op_remu_i32:
-    case INDEX_op_mulsh_i32:
     case INDEX_op_div_i64:
     case INDEX_op_divu_i64:
     case INDEX_op_rem_i64:
     case INDEX_op_remu_i64:
-    case INDEX_op_mulsh_i64:
         return C_O1_I2(r, r, r);
 
     case INDEX_op_clz_i32:
diff --git a/tcg/riscv/tcg-target-has.h b/tcg/riscv/tcg-target-has.h
index 453942a6a5..f7e1ef82fc 100644
--- a/tcg/riscv/tcg-target-has.h
+++ b/tcg/riscv/tcg-target-has.h
@@ -20,7 +20,6 @@
 #define TCG_TARGET_HAS_sub2_i32         1
 #define TCG_TARGET_HAS_mulu2_i32        0
 #define TCG_TARGET_HAS_muls2_i32        0
-#define TCG_TARGET_HAS_mulsh_i32        0
 #define TCG_TARGET_HAS_bswap16_i32      (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_bswap32_i32      (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_clz_i32          (cpuinfo & CPUINFO_ZBB)
@@ -45,7 +44,6 @@
 #define TCG_TARGET_HAS_sub2_i64         1
 #define TCG_TARGET_HAS_mulu2_i64        0
 #define TCG_TARGET_HAS_muls2_i64        0
-#define TCG_TARGET_HAS_mulsh_i64        1
 
 #define TCG_TARGET_HAS_qemu_ldst_i128   0
 
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index 65246cc450..82f76b8e0c 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -2026,6 +2026,18 @@ static TCGConstraintSetIndex cset_mulh(TCGType type, unsigned flags)
     return type == TCG_TYPE_I32 ? C_NotImplemented : C_O1_I2(r, r, r);
 }
 
+static void tgen_mulsh(TCGContext *s, TCGType type,
+                       TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_opc_reg(s, OPC_MULH, a0, a1, a2);
+}
+
+static const TCGOutOpBinary outop_mulsh = {
+    .base.static_constraint = C_Dynamic,
+    .base.dynamic_constraint = cset_mulh,
+    .out_rrr = tgen_mulsh,
+};
+
 static void tgen_muluh(TCGContext *s, TCGType type,
                        TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -2391,11 +2403,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_opc_imm(s, OPC_SRAI, a0, a1, 32);
         break;
 
-    case INDEX_op_mulsh_i32:
-    case INDEX_op_mulsh_i64:
-        tcg_out_opc_reg(s, OPC_MULH, a0, a1, a2);
-        break;
-
     case INDEX_op_mb:
         tcg_out_mb(s, a0);
         break;
@@ -2723,12 +2730,10 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_negsetcond_i64:
         return C_O1_I2(r, r, rI);
 
-    case INDEX_op_mulsh_i32:
     case INDEX_op_div_i32:
     case INDEX_op_divu_i32:
     case INDEX_op_rem_i32:
     case INDEX_op_remu_i32:
-    case INDEX_op_mulsh_i64:
     case INDEX_op_div_i64:
     case INDEX_op_divu_i64:
     case INDEX_op_rem_i64:
diff --git a/tcg/s390x/tcg-target-has.h b/tcg/s390x/tcg-target-has.h
index ac808e21e5..64f1805641 100644
--- a/tcg/s390x/tcg-target-has.h
+++ b/tcg/s390x/tcg-target-has.h
@@ -42,7 +42,6 @@ extern uint64_t s390_facilities[3];
 #define TCG_TARGET_HAS_sub2_i32       1
 #define TCG_TARGET_HAS_mulu2_i32      0
 #define TCG_TARGET_HAS_muls2_i32      0
-#define TCG_TARGET_HAS_mulsh_i32      0
 #define TCG_TARGET_HAS_extr_i64_i32   0
 #define TCG_TARGET_HAS_qemu_st8_i32   0
 
@@ -60,7 +59,6 @@ extern uint64_t s390_facilities[3];
 #define TCG_TARGET_HAS_sub2_i64       1
 #define TCG_TARGET_HAS_mulu2_i64      1
 #define TCG_TARGET_HAS_muls2_i64      HAVE_FACILITY(MISC_INSN_EXT2)
-#define TCG_TARGET_HAS_mulsh_i64      0
 
 #define TCG_TARGET_HAS_qemu_ldst_i128 1
 
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index e3d70ca236..2685e6ffa1 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -2309,6 +2309,10 @@ static const TCGOutOpBinary outop_mul = {
     .out_rri = tgen_muli,
 };
 
+static const TCGOutOpBinary outop_mulsh = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static const TCGOutOpBinary outop_muluh = {
     .base.static_constraint = C_NotImplemented,
 };
diff --git a/tcg/sparc64/tcg-target-has.h b/tcg/sparc64/tcg-target-has.h
index 093de87a1d..5a517b6835 100644
--- a/tcg/sparc64/tcg-target-has.h
+++ b/tcg/sparc64/tcg-target-has.h
@@ -28,7 +28,6 @@ extern bool use_vis3_instructions;
 #define TCG_TARGET_HAS_sub2_i32         1
 #define TCG_TARGET_HAS_mulu2_i32        1
 #define TCG_TARGET_HAS_muls2_i32        1
-#define TCG_TARGET_HAS_mulsh_i32        0
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
 #define TCG_TARGET_HAS_extr_i64_i32     0
@@ -47,7 +46,6 @@ extern bool use_vis3_instructions;
 #define TCG_TARGET_HAS_sub2_i64         1
 #define TCG_TARGET_HAS_mulu2_i64        0
 #define TCG_TARGET_HAS_muls2_i64        0
-#define TCG_TARGET_HAS_mulsh_i64        0
 
 #define TCG_TARGET_HAS_qemu_ldst_i128   0
 
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index 31bdaecafa..95a138ef56 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -1357,6 +1357,10 @@ static const TCGOutOpBinary outop_mul = {
     .out_rri = tgen_muli,
 };
 
+static const TCGOutOpBinary outop_mulsh = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static void tgen_muluh(TCGContext *s, TCGType type,
                        TCGReg a0, TCGReg a1, TCGReg a2)
 {
diff --git a/tcg/tcg-has.h b/tcg/tcg-has.h
index 7f3ef73f2e..3d4c67698f 100644
--- a/tcg/tcg-has.h
+++ b/tcg/tcg-has.h
@@ -28,7 +28,6 @@
 #define TCG_TARGET_HAS_sub2_i64         0
 #define TCG_TARGET_HAS_mulu2_i64        0
 #define TCG_TARGET_HAS_muls2_i64        0
-#define TCG_TARGET_HAS_mulsh_i64        0
 /* Turn some undef macros into true macros.  */
 #define TCG_TARGET_HAS_add2_i32         1
 #define TCG_TARGET_HAS_sub2_i32         1
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index 7a37b21c56..a043c4554b 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -1156,7 +1156,7 @@ void tcg_gen_muls2_i32(TCGv_i32 rl, TCGv_i32 rh, TCGv_i32 arg1, TCGv_i32 arg2)
 {
     if (TCG_TARGET_HAS_muls2_i32) {
         tcg_gen_op4_i32(INDEX_op_muls2_i32, rl, rh, arg1, arg2);
-    } else if (TCG_TARGET_HAS_mulsh_i32) {
+    } else if (tcg_op_supported(INDEX_op_mulsh_i32, TCG_TYPE_I32, 0)) {
         TCGv_i32 t = tcg_temp_ebb_new_i32();
         tcg_gen_op3_i32(INDEX_op_mul, t, arg1, arg2);
         tcg_gen_op3_i32(INDEX_op_mulsh_i32, rh, arg1, arg2);
@@ -2861,7 +2861,7 @@ void tcg_gen_muls2_i64(TCGv_i64 rl, TCGv_i64 rh, TCGv_i64 arg1, TCGv_i64 arg2)
 {
     if (TCG_TARGET_HAS_muls2_i64) {
         tcg_gen_op4_i64(INDEX_op_muls2_i64, rl, rh, arg1, arg2);
-    } else if (TCG_TARGET_HAS_mulsh_i64) {
+    } else if (tcg_op_supported(INDEX_op_mulsh_i64, TCG_TYPE_I64, 0)) {
         TCGv_i64 t = tcg_temp_ebb_new_i64();
         tcg_gen_op3_i64(INDEX_op_mul, t, arg1, arg2);
         tcg_gen_op3_i64(INDEX_op_mulsh_i64, rh, arg1, arg2);
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 808ac8c431..4bfda0a38f 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1022,6 +1022,8 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_andc, TCGOutOpBinary, outop_andc),
     OUTOP(INDEX_op_eqv, TCGOutOpBinary, outop_eqv),
     OUTOP(INDEX_op_mul, TCGOutOpBinary, outop_mul),
+    OUTOP(INDEX_op_mulsh_i32, TCGOutOpBinary, outop_mulsh),
+    OUTOP(INDEX_op_mulsh_i64, TCGOutOpBinary, outop_mulsh),
     OUTOP(INDEX_op_muluh, TCGOutOpBinary, outop_muluh),
     OUTOP(INDEX_op_nand, TCGOutOpBinary, outop_nand),
     OUTOP(INDEX_op_neg, TCGOutOpUnary, outop_neg),
@@ -2281,8 +2283,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
         return TCG_TARGET_HAS_mulu2_i32;
     case INDEX_op_muls2_i32:
         return TCG_TARGET_HAS_muls2_i32;
-    case INDEX_op_mulsh_i32:
-        return TCG_TARGET_HAS_mulsh_i32;
     case INDEX_op_bswap16_i32:
         return TCG_TARGET_HAS_bswap16_i32;
     case INDEX_op_bswap32_i32:
@@ -2361,8 +2361,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
         return TCG_TARGET_HAS_mulu2_i64;
     case INDEX_op_muls2_i64:
         return TCG_TARGET_HAS_muls2_i64;
-    case INDEX_op_mulsh_i64:
-        return TCG_TARGET_HAS_mulsh_i64;
 
     case INDEX_op_mov_vec:
     case INDEX_op_dup_vec:
@@ -5426,6 +5424,8 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
     case INDEX_op_andc:
     case INDEX_op_eqv:
     case INDEX_op_mul:
+    case INDEX_op_mulsh_i32:
+    case INDEX_op_mulsh_i64:
     case INDEX_op_muluh:
     case INDEX_op_nand:
     case INDEX_op_nor:
diff --git a/tcg/tci/tcg-target-has.h b/tcg/tci/tcg-target-has.h
index b99b12c24c..0627585097 100644
--- a/tcg/tci/tcg-target-has.h
+++ b/tcg/tci/tcg-target-has.h
@@ -18,7 +18,6 @@
 #define TCG_TARGET_HAS_rot_i32          1
 #define TCG_TARGET_HAS_negsetcond_i32   0
 #define TCG_TARGET_HAS_muls2_i32        1
-#define TCG_TARGET_HAS_mulsh_i32        0
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
 #if TCG_TARGET_REG_BITS == 64
@@ -41,7 +40,6 @@
 #define TCG_TARGET_HAS_add2_i64         1
 #define TCG_TARGET_HAS_sub2_i64         1
 #define TCG_TARGET_HAS_mulu2_i64        1
-#define TCG_TARGET_HAS_mulsh_i64        0
 #else
 #define TCG_TARGET_HAS_mulu2_i32        1
 #endif /* TCG_TARGET_REG_BITS == 64 */
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index e4a2b171df..1dcce543ec 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -670,6 +670,10 @@ static const TCGOutOpBinary outop_mul = {
     .out_rrr = tgen_mul,
 };
 
+static const TCGOutOpBinary outop_mulsh = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static const TCGOutOpBinary outop_muluh = {
     .base.static_constraint = C_NotImplemented,
 };

From c742824dd8df3283098d5339291d49e65e515751 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 7 Jan 2025 11:19:29 -0800
Subject: [PATCH 0399/2760] tcg: Merge INDEX_op_mulsh_{i32,i64}
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 docs/devel/tcg-ops.rst |  2 +-
 include/tcg/tcg-opc.h  |  3 +--
 tcg/optimize.c         | 10 +++++-----
 tcg/tcg-op.c           |  8 ++++----
 tcg/tcg.c              | 14 ++++----------
 5 files changed, 15 insertions(+), 22 deletions(-)

diff --git a/docs/devel/tcg-ops.rst b/docs/devel/tcg-ops.rst
index 4fed5a77c6..fe922d1dac 100644
--- a/docs/devel/tcg-ops.rst
+++ b/docs/devel/tcg-ops.rst
@@ -589,7 +589,7 @@ Multiword arithmetic support
 
      - | Similar to mulu2, except the two inputs *t1* and *t2* are signed.
 
-   * - mulsh_i32/i64 *t0*, *t1*, *t2*
+   * - mulsh *t0*, *t1*, *t2*
 
        muluh *t0*, *t1*, *t2*
 
diff --git a/include/tcg/tcg-opc.h b/include/tcg/tcg-opc.h
index 28a5128537..a9d7938a52 100644
--- a/include/tcg/tcg-opc.h
+++ b/include/tcg/tcg-opc.h
@@ -44,6 +44,7 @@ DEF(and, 1, 2, 0, TCG_OPF_INT)
 DEF(andc, 1, 2, 0, TCG_OPF_INT)
 DEF(eqv, 1, 2, 0, TCG_OPF_INT)
 DEF(mul, 1, 2, 0, TCG_OPF_INT)
+DEF(mulsh, 1, 2, 0, TCG_OPF_INT)
 DEF(muluh, 1, 2, 0, TCG_OPF_INT)
 DEF(nand, 1, 2, 0, TCG_OPF_INT)
 DEF(neg, 1, 1, 0, TCG_OPF_INT)
@@ -90,7 +91,6 @@ DEF(add2_i32, 2, 4, 0, 0)
 DEF(sub2_i32, 2, 4, 0, 0)
 DEF(mulu2_i32, 2, 2, 0, 0)
 DEF(muls2_i32, 2, 2, 0, 0)
-DEF(mulsh_i32, 1, 2, 0, 0)
 DEF(brcond2_i32, 0, 4, 2, TCG_OPF_BB_END | TCG_OPF_COND_BRANCH)
 DEF(setcond2_i32, 1, 4, 1, 0)
 
@@ -151,7 +151,6 @@ DEF(add2_i64, 2, 4, 0, 0)
 DEF(sub2_i64, 2, 4, 0, 0)
 DEF(mulu2_i64, 2, 2, 0, 0)
 DEF(muls2_i64, 2, 2, 0, 0)
-DEF(mulsh_i64, 1, 2, 0, 0)
 
 #define DATA64_ARGS  (TCG_TARGET_REG_BITS == 64 ? 1 : 2)
 
diff --git a/tcg/optimize.c b/tcg/optimize.c
index e19bccf906..fd446fc47d 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -549,10 +549,10 @@ static uint64_t do_constant_folding_2(TCGOpcode op, TCGType type,
         mulu64(&l64, &h64, x, y);
         return h64;
 
-    case INDEX_op_mulsh_i32:
-        return ((int64_t)(int32_t)x * (int32_t)y) >> 32;
-
-    case INDEX_op_mulsh_i64:
+    case INDEX_op_mulsh:
+        if (type == TCG_TYPE_I32) {
+            return ((int64_t)(int32_t)x * (int32_t)y) >> 32;
+        }
         muls64(&l64, &h64, x, y);
         return h64;
 
@@ -2969,7 +2969,7 @@ void tcg_optimize(TCGContext *s)
         case INDEX_op_mul:
             done = fold_mul(&ctx, op);
             break;
-        CASE_OP_32_64(mulsh):
+        case INDEX_op_mulsh:
         case INDEX_op_muluh:
             done = fold_mul_highpart(&ctx, op);
             break;
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index a043c4554b..664c698187 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -1156,10 +1156,10 @@ void tcg_gen_muls2_i32(TCGv_i32 rl, TCGv_i32 rh, TCGv_i32 arg1, TCGv_i32 arg2)
 {
     if (TCG_TARGET_HAS_muls2_i32) {
         tcg_gen_op4_i32(INDEX_op_muls2_i32, rl, rh, arg1, arg2);
-    } else if (tcg_op_supported(INDEX_op_mulsh_i32, TCG_TYPE_I32, 0)) {
+    } else if (tcg_op_supported(INDEX_op_mulsh, TCG_TYPE_I32, 0)) {
         TCGv_i32 t = tcg_temp_ebb_new_i32();
         tcg_gen_op3_i32(INDEX_op_mul, t, arg1, arg2);
-        tcg_gen_op3_i32(INDEX_op_mulsh_i32, rh, arg1, arg2);
+        tcg_gen_op3_i32(INDEX_op_mulsh, rh, arg1, arg2);
         tcg_gen_mov_i32(rl, t);
         tcg_temp_free_i32(t);
     } else if (TCG_TARGET_REG_BITS == 32) {
@@ -2861,10 +2861,10 @@ void tcg_gen_muls2_i64(TCGv_i64 rl, TCGv_i64 rh, TCGv_i64 arg1, TCGv_i64 arg2)
 {
     if (TCG_TARGET_HAS_muls2_i64) {
         tcg_gen_op4_i64(INDEX_op_muls2_i64, rl, rh, arg1, arg2);
-    } else if (tcg_op_supported(INDEX_op_mulsh_i64, TCG_TYPE_I64, 0)) {
+    } else if (tcg_op_supported(INDEX_op_mulsh, TCG_TYPE_I64, 0)) {
         TCGv_i64 t = tcg_temp_ebb_new_i64();
         tcg_gen_op3_i64(INDEX_op_mul, t, arg1, arg2);
-        tcg_gen_op3_i64(INDEX_op_mulsh_i64, rh, arg1, arg2);
+        tcg_gen_op3_i64(INDEX_op_mulsh, rh, arg1, arg2);
         tcg_gen_mov_i64(rl, t);
         tcg_temp_free_i64(t);
     } else if (TCG_TARGET_HAS_mulu2_i64 ||
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 4bfda0a38f..d4b5872128 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1022,8 +1022,7 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_andc, TCGOutOpBinary, outop_andc),
     OUTOP(INDEX_op_eqv, TCGOutOpBinary, outop_eqv),
     OUTOP(INDEX_op_mul, TCGOutOpBinary, outop_mul),
-    OUTOP(INDEX_op_mulsh_i32, TCGOutOpBinary, outop_mulsh),
-    OUTOP(INDEX_op_mulsh_i64, TCGOutOpBinary, outop_mulsh),
+    OUTOP(INDEX_op_mulsh, TCGOutOpBinary, outop_mulsh),
     OUTOP(INDEX_op_muluh, TCGOutOpBinary, outop_muluh),
     OUTOP(INDEX_op_nand, TCGOutOpBinary, outop_nand),
     OUTOP(INDEX_op_neg, TCGOutOpUnary, outop_neg),
@@ -4028,18 +4027,14 @@ liveness_pass_1(TCGContext *s)
             goto do_not_remove;
 
         case INDEX_op_muls2_i32:
+        case INDEX_op_muls2_i64:
             opc_new = INDEX_op_mul;
-            opc_new2 = INDEX_op_mulsh_i32;
+            opc_new2 = INDEX_op_mulsh;
             goto do_mul2;
         case INDEX_op_mulu2_i32:
         case INDEX_op_mulu2_i64:
             opc_new = INDEX_op_mul;
             opc_new2 = INDEX_op_muluh;
-            goto do_mul2;
-        case INDEX_op_muls2_i64:
-            opc_new = INDEX_op_mul;
-            opc_new2 = INDEX_op_mulsh_i64;
-            goto do_mul2;
         do_mul2:
             nb_iargs = 2;
             nb_oargs = 2;
@@ -5424,8 +5419,7 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
     case INDEX_op_andc:
     case INDEX_op_eqv:
     case INDEX_op_mul:
-    case INDEX_op_mulsh_i32:
-    case INDEX_op_mulsh_i64:
+    case INDEX_op_mulsh:
     case INDEX_op_muluh:
     case INDEX_op_nand:
     case INDEX_op_nor:

From 0cdacacebbe8a5e0d8a68a8c0007bff364c0e79a Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 7 Jan 2025 13:04:24 -0800
Subject: [PATCH 0400/2760] tcg: Convert div to TCGOutOpBinary

For TCI, we're losing type information in the interpreter.
Introduce a tci-specific opcode to handle the difference.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target.c.inc     | 17 ++++++++-----
 tcg/arm/tcg-target.c.inc         | 28 +++++++++++++--------
 tcg/i386/tcg-target.c.inc        |  4 +++
 tcg/loongarch64/tcg-target.c.inc | 24 +++++++++++-------
 tcg/mips/tcg-target.c.inc        | 37 ++++++++++++++++------------
 tcg/ppc/tcg-target.c.inc         | 21 +++++++++-------
 tcg/riscv/tcg-target.c.inc       | 21 +++++++++-------
 tcg/s390x/tcg-target.c.inc       |  4 +++
 tcg/sparc64/tcg-target.c.inc     | 42 ++++++++++++++++++++++++++------
 tcg/tcg-op.c                     |  8 +++---
 tcg/tcg.c                        |  6 +++--
 tcg/tci.c                        |  3 ++-
 tcg/tci/tcg-target-opc.h.inc     |  1 +
 tcg/tci/tcg-target.c.inc         | 17 ++++++++++---
 14 files changed, 156 insertions(+), 77 deletions(-)

diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index 493c504682..52069f1445 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -2157,6 +2157,17 @@ static const TCGOutOpBinary outop_andc = {
     .out_rrr = tgen_andc,
 };
 
+static void tgen_divs(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_insn(s, 3508, SDIV, type, a0, a1, a2);
+}
+
+static const TCGOutOpBinary outop_divs = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_divs,
+};
+
 static void tgen_eqv(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -2362,10 +2373,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType ext,
         tcg_out_ldst(s, I3312_STRX, a0, a1, a2, 3);
         break;
 
-    case INDEX_op_div_i64:
-    case INDEX_op_div_i32:
-        tcg_out_insn(s, 3508, SDIV, ext, a0, a1, a2);
-        break;
     case INDEX_op_divu_i64:
     case INDEX_op_divu_i32:
         tcg_out_insn(s, 3508, UDIV, ext, a0, a1, a2);
@@ -3057,8 +3064,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_negsetcond_i64:
         return C_O1_I2(r, r, rC);
 
-    case INDEX_op_div_i32:
-    case INDEX_op_div_i64:
     case INDEX_op_divu_i32:
     case INDEX_op_divu_i64:
     case INDEX_op_rem_i32:
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index 1c19004e6e..e07e4c06d9 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -937,12 +937,6 @@ static void tcg_out_smull32(TCGContext *s, ARMCond cond, TCGReg rd0,
               (rd1 << 16) | (rd0 << 12) | (rm << 8) | rn);
 }
 
-static void tcg_out_sdiv(TCGContext *s, ARMCond cond,
-                         TCGReg rd, TCGReg rn, TCGReg rm)
-{
-    tcg_out32(s, 0x0710f010 | (cond << 28) | (rd << 16) | rn | (rm << 8));
-}
-
 static void tcg_out_udiv(TCGContext *s, ARMCond cond,
                          TCGReg rd, TCGReg rn, TCGReg rm)
 {
@@ -1874,6 +1868,24 @@ static const TCGOutOpBinary outop_andc = {
     .out_rrr = tgen_andc,
 };
 
+static TCGConstraintSetIndex cset_idiv(TCGType type, unsigned flags)
+{
+    return use_idiv_instructions ? C_O1_I2(r, r, r) : C_NotImplemented;
+}
+
+static void tgen_divs(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    /* sdiv */
+    tcg_out32(s, 0x0710f010 | (COND_AL << 28) | (a0 << 16) | a1 | (a2 << 8));
+}
+
+static const TCGOutOpBinary outop_divs = {
+    .base.static_constraint = C_Dynamic,
+    .base.dynamic_constraint = cset_idiv,
+    .out_rrr = tgen_divs,
+};
+
 static const TCGOutOpBinary outop_eqv = {
     .base.static_constraint = C_NotImplemented,
 };
@@ -2218,9 +2230,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    case INDEX_op_div_i32:
-        tcg_out_sdiv(s, COND_AL, args[0], args[1], args[2]);
-        break;
     case INDEX_op_divu_i32:
         tcg_out_udiv(s, COND_AL, args[0], args[1], args[2]);
         break;
@@ -2268,7 +2277,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ctz_i32:
         return C_O1_I2(r, r, rIK);
 
-    case INDEX_op_div_i32:
     case INDEX_op_divu_i32:
         return C_O1_I2(r, r, r);
 
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index d0391157a4..e132dd0c88 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -2633,6 +2633,10 @@ static const TCGOutOpBinary outop_andc = {
     .out_rrr = tgen_andc,
 };
 
+static const TCGOutOpBinary outop_divs = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static const TCGOutOpBinary outop_eqv = {
     .base.static_constraint = C_NotImplemented,
 };
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index 7503270ca3..c42d8d690a 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -1328,6 +1328,21 @@ static const TCGOutOpBinary outop_andc = {
     .out_rrr = tgen_andc,
 };
 
+static void tgen_divs(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    if (type == TCG_TYPE_I32) {
+        tcg_out_opc_div_w(s, a0, a1, a2);
+    } else {
+        tcg_out_opc_div_d(s, a0, a1, a2);
+    }
+}
+
+static const TCGOutOpBinary outop_divs = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_divs,
+};
+
 static const TCGOutOpBinary outop_eqv = {
     .base.static_constraint = C_NotImplemented,
 };
@@ -1671,13 +1686,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    case INDEX_op_div_i32:
-        tcg_out_opc_div_w(s, a0, a1, a2);
-        break;
-    case INDEX_op_div_i64:
-        tcg_out_opc_div_d(s, a0, a1, a2);
-        break;
-
     case INDEX_op_divu_i32:
         tcg_out_opc_div_wu(s, a0, a1, a2);
         break;
@@ -2357,8 +2365,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_setcond_i64:
         return C_O1_I2(r, rz, rJ);
 
-    case INDEX_op_div_i32:
-    case INDEX_op_div_i64:
     case INDEX_op_divu_i32:
     case INDEX_op_divu_i64:
     case INDEX_op_rem_i32:
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index a1c215c25d..7762d88e6b 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -1712,6 +1712,27 @@ static const TCGOutOpBinary outop_andc = {
     .base.static_constraint = C_NotImplemented,
 };
 
+static void tgen_divs(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    if (use_mips32r6_instructions) {
+        if (type == TCG_TYPE_I32) {
+            tcg_out_opc_reg(s, OPC_DIV_R6, a0, a1, a2);
+        } else {
+            tcg_out_opc_reg(s, OPC_DDIV_R6, a0, a1, a2);
+        }
+    } else {
+        MIPSInsn insn = type == TCG_TYPE_I32 ? OPC_DIV : OPC_DDIV;
+        tcg_out_opc_reg(s, insn, 0, a1, a2);
+        tcg_out_opc_reg(s, OPC_MFLO, a0, 0, 0);
+    }
+}
+
+static const TCGOutOpBinary outop_divs = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_divs,
+};
+
 static const TCGOutOpBinary outop_eqv = {
     .base.static_constraint = C_NotImplemented,
 };
@@ -1939,13 +1960,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_ldst(s, i1, a0, a1, a2);
         break;
 
-    case INDEX_op_div_i32:
-        if (use_mips32r6_instructions) {
-            tcg_out_opc_reg(s, OPC_DIV_R6, a0, a1, a2);
-            break;
-        }
-        i1 = OPC_DIV, i2 = OPC_MFLO;
-        goto do_hilo1;
     case INDEX_op_divu_i32:
         if (use_mips32r6_instructions) {
             tcg_out_opc_reg(s, OPC_DIVU_R6, a0, a1, a2);
@@ -1967,13 +1981,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         i1 = OPC_DIVU, i2 = OPC_MFHI;
         goto do_hilo1;
-    case INDEX_op_div_i64:
-        if (use_mips32r6_instructions) {
-            tcg_out_opc_reg(s, OPC_DDIV_R6, a0, a1, a2);
-            break;
-        }
-        i1 = OPC_DDIV, i2 = OPC_MFLO;
-        goto do_hilo1;
     case INDEX_op_divu_i64:
         if (use_mips32r6_instructions) {
             tcg_out_opc_reg(s, OPC_DDIVU_R6, a0, a1, a2);
@@ -2253,12 +2260,10 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(rz, r);
 
-    case INDEX_op_div_i32:
     case INDEX_op_divu_i32:
     case INDEX_op_rem_i32:
     case INDEX_op_remu_i32:
     case INDEX_op_setcond_i32:
-    case INDEX_op_div_i64:
     case INDEX_op_divu_i64:
     case INDEX_op_rem_i64:
     case INDEX_op_remu_i64:
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index 7ebadf396a..9fdf8df082 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -2960,6 +2960,18 @@ static void tgen_eqv(TCGContext *s, TCGType type,
     tcg_out32(s, EQV | SAB(a1, a0, a2));
 }
 
+static void tgen_divs(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    uint32_t insn = type == TCG_TYPE_I32 ? DIVW : DIVD;
+    tcg_out32(s, insn | TAB(a0, a1, a2));
+}
+
+static const TCGOutOpBinary outop_divs = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_divs,
+};
+
 static const TCGOutOpBinary outop_eqv = {
     .base.static_constraint = C_O1_I2(r, r, r),
     .out_rrr = tgen_eqv,
@@ -3209,10 +3221,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out32(s, CNTPOPD | SAB(args[1], args[0], 0));
         break;
 
-    case INDEX_op_div_i32:
-        tcg_out32(s, DIVW | TAB(args[0], args[1], args[2]));
-        break;
-
     case INDEX_op_divu_i32:
         tcg_out32(s, DIVWU | TAB(args[0], args[1], args[2]));
         break;
@@ -3317,9 +3325,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    case INDEX_op_div_i64:
-        tcg_out32(s, DIVD | TAB(args[0], args[1], args[2]));
-        break;
     case INDEX_op_divu_i64:
         tcg_out32(s, DIVDU | TAB(args[0], args[1], args[2]));
         break;
@@ -4184,11 +4189,9 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_rotr_i64:
         return C_O1_I2(r, r, ri);
 
-    case INDEX_op_div_i32:
     case INDEX_op_divu_i32:
     case INDEX_op_rem_i32:
     case INDEX_op_remu_i32:
-    case INDEX_op_div_i64:
     case INDEX_op_divu_i64:
     case INDEX_op_rem_i64:
     case INDEX_op_remu_i64:
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index 82f76b8e0c..15925729dc 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -1997,6 +1997,18 @@ static const TCGOutOpBinary outop_andc = {
     .out_rrr = tgen_andc,
 };
 
+static void tgen_divs(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    RISCVInsn insn = type == TCG_TYPE_I32 ? OPC_DIVW : OPC_DIV;
+    tcg_out_opc_reg(s, insn, a0, a1, a2);
+}
+
+static const TCGOutOpBinary outop_divs = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_divs,
+};
+
 static void tgen_eqv(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -2201,13 +2213,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_ldst(s, OPC_SD, a0, a1, a2);
         break;
 
-    case INDEX_op_div_i32:
-        tcg_out_opc_reg(s, OPC_DIVW, a0, a1, a2);
-        break;
-    case INDEX_op_div_i64:
-        tcg_out_opc_reg(s, OPC_DIV, a0, a1, a2);
-        break;
-
     case INDEX_op_divu_i32:
         tcg_out_opc_reg(s, OPC_DIVUW, a0, a1, a2);
         break;
@@ -2730,11 +2735,9 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_negsetcond_i64:
         return C_O1_I2(r, r, rI);
 
-    case INDEX_op_div_i32:
     case INDEX_op_divu_i32:
     case INDEX_op_rem_i32:
     case INDEX_op_remu_i32:
-    case INDEX_op_div_i64:
     case INDEX_op_divu_i64:
     case INDEX_op_rem_i64:
     case INDEX_op_remu_i64:
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index 2685e6ffa1..fd0e717c49 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -2242,6 +2242,10 @@ static const TCGOutOpBinary outop_andc = {
     .out_rrr = tgen_andc,
 };
 
+static const TCGOutOpBinary outop_divs = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static void tgen_eqv(TCGContext *s, TCGType type,
                       TCGReg a0, TCGReg a1, TCGReg a2)
 {
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index 95a138ef56..779d0ce882 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -1333,6 +1333,40 @@ static const TCGOutOpBinary outop_andc = {
     .out_rrr = tgen_andc,
 };
 
+static void tgen_divs_rJ(TCGContext *s, TCGType type,
+                         TCGReg a0, TCGReg a1, TCGArg a2, bool c2)
+{
+    uint32_t insn;
+
+    if (type == TCG_TYPE_I32) {
+        /* Load Y with the sign extension of a1 to 64-bits.  */
+        tcg_out_arithi(s, TCG_REG_T1, a1, 31, SHIFT_SRA);
+        tcg_out_sety(s, TCG_REG_T1);
+        insn = ARITH_SDIV;
+    } else {
+        insn = ARITH_SDIVX;
+    }
+    tcg_out_arithc(s, a0, a1, a2, c2, insn);
+}
+
+static void tgen_divs(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tgen_divs_rJ(s, type, a0, a1, a2, false);
+}
+
+static void tgen_divsi(TCGContext *s, TCGType type,
+                       TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    tgen_divs_rJ(s, type, a0, a1, a2, true);
+}
+
+static const TCGOutOpBinary outop_divs = {
+    .base.static_constraint = C_O1_I2(r, r, rJ),
+    .out_rrr = tgen_divs,
+    .out_rri = tgen_divsi,
+};
+
 static const TCGOutOpBinary outop_eqv = {
     .base.static_constraint = C_NotImplemented,
 };
@@ -1532,9 +1566,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         c = SHIFT_SRA;
         goto do_shift32;
 
-    case INDEX_op_div_i32:
-        tcg_out_div32(s, a0, a1, a2, c2, 0);
-        break;
     case INDEX_op_divu_i32:
         tcg_out_div32(s, a0, a1, a2, c2, 1);
         break;
@@ -1607,9 +1638,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     case INDEX_op_sar_i64:
         c = SHIFT_SRAX;
         goto do_shift64;
-    case INDEX_op_div_i64:
-        c = ARITH_SDIVX;
-        goto gen_arith;
     case INDEX_op_divu_i64:
         c = ARITH_UDIVX;
         goto gen_arith;
@@ -1700,8 +1728,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_qemu_st_i64:
         return C_O0_I2(rz, r);
 
-    case INDEX_op_div_i32:
-    case INDEX_op_div_i64:
     case INDEX_op_divu_i32:
     case INDEX_op_divu_i64:
     case INDEX_op_shl_i32:
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index 664c698187..69e50f968f 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -601,7 +601,7 @@ void tcg_gen_muli_i32(TCGv_i32 ret, TCGv_i32 arg1, int32_t arg2)
 
 void tcg_gen_div_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 {
-    if (TCG_TARGET_HAS_div_i32) {
+    if (tcg_op_supported(INDEX_op_div_i32, TCG_TYPE_I32, 0)) {
         tcg_gen_op3_i32(INDEX_op_div_i32, ret, arg1, arg2);
     } else if (TCG_TARGET_HAS_div2_i32) {
         TCGv_i32 t0 = tcg_temp_ebb_new_i32();
@@ -617,7 +617,7 @@ void tcg_gen_rem_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 {
     if (TCG_TARGET_HAS_rem_i32) {
         tcg_gen_op3_i32(INDEX_op_rem_i32, ret, arg1, arg2);
-    } else if (TCG_TARGET_HAS_div_i32) {
+    } else if (tcg_op_supported(INDEX_op_div_i32, TCG_TYPE_I32, 0)) {
         TCGv_i32 t0 = tcg_temp_ebb_new_i32();
         tcg_gen_op3_i32(INDEX_op_div_i32, t0, arg1, arg2);
         tcg_gen_mul_i32(t0, t0, arg2);
@@ -1969,7 +1969,7 @@ void tcg_gen_muli_i64(TCGv_i64 ret, TCGv_i64 arg1, int64_t arg2)
 
 void tcg_gen_div_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
 {
-    if (TCG_TARGET_HAS_div_i64) {
+    if (tcg_op_supported(INDEX_op_div_i64, TCG_TYPE_I64, 0)) {
         tcg_gen_op3_i64(INDEX_op_div_i64, ret, arg1, arg2);
     } else if (TCG_TARGET_HAS_div2_i64) {
         TCGv_i64 t0 = tcg_temp_ebb_new_i64();
@@ -1985,7 +1985,7 @@ void tcg_gen_rem_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
 {
     if (TCG_TARGET_HAS_rem_i64) {
         tcg_gen_op3_i64(INDEX_op_rem_i64, ret, arg1, arg2);
-    } else if (TCG_TARGET_HAS_div_i64) {
+    } else if (tcg_op_supported(INDEX_op_div_i64, TCG_TYPE_I64, 0)) {
         TCGv_i64 t0 = tcg_temp_ebb_new_i64();
         tcg_gen_op3_i64(INDEX_op_div_i64, t0, arg1, arg2);
         tcg_gen_mul_i64(t0, t0, arg2);
diff --git a/tcg/tcg.c b/tcg/tcg.c
index d4b5872128..f99213a154 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1020,6 +1020,8 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_add, TCGOutOpBinary, outop_add),
     OUTOP(INDEX_op_and, TCGOutOpBinary, outop_and),
     OUTOP(INDEX_op_andc, TCGOutOpBinary, outop_andc),
+    OUTOP(INDEX_op_div_i32, TCGOutOpBinary, outop_divs),
+    OUTOP(INDEX_op_div_i64, TCGOutOpBinary, outop_divs),
     OUTOP(INDEX_op_eqv, TCGOutOpBinary, outop_eqv),
     OUTOP(INDEX_op_mul, TCGOutOpBinary, outop_mul),
     OUTOP(INDEX_op_mulsh, TCGOutOpBinary, outop_mulsh),
@@ -2260,7 +2262,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
 
     case INDEX_op_negsetcond_i32:
         return TCG_TARGET_HAS_negsetcond_i32;
-    case INDEX_op_div_i32:
     case INDEX_op_divu_i32:
         return TCG_TARGET_HAS_div_i32;
     case INDEX_op_rem_i32:
@@ -2323,7 +2324,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
 
     case INDEX_op_negsetcond_i64:
         return TCG_TARGET_HAS_negsetcond_i64;
-    case INDEX_op_div_i64:
     case INDEX_op_divu_i64:
         return TCG_TARGET_HAS_div_i64;
     case INDEX_op_rem_i64:
@@ -5417,6 +5417,8 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
     case INDEX_op_add:
     case INDEX_op_and:
     case INDEX_op_andc:
+    case INDEX_op_div_i32:
+    case INDEX_op_div_i64:
     case INDEX_op_eqv:
     case INDEX_op_mul:
     case INDEX_op_mulsh:
diff --git a/tcg/tci.c b/tcg/tci.c
index 61c0ccf21e..4ecbb2d335 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -578,7 +578,7 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
 
             /* Arithmetic operations (32 bit). */
 
-        case INDEX_op_div_i32:
+        case INDEX_op_tci_divs32:
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = (int32_t)regs[r1] / (int32_t)regs[r2];
             break;
@@ -1101,6 +1101,7 @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
     case INDEX_op_clz_i64:
     case INDEX_op_ctz_i32:
     case INDEX_op_ctz_i64:
+    case INDEX_op_tci_divs32:
         tci_args_rrr(insn, &r0, &r1, &r2);
         info->fprintf_func(info->stream, "%-12s  %s, %s, %s",
                            op_name, str_r(r0), str_r(r1), str_r(r2));
diff --git a/tcg/tci/tcg-target-opc.h.inc b/tcg/tci/tcg-target-opc.h.inc
index ecc8c4e55e..f503374643 100644
--- a/tcg/tci/tcg-target-opc.h.inc
+++ b/tcg/tci/tcg-target-opc.h.inc
@@ -2,3 +2,4 @@
 /* These opcodes for use between the tci generator and interpreter. */
 DEF(tci_movi, 1, 0, 1, TCG_OPF_NOT_PRESENT)
 DEF(tci_movl, 1, 0, 1, TCG_OPF_NOT_PRESENT)
+DEF(tci_divs32, 1, 2, 0, TCG_OPF_NOT_PRESENT)
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index 1dcce543ec..c8e86a3253 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -79,8 +79,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(r, r);
 
-    case INDEX_op_div_i32:
-    case INDEX_op_div_i64:
     case INDEX_op_divu_i32:
     case INDEX_op_divu_i64:
     case INDEX_op_rem_i32:
@@ -648,6 +646,20 @@ static const TCGOutOpBinary outop_andc = {
     .out_rrr = tgen_andc,
 };
 
+static void tgen_divs(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    TCGOpcode opc = (type == TCG_TYPE_I32
+                     ? INDEX_op_tci_divs32
+                     : INDEX_op_div_i64);
+    tcg_out_op_rrr(s, opc, a0, a1, a2);
+}
+
+static const TCGOutOpBinary outop_divs = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_divs,
+};
+
 static void tgen_eqv(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -811,7 +823,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     CASE_32_64(sar)
     CASE_32_64(rotl)     /* Optional (TCG_TARGET_HAS_rot_*). */
     CASE_32_64(rotr)     /* Optional (TCG_TARGET_HAS_rot_*). */
-    CASE_32_64(div)      /* Optional (TCG_TARGET_HAS_div_*). */
     CASE_32_64(divu)     /* Optional (TCG_TARGET_HAS_div_*). */
     CASE_32_64(rem)      /* Optional (TCG_TARGET_HAS_div_*). */
     CASE_32_64(remu)     /* Optional (TCG_TARGET_HAS_div_*). */

From b2c514f9d5cab89814dc8a6b7c98c653ca8523d3 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 7 Jan 2025 13:22:56 -0800
Subject: [PATCH 0401/2760] tcg: Merge INDEX_op_div_{i32,i64}
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Rename to INDEX_op_divs to emphasize signed inputs,
and mirroring INDEX_op_divu_*.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 docs/devel/tcg-ops.rst   |  2 +-
 include/tcg/tcg-opc.h    |  3 +--
 tcg/optimize.c           | 12 +++++++-----
 tcg/tcg-op.c             | 16 ++++++++--------
 tcg/tcg.c                |  6 ++----
 tcg/tci.c                |  5 ++---
 tcg/tci/tcg-target.c.inc |  2 +-
 7 files changed, 22 insertions(+), 24 deletions(-)

diff --git a/docs/devel/tcg-ops.rst b/docs/devel/tcg-ops.rst
index fe922d1dac..a833b3b7b2 100644
--- a/docs/devel/tcg-ops.rst
+++ b/docs/devel/tcg-ops.rst
@@ -277,7 +277,7 @@ Arithmetic
 
      - | *t0* = *t1* * *t2*
 
-   * - div_i32/i64 *t0*, *t1*, *t2*
+   * - divs *t0*, *t1*, *t2*
 
      - | *t0* = *t1* / *t2* (signed)
        | Undefined behavior if division by zero or overflow.
diff --git a/include/tcg/tcg-opc.h b/include/tcg/tcg-opc.h
index a9d7938a52..6d4edd0b16 100644
--- a/include/tcg/tcg-opc.h
+++ b/include/tcg/tcg-opc.h
@@ -42,6 +42,7 @@ DEF(mov, 1, 1, 0, TCG_OPF_INT | TCG_OPF_NOT_PRESENT)
 DEF(add, 1, 2, 0, TCG_OPF_INT)
 DEF(and, 1, 2, 0, TCG_OPF_INT)
 DEF(andc, 1, 2, 0, TCG_OPF_INT)
+DEF(divs, 1, 2, 0, TCG_OPF_INT)
 DEF(eqv, 1, 2, 0, TCG_OPF_INT)
 DEF(mul, 1, 2, 0, TCG_OPF_INT)
 DEF(mulsh, 1, 2, 0, TCG_OPF_INT)
@@ -68,7 +69,6 @@ DEF(st8_i32, 0, 2, 1, 0)
 DEF(st16_i32, 0, 2, 1, 0)
 DEF(st_i32, 0, 2, 1, 0)
 /* arith */
-DEF(div_i32, 1, 2, 0, 0)
 DEF(divu_i32, 1, 2, 0, 0)
 DEF(rem_i32, 1, 2, 0, 0)
 DEF(remu_i32, 1, 2, 0, 0)
@@ -116,7 +116,6 @@ DEF(st16_i64, 0, 2, 1, 0)
 DEF(st32_i64, 0, 2, 1, 0)
 DEF(st_i64, 0, 2, 1, 0)
 /* arith */
-DEF(div_i64, 1, 2, 0, 0)
 DEF(divu_i64, 1, 2, 0, 0)
 DEF(rem_i64, 1, 2, 0, 0)
 DEF(remu_i64, 1, 2, 0, 0)
diff --git a/tcg/optimize.c b/tcg/optimize.c
index fd446fc47d..af9054be37 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -556,13 +556,15 @@ static uint64_t do_constant_folding_2(TCGOpcode op, TCGType type,
         muls64(&l64, &h64, x, y);
         return h64;
 
-    case INDEX_op_div_i32:
+    case INDEX_op_divs:
         /* Avoid crashing on divide by zero, otherwise undefined.  */
-        return (int32_t)x / ((int32_t)y ? : 1);
+        if (type == TCG_TYPE_I32) {
+            return (int32_t)x / ((int32_t)y ? : 1);
+        }
+        return (int64_t)x / ((int64_t)y ? : 1);
+
     case INDEX_op_divu_i32:
         return (uint32_t)x / ((uint32_t)y ? : 1);
-    case INDEX_op_div_i64:
-        return (int64_t)x / ((int64_t)y ? : 1);
     case INDEX_op_divu_i64:
         return (uint64_t)x / ((uint64_t)y ? : 1);
 
@@ -2905,7 +2907,7 @@ void tcg_optimize(TCGContext *s)
         CASE_OP_32_64(deposit):
             done = fold_deposit(&ctx, op);
             break;
-        CASE_OP_32_64(div):
+        case INDEX_op_divs:
         CASE_OP_32_64(divu):
             done = fold_divide(&ctx, op);
             break;
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index 69e50f968f..9dba520d40 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -601,8 +601,8 @@ void tcg_gen_muli_i32(TCGv_i32 ret, TCGv_i32 arg1, int32_t arg2)
 
 void tcg_gen_div_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 {
-    if (tcg_op_supported(INDEX_op_div_i32, TCG_TYPE_I32, 0)) {
-        tcg_gen_op3_i32(INDEX_op_div_i32, ret, arg1, arg2);
+    if (tcg_op_supported(INDEX_op_divs, TCG_TYPE_I32, 0)) {
+        tcg_gen_op3_i32(INDEX_op_divs, ret, arg1, arg2);
     } else if (TCG_TARGET_HAS_div2_i32) {
         TCGv_i32 t0 = tcg_temp_ebb_new_i32();
         tcg_gen_sari_i32(t0, arg1, 31);
@@ -617,9 +617,9 @@ void tcg_gen_rem_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 {
     if (TCG_TARGET_HAS_rem_i32) {
         tcg_gen_op3_i32(INDEX_op_rem_i32, ret, arg1, arg2);
-    } else if (tcg_op_supported(INDEX_op_div_i32, TCG_TYPE_I32, 0)) {
+    } else if (tcg_op_supported(INDEX_op_divs, TCG_TYPE_I32, 0)) {
         TCGv_i32 t0 = tcg_temp_ebb_new_i32();
-        tcg_gen_op3_i32(INDEX_op_div_i32, t0, arg1, arg2);
+        tcg_gen_op3_i32(INDEX_op_divs, t0, arg1, arg2);
         tcg_gen_mul_i32(t0, t0, arg2);
         tcg_gen_sub_i32(ret, arg1, t0);
         tcg_temp_free_i32(t0);
@@ -1969,8 +1969,8 @@ void tcg_gen_muli_i64(TCGv_i64 ret, TCGv_i64 arg1, int64_t arg2)
 
 void tcg_gen_div_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
 {
-    if (tcg_op_supported(INDEX_op_div_i64, TCG_TYPE_I64, 0)) {
-        tcg_gen_op3_i64(INDEX_op_div_i64, ret, arg1, arg2);
+    if (tcg_op_supported(INDEX_op_divs, TCG_TYPE_I64, 0)) {
+        tcg_gen_op3_i64(INDEX_op_divs, ret, arg1, arg2);
     } else if (TCG_TARGET_HAS_div2_i64) {
         TCGv_i64 t0 = tcg_temp_ebb_new_i64();
         tcg_gen_sari_i64(t0, arg1, 63);
@@ -1985,9 +1985,9 @@ void tcg_gen_rem_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
 {
     if (TCG_TARGET_HAS_rem_i64) {
         tcg_gen_op3_i64(INDEX_op_rem_i64, ret, arg1, arg2);
-    } else if (tcg_op_supported(INDEX_op_div_i64, TCG_TYPE_I64, 0)) {
+    } else if (tcg_op_supported(INDEX_op_divs, TCG_TYPE_I64, 0)) {
         TCGv_i64 t0 = tcg_temp_ebb_new_i64();
-        tcg_gen_op3_i64(INDEX_op_div_i64, t0, arg1, arg2);
+        tcg_gen_op3_i64(INDEX_op_divs, t0, arg1, arg2);
         tcg_gen_mul_i64(t0, t0, arg2);
         tcg_gen_sub_i64(ret, arg1, t0);
         tcg_temp_free_i64(t0);
diff --git a/tcg/tcg.c b/tcg/tcg.c
index f99213a154..d4e30d0b33 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1020,8 +1020,7 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_add, TCGOutOpBinary, outop_add),
     OUTOP(INDEX_op_and, TCGOutOpBinary, outop_and),
     OUTOP(INDEX_op_andc, TCGOutOpBinary, outop_andc),
-    OUTOP(INDEX_op_div_i32, TCGOutOpBinary, outop_divs),
-    OUTOP(INDEX_op_div_i64, TCGOutOpBinary, outop_divs),
+    OUTOP(INDEX_op_divs, TCGOutOpBinary, outop_divs),
     OUTOP(INDEX_op_eqv, TCGOutOpBinary, outop_eqv),
     OUTOP(INDEX_op_mul, TCGOutOpBinary, outop_mul),
     OUTOP(INDEX_op_mulsh, TCGOutOpBinary, outop_mulsh),
@@ -5417,8 +5416,7 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
     case INDEX_op_add:
     case INDEX_op_and:
     case INDEX_op_andc:
-    case INDEX_op_div_i32:
-    case INDEX_op_div_i64:
+    case INDEX_op_divs:
     case INDEX_op_eqv:
     case INDEX_op_mul:
     case INDEX_op_mulsh:
diff --git a/tcg/tci.c b/tcg/tci.c
index 4ecbb2d335..4b3ca53bc5 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -720,7 +720,7 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
 
             /* Arithmetic operations (64 bit). */
 
-        case INDEX_op_div_i64:
+        case INDEX_op_divs:
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = (int64_t)regs[r1] / (int64_t)regs[r2];
             break;
@@ -1071,6 +1071,7 @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
     case INDEX_op_add:
     case INDEX_op_and:
     case INDEX_op_andc:
+    case INDEX_op_divs:
     case INDEX_op_eqv:
     case INDEX_op_mul:
     case INDEX_op_nand:
@@ -1079,8 +1080,6 @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
     case INDEX_op_orc:
     case INDEX_op_sub:
     case INDEX_op_xor:
-    case INDEX_op_div_i32:
-    case INDEX_op_div_i64:
     case INDEX_op_rem_i32:
     case INDEX_op_rem_i64:
     case INDEX_op_divu_i32:
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index c8e86a3253..4a556e2ce7 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -651,7 +651,7 @@ static void tgen_divs(TCGContext *s, TCGType type,
 {
     TCGOpcode opc = (type == TCG_TYPE_I32
                      ? INDEX_op_tci_divs32
-                     : INDEX_op_div_i64);
+                     : INDEX_op_divs);
     tcg_out_op_rrr(s, opc, a0, a1, a2);
 }
 

From 6d1a2365eaee0603347fd2fabd89a8dc935c8ac7 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 7 Jan 2025 14:10:27 -0800
Subject: [PATCH 0402/2760] tcg: Convert divu to TCGOutOpBinary

For TCI, we're losing type information in the interpreter.
Introduce a tci-specific opcode to handle the difference.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target-has.h     |  2 --
 tcg/aarch64/tcg-target.c.inc     | 18 ++++++----
 tcg/arm/tcg-target-has.h         |  1 -
 tcg/arm/tcg-target.c.inc         | 26 +++++++-------
 tcg/i386/tcg-target.c.inc        |  4 +++
 tcg/loongarch64/tcg-target-has.h |  2 --
 tcg/loongarch64/tcg-target.c.inc | 24 ++++++++-----
 tcg/mips/tcg-target-has.h        |  2 --
 tcg/mips/tcg-target.c.inc        | 37 ++++++++++---------
 tcg/ppc/tcg-target-has.h         |  2 --
 tcg/ppc/tcg-target.c.inc         | 21 ++++++-----
 tcg/riscv/tcg-target-has.h       |  2 --
 tcg/riscv/tcg-target.c.inc       | 21 ++++++-----
 tcg/s390x/tcg-target.c.inc       |  4 +++
 tcg/sparc64/tcg-target-has.h     |  2 --
 tcg/sparc64/tcg-target.c.inc     | 61 +++++++++++++++++---------------
 tcg/tcg-has.h                    | 15 ++++----
 tcg/tcg-op.c                     |  8 ++---
 tcg/tcg.c                        |  8 ++---
 tcg/tci.c                        |  3 +-
 tcg/tci/tcg-target-has.h         |  2 --
 tcg/tci/tcg-target-opc.h.inc     |  1 +
 tcg/tci/tcg-target.c.inc         | 17 +++++++--
 23 files changed, 157 insertions(+), 126 deletions(-)

diff --git a/tcg/aarch64/tcg-target-has.h b/tcg/aarch64/tcg-target-has.h
index bde6db8f2a..e961668ef0 100644
--- a/tcg/aarch64/tcg-target-has.h
+++ b/tcg/aarch64/tcg-target-has.h
@@ -13,7 +13,6 @@
 #define have_lse2   (cpuinfo & CPUINFO_LSE2)
 
 /* optional instructions */
-#define TCG_TARGET_HAS_div_i32          1
 #define TCG_TARGET_HAS_rem_i32          1
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
@@ -30,7 +29,6 @@
 #define TCG_TARGET_HAS_extr_i64_i32     0
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
-#define TCG_TARGET_HAS_div_i64          1
 #define TCG_TARGET_HAS_rem_i64          1
 #define TCG_TARGET_HAS_bswap16_i64      1
 #define TCG_TARGET_HAS_bswap32_i64      1
diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index 52069f1445..167c51c897 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -2168,6 +2168,17 @@ static const TCGOutOpBinary outop_divs = {
     .out_rrr = tgen_divs,
 };
 
+static void tgen_divu(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_insn(s, 3508, UDIV, type, a0, a1, a2);
+}
+
+static const TCGOutOpBinary outop_divu = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_divu,
+};
+
 static void tgen_eqv(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -2373,11 +2384,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType ext,
         tcg_out_ldst(s, I3312_STRX, a0, a1, a2, 3);
         break;
 
-    case INDEX_op_divu_i64:
-    case INDEX_op_divu_i32:
-        tcg_out_insn(s, 3508, UDIV, ext, a0, a1, a2);
-        break;
-
     case INDEX_op_rem_i64:
     case INDEX_op_rem_i32:
         tcg_out_insn(s, 3508, SDIV, ext, TCG_REG_TMP0, a1, a2);
@@ -3064,8 +3070,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_negsetcond_i64:
         return C_O1_I2(r, r, rC);
 
-    case INDEX_op_divu_i32:
-    case INDEX_op_divu_i64:
     case INDEX_op_rem_i32:
     case INDEX_op_rem_i64:
     case INDEX_op_remu_i32:
diff --git a/tcg/arm/tcg-target-has.h b/tcg/arm/tcg-target-has.h
index ab9b7b6162..6ed2b49c84 100644
--- a/tcg/arm/tcg-target-has.h
+++ b/tcg/arm/tcg-target-has.h
@@ -34,7 +34,6 @@ extern bool use_neon_instructions;
 #define TCG_TARGET_HAS_negsetcond_i32   1
 #define TCG_TARGET_HAS_mulu2_i32        1
 #define TCG_TARGET_HAS_muls2_i32        1
-#define TCG_TARGET_HAS_div_i32          use_idiv_instructions
 #define TCG_TARGET_HAS_rem_i32          0
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index e07e4c06d9..65d0ae83b2 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -937,12 +937,6 @@ static void tcg_out_smull32(TCGContext *s, ARMCond cond, TCGReg rd0,
               (rd1 << 16) | (rd0 << 12) | (rm << 8) | rn);
 }
 
-static void tcg_out_udiv(TCGContext *s, ARMCond cond,
-                         TCGReg rd, TCGReg rn, TCGReg rm)
-{
-    tcg_out32(s, 0x0730f010 | (cond << 28) | (rd << 16) | rn | (rm << 8));
-}
-
 static void tcg_out_ext8s(TCGContext *s, TCGType t, TCGReg rd, TCGReg rn)
 {
     /* sxtb */
@@ -1886,6 +1880,19 @@ static const TCGOutOpBinary outop_divs = {
     .out_rrr = tgen_divs,
 };
 
+static void tgen_divu(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    /* udiv */
+    tcg_out32(s, 0x0730f010 | (COND_AL << 28) | (a0 << 16) | a1 | (a2 << 8));
+}
+
+static const TCGOutOpBinary outop_divu = {
+    .base.static_constraint = C_Dynamic,
+    .base.dynamic_constraint = cset_idiv,
+    .out_rrr = tgen_divu,
+};
+
 static const TCGOutOpBinary outop_eqv = {
     .base.static_constraint = C_NotImplemented,
 };
@@ -2230,10 +2237,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    case INDEX_op_divu_i32:
-        tcg_out_udiv(s, COND_AL, args[0], args[1], args[2]);
-        break;
-
     case INDEX_op_mb:
         tcg_out_mb(s, args[0]);
         break;
@@ -2277,9 +2280,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ctz_i32:
         return C_O1_I2(r, r, rIK);
 
-    case INDEX_op_divu_i32:
-        return C_O1_I2(r, r, r);
-
     case INDEX_op_mulu2_i32:
     case INDEX_op_muls2_i32:
         return C_O2_I2(r, r, r, r);
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index e132dd0c88..f258d6383b 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -2637,6 +2637,10 @@ static const TCGOutOpBinary outop_divs = {
     .base.static_constraint = C_NotImplemented,
 };
 
+static const TCGOutOpBinary outop_divu = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static const TCGOutOpBinary outop_eqv = {
     .base.static_constraint = C_NotImplemented,
 };
diff --git a/tcg/loongarch64/tcg-target-has.h b/tcg/loongarch64/tcg-target-has.h
index e29c892756..96a99b6d4c 100644
--- a/tcg/loongarch64/tcg-target-has.h
+++ b/tcg/loongarch64/tcg-target-has.h
@@ -11,7 +11,6 @@
 
 /* optional instructions */
 #define TCG_TARGET_HAS_negsetcond_i32   0
-#define TCG_TARGET_HAS_div_i32          1
 #define TCG_TARGET_HAS_rem_i32          1
 #define TCG_TARGET_HAS_div2_i32         0
 #define TCG_TARGET_HAS_rot_i32          1
@@ -29,7 +28,6 @@
 
 /* 64-bit operations */
 #define TCG_TARGET_HAS_negsetcond_i64   0
-#define TCG_TARGET_HAS_div_i64          1
 #define TCG_TARGET_HAS_rem_i64          1
 #define TCG_TARGET_HAS_div2_i64         0
 #define TCG_TARGET_HAS_rot_i64          1
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index c42d8d690a..e82a62d09e 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -1343,6 +1343,21 @@ static const TCGOutOpBinary outop_divs = {
     .out_rrr = tgen_divs,
 };
 
+static void tgen_divu(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    if (type == TCG_TYPE_I32) {
+        tcg_out_opc_div_wu(s, a0, a1, a2);
+    } else {
+        tcg_out_opc_div_du(s, a0, a1, a2);
+    }
+}
+
+static const TCGOutOpBinary outop_divu = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_divu,
+};
+
 static const TCGOutOpBinary outop_eqv = {
     .base.static_constraint = C_NotImplemented,
 };
@@ -1686,13 +1701,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    case INDEX_op_divu_i32:
-        tcg_out_opc_div_wu(s, a0, a1, a2);
-        break;
-    case INDEX_op_divu_i64:
-        tcg_out_opc_div_du(s, a0, a1, a2);
-        break;
-
     case INDEX_op_rem_i32:
         tcg_out_opc_mod_w(s, a0, a1, a2);
         break;
@@ -2365,8 +2373,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_setcond_i64:
         return C_O1_I2(r, rz, rJ);
 
-    case INDEX_op_divu_i32:
-    case INDEX_op_divu_i64:
     case INDEX_op_rem_i32:
     case INDEX_op_rem_i64:
     case INDEX_op_remu_i32:
diff --git a/tcg/mips/tcg-target-has.h b/tcg/mips/tcg-target-has.h
index ebaaa49cdd..9aa5bf9f1b 100644
--- a/tcg/mips/tcg-target-has.h
+++ b/tcg/mips/tcg-target-has.h
@@ -39,7 +39,6 @@ extern bool use_mips32r2_instructions;
 #endif
 
 /* optional instructions */
-#define TCG_TARGET_HAS_div_i32          1
 #define TCG_TARGET_HAS_rem_i32          1
 #define TCG_TARGET_HAS_mulu2_i32        (!use_mips32r6_instructions)
 #define TCG_TARGET_HAS_muls2_i32        (!use_mips32r6_instructions)
@@ -51,7 +50,6 @@ extern bool use_mips32r2_instructions;
 #define TCG_TARGET_HAS_add2_i32         0
 #define TCG_TARGET_HAS_sub2_i32         0
 #define TCG_TARGET_HAS_extr_i64_i32     1
-#define TCG_TARGET_HAS_div_i64          1
 #define TCG_TARGET_HAS_rem_i64          1
 #define TCG_TARGET_HAS_add2_i64         0
 #define TCG_TARGET_HAS_sub2_i64         0
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index 7762d88e6b..ab9546f104 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -1733,6 +1733,27 @@ static const TCGOutOpBinary outop_divs = {
     .out_rrr = tgen_divs,
 };
 
+static void tgen_divu(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    if (use_mips32r6_instructions) {
+        if (type == TCG_TYPE_I32) {
+            tcg_out_opc_reg(s, OPC_DIVU_R6, a0, a1, a2);
+        } else {
+            tcg_out_opc_reg(s, OPC_DDIVU_R6, a0, a1, a2);
+        }
+    } else {
+        MIPSInsn insn = type == TCG_TYPE_I32 ? OPC_DIVU : OPC_DDIVU;
+        tcg_out_opc_reg(s, insn, 0, a1, a2);
+        tcg_out_opc_reg(s, OPC_MFLO, a0, 0, 0);
+    }
+}
+
+static const TCGOutOpBinary outop_divu = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_divu,
+};
+
 static const TCGOutOpBinary outop_eqv = {
     .base.static_constraint = C_NotImplemented,
 };
@@ -1960,13 +1981,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_ldst(s, i1, a0, a1, a2);
         break;
 
-    case INDEX_op_divu_i32:
-        if (use_mips32r6_instructions) {
-            tcg_out_opc_reg(s, OPC_DIVU_R6, a0, a1, a2);
-            break;
-        }
-        i1 = OPC_DIVU, i2 = OPC_MFLO;
-        goto do_hilo1;
     case INDEX_op_rem_i32:
         if (use_mips32r6_instructions) {
             tcg_out_opc_reg(s, OPC_MOD, a0, a1, a2);
@@ -1981,13 +1995,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         i1 = OPC_DIVU, i2 = OPC_MFHI;
         goto do_hilo1;
-    case INDEX_op_divu_i64:
-        if (use_mips32r6_instructions) {
-            tcg_out_opc_reg(s, OPC_DDIVU_R6, a0, a1, a2);
-            break;
-        }
-        i1 = OPC_DDIVU, i2 = OPC_MFLO;
-        goto do_hilo1;
     case INDEX_op_rem_i64:
         if (use_mips32r6_instructions) {
             tcg_out_opc_reg(s, OPC_DMOD, a0, a1, a2);
@@ -2260,11 +2267,9 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(rz, r);
 
-    case INDEX_op_divu_i32:
     case INDEX_op_rem_i32:
     case INDEX_op_remu_i32:
     case INDEX_op_setcond_i32:
-    case INDEX_op_divu_i64:
     case INDEX_op_rem_i64:
     case INDEX_op_remu_i64:
     case INDEX_op_setcond_i64:
diff --git a/tcg/ppc/tcg-target-has.h b/tcg/ppc/tcg-target-has.h
index bbbd8de2c7..f8e4c0ad3c 100644
--- a/tcg/ppc/tcg-target-has.h
+++ b/tcg/ppc/tcg-target-has.h
@@ -17,7 +17,6 @@
 #define have_vsx       (cpuinfo & CPUINFO_VSX)
 
 /* optional instructions */
-#define TCG_TARGET_HAS_div_i32          1
 #define TCG_TARGET_HAS_rem_i32          have_isa_3_00
 #define TCG_TARGET_HAS_rot_i32          1
 #define TCG_TARGET_HAS_bswap16_i32      1
@@ -35,7 +34,6 @@
 #define TCG_TARGET_HAS_add2_i32         0
 #define TCG_TARGET_HAS_sub2_i32         0
 #define TCG_TARGET_HAS_extr_i64_i32     0
-#define TCG_TARGET_HAS_div_i64          1
 #define TCG_TARGET_HAS_rem_i64          have_isa_3_00
 #define TCG_TARGET_HAS_rot_i64          1
 #define TCG_TARGET_HAS_bswap16_i64      1
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index 9fdf8df082..b347595131 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -2972,6 +2972,18 @@ static const TCGOutOpBinary outop_divs = {
     .out_rrr = tgen_divs,
 };
 
+static void tgen_divu(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    uint32_t insn = type == TCG_TYPE_I32 ? DIVWU : DIVDU;
+    tcg_out32(s, insn | TAB(a0, a1, a2));
+}
+
+static const TCGOutOpBinary outop_divu = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_divu,
+};
+
 static const TCGOutOpBinary outop_eqv = {
     .base.static_constraint = C_O1_I2(r, r, r),
     .out_rrr = tgen_eqv,
@@ -3221,10 +3233,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out32(s, CNTPOPD | SAB(args[1], args[0], 0));
         break;
 
-    case INDEX_op_divu_i32:
-        tcg_out32(s, DIVWU | TAB(args[0], args[1], args[2]));
-        break;
-
     case INDEX_op_rem_i32:
         tcg_out32(s, MODSW | TAB(args[0], args[1], args[2]));
         break;
@@ -3325,9 +3333,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    case INDEX_op_divu_i64:
-        tcg_out32(s, DIVDU | TAB(args[0], args[1], args[2]));
-        break;
     case INDEX_op_rem_i64:
         tcg_out32(s, MODSD | TAB(args[0], args[1], args[2]));
         break;
@@ -4189,10 +4194,8 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_rotr_i64:
         return C_O1_I2(r, r, ri);
 
-    case INDEX_op_divu_i32:
     case INDEX_op_rem_i32:
     case INDEX_op_remu_i32:
-    case INDEX_op_divu_i64:
     case INDEX_op_rem_i64:
     case INDEX_op_remu_i64:
         return C_O1_I2(r, r, r);
diff --git a/tcg/riscv/tcg-target-has.h b/tcg/riscv/tcg-target-has.h
index f7e1ef82fc..ae6624b9a4 100644
--- a/tcg/riscv/tcg-target-has.h
+++ b/tcg/riscv/tcg-target-has.h
@@ -11,7 +11,6 @@
 
 /* optional instructions */
 #define TCG_TARGET_HAS_negsetcond_i32   1
-#define TCG_TARGET_HAS_div_i32          1
 #define TCG_TARGET_HAS_rem_i32          1
 #define TCG_TARGET_HAS_div2_i32         0
 #define TCG_TARGET_HAS_rot_i32          (cpuinfo & CPUINFO_ZBB)
@@ -28,7 +27,6 @@
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
 #define TCG_TARGET_HAS_negsetcond_i64   1
-#define TCG_TARGET_HAS_div_i64          1
 #define TCG_TARGET_HAS_rem_i64          1
 #define TCG_TARGET_HAS_div2_i64         0
 #define TCG_TARGET_HAS_rot_i64          (cpuinfo & CPUINFO_ZBB)
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index 15925729dc..74fa38d273 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -2009,6 +2009,18 @@ static const TCGOutOpBinary outop_divs = {
     .out_rrr = tgen_divs,
 };
 
+static void tgen_divu(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    RISCVInsn insn = type == TCG_TYPE_I32 ? OPC_DIVUW : OPC_DIVU;
+    tcg_out_opc_reg(s, insn, a0, a1, a2);
+}
+
+static const TCGOutOpBinary outop_divu = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_divu,
+};
+
 static void tgen_eqv(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -2213,13 +2225,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_ldst(s, OPC_SD, a0, a1, a2);
         break;
 
-    case INDEX_op_divu_i32:
-        tcg_out_opc_reg(s, OPC_DIVUW, a0, a1, a2);
-        break;
-    case INDEX_op_divu_i64:
-        tcg_out_opc_reg(s, OPC_DIVU, a0, a1, a2);
-        break;
-
     case INDEX_op_rem_i32:
         tcg_out_opc_reg(s, OPC_REMW, a0, a1, a2);
         break;
@@ -2735,10 +2740,8 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_negsetcond_i64:
         return C_O1_I2(r, r, rI);
 
-    case INDEX_op_divu_i32:
     case INDEX_op_rem_i32:
     case INDEX_op_remu_i32:
-    case INDEX_op_divu_i64:
     case INDEX_op_rem_i64:
     case INDEX_op_remu_i64:
         return C_O1_I2(r, rz, rz);
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index fd0e717c49..f55309f48e 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -2246,6 +2246,10 @@ static const TCGOutOpBinary outop_divs = {
     .base.static_constraint = C_NotImplemented,
 };
 
+static const TCGOutOpBinary outop_divu = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static void tgen_eqv(TCGContext *s, TCGType type,
                       TCGReg a0, TCGReg a1, TCGReg a2)
 {
diff --git a/tcg/sparc64/tcg-target-has.h b/tcg/sparc64/tcg-target-has.h
index 5a517b6835..35f0dd4230 100644
--- a/tcg/sparc64/tcg-target-has.h
+++ b/tcg/sparc64/tcg-target-has.h
@@ -14,7 +14,6 @@ extern bool use_vis3_instructions;
 #endif
 
 /* optional instructions */
-#define TCG_TARGET_HAS_div_i32		1
 #define TCG_TARGET_HAS_rem_i32		0
 #define TCG_TARGET_HAS_rot_i32          0
 #define TCG_TARGET_HAS_bswap16_i32      0
@@ -31,7 +30,6 @@ extern bool use_vis3_instructions;
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
 #define TCG_TARGET_HAS_extr_i64_i32     0
-#define TCG_TARGET_HAS_div_i64          1
 #define TCG_TARGET_HAS_rem_i64          0
 #define TCG_TARGET_HAS_rot_i64          0
 #define TCG_TARGET_HAS_bswap16_i64      0
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index 779d0ce882..3a3372d7aa 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -596,21 +596,6 @@ static void tcg_out_sety(TCGContext *s, TCGReg rs)
     tcg_out32(s, WRY | INSN_RS1(TCG_REG_G0) | INSN_RS2(rs));
 }
 
-static void tcg_out_div32(TCGContext *s, TCGReg rd, TCGReg rs1,
-                          int32_t val2, int val2const, int uns)
-{
-    /* Load Y with the sign/zero extension of RS1 to 64-bits.  */
-    if (uns) {
-        tcg_out_sety(s, TCG_REG_G0);
-    } else {
-        tcg_out_arithi(s, TCG_REG_T1, rs1, 31, SHIFT_SRA);
-        tcg_out_sety(s, TCG_REG_T1);
-    }
-
-    tcg_out_arithc(s, rd, rs1, val2, val2const,
-                   uns ? ARITH_UDIV : ARITH_SDIV);
-}
-
 static const uint8_t tcg_cond_to_bcond[16] = {
     [TCG_COND_EQ] = COND_E,
     [TCG_COND_NE] = COND_NE,
@@ -1367,6 +1352,39 @@ static const TCGOutOpBinary outop_divs = {
     .out_rri = tgen_divsi,
 };
 
+static void tgen_divu_rJ(TCGContext *s, TCGType type,
+                         TCGReg a0, TCGReg a1, TCGArg a2, bool c2)
+{
+    uint32_t insn;
+
+    if (type == TCG_TYPE_I32) {
+        /* Load Y with the zero extension to 64-bits.  */
+        tcg_out_sety(s, TCG_REG_G0);
+        insn = ARITH_UDIV;
+    } else {
+        insn = ARITH_UDIVX;
+    }
+    tcg_out_arithc(s, a0, a1, a2, c2, insn);
+}
+
+static void tgen_divu(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tgen_divu_rJ(s, type, a0, a1, a2, false);
+}
+
+static void tgen_divui(TCGContext *s, TCGType type,
+                       TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    tgen_divu_rJ(s, type, a0, a1, a2, true);
+}
+
+static const TCGOutOpBinary outop_divu = {
+    .base.static_constraint = C_O1_I2(r, r, rJ),
+    .out_rrr = tgen_divu,
+    .out_rri = tgen_divui,
+};
+
 static const TCGOutOpBinary outop_eqv = {
     .base.static_constraint = C_NotImplemented,
 };
@@ -1566,10 +1584,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         c = SHIFT_SRA;
         goto do_shift32;
 
-    case INDEX_op_divu_i32:
-        tcg_out_div32(s, a0, a1, a2, c2, 1);
-        break;
-
     case INDEX_op_brcond_i32:
         tcg_out_brcond_i32(s, a2, a0, a1, const_args[1], arg_label(args[3]));
         break;
@@ -1638,9 +1652,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     case INDEX_op_sar_i64:
         c = SHIFT_SRAX;
         goto do_shift64;
-    case INDEX_op_divu_i64:
-        c = ARITH_UDIVX;
-        goto gen_arith;
 
     case INDEX_op_brcond_i64:
         tcg_out_brcond_i64(s, a2, a0, a1, const_args[1], arg_label(args[3]));
@@ -1663,10 +1674,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                             const_args[4], args[5], const_args[5], true);
         break;
 
-    gen_arith:
-        tcg_out_arithc(s, a0, a1, a2, c2, c);
-        break;
-
     case INDEX_op_mb:
         tcg_out_mb(s, a0);
         break;
@@ -1728,8 +1735,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_qemu_st_i64:
         return C_O0_I2(rz, r);
 
-    case INDEX_op_divu_i32:
-    case INDEX_op_divu_i64:
     case INDEX_op_shl_i32:
     case INDEX_op_shl_i64:
     case INDEX_op_shr_i32:
diff --git a/tcg/tcg-has.h b/tcg/tcg-has.h
index 3d4c67698f..9680ccfc53 100644
--- a/tcg/tcg-has.h
+++ b/tcg/tcg-has.h
@@ -33,17 +33,16 @@
 #define TCG_TARGET_HAS_sub2_i32         1
 #endif
 
-/* Only one of DIV or DIV2 should be defined.  */
-#if defined(TCG_TARGET_HAS_div_i32)
+#ifndef TCG_TARGET_HAS_div2_i32
 #define TCG_TARGET_HAS_div2_i32         0
-#elif defined(TCG_TARGET_HAS_div2_i32)
-#define TCG_TARGET_HAS_div_i32          0
+#endif
+#ifndef TCG_TARGET_HAS_div2_i64
+#define TCG_TARGET_HAS_div2_i64         0
+#endif
+#ifndef TCG_TARGET_HAS_rem_i32
 #define TCG_TARGET_HAS_rem_i32          0
 #endif
-#if defined(TCG_TARGET_HAS_div_i64)
-#define TCG_TARGET_HAS_div2_i64         0
-#elif defined(TCG_TARGET_HAS_div2_i64)
-#define TCG_TARGET_HAS_div_i64          0
+#ifndef TCG_TARGET_HAS_rem_i64
 #define TCG_TARGET_HAS_rem_i64          0
 #endif
 
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index 9dba520d40..19be461214 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -635,7 +635,7 @@ void tcg_gen_rem_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 
 void tcg_gen_divu_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 {
-    if (TCG_TARGET_HAS_div_i32) {
+    if (tcg_op_supported(INDEX_op_divu_i32, TCG_TYPE_I32, 0)) {
         tcg_gen_op3_i32(INDEX_op_divu_i32, ret, arg1, arg2);
     } else if (TCG_TARGET_HAS_div2_i32) {
         TCGv_i32 t0 = tcg_temp_ebb_new_i32();
@@ -651,7 +651,7 @@ void tcg_gen_remu_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 {
     if (TCG_TARGET_HAS_rem_i32) {
         tcg_gen_op3_i32(INDEX_op_remu_i32, ret, arg1, arg2);
-    } else if (TCG_TARGET_HAS_div_i32) {
+    } else if (tcg_op_supported(INDEX_op_divu_i32, TCG_TYPE_I32, 0)) {
         TCGv_i32 t0 = tcg_temp_ebb_new_i32();
         tcg_gen_op3_i32(INDEX_op_divu_i32, t0, arg1, arg2);
         tcg_gen_mul_i32(t0, t0, arg2);
@@ -2003,7 +2003,7 @@ void tcg_gen_rem_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
 
 void tcg_gen_divu_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
 {
-    if (TCG_TARGET_HAS_div_i64) {
+    if (tcg_op_supported(INDEX_op_divu_i64, TCG_TYPE_I64, 0)) {
         tcg_gen_op3_i64(INDEX_op_divu_i64, ret, arg1, arg2);
     } else if (TCG_TARGET_HAS_div2_i64) {
         TCGv_i64 t0 = tcg_temp_ebb_new_i64();
@@ -2019,7 +2019,7 @@ void tcg_gen_remu_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
 {
     if (TCG_TARGET_HAS_rem_i64) {
         tcg_gen_op3_i64(INDEX_op_remu_i64, ret, arg1, arg2);
-    } else if (TCG_TARGET_HAS_div_i64) {
+    } else if (tcg_op_supported(INDEX_op_divu_i64, TCG_TYPE_I64, 0)) {
         TCGv_i64 t0 = tcg_temp_ebb_new_i64();
         tcg_gen_op3_i64(INDEX_op_divu_i64, t0, arg1, arg2);
         tcg_gen_mul_i64(t0, t0, arg2);
diff --git a/tcg/tcg.c b/tcg/tcg.c
index d4e30d0b33..a0e58c07d7 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1021,6 +1021,8 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_and, TCGOutOpBinary, outop_and),
     OUTOP(INDEX_op_andc, TCGOutOpBinary, outop_andc),
     OUTOP(INDEX_op_divs, TCGOutOpBinary, outop_divs),
+    OUTOP(INDEX_op_divu_i32, TCGOutOpBinary, outop_divu),
+    OUTOP(INDEX_op_divu_i64, TCGOutOpBinary, outop_divu),
     OUTOP(INDEX_op_eqv, TCGOutOpBinary, outop_eqv),
     OUTOP(INDEX_op_mul, TCGOutOpBinary, outop_mul),
     OUTOP(INDEX_op_mulsh, TCGOutOpBinary, outop_mulsh),
@@ -2261,8 +2263,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
 
     case INDEX_op_negsetcond_i32:
         return TCG_TARGET_HAS_negsetcond_i32;
-    case INDEX_op_divu_i32:
-        return TCG_TARGET_HAS_div_i32;
     case INDEX_op_rem_i32:
     case INDEX_op_remu_i32:
         return TCG_TARGET_HAS_rem_i32;
@@ -2323,8 +2323,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
 
     case INDEX_op_negsetcond_i64:
         return TCG_TARGET_HAS_negsetcond_i64;
-    case INDEX_op_divu_i64:
-        return TCG_TARGET_HAS_div_i64;
     case INDEX_op_rem_i64:
     case INDEX_op_remu_i64:
         return TCG_TARGET_HAS_rem_i64;
@@ -5417,6 +5415,8 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
     case INDEX_op_and:
     case INDEX_op_andc:
     case INDEX_op_divs:
+    case INDEX_op_divu_i32:
+    case INDEX_op_divu_i64:
     case INDEX_op_eqv:
     case INDEX_op_mul:
     case INDEX_op_mulsh:
diff --git a/tcg/tci.c b/tcg/tci.c
index 4b3ca53bc5..0691824f97 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -582,7 +582,7 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = (int32_t)regs[r1] / (int32_t)regs[r2];
             break;
-        case INDEX_op_divu_i32:
+        case INDEX_op_tci_divu32:
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = (uint32_t)regs[r1] / (uint32_t)regs[r2];
             break;
@@ -1101,6 +1101,7 @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
     case INDEX_op_ctz_i32:
     case INDEX_op_ctz_i64:
     case INDEX_op_tci_divs32:
+    case INDEX_op_tci_divu32:
         tci_args_rrr(insn, &r0, &r1, &r2);
         info->fprintf_func(info->stream, "%-12s  %s, %s, %s",
                            op_name, str_r(r0), str_r(r1), str_r(r2));
diff --git a/tcg/tci/tcg-target-has.h b/tcg/tci/tcg-target-has.h
index 0627585097..ccec96b610 100644
--- a/tcg/tci/tcg-target-has.h
+++ b/tcg/tci/tcg-target-has.h
@@ -9,7 +9,6 @@
 
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
-#define TCG_TARGET_HAS_div_i32          1
 #define TCG_TARGET_HAS_rem_i32          1
 #define TCG_TARGET_HAS_extract2_i32     0
 #define TCG_TARGET_HAS_clz_i32          1
@@ -26,7 +25,6 @@
 #define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1
 #define TCG_TARGET_HAS_extract2_i64     0
-#define TCG_TARGET_HAS_div_i64          1
 #define TCG_TARGET_HAS_rem_i64          1
 #define TCG_TARGET_HAS_clz_i64          1
 #define TCG_TARGET_HAS_ctz_i64          1
diff --git a/tcg/tci/tcg-target-opc.h.inc b/tcg/tci/tcg-target-opc.h.inc
index f503374643..43c07a269f 100644
--- a/tcg/tci/tcg-target-opc.h.inc
+++ b/tcg/tci/tcg-target-opc.h.inc
@@ -3,3 +3,4 @@
 DEF(tci_movi, 1, 0, 1, TCG_OPF_NOT_PRESENT)
 DEF(tci_movl, 1, 0, 1, TCG_OPF_NOT_PRESENT)
 DEF(tci_divs32, 1, 2, 0, TCG_OPF_NOT_PRESENT)
+DEF(tci_divu32, 1, 2, 0, TCG_OPF_NOT_PRESENT)
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index 4a556e2ce7..18a10156a6 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -79,8 +79,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(r, r);
 
-    case INDEX_op_divu_i32:
-    case INDEX_op_divu_i64:
     case INDEX_op_rem_i32:
     case INDEX_op_rem_i64:
     case INDEX_op_remu_i32:
@@ -660,6 +658,20 @@ static const TCGOutOpBinary outop_divs = {
     .out_rrr = tgen_divs,
 };
 
+static void tgen_divu(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    TCGOpcode opc = (type == TCG_TYPE_I32
+                     ? INDEX_op_tci_divu32
+                     : INDEX_op_divu_i64);
+    tcg_out_op_rrr(s, opc, a0, a1, a2);
+}
+
+static const TCGOutOpBinary outop_divu = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_divu,
+};
+
 static void tgen_eqv(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -823,7 +835,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     CASE_32_64(sar)
     CASE_32_64(rotl)     /* Optional (TCG_TARGET_HAS_rot_*). */
     CASE_32_64(rotr)     /* Optional (TCG_TARGET_HAS_rot_*). */
-    CASE_32_64(divu)     /* Optional (TCG_TARGET_HAS_div_*). */
     CASE_32_64(rem)      /* Optional (TCG_TARGET_HAS_div_*). */
     CASE_32_64(remu)     /* Optional (TCG_TARGET_HAS_div_*). */
     CASE_32_64(clz)      /* Optional (TCG_TARGET_HAS_clz_*). */

From 961b80aecd1a503eedb885c309a1d5267d89c98c Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 7 Jan 2025 14:27:19 -0800
Subject: [PATCH 0403/2760] tcg: Merge INDEX_op_divu_{i32,i64}
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 docs/devel/tcg-ops.rst   |  2 +-
 include/tcg/tcg-opc.h    |  3 +--
 tcg/optimize.c           |  9 +++++----
 tcg/tcg-op.c             | 16 ++++++++--------
 tcg/tcg.c                |  6 ++----
 tcg/tci.c                |  5 ++---
 tcg/tci/tcg-target.c.inc |  2 +-
 7 files changed, 20 insertions(+), 23 deletions(-)

diff --git a/docs/devel/tcg-ops.rst b/docs/devel/tcg-ops.rst
index a833b3b7b2..41985be012 100644
--- a/docs/devel/tcg-ops.rst
+++ b/docs/devel/tcg-ops.rst
@@ -282,7 +282,7 @@ Arithmetic
      - | *t0* = *t1* / *t2* (signed)
        | Undefined behavior if division by zero or overflow.
 
-   * - divu_i32/i64 *t0*, *t1*, *t2*
+   * - divu *t0*, *t1*, *t2*
 
      - | *t0* = *t1* / *t2* (unsigned)
        | Undefined behavior if division by zero.
diff --git a/include/tcg/tcg-opc.h b/include/tcg/tcg-opc.h
index 6d4edd0b16..243f002a61 100644
--- a/include/tcg/tcg-opc.h
+++ b/include/tcg/tcg-opc.h
@@ -43,6 +43,7 @@ DEF(add, 1, 2, 0, TCG_OPF_INT)
 DEF(and, 1, 2, 0, TCG_OPF_INT)
 DEF(andc, 1, 2, 0, TCG_OPF_INT)
 DEF(divs, 1, 2, 0, TCG_OPF_INT)
+DEF(divu, 1, 2, 0, TCG_OPF_INT)
 DEF(eqv, 1, 2, 0, TCG_OPF_INT)
 DEF(mul, 1, 2, 0, TCG_OPF_INT)
 DEF(mulsh, 1, 2, 0, TCG_OPF_INT)
@@ -69,7 +70,6 @@ DEF(st8_i32, 0, 2, 1, 0)
 DEF(st16_i32, 0, 2, 1, 0)
 DEF(st_i32, 0, 2, 1, 0)
 /* arith */
-DEF(divu_i32, 1, 2, 0, 0)
 DEF(rem_i32, 1, 2, 0, 0)
 DEF(remu_i32, 1, 2, 0, 0)
 DEF(div2_i32, 2, 3, 0, 0)
@@ -116,7 +116,6 @@ DEF(st16_i64, 0, 2, 1, 0)
 DEF(st32_i64, 0, 2, 1, 0)
 DEF(st_i64, 0, 2, 1, 0)
 /* arith */
-DEF(divu_i64, 1, 2, 0, 0)
 DEF(rem_i64, 1, 2, 0, 0)
 DEF(remu_i64, 1, 2, 0, 0)
 DEF(div2_i64, 2, 3, 0, 0)
diff --git a/tcg/optimize.c b/tcg/optimize.c
index af9054be37..c11cce782a 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -563,9 +563,10 @@ static uint64_t do_constant_folding_2(TCGOpcode op, TCGType type,
         }
         return (int64_t)x / ((int64_t)y ? : 1);
 
-    case INDEX_op_divu_i32:
-        return (uint32_t)x / ((uint32_t)y ? : 1);
-    case INDEX_op_divu_i64:
+    case INDEX_op_divu:
+        if (type == TCG_TYPE_I32) {
+            return (uint32_t)x / ((uint32_t)y ? : 1);
+        }
         return (uint64_t)x / ((uint64_t)y ? : 1);
 
     case INDEX_op_rem_i32:
@@ -2908,7 +2909,7 @@ void tcg_optimize(TCGContext *s)
             done = fold_deposit(&ctx, op);
             break;
         case INDEX_op_divs:
-        CASE_OP_32_64(divu):
+        case INDEX_op_divu:
             done = fold_divide(&ctx, op);
             break;
         case INDEX_op_dup_vec:
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index 19be461214..f326c452a4 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -635,8 +635,8 @@ void tcg_gen_rem_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 
 void tcg_gen_divu_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 {
-    if (tcg_op_supported(INDEX_op_divu_i32, TCG_TYPE_I32, 0)) {
-        tcg_gen_op3_i32(INDEX_op_divu_i32, ret, arg1, arg2);
+    if (tcg_op_supported(INDEX_op_divu, TCG_TYPE_I32, 0)) {
+        tcg_gen_op3_i32(INDEX_op_divu, ret, arg1, arg2);
     } else if (TCG_TARGET_HAS_div2_i32) {
         TCGv_i32 t0 = tcg_temp_ebb_new_i32();
         TCGv_i32 zero = tcg_constant_i32(0);
@@ -651,9 +651,9 @@ void tcg_gen_remu_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 {
     if (TCG_TARGET_HAS_rem_i32) {
         tcg_gen_op3_i32(INDEX_op_remu_i32, ret, arg1, arg2);
-    } else if (tcg_op_supported(INDEX_op_divu_i32, TCG_TYPE_I32, 0)) {
+    } else if (tcg_op_supported(INDEX_op_divu, TCG_TYPE_I32, 0)) {
         TCGv_i32 t0 = tcg_temp_ebb_new_i32();
-        tcg_gen_op3_i32(INDEX_op_divu_i32, t0, arg1, arg2);
+        tcg_gen_op3_i32(INDEX_op_divu, t0, arg1, arg2);
         tcg_gen_mul_i32(t0, t0, arg2);
         tcg_gen_sub_i32(ret, arg1, t0);
         tcg_temp_free_i32(t0);
@@ -2003,8 +2003,8 @@ void tcg_gen_rem_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
 
 void tcg_gen_divu_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
 {
-    if (tcg_op_supported(INDEX_op_divu_i64, TCG_TYPE_I64, 0)) {
-        tcg_gen_op3_i64(INDEX_op_divu_i64, ret, arg1, arg2);
+    if (tcg_op_supported(INDEX_op_divu, TCG_TYPE_I64, 0)) {
+        tcg_gen_op3_i64(INDEX_op_divu, ret, arg1, arg2);
     } else if (TCG_TARGET_HAS_div2_i64) {
         TCGv_i64 t0 = tcg_temp_ebb_new_i64();
         TCGv_i64 zero = tcg_constant_i64(0);
@@ -2019,9 +2019,9 @@ void tcg_gen_remu_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
 {
     if (TCG_TARGET_HAS_rem_i64) {
         tcg_gen_op3_i64(INDEX_op_remu_i64, ret, arg1, arg2);
-    } else if (tcg_op_supported(INDEX_op_divu_i64, TCG_TYPE_I64, 0)) {
+    } else if (tcg_op_supported(INDEX_op_divu, TCG_TYPE_I64, 0)) {
         TCGv_i64 t0 = tcg_temp_ebb_new_i64();
-        tcg_gen_op3_i64(INDEX_op_divu_i64, t0, arg1, arg2);
+        tcg_gen_op3_i64(INDEX_op_divu, t0, arg1, arg2);
         tcg_gen_mul_i64(t0, t0, arg2);
         tcg_gen_sub_i64(ret, arg1, t0);
         tcg_temp_free_i64(t0);
diff --git a/tcg/tcg.c b/tcg/tcg.c
index a0e58c07d7..9aa6d40905 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1021,8 +1021,7 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_and, TCGOutOpBinary, outop_and),
     OUTOP(INDEX_op_andc, TCGOutOpBinary, outop_andc),
     OUTOP(INDEX_op_divs, TCGOutOpBinary, outop_divs),
-    OUTOP(INDEX_op_divu_i32, TCGOutOpBinary, outop_divu),
-    OUTOP(INDEX_op_divu_i64, TCGOutOpBinary, outop_divu),
+    OUTOP(INDEX_op_divu, TCGOutOpBinary, outop_divu),
     OUTOP(INDEX_op_eqv, TCGOutOpBinary, outop_eqv),
     OUTOP(INDEX_op_mul, TCGOutOpBinary, outop_mul),
     OUTOP(INDEX_op_mulsh, TCGOutOpBinary, outop_mulsh),
@@ -5415,8 +5414,7 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
     case INDEX_op_and:
     case INDEX_op_andc:
     case INDEX_op_divs:
-    case INDEX_op_divu_i32:
-    case INDEX_op_divu_i64:
+    case INDEX_op_divu:
     case INDEX_op_eqv:
     case INDEX_op_mul:
     case INDEX_op_mulsh:
diff --git a/tcg/tci.c b/tcg/tci.c
index 0691824f97..bf97849bfe 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -724,7 +724,7 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = (int64_t)regs[r1] / (int64_t)regs[r2];
             break;
-        case INDEX_op_divu_i64:
+        case INDEX_op_divu:
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = (uint64_t)regs[r1] / (uint64_t)regs[r2];
             break;
@@ -1072,6 +1072,7 @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
     case INDEX_op_and:
     case INDEX_op_andc:
     case INDEX_op_divs:
+    case INDEX_op_divu:
     case INDEX_op_eqv:
     case INDEX_op_mul:
     case INDEX_op_nand:
@@ -1082,8 +1083,6 @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
     case INDEX_op_xor:
     case INDEX_op_rem_i32:
     case INDEX_op_rem_i64:
-    case INDEX_op_divu_i32:
-    case INDEX_op_divu_i64:
     case INDEX_op_remu_i32:
     case INDEX_op_remu_i64:
     case INDEX_op_shl_i32:
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index 18a10156a6..dfa8aecc7a 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -663,7 +663,7 @@ static void tgen_divu(TCGContext *s, TCGType type,
 {
     TCGOpcode opc = (type == TCG_TYPE_I32
                      ? INDEX_op_tci_divu32
-                     : INDEX_op_divu_i64);
+                     : INDEX_op_divu);
     tcg_out_op_rrr(s, opc, a0, a1, a2);
 }
 

From d6cad9c9278566deb7f646f027c056ba24f7988d Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 7 Jan 2025 16:32:29 -0800
Subject: [PATCH 0404/2760] tcg: Convert div2 to TCGOutOpDivRem
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target.c.inc     |  4 +++
 tcg/arm/tcg-target.c.inc         |  4 +++
 tcg/i386/tcg-target.c.inc        | 17 ++++++++----
 tcg/loongarch64/tcg-target.c.inc |  4 +++
 tcg/mips/tcg-target.c.inc        |  4 +++
 tcg/ppc/tcg-target.c.inc         |  4 +++
 tcg/riscv/tcg-target.c.inc       |  4 +++
 tcg/s390x/tcg-target.c.inc       | 44 ++++++++++++++++----------------
 tcg/sparc64/tcg-target.c.inc     |  4 +++
 tcg/tcg.c                        | 24 +++++++++++++++--
 tcg/tci/tcg-target.c.inc         |  4 +++
 11 files changed, 88 insertions(+), 29 deletions(-)

diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index 167c51c897..ea5766414d 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -2168,6 +2168,10 @@ static const TCGOutOpBinary outop_divs = {
     .out_rrr = tgen_divs,
 };
 
+static const TCGOutOpDivRem outop_divs2 = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static void tgen_divu(TCGContext *s, TCGType type,
                       TCGReg a0, TCGReg a1, TCGReg a2)
 {
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index 65d0ae83b2..ff750e2df8 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -1880,6 +1880,10 @@ static const TCGOutOpBinary outop_divs = {
     .out_rrr = tgen_divs,
 };
 
+static const TCGOutOpDivRem outop_divs2 = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static void tgen_divu(TCGContext *s, TCGType type,
                       TCGReg a0, TCGReg a1, TCGReg a2)
 {
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index f258d6383b..9238e0e8e4 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -2637,6 +2637,18 @@ static const TCGOutOpBinary outop_divs = {
     .base.static_constraint = C_NotImplemented,
 };
 
+static void tgen_divs2(TCGContext *s, TCGType type,
+                       TCGReg a0, TCGReg a1, TCGReg a4)
+{
+    int rexw = type == TCG_TYPE_I32 ? 0 : P_REXW;
+    tcg_out_modrm(s, OPC_GRP3_Ev + rexw, EXT3_IDIV, a4);
+}
+
+static const TCGOutOpDivRem outop_divs2 = {
+    .base.static_constraint = C_O2_I3(a, d, 0, 1, r),
+    .out_rr01r = tgen_divs2,
+};
+
 static const TCGOutOpBinary outop_divu = {
     .base.static_constraint = C_NotImplemented,
 };
@@ -2847,9 +2859,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    OP_32_64(div2):
-        tcg_out_modrm(s, OPC_GRP3_Ev + rexw, EXT3_IDIV, args[4]);
-        break;
     OP_32_64(divu2):
         tcg_out_modrm(s, OPC_GRP3_Ev + rexw, EXT3_DIV, args[4]);
         break;
@@ -3789,8 +3798,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_movcond_i64:
         return C_O1_I4(r, r, reT, r, 0);
 
-    case INDEX_op_div2_i32:
-    case INDEX_op_div2_i64:
     case INDEX_op_divu2_i32:
     case INDEX_op_divu2_i64:
         return C_O2_I3(a, d, 0, 1, r);
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index e82a62d09e..8ec46114b8 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -1343,6 +1343,10 @@ static const TCGOutOpBinary outop_divs = {
     .out_rrr = tgen_divs,
 };
 
+static const TCGOutOpDivRem outop_divs2 = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static void tgen_divu(TCGContext *s, TCGType type,
                       TCGReg a0, TCGReg a1, TCGReg a2)
 {
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index ab9546f104..adbc7ee39d 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -1733,6 +1733,10 @@ static const TCGOutOpBinary outop_divs = {
     .out_rrr = tgen_divs,
 };
 
+static const TCGOutOpDivRem outop_divs2 = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static void tgen_divu(TCGContext *s, TCGType type,
                       TCGReg a0, TCGReg a1, TCGReg a2)
 {
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index b347595131..1eb3e785c0 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -2972,6 +2972,10 @@ static const TCGOutOpBinary outop_divs = {
     .out_rrr = tgen_divs,
 };
 
+static const TCGOutOpDivRem outop_divs2 = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static void tgen_divu(TCGContext *s, TCGType type,
                       TCGReg a0, TCGReg a1, TCGReg a2)
 {
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index 74fa38d273..19c690c1c2 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -2009,6 +2009,10 @@ static const TCGOutOpBinary outop_divs = {
     .out_rrr = tgen_divs,
 };
 
+static const TCGOutOpDivRem outop_divs2 = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static void tgen_divu(TCGContext *s, TCGType type,
                       TCGReg a0, TCGReg a1, TCGReg a2)
 {
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index f55309f48e..b434ce423a 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -2246,6 +2246,28 @@ static const TCGOutOpBinary outop_divs = {
     .base.static_constraint = C_NotImplemented,
 };
 
+static void tgen_divs2(TCGContext *s, TCGType type,
+                       TCGReg a0, TCGReg a1, TCGReg a4)
+{
+    tcg_debug_assert((a1 & 1) == 0);
+    tcg_debug_assert(a0 == a1 + 1);
+    if (type == TCG_TYPE_I32) {
+        tcg_out_insn(s, RR, DR, a1, a4);
+    } else {
+        /*
+         * TODO: Move the sign-extend of the numerator from a2 into a3
+         * into the tcg backend, instead of in early expansion.  It is
+         * required for 32-bit DR, but not 64-bit DSGR.
+         */
+        tcg_out_insn(s, RRE, DSGR, a1, a4);
+    }
+}
+
+static const TCGOutOpDivRem outop_divs2 = {
+    .base.static_constraint = C_O2_I3(o, m, 0, 1, r),
+    .out_rr01r = tgen_divs2,
+};
+
 static const TCGOutOpBinary outop_divu = {
     .base.static_constraint = C_NotImplemented,
 };
@@ -2527,13 +2549,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_st(s, TCG_TYPE_I32, args[0], args[1], args[2]);
         break;
 
-    case INDEX_op_div2_i32:
-        tcg_debug_assert(args[0] == args[2]);
-        tcg_debug_assert(args[1] == args[3]);
-        tcg_debug_assert((args[1] & 1) == 0);
-        tcg_debug_assert(args[0] == args[1] + 1);
-        tcg_out_insn(s, RR, DR, args[1], args[4]);
-        break;
     case INDEX_op_divu2_i32:
         tcg_debug_assert(args[0] == args[2]);
         tcg_debug_assert(args[1] == args[3]);
@@ -2702,19 +2717,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_insn(s, RRE, LRVGR, args[0], args[1]);
         break;
 
-    case INDEX_op_div2_i64:
-        /*
-         * ??? We get an unnecessary sign-extension of the dividend
-         * into op0 with this definition, but as we do in fact always
-         * produce both quotient and remainder using INDEX_op_div_i64
-         * instead requires jumping through even more hoops.
-         */
-        tcg_debug_assert(args[0] == args[2]);
-        tcg_debug_assert(args[1] == args[3]);
-        tcg_debug_assert((args[1] & 1) == 0);
-        tcg_debug_assert(args[0] == args[1] + 1);
-        tcg_out_insn(s, RRE, DSGR, args[1], args[4]);
-        break;
     case INDEX_op_divu2_i64:
         tcg_debug_assert(args[0] == args[2]);
         tcg_debug_assert(args[1] == args[3]);
@@ -3396,8 +3398,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_movcond_i64:
         return C_O1_I4(r, r, rC, rI, r);
 
-    case INDEX_op_div2_i32:
-    case INDEX_op_div2_i64:
     case INDEX_op_divu2_i32:
     case INDEX_op_divu2_i64:
         return C_O2_I3(o, m, 0, 1, r);
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index 3a3372d7aa..472ccd7608 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -1352,6 +1352,10 @@ static const TCGOutOpBinary outop_divs = {
     .out_rri = tgen_divsi,
 };
 
+static const TCGOutOpDivRem outop_divs2 = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static void tgen_divu_rJ(TCGContext *s, TCGType type,
                          TCGReg a0, TCGReg a1, TCGArg a2, bool c2)
 {
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 9aa6d40905..ef3af4157a 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -986,6 +986,12 @@ typedef struct TCGOutOpBinary {
                     TCGReg a0, TCGReg a1, tcg_target_long a2);
 } TCGOutOpBinary;
 
+typedef struct TCGOutOpDivRem {
+    TCGOutOp base;
+    void (*out_rr01r)(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, TCGReg a4);
+} TCGOutOpDivRem;
+
 typedef struct TCGOutOpUnary {
     TCGOutOp base;
     void (*out_rr)(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1);
@@ -1022,6 +1028,8 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_andc, TCGOutOpBinary, outop_andc),
     OUTOP(INDEX_op_divs, TCGOutOpBinary, outop_divs),
     OUTOP(INDEX_op_divu, TCGOutOpBinary, outop_divu),
+    OUTOP(INDEX_op_div2_i32, TCGOutOpDivRem, outop_divs2),
+    OUTOP(INDEX_op_div2_i64, TCGOutOpDivRem, outop_divs2),
     OUTOP(INDEX_op_eqv, TCGOutOpBinary, outop_eqv),
     OUTOP(INDEX_op_mul, TCGOutOpBinary, outop_mul),
     OUTOP(INDEX_op_mulsh, TCGOutOpBinary, outop_mulsh),
@@ -2265,7 +2273,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_rem_i32:
     case INDEX_op_remu_i32:
         return TCG_TARGET_HAS_rem_i32;
-    case INDEX_op_div2_i32:
     case INDEX_op_divu2_i32:
         return TCG_TARGET_HAS_div2_i32;
     case INDEX_op_rotl_i32:
@@ -2325,7 +2332,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_rem_i64:
     case INDEX_op_remu_i64:
         return TCG_TARGET_HAS_rem_i64;
-    case INDEX_op_div2_i64:
     case INDEX_op_divu2_i64:
         return TCG_TARGET_HAS_div2_i64;
     case INDEX_op_rotl_i64:
@@ -5467,6 +5473,20 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
         }
         break;
 
+    case INDEX_op_div2_i32:
+    case INDEX_op_div2_i64:
+        {
+            const TCGOutOpDivRem *out =
+                container_of(all_outop[op->opc], TCGOutOpDivRem, base);
+
+            /* Only used by x86 and s390x, which use matching constraints. */
+            tcg_debug_assert(new_args[0] == new_args[2]);
+            tcg_debug_assert(new_args[1] == new_args[3]);
+            tcg_debug_assert(!const_args[4]);
+            out->out_rr01r(s, type, new_args[0], new_args[1], new_args[4]);
+        }
+        break;
+
     default:
         if (def->flags & TCG_OPF_VECTOR) {
             tcg_out_vec_op(s, op->opc, type - TCG_TYPE_V64,
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index dfa8aecc7a..6646be224d 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -658,6 +658,10 @@ static const TCGOutOpBinary outop_divs = {
     .out_rrr = tgen_divs,
 };
 
+static const TCGOutOpDivRem outop_divs2 = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static void tgen_divu(TCGContext *s, TCGType type,
                       TCGReg a0, TCGReg a1, TCGReg a2)
 {

From ee1805b9e66d6b6229270a339586058bbf275412 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 7 Jan 2025 16:44:23 -0800
Subject: [PATCH 0405/2760] tcg: Merge INDEX_op_div2_{i32,i64}

Rename to INDEX_op_divs2 to emphasize signed inputs,
and mirroring INDEX_op_divu2_*.  Document the opcode.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 docs/devel/tcg-ops.rst |  9 +++++++++
 include/tcg/tcg-opc.h  |  3 +--
 tcg/tcg-op.c           | 16 ++++++++--------
 tcg/tcg.c              |  6 ++----
 4 files changed, 20 insertions(+), 14 deletions(-)

diff --git a/docs/devel/tcg-ops.rst b/docs/devel/tcg-ops.rst
index 41985be012..62af390854 100644
--- a/docs/devel/tcg-ops.rst
+++ b/docs/devel/tcg-ops.rst
@@ -297,6 +297,15 @@ Arithmetic
      - | *t0* = *t1* % *t2* (unsigned)
        | Undefined behavior if division by zero.
 
+   * - divs2 *q*, *r*, *nl*, *nh*, *d*
+
+     - | *q* = *nh:nl* / *d* (signed)
+       | *r* = *nh:nl* % *d*
+       | Undefined behaviour if division by zero, or the double-word
+         numerator divided by the single-word divisor does not fit
+         within the single-word quotient.  The code generator will
+         pass *nh* as a simple sign-extension of *nl*, so the only
+         overflow should be *INT_MIN* / -1.
 
 Logical
 -------
diff --git a/include/tcg/tcg-opc.h b/include/tcg/tcg-opc.h
index 243f002a61..36dfbf80ad 100644
--- a/include/tcg/tcg-opc.h
+++ b/include/tcg/tcg-opc.h
@@ -43,6 +43,7 @@ DEF(add, 1, 2, 0, TCG_OPF_INT)
 DEF(and, 1, 2, 0, TCG_OPF_INT)
 DEF(andc, 1, 2, 0, TCG_OPF_INT)
 DEF(divs, 1, 2, 0, TCG_OPF_INT)
+DEF(divs2, 2, 3, 0, TCG_OPF_INT)
 DEF(divu, 1, 2, 0, TCG_OPF_INT)
 DEF(eqv, 1, 2, 0, TCG_OPF_INT)
 DEF(mul, 1, 2, 0, TCG_OPF_INT)
@@ -72,7 +73,6 @@ DEF(st_i32, 0, 2, 1, 0)
 /* arith */
 DEF(rem_i32, 1, 2, 0, 0)
 DEF(remu_i32, 1, 2, 0, 0)
-DEF(div2_i32, 2, 3, 0, 0)
 DEF(divu2_i32, 2, 3, 0, 0)
 /* shifts/rotates */
 DEF(shl_i32, 1, 2, 0, 0)
@@ -118,7 +118,6 @@ DEF(st_i64, 0, 2, 1, 0)
 /* arith */
 DEF(rem_i64, 1, 2, 0, 0)
 DEF(remu_i64, 1, 2, 0, 0)
-DEF(div2_i64, 2, 3, 0, 0)
 DEF(divu2_i64, 2, 3, 0, 0)
 /* shifts/rotates */
 DEF(shl_i64, 1, 2, 0, 0)
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index f326c452a4..f95beb8b5d 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -603,10 +603,10 @@ void tcg_gen_div_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 {
     if (tcg_op_supported(INDEX_op_divs, TCG_TYPE_I32, 0)) {
         tcg_gen_op3_i32(INDEX_op_divs, ret, arg1, arg2);
-    } else if (TCG_TARGET_HAS_div2_i32) {
+    } else if (tcg_op_supported(INDEX_op_divs2, TCG_TYPE_I32, 0)) {
         TCGv_i32 t0 = tcg_temp_ebb_new_i32();
         tcg_gen_sari_i32(t0, arg1, 31);
-        tcg_gen_op5_i32(INDEX_op_div2_i32, ret, t0, arg1, t0, arg2);
+        tcg_gen_op5_i32(INDEX_op_divs2, ret, t0, arg1, t0, arg2);
         tcg_temp_free_i32(t0);
     } else {
         gen_helper_div_i32(ret, arg1, arg2);
@@ -623,10 +623,10 @@ void tcg_gen_rem_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
         tcg_gen_mul_i32(t0, t0, arg2);
         tcg_gen_sub_i32(ret, arg1, t0);
         tcg_temp_free_i32(t0);
-    } else if (TCG_TARGET_HAS_div2_i32) {
+    } else if (tcg_op_supported(INDEX_op_divs2, TCG_TYPE_I32, 0)) {
         TCGv_i32 t0 = tcg_temp_ebb_new_i32();
         tcg_gen_sari_i32(t0, arg1, 31);
-        tcg_gen_op5_i32(INDEX_op_div2_i32, t0, ret, arg1, t0, arg2);
+        tcg_gen_op5_i32(INDEX_op_divs2, t0, ret, arg1, t0, arg2);
         tcg_temp_free_i32(t0);
     } else {
         gen_helper_rem_i32(ret, arg1, arg2);
@@ -1971,10 +1971,10 @@ void tcg_gen_div_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
 {
     if (tcg_op_supported(INDEX_op_divs, TCG_TYPE_I64, 0)) {
         tcg_gen_op3_i64(INDEX_op_divs, ret, arg1, arg2);
-    } else if (TCG_TARGET_HAS_div2_i64) {
+    } else if (tcg_op_supported(INDEX_op_divs2, TCG_TYPE_I64, 0)) {
         TCGv_i64 t0 = tcg_temp_ebb_new_i64();
         tcg_gen_sari_i64(t0, arg1, 63);
-        tcg_gen_op5_i64(INDEX_op_div2_i64, ret, t0, arg1, t0, arg2);
+        tcg_gen_op5_i64(INDEX_op_divs2, ret, t0, arg1, t0, arg2);
         tcg_temp_free_i64(t0);
     } else {
         gen_helper_div_i64(ret, arg1, arg2);
@@ -1991,10 +1991,10 @@ void tcg_gen_rem_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
         tcg_gen_mul_i64(t0, t0, arg2);
         tcg_gen_sub_i64(ret, arg1, t0);
         tcg_temp_free_i64(t0);
-    } else if (TCG_TARGET_HAS_div2_i64) {
+    } else if (tcg_op_supported(INDEX_op_divs2, TCG_TYPE_I64, 0)) {
         TCGv_i64 t0 = tcg_temp_ebb_new_i64();
         tcg_gen_sari_i64(t0, arg1, 63);
-        tcg_gen_op5_i64(INDEX_op_div2_i64, t0, ret, arg1, t0, arg2);
+        tcg_gen_op5_i64(INDEX_op_divs2, t0, ret, arg1, t0, arg2);
         tcg_temp_free_i64(t0);
     } else {
         gen_helper_rem_i64(ret, arg1, arg2);
diff --git a/tcg/tcg.c b/tcg/tcg.c
index ef3af4157a..30b7f8ee19 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1028,8 +1028,7 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_andc, TCGOutOpBinary, outop_andc),
     OUTOP(INDEX_op_divs, TCGOutOpBinary, outop_divs),
     OUTOP(INDEX_op_divu, TCGOutOpBinary, outop_divu),
-    OUTOP(INDEX_op_div2_i32, TCGOutOpDivRem, outop_divs2),
-    OUTOP(INDEX_op_div2_i64, TCGOutOpDivRem, outop_divs2),
+    OUTOP(INDEX_op_divs2, TCGOutOpDivRem, outop_divs2),
     OUTOP(INDEX_op_eqv, TCGOutOpBinary, outop_eqv),
     OUTOP(INDEX_op_mul, TCGOutOpBinary, outop_mul),
     OUTOP(INDEX_op_mulsh, TCGOutOpBinary, outop_mulsh),
@@ -5473,8 +5472,7 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
         }
         break;
 
-    case INDEX_op_div2_i32:
-    case INDEX_op_div2_i64:
+    case INDEX_op_divs2:
         {
             const TCGOutOpDivRem *out =
                 container_of(all_outop[op->opc], TCGOutOpDivRem, base);

From 9bf558ed17c274b172549894e8e343e6a1a1508c Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 7 Jan 2025 18:10:14 -0800
Subject: [PATCH 0406/2760] tcg: Convert divu2 to TCGOutOpDivRem

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target.c.inc     |  4 ++++
 tcg/arm/tcg-target.c.inc         |  4 ++++
 tcg/i386/tcg-target-has.h        |  2 --
 tcg/i386/tcg-target.c.inc        | 20 +++++++++++-------
 tcg/loongarch64/tcg-target-has.h |  2 --
 tcg/loongarch64/tcg-target.c.inc |  4 ++++
 tcg/mips/tcg-target.c.inc        |  4 ++++
 tcg/ppc/tcg-target.c.inc         |  4 ++++
 tcg/riscv/tcg-target-has.h       |  2 --
 tcg/riscv/tcg-target.c.inc       |  4 ++++
 tcg/s390x/tcg-target-has.h       |  2 --
 tcg/s390x/tcg-target.c.inc       | 36 +++++++++++++++-----------------
 tcg/sparc64/tcg-target.c.inc     |  4 ++++
 tcg/tcg-has.h                    |  7 -------
 tcg/tcg-op.c                     |  8 +++----
 tcg/tcg.c                        |  8 +++----
 tcg/tci/tcg-target.c.inc         |  4 ++++
 17 files changed, 69 insertions(+), 50 deletions(-)

diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index ea5766414d..456159cdc6 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -2183,6 +2183,10 @@ static const TCGOutOpBinary outop_divu = {
     .out_rrr = tgen_divu,
 };
 
+static const TCGOutOpDivRem outop_divu2 = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static void tgen_eqv(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index ff750e2df8..b2c08bba3e 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -1897,6 +1897,10 @@ static const TCGOutOpBinary outop_divu = {
     .out_rrr = tgen_divu,
 };
 
+static const TCGOutOpDivRem outop_divu2 = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static const TCGOutOpBinary outop_eqv = {
     .base.static_constraint = C_NotImplemented,
 };
diff --git a/tcg/i386/tcg-target-has.h b/tcg/i386/tcg-target-has.h
index 121fb95ee0..aee6066579 100644
--- a/tcg/i386/tcg-target-has.h
+++ b/tcg/i386/tcg-target-has.h
@@ -26,7 +26,6 @@
 #define have_avx512vbmi2  ((cpuinfo & CPUINFO_AVX512VBMI2) && have_avx512vl)
 
 /* optional instructions */
-#define TCG_TARGET_HAS_div2_i32         1
 #define TCG_TARGET_HAS_rot_i32          1
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
@@ -43,7 +42,6 @@
 #if TCG_TARGET_REG_BITS == 64
 /* Keep 32-bit values zero-extended in a register.  */
 #define TCG_TARGET_HAS_extr_i64_i32     1
-#define TCG_TARGET_HAS_div2_i64         1
 #define TCG_TARGET_HAS_rot_i64          1
 #define TCG_TARGET_HAS_bswap16_i64      1
 #define TCG_TARGET_HAS_bswap32_i64      1
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index 9238e0e8e4..0e6b743fb2 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -2653,6 +2653,18 @@ static const TCGOutOpBinary outop_divu = {
     .base.static_constraint = C_NotImplemented,
 };
 
+static void tgen_divu2(TCGContext *s, TCGType type,
+                       TCGReg a0, TCGReg a1, TCGReg a4)
+{
+    int rexw = type == TCG_TYPE_I32 ? 0 : P_REXW;
+    tcg_out_modrm(s, OPC_GRP3_Ev + rexw, EXT3_DIV, a4);
+}
+
+static const TCGOutOpDivRem outop_divu2 = {
+    .base.static_constraint = C_O2_I3(a, d, 0, 1, r),
+    .out_rr01r = tgen_divu2,
+};
+
 static const TCGOutOpBinary outop_eqv = {
     .base.static_constraint = C_NotImplemented,
 };
@@ -2859,10 +2871,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    OP_32_64(divu2):
-        tcg_out_modrm(s, OPC_GRP3_Ev + rexw, EXT3_DIV, args[4]);
-        break;
-
     OP_32_64(shl):
         /* For small constant 3-operand shift, use LEA.  */
         if (const_a2 && a0 != a1 && (a2 - 1) < 3) {
@@ -3798,10 +3806,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_movcond_i64:
         return C_O1_I4(r, r, reT, r, 0);
 
-    case INDEX_op_divu2_i32:
-    case INDEX_op_divu2_i64:
-        return C_O2_I3(a, d, 0, 1, r);
-
     case INDEX_op_mulu2_i32:
     case INDEX_op_mulu2_i64:
     case INDEX_op_muls2_i32:
diff --git a/tcg/loongarch64/tcg-target-has.h b/tcg/loongarch64/tcg-target-has.h
index 96a99b6d4c..aecd2879b8 100644
--- a/tcg/loongarch64/tcg-target-has.h
+++ b/tcg/loongarch64/tcg-target-has.h
@@ -12,7 +12,6 @@
 /* optional instructions */
 #define TCG_TARGET_HAS_negsetcond_i32   0
 #define TCG_TARGET_HAS_rem_i32          1
-#define TCG_TARGET_HAS_div2_i32         0
 #define TCG_TARGET_HAS_rot_i32          1
 #define TCG_TARGET_HAS_extract2_i32     0
 #define TCG_TARGET_HAS_add2_i32         0
@@ -29,7 +28,6 @@
 /* 64-bit operations */
 #define TCG_TARGET_HAS_negsetcond_i64   0
 #define TCG_TARGET_HAS_rem_i64          1
-#define TCG_TARGET_HAS_div2_i64         0
 #define TCG_TARGET_HAS_rot_i64          1
 #define TCG_TARGET_HAS_extract2_i64     0
 #define TCG_TARGET_HAS_extr_i64_i32     1
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index 8ec46114b8..be09c362cb 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -1362,6 +1362,10 @@ static const TCGOutOpBinary outop_divu = {
     .out_rrr = tgen_divu,
 };
 
+static const TCGOutOpDivRem outop_divu2 = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static const TCGOutOpBinary outop_eqv = {
     .base.static_constraint = C_NotImplemented,
 };
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index adbc7ee39d..280afbf297 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -1758,6 +1758,10 @@ static const TCGOutOpBinary outop_divu = {
     .out_rrr = tgen_divu,
 };
 
+static const TCGOutOpDivRem outop_divu2 = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static const TCGOutOpBinary outop_eqv = {
     .base.static_constraint = C_NotImplemented,
 };
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index 1eb3e785c0..8b14d57d1c 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -2988,6 +2988,10 @@ static const TCGOutOpBinary outop_divu = {
     .out_rrr = tgen_divu,
 };
 
+static const TCGOutOpDivRem outop_divu2 = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static const TCGOutOpBinary outop_eqv = {
     .base.static_constraint = C_O1_I2(r, r, r),
     .out_rrr = tgen_eqv,
diff --git a/tcg/riscv/tcg-target-has.h b/tcg/riscv/tcg-target-has.h
index ae6624b9a4..e5861e5260 100644
--- a/tcg/riscv/tcg-target-has.h
+++ b/tcg/riscv/tcg-target-has.h
@@ -12,7 +12,6 @@
 /* optional instructions */
 #define TCG_TARGET_HAS_negsetcond_i32   1
 #define TCG_TARGET_HAS_rem_i32          1
-#define TCG_TARGET_HAS_div2_i32         0
 #define TCG_TARGET_HAS_rot_i32          (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_extract2_i32     0
 #define TCG_TARGET_HAS_add2_i32         1
@@ -28,7 +27,6 @@
 
 #define TCG_TARGET_HAS_negsetcond_i64   1
 #define TCG_TARGET_HAS_rem_i64          1
-#define TCG_TARGET_HAS_div2_i64         0
 #define TCG_TARGET_HAS_rot_i64          (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_extract2_i64     0
 #define TCG_TARGET_HAS_extr_i64_i32     1
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index 19c690c1c2..72910b0f25 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -2025,6 +2025,10 @@ static const TCGOutOpBinary outop_divu = {
     .out_rrr = tgen_divu,
 };
 
+static const TCGOutOpDivRem outop_divu2 = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static void tgen_eqv(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
diff --git a/tcg/s390x/tcg-target-has.h b/tcg/s390x/tcg-target-has.h
index 64f1805641..d61cc7a144 100644
--- a/tcg/s390x/tcg-target-has.h
+++ b/tcg/s390x/tcg-target-has.h
@@ -29,7 +29,6 @@ extern uint64_t s390_facilities[3];
     ((s390_facilities[FACILITY_##X / 64] >> (63 - FACILITY_##X % 64)) & 1)
 
 /* optional instructions */
-#define TCG_TARGET_HAS_div2_i32       1
 #define TCG_TARGET_HAS_rot_i32        1
 #define TCG_TARGET_HAS_bswap16_i32    1
 #define TCG_TARGET_HAS_bswap32_i32    1
@@ -45,7 +44,6 @@ extern uint64_t s390_facilities[3];
 #define TCG_TARGET_HAS_extr_i64_i32   0
 #define TCG_TARGET_HAS_qemu_st8_i32   0
 
-#define TCG_TARGET_HAS_div2_i64       1
 #define TCG_TARGET_HAS_rot_i64        1
 #define TCG_TARGET_HAS_bswap16_i64    1
 #define TCG_TARGET_HAS_bswap32_i64    1
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index b434ce423a..9af626eec2 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -2272,6 +2272,23 @@ static const TCGOutOpBinary outop_divu = {
     .base.static_constraint = C_NotImplemented,
 };
 
+static void tgen_divu2(TCGContext *s, TCGType type,
+                       TCGReg a0, TCGReg a1, TCGReg a4)
+{
+    tcg_debug_assert((a1 & 1) == 0);
+    tcg_debug_assert(a0 == a1 + 1);
+    if (type == TCG_TYPE_I32) {
+        tcg_out_insn(s, RRE, DLR, a1, a4);
+    } else {
+        tcg_out_insn(s, RRE, DLGR, a1, a4);
+    }
+}
+
+static const TCGOutOpDivRem outop_divu2 = {
+    .base.static_constraint = C_O2_I3(o, m, 0, 1, r),
+    .out_rr01r = tgen_divu2,
+};
+
 static void tgen_eqv(TCGContext *s, TCGType type,
                       TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -2549,14 +2566,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_st(s, TCG_TYPE_I32, args[0], args[1], args[2]);
         break;
 
-    case INDEX_op_divu2_i32:
-        tcg_debug_assert(args[0] == args[2]);
-        tcg_debug_assert(args[1] == args[3]);
-        tcg_debug_assert((args[1] & 1) == 0);
-        tcg_debug_assert(args[0] == args[1] + 1);
-        tcg_out_insn(s, RRE, DLR, args[1], args[4]);
-        break;
-
     case INDEX_op_shl_i32:
         op = RS_SLL;
         op2 = RSY_SLLK;
@@ -2717,13 +2726,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_insn(s, RRE, LRVGR, args[0], args[1]);
         break;
 
-    case INDEX_op_divu2_i64:
-        tcg_debug_assert(args[0] == args[2]);
-        tcg_debug_assert(args[1] == args[3]);
-        tcg_debug_assert((args[1] & 1) == 0);
-        tcg_debug_assert(args[0] == args[1] + 1);
-        tcg_out_insn(s, RRE, DLGR, args[1], args[4]);
-        break;
     case INDEX_op_mulu2_i64:
         tcg_debug_assert(args[0] == args[2]);
         tcg_debug_assert((args[1] & 1) == 0);
@@ -3398,10 +3400,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_movcond_i64:
         return C_O1_I4(r, r, rC, rI, r);
 
-    case INDEX_op_divu2_i32:
-    case INDEX_op_divu2_i64:
-        return C_O2_I3(o, m, 0, 1, r);
-
     case INDEX_op_mulu2_i64:
         return C_O2_I2(o, m, 0, r);
     case INDEX_op_muls2_i64:
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index 472ccd7608..a4659653b3 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -1389,6 +1389,10 @@ static const TCGOutOpBinary outop_divu = {
     .out_rri = tgen_divui,
 };
 
+static const TCGOutOpDivRem outop_divu2 = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static const TCGOutOpBinary outop_eqv = {
     .base.static_constraint = C_NotImplemented,
 };
diff --git a/tcg/tcg-has.h b/tcg/tcg-has.h
index 9680ccfc53..bae9918024 100644
--- a/tcg/tcg-has.h
+++ b/tcg/tcg-has.h
@@ -14,7 +14,6 @@
 #define TCG_TARGET_HAS_extr_i64_i32     0
 #define TCG_TARGET_HAS_div_i64          0
 #define TCG_TARGET_HAS_rem_i64          0
-#define TCG_TARGET_HAS_div2_i64         0
 #define TCG_TARGET_HAS_rot_i64          0
 #define TCG_TARGET_HAS_bswap16_i64      0
 #define TCG_TARGET_HAS_bswap32_i64      0
@@ -33,12 +32,6 @@
 #define TCG_TARGET_HAS_sub2_i32         1
 #endif
 
-#ifndef TCG_TARGET_HAS_div2_i32
-#define TCG_TARGET_HAS_div2_i32         0
-#endif
-#ifndef TCG_TARGET_HAS_div2_i64
-#define TCG_TARGET_HAS_div2_i64         0
-#endif
 #ifndef TCG_TARGET_HAS_rem_i32
 #define TCG_TARGET_HAS_rem_i32          0
 #endif
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index f95beb8b5d..5511106554 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -637,7 +637,7 @@ void tcg_gen_divu_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 {
     if (tcg_op_supported(INDEX_op_divu, TCG_TYPE_I32, 0)) {
         tcg_gen_op3_i32(INDEX_op_divu, ret, arg1, arg2);
-    } else if (TCG_TARGET_HAS_div2_i32) {
+    } else if (tcg_op_supported(INDEX_op_divu2_i32, TCG_TYPE_I32, 0)) {
         TCGv_i32 t0 = tcg_temp_ebb_new_i32();
         TCGv_i32 zero = tcg_constant_i32(0);
         tcg_gen_op5_i32(INDEX_op_divu2_i32, ret, t0, arg1, zero, arg2);
@@ -657,7 +657,7 @@ void tcg_gen_remu_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
         tcg_gen_mul_i32(t0, t0, arg2);
         tcg_gen_sub_i32(ret, arg1, t0);
         tcg_temp_free_i32(t0);
-    } else if (TCG_TARGET_HAS_div2_i32) {
+    } else if (tcg_op_supported(INDEX_op_divu2_i32, TCG_TYPE_I32, 0)) {
         TCGv_i32 t0 = tcg_temp_ebb_new_i32();
         TCGv_i32 zero = tcg_constant_i32(0);
         tcg_gen_op5_i32(INDEX_op_divu2_i32, t0, ret, arg1, zero, arg2);
@@ -2005,7 +2005,7 @@ void tcg_gen_divu_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
 {
     if (tcg_op_supported(INDEX_op_divu, TCG_TYPE_I64, 0)) {
         tcg_gen_op3_i64(INDEX_op_divu, ret, arg1, arg2);
-    } else if (TCG_TARGET_HAS_div2_i64) {
+    } else if (tcg_op_supported(INDEX_op_divu2_i64, TCG_TYPE_I64, 0)) {
         TCGv_i64 t0 = tcg_temp_ebb_new_i64();
         TCGv_i64 zero = tcg_constant_i64(0);
         tcg_gen_op5_i64(INDEX_op_divu2_i64, ret, t0, arg1, zero, arg2);
@@ -2025,7 +2025,7 @@ void tcg_gen_remu_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
         tcg_gen_mul_i64(t0, t0, arg2);
         tcg_gen_sub_i64(ret, arg1, t0);
         tcg_temp_free_i64(t0);
-    } else if (TCG_TARGET_HAS_div2_i64) {
+    } else if (tcg_op_supported(INDEX_op_divu2_i64, TCG_TYPE_I64, 0)) {
         TCGv_i64 t0 = tcg_temp_ebb_new_i64();
         TCGv_i64 zero = tcg_constant_i64(0);
         tcg_gen_op5_i64(INDEX_op_divu2_i64, t0, ret, arg1, zero, arg2);
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 30b7f8ee19..1029cba3f0 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1029,6 +1029,8 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_divs, TCGOutOpBinary, outop_divs),
     OUTOP(INDEX_op_divu, TCGOutOpBinary, outop_divu),
     OUTOP(INDEX_op_divs2, TCGOutOpDivRem, outop_divs2),
+    OUTOP(INDEX_op_divu2_i32, TCGOutOpDivRem, outop_divu2),
+    OUTOP(INDEX_op_divu2_i64, TCGOutOpDivRem, outop_divu2),
     OUTOP(INDEX_op_eqv, TCGOutOpBinary, outop_eqv),
     OUTOP(INDEX_op_mul, TCGOutOpBinary, outop_mul),
     OUTOP(INDEX_op_mulsh, TCGOutOpBinary, outop_mulsh),
@@ -2272,8 +2274,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_rem_i32:
     case INDEX_op_remu_i32:
         return TCG_TARGET_HAS_rem_i32;
-    case INDEX_op_divu2_i32:
-        return TCG_TARGET_HAS_div2_i32;
     case INDEX_op_rotl_i32:
     case INDEX_op_rotr_i32:
         return TCG_TARGET_HAS_rot_i32;
@@ -2331,8 +2331,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_rem_i64:
     case INDEX_op_remu_i64:
         return TCG_TARGET_HAS_rem_i64;
-    case INDEX_op_divu2_i64:
-        return TCG_TARGET_HAS_div2_i64;
     case INDEX_op_rotl_i64:
     case INDEX_op_rotr_i64:
         return TCG_TARGET_HAS_rot_i64;
@@ -5473,6 +5471,8 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
         break;
 
     case INDEX_op_divs2:
+    case INDEX_op_divu2_i32:
+    case INDEX_op_divu2_i64:
         {
             const TCGOutOpDivRem *out =
                 container_of(all_outop[op->opc], TCGOutOpDivRem, base);
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index 6646be224d..27271c178c 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -676,6 +676,10 @@ static const TCGOutOpBinary outop_divu = {
     .out_rrr = tgen_divu,
 };
 
+static const TCGOutOpDivRem outop_divu2 = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static void tgen_eqv(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {

From 8109598b683ad2b6b02cd9c79dc15b7fc0b685aa Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 7 Jan 2025 18:23:17 -0800
Subject: [PATCH 0407/2760] tcg: Merge INDEX_op_divu2_{i32,i64}
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 docs/devel/tcg-ops.rst | 10 ++++++++++
 include/tcg/tcg-opc.h  |  3 +--
 tcg/tcg-op.c           | 16 ++++++++--------
 tcg/tcg.c              |  6 ++----
 4 files changed, 21 insertions(+), 14 deletions(-)

diff --git a/docs/devel/tcg-ops.rst b/docs/devel/tcg-ops.rst
index 62af390854..8f3b5e91b2 100644
--- a/docs/devel/tcg-ops.rst
+++ b/docs/devel/tcg-ops.rst
@@ -307,6 +307,16 @@ Arithmetic
          pass *nh* as a simple sign-extension of *nl*, so the only
          overflow should be *INT_MIN* / -1.
 
+   * - divu2 *q*, *r*, *nl*, *nh*, *d*
+
+     - | *q* = *nh:nl* / *d* (unsigned)
+       | *r* = *nh:nl* % *d*
+       | Undefined behaviour if division by zero, or the double-word
+         numerator divided by the single-word divisor does not fit
+         within the single-word quotient.  The code generator will
+         pass 0 to *nh* to make a simple zero-extension of *nl*,
+         so overflow should never occur.
+
 Logical
 -------
 
diff --git a/include/tcg/tcg-opc.h b/include/tcg/tcg-opc.h
index 36dfbf80ad..61e5e185cc 100644
--- a/include/tcg/tcg-opc.h
+++ b/include/tcg/tcg-opc.h
@@ -45,6 +45,7 @@ DEF(andc, 1, 2, 0, TCG_OPF_INT)
 DEF(divs, 1, 2, 0, TCG_OPF_INT)
 DEF(divs2, 2, 3, 0, TCG_OPF_INT)
 DEF(divu, 1, 2, 0, TCG_OPF_INT)
+DEF(divu2, 2, 3, 0, TCG_OPF_INT)
 DEF(eqv, 1, 2, 0, TCG_OPF_INT)
 DEF(mul, 1, 2, 0, TCG_OPF_INT)
 DEF(mulsh, 1, 2, 0, TCG_OPF_INT)
@@ -73,7 +74,6 @@ DEF(st_i32, 0, 2, 1, 0)
 /* arith */
 DEF(rem_i32, 1, 2, 0, 0)
 DEF(remu_i32, 1, 2, 0, 0)
-DEF(divu2_i32, 2, 3, 0, 0)
 /* shifts/rotates */
 DEF(shl_i32, 1, 2, 0, 0)
 DEF(shr_i32, 1, 2, 0, 0)
@@ -118,7 +118,6 @@ DEF(st_i64, 0, 2, 1, 0)
 /* arith */
 DEF(rem_i64, 1, 2, 0, 0)
 DEF(remu_i64, 1, 2, 0, 0)
-DEF(divu2_i64, 2, 3, 0, 0)
 /* shifts/rotates */
 DEF(shl_i64, 1, 2, 0, 0)
 DEF(shr_i64, 1, 2, 0, 0)
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index 5511106554..7ed92157de 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -637,10 +637,10 @@ void tcg_gen_divu_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 {
     if (tcg_op_supported(INDEX_op_divu, TCG_TYPE_I32, 0)) {
         tcg_gen_op3_i32(INDEX_op_divu, ret, arg1, arg2);
-    } else if (tcg_op_supported(INDEX_op_divu2_i32, TCG_TYPE_I32, 0)) {
+    } else if (tcg_op_supported(INDEX_op_divu2, TCG_TYPE_I32, 0)) {
         TCGv_i32 t0 = tcg_temp_ebb_new_i32();
         TCGv_i32 zero = tcg_constant_i32(0);
-        tcg_gen_op5_i32(INDEX_op_divu2_i32, ret, t0, arg1, zero, arg2);
+        tcg_gen_op5_i32(INDEX_op_divu2, ret, t0, arg1, zero, arg2);
         tcg_temp_free_i32(t0);
     } else {
         gen_helper_divu_i32(ret, arg1, arg2);
@@ -657,10 +657,10 @@ void tcg_gen_remu_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
         tcg_gen_mul_i32(t0, t0, arg2);
         tcg_gen_sub_i32(ret, arg1, t0);
         tcg_temp_free_i32(t0);
-    } else if (tcg_op_supported(INDEX_op_divu2_i32, TCG_TYPE_I32, 0)) {
+    } else if (tcg_op_supported(INDEX_op_divu2, TCG_TYPE_I32, 0)) {
         TCGv_i32 t0 = tcg_temp_ebb_new_i32();
         TCGv_i32 zero = tcg_constant_i32(0);
-        tcg_gen_op5_i32(INDEX_op_divu2_i32, t0, ret, arg1, zero, arg2);
+        tcg_gen_op5_i32(INDEX_op_divu2, t0, ret, arg1, zero, arg2);
         tcg_temp_free_i32(t0);
     } else {
         gen_helper_remu_i32(ret, arg1, arg2);
@@ -2005,10 +2005,10 @@ void tcg_gen_divu_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
 {
     if (tcg_op_supported(INDEX_op_divu, TCG_TYPE_I64, 0)) {
         tcg_gen_op3_i64(INDEX_op_divu, ret, arg1, arg2);
-    } else if (tcg_op_supported(INDEX_op_divu2_i64, TCG_TYPE_I64, 0)) {
+    } else if (tcg_op_supported(INDEX_op_divu2, TCG_TYPE_I64, 0)) {
         TCGv_i64 t0 = tcg_temp_ebb_new_i64();
         TCGv_i64 zero = tcg_constant_i64(0);
-        tcg_gen_op5_i64(INDEX_op_divu2_i64, ret, t0, arg1, zero, arg2);
+        tcg_gen_op5_i64(INDEX_op_divu2, ret, t0, arg1, zero, arg2);
         tcg_temp_free_i64(t0);
     } else {
         gen_helper_divu_i64(ret, arg1, arg2);
@@ -2025,10 +2025,10 @@ void tcg_gen_remu_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
         tcg_gen_mul_i64(t0, t0, arg2);
         tcg_gen_sub_i64(ret, arg1, t0);
         tcg_temp_free_i64(t0);
-    } else if (tcg_op_supported(INDEX_op_divu2_i64, TCG_TYPE_I64, 0)) {
+    } else if (tcg_op_supported(INDEX_op_divu2, TCG_TYPE_I64, 0)) {
         TCGv_i64 t0 = tcg_temp_ebb_new_i64();
         TCGv_i64 zero = tcg_constant_i64(0);
-        tcg_gen_op5_i64(INDEX_op_divu2_i64, t0, ret, arg1, zero, arg2);
+        tcg_gen_op5_i64(INDEX_op_divu2, t0, ret, arg1, zero, arg2);
         tcg_temp_free_i64(t0);
     } else {
         gen_helper_remu_i64(ret, arg1, arg2);
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 1029cba3f0..2c1307e3fc 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1029,8 +1029,7 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_divs, TCGOutOpBinary, outop_divs),
     OUTOP(INDEX_op_divu, TCGOutOpBinary, outop_divu),
     OUTOP(INDEX_op_divs2, TCGOutOpDivRem, outop_divs2),
-    OUTOP(INDEX_op_divu2_i32, TCGOutOpDivRem, outop_divu2),
-    OUTOP(INDEX_op_divu2_i64, TCGOutOpDivRem, outop_divu2),
+    OUTOP(INDEX_op_divu2, TCGOutOpDivRem, outop_divu2),
     OUTOP(INDEX_op_eqv, TCGOutOpBinary, outop_eqv),
     OUTOP(INDEX_op_mul, TCGOutOpBinary, outop_mul),
     OUTOP(INDEX_op_mulsh, TCGOutOpBinary, outop_mulsh),
@@ -5471,8 +5470,7 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
         break;
 
     case INDEX_op_divs2:
-    case INDEX_op_divu2_i32:
-    case INDEX_op_divu2_i64:
+    case INDEX_op_divu2:
         {
             const TCGOutOpDivRem *out =
                 container_of(all_outop[op->opc], TCGOutOpDivRem, base);

From 646f36fead167e924e83d23d0e1dc59c37b5cca5 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 7 Jan 2025 18:52:30 -0800
Subject: [PATCH 0408/2760] tcg: Convert rem to TCGOutOpBinary

For TCI, we're losing type information in the interpreter.
Introduce a tci-specific opcode to handle the difference.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target.c.inc     | 19 ++++++++++------
 tcg/arm/tcg-target.c.inc         |  4 ++++
 tcg/i386/tcg-target.c.inc        |  4 ++++
 tcg/loongarch64/tcg-target.c.inc | 24 +++++++++++++--------
 tcg/mips/tcg-target.c.inc        | 37 ++++++++++++++++++--------------
 tcg/ppc/tcg-target.c.inc         | 27 +++++++++++++++--------
 tcg/riscv/tcg-target.c.inc       | 21 ++++++++++--------
 tcg/s390x/tcg-target.c.inc       |  4 ++++
 tcg/sparc64/tcg-target.c.inc     |  4 ++++
 tcg/tcg.c                        |  6 ++++--
 tcg/tci.c                        |  4 ++--
 tcg/tci/tcg-target-opc.h.inc     |  1 +
 tcg/tci/tcg-target.c.inc         | 17 ++++++++++++---
 13 files changed, 115 insertions(+), 57 deletions(-)

diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index 456159cdc6..6e80e18a6a 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -2275,6 +2275,18 @@ static const TCGOutOpBinary outop_orc = {
     .out_rrr = tgen_orc,
 };
 
+static void tgen_rems(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_insn(s, 3508, SDIV, type, TCG_REG_TMP0, a1, a2);
+    tcg_out_insn(s, 3509, MSUB, type, a0, TCG_REG_TMP0, a2, a1);
+}
+
+static const TCGOutOpBinary outop_rems = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_rems,
+};
+
 static void tgen_sub(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -2392,11 +2404,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType ext,
         tcg_out_ldst(s, I3312_STRX, a0, a1, a2, 3);
         break;
 
-    case INDEX_op_rem_i64:
-    case INDEX_op_rem_i32:
-        tcg_out_insn(s, 3508, SDIV, ext, TCG_REG_TMP0, a1, a2);
-        tcg_out_insn(s, 3509, MSUB, ext, a0, TCG_REG_TMP0, a2, a1);
-        break;
     case INDEX_op_remu_i64:
     case INDEX_op_remu_i32:
         tcg_out_insn(s, 3508, UDIV, ext, TCG_REG_TMP0, a1, a2);
@@ -3078,8 +3085,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_negsetcond_i64:
         return C_O1_I2(r, r, rC);
 
-    case INDEX_op_rem_i32:
-    case INDEX_op_rem_i64:
     case INDEX_op_remu_i32:
     case INDEX_op_remu_i64:
         return C_O1_I2(r, r, r);
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index b2c08bba3e..673c8fb7a6 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -1955,6 +1955,10 @@ static const TCGOutOpBinary outop_orc = {
     .base.static_constraint = C_NotImplemented,
 };
 
+static const TCGOutOpBinary outop_rems = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static void tgen_sub(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index 0e6b743fb2..ac0721d71c 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -2736,6 +2736,10 @@ static const TCGOutOpBinary outop_orc = {
     .base.static_constraint = C_NotImplemented,
 };
 
+static const TCGOutOpBinary outop_rems = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static void tgen_sub(TCGContext *s, TCGType type,
                       TCGReg a0, TCGReg a1, TCGReg a2)
 {
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index be09c362cb..ef37b4daa7 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -1459,6 +1459,21 @@ static const TCGOutOpBinary outop_orc = {
     .out_rrr = tgen_orc,
 };
 
+static void tgen_rems(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    if (type == TCG_TYPE_I32) {
+        tcg_out_opc_mod_w(s, a0, a1, a2);
+    } else {
+        tcg_out_opc_mod_d(s, a0, a1, a2);
+    }
+}
+
+static const TCGOutOpBinary outop_rems = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_rems,
+};
+
 static void tgen_sub(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -1709,13 +1724,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    case INDEX_op_rem_i32:
-        tcg_out_opc_mod_w(s, a0, a1, a2);
-        break;
-    case INDEX_op_rem_i64:
-        tcg_out_opc_mod_d(s, a0, a1, a2);
-        break;
-
     case INDEX_op_remu_i32:
         tcg_out_opc_mod_wu(s, a0, a1, a2);
         break;
@@ -2381,8 +2389,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_setcond_i64:
         return C_O1_I2(r, rz, rJ);
 
-    case INDEX_op_rem_i32:
-    case INDEX_op_rem_i64:
     case INDEX_op_remu_i32:
     case INDEX_op_remu_i64:
         return C_O1_I2(r, rz, rz);
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index 280afbf297..37b878ec61 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -1866,6 +1866,27 @@ static const TCGOutOpBinary outop_orc = {
     .base.static_constraint = C_NotImplemented,
 };
 
+static void tgen_rems(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    if (use_mips32r6_instructions) {
+        if (type == TCG_TYPE_I32) {
+            tcg_out_opc_reg(s, OPC_MOD, a0, a1, a2);
+        } else {
+            tcg_out_opc_reg(s, OPC_DMOD, a0, a1, a2);
+        }
+    } else {
+        MIPSInsn insn = type == TCG_TYPE_I32 ? OPC_DIV : OPC_DDIV;
+        tcg_out_opc_reg(s, insn, 0, a1, a2);
+        tcg_out_opc_reg(s, OPC_MFHI, a0, 0, 0);
+    }
+}
+
+static const TCGOutOpBinary outop_rems = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_rems,
+};
+
 static void tgen_sub(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -1989,13 +2010,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_ldst(s, i1, a0, a1, a2);
         break;
 
-    case INDEX_op_rem_i32:
-        if (use_mips32r6_instructions) {
-            tcg_out_opc_reg(s, OPC_MOD, a0, a1, a2);
-            break;
-        }
-        i1 = OPC_DIV, i2 = OPC_MFHI;
-        goto do_hilo1;
     case INDEX_op_remu_i32:
         if (use_mips32r6_instructions) {
             tcg_out_opc_reg(s, OPC_MODU, a0, a1, a2);
@@ -2003,13 +2017,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         i1 = OPC_DIVU, i2 = OPC_MFHI;
         goto do_hilo1;
-    case INDEX_op_rem_i64:
-        if (use_mips32r6_instructions) {
-            tcg_out_opc_reg(s, OPC_DMOD, a0, a1, a2);
-            break;
-        }
-        i1 = OPC_DDIV, i2 = OPC_MFHI;
-        goto do_hilo1;
     case INDEX_op_remu_i64:
         if (use_mips32r6_instructions) {
             tcg_out_opc_reg(s, OPC_DMODU, a0, a1, a2);
@@ -2275,10 +2282,8 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(rz, r);
 
-    case INDEX_op_rem_i32:
     case INDEX_op_remu_i32:
     case INDEX_op_setcond_i32:
-    case INDEX_op_rem_i64:
     case INDEX_op_remu_i64:
     case INDEX_op_setcond_i64:
         return C_O1_I2(r, rz, rz);
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index 8b14d57d1c..c331f0d672 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -3091,6 +3091,24 @@ static const TCGOutOpBinary outop_orc = {
     .out_rrr = tgen_orc,
 };
 
+static TCGConstraintSetIndex cset_mod(TCGType type, unsigned flags)
+{
+    return have_isa_3_00 ? C_O1_I2(r, r, r) : C_NotImplemented;
+}
+
+static void tgen_rems(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    uint32_t insn = type == TCG_TYPE_I32 ? MODSW : MODSD;
+    tcg_out32(s, insn | TAB(a0, a1, a2));
+}
+
+static const TCGOutOpBinary outop_rems = {
+    .base.static_constraint = C_Dynamic,
+    .base.dynamic_constraint = cset_mod,
+    .out_rrr = tgen_rems,
+};
+
 static void tgen_sub(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -3241,10 +3259,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out32(s, CNTPOPD | SAB(args[1], args[0], 0));
         break;
 
-    case INDEX_op_rem_i32:
-        tcg_out32(s, MODSW | TAB(args[0], args[1], args[2]));
-        break;
-
     case INDEX_op_remu_i32:
         tcg_out32(s, MODUW | TAB(args[0], args[1], args[2]));
         break;
@@ -3341,9 +3355,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    case INDEX_op_rem_i64:
-        tcg_out32(s, MODSD | TAB(args[0], args[1], args[2]));
-        break;
     case INDEX_op_remu_i64:
         tcg_out32(s, MODUD | TAB(args[0], args[1], args[2]));
         break;
@@ -4202,9 +4213,7 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_rotr_i64:
         return C_O1_I2(r, r, ri);
 
-    case INDEX_op_rem_i32:
     case INDEX_op_remu_i32:
-    case INDEX_op_rem_i64:
     case INDEX_op_remu_i64:
         return C_O1_I2(r, r, r);
 
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index 72910b0f25..b0a98273f1 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -2120,6 +2120,18 @@ static const TCGOutOpBinary outop_orc = {
     .out_rrr = tgen_orc,
 };
 
+static void tgen_rems(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    RISCVInsn insn = type == TCG_TYPE_I32 ? OPC_REMW : OPC_REM;
+    tcg_out_opc_reg(s, insn, a0, a1, a2);
+}
+
+static const TCGOutOpBinary outop_rems = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_rems,
+};
+
 static void tgen_sub(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -2233,13 +2245,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_ldst(s, OPC_SD, a0, a1, a2);
         break;
 
-    case INDEX_op_rem_i32:
-        tcg_out_opc_reg(s, OPC_REMW, a0, a1, a2);
-        break;
-    case INDEX_op_rem_i64:
-        tcg_out_opc_reg(s, OPC_REM, a0, a1, a2);
-        break;
-
     case INDEX_op_remu_i32:
         tcg_out_opc_reg(s, OPC_REMUW, a0, a1, a2);
         break;
@@ -2748,9 +2753,7 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_negsetcond_i64:
         return C_O1_I2(r, r, rI);
 
-    case INDEX_op_rem_i32:
     case INDEX_op_remu_i32:
-    case INDEX_op_rem_i64:
     case INDEX_op_remu_i64:
         return C_O1_I2(r, rz, rz);
 
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index 9af626eec2..320268669a 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -2437,6 +2437,10 @@ static const TCGOutOpBinary outop_orc = {
     .out_rrr = tgen_orc,
 };
 
+static const TCGOutOpBinary outop_rems = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static void tgen_sub(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index a4659653b3..23cca5c664 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -1476,6 +1476,10 @@ static const TCGOutOpBinary outop_orc = {
     .out_rrr = tgen_orc,
 };
 
+static const TCGOutOpBinary outop_rems = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static void tgen_sub(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 2c1307e3fc..5af5529284 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1040,6 +1040,8 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_not, TCGOutOpUnary, outop_not),
     OUTOP(INDEX_op_or, TCGOutOpBinary, outop_or),
     OUTOP(INDEX_op_orc, TCGOutOpBinary, outop_orc),
+    OUTOP(INDEX_op_rem_i32, TCGOutOpBinary, outop_rems),
+    OUTOP(INDEX_op_rem_i64, TCGOutOpBinary, outop_rems),
     OUTOP(INDEX_op_sub, TCGOutOpSubtract, outop_sub),
     OUTOP(INDEX_op_xor, TCGOutOpBinary, outop_xor),
 };
@@ -2270,7 +2272,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
 
     case INDEX_op_negsetcond_i32:
         return TCG_TARGET_HAS_negsetcond_i32;
-    case INDEX_op_rem_i32:
     case INDEX_op_remu_i32:
         return TCG_TARGET_HAS_rem_i32;
     case INDEX_op_rotl_i32:
@@ -2327,7 +2328,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
 
     case INDEX_op_negsetcond_i64:
         return TCG_TARGET_HAS_negsetcond_i64;
-    case INDEX_op_rem_i64:
     case INDEX_op_remu_i64:
         return TCG_TARGET_HAS_rem_i64;
     case INDEX_op_rotl_i64:
@@ -5425,6 +5425,8 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
     case INDEX_op_nor:
     case INDEX_op_or:
     case INDEX_op_orc:
+    case INDEX_op_rem_i32:
+    case INDEX_op_rem_i64:
     case INDEX_op_xor:
         {
             const TCGOutOpBinary *out =
diff --git a/tcg/tci.c b/tcg/tci.c
index bf97849bfe..65f493c3d4 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -586,7 +586,7 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = (uint32_t)regs[r1] / (uint32_t)regs[r2];
             break;
-        case INDEX_op_rem_i32:
+        case INDEX_op_tci_rems32:
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = (int32_t)regs[r1] % (int32_t)regs[r2];
             break;
@@ -1081,7 +1081,6 @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
     case INDEX_op_orc:
     case INDEX_op_sub:
     case INDEX_op_xor:
-    case INDEX_op_rem_i32:
     case INDEX_op_rem_i64:
     case INDEX_op_remu_i32:
     case INDEX_op_remu_i64:
@@ -1101,6 +1100,7 @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
     case INDEX_op_ctz_i64:
     case INDEX_op_tci_divs32:
     case INDEX_op_tci_divu32:
+    case INDEX_op_tci_rems32:
         tci_args_rrr(insn, &r0, &r1, &r2);
         info->fprintf_func(info->stream, "%-12s  %s, %s, %s",
                            op_name, str_r(r0), str_r(r1), str_r(r2));
diff --git a/tcg/tci/tcg-target-opc.h.inc b/tcg/tci/tcg-target-opc.h.inc
index 43c07a269f..2822fbffc8 100644
--- a/tcg/tci/tcg-target-opc.h.inc
+++ b/tcg/tci/tcg-target-opc.h.inc
@@ -4,3 +4,4 @@ DEF(tci_movi, 1, 0, 1, TCG_OPF_NOT_PRESENT)
 DEF(tci_movl, 1, 0, 1, TCG_OPF_NOT_PRESENT)
 DEF(tci_divs32, 1, 2, 0, TCG_OPF_NOT_PRESENT)
 DEF(tci_divu32, 1, 2, 0, TCG_OPF_NOT_PRESENT)
+DEF(tci_rems32, 1, 2, 0, TCG_OPF_NOT_PRESENT)
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index 27271c178c..4d9c142a00 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -79,8 +79,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(r, r);
 
-    case INDEX_op_rem_i32:
-    case INDEX_op_rem_i64:
     case INDEX_op_remu_i32:
     case INDEX_op_remu_i64:
     case INDEX_op_shl_i32:
@@ -754,6 +752,20 @@ static const TCGOutOpBinary outop_orc = {
     .out_rrr = tgen_orc,
 };
 
+static void tgen_rems(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    TCGOpcode opc = (type == TCG_TYPE_I32
+                     ? INDEX_op_tci_rems32
+                     : INDEX_op_rem_i64);
+    tcg_out_op_rrr(s, opc, a0, a1, a2);
+}
+
+static const TCGOutOpBinary outop_rems = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_rems,
+};
+
 static void tgen_sub(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -843,7 +855,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     CASE_32_64(sar)
     CASE_32_64(rotl)     /* Optional (TCG_TARGET_HAS_rot_*). */
     CASE_32_64(rotr)     /* Optional (TCG_TARGET_HAS_rot_*). */
-    CASE_32_64(rem)      /* Optional (TCG_TARGET_HAS_div_*). */
     CASE_32_64(remu)     /* Optional (TCG_TARGET_HAS_div_*). */
     CASE_32_64(clz)      /* Optional (TCG_TARGET_HAS_clz_*). */
     CASE_32_64(ctz)      /* Optional (TCG_TARGET_HAS_ctz_*). */

From 9a6bc1840ec105902bda1a59c42e9e0c56a9ed05 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 7 Jan 2025 19:00:51 -0800
Subject: [PATCH 0409/2760] tcg: Merge INDEX_op_rem_{i32,i64}

Rename to INDEX_op_rems to emphasize signed inputs,
and mirroring INDEX_op_remu_*.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 docs/devel/tcg-ops.rst   |  2 +-
 include/tcg/tcg-opc.h    |  3 +--
 tcg/optimize.c           | 12 +++++++-----
 tcg/tcg-op.c             |  8 ++++----
 tcg/tcg.c                |  6 ++----
 tcg/tci.c                |  4 ++--
 tcg/tci/tcg-target.c.inc |  2 +-
 7 files changed, 18 insertions(+), 19 deletions(-)

diff --git a/docs/devel/tcg-ops.rst b/docs/devel/tcg-ops.rst
index 8f3b5e91b2..1f4160a585 100644
--- a/docs/devel/tcg-ops.rst
+++ b/docs/devel/tcg-ops.rst
@@ -287,7 +287,7 @@ Arithmetic
      - | *t0* = *t1* / *t2* (unsigned)
        | Undefined behavior if division by zero.
 
-   * - rem_i32/i64 *t0*, *t1*, *t2*
+   * - rems *t0*, *t1*, *t2*
 
      - | *t0* = *t1* % *t2* (signed)
        | Undefined behavior if division by zero or overflow.
diff --git a/include/tcg/tcg-opc.h b/include/tcg/tcg-opc.h
index 61e5e185cc..040f4da835 100644
--- a/include/tcg/tcg-opc.h
+++ b/include/tcg/tcg-opc.h
@@ -56,6 +56,7 @@ DEF(nor, 1, 2, 0, TCG_OPF_INT)
 DEF(not, 1, 1, 0, TCG_OPF_INT)
 DEF(or, 1, 2, 0, TCG_OPF_INT)
 DEF(orc, 1, 2, 0, TCG_OPF_INT)
+DEF(rems, 1, 2, 0, TCG_OPF_INT)
 DEF(sub, 1, 2, 0, TCG_OPF_INT)
 DEF(xor, 1, 2, 0, TCG_OPF_INT)
 
@@ -72,7 +73,6 @@ DEF(st8_i32, 0, 2, 1, 0)
 DEF(st16_i32, 0, 2, 1, 0)
 DEF(st_i32, 0, 2, 1, 0)
 /* arith */
-DEF(rem_i32, 1, 2, 0, 0)
 DEF(remu_i32, 1, 2, 0, 0)
 /* shifts/rotates */
 DEF(shl_i32, 1, 2, 0, 0)
@@ -116,7 +116,6 @@ DEF(st16_i64, 0, 2, 1, 0)
 DEF(st32_i64, 0, 2, 1, 0)
 DEF(st_i64, 0, 2, 1, 0)
 /* arith */
-DEF(rem_i64, 1, 2, 0, 0)
 DEF(remu_i64, 1, 2, 0, 0)
 /* shifts/rotates */
 DEF(shl_i64, 1, 2, 0, 0)
diff --git a/tcg/optimize.c b/tcg/optimize.c
index c11cce782a..01ec365175 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -569,12 +569,14 @@ static uint64_t do_constant_folding_2(TCGOpcode op, TCGType type,
         }
         return (uint64_t)x / ((uint64_t)y ? : 1);
 
-    case INDEX_op_rem_i32:
-        return (int32_t)x % ((int32_t)y ? : 1);
+    case INDEX_op_rems:
+        if (type == TCG_TYPE_I32) {
+            return (int32_t)x % ((int32_t)y ? : 1);
+        }
+        return (int64_t)x % ((int64_t)y ? : 1);
+
     case INDEX_op_remu_i32:
         return (uint32_t)x % ((uint32_t)y ? : 1);
-    case INDEX_op_rem_i64:
-        return (int64_t)x % ((int64_t)y ? : 1);
     case INDEX_op_remu_i64:
         return (uint64_t)x % ((uint64_t)y ? : 1);
 
@@ -3021,7 +3023,7 @@ void tcg_optimize(TCGContext *s)
         case INDEX_op_qemu_st_i128:
             done = fold_qemu_st(&ctx, op);
             break;
-        CASE_OP_32_64(rem):
+        case INDEX_op_rems:
         CASE_OP_32_64(remu):
             done = fold_remainder(&ctx, op);
             break;
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index 7ed92157de..6da8b30547 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -615,8 +615,8 @@ void tcg_gen_div_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 
 void tcg_gen_rem_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 {
-    if (TCG_TARGET_HAS_rem_i32) {
-        tcg_gen_op3_i32(INDEX_op_rem_i32, ret, arg1, arg2);
+    if (tcg_op_supported(INDEX_op_rems, TCG_TYPE_I32, 0)) {
+        tcg_gen_op3_i32(INDEX_op_rems, ret, arg1, arg2);
     } else if (tcg_op_supported(INDEX_op_divs, TCG_TYPE_I32, 0)) {
         TCGv_i32 t0 = tcg_temp_ebb_new_i32();
         tcg_gen_op3_i32(INDEX_op_divs, t0, arg1, arg2);
@@ -1983,8 +1983,8 @@ void tcg_gen_div_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
 
 void tcg_gen_rem_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
 {
-    if (TCG_TARGET_HAS_rem_i64) {
-        tcg_gen_op3_i64(INDEX_op_rem_i64, ret, arg1, arg2);
+    if (tcg_op_supported(INDEX_op_rems, TCG_TYPE_I64, 0)) {
+        tcg_gen_op3_i64(INDEX_op_rems, ret, arg1, arg2);
     } else if (tcg_op_supported(INDEX_op_divs, TCG_TYPE_I64, 0)) {
         TCGv_i64 t0 = tcg_temp_ebb_new_i64();
         tcg_gen_op3_i64(INDEX_op_divs, t0, arg1, arg2);
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 5af5529284..fad828fa2f 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1040,8 +1040,7 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_not, TCGOutOpUnary, outop_not),
     OUTOP(INDEX_op_or, TCGOutOpBinary, outop_or),
     OUTOP(INDEX_op_orc, TCGOutOpBinary, outop_orc),
-    OUTOP(INDEX_op_rem_i32, TCGOutOpBinary, outop_rems),
-    OUTOP(INDEX_op_rem_i64, TCGOutOpBinary, outop_rems),
+    OUTOP(INDEX_op_rems, TCGOutOpBinary, outop_rems),
     OUTOP(INDEX_op_sub, TCGOutOpSubtract, outop_sub),
     OUTOP(INDEX_op_xor, TCGOutOpBinary, outop_xor),
 };
@@ -5425,8 +5424,7 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
     case INDEX_op_nor:
     case INDEX_op_or:
     case INDEX_op_orc:
-    case INDEX_op_rem_i32:
-    case INDEX_op_rem_i64:
+    case INDEX_op_rems:
     case INDEX_op_xor:
         {
             const TCGOutOpBinary *out =
diff --git a/tcg/tci.c b/tcg/tci.c
index 65f493c3d4..6ca033f3be 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -728,7 +728,7 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = (uint64_t)regs[r1] / (uint64_t)regs[r2];
             break;
-        case INDEX_op_rem_i64:
+        case INDEX_op_rems:
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = (int64_t)regs[r1] % (int64_t)regs[r2];
             break;
@@ -1079,9 +1079,9 @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
     case INDEX_op_nor:
     case INDEX_op_or:
     case INDEX_op_orc:
+    case INDEX_op_rems:
     case INDEX_op_sub:
     case INDEX_op_xor:
-    case INDEX_op_rem_i64:
     case INDEX_op_remu_i32:
     case INDEX_op_remu_i64:
     case INDEX_op_shl_i32:
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index 4d9c142a00..2b05da7d06 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -757,7 +757,7 @@ static void tgen_rems(TCGContext *s, TCGType type,
 {
     TCGOpcode opc = (type == TCG_TYPE_I32
                      ? INDEX_op_tci_rems32
-                     : INDEX_op_rem_i64);
+                     : INDEX_op_rems);
     tcg_out_op_rrr(s, opc, a0, a1, a2);
 }
 

From 967e7ccd9c5c6a5a2cc5d7a101cd24acced22749 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 7 Jan 2025 20:12:08 -0800
Subject: [PATCH 0410/2760] tcg: Convert remu to TCGOutOpBinary

For TCI, we're losing type information in the interpreter.
Introduce a tci-specific opcode to handle the difference.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target-has.h         |  2 --
 tcg/aarch64/tcg-target.c.inc         | 22 ++++++++-------
 tcg/arm/tcg-target-has.h             |  1 -
 tcg/arm/tcg-target.c.inc             |  4 +++
 tcg/i386/tcg-target.c.inc            |  4 +++
 tcg/loongarch64/tcg-target-con-set.h |  1 -
 tcg/loongarch64/tcg-target-has.h     |  2 --
 tcg/loongarch64/tcg-target.c.inc     | 26 ++++++++++--------
 tcg/mips/tcg-target-has.h            |  2 --
 tcg/mips/tcg-target.c.inc            | 41 ++++++++++++++--------------
 tcg/ppc/tcg-target-has.h             |  2 --
 tcg/ppc/tcg-target.c.inc             | 25 +++++++++--------
 tcg/riscv/tcg-target-con-set.h       |  1 -
 tcg/riscv/tcg-target-has.h           |  2 --
 tcg/riscv/tcg-target.c.inc           | 23 ++++++++--------
 tcg/s390x/tcg-target.c.inc           |  4 +++
 tcg/sparc64/tcg-target-has.h         |  2 --
 tcg/sparc64/tcg-target.c.inc         |  4 +++
 tcg/tcg-has.h                        |  9 ------
 tcg/tcg-op.c                         |  4 +--
 tcg/tcg.c                            |  8 +++---
 tcg/tci.c                            |  4 +--
 tcg/tci/tcg-target-has.h             |  2 --
 tcg/tci/tcg-target-opc.h.inc         |  1 +
 tcg/tci/tcg-target.c.inc             | 17 ++++++++++--
 25 files changed, 112 insertions(+), 101 deletions(-)

diff --git a/tcg/aarch64/tcg-target-has.h b/tcg/aarch64/tcg-target-has.h
index e961668ef0..1fdff25d05 100644
--- a/tcg/aarch64/tcg-target-has.h
+++ b/tcg/aarch64/tcg-target-has.h
@@ -13,7 +13,6 @@
 #define have_lse2   (cpuinfo & CPUINFO_LSE2)
 
 /* optional instructions */
-#define TCG_TARGET_HAS_rem_i32          1
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
 #define TCG_TARGET_HAS_rot_i32          1
@@ -29,7 +28,6 @@
 #define TCG_TARGET_HAS_extr_i64_i32     0
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
-#define TCG_TARGET_HAS_rem_i64          1
 #define TCG_TARGET_HAS_bswap16_i64      1
 #define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1
diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index 6e80e18a6a..8aa11e9d9d 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -2287,6 +2287,18 @@ static const TCGOutOpBinary outop_rems = {
     .out_rrr = tgen_rems,
 };
 
+static void tgen_remu(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_insn(s, 3508, UDIV, type, TCG_REG_TMP0, a1, a2);
+    tcg_out_insn(s, 3509, MSUB, type, a0, TCG_REG_TMP0, a2, a1);
+}
+
+static const TCGOutOpBinary outop_remu = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_remu,
+};
+
 static void tgen_sub(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -2404,12 +2416,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType ext,
         tcg_out_ldst(s, I3312_STRX, a0, a1, a2, 3);
         break;
 
-    case INDEX_op_remu_i64:
-    case INDEX_op_remu_i32:
-        tcg_out_insn(s, 3508, UDIV, ext, TCG_REG_TMP0, a1, a2);
-        tcg_out_insn(s, 3509, MSUB, ext, a0, TCG_REG_TMP0, a2, a1);
-        break;
-
     case INDEX_op_shl_i64:
     case INDEX_op_shl_i32:
         if (c2) {
@@ -3085,10 +3091,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_negsetcond_i64:
         return C_O1_I2(r, r, rC);
 
-    case INDEX_op_remu_i32:
-    case INDEX_op_remu_i64:
-        return C_O1_I2(r, r, r);
-
     case INDEX_op_shl_i32:
     case INDEX_op_shr_i32:
     case INDEX_op_sar_i32:
diff --git a/tcg/arm/tcg-target-has.h b/tcg/arm/tcg-target-has.h
index 6ed2b49c84..32d73d3443 100644
--- a/tcg/arm/tcg-target-has.h
+++ b/tcg/arm/tcg-target-has.h
@@ -34,7 +34,6 @@ extern bool use_neon_instructions;
 #define TCG_TARGET_HAS_negsetcond_i32   1
 #define TCG_TARGET_HAS_mulu2_i32        1
 #define TCG_TARGET_HAS_muls2_i32        1
-#define TCG_TARGET_HAS_rem_i32          0
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
 #define TCG_TARGET_HAS_qemu_ldst_i128   0
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index 673c8fb7a6..c08cd712b1 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -1959,6 +1959,10 @@ static const TCGOutOpBinary outop_rems = {
     .base.static_constraint = C_NotImplemented,
 };
 
+static const TCGOutOpBinary outop_remu = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static void tgen_sub(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index ac0721d71c..02dd440052 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -2740,6 +2740,10 @@ static const TCGOutOpBinary outop_rems = {
     .base.static_constraint = C_NotImplemented,
 };
 
+static const TCGOutOpBinary outop_remu = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static void tgen_sub(TCGContext *s, TCGType type,
                       TCGReg a0, TCGReg a1, TCGReg a2)
 {
diff --git a/tcg/loongarch64/tcg-target-con-set.h b/tcg/loongarch64/tcg-target-con-set.h
index b4af4f5423..da84e4d49c 100644
--- a/tcg/loongarch64/tcg-target-con-set.h
+++ b/tcg/loongarch64/tcg-target-con-set.h
@@ -31,7 +31,6 @@ C_O1_I2(r, r, rW)
 C_O1_I2(r, 0, rz)
 C_O1_I2(r, rz, ri)
 C_O1_I2(r, rz, rJ)
-C_O1_I2(r, rz, rz)
 C_O1_I2(w, w, w)
 C_O1_I2(w, w, wM)
 C_O1_I2(w, w, wA)
diff --git a/tcg/loongarch64/tcg-target-has.h b/tcg/loongarch64/tcg-target-has.h
index aecd2879b8..5dfc69ae6a 100644
--- a/tcg/loongarch64/tcg-target-has.h
+++ b/tcg/loongarch64/tcg-target-has.h
@@ -11,7 +11,6 @@
 
 /* optional instructions */
 #define TCG_TARGET_HAS_negsetcond_i32   0
-#define TCG_TARGET_HAS_rem_i32          1
 #define TCG_TARGET_HAS_rot_i32          1
 #define TCG_TARGET_HAS_extract2_i32     0
 #define TCG_TARGET_HAS_add2_i32         0
@@ -27,7 +26,6 @@
 
 /* 64-bit operations */
 #define TCG_TARGET_HAS_negsetcond_i64   0
-#define TCG_TARGET_HAS_rem_i64          1
 #define TCG_TARGET_HAS_rot_i64          1
 #define TCG_TARGET_HAS_extract2_i64     0
 #define TCG_TARGET_HAS_extr_i64_i32     1
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index ef37b4daa7..a0313b1140 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -1474,6 +1474,21 @@ static const TCGOutOpBinary outop_rems = {
     .out_rrr = tgen_rems,
 };
 
+static void tgen_remu(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    if (type == TCG_TYPE_I32) {
+        tcg_out_opc_mod_wu(s, a0, a1, a2);
+    } else {
+        tcg_out_opc_mod_du(s, a0, a1, a2);
+    }
+}
+
+static const TCGOutOpBinary outop_remu = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_remu,
+};
+
 static void tgen_sub(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -1724,13 +1739,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    case INDEX_op_remu_i32:
-        tcg_out_opc_mod_wu(s, a0, a1, a2);
-        break;
-    case INDEX_op_remu_i64:
-        tcg_out_opc_mod_du(s, a0, a1, a2);
-        break;
-
     case INDEX_op_setcond_i32:
     case INDEX_op_setcond_i64:
         tcg_out_setcond(s, args[3], a0, a1, a2, c2);
@@ -2389,10 +2397,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_setcond_i64:
         return C_O1_I2(r, rz, rJ);
 
-    case INDEX_op_remu_i32:
-    case INDEX_op_remu_i64:
-        return C_O1_I2(r, rz, rz);
-
     case INDEX_op_movcond_i32:
     case INDEX_op_movcond_i64:
         return C_O1_I4(r, rz, rJ, rz, rz);
diff --git a/tcg/mips/tcg-target-has.h b/tcg/mips/tcg-target-has.h
index 9aa5bf9f1b..ab6a134796 100644
--- a/tcg/mips/tcg-target-has.h
+++ b/tcg/mips/tcg-target-has.h
@@ -39,7 +39,6 @@ extern bool use_mips32r2_instructions;
 #endif
 
 /* optional instructions */
-#define TCG_TARGET_HAS_rem_i32          1
 #define TCG_TARGET_HAS_mulu2_i32        (!use_mips32r6_instructions)
 #define TCG_TARGET_HAS_muls2_i32        (!use_mips32r6_instructions)
 #define TCG_TARGET_HAS_bswap16_i32      1
@@ -50,7 +49,6 @@ extern bool use_mips32r2_instructions;
 #define TCG_TARGET_HAS_add2_i32         0
 #define TCG_TARGET_HAS_sub2_i32         0
 #define TCG_TARGET_HAS_extr_i64_i32     1
-#define TCG_TARGET_HAS_rem_i64          1
 #define TCG_TARGET_HAS_add2_i64         0
 #define TCG_TARGET_HAS_sub2_i64         0
 #define TCG_TARGET_HAS_mulu2_i64        (!use_mips32r6_instructions)
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index 37b878ec61..bd38c7ab95 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -1887,6 +1887,27 @@ static const TCGOutOpBinary outop_rems = {
     .out_rrr = tgen_rems,
 };
 
+static void tgen_remu(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    if (use_mips32r6_instructions) {
+        if (type == TCG_TYPE_I32) {
+            tcg_out_opc_reg(s, OPC_MODU, a0, a1, a2);
+        } else {
+            tcg_out_opc_reg(s, OPC_DMODU, a0, a1, a2);
+        }
+    } else {
+        MIPSInsn insn = type == TCG_TYPE_I32 ? OPC_DIVU : OPC_DDIVU;
+        tcg_out_opc_reg(s, insn, 0, a1, a2);
+        tcg_out_opc_reg(s, OPC_MFHI, a0, 0, 0);
+    }
+}
+
+static const TCGOutOpBinary outop_remu = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_remu,
+};
+
 static void tgen_sub(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -2010,24 +2031,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_ldst(s, i1, a0, a1, a2);
         break;
 
-    case INDEX_op_remu_i32:
-        if (use_mips32r6_instructions) {
-            tcg_out_opc_reg(s, OPC_MODU, a0, a1, a2);
-            break;
-        }
-        i1 = OPC_DIVU, i2 = OPC_MFHI;
-        goto do_hilo1;
-    case INDEX_op_remu_i64:
-        if (use_mips32r6_instructions) {
-            tcg_out_opc_reg(s, OPC_DMODU, a0, a1, a2);
-            break;
-        }
-        i1 = OPC_DDIVU, i2 = OPC_MFHI;
-    do_hilo1:
-        tcg_out_opc_reg(s, i1, 0, a1, a2);
-        tcg_out_opc_reg(s, i2, a0, 0, 0);
-        break;
-
     case INDEX_op_muls2_i32:
         i1 = OPC_MULT;
         goto do_hilo2;
@@ -2282,9 +2285,7 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(rz, r);
 
-    case INDEX_op_remu_i32:
     case INDEX_op_setcond_i32:
-    case INDEX_op_remu_i64:
     case INDEX_op_setcond_i64:
         return C_O1_I2(r, rz, rz);
     case INDEX_op_muls2_i32:
diff --git a/tcg/ppc/tcg-target-has.h b/tcg/ppc/tcg-target-has.h
index f8e4c0ad3c..37e88a3193 100644
--- a/tcg/ppc/tcg-target-has.h
+++ b/tcg/ppc/tcg-target-has.h
@@ -17,7 +17,6 @@
 #define have_vsx       (cpuinfo & CPUINFO_VSX)
 
 /* optional instructions */
-#define TCG_TARGET_HAS_rem_i32          have_isa_3_00
 #define TCG_TARGET_HAS_rot_i32          1
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
@@ -34,7 +33,6 @@
 #define TCG_TARGET_HAS_add2_i32         0
 #define TCG_TARGET_HAS_sub2_i32         0
 #define TCG_TARGET_HAS_extr_i64_i32     0
-#define TCG_TARGET_HAS_rem_i64          have_isa_3_00
 #define TCG_TARGET_HAS_rot_i64          1
 #define TCG_TARGET_HAS_bswap16_i64      1
 #define TCG_TARGET_HAS_bswap32_i64      1
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index c331f0d672..80ee4d04c9 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -3109,6 +3109,19 @@ static const TCGOutOpBinary outop_rems = {
     .out_rrr = tgen_rems,
 };
 
+static void tgen_remu(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    uint32_t insn = type == TCG_TYPE_I32 ? MODUW : MODUD;
+    tcg_out32(s, insn | TAB(a0, a1, a2));
+}
+
+static const TCGOutOpBinary outop_remu = {
+    .base.static_constraint = C_Dynamic,
+    .base.dynamic_constraint = cset_mod,
+    .out_rrr = tgen_remu,
+};
+
 static void tgen_sub(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -3259,10 +3272,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out32(s, CNTPOPD | SAB(args[1], args[0], 0));
         break;
 
-    case INDEX_op_remu_i32:
-        tcg_out32(s, MODUW | TAB(args[0], args[1], args[2]));
-        break;
-
     case INDEX_op_shl_i32:
         if (const_args[2]) {
             /* Limit immediate shift count lest we create an illegal insn.  */
@@ -3355,10 +3364,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    case INDEX_op_remu_i64:
-        tcg_out32(s, MODUD | TAB(args[0], args[1], args[2]));
-        break;
-
     case INDEX_op_qemu_ld_i32:
         tcg_out_qemu_ld(s, args[0], -1, args[1], args[2], TCG_TYPE_I32);
         break;
@@ -4213,10 +4218,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_rotr_i64:
         return C_O1_I2(r, r, ri);
 
-    case INDEX_op_remu_i32:
-    case INDEX_op_remu_i64:
-        return C_O1_I2(r, r, r);
-
     case INDEX_op_clz_i32:
     case INDEX_op_ctz_i32:
     case INDEX_op_clz_i64:
diff --git a/tcg/riscv/tcg-target-con-set.h b/tcg/riscv/tcg-target-con-set.h
index f3a6f7a7ed..f0d3cb81bd 100644
--- a/tcg/riscv/tcg-target-con-set.h
+++ b/tcg/riscv/tcg-target-con-set.h
@@ -16,7 +16,6 @@ C_O1_I1(r, r)
 C_O1_I2(r, r, r)
 C_O1_I2(r, r, ri)
 C_O1_I2(r, r, rI)
-C_O1_I2(r, rz, rz)
 C_N1_I2(r, r, rM)
 C_O1_I4(r, r, rI, rM, rM)
 C_O2_I4(r, r, rz, rz, rM, rM)
diff --git a/tcg/riscv/tcg-target-has.h b/tcg/riscv/tcg-target-has.h
index e5861e5260..b3c6899887 100644
--- a/tcg/riscv/tcg-target-has.h
+++ b/tcg/riscv/tcg-target-has.h
@@ -11,7 +11,6 @@
 
 /* optional instructions */
 #define TCG_TARGET_HAS_negsetcond_i32   1
-#define TCG_TARGET_HAS_rem_i32          1
 #define TCG_TARGET_HAS_rot_i32          (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_extract2_i32     0
 #define TCG_TARGET_HAS_add2_i32         1
@@ -26,7 +25,6 @@
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
 #define TCG_TARGET_HAS_negsetcond_i64   1
-#define TCG_TARGET_HAS_rem_i64          1
 #define TCG_TARGET_HAS_rot_i64          (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_extract2_i64     0
 #define TCG_TARGET_HAS_extr_i64_i32     1
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index b0a98273f1..38ba898042 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -2132,6 +2132,18 @@ static const TCGOutOpBinary outop_rems = {
     .out_rrr = tgen_rems,
 };
 
+static void tgen_remu(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    RISCVInsn insn = type == TCG_TYPE_I32 ? OPC_REMUW : OPC_REMU;
+    tcg_out_opc_reg(s, insn, a0, a1, a2);
+}
+
+static const TCGOutOpBinary outop_remu = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_remu,
+};
+
 static void tgen_sub(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -2245,13 +2257,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_ldst(s, OPC_SD, a0, a1, a2);
         break;
 
-    case INDEX_op_remu_i32:
-        tcg_out_opc_reg(s, OPC_REMUW, a0, a1, a2);
-        break;
-    case INDEX_op_remu_i64:
-        tcg_out_opc_reg(s, OPC_REMU, a0, a1, a2);
-        break;
-
     case INDEX_op_shl_i32:
         if (c2) {
             tcg_out_opc_imm(s, OPC_SLLIW, a0, a1, a2 & 0x1f);
@@ -2753,10 +2758,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_negsetcond_i64:
         return C_O1_I2(r, r, rI);
 
-    case INDEX_op_remu_i32:
-    case INDEX_op_remu_i64:
-        return C_O1_I2(r, rz, rz);
-
     case INDEX_op_shl_i32:
     case INDEX_op_shr_i32:
     case INDEX_op_sar_i32:
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index 320268669a..8702d8c928 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -2441,6 +2441,10 @@ static const TCGOutOpBinary outop_rems = {
     .base.static_constraint = C_NotImplemented,
 };
 
+static const TCGOutOpBinary outop_remu = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static void tgen_sub(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
diff --git a/tcg/sparc64/tcg-target-has.h b/tcg/sparc64/tcg-target-has.h
index 35f0dd4230..42de99efbf 100644
--- a/tcg/sparc64/tcg-target-has.h
+++ b/tcg/sparc64/tcg-target-has.h
@@ -14,7 +14,6 @@ extern bool use_vis3_instructions;
 #endif
 
 /* optional instructions */
-#define TCG_TARGET_HAS_rem_i32		0
 #define TCG_TARGET_HAS_rot_i32          0
 #define TCG_TARGET_HAS_bswap16_i32      0
 #define TCG_TARGET_HAS_bswap32_i32      0
@@ -30,7 +29,6 @@ extern bool use_vis3_instructions;
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
 #define TCG_TARGET_HAS_extr_i64_i32     0
-#define TCG_TARGET_HAS_rem_i64          0
 #define TCG_TARGET_HAS_rot_i64          0
 #define TCG_TARGET_HAS_bswap16_i64      0
 #define TCG_TARGET_HAS_bswap32_i64      0
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index 23cca5c664..d465c8dd06 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -1480,6 +1480,10 @@ static const TCGOutOpBinary outop_rems = {
     .base.static_constraint = C_NotImplemented,
 };
 
+static const TCGOutOpBinary outop_remu = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static void tgen_sub(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
diff --git a/tcg/tcg-has.h b/tcg/tcg-has.h
index bae9918024..0bb829be36 100644
--- a/tcg/tcg-has.h
+++ b/tcg/tcg-has.h
@@ -12,8 +12,6 @@
 #if TCG_TARGET_REG_BITS == 32
 /* Turn some undef macros into false macros.  */
 #define TCG_TARGET_HAS_extr_i64_i32     0
-#define TCG_TARGET_HAS_div_i64          0
-#define TCG_TARGET_HAS_rem_i64          0
 #define TCG_TARGET_HAS_rot_i64          0
 #define TCG_TARGET_HAS_bswap16_i64      0
 #define TCG_TARGET_HAS_bswap32_i64      0
@@ -32,13 +30,6 @@
 #define TCG_TARGET_HAS_sub2_i32         1
 #endif
 
-#ifndef TCG_TARGET_HAS_rem_i32
-#define TCG_TARGET_HAS_rem_i32          0
-#endif
-#ifndef TCG_TARGET_HAS_rem_i64
-#define TCG_TARGET_HAS_rem_i64          0
-#endif
-
 #if !defined(TCG_TARGET_HAS_v64) \
     && !defined(TCG_TARGET_HAS_v128) \
     && !defined(TCG_TARGET_HAS_v256)
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index 6da8b30547..4ff6c9f0ab 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -649,7 +649,7 @@ void tcg_gen_divu_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 
 void tcg_gen_remu_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 {
-    if (TCG_TARGET_HAS_rem_i32) {
+    if (tcg_op_supported(INDEX_op_remu_i32, TCG_TYPE_I32, 0)) {
         tcg_gen_op3_i32(INDEX_op_remu_i32, ret, arg1, arg2);
     } else if (tcg_op_supported(INDEX_op_divu, TCG_TYPE_I32, 0)) {
         TCGv_i32 t0 = tcg_temp_ebb_new_i32();
@@ -2017,7 +2017,7 @@ void tcg_gen_divu_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
 
 void tcg_gen_remu_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
 {
-    if (TCG_TARGET_HAS_rem_i64) {
+    if (tcg_op_supported(INDEX_op_remu_i64, TCG_TYPE_I64, 0)) {
         tcg_gen_op3_i64(INDEX_op_remu_i64, ret, arg1, arg2);
     } else if (tcg_op_supported(INDEX_op_divu, TCG_TYPE_I64, 0)) {
         TCGv_i64 t0 = tcg_temp_ebb_new_i64();
diff --git a/tcg/tcg.c b/tcg/tcg.c
index fad828fa2f..537b665d07 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1041,6 +1041,8 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_or, TCGOutOpBinary, outop_or),
     OUTOP(INDEX_op_orc, TCGOutOpBinary, outop_orc),
     OUTOP(INDEX_op_rems, TCGOutOpBinary, outop_rems),
+    OUTOP(INDEX_op_remu_i32, TCGOutOpBinary, outop_remu),
+    OUTOP(INDEX_op_remu_i64, TCGOutOpBinary, outop_remu),
     OUTOP(INDEX_op_sub, TCGOutOpSubtract, outop_sub),
     OUTOP(INDEX_op_xor, TCGOutOpBinary, outop_xor),
 };
@@ -2271,8 +2273,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
 
     case INDEX_op_negsetcond_i32:
         return TCG_TARGET_HAS_negsetcond_i32;
-    case INDEX_op_remu_i32:
-        return TCG_TARGET_HAS_rem_i32;
     case INDEX_op_rotl_i32:
     case INDEX_op_rotr_i32:
         return TCG_TARGET_HAS_rot_i32;
@@ -2327,8 +2327,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
 
     case INDEX_op_negsetcond_i64:
         return TCG_TARGET_HAS_negsetcond_i64;
-    case INDEX_op_remu_i64:
-        return TCG_TARGET_HAS_rem_i64;
     case INDEX_op_rotl_i64:
     case INDEX_op_rotr_i64:
         return TCG_TARGET_HAS_rot_i64;
@@ -5425,6 +5423,8 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
     case INDEX_op_or:
     case INDEX_op_orc:
     case INDEX_op_rems:
+    case INDEX_op_remu_i32:
+    case INDEX_op_remu_i64:
     case INDEX_op_xor:
         {
             const TCGOutOpBinary *out =
diff --git a/tcg/tci.c b/tcg/tci.c
index 6ca033f3be..bd5817a382 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -590,7 +590,7 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = (int32_t)regs[r1] % (int32_t)regs[r2];
             break;
-        case INDEX_op_remu_i32:
+        case INDEX_op_tci_remu32:
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = (uint32_t)regs[r1] % (uint32_t)regs[r2];
             break;
@@ -1082,7 +1082,6 @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
     case INDEX_op_rems:
     case INDEX_op_sub:
     case INDEX_op_xor:
-    case INDEX_op_remu_i32:
     case INDEX_op_remu_i64:
     case INDEX_op_shl_i32:
     case INDEX_op_shl_i64:
@@ -1101,6 +1100,7 @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
     case INDEX_op_tci_divs32:
     case INDEX_op_tci_divu32:
     case INDEX_op_tci_rems32:
+    case INDEX_op_tci_remu32:
         tci_args_rrr(insn, &r0, &r1, &r2);
         info->fprintf_func(info->stream, "%-12s  %s, %s, %s",
                            op_name, str_r(r0), str_r(r1), str_r(r2));
diff --git a/tcg/tci/tcg-target-has.h b/tcg/tci/tcg-target-has.h
index ccec96b610..bd51b9346d 100644
--- a/tcg/tci/tcg-target-has.h
+++ b/tcg/tci/tcg-target-has.h
@@ -9,7 +9,6 @@
 
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
-#define TCG_TARGET_HAS_rem_i32          1
 #define TCG_TARGET_HAS_extract2_i32     0
 #define TCG_TARGET_HAS_clz_i32          1
 #define TCG_TARGET_HAS_ctz_i32          1
@@ -25,7 +24,6 @@
 #define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1
 #define TCG_TARGET_HAS_extract2_i64     0
-#define TCG_TARGET_HAS_rem_i64          1
 #define TCG_TARGET_HAS_clz_i64          1
 #define TCG_TARGET_HAS_ctz_i64          1
 #define TCG_TARGET_HAS_ctpop_i64        1
diff --git a/tcg/tci/tcg-target-opc.h.inc b/tcg/tci/tcg-target-opc.h.inc
index 2822fbffc8..82d2a38cae 100644
--- a/tcg/tci/tcg-target-opc.h.inc
+++ b/tcg/tci/tcg-target-opc.h.inc
@@ -5,3 +5,4 @@ DEF(tci_movl, 1, 0, 1, TCG_OPF_NOT_PRESENT)
 DEF(tci_divs32, 1, 2, 0, TCG_OPF_NOT_PRESENT)
 DEF(tci_divu32, 1, 2, 0, TCG_OPF_NOT_PRESENT)
 DEF(tci_rems32, 1, 2, 0, TCG_OPF_NOT_PRESENT)
+DEF(tci_remu32, 1, 2, 0, TCG_OPF_NOT_PRESENT)
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index 2b05da7d06..421a2a8ac7 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -79,8 +79,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(r, r);
 
-    case INDEX_op_remu_i32:
-    case INDEX_op_remu_i64:
     case INDEX_op_shl_i32:
     case INDEX_op_shl_i64:
     case INDEX_op_shr_i32:
@@ -766,6 +764,20 @@ static const TCGOutOpBinary outop_rems = {
     .out_rrr = tgen_rems,
 };
 
+static void tgen_remu(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    TCGOpcode opc = (type == TCG_TYPE_I32
+                     ? INDEX_op_tci_remu32
+                     : INDEX_op_remu_i64);
+    tcg_out_op_rrr(s, opc, a0, a1, a2);
+}
+
+static const TCGOutOpBinary outop_remu = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_remu,
+};
+
 static void tgen_sub(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -855,7 +867,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     CASE_32_64(sar)
     CASE_32_64(rotl)     /* Optional (TCG_TARGET_HAS_rot_*). */
     CASE_32_64(rotr)     /* Optional (TCG_TARGET_HAS_rot_*). */
-    CASE_32_64(remu)     /* Optional (TCG_TARGET_HAS_div_*). */
     CASE_32_64(clz)      /* Optional (TCG_TARGET_HAS_clz_*). */
     CASE_32_64(ctz)      /* Optional (TCG_TARGET_HAS_ctz_*). */
         tcg_out_op_rrr(s, opc, args[0], args[1], args[2]);

From cd9acd2049a385e54314d58f35b4bfce7c031d55 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 7 Jan 2025 20:25:14 -0800
Subject: [PATCH 0411/2760] tcg: Merge INDEX_op_remu_{i32,i64}
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 docs/devel/tcg-ops.rst   | 2 +-
 include/tcg/tcg-opc.h    | 5 +----
 tcg/optimize.c           | 9 +++++----
 tcg/tcg-op.c             | 8 ++++----
 tcg/tcg.c                | 6 ++----
 tcg/tci.c                | 4 ++--
 tcg/tci/tcg-target.c.inc | 2 +-
 7 files changed, 16 insertions(+), 20 deletions(-)

diff --git a/docs/devel/tcg-ops.rst b/docs/devel/tcg-ops.rst
index 1f4160a585..bceecb0596 100644
--- a/docs/devel/tcg-ops.rst
+++ b/docs/devel/tcg-ops.rst
@@ -292,7 +292,7 @@ Arithmetic
      - | *t0* = *t1* % *t2* (signed)
        | Undefined behavior if division by zero or overflow.
 
-   * - remu_i32/i64 *t0*, *t1*, *t2*
+   * - remu *t0*, *t1*, *t2*
 
      - | *t0* = *t1* % *t2* (unsigned)
        | Undefined behavior if division by zero.
diff --git a/include/tcg/tcg-opc.h b/include/tcg/tcg-opc.h
index 040f4da835..ebb23347e9 100644
--- a/include/tcg/tcg-opc.h
+++ b/include/tcg/tcg-opc.h
@@ -57,6 +57,7 @@ DEF(not, 1, 1, 0, TCG_OPF_INT)
 DEF(or, 1, 2, 0, TCG_OPF_INT)
 DEF(orc, 1, 2, 0, TCG_OPF_INT)
 DEF(rems, 1, 2, 0, TCG_OPF_INT)
+DEF(remu, 1, 2, 0, TCG_OPF_INT)
 DEF(sub, 1, 2, 0, TCG_OPF_INT)
 DEF(xor, 1, 2, 0, TCG_OPF_INT)
 
@@ -72,8 +73,6 @@ DEF(ld_i32, 1, 1, 1, 0)
 DEF(st8_i32, 0, 2, 1, 0)
 DEF(st16_i32, 0, 2, 1, 0)
 DEF(st_i32, 0, 2, 1, 0)
-/* arith */
-DEF(remu_i32, 1, 2, 0, 0)
 /* shifts/rotates */
 DEF(shl_i32, 1, 2, 0, 0)
 DEF(shr_i32, 1, 2, 0, 0)
@@ -115,8 +114,6 @@ DEF(st8_i64, 0, 2, 1, 0)
 DEF(st16_i64, 0, 2, 1, 0)
 DEF(st32_i64, 0, 2, 1, 0)
 DEF(st_i64, 0, 2, 1, 0)
-/* arith */
-DEF(remu_i64, 1, 2, 0, 0)
 /* shifts/rotates */
 DEF(shl_i64, 1, 2, 0, 0)
 DEF(shr_i64, 1, 2, 0, 0)
diff --git a/tcg/optimize.c b/tcg/optimize.c
index 01ec365175..69f9ba1555 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -575,9 +575,10 @@ static uint64_t do_constant_folding_2(TCGOpcode op, TCGType type,
         }
         return (int64_t)x % ((int64_t)y ? : 1);
 
-    case INDEX_op_remu_i32:
-        return (uint32_t)x % ((uint32_t)y ? : 1);
-    case INDEX_op_remu_i64:
+    case INDEX_op_remu:
+        if (type == TCG_TYPE_I32) {
+            return (uint32_t)x % ((uint32_t)y ? : 1);
+        }
         return (uint64_t)x % ((uint64_t)y ? : 1);
 
     default:
@@ -3024,7 +3025,7 @@ void tcg_optimize(TCGContext *s)
             done = fold_qemu_st(&ctx, op);
             break;
         case INDEX_op_rems:
-        CASE_OP_32_64(remu):
+        case INDEX_op_remu:
             done = fold_remainder(&ctx, op);
             break;
         CASE_OP_32_64(rotl):
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index 4ff6c9f0ab..0f1e83a49f 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -649,8 +649,8 @@ void tcg_gen_divu_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 
 void tcg_gen_remu_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 {
-    if (tcg_op_supported(INDEX_op_remu_i32, TCG_TYPE_I32, 0)) {
-        tcg_gen_op3_i32(INDEX_op_remu_i32, ret, arg1, arg2);
+    if (tcg_op_supported(INDEX_op_remu, TCG_TYPE_I32, 0)) {
+        tcg_gen_op3_i32(INDEX_op_remu, ret, arg1, arg2);
     } else if (tcg_op_supported(INDEX_op_divu, TCG_TYPE_I32, 0)) {
         TCGv_i32 t0 = tcg_temp_ebb_new_i32();
         tcg_gen_op3_i32(INDEX_op_divu, t0, arg1, arg2);
@@ -2017,8 +2017,8 @@ void tcg_gen_divu_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
 
 void tcg_gen_remu_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
 {
-    if (tcg_op_supported(INDEX_op_remu_i64, TCG_TYPE_I64, 0)) {
-        tcg_gen_op3_i64(INDEX_op_remu_i64, ret, arg1, arg2);
+    if (tcg_op_supported(INDEX_op_remu, TCG_TYPE_I64, 0)) {
+        tcg_gen_op3_i64(INDEX_op_remu, ret, arg1, arg2);
     } else if (tcg_op_supported(INDEX_op_divu, TCG_TYPE_I64, 0)) {
         TCGv_i64 t0 = tcg_temp_ebb_new_i64();
         tcg_gen_op3_i64(INDEX_op_divu, t0, arg1, arg2);
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 537b665d07..cd89ef1faa 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1041,8 +1041,7 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_or, TCGOutOpBinary, outop_or),
     OUTOP(INDEX_op_orc, TCGOutOpBinary, outop_orc),
     OUTOP(INDEX_op_rems, TCGOutOpBinary, outop_rems),
-    OUTOP(INDEX_op_remu_i32, TCGOutOpBinary, outop_remu),
-    OUTOP(INDEX_op_remu_i64, TCGOutOpBinary, outop_remu),
+    OUTOP(INDEX_op_remu, TCGOutOpBinary, outop_remu),
     OUTOP(INDEX_op_sub, TCGOutOpSubtract, outop_sub),
     OUTOP(INDEX_op_xor, TCGOutOpBinary, outop_xor),
 };
@@ -5423,8 +5422,7 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
     case INDEX_op_or:
     case INDEX_op_orc:
     case INDEX_op_rems:
-    case INDEX_op_remu_i32:
-    case INDEX_op_remu_i64:
+    case INDEX_op_remu:
     case INDEX_op_xor:
         {
             const TCGOutOpBinary *out =
diff --git a/tcg/tci.c b/tcg/tci.c
index bd5817a382..5d2cba4941 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -732,7 +732,7 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = (int64_t)regs[r1] % (int64_t)regs[r2];
             break;
-        case INDEX_op_remu_i64:
+        case INDEX_op_remu:
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = (uint64_t)regs[r1] % (uint64_t)regs[r2];
             break;
@@ -1080,9 +1080,9 @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
     case INDEX_op_or:
     case INDEX_op_orc:
     case INDEX_op_rems:
+    case INDEX_op_remu:
     case INDEX_op_sub:
     case INDEX_op_xor:
-    case INDEX_op_remu_i64:
     case INDEX_op_shl_i32:
     case INDEX_op_shl_i64:
     case INDEX_op_shr_i32:
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index 421a2a8ac7..eb30fd04ba 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -769,7 +769,7 @@ static void tgen_remu(TCGContext *s, TCGType type,
 {
     TCGOpcode opc = (type == TCG_TYPE_I32
                      ? INDEX_op_tci_remu32
-                     : INDEX_op_remu_i64);
+                     : INDEX_op_remu);
     tcg_out_op_rrr(s, opc, a0, a1, a2);
 }
 

From 27d21ee7c79133e5dfdab8f160f547e833dc5dd0 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 7 Jan 2025 21:33:33 -0800
Subject: [PATCH 0412/2760] tcg: Convert shl to TCGOutOpBinary
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target.c.inc     | 38 ++++++++++----------
 tcg/arm/tcg-target.c.inc         | 25 +++++++++----
 tcg/i386/tcg-target.c.inc        | 60 +++++++++++++++++++++++---------
 tcg/loongarch64/tcg-target.c.inc | 43 ++++++++++++++---------
 tcg/mips/tcg-target.c.inc        | 35 ++++++++++++-------
 tcg/ppc/tcg-target.c.inc         | 42 ++++++++++++----------
 tcg/riscv/tcg-target.c.inc       | 38 +++++++++++---------
 tcg/s390x/tcg-target.c.inc       | 37 ++++++++++++++++----
 tcg/sparc64/tcg-target.c.inc     | 27 ++++++++++----
 tcg/tcg.c                        |  6 ++--
 tcg/tci/tcg-target.c.inc         | 14 ++++++--
 11 files changed, 241 insertions(+), 124 deletions(-)

diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index 8aa11e9d9d..b57baa1eec 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -1347,14 +1347,6 @@ static inline void tcg_out_extr(TCGContext *s, TCGType ext, TCGReg rd,
     tcg_out_insn(s, 3403, EXTR, ext, rd, rn, rm, a);
 }
 
-static inline void tcg_out_shl(TCGContext *s, TCGType ext,
-                               TCGReg rd, TCGReg rn, unsigned int m)
-{
-    int bits = ext ? 64 : 32;
-    int max = bits - 1;
-    tcg_out_ubfm(s, ext, rd, rn, (bits - m) & max, (max - m) & max);
-}
-
 static inline void tcg_out_shr(TCGContext *s, TCGType ext,
                                TCGReg rd, TCGReg rn, unsigned int m)
 {
@@ -2299,6 +2291,25 @@ static const TCGOutOpBinary outop_remu = {
     .out_rrr = tgen_remu,
 };
 
+static void tgen_shl(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_insn(s, 3508, LSLV, type, a0, a1, a2);
+}
+
+static void tgen_shli(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    int max = type == TCG_TYPE_I32 ? 31 : 63;
+    tcg_out_ubfm(s, type, a0, a1, -a2 & max, ~a2 & max);
+}
+
+static const TCGOutOpBinary outop_shl = {
+    .base.static_constraint = C_O1_I2(r, r, ri),
+    .out_rrr = tgen_shl,
+    .out_rri = tgen_shli,
+};
+
 static void tgen_sub(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -2416,15 +2427,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType ext,
         tcg_out_ldst(s, I3312_STRX, a0, a1, a2, 3);
         break;
 
-    case INDEX_op_shl_i64:
-    case INDEX_op_shl_i32:
-        if (c2) {
-            tcg_out_shl(s, ext, a0, a1, a2);
-        } else {
-            tcg_out_insn(s, 3508, LSLV, ext, a0, a1, a2);
-        }
-        break;
-
     case INDEX_op_shr_i64:
     case INDEX_op_shr_i32:
         if (c2) {
@@ -3091,12 +3093,10 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_negsetcond_i64:
         return C_O1_I2(r, r, rC);
 
-    case INDEX_op_shl_i32:
     case INDEX_op_shr_i32:
     case INDEX_op_sar_i32:
     case INDEX_op_rotl_i32:
     case INDEX_op_rotr_i32:
-    case INDEX_op_shl_i64:
     case INDEX_op_shr_i64:
     case INDEX_op_sar_i64:
     case INDEX_op_rotl_i64:
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index c08cd712b1..2b9e52914c 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -1963,6 +1963,25 @@ static const TCGOutOpBinary outop_remu = {
     .base.static_constraint = C_NotImplemented,
 };
 
+static void tgen_shl(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_dat_reg(s, COND_AL, ARITH_MOV, a0, 0, a1, SHIFT_REG_LSL(a2));
+}
+
+static void tgen_shli(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    tcg_out_dat_reg(s, COND_AL, ARITH_MOV, a0, 0, a1,
+                    SHIFT_IMM_LSL(a2 & 0x1f));
+}
+
+static const TCGOutOpBinary outop_shl = {
+    .base.static_constraint = C_O1_I2(r, r, ri),
+    .out_rrr = tgen_shl,
+    .out_rri = tgen_shli,
+};
+
 static void tgen_sub(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -2114,11 +2133,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     case INDEX_op_muls2_i32:
         tcg_out_smull32(s, COND_AL, args[0], args[1], args[2], args[3]);
         break;
-    /* XXX: Perhaps args[2] & 0x1f is wrong */
-    case INDEX_op_shl_i32:
-        c = const_args[2] ?
-                SHIFT_IMM_LSL(args[2] & 0x1f) : SHIFT_REG_LSL(args[2]);
-        goto gen_shift32;
     case INDEX_op_shr_i32:
         c = const_args[2] ? (args[2] & 0x1f) ? SHIFT_IMM_LSR(args[2] & 0x1f) :
                 SHIFT_IMM_LSL(0) : SHIFT_REG_LSR(args[2]);
@@ -2300,7 +2314,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_muls2_i32:
         return C_O2_I2(r, r, r, r);
 
-    case INDEX_op_shl_i32:
     case INDEX_op_shr_i32:
     case INDEX_op_sar_i32:
     case INDEX_op_rotl_i32:
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index 02dd440052..648d9ee66c 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -2744,6 +2744,49 @@ static const TCGOutOpBinary outop_remu = {
     .base.static_constraint = C_NotImplemented,
 };
 
+static TCGConstraintSetIndex cset_shift(TCGType type, unsigned flags)
+{
+    return have_bmi2 ? C_O1_I2(r, r, ri) : C_O1_I2(r, 0, ci);
+}
+
+static void tgen_shl(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    int rexw = type == TCG_TYPE_I32 ? 0 : P_REXW;
+    if (have_bmi2) {
+        tcg_out_vex_modrm(s, OPC_SHLX + rexw, a0, a2, a1);
+    } else {
+        tcg_out_modrm(s, OPC_SHIFT_cl + rexw, SHIFT_SHL, a0);
+    }
+}
+
+static void tgen_shli(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    int rexw = type == TCG_TYPE_I32 ? 0 : P_REXW;
+
+    /* For small constant 3-operand shift, use LEA.  */
+    if (a0 != a1 && a2 >= 1 && a2 <= 3) {
+        if (a2 == 1) {
+            /* shl $1,a1,a0 -> lea (a1,a1),a0 */
+            tcg_out_modrm_sib_offset(s, OPC_LEA + rexw, a0, a1, a1, 0, 0);
+        } else {
+            /* shl $n,a1,a0 -> lea 0(,a1,n),a0 */
+            tcg_out_modrm_sib_offset(s, OPC_LEA + rexw, a0, -1, a1, a2, 0);
+        }
+        return;
+    }
+    tcg_out_mov(s, type, a0, a1);
+    tcg_out_shifti(s, SHIFT_SHL + rexw, a0, a2);
+}
+
+static const TCGOutOpBinary outop_shl = {
+    .base.static_constraint = C_Dynamic,
+    .base.dynamic_constraint = cset_shift,
+    .out_rrr = tgen_shl,
+    .out_rri = tgen_shli,
+};
+
 static void tgen_sub(TCGContext *s, TCGType type,
                       TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -2879,21 +2922,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    OP_32_64(shl):
-        /* For small constant 3-operand shift, use LEA.  */
-        if (const_a2 && a0 != a1 && (a2 - 1) < 3) {
-            if (a2 - 1 == 0) {
-                /* shl $1,a1,a0 -> lea (a1,a1),a0 */
-                tcg_out_modrm_sib_offset(s, OPC_LEA + rexw, a0, a1, a1, 0, 0);
-            } else {
-                /* shl $n,a1,a0 -> lea 0(,a1,n),a0 */
-                tcg_out_modrm_sib_offset(s, OPC_LEA + rexw, a0, -1, a1, a2, 0);
-            }
-            break;
-        }
-        c = SHIFT_SHL;
-        vexop = OPC_SHLX;
-        goto gen_shift_maybe_vex;
     OP_32_64(shr):
         c = SHIFT_SHR;
         vexop = OPC_SHRX;
@@ -3759,8 +3787,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(re, r);
 
-    case INDEX_op_shl_i32:
-    case INDEX_op_shl_i64:
     case INDEX_op_shr_i32:
     case INDEX_op_shr_i64:
     case INDEX_op_sar_i32:
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index a0313b1140..9e34c37e62 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -1489,6 +1489,32 @@ static const TCGOutOpBinary outop_remu = {
     .out_rrr = tgen_remu,
 };
 
+static void tgen_shl(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    if (type == TCG_TYPE_I32) {
+        tcg_out_opc_sll_w(s, a0, a1, a2);
+    } else {
+        tcg_out_opc_sll_d(s, a0, a1, a2);
+    }
+}
+
+static void tgen_shli(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    if (type == TCG_TYPE_I32) {
+        tcg_out_opc_slli_w(s, a0, a1, a2 & 0x1f);
+    } else {
+        tcg_out_opc_slli_d(s, a0, a1, a2 & 0x3f);
+    }
+}
+
+static const TCGOutOpBinary outop_shl = {
+    .base.static_constraint = C_O1_I2(r, r, ri),
+    .out_rrr = tgen_shl,
+    .out_rri = tgen_shli,
+};
+
 static void tgen_sub(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -1660,21 +1686,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_clzctz(s, OPC_CTZ_D, a0, a1, a2, c2, false);
         break;
 
-    case INDEX_op_shl_i32:
-        if (c2) {
-            tcg_out_opc_slli_w(s, a0, a1, a2 & 0x1f);
-        } else {
-            tcg_out_opc_sll_w(s, a0, a1, a2);
-        }
-        break;
-    case INDEX_op_shl_i64:
-        if (c2) {
-            tcg_out_opc_slli_d(s, a0, a1, a2 & 0x3f);
-        } else {
-            tcg_out_opc_sll_d(s, a0, a1, a2);
-        }
-        break;
-
     case INDEX_op_shr_i32:
         if (c2) {
             tcg_out_opc_srli_w(s, a0, a1, a2 & 0x1f);
@@ -2369,8 +2380,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_qemu_ld_i64:
         return C_O1_I1(r, r);
 
-    case INDEX_op_shl_i32:
-    case INDEX_op_shl_i64:
     case INDEX_op_shr_i32:
     case INDEX_op_shr_i64:
     case INDEX_op_sar_i32:
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index bd38c7ab95..30d8872b4f 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -1908,6 +1908,29 @@ static const TCGOutOpBinary outop_remu = {
     .out_rrr = tgen_remu,
 };
 
+static void tgen_shl(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    MIPSInsn insn = type == TCG_TYPE_I32 ? OPC_SLLV : OPC_DSLLV;
+    tcg_out_opc_reg(s, insn, a0, a1, a2);
+}
+
+static void tgen_shli(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    if (type == TCG_TYPE_I32) {
+        tcg_out_opc_sa(s, OPC_SLL, a0, a1, a2);
+    } else {
+        tcg_out_dsll(s, a0, a1, a2);
+    }
+}
+
+static const TCGOutOpBinary outop_shl = {
+    .base.static_constraint = C_O1_I2(r, r, ri),
+    .out_rrr = tgen_shl,
+    .out_rri = tgen_shli,
+};
+
 static void tgen_sub(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -2068,9 +2091,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     case INDEX_op_sar_i32:
         i1 = OPC_SRAV, i2 = OPC_SRA;
         goto do_shift;
-    case INDEX_op_shl_i32:
-        i1 = OPC_SLLV, i2 = OPC_SLL;
-        goto do_shift;
     case INDEX_op_shr_i32:
         i1 = OPC_SRLV, i2 = OPC_SRL;
         goto do_shift;
@@ -2099,13 +2119,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         i1 = OPC_DSRAV;
         goto do_shiftv;
-    case INDEX_op_shl_i64:
-        if (c2) {
-            tcg_out_dsll(s, a0, a1, a2);
-            break;
-        }
-        i1 = OPC_DSLLV;
-        goto do_shiftv;
     case INDEX_op_shr_i64:
         if (c2) {
             tcg_out_dsrl(s, a0, a1, a2);
@@ -2293,12 +2306,10 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_muls2_i64:
     case INDEX_op_mulu2_i64:
         return C_O2_I2(r, r, r, r);
-    case INDEX_op_shl_i32:
     case INDEX_op_shr_i32:
     case INDEX_op_sar_i32:
     case INDEX_op_rotr_i32:
     case INDEX_op_rotl_i32:
-    case INDEX_op_shl_i64:
     case INDEX_op_shr_i64:
     case INDEX_op_sar_i64:
     case INDEX_op_rotr_i64:
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index 80ee4d04c9..88cfcd1d91 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -3122,6 +3122,30 @@ static const TCGOutOpBinary outop_remu = {
     .out_rrr = tgen_remu,
 };
 
+static void tgen_shl(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    uint32_t insn = type == TCG_TYPE_I32 ? SLW : SLD;
+    tcg_out32(s, insn | SAB(a1, a0, a2));
+}
+
+static void tgen_shli(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    /* Limit immediate shift count lest we create an illegal insn.  */
+    if (type == TCG_TYPE_I32) {
+        tcg_out_shli32(s, a0, a1, a2 & 31);
+    } else {
+        tcg_out_shli64(s, a0, a1, a2 & 63);
+    }
+}
+
+static const TCGOutOpBinary outop_shl = {
+    .base.static_constraint = C_O1_I2(r, r, ri),
+    .out_rrr = tgen_shl,
+    .out_rri = tgen_shli,
+};
+
 static void tgen_sub(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -3272,14 +3296,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out32(s, CNTPOPD | SAB(args[1], args[0], 0));
         break;
 
-    case INDEX_op_shl_i32:
-        if (const_args[2]) {
-            /* Limit immediate shift count lest we create an illegal insn.  */
-            tcg_out_shli32(s, args[0], args[1], args[2] & 31);
-        } else {
-            tcg_out32(s, SLW | SAB(args[1], args[0], args[2]));
-        }
-        break;
     case INDEX_op_shr_i32:
         if (const_args[2]) {
             /* Limit immediate shift count lest we create an illegal insn.  */
@@ -3325,14 +3341,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_brcond2(s, args, const_args);
         break;
 
-    case INDEX_op_shl_i64:
-        if (const_args[2]) {
-            /* Limit immediate shift count lest we create an illegal insn.  */
-            tcg_out_shli64(s, args[0], args[1], args[2] & 63);
-        } else {
-            tcg_out32(s, SLD | SAB(args[1], args[0], args[2]));
-        }
-        break;
     case INDEX_op_shr_i64:
         if (const_args[2]) {
             /* Limit immediate shift count lest we create an illegal insn.  */
@@ -4206,12 +4214,10 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(r, r);
 
-    case INDEX_op_shl_i32:
     case INDEX_op_shr_i32:
     case INDEX_op_sar_i32:
     case INDEX_op_rotl_i32:
     case INDEX_op_rotr_i32:
-    case INDEX_op_shl_i64:
     case INDEX_op_shr_i64:
     case INDEX_op_sar_i64:
     case INDEX_op_rotl_i64:
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index 38ba898042..372c4e1651 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -2144,6 +2144,27 @@ static const TCGOutOpBinary outop_remu = {
     .out_rrr = tgen_remu,
 };
 
+static void tgen_shl(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    RISCVInsn insn = type == TCG_TYPE_I32 ? OPC_SLLW : OPC_SLL;
+    tcg_out_opc_reg(s, insn, a0, a1, a2);
+}
+
+static void tgen_shli(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    RISCVInsn insn = type == TCG_TYPE_I32 ? OPC_SLLIW : OPC_SLLI;
+    unsigned mask = type == TCG_TYPE_I32 ? 31 : 63;
+    tcg_out_opc_imm(s, insn, a0, a1, a2 & mask);
+}
+
+static const TCGOutOpBinary outop_shl = {
+    .base.static_constraint = C_O1_I2(r, r, ri),
+    .out_rrr = tgen_shl,
+    .out_rri = tgen_shli,
+};
+
 static void tgen_sub(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -2257,21 +2278,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_ldst(s, OPC_SD, a0, a1, a2);
         break;
 
-    case INDEX_op_shl_i32:
-        if (c2) {
-            tcg_out_opc_imm(s, OPC_SLLIW, a0, a1, a2 & 0x1f);
-        } else {
-            tcg_out_opc_reg(s, OPC_SLLW, a0, a1, a2);
-        }
-        break;
-    case INDEX_op_shl_i64:
-        if (c2) {
-            tcg_out_opc_imm(s, OPC_SLLI, a0, a1, a2 & 0x3f);
-        } else {
-            tcg_out_opc_reg(s, OPC_SLL, a0, a1, a2);
-        }
-        break;
-
     case INDEX_op_shr_i32:
         if (c2) {
             tcg_out_opc_imm(s, OPC_SRLIW, a0, a1, a2 & 0x1f);
@@ -2758,12 +2764,10 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_negsetcond_i64:
         return C_O1_I2(r, r, rI);
 
-    case INDEX_op_shl_i32:
     case INDEX_op_shr_i32:
     case INDEX_op_sar_i32:
     case INDEX_op_rotl_i32:
     case INDEX_op_rotr_i32:
-    case INDEX_op_shl_i64:
     case INDEX_op_shr_i64:
     case INDEX_op_sar_i64:
     case INDEX_op_rotl_i64:
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index 8702d8c928..ed68054664 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -2445,6 +2445,36 @@ static const TCGOutOpBinary outop_remu = {
     .base.static_constraint = C_NotImplemented,
 };
 
+static void tgen_shl_int(TCGContext *s, TCGType type, TCGReg dst,
+                         TCGReg src, TCGReg v, tcg_target_long i)
+{
+    if (type != TCG_TYPE_I32) {
+        tcg_out_sh64(s, RSY_SLLG, dst, src, v, i);
+    } else if (dst == src) {
+        tcg_out_sh32(s, RS_SLL, dst, v, i);
+    } else {
+        tcg_out_sh64(s, RSY_SLLK, dst, src, v, i);
+    }
+}
+
+static void tgen_shl(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tgen_shl_int(s, type, a0, a1, a2, 0);
+}
+
+static void tgen_shli(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    tgen_shl_int(s, type, a0, a1, TCG_REG_NONE, a2);
+}
+
+static const TCGOutOpBinary outop_shl = {
+    .base.static_constraint = C_O1_I2(r, r, ri),
+    .out_rrr = tgen_shl,
+    .out_rri = tgen_shli,
+};
+
 static void tgen_sub(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -2574,9 +2604,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_st(s, TCG_TYPE_I32, args[0], args[1], args[2]);
         break;
 
-    case INDEX_op_shl_i32:
-        op = RS_SLL;
-        op2 = RSY_SLLK;
     do_shift32:
         a0 = args[0], a1 = args[1], a2 = (int32_t)args[2];
         if (a0 == a1) {
@@ -2746,8 +2773,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_insn(s, RRFa, MGRK, args[1], args[2], args[3]);
         break;
 
-    case INDEX_op_shl_i64:
-        op = RSY_SLLG;
     do_shift64:
         if (const_args[2]) {
             tcg_out_sh64(s, op, args[0], args[1], TCG_REG_NONE, args[2]);
@@ -3346,7 +3371,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(r, r);
 
-    case INDEX_op_shl_i64:
     case INDEX_op_shr_i64:
     case INDEX_op_sar_i64:
     case INDEX_op_rotl_i32:
@@ -3363,7 +3387,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_clz_i64:
         return C_O1_I2(r, r, rI);
 
-    case INDEX_op_shl_i32:
     case INDEX_op_shr_i32:
     case INDEX_op_sar_i32:
         return C_O1_I2(r, r, ri);
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index d465c8dd06..6b320a8622 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -1484,6 +1484,27 @@ static const TCGOutOpBinary outop_remu = {
     .base.static_constraint = C_NotImplemented,
 };
 
+static void tgen_shl(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    uint32_t insn = type == TCG_TYPE_I32 ? SHIFT_SLL : SHIFT_SLLX;
+    tcg_out_arith(s, a0, a1, a2, insn);
+}
+
+static void tgen_shli(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    uint32_t insn = type == TCG_TYPE_I32 ? SHIFT_SLL : SHIFT_SLLX;
+    uint32_t mask = type == TCG_TYPE_I32 ? 31 : 63;
+    tcg_out_arithi(s, a0, a1, a2 & mask, insn);
+}
+
+static const TCGOutOpBinary outop_shl = {
+    .base.static_constraint = C_O1_I2(r, r, rJ),
+    .out_rrr = tgen_shl,
+    .out_rri = tgen_shli,
+};
+
 static void tgen_sub(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -1587,8 +1608,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     case INDEX_op_st32_i64:
         tcg_out_ldst(s, a0, a1, a2, STW);
         break;
-    case INDEX_op_shl_i32:
-        c = SHIFT_SLL;
     do_shift32:
         /* Limit immediate shift count lest we create an illegal insn.  */
         tcg_out_arithc(s, a0, a1, a2 & 31, c2, c);
@@ -1656,8 +1675,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     case INDEX_op_st_i64:
         tcg_out_ldst(s, a0, a1, a2, STX);
         break;
-    case INDEX_op_shl_i64:
-        c = SHIFT_SLLX;
     do_shift64:
         /* Limit immediate shift count lest we create an illegal insn.  */
         tcg_out_arithc(s, a0, a1, a2 & 63, c2, c);
@@ -1751,8 +1768,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_qemu_st_i64:
         return C_O0_I2(rz, r);
 
-    case INDEX_op_shl_i32:
-    case INDEX_op_shl_i64:
     case INDEX_op_shr_i32:
     case INDEX_op_shr_i64:
     case INDEX_op_sar_i32:
diff --git a/tcg/tcg.c b/tcg/tcg.c
index cd89ef1faa..369a1e6d48 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1042,6 +1042,8 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_orc, TCGOutOpBinary, outop_orc),
     OUTOP(INDEX_op_rems, TCGOutOpBinary, outop_rems),
     OUTOP(INDEX_op_remu, TCGOutOpBinary, outop_remu),
+    OUTOP(INDEX_op_shl_i32, TCGOutOpBinary, outop_shl),
+    OUTOP(INDEX_op_shl_i64, TCGOutOpBinary, outop_shl),
     OUTOP(INDEX_op_sub, TCGOutOpSubtract, outop_sub),
     OUTOP(INDEX_op_xor, TCGOutOpBinary, outop_xor),
 };
@@ -2262,7 +2264,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st8_i32:
     case INDEX_op_st16_i32:
     case INDEX_op_st_i32:
-    case INDEX_op_shl_i32:
     case INDEX_op_shr_i32:
     case INDEX_op_sar_i32:
     case INDEX_op_extract_i32:
@@ -2314,7 +2315,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st16_i64:
     case INDEX_op_st32_i64:
     case INDEX_op_st_i64:
-    case INDEX_op_shl_i64:
     case INDEX_op_shr_i64:
     case INDEX_op_sar_i64:
     case INDEX_op_ext_i32_i64:
@@ -5423,6 +5423,8 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
     case INDEX_op_orc:
     case INDEX_op_rems:
     case INDEX_op_remu:
+    case INDEX_op_shl_i32:
+    case INDEX_op_shl_i64:
     case INDEX_op_xor:
         {
             const TCGOutOpBinary *out =
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index eb30fd04ba..748bb8118f 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -79,8 +79,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(r, r);
 
-    case INDEX_op_shl_i32:
-    case INDEX_op_shl_i64:
     case INDEX_op_shr_i32:
     case INDEX_op_shr_i64:
     case INDEX_op_sar_i32:
@@ -778,6 +776,17 @@ static const TCGOutOpBinary outop_remu = {
     .out_rrr = tgen_remu,
 };
 
+static void tgen_shl(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_op_rrr(s, glue(INDEX_op_shl_i,TCG_TARGET_REG_BITS), a0, a1, a2);
+}
+
+static const TCGOutOpBinary outop_shl = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_shl,
+};
+
 static void tgen_sub(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -862,7 +871,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_ldst(s, opc, args[0], args[1], args[2]);
         break;
 
-    CASE_32_64(shl)
     CASE_32_64(shr)
     CASE_32_64(sar)
     CASE_32_64(rotl)     /* Optional (TCG_TARGET_HAS_rot_*). */

From 6ca594517ab389f3095c4aab745e168cdd8e8ff5 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 7 Jan 2025 21:50:04 -0800
Subject: [PATCH 0413/2760] tcg: Merge INDEX_op_shl_{i32,i64}
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 docs/devel/tcg-ops.rst   |  4 ++--
 include/tcg/tcg-opc.h    |  3 +--
 tcg/optimize.c           | 10 +++++-----
 tcg/tcg-op.c             |  4 ++--
 tcg/tcg.c                |  6 ++----
 tcg/tci.c                | 13 ++++---------
 tcg/tci/tcg-target.c.inc |  2 +-
 7 files changed, 17 insertions(+), 25 deletions(-)

diff --git a/docs/devel/tcg-ops.rst b/docs/devel/tcg-ops.rst
index bceecb0596..f64c881530 100644
--- a/docs/devel/tcg-ops.rst
+++ b/docs/devel/tcg-ops.rst
@@ -379,10 +379,10 @@ Shifts/Rotates
 
 .. list-table::
 
-   * - shl_i32/i64 *t0*, *t1*, *t2*
+   * - shl *t0*, *t1*, *t2*
 
      - | *t0* = *t1* << *t2*
-       | Unspecified behavior if *t2* < 0 or *t2* >= 32 (resp 64)
+       | Unspecified behavior for negative or out-of-range shifts.
 
    * - shr_i32/i64 *t0*, *t1*, *t2*
 
diff --git a/include/tcg/tcg-opc.h b/include/tcg/tcg-opc.h
index ebb23347e9..c2ac25d1b6 100644
--- a/include/tcg/tcg-opc.h
+++ b/include/tcg/tcg-opc.h
@@ -58,6 +58,7 @@ DEF(or, 1, 2, 0, TCG_OPF_INT)
 DEF(orc, 1, 2, 0, TCG_OPF_INT)
 DEF(rems, 1, 2, 0, TCG_OPF_INT)
 DEF(remu, 1, 2, 0, TCG_OPF_INT)
+DEF(shl, 1, 2, 0, TCG_OPF_INT)
 DEF(sub, 1, 2, 0, TCG_OPF_INT)
 DEF(xor, 1, 2, 0, TCG_OPF_INT)
 
@@ -74,7 +75,6 @@ DEF(st8_i32, 0, 2, 1, 0)
 DEF(st16_i32, 0, 2, 1, 0)
 DEF(st_i32, 0, 2, 1, 0)
 /* shifts/rotates */
-DEF(shl_i32, 1, 2, 0, 0)
 DEF(shr_i32, 1, 2, 0, 0)
 DEF(sar_i32, 1, 2, 0, 0)
 DEF(rotl_i32, 1, 2, 0, 0)
@@ -115,7 +115,6 @@ DEF(st16_i64, 0, 2, 1, 0)
 DEF(st32_i64, 0, 2, 1, 0)
 DEF(st_i64, 0, 2, 1, 0)
 /* shifts/rotates */
-DEF(shl_i64, 1, 2, 0, 0)
 DEF(shr_i64, 1, 2, 0, 0)
 DEF(sar_i64, 1, 2, 0, 0)
 DEF(rotl_i64, 1, 2, 0, 0)
diff --git a/tcg/optimize.c b/tcg/optimize.c
index 69f9ba1555..3142daa800 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -446,10 +446,10 @@ static uint64_t do_constant_folding_2(TCGOpcode op, TCGType type,
     case INDEX_op_xor_vec:
         return x ^ y;
 
-    case INDEX_op_shl_i32:
-        return (uint32_t)x << (y & 31);
-
-    case INDEX_op_shl_i64:
+    case INDEX_op_shl:
+        if (type == TCG_TYPE_I32) {
+            return (uint32_t)x << (y & 31);
+        }
         return (uint64_t)x << (y & 63);
 
     case INDEX_op_shr_i32:
@@ -3031,7 +3031,7 @@ void tcg_optimize(TCGContext *s)
         CASE_OP_32_64(rotl):
         CASE_OP_32_64(rotr):
         CASE_OP_32_64(sar):
-        CASE_OP_32_64(shl):
+        case INDEX_op_shl:
         CASE_OP_32_64(shr):
             done = fold_shift(&ctx, op);
             break;
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index 0f1e83a49f..c85c056726 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -481,7 +481,7 @@ void tcg_gen_not_i32(TCGv_i32 ret, TCGv_i32 arg)
 
 void tcg_gen_shl_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 {
-    tcg_gen_op3_i32(INDEX_op_shl_i32, ret, arg1, arg2);
+    tcg_gen_op3_i32(INDEX_op_shl, ret, arg1, arg2);
 }
 
 void tcg_gen_shli_i32(TCGv_i32 ret, TCGv_i32 arg1, int32_t arg2)
@@ -1606,7 +1606,7 @@ void tcg_gen_xor_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
 void tcg_gen_shl_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
 {
     if (TCG_TARGET_REG_BITS == 64) {
-        tcg_gen_op3_i64(INDEX_op_shl_i64, ret, arg1, arg2);
+        tcg_gen_op3_i64(INDEX_op_shl, ret, arg1, arg2);
     } else {
         gen_helper_shl_i64(ret, arg1, arg2);
     }
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 369a1e6d48..50935b7e03 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1042,8 +1042,7 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_orc, TCGOutOpBinary, outop_orc),
     OUTOP(INDEX_op_rems, TCGOutOpBinary, outop_rems),
     OUTOP(INDEX_op_remu, TCGOutOpBinary, outop_remu),
-    OUTOP(INDEX_op_shl_i32, TCGOutOpBinary, outop_shl),
-    OUTOP(INDEX_op_shl_i64, TCGOutOpBinary, outop_shl),
+    OUTOP(INDEX_op_shl, TCGOutOpBinary, outop_shl),
     OUTOP(INDEX_op_sub, TCGOutOpSubtract, outop_sub),
     OUTOP(INDEX_op_xor, TCGOutOpBinary, outop_xor),
 };
@@ -5423,8 +5422,7 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
     case INDEX_op_orc:
     case INDEX_op_rems:
     case INDEX_op_remu:
-    case INDEX_op_shl_i32:
-    case INDEX_op_shl_i64:
+    case INDEX_op_shl:
     case INDEX_op_xor:
         {
             const TCGOutOpBinary *out =
diff --git a/tcg/tci.c b/tcg/tci.c
index 5d2cba4941..22401ce1f6 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -615,11 +615,11 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             break;
 #endif
 
-            /* Shift/rotate operations (32 bit). */
+            /* Shift/rotate operations. */
 
-        case INDEX_op_shl_i32:
+        case INDEX_op_shl:
             tci_args_rrr(insn, &r0, &r1, &r2);
-            regs[r0] = (uint32_t)regs[r1] << (regs[r2] & 31);
+            regs[r0] = regs[r1] << (regs[r2] % TCG_TARGET_REG_BITS);
             break;
         case INDEX_op_shr_i32:
             tci_args_rrr(insn, &r0, &r1, &r2);
@@ -787,10 +787,6 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
 
             /* Shift/rotate operations (64 bit). */
 
-        case INDEX_op_shl_i64:
-            tci_args_rrr(insn, &r0, &r1, &r2);
-            regs[r0] = regs[r1] << (regs[r2] & 63);
-            break;
         case INDEX_op_shr_i64:
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = regs[r1] >> (regs[r2] & 63);
@@ -1081,10 +1077,9 @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
     case INDEX_op_orc:
     case INDEX_op_rems:
     case INDEX_op_remu:
+    case INDEX_op_shl:
     case INDEX_op_sub:
     case INDEX_op_xor:
-    case INDEX_op_shl_i32:
-    case INDEX_op_shl_i64:
     case INDEX_op_shr_i32:
     case INDEX_op_shr_i64:
     case INDEX_op_sar_i32:
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index 748bb8118f..ca83a097ab 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -779,7 +779,7 @@ static const TCGOutOpBinary outop_remu = {
 static void tgen_shl(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
-    tcg_out_op_rrr(s, glue(INDEX_op_shl_i,TCG_TARGET_REG_BITS), a0, a1, a2);
+    tcg_out_op_rrr(s, INDEX_op_shl, a0, a1, a2);
 }
 
 static const TCGOutOpBinary outop_shl = {

From edd6ba8a6bc804153a8fe643a7e2dae0802db98c Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 7 Jan 2025 22:22:36 -0800
Subject: [PATCH 0414/2760] tcg: Convert shr to TCGOutOpBinary

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target.c.inc     | 37 ++++++++++++++-------------
 tcg/arm/tcg-target.c.inc         | 24 ++++++++++++++----
 tcg/i386/tcg-target.c.inc        | 33 +++++++++++++++++++-----
 tcg/loongarch64/tcg-target.c.inc | 43 +++++++++++++++++++-------------
 tcg/mips/tcg-target.c.inc        | 35 +++++++++++++++++---------
 tcg/ppc/tcg-target.c.inc         | 42 ++++++++++++++++++-------------
 tcg/riscv/tcg-target.c.inc       | 38 +++++++++++++++-------------
 tcg/s390x/tcg-target.c.inc       | 39 ++++++++++++++++++++++-------
 tcg/sparc64/tcg-target.c.inc     | 29 +++++++++++++++------
 tcg/tcg.c                        |  6 +++--
 tcg/tci/tcg-target.c.inc         | 18 ++++++++++---
 11 files changed, 229 insertions(+), 115 deletions(-)

diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index b57baa1eec..87b97e852a 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -1347,13 +1347,6 @@ static inline void tcg_out_extr(TCGContext *s, TCGType ext, TCGReg rd,
     tcg_out_insn(s, 3403, EXTR, ext, rd, rn, rm, a);
 }
 
-static inline void tcg_out_shr(TCGContext *s, TCGType ext,
-                               TCGReg rd, TCGReg rn, unsigned int m)
-{
-    int max = ext ? 63 : 31;
-    tcg_out_ubfm(s, ext, rd, rn, m & max, max);
-}
-
 static inline void tcg_out_sar(TCGContext *s, TCGType ext,
                                TCGReg rd, TCGReg rn, unsigned int m)
 {
@@ -2310,6 +2303,25 @@ static const TCGOutOpBinary outop_shl = {
     .out_rri = tgen_shli,
 };
 
+static void tgen_shr(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_insn(s, 3508, LSRV, type, a0, a1, a2);
+}
+
+static void tgen_shri(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    int max = type == TCG_TYPE_I32 ? 31 : 63;
+    tcg_out_ubfm(s, type, a0, a1, a2 & max, max);
+}
+
+static const TCGOutOpBinary outop_shr = {
+    .base.static_constraint = C_O1_I2(r, r, ri),
+    .out_rrr = tgen_shr,
+    .out_rri = tgen_shri,
+};
+
 static void tgen_sub(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -2427,15 +2439,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType ext,
         tcg_out_ldst(s, I3312_STRX, a0, a1, a2, 3);
         break;
 
-    case INDEX_op_shr_i64:
-    case INDEX_op_shr_i32:
-        if (c2) {
-            tcg_out_shr(s, ext, a0, a1, a2);
-        } else {
-            tcg_out_insn(s, 3508, LSRV, ext, a0, a1, a2);
-        }
-        break;
-
     case INDEX_op_sar_i64:
     case INDEX_op_sar_i32:
         if (c2) {
@@ -3093,11 +3096,9 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_negsetcond_i64:
         return C_O1_I2(r, r, rC);
 
-    case INDEX_op_shr_i32:
     case INDEX_op_sar_i32:
     case INDEX_op_rotl_i32:
     case INDEX_op_rotr_i32:
-    case INDEX_op_shr_i64:
     case INDEX_op_sar_i64:
     case INDEX_op_rotl_i64:
     case INDEX_op_rotr_i64:
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index 2b9e52914c..247aefd0a1 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -1982,6 +1982,25 @@ static const TCGOutOpBinary outop_shl = {
     .out_rri = tgen_shli,
 };
 
+static void tgen_shr(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_dat_reg(s, COND_AL, ARITH_MOV, a0, 0, a1, SHIFT_REG_LSR(a2));
+}
+
+static void tgen_shri(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    tcg_out_dat_reg(s, COND_AL, ARITH_MOV, a0, 0, a1,
+                    SHIFT_IMM_LSR(a2 & 0x1f));
+}
+
+static const TCGOutOpBinary outop_shr = {
+    .base.static_constraint = C_O1_I2(r, r, ri),
+    .out_rrr = tgen_shr,
+    .out_rri = tgen_shri,
+};
+
 static void tgen_sub(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -2133,10 +2152,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     case INDEX_op_muls2_i32:
         tcg_out_smull32(s, COND_AL, args[0], args[1], args[2], args[3]);
         break;
-    case INDEX_op_shr_i32:
-        c = const_args[2] ? (args[2] & 0x1f) ? SHIFT_IMM_LSR(args[2] & 0x1f) :
-                SHIFT_IMM_LSL(0) : SHIFT_REG_LSR(args[2]);
-        goto gen_shift32;
     case INDEX_op_sar_i32:
         c = const_args[2] ? (args[2] & 0x1f) ? SHIFT_IMM_ASR(args[2] & 0x1f) :
                 SHIFT_IMM_LSL(0) : SHIFT_REG_ASR(args[2]);
@@ -2314,7 +2329,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_muls2_i32:
         return C_O2_I2(r, r, r, r);
 
-    case INDEX_op_shr_i32:
     case INDEX_op_sar_i32:
     case INDEX_op_rotl_i32:
     case INDEX_op_rotr_i32:
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index 648d9ee66c..93d94e7881 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -2787,6 +2787,33 @@ static const TCGOutOpBinary outop_shl = {
     .out_rri = tgen_shli,
 };
 
+static void tgen_shr(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    int rexw = type == TCG_TYPE_I32 ? 0 : P_REXW;
+    if (have_bmi2) {
+        tcg_out_vex_modrm(s, OPC_SHRX + rexw, a0, a2, a1);
+    } else {
+        tcg_out_modrm(s, OPC_SHIFT_cl + rexw, SHIFT_SHR, a0);
+    }
+}
+
+static void tgen_shri(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    int rexw = type == TCG_TYPE_I32 ? 0 : P_REXW;
+
+    tcg_out_mov(s, type, a0, a1);
+    tcg_out_shifti(s, SHIFT_SHR + rexw, a0, a2);
+}
+
+static const TCGOutOpBinary outop_shr = {
+    .base.static_constraint = C_Dynamic,
+    .base.dynamic_constraint = cset_shift,
+    .out_rrr = tgen_shr,
+    .out_rri = tgen_shri,
+};
+
 static void tgen_sub(TCGContext *s, TCGType type,
                       TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -2922,10 +2949,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    OP_32_64(shr):
-        c = SHIFT_SHR;
-        vexop = OPC_SHRX;
-        goto gen_shift_maybe_vex;
     OP_32_64(sar):
         c = SHIFT_SAR;
         vexop = OPC_SARX;
@@ -3787,8 +3810,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(re, r);
 
-    case INDEX_op_shr_i32:
-    case INDEX_op_shr_i64:
     case INDEX_op_sar_i32:
     case INDEX_op_sar_i64:
         return have_bmi2 ? C_O1_I2(r, r, ri) : C_O1_I2(r, 0, ci);
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index 9e34c37e62..2699079073 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -1515,6 +1515,32 @@ static const TCGOutOpBinary outop_shl = {
     .out_rri = tgen_shli,
 };
 
+static void tgen_shr(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    if (type == TCG_TYPE_I32) {
+        tcg_out_opc_srl_w(s, a0, a1, a2);
+    } else {
+        tcg_out_opc_srl_d(s, a0, a1, a2);
+    }
+}
+
+static void tgen_shri(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    if (type == TCG_TYPE_I32) {
+        tcg_out_opc_srli_w(s, a0, a1, a2 & 0x1f);
+    } else {
+        tcg_out_opc_srli_d(s, a0, a1, a2 & 0x3f);
+    }
+}
+
+static const TCGOutOpBinary outop_shr = {
+    .base.static_constraint = C_O1_I2(r, r, ri),
+    .out_rrr = tgen_shr,
+    .out_rri = tgen_shri,
+};
+
 static void tgen_sub(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -1686,21 +1712,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_clzctz(s, OPC_CTZ_D, a0, a1, a2, c2, false);
         break;
 
-    case INDEX_op_shr_i32:
-        if (c2) {
-            tcg_out_opc_srli_w(s, a0, a1, a2 & 0x1f);
-        } else {
-            tcg_out_opc_srl_w(s, a0, a1, a2);
-        }
-        break;
-    case INDEX_op_shr_i64:
-        if (c2) {
-            tcg_out_opc_srli_d(s, a0, a1, a2 & 0x3f);
-        } else {
-            tcg_out_opc_srl_d(s, a0, a1, a2);
-        }
-        break;
-
     case INDEX_op_sar_i32:
         if (c2) {
             tcg_out_opc_srai_w(s, a0, a1, a2 & 0x1f);
@@ -2380,8 +2391,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_qemu_ld_i64:
         return C_O1_I1(r, r);
 
-    case INDEX_op_shr_i32:
-    case INDEX_op_shr_i64:
     case INDEX_op_sar_i32:
     case INDEX_op_sar_i64:
     case INDEX_op_rotl_i32:
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index 30d8872b4f..03b4248ea9 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -1931,6 +1931,29 @@ static const TCGOutOpBinary outop_shl = {
     .out_rri = tgen_shli,
 };
 
+static void tgen_shr(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    MIPSInsn insn = type == TCG_TYPE_I32 ? OPC_SRLV : OPC_DSRLV;
+    tcg_out_opc_reg(s, insn, a0, a1, a2);
+}
+
+static void tgen_shri(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    if (type == TCG_TYPE_I32) {
+        tcg_out_opc_sa(s, OPC_SRL, a0, a1, a2);
+    } else {
+        tcg_out_dsrl(s, a0, a1, a2);
+    }
+}
+
+static const TCGOutOpBinary outop_shr = {
+    .base.static_constraint = C_O1_I2(r, r, ri),
+    .out_rrr = tgen_shr,
+    .out_rri = tgen_shri,
+};
+
 static void tgen_sub(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -2091,9 +2114,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     case INDEX_op_sar_i32:
         i1 = OPC_SRAV, i2 = OPC_SRA;
         goto do_shift;
-    case INDEX_op_shr_i32:
-        i1 = OPC_SRLV, i2 = OPC_SRL;
-        goto do_shift;
     case INDEX_op_rotr_i32:
         i1 = OPC_ROTRV, i2 = OPC_ROTR;
     do_shift:
@@ -2119,13 +2139,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         i1 = OPC_DSRAV;
         goto do_shiftv;
-    case INDEX_op_shr_i64:
-        if (c2) {
-            tcg_out_dsrl(s, a0, a1, a2);
-            break;
-        }
-        i1 = OPC_DSRLV;
-        goto do_shiftv;
     case INDEX_op_rotr_i64:
         if (c2) {
             tcg_out_opc_sa64(s, OPC_DROTR, OPC_DROTR32, a0, a1, a2);
@@ -2306,11 +2319,9 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_muls2_i64:
     case INDEX_op_mulu2_i64:
         return C_O2_I2(r, r, r, r);
-    case INDEX_op_shr_i32:
     case INDEX_op_sar_i32:
     case INDEX_op_rotr_i32:
     case INDEX_op_rotl_i32:
-    case INDEX_op_shr_i64:
     case INDEX_op_sar_i64:
     case INDEX_op_rotr_i64:
     case INDEX_op_rotl_i64:
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index 88cfcd1d91..2012734bb3 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -3146,6 +3146,30 @@ static const TCGOutOpBinary outop_shl = {
     .out_rri = tgen_shli,
 };
 
+static void tgen_shr(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    uint32_t insn = type == TCG_TYPE_I32 ? SRW : SRD;
+    tcg_out32(s, insn | SAB(a1, a0, a2));
+}
+
+static void tgen_shri(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    /* Limit immediate shift count lest we create an illegal insn.  */
+    if (type == TCG_TYPE_I32) {
+        tcg_out_shri32(s, a0, a1, a2 & 31);
+    } else {
+        tcg_out_shri64(s, a0, a1, a2 & 63);
+    }
+}
+
+static const TCGOutOpBinary outop_shr = {
+    .base.static_constraint = C_O1_I2(r, r, ri),
+    .out_rrr = tgen_shr,
+    .out_rri = tgen_shri,
+};
+
 static void tgen_sub(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -3296,14 +3320,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out32(s, CNTPOPD | SAB(args[1], args[0], 0));
         break;
 
-    case INDEX_op_shr_i32:
-        if (const_args[2]) {
-            /* Limit immediate shift count lest we create an illegal insn.  */
-            tcg_out_shri32(s, args[0], args[1], args[2] & 31);
-        } else {
-            tcg_out32(s, SRW | SAB(args[1], args[0], args[2]));
-        }
-        break;
     case INDEX_op_sar_i32:
         if (const_args[2]) {
             tcg_out_sari32(s, args[0], args[1], args[2]);
@@ -3341,14 +3357,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_brcond2(s, args, const_args);
         break;
 
-    case INDEX_op_shr_i64:
-        if (const_args[2]) {
-            /* Limit immediate shift count lest we create an illegal insn.  */
-            tcg_out_shri64(s, args[0], args[1], args[2] & 63);
-        } else {
-            tcg_out32(s, SRD | SAB(args[1], args[0], args[2]));
-        }
-        break;
     case INDEX_op_sar_i64:
         if (const_args[2]) {
             tcg_out_sari64(s, args[0], args[1], args[2]);
@@ -4214,11 +4222,9 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(r, r);
 
-    case INDEX_op_shr_i32:
     case INDEX_op_sar_i32:
     case INDEX_op_rotl_i32:
     case INDEX_op_rotr_i32:
-    case INDEX_op_shr_i64:
     case INDEX_op_sar_i64:
     case INDEX_op_rotl_i64:
     case INDEX_op_rotr_i64:
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index 372c4e1651..8020cc0b3f 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -2165,6 +2165,27 @@ static const TCGOutOpBinary outop_shl = {
     .out_rri = tgen_shli,
 };
 
+static void tgen_shr(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    RISCVInsn insn = type == TCG_TYPE_I32 ? OPC_SRLW : OPC_SRL;
+    tcg_out_opc_reg(s, insn, a0, a1, a2);
+}
+
+static void tgen_shri(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    RISCVInsn insn = type == TCG_TYPE_I32 ? OPC_SRLIW : OPC_SRLI;
+    unsigned mask = type == TCG_TYPE_I32 ? 31 : 63;
+    tcg_out_opc_imm(s, insn, a0, a1, a2 & mask);
+}
+
+static const TCGOutOpBinary outop_shr = {
+    .base.static_constraint = C_O1_I2(r, r, ri),
+    .out_rrr = tgen_shr,
+    .out_rri = tgen_shri,
+};
+
 static void tgen_sub(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -2278,21 +2299,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_ldst(s, OPC_SD, a0, a1, a2);
         break;
 
-    case INDEX_op_shr_i32:
-        if (c2) {
-            tcg_out_opc_imm(s, OPC_SRLIW, a0, a1, a2 & 0x1f);
-        } else {
-            tcg_out_opc_reg(s, OPC_SRLW, a0, a1, a2);
-        }
-        break;
-    case INDEX_op_shr_i64:
-        if (c2) {
-            tcg_out_opc_imm(s, OPC_SRLI, a0, a1, a2 & 0x3f);
-        } else {
-            tcg_out_opc_reg(s, OPC_SRL, a0, a1, a2);
-        }
-        break;
-
     case INDEX_op_sar_i32:
         if (c2) {
             tcg_out_opc_imm(s, OPC_SRAIW, a0, a1, a2 & 0x1f);
@@ -2764,11 +2770,9 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_negsetcond_i64:
         return C_O1_I2(r, r, rI);
 
-    case INDEX_op_shr_i32:
     case INDEX_op_sar_i32:
     case INDEX_op_rotl_i32:
     case INDEX_op_rotr_i32:
-    case INDEX_op_shr_i64:
     case INDEX_op_sar_i64:
     case INDEX_op_rotl_i64:
     case INDEX_op_rotr_i64:
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index ed68054664..0417bbef50 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -2475,6 +2475,36 @@ static const TCGOutOpBinary outop_shl = {
     .out_rri = tgen_shli,
 };
 
+static void tgen_shr_int(TCGContext *s, TCGType type, TCGReg dst,
+                         TCGReg src, TCGReg v, tcg_target_long i)
+{
+    if (type != TCG_TYPE_I32) {
+        tcg_out_sh64(s, RSY_SRLG, dst, src, v, i);
+    } else if (dst == src) {
+        tcg_out_sh32(s, RS_SRL, dst, v, i);
+    } else {
+        tcg_out_sh64(s, RSY_SRLK, dst, src, v, i);
+    }
+}
+
+static void tgen_shr(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tgen_shr_int(s, type, a0, a1, a2, 0);
+}
+
+static void tgen_shri(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    tgen_shr_int(s, type, a0, a1, TCG_REG_NONE, a2);
+}
+
+static const TCGOutOpBinary outop_shr = {
+    .base.static_constraint = C_O1_I2(r, r, ri),
+    .out_rrr = tgen_shr,
+    .out_rri = tgen_shri,
+};
+
 static void tgen_sub(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -2621,10 +2651,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
             }
         }
         break;
-    case INDEX_op_shr_i32:
-        op = RS_SRL;
-        op2 = RSY_SRLK;
-        goto do_shift32;
     case INDEX_op_sar_i32:
         op = RS_SRA;
         op2 = RSY_SRAK;
@@ -2780,9 +2806,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
             tcg_out_sh64(s, op, args[0], args[1], args[2], 0);
         }
         break;
-    case INDEX_op_shr_i64:
-        op = RSY_SRLG;
-        goto do_shift64;
     case INDEX_op_sar_i64:
         op = RSY_SRAG;
         goto do_shift64;
@@ -3371,7 +3394,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(r, r);
 
-    case INDEX_op_shr_i64:
     case INDEX_op_sar_i64:
     case INDEX_op_rotl_i32:
     case INDEX_op_rotl_i64:
@@ -3387,7 +3409,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_clz_i64:
         return C_O1_I2(r, r, rI);
 
-    case INDEX_op_shr_i32:
     case INDEX_op_sar_i32:
         return C_O1_I2(r, r, ri);
 
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index 6b320a8622..f679fa04ea 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -1505,6 +1505,27 @@ static const TCGOutOpBinary outop_shl = {
     .out_rri = tgen_shli,
 };
 
+static void tgen_shr(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    uint32_t insn = type == TCG_TYPE_I32 ? SHIFT_SRL : SHIFT_SRLX;
+    tcg_out_arith(s, a0, a1, a2, insn);
+}
+
+static void tgen_shri(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    uint32_t insn = type == TCG_TYPE_I32 ? SHIFT_SRL : SHIFT_SRLX;
+    uint32_t mask = type == TCG_TYPE_I32 ? 31 : 63;
+    tcg_out_arithi(s, a0, a1, a2 & mask, insn);
+}
+
+static const TCGOutOpBinary outop_shr = {
+    .base.static_constraint = C_O1_I2(r, r, rJ),
+    .out_rrr = tgen_shr,
+    .out_rri = tgen_shri,
+};
+
 static void tgen_sub(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -1612,9 +1633,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         /* Limit immediate shift count lest we create an illegal insn.  */
         tcg_out_arithc(s, a0, a1, a2 & 31, c2, c);
         break;
-    case INDEX_op_shr_i32:
-        c = SHIFT_SRL;
-        goto do_shift32;
     case INDEX_op_sar_i32:
         c = SHIFT_SRA;
         goto do_shift32;
@@ -1679,9 +1697,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         /* Limit immediate shift count lest we create an illegal insn.  */
         tcg_out_arithc(s, a0, a1, a2 & 63, c2, c);
         break;
-    case INDEX_op_shr_i64:
-        c = SHIFT_SRLX;
-        goto do_shift64;
     case INDEX_op_sar_i64:
         c = SHIFT_SRAX;
         goto do_shift64;
@@ -1768,8 +1783,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_qemu_st_i64:
         return C_O0_I2(rz, r);
 
-    case INDEX_op_shr_i32:
-    case INDEX_op_shr_i64:
     case INDEX_op_sar_i32:
     case INDEX_op_sar_i64:
     case INDEX_op_setcond_i32:
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 50935b7e03..134ab9c6c2 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1043,6 +1043,8 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_rems, TCGOutOpBinary, outop_rems),
     OUTOP(INDEX_op_remu, TCGOutOpBinary, outop_remu),
     OUTOP(INDEX_op_shl, TCGOutOpBinary, outop_shl),
+    OUTOP(INDEX_op_shr_i32, TCGOutOpBinary, outop_shr),
+    OUTOP(INDEX_op_shr_i64, TCGOutOpBinary, outop_shr),
     OUTOP(INDEX_op_sub, TCGOutOpSubtract, outop_sub),
     OUTOP(INDEX_op_xor, TCGOutOpBinary, outop_xor),
 };
@@ -2263,7 +2265,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st8_i32:
     case INDEX_op_st16_i32:
     case INDEX_op_st_i32:
-    case INDEX_op_shr_i32:
     case INDEX_op_sar_i32:
     case INDEX_op_extract_i32:
     case INDEX_op_sextract_i32:
@@ -2314,7 +2315,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st16_i64:
     case INDEX_op_st32_i64:
     case INDEX_op_st_i64:
-    case INDEX_op_shr_i64:
     case INDEX_op_sar_i64:
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
@@ -5423,6 +5423,8 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
     case INDEX_op_rems:
     case INDEX_op_remu:
     case INDEX_op_shl:
+    case INDEX_op_shr_i32:
+    case INDEX_op_shr_i64:
     case INDEX_op_xor:
         {
             const TCGOutOpBinary *out =
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index ca83a097ab..5651833ac9 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -79,8 +79,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(r, r);
 
-    case INDEX_op_shr_i32:
-    case INDEX_op_shr_i64:
     case INDEX_op_sar_i32:
     case INDEX_op_sar_i64:
     case INDEX_op_rotl_i32:
@@ -787,6 +785,21 @@ static const TCGOutOpBinary outop_shl = {
     .out_rrr = tgen_shl,
 };
 
+static void tgen_shr(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    if (type < TCG_TYPE_REG) {
+        tcg_out_ext32u(s, TCG_REG_TMP, a1);
+        a1 = TCG_REG_TMP;
+    }
+    tcg_out_op_rrr(s, glue(INDEX_op_shr_i,TCG_TARGET_REG_BITS), a0, a1, a2);
+}
+
+static const TCGOutOpBinary outop_shr = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_shr,
+};
+
 static void tgen_sub(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -871,7 +884,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_ldst(s, opc, args[0], args[1], args[2]);
         break;
 
-    CASE_32_64(shr)
     CASE_32_64(sar)
     CASE_32_64(rotl)     /* Optional (TCG_TARGET_HAS_rot_*). */
     CASE_32_64(rotr)     /* Optional (TCG_TARGET_HAS_rot_*). */

From 74dbd36f1f87bd7fc4705644d63c5561a23b0567 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 7 Jan 2025 22:52:10 -0800
Subject: [PATCH 0415/2760] tcg: Merge INDEX_op_shr_{i32,i64}
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 docs/devel/tcg-ops.rst   |  4 ++--
 include/tcg/tcg-opc.h    |  3 +--
 tcg/optimize.c           | 17 +++++++----------
 tcg/tcg-op.c             |  4 ++--
 tcg/tcg.c                |  6 ++----
 tcg/tci.c                | 11 +++--------
 tcg/tci/tcg-target.c.inc |  2 +-
 7 files changed, 18 insertions(+), 29 deletions(-)

diff --git a/docs/devel/tcg-ops.rst b/docs/devel/tcg-ops.rst
index f64c881530..f9fd4b0087 100644
--- a/docs/devel/tcg-ops.rst
+++ b/docs/devel/tcg-ops.rst
@@ -384,10 +384,10 @@ Shifts/Rotates
      - | *t0* = *t1* << *t2*
        | Unspecified behavior for negative or out-of-range shifts.
 
-   * - shr_i32/i64 *t0*, *t1*, *t2*
+   * - shr *t0*, *t1*, *t2*
 
      - | *t0* = *t1* >> *t2* (unsigned)
-       | Unspecified behavior if *t2* < 0 or *t2* >= 32 (resp 64)
+       | Unspecified behavior for negative or out-of-range shifts.
 
    * - sar_i32/i64 *t0*, *t1*, *t2*
 
diff --git a/include/tcg/tcg-opc.h b/include/tcg/tcg-opc.h
index c2ac25d1b6..35e0be8f80 100644
--- a/include/tcg/tcg-opc.h
+++ b/include/tcg/tcg-opc.h
@@ -59,6 +59,7 @@ DEF(orc, 1, 2, 0, TCG_OPF_INT)
 DEF(rems, 1, 2, 0, TCG_OPF_INT)
 DEF(remu, 1, 2, 0, TCG_OPF_INT)
 DEF(shl, 1, 2, 0, TCG_OPF_INT)
+DEF(shr, 1, 2, 0, TCG_OPF_INT)
 DEF(sub, 1, 2, 0, TCG_OPF_INT)
 DEF(xor, 1, 2, 0, TCG_OPF_INT)
 
@@ -75,7 +76,6 @@ DEF(st8_i32, 0, 2, 1, 0)
 DEF(st16_i32, 0, 2, 1, 0)
 DEF(st_i32, 0, 2, 1, 0)
 /* shifts/rotates */
-DEF(shr_i32, 1, 2, 0, 0)
 DEF(sar_i32, 1, 2, 0, 0)
 DEF(rotl_i32, 1, 2, 0, 0)
 DEF(rotr_i32, 1, 2, 0, 0)
@@ -115,7 +115,6 @@ DEF(st16_i64, 0, 2, 1, 0)
 DEF(st32_i64, 0, 2, 1, 0)
 DEF(st_i64, 0, 2, 1, 0)
 /* shifts/rotates */
-DEF(shr_i64, 1, 2, 0, 0)
 DEF(sar_i64, 1, 2, 0, 0)
 DEF(rotl_i64, 1, 2, 0, 0)
 DEF(rotr_i64, 1, 2, 0, 0)
diff --git a/tcg/optimize.c b/tcg/optimize.c
index 3142daa800..43db079693 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -452,10 +452,10 @@ static uint64_t do_constant_folding_2(TCGOpcode op, TCGType type,
         }
         return (uint64_t)x << (y & 63);
 
-    case INDEX_op_shr_i32:
-        return (uint32_t)x >> (y & 31);
-
-    case INDEX_op_shr_i64:
+    case INDEX_op_shr:
+        if (type == TCG_TYPE_I32) {
+            return (uint32_t)x >> (y & 31);
+        }
         return (uint64_t)x >> (y & 63);
 
     case INDEX_op_sar_i32:
@@ -2342,7 +2342,6 @@ static int fold_setcond_zmask(OptContext *ctx, TCGOp *op, bool neg)
 
 static void fold_setcond_tst_pow2(OptContext *ctx, TCGOp *op, bool neg)
 {
-    TCGOpcode shr_opc;
     TCGOpcode uext_opc = 0, sext_opc = 0;
     TCGCond cond = op->args[3];
     TCGArg ret, src1, src2;
@@ -2364,7 +2363,6 @@ static void fold_setcond_tst_pow2(OptContext *ctx, TCGOp *op, bool neg)
 
     switch (ctx->type) {
     case TCG_TYPE_I32:
-        shr_opc = INDEX_op_shr_i32;
         if (TCG_TARGET_extract_valid(TCG_TYPE_I32, sh, 1)) {
             uext_opc = INDEX_op_extract_i32;
         }
@@ -2373,7 +2371,6 @@ static void fold_setcond_tst_pow2(OptContext *ctx, TCGOp *op, bool neg)
         }
         break;
     case TCG_TYPE_I64:
-        shr_opc = INDEX_op_shr_i64;
         if (TCG_TARGET_extract_valid(TCG_TYPE_I64, sh, 1)) {
             uext_opc = INDEX_op_extract_i64;
         }
@@ -2402,7 +2399,7 @@ static void fold_setcond_tst_pow2(OptContext *ctx, TCGOp *op, bool neg)
         op->args[3] = 1;
     } else {
         if (sh) {
-            op2 = opt_insert_before(ctx, op, shr_opc, 3);
+            op2 = opt_insert_before(ctx, op, INDEX_op_shr, 3);
             op2->args[0] = ret;
             op2->args[1] = src1;
             op2->args[2] = arg_new_constant(ctx, sh);
@@ -2609,7 +2606,7 @@ static bool fold_shift(OptContext *ctx, TCGOp *op)
          * input sign repetitions.
          */
         return fold_masks_s(ctx, op, s_mask);
-    CASE_OP_32_64(shr):
+    case INDEX_op_shr:
         /*
          * If the sign bit is known zero, then logical right shift
          * will not reduce the number of input sign repetitions.
@@ -3032,7 +3029,7 @@ void tcg_optimize(TCGContext *s)
         CASE_OP_32_64(rotr):
         CASE_OP_32_64(sar):
         case INDEX_op_shl:
-        CASE_OP_32_64(shr):
+        case INDEX_op_shr:
             done = fold_shift(&ctx, op);
             break;
         CASE_OP_32_64(setcond):
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index c85c056726..ef8cf5a1ac 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -496,7 +496,7 @@ void tcg_gen_shli_i32(TCGv_i32 ret, TCGv_i32 arg1, int32_t arg2)
 
 void tcg_gen_shr_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 {
-    tcg_gen_op3_i32(INDEX_op_shr_i32, ret, arg1, arg2);
+    tcg_gen_op3_i32(INDEX_op_shr, ret, arg1, arg2);
 }
 
 void tcg_gen_shri_i32(TCGv_i32 ret, TCGv_i32 arg1, int32_t arg2)
@@ -1615,7 +1615,7 @@ void tcg_gen_shl_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
 void tcg_gen_shr_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
 {
     if (TCG_TARGET_REG_BITS == 64) {
-        tcg_gen_op3_i64(INDEX_op_shr_i64, ret, arg1, arg2);
+        tcg_gen_op3_i64(INDEX_op_shr, ret, arg1, arg2);
     } else {
         gen_helper_shr_i64(ret, arg1, arg2);
     }
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 134ab9c6c2..939bbe86e9 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1043,8 +1043,7 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_rems, TCGOutOpBinary, outop_rems),
     OUTOP(INDEX_op_remu, TCGOutOpBinary, outop_remu),
     OUTOP(INDEX_op_shl, TCGOutOpBinary, outop_shl),
-    OUTOP(INDEX_op_shr_i32, TCGOutOpBinary, outop_shr),
-    OUTOP(INDEX_op_shr_i64, TCGOutOpBinary, outop_shr),
+    OUTOP(INDEX_op_shr, TCGOutOpBinary, outop_shr),
     OUTOP(INDEX_op_sub, TCGOutOpSubtract, outop_sub),
     OUTOP(INDEX_op_xor, TCGOutOpBinary, outop_xor),
 };
@@ -5423,8 +5422,7 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
     case INDEX_op_rems:
     case INDEX_op_remu:
     case INDEX_op_shl:
-    case INDEX_op_shr_i32:
-    case INDEX_op_shr_i64:
+    case INDEX_op_shr:
     case INDEX_op_xor:
         {
             const TCGOutOpBinary *out =
diff --git a/tcg/tci.c b/tcg/tci.c
index 22401ce1f6..376b1b1ece 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -621,9 +621,9 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = regs[r1] << (regs[r2] % TCG_TARGET_REG_BITS);
             break;
-        case INDEX_op_shr_i32:
+        case INDEX_op_shr:
             tci_args_rrr(insn, &r0, &r1, &r2);
-            regs[r0] = (uint32_t)regs[r1] >> (regs[r2] & 31);
+            regs[r0] = regs[r1] >> (regs[r2] % TCG_TARGET_REG_BITS);
             break;
         case INDEX_op_sar_i32:
             tci_args_rrr(insn, &r0, &r1, &r2);
@@ -787,10 +787,6 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
 
             /* Shift/rotate operations (64 bit). */
 
-        case INDEX_op_shr_i64:
-            tci_args_rrr(insn, &r0, &r1, &r2);
-            regs[r0] = regs[r1] >> (regs[r2] & 63);
-            break;
         case INDEX_op_sar_i64:
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = (int64_t)regs[r1] >> (regs[r2] & 63);
@@ -1078,10 +1074,9 @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
     case INDEX_op_rems:
     case INDEX_op_remu:
     case INDEX_op_shl:
+    case INDEX_op_shr:
     case INDEX_op_sub:
     case INDEX_op_xor:
-    case INDEX_op_shr_i32:
-    case INDEX_op_shr_i64:
     case INDEX_op_sar_i32:
     case INDEX_op_sar_i64:
     case INDEX_op_rotl_i32:
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index 5651833ac9..c0dbe873f1 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -792,7 +792,7 @@ static void tgen_shr(TCGContext *s, TCGType type,
         tcg_out_ext32u(s, TCG_REG_TMP, a1);
         a1 = TCG_REG_TMP;
     }
-    tcg_out_op_rrr(s, glue(INDEX_op_shr_i,TCG_TARGET_REG_BITS), a0, a1, a2);
+    tcg_out_op_rrr(s, INDEX_op_shr, a0, a1, a2);
 }
 
 static const TCGOutOpBinary outop_shr = {

From b5aafbaa834653abd4c208794bacbc53a4c1bc16 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 7 Jan 2025 23:36:22 -0800
Subject: [PATCH 0416/2760] tcg: Convert sar to TCGOutOpBinary

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target.c.inc     | 37 ++++++++---------
 tcg/arm/tcg-target.c.inc         | 26 ++++++++----
 tcg/i386/tcg-target.c.inc        | 46 ++++++++++++---------
 tcg/loongarch64/tcg-target.c.inc | 43 ++++++++++++--------
 tcg/mips/tcg-target.c.inc        | 36 +++++++++++------
 tcg/ppc/tcg-target.c.inc         | 40 +++++++++++--------
 tcg/riscv/tcg-target.c.inc       | 38 ++++++++++--------
 tcg/s390x/tcg-target.c.inc       | 68 ++++++++++++++------------------
 tcg/sparc64/tcg-target.c.inc     | 37 +++++++++--------
 tcg/tcg.c                        |  6 ++-
 tcg/tci/tcg-target.c.inc         | 17 +++++++-
 11 files changed, 230 insertions(+), 164 deletions(-)

diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index 87b97e852a..90bdbf8387 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -1347,13 +1347,6 @@ static inline void tcg_out_extr(TCGContext *s, TCGType ext, TCGReg rd,
     tcg_out_insn(s, 3403, EXTR, ext, rd, rn, rm, a);
 }
 
-static inline void tcg_out_sar(TCGContext *s, TCGType ext,
-                               TCGReg rd, TCGReg rn, unsigned int m)
-{
-    int max = ext ? 63 : 31;
-    tcg_out_sbfm(s, ext, rd, rn, m & max, max);
-}
-
 static inline void tcg_out_rotr(TCGContext *s, TCGType ext,
                                 TCGReg rd, TCGReg rn, unsigned int m)
 {
@@ -2284,6 +2277,25 @@ static const TCGOutOpBinary outop_remu = {
     .out_rrr = tgen_remu,
 };
 
+static void tgen_sar(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_insn(s, 3508, ASRV, type, a0, a1, a2);
+}
+
+static void tgen_sari(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    int max = type == TCG_TYPE_I32 ? 31 : 63;
+    tcg_out_sbfm(s, type, a0, a1, a2 & max, max);
+}
+
+static const TCGOutOpBinary outop_sar = {
+    .base.static_constraint = C_O1_I2(r, r, ri),
+    .out_rrr = tgen_sar,
+    .out_rri = tgen_sari,
+};
+
 static void tgen_shl(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -2439,15 +2451,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType ext,
         tcg_out_ldst(s, I3312_STRX, a0, a1, a2, 3);
         break;
 
-    case INDEX_op_sar_i64:
-    case INDEX_op_sar_i32:
-        if (c2) {
-            tcg_out_sar(s, ext, a0, a1, a2);
-        } else {
-            tcg_out_insn(s, 3508, ASRV, ext, a0, a1, a2);
-        }
-        break;
-
     case INDEX_op_rotr_i64:
     case INDEX_op_rotr_i32:
         if (c2) {
@@ -3096,10 +3099,8 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_negsetcond_i64:
         return C_O1_I2(r, r, rC);
 
-    case INDEX_op_sar_i32:
     case INDEX_op_rotl_i32:
     case INDEX_op_rotr_i32:
-    case INDEX_op_sar_i64:
     case INDEX_op_rotl_i64:
     case INDEX_op_rotr_i64:
         return C_O1_I2(r, r, ri);
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index 247aefd0a1..058677650b 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -1963,6 +1963,25 @@ static const TCGOutOpBinary outop_remu = {
     .base.static_constraint = C_NotImplemented,
 };
 
+static void tgen_sar(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_dat_reg(s, COND_AL, ARITH_MOV, a0, 0, a1, SHIFT_REG_ASR(a2));
+}
+
+static void tgen_sari(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    tcg_out_dat_reg(s, COND_AL, ARITH_MOV, a0, 0, a1,
+                    SHIFT_IMM_ASR(a2 & 0x1f));
+}
+
+static const TCGOutOpBinary outop_sar = {
+    .base.static_constraint = C_O1_I2(r, r, ri),
+    .out_rrr = tgen_sar,
+    .out_rri = tgen_sari,
+};
+
 static void tgen_shl(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -2152,15 +2171,9 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     case INDEX_op_muls2_i32:
         tcg_out_smull32(s, COND_AL, args[0], args[1], args[2], args[3]);
         break;
-    case INDEX_op_sar_i32:
-        c = const_args[2] ? (args[2] & 0x1f) ? SHIFT_IMM_ASR(args[2] & 0x1f) :
-                SHIFT_IMM_LSL(0) : SHIFT_REG_ASR(args[2]);
-        goto gen_shift32;
     case INDEX_op_rotr_i32:
         c = const_args[2] ? (args[2] & 0x1f) ? SHIFT_IMM_ROR(args[2] & 0x1f) :
                 SHIFT_IMM_LSL(0) : SHIFT_REG_ROR(args[2]);
-        /* Fall through.  */
-    gen_shift32:
         tcg_out_dat_reg(s, COND_AL, ARITH_MOV, args[0], 0, args[1], c);
         break;
 
@@ -2329,7 +2342,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_muls2_i32:
         return C_O2_I2(r, r, r, r);
 
-    case INDEX_op_sar_i32:
     case INDEX_op_rotl_i32:
     case INDEX_op_rotr_i32:
         return C_O1_I2(r, r, ri);
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index 93d94e7881..1e81455461 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -2749,6 +2749,33 @@ static TCGConstraintSetIndex cset_shift(TCGType type, unsigned flags)
     return have_bmi2 ? C_O1_I2(r, r, ri) : C_O1_I2(r, 0, ci);
 }
 
+static void tgen_sar(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    int rexw = type == TCG_TYPE_I32 ? 0 : P_REXW;
+    if (have_bmi2) {
+        tcg_out_vex_modrm(s, OPC_SARX + rexw, a0, a2, a1);
+    } else {
+        tcg_out_modrm(s, OPC_SHIFT_cl + rexw, SHIFT_SAR, a0);
+    }
+}
+
+static void tgen_sari(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    int rexw = type == TCG_TYPE_I32 ? 0 : P_REXW;
+
+    tcg_out_mov(s, type, a0, a1);
+    tcg_out_shifti(s, SHIFT_SAR + rexw, a0, a2);
+}
+
+static const TCGOutOpBinary outop_sar = {
+    .base.static_constraint = C_Dynamic,
+    .base.dynamic_constraint = cset_shift,
+    .out_rrr = tgen_sar,
+    .out_rri = tgen_sari,
+};
+
 static void tgen_shl(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -2874,7 +2901,7 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const int const_args[TCG_MAX_OP_ARGS])
 {
     TCGArg a0, a1, a2;
-    int c, const_a2, vexop, rexw;
+    int c, const_a2, rexw;
 
 #if TCG_TARGET_REG_BITS == 64
 # define OP_32_64(x) \
@@ -2949,25 +2976,12 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    OP_32_64(sar):
-        c = SHIFT_SAR;
-        vexop = OPC_SARX;
-        goto gen_shift_maybe_vex;
     OP_32_64(rotl):
         c = SHIFT_ROL;
         goto gen_shift;
     OP_32_64(rotr):
         c = SHIFT_ROR;
         goto gen_shift;
-    gen_shift_maybe_vex:
-        if (have_bmi2) {
-            if (!const_a2) {
-                tcg_out_vex_modrm(s, vexop + rexw, a0, a2, a1);
-                break;
-            }
-            tcg_out_mov(s, rexw ? TCG_TYPE_I64 : TCG_TYPE_I32, a0, a1);
-        }
-        /* FALLTHRU */
     gen_shift:
         if (const_a2) {
             tcg_out_shifti(s, c + rexw, a0, a2);
@@ -3810,10 +3824,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(re, r);
 
-    case INDEX_op_sar_i32:
-    case INDEX_op_sar_i64:
-        return have_bmi2 ? C_O1_I2(r, r, ri) : C_O1_I2(r, 0, ci);
-
     case INDEX_op_rotl_i32:
     case INDEX_op_rotl_i64:
     case INDEX_op_rotr_i32:
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index 2699079073..aae0f03505 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -1489,6 +1489,32 @@ static const TCGOutOpBinary outop_remu = {
     .out_rrr = tgen_remu,
 };
 
+static void tgen_sar(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    if (type == TCG_TYPE_I32) {
+        tcg_out_opc_sra_w(s, a0, a1, a2);
+    } else {
+        tcg_out_opc_sra_d(s, a0, a1, a2);
+    }
+}
+
+static void tgen_sari(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    if (type == TCG_TYPE_I32) {
+        tcg_out_opc_srai_w(s, a0, a1, a2 & 0x1f);
+    } else {
+        tcg_out_opc_srai_d(s, a0, a1, a2 & 0x3f);
+    }
+}
+
+static const TCGOutOpBinary outop_sar = {
+    .base.static_constraint = C_O1_I2(r, r, ri),
+    .out_rrr = tgen_sar,
+    .out_rri = tgen_sari,
+};
+
 static void tgen_shl(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -1712,21 +1738,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_clzctz(s, OPC_CTZ_D, a0, a1, a2, c2, false);
         break;
 
-    case INDEX_op_sar_i32:
-        if (c2) {
-            tcg_out_opc_srai_w(s, a0, a1, a2 & 0x1f);
-        } else {
-            tcg_out_opc_sra_w(s, a0, a1, a2);
-        }
-        break;
-    case INDEX_op_sar_i64:
-        if (c2) {
-            tcg_out_opc_srai_d(s, a0, a1, a2 & 0x3f);
-        } else {
-            tcg_out_opc_sra_d(s, a0, a1, a2);
-        }
-        break;
-
     case INDEX_op_rotl_i32:
         /* transform into equivalent rotr/rotri */
         if (c2) {
@@ -2391,8 +2402,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_qemu_ld_i64:
         return C_O1_I1(r, r);
 
-    case INDEX_op_sar_i32:
-    case INDEX_op_sar_i64:
     case INDEX_op_rotl_i32:
     case INDEX_op_rotl_i64:
     case INDEX_op_rotr_i32:
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index 03b4248ea9..16c3d59c19 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -1908,6 +1908,29 @@ static const TCGOutOpBinary outop_remu = {
     .out_rrr = tgen_remu,
 };
 
+static void tgen_sar(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    MIPSInsn insn = type == TCG_TYPE_I32 ? OPC_SRAV : OPC_DSRAV;
+    tcg_out_opc_reg(s, insn, a0, a1, a2);
+}
+
+static void tgen_sari(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    if (type == TCG_TYPE_I32) {
+        tcg_out_opc_sa(s, OPC_SRA, a0, a1, a2);
+    } else {
+        tcg_out_dsra(s, a0, a1, a2);
+    }
+}
+
+static const TCGOutOpBinary outop_sar = {
+    .base.static_constraint = C_O1_I2(r, r, ri),
+    .out_rrr = tgen_sar,
+    .out_rri = tgen_sari,
+};
+
 static void tgen_shl(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -2111,12 +2134,8 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_dsra(s, a0, a1, 32);
         break;
 
-    case INDEX_op_sar_i32:
-        i1 = OPC_SRAV, i2 = OPC_SRA;
-        goto do_shift;
     case INDEX_op_rotr_i32:
         i1 = OPC_ROTRV, i2 = OPC_ROTR;
-    do_shift:
         if (c2) {
             tcg_out_opc_sa(s, i2, a0, a1, a2);
             break;
@@ -2132,13 +2151,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
             tcg_out_opc_reg(s, OPC_ROTRV, a0, TCG_TMP0, a1);
         }
         break;
-    case INDEX_op_sar_i64:
-        if (c2) {
-            tcg_out_dsra(s, a0, a1, a2);
-            break;
-        }
-        i1 = OPC_DSRAV;
-        goto do_shiftv;
     case INDEX_op_rotr_i64:
         if (c2) {
             tcg_out_opc_sa64(s, OPC_DROTR, OPC_DROTR32, a0, a1, a2);
@@ -2319,10 +2331,8 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_muls2_i64:
     case INDEX_op_mulu2_i64:
         return C_O2_I2(r, r, r, r);
-    case INDEX_op_sar_i32:
     case INDEX_op_rotr_i32:
     case INDEX_op_rotl_i32:
-    case INDEX_op_sar_i64:
     case INDEX_op_rotr_i64:
     case INDEX_op_rotl_i64:
         return C_O1_I2(r, r, ri);
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index 2012734bb3..24e8f675bb 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -3122,6 +3122,30 @@ static const TCGOutOpBinary outop_remu = {
     .out_rrr = tgen_remu,
 };
 
+static void tgen_sar(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    uint32_t insn = type == TCG_TYPE_I32 ? SRAW : SRAD;
+    tcg_out32(s, insn | SAB(a1, a0, a2));
+}
+
+static void tgen_sari(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    /* Limit immediate shift count lest we create an illegal insn.  */
+    if (type == TCG_TYPE_I32) {
+        tcg_out_sari32(s, a0, a1, a2 & 31);
+    } else {
+        tcg_out_sari64(s, a0, a1, a2 & 63);
+    }
+}
+
+static const TCGOutOpBinary outop_sar = {
+    .base.static_constraint = C_O1_I2(r, r, ri),
+    .out_rrr = tgen_sar,
+    .out_rri = tgen_sari,
+};
+
 static void tgen_shl(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -3320,13 +3344,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out32(s, CNTPOPD | SAB(args[1], args[0], 0));
         break;
 
-    case INDEX_op_sar_i32:
-        if (const_args[2]) {
-            tcg_out_sari32(s, args[0], args[1], args[2]);
-        } else {
-            tcg_out32(s, SRAW | SAB(args[1], args[0], args[2]));
-        }
-        break;
     case INDEX_op_rotl_i32:
         if (const_args[2]) {
             tcg_out_rlw(s, RLWINM, args[0], args[1], args[2], 0, 31);
@@ -3357,13 +3374,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_brcond2(s, args, const_args);
         break;
 
-    case INDEX_op_sar_i64:
-        if (const_args[2]) {
-            tcg_out_sari64(s, args[0], args[1], args[2]);
-        } else {
-            tcg_out32(s, SRAD | SAB(args[1], args[0], args[2]));
-        }
-        break;
     case INDEX_op_rotl_i64:
         if (const_args[2]) {
             tcg_out_rld(s, RLDICL, args[0], args[1], args[2], 0);
@@ -4222,10 +4232,8 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(r, r);
 
-    case INDEX_op_sar_i32:
     case INDEX_op_rotl_i32:
     case INDEX_op_rotr_i32:
-    case INDEX_op_sar_i64:
     case INDEX_op_rotl_i64:
     case INDEX_op_rotr_i64:
         return C_O1_I2(r, r, ri);
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index 8020cc0b3f..8cab07a392 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -2144,6 +2144,27 @@ static const TCGOutOpBinary outop_remu = {
     .out_rrr = tgen_remu,
 };
 
+static void tgen_sar(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    RISCVInsn insn = type == TCG_TYPE_I32 ? OPC_SRAW : OPC_SRA;
+    tcg_out_opc_reg(s, insn, a0, a1, a2);
+}
+
+static void tgen_sari(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    RISCVInsn insn = type == TCG_TYPE_I32 ? OPC_SRAIW : OPC_SRAI;
+    unsigned mask = type == TCG_TYPE_I32 ? 31 : 63;
+    tcg_out_opc_imm(s, insn, a0, a1, a2 & mask);
+}
+
+static const TCGOutOpBinary outop_sar = {
+    .base.static_constraint = C_O1_I2(r, r, ri),
+    .out_rrr = tgen_sar,
+    .out_rri = tgen_sari,
+};
+
 static void tgen_shl(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -2299,21 +2320,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_ldst(s, OPC_SD, a0, a1, a2);
         break;
 
-    case INDEX_op_sar_i32:
-        if (c2) {
-            tcg_out_opc_imm(s, OPC_SRAIW, a0, a1, a2 & 0x1f);
-        } else {
-            tcg_out_opc_reg(s, OPC_SRAW, a0, a1, a2);
-        }
-        break;
-    case INDEX_op_sar_i64:
-        if (c2) {
-            tcg_out_opc_imm(s, OPC_SRAI, a0, a1, a2 & 0x3f);
-        } else {
-            tcg_out_opc_reg(s, OPC_SRA, a0, a1, a2);
-        }
-        break;
-
     case INDEX_op_rotl_i32:
         if (c2) {
             tcg_out_opc_imm(s, OPC_RORIW, a0, a1, -a2 & 0x1f);
@@ -2770,10 +2776,8 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_negsetcond_i64:
         return C_O1_I2(r, r, rI);
 
-    case INDEX_op_sar_i32:
     case INDEX_op_rotl_i32:
     case INDEX_op_rotr_i32:
-    case INDEX_op_sar_i64:
     case INDEX_op_rotl_i64:
     case INDEX_op_rotr_i64:
         return C_O1_I2(r, r, ri);
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index 0417bbef50..1cf4920276 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -2445,6 +2445,36 @@ static const TCGOutOpBinary outop_remu = {
     .base.static_constraint = C_NotImplemented,
 };
 
+static void tgen_sar_int(TCGContext *s, TCGType type, TCGReg dst,
+                         TCGReg src, TCGReg v, tcg_target_long i)
+{
+    if (type != TCG_TYPE_I32) {
+        tcg_out_sh64(s, RSY_SRAG, dst, src, v, i);
+    } else if (dst == src) {
+        tcg_out_sh32(s, RS_SRA, dst, v, i);
+    } else {
+        tcg_out_sh64(s, RSY_SRAK, dst, src, v, i);
+    }
+}
+
+static void tgen_sar(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tgen_sar_int(s, type, a0, a1, a2, 0);
+}
+
+static void tgen_sari(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    tgen_sar_int(s, type, a0, a1, TCG_REG_NONE, a2);
+}
+
+static const TCGOutOpBinary outop_sar = {
+    .base.static_constraint = C_O1_I2(r, r, ri),
+    .out_rrr = tgen_sar,
+    .out_rri = tgen_sari,
+};
+
 static void tgen_shl_int(TCGContext *s, TCGType type, TCGReg dst,
                          TCGReg src, TCGReg v, tcg_target_long i)
 {
@@ -2586,7 +2616,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
                        const int const_args[TCG_MAX_OP_ARGS])
 {
-    S390Opcode op, op2;
     TCGArg a0, a1, a2;
 
     switch (opc) {
@@ -2634,28 +2663,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_st(s, TCG_TYPE_I32, args[0], args[1], args[2]);
         break;
 
-    do_shift32:
-        a0 = args[0], a1 = args[1], a2 = (int32_t)args[2];
-        if (a0 == a1) {
-            if (const_args[2]) {
-                tcg_out_sh32(s, op, a0, TCG_REG_NONE, a2);
-            } else {
-                tcg_out_sh32(s, op, a0, a2, 0);
-            }
-        } else {
-            /* Using tcg_out_sh64 here for the format; it is a 32-bit shift.  */
-            if (const_args[2]) {
-                tcg_out_sh64(s, op2, a0, a1, TCG_REG_NONE, a2);
-            } else {
-                tcg_out_sh64(s, op2, a0, a1, a2, 0);
-            }
-        }
-        break;
-    case INDEX_op_sar_i32:
-        op = RS_SRA;
-        op2 = RSY_SRAK;
-        goto do_shift32;
-
     case INDEX_op_rotl_i32:
         /* ??? Using tcg_out_sh64 here for the format; it is a 32-bit rol.  */
         if (const_args[2]) {
@@ -2799,17 +2806,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_insn(s, RRFa, MGRK, args[1], args[2], args[3]);
         break;
 
-    do_shift64:
-        if (const_args[2]) {
-            tcg_out_sh64(s, op, args[0], args[1], TCG_REG_NONE, args[2]);
-        } else {
-            tcg_out_sh64(s, op, args[0], args[1], args[2], 0);
-        }
-        break;
-    case INDEX_op_sar_i64:
-        op = RSY_SRAG;
-        goto do_shift64;
-
     case INDEX_op_rotl_i64:
         if (const_args[2]) {
             tcg_out_sh64(s, RSY_RLLG, args[0], args[1],
@@ -3394,7 +3390,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(r, r);
 
-    case INDEX_op_sar_i64:
     case INDEX_op_rotl_i32:
     case INDEX_op_rotl_i64:
     case INDEX_op_rotr_i32:
@@ -3409,9 +3404,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_clz_i64:
         return C_O1_I2(r, r, rI);
 
-    case INDEX_op_sar_i32:
-        return C_O1_I2(r, r, ri);
-
     case INDEX_op_brcond_i32:
         return C_O0_I2(r, ri);
     case INDEX_op_brcond_i64:
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index f679fa04ea..42d81c1e6c 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -1484,6 +1484,27 @@ static const TCGOutOpBinary outop_remu = {
     .base.static_constraint = C_NotImplemented,
 };
 
+static void tgen_sar(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    uint32_t insn = type == TCG_TYPE_I32 ? SHIFT_SRA : SHIFT_SRAX;
+    tcg_out_arith(s, a0, a1, a2, insn);
+}
+
+static void tgen_sari(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    uint32_t insn = type == TCG_TYPE_I32 ? SHIFT_SRA : SHIFT_SRAX;
+    uint32_t mask = type == TCG_TYPE_I32 ? 31 : 63;
+    tcg_out_arithi(s, a0, a1, a2 & mask, insn);
+}
+
+static const TCGOutOpBinary outop_sar = {
+    .base.static_constraint = C_O1_I2(r, r, rJ),
+    .out_rrr = tgen_sar,
+    .out_rri = tgen_sari,
+};
+
 static void tgen_shl(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -1629,13 +1650,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     case INDEX_op_st32_i64:
         tcg_out_ldst(s, a0, a1, a2, STW);
         break;
-    do_shift32:
-        /* Limit immediate shift count lest we create an illegal insn.  */
-        tcg_out_arithc(s, a0, a1, a2 & 31, c2, c);
-        break;
-    case INDEX_op_sar_i32:
-        c = SHIFT_SRA;
-        goto do_shift32;
 
     case INDEX_op_brcond_i32:
         tcg_out_brcond_i32(s, a2, a0, a1, const_args[1], arg_label(args[3]));
@@ -1693,13 +1707,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     case INDEX_op_st_i64:
         tcg_out_ldst(s, a0, a1, a2, STX);
         break;
-    do_shift64:
-        /* Limit immediate shift count lest we create an illegal insn.  */
-        tcg_out_arithc(s, a0, a1, a2 & 63, c2, c);
-        break;
-    case INDEX_op_sar_i64:
-        c = SHIFT_SRAX;
-        goto do_shift64;
 
     case INDEX_op_brcond_i64:
         tcg_out_brcond_i64(s, a2, a0, a1, const_args[1], arg_label(args[3]));
@@ -1783,8 +1790,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_qemu_st_i64:
         return C_O0_I2(rz, r);
 
-    case INDEX_op_sar_i32:
-    case INDEX_op_sar_i64:
     case INDEX_op_setcond_i32:
     case INDEX_op_setcond_i64:
     case INDEX_op_negsetcond_i32:
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 939bbe86e9..ffe9efbf79 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1042,6 +1042,8 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_orc, TCGOutOpBinary, outop_orc),
     OUTOP(INDEX_op_rems, TCGOutOpBinary, outop_rems),
     OUTOP(INDEX_op_remu, TCGOutOpBinary, outop_remu),
+    OUTOP(INDEX_op_sar_i32, TCGOutOpBinary, outop_sar),
+    OUTOP(INDEX_op_sar_i64, TCGOutOpBinary, outop_sar),
     OUTOP(INDEX_op_shl, TCGOutOpBinary, outop_shl),
     OUTOP(INDEX_op_shr, TCGOutOpBinary, outop_shr),
     OUTOP(INDEX_op_sub, TCGOutOpSubtract, outop_sub),
@@ -2264,7 +2266,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st8_i32:
     case INDEX_op_st16_i32:
     case INDEX_op_st_i32:
-    case INDEX_op_sar_i32:
     case INDEX_op_extract_i32:
     case INDEX_op_sextract_i32:
     case INDEX_op_deposit_i32:
@@ -2314,7 +2315,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st16_i64:
     case INDEX_op_st32_i64:
     case INDEX_op_st_i64:
-    case INDEX_op_sar_i64:
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
     case INDEX_op_extract_i64:
@@ -5421,6 +5421,8 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
     case INDEX_op_orc:
     case INDEX_op_rems:
     case INDEX_op_remu:
+    case INDEX_op_sar_i32:
+    case INDEX_op_sar_i64:
     case INDEX_op_shl:
     case INDEX_op_shr:
     case INDEX_op_xor:
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index c0dbe873f1..f50a2d6574 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -79,8 +79,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(r, r);
 
-    case INDEX_op_sar_i32:
-    case INDEX_op_sar_i64:
     case INDEX_op_rotl_i32:
     case INDEX_op_rotl_i64:
     case INDEX_op_rotr_i32:
@@ -774,6 +772,21 @@ static const TCGOutOpBinary outop_remu = {
     .out_rrr = tgen_remu,
 };
 
+static void tgen_sar(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    if (type < TCG_TYPE_REG) {
+        tcg_out_ext32s(s, TCG_REG_TMP, a1);
+        a1 = TCG_REG_TMP;
+    }
+    tcg_out_op_rrr(s, glue(INDEX_op_sar_i,TCG_TARGET_REG_BITS), a0, a1, a2);
+}
+
+static const TCGOutOpBinary outop_sar = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_sar,
+};
+
 static void tgen_shl(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {

From 3949f365eb6e7c934831c65c67b729562846ede9 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Jan 2025 08:05:18 -0800
Subject: [PATCH 0417/2760] tcg: Merge INDEX_op_sar_{i32,i64}
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 docs/devel/tcg-ops.rst   |  4 ++--
 include/tcg/tcg-opc.h    |  3 +--
 tcg/optimize.c           | 12 ++++++------
 tcg/tcg-op.c             |  4 ++--
 tcg/tcg.c                |  6 ++----
 tcg/tci.c                | 12 ++++--------
 tcg/tci/tcg-target.c.inc |  3 +--
 7 files changed, 18 insertions(+), 26 deletions(-)

diff --git a/docs/devel/tcg-ops.rst b/docs/devel/tcg-ops.rst
index f9fd4b0087..be82fed41a 100644
--- a/docs/devel/tcg-ops.rst
+++ b/docs/devel/tcg-ops.rst
@@ -389,10 +389,10 @@ Shifts/Rotates
      - | *t0* = *t1* >> *t2* (unsigned)
        | Unspecified behavior for negative or out-of-range shifts.
 
-   * - sar_i32/i64 *t0*, *t1*, *t2*
+   * - sar *t0*, *t1*, *t2*
 
      - | *t0* = *t1* >> *t2* (signed)
-       | Unspecified behavior if *t2* < 0 or *t2* >= 32 (resp 64)
+       | Unspecified behavior for negative or out-of-range shifts.
 
    * - rotl_i32/i64 *t0*, *t1*, *t2*
 
diff --git a/include/tcg/tcg-opc.h b/include/tcg/tcg-opc.h
index 35e0be8f80..cb8c134e94 100644
--- a/include/tcg/tcg-opc.h
+++ b/include/tcg/tcg-opc.h
@@ -58,6 +58,7 @@ DEF(or, 1, 2, 0, TCG_OPF_INT)
 DEF(orc, 1, 2, 0, TCG_OPF_INT)
 DEF(rems, 1, 2, 0, TCG_OPF_INT)
 DEF(remu, 1, 2, 0, TCG_OPF_INT)
+DEF(sar, 1, 2, 0, TCG_OPF_INT)
 DEF(shl, 1, 2, 0, TCG_OPF_INT)
 DEF(shr, 1, 2, 0, TCG_OPF_INT)
 DEF(sub, 1, 2, 0, TCG_OPF_INT)
@@ -76,7 +77,6 @@ DEF(st8_i32, 0, 2, 1, 0)
 DEF(st16_i32, 0, 2, 1, 0)
 DEF(st_i32, 0, 2, 1, 0)
 /* shifts/rotates */
-DEF(sar_i32, 1, 2, 0, 0)
 DEF(rotl_i32, 1, 2, 0, 0)
 DEF(rotr_i32, 1, 2, 0, 0)
 DEF(deposit_i32, 1, 2, 2, 0)
@@ -115,7 +115,6 @@ DEF(st16_i64, 0, 2, 1, 0)
 DEF(st32_i64, 0, 2, 1, 0)
 DEF(st_i64, 0, 2, 1, 0)
 /* shifts/rotates */
-DEF(sar_i64, 1, 2, 0, 0)
 DEF(rotl_i64, 1, 2, 0, 0)
 DEF(rotr_i64, 1, 2, 0, 0)
 DEF(deposit_i64, 1, 2, 2, 0)
diff --git a/tcg/optimize.c b/tcg/optimize.c
index 43db079693..f94be19b72 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -458,10 +458,10 @@ static uint64_t do_constant_folding_2(TCGOpcode op, TCGType type,
         }
         return (uint64_t)x >> (y & 63);
 
-    case INDEX_op_sar_i32:
-        return (int32_t)x >> (y & 31);
-
-    case INDEX_op_sar_i64:
+    case INDEX_op_sar:
+        if (type == TCG_TYPE_I32) {
+            return (int32_t)x >> (y & 31);
+        }
         return (int64_t)x >> (y & 63);
 
     case INDEX_op_rotr_i32:
@@ -2600,7 +2600,7 @@ static bool fold_shift(OptContext *ctx, TCGOp *op)
     }
 
     switch (op->opc) {
-    CASE_OP_32_64(sar):
+    case INDEX_op_sar:
         /*
          * Arithmetic right shift will not reduce the number of
          * input sign repetitions.
@@ -3027,7 +3027,7 @@ void tcg_optimize(TCGContext *s)
             break;
         CASE_OP_32_64(rotl):
         CASE_OP_32_64(rotr):
-        CASE_OP_32_64(sar):
+        case INDEX_op_sar:
         case INDEX_op_shl:
         case INDEX_op_shr:
             done = fold_shift(&ctx, op);
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index ef8cf5a1ac..43848ebc4f 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -511,7 +511,7 @@ void tcg_gen_shri_i32(TCGv_i32 ret, TCGv_i32 arg1, int32_t arg2)
 
 void tcg_gen_sar_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 {
-    tcg_gen_op3_i32(INDEX_op_sar_i32, ret, arg1, arg2);
+    tcg_gen_op3_i32(INDEX_op_sar, ret, arg1, arg2);
 }
 
 void tcg_gen_sari_i32(TCGv_i32 ret, TCGv_i32 arg1, int32_t arg2)
@@ -1624,7 +1624,7 @@ void tcg_gen_shr_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
 void tcg_gen_sar_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
 {
     if (TCG_TARGET_REG_BITS == 64) {
-        tcg_gen_op3_i64(INDEX_op_sar_i64, ret, arg1, arg2);
+        tcg_gen_op3_i64(INDEX_op_sar, ret, arg1, arg2);
     } else {
         gen_helper_sar_i64(ret, arg1, arg2);
     }
diff --git a/tcg/tcg.c b/tcg/tcg.c
index ffe9efbf79..8f67107190 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1042,8 +1042,7 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_orc, TCGOutOpBinary, outop_orc),
     OUTOP(INDEX_op_rems, TCGOutOpBinary, outop_rems),
     OUTOP(INDEX_op_remu, TCGOutOpBinary, outop_remu),
-    OUTOP(INDEX_op_sar_i32, TCGOutOpBinary, outop_sar),
-    OUTOP(INDEX_op_sar_i64, TCGOutOpBinary, outop_sar),
+    OUTOP(INDEX_op_sar, TCGOutOpBinary, outop_sar),
     OUTOP(INDEX_op_shl, TCGOutOpBinary, outop_shl),
     OUTOP(INDEX_op_shr, TCGOutOpBinary, outop_shr),
     OUTOP(INDEX_op_sub, TCGOutOpSubtract, outop_sub),
@@ -5421,8 +5420,7 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
     case INDEX_op_orc:
     case INDEX_op_rems:
     case INDEX_op_remu:
-    case INDEX_op_sar_i32:
-    case INDEX_op_sar_i64:
+    case INDEX_op_sar:
     case INDEX_op_shl:
     case INDEX_op_shr:
     case INDEX_op_xor:
diff --git a/tcg/tci.c b/tcg/tci.c
index 376b1b1ece..2a2f216898 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -625,9 +625,10 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = regs[r1] >> (regs[r2] % TCG_TARGET_REG_BITS);
             break;
-        case INDEX_op_sar_i32:
+        case INDEX_op_sar:
             tci_args_rrr(insn, &r0, &r1, &r2);
-            regs[r0] = (int32_t)regs[r1] >> (regs[r2] & 31);
+            regs[r0] = ((tcg_target_long)regs[r1]
+                        >> (regs[r2] % TCG_TARGET_REG_BITS));
             break;
 #if TCG_TARGET_HAS_rot_i32
         case INDEX_op_rotl_i32:
@@ -787,10 +788,6 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
 
             /* Shift/rotate operations (64 bit). */
 
-        case INDEX_op_sar_i64:
-            tci_args_rrr(insn, &r0, &r1, &r2);
-            regs[r0] = (int64_t)regs[r1] >> (regs[r2] & 63);
-            break;
 #if TCG_TARGET_HAS_rot_i64
         case INDEX_op_rotl_i64:
             tci_args_rrr(insn, &r0, &r1, &r2);
@@ -1073,12 +1070,11 @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
     case INDEX_op_orc:
     case INDEX_op_rems:
     case INDEX_op_remu:
+    case INDEX_op_sar:
     case INDEX_op_shl:
     case INDEX_op_shr:
     case INDEX_op_sub:
     case INDEX_op_xor:
-    case INDEX_op_sar_i32:
-    case INDEX_op_sar_i64:
     case INDEX_op_rotl_i32:
     case INDEX_op_rotl_i64:
     case INDEX_op_rotr_i32:
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index f50a2d6574..feaa13dff0 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -779,7 +779,7 @@ static void tgen_sar(TCGContext *s, TCGType type,
         tcg_out_ext32s(s, TCG_REG_TMP, a1);
         a1 = TCG_REG_TMP;
     }
-    tcg_out_op_rrr(s, glue(INDEX_op_sar_i,TCG_TARGET_REG_BITS), a0, a1, a2);
+    tcg_out_op_rrr(s, INDEX_op_sar, a0, a1, a2);
 }
 
 static const TCGOutOpBinary outop_sar = {
@@ -897,7 +897,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_ldst(s, opc, args[0], args[1], args[2]);
         break;
 
-    CASE_32_64(sar)
     CASE_32_64(rotl)     /* Optional (TCG_TARGET_HAS_rot_*). */
     CASE_32_64(rotr)     /* Optional (TCG_TARGET_HAS_rot_*). */
     CASE_32_64(clz)      /* Optional (TCG_TARGET_HAS_clz_*). */

From 8726c7d79967c740f7d5a963ac2d855354805cd2 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Jan 2025 09:53:38 -0800
Subject: [PATCH 0418/2760] tcg: Do not require both rotr and rotl from the
 backend

Many host architectures do not implement both rotate right
and rotate left and require the compiler to negate the
shift count to rotate the opposite direction.  We have been
requiring the backend to perform this transformation.
Do this during opcode expansion so that the next patch
can drop support where possible in the backend.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tcg-op.c | 98 +++++++++++++++++++++++++++++-----------------------
 1 file changed, 54 insertions(+), 44 deletions(-)

diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index 43848ebc4f..8c8b9d179b 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -829,15 +829,18 @@ void tcg_gen_ctpop_i32(TCGv_i32 ret, TCGv_i32 arg1)
 
 void tcg_gen_rotl_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 {
-    if (TCG_TARGET_HAS_rot_i32) {
+    if (tcg_op_supported(INDEX_op_rotl_i32, TCG_TYPE_I32, 0)) {
         tcg_gen_op3_i32(INDEX_op_rotl_i32, ret, arg1, arg2);
+    } else if (tcg_op_supported(INDEX_op_rotr_i32, TCG_TYPE_I32, 0)) {
+        TCGv_i32 t0 = tcg_temp_ebb_new_i32();
+        tcg_gen_neg_i32(t0, arg2);
+        tcg_gen_op3_i32(INDEX_op_rotr_i32, ret, arg1, t0);
+        tcg_temp_free_i32(t0);
     } else {
-        TCGv_i32 t0, t1;
-
-        t0 = tcg_temp_ebb_new_i32();
-        t1 = tcg_temp_ebb_new_i32();
+        TCGv_i32 t0 = tcg_temp_ebb_new_i32();
+        TCGv_i32 t1 = tcg_temp_ebb_new_i32();
         tcg_gen_shl_i32(t0, arg1, arg2);
-        tcg_gen_subfi_i32(t1, 32, arg2);
+        tcg_gen_neg_i32(t1, arg2);
         tcg_gen_shr_i32(t1, arg1, t1);
         tcg_gen_or_i32(ret, t0, t1);
         tcg_temp_free_i32(t0);
@@ -851,12 +854,15 @@ void tcg_gen_rotli_i32(TCGv_i32 ret, TCGv_i32 arg1, int32_t arg2)
     /* some cases can be optimized here */
     if (arg2 == 0) {
         tcg_gen_mov_i32(ret, arg1);
-    } else if (TCG_TARGET_HAS_rot_i32) {
-        tcg_gen_rotl_i32(ret, arg1, tcg_constant_i32(arg2));
+    } else if (tcg_op_supported(INDEX_op_rotl_i32, TCG_TYPE_I32, 0)) {
+        TCGv_i32 t0 = tcg_constant_i32(arg2);
+        tcg_gen_op3_i32(INDEX_op_rotl_i32, ret, arg1, t0);
+    } else if (tcg_op_supported(INDEX_op_rotr_i32, TCG_TYPE_I32, 0)) {
+        TCGv_i32 t0 = tcg_constant_i32(32 - arg2);
+        tcg_gen_op3_i32(INDEX_op_rotr_i32, ret, arg1, t0);
     } else {
-        TCGv_i32 t0, t1;
-        t0 = tcg_temp_ebb_new_i32();
-        t1 = tcg_temp_ebb_new_i32();
+        TCGv_i32 t0 = tcg_temp_ebb_new_i32();
+        TCGv_i32 t1 = tcg_temp_ebb_new_i32();
         tcg_gen_shli_i32(t0, arg1, arg2);
         tcg_gen_shri_i32(t1, arg1, 32 - arg2);
         tcg_gen_or_i32(ret, t0, t1);
@@ -867,15 +873,18 @@ void tcg_gen_rotli_i32(TCGv_i32 ret, TCGv_i32 arg1, int32_t arg2)
 
 void tcg_gen_rotr_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 {
-    if (TCG_TARGET_HAS_rot_i32) {
+    if (tcg_op_supported(INDEX_op_rotr_i32, TCG_TYPE_I32, 0)) {
         tcg_gen_op3_i32(INDEX_op_rotr_i32, ret, arg1, arg2);
+    } else if (tcg_op_supported(INDEX_op_rotl_i32, TCG_TYPE_I32, 0)) {
+        TCGv_i32 t0 = tcg_temp_ebb_new_i32();
+        tcg_gen_neg_i32(t0, arg2);
+        tcg_gen_op3_i32(INDEX_op_rotl_i32, ret, arg1, t0);
+        tcg_temp_free_i32(t0);
     } else {
-        TCGv_i32 t0, t1;
-
-        t0 = tcg_temp_ebb_new_i32();
-        t1 = tcg_temp_ebb_new_i32();
+        TCGv_i32 t0 = tcg_temp_ebb_new_i32();
+        TCGv_i32 t1 = tcg_temp_ebb_new_i32();
         tcg_gen_shr_i32(t0, arg1, arg2);
-        tcg_gen_subfi_i32(t1, 32, arg2);
+        tcg_gen_neg_i32(t1, arg2);
         tcg_gen_shl_i32(t1, arg1, t1);
         tcg_gen_or_i32(ret, t0, t1);
         tcg_temp_free_i32(t0);
@@ -886,12 +895,7 @@ void tcg_gen_rotr_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 void tcg_gen_rotri_i32(TCGv_i32 ret, TCGv_i32 arg1, int32_t arg2)
 {
     tcg_debug_assert(arg2 >= 0 && arg2 < 32);
-    /* some cases can be optimized here */
-    if (arg2 == 0) {
-        tcg_gen_mov_i32(ret, arg1);
-    } else {
-        tcg_gen_rotli_i32(ret, arg1, 32 - arg2);
-    }
+    tcg_gen_rotli_i32(ret, arg1, -arg2 & 31);
 }
 
 void tcg_gen_deposit_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2,
@@ -2437,14 +2441,18 @@ void tcg_gen_ctpop_i64(TCGv_i64 ret, TCGv_i64 arg1)
 
 void tcg_gen_rotl_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
 {
-    if (TCG_TARGET_HAS_rot_i64) {
+    if (tcg_op_supported(INDEX_op_rotl_i64, TCG_TYPE_I64, 0)) {
         tcg_gen_op3_i64(INDEX_op_rotl_i64, ret, arg1, arg2);
+    } else if (tcg_op_supported(INDEX_op_rotl_i64, TCG_TYPE_I64, 0)) {
+        TCGv_i64 t0 = tcg_temp_ebb_new_i64();
+        tcg_gen_neg_i64(t0, arg2);
+        tcg_gen_op3_i64(INDEX_op_rotr_i64, ret, arg1, t0);
+        tcg_temp_free_i64(t0);
     } else {
-        TCGv_i64 t0, t1;
-        t0 = tcg_temp_ebb_new_i64();
-        t1 = tcg_temp_ebb_new_i64();
+        TCGv_i64 t0 = tcg_temp_ebb_new_i64();
+        TCGv_i64 t1 = tcg_temp_ebb_new_i64();
         tcg_gen_shl_i64(t0, arg1, arg2);
-        tcg_gen_subfi_i64(t1, 64, arg2);
+        tcg_gen_neg_i64(t1, arg2);
         tcg_gen_shr_i64(t1, arg1, t1);
         tcg_gen_or_i64(ret, t0, t1);
         tcg_temp_free_i64(t0);
@@ -2458,12 +2466,15 @@ void tcg_gen_rotli_i64(TCGv_i64 ret, TCGv_i64 arg1, int64_t arg2)
     /* some cases can be optimized here */
     if (arg2 == 0) {
         tcg_gen_mov_i64(ret, arg1);
-    } else if (TCG_TARGET_HAS_rot_i64) {
-        tcg_gen_rotl_i64(ret, arg1, tcg_constant_i64(arg2));
+    } else if (tcg_op_supported(INDEX_op_rotl_i64, TCG_TYPE_I64, 0)) {
+        TCGv_i64 t0 = tcg_constant_i64(arg2);
+        tcg_gen_op3_i64(INDEX_op_rotl_i64, ret, arg1, t0);
+    } else if (tcg_op_supported(INDEX_op_rotr_i64, TCG_TYPE_I64, 0)) {
+        TCGv_i64 t0 = tcg_constant_i64(64 - arg2);
+        tcg_gen_op3_i64(INDEX_op_rotr_i64, ret, arg1, t0);
     } else {
-        TCGv_i64 t0, t1;
-        t0 = tcg_temp_ebb_new_i64();
-        t1 = tcg_temp_ebb_new_i64();
+        TCGv_i64 t0 = tcg_temp_ebb_new_i64();
+        TCGv_i64 t1 = tcg_temp_ebb_new_i64();
         tcg_gen_shli_i64(t0, arg1, arg2);
         tcg_gen_shri_i64(t1, arg1, 64 - arg2);
         tcg_gen_or_i64(ret, t0, t1);
@@ -2474,14 +2485,18 @@ void tcg_gen_rotli_i64(TCGv_i64 ret, TCGv_i64 arg1, int64_t arg2)
 
 void tcg_gen_rotr_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
 {
-    if (TCG_TARGET_HAS_rot_i64) {
+    if (tcg_op_supported(INDEX_op_rotr_i64, TCG_TYPE_I64, 0)) {
         tcg_gen_op3_i64(INDEX_op_rotr_i64, ret, arg1, arg2);
+    } else if (tcg_op_supported(INDEX_op_rotl_i64, TCG_TYPE_I64, 0)) {
+        TCGv_i64 t0 = tcg_temp_ebb_new_i64();
+        tcg_gen_neg_i64(t0, arg2);
+        tcg_gen_op3_i64(INDEX_op_rotl_i64, ret, arg1, t0);
+        tcg_temp_free_i64(t0);
     } else {
-        TCGv_i64 t0, t1;
-        t0 = tcg_temp_ebb_new_i64();
-        t1 = tcg_temp_ebb_new_i64();
+        TCGv_i64 t0 = tcg_temp_ebb_new_i64();
+        TCGv_i64 t1 = tcg_temp_ebb_new_i64();
         tcg_gen_shr_i64(t0, arg1, arg2);
-        tcg_gen_subfi_i64(t1, 64, arg2);
+        tcg_gen_neg_i64(t1, arg2);
         tcg_gen_shl_i64(t1, arg1, t1);
         tcg_gen_or_i64(ret, t0, t1);
         tcg_temp_free_i64(t0);
@@ -2492,12 +2507,7 @@ void tcg_gen_rotr_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
 void tcg_gen_rotri_i64(TCGv_i64 ret, TCGv_i64 arg1, int64_t arg2)
 {
     tcg_debug_assert(arg2 >= 0 && arg2 < 64);
-    /* some cases can be optimized here */
-    if (arg2 == 0) {
-        tcg_gen_mov_i64(ret, arg1);
-    } else {
-        tcg_gen_rotli_i64(ret, arg1, 64 - arg2);
-    }
+    tcg_gen_rotli_i64(ret, arg1, -arg2 & 63);
 }
 
 void tcg_gen_deposit_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2,

From 03568c0d539581c6e86263d2fd7396f5a1e25a6b Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Jan 2025 10:22:53 -0800
Subject: [PATCH 0419/2760] tcg: Convert rotl, rotr to TCGOutOpBinary

For aarch64, arm, loongarch64, mips, we can drop rotl.
For ppc, s390x we can drop rotr.
Only x86, riscv, tci have both rotl and rotr.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target-has.h     |  2 -
 tcg/aarch64/tcg-target.c.inc     | 62 +++++++++---------------
 tcg/arm/tcg-target-has.h         |  1 -
 tcg/arm/tcg-target.c.inc         | 44 ++++++++---------
 tcg/i386/tcg-target-has.h        |  2 -
 tcg/i386/tcg-target.c.inc        | 62 ++++++++++++++++--------
 tcg/loongarch64/tcg-target-has.h |  2 -
 tcg/loongarch64/tcg-target.c.inc | 70 ++++++++++++---------------
 tcg/mips/tcg-target-has.h        |  2 -
 tcg/mips/tcg-target.c.inc        | 75 +++++++++++++----------------
 tcg/ppc/tcg-target-has.h         |  2 -
 tcg/ppc/tcg-target.c.inc         | 70 ++++++++++++---------------
 tcg/riscv/tcg-target-has.h       |  2 -
 tcg/riscv/tcg-target.c.inc       | 83 ++++++++++++++++++--------------
 tcg/s390x/tcg-target-has.h       |  2 -
 tcg/s390x/tcg-target.c.inc       | 72 +++++++++++----------------
 tcg/sparc64/tcg-target-has.h     |  2 -
 tcg/sparc64/tcg-target.c.inc     |  8 +++
 tcg/tcg-has.h                    |  1 -
 tcg/tcg.c                        | 14 +++---
 tcg/tci.c                        | 12 ++---
 tcg/tci/tcg-target-has.h         |  2 -
 tcg/tci/tcg-target-opc.h.inc     |  2 +
 tcg/tci/tcg-target.c.inc         | 34 ++++++++++---
 24 files changed, 306 insertions(+), 322 deletions(-)

diff --git a/tcg/aarch64/tcg-target-has.h b/tcg/aarch64/tcg-target-has.h
index 1fdff25d05..fa79cbc1f0 100644
--- a/tcg/aarch64/tcg-target-has.h
+++ b/tcg/aarch64/tcg-target-has.h
@@ -15,7 +15,6 @@
 /* optional instructions */
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
-#define TCG_TARGET_HAS_rot_i32          1
 #define TCG_TARGET_HAS_clz_i32          1
 #define TCG_TARGET_HAS_ctz_i32          1
 #define TCG_TARGET_HAS_ctpop_i32        0
@@ -31,7 +30,6 @@
 #define TCG_TARGET_HAS_bswap16_i64      1
 #define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1
-#define TCG_TARGET_HAS_rot_i64          1
 #define TCG_TARGET_HAS_clz_i64          1
 #define TCG_TARGET_HAS_ctz_i64          1
 #define TCG_TARGET_HAS_ctpop_i64        0
diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index 90bdbf8387..00fca43840 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -1347,20 +1347,6 @@ static inline void tcg_out_extr(TCGContext *s, TCGType ext, TCGReg rd,
     tcg_out_insn(s, 3403, EXTR, ext, rd, rn, rm, a);
 }
 
-static inline void tcg_out_rotr(TCGContext *s, TCGType ext,
-                                TCGReg rd, TCGReg rn, unsigned int m)
-{
-    int max = ext ? 63 : 31;
-    tcg_out_extr(s, ext, rd, rn, rn, m & max);
-}
-
-static inline void tcg_out_rotl(TCGContext *s, TCGType ext,
-                                TCGReg rd, TCGReg rn, unsigned int m)
-{
-    int max = ext ? 63 : 31;
-    tcg_out_extr(s, ext, rd, rn, rn, -m & max);
-}
-
 static inline void tcg_out_dep(TCGContext *s, TCGType ext, TCGReg rd,
                                TCGReg rn, unsigned lsb, unsigned width)
 {
@@ -2277,6 +2263,29 @@ static const TCGOutOpBinary outop_remu = {
     .out_rrr = tgen_remu,
 };
 
+static const TCGOutOpBinary outop_rotl = {
+    .base.static_constraint = C_NotImplemented,
+};
+
+static void tgen_rotr(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_insn(s, 3508, RORV, type, a0, a1, a2);
+}
+
+static void tgen_rotri(TCGContext *s, TCGType type,
+                       TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    int max = type == TCG_TYPE_I32 ? 31 : 63;
+    tcg_out_extr(s, type, a0, a1, a1, a2 & max);
+}
+
+static const TCGOutOpBinary outop_rotr = {
+    .base.static_constraint = C_O1_I2(r, r, ri),
+    .out_rrr = tgen_rotr,
+    .out_rri = tgen_rotri,
+};
+
 static void tgen_sar(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -2451,25 +2460,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType ext,
         tcg_out_ldst(s, I3312_STRX, a0, a1, a2, 3);
         break;
 
-    case INDEX_op_rotr_i64:
-    case INDEX_op_rotr_i32:
-        if (c2) {
-            tcg_out_rotr(s, ext, a0, a1, a2);
-        } else {
-            tcg_out_insn(s, 3508, RORV, ext, a0, a1, a2);
-        }
-        break;
-
-    case INDEX_op_rotl_i64:
-    case INDEX_op_rotl_i32:
-        if (c2) {
-            tcg_out_rotl(s, ext, a0, a1, a2);
-        } else {
-            tcg_out_insn(s, 3502, SUB, 0, TCG_REG_TMP0, TCG_REG_XZR, a2);
-            tcg_out_insn(s, 3508, RORV, ext, a0, a1, TCG_REG_TMP0);
-        }
-        break;
-
     case INDEX_op_clz_i64:
     case INDEX_op_clz_i32:
         tcg_out_cltz(s, ext, a0, a1, a2, c2, false);
@@ -3099,12 +3089,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_negsetcond_i64:
         return C_O1_I2(r, r, rC);
 
-    case INDEX_op_rotl_i32:
-    case INDEX_op_rotr_i32:
-    case INDEX_op_rotl_i64:
-    case INDEX_op_rotr_i64:
-        return C_O1_I2(r, r, ri);
-
     case INDEX_op_clz_i32:
     case INDEX_op_ctz_i32:
     case INDEX_op_clz_i64:
diff --git a/tcg/arm/tcg-target-has.h b/tcg/arm/tcg-target-has.h
index 32d73d3443..12ffbcda2b 100644
--- a/tcg/arm/tcg-target-has.h
+++ b/tcg/arm/tcg-target-has.h
@@ -26,7 +26,6 @@ extern bool use_neon_instructions;
 /* optional instructions */
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
-#define TCG_TARGET_HAS_rot_i32          1
 #define TCG_TARGET_HAS_clz_i32          1
 #define TCG_TARGET_HAS_ctz_i32          use_armv7_instructions
 #define TCG_TARGET_HAS_ctpop_i32        0
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index 058677650b..462f0ec08d 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -1963,6 +1963,28 @@ static const TCGOutOpBinary outop_remu = {
     .base.static_constraint = C_NotImplemented,
 };
 
+static const TCGOutOpBinary outop_rotl = {
+    .base.static_constraint = C_NotImplemented,
+};
+
+static void tgen_rotr(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_dat_reg(s, COND_AL, ARITH_MOV, a0, 0, a1, SHIFT_REG_ROR(a2));
+}
+
+static void tgen_rotri(TCGContext *s, TCGType type,
+                       TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    tcg_out_dat_reg(s, COND_AL, ARITH_MOV, a0, 0, a1, SHIFT_IMM_ROR(a2 & 0x1f));
+}
+
+static const TCGOutOpBinary outop_rotr = {
+    .base.static_constraint = C_O1_I2(r, r, ri),
+    .out_rrr = tgen_rotr,
+    .out_rri = tgen_rotri,
+};
+
 static void tgen_sar(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -2171,24 +2193,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     case INDEX_op_muls2_i32:
         tcg_out_smull32(s, COND_AL, args[0], args[1], args[2], args[3]);
         break;
-    case INDEX_op_rotr_i32:
-        c = const_args[2] ? (args[2] & 0x1f) ? SHIFT_IMM_ROR(args[2] & 0x1f) :
-                SHIFT_IMM_LSL(0) : SHIFT_REG_ROR(args[2]);
-        tcg_out_dat_reg(s, COND_AL, ARITH_MOV, args[0], 0, args[1], c);
-        break;
-
-    case INDEX_op_rotl_i32:
-        if (const_args[2]) {
-            tcg_out_dat_reg(s, COND_AL, ARITH_MOV, args[0], 0, args[1],
-                            ((0x20 - args[2]) & 0x1f) ?
-                            SHIFT_IMM_ROR((0x20 - args[2]) & 0x1f) :
-                            SHIFT_IMM_LSL(0));
-        } else {
-            tcg_out_dat_imm(s, COND_AL, ARITH_RSB, TCG_REG_TMP, args[2], 0x20);
-            tcg_out_dat_reg(s, COND_AL, ARITH_MOV, args[0], 0, args[1],
-                            SHIFT_REG_ROR(TCG_REG_TMP));
-        }
-        break;
 
     case INDEX_op_ctz_i32:
         tcg_out_dat_reg(s, COND_AL, INSN_RBIT, TCG_REG_TMP, 0, args[1], 0);
@@ -2342,10 +2346,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_muls2_i32:
         return C_O2_I2(r, r, r, r);
 
-    case INDEX_op_rotl_i32:
-    case INDEX_op_rotr_i32:
-        return C_O1_I2(r, r, ri);
-
     case INDEX_op_brcond_i32:
         return C_O0_I2(r, rIN);
     case INDEX_op_deposit_i32:
diff --git a/tcg/i386/tcg-target-has.h b/tcg/i386/tcg-target-has.h
index aee6066579..a7199463df 100644
--- a/tcg/i386/tcg-target-has.h
+++ b/tcg/i386/tcg-target-has.h
@@ -26,7 +26,6 @@
 #define have_avx512vbmi2  ((cpuinfo & CPUINFO_AVX512VBMI2) && have_avx512vl)
 
 /* optional instructions */
-#define TCG_TARGET_HAS_rot_i32          1
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
 #define TCG_TARGET_HAS_clz_i32          1
@@ -42,7 +41,6 @@
 #if TCG_TARGET_REG_BITS == 64
 /* Keep 32-bit values zero-extended in a register.  */
 #define TCG_TARGET_HAS_extr_i64_i32     1
-#define TCG_TARGET_HAS_rot_i64          1
 #define TCG_TARGET_HAS_bswap16_i64      1
 #define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index 1e81455461..dd35bba57f 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -2744,6 +2744,46 @@ static const TCGOutOpBinary outop_remu = {
     .base.static_constraint = C_NotImplemented,
 };
 
+static void tgen_rotl(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    int rexw = type == TCG_TYPE_I32 ? 0 : P_REXW;
+    tcg_out_modrm(s, OPC_SHIFT_cl + rexw, SHIFT_ROL, a0);
+}
+
+static void tgen_rotli(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    int rexw = type == TCG_TYPE_I32 ? 0 : P_REXW;
+    tcg_out_shifti(s, SHIFT_ROL + rexw, a0, a2);
+}
+
+static const TCGOutOpBinary outop_rotl = {
+    .base.static_constraint = C_O1_I2(r, 0, ci),
+    .out_rrr = tgen_rotl,
+    .out_rri = tgen_rotli,
+};
+
+static void tgen_rotr(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    int rexw = type == TCG_TYPE_I32 ? 0 : P_REXW;
+    tcg_out_modrm(s, OPC_SHIFT_cl + rexw, SHIFT_ROR, a0);
+}
+
+static void tgen_rotri(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    int rexw = type == TCG_TYPE_I32 ? 0 : P_REXW;
+    tcg_out_shifti(s, SHIFT_ROR + rexw, a0, a2);
+}
+
+static const TCGOutOpBinary outop_rotr = {
+    .base.static_constraint = C_O1_I2(r, 0, ci),
+    .out_rrr = tgen_rotr,
+    .out_rri = tgen_rotri,
+};
+
 static TCGConstraintSetIndex cset_shift(TCGType type, unsigned flags)
 {
     return have_bmi2 ? C_O1_I2(r, r, ri) : C_O1_I2(r, 0, ci);
@@ -2901,7 +2941,7 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const int const_args[TCG_MAX_OP_ARGS])
 {
     TCGArg a0, a1, a2;
-    int c, const_a2, rexw;
+    int const_a2, rexw;
 
 #if TCG_TARGET_REG_BITS == 64
 # define OP_32_64(x) \
@@ -2976,20 +3016,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    OP_32_64(rotl):
-        c = SHIFT_ROL;
-        goto gen_shift;
-    OP_32_64(rotr):
-        c = SHIFT_ROR;
-        goto gen_shift;
-    gen_shift:
-        if (const_a2) {
-            tcg_out_shifti(s, c + rexw, a0, a2);
-        } else {
-            tcg_out_modrm(s, OPC_SHIFT_cl + rexw, c, a0);
-        }
-        break;
-
     OP_32_64(ctz):
         tcg_out_ctz(s, rexw, args[0], args[1], args[2], const_args[2]);
         break;
@@ -3824,12 +3850,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(re, r);
 
-    case INDEX_op_rotl_i32:
-    case INDEX_op_rotl_i64:
-    case INDEX_op_rotr_i32:
-    case INDEX_op_rotr_i64:
-        return C_O1_I2(r, 0, ci);
-
     case INDEX_op_brcond_i32:
     case INDEX_op_brcond_i64:
         return C_O0_I2(r, reT);
diff --git a/tcg/loongarch64/tcg-target-has.h b/tcg/loongarch64/tcg-target-has.h
index 5dfc69ae6a..303134390a 100644
--- a/tcg/loongarch64/tcg-target-has.h
+++ b/tcg/loongarch64/tcg-target-has.h
@@ -11,7 +11,6 @@
 
 /* optional instructions */
 #define TCG_TARGET_HAS_negsetcond_i32   0
-#define TCG_TARGET_HAS_rot_i32          1
 #define TCG_TARGET_HAS_extract2_i32     0
 #define TCG_TARGET_HAS_add2_i32         0
 #define TCG_TARGET_HAS_sub2_i32         0
@@ -26,7 +25,6 @@
 
 /* 64-bit operations */
 #define TCG_TARGET_HAS_negsetcond_i64   0
-#define TCG_TARGET_HAS_rot_i64          1
 #define TCG_TARGET_HAS_extract2_i64     0
 #define TCG_TARGET_HAS_extr_i64_i32     1
 #define TCG_TARGET_HAS_bswap16_i64      1
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index aae0f03505..26cf982780 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -1489,6 +1489,36 @@ static const TCGOutOpBinary outop_remu = {
     .out_rrr = tgen_remu,
 };
 
+static const TCGOutOpBinary outop_rotl = {
+    .base.static_constraint = C_NotImplemented,
+};
+
+static void tgen_rotr(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    if (type == TCG_TYPE_I32) {
+        tcg_out_opc_rotr_w(s, a0, a1, a2);
+    } else {
+        tcg_out_opc_rotr_d(s, a0, a1, a2);
+    }
+}
+
+static void tgen_rotri(TCGContext *s, TCGType type,
+                       TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    if (type == TCG_TYPE_I32) {
+        tcg_out_opc_rotri_w(s, a0, a1, a2 & 0x1f);
+    } else {
+        tcg_out_opc_rotri_d(s, a0, a1, a2 & 0x3f);
+    }
+}
+
+static const TCGOutOpBinary outop_rotr = {
+    .base.static_constraint = C_O1_I2(r, r, ri),
+    .out_rrr = tgen_rotr,
+    .out_rri = tgen_rotri,
+};
+
 static void tgen_sar(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -1738,40 +1768,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_clzctz(s, OPC_CTZ_D, a0, a1, a2, c2, false);
         break;
 
-    case INDEX_op_rotl_i32:
-        /* transform into equivalent rotr/rotri */
-        if (c2) {
-            tcg_out_opc_rotri_w(s, a0, a1, (32 - a2) & 0x1f);
-        } else {
-            tcg_out_opc_sub_w(s, TCG_REG_TMP0, TCG_REG_ZERO, a2);
-            tcg_out_opc_rotr_w(s, a0, a1, TCG_REG_TMP0);
-        }
-        break;
-    case INDEX_op_rotl_i64:
-        /* transform into equivalent rotr/rotri */
-        if (c2) {
-            tcg_out_opc_rotri_d(s, a0, a1, (64 - a2) & 0x3f);
-        } else {
-            tcg_out_opc_sub_w(s, TCG_REG_TMP0, TCG_REG_ZERO, a2);
-            tcg_out_opc_rotr_d(s, a0, a1, TCG_REG_TMP0);
-        }
-        break;
-
-    case INDEX_op_rotr_i32:
-        if (c2) {
-            tcg_out_opc_rotri_w(s, a0, a1, a2 & 0x1f);
-        } else {
-            tcg_out_opc_rotr_w(s, a0, a1, a2);
-        }
-        break;
-    case INDEX_op_rotr_i64:
-        if (c2) {
-            tcg_out_opc_rotri_d(s, a0, a1, a2 & 0x3f);
-        } else {
-            tcg_out_opc_rotr_d(s, a0, a1, a2);
-        }
-        break;
-
     case INDEX_op_setcond_i32:
     case INDEX_op_setcond_i64:
         tcg_out_setcond(s, args[3], a0, a1, a2, c2);
@@ -2402,12 +2398,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_qemu_ld_i64:
         return C_O1_I1(r, r);
 
-    case INDEX_op_rotl_i32:
-    case INDEX_op_rotl_i64:
-    case INDEX_op_rotr_i32:
-    case INDEX_op_rotr_i64:
-        return C_O1_I2(r, r, ri);
-
     case INDEX_op_clz_i32:
     case INDEX_op_clz_i64:
     case INDEX_op_ctz_i32:
diff --git a/tcg/mips/tcg-target-has.h b/tcg/mips/tcg-target-has.h
index ab6a134796..880eb084eb 100644
--- a/tcg/mips/tcg-target-has.h
+++ b/tcg/mips/tcg-target-has.h
@@ -60,7 +60,6 @@ extern bool use_mips32r2_instructions;
 
 /* optional instructions detected at runtime */
 #define TCG_TARGET_HAS_extract2_i32     0
-#define TCG_TARGET_HAS_rot_i32          use_mips32r2_instructions
 #define TCG_TARGET_HAS_clz_i32          use_mips32r2_instructions
 #define TCG_TARGET_HAS_ctz_i32          0
 #define TCG_TARGET_HAS_ctpop_i32        0
@@ -71,7 +70,6 @@ extern bool use_mips32r2_instructions;
 #define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1
 #define TCG_TARGET_HAS_extract2_i64     0
-#define TCG_TARGET_HAS_rot_i64          use_mips32r2_instructions
 #define TCG_TARGET_HAS_clz_i64          use_mips32r2_instructions
 #define TCG_TARGET_HAS_ctz_i64          0
 #define TCG_TARGET_HAS_ctpop_i64        0
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index 16c3d59c19..fb9fe0c40e 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -1908,6 +1908,39 @@ static const TCGOutOpBinary outop_remu = {
     .out_rrr = tgen_remu,
 };
 
+static const TCGOutOpBinary outop_rotl = {
+    .base.static_constraint = C_NotImplemented,
+};
+
+static TCGConstraintSetIndex cset_rotr(TCGType type, unsigned flags)
+{
+    return use_mips32r2_instructions ? C_O1_I2(r, r, ri) : C_NotImplemented;
+}
+
+static void tgen_rotr(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    MIPSInsn insn = type == TCG_TYPE_I32 ? OPC_ROTRV : OPC_DROTRV;
+    tcg_out_opc_reg(s, insn, a0, a1, a2);
+}
+
+static void tgen_rotri(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    if (type == TCG_TYPE_I32) {
+        tcg_out_opc_sa(s, OPC_ROTR, a0, a1, a2);
+    } else {
+        tcg_out_opc_sa64(s, OPC_DROTR, OPC_DROTR32, a0, a1, a2);
+    }
+}
+
+static const TCGOutOpBinary outop_rotr = {
+    .base.static_constraint = C_Dynamic,
+    .base.dynamic_constraint = cset_rotr,
+    .out_rrr = tgen_rotr,
+    .out_rri = tgen_rotri,
+};
+
 static void tgen_sar(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -2032,14 +2065,12 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
                        const int const_args[TCG_MAX_OP_ARGS])
 {
-    MIPSInsn i1, i2;
+    MIPSInsn i1;
     TCGArg a0, a1, a2;
-    int c2;
 
     a0 = args[0];
     a1 = args[1];
     a2 = args[2];
-    c2 = const_args[2];
 
     switch (opc) {
     case INDEX_op_goto_ptr:
@@ -2134,39 +2165,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_dsra(s, a0, a1, 32);
         break;
 
-    case INDEX_op_rotr_i32:
-        i1 = OPC_ROTRV, i2 = OPC_ROTR;
-        if (c2) {
-            tcg_out_opc_sa(s, i2, a0, a1, a2);
-            break;
-        }
-    do_shiftv:
-        tcg_out_opc_reg(s, i1, a0, a2, a1);
-        break;
-    case INDEX_op_rotl_i32:
-        if (c2) {
-            tcg_out_opc_sa(s, OPC_ROTR, a0, a1, 32 - a2);
-        } else {
-            tcg_out_opc_reg(s, OPC_SUBU, TCG_TMP0, TCG_REG_ZERO, a2);
-            tcg_out_opc_reg(s, OPC_ROTRV, a0, TCG_TMP0, a1);
-        }
-        break;
-    case INDEX_op_rotr_i64:
-        if (c2) {
-            tcg_out_opc_sa64(s, OPC_DROTR, OPC_DROTR32, a0, a1, a2);
-            break;
-        }
-        i1 = OPC_DROTRV;
-        goto do_shiftv;
-    case INDEX_op_rotl_i64:
-        if (c2) {
-            tcg_out_opc_sa64(s, OPC_DROTR, OPC_DROTR32, a0, a1, 64 - a2);
-        } else {
-            tcg_out_opc_reg(s, OPC_DSUBU, TCG_TMP0, TCG_REG_ZERO, a2);
-            tcg_out_opc_reg(s, OPC_DROTRV, a0, TCG_TMP0, a1);
-        }
-        break;
-
     case INDEX_op_clz_i32:
         tcg_out_clz(s, OPC_CLZ, OPC_CLZ_R6, 32, a0, a1, a2);
         break;
@@ -2331,11 +2329,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_muls2_i64:
     case INDEX_op_mulu2_i64:
         return C_O2_I2(r, r, r, r);
-    case INDEX_op_rotr_i32:
-    case INDEX_op_rotl_i32:
-    case INDEX_op_rotr_i64:
-    case INDEX_op_rotl_i64:
-        return C_O1_I2(r, r, ri);
     case INDEX_op_clz_i32:
     case INDEX_op_clz_i64:
         return C_O1_I2(r, r, rzW);
diff --git a/tcg/ppc/tcg-target-has.h b/tcg/ppc/tcg-target-has.h
index 37e88a3193..71c02d88b9 100644
--- a/tcg/ppc/tcg-target-has.h
+++ b/tcg/ppc/tcg-target-has.h
@@ -17,7 +17,6 @@
 #define have_vsx       (cpuinfo & CPUINFO_VSX)
 
 /* optional instructions */
-#define TCG_TARGET_HAS_rot_i32          1
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
 #define TCG_TARGET_HAS_clz_i32          1
@@ -33,7 +32,6 @@
 #define TCG_TARGET_HAS_add2_i32         0
 #define TCG_TARGET_HAS_sub2_i32         0
 #define TCG_TARGET_HAS_extr_i64_i32     0
-#define TCG_TARGET_HAS_rot_i64          1
 #define TCG_TARGET_HAS_bswap16_i64      1
 #define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index 24e8f675bb..687b66af54 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -3122,6 +3122,36 @@ static const TCGOutOpBinary outop_remu = {
     .out_rrr = tgen_remu,
 };
 
+static void tgen_rotl(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    if (type == TCG_TYPE_I32) {
+        tcg_out32(s, RLWNM | SAB(a1, a0, a2) | MB(0) | ME(31));
+    } else {
+        tcg_out32(s, RLDCL | SAB(a1, a0, a2) | MB64(0));
+    }
+}
+
+static void tgen_rotli(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    if (type == TCG_TYPE_I32) {
+        tcg_out_rlw(s, RLWINM, a0, a1, a2, 0, 31);
+    } else {
+        tcg_out_rld(s, RLDICL, a0, a1, a2, 0);
+    }
+}
+
+static const TCGOutOpBinary outop_rotl = {
+    .base.static_constraint = C_O1_I2(r, r, ri),
+    .out_rrr = tgen_rotl,
+    .out_rri = tgen_rotli,
+};
+
+static const TCGOutOpBinary outop_rotr = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static void tgen_sar(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -3344,24 +3374,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out32(s, CNTPOPD | SAB(args[1], args[0], 0));
         break;
 
-    case INDEX_op_rotl_i32:
-        if (const_args[2]) {
-            tcg_out_rlw(s, RLWINM, args[0], args[1], args[2], 0, 31);
-        } else {
-            tcg_out32(s, RLWNM | SAB(args[1], args[0], args[2])
-                         | MB(0) | ME(31));
-        }
-        break;
-    case INDEX_op_rotr_i32:
-        if (const_args[2]) {
-            tcg_out_rlw(s, RLWINM, args[0], args[1], 32 - args[2], 0, 31);
-        } else {
-            tcg_out32(s, SUBFIC | TAI(TCG_REG_R0, args[2], 32));
-            tcg_out32(s, RLWNM | SAB(args[1], args[0], TCG_REG_R0)
-                         | MB(0) | ME(31));
-        }
-        break;
-
     case INDEX_op_brcond_i32:
         tcg_out_brcond(s, args[2], args[0], args[1], const_args[1],
                        arg_label(args[3]), TCG_TYPE_I32);
@@ -3374,22 +3386,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_brcond2(s, args, const_args);
         break;
 
-    case INDEX_op_rotl_i64:
-        if (const_args[2]) {
-            tcg_out_rld(s, RLDICL, args[0], args[1], args[2], 0);
-        } else {
-            tcg_out32(s, RLDCL | SAB(args[1], args[0], args[2]) | MB64(0));
-        }
-        break;
-    case INDEX_op_rotr_i64:
-        if (const_args[2]) {
-            tcg_out_rld(s, RLDICL, args[0], args[1], 64 - args[2], 0);
-        } else {
-            tcg_out32(s, SUBFIC | TAI(TCG_REG_R0, args[2], 64));
-            tcg_out32(s, RLDCL | SAB(args[1], args[0], TCG_REG_R0) | MB64(0));
-        }
-        break;
-
     case INDEX_op_qemu_ld_i32:
         tcg_out_qemu_ld(s, args[0], -1, args[1], args[2], TCG_TYPE_I32);
         break;
@@ -4232,12 +4228,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(r, r);
 
-    case INDEX_op_rotl_i32:
-    case INDEX_op_rotr_i32:
-    case INDEX_op_rotl_i64:
-    case INDEX_op_rotr_i64:
-        return C_O1_I2(r, r, ri);
-
     case INDEX_op_clz_i32:
     case INDEX_op_ctz_i32:
     case INDEX_op_clz_i64:
diff --git a/tcg/riscv/tcg-target-has.h b/tcg/riscv/tcg-target-has.h
index b3c6899887..c7745a6462 100644
--- a/tcg/riscv/tcg-target-has.h
+++ b/tcg/riscv/tcg-target-has.h
@@ -11,7 +11,6 @@
 
 /* optional instructions */
 #define TCG_TARGET_HAS_negsetcond_i32   1
-#define TCG_TARGET_HAS_rot_i32          (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_extract2_i32     0
 #define TCG_TARGET_HAS_add2_i32         1
 #define TCG_TARGET_HAS_sub2_i32         1
@@ -25,7 +24,6 @@
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
 #define TCG_TARGET_HAS_negsetcond_i64   1
-#define TCG_TARGET_HAS_rot_i64          (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_extract2_i64     0
 #define TCG_TARGET_HAS_extr_i64_i32     1
 #define TCG_TARGET_HAS_bswap16_i64      (cpuinfo & CPUINFO_ZBB)
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index 8cab07a392..4dd892d98d 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -2144,6 +2144,53 @@ static const TCGOutOpBinary outop_remu = {
     .out_rrr = tgen_remu,
 };
 
+static TCGConstraintSetIndex cset_rot(TCGType type, unsigned flags)
+{
+    return cpuinfo & CPUINFO_ZBB ? C_O1_I2(r, r, ri) : C_NotImplemented;
+}
+
+static void tgen_rotr(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    RISCVInsn insn = type == TCG_TYPE_I32 ? OPC_RORW : OPC_ROR;
+    tcg_out_opc_reg(s, insn, a0, a1, a2);
+}
+
+static void tgen_rotri(TCGContext *s, TCGType type,
+                       TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    RISCVInsn insn = type == TCG_TYPE_I32 ? OPC_RORIW : OPC_RORI;
+    unsigned mask = type == TCG_TYPE_I32 ? 31 : 63;
+    tcg_out_opc_imm(s, insn, a0, a1, a2 & mask);
+}
+
+static const TCGOutOpBinary outop_rotr = {
+    .base.static_constraint = C_Dynamic,
+    .base.dynamic_constraint = cset_rot,
+    .out_rrr = tgen_rotr,
+    .out_rri = tgen_rotri,
+};
+
+static void tgen_rotl(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    RISCVInsn insn = type == TCG_TYPE_I32 ? OPC_ROLW : OPC_ROL;
+    tcg_out_opc_reg(s, insn, a0, a1, a2);
+}
+
+static void tgen_rotli(TCGContext *s, TCGType type,
+                       TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    tgen_rotri(s, type, a0, a1, -a2);
+}
+
+static const TCGOutOpBinary outop_rotl = {
+    .base.static_constraint = C_Dynamic,
+    .base.dynamic_constraint = cset_rot,
+    .out_rrr = tgen_rotl,
+    .out_rri = tgen_rotli,
+};
+
 static void tgen_sar(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -2320,36 +2367,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_ldst(s, OPC_SD, a0, a1, a2);
         break;
 
-    case INDEX_op_rotl_i32:
-        if (c2) {
-            tcg_out_opc_imm(s, OPC_RORIW, a0, a1, -a2 & 0x1f);
-        } else {
-            tcg_out_opc_reg(s, OPC_ROLW, a0, a1, a2);
-        }
-        break;
-    case INDEX_op_rotl_i64:
-        if (c2) {
-            tcg_out_opc_imm(s, OPC_RORI, a0, a1, -a2 & 0x3f);
-        } else {
-            tcg_out_opc_reg(s, OPC_ROL, a0, a1, a2);
-        }
-        break;
-
-    case INDEX_op_rotr_i32:
-        if (c2) {
-            tcg_out_opc_imm(s, OPC_RORIW, a0, a1, a2 & 0x1f);
-        } else {
-            tcg_out_opc_reg(s, OPC_RORW, a0, a1, a2);
-        }
-        break;
-    case INDEX_op_rotr_i64:
-        if (c2) {
-            tcg_out_opc_imm(s, OPC_RORI, a0, a1, a2 & 0x3f);
-        } else {
-            tcg_out_opc_reg(s, OPC_ROR, a0, a1, a2);
-        }
-        break;
-
     case INDEX_op_bswap64_i64:
         tcg_out_opc_imm(s, OPC_REV8, a0, a1, 0);
         break;
@@ -2776,12 +2793,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_negsetcond_i64:
         return C_O1_I2(r, r, rI);
 
-    case INDEX_op_rotl_i32:
-    case INDEX_op_rotr_i32:
-    case INDEX_op_rotl_i64:
-    case INDEX_op_rotr_i64:
-        return C_O1_I2(r, r, ri);
-
     case INDEX_op_clz_i32:
     case INDEX_op_clz_i64:
     case INDEX_op_ctz_i32:
diff --git a/tcg/s390x/tcg-target-has.h b/tcg/s390x/tcg-target-has.h
index d61cc7a144..eaddf7005e 100644
--- a/tcg/s390x/tcg-target-has.h
+++ b/tcg/s390x/tcg-target-has.h
@@ -29,7 +29,6 @@ extern uint64_t s390_facilities[3];
     ((s390_facilities[FACILITY_##X / 64] >> (63 - FACILITY_##X % 64)) & 1)
 
 /* optional instructions */
-#define TCG_TARGET_HAS_rot_i32        1
 #define TCG_TARGET_HAS_bswap16_i32    1
 #define TCG_TARGET_HAS_bswap32_i32    1
 #define TCG_TARGET_HAS_clz_i32        0
@@ -44,7 +43,6 @@ extern uint64_t s390_facilities[3];
 #define TCG_TARGET_HAS_extr_i64_i32   0
 #define TCG_TARGET_HAS_qemu_st8_i32   0
 
-#define TCG_TARGET_HAS_rot_i64        1
 #define TCG_TARGET_HAS_bswap16_i64    1
 #define TCG_TARGET_HAS_bswap32_i64    1
 #define TCG_TARGET_HAS_bswap64_i64    1
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index 1cf4920276..76180dabcb 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -2445,6 +2445,35 @@ static const TCGOutOpBinary outop_remu = {
     .base.static_constraint = C_NotImplemented,
 };
 
+static void tgen_rotl_int(TCGContext *s, TCGType type, TCGReg dst,
+                          TCGReg src, TCGReg v, tcg_target_long i)
+{
+    S390Opcode insn = type == TCG_TYPE_I32 ? RSY_RLL : RSY_RLLG;
+    tcg_out_sh64(s, insn, dst, src, v, i);
+}
+
+static void tgen_rotl(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tgen_rotl_int(s, type, a0, a1, a2, 0);
+}
+
+static void tgen_rotli(TCGContext *s, TCGType type,
+                       TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    tgen_rotl_int(s, type, a0, a1, TCG_REG_NONE, a2);
+}
+
+static const TCGOutOpBinary outop_rotl = {
+    .base.static_constraint = C_O1_I2(r, r, ri),
+    .out_rrr = tgen_rotl,
+    .out_rri = tgen_rotli,
+};
+
+static const TCGOutOpBinary outop_rotr = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static void tgen_sar_int(TCGContext *s, TCGType type, TCGReg dst,
                          TCGReg src, TCGReg v, tcg_target_long i)
 {
@@ -2663,24 +2692,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_st(s, TCG_TYPE_I32, args[0], args[1], args[2]);
         break;
 
-    case INDEX_op_rotl_i32:
-        /* ??? Using tcg_out_sh64 here for the format; it is a 32-bit rol.  */
-        if (const_args[2]) {
-            tcg_out_sh64(s, RSY_RLL, args[0], args[1], TCG_REG_NONE, args[2]);
-        } else {
-            tcg_out_sh64(s, RSY_RLL, args[0], args[1], args[2], 0);
-        }
-        break;
-    case INDEX_op_rotr_i32:
-        if (const_args[2]) {
-            tcg_out_sh64(s, RSY_RLL, args[0], args[1],
-                         TCG_REG_NONE, (32 - args[2]) & 31);
-        } else {
-            tcg_out_insn(s, RR, LCR, TCG_TMP0, args[2]);
-            tcg_out_sh64(s, RSY_RLL, args[0], args[1], TCG_TMP0, 0);
-        }
-        break;
-
     case INDEX_op_bswap16_i32:
         a0 = args[0], a1 = args[1], a2 = args[2];
         tcg_out_insn(s, RRE, LRVR, a0, a1);
@@ -2806,26 +2817,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_insn(s, RRFa, MGRK, args[1], args[2], args[3]);
         break;
 
-    case INDEX_op_rotl_i64:
-        if (const_args[2]) {
-            tcg_out_sh64(s, RSY_RLLG, args[0], args[1],
-                         TCG_REG_NONE, args[2]);
-        } else {
-            tcg_out_sh64(s, RSY_RLLG, args[0], args[1], args[2], 0);
-        }
-        break;
-    case INDEX_op_rotr_i64:
-        if (const_args[2]) {
-            tcg_out_sh64(s, RSY_RLLG, args[0], args[1],
-                         TCG_REG_NONE, (64 - args[2]) & 63);
-        } else {
-            /* We can use the smaller 32-bit negate because only the
-               low 6 bits are examined for the rotate.  */
-            tcg_out_insn(s, RR, LCR, TCG_TMP0, args[2]);
-            tcg_out_sh64(s, RSY_RLLG, args[0], args[1], TCG_TMP0, 0);
-        }
-        break;
-
     case INDEX_op_add2_i64:
         if (const_args[4]) {
             if ((int64_t)args[4] >= 0) {
@@ -3390,11 +3381,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(r, r);
 
-    case INDEX_op_rotl_i32:
-    case INDEX_op_rotl_i64:
-    case INDEX_op_rotr_i32:
-    case INDEX_op_rotr_i64:
-        return C_O1_I2(r, r, ri);
     case INDEX_op_setcond_i32:
     case INDEX_op_negsetcond_i32:
     case INDEX_op_setcond_i64:
diff --git a/tcg/sparc64/tcg-target-has.h b/tcg/sparc64/tcg-target-has.h
index 42de99efbf..1dd86c363d 100644
--- a/tcg/sparc64/tcg-target-has.h
+++ b/tcg/sparc64/tcg-target-has.h
@@ -14,7 +14,6 @@ extern bool use_vis3_instructions;
 #endif
 
 /* optional instructions */
-#define TCG_TARGET_HAS_rot_i32          0
 #define TCG_TARGET_HAS_bswap16_i32      0
 #define TCG_TARGET_HAS_bswap32_i32      0
 #define TCG_TARGET_HAS_clz_i32          0
@@ -29,7 +28,6 @@ extern bool use_vis3_instructions;
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
 #define TCG_TARGET_HAS_extr_i64_i32     0
-#define TCG_TARGET_HAS_rot_i64          0
 #define TCG_TARGET_HAS_bswap16_i64      0
 #define TCG_TARGET_HAS_bswap32_i64      0
 #define TCG_TARGET_HAS_bswap64_i64      0
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index 42d81c1e6c..57b26ae33b 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -1484,6 +1484,14 @@ static const TCGOutOpBinary outop_remu = {
     .base.static_constraint = C_NotImplemented,
 };
 
+static const TCGOutOpBinary outop_rotl = {
+    .base.static_constraint = C_NotImplemented,
+};
+
+static const TCGOutOpBinary outop_rotr = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static void tgen_sar(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
diff --git a/tcg/tcg-has.h b/tcg/tcg-has.h
index 0bb829be36..7bfa55adb1 100644
--- a/tcg/tcg-has.h
+++ b/tcg/tcg-has.h
@@ -12,7 +12,6 @@
 #if TCG_TARGET_REG_BITS == 32
 /* Turn some undef macros into false macros.  */
 #define TCG_TARGET_HAS_extr_i64_i32     0
-#define TCG_TARGET_HAS_rot_i64          0
 #define TCG_TARGET_HAS_bswap16_i64      0
 #define TCG_TARGET_HAS_bswap32_i64      0
 #define TCG_TARGET_HAS_bswap64_i64      0
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 8f67107190..40a3e44b7c 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1042,6 +1042,10 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_orc, TCGOutOpBinary, outop_orc),
     OUTOP(INDEX_op_rems, TCGOutOpBinary, outop_rems),
     OUTOP(INDEX_op_remu, TCGOutOpBinary, outop_remu),
+    OUTOP(INDEX_op_rotl_i32, TCGOutOpBinary, outop_rotl),
+    OUTOP(INDEX_op_rotl_i64, TCGOutOpBinary, outop_rotl),
+    OUTOP(INDEX_op_rotr_i32, TCGOutOpBinary, outop_rotr),
+    OUTOP(INDEX_op_rotr_i64, TCGOutOpBinary, outop_rotr),
     OUTOP(INDEX_op_sar, TCGOutOpBinary, outop_sar),
     OUTOP(INDEX_op_shl, TCGOutOpBinary, outop_shl),
     OUTOP(INDEX_op_shr, TCGOutOpBinary, outop_shr),
@@ -2272,9 +2276,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
 
     case INDEX_op_negsetcond_i32:
         return TCG_TARGET_HAS_negsetcond_i32;
-    case INDEX_op_rotl_i32:
-    case INDEX_op_rotr_i32:
-        return TCG_TARGET_HAS_rot_i32;
     case INDEX_op_extract2_i32:
         return TCG_TARGET_HAS_extract2_i32;
     case INDEX_op_add2_i32:
@@ -2323,9 +2324,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
 
     case INDEX_op_negsetcond_i64:
         return TCG_TARGET_HAS_negsetcond_i64;
-    case INDEX_op_rotl_i64:
-    case INDEX_op_rotr_i64:
-        return TCG_TARGET_HAS_rot_i64;
     case INDEX_op_extract2_i64:
         return TCG_TARGET_HAS_extract2_i64;
     case INDEX_op_extrl_i64_i32:
@@ -5420,6 +5418,10 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
     case INDEX_op_orc:
     case INDEX_op_rems:
     case INDEX_op_remu:
+    case INDEX_op_rotl_i32:
+    case INDEX_op_rotl_i64:
+    case INDEX_op_rotr_i32:
+    case INDEX_op_rotr_i64:
     case INDEX_op_sar:
     case INDEX_op_shl:
     case INDEX_op_shr:
diff --git a/tcg/tci.c b/tcg/tci.c
index 2a2f216898..0fb13ff61d 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -630,16 +630,14 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             regs[r0] = ((tcg_target_long)regs[r1]
                         >> (regs[r2] % TCG_TARGET_REG_BITS));
             break;
-#if TCG_TARGET_HAS_rot_i32
-        case INDEX_op_rotl_i32:
+        case INDEX_op_tci_rotl32:
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = rol32(regs[r1], regs[r2] & 31);
             break;
-        case INDEX_op_rotr_i32:
+        case INDEX_op_tci_rotr32:
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = ror32(regs[r1], regs[r2] & 31);
             break;
-#endif
         case INDEX_op_deposit_i32:
             tci_args_rrrbb(insn, &r0, &r1, &r2, &pos, &len);
             regs[r0] = deposit32(regs[r1], pos, len, regs[r2]);
@@ -788,7 +786,6 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
 
             /* Shift/rotate operations (64 bit). */
 
-#if TCG_TARGET_HAS_rot_i64
         case INDEX_op_rotl_i64:
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = rol64(regs[r1], regs[r2] & 63);
@@ -797,7 +794,6 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = ror64(regs[r1], regs[r2] & 63);
             break;
-#endif
         case INDEX_op_deposit_i64:
             tci_args_rrrbb(insn, &r0, &r1, &r2, &pos, &len);
             regs[r0] = deposit64(regs[r1], pos, len, regs[r2]);
@@ -1075,9 +1071,7 @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
     case INDEX_op_shr:
     case INDEX_op_sub:
     case INDEX_op_xor:
-    case INDEX_op_rotl_i32:
     case INDEX_op_rotl_i64:
-    case INDEX_op_rotr_i32:
     case INDEX_op_rotr_i64:
     case INDEX_op_clz_i32:
     case INDEX_op_clz_i64:
@@ -1087,6 +1081,8 @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
     case INDEX_op_tci_divu32:
     case INDEX_op_tci_rems32:
     case INDEX_op_tci_remu32:
+    case INDEX_op_tci_rotl32:
+    case INDEX_op_tci_rotr32:
         tci_args_rrr(insn, &r0, &r1, &r2);
         info->fprintf_func(info->stream, "%-12s  %s, %s, %s",
                            op_name, str_r(r0), str_r(r1), str_r(r2));
diff --git a/tcg/tci/tcg-target-has.h b/tcg/tci/tcg-target-has.h
index bd51b9346d..04d341a8d2 100644
--- a/tcg/tci/tcg-target-has.h
+++ b/tcg/tci/tcg-target-has.h
@@ -13,7 +13,6 @@
 #define TCG_TARGET_HAS_clz_i32          1
 #define TCG_TARGET_HAS_ctz_i32          1
 #define TCG_TARGET_HAS_ctpop_i32        1
-#define TCG_TARGET_HAS_rot_i32          1
 #define TCG_TARGET_HAS_negsetcond_i32   0
 #define TCG_TARGET_HAS_muls2_i32        1
 #define TCG_TARGET_HAS_qemu_st8_i32     0
@@ -27,7 +26,6 @@
 #define TCG_TARGET_HAS_clz_i64          1
 #define TCG_TARGET_HAS_ctz_i64          1
 #define TCG_TARGET_HAS_ctpop_i64        1
-#define TCG_TARGET_HAS_rot_i64          1
 #define TCG_TARGET_HAS_negsetcond_i64   0
 #define TCG_TARGET_HAS_muls2_i64        1
 #define TCG_TARGET_HAS_add2_i32         1
diff --git a/tcg/tci/tcg-target-opc.h.inc b/tcg/tci/tcg-target-opc.h.inc
index 82d2a38cae..cff215490a 100644
--- a/tcg/tci/tcg-target-opc.h.inc
+++ b/tcg/tci/tcg-target-opc.h.inc
@@ -6,3 +6,5 @@ DEF(tci_divs32, 1, 2, 0, TCG_OPF_NOT_PRESENT)
 DEF(tci_divu32, 1, 2, 0, TCG_OPF_NOT_PRESENT)
 DEF(tci_rems32, 1, 2, 0, TCG_OPF_NOT_PRESENT)
 DEF(tci_remu32, 1, 2, 0, TCG_OPF_NOT_PRESENT)
+DEF(tci_rotl32, 1, 2, 0, TCG_OPF_NOT_PRESENT)
+DEF(tci_rotr32, 1, 2, 0, TCG_OPF_NOT_PRESENT)
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index feaa13dff0..0a2da3ba47 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -79,10 +79,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(r, r);
 
-    case INDEX_op_rotl_i32:
-    case INDEX_op_rotl_i64:
-    case INDEX_op_rotr_i32:
-    case INDEX_op_rotr_i64:
     case INDEX_op_setcond_i32:
     case INDEX_op_setcond_i64:
     case INDEX_op_deposit_i32:
@@ -772,6 +768,34 @@ static const TCGOutOpBinary outop_remu = {
     .out_rrr = tgen_remu,
 };
 
+static void tgen_rotl(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    TCGOpcode opc = (type == TCG_TYPE_I32
+                     ? INDEX_op_tci_rotl32
+                     : INDEX_op_rotl_i64);
+    tcg_out_op_rrr(s, opc, a0, a1, a2);
+}
+
+static const TCGOutOpBinary outop_rotl = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_rotl,
+};
+
+static void tgen_rotr(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    TCGOpcode opc = (type == TCG_TYPE_I32
+                     ? INDEX_op_tci_rotr32
+                     : INDEX_op_rotr_i64);
+    tcg_out_op_rrr(s, opc, a0, a1, a2);
+}
+
+static const TCGOutOpBinary outop_rotr = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_rotr,
+};
+
 static void tgen_sar(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -897,8 +921,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_ldst(s, opc, args[0], args[1], args[2]);
         break;
 
-    CASE_32_64(rotl)     /* Optional (TCG_TARGET_HAS_rot_*). */
-    CASE_32_64(rotr)     /* Optional (TCG_TARGET_HAS_rot_*). */
     CASE_32_64(clz)      /* Optional (TCG_TARGET_HAS_clz_*). */
     CASE_32_64(ctz)      /* Optional (TCG_TARGET_HAS_ctz_*). */
         tcg_out_op_rrr(s, opc, args[0], args[1], args[2]);

From 005a87e148dc20f59835b328336240759703d63d Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Jan 2025 10:42:16 -0800
Subject: [PATCH 0420/2760] tcg: Merge INDEX_op_rot{l,r}_{i32,i64}

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 docs/devel/tcg-ops.rst   |  8 +++----
 include/tcg/tcg-opc.h    |  6 ++---
 tcg/optimize.c           | 20 ++++++++---------
 tcg/tcg-op.c             | 48 ++++++++++++++++++++--------------------
 tcg/tcg.c                | 12 ++++------
 tcg/tci.c                |  8 +++----
 tcg/tci/tcg-target.c.inc |  4 ++--
 7 files changed, 50 insertions(+), 56 deletions(-)

diff --git a/docs/devel/tcg-ops.rst b/docs/devel/tcg-ops.rst
index be82fed41a..c3a6499d01 100644
--- a/docs/devel/tcg-ops.rst
+++ b/docs/devel/tcg-ops.rst
@@ -394,15 +394,15 @@ Shifts/Rotates
      - | *t0* = *t1* >> *t2* (signed)
        | Unspecified behavior for negative or out-of-range shifts.
 
-   * - rotl_i32/i64 *t0*, *t1*, *t2*
+   * - rotl *t0*, *t1*, *t2*
 
      - | Rotation of *t2* bits to the left
-       | Unspecified behavior if *t2* < 0 or *t2* >= 32 (resp 64)
+       | Unspecified behavior for negative or out-of-range shifts.
 
-   * - rotr_i32/i64 *t0*, *t1*, *t2*
+   * - rotr *t0*, *t1*, *t2*
 
      - | Rotation of *t2* bits to the right.
-       | Unspecified behavior if *t2* < 0 or *t2* >= 32 (resp 64)
+       | Unspecified behavior for negative or out-of-range shifts.
 
 
 Misc
diff --git a/include/tcg/tcg-opc.h b/include/tcg/tcg-opc.h
index cb8c134e94..25fd93eb28 100644
--- a/include/tcg/tcg-opc.h
+++ b/include/tcg/tcg-opc.h
@@ -58,6 +58,8 @@ DEF(or, 1, 2, 0, TCG_OPF_INT)
 DEF(orc, 1, 2, 0, TCG_OPF_INT)
 DEF(rems, 1, 2, 0, TCG_OPF_INT)
 DEF(remu, 1, 2, 0, TCG_OPF_INT)
+DEF(rotl, 1, 2, 0, TCG_OPF_INT)
+DEF(rotr, 1, 2, 0, TCG_OPF_INT)
 DEF(sar, 1, 2, 0, TCG_OPF_INT)
 DEF(shl, 1, 2, 0, TCG_OPF_INT)
 DEF(shr, 1, 2, 0, TCG_OPF_INT)
@@ -77,8 +79,6 @@ DEF(st8_i32, 0, 2, 1, 0)
 DEF(st16_i32, 0, 2, 1, 0)
 DEF(st_i32, 0, 2, 1, 0)
 /* shifts/rotates */
-DEF(rotl_i32, 1, 2, 0, 0)
-DEF(rotr_i32, 1, 2, 0, 0)
 DEF(deposit_i32, 1, 2, 2, 0)
 DEF(extract_i32, 1, 1, 2, 0)
 DEF(sextract_i32, 1, 1, 2, 0)
@@ -115,8 +115,6 @@ DEF(st16_i64, 0, 2, 1, 0)
 DEF(st32_i64, 0, 2, 1, 0)
 DEF(st_i64, 0, 2, 1, 0)
 /* shifts/rotates */
-DEF(rotl_i64, 1, 2, 0, 0)
-DEF(rotr_i64, 1, 2, 0, 0)
 DEF(deposit_i64, 1, 2, 2, 0)
 DEF(extract_i64, 1, 1, 2, 0)
 DEF(sextract_i64, 1, 1, 2, 0)
diff --git a/tcg/optimize.c b/tcg/optimize.c
index f94be19b72..97a566a617 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -464,16 +464,16 @@ static uint64_t do_constant_folding_2(TCGOpcode op, TCGType type,
         }
         return (int64_t)x >> (y & 63);
 
-    case INDEX_op_rotr_i32:
-        return ror32(x, y & 31);
-
-    case INDEX_op_rotr_i64:
+    case INDEX_op_rotr:
+        if (type == TCG_TYPE_I32) {
+            return ror32(x, y & 31);
+        }
         return ror64(x, y & 63);
 
-    case INDEX_op_rotl_i32:
-        return rol32(x, y & 31);
-
-    case INDEX_op_rotl_i64:
+    case INDEX_op_rotl:
+        if (type == TCG_TYPE_I32) {
+            return rol32(x, y & 31);
+        }
         return rol64(x, y & 63);
 
     case INDEX_op_not:
@@ -3025,8 +3025,8 @@ void tcg_optimize(TCGContext *s)
         case INDEX_op_remu:
             done = fold_remainder(&ctx, op);
             break;
-        CASE_OP_32_64(rotl):
-        CASE_OP_32_64(rotr):
+        case INDEX_op_rotl:
+        case INDEX_op_rotr:
         case INDEX_op_sar:
         case INDEX_op_shl:
         case INDEX_op_shr:
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index 8c8b9d179b..1989d8d12c 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -829,12 +829,12 @@ void tcg_gen_ctpop_i32(TCGv_i32 ret, TCGv_i32 arg1)
 
 void tcg_gen_rotl_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 {
-    if (tcg_op_supported(INDEX_op_rotl_i32, TCG_TYPE_I32, 0)) {
-        tcg_gen_op3_i32(INDEX_op_rotl_i32, ret, arg1, arg2);
-    } else if (tcg_op_supported(INDEX_op_rotr_i32, TCG_TYPE_I32, 0)) {
+    if (tcg_op_supported(INDEX_op_rotl, TCG_TYPE_I32, 0)) {
+        tcg_gen_op3_i32(INDEX_op_rotl, ret, arg1, arg2);
+    } else if (tcg_op_supported(INDEX_op_rotr, TCG_TYPE_I32, 0)) {
         TCGv_i32 t0 = tcg_temp_ebb_new_i32();
         tcg_gen_neg_i32(t0, arg2);
-        tcg_gen_op3_i32(INDEX_op_rotr_i32, ret, arg1, t0);
+        tcg_gen_op3_i32(INDEX_op_rotr, ret, arg1, t0);
         tcg_temp_free_i32(t0);
     } else {
         TCGv_i32 t0 = tcg_temp_ebb_new_i32();
@@ -854,12 +854,12 @@ void tcg_gen_rotli_i32(TCGv_i32 ret, TCGv_i32 arg1, int32_t arg2)
     /* some cases can be optimized here */
     if (arg2 == 0) {
         tcg_gen_mov_i32(ret, arg1);
-    } else if (tcg_op_supported(INDEX_op_rotl_i32, TCG_TYPE_I32, 0)) {
+    } else if (tcg_op_supported(INDEX_op_rotl, TCG_TYPE_I32, 0)) {
         TCGv_i32 t0 = tcg_constant_i32(arg2);
-        tcg_gen_op3_i32(INDEX_op_rotl_i32, ret, arg1, t0);
-    } else if (tcg_op_supported(INDEX_op_rotr_i32, TCG_TYPE_I32, 0)) {
+        tcg_gen_op3_i32(INDEX_op_rotl, ret, arg1, t0);
+    } else if (tcg_op_supported(INDEX_op_rotr, TCG_TYPE_I32, 0)) {
         TCGv_i32 t0 = tcg_constant_i32(32 - arg2);
-        tcg_gen_op3_i32(INDEX_op_rotr_i32, ret, arg1, t0);
+        tcg_gen_op3_i32(INDEX_op_rotr, ret, arg1, t0);
     } else {
         TCGv_i32 t0 = tcg_temp_ebb_new_i32();
         TCGv_i32 t1 = tcg_temp_ebb_new_i32();
@@ -873,12 +873,12 @@ void tcg_gen_rotli_i32(TCGv_i32 ret, TCGv_i32 arg1, int32_t arg2)
 
 void tcg_gen_rotr_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 {
-    if (tcg_op_supported(INDEX_op_rotr_i32, TCG_TYPE_I32, 0)) {
-        tcg_gen_op3_i32(INDEX_op_rotr_i32, ret, arg1, arg2);
-    } else if (tcg_op_supported(INDEX_op_rotl_i32, TCG_TYPE_I32, 0)) {
+    if (tcg_op_supported(INDEX_op_rotr, TCG_TYPE_I32, 0)) {
+        tcg_gen_op3_i32(INDEX_op_rotr, ret, arg1, arg2);
+    } else if (tcg_op_supported(INDEX_op_rotl, TCG_TYPE_I32, 0)) {
         TCGv_i32 t0 = tcg_temp_ebb_new_i32();
         tcg_gen_neg_i32(t0, arg2);
-        tcg_gen_op3_i32(INDEX_op_rotl_i32, ret, arg1, t0);
+        tcg_gen_op3_i32(INDEX_op_rotl, ret, arg1, t0);
         tcg_temp_free_i32(t0);
     } else {
         TCGv_i32 t0 = tcg_temp_ebb_new_i32();
@@ -2441,12 +2441,12 @@ void tcg_gen_ctpop_i64(TCGv_i64 ret, TCGv_i64 arg1)
 
 void tcg_gen_rotl_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
 {
-    if (tcg_op_supported(INDEX_op_rotl_i64, TCG_TYPE_I64, 0)) {
-        tcg_gen_op3_i64(INDEX_op_rotl_i64, ret, arg1, arg2);
-    } else if (tcg_op_supported(INDEX_op_rotl_i64, TCG_TYPE_I64, 0)) {
+    if (tcg_op_supported(INDEX_op_rotl, TCG_TYPE_I64, 0)) {
+        tcg_gen_op3_i64(INDEX_op_rotl, ret, arg1, arg2);
+    } else if (tcg_op_supported(INDEX_op_rotl, TCG_TYPE_I64, 0)) {
         TCGv_i64 t0 = tcg_temp_ebb_new_i64();
         tcg_gen_neg_i64(t0, arg2);
-        tcg_gen_op3_i64(INDEX_op_rotr_i64, ret, arg1, t0);
+        tcg_gen_op3_i64(INDEX_op_rotr, ret, arg1, t0);
         tcg_temp_free_i64(t0);
     } else {
         TCGv_i64 t0 = tcg_temp_ebb_new_i64();
@@ -2466,12 +2466,12 @@ void tcg_gen_rotli_i64(TCGv_i64 ret, TCGv_i64 arg1, int64_t arg2)
     /* some cases can be optimized here */
     if (arg2 == 0) {
         tcg_gen_mov_i64(ret, arg1);
-    } else if (tcg_op_supported(INDEX_op_rotl_i64, TCG_TYPE_I64, 0)) {
+    } else if (tcg_op_supported(INDEX_op_rotl, TCG_TYPE_I64, 0)) {
         TCGv_i64 t0 = tcg_constant_i64(arg2);
-        tcg_gen_op3_i64(INDEX_op_rotl_i64, ret, arg1, t0);
-    } else if (tcg_op_supported(INDEX_op_rotr_i64, TCG_TYPE_I64, 0)) {
+        tcg_gen_op3_i64(INDEX_op_rotl, ret, arg1, t0);
+    } else if (tcg_op_supported(INDEX_op_rotr, TCG_TYPE_I64, 0)) {
         TCGv_i64 t0 = tcg_constant_i64(64 - arg2);
-        tcg_gen_op3_i64(INDEX_op_rotr_i64, ret, arg1, t0);
+        tcg_gen_op3_i64(INDEX_op_rotr, ret, arg1, t0);
     } else {
         TCGv_i64 t0 = tcg_temp_ebb_new_i64();
         TCGv_i64 t1 = tcg_temp_ebb_new_i64();
@@ -2485,12 +2485,12 @@ void tcg_gen_rotli_i64(TCGv_i64 ret, TCGv_i64 arg1, int64_t arg2)
 
 void tcg_gen_rotr_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
 {
-    if (tcg_op_supported(INDEX_op_rotr_i64, TCG_TYPE_I64, 0)) {
-        tcg_gen_op3_i64(INDEX_op_rotr_i64, ret, arg1, arg2);
-    } else if (tcg_op_supported(INDEX_op_rotl_i64, TCG_TYPE_I64, 0)) {
+    if (tcg_op_supported(INDEX_op_rotr, TCG_TYPE_I64, 0)) {
+        tcg_gen_op3_i64(INDEX_op_rotr, ret, arg1, arg2);
+    } else if (tcg_op_supported(INDEX_op_rotl, TCG_TYPE_I64, 0)) {
         TCGv_i64 t0 = tcg_temp_ebb_new_i64();
         tcg_gen_neg_i64(t0, arg2);
-        tcg_gen_op3_i64(INDEX_op_rotl_i64, ret, arg1, t0);
+        tcg_gen_op3_i64(INDEX_op_rotl, ret, arg1, t0);
         tcg_temp_free_i64(t0);
     } else {
         TCGv_i64 t0 = tcg_temp_ebb_new_i64();
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 40a3e44b7c..182f19e5f0 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1042,10 +1042,8 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_orc, TCGOutOpBinary, outop_orc),
     OUTOP(INDEX_op_rems, TCGOutOpBinary, outop_rems),
     OUTOP(INDEX_op_remu, TCGOutOpBinary, outop_remu),
-    OUTOP(INDEX_op_rotl_i32, TCGOutOpBinary, outop_rotl),
-    OUTOP(INDEX_op_rotl_i64, TCGOutOpBinary, outop_rotl),
-    OUTOP(INDEX_op_rotr_i32, TCGOutOpBinary, outop_rotr),
-    OUTOP(INDEX_op_rotr_i64, TCGOutOpBinary, outop_rotr),
+    OUTOP(INDEX_op_rotl, TCGOutOpBinary, outop_rotl),
+    OUTOP(INDEX_op_rotr, TCGOutOpBinary, outop_rotr),
     OUTOP(INDEX_op_sar, TCGOutOpBinary, outop_sar),
     OUTOP(INDEX_op_shl, TCGOutOpBinary, outop_shl),
     OUTOP(INDEX_op_shr, TCGOutOpBinary, outop_shr),
@@ -5418,10 +5416,8 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
     case INDEX_op_orc:
     case INDEX_op_rems:
     case INDEX_op_remu:
-    case INDEX_op_rotl_i32:
-    case INDEX_op_rotl_i64:
-    case INDEX_op_rotr_i32:
-    case INDEX_op_rotr_i64:
+    case INDEX_op_rotl:
+    case INDEX_op_rotr:
     case INDEX_op_sar:
     case INDEX_op_shl:
     case INDEX_op_shr:
diff --git a/tcg/tci.c b/tcg/tci.c
index 0fb13ff61d..b1ee14e65f 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -786,11 +786,11 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
 
             /* Shift/rotate operations (64 bit). */
 
-        case INDEX_op_rotl_i64:
+        case INDEX_op_rotl:
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = rol64(regs[r1], regs[r2] & 63);
             break;
-        case INDEX_op_rotr_i64:
+        case INDEX_op_rotr:
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = ror64(regs[r1], regs[r2] & 63);
             break;
@@ -1066,13 +1066,13 @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
     case INDEX_op_orc:
     case INDEX_op_rems:
     case INDEX_op_remu:
+    case INDEX_op_rotl:
+    case INDEX_op_rotr:
     case INDEX_op_sar:
     case INDEX_op_shl:
     case INDEX_op_shr:
     case INDEX_op_sub:
     case INDEX_op_xor:
-    case INDEX_op_rotl_i64:
-    case INDEX_op_rotr_i64:
     case INDEX_op_clz_i32:
     case INDEX_op_clz_i64:
     case INDEX_op_ctz_i32:
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index 0a2da3ba47..0d15547c9f 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -773,7 +773,7 @@ static void tgen_rotl(TCGContext *s, TCGType type,
 {
     TCGOpcode opc = (type == TCG_TYPE_I32
                      ? INDEX_op_tci_rotl32
-                     : INDEX_op_rotl_i64);
+                     : INDEX_op_rotl);
     tcg_out_op_rrr(s, opc, a0, a1, a2);
 }
 
@@ -787,7 +787,7 @@ static void tgen_rotr(TCGContext *s, TCGType type,
 {
     TCGOpcode opc = (type == TCG_TYPE_I32
                      ? INDEX_op_tci_rotr32
-                     : INDEX_op_rotr_i64);
+                     : INDEX_op_rotr);
     tcg_out_op_rrr(s, opc, a0, a1, a2);
 }
 

From 8b915879b0fdd05afab41f0ca156113811ebac38 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Jan 2025 14:16:04 -0800
Subject: [PATCH 0421/2760] tcg: Convert clz to TCGOutOpBinary

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target-has.h     |   2 -
 tcg/aarch64/tcg-target.c.inc     |  83 +++++++++++++-----------
 tcg/arm/tcg-target-has.h         |   1 -
 tcg/arm/tcg-target.c.inc         |  47 +++++++++-----
 tcg/i386/tcg-target-has.h        |   2 -
 tcg/i386/tcg-target.c.inc        |  72 +++++++++++----------
 tcg/loongarch64/tcg-target-has.h |   2 -
 tcg/loongarch64/tcg-target.c.inc |  36 ++++++++---
 tcg/mips/tcg-target-has.h        |   2 -
 tcg/mips/tcg-target.c.inc        |  86 +++++++++++++-----------
 tcg/ppc/tcg-target-has.h         |   2 -
 tcg/ppc/tcg-target.c.inc         |  30 ++++++---
 tcg/riscv/tcg-target-has.h       |   2 -
 tcg/riscv/tcg-target.c.inc       |  34 +++++++---
 tcg/s390x/tcg-target-has.h       |   2 -
 tcg/s390x/tcg-target.c.inc       |  75 +++++++++++++--------
 tcg/sparc64/tcg-target-has.h     |   2 -
 tcg/sparc64/tcg-target.c.inc     |   4 ++
 tcg/tcg-has.h                    |   1 -
 tcg/tcg-op.c                     | 108 ++++++++++++++++---------------
 tcg/tcg.c                        |   8 +--
 tcg/tci.c                        |   8 +--
 tcg/tci/tcg-target-has.h         |   2 -
 tcg/tci/tcg-target-opc.h.inc     |   1 +
 tcg/tci/tcg-target.c.inc         |  17 ++++-
 25 files changed, 365 insertions(+), 264 deletions(-)

diff --git a/tcg/aarch64/tcg-target-has.h b/tcg/aarch64/tcg-target-has.h
index fa79cbc1f0..8c839d8949 100644
--- a/tcg/aarch64/tcg-target-has.h
+++ b/tcg/aarch64/tcg-target-has.h
@@ -15,7 +15,6 @@
 /* optional instructions */
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
-#define TCG_TARGET_HAS_clz_i32          1
 #define TCG_TARGET_HAS_ctz_i32          1
 #define TCG_TARGET_HAS_ctpop_i32        0
 #define TCG_TARGET_HAS_extract2_i32     1
@@ -30,7 +29,6 @@
 #define TCG_TARGET_HAS_bswap16_i64      1
 #define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1
-#define TCG_TARGET_HAS_clz_i64          1
 #define TCG_TARGET_HAS_ctz_i64          1
 #define TCG_TARGET_HAS_ctpop_i64        0
 #define TCG_TARGET_HAS_extract2_i64     1
diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index 00fca43840..3bd8231117 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -1618,37 +1618,6 @@ static inline void tcg_out_mb(TCGContext *s, TCGArg a0)
     tcg_out32(s, sync[a0 & TCG_MO_ALL]);
 }
 
-static void tcg_out_cltz(TCGContext *s, TCGType ext, TCGReg d,
-                         TCGReg a0, TCGArg b, bool const_b, bool is_ctz)
-{
-    TCGReg a1 = a0;
-    if (is_ctz) {
-        a1 = TCG_REG_TMP0;
-        tcg_out_insn(s, 3507, RBIT, ext, a1, a0);
-    }
-    if (const_b && b == (ext ? 64 : 32)) {
-        tcg_out_insn(s, 3507, CLZ, ext, d, a1);
-    } else {
-        AArch64Insn sel = I3506_CSEL;
-
-        tcg_out_cmp(s, ext, TCG_COND_NE, a0, 0, 1);
-        tcg_out_insn(s, 3507, CLZ, ext, TCG_REG_TMP0, a1);
-
-        if (const_b) {
-            if (b == -1) {
-                b = TCG_REG_XZR;
-                sel = I3506_CSINV;
-            } else if (b == 0) {
-                b = TCG_REG_XZR;
-            } else {
-                tcg_out_movi(s, ext, d, b);
-                b = d;
-            }
-        }
-        tcg_out_insn_3506(s, sel, ext, d, TCG_REG_TMP0, b, TCG_COND_NE);
-    }
-}
-
 typedef struct {
     TCGReg base;
     TCGReg index;
@@ -2121,6 +2090,45 @@ static const TCGOutOpBinary outop_andc = {
     .out_rrr = tgen_andc,
 };
 
+static void tgen_clz(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_cmp(s, type, TCG_COND_NE, a1, 0, true);
+    tcg_out_insn(s, 3507, CLZ, type, TCG_REG_TMP0, a1);
+    tcg_out_insn(s, 3506, CSEL, type, a0, TCG_REG_TMP0, a2, TCG_COND_NE);
+}
+
+static void tgen_clzi(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    if (a2 == (type == TCG_TYPE_I32 ? 32 : 64)) {
+        tcg_out_insn(s, 3507, CLZ, type, a0, a1);
+        return;
+    }
+
+    tcg_out_cmp(s, type, TCG_COND_NE, a1, 0, true);
+    tcg_out_insn(s, 3507, CLZ, type, a0, a1);
+
+    switch (a2) {
+    case -1:
+        tcg_out_insn(s, 3506, CSINV, type, a0, a0, TCG_REG_XZR, TCG_COND_NE);
+        break;
+    case 0:
+        tcg_out_insn(s, 3506, CSEL, type, a0, a0, TCG_REG_XZR, TCG_COND_NE);
+        break;
+    default:
+        tcg_out_movi(s, type, TCG_REG_TMP0, a2);
+        tcg_out_insn(s, 3506, CSEL, type, a0, a0, TCG_REG_TMP0, TCG_COND_NE);
+        break;
+    }
+}
+
+static const TCGOutOpBinary outop_clz = {
+    .base.static_constraint = C_O1_I2(r, r, rAL),
+    .out_rrr = tgen_clz,
+    .out_rri = tgen_clzi,
+};
+
 static void tgen_divs(TCGContext *s, TCGType type,
                       TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -2460,13 +2468,14 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType ext,
         tcg_out_ldst(s, I3312_STRX, a0, a1, a2, 3);
         break;
 
-    case INDEX_op_clz_i64:
-    case INDEX_op_clz_i32:
-        tcg_out_cltz(s, ext, a0, a1, a2, c2, false);
-        break;
     case INDEX_op_ctz_i64:
     case INDEX_op_ctz_i32:
-        tcg_out_cltz(s, ext, a0, a1, a2, c2, true);
+        tcg_out_insn(s, 3507, RBIT, ext, TCG_REG_TMP0, a1);
+        if (c2) {
+            tgen_clzi(s, ext, a0, TCG_REG_TMP0, a2);
+        } else {
+            tgen_clz(s, ext, a0, TCG_REG_TMP0, a2);
+        }
         break;
 
     case INDEX_op_brcond_i32:
@@ -3089,9 +3098,7 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_negsetcond_i64:
         return C_O1_I2(r, r, rC);
 
-    case INDEX_op_clz_i32:
     case INDEX_op_ctz_i32:
-    case INDEX_op_clz_i64:
     case INDEX_op_ctz_i64:
         return C_O1_I2(r, r, rAL);
 
diff --git a/tcg/arm/tcg-target-has.h b/tcg/arm/tcg-target-has.h
index 12ffbcda2b..fceec2f0ca 100644
--- a/tcg/arm/tcg-target-has.h
+++ b/tcg/arm/tcg-target-has.h
@@ -26,7 +26,6 @@ extern bool use_neon_instructions;
 /* optional instructions */
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
-#define TCG_TARGET_HAS_clz_i32          1
 #define TCG_TARGET_HAS_ctz_i32          use_armv7_instructions
 #define TCG_TARGET_HAS_ctpop_i32        0
 #define TCG_TARGET_HAS_extract2_i32     1
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index 462f0ec08d..681eb5aba1 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -1862,6 +1862,32 @@ static const TCGOutOpBinary outop_andc = {
     .out_rrr = tgen_andc,
 };
 
+static void tgen_clz(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_dat_imm(s, COND_AL, ARITH_CMP, 0, a1, 0);
+    tcg_out_dat_reg(s, COND_NE, INSN_CLZ, a0, 0, a1, 0);
+    tcg_out_mov_reg(s, COND_EQ, a0, a2);
+}
+
+static void tgen_clzi(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    if (a2 == 32) {
+        tcg_out_dat_reg(s, COND_AL, INSN_CLZ, a0, 0, a1, 0);
+    } else {
+        tcg_out_dat_imm(s, COND_AL, ARITH_CMP, 0, a1, 0);
+        tcg_out_dat_reg(s, COND_NE, INSN_CLZ, a0, 0, a1, 0);
+        tcg_out_movi32(s, COND_EQ, a0, a2);
+    }
+}
+
+static const TCGOutOpBinary outop_clz = {
+    .base.static_constraint = C_O1_I2(r, r, rIK),
+    .out_rrr = tgen_clz,
+    .out_rri = tgen_clzi,
+};
+
 static TCGConstraintSetIndex cset_idiv(TCGType type, unsigned flags)
 {
     return use_idiv_instructions ? C_O1_I2(r, r, r) : C_NotImplemented;
@@ -2196,23 +2222,10 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
 
     case INDEX_op_ctz_i32:
         tcg_out_dat_reg(s, COND_AL, INSN_RBIT, TCG_REG_TMP, 0, args[1], 0);
-        a1 = TCG_REG_TMP;
-        goto do_clz;
-
-    case INDEX_op_clz_i32:
-        a1 = args[1];
-    do_clz:
-        a0 = args[0];
-        a2 = args[2];
-        c = const_args[2];
-        if (c && a2 == 32) {
-            tcg_out_dat_reg(s, COND_AL, INSN_CLZ, a0, 0, a1, 0);
-            break;
-        }
-        tcg_out_dat_imm(s, COND_AL, ARITH_CMP, 0, a1, 0);
-        tcg_out_dat_reg(s, COND_NE, INSN_CLZ, a0, 0, a1, 0);
-        if (c || a0 != a2) {
-            tcg_out_dat_rIK(s, COND_EQ, ARITH_MOV, ARITH_MVN, a0, 0, a2, c);
+        if (const_args[2]) {
+            tgen_clzi(s, TCG_TYPE_I32, args[0], TCG_REG_TMP, args[2]);
+        } else {
+            tgen_clz(s, TCG_TYPE_I32, args[0], TCG_REG_TMP, args[2]);
         }
         break;
 
diff --git a/tcg/i386/tcg-target-has.h b/tcg/i386/tcg-target-has.h
index a7199463df..2277872ff3 100644
--- a/tcg/i386/tcg-target-has.h
+++ b/tcg/i386/tcg-target-has.h
@@ -28,7 +28,6 @@
 /* optional instructions */
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
-#define TCG_TARGET_HAS_clz_i32          1
 #define TCG_TARGET_HAS_ctz_i32          1
 #define TCG_TARGET_HAS_ctpop_i32        have_popcnt
 #define TCG_TARGET_HAS_extract2_i32     1
@@ -44,7 +43,6 @@
 #define TCG_TARGET_HAS_bswap16_i64      1
 #define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1
-#define TCG_TARGET_HAS_clz_i64          1
 #define TCG_TARGET_HAS_ctz_i64          1
 #define TCG_TARGET_HAS_ctpop_i64        have_popcnt
 #define TCG_TARGET_HAS_extract2_i64     1
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index dd35bba57f..0edd4cbc07 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -1869,32 +1869,6 @@ static void tcg_out_ctz(TCGContext *s, int rexw, TCGReg dest, TCGReg arg1,
     }
 }
 
-static void tcg_out_clz(TCGContext *s, int rexw, TCGReg dest, TCGReg arg1,
-                        TCGArg arg2, bool const_a2)
-{
-    if (have_lzcnt) {
-        tcg_out_modrm(s, OPC_LZCNT + rexw, dest, arg1);
-        if (const_a2) {
-            tcg_debug_assert(arg2 == (rexw ? 64 : 32));
-        } else {
-            tcg_debug_assert(dest != arg2);
-            tcg_out_cmov(s, JCC_JB, rexw, dest, arg2);
-        }
-    } else {
-        tcg_debug_assert(!const_a2);
-        tcg_debug_assert(dest != arg1);
-        tcg_debug_assert(dest != arg2);
-
-        /* Recall that the output of BSR is the index not the count.  */
-        tcg_out_modrm(s, OPC_BSR + rexw, dest, arg1);
-        tgen_arithi(s, ARITH_XOR + rexw, dest, rexw ? 63 : 31, 0);
-
-        /* Since we have destroyed the flags from BSR, we have to re-test.  */
-        int jcc = tcg_out_cmp(s, TCG_COND_EQ, arg1, 0, 1, rexw);
-        tcg_out_cmov(s, jcc, rexw, dest, arg2);
-    }
-}
-
 static void tcg_out_branch(TCGContext *s, int call, const tcg_insn_unit *dest)
 {
     intptr_t disp = tcg_pcrel_diff(s, dest) - 5;
@@ -2633,6 +2607,45 @@ static const TCGOutOpBinary outop_andc = {
     .out_rrr = tgen_andc,
 };
 
+static void tgen_clz(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    int rexw = type == TCG_TYPE_I32 ? 0 : P_REXW;
+    int jcc;
+
+    if (have_lzcnt) {
+        tcg_out_modrm(s, OPC_LZCNT + rexw, a0, a1);
+        jcc = JCC_JB;
+    } else {
+        /* Recall that the output of BSR is the index not the count.  */
+        tcg_out_modrm(s, OPC_BSR + rexw, a0, a1);
+        tgen_arithi(s, ARITH_XOR + rexw, a0, rexw ? 63 : 31, 0);
+
+        /* Since we have destroyed the flags from BSR, we have to re-test.  */
+        jcc = tcg_out_cmp(s, TCG_COND_EQ, a1, 0, 1, rexw);
+    }
+    tcg_out_cmov(s, jcc, rexw, a0, a2);
+}
+
+static void tgen_clzi(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    int rexw = type == TCG_TYPE_I32 ? 0 : P_REXW;
+    tcg_out_modrm(s, OPC_LZCNT + rexw, a0, a1);
+}
+
+static TCGConstraintSetIndex cset_clz(TCGType type, unsigned flags)
+{
+    return have_lzcnt ? C_N1_I2(r, r, rW) : C_N1_I2(r, r, r);
+}
+
+static const TCGOutOpBinary outop_clz = {
+    .base.static_constraint = C_Dynamic,
+    .base.dynamic_constraint = cset_clz,
+    .out_rrr = tgen_clz,
+    .out_rri = tgen_clzi,
+};
+
 static const TCGOutOpBinary outop_divs = {
     .base.static_constraint = C_NotImplemented,
 };
@@ -3019,9 +3032,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     OP_32_64(ctz):
         tcg_out_ctz(s, rexw, args[0], args[1], args[2], const_args[2]);
         break;
-    OP_32_64(clz):
-        tcg_out_clz(s, rexw, args[0], args[1], args[2], const_args[2]);
-        break;
     OP_32_64(ctpop):
         tcg_out_modrm(s, OPC_POPCNT + rexw, a0, a1);
         break;
@@ -3907,10 +3917,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ctz_i64:
         return have_bmi1 ? C_N1_I2(r, r, rW) : C_N1_I2(r, r, r);
 
-    case INDEX_op_clz_i32:
-    case INDEX_op_clz_i64:
-        return have_lzcnt ? C_N1_I2(r, r, rW) : C_N1_I2(r, r, r);
-
     case INDEX_op_qemu_ld_i32:
         return C_O1_I1(r, L);
 
diff --git a/tcg/loongarch64/tcg-target-has.h b/tcg/loongarch64/tcg-target-has.h
index 303134390a..2eba2132b8 100644
--- a/tcg/loongarch64/tcg-target-has.h
+++ b/tcg/loongarch64/tcg-target-has.h
@@ -18,7 +18,6 @@
 #define TCG_TARGET_HAS_muls2_i32        0
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
-#define TCG_TARGET_HAS_clz_i32          1
 #define TCG_TARGET_HAS_ctz_i32          1
 #define TCG_TARGET_HAS_ctpop_i32        0
 #define TCG_TARGET_HAS_qemu_st8_i32     0
@@ -30,7 +29,6 @@
 #define TCG_TARGET_HAS_bswap16_i64      1
 #define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1
-#define TCG_TARGET_HAS_clz_i64          1
 #define TCG_TARGET_HAS_ctz_i64          1
 #define TCG_TARGET_HAS_ctpop_i64        0
 #define TCG_TARGET_HAS_add2_i64         0
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index 26cf982780..332ce6c86b 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -1328,6 +1328,33 @@ static const TCGOutOpBinary outop_andc = {
     .out_rrr = tgen_andc,
 };
 
+static void tgen_clzi(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    /* a2 is constrained to exactly the type width. */
+    if (type == TCG_TYPE_I32) {
+        tcg_out_opc_clz_w(s, a0, a1);
+    } else {
+        tcg_out_opc_clz_d(s, a0, a1);
+    }
+}
+
+static void tgen_clz(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tgen_clzi(s, type, TCG_REG_TMP0, a1, /* ignored */ 0);
+    /* a0 = a1 ? REG_TMP0 : a2 */
+    tcg_out_opc_maskeqz(s, TCG_REG_TMP0, TCG_REG_TMP0, a1);
+    tcg_out_opc_masknez(s, a0, a2, a1);
+    tcg_out_opc_or(s, a0, a0, TCG_REG_TMP0);
+}
+
+static const TCGOutOpBinary outop_clz = {
+    .base.static_constraint = C_O1_I2(r, r, rW),
+    .out_rrr = tgen_clz,
+    .out_rri = tgen_clzi,
+};
+
 static void tgen_divs(TCGContext *s, TCGType type,
                       TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -1754,13 +1781,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_opc_revb_d(s, a0, a1);
         break;
 
-    case INDEX_op_clz_i32:
-        tcg_out_clzctz(s, OPC_CLZ_W, a0, a1, a2, c2, true);
-        break;
-    case INDEX_op_clz_i64:
-        tcg_out_clzctz(s, OPC_CLZ_D, a0, a1, a2, c2, false);
-        break;
-
     case INDEX_op_ctz_i32:
         tcg_out_clzctz(s, OPC_CTZ_W, a0, a1, a2, c2, true);
         break;
@@ -2398,8 +2418,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_qemu_ld_i64:
         return C_O1_I1(r, r);
 
-    case INDEX_op_clz_i32:
-    case INDEX_op_clz_i64:
     case INDEX_op_ctz_i32:
     case INDEX_op_ctz_i64:
         return C_O1_I2(r, r, rW);
diff --git a/tcg/mips/tcg-target-has.h b/tcg/mips/tcg-target-has.h
index 880eb084eb..c27ca7e543 100644
--- a/tcg/mips/tcg-target-has.h
+++ b/tcg/mips/tcg-target-has.h
@@ -60,7 +60,6 @@ extern bool use_mips32r2_instructions;
 
 /* optional instructions detected at runtime */
 #define TCG_TARGET_HAS_extract2_i32     0
-#define TCG_TARGET_HAS_clz_i32          use_mips32r2_instructions
 #define TCG_TARGET_HAS_ctz_i32          0
 #define TCG_TARGET_HAS_ctpop_i32        0
 #define TCG_TARGET_HAS_qemu_st8_i32     0
@@ -70,7 +69,6 @@ extern bool use_mips32r2_instructions;
 #define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1
 #define TCG_TARGET_HAS_extract2_i64     0
-#define TCG_TARGET_HAS_clz_i64          use_mips32r2_instructions
 #define TCG_TARGET_HAS_ctz_i64          0
 #define TCG_TARGET_HAS_ctpop_i64        0
 #endif
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index fb9fe0c40e..5052d6481c 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -1563,33 +1563,6 @@ static void tcg_out_mb(TCGContext *s, TCGArg a0)
     tcg_out32(s, sync[a0 & TCG_MO_ALL]);
 }
 
-static void tcg_out_clz(TCGContext *s, MIPSInsn opcv2, MIPSInsn opcv6,
-                        int width, TCGReg a0, TCGReg a1, TCGArg a2)
-{
-    if (use_mips32r6_instructions) {
-        if (a2 == width) {
-            tcg_out_opc_reg(s, opcv6, a0, a1, 0);
-        } else {
-            tcg_out_opc_reg(s, opcv6, TCG_TMP0, a1, 0);
-            tcg_out_movcond(s, TCG_COND_EQ, a0, a1, 0, a2, TCG_TMP0);
-        }
-    } else {
-        if (a2 == width) {
-            tcg_out_opc_reg(s, opcv2, a0, a1, a1);
-        } else if (a0 == a2) {
-            tcg_out_opc_reg(s, opcv2, TCG_TMP0, a1, a1);
-            tcg_out_opc_reg(s, OPC_MOVN, a0, TCG_TMP0, a1);
-        } else if (a0 != a1) {
-            tcg_out_opc_reg(s, opcv2, a0, a1, a1);
-            tcg_out_opc_reg(s, OPC_MOVZ, a0, a2, a1);
-        } else {
-            tcg_out_opc_reg(s, opcv2, TCG_TMP0, a1, a1);
-            tcg_out_opc_reg(s, OPC_MOVZ, TCG_TMP0, a2, a1);
-            tcg_out_mov(s, TCG_TYPE_REG, a0, TCG_TMP0);
-        }
-    }
-}
-
 static void tcg_out_exit_tb(TCGContext *s, uintptr_t a0)
 {
     TCGReg base = TCG_REG_ZERO;
@@ -1712,6 +1685,55 @@ static const TCGOutOpBinary outop_andc = {
     .base.static_constraint = C_NotImplemented,
 };
 
+static void tgen_clz(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    if (use_mips32r6_instructions) {
+        MIPSInsn opcv6 = type == TCG_TYPE_I32 ? OPC_CLZ_R6 : OPC_DCLZ_R6;
+        tcg_out_opc_reg(s, opcv6, TCG_TMP0, a1, 0);
+        tcg_out_movcond(s, TCG_COND_EQ, a0, a1, 0, a2, TCG_TMP0);
+    } else {
+        MIPSInsn opcv2 = type == TCG_TYPE_I32 ? OPC_CLZ : OPC_DCLZ;
+        if (a0 == a2) {
+            tcg_out_opc_reg(s, opcv2, TCG_TMP0, a1, a1);
+            tcg_out_opc_reg(s, OPC_MOVN, a0, TCG_TMP0, a1);
+        } else if (a0 != a1) {
+            tcg_out_opc_reg(s, opcv2, a0, a1, a1);
+            tcg_out_opc_reg(s, OPC_MOVZ, a0, a2, a1);
+        } else {
+            tcg_out_opc_reg(s, opcv2, TCG_TMP0, a1, a1);
+            tcg_out_opc_reg(s, OPC_MOVZ, TCG_TMP0, a2, a1);
+            tcg_out_mov(s, type, a0, TCG_TMP0);
+        }
+    }
+}
+
+static void tgen_clzi(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    if (a2 == 0) {
+        tgen_clz(s, type, a0, a1, TCG_REG_ZERO);
+    } else if (use_mips32r6_instructions) {
+        MIPSInsn opcv6 = type == TCG_TYPE_I32 ? OPC_CLZ_R6 : OPC_DCLZ_R6;
+        tcg_out_opc_reg(s, opcv6, a0, a1, 0);
+    } else {
+        MIPSInsn opcv2 = type == TCG_TYPE_I32 ? OPC_CLZ : OPC_DCLZ;
+        tcg_out_opc_reg(s, opcv2, a0, a1, a1);
+    }
+}
+
+static TCGConstraintSetIndex cset_clz(TCGType type, unsigned flags)
+{
+    return use_mips32r2_instructions ? C_O1_I2(r, r, rzW) : C_NotImplemented;
+}
+
+static const TCGOutOpBinary outop_clz = {
+    .base.static_constraint = C_Dynamic,
+    .base.dynamic_constraint = cset_clz,
+    .out_rrr = tgen_clz,
+    .out_rri = tgen_clzi,
+};
+
 static void tgen_divs(TCGContext *s, TCGType type,
                       TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -2165,13 +2187,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_dsra(s, a0, a1, 32);
         break;
 
-    case INDEX_op_clz_i32:
-        tcg_out_clz(s, OPC_CLZ, OPC_CLZ_R6, 32, a0, a1, a2);
-        break;
-    case INDEX_op_clz_i64:
-        tcg_out_clz(s, OPC_DCLZ, OPC_DCLZ_R6, 64, a0, a1, a2);
-        break;
-
     case INDEX_op_deposit_i32:
         tcg_out_opc_bf(s, OPC_INS, a0, a2, args[3] + args[4] - 1, args[3]);
         break;
@@ -2329,9 +2344,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_muls2_i64:
     case INDEX_op_mulu2_i64:
         return C_O2_I2(r, r, r, r);
-    case INDEX_op_clz_i32:
-    case INDEX_op_clz_i64:
-        return C_O1_I2(r, r, rzW);
 
     case INDEX_op_deposit_i32:
     case INDEX_op_deposit_i64:
diff --git a/tcg/ppc/tcg-target-has.h b/tcg/ppc/tcg-target-has.h
index 71c02d88b9..cd7346011b 100644
--- a/tcg/ppc/tcg-target-has.h
+++ b/tcg/ppc/tcg-target-has.h
@@ -19,7 +19,6 @@
 /* optional instructions */
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
-#define TCG_TARGET_HAS_clz_i32          1
 #define TCG_TARGET_HAS_ctz_i32          have_isa_3_00
 #define TCG_TARGET_HAS_ctpop_i32        have_isa_2_06
 #define TCG_TARGET_HAS_extract2_i32     0
@@ -35,7 +34,6 @@
 #define TCG_TARGET_HAS_bswap16_i64      1
 #define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1
-#define TCG_TARGET_HAS_clz_i64          1
 #define TCG_TARGET_HAS_ctz_i64          have_isa_3_00
 #define TCG_TARGET_HAS_ctpop_i64        have_isa_2_06
 #define TCG_TARGET_HAS_extract2_i64     0
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index 687b66af54..518cf1e9ef 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -2954,6 +2954,26 @@ static const TCGOutOpBinary outop_andc = {
     .out_rrr = tgen_andc,
 };
 
+static void tgen_clz(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    uint32_t insn = type == TCG_TYPE_I32 ? CNTLZW : CNTLZD;
+    tcg_out_cntxz(s, type, insn, a0, a1, a2, false);
+}
+
+static void tgen_clzi(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    uint32_t insn = type == TCG_TYPE_I32 ? CNTLZW : CNTLZD;
+    tcg_out_cntxz(s, type, insn, a0, a1, a2, true);
+}
+
+static const TCGOutOpBinary outop_clz = {
+    .base.static_constraint = C_O1_I2(r, r, rZW),
+    .out_rrr = tgen_clz,
+    .out_rri = tgen_clzi,
+};
+
 static void tgen_eqv(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -3350,10 +3370,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_mem_long(s, STD, STDX, args[0], args[1], args[2]);
         break;
 
-    case INDEX_op_clz_i32:
-        tcg_out_cntxz(s, TCG_TYPE_I32, CNTLZW, args[0], args[1],
-                      args[2], const_args[2]);
-        break;
     case INDEX_op_ctz_i32:
         tcg_out_cntxz(s, TCG_TYPE_I32, CNTTZW, args[0], args[1],
                       args[2], const_args[2]);
@@ -3362,10 +3378,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out32(s, CNTPOPW | SAB(args[1], args[0], 0));
         break;
 
-    case INDEX_op_clz_i64:
-        tcg_out_cntxz(s, TCG_TYPE_I64, CNTLZD, args[0], args[1],
-                      args[2], const_args[2]);
-        break;
     case INDEX_op_ctz_i64:
         tcg_out_cntxz(s, TCG_TYPE_I64, CNTTZD, args[0], args[1],
                       args[2], const_args[2]);
@@ -4228,9 +4240,7 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(r, r);
 
-    case INDEX_op_clz_i32:
     case INDEX_op_ctz_i32:
-    case INDEX_op_clz_i64:
     case INDEX_op_ctz_i64:
         return C_O1_I2(r, r, rZW);
 
diff --git a/tcg/riscv/tcg-target-has.h b/tcg/riscv/tcg-target-has.h
index c7745a6462..41e287130d 100644
--- a/tcg/riscv/tcg-target-has.h
+++ b/tcg/riscv/tcg-target-has.h
@@ -18,7 +18,6 @@
 #define TCG_TARGET_HAS_muls2_i32        0
 #define TCG_TARGET_HAS_bswap16_i32      (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_bswap32_i32      (cpuinfo & CPUINFO_ZBB)
-#define TCG_TARGET_HAS_clz_i32          (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_ctz_i32          (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_ctpop_i32        (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_qemu_st8_i32     0
@@ -29,7 +28,6 @@
 #define TCG_TARGET_HAS_bswap16_i64      (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_bswap32_i64      (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_bswap64_i64      (cpuinfo & CPUINFO_ZBB)
-#define TCG_TARGET_HAS_clz_i64          (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_ctz_i64          (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_ctpop_i64        (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_add2_i64         1
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index 4dd892d98d..77eef02db5 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -1997,6 +1997,32 @@ static const TCGOutOpBinary outop_andc = {
     .out_rrr = tgen_andc,
 };
 
+static void tgen_clz(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    RISCVInsn insn = type == TCG_TYPE_I32 ? OPC_CLZW : OPC_CLZ;
+    tcg_out_cltz(s, type, insn, a0, a1, a2, false);
+}
+
+static void tgen_clzi(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    RISCVInsn insn = type == TCG_TYPE_I32 ? OPC_CLZW : OPC_CLZ;
+    tcg_out_cltz(s, type, insn, a0, a1, a2, true);
+}
+
+static TCGConstraintSetIndex cset_clzctz(TCGType type, unsigned flags)
+{
+    return cpuinfo & CPUINFO_ZBB ? C_N1_I2(r, r, rM) : C_NotImplemented;
+}
+
+static const TCGOutOpBinary outop_clz = {
+    .base.static_constraint = C_Dynamic,
+    .base.dynamic_constraint = cset_clzctz,
+    .out_rrr = tgen_clz,
+    .out_rri = tgen_clzi,
+};
+
 static void tgen_divs(TCGContext *s, TCGType type,
                       TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -2398,12 +2424,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_opc_imm(s, OPC_CPOP, a0, a1, 0);
         break;
 
-    case INDEX_op_clz_i32:
-        tcg_out_cltz(s, TCG_TYPE_I32, OPC_CLZW, a0, a1, a2, c2);
-        break;
-    case INDEX_op_clz_i64:
-        tcg_out_cltz(s, TCG_TYPE_I64, OPC_CLZ, a0, a1, a2, c2);
-        break;
     case INDEX_op_ctz_i32:
         tcg_out_cltz(s, TCG_TYPE_I32, OPC_CTZW, a0, a1, a2, c2);
         break;
@@ -2793,8 +2813,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_negsetcond_i64:
         return C_O1_I2(r, r, rI);
 
-    case INDEX_op_clz_i32:
-    case INDEX_op_clz_i64:
     case INDEX_op_ctz_i32:
     case INDEX_op_ctz_i64:
         return C_N1_I2(r, r, rM);
diff --git a/tcg/s390x/tcg-target-has.h b/tcg/s390x/tcg-target-has.h
index eaddf7005e..85a4f23e95 100644
--- a/tcg/s390x/tcg-target-has.h
+++ b/tcg/s390x/tcg-target-has.h
@@ -31,7 +31,6 @@ extern uint64_t s390_facilities[3];
 /* optional instructions */
 #define TCG_TARGET_HAS_bswap16_i32    1
 #define TCG_TARGET_HAS_bswap32_i32    1
-#define TCG_TARGET_HAS_clz_i32        0
 #define TCG_TARGET_HAS_ctz_i32        0
 #define TCG_TARGET_HAS_ctpop_i32      1
 #define TCG_TARGET_HAS_extract2_i32   0
@@ -46,7 +45,6 @@ extern uint64_t s390_facilities[3];
 #define TCG_TARGET_HAS_bswap16_i64    1
 #define TCG_TARGET_HAS_bswap32_i64    1
 #define TCG_TARGET_HAS_bswap64_i64    1
-#define TCG_TARGET_HAS_clz_i64        1
 #define TCG_TARGET_HAS_ctz_i64        0
 #define TCG_TARGET_HAS_ctpop_i64      1
 #define TCG_TARGET_HAS_extract2_i64   0
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index 76180dabcb..adfe403bef 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -1514,27 +1514,6 @@ static void tgen_movcond(TCGContext *s, TCGType type, TCGCond c, TCGReg dest,
     tgen_movcond_int(s, type, dest, v3, v3const, v4, cc, inv_cc);
 }
 
-static void tgen_clz(TCGContext *s, TCGReg dest, TCGReg a1,
-                     TCGArg a2, int a2const)
-{
-    /* Since this sets both R and R+1, we have no choice but to store the
-       result into R0, allowing R1 == TCG_TMP0 to be clobbered as well.  */
-    QEMU_BUILD_BUG_ON(TCG_TMP0 != TCG_REG_R1);
-    tcg_out_insn(s, RRE, FLOGR, TCG_REG_R0, a1);
-
-    if (a2const && a2 == 64) {
-        tcg_out_mov(s, TCG_TYPE_I64, dest, TCG_REG_R0);
-        return;
-    }
-
-    /*
-     * Conditions from FLOGR are:
-     *   2 -> one bit found
-     *   8 -> no one bit found
-     */
-    tgen_movcond_int(s, TCG_TYPE_I64, dest, a2, a2const, TCG_REG_R0, 8, 2);
-}
-
 static void tgen_ctpop(TCGContext *s, TCGType type, TCGReg dest, TCGReg src)
 {
     /* With MIE3, and bit 0 of m4 set, we get the complete result. */
@@ -2242,6 +2221,53 @@ static const TCGOutOpBinary outop_andc = {
     .out_rrr = tgen_andc,
 };
 
+static void tgen_clz_int(TCGContext *s, TCGReg dest, TCGReg a1,
+                         TCGArg a2, int a2const)
+{
+    /*
+     * Since this sets both R and R+1, we have no choice but to store the
+     * result into R0, allowing R1 == TCG_TMP0 to be clobbered as well.
+     */
+    QEMU_BUILD_BUG_ON(TCG_TMP0 != TCG_REG_R1);
+    tcg_out_insn(s, RRE, FLOGR, TCG_REG_R0, a1);
+
+    if (a2const && a2 == 64) {
+        tcg_out_mov(s, TCG_TYPE_I64, dest, TCG_REG_R0);
+        return;
+    }
+
+    /*
+     * Conditions from FLOGR are:
+     *   2 -> one bit found
+     *   8 -> no one bit found
+     */
+    tgen_movcond_int(s, TCG_TYPE_I64, dest, a2, a2const, TCG_REG_R0, 8, 2);
+}
+
+static void tgen_clz(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tgen_clz_int(s, a0, a1, a2, false);
+}
+
+static void tgen_clzi(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    tgen_clz_int(s, a0, a1, a2, true);
+}
+
+static TCGConstraintSetIndex cset_clz(TCGType type, unsigned flags)
+{
+    return type == TCG_TYPE_I64 ? C_O1_I2(r, r, rI) : C_NotImplemented;
+}
+
+static const TCGOutOpBinary outop_clz = {
+    .base.static_constraint = C_Dynamic,
+    .base.dynamic_constraint = cset_clz,
+    .out_rrr = tgen_clz,
+    .out_rri = tgen_clzi,
+};
+
 static const TCGOutOpBinary outop_divs = {
     .base.static_constraint = C_NotImplemented,
 };
@@ -2884,10 +2910,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tgen_sextract(s, args[0], args[1], args[2], args[3]);
         break;
 
-    case INDEX_op_clz_i64:
-        tgen_clz(s, args[0], args[1], args[2], const_args[2]);
-        break;
-
     case INDEX_op_ctpop_i32:
         tgen_ctpop(s, TCG_TYPE_I32, args[0], args[1]);
         break;
@@ -3387,9 +3409,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_negsetcond_i64:
         return C_O1_I2(r, r, rC);
 
-    case INDEX_op_clz_i64:
-        return C_O1_I2(r, r, rI);
-
     case INDEX_op_brcond_i32:
         return C_O0_I2(r, ri);
     case INDEX_op_brcond_i64:
diff --git a/tcg/sparc64/tcg-target-has.h b/tcg/sparc64/tcg-target-has.h
index 1dd86c363d..21fa0f3663 100644
--- a/tcg/sparc64/tcg-target-has.h
+++ b/tcg/sparc64/tcg-target-has.h
@@ -16,7 +16,6 @@ extern bool use_vis3_instructions;
 /* optional instructions */
 #define TCG_TARGET_HAS_bswap16_i32      0
 #define TCG_TARGET_HAS_bswap32_i32      0
-#define TCG_TARGET_HAS_clz_i32          0
 #define TCG_TARGET_HAS_ctz_i32          0
 #define TCG_TARGET_HAS_ctpop_i32        0
 #define TCG_TARGET_HAS_extract2_i32     0
@@ -31,7 +30,6 @@ extern bool use_vis3_instructions;
 #define TCG_TARGET_HAS_bswap16_i64      0
 #define TCG_TARGET_HAS_bswap32_i64      0
 #define TCG_TARGET_HAS_bswap64_i64      0
-#define TCG_TARGET_HAS_clz_i64          0
 #define TCG_TARGET_HAS_ctz_i64          0
 #define TCG_TARGET_HAS_ctpop_i64        0
 #define TCG_TARGET_HAS_extract2_i64     0
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index 57b26ae33b..a4fb41764b 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -1318,6 +1318,10 @@ static const TCGOutOpBinary outop_andc = {
     .out_rrr = tgen_andc,
 };
 
+static const TCGOutOpBinary outop_clz = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static void tgen_divs_rJ(TCGContext *s, TCGType type,
                          TCGReg a0, TCGReg a1, TCGArg a2, bool c2)
 {
diff --git a/tcg/tcg-has.h b/tcg/tcg-has.h
index 7bfa55adb1..27d6ec7636 100644
--- a/tcg/tcg-has.h
+++ b/tcg/tcg-has.h
@@ -15,7 +15,6 @@
 #define TCG_TARGET_HAS_bswap16_i64      0
 #define TCG_TARGET_HAS_bswap32_i64      0
 #define TCG_TARGET_HAS_bswap64_i64      0
-#define TCG_TARGET_HAS_clz_i64          0
 #define TCG_TARGET_HAS_ctz_i64          0
 #define TCG_TARGET_HAS_ctpop_i64        0
 #define TCG_TARGET_HAS_extract2_i64     0
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index 1989d8d12c..e1e57ff3f8 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -723,9 +723,9 @@ void tcg_gen_orc_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 
 void tcg_gen_clz_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 {
-    if (TCG_TARGET_HAS_clz_i32) {
+    if (tcg_op_supported(INDEX_op_clz_i32, TCG_TYPE_I32, 0)) {
         tcg_gen_op3_i32(INDEX_op_clz_i32, ret, arg1, arg2);
-    } else if (TCG_TARGET_HAS_clz_i64) {
+    } else if (tcg_op_supported(INDEX_op_clz_i64, TCG_TYPE_I64, 0)) {
         TCGv_i64 t1 = tcg_temp_ebb_new_i64();
         TCGv_i64 t2 = tcg_temp_ebb_new_i64();
         tcg_gen_extu_i32_i64(t1, arg1);
@@ -748,9 +748,13 @@ void tcg_gen_clzi_i32(TCGv_i32 ret, TCGv_i32 arg1, uint32_t arg2)
 
 void tcg_gen_ctz_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 {
+    TCGv_i32 z, t;
+
     if (TCG_TARGET_HAS_ctz_i32) {
         tcg_gen_op3_i32(INDEX_op_ctz_i32, ret, arg1, arg2);
-    } else if (TCG_TARGET_HAS_ctz_i64) {
+        return;
+    }
+    if (TCG_TARGET_HAS_ctz_i64) {
         TCGv_i64 t1 = tcg_temp_ebb_new_i64();
         TCGv_i64 t2 = tcg_temp_ebb_new_i64();
         tcg_gen_extu_i32_i64(t1, arg1);
@@ -759,29 +763,28 @@ void tcg_gen_ctz_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
         tcg_gen_extrl_i64_i32(ret, t1);
         tcg_temp_free_i64(t1);
         tcg_temp_free_i64(t2);
-    } else if (TCG_TARGET_HAS_ctpop_i32
-               || TCG_TARGET_HAS_ctpop_i64
-               || TCG_TARGET_HAS_clz_i32
-               || TCG_TARGET_HAS_clz_i64) {
-        TCGv_i32 z, t = tcg_temp_ebb_new_i32();
-
-        if (TCG_TARGET_HAS_ctpop_i32 || TCG_TARGET_HAS_ctpop_i64) {
-            tcg_gen_subi_i32(t, arg1, 1);
-            tcg_gen_andc_i32(t, t, arg1);
-            tcg_gen_ctpop_i32(t, t);
-        } else {
-            /* Since all non-x86 hosts have clz(0) == 32, don't fight it.  */
-            tcg_gen_neg_i32(t, arg1);
-            tcg_gen_and_i32(t, t, arg1);
-            tcg_gen_clzi_i32(t, t, 32);
-            tcg_gen_xori_i32(t, t, 31);
-        }
-        z = tcg_constant_i32(0);
-        tcg_gen_movcond_i32(TCG_COND_EQ, ret, arg1, z, arg2, t);
-        tcg_temp_free_i32(t);
+        return;
+    }
+    if (TCG_TARGET_HAS_ctpop_i32 || TCG_TARGET_HAS_ctpop_i64) {
+        t = tcg_temp_ebb_new_i32();
+        tcg_gen_subi_i32(t, arg1, 1);
+        tcg_gen_andc_i32(t, t, arg1);
+        tcg_gen_ctpop_i32(t, t);
+    } else if (tcg_op_supported(INDEX_op_clz_i32, TCG_TYPE_I32, 0) ||
+               tcg_op_supported(INDEX_op_clz_i64, TCG_TYPE_I64, 0)) {
+        t = tcg_temp_ebb_new_i32();
+        tcg_gen_neg_i32(t, arg1);
+        tcg_gen_and_i32(t, t, arg1);
+        tcg_gen_clzi_i32(t, t, 32);
+        tcg_gen_xori_i32(t, t, 31);
     } else {
         gen_helper_ctz_i32(ret, arg1, arg2);
+        return;
     }
+
+    z = tcg_constant_i32(0);
+    tcg_gen_movcond_i32(TCG_COND_EQ, ret, arg1, z, arg2, t);
+    tcg_temp_free_i32(t);
 }
 
 void tcg_gen_ctzi_i32(TCGv_i32 ret, TCGv_i32 arg1, uint32_t arg2)
@@ -800,7 +803,8 @@ void tcg_gen_ctzi_i32(TCGv_i32 ret, TCGv_i32 arg1, uint32_t arg2)
 
 void tcg_gen_clrsb_i32(TCGv_i32 ret, TCGv_i32 arg)
 {
-    if (TCG_TARGET_HAS_clz_i32) {
+    if (tcg_op_supported(INDEX_op_clz_i32, TCG_TYPE_I32, 0) ||
+        tcg_op_supported(INDEX_op_clz_i64, TCG_TYPE_I64, 0)) {
         TCGv_i32 t = tcg_temp_ebb_new_i32();
         tcg_gen_sari_i32(t, arg, 31);
         tcg_gen_xor_i32(t, t, arg);
@@ -2336,7 +2340,7 @@ void tcg_gen_orc_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
 
 void tcg_gen_clz_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
 {
-    if (TCG_TARGET_HAS_clz_i64) {
+    if (tcg_op_supported(INDEX_op_clz_i64, TCG_TYPE_I64, 0)) {
         tcg_gen_op3_i64(INDEX_op_clz_i64, ret, arg1, arg2);
     } else {
         gen_helper_clz_i64(ret, arg1, arg2);
@@ -2346,8 +2350,8 @@ void tcg_gen_clz_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
 void tcg_gen_clzi_i64(TCGv_i64 ret, TCGv_i64 arg1, uint64_t arg2)
 {
     if (TCG_TARGET_REG_BITS == 32
-        && TCG_TARGET_HAS_clz_i32
-        && arg2 <= 0xffffffffu) {
+        && arg2 <= 0xffffffffu
+        && tcg_op_supported(INDEX_op_clz_i32, TCG_TYPE_I32, 0)) {
         TCGv_i32 t = tcg_temp_ebb_new_i32();
         tcg_gen_clzi_i32(t, TCGV_LOW(arg1), arg2 - 32);
         tcg_gen_addi_i32(t, t, 32);
@@ -2361,45 +2365,47 @@ void tcg_gen_clzi_i64(TCGv_i64 ret, TCGv_i64 arg1, uint64_t arg2)
 
 void tcg_gen_ctz_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
 {
+    TCGv_i64 z, t;
+
     if (TCG_TARGET_HAS_ctz_i64) {
         tcg_gen_op3_i64(INDEX_op_ctz_i64, ret, arg1, arg2);
-    } else if (TCG_TARGET_HAS_ctpop_i64 || TCG_TARGET_HAS_clz_i64) {
-        TCGv_i64 z, t = tcg_temp_ebb_new_i64();
-
-        if (TCG_TARGET_HAS_ctpop_i64) {
-            tcg_gen_subi_i64(t, arg1, 1);
-            tcg_gen_andc_i64(t, t, arg1);
-            tcg_gen_ctpop_i64(t, t);
-        } else {
-            /* Since all non-x86 hosts have clz(0) == 64, don't fight it.  */
-            tcg_gen_neg_i64(t, arg1);
-            tcg_gen_and_i64(t, t, arg1);
-            tcg_gen_clzi_i64(t, t, 64);
-            tcg_gen_xori_i64(t, t, 63);
-        }
-        z = tcg_constant_i64(0);
-        tcg_gen_movcond_i64(TCG_COND_EQ, ret, arg1, z, arg2, t);
-        tcg_temp_free_i64(t);
-        tcg_temp_free_i64(z);
+        return;
+    }
+    if (TCG_TARGET_HAS_ctpop_i64) {
+        t = tcg_temp_ebb_new_i64();
+        tcg_gen_subi_i64(t, arg1, 1);
+        tcg_gen_andc_i64(t, t, arg1);
+        tcg_gen_ctpop_i64(t, t);
+    } else if (tcg_op_supported(INDEX_op_clz_i64, TCG_TYPE_I64, 0)) {
+        t = tcg_temp_ebb_new_i64();
+        tcg_gen_neg_i64(t, arg1);
+        tcg_gen_and_i64(t, t, arg1);
+        tcg_gen_clzi_i64(t, t, 64);
+        tcg_gen_xori_i64(t, t, 63);
     } else {
         gen_helper_ctz_i64(ret, arg1, arg2);
+        return;
     }
+
+    z = tcg_constant_i64(0);
+    tcg_gen_movcond_i64(TCG_COND_EQ, ret, arg1, z, arg2, t);
+    tcg_temp_free_i64(t);
 }
 
 void tcg_gen_ctzi_i64(TCGv_i64 ret, TCGv_i64 arg1, uint64_t arg2)
 {
     if (TCG_TARGET_REG_BITS == 32
-        && TCG_TARGET_HAS_ctz_i32
-        && arg2 <= 0xffffffffu) {
+        && arg2 <= 0xffffffffu
+        && tcg_op_supported(INDEX_op_ctz_i32, TCG_TYPE_I32, 0)) {
         TCGv_i32 t32 = tcg_temp_ebb_new_i32();
         tcg_gen_ctzi_i32(t32, TCGV_HIGH(arg1), arg2 - 32);
         tcg_gen_addi_i32(t32, t32, 32);
         tcg_gen_ctz_i32(TCGV_LOW(ret), TCGV_LOW(arg1), t32);
         tcg_gen_movi_i32(TCGV_HIGH(ret), 0);
         tcg_temp_free_i32(t32);
-    } else if (!TCG_TARGET_HAS_ctz_i64
-               && TCG_TARGET_HAS_ctpop_i64
-               && arg2 == 64) {
+    } else if (arg2 == 64
+               && !tcg_op_supported(INDEX_op_ctz_i64, TCG_TYPE_I64, 0)
+               && TCG_TARGET_HAS_ctpop_i64) {
         /* This equivalence has the advantage of not requiring a fixup.  */
         TCGv_i64 t = tcg_temp_ebb_new_i64();
         tcg_gen_subi_i64(t, arg1, 1);
@@ -2413,7 +2419,7 @@ void tcg_gen_ctzi_i64(TCGv_i64 ret, TCGv_i64 arg1, uint64_t arg2)
 
 void tcg_gen_clrsb_i64(TCGv_i64 ret, TCGv_i64 arg)
 {
-    if (TCG_TARGET_HAS_clz_i64 || TCG_TARGET_HAS_clz_i32) {
+    if (tcg_op_supported(INDEX_op_clz_i64, TCG_TYPE_I64, 0)) {
         TCGv_i64 t = tcg_temp_ebb_new_i64();
         tcg_gen_sari_i64(t, arg, 63);
         tcg_gen_xor_i64(t, t, arg);
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 182f19e5f0..e04d3adcec 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1026,6 +1026,8 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_add, TCGOutOpBinary, outop_add),
     OUTOP(INDEX_op_and, TCGOutOpBinary, outop_and),
     OUTOP(INDEX_op_andc, TCGOutOpBinary, outop_andc),
+    OUTOP(INDEX_op_clz_i32, TCGOutOpBinary, outop_clz),
+    OUTOP(INDEX_op_clz_i64, TCGOutOpBinary, outop_clz),
     OUTOP(INDEX_op_divs, TCGOutOpBinary, outop_divs),
     OUTOP(INDEX_op_divu, TCGOutOpBinary, outop_divu),
     OUTOP(INDEX_op_divs2, TCGOutOpDivRem, outop_divs2),
@@ -2288,8 +2290,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
         return TCG_TARGET_HAS_bswap16_i32;
     case INDEX_op_bswap32_i32:
         return TCG_TARGET_HAS_bswap32_i32;
-    case INDEX_op_clz_i32:
-        return TCG_TARGET_HAS_clz_i32;
     case INDEX_op_ctz_i32:
         return TCG_TARGET_HAS_ctz_i32;
     case INDEX_op_ctpop_i32:
@@ -2333,8 +2333,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
         return TCG_TARGET_HAS_bswap32_i64;
     case INDEX_op_bswap64_i64:
         return TCG_TARGET_HAS_bswap64_i64;
-    case INDEX_op_clz_i64:
-        return TCG_TARGET_HAS_clz_i64;
     case INDEX_op_ctz_i64:
         return TCG_TARGET_HAS_ctz_i64;
     case INDEX_op_ctpop_i64:
@@ -5404,6 +5402,8 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
     case INDEX_op_add:
     case INDEX_op_and:
     case INDEX_op_andc:
+    case INDEX_op_clz_i32:
+    case INDEX_op_clz_i64:
     case INDEX_op_divs:
     case INDEX_op_divu:
     case INDEX_op_eqv:
diff --git a/tcg/tci.c b/tcg/tci.c
index b1ee14e65f..11b11ce642 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -594,13 +594,11 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = (uint32_t)regs[r1] % (uint32_t)regs[r2];
             break;
-#if TCG_TARGET_HAS_clz_i32
-        case INDEX_op_clz_i32:
+        case INDEX_op_tci_clz32:
             tci_args_rrr(insn, &r0, &r1, &r2);
             tmp32 = regs[r1];
             regs[r0] = tmp32 ? clz32(tmp32) : regs[r2];
             break;
-#endif
 #if TCG_TARGET_HAS_ctz_i32
         case INDEX_op_ctz_i32:
             tci_args_rrr(insn, &r0, &r1, &r2);
@@ -735,12 +733,10 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = (uint64_t)regs[r1] % (uint64_t)regs[r2];
             break;
-#if TCG_TARGET_HAS_clz_i64
         case INDEX_op_clz_i64:
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = regs[r1] ? clz64(regs[r1]) : regs[r2];
             break;
-#endif
 #if TCG_TARGET_HAS_ctz_i64
         case INDEX_op_ctz_i64:
             tci_args_rrr(insn, &r0, &r1, &r2);
@@ -1073,10 +1069,10 @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
     case INDEX_op_shr:
     case INDEX_op_sub:
     case INDEX_op_xor:
-    case INDEX_op_clz_i32:
     case INDEX_op_clz_i64:
     case INDEX_op_ctz_i32:
     case INDEX_op_ctz_i64:
+    case INDEX_op_tci_clz32:
     case INDEX_op_tci_divs32:
     case INDEX_op_tci_divu32:
     case INDEX_op_tci_rems32:
diff --git a/tcg/tci/tcg-target-has.h b/tcg/tci/tcg-target-has.h
index 04d341a8d2..ae1f724702 100644
--- a/tcg/tci/tcg-target-has.h
+++ b/tcg/tci/tcg-target-has.h
@@ -10,7 +10,6 @@
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
 #define TCG_TARGET_HAS_extract2_i32     0
-#define TCG_TARGET_HAS_clz_i32          1
 #define TCG_TARGET_HAS_ctz_i32          1
 #define TCG_TARGET_HAS_ctpop_i32        1
 #define TCG_TARGET_HAS_negsetcond_i32   0
@@ -23,7 +22,6 @@
 #define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1
 #define TCG_TARGET_HAS_extract2_i64     0
-#define TCG_TARGET_HAS_clz_i64          1
 #define TCG_TARGET_HAS_ctz_i64          1
 #define TCG_TARGET_HAS_ctpop_i64        1
 #define TCG_TARGET_HAS_negsetcond_i64   0
diff --git a/tcg/tci/tcg-target-opc.h.inc b/tcg/tci/tcg-target-opc.h.inc
index cff215490a..04774ca9c4 100644
--- a/tcg/tci/tcg-target-opc.h.inc
+++ b/tcg/tci/tcg-target-opc.h.inc
@@ -2,6 +2,7 @@
 /* These opcodes for use between the tci generator and interpreter. */
 DEF(tci_movi, 1, 0, 1, TCG_OPF_NOT_PRESENT)
 DEF(tci_movl, 1, 0, 1, TCG_OPF_NOT_PRESENT)
+DEF(tci_clz32, 1, 2, 0, TCG_OPF_NOT_PRESENT)
 DEF(tci_divs32, 1, 2, 0, TCG_OPF_NOT_PRESENT)
 DEF(tci_divu32, 1, 2, 0, TCG_OPF_NOT_PRESENT)
 DEF(tci_rems32, 1, 2, 0, TCG_OPF_NOT_PRESENT)
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index 0d15547c9f..ee7e6f15eb 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -83,8 +83,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_setcond_i64:
     case INDEX_op_deposit_i32:
     case INDEX_op_deposit_i64:
-    case INDEX_op_clz_i32:
-    case INDEX_op_clz_i64:
     case INDEX_op_ctz_i32:
     case INDEX_op_ctz_i64:
         return C_O1_I2(r, r, r);
@@ -630,6 +628,20 @@ static const TCGOutOpBinary outop_andc = {
     .out_rrr = tgen_andc,
 };
 
+static void tgen_clz(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    TCGOpcode opc = (type == TCG_TYPE_I32
+                     ? INDEX_op_tci_clz32
+                     : INDEX_op_clz_i64);
+    tcg_out_op_rrr(s, opc, a0, a1, a2);
+}
+
+static const TCGOutOpBinary outop_clz = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_clz,
+};
+
 static void tgen_divs(TCGContext *s, TCGType type,
                       TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -921,7 +933,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_ldst(s, opc, args[0], args[1], args[2]);
         break;
 
-    CASE_32_64(clz)      /* Optional (TCG_TARGET_HAS_clz_*). */
     CASE_32_64(ctz)      /* Optional (TCG_TARGET_HAS_ctz_*). */
         tcg_out_op_rrr(s, opc, args[0], args[1], args[2]);
         break;

From 5a5bb0a5a0b879c8f110c6a9bde9146181ef840c Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Jan 2025 16:12:46 -0800
Subject: [PATCH 0422/2760] tcg: Merge INDEX_op_clz_{i32,i64}
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 docs/devel/tcg-ops.rst   |  2 +-
 include/tcg/tcg-opc.h    |  3 +--
 tcg/optimize.c           | 10 +++++-----
 tcg/tcg-op.c             | 22 ++++++++++------------
 tcg/tcg.c                |  6 ++----
 tcg/tci.c                |  4 ++--
 tcg/tci/tcg-target.c.inc |  2 +-
 7 files changed, 22 insertions(+), 27 deletions(-)

diff --git a/docs/devel/tcg-ops.rst b/docs/devel/tcg-ops.rst
index c3a6499d01..22f0432988 100644
--- a/docs/devel/tcg-ops.rst
+++ b/docs/devel/tcg-ops.rst
@@ -358,7 +358,7 @@ Logical
 
      - | *t0* = *t1* | ~\ *t2*
 
-   * - clz_i32/i64 *t0*, *t1*, *t2*
+   * - clz *t0*, *t1*, *t2*
 
      - | *t0* = *t1* ? clz(*t1*) : *t2*
 
diff --git a/include/tcg/tcg-opc.h b/include/tcg/tcg-opc.h
index 25fd93eb28..ad1d193ef4 100644
--- a/include/tcg/tcg-opc.h
+++ b/include/tcg/tcg-opc.h
@@ -42,6 +42,7 @@ DEF(mov, 1, 1, 0, TCG_OPF_INT | TCG_OPF_NOT_PRESENT)
 DEF(add, 1, 2, 0, TCG_OPF_INT)
 DEF(and, 1, 2, 0, TCG_OPF_INT)
 DEF(andc, 1, 2, 0, TCG_OPF_INT)
+DEF(clz, 1, 2, 0, TCG_OPF_INT)
 DEF(divs, 1, 2, 0, TCG_OPF_INT)
 DEF(divs2, 2, 3, 0, TCG_OPF_INT)
 DEF(divu, 1, 2, 0, TCG_OPF_INT)
@@ -95,7 +96,6 @@ DEF(setcond2_i32, 1, 4, 1, 0)
 
 DEF(bswap16_i32, 1, 1, 1, 0)
 DEF(bswap32_i32, 1, 1, 1, 0)
-DEF(clz_i32, 1, 2, 0, 0)
 DEF(ctz_i32, 1, 2, 0, 0)
 DEF(ctpop_i32, 1, 1, 0, 0)
 
@@ -130,7 +130,6 @@ DEF(brcond_i64, 0, 2, 2, TCG_OPF_BB_END | TCG_OPF_COND_BRANCH)
 DEF(bswap16_i64, 1, 1, 1, 0)
 DEF(bswap32_i64, 1, 1, 1, 0)
 DEF(bswap64_i64, 1, 1, 1, 0)
-DEF(clz_i64, 1, 2, 0, 0)
 DEF(ctz_i64, 1, 2, 0, 0)
 DEF(ctpop_i64, 1, 1, 0, 0)
 
diff --git a/tcg/optimize.c b/tcg/optimize.c
index 97a566a617..d8d0e728aa 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -503,10 +503,10 @@ static uint64_t do_constant_folding_2(TCGOpcode op, TCGType type,
     case INDEX_op_nor_vec:
         return ~(x | y);
 
-    case INDEX_op_clz_i32:
-        return (uint32_t)x ? clz32(x) : y;
-
-    case INDEX_op_clz_i64:
+    case INDEX_op_clz:
+        if (type == TCG_TYPE_I32) {
+            return (uint32_t)x ? clz32(x) : y;
+        }
         return x ? clz64(x) : y;
 
     case INDEX_op_ctz_i32:
@@ -2898,7 +2898,7 @@ void tcg_optimize(TCGContext *s)
         case INDEX_op_bswap64_i64:
             done = fold_bswap(&ctx, op);
             break;
-        CASE_OP_32_64(clz):
+        case INDEX_op_clz:
         CASE_OP_32_64(ctz):
             done = fold_count_zeros(&ctx, op);
             break;
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index e1e57ff3f8..76e9efc655 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -723,9 +723,9 @@ void tcg_gen_orc_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 
 void tcg_gen_clz_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 {
-    if (tcg_op_supported(INDEX_op_clz_i32, TCG_TYPE_I32, 0)) {
-        tcg_gen_op3_i32(INDEX_op_clz_i32, ret, arg1, arg2);
-    } else if (tcg_op_supported(INDEX_op_clz_i64, TCG_TYPE_I64, 0)) {
+    if (tcg_op_supported(INDEX_op_clz, TCG_TYPE_I32, 0)) {
+        tcg_gen_op3_i32(INDEX_op_clz, ret, arg1, arg2);
+    } else if (tcg_op_supported(INDEX_op_clz, TCG_TYPE_I64, 0)) {
         TCGv_i64 t1 = tcg_temp_ebb_new_i64();
         TCGv_i64 t2 = tcg_temp_ebb_new_i64();
         tcg_gen_extu_i32_i64(t1, arg1);
@@ -770,8 +770,7 @@ void tcg_gen_ctz_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
         tcg_gen_subi_i32(t, arg1, 1);
         tcg_gen_andc_i32(t, t, arg1);
         tcg_gen_ctpop_i32(t, t);
-    } else if (tcg_op_supported(INDEX_op_clz_i32, TCG_TYPE_I32, 0) ||
-               tcg_op_supported(INDEX_op_clz_i64, TCG_TYPE_I64, 0)) {
+    } else if (tcg_op_supported(INDEX_op_clz, TCG_TYPE_REG, 0)) {
         t = tcg_temp_ebb_new_i32();
         tcg_gen_neg_i32(t, arg1);
         tcg_gen_and_i32(t, t, arg1);
@@ -803,8 +802,7 @@ void tcg_gen_ctzi_i32(TCGv_i32 ret, TCGv_i32 arg1, uint32_t arg2)
 
 void tcg_gen_clrsb_i32(TCGv_i32 ret, TCGv_i32 arg)
 {
-    if (tcg_op_supported(INDEX_op_clz_i32, TCG_TYPE_I32, 0) ||
-        tcg_op_supported(INDEX_op_clz_i64, TCG_TYPE_I64, 0)) {
+    if (tcg_op_supported(INDEX_op_clz, TCG_TYPE_REG, 0)) {
         TCGv_i32 t = tcg_temp_ebb_new_i32();
         tcg_gen_sari_i32(t, arg, 31);
         tcg_gen_xor_i32(t, t, arg);
@@ -2340,8 +2338,8 @@ void tcg_gen_orc_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
 
 void tcg_gen_clz_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
 {
-    if (tcg_op_supported(INDEX_op_clz_i64, TCG_TYPE_I64, 0)) {
-        tcg_gen_op3_i64(INDEX_op_clz_i64, ret, arg1, arg2);
+    if (tcg_op_supported(INDEX_op_clz, TCG_TYPE_I64, 0)) {
+        tcg_gen_op3_i64(INDEX_op_clz, ret, arg1, arg2);
     } else {
         gen_helper_clz_i64(ret, arg1, arg2);
     }
@@ -2351,7 +2349,7 @@ void tcg_gen_clzi_i64(TCGv_i64 ret, TCGv_i64 arg1, uint64_t arg2)
 {
     if (TCG_TARGET_REG_BITS == 32
         && arg2 <= 0xffffffffu
-        && tcg_op_supported(INDEX_op_clz_i32, TCG_TYPE_I32, 0)) {
+        && tcg_op_supported(INDEX_op_clz, TCG_TYPE_I32, 0)) {
         TCGv_i32 t = tcg_temp_ebb_new_i32();
         tcg_gen_clzi_i32(t, TCGV_LOW(arg1), arg2 - 32);
         tcg_gen_addi_i32(t, t, 32);
@@ -2376,7 +2374,7 @@ void tcg_gen_ctz_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
         tcg_gen_subi_i64(t, arg1, 1);
         tcg_gen_andc_i64(t, t, arg1);
         tcg_gen_ctpop_i64(t, t);
-    } else if (tcg_op_supported(INDEX_op_clz_i64, TCG_TYPE_I64, 0)) {
+    } else if (tcg_op_supported(INDEX_op_clz, TCG_TYPE_I64, 0)) {
         t = tcg_temp_ebb_new_i64();
         tcg_gen_neg_i64(t, arg1);
         tcg_gen_and_i64(t, t, arg1);
@@ -2419,7 +2417,7 @@ void tcg_gen_ctzi_i64(TCGv_i64 ret, TCGv_i64 arg1, uint64_t arg2)
 
 void tcg_gen_clrsb_i64(TCGv_i64 ret, TCGv_i64 arg)
 {
-    if (tcg_op_supported(INDEX_op_clz_i64, TCG_TYPE_I64, 0)) {
+    if (tcg_op_supported(INDEX_op_clz, TCG_TYPE_I64, 0)) {
         TCGv_i64 t = tcg_temp_ebb_new_i64();
         tcg_gen_sari_i64(t, arg, 63);
         tcg_gen_xor_i64(t, t, arg);
diff --git a/tcg/tcg.c b/tcg/tcg.c
index e04d3adcec..71b0721fb5 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1026,8 +1026,7 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_add, TCGOutOpBinary, outop_add),
     OUTOP(INDEX_op_and, TCGOutOpBinary, outop_and),
     OUTOP(INDEX_op_andc, TCGOutOpBinary, outop_andc),
-    OUTOP(INDEX_op_clz_i32, TCGOutOpBinary, outop_clz),
-    OUTOP(INDEX_op_clz_i64, TCGOutOpBinary, outop_clz),
+    OUTOP(INDEX_op_clz, TCGOutOpBinary, outop_clz),
     OUTOP(INDEX_op_divs, TCGOutOpBinary, outop_divs),
     OUTOP(INDEX_op_divu, TCGOutOpBinary, outop_divu),
     OUTOP(INDEX_op_divs2, TCGOutOpDivRem, outop_divs2),
@@ -5402,8 +5401,7 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
     case INDEX_op_add:
     case INDEX_op_and:
     case INDEX_op_andc:
-    case INDEX_op_clz_i32:
-    case INDEX_op_clz_i64:
+    case INDEX_op_clz:
     case INDEX_op_divs:
     case INDEX_op_divu:
     case INDEX_op_eqv:
diff --git a/tcg/tci.c b/tcg/tci.c
index 11b11ce642..7c2f2a524b 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -733,7 +733,7 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = (uint64_t)regs[r1] % (uint64_t)regs[r2];
             break;
-        case INDEX_op_clz_i64:
+        case INDEX_op_clz:
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = regs[r1] ? clz64(regs[r1]) : regs[r2];
             break;
@@ -1052,6 +1052,7 @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
     case INDEX_op_add:
     case INDEX_op_and:
     case INDEX_op_andc:
+    case INDEX_op_clz:
     case INDEX_op_divs:
     case INDEX_op_divu:
     case INDEX_op_eqv:
@@ -1069,7 +1070,6 @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
     case INDEX_op_shr:
     case INDEX_op_sub:
     case INDEX_op_xor:
-    case INDEX_op_clz_i64:
     case INDEX_op_ctz_i32:
     case INDEX_op_ctz_i64:
     case INDEX_op_tci_clz32:
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index ee7e6f15eb..0fd1f5510a 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -633,7 +633,7 @@ static void tgen_clz(TCGContext *s, TCGType type,
 {
     TCGOpcode opc = (type == TCG_TYPE_I32
                      ? INDEX_op_tci_clz32
-                     : INDEX_op_clz_i64);
+                     : INDEX_op_clz);
     tcg_out_op_rrr(s, opc, a0, a1, a2);
 }
 

From e3fcde59c92fb421789890c145d5fffdd3d1672d Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Jan 2025 17:02:13 -0800
Subject: [PATCH 0423/2760] tcg: Convert ctz to TCGOutOpBinary

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target-has.h     |  2 --
 tcg/aarch64/tcg-target.c.inc     | 34 ++++++++++--------
 tcg/arm/tcg-target-has.h         |  1 -
 tcg/arm/tcg-target.c.inc         | 39 ++++++++++++++-------
 tcg/i386/tcg-target-has.h        |  2 --
 tcg/i386/tcg-target.c.inc        | 60 +++++++++++++++++++-------------
 tcg/loongarch64/tcg-target-has.h |  2 --
 tcg/loongarch64/tcg-target.c.inc | 60 ++++++++++++++------------------
 tcg/mips/tcg-target-has.h        |  2 --
 tcg/mips/tcg-target.c.inc        |  4 +++
 tcg/ppc/tcg-target-has.h         |  2 --
 tcg/ppc/tcg-target.c.inc         | 39 ++++++++++++++-------
 tcg/riscv/tcg-target-has.h       |  2 --
 tcg/riscv/tcg-target.c.inc       | 32 +++++++++++------
 tcg/s390x/tcg-target-has.h       |  2 --
 tcg/s390x/tcg-target.c.inc       |  4 +++
 tcg/sparc64/tcg-target-has.h     |  2 --
 tcg/sparc64/tcg-target.c.inc     |  4 +++
 tcg/tcg-has.h                    |  1 -
 tcg/tcg-op.c                     |  9 ++---
 tcg/tcg.c                        |  8 ++---
 tcg/tci.c                        |  8 ++---
 tcg/tci/tcg-target-has.h         |  2 --
 tcg/tci/tcg-target-opc.h.inc     |  1 +
 tcg/tci/tcg-target.c.inc         | 20 +++++++----
 25 files changed, 193 insertions(+), 149 deletions(-)

diff --git a/tcg/aarch64/tcg-target-has.h b/tcg/aarch64/tcg-target-has.h
index 8c839d8949..478d59676e 100644
--- a/tcg/aarch64/tcg-target-has.h
+++ b/tcg/aarch64/tcg-target-has.h
@@ -15,7 +15,6 @@
 /* optional instructions */
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
-#define TCG_TARGET_HAS_ctz_i32          1
 #define TCG_TARGET_HAS_ctpop_i32        0
 #define TCG_TARGET_HAS_extract2_i32     1
 #define TCG_TARGET_HAS_negsetcond_i32   1
@@ -29,7 +28,6 @@
 #define TCG_TARGET_HAS_bswap16_i64      1
 #define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1
-#define TCG_TARGET_HAS_ctz_i64          1
 #define TCG_TARGET_HAS_ctpop_i64        0
 #define TCG_TARGET_HAS_extract2_i64     1
 #define TCG_TARGET_HAS_negsetcond_i64   1
diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index 3bd8231117..8441c5f4bf 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -2129,6 +2129,26 @@ static const TCGOutOpBinary outop_clz = {
     .out_rri = tgen_clzi,
 };
 
+static void tgen_ctz(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_insn(s, 3507, RBIT, type, TCG_REG_TMP0, a1);
+    tgen_clz(s, type, a0, TCG_REG_TMP0, a2);
+}
+
+static void tgen_ctzi(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    tcg_out_insn(s, 3507, RBIT, type, TCG_REG_TMP0, a1);
+    tgen_clzi(s, type, a0, TCG_REG_TMP0, a2);
+}
+
+static const TCGOutOpBinary outop_ctz = {
+    .base.static_constraint = C_O1_I2(r, r, rAL),
+    .out_rrr = tgen_ctz,
+    .out_rri = tgen_ctzi,
+};
+
 static void tgen_divs(TCGContext *s, TCGType type,
                       TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -2468,16 +2488,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType ext,
         tcg_out_ldst(s, I3312_STRX, a0, a1, a2, 3);
         break;
 
-    case INDEX_op_ctz_i64:
-    case INDEX_op_ctz_i32:
-        tcg_out_insn(s, 3507, RBIT, ext, TCG_REG_TMP0, a1);
-        if (c2) {
-            tgen_clzi(s, ext, a0, TCG_REG_TMP0, a2);
-        } else {
-            tgen_clz(s, ext, a0, TCG_REG_TMP0, a2);
-        }
-        break;
-
     case INDEX_op_brcond_i32:
         a1 = (int32_t)a1;
         /* FALLTHRU */
@@ -3098,10 +3108,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_negsetcond_i64:
         return C_O1_I2(r, r, rC);
 
-    case INDEX_op_ctz_i32:
-    case INDEX_op_ctz_i64:
-        return C_O1_I2(r, r, rAL);
-
     case INDEX_op_brcond_i32:
     case INDEX_op_brcond_i64:
         return C_O0_I2(r, rC);
diff --git a/tcg/arm/tcg-target-has.h b/tcg/arm/tcg-target-has.h
index fceec2f0ca..1485a52c21 100644
--- a/tcg/arm/tcg-target-has.h
+++ b/tcg/arm/tcg-target-has.h
@@ -26,7 +26,6 @@ extern bool use_neon_instructions;
 /* optional instructions */
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
-#define TCG_TARGET_HAS_ctz_i32          use_armv7_instructions
 #define TCG_TARGET_HAS_ctpop_i32        0
 #define TCG_TARGET_HAS_extract2_i32     1
 #define TCG_TARGET_HAS_negsetcond_i32   1
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index 681eb5aba1..c05f21c82c 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -1888,6 +1888,32 @@ static const TCGOutOpBinary outop_clz = {
     .out_rri = tgen_clzi,
 };
 
+static void tgen_ctz(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_dat_reg(s, COND_AL, INSN_RBIT, TCG_REG_TMP, 0, a1, 0);
+    tgen_clz(s, TCG_TYPE_I32, a0, TCG_REG_TMP, a2);
+}
+
+static void tgen_ctzi(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    tcg_out_dat_reg(s, COND_AL, INSN_RBIT, TCG_REG_TMP, 0, a1, 0);
+    tgen_clzi(s, TCG_TYPE_I32, a0, TCG_REG_TMP, a2);
+}
+
+static TCGConstraintSetIndex cset_ctz(TCGType type, unsigned flags)
+{
+    return use_armv7_instructions ? C_O1_I2(r, r, rIK) : C_NotImplemented;
+}
+
+static const TCGOutOpBinary outop_ctz = {
+    .base.static_constraint = C_Dynamic,
+    .base.dynamic_constraint = cset_ctz,
+    .out_rrr = tgen_ctz,
+    .out_rri = tgen_ctzi,
+};
+
 static TCGConstraintSetIndex cset_idiv(TCGType type, unsigned flags)
 {
     return use_idiv_instructions ? C_O1_I2(r, r, r) : C_NotImplemented;
@@ -2220,15 +2246,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_smull32(s, COND_AL, args[0], args[1], args[2], args[3]);
         break;
 
-    case INDEX_op_ctz_i32:
-        tcg_out_dat_reg(s, COND_AL, INSN_RBIT, TCG_REG_TMP, 0, args[1], 0);
-        if (const_args[2]) {
-            tgen_clzi(s, TCG_TYPE_I32, args[0], TCG_REG_TMP, args[2]);
-        } else {
-            tgen_clz(s, TCG_TYPE_I32, args[0], TCG_REG_TMP, args[2]);
-        }
-        break;
-
     case INDEX_op_brcond_i32:
         c = tcg_out_cmp(s, args[2], args[0], args[1], const_args[1]);
         tcg_out_goto_label(s, tcg_cond_to_arm_cond[c], arg_label(args[3]));
@@ -2351,10 +2368,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_negsetcond_i32:
         return C_O1_I2(r, r, rIN);
 
-    case INDEX_op_clz_i32:
-    case INDEX_op_ctz_i32:
-        return C_O1_I2(r, r, rIK);
-
     case INDEX_op_mulu2_i32:
     case INDEX_op_muls2_i32:
         return C_O2_I2(r, r, r, r);
diff --git a/tcg/i386/tcg-target-has.h b/tcg/i386/tcg-target-has.h
index 2277872ff3..b8a0a5c619 100644
--- a/tcg/i386/tcg-target-has.h
+++ b/tcg/i386/tcg-target-has.h
@@ -28,7 +28,6 @@
 /* optional instructions */
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
-#define TCG_TARGET_HAS_ctz_i32          1
 #define TCG_TARGET_HAS_ctpop_i32        have_popcnt
 #define TCG_TARGET_HAS_extract2_i32     1
 #define TCG_TARGET_HAS_negsetcond_i32   1
@@ -43,7 +42,6 @@
 #define TCG_TARGET_HAS_bswap16_i64      1
 #define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1
-#define TCG_TARGET_HAS_ctz_i64          1
 #define TCG_TARGET_HAS_ctpop_i64        have_popcnt
 #define TCG_TARGET_HAS_extract2_i64     1
 #define TCG_TARGET_HAS_negsetcond_i64   1
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index 0edd4cbc07..f7d0b93af0 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -1851,24 +1851,6 @@ static void tcg_out_movcond(TCGContext *s, int rexw, TCGCond cond,
     tcg_out_cmov(s, jcc, rexw, dest, v1);
 }
 
-static void tcg_out_ctz(TCGContext *s, int rexw, TCGReg dest, TCGReg arg1,
-                        TCGArg arg2, bool const_a2)
-{
-    if (have_bmi1) {
-        tcg_out_modrm(s, OPC_TZCNT + rexw, dest, arg1);
-        if (const_a2) {
-            tcg_debug_assert(arg2 == (rexw ? 64 : 32));
-        } else {
-            tcg_debug_assert(dest != arg2);
-            tcg_out_cmov(s, JCC_JB, rexw, dest, arg2);
-        }
-    } else {
-        tcg_debug_assert(dest != arg2);
-        tcg_out_modrm(s, OPC_BSF + rexw, dest, arg1);
-        tcg_out_cmov(s, JCC_JE, rexw, dest, arg2);
-    }
-}
-
 static void tcg_out_branch(TCGContext *s, int call, const tcg_insn_unit *dest)
 {
     intptr_t disp = tcg_pcrel_diff(s, dest) - 5;
@@ -2646,6 +2628,41 @@ static const TCGOutOpBinary outop_clz = {
     .out_rri = tgen_clzi,
 };
 
+static void tgen_ctz(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    int rexw = type == TCG_TYPE_I32 ? 0 : P_REXW;
+    int jcc;
+
+    if (have_bmi1) {
+        tcg_out_modrm(s, OPC_TZCNT + rexw, a0, a1);
+        jcc = JCC_JB;
+    } else {
+        tcg_out_modrm(s, OPC_BSF + rexw, a0, a1);
+        jcc = JCC_JE;
+    }
+    tcg_out_cmov(s, jcc, rexw, a0, a2);
+}
+
+static void tgen_ctzi(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    int rexw = type == TCG_TYPE_I32 ? 0 : P_REXW;
+    tcg_out_modrm(s, OPC_TZCNT + rexw, a0, a1);
+}
+
+static TCGConstraintSetIndex cset_ctz(TCGType type, unsigned flags)
+{
+    return have_bmi1 ? C_N1_I2(r, r, rW) : C_N1_I2(r, r, r);
+}
+
+static const TCGOutOpBinary outop_ctz = {
+    .base.static_constraint = C_Dynamic,
+    .base.dynamic_constraint = cset_ctz,
+    .out_rrr = tgen_ctz,
+    .out_rri = tgen_ctzi,
+};
+
 static const TCGOutOpBinary outop_divs = {
     .base.static_constraint = C_NotImplemented,
 };
@@ -3029,9 +3046,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    OP_32_64(ctz):
-        tcg_out_ctz(s, rexw, args[0], args[1], args[2], const_args[2]);
-        break;
     OP_32_64(ctpop):
         tcg_out_modrm(s, OPC_POPCNT + rexw, a0, a1);
         break;
@@ -3913,10 +3927,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_sub2_i64:
         return C_N1_O1_I4(r, r, 0, 1, re, re);
 
-    case INDEX_op_ctz_i32:
-    case INDEX_op_ctz_i64:
-        return have_bmi1 ? C_N1_I2(r, r, rW) : C_N1_I2(r, r, r);
-
     case INDEX_op_qemu_ld_i32:
         return C_O1_I1(r, L);
 
diff --git a/tcg/loongarch64/tcg-target-has.h b/tcg/loongarch64/tcg-target-has.h
index 2eba2132b8..f87d05efc6 100644
--- a/tcg/loongarch64/tcg-target-has.h
+++ b/tcg/loongarch64/tcg-target-has.h
@@ -18,7 +18,6 @@
 #define TCG_TARGET_HAS_muls2_i32        0
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
-#define TCG_TARGET_HAS_ctz_i32          1
 #define TCG_TARGET_HAS_ctpop_i32        0
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
@@ -29,7 +28,6 @@
 #define TCG_TARGET_HAS_bswap16_i64      1
 #define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1
-#define TCG_TARGET_HAS_ctz_i64          1
 #define TCG_TARGET_HAS_ctpop_i64        0
 #define TCG_TARGET_HAS_add2_i64         0
 #define TCG_TARGET_HAS_sub2_i64         0
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index 332ce6c86b..14f3ed1f5c 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -546,28 +546,6 @@ static void tcg_out_extrl_i64_i32(TCGContext *s, TCGReg ret, TCGReg arg)
     tcg_out_ext32s(s, ret, arg);
 }
 
-static void tcg_out_clzctz(TCGContext *s, LoongArchInsn opc,
-                           TCGReg a0, TCGReg a1, TCGReg a2,
-                           bool c2, bool is_32bit)
-{
-    if (c2) {
-        /*
-         * Fast path: semantics already satisfied due to constraint and
-         * insn behavior, single instruction is enough.
-         */
-        tcg_debug_assert(a2 == (is_32bit ? 32 : 64));
-        /* all clz/ctz insns belong to DJ-format */
-        tcg_out32(s, encode_dj_insn(opc, a0, a1));
-        return;
-    }
-
-    tcg_out32(s, encode_dj_insn(opc, TCG_REG_TMP0, a1));
-    /* a0 = a1 ? REG_TMP0 : a2 */
-    tcg_out_opc_maskeqz(s, TCG_REG_TMP0, TCG_REG_TMP0, a1);
-    tcg_out_opc_masknez(s, a0, a2, a1);
-    tcg_out_opc_or(s, a0, TCG_REG_TMP0, a0);
-}
-
 #define SETCOND_INV    TCG_TARGET_NB_REGS
 #define SETCOND_NEZ    (SETCOND_INV << 1)
 #define SETCOND_FLAGS  (SETCOND_INV | SETCOND_NEZ)
@@ -1355,6 +1333,33 @@ static const TCGOutOpBinary outop_clz = {
     .out_rri = tgen_clzi,
 };
 
+static void tgen_ctzi(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    /* a2 is constrained to exactly the type width. */
+    if (type == TCG_TYPE_I32) {
+        tcg_out_opc_ctz_w(s, a0, a1);
+    } else {
+        tcg_out_opc_ctz_d(s, a0, a1);
+    }
+}
+
+static void tgen_ctz(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tgen_ctzi(s, type, TCG_REG_TMP0, a1, /* ignored */ 0);
+    /* a0 = a1 ? REG_TMP0 : a2 */
+    tcg_out_opc_maskeqz(s, TCG_REG_TMP0, TCG_REG_TMP0, a1);
+    tcg_out_opc_masknez(s, a0, a2, a1);
+    tcg_out_opc_or(s, a0, a0, TCG_REG_TMP0);
+}
+
+static const TCGOutOpBinary outop_ctz = {
+    .base.static_constraint = C_O1_I2(r, r, rW),
+    .out_rrr = tgen_ctz,
+    .out_rri = tgen_ctzi,
+};
+
 static void tgen_divs(TCGContext *s, TCGType type,
                       TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -1781,13 +1786,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_opc_revb_d(s, a0, a1);
         break;
 
-    case INDEX_op_ctz_i32:
-        tcg_out_clzctz(s, OPC_CTZ_W, a0, a1, a2, c2, true);
-        break;
-    case INDEX_op_ctz_i64:
-        tcg_out_clzctz(s, OPC_CTZ_D, a0, a1, a2, c2, false);
-        break;
-
     case INDEX_op_setcond_i32:
     case INDEX_op_setcond_i64:
         tcg_out_setcond(s, args[3], a0, a1, a2, c2);
@@ -2418,10 +2416,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_qemu_ld_i64:
         return C_O1_I1(r, r);
 
-    case INDEX_op_ctz_i32:
-    case INDEX_op_ctz_i64:
-        return C_O1_I2(r, r, rW);
-
     case INDEX_op_deposit_i32:
     case INDEX_op_deposit_i64:
         /* Must deposit into the same register as input */
diff --git a/tcg/mips/tcg-target-has.h b/tcg/mips/tcg-target-has.h
index c27ca7e543..ca33c9b745 100644
--- a/tcg/mips/tcg-target-has.h
+++ b/tcg/mips/tcg-target-has.h
@@ -60,7 +60,6 @@ extern bool use_mips32r2_instructions;
 
 /* optional instructions detected at runtime */
 #define TCG_TARGET_HAS_extract2_i32     0
-#define TCG_TARGET_HAS_ctz_i32          0
 #define TCG_TARGET_HAS_ctpop_i32        0
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
@@ -69,7 +68,6 @@ extern bool use_mips32r2_instructions;
 #define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1
 #define TCG_TARGET_HAS_extract2_i64     0
-#define TCG_TARGET_HAS_ctz_i64          0
 #define TCG_TARGET_HAS_ctpop_i64        0
 #endif
 
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index 5052d6481c..e8720b63ed 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -1734,6 +1734,10 @@ static const TCGOutOpBinary outop_clz = {
     .out_rri = tgen_clzi,
 };
 
+static const TCGOutOpBinary outop_ctz = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static void tgen_divs(TCGContext *s, TCGType type,
                       TCGReg a0, TCGReg a1, TCGReg a2)
 {
diff --git a/tcg/ppc/tcg-target-has.h b/tcg/ppc/tcg-target-has.h
index cd7346011b..2b381b99a2 100644
--- a/tcg/ppc/tcg-target-has.h
+++ b/tcg/ppc/tcg-target-has.h
@@ -19,7 +19,6 @@
 /* optional instructions */
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
-#define TCG_TARGET_HAS_ctz_i32          have_isa_3_00
 #define TCG_TARGET_HAS_ctpop_i32        have_isa_2_06
 #define TCG_TARGET_HAS_extract2_i32     0
 #define TCG_TARGET_HAS_negsetcond_i32   1
@@ -34,7 +33,6 @@
 #define TCG_TARGET_HAS_bswap16_i64      1
 #define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1
-#define TCG_TARGET_HAS_ctz_i64          have_isa_3_00
 #define TCG_TARGET_HAS_ctpop_i64        have_isa_2_06
 #define TCG_TARGET_HAS_extract2_i64     0
 #define TCG_TARGET_HAS_negsetcond_i64   1
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index 518cf1e9ef..2cdabcf610 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -2974,6 +2974,32 @@ static const TCGOutOpBinary outop_clz = {
     .out_rri = tgen_clzi,
 };
 
+static void tgen_ctz(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    uint32_t insn = type == TCG_TYPE_I32 ? CNTTZW : CNTTZD;
+    tcg_out_cntxz(s, type, insn, a0, a1, a2, false);
+}
+
+static void tgen_ctzi(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    uint32_t insn = type == TCG_TYPE_I32 ? CNTTZW : CNTTZD;
+    tcg_out_cntxz(s, type, insn, a0, a1, a2, true);
+}
+
+static TCGConstraintSetIndex cset_ctz(TCGType type, unsigned flags)
+{
+    return have_isa_3_00 ? C_O1_I2(r, r, rZW) : C_NotImplemented;
+}
+
+static const TCGOutOpBinary outop_ctz = {
+    .base.static_constraint = C_Dynamic,
+    .base.dynamic_constraint = cset_ctz,
+    .out_rrr = tgen_ctz,
+    .out_rri = tgen_ctzi,
+};
+
 static void tgen_eqv(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -3370,18 +3396,9 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_mem_long(s, STD, STDX, args[0], args[1], args[2]);
         break;
 
-    case INDEX_op_ctz_i32:
-        tcg_out_cntxz(s, TCG_TYPE_I32, CNTTZW, args[0], args[1],
-                      args[2], const_args[2]);
-        break;
     case INDEX_op_ctpop_i32:
         tcg_out32(s, CNTPOPW | SAB(args[1], args[0], 0));
         break;
-
-    case INDEX_op_ctz_i64:
-        tcg_out_cntxz(s, TCG_TYPE_I64, CNTTZD, args[0], args[1],
-                      args[2], const_args[2]);
-        break;
     case INDEX_op_ctpop_i64:
         tcg_out32(s, CNTPOPD | SAB(args[1], args[0], 0));
         break;
@@ -4240,10 +4257,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(r, r);
 
-    case INDEX_op_ctz_i32:
-    case INDEX_op_ctz_i64:
-        return C_O1_I2(r, r, rZW);
-
     case INDEX_op_brcond_i32:
     case INDEX_op_brcond_i64:
         return C_O0_I2(r, rC);
diff --git a/tcg/riscv/tcg-target-has.h b/tcg/riscv/tcg-target-has.h
index 41e287130d..385a6736c0 100644
--- a/tcg/riscv/tcg-target-has.h
+++ b/tcg/riscv/tcg-target-has.h
@@ -18,7 +18,6 @@
 #define TCG_TARGET_HAS_muls2_i32        0
 #define TCG_TARGET_HAS_bswap16_i32      (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_bswap32_i32      (cpuinfo & CPUINFO_ZBB)
-#define TCG_TARGET_HAS_ctz_i32          (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_ctpop_i32        (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
@@ -28,7 +27,6 @@
 #define TCG_TARGET_HAS_bswap16_i64      (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_bswap32_i64      (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_bswap64_i64      (cpuinfo & CPUINFO_ZBB)
-#define TCG_TARGET_HAS_ctz_i64          (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_ctpop_i64        (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_add2_i64         1
 #define TCG_TARGET_HAS_sub2_i64         1
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index 77eef02db5..1ceb1aeb1c 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -2023,6 +2023,27 @@ static const TCGOutOpBinary outop_clz = {
     .out_rri = tgen_clzi,
 };
 
+static void tgen_ctz(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    RISCVInsn insn = type == TCG_TYPE_I32 ? OPC_CTZW : OPC_CTZ;
+    tcg_out_cltz(s, type, insn, a0, a1, a2, false);
+}
+
+static void tgen_ctzi(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    RISCVInsn insn = type == TCG_TYPE_I32 ? OPC_CTZW : OPC_CTZ;
+    tcg_out_cltz(s, type, insn, a0, a1, a2, true);
+}
+
+static const TCGOutOpBinary outop_ctz = {
+    .base.static_constraint = C_Dynamic,
+    .base.dynamic_constraint = cset_clzctz,
+    .out_rrr = tgen_ctz,
+    .out_rri = tgen_ctzi,
+};
+
 static void tgen_divs(TCGContext *s, TCGType type,
                       TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -2424,13 +2445,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_opc_imm(s, OPC_CPOP, a0, a1, 0);
         break;
 
-    case INDEX_op_ctz_i32:
-        tcg_out_cltz(s, TCG_TYPE_I32, OPC_CTZW, a0, a1, a2, c2);
-        break;
-    case INDEX_op_ctz_i64:
-        tcg_out_cltz(s, TCG_TYPE_I64, OPC_CTZ, a0, a1, a2, c2);
-        break;
-
     case INDEX_op_add2_i32:
         tcg_out_addsub2(s, a0, a1, a2, args[3], args[4], args[5],
                         const_args[4], const_args[5], false, true);
@@ -2813,10 +2827,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_negsetcond_i64:
         return C_O1_I2(r, r, rI);
 
-    case INDEX_op_ctz_i32:
-    case INDEX_op_ctz_i64:
-        return C_N1_I2(r, r, rM);
-
     case INDEX_op_brcond_i32:
     case INDEX_op_brcond_i64:
         return C_O0_I2(rz, rz);
diff --git a/tcg/s390x/tcg-target-has.h b/tcg/s390x/tcg-target-has.h
index 85a4f23e95..0794394fea 100644
--- a/tcg/s390x/tcg-target-has.h
+++ b/tcg/s390x/tcg-target-has.h
@@ -31,7 +31,6 @@ extern uint64_t s390_facilities[3];
 /* optional instructions */
 #define TCG_TARGET_HAS_bswap16_i32    1
 #define TCG_TARGET_HAS_bswap32_i32    1
-#define TCG_TARGET_HAS_ctz_i32        0
 #define TCG_TARGET_HAS_ctpop_i32      1
 #define TCG_TARGET_HAS_extract2_i32   0
 #define TCG_TARGET_HAS_negsetcond_i32 1
@@ -45,7 +44,6 @@ extern uint64_t s390_facilities[3];
 #define TCG_TARGET_HAS_bswap16_i64    1
 #define TCG_TARGET_HAS_bswap32_i64    1
 #define TCG_TARGET_HAS_bswap64_i64    1
-#define TCG_TARGET_HAS_ctz_i64        0
 #define TCG_TARGET_HAS_ctpop_i64      1
 #define TCG_TARGET_HAS_extract2_i64   0
 #define TCG_TARGET_HAS_negsetcond_i64 1
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index adfe403bef..374136ed14 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -2268,6 +2268,10 @@ static const TCGOutOpBinary outop_clz = {
     .out_rri = tgen_clzi,
 };
 
+static const TCGOutOpBinary outop_ctz = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static const TCGOutOpBinary outop_divs = {
     .base.static_constraint = C_NotImplemented,
 };
diff --git a/tcg/sparc64/tcg-target-has.h b/tcg/sparc64/tcg-target-has.h
index 21fa0f3663..56262640ff 100644
--- a/tcg/sparc64/tcg-target-has.h
+++ b/tcg/sparc64/tcg-target-has.h
@@ -16,7 +16,6 @@ extern bool use_vis3_instructions;
 /* optional instructions */
 #define TCG_TARGET_HAS_bswap16_i32      0
 #define TCG_TARGET_HAS_bswap32_i32      0
-#define TCG_TARGET_HAS_ctz_i32          0
 #define TCG_TARGET_HAS_ctpop_i32        0
 #define TCG_TARGET_HAS_extract2_i32     0
 #define TCG_TARGET_HAS_negsetcond_i32   1
@@ -30,7 +29,6 @@ extern bool use_vis3_instructions;
 #define TCG_TARGET_HAS_bswap16_i64      0
 #define TCG_TARGET_HAS_bswap32_i64      0
 #define TCG_TARGET_HAS_bswap64_i64      0
-#define TCG_TARGET_HAS_ctz_i64          0
 #define TCG_TARGET_HAS_ctpop_i64        0
 #define TCG_TARGET_HAS_extract2_i64     0
 #define TCG_TARGET_HAS_negsetcond_i64   1
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index a4fb41764b..a9257b8b93 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -1322,6 +1322,10 @@ static const TCGOutOpBinary outop_clz = {
     .base.static_constraint = C_NotImplemented,
 };
 
+static const TCGOutOpBinary outop_ctz = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static void tgen_divs_rJ(TCGContext *s, TCGType type,
                          TCGReg a0, TCGReg a1, TCGArg a2, bool c2)
 {
diff --git a/tcg/tcg-has.h b/tcg/tcg-has.h
index 27d6ec7636..6bba845944 100644
--- a/tcg/tcg-has.h
+++ b/tcg/tcg-has.h
@@ -15,7 +15,6 @@
 #define TCG_TARGET_HAS_bswap16_i64      0
 #define TCG_TARGET_HAS_bswap32_i64      0
 #define TCG_TARGET_HAS_bswap64_i64      0
-#define TCG_TARGET_HAS_ctz_i64          0
 #define TCG_TARGET_HAS_ctpop_i64        0
 #define TCG_TARGET_HAS_extract2_i64     0
 #define TCG_TARGET_HAS_negsetcond_i64   0
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index 76e9efc655..b117a59f05 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -750,11 +750,11 @@ void tcg_gen_ctz_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 {
     TCGv_i32 z, t;
 
-    if (TCG_TARGET_HAS_ctz_i32) {
+    if (tcg_op_supported(INDEX_op_ctz_i32, TCG_TYPE_I32, 0)) {
         tcg_gen_op3_i32(INDEX_op_ctz_i32, ret, arg1, arg2);
         return;
     }
-    if (TCG_TARGET_HAS_ctz_i64) {
+    if (tcg_op_supported(INDEX_op_ctz_i64, TCG_TYPE_I64, 0)) {
         TCGv_i64 t1 = tcg_temp_ebb_new_i64();
         TCGv_i64 t2 = tcg_temp_ebb_new_i64();
         tcg_gen_extu_i32_i64(t1, arg1);
@@ -788,7 +788,8 @@ void tcg_gen_ctz_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 
 void tcg_gen_ctzi_i32(TCGv_i32 ret, TCGv_i32 arg1, uint32_t arg2)
 {
-    if (!TCG_TARGET_HAS_ctz_i32 && TCG_TARGET_HAS_ctpop_i32 && arg2 == 32) {
+    if (!tcg_op_supported(INDEX_op_ctz_i32, TCG_TYPE_I32, 0)
+        && TCG_TARGET_HAS_ctpop_i32 && arg2 == 32) {
         /* This equivalence has the advantage of not requiring a fixup.  */
         TCGv_i32 t = tcg_temp_ebb_new_i32();
         tcg_gen_subi_i32(t, arg1, 1);
@@ -2365,7 +2366,7 @@ void tcg_gen_ctz_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
 {
     TCGv_i64 z, t;
 
-    if (TCG_TARGET_HAS_ctz_i64) {
+    if (tcg_op_supported(INDEX_op_ctz_i64, TCG_TYPE_I64, 0)) {
         tcg_gen_op3_i64(INDEX_op_ctz_i64, ret, arg1, arg2);
         return;
     }
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 71b0721fb5..3f610e3f83 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1027,6 +1027,8 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_and, TCGOutOpBinary, outop_and),
     OUTOP(INDEX_op_andc, TCGOutOpBinary, outop_andc),
     OUTOP(INDEX_op_clz, TCGOutOpBinary, outop_clz),
+    OUTOP(INDEX_op_ctz_i32, TCGOutOpBinary, outop_ctz),
+    OUTOP(INDEX_op_ctz_i64, TCGOutOpBinary, outop_ctz),
     OUTOP(INDEX_op_divs, TCGOutOpBinary, outop_divs),
     OUTOP(INDEX_op_divu, TCGOutOpBinary, outop_divu),
     OUTOP(INDEX_op_divs2, TCGOutOpDivRem, outop_divs2),
@@ -2289,8 +2291,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
         return TCG_TARGET_HAS_bswap16_i32;
     case INDEX_op_bswap32_i32:
         return TCG_TARGET_HAS_bswap32_i32;
-    case INDEX_op_ctz_i32:
-        return TCG_TARGET_HAS_ctz_i32;
     case INDEX_op_ctpop_i32:
         return TCG_TARGET_HAS_ctpop_i32;
 
@@ -2332,8 +2332,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
         return TCG_TARGET_HAS_bswap32_i64;
     case INDEX_op_bswap64_i64:
         return TCG_TARGET_HAS_bswap64_i64;
-    case INDEX_op_ctz_i64:
-        return TCG_TARGET_HAS_ctz_i64;
     case INDEX_op_ctpop_i64:
         return TCG_TARGET_HAS_ctpop_i64;
     case INDEX_op_add2_i64:
@@ -5402,6 +5400,8 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
     case INDEX_op_and:
     case INDEX_op_andc:
     case INDEX_op_clz:
+    case INDEX_op_ctz_i32:
+    case INDEX_op_ctz_i64:
     case INDEX_op_divs:
     case INDEX_op_divu:
     case INDEX_op_eqv:
diff --git a/tcg/tci.c b/tcg/tci.c
index 7c2f2a524b..b505944b10 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -599,13 +599,11 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tmp32 = regs[r1];
             regs[r0] = tmp32 ? clz32(tmp32) : regs[r2];
             break;
-#if TCG_TARGET_HAS_ctz_i32
-        case INDEX_op_ctz_i32:
+        case INDEX_op_tci_ctz32:
             tci_args_rrr(insn, &r0, &r1, &r2);
             tmp32 = regs[r1];
             regs[r0] = tmp32 ? ctz32(tmp32) : regs[r2];
             break;
-#endif
 #if TCG_TARGET_HAS_ctpop_i32
         case INDEX_op_ctpop_i32:
             tci_args_rr(insn, &r0, &r1);
@@ -737,12 +735,10 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = regs[r1] ? clz64(regs[r1]) : regs[r2];
             break;
-#if TCG_TARGET_HAS_ctz_i64
         case INDEX_op_ctz_i64:
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = regs[r1] ? ctz64(regs[r1]) : regs[r2];
             break;
-#endif
 #if TCG_TARGET_HAS_ctpop_i64
         case INDEX_op_ctpop_i64:
             tci_args_rr(insn, &r0, &r1);
@@ -1070,8 +1066,8 @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
     case INDEX_op_shr:
     case INDEX_op_sub:
     case INDEX_op_xor:
-    case INDEX_op_ctz_i32:
     case INDEX_op_ctz_i64:
+    case INDEX_op_tci_ctz32:
     case INDEX_op_tci_clz32:
     case INDEX_op_tci_divs32:
     case INDEX_op_tci_divu32:
diff --git a/tcg/tci/tcg-target-has.h b/tcg/tci/tcg-target-has.h
index ae1f724702..daa6db4799 100644
--- a/tcg/tci/tcg-target-has.h
+++ b/tcg/tci/tcg-target-has.h
@@ -10,7 +10,6 @@
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
 #define TCG_TARGET_HAS_extract2_i32     0
-#define TCG_TARGET_HAS_ctz_i32          1
 #define TCG_TARGET_HAS_ctpop_i32        1
 #define TCG_TARGET_HAS_negsetcond_i32   0
 #define TCG_TARGET_HAS_muls2_i32        1
@@ -22,7 +21,6 @@
 #define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1
 #define TCG_TARGET_HAS_extract2_i64     0
-#define TCG_TARGET_HAS_ctz_i64          1
 #define TCG_TARGET_HAS_ctpop_i64        1
 #define TCG_TARGET_HAS_negsetcond_i64   0
 #define TCG_TARGET_HAS_muls2_i64        1
diff --git a/tcg/tci/tcg-target-opc.h.inc b/tcg/tci/tcg-target-opc.h.inc
index 04774ca9c4..2bb346f4c8 100644
--- a/tcg/tci/tcg-target-opc.h.inc
+++ b/tcg/tci/tcg-target-opc.h.inc
@@ -3,6 +3,7 @@
 DEF(tci_movi, 1, 0, 1, TCG_OPF_NOT_PRESENT)
 DEF(tci_movl, 1, 0, 1, TCG_OPF_NOT_PRESENT)
 DEF(tci_clz32, 1, 2, 0, TCG_OPF_NOT_PRESENT)
+DEF(tci_ctz32, 1, 2, 0, TCG_OPF_NOT_PRESENT)
 DEF(tci_divs32, 1, 2, 0, TCG_OPF_NOT_PRESENT)
 DEF(tci_divu32, 1, 2, 0, TCG_OPF_NOT_PRESENT)
 DEF(tci_rems32, 1, 2, 0, TCG_OPF_NOT_PRESENT)
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index 0fd1f5510a..47bdec5f44 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -83,8 +83,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_setcond_i64:
     case INDEX_op_deposit_i32:
     case INDEX_op_deposit_i64:
-    case INDEX_op_ctz_i32:
-    case INDEX_op_ctz_i64:
         return C_O1_I2(r, r, r);
 
     case INDEX_op_brcond_i32:
@@ -642,6 +640,20 @@ static const TCGOutOpBinary outop_clz = {
     .out_rrr = tgen_clz,
 };
 
+static void tgen_ctz(TCGContext *s, TCGType type,
+                      TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    TCGOpcode opc = (type == TCG_TYPE_I32
+                     ? INDEX_op_tci_ctz32
+                     : INDEX_op_ctz_i64);
+    tcg_out_op_rrr(s, opc, a0, a1, a2);
+}
+
+static const TCGOutOpBinary outop_ctz = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_ctz,
+};
+
 static void tgen_divs(TCGContext *s, TCGType type,
                       TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -933,10 +945,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_ldst(s, opc, args[0], args[1], args[2]);
         break;
 
-    CASE_32_64(ctz)      /* Optional (TCG_TARGET_HAS_ctz_*). */
-        tcg_out_op_rrr(s, opc, args[0], args[1], args[2]);
-        break;
-
     CASE_32_64(deposit)
         tcg_out_op_rrrbb(s, opc, args[0], args[1], args[2], args[3], args[4]);
         break;

From c96447d838d67db509cde1a190132e14b8672055 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Jan 2025 17:07:01 -0800
Subject: [PATCH 0424/2760] tcg: Merge INDEX_op_ctz_{i32,i64}
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 docs/devel/tcg-ops.rst   |  2 +-
 include/tcg/tcg-opc.h    |  3 +--
 tcg/optimize.c           | 10 +++++-----
 tcg/tcg-op.c             | 16 ++++++++--------
 tcg/tcg.c                |  6 ++----
 tcg/tci.c                |  4 ++--
 tcg/tci/tcg-target.c.inc |  2 +-
 7 files changed, 20 insertions(+), 23 deletions(-)

diff --git a/docs/devel/tcg-ops.rst b/docs/devel/tcg-ops.rst
index 22f0432988..92344b8786 100644
--- a/docs/devel/tcg-ops.rst
+++ b/docs/devel/tcg-ops.rst
@@ -362,7 +362,7 @@ Logical
 
      - | *t0* = *t1* ? clz(*t1*) : *t2*
 
-   * - ctz_i32/i64 *t0*, *t1*, *t2*
+   * - ctz *t0*, *t1*, *t2*
 
      - | *t0* = *t1* ? ctz(*t1*) : *t2*
 
diff --git a/include/tcg/tcg-opc.h b/include/tcg/tcg-opc.h
index ad1d193ef4..4dfd8708a5 100644
--- a/include/tcg/tcg-opc.h
+++ b/include/tcg/tcg-opc.h
@@ -43,6 +43,7 @@ DEF(add, 1, 2, 0, TCG_OPF_INT)
 DEF(and, 1, 2, 0, TCG_OPF_INT)
 DEF(andc, 1, 2, 0, TCG_OPF_INT)
 DEF(clz, 1, 2, 0, TCG_OPF_INT)
+DEF(ctz, 1, 2, 0, TCG_OPF_INT)
 DEF(divs, 1, 2, 0, TCG_OPF_INT)
 DEF(divs2, 2, 3, 0, TCG_OPF_INT)
 DEF(divu, 1, 2, 0, TCG_OPF_INT)
@@ -96,7 +97,6 @@ DEF(setcond2_i32, 1, 4, 1, 0)
 
 DEF(bswap16_i32, 1, 1, 1, 0)
 DEF(bswap32_i32, 1, 1, 1, 0)
-DEF(ctz_i32, 1, 2, 0, 0)
 DEF(ctpop_i32, 1, 1, 0, 0)
 
 DEF(setcond_i64, 1, 2, 1, 0)
@@ -130,7 +130,6 @@ DEF(brcond_i64, 0, 2, 2, TCG_OPF_BB_END | TCG_OPF_COND_BRANCH)
 DEF(bswap16_i64, 1, 1, 1, 0)
 DEF(bswap32_i64, 1, 1, 1, 0)
 DEF(bswap64_i64, 1, 1, 1, 0)
-DEF(ctz_i64, 1, 2, 0, 0)
 DEF(ctpop_i64, 1, 1, 0, 0)
 
 DEF(add2_i64, 2, 4, 0, 0)
diff --git a/tcg/optimize.c b/tcg/optimize.c
index d8d0e728aa..af4e76e81b 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -509,10 +509,10 @@ static uint64_t do_constant_folding_2(TCGOpcode op, TCGType type,
         }
         return x ? clz64(x) : y;
 
-    case INDEX_op_ctz_i32:
-        return (uint32_t)x ? ctz32(x) : y;
-
-    case INDEX_op_ctz_i64:
+    case INDEX_op_ctz:
+        if (type == TCG_TYPE_I32) {
+            return (uint32_t)x ? ctz32(x) : y;
+        }
         return x ? ctz64(x) : y;
 
     case INDEX_op_ctpop_i32:
@@ -2899,7 +2899,7 @@ void tcg_optimize(TCGContext *s)
             done = fold_bswap(&ctx, op);
             break;
         case INDEX_op_clz:
-        CASE_OP_32_64(ctz):
+        case INDEX_op_ctz:
             done = fold_count_zeros(&ctx, op);
             break;
         CASE_OP_32_64(ctpop):
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index b117a59f05..7bf7de1213 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -750,11 +750,11 @@ void tcg_gen_ctz_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 {
     TCGv_i32 z, t;
 
-    if (tcg_op_supported(INDEX_op_ctz_i32, TCG_TYPE_I32, 0)) {
-        tcg_gen_op3_i32(INDEX_op_ctz_i32, ret, arg1, arg2);
+    if (tcg_op_supported(INDEX_op_ctz, TCG_TYPE_I32, 0)) {
+        tcg_gen_op3_i32(INDEX_op_ctz, ret, arg1, arg2);
         return;
     }
-    if (tcg_op_supported(INDEX_op_ctz_i64, TCG_TYPE_I64, 0)) {
+    if (tcg_op_supported(INDEX_op_ctz, TCG_TYPE_I64, 0)) {
         TCGv_i64 t1 = tcg_temp_ebb_new_i64();
         TCGv_i64 t2 = tcg_temp_ebb_new_i64();
         tcg_gen_extu_i32_i64(t1, arg1);
@@ -788,7 +788,7 @@ void tcg_gen_ctz_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 
 void tcg_gen_ctzi_i32(TCGv_i32 ret, TCGv_i32 arg1, uint32_t arg2)
 {
-    if (!tcg_op_supported(INDEX_op_ctz_i32, TCG_TYPE_I32, 0)
+    if (!tcg_op_supported(INDEX_op_ctz, TCG_TYPE_I32, 0)
         && TCG_TARGET_HAS_ctpop_i32 && arg2 == 32) {
         /* This equivalence has the advantage of not requiring a fixup.  */
         TCGv_i32 t = tcg_temp_ebb_new_i32();
@@ -2366,8 +2366,8 @@ void tcg_gen_ctz_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
 {
     TCGv_i64 z, t;
 
-    if (tcg_op_supported(INDEX_op_ctz_i64, TCG_TYPE_I64, 0)) {
-        tcg_gen_op3_i64(INDEX_op_ctz_i64, ret, arg1, arg2);
+    if (tcg_op_supported(INDEX_op_ctz, TCG_TYPE_I64, 0)) {
+        tcg_gen_op3_i64(INDEX_op_ctz, ret, arg1, arg2);
         return;
     }
     if (TCG_TARGET_HAS_ctpop_i64) {
@@ -2395,7 +2395,7 @@ void tcg_gen_ctzi_i64(TCGv_i64 ret, TCGv_i64 arg1, uint64_t arg2)
 {
     if (TCG_TARGET_REG_BITS == 32
         && arg2 <= 0xffffffffu
-        && tcg_op_supported(INDEX_op_ctz_i32, TCG_TYPE_I32, 0)) {
+        && tcg_op_supported(INDEX_op_ctz, TCG_TYPE_I32, 0)) {
         TCGv_i32 t32 = tcg_temp_ebb_new_i32();
         tcg_gen_ctzi_i32(t32, TCGV_HIGH(arg1), arg2 - 32);
         tcg_gen_addi_i32(t32, t32, 32);
@@ -2403,7 +2403,7 @@ void tcg_gen_ctzi_i64(TCGv_i64 ret, TCGv_i64 arg1, uint64_t arg2)
         tcg_gen_movi_i32(TCGV_HIGH(ret), 0);
         tcg_temp_free_i32(t32);
     } else if (arg2 == 64
-               && !tcg_op_supported(INDEX_op_ctz_i64, TCG_TYPE_I64, 0)
+               && !tcg_op_supported(INDEX_op_ctz, TCG_TYPE_I64, 0)
                && TCG_TARGET_HAS_ctpop_i64) {
         /* This equivalence has the advantage of not requiring a fixup.  */
         TCGv_i64 t = tcg_temp_ebb_new_i64();
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 3f610e3f83..18b28a670e 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1027,8 +1027,7 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_and, TCGOutOpBinary, outop_and),
     OUTOP(INDEX_op_andc, TCGOutOpBinary, outop_andc),
     OUTOP(INDEX_op_clz, TCGOutOpBinary, outop_clz),
-    OUTOP(INDEX_op_ctz_i32, TCGOutOpBinary, outop_ctz),
-    OUTOP(INDEX_op_ctz_i64, TCGOutOpBinary, outop_ctz),
+    OUTOP(INDEX_op_ctz, TCGOutOpBinary, outop_ctz),
     OUTOP(INDEX_op_divs, TCGOutOpBinary, outop_divs),
     OUTOP(INDEX_op_divu, TCGOutOpBinary, outop_divu),
     OUTOP(INDEX_op_divs2, TCGOutOpDivRem, outop_divs2),
@@ -5400,8 +5399,7 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
     case INDEX_op_and:
     case INDEX_op_andc:
     case INDEX_op_clz:
-    case INDEX_op_ctz_i32:
-    case INDEX_op_ctz_i64:
+    case INDEX_op_ctz:
     case INDEX_op_divs:
     case INDEX_op_divu:
     case INDEX_op_eqv:
diff --git a/tcg/tci.c b/tcg/tci.c
index b505944b10..550f2014a8 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -735,7 +735,7 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = regs[r1] ? clz64(regs[r1]) : regs[r2];
             break;
-        case INDEX_op_ctz_i64:
+        case INDEX_op_ctz:
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = regs[r1] ? ctz64(regs[r1]) : regs[r2];
             break;
@@ -1049,6 +1049,7 @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
     case INDEX_op_and:
     case INDEX_op_andc:
     case INDEX_op_clz:
+    case INDEX_op_ctz:
     case INDEX_op_divs:
     case INDEX_op_divu:
     case INDEX_op_eqv:
@@ -1066,7 +1067,6 @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
     case INDEX_op_shr:
     case INDEX_op_sub:
     case INDEX_op_xor:
-    case INDEX_op_ctz_i64:
     case INDEX_op_tci_ctz32:
     case INDEX_op_tci_clz32:
     case INDEX_op_tci_divs32:
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index 47bdec5f44..d8d45e2c4b 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -645,7 +645,7 @@ static void tgen_ctz(TCGContext *s, TCGType type,
 {
     TCGOpcode opc = (type == TCG_TYPE_I32
                      ? INDEX_op_tci_ctz32
-                     : INDEX_op_ctz_i64);
+                     : INDEX_op_ctz);
     tcg_out_op_rrr(s, opc, a0, a1, a2);
 }
 

From f8fa1dae3db5493617ff42e8ccfd797058df243e Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Jan 2025 17:56:01 -0800
Subject: [PATCH 0425/2760] tcg: Convert ctpop to TCGOutOpUnary

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target-has.h     |  2 -
 tcg/aarch64/tcg-target.c.inc     |  4 ++
 tcg/arm/tcg-target-has.h         |  1 -
 tcg/arm/tcg-target.c.inc         |  4 ++
 tcg/i386/tcg-target-has.h        |  2 -
 tcg/i386/tcg-target.c.inc        | 23 ++++++++---
 tcg/loongarch64/tcg-target-has.h |  2 -
 tcg/loongarch64/tcg-target.c.inc |  4 ++
 tcg/mips/tcg-target-has.h        |  2 -
 tcg/mips/tcg-target.c.inc        |  4 ++
 tcg/ppc/tcg-target-has.h         |  2 -
 tcg/ppc/tcg-target.c.inc         | 26 ++++++++-----
 tcg/riscv/tcg-target-has.h       |  2 -
 tcg/riscv/tcg-target.c.inc       | 26 ++++++++-----
 tcg/s390x/tcg-target-has.h       |  2 -
 tcg/s390x/tcg-target.c.inc       | 66 +++++++++++++++-----------------
 tcg/sparc64/tcg-target-has.h     |  2 -
 tcg/sparc64/tcg-target.c.inc     |  4 ++
 tcg/tcg-has.h                    |  1 -
 tcg/tcg-op.c                     | 37 ++++++++++--------
 tcg/tcg.c                        |  8 ++--
 tcg/tci.c                        | 19 ++++-----
 tcg/tci/tcg-target-has.h         |  2 -
 tcg/tci/tcg-target.c.inc         | 19 +++++++--
 24 files changed, 151 insertions(+), 113 deletions(-)

diff --git a/tcg/aarch64/tcg-target-has.h b/tcg/aarch64/tcg-target-has.h
index 478d59676e..4f1840f44e 100644
--- a/tcg/aarch64/tcg-target-has.h
+++ b/tcg/aarch64/tcg-target-has.h
@@ -15,7 +15,6 @@
 /* optional instructions */
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
-#define TCG_TARGET_HAS_ctpop_i32        0
 #define TCG_TARGET_HAS_extract2_i32     1
 #define TCG_TARGET_HAS_negsetcond_i32   1
 #define TCG_TARGET_HAS_add2_i32         1
@@ -28,7 +27,6 @@
 #define TCG_TARGET_HAS_bswap16_i64      1
 #define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1
-#define TCG_TARGET_HAS_ctpop_i64        0
 #define TCG_TARGET_HAS_extract2_i64     1
 #define TCG_TARGET_HAS_negsetcond_i64   1
 #define TCG_TARGET_HAS_add2_i64         1
diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index 8441c5f4bf..0f01fa8c20 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -2129,6 +2129,10 @@ static const TCGOutOpBinary outop_clz = {
     .out_rri = tgen_clzi,
 };
 
+static const TCGOutOpUnary outop_ctpop = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static void tgen_ctz(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
diff --git a/tcg/arm/tcg-target-has.h b/tcg/arm/tcg-target-has.h
index 1485a52c21..1cf3911613 100644
--- a/tcg/arm/tcg-target-has.h
+++ b/tcg/arm/tcg-target-has.h
@@ -26,7 +26,6 @@ extern bool use_neon_instructions;
 /* optional instructions */
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
-#define TCG_TARGET_HAS_ctpop_i32        0
 #define TCG_TARGET_HAS_extract2_i32     1
 #define TCG_TARGET_HAS_negsetcond_i32   1
 #define TCG_TARGET_HAS_mulu2_i32        1
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index c05f21c82c..e109c65965 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -1888,6 +1888,10 @@ static const TCGOutOpBinary outop_clz = {
     .out_rri = tgen_clzi,
 };
 
+static const TCGOutOpUnary outop_ctpop = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static void tgen_ctz(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
diff --git a/tcg/i386/tcg-target-has.h b/tcg/i386/tcg-target-has.h
index b8a0a5c619..a71f8c7370 100644
--- a/tcg/i386/tcg-target-has.h
+++ b/tcg/i386/tcg-target-has.h
@@ -28,7 +28,6 @@
 /* optional instructions */
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
-#define TCG_TARGET_HAS_ctpop_i32        have_popcnt
 #define TCG_TARGET_HAS_extract2_i32     1
 #define TCG_TARGET_HAS_negsetcond_i32   1
 #define TCG_TARGET_HAS_add2_i32         1
@@ -42,7 +41,6 @@
 #define TCG_TARGET_HAS_bswap16_i64      1
 #define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1
-#define TCG_TARGET_HAS_ctpop_i64        have_popcnt
 #define TCG_TARGET_HAS_extract2_i64     1
 #define TCG_TARGET_HAS_negsetcond_i64   1
 #define TCG_TARGET_HAS_add2_i64         1
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index f7d0b93af0..318a30ebe0 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -2628,6 +2628,23 @@ static const TCGOutOpBinary outop_clz = {
     .out_rri = tgen_clzi,
 };
 
+static void tgen_ctpop(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1)
+{
+    int rexw = type == TCG_TYPE_I32 ? 0 : P_REXW;
+    tcg_out_modrm(s, OPC_POPCNT + rexw, a0, a1);
+}
+
+static TCGConstraintSetIndex cset_ctpop(TCGType type, unsigned flags)
+{
+    return have_popcnt ? C_O1_I1(r, r) : C_NotImplemented;
+}
+
+static const TCGOutOpUnary outop_ctpop = {
+    .base.static_constraint = C_Dynamic,
+    .base.dynamic_constraint = cset_ctpop,
+    .out_rr = tgen_ctpop,
+};
+
 static void tgen_ctz(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -3046,10 +3063,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    OP_32_64(ctpop):
-        tcg_out_modrm(s, OPC_POPCNT + rexw, a0, a1);
-        break;
-
     OP_32_64(brcond):
         tcg_out_brcond(s, rexw, a2, a0, a1, const_args[1],
                        arg_label(args[3]), 0);
@@ -3893,8 +3906,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_extract_i64:
     case INDEX_op_sextract_i32:
     case INDEX_op_sextract_i64:
-    case INDEX_op_ctpop_i32:
-    case INDEX_op_ctpop_i64:
         return C_O1_I1(r, r);
 
     case INDEX_op_extract2_i32:
diff --git a/tcg/loongarch64/tcg-target-has.h b/tcg/loongarch64/tcg-target-has.h
index f87d05efc6..33a1cf2326 100644
--- a/tcg/loongarch64/tcg-target-has.h
+++ b/tcg/loongarch64/tcg-target-has.h
@@ -18,7 +18,6 @@
 #define TCG_TARGET_HAS_muls2_i32        0
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
-#define TCG_TARGET_HAS_ctpop_i32        0
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
 /* 64-bit operations */
@@ -28,7 +27,6 @@
 #define TCG_TARGET_HAS_bswap16_i64      1
 #define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1
-#define TCG_TARGET_HAS_ctpop_i64        0
 #define TCG_TARGET_HAS_add2_i64         0
 #define TCG_TARGET_HAS_sub2_i64         0
 #define TCG_TARGET_HAS_mulu2_i64        0
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index 14f3ed1f5c..4ef7c6b945 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -1333,6 +1333,10 @@ static const TCGOutOpBinary outop_clz = {
     .out_rri = tgen_clzi,
 };
 
+static const TCGOutOpUnary outop_ctpop = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static void tgen_ctzi(TCGContext *s, TCGType type,
                       TCGReg a0, TCGReg a1, tcg_target_long a2)
 {
diff --git a/tcg/mips/tcg-target-has.h b/tcg/mips/tcg-target-has.h
index ca33c9b745..470aa16452 100644
--- a/tcg/mips/tcg-target-has.h
+++ b/tcg/mips/tcg-target-has.h
@@ -60,7 +60,6 @@ extern bool use_mips32r2_instructions;
 
 /* optional instructions detected at runtime */
 #define TCG_TARGET_HAS_extract2_i32     0
-#define TCG_TARGET_HAS_ctpop_i32        0
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
 #if TCG_TARGET_REG_BITS == 64
@@ -68,7 +67,6 @@ extern bool use_mips32r2_instructions;
 #define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1
 #define TCG_TARGET_HAS_extract2_i64     0
-#define TCG_TARGET_HAS_ctpop_i64        0
 #endif
 
 #define TCG_TARGET_HAS_qemu_ldst_i128   0
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index e8720b63ed..a94c965046 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -1734,6 +1734,10 @@ static const TCGOutOpBinary outop_clz = {
     .out_rri = tgen_clzi,
 };
 
+static const TCGOutOpUnary outop_ctpop = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static const TCGOutOpBinary outop_ctz = {
     .base.static_constraint = C_NotImplemented,
 };
diff --git a/tcg/ppc/tcg-target-has.h b/tcg/ppc/tcg-target-has.h
index 2b381b99a2..f071435d98 100644
--- a/tcg/ppc/tcg-target-has.h
+++ b/tcg/ppc/tcg-target-has.h
@@ -19,7 +19,6 @@
 /* optional instructions */
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
-#define TCG_TARGET_HAS_ctpop_i32        have_isa_2_06
 #define TCG_TARGET_HAS_extract2_i32     0
 #define TCG_TARGET_HAS_negsetcond_i32   1
 #define TCG_TARGET_HAS_mulu2_i32        0
@@ -33,7 +32,6 @@
 #define TCG_TARGET_HAS_bswap16_i64      1
 #define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1
-#define TCG_TARGET_HAS_ctpop_i64        have_isa_2_06
 #define TCG_TARGET_HAS_extract2_i64     0
 #define TCG_TARGET_HAS_negsetcond_i64   1
 #define TCG_TARGET_HAS_add2_i64         1
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index 2cdabcf610..ab56c623c7 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -2974,6 +2974,23 @@ static const TCGOutOpBinary outop_clz = {
     .out_rri = tgen_clzi,
 };
 
+static void tgen_ctpop(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1)
+{
+    uint32_t insn = type == TCG_TYPE_I32 ? CNTPOPW : CNTPOPD;
+    tcg_out32(s, insn | SAB(a1, a0, 0));
+}
+
+static TCGConstraintSetIndex cset_ctpop(TCGType type, unsigned flags)
+{
+    return have_isa_2_06 ? C_O1_I1(r, r) : C_NotImplemented;
+}
+
+static const TCGOutOpUnary outop_ctpop = {
+    .base.static_constraint = C_Dynamic,
+    .base.dynamic_constraint = cset_ctpop,
+    .out_rr = tgen_ctpop,
+};
+
 static void tgen_ctz(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -3396,13 +3413,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_mem_long(s, STD, STDX, args[0], args[1], args[2]);
         break;
 
-    case INDEX_op_ctpop_i32:
-        tcg_out32(s, CNTPOPW | SAB(args[1], args[0], 0));
-        break;
-    case INDEX_op_ctpop_i64:
-        tcg_out32(s, CNTPOPD | SAB(args[1], args[0], 0));
-        break;
-
     case INDEX_op_brcond_i32:
         tcg_out_brcond(s, args[2], args[0], args[1], const_args[1],
                        arg_label(args[3]), TCG_TYPE_I32);
@@ -4226,7 +4236,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld16u_i32:
     case INDEX_op_ld16s_i32:
     case INDEX_op_ld_i32:
-    case INDEX_op_ctpop_i32:
     case INDEX_op_bswap16_i32:
     case INDEX_op_bswap32_i32:
     case INDEX_op_extract_i32:
@@ -4238,7 +4247,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld32u_i64:
     case INDEX_op_ld32s_i64:
     case INDEX_op_ld_i64:
-    case INDEX_op_ctpop_i64:
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
     case INDEX_op_bswap16_i64:
diff --git a/tcg/riscv/tcg-target-has.h b/tcg/riscv/tcg-target-has.h
index 385a6736c0..a3b634570b 100644
--- a/tcg/riscv/tcg-target-has.h
+++ b/tcg/riscv/tcg-target-has.h
@@ -18,7 +18,6 @@
 #define TCG_TARGET_HAS_muls2_i32        0
 #define TCG_TARGET_HAS_bswap16_i32      (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_bswap32_i32      (cpuinfo & CPUINFO_ZBB)
-#define TCG_TARGET_HAS_ctpop_i32        (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
 #define TCG_TARGET_HAS_negsetcond_i64   1
@@ -27,7 +26,6 @@
 #define TCG_TARGET_HAS_bswap16_i64      (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_bswap32_i64      (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_bswap64_i64      (cpuinfo & CPUINFO_ZBB)
-#define TCG_TARGET_HAS_ctpop_i64        (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_add2_i64         1
 #define TCG_TARGET_HAS_sub2_i64         1
 #define TCG_TARGET_HAS_mulu2_i64        0
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index 1ceb1aeb1c..a5cd18c99e 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -2023,6 +2023,23 @@ static const TCGOutOpBinary outop_clz = {
     .out_rri = tgen_clzi,
 };
 
+static void tgen_ctpop(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1)
+{
+    RISCVInsn insn = type == TCG_TYPE_I32 ? OPC_CPOPW : OPC_CPOP;
+    tcg_out_opc_imm(s, insn, a0, a1, 0);
+}
+
+static TCGConstraintSetIndex cset_ctpop(TCGType type, unsigned flags)
+{
+    return cpuinfo & CPUINFO_ZBB ? C_O1_I1(r, r) : C_NotImplemented;
+}
+
+static const TCGOutOpUnary outop_ctpop = {
+    .base.static_constraint = C_Dynamic,
+    .base.dynamic_constraint = cset_ctpop,
+    .out_rr = tgen_ctpop,
+};
+
 static void tgen_ctz(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -2438,13 +2455,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    case INDEX_op_ctpop_i32:
-        tcg_out_opc_imm(s, OPC_CPOPW, a0, a1, 0);
-        break;
-    case INDEX_op_ctpop_i64:
-        tcg_out_opc_imm(s, OPC_CPOP, a0, a1, 0);
-        break;
-
     case INDEX_op_add2_i32:
         tcg_out_addsub2(s, a0, a1, a2, args[3], args[4], args[5],
                         const_args[4], const_args[5], false, true);
@@ -2808,8 +2818,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_bswap16_i64:
     case INDEX_op_bswap32_i64:
     case INDEX_op_bswap64_i64:
-    case INDEX_op_ctpop_i32:
-    case INDEX_op_ctpop_i64:
         return C_O1_I1(r, r);
 
     case INDEX_op_st8_i32:
diff --git a/tcg/s390x/tcg-target-has.h b/tcg/s390x/tcg-target-has.h
index 0794394fea..87f117ce58 100644
--- a/tcg/s390x/tcg-target-has.h
+++ b/tcg/s390x/tcg-target-has.h
@@ -31,7 +31,6 @@ extern uint64_t s390_facilities[3];
 /* optional instructions */
 #define TCG_TARGET_HAS_bswap16_i32    1
 #define TCG_TARGET_HAS_bswap32_i32    1
-#define TCG_TARGET_HAS_ctpop_i32      1
 #define TCG_TARGET_HAS_extract2_i32   0
 #define TCG_TARGET_HAS_negsetcond_i32 1
 #define TCG_TARGET_HAS_add2_i32       1
@@ -44,7 +43,6 @@ extern uint64_t s390_facilities[3];
 #define TCG_TARGET_HAS_bswap16_i64    1
 #define TCG_TARGET_HAS_bswap32_i64    1
 #define TCG_TARGET_HAS_bswap64_i64    1
-#define TCG_TARGET_HAS_ctpop_i64      1
 #define TCG_TARGET_HAS_extract2_i64   0
 #define TCG_TARGET_HAS_negsetcond_i64 1
 #define TCG_TARGET_HAS_add2_i64       1
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index 374136ed14..71adb0964d 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -1514,32 +1514,6 @@ static void tgen_movcond(TCGContext *s, TCGType type, TCGCond c, TCGReg dest,
     tgen_movcond_int(s, type, dest, v3, v3const, v4, cc, inv_cc);
 }
 
-static void tgen_ctpop(TCGContext *s, TCGType type, TCGReg dest, TCGReg src)
-{
-    /* With MIE3, and bit 0 of m4 set, we get the complete result. */
-    if (HAVE_FACILITY(MISC_INSN_EXT3)) {
-        if (type == TCG_TYPE_I32) {
-            tcg_out_ext32u(s, dest, src);
-            src = dest;
-        }
-        tcg_out_insn(s, RRFc, POPCNT, dest, src, 8);
-        return;
-    }
-
-    /* Without MIE3, each byte gets the count of bits for the byte. */
-    tcg_out_insn(s, RRFc, POPCNT, dest, src, 0);
-
-    /* Multiply to sum each byte at the top of the word. */
-    if (type == TCG_TYPE_I32) {
-        tcg_out_insn(s, RIL, MSFI, dest, 0x01010101);
-        tcg_out_sh32(s, RS_SRL, dest, TCG_REG_NONE, 24);
-    } else {
-        tcg_out_movi(s, TCG_TYPE_I64, TCG_TMP0, 0x0101010101010101ull);
-        tcg_out_insn(s, RRE, MSGR, dest, TCG_TMP0);
-        tcg_out_sh64(s, RSY_SRLG, dest, dest, TCG_REG_NONE, 56);
-    }
-}
-
 static void tgen_deposit(TCGContext *s, TCGReg dest, TCGReg src,
                          int ofs, int len, int z)
 {
@@ -2268,6 +2242,37 @@ static const TCGOutOpBinary outop_clz = {
     .out_rri = tgen_clzi,
 };
 
+static void tgen_ctpop(TCGContext *s, TCGType type, TCGReg dest, TCGReg src)
+{
+    /* With MIE3, and bit 0 of m4 set, we get the complete result. */
+    if (HAVE_FACILITY(MISC_INSN_EXT3)) {
+        if (type == TCG_TYPE_I32) {
+            tcg_out_ext32u(s, dest, src);
+            src = dest;
+        }
+        tcg_out_insn(s, RRFc, POPCNT, dest, src, 8);
+        return;
+    }
+
+    /* Without MIE3, each byte gets the count of bits for the byte. */
+    tcg_out_insn(s, RRFc, POPCNT, dest, src, 0);
+
+    /* Multiply to sum each byte at the top of the word. */
+    if (type == TCG_TYPE_I32) {
+        tcg_out_insn(s, RIL, MSFI, dest, 0x01010101);
+        tcg_out_sh32(s, RS_SRL, dest, TCG_REG_NONE, 24);
+    } else {
+        tcg_out_movi(s, TCG_TYPE_I64, TCG_TMP0, 0x0101010101010101ull);
+        tcg_out_insn(s, RRE, MSGR, dest, TCG_TMP0);
+        tcg_out_sh64(s, RSY_SRLG, dest, dest, TCG_REG_NONE, 56);
+    }
+}
+
+static const TCGOutOpUnary outop_ctpop = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = tgen_ctpop,
+};
+
 static const TCGOutOpBinary outop_ctz = {
     .base.static_constraint = C_NotImplemented,
 };
@@ -2914,13 +2919,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tgen_sextract(s, args[0], args[1], args[2], args[3]);
         break;
 
-    case INDEX_op_ctpop_i32:
-        tgen_ctpop(s, TCG_TYPE_I32, args[0], args[1]);
-        break;
-    case INDEX_op_ctpop_i64:
-        tgen_ctpop(s, TCG_TYPE_I64, args[0], args[1]);
-        break;
-
     case INDEX_op_mb:
         /* The host memory model is quite strong, we simply need to
            serialize the instruction stream.  */
@@ -3429,8 +3427,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_extract_i64:
     case INDEX_op_sextract_i32:
     case INDEX_op_sextract_i64:
-    case INDEX_op_ctpop_i32:
-    case INDEX_op_ctpop_i64:
         return C_O1_I1(r, r);
 
     case INDEX_op_qemu_ld_i32:
diff --git a/tcg/sparc64/tcg-target-has.h b/tcg/sparc64/tcg-target-has.h
index 56262640ff..40e54e1543 100644
--- a/tcg/sparc64/tcg-target-has.h
+++ b/tcg/sparc64/tcg-target-has.h
@@ -16,7 +16,6 @@ extern bool use_vis3_instructions;
 /* optional instructions */
 #define TCG_TARGET_HAS_bswap16_i32      0
 #define TCG_TARGET_HAS_bswap32_i32      0
-#define TCG_TARGET_HAS_ctpop_i32        0
 #define TCG_TARGET_HAS_extract2_i32     0
 #define TCG_TARGET_HAS_negsetcond_i32   1
 #define TCG_TARGET_HAS_add2_i32         1
@@ -29,7 +28,6 @@ extern bool use_vis3_instructions;
 #define TCG_TARGET_HAS_bswap16_i64      0
 #define TCG_TARGET_HAS_bswap32_i64      0
 #define TCG_TARGET_HAS_bswap64_i64      0
-#define TCG_TARGET_HAS_ctpop_i64        0
 #define TCG_TARGET_HAS_extract2_i64     0
 #define TCG_TARGET_HAS_negsetcond_i64   1
 #define TCG_TARGET_HAS_add2_i64         1
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index a9257b8b93..43ca23f593 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -1322,6 +1322,10 @@ static const TCGOutOpBinary outop_clz = {
     .base.static_constraint = C_NotImplemented,
 };
 
+static const TCGOutOpUnary outop_ctpop = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static const TCGOutOpBinary outop_ctz = {
     .base.static_constraint = C_NotImplemented,
 };
diff --git a/tcg/tcg-has.h b/tcg/tcg-has.h
index 6bba845944..97f4e83303 100644
--- a/tcg/tcg-has.h
+++ b/tcg/tcg-has.h
@@ -15,7 +15,6 @@
 #define TCG_TARGET_HAS_bswap16_i64      0
 #define TCG_TARGET_HAS_bswap32_i64      0
 #define TCG_TARGET_HAS_bswap64_i64      0
-#define TCG_TARGET_HAS_ctpop_i64        0
 #define TCG_TARGET_HAS_extract2_i64     0
 #define TCG_TARGET_HAS_negsetcond_i64   0
 #define TCG_TARGET_HAS_add2_i64         0
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index 7bf7de1213..db0e79059b 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -765,7 +765,8 @@ void tcg_gen_ctz_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
         tcg_temp_free_i64(t2);
         return;
     }
-    if (TCG_TARGET_HAS_ctpop_i32 || TCG_TARGET_HAS_ctpop_i64) {
+    if (tcg_op_supported(INDEX_op_ctpop_i32, TCG_TYPE_I32, 0) ||
+        tcg_op_supported(INDEX_op_ctpop_i64, TCG_TYPE_I64, 0)) {
         t = tcg_temp_ebb_new_i32();
         tcg_gen_subi_i32(t, arg1, 1);
         tcg_gen_andc_i32(t, t, arg1);
@@ -788,8 +789,9 @@ void tcg_gen_ctz_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 
 void tcg_gen_ctzi_i32(TCGv_i32 ret, TCGv_i32 arg1, uint32_t arg2)
 {
-    if (!tcg_op_supported(INDEX_op_ctz, TCG_TYPE_I32, 0)
-        && TCG_TARGET_HAS_ctpop_i32 && arg2 == 32) {
+    if (arg2 == 32
+        && !tcg_op_supported(INDEX_op_ctz, TCG_TYPE_I32, 0)
+        && tcg_op_supported(INDEX_op_ctpop_i32, TCG_TYPE_I32, 0)) {
         /* This equivalence has the advantage of not requiring a fixup.  */
         TCGv_i32 t = tcg_temp_ebb_new_i32();
         tcg_gen_subi_i32(t, arg1, 1);
@@ -817,9 +819,9 @@ void tcg_gen_clrsb_i32(TCGv_i32 ret, TCGv_i32 arg)
 
 void tcg_gen_ctpop_i32(TCGv_i32 ret, TCGv_i32 arg1)
 {
-    if (TCG_TARGET_HAS_ctpop_i32) {
+    if (tcg_op_supported(INDEX_op_ctpop_i32, TCG_TYPE_I32, 0)) {
         tcg_gen_op2_i32(INDEX_op_ctpop_i32, ret, arg1);
-    } else if (TCG_TARGET_HAS_ctpop_i64) {
+    } else if (tcg_op_supported(INDEX_op_ctpop_i64, TCG_TYPE_I64, 0)) {
         TCGv_i64 t = tcg_temp_ebb_new_i64();
         tcg_gen_extu_i32_i64(t, arg1);
         tcg_gen_ctpop_i64(t, t);
@@ -2370,7 +2372,7 @@ void tcg_gen_ctz_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
         tcg_gen_op3_i64(INDEX_op_ctz, ret, arg1, arg2);
         return;
     }
-    if (TCG_TARGET_HAS_ctpop_i64) {
+    if (tcg_op_supported(INDEX_op_ctpop_i64, TCG_TYPE_I64, 0)) {
         t = tcg_temp_ebb_new_i64();
         tcg_gen_subi_i64(t, arg1, 1);
         tcg_gen_andc_i64(t, t, arg1);
@@ -2404,7 +2406,7 @@ void tcg_gen_ctzi_i64(TCGv_i64 ret, TCGv_i64 arg1, uint64_t arg2)
         tcg_temp_free_i32(t32);
     } else if (arg2 == 64
                && !tcg_op_supported(INDEX_op_ctz, TCG_TYPE_I64, 0)
-               && TCG_TARGET_HAS_ctpop_i64) {
+               && tcg_op_supported(INDEX_op_ctpop_i64, TCG_TYPE_I64, 0)) {
         /* This equivalence has the advantage of not requiring a fixup.  */
         TCGv_i64 t = tcg_temp_ebb_new_i64();
         tcg_gen_subi_i64(t, arg1, 1);
@@ -2432,16 +2434,21 @@ void tcg_gen_clrsb_i64(TCGv_i64 ret, TCGv_i64 arg)
 
 void tcg_gen_ctpop_i64(TCGv_i64 ret, TCGv_i64 arg1)
 {
-    if (TCG_TARGET_HAS_ctpop_i64) {
-        tcg_gen_op2_i64(INDEX_op_ctpop_i64, ret, arg1);
-    } else if (TCG_TARGET_REG_BITS == 32 && TCG_TARGET_HAS_ctpop_i32) {
-        tcg_gen_ctpop_i32(TCGV_HIGH(ret), TCGV_HIGH(arg1));
-        tcg_gen_ctpop_i32(TCGV_LOW(ret), TCGV_LOW(arg1));
-        tcg_gen_add_i32(TCGV_LOW(ret), TCGV_LOW(ret), TCGV_HIGH(ret));
-        tcg_gen_movi_i32(TCGV_HIGH(ret), 0);
+    if (TCG_TARGET_REG_BITS == 64) {
+        if (tcg_op_supported(INDEX_op_ctpop_i64, TCG_TYPE_I64, 0)) {
+            tcg_gen_op2_i64(INDEX_op_ctpop_i64, ret, arg1);
+            return;
+        }
     } else {
-        gen_helper_ctpop_i64(ret, arg1);
+        if (tcg_op_supported(INDEX_op_ctpop_i32, TCG_TYPE_I32, 0)) {
+            tcg_gen_ctpop_i32(TCGV_HIGH(ret), TCGV_HIGH(arg1));
+            tcg_gen_ctpop_i32(TCGV_LOW(ret), TCGV_LOW(arg1));
+            tcg_gen_add_i32(TCGV_LOW(ret), TCGV_LOW(ret), TCGV_HIGH(ret));
+            tcg_gen_movi_i32(TCGV_HIGH(ret), 0);
+            return;
+        }
     }
+    gen_helper_ctpop_i64(ret, arg1);
 }
 
 void tcg_gen_rotl_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 18b28a670e..94997d8610 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1027,6 +1027,8 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_and, TCGOutOpBinary, outop_and),
     OUTOP(INDEX_op_andc, TCGOutOpBinary, outop_andc),
     OUTOP(INDEX_op_clz, TCGOutOpBinary, outop_clz),
+    OUTOP(INDEX_op_ctpop_i32, TCGOutOpUnary, outop_ctpop),
+    OUTOP(INDEX_op_ctpop_i64, TCGOutOpUnary, outop_ctpop),
     OUTOP(INDEX_op_ctz, TCGOutOpBinary, outop_ctz),
     OUTOP(INDEX_op_divs, TCGOutOpBinary, outop_divs),
     OUTOP(INDEX_op_divu, TCGOutOpBinary, outop_divu),
@@ -2290,8 +2292,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
         return TCG_TARGET_HAS_bswap16_i32;
     case INDEX_op_bswap32_i32:
         return TCG_TARGET_HAS_bswap32_i32;
-    case INDEX_op_ctpop_i32:
-        return TCG_TARGET_HAS_ctpop_i32;
 
     case INDEX_op_brcond2_i32:
     case INDEX_op_setcond2_i32:
@@ -2331,8 +2331,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
         return TCG_TARGET_HAS_bswap32_i64;
     case INDEX_op_bswap64_i64:
         return TCG_TARGET_HAS_bswap64_i64;
-    case INDEX_op_ctpop_i64:
-        return TCG_TARGET_HAS_ctpop_i64;
     case INDEX_op_add2_i64:
         return TCG_TARGET_HAS_add2_i64;
     case INDEX_op_sub2_i64:
@@ -5449,6 +5447,8 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
         }
         break;
 
+    case INDEX_op_ctpop_i32:
+    case INDEX_op_ctpop_i64:
     case INDEX_op_neg:
     case INDEX_op_not:
         {
diff --git a/tcg/tci.c b/tcg/tci.c
index 550f2014a8..8bcf48b251 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -26,6 +26,8 @@
 #include <ffi.h>
 
 
+#define ctpop_tr    glue(ctpop, TCG_TARGET_REG_BITS)
+
 /*
  * Enable TCI assertions only when debugging TCG (and without NDEBUG defined).
  * Without assertions, the interpreter runs much faster.
@@ -575,6 +577,11 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_args_rr(insn, &r0, &r1);
             regs[r0] = ~regs[r1];
             break;
+        case INDEX_op_ctpop_i32:
+        case INDEX_op_ctpop_i64:
+            tci_args_rr(insn, &r0, &r1);
+            regs[r0] = ctpop_tr(regs[r1]);
+            break;
 
             /* Arithmetic operations (32 bit). */
 
@@ -604,12 +611,6 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tmp32 = regs[r1];
             regs[r0] = tmp32 ? ctz32(tmp32) : regs[r2];
             break;
-#if TCG_TARGET_HAS_ctpop_i32
-        case INDEX_op_ctpop_i32:
-            tci_args_rr(insn, &r0, &r1);
-            regs[r0] = ctpop32(regs[r1]);
-            break;
-#endif
 
             /* Shift/rotate operations. */
 
@@ -739,12 +740,6 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = regs[r1] ? ctz64(regs[r1]) : regs[r2];
             break;
-#if TCG_TARGET_HAS_ctpop_i64
-        case INDEX_op_ctpop_i64:
-            tci_args_rr(insn, &r0, &r1);
-            regs[r0] = ctpop64(regs[r1]);
-            break;
-#endif
 #if TCG_TARGET_HAS_mulu2_i64
         case INDEX_op_mulu2_i64:
             tci_args_rrrr(insn, &r0, &r1, &r2, &r3);
diff --git a/tcg/tci/tcg-target-has.h b/tcg/tci/tcg-target-has.h
index daa6db4799..774fb149fc 100644
--- a/tcg/tci/tcg-target-has.h
+++ b/tcg/tci/tcg-target-has.h
@@ -10,7 +10,6 @@
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
 #define TCG_TARGET_HAS_extract2_i32     0
-#define TCG_TARGET_HAS_ctpop_i32        1
 #define TCG_TARGET_HAS_negsetcond_i32   0
 #define TCG_TARGET_HAS_muls2_i32        1
 #define TCG_TARGET_HAS_qemu_st8_i32     0
@@ -21,7 +20,6 @@
 #define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1
 #define TCG_TARGET_HAS_extract2_i64     0
-#define TCG_TARGET_HAS_ctpop_i64        1
 #define TCG_TARGET_HAS_negsetcond_i64   0
 #define TCG_TARGET_HAS_muls2_i64        1
 #define TCG_TARGET_HAS_add2_i32         1
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index d8d45e2c4b..a931369a80 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -66,8 +66,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_extract_i64:
     case INDEX_op_sextract_i32:
     case INDEX_op_sextract_i64:
-    case INDEX_op_ctpop_i32:
-    case INDEX_op_ctpop_i64:
         return C_O1_I1(r, r);
 
     case INDEX_op_st8_i32:
@@ -883,6 +881,22 @@ static const TCGOutOpBinary outop_xor = {
     .out_rrr = tgen_xor,
 };
 
+static void tgen_ctpop(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1)
+{
+    tcg_out_op_rr(s, glue(INDEX_op_ctpop_i,TCG_TARGET_REG_BITS), a0, a1);
+}
+
+static TCGConstraintSetIndex cset_ctpop(TCGType type, unsigned flags)
+{
+    return type == TCG_TYPE_REG ? C_O1_I1(r, r) : C_NotImplemented;
+}
+
+static const TCGOutOpUnary outop_ctpop = {
+    .base.static_constraint = C_Dynamic,
+    .base.dynamic_constraint = cset_ctpop,
+    .out_rr = tgen_ctpop,
+};
+
 static void tgen_neg(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1)
 {
     tcg_out_op_rr(s, INDEX_op_neg, a0, a1);
@@ -961,7 +975,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_op_rl(s, opc, TCG_REG_TMP, arg_label(args[3]));
         break;
 
-    CASE_32_64(ctpop)    /* Optional (TCG_TARGET_HAS_ctpop_*). */
     case INDEX_op_bswap32_i32: /* Optional (TCG_TARGET_HAS_bswap32_i32). */
     case INDEX_op_bswap64_i64: /* Optional (TCG_TARGET_HAS_bswap64_i64). */
         tcg_out_op_rr(s, opc, args[0], args[1]);

From 97218ae918b1504a63623130f3dc8f4b423b5f1b Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Jan 2025 18:37:43 -0800
Subject: [PATCH 0426/2760] tcg: Merge INDEX_op_ctpop_{i32,i64}

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 docs/devel/tcg-ops.rst   |  6 +++---
 include/tcg/tcg-opc.h    |  3 +--
 tcg/optimize.c           |  9 +++------
 tcg/tcg-op.c             | 21 ++++++++++-----------
 tcg/tcg.c                |  6 ++----
 tcg/tci.c                |  6 ++----
 tcg/tci/tcg-target.c.inc |  2 +-
 7 files changed, 22 insertions(+), 31 deletions(-)

diff --git a/docs/devel/tcg-ops.rst b/docs/devel/tcg-ops.rst
index 92344b8786..fb7764e3c0 100644
--- a/docs/devel/tcg-ops.rst
+++ b/docs/devel/tcg-ops.rst
@@ -366,12 +366,12 @@ Logical
 
      - | *t0* = *t1* ? ctz(*t1*) : *t2*
 
-   * - ctpop_i32/i64 *t0*, *t1*
+   * - ctpop *t0*, *t1*
 
      - | *t0* = number of bits set in *t1*
        |
-       | With *ctpop* short for "count population", matching
-       | the function name used in ``include/qemu/host-utils.h``.
+       | The name *ctpop* is short for "count population", and matches
+         the function name used in ``include/qemu/host-utils.h``.
 
 
 Shifts/Rotates
diff --git a/include/tcg/tcg-opc.h b/include/tcg/tcg-opc.h
index 4dfd8708a5..f4ccde074b 100644
--- a/include/tcg/tcg-opc.h
+++ b/include/tcg/tcg-opc.h
@@ -43,6 +43,7 @@ DEF(add, 1, 2, 0, TCG_OPF_INT)
 DEF(and, 1, 2, 0, TCG_OPF_INT)
 DEF(andc, 1, 2, 0, TCG_OPF_INT)
 DEF(clz, 1, 2, 0, TCG_OPF_INT)
+DEF(ctpop, 1, 1, 0, TCG_OPF_INT)
 DEF(ctz, 1, 2, 0, TCG_OPF_INT)
 DEF(divs, 1, 2, 0, TCG_OPF_INT)
 DEF(divs2, 2, 3, 0, TCG_OPF_INT)
@@ -97,7 +98,6 @@ DEF(setcond2_i32, 1, 4, 1, 0)
 
 DEF(bswap16_i32, 1, 1, 1, 0)
 DEF(bswap32_i32, 1, 1, 1, 0)
-DEF(ctpop_i32, 1, 1, 0, 0)
 
 DEF(setcond_i64, 1, 2, 1, 0)
 DEF(negsetcond_i64, 1, 2, 1, 0)
@@ -130,7 +130,6 @@ DEF(brcond_i64, 0, 2, 2, TCG_OPF_BB_END | TCG_OPF_COND_BRANCH)
 DEF(bswap16_i64, 1, 1, 1, 0)
 DEF(bswap32_i64, 1, 1, 1, 0)
 DEF(bswap64_i64, 1, 1, 1, 0)
-DEF(ctpop_i64, 1, 1, 0, 0)
 
 DEF(add2_i64, 2, 4, 0, 0)
 DEF(sub2_i64, 2, 4, 0, 0)
diff --git a/tcg/optimize.c b/tcg/optimize.c
index af4e76e81b..bf625f770c 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -515,11 +515,8 @@ static uint64_t do_constant_folding_2(TCGOpcode op, TCGType type,
         }
         return x ? ctz64(x) : y;
 
-    case INDEX_op_ctpop_i32:
-        return ctpop32(x);
-
-    case INDEX_op_ctpop_i64:
-        return ctpop64(x);
+    case INDEX_op_ctpop:
+        return type == TCG_TYPE_I32 ? ctpop32(x) : ctpop64(x);
 
     CASE_OP_32_64(bswap16):
         x = bswap16(x);
@@ -2902,7 +2899,7 @@ void tcg_optimize(TCGContext *s)
         case INDEX_op_ctz:
             done = fold_count_zeros(&ctx, op);
             break;
-        CASE_OP_32_64(ctpop):
+        case INDEX_op_ctpop:
             done = fold_ctpop(&ctx, op);
             break;
         CASE_OP_32_64(deposit):
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index db0e79059b..0eeec47b83 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -765,8 +765,7 @@ void tcg_gen_ctz_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
         tcg_temp_free_i64(t2);
         return;
     }
-    if (tcg_op_supported(INDEX_op_ctpop_i32, TCG_TYPE_I32, 0) ||
-        tcg_op_supported(INDEX_op_ctpop_i64, TCG_TYPE_I64, 0)) {
+    if (tcg_op_supported(INDEX_op_ctpop, TCG_TYPE_REG, 0)) {
         t = tcg_temp_ebb_new_i32();
         tcg_gen_subi_i32(t, arg1, 1);
         tcg_gen_andc_i32(t, t, arg1);
@@ -791,7 +790,7 @@ void tcg_gen_ctzi_i32(TCGv_i32 ret, TCGv_i32 arg1, uint32_t arg2)
 {
     if (arg2 == 32
         && !tcg_op_supported(INDEX_op_ctz, TCG_TYPE_I32, 0)
-        && tcg_op_supported(INDEX_op_ctpop_i32, TCG_TYPE_I32, 0)) {
+        && tcg_op_supported(INDEX_op_ctpop, TCG_TYPE_REG, 0)) {
         /* This equivalence has the advantage of not requiring a fixup.  */
         TCGv_i32 t = tcg_temp_ebb_new_i32();
         tcg_gen_subi_i32(t, arg1, 1);
@@ -819,9 +818,9 @@ void tcg_gen_clrsb_i32(TCGv_i32 ret, TCGv_i32 arg)
 
 void tcg_gen_ctpop_i32(TCGv_i32 ret, TCGv_i32 arg1)
 {
-    if (tcg_op_supported(INDEX_op_ctpop_i32, TCG_TYPE_I32, 0)) {
-        tcg_gen_op2_i32(INDEX_op_ctpop_i32, ret, arg1);
-    } else if (tcg_op_supported(INDEX_op_ctpop_i64, TCG_TYPE_I64, 0)) {
+    if (tcg_op_supported(INDEX_op_ctpop, TCG_TYPE_I32, 0)) {
+        tcg_gen_op2_i32(INDEX_op_ctpop, ret, arg1);
+    } else if (tcg_op_supported(INDEX_op_ctpop, TCG_TYPE_I64, 0)) {
         TCGv_i64 t = tcg_temp_ebb_new_i64();
         tcg_gen_extu_i32_i64(t, arg1);
         tcg_gen_ctpop_i64(t, t);
@@ -2372,7 +2371,7 @@ void tcg_gen_ctz_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2)
         tcg_gen_op3_i64(INDEX_op_ctz, ret, arg1, arg2);
         return;
     }
-    if (tcg_op_supported(INDEX_op_ctpop_i64, TCG_TYPE_I64, 0)) {
+    if (tcg_op_supported(INDEX_op_ctpop, TCG_TYPE_I64, 0)) {
         t = tcg_temp_ebb_new_i64();
         tcg_gen_subi_i64(t, arg1, 1);
         tcg_gen_andc_i64(t, t, arg1);
@@ -2406,7 +2405,7 @@ void tcg_gen_ctzi_i64(TCGv_i64 ret, TCGv_i64 arg1, uint64_t arg2)
         tcg_temp_free_i32(t32);
     } else if (arg2 == 64
                && !tcg_op_supported(INDEX_op_ctz, TCG_TYPE_I64, 0)
-               && tcg_op_supported(INDEX_op_ctpop_i64, TCG_TYPE_I64, 0)) {
+               && tcg_op_supported(INDEX_op_ctpop, TCG_TYPE_I64, 0)) {
         /* This equivalence has the advantage of not requiring a fixup.  */
         TCGv_i64 t = tcg_temp_ebb_new_i64();
         tcg_gen_subi_i64(t, arg1, 1);
@@ -2435,12 +2434,12 @@ void tcg_gen_clrsb_i64(TCGv_i64 ret, TCGv_i64 arg)
 void tcg_gen_ctpop_i64(TCGv_i64 ret, TCGv_i64 arg1)
 {
     if (TCG_TARGET_REG_BITS == 64) {
-        if (tcg_op_supported(INDEX_op_ctpop_i64, TCG_TYPE_I64, 0)) {
-            tcg_gen_op2_i64(INDEX_op_ctpop_i64, ret, arg1);
+        if (tcg_op_supported(INDEX_op_ctpop, TCG_TYPE_I64, 0)) {
+            tcg_gen_op2_i64(INDEX_op_ctpop, ret, arg1);
             return;
         }
     } else {
-        if (tcg_op_supported(INDEX_op_ctpop_i32, TCG_TYPE_I32, 0)) {
+        if (tcg_op_supported(INDEX_op_ctpop, TCG_TYPE_I32, 0)) {
             tcg_gen_ctpop_i32(TCGV_HIGH(ret), TCGV_HIGH(arg1));
             tcg_gen_ctpop_i32(TCGV_LOW(ret), TCGV_LOW(arg1));
             tcg_gen_add_i32(TCGV_LOW(ret), TCGV_LOW(ret), TCGV_HIGH(ret));
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 94997d8610..5b6af803b2 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1027,8 +1027,7 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_and, TCGOutOpBinary, outop_and),
     OUTOP(INDEX_op_andc, TCGOutOpBinary, outop_andc),
     OUTOP(INDEX_op_clz, TCGOutOpBinary, outop_clz),
-    OUTOP(INDEX_op_ctpop_i32, TCGOutOpUnary, outop_ctpop),
-    OUTOP(INDEX_op_ctpop_i64, TCGOutOpUnary, outop_ctpop),
+    OUTOP(INDEX_op_ctpop, TCGOutOpUnary, outop_ctpop),
     OUTOP(INDEX_op_ctz, TCGOutOpBinary, outop_ctz),
     OUTOP(INDEX_op_divs, TCGOutOpBinary, outop_divs),
     OUTOP(INDEX_op_divu, TCGOutOpBinary, outop_divu),
@@ -5447,8 +5446,7 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
         }
         break;
 
-    case INDEX_op_ctpop_i32:
-    case INDEX_op_ctpop_i64:
+    case INDEX_op_ctpop:
     case INDEX_op_neg:
     case INDEX_op_not:
         {
diff --git a/tcg/tci.c b/tcg/tci.c
index 8bcf48b251..d58a94ff28 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -577,8 +577,7 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_args_rr(insn, &r0, &r1);
             regs[r0] = ~regs[r1];
             break;
-        case INDEX_op_ctpop_i32:
-        case INDEX_op_ctpop_i64:
+        case INDEX_op_ctpop:
             tci_args_rr(insn, &r0, &r1);
             regs[r0] = ctpop_tr(regs[r1]);
             break;
@@ -1023,6 +1022,7 @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
                            op_name, str_r(r0), str_r(r1), s2);
         break;
 
+    case INDEX_op_ctpop:
     case INDEX_op_mov:
     case INDEX_op_neg:
     case INDEX_op_not:
@@ -1033,8 +1033,6 @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
     case INDEX_op_bswap32_i32:
     case INDEX_op_bswap32_i64:
     case INDEX_op_bswap64_i64:
-    case INDEX_op_ctpop_i32:
-    case INDEX_op_ctpop_i64:
         tci_args_rr(insn, &r0, &r1);
         info->fprintf_func(info->stream, "%-12s  %s, %s",
                            op_name, str_r(r0), str_r(r1));
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index a931369a80..1d696a087e 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -883,7 +883,7 @@ static const TCGOutOpBinary outop_xor = {
 
 static void tgen_ctpop(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1)
 {
-    tcg_out_op_rr(s, glue(INDEX_op_ctpop_i,TCG_TARGET_REG_BITS), a0, a1);
+    tcg_out_op_rr(s, INDEX_op_ctpop, a0, a1);
 }
 
 static TCGConstraintSetIndex cset_ctpop(TCGType type, unsigned flags)

From 5641afdf9b496933596fd0bd5fa9cad0033405d4 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Jan 2025 21:52:03 -0800
Subject: [PATCH 0427/2760] tcg: Convert muls2 to TCGOutOpMul2

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target-has.h     |  2 --
 tcg/aarch64/tcg-target.c.inc     |  4 ++++
 tcg/arm/tcg-target-has.h         |  1 -
 tcg/arm/tcg-target.c.inc         | 25 +++++++++++++------------
 tcg/i386/tcg-target-has.h        |  2 --
 tcg/i386/tcg-target.c.inc        | 17 ++++++++++++-----
 tcg/loongarch64/tcg-target-has.h |  2 --
 tcg/loongarch64/tcg-target.c.inc |  4 ++++
 tcg/mips/tcg-target-has.h        |  2 --
 tcg/mips/tcg-target.c.inc        | 28 ++++++++++++++++++++--------
 tcg/ppc/tcg-target-has.h         |  2 --
 tcg/ppc/tcg-target.c.inc         |  4 ++++
 tcg/riscv/tcg-target-has.h       |  2 --
 tcg/riscv/tcg-target.c.inc       |  4 ++++
 tcg/s390x/tcg-target-has.h       |  2 --
 tcg/s390x/tcg-target.c.inc       | 27 ++++++++++++++++++++-------
 tcg/sparc64/tcg-target-con-set.h |  1 +
 tcg/sparc64/tcg-target-has.h     |  2 --
 tcg/sparc64/tcg-target.c.inc     | 29 ++++++++++++++++++++++++-----
 tcg/tcg-has.h                    |  1 -
 tcg/tcg-op.c                     |  4 ++--
 tcg/tcg.c                        | 26 ++++++++++++++++++++++----
 tcg/tci.c                        | 23 ++++++++++-------------
 tcg/tci/tcg-target-has.h         |  2 --
 tcg/tci/tcg-target.c.inc         | 21 ++++++++++++++++++---
 25 files changed, 158 insertions(+), 79 deletions(-)

diff --git a/tcg/aarch64/tcg-target-has.h b/tcg/aarch64/tcg-target-has.h
index 4f1840f44e..c351db223d 100644
--- a/tcg/aarch64/tcg-target-has.h
+++ b/tcg/aarch64/tcg-target-has.h
@@ -20,7 +20,6 @@
 #define TCG_TARGET_HAS_add2_i32         1
 #define TCG_TARGET_HAS_sub2_i32         1
 #define TCG_TARGET_HAS_mulu2_i32        0
-#define TCG_TARGET_HAS_muls2_i32        0
 #define TCG_TARGET_HAS_extr_i64_i32     0
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
@@ -32,7 +31,6 @@
 #define TCG_TARGET_HAS_add2_i64         1
 #define TCG_TARGET_HAS_sub2_i64         1
 #define TCG_TARGET_HAS_mulu2_i64        0
-#define TCG_TARGET_HAS_muls2_i64        0
 
 /*
  * Without FEAT_LSE2, we must use LDXP+STXP to implement atomic 128-bit load,
diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index 0f01fa8c20..0996c6234b 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -2205,6 +2205,10 @@ static const TCGOutOpBinary outop_mul = {
     .out_rrr = tgen_mul,
 };
 
+static const TCGOutOpMul2 outop_muls2 = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static TCGConstraintSetIndex cset_mulh(TCGType type, unsigned flags)
 {
     return type == TCG_TYPE_I64 ? C_O1_I2(r, r, r) : C_NotImplemented;
diff --git a/tcg/arm/tcg-target-has.h b/tcg/arm/tcg-target-has.h
index 1cf3911613..e1f19ffbc9 100644
--- a/tcg/arm/tcg-target-has.h
+++ b/tcg/arm/tcg-target-has.h
@@ -29,7 +29,6 @@ extern bool use_neon_instructions;
 #define TCG_TARGET_HAS_extract2_i32     1
 #define TCG_TARGET_HAS_negsetcond_i32   1
 #define TCG_TARGET_HAS_mulu2_i32        1
-#define TCG_TARGET_HAS_muls2_i32        1
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
 #define TCG_TARGET_HAS_qemu_ldst_i128   0
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index e109c65965..8c0bc78be3 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -929,14 +929,6 @@ static void tcg_out_umull32(TCGContext *s, ARMCond cond, TCGReg rd0,
               (rd1 << 16) | (rd0 << 12) | (rm << 8) | rn);
 }
 
-static void tcg_out_smull32(TCGContext *s, ARMCond cond, TCGReg rd0,
-                            TCGReg rd1, TCGReg rn, TCGReg rm)
-{
-    /* smull */
-    tcg_out32(s, (cond << 28) | 0x00c00090 |
-              (rd1 << 16) | (rd0 << 12) | (rm << 8) | rn);
-}
-
 static void tcg_out_ext8s(TCGContext *s, TCGType t, TCGReg rd, TCGReg rn)
 {
     /* sxtb */
@@ -1973,6 +1965,19 @@ static const TCGOutOpBinary outop_mul = {
     .out_rrr = tgen_mul,
 };
 
+static void tgen_muls2(TCGContext *s, TCGType type,
+                       TCGReg rd0, TCGReg rd1, TCGReg rn, TCGReg rm)
+{
+    /* smull */
+    tcg_out32(s, (COND_AL << 28) | 0x00c00090 |
+              (rd1 << 16) | (rd0 << 12) | (rm << 8) | rn);
+}
+
+static const TCGOutOpMul2 outop_muls2 = {
+    .base.static_constraint = C_O2_I2(r, r, r, r),
+    .out_rrrr = tgen_muls2,
+};
+
 static const TCGOutOpBinary outop_mulsh = {
     .base.static_constraint = C_NotImplemented,
 };
@@ -2246,9 +2251,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     case INDEX_op_mulu2_i32:
         tcg_out_umull32(s, COND_AL, args[0], args[1], args[2], args[3]);
         break;
-    case INDEX_op_muls2_i32:
-        tcg_out_smull32(s, COND_AL, args[0], args[1], args[2], args[3]);
-        break;
 
     case INDEX_op_brcond_i32:
         c = tcg_out_cmp(s, args[2], args[0], args[1], const_args[1]);
@@ -2373,7 +2375,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
         return C_O1_I2(r, r, rIN);
 
     case INDEX_op_mulu2_i32:
-    case INDEX_op_muls2_i32:
         return C_O2_I2(r, r, r, r);
 
     case INDEX_op_brcond_i32:
diff --git a/tcg/i386/tcg-target-has.h b/tcg/i386/tcg-target-has.h
index a71f8c7370..d63b3a3a89 100644
--- a/tcg/i386/tcg-target-has.h
+++ b/tcg/i386/tcg-target-has.h
@@ -33,7 +33,6 @@
 #define TCG_TARGET_HAS_add2_i32         1
 #define TCG_TARGET_HAS_sub2_i32         1
 #define TCG_TARGET_HAS_mulu2_i32        1
-#define TCG_TARGET_HAS_muls2_i32        1
 
 #if TCG_TARGET_REG_BITS == 64
 /* Keep 32-bit values zero-extended in a register.  */
@@ -46,7 +45,6 @@
 #define TCG_TARGET_HAS_add2_i64         1
 #define TCG_TARGET_HAS_sub2_i64         1
 #define TCG_TARGET_HAS_mulu2_i64        1
-#define TCG_TARGET_HAS_muls2_i64        1
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 #else
 #define TCG_TARGET_HAS_qemu_st8_i32     1
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index 318a30ebe0..43d63cab5c 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -2743,6 +2743,18 @@ static const TCGOutOpBinary outop_mul = {
     .out_rri = tgen_muli,
 };
 
+static void tgen_muls2(TCGContext *s, TCGType type,
+                       TCGReg a0, TCGReg a1, TCGReg a2, TCGReg a3)
+{
+    int rexw = type == TCG_TYPE_I32 ? 0 : P_REXW;
+    tcg_out_modrm(s, OPC_GRP3_Ev + rexw, EXT3_IMUL, a3);
+}
+
+static const TCGOutOpMul2 outop_muls2 = {
+    .base.static_constraint = C_O2_I2(a, d, a, r),
+    .out_rrrr = tgen_muls2,
+};
+
 static const TCGOutOpBinary outop_mulsh = {
     .base.static_constraint = C_NotImplemented,
 };
@@ -3136,9 +3148,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     OP_32_64(mulu2):
         tcg_out_modrm(s, OPC_GRP3_Ev + rexw, EXT3_MUL, args[3]);
         break;
-    OP_32_64(muls2):
-        tcg_out_modrm(s, OPC_GRP3_Ev + rexw, EXT3_IMUL, args[3]);
-        break;
     OP_32_64(add2):
         if (const_args[4]) {
             tgen_arithi(s, ARITH_ADD + rexw, a0, args[4], 1);
@@ -3928,8 +3937,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 
     case INDEX_op_mulu2_i32:
     case INDEX_op_mulu2_i64:
-    case INDEX_op_muls2_i32:
-    case INDEX_op_muls2_i64:
         return C_O2_I2(a, d, a, r);
 
     case INDEX_op_add2_i32:
diff --git a/tcg/loongarch64/tcg-target-has.h b/tcg/loongarch64/tcg-target-has.h
index 33a1cf2326..491ebf0d06 100644
--- a/tcg/loongarch64/tcg-target-has.h
+++ b/tcg/loongarch64/tcg-target-has.h
@@ -15,7 +15,6 @@
 #define TCG_TARGET_HAS_add2_i32         0
 #define TCG_TARGET_HAS_sub2_i32         0
 #define TCG_TARGET_HAS_mulu2_i32        0
-#define TCG_TARGET_HAS_muls2_i32        0
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
 #define TCG_TARGET_HAS_qemu_st8_i32     0
@@ -30,7 +29,6 @@
 #define TCG_TARGET_HAS_add2_i64         0
 #define TCG_TARGET_HAS_sub2_i64         0
 #define TCG_TARGET_HAS_mulu2_i64        0
-#define TCG_TARGET_HAS_muls2_i64        0
 
 #define TCG_TARGET_HAS_qemu_ldst_i128   (cpuinfo & CPUINFO_LSX)
 
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index 4ef7c6b945..95a0614e6e 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -1421,6 +1421,10 @@ static const TCGOutOpBinary outop_mul = {
     .out_rrr = tgen_mul,
 };
 
+static const TCGOutOpMul2 outop_muls2 = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static void tgen_mulsh(TCGContext *s, TCGType type,
                        TCGReg a0, TCGReg a1, TCGReg a2)
 {
diff --git a/tcg/mips/tcg-target-has.h b/tcg/mips/tcg-target-has.h
index 470aa16452..fd0b674402 100644
--- a/tcg/mips/tcg-target-has.h
+++ b/tcg/mips/tcg-target-has.h
@@ -40,7 +40,6 @@ extern bool use_mips32r2_instructions;
 
 /* optional instructions */
 #define TCG_TARGET_HAS_mulu2_i32        (!use_mips32r6_instructions)
-#define TCG_TARGET_HAS_muls2_i32        (!use_mips32r6_instructions)
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
 #define TCG_TARGET_HAS_negsetcond_i32   0
@@ -52,7 +51,6 @@ extern bool use_mips32r2_instructions;
 #define TCG_TARGET_HAS_add2_i64         0
 #define TCG_TARGET_HAS_sub2_i64         0
 #define TCG_TARGET_HAS_mulu2_i64        (!use_mips32r6_instructions)
-#define TCG_TARGET_HAS_muls2_i64        (!use_mips32r6_instructions)
 #define TCG_TARGET_HAS_ext32s_i64       1
 #define TCG_TARGET_HAS_ext32u_i64       1
 #define TCG_TARGET_HAS_negsetcond_i64   0
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index a94c965046..a1f9efb18b 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -1823,6 +1823,26 @@ static const TCGOutOpBinary outop_mul = {
     .out_rrr = tgen_mul,
 };
 
+static void tgen_muls2(TCGContext *s, TCGType type,
+                       TCGReg a0, TCGReg a1, TCGReg a2, TCGReg a3)
+{
+    MIPSInsn insn = type == TCG_TYPE_I32 ? OPC_MULT : OPC_DMULT;
+    tcg_out_opc_reg(s, insn, 0, a2, a3);
+    tcg_out_opc_reg(s, OPC_MFLO, a0, 0, 0);
+    tcg_out_opc_reg(s, OPC_MFHI, a1, 0, 0);
+}
+
+static TCGConstraintSetIndex cset_mul2(TCGType type, unsigned flags)
+{
+    return use_mips32r6_instructions ? C_NotImplemented : C_O2_I2(r, r, r, r);
+}
+
+static const TCGOutOpMul2 outop_muls2 = {
+    .base.static_constraint = C_Dynamic,
+    .base.dynamic_constraint = cset_mul2,
+    .out_rrrr = tgen_muls2,
+};
+
 static void tgen_mulsh(TCGContext *s, TCGType type,
                        TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -2161,15 +2181,9 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_ldst(s, i1, a0, a1, a2);
         break;
 
-    case INDEX_op_muls2_i32:
-        i1 = OPC_MULT;
-        goto do_hilo2;
     case INDEX_op_mulu2_i32:
         i1 = OPC_MULTU;
         goto do_hilo2;
-    case INDEX_op_muls2_i64:
-        i1 = OPC_DMULT;
-        goto do_hilo2;
     case INDEX_op_mulu2_i64:
         i1 = OPC_DMULTU;
     do_hilo2:
@@ -2347,9 +2361,7 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_setcond_i32:
     case INDEX_op_setcond_i64:
         return C_O1_I2(r, rz, rz);
-    case INDEX_op_muls2_i32:
     case INDEX_op_mulu2_i32:
-    case INDEX_op_muls2_i64:
     case INDEX_op_mulu2_i64:
         return C_O2_I2(r, r, r, r);
 
diff --git a/tcg/ppc/tcg-target-has.h b/tcg/ppc/tcg-target-has.h
index f071435d98..e711aa0731 100644
--- a/tcg/ppc/tcg-target-has.h
+++ b/tcg/ppc/tcg-target-has.h
@@ -22,7 +22,6 @@
 #define TCG_TARGET_HAS_extract2_i32     0
 #define TCG_TARGET_HAS_negsetcond_i32   1
 #define TCG_TARGET_HAS_mulu2_i32        0
-#define TCG_TARGET_HAS_muls2_i32        0
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
 #if TCG_TARGET_REG_BITS == 64
@@ -37,7 +36,6 @@
 #define TCG_TARGET_HAS_add2_i64         1
 #define TCG_TARGET_HAS_sub2_i64         1
 #define TCG_TARGET_HAS_mulu2_i64        0
-#define TCG_TARGET_HAS_muls2_i64        0
 #endif
 
 #define TCG_TARGET_HAS_qemu_ldst_i128   \
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index ab56c623c7..d4e34e3e7d 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -3079,6 +3079,10 @@ static const TCGOutOpBinary outop_mul = {
     .out_rri = tgen_muli,
 };
 
+static const TCGOutOpMul2 outop_muls2 = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static void tgen_mulsh(TCGContext *s, TCGType type,
                        TCGReg a0, TCGReg a1, TCGReg a2)
 {
diff --git a/tcg/riscv/tcg-target-has.h b/tcg/riscv/tcg-target-has.h
index a3b634570b..7e260da61e 100644
--- a/tcg/riscv/tcg-target-has.h
+++ b/tcg/riscv/tcg-target-has.h
@@ -15,7 +15,6 @@
 #define TCG_TARGET_HAS_add2_i32         1
 #define TCG_TARGET_HAS_sub2_i32         1
 #define TCG_TARGET_HAS_mulu2_i32        0
-#define TCG_TARGET_HAS_muls2_i32        0
 #define TCG_TARGET_HAS_bswap16_i32      (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_bswap32_i32      (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_qemu_st8_i32     0
@@ -29,7 +28,6 @@
 #define TCG_TARGET_HAS_add2_i64         1
 #define TCG_TARGET_HAS_sub2_i64         1
 #define TCG_TARGET_HAS_mulu2_i64        0
-#define TCG_TARGET_HAS_muls2_i64        0
 
 #define TCG_TARGET_HAS_qemu_ldst_i128   0
 
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index a5cd18c99e..316621b285 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -2117,6 +2117,10 @@ static const TCGOutOpBinary outop_mul = {
     .out_rrr = tgen_mul,
 };
 
+static const TCGOutOpMul2 outop_muls2 = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static TCGConstraintSetIndex cset_mulh(TCGType type, unsigned flags)
 {
     return type == TCG_TYPE_I32 ? C_NotImplemented : C_O1_I2(r, r, r);
diff --git a/tcg/s390x/tcg-target-has.h b/tcg/s390x/tcg-target-has.h
index 87f117ce58..52a76fc0b5 100644
--- a/tcg/s390x/tcg-target-has.h
+++ b/tcg/s390x/tcg-target-has.h
@@ -36,7 +36,6 @@ extern uint64_t s390_facilities[3];
 #define TCG_TARGET_HAS_add2_i32       1
 #define TCG_TARGET_HAS_sub2_i32       1
 #define TCG_TARGET_HAS_mulu2_i32      0
-#define TCG_TARGET_HAS_muls2_i32      0
 #define TCG_TARGET_HAS_extr_i64_i32   0
 #define TCG_TARGET_HAS_qemu_st8_i32   0
 
@@ -48,7 +47,6 @@ extern uint64_t s390_facilities[3];
 #define TCG_TARGET_HAS_add2_i64       1
 #define TCG_TARGET_HAS_sub2_i64       1
 #define TCG_TARGET_HAS_mulu2_i64      1
-#define TCG_TARGET_HAS_muls2_i64      HAVE_FACILITY(MISC_INSN_EXT2)
 
 #define TCG_TARGET_HAS_qemu_ldst_i128 1
 
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index 71adb0964d..71f0eb40f8 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -2391,6 +2391,26 @@ static const TCGOutOpBinary outop_mul = {
     .out_rri = tgen_muli,
 };
 
+static void tgen_muls2(TCGContext *s, TCGType type,
+                       TCGReg a0, TCGReg a1, TCGReg a2, TCGReg a3)
+{
+    tcg_debug_assert((a1 & 1) == 0);
+    tcg_debug_assert(a0 == a1 + 1);
+    tcg_out_insn(s, RRFa, MGRK, a1, a2, a3);
+}
+
+static TCGConstraintSetIndex cset_muls2(TCGType type, unsigned flags)
+{
+    return (type == TCG_TYPE_I64 && HAVE_FACILITY(MISC_INSN_EXT2)
+            ? C_O2_I2(o, m, r, r) : C_NotImplemented);
+}
+
+static const TCGOutOpMul2 outop_muls2 = {
+    .base.static_constraint = C_Dynamic,
+    .base.dynamic_constraint = cset_muls2,
+    .out_rrrr = tgen_muls2,
+};
+
 static const TCGOutOpBinary outop_mulsh = {
     .base.static_constraint = C_NotImplemented,
 };
@@ -2846,11 +2866,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_debug_assert(args[0] == args[1] + 1);
         tcg_out_insn(s, RRE, MLGR, args[1], args[3]);
         break;
-    case INDEX_op_muls2_i64:
-        tcg_debug_assert((args[1] & 1) == 0);
-        tcg_debug_assert(args[0] == args[1] + 1);
-        tcg_out_insn(s, RRFa, MGRK, args[1], args[2], args[3]);
-        break;
 
     case INDEX_op_add2_i64:
         if (const_args[4]) {
@@ -3451,8 +3466,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 
     case INDEX_op_mulu2_i64:
         return C_O2_I2(o, m, 0, r);
-    case INDEX_op_muls2_i64:
-        return C_O2_I2(o, m, r, r);
 
     case INDEX_op_add2_i32:
     case INDEX_op_sub2_i32:
diff --git a/tcg/sparc64/tcg-target-con-set.h b/tcg/sparc64/tcg-target-con-set.h
index d90ba11443..d2ea184fa2 100644
--- a/tcg/sparc64/tcg-target-con-set.h
+++ b/tcg/sparc64/tcg-target-con-set.h
@@ -17,5 +17,6 @@ C_O1_I2(r, r, r)
 C_O1_I2(r, r, rJ)
 C_O1_I2(r, rz, rJ)
 C_O1_I4(r, rz, rJ, rI, 0)
+C_O2_I2(r, r, r, r)
 C_O2_I2(r, r, rz, rJ)
 C_O2_I4(r, r, rz, rz, rJ, rJ)
diff --git a/tcg/sparc64/tcg-target-has.h b/tcg/sparc64/tcg-target-has.h
index 40e54e1543..dea0941cac 100644
--- a/tcg/sparc64/tcg-target-has.h
+++ b/tcg/sparc64/tcg-target-has.h
@@ -21,7 +21,6 @@ extern bool use_vis3_instructions;
 #define TCG_TARGET_HAS_add2_i32         1
 #define TCG_TARGET_HAS_sub2_i32         1
 #define TCG_TARGET_HAS_mulu2_i32        1
-#define TCG_TARGET_HAS_muls2_i32        1
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
 #define TCG_TARGET_HAS_extr_i64_i32     0
@@ -33,7 +32,6 @@ extern bool use_vis3_instructions;
 #define TCG_TARGET_HAS_add2_i64         1
 #define TCG_TARGET_HAS_sub2_i64         1
 #define TCG_TARGET_HAS_mulu2_i64        0
-#define TCG_TARGET_HAS_muls2_i64        0
 
 #define TCG_TARGET_HAS_qemu_ldst_i128   0
 
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index 43ca23f593..be2072c027 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -1429,6 +1429,30 @@ static const TCGOutOpBinary outop_mul = {
     .out_rri = tgen_muli,
 };
 
+/*
+ * The 32-bit multiply insns produce a full 64-bit result.
+ * Supporting 32-bit mul[us]2 opcodes avoids sign/zero-extensions
+ * before the actual multiply; we only need extract the high part
+ * into the separate operand.
+ */
+static TCGConstraintSetIndex cset_mul2(TCGType type, unsigned flags)
+{
+    return type == TCG_TYPE_I32 ? C_O2_I2(r, r, r, r) : C_NotImplemented;
+}
+
+static void tgen_muls2(TCGContext *s, TCGType type,
+                       TCGReg a0, TCGReg a1, TCGReg a2, TCGReg a3)
+{
+    tcg_out_arith(s, a0, a2, a3, ARITH_SMUL);
+    tcg_out_arithi(s, a1, a0, 32, SHIFT_SRLX);
+}
+
+static const TCGOutOpMul2 outop_muls2 = {
+    .base.static_constraint = C_Dynamic,
+    .base.dynamic_constraint = cset_mul2,
+    .out_rrrr = tgen_muls2,
+};
+
 static const TCGOutOpBinary outop_mulsh = {
     .base.static_constraint = C_NotImplemented,
 };
@@ -1696,10 +1720,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         break;
     case INDEX_op_mulu2_i32:
         c = ARITH_UMUL;
-        goto do_mul2;
-    case INDEX_op_muls2_i32:
-        c = ARITH_SMUL;
-    do_mul2:
         /* The 32-bit multiply insns produce a full 64-bit result. */
         tcg_out_arithc(s, a0, a2, args[3], const_args[3], c);
         tcg_out_arithi(s, a1, a0, 32, SHIFT_SRLX);
@@ -1828,7 +1848,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_sub2_i64:
         return C_O2_I4(r, r, rz, rz, rJ, rJ);
     case INDEX_op_mulu2_i32:
-    case INDEX_op_muls2_i32:
         return C_O2_I2(r, r, rz, rJ);
 
     default:
diff --git a/tcg/tcg-has.h b/tcg/tcg-has.h
index 97f4e83303..ac387b2544 100644
--- a/tcg/tcg-has.h
+++ b/tcg/tcg-has.h
@@ -20,7 +20,6 @@
 #define TCG_TARGET_HAS_add2_i64         0
 #define TCG_TARGET_HAS_sub2_i64         0
 #define TCG_TARGET_HAS_mulu2_i64        0
-#define TCG_TARGET_HAS_muls2_i64        0
 /* Turn some undef macros into true macros.  */
 #define TCG_TARGET_HAS_add2_i32         1
 #define TCG_TARGET_HAS_sub2_i32         1
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index 0eeec47b83..8a0846a8d2 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -1162,7 +1162,7 @@ void tcg_gen_mulu2_i32(TCGv_i32 rl, TCGv_i32 rh, TCGv_i32 arg1, TCGv_i32 arg2)
 
 void tcg_gen_muls2_i32(TCGv_i32 rl, TCGv_i32 rh, TCGv_i32 arg1, TCGv_i32 arg2)
 {
-    if (TCG_TARGET_HAS_muls2_i32) {
+    if (tcg_op_supported(INDEX_op_muls2_i32, TCG_TYPE_I32, 0)) {
         tcg_gen_op4_i32(INDEX_op_muls2_i32, rl, rh, arg1, arg2);
     } else if (tcg_op_supported(INDEX_op_mulsh, TCG_TYPE_I32, 0)) {
         TCGv_i32 t = tcg_temp_ebb_new_i32();
@@ -2880,7 +2880,7 @@ void tcg_gen_mulu2_i64(TCGv_i64 rl, TCGv_i64 rh, TCGv_i64 arg1, TCGv_i64 arg2)
 
 void tcg_gen_muls2_i64(TCGv_i64 rl, TCGv_i64 rh, TCGv_i64 arg1, TCGv_i64 arg2)
 {
-    if (TCG_TARGET_HAS_muls2_i64) {
+    if (tcg_op_supported(INDEX_op_muls2_i64, TCG_TYPE_I64, 0)) {
         tcg_gen_op4_i64(INDEX_op_muls2_i64, rl, rh, arg1, arg2);
     } else if (tcg_op_supported(INDEX_op_mulsh, TCG_TYPE_I64, 0)) {
         TCGv_i64 t = tcg_temp_ebb_new_i64();
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 5b6af803b2..b1efc44725 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -992,6 +992,12 @@ typedef struct TCGOutOpDivRem {
                       TCGReg a0, TCGReg a1, TCGReg a4);
 } TCGOutOpDivRem;
 
+typedef struct TCGOutOpMul2 {
+    TCGOutOp base;
+    void (*out_rrrr)(TCGContext *s, TCGType type,
+                     TCGReg a0, TCGReg a1, TCGReg a2, TCGReg a3);
+} TCGOutOpMul2;
+
 typedef struct TCGOutOpUnary {
     TCGOutOp base;
     void (*out_rr)(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1);
@@ -1035,6 +1041,8 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_divu2, TCGOutOpDivRem, outop_divu2),
     OUTOP(INDEX_op_eqv, TCGOutOpBinary, outop_eqv),
     OUTOP(INDEX_op_mul, TCGOutOpBinary, outop_mul),
+    OUTOP(INDEX_op_muls2_i32, TCGOutOpMul2, outop_muls2),
+    OUTOP(INDEX_op_muls2_i64, TCGOutOpMul2, outop_muls2),
     OUTOP(INDEX_op_mulsh, TCGOutOpBinary, outop_mulsh),
     OUTOP(INDEX_op_muluh, TCGOutOpBinary, outop_muluh),
     OUTOP(INDEX_op_nand, TCGOutOpBinary, outop_nand),
@@ -2285,8 +2293,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
         return TCG_TARGET_HAS_sub2_i32;
     case INDEX_op_mulu2_i32:
         return TCG_TARGET_HAS_mulu2_i32;
-    case INDEX_op_muls2_i32:
-        return TCG_TARGET_HAS_muls2_i32;
     case INDEX_op_bswap16_i32:
         return TCG_TARGET_HAS_bswap16_i32;
     case INDEX_op_bswap32_i32:
@@ -2336,8 +2342,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
         return TCG_TARGET_HAS_sub2_i64;
     case INDEX_op_mulu2_i64:
         return TCG_TARGET_HAS_mulu2_i64;
-    case INDEX_op_muls2_i64:
-        return TCG_TARGET_HAS_muls2_i64;
 
     case INDEX_op_mov_vec:
     case INDEX_op_dup_vec:
@@ -5473,6 +5477,20 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
         }
         break;
 
+    case INDEX_op_muls2_i32:
+    case INDEX_op_muls2_i64:
+        {
+            const TCGOutOpMul2 *out =
+                container_of(all_outop[op->opc], TCGOutOpMul2, base);
+
+            tcg_debug_assert(!const_args[2]);
+            tcg_debug_assert(!const_args[3]);
+            out->out_rrrr(s, type, new_args[0], new_args[1],
+                          new_args[2], new_args[3]);
+        }
+        break;
+
+
     default:
         if (def->flags & TCG_OPF_VECTOR) {
             tcg_out_vec_op(s, op->opc, type - TCG_TYPE_V64,
diff --git a/tcg/tci.c b/tcg/tci.c
index d58a94ff28..51cbb5760a 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -581,6 +581,16 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_args_rr(insn, &r0, &r1);
             regs[r0] = ctpop_tr(regs[r1]);
             break;
+        case INDEX_op_muls2_i32:
+        case INDEX_op_muls2_i64:
+            tci_args_rrrr(insn, &r0, &r1, &r2, &r3);
+#if TCG_TARGET_REG_BITS == 32
+            tmp64 = (int64_t)(int32_t)regs[r2] * (int32_t)regs[r3];
+            tci_write_reg64(regs, r1, r0, tmp64);
+#else
+            muls64(&regs[r0], &regs[r1], regs[r2], regs[r3]);
+#endif
+            break;
 
             /* Arithmetic operations (32 bit). */
 
@@ -675,13 +685,6 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_write_reg64(regs, r1, r0, tmp64);
             break;
 #endif
-#if TCG_TARGET_HAS_muls2_i32
-        case INDEX_op_muls2_i32:
-            tci_args_rrrr(insn, &r0, &r1, &r2, &r3);
-            tmp64 = (int64_t)(int32_t)regs[r2] * (int32_t)regs[r3];
-            tci_write_reg64(regs, r1, r0, tmp64);
-            break;
-#endif
 #if TCG_TARGET_HAS_bswap16_i32 || TCG_TARGET_HAS_bswap16_i64
         CASE_32_64(bswap16)
             tci_args_rr(insn, &r0, &r1);
@@ -745,12 +748,6 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             mulu64(&regs[r0], &regs[r1], regs[r2], regs[r3]);
             break;
 #endif
-#if TCG_TARGET_HAS_muls2_i64
-        case INDEX_op_muls2_i64:
-            tci_args_rrrr(insn, &r0, &r1, &r2, &r3);
-            muls64(&regs[r0], &regs[r1], regs[r2], regs[r3]);
-            break;
-#endif
 #if TCG_TARGET_HAS_add2_i64
         case INDEX_op_add2_i64:
             tci_args_rrrrrr(insn, &r0, &r1, &r2, &r3, &r4, &r5);
diff --git a/tcg/tci/tcg-target-has.h b/tcg/tci/tcg-target-has.h
index 774fb149fc..a3d04b0ee2 100644
--- a/tcg/tci/tcg-target-has.h
+++ b/tcg/tci/tcg-target-has.h
@@ -11,7 +11,6 @@
 #define TCG_TARGET_HAS_bswap32_i32      1
 #define TCG_TARGET_HAS_extract2_i32     0
 #define TCG_TARGET_HAS_negsetcond_i32   0
-#define TCG_TARGET_HAS_muls2_i32        1
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
 #if TCG_TARGET_REG_BITS == 64
@@ -21,7 +20,6 @@
 #define TCG_TARGET_HAS_bswap64_i64      1
 #define TCG_TARGET_HAS_extract2_i64     0
 #define TCG_TARGET_HAS_negsetcond_i64   0
-#define TCG_TARGET_HAS_muls2_i64        1
 #define TCG_TARGET_HAS_add2_i32         1
 #define TCG_TARGET_HAS_sub2_i32         1
 #define TCG_TARGET_HAS_mulu2_i32        1
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index 1d696a087e..f568d4edb9 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -100,8 +100,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 
     case INDEX_op_mulu2_i32:
     case INDEX_op_mulu2_i64:
-    case INDEX_op_muls2_i32:
-    case INDEX_op_muls2_i64:
         return C_O2_I2(r, r, r, r);
 
     case INDEX_op_movcond_i32:
@@ -710,6 +708,24 @@ static const TCGOutOpBinary outop_mul = {
     .out_rrr = tgen_mul,
 };
 
+static TCGConstraintSetIndex cset_mul2(TCGType type, unsigned flags)
+{
+    return type == TCG_TYPE_REG ? C_O2_I2(r, r, r, r) : C_NotImplemented;
+}
+
+static void tgen_muls2(TCGContext *s, TCGType type,
+                       TCGReg a0, TCGReg a1, TCGReg a2, TCGReg a3)
+{
+    tcg_out_op_rrrr(s, glue(INDEX_op_muls2_i,TCG_TARGET_REG_BITS),
+                    a0, a1, a2, a3);
+}
+
+static const TCGOutOpMul2 outop_muls2 = {
+    .base.static_constraint = C_Dynamic,
+    .base.dynamic_constraint = cset_mul2,
+    .out_rrrr = tgen_muls2,
+};
+
 static const TCGOutOpBinary outop_mulsh = {
     .base.static_constraint = C_NotImplemented,
 };
@@ -1009,7 +1025,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
 #endif
 
     CASE_32_64(mulu2)
-    CASE_32_64(muls2)
         tcg_out_op_rrrr(s, opc, args[0], args[1], args[2], args[3]);
         break;
 

From bfe964809bf6ce951b2e674929d7b730c754e298 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 9 Jan 2025 07:24:32 -0800
Subject: [PATCH 0428/2760] tcg: Merge INDEX_op_muls2_{i32,i64}
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 docs/devel/tcg-ops.rst   |  2 +-
 include/tcg/tcg-opc.h    |  3 +--
 tcg/optimize.c           | 17 +++++++++--------
 tcg/tcg-op.c             |  8 ++++----
 tcg/tcg.c                |  9 +++------
 tcg/tci.c                |  6 ++----
 tcg/tci/tcg-target.c.inc |  3 +--
 7 files changed, 21 insertions(+), 27 deletions(-)

diff --git a/docs/devel/tcg-ops.rst b/docs/devel/tcg-ops.rst
index fb7764e3c0..0394767291 100644
--- a/docs/devel/tcg-ops.rst
+++ b/docs/devel/tcg-ops.rst
@@ -604,7 +604,7 @@ Multiword arithmetic support
      - | Similar to mul, except two unsigned inputs *t1* and *t2* yielding the full
          double-word product *t0*. The latter is returned in two single-word outputs.
 
-   * - muls2_i32/i64 *t0_low*, *t0_high*, *t1*, *t2*
+   * - muls2 *t0_low*, *t0_high*, *t1*, *t2*
 
      - | Similar to mulu2, except the two inputs *t1* and *t2* are signed.
 
diff --git a/include/tcg/tcg-opc.h b/include/tcg/tcg-opc.h
index f4ccde074b..a45b22ca1a 100644
--- a/include/tcg/tcg-opc.h
+++ b/include/tcg/tcg-opc.h
@@ -51,6 +51,7 @@ DEF(divu, 1, 2, 0, TCG_OPF_INT)
 DEF(divu2, 2, 3, 0, TCG_OPF_INT)
 DEF(eqv, 1, 2, 0, TCG_OPF_INT)
 DEF(mul, 1, 2, 0, TCG_OPF_INT)
+DEF(muls2, 2, 2, 0, TCG_OPF_INT)
 DEF(mulsh, 1, 2, 0, TCG_OPF_INT)
 DEF(muluh, 1, 2, 0, TCG_OPF_INT)
 DEF(nand, 1, 2, 0, TCG_OPF_INT)
@@ -92,7 +93,6 @@ DEF(brcond_i32, 0, 2, 2, TCG_OPF_BB_END | TCG_OPF_COND_BRANCH)
 DEF(add2_i32, 2, 4, 0, 0)
 DEF(sub2_i32, 2, 4, 0, 0)
 DEF(mulu2_i32, 2, 2, 0, 0)
-DEF(muls2_i32, 2, 2, 0, 0)
 DEF(brcond2_i32, 0, 4, 2, TCG_OPF_BB_END | TCG_OPF_COND_BRANCH)
 DEF(setcond2_i32, 1, 4, 1, 0)
 
@@ -134,7 +134,6 @@ DEF(bswap64_i64, 1, 1, 1, 0)
 DEF(add2_i64, 2, 4, 0, 0)
 DEF(sub2_i64, 2, 4, 0, 0)
 DEF(mulu2_i64, 2, 2, 0, 0)
-DEF(muls2_i64, 2, 2, 0, 0)
 
 #define DATA64_ARGS  (TCG_TARGET_REG_BITS == 64 ? 1 : 2)
 
diff --git a/tcg/optimize.c b/tcg/optimize.c
index bf625f770c..756f681e88 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -2074,16 +2074,17 @@ static bool fold_multiply2(OptContext *ctx, TCGOp *op)
             h = (int32_t)(l >> 32);
             l = (int32_t)l;
             break;
-        case INDEX_op_muls2_i32:
-            l = (int64_t)(int32_t)a * (int32_t)b;
-            h = l >> 32;
-            l = (int32_t)l;
-            break;
         case INDEX_op_mulu2_i64:
             mulu64(&l, &h, a, b);
             break;
-        case INDEX_op_muls2_i64:
-            muls64(&l, &h, a, b);
+        case INDEX_op_muls2:
+            if (ctx->type == TCG_TYPE_I32) {
+                l = (int64_t)(int32_t)a * (int32_t)b;
+                h = l >> 32;
+                l = (int32_t)l;
+            } else {
+                muls64(&l, &h, a, b);
+            }
             break;
         default:
             g_assert_not_reached();
@@ -2973,7 +2974,7 @@ void tcg_optimize(TCGContext *s)
         case INDEX_op_muluh:
             done = fold_mul_highpart(&ctx, op);
             break;
-        CASE_OP_32_64(muls2):
+        case INDEX_op_muls2:
         CASE_OP_32_64(mulu2):
             done = fold_multiply2(&ctx, op);
             break;
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index 8a0846a8d2..0f48484dfe 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -1162,8 +1162,8 @@ void tcg_gen_mulu2_i32(TCGv_i32 rl, TCGv_i32 rh, TCGv_i32 arg1, TCGv_i32 arg2)
 
 void tcg_gen_muls2_i32(TCGv_i32 rl, TCGv_i32 rh, TCGv_i32 arg1, TCGv_i32 arg2)
 {
-    if (tcg_op_supported(INDEX_op_muls2_i32, TCG_TYPE_I32, 0)) {
-        tcg_gen_op4_i32(INDEX_op_muls2_i32, rl, rh, arg1, arg2);
+    if (tcg_op_supported(INDEX_op_muls2, TCG_TYPE_I32, 0)) {
+        tcg_gen_op4_i32(INDEX_op_muls2, rl, rh, arg1, arg2);
     } else if (tcg_op_supported(INDEX_op_mulsh, TCG_TYPE_I32, 0)) {
         TCGv_i32 t = tcg_temp_ebb_new_i32();
         tcg_gen_op3_i32(INDEX_op_mul, t, arg1, arg2);
@@ -2880,8 +2880,8 @@ void tcg_gen_mulu2_i64(TCGv_i64 rl, TCGv_i64 rh, TCGv_i64 arg1, TCGv_i64 arg2)
 
 void tcg_gen_muls2_i64(TCGv_i64 rl, TCGv_i64 rh, TCGv_i64 arg1, TCGv_i64 arg2)
 {
-    if (tcg_op_supported(INDEX_op_muls2_i64, TCG_TYPE_I64, 0)) {
-        tcg_gen_op4_i64(INDEX_op_muls2_i64, rl, rh, arg1, arg2);
+    if (tcg_op_supported(INDEX_op_muls2, TCG_TYPE_I64, 0)) {
+        tcg_gen_op4_i64(INDEX_op_muls2, rl, rh, arg1, arg2);
     } else if (tcg_op_supported(INDEX_op_mulsh, TCG_TYPE_I64, 0)) {
         TCGv_i64 t = tcg_temp_ebb_new_i64();
         tcg_gen_op3_i64(INDEX_op_mul, t, arg1, arg2);
diff --git a/tcg/tcg.c b/tcg/tcg.c
index b1efc44725..5b22c75d2e 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1041,8 +1041,7 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_divu2, TCGOutOpDivRem, outop_divu2),
     OUTOP(INDEX_op_eqv, TCGOutOpBinary, outop_eqv),
     OUTOP(INDEX_op_mul, TCGOutOpBinary, outop_mul),
-    OUTOP(INDEX_op_muls2_i32, TCGOutOpMul2, outop_muls2),
-    OUTOP(INDEX_op_muls2_i64, TCGOutOpMul2, outop_muls2),
+    OUTOP(INDEX_op_muls2, TCGOutOpMul2, outop_muls2),
     OUTOP(INDEX_op_mulsh, TCGOutOpBinary, outop_mulsh),
     OUTOP(INDEX_op_muluh, TCGOutOpBinary, outop_muluh),
     OUTOP(INDEX_op_nand, TCGOutOpBinary, outop_nand),
@@ -4008,8 +4007,7 @@ liveness_pass_1(TCGContext *s)
             }
             goto do_not_remove;
 
-        case INDEX_op_muls2_i32:
-        case INDEX_op_muls2_i64:
+        case INDEX_op_muls2:
             opc_new = INDEX_op_mul;
             opc_new2 = INDEX_op_mulsh;
             goto do_mul2;
@@ -5477,8 +5475,7 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
         }
         break;
 
-    case INDEX_op_muls2_i32:
-    case INDEX_op_muls2_i64:
+    case INDEX_op_muls2:
         {
             const TCGOutOpMul2 *out =
                 container_of(all_outop[op->opc], TCGOutOpMul2, base);
diff --git a/tcg/tci.c b/tcg/tci.c
index 51cbb5760a..708ded34c7 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -581,8 +581,7 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_args_rr(insn, &r0, &r1);
             regs[r0] = ctpop_tr(regs[r1]);
             break;
-        case INDEX_op_muls2_i32:
-        case INDEX_op_muls2_i64:
+        case INDEX_op_muls2:
             tci_args_rrrr(insn, &r0, &r1, &r2, &r3);
 #if TCG_TARGET_REG_BITS == 32
             tmp64 = (int64_t)(int32_t)regs[r2] * (int32_t)regs[r3];
@@ -1095,10 +1094,9 @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
                            str_r(r3), str_r(r4), str_c(c));
         break;
 
+    case INDEX_op_muls2:
     case INDEX_op_mulu2_i32:
     case INDEX_op_mulu2_i64:
-    case INDEX_op_muls2_i32:
-    case INDEX_op_muls2_i64:
         tci_args_rrrr(insn, &r0, &r1, &r2, &r3);
         info->fprintf_func(info->stream, "%-12s  %s, %s, %s, %s",
                            op_name, str_r(r0), str_r(r1),
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index f568d4edb9..aa3ce929b4 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -716,8 +716,7 @@ static TCGConstraintSetIndex cset_mul2(TCGType type, unsigned flags)
 static void tgen_muls2(TCGContext *s, TCGType type,
                        TCGReg a0, TCGReg a1, TCGReg a2, TCGReg a3)
 {
-    tcg_out_op_rrrr(s, glue(INDEX_op_muls2_i,TCG_TARGET_REG_BITS),
-                    a0, a1, a2, a3);
+    tcg_out_op_rrrr(s, INDEX_op_muls2, a0, a1, a2, a3);
 }
 
 static const TCGOutOpMul2 outop_muls2 = {

From d37bc370fcad08698e4b6de99184361a2cf71ac0 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 9 Jan 2025 08:59:52 -0800
Subject: [PATCH 0429/2760] tcg: Convert mulu2 to TCGOutOpMul2

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target-has.h     |  2 --
 tcg/aarch64/tcg-target.c.inc     |  4 ++++
 tcg/arm/tcg-target-has.h         |  1 -
 tcg/arm/tcg-target.c.inc         | 27 +++++++++++++--------------
 tcg/i386/tcg-target-has.h        |  2 --
 tcg/i386/tcg-target.c.inc        | 19 ++++++++++++-------
 tcg/loongarch64/tcg-target-has.h |  2 --
 tcg/loongarch64/tcg-target.c.inc |  4 ++++
 tcg/mips/tcg-target-has.h        |  2 --
 tcg/mips/tcg-target.c.inc        | 29 +++++++++++++++--------------
 tcg/ppc/tcg-target-has.h         |  2 --
 tcg/ppc/tcg-target.c.inc         |  4 ++++
 tcg/riscv/tcg-target-has.h       |  2 --
 tcg/riscv/tcg-target.c.inc       |  4 ++++
 tcg/s390x/tcg-target-has.h       |  2 --
 tcg/s390x/tcg-target.c.inc       | 31 +++++++++++++++++++++----------
 tcg/sparc64/tcg-target-con-set.h |  1 -
 tcg/sparc64/tcg-target-has.h     |  2 --
 tcg/sparc64/tcg-target.c.inc     | 23 ++++++++++++++---------
 tcg/tcg-has.h                    |  1 -
 tcg/tcg-op.c                     |  8 ++++----
 tcg/tcg.c                        |  8 ++++----
 tcg/tci.c                        | 23 ++++++++++-------------
 tcg/tci/tcg-target-has.h         |  4 ----
 tcg/tci/tcg-target.c.inc         | 21 +++++++++++++--------
 25 files changed, 122 insertions(+), 106 deletions(-)

diff --git a/tcg/aarch64/tcg-target-has.h b/tcg/aarch64/tcg-target-has.h
index c351db223d..0c370d7dda 100644
--- a/tcg/aarch64/tcg-target-has.h
+++ b/tcg/aarch64/tcg-target-has.h
@@ -19,7 +19,6 @@
 #define TCG_TARGET_HAS_negsetcond_i32   1
 #define TCG_TARGET_HAS_add2_i32         1
 #define TCG_TARGET_HAS_sub2_i32         1
-#define TCG_TARGET_HAS_mulu2_i32        0
 #define TCG_TARGET_HAS_extr_i64_i32     0
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
@@ -30,7 +29,6 @@
 #define TCG_TARGET_HAS_negsetcond_i64   1
 #define TCG_TARGET_HAS_add2_i64         1
 #define TCG_TARGET_HAS_sub2_i64         1
-#define TCG_TARGET_HAS_mulu2_i64        0
 
 /*
  * Without FEAT_LSE2, we must use LDXP+STXP to implement atomic 128-bit load,
diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index 0996c6234b..46ad91f40e 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -2226,6 +2226,10 @@ static const TCGOutOpBinary outop_mulsh = {
     .out_rrr = tgen_mulsh,
 };
 
+static const TCGOutOpMul2 outop_mulu2 = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static void tgen_muluh(TCGContext *s, TCGType type,
                        TCGReg a0, TCGReg a1, TCGReg a2)
 {
diff --git a/tcg/arm/tcg-target-has.h b/tcg/arm/tcg-target-has.h
index e1f19ffbc9..ccbc39a23e 100644
--- a/tcg/arm/tcg-target-has.h
+++ b/tcg/arm/tcg-target-has.h
@@ -28,7 +28,6 @@ extern bool use_neon_instructions;
 #define TCG_TARGET_HAS_bswap32_i32      1
 #define TCG_TARGET_HAS_extract2_i32     1
 #define TCG_TARGET_HAS_negsetcond_i32   1
-#define TCG_TARGET_HAS_mulu2_i32        1
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
 #define TCG_TARGET_HAS_qemu_ldst_i128   0
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index 8c0bc78be3..55e9f66340 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -921,14 +921,6 @@ static void tcg_out_dat_rIN(TCGContext *s, ARMCond cond, ARMInsn opc,
     }
 }
 
-static void tcg_out_umull32(TCGContext *s, ARMCond cond, TCGReg rd0,
-                            TCGReg rd1, TCGReg rn, TCGReg rm)
-{
-    /* umull */
-    tcg_out32(s, (cond << 28) | 0x00800090 |
-              (rd1 << 16) | (rd0 << 12) | (rm << 8) | rn);
-}
-
 static void tcg_out_ext8s(TCGContext *s, TCGType t, TCGReg rd, TCGReg rn)
 {
     /* sxtb */
@@ -1982,6 +1974,19 @@ static const TCGOutOpBinary outop_mulsh = {
     .base.static_constraint = C_NotImplemented,
 };
 
+static void tgen_mulu2(TCGContext *s, TCGType type,
+                       TCGReg rd0, TCGReg rd1, TCGReg rn, TCGReg rm)
+{
+    /* umull */
+    tcg_out32(s, (COND_AL << 28) | 0x00800090 |
+              (rd1 << 16) | (rd0 << 12) | (rm << 8) | rn);
+}
+
+static const TCGOutOpMul2 outop_mulu2 = {
+    .base.static_constraint = C_O2_I2(r, r, r, r),
+    .out_rrrr = tgen_mulu2,
+};
+
 static const TCGOutOpBinary outop_muluh = {
     .base.static_constraint = C_NotImplemented,
 };
@@ -2248,9 +2253,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         tcg_out_mov_reg(s, COND_AL, args[0], a0);
         break;
-    case INDEX_op_mulu2_i32:
-        tcg_out_umull32(s, COND_AL, args[0], args[1], args[2], args[3]);
-        break;
 
     case INDEX_op_brcond_i32:
         c = tcg_out_cmp(s, args[2], args[0], args[1], const_args[1]);
@@ -2374,9 +2376,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_negsetcond_i32:
         return C_O1_I2(r, r, rIN);
 
-    case INDEX_op_mulu2_i32:
-        return C_O2_I2(r, r, r, r);
-
     case INDEX_op_brcond_i32:
         return C_O0_I2(r, rIN);
     case INDEX_op_deposit_i32:
diff --git a/tcg/i386/tcg-target-has.h b/tcg/i386/tcg-target-has.h
index d63b3a3a89..c92a049fd7 100644
--- a/tcg/i386/tcg-target-has.h
+++ b/tcg/i386/tcg-target-has.h
@@ -32,7 +32,6 @@
 #define TCG_TARGET_HAS_negsetcond_i32   1
 #define TCG_TARGET_HAS_add2_i32         1
 #define TCG_TARGET_HAS_sub2_i32         1
-#define TCG_TARGET_HAS_mulu2_i32        1
 
 #if TCG_TARGET_REG_BITS == 64
 /* Keep 32-bit values zero-extended in a register.  */
@@ -44,7 +43,6 @@
 #define TCG_TARGET_HAS_negsetcond_i64   1
 #define TCG_TARGET_HAS_add2_i64         1
 #define TCG_TARGET_HAS_sub2_i64         1
-#define TCG_TARGET_HAS_mulu2_i64        1
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 #else
 #define TCG_TARGET_HAS_qemu_st8_i32     1
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index 43d63cab5c..d1b37c4388 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -2763,6 +2763,18 @@ static const TCGOutOpBinary outop_muluh = {
     .base.static_constraint = C_NotImplemented,
 };
 
+static void tgen_mulu2(TCGContext *s, TCGType type,
+                       TCGReg a0, TCGReg a1, TCGReg a2, TCGReg a3)
+{
+    int rexw = type == TCG_TYPE_I32 ? 0 : P_REXW;
+    tcg_out_modrm(s, OPC_GRP3_Ev + rexw, EXT3_MUL, a3);
+}
+
+static const TCGOutOpMul2 outop_mulu2 = {
+    .base.static_constraint = C_O2_I2(a, d, a, r),
+    .out_rrrr = tgen_mulu2,
+};
+
 static const TCGOutOpBinary outop_nand = {
     .base.static_constraint = C_NotImplemented,
 };
@@ -3145,9 +3157,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_qemu_st(s, a0, a1, a2, args[3], TCG_TYPE_I128);
         break;
 
-    OP_32_64(mulu2):
-        tcg_out_modrm(s, OPC_GRP3_Ev + rexw, EXT3_MUL, args[3]);
-        break;
     OP_32_64(add2):
         if (const_args[4]) {
             tgen_arithi(s, ARITH_ADD + rexw, a0, args[4], 1);
@@ -3935,10 +3944,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_movcond_i64:
         return C_O1_I4(r, r, reT, r, 0);
 
-    case INDEX_op_mulu2_i32:
-    case INDEX_op_mulu2_i64:
-        return C_O2_I2(a, d, a, r);
-
     case INDEX_op_add2_i32:
     case INDEX_op_add2_i64:
     case INDEX_op_sub2_i32:
diff --git a/tcg/loongarch64/tcg-target-has.h b/tcg/loongarch64/tcg-target-has.h
index 491ebf0d06..12a721b4da 100644
--- a/tcg/loongarch64/tcg-target-has.h
+++ b/tcg/loongarch64/tcg-target-has.h
@@ -14,7 +14,6 @@
 #define TCG_TARGET_HAS_extract2_i32     0
 #define TCG_TARGET_HAS_add2_i32         0
 #define TCG_TARGET_HAS_sub2_i32         0
-#define TCG_TARGET_HAS_mulu2_i32        0
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
 #define TCG_TARGET_HAS_qemu_st8_i32     0
@@ -28,7 +27,6 @@
 #define TCG_TARGET_HAS_bswap64_i64      1
 #define TCG_TARGET_HAS_add2_i64         0
 #define TCG_TARGET_HAS_sub2_i64         0
-#define TCG_TARGET_HAS_mulu2_i64        0
 
 #define TCG_TARGET_HAS_qemu_ldst_i128   (cpuinfo & CPUINFO_LSX)
 
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index 95a0614e6e..fa9da82df8 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -1440,6 +1440,10 @@ static const TCGOutOpBinary outop_mulsh = {
     .out_rrr = tgen_mulsh,
 };
 
+static const TCGOutOpMul2 outop_mulu2 = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static void tgen_muluh(TCGContext *s, TCGType type,
                        TCGReg a0, TCGReg a1, TCGReg a2)
 {
diff --git a/tcg/mips/tcg-target-has.h b/tcg/mips/tcg-target-has.h
index fd0b674402..05701fd228 100644
--- a/tcg/mips/tcg-target-has.h
+++ b/tcg/mips/tcg-target-has.h
@@ -39,7 +39,6 @@ extern bool use_mips32r2_instructions;
 #endif
 
 /* optional instructions */
-#define TCG_TARGET_HAS_mulu2_i32        (!use_mips32r6_instructions)
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
 #define TCG_TARGET_HAS_negsetcond_i32   0
@@ -50,7 +49,6 @@ extern bool use_mips32r2_instructions;
 #define TCG_TARGET_HAS_extr_i64_i32     1
 #define TCG_TARGET_HAS_add2_i64         0
 #define TCG_TARGET_HAS_sub2_i64         0
-#define TCG_TARGET_HAS_mulu2_i64        (!use_mips32r6_instructions)
 #define TCG_TARGET_HAS_ext32s_i64       1
 #define TCG_TARGET_HAS_ext32u_i64       1
 #define TCG_TARGET_HAS_negsetcond_i64   0
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index a1f9efb18b..6a97264c7c 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -1861,6 +1861,21 @@ static const TCGOutOpBinary outop_mulsh = {
     .out_rrr = tgen_mulsh,
 };
 
+static void tgen_mulu2(TCGContext *s, TCGType type,
+                       TCGReg a0, TCGReg a1, TCGReg a2, TCGReg a3)
+{
+    MIPSInsn insn = type == TCG_TYPE_I32 ? OPC_MULTU : OPC_DMULTU;
+    tcg_out_opc_reg(s, insn, 0, a2, a3);
+    tcg_out_opc_reg(s, OPC_MFLO, a0, 0, 0);
+    tcg_out_opc_reg(s, OPC_MFHI, a1, 0, 0);
+}
+
+static const TCGOutOpMul2 outop_mulu2 = {
+    .base.static_constraint = C_Dynamic,
+    .base.dynamic_constraint = cset_mul2,
+    .out_rrrr = tgen_mulu2,
+};
+
 static void tgen_muluh(TCGContext *s, TCGType type,
                        TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -2181,17 +2196,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_ldst(s, i1, a0, a1, a2);
         break;
 
-    case INDEX_op_mulu2_i32:
-        i1 = OPC_MULTU;
-        goto do_hilo2;
-    case INDEX_op_mulu2_i64:
-        i1 = OPC_DMULTU;
-    do_hilo2:
-        tcg_out_opc_reg(s, i1, 0, a2, args[3]);
-        tcg_out_opc_reg(s, OPC_MFLO, a0, 0, 0);
-        tcg_out_opc_reg(s, OPC_MFHI, a1, 0, 0);
-        break;
-
     case INDEX_op_bswap16_i32:
     case INDEX_op_bswap16_i64:
         tcg_out_bswap16(s, a0, a1, a2);
@@ -2361,9 +2365,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_setcond_i32:
     case INDEX_op_setcond_i64:
         return C_O1_I2(r, rz, rz);
-    case INDEX_op_mulu2_i32:
-    case INDEX_op_mulu2_i64:
-        return C_O2_I2(r, r, r, r);
 
     case INDEX_op_deposit_i32:
     case INDEX_op_deposit_i64:
diff --git a/tcg/ppc/tcg-target-has.h b/tcg/ppc/tcg-target-has.h
index e711aa0731..5cc059fe9a 100644
--- a/tcg/ppc/tcg-target-has.h
+++ b/tcg/ppc/tcg-target-has.h
@@ -21,7 +21,6 @@
 #define TCG_TARGET_HAS_bswap32_i32      1
 #define TCG_TARGET_HAS_extract2_i32     0
 #define TCG_TARGET_HAS_negsetcond_i32   1
-#define TCG_TARGET_HAS_mulu2_i32        0
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
 #if TCG_TARGET_REG_BITS == 64
@@ -35,7 +34,6 @@
 #define TCG_TARGET_HAS_negsetcond_i64   1
 #define TCG_TARGET_HAS_add2_i64         1
 #define TCG_TARGET_HAS_sub2_i64         1
-#define TCG_TARGET_HAS_mulu2_i64        0
 #endif
 
 #define TCG_TARGET_HAS_qemu_ldst_i128   \
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index d4e34e3e7d..f2cb45029f 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -3095,6 +3095,10 @@ static const TCGOutOpBinary outop_mulsh = {
     .out_rrr = tgen_mulsh,
 };
 
+static const TCGOutOpMul2 outop_mulu2 = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static void tgen_muluh(TCGContext *s, TCGType type,
                        TCGReg a0, TCGReg a1, TCGReg a2)
 {
diff --git a/tcg/riscv/tcg-target-has.h b/tcg/riscv/tcg-target-has.h
index 7e260da61e..9b86b8bf48 100644
--- a/tcg/riscv/tcg-target-has.h
+++ b/tcg/riscv/tcg-target-has.h
@@ -14,7 +14,6 @@
 #define TCG_TARGET_HAS_extract2_i32     0
 #define TCG_TARGET_HAS_add2_i32         1
 #define TCG_TARGET_HAS_sub2_i32         1
-#define TCG_TARGET_HAS_mulu2_i32        0
 #define TCG_TARGET_HAS_bswap16_i32      (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_bswap32_i32      (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_qemu_st8_i32     0
@@ -27,7 +26,6 @@
 #define TCG_TARGET_HAS_bswap64_i64      (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_add2_i64         1
 #define TCG_TARGET_HAS_sub2_i64         1
-#define TCG_TARGET_HAS_mulu2_i64        0
 
 #define TCG_TARGET_HAS_qemu_ldst_i128   0
 
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index 316621b285..071be449f6 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -2138,6 +2138,10 @@ static const TCGOutOpBinary outop_mulsh = {
     .out_rrr = tgen_mulsh,
 };
 
+static const TCGOutOpMul2 outop_mulu2 = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static void tgen_muluh(TCGContext *s, TCGType type,
                        TCGReg a0, TCGReg a1, TCGReg a2)
 {
diff --git a/tcg/s390x/tcg-target-has.h b/tcg/s390x/tcg-target-has.h
index 52a76fc0b5..894a9f64e0 100644
--- a/tcg/s390x/tcg-target-has.h
+++ b/tcg/s390x/tcg-target-has.h
@@ -35,7 +35,6 @@ extern uint64_t s390_facilities[3];
 #define TCG_TARGET_HAS_negsetcond_i32 1
 #define TCG_TARGET_HAS_add2_i32       1
 #define TCG_TARGET_HAS_sub2_i32       1
-#define TCG_TARGET_HAS_mulu2_i32      0
 #define TCG_TARGET_HAS_extr_i64_i32   0
 #define TCG_TARGET_HAS_qemu_st8_i32   0
 
@@ -46,7 +45,6 @@ extern uint64_t s390_facilities[3];
 #define TCG_TARGET_HAS_negsetcond_i64 1
 #define TCG_TARGET_HAS_add2_i64       1
 #define TCG_TARGET_HAS_sub2_i64       1
-#define TCG_TARGET_HAS_mulu2_i64      1
 
 #define TCG_TARGET_HAS_qemu_ldst_i128 1
 
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index 71f0eb40f8..18b83d5899 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -2415,6 +2415,27 @@ static const TCGOutOpBinary outop_mulsh = {
     .base.static_constraint = C_NotImplemented,
 };
 
+static void tgen_mulu2(TCGContext *s, TCGType type,
+                       TCGReg a0, TCGReg a1, TCGReg a2, TCGReg a3)
+{
+    tcg_debug_assert(a0 == a2);
+    tcg_debug_assert((a1 & 1) == 0);
+    tcg_debug_assert(a0 == a1 + 1);
+    tcg_out_insn(s, RRE, MLGR, a1, a3);
+}
+
+static TCGConstraintSetIndex cset_mulu2(TCGType type, unsigned flags)
+{
+    return (type == TCG_TYPE_I64 && HAVE_FACILITY(MISC_INSN_EXT2)
+            ? C_O2_I2(o, m, 0, r) : C_NotImplemented);
+}
+
+static const TCGOutOpMul2 outop_mulu2 = {
+    .base.static_constraint = C_Dynamic,
+    .base.dynamic_constraint = cset_mulu2,
+    .out_rrrr = tgen_mulu2,
+};
+
 static const TCGOutOpBinary outop_muluh = {
     .base.static_constraint = C_NotImplemented,
 };
@@ -2860,13 +2881,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_insn(s, RRE, LRVGR, args[0], args[1]);
         break;
 
-    case INDEX_op_mulu2_i64:
-        tcg_debug_assert(args[0] == args[2]);
-        tcg_debug_assert((args[1] & 1) == 0);
-        tcg_debug_assert(args[0] == args[1] + 1);
-        tcg_out_insn(s, RRE, MLGR, args[1], args[3]);
-        break;
-
     case INDEX_op_add2_i64:
         if (const_args[4]) {
             if ((int64_t)args[4] >= 0) {
@@ -3464,9 +3478,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_movcond_i64:
         return C_O1_I4(r, r, rC, rI, r);
 
-    case INDEX_op_mulu2_i64:
-        return C_O2_I2(o, m, 0, r);
-
     case INDEX_op_add2_i32:
     case INDEX_op_sub2_i32:
         return C_N1_O1_I4(r, r, 0, 1, ri, r);
diff --git a/tcg/sparc64/tcg-target-con-set.h b/tcg/sparc64/tcg-target-con-set.h
index d2ea184fa2..85dcfbc375 100644
--- a/tcg/sparc64/tcg-target-con-set.h
+++ b/tcg/sparc64/tcg-target-con-set.h
@@ -18,5 +18,4 @@ C_O1_I2(r, r, rJ)
 C_O1_I2(r, rz, rJ)
 C_O1_I4(r, rz, rJ, rI, 0)
 C_O2_I2(r, r, r, r)
-C_O2_I2(r, r, rz, rJ)
 C_O2_I4(r, r, rz, rz, rJ, rJ)
diff --git a/tcg/sparc64/tcg-target-has.h b/tcg/sparc64/tcg-target-has.h
index dea0941cac..258c978b5e 100644
--- a/tcg/sparc64/tcg-target-has.h
+++ b/tcg/sparc64/tcg-target-has.h
@@ -20,7 +20,6 @@ extern bool use_vis3_instructions;
 #define TCG_TARGET_HAS_negsetcond_i32   1
 #define TCG_TARGET_HAS_add2_i32         1
 #define TCG_TARGET_HAS_sub2_i32         1
-#define TCG_TARGET_HAS_mulu2_i32        1
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
 #define TCG_TARGET_HAS_extr_i64_i32     0
@@ -31,7 +30,6 @@ extern bool use_vis3_instructions;
 #define TCG_TARGET_HAS_negsetcond_i64   1
 #define TCG_TARGET_HAS_add2_i64         1
 #define TCG_TARGET_HAS_sub2_i64         1
-#define TCG_TARGET_HAS_mulu2_i64        0
 
 #define TCG_TARGET_HAS_qemu_ldst_i128   0
 
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index be2072c027..41c4e77466 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -1457,6 +1457,19 @@ static const TCGOutOpBinary outop_mulsh = {
     .base.static_constraint = C_NotImplemented,
 };
 
+static void tgen_mulu2(TCGContext *s, TCGType type,
+                       TCGReg a0, TCGReg a1, TCGReg a2, TCGReg a3)
+{
+    tcg_out_arith(s, a0, a2, a3, ARITH_UMUL);
+    tcg_out_arithi(s, a1, a0, 32, SHIFT_SRLX);
+}
+
+static const TCGOutOpMul2 outop_mulu2 = {
+    .base.static_constraint = C_Dynamic,
+    .base.dynamic_constraint = cset_mul2,
+    .out_rrrr = tgen_mulu2,
+};
+
 static void tgen_muluh(TCGContext *s, TCGType type,
                        TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -1646,7 +1659,7 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const int const_args[TCG_MAX_OP_ARGS])
 {
     TCGArg a0, a1, a2;
-    int c, c2;
+    int c2;
 
     /* Hoist the loads of the most common arguments.  */
     a0 = args[0];
@@ -1718,12 +1731,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                             args[4], const_args[4], args[5], const_args[5],
                             ARITH_SUBCC, ARITH_SUBC);
         break;
-    case INDEX_op_mulu2_i32:
-        c = ARITH_UMUL;
-        /* The 32-bit multiply insns produce a full 64-bit result. */
-        tcg_out_arithc(s, a0, a2, args[3], const_args[3], c);
-        tcg_out_arithi(s, a1, a0, 32, SHIFT_SRLX);
-        break;
 
     case INDEX_op_qemu_ld_i32:
         tcg_out_qemu_ld(s, a0, a1, a2, TCG_TYPE_I32);
@@ -1847,8 +1854,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_sub2_i32:
     case INDEX_op_sub2_i64:
         return C_O2_I4(r, r, rz, rz, rJ, rJ);
-    case INDEX_op_mulu2_i32:
-        return C_O2_I2(r, r, rz, rJ);
 
     default:
         return C_NotImplemented;
diff --git a/tcg/tcg-has.h b/tcg/tcg-has.h
index ac387b2544..d4fc7148b4 100644
--- a/tcg/tcg-has.h
+++ b/tcg/tcg-has.h
@@ -19,7 +19,6 @@
 #define TCG_TARGET_HAS_negsetcond_i64   0
 #define TCG_TARGET_HAS_add2_i64         0
 #define TCG_TARGET_HAS_sub2_i64         0
-#define TCG_TARGET_HAS_mulu2_i64        0
 /* Turn some undef macros into true macros.  */
 #define TCG_TARGET_HAS_add2_i32         1
 #define TCG_TARGET_HAS_sub2_i32         1
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index 0f48484dfe..a4d976242a 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -1138,7 +1138,7 @@ void tcg_gen_sub2_i32(TCGv_i32 rl, TCGv_i32 rh, TCGv_i32 al,
 
 void tcg_gen_mulu2_i32(TCGv_i32 rl, TCGv_i32 rh, TCGv_i32 arg1, TCGv_i32 arg2)
 {
-    if (TCG_TARGET_HAS_mulu2_i32) {
+    if (tcg_op_supported(INDEX_op_mulu2_i32, TCG_TYPE_I32, 0)) {
         tcg_gen_op4_i32(INDEX_op_mulu2_i32, rl, rh, arg1, arg2);
     } else if (tcg_op_supported(INDEX_op_muluh, TCG_TYPE_I32, 0)) {
         TCGv_i32 t = tcg_temp_ebb_new_i32();
@@ -1156,7 +1156,7 @@ void tcg_gen_mulu2_i32(TCGv_i32 rl, TCGv_i32 rh, TCGv_i32 arg1, TCGv_i32 arg2)
         tcg_temp_free_i64(t0);
         tcg_temp_free_i64(t1);
     } else {
-        qemu_build_not_reached();
+        g_assert_not_reached();
     }
 }
 
@@ -2861,7 +2861,7 @@ void tcg_gen_sub2_i64(TCGv_i64 rl, TCGv_i64 rh, TCGv_i64 al,
 
 void tcg_gen_mulu2_i64(TCGv_i64 rl, TCGv_i64 rh, TCGv_i64 arg1, TCGv_i64 arg2)
 {
-    if (TCG_TARGET_HAS_mulu2_i64) {
+    if (tcg_op_supported(INDEX_op_mulu2_i64, TCG_TYPE_I64, 0)) {
         tcg_gen_op4_i64(INDEX_op_mulu2_i64, rl, rh, arg1, arg2);
     } else if (tcg_op_supported(INDEX_op_muluh, TCG_TYPE_I64, 0)) {
         TCGv_i64 t = tcg_temp_ebb_new_i64();
@@ -2888,7 +2888,7 @@ void tcg_gen_muls2_i64(TCGv_i64 rl, TCGv_i64 rh, TCGv_i64 arg1, TCGv_i64 arg2)
         tcg_gen_op3_i64(INDEX_op_mulsh, rh, arg1, arg2);
         tcg_gen_mov_i64(rl, t);
         tcg_temp_free_i64(t);
-    } else if (TCG_TARGET_HAS_mulu2_i64 ||
+    } else if (tcg_op_supported(INDEX_op_mulu2_i64, TCG_TYPE_I64, 0) ||
                tcg_op_supported(INDEX_op_muluh, TCG_TYPE_I64, 0)) {
         TCGv_i64 t0 = tcg_temp_ebb_new_i64();
         TCGv_i64 t1 = tcg_temp_ebb_new_i64();
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 5b22c75d2e..d38b55d04f 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1043,6 +1043,8 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_mul, TCGOutOpBinary, outop_mul),
     OUTOP(INDEX_op_muls2, TCGOutOpMul2, outop_muls2),
     OUTOP(INDEX_op_mulsh, TCGOutOpBinary, outop_mulsh),
+    OUTOP(INDEX_op_mulu2_i32, TCGOutOpMul2, outop_mulu2),
+    OUTOP(INDEX_op_mulu2_i64, TCGOutOpMul2, outop_mulu2),
     OUTOP(INDEX_op_muluh, TCGOutOpBinary, outop_muluh),
     OUTOP(INDEX_op_nand, TCGOutOpBinary, outop_nand),
     OUTOP(INDEX_op_neg, TCGOutOpUnary, outop_neg),
@@ -2290,8 +2292,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
         return TCG_TARGET_HAS_add2_i32;
     case INDEX_op_sub2_i32:
         return TCG_TARGET_HAS_sub2_i32;
-    case INDEX_op_mulu2_i32:
-        return TCG_TARGET_HAS_mulu2_i32;
     case INDEX_op_bswap16_i32:
         return TCG_TARGET_HAS_bswap16_i32;
     case INDEX_op_bswap32_i32:
@@ -2339,8 +2339,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
         return TCG_TARGET_HAS_add2_i64;
     case INDEX_op_sub2_i64:
         return TCG_TARGET_HAS_sub2_i64;
-    case INDEX_op_mulu2_i64:
-        return TCG_TARGET_HAS_mulu2_i64;
 
     case INDEX_op_mov_vec:
     case INDEX_op_dup_vec:
@@ -5476,6 +5474,8 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
         break;
 
     case INDEX_op_muls2:
+    case INDEX_op_mulu2_i32:
+    case INDEX_op_mulu2_i64:
         {
             const TCGOutOpMul2 *out =
                 container_of(all_outop[op->opc], TCGOutOpMul2, base);
diff --git a/tcg/tci.c b/tcg/tci.c
index 708ded34c7..5c8c62c0ef 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -588,6 +588,16 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_write_reg64(regs, r1, r0, tmp64);
 #else
             muls64(&regs[r0], &regs[r1], regs[r2], regs[r3]);
+#endif
+            break;
+        case INDEX_op_mulu2_i32:
+        case INDEX_op_mulu2_i64:
+            tci_args_rrrr(insn, &r0, &r1, &r2, &r3);
+#if TCG_TARGET_REG_BITS == 32
+            tmp64 = (uint64_t)(uint32_t)regs[r2] * (uint32_t)regs[r3];
+            tci_write_reg64(regs, r1, r0, tmp64);
+#else
+            mulu64(&regs[r0], &regs[r1], regs[r2], regs[r3]);
 #endif
             break;
 
@@ -677,13 +687,6 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_write_reg64(regs, r1, r0, T1 - T2);
             break;
 #endif
-#if TCG_TARGET_HAS_mulu2_i32
-        case INDEX_op_mulu2_i32:
-            tci_args_rrrr(insn, &r0, &r1, &r2, &r3);
-            tmp64 = (uint64_t)(uint32_t)regs[r2] * (uint32_t)regs[r3];
-            tci_write_reg64(regs, r1, r0, tmp64);
-            break;
-#endif
 #if TCG_TARGET_HAS_bswap16_i32 || TCG_TARGET_HAS_bswap16_i64
         CASE_32_64(bswap16)
             tci_args_rr(insn, &r0, &r1);
@@ -741,12 +744,6 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = regs[r1] ? ctz64(regs[r1]) : regs[r2];
             break;
-#if TCG_TARGET_HAS_mulu2_i64
-        case INDEX_op_mulu2_i64:
-            tci_args_rrrr(insn, &r0, &r1, &r2, &r3);
-            mulu64(&regs[r0], &regs[r1], regs[r2], regs[r3]);
-            break;
-#endif
 #if TCG_TARGET_HAS_add2_i64
         case INDEX_op_add2_i64:
             tci_args_rrrrrr(insn, &r0, &r1, &r2, &r3, &r4, &r5);
diff --git a/tcg/tci/tcg-target-has.h b/tcg/tci/tcg-target-has.h
index a3d04b0ee2..2402889bec 100644
--- a/tcg/tci/tcg-target-has.h
+++ b/tcg/tci/tcg-target-has.h
@@ -22,12 +22,8 @@
 #define TCG_TARGET_HAS_negsetcond_i64   0
 #define TCG_TARGET_HAS_add2_i32         1
 #define TCG_TARGET_HAS_sub2_i32         1
-#define TCG_TARGET_HAS_mulu2_i32        1
 #define TCG_TARGET_HAS_add2_i64         1
 #define TCG_TARGET_HAS_sub2_i64         1
-#define TCG_TARGET_HAS_mulu2_i64        1
-#else
-#define TCG_TARGET_HAS_mulu2_i32        1
 #endif /* TCG_TARGET_REG_BITS == 64 */
 
 #define TCG_TARGET_HAS_qemu_ldst_i128   0
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index aa3ce929b4..4bce206f80 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -98,10 +98,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
         return C_O0_I4(r, r, r, r);
 #endif
 
-    case INDEX_op_mulu2_i32:
-    case INDEX_op_mulu2_i64:
-        return C_O2_I2(r, r, r, r);
-
     case INDEX_op_movcond_i32:
     case INDEX_op_movcond_i64:
     case INDEX_op_setcond2_i32:
@@ -729,6 +725,19 @@ static const TCGOutOpBinary outop_mulsh = {
     .base.static_constraint = C_NotImplemented,
 };
 
+static void tgen_mulu2(TCGContext *s, TCGType type,
+                       TCGReg a0, TCGReg a1, TCGReg a2, TCGReg a3)
+{
+    tcg_out_op_rrrr(s, glue(INDEX_op_mulu2_i,TCG_TARGET_REG_BITS),
+                    a0, a1, a2, a3);
+}
+
+static const TCGOutOpMul2 outop_mulu2 = {
+    .base.static_constraint = C_Dynamic,
+    .base.dynamic_constraint = cset_mul2,
+    .out_rrrr = tgen_mulu2,
+};
+
 static const TCGOutOpBinary outop_muluh = {
     .base.static_constraint = C_NotImplemented,
 };
@@ -1023,10 +1032,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         break;
 #endif
 
-    CASE_32_64(mulu2)
-        tcg_out_op_rrrr(s, opc, args[0], args[1], args[2], args[3]);
-        break;
-
     case INDEX_op_qemu_ld_i64:
     case INDEX_op_qemu_st_i64:
         if (TCG_TARGET_REG_BITS == 32) {

From d776198cd31d1578c4b0239dc80cb2841e86f2f8 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 9 Jan 2025 09:11:53 -0800
Subject: [PATCH 0430/2760] tcg: Merge INDEX_op_mulu2_{i32,i64}
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 docs/devel/tcg-ops.rst   |  2 +-
 include/tcg/tcg-opc.h    |  3 +--
 tcg/optimize.c           | 17 +++++++++--------
 tcg/tcg-op.c             | 10 +++++-----
 tcg/tcg.c                |  9 +++------
 tcg/tci.c                |  6 ++----
 tcg/tci/tcg-target.c.inc |  3 +--
 7 files changed, 22 insertions(+), 28 deletions(-)

diff --git a/docs/devel/tcg-ops.rst b/docs/devel/tcg-ops.rst
index 0394767291..592e002971 100644
--- a/docs/devel/tcg-ops.rst
+++ b/docs/devel/tcg-ops.rst
@@ -599,7 +599,7 @@ Multiword arithmetic support
          formed from two single-word arguments, and the double-word output *t0*
          is returned in two single-word outputs.
 
-   * - mulu2_i32/i64 *t0_low*, *t0_high*, *t1*, *t2*
+   * - mulu2 *t0_low*, *t0_high*, *t1*, *t2*
 
      - | Similar to mul, except two unsigned inputs *t1* and *t2* yielding the full
          double-word product *t0*. The latter is returned in two single-word outputs.
diff --git a/include/tcg/tcg-opc.h b/include/tcg/tcg-opc.h
index a45b22ca1a..287bdf3473 100644
--- a/include/tcg/tcg-opc.h
+++ b/include/tcg/tcg-opc.h
@@ -53,6 +53,7 @@ DEF(eqv, 1, 2, 0, TCG_OPF_INT)
 DEF(mul, 1, 2, 0, TCG_OPF_INT)
 DEF(muls2, 2, 2, 0, TCG_OPF_INT)
 DEF(mulsh, 1, 2, 0, TCG_OPF_INT)
+DEF(mulu2, 2, 2, 0, TCG_OPF_INT)
 DEF(muluh, 1, 2, 0, TCG_OPF_INT)
 DEF(nand, 1, 2, 0, TCG_OPF_INT)
 DEF(neg, 1, 1, 0, TCG_OPF_INT)
@@ -92,7 +93,6 @@ DEF(brcond_i32, 0, 2, 2, TCG_OPF_BB_END | TCG_OPF_COND_BRANCH)
 
 DEF(add2_i32, 2, 4, 0, 0)
 DEF(sub2_i32, 2, 4, 0, 0)
-DEF(mulu2_i32, 2, 2, 0, 0)
 DEF(brcond2_i32, 0, 4, 2, TCG_OPF_BB_END | TCG_OPF_COND_BRANCH)
 DEF(setcond2_i32, 1, 4, 1, 0)
 
@@ -133,7 +133,6 @@ DEF(bswap64_i64, 1, 1, 1, 0)
 
 DEF(add2_i64, 2, 4, 0, 0)
 DEF(sub2_i64, 2, 4, 0, 0)
-DEF(mulu2_i64, 2, 2, 0, 0)
 
 #define DATA64_ARGS  (TCG_TARGET_REG_BITS == 64 ? 1 : 2)
 
diff --git a/tcg/optimize.c b/tcg/optimize.c
index 756f681e88..14d943cf97 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -2069,13 +2069,14 @@ static bool fold_multiply2(OptContext *ctx, TCGOp *op)
         TCGOp *op2;
 
         switch (op->opc) {
-        case INDEX_op_mulu2_i32:
-            l = (uint64_t)(uint32_t)a * (uint32_t)b;
-            h = (int32_t)(l >> 32);
-            l = (int32_t)l;
-            break;
-        case INDEX_op_mulu2_i64:
-            mulu64(&l, &h, a, b);
+        case INDEX_op_mulu2:
+            if (ctx->type == TCG_TYPE_I32) {
+                l = (uint64_t)(uint32_t)a * (uint32_t)b;
+                h = (int32_t)(l >> 32);
+                l = (int32_t)l;
+            } else {
+                mulu64(&l, &h, a, b);
+            }
             break;
         case INDEX_op_muls2:
             if (ctx->type == TCG_TYPE_I32) {
@@ -2975,7 +2976,7 @@ void tcg_optimize(TCGContext *s)
             done = fold_mul_highpart(&ctx, op);
             break;
         case INDEX_op_muls2:
-        CASE_OP_32_64(mulu2):
+        case INDEX_op_mulu2:
             done = fold_multiply2(&ctx, op);
             break;
         case INDEX_op_nand:
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index a4d976242a..22af3b12bc 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -1138,8 +1138,8 @@ void tcg_gen_sub2_i32(TCGv_i32 rl, TCGv_i32 rh, TCGv_i32 al,
 
 void tcg_gen_mulu2_i32(TCGv_i32 rl, TCGv_i32 rh, TCGv_i32 arg1, TCGv_i32 arg2)
 {
-    if (tcg_op_supported(INDEX_op_mulu2_i32, TCG_TYPE_I32, 0)) {
-        tcg_gen_op4_i32(INDEX_op_mulu2_i32, rl, rh, arg1, arg2);
+    if (tcg_op_supported(INDEX_op_mulu2, TCG_TYPE_I32, 0)) {
+        tcg_gen_op4_i32(INDEX_op_mulu2, rl, rh, arg1, arg2);
     } else if (tcg_op_supported(INDEX_op_muluh, TCG_TYPE_I32, 0)) {
         TCGv_i32 t = tcg_temp_ebb_new_i32();
         tcg_gen_op3_i32(INDEX_op_mul, t, arg1, arg2);
@@ -2861,8 +2861,8 @@ void tcg_gen_sub2_i64(TCGv_i64 rl, TCGv_i64 rh, TCGv_i64 al,
 
 void tcg_gen_mulu2_i64(TCGv_i64 rl, TCGv_i64 rh, TCGv_i64 arg1, TCGv_i64 arg2)
 {
-    if (tcg_op_supported(INDEX_op_mulu2_i64, TCG_TYPE_I64, 0)) {
-        tcg_gen_op4_i64(INDEX_op_mulu2_i64, rl, rh, arg1, arg2);
+    if (tcg_op_supported(INDEX_op_mulu2, TCG_TYPE_I64, 0)) {
+        tcg_gen_op4_i64(INDEX_op_mulu2, rl, rh, arg1, arg2);
     } else if (tcg_op_supported(INDEX_op_muluh, TCG_TYPE_I64, 0)) {
         TCGv_i64 t = tcg_temp_ebb_new_i64();
         tcg_gen_op3_i64(INDEX_op_mul, t, arg1, arg2);
@@ -2888,7 +2888,7 @@ void tcg_gen_muls2_i64(TCGv_i64 rl, TCGv_i64 rh, TCGv_i64 arg1, TCGv_i64 arg2)
         tcg_gen_op3_i64(INDEX_op_mulsh, rh, arg1, arg2);
         tcg_gen_mov_i64(rl, t);
         tcg_temp_free_i64(t);
-    } else if (tcg_op_supported(INDEX_op_mulu2_i64, TCG_TYPE_I64, 0) ||
+    } else if (tcg_op_supported(INDEX_op_mulu2, TCG_TYPE_I64, 0) ||
                tcg_op_supported(INDEX_op_muluh, TCG_TYPE_I64, 0)) {
         TCGv_i64 t0 = tcg_temp_ebb_new_i64();
         TCGv_i64 t1 = tcg_temp_ebb_new_i64();
diff --git a/tcg/tcg.c b/tcg/tcg.c
index d38b55d04f..685408f0f9 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1043,8 +1043,7 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_mul, TCGOutOpBinary, outop_mul),
     OUTOP(INDEX_op_muls2, TCGOutOpMul2, outop_muls2),
     OUTOP(INDEX_op_mulsh, TCGOutOpBinary, outop_mulsh),
-    OUTOP(INDEX_op_mulu2_i32, TCGOutOpMul2, outop_mulu2),
-    OUTOP(INDEX_op_mulu2_i64, TCGOutOpMul2, outop_mulu2),
+    OUTOP(INDEX_op_mulu2, TCGOutOpMul2, outop_mulu2),
     OUTOP(INDEX_op_muluh, TCGOutOpBinary, outop_muluh),
     OUTOP(INDEX_op_nand, TCGOutOpBinary, outop_nand),
     OUTOP(INDEX_op_neg, TCGOutOpUnary, outop_neg),
@@ -4009,8 +4008,7 @@ liveness_pass_1(TCGContext *s)
             opc_new = INDEX_op_mul;
             opc_new2 = INDEX_op_mulsh;
             goto do_mul2;
-        case INDEX_op_mulu2_i32:
-        case INDEX_op_mulu2_i64:
+        case INDEX_op_mulu2:
             opc_new = INDEX_op_mul;
             opc_new2 = INDEX_op_muluh;
         do_mul2:
@@ -5474,8 +5472,7 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
         break;
 
     case INDEX_op_muls2:
-    case INDEX_op_mulu2_i32:
-    case INDEX_op_mulu2_i64:
+    case INDEX_op_mulu2:
         {
             const TCGOutOpMul2 *out =
                 container_of(all_outop[op->opc], TCGOutOpMul2, base);
diff --git a/tcg/tci.c b/tcg/tci.c
index 5c8c62c0ef..569b5c7ed0 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -590,8 +590,7 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             muls64(&regs[r0], &regs[r1], regs[r2], regs[r3]);
 #endif
             break;
-        case INDEX_op_mulu2_i32:
-        case INDEX_op_mulu2_i64:
+        case INDEX_op_mulu2:
             tci_args_rrrr(insn, &r0, &r1, &r2, &r3);
 #if TCG_TARGET_REG_BITS == 32
             tmp64 = (uint64_t)(uint32_t)regs[r2] * (uint32_t)regs[r3];
@@ -1092,8 +1091,7 @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
         break;
 
     case INDEX_op_muls2:
-    case INDEX_op_mulu2_i32:
-    case INDEX_op_mulu2_i64:
+    case INDEX_op_mulu2:
         tci_args_rrrr(insn, &r0, &r1, &r2, &r3);
         info->fprintf_func(info->stream, "%-12s  %s, %s, %s, %s",
                            op_name, str_r(r0), str_r(r1),
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index 4bce206f80..563529e055 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -728,8 +728,7 @@ static const TCGOutOpBinary outop_mulsh = {
 static void tgen_mulu2(TCGContext *s, TCGType type,
                        TCGReg a0, TCGReg a1, TCGReg a2, TCGReg a3)
 {
-    tcg_out_op_rrrr(s, glue(INDEX_op_mulu2_i,TCG_TARGET_REG_BITS),
-                    a0, a1, a2, a3);
+    tcg_out_op_rrrr(s, INDEX_op_mulu2, a0, a1, a2, a3);
 }
 
 static const TCGOutOpMul2 outop_mulu2 = {

From 84f57d50ac25a24870de6d19f5b588083a4899e2 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 9 Jan 2025 20:22:55 +0000
Subject: [PATCH 0431/2760] tcg/loongarch64: Support negsetcond

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/loongarch64/tcg-target-con-set.h |  2 --
 tcg/loongarch64/tcg-target-has.h     |  4 ++--
 tcg/loongarch64/tcg-target.c.inc     | 34 ++++++++++++++++++++++------
 3 files changed, 29 insertions(+), 11 deletions(-)

diff --git a/tcg/loongarch64/tcg-target-con-set.h b/tcg/loongarch64/tcg-target-con-set.h
index da84e4d49c..c145d4ab66 100644
--- a/tcg/loongarch64/tcg-target-con-set.h
+++ b/tcg/loongarch64/tcg-target-con-set.h
@@ -29,8 +29,6 @@ C_O1_I2(r, r, rJ)
 C_O1_I2(r, r, rU)
 C_O1_I2(r, r, rW)
 C_O1_I2(r, 0, rz)
-C_O1_I2(r, rz, ri)
-C_O1_I2(r, rz, rJ)
 C_O1_I2(w, w, w)
 C_O1_I2(w, w, wM)
 C_O1_I2(w, w, wA)
diff --git a/tcg/loongarch64/tcg-target-has.h b/tcg/loongarch64/tcg-target-has.h
index 12a721b4da..e9bb913961 100644
--- a/tcg/loongarch64/tcg-target-has.h
+++ b/tcg/loongarch64/tcg-target-has.h
@@ -10,7 +10,7 @@
 #include "host/cpuinfo.h"
 
 /* optional instructions */
-#define TCG_TARGET_HAS_negsetcond_i32   0
+#define TCG_TARGET_HAS_negsetcond_i32   1
 #define TCG_TARGET_HAS_extract2_i32     0
 #define TCG_TARGET_HAS_add2_i32         0
 #define TCG_TARGET_HAS_sub2_i32         0
@@ -19,7 +19,7 @@
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
 /* 64-bit operations */
-#define TCG_TARGET_HAS_negsetcond_i64   0
+#define TCG_TARGET_HAS_negsetcond_i64   1
 #define TCG_TARGET_HAS_extract2_i64     0
 #define TCG_TARGET_HAS_extr_i64_i32     1
 #define TCG_TARGET_HAS_bswap16_i64      1
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index fa9da82df8..e7f97aaa5e 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -646,14 +646,29 @@ static int tcg_out_setcond_int(TCGContext *s, TCGCond cond, TCGReg ret,
 }
 
 static void tcg_out_setcond(TCGContext *s, TCGCond cond, TCGReg ret,
-                            TCGReg arg1, tcg_target_long arg2, bool c2)
+                            TCGReg arg1, tcg_target_long arg2,
+                            bool c2, bool neg)
 {
     int tmpflags = tcg_out_setcond_int(s, cond, ret, arg1, arg2, c2);
+    TCGReg tmp = tmpflags & ~SETCOND_FLAGS;
 
-    if (tmpflags != ret) {
-        TCGReg tmp = tmpflags & ~SETCOND_FLAGS;
-
+    if (neg) {
+        /* If intermediate result is zero/non-zero: test != 0. */
+        if (tmpflags & SETCOND_NEZ) {
+            tcg_out_opc_sltu(s, ret, TCG_REG_ZERO, tmp);
+            tmp = ret;
+        }
+        /* Produce the 0/-1 result. */
+        if (tmpflags & SETCOND_INV) {
+            tcg_out_opc_addi_d(s, ret, tmp, -1);
+        } else {
+            tcg_out_opc_sub_d(s, ret, TCG_REG_ZERO, tmp);
+        }
+    } else {
         switch (tmpflags & SETCOND_FLAGS) {
+        case 0:
+            tcg_debug_assert(tmp == ret);
+            break;
         case SETCOND_INV:
             /* Intermediate result is boolean: simply invert. */
             tcg_out_opc_xori(s, ret, tmp, 1);
@@ -1800,7 +1815,11 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
 
     case INDEX_op_setcond_i32:
     case INDEX_op_setcond_i64:
-        tcg_out_setcond(s, args[3], a0, a1, a2, c2);
+        tcg_out_setcond(s, args[3], a0, a1, a2, c2, false);
+        break;
+    case INDEX_op_negsetcond_i32:
+    case INDEX_op_negsetcond_i64:
+        tcg_out_setcond(s, args[3], a0, a1, a2, c2, true);
         break;
 
     case INDEX_op_movcond_i32:
@@ -2434,9 +2453,10 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
         return C_O1_I2(r, 0, rz);
 
     case INDEX_op_setcond_i32:
-        return C_O1_I2(r, rz, ri);
     case INDEX_op_setcond_i64:
-        return C_O1_I2(r, rz, rJ);
+    case INDEX_op_negsetcond_i32:
+    case INDEX_op_negsetcond_i64:
+        return C_O1_I2(r, r, rJ);
 
     case INDEX_op_movcond_i32:
     case INDEX_op_movcond_i64:

From ce27066de1bf9e44486834bfeb0aa44022f98ab9 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 9 Jan 2025 12:36:32 -0800
Subject: [PATCH 0432/2760] tcg/mips: Support negsetcond

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/mips/tcg-target-has.h |  4 ++--
 tcg/mips/tcg-target.c.inc | 25 +++++++++++++++++++++++++
 2 files changed, 27 insertions(+), 2 deletions(-)

diff --git a/tcg/mips/tcg-target-has.h b/tcg/mips/tcg-target-has.h
index 05701fd228..c77d4296cf 100644
--- a/tcg/mips/tcg-target-has.h
+++ b/tcg/mips/tcg-target-has.h
@@ -41,7 +41,7 @@ extern bool use_mips32r2_instructions;
 /* optional instructions */
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
-#define TCG_TARGET_HAS_negsetcond_i32   0
+#define TCG_TARGET_HAS_negsetcond_i32   1
 
 #if TCG_TARGET_REG_BITS == 64
 #define TCG_TARGET_HAS_add2_i32         0
@@ -51,7 +51,7 @@ extern bool use_mips32r2_instructions;
 #define TCG_TARGET_HAS_sub2_i64         0
 #define TCG_TARGET_HAS_ext32s_i64       1
 #define TCG_TARGET_HAS_ext32u_i64       1
-#define TCG_TARGET_HAS_negsetcond_i64   0
+#define TCG_TARGET_HAS_negsetcond_i64   1
 #endif
 
 /* optional instructions detected at runtime */
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index 6a97264c7c..759f152711 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -959,6 +959,25 @@ static void tcg_out_setcond(TCGContext *s, TCGCond cond, TCGReg ret,
     tcg_out_setcond_end(s, ret, tmpflags);
 }
 
+static void tcg_out_negsetcond(TCGContext *s, TCGCond cond, TCGReg ret,
+                               TCGReg arg1, TCGReg arg2)
+{
+    int tmpflags = tcg_out_setcond_int(s, cond, ret, arg1, arg2);
+    TCGReg tmp = tmpflags & ~SETCOND_FLAGS;
+
+    /* If intermediate result is zero/non-zero: test != 0. */
+    if (tmpflags & SETCOND_NEZ) {
+        tcg_out_opc_reg(s, OPC_SLTU, ret, TCG_REG_ZERO, tmp);
+        tmp = ret;
+    }
+    /* Produce the 0/-1 result. */
+    if (tmpflags & SETCOND_INV) {
+        tcg_out_opc_imm(s, OPC_ADDIU, ret, tmp, -1);
+    } else {
+        tcg_out_opc_reg(s, OPC_SUBU, ret, TCG_REG_ZERO, tmp);
+    }
+}
+
 static void tcg_out_brcond(TCGContext *s, TCGCond cond, TCGReg arg1,
                            TCGReg arg2, TCGLabel *l)
 {
@@ -2270,6 +2289,10 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     case INDEX_op_setcond_i64:
         tcg_out_setcond(s, args[3], a0, a1, a2);
         break;
+    case INDEX_op_negsetcond_i32:
+    case INDEX_op_negsetcond_i64:
+        tcg_out_negsetcond(s, args[3], a0, a1, a2);
+        break;
     case INDEX_op_setcond2_i32:
         tcg_out_setcond2(s, args[5], a0, a1, a2, args[3], args[4]);
         break;
@@ -2364,6 +2387,8 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 
     case INDEX_op_setcond_i32:
     case INDEX_op_setcond_i64:
+    case INDEX_op_negsetcond_i32:
+    case INDEX_op_negsetcond_i64:
         return C_O1_I2(r, rz, rz);
 
     case INDEX_op_deposit_i32:

From 9204be8dec1a52e943185df392377d8853decf93 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 9 Jan 2025 12:42:13 -0800
Subject: [PATCH 0433/2760] tcg/tci: Support negsetcond
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tci/tcg-target-has.h |  4 ++--
 tcg/tci/tcg-target.c.inc | 13 +++++++++++++
 2 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/tcg/tci/tcg-target-has.h b/tcg/tci/tcg-target-has.h
index 2402889bec..7787347e05 100644
--- a/tcg/tci/tcg-target-has.h
+++ b/tcg/tci/tcg-target-has.h
@@ -10,7 +10,7 @@
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
 #define TCG_TARGET_HAS_extract2_i32     0
-#define TCG_TARGET_HAS_negsetcond_i32   0
+#define TCG_TARGET_HAS_negsetcond_i32   1
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
 #if TCG_TARGET_REG_BITS == 64
@@ -19,7 +19,7 @@
 #define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1
 #define TCG_TARGET_HAS_extract2_i64     0
-#define TCG_TARGET_HAS_negsetcond_i64   0
+#define TCG_TARGET_HAS_negsetcond_i64   1
 #define TCG_TARGET_HAS_add2_i32         1
 #define TCG_TARGET_HAS_sub2_i32         1
 #define TCG_TARGET_HAS_add2_i64         1
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index 563529e055..2eb323b5c5 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -79,6 +79,8 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 
     case INDEX_op_setcond_i32:
     case INDEX_op_setcond_i64:
+    case INDEX_op_negsetcond_i32:
+    case INDEX_op_negsetcond_i64:
     case INDEX_op_deposit_i32:
     case INDEX_op_deposit_i64:
         return C_O1_I2(r, r, r);
@@ -966,6 +968,17 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                           args[3], args[4], args[5]);
         break;
 
+    case INDEX_op_negsetcond_i32:
+        tcg_out_op_rrrc(s, INDEX_op_setcond_i32,
+                        args[0], args[1], args[2], args[3]);
+        tcg_out_op_rr(s, INDEX_op_neg, args[0], args[0]);
+        break;
+    case INDEX_op_negsetcond_i64:
+        tcg_out_op_rrrc(s, INDEX_op_setcond_i64,
+                        args[0], args[1], args[2], args[3]);
+        tcg_out_op_rr(s, INDEX_op_neg, args[0], args[0]);
+        break;
+
     CASE_32_64(ld8u)
     CASE_32_64(ld8s)
     CASE_32_64(ld16u)

From f791458932a21f8d99694af412304abfbce83765 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 9 Jan 2025 12:48:21 -0800
Subject: [PATCH 0434/2760] tcg: Remove TCG_TARGET_HAS_negsetcond_{i32,i64}
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

All targets now provide negsetcond, so remove the conditional.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target-has.h     |  2 --
 tcg/arm/tcg-target-has.h         |  1 -
 tcg/i386/tcg-target-has.h        |  2 --
 tcg/loongarch64/tcg-target-has.h |  2 --
 tcg/mips/tcg-target-has.h        |  2 --
 tcg/optimize.c                   | 24 +++++++++---------------
 tcg/ppc/tcg-target-has.h         |  2 --
 tcg/riscv/tcg-target-has.h       |  2 --
 tcg/s390x/tcg-target-has.h       |  2 --
 tcg/sparc64/tcg-target-has.h     |  2 --
 tcg/tcg-has.h                    |  1 -
 tcg/tcg-op.c                     | 12 +++---------
 tcg/tcg.c                        |  6 ++----
 tcg/tci/tcg-target-has.h         |  2 --
 14 files changed, 14 insertions(+), 48 deletions(-)

diff --git a/tcg/aarch64/tcg-target-has.h b/tcg/aarch64/tcg-target-has.h
index 0c370d7dda..22a574e703 100644
--- a/tcg/aarch64/tcg-target-has.h
+++ b/tcg/aarch64/tcg-target-has.h
@@ -16,7 +16,6 @@
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
 #define TCG_TARGET_HAS_extract2_i32     1
-#define TCG_TARGET_HAS_negsetcond_i32   1
 #define TCG_TARGET_HAS_add2_i32         1
 #define TCG_TARGET_HAS_sub2_i32         1
 #define TCG_TARGET_HAS_extr_i64_i32     0
@@ -26,7 +25,6 @@
 #define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1
 #define TCG_TARGET_HAS_extract2_i64     1
-#define TCG_TARGET_HAS_negsetcond_i64   1
 #define TCG_TARGET_HAS_add2_i64         1
 #define TCG_TARGET_HAS_sub2_i64         1
 
diff --git a/tcg/arm/tcg-target-has.h b/tcg/arm/tcg-target-has.h
index ccbc39a23e..bfa3be8028 100644
--- a/tcg/arm/tcg-target-has.h
+++ b/tcg/arm/tcg-target-has.h
@@ -27,7 +27,6 @@ extern bool use_neon_instructions;
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
 #define TCG_TARGET_HAS_extract2_i32     1
-#define TCG_TARGET_HAS_negsetcond_i32   1
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
 #define TCG_TARGET_HAS_qemu_ldst_i128   0
diff --git a/tcg/i386/tcg-target-has.h b/tcg/i386/tcg-target-has.h
index c92a049fd7..aaf8764cc9 100644
--- a/tcg/i386/tcg-target-has.h
+++ b/tcg/i386/tcg-target-has.h
@@ -29,7 +29,6 @@
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
 #define TCG_TARGET_HAS_extract2_i32     1
-#define TCG_TARGET_HAS_negsetcond_i32   1
 #define TCG_TARGET_HAS_add2_i32         1
 #define TCG_TARGET_HAS_sub2_i32         1
 
@@ -40,7 +39,6 @@
 #define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1
 #define TCG_TARGET_HAS_extract2_i64     1
-#define TCG_TARGET_HAS_negsetcond_i64   1
 #define TCG_TARGET_HAS_add2_i64         1
 #define TCG_TARGET_HAS_sub2_i64         1
 #define TCG_TARGET_HAS_qemu_st8_i32     0
diff --git a/tcg/loongarch64/tcg-target-has.h b/tcg/loongarch64/tcg-target-has.h
index e9bb913961..90f0a131ae 100644
--- a/tcg/loongarch64/tcg-target-has.h
+++ b/tcg/loongarch64/tcg-target-has.h
@@ -10,7 +10,6 @@
 #include "host/cpuinfo.h"
 
 /* optional instructions */
-#define TCG_TARGET_HAS_negsetcond_i32   1
 #define TCG_TARGET_HAS_extract2_i32     0
 #define TCG_TARGET_HAS_add2_i32         0
 #define TCG_TARGET_HAS_sub2_i32         0
@@ -19,7 +18,6 @@
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
 /* 64-bit operations */
-#define TCG_TARGET_HAS_negsetcond_i64   1
 #define TCG_TARGET_HAS_extract2_i64     0
 #define TCG_TARGET_HAS_extr_i64_i32     1
 #define TCG_TARGET_HAS_bswap16_i64      1
diff --git a/tcg/mips/tcg-target-has.h b/tcg/mips/tcg-target-has.h
index c77d4296cf..c6cecba28b 100644
--- a/tcg/mips/tcg-target-has.h
+++ b/tcg/mips/tcg-target-has.h
@@ -41,7 +41,6 @@ extern bool use_mips32r2_instructions;
 /* optional instructions */
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
-#define TCG_TARGET_HAS_negsetcond_i32   1
 
 #if TCG_TARGET_REG_BITS == 64
 #define TCG_TARGET_HAS_add2_i32         0
@@ -51,7 +50,6 @@ extern bool use_mips32r2_instructions;
 #define TCG_TARGET_HAS_sub2_i64         0
 #define TCG_TARGET_HAS_ext32s_i64       1
 #define TCG_TARGET_HAS_ext32u_i64       1
-#define TCG_TARGET_HAS_negsetcond_i64   1
 #endif
 
 /* optional instructions detected at runtime */
diff --git a/tcg/optimize.c b/tcg/optimize.c
index 14d943cf97..0affde323b 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -1996,23 +1996,19 @@ static bool fold_movcond(OptContext *ctx, TCGOp *op)
     if (ti_is_const(tt) && ti_is_const(ft)) {
         uint64_t tv = ti_const_val(tt);
         uint64_t fv = ti_const_val(ft);
-        TCGOpcode opc, negopc = 0;
+        TCGOpcode opc, negopc;
         TCGCond cond = op->args[5];
 
         switch (ctx->type) {
         case TCG_TYPE_I32:
             opc = INDEX_op_setcond_i32;
-            if (TCG_TARGET_HAS_negsetcond_i32) {
-                negopc = INDEX_op_negsetcond_i32;
-            }
+            negopc = INDEX_op_negsetcond_i32;
             tv = (int32_t)tv;
             fv = (int32_t)fv;
             break;
         case TCG_TYPE_I64:
             opc = INDEX_op_setcond_i64;
-            if (TCG_TARGET_HAS_negsetcond_i64) {
-                negopc = INDEX_op_negsetcond_i64;
-            }
+            negopc = INDEX_op_negsetcond_i64;
             break;
         default:
             g_assert_not_reached();
@@ -2024,14 +2020,12 @@ static bool fold_movcond(OptContext *ctx, TCGOp *op)
         } else if (fv == 1 && tv == 0) {
             op->opc = opc;
             op->args[3] = tcg_invert_cond(cond);
-        } else if (negopc) {
-            if (tv == -1 && fv == 0) {
-                op->opc = negopc;
-                op->args[3] = cond;
-            } else if (fv == -1 && tv == 0) {
-                op->opc = negopc;
-                op->args[3] = tcg_invert_cond(cond);
-            }
+        } else if (tv == -1 && fv == 0) {
+            op->opc = negopc;
+            op->args[3] = cond;
+        } else if (fv == -1 && tv == 0) {
+            op->opc = negopc;
+            op->args[3] = tcg_invert_cond(cond);
         }
     }
 
diff --git a/tcg/ppc/tcg-target-has.h b/tcg/ppc/tcg-target-has.h
index 5cc059fe9a..5c4fc2bc34 100644
--- a/tcg/ppc/tcg-target-has.h
+++ b/tcg/ppc/tcg-target-has.h
@@ -20,7 +20,6 @@
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
 #define TCG_TARGET_HAS_extract2_i32     0
-#define TCG_TARGET_HAS_negsetcond_i32   1
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
 #if TCG_TARGET_REG_BITS == 64
@@ -31,7 +30,6 @@
 #define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1
 #define TCG_TARGET_HAS_extract2_i64     0
-#define TCG_TARGET_HAS_negsetcond_i64   1
 #define TCG_TARGET_HAS_add2_i64         1
 #define TCG_TARGET_HAS_sub2_i64         1
 #endif
diff --git a/tcg/riscv/tcg-target-has.h b/tcg/riscv/tcg-target-has.h
index 9b86b8bf48..e18b5cb8ec 100644
--- a/tcg/riscv/tcg-target-has.h
+++ b/tcg/riscv/tcg-target-has.h
@@ -10,7 +10,6 @@
 #include "host/cpuinfo.h"
 
 /* optional instructions */
-#define TCG_TARGET_HAS_negsetcond_i32   1
 #define TCG_TARGET_HAS_extract2_i32     0
 #define TCG_TARGET_HAS_add2_i32         1
 #define TCG_TARGET_HAS_sub2_i32         1
@@ -18,7 +17,6 @@
 #define TCG_TARGET_HAS_bswap32_i32      (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
-#define TCG_TARGET_HAS_negsetcond_i64   1
 #define TCG_TARGET_HAS_extract2_i64     0
 #define TCG_TARGET_HAS_extr_i64_i32     1
 #define TCG_TARGET_HAS_bswap16_i64      (cpuinfo & CPUINFO_ZBB)
diff --git a/tcg/s390x/tcg-target-has.h b/tcg/s390x/tcg-target-has.h
index 894a9f64e0..41cd8a1d0d 100644
--- a/tcg/s390x/tcg-target-has.h
+++ b/tcg/s390x/tcg-target-has.h
@@ -32,7 +32,6 @@ extern uint64_t s390_facilities[3];
 #define TCG_TARGET_HAS_bswap16_i32    1
 #define TCG_TARGET_HAS_bswap32_i32    1
 #define TCG_TARGET_HAS_extract2_i32   0
-#define TCG_TARGET_HAS_negsetcond_i32 1
 #define TCG_TARGET_HAS_add2_i32       1
 #define TCG_TARGET_HAS_sub2_i32       1
 #define TCG_TARGET_HAS_extr_i64_i32   0
@@ -42,7 +41,6 @@ extern uint64_t s390_facilities[3];
 #define TCG_TARGET_HAS_bswap32_i64    1
 #define TCG_TARGET_HAS_bswap64_i64    1
 #define TCG_TARGET_HAS_extract2_i64   0
-#define TCG_TARGET_HAS_negsetcond_i64 1
 #define TCG_TARGET_HAS_add2_i64       1
 #define TCG_TARGET_HAS_sub2_i64       1
 
diff --git a/tcg/sparc64/tcg-target-has.h b/tcg/sparc64/tcg-target-has.h
index 258c978b5e..6ed27b8fcc 100644
--- a/tcg/sparc64/tcg-target-has.h
+++ b/tcg/sparc64/tcg-target-has.h
@@ -17,7 +17,6 @@ extern bool use_vis3_instructions;
 #define TCG_TARGET_HAS_bswap16_i32      0
 #define TCG_TARGET_HAS_bswap32_i32      0
 #define TCG_TARGET_HAS_extract2_i32     0
-#define TCG_TARGET_HAS_negsetcond_i32   1
 #define TCG_TARGET_HAS_add2_i32         1
 #define TCG_TARGET_HAS_sub2_i32         1
 #define TCG_TARGET_HAS_qemu_st8_i32     0
@@ -27,7 +26,6 @@ extern bool use_vis3_instructions;
 #define TCG_TARGET_HAS_bswap32_i64      0
 #define TCG_TARGET_HAS_bswap64_i64      0
 #define TCG_TARGET_HAS_extract2_i64     0
-#define TCG_TARGET_HAS_negsetcond_i64   1
 #define TCG_TARGET_HAS_add2_i64         1
 #define TCG_TARGET_HAS_sub2_i64         1
 
diff --git a/tcg/tcg-has.h b/tcg/tcg-has.h
index d4fc7148b4..315dfd05aa 100644
--- a/tcg/tcg-has.h
+++ b/tcg/tcg-has.h
@@ -16,7 +16,6 @@
 #define TCG_TARGET_HAS_bswap32_i64      0
 #define TCG_TARGET_HAS_bswap64_i64      0
 #define TCG_TARGET_HAS_extract2_i64     0
-#define TCG_TARGET_HAS_negsetcond_i64   0
 #define TCG_TARGET_HAS_add2_i64         0
 #define TCG_TARGET_HAS_sub2_i64         0
 /* Turn some undef macros into true macros.  */
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index 22af3b12bc..413b68352d 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -569,11 +569,8 @@ void tcg_gen_negsetcond_i32(TCGCond cond, TCGv_i32 ret,
         tcg_gen_movi_i32(ret, -1);
     } else if (cond == TCG_COND_NEVER) {
         tcg_gen_movi_i32(ret, 0);
-    } else if (TCG_TARGET_HAS_negsetcond_i32) {
-        tcg_gen_op4i_i32(INDEX_op_negsetcond_i32, ret, arg1, arg2, cond);
     } else {
-        tcg_gen_setcond_i32(cond, ret, arg1, arg2);
-        tcg_gen_neg_i32(ret, ret);
+        tcg_gen_op4i_i32(INDEX_op_negsetcond_i32, ret, arg1, arg2, cond);
     }
 }
 
@@ -1950,17 +1947,14 @@ void tcg_gen_negsetcond_i64(TCGCond cond, TCGv_i64 ret,
         tcg_gen_movi_i64(ret, -1);
     } else if (cond == TCG_COND_NEVER) {
         tcg_gen_movi_i64(ret, 0);
-    } else if (TCG_TARGET_HAS_negsetcond_i64) {
+    } else if (TCG_TARGET_REG_BITS == 64) {
         tcg_gen_op4i_i64(INDEX_op_negsetcond_i64, ret, arg1, arg2, cond);
-    } else if (TCG_TARGET_REG_BITS == 32) {
+    } else {
         tcg_gen_op6i_i32(INDEX_op_setcond2_i32, TCGV_LOW(ret),
                          TCGV_LOW(arg1), TCGV_HIGH(arg1),
                          TCGV_LOW(arg2), TCGV_HIGH(arg2), cond);
         tcg_gen_neg_i32(TCGV_LOW(ret), TCGV_LOW(ret));
         tcg_gen_mov_i32(TCGV_HIGH(ret), TCGV_LOW(ret));
-    } else {
-        tcg_gen_setcond_i64(cond, ret, arg1, arg2);
-        tcg_gen_neg_i64(ret, ret);
     }
 }
 
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 685408f0f9..38a329b876 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -2268,6 +2268,7 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
         return has_type;
 
     case INDEX_op_setcond_i32:
+    case INDEX_op_negsetcond_i32:
     case INDEX_op_brcond_i32:
     case INDEX_op_movcond_i32:
     case INDEX_op_ld8u_i32:
@@ -2283,8 +2284,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_deposit_i32:
         return true;
 
-    case INDEX_op_negsetcond_i32:
-        return TCG_TARGET_HAS_negsetcond_i32;
     case INDEX_op_extract2_i32:
         return TCG_TARGET_HAS_extract2_i32;
     case INDEX_op_add2_i32:
@@ -2301,6 +2300,7 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
         return TCG_TARGET_REG_BITS == 32;
 
     case INDEX_op_setcond_i64:
+    case INDEX_op_negsetcond_i64:
     case INDEX_op_brcond_i64:
     case INDEX_op_movcond_i64:
     case INDEX_op_ld8u_i64:
@@ -2321,8 +2321,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_deposit_i64:
         return TCG_TARGET_REG_BITS == 64;
 
-    case INDEX_op_negsetcond_i64:
-        return TCG_TARGET_HAS_negsetcond_i64;
     case INDEX_op_extract2_i64:
         return TCG_TARGET_HAS_extract2_i64;
     case INDEX_op_extrl_i64_i32:
diff --git a/tcg/tci/tcg-target-has.h b/tcg/tci/tcg-target-has.h
index 7787347e05..f45a0688f9 100644
--- a/tcg/tci/tcg-target-has.h
+++ b/tcg/tci/tcg-target-has.h
@@ -10,7 +10,6 @@
 #define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
 #define TCG_TARGET_HAS_extract2_i32     0
-#define TCG_TARGET_HAS_negsetcond_i32   1
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
 #if TCG_TARGET_REG_BITS == 64
@@ -19,7 +18,6 @@
 #define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1
 #define TCG_TARGET_HAS_extract2_i64     0
-#define TCG_TARGET_HAS_negsetcond_i64   1
 #define TCG_TARGET_HAS_add2_i32         1
 #define TCG_TARGET_HAS_sub2_i32         1
 #define TCG_TARGET_HAS_add2_i64         1

From 5a7b38c8ca056f1ffbb488c1b7c97636b1f3b22b Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 10 Jan 2025 09:12:06 -0800
Subject: [PATCH 0435/2760] tcg: Convert setcond, negsetcond to TCGOutOpSetcond

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target.c.inc     | 121 ++++++++++++++++++++-----------
 tcg/arm/tcg-target.c.inc         | 117 +++++++++++++++++++++---------
 tcg/i386/tcg-target.c.inc        |  57 +++++++++++----
 tcg/loongarch64/tcg-target.c.inc |  51 +++++++++----
 tcg/mips/tcg-target-con-set.h    |   2 +-
 tcg/mips/tcg-target.c.inc        |  39 +++++-----
 tcg/ppc/tcg-target.c.inc         |  61 ++++++++++------
 tcg/riscv/tcg-target.c.inc       |  52 +++++++++----
 tcg/s390x/tcg-target.c.inc       |  64 +++++++++-------
 tcg/sparc64/tcg-target-con-set.h |   1 -
 tcg/sparc64/tcg-target.c.inc     |  69 +++++++++++++-----
 tcg/tcg.c                        |  31 ++++++++
 tcg/tci/tcg-target.c.inc         |  49 +++++++------
 13 files changed, 477 insertions(+), 237 deletions(-)

diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index 46ad91f40e..2524e73ff4 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -1356,25 +1356,37 @@ static inline void tcg_out_dep(TCGContext *s, TCGType ext, TCGReg rd,
     tcg_out_bfm(s, ext, rd, rn, a, b);
 }
 
+static void tgen_cmp(TCGContext *s, TCGType ext, TCGCond cond,
+                     TCGReg a, TCGReg b)
+{
+    if (is_tst_cond(cond)) {
+        tcg_out_insn(s, 3510, ANDS, ext, TCG_REG_XZR, a, b);
+    } else {
+        tcg_out_insn(s, 3502, SUBS, ext, TCG_REG_XZR, a, b);
+    }
+}
+
+static void tgen_cmpi(TCGContext *s, TCGType ext, TCGCond cond,
+                      TCGReg a, tcg_target_long b)
+{
+    if (is_tst_cond(cond)) {
+        tcg_out_logicali(s, I3404_ANDSI, ext, TCG_REG_XZR, a, b);
+    } else if (b >= 0) {
+        tcg_debug_assert(is_aimm(b));
+        tcg_out_insn(s, 3401, SUBSI, ext, TCG_REG_XZR, a, b);
+    } else {
+        tcg_debug_assert(is_aimm(-b));
+        tcg_out_insn(s, 3401, ADDSI, ext, TCG_REG_XZR, a, -b);
+    }
+}
+
 static void tcg_out_cmp(TCGContext *s, TCGType ext, TCGCond cond, TCGReg a,
                         tcg_target_long b, bool const_b)
 {
-    if (is_tst_cond(cond)) {
-        if (!const_b) {
-            tcg_out_insn(s, 3510, ANDS, ext, TCG_REG_XZR, a, b);
-        } else {
-            tcg_out_logicali(s, I3404_ANDSI, ext, TCG_REG_XZR, a, b);
-        }
+    if (const_b) {
+        tgen_cmpi(s, ext, cond, a, b);
     } else {
-        if (!const_b) {
-            tcg_out_insn(s, 3502, SUBS, ext, TCG_REG_XZR, a, b);
-        } else if (b >= 0) {
-            tcg_debug_assert(is_aimm(b));
-            tcg_out_insn(s, 3401, SUBSI, ext, TCG_REG_XZR, a, b);
-        } else {
-            tcg_debug_assert(is_aimm(-b));
-            tcg_out_insn(s, 3401, ADDSI, ext, TCG_REG_XZR, a, -b);
-        }
+        tgen_cmp(s, ext, cond, a, b);
     }
 }
 
@@ -2433,6 +2445,59 @@ static const TCGOutOpUnary outop_not = {
     .out_rr = tgen_not,
 };
 
+static void tgen_cset(TCGContext *s, TCGCond cond, TCGReg ret)
+{
+    /* Use CSET alias of CSINC Wd, WZR, WZR, invert(cond).  */
+    tcg_out_insn(s, 3506, CSINC, TCG_TYPE_I32, ret, TCG_REG_XZR,
+                 TCG_REG_XZR, tcg_invert_cond(cond));
+}
+
+static void tgen_setcond(TCGContext *s, TCGType type, TCGCond cond,
+                         TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tgen_cmp(s, type, cond, a1, a2);
+    tgen_cset(s, cond, a0);
+}
+
+static void tgen_setcondi(TCGContext *s, TCGType type, TCGCond cond,
+                          TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    tgen_cmpi(s, type, cond, a1, a2);
+    tgen_cset(s, cond, a0);
+}
+
+static const TCGOutOpSetcond outop_setcond = {
+    .base.static_constraint = C_O1_I2(r, r, rC),
+    .out_rrr = tgen_setcond,
+    .out_rri = tgen_setcondi,
+};
+
+static void tgen_csetm(TCGContext *s, TCGType ext, TCGCond cond, TCGReg ret)
+{
+    /* Use CSETM alias of CSINV Wd, WZR, WZR, invert(cond).  */
+    tcg_out_insn(s, 3506, CSINV, ext, ret, TCG_REG_XZR,
+                 TCG_REG_XZR, tcg_invert_cond(cond));
+}
+
+static void tgen_negsetcond(TCGContext *s, TCGType type, TCGCond cond,
+                            TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tgen_cmp(s, type, cond, a1, a2);
+    tgen_csetm(s, type, cond, a0);
+}
+
+static void tgen_negsetcondi(TCGContext *s, TCGType type, TCGCond cond,
+                             TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    tgen_cmpi(s, type, cond, a1, a2);
+    tgen_csetm(s, type, cond, a0);
+}
+
+static const TCGOutOpSetcond outop_negsetcond = {
+    .base.static_constraint = C_O1_I2(r, r, rC),
+    .out_rrr = tgen_negsetcond,
+    .out_rri = tgen_negsetcondi,
+};
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType ext,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -2507,26 +2572,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType ext,
         tcg_out_brcond(s, ext, a2, a0, a1, const_args[1], arg_label(args[3]));
         break;
 
-    case INDEX_op_setcond_i32:
-        a2 = (int32_t)a2;
-        /* FALLTHRU */
-    case INDEX_op_setcond_i64:
-        tcg_out_cmp(s, ext, args[3], a1, a2, c2);
-        /* Use CSET alias of CSINC Wd, WZR, WZR, invert(cond).  */
-        tcg_out_insn(s, 3506, CSINC, TCG_TYPE_I32, a0, TCG_REG_XZR,
-                     TCG_REG_XZR, tcg_invert_cond(args[3]));
-        break;
-
-    case INDEX_op_negsetcond_i32:
-        a2 = (int32_t)a2;
-        /* FALLTHRU */
-    case INDEX_op_negsetcond_i64:
-        tcg_out_cmp(s, ext, args[3], a1, a2, c2);
-        /* Use CSETM alias of CSINV Wd, WZR, WZR, invert(cond).  */
-        tcg_out_insn(s, 3506, CSINV, ext, a0, TCG_REG_XZR,
-                     TCG_REG_XZR, tcg_invert_cond(args[3]));
-        break;
-
     case INDEX_op_movcond_i32:
         a2 = (int32_t)a2;
         /* FALLTHRU */
@@ -3114,12 +3159,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(rz, r);
 
-    case INDEX_op_setcond_i32:
-    case INDEX_op_setcond_i64:
-    case INDEX_op_negsetcond_i32:
-    case INDEX_op_negsetcond_i64:
-        return C_O1_I2(r, r, rC);
-
     case INDEX_op_brcond_i32:
     case INDEX_op_brcond_i64:
         return C_O0_I2(r, rC);
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index 55e9f66340..0f2a029f6d 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -1210,31 +1210,48 @@ static void tcg_out_mb(TCGContext *s, TCGArg a0)
     }
 }
 
-static TCGCond tcg_out_cmp(TCGContext *s, TCGCond cond, TCGReg a,
-                           TCGArg b, int b_const)
+static TCGCond tgen_cmp(TCGContext *s, TCGCond cond, TCGReg a, TCGReg b)
 {
+    if (is_tst_cond(cond)) {
+        tcg_out_dat_reg(s, COND_AL, ARITH_TST, 0, a, b, SHIFT_IMM_LSL(0));
+        return tcg_tst_eqne_cond(cond);
+    }
+    tcg_out_dat_reg(s, COND_AL, ARITH_CMP, 0, a, b, SHIFT_IMM_LSL(0));
+    return cond;
+}
+
+static TCGCond tgen_cmpi(TCGContext *s, TCGCond cond, TCGReg a, TCGArg b)
+{
+    int imm12;
+
     if (!is_tst_cond(cond)) {
-        tcg_out_dat_rIN(s, COND_AL, ARITH_CMP, ARITH_CMN, 0, a, b, b_const);
+        tcg_out_dat_IN(s, COND_AL, ARITH_CMP, ARITH_CMN, 0, a, b);
         return cond;
     }
 
-    cond = tcg_tst_eqne_cond(cond);
-    if (b_const) {
-        int imm12 = encode_imm(b);
-
-        /*
-         * The compare constraints allow rIN, but TST does not support N.
-         * Be prepared to load the constant into a scratch register.
-         */
-        if (imm12 >= 0) {
-            tcg_out_dat_imm(s, COND_AL, ARITH_TST, 0, a, imm12);
-            return cond;
-        }
+    /*
+     * The compare constraints allow rIN, but TST does not support N.
+     * Be prepared to load the constant into a scratch register.
+     */
+    imm12 = encode_imm(b);
+    if (imm12 >= 0) {
+        tcg_out_dat_imm(s, COND_AL, ARITH_TST, 0, a, imm12);
+    } else {
         tcg_out_movi32(s, COND_AL, TCG_REG_TMP, b);
-        b = TCG_REG_TMP;
+        tcg_out_dat_reg(s, COND_AL, ARITH_TST, 0,
+                        a, TCG_REG_TMP, SHIFT_IMM_LSL(0));
+    }
+    return tcg_tst_eqne_cond(cond);
+}
+
+static TCGCond tcg_out_cmp(TCGContext *s, TCGCond cond, TCGReg a,
+                           TCGArg b, int b_const)
+{
+    if (b_const) {
+        return tgen_cmpi(s, cond, a, b);
+    } else {
+        return tgen_cmp(s, cond, a, b);
     }
-    tcg_out_dat_reg(s, COND_AL, ARITH_TST, 0, a, b, SHIFT_IMM_LSL(0));
-    return cond;
 }
 
 static TCGCond tcg_out_cmp2(TCGContext *s, const TCGArg *args,
@@ -2164,6 +2181,52 @@ static const TCGOutOpUnary outop_not = {
     .out_rr = tgen_not,
 };
 
+static void finish_setcond(TCGContext *s, TCGCond cond, TCGReg ret, bool neg)
+{
+    tcg_out_movi32(s, tcg_cond_to_arm_cond[tcg_invert_cond(cond)], ret, 0);
+    tcg_out_movi32(s, tcg_cond_to_arm_cond[cond], ret, neg ? -1 : 1);
+}
+
+static void tgen_setcond(TCGContext *s, TCGType type, TCGCond cond,
+                         TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    cond = tgen_cmp(s, cond, a1, a2);
+    finish_setcond(s, cond, a0, false);
+}
+
+static void tgen_setcondi(TCGContext *s, TCGType type, TCGCond cond,
+                          TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    cond = tgen_cmpi(s, cond, a1, a2);
+    finish_setcond(s, cond, a0, false);
+}
+
+static const TCGOutOpSetcond outop_setcond = {
+    .base.static_constraint = C_O1_I2(r, r, rIN),
+    .out_rrr = tgen_setcond,
+    .out_rri = tgen_setcondi,
+};
+
+static void tgen_negsetcond(TCGContext *s, TCGType type, TCGCond cond,
+                            TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    cond = tgen_cmp(s, cond, a1, a2);
+    finish_setcond(s, cond, a0, true);
+}
+
+static void tgen_negsetcondi(TCGContext *s, TCGType type, TCGCond cond,
+                             TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    cond = tgen_cmpi(s, cond, a1, a2);
+    finish_setcond(s, cond, a0, true);
+}
+
+static const TCGOutOpSetcond outop_negsetcond = {
+    .base.static_constraint = C_O1_I2(r, r, rIN),
+    .out_rrr = tgen_negsetcond,
+    .out_rri = tgen_negsetcondi,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -2258,20 +2321,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         c = tcg_out_cmp(s, args[2], args[0], args[1], const_args[1]);
         tcg_out_goto_label(s, tcg_cond_to_arm_cond[c], arg_label(args[3]));
         break;
-    case INDEX_op_setcond_i32:
-        c = tcg_out_cmp(s, args[3], args[1], args[2], const_args[2]);
-        tcg_out_dat_imm(s, tcg_cond_to_arm_cond[c],
-                        ARITH_MOV, args[0], 0, 1);
-        tcg_out_dat_imm(s, tcg_cond_to_arm_cond[tcg_invert_cond(c)],
-                        ARITH_MOV, args[0], 0, 0);
-        break;
-    case INDEX_op_negsetcond_i32:
-        c = tcg_out_cmp(s, args[3], args[1], args[2], const_args[2]);
-        tcg_out_dat_imm(s, tcg_cond_to_arm_cond[c],
-                        ARITH_MVN, args[0], 0, 0);
-        tcg_out_dat_imm(s, tcg_cond_to_arm_cond[tcg_invert_cond(c)],
-                        ARITH_MOV, args[0], 0, 0);
-        break;
 
     case INDEX_op_brcond2_i32:
         c = tcg_out_cmp2(s, args, const_args);
@@ -2372,10 +2421,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i32:
         return C_O0_I2(r, r);
 
-    case INDEX_op_setcond_i32:
-    case INDEX_op_negsetcond_i32:
-        return C_O1_I2(r, r, rIN);
-
     case INDEX_op_brcond_i32:
         return C_O0_I2(r, rIN);
     case INDEX_op_deposit_i32:
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index d1b37c4388..d3a3f1f7fb 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -1679,10 +1679,11 @@ static void tcg_out_brcond2(TCGContext *s, const TCGArg *args,
 }
 #endif
 
-static void tcg_out_setcond(TCGContext *s, int rexw, TCGCond cond,
-                            TCGArg dest, TCGArg arg1, TCGArg arg2,
-                            int const_arg2, bool neg)
+static void tcg_out_setcond(TCGContext *s, TCGType type, TCGCond cond,
+                            TCGReg dest, TCGReg arg1, TCGArg arg2,
+                            bool const_arg2, bool neg)
 {
+    int rexw = type == TCG_TYPE_I32 ? 0 : P_REXW;
     int cmp_rexw = rexw;
     bool inv = false;
     bool cleared;
@@ -1757,7 +1758,7 @@ static void tcg_out_setcond(TCGContext *s, int rexw, TCGCond cond,
     case TCG_COND_LT:
         /* If arg2 is 0, extract the sign bit. */
         if (const_arg2 && arg2 == 0) {
-            tcg_out_mov(s, rexw ? TCG_TYPE_I64 : TCG_TYPE_I32, dest, arg1);
+            tcg_out_mov(s, type, dest, arg1);
             if (inv) {
                 tcg_out_modrm(s, OPC_GRP3_Ev + rexw, EXT3_NOT, dest);
             }
@@ -1793,6 +1794,42 @@ static void tcg_out_setcond(TCGContext *s, int rexw, TCGCond cond,
     }
 }
 
+static void tgen_setcond(TCGContext *s, TCGType type, TCGCond cond,
+                         TCGReg dest, TCGReg arg1, TCGReg arg2)
+{
+    tcg_out_setcond(s, type, cond, dest, arg1, arg2, false, false);
+}
+
+static void tgen_setcondi(TCGContext *s, TCGType type, TCGCond cond,
+                          TCGReg dest, TCGReg arg1, tcg_target_long arg2)
+{
+    tcg_out_setcond(s, type, cond, dest, arg1, arg2, true, false);
+}
+
+static const TCGOutOpSetcond outop_setcond = {
+    .base.static_constraint = C_O1_I2(q, r, reT),
+    .out_rrr = tgen_setcond,
+    .out_rri = tgen_setcondi,
+};
+
+static void tgen_negsetcond(TCGContext *s, TCGType type, TCGCond cond,
+                            TCGReg dest, TCGReg arg1, TCGReg arg2)
+{
+    tcg_out_setcond(s, type, cond, dest, arg1, arg2, false, true);
+}
+
+static void tgen_negsetcondi(TCGContext *s, TCGType type, TCGCond cond,
+                             TCGReg dest, TCGReg arg1, tcg_target_long arg2)
+{
+    tcg_out_setcond(s, type, cond, dest, arg1, arg2, true, true);
+}
+
+static const TCGOutOpSetcond outop_negsetcond = {
+    .base.static_constraint = C_O1_I2(q, r, reT),
+    .out_rrr = tgen_negsetcond,
+    .out_rri = tgen_negsetcondi,
+};
+
 #if TCG_TARGET_REG_BITS == 32
 static void tcg_out_setcond2(TCGContext *s, const TCGArg *args,
                              const int *const_args)
@@ -3091,12 +3128,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_brcond(s, rexw, a2, a0, a1, const_args[1],
                        arg_label(args[3]), 0);
         break;
-    OP_32_64(setcond):
-        tcg_out_setcond(s, rexw, args[3], a0, a1, a2, const_a2, false);
-        break;
-    OP_32_64(negsetcond):
-        tcg_out_setcond(s, rexw, args[3], a0, a1, a2, const_a2, true);
-        break;
     OP_32_64(movcond):
         tcg_out_movcond(s, rexw, args[5], a0, a1, a2, const_a2, args[3]);
         break;
@@ -3934,12 +3965,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_deposit_i64:
         return C_O1_I2(q, 0, qi);
 
-    case INDEX_op_setcond_i32:
-    case INDEX_op_setcond_i64:
-    case INDEX_op_negsetcond_i32:
-    case INDEX_op_negsetcond_i64:
-        return C_O1_I2(q, r, reT);
-
     case INDEX_op_movcond_i32:
     case INDEX_op_movcond_i64:
         return C_O1_I4(r, r, reT, r, 0);
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index e7f97aaa5e..87e8b843f8 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -687,6 +687,42 @@ static void tcg_out_setcond(TCGContext *s, TCGCond cond, TCGReg ret,
     }
 }
 
+static void tgen_setcond(TCGContext *s, TCGType type, TCGCond cond,
+                         TCGReg dest, TCGReg arg1, TCGReg arg2)
+{
+    tcg_out_setcond(s, cond, dest, arg1, arg2, false, false);
+}
+
+static void tgen_setcondi(TCGContext *s, TCGType type, TCGCond cond,
+                          TCGReg dest, TCGReg arg1, tcg_target_long arg2)
+{
+    tcg_out_setcond(s, cond, dest, arg1, arg2, true, false);
+}
+
+static const TCGOutOpSetcond outop_setcond = {
+    .base.static_constraint = C_O1_I2(r, r, rJ),
+    .out_rrr = tgen_setcond,
+    .out_rri = tgen_setcondi,
+};
+
+static void tgen_negsetcond(TCGContext *s, TCGType type, TCGCond cond,
+                            TCGReg dest, TCGReg arg1, TCGReg arg2)
+{
+    tcg_out_setcond(s, cond, dest, arg1, arg2, false, true);
+}
+
+static void tgen_negsetcondi(TCGContext *s, TCGType type, TCGCond cond,
+                             TCGReg dest, TCGReg arg1, tcg_target_long arg2)
+{
+    tcg_out_setcond(s, cond, dest, arg1, arg2, true, true);
+}
+
+static const TCGOutOpSetcond outop_negsetcond = {
+    .base.static_constraint = C_O1_I2(r, r, rJ),
+    .out_rrr = tgen_negsetcond,
+    .out_rri = tgen_negsetcondi,
+};
+
 static void tcg_out_movcond(TCGContext *s, TCGCond cond, TCGReg ret,
                             TCGReg c1, tcg_target_long c2, bool const2,
                             TCGReg v1, TCGReg v2)
@@ -1813,15 +1849,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_opc_revb_d(s, a0, a1);
         break;
 
-    case INDEX_op_setcond_i32:
-    case INDEX_op_setcond_i64:
-        tcg_out_setcond(s, args[3], a0, a1, a2, c2, false);
-        break;
-    case INDEX_op_negsetcond_i32:
-    case INDEX_op_negsetcond_i64:
-        tcg_out_setcond(s, args[3], a0, a1, a2, c2, true);
-        break;
-
     case INDEX_op_movcond_i32:
     case INDEX_op_movcond_i64:
         tcg_out_movcond(s, args[5], a0, a1, a2, c2, args[3], args[4]);
@@ -2452,12 +2479,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
         /* Must deposit into the same register as input */
         return C_O1_I2(r, 0, rz);
 
-    case INDEX_op_setcond_i32:
-    case INDEX_op_setcond_i64:
-    case INDEX_op_negsetcond_i32:
-    case INDEX_op_negsetcond_i64:
-        return C_O1_I2(r, r, rJ);
-
     case INDEX_op_movcond_i32:
     case INDEX_op_movcond_i64:
         return C_O1_I4(r, rz, rJ, rz, rz);
diff --git a/tcg/mips/tcg-target-con-set.h b/tcg/mips/tcg-target-con-set.h
index 248bc95d9b..67dfab2aed 100644
--- a/tcg/mips/tcg-target-con-set.h
+++ b/tcg/mips/tcg-target-con-set.h
@@ -23,8 +23,8 @@ C_O1_I2(r, r, ri)
 C_O1_I2(r, r, rI)
 C_O1_I2(r, r, rIK)
 C_O1_I2(r, r, rJ)
+C_O1_I2(r, r, rz)
 C_O1_I2(r, r, rzW)
-C_O1_I2(r, rz, rz)
 C_O1_I4(r, rz, rz, rz, 0)
 C_O1_I4(r, rz, rz, rz, rz)
 C_O2_I1(r, r, r)
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index 759f152711..51b3ea4bb0 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -952,15 +952,20 @@ static void tcg_out_setcond_end(TCGContext *s, TCGReg ret, int tmpflags)
     }
 }
 
-static void tcg_out_setcond(TCGContext *s, TCGCond cond, TCGReg ret,
-                            TCGReg arg1, TCGReg arg2)
+static void tgen_setcond(TCGContext *s, TCGType type, TCGCond cond,
+                         TCGReg ret, TCGReg arg1, TCGReg arg2)
 {
     int tmpflags = tcg_out_setcond_int(s, cond, ret, arg1, arg2);
     tcg_out_setcond_end(s, ret, tmpflags);
 }
 
-static void tcg_out_negsetcond(TCGContext *s, TCGCond cond, TCGReg ret,
-                               TCGReg arg1, TCGReg arg2)
+static const TCGOutOpSetcond outop_setcond = {
+    .base.static_constraint = C_O1_I2(r, r, rz),
+    .out_rrr = tgen_setcond,
+};
+
+static void tgen_negsetcond(TCGContext *s, TCGType type, TCGCond cond,
+                            TCGReg ret, TCGReg arg1, TCGReg arg2)
 {
     int tmpflags = tcg_out_setcond_int(s, cond, ret, arg1, arg2);
     TCGReg tmp = tmpflags & ~SETCOND_FLAGS;
@@ -978,6 +983,11 @@ static void tcg_out_negsetcond(TCGContext *s, TCGCond cond, TCGReg ret,
     }
 }
 
+static const TCGOutOpSetcond outop_negsetcond = {
+    .base.static_constraint = C_O1_I2(r, r, rz),
+    .out_rrr = tgen_negsetcond,
+};
+
 static void tcg_out_brcond(TCGContext *s, TCGCond cond, TCGReg arg1,
                            TCGReg arg2, TCGLabel *l)
 {
@@ -1041,10 +1051,11 @@ static int tcg_out_setcond2_int(TCGContext *s, TCGCond cond, TCGReg ret,
         break;
 
     default:
-        tcg_out_setcond(s, TCG_COND_EQ, TCG_TMP0, ah, bh);
-        tcg_out_setcond(s, tcg_unsigned_cond(cond), TCG_TMP1, al, bl);
+        tgen_setcond(s, TCG_TYPE_I32, TCG_COND_EQ, TCG_TMP0, ah, bh);
+        tgen_setcond(s, TCG_TYPE_I32, tcg_unsigned_cond(cond),
+                     TCG_TMP1, al, bl);
         tcg_out_opc_reg(s, OPC_AND, TCG_TMP1, TCG_TMP1, TCG_TMP0);
-        tcg_out_setcond(s, tcg_high_cond(cond), TCG_TMP0, ah, bh);
+        tgen_setcond(s, TCG_TYPE_I32, tcg_high_cond(cond), TCG_TMP0, ah, bh);
         tcg_out_opc_reg(s, OPC_OR, ret, TCG_TMP0, TCG_TMP1);
         break;
     }
@@ -2285,14 +2296,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_movcond(s, args[5], a0, a1, a2, args[3], args[4]);
         break;
 
-    case INDEX_op_setcond_i32:
-    case INDEX_op_setcond_i64:
-        tcg_out_setcond(s, args[3], a0, a1, a2);
-        break;
-    case INDEX_op_negsetcond_i32:
-    case INDEX_op_negsetcond_i64:
-        tcg_out_negsetcond(s, args[3], a0, a1, a2);
-        break;
     case INDEX_op_setcond2_i32:
         tcg_out_setcond2(s, args[5], a0, a1, a2, args[3], args[4]);
         break;
@@ -2385,12 +2388,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(rz, r);
 
-    case INDEX_op_setcond_i32:
-    case INDEX_op_setcond_i64:
-    case INDEX_op_negsetcond_i32:
-    case INDEX_op_negsetcond_i64:
-        return C_O1_I2(r, rz, rz);
-
     case INDEX_op_deposit_i32:
     case INDEX_op_deposit_i64:
         return C_O1_I2(r, 0, rz);
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index f2cb45029f..0a66351124 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -1926,8 +1926,8 @@ static TCGReg tcg_gen_setcond_xor(TCGContext *s, TCGReg arg1, TCGArg arg2,
 }
 
 static void tcg_out_setcond(TCGContext *s, TCGType type, TCGCond cond,
-                            TCGArg arg0, TCGArg arg1, TCGArg arg2,
-                            int const_arg2, bool neg)
+                            TCGReg arg0, TCGReg arg1, TCGArg arg2,
+                            bool const_arg2, bool neg)
 {
     int sh;
     bool inv;
@@ -2072,6 +2072,42 @@ static void tcg_out_setcond(TCGContext *s, TCGType type, TCGCond cond,
     }
 }
 
+static void tgen_setcond(TCGContext *s, TCGType type, TCGCond cond,
+                         TCGReg dest, TCGReg arg1, TCGReg arg2)
+{
+    tcg_out_setcond(s, type, cond, dest, arg1, arg2, false, false);
+}
+
+static void tgen_setcondi(TCGContext *s, TCGType type, TCGCond cond,
+                          TCGReg dest, TCGReg arg1, tcg_target_long arg2)
+{
+    tcg_out_setcond(s, type, cond, dest, arg1, arg2, true, false);
+}
+
+static const TCGOutOpSetcond outop_setcond = {
+    .base.static_constraint = C_O1_I2(r, r, rC),
+    .out_rrr = tgen_setcond,
+    .out_rri = tgen_setcondi,
+};
+
+static void tgen_negsetcond(TCGContext *s, TCGType type, TCGCond cond,
+                            TCGReg dest, TCGReg arg1, TCGReg arg2)
+{
+    tcg_out_setcond(s, type, cond, dest, arg1, arg2, false, true);
+}
+
+static void tgen_negsetcondi(TCGContext *s, TCGType type, TCGCond cond,
+                             TCGReg dest, TCGReg arg1, tcg_target_long arg2)
+{
+    tcg_out_setcond(s, type, cond, dest, arg1, arg2, true, true);
+}
+
+static const TCGOutOpSetcond outop_negsetcond = {
+    .base.static_constraint = C_O1_I2(r, r, rC),
+    .out_rrr = tgen_negsetcond,
+    .out_rri = tgen_negsetcondi,
+};
+
 static void tcg_out_bc(TCGContext *s, TCGCond cond, int bd)
 {
     tcg_out32(s, tcg_to_bc[cond] | bd);
@@ -3465,22 +3501,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_qemu_ldst_i128(s, args[0], args[1], args[2], args[3], false);
         break;
 
-    case INDEX_op_setcond_i32:
-        tcg_out_setcond(s, TCG_TYPE_I32, args[3], args[0], args[1], args[2],
-                        const_args[2], false);
-        break;
-    case INDEX_op_setcond_i64:
-        tcg_out_setcond(s, TCG_TYPE_I64, args[3], args[0], args[1], args[2],
-                        const_args[2], false);
-        break;
-    case INDEX_op_negsetcond_i32:
-        tcg_out_setcond(s, TCG_TYPE_I32, args[3], args[0], args[1], args[2],
-                        const_args[2], true);
-        break;
-    case INDEX_op_negsetcond_i64:
-        tcg_out_setcond(s, TCG_TYPE_I64, args[3], args[0], args[1], args[2],
-                        const_args[2], true);
-        break;
     case INDEX_op_setcond2_i32:
         tcg_out_setcond2(s, args, const_args);
         break;
@@ -4276,11 +4296,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_brcond_i32:
     case INDEX_op_brcond_i64:
         return C_O0_I2(r, rC);
-    case INDEX_op_setcond_i32:
-    case INDEX_op_setcond_i64:
-    case INDEX_op_negsetcond_i32:
-    case INDEX_op_negsetcond_i64:
-        return C_O1_I2(r, r, rC);
     case INDEX_op_movcond_i32:
     case INDEX_op_movcond_i64:
         return C_O1_I4(r, r, rC, rZ, rZ);
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index 071be449f6..05114b5c5f 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -1325,6 +1325,24 @@ static void tcg_out_setcond(TCGContext *s, TCGCond cond, TCGReg ret,
     }
 }
 
+static void tgen_setcond(TCGContext *s, TCGType type, TCGCond cond,
+                         TCGReg dest, TCGReg arg1, TCGReg arg2)
+{
+    tcg_out_setcond(s, cond, dest, arg1, arg2, false);
+}
+
+static void tgen_setcondi(TCGContext *s, TCGType type, TCGCond cond,
+                          TCGReg dest, TCGReg arg1, tcg_target_long arg2)
+{
+    tcg_out_setcond(s, cond, dest, arg1, arg2, true);
+}
+
+static const TCGOutOpSetcond outop_setcond = {
+    .base.static_constraint = C_O1_I2(r, r, rI),
+    .out_rrr = tgen_setcond,
+    .out_rri = tgen_setcondi,
+};
+
 static void tcg_out_negsetcond(TCGContext *s, TCGCond cond, TCGReg ret,
                                TCGReg arg1, tcg_target_long arg2, bool c2)
 {
@@ -1363,6 +1381,24 @@ static void tcg_out_negsetcond(TCGContext *s, TCGCond cond, TCGReg ret,
     }
 }
 
+static void tgen_negsetcond(TCGContext *s, TCGType type, TCGCond cond,
+                            TCGReg dest, TCGReg arg1, TCGReg arg2)
+{
+    tcg_out_negsetcond(s, cond, dest, arg1, arg2, false);
+}
+
+static void tgen_negsetcondi(TCGContext *s, TCGType type, TCGCond cond,
+                             TCGReg dest, TCGReg arg1, tcg_target_long arg2)
+{
+    tcg_out_negsetcond(s, cond, dest, arg1, arg2, true);
+}
+
+static const TCGOutOpSetcond outop_negsetcond = {
+    .base.static_constraint = C_O1_I2(r, r, rI),
+    .out_rrr = tgen_negsetcond,
+    .out_rri = tgen_negsetcondi,
+};
+
 static void tcg_out_movcond_zicond(TCGContext *s, TCGReg ret, TCGReg test_ne,
                                    int val1, bool c_val1,
                                    int val2, bool c_val2)
@@ -2485,16 +2521,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_brcond(s, a2, a0, a1, arg_label(args[3]));
         break;
 
-    case INDEX_op_setcond_i32:
-    case INDEX_op_setcond_i64:
-        tcg_out_setcond(s, args[3], a0, a1, a2, c2);
-        break;
-
-    case INDEX_op_negsetcond_i32:
-    case INDEX_op_negsetcond_i64:
-        tcg_out_negsetcond(s, args[3], a0, a1, a2, c2);
-        break;
-
     case INDEX_op_movcond_i32:
     case INDEX_op_movcond_i64:
         tcg_out_movcond(s, args[5], a0, a1, a2, c2,
@@ -2837,12 +2863,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(rz, r);
 
-    case INDEX_op_setcond_i32:
-    case INDEX_op_setcond_i64:
-    case INDEX_op_negsetcond_i32:
-    case INDEX_op_negsetcond_i64:
-        return C_O1_I2(r, r, rI);
-
     case INDEX_op_brcond_i32:
     case INDEX_op_brcond_i64:
         return C_O0_I2(rz, rz);
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index 18b83d5899..3c04b87109 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -1370,9 +1370,9 @@ static int tgen_cmp(TCGContext *s, TCGType type, TCGCond c, TCGReg r1,
     return tgen_cmp2(s, type, c, r1, c2, c2const, need_carry, &inv_cc);
 }
 
-static void tgen_setcond(TCGContext *s, TCGType type, TCGCond cond,
-                         TCGReg dest, TCGReg c1, TCGArg c2,
-                         bool c2const, bool neg)
+static void tgen_setcond_int(TCGContext *s, TCGType type, TCGCond cond,
+                             TCGReg dest, TCGReg c1, TCGArg c2,
+                             bool c2const, bool neg)
 {
     int cc;
 
@@ -1464,6 +1464,42 @@ static void tgen_setcond(TCGContext *s, TCGType type, TCGCond cond,
     tcg_out_insn(s, RRFc, LOCGR, dest, TCG_TMP0, cc);
 }
 
+static void tgen_setcond(TCGContext *s, TCGType type, TCGCond cond,
+                         TCGReg dest, TCGReg arg1, TCGReg arg2)
+{
+    tgen_setcond_int(s, type, cond, dest, arg1, arg2, false, false);
+}
+
+static void tgen_setcondi(TCGContext *s, TCGType type, TCGCond cond,
+                          TCGReg dest, TCGReg arg1, tcg_target_long arg2)
+{
+    tgen_setcond_int(s, type, cond, dest, arg1, arg2, true, false);
+}
+
+static const TCGOutOpSetcond outop_setcond = {
+    .base.static_constraint = C_O1_I2(r, r, rC),
+    .out_rrr = tgen_setcond,
+    .out_rri = tgen_setcondi,
+};
+
+static void tgen_negsetcond(TCGContext *s, TCGType type, TCGCond cond,
+                            TCGReg dest, TCGReg arg1, TCGReg arg2)
+{
+    tgen_setcond_int(s, type, cond, dest, arg1, arg2, false, true);
+}
+
+static void tgen_negsetcondi(TCGContext *s, TCGType type, TCGCond cond,
+                             TCGReg dest, TCGReg arg1, tcg_target_long arg2)
+{
+    tgen_setcond_int(s, type, cond, dest, arg1, arg2, true, true);
+}
+
+static const TCGOutOpSetcond outop_negsetcond = {
+    .base.static_constraint = C_O1_I2(r, r, rC),
+    .out_rrr = tgen_negsetcond,
+    .out_rri = tgen_negsetcondi,
+};
+
 static void tgen_movcond_int(TCGContext *s, TCGType type, TCGReg dest,
                              TCGArg v3, int v3const, TCGReg v4,
                              int cc, int inv_cc)
@@ -2825,14 +2861,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tgen_brcond(s, TCG_TYPE_I32, args[2], args[0],
                     args[1], const_args[1], arg_label(args[3]));
         break;
-    case INDEX_op_setcond_i32:
-        tgen_setcond(s, TCG_TYPE_I32, args[3], args[0], args[1],
-                     args[2], const_args[2], false);
-        break;
-    case INDEX_op_negsetcond_i32:
-        tgen_setcond(s, TCG_TYPE_I32, args[3], args[0], args[1],
-                     args[2], const_args[2], true);
-        break;
     case INDEX_op_movcond_i32:
         tgen_movcond(s, TCG_TYPE_I32, args[5], args[0], args[1],
                      args[2], const_args[2], args[3], const_args[3], args[4]);
@@ -2910,14 +2938,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tgen_brcond(s, TCG_TYPE_I64, args[2], args[0],
                     args[1], const_args[1], arg_label(args[3]));
         break;
-    case INDEX_op_setcond_i64:
-        tgen_setcond(s, TCG_TYPE_I64, args[3], args[0], args[1],
-                     args[2], const_args[2], false);
-        break;
-    case INDEX_op_negsetcond_i64:
-        tgen_setcond(s, TCG_TYPE_I64, args[3], args[0], args[1],
-                     args[2], const_args[2], true);
-        break;
     case INDEX_op_movcond_i64:
         tgen_movcond(s, TCG_TYPE_I64, args[5], args[0], args[1],
                      args[2], const_args[2], args[3], const_args[3], args[4]);
@@ -3434,12 +3454,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(r, r);
 
-    case INDEX_op_setcond_i32:
-    case INDEX_op_negsetcond_i32:
-    case INDEX_op_setcond_i64:
-    case INDEX_op_negsetcond_i64:
-        return C_O1_I2(r, r, rC);
-
     case INDEX_op_brcond_i32:
         return C_O0_I2(r, ri);
     case INDEX_op_brcond_i64:
diff --git a/tcg/sparc64/tcg-target-con-set.h b/tcg/sparc64/tcg-target-con-set.h
index 85dcfbc375..ca7bbf0a2f 100644
--- a/tcg/sparc64/tcg-target-con-set.h
+++ b/tcg/sparc64/tcg-target-con-set.h
@@ -15,7 +15,6 @@ C_O0_I2(rz, rJ)
 C_O1_I1(r, r)
 C_O1_I2(r, r, r)
 C_O1_I2(r, r, rJ)
-C_O1_I2(r, rz, rJ)
 C_O1_I4(r, rz, rJ, rI, 0)
 C_O2_I2(r, r, r, r)
 C_O2_I4(r, r, rz, rz, rJ, rJ)
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index 41c4e77466..dcbe6a8f47 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -714,7 +714,7 @@ static void tcg_out_movcond_i64(TCGContext *s, TCGCond cond, TCGReg ret,
 }
 
 static void tcg_out_setcond_i32(TCGContext *s, TCGCond cond, TCGReg ret,
-                                TCGReg c1, int32_t c2, int c2const, bool neg)
+                                TCGReg c1, int32_t c2, bool c2const, bool neg)
 {
     /* For 32-bit comparisons, we can play games with ADDC/SUBC.  */
     switch (cond) {
@@ -788,7 +788,7 @@ static void tcg_out_setcond_i32(TCGContext *s, TCGCond cond, TCGReg ret,
 }
 
 static void tcg_out_setcond_i64(TCGContext *s, TCGCond cond, TCGReg ret,
-                                TCGReg c1, int32_t c2, int c2const, bool neg)
+                                TCGReg c1, int32_t c2, bool c2const, bool neg)
 {
     int rcond;
 
@@ -822,6 +822,53 @@ static void tcg_out_setcond_i64(TCGContext *s, TCGCond cond, TCGReg ret,
     }
 }
 
+static void tcg_out_setcond(TCGContext *s, TCGType type, TCGCond cond,
+                            TCGReg ret, TCGReg c1,
+                            TCGArg c2, bool c2const, bool neg)
+{
+    if (type == TCG_TYPE_I32) {
+        tcg_out_setcond_i32(s, cond, ret, c1, c2, c2const, neg);
+    } else {
+        tcg_out_setcond_i64(s, cond, ret, c1, c2, c2const, neg);
+    }
+}
+
+static void tgen_setcond(TCGContext *s, TCGType type, TCGCond cond,
+                         TCGReg dest, TCGReg arg1, TCGReg arg2)
+{
+    tcg_out_setcond(s, type, cond, dest, arg1, arg2, false, false);
+}
+
+static void tgen_setcondi(TCGContext *s, TCGType type, TCGCond cond,
+                          TCGReg dest, TCGReg arg1, tcg_target_long arg2)
+{
+    tcg_out_setcond(s, type, cond, dest, arg1, arg2, true, false);
+}
+
+static const TCGOutOpSetcond outop_setcond = {
+    .base.static_constraint = C_O1_I2(r, r, rJ),
+    .out_rrr = tgen_setcond,
+    .out_rri = tgen_setcondi,
+};
+
+static void tgen_negsetcond(TCGContext *s, TCGType type, TCGCond cond,
+                            TCGReg dest, TCGReg arg1, TCGReg arg2)
+{
+    tcg_out_setcond(s, type, cond, dest, arg1, arg2, false, true);
+}
+
+static void tgen_negsetcondi(TCGContext *s, TCGType type, TCGCond cond,
+                             TCGReg dest, TCGReg arg1, tcg_target_long arg2)
+{
+    tcg_out_setcond(s, type, cond, dest, arg1, arg2, true, true);
+}
+
+static const TCGOutOpSetcond outop_negsetcond = {
+    .base.static_constraint = C_O1_I2(r, r, rJ),
+    .out_rrr = tgen_negsetcond,
+    .out_rri = tgen_negsetcondi,
+};
+
 static void tcg_out_addsub2_i32(TCGContext *s, TCGReg rl, TCGReg rh,
                                 TCGReg al, TCGReg ah, int32_t bl, int blconst,
                                 int32_t bh, int bhconst, int opl, int oph)
@@ -1711,12 +1758,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     case INDEX_op_brcond_i32:
         tcg_out_brcond_i32(s, a2, a0, a1, const_args[1], arg_label(args[3]));
         break;
-    case INDEX_op_setcond_i32:
-        tcg_out_setcond_i32(s, args[3], a0, a1, a2, c2, false);
-        break;
-    case INDEX_op_negsetcond_i32:
-        tcg_out_setcond_i32(s, args[3], a0, a1, a2, c2, true);
-        break;
     case INDEX_op_movcond_i32:
         tcg_out_movcond_i32(s, args[5], a0, a1, a2, c2, args[3], const_args[3]);
         break;
@@ -1758,12 +1799,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     case INDEX_op_brcond_i64:
         tcg_out_brcond_i64(s, a2, a0, a1, const_args[1], arg_label(args[3]));
         break;
-    case INDEX_op_setcond_i64:
-        tcg_out_setcond_i64(s, args[3], a0, a1, a2, c2, false);
-        break;
-    case INDEX_op_negsetcond_i64:
-        tcg_out_setcond_i64(s, args[3], a0, a1, a2, c2, true);
-        break;
     case INDEX_op_movcond_i64:
         tcg_out_movcond_i64(s, args[5], a0, a1, a2, c2, args[3], const_args[3]);
         break;
@@ -1837,12 +1872,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_qemu_st_i64:
         return C_O0_I2(rz, r);
 
-    case INDEX_op_setcond_i32:
-    case INDEX_op_setcond_i64:
-    case INDEX_op_negsetcond_i32:
-    case INDEX_op_negsetcond_i64:
-        return C_O1_I2(r, rz, rJ);
-
     case INDEX_op_brcond_i32:
     case INDEX_op_brcond_i64:
         return C_O0_I2(rz, rJ);
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 38a329b876..90e82e7ed0 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1003,6 +1003,14 @@ typedef struct TCGOutOpUnary {
     void (*out_rr)(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1);
 } TCGOutOpUnary;
 
+typedef struct TCGOutOpSetcond {
+    TCGOutOp base;
+    void (*out_rrr)(TCGContext *s, TCGType type, TCGCond cond,
+                    TCGReg ret, TCGReg a1, TCGReg a2);
+    void (*out_rri)(TCGContext *s, TCGType type, TCGCond cond,
+                    TCGReg ret, TCGReg a1, tcg_target_long a2);
+} TCGOutOpSetcond;
+
 typedef struct TCGOutOpSubtract {
     TCGOutOp base;
     void (*out_rrr)(TCGContext *s, TCGType type,
@@ -1047,6 +1055,8 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_muluh, TCGOutOpBinary, outop_muluh),
     OUTOP(INDEX_op_nand, TCGOutOpBinary, outop_nand),
     OUTOP(INDEX_op_neg, TCGOutOpUnary, outop_neg),
+    OUTOP(INDEX_op_negsetcond_i32, TCGOutOpSetcond, outop_negsetcond),
+    OUTOP(INDEX_op_negsetcond_i64, TCGOutOpSetcond, outop_negsetcond),
     OUTOP(INDEX_op_nor, TCGOutOpBinary, outop_nor),
     OUTOP(INDEX_op_not, TCGOutOpUnary, outop_not),
     OUTOP(INDEX_op_or, TCGOutOpBinary, outop_or),
@@ -1056,6 +1066,8 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_rotl, TCGOutOpBinary, outop_rotl),
     OUTOP(INDEX_op_rotr, TCGOutOpBinary, outop_rotr),
     OUTOP(INDEX_op_sar, TCGOutOpBinary, outop_sar),
+    OUTOP(INDEX_op_setcond_i32, TCGOutOpSetcond, outop_setcond),
+    OUTOP(INDEX_op_setcond_i64, TCGOutOpSetcond, outop_setcond),
     OUTOP(INDEX_op_shl, TCGOutOpBinary, outop_shl),
     OUTOP(INDEX_op_shr, TCGOutOpBinary, outop_shr),
     OUTOP(INDEX_op_sub, TCGOutOpSubtract, outop_sub),
@@ -5482,6 +5494,25 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
         }
         break;
 
+    case INDEX_op_setcond_i32:
+    case INDEX_op_setcond_i64:
+    case INDEX_op_negsetcond_i32:
+    case INDEX_op_negsetcond_i64:
+        {
+            const TCGOutOpSetcond *out =
+                container_of(all_outop[op->opc], TCGOutOpSetcond, base);
+            TCGCond cond = new_args[3];
+
+            tcg_debug_assert(!const_args[1]);
+            if (const_args[2]) {
+                out->out_rri(s, type, cond,
+                             new_args[0], new_args[1], new_args[2]);
+            } else {
+                out->out_rrr(s, type, cond,
+                             new_args[0], new_args[1], new_args[2]);
+            }
+        }
+        break;
 
     default:
         if (def->flags & TCG_OPF_VECTOR) {
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index 2eb323b5c5..1b75aba698 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -77,10 +77,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(r, r);
 
-    case INDEX_op_setcond_i32:
-    case INDEX_op_setcond_i64:
-    case INDEX_op_negsetcond_i32:
-    case INDEX_op_negsetcond_i64:
     case INDEX_op_deposit_i32:
     case INDEX_op_deposit_i64:
         return C_O1_I2(r, r, r);
@@ -942,6 +938,32 @@ static const TCGOutOpUnary outop_not = {
     .out_rr = tgen_not,
 };
 
+static void tgen_setcond(TCGContext *s, TCGType type, TCGCond cond,
+                         TCGReg dest, TCGReg arg1, TCGReg arg2)
+{
+    TCGOpcode opc = (type == TCG_TYPE_I32
+                     ? INDEX_op_setcond_i32
+                     : INDEX_op_setcond_i64);
+    tcg_out_op_rrrc(s, opc, dest, arg1, arg2, cond);
+}
+
+static const TCGOutOpSetcond outop_setcond = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_setcond,
+};
+
+static void tgen_negsetcond(TCGContext *s, TCGType type, TCGCond cond,
+                            TCGReg dest, TCGReg arg1, TCGReg arg2)
+{
+    tgen_setcond(s, type, cond, dest, arg1, arg2);
+    tgen_neg(s, type, dest, dest);
+}
+
+static const TCGOutOpSetcond outop_negsetcond = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_negsetcond,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -958,27 +980,12 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_op_l(s, opc, arg_label(args[0]));
         break;
 
-    CASE_32_64(setcond)
-        tcg_out_op_rrrc(s, opc, args[0], args[1], args[2], args[3]);
-        break;
-
     CASE_32_64(movcond)
     case INDEX_op_setcond2_i32:
         tcg_out_op_rrrrrc(s, opc, args[0], args[1], args[2],
                           args[3], args[4], args[5]);
         break;
 
-    case INDEX_op_negsetcond_i32:
-        tcg_out_op_rrrc(s, INDEX_op_setcond_i32,
-                        args[0], args[1], args[2], args[3]);
-        tcg_out_op_rr(s, INDEX_op_neg, args[0], args[0]);
-        break;
-    case INDEX_op_negsetcond_i64:
-        tcg_out_op_rrrc(s, INDEX_op_setcond_i64,
-                        args[0], args[1], args[2], args[3]);
-        tcg_out_op_rr(s, INDEX_op_neg, args[0], args[0]);
-        break;
-
     CASE_32_64(ld8u)
     CASE_32_64(ld8s)
     CASE_32_64(ld16u)
@@ -1005,9 +1012,7 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         break;
 
     CASE_32_64(brcond)
-        tcg_out_op_rrrc(s, (opc == INDEX_op_brcond_i32
-                            ? INDEX_op_setcond_i32 : INDEX_op_setcond_i64),
-                        TCG_REG_TMP, args[0], args[1], args[2]);
+        tgen_setcond(s, type, args[2], TCG_REG_TMP, args[0], args[1]);
         tcg_out_op_rl(s, opc, TCG_REG_TMP, arg_label(args[3]));
         break;
 

From a363e1e179445102d7940e92d394d6c00c126f13 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 10 Jan 2025 09:26:44 -0800
Subject: [PATCH 0436/2760] tcg: Merge INDEX_op_{neg}setcond_{i32,i64}`

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 docs/devel/tcg-ops.rst       |  4 ++--
 include/tcg/tcg-opc.h        |  6 ++----
 target/sh4/translate.c       |  6 +++---
 tcg/optimize.c               | 32 ++++++++------------------------
 tcg/tcg-op.c                 |  8 ++++----
 tcg/tcg.c                    | 30 ++++++++++--------------------
 tcg/tci.c                    | 14 +++++++-------
 tcg/tci/tcg-target-opc.h.inc |  1 +
 tcg/tci/tcg-target.c.inc     |  4 ++--
 9 files changed, 39 insertions(+), 66 deletions(-)

diff --git a/docs/devel/tcg-ops.rst b/docs/devel/tcg-ops.rst
index 592e002971..d3283265cd 100644
--- a/docs/devel/tcg-ops.rst
+++ b/docs/devel/tcg-ops.rst
@@ -499,13 +499,13 @@ Conditional moves
 
 .. list-table::
 
-   * - setcond_i32/i64 *dest*, *t1*, *t2*, *cond*
+   * - setcond *dest*, *t1*, *t2*, *cond*
 
      - | *dest* = (*t1* *cond* *t2*)
        |
        | Set *dest* to 1 if (*t1* *cond* *t2*) is true, otherwise set to 0.
 
-   * - negsetcond_i32/i64 *dest*, *t1*, *t2*, *cond*
+   * - negsetcond *dest*, *t1*, *t2*, *cond*
 
      - | *dest* = -(*t1* *cond* *t2*)
        |
diff --git a/include/tcg/tcg-opc.h b/include/tcg/tcg-opc.h
index 287bdf3473..f40bb5796a 100644
--- a/include/tcg/tcg-opc.h
+++ b/include/tcg/tcg-opc.h
@@ -57,6 +57,7 @@ DEF(mulu2, 2, 2, 0, TCG_OPF_INT)
 DEF(muluh, 1, 2, 0, TCG_OPF_INT)
 DEF(nand, 1, 2, 0, TCG_OPF_INT)
 DEF(neg, 1, 1, 0, TCG_OPF_INT)
+DEF(negsetcond, 1, 2, 1, TCG_OPF_INT)
 DEF(nor, 1, 2, 0, TCG_OPF_INT)
 DEF(not, 1, 1, 0, TCG_OPF_INT)
 DEF(or, 1, 2, 0, TCG_OPF_INT)
@@ -66,13 +67,12 @@ DEF(remu, 1, 2, 0, TCG_OPF_INT)
 DEF(rotl, 1, 2, 0, TCG_OPF_INT)
 DEF(rotr, 1, 2, 0, TCG_OPF_INT)
 DEF(sar, 1, 2, 0, TCG_OPF_INT)
+DEF(setcond, 1, 2, 1, TCG_OPF_INT)
 DEF(shl, 1, 2, 0, TCG_OPF_INT)
 DEF(shr, 1, 2, 0, TCG_OPF_INT)
 DEF(sub, 1, 2, 0, TCG_OPF_INT)
 DEF(xor, 1, 2, 0, TCG_OPF_INT)
 
-DEF(setcond_i32, 1, 2, 1, 0)
-DEF(negsetcond_i32, 1, 2, 1, 0)
 DEF(movcond_i32, 1, 4, 1, 0)
 /* load/store */
 DEF(ld8u_i32, 1, 1, 1, 0)
@@ -99,8 +99,6 @@ DEF(setcond2_i32, 1, 4, 1, 0)
 DEF(bswap16_i32, 1, 1, 1, 0)
 DEF(bswap32_i32, 1, 1, 1, 0)
 
-DEF(setcond_i64, 1, 2, 1, 0)
-DEF(negsetcond_i64, 1, 2, 1, 0)
 DEF(movcond_i64, 1, 4, 1, 0)
 /* load/store */
 DEF(ld8u_i64, 1, 1, 1, 0)
diff --git a/target/sh4/translate.c b/target/sh4/translate.c
index 8248648c0c..712a57fb54 100644
--- a/target/sh4/translate.c
+++ b/target/sh4/translate.c
@@ -1995,7 +1995,7 @@ static void decode_gusa(DisasContext *ctx, CPUSH4State *env)
         if ((ld_dst == B11_8) + (ld_dst == B7_4) != 1 || mv_src >= 0) {
             goto fail;
         }
-        op_opc = INDEX_op_setcond_i32;  /* placeholder */
+        op_opc = INDEX_op_setcond;  /* placeholder */
         op_src = (ld_dst == B11_8 ? B7_4 : B11_8);
         op_arg = REG(op_src);
 
@@ -2030,7 +2030,7 @@ static void decode_gusa(DisasContext *ctx, CPUSH4State *env)
         if (ld_dst != B11_8 || ld_dst != B7_4 || mv_src >= 0) {
             goto fail;
         }
-        op_opc = INDEX_op_setcond_i32;
+        op_opc = INDEX_op_setcond;
         op_arg = tcg_constant_i32(0);
 
         NEXT_INSN;
@@ -2147,7 +2147,7 @@ static void decode_gusa(DisasContext *ctx, CPUSH4State *env)
         }
         break;
 
-    case INDEX_op_setcond_i32:
+    case INDEX_op_setcond:
         if (st_src == ld_dst) {
             goto fail;
         }
diff --git a/tcg/optimize.c b/tcg/optimize.c
index 0affde323b..e53dbd4290 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -1996,35 +1996,19 @@ static bool fold_movcond(OptContext *ctx, TCGOp *op)
     if (ti_is_const(tt) && ti_is_const(ft)) {
         uint64_t tv = ti_const_val(tt);
         uint64_t fv = ti_const_val(ft);
-        TCGOpcode opc, negopc;
         TCGCond cond = op->args[5];
 
-        switch (ctx->type) {
-        case TCG_TYPE_I32:
-            opc = INDEX_op_setcond_i32;
-            negopc = INDEX_op_negsetcond_i32;
-            tv = (int32_t)tv;
-            fv = (int32_t)fv;
-            break;
-        case TCG_TYPE_I64:
-            opc = INDEX_op_setcond_i64;
-            negopc = INDEX_op_negsetcond_i64;
-            break;
-        default:
-            g_assert_not_reached();
-        }
-
         if (tv == 1 && fv == 0) {
-            op->opc = opc;
+            op->opc = INDEX_op_setcond;
             op->args[3] = cond;
         } else if (fv == 1 && tv == 0) {
-            op->opc = opc;
+            op->opc = INDEX_op_setcond;
             op->args[3] = tcg_invert_cond(cond);
         } else if (tv == -1 && fv == 0) {
-            op->opc = negopc;
+            op->opc = INDEX_op_negsetcond;
             op->args[3] = cond;
         } else if (fv == -1 && tv == 0) {
-            op->opc = negopc;
+            op->opc = INDEX_op_negsetcond;
             op->args[3] = tcg_invert_cond(cond);
         }
     }
@@ -2526,14 +2510,14 @@ static bool fold_setcond2(OptContext *ctx, TCGOp *op)
     do_setcond_low:
         op->args[2] = op->args[3];
         op->args[3] = cond;
-        op->opc = INDEX_op_setcond_i32;
+        op->opc = INDEX_op_setcond;
         return fold_setcond(ctx, op);
 
     do_setcond_high:
         op->args[1] = op->args[2];
         op->args[2] = op->args[4];
         op->args[3] = cond;
-        op->opc = INDEX_op_setcond_i32;
+        op->opc = INDEX_op_setcond;
         return fold_setcond(ctx, op);
     }
 
@@ -3025,10 +3009,10 @@ void tcg_optimize(TCGContext *s)
         case INDEX_op_shr:
             done = fold_shift(&ctx, op);
             break;
-        CASE_OP_32_64(setcond):
+        case INDEX_op_setcond:
             done = fold_setcond(&ctx, op);
             break;
-        CASE_OP_32_64(negsetcond):
+        case INDEX_op_negsetcond:
             done = fold_negsetcond(&ctx, op);
             break;
         case INDEX_op_setcond2_i32:
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index 413b68352d..477dfc25b7 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -552,7 +552,7 @@ void tcg_gen_setcond_i32(TCGCond cond, TCGv_i32 ret,
     } else if (cond == TCG_COND_NEVER) {
         tcg_gen_movi_i32(ret, 0);
     } else {
-        tcg_gen_op4i_i32(INDEX_op_setcond_i32, ret, arg1, arg2, cond);
+        tcg_gen_op4i_i32(INDEX_op_setcond, ret, arg1, arg2, cond);
     }
 }
 
@@ -570,7 +570,7 @@ void tcg_gen_negsetcond_i32(TCGCond cond, TCGv_i32 ret,
     } else if (cond == TCG_COND_NEVER) {
         tcg_gen_movi_i32(ret, 0);
     } else {
-        tcg_gen_op4i_i32(INDEX_op_negsetcond_i32, ret, arg1, arg2, cond);
+        tcg_gen_op4i_i32(INDEX_op_negsetcond, ret, arg1, arg2, cond);
     }
 }
 
@@ -1911,7 +1911,7 @@ void tcg_gen_setcond_i64(TCGCond cond, TCGv_i64 ret,
                              TCGV_LOW(arg2), TCGV_HIGH(arg2), cond);
             tcg_gen_movi_i32(TCGV_HIGH(ret), 0);
         } else {
-            tcg_gen_op4i_i64(INDEX_op_setcond_i64, ret, arg1, arg2, cond);
+            tcg_gen_op4i_i64(INDEX_op_setcond, ret, arg1, arg2, cond);
         }
     }
 }
@@ -1948,7 +1948,7 @@ void tcg_gen_negsetcond_i64(TCGCond cond, TCGv_i64 ret,
     } else if (cond == TCG_COND_NEVER) {
         tcg_gen_movi_i64(ret, 0);
     } else if (TCG_TARGET_REG_BITS == 64) {
-        tcg_gen_op4i_i64(INDEX_op_negsetcond_i64, ret, arg1, arg2, cond);
+        tcg_gen_op4i_i64(INDEX_op_negsetcond, ret, arg1, arg2, cond);
     } else {
         tcg_gen_op6i_i32(INDEX_op_setcond2_i32, TCGV_LOW(ret),
                          TCGV_LOW(arg1), TCGV_HIGH(arg1),
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 90e82e7ed0..49fbf1f561 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1055,8 +1055,7 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_muluh, TCGOutOpBinary, outop_muluh),
     OUTOP(INDEX_op_nand, TCGOutOpBinary, outop_nand),
     OUTOP(INDEX_op_neg, TCGOutOpUnary, outop_neg),
-    OUTOP(INDEX_op_negsetcond_i32, TCGOutOpSetcond, outop_negsetcond),
-    OUTOP(INDEX_op_negsetcond_i64, TCGOutOpSetcond, outop_negsetcond),
+    OUTOP(INDEX_op_negsetcond, TCGOutOpSetcond, outop_negsetcond),
     OUTOP(INDEX_op_nor, TCGOutOpBinary, outop_nor),
     OUTOP(INDEX_op_not, TCGOutOpUnary, outop_not),
     OUTOP(INDEX_op_or, TCGOutOpBinary, outop_or),
@@ -1066,8 +1065,7 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_rotl, TCGOutOpBinary, outop_rotl),
     OUTOP(INDEX_op_rotr, TCGOutOpBinary, outop_rotr),
     OUTOP(INDEX_op_sar, TCGOutOpBinary, outop_sar),
-    OUTOP(INDEX_op_setcond_i32, TCGOutOpSetcond, outop_setcond),
-    OUTOP(INDEX_op_setcond_i64, TCGOutOpSetcond, outop_setcond),
+    OUTOP(INDEX_op_setcond, TCGOutOpSetcond, outop_setcond),
     OUTOP(INDEX_op_shl, TCGOutOpBinary, outop_shl),
     OUTOP(INDEX_op_shr, TCGOutOpBinary, outop_shr),
     OUTOP(INDEX_op_sub, TCGOutOpSubtract, outop_sub),
@@ -2275,12 +2273,12 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_add:
     case INDEX_op_and:
     case INDEX_op_mov:
+    case INDEX_op_negsetcond:
     case INDEX_op_or:
+    case INDEX_op_setcond:
     case INDEX_op_xor:
         return has_type;
 
-    case INDEX_op_setcond_i32:
-    case INDEX_op_negsetcond_i32:
     case INDEX_op_brcond_i32:
     case INDEX_op_movcond_i32:
     case INDEX_op_ld8u_i32:
@@ -2311,8 +2309,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_setcond2_i32:
         return TCG_TARGET_REG_BITS == 32;
 
-    case INDEX_op_setcond_i64:
-    case INDEX_op_negsetcond_i64:
     case INDEX_op_brcond_i64:
     case INDEX_op_movcond_i64:
     case INDEX_op_ld8u_i64:
@@ -2864,14 +2860,12 @@ void tcg_dump_ops(TCGContext *s, FILE *f, bool have_prefs)
             }
             switch (c) {
             case INDEX_op_brcond_i32:
-            case INDEX_op_setcond_i32:
-            case INDEX_op_negsetcond_i32:
+            case INDEX_op_setcond:
+            case INDEX_op_negsetcond:
             case INDEX_op_movcond_i32:
             case INDEX_op_brcond2_i32:
             case INDEX_op_setcond2_i32:
             case INDEX_op_brcond_i64:
-            case INDEX_op_setcond_i64:
-            case INDEX_op_negsetcond_i64:
             case INDEX_op_movcond_i64:
             case INDEX_op_cmp_vec:
             case INDEX_op_cmpsel_vec:
@@ -5068,10 +5062,8 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
     case INDEX_op_brcond_i64:
         op_cond = op->args[2];
         break;
-    case INDEX_op_setcond_i32:
-    case INDEX_op_setcond_i64:
-    case INDEX_op_negsetcond_i32:
-    case INDEX_op_negsetcond_i64:
+    case INDEX_op_setcond:
+    case INDEX_op_negsetcond:
     case INDEX_op_cmp_vec:
         op_cond = op->args[3];
         break;
@@ -5494,10 +5486,8 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
         }
         break;
 
-    case INDEX_op_setcond_i32:
-    case INDEX_op_setcond_i64:
-    case INDEX_op_negsetcond_i32:
-    case INDEX_op_negsetcond_i64:
+    case INDEX_op_setcond:
+    case INDEX_op_negsetcond:
         {
             const TCGOutOpSetcond *out =
                 container_of(all_outop[op->opc], TCGOutOpSetcond, base);
diff --git a/tcg/tci.c b/tcg/tci.c
index 569b5c7ed0..d97ca1fade 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -438,10 +438,6 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_args_l(insn, tb_ptr, &ptr);
             tb_ptr = ptr;
             continue;
-        case INDEX_op_setcond_i32:
-            tci_args_rrrc(insn, &r0, &r1, &r2, &condition);
-            regs[r0] = tci_compare32(regs[r1], regs[r2], condition);
-            break;
         case INDEX_op_movcond_i32:
             tci_args_rrrrrc(insn, &r0, &r1, &r2, &r3, &r4, &condition);
             tmp32 = tci_compare32(regs[r1], regs[r2], condition);
@@ -455,7 +451,7 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             regs[r0] = tci_compare64(T1, T2, condition);
             break;
 #elif TCG_TARGET_REG_BITS == 64
-        case INDEX_op_setcond_i64:
+        case INDEX_op_setcond:
             tci_args_rrrc(insn, &r0, &r1, &r2, &condition);
             regs[r0] = tci_compare64(regs[r1], regs[r2], condition);
             break;
@@ -628,6 +624,10 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tmp32 = regs[r1];
             regs[r0] = tmp32 ? ctz32(tmp32) : regs[r2];
             break;
+        case INDEX_op_tci_setcond32:
+            tci_args_rrrc(insn, &r0, &r1, &r2, &condition);
+            regs[r0] = tci_compare32(regs[r1], regs[r2], condition);
+            break;
 
             /* Shift/rotate operations. */
 
@@ -971,8 +971,8 @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
                            op_name, str_r(r0), ptr);
         break;
 
-    case INDEX_op_setcond_i32:
-    case INDEX_op_setcond_i64:
+    case INDEX_op_setcond:
+    case INDEX_op_tci_setcond32:
         tci_args_rrrc(insn, &r0, &r1, &r2, &c);
         info->fprintf_func(info->stream, "%-12s  %s, %s, %s, %s",
                            op_name, str_r(r0), str_r(r1), str_r(r2), str_c(c));
diff --git a/tcg/tci/tcg-target-opc.h.inc b/tcg/tci/tcg-target-opc.h.inc
index 2bb346f4c8..27b4574e4f 100644
--- a/tcg/tci/tcg-target-opc.h.inc
+++ b/tcg/tci/tcg-target-opc.h.inc
@@ -10,3 +10,4 @@ DEF(tci_rems32, 1, 2, 0, TCG_OPF_NOT_PRESENT)
 DEF(tci_remu32, 1, 2, 0, TCG_OPF_NOT_PRESENT)
 DEF(tci_rotl32, 1, 2, 0, TCG_OPF_NOT_PRESENT)
 DEF(tci_rotr32, 1, 2, 0, TCG_OPF_NOT_PRESENT)
+DEF(tci_setcond32, 1, 2, 1, TCG_OPF_NOT_PRESENT)
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index 1b75aba698..d49c767de5 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -942,8 +942,8 @@ static void tgen_setcond(TCGContext *s, TCGType type, TCGCond cond,
                          TCGReg dest, TCGReg arg1, TCGReg arg2)
 {
     TCGOpcode opc = (type == TCG_TYPE_I32
-                     ? INDEX_op_setcond_i32
-                     : INDEX_op_setcond_i64);
+                     ? INDEX_op_tci_setcond32
+                     : INDEX_op_setcond);
     tcg_out_op_rrrc(s, opc, dest, arg1, arg2, cond);
 }
 

From 99ac4706b35a2c16e2bf4437e966fc39c41ed67d Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 10 Jan 2025 11:40:06 -0800
Subject: [PATCH 0437/2760] tcg: Convert brcond to TCGOutOpBrcond

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target.c.inc         | 39 +++++++++++++++-------------
 tcg/arm/tcg-target.c.inc             | 27 ++++++++++++++-----
 tcg/i386/tcg-target.c.inc            | 28 ++++++++++++++------
 tcg/loongarch64/tcg-target-con-set.h |  2 +-
 tcg/loongarch64/tcg-target.c.inc     | 18 +++++--------
 tcg/mips/tcg-target-con-set.h        |  4 +--
 tcg/mips/tcg-target.c.inc            | 20 +++++++-------
 tcg/ppc/tcg-target.c.inc             | 31 +++++++++++-----------
 tcg/riscv/tcg-target-con-set.h       |  2 +-
 tcg/riscv/tcg-target.c.inc           | 18 +++++--------
 tcg/s390x/tcg-target.c.inc           | 31 ++++++++++++----------
 tcg/sparc64/tcg-target-con-set.h     |  2 +-
 tcg/sparc64/tcg-target.c.inc         | 38 ++++++++++++++++++++-------
 tcg/tcg.c                            | 26 +++++++++++++++++++
 tcg/tci.c                            |  9 ++-----
 tcg/tci/tcg-target.c.inc             | 20 +++++++-------
 16 files changed, 190 insertions(+), 125 deletions(-)

diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index 2524e73ff4..e3d8e9090f 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -1424,8 +1424,16 @@ static inline void tcg_out_goto_label(TCGContext *s, TCGLabel *l)
     }
 }
 
-static void tcg_out_brcond(TCGContext *s, TCGType ext, TCGCond c, TCGArg a,
-                           TCGArg b, bool b_const, TCGLabel *l)
+static void tgen_brcond(TCGContext *s, TCGType type, TCGCond c,
+                        TCGReg a, TCGReg b, TCGLabel *l)
+{
+    tgen_cmp(s, type, c, a, b);
+    tcg_out_reloc(s, s->code_ptr, R_AARCH64_CONDBR19, l, 0);
+    tcg_out_insn(s, 3202, B_C, c, 0);
+}
+
+static void tgen_brcondi(TCGContext *s, TCGType ext, TCGCond c,
+                         TCGReg a, tcg_target_long b, TCGLabel *l)
 {
     int tbit = -1;
     bool need_cmp = true;
@@ -1434,14 +1442,14 @@ static void tcg_out_brcond(TCGContext *s, TCGType ext, TCGCond c, TCGArg a,
     case TCG_COND_EQ:
     case TCG_COND_NE:
         /* cmp xN,0; b.ne L -> cbnz xN,L */
-        if (b_const && b == 0) {
+        if (b == 0) {
             need_cmp = false;
         }
         break;
     case TCG_COND_LT:
     case TCG_COND_GE:
         /* cmp xN,0; b.mi L -> tbnz xN,63,L */
-        if (b_const && b == 0) {
+        if (b == 0) {
             c = (c == TCG_COND_LT ? TCG_COND_TSTNE : TCG_COND_TSTEQ);
             tbit = ext ? 63 : 31;
             need_cmp = false;
@@ -1450,14 +1458,14 @@ static void tcg_out_brcond(TCGContext *s, TCGType ext, TCGCond c, TCGArg a,
     case TCG_COND_TSTEQ:
     case TCG_COND_TSTNE:
         /* tst xN,0xffffffff; b.ne L -> cbnz wN,L */
-        if (b_const && b == UINT32_MAX) {
+        if (b == UINT32_MAX) {
             c = tcg_tst_eqne_cond(c);
             ext = TCG_TYPE_I32;
             need_cmp = false;
             break;
         }
         /* tst xN,1<<B; b.ne L -> tbnz xN,B,L */
-        if (b_const && is_power_of_2(b)) {
+        if (is_power_of_2(b)) {
             tbit = ctz64(b);
             need_cmp = false;
         }
@@ -1467,7 +1475,7 @@ static void tcg_out_brcond(TCGContext *s, TCGType ext, TCGCond c, TCGArg a,
     }
 
     if (need_cmp) {
-        tcg_out_cmp(s, ext, c, a, b, b_const);
+        tgen_cmpi(s, ext, c, a, b);
         tcg_out_reloc(s, s->code_ptr, R_AARCH64_CONDBR19, l, 0);
         tcg_out_insn(s, 3202, B_C, c, 0);
         return;
@@ -1500,6 +1508,12 @@ static void tcg_out_brcond(TCGContext *s, TCGType ext, TCGCond c, TCGArg a,
     }
 }
 
+static const TCGOutOpBrcond outop_brcond = {
+    .base.static_constraint = C_O0_I2(r, rC),
+    .out_rr = tgen_brcond,
+    .out_ri = tgen_brcondi,
+};
+
 static inline void tcg_out_rev(TCGContext *s, int ext, MemOp s_bits,
                                TCGReg rd, TCGReg rn)
 {
@@ -2565,13 +2579,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType ext,
         tcg_out_ldst(s, I3312_STRX, a0, a1, a2, 3);
         break;
 
-    case INDEX_op_brcond_i32:
-        a1 = (int32_t)a1;
-        /* FALLTHRU */
-    case INDEX_op_brcond_i64:
-        tcg_out_brcond(s, ext, a2, a0, a1, const_args[1], arg_label(args[3]));
-        break;
-
     case INDEX_op_movcond_i32:
         a2 = (int32_t)a2;
         /* FALLTHRU */
@@ -3159,10 +3166,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(rz, r);
 
-    case INDEX_op_brcond_i32:
-    case INDEX_op_brcond_i64:
-        return C_O0_I2(r, rC);
-
     case INDEX_op_movcond_i32:
     case INDEX_op_movcond_i64:
         return C_O1_I4(r, r, rC, rz, rz);
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index 0f2a029f6d..4c7537cbeb 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -2181,6 +2181,26 @@ static const TCGOutOpUnary outop_not = {
     .out_rr = tgen_not,
 };
 
+static void tgen_brcond(TCGContext *s, TCGType type, TCGCond cond,
+                        TCGReg a0, TCGReg a1, TCGLabel *l)
+{
+    cond = tgen_cmp(s, cond, a0, a1);
+    tcg_out_goto_label(s, tcg_cond_to_arm_cond[cond], l);
+}
+
+static void tgen_brcondi(TCGContext *s, TCGType type, TCGCond cond,
+                         TCGReg a0, tcg_target_long a1, TCGLabel *l)
+{
+    cond = tgen_cmpi(s, cond, a0, a1);
+    tcg_out_goto_label(s, tcg_cond_to_arm_cond[cond], l);
+}
+
+static const TCGOutOpBrcond outop_brcond = {
+    .base.static_constraint = C_O0_I2(r, rIN),
+    .out_rr = tgen_brcond,
+    .out_ri = tgen_brcondi,
+};
+
 static void finish_setcond(TCGContext *s, TCGCond cond, TCGReg ret, bool neg)
 {
     tcg_out_movi32(s, tcg_cond_to_arm_cond[tcg_invert_cond(cond)], ret, 0);
@@ -2317,11 +2337,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_mov_reg(s, COND_AL, args[0], a0);
         break;
 
-    case INDEX_op_brcond_i32:
-        c = tcg_out_cmp(s, args[2], args[0], args[1], const_args[1]);
-        tcg_out_goto_label(s, tcg_cond_to_arm_cond[c], arg_label(args[3]));
-        break;
-
     case INDEX_op_brcond2_i32:
         c = tcg_out_cmp2(s, args, const_args);
         tcg_out_goto_label(s, tcg_cond_to_arm_cond[c], arg_label(args[5]));
@@ -2421,8 +2436,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i32:
         return C_O0_I2(r, r);
 
-    case INDEX_op_brcond_i32:
-        return C_O0_I2(r, rIN);
     case INDEX_op_deposit_i32:
         return C_O1_I2(r, 0, rZ);
     case INDEX_op_extract2_i32:
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index d3a3f1f7fb..d2eff3b617 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -1642,6 +1642,26 @@ static void tcg_out_brcond(TCGContext *s, int rexw, TCGCond cond,
     tcg_out_jxx(s, jcc, label, small);
 }
 
+static void tgen_brcond(TCGContext *s, TCGType type, TCGCond cond,
+                        TCGReg arg1, TCGReg arg2, TCGLabel *label)
+{
+    int rexw = type == TCG_TYPE_I32 ? 0 : P_REXW;
+    tcg_out_brcond(s, rexw, cond, arg1, arg2, false, label, false);
+}
+
+static void tgen_brcondi(TCGContext *s, TCGType type, TCGCond cond,
+                         TCGReg arg1, tcg_target_long arg2, TCGLabel *label)
+{
+    int rexw = type == TCG_TYPE_I32 ? 0 : P_REXW;
+    tcg_out_brcond(s, rexw, cond, arg1, arg2, true, label, false);
+}
+
+static const TCGOutOpBrcond outop_brcond = {
+    .base.static_constraint = C_O0_I2(r, reT),
+    .out_rr = tgen_brcond,
+    .out_ri = tgen_brcondi,
+};
+
 #if TCG_TARGET_REG_BITS == 32
 static void tcg_out_brcond2(TCGContext *s, const TCGArg *args,
                             const int *const_args, bool small)
@@ -3124,10 +3144,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    OP_32_64(brcond):
-        tcg_out_brcond(s, rexw, a2, a0, a1, const_args[1],
-                       arg_label(args[3]), 0);
-        break;
     OP_32_64(movcond):
         tcg_out_movcond(s, rexw, args[5], a0, a1, a2, const_a2, args[3]);
         break;
@@ -3936,10 +3952,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(re, r);
 
-    case INDEX_op_brcond_i32:
-    case INDEX_op_brcond_i64:
-        return C_O0_I2(r, reT);
-
     case INDEX_op_bswap16_i32:
     case INDEX_op_bswap16_i64:
     case INDEX_op_bswap32_i32:
diff --git a/tcg/loongarch64/tcg-target-con-set.h b/tcg/loongarch64/tcg-target-con-set.h
index c145d4ab66..dfe55c6fe8 100644
--- a/tcg/loongarch64/tcg-target-con-set.h
+++ b/tcg/loongarch64/tcg-target-con-set.h
@@ -16,7 +16,7 @@
  */
 C_O0_I1(r)
 C_O0_I2(rz, r)
-C_O0_I2(rz, rz)
+C_O0_I2(r, rz)
 C_O0_I2(w, r)
 C_O0_I3(r, r, r)
 C_O1_I1(r, r)
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index 87e8b843f8..53bba07c49 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -767,8 +767,8 @@ static const struct {
     [TCG_COND_GTU] = { OPC_BGTU, false }
 };
 
-static void tcg_out_brcond(TCGContext *s, TCGCond cond, TCGReg arg1,
-                           TCGReg arg2, TCGLabel *l)
+static void tgen_brcond(TCGContext *s, TCGType type, TCGCond cond,
+                        TCGReg arg1, TCGReg arg2, TCGLabel *l)
 {
     LoongArchInsn op = tcg_brcond_to_loongarch[cond].op;
 
@@ -785,6 +785,11 @@ static void tcg_out_brcond(TCGContext *s, TCGCond cond, TCGReg arg1,
     tcg_out32(s, encode_djsk16_insn(op, arg1, arg2, 0));
 }
 
+static const TCGOutOpBrcond outop_brcond = {
+    .base.static_constraint = C_O0_I2(r, rz),
+    .out_rr = tgen_brcond,
+};
+
 static void tcg_out_call_int(TCGContext *s, const tcg_insn_unit *arg, bool tail)
 {
     TCGReg link = tail ? TCG_REG_ZERO : TCG_REG_RA;
@@ -1771,11 +1776,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_opc_b(s, 0);
         break;
 
-    case INDEX_op_brcond_i32:
-    case INDEX_op_brcond_i64:
-        tcg_out_brcond(s, a2, a0, a1, arg_label(args[3]));
-        break;
-
     case INDEX_op_extrh_i64_i32:
         tcg_out_opc_srai_d(s, a0, a1, 32);
         break;
@@ -2441,10 +2441,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_qemu_st_i128:
         return C_O0_I3(r, r, r);
 
-    case INDEX_op_brcond_i32:
-    case INDEX_op_brcond_i64:
-        return C_O0_I2(rz, rz);
-
     case INDEX_op_extu_i32_i64:
     case INDEX_op_extrl_i64_i32:
     case INDEX_op_extrh_i64_i32:
diff --git a/tcg/mips/tcg-target-con-set.h b/tcg/mips/tcg-target-con-set.h
index 67dfab2aed..a80630a8b4 100644
--- a/tcg/mips/tcg-target-con-set.h
+++ b/tcg/mips/tcg-target-con-set.h
@@ -10,12 +10,10 @@
  * tcg-target-con-str.h; the constraint combination is inclusive or.
  */
 C_O0_I1(r)
+C_O0_I2(r, rz)
 C_O0_I2(rz, r)
-C_O0_I2(rz, rz)
-C_O0_I3(rz, r, r)
 C_O0_I3(rz, rz, r)
 C_O0_I4(rz, rz, rz, rz)
-C_O0_I4(rz, rz, r, r)
 C_O1_I1(r, r)
 C_O1_I2(r, 0, rz)
 C_O1_I2(r, r, r)
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index 51b3ea4bb0..a942905dc4 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -988,8 +988,8 @@ static const TCGOutOpSetcond outop_negsetcond = {
     .out_rrr = tgen_negsetcond,
 };
 
-static void tcg_out_brcond(TCGContext *s, TCGCond cond, TCGReg arg1,
-                           TCGReg arg2, TCGLabel *l)
+static void tgen_brcond(TCGContext *s, TCGType type, TCGCond cond,
+                        TCGReg arg1, TCGReg arg2, TCGLabel *l)
 {
     static const MIPSInsn b_zero[16] = {
         [TCG_COND_LT] = OPC_BLTZ,
@@ -1034,6 +1034,11 @@ static void tcg_out_brcond(TCGContext *s, TCGCond cond, TCGReg arg1,
     tcg_out_nop(s);
 }
 
+static const TCGOutOpBrcond outop_brcond = {
+    .base.static_constraint = C_O0_I2(r, rz),
+    .out_rr = tgen_brcond,
+};
+
 static int tcg_out_setcond2_int(TCGContext *s, TCGCond cond, TCGReg ret,
                                 TCGReg al, TCGReg ah, TCGReg bl, TCGReg bh)
 {
@@ -2178,8 +2183,8 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
     case INDEX_op_br:
-        tcg_out_brcond(s, TCG_COND_EQ, TCG_REG_ZERO, TCG_REG_ZERO,
-                       arg_label(a0));
+        tgen_brcond(s, TCG_TYPE_I32, TCG_COND_EQ,
+                    TCG_REG_ZERO, TCG_REG_ZERO, arg_label(a0));
         break;
 
     case INDEX_op_ld8u_i32:
@@ -2283,10 +2288,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    case INDEX_op_brcond_i32:
-    case INDEX_op_brcond_i64:
-        tcg_out_brcond(s, a2, a0, a1, arg_label(args[3]));
-        break;
     case INDEX_op_brcond2_i32:
         tcg_out_brcond2(s, args[4], a0, a1, a2, args[3], arg_label(args[5]));
         break;
@@ -2391,9 +2392,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_deposit_i32:
     case INDEX_op_deposit_i64:
         return C_O1_I2(r, 0, rz);
-    case INDEX_op_brcond_i32:
-    case INDEX_op_brcond_i64:
-        return C_O0_I2(rz, rz);
     case INDEX_op_movcond_i32:
     case INDEX_op_movcond_i64:
         return (use_mips32r6_instructions
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index 0a66351124..819abdc906 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -2124,14 +2124,26 @@ static void tcg_out_bc_lab(TCGContext *s, TCGCond cond, TCGLabel *l)
     tcg_out_bc(s, cond, bd);
 }
 
-static void tcg_out_brcond(TCGContext *s, TCGCond cond,
-                           TCGArg arg1, TCGArg arg2, int const_arg2,
-                           TCGLabel *l, TCGType type)
+static void tgen_brcond(TCGContext *s, TCGType type, TCGCond cond,
+                        TCGReg arg1, TCGReg arg2, TCGLabel *l)
 {
-    tcg_out_cmp(s, cond, arg1, arg2, const_arg2, 0, type);
+    tcg_out_cmp(s, cond, arg1, arg2, false, 0, type);
     tcg_out_bc_lab(s, cond, l);
 }
 
+static void tgen_brcondi(TCGContext *s, TCGType type, TCGCond cond,
+                         TCGReg arg1, tcg_target_long arg2, TCGLabel *l)
+{
+    tcg_out_cmp(s, cond, arg1, arg2, true, 0, type);
+    tcg_out_bc_lab(s, cond, l);
+}
+
+static const TCGOutOpBrcond outop_brcond = {
+    .base.static_constraint = C_O0_I2(r, rC),
+    .out_rr = tgen_brcond,
+    .out_ri = tgen_brcondi,
+};
+
 static void tcg_out_movcond(TCGContext *s, TCGType type, TCGCond cond,
                             TCGArg dest, TCGArg c1, TCGArg c2, TCGArg v1,
                             TCGArg v2, bool const_c2)
@@ -3457,14 +3469,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_mem_long(s, STD, STDX, args[0], args[1], args[2]);
         break;
 
-    case INDEX_op_brcond_i32:
-        tcg_out_brcond(s, args[2], args[0], args[1], const_args[1],
-                       arg_label(args[3]), TCG_TYPE_I32);
-        break;
-    case INDEX_op_brcond_i64:
-        tcg_out_brcond(s, args[2], args[0], args[1], const_args[1],
-                       arg_label(args[3]), TCG_TYPE_I64);
-        break;
     case INDEX_op_brcond2_i32:
         tcg_out_brcond2(s, args, const_args);
         break;
@@ -4293,9 +4297,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(r, r);
 
-    case INDEX_op_brcond_i32:
-    case INDEX_op_brcond_i64:
-        return C_O0_I2(r, rC);
     case INDEX_op_movcond_i32:
     case INDEX_op_movcond_i64:
         return C_O1_I4(r, r, rC, rZ, rZ);
diff --git a/tcg/riscv/tcg-target-con-set.h b/tcg/riscv/tcg-target-con-set.h
index f0d3cb81bd..5ff2c2db60 100644
--- a/tcg/riscv/tcg-target-con-set.h
+++ b/tcg/riscv/tcg-target-con-set.h
@@ -11,7 +11,7 @@
  */
 C_O0_I1(r)
 C_O0_I2(rz, r)
-C_O0_I2(rz, rz)
+C_O0_I2(r, rz)
 C_O1_I1(r, r)
 C_O1_I2(r, r, r)
 C_O1_I2(r, r, ri)
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index 05114b5c5f..1d7194e883 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -1184,8 +1184,8 @@ static const struct {
     [TCG_COND_GTU] = { OPC_BLTU, true  }
 };
 
-static void tcg_out_brcond(TCGContext *s, TCGCond cond, TCGReg arg1,
-                           TCGReg arg2, TCGLabel *l)
+static void tgen_brcond(TCGContext *s, TCGType type, TCGCond cond,
+                        TCGReg arg1, TCGReg arg2, TCGLabel *l)
 {
     RISCVInsn op = tcg_brcond_to_riscv[cond].op;
 
@@ -1201,6 +1201,11 @@ static void tcg_out_brcond(TCGContext *s, TCGCond cond, TCGReg arg1,
     tcg_out_opc_branch(s, op, arg1, arg2, 0);
 }
 
+static const TCGOutOpBrcond outop_brcond = {
+    .base.static_constraint = C_O0_I2(r, rz),
+    .out_rr = tgen_brcond,
+};
+
 #define SETCOND_INV    TCG_TARGET_NB_REGS
 #define SETCOND_NEZ    (SETCOND_INV << 1)
 #define SETCOND_FLAGS  (SETCOND_INV | SETCOND_NEZ)
@@ -2516,11 +2521,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                         const_args[4], const_args[5], true, false);
         break;
 
-    case INDEX_op_brcond_i32:
-    case INDEX_op_brcond_i64:
-        tcg_out_brcond(s, a2, a0, a1, arg_label(args[3]));
-        break;
-
     case INDEX_op_movcond_i32:
     case INDEX_op_movcond_i64:
         tcg_out_movcond(s, args[5], a0, a1, a2, c2,
@@ -2863,10 +2863,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(rz, r);
 
-    case INDEX_op_brcond_i32:
-    case INDEX_op_brcond_i64:
-        return C_O0_I2(rz, rz);
-
     case INDEX_op_movcond_i32:
     case INDEX_op_movcond_i64:
         return C_O1_I4(r, r, rI, rM, rM);
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index 3c04b87109..d3650636aa 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -1693,6 +1693,24 @@ static void tgen_brcond(TCGContext *s, TCGType type, TCGCond c,
     tgen_branch(s, cc, l);
 }
 
+static void tgen_brcondr(TCGContext *s, TCGType type, TCGCond c,
+                         TCGReg a0, TCGReg a1, TCGLabel *l)
+{
+    tgen_brcond(s, type, c, a0, a1, false, l);
+}
+
+static void tgen_brcondi(TCGContext *s, TCGType type, TCGCond c,
+                         TCGReg a0, tcg_target_long a1, TCGLabel *l)
+{
+    tgen_brcond(s, type, c, a0, a1, true, l);
+}
+
+static const TCGOutOpBrcond outop_brcond = {
+    .base.static_constraint = C_O0_I2(r, rC),
+    .out_rr = tgen_brcondr,
+    .out_ri = tgen_brcondi,
+};
+
 static void tcg_out_call_int(TCGContext *s, const tcg_insn_unit *dest)
 {
     ptrdiff_t off = tcg_pcrel_diff(s, dest) >> 1;
@@ -2857,10 +2875,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tgen_branch(s, S390_CC_ALWAYS, arg_label(args[0]));
         break;
 
-    case INDEX_op_brcond_i32:
-        tgen_brcond(s, TCG_TYPE_I32, args[2], args[0],
-                    args[1], const_args[1], arg_label(args[3]));
-        break;
     case INDEX_op_movcond_i32:
         tgen_movcond(s, TCG_TYPE_I32, args[5], args[0], args[1],
                      args[2], const_args[2], args[3], const_args[3], args[4]);
@@ -2934,10 +2948,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_insn(s, RRE, SLBGR, args[1], args[5]);
         break;
 
-    case INDEX_op_brcond_i64:
-        tgen_brcond(s, TCG_TYPE_I64, args[2], args[0],
-                    args[1], const_args[1], arg_label(args[3]));
-        break;
     case INDEX_op_movcond_i64:
         tgen_movcond(s, TCG_TYPE_I64, args[5], args[0], args[1],
                      args[2], const_args[2], args[3], const_args[3], args[4]);
@@ -3454,11 +3464,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(r, r);
 
-    case INDEX_op_brcond_i32:
-        return C_O0_I2(r, ri);
-    case INDEX_op_brcond_i64:
-        return C_O0_I2(r, rC);
-
     case INDEX_op_bswap16_i32:
     case INDEX_op_bswap16_i64:
     case INDEX_op_bswap32_i32:
diff --git a/tcg/sparc64/tcg-target-con-set.h b/tcg/sparc64/tcg-target-con-set.h
index ca7bbf0a2f..9f66e52ec6 100644
--- a/tcg/sparc64/tcg-target-con-set.h
+++ b/tcg/sparc64/tcg-target-con-set.h
@@ -11,7 +11,7 @@
  */
 C_O0_I1(r)
 C_O0_I2(rz, r)
-C_O0_I2(rz, rJ)
+C_O0_I2(r, rJ)
 C_O1_I1(r, r)
 C_O1_I2(r, r, r)
 C_O1_I2(r, r, rJ)
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index dcbe6a8f47..68f38b7d71 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -822,6 +822,35 @@ static void tcg_out_setcond_i64(TCGContext *s, TCGCond cond, TCGReg ret,
     }
 }
 
+static void tcg_out_brcond(TCGContext *s, TCGType type, TCGCond cond,
+                           TCGReg arg1, TCGArg arg2, bool const_arg2,
+                           TCGLabel *l)
+{
+    if (type == TCG_TYPE_I32) {
+        tcg_out_brcond_i32(s, cond, arg1, arg2, const_arg2, l);
+    } else {
+        tcg_out_brcond_i64(s, cond, arg1, arg2, const_arg2, l);
+    }
+}
+
+static void tgen_brcond(TCGContext *s, TCGType type, TCGCond cond,
+                        TCGReg arg1, TCGReg arg2, TCGLabel *l)
+{
+    tcg_out_brcond(s, type, cond, arg1, arg2, false, l);
+}
+
+static void tgen_brcondi(TCGContext *s, TCGType type, TCGCond cond,
+                         TCGReg arg1, tcg_target_long arg2, TCGLabel *l)
+{
+    tcg_out_brcond(s, type, cond, arg1, arg2, true, l);
+}
+
+static const TCGOutOpBrcond outop_brcond = {
+    .base.static_constraint = C_O0_I2(r, rJ),
+    .out_rr = tgen_brcond,
+    .out_ri = tgen_brcondi,
+};
+
 static void tcg_out_setcond(TCGContext *s, TCGType type, TCGCond cond,
                             TCGReg ret, TCGReg c1,
                             TCGArg c2, bool c2const, bool neg)
@@ -1755,9 +1784,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_ldst(s, a0, a1, a2, STW);
         break;
 
-    case INDEX_op_brcond_i32:
-        tcg_out_brcond_i32(s, a2, a0, a1, const_args[1], arg_label(args[3]));
-        break;
     case INDEX_op_movcond_i32:
         tcg_out_movcond_i32(s, args[5], a0, a1, a2, c2, args[3], const_args[3]);
         break;
@@ -1796,9 +1822,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_ldst(s, a0, a1, a2, STX);
         break;
 
-    case INDEX_op_brcond_i64:
-        tcg_out_brcond_i64(s, a2, a0, a1, const_args[1], arg_label(args[3]));
-        break;
     case INDEX_op_movcond_i64:
         tcg_out_movcond_i64(s, args[5], a0, a1, a2, c2, args[3], const_args[3]);
         break;
@@ -1872,9 +1895,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_qemu_st_i64:
         return C_O0_I2(rz, r);
 
-    case INDEX_op_brcond_i32:
-    case INDEX_op_brcond_i64:
-        return C_O0_I2(rz, rJ);
     case INDEX_op_movcond_i32:
     case INDEX_op_movcond_i64:
         return C_O1_I4(r, rz, rJ, rI, 0);
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 49fbf1f561..dbaa574cb5 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -986,6 +986,14 @@ typedef struct TCGOutOpBinary {
                     TCGReg a0, TCGReg a1, tcg_target_long a2);
 } TCGOutOpBinary;
 
+typedef struct TCGOutOpBrcond {
+    TCGOutOp base;
+    void (*out_rr)(TCGContext *s, TCGType type, TCGCond cond,
+                   TCGReg a1, TCGReg a2, TCGLabel *label);
+    void (*out_ri)(TCGContext *s, TCGType type, TCGCond cond,
+                   TCGReg a1, tcg_target_long a2, TCGLabel *label);
+} TCGOutOpBrcond;
+
 typedef struct TCGOutOpDivRem {
     TCGOutOp base;
     void (*out_rr01r)(TCGContext *s, TCGType type,
@@ -1040,6 +1048,8 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_add, TCGOutOpBinary, outop_add),
     OUTOP(INDEX_op_and, TCGOutOpBinary, outop_and),
     OUTOP(INDEX_op_andc, TCGOutOpBinary, outop_andc),
+    OUTOP(INDEX_op_brcond_i32, TCGOutOpBrcond, outop_brcond),
+    OUTOP(INDEX_op_brcond_i64, TCGOutOpBrcond, outop_brcond),
     OUTOP(INDEX_op_clz, TCGOutOpBinary, outop_clz),
     OUTOP(INDEX_op_ctpop, TCGOutOpUnary, outop_ctpop),
     OUTOP(INDEX_op_ctz, TCGOutOpBinary, outop_ctz),
@@ -5486,6 +5496,22 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
         }
         break;
 
+    case INDEX_op_brcond_i32:
+    case INDEX_op_brcond_i64:
+        {
+            const TCGOutOpBrcond *out = &outop_brcond;
+            TCGCond cond = new_args[2];
+            TCGLabel *label = arg_label(new_args[3]);
+
+            tcg_debug_assert(!const_args[0]);
+            if (const_args[1]) {
+                out->out_ri(s, type, cond, new_args[0], new_args[1], label);
+            } else {
+                out->out_rr(s, type, cond, new_args[0], new_args[1], label);
+            }
+        }
+        break;
+
     case INDEX_op_setcond:
     case INDEX_op_negsetcond:
         {
diff --git a/tcg/tci.c b/tcg/tci.c
index d97ca1fade..d431cad6fd 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -665,8 +665,9 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             regs[r0] = sextract32(regs[r1], pos, len);
             break;
         case INDEX_op_brcond_i32:
+        case INDEX_op_brcond_i64:
             tci_args_rl(insn, tb_ptr, &r0, &ptr);
-            if ((uint32_t)regs[r0]) {
+            if (regs[r0]) {
                 tb_ptr = ptr;
             }
             break;
@@ -784,12 +785,6 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_args_rrbb(insn, &r0, &r1, &pos, &len);
             regs[r0] = sextract64(regs[r1], pos, len);
             break;
-        case INDEX_op_brcond_i64:
-            tci_args_rl(insn, tb_ptr, &r0, &ptr);
-            if (regs[r0]) {
-                tb_ptr = ptr;
-            }
-            break;
         case INDEX_op_ext_i32_i64:
             tci_args_rr(insn, &r0, &r1);
             regs[r0] = (int32_t)regs[r1];
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index d49c767de5..2c7fb5d75f 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -81,10 +81,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_deposit_i64:
         return C_O1_I2(r, r, r);
 
-    case INDEX_op_brcond_i32:
-    case INDEX_op_brcond_i64:
-        return C_O0_I2(r, r);
-
     case INDEX_op_add2_i32:
     case INDEX_op_add2_i64:
     case INDEX_op_sub2_i32:
@@ -964,6 +960,17 @@ static const TCGOutOpSetcond outop_negsetcond = {
     .out_rrr = tgen_negsetcond,
 };
 
+static void tgen_brcond(TCGContext *s, TCGType type, TCGCond cond,
+                        TCGReg arg0, TCGReg arg1, TCGLabel *l)
+{
+    tgen_setcond(s, type, cond, TCG_REG_TMP, arg0, arg1);
+    tcg_out_op_rl(s, INDEX_op_brcond_i32, TCG_REG_TMP, l);
+}
+
+static const TCGOutOpBrcond outop_brcond = {
+    .base.static_constraint = C_O0_I2(r, r),
+    .out_rr = tgen_brcond,
+};
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -1011,11 +1018,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_op_rrbb(s, opc, args[0], args[1], args[2], args[3]);
         break;
 
-    CASE_32_64(brcond)
-        tgen_setcond(s, type, args[2], TCG_REG_TMP, args[0], args[1]);
-        tcg_out_op_rl(s, opc, TCG_REG_TMP, arg_label(args[3]));
-        break;
-
     case INDEX_op_bswap32_i32: /* Optional (TCG_TARGET_HAS_bswap32_i32). */
     case INDEX_op_bswap64_i64: /* Optional (TCG_TARGET_HAS_bswap64_i64). */
         tcg_out_op_rr(s, opc, args[0], args[1]);

From b6d69fcefbd45ca33b896abfbc8e27e0f713bdf0 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 10 Jan 2025 11:49:22 -0800
Subject: [PATCH 0438/2760] tcg: Merge INDEX_op_brcond_{i32,i64}
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 docs/devel/tcg-ops.rst   |  2 +-
 include/tcg/tcg-opc.h    |  4 +---
 tcg/optimize.c           |  6 +++---
 tcg/tcg-op.c             |  4 ++--
 tcg/tcg.c                | 24 ++++++++----------------
 tcg/tci.c                |  6 ++----
 tcg/tci/tcg-target.c.inc |  4 ++--
 7 files changed, 19 insertions(+), 31 deletions(-)

diff --git a/docs/devel/tcg-ops.rst b/docs/devel/tcg-ops.rst
index d3283265cd..18f02c5122 100644
--- a/docs/devel/tcg-ops.rst
+++ b/docs/devel/tcg-ops.rst
@@ -239,7 +239,7 @@ Jumps/Labels
 
      - | Jump to label.
 
-   * - brcond_i32/i64 *t0*, *t1*, *cond*, *label*
+   * - brcond *t0*, *t1*, *cond*, *label*
 
      - | Conditional jump if *t0* *cond* *t1* is true. *cond* can be:
        |
diff --git a/include/tcg/tcg-opc.h b/include/tcg/tcg-opc.h
index f40bb5796a..d40ca001c2 100644
--- a/include/tcg/tcg-opc.h
+++ b/include/tcg/tcg-opc.h
@@ -34,6 +34,7 @@ DEF(set_label, 0, 0, 1, TCG_OPF_BB_END | TCG_OPF_NOT_PRESENT)
 DEF(call, 0, 0, 3, TCG_OPF_CALL_CLOBBER | TCG_OPF_NOT_PRESENT)
 
 DEF(br, 0, 0, 1, TCG_OPF_BB_END | TCG_OPF_NOT_PRESENT)
+DEF(brcond, 0, 2, 2, TCG_OPF_BB_END | TCG_OPF_COND_BRANCH | TCG_OPF_INT)
 
 DEF(mb, 0, 0, 1, TCG_OPF_NOT_PRESENT)
 
@@ -89,8 +90,6 @@ DEF(extract_i32, 1, 1, 2, 0)
 DEF(sextract_i32, 1, 1, 2, 0)
 DEF(extract2_i32, 1, 2, 1, 0)
 
-DEF(brcond_i32, 0, 2, 2, TCG_OPF_BB_END | TCG_OPF_COND_BRANCH)
-
 DEF(add2_i32, 2, 4, 0, 0)
 DEF(sub2_i32, 2, 4, 0, 0)
 DEF(brcond2_i32, 0, 4, 2, TCG_OPF_BB_END | TCG_OPF_COND_BRANCH)
@@ -124,7 +123,6 @@ DEF(extu_i32_i64, 1, 1, 0, 0)
 DEF(extrl_i64_i32, 1, 1, 0, 0)
 DEF(extrh_i64_i32, 1, 1, 0, 0)
 
-DEF(brcond_i64, 0, 2, 2, TCG_OPF_BB_END | TCG_OPF_COND_BRANCH)
 DEF(bswap16_i64, 1, 1, 1, 0)
 DEF(bswap32_i64, 1, 1, 1, 0)
 DEF(bswap64_i64, 1, 1, 1, 0)
diff --git a/tcg/optimize.c b/tcg/optimize.c
index e53dbd4290..d0cb4588ed 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -1529,14 +1529,14 @@ static bool fold_brcond2(OptContext *ctx, TCGOp *op)
         break;
 
     do_brcond_low:
-        op->opc = INDEX_op_brcond_i32;
+        op->opc = INDEX_op_brcond;
         op->args[1] = op->args[2];
         op->args[2] = cond;
         op->args[3] = label;
         return fold_brcond(ctx, op);
 
     do_brcond_high:
-        op->opc = INDEX_op_brcond_i32;
+        op->opc = INDEX_op_brcond;
         op->args[0] = op->args[1];
         op->args[1] = op->args[3];
         op->args[2] = cond;
@@ -2864,7 +2864,7 @@ void tcg_optimize(TCGContext *s)
         case INDEX_op_andc_vec:
             done = fold_andc(&ctx, op);
             break;
-        CASE_OP_32_64(brcond):
+        case INDEX_op_brcond:
             done = fold_brcond(&ctx, op);
             break;
         case INDEX_op_brcond2_i32:
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index 477dfc25b7..041ca95f0d 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -529,7 +529,7 @@ void tcg_gen_brcond_i32(TCGCond cond, TCGv_i32 arg1, TCGv_i32 arg2, TCGLabel *l)
     if (cond == TCG_COND_ALWAYS) {
         tcg_gen_br(l);
     } else if (cond != TCG_COND_NEVER) {
-        TCGOp *op = tcg_gen_op4ii_i32(INDEX_op_brcond_i32,
+        TCGOp *op = tcg_gen_op4ii_i32(INDEX_op_brcond,
                                       arg1, arg2, cond, label_arg(l));
         add_as_label_use(l, op);
     }
@@ -1874,7 +1874,7 @@ void tcg_gen_brcond_i64(TCGCond cond, TCGv_i64 arg1, TCGv_i64 arg2, TCGLabel *l)
                                    TCGV_HIGH(arg1), TCGV_LOW(arg2),
                                    TCGV_HIGH(arg2), cond, label_arg(l));
         } else {
-            op = tcg_gen_op4ii_i64(INDEX_op_brcond_i64, arg1, arg2, cond,
+            op = tcg_gen_op4ii_i64(INDEX_op_brcond, arg1, arg2, cond,
                                    label_arg(l));
         }
         add_as_label_use(l, op);
diff --git a/tcg/tcg.c b/tcg/tcg.c
index dbaa574cb5..4dc6995d00 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1048,8 +1048,7 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_add, TCGOutOpBinary, outop_add),
     OUTOP(INDEX_op_and, TCGOutOpBinary, outop_and),
     OUTOP(INDEX_op_andc, TCGOutOpBinary, outop_andc),
-    OUTOP(INDEX_op_brcond_i32, TCGOutOpBrcond, outop_brcond),
-    OUTOP(INDEX_op_brcond_i64, TCGOutOpBrcond, outop_brcond),
+    OUTOP(INDEX_op_brcond, TCGOutOpBrcond, outop_brcond),
     OUTOP(INDEX_op_clz, TCGOutOpBinary, outop_clz),
     OUTOP(INDEX_op_ctpop, TCGOutOpUnary, outop_ctpop),
     OUTOP(INDEX_op_ctz, TCGOutOpBinary, outop_ctz),
@@ -2282,6 +2281,7 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
 
     case INDEX_op_add:
     case INDEX_op_and:
+    case INDEX_op_brcond:
     case INDEX_op_mov:
     case INDEX_op_negsetcond:
     case INDEX_op_or:
@@ -2289,7 +2289,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_xor:
         return has_type;
 
-    case INDEX_op_brcond_i32:
     case INDEX_op_movcond_i32:
     case INDEX_op_ld8u_i32:
     case INDEX_op_ld8s_i32:
@@ -2319,7 +2318,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_setcond2_i32:
         return TCG_TARGET_REG_BITS == 32;
 
-    case INDEX_op_brcond_i64:
     case INDEX_op_movcond_i64:
     case INDEX_op_ld8u_i64:
     case INDEX_op_ld8s_i64:
@@ -2869,13 +2867,12 @@ void tcg_dump_ops(TCGContext *s, FILE *f, bool have_prefs)
                                                   op->args[k++]));
             }
             switch (c) {
-            case INDEX_op_brcond_i32:
+            case INDEX_op_brcond:
             case INDEX_op_setcond:
             case INDEX_op_negsetcond:
             case INDEX_op_movcond_i32:
             case INDEX_op_brcond2_i32:
             case INDEX_op_setcond2_i32:
-            case INDEX_op_brcond_i64:
             case INDEX_op_movcond_i64:
             case INDEX_op_cmp_vec:
             case INDEX_op_cmpsel_vec:
@@ -2961,8 +2958,7 @@ void tcg_dump_ops(TCGContext *s, FILE *f, bool have_prefs)
             switch (c) {
             case INDEX_op_set_label:
             case INDEX_op_br:
-            case INDEX_op_brcond_i32:
-            case INDEX_op_brcond_i64:
+            case INDEX_op_brcond:
             case INDEX_op_brcond2_i32:
                 col += ne_fprintf(f, "%s$L%d", k ? "," : "",
                                   arg_label(op->args[k])->id);
@@ -3417,8 +3413,7 @@ void tcg_op_remove(TCGContext *s, TCGOp *op)
     case INDEX_op_br:
         remove_label_use(op, 0);
         break;
-    case INDEX_op_brcond_i32:
-    case INDEX_op_brcond_i64:
+    case INDEX_op_brcond:
         remove_label_use(op, 3);
         break;
     case INDEX_op_brcond2_i32:
@@ -3519,8 +3514,7 @@ static void move_label_uses(TCGLabel *to, TCGLabel *from)
         case INDEX_op_br:
             op->args[0] = label_arg(to);
             break;
-        case INDEX_op_brcond_i32:
-        case INDEX_op_brcond_i64:
+        case INDEX_op_brcond:
             op->args[3] = label_arg(to);
             break;
         case INDEX_op_brcond2_i32:
@@ -5068,8 +5062,7 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
     o_allocated_regs = s->reserved_regs;
 
     switch (op->opc) {
-    case INDEX_op_brcond_i32:
-    case INDEX_op_brcond_i64:
+    case INDEX_op_brcond:
         op_cond = op->args[2];
         break;
     case INDEX_op_setcond:
@@ -5496,8 +5489,7 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
         }
         break;
 
-    case INDEX_op_brcond_i32:
-    case INDEX_op_brcond_i64:
+    case INDEX_op_brcond:
         {
             const TCGOutOpBrcond *out = &outop_brcond;
             TCGCond cond = new_args[2];
diff --git a/tcg/tci.c b/tcg/tci.c
index d431cad6fd..4c5dc16ecb 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -664,8 +664,7 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_args_rrbb(insn, &r0, &r1, &pos, &len);
             regs[r0] = sextract32(regs[r1], pos, len);
             break;
-        case INDEX_op_brcond_i32:
-        case INDEX_op_brcond_i64:
+        case INDEX_op_brcond:
             tci_args_rl(insn, tb_ptr, &r0, &ptr);
             if (regs[r0]) {
                 tb_ptr = ptr;
@@ -959,8 +958,7 @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
         info->fprintf_func(info->stream, "%-12s  %d, %p", op_name, len, ptr);
         break;
 
-    case INDEX_op_brcond_i32:
-    case INDEX_op_brcond_i64:
+    case INDEX_op_brcond:
         tci_args_rl(insn, tb_ptr, &r0, &ptr);
         info->fprintf_func(info->stream, "%-12s  %s, 0, ne, %p",
                            op_name, str_r(r0), ptr);
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index 2c7fb5d75f..18628b957a 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -964,7 +964,7 @@ static void tgen_brcond(TCGContext *s, TCGType type, TCGCond cond,
                         TCGReg arg0, TCGReg arg1, TCGLabel *l)
 {
     tgen_setcond(s, type, cond, TCG_REG_TMP, arg0, arg1);
-    tcg_out_op_rl(s, INDEX_op_brcond_i32, TCG_REG_TMP, l);
+    tcg_out_op_rl(s, INDEX_op_brcond, TCG_REG_TMP, l);
 }
 
 static const TCGOutOpBrcond outop_brcond = {
@@ -1047,7 +1047,7 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     case INDEX_op_brcond2_i32:
         tcg_out_op_rrrrrc(s, INDEX_op_setcond2_i32, TCG_REG_TMP,
                           args[0], args[1], args[2], args[3], args[4]);
-        tcg_out_op_rl(s, INDEX_op_brcond_i32, TCG_REG_TMP, arg_label(args[5]));
+        tcg_out_op_rl(s, INDEX_op_brcond, TCG_REG_TMP, arg_label(args[5]));
         break;
 #endif
 

From 1f406e46785e60e274a9c581d6fd07e05a6ff4e0 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 10 Jan 2025 13:29:39 -0800
Subject: [PATCH 0439/2760] tcg: Convert movcond to TCGOutOpMovcond

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target.c.inc         | 26 +++++++++++++-------------
 tcg/arm/tcg-target.c.inc             | 24 ++++++++++++++----------
 tcg/i386/tcg-target.c.inc            | 23 +++++++++++------------
 tcg/loongarch64/tcg-target-con-set.h |  2 +-
 tcg/loongarch64/tcg-target.c.inc     | 23 +++++++++--------------
 tcg/mips/tcg-target-con-set.h        |  3 ++-
 tcg/mips/tcg-target.c.inc            | 25 ++++++++++++-------------
 tcg/ppc/tcg-target.c.inc             | 24 ++++++++----------------
 tcg/riscv/tcg-target.c.inc           | 26 ++++++++++----------------
 tcg/s390x/tcg-target-con-set.h       |  1 -
 tcg/s390x/tcg-target.c.inc           | 26 ++++++++------------------
 tcg/sparc64/tcg-target-con-set.h     |  2 +-
 tcg/sparc64/tcg-target.c.inc         | 28 ++++++++++++++++------------
 tcg/tcg.c                            | 23 +++++++++++++++++++++++
 tcg/tci.c                            | 12 ++++++------
 tcg/tci/tcg-target-opc.h.inc         |  1 +
 tcg/tci/tcg-target.c.inc             | 18 +++++++++++++++---
 17 files changed, 150 insertions(+), 137 deletions(-)

diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index e3d8e9090f..ee45e7e244 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -2513,6 +2513,19 @@ static const TCGOutOpSetcond outop_negsetcond = {
     .out_rri = tgen_negsetcondi,
 };
 
+static void tgen_movcond(TCGContext *s, TCGType type, TCGCond cond,
+                         TCGReg ret, TCGReg c1, TCGArg c2, bool const_c2,
+                         TCGArg vt, bool const_vt, TCGArg vf, bool const_vf)
+{
+    tcg_out_cmp(s, type, cond, c1, c2, const_c2);
+    tcg_out_insn(s, 3506, CSEL, type, ret, vt, vf, cond);
+}
+
+static const TCGOutOpMovcond outop_movcond = {
+    .base.static_constraint = C_O1_I4(r, r, rC, rz, rz),
+    .out = tgen_movcond,
+};
+
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType ext,
                        const TCGArg args[TCG_MAX_OP_ARGS],
                        const int const_args[TCG_MAX_OP_ARGS])
@@ -2521,7 +2534,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType ext,
     TCGArg a0 = args[0];
     TCGArg a1 = args[1];
     TCGArg a2 = args[2];
-    int c2 = const_args[2];
 
     switch (opc) {
     case INDEX_op_goto_ptr:
@@ -2579,14 +2591,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType ext,
         tcg_out_ldst(s, I3312_STRX, a0, a1, a2, 3);
         break;
 
-    case INDEX_op_movcond_i32:
-        a2 = (int32_t)a2;
-        /* FALLTHRU */
-    case INDEX_op_movcond_i64:
-        tcg_out_cmp(s, ext, args[5], a1, a2, c2);
-        tcg_out_insn(s, 3506, CSEL, ext, a0, args[3], args[4], args[5]);
-        break;
-
     case INDEX_op_qemu_ld_i32:
     case INDEX_op_qemu_ld_i64:
         tcg_out_qemu_ld(s, a0, a1, a2, ext);
@@ -3166,10 +3170,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(rz, r);
 
-    case INDEX_op_movcond_i32:
-    case INDEX_op_movcond_i64:
-        return C_O1_I4(r, r, rC, rz, rz);
-
     case INDEX_op_qemu_ld_i32:
     case INDEX_op_qemu_ld_i64:
         return C_O1_I1(r, r);
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index 4c7537cbeb..3d864c1c1e 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -2247,6 +2247,20 @@ static const TCGOutOpSetcond outop_negsetcond = {
     .out_rri = tgen_negsetcondi,
 };
 
+static void tgen_movcond(TCGContext *s, TCGType type, TCGCond cond,
+                         TCGReg ret, TCGReg c1, TCGArg c2, bool const_c2,
+                         TCGArg vt, bool const_vt, TCGArg vf, bool consf_vf)
+{
+    cond = tcg_out_cmp(s, cond, c1, c2, const_c2);
+    tcg_out_dat_rIK(s, tcg_cond_to_arm_cond[cond], ARITH_MOV, ARITH_MVN,
+                    ret, 0, vt, const_vt);
+}
+
+static const TCGOutOpMovcond outop_movcond = {
+    .base.static_constraint = C_O1_I4(r, r, rIN, rIK, 0),
+    .out = tgen_movcond,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -2288,14 +2302,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_st32(s, COND_AL, args[0], args[1], args[2]);
         break;
 
-    case INDEX_op_movcond_i32:
-        /* Constraints mean that v2 is always in the same register as dest,
-         * so we only need to do "if condition passed, move v1 to dest".
-         */
-        c = tcg_out_cmp(s, args[5], args[1], args[2], const_args[2]);
-        tcg_out_dat_rIK(s, tcg_cond_to_arm_cond[c], ARITH_MOV,
-                        ARITH_MVN, args[0], 0, args[3], const_args[3]);
-        break;
     case INDEX_op_add2_i32:
         a0 = args[0], a1 = args[1], a2 = args[2];
         a3 = args[3], a4 = args[4], a5 = args[5];
@@ -2440,8 +2446,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
         return C_O1_I2(r, 0, rZ);
     case INDEX_op_extract2_i32:
         return C_O1_I2(r, rZ, rZ);
-    case INDEX_op_movcond_i32:
-        return C_O1_I4(r, r, rIN, rIK, 0);
     case INDEX_op_add2_i32:
         return C_O2_I4(r, r, r, r, rIN, rIK);
     case INDEX_op_sub2_i32:
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index d2eff3b617..ae3a53a18a 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -1900,14 +1900,21 @@ static void tcg_out_cmov(TCGContext *s, int jcc, int rexw,
     tcg_out_modrm(s, OPC_CMOVCC | jcc | rexw, dest, v1);
 }
 
-static void tcg_out_movcond(TCGContext *s, int rexw, TCGCond cond,
-                            TCGReg dest, TCGReg c1, TCGArg c2, int const_c2,
-                            TCGReg v1)
+static void tgen_movcond(TCGContext *s, TCGType type, TCGCond cond,
+                         TCGReg dest, TCGReg c1, TCGArg c2, bool const_c2,
+                         TCGArg vt, bool const_vt,
+                         TCGArg vf, bool consf_vf)
 {
+    int rexw = type == TCG_TYPE_I32 ? 0 : P_REXW;
     int jcc = tcg_out_cmp(s, cond, c1, c2, const_c2, rexw);
-    tcg_out_cmov(s, jcc, rexw, dest, v1);
+    tcg_out_cmov(s, jcc, rexw, dest, vt);
 }
 
+static const TCGOutOpMovcond outop_movcond = {
+    .base.static_constraint = C_O1_I4(r, r, reT, r, 0),
+    .out = tgen_movcond,
+};
+
 static void tcg_out_branch(TCGContext *s, int call, const tcg_insn_unit *dest)
 {
     intptr_t disp = tcg_pcrel_diff(s, dest) - 5;
@@ -3144,10 +3151,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    OP_32_64(movcond):
-        tcg_out_movcond(s, rexw, args[5], a0, a1, a2, const_a2, args[3]);
-        break;
-
     OP_32_64(bswap16):
         if (a2 & TCG_BSWAP_OS) {
             /* Output must be sign-extended. */
@@ -3977,10 +3980,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_deposit_i64:
         return C_O1_I2(q, 0, qi);
 
-    case INDEX_op_movcond_i32:
-    case INDEX_op_movcond_i64:
-        return C_O1_I4(r, r, reT, r, 0);
-
     case INDEX_op_add2_i32:
     case INDEX_op_add2_i64:
     case INDEX_op_sub2_i32:
diff --git a/tcg/loongarch64/tcg-target-con-set.h b/tcg/loongarch64/tcg-target-con-set.h
index dfe55c6fe8..fd731c0c0f 100644
--- a/tcg/loongarch64/tcg-target-con-set.h
+++ b/tcg/loongarch64/tcg-target-con-set.h
@@ -33,5 +33,5 @@ C_O1_I2(w, w, w)
 C_O1_I2(w, w, wM)
 C_O1_I2(w, w, wA)
 C_O1_I3(w, w, w, w)
-C_O1_I4(r, rz, rJ, rz, rz)
+C_O1_I4(r, r, rJ, rz, rz)
 C_N2_I1(r, r, r)
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index 53bba07c49..c731096c64 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -723,11 +723,11 @@ static const TCGOutOpSetcond outop_negsetcond = {
     .out_rri = tgen_negsetcondi,
 };
 
-static void tcg_out_movcond(TCGContext *s, TCGCond cond, TCGReg ret,
-                            TCGReg c1, tcg_target_long c2, bool const2,
-                            TCGReg v1, TCGReg v2)
+static void tgen_movcond(TCGContext *s, TCGType type, TCGCond cond,
+                         TCGReg ret, TCGReg c1, TCGArg c2, bool const_c2,
+                         TCGArg v1, bool const_v1, TCGArg v2, bool const_v2)
 {
-    int tmpflags = tcg_out_setcond_int(s, cond, TCG_REG_TMP0, c1, c2, const2);
+    int tmpflags = tcg_out_setcond_int(s, cond, TCG_REG_TMP0, c1, c2, const_c2);
     TCGReg t;
 
     /* Standardize the test below to t != 0. */
@@ -747,6 +747,11 @@ static void tcg_out_movcond(TCGContext *s, TCGCond cond, TCGReg ret,
     }
 }
 
+static const TCGOutOpMovcond outop_movcond = {
+    .base.static_constraint = C_O1_I4(r, r, rJ, rz, rz),
+    .out = tgen_movcond,
+};
+
 /*
  * Branch helpers
  */
@@ -1759,7 +1764,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     TCGArg a1 = args[1];
     TCGArg a2 = args[2];
     TCGArg a3 = args[3];
-    int c2 = const_args[2];
 
     switch (opc) {
     case INDEX_op_mb:
@@ -1849,11 +1853,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_opc_revb_d(s, a0, a1);
         break;
 
-    case INDEX_op_movcond_i32:
-    case INDEX_op_movcond_i64:
-        tcg_out_movcond(s, args[5], a0, a1, a2, c2, args[3], args[4]);
-        break;
-
     case INDEX_op_ld8s_i32:
     case INDEX_op_ld8s_i64:
         tcg_out_ldst(s, OPC_LD_B, a0, a1, a2);
@@ -2475,10 +2474,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
         /* Must deposit into the same register as input */
         return C_O1_I2(r, 0, rz);
 
-    case INDEX_op_movcond_i32:
-    case INDEX_op_movcond_i64:
-        return C_O1_I4(r, rz, rJ, rz, rz);
-
     case INDEX_op_ld_vec:
     case INDEX_op_dupm_vec:
     case INDEX_op_dup_vec:
diff --git a/tcg/mips/tcg-target-con-set.h b/tcg/mips/tcg-target-con-set.h
index a80630a8b4..f5e4852b56 100644
--- a/tcg/mips/tcg-target-con-set.h
+++ b/tcg/mips/tcg-target-con-set.h
@@ -23,7 +23,8 @@ C_O1_I2(r, r, rIK)
 C_O1_I2(r, r, rJ)
 C_O1_I2(r, r, rz)
 C_O1_I2(r, r, rzW)
-C_O1_I4(r, rz, rz, rz, 0)
+C_O1_I4(r, r, rz, rz, 0)
+C_O1_I4(r, r, rz, rz, rz)
 C_O1_I4(r, rz, rz, rz, rz)
 C_O2_I1(r, r, r)
 C_O2_I2(r, r, r, r)
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index a942905dc4..3ce71a1c8d 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -1086,8 +1086,9 @@ static void tcg_out_brcond2(TCGContext *s, TCGCond cond, TCGReg al, TCGReg ah,
     tcg_out_nop(s);
 }
 
-static void tcg_out_movcond(TCGContext *s, TCGCond cond, TCGReg ret,
-                            TCGReg c1, TCGReg c2, TCGReg v1, TCGReg v2)
+static void tgen_movcond(TCGContext *s, TCGType type, TCGCond cond,
+                         TCGReg ret, TCGReg c1, TCGArg c2, bool const_c2,
+                         TCGArg v1, bool const_v1, TCGArg v2, bool const_v2)
 {
     int tmpflags;
     bool eqz;
@@ -1133,6 +1134,13 @@ static void tcg_out_movcond(TCGContext *s, TCGCond cond, TCGReg ret,
     }
 }
 
+static const TCGOutOpMovcond outop_movcond = {
+    .base.static_constraint = (use_mips32r6_instructions
+                               ? C_O1_I4(r, r, rz, rz, rz)
+                               : C_O1_I4(r, r, rz, rz, 0)),
+    .out = tgen_movcond,
+};
+
 static void tcg_out_call_int(TCGContext *s, const tcg_insn_unit *arg, bool tail)
 {
     /*
@@ -1726,7 +1734,8 @@ static void tgen_clz(TCGContext *s, TCGType type,
     if (use_mips32r6_instructions) {
         MIPSInsn opcv6 = type == TCG_TYPE_I32 ? OPC_CLZ_R6 : OPC_DCLZ_R6;
         tcg_out_opc_reg(s, opcv6, TCG_TMP0, a1, 0);
-        tcg_out_movcond(s, TCG_COND_EQ, a0, a1, 0, a2, TCG_TMP0);
+        tgen_movcond(s, TCG_TYPE_REG, TCG_COND_EQ, a0, a1, a2, false,
+                     TCG_TMP0, false, TCG_REG_ZERO, false);
     } else {
         MIPSInsn opcv2 = type == TCG_TYPE_I32 ? OPC_CLZ : OPC_DCLZ;
         if (a0 == a2) {
@@ -2292,11 +2301,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_brcond2(s, args[4], a0, a1, a2, args[3], arg_label(args[5]));
         break;
 
-    case INDEX_op_movcond_i32:
-    case INDEX_op_movcond_i64:
-        tcg_out_movcond(s, args[5], a0, a1, a2, args[3], args[4]);
-        break;
-
     case INDEX_op_setcond2_i32:
         tcg_out_setcond2(s, args[5], a0, a1, a2, args[3], args[4]);
         break;
@@ -2392,11 +2396,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_deposit_i32:
     case INDEX_op_deposit_i64:
         return C_O1_I2(r, 0, rz);
-    case INDEX_op_movcond_i32:
-    case INDEX_op_movcond_i64:
-        return (use_mips32r6_instructions
-                ? C_O1_I4(r, rz, rz, rz, rz)
-                : C_O1_I4(r, rz, rz, rz, 0));
     case INDEX_op_add2_i32:
     case INDEX_op_sub2_i32:
         return C_O2_I4(r, r, rz, rz, rN, rN);
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index 819abdc906..339b3a0904 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -2144,9 +2144,9 @@ static const TCGOutOpBrcond outop_brcond = {
     .out_ri = tgen_brcondi,
 };
 
-static void tcg_out_movcond(TCGContext *s, TCGType type, TCGCond cond,
-                            TCGArg dest, TCGArg c1, TCGArg c2, TCGArg v1,
-                            TCGArg v2, bool const_c2)
+static void tgen_movcond(TCGContext *s, TCGType type, TCGCond cond,
+                         TCGReg dest, TCGReg c1, TCGArg c2, bool const_c2,
+                         TCGArg v1, bool const_v1, TCGArg v2, bool const_v2)
 {
     /* If for some reason both inputs are zero, don't produce bad code.  */
     if (v1 == 0 && v2 == 0) {
@@ -2192,6 +2192,11 @@ static void tcg_out_movcond(TCGContext *s, TCGType type, TCGCond cond,
     }
 }
 
+static const TCGOutOpMovcond outop_movcond = {
+    .base.static_constraint = C_O1_I4(r, r, rC, rZ, rZ),
+    .out = tgen_movcond,
+};
+
 static void tcg_out_cntxz(TCGContext *s, TCGType type, uint32_t opc,
                           TCGArg a0, TCGArg a1, TCGArg a2, bool const_a2)
 {
@@ -3578,15 +3583,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    case INDEX_op_movcond_i32:
-        tcg_out_movcond(s, TCG_TYPE_I32, args[5], args[0], args[1], args[2],
-                        args[3], args[4], const_args[2]);
-        break;
-    case INDEX_op_movcond_i64:
-        tcg_out_movcond(s, TCG_TYPE_I64, args[5], args[0], args[1], args[2],
-                        args[3], args[4], const_args[2]);
-        break;
-
 #if TCG_TARGET_REG_BITS == 64
     case INDEX_op_add2_i64:
 #else
@@ -4297,10 +4293,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(r, r);
 
-    case INDEX_op_movcond_i32:
-    case INDEX_op_movcond_i64:
-        return C_O1_I4(r, r, rC, rZ, rZ);
-
     case INDEX_op_deposit_i32:
     case INDEX_op_deposit_i64:
         return C_O1_I2(r, 0, rZ);
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index 1d7194e883..8d106d7f28 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -1501,10 +1501,10 @@ static void tcg_out_movcond_br2(TCGContext *s, TCGCond cond, TCGReg ret,
     tcg_out_mov(s, TCG_TYPE_REG, ret, tmp);
 }
 
-static void tcg_out_movcond(TCGContext *s, TCGCond cond, TCGReg ret,
-                            TCGReg cmp1, int cmp2, bool c_cmp2,
-                            TCGReg val1, bool c_val1,
-                            TCGReg val2, bool c_val2)
+static void tcg_out_movcond(TCGContext *s, TCGType type, TCGCond cond,
+                            TCGReg ret, TCGReg cmp1, TCGArg cmp2, bool c_cmp2,
+                            TCGArg val1, bool c_val1,
+                            TCGArg val2, bool c_val2)
 {
     int tmpflags;
     TCGReg t;
@@ -1531,6 +1531,11 @@ static void tcg_out_movcond(TCGContext *s, TCGCond cond, TCGReg ret,
     }
 }
 
+static const TCGOutOpMovcond outop_movcond = {
+    .base.static_constraint = C_O1_I4(r, r, rI, rM, rM),
+    .out = tcg_out_movcond,
+};
+
 static void tcg_out_cltz(TCGContext *s, TCGType type, RISCVInsn insn,
                          TCGReg ret, TCGReg src1, int src2, bool c_src2)
 {
@@ -1542,7 +1547,7 @@ static void tcg_out_cltz(TCGContext *s, TCGType type, RISCVInsn insn,
          * Note that constraints put 'ret' in a new register, so the
          * computation above did not clobber either 'src1' or 'src2'.
          */
-        tcg_out_movcond(s, TCG_COND_EQ, ret, src1, 0, true,
+        tcg_out_movcond(s, type, TCG_COND_EQ, ret, src1, 0, true,
                         src2, c_src2, ret, false);
     }
 }
@@ -2425,7 +2430,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     TCGArg a0 = args[0];
     TCGArg a1 = args[1];
     TCGArg a2 = args[2];
-    int c2 = const_args[2];
 
     switch (opc) {
     case INDEX_op_goto_ptr:
@@ -2521,12 +2525,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                         const_args[4], const_args[5], true, false);
         break;
 
-    case INDEX_op_movcond_i32:
-    case INDEX_op_movcond_i64:
-        tcg_out_movcond(s, args[5], a0, a1, a2, c2,
-                        args[3], const_args[3], args[4], const_args[4]);
-        break;
-
     case INDEX_op_qemu_ld_i32:
         tcg_out_qemu_ld(s, a0, a1, a2, TCG_TYPE_I32);
         break;
@@ -2863,10 +2861,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(rz, r);
 
-    case INDEX_op_movcond_i32:
-    case INDEX_op_movcond_i64:
-        return C_O1_I4(r, r, rI, rM, rM);
-
     case INDEX_op_add2_i32:
     case INDEX_op_add2_i64:
     case INDEX_op_sub2_i32:
diff --git a/tcg/s390x/tcg-target-con-set.h b/tcg/s390x/tcg-target-con-set.h
index 86af067965..78f06e3e52 100644
--- a/tcg/s390x/tcg-target-con-set.h
+++ b/tcg/s390x/tcg-target-con-set.h
@@ -38,7 +38,6 @@ C_O1_I2(v, v, v)
 C_O1_I3(v, v, v, v)
 C_O1_I4(v, v, v, vZ, v)
 C_O1_I4(v, v, v, vZM, v)
-C_O1_I4(r, r, ri, rI, r)
 C_O1_I4(r, r, rC, rI, r)
 C_O2_I1(o, m, r)
 C_O2_I2(o, m, 0, r)
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index d3650636aa..fbf39ca529 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -1540,9 +1540,9 @@ static void tgen_movcond_int(TCGContext *s, TCGType type, TCGReg dest,
     tcg_out_insn(s, RRFc, LOCGR, dest, src, cc);
 }
 
-static void tgen_movcond(TCGContext *s, TCGType type, TCGCond c, TCGReg dest,
-                         TCGReg c1, TCGArg c2, int c2const,
-                         TCGArg v3, int v3const, TCGReg v4)
+static void tgen_movcond(TCGContext *s, TCGType type, TCGCond c,
+                         TCGReg dest, TCGReg c1, TCGArg c2, bool c2const,
+                         TCGArg v3, bool v3const, TCGArg v4, bool v4const)
 {
     int cc, inv_cc;
 
@@ -1550,6 +1550,11 @@ static void tgen_movcond(TCGContext *s, TCGType type, TCGCond c, TCGReg dest,
     tgen_movcond_int(s, type, dest, v3, v3const, v4, cc, inv_cc);
 }
 
+static const TCGOutOpMovcond outop_movcond = {
+    .base.static_constraint = C_O1_I4(r, r, rC, rI, r),
+    .out = tgen_movcond,
+};
+
 static void tgen_deposit(TCGContext *s, TCGReg dest, TCGReg src,
                          int ofs, int len, int z)
 {
@@ -2875,11 +2880,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tgen_branch(s, S390_CC_ALWAYS, arg_label(args[0]));
         break;
 
-    case INDEX_op_movcond_i32:
-        tgen_movcond(s, TCG_TYPE_I32, args[5], args[0], args[1],
-                     args[2], const_args[2], args[3], const_args[3], args[4]);
-        break;
-
     case INDEX_op_qemu_ld_i32:
         tcg_out_qemu_ld(s, args[0], args[1], args[2], TCG_TYPE_I32);
         break;
@@ -2948,11 +2948,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_insn(s, RRE, SLBGR, args[1], args[5]);
         break;
 
-    case INDEX_op_movcond_i64:
-        tgen_movcond(s, TCG_TYPE_I64, args[5], args[0], args[1],
-                     args[2], const_args[2], args[3], const_args[3], args[4]);
-        break;
-
     OP_32_64(deposit):
         a0 = args[0], a1 = args[1], a2 = args[2];
         if (const_args[1]) {
@@ -3492,11 +3487,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_deposit_i64:
         return C_O1_I2(r, rZ, r);
 
-    case INDEX_op_movcond_i32:
-        return C_O1_I4(r, r, ri, rI, r);
-    case INDEX_op_movcond_i64:
-        return C_O1_I4(r, r, rC, rI, r);
-
     case INDEX_op_add2_i32:
     case INDEX_op_sub2_i32:
         return C_N1_O1_I4(r, r, 0, 1, ri, r);
diff --git a/tcg/sparc64/tcg-target-con-set.h b/tcg/sparc64/tcg-target-con-set.h
index 9f66e52ec6..8cec396173 100644
--- a/tcg/sparc64/tcg-target-con-set.h
+++ b/tcg/sparc64/tcg-target-con-set.h
@@ -15,6 +15,6 @@ C_O0_I2(r, rJ)
 C_O1_I1(r, r)
 C_O1_I2(r, r, r)
 C_O1_I2(r, r, rJ)
-C_O1_I4(r, rz, rJ, rI, 0)
+C_O1_I4(r, r, rJ, rI, 0)
 C_O2_I2(r, r, r, r)
 C_O2_I4(r, r, rz, rz, rJ, rJ)
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index 68f38b7d71..d99b9e42ce 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -898,6 +898,22 @@ static const TCGOutOpSetcond outop_negsetcond = {
     .out_rri = tgen_negsetcondi,
 };
 
+static void tgen_movcond(TCGContext *s, TCGType type, TCGCond cond,
+                         TCGReg ret, TCGReg c1, TCGArg c2, bool c2const,
+                         TCGArg v1, bool v1const, TCGArg v2, bool v2consf)
+{
+    if (type == TCG_TYPE_I32) {
+        tcg_out_movcond_i32(s, cond, ret, c1, c2, c2const, v1, v1const);
+    } else {
+        tcg_out_movcond_i64(s, cond, ret, c1, c2, c2const, v1, v1const);
+    }
+}
+
+static const TCGOutOpMovcond outop_movcond = {
+    .base.static_constraint = C_O1_I4(r, r, rJ, rI, 0),
+    .out = tgen_movcond,
+};
+
 static void tcg_out_addsub2_i32(TCGContext *s, TCGReg rl, TCGReg rh,
                                 TCGReg al, TCGReg ah, int32_t bl, int blconst,
                                 int32_t bh, int bhconst, int opl, int oph)
@@ -1735,13 +1751,11 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const int const_args[TCG_MAX_OP_ARGS])
 {
     TCGArg a0, a1, a2;
-    int c2;
 
     /* Hoist the loads of the most common arguments.  */
     a0 = args[0];
     a1 = args[1];
     a2 = args[2];
-    c2 = const_args[2];
 
     switch (opc) {
     case INDEX_op_goto_ptr:
@@ -1784,10 +1798,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_ldst(s, a0, a1, a2, STW);
         break;
 
-    case INDEX_op_movcond_i32:
-        tcg_out_movcond_i32(s, args[5], a0, a1, a2, c2, args[3], const_args[3]);
-        break;
-
     case INDEX_op_add2_i32:
         tcg_out_addsub2_i32(s, args[0], args[1], args[2], args[3],
                             args[4], const_args[4], args[5], const_args[5],
@@ -1822,9 +1832,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_ldst(s, a0, a1, a2, STX);
         break;
 
-    case INDEX_op_movcond_i64:
-        tcg_out_movcond_i64(s, args[5], a0, a1, a2, c2, args[3], const_args[3]);
-        break;
     case INDEX_op_add2_i64:
         tcg_out_addsub2_i64(s, args[0], args[1], args[2], args[3], args[4],
                             const_args[4], args[5], const_args[5], false);
@@ -1895,9 +1902,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_qemu_st_i64:
         return C_O0_I2(rz, r);
 
-    case INDEX_op_movcond_i32:
-    case INDEX_op_movcond_i64:
-        return C_O1_I4(r, rz, rJ, rI, 0);
     case INDEX_op_add2_i32:
     case INDEX_op_add2_i64:
     case INDEX_op_sub2_i32:
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 4dc6995d00..ba81a67e28 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1000,6 +1000,13 @@ typedef struct TCGOutOpDivRem {
                       TCGReg a0, TCGReg a1, TCGReg a4);
 } TCGOutOpDivRem;
 
+typedef struct TCGOutOpMovcond {
+    TCGOutOp base;
+    void (*out)(TCGContext *s, TCGType type, TCGCond cond,
+                TCGReg ret, TCGReg c1, TCGArg c2, bool const_c2,
+                TCGArg vt, bool const_vt, TCGArg vf, bool consf_vf);
+} TCGOutOpMovcond;
+
 typedef struct TCGOutOpMul2 {
     TCGOutOp base;
     void (*out_rrrr)(TCGContext *s, TCGType type,
@@ -1057,6 +1064,8 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_divs2, TCGOutOpDivRem, outop_divs2),
     OUTOP(INDEX_op_divu2, TCGOutOpDivRem, outop_divu2),
     OUTOP(INDEX_op_eqv, TCGOutOpBinary, outop_eqv),
+    OUTOP(INDEX_op_movcond_i32, TCGOutOpMovcond, outop_movcond),
+    OUTOP(INDEX_op_movcond_i64, TCGOutOpMovcond, outop_movcond),
     OUTOP(INDEX_op_mul, TCGOutOpBinary, outop_mul),
     OUTOP(INDEX_op_muls2, TCGOutOpMul2, outop_muls2),
     OUTOP(INDEX_op_mulsh, TCGOutOpBinary, outop_mulsh),
@@ -5504,6 +5513,20 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
         }
         break;
 
+    case INDEX_op_movcond_i32:
+    case INDEX_op_movcond_i64:
+        {
+            const TCGOutOpMovcond *out = &outop_movcond;
+            TCGCond cond = new_args[5];
+
+            tcg_debug_assert(!const_args[1]);
+            out->out(s, type, cond, new_args[0],
+                     new_args[1], new_args[2], const_args[2],
+                     new_args[3], const_args[3],
+                     new_args[4], const_args[4]);
+        }
+        break;
+
     case INDEX_op_setcond:
     case INDEX_op_negsetcond:
         {
diff --git a/tcg/tci.c b/tcg/tci.c
index 4c5dc16ecb..aef0023dc6 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -438,11 +438,6 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_args_l(insn, tb_ptr, &ptr);
             tb_ptr = ptr;
             continue;
-        case INDEX_op_movcond_i32:
-            tci_args_rrrrrc(insn, &r0, &r1, &r2, &r3, &r4, &condition);
-            tmp32 = tci_compare32(regs[r1], regs[r2], condition);
-            regs[r0] = regs[tmp32 ? r3 : r4];
-            break;
 #if TCG_TARGET_REG_BITS == 32
         case INDEX_op_setcond2_i32:
             tci_args_rrrrrc(insn, &r0, &r1, &r2, &r3, &r4, &condition);
@@ -628,6 +623,11 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_args_rrrc(insn, &r0, &r1, &r2, &condition);
             regs[r0] = tci_compare32(regs[r1], regs[r2], condition);
             break;
+        case INDEX_op_tci_movcond32:
+            tci_args_rrrrrc(insn, &r0, &r1, &r2, &r3, &r4, &condition);
+            tmp32 = tci_compare32(regs[r1], regs[r2], condition);
+            regs[r0] = regs[tmp32 ? r3 : r4];
+            break;
 
             /* Shift/rotate operations. */
 
@@ -1074,7 +1074,7 @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
                            op_name, str_r(r0), str_r(r1), pos, len);
         break;
 
-    case INDEX_op_movcond_i32:
+    case INDEX_op_tci_movcond32:
     case INDEX_op_movcond_i64:
     case INDEX_op_setcond2_i32:
         tci_args_rrrrrc(insn, &r0, &r1, &r2, &r3, &r4, &c);
diff --git a/tcg/tci/tcg-target-opc.h.inc b/tcg/tci/tcg-target-opc.h.inc
index 27b4574e4f..672d9b7323 100644
--- a/tcg/tci/tcg-target-opc.h.inc
+++ b/tcg/tci/tcg-target-opc.h.inc
@@ -11,3 +11,4 @@ DEF(tci_remu32, 1, 2, 0, TCG_OPF_NOT_PRESENT)
 DEF(tci_rotl32, 1, 2, 0, TCG_OPF_NOT_PRESENT)
 DEF(tci_rotr32, 1, 2, 0, TCG_OPF_NOT_PRESENT)
 DEF(tci_setcond32, 1, 2, 1, TCG_OPF_NOT_PRESENT)
+DEF(tci_movcond32, 1, 2, 1, TCG_OPF_NOT_PRESENT)
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index 18628b957a..79f9219187 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -92,8 +92,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
         return C_O0_I4(r, r, r, r);
 #endif
 
-    case INDEX_op_movcond_i32:
-    case INDEX_op_movcond_i64:
     case INDEX_op_setcond2_i32:
         return C_O1_I4(r, r, r, r, r);
 
@@ -972,6 +970,21 @@ static const TCGOutOpBrcond outop_brcond = {
     .out_rr = tgen_brcond,
 };
 
+static void tgen_movcond(TCGContext *s, TCGType type, TCGCond cond,
+                         TCGReg ret, TCGReg c1, TCGArg c2, bool const_c2,
+                         TCGArg vt, bool const_vt, TCGArg vf, bool consf_vf)
+{
+    TCGOpcode opc = (type == TCG_TYPE_I32
+                     ? INDEX_op_tci_movcond32
+                     : INDEX_op_movcond_i64);
+    tcg_out_op_rrrrrc(s, opc, ret, c1, c2, vt, vf, cond);
+}
+
+static const TCGOutOpMovcond outop_movcond = {
+    .base.static_constraint = C_O1_I4(r, r, r, r, r),
+    .out = tgen_movcond,
+};
+
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
                        const int const_args[TCG_MAX_OP_ARGS])
@@ -987,7 +1000,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_op_l(s, opc, arg_label(args[0]));
         break;
 
-    CASE_32_64(movcond)
     case INDEX_op_setcond2_i32:
         tcg_out_op_rrrrrc(s, opc, args[0], args[1], args[2],
                           args[3], args[4], args[5]);

From ea46c4bce8c8a8285e6715c1bac29f5b73f5062b Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 10 Jan 2025 13:41:25 -0800
Subject: [PATCH 0440/2760] tcg: Merge INDEX_op_movcond_{i32,i64}
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 docs/devel/tcg-ops.rst   |  2 +-
 include/tcg/tcg-opc.h    |  3 +--
 tcg/optimize.c           |  2 +-
 tcg/tcg-op.c             |  4 ++--
 tcg/tcg.c                | 15 +++++----------
 tcg/tci.c                |  4 ++--
 tcg/tci/tcg-target.c.inc |  2 +-
 7 files changed, 13 insertions(+), 19 deletions(-)

diff --git a/docs/devel/tcg-ops.rst b/docs/devel/tcg-ops.rst
index 18f02c5122..26dc3bad49 100644
--- a/docs/devel/tcg-ops.rst
+++ b/docs/devel/tcg-ops.rst
@@ -511,7 +511,7 @@ Conditional moves
        |
        | Set *dest* to -1 if (*t1* *cond* *t2*) is true, otherwise set to 0.
 
-   * - movcond_i32/i64 *dest*, *c1*, *c2*, *v1*, *v2*, *cond*
+   * - movcond *dest*, *c1*, *c2*, *v1*, *v2*, *cond*
 
      - | *dest* = (*c1* *cond* *c2* ? *v1* : *v2*)
        |
diff --git a/include/tcg/tcg-opc.h b/include/tcg/tcg-opc.h
index d40ca001c2..5e085607d5 100644
--- a/include/tcg/tcg-opc.h
+++ b/include/tcg/tcg-opc.h
@@ -51,6 +51,7 @@ DEF(divs2, 2, 3, 0, TCG_OPF_INT)
 DEF(divu, 1, 2, 0, TCG_OPF_INT)
 DEF(divu2, 2, 3, 0, TCG_OPF_INT)
 DEF(eqv, 1, 2, 0, TCG_OPF_INT)
+DEF(movcond, 1, 4, 1, TCG_OPF_INT)
 DEF(mul, 1, 2, 0, TCG_OPF_INT)
 DEF(muls2, 2, 2, 0, TCG_OPF_INT)
 DEF(mulsh, 1, 2, 0, TCG_OPF_INT)
@@ -74,7 +75,6 @@ DEF(shr, 1, 2, 0, TCG_OPF_INT)
 DEF(sub, 1, 2, 0, TCG_OPF_INT)
 DEF(xor, 1, 2, 0, TCG_OPF_INT)
 
-DEF(movcond_i32, 1, 4, 1, 0)
 /* load/store */
 DEF(ld8u_i32, 1, 1, 1, 0)
 DEF(ld8s_i32, 1, 1, 1, 0)
@@ -98,7 +98,6 @@ DEF(setcond2_i32, 1, 4, 1, 0)
 DEF(bswap16_i32, 1, 1, 1, 0)
 DEF(bswap32_i32, 1, 1, 1, 0)
 
-DEF(movcond_i64, 1, 4, 1, 0)
 /* load/store */
 DEF(ld8u_i64, 1, 1, 1, 0)
 DEF(ld8s_i64, 1, 1, 1, 0)
diff --git a/tcg/optimize.c b/tcg/optimize.c
index d0cb4588ed..54606388cc 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -2943,7 +2943,7 @@ void tcg_optimize(TCGContext *s)
         case INDEX_op_mov_vec:
             done = fold_mov(&ctx, op);
             break;
-        CASE_OP_32_64(movcond):
+        case INDEX_op_movcond:
             done = fold_movcond(&ctx, op);
             break;
         case INDEX_op_mul:
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index 041ca95f0d..3527952c66 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -1095,7 +1095,7 @@ void tcg_gen_movcond_i32(TCGCond cond, TCGv_i32 ret, TCGv_i32 c1,
     } else if (cond == TCG_COND_NEVER) {
         tcg_gen_mov_i32(ret, v2);
     } else {
-        tcg_gen_op6i_i32(INDEX_op_movcond_i32, ret, c1, c2, v1, v2, cond);
+        tcg_gen_op6i_i32(INDEX_op_movcond, ret, c1, c2, v1, v2, cond);
     }
 }
 
@@ -2799,7 +2799,7 @@ void tcg_gen_movcond_i64(TCGCond cond, TCGv_i64 ret, TCGv_i64 c1,
     } else if (cond == TCG_COND_NEVER) {
         tcg_gen_mov_i64(ret, v2);
     } else if (TCG_TARGET_REG_BITS == 64) {
-        tcg_gen_op6i_i64(INDEX_op_movcond_i64, ret, c1, c2, v1, v2, cond);
+        tcg_gen_op6i_i64(INDEX_op_movcond, ret, c1, c2, v1, v2, cond);
     } else {
         TCGv_i32 t0 = tcg_temp_ebb_new_i32();
         TCGv_i32 zero = tcg_constant_i32(0);
diff --git a/tcg/tcg.c b/tcg/tcg.c
index ba81a67e28..3f57f6aafd 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1064,8 +1064,7 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_divs2, TCGOutOpDivRem, outop_divs2),
     OUTOP(INDEX_op_divu2, TCGOutOpDivRem, outop_divu2),
     OUTOP(INDEX_op_eqv, TCGOutOpBinary, outop_eqv),
-    OUTOP(INDEX_op_movcond_i32, TCGOutOpMovcond, outop_movcond),
-    OUTOP(INDEX_op_movcond_i64, TCGOutOpMovcond, outop_movcond),
+    OUTOP(INDEX_op_movcond, TCGOutOpMovcond, outop_movcond),
     OUTOP(INDEX_op_mul, TCGOutOpBinary, outop_mul),
     OUTOP(INDEX_op_muls2, TCGOutOpMul2, outop_muls2),
     OUTOP(INDEX_op_mulsh, TCGOutOpBinary, outop_mulsh),
@@ -2292,13 +2291,13 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_and:
     case INDEX_op_brcond:
     case INDEX_op_mov:
+    case INDEX_op_movcond:
     case INDEX_op_negsetcond:
     case INDEX_op_or:
     case INDEX_op_setcond:
     case INDEX_op_xor:
         return has_type;
 
-    case INDEX_op_movcond_i32:
     case INDEX_op_ld8u_i32:
     case INDEX_op_ld8s_i32:
     case INDEX_op_ld16u_i32:
@@ -2327,7 +2326,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_setcond2_i32:
         return TCG_TARGET_REG_BITS == 32;
 
-    case INDEX_op_movcond_i64:
     case INDEX_op_ld8u_i64:
     case INDEX_op_ld8s_i64:
     case INDEX_op_ld16u_i64:
@@ -2879,10 +2877,9 @@ void tcg_dump_ops(TCGContext *s, FILE *f, bool have_prefs)
             case INDEX_op_brcond:
             case INDEX_op_setcond:
             case INDEX_op_negsetcond:
-            case INDEX_op_movcond_i32:
+            case INDEX_op_movcond:
             case INDEX_op_brcond2_i32:
             case INDEX_op_setcond2_i32:
-            case INDEX_op_movcond_i64:
             case INDEX_op_cmp_vec:
             case INDEX_op_cmpsel_vec:
                 if (op->args[k] < ARRAY_SIZE(cond_name)
@@ -5082,8 +5079,7 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
     case INDEX_op_brcond2_i32:
         op_cond = op->args[4];
         break;
-    case INDEX_op_movcond_i32:
-    case INDEX_op_movcond_i64:
+    case INDEX_op_movcond:
     case INDEX_op_setcond2_i32:
     case INDEX_op_cmpsel_vec:
         op_cond = op->args[5];
@@ -5513,8 +5509,7 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
         }
         break;
 
-    case INDEX_op_movcond_i32:
-    case INDEX_op_movcond_i64:
+    case INDEX_op_movcond:
         {
             const TCGOutOpMovcond *out = &outop_movcond;
             TCGCond cond = new_args[5];
diff --git a/tcg/tci.c b/tcg/tci.c
index aef0023dc6..9c3f58242e 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -450,7 +450,7 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_args_rrrc(insn, &r0, &r1, &r2, &condition);
             regs[r0] = tci_compare64(regs[r1], regs[r2], condition);
             break;
-        case INDEX_op_movcond_i64:
+        case INDEX_op_movcond:
             tci_args_rrrrrc(insn, &r0, &r1, &r2, &r3, &r4, &condition);
             tmp32 = tci_compare64(regs[r1], regs[r2], condition);
             regs[r0] = regs[tmp32 ? r3 : r4];
@@ -1075,7 +1075,7 @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
         break;
 
     case INDEX_op_tci_movcond32:
-    case INDEX_op_movcond_i64:
+    case INDEX_op_movcond:
     case INDEX_op_setcond2_i32:
         tci_args_rrrrrc(insn, &r0, &r1, &r2, &r3, &r4, &c);
         info->fprintf_func(info->stream, "%-12s  %s, %s, %s, %s, %s, %s",
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index 79f9219187..99a5744ab4 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -976,7 +976,7 @@ static void tgen_movcond(TCGContext *s, TCGType type, TCGCond cond,
 {
     TCGOpcode opc = (type == TCG_TYPE_I32
                      ? INDEX_op_tci_movcond32
-                     : INDEX_op_movcond_i64);
+                     : INDEX_op_movcond);
     tcg_out_op_rrrrrc(s, opc, ret, c1, c2, vt, vf, cond);
 }
 

From 298b3b548656ea89ff6fd4251bc7319986b79c67 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 10 Jan 2025 13:52:49 -0800
Subject: [PATCH 0441/2760] tcg/ppc: Drop fallback constant loading in
 tcg_out_cmp

Use U and C constraints for brcond2 and setcond2, so that tcg_out_cmp2
automatically passes in-range constants to tcg_out_cmp.

Tested-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/ppc/tcg-target-con-set.h |  4 +--
 tcg/ppc/tcg-target.c.inc     | 49 ++++++++++++------------------------
 2 files changed, 18 insertions(+), 35 deletions(-)

diff --git a/tcg/ppc/tcg-target-con-set.h b/tcg/ppc/tcg-target-con-set.h
index 77a1038d51..14cd217287 100644
--- a/tcg/ppc/tcg-target-con-set.h
+++ b/tcg/ppc/tcg-target-con-set.h
@@ -15,7 +15,7 @@ C_O0_I2(r, rC)
 C_O0_I2(v, r)
 C_O0_I3(r, r, r)
 C_O0_I3(o, m, r)
-C_O0_I4(r, r, ri, ri)
+C_O0_I4(r, r, rU, rC)
 C_O0_I4(r, r, r, r)
 C_O1_I1(r, r)
 C_O1_I1(v, r)
@@ -34,7 +34,7 @@ C_O1_I2(v, v, v)
 C_O1_I3(v, v, v, v)
 C_O1_I4(v, v, v, vZM, v)
 C_O1_I4(r, r, rC, rZ, rZ)
-C_O1_I4(r, r, r, ri, ri)
+C_O1_I4(r, r, r, rU, rC)
 C_O2_I1(r, r, r)
 C_N1O1_I1(o, m, r)
 C_O2_I2(r, r, r, r)
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index 339b3a0904..1782d05290 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -1777,9 +1777,8 @@ static void tcg_out_test(TCGContext *s, TCGReg dest, TCGReg arg1, TCGArg arg2,
 }
 
 static void tcg_out_cmp(TCGContext *s, int cond, TCGArg arg1, TCGArg arg2,
-                        int const_arg2, int cr, TCGType type)
+                        bool const_arg2, int cr, TCGType type)
 {
-    int imm;
     uint32_t op;
 
     tcg_debug_assert(TCG_TARGET_REG_BITS == 64 || type == TCG_TYPE_I32);
@@ -1796,18 +1795,15 @@ static void tcg_out_cmp(TCGContext *s, int cond, TCGArg arg1, TCGArg arg2,
     case TCG_COND_EQ:
     case TCG_COND_NE:
         if (const_arg2) {
-            if ((int16_t) arg2 == arg2) {
+            if ((int16_t)arg2 == arg2) {
                 op = CMPI;
-                imm = 1;
-                break;
-            } else if ((uint16_t) arg2 == arg2) {
-                op = CMPLI;
-                imm = 1;
                 break;
             }
+            tcg_debug_assert((uint16_t)arg2 == arg2);
+            op = CMPLI;
+            break;
         }
         op = CMPL;
-        imm = 0;
         break;
 
     case TCG_COND_TSTEQ:
@@ -1821,14 +1817,11 @@ static void tcg_out_cmp(TCGContext *s, int cond, TCGArg arg1, TCGArg arg2,
     case TCG_COND_LE:
     case TCG_COND_GT:
         if (const_arg2) {
-            if ((int16_t) arg2 == arg2) {
-                op = CMPI;
-                imm = 1;
-                break;
-            }
+            tcg_debug_assert((int16_t)arg2 == arg2);
+            op = CMPI;
+            break;
         }
         op = CMP;
-        imm = 0;
         break;
 
     case TCG_COND_LTU:
@@ -1836,30 +1829,20 @@ static void tcg_out_cmp(TCGContext *s, int cond, TCGArg arg1, TCGArg arg2,
     case TCG_COND_LEU:
     case TCG_COND_GTU:
         if (const_arg2) {
-            if ((uint16_t) arg2 == arg2) {
-                op = CMPLI;
-                imm = 1;
-                break;
-            }
+            tcg_debug_assert((uint16_t)arg2 == arg2);
+            op = CMPLI;
+            break;
         }
         op = CMPL;
-        imm = 0;
         break;
 
     default:
         g_assert_not_reached();
     }
     op |= BF(cr) | ((type == TCG_TYPE_I64) << 21);
-
-    if (imm) {
-        tcg_out32(s, op | RA(arg1) | (arg2 & 0xffff));
-    } else {
-        if (const_arg2) {
-            tcg_out_movi(s, type, TCG_REG_R0, arg2);
-            arg2 = TCG_REG_R0;
-        }
-        tcg_out32(s, op | RA(arg1) | RB(arg2));
-    }
+    op |= RA(arg1);
+    op |= const_arg2 ? arg2 & 0xffff : RB(arg2);
+    tcg_out32(s, op);
 }
 
 static void tcg_out_setcond_eq0(TCGContext *s, TCGType type,
@@ -4297,9 +4280,9 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_deposit_i64:
         return C_O1_I2(r, 0, rZ);
     case INDEX_op_brcond2_i32:
-        return C_O0_I4(r, r, ri, ri);
+        return C_O0_I4(r, r, rU, rC);
     case INDEX_op_setcond2_i32:
-        return C_O1_I4(r, r, r, ri, ri);
+        return C_O1_I4(r, r, r, rU, rC);
     case INDEX_op_add2_i64:
     case INDEX_op_add2_i32:
         return C_O2_I4(r, r, r, r, rI, rZM);

From cd2d9b181a67517fb7bbe8f0c8a81e2284207241 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 10 Jan 2025 14:52:41 -0800
Subject: [PATCH 0442/2760] tcg/arm: Expand arguments to tcg_out_cmp2
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Pass explicit arguments instead of arrays.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/arm/tcg-target.c.inc | 18 ++++++------------
 1 file changed, 6 insertions(+), 12 deletions(-)

diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index 3d864c1c1e..cebd783285 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -1254,17 +1254,9 @@ static TCGCond tcg_out_cmp(TCGContext *s, TCGCond cond, TCGReg a,
     }
 }
 
-static TCGCond tcg_out_cmp2(TCGContext *s, const TCGArg *args,
-                            const int *const_args)
+static TCGCond tcg_out_cmp2(TCGContext *s, TCGCond cond, TCGReg al, TCGReg ah,
+                            TCGArg bl, bool const_bl, TCGArg bh, bool const_bh)
 {
-    TCGReg al = args[0];
-    TCGReg ah = args[1];
-    TCGArg bl = args[2];
-    TCGArg bh = args[3];
-    TCGCond cond = args[4];
-    int const_bl = const_args[2];
-    int const_bh = const_args[3];
-
     switch (cond) {
     case TCG_COND_EQ:
     case TCG_COND_NE:
@@ -2344,11 +2336,13 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         break;
 
     case INDEX_op_brcond2_i32:
-        c = tcg_out_cmp2(s, args, const_args);
+        c = tcg_out_cmp2(s, args[4], args[0], args[1], args[2], const_args[2],
+                         args[3], const_args[3]);
         tcg_out_goto_label(s, tcg_cond_to_arm_cond[c], arg_label(args[5]));
         break;
     case INDEX_op_setcond2_i32:
-        c = tcg_out_cmp2(s, args + 1, const_args + 1);
+        c = tcg_out_cmp2(s, args[5], args[1], args[2], args[3], const_args[3],
+                         args[4], const_args[4]);
         tcg_out_dat_imm(s, tcg_cond_to_arm_cond[c], ARITH_MOV, args[0], 0, 1);
         tcg_out_dat_imm(s, tcg_cond_to_arm_cond[tcg_invert_cond(c)],
                         ARITH_MOV, args[0], 0, 0);

From c1e84acb7a87c23494f706c7045956ffaff5435a Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 10 Jan 2025 16:41:26 -0800
Subject: [PATCH 0443/2760] tcg/ppc: Expand arguments to tcg_out_cmp2
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Tested-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/ppc/tcg-target.c.inc | 21 +++++++--------------
 1 file changed, 7 insertions(+), 14 deletions(-)

diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index 1782d05290..669c5eae4a 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -2206,8 +2206,8 @@ static void tcg_out_cntxz(TCGContext *s, TCGType type, uint32_t opc,
     }
 }
 
-static void tcg_out_cmp2(TCGContext *s, const TCGArg *args,
-                         const int *const_args)
+static void tcg_out_cmp2(TCGContext *s, TCGCond cond, TCGReg al, TCGReg ah,
+                         TCGArg bl, bool blconst, TCGArg bh, bool bhconst)
 {
     static const struct { uint8_t bit1, bit2; } bits[] = {
         [TCG_COND_LT ] = { CR_LT, CR_LT },
@@ -2220,18 +2220,9 @@ static void tcg_out_cmp2(TCGContext *s, const TCGArg *args,
         [TCG_COND_GEU] = { CR_GT, CR_LT },
     };
 
-    TCGCond cond = args[4], cond2;
-    TCGArg al, ah, bl, bh;
-    int blconst, bhconst;
+    TCGCond cond2;
     int op, bit1, bit2;
 
-    al = args[0];
-    ah = args[1];
-    bl = args[2];
-    bh = args[3];
-    blconst = const_args[2];
-    bhconst = const_args[3];
-
     switch (cond) {
     case TCG_COND_EQ:
         op = CRAND;
@@ -2286,7 +2277,8 @@ static void tcg_out_cmp2(TCGContext *s, const TCGArg *args,
 static void tcg_out_setcond2(TCGContext *s, const TCGArg *args,
                              const int *const_args)
 {
-    tcg_out_cmp2(s, args + 1, const_args + 1);
+    tcg_out_cmp2(s, args[5], args[1], args[2], args[3], const_args[3],
+                 args[4], const_args[4]);
     tcg_out32(s, MFOCRF | RT(TCG_REG_R0) | FXM(0));
     tcg_out_rlw(s, RLWINM, args[0], TCG_REG_R0, CR_EQ + 0*4 + 1, 31, 31);
 }
@@ -2294,7 +2286,8 @@ static void tcg_out_setcond2(TCGContext *s, const TCGArg *args,
 static void tcg_out_brcond2(TCGContext *s, const TCGArg *args,
                             const int *const_args)
 {
-    tcg_out_cmp2(s, args, const_args);
+    tcg_out_cmp2(s, args[4], args[0], args[1], args[2], const_args[2],
+                 args[3], const_args[3]);
     tcg_out_bc_lab(s, TCG_COND_EQ, arg_label(args[5]));
 }
 

From f408df587a0459c0e44414d1c0c72a7926ce8f3c Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 10 Jan 2025 15:51:26 -0800
Subject: [PATCH 0444/2760] tcg: Convert brcond2_i32 to TCGOutOpBrcond2

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/arm/tcg-target.c.inc      | 20 +++++++----
 tcg/i386/tcg-target.c.inc     | 62 ++++++++++++++++++-----------------
 tcg/mips/tcg-target-con-set.h |  2 +-
 tcg/mips/tcg-target.c.inc     | 19 ++++++-----
 tcg/ppc/tcg-target.c.inc      | 25 +++++++-------
 tcg/tcg.c                     | 30 +++++++++++++++++
 tcg/tci/tcg-target.c.inc      | 30 +++++++++--------
 7 files changed, 118 insertions(+), 70 deletions(-)

diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index cebd783285..1c42df1092 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -2253,6 +2253,19 @@ static const TCGOutOpMovcond outop_movcond = {
     .out = tgen_movcond,
 };
 
+static void tgen_brcond2(TCGContext *s, TCGCond cond, TCGReg al, TCGReg ah,
+                         TCGArg bl, bool const_bl, TCGArg bh, bool const_bh,
+                         TCGLabel *l)
+{
+    cond = tcg_out_cmp2(s, cond, al, ah, bl, const_bl, bh, const_bh);
+    tcg_out_goto_label(s, tcg_cond_to_arm_cond[cond], l);
+}
+
+static const TCGOutOpBrcond2 outop_brcond2 = {
+    .base.static_constraint = C_O0_I4(r, r, rI, rI),
+    .out = tgen_brcond2,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -2335,11 +2348,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_mov_reg(s, COND_AL, args[0], a0);
         break;
 
-    case INDEX_op_brcond2_i32:
-        c = tcg_out_cmp2(s, args[4], args[0], args[1], args[2], const_args[2],
-                         args[3], const_args[3]);
-        tcg_out_goto_label(s, tcg_cond_to_arm_cond[c], arg_label(args[5]));
-        break;
     case INDEX_op_setcond2_i32:
         c = tcg_out_cmp2(s, args[5], args[1], args[2], args[3], const_args[3],
                          args[4], const_args[4]);
@@ -2444,8 +2452,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
         return C_O2_I4(r, r, r, r, rIN, rIK);
     case INDEX_op_sub2_i32:
         return C_O2_I4(r, r, rI, rI, rIN, rIK);
-    case INDEX_op_brcond2_i32:
-        return C_O0_I4(r, r, rI, rI);
     case INDEX_op_setcond2_i32:
         return C_O1_I4(r, r, r, rI, rI);
 
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index ae3a53a18a..b7708c945f 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -1662,42 +1662,52 @@ static const TCGOutOpBrcond outop_brcond = {
     .out_ri = tgen_brcondi,
 };
 
-#if TCG_TARGET_REG_BITS == 32
-static void tcg_out_brcond2(TCGContext *s, const TCGArg *args,
-                            const int *const_args, bool small)
+static void tcg_out_brcond2(TCGContext *s, TCGCond cond, TCGReg al,
+                            TCGReg ah, TCGArg bl, bool blconst,
+                            TCGArg bh, bool bhconst,
+                            TCGLabel *label_this, bool small)
 {
     TCGLabel *label_next = gen_new_label();
-    TCGLabel *label_this = arg_label(args[5]);
-    TCGCond cond = args[4];
 
     switch (cond) {
     case TCG_COND_EQ:
     case TCG_COND_TSTEQ:
         tcg_out_brcond(s, 0, tcg_invert_cond(cond),
-                       args[0], args[2], const_args[2], label_next, 1);
-        tcg_out_brcond(s, 0, cond, args[1], args[3], const_args[3],
-                       label_this, small);
+                       al, bl, blconst, label_next, true);
+        tcg_out_brcond(s, 0, cond, ah, bh, bhconst, label_this, small);
         break;
 
     case TCG_COND_NE:
     case TCG_COND_TSTNE:
-        tcg_out_brcond(s, 0, cond, args[0], args[2], const_args[2],
-                       label_this, small);
-        tcg_out_brcond(s, 0, cond, args[1], args[3], const_args[3],
-                       label_this, small);
+        tcg_out_brcond(s, 0, cond, al, bl, blconst, label_this, small);
+        tcg_out_brcond(s, 0, cond, ah, bh, bhconst, label_this, small);
         break;
 
     default:
-        tcg_out_brcond(s, 0, tcg_high_cond(cond), args[1],
-                       args[3], const_args[3], label_this, small);
+        tcg_out_brcond(s, 0, tcg_high_cond(cond),
+                       ah, bh, bhconst, label_this, small);
         tcg_out_jxx(s, JCC_JNE, label_next, 1);
-        tcg_out_brcond(s, 0, tcg_unsigned_cond(cond), args[0],
-                       args[2], const_args[2], label_this, small);
+        tcg_out_brcond(s, 0, tcg_unsigned_cond(cond),
+                       al, bl, blconst, label_this, small);
         break;
     }
     tcg_out_label(s, label_next);
 }
+
+static void tgen_brcond2(TCGContext *s, TCGCond cond, TCGReg al,
+                         TCGReg ah, TCGArg bl, bool blconst,
+                         TCGArg bh, bool bhconst, TCGLabel *l)
+{
+    tcg_out_brcond2(s, cond, al, ah, bl, blconst, bh, bhconst, l, false);
+}
+
+#if TCG_TARGET_REG_BITS != 32
+__attribute__((unused))
 #endif
+static const TCGOutOpBrcond2 outop_brcond2 = {
+    .base.static_constraint = C_O0_I4(r, r, ri, ri),
+    .out = tgen_brcond2,
+};
 
 static void tcg_out_setcond(TCGContext *s, TCGType type, TCGCond cond,
                             TCGReg dest, TCGReg arg1, TCGArg arg2,
@@ -1854,11 +1864,8 @@ static const TCGOutOpSetcond outop_negsetcond = {
 static void tcg_out_setcond2(TCGContext *s, const TCGArg *args,
                              const int *const_args)
 {
-    TCGArg new_args[6];
     TCGLabel *label_true, *label_over;
 
-    memcpy(new_args, args+1, 5*sizeof(TCGArg));
-
     if (args[0] == args[1] || args[0] == args[2]
         || (!const_args[3] && args[0] == args[3])
         || (!const_args[4] && args[0] == args[4])) {
@@ -1867,8 +1874,8 @@ static void tcg_out_setcond2(TCGContext *s, const TCGArg *args,
         label_true = gen_new_label();
         label_over = gen_new_label();
 
-        new_args[5] = label_arg(label_true);
-        tcg_out_brcond2(s, new_args, const_args+1, 1);
+        tcg_out_brcond2(s, args[5], args[1], args[2], args[3], const_args[3],
+                        args[4], const_args[4], label_true, true);
 
         tcg_out_movi(s, TCG_TYPE_I32, args[0], 0);
         tcg_out_jxx(s, JCC_JMP, label_over, 1);
@@ -1884,9 +1891,10 @@ static void tcg_out_setcond2(TCGContext *s, const TCGArg *args,
         tcg_out_movi(s, TCG_TYPE_I32, args[0], 0);
 
         label_over = gen_new_label();
-        new_args[4] = tcg_invert_cond(new_args[4]);
-        new_args[5] = label_arg(label_over);
-        tcg_out_brcond2(s, new_args, const_args+1, 1);
+        tcg_out_brcond2(s, tcg_invert_cond(args[5]), args[1], args[2],
+                        args[3], const_args[3],
+                        args[4], const_args[4], label_over, true);
+
 
         tgen_arithi(s, ARITH_ADD, args[0], 1, 0);
         tcg_out_label(s, label_over);
@@ -3233,9 +3241,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         break;
 
 #if TCG_TARGET_REG_BITS == 32
-    case INDEX_op_brcond2_i32:
-        tcg_out_brcond2(s, args, const_args, 0);
-        break;
     case INDEX_op_setcond2_i32:
         tcg_out_setcond2(s, args, const_args);
         break;
@@ -4007,9 +4012,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
         tcg_debug_assert(TCG_TARGET_REG_BITS == 64);
         return C_O0_I3(L, L, L);
 
-    case INDEX_op_brcond2_i32:
-        return C_O0_I4(r, r, ri, ri);
-
     case INDEX_op_setcond2_i32:
         return C_O1_I4(r, r, r, ri, ri);
 
diff --git a/tcg/mips/tcg-target-con-set.h b/tcg/mips/tcg-target-con-set.h
index f5e4852b56..9d0ea73f4f 100644
--- a/tcg/mips/tcg-target-con-set.h
+++ b/tcg/mips/tcg-target-con-set.h
@@ -13,7 +13,7 @@ C_O0_I1(r)
 C_O0_I2(r, rz)
 C_O0_I2(rz, r)
 C_O0_I3(rz, rz, r)
-C_O0_I4(rz, rz, rz, rz)
+C_O0_I4(r, r, rz, rz)
 C_O1_I1(r, r)
 C_O1_I2(r, 0, rz)
 C_O1_I2(r, r, r)
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index 3ce71a1c8d..9a9b1bb09a 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -1074,8 +1074,9 @@ static void tcg_out_setcond2(TCGContext *s, TCGCond cond, TCGReg ret,
     tcg_out_setcond_end(s, ret, tmpflags);
 }
 
-static void tcg_out_brcond2(TCGContext *s, TCGCond cond, TCGReg al, TCGReg ah,
-                            TCGReg bl, TCGReg bh, TCGLabel *l)
+static void tgen_brcond2(TCGContext *s, TCGCond cond, TCGReg al, TCGReg ah,
+                         TCGArg bl, bool const_bl,
+                         TCGArg bh, bool const_bh, TCGLabel *l)
 {
     int tmpflags = tcg_out_setcond2_int(s, cond, TCG_TMP0, al, ah, bl, bh);
     TCGReg tmp = tmpflags & ~SETCOND_FLAGS;
@@ -1086,6 +1087,14 @@ static void tcg_out_brcond2(TCGContext *s, TCGCond cond, TCGReg al, TCGReg ah,
     tcg_out_nop(s);
 }
 
+#if TCG_TARGET_REG_BITS != 32
+__attribute__((unused))
+#endif
+static const TCGOutOpBrcond2 outop_brcond2 = {
+    .base.static_constraint = C_O0_I4(r, r, rz, rz),
+    .out = tgen_brcond2,
+};
+
 static void tgen_movcond(TCGContext *s, TCGType type, TCGCond cond,
                          TCGReg ret, TCGReg c1, TCGArg c2, bool const_c2,
                          TCGArg v1, bool const_v1, TCGArg v2, bool const_v2)
@@ -2297,10 +2306,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    case INDEX_op_brcond2_i32:
-        tcg_out_brcond2(s, args[4], a0, a1, a2, args[3], arg_label(args[5]));
-        break;
-
     case INDEX_op_setcond2_i32:
         tcg_out_setcond2(s, args[5], a0, a1, a2, args[3], args[4]);
         break;
@@ -2401,8 +2406,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
         return C_O2_I4(r, r, rz, rz, rN, rN);
     case INDEX_op_setcond2_i32:
         return C_O1_I4(r, rz, rz, rz, rz);
-    case INDEX_op_brcond2_i32:
-        return C_O0_I4(rz, rz, rz, rz);
 
     case INDEX_op_qemu_ld_i32:
         return C_O1_I1(r, r);
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index 669c5eae4a..cde8a55918 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -2283,14 +2283,23 @@ static void tcg_out_setcond2(TCGContext *s, const TCGArg *args,
     tcg_out_rlw(s, RLWINM, args[0], TCG_REG_R0, CR_EQ + 0*4 + 1, 31, 31);
 }
 
-static void tcg_out_brcond2(TCGContext *s, const TCGArg *args,
-                            const int *const_args)
+static void tgen_brcond2(TCGContext *s, TCGCond cond, TCGReg al, TCGReg ah,
+                         TCGArg bl, bool const_bl,
+                         TCGArg bh, bool const_bh, TCGLabel *l)
 {
-    tcg_out_cmp2(s, args[4], args[0], args[1], args[2], const_args[2],
-                 args[3], const_args[3]);
-    tcg_out_bc_lab(s, TCG_COND_EQ, arg_label(args[5]));
+    assert(TCG_TARGET_REG_BITS == 32);
+    tcg_out_cmp2(s, cond, al, ah, bl, const_bl, bh, const_bh);
+    tcg_out_bc_lab(s, TCG_COND_EQ, l);
 }
 
+#if TCG_TARGET_REG_BITS != 32
+__attribute__((unused))
+#endif
+static const TCGOutOpBrcond2 outop_brcond2 = {
+    .base.static_constraint = C_O0_I4(r, r, rU, rC),
+    .out = tgen_brcond2,
+};
+
 static void tcg_out_mb(TCGContext *s, TCGArg a0)
 {
     uint32_t insn;
@@ -3450,10 +3459,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_mem_long(s, STD, STDX, args[0], args[1], args[2]);
         break;
 
-    case INDEX_op_brcond2_i32:
-        tcg_out_brcond2(s, args, const_args);
-        break;
-
     case INDEX_op_qemu_ld_i32:
         tcg_out_qemu_ld(s, args[0], -1, args[1], args[2], TCG_TYPE_I32);
         break;
@@ -4272,8 +4277,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_deposit_i32:
     case INDEX_op_deposit_i64:
         return C_O1_I2(r, 0, rZ);
-    case INDEX_op_brcond2_i32:
-        return C_O0_I4(r, r, rU, rC);
     case INDEX_op_setcond2_i32:
         return C_O1_I4(r, r, r, rU, rC);
     case INDEX_op_add2_i64:
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 3f57f6aafd..2a39ce3665 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -994,6 +994,13 @@ typedef struct TCGOutOpBrcond {
                    TCGReg a1, tcg_target_long a2, TCGLabel *label);
 } TCGOutOpBrcond;
 
+typedef struct TCGOutOpBrcond2 {
+    TCGOutOp base;
+    void (*out)(TCGContext *s, TCGCond cond, TCGReg al, TCGReg ah,
+                TCGArg bl, bool const_bl,
+                TCGArg bh, bool const_bh, TCGLabel *l);
+} TCGOutOpBrcond2;
+
 typedef struct TCGOutOpDivRem {
     TCGOutOp base;
     void (*out_rr01r)(TCGContext *s, TCGType type,
@@ -1087,6 +1094,10 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_shr, TCGOutOpBinary, outop_shr),
     OUTOP(INDEX_op_sub, TCGOutOpSubtract, outop_sub),
     OUTOP(INDEX_op_xor, TCGOutOpBinary, outop_xor),
+
+#if TCG_TARGET_REG_BITS == 32
+    OUTOP(INDEX_op_brcond2_i32, TCGOutOpBrcond2, outop_brcond2),
+#endif
 };
 
 #undef OUTOP
@@ -5540,6 +5551,25 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
         }
         break;
 
+#if TCG_TARGET_REG_BITS == 32
+    case INDEX_op_brcond2_i32:
+        {
+            const TCGOutOpBrcond2 *out = &outop_brcond2;
+            TCGCond cond = new_args[4];
+            TCGLabel *label = arg_label(new_args[5]);
+
+            tcg_debug_assert(!const_args[0]);
+            tcg_debug_assert(!const_args[1]);
+            out->out(s, cond, new_args[0], new_args[1],
+                     new_args[2], const_args[2],
+                     new_args[3], const_args[3], label);
+        }
+        break;
+#else
+    case INDEX_op_brcond2_i32:
+        g_assert_not_reached();
+#endif
+
     default:
         if (def->flags & TCG_OPF_VECTOR) {
             tcg_out_vec_op(s, op->opc, type - TCG_TYPE_V64,
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index 99a5744ab4..0fe365e2d4 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -87,11 +87,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_sub2_i64:
         return C_O2_I4(r, r, r, r, r, r);
 
-#if TCG_TARGET_REG_BITS == 32
-    case INDEX_op_brcond2_i32:
-        return C_O0_I4(r, r, r, r);
-#endif
-
     case INDEX_op_setcond2_i32:
         return C_O1_I4(r, r, r, r, r);
 
@@ -985,6 +980,23 @@ static const TCGOutOpMovcond outop_movcond = {
     .out = tgen_movcond,
 };
 
+static void tgen_brcond2(TCGContext *s, TCGCond cond, TCGReg al, TCGReg ah,
+                         TCGArg bl, bool const_bl,
+                         TCGArg bh, bool const_bh, TCGLabel *l)
+{
+    tcg_out_op_rrrrrc(s, INDEX_op_setcond2_i32, TCG_REG_TMP,
+                      al, ah, bl, bh, cond);
+    tcg_out_op_rl(s, INDEX_op_brcond, TCG_REG_TMP, l);
+}
+
+#if TCG_TARGET_REG_BITS != 32
+__attribute__((unused))
+#endif
+static const TCGOutOpBrcond2 outop_brcond2 = {
+    .base.static_constraint = C_O0_I4(r, r, r, r),
+    .out = tgen_brcond2,
+};
+
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
                        const int const_args[TCG_MAX_OP_ARGS])
@@ -1055,14 +1067,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                           args[3], args[4], args[5]);
         break;
 
-#if TCG_TARGET_REG_BITS == 32
-    case INDEX_op_brcond2_i32:
-        tcg_out_op_rrrrrc(s, INDEX_op_setcond2_i32, TCG_REG_TMP,
-                          args[0], args[1], args[2], args[3], args[4]);
-        tcg_out_op_rl(s, INDEX_op_brcond, TCG_REG_TMP, arg_label(args[5]));
-        break;
-#endif
-
     case INDEX_op_qemu_ld_i64:
     case INDEX_op_qemu_st_i64:
         if (TCG_TARGET_REG_BITS == 32) {

From e579c717cb1176d2cd8bd24d9b0e9c6a4b1a0d71 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 10 Jan 2025 16:57:07 -0800
Subject: [PATCH 0445/2760] tcg: Convert setcond2_i32 to TCGOutOpSetcond2

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/arm/tcg-target.c.inc      | 25 ++++++------
 tcg/i386/tcg-target.c.inc     | 71 +++++++++++++++++------------------
 tcg/mips/tcg-target-con-set.h |  2 +-
 tcg/mips/tcg-target.c.inc     | 20 ++++++----
 tcg/ppc/tcg-target.c.inc      | 25 ++++++------
 tcg/tcg.c                     | 19 ++++++++++
 tcg/tci/tcg-target.c.inc      | 24 ++++++++----
 7 files changed, 110 insertions(+), 76 deletions(-)

diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index 1c42df1092..8cd82b8baf 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -2266,13 +2266,25 @@ static const TCGOutOpBrcond2 outop_brcond2 = {
     .out = tgen_brcond2,
 };
 
+static void tgen_setcond2(TCGContext *s, TCGCond cond, TCGReg ret,
+                          TCGReg al, TCGReg ah,
+                          TCGArg bl, bool const_bl,
+                          TCGArg bh, bool const_bh)
+{
+    cond = tcg_out_cmp2(s, cond, al, ah, bl, const_bl, bh, const_bh);
+    finish_setcond(s, cond, ret, false);
+}
+
+static const TCGOutOpSetcond2 outop_setcond2 = {
+    .base.static_constraint = C_O1_I4(r, r, r, rI, rI),
+    .out = tgen_setcond2,
+};
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
                        const int const_args[TCG_MAX_OP_ARGS])
 {
     TCGArg a0, a1, a2, a3, a4, a5;
-    int c;
 
     switch (opc) {
     case INDEX_op_goto_ptr:
@@ -2348,14 +2360,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_mov_reg(s, COND_AL, args[0], a0);
         break;
 
-    case INDEX_op_setcond2_i32:
-        c = tcg_out_cmp2(s, args[5], args[1], args[2], args[3], const_args[3],
-                         args[4], const_args[4]);
-        tcg_out_dat_imm(s, tcg_cond_to_arm_cond[c], ARITH_MOV, args[0], 0, 1);
-        tcg_out_dat_imm(s, tcg_cond_to_arm_cond[tcg_invert_cond(c)],
-                        ARITH_MOV, args[0], 0, 0);
-        break;
-
     case INDEX_op_qemu_ld_i32:
         tcg_out_qemu_ld(s, args[0], -1, args[1], args[2], TCG_TYPE_I32);
         break;
@@ -2452,9 +2456,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
         return C_O2_I4(r, r, r, r, rIN, rIK);
     case INDEX_op_sub2_i32:
         return C_O2_I4(r, r, rI, rI, rIN, rIK);
-    case INDEX_op_setcond2_i32:
-        return C_O1_I4(r, r, r, rI, rI);
-
     case INDEX_op_qemu_ld_i32:
         return C_O1_I1(r, q);
     case INDEX_op_qemu_ld_i64:
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index b7708c945f..6a42ffaf44 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -1860,47 +1860,53 @@ static const TCGOutOpSetcond outop_negsetcond = {
     .out_rri = tgen_negsetcondi,
 };
 
-#if TCG_TARGET_REG_BITS == 32
-static void tcg_out_setcond2(TCGContext *s, const TCGArg *args,
-                             const int *const_args)
+static void tgen_setcond2(TCGContext *s, TCGCond cond, TCGReg ret,
+                          TCGReg al, TCGReg ah,
+                          TCGArg bl, bool const_bl,
+                          TCGArg bh, bool const_bh)
 {
-    TCGLabel *label_true, *label_over;
+    TCGLabel *label_over = gen_new_label();
 
-    if (args[0] == args[1] || args[0] == args[2]
-        || (!const_args[3] && args[0] == args[3])
-        || (!const_args[4] && args[0] == args[4])) {
-        /* When the destination overlaps with one of the argument
-           registers, don't do anything tricky.  */
-        label_true = gen_new_label();
-        label_over = gen_new_label();
+    if (ret == al || ret == ah
+        || (!const_bl && ret == bl)
+        || (!const_bh && ret == bh)) {
+        /*
+         * When the destination overlaps with one of the argument
+         * registers, don't do anything tricky.
+         */
+        TCGLabel *label_true = gen_new_label();
 
-        tcg_out_brcond2(s, args[5], args[1], args[2], args[3], const_args[3],
-                        args[4], const_args[4], label_true, true);
+        tcg_out_brcond2(s, cond, al, ah, bl, const_bl,
+                        bh, const_bh, label_true, true);
 
-        tcg_out_movi(s, TCG_TYPE_I32, args[0], 0);
+        tcg_out_movi(s, TCG_TYPE_I32, ret, 0);
         tcg_out_jxx(s, JCC_JMP, label_over, 1);
         tcg_out_label(s, label_true);
 
-        tcg_out_movi(s, TCG_TYPE_I32, args[0], 1);
-        tcg_out_label(s, label_over);
+        tcg_out_movi(s, TCG_TYPE_I32, ret, 1);
     } else {
-        /* When the destination does not overlap one of the arguments,
-           clear the destination first, jump if cond false, and emit an
-           increment in the true case.  This results in smaller code.  */
+        /*
+         * When the destination does not overlap one of the arguments,
+         * clear the destination first, jump if cond false, and emit an
+         * increment in the true case.  This results in smaller code.
+         */
+        tcg_out_movi(s, TCG_TYPE_I32, ret, 0);
 
-        tcg_out_movi(s, TCG_TYPE_I32, args[0], 0);
+        tcg_out_brcond2(s, tcg_invert_cond(cond), al, ah, bl, const_bl,
+                        bh, const_bh, label_over, true);
 
-        label_over = gen_new_label();
-        tcg_out_brcond2(s, tcg_invert_cond(args[5]), args[1], args[2],
-                        args[3], const_args[3],
-                        args[4], const_args[4], label_over, true);
-
-
-        tgen_arithi(s, ARITH_ADD, args[0], 1, 0);
-        tcg_out_label(s, label_over);
+        tgen_arithi(s, ARITH_ADD, ret, 1, 0);
     }
+    tcg_out_label(s, label_over);
 }
+
+#if TCG_TARGET_REG_BITS != 32
+__attribute__((unused))
 #endif
+static const TCGOutOpSetcond2 outop_setcond2 = {
+    .base.static_constraint = C_O1_I4(r, r, r, ri, ri),
+    .out = tgen_setcond2,
+};
 
 static void tcg_out_cmov(TCGContext *s, int jcc, int rexw,
                          TCGReg dest, TCGReg v1)
@@ -3240,11 +3246,7 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-#if TCG_TARGET_REG_BITS == 32
-    case INDEX_op_setcond2_i32:
-        tcg_out_setcond2(s, args, const_args);
-        break;
-#else /* TCG_TARGET_REG_BITS == 64 */
+#if TCG_TARGET_REG_BITS == 64
     case INDEX_op_ld32s_i64:
         tcg_out_modrm_offset(s, OPC_MOVSLQ, a0, a1, a2);
         break;
@@ -4012,9 +4014,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
         tcg_debug_assert(TCG_TARGET_REG_BITS == 64);
         return C_O0_I3(L, L, L);
 
-    case INDEX_op_setcond2_i32:
-        return C_O1_I4(r, r, r, ri, ri);
-
     case INDEX_op_ld_vec:
     case INDEX_op_dupm_vec:
         return C_O1_I1(x, r);
diff --git a/tcg/mips/tcg-target-con-set.h b/tcg/mips/tcg-target-con-set.h
index 9d0ea73f4f..4e09c9a400 100644
--- a/tcg/mips/tcg-target-con-set.h
+++ b/tcg/mips/tcg-target-con-set.h
@@ -25,7 +25,7 @@ C_O1_I2(r, r, rz)
 C_O1_I2(r, r, rzW)
 C_O1_I4(r, r, rz, rz, 0)
 C_O1_I4(r, r, rz, rz, rz)
-C_O1_I4(r, rz, rz, rz, rz)
+C_O1_I4(r, r, r, rz, rz)
 C_O2_I1(r, r, r)
 C_O2_I2(r, r, r, r)
 C_O2_I4(r, r, rz, rz, rN, rN)
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index 9a9b1bb09a..e8ae65bccb 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -1067,13 +1067,23 @@ static int tcg_out_setcond2_int(TCGContext *s, TCGCond cond, TCGReg ret,
     return ret | flags;
 }
 
-static void tcg_out_setcond2(TCGContext *s, TCGCond cond, TCGReg ret,
-                             TCGReg al, TCGReg ah, TCGReg bl, TCGReg bh)
+static void tgen_setcond2(TCGContext *s, TCGCond cond, TCGReg ret,
+                          TCGReg al, TCGReg ah,
+                          TCGArg bl, bool const_bl,
+                          TCGArg bh, bool const_bh)
 {
     int tmpflags = tcg_out_setcond2_int(s, cond, ret, al, ah, bl, bh);
     tcg_out_setcond_end(s, ret, tmpflags);
 }
 
+#if TCG_TARGET_REG_BITS != 32
+__attribute__((unused))
+#endif
+static const TCGOutOpSetcond2 outop_setcond2 = {
+    .base.static_constraint = C_O1_I4(r, r, r, rz, rz),
+    .out = tgen_setcond2,
+};
+
 static void tgen_brcond2(TCGContext *s, TCGCond cond, TCGReg al, TCGReg ah,
                          TCGArg bl, bool const_bl,
                          TCGArg bh, bool const_bh, TCGLabel *l)
@@ -2306,10 +2316,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    case INDEX_op_setcond2_i32:
-        tcg_out_setcond2(s, args[5], a0, a1, a2, args[3], args[4]);
-        break;
-
     case INDEX_op_qemu_ld_i32:
         tcg_out_qemu_ld(s, a0, 0, a1, a2, TCG_TYPE_I32);
         break;
@@ -2404,8 +2410,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_add2_i32:
     case INDEX_op_sub2_i32:
         return C_O2_I4(r, r, rz, rz, rN, rN);
-    case INDEX_op_setcond2_i32:
-        return C_O1_I4(r, rz, rz, rz, rz);
 
     case INDEX_op_qemu_ld_i32:
         return C_O1_I1(r, r);
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index cde8a55918..4cdbf246d2 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -2274,15 +2274,24 @@ static void tcg_out_cmp2(TCGContext *s, TCGCond cond, TCGReg al, TCGReg ah,
     }
 }
 
-static void tcg_out_setcond2(TCGContext *s, const TCGArg *args,
-                             const int *const_args)
+static void tgen_setcond2(TCGContext *s, TCGCond cond, TCGReg ret,
+                          TCGReg al, TCGReg ah,
+                          TCGArg bl, bool const_bl,
+                          TCGArg bh, bool const_bh)
 {
-    tcg_out_cmp2(s, args[5], args[1], args[2], args[3], const_args[3],
-                 args[4], const_args[4]);
+    tcg_out_cmp2(s, cond, al, ah, bl, const_bl, bh, const_bh);
     tcg_out32(s, MFOCRF | RT(TCG_REG_R0) | FXM(0));
-    tcg_out_rlw(s, RLWINM, args[0], TCG_REG_R0, CR_EQ + 0*4 + 1, 31, 31);
+    tcg_out_rlw(s, RLWINM, ret, TCG_REG_R0, CR_EQ + 0*4 + 1, 31, 31);
 }
 
+#if TCG_TARGET_REG_BITS != 32
+__attribute__((unused))
+#endif
+static const TCGOutOpSetcond2 outop_setcond2 = {
+    .base.static_constraint = C_O1_I4(r, r, r, rU, rC),
+    .out = tgen_setcond2,
+};
+
 static void tgen_brcond2(TCGContext *s, TCGCond cond, TCGReg al, TCGReg ah,
                          TCGArg bl, bool const_bl,
                          TCGArg bh, bool const_bh, TCGLabel *l)
@@ -3491,10 +3500,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_qemu_ldst_i128(s, args[0], args[1], args[2], args[3], false);
         break;
 
-    case INDEX_op_setcond2_i32:
-        tcg_out_setcond2(s, args, const_args);
-        break;
-
     case INDEX_op_bswap16_i32:
     case INDEX_op_bswap16_i64:
         tcg_out_bswap16(s, args[0], args[1], args[2]);
@@ -4277,8 +4282,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_deposit_i32:
     case INDEX_op_deposit_i64:
         return C_O1_I2(r, 0, rZ);
-    case INDEX_op_setcond2_i32:
-        return C_O1_I4(r, r, r, rU, rC);
     case INDEX_op_add2_i64:
     case INDEX_op_add2_i32:
         return C_O2_I4(r, r, r, r, rI, rZM);
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 2a39ce3665..735a7b95d4 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1033,6 +1033,12 @@ typedef struct TCGOutOpSetcond {
                     TCGReg ret, TCGReg a1, tcg_target_long a2);
 } TCGOutOpSetcond;
 
+typedef struct TCGOutOpSetcond2 {
+    TCGOutOp base;
+    void (*out)(TCGContext *s, TCGCond cond, TCGReg ret, TCGReg al, TCGReg ah,
+                TCGArg bl, bool const_bl, TCGArg bh, bool const_bh);
+} TCGOutOpSetcond2;
+
 typedef struct TCGOutOpSubtract {
     TCGOutOp base;
     void (*out_rrr)(TCGContext *s, TCGType type,
@@ -1097,6 +1103,7 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
 
 #if TCG_TARGET_REG_BITS == 32
     OUTOP(INDEX_op_brcond2_i32, TCGOutOpBrcond2, outop_brcond2),
+    OUTOP(INDEX_op_setcond2_i32, TCGOutOpSetcond2, outop_setcond2),
 #endif
 };
 
@@ -5565,8 +5572,20 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
                      new_args[3], const_args[3], label);
         }
         break;
+    case INDEX_op_setcond2_i32:
+        {
+            const TCGOutOpSetcond2 *out = &outop_setcond2;
+            TCGCond cond = new_args[5];
+
+            tcg_debug_assert(!const_args[1]);
+            tcg_debug_assert(!const_args[2]);
+            out->out(s, cond, new_args[0], new_args[1], new_args[2],
+                     new_args[3], const_args[3], new_args[4], const_args[4]);
+        }
+        break;
 #else
     case INDEX_op_brcond2_i32:
+    case INDEX_op_setcond2_i32:
         g_assert_not_reached();
 #endif
 
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index 0fe365e2d4..88dc7e24e3 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -87,9 +87,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_sub2_i64:
         return C_O2_I4(r, r, r, r, r, r);
 
-    case INDEX_op_setcond2_i32:
-        return C_O1_I4(r, r, r, r, r);
-
     case INDEX_op_qemu_ld_i32:
         return C_O1_I1(r, r);
     case INDEX_op_qemu_ld_i64:
@@ -997,6 +994,22 @@ static const TCGOutOpBrcond2 outop_brcond2 = {
     .out = tgen_brcond2,
 };
 
+static void tgen_setcond2(TCGContext *s, TCGCond cond, TCGReg ret,
+                          TCGReg al, TCGReg ah,
+                          TCGArg bl, bool const_bl,
+                          TCGArg bh, bool const_bh)
+{
+    tcg_out_op_rrrrrc(s, INDEX_op_setcond2_i32, ret, al, ah, bl, bh, cond);
+}
+
+#if TCG_TARGET_REG_BITS != 32
+__attribute__((unused))
+#endif
+static const TCGOutOpSetcond2 outop_setcond2 = {
+    .base.static_constraint = C_O1_I4(r, r, r, r, r),
+    .out = tgen_setcond2,
+};
+
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
                        const int const_args[TCG_MAX_OP_ARGS])
@@ -1012,11 +1025,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_op_l(s, opc, arg_label(args[0]));
         break;
 
-    case INDEX_op_setcond2_i32:
-        tcg_out_op_rrrrrc(s, opc, args[0], args[1], args[2],
-                          args[3], args[4], args[5]);
-        break;
-
     CASE_32_64(ld8u)
     CASE_32_64(ld8s)
     CASE_32_64(ld16u)

From 5fa8e13872b0ecab7e1bc1f75c65281983df52e5 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 10 Jan 2025 18:32:08 -0800
Subject: [PATCH 0446/2760] tcg: Convert bswap16 to TCGOutOpBswap

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target-has.h     |  2 -
 tcg/aarch64/tcg-target.c.inc     | 30 +++++++------
 tcg/arm/tcg-target-has.h         |  1 -
 tcg/arm/tcg-target.c.inc         | 42 +++++++++---------
 tcg/i386/tcg-target-has.h        |  2 -
 tcg/i386/tcg-target.c.inc        | 48 +++++++++++---------
 tcg/loongarch64/tcg-target-has.h |  2 -
 tcg/loongarch64/tcg-target.c.inc | 28 +++++++-----
 tcg/mips/tcg-target-has.h        |  2 -
 tcg/mips/tcg-target.c.inc        | 74 +++++++++++++++----------------
 tcg/ppc/tcg-target-has.h         |  2 -
 tcg/ppc/tcg-target.c.inc         | 76 ++++++++++++++++----------------
 tcg/riscv/tcg-target-has.h       |  2 -
 tcg/riscv/tcg-target.c.inc       | 33 +++++++++-----
 tcg/s390x/tcg-target-has.h       |  2 -
 tcg/s390x/tcg-target.c.inc       | 40 ++++++++---------
 tcg/sparc64/tcg-target-has.h     |  2 -
 tcg/sparc64/tcg-target.c.inc     |  4 ++
 tcg/tcg-has.h                    |  1 -
 tcg/tcg-op.c                     |  4 +-
 tcg/tcg.c                        | 23 ++++++++--
 tcg/tci.c                        |  2 -
 tcg/tci/tcg-target-has.h         |  2 -
 tcg/tci/tcg-target.c.inc         | 21 ++++++---
 24 files changed, 235 insertions(+), 210 deletions(-)

diff --git a/tcg/aarch64/tcg-target-has.h b/tcg/aarch64/tcg-target-has.h
index 22a574e703..4797409467 100644
--- a/tcg/aarch64/tcg-target-has.h
+++ b/tcg/aarch64/tcg-target-has.h
@@ -13,7 +13,6 @@
 #define have_lse2   (cpuinfo & CPUINFO_LSE2)
 
 /* optional instructions */
-#define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
 #define TCG_TARGET_HAS_extract2_i32     1
 #define TCG_TARGET_HAS_add2_i32         1
@@ -21,7 +20,6 @@
 #define TCG_TARGET_HAS_extr_i64_i32     0
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
-#define TCG_TARGET_HAS_bswap16_i64      1
 #define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1
 #define TCG_TARGET_HAS_extract2_i64     1
diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index ee45e7e244..03961b34aa 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -2438,6 +2438,23 @@ static const TCGOutOpBinary outop_xor = {
     .out_rri = tgen_xori,
 };
 
+static void tgen_bswap16(TCGContext *s, TCGType type,
+                         TCGReg a0, TCGReg a1, unsigned flags)
+{
+    tcg_out_rev(s, TCG_TYPE_I32, MO_16, a0, a1);
+    if (flags & TCG_BSWAP_OS) {
+        /* Output must be sign-extended. */
+        tcg_out_ext16s(s, type, a0, a0);
+    } else if ((flags & (TCG_BSWAP_IZ | TCG_BSWAP_OZ)) == TCG_BSWAP_OZ) {
+        /* Output must be zero-extended, but input isn't. */
+        tcg_out_ext16u(s, a0, a0);
+    }
+}
+
+static const TCGOutOpBswap outop_bswap16 = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = tgen_bswap16,
+};
 
 static void tgen_neg(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1)
 {
@@ -2618,17 +2635,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType ext,
     case INDEX_op_bswap32_i32:
         tcg_out_rev(s, TCG_TYPE_I32, MO_32, a0, a1);
         break;
-    case INDEX_op_bswap16_i64:
-    case INDEX_op_bswap16_i32:
-        tcg_out_rev(s, TCG_TYPE_I32, MO_16, a0, a1);
-        if (a2 & TCG_BSWAP_OS) {
-            /* Output must be sign-extended. */
-            tcg_out_ext16s(s, ext, a0, a0);
-        } else if ((a2 & (TCG_BSWAP_IZ | TCG_BSWAP_OZ)) == TCG_BSWAP_OZ) {
-            /* Output must be zero-extended, but input isn't. */
-            tcg_out_ext16u(s, a0, a0);
-        }
-        break;
 
     case INDEX_op_deposit_i64:
     case INDEX_op_deposit_i32:
@@ -3148,9 +3154,7 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld32u_i64:
     case INDEX_op_ld32s_i64:
     case INDEX_op_ld_i64:
-    case INDEX_op_bswap16_i32:
     case INDEX_op_bswap32_i32:
-    case INDEX_op_bswap16_i64:
     case INDEX_op_bswap32_i64:
     case INDEX_op_bswap64_i64:
     case INDEX_op_ext_i32_i64:
diff --git a/tcg/arm/tcg-target-has.h b/tcg/arm/tcg-target-has.h
index bfa3be8028..5972def558 100644
--- a/tcg/arm/tcg-target-has.h
+++ b/tcg/arm/tcg-target-has.h
@@ -24,7 +24,6 @@ extern bool use_neon_instructions;
 #endif
 
 /* optional instructions */
-#define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
 #define TCG_TARGET_HAS_extract2_i32     1
 #define TCG_TARGET_HAS_qemu_st8_i32     0
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index 8cd82b8baf..6928f209d2 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -969,23 +969,6 @@ static void tcg_out_extrl_i64_i32(TCGContext *s, TCGReg rd, TCGReg rn)
     g_assert_not_reached();
 }
 
-static void tcg_out_bswap16(TCGContext *s, ARMCond cond,
-                            TCGReg rd, TCGReg rn, int flags)
-{
-    if (flags & TCG_BSWAP_OS) {
-        /* revsh */
-        tcg_out32(s, 0x06ff0fb0 | (cond << 28) | (rd << 12) | rn);
-        return;
-    }
-
-    /* rev16 */
-    tcg_out32(s, 0x06bf0fb0 | (cond << 28) | (rd << 12) | rn);
-    if ((flags & (TCG_BSWAP_IZ | TCG_BSWAP_OZ)) == TCG_BSWAP_OZ) {
-        /* uxth */
-        tcg_out32(s, 0x06ff0070 | (cond << 28) | (rd << 12) | rd);
-    }
-}
-
 static void tcg_out_bswap32(TCGContext *s, ARMCond cond, TCGReg rd, TCGReg rn)
 {
     /* rev */
@@ -2153,6 +2136,27 @@ static const TCGOutOpBinary outop_xor = {
     .out_rri = tgen_xori,
 };
 
+static void tgen_bswap16(TCGContext *s, TCGType type,
+                         TCGReg rd, TCGReg rn, unsigned flags)
+{
+    if (flags & TCG_BSWAP_OS) {
+        /* revsh */
+        tcg_out32(s, 0x06ff0fb0 | (COND_AL << 28) | (rd << 12) | rn);
+        return;
+    }
+
+    /* rev16 */
+    tcg_out32(s, 0x06bf0fb0 | (COND_AL << 28) | (rd << 12) | rn);
+    if ((flags & (TCG_BSWAP_IZ | TCG_BSWAP_OZ)) == TCG_BSWAP_OZ) {
+        tcg_out_ext16u(s, rd, rd);
+    }
+}
+
+static const TCGOutOpBswap outop_bswap16 = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = tgen_bswap16,
+};
+
 static void tgen_neg(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1)
 {
     tgen_subfi(s, type, a0, 0, a1);
@@ -2374,9 +2378,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_qemu_st(s, args[0], args[1], args[2], args[3], TCG_TYPE_I64);
         break;
 
-    case INDEX_op_bswap16_i32:
-        tcg_out_bswap16(s, COND_AL, args[0], args[1], args[2]);
-        break;
     case INDEX_op_bswap32_i32:
         tcg_out_bswap32(s, COND_AL, args[0], args[1]);
         break;
@@ -2437,7 +2438,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld16u_i32:
     case INDEX_op_ld16s_i32:
     case INDEX_op_ld_i32:
-    case INDEX_op_bswap16_i32:
     case INDEX_op_bswap32_i32:
     case INDEX_op_extract_i32:
     case INDEX_op_sextract_i32:
diff --git a/tcg/i386/tcg-target-has.h b/tcg/i386/tcg-target-has.h
index aaf8764cc9..fd44ed8168 100644
--- a/tcg/i386/tcg-target-has.h
+++ b/tcg/i386/tcg-target-has.h
@@ -26,7 +26,6 @@
 #define have_avx512vbmi2  ((cpuinfo & CPUINFO_AVX512VBMI2) && have_avx512vl)
 
 /* optional instructions */
-#define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
 #define TCG_TARGET_HAS_extract2_i32     1
 #define TCG_TARGET_HAS_add2_i32         1
@@ -35,7 +34,6 @@
 #if TCG_TARGET_REG_BITS == 64
 /* Keep 32-bit values zero-extended in a register.  */
 #define TCG_TARGET_HAS_extr_i64_i32     1
-#define TCG_TARGET_HAS_bswap16_i64      1
 #define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1
 #define TCG_TARGET_HAS_extract2_i64     1
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index 6a42ffaf44..c74a718cee 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -3062,6 +3062,34 @@ static const TCGOutOpBinary outop_xor = {
     .out_rri = tgen_xori,
 };
 
+static void tgen_bswap16(TCGContext *s, TCGType type,
+                         TCGReg a0, TCGReg a1, unsigned flags)
+{
+    int rexw = type == TCG_TYPE_I32 ? 0 : P_REXW;
+
+    if (flags & TCG_BSWAP_OS) {
+        /* Output must be sign-extended. */
+        if (rexw) {
+            tcg_out_bswap64(s, a0);
+            tcg_out_shifti(s, SHIFT_SAR + rexw, a0, 48);
+        } else {
+            tcg_out_bswap32(s, a0);
+            tcg_out_shifti(s, SHIFT_SAR, a0, 16);
+        }
+    } else if ((flags & (TCG_BSWAP_IZ | TCG_BSWAP_OZ)) == TCG_BSWAP_OZ) {
+        /* Output must be zero-extended, but input isn't. */
+        tcg_out_bswap32(s, a0);
+        tcg_out_shifti(s, SHIFT_SHR, a0, 16);
+    } else {
+        tcg_out_rolw_8(s, a0);
+    }
+}
+
+static const TCGOutOpBswap outop_bswap16 = {
+    .base.static_constraint = C_O1_I1(r, 0),
+    .out_rr = tgen_bswap16,
+};
+
 static void tgen_neg(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1)
 {
     int rexw = type == TCG_TYPE_I32 ? 0 : P_REXW;
@@ -3165,24 +3193,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    OP_32_64(bswap16):
-        if (a2 & TCG_BSWAP_OS) {
-            /* Output must be sign-extended. */
-            if (rexw) {
-                tcg_out_bswap64(s, a0);
-                tcg_out_shifti(s, SHIFT_SAR + rexw, a0, 48);
-            } else {
-                tcg_out_bswap32(s, a0);
-                tcg_out_shifti(s, SHIFT_SAR, a0, 16);
-            }
-        } else if ((a2 & (TCG_BSWAP_IZ | TCG_BSWAP_OZ)) == TCG_BSWAP_OZ) {
-            /* Output must be zero-extended, but input isn't. */
-            tcg_out_bswap32(s, a0);
-            tcg_out_shifti(s, SHIFT_SHR, a0, 16);
-        } else {
-            tcg_out_rolw_8(s, a0);
-        }
-        break;
     OP_32_64(bswap32):
         tcg_out_bswap32(s, a0);
         if (rexw && (a2 & TCG_BSWAP_OS)) {
@@ -3962,8 +3972,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(re, r);
 
-    case INDEX_op_bswap16_i32:
-    case INDEX_op_bswap16_i64:
     case INDEX_op_bswap32_i32:
     case INDEX_op_bswap32_i64:
     case INDEX_op_bswap64_i64:
diff --git a/tcg/loongarch64/tcg-target-has.h b/tcg/loongarch64/tcg-target-has.h
index 90f0a131ae..11a93afd8b 100644
--- a/tcg/loongarch64/tcg-target-has.h
+++ b/tcg/loongarch64/tcg-target-has.h
@@ -13,14 +13,12 @@
 #define TCG_TARGET_HAS_extract2_i32     0
 #define TCG_TARGET_HAS_add2_i32         0
 #define TCG_TARGET_HAS_sub2_i32         0
-#define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
 /* 64-bit operations */
 #define TCG_TARGET_HAS_extract2_i64     0
 #define TCG_TARGET_HAS_extr_i64_i32     1
-#define TCG_TARGET_HAS_bswap16_i64      1
 #define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1
 #define TCG_TARGET_HAS_add2_i64         0
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index c731096c64..8be6f69e3a 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -1735,6 +1735,22 @@ static const TCGOutOpBinary outop_xor = {
     .out_rri = tgen_xori,
 };
 
+static void tgen_bswap16(TCGContext *s, TCGType type,
+                         TCGReg a0, TCGReg a1, unsigned flags)
+{
+    tcg_out_opc_revb_2h(s, a0, a1);
+    if (flags & TCG_BSWAP_OS) {
+        tcg_out_ext16s(s, TCG_TYPE_REG, a0, a0);
+    } else if ((flags & (TCG_BSWAP_IZ | TCG_BSWAP_OZ)) == TCG_BSWAP_OZ) {
+        tcg_out_ext16u(s, a0, a0);
+    }
+}
+
+static const TCGOutOpBswap outop_bswap16 = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = tgen_bswap16,
+};
+
 static void tgen_neg(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1)
 {
     tgen_sub(s, type, a0, TCG_REG_ZERO, a1);
@@ -1826,16 +1842,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_opc_bstrins_d(s, a0, a2, args[3], args[3] + args[4] - 1);
         break;
 
-    case INDEX_op_bswap16_i32:
-    case INDEX_op_bswap16_i64:
-        tcg_out_opc_revb_2h(s, a0, a1);
-        if (a2 & TCG_BSWAP_OS) {
-            tcg_out_ext16s(s, TCG_TYPE_REG, a0, a0);
-        } else if ((a2 & (TCG_BSWAP_IZ | TCG_BSWAP_OZ)) == TCG_BSWAP_OZ) {
-            tcg_out_ext16u(s, a0, a0);
-        }
-        break;
-
     case INDEX_op_bswap32_i32:
         /* All 32-bit values are computed sign-extended in the register.  */
         a2 = TCG_BSWAP_OS;
@@ -2448,8 +2454,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_extract_i64:
     case INDEX_op_sextract_i32:
     case INDEX_op_sextract_i64:
-    case INDEX_op_bswap16_i32:
-    case INDEX_op_bswap16_i64:
     case INDEX_op_bswap32_i32:
     case INDEX_op_bswap32_i64:
     case INDEX_op_bswap64_i64:
diff --git a/tcg/mips/tcg-target-has.h b/tcg/mips/tcg-target-has.h
index c6cecba28b..6c967d9c9f 100644
--- a/tcg/mips/tcg-target-has.h
+++ b/tcg/mips/tcg-target-has.h
@@ -39,7 +39,6 @@ extern bool use_mips32r2_instructions;
 #endif
 
 /* optional instructions */
-#define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
 
 #if TCG_TARGET_REG_BITS == 64
@@ -57,7 +56,6 @@ extern bool use_mips32r2_instructions;
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
 #if TCG_TARGET_REG_BITS == 64
-#define TCG_TARGET_HAS_bswap16_i64      1
 #define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1
 #define TCG_TARGET_HAS_extract2_i64     0
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index e8ae65bccb..258b49f9db 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -702,39 +702,6 @@ static void tcg_out_addi_ptr(TCGContext *s, TCGReg rd, TCGReg rs,
     g_assert_not_reached();
 }
 
-static void tcg_out_bswap16(TCGContext *s, TCGReg ret, TCGReg arg, int flags)
-{
-    /* ret and arg can't be register tmp0 */
-    tcg_debug_assert(ret != TCG_TMP0);
-    tcg_debug_assert(arg != TCG_TMP0);
-
-    /* With arg = abcd: */
-    if (use_mips32r2_instructions) {
-        tcg_out_opc_reg(s, OPC_WSBH, ret, 0, arg);                 /* badc */
-        if (flags & TCG_BSWAP_OS) {
-            tcg_out_opc_reg(s, OPC_SEH, ret, 0, ret);              /* ssdc */
-        } else if ((flags & (TCG_BSWAP_IZ | TCG_BSWAP_OZ)) == TCG_BSWAP_OZ) {
-            tcg_out_opc_imm(s, OPC_ANDI, ret, ret, 0xffff);        /* 00dc */
-        }
-        return;
-    }
-
-    tcg_out_opc_sa(s, OPC_SRL, TCG_TMP0, arg, 8);                  /* 0abc */
-    if (!(flags & TCG_BSWAP_IZ)) {
-        tcg_out_opc_imm(s, OPC_ANDI, TCG_TMP0, TCG_TMP0, 0x00ff);  /* 000c */
-    }
-    if (flags & TCG_BSWAP_OS) {
-        tcg_out_opc_sa(s, OPC_SLL, ret, arg, 24);                  /* d000 */
-        tcg_out_opc_sa(s, OPC_SRA, ret, ret, 16);                  /* ssd0 */
-    } else {
-        tcg_out_opc_sa(s, OPC_SLL, ret, arg, 8);                   /* bcd0 */
-        if (flags & TCG_BSWAP_OZ) {
-            tcg_out_opc_imm(s, OPC_ANDI, ret, ret, 0xff00);        /* 00d0 */
-        }
-    }
-    tcg_out_opc_reg(s, OPC_OR, ret, ret, TCG_TMP0);                /* ssdc */
-}
-
 static void tcg_out_bswap_subr(TCGContext *s, const tcg_insn_unit *sub)
 {
     if (!tcg_out_opc_jmp(s, OPC_JAL, sub)) {
@@ -2168,6 +2135,41 @@ static const TCGOutOpBinary outop_xor = {
     .out_rri = tgen_xori,
 };
 
+static void tgen_bswap16(TCGContext *s, TCGType type,
+                         TCGReg ret, TCGReg arg, unsigned flags)
+{
+    /* With arg = abcd: */
+    if (use_mips32r2_instructions) {
+        tcg_out_opc_reg(s, OPC_WSBH, ret, 0, arg);                 /* badc */
+        if (flags & TCG_BSWAP_OS) {
+            tcg_out_opc_reg(s, OPC_SEH, ret, 0, ret);              /* ssdc */
+        } else if ((flags & (TCG_BSWAP_IZ | TCG_BSWAP_OZ)) == TCG_BSWAP_OZ) {
+            tcg_out_opc_imm(s, OPC_ANDI, ret, ret, 0xffff);        /* 00dc */
+        }
+        return;
+    }
+
+    tcg_out_opc_sa(s, OPC_SRL, TCG_TMP0, arg, 8);                  /* 0abc */
+    if (!(flags & TCG_BSWAP_IZ)) {
+        tcg_out_opc_imm(s, OPC_ANDI, TCG_TMP0, TCG_TMP0, 0x00ff);  /* 000c */
+    }
+    if (flags & TCG_BSWAP_OS) {
+        tcg_out_opc_sa(s, OPC_SLL, ret, arg, 24);                  /* d000 */
+        tcg_out_opc_sa(s, OPC_SRA, ret, ret, 16);                  /* ssd0 */
+    } else {
+        tcg_out_opc_sa(s, OPC_SLL, ret, arg, 8);                   /* bcd0 */
+        if (flags & TCG_BSWAP_OZ) {
+            tcg_out_opc_imm(s, OPC_ANDI, ret, ret, 0xff00);        /* 00d0 */
+        }
+    }
+    tcg_out_opc_reg(s, OPC_OR, ret, ret, TCG_TMP0);                /* ssdc */
+}
+
+static const TCGOutOpBswap outop_bswap16 = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = tgen_bswap16,
+};
+
 static void tgen_neg(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1)
 {
     tgen_sub(s, type, a0, TCG_REG_ZERO, a1);
@@ -2259,10 +2261,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_ldst(s, i1, a0, a1, a2);
         break;
 
-    case INDEX_op_bswap16_i32:
-    case INDEX_op_bswap16_i64:
-        tcg_out_bswap16(s, a0, a1, a2);
-        break;
     case INDEX_op_bswap32_i32:
         tcg_out_bswap32(s, a0, a1, 0);
         break;
@@ -2373,7 +2371,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld16u_i32:
     case INDEX_op_ld16s_i32:
     case INDEX_op_ld_i32:
-    case INDEX_op_bswap16_i32:
     case INDEX_op_bswap32_i32:
     case INDEX_op_extract_i32:
     case INDEX_op_sextract_i32:
@@ -2384,7 +2381,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld32s_i64:
     case INDEX_op_ld32u_i64:
     case INDEX_op_ld_i64:
-    case INDEX_op_bswap16_i64:
     case INDEX_op_bswap32_i64:
     case INDEX_op_bswap64_i64:
     case INDEX_op_ext_i32_i64:
diff --git a/tcg/ppc/tcg-target-has.h b/tcg/ppc/tcg-target-has.h
index 5c4fc2bc34..b73fca9789 100644
--- a/tcg/ppc/tcg-target-has.h
+++ b/tcg/ppc/tcg-target-has.h
@@ -17,7 +17,6 @@
 #define have_vsx       (cpuinfo & CPUINFO_VSX)
 
 /* optional instructions */
-#define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
 #define TCG_TARGET_HAS_extract2_i32     0
 #define TCG_TARGET_HAS_qemu_st8_i32     0
@@ -26,7 +25,6 @@
 #define TCG_TARGET_HAS_add2_i32         0
 #define TCG_TARGET_HAS_sub2_i32         0
 #define TCG_TARGET_HAS_extr_i64_i32     0
-#define TCG_TARGET_HAS_bswap16_i64      1
 #define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1
 #define TCG_TARGET_HAS_extract2_i64     0
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index 4cdbf246d2..3454254624 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -1012,38 +1012,6 @@ static void tcg_out_addpcis(TCGContext *s, TCGReg dst, intptr_t imm)
     tcg_out32(s, ADDPCIS | RT(dst) | (d1 << 16) | (d0 << 6) | d2);
 }
 
-static void tcg_out_bswap16(TCGContext *s, TCGReg dst, TCGReg src, int flags)
-{
-    TCGReg tmp = dst == src ? TCG_REG_R0 : dst;
-
-    if (have_isa_3_10) {
-        tcg_out32(s, BRH | RA(dst) | RS(src));
-        if (flags & TCG_BSWAP_OS) {
-            tcg_out_ext16s(s, TCG_TYPE_REG, dst, dst);
-        } else if ((flags & (TCG_BSWAP_IZ | TCG_BSWAP_OZ)) == TCG_BSWAP_OZ) {
-            tcg_out_ext16u(s, dst, dst);
-        }
-        return;
-    }
-
-    /*
-     * In the following,
-     *   dep(a, b, m) -> (a & ~m) | (b & m)
-     *
-     * Begin with:                              src = xxxxabcd
-     */
-    /* tmp = rol32(src, 24) & 0x000000ff            = 0000000c */
-    tcg_out_rlw(s, RLWINM, tmp, src, 24, 24, 31);
-    /* tmp = dep(tmp, rol32(src, 8), 0x0000ff00)    = 000000dc */
-    tcg_out_rlw(s, RLWIMI, tmp, src, 8, 16, 23);
-
-    if (flags & TCG_BSWAP_OS) {
-        tcg_out_ext16s(s, TCG_TYPE_REG, dst, tmp);
-    } else {
-        tcg_out_mov(s, TCG_TYPE_REG, dst, tmp);
-    }
-}
-
 static void tcg_out_bswap32(TCGContext *s, TCGReg dst, TCGReg src, int flags)
 {
     TCGReg tmp = dst == src ? TCG_REG_R0 : dst;
@@ -3378,6 +3346,44 @@ static const TCGOutOpBinary outop_xor = {
     .out_rri = tgen_xori,
 };
 
+static void tgen_bswap16(TCGContext *s, TCGType type,
+                         TCGReg dst, TCGReg src, unsigned flags)
+{
+    TCGReg tmp = dst == src ? TCG_REG_R0 : dst;
+
+    if (have_isa_3_10) {
+        tcg_out32(s, BRH | RA(dst) | RS(src));
+        if (flags & TCG_BSWAP_OS) {
+            tcg_out_ext16s(s, TCG_TYPE_REG, dst, dst);
+        } else if ((flags & (TCG_BSWAP_IZ | TCG_BSWAP_OZ)) == TCG_BSWAP_OZ) {
+            tcg_out_ext16u(s, dst, dst);
+        }
+        return;
+    }
+
+    /*
+     * In the following,
+     *   dep(a, b, m) -> (a & ~m) | (b & m)
+     *
+     * Begin with:                              src = xxxxabcd
+     */
+    /* tmp = rol32(src, 24) & 0x000000ff            = 0000000c */
+    tcg_out_rlw(s, RLWINM, tmp, src, 24, 24, 31);
+    /* tmp = dep(tmp, rol32(src, 8), 0x0000ff00)    = 000000dc */
+    tcg_out_rlw(s, RLWIMI, tmp, src, 8, 16, 23);
+
+    if (flags & TCG_BSWAP_OS) {
+        tcg_out_ext16s(s, TCG_TYPE_REG, dst, tmp);
+    } else {
+        tcg_out_mov(s, TCG_TYPE_REG, dst, tmp);
+    }
+}
+
+static const TCGOutOpBswap outop_bswap16 = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = tgen_bswap16,
+};
+
 static void tgen_neg(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1)
 {
     tcg_out32(s, NEG | RT(a0) | RA(a1));
@@ -3500,10 +3506,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_qemu_ldst_i128(s, args[0], args[1], args[2], args[3], false);
         break;
 
-    case INDEX_op_bswap16_i32:
-    case INDEX_op_bswap16_i64:
-        tcg_out_bswap16(s, args[0], args[1], args[2]);
-        break;
     case INDEX_op_bswap32_i32:
         tcg_out_bswap32(s, args[0], args[1], 0);
         break;
@@ -4250,7 +4252,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld16u_i32:
     case INDEX_op_ld16s_i32:
     case INDEX_op_ld_i32:
-    case INDEX_op_bswap16_i32:
     case INDEX_op_bswap32_i32:
     case INDEX_op_extract_i32:
     case INDEX_op_sextract_i32:
@@ -4263,7 +4264,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld_i64:
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
-    case INDEX_op_bswap16_i64:
     case INDEX_op_bswap32_i64:
     case INDEX_op_bswap64_i64:
     case INDEX_op_extract_i64:
diff --git a/tcg/riscv/tcg-target-has.h b/tcg/riscv/tcg-target-has.h
index e18b5cb8ec..85bb5cd591 100644
--- a/tcg/riscv/tcg-target-has.h
+++ b/tcg/riscv/tcg-target-has.h
@@ -13,13 +13,11 @@
 #define TCG_TARGET_HAS_extract2_i32     0
 #define TCG_TARGET_HAS_add2_i32         1
 #define TCG_TARGET_HAS_sub2_i32         1
-#define TCG_TARGET_HAS_bswap16_i32      (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_bswap32_i32      (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
 #define TCG_TARGET_HAS_extract2_i64     0
 #define TCG_TARGET_HAS_extr_i64_i32     1
-#define TCG_TARGET_HAS_bswap16_i64      (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_bswap32_i64      (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_bswap64_i64      (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_add2_i64         1
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index 8d106d7f28..c6cd2100f8 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -2402,6 +2402,28 @@ static const TCGOutOpBinary outop_xor = {
     .out_rri = tgen_xori,
 };
 
+static TCGConstraintSetIndex cset_bswap(TCGType type, unsigned flags)
+{
+    return cpuinfo & CPUINFO_ZBB ? C_O1_I1(r, r) : C_NotImplemented;
+}
+
+static void tgen_bswap16(TCGContext *s, TCGType type,
+                         TCGReg a0, TCGReg a1, unsigned flags)
+{
+    tcg_out_opc_imm(s, OPC_REV8, a0, a1, 0);
+    if (flags & TCG_BSWAP_OZ) {
+        tcg_out_opc_imm(s, OPC_SRLI, a0, a0, 48);
+    } else {
+        tcg_out_opc_imm(s, OPC_SRAI, a0, a0, 48);
+    }
+}
+
+static const TCGOutOpBswap outop_bswap16 = {
+    .base.static_constraint = C_Dynamic,
+    .base.dynamic_constraint = cset_bswap,
+    .out_rr = tgen_bswap16,
+};
+
 static void tgen_neg(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1)
 {
     tgen_sub(s, type, a0, TCG_REG_ZERO, a1);
@@ -2498,15 +2520,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
             tcg_out_opc_imm(s, OPC_SRAI, a0, a0, 32);
         }
         break;
-    case INDEX_op_bswap16_i64:
-    case INDEX_op_bswap16_i32:
-        tcg_out_opc_imm(s, OPC_REV8, a0, a1, 0);
-        if (a2 & TCG_BSWAP_OZ) {
-            tcg_out_opc_imm(s, OPC_SRLI, a0, a0, 48);
-        } else {
-            tcg_out_opc_imm(s, OPC_SRAI, a0, a0, 48);
-        }
-        break;
 
     case INDEX_op_add2_i32:
         tcg_out_addsub2(s, a0, a1, a2, args[3], args[4], args[5],
@@ -2845,9 +2858,7 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_extract_i64:
     case INDEX_op_sextract_i32:
     case INDEX_op_sextract_i64:
-    case INDEX_op_bswap16_i32:
     case INDEX_op_bswap32_i32:
-    case INDEX_op_bswap16_i64:
     case INDEX_op_bswap32_i64:
     case INDEX_op_bswap64_i64:
         return C_O1_I1(r, r);
diff --git a/tcg/s390x/tcg-target-has.h b/tcg/s390x/tcg-target-has.h
index 41cd8a1d0d..6cd92fa240 100644
--- a/tcg/s390x/tcg-target-has.h
+++ b/tcg/s390x/tcg-target-has.h
@@ -29,7 +29,6 @@ extern uint64_t s390_facilities[3];
     ((s390_facilities[FACILITY_##X / 64] >> (63 - FACILITY_##X % 64)) & 1)
 
 /* optional instructions */
-#define TCG_TARGET_HAS_bswap16_i32    1
 #define TCG_TARGET_HAS_bswap32_i32    1
 #define TCG_TARGET_HAS_extract2_i32   0
 #define TCG_TARGET_HAS_add2_i32       1
@@ -37,7 +36,6 @@ extern uint64_t s390_facilities[3];
 #define TCG_TARGET_HAS_extr_i64_i32   0
 #define TCG_TARGET_HAS_qemu_st8_i32   0
 
-#define TCG_TARGET_HAS_bswap16_i64    1
 #define TCG_TARGET_HAS_bswap32_i64    1
 #define TCG_TARGET_HAS_bswap64_i64    1
 #define TCG_TARGET_HAS_extract2_i64   0
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index fbf39ca529..e90c03628a 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -2741,6 +2741,25 @@ static const TCGOutOpBinary outop_xor = {
     .out_rri = tgen_xori_3,
 };
 
+static void tgen_bswap16(TCGContext *s, TCGType type,
+                         TCGReg a0, TCGReg a1, unsigned flags)
+{
+    if (type == TCG_TYPE_I32) {
+        tcg_out_insn(s, RRE, LRVR, a0, a1);
+        tcg_out_sh32(s, (flags & TCG_BSWAP_OS ? RS_SRA : RS_SRL),
+                     a0, TCG_REG_NONE, 16);
+    } else {
+        tcg_out_insn(s, RRE, LRVGR, a0, a1);
+        tcg_out_sh64(s, (flags & TCG_BSWAP_OS ? RSY_SRAG : RSY_SRLG),
+                     a0, a0, TCG_REG_NONE, 48);
+    }
+}
+
+static const TCGOutOpBswap outop_bswap16 = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = tgen_bswap16,
+};
+
 static void tgen_neg(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1)
 {
     if (type == TCG_TYPE_I32) {
@@ -2827,25 +2846,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_st(s, TCG_TYPE_I32, args[0], args[1], args[2]);
         break;
 
-    case INDEX_op_bswap16_i32:
-        a0 = args[0], a1 = args[1], a2 = args[2];
-        tcg_out_insn(s, RRE, LRVR, a0, a1);
-        if (a2 & TCG_BSWAP_OS) {
-            tcg_out_sh32(s, RS_SRA, a0, TCG_REG_NONE, 16);
-        } else {
-            tcg_out_sh32(s, RS_SRL, a0, TCG_REG_NONE, 16);
-        }
-        break;
-    case INDEX_op_bswap16_i64:
-        a0 = args[0], a1 = args[1], a2 = args[2];
-        tcg_out_insn(s, RRE, LRVGR, a0, a1);
-        if (a2 & TCG_BSWAP_OS) {
-            tcg_out_sh64(s, RSY_SRAG, a0, a0, TCG_REG_NONE, 48);
-        } else {
-            tcg_out_sh64(s, RSY_SRLG, a0, a0, TCG_REG_NONE, 48);
-        }
-        break;
-
     case INDEX_op_bswap32_i32:
         tcg_out_insn(s, RRE, LRVR, args[0], args[1]);
         break;
@@ -3459,8 +3459,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(r, r);
 
-    case INDEX_op_bswap16_i32:
-    case INDEX_op_bswap16_i64:
     case INDEX_op_bswap32_i32:
     case INDEX_op_bswap32_i64:
     case INDEX_op_bswap64_i64:
diff --git a/tcg/sparc64/tcg-target-has.h b/tcg/sparc64/tcg-target-has.h
index 6ed27b8fcc..eb1e16c0e2 100644
--- a/tcg/sparc64/tcg-target-has.h
+++ b/tcg/sparc64/tcg-target-has.h
@@ -14,7 +14,6 @@ extern bool use_vis3_instructions;
 #endif
 
 /* optional instructions */
-#define TCG_TARGET_HAS_bswap16_i32      0
 #define TCG_TARGET_HAS_bswap32_i32      0
 #define TCG_TARGET_HAS_extract2_i32     0
 #define TCG_TARGET_HAS_add2_i32         1
@@ -22,7 +21,6 @@ extern bool use_vis3_instructions;
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
 #define TCG_TARGET_HAS_extr_i64_i32     0
-#define TCG_TARGET_HAS_bswap16_i64      0
 #define TCG_TARGET_HAS_bswap32_i64      0
 #define TCG_TARGET_HAS_bswap64_i64      0
 #define TCG_TARGET_HAS_extract2_i64     0
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index d99b9e42ce..5111f173e1 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -1725,6 +1725,10 @@ static const TCGOutOpBinary outop_xor = {
     .out_rri = tgen_xori,
 };
 
+static const TCGOutOpBswap outop_bswap16 = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static void tgen_neg(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1)
 {
      tgen_sub(s, type, a0, TCG_REG_G0, a1);
diff --git a/tcg/tcg-has.h b/tcg/tcg-has.h
index 315dfd05aa..3d1c805d59 100644
--- a/tcg/tcg-has.h
+++ b/tcg/tcg-has.h
@@ -12,7 +12,6 @@
 #if TCG_TARGET_REG_BITS == 32
 /* Turn some undef macros into false macros.  */
 #define TCG_TARGET_HAS_extr_i64_i32     0
-#define TCG_TARGET_HAS_bswap16_i64      0
 #define TCG_TARGET_HAS_bswap32_i64      0
 #define TCG_TARGET_HAS_bswap64_i64      0
 #define TCG_TARGET_HAS_extract2_i64     0
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index 3527952c66..c5b3bc8148 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -1257,7 +1257,7 @@ void tcg_gen_bswap16_i32(TCGv_i32 ret, TCGv_i32 arg, int flags)
     /* Only one extension flag may be present. */
     tcg_debug_assert(!(flags & TCG_BSWAP_OS) || !(flags & TCG_BSWAP_OZ));
 
-    if (TCG_TARGET_HAS_bswap16_i32) {
+    if (tcg_op_supported(INDEX_op_bswap16_i32, TCG_TYPE_I32, 0)) {
         tcg_gen_op3i_i32(INDEX_op_bswap16_i32, ret, arg, flags);
     } else {
         TCGv_i32 t0 = tcg_temp_ebb_new_i32();
@@ -2087,7 +2087,7 @@ void tcg_gen_bswap16_i64(TCGv_i64 ret, TCGv_i64 arg, int flags)
         } else {
             tcg_gen_movi_i32(TCGV_HIGH(ret), 0);
         }
-    } else if (TCG_TARGET_HAS_bswap16_i64) {
+    } else if (tcg_op_supported(INDEX_op_bswap16_i64, TCG_TYPE_I64, 0)) {
         tcg_gen_op3i_i64(INDEX_op_bswap16_i64, ret, arg, flags);
     } else {
         TCGv_i64 t0 = tcg_temp_ebb_new_i64();
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 735a7b95d4..25834f40a0 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1001,6 +1001,12 @@ typedef struct TCGOutOpBrcond2 {
                 TCGArg bh, bool const_bh, TCGLabel *l);
 } TCGOutOpBrcond2;
 
+typedef struct TCGOutOpBswap {
+    TCGOutOp base;
+    void (*out_rr)(TCGContext *s, TCGType type,
+                   TCGReg a0, TCGReg a1, unsigned flags);
+} TCGOutOpBswap;
+
 typedef struct TCGOutOpDivRem {
     TCGOutOp base;
     void (*out_rr01r)(TCGContext *s, TCGType type,
@@ -1069,6 +1075,8 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_and, TCGOutOpBinary, outop_and),
     OUTOP(INDEX_op_andc, TCGOutOpBinary, outop_andc),
     OUTOP(INDEX_op_brcond, TCGOutOpBrcond, outop_brcond),
+    OUTOP(INDEX_op_bswap16_i32, TCGOutOpBswap, outop_bswap16),
+    OUTOP(INDEX_op_bswap16_i64, TCGOutOpBswap, outop_bswap16),
     OUTOP(INDEX_op_clz, TCGOutOpBinary, outop_clz),
     OUTOP(INDEX_op_ctpop, TCGOutOpUnary, outop_ctpop),
     OUTOP(INDEX_op_ctz, TCGOutOpBinary, outop_ctz),
@@ -2335,8 +2343,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
         return TCG_TARGET_HAS_add2_i32;
     case INDEX_op_sub2_i32:
         return TCG_TARGET_HAS_sub2_i32;
-    case INDEX_op_bswap16_i32:
-        return TCG_TARGET_HAS_bswap16_i32;
     case INDEX_op_bswap32_i32:
         return TCG_TARGET_HAS_bswap32_i32;
 
@@ -2367,8 +2373,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_extrl_i64_i32:
     case INDEX_op_extrh_i64_i32:
         return TCG_TARGET_HAS_extr_i64_i32;
-    case INDEX_op_bswap16_i64:
-        return TCG_TARGET_HAS_bswap16_i64;
     case INDEX_op_bswap32_i64:
         return TCG_TARGET_HAS_bswap32_i64;
     case INDEX_op_bswap64_i64:
@@ -5485,6 +5489,17 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
         }
         break;
 
+    case INDEX_op_bswap16_i32:
+    case INDEX_op_bswap16_i64:
+        {
+            const TCGOutOpBswap *out =
+                container_of(all_outop[op->opc], TCGOutOpBswap, base);
+
+            tcg_debug_assert(!const_args[1]);
+            out->out_rr(s, type, new_args[0], new_args[1], new_args[2]);
+        }
+        break;
+
     case INDEX_op_divs2:
     case INDEX_op_divu2:
         {
diff --git a/tcg/tci.c b/tcg/tci.c
index 9c3f58242e..ae447e91bd 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -686,12 +686,10 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_write_reg64(regs, r1, r0, T1 - T2);
             break;
 #endif
-#if TCG_TARGET_HAS_bswap16_i32 || TCG_TARGET_HAS_bswap16_i64
         CASE_32_64(bswap16)
             tci_args_rr(insn, &r0, &r1);
             regs[r0] = bswap16(regs[r1]);
             break;
-#endif
 #if TCG_TARGET_HAS_bswap32_i32 || TCG_TARGET_HAS_bswap32_i64
         CASE_32_64(bswap32)
             tci_args_rr(insn, &r0, &r1);
diff --git a/tcg/tci/tcg-target-has.h b/tcg/tci/tcg-target-has.h
index f45a0688f9..d7228246ab 100644
--- a/tcg/tci/tcg-target-has.h
+++ b/tcg/tci/tcg-target-has.h
@@ -7,14 +7,12 @@
 #ifndef TCG_TARGET_HAS_H
 #define TCG_TARGET_HAS_H
 
-#define TCG_TARGET_HAS_bswap16_i32      1
 #define TCG_TARGET_HAS_bswap32_i32      1
 #define TCG_TARGET_HAS_extract2_i32     0
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
 #if TCG_TARGET_REG_BITS == 64
 #define TCG_TARGET_HAS_extr_i64_i32     0
-#define TCG_TARGET_HAS_bswap16_i64      1
 #define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1
 #define TCG_TARGET_HAS_extract2_i64     0
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index 88dc7e24e3..2a8ba07e37 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -57,8 +57,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld_i64:
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
-    case INDEX_op_bswap16_i32:
-    case INDEX_op_bswap16_i64:
     case INDEX_op_bswap32_i32:
     case INDEX_op_bswap32_i64:
     case INDEX_op_bswap64_i64:
@@ -904,6 +902,20 @@ static const TCGOutOpUnary outop_ctpop = {
     .out_rr = tgen_ctpop,
 };
 
+static void tgen_bswap16(TCGContext *s, TCGType type,
+                         TCGReg a0, TCGReg a1, unsigned flags)
+{
+    tcg_out_op_rr(s, INDEX_op_bswap16_i32, a0, a1);
+    if (flags & TCG_BSWAP_OS) {
+        tcg_out_sextract(s, TCG_TYPE_REG, a0, a0, 0, 16);
+    }
+}
+
+static const TCGOutOpBswap outop_bswap16 = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = tgen_bswap16,
+};
+
 static void tgen_neg(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1)
 {
     tcg_out_op_rr(s, INDEX_op_neg, a0, a1);
@@ -1055,13 +1067,8 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_op_rr(s, opc, args[0], args[1]);
         break;
 
-    case INDEX_op_bswap16_i32: /* Optional (TCG_TARGET_HAS_bswap16_i32). */
-    case INDEX_op_bswap16_i64: /* Optional (TCG_TARGET_HAS_bswap16_i64). */
-        width = 16;
-        goto do_bswap;
     case INDEX_op_bswap32_i64: /* Optional (TCG_TARGET_HAS_bswap32_i64). */
         width = 32;
-    do_bswap:
         /* The base tci bswaps zero-extend, and ignore high bits. */
         tcg_out_op_rr(s, opc, args[0], args[1]);
         if (args[2] & TCG_BSWAP_OS) {

From 0dd07ee1122abaf1adb4f1e00a8e0b89937f53bd Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 10 Jan 2025 18:51:16 -0800
Subject: [PATCH 0447/2760] tcg: Merge INDEX_op_bswap16_{i32,i64}
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 docs/devel/tcg-ops.rst   | 2 +-
 include/tcg/tcg-opc.h    | 3 +--
 tcg/optimize.c           | 7 +++----
 tcg/tcg-op.c             | 8 ++++----
 tcg/tcg.c                | 9 +++------
 tcg/tci.c                | 5 ++---
 tcg/tci/tcg-target.c.inc | 2 +-
 7 files changed, 15 insertions(+), 21 deletions(-)

diff --git a/docs/devel/tcg-ops.rst b/docs/devel/tcg-ops.rst
index 26dc3bad49..509cfe7db1 100644
--- a/docs/devel/tcg-ops.rst
+++ b/docs/devel/tcg-ops.rst
@@ -415,7 +415,7 @@ Misc
      - | *t0* = *t1*
        | Move *t1* to *t0*.
 
-   * - bswap16_i32/i64 *t0*, *t1*, *flags*
+   * - bswap16 *t0*, *t1*, *flags*
 
      - | 16 bit byte swap on the low bits of a 32/64 bit input.
        |
diff --git a/include/tcg/tcg-opc.h b/include/tcg/tcg-opc.h
index 5e085607d5..acfbaa05b4 100644
--- a/include/tcg/tcg-opc.h
+++ b/include/tcg/tcg-opc.h
@@ -43,6 +43,7 @@ DEF(mov, 1, 1, 0, TCG_OPF_INT | TCG_OPF_NOT_PRESENT)
 DEF(add, 1, 2, 0, TCG_OPF_INT)
 DEF(and, 1, 2, 0, TCG_OPF_INT)
 DEF(andc, 1, 2, 0, TCG_OPF_INT)
+DEF(bswap16, 1, 1, 1, TCG_OPF_INT)
 DEF(clz, 1, 2, 0, TCG_OPF_INT)
 DEF(ctpop, 1, 1, 0, TCG_OPF_INT)
 DEF(ctz, 1, 2, 0, TCG_OPF_INT)
@@ -95,7 +96,6 @@ DEF(sub2_i32, 2, 4, 0, 0)
 DEF(brcond2_i32, 0, 4, 2, TCG_OPF_BB_END | TCG_OPF_COND_BRANCH)
 DEF(setcond2_i32, 1, 4, 1, 0)
 
-DEF(bswap16_i32, 1, 1, 1, 0)
 DEF(bswap32_i32, 1, 1, 1, 0)
 
 /* load/store */
@@ -122,7 +122,6 @@ DEF(extu_i32_i64, 1, 1, 0, 0)
 DEF(extrl_i64_i32, 1, 1, 0, 0)
 DEF(extrh_i64_i32, 1, 1, 0, 0)
 
-DEF(bswap16_i64, 1, 1, 1, 0)
 DEF(bswap32_i64, 1, 1, 1, 0)
 DEF(bswap64_i64, 1, 1, 1, 0)
 
diff --git a/tcg/optimize.c b/tcg/optimize.c
index 54606388cc..1d535a9fae 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -518,7 +518,7 @@ static uint64_t do_constant_folding_2(TCGOpcode op, TCGType type,
     case INDEX_op_ctpop:
         return type == TCG_TYPE_I32 ? ctpop32(x) : ctpop64(x);
 
-    CASE_OP_32_64(bswap16):
+    case INDEX_op_bswap16:
         x = bswap16(x);
         return y & TCG_BSWAP_OS ? (int16_t)x : x;
 
@@ -1572,8 +1572,7 @@ static bool fold_bswap(OptContext *ctx, TCGOp *op)
 
     z_mask = t1->z_mask;
     switch (op->opc) {
-    case INDEX_op_bswap16_i32:
-    case INDEX_op_bswap16_i64:
+    case INDEX_op_bswap16:
         z_mask = bswap16(z_mask);
         sign = INT16_MIN;
         break;
@@ -2870,7 +2869,7 @@ void tcg_optimize(TCGContext *s)
         case INDEX_op_brcond2_i32:
             done = fold_brcond2(&ctx, op);
             break;
-        CASE_OP_32_64(bswap16):
+        case INDEX_op_bswap16:
         CASE_OP_32_64(bswap32):
         case INDEX_op_bswap64_i64:
             done = fold_bswap(&ctx, op);
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index c5b3bc8148..917f52b04a 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -1257,8 +1257,8 @@ void tcg_gen_bswap16_i32(TCGv_i32 ret, TCGv_i32 arg, int flags)
     /* Only one extension flag may be present. */
     tcg_debug_assert(!(flags & TCG_BSWAP_OS) || !(flags & TCG_BSWAP_OZ));
 
-    if (tcg_op_supported(INDEX_op_bswap16_i32, TCG_TYPE_I32, 0)) {
-        tcg_gen_op3i_i32(INDEX_op_bswap16_i32, ret, arg, flags);
+    if (tcg_op_supported(INDEX_op_bswap16, TCG_TYPE_I32, 0)) {
+        tcg_gen_op3i_i32(INDEX_op_bswap16, ret, arg, flags);
     } else {
         TCGv_i32 t0 = tcg_temp_ebb_new_i32();
         TCGv_i32 t1 = tcg_temp_ebb_new_i32();
@@ -2087,8 +2087,8 @@ void tcg_gen_bswap16_i64(TCGv_i64 ret, TCGv_i64 arg, int flags)
         } else {
             tcg_gen_movi_i32(TCGV_HIGH(ret), 0);
         }
-    } else if (tcg_op_supported(INDEX_op_bswap16_i64, TCG_TYPE_I64, 0)) {
-        tcg_gen_op3i_i64(INDEX_op_bswap16_i64, ret, arg, flags);
+    } else if (tcg_op_supported(INDEX_op_bswap16, TCG_TYPE_I64, 0)) {
+        tcg_gen_op3i_i64(INDEX_op_bswap16, ret, arg, flags);
     } else {
         TCGv_i64 t0 = tcg_temp_ebb_new_i64();
         TCGv_i64 t1 = tcg_temp_ebb_new_i64();
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 25834f40a0..ae68ce88b7 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1075,8 +1075,7 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_and, TCGOutOpBinary, outop_and),
     OUTOP(INDEX_op_andc, TCGOutOpBinary, outop_andc),
     OUTOP(INDEX_op_brcond, TCGOutOpBrcond, outop_brcond),
-    OUTOP(INDEX_op_bswap16_i32, TCGOutOpBswap, outop_bswap16),
-    OUTOP(INDEX_op_bswap16_i64, TCGOutOpBswap, outop_bswap16),
+    OUTOP(INDEX_op_bswap16, TCGOutOpBswap, outop_bswap16),
     OUTOP(INDEX_op_clz, TCGOutOpBinary, outop_clz),
     OUTOP(INDEX_op_ctpop, TCGOutOpUnary, outop_ctpop),
     OUTOP(INDEX_op_ctz, TCGOutOpBinary, outop_ctz),
@@ -2941,8 +2940,7 @@ void tcg_dump_ops(TCGContext *s, FILE *f, bool have_prefs)
                     i = 1;
                 }
                 break;
-            case INDEX_op_bswap16_i32:
-            case INDEX_op_bswap16_i64:
+            case INDEX_op_bswap16:
             case INDEX_op_bswap32_i32:
             case INDEX_op_bswap32_i64:
             case INDEX_op_bswap64_i64:
@@ -5489,8 +5487,7 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
         }
         break;
 
-    case INDEX_op_bswap16_i32:
-    case INDEX_op_bswap16_i64:
+    case INDEX_op_bswap16:
         {
             const TCGOutOpBswap *out =
                 container_of(all_outop[op->opc], TCGOutOpBswap, base);
diff --git a/tcg/tci.c b/tcg/tci.c
index ae447e91bd..905ca154fc 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -686,7 +686,7 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_write_reg64(regs, r1, r0, T1 - T2);
             break;
 #endif
-        CASE_32_64(bswap16)
+        case INDEX_op_bswap16:
             tci_args_rr(insn, &r0, &r1);
             regs[r0] = bswap16(regs[r1]);
             break;
@@ -1005,14 +1005,13 @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
                            op_name, str_r(r0), str_r(r1), s2);
         break;
 
+    case INDEX_op_bswap16:
     case INDEX_op_ctpop:
     case INDEX_op_mov:
     case INDEX_op_neg:
     case INDEX_op_not:
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
-    case INDEX_op_bswap16_i32:
-    case INDEX_op_bswap16_i64:
     case INDEX_op_bswap32_i32:
     case INDEX_op_bswap32_i64:
     case INDEX_op_bswap64_i64:
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index 2a8ba07e37..4d3d9569cc 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -905,7 +905,7 @@ static const TCGOutOpUnary outop_ctpop = {
 static void tgen_bswap16(TCGContext *s, TCGType type,
                          TCGReg a0, TCGReg a1, unsigned flags)
 {
-    tcg_out_op_rr(s, INDEX_op_bswap16_i32, a0, a1);
+    tcg_out_op_rr(s, INDEX_op_bswap16, a0, a1);
     if (flags & TCG_BSWAP_OS) {
         tcg_out_sextract(s, TCG_TYPE_REG, a0, a0, 0, 16);
     }

From d7b15a25a707f977e39af20c9f14a5ac4971c762 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 10 Jan 2025 19:49:20 -0800
Subject: [PATCH 0448/2760] tcg: Convert bswap32 to TCGOutOpBswap

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target-has.h     |  2 -
 tcg/aarch64/tcg-target.c.inc     | 25 +++++-----
 tcg/arm/tcg-target-has.h         |  1 -
 tcg/arm/tcg-target.c.inc         | 23 ++++-----
 tcg/i386/tcg-target-has.h        |  2 -
 tcg/i386/tcg-target.c.inc        | 23 +++++----
 tcg/loongarch64/tcg-target-has.h |  2 -
 tcg/loongarch64/tcg-target.c.inc | 33 +++++++------
 tcg/mips/tcg-target-has.h        |  2 -
 tcg/mips/tcg-target.c.inc        | 54 ++++++++++----------
 tcg/ppc/tcg-target-has.h         |  2 -
 tcg/ppc/tcg-target.c.inc         | 84 ++++++++++++++++----------------
 tcg/riscv/tcg-target-has.h       |  2 -
 tcg/riscv/tcg-target.c.inc       | 30 +++++++-----
 tcg/s390x/tcg-target-has.h       |  2 -
 tcg/s390x/tcg-target.c.inc       | 31 ++++++------
 tcg/sparc64/tcg-target-has.h     |  2 -
 tcg/sparc64/tcg-target.c.inc     |  4 ++
 tcg/tcg-has.h                    |  1 -
 tcg/tcg-op.c                     |  4 +-
 tcg/tcg.c                        |  8 +--
 tcg/tci.c                        |  2 -
 tcg/tci/tcg-target-has.h         |  2 -
 tcg/tci/tcg-target.c.inc         | 28 +++++------
 24 files changed, 182 insertions(+), 187 deletions(-)

diff --git a/tcg/aarch64/tcg-target-has.h b/tcg/aarch64/tcg-target-has.h
index 4797409467..7c3d3fc637 100644
--- a/tcg/aarch64/tcg-target-has.h
+++ b/tcg/aarch64/tcg-target-has.h
@@ -13,14 +13,12 @@
 #define have_lse2   (cpuinfo & CPUINFO_LSE2)
 
 /* optional instructions */
-#define TCG_TARGET_HAS_bswap32_i32      1
 #define TCG_TARGET_HAS_extract2_i32     1
 #define TCG_TARGET_HAS_add2_i32         1
 #define TCG_TARGET_HAS_sub2_i32         1
 #define TCG_TARGET_HAS_extr_i64_i32     0
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
-#define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1
 #define TCG_TARGET_HAS_extract2_i64     1
 #define TCG_TARGET_HAS_add2_i64         1
diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index 03961b34aa..a2e45ca5c8 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -2456,6 +2456,20 @@ static const TCGOutOpBswap outop_bswap16 = {
     .out_rr = tgen_bswap16,
 };
 
+static void tgen_bswap32(TCGContext *s, TCGType type,
+                         TCGReg a0, TCGReg a1, unsigned flags)
+{
+    tcg_out_rev(s, TCG_TYPE_I32, MO_32, a0, a1);
+    if (flags & TCG_BSWAP_OS) {
+        tcg_out_ext32s(s, a0, a0);
+    }
+}
+
+static const TCGOutOpBswap outop_bswap32 = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = tgen_bswap32,
+};
+
 static void tgen_neg(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1)
 {
     tgen_sub(s, type, a0, TCG_REG_XZR, a1);
@@ -2626,15 +2640,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType ext,
     case INDEX_op_bswap64_i64:
         tcg_out_rev(s, TCG_TYPE_I64, MO_64, a0, a1);
         break;
-    case INDEX_op_bswap32_i64:
-        tcg_out_rev(s, TCG_TYPE_I32, MO_32, a0, a1);
-        if (a2 & TCG_BSWAP_OS) {
-            tcg_out_ext32s(s, a0, a0);
-        }
-        break;
-    case INDEX_op_bswap32_i32:
-        tcg_out_rev(s, TCG_TYPE_I32, MO_32, a0, a1);
-        break;
 
     case INDEX_op_deposit_i64:
     case INDEX_op_deposit_i32:
@@ -3154,8 +3159,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld32u_i64:
     case INDEX_op_ld32s_i64:
     case INDEX_op_ld_i64:
-    case INDEX_op_bswap32_i32:
-    case INDEX_op_bswap32_i64:
     case INDEX_op_bswap64_i64:
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
diff --git a/tcg/arm/tcg-target-has.h b/tcg/arm/tcg-target-has.h
index 5972def558..c85b5da1e5 100644
--- a/tcg/arm/tcg-target-has.h
+++ b/tcg/arm/tcg-target-has.h
@@ -24,7 +24,6 @@ extern bool use_neon_instructions;
 #endif
 
 /* optional instructions */
-#define TCG_TARGET_HAS_bswap32_i32      1
 #define TCG_TARGET_HAS_extract2_i32     1
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index 6928f209d2..4ca23bb718 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -969,12 +969,6 @@ static void tcg_out_extrl_i64_i32(TCGContext *s, TCGReg rd, TCGReg rn)
     g_assert_not_reached();
 }
 
-static void tcg_out_bswap32(TCGContext *s, ARMCond cond, TCGReg rd, TCGReg rn)
-{
-    /* rev */
-    tcg_out32(s, 0x06bf0f30 | (cond << 28) | (rd << 12) | rn);
-}
-
 static void tcg_out_deposit(TCGContext *s, ARMCond cond, TCGReg rd,
                             TCGArg a1, int ofs, int len, bool const_a1)
 {
@@ -2157,6 +2151,18 @@ static const TCGOutOpBswap outop_bswap16 = {
     .out_rr = tgen_bswap16,
 };
 
+static void tgen_bswap32(TCGContext *s, TCGType type,
+                         TCGReg rd, TCGReg rn, unsigned flags)
+{
+    /* rev */
+    tcg_out32(s, 0x06bf0f30 | (COND_AL << 28) | (rd << 12) | rn);
+}
+
+static const TCGOutOpBswap outop_bswap32 = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = tgen_bswap32,
+};
+
 static void tgen_neg(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1)
 {
     tgen_subfi(s, type, a0, 0, a1);
@@ -2378,10 +2384,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_qemu_st(s, args[0], args[1], args[2], args[3], TCG_TYPE_I64);
         break;
 
-    case INDEX_op_bswap32_i32:
-        tcg_out_bswap32(s, COND_AL, args[0], args[1]);
-        break;
-
     case INDEX_op_deposit_i32:
         tcg_out_deposit(s, COND_AL, args[0], args[2],
                         args[3], args[4], const_args[2]);
@@ -2438,7 +2440,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld16u_i32:
     case INDEX_op_ld16s_i32:
     case INDEX_op_ld_i32:
-    case INDEX_op_bswap32_i32:
     case INDEX_op_extract_i32:
     case INDEX_op_sextract_i32:
         return C_O1_I1(r, r);
diff --git a/tcg/i386/tcg-target-has.h b/tcg/i386/tcg-target-has.h
index fd44ed8168..ca533ab5cf 100644
--- a/tcg/i386/tcg-target-has.h
+++ b/tcg/i386/tcg-target-has.h
@@ -26,7 +26,6 @@
 #define have_avx512vbmi2  ((cpuinfo & CPUINFO_AVX512VBMI2) && have_avx512vl)
 
 /* optional instructions */
-#define TCG_TARGET_HAS_bswap32_i32      1
 #define TCG_TARGET_HAS_extract2_i32     1
 #define TCG_TARGET_HAS_add2_i32         1
 #define TCG_TARGET_HAS_sub2_i32         1
@@ -34,7 +33,6 @@
 #if TCG_TARGET_REG_BITS == 64
 /* Keep 32-bit values zero-extended in a register.  */
 #define TCG_TARGET_HAS_extr_i64_i32     1
-#define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1
 #define TCG_TARGET_HAS_extract2_i64     1
 #define TCG_TARGET_HAS_add2_i64         1
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index c74a718cee..6d90666ba7 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -3090,6 +3090,20 @@ static const TCGOutOpBswap outop_bswap16 = {
     .out_rr = tgen_bswap16,
 };
 
+static void tgen_bswap32(TCGContext *s, TCGType type,
+                         TCGReg a0, TCGReg a1, unsigned flags)
+{
+    tcg_out_bswap32(s, a0);
+    if (flags & TCG_BSWAP_OS) {
+        tcg_out_ext32s(s, a0, a0);
+    }
+}
+
+static const TCGOutOpBswap outop_bswap32 = {
+    .base.static_constraint = C_O1_I1(r, 0),
+    .out_rr = tgen_bswap32,
+};
+
 static void tgen_neg(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1)
 {
     int rexw = type == TCG_TYPE_I32 ? 0 : P_REXW;
@@ -3193,13 +3207,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    OP_32_64(bswap32):
-        tcg_out_bswap32(s, a0);
-        if (rexw && (a2 & TCG_BSWAP_OS)) {
-            tcg_out_ext32s(s, a0, a0);
-        }
-        break;
-
     case INDEX_op_qemu_ld_i32:
         tcg_out_qemu_ld(s, a0, -1, a1, a2, TCG_TYPE_I32);
         break;
@@ -3972,8 +3979,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(re, r);
 
-    case INDEX_op_bswap32_i32:
-    case INDEX_op_bswap32_i64:
     case INDEX_op_bswap64_i64:
     case INDEX_op_extrh_i64_i32:
         return C_O1_I1(r, 0);
diff --git a/tcg/loongarch64/tcg-target-has.h b/tcg/loongarch64/tcg-target-has.h
index 11a93afd8b..e66df31954 100644
--- a/tcg/loongarch64/tcg-target-has.h
+++ b/tcg/loongarch64/tcg-target-has.h
@@ -13,13 +13,11 @@
 #define TCG_TARGET_HAS_extract2_i32     0
 #define TCG_TARGET_HAS_add2_i32         0
 #define TCG_TARGET_HAS_sub2_i32         0
-#define TCG_TARGET_HAS_bswap32_i32      1
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
 /* 64-bit operations */
 #define TCG_TARGET_HAS_extract2_i64     0
 #define TCG_TARGET_HAS_extr_i64_i32     1
-#define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1
 #define TCG_TARGET_HAS_add2_i64         0
 #define TCG_TARGET_HAS_sub2_i64         0
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index 8be6f69e3a..d4bcb06a5f 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -1751,6 +1751,24 @@ static const TCGOutOpBswap outop_bswap16 = {
     .out_rr = tgen_bswap16,
 };
 
+static void tgen_bswap32(TCGContext *s, TCGType type,
+                         TCGReg a0, TCGReg a1, unsigned flags)
+{
+    tcg_out_opc_revb_2w(s, a0, a1);
+
+    /* All 32-bit values are computed sign-extended in the register.  */
+    if (type == TCG_TYPE_I32 || (flags & TCG_BSWAP_OS)) {
+        tcg_out_ext32s(s, a0, a0);
+    } else if ((flags & (TCG_BSWAP_IZ | TCG_BSWAP_OZ)) == TCG_BSWAP_OZ) {
+        tcg_out_ext32u(s, a0, a0);
+    }
+}
+
+static const TCGOutOpBswap outop_bswap32 = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = tgen_bswap32,
+};
+
 static void tgen_neg(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1)
 {
     tgen_sub(s, type, a0, TCG_REG_ZERO, a1);
@@ -1842,19 +1860,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_opc_bstrins_d(s, a0, a2, args[3], args[3] + args[4] - 1);
         break;
 
-    case INDEX_op_bswap32_i32:
-        /* All 32-bit values are computed sign-extended in the register.  */
-        a2 = TCG_BSWAP_OS;
-        /* fallthrough */
-    case INDEX_op_bswap32_i64:
-        tcg_out_opc_revb_2w(s, a0, a1);
-        if (a2 & TCG_BSWAP_OS) {
-            tcg_out_ext32s(s, a0, a0);
-        } else if ((a2 & (TCG_BSWAP_IZ | TCG_BSWAP_OZ)) == TCG_BSWAP_OZ) {
-            tcg_out_ext32u(s, a0, a0);
-        }
-        break;
-
     case INDEX_op_bswap64_i64:
         tcg_out_opc_revb_d(s, a0, a1);
         break;
@@ -2454,8 +2459,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_extract_i64:
     case INDEX_op_sextract_i32:
     case INDEX_op_sextract_i64:
-    case INDEX_op_bswap32_i32:
-    case INDEX_op_bswap32_i64:
     case INDEX_op_bswap64_i64:
     case INDEX_op_ld8s_i32:
     case INDEX_op_ld8s_i64:
diff --git a/tcg/mips/tcg-target-has.h b/tcg/mips/tcg-target-has.h
index 6c967d9c9f..2391f5d8bf 100644
--- a/tcg/mips/tcg-target-has.h
+++ b/tcg/mips/tcg-target-has.h
@@ -39,7 +39,6 @@ extern bool use_mips32r2_instructions;
 #endif
 
 /* optional instructions */
-#define TCG_TARGET_HAS_bswap32_i32      1
 
 #if TCG_TARGET_REG_BITS == 64
 #define TCG_TARGET_HAS_add2_i32         0
@@ -56,7 +55,6 @@ extern bool use_mips32r2_instructions;
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
 #if TCG_TARGET_REG_BITS == 64
-#define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1
 #define TCG_TARGET_HAS_extract2_i64     0
 #endif
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index 258b49f9db..ab8f8c9994 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -710,26 +710,6 @@ static void tcg_out_bswap_subr(TCGContext *s, const tcg_insn_unit *sub)
     }
 }
 
-static void tcg_out_bswap32(TCGContext *s, TCGReg ret, TCGReg arg, int flags)
-{
-    if (use_mips32r2_instructions) {
-        tcg_out_opc_reg(s, OPC_WSBH, ret, 0, arg);
-        tcg_out_opc_sa(s, OPC_ROTR, ret, ret, 16);
-        if (flags & TCG_BSWAP_OZ) {
-            tcg_out_opc_bf(s, OPC_DEXT, ret, ret, 31, 0);
-        }
-    } else {
-        if (flags & TCG_BSWAP_OZ) {
-            tcg_out_bswap_subr(s, bswap32u_addr);
-        } else {
-            tcg_out_bswap_subr(s, bswap32_addr);
-        }
-        /* delay slot -- never omit the insn, like tcg_out_mov might.  */
-        tcg_out_opc_reg(s, OPC_OR, TCG_TMP0, arg, TCG_REG_ZERO);
-        tcg_out_mov(s, TCG_TYPE_I32, ret, TCG_TMP3);
-    }
-}
-
 static void tcg_out_bswap64(TCGContext *s, TCGReg ret, TCGReg arg)
 {
     if (use_mips32r2_instructions) {
@@ -2170,6 +2150,32 @@ static const TCGOutOpBswap outop_bswap16 = {
     .out_rr = tgen_bswap16,
 };
 
+static void tgen_bswap32(TCGContext *s, TCGType type,
+                         TCGReg ret, TCGReg arg, unsigned flags)
+{
+    if (use_mips32r2_instructions) {
+        tcg_out_opc_reg(s, OPC_WSBH, ret, 0, arg);
+        tcg_out_opc_sa(s, OPC_ROTR, ret, ret, 16);
+        if (flags & TCG_BSWAP_OZ) {
+            tcg_out_opc_bf(s, OPC_DEXT, ret, ret, 31, 0);
+        }
+    } else {
+        if (flags & TCG_BSWAP_OZ) {
+            tcg_out_bswap_subr(s, bswap32u_addr);
+        } else {
+            tcg_out_bswap_subr(s, bswap32_addr);
+        }
+        /* delay slot -- never omit the insn, like tcg_out_mov might.  */
+        tcg_out_opc_reg(s, OPC_OR, TCG_TMP0, arg, TCG_REG_ZERO);
+        tcg_out_mov(s, TCG_TYPE_I32, ret, TCG_TMP3);
+    }
+}
+
+static const TCGOutOpBswap outop_bswap32 = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = tgen_bswap32,
+};
+
 static void tgen_neg(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1)
 {
     tgen_sub(s, type, a0, TCG_REG_ZERO, a1);
@@ -2261,12 +2267,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_ldst(s, i1, a0, a1, a2);
         break;
 
-    case INDEX_op_bswap32_i32:
-        tcg_out_bswap32(s, a0, a1, 0);
-        break;
-    case INDEX_op_bswap32_i64:
-        tcg_out_bswap32(s, a0, a1, a2);
-        break;
     case INDEX_op_bswap64_i64:
         tcg_out_bswap64(s, a0, a1);
         break;
@@ -2371,7 +2371,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld16u_i32:
     case INDEX_op_ld16s_i32:
     case INDEX_op_ld_i32:
-    case INDEX_op_bswap32_i32:
     case INDEX_op_extract_i32:
     case INDEX_op_sextract_i32:
     case INDEX_op_ld8u_i64:
@@ -2381,7 +2380,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld32s_i64:
     case INDEX_op_ld32u_i64:
     case INDEX_op_ld_i64:
-    case INDEX_op_bswap32_i64:
     case INDEX_op_bswap64_i64:
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
diff --git a/tcg/ppc/tcg-target-has.h b/tcg/ppc/tcg-target-has.h
index b73fca9789..ad0885d635 100644
--- a/tcg/ppc/tcg-target-has.h
+++ b/tcg/ppc/tcg-target-has.h
@@ -17,7 +17,6 @@
 #define have_vsx       (cpuinfo & CPUINFO_VSX)
 
 /* optional instructions */
-#define TCG_TARGET_HAS_bswap32_i32      1
 #define TCG_TARGET_HAS_extract2_i32     0
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
@@ -25,7 +24,6 @@
 #define TCG_TARGET_HAS_add2_i32         0
 #define TCG_TARGET_HAS_sub2_i32         0
 #define TCG_TARGET_HAS_extr_i64_i32     0
-#define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1
 #define TCG_TARGET_HAS_extract2_i64     0
 #define TCG_TARGET_HAS_add2_i64         1
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index 3454254624..4527ed3eee 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -1012,41 +1012,6 @@ static void tcg_out_addpcis(TCGContext *s, TCGReg dst, intptr_t imm)
     tcg_out32(s, ADDPCIS | RT(dst) | (d1 << 16) | (d0 << 6) | d2);
 }
 
-static void tcg_out_bswap32(TCGContext *s, TCGReg dst, TCGReg src, int flags)
-{
-    TCGReg tmp = dst == src ? TCG_REG_R0 : dst;
-
-    if (have_isa_3_10) {
-        tcg_out32(s, BRW | RA(dst) | RS(src));
-        if (flags & TCG_BSWAP_OS) {
-            tcg_out_ext32s(s, dst, dst);
-        } else if ((flags & (TCG_BSWAP_IZ | TCG_BSWAP_OZ)) == TCG_BSWAP_OZ) {
-            tcg_out_ext32u(s, dst, dst);
-        }
-        return;
-    }
-
-    /*
-     * Stolen from gcc's builtin_bswap32.
-     * In the following,
-     *   dep(a, b, m) -> (a & ~m) | (b & m)
-     *
-     * Begin with:                              src = xxxxabcd
-     */
-    /* tmp = rol32(src, 8) & 0xffffffff             = 0000bcda */
-    tcg_out_rlw(s, RLWINM, tmp, src, 8, 0, 31);
-    /* tmp = dep(tmp, rol32(src, 24), 0xff000000)   = 0000dcda */
-    tcg_out_rlw(s, RLWIMI, tmp, src, 24, 0, 7);
-    /* tmp = dep(tmp, rol32(src, 24), 0x0000ff00)   = 0000dcba */
-    tcg_out_rlw(s, RLWIMI, tmp, src, 24, 16, 23);
-
-    if (flags & TCG_BSWAP_OS) {
-        tcg_out_ext32s(s, dst, tmp);
-    } else {
-        tcg_out_mov(s, TCG_TYPE_REG, dst, tmp);
-    }
-}
-
 static void tcg_out_bswap64(TCGContext *s, TCGReg dst, TCGReg src)
 {
     TCGReg t0 = dst == src ? TCG_REG_R0 : dst;
@@ -3384,6 +3349,47 @@ static const TCGOutOpBswap outop_bswap16 = {
     .out_rr = tgen_bswap16,
 };
 
+static void tgen_bswap32(TCGContext *s, TCGType type,
+                         TCGReg dst, TCGReg src, unsigned flags)
+{
+    TCGReg tmp = dst == src ? TCG_REG_R0 : dst;
+
+    if (have_isa_3_10) {
+        tcg_out32(s, BRW | RA(dst) | RS(src));
+        if (flags & TCG_BSWAP_OS) {
+            tcg_out_ext32s(s, dst, dst);
+        } else if ((flags & (TCG_BSWAP_IZ | TCG_BSWAP_OZ)) == TCG_BSWAP_OZ) {
+            tcg_out_ext32u(s, dst, dst);
+        }
+        return;
+    }
+
+    /*
+     * Stolen from gcc's builtin_bswap32.
+     * In the following,
+     *   dep(a, b, m) -> (a & ~m) | (b & m)
+     *
+     * Begin with:                              src = xxxxabcd
+     */
+    /* tmp = rol32(src, 8) & 0xffffffff             = 0000bcda */
+    tcg_out_rlw(s, RLWINM, tmp, src, 8, 0, 31);
+    /* tmp = dep(tmp, rol32(src, 24), 0xff000000)   = 0000dcda */
+    tcg_out_rlw(s, RLWIMI, tmp, src, 24, 0, 7);
+    /* tmp = dep(tmp, rol32(src, 24), 0x0000ff00)   = 0000dcba */
+    tcg_out_rlw(s, RLWIMI, tmp, src, 24, 16, 23);
+
+    if (flags & TCG_BSWAP_OS) {
+        tcg_out_ext32s(s, dst, tmp);
+    } else {
+        tcg_out_mov(s, TCG_TYPE_REG, dst, tmp);
+    }
+}
+
+static const TCGOutOpBswap outop_bswap32 = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = tgen_bswap32,
+};
+
 static void tgen_neg(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1)
 {
     tcg_out32(s, NEG | RT(a0) | RA(a1));
@@ -3506,12 +3512,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_qemu_ldst_i128(s, args[0], args[1], args[2], args[3], false);
         break;
 
-    case INDEX_op_bswap32_i32:
-        tcg_out_bswap32(s, args[0], args[1], 0);
-        break;
-    case INDEX_op_bswap32_i64:
-        tcg_out_bswap32(s, args[0], args[1], args[2]);
-        break;
     case INDEX_op_bswap64_i64:
         tcg_out_bswap64(s, args[0], args[1]);
         break;
@@ -4252,7 +4252,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld16u_i32:
     case INDEX_op_ld16s_i32:
     case INDEX_op_ld_i32:
-    case INDEX_op_bswap32_i32:
     case INDEX_op_extract_i32:
     case INDEX_op_sextract_i32:
     case INDEX_op_ld8u_i64:
@@ -4264,7 +4263,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld_i64:
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
-    case INDEX_op_bswap32_i64:
     case INDEX_op_bswap64_i64:
     case INDEX_op_extract_i64:
     case INDEX_op_sextract_i64:
diff --git a/tcg/riscv/tcg-target-has.h b/tcg/riscv/tcg-target-has.h
index 85bb5cd591..fbe294474a 100644
--- a/tcg/riscv/tcg-target-has.h
+++ b/tcg/riscv/tcg-target-has.h
@@ -13,12 +13,10 @@
 #define TCG_TARGET_HAS_extract2_i32     0
 #define TCG_TARGET_HAS_add2_i32         1
 #define TCG_TARGET_HAS_sub2_i32         1
-#define TCG_TARGET_HAS_bswap32_i32      (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
 #define TCG_TARGET_HAS_extract2_i64     0
 #define TCG_TARGET_HAS_extr_i64_i32     1
-#define TCG_TARGET_HAS_bswap32_i64      (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_bswap64_i64      (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_add2_i64         1
 #define TCG_TARGET_HAS_sub2_i64         1
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index c6cd2100f8..9b6ca54ae7 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -2424,6 +2424,23 @@ static const TCGOutOpBswap outop_bswap16 = {
     .out_rr = tgen_bswap16,
 };
 
+static void tgen_bswap32(TCGContext *s, TCGType type,
+                         TCGReg a0, TCGReg a1, unsigned flags)
+{
+    tcg_out_opc_imm(s, OPC_REV8, a0, a1, 0);
+    if (flags & TCG_BSWAP_OZ) {
+        tcg_out_opc_imm(s, OPC_SRLI, a0, a0, 32);
+    } else {
+        tcg_out_opc_imm(s, OPC_SRAI, a0, a0, 32);
+    }
+}
+
+static const TCGOutOpBswap outop_bswap32 = {
+    .base.static_constraint = C_Dynamic,
+    .base.dynamic_constraint = cset_bswap,
+    .out_rr = tgen_bswap32,
+};
+
 static void tgen_neg(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1)
 {
     tgen_sub(s, type, a0, TCG_REG_ZERO, a1);
@@ -2509,17 +2526,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     case INDEX_op_bswap64_i64:
         tcg_out_opc_imm(s, OPC_REV8, a0, a1, 0);
         break;
-    case INDEX_op_bswap32_i32:
-        a2 = 0;
-        /* fall through */
-    case INDEX_op_bswap32_i64:
-        tcg_out_opc_imm(s, OPC_REV8, a0, a1, 0);
-        if (a2 & TCG_BSWAP_OZ) {
-            tcg_out_opc_imm(s, OPC_SRLI, a0, a0, 32);
-        } else {
-            tcg_out_opc_imm(s, OPC_SRAI, a0, a0, 32);
-        }
-        break;
 
     case INDEX_op_add2_i32:
         tcg_out_addsub2(s, a0, a1, a2, args[3], args[4], args[5],
@@ -2858,8 +2864,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_extract_i64:
     case INDEX_op_sextract_i32:
     case INDEX_op_sextract_i64:
-    case INDEX_op_bswap32_i32:
-    case INDEX_op_bswap32_i64:
     case INDEX_op_bswap64_i64:
         return C_O1_I1(r, r);
 
diff --git a/tcg/s390x/tcg-target-has.h b/tcg/s390x/tcg-target-has.h
index 6cd92fa240..76cfe4f323 100644
--- a/tcg/s390x/tcg-target-has.h
+++ b/tcg/s390x/tcg-target-has.h
@@ -29,14 +29,12 @@ extern uint64_t s390_facilities[3];
     ((s390_facilities[FACILITY_##X / 64] >> (63 - FACILITY_##X % 64)) & 1)
 
 /* optional instructions */
-#define TCG_TARGET_HAS_bswap32_i32    1
 #define TCG_TARGET_HAS_extract2_i32   0
 #define TCG_TARGET_HAS_add2_i32       1
 #define TCG_TARGET_HAS_sub2_i32       1
 #define TCG_TARGET_HAS_extr_i64_i32   0
 #define TCG_TARGET_HAS_qemu_st8_i32   0
 
-#define TCG_TARGET_HAS_bswap32_i64    1
 #define TCG_TARGET_HAS_bswap64_i64    1
 #define TCG_TARGET_HAS_extract2_i64   0
 #define TCG_TARGET_HAS_add2_i64       1
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index e90c03628a..ed2da3f31d 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -2760,6 +2760,22 @@ static const TCGOutOpBswap outop_bswap16 = {
     .out_rr = tgen_bswap16,
 };
 
+static void tgen_bswap32(TCGContext *s, TCGType type,
+                         TCGReg a0, TCGReg a1, unsigned flags)
+{
+    tcg_out_insn(s, RRE, LRVR, a0, a1);
+    if (flags & TCG_BSWAP_OS) {
+        tcg_out_ext32s(s, a0, a0);
+    } else if ((flags & (TCG_BSWAP_IZ | TCG_BSWAP_OZ)) == TCG_BSWAP_OZ) {
+        tcg_out_ext32u(s, a0, a0);
+    }
+}
+
+static const TCGOutOpBswap outop_bswap32 = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = tgen_bswap32,
+};
+
 static void tgen_neg(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1)
 {
     if (type == TCG_TYPE_I32) {
@@ -2846,19 +2862,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_st(s, TCG_TYPE_I32, args[0], args[1], args[2]);
         break;
 
-    case INDEX_op_bswap32_i32:
-        tcg_out_insn(s, RRE, LRVR, args[0], args[1]);
-        break;
-    case INDEX_op_bswap32_i64:
-        a0 = args[0], a1 = args[1], a2 = args[2];
-        tcg_out_insn(s, RRE, LRVR, a0, a1);
-        if (a2 & TCG_BSWAP_OS) {
-            tcg_out_ext32s(s, a0, a0);
-        } else if ((a2 & (TCG_BSWAP_IZ | TCG_BSWAP_OZ)) == TCG_BSWAP_OZ) {
-            tcg_out_ext32u(s, a0, a0);
-        }
-        break;
-
     case INDEX_op_add2_i32:
         if (const_args[4]) {
             tcg_out_insn(s, RIL, ALFI, args[0], args[4]);
@@ -3459,8 +3462,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(r, r);
 
-    case INDEX_op_bswap32_i32:
-    case INDEX_op_bswap32_i64:
     case INDEX_op_bswap64_i64:
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
diff --git a/tcg/sparc64/tcg-target-has.h b/tcg/sparc64/tcg-target-has.h
index eb1e16c0e2..22837beca9 100644
--- a/tcg/sparc64/tcg-target-has.h
+++ b/tcg/sparc64/tcg-target-has.h
@@ -14,14 +14,12 @@ extern bool use_vis3_instructions;
 #endif
 
 /* optional instructions */
-#define TCG_TARGET_HAS_bswap32_i32      0
 #define TCG_TARGET_HAS_extract2_i32     0
 #define TCG_TARGET_HAS_add2_i32         1
 #define TCG_TARGET_HAS_sub2_i32         1
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
 #define TCG_TARGET_HAS_extr_i64_i32     0
-#define TCG_TARGET_HAS_bswap32_i64      0
 #define TCG_TARGET_HAS_bswap64_i64      0
 #define TCG_TARGET_HAS_extract2_i64     0
 #define TCG_TARGET_HAS_add2_i64         1
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index 5111f173e1..cbe9c759ec 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -1729,6 +1729,10 @@ static const TCGOutOpBswap outop_bswap16 = {
     .base.static_constraint = C_NotImplemented,
 };
 
+static const TCGOutOpBswap outop_bswap32 = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static void tgen_neg(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1)
 {
      tgen_sub(s, type, a0, TCG_REG_G0, a1);
diff --git a/tcg/tcg-has.h b/tcg/tcg-has.h
index 3d1c805d59..4034c73cca 100644
--- a/tcg/tcg-has.h
+++ b/tcg/tcg-has.h
@@ -12,7 +12,6 @@
 #if TCG_TARGET_REG_BITS == 32
 /* Turn some undef macros into false macros.  */
 #define TCG_TARGET_HAS_extr_i64_i32     0
-#define TCG_TARGET_HAS_bswap32_i64      0
 #define TCG_TARGET_HAS_bswap64_i64      0
 #define TCG_TARGET_HAS_extract2_i64     0
 #define TCG_TARGET_HAS_add2_i64         0
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index 917f52b04a..68e53a9c85 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -1294,7 +1294,7 @@ void tcg_gen_bswap16_i32(TCGv_i32 ret, TCGv_i32 arg, int flags)
  */
 void tcg_gen_bswap32_i32(TCGv_i32 ret, TCGv_i32 arg)
 {
-    if (TCG_TARGET_HAS_bswap32_i32) {
+    if (tcg_op_supported(INDEX_op_bswap32_i32, TCG_TYPE_I32, 0)) {
         tcg_gen_op3i_i32(INDEX_op_bswap32_i32, ret, arg, 0);
     } else {
         TCGv_i32 t0 = tcg_temp_ebb_new_i32();
@@ -2137,7 +2137,7 @@ void tcg_gen_bswap32_i64(TCGv_i64 ret, TCGv_i64 arg, int flags)
         } else {
             tcg_gen_movi_i32(TCGV_HIGH(ret), 0);
         }
-    } else if (TCG_TARGET_HAS_bswap32_i64) {
+    } else if (tcg_op_supported(INDEX_op_bswap32_i64, TCG_TYPE_I64, 0)) {
         tcg_gen_op3i_i64(INDEX_op_bswap32_i64, ret, arg, flags);
     } else {
         TCGv_i64 t0 = tcg_temp_ebb_new_i64();
diff --git a/tcg/tcg.c b/tcg/tcg.c
index ae68ce88b7..89ef2ef89c 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1076,6 +1076,8 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_andc, TCGOutOpBinary, outop_andc),
     OUTOP(INDEX_op_brcond, TCGOutOpBrcond, outop_brcond),
     OUTOP(INDEX_op_bswap16, TCGOutOpBswap, outop_bswap16),
+    OUTOP(INDEX_op_bswap32_i32, TCGOutOpBswap, outop_bswap32),
+    OUTOP(INDEX_op_bswap32_i64, TCGOutOpBswap, outop_bswap32),
     OUTOP(INDEX_op_clz, TCGOutOpBinary, outop_clz),
     OUTOP(INDEX_op_ctpop, TCGOutOpUnary, outop_ctpop),
     OUTOP(INDEX_op_ctz, TCGOutOpBinary, outop_ctz),
@@ -2342,8 +2344,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
         return TCG_TARGET_HAS_add2_i32;
     case INDEX_op_sub2_i32:
         return TCG_TARGET_HAS_sub2_i32;
-    case INDEX_op_bswap32_i32:
-        return TCG_TARGET_HAS_bswap32_i32;
 
     case INDEX_op_brcond2_i32:
     case INDEX_op_setcond2_i32:
@@ -2372,8 +2372,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_extrl_i64_i32:
     case INDEX_op_extrh_i64_i32:
         return TCG_TARGET_HAS_extr_i64_i32;
-    case INDEX_op_bswap32_i64:
-        return TCG_TARGET_HAS_bswap32_i64;
     case INDEX_op_bswap64_i64:
         return TCG_TARGET_HAS_bswap64_i64;
     case INDEX_op_add2_i64:
@@ -5488,6 +5486,8 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
         break;
 
     case INDEX_op_bswap16:
+    case INDEX_op_bswap32_i32:
+    case INDEX_op_bswap32_i64:
         {
             const TCGOutOpBswap *out =
                 container_of(all_outop[op->opc], TCGOutOpBswap, base);
diff --git a/tcg/tci.c b/tcg/tci.c
index 905ca154fc..0cb89f3256 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -690,12 +690,10 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_args_rr(insn, &r0, &r1);
             regs[r0] = bswap16(regs[r1]);
             break;
-#if TCG_TARGET_HAS_bswap32_i32 || TCG_TARGET_HAS_bswap32_i64
         CASE_32_64(bswap32)
             tci_args_rr(insn, &r0, &r1);
             regs[r0] = bswap32(regs[r1]);
             break;
-#endif
 #if TCG_TARGET_REG_BITS == 64
             /* Load/store operations (64 bit). */
 
diff --git a/tcg/tci/tcg-target-has.h b/tcg/tci/tcg-target-has.h
index d7228246ab..c5c64f4f5d 100644
--- a/tcg/tci/tcg-target-has.h
+++ b/tcg/tci/tcg-target-has.h
@@ -7,13 +7,11 @@
 #ifndef TCG_TARGET_HAS_H
 #define TCG_TARGET_HAS_H
 
-#define TCG_TARGET_HAS_bswap32_i32      1
 #define TCG_TARGET_HAS_extract2_i32     0
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
 #if TCG_TARGET_REG_BITS == 64
 #define TCG_TARGET_HAS_extr_i64_i32     0
-#define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1
 #define TCG_TARGET_HAS_extract2_i64     0
 #define TCG_TARGET_HAS_add2_i32         1
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index 4d3d9569cc..1b2f18e370 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -57,8 +57,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld_i64:
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
-    case INDEX_op_bswap32_i32:
-    case INDEX_op_bswap32_i64:
     case INDEX_op_bswap64_i64:
     case INDEX_op_extract_i32:
     case INDEX_op_extract_i64:
@@ -916,6 +914,20 @@ static const TCGOutOpBswap outop_bswap16 = {
     .out_rr = tgen_bswap16,
 };
 
+static void tgen_bswap32(TCGContext *s, TCGType type,
+                         TCGReg a0, TCGReg a1, unsigned flags)
+{
+    tcg_out_op_rr(s, INDEX_op_bswap32_i32, a0, a1);
+    if (flags & TCG_BSWAP_OS) {
+        tcg_out_sextract(s, TCG_TYPE_REG, a0, a0, 0, 32);
+    }
+}
+
+static const TCGOutOpBswap outop_bswap32 = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = tgen_bswap32,
+};
+
 static void tgen_neg(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1)
 {
     tcg_out_op_rr(s, INDEX_op_neg, a0, a1);
@@ -1026,8 +1038,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
                        const int const_args[TCG_MAX_OP_ARGS])
 {
-    int width;
-
     switch (opc) {
     case INDEX_op_goto_ptr:
         tcg_out_op_r(s, opc, args[0]);
@@ -1062,20 +1072,10 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_op_rrbb(s, opc, args[0], args[1], args[2], args[3]);
         break;
 
-    case INDEX_op_bswap32_i32: /* Optional (TCG_TARGET_HAS_bswap32_i32). */
     case INDEX_op_bswap64_i64: /* Optional (TCG_TARGET_HAS_bswap64_i64). */
         tcg_out_op_rr(s, opc, args[0], args[1]);
         break;
 
-    case INDEX_op_bswap32_i64: /* Optional (TCG_TARGET_HAS_bswap32_i64). */
-        width = 32;
-        /* The base tci bswaps zero-extend, and ignore high bits. */
-        tcg_out_op_rr(s, opc, args[0], args[1]);
-        if (args[2] & TCG_BSWAP_OS) {
-            tcg_out_sextract(s, TCG_TYPE_REG, args[0], args[0], 0, width);
-        }
-        break;
-
     CASE_32_64(add2)
     CASE_32_64(sub2)
         tcg_out_op_rrrrrr(s, opc, args[0], args[1], args[2],

From 7498d882cbe39ae7df4315ea006830e640f0d47b Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 10 Jan 2025 19:53:51 -0800
Subject: [PATCH 0449/2760] tcg: Merge INDEX_op_bswap32_{i32,i64}
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 docs/devel/tcg-ops.rst   | 13 ++++++-------
 include/tcg/tcg-opc.h    |  4 +---
 tcg/optimize.c           |  7 +++----
 tcg/tcg-op.c             |  8 ++++----
 tcg/tcg.c                |  9 +++------
 tcg/tci.c                |  5 ++---
 tcg/tci/tcg-target.c.inc |  2 +-
 7 files changed, 20 insertions(+), 28 deletions(-)

diff --git a/docs/devel/tcg-ops.rst b/docs/devel/tcg-ops.rst
index 509cfe7db1..e89ede54fa 100644
--- a/docs/devel/tcg-ops.rst
+++ b/docs/devel/tcg-ops.rst
@@ -425,16 +425,15 @@ Misc
        |
        | If neither ``TCG_BSWAP_OZ`` nor ``TCG_BSWAP_OS`` are set, then the bits of *t0* above bit 15 may contain any value.
 
-   * - bswap32_i64 *t0*, *t1*, *flags*
+   * - bswap32 *t0*, *t1*, *flags*
 
-     - | 32 bit byte swap on a 64-bit value.  The flags are the same as for bswap16,
-         except they apply from bit 31 instead of bit 15.
+     - | 32 bit byte swap.  The flags are the same as for bswap16, except
+         they apply from bit 31 instead of bit 15.  On TCG_TYPE_I32, the
+         flags should be zero.
 
-   * - bswap32_i32 *t0*, *t1*, *flags*
+   * - bswap64_i64 *t0*, *t1*, *flags*
 
-       bswap64_i64 *t0*, *t1*, *flags*
-
-     - | 32/64 bit byte swap. The flags are ignored, but still present
+     - | 64 bit byte swap. The flags are ignored, but still present
          for consistency with the other bswap opcodes.
 
    * - discard_i32/i64 *t0*
diff --git a/include/tcg/tcg-opc.h b/include/tcg/tcg-opc.h
index acfbaa05b4..296dffe99a 100644
--- a/include/tcg/tcg-opc.h
+++ b/include/tcg/tcg-opc.h
@@ -44,6 +44,7 @@ DEF(add, 1, 2, 0, TCG_OPF_INT)
 DEF(and, 1, 2, 0, TCG_OPF_INT)
 DEF(andc, 1, 2, 0, TCG_OPF_INT)
 DEF(bswap16, 1, 1, 1, TCG_OPF_INT)
+DEF(bswap32, 1, 1, 1, TCG_OPF_INT)
 DEF(clz, 1, 2, 0, TCG_OPF_INT)
 DEF(ctpop, 1, 1, 0, TCG_OPF_INT)
 DEF(ctz, 1, 2, 0, TCG_OPF_INT)
@@ -96,8 +97,6 @@ DEF(sub2_i32, 2, 4, 0, 0)
 DEF(brcond2_i32, 0, 4, 2, TCG_OPF_BB_END | TCG_OPF_COND_BRANCH)
 DEF(setcond2_i32, 1, 4, 1, 0)
 
-DEF(bswap32_i32, 1, 1, 1, 0)
-
 /* load/store */
 DEF(ld8u_i64, 1, 1, 1, 0)
 DEF(ld8s_i64, 1, 1, 1, 0)
@@ -122,7 +121,6 @@ DEF(extu_i32_i64, 1, 1, 0, 0)
 DEF(extrl_i64_i32, 1, 1, 0, 0)
 DEF(extrh_i64_i32, 1, 1, 0, 0)
 
-DEF(bswap32_i64, 1, 1, 1, 0)
 DEF(bswap64_i64, 1, 1, 1, 0)
 
 DEF(add2_i64, 2, 4, 0, 0)
diff --git a/tcg/optimize.c b/tcg/optimize.c
index 1d535a9fae..6fa968624d 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -522,7 +522,7 @@ static uint64_t do_constant_folding_2(TCGOpcode op, TCGType type,
         x = bswap16(x);
         return y & TCG_BSWAP_OS ? (int16_t)x : x;
 
-    CASE_OP_32_64(bswap32):
+    case INDEX_op_bswap32:
         x = bswap32(x);
         return y & TCG_BSWAP_OS ? (int32_t)x : x;
 
@@ -1576,8 +1576,7 @@ static bool fold_bswap(OptContext *ctx, TCGOp *op)
         z_mask = bswap16(z_mask);
         sign = INT16_MIN;
         break;
-    case INDEX_op_bswap32_i32:
-    case INDEX_op_bswap32_i64:
+    case INDEX_op_bswap32:
         z_mask = bswap32(z_mask);
         sign = INT32_MIN;
         break;
@@ -2870,7 +2869,7 @@ void tcg_optimize(TCGContext *s)
             done = fold_brcond2(&ctx, op);
             break;
         case INDEX_op_bswap16:
-        CASE_OP_32_64(bswap32):
+        case INDEX_op_bswap32:
         case INDEX_op_bswap64_i64:
             done = fold_bswap(&ctx, op);
             break;
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index 68e53a9c85..b1174f60cc 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -1294,8 +1294,8 @@ void tcg_gen_bswap16_i32(TCGv_i32 ret, TCGv_i32 arg, int flags)
  */
 void tcg_gen_bswap32_i32(TCGv_i32 ret, TCGv_i32 arg)
 {
-    if (tcg_op_supported(INDEX_op_bswap32_i32, TCG_TYPE_I32, 0)) {
-        tcg_gen_op3i_i32(INDEX_op_bswap32_i32, ret, arg, 0);
+    if (tcg_op_supported(INDEX_op_bswap32, TCG_TYPE_I32, 0)) {
+        tcg_gen_op3i_i32(INDEX_op_bswap32, ret, arg, 0);
     } else {
         TCGv_i32 t0 = tcg_temp_ebb_new_i32();
         TCGv_i32 t1 = tcg_temp_ebb_new_i32();
@@ -2137,8 +2137,8 @@ void tcg_gen_bswap32_i64(TCGv_i64 ret, TCGv_i64 arg, int flags)
         } else {
             tcg_gen_movi_i32(TCGV_HIGH(ret), 0);
         }
-    } else if (tcg_op_supported(INDEX_op_bswap32_i64, TCG_TYPE_I64, 0)) {
-        tcg_gen_op3i_i64(INDEX_op_bswap32_i64, ret, arg, flags);
+    } else if (tcg_op_supported(INDEX_op_bswap32, TCG_TYPE_I64, 0)) {
+        tcg_gen_op3i_i64(INDEX_op_bswap32, ret, arg, flags);
     } else {
         TCGv_i64 t0 = tcg_temp_ebb_new_i64();
         TCGv_i64 t1 = tcg_temp_ebb_new_i64();
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 89ef2ef89c..571f15626c 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1076,8 +1076,7 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_andc, TCGOutOpBinary, outop_andc),
     OUTOP(INDEX_op_brcond, TCGOutOpBrcond, outop_brcond),
     OUTOP(INDEX_op_bswap16, TCGOutOpBswap, outop_bswap16),
-    OUTOP(INDEX_op_bswap32_i32, TCGOutOpBswap, outop_bswap32),
-    OUTOP(INDEX_op_bswap32_i64, TCGOutOpBswap, outop_bswap32),
+    OUTOP(INDEX_op_bswap32, TCGOutOpBswap, outop_bswap32),
     OUTOP(INDEX_op_clz, TCGOutOpBinary, outop_clz),
     OUTOP(INDEX_op_ctpop, TCGOutOpUnary, outop_ctpop),
     OUTOP(INDEX_op_ctz, TCGOutOpBinary, outop_ctz),
@@ -2939,8 +2938,7 @@ void tcg_dump_ops(TCGContext *s, FILE *f, bool have_prefs)
                 }
                 break;
             case INDEX_op_bswap16:
-            case INDEX_op_bswap32_i32:
-            case INDEX_op_bswap32_i64:
+            case INDEX_op_bswap32:
             case INDEX_op_bswap64_i64:
                 {
                     TCGArg flags = op->args[k];
@@ -5486,8 +5484,7 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
         break;
 
     case INDEX_op_bswap16:
-    case INDEX_op_bswap32_i32:
-    case INDEX_op_bswap32_i64:
+    case INDEX_op_bswap32:
         {
             const TCGOutOpBswap *out =
                 container_of(all_outop[op->opc], TCGOutOpBswap, base);
diff --git a/tcg/tci.c b/tcg/tci.c
index 0cb89f3256..f98c437100 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -690,7 +690,7 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_args_rr(insn, &r0, &r1);
             regs[r0] = bswap16(regs[r1]);
             break;
-        CASE_32_64(bswap32)
+        case INDEX_op_bswap32:
             tci_args_rr(insn, &r0, &r1);
             regs[r0] = bswap32(regs[r1]);
             break;
@@ -1004,14 +1004,13 @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
         break;
 
     case INDEX_op_bswap16:
+    case INDEX_op_bswap32:
     case INDEX_op_ctpop:
     case INDEX_op_mov:
     case INDEX_op_neg:
     case INDEX_op_not:
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
-    case INDEX_op_bswap32_i32:
-    case INDEX_op_bswap32_i64:
     case INDEX_op_bswap64_i64:
         tci_args_rr(insn, &r0, &r1);
         info->fprintf_func(info->stream, "%-12s  %s, %s",
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index 1b2f18e370..7478ada393 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -917,7 +917,7 @@ static const TCGOutOpBswap outop_bswap16 = {
 static void tgen_bswap32(TCGContext *s, TCGType type,
                          TCGReg a0, TCGReg a1, unsigned flags)
 {
-    tcg_out_op_rr(s, INDEX_op_bswap32_i32, a0, a1);
+    tcg_out_op_rr(s, INDEX_op_bswap32, a0, a1);
     if (flags & TCG_BSWAP_OS) {
         tcg_out_sextract(s, TCG_TYPE_REG, a0, a0, 0, 32);
     }

From 613b571c93db4cec7d0023b857c1b857af7a3324 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 10 Jan 2025 21:46:38 -0800
Subject: [PATCH 0450/2760] tcg: Convert bswap64 to TCGOutOpUnary

Use TCGOutOpUnary instead of TCGOutOpBswap because the
flags are not used with this opcode; they are merely
present for uniformity with the smaller bswaps.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target-has.h     |  1 -
 tcg/aarch64/tcg-target.c.inc     | 15 ++++--
 tcg/arm/tcg-target.c.inc         |  4 ++
 tcg/i386/tcg-target-has.h        |  1 -
 tcg/i386/tcg-target.c.inc        | 16 ++++--
 tcg/loongarch64/tcg-target-has.h |  1 -
 tcg/loongarch64/tcg-target.c.inc | 15 ++++--
 tcg/mips/tcg-target-has.h        |  1 -
 tcg/mips/tcg-target.c.inc        | 37 ++++++++------
 tcg/ppc/tcg-target-has.h         |  1 -
 tcg/ppc/tcg-target.c.inc         | 88 ++++++++++++++++----------------
 tcg/riscv/tcg-target-has.h       |  1 -
 tcg/riscv/tcg-target.c.inc       | 16 ++++--
 tcg/s390x/tcg-target-has.h       |  1 -
 tcg/s390x/tcg-target.c.inc       | 15 ++++--
 tcg/sparc64/tcg-target-has.h     |  1 -
 tcg/sparc64/tcg-target.c.inc     |  4 ++
 tcg/tcg-has.h                    |  1 -
 tcg/tcg-op.c                     |  2 +-
 tcg/tcg.c                        |  7 ++-
 tcg/tci.c                        |  2 -
 tcg/tci/tcg-target-has.h         |  1 -
 tcg/tci/tcg-target.c.inc         | 17 ++++--
 23 files changed, 144 insertions(+), 104 deletions(-)

diff --git a/tcg/aarch64/tcg-target-has.h b/tcg/aarch64/tcg-target-has.h
index 7c3d3fc637..82d8cd5965 100644
--- a/tcg/aarch64/tcg-target-has.h
+++ b/tcg/aarch64/tcg-target-has.h
@@ -19,7 +19,6 @@
 #define TCG_TARGET_HAS_extr_i64_i32     0
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
-#define TCG_TARGET_HAS_bswap64_i64      1
 #define TCG_TARGET_HAS_extract2_i64     1
 #define TCG_TARGET_HAS_add2_i64         1
 #define TCG_TARGET_HAS_sub2_i64         1
diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index a2e45ca5c8..79c0e2e097 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -2470,6 +2470,16 @@ static const TCGOutOpBswap outop_bswap32 = {
     .out_rr = tgen_bswap32,
 };
 
+static void tgen_bswap64(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1)
+{
+    tcg_out_rev(s, TCG_TYPE_I64, MO_64, a0, a1);
+}
+
+static const TCGOutOpUnary outop_bswap64 = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = tgen_bswap64,
+};
+
 static void tgen_neg(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1)
 {
     tgen_sub(s, type, a0, TCG_REG_XZR, a1);
@@ -2637,10 +2647,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType ext,
         tcg_out_qemu_ldst_i128(s, a0, a1, a2, args[3], false);
         break;
 
-    case INDEX_op_bswap64_i64:
-        tcg_out_rev(s, TCG_TYPE_I64, MO_64, a0, a1);
-        break;
-
     case INDEX_op_deposit_i64:
     case INDEX_op_deposit_i32:
         tcg_out_dep(s, ext, a0, a2, args[3], args[4]);
@@ -3159,7 +3165,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld32u_i64:
     case INDEX_op_ld32s_i64:
     case INDEX_op_ld_i64:
-    case INDEX_op_bswap64_i64:
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
     case INDEX_op_extract_i32:
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index 4ca23bb718..3bbc28c63c 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -2163,6 +2163,10 @@ static const TCGOutOpBswap outop_bswap32 = {
     .out_rr = tgen_bswap32,
 };
 
+static const TCGOutOpUnary outop_bswap64 = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static void tgen_neg(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1)
 {
     tgen_subfi(s, type, a0, 0, a1);
diff --git a/tcg/i386/tcg-target-has.h b/tcg/i386/tcg-target-has.h
index ca533ab5cf..6b91b23fe8 100644
--- a/tcg/i386/tcg-target-has.h
+++ b/tcg/i386/tcg-target-has.h
@@ -33,7 +33,6 @@
 #if TCG_TARGET_REG_BITS == 64
 /* Keep 32-bit values zero-extended in a register.  */
 #define TCG_TARGET_HAS_extr_i64_i32     1
-#define TCG_TARGET_HAS_bswap64_i64      1
 #define TCG_TARGET_HAS_extract2_i64     1
 #define TCG_TARGET_HAS_add2_i64         1
 #define TCG_TARGET_HAS_sub2_i64         1
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index 6d90666ba7..347e01c076 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -3104,6 +3104,18 @@ static const TCGOutOpBswap outop_bswap32 = {
     .out_rr = tgen_bswap32,
 };
 
+#if TCG_TARGET_REG_BITS == 64
+static void tgen_bswap64(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1)
+{
+    tcg_out_bswap64(s, a0);
+}
+
+static const TCGOutOpUnary outop_bswap64 = {
+    .base.static_constraint = C_O1_I1(r, 0),
+    .out_rr = tgen_bswap64,
+};
+#endif
+
 static void tgen_neg(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1)
 {
     int rexw = type == TCG_TYPE_I32 ? 0 : P_REXW;
@@ -3279,9 +3291,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    case INDEX_op_bswap64_i64:
-        tcg_out_bswap64(s, a0);
-        break;
     case INDEX_op_extrh_i64_i32:
         tcg_out_shifti(s, SHIFT_SHR + P_REXW, a0, 32);
         break;
@@ -3979,7 +3988,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(re, r);
 
-    case INDEX_op_bswap64_i64:
     case INDEX_op_extrh_i64_i32:
         return C_O1_I1(r, 0);
 
diff --git a/tcg/loongarch64/tcg-target-has.h b/tcg/loongarch64/tcg-target-has.h
index e66df31954..10090102f7 100644
--- a/tcg/loongarch64/tcg-target-has.h
+++ b/tcg/loongarch64/tcg-target-has.h
@@ -18,7 +18,6 @@
 /* 64-bit operations */
 #define TCG_TARGET_HAS_extract2_i64     0
 #define TCG_TARGET_HAS_extr_i64_i32     1
-#define TCG_TARGET_HAS_bswap64_i64      1
 #define TCG_TARGET_HAS_add2_i64         0
 #define TCG_TARGET_HAS_sub2_i64         0
 
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index d4bcb06a5f..f3b2f709d2 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -1769,6 +1769,16 @@ static const TCGOutOpBswap outop_bswap32 = {
     .out_rr = tgen_bswap32,
 };
 
+static void tgen_bswap64(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1)
+{
+    tcg_out_opc_revb_d(s, a0, a1);
+}
+
+static const TCGOutOpUnary outop_bswap64 = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = tgen_bswap64,
+};
+
 static void tgen_neg(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1)
 {
     tgen_sub(s, type, a0, TCG_REG_ZERO, a1);
@@ -1860,10 +1870,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_opc_bstrins_d(s, a0, a2, args[3], args[3] + args[4] - 1);
         break;
 
-    case INDEX_op_bswap64_i64:
-        tcg_out_opc_revb_d(s, a0, a1);
-        break;
-
     case INDEX_op_ld8s_i32:
     case INDEX_op_ld8s_i64:
         tcg_out_ldst(s, OPC_LD_B, a0, a1, a2);
@@ -2459,7 +2465,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_extract_i64:
     case INDEX_op_sextract_i32:
     case INDEX_op_sextract_i64:
-    case INDEX_op_bswap64_i64:
     case INDEX_op_ld8s_i32:
     case INDEX_op_ld8s_i64:
     case INDEX_op_ld8u_i32:
diff --git a/tcg/mips/tcg-target-has.h b/tcg/mips/tcg-target-has.h
index 2391f5d8bf..24b00f1eec 100644
--- a/tcg/mips/tcg-target-has.h
+++ b/tcg/mips/tcg-target-has.h
@@ -55,7 +55,6 @@ extern bool use_mips32r2_instructions;
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
 #if TCG_TARGET_REG_BITS == 64
-#define TCG_TARGET_HAS_bswap64_i64      1
 #define TCG_TARGET_HAS_extract2_i64     0
 #endif
 
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index ab8f8c9994..baaf0e416b 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -710,19 +710,6 @@ static void tcg_out_bswap_subr(TCGContext *s, const tcg_insn_unit *sub)
     }
 }
 
-static void tcg_out_bswap64(TCGContext *s, TCGReg ret, TCGReg arg)
-{
-    if (use_mips32r2_instructions) {
-        tcg_out_opc_reg(s, OPC_DSBH, ret, 0, arg);
-        tcg_out_opc_reg(s, OPC_DSHD, ret, 0, ret);
-    } else {
-        tcg_out_bswap_subr(s, bswap64_addr);
-        /* delay slot -- never omit the insn, like tcg_out_mov might.  */
-        tcg_out_opc_reg(s, OPC_OR, TCG_TMP0, arg, TCG_REG_ZERO);
-        tcg_out_mov(s, TCG_TYPE_I32, ret, TCG_TMP3);
-    }
-}
-
 static void tcg_out_ext32u(TCGContext *s, TCGReg ret, TCGReg arg)
 {
     tcg_debug_assert(TCG_TARGET_REG_BITS == 64);
@@ -2176,6 +2163,26 @@ static const TCGOutOpBswap outop_bswap32 = {
     .out_rr = tgen_bswap32,
 };
 
+#if TCG_TARGET_REG_BITS == 64
+static void tgen_bswap64(TCGContext *s, TCGType type, TCGReg ret, TCGReg arg)
+{
+    if (use_mips32r2_instructions) {
+        tcg_out_opc_reg(s, OPC_DSBH, ret, 0, arg);
+        tcg_out_opc_reg(s, OPC_DSHD, ret, 0, ret);
+    } else {
+        tcg_out_bswap_subr(s, bswap64_addr);
+        /* delay slot -- never omit the insn, like tcg_out_mov might.  */
+        tcg_out_opc_reg(s, OPC_OR, TCG_TMP0, arg, TCG_REG_ZERO);
+        tcg_out_mov(s, TCG_TYPE_I32, ret, TCG_TMP3);
+    }
+}
+
+static const TCGOutOpUnary outop_bswap64 = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = tgen_bswap64,
+};
+#endif /* TCG_TARGET_REG_BITS == 64 */
+
 static void tgen_neg(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1)
 {
     tgen_sub(s, type, a0, TCG_REG_ZERO, a1);
@@ -2267,9 +2274,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_ldst(s, i1, a0, a1, a2);
         break;
 
-    case INDEX_op_bswap64_i64:
-        tcg_out_bswap64(s, a0, a1);
-        break;
     case INDEX_op_extrh_i64_i32:
         tcg_out_dsra(s, a0, a1, 32);
         break;
@@ -2380,7 +2384,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld32s_i64:
     case INDEX_op_ld32u_i64:
     case INDEX_op_ld_i64:
-    case INDEX_op_bswap64_i64:
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
     case INDEX_op_extrl_i64_i32:
diff --git a/tcg/ppc/tcg-target-has.h b/tcg/ppc/tcg-target-has.h
index ad0885d635..bd9c3d92ed 100644
--- a/tcg/ppc/tcg-target-has.h
+++ b/tcg/ppc/tcg-target-has.h
@@ -24,7 +24,6 @@
 #define TCG_TARGET_HAS_add2_i32         0
 #define TCG_TARGET_HAS_sub2_i32         0
 #define TCG_TARGET_HAS_extr_i64_i32     0
-#define TCG_TARGET_HAS_bswap64_i64      1
 #define TCG_TARGET_HAS_extract2_i64     0
 #define TCG_TARGET_HAS_add2_i64         1
 #define TCG_TARGET_HAS_sub2_i64         1
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index 4527ed3eee..083137d211 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -1012,44 +1012,6 @@ static void tcg_out_addpcis(TCGContext *s, TCGReg dst, intptr_t imm)
     tcg_out32(s, ADDPCIS | RT(dst) | (d1 << 16) | (d0 << 6) | d2);
 }
 
-static void tcg_out_bswap64(TCGContext *s, TCGReg dst, TCGReg src)
-{
-    TCGReg t0 = dst == src ? TCG_REG_R0 : dst;
-    TCGReg t1 = dst == src ? dst : TCG_REG_R0;
-
-    if (have_isa_3_10) {
-        tcg_out32(s, BRD | RA(dst) | RS(src));
-        return;
-    }
-
-    /*
-     * In the following,
-     *   dep(a, b, m) -> (a & ~m) | (b & m)
-     *
-     * Begin with:                              src = abcdefgh
-     */
-    /* t0 = rol32(src, 8) & 0xffffffff              = 0000fghe */
-    tcg_out_rlw(s, RLWINM, t0, src, 8, 0, 31);
-    /* t0 = dep(t0, rol32(src, 24), 0xff000000)     = 0000hghe */
-    tcg_out_rlw(s, RLWIMI, t0, src, 24, 0, 7);
-    /* t0 = dep(t0, rol32(src, 24), 0x0000ff00)     = 0000hgfe */
-    tcg_out_rlw(s, RLWIMI, t0, src, 24, 16, 23);
-
-    /* t0 = rol64(t0, 32)                           = hgfe0000 */
-    tcg_out_rld(s, RLDICL, t0, t0, 32, 0);
-    /* t1 = rol64(src, 32)                          = efghabcd */
-    tcg_out_rld(s, RLDICL, t1, src, 32, 0);
-
-    /* t0 = dep(t0, rol32(t1, 24), 0xffffffff)      = hgfebcda */
-    tcg_out_rlw(s, RLWIMI, t0, t1, 8, 0, 31);
-    /* t0 = dep(t0, rol32(t1, 24), 0xff000000)      = hgfedcda */
-    tcg_out_rlw(s, RLWIMI, t0, t1, 24, 0, 7);
-    /* t0 = dep(t0, rol32(t1, 24), 0x0000ff00)      = hgfedcba */
-    tcg_out_rlw(s, RLWIMI, t0, t1, 24, 16, 23);
-
-    tcg_out_mov(s, TCG_TYPE_REG, dst, t0);
-}
-
 /* Emit a move into ret of arg, if it can be done in one insn.  */
 static bool tcg_out_movi_one(TCGContext *s, TCGReg ret, tcg_target_long arg)
 {
@@ -3390,6 +3352,51 @@ static const TCGOutOpBswap outop_bswap32 = {
     .out_rr = tgen_bswap32,
 };
 
+#if TCG_TARGET_REG_BITS == 64
+static void tgen_bswap64(TCGContext *s, TCGType type, TCGReg dst, TCGReg src)
+{
+    TCGReg t0 = dst == src ? TCG_REG_R0 : dst;
+    TCGReg t1 = dst == src ? dst : TCG_REG_R0;
+
+    if (have_isa_3_10) {
+        tcg_out32(s, BRD | RA(dst) | RS(src));
+        return;
+    }
+
+    /*
+     * In the following,
+     *   dep(a, b, m) -> (a & ~m) | (b & m)
+     *
+     * Begin with:                              src = abcdefgh
+     */
+    /* t0 = rol32(src, 8) & 0xffffffff              = 0000fghe */
+    tcg_out_rlw(s, RLWINM, t0, src, 8, 0, 31);
+    /* t0 = dep(t0, rol32(src, 24), 0xff000000)     = 0000hghe */
+    tcg_out_rlw(s, RLWIMI, t0, src, 24, 0, 7);
+    /* t0 = dep(t0, rol32(src, 24), 0x0000ff00)     = 0000hgfe */
+    tcg_out_rlw(s, RLWIMI, t0, src, 24, 16, 23);
+
+    /* t0 = rol64(t0, 32)                           = hgfe0000 */
+    tcg_out_rld(s, RLDICL, t0, t0, 32, 0);
+    /* t1 = rol64(src, 32)                          = efghabcd */
+    tcg_out_rld(s, RLDICL, t1, src, 32, 0);
+
+    /* t0 = dep(t0, rol32(t1, 24), 0xffffffff)      = hgfebcda */
+    tcg_out_rlw(s, RLWIMI, t0, t1, 8, 0, 31);
+    /* t0 = dep(t0, rol32(t1, 24), 0xff000000)      = hgfedcda */
+    tcg_out_rlw(s, RLWIMI, t0, t1, 24, 0, 7);
+    /* t0 = dep(t0, rol32(t1, 24), 0x0000ff00)      = hgfedcba */
+    tcg_out_rlw(s, RLWIMI, t0, t1, 24, 16, 23);
+
+    tcg_out_mov(s, TCG_TYPE_REG, dst, t0);
+}
+
+static const TCGOutOpUnary outop_bswap64 = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = tgen_bswap64,
+};
+#endif /* TCG_TARGET_REG_BITS == 64 */
+
 static void tgen_neg(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1)
 {
     tcg_out32(s, NEG | RT(a0) | RA(a1));
@@ -3512,10 +3519,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_qemu_ldst_i128(s, args[0], args[1], args[2], args[3], false);
         break;
 
-    case INDEX_op_bswap64_i64:
-        tcg_out_bswap64(s, args[0], args[1]);
-        break;
-
     case INDEX_op_deposit_i32:
         if (const_args[2]) {
             uint32_t mask = ((2u << (args[4] - 1)) - 1) << args[3];
@@ -4263,7 +4266,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld_i64:
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
-    case INDEX_op_bswap64_i64:
     case INDEX_op_extract_i64:
     case INDEX_op_sextract_i64:
         return C_O1_I1(r, r);
diff --git a/tcg/riscv/tcg-target-has.h b/tcg/riscv/tcg-target-has.h
index fbe294474a..88fadc2428 100644
--- a/tcg/riscv/tcg-target-has.h
+++ b/tcg/riscv/tcg-target-has.h
@@ -17,7 +17,6 @@
 
 #define TCG_TARGET_HAS_extract2_i64     0
 #define TCG_TARGET_HAS_extr_i64_i32     1
-#define TCG_TARGET_HAS_bswap64_i64      (cpuinfo & CPUINFO_ZBB)
 #define TCG_TARGET_HAS_add2_i64         1
 #define TCG_TARGET_HAS_sub2_i64         1
 
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index 9b6ca54ae7..00b097d171 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -2441,6 +2441,17 @@ static const TCGOutOpBswap outop_bswap32 = {
     .out_rr = tgen_bswap32,
 };
 
+static void tgen_bswap64(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1)
+{
+    tcg_out_opc_imm(s, OPC_REV8, a0, a1, 0);
+}
+
+static const TCGOutOpUnary outop_bswap64 = {
+    .base.static_constraint = C_Dynamic,
+    .base.dynamic_constraint = cset_bswap,
+    .out_rr = tgen_bswap64,
+};
+
 static void tgen_neg(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1)
 {
     tgen_sub(s, type, a0, TCG_REG_ZERO, a1);
@@ -2523,10 +2534,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_ldst(s, OPC_SD, a0, a1, a2);
         break;
 
-    case INDEX_op_bswap64_i64:
-        tcg_out_opc_imm(s, OPC_REV8, a0, a1, 0);
-        break;
-
     case INDEX_op_add2_i32:
         tcg_out_addsub2(s, a0, a1, a2, args[3], args[4], args[5],
                         const_args[4], const_args[5], false, true);
@@ -2864,7 +2871,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_extract_i64:
     case INDEX_op_sextract_i32:
     case INDEX_op_sextract_i64:
-    case INDEX_op_bswap64_i64:
         return C_O1_I1(r, r);
 
     case INDEX_op_st8_i32:
diff --git a/tcg/s390x/tcg-target-has.h b/tcg/s390x/tcg-target-has.h
index 76cfe4f323..95407f61cf 100644
--- a/tcg/s390x/tcg-target-has.h
+++ b/tcg/s390x/tcg-target-has.h
@@ -35,7 +35,6 @@ extern uint64_t s390_facilities[3];
 #define TCG_TARGET_HAS_extr_i64_i32   0
 #define TCG_TARGET_HAS_qemu_st8_i32   0
 
-#define TCG_TARGET_HAS_bswap64_i64    1
 #define TCG_TARGET_HAS_extract2_i64   0
 #define TCG_TARGET_HAS_add2_i64       1
 #define TCG_TARGET_HAS_sub2_i64       1
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index ed2da3f31d..2ed288cfe0 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -2776,6 +2776,16 @@ static const TCGOutOpBswap outop_bswap32 = {
     .out_rr = tgen_bswap32,
 };
 
+static void tgen_bswap64(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1)
+{
+    tcg_out_insn(s, RRE, LRVGR, a0, a1);
+}
+
+static const TCGOutOpUnary outop_bswap64 = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = tgen_bswap64,
+};
+
 static void tgen_neg(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1)
 {
     if (type == TCG_TYPE_I32) {
@@ -2922,10 +2932,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_st(s, TCG_TYPE_I64, args[0], args[1], args[2]);
         break;
 
-    case INDEX_op_bswap64_i64:
-        tcg_out_insn(s, RRE, LRVGR, args[0], args[1]);
-        break;
-
     case INDEX_op_add2_i64:
         if (const_args[4]) {
             if ((int64_t)args[4] >= 0) {
@@ -3462,7 +3468,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(r, r);
 
-    case INDEX_op_bswap64_i64:
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
     case INDEX_op_extract_i32:
diff --git a/tcg/sparc64/tcg-target-has.h b/tcg/sparc64/tcg-target-has.h
index 22837beca9..2ced6f7c1c 100644
--- a/tcg/sparc64/tcg-target-has.h
+++ b/tcg/sparc64/tcg-target-has.h
@@ -20,7 +20,6 @@ extern bool use_vis3_instructions;
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
 #define TCG_TARGET_HAS_extr_i64_i32     0
-#define TCG_TARGET_HAS_bswap64_i64      0
 #define TCG_TARGET_HAS_extract2_i64     0
 #define TCG_TARGET_HAS_add2_i64         1
 #define TCG_TARGET_HAS_sub2_i64         1
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index cbe9c759ec..96ffba9af6 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -1733,6 +1733,10 @@ static const TCGOutOpBswap outop_bswap32 = {
     .base.static_constraint = C_NotImplemented,
 };
 
+static const TCGOutOpUnary outop_bswap64 = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static void tgen_neg(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1)
 {
      tgen_sub(s, type, a0, TCG_REG_G0, a1);
diff --git a/tcg/tcg-has.h b/tcg/tcg-has.h
index 4034c73cca..21bef070fe 100644
--- a/tcg/tcg-has.h
+++ b/tcg/tcg-has.h
@@ -12,7 +12,6 @@
 #if TCG_TARGET_REG_BITS == 32
 /* Turn some undef macros into false macros.  */
 #define TCG_TARGET_HAS_extr_i64_i32     0
-#define TCG_TARGET_HAS_bswap64_i64      0
 #define TCG_TARGET_HAS_extract2_i64     0
 #define TCG_TARGET_HAS_add2_i64         0
 #define TCG_TARGET_HAS_sub2_i64         0
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index b1174f60cc..27e700161f 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -2184,7 +2184,7 @@ void tcg_gen_bswap64_i64(TCGv_i64 ret, TCGv_i64 arg)
         tcg_gen_mov_i32(TCGV_HIGH(ret), t0);
         tcg_temp_free_i32(t0);
         tcg_temp_free_i32(t1);
-    } else if (TCG_TARGET_HAS_bswap64_i64) {
+    } else if (tcg_op_supported(INDEX_op_bswap64_i64, TCG_TYPE_I64, 0)) {
         tcg_gen_op3i_i64(INDEX_op_bswap64_i64, ret, arg, 0);
     } else {
         TCGv_i64 t0 = tcg_temp_ebb_new_i64();
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 571f15626c..f2f2c0dd74 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1112,6 +1112,8 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
 #if TCG_TARGET_REG_BITS == 32
     OUTOP(INDEX_op_brcond2_i32, TCGOutOpBrcond2, outop_brcond2),
     OUTOP(INDEX_op_setcond2_i32, TCGOutOpSetcond2, outop_setcond2),
+#else
+    OUTOP(INDEX_op_bswap64_i64, TCGOutOpUnary, outop_bswap64),
 #endif
 };
 
@@ -2371,8 +2373,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_extrl_i64_i32:
     case INDEX_op_extrh_i64_i32:
         return TCG_TARGET_HAS_extr_i64_i32;
-    case INDEX_op_bswap64_i64:
-        return TCG_TARGET_HAS_bswap64_i64;
     case INDEX_op_add2_i64:
         return TCG_TARGET_HAS_add2_i64;
     case INDEX_op_sub2_i64:
@@ -5470,6 +5470,9 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
         }
         break;
 
+    case INDEX_op_bswap64_i64:
+        assert(TCG_TARGET_REG_BITS == 64);
+        /* fall through */
     case INDEX_op_ctpop:
     case INDEX_op_neg:
     case INDEX_op_not:
diff --git a/tcg/tci.c b/tcg/tci.c
index f98c437100..903f996f02 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -788,12 +788,10 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_args_rr(insn, &r0, &r1);
             regs[r0] = (uint32_t)regs[r1];
             break;
-#if TCG_TARGET_HAS_bswap64_i64
         case INDEX_op_bswap64_i64:
             tci_args_rr(insn, &r0, &r1);
             regs[r0] = bswap64(regs[r1]);
             break;
-#endif
 #endif /* TCG_TARGET_REG_BITS == 64 */
 
             /* QEMU specific operations. */
diff --git a/tcg/tci/tcg-target-has.h b/tcg/tci/tcg-target-has.h
index c5c64f4f5d..90aa5c8bbb 100644
--- a/tcg/tci/tcg-target-has.h
+++ b/tcg/tci/tcg-target-has.h
@@ -12,7 +12,6 @@
 
 #if TCG_TARGET_REG_BITS == 64
 #define TCG_TARGET_HAS_extr_i64_i32     0
-#define TCG_TARGET_HAS_bswap64_i64      1
 #define TCG_TARGET_HAS_extract2_i64     0
 #define TCG_TARGET_HAS_add2_i32         1
 #define TCG_TARGET_HAS_sub2_i32         1
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index 7478ada393..cbfe92adf3 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -57,7 +57,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld_i64:
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
-    case INDEX_op_bswap64_i64:
     case INDEX_op_extract_i32:
     case INDEX_op_extract_i64:
     case INDEX_op_sextract_i32:
@@ -928,6 +927,18 @@ static const TCGOutOpBswap outop_bswap32 = {
     .out_rr = tgen_bswap32,
 };
 
+#if TCG_TARGET_REG_BITS == 64
+static void tgen_bswap64(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1)
+{
+    tcg_out_op_rr(s, INDEX_op_bswap64_i64, a0, a1);
+}
+
+static const TCGOutOpUnary outop_bswap64 = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = tgen_bswap64,
+};
+#endif
+
 static void tgen_neg(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1)
 {
     tcg_out_op_rr(s, INDEX_op_neg, a0, a1);
@@ -1072,10 +1083,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_op_rrbb(s, opc, args[0], args[1], args[2], args[3]);
         break;
 
-    case INDEX_op_bswap64_i64: /* Optional (TCG_TARGET_HAS_bswap64_i64). */
-        tcg_out_op_rr(s, opc, args[0], args[1]);
-        break;
-
     CASE_32_64(add2)
     CASE_32_64(sub2)
         tcg_out_op_rrrrrr(s, opc, args[0], args[1], args[2],

From 3ad5d4ccb4bdebdff4e90957bb2b8a93e5e418e2 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 10 Jan 2025 21:54:44 -0800
Subject: [PATCH 0451/2760] tcg: Rename INDEX_op_bswap64_i64 to
 INDEX_op_bswap64
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Even though bswap64 can only be used with TCG_TYPE_I64,
rename the opcode to maintain uniformity.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 docs/devel/tcg-ops.rst   | 5 +++--
 include/tcg/tcg-opc.h    | 3 +--
 tcg/optimize.c           | 6 +++---
 tcg/tcg-op.c             | 4 ++--
 tcg/tcg.c                | 6 +++---
 tcg/tci.c                | 4 ++--
 tcg/tci/tcg-target.c.inc | 2 +-
 7 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/docs/devel/tcg-ops.rst b/docs/devel/tcg-ops.rst
index e89ede54fa..72a23d6ea2 100644
--- a/docs/devel/tcg-ops.rst
+++ b/docs/devel/tcg-ops.rst
@@ -431,10 +431,11 @@ Misc
          they apply from bit 31 instead of bit 15.  On TCG_TYPE_I32, the
          flags should be zero.
 
-   * - bswap64_i64 *t0*, *t1*, *flags*
+   * - bswap64 *t0*, *t1*, *flags*
 
      - | 64 bit byte swap. The flags are ignored, but still present
-         for consistency with the other bswap opcodes.
+         for consistency with the other bswap opcodes. For future
+         compatibility, the flags should be zero.
 
    * - discard_i32/i64 *t0*
 
diff --git a/include/tcg/tcg-opc.h b/include/tcg/tcg-opc.h
index 296dffe99a..1d27b882fe 100644
--- a/include/tcg/tcg-opc.h
+++ b/include/tcg/tcg-opc.h
@@ -45,6 +45,7 @@ DEF(and, 1, 2, 0, TCG_OPF_INT)
 DEF(andc, 1, 2, 0, TCG_OPF_INT)
 DEF(bswap16, 1, 1, 1, TCG_OPF_INT)
 DEF(bswap32, 1, 1, 1, TCG_OPF_INT)
+DEF(bswap64, 1, 1, 1, TCG_OPF_INT)
 DEF(clz, 1, 2, 0, TCG_OPF_INT)
 DEF(ctpop, 1, 1, 0, TCG_OPF_INT)
 DEF(ctz, 1, 2, 0, TCG_OPF_INT)
@@ -121,8 +122,6 @@ DEF(extu_i32_i64, 1, 1, 0, 0)
 DEF(extrl_i64_i32, 1, 1, 0, 0)
 DEF(extrh_i64_i32, 1, 1, 0, 0)
 
-DEF(bswap64_i64, 1, 1, 1, 0)
-
 DEF(add2_i64, 2, 4, 0, 0)
 DEF(sub2_i64, 2, 4, 0, 0)
 
diff --git a/tcg/optimize.c b/tcg/optimize.c
index 6fa968624d..a860b62109 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -526,7 +526,7 @@ static uint64_t do_constant_folding_2(TCGOpcode op, TCGType type,
         x = bswap32(x);
         return y & TCG_BSWAP_OS ? (int32_t)x : x;
 
-    case INDEX_op_bswap64_i64:
+    case INDEX_op_bswap64:
         return bswap64(x);
 
     case INDEX_op_ext_i32_i64:
@@ -1580,7 +1580,7 @@ static bool fold_bswap(OptContext *ctx, TCGOp *op)
         z_mask = bswap32(z_mask);
         sign = INT32_MIN;
         break;
-    case INDEX_op_bswap64_i64:
+    case INDEX_op_bswap64:
         z_mask = bswap64(z_mask);
         sign = INT64_MIN;
         break;
@@ -2870,7 +2870,7 @@ void tcg_optimize(TCGContext *s)
             break;
         case INDEX_op_bswap16:
         case INDEX_op_bswap32:
-        case INDEX_op_bswap64_i64:
+        case INDEX_op_bswap64:
             done = fold_bswap(&ctx, op);
             break;
         case INDEX_op_clz:
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index 27e700161f..ba062191ac 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -2184,8 +2184,8 @@ void tcg_gen_bswap64_i64(TCGv_i64 ret, TCGv_i64 arg)
         tcg_gen_mov_i32(TCGV_HIGH(ret), t0);
         tcg_temp_free_i32(t0);
         tcg_temp_free_i32(t1);
-    } else if (tcg_op_supported(INDEX_op_bswap64_i64, TCG_TYPE_I64, 0)) {
-        tcg_gen_op3i_i64(INDEX_op_bswap64_i64, ret, arg, 0);
+    } else if (tcg_op_supported(INDEX_op_bswap64, TCG_TYPE_I64, 0)) {
+        tcg_gen_op3i_i64(INDEX_op_bswap64, ret, arg, 0);
     } else {
         TCGv_i64 t0 = tcg_temp_ebb_new_i64();
         TCGv_i64 t1 = tcg_temp_ebb_new_i64();
diff --git a/tcg/tcg.c b/tcg/tcg.c
index f2f2c0dd74..1ba86dd515 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1113,7 +1113,7 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_brcond2_i32, TCGOutOpBrcond2, outop_brcond2),
     OUTOP(INDEX_op_setcond2_i32, TCGOutOpSetcond2, outop_setcond2),
 #else
-    OUTOP(INDEX_op_bswap64_i64, TCGOutOpUnary, outop_bswap64),
+    OUTOP(INDEX_op_bswap64, TCGOutOpUnary, outop_bswap64),
 #endif
 };
 
@@ -2939,7 +2939,7 @@ void tcg_dump_ops(TCGContext *s, FILE *f, bool have_prefs)
                 break;
             case INDEX_op_bswap16:
             case INDEX_op_bswap32:
-            case INDEX_op_bswap64_i64:
+            case INDEX_op_bswap64:
                 {
                     TCGArg flags = op->args[k];
                     const char *name = NULL;
@@ -5470,7 +5470,7 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
         }
         break;
 
-    case INDEX_op_bswap64_i64:
+    case INDEX_op_bswap64:
         assert(TCG_TARGET_REG_BITS == 64);
         /* fall through */
     case INDEX_op_ctpop:
diff --git a/tcg/tci.c b/tcg/tci.c
index 903f996f02..30928c3412 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -788,7 +788,7 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_args_rr(insn, &r0, &r1);
             regs[r0] = (uint32_t)regs[r1];
             break;
-        case INDEX_op_bswap64_i64:
+        case INDEX_op_bswap64:
             tci_args_rr(insn, &r0, &r1);
             regs[r0] = bswap64(regs[r1]);
             break;
@@ -1009,7 +1009,7 @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
     case INDEX_op_not:
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
-    case INDEX_op_bswap64_i64:
+    case INDEX_op_bswap64:
         tci_args_rr(insn, &r0, &r1);
         info->fprintf_func(info->stream, "%-12s  %s, %s",
                            op_name, str_r(r0), str_r(r1));
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index cbfe92adf3..4fc857ad35 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -930,7 +930,7 @@ static const TCGOutOpBswap outop_bswap32 = {
 #if TCG_TARGET_REG_BITS == 64
 static void tgen_bswap64(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1)
 {
-    tcg_out_op_rr(s, INDEX_op_bswap64_i64, a0, a1);
+    tcg_out_op_rr(s, INDEX_op_bswap64, a0, a1);
 }
 
 static const TCGOutOpUnary outop_bswap64 = {

From 5a4d034f3cbc6d3bffc983b24a2746e9fe9b91cd Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 11 Jan 2025 07:55:47 -0800
Subject: [PATCH 0452/2760] tcg: Convert extract to TCGOutOpExtract

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target.c.inc     | 28 +++++++-----
 tcg/arm/tcg-target.c.inc         | 23 +++++-----
 tcg/i386/tcg-target.c.inc        | 77 +++++++++++++++++---------------
 tcg/loongarch64/tcg-target.c.inc | 33 +++++++-------
 tcg/mips/tcg-target.c.inc        | 35 +++++++--------
 tcg/ppc/tcg-target.c.inc         | 35 +++++++--------
 tcg/riscv/tcg-target.c.inc       | 54 +++++++++++-----------
 tcg/s390x/tcg-target.c.inc       | 14 +++---
 tcg/sparc64/tcg-target.c.inc     | 16 ++++---
 tcg/tcg.c                        | 20 +++++++++
 tcg/tci/tcg-target.c.inc         |  8 ++--
 11 files changed, 191 insertions(+), 152 deletions(-)

diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index 79c0e2e097..6c9d6094a2 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -2567,6 +2567,22 @@ static const TCGOutOpMovcond outop_movcond = {
     .out = tgen_movcond,
 };
 
+static void tgen_extract(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1,
+                         unsigned ofs, unsigned len)
+{
+    if (ofs == 0) {
+        uint64_t mask = MAKE_64BIT_MASK(0, len);
+        tcg_out_logicali(s, I3404_ANDI, type, a0, a1, mask);
+    } else {
+        tcg_out_ubfm(s, type, a0, a1, ofs, ofs + len - 1);
+    }
+}
+
+static const TCGOutOpExtract outop_extract = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = tgen_extract,
+};
+
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType ext,
                        const TCGArg args[TCG_MAX_OP_ARGS],
                        const int const_args[TCG_MAX_OP_ARGS])
@@ -2652,16 +2668,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType ext,
         tcg_out_dep(s, ext, a0, a2, args[3], args[4]);
         break;
 
-    case INDEX_op_extract_i64:
-    case INDEX_op_extract_i32:
-        if (a2 == 0) {
-            uint64_t mask = MAKE_64BIT_MASK(0, args[3]);
-            tcg_out_logicali(s, I3404_ANDI, ext, a0, a1, mask);
-        } else {
-            tcg_out_ubfm(s, ext, a0, a1, a2, a2 + args[3] - 1);
-        }
-        break;
-
     case INDEX_op_sextract_i64:
     case INDEX_op_sextract_i32:
         tcg_out_sbfm(s, ext, a0, a1, a2, a2 + args[3] - 1);
@@ -3167,8 +3173,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld_i64:
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
-    case INDEX_op_extract_i32:
-    case INDEX_op_extract_i64:
     case INDEX_op_sextract_i32:
     case INDEX_op_sextract_i64:
         return C_O1_I1(r, r);
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index 3bbc28c63c..bc060b20f2 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -981,19 +981,19 @@ static void tcg_out_deposit(TCGContext *s, ARMCond cond, TCGReg rd,
               | (ofs << 7) | ((ofs + len - 1) << 16));
 }
 
-static void tcg_out_extract(TCGContext *s, ARMCond cond, TCGReg rd,
-                            TCGReg rn, int ofs, int len)
+static void tgen_extract(TCGContext *s, TCGType type, TCGReg rd, TCGReg rn,
+                         unsigned ofs, unsigned len)
 {
     /* According to gcc, AND can be faster. */
     if (ofs == 0 && len <= 8) {
-        tcg_out_dat_imm(s, cond, ARITH_AND, rd, rn,
+        tcg_out_dat_imm(s, COND_AL, ARITH_AND, rd, rn,
                         encode_imm_nofail((1 << len) - 1));
         return;
     }
 
     if (use_armv7_instructions) {
         /* ubfx */
-        tcg_out32(s, 0x07e00050 | (cond << 28) | (rd << 12) | rn
+        tcg_out32(s, 0x07e00050 | (COND_AL << 28) | (rd << 12) | rn
                   | (ofs << 7) | ((len - 1) << 16));
         return;
     }
@@ -1002,17 +1002,24 @@ static void tcg_out_extract(TCGContext *s, ARMCond cond, TCGReg rd,
     switch (len) {
     case 8:
         /* uxtb */
-        tcg_out32(s, 0x06ef0070 | (cond << 28) | (rd << 12) | (ofs << 7) | rn);
+        tcg_out32(s, 0x06ef0070 | (COND_AL << 28) |
+                  (rd << 12) | (ofs << 7) | rn);
         break;
     case 16:
         /* uxth */
-        tcg_out32(s, 0x06ff0070 | (cond << 28) | (rd << 12) | (ofs << 7) | rn);
+        tcg_out32(s, 0x06ff0070 | (COND_AL << 28) |
+                  (rd << 12) | (ofs << 7) | rn);
         break;
     default:
         g_assert_not_reached();
     }
 }
 
+static const TCGOutOpExtract outop_extract = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = tgen_extract,
+};
+
 static void tcg_out_sextract(TCGContext *s, ARMCond cond, TCGReg rd,
                              TCGReg rn, int ofs, int len)
 {
@@ -2392,9 +2399,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_deposit(s, COND_AL, args[0], args[2],
                         args[3], args[4], const_args[2]);
         break;
-    case INDEX_op_extract_i32:
-        tcg_out_extract(s, COND_AL, args[0], args[1], args[2], args[3]);
-        break;
     case INDEX_op_sextract_i32:
         tcg_out_sextract(s, COND_AL, args[0], args[1], args[2], args[3]);
         break;
@@ -2444,7 +2448,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld16u_i32:
     case INDEX_op_ld16s_i32:
     case INDEX_op_ld_i32:
-    case INDEX_op_extract_i32:
     case INDEX_op_sextract_i32:
         return C_O1_I1(r, r);
 
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index 347e01c076..b26c93bdb1 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -3138,6 +3138,47 @@ static const TCGOutOpUnary outop_not = {
     .out_rr = tgen_not,
 };
 
+static void tgen_extract(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1,
+                         unsigned ofs, unsigned len)
+{
+    if (ofs == 0) {
+        switch (len) {
+        case 8:
+            tcg_out_ext8u(s, a0, a1);
+            return;
+        case 16:
+            tcg_out_ext16u(s, a0, a1);
+            return;
+        case 32:
+            tcg_out_ext32u(s, a0, a1);
+            return;
+        }
+    } else if (TCG_TARGET_REG_BITS == 64 && ofs + len == 32) {
+        /* This is a 32-bit zero-extending right shift.  */
+        tcg_out_mov(s, TCG_TYPE_I32, a0, a1);
+        tcg_out_shifti(s, SHIFT_SHR, a0, ofs);
+        return;
+    } else if (ofs == 8 && len == 8) {
+        /*
+         * On the off-chance that we can use the high-byte registers.
+         * Otherwise we emit the same ext16 + shift pattern that we
+         * would have gotten from the normal tcg-op.c expansion.
+         */
+        if (a1 < 4 && (TCG_TARGET_REG_BITS == 32 || a0 < 8)) {
+            tcg_out_modrm(s, OPC_MOVZBL, a0, a1 + 4);
+        } else {
+            tcg_out_ext16u(s, a0, a1);
+            tcg_out_shifti(s, SHIFT_SHR, a0, 8);
+        }
+        return;
+    }
+    g_assert_not_reached();
+}
+
+static const TCGOutOpExtract outop_extract = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = tgen_extract,
+};
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -3328,40 +3369,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    case INDEX_op_extract_i64:
-        if (a2 + args[3] == 32) {
-            if (a2 == 0) {
-                tcg_out_ext32u(s, a0, a1);
-                break;
-            }
-            /* This is a 32-bit zero-extending right shift.  */
-            tcg_out_mov(s, TCG_TYPE_I32, a0, a1);
-            tcg_out_shifti(s, SHIFT_SHR, a0, a2);
-            break;
-        }
-        /* FALLTHRU */
-    case INDEX_op_extract_i32:
-        if (a2 == 0 && args[3] == 8) {
-            tcg_out_ext8u(s, a0, a1);
-        } else if (a2 == 0 && args[3] == 16) {
-            tcg_out_ext16u(s, a0, a1);
-        } else if (a2 == 8 && args[3] == 8) {
-            /*
-             * On the off-chance that we can use the high-byte registers.
-             * Otherwise we emit the same ext16 + shift pattern that we
-             * would have gotten from the normal tcg-op.c expansion.
-             */
-            if (a1 < 4 && a0 < 8) {
-                tcg_out_modrm(s, OPC_MOVZBL, a0, a1 + 4);
-            } else {
-                tcg_out_ext16u(s, a0, a1);
-                tcg_out_shifti(s, SHIFT_SHR, a0, 8);
-            }
-        } else {
-            g_assert_not_reached();
-        }
-        break;
-
     case INDEX_op_sextract_i64:
         if (a2 == 0 && args[3] == 8) {
             tcg_out_ext8s(s, TCG_TYPE_I64, a0, a1);
@@ -3994,8 +4001,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
     case INDEX_op_extrl_i64_i32:
-    case INDEX_op_extract_i32:
-    case INDEX_op_extract_i64:
     case INDEX_op_sextract_i32:
     case INDEX_op_sextract_i64:
         return C_O1_I1(r, r);
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index f3b2f709d2..f63d33e9ac 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -1799,6 +1799,22 @@ static const TCGOutOpUnary outop_not = {
     .out_rr = tgen_not,
 };
 
+static void tgen_extract(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1,
+                         unsigned ofs, unsigned len)
+{
+    if (ofs == 0 && len <= 12) {
+        tcg_out_opc_andi(s, a0, a1, (1 << len) - 1);
+    } else if (type == TCG_TYPE_I32) {
+        tcg_out_opc_bstrpick_w(s, a0, a1, ofs, ofs + len - 1);
+    } else {
+        tcg_out_opc_bstrpick_d(s, a0, a1, ofs, ofs + len - 1);
+    }
+}
+
+static const TCGOutOpExtract outop_extract = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = tgen_extract,
+};
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -1828,21 +1844,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_opc_srai_d(s, a0, a1, 32);
         break;
 
-    case INDEX_op_extract_i32:
-        if (a2 == 0 && args[3] <= 12) {
-            tcg_out_opc_andi(s, a0, a1, (1 << args[3]) - 1);
-        } else {
-            tcg_out_opc_bstrpick_w(s, a0, a1, a2, a2 + args[3] - 1);
-        }
-        break;
-    case INDEX_op_extract_i64:
-        if (a2 == 0 && args[3] <= 12) {
-            tcg_out_opc_andi(s, a0, a1, (1 << args[3]) - 1);
-        } else {
-            tcg_out_opc_bstrpick_d(s, a0, a1, a2, a2 + args[3] - 1);
-        }
-        break;
-
     case INDEX_op_sextract_i64:
         if (a2 + args[3] == 32) {
             if (a2 == 0) {
@@ -2461,8 +2462,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_extrl_i64_i32:
     case INDEX_op_extrh_i64_i32:
     case INDEX_op_ext_i32_i64:
-    case INDEX_op_extract_i32:
-    case INDEX_op_extract_i64:
     case INDEX_op_sextract_i32:
     case INDEX_op_sextract_i64:
     case INDEX_op_ld8s_i32:
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index baaf0e416b..dbb4b9355d 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -2203,6 +2203,23 @@ static const TCGOutOpUnary outop_not = {
     .out_rr = tgen_not,
 };
 
+static void tgen_extract(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1,
+                         unsigned ofs, unsigned len)
+{
+    if (ofs == 0 && len <= 16) {
+        tcg_out_opc_imm(s, OPC_ANDI, a0, a1, (1 << len) - 1);
+    } else if (type == TCG_TYPE_I32) {
+        tcg_out_opc_bf(s, OPC_EXT, a0, a1, len - 1, ofs);
+    } else {
+        tcg_out_opc_bf64(s, OPC_DEXT, OPC_DEXTM, OPC_DEXTU,
+                         a0, a1, len - 1, ofs);
+    }
+}
+
+static const TCGOutOpExtract outop_extract = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = tgen_extract,
+};
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -2286,22 +2303,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                          args[3] + args[4] - 1, args[3]);
         break;
 
-    case INDEX_op_extract_i32:
-        if (a2 == 0 && args[3] <= 16) {
-            tcg_out_opc_imm(s, OPC_ANDI, a0, a1, (1 << args[3]) - 1);
-        } else {
-            tcg_out_opc_bf(s, OPC_EXT, a0, a1, args[3] - 1, a2);
-        }
-        break;
-    case INDEX_op_extract_i64:
-        if (a2 == 0 && args[3] <= 16) {
-            tcg_out_opc_imm(s, OPC_ANDI, a0, a1, (1 << args[3]) - 1);
-        } else {
-            tcg_out_opc_bf64(s, OPC_DEXT, OPC_DEXTM, OPC_DEXTU,
-                             a0, a1, args[3] - 1, a2);
-        }
-        break;
-
     case INDEX_op_sextract_i64:
         if (a2 == 0 && args[3] == 32) {
             tcg_out_ext32s(s, a0, a1);
@@ -2375,7 +2376,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld16u_i32:
     case INDEX_op_ld16s_i32:
     case INDEX_op_ld_i32:
-    case INDEX_op_extract_i32:
     case INDEX_op_sextract_i32:
     case INDEX_op_ld8u_i64:
     case INDEX_op_ld8s_i64:
@@ -2388,7 +2388,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_extu_i32_i64:
     case INDEX_op_extrl_i64_i32:
     case INDEX_op_extrh_i64_i32:
-    case INDEX_op_extract_i64:
     case INDEX_op_sextract_i64:
         return C_O1_I1(r, r);
 
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index 083137d211..a8558a47b7 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -3417,6 +3417,23 @@ static const TCGOutOpUnary outop_not = {
     .out_rr = tgen_not,
 };
 
+static void tgen_extract(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1,
+                         unsigned ofs, unsigned len)
+{
+    if (ofs == 0 && len <= 16) {
+        tgen_andi(s, TCG_TYPE_I32, a0, a1, (1 << len) - 1);
+    } else if (type == TCG_TYPE_I32) {
+        tcg_out_rlw(s, RLWINM, a0, a1, 32 - ofs, 32 - len, 31);
+    } else {
+        tcg_out_rld(s, RLDICL, a0, a1, 64 - ofs, 64 - len);
+    }
+}
+
+static const TCGOutOpExtract outop_extract = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = tgen_extract,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -3538,22 +3555,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    case INDEX_op_extract_i32:
-        if (args[2] == 0 && args[3] <= 16) {
-            tcg_out32(s, ANDI | SAI(args[1], args[0], (1 << args[3]) - 1));
-            break;
-        }
-        tcg_out_rlw(s, RLWINM, args[0], args[1],
-                    32 - args[2], 32 - args[3], 31);
-        break;
-    case INDEX_op_extract_i64:
-        if (args[2] == 0 && args[3] <= 16) {
-            tcg_out32(s, ANDI | SAI(args[1], args[0], (1 << args[3]) - 1));
-            break;
-        }
-        tcg_out_rld(s, RLDICL, args[0], args[1], 64 - args[2], 64 - args[3]);
-        break;
-
     case INDEX_op_sextract_i64:
         if (args[2] + args[3] == 32) {
             if (args[2] == 0) {
@@ -4255,7 +4256,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld16u_i32:
     case INDEX_op_ld16s_i32:
     case INDEX_op_ld_i32:
-    case INDEX_op_extract_i32:
     case INDEX_op_sextract_i32:
     case INDEX_op_ld8u_i64:
     case INDEX_op_ld8s_i64:
@@ -4266,7 +4266,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld_i64:
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
-    case INDEX_op_extract_i64:
     case INDEX_op_sextract_i64:
         return C_O1_I1(r, r);
 
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index 00b097d171..85d978763c 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -2472,6 +2472,34 @@ static const TCGOutOpUnary outop_not = {
     .out_rr = tgen_not,
 };
 
+static void tgen_extract(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1,
+                         unsigned ofs, unsigned len)
+{
+    if (ofs == 0) {
+        switch (len) {
+        case 16:
+            tcg_out_ext16u(s, a0, a1);
+            return;
+        case 32:
+            tcg_out_ext32u(s, a0, a1);
+            return;
+        }
+    }
+    if (ofs + len == 32) {
+        tgen_shli(s, TCG_TYPE_I32, a0, a1, ofs);
+        return;
+    }
+    if (len == 1) {
+        tcg_out_opc_imm(s, OPC_BEXTI, a0, a1, ofs);
+        return;
+    }
+    g_assert_not_reached();
+}
+
+static const TCGOutOpExtract outop_extract = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = tgen_extract,
+};
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -2572,30 +2600,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_mb(s, a0);
         break;
 
-    case INDEX_op_extract_i64:
-        if (a2 + args[3] == 32) {
-            if (a2 == 0) {
-                tcg_out_ext32u(s, a0, a1);
-            } else {
-                tcg_out_opc_imm(s, OPC_SRLIW, a0, a1, a2);
-            }
-            break;
-        }
-        /* FALLTHRU */
-    case INDEX_op_extract_i32:
-        switch (args[3]) {
-        case 1:
-            tcg_out_opc_imm(s, OPC_BEXTI, a0, a1, a2);
-            break;
-        case 16:
-            tcg_debug_assert(a2 == 0);
-            tcg_out_ext16u(s, a0, a1);
-            break;
-        default:
-            g_assert_not_reached();
-        }
-        break;
-
     case INDEX_op_sextract_i64:
         if (a2 + args[3] == 32) {
             if (a2 == 0) {
@@ -2867,8 +2871,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_extrl_i64_i32:
     case INDEX_op_extrh_i64_i32:
     case INDEX_op_ext_i32_i64:
-    case INDEX_op_extract_i32:
-    case INDEX_op_extract_i64:
     case INDEX_op_sextract_i32:
     case INDEX_op_sextract_i64:
         return C_O1_I1(r, r);
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index 2ed288cfe0..96e2dc0ad5 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -1563,8 +1563,8 @@ static void tgen_deposit(TCGContext *s, TCGReg dest, TCGReg src,
     tcg_out_risbg(s, dest, src, msb, lsb, ofs, z);
 }
 
-static void tgen_extract(TCGContext *s, TCGReg dest, TCGReg src,
-                         int ofs, int len)
+static void tgen_extract(TCGContext *s, TCGType type, TCGReg dest,
+                         TCGReg src, unsigned ofs, unsigned len)
 {
     if (ofs == 0) {
         switch (len) {
@@ -1582,6 +1582,11 @@ static void tgen_extract(TCGContext *s, TCGReg dest, TCGReg src,
     tcg_out_risbg(s, dest, src, 64 - len, 63, 64 - ofs, 1);
 }
 
+static const TCGOutOpExtract outop_extract = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = tgen_extract,
+};
+
 static void tgen_sextract(TCGContext *s, TCGReg dest, TCGReg src,
                           int ofs, int len)
 {
@@ -2975,9 +2980,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    OP_32_64(extract):
-        tgen_extract(s, args[0], args[1], args[2], args[3]);
-        break;
     OP_32_64(sextract):
         tgen_sextract(s, args[0], args[1], args[2], args[3]);
         break;
@@ -3470,8 +3472,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
-    case INDEX_op_extract_i32:
-    case INDEX_op_extract_i64:
     case INDEX_op_sextract_i32:
     case INDEX_op_sextract_i64:
         return C_O1_I1(r, r);
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index 96ffba9af6..cba1dd009c 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -1757,6 +1757,17 @@ static const TCGOutOpUnary outop_not = {
     .out_rr = tgen_not,
 };
 
+static void tgen_extract(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1,
+                         unsigned ofs, unsigned len)
+{
+    tcg_debug_assert(ofs + len == 32);
+    tcg_out_arithi(s, a0, a1, ofs, SHIFT_SRL);
+}
+
+static const TCGOutOpExtract outop_extract = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = tgen_extract,
+};
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -1857,10 +1868,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_mb(s, a0);
         break;
 
-    case INDEX_op_extract_i64:
-        tcg_debug_assert(a2 + args[3] == 32);
-        tcg_out_arithi(s, a0, a1, a2, SHIFT_SRL);
-        break;
     case INDEX_op_sextract_i64:
         tcg_debug_assert(a2 + args[3] == 32);
         tcg_out_arithi(s, a0, a1, a2, SHIFT_SRA);
@@ -1897,7 +1904,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld_i64:
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
-    case INDEX_op_extract_i64:
     case INDEX_op_sextract_i64:
     case INDEX_op_qemu_ld_i32:
     case INDEX_op_qemu_ld_i64:
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 1ba86dd515..36c5e9c847 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1013,6 +1013,12 @@ typedef struct TCGOutOpDivRem {
                       TCGReg a0, TCGReg a1, TCGReg a4);
 } TCGOutOpDivRem;
 
+typedef struct TCGOutOpExtract {
+    TCGOutOp base;
+    void (*out_rr)(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1,
+                   unsigned ofs, unsigned len);
+} TCGOutOpExtract;
+
 typedef struct TCGOutOpMovcond {
     TCGOutOp base;
     void (*out)(TCGContext *s, TCGType type, TCGCond cond,
@@ -1085,6 +1091,8 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_divs2, TCGOutOpDivRem, outop_divs2),
     OUTOP(INDEX_op_divu2, TCGOutOpDivRem, outop_divu2),
     OUTOP(INDEX_op_eqv, TCGOutOpBinary, outop_eqv),
+    OUTOP(INDEX_op_extract_i32, TCGOutOpExtract, outop_extract),
+    OUTOP(INDEX_op_extract_i64, TCGOutOpExtract, outop_extract),
     OUTOP(INDEX_op_movcond, TCGOutOpMovcond, outop_movcond),
     OUTOP(INDEX_op_mul, TCGOutOpBinary, outop_mul),
     OUTOP(INDEX_op_muls2, TCGOutOpMul2, outop_muls2),
@@ -5511,6 +5519,18 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
         }
         break;
 
+    case INDEX_op_extract_i32:
+    case INDEX_op_extract_i64:
+        {
+            const TCGOutOpExtract *out =
+                container_of(all_outop[op->opc], TCGOutOpExtract, base);
+
+            tcg_debug_assert(!const_args[1]);
+            out->out_rr(s, type, new_args[0], new_args[1],
+                        new_args[2], new_args[3]);
+        }
+        break;
+
     case INDEX_op_muls2:
     case INDEX_op_mulu2:
         {
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index 4fc857ad35..d8cf5d237b 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -57,8 +57,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld_i64:
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
-    case INDEX_op_extract_i32:
-    case INDEX_op_extract_i64:
     case INDEX_op_sextract_i32:
     case INDEX_op_sextract_i64:
         return C_O1_I1(r, r);
@@ -444,6 +442,11 @@ static void tcg_out_extract(TCGContext *s, TCGType type, TCGReg rd,
     tcg_out_op_rrbb(s, opc, rd, rs, pos, len);
 }
 
+static const TCGOutOpExtract outop_extract = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = tcg_out_extract,
+};
+
 static void tcg_out_sextract(TCGContext *s, TCGType type, TCGReg rd,
                              TCGReg rs, unsigned pos, unsigned len)
 {
@@ -1078,7 +1081,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_op_rrrbb(s, opc, args[0], args[1], args[2], args[3], args[4]);
         break;
 
-    CASE_32_64(extract)  /* Optional (TCG_TARGET_HAS_extract_*). */
     CASE_32_64(sextract) /* Optional (TCG_TARGET_HAS_sextract_*). */
         tcg_out_op_rrbb(s, opc, args[0], args[1], args[2], args[3]);
         break;

From 07d5d502f2b4a8eedda3c6bdfcab31dc36d1d1d5 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 11 Jan 2025 09:01:46 -0800
Subject: [PATCH 0453/2760] tcg: Merge INDEX_op_extract_{i32,i64}
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 docs/devel/tcg-ops.rst   |  6 +++---
 include/tcg/tcg-opc.h    |  3 +--
 tcg/optimize.c           | 14 ++++----------
 tcg/tcg-op.c             |  8 ++++----
 tcg/tcg.c                |  9 +++------
 tcg/tci.c                | 12 ++++--------
 tcg/tci/tcg-target.c.inc |  5 +----
 7 files changed, 20 insertions(+), 37 deletions(-)

diff --git a/docs/devel/tcg-ops.rst b/docs/devel/tcg-ops.rst
index 72a23d6ea2..2843f88772 100644
--- a/docs/devel/tcg-ops.rst
+++ b/docs/devel/tcg-ops.rst
@@ -456,7 +456,7 @@ Misc
        |
        |     *dest* = (*t1* & ~0x0f00) | ((*t2* << 8) & 0x0f00)
 
-   * - extract_i32/i64 *dest*, *t1*, *pos*, *len*
+   * - extract *dest*, *t1*, *pos*, *len*
 
        sextract_i32/i64 *dest*, *t1*, *pos*, *len*
 
@@ -467,12 +467,12 @@ Misc
          to the left with zeros; for sextract_*, the result will be extended
          to the left with copies of the bitfield sign bit at *pos* + *len* - 1.
        |
-       | For example, "sextract_i32 dest, t1, 8, 4" indicates a 4-bit field
+       | For example, "sextract dest, t1, 8, 4" indicates a 4-bit field
          at bit 8. This operation would be equivalent to
        |
        |    *dest* = (*t1* << 20) >> 28
        |
-       | (using an arithmetic right shift).
+       | (using an arithmetic right shift) on TCG_TYPE_I32.
 
    * - extract2_i32/i64 *dest*, *t1*, *t2*, *pos*
 
diff --git a/include/tcg/tcg-opc.h b/include/tcg/tcg-opc.h
index 1d27b882fe..a8c304ca63 100644
--- a/include/tcg/tcg-opc.h
+++ b/include/tcg/tcg-opc.h
@@ -54,6 +54,7 @@ DEF(divs2, 2, 3, 0, TCG_OPF_INT)
 DEF(divu, 1, 2, 0, TCG_OPF_INT)
 DEF(divu2, 2, 3, 0, TCG_OPF_INT)
 DEF(eqv, 1, 2, 0, TCG_OPF_INT)
+DEF(extract, 1, 1, 2, TCG_OPF_INT)
 DEF(movcond, 1, 4, 1, TCG_OPF_INT)
 DEF(mul, 1, 2, 0, TCG_OPF_INT)
 DEF(muls2, 2, 2, 0, TCG_OPF_INT)
@@ -89,7 +90,6 @@ DEF(st16_i32, 0, 2, 1, 0)
 DEF(st_i32, 0, 2, 1, 0)
 /* shifts/rotates */
 DEF(deposit_i32, 1, 2, 2, 0)
-DEF(extract_i32, 1, 1, 2, 0)
 DEF(sextract_i32, 1, 1, 2, 0)
 DEF(extract2_i32, 1, 2, 1, 0)
 
@@ -112,7 +112,6 @@ DEF(st32_i64, 0, 2, 1, 0)
 DEF(st_i64, 0, 2, 1, 0)
 /* shifts/rotates */
 DEF(deposit_i64, 1, 2, 2, 0)
-DEF(extract_i64, 1, 1, 2, 0)
 DEF(sextract_i64, 1, 1, 2, 0)
 DEF(extract2_i64, 1, 2, 1, 0)
 
diff --git a/tcg/optimize.c b/tcg/optimize.c
index a860b62109..fbfcbf23cd 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -2317,7 +2317,7 @@ static int fold_setcond_zmask(OptContext *ctx, TCGOp *op, bool neg)
 
 static void fold_setcond_tst_pow2(OptContext *ctx, TCGOp *op, bool neg)
 {
-    TCGOpcode uext_opc = 0, sext_opc = 0;
+    TCGOpcode sext_opc = 0;
     TCGCond cond = op->args[3];
     TCGArg ret, src1, src2;
     TCGOp *op2;
@@ -2338,17 +2338,11 @@ static void fold_setcond_tst_pow2(OptContext *ctx, TCGOp *op, bool neg)
 
     switch (ctx->type) {
     case TCG_TYPE_I32:
-        if (TCG_TARGET_extract_valid(TCG_TYPE_I32, sh, 1)) {
-            uext_opc = INDEX_op_extract_i32;
-        }
         if (TCG_TARGET_sextract_valid(TCG_TYPE_I32, sh, 1)) {
             sext_opc = INDEX_op_sextract_i32;
         }
         break;
     case TCG_TYPE_I64:
-        if (TCG_TARGET_extract_valid(TCG_TYPE_I64, sh, 1)) {
-            uext_opc = INDEX_op_extract_i64;
-        }
         if (TCG_TARGET_sextract_valid(TCG_TYPE_I64, sh, 1)) {
             sext_opc = INDEX_op_sextract_i64;
         }
@@ -2367,8 +2361,8 @@ static void fold_setcond_tst_pow2(OptContext *ctx, TCGOp *op, bool neg)
         op->args[2] = sh;
         op->args[3] = 1;
         return;
-    } else if (sh && uext_opc) {
-        op->opc = uext_opc;
+    } else if (sh && TCG_TARGET_extract_valid(ctx->type, sh, 1)) {
+        op->opc = INDEX_op_extract;
         op->args[1] = src1;
         op->args[2] = sh;
         op->args[3] = 1;
@@ -2897,7 +2891,7 @@ void tcg_optimize(TCGContext *s)
         case INDEX_op_eqv_vec:
             done = fold_eqv(&ctx, op);
             break;
-        CASE_OP_32_64(extract):
+        case INDEX_op_extract:
             done = fold_extract(&ctx, op);
             break;
         CASE_OP_32_64(extract2):
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index ba062191ac..ddade73b7b 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -998,7 +998,7 @@ void tcg_gen_extract_i32(TCGv_i32 ret, TCGv_i32 arg,
     }
 
     if (TCG_TARGET_extract_valid(TCG_TYPE_I32, ofs, len)) {
-        tcg_gen_op4ii_i32(INDEX_op_extract_i32, ret, arg, ofs, len);
+        tcg_gen_op4ii_i32(INDEX_op_extract, ret, arg, ofs, len);
         return;
     }
     if (ofs == 0) {
@@ -1008,7 +1008,7 @@ void tcg_gen_extract_i32(TCGv_i32 ret, TCGv_i32 arg,
 
     /* Assume that zero-extension, if available, is cheaper than a shift.  */
     if (TCG_TARGET_extract_valid(TCG_TYPE_I32, 0, ofs + len)) {
-        tcg_gen_op4ii_i32(INDEX_op_extract_i32, ret, arg, 0, ofs + len);
+        tcg_gen_op4ii_i32(INDEX_op_extract, ret, arg, 0, ofs + len);
         tcg_gen_shri_i32(ret, ret, ofs);
         return;
     }
@@ -2670,7 +2670,7 @@ void tcg_gen_extract_i64(TCGv_i64 ret, TCGv_i64 arg,
     }
 
     if (TCG_TARGET_extract_valid(TCG_TYPE_I64, ofs, len)) {
-        tcg_gen_op4ii_i64(INDEX_op_extract_i64, ret, arg, ofs, len);
+        tcg_gen_op4ii_i64(INDEX_op_extract, ret, arg, ofs, len);
         return;
     }
     if (ofs == 0) {
@@ -2680,7 +2680,7 @@ void tcg_gen_extract_i64(TCGv_i64 ret, TCGv_i64 arg,
 
     /* Assume that zero-extension, if available, is cheaper than a shift.  */
     if (TCG_TARGET_extract_valid(TCG_TYPE_I64, 0, ofs + len)) {
-        tcg_gen_op4ii_i64(INDEX_op_extract_i64, ret, arg, 0, ofs + len);
+        tcg_gen_op4ii_i64(INDEX_op_extract, ret, arg, 0, ofs + len);
         tcg_gen_shri_i64(ret, ret, ofs);
         return;
     }
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 36c5e9c847..ce0d862b19 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1091,8 +1091,7 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_divs2, TCGOutOpDivRem, outop_divs2),
     OUTOP(INDEX_op_divu2, TCGOutOpDivRem, outop_divu2),
     OUTOP(INDEX_op_eqv, TCGOutOpBinary, outop_eqv),
-    OUTOP(INDEX_op_extract_i32, TCGOutOpExtract, outop_extract),
-    OUTOP(INDEX_op_extract_i64, TCGOutOpExtract, outop_extract),
+    OUTOP(INDEX_op_extract, TCGOutOpExtract, outop_extract),
     OUTOP(INDEX_op_movcond, TCGOutOpMovcond, outop_movcond),
     OUTOP(INDEX_op_mul, TCGOutOpBinary, outop_mul),
     OUTOP(INDEX_op_muls2, TCGOutOpMul2, outop_muls2),
@@ -2326,6 +2325,7 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_add:
     case INDEX_op_and:
     case INDEX_op_brcond:
+    case INDEX_op_extract:
     case INDEX_op_mov:
     case INDEX_op_movcond:
     case INDEX_op_negsetcond:
@@ -2342,7 +2342,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st8_i32:
     case INDEX_op_st16_i32:
     case INDEX_op_st_i32:
-    case INDEX_op_extract_i32:
     case INDEX_op_sextract_i32:
     case INDEX_op_deposit_i32:
         return true;
@@ -2371,7 +2370,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
-    case INDEX_op_extract_i64:
     case INDEX_op_sextract_i64:
     case INDEX_op_deposit_i64:
         return TCG_TARGET_REG_BITS == 64;
@@ -5519,8 +5517,7 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
         }
         break;
 
-    case INDEX_op_extract_i32:
-    case INDEX_op_extract_i64:
+    case INDEX_op_extract:
         {
             const TCGOutOpExtract *out =
                 container_of(all_outop[op->opc], TCGOutOpExtract, base);
diff --git a/tcg/tci.c b/tcg/tci.c
index 30928c3412..6345029802 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -27,6 +27,7 @@
 
 
 #define ctpop_tr    glue(ctpop, TCG_TARGET_REG_BITS)
+#define extract_tr  glue(extract, TCG_TARGET_REG_BITS)
 
 /*
  * Enable TCI assertions only when debugging TCG (and without NDEBUG defined).
@@ -656,9 +657,9 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_args_rrrbb(insn, &r0, &r1, &r2, &pos, &len);
             regs[r0] = deposit32(regs[r1], pos, len, regs[r2]);
             break;
-        case INDEX_op_extract_i32:
+        case INDEX_op_extract:
             tci_args_rrbb(insn, &r0, &r1, &pos, &len);
-            regs[r0] = extract32(regs[r1], pos, len);
+            regs[r0] = extract_tr(regs[r1], pos, len);
             break;
         case INDEX_op_sextract_i32:
             tci_args_rrbb(insn, &r0, &r1, &pos, &len);
@@ -772,10 +773,6 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_args_rrrbb(insn, &r0, &r1, &r2, &pos, &len);
             regs[r0] = deposit64(regs[r1], pos, len, regs[r2]);
             break;
-        case INDEX_op_extract_i64:
-            tci_args_rrbb(insn, &r0, &r1, &pos, &len);
-            regs[r0] = extract64(regs[r1], pos, len);
-            break;
         case INDEX_op_sextract_i64:
             tci_args_rrbb(insn, &r0, &r1, &pos, &len);
             regs[r0] = sextract64(regs[r1], pos, len);
@@ -1057,8 +1054,7 @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
                            op_name, str_r(r0), str_r(r1), str_r(r2), pos, len);
         break;
 
-    case INDEX_op_extract_i32:
-    case INDEX_op_extract_i64:
+    case INDEX_op_extract:
     case INDEX_op_sextract_i32:
     case INDEX_op_sextract_i64:
         tci_args_rrbb(insn, &r0, &r1, &pos, &len);
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index d8cf5d237b..ede11d9e70 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -436,10 +436,7 @@ static void tcg_out_movi(TCGContext *s, TCGType type,
 static void tcg_out_extract(TCGContext *s, TCGType type, TCGReg rd,
                             TCGReg rs, unsigned pos, unsigned len)
 {
-    TCGOpcode opc = type == TCG_TYPE_I32 ?
-                    INDEX_op_extract_i32 :
-                    INDEX_op_extract_i64;
-    tcg_out_op_rrbb(s, opc, rd, rs, pos, len);
+    tcg_out_op_rrbb(s, INDEX_op_extract, rd, rs, pos, len);
 }
 
 static const TCGOutOpExtract outop_extract = {

From 05a1129e23bfed1fe799a169e0eca0f676fa5016 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sun, 12 Jan 2025 11:44:30 -0800
Subject: [PATCH 0454/2760] tcg: Convert sextract to TCGOutOpExtract

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target.c.inc     | 18 +++++----
 tcg/arm/tcg-target.c.inc         | 21 ++++++-----
 tcg/i386/tcg-target.c.inc        | 63 ++++++++++++++++----------------
 tcg/loongarch64/tcg-target.c.inc | 49 ++++++++++++++-----------
 tcg/mips/tcg-target.c.inc        | 42 ++++++++++++---------
 tcg/ppc/tcg-target.c.inc         | 49 ++++++++++++++-----------
 tcg/riscv/tcg-target.c.inc       | 49 ++++++++++++++-----------
 tcg/s390x/tcg-target.c.inc       | 15 ++++----
 tcg/sparc64/tcg-target.c.inc     | 18 ++++++---
 tcg/tcg.c                        |  4 ++
 tcg/tci/tcg-target.c.inc         | 11 +++---
 11 files changed, 188 insertions(+), 151 deletions(-)

diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index 6c9d6094a2..00400f6ea7 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -2583,6 +2583,17 @@ static const TCGOutOpExtract outop_extract = {
     .out_rr = tgen_extract,
 };
 
+static void tgen_sextract(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1,
+                          unsigned ofs, unsigned len)
+{
+    tcg_out_sbfm(s, type, a0, a1, ofs, ofs + len - 1);
+}
+
+static const TCGOutOpExtract outop_sextract = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = tgen_sextract,
+};
+
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType ext,
                        const TCGArg args[TCG_MAX_OP_ARGS],
                        const int const_args[TCG_MAX_OP_ARGS])
@@ -2668,11 +2679,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType ext,
         tcg_out_dep(s, ext, a0, a2, args[3], args[4]);
         break;
 
-    case INDEX_op_sextract_i64:
-    case INDEX_op_sextract_i32:
-        tcg_out_sbfm(s, ext, a0, a1, a2, a2 + args[3] - 1);
-        break;
-
     case INDEX_op_extract2_i64:
     case INDEX_op_extract2_i32:
         tcg_out_extr(s, ext, a0, a2, a1, args[3]);
@@ -3173,8 +3179,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld_i64:
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
-    case INDEX_op_sextract_i32:
-    case INDEX_op_sextract_i64:
         return C_O1_I1(r, r);
 
     case INDEX_op_st8_i32:
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index bc060b20f2..aebe48679c 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -1020,12 +1020,12 @@ static const TCGOutOpExtract outop_extract = {
     .out_rr = tgen_extract,
 };
 
-static void tcg_out_sextract(TCGContext *s, ARMCond cond, TCGReg rd,
-                             TCGReg rn, int ofs, int len)
+static void tgen_sextract(TCGContext *s, TCGType type, TCGReg rd, TCGReg rn,
+                          unsigned ofs, unsigned len)
 {
     if (use_armv7_instructions) {
         /* sbfx */
-        tcg_out32(s, 0x07a00050 | (cond << 28) | (rd << 12) | rn
+        tcg_out32(s, 0x07a00050 | (COND_AL << 28) | (rd << 12) | rn
                   | (ofs << 7) | ((len - 1) << 16));
         return;
     }
@@ -1034,17 +1034,24 @@ static void tcg_out_sextract(TCGContext *s, ARMCond cond, TCGReg rd,
     switch (len) {
     case 8:
         /* sxtb */
-        tcg_out32(s, 0x06af0070 | (cond << 28) | (rd << 12) | (ofs << 7) | rn);
+        tcg_out32(s, 0x06af0070 | (COND_AL << 28) |
+                  (rd << 12) | (ofs << 7) | rn);
         break;
     case 16:
         /* sxth */
-        tcg_out32(s, 0x06bf0070 | (cond << 28) | (rd << 12) | (ofs << 7) | rn);
+        tcg_out32(s, 0x06bf0070 | (COND_AL << 28) |
+                  (rd << 12) | (ofs << 7) | rn);
         break;
     default:
         g_assert_not_reached();
     }
 }
 
+static const TCGOutOpExtract outop_sextract = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = tgen_sextract,
+};
+
 
 static void tcg_out_ld32u(TCGContext *s, ARMCond cond,
                           TCGReg rd, TCGReg rn, int32_t offset)
@@ -2399,9 +2406,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_deposit(s, COND_AL, args[0], args[2],
                         args[3], args[4], const_args[2]);
         break;
-    case INDEX_op_sextract_i32:
-        tcg_out_sextract(s, COND_AL, args[0], args[1], args[2], args[3]);
-        break;
     case INDEX_op_extract2_i32:
         /* ??? These optimization vs zero should be generic.  */
         /* ??? But we can't substitute 2 for 1 in the opcode stream yet.  */
@@ -2448,7 +2452,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld16u_i32:
     case INDEX_op_ld16s_i32:
     case INDEX_op_ld_i32:
-    case INDEX_op_sextract_i32:
         return C_O1_I1(r, r);
 
     case INDEX_op_st8_i32:
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index b26c93bdb1..6a5414ab3a 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -3180,6 +3180,38 @@ static const TCGOutOpExtract outop_extract = {
     .out_rr = tgen_extract,
 };
 
+static void tgen_sextract(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1,
+                          unsigned ofs, unsigned len)
+{
+    if (ofs == 0) {
+        switch (len) {
+        case 8:
+            tcg_out_ext8s(s, type, a0, a1);
+            return;
+        case 16:
+            tcg_out_ext16s(s, type, a0, a1);
+            return;
+        case 32:
+            tcg_out_ext32s(s, a0, a1);
+            return;
+        }
+    } else if (ofs == 8 && len == 8) {
+        if (type == TCG_TYPE_I32 && a1 < 4 && a0 < 8) {
+            tcg_out_modrm(s, OPC_MOVSBL, a0, a1 + 4);
+        } else {
+            tcg_out_ext16s(s, type, a0, a1);
+            tgen_sari(s, type, a0, a0, 8);
+        }
+        return;
+    }
+    g_assert_not_reached();
+}
+
+static const TCGOutOpExtract outop_sextract = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = tgen_sextract,
+};
+
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
                        const int const_args[TCG_MAX_OP_ARGS])
@@ -3369,35 +3401,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    case INDEX_op_sextract_i64:
-        if (a2 == 0 && args[3] == 8) {
-            tcg_out_ext8s(s, TCG_TYPE_I64, a0, a1);
-        } else if (a2 == 0 && args[3] == 16) {
-            tcg_out_ext16s(s, TCG_TYPE_I64, a0, a1);
-        } else if (a2 == 0 && args[3] == 32) {
-            tcg_out_ext32s(s, a0, a1);
-        } else {
-            g_assert_not_reached();
-        }
-        break;
-
-    case INDEX_op_sextract_i32:
-        if (a2 == 0 && args[3] == 8) {
-            tcg_out_ext8s(s, TCG_TYPE_I32, a0, a1);
-        } else if (a2 == 0 && args[3] == 16) {
-            tcg_out_ext16s(s, TCG_TYPE_I32, a0, a1);
-        } else if (a2 == 8 && args[3] == 8) {
-            if (a1 < 4 && a0 < 8) {
-                tcg_out_modrm(s, OPC_MOVSBL, a0, a1 + 4);
-            } else {
-                tcg_out_ext16s(s, TCG_TYPE_I32, a0, a1);
-                tcg_out_shifti(s, SHIFT_SAR, a0, 8);
-            }
-        } else {
-            g_assert_not_reached();
-        }
-        break;
-
     OP_32_64(extract2):
         /* Note that SHRD outputs to the r/m operand.  */
         tcg_out_modrm(s, OPC_SHRD_Ib + rexw, a2, a0);
@@ -4001,8 +4004,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
     case INDEX_op_extrl_i64_i32:
-    case INDEX_op_sextract_i32:
-    case INDEX_op_sextract_i64:
         return C_O1_I1(r, r);
 
     case INDEX_op_extract2_i32:
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index f63d33e9ac..2ea5234097 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -1816,6 +1816,33 @@ static const TCGOutOpExtract outop_extract = {
     .out_rr = tgen_extract,
 };
 
+static void tgen_sextract(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1,
+                          unsigned ofs, unsigned len)
+{
+    if (ofs == 0) {
+        switch (len) {
+        case 8:
+            tcg_out_ext8s(s, type, a0, a1);
+            return;
+        case 16:
+            tcg_out_ext16s(s, type, a0, a1);
+            return;
+        case 32:
+            tcg_out_ext32s(s, a0, a1);
+            return;
+        }
+    } else if (ofs + len == 32) {
+        tcg_out_opc_srai_w(s, a0, a1, ofs);
+        return;
+    }
+    g_assert_not_reached();
+}
+
+static const TCGOutOpExtract outop_sextract = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = tgen_sextract,
+};
+
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
                        const int const_args[TCG_MAX_OP_ARGS])
@@ -1844,26 +1871,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_opc_srai_d(s, a0, a1, 32);
         break;
 
-    case INDEX_op_sextract_i64:
-        if (a2 + args[3] == 32) {
-            if (a2 == 0) {
-                tcg_out_ext32s(s, a0, a1);
-            } else {
-                tcg_out_opc_srai_w(s, a0, a1, a2);
-            }
-            break;
-        }
-        /* FALLTHRU */
-    case INDEX_op_sextract_i32:
-        if (a2 == 0 && args[3] == 8) {
-            tcg_out_ext8s(s, TCG_TYPE_REG, a0, a1);
-        } else if (a2 == 0 && args[3] == 16) {
-            tcg_out_ext16s(s, TCG_TYPE_REG, a0, a1);
-        } else {
-            g_assert_not_reached();
-        }
-        break;
-
     case INDEX_op_deposit_i32:
         tcg_out_opc_bstrins_w(s, a0, a2, args[3], args[3] + args[4] - 1);
         break;
@@ -2462,8 +2469,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_extrl_i64_i32:
     case INDEX_op_extrh_i64_i32:
     case INDEX_op_ext_i32_i64:
-    case INDEX_op_sextract_i32:
-    case INDEX_op_sextract_i64:
     case INDEX_op_ld8s_i32:
     case INDEX_op_ld8s_i64:
     case INDEX_op_ld8u_i32:
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index dbb4b9355d..56c58bf82d 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -2221,6 +2221,30 @@ static const TCGOutOpExtract outop_extract = {
     .out_rr = tgen_extract,
 };
 
+static void tgen_sextract(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1,
+                          unsigned ofs, unsigned len)
+{
+    if (ofs == 0) {
+        switch (len) {
+        case 8:
+            tcg_out_ext8s(s, type, a0, a1);
+            return;
+        case 16:
+            tcg_out_ext16s(s, type, a0, a1);
+            return;
+        case 32:
+            tcg_out_ext32s(s, a0, a1);
+            return;
+        }
+    }
+    g_assert_not_reached();
+}
+
+static const TCGOutOpExtract outop_sextract = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = tgen_sextract,
+};
+
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
                        const int const_args[TCG_MAX_OP_ARGS])
@@ -2303,22 +2327,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                          args[3] + args[4] - 1, args[3]);
         break;
 
-    case INDEX_op_sextract_i64:
-        if (a2 == 0 && args[3] == 32) {
-            tcg_out_ext32s(s, a0, a1);
-            break;
-        }
-        /* FALLTHRU */
-    case INDEX_op_sextract_i32:
-        if (a2 == 0 && args[3] == 8) {
-            tcg_out_ext8s(s, TCG_TYPE_REG, a0, a1);
-        } else if (a2 == 0 && args[3] == 16) {
-            tcg_out_ext16s(s, TCG_TYPE_REG, a0, a1);
-        } else {
-            g_assert_not_reached();
-        }
-        break;
-
     case INDEX_op_qemu_ld_i32:
         tcg_out_qemu_ld(s, a0, 0, a1, a2, TCG_TYPE_I32);
         break;
@@ -2376,7 +2384,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld16u_i32:
     case INDEX_op_ld16s_i32:
     case INDEX_op_ld_i32:
-    case INDEX_op_sextract_i32:
     case INDEX_op_ld8u_i64:
     case INDEX_op_ld8s_i64:
     case INDEX_op_ld16u_i64:
@@ -2388,7 +2395,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_extu_i32_i64:
     case INDEX_op_extrl_i64_i32:
     case INDEX_op_extrh_i64_i32:
-    case INDEX_op_sextract_i64:
         return C_O1_I1(r, r);
 
     case INDEX_op_st8_i32:
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index a8558a47b7..3d1ffa9130 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -3434,6 +3434,33 @@ static const TCGOutOpExtract outop_extract = {
     .out_rr = tgen_extract,
 };
 
+static void tgen_sextract(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1,
+                          unsigned ofs, unsigned len)
+{
+    if (ofs == 0) {
+        switch (len) {
+        case 8:
+            tcg_out_ext8s(s, type, a0, a1);
+            return;
+        case 16:
+            tcg_out_ext16s(s, type, a0, a1);
+            return;
+        case 32:
+            tcg_out_ext32s(s, a0, a1);
+            return;
+        }
+    } else if (ofs + len == 32) {
+        tcg_out_sari32(s, a0, a1, ofs);
+        return;
+    }
+    g_assert_not_reached();
+}
+
+static const TCGOutOpExtract outop_sextract = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = tgen_sextract,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -3555,26 +3582,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    case INDEX_op_sextract_i64:
-        if (args[2] + args[3] == 32) {
-            if (args[2] == 0) {
-                tcg_out_ext32s(s, args[0], args[1]);
-            } else {
-                tcg_out_sari32(s, args[0], args[1], args[2]);
-            }
-            break;
-        }
-        /* FALLTHRU */
-    case INDEX_op_sextract_i32:
-        if (args[2] == 0 && args[3] == 8) {
-            tcg_out_ext8s(s, TCG_TYPE_I32, args[0], args[1]);
-        } else if (args[2] == 0 && args[3] == 16) {
-            tcg_out_ext16s(s, TCG_TYPE_I32, args[0], args[1]);
-        } else {
-            g_assert_not_reached();
-        }
-        break;
-
 #if TCG_TARGET_REG_BITS == 64
     case INDEX_op_add2_i64:
 #else
@@ -4256,7 +4263,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld16u_i32:
     case INDEX_op_ld16s_i32:
     case INDEX_op_ld_i32:
-    case INDEX_op_sextract_i32:
     case INDEX_op_ld8u_i64:
     case INDEX_op_ld8s_i64:
     case INDEX_op_ld16u_i64:
@@ -4266,7 +4272,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld_i64:
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
-    case INDEX_op_sextract_i64:
         return C_O1_I1(r, r);
 
     case INDEX_op_st8_i32:
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index 85d978763c..dc2b487844 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -2501,6 +2501,33 @@ static const TCGOutOpExtract outop_extract = {
     .out_rr = tgen_extract,
 };
 
+static void tgen_sextract(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1,
+                          unsigned ofs, unsigned len)
+{
+    if (ofs == 0) {
+        switch (len) {
+        case 8:
+            tcg_out_ext8s(s, type, a0, a1);
+            return;
+        case 16:
+            tcg_out_ext16s(s, type, a0, a1);
+            return;
+        case 32:
+            tcg_out_ext32s(s, a0, a1);
+            return;
+        }
+    } else if (ofs + len == 32) {
+        tgen_sari(s, TCG_TYPE_I32, a0, a1, ofs);
+        return;
+    }
+    g_assert_not_reached();
+}
+
+static const TCGOutOpExtract outop_sextract = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = tgen_sextract,
+};
+
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
                        const int const_args[TCG_MAX_OP_ARGS])
@@ -2600,26 +2627,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_mb(s, a0);
         break;
 
-    case INDEX_op_sextract_i64:
-        if (a2 + args[3] == 32) {
-            if (a2 == 0) {
-                tcg_out_ext32s(s, a0, a1);
-            } else {
-                tcg_out_opc_imm(s, OPC_SRAIW, a0, a1, a2);
-            }
-            break;
-        }
-        /* FALLTHRU */
-    case INDEX_op_sextract_i32:
-        if (a2 == 0 && args[3] == 8) {
-            tcg_out_ext8s(s, TCG_TYPE_REG, a0, a1);
-        } else if (a2 == 0 && args[3] == 16) {
-            tcg_out_ext16s(s, TCG_TYPE_REG, a0, a1);
-        } else {
-            g_assert_not_reached();
-        }
-        break;
-
     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
@@ -2871,8 +2878,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_extrl_i64_i32:
     case INDEX_op_extrh_i64_i32:
     case INDEX_op_ext_i32_i64:
-    case INDEX_op_sextract_i32:
-    case INDEX_op_sextract_i64:
         return C_O1_I1(r, r);
 
     case INDEX_op_st8_i32:
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index 96e2dc0ad5..ab178bebc8 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -1587,8 +1587,8 @@ static const TCGOutOpExtract outop_extract = {
     .out_rr = tgen_extract,
 };
 
-static void tgen_sextract(TCGContext *s, TCGReg dest, TCGReg src,
-                          int ofs, int len)
+static void tgen_sextract(TCGContext *s, TCGType type, TCGReg dest,
+                          TCGReg src, unsigned ofs, unsigned len)
 {
     if (ofs == 0) {
         switch (len) {
@@ -1606,6 +1606,11 @@ static void tgen_sextract(TCGContext *s, TCGReg dest, TCGReg src,
     g_assert_not_reached();
 }
 
+static const TCGOutOpExtract outop_sextract = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = tgen_sextract,
+};
+
 static void tgen_gotoi(TCGContext *s, int cc, const tcg_insn_unit *dest)
 {
     ptrdiff_t off = tcg_pcrel_diff(s, dest) >> 1;
@@ -2980,10 +2985,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    OP_32_64(sextract):
-        tgen_sextract(s, args[0], args[1], args[2], args[3]);
-        break;
-
     case INDEX_op_mb:
         /* The host memory model is quite strong, we simply need to
            serialize the instruction stream.  */
@@ -3472,8 +3473,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
-    case INDEX_op_sextract_i32:
-    case INDEX_op_sextract_i64:
         return C_O1_I1(r, r);
 
     case INDEX_op_qemu_ld_i32:
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index cba1dd009c..0f2bec21e9 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -1769,6 +1769,18 @@ static const TCGOutOpExtract outop_extract = {
     .out_rr = tgen_extract,
 };
 
+static void tgen_sextract(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1,
+                          unsigned ofs, unsigned len)
+{
+    tcg_debug_assert(ofs + len == 32);
+    tcg_out_arithi(s, a0, a1, ofs, SHIFT_SRA);
+}
+
+static const TCGOutOpExtract outop_sextract = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = tgen_sextract,
+};
+
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
                        const int const_args[TCG_MAX_OP_ARGS])
@@ -1868,11 +1880,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_mb(s, a0);
         break;
 
-    case INDEX_op_sextract_i64:
-        tcg_debug_assert(a2 + args[3] == 32);
-        tcg_out_arithi(s, a0, a1, a2, SHIFT_SRA);
-        break;
-
     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
@@ -1904,7 +1911,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld_i64:
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
-    case INDEX_op_sextract_i64:
     case INDEX_op_qemu_ld_i32:
     case INDEX_op_qemu_ld_i64:
         return C_O1_I1(r, r);
diff --git a/tcg/tcg.c b/tcg/tcg.c
index ce0d862b19..7f5fa25062 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1111,6 +1111,8 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_rotr, TCGOutOpBinary, outop_rotr),
     OUTOP(INDEX_op_sar, TCGOutOpBinary, outop_sar),
     OUTOP(INDEX_op_setcond, TCGOutOpSetcond, outop_setcond),
+    OUTOP(INDEX_op_sextract_i32, TCGOutOpExtract, outop_sextract),
+    OUTOP(INDEX_op_sextract_i64, TCGOutOpExtract, outop_sextract),
     OUTOP(INDEX_op_shl, TCGOutOpBinary, outop_shl),
     OUTOP(INDEX_op_shr, TCGOutOpBinary, outop_shr),
     OUTOP(INDEX_op_sub, TCGOutOpSubtract, outop_sub),
@@ -5518,6 +5520,8 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
         break;
 
     case INDEX_op_extract:
+    case INDEX_op_sextract_i32:
+    case INDEX_op_sextract_i64:
         {
             const TCGOutOpExtract *out =
                 container_of(all_outop[op->opc], TCGOutOpExtract, base);
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index ede11d9e70..e013321ac7 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -57,8 +57,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld_i64:
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
-    case INDEX_op_sextract_i32:
-    case INDEX_op_sextract_i64:
         return C_O1_I1(r, r);
 
     case INDEX_op_st8_i32:
@@ -453,6 +451,11 @@ static void tcg_out_sextract(TCGContext *s, TCGType type, TCGReg rd,
     tcg_out_op_rrbb(s, opc, rd, rs, pos, len);
 }
 
+static const TCGOutOpExtract outop_sextract = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = tcg_out_sextract,
+};
+
 static void tcg_out_ext8s(TCGContext *s, TCGType type, TCGReg rd, TCGReg rs)
 {
     tcg_out_sextract(s, type, rd, rs, 0, 8);
@@ -1078,10 +1081,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_op_rrrbb(s, opc, args[0], args[1], args[2], args[3], args[4]);
         break;
 
-    CASE_32_64(sextract) /* Optional (TCG_TARGET_HAS_sextract_*). */
-        tcg_out_op_rrbb(s, opc, args[0], args[1], args[2], args[3]);
-        break;
-
     CASE_32_64(add2)
     CASE_32_64(sub2)
         tcg_out_op_rrrrrr(s, opc, args[0], args[1], args[2],

From fa361eefac24dcaa1d6dfbc433fce0652fdd8ba8 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sun, 12 Jan 2025 11:50:09 -0800
Subject: [PATCH 0455/2760] tcg: Merge INDEX_op_sextract_{i32,i64}
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 docs/devel/tcg-ops.rst   |  2 +-
 include/tcg/tcg-opc.h    |  3 +--
 tcg/optimize.c           | 22 +++-------------------
 tcg/tcg-op.c             | 12 ++++++------
 tcg/tcg.c                |  9 +++------
 tcg/tci.c                | 12 ++++--------
 tcg/tci/tcg-target.c.inc |  5 +----
 7 files changed, 19 insertions(+), 46 deletions(-)

diff --git a/docs/devel/tcg-ops.rst b/docs/devel/tcg-ops.rst
index 2843f88772..ca7550f68c 100644
--- a/docs/devel/tcg-ops.rst
+++ b/docs/devel/tcg-ops.rst
@@ -458,7 +458,7 @@ Misc
 
    * - extract *dest*, *t1*, *pos*, *len*
 
-       sextract_i32/i64 *dest*, *t1*, *pos*, *len*
+       sextract *dest*, *t1*, *pos*, *len*
 
      - | Extract a bitfield from *t1*, placing the result in *dest*.
        |
diff --git a/include/tcg/tcg-opc.h b/include/tcg/tcg-opc.h
index a8c304ca63..4ace1f85c4 100644
--- a/include/tcg/tcg-opc.h
+++ b/include/tcg/tcg-opc.h
@@ -74,6 +74,7 @@ DEF(rotl, 1, 2, 0, TCG_OPF_INT)
 DEF(rotr, 1, 2, 0, TCG_OPF_INT)
 DEF(sar, 1, 2, 0, TCG_OPF_INT)
 DEF(setcond, 1, 2, 1, TCG_OPF_INT)
+DEF(sextract, 1, 1, 2, TCG_OPF_INT)
 DEF(shl, 1, 2, 0, TCG_OPF_INT)
 DEF(shr, 1, 2, 0, TCG_OPF_INT)
 DEF(sub, 1, 2, 0, TCG_OPF_INT)
@@ -90,7 +91,6 @@ DEF(st16_i32, 0, 2, 1, 0)
 DEF(st_i32, 0, 2, 1, 0)
 /* shifts/rotates */
 DEF(deposit_i32, 1, 2, 2, 0)
-DEF(sextract_i32, 1, 1, 2, 0)
 DEF(extract2_i32, 1, 2, 1, 0)
 
 DEF(add2_i32, 2, 4, 0, 0)
@@ -112,7 +112,6 @@ DEF(st32_i64, 0, 2, 1, 0)
 DEF(st_i64, 0, 2, 1, 0)
 /* shifts/rotates */
 DEF(deposit_i64, 1, 2, 2, 0)
-DEF(sextract_i64, 1, 1, 2, 0)
 DEF(extract2_i64, 1, 2, 1, 0)
 
 /* size changing ops */
diff --git a/tcg/optimize.c b/tcg/optimize.c
index fbfcbf23cd..d324cbf7fe 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -2317,7 +2317,6 @@ static int fold_setcond_zmask(OptContext *ctx, TCGOp *op, bool neg)
 
 static void fold_setcond_tst_pow2(OptContext *ctx, TCGOp *op, bool neg)
 {
-    TCGOpcode sext_opc = 0;
     TCGCond cond = op->args[3];
     TCGArg ret, src1, src2;
     TCGOp *op2;
@@ -2336,27 +2335,12 @@ static void fold_setcond_tst_pow2(OptContext *ctx, TCGOp *op, bool neg)
     }
     sh = ctz64(val);
 
-    switch (ctx->type) {
-    case TCG_TYPE_I32:
-        if (TCG_TARGET_sextract_valid(TCG_TYPE_I32, sh, 1)) {
-            sext_opc = INDEX_op_sextract_i32;
-        }
-        break;
-    case TCG_TYPE_I64:
-        if (TCG_TARGET_sextract_valid(TCG_TYPE_I64, sh, 1)) {
-            sext_opc = INDEX_op_sextract_i64;
-        }
-        break;
-    default:
-        g_assert_not_reached();
-    }
-
     ret = op->args[0];
     src1 = op->args[1];
     inv = cond == TCG_COND_TSTEQ;
 
-    if (sh && sext_opc && neg && !inv) {
-        op->opc = sext_opc;
+    if (sh && neg && !inv && TCG_TARGET_sextract_valid(ctx->type, sh, 1)) {
+        op->opc = INDEX_op_sextract;
         op->args[1] = src1;
         op->args[2] = sh;
         op->args[3] = 1;
@@ -3019,7 +3003,7 @@ void tcg_optimize(TCGContext *s)
         case INDEX_op_bitsel_vec:
             done = fold_bitsel_vec(&ctx, op);
             break;
-        CASE_OP_32_64(sextract):
+        case INDEX_op_sextract:
             done = fold_sextract(&ctx, op);
             break;
         case INDEX_op_sub:
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index ddade73b7b..d3f3c9d248 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -1043,19 +1043,19 @@ void tcg_gen_sextract_i32(TCGv_i32 ret, TCGv_i32 arg,
     }
 
     if (TCG_TARGET_sextract_valid(TCG_TYPE_I32, ofs, len)) {
-        tcg_gen_op4ii_i32(INDEX_op_sextract_i32, ret, arg, ofs, len);
+        tcg_gen_op4ii_i32(INDEX_op_sextract, ret, arg, ofs, len);
         return;
     }
 
     /* Assume that sign-extension, if available, is cheaper than a shift.  */
     if (TCG_TARGET_sextract_valid(TCG_TYPE_I32, 0, ofs + len)) {
-        tcg_gen_op4ii_i32(INDEX_op_sextract_i32, ret, arg, 0, ofs + len);
+        tcg_gen_op4ii_i32(INDEX_op_sextract, ret, arg, 0, ofs + len);
         tcg_gen_sari_i32(ret, ret, ofs);
         return;
     }
     if (TCG_TARGET_sextract_valid(TCG_TYPE_I32, 0, len)) {
         tcg_gen_shri_i32(ret, arg, ofs);
-        tcg_gen_op4ii_i32(INDEX_op_sextract_i32, ret, ret, 0, len);
+        tcg_gen_op4ii_i32(INDEX_op_sextract, ret, ret, 0, len);
         return;
     }
 
@@ -2747,19 +2747,19 @@ void tcg_gen_sextract_i64(TCGv_i64 ret, TCGv_i64 arg,
     }
 
     if (TCG_TARGET_sextract_valid(TCG_TYPE_I64, ofs, len)) {
-        tcg_gen_op4ii_i64(INDEX_op_sextract_i64, ret, arg, ofs, len);
+        tcg_gen_op4ii_i64(INDEX_op_sextract, ret, arg, ofs, len);
         return;
     }
 
     /* Assume that sign-extension, if available, is cheaper than a shift.  */
     if (TCG_TARGET_sextract_valid(TCG_TYPE_I64, 0, ofs + len)) {
-        tcg_gen_op4ii_i64(INDEX_op_sextract_i64, ret, arg, 0, ofs + len);
+        tcg_gen_op4ii_i64(INDEX_op_sextract, ret, arg, 0, ofs + len);
         tcg_gen_sari_i64(ret, ret, ofs);
         return;
     }
     if (TCG_TARGET_sextract_valid(TCG_TYPE_I64, 0, len)) {
         tcg_gen_shri_i64(ret, arg, ofs);
-        tcg_gen_op4ii_i64(INDEX_op_sextract_i64, ret, ret, 0, len);
+        tcg_gen_op4ii_i64(INDEX_op_sextract, ret, ret, 0, len);
         return;
     }
 
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 7f5fa25062..c7ce13cda0 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1111,8 +1111,7 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_rotr, TCGOutOpBinary, outop_rotr),
     OUTOP(INDEX_op_sar, TCGOutOpBinary, outop_sar),
     OUTOP(INDEX_op_setcond, TCGOutOpSetcond, outop_setcond),
-    OUTOP(INDEX_op_sextract_i32, TCGOutOpExtract, outop_sextract),
-    OUTOP(INDEX_op_sextract_i64, TCGOutOpExtract, outop_sextract),
+    OUTOP(INDEX_op_sextract, TCGOutOpExtract, outop_sextract),
     OUTOP(INDEX_op_shl, TCGOutOpBinary, outop_shl),
     OUTOP(INDEX_op_shr, TCGOutOpBinary, outop_shr),
     OUTOP(INDEX_op_sub, TCGOutOpSubtract, outop_sub),
@@ -2333,6 +2332,7 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_negsetcond:
     case INDEX_op_or:
     case INDEX_op_setcond:
+    case INDEX_op_sextract:
     case INDEX_op_xor:
         return has_type;
 
@@ -2344,7 +2344,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st8_i32:
     case INDEX_op_st16_i32:
     case INDEX_op_st_i32:
-    case INDEX_op_sextract_i32:
     case INDEX_op_deposit_i32:
         return true;
 
@@ -2372,7 +2371,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
-    case INDEX_op_sextract_i64:
     case INDEX_op_deposit_i64:
         return TCG_TARGET_REG_BITS == 64;
 
@@ -5520,8 +5518,7 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
         break;
 
     case INDEX_op_extract:
-    case INDEX_op_sextract_i32:
-    case INDEX_op_sextract_i64:
+    case INDEX_op_sextract:
         {
             const TCGOutOpExtract *out =
                 container_of(all_outop[op->opc], TCGOutOpExtract, base);
diff --git a/tcg/tci.c b/tcg/tci.c
index 6345029802..5a07d65db8 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -28,6 +28,7 @@
 
 #define ctpop_tr    glue(ctpop, TCG_TARGET_REG_BITS)
 #define extract_tr  glue(extract, TCG_TARGET_REG_BITS)
+#define sextract_tr glue(sextract, TCG_TARGET_REG_BITS)
 
 /*
  * Enable TCI assertions only when debugging TCG (and without NDEBUG defined).
@@ -661,9 +662,9 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_args_rrbb(insn, &r0, &r1, &pos, &len);
             regs[r0] = extract_tr(regs[r1], pos, len);
             break;
-        case INDEX_op_sextract_i32:
+        case INDEX_op_sextract:
             tci_args_rrbb(insn, &r0, &r1, &pos, &len);
-            regs[r0] = sextract32(regs[r1], pos, len);
+            regs[r0] = sextract_tr(regs[r1], pos, len);
             break;
         case INDEX_op_brcond:
             tci_args_rl(insn, tb_ptr, &r0, &ptr);
@@ -773,10 +774,6 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_args_rrrbb(insn, &r0, &r1, &r2, &pos, &len);
             regs[r0] = deposit64(regs[r1], pos, len, regs[r2]);
             break;
-        case INDEX_op_sextract_i64:
-            tci_args_rrbb(insn, &r0, &r1, &pos, &len);
-            regs[r0] = sextract64(regs[r1], pos, len);
-            break;
         case INDEX_op_ext_i32_i64:
             tci_args_rr(insn, &r0, &r1);
             regs[r0] = (int32_t)regs[r1];
@@ -1055,8 +1052,7 @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
         break;
 
     case INDEX_op_extract:
-    case INDEX_op_sextract_i32:
-    case INDEX_op_sextract_i64:
+    case INDEX_op_sextract:
         tci_args_rrbb(insn, &r0, &r1, &pos, &len);
         info->fprintf_func(info->stream, "%-12s  %s,%s,%d,%d",
                            op_name, str_r(r0), str_r(r1), pos, len);
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index e013321ac7..9ba108ef8d 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -445,10 +445,7 @@ static const TCGOutOpExtract outop_extract = {
 static void tcg_out_sextract(TCGContext *s, TCGType type, TCGReg rd,
                              TCGReg rs, unsigned pos, unsigned len)
 {
-    TCGOpcode opc = type == TCG_TYPE_I32 ?
-                    INDEX_op_sextract_i32 :
-                    INDEX_op_sextract_i64;
-    tcg_out_op_rrbb(s, opc, rd, rs, pos, len);
+    tcg_out_op_rrbb(s, INDEX_op_sextract, rd, rs, pos, len);
 }
 
 static const TCGOutOpExtract outop_sextract = {

From b7b7347fe391f134c7ea616c0593d3ea835d5eea Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sun, 12 Jan 2025 12:22:45 -0800
Subject: [PATCH 0456/2760] tcg: Convert ext_i32_i64 to TCGOutOpUnary

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target.c.inc     |  2 --
 tcg/i386/tcg-target.c.inc        |  2 --
 tcg/loongarch64/tcg-target.c.inc |  2 --
 tcg/mips/tcg-target.c.inc        |  2 --
 tcg/ppc/tcg-target.c.inc         |  2 --
 tcg/riscv/tcg-target.c.inc       |  2 --
 tcg/s390x/tcg-target.c.inc       |  2 --
 tcg/sparc64/tcg-target.c.inc     |  2 --
 tcg/tcg.c                        | 22 +++++++++++++++++++---
 tcg/tci/tcg-target.c.inc         |  2 --
 10 files changed, 19 insertions(+), 21 deletions(-)

diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index 00400f6ea7..68f7a1cec2 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -2710,7 +2710,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType ext,
     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
-    case INDEX_op_ext_i32_i64:  /* Always emitted via tcg_reg_alloc_op.  */
     case INDEX_op_extu_i32_i64:
     case INDEX_op_extrl_i64_i32:
     default:
@@ -3177,7 +3176,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld32u_i64:
     case INDEX_op_ld32s_i64:
     case INDEX_op_ld_i64:
-    case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
         return C_O1_I1(r, r);
 
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index 6a5414ab3a..14b912beb7 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -3413,7 +3413,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
-    case INDEX_op_ext_i32_i64:  /* Always emitted via tcg_reg_alloc_op.  */
     case INDEX_op_extu_i32_i64:
     case INDEX_op_extrl_i64_i32:
     default:
@@ -4001,7 +4000,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_extrh_i64_i32:
         return C_O1_I1(r, 0);
 
-    case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
     case INDEX_op_extrl_i64_i32:
         return C_O1_I1(r, r);
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index 2ea5234097..2a9c7fc10a 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -1943,7 +1943,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
-    case INDEX_op_ext_i32_i64:  /* Always emitted via tcg_reg_alloc_op.  */
     case INDEX_op_extu_i32_i64:
     case INDEX_op_extrl_i64_i32:
     default:
@@ -2468,7 +2467,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_extu_i32_i64:
     case INDEX_op_extrl_i64_i32:
     case INDEX_op_extrh_i64_i32:
-    case INDEX_op_ext_i32_i64:
     case INDEX_op_ld8s_i32:
     case INDEX_op_ld8s_i64:
     case INDEX_op_ld8u_i32:
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index 56c58bf82d..e992a468eb 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -2364,7 +2364,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
-    case INDEX_op_ext_i32_i64:  /* Always emitted via tcg_reg_alloc_op.  */
     case INDEX_op_extu_i32_i64:
     case INDEX_op_extrl_i64_i32:
     default:
@@ -2391,7 +2390,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld32s_i64:
     case INDEX_op_ld32u_i64:
     case INDEX_op_ld_i64:
-    case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
     case INDEX_op_extrl_i64_i32:
     case INDEX_op_extrh_i64_i32:
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index 3d1ffa9130..fea767573c 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -3640,7 +3640,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     case INDEX_op_call:      /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:   /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:   /* Always emitted via tcg_out_goto_tb.  */
-    case INDEX_op_ext_i32_i64:  /* Always emitted via tcg_reg_alloc_op.  */
     case INDEX_op_extu_i32_i64:
     case INDEX_op_extrl_i64_i32:
     default:
@@ -4270,7 +4269,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld32u_i64:
     case INDEX_op_ld32s_i64:
     case INDEX_op_ld_i64:
-    case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
         return C_O1_I1(r, r);
 
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index dc2b487844..e5fe15c338 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -2630,7 +2630,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
-    case INDEX_op_ext_i32_i64:  /* Always emitted via tcg_reg_alloc_op.  */
     case INDEX_op_extu_i32_i64:
     case INDEX_op_extrl_i64_i32:
     default:
@@ -2877,7 +2876,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_extu_i32_i64:
     case INDEX_op_extrl_i64_i32:
     case INDEX_op_extrh_i64_i32:
-    case INDEX_op_ext_i32_i64:
         return C_O1_I1(r, r);
 
     case INDEX_op_st8_i32:
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index ab178bebc8..5c5a38c2c8 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -2997,7 +2997,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
-    case INDEX_op_ext_i32_i64:  /* Always emitted via tcg_reg_alloc_op.  */
     case INDEX_op_extu_i32_i64:
     case INDEX_op_extrl_i64_i32:
     default:
@@ -3471,7 +3470,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(r, r);
 
-    case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
         return C_O1_I1(r, r);
 
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index 0f2bec21e9..e93ef8e7f2 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -1883,7 +1883,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
-    case INDEX_op_ext_i32_i64:  /* Always emitted via tcg_reg_alloc_op.  */
     case INDEX_op_extu_i32_i64:
     default:
         g_assert_not_reached();
@@ -1909,7 +1908,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld32u_i64:
     case INDEX_op_ld32s_i64:
     case INDEX_op_ld_i64:
-    case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
     case INDEX_op_qemu_ld_i32:
     case INDEX_op_qemu_ld_i64:
diff --git a/tcg/tcg.c b/tcg/tcg.c
index c7ce13cda0..6bce097eac 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1068,6 +1068,23 @@ QEMU_BUILD_BUG_ON((int)(offsetof(CPUNegativeOffsetState, tlb.f[0]) -
                   < MIN_TLB_MASK_TABLE_OFS);
 #endif
 
+#if TCG_TARGET_REG_BITS == 64
+/*
+ * We require these functions for slow-path function calls.
+ * Adapt them generically for opcode output.
+ */
+
+static void tgen_exts_i32_i64(TCGContext *s, TCGType t, TCGReg a0, TCGReg a1)
+{
+    tcg_out_exts_i32_i64(s, a0, a1);
+}
+
+static const TCGOutOpUnary outop_exts_i32_i64 = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = tgen_exts_i32_i64,
+};
+#endif
+
 /*
  * Register V as the TCGOutOp for O.
  * This verifies that V is of type T, otherwise give a nice compiler error.
@@ -1122,6 +1139,7 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_setcond2_i32, TCGOutOpSetcond2, outop_setcond2),
 #else
     OUTOP(INDEX_op_bswap64, TCGOutOpUnary, outop_bswap64),
+    OUTOP(INDEX_op_ext_i32_i64, TCGOutOpUnary, outop_exts_i32_i64),
 #endif
 };
 
@@ -5412,9 +5430,6 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
     /* emit instruction */
     TCGType type = TCGOP_TYPE(op);
     switch (op->opc) {
-    case INDEX_op_ext_i32_i64:
-        tcg_out_exts_i32_i64(s, new_args[0], new_args[1]);
-        break;
     case INDEX_op_extu_i32_i64:
         tcg_out_extu_i32_i64(s, new_args[0], new_args[1]);
         break;
@@ -5477,6 +5492,7 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
         break;
 
     case INDEX_op_bswap64:
+    case INDEX_op_ext_i32_i64:
         assert(TCG_TARGET_REG_BITS == 64);
         /* fall through */
     case INDEX_op_ctpop:
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index 9ba108ef8d..ecff90404f 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -55,7 +55,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld32u_i64:
     case INDEX_op_ld32s_i64:
     case INDEX_op_ld_i64:
-    case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
         return C_O1_I1(r, r);
 
@@ -1109,7 +1108,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
-    case INDEX_op_ext_i32_i64:  /* Always emitted via tcg_reg_alloc_op.  */
     case INDEX_op_extu_i32_i64:
     case INDEX_op_extrl_i64_i32:
     default:

From c1ad25de11ccf47a650c860f490864dcf7fe7675 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sun, 12 Jan 2025 12:34:45 -0800
Subject: [PATCH 0457/2760] tcg: Convert extu_i32_i64 to TCGOutOpUnary

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target.c.inc     |  2 --
 tcg/i386/tcg-target.c.inc        |  2 --
 tcg/loongarch64/tcg-target.c.inc |  2 --
 tcg/mips/tcg-target.c.inc        |  2 --
 tcg/ppc/tcg-target.c.inc         |  2 --
 tcg/riscv/tcg-target.c.inc       |  2 --
 tcg/s390x/tcg-target.c.inc       |  4 ----
 tcg/sparc64/tcg-target.c.inc     |  2 --
 tcg/tcg.c                        | 15 ++++++++++++---
 tcg/tci/tcg-target.c.inc         |  2 --
 10 files changed, 12 insertions(+), 23 deletions(-)

diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index 68f7a1cec2..44314f6a0f 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -2710,7 +2710,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType ext,
     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
-    case INDEX_op_extu_i32_i64:
     case INDEX_op_extrl_i64_i32:
     default:
         g_assert_not_reached();
@@ -3176,7 +3175,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld32u_i64:
     case INDEX_op_ld32s_i64:
     case INDEX_op_ld_i64:
-    case INDEX_op_extu_i32_i64:
         return C_O1_I1(r, r);
 
     case INDEX_op_st8_i32:
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index 14b912beb7..8371cfaf5a 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -3413,7 +3413,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
-    case INDEX_op_extu_i32_i64:
     case INDEX_op_extrl_i64_i32:
     default:
         g_assert_not_reached();
@@ -4000,7 +3999,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_extrh_i64_i32:
         return C_O1_I1(r, 0);
 
-    case INDEX_op_extu_i32_i64:
     case INDEX_op_extrl_i64_i32:
         return C_O1_I1(r, r);
 
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index 2a9c7fc10a..60356d5dfd 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -1943,7 +1943,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
-    case INDEX_op_extu_i32_i64:
     case INDEX_op_extrl_i64_i32:
     default:
         g_assert_not_reached();
@@ -2464,7 +2463,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_qemu_st_i128:
         return C_O0_I3(r, r, r);
 
-    case INDEX_op_extu_i32_i64:
     case INDEX_op_extrl_i64_i32:
     case INDEX_op_extrh_i64_i32:
     case INDEX_op_ld8s_i32:
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index e992a468eb..b6b7070fbb 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -2364,7 +2364,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
-    case INDEX_op_extu_i32_i64:
     case INDEX_op_extrl_i64_i32:
     default:
         g_assert_not_reached();
@@ -2390,7 +2389,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld32s_i64:
     case INDEX_op_ld32u_i64:
     case INDEX_op_ld_i64:
-    case INDEX_op_extu_i32_i64:
     case INDEX_op_extrl_i64_i32:
     case INDEX_op_extrh_i64_i32:
         return C_O1_I1(r, r);
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index fea767573c..e1767f1d6c 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -3640,7 +3640,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     case INDEX_op_call:      /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:   /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:   /* Always emitted via tcg_out_goto_tb.  */
-    case INDEX_op_extu_i32_i64:
     case INDEX_op_extrl_i64_i32:
     default:
         g_assert_not_reached();
@@ -4269,7 +4268,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld32u_i64:
     case INDEX_op_ld32s_i64:
     case INDEX_op_ld_i64:
-    case INDEX_op_extu_i32_i64:
         return C_O1_I1(r, r);
 
     case INDEX_op_st8_i32:
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index e5fe15c338..48d4325097 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -2630,7 +2630,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
-    case INDEX_op_extu_i32_i64:
     case INDEX_op_extrl_i64_i32:
     default:
         g_assert_not_reached();
@@ -2873,7 +2872,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld32s_i64:
     case INDEX_op_ld32u_i64:
     case INDEX_op_ld_i64:
-    case INDEX_op_extu_i32_i64:
     case INDEX_op_extrl_i64_i32:
     case INDEX_op_extrh_i64_i32:
         return C_O1_I1(r, r);
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index 5c5a38c2c8..d81b8fb8f4 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -2997,7 +2997,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
-    case INDEX_op_extu_i32_i64:
     case INDEX_op_extrl_i64_i32:
     default:
         g_assert_not_reached();
@@ -3470,9 +3469,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(r, r);
 
-    case INDEX_op_extu_i32_i64:
-        return C_O1_I1(r, r);
-
     case INDEX_op_qemu_ld_i32:
     case INDEX_op_qemu_ld_i64:
         return C_O1_I1(r, r);
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index e93ef8e7f2..d52907f7e3 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -1883,7 +1883,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
-    case INDEX_op_extu_i32_i64:
     default:
         g_assert_not_reached();
     }
@@ -1908,7 +1907,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld32u_i64:
     case INDEX_op_ld32s_i64:
     case INDEX_op_ld_i64:
-    case INDEX_op_extu_i32_i64:
     case INDEX_op_qemu_ld_i32:
     case INDEX_op_qemu_ld_i64:
         return C_O1_I1(r, r);
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 6bce097eac..0b2dc17600 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1083,6 +1083,16 @@ static const TCGOutOpUnary outop_exts_i32_i64 = {
     .base.static_constraint = C_O1_I1(r, r),
     .out_rr = tgen_exts_i32_i64,
 };
+
+static void tgen_extu_i32_i64(TCGContext *s, TCGType t, TCGReg a0, TCGReg a1)
+{
+    tcg_out_extu_i32_i64(s, a0, a1);
+}
+
+static const TCGOutOpUnary outop_extu_i32_i64 = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = tgen_extu_i32_i64,
+};
 #endif
 
 /*
@@ -1140,6 +1150,7 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
 #else
     OUTOP(INDEX_op_bswap64, TCGOutOpUnary, outop_bswap64),
     OUTOP(INDEX_op_ext_i32_i64, TCGOutOpUnary, outop_exts_i32_i64),
+    OUTOP(INDEX_op_extu_i32_i64, TCGOutOpUnary, outop_extu_i32_i64),
 #endif
 };
 
@@ -5430,9 +5441,6 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
     /* emit instruction */
     TCGType type = TCGOP_TYPE(op);
     switch (op->opc) {
-    case INDEX_op_extu_i32_i64:
-        tcg_out_extu_i32_i64(s, new_args[0], new_args[1]);
-        break;
     case INDEX_op_extrl_i64_i32:
         tcg_out_extrl_i64_i32(s, new_args[0], new_args[1]);
         break;
@@ -5493,6 +5501,7 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
 
     case INDEX_op_bswap64:
     case INDEX_op_ext_i32_i64:
+    case INDEX_op_extu_i32_i64:
         assert(TCG_TARGET_REG_BITS == 64);
         /* fall through */
     case INDEX_op_ctpop:
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index ecff90404f..3cf2913acd 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -55,7 +55,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld32u_i64:
     case INDEX_op_ld32s_i64:
     case INDEX_op_ld_i64:
-    case INDEX_op_extu_i32_i64:
         return C_O1_I1(r, r);
 
     case INDEX_op_st8_i32:
@@ -1108,7 +1107,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
-    case INDEX_op_extu_i32_i64:
     case INDEX_op_extrl_i64_i32:
     default:
         g_assert_not_reached();

From 1e6fec9dd90756b22331a3c4c6859c51ad3a2c3e Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sun, 12 Jan 2025 12:57:13 -0800
Subject: [PATCH 0458/2760] tcg: Convert extrl_i64_i32 to TCGOutOpUnary

Drop the cast from TCGv_i64 to TCGv_i32 in tcg_gen_extrl_i64_i32
an emit extrl_i64_i32 unconditionally.  Move that special case
to tcg_gen_code when we find out if the output is live or dead.
In this way even hosts that canonicalize truncations can make
use of a store directly from the 64-bit host register.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target.c.inc     |  1 -
 tcg/i386/tcg-target.c.inc        |  4 ----
 tcg/loongarch64/tcg-target.c.inc |  2 --
 tcg/mips/tcg-target.c.inc        |  2 --
 tcg/ppc/tcg-target.c.inc         |  1 -
 tcg/riscv/tcg-target.c.inc       |  2 --
 tcg/s390x/tcg-target.c.inc       |  1 -
 tcg/tcg-op.c                     |  4 +---
 tcg/tcg.c                        | 35 +++++++++++++++++++++++++++-----
 tcg/tci/tcg-target.c.inc         |  1 -
 10 files changed, 31 insertions(+), 22 deletions(-)

diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index 44314f6a0f..8abc5f26da 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -2710,7 +2710,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType ext,
     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
-    case INDEX_op_extrl_i64_i32:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index 8371cfaf5a..9bae60d3b6 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -3413,7 +3413,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
-    case INDEX_op_extrl_i64_i32:
     default:
         g_assert_not_reached();
     }
@@ -3999,9 +3998,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_extrh_i64_i32:
         return C_O1_I1(r, 0);
 
-    case INDEX_op_extrl_i64_i32:
-        return C_O1_I1(r, r);
-
     case INDEX_op_extract2_i32:
     case INDEX_op_extract2_i64:
         return C_O1_I2(r, 0, r);
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index 60356d5dfd..fae1a58c94 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -1943,7 +1943,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
-    case INDEX_op_extrl_i64_i32:
     default:
         g_assert_not_reached();
     }
@@ -2463,7 +2462,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_qemu_st_i128:
         return C_O0_I3(r, r, r);
 
-    case INDEX_op_extrl_i64_i32:
     case INDEX_op_extrh_i64_i32:
     case INDEX_op_ld8s_i32:
     case INDEX_op_ld8s_i64:
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index b6b7070fbb..095eb8f672 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -2364,7 +2364,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
-    case INDEX_op_extrl_i64_i32:
     default:
         g_assert_not_reached();
     }
@@ -2389,7 +2388,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld32s_i64:
     case INDEX_op_ld32u_i64:
     case INDEX_op_ld_i64:
-    case INDEX_op_extrl_i64_i32:
     case INDEX_op_extrh_i64_i32:
         return C_O1_I1(r, r);
 
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index e1767f1d6c..bb03efe055 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -3640,7 +3640,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     case INDEX_op_call:      /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:   /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:   /* Always emitted via tcg_out_goto_tb.  */
-    case INDEX_op_extrl_i64_i32:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index 48d4325097..76ad2df410 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -2630,7 +2630,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
-    case INDEX_op_extrl_i64_i32:
     default:
         g_assert_not_reached();
     }
@@ -2872,7 +2871,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld32s_i64:
     case INDEX_op_ld32u_i64:
     case INDEX_op_ld_i64:
-    case INDEX_op_extrl_i64_i32:
     case INDEX_op_extrh_i64_i32:
         return C_O1_I1(r, r);
 
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index d81b8fb8f4..1ea041c75f 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -2997,7 +2997,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
-    case INDEX_op_extrl_i64_i32:
     default:
         g_assert_not_reached();
     }
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index d3f3c9d248..7ecd1f6c8f 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -2962,11 +2962,9 @@ void tcg_gen_extrl_i64_i32(TCGv_i32 ret, TCGv_i64 arg)
 {
     if (TCG_TARGET_REG_BITS == 32) {
         tcg_gen_mov_i32(ret, TCGV_LOW(arg));
-    } else if (TCG_TARGET_HAS_extr_i64_i32) {
+    } else {
         tcg_gen_op2(INDEX_op_extrl_i64_i32, TCG_TYPE_I32,
                     tcgv_i32_arg(ret), tcgv_i64_arg(arg));
-    } else {
-        tcg_gen_mov_i32(ret, (TCGv_i32)arg);
     }
 }
 
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 0b2dc17600..8fcaf54d32 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1093,6 +1093,16 @@ static const TCGOutOpUnary outop_extu_i32_i64 = {
     .base.static_constraint = C_O1_I1(r, r),
     .out_rr = tgen_extu_i32_i64,
 };
+
+static void tgen_extrl_i64_i32(TCGContext *s, TCGType t, TCGReg a0, TCGReg a1)
+{
+    tcg_out_extrl_i64_i32(s, a0, a1);
+}
+
+static const TCGOutOpUnary outop_extrl_i64_i32 = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = TCG_TARGET_HAS_extr_i64_i32 ? tgen_extrl_i64_i32 : NULL,
+};
 #endif
 
 /*
@@ -1151,6 +1161,7 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_bswap64, TCGOutOpUnary, outop_bswap64),
     OUTOP(INDEX_op_ext_i32_i64, TCGOutOpUnary, outop_exts_i32_i64),
     OUTOP(INDEX_op_extu_i32_i64, TCGOutOpUnary, outop_extu_i32_i64),
+    OUTOP(INDEX_op_extrl_i64_i32, TCGOutOpUnary, outop_extrl_i64_i32),
 #endif
 };
 
@@ -2400,12 +2411,12 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
+    case INDEX_op_extrl_i64_i32:
     case INDEX_op_deposit_i64:
         return TCG_TARGET_REG_BITS == 64;
 
     case INDEX_op_extract2_i64:
         return TCG_TARGET_HAS_extract2_i64;
-    case INDEX_op_extrl_i64_i32:
     case INDEX_op_extrh_i64_i32:
         return TCG_TARGET_HAS_extr_i64_i32;
     case INDEX_op_add2_i64:
@@ -5441,10 +5452,6 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
     /* emit instruction */
     TCGType type = TCGOP_TYPE(op);
     switch (op->opc) {
-    case INDEX_op_extrl_i64_i32:
-        tcg_out_extrl_i64_i32(s, new_args[0], new_args[1]);
-        break;
-
     case INDEX_op_add:
     case INDEX_op_and:
     case INDEX_op_andc:
@@ -5502,6 +5509,7 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
     case INDEX_op_bswap64:
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
+    case INDEX_op_extrl_i64_i32:
         assert(TCG_TARGET_REG_BITS == 64);
         /* fall through */
     case INDEX_op_ctpop:
@@ -6660,6 +6668,22 @@ int tcg_gen_code(TCGContext *s, TranslationBlock *tb, uint64_t pc_start)
         TCGOpcode opc = op->opc;
 
         switch (opc) {
+        case INDEX_op_extrl_i64_i32:
+            assert(TCG_TARGET_REG_BITS == 64);
+            /*
+             * If TCG_TYPE_I32 is represented in some canonical form,
+             * e.g. zero or sign-extended, then emit as a unary op.
+             * Otherwise we can treat this as a plain move.
+             * If the output dies, treat this as a plain move, because
+             * this will be implemented with a store.
+             */
+            if (TCG_TARGET_HAS_extr_i64_i32) {
+                TCGLifeData arg_life = op->life;
+                if (!IS_DEAD_ARG(0)) {
+                    goto do_default;
+                }
+            }
+            /* fall through */
         case INDEX_op_mov:
         case INDEX_op_mov_vec:
             tcg_reg_alloc_mov(s, op);
@@ -6702,6 +6726,7 @@ int tcg_gen_code(TCGContext *s, TranslationBlock *tb, uint64_t pc_start)
             }
             /* fall through */
         default:
+        do_default:
             /* Sanity check that we've not introduced any unhandled opcodes. */
             tcg_debug_assert(tcg_op_supported(opc, TCGOP_TYPE(op),
                                               TCGOP_FLAGS(op)));
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index 3cf2913acd..e9b46d5e66 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -1107,7 +1107,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
-    case INDEX_op_extrl_i64_i32:
     default:
         g_assert_not_reached();
     }

From b3b139766424d022dc3455b711837dc6acf0724b Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sun, 12 Jan 2025 13:37:28 -0800
Subject: [PATCH 0459/2760] tcg: Convert extrh_i64_i32 to TCGOutOpUnary

At the same time, make extrh_i64_i32 mandatory.  This closes a hole
in which move arguments could be cast between TCGv_i32 and TCGv_i64.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target.c.inc     | 10 ++++++++++
 tcg/i386/tcg-target.c.inc        | 20 +++++++++++++-------
 tcg/loongarch64/tcg-target.c.inc | 15 ++++++++++-----
 tcg/mips/tcg-target.c.inc        | 17 ++++++++++++-----
 tcg/ppc/tcg-target.c.inc         | 12 ++++++++++++
 tcg/riscv/tcg-target.c.inc       | 15 ++++++++++-----
 tcg/s390x/tcg-target.c.inc       | 10 ++++++++++
 tcg/sparc64/tcg-target.c.inc     | 10 ++++++++++
 tcg/tcg-op.c                     |  7 +------
 tcg/tcg.c                        |  5 +++--
 tcg/tci/tcg-target.c.inc         | 12 ++++++++++++
 11 files changed, 103 insertions(+), 30 deletions(-)

diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index 8abc5f26da..4ea1aebc5e 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -2220,6 +2220,16 @@ static const TCGOutOpBinary outop_eqv = {
     .out_rrr = tgen_eqv,
 };
 
+static void tgen_extrh_i64_i32(TCGContext *s, TCGType t, TCGReg a0, TCGReg a1)
+{
+    tcg_out_ubfm(s, TCG_TYPE_I64, a0, a1, 32, 63);
+}
+
+static const TCGOutOpUnary outop_extrh_i64_i32 = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = tgen_extrh_i64_i32,
+};
+
 static void tgen_mul(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index 9bae60d3b6..63c9aae26e 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -2794,6 +2794,18 @@ static const TCGOutOpBinary outop_eqv = {
     .base.static_constraint = C_NotImplemented,
 };
 
+#if TCG_TARGET_REG_BITS == 64
+static void tgen_extrh_i64_i32(TCGContext *s, TCGType t, TCGReg a0, TCGReg a1)
+{
+    tcg_out_shifti(s, SHIFT_SHR + P_REXW, a0, 32);
+}
+
+static const TCGOutOpUnary outop_extrh_i64_i32 = {
+    .base.static_constraint = C_O1_I1(r, 0),
+    .out_rr = tgen_extrh_i64_i32,
+};
+#endif /* TCG_TARGET_REG_BITS == 64 */
+
 static void tgen_mul(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -3212,6 +3224,7 @@ static const TCGOutOpExtract outop_sextract = {
     .out_rr = tgen_sextract,
 };
 
+
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
                        const int const_args[TCG_MAX_OP_ARGS])
@@ -3363,10 +3376,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
             tcg_out_st(s, TCG_TYPE_I64, a0, a1, a2);
         }
         break;
-
-    case INDEX_op_extrh_i64_i32:
-        tcg_out_shifti(s, SHIFT_SHR + P_REXW, a0, 32);
-        break;
 #endif
 
     OP_32_64(deposit):
@@ -3995,9 +4004,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(re, r);
 
-    case INDEX_op_extrh_i64_i32:
-        return C_O1_I1(r, 0);
-
     case INDEX_op_extract2_i32:
     case INDEX_op_extract2_i64:
         return C_O1_I2(r, 0, r);
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index fae1a58c94..1062eb1883 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -1467,6 +1467,16 @@ static const TCGOutOpBinary outop_eqv = {
     .base.static_constraint = C_NotImplemented,
 };
 
+static void tgen_extrh_i64_i32(TCGContext *s, TCGType t, TCGReg a0, TCGReg a1)
+{
+    tcg_out_opc_srai_d(s, a0, a1, 32);
+}
+
+static const TCGOutOpUnary outop_extrh_i64_i32 = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = tgen_extrh_i64_i32,
+};
+
 static void tgen_mul(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -1867,10 +1877,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_opc_b(s, 0);
         break;
 
-    case INDEX_op_extrh_i64_i32:
-        tcg_out_opc_srai_d(s, a0, a1, 32);
-        break;
-
     case INDEX_op_deposit_i32:
         tcg_out_opc_bstrins_w(s, a0, a2, args[3], args[3] + args[4] - 1);
         break;
@@ -2462,7 +2468,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_qemu_st_i128:
         return C_O0_I3(r, r, r);
 
-    case INDEX_op_extrh_i64_i32:
     case INDEX_op_ld8s_i32:
     case INDEX_op_ld8s_i64:
     case INDEX_op_ld8u_i32:
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index 095eb8f672..ad0482902d 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -1793,6 +1793,18 @@ static const TCGOutOpBinary outop_eqv = {
     .base.static_constraint = C_NotImplemented,
 };
 
+#if TCG_TARGET_REG_BITS == 64
+static void tgen_extrh_i64_i32(TCGContext *s, TCGType t, TCGReg a0, TCGReg a1)
+{
+    tcg_out_dsra(s, a0, a1, 32);
+}
+
+static const TCGOutOpUnary outop_extrh_i64_i32 = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = tgen_extrh_i64_i32,
+};
+#endif
+
 static void tgen_mul(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -2315,10 +2327,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_ldst(s, i1, a0, a1, a2);
         break;
 
-    case INDEX_op_extrh_i64_i32:
-        tcg_out_dsra(s, a0, a1, 32);
-        break;
-
     case INDEX_op_deposit_i32:
         tcg_out_opc_bf(s, OPC_INS, a0, a2, args[3] + args[4] - 1, args[3]);
         break;
@@ -2388,7 +2396,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld32s_i64:
     case INDEX_op_ld32u_i64:
     case INDEX_op_ld_i64:
-    case INDEX_op_extrh_i64_i32:
         return C_O1_I1(r, r);
 
     case INDEX_op_st8_i32:
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index bb03efe055..ba6d7556f7 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -2965,6 +2965,18 @@ static void tgen_eqv(TCGContext *s, TCGType type,
     tcg_out32(s, EQV | SAB(a1, a0, a2));
 }
 
+#if TCG_TARGET_REG_BITS == 64
+static void tgen_extrh_i64_i32(TCGContext *s, TCGType t, TCGReg a0, TCGReg a1)
+{
+    tcg_out_shri64(s, a0, a1, 32);
+}
+
+static const TCGOutOpUnary outop_extrh_i64_i32 = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = tgen_extrh_i64_i32,
+};
+#endif
+
 static void tgen_divs(TCGContext *s, TCGType type,
                       TCGReg a0, TCGReg a1, TCGReg a2)
 {
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index 76ad2df410..46b4e1167c 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -2151,6 +2151,16 @@ static const TCGOutOpBinary outop_eqv = {
     .out_rrr = tgen_eqv,
 };
 
+static void tgen_extrh_i64_i32(TCGContext *s, TCGType t, TCGReg a0, TCGReg a1)
+{
+    tcg_out_opc_imm(s, OPC_SRAI, a0, a1, 32);
+}
+
+static const TCGOutOpUnary outop_extrh_i64_i32 = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = tgen_extrh_i64_i32,
+};
+
 static void tgen_mul(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -2619,10 +2629,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_qemu_st(s, a0, a1, a2, TCG_TYPE_I64);
         break;
 
-    case INDEX_op_extrh_i64_i32:
-        tcg_out_opc_imm(s, OPC_SRAI, a0, a1, 32);
-        break;
-
     case INDEX_op_mb:
         tcg_out_mb(s, a0);
         break;
@@ -2871,7 +2877,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ld32s_i64:
     case INDEX_op_ld32u_i64:
     case INDEX_op_ld_i64:
-    case INDEX_op_extrh_i64_i32:
         return C_O1_I1(r, r);
 
     case INDEX_op_st8_i32:
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index 1ea041c75f..3b3749efd3 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -2409,6 +2409,16 @@ static const TCGOutOpBinary outop_eqv = {
     .out_rrr = tgen_eqv,
 };
 
+static void tgen_extrh_i64_i32(TCGContext *s, TCGType t, TCGReg a0, TCGReg a1)
+{
+    tcg_out_sh64(s, RSY_SRLG, a0, a1, TCG_REG_NONE, 32);
+}
+
+static const TCGOutOpUnary outop_extrh_i64_i32 = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = tgen_extrh_i64_i32,
+};
+
 static void tgen_mul(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index d52907f7e3..c1cce7c196 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -1501,6 +1501,16 @@ static const TCGOutOpBinary outop_eqv = {
     .base.static_constraint = C_NotImplemented,
 };
 
+static void tgen_extrh_i64_i32(TCGContext *s, TCGType t, TCGReg a0, TCGReg a1)
+{
+    tcg_out_arithi(s, a0, a1, 32, SHIFT_SRLX);
+}
+
+static const TCGOutOpUnary outop_extrh_i64_i32 = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = tgen_extrh_i64_i32,
+};
+
 static void tgen_mul(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index 7ecd1f6c8f..b88f411ece 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -2972,14 +2972,9 @@ void tcg_gen_extrh_i64_i32(TCGv_i32 ret, TCGv_i64 arg)
 {
     if (TCG_TARGET_REG_BITS == 32) {
         tcg_gen_mov_i32(ret, TCGV_HIGH(arg));
-    } else if (TCG_TARGET_HAS_extr_i64_i32) {
+    } else {
         tcg_gen_op2(INDEX_op_extrh_i64_i32, TCG_TYPE_I32,
                     tcgv_i32_arg(ret), tcgv_i64_arg(arg));
-    } else {
-        TCGv_i64 t = tcg_temp_ebb_new_i64();
-        tcg_gen_shri_i64(t, arg, 32);
-        tcg_gen_mov_i32(ret, (TCGv_i32)t);
-        tcg_temp_free_i64(t);
     }
 }
 
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 8fcaf54d32..ce583b824c 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1162,6 +1162,7 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_ext_i32_i64, TCGOutOpUnary, outop_exts_i32_i64),
     OUTOP(INDEX_op_extu_i32_i64, TCGOutOpUnary, outop_extu_i32_i64),
     OUTOP(INDEX_op_extrl_i64_i32, TCGOutOpUnary, outop_extrl_i64_i32),
+    OUTOP(INDEX_op_extrh_i64_i32, TCGOutOpUnary, outop_extrh_i64_i32),
 #endif
 };
 
@@ -2412,13 +2413,12 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
     case INDEX_op_extrl_i64_i32:
+    case INDEX_op_extrh_i64_i32:
     case INDEX_op_deposit_i64:
         return TCG_TARGET_REG_BITS == 64;
 
     case INDEX_op_extract2_i64:
         return TCG_TARGET_HAS_extract2_i64;
-    case INDEX_op_extrh_i64_i32:
-        return TCG_TARGET_HAS_extr_i64_i32;
     case INDEX_op_add2_i64:
         return TCG_TARGET_HAS_add2_i64;
     case INDEX_op_sub2_i64:
@@ -5510,6 +5510,7 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
     case INDEX_op_extrl_i64_i32:
+    case INDEX_op_extrh_i64_i32:
         assert(TCG_TARGET_REG_BITS == 64);
         /* fall through */
     case INDEX_op_ctpop:
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index e9b46d5e66..d84d01e098 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -670,6 +670,18 @@ static const TCGOutOpBinary outop_eqv = {
     .out_rrr = tgen_eqv,
 };
 
+#if TCG_TARGET_REG_BITS == 64
+static void tgen_extrh_i64_i32(TCGContext *s, TCGType t, TCGReg a0, TCGReg a1)
+{
+    tcg_out_extract(s, TCG_TYPE_I64, a0, a1, 32, 32);
+}
+
+static const TCGOutOpUnary outop_extrh_i64_i32 = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out_rr = tgen_extrh_i64_i32,
+};
+#endif
+
 static void tgen_mul(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {

From cf4905c03135f1181e86c618426f8d6c703b38c0 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sun, 12 Jan 2025 20:29:41 -0800
Subject: [PATCH 0460/2760] tcg: Convert deposit to TCGOutOpDeposit

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target.c.inc     | 30 +++++--------
 tcg/arm/tcg-target.c.inc         | 29 ++++++------
 tcg/i386/tcg-target.c.inc        | 76 ++++++++++++++++----------------
 tcg/loongarch64/tcg-target.c.inc | 27 +++++++-----
 tcg/mips/tcg-target.c.inc        | 27 +++++++-----
 tcg/ppc/tcg-target.c.inc         | 44 +++++++++---------
 tcg/riscv/tcg-target.c.inc       |  4 ++
 tcg/s390x/tcg-target.c.inc       | 60 +++++++++++++------------
 tcg/sparc64/tcg-target.c.inc     |  4 ++
 tcg/tcg.c                        | 33 ++++++++++++++
 tcg/tci.c                        |  8 ++--
 tcg/tci/tcg-target.c.inc         | 19 ++++----
 12 files changed, 206 insertions(+), 155 deletions(-)

diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index 4ea1aebc5e..62b045c222 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -1347,15 +1347,6 @@ static inline void tcg_out_extr(TCGContext *s, TCGType ext, TCGReg rd,
     tcg_out_insn(s, 3403, EXTR, ext, rd, rn, rm, a);
 }
 
-static inline void tcg_out_dep(TCGContext *s, TCGType ext, TCGReg rd,
-                               TCGReg rn, unsigned lsb, unsigned width)
-{
-    unsigned size = ext ? 64 : 32;
-    unsigned a = (size - lsb) & (size - 1);
-    unsigned b = width - 1;
-    tcg_out_bfm(s, ext, rd, rn, a, b);
-}
-
 static void tgen_cmp(TCGContext *s, TCGType ext, TCGCond cond,
                      TCGReg a, TCGReg b)
 {
@@ -2577,6 +2568,18 @@ static const TCGOutOpMovcond outop_movcond = {
     .out = tgen_movcond,
 };
 
+static void tgen_deposit(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1,
+                         TCGReg a2, unsigned ofs, unsigned len)
+{
+    unsigned mask = type == TCG_TYPE_I32 ? 31 : 63;
+    tcg_out_bfm(s, type, a0, a2, -ofs & mask, len - 1);
+}
+
+static const TCGOutOpDeposit outop_deposit = {
+    .base.static_constraint = C_O1_I2(r, 0, rz),
+    .out_rrr = tgen_deposit,
+};
+
 static void tgen_extract(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1,
                          unsigned ofs, unsigned len)
 {
@@ -2684,11 +2687,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType ext,
         tcg_out_qemu_ldst_i128(s, a0, a1, a2, args[3], false);
         break;
 
-    case INDEX_op_deposit_i64:
-    case INDEX_op_deposit_i32:
-        tcg_out_dep(s, ext, a0, a2, args[3], args[4]);
-        break;
-
     case INDEX_op_extract2_i64:
     case INDEX_op_extract2_i32:
         tcg_out_extr(s, ext, a0, a2, a1, args[3]);
@@ -3206,10 +3204,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_qemu_st_i128:
         return C_O0_I3(rz, rz, r);
 
-    case INDEX_op_deposit_i32:
-    case INDEX_op_deposit_i64:
-        return C_O1_I2(r, 0, rz);
-
     case INDEX_op_extract2_i32:
     case INDEX_op_extract2_i64:
         return C_O1_I2(r, rz, rz);
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index aebe48679c..2bf6bfe274 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -969,18 +969,27 @@ static void tcg_out_extrl_i64_i32(TCGContext *s, TCGReg rd, TCGReg rn)
     g_assert_not_reached();
 }
 
-static void tcg_out_deposit(TCGContext *s, ARMCond cond, TCGReg rd,
-                            TCGArg a1, int ofs, int len, bool const_a1)
+static void tgen_deposit(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1,
+                         TCGReg a2, unsigned ofs, unsigned len)
 {
-    if (const_a1) {
-        /* bfi becomes bfc with rn == 15.  */
-        a1 = 15;
-    }
     /* bfi/bfc */
-    tcg_out32(s, 0x07c00010 | (cond << 28) | (rd << 12) | a1
+    tcg_out32(s, 0x07c00010 | (COND_AL << 28) | (a0 << 12) | a1
               | (ofs << 7) | ((ofs + len - 1) << 16));
 }
 
+static void tgen_depositi(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1,
+                          tcg_target_long a2, unsigned ofs, unsigned len)
+{
+    /* bfi becomes bfc with rn == 15.  */
+    tgen_deposit(s, type, a0, a1, 15, ofs, len);
+}
+
+static const TCGOutOpDeposit outop_deposit = {
+    .base.static_constraint = C_O1_I2(r, 0, rZ),
+    .out_rrr = tgen_deposit,
+    .out_rri = tgen_depositi,
+};
+
 static void tgen_extract(TCGContext *s, TCGType type, TCGReg rd, TCGReg rn,
                          unsigned ofs, unsigned len)
 {
@@ -2402,10 +2411,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_qemu_st(s, args[0], args[1], args[2], args[3], TCG_TYPE_I64);
         break;
 
-    case INDEX_op_deposit_i32:
-        tcg_out_deposit(s, COND_AL, args[0], args[2],
-                        args[3], args[4], const_args[2]);
-        break;
     case INDEX_op_extract2_i32:
         /* ??? These optimization vs zero should be generic.  */
         /* ??? But we can't substitute 2 for 1 in the opcode stream yet.  */
@@ -2459,8 +2464,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i32:
         return C_O0_I2(r, r);
 
-    case INDEX_op_deposit_i32:
-        return C_O1_I2(r, 0, rZ);
     case INDEX_op_extract2_i32:
         return C_O1_I2(r, rZ, rZ);
     case INDEX_op_add2_i32:
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index 63c9aae26e..1dd9741f45 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -3150,6 +3150,43 @@ static const TCGOutOpUnary outop_not = {
     .out_rr = tgen_not,
 };
 
+static void tgen_deposit(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1,
+                         TCGReg a2, unsigned ofs, unsigned len)
+{
+    if (ofs == 0 && len == 8) {
+        tcg_out_modrm(s, OPC_MOVB_EvGv | P_REXB_R | P_REXB_RM, a2, a0);
+    } else if (ofs == 0 && len == 16) {
+        tcg_out_modrm(s, OPC_MOVL_EvGv | P_DATA16, a2, a0);
+    } else if (TCG_TARGET_REG_BITS == 32 && ofs == 8 && len == 8) {
+        tcg_out_modrm(s, OPC_MOVB_EvGv, a2, a0 + 4);
+    } else {
+        g_assert_not_reached();
+    }
+}
+
+static void tgen_depositi(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1,
+                          tcg_target_long a2, unsigned ofs, unsigned len)
+{
+    if (ofs == 0 && len == 8) {
+        tcg_out_opc(s, OPC_MOVB_Ib | P_REXB_RM | LOWREGMASK(a0), 0, a0, 0);
+        tcg_out8(s, a2);
+    } else if (ofs == 0 && len == 16) {
+        tcg_out_opc(s, OPC_MOVL_Iv | P_DATA16 | LOWREGMASK(a0), 0, a0, 0);
+        tcg_out16(s, a2);
+    } else if (TCG_TARGET_REG_BITS == 32 && ofs == 8 && len == 8) {
+        tcg_out8(s, OPC_MOVB_Ib + a0 + 4);
+        tcg_out8(s, a2);
+    } else {
+        g_assert_not_reached();
+    }
+}
+
+static const TCGOutOpDeposit outop_deposit = {
+    .base.static_constraint = C_O1_I2(q, 0, qi),
+    .out_rrr = tgen_deposit,
+    .out_rri = tgen_depositi,
+};
+
 static void tgen_extract(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1,
                          unsigned ofs, unsigned len)
 {
@@ -3230,7 +3267,7 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const int const_args[TCG_MAX_OP_ARGS])
 {
     TCGArg a0, a1, a2;
-    int const_a2, rexw;
+    int rexw;
 
 #if TCG_TARGET_REG_BITS == 64
 # define OP_32_64(x) \
@@ -3245,7 +3282,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     a0 = args[0];
     a1 = args[1];
     a2 = args[2];
-    const_a2 = const_args[2];
     rexw = type == TCG_TYPE_I32 ? 0 : P_REXW;
 
     switch (opc) {
@@ -3378,38 +3414,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         break;
 #endif
 
-    OP_32_64(deposit):
-        if (args[3] == 0 && args[4] == 8) {
-            /* load bits 0..7 */
-            if (const_a2) {
-                tcg_out_opc(s, OPC_MOVB_Ib | P_REXB_RM | LOWREGMASK(a0),
-                            0, a0, 0);
-                tcg_out8(s, a2);
-            } else {
-                tcg_out_modrm(s, OPC_MOVB_EvGv | P_REXB_R | P_REXB_RM, a2, a0);
-            }
-        } else if (TCG_TARGET_REG_BITS == 32 && args[3] == 8 && args[4] == 8) {
-            /* load bits 8..15 */
-            if (const_a2) {
-                tcg_out8(s, OPC_MOVB_Ib + a0 + 4);
-                tcg_out8(s, a2);
-            } else {
-                tcg_out_modrm(s, OPC_MOVB_EvGv, a2, a0 + 4);
-            }
-        } else if (args[3] == 0 && args[4] == 16) {
-            /* load bits 0..15 */
-            if (const_a2) {
-                tcg_out_opc(s, OPC_MOVL_Iv | P_DATA16 | LOWREGMASK(a0),
-                            0, a0, 0);
-                tcg_out16(s, a2);
-            } else {
-                tcg_out_modrm(s, OPC_MOVL_EvGv | P_DATA16, a2, a0);
-            }
-        } else {
-            g_assert_not_reached();
-        }
-        break;
-
     OP_32_64(extract2):
         /* Note that SHRD outputs to the r/m operand.  */
         tcg_out_modrm(s, OPC_SHRD_Ib + rexw, a2, a0);
@@ -4008,10 +4012,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_extract2_i64:
         return C_O1_I2(r, 0, r);
 
-    case INDEX_op_deposit_i32:
-    case INDEX_op_deposit_i64:
-        return C_O1_I2(q, 0, qi);
-
     case INDEX_op_add2_i32:
     case INDEX_op_add2_i64:
     case INDEX_op_sub2_i32:
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index 1062eb1883..0b64efc078 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -1809,6 +1809,21 @@ static const TCGOutOpUnary outop_not = {
     .out_rr = tgen_not,
 };
 
+static void tgen_deposit(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1,
+                         TCGReg a2, unsigned ofs, unsigned len)
+{
+    if (type == TCG_TYPE_I32) {
+        tcg_out_opc_bstrins_w(s, a0, a2, ofs, ofs + len - 1);
+    } else {
+        tcg_out_opc_bstrins_d(s, a0, a2, ofs, ofs + len - 1);
+    }
+}
+
+static const TCGOutOpDeposit outop_deposit = {
+    .base.static_constraint = C_O1_I2(r, 0, rz),
+    .out_rrr = tgen_deposit,
+};
+
 static void tgen_extract(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1,
                          unsigned ofs, unsigned len)
 {
@@ -1877,13 +1892,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_opc_b(s, 0);
         break;
 
-    case INDEX_op_deposit_i32:
-        tcg_out_opc_bstrins_w(s, a0, a2, args[3], args[3] + args[4] - 1);
-        break;
-    case INDEX_op_deposit_i64:
-        tcg_out_opc_bstrins_d(s, a0, a2, args[3], args[3] + args[4] - 1);
-        break;
-
     case INDEX_op_ld8s_i32:
     case INDEX_op_ld8s_i64:
         tcg_out_ldst(s, OPC_LD_B, a0, a1, a2);
@@ -2484,11 +2492,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_qemu_ld_i64:
         return C_O1_I1(r, r);
 
-    case INDEX_op_deposit_i32:
-    case INDEX_op_deposit_i64:
-        /* Must deposit into the same register as input */
-        return C_O1_I2(r, 0, rz);
-
     case INDEX_op_ld_vec:
     case INDEX_op_dupm_vec:
     case INDEX_op_dup_vec:
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index ad0482902d..cd648ab1df 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -2215,6 +2215,22 @@ static const TCGOutOpUnary outop_not = {
     .out_rr = tgen_not,
 };
 
+static void tgen_deposit(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1,
+                         TCGReg a2, unsigned ofs, unsigned len)
+{
+    if (type == TCG_TYPE_I32) {
+        tcg_out_opc_bf(s, OPC_INS, a0, a2, ofs + len - 1, ofs);
+    } else {
+        tcg_out_opc_bf64(s, OPC_DINS, OPC_DINSM, OPC_DINSU, a0, a2,
+                         ofs + len - 1, ofs);
+    }
+}
+
+static const TCGOutOpDeposit outop_deposit = {
+    .base.static_constraint = C_O1_I2(r, 0, rz),
+    .out_rrr = tgen_deposit,
+};
+
 static void tgen_extract(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1,
                          unsigned ofs, unsigned len)
 {
@@ -2327,14 +2343,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_ldst(s, i1, a0, a1, a2);
         break;
 
-    case INDEX_op_deposit_i32:
-        tcg_out_opc_bf(s, OPC_INS, a0, a2, args[3] + args[4] - 1, args[3]);
-        break;
-    case INDEX_op_deposit_i64:
-        tcg_out_opc_bf64(s, OPC_DINS, OPC_DINSM, OPC_DINSU, a0, a2,
-                         args[3] + args[4] - 1, args[3]);
-        break;
-
     case INDEX_op_qemu_ld_i32:
         tcg_out_qemu_ld(s, a0, 0, a1, a2, TCG_TYPE_I32);
         break;
@@ -2407,9 +2415,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(rz, r);
 
-    case INDEX_op_deposit_i32:
-    case INDEX_op_deposit_i64:
-        return C_O1_I2(r, 0, rz);
     case INDEX_op_add2_i32:
     case INDEX_op_sub2_i32:
         return C_O2_I4(r, r, rz, rz, rN, rN);
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index ba6d7556f7..fc92a4896d 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -3429,6 +3429,28 @@ static const TCGOutOpUnary outop_not = {
     .out_rr = tgen_not,
 };
 
+static void tgen_deposit(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1,
+                         TCGReg a2, unsigned ofs, unsigned len)
+{
+    if (type == TCG_TYPE_I32) {
+        tcg_out_rlw(s, RLWIMI, a0, a2, ofs, 32 - ofs - len, 31 - ofs);
+    } else {
+        tcg_out_rld(s, RLDIMI, a0, a2, ofs, 64 - ofs - len);
+    }
+}
+
+static void tgen_depositi(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1,
+                          tcg_target_long a2, unsigned ofs, unsigned len)
+{
+    tgen_andi(s, type, a0, a1, ~MAKE_64BIT_MASK(ofs, len));
+}
+
+static const TCGOutOpDeposit outop_deposit = {
+    .base.static_constraint = C_O1_I2(r, 0, rZ),
+    .out_rrr = tgen_deposit,
+    .out_rri = tgen_depositi,
+};
+
 static void tgen_extract(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1,
                          unsigned ofs, unsigned len)
 {
@@ -3575,25 +3597,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_qemu_ldst_i128(s, args[0], args[1], args[2], args[3], false);
         break;
 
-    case INDEX_op_deposit_i32:
-        if (const_args[2]) {
-            uint32_t mask = ((2u << (args[4] - 1)) - 1) << args[3];
-            tcg_out_andi32(s, args[0], args[0], ~mask);
-        } else {
-            tcg_out_rlw(s, RLWIMI, args[0], args[2], args[3],
-                        32 - args[3] - args[4], 31 - args[3]);
-        }
-        break;
-    case INDEX_op_deposit_i64:
-        if (const_args[2]) {
-            uint64_t mask = ((2ull << (args[4] - 1)) - 1) << args[3];
-            tcg_out_andi64(s, args[0], args[0], ~mask);
-        } else {
-            tcg_out_rld(s, RLDIMI, args[0], args[2], args[3],
-                        64 - args[3] - args[4]);
-        }
-        break;
-
 #if TCG_TARGET_REG_BITS == 64
     case INDEX_op_add2_i64:
 #else
@@ -4290,9 +4293,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(r, r);
 
-    case INDEX_op_deposit_i32:
-    case INDEX_op_deposit_i64:
-        return C_O1_I2(r, 0, rZ);
     case INDEX_op_add2_i64:
     case INDEX_op_add2_i32:
         return C_O2_I4(r, r, r, r, rI, rZM);
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index 46b4e1167c..371e0c24c8 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -2482,6 +2482,10 @@ static const TCGOutOpUnary outop_not = {
     .out_rr = tgen_not,
 };
 
+static const TCGOutOpDeposit outop_deposit = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static void tgen_extract(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1,
                          unsigned ofs, unsigned len)
 {
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index 3b3749efd3..d72393315d 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -1555,14 +1555,40 @@ static const TCGOutOpMovcond outop_movcond = {
     .out = tgen_movcond,
 };
 
-static void tgen_deposit(TCGContext *s, TCGReg dest, TCGReg src,
-                         int ofs, int len, int z)
+static void tgen_deposit(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1,
+                         TCGReg a2, unsigned ofs, unsigned len)
 {
-    int lsb = (63 - ofs);
-    int msb = lsb - (len - 1);
-    tcg_out_risbg(s, dest, src, msb, lsb, ofs, z);
+    unsigned lsb = (63 - ofs);
+    unsigned msb = lsb - (len - 1);
+
+    /*
+     * Since we can't support "0Z" as a constraint, we allow a1 in
+     * any register.  Fix things up as if a matching constraint.
+     */
+    if (a0 != a1) {
+        if (a0 == a2) {
+            tcg_out_mov(s, type, TCG_TMP0, a2);
+            a2 = TCG_TMP0;
+        }
+        tcg_out_mov(s, type, a0, a1);
+    }
+    tcg_out_risbg(s, a0, a2, msb, lsb, ofs, false);
 }
 
+static void tgen_depositz(TCGContext *s, TCGType type, TCGReg a0, TCGReg a2,
+                          unsigned ofs, unsigned len)
+{
+    unsigned lsb = (63 - ofs);
+    unsigned msb = lsb - (len - 1);
+    tcg_out_risbg(s, a0, a2, msb, lsb, ofs, true);
+}
+
+static const TCGOutOpDeposit outop_deposit = {
+    .base.static_constraint = C_O1_I2(r, rZ, r),
+    .out_rrr = tgen_deposit,
+    .out_rzr = tgen_depositz,
+};
+
 static void tgen_extract(TCGContext *s, TCGType type, TCGReg dest,
                          TCGReg src, unsigned ofs, unsigned len)
 {
@@ -2845,7 +2871,7 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
                        const int const_args[TCG_MAX_OP_ARGS])
 {
-    TCGArg a0, a1, a2;
+    TCGArg a0;
 
     switch (opc) {
     case INDEX_op_goto_ptr:
@@ -2977,24 +3003,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_insn(s, RRE, SLBGR, args[1], args[5]);
         break;
 
-    OP_32_64(deposit):
-        a0 = args[0], a1 = args[1], a2 = args[2];
-        if (const_args[1]) {
-            tgen_deposit(s, a0, a2, args[3], args[4], 1);
-        } else {
-            /* Since we can't support "0Z" as a constraint, we allow a1 in
-               any register.  Fix things up as if a matching constraint.  */
-            if (a0 != a1) {
-                if (a0 == a2) {
-                    tcg_out_mov(s, type, TCG_TMP0, a2);
-                    a2 = TCG_TMP0;
-                }
-                tcg_out_mov(s, type, a0, a1);
-            }
-            tgen_deposit(s, a0, a2, args[3], args[4], 0);
-        }
-        break;
-
     case INDEX_op_mb:
         /* The host memory model is quite strong, we simply need to
            serialize the instruction stream.  */
@@ -3489,10 +3497,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_qemu_st_i128:
         return C_O0_I3(o, m, r);
 
-    case INDEX_op_deposit_i32:
-    case INDEX_op_deposit_i64:
-        return C_O1_I2(r, rZ, r);
-
     case INDEX_op_add2_i32:
     case INDEX_op_sub2_i32:
         return C_N1_O1_I4(r, r, 0, 1, ri, r);
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index c1cce7c196..741de260e9 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -1767,6 +1767,10 @@ static const TCGOutOpUnary outop_not = {
     .out_rr = tgen_not,
 };
 
+static const TCGOutOpDeposit outop_deposit = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static void tgen_extract(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1,
                          unsigned ofs, unsigned len)
 {
diff --git a/tcg/tcg.c b/tcg/tcg.c
index ce583b824c..b9e9454654 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1007,6 +1007,16 @@ typedef struct TCGOutOpBswap {
                    TCGReg a0, TCGReg a1, unsigned flags);
 } TCGOutOpBswap;
 
+typedef struct TCGOutOpDeposit {
+    TCGOutOp base;
+    void (*out_rrr)(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1,
+                    TCGReg a2, unsigned ofs, unsigned len);
+    void (*out_rri)(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1,
+                    tcg_target_long a2, unsigned ofs, unsigned len);
+    void (*out_rzr)(TCGContext *s, TCGType type, TCGReg a0,
+                    TCGReg a2, unsigned ofs, unsigned len);
+} TCGOutOpDeposit;
+
 typedef struct TCGOutOpDivRem {
     TCGOutOp base;
     void (*out_rr01r)(TCGContext *s, TCGType type,
@@ -1123,6 +1133,8 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_clz, TCGOutOpBinary, outop_clz),
     OUTOP(INDEX_op_ctpop, TCGOutOpUnary, outop_ctpop),
     OUTOP(INDEX_op_ctz, TCGOutOpBinary, outop_ctz),
+    OUTOP(INDEX_op_deposit_i32, TCGOutOpDeposit, outop_deposit),
+    OUTOP(INDEX_op_deposit_i64, TCGOutOpDeposit, outop_deposit),
     OUTOP(INDEX_op_divs, TCGOutOpBinary, outop_divs),
     OUTOP(INDEX_op_divu, TCGOutOpBinary, outop_divu),
     OUTOP(INDEX_op_divs2, TCGOutOpDivRem, outop_divs2),
@@ -5537,6 +5549,27 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
         }
         break;
 
+    case INDEX_op_deposit_i32:
+    case INDEX_op_deposit_i64:
+        {
+            const TCGOutOpDeposit *out = &outop_deposit;
+
+            if (const_args[2]) {
+                tcg_debug_assert(!const_args[1]);
+                out->out_rri(s, type, new_args[0], new_args[1],
+                             new_args[2], new_args[3], new_args[4]);
+            } else if (const_args[1]) {
+                tcg_debug_assert(new_args[1] == 0);
+                tcg_debug_assert(!const_args[2]);
+                out->out_rzr(s, type, new_args[0], new_args[2],
+                             new_args[3], new_args[4]);
+            } else {
+                out->out_rrr(s, type, new_args[0], new_args[1],
+                             new_args[2], new_args[3], new_args[4]);
+            }
+        }
+        break;
+
     case INDEX_op_divs2:
     case INDEX_op_divu2:
         {
diff --git a/tcg/tci.c b/tcg/tci.c
index 5a07d65db8..595416a192 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -27,6 +27,7 @@
 
 
 #define ctpop_tr    glue(ctpop, TCG_TARGET_REG_BITS)
+#define deposit_tr  glue(deposit, TCG_TARGET_REG_BITS)
 #define extract_tr  glue(extract, TCG_TARGET_REG_BITS)
 #define sextract_tr glue(sextract, TCG_TARGET_REG_BITS)
 
@@ -655,8 +656,9 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             regs[r0] = ror32(regs[r1], regs[r2] & 31);
             break;
         case INDEX_op_deposit_i32:
+        case INDEX_op_deposit_i64:
             tci_args_rrrbb(insn, &r0, &r1, &r2, &pos, &len);
-            regs[r0] = deposit32(regs[r1], pos, len, regs[r2]);
+            regs[r0] = deposit_tr(regs[r1], pos, len, regs[r2]);
             break;
         case INDEX_op_extract:
             tci_args_rrbb(insn, &r0, &r1, &pos, &len);
@@ -770,10 +772,6 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = ror64(regs[r1], regs[r2] & 63);
             break;
-        case INDEX_op_deposit_i64:
-            tci_args_rrrbb(insn, &r0, &r1, &r2, &pos, &len);
-            regs[r0] = deposit64(regs[r1], pos, len, regs[r2]);
-            break;
         case INDEX_op_ext_i32_i64:
             tci_args_rr(insn, &r0, &r1);
             regs[r0] = (int32_t)regs[r1];
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index d84d01e098..566c2fb0d0 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -66,10 +66,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(r, r);
 
-    case INDEX_op_deposit_i32:
-    case INDEX_op_deposit_i64:
-        return C_O1_I2(r, r, r);
-
     case INDEX_op_add2_i32:
     case INDEX_op_add2_i64:
     case INDEX_op_sub2_i32:
@@ -623,6 +619,17 @@ static const TCGOutOpBinary outop_ctz = {
     .out_rrr = tgen_ctz,
 };
 
+static void tgen_deposit(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1,
+                         TCGReg a2, unsigned ofs, unsigned len)
+{
+    tcg_out_op_rrrbb(s, INDEX_op_deposit_i64, a0, a1, a2, ofs, len);
+}
+
+static const TCGOutOpDeposit outop_deposit = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_deposit,
+};
+
 static void tgen_divs(TCGContext *s, TCGType type,
                       TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -1084,10 +1091,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_ldst(s, opc, args[0], args[1], args[2]);
         break;
 
-    CASE_32_64(deposit)
-        tcg_out_op_rrrbb(s, opc, args[0], args[1], args[2], args[3], args[4]);
-        break;
-
     CASE_32_64(add2)
     CASE_32_64(sub2)
         tcg_out_op_rrrrrr(s, opc, args[0], args[1], args[2],

From a5a8dd33aad1ada9b05968e8b93033bdbdfdbca2 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sun, 12 Jan 2025 20:42:13 -0800
Subject: [PATCH 0461/2760] tcg/aarch64: Improve deposit

Use ANDI for deposit 0 into a register.
Use UBFIZ, aka UBFM, for deposit register into 0.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target-con-set.h |  2 +-
 tcg/aarch64/tcg-target.c.inc     | 29 ++++++++++++++++++++++++++++-
 2 files changed, 29 insertions(+), 2 deletions(-)

diff --git a/tcg/aarch64/tcg-target-con-set.h b/tcg/aarch64/tcg-target-con-set.h
index 1281e5efc0..2eda499cd3 100644
--- a/tcg/aarch64/tcg-target-con-set.h
+++ b/tcg/aarch64/tcg-target-con-set.h
@@ -18,7 +18,6 @@ C_O1_I1(r, r)
 C_O1_I1(w, r)
 C_O1_I1(w, w)
 C_O1_I1(w, wr)
-C_O1_I2(r, 0, rz)
 C_O1_I2(r, r, r)
 C_O1_I2(r, r, rA)
 C_O1_I2(r, r, rAL)
@@ -26,6 +25,7 @@ C_O1_I2(r, r, rC)
 C_O1_I2(r, r, ri)
 C_O1_I2(r, r, rL)
 C_O1_I2(r, rz, rz)
+C_O1_I2(r, rZ, rZ)
 C_O1_I2(w, 0, w)
 C_O1_I2(w, w, w)
 C_O1_I2(w, w, wN)
diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index 62b045c222..dee4afcce1 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -2572,12 +2572,39 @@ static void tgen_deposit(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1,
                          TCGReg a2, unsigned ofs, unsigned len)
 {
     unsigned mask = type == TCG_TYPE_I32 ? 31 : 63;
+
+    /*
+     * Since we can't support "0Z" as a constraint, we allow a1 in
+     * any register.  Fix things up as if a matching constraint.
+     */
+    if (a0 != a1) {
+        if (a0 == a2) {
+            tcg_out_mov(s, type, TCG_REG_TMP0, a2);
+            a2 = TCG_REG_TMP0;
+        }
+        tcg_out_mov(s, type, a0, a1);
+    }
     tcg_out_bfm(s, type, a0, a2, -ofs & mask, len - 1);
 }
 
+static void tgen_depositi(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1,
+                          tcg_target_long a2, unsigned ofs, unsigned len)
+{
+    tgen_andi(s, type, a0, a1, ~MAKE_64BIT_MASK(ofs, len));
+}
+
+static void tgen_depositz(TCGContext *s, TCGType type, TCGReg a0, TCGReg a2,
+                          unsigned ofs, unsigned len)
+{
+    int max = type == TCG_TYPE_I32 ? 31 : 63;
+    tcg_out_ubfm(s, type, a0, a2, -ofs & max, len - 1);
+}
+
 static const TCGOutOpDeposit outop_deposit = {
-    .base.static_constraint = C_O1_I2(r, 0, rz),
+    .base.static_constraint = C_O1_I2(r, rZ, rZ),
     .out_rrr = tgen_deposit,
+    .out_rri = tgen_depositi,
+    .out_rzr = tgen_depositz,
 };
 
 static void tgen_extract(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1,

From 4d137ff819bae33d045f13bb9186e3a2c71cb7e4 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sun, 12 Jan 2025 20:48:57 -0800
Subject: [PATCH 0462/2760] tcg: Merge INDEX_op_deposit_{i32,i64}
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 docs/devel/tcg-ops.rst   | 6 ++++--
 include/tcg/tcg-opc.h    | 3 +--
 tcg/optimize.c           | 2 +-
 tcg/tcg-op.c             | 8 ++++----
 tcg/tcg.c                | 9 +++------
 tcg/tci.c                | 6 ++----
 tcg/tci/tcg-target.c.inc | 2 +-
 7 files changed, 16 insertions(+), 20 deletions(-)

diff --git a/docs/devel/tcg-ops.rst b/docs/devel/tcg-ops.rst
index ca7550f68c..aea8a897bd 100644
--- a/docs/devel/tcg-ops.rst
+++ b/docs/devel/tcg-ops.rst
@@ -442,7 +442,7 @@ Misc
      - | Indicate that the value of *t0* won't be used later. It is useful to
          force dead code elimination.
 
-   * - deposit_i32/i64 *dest*, *t1*, *t2*, *pos*, *len*
+   * - deposit *dest*, *t1*, *t2*, *pos*, *len*
 
      - | Deposit *t2* as a bitfield into *t1*, placing the result in *dest*.
        |
@@ -451,10 +451,12 @@ Misc
        |     *len* - the length of the bitfield
        |     *pos* - the position of the first bit, counting from the LSB
        |
-       | For example, "deposit_i32 dest, t1, t2, 8, 4" indicates a 4-bit field
+       | For example, "deposit dest, t1, t2, 8, 4" indicates a 4-bit field
          at bit 8. This operation would be equivalent to
        |
        |     *dest* = (*t1* & ~0x0f00) | ((*t2* << 8) & 0x0f00)
+       |
+       | on TCG_TYPE_I32.
 
    * - extract *dest*, *t1*, *pos*, *len*
 
diff --git a/include/tcg/tcg-opc.h b/include/tcg/tcg-opc.h
index 4ace1f85c4..c6848b3c63 100644
--- a/include/tcg/tcg-opc.h
+++ b/include/tcg/tcg-opc.h
@@ -49,6 +49,7 @@ DEF(bswap64, 1, 1, 1, TCG_OPF_INT)
 DEF(clz, 1, 2, 0, TCG_OPF_INT)
 DEF(ctpop, 1, 1, 0, TCG_OPF_INT)
 DEF(ctz, 1, 2, 0, TCG_OPF_INT)
+DEF(deposit, 1, 2, 2, TCG_OPF_INT)
 DEF(divs, 1, 2, 0, TCG_OPF_INT)
 DEF(divs2, 2, 3, 0, TCG_OPF_INT)
 DEF(divu, 1, 2, 0, TCG_OPF_INT)
@@ -90,7 +91,6 @@ DEF(st8_i32, 0, 2, 1, 0)
 DEF(st16_i32, 0, 2, 1, 0)
 DEF(st_i32, 0, 2, 1, 0)
 /* shifts/rotates */
-DEF(deposit_i32, 1, 2, 2, 0)
 DEF(extract2_i32, 1, 2, 1, 0)
 
 DEF(add2_i32, 2, 4, 0, 0)
@@ -111,7 +111,6 @@ DEF(st16_i64, 0, 2, 1, 0)
 DEF(st32_i64, 0, 2, 1, 0)
 DEF(st_i64, 0, 2, 1, 0)
 /* shifts/rotates */
-DEF(deposit_i64, 1, 2, 2, 0)
 DEF(extract2_i64, 1, 2, 1, 0)
 
 /* size changing ops */
diff --git a/tcg/optimize.c b/tcg/optimize.c
index d324cbf7fe..acc566ed76 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -2858,7 +2858,7 @@ void tcg_optimize(TCGContext *s)
         case INDEX_op_ctpop:
             done = fold_ctpop(&ctx, op);
             break;
-        CASE_OP_32_64(deposit):
+        case INDEX_op_deposit:
             done = fold_deposit(&ctx, op);
             break;
         case INDEX_op_divs:
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index b88f411ece..961a39f446 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -915,7 +915,7 @@ void tcg_gen_deposit_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2,
         return;
     }
     if (TCG_TARGET_deposit_valid(TCG_TYPE_I32, ofs, len)) {
-        tcg_gen_op5ii_i32(INDEX_op_deposit_i32, ret, arg1, arg2, ofs, len);
+        tcg_gen_op5ii_i32(INDEX_op_deposit, ret, arg1, arg2, ofs, len);
         return;
     }
 
@@ -961,7 +961,7 @@ void tcg_gen_deposit_z_i32(TCGv_i32 ret, TCGv_i32 arg,
         tcg_gen_andi_i32(ret, arg, (1u << len) - 1);
     } else if (TCG_TARGET_deposit_valid(TCG_TYPE_I32, ofs, len)) {
         TCGv_i32 zero = tcg_constant_i32(0);
-        tcg_gen_op5ii_i32(INDEX_op_deposit_i32, ret, zero, arg, ofs, len);
+        tcg_gen_op5ii_i32(INDEX_op_deposit, ret, zero, arg, ofs, len);
     } else {
         /*
          * To help two-operand hosts we prefer to zero-extend first,
@@ -2533,7 +2533,7 @@ void tcg_gen_deposit_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2,
 
     if (TCG_TARGET_REG_BITS == 64) {
         if (TCG_TARGET_deposit_valid(TCG_TYPE_I64, ofs, len)) {
-            tcg_gen_op5ii_i64(INDEX_op_deposit_i64, ret, arg1, arg2, ofs, len);
+            tcg_gen_op5ii_i64(INDEX_op_deposit, ret, arg1, arg2, ofs, len);
             return;
         }
     } else {
@@ -2594,7 +2594,7 @@ void tcg_gen_deposit_z_i64(TCGv_i64 ret, TCGv_i64 arg,
     } else if (TCG_TARGET_REG_BITS == 64 &&
                TCG_TARGET_deposit_valid(TCG_TYPE_I64, ofs, len)) {
         TCGv_i64 zero = tcg_constant_i64(0);
-        tcg_gen_op5ii_i64(INDEX_op_deposit_i64, ret, zero, arg, ofs, len);
+        tcg_gen_op5ii_i64(INDEX_op_deposit, ret, zero, arg, ofs, len);
     } else {
         if (TCG_TARGET_REG_BITS == 32) {
             if (ofs >= 32) {
diff --git a/tcg/tcg.c b/tcg/tcg.c
index b9e9454654..6b49fd4acf 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1133,8 +1133,7 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_clz, TCGOutOpBinary, outop_clz),
     OUTOP(INDEX_op_ctpop, TCGOutOpUnary, outop_ctpop),
     OUTOP(INDEX_op_ctz, TCGOutOpBinary, outop_ctz),
-    OUTOP(INDEX_op_deposit_i32, TCGOutOpDeposit, outop_deposit),
-    OUTOP(INDEX_op_deposit_i64, TCGOutOpDeposit, outop_deposit),
+    OUTOP(INDEX_op_deposit, TCGOutOpDeposit, outop_deposit),
     OUTOP(INDEX_op_divs, TCGOutOpBinary, outop_divs),
     OUTOP(INDEX_op_divu, TCGOutOpBinary, outop_divu),
     OUTOP(INDEX_op_divs2, TCGOutOpDivRem, outop_divs2),
@@ -2379,6 +2378,7 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_add:
     case INDEX_op_and:
     case INDEX_op_brcond:
+    case INDEX_op_deposit:
     case INDEX_op_extract:
     case INDEX_op_mov:
     case INDEX_op_movcond:
@@ -2397,7 +2397,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st8_i32:
     case INDEX_op_st16_i32:
     case INDEX_op_st_i32:
-    case INDEX_op_deposit_i32:
         return true;
 
     case INDEX_op_extract2_i32:
@@ -2426,7 +2425,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_extu_i32_i64:
     case INDEX_op_extrl_i64_i32:
     case INDEX_op_extrh_i64_i32:
-    case INDEX_op_deposit_i64:
         return TCG_TARGET_REG_BITS == 64;
 
     case INDEX_op_extract2_i64:
@@ -5549,8 +5547,7 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
         }
         break;
 
-    case INDEX_op_deposit_i32:
-    case INDEX_op_deposit_i64:
+    case INDEX_op_deposit:
         {
             const TCGOutOpDeposit *out = &outop_deposit;
 
diff --git a/tcg/tci.c b/tcg/tci.c
index 595416a192..dc916eb112 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -655,8 +655,7 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = ror32(regs[r1], regs[r2] & 31);
             break;
-        case INDEX_op_deposit_i32:
-        case INDEX_op_deposit_i64:
+        case INDEX_op_deposit:
             tci_args_rrrbb(insn, &r0, &r1, &r2, &pos, &len);
             regs[r0] = deposit_tr(regs[r1], pos, len, regs[r2]);
             break;
@@ -1042,8 +1041,7 @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
                            op_name, str_r(r0), str_r(r1), str_r(r2));
         break;
 
-    case INDEX_op_deposit_i32:
-    case INDEX_op_deposit_i64:
+    case INDEX_op_deposit:
         tci_args_rrrbb(insn, &r0, &r1, &r2, &pos, &len);
         info->fprintf_func(info->stream, "%-12s  %s, %s, %s, %d, %d",
                            op_name, str_r(r0), str_r(r1), str_r(r2), pos, len);
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index 566c2fb0d0..ef14e81609 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -622,7 +622,7 @@ static const TCGOutOpBinary outop_ctz = {
 static void tgen_deposit(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1,
                          TCGReg a2, unsigned ofs, unsigned len)
 {
-    tcg_out_op_rrrbb(s, INDEX_op_deposit_i64, a0, a1, a2, ofs, len);
+    tcg_out_op_rrrbb(s, INDEX_op_deposit, a0, a1, a2, ofs, len);
 }
 
 static const TCGOutOpDeposit outop_deposit = {

From c8f9f70047e17ce70e016bc59fe7857123f3cbd5 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sun, 12 Jan 2025 21:30:10 -0800
Subject: [PATCH 0463/2760] tcg: Convert extract2 to TCGOutOpExtract2

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target-has.h     |  2 --
 tcg/aarch64/tcg-target.c.inc     | 20 +++++++++--------
 tcg/arm/tcg-target-has.h         |  1 -
 tcg/arm/tcg-target.c.inc         | 38 ++++++++++++--------------------
 tcg/i386/tcg-target-has.h        |  2 --
 tcg/i386/tcg-target.c.inc        | 25 ++++++++++++---------
 tcg/loongarch64/tcg-target-has.h |  2 --
 tcg/loongarch64/tcg-target.c.inc |  5 +++++
 tcg/mips/tcg-target-has.h        |  6 -----
 tcg/mips/tcg-target.c.inc        |  5 +++++
 tcg/ppc/tcg-target-has.h         |  2 --
 tcg/ppc/tcg-target.c.inc         |  4 ++++
 tcg/riscv/tcg-target-has.h       |  2 --
 tcg/riscv/tcg-target.c.inc       |  5 +++++
 tcg/s390x/tcg-target-has.h       |  2 --
 tcg/s390x/tcg-target.c.inc       |  4 ++++
 tcg/sparc64/tcg-target-has.h     |  2 --
 tcg/sparc64/tcg-target.c.inc     |  4 ++++
 tcg/tcg-has.h                    |  1 -
 tcg/tcg-op.c                     | 12 +++++-----
 tcg/tcg.c                        | 24 ++++++++++++++++----
 tcg/tci/tcg-target-has.h         |  2 --
 tcg/tci/tcg-target.c.inc         |  4 ++++
 23 files changed, 97 insertions(+), 77 deletions(-)

diff --git a/tcg/aarch64/tcg-target-has.h b/tcg/aarch64/tcg-target-has.h
index 82d8cd5965..011a91c263 100644
--- a/tcg/aarch64/tcg-target-has.h
+++ b/tcg/aarch64/tcg-target-has.h
@@ -13,13 +13,11 @@
 #define have_lse2   (cpuinfo & CPUINFO_LSE2)
 
 /* optional instructions */
-#define TCG_TARGET_HAS_extract2_i32     1
 #define TCG_TARGET_HAS_add2_i32         1
 #define TCG_TARGET_HAS_sub2_i32         1
 #define TCG_TARGET_HAS_extr_i64_i32     0
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
-#define TCG_TARGET_HAS_extract2_i64     1
 #define TCG_TARGET_HAS_add2_i64         1
 #define TCG_TARGET_HAS_sub2_i64         1
 
diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index dee4afcce1..bece494c55 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -2634,6 +2634,17 @@ static const TCGOutOpExtract outop_sextract = {
     .out_rr = tgen_sextract,
 };
 
+static void tgen_extract2(TCGContext *s, TCGType type, TCGReg a0,
+                          TCGReg a1, TCGReg a2, unsigned shr)
+{
+    tcg_out_extr(s, type, a0, a2, a1, shr);
+}
+
+static const TCGOutOpExtract2 outop_extract2 = {
+    .base.static_constraint = C_O1_I2(r, rz, rz),
+    .out_rrr = tgen_extract2,
+};
+
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType ext,
                        const TCGArg args[TCG_MAX_OP_ARGS],
                        const int const_args[TCG_MAX_OP_ARGS])
@@ -2714,11 +2725,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType ext,
         tcg_out_qemu_ldst_i128(s, a0, a1, a2, args[3], false);
         break;
 
-    case INDEX_op_extract2_i64:
-    case INDEX_op_extract2_i32:
-        tcg_out_extr(s, ext, a0, a2, a1, args[3]);
-        break;
-
     case INDEX_op_add2_i32:
         tcg_out_addsub2(s, TCG_TYPE_I32, a0, a1, a2, args[3],
                         (int32_t)args[4], args[5], const_args[4],
@@ -3231,10 +3237,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_qemu_st_i128:
         return C_O0_I3(rz, rz, r);
 
-    case INDEX_op_extract2_i32:
-    case INDEX_op_extract2_i64:
-        return C_O1_I2(r, rz, rz);
-
     case INDEX_op_add2_i32:
     case INDEX_op_add2_i64:
     case INDEX_op_sub2_i32:
diff --git a/tcg/arm/tcg-target-has.h b/tcg/arm/tcg-target-has.h
index c85b5da1e5..0d6a785542 100644
--- a/tcg/arm/tcg-target-has.h
+++ b/tcg/arm/tcg-target-has.h
@@ -24,7 +24,6 @@ extern bool use_neon_instructions;
 #endif
 
 /* optional instructions */
-#define TCG_TARGET_HAS_extract2_i32     1
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
 #define TCG_TARGET_HAS_qemu_ldst_i128   0
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index 2bf6bfe274..f366424af5 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -2317,6 +2317,20 @@ static const TCGOutOpSetcond2 outop_setcond2 = {
     .out = tgen_setcond2,
 };
 
+static void tgen_extract2(TCGContext *s, TCGType type, TCGReg a0,
+                          TCGReg a1, TCGReg a2, unsigned shr)
+{
+    /* We can do extract2 in 2 insns, vs the 3 required otherwise.  */
+    tgen_shli(s, TCG_TYPE_I32, TCG_REG_TMP, a2, 32 - shr);
+    tcg_out_dat_reg(s, COND_AL, ARITH_ORR, a0, TCG_REG_TMP,
+                    a1, SHIFT_IMM_LSR(shr));
+}
+
+static const TCGOutOpExtract2 outop_extract2 = {
+    .base.static_constraint = C_O1_I2(r, r, r),
+    .out_rrr = tgen_extract2,
+};
+
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
                        const int const_args[TCG_MAX_OP_ARGS])
@@ -2411,28 +2425,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_qemu_st(s, args[0], args[1], args[2], args[3], TCG_TYPE_I64);
         break;
 
-    case INDEX_op_extract2_i32:
-        /* ??? These optimization vs zero should be generic.  */
-        /* ??? But we can't substitute 2 for 1 in the opcode stream yet.  */
-        if (const_args[1]) {
-            if (const_args[2]) {
-                tcg_out_movi(s, TCG_TYPE_REG, args[0], 0);
-            } else {
-                tcg_out_dat_reg(s, COND_AL, ARITH_MOV, args[0], 0,
-                                args[2], SHIFT_IMM_LSL(32 - args[3]));
-            }
-        } else if (const_args[2]) {
-            tcg_out_dat_reg(s, COND_AL, ARITH_MOV, args[0], 0,
-                            args[1], SHIFT_IMM_LSR(args[3]));
-        } else {
-            /* We can do extract2 in 2 insns, vs the 3 required otherwise.  */
-            tcg_out_dat_reg(s, COND_AL, ARITH_MOV, TCG_REG_TMP, 0,
-                            args[2], SHIFT_IMM_LSL(32 - args[3]));
-            tcg_out_dat_reg(s, COND_AL, ARITH_ORR, args[0], TCG_REG_TMP,
-                            args[1], SHIFT_IMM_LSR(args[3]));
-        }
-        break;
-
     case INDEX_op_mb:
         tcg_out_mb(s, args[0]);
         break;
@@ -2464,8 +2456,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i32:
         return C_O0_I2(r, r);
 
-    case INDEX_op_extract2_i32:
-        return C_O1_I2(r, rZ, rZ);
     case INDEX_op_add2_i32:
         return C_O2_I4(r, r, r, r, rIN, rIK);
     case INDEX_op_sub2_i32:
diff --git a/tcg/i386/tcg-target-has.h b/tcg/i386/tcg-target-has.h
index 6b91b23fe8..0328102c2a 100644
--- a/tcg/i386/tcg-target-has.h
+++ b/tcg/i386/tcg-target-has.h
@@ -26,14 +26,12 @@
 #define have_avx512vbmi2  ((cpuinfo & CPUINFO_AVX512VBMI2) && have_avx512vl)
 
 /* optional instructions */
-#define TCG_TARGET_HAS_extract2_i32     1
 #define TCG_TARGET_HAS_add2_i32         1
 #define TCG_TARGET_HAS_sub2_i32         1
 
 #if TCG_TARGET_REG_BITS == 64
 /* Keep 32-bit values zero-extended in a register.  */
 #define TCG_TARGET_HAS_extr_i64_i32     1
-#define TCG_TARGET_HAS_extract2_i64     1
 #define TCG_TARGET_HAS_add2_i64         1
 #define TCG_TARGET_HAS_sub2_i64         1
 #define TCG_TARGET_HAS_qemu_st8_i32     0
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index 1dd9741f45..2b2ad9ca95 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -3261,6 +3261,21 @@ static const TCGOutOpExtract outop_sextract = {
     .out_rr = tgen_sextract,
 };
 
+static void tgen_extract2(TCGContext *s, TCGType type, TCGReg a0,
+                          TCGReg a1, TCGReg a2, unsigned shr)
+{
+    int rexw = type == TCG_TYPE_I32 ? 0 : P_REXW;
+
+    /* Note that SHRD outputs to the r/m operand.  */
+    tcg_out_modrm(s, OPC_SHRD_Ib + rexw, a2, a0);
+    tcg_out8(s, shr);
+}
+
+static const TCGOutOpExtract2 outop_extract2 = {
+    .base.static_constraint = C_O1_I2(r, 0, r),
+    .out_rrr = tgen_extract2,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -3414,12 +3429,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         break;
 #endif
 
-    OP_32_64(extract2):
-        /* Note that SHRD outputs to the r/m operand.  */
-        tcg_out_modrm(s, OPC_SHRD_Ib + rexw, a2, a0);
-        tcg_out8(s, args[3]);
-        break;
-
     case INDEX_op_mb:
         tcg_out_mb(s, a0);
         break;
@@ -4008,10 +4017,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(re, r);
 
-    case INDEX_op_extract2_i32:
-    case INDEX_op_extract2_i64:
-        return C_O1_I2(r, 0, r);
-
     case INDEX_op_add2_i32:
     case INDEX_op_add2_i64:
     case INDEX_op_sub2_i32:
diff --git a/tcg/loongarch64/tcg-target-has.h b/tcg/loongarch64/tcg-target-has.h
index 10090102f7..a1bd71db6a 100644
--- a/tcg/loongarch64/tcg-target-has.h
+++ b/tcg/loongarch64/tcg-target-has.h
@@ -10,13 +10,11 @@
 #include "host/cpuinfo.h"
 
 /* optional instructions */
-#define TCG_TARGET_HAS_extract2_i32     0
 #define TCG_TARGET_HAS_add2_i32         0
 #define TCG_TARGET_HAS_sub2_i32         0
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
 /* 64-bit operations */
-#define TCG_TARGET_HAS_extract2_i64     0
 #define TCG_TARGET_HAS_extr_i64_i32     1
 #define TCG_TARGET_HAS_add2_i64         0
 #define TCG_TARGET_HAS_sub2_i64         0
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index 0b64efc078..eb2143703d 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -1868,6 +1868,11 @@ static const TCGOutOpExtract outop_sextract = {
     .out_rr = tgen_sextract,
 };
 
+static const TCGOutOpExtract2 outop_extract2 = {
+    .base.static_constraint = C_NotImplemented,
+};
+
+
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
                        const int const_args[TCG_MAX_OP_ARGS])
diff --git a/tcg/mips/tcg-target-has.h b/tcg/mips/tcg-target-has.h
index 24b00f1eec..48a1e68fbe 100644
--- a/tcg/mips/tcg-target-has.h
+++ b/tcg/mips/tcg-target-has.h
@@ -51,13 +51,7 @@ extern bool use_mips32r2_instructions;
 #endif
 
 /* optional instructions detected at runtime */
-#define TCG_TARGET_HAS_extract2_i32     0
 #define TCG_TARGET_HAS_qemu_st8_i32     0
-
-#if TCG_TARGET_REG_BITS == 64
-#define TCG_TARGET_HAS_extract2_i64     0
-#endif
-
 #define TCG_TARGET_HAS_qemu_ldst_i128   0
 #define TCG_TARGET_HAS_tst              0
 
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index cd648ab1df..7fae1c51e9 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -2273,6 +2273,11 @@ static const TCGOutOpExtract outop_sextract = {
     .out_rr = tgen_sextract,
 };
 
+static const TCGOutOpExtract2 outop_extract2 = {
+    .base.static_constraint = C_NotImplemented,
+};
+
+
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
                        const int const_args[TCG_MAX_OP_ARGS])
diff --git a/tcg/ppc/tcg-target-has.h b/tcg/ppc/tcg-target-has.h
index bd9c3d92ed..033d58e095 100644
--- a/tcg/ppc/tcg-target-has.h
+++ b/tcg/ppc/tcg-target-has.h
@@ -17,14 +17,12 @@
 #define have_vsx       (cpuinfo & CPUINFO_VSX)
 
 /* optional instructions */
-#define TCG_TARGET_HAS_extract2_i32     0
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
 #if TCG_TARGET_REG_BITS == 64
 #define TCG_TARGET_HAS_add2_i32         0
 #define TCG_TARGET_HAS_sub2_i32         0
 #define TCG_TARGET_HAS_extr_i64_i32     0
-#define TCG_TARGET_HAS_extract2_i64     0
 #define TCG_TARGET_HAS_add2_i64         1
 #define TCG_TARGET_HAS_sub2_i64         1
 #endif
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index fc92a4896d..a964239aab 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -3495,6 +3495,10 @@ static const TCGOutOpExtract outop_sextract = {
     .out_rr = tgen_sextract,
 };
 
+static const TCGOutOpExtract2 outop_extract2 = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
diff --git a/tcg/riscv/tcg-target-has.h b/tcg/riscv/tcg-target-has.h
index 88fadc2428..b2814f8ef9 100644
--- a/tcg/riscv/tcg-target-has.h
+++ b/tcg/riscv/tcg-target-has.h
@@ -10,12 +10,10 @@
 #include "host/cpuinfo.h"
 
 /* optional instructions */
-#define TCG_TARGET_HAS_extract2_i32     0
 #define TCG_TARGET_HAS_add2_i32         1
 #define TCG_TARGET_HAS_sub2_i32         1
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
-#define TCG_TARGET_HAS_extract2_i64     0
 #define TCG_TARGET_HAS_extr_i64_i32     1
 #define TCG_TARGET_HAS_add2_i64         1
 #define TCG_TARGET_HAS_sub2_i64         1
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index 371e0c24c8..d74ac7587a 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -2542,6 +2542,11 @@ static const TCGOutOpExtract outop_sextract = {
     .out_rr = tgen_sextract,
 };
 
+static const TCGOutOpExtract2 outop_extract2 = {
+    .base.static_constraint = C_NotImplemented,
+};
+
+
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
                        const int const_args[TCG_MAX_OP_ARGS])
diff --git a/tcg/s390x/tcg-target-has.h b/tcg/s390x/tcg-target-has.h
index 95407f61cf..4a2b71995d 100644
--- a/tcg/s390x/tcg-target-has.h
+++ b/tcg/s390x/tcg-target-has.h
@@ -29,13 +29,11 @@ extern uint64_t s390_facilities[3];
     ((s390_facilities[FACILITY_##X / 64] >> (63 - FACILITY_##X % 64)) & 1)
 
 /* optional instructions */
-#define TCG_TARGET_HAS_extract2_i32   0
 #define TCG_TARGET_HAS_add2_i32       1
 #define TCG_TARGET_HAS_sub2_i32       1
 #define TCG_TARGET_HAS_extr_i64_i32   0
 #define TCG_TARGET_HAS_qemu_st8_i32   0
 
-#define TCG_TARGET_HAS_extract2_i64   0
 #define TCG_TARGET_HAS_add2_i64       1
 #define TCG_TARGET_HAS_sub2_i64       1
 
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index d72393315d..ff06834e6e 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -1637,6 +1637,10 @@ static const TCGOutOpExtract outop_sextract = {
     .out_rr = tgen_sextract,
 };
 
+static const TCGOutOpExtract2 outop_extract2 = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static void tgen_gotoi(TCGContext *s, int cc, const tcg_insn_unit *dest)
 {
     ptrdiff_t off = tcg_pcrel_diff(s, dest) >> 1;
diff --git a/tcg/sparc64/tcg-target-has.h b/tcg/sparc64/tcg-target-has.h
index 2ced6f7c1c..b8760dd154 100644
--- a/tcg/sparc64/tcg-target-has.h
+++ b/tcg/sparc64/tcg-target-has.h
@@ -14,13 +14,11 @@ extern bool use_vis3_instructions;
 #endif
 
 /* optional instructions */
-#define TCG_TARGET_HAS_extract2_i32     0
 #define TCG_TARGET_HAS_add2_i32         1
 #define TCG_TARGET_HAS_sub2_i32         1
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
 #define TCG_TARGET_HAS_extr_i64_i32     0
-#define TCG_TARGET_HAS_extract2_i64     0
 #define TCG_TARGET_HAS_add2_i64         1
 #define TCG_TARGET_HAS_sub2_i64         1
 
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index 741de260e9..4c7d916302 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -1795,6 +1795,10 @@ static const TCGOutOpExtract outop_sextract = {
     .out_rr = tgen_sextract,
 };
 
+static const TCGOutOpExtract2 outop_extract2 = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
                        const int const_args[TCG_MAX_OP_ARGS])
diff --git a/tcg/tcg-has.h b/tcg/tcg-has.h
index 21bef070fe..6125ac677c 100644
--- a/tcg/tcg-has.h
+++ b/tcg/tcg-has.h
@@ -12,7 +12,6 @@
 #if TCG_TARGET_REG_BITS == 32
 /* Turn some undef macros into false macros.  */
 #define TCG_TARGET_HAS_extr_i64_i32     0
-#define TCG_TARGET_HAS_extract2_i64     0
 #define TCG_TARGET_HAS_add2_i64         0
 #define TCG_TARGET_HAS_sub2_i64         0
 /* Turn some undef macros into true macros.  */
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index 961a39f446..5f95350d5d 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -921,7 +921,7 @@ void tcg_gen_deposit_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2,
 
     t1 = tcg_temp_ebb_new_i32();
 
-    if (TCG_TARGET_HAS_extract2_i32) {
+    if (tcg_op_supported(INDEX_op_extract2_i32, TCG_TYPE_I32, 0)) {
         if (ofs + len == 32) {
             tcg_gen_shli_i32(t1, arg1, len);
             tcg_gen_extract2_i32(ret, t1, arg2, len);
@@ -1077,7 +1077,7 @@ void tcg_gen_extract2_i32(TCGv_i32 ret, TCGv_i32 al, TCGv_i32 ah,
         tcg_gen_mov_i32(ret, ah);
     } else if (al == ah) {
         tcg_gen_rotri_i32(ret, al, ofs);
-    } else if (TCG_TARGET_HAS_extract2_i32) {
+    } else if (tcg_op_supported(INDEX_op_extract2_i32, TCG_TYPE_I32, 0)) {
         tcg_gen_op4i_i32(INDEX_op_extract2_i32, ret, al, ah, ofs);
     } else {
         TCGv_i32 t0 = tcg_temp_ebb_new_i32();
@@ -1799,7 +1799,7 @@ static inline void tcg_gen_shifti_i64(TCGv_i64 ret, TCGv_i64 arg1,
             tcg_gen_movi_i32(TCGV_LOW(ret), 0);
         }
     } else if (right) {
-        if (TCG_TARGET_HAS_extract2_i32) {
+        if (tcg_op_supported(INDEX_op_extract2_i32, TCG_TYPE_I32, 0)) {
             tcg_gen_extract2_i32(TCGV_LOW(ret),
                                  TCGV_LOW(arg1), TCGV_HIGH(arg1), c);
         } else {
@@ -1813,7 +1813,7 @@ static inline void tcg_gen_shifti_i64(TCGv_i64 ret, TCGv_i64 arg1,
             tcg_gen_shri_i32(TCGV_HIGH(ret), TCGV_HIGH(arg1), c);
         }
     } else {
-        if (TCG_TARGET_HAS_extract2_i32) {
+        if (tcg_op_supported(INDEX_op_extract2_i32, TCG_TYPE_I32, 0)) {
             tcg_gen_extract2_i32(TCGV_HIGH(ret),
                                  TCGV_LOW(arg1), TCGV_HIGH(arg1), 32 - c);
         } else {
@@ -2553,7 +2553,7 @@ void tcg_gen_deposit_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2,
 
     t1 = tcg_temp_ebb_new_i64();
 
-    if (TCG_TARGET_HAS_extract2_i64) {
+    if (tcg_op_supported(INDEX_op_extract2_i64, TCG_TYPE_I64, 0)) {
         if (ofs + len == 64) {
             tcg_gen_shli_i64(t1, arg1, len);
             tcg_gen_extract2_i64(ret, t1, arg2, len);
@@ -2781,7 +2781,7 @@ void tcg_gen_extract2_i64(TCGv_i64 ret, TCGv_i64 al, TCGv_i64 ah,
         tcg_gen_mov_i64(ret, ah);
     } else if (al == ah) {
         tcg_gen_rotri_i64(ret, al, ofs);
-    } else if (TCG_TARGET_HAS_extract2_i64) {
+    } else if (tcg_op_supported(INDEX_op_extract2_i64, TCG_TYPE_I64, 0)) {
         tcg_gen_op4i_i64(INDEX_op_extract2_i64, ret, al, ah, ofs);
     } else {
         TCGv_i64 t0 = tcg_temp_ebb_new_i64();
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 6b49fd4acf..3fbbe3bd83 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1029,6 +1029,12 @@ typedef struct TCGOutOpExtract {
                    unsigned ofs, unsigned len);
 } TCGOutOpExtract;
 
+typedef struct TCGOutOpExtract2 {
+    TCGOutOp base;
+    void (*out_rrr)(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1,
+                    TCGReg a2, unsigned shr);
+} TCGOutOpExtract2;
+
 typedef struct TCGOutOpMovcond {
     TCGOutOp base;
     void (*out)(TCGContext *s, TCGType type, TCGCond cond,
@@ -1140,6 +1146,8 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_divu2, TCGOutOpDivRem, outop_divu2),
     OUTOP(INDEX_op_eqv, TCGOutOpBinary, outop_eqv),
     OUTOP(INDEX_op_extract, TCGOutOpExtract, outop_extract),
+    OUTOP(INDEX_op_extract2_i32, TCGOutOpExtract2, outop_extract2),
+    OUTOP(INDEX_op_extract2_i64, TCGOutOpExtract2, outop_extract2),
     OUTOP(INDEX_op_movcond, TCGOutOpMovcond, outop_movcond),
     OUTOP(INDEX_op_mul, TCGOutOpBinary, outop_mul),
     OUTOP(INDEX_op_muls2, TCGOutOpMul2, outop_muls2),
@@ -2399,8 +2407,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i32:
         return true;
 
-    case INDEX_op_extract2_i32:
-        return TCG_TARGET_HAS_extract2_i32;
     case INDEX_op_add2_i32:
         return TCG_TARGET_HAS_add2_i32;
     case INDEX_op_sub2_i32:
@@ -2427,8 +2433,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_extrh_i64_i32:
         return TCG_TARGET_REG_BITS == 64;
 
-    case INDEX_op_extract2_i64:
-        return TCG_TARGET_HAS_extract2_i64;
     case INDEX_op_add2_i64:
         return TCG_TARGET_HAS_add2_i64;
     case INDEX_op_sub2_i64:
@@ -5593,6 +5597,18 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
         }
         break;
 
+    case INDEX_op_extract2_i32:
+    case INDEX_op_extract2_i64:
+        {
+            const TCGOutOpExtract2 *out = &outop_extract2;
+
+            tcg_debug_assert(!const_args[1]);
+            tcg_debug_assert(!const_args[2]);
+            out->out_rrr(s, type, new_args[0], new_args[1],
+                         new_args[2], new_args[3]);
+        }
+        break;
+
     case INDEX_op_muls2:
     case INDEX_op_mulu2:
         {
diff --git a/tcg/tci/tcg-target-has.h b/tcg/tci/tcg-target-has.h
index 90aa5c8bbb..4cb2b529ae 100644
--- a/tcg/tci/tcg-target-has.h
+++ b/tcg/tci/tcg-target-has.h
@@ -7,12 +7,10 @@
 #ifndef TCG_TARGET_HAS_H
 #define TCG_TARGET_HAS_H
 
-#define TCG_TARGET_HAS_extract2_i32     0
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
 #if TCG_TARGET_REG_BITS == 64
 #define TCG_TARGET_HAS_extr_i64_i32     0
-#define TCG_TARGET_HAS_extract2_i64     0
 #define TCG_TARGET_HAS_add2_i32         1
 #define TCG_TARGET_HAS_sub2_i32         1
 #define TCG_TARGET_HAS_add2_i64         1
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index ef14e81609..9a5ca9c778 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -447,6 +447,10 @@ static const TCGOutOpExtract outop_sextract = {
     .out_rr = tcg_out_sextract,
 };
 
+static const TCGOutOpExtract2 outop_extract2 = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static void tcg_out_ext8s(TCGContext *s, TCGType type, TCGReg rd, TCGReg rs)
 {
     tcg_out_sextract(s, type, rd, rs, 0, 8);

From 61d6a8767a5d4cd4fe5086ef98b53614ae099104 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sun, 12 Jan 2025 21:40:43 -0800
Subject: [PATCH 0464/2760] tcg: Merge INDEX_op_extract2_{i32,i64}
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 docs/devel/tcg-ops.rst     |  4 ++--
 include/tcg/tcg-opc.h      |  5 +----
 target/i386/tcg/emit.c.inc | 12 +-----------
 tcg/optimize.c             | 10 +++++-----
 tcg/tcg-op.c               | 16 ++++++++--------
 tcg/tcg.c                  |  6 ++----
 6 files changed, 19 insertions(+), 34 deletions(-)

diff --git a/docs/devel/tcg-ops.rst b/docs/devel/tcg-ops.rst
index aea8a897bd..9392d88069 100644
--- a/docs/devel/tcg-ops.rst
+++ b/docs/devel/tcg-ops.rst
@@ -476,9 +476,9 @@ Misc
        |
        | (using an arithmetic right shift) on TCG_TYPE_I32.
 
-   * - extract2_i32/i64 *dest*, *t1*, *t2*, *pos*
+   * - extract2 *dest*, *t1*, *t2*, *pos*
 
-     - | For N = {32,64}, extract an N-bit quantity from the concatenation
+     - | For TCG_TYPE_I{N}, extract an N-bit quantity from the concatenation
          of *t2*:*t1*, beginning at *pos*. The tcg_gen_extract2_{i32,i64} expander
          accepts 0 <= *pos* <= N as inputs. The backend code generator will
          not see either 0 or N as inputs for these opcodes.
diff --git a/include/tcg/tcg-opc.h b/include/tcg/tcg-opc.h
index c6848b3c63..1f995c54be 100644
--- a/include/tcg/tcg-opc.h
+++ b/include/tcg/tcg-opc.h
@@ -56,6 +56,7 @@ DEF(divu, 1, 2, 0, TCG_OPF_INT)
 DEF(divu2, 2, 3, 0, TCG_OPF_INT)
 DEF(eqv, 1, 2, 0, TCG_OPF_INT)
 DEF(extract, 1, 1, 2, TCG_OPF_INT)
+DEF(extract2, 1, 2, 1, TCG_OPF_INT)
 DEF(movcond, 1, 4, 1, TCG_OPF_INT)
 DEF(mul, 1, 2, 0, TCG_OPF_INT)
 DEF(muls2, 2, 2, 0, TCG_OPF_INT)
@@ -90,8 +91,6 @@ DEF(ld_i32, 1, 1, 1, 0)
 DEF(st8_i32, 0, 2, 1, 0)
 DEF(st16_i32, 0, 2, 1, 0)
 DEF(st_i32, 0, 2, 1, 0)
-/* shifts/rotates */
-DEF(extract2_i32, 1, 2, 1, 0)
 
 DEF(add2_i32, 2, 4, 0, 0)
 DEF(sub2_i32, 2, 4, 0, 0)
@@ -110,8 +109,6 @@ DEF(st8_i64, 0, 2, 1, 0)
 DEF(st16_i64, 0, 2, 1, 0)
 DEF(st32_i64, 0, 2, 1, 0)
 DEF(st_i64, 0, 2, 1, 0)
-/* shifts/rotates */
-DEF(extract2_i64, 1, 2, 1, 0)
 
 /* size changing ops */
 DEF(ext_i32_i64, 1, 1, 0, 0)
diff --git a/target/i386/tcg/emit.c.inc b/target/i386/tcg/emit.c.inc
index ca6bc2ea82..e3166e70a5 100644
--- a/target/i386/tcg/emit.c.inc
+++ b/target/i386/tcg/emit.c.inc
@@ -19,16 +19,6 @@
  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  */
 
-/*
- * Sometimes, knowing what the backend has can produce better code.
- * The exact opcode to check depends on 32- vs. 64-bit.
- */
-#ifdef TARGET_X86_64
-#define INDEX_op_extract2_tl            INDEX_op_extract2_i64
-#else
-#define INDEX_op_extract2_tl            INDEX_op_extract2_i32
-#endif
-
 #define MMX_OFFSET(reg)                        \
   ({ assert((reg) >= 0 && (reg) <= 7);         \
      offsetof(CPUX86State, fpregs[reg].mmx); })
@@ -3023,7 +3013,7 @@ static void gen_PMOVMSKB(DisasContext *s, X86DecodedInsn *decode)
     tcg_gen_ld8u_tl(s->T0, tcg_env, offsetof(CPUX86State, xmm_t0.ZMM_B(vec_len - 1)));
     while (vec_len > 8) {
         vec_len -= 8;
-        if (tcg_op_supported(INDEX_op_extract2_tl, TCG_TYPE_TL, 0)) {
+        if (tcg_op_supported(INDEX_op_extract2, TCG_TYPE_TL, 0)) {
             /*
              * Load the next byte of the result into the high byte of T.
              * TCG does a similar expansion of deposit to shl+extract2; by
diff --git a/tcg/optimize.c b/tcg/optimize.c
index acc566ed76..a728a4b2fa 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -1873,12 +1873,12 @@ static bool fold_extract2(OptContext *ctx, TCGOp *op)
         uint64_t v2 = arg_info(op->args[2])->val;
         int shr = op->args[3];
 
-        if (op->opc == INDEX_op_extract2_i64) {
-            v1 >>= shr;
-            v2 <<= 64 - shr;
-        } else {
+        if (ctx->type == TCG_TYPE_I32) {
             v1 = (uint32_t)v1 >> shr;
             v2 = (uint64_t)((int32_t)v2 << (32 - shr));
+        } else {
+            v1 >>= shr;
+            v2 <<= 64 - shr;
         }
         return tcg_opt_gen_movi(ctx, op, op->args[0], v1 | v2);
     }
@@ -2878,7 +2878,7 @@ void tcg_optimize(TCGContext *s)
         case INDEX_op_extract:
             done = fold_extract(&ctx, op);
             break;
-        CASE_OP_32_64(extract2):
+        case INDEX_op_extract2:
             done = fold_extract2(&ctx, op);
             break;
         case INDEX_op_ext_i32_i64:
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index 5f95350d5d..edbb214f7c 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -921,7 +921,7 @@ void tcg_gen_deposit_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2,
 
     t1 = tcg_temp_ebb_new_i32();
 
-    if (tcg_op_supported(INDEX_op_extract2_i32, TCG_TYPE_I32, 0)) {
+    if (tcg_op_supported(INDEX_op_extract2, TCG_TYPE_I32, 0)) {
         if (ofs + len == 32) {
             tcg_gen_shli_i32(t1, arg1, len);
             tcg_gen_extract2_i32(ret, t1, arg2, len);
@@ -1077,8 +1077,8 @@ void tcg_gen_extract2_i32(TCGv_i32 ret, TCGv_i32 al, TCGv_i32 ah,
         tcg_gen_mov_i32(ret, ah);
     } else if (al == ah) {
         tcg_gen_rotri_i32(ret, al, ofs);
-    } else if (tcg_op_supported(INDEX_op_extract2_i32, TCG_TYPE_I32, 0)) {
-        tcg_gen_op4i_i32(INDEX_op_extract2_i32, ret, al, ah, ofs);
+    } else if (tcg_op_supported(INDEX_op_extract2, TCG_TYPE_I32, 0)) {
+        tcg_gen_op4i_i32(INDEX_op_extract2, ret, al, ah, ofs);
     } else {
         TCGv_i32 t0 = tcg_temp_ebb_new_i32();
         tcg_gen_shri_i32(t0, al, ofs);
@@ -1799,7 +1799,7 @@ static inline void tcg_gen_shifti_i64(TCGv_i64 ret, TCGv_i64 arg1,
             tcg_gen_movi_i32(TCGV_LOW(ret), 0);
         }
     } else if (right) {
-        if (tcg_op_supported(INDEX_op_extract2_i32, TCG_TYPE_I32, 0)) {
+        if (tcg_op_supported(INDEX_op_extract2, TCG_TYPE_I32, 0)) {
             tcg_gen_extract2_i32(TCGV_LOW(ret),
                                  TCGV_LOW(arg1), TCGV_HIGH(arg1), c);
         } else {
@@ -1813,7 +1813,7 @@ static inline void tcg_gen_shifti_i64(TCGv_i64 ret, TCGv_i64 arg1,
             tcg_gen_shri_i32(TCGV_HIGH(ret), TCGV_HIGH(arg1), c);
         }
     } else {
-        if (tcg_op_supported(INDEX_op_extract2_i32, TCG_TYPE_I32, 0)) {
+        if (tcg_op_supported(INDEX_op_extract2, TCG_TYPE_I32, 0)) {
             tcg_gen_extract2_i32(TCGV_HIGH(ret),
                                  TCGV_LOW(arg1), TCGV_HIGH(arg1), 32 - c);
         } else {
@@ -2553,7 +2553,7 @@ void tcg_gen_deposit_i64(TCGv_i64 ret, TCGv_i64 arg1, TCGv_i64 arg2,
 
     t1 = tcg_temp_ebb_new_i64();
 
-    if (tcg_op_supported(INDEX_op_extract2_i64, TCG_TYPE_I64, 0)) {
+    if (tcg_op_supported(INDEX_op_extract2, TCG_TYPE_I64, 0)) {
         if (ofs + len == 64) {
             tcg_gen_shli_i64(t1, arg1, len);
             tcg_gen_extract2_i64(ret, t1, arg2, len);
@@ -2781,8 +2781,8 @@ void tcg_gen_extract2_i64(TCGv_i64 ret, TCGv_i64 al, TCGv_i64 ah,
         tcg_gen_mov_i64(ret, ah);
     } else if (al == ah) {
         tcg_gen_rotri_i64(ret, al, ofs);
-    } else if (tcg_op_supported(INDEX_op_extract2_i64, TCG_TYPE_I64, 0)) {
-        tcg_gen_op4i_i64(INDEX_op_extract2_i64, ret, al, ah, ofs);
+    } else if (tcg_op_supported(INDEX_op_extract2, TCG_TYPE_I64, 0)) {
+        tcg_gen_op4i_i64(INDEX_op_extract2, ret, al, ah, ofs);
     } else {
         TCGv_i64 t0 = tcg_temp_ebb_new_i64();
         tcg_gen_shri_i64(t0, al, ofs);
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 3fbbe3bd83..037b5a4664 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1146,8 +1146,7 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_divu2, TCGOutOpDivRem, outop_divu2),
     OUTOP(INDEX_op_eqv, TCGOutOpBinary, outop_eqv),
     OUTOP(INDEX_op_extract, TCGOutOpExtract, outop_extract),
-    OUTOP(INDEX_op_extract2_i32, TCGOutOpExtract2, outop_extract2),
-    OUTOP(INDEX_op_extract2_i64, TCGOutOpExtract2, outop_extract2),
+    OUTOP(INDEX_op_extract2, TCGOutOpExtract2, outop_extract2),
     OUTOP(INDEX_op_movcond, TCGOutOpMovcond, outop_movcond),
     OUTOP(INDEX_op_mul, TCGOutOpBinary, outop_mul),
     OUTOP(INDEX_op_muls2, TCGOutOpMul2, outop_muls2),
@@ -5597,8 +5596,7 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
         }
         break;
 
-    case INDEX_op_extract2_i32:
-    case INDEX_op_extract2_i64:
+    case INDEX_op_extract2:
         {
             const TCGOutOpExtract2 *out = &outop_extract2;
 

From 3ff7e44ef35924f76dbe36510c54c27e72af9121 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 13 Jan 2025 20:14:09 -0800
Subject: [PATCH 0465/2760] tcg: Expand fallback add2 with 32-bit operations

No need to expand to i64 to perform the add.
This is smaller on a loongarch64 host, e.g.

	bstrpick_d  r28, r27, 31, 0
	bstrpick_d  r29, r24, 31, 0
	add_d       r28, r28, r29
	addi_w      r29, r28, 0
	srai_d      r28, r28, 32
  ---
	add_w       r28, r27, r24
	sltu        r29, r28, r24

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tcg-op.c | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index edbb214f7c..8b1356c526 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -1105,14 +1105,15 @@ void tcg_gen_add2_i32(TCGv_i32 rl, TCGv_i32 rh, TCGv_i32 al,
     if (TCG_TARGET_HAS_add2_i32) {
         tcg_gen_op6_i32(INDEX_op_add2_i32, rl, rh, al, ah, bl, bh);
     } else {
-        TCGv_i64 t0 = tcg_temp_ebb_new_i64();
-        TCGv_i64 t1 = tcg_temp_ebb_new_i64();
-        tcg_gen_concat_i32_i64(t0, al, ah);
-        tcg_gen_concat_i32_i64(t1, bl, bh);
-        tcg_gen_add_i64(t0, t0, t1);
-        tcg_gen_extr_i64_i32(rl, rh, t0);
-        tcg_temp_free_i64(t0);
-        tcg_temp_free_i64(t1);
+        TCGv_i32 t0 = tcg_temp_ebb_new_i32();
+        TCGv_i32 t1 = tcg_temp_ebb_new_i32();
+        tcg_gen_add_i32(t0, al, bl);
+        tcg_gen_setcond_i32(TCG_COND_LTU, t1, t0, al);
+        tcg_gen_add_i32(rh, ah, bh);
+        tcg_gen_add_i32(rh, rh, t1);
+        tcg_gen_mov_i32(rl, t0);
+        tcg_temp_free_i32(t0);
+        tcg_temp_free_i32(t1);
     }
 }
 

From 3db22914ced9bb3683bffa03729608be0c42f666 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 13 Jan 2025 20:21:09 -0800
Subject: [PATCH 0466/2760] tcg: Expand fallback sub2 with 32-bit operations

No need to expand to i64 to perform the subtract.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tcg-op.c | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index 8b1356c526..127338b994 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -1123,14 +1123,15 @@ void tcg_gen_sub2_i32(TCGv_i32 rl, TCGv_i32 rh, TCGv_i32 al,
     if (TCG_TARGET_HAS_sub2_i32) {
         tcg_gen_op6_i32(INDEX_op_sub2_i32, rl, rh, al, ah, bl, bh);
     } else {
-        TCGv_i64 t0 = tcg_temp_ebb_new_i64();
-        TCGv_i64 t1 = tcg_temp_ebb_new_i64();
-        tcg_gen_concat_i32_i64(t0, al, ah);
-        tcg_gen_concat_i32_i64(t1, bl, bh);
-        tcg_gen_sub_i64(t0, t0, t1);
-        tcg_gen_extr_i64_i32(rl, rh, t0);
-        tcg_temp_free_i64(t0);
-        tcg_temp_free_i64(t1);
+        TCGv_i32 t0 = tcg_temp_ebb_new_i32();
+        TCGv_i32 t1 = tcg_temp_ebb_new_i32();
+        tcg_gen_sub_i32(t0, al, bl);
+        tcg_gen_setcond_i32(TCG_COND_LTU, t1, al, bl);
+        tcg_gen_sub_i32(rh, ah, bh);
+        tcg_gen_sub_i32(rh, rh, t1);
+        tcg_gen_mov_i32(rl, t0);
+        tcg_temp_free_i32(t0);
+        tcg_temp_free_i32(t1);
     }
 }
 

From 8dc1bdf79553594287b6c3f9185fe028307aedcb Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 13 Jan 2025 21:13:54 -0800
Subject: [PATCH 0467/2760] tcg: Do not default add2/sub2_i32 for 32-bit hosts

Require TCG_TARGET_HAS_{add2,sub2}_i32 be defined,
one way or another.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/arm/tcg-target-has.h  | 2 ++
 tcg/mips/tcg-target-has.h | 3 +++
 tcg/ppc/tcg-target-has.h  | 3 +++
 tcg/tcg-has.h             | 3 ---
 tcg/tci/tcg-target-has.h  | 4 ++--
 5 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/tcg/arm/tcg-target-has.h b/tcg/arm/tcg-target-has.h
index 0d6a785542..3973df1f12 100644
--- a/tcg/arm/tcg-target-has.h
+++ b/tcg/arm/tcg-target-has.h
@@ -24,6 +24,8 @@ extern bool use_neon_instructions;
 #endif
 
 /* optional instructions */
+#define TCG_TARGET_HAS_add2_i32         1
+#define TCG_TARGET_HAS_sub2_i32         1
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
 #define TCG_TARGET_HAS_qemu_ldst_i128   0
diff --git a/tcg/mips/tcg-target-has.h b/tcg/mips/tcg-target-has.h
index 48a1e68fbe..9f6fa194b9 100644
--- a/tcg/mips/tcg-target-has.h
+++ b/tcg/mips/tcg-target-has.h
@@ -48,6 +48,9 @@ extern bool use_mips32r2_instructions;
 #define TCG_TARGET_HAS_sub2_i64         0
 #define TCG_TARGET_HAS_ext32s_i64       1
 #define TCG_TARGET_HAS_ext32u_i64       1
+#else
+#define TCG_TARGET_HAS_add2_i32         1
+#define TCG_TARGET_HAS_sub2_i32         1
 #endif
 
 /* optional instructions detected at runtime */
diff --git a/tcg/ppc/tcg-target-has.h b/tcg/ppc/tcg-target-has.h
index 033d58e095..8d832ce99c 100644
--- a/tcg/ppc/tcg-target-has.h
+++ b/tcg/ppc/tcg-target-has.h
@@ -25,6 +25,9 @@
 #define TCG_TARGET_HAS_extr_i64_i32     0
 #define TCG_TARGET_HAS_add2_i64         1
 #define TCG_TARGET_HAS_sub2_i64         1
+#else
+#define TCG_TARGET_HAS_add2_i32         1
+#define TCG_TARGET_HAS_sub2_i32         1
 #endif
 
 #define TCG_TARGET_HAS_qemu_ldst_i128   \
diff --git a/tcg/tcg-has.h b/tcg/tcg-has.h
index 6125ac677c..50e8d0cda4 100644
--- a/tcg/tcg-has.h
+++ b/tcg/tcg-has.h
@@ -14,9 +14,6 @@
 #define TCG_TARGET_HAS_extr_i64_i32     0
 #define TCG_TARGET_HAS_add2_i64         0
 #define TCG_TARGET_HAS_sub2_i64         0
-/* Turn some undef macros into true macros.  */
-#define TCG_TARGET_HAS_add2_i32         1
-#define TCG_TARGET_HAS_sub2_i32         1
 #endif
 
 #if !defined(TCG_TARGET_HAS_v64) \
diff --git a/tcg/tci/tcg-target-has.h b/tcg/tci/tcg-target-has.h
index 4cb2b529ae..6063f32f7b 100644
--- a/tcg/tci/tcg-target-has.h
+++ b/tcg/tci/tcg-target-has.h
@@ -8,11 +8,11 @@
 #define TCG_TARGET_HAS_H
 
 #define TCG_TARGET_HAS_qemu_st8_i32     0
+#define TCG_TARGET_HAS_add2_i32         1
+#define TCG_TARGET_HAS_sub2_i32         1
 
 #if TCG_TARGET_REG_BITS == 64
 #define TCG_TARGET_HAS_extr_i64_i32     0
-#define TCG_TARGET_HAS_add2_i32         1
-#define TCG_TARGET_HAS_sub2_i32         1
 #define TCG_TARGET_HAS_add2_i64         1
 #define TCG_TARGET_HAS_sub2_i64         1
 #endif /* TCG_TARGET_REG_BITS == 64 */

From 52c49c79b820ceeff10c7c414f747f9bbb39f6c9 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 13 Jan 2025 21:16:40 -0800
Subject: [PATCH 0468/2760] tcg/mips: Drop support for add2/sub2

We now produce exactly the same code via generic expansion.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/mips/tcg-target-con-set.h |  1 -
 tcg/mips/tcg-target-con-str.h |  1 -
 tcg/mips/tcg-target-has.h     |  7 ++--
 tcg/mips/tcg-target.c.inc     | 67 +----------------------------------
 4 files changed, 3 insertions(+), 73 deletions(-)

diff --git a/tcg/mips/tcg-target-con-set.h b/tcg/mips/tcg-target-con-set.h
index 4e09c9a400..5304691dc1 100644
--- a/tcg/mips/tcg-target-con-set.h
+++ b/tcg/mips/tcg-target-con-set.h
@@ -28,4 +28,3 @@ C_O1_I4(r, r, rz, rz, rz)
 C_O1_I4(r, r, r, rz, rz)
 C_O2_I1(r, r, r)
 C_O2_I2(r, r, r, r)
-C_O2_I4(r, r, rz, rz, rN, rN)
diff --git a/tcg/mips/tcg-target-con-str.h b/tcg/mips/tcg-target-con-str.h
index dfe2b156df..db2b225e4a 100644
--- a/tcg/mips/tcg-target-con-str.h
+++ b/tcg/mips/tcg-target-con-str.h
@@ -17,5 +17,4 @@ REGS('r', ALL_GENERAL_REGS)
 CONST('I', TCG_CT_CONST_U16)
 CONST('J', TCG_CT_CONST_S16)
 CONST('K', TCG_CT_CONST_P2M1)
-CONST('N', TCG_CT_CONST_N16)
 CONST('W', TCG_CT_CONST_WSZ)
diff --git a/tcg/mips/tcg-target-has.h b/tcg/mips/tcg-target-has.h
index 9f6fa194b9..9d86906bf3 100644
--- a/tcg/mips/tcg-target-has.h
+++ b/tcg/mips/tcg-target-has.h
@@ -39,18 +39,15 @@ extern bool use_mips32r2_instructions;
 #endif
 
 /* optional instructions */
-
-#if TCG_TARGET_REG_BITS == 64
 #define TCG_TARGET_HAS_add2_i32         0
 #define TCG_TARGET_HAS_sub2_i32         0
+
+#if TCG_TARGET_REG_BITS == 64
 #define TCG_TARGET_HAS_extr_i64_i32     1
 #define TCG_TARGET_HAS_add2_i64         0
 #define TCG_TARGET_HAS_sub2_i64         0
 #define TCG_TARGET_HAS_ext32s_i64       1
 #define TCG_TARGET_HAS_ext32u_i64       1
-#else
-#define TCG_TARGET_HAS_add2_i32         1
-#define TCG_TARGET_HAS_sub2_i32         1
 #endif
 
 /* optional instructions detected at runtime */
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index 7fae1c51e9..e69781b871 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -187,8 +187,7 @@ static bool patch_reloc(tcg_insn_unit *code_ptr, int type,
 #define TCG_CT_CONST_U16  0x100    /* Unsigned 16-bit: 0 - 0xffff.  */
 #define TCG_CT_CONST_S16  0x200    /* Signed 16-bit: -32768 - 32767 */
 #define TCG_CT_CONST_P2M1 0x400    /* Power of 2 minus 1.  */
-#define TCG_CT_CONST_N16  0x800    /* "Negatable" 16-bit: -32767 - 32767 */
-#define TCG_CT_CONST_WSZ  0x1000   /* word size */
+#define TCG_CT_CONST_WSZ  0x800    /* word size */
 
 #define ALL_GENERAL_REGS  0xffffffffu
 
@@ -207,8 +206,6 @@ static bool tcg_target_const_match(int64_t val, int ct,
         return 1;
     } else if ((ct & TCG_CT_CONST_S16) && val == (int16_t)val) {
         return 1;
-    } else if ((ct & TCG_CT_CONST_N16) && val >= -32767 && val <= 32767) {
-        return 1;
     } else if ((ct & TCG_CT_CONST_P2M1)
                && use_mips32r2_instructions && is_p2m1(val)) {
         return 1;
@@ -765,55 +762,6 @@ static bool tcg_out_sti(TCGContext *s, TCGType type, TCGArg val,
     return false;
 }
 
-static void tcg_out_addsub2(TCGContext *s, TCGReg rl, TCGReg rh, TCGReg al,
-                            TCGReg ah, TCGArg bl, TCGArg bh, bool cbl,
-                            bool cbh, bool is_sub)
-{
-    TCGReg th = TCG_TMP1;
-
-    /* If we have a negative constant such that negating it would
-       make the high part zero, we can (usually) eliminate one insn.  */
-    if (cbl && cbh && bh == -1 && bl != 0) {
-        bl = -bl;
-        bh = 0;
-        is_sub = !is_sub;
-    }
-
-    /* By operating on the high part first, we get to use the final
-       carry operation to move back from the temporary.  */
-    if (!cbh) {
-        tcg_out_opc_reg(s, (is_sub ? OPC_SUBU : OPC_ADDU), th, ah, bh);
-    } else if (bh != 0 || ah == rl) {
-        tcg_out_opc_imm(s, OPC_ADDIU, th, ah, (is_sub ? -bh : bh));
-    } else {
-        th = ah;
-    }
-
-    /* Note that tcg optimization should eliminate the bl == 0 case.  */
-    if (is_sub) {
-        if (cbl) {
-            tcg_out_opc_imm(s, OPC_SLTIU, TCG_TMP0, al, bl);
-            tcg_out_opc_imm(s, OPC_ADDIU, rl, al, -bl);
-        } else {
-            tcg_out_opc_reg(s, OPC_SLTU, TCG_TMP0, al, bl);
-            tcg_out_opc_reg(s, OPC_SUBU, rl, al, bl);
-        }
-        tcg_out_opc_reg(s, OPC_SUBU, rh, th, TCG_TMP0);
-    } else {
-        if (cbl) {
-            tcg_out_opc_imm(s, OPC_ADDIU, rl, al, bl);
-            tcg_out_opc_imm(s, OPC_SLTIU, TCG_TMP0, rl, bl);
-        } else if (rl == al && rl == bl) {
-            tcg_out_opc_sa(s, OPC_SRL, TCG_TMP0, al, TCG_TARGET_REG_BITS - 1);
-            tcg_out_opc_reg(s, OPC_ADDU, rl, al, bl);
-        } else {
-            tcg_out_opc_reg(s, OPC_ADDU, rl, al, bl);
-            tcg_out_opc_reg(s, OPC_SLTU, TCG_TMP0, rl, (rl == bl ? al : bl));
-        }
-        tcg_out_opc_reg(s, OPC_ADDU, rh, th, TCG_TMP0);
-    }
-}
-
 #define SETCOND_INV    TCG_TARGET_NB_REGS
 #define SETCOND_NEZ    (SETCOND_INV << 1)
 #define SETCOND_FLAGS  (SETCOND_INV | SETCOND_NEZ)
@@ -2370,15 +2318,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    case INDEX_op_add2_i32:
-        tcg_out_addsub2(s, a0, a1, a2, args[3], args[4], args[5],
-                        const_args[4], const_args[5], false);
-        break;
-    case INDEX_op_sub2_i32:
-        tcg_out_addsub2(s, a0, a1, a2, args[3], args[4], args[5],
-                        const_args[4], const_args[5], true);
-        break;
-
     case INDEX_op_mb:
         tcg_out_mb(s, a0);
         break;
@@ -2420,10 +2359,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(rz, r);
 
-    case INDEX_op_add2_i32:
-    case INDEX_op_sub2_i32:
-        return C_O2_I4(r, r, rz, rz, rN, rN);
-
     case INDEX_op_qemu_ld_i32:
         return C_O1_I1(r, r);
     case INDEX_op_qemu_st_i32:

From 0e08be0f5482af78f7ed703f665287964d1650f5 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 13 Jan 2025 21:24:25 -0800
Subject: [PATCH 0469/2760] tcg/riscv: Drop support for add2/sub2

We now produce exactly the same code via generic expansion.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/riscv/tcg-target-con-set.h |  1 -
 tcg/riscv/tcg-target-has.h     |  6 +--
 tcg/riscv/tcg-target.c.inc     | 86 +---------------------------------
 3 files changed, 3 insertions(+), 90 deletions(-)

diff --git a/tcg/riscv/tcg-target-con-set.h b/tcg/riscv/tcg-target-con-set.h
index 5ff2c2db60..0fc26d3f98 100644
--- a/tcg/riscv/tcg-target-con-set.h
+++ b/tcg/riscv/tcg-target-con-set.h
@@ -18,7 +18,6 @@ C_O1_I2(r, r, ri)
 C_O1_I2(r, r, rI)
 C_N1_I2(r, r, rM)
 C_O1_I4(r, r, rI, rM, rM)
-C_O2_I4(r, r, rz, rz, rM, rM)
 C_O0_I2(v, r)
 C_O1_I1(v, r)
 C_O1_I1(v, v)
diff --git a/tcg/riscv/tcg-target-has.h b/tcg/riscv/tcg-target-has.h
index b2814f8ef9..c95dc1921e 100644
--- a/tcg/riscv/tcg-target-has.h
+++ b/tcg/riscv/tcg-target-has.h
@@ -10,13 +10,11 @@
 #include "host/cpuinfo.h"
 
 /* optional instructions */
-#define TCG_TARGET_HAS_add2_i32         1
-#define TCG_TARGET_HAS_sub2_i32         1
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
 #define TCG_TARGET_HAS_extr_i64_i32     1
-#define TCG_TARGET_HAS_add2_i64         1
-#define TCG_TARGET_HAS_sub2_i64         1
+#define TCG_TARGET_HAS_add2_i64         0
+#define TCG_TARGET_HAS_sub2_i64         0
 
 #define TCG_TARGET_HAS_qemu_ldst_i128   0
 
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index d74ac7587a..dce46dcba6 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -401,7 +401,7 @@ static bool tcg_target_const_match(int64_t val, int ct,
     }
     /*
      * Sign extended from 12 bits, +/- matching: [-0x7ff, 0x7ff].
-     * Used by addsub2 and movcond, which may need the negative value,
+     * Used by movcond, which may need the negative value,
      * and requires the modified constant to be representable.
      */
     if ((ct & TCG_CT_CONST_M12) && val >= -0x7ff && val <= 0x7ff) {
@@ -1073,67 +1073,6 @@ static bool tcg_out_sti(TCGContext *s, TCGType type, TCGArg val,
     return false;
 }
 
-static void tcg_out_addsub2(TCGContext *s,
-                            TCGReg rl, TCGReg rh,
-                            TCGReg al, TCGReg ah,
-                            TCGArg bl, TCGArg bh,
-                            bool cbl, bool cbh, bool is_sub, bool is32bit)
-{
-    const RISCVInsn opc_add = is32bit ? OPC_ADDW : OPC_ADD;
-    const RISCVInsn opc_addi = is32bit ? OPC_ADDIW : OPC_ADDI;
-    const RISCVInsn opc_sub = is32bit ? OPC_SUBW : OPC_SUB;
-    TCGReg th = TCG_REG_TMP1;
-
-    /* If we have a negative constant such that negating it would
-       make the high part zero, we can (usually) eliminate one insn.  */
-    if (cbl && cbh && bh == -1 && bl != 0) {
-        bl = -bl;
-        bh = 0;
-        is_sub = !is_sub;
-    }
-
-    /* By operating on the high part first, we get to use the final
-       carry operation to move back from the temporary.  */
-    if (!cbh) {
-        tcg_out_opc_reg(s, (is_sub ? opc_sub : opc_add), th, ah, bh);
-    } else if (bh != 0 || ah == rl) {
-        tcg_out_opc_imm(s, opc_addi, th, ah, (is_sub ? -bh : bh));
-    } else {
-        th = ah;
-    }
-
-    /* Note that tcg optimization should eliminate the bl == 0 case.  */
-    if (is_sub) {
-        if (cbl) {
-            tcg_out_opc_imm(s, OPC_SLTIU, TCG_REG_TMP0, al, bl);
-            tcg_out_opc_imm(s, opc_addi, rl, al, -bl);
-        } else {
-            tcg_out_opc_reg(s, OPC_SLTU, TCG_REG_TMP0, al, bl);
-            tcg_out_opc_reg(s, opc_sub, rl, al, bl);
-        }
-        tcg_out_opc_reg(s, opc_sub, rh, th, TCG_REG_TMP0);
-    } else {
-        if (cbl) {
-            tcg_out_opc_imm(s, opc_addi, rl, al, bl);
-            tcg_out_opc_imm(s, OPC_SLTIU, TCG_REG_TMP0, rl, bl);
-        } else if (al == bl) {
-            /*
-             * If the input regs overlap, this is a simple doubling
-             * and carry-out is the input msb.  This special case is
-             * required when the output reg overlaps the input,
-             * but we might as well use it always.
-             */
-            tcg_out_opc_imm(s, OPC_SLTI, TCG_REG_TMP0, al, 0);
-            tcg_out_opc_reg(s, opc_add, rl, al, al);
-        } else {
-            tcg_out_opc_reg(s, opc_add, rl, al, bl);
-            tcg_out_opc_reg(s, OPC_SLTU, TCG_REG_TMP0,
-                            rl, (rl == bl ? al : bl));
-        }
-        tcg_out_opc_reg(s, opc_add, rh, th, TCG_REG_TMP0);
-    }
-}
-
 static bool tcg_out_dup_vec(TCGContext *s, TCGType type, unsigned vece,
                                    TCGReg dst, TCGReg src)
 {
@@ -2608,23 +2547,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_ldst(s, OPC_SD, a0, a1, a2);
         break;
 
-    case INDEX_op_add2_i32:
-        tcg_out_addsub2(s, a0, a1, a2, args[3], args[4], args[5],
-                        const_args[4], const_args[5], false, true);
-        break;
-    case INDEX_op_add2_i64:
-        tcg_out_addsub2(s, a0, a1, a2, args[3], args[4], args[5],
-                        const_args[4], const_args[5], false, false);
-        break;
-    case INDEX_op_sub2_i32:
-        tcg_out_addsub2(s, a0, a1, a2, args[3], args[4], args[5],
-                        const_args[4], const_args[5], true, true);
-        break;
-    case INDEX_op_sub2_i64:
-        tcg_out_addsub2(s, a0, a1, a2, args[3], args[4], args[5],
-                        const_args[4], const_args[5], true, false);
-        break;
-
     case INDEX_op_qemu_ld_i32:
         tcg_out_qemu_ld(s, a0, a1, a2, TCG_TYPE_I32);
         break;
@@ -2897,12 +2819,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(rz, r);
 
-    case INDEX_op_add2_i32:
-    case INDEX_op_add2_i64:
-    case INDEX_op_sub2_i32:
-    case INDEX_op_sub2_i64:
-        return C_O2_I4(r, r, rz, rz, rM, rM);
-
     case INDEX_op_qemu_ld_i32:
     case INDEX_op_qemu_ld_i64:
         return C_O1_I1(r, r);

From 7d10d8e076201e968d57f1c2f5ffd8c88ae1eec9 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 14 Jan 2025 13:04:15 -0800
Subject: [PATCH 0470/2760] tcg: Move i into each for loop in liveness_pass_1
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Use per-loop variables instead of one 'i' for the function.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tcg.c | 23 +++++++++++------------
 1 file changed, 11 insertions(+), 12 deletions(-)

diff --git a/tcg/tcg.c b/tcg/tcg.c
index 037b5a4664..e2ca02eddf 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -3924,10 +3924,9 @@ liveness_pass_1(TCGContext *s)
     int nb_temps = s->nb_temps;
     TCGOp *op, *op_prev;
     TCGRegSet *prefs;
-    int i;
 
     prefs = tcg_malloc(sizeof(TCGRegSet) * nb_temps);
-    for (i = 0; i < nb_temps; ++i) {
+    for (int i = 0; i < nb_temps; ++i) {
         s->temps[i].state_ptr = prefs + i;
     }
 
@@ -3954,7 +3953,7 @@ liveness_pass_1(TCGContext *s)
 
                 /* pure functions can be removed if their result is unused */
                 if (call_flags & TCG_CALL_NO_SIDE_EFFECTS) {
-                    for (i = 0; i < nb_oargs; i++) {
+                    for (int i = 0; i < nb_oargs; i++) {
                         ts = arg_temp(op->args[i]);
                         if (ts->state != TS_DEAD) {
                             goto do_not_remove_call;
@@ -3965,7 +3964,7 @@ liveness_pass_1(TCGContext *s)
             do_not_remove_call:
 
                 /* Output args are dead.  */
-                for (i = 0; i < nb_oargs; i++) {
+                for (int i = 0; i < nb_oargs; i++) {
                     ts = arg_temp(op->args[i]);
                     if (ts->state & TS_DEAD) {
                         arg_life |= DEAD_ARG << i;
@@ -3988,7 +3987,7 @@ liveness_pass_1(TCGContext *s)
                 }
 
                 /* Record arguments that die in this helper.  */
-                for (i = nb_oargs; i < nb_iargs + nb_oargs; i++) {
+                for (int i = nb_oargs; i < nb_iargs + nb_oargs; i++) {
                     ts = arg_temp(op->args[i]);
                     if (ts->state & TS_DEAD) {
                         arg_life |= DEAD_ARG << i;
@@ -4008,7 +4007,7 @@ liveness_pass_1(TCGContext *s)
                  * order so that if a temp is used more than once, the stack
                  * reset to max happens before the register reset to 0.
                  */
-                for (i = nb_iargs - 1; i >= 0; i--) {
+                for (int i = nb_iargs - 1; i >= 0; i--) {
                     const TCGCallArgumentLoc *loc = &info->in[i];
                     ts = arg_temp(op->args[nb_oargs + i]);
 
@@ -4036,7 +4035,7 @@ liveness_pass_1(TCGContext *s)
                  * If a temp is used once, this produces a single set bit;
                  * if a temp is used multiple times, this produces a set.
                  */
-                for (i = 0; i < nb_iargs; i++) {
+                for (int i = 0; i < nb_iargs; i++) {
                     const TCGCallArgumentLoc *loc = &info->in[i];
                     ts = arg_temp(op->args[nb_oargs + i]);
 
@@ -4135,7 +4134,7 @@ liveness_pass_1(TCGContext *s)
                its outputs are dead. We assume that nb_oargs == 0
                implies side effects */
             if (!(def->flags & TCG_OPF_SIDE_EFFECTS) && nb_oargs != 0) {
-                for (i = 0; i < nb_oargs; i++) {
+                for (int i = 0; i < nb_oargs; i++) {
                     if (arg_temp(op->args[i])->state != TS_DEAD) {
                         goto do_not_remove;
                     }
@@ -4149,7 +4148,7 @@ liveness_pass_1(TCGContext *s)
             break;
 
         do_not_remove:
-            for (i = 0; i < nb_oargs; i++) {
+            for (int i = 0; i < nb_oargs; i++) {
                 ts = arg_temp(op->args[i]);
 
                 /* Remember the preference of the uses that followed.  */
@@ -4183,7 +4182,7 @@ liveness_pass_1(TCGContext *s)
             }
 
             /* Record arguments that die in this opcode.  */
-            for (i = nb_oargs; i < nb_oargs + nb_iargs; i++) {
+            for (int i = nb_oargs; i < nb_oargs + nb_iargs; i++) {
                 ts = arg_temp(op->args[i]);
                 if (ts->state & TS_DEAD) {
                     arg_life |= DEAD_ARG << i;
@@ -4191,7 +4190,7 @@ liveness_pass_1(TCGContext *s)
             }
 
             /* Input arguments are live for preceding opcodes.  */
-            for (i = nb_oargs; i < nb_oargs + nb_iargs; i++) {
+            for (int i = nb_oargs; i < nb_oargs + nb_iargs; i++) {
                 ts = arg_temp(op->args[i]);
                 if (ts->state & TS_DEAD) {
                     /* For operands that were dead, initially allow
@@ -4215,7 +4214,7 @@ liveness_pass_1(TCGContext *s)
 
             default:
                 args_ct = opcode_args_ct(op);
-                for (i = nb_oargs; i < nb_oargs + nb_iargs; i++) {
+                for (int i = nb_oargs; i < nb_oargs + nb_iargs; i++) {
                     const TCGArgConstraint *ct = &args_ct[i];
                     TCGRegSet set, *pset;
 

From 3e3689df4e05eb76b64a9e45247d87f9dad03177 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 14 Jan 2025 13:12:35 -0800
Subject: [PATCH 0471/2760] tcg: Sink def, nb_iargs, nb_oargs loads in
 liveness_pass_1

Sink the sets of the def, nb_iargs, nb_oargs variables to
the default and do_not_remove labels.  They're not really
needed beforehand, and it avoids preceding code from having
to keep them up-to-date.  Note that def had *not* been kept
up-to-date; thankfully only def->flags had been used and
those bits were constant between opcode changes.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tcg.c | 20 +++++++-------------
 1 file changed, 7 insertions(+), 13 deletions(-)

diff --git a/tcg/tcg.c b/tcg/tcg.c
index e2ca02eddf..2849bba480 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -4071,8 +4071,6 @@ liveness_pass_1(TCGContext *s)
         case INDEX_op_sub2_i64:
             opc_new = INDEX_op_sub;
         do_addsub2:
-            nb_iargs = 4;
-            nb_oargs = 2;
             /* Test if the high part of the operation is dead, but not
                the low part.  The result can be optimized to a simple
                add or sub.  This happens often for x86_64 guest when the
@@ -4087,8 +4085,6 @@ liveness_pass_1(TCGContext *s)
                 op->args[1] = op->args[2];
                 op->args[2] = op->args[4];
                 /* Fall through and mark the single-word operation live.  */
-                nb_iargs = 2;
-                nb_oargs = 1;
             }
             goto do_not_remove;
 
@@ -4100,8 +4096,6 @@ liveness_pass_1(TCGContext *s)
             opc_new = INDEX_op_mul;
             opc_new2 = INDEX_op_muluh;
         do_mul2:
-            nb_iargs = 2;
-            nb_oargs = 2;
             if (arg_temp(op->args[1])->state == TS_DEAD) {
                 if (arg_temp(op->args[0])->state == TS_DEAD) {
                     /* Both parts of the operation are dead.  */
@@ -4122,19 +4116,15 @@ liveness_pass_1(TCGContext *s)
                 goto do_not_remove;
             }
             /* Mark the single-word operation live.  */
-            nb_oargs = 1;
             goto do_not_remove;
 
         default:
-            /* XXX: optimize by hardcoding common cases (e.g. triadic ops) */
-            nb_iargs = def->nb_iargs;
-            nb_oargs = def->nb_oargs;
-
             /* Test if the operation can be removed because all
                its outputs are dead. We assume that nb_oargs == 0
                implies side effects */
-            if (!(def->flags & TCG_OPF_SIDE_EFFECTS) && nb_oargs != 0) {
-                for (int i = 0; i < nb_oargs; i++) {
+            def = &tcg_op_defs[opc];
+            if (!(def->flags & TCG_OPF_SIDE_EFFECTS) && def->nb_oargs != 0) {
+                for (int i = def->nb_oargs - 1; i >= 0; i--) {
                     if (arg_temp(op->args[i])->state != TS_DEAD) {
                         goto do_not_remove;
                     }
@@ -4148,6 +4138,10 @@ liveness_pass_1(TCGContext *s)
             break;
 
         do_not_remove:
+            def = &tcg_op_defs[opc];
+            nb_iargs = def->nb_iargs;
+            nb_oargs = def->nb_oargs;
+
             for (int i = 0; i < nb_oargs; i++) {
                 ts = arg_temp(op->args[i]);
 

From 76f42780292c16a0d2f36cbbfbaf57495cd4d5e8 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 14 Jan 2025 13:58:39 -0800
Subject: [PATCH 0472/2760] tcg: Add add/sub with carry opcodes and
 infrastructure

Liveness needs to track carry-live state in order to
determine if the (hidden) output of the opcode is used.
Code generation needs to track carry-live state in order
to avoid clobbering cpu flags when loading constants.

So far, output routines and backends are unchanged.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 docs/devel/tcg-ops.rst |  61 +++++++++++++++++
 include/tcg/tcg-opc.h  |  10 +++
 include/tcg/tcg.h      |  13 +++-
 tcg/optimize.c         |  11 +++
 tcg/tcg.c              | 150 ++++++++++++++++++++++++++++++++++++++---
 5 files changed, 235 insertions(+), 10 deletions(-)

diff --git a/docs/devel/tcg-ops.rst b/docs/devel/tcg-ops.rst
index 9392d88069..93bcc70639 100644
--- a/docs/devel/tcg-ops.rst
+++ b/docs/devel/tcg-ops.rst
@@ -593,6 +593,67 @@ Multiword arithmetic support
 
 .. list-table::
 
+   * - addco *t0*, *t1*, *t2*
+
+     - | Compute *t0* = *t1* + *t2* and in addition output to the
+         carry bit provided by the host architecture.
+
+   * - addci *t0, *t1*, *t2*
+
+     - | Compute *t0* = *t1* + *t2* + *C*, where *C* is the
+         input carry bit provided by the host architecture.
+         The output carry bit need not be computed.
+
+   * - addcio *t0, *t1*, *t2*
+
+     - | Compute *t0* = *t1* + *t2* + *C*, where *C* is the
+         input carry bit provided by the host architecture,
+         and also compute the output carry bit.
+
+   * - addc1o *t0, *t1*, *t2*
+
+     - | Compute *t0* = *t1* + *t2* + 1, and in addition output to the
+         carry bit provided by the host architecture.  This is akin to
+         *addcio* with a fixed carry-in value of 1.
+       | This is intended to be used by the optimization pass,
+         intermediate to complete folding of the addition chain.
+         In some cases complete folding is not possible and this
+         opcode will remain until output.  If this happens, the
+         code generator will use ``tcg_out_set_carry`` and then
+         the output routine for *addcio*.
+
+   * - subbo *t0*, *t1*, *t2*
+
+     - | Compute *t0* = *t1* - *t2* and in addition output to the
+         borrow bit provided by the host architecture.
+       | Depending on the host architecture, the carry bit may or may not be
+         identical to the borrow bit.  Thus the addc\* and subb\*
+         opcodes must not be mixed.
+
+   * - subbi *t0, *t1*, *t2*
+
+     - | Compute *t0* = *t1* - *t2* - *B*, where *B* is the
+         input borrow bit provided by the host architecture.
+         The output borrow bit need not be computed.
+
+   * - subbio *t0, *t1*, *t2*
+
+     - | Compute *t0* = *t1* - *t2* - *B*, where *B* is the
+         input borrow bit provided by the host architecture,
+         and also compute the output borrow bit.
+
+   * - subb1o *t0, *t1*, *t2*
+
+     - | Compute *t0* = *t1* - *t2* - 1, and in addition output to the
+         borrow bit provided by the host architecture.  This is akin to
+         *subbio* with a fixed borrow-in value of 1.
+       | This is intended to be used by the optimization pass,
+         intermediate to complete folding of the subtraction chain.
+         In some cases complete folding is not possible and this
+         opcode will remain until output.  If this happens, the
+         code generator will use ``tcg_out_set_borrow`` and then
+         the output routine for *subbio*.
+
    * - add2_i32/i64 *t0_low*, *t0_high*, *t1_low*, *t1_high*, *t2_low*, *t2_high*
 
        sub2_i32/i64 *t0_low*, *t0_high*, *t1_low*, *t1_high*, *t2_low*, *t2_high*
diff --git a/include/tcg/tcg-opc.h b/include/tcg/tcg-opc.h
index 1f995c54be..9cc20cd62c 100644
--- a/include/tcg/tcg-opc.h
+++ b/include/tcg/tcg-opc.h
@@ -82,6 +82,16 @@ DEF(shr, 1, 2, 0, TCG_OPF_INT)
 DEF(sub, 1, 2, 0, TCG_OPF_INT)
 DEF(xor, 1, 2, 0, TCG_OPF_INT)
 
+DEF(addco, 1, 2, 0, TCG_OPF_INT | TCG_OPF_CARRY_OUT)
+DEF(addc1o, 1, 2, 0, TCG_OPF_INT | TCG_OPF_CARRY_OUT)
+DEF(addci, 1, 2, 0, TCG_OPF_INT | TCG_OPF_CARRY_IN)
+DEF(addcio, 1, 2, 0, TCG_OPF_INT | TCG_OPF_CARRY_IN | TCG_OPF_CARRY_OUT)
+
+DEF(subbo, 1, 2, 0, TCG_OPF_INT | TCG_OPF_CARRY_OUT)
+DEF(subb1o, 1, 2, 0, TCG_OPF_INT | TCG_OPF_CARRY_OUT)
+DEF(subbi, 1, 2, 0, TCG_OPF_INT | TCG_OPF_CARRY_IN)
+DEF(subbio, 1, 2, 0, TCG_OPF_INT | TCG_OPF_CARRY_IN | TCG_OPF_CARRY_OUT)
+
 /* load/store */
 DEF(ld8u_i32, 1, 1, 1, 0)
 DEF(ld8s_i32, 1, 1, 1, 0)
diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
index c6b50b5226..aa300a2f8b 100644
--- a/include/tcg/tcg.h
+++ b/include/tcg/tcg.h
@@ -418,6 +418,11 @@ struct TCGContext {
     MemOp riscv_cur_vsew;
     TCGType riscv_cur_type;
 #endif
+    /*
+     * During the tcg_reg_alloc_op loop, we are within a sequence of
+     * carry-using opcodes like addco+addci.
+     */
+    bool carry_live;
 
     GHashTable *const_table[TCG_TYPE_COUNT];
     TCGTempSet free_temps[TCG_TYPE_COUNT];
@@ -749,13 +754,17 @@ enum {
     /* Instruction operands are vectors.  */
     TCG_OPF_VECTOR       = 0x40,
     /* Instruction is a conditional branch. */
-    TCG_OPF_COND_BRANCH  = 0x80
+    TCG_OPF_COND_BRANCH  = 0x80,
+    /* Instruction produces carry out. */
+    TCG_OPF_CARRY_OUT    = 0x100,
+    /* Instruction consumes carry in. */
+    TCG_OPF_CARRY_IN     = 0x200,
 };
 
 typedef struct TCGOpDef {
     const char *name;
     uint8_t nb_oargs, nb_iargs, nb_cargs, nb_args;
-    uint8_t flags;
+    uint16_t flags;
 } TCGOpDef;
 
 extern const TCGOpDef tcg_op_defs[];
diff --git a/tcg/optimize.c b/tcg/optimize.c
index a728a4b2fa..8b00833f97 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -1226,6 +1226,12 @@ static bool fold_add_vec(OptContext *ctx, TCGOp *op)
     return finish_folding(ctx, op);
 }
 
+static bool fold_add_carry(OptContext *ctx, TCGOp *op)
+{
+    fold_commutative(ctx, op);
+    return finish_folding(ctx, op);
+}
+
 static bool fold_addsub2(OptContext *ctx, TCGOp *op, bool add)
 {
     bool a_const = arg_is_const(op->args[2]) && arg_is_const(op->args[3]);
@@ -2829,6 +2835,11 @@ void tcg_optimize(TCGContext *s)
         case INDEX_op_add_vec:
             done = fold_add_vec(&ctx, op);
             break;
+        case INDEX_op_addci:
+        case INDEX_op_addco:
+        case INDEX_op_addcio:
+            done = fold_add_carry(&ctx, op);
+            break;
         CASE_OP_32_64(add2):
             done = fold_add2(&ctx, op);
             break;
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 2849bba480..f04ad0afcf 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -3914,6 +3914,17 @@ liveness_pass_0(TCGContext *s)
     }
 }
 
+static void assert_carry_dead(TCGContext *s)
+{
+    /*
+     * Carry operations can be separated by a few insns like mov,
+     * load or store, but they should always be "close", and
+     * carry-out operations should always be paired with carry-in.
+     * At various boundaries, carry must have been consumed.
+     */
+    tcg_debug_assert(!s->carry_live);
+}
+
 /* Liveness analysis : update the opc_arg_life array to tell if a
    given input arguments is dead. Instructions updating dead
    temporaries are removed. */
@@ -3933,17 +3944,19 @@ liveness_pass_1(TCGContext *s)
     /* ??? Should be redundant with the exit_tb that ends the TB.  */
     la_func_end(s, nb_globals, nb_temps);
 
+    s->carry_live = false;
     QTAILQ_FOREACH_REVERSE_SAFE(op, &s->ops, link, op_prev) {
         int nb_iargs, nb_oargs;
         TCGOpcode opc_new, opc_new2;
         TCGLifeData arg_life = 0;
         TCGTemp *ts;
         TCGOpcode opc = op->opc;
-        const TCGOpDef *def = &tcg_op_defs[opc];
+        const TCGOpDef *def;
         const TCGArgConstraint *args_ct;
 
         switch (opc) {
         case INDEX_op_call:
+            assert_carry_dead(s);
             {
                 const TCGHelperInfo *info = tcg_call_info(op);
                 int call_flags = tcg_call_flags(op);
@@ -4055,6 +4068,7 @@ liveness_pass_1(TCGContext *s)
             }
             break;
         case INDEX_op_insn_start:
+            assert_carry_dead(s);
             break;
         case INDEX_op_discard:
             /* mark the temporary as dead */
@@ -4071,6 +4085,7 @@ liveness_pass_1(TCGContext *s)
         case INDEX_op_sub2_i64:
             opc_new = INDEX_op_sub;
         do_addsub2:
+            assert_carry_dead(s);
             /* Test if the high part of the operation is dead, but not
                the low part.  The result can be optimized to a simple
                add or sub.  This happens often for x86_64 guest when the
@@ -4096,6 +4111,7 @@ liveness_pass_1(TCGContext *s)
             opc_new = INDEX_op_mul;
             opc_new2 = INDEX_op_muluh;
         do_mul2:
+            assert_carry_dead(s);
             if (arg_temp(op->args[1])->state == TS_DEAD) {
                 if (arg_temp(op->args[0])->state == TS_DEAD) {
                     /* Both parts of the operation are dead.  */
@@ -4118,10 +4134,89 @@ liveness_pass_1(TCGContext *s)
             /* Mark the single-word operation live.  */
             goto do_not_remove;
 
+        case INDEX_op_addco:
+            if (s->carry_live) {
+                goto do_not_remove;
+            }
+            op->opc = opc = INDEX_op_add;
+            goto do_default;
+
+        case INDEX_op_addcio:
+            if (s->carry_live) {
+                goto do_not_remove;
+            }
+            op->opc = opc = INDEX_op_addci;
+            goto do_default;
+
+        case INDEX_op_subbo:
+            if (s->carry_live) {
+                goto do_not_remove;
+            }
+            /* Lower to sub, but this may also require canonicalization. */
+            op->opc = opc = INDEX_op_sub;
+            ts = arg_temp(op->args[2]);
+            if (ts->kind == TEMP_CONST) {
+                ts = tcg_constant_internal(ts->type, -ts->val);
+                if (ts->state_ptr == NULL) {
+                    tcg_debug_assert(temp_idx(ts) == nb_temps);
+                    nb_temps++;
+                    ts->state_ptr = tcg_malloc(sizeof(TCGRegSet));
+                    ts->state = TS_DEAD;
+                    la_reset_pref(ts);
+                }
+                op->args[2] = temp_arg(ts);
+                op->opc = opc = INDEX_op_add;
+            }
+            goto do_default;
+
+        case INDEX_op_subbio:
+            if (s->carry_live) {
+                goto do_not_remove;
+            }
+            op->opc = opc = INDEX_op_subbi;
+            goto do_default;
+
+        case INDEX_op_addc1o:
+            if (s->carry_live) {
+                goto do_not_remove;
+            }
+            /* Lower to add, add +1. */
+            op_prev = tcg_op_insert_before(s, op, INDEX_op_add,
+                                           TCGOP_TYPE(op), 3);
+            op_prev->args[0] = op->args[0];
+            op_prev->args[1] = op->args[1];
+            op_prev->args[2] = op->args[2];
+            op->opc = opc = INDEX_op_add;
+            op->args[1] = op->args[0];
+            ts = arg_temp(op->args[0]);
+            ts = tcg_constant_internal(ts->type, 1);
+            op->args[2] = temp_arg(ts);
+            goto do_default;
+
+        case INDEX_op_subb1o:
+            if (s->carry_live) {
+                goto do_not_remove;
+            }
+            /* Lower to sub, add -1. */
+            op_prev = tcg_op_insert_before(s, op, INDEX_op_sub,
+                                           TCGOP_TYPE(op), 3);
+            op_prev->args[0] = op->args[0];
+            op_prev->args[1] = op->args[1];
+            op_prev->args[2] = op->args[2];
+            op->opc = opc = INDEX_op_add;
+            op->args[1] = op->args[0];
+            ts = arg_temp(op->args[0]);
+            ts = tcg_constant_internal(ts->type, -1);
+            op->args[2] = temp_arg(ts);
+            goto do_default;
+
         default:
-            /* Test if the operation can be removed because all
-               its outputs are dead. We assume that nb_oargs == 0
-               implies side effects */
+        do_default:
+            /*
+             * Test if the operation can be removed because all
+             * its outputs are dead. We assume that nb_oargs == 0
+             * implies side effects.
+             */
             def = &tcg_op_defs[opc];
             if (!(def->flags & TCG_OPF_SIDE_EFFECTS) && def->nb_oargs != 0) {
                 for (int i = def->nb_oargs - 1; i >= 0; i--) {
@@ -4163,12 +4258,16 @@ liveness_pass_1(TCGContext *s)
 
             /* If end of basic block, update.  */
             if (def->flags & TCG_OPF_BB_EXIT) {
+                assert_carry_dead(s);
                 la_func_end(s, nb_globals, nb_temps);
             } else if (def->flags & TCG_OPF_COND_BRANCH) {
+                assert_carry_dead(s);
                 la_bb_sync(s, nb_globals, nb_temps);
             } else if (def->flags & TCG_OPF_BB_END) {
+                assert_carry_dead(s);
                 la_bb_end(s, nb_globals, nb_temps);
             } else if (def->flags & TCG_OPF_SIDE_EFFECTS) {
+                assert_carry_dead(s);
                 la_global_sync(s, nb_globals);
                 if (def->flags & TCG_OPF_CALL_CLOBBER) {
                     la_cross_call(s, nb_temps);
@@ -4182,6 +4281,9 @@ liveness_pass_1(TCGContext *s)
                     arg_life |= DEAD_ARG << i;
                 }
             }
+            if (def->flags & TCG_OPF_CARRY_OUT) {
+                s->carry_live = false;
+            }
 
             /* Input arguments are live for preceding opcodes.  */
             for (int i = nb_oargs; i < nb_oargs + nb_iargs; i++) {
@@ -4193,6 +4295,9 @@ liveness_pass_1(TCGContext *s)
                     ts->state &= ~TS_DEAD;
                 }
             }
+            if (def->flags & TCG_OPF_CARRY_IN) {
+                s->carry_live = true;
+            }
 
             /* Incorporate constraints for this operand.  */
             switch (opc) {
@@ -4232,6 +4337,7 @@ liveness_pass_1(TCGContext *s)
         }
         op->life = arg_life;
     }
+    assert_carry_dead(s);
 }
 
 /* Liveness analysis: Convert indirect regs to direct temporaries.  */
@@ -4820,9 +4926,8 @@ static void sync_globals(TCGContext *s, TCGRegSet allocated_regs)
    all globals are stored at their canonical location. */
 static void tcg_reg_alloc_bb_end(TCGContext *s, TCGRegSet allocated_regs)
 {
-    int i;
-
-    for (i = s->nb_globals; i < s->nb_temps; i++) {
+    assert_carry_dead(s);
+    for (int i = s->nb_globals; i < s->nb_temps; i++) {
         TCGTemp *ts = &s->temps[i];
 
         switch (ts->kind) {
@@ -4853,6 +4958,7 @@ static void tcg_reg_alloc_bb_end(TCGContext *s, TCGRegSet allocated_regs)
  */
 static void tcg_reg_alloc_cbranch(TCGContext *s, TCGRegSet allocated_regs)
 {
+    assert_carry_dead(s);
     sync_globals(s, allocated_regs);
 
     for (int i = s->nb_globals; i < s->nb_temps; i++) {
@@ -5124,6 +5230,10 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
     int const_args[TCG_MAX_OP_ARGS];
     TCGCond op_cond;
 
+    if (def->flags & TCG_OPF_CARRY_IN) {
+        tcg_debug_assert(s->carry_live);
+    }
+
     nb_oargs = def->nb_oargs;
     nb_iargs = def->nb_iargs;
 
@@ -5380,6 +5490,7 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
         tcg_reg_alloc_bb_end(s, i_allocated_regs);
     } else {
         if (def->flags & TCG_OPF_CALL_CLOBBER) {
+            assert_carry_dead(s);
             /* XXX: permit generic clobber register list ? */
             for (i = 0; i < TCG_TARGET_NB_REGS; i++) {
                 if (tcg_regset_test_reg(tcg_target_call_clobber_regs, i)) {
@@ -5497,7 +5608,8 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
 
     case INDEX_op_sub:
         {
-            const TCGOutOpSubtract *out = &outop_sub;
+            const TCGOutOpSubtract *out =
+                container_of(all_outop[op->opc], TCGOutOpSubtract, base);
 
             /*
              * Constants should never appear in the second source operand.
@@ -5512,6 +5624,16 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
         }
         break;
 
+    case INDEX_op_addco:
+    case INDEX_op_subbo:
+    case INDEX_op_addci:
+    case INDEX_op_subbi:
+    case INDEX_op_addcio:
+    case INDEX_op_subbio:
+    case INDEX_op_addc1o:
+    case INDEX_op_subb1o:
+        g_assert_not_reached();
+
     case INDEX_op_bswap64:
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
@@ -5700,6 +5822,13 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
         break;
     }
 
+    if (def->flags & TCG_OPF_CARRY_IN) {
+        s->carry_live = false;
+    }
+    if (def->flags & TCG_OPF_CARRY_OUT) {
+        s->carry_live = true;
+    }
+
     /* move the outputs in the correct register if needed */
     for(i = 0; i < nb_oargs; i++) {
         ts = arg_temp(op->args[i]);
@@ -6702,6 +6831,7 @@ int tcg_gen_code(TCGContext *s, TranslationBlock *tb, uint64_t pc_start)
     tcg_out_tb_start(s);
 
     num_insns = -1;
+    s->carry_live = false;
     QTAILQ_FOREACH(op, &s->ops, link) {
         TCGOpcode opc = op->opc;
 
@@ -6730,6 +6860,7 @@ int tcg_gen_code(TCGContext *s, TranslationBlock *tb, uint64_t pc_start)
             tcg_reg_alloc_dup(s, op);
             break;
         case INDEX_op_insn_start:
+            assert_carry_dead(s);
             if (num_insns >= 0) {
                 size_t off = tcg_current_code_size(s);
                 s->gen_insn_end_off[num_insns] = off;
@@ -6750,6 +6881,7 @@ int tcg_gen_code(TCGContext *s, TranslationBlock *tb, uint64_t pc_start)
             tcg_out_label(s, arg_label(op->args[0]));
             break;
         case INDEX_op_call:
+            assert_carry_dead(s);
             tcg_reg_alloc_call(s, op);
             break;
         case INDEX_op_exit_tb:
@@ -6786,6 +6918,8 @@ int tcg_gen_code(TCGContext *s, TranslationBlock *tb, uint64_t pc_start)
             return -2;
         }
     }
+    assert_carry_dead(s);
+
     tcg_debug_assert(num_insns + 1 == s->gen_tb->icount);
     s->gen_insn_end_off[num_insns] = tcg_current_code_size(s);
 

From ee60315210058c9b3d0869b2046eeb254ba33f3a Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 14 Jan 2025 23:27:53 -0800
Subject: [PATCH 0473/2760] tcg: Add TCGOutOp structures for add/sub carry
 opcodes

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target.c.inc     | 34 ++++++++++++++++++
 tcg/arm/tcg-target.c.inc         | 34 ++++++++++++++++++
 tcg/i386/tcg-target.c.inc        | 34 ++++++++++++++++++
 tcg/loongarch64/tcg-target.c.inc | 34 ++++++++++++++++++
 tcg/mips/tcg-target.c.inc        | 34 ++++++++++++++++++
 tcg/ppc/tcg-target.c.inc         | 34 ++++++++++++++++++
 tcg/riscv/tcg-target.c.inc       | 34 ++++++++++++++++++
 tcg/s390x/tcg-target.c.inc       | 34 ++++++++++++++++++
 tcg/sparc64/tcg-target.c.inc     | 34 ++++++++++++++++++
 tcg/tcg.c                        | 61 +++++++++++++++++++++++++++-----
 tcg/tci/tcg-target.c.inc         | 34 ++++++++++++++++++
 11 files changed, 393 insertions(+), 8 deletions(-)

diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index bece494c55..87f8c98ed7 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -2078,6 +2078,23 @@ static const TCGOutOpBinary outop_add = {
     .out_rri = tgen_addi,
 };
 
+static const TCGOutOpBinary outop_addco = {
+    .base.static_constraint = C_NotImplemented,
+};
+
+static const TCGOutOpAddSubCarry outop_addci = {
+    .base.static_constraint = C_NotImplemented,
+};
+
+static const TCGOutOpBinary outop_addcio = {
+    .base.static_constraint = C_NotImplemented,
+};
+
+static void tcg_out_set_carry(TCGContext *s)
+{
+    g_assert_not_reached();
+}
+
 static void tgen_and(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -2421,6 +2438,23 @@ static const TCGOutOpSubtract outop_sub = {
     .out_rrr = tgen_sub,
 };
 
+static const TCGOutOpAddSubCarry outop_subbo = {
+    .base.static_constraint = C_NotImplemented,
+};
+
+static const TCGOutOpAddSubCarry outop_subbi = {
+    .base.static_constraint = C_NotImplemented,
+};
+
+static const TCGOutOpAddSubCarry outop_subbio = {
+    .base.static_constraint = C_NotImplemented,
+};
+
+static void tcg_out_set_borrow(TCGContext *s)
+{
+    g_assert_not_reached();
+}
+
 static void tgen_xor(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index f366424af5..aa0397520d 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -1826,6 +1826,23 @@ static const TCGOutOpBinary outop_add = {
     .out_rri = tgen_addi,
 };
 
+static const TCGOutOpBinary outop_addco = {
+    .base.static_constraint = C_NotImplemented,
+};
+
+static const TCGOutOpAddSubCarry outop_addci = {
+    .base.static_constraint = C_NotImplemented,
+};
+
+static const TCGOutOpBinary outop_addcio = {
+    .base.static_constraint = C_NotImplemented,
+};
+
+static void tcg_out_set_carry(TCGContext *s)
+{
+    g_assert_not_reached();
+}
+
 static void tgen_and(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -2135,6 +2152,23 @@ static const TCGOutOpSubtract outop_sub = {
     .out_rir = tgen_subfi,
 };
 
+static const TCGOutOpAddSubCarry outop_subbo = {
+    .base.static_constraint = C_NotImplemented,
+};
+
+static const TCGOutOpAddSubCarry outop_subbi = {
+    .base.static_constraint = C_NotImplemented,
+};
+
+static const TCGOutOpAddSubCarry outop_subbio = {
+    .base.static_constraint = C_NotImplemented,
+};
+
+static void tcg_out_set_borrow(TCGContext *s)
+{
+    g_assert_not_reached();
+}
+
 static void tgen_xor(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index 2b2ad9ca95..04e31cae12 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -2629,6 +2629,23 @@ static const TCGOutOpBinary outop_add = {
     .out_rri = tgen_addi,
 };
 
+static const TCGOutOpBinary outop_addco = {
+    .base.static_constraint = C_NotImplemented,
+};
+
+static const TCGOutOpAddSubCarry outop_addci = {
+    .base.static_constraint = C_NotImplemented,
+};
+
+static const TCGOutOpBinary outop_addcio = {
+    .base.static_constraint = C_NotImplemented,
+};
+
+static void tcg_out_set_carry(TCGContext *s)
+{
+    g_assert_not_reached();
+}
+
 static void tgen_and(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -3054,6 +3071,23 @@ static const TCGOutOpSubtract outop_sub = {
     .out_rrr = tgen_sub,
 };
 
+static const TCGOutOpAddSubCarry outop_subbo = {
+    .base.static_constraint = C_NotImplemented,
+};
+
+static const TCGOutOpAddSubCarry outop_subbi = {
+    .base.static_constraint = C_NotImplemented,
+};
+
+static const TCGOutOpAddSubCarry outop_subbio = {
+    .base.static_constraint = C_NotImplemented,
+};
+
+static void tcg_out_set_borrow(TCGContext *s)
+{
+    g_assert_not_reached();
+}
+
 static void tgen_xor(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index eb2143703d..4f640764ef 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -1338,6 +1338,23 @@ static const TCGOutOpBinary outop_add = {
     .out_rri = tcg_out_addi,
 };
 
+static const TCGOutOpBinary outop_addco = {
+    .base.static_constraint = C_NotImplemented,
+};
+
+static const TCGOutOpAddSubCarry outop_addci = {
+    .base.static_constraint = C_NotImplemented,
+};
+
+static const TCGOutOpBinary outop_addcio = {
+    .base.static_constraint = C_NotImplemented,
+};
+
+static void tcg_out_set_carry(TCGContext *s)
+{
+    g_assert_not_reached();
+}
+
 static void tgen_and(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -1727,6 +1744,23 @@ static const TCGOutOpSubtract outop_sub = {
     .out_rrr = tgen_sub,
 };
 
+static const TCGOutOpAddSubCarry outop_subbo = {
+    .base.static_constraint = C_NotImplemented,
+};
+
+static const TCGOutOpAddSubCarry outop_subbi = {
+    .base.static_constraint = C_NotImplemented,
+};
+
+static const TCGOutOpAddSubCarry outop_subbio = {
+    .base.static_constraint = C_NotImplemented,
+};
+
+static void tcg_out_set_borrow(TCGContext *s)
+{
+    g_assert_not_reached();
+}
+
 static void tgen_xor(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index e69781b871..0c268cef42 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -1593,6 +1593,23 @@ static const TCGOutOpBinary outop_add = {
     .out_rri = tgen_addi,
 };
 
+static const TCGOutOpBinary outop_addco = {
+    .base.static_constraint = C_NotImplemented,
+};
+
+static const TCGOutOpAddSubCarry outop_addci = {
+    .base.static_constraint = C_NotImplemented,
+};
+
+static const TCGOutOpBinary outop_addcio = {
+    .base.static_constraint = C_NotImplemented,
+};
+
+static void tcg_out_set_carry(TCGContext *s)
+{
+    g_assert_not_reached();
+}
+
 static void tgen_and(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -2044,6 +2061,23 @@ static const TCGOutOpSubtract outop_sub = {
     .out_rrr = tgen_sub,
 };
 
+static const TCGOutOpAddSubCarry outop_subbo = {
+    .base.static_constraint = C_NotImplemented,
+};
+
+static const TCGOutOpAddSubCarry outop_subbi = {
+    .base.static_constraint = C_NotImplemented,
+};
+
+static const TCGOutOpAddSubCarry outop_subbio = {
+    .base.static_constraint = C_NotImplemented,
+};
+
+static void tcg_out_set_borrow(TCGContext *s)
+{
+    g_assert_not_reached();
+}
+
 static void tgen_xor(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index a964239aab..5b04655f3b 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -2863,6 +2863,23 @@ static const TCGOutOpBinary outop_add = {
     .out_rri = tgen_addi,
 };
 
+static const TCGOutOpBinary outop_addco = {
+    .base.static_constraint = C_NotImplemented,
+};
+
+static const TCGOutOpAddSubCarry outop_addci = {
+    .base.static_constraint = C_NotImplemented,
+};
+
+static const TCGOutOpBinary outop_addcio = {
+    .base.static_constraint = C_NotImplemented,
+};
+
+static void tcg_out_set_carry(TCGContext *s)
+{
+    g_assert_not_reached();
+}
+
 static void tgen_and(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -3267,6 +3284,23 @@ static const TCGOutOpSubtract outop_sub = {
     .out_rir = tgen_subfi,
 };
 
+static const TCGOutOpAddSubCarry outop_subbo = {
+    .base.static_constraint = C_NotImplemented,
+};
+
+static const TCGOutOpAddSubCarry outop_subbi = {
+    .base.static_constraint = C_NotImplemented,
+};
+
+static const TCGOutOpAddSubCarry outop_subbio = {
+    .base.static_constraint = C_NotImplemented,
+};
+
+static void tcg_out_set_borrow(TCGContext *s)
+{
+    g_assert_not_reached();
+}
+
 static void tgen_xor(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index dce46dcba6..707ebb8f6d 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -1947,6 +1947,23 @@ static const TCGOutOpBinary outop_add = {
     .out_rri = tgen_addi,
 };
 
+static const TCGOutOpBinary outop_addco = {
+    .base.static_constraint = C_NotImplemented,
+};
+
+static const TCGOutOpAddSubCarry outop_addci = {
+    .base.static_constraint = C_NotImplemented,
+};
+
+static const TCGOutOpBinary outop_addcio = {
+    .base.static_constraint = C_NotImplemented,
+};
+
+static void tcg_out_set_carry(TCGContext *s)
+{
+    g_assert_not_reached();
+}
+
 static void tgen_and(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -2333,6 +2350,23 @@ static const TCGOutOpSubtract outop_sub = {
     .out_rrr = tgen_sub,
 };
 
+static const TCGOutOpAddSubCarry outop_subbo = {
+    .base.static_constraint = C_NotImplemented,
+};
+
+static const TCGOutOpAddSubCarry outop_subbi = {
+    .base.static_constraint = C_NotImplemented,
+};
+
+static const TCGOutOpAddSubCarry outop_subbio = {
+    .base.static_constraint = C_NotImplemented,
+};
+
+static void tcg_out_set_borrow(TCGContext *s)
+{
+    g_assert_not_reached();
+}
+
 static void tgen_xor(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index ff06834e6e..a30afb455e 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -2248,6 +2248,23 @@ static const TCGOutOpBinary outop_add = {
     .out_rri = tgen_addi,
 };
 
+static const TCGOutOpBinary outop_addco = {
+    .base.static_constraint = C_NotImplemented,
+};
+
+static const TCGOutOpAddSubCarry outop_addci = {
+    .base.static_constraint = C_NotImplemented,
+};
+
+static const TCGOutOpBinary outop_addcio = {
+    .base.static_constraint = C_NotImplemented,
+};
+
+static void tcg_out_set_carry(TCGContext *s)
+{
+    g_assert_not_reached();
+}
+
 static void tgen_and(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -2766,6 +2783,23 @@ static const TCGOutOpSubtract outop_sub = {
     .out_rrr = tgen_sub,
 };
 
+static const TCGOutOpAddSubCarry outop_subbo = {
+    .base.static_constraint = C_NotImplemented,
+};
+
+static const TCGOutOpAddSubCarry outop_subbi = {
+    .base.static_constraint = C_NotImplemented,
+};
+
+static const TCGOutOpAddSubCarry outop_subbio = {
+    .base.static_constraint = C_NotImplemented,
+};
+
+static void tcg_out_set_borrow(TCGContext *s)
+{
+    g_assert_not_reached();
+}
+
 static void tgen_xor(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index 4c7d916302..12f0dbd23d 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -1381,6 +1381,23 @@ static const TCGOutOpBinary outop_add = {
     .out_rri = tgen_addi,
 };
 
+static const TCGOutOpBinary outop_addco = {
+    .base.static_constraint = C_NotImplemented,
+};
+
+static const TCGOutOpAddSubCarry outop_addci = {
+    .base.static_constraint = C_NotImplemented,
+};
+
+static const TCGOutOpBinary outop_addcio = {
+    .base.static_constraint = C_NotImplemented,
+};
+
+static void tcg_out_set_carry(TCGContext *s)
+{
+    g_assert_not_reached();
+}
+
 static void tgen_and(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -1717,6 +1734,23 @@ static const TCGOutOpSubtract outop_sub = {
     .out_rrr = tgen_sub,
 };
 
+static const TCGOutOpAddSubCarry outop_subbo = {
+    .base.static_constraint = C_NotImplemented,
+};
+
+static const TCGOutOpAddSubCarry outop_subbi = {
+    .base.static_constraint = C_NotImplemented,
+};
+
+static const TCGOutOpAddSubCarry outop_subbio = {
+    .base.static_constraint = C_NotImplemented,
+};
+
+static void tcg_out_set_borrow(TCGContext *s)
+{
+    g_assert_not_reached();
+}
+
 static void tgen_xor(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
diff --git a/tcg/tcg.c b/tcg/tcg.c
index f04ad0afcf..3b9f519ef6 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -133,6 +133,8 @@ static void tcg_out_addi_ptr(TCGContext *s, TCGReg, TCGReg, tcg_target_long);
 static bool tcg_out_xchg(TCGContext *s, TCGType type, TCGReg r1, TCGReg r2);
 static void tcg_out_exit_tb(TCGContext *s, uintptr_t arg);
 static void tcg_out_goto_tb(TCGContext *s, int which);
+static void tcg_out_set_carry(TCGContext *s);
+static void tcg_out_set_borrow(TCGContext *s);
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
                        const int const_args[TCG_MAX_OP_ARGS]);
@@ -978,6 +980,18 @@ typedef struct TCGOutOp {
     TCGConstraintSetIndex (*dynamic_constraint)(TCGType type, unsigned flags);
 } TCGOutOp;
 
+typedef struct TCGOutOpAddSubCarry {
+    TCGOutOp base;
+    void (*out_rrr)(TCGContext *s, TCGType type,
+                    TCGReg a0, TCGReg a1, TCGReg a2);
+    void (*out_rri)(TCGContext *s, TCGType type,
+                    TCGReg a0, TCGReg a1, tcg_target_long a2);
+    void (*out_rir)(TCGContext *s, TCGType type,
+                    TCGReg a0, tcg_target_long a1, TCGReg a2);
+    void (*out_rii)(TCGContext *s, TCGType type,
+                    TCGReg a0, tcg_target_long a1, tcg_target_long a2);
+} TCGOutOpAddSubCarry;
+
 typedef struct TCGOutOpBinary {
     TCGOutOp base;
     void (*out_rrr)(TCGContext *s, TCGType type,
@@ -1131,6 +1145,11 @@ static const TCGOutOpUnary outop_extrl_i64_i32 = {
 /* Register allocation descriptions for every TCGOpcode. */
 static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_add, TCGOutOpBinary, outop_add),
+    OUTOP(INDEX_op_addci, TCGOutOpAddSubCarry, outop_addci),
+    OUTOP(INDEX_op_addcio, TCGOutOpBinary, outop_addcio),
+    OUTOP(INDEX_op_addco, TCGOutOpBinary, outop_addco),
+    /* addc1o is implemented with set_carry + addcio */
+    OUTOP(INDEX_op_addc1o, TCGOutOpBinary, outop_addcio),
     OUTOP(INDEX_op_and, TCGOutOpBinary, outop_and),
     OUTOP(INDEX_op_andc, TCGOutOpBinary, outop_andc),
     OUTOP(INDEX_op_brcond, TCGOutOpBrcond, outop_brcond),
@@ -1170,6 +1189,11 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_shl, TCGOutOpBinary, outop_shl),
     OUTOP(INDEX_op_shr, TCGOutOpBinary, outop_shr),
     OUTOP(INDEX_op_sub, TCGOutOpSubtract, outop_sub),
+    OUTOP(INDEX_op_subbi, TCGOutOpAddSubCarry, outop_subbi),
+    OUTOP(INDEX_op_subbio, TCGOutOpAddSubCarry, outop_subbio),
+    OUTOP(INDEX_op_subbo, TCGOutOpAddSubCarry, outop_subbo),
+    /* subb1o is implemented with set_borrow + subbio */
+    OUTOP(INDEX_op_subb1o, TCGOutOpAddSubCarry, outop_subbio),
     OUTOP(INDEX_op_xor, TCGOutOpBinary, outop_xor),
 
 #if TCG_TARGET_REG_BITS == 32
@@ -5569,7 +5593,12 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
     /* emit instruction */
     TCGType type = TCGOP_TYPE(op);
     switch (op->opc) {
+    case INDEX_op_addc1o:
+        tcg_out_set_carry(s);
+        /* fall through */
     case INDEX_op_add:
+    case INDEX_op_addcio:
+    case INDEX_op_addco:
     case INDEX_op_and:
     case INDEX_op_andc:
     case INDEX_op_clz:
@@ -5608,8 +5637,7 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
 
     case INDEX_op_sub:
         {
-            const TCGOutOpSubtract *out =
-                container_of(all_outop[op->opc], TCGOutOpSubtract, base);
+            const TCGOutOpSubtract *out = &outop_sub;
 
             /*
              * Constants should never appear in the second source operand.
@@ -5624,15 +5652,32 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
         }
         break;
 
-    case INDEX_op_addco:
-    case INDEX_op_subbo:
+    case INDEX_op_subb1o:
+        tcg_out_set_borrow(s);
+        /* fall through */
     case INDEX_op_addci:
     case INDEX_op_subbi:
-    case INDEX_op_addcio:
     case INDEX_op_subbio:
-    case INDEX_op_addc1o:
-    case INDEX_op_subb1o:
-        g_assert_not_reached();
+    case INDEX_op_subbo:
+        {
+            const TCGOutOpAddSubCarry *out =
+                container_of(all_outop[op->opc], TCGOutOpAddSubCarry, base);
+
+            if (const_args[2]) {
+                if (const_args[1]) {
+                    out->out_rii(s, type, new_args[0],
+                                 new_args[1], new_args[2]);
+                } else {
+                    out->out_rri(s, type, new_args[0],
+                                 new_args[1], new_args[2]);
+                }
+            } else if (const_args[1]) {
+                out->out_rir(s, type, new_args[0], new_args[1], new_args[2]);
+            } else {
+                out->out_rrr(s, type, new_args[0], new_args[1], new_args[2]);
+            }
+        }
+        break;
 
     case INDEX_op_bswap64:
     case INDEX_op_ext_i32_i64:
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index 9a5ca9c778..bba96d7a19 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -573,6 +573,23 @@ static const TCGOutOpBinary outop_add = {
     .out_rrr = tgen_add,
 };
 
+static const TCGOutOpBinary outop_addco = {
+    .base.static_constraint = C_NotImplemented,
+};
+
+static const TCGOutOpAddSubCarry outop_addci = {
+    .base.static_constraint = C_NotImplemented,
+};
+
+static const TCGOutOpBinary outop_addcio = {
+    .base.static_constraint = C_NotImplemented,
+};
+
+static void tcg_out_set_carry(TCGContext *s)
+{
+    g_assert_not_reached();
+}
+
 static void tgen_and(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {
@@ -893,6 +910,23 @@ static const TCGOutOpSubtract outop_sub = {
     .out_rrr = tgen_sub,
 };
 
+static const TCGOutOpAddSubCarry outop_subbo = {
+    .base.static_constraint = C_NotImplemented,
+};
+
+static const TCGOutOpAddSubCarry outop_subbi = {
+    .base.static_constraint = C_NotImplemented,
+};
+
+static const TCGOutOpAddSubCarry outop_subbio = {
+    .base.static_constraint = C_NotImplemented,
+};
+
+static void tcg_out_set_borrow(TCGContext *s)
+{
+    g_assert_not_reached();
+}
+
 static void tgen_xor(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
 {

From aeb3514bd06b278dd026c90e8f71ca5b32762ab9 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 14 Jan 2025 18:28:15 -0800
Subject: [PATCH 0474/2760] tcg/optimize: Handle add/sub with carry opcodes

Propagate known carry when possible, and simplify the opcodes
to not require carry-in when known.  The result will be cleaned
up further by the subsequent liveness analysis pass.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 319 ++++++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 316 insertions(+), 3 deletions(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index 8b00833f97..cfcd0ab7f9 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -66,6 +66,7 @@ typedef struct OptContext {
 
     /* In flight values from optimization. */
     TCGType type;
+    int carry_state;  /* -1 = non-constant, {0,1} = constant carry-in */
 } OptContext;
 
 static inline TempOptInfo *ts_info(TCGTemp *ts)
@@ -1203,8 +1204,10 @@ static bool fold_xx_to_x(OptContext *ctx, TCGOp *op)
  *   3) those that produce information about the result value.
  */
 
+static bool fold_addco(OptContext *ctx, TCGOp *op);
 static bool fold_or(OptContext *ctx, TCGOp *op);
 static bool fold_orc(OptContext *ctx, TCGOp *op);
+static bool fold_subbo(OptContext *ctx, TCGOp *op);
 static bool fold_xor(OptContext *ctx, TCGOp *op);
 
 static bool fold_add(OptContext *ctx, TCGOp *op)
@@ -1226,9 +1229,167 @@ static bool fold_add_vec(OptContext *ctx, TCGOp *op)
     return finish_folding(ctx, op);
 }
 
-static bool fold_add_carry(OptContext *ctx, TCGOp *op)
+static void squash_prev_carryout(OptContext *ctx, TCGOp *op)
+{
+    TempOptInfo *t2;
+
+    op = QTAILQ_PREV(op, link);
+    switch (op->opc) {
+    case INDEX_op_addco:
+        op->opc = INDEX_op_add;
+        fold_add(ctx, op);
+        break;
+    case INDEX_op_addcio:
+        op->opc = INDEX_op_addci;
+        break;
+    case INDEX_op_addc1o:
+        op->opc = INDEX_op_add;
+        t2 = arg_info(op->args[2]);
+        if (ti_is_const(t2)) {
+            op->args[2] = arg_new_constant(ctx, ti_const_val(t2) + 1);
+            /* Perform other constant folding, if needed. */
+            fold_add(ctx, op);
+        } else {
+            TCGArg ret = op->args[0];
+            op = opt_insert_after(ctx, op, INDEX_op_add, 3);
+            op->args[0] = ret;
+            op->args[1] = ret;
+            op->args[2] = arg_new_constant(ctx, 1);
+        }
+        break;
+    default:
+        g_assert_not_reached();
+    }
+}
+
+static bool fold_addci(OptContext *ctx, TCGOp *op)
 {
     fold_commutative(ctx, op);
+
+    if (ctx->carry_state < 0) {
+        return finish_folding(ctx, op);
+    }
+
+    squash_prev_carryout(ctx, op);
+    op->opc = INDEX_op_add;
+
+    if (ctx->carry_state > 0) {
+        TempOptInfo *t2 = arg_info(op->args[2]);
+
+        /*
+         * Propagate the known carry-in into a constant, if possible.
+         * Otherwise emit a second add +1.
+         */
+        if (ti_is_const(t2)) {
+            op->args[2] = arg_new_constant(ctx, ti_const_val(t2) + 1);
+        } else {
+            TCGOp *op2 = opt_insert_before(ctx, op, INDEX_op_add, 3);
+
+            op2->args[0] = op->args[0];
+            op2->args[1] = op->args[1];
+            op2->args[2] = op->args[2];
+            fold_add(ctx, op2);
+
+            op->args[1] = op->args[0];
+            op->args[2] = arg_new_constant(ctx, 1);
+        }
+    }
+
+    ctx->carry_state = -1;
+    return fold_add(ctx, op);
+}
+
+static bool fold_addcio(OptContext *ctx, TCGOp *op)
+{
+    TempOptInfo *t1, *t2;
+    int carry_out = -1;
+    uint64_t sum, max;
+
+    fold_commutative(ctx, op);
+    t1 = arg_info(op->args[1]);
+    t2 = arg_info(op->args[2]);
+
+    /*
+     * The z_mask value is >= the maximum value that can be represented
+     * with the known zero bits.  So adding the z_mask values will not
+     * overflow if and only if the true values cannot overflow.
+     */
+    if (!uadd64_overflow(t1->z_mask, t2->z_mask, &sum) &&
+        !uadd64_overflow(sum, ctx->carry_state != 0, &sum)) {
+        carry_out = 0;
+    }
+
+    if (ctx->carry_state < 0) {
+        ctx->carry_state = carry_out;
+        return finish_folding(ctx, op);
+    }
+
+    squash_prev_carryout(ctx, op);
+    if (ctx->carry_state == 0) {
+        goto do_addco;
+    }
+
+    /* Propagate the known carry-in into a constant, if possible. */
+    max = ctx->type == TCG_TYPE_I32 ? UINT32_MAX : UINT64_MAX;
+    if (ti_is_const(t2)) {
+        uint64_t v = ti_const_val(t2) & max;
+        if (v < max) {
+            op->args[2] = arg_new_constant(ctx, v + 1);
+            goto do_addco;
+        }
+        /* max + known carry in produces known carry out. */
+        carry_out = 1;
+    }
+    if (ti_is_const(t1)) {
+        uint64_t v = ti_const_val(t1) & max;
+        if (v < max) {
+            op->args[1] = arg_new_constant(ctx, v + 1);
+            goto do_addco;
+        }
+        carry_out = 1;
+    }
+
+    /* Adjust the opcode to remember the known carry-in. */
+    op->opc = INDEX_op_addc1o;
+    ctx->carry_state = carry_out;
+    return finish_folding(ctx, op);
+
+ do_addco:
+    op->opc = INDEX_op_addco;
+    return fold_addco(ctx, op);
+}
+
+static bool fold_addco(OptContext *ctx, TCGOp *op)
+{
+    TempOptInfo *t1, *t2;
+    int carry_out = -1;
+    uint64_t ign;
+
+    fold_commutative(ctx, op);
+    t1 = arg_info(op->args[1]);
+    t2 = arg_info(op->args[2]);
+
+    if (ti_is_const(t2)) {
+        uint64_t v2 = ti_const_val(t2);
+
+        if (ti_is_const(t1)) {
+            uint64_t v1 = ti_const_val(t1);
+            /* Given sign-extension of z_mask for I32, we need not truncate. */
+            carry_out = uadd64_overflow(v1, v2, &ign);
+        } else if (v2 == 0) {
+            carry_out = 0;
+        }
+    } else {
+        /*
+         * The z_mask value is >= the maximum value that can be represented
+         * with the known zero bits.  So adding the z_mask values will not
+         * overflow if and only if the true values cannot overflow.
+         */
+        if (!uadd64_overflow(t1->z_mask, t2->z_mask, &ign)) {
+            carry_out = 0;
+        }
+    }
+    ctx->carry_state = carry_out;
     return finish_folding(ctx, op);
 }
 
@@ -2649,6 +2810,145 @@ static bool fold_sub2(OptContext *ctx, TCGOp *op)
     return fold_addsub2(ctx, op, false);
 }
 
+static void squash_prev_borrowout(OptContext *ctx, TCGOp *op)
+{
+    TempOptInfo *t2;
+
+    op = QTAILQ_PREV(op, link);
+    switch (op->opc) {
+    case INDEX_op_subbo:
+        op->opc = INDEX_op_sub;
+        fold_sub(ctx, op);
+        break;
+    case INDEX_op_subbio:
+        op->opc = INDEX_op_subbi;
+        break;
+    case INDEX_op_subb1o:
+        t2 = arg_info(op->args[2]);
+        if (ti_is_const(t2)) {
+            op->opc = INDEX_op_add;
+            op->args[2] = arg_new_constant(ctx, -(ti_const_val(t2) + 1));
+            /* Perform other constant folding, if needed. */
+            fold_add(ctx, op);
+        } else {
+            TCGArg ret = op->args[0];
+            op->opc = INDEX_op_sub;
+            op = opt_insert_after(ctx, op, INDEX_op_add, 3);
+            op->args[0] = ret;
+            op->args[1] = ret;
+            op->args[2] = arg_new_constant(ctx, -1);
+        }
+        break;
+    default:
+        g_assert_not_reached();
+    }
+}
+
+static bool fold_subbi(OptContext *ctx, TCGOp *op)
+{
+    TempOptInfo *t2;
+    int borrow_in = ctx->carry_state;
+
+    if (borrow_in < 0) {
+        return finish_folding(ctx, op);
+    }
+    ctx->carry_state = -1;
+
+    squash_prev_borrowout(ctx, op);
+    if (borrow_in == 0) {
+        op->opc = INDEX_op_sub;
+        return fold_sub(ctx, op);
+    }
+
+    /*
+     * Propagate the known carry-in into any constant, then negate to
+     * transform from sub to add.  If there is no constant, emit a
+     * separate add -1.
+     */
+    t2 = arg_info(op->args[2]);
+    if (ti_is_const(t2)) {
+        op->args[2] = arg_new_constant(ctx, -(ti_const_val(t2) + 1));
+    } else {
+        TCGOp *op2 = opt_insert_before(ctx, op, INDEX_op_sub, 3);
+
+        op2->args[0] = op->args[0];
+        op2->args[1] = op->args[1];
+        op2->args[2] = op->args[2];
+        fold_sub(ctx, op2);
+
+        op->args[1] = op->args[0];
+        op->args[2] = arg_new_constant(ctx, -1);
+    }
+    op->opc = INDEX_op_add;
+    return fold_add(ctx, op);
+}
+
+static bool fold_subbio(OptContext *ctx, TCGOp *op)
+{
+    TempOptInfo *t1, *t2;
+    int borrow_out = -1;
+
+    if (ctx->carry_state < 0) {
+        return finish_folding(ctx, op);
+    }
+
+    squash_prev_borrowout(ctx, op);
+    if (ctx->carry_state == 0) {
+        goto do_subbo;
+    }
+
+    t1 = arg_info(op->args[1]);
+    t2 = arg_info(op->args[2]);
+
+    /* Propagate the known borrow-in into a constant, if possible. */
+    if (ti_is_const(t2)) {
+        uint64_t max = ctx->type == TCG_TYPE_I32 ? UINT32_MAX : UINT64_MAX;
+        uint64_t v = ti_const_val(t2) & max;
+
+        if (v < max) {
+            op->args[2] = arg_new_constant(ctx, v + 1);
+            goto do_subbo;
+        }
+        /* subtracting max + 1 produces known borrow out. */
+        borrow_out = 1;
+    }
+    if (ti_is_const(t1)) {
+        uint64_t v = ti_const_val(t1);
+        if (v != 0) {
+            op->args[2] = arg_new_constant(ctx, v - 1);
+            goto do_subbo;
+        }
+    }
+
+    /* Adjust the opcode to remember the known carry-in. */
+    op->opc = INDEX_op_subb1o;
+    ctx->carry_state = borrow_out;
+    return finish_folding(ctx, op);
+
+ do_subbo:
+    op->opc = INDEX_op_subbo;
+    return fold_subbo(ctx, op);
+}
+
+static bool fold_subbo(OptContext *ctx, TCGOp *op)
+{
+    TempOptInfo *t1 = arg_info(op->args[1]);
+    TempOptInfo *t2 = arg_info(op->args[2]);
+    int borrow_out = -1;
+
+    if (ti_is_const(t2)) {
+        uint64_t v2 = ti_const_val(t2);
+        if (v2 == 0) {
+            borrow_out = 0;
+        } else if (ti_is_const(t1)) {
+            uint64_t v1 = ti_const_val(t1);
+            borrow_out = v1 < v2;
+        }
+    }
+    ctx->carry_state = borrow_out;
+    return finish_folding(ctx, op);
+}
+
 static bool fold_tcg_ld(OptContext *ctx, TCGOp *op)
 {
     uint64_t z_mask = -1, s_mask = 0;
@@ -2836,9 +3136,13 @@ void tcg_optimize(TCGContext *s)
             done = fold_add_vec(&ctx, op);
             break;
         case INDEX_op_addci:
-        case INDEX_op_addco:
+            done = fold_addci(&ctx, op);
+            break;
         case INDEX_op_addcio:
-            done = fold_add_carry(&ctx, op);
+            done = fold_addcio(&ctx, op);
+            break;
+        case INDEX_op_addco:
+            done = fold_addco(&ctx, op);
             break;
         CASE_OP_32_64(add2):
             done = fold_add2(&ctx, op);
@@ -3020,6 +3324,15 @@ void tcg_optimize(TCGContext *s)
         case INDEX_op_sub:
             done = fold_sub(&ctx, op);
             break;
+        case INDEX_op_subbi:
+            done = fold_subbi(&ctx, op);
+            break;
+        case INDEX_op_subbio:
+            done = fold_subbio(&ctx, op);
+            break;
+        case INDEX_op_subbo:
+            done = fold_subbo(&ctx, op);
+            break;
         case INDEX_op_sub_vec:
             done = fold_sub_vec(&ctx, op);
             break;

From e2f5ee36afb3b5306c99f40044534ae7d2580114 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 14 Jan 2025 23:08:24 -0800
Subject: [PATCH 0475/2760] tcg/optimize: With two const operands, prefer 0 in
 arg1

For most binary operands, two const operands fold.
However, the add/sub carry opcodes have a third input.
Prefer "reg, zero, const" since many risc hosts have a
zero register that can fit a "reg, reg, const" insn format.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index cfcd0ab7f9..95ec3b426d 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -737,12 +737,18 @@ static int do_constant_folding_cond(TCGType type, TCGArg x,
 
 #define NO_DEST  temp_arg(NULL)
 
+static int pref_commutative(TempOptInfo *ti)
+{
+    /* Slight preference for non-zero constants second. */
+    return !ti_is_const(ti) ? 0 : ti_const_val(ti) ? 3 : 2;
+}
+
 static bool swap_commutative(TCGArg dest, TCGArg *p1, TCGArg *p2)
 {
     TCGArg a1 = *p1, a2 = *p2;
     int sum = 0;
-    sum += arg_is_const(a1);
-    sum -= arg_is_const(a2);
+    sum += pref_commutative(arg_info(a1));
+    sum -= pref_commutative(arg_info(a2));
 
     /* Prefer the constant in second argument, and then the form
        op a, a, b, which is better handled on non-RISC hosts. */
@@ -757,10 +763,10 @@ static bool swap_commutative(TCGArg dest, TCGArg *p1, TCGArg *p2)
 static bool swap_commutative2(TCGArg *p1, TCGArg *p2)
 {
     int sum = 0;
-    sum += arg_is_const(p1[0]);
-    sum += arg_is_const(p1[1]);
-    sum -= arg_is_const(p2[0]);
-    sum -= arg_is_const(p2[1]);
+    sum += pref_commutative(arg_info(p1[0]));
+    sum += pref_commutative(arg_info(p1[1]));
+    sum -= pref_commutative(arg_info(p2[0]));
+    sum -= pref_commutative(arg_info(p2[1]));
     if (sum > 0) {
         TCGArg t;
         t = p1[0], p1[0] = p2[0], p2[0] = t;

From c4d2e3d736197bb2d82bd37de0de1819222d9768 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 13 Jan 2025 23:29:42 -0800
Subject: [PATCH 0476/2760] tcg: Use add carry opcodes to expand add2

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tcg-op.c | 29 +++++++++++++++++++++++++++--
 1 file changed, 27 insertions(+), 2 deletions(-)

diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index 127338b994..f17ec658fb 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -1102,7 +1102,13 @@ void tcg_gen_movcond_i32(TCGCond cond, TCGv_i32 ret, TCGv_i32 c1,
 void tcg_gen_add2_i32(TCGv_i32 rl, TCGv_i32 rh, TCGv_i32 al,
                       TCGv_i32 ah, TCGv_i32 bl, TCGv_i32 bh)
 {
-    if (TCG_TARGET_HAS_add2_i32) {
+    if (tcg_op_supported(INDEX_op_addci, TCG_TYPE_I32, 0)) {
+        TCGv_i32 t0 = tcg_temp_ebb_new_i32();
+        tcg_gen_op3_i32(INDEX_op_addco, t0, al, bl);
+        tcg_gen_op3_i32(INDEX_op_addci, rh, ah, bh);
+        tcg_gen_mov_i32(rl, t0);
+        tcg_temp_free_i32(t0);
+    } else if (TCG_TARGET_HAS_add2_i32) {
         tcg_gen_op6_i32(INDEX_op_add2_i32, rl, rh, al, ah, bl, bh);
     } else {
         TCGv_i32 t0 = tcg_temp_ebb_new_i32();
@@ -2822,7 +2828,26 @@ void tcg_gen_movcond_i64(TCGCond cond, TCGv_i64 ret, TCGv_i64 c1,
 void tcg_gen_add2_i64(TCGv_i64 rl, TCGv_i64 rh, TCGv_i64 al,
                       TCGv_i64 ah, TCGv_i64 bl, TCGv_i64 bh)
 {
-    if (TCG_TARGET_HAS_add2_i64) {
+    if (tcg_op_supported(INDEX_op_addci, TCG_TYPE_REG, 0)) {
+        TCGv_i64 t0 = tcg_temp_ebb_new_i64();
+
+        if (TCG_TARGET_REG_BITS == 32) {
+            tcg_gen_op3_i32(INDEX_op_addco, TCGV_LOW(t0),
+                            TCGV_LOW(al), TCGV_LOW(bl));
+            tcg_gen_op3_i32(INDEX_op_addcio, TCGV_HIGH(t0),
+                            TCGV_HIGH(al), TCGV_HIGH(bl));
+            tcg_gen_op3_i32(INDEX_op_addcio, TCGV_LOW(rh),
+                            TCGV_LOW(ah), TCGV_LOW(bh));
+            tcg_gen_op3_i32(INDEX_op_addci, TCGV_HIGH(rh),
+                            TCGV_HIGH(ah), TCGV_HIGH(bh));
+        } else {
+            tcg_gen_op3_i64(INDEX_op_addco, t0, al, bl);
+            tcg_gen_op3_i64(INDEX_op_addci, rh, ah, bh);
+        }
+
+        tcg_gen_mov_i64(rl, t0);
+        tcg_temp_free_i64(t0);
+    } else if (TCG_TARGET_HAS_add2_i64) {
         tcg_gen_op6_i64(INDEX_op_add2_i64, rl, rh, al, ah, bl, bh);
     } else {
         TCGv_i64 t0 = tcg_temp_ebb_new_i64();

From 7a89deae635ceaf687973dd95e4714af27a3f9d2 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 14 Jan 2025 18:58:05 -0800
Subject: [PATCH 0477/2760] tcg: Use sub carry opcodes to expand sub2

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tcg-op.c | 29 +++++++++++++++++++++++++++--
 1 file changed, 27 insertions(+), 2 deletions(-)

diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index f17ec658fb..447b0ebacd 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -1126,7 +1126,13 @@ void tcg_gen_add2_i32(TCGv_i32 rl, TCGv_i32 rh, TCGv_i32 al,
 void tcg_gen_sub2_i32(TCGv_i32 rl, TCGv_i32 rh, TCGv_i32 al,
                       TCGv_i32 ah, TCGv_i32 bl, TCGv_i32 bh)
 {
-    if (TCG_TARGET_HAS_sub2_i32) {
+    if (tcg_op_supported(INDEX_op_subbi, TCG_TYPE_I32, 0)) {
+        TCGv_i32 t0 = tcg_temp_ebb_new_i32();
+        tcg_gen_op3_i32(INDEX_op_subbo, t0, al, bl);
+        tcg_gen_op3_i32(INDEX_op_subbi, rh, ah, bh);
+        tcg_gen_mov_i32(rl, t0);
+        tcg_temp_free_i32(t0);
+    } else if (TCG_TARGET_HAS_sub2_i32) {
         tcg_gen_op6_i32(INDEX_op_sub2_i32, rl, rh, al, ah, bl, bh);
     } else {
         TCGv_i32 t0 = tcg_temp_ebb_new_i32();
@@ -2865,7 +2871,26 @@ void tcg_gen_add2_i64(TCGv_i64 rl, TCGv_i64 rh, TCGv_i64 al,
 void tcg_gen_sub2_i64(TCGv_i64 rl, TCGv_i64 rh, TCGv_i64 al,
                       TCGv_i64 ah, TCGv_i64 bl, TCGv_i64 bh)
 {
-    if (TCG_TARGET_HAS_sub2_i64) {
+    if (tcg_op_supported(INDEX_op_subbi, TCG_TYPE_REG, 0)) {
+        TCGv_i64 t0 = tcg_temp_ebb_new_i64();
+
+        if (TCG_TARGET_REG_BITS == 32) {
+            tcg_gen_op3_i32(INDEX_op_subbo, TCGV_LOW(t0),
+                            TCGV_LOW(al), TCGV_LOW(bl));
+            tcg_gen_op3_i32(INDEX_op_subbio, TCGV_HIGH(t0),
+                            TCGV_HIGH(al), TCGV_HIGH(bl));
+            tcg_gen_op3_i32(INDEX_op_subbio, TCGV_LOW(rh),
+                            TCGV_LOW(ah), TCGV_LOW(bh));
+            tcg_gen_op3_i32(INDEX_op_subbi, TCGV_HIGH(rh),
+                            TCGV_HIGH(ah), TCGV_HIGH(bh));
+        } else {
+            tcg_gen_op3_i64(INDEX_op_subbo, t0, al, bl);
+            tcg_gen_op3_i64(INDEX_op_subbi, rh, ah, bh);
+        }
+
+        tcg_gen_mov_i64(rl, t0);
+        tcg_temp_free_i64(t0);
+    } else if (TCG_TARGET_HAS_sub2_i64) {
         tcg_gen_op6_i64(INDEX_op_sub2_i64, rl, rh, al, ah, bl, bh);
     } else {
         TCGv_i64 t0 = tcg_temp_ebb_new_i64();

From 1f049cc5fda405c46de94f9328f0e3f84c0c993b Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 17 Jan 2025 22:05:48 -0800
Subject: [PATCH 0478/2760] tcg/i386: Honor carry_live in tcg_out_movi

Do not clobber flags if they're live.  Required in order
to perform register allocation on add/sub carry opcodes.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/i386/tcg-target.c.inc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index 04e31cae12..8e0ccbc722 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -1092,7 +1092,7 @@ static void tcg_out_movi_int(TCGContext *s, TCGType type,
 {
     tcg_target_long diff;
 
-    if (arg == 0) {
+    if (arg == 0 && !s->carry_live) {
         tgen_arithr(s, ARITH_XOR, ret, ret);
         return;
     }

From e37e98b711975752d592e7b2daf11d320d0a8daf Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 17 Jan 2025 22:24:56 -0800
Subject: [PATCH 0479/2760] tcg/i386: Implement add/sub carry opcodes

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/i386/tcg-target-con-set.h |   1 -
 tcg/i386/tcg-target-has.h     |   8 +--
 tcg/i386/tcg-target.c.inc     | 117 +++++++++++++++++++++-------------
 3 files changed, 76 insertions(+), 50 deletions(-)

diff --git a/tcg/i386/tcg-target-con-set.h b/tcg/i386/tcg-target-con-set.h
index 0ae9775944..85c93836bb 100644
--- a/tcg/i386/tcg-target-con-set.h
+++ b/tcg/i386/tcg-target-con-set.h
@@ -57,4 +57,3 @@ C_O2_I1(r, r, L)
 C_O2_I2(a, d, a, r)
 C_O2_I2(r, r, L, L)
 C_O2_I3(a, d, 0, 1, r)
-C_N1_O1_I4(r, r, 0, 1, re, re)
diff --git a/tcg/i386/tcg-target-has.h b/tcg/i386/tcg-target-has.h
index 0328102c2a..a984a6af2e 100644
--- a/tcg/i386/tcg-target-has.h
+++ b/tcg/i386/tcg-target-has.h
@@ -26,14 +26,14 @@
 #define have_avx512vbmi2  ((cpuinfo & CPUINFO_AVX512VBMI2) && have_avx512vl)
 
 /* optional instructions */
-#define TCG_TARGET_HAS_add2_i32         1
-#define TCG_TARGET_HAS_sub2_i32         1
+#define TCG_TARGET_HAS_add2_i32         0
+#define TCG_TARGET_HAS_sub2_i32         0
 
 #if TCG_TARGET_REG_BITS == 64
 /* Keep 32-bit values zero-extended in a register.  */
 #define TCG_TARGET_HAS_extr_i64_i32     1
-#define TCG_TARGET_HAS_add2_i64         1
-#define TCG_TARGET_HAS_sub2_i64         1
+#define TCG_TARGET_HAS_add2_i64         0
+#define TCG_TARGET_HAS_sub2_i64         0
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 #else
 #define TCG_TARGET_HAS_qemu_st8_i32     1
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index 8e0ccbc722..44f9afc0d6 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -424,6 +424,7 @@ static bool tcg_target_const_match(int64_t val, int ct,
 #define OPC_SHLX        (0xf7 | P_EXT38 | P_DATA16)
 #define OPC_SHRX        (0xf7 | P_EXT38 | P_SIMDF2)
 #define OPC_SHRD_Ib     (0xac | P_EXT)
+#define OPC_STC         (0xf9)
 #define OPC_TESTB	(0x84)
 #define OPC_TESTL	(0x85)
 #define OPC_TZCNT       (0xbc | P_EXT | P_SIMDF3)
@@ -2629,21 +2630,55 @@ static const TCGOutOpBinary outop_add = {
     .out_rri = tgen_addi,
 };
 
+static void tgen_addco(TCGContext *s, TCGType type,
+                       TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    int rexw = type == TCG_TYPE_I32 ? 0 : P_REXW;
+    tgen_arithr(s, ARITH_ADD + rexw, a0, a2);
+}
+
+static void tgen_addco_imm(TCGContext *s, TCGType type,
+                           TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    int rexw = type == TCG_TYPE_I32 ? 0 : P_REXW;
+    tgen_arithi(s, ARITH_ADD + rexw, a0, a2, true);
+}
+
 static const TCGOutOpBinary outop_addco = {
-    .base.static_constraint = C_NotImplemented,
+    .base.static_constraint = C_O1_I2(r, 0, re),
+    .out_rrr = tgen_addco,
+    .out_rri = tgen_addco_imm,
+};
+
+static void tgen_addcio(TCGContext *s, TCGType type,
+                        TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    int rexw = type == TCG_TYPE_I32 ? 0 : P_REXW;
+    tgen_arithr(s, ARITH_ADC + rexw, a0, a2);
+}
+
+static void tgen_addcio_imm(TCGContext *s, TCGType type,
+                            TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    int rexw = type == TCG_TYPE_I32 ? 0 : P_REXW;
+    tgen_arithi(s, ARITH_ADC + rexw, a0, a2, true);
+}
+
+static const TCGOutOpBinary outop_addcio = {
+    .base.static_constraint = C_O1_I2(r, 0, re),
+    .out_rrr = tgen_addcio,
+    .out_rri = tgen_addcio_imm,
 };
 
 static const TCGOutOpAddSubCarry outop_addci = {
-    .base.static_constraint = C_NotImplemented,
-};
-
-static const TCGOutOpBinary outop_addcio = {
-    .base.static_constraint = C_NotImplemented,
+    .base.static_constraint = C_O1_I2(r, 0, re),
+    .out_rrr = tgen_addcio,
+    .out_rri = tgen_addcio_imm,
 };
 
 static void tcg_out_set_carry(TCGContext *s)
 {
-    g_assert_not_reached();
+    tcg_out8(s, OPC_STC);
 }
 
 static void tgen_and(TCGContext *s, TCGType type,
@@ -3060,7 +3095,7 @@ static const TCGOutOpBinary outop_shr = {
 };
 
 static void tgen_sub(TCGContext *s, TCGType type,
-                      TCGReg a0, TCGReg a1, TCGReg a2)
+                     TCGReg a0, TCGReg a1, TCGReg a2)
 {
     int rexw = type == TCG_TYPE_I32 ? 0 : P_REXW;
     tgen_arithr(s, ARITH_SUB + rexw, a0, a2);
@@ -3071,21 +3106,44 @@ static const TCGOutOpSubtract outop_sub = {
     .out_rrr = tgen_sub,
 };
 
+static void tgen_subbo_rri(TCGContext *s, TCGType type,
+                           TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    int rexw = type == TCG_TYPE_I32 ? 0 : P_REXW;
+    tgen_arithi(s, ARITH_SUB + rexw, a0, a2, 1);
+}
+
 static const TCGOutOpAddSubCarry outop_subbo = {
-    .base.static_constraint = C_NotImplemented,
+    .base.static_constraint = C_O1_I2(r, 0, re),
+    .out_rrr = tgen_sub,
+    .out_rri = tgen_subbo_rri,
 };
 
-static const TCGOutOpAddSubCarry outop_subbi = {
-    .base.static_constraint = C_NotImplemented,
-};
+static void tgen_subbio_rrr(TCGContext *s, TCGType type,
+                            TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    int rexw = type == TCG_TYPE_I32 ? 0 : P_REXW;
+    tgen_arithr(s, ARITH_SBB + rexw, a0, a2);
+}
+
+static void tgen_subbio_rri(TCGContext *s, TCGType type,
+                            TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    int rexw = type == TCG_TYPE_I32 ? 0 : P_REXW;
+    tgen_arithi(s, ARITH_SBB + rexw, a0, a2, 1);
+}
 
 static const TCGOutOpAddSubCarry outop_subbio = {
-    .base.static_constraint = C_NotImplemented,
+    .base.static_constraint = C_O1_I2(r, 0, re),
+    .out_rrr = tgen_subbio_rrr,
+    .out_rri = tgen_subbio_rri,
 };
 
+#define outop_subbi  outop_subbio
+
 static void tcg_out_set_borrow(TCGContext *s)
 {
-    g_assert_not_reached();
+    tcg_out8(s, OPC_STC);
 }
 
 static void tgen_xor(TCGContext *s, TCGType type,
@@ -3421,31 +3479,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_qemu_st(s, a0, a1, a2, args[3], TCG_TYPE_I128);
         break;
 
-    OP_32_64(add2):
-        if (const_args[4]) {
-            tgen_arithi(s, ARITH_ADD + rexw, a0, args[4], 1);
-        } else {
-            tgen_arithr(s, ARITH_ADD + rexw, a0, args[4]);
-        }
-        if (const_args[5]) {
-            tgen_arithi(s, ARITH_ADC + rexw, a1, args[5], 1);
-        } else {
-            tgen_arithr(s, ARITH_ADC + rexw, a1, args[5]);
-        }
-        break;
-    OP_32_64(sub2):
-        if (const_args[4]) {
-            tgen_arithi(s, ARITH_SUB + rexw, a0, args[4], 1);
-        } else {
-            tgen_arithr(s, ARITH_SUB + rexw, a0, args[4]);
-        }
-        if (const_args[5]) {
-            tgen_arithi(s, ARITH_SBB + rexw, a1, args[5], 1);
-        } else {
-            tgen_arithr(s, ARITH_SBB + rexw, a1, args[5]);
-        }
-        break;
-
 #if TCG_TARGET_REG_BITS == 64
     case INDEX_op_ld32s_i64:
         tcg_out_modrm_offset(s, OPC_MOVSLQ, a0, a1, a2);
@@ -4051,12 +4084,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(re, r);
 
-    case INDEX_op_add2_i32:
-    case INDEX_op_add2_i64:
-    case INDEX_op_sub2_i32:
-    case INDEX_op_sub2_i64:
-        return C_N1_O1_I4(r, r, 0, 1, re, re);
-
     case INDEX_op_qemu_ld_i32:
         return C_O1_I1(r, L);
 

From 0ad6d64b7be6287f8c07c72f8462ef5635b1e2da Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 17 Jan 2025 22:39:14 -0800
Subject: [PATCH 0480/2760] tcg/i386: Special case addci r, 0, 0

Using addci with two zeros as input in order to capture the value
of the carry-in bit is common.  Special case this with sbb+neg so
that we do not have to load 0 into a register first.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/i386/tcg-target-con-set.h |  1 +
 tcg/i386/tcg-target.c.inc     | 46 ++++++++++++++++++++++++++++++++---
 2 files changed, 44 insertions(+), 3 deletions(-)

diff --git a/tcg/i386/tcg-target-con-set.h b/tcg/i386/tcg-target-con-set.h
index 85c93836bb..458d69c3c0 100644
--- a/tcg/i386/tcg-target-con-set.h
+++ b/tcg/i386/tcg-target-con-set.h
@@ -45,6 +45,7 @@ C_O1_I2(r, L, L)
 C_O1_I2(r, r, r)
 C_O1_I2(r, r, re)
 C_O1_I2(r, r, ri)
+C_O1_I2(r, rO, re)
 C_O1_I2(x, x, x)
 C_N1_I2(r, r, r)
 C_N1_I2(r, r, rW)
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index 44f9afc0d6..da05f13b21 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -2670,10 +2670,50 @@ static const TCGOutOpBinary outop_addcio = {
     .out_rri = tgen_addcio_imm,
 };
 
+static void tgen_addci_rrr(TCGContext *s, TCGType type,
+                           TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    /* Because "0O" is not a valid constraint, we must match ourselves. */
+    if (a0 == a2) {
+        tgen_addcio(s, type, a0, a0, a1);
+    } else {
+        tcg_out_mov(s, type, a0, a1);
+        tgen_addcio(s, type, a0, a0, a2);
+    }
+}
+
+static void tgen_addci_rri(TCGContext *s, TCGType type,
+                           TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    tcg_out_mov(s, type, a0, a1);
+    tgen_addcio_imm(s, type, a0, a0, a2);
+}
+
+static void tgen_addci_rir(TCGContext *s, TCGType type,
+                           TCGReg a0, tcg_target_long a1, TCGReg a2)
+{
+    tgen_addci_rri(s, type, a0, a2, a1);
+}
+
+static void tgen_addci_rii(TCGContext *s, TCGType type, TCGReg a0,
+                           tcg_target_long a1, tcg_target_long a2)
+{
+    if (a2 == 0) {
+        /* Implement 0 + 0 + C with -(x - x - c). */
+        tgen_arithr(s, ARITH_SBB, a0, a0);
+        tcg_out_modrm(s, OPC_GRP3_Ev, EXT3_NEG, a0);
+    } else {
+        tcg_out_movi(s, type, a0, a2);
+        tgen_addcio_imm(s, type, a0, a0, a1);
+    }
+}
+
 static const TCGOutOpAddSubCarry outop_addci = {
-    .base.static_constraint = C_O1_I2(r, 0, re),
-    .out_rrr = tgen_addcio,
-    .out_rri = tgen_addcio_imm,
+    .base.static_constraint = C_O1_I2(r, rO, re),
+    .out_rrr = tgen_addci_rrr,
+    .out_rri = tgen_addci_rri,
+    .out_rir = tgen_addci_rir,
+    .out_rii = tgen_addci_rii,
 };
 
 static void tcg_out_set_carry(TCGContext *s)

From db3feb02b82d388d85a0c0a14d62f1a625f626a4 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 18 Jan 2025 01:19:51 -0800
Subject: [PATCH 0481/2760] tcg: Add tcg_gen_addcio_{i32,i64,tl}

Create a function for performing an add with carry-in
and producing carry out.  The carry-out result is boolean.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/tcg/tcg-op-common.h |  4 ++
 include/tcg/tcg-op.h        |  2 +
 tcg/tcg-op.c                | 95 +++++++++++++++++++++++++++++++++++++
 3 files changed, 101 insertions(+)

diff --git a/include/tcg/tcg-op-common.h b/include/tcg/tcg-op-common.h
index 009e2778c5..b439bdb385 100644
--- a/include/tcg/tcg-op-common.h
+++ b/include/tcg/tcg-op-common.h
@@ -135,6 +135,8 @@ void tcg_gen_add2_i32(TCGv_i32 rl, TCGv_i32 rh, TCGv_i32 al,
                       TCGv_i32 ah, TCGv_i32 bl, TCGv_i32 bh);
 void tcg_gen_sub2_i32(TCGv_i32 rl, TCGv_i32 rh, TCGv_i32 al,
                       TCGv_i32 ah, TCGv_i32 bl, TCGv_i32 bh);
+void tcg_gen_addcio_i32(TCGv_i32 r, TCGv_i32 co,
+                        TCGv_i32 a, TCGv_i32 b, TCGv_i32 ci);
 void tcg_gen_mulu2_i32(TCGv_i32 rl, TCGv_i32 rh, TCGv_i32 arg1, TCGv_i32 arg2);
 void tcg_gen_muls2_i32(TCGv_i32 rl, TCGv_i32 rh, TCGv_i32 arg1, TCGv_i32 arg2);
 void tcg_gen_mulsu2_i32(TCGv_i32 rl, TCGv_i32 rh, TCGv_i32 arg1, TCGv_i32 arg2);
@@ -238,6 +240,8 @@ void tcg_gen_add2_i64(TCGv_i64 rl, TCGv_i64 rh, TCGv_i64 al,
                       TCGv_i64 ah, TCGv_i64 bl, TCGv_i64 bh);
 void tcg_gen_sub2_i64(TCGv_i64 rl, TCGv_i64 rh, TCGv_i64 al,
                       TCGv_i64 ah, TCGv_i64 bl, TCGv_i64 bh);
+void tcg_gen_addcio_i64(TCGv_i64 r, TCGv_i64 co,
+                        TCGv_i64 a, TCGv_i64 b, TCGv_i64 ci);
 void tcg_gen_mulu2_i64(TCGv_i64 rl, TCGv_i64 rh, TCGv_i64 arg1, TCGv_i64 arg2);
 void tcg_gen_muls2_i64(TCGv_i64 rl, TCGv_i64 rh, TCGv_i64 arg1, TCGv_i64 arg2);
 void tcg_gen_mulsu2_i64(TCGv_i64 rl, TCGv_i64 rh, TCGv_i64 arg1, TCGv_i64 arg2);
diff --git a/include/tcg/tcg-op.h b/include/tcg/tcg-op.h
index cded92a447..59d19755e6 100644
--- a/include/tcg/tcg-op.h
+++ b/include/tcg/tcg-op.h
@@ -253,6 +253,7 @@ DEF_ATOMIC2(tcg_gen_atomic_umax_fetch, i64)
 #define tcg_gen_movcond_tl tcg_gen_movcond_i64
 #define tcg_gen_add2_tl tcg_gen_add2_i64
 #define tcg_gen_sub2_tl tcg_gen_sub2_i64
+#define tcg_gen_addcio_tl tcg_gen_addcio_i64
 #define tcg_gen_mulu2_tl tcg_gen_mulu2_i64
 #define tcg_gen_muls2_tl tcg_gen_muls2_i64
 #define tcg_gen_mulsu2_tl tcg_gen_mulsu2_i64
@@ -371,6 +372,7 @@ DEF_ATOMIC2(tcg_gen_atomic_umax_fetch, i64)
 #define tcg_gen_movcond_tl tcg_gen_movcond_i32
 #define tcg_gen_add2_tl tcg_gen_add2_i32
 #define tcg_gen_sub2_tl tcg_gen_sub2_i32
+#define tcg_gen_addcio_tl tcg_gen_addcio_i32
 #define tcg_gen_mulu2_tl tcg_gen_mulu2_i32
 #define tcg_gen_muls2_tl tcg_gen_muls2_i32
 #define tcg_gen_mulsu2_tl tcg_gen_mulsu2_i32
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index 447b0ebacd..b0a29278ab 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -1123,6 +1123,33 @@ void tcg_gen_add2_i32(TCGv_i32 rl, TCGv_i32 rh, TCGv_i32 al,
     }
 }
 
+void tcg_gen_addcio_i32(TCGv_i32 r, TCGv_i32 co,
+                        TCGv_i32 a, TCGv_i32 b, TCGv_i32 ci)
+{
+    if (tcg_op_supported(INDEX_op_addci, TCG_TYPE_I32, 0)) {
+        TCGv_i32 t0 = tcg_temp_ebb_new_i32();
+        TCGv_i32 zero = tcg_constant_i32(0);
+        TCGv_i32 mone = tcg_constant_i32(-1);
+
+        tcg_gen_op3_i32(INDEX_op_addco, t0, ci, mone);
+        tcg_gen_op3_i32(INDEX_op_addcio, r, a, b);
+        tcg_gen_op3_i32(INDEX_op_addci, co, zero, zero);
+        tcg_temp_free_i32(t0);
+    } else {
+        TCGv_i32 t0 = tcg_temp_ebb_new_i32();
+        TCGv_i32 t1 = tcg_temp_ebb_new_i32();
+
+        tcg_gen_add_i32(t0, a, b);
+        tcg_gen_setcond_i32(TCG_COND_LTU, t1, t0, a);
+        tcg_gen_add_i32(r, t0, ci);
+        tcg_gen_setcond_i32(TCG_COND_LTU, t0, r, t0);
+        tcg_gen_or_i32(co, t0, t1);
+
+        tcg_temp_free_i32(t0);
+        tcg_temp_free_i32(t1);
+    }
+}
+
 void tcg_gen_sub2_i32(TCGv_i32 rl, TCGv_i32 rh, TCGv_i32 al,
                       TCGv_i32 ah, TCGv_i32 bl, TCGv_i32 bh)
 {
@@ -2868,6 +2895,74 @@ void tcg_gen_add2_i64(TCGv_i64 rl, TCGv_i64 rh, TCGv_i64 al,
     }
 }
 
+void tcg_gen_addcio_i64(TCGv_i64 r, TCGv_i64 co,
+                        TCGv_i64 a, TCGv_i64 b, TCGv_i64 ci)
+{
+    if (TCG_TARGET_REG_BITS == 64) {
+        if (tcg_op_supported(INDEX_op_addci, TCG_TYPE_I64, 0)) {
+            TCGv_i64 discard = tcg_temp_ebb_new_i64();
+            TCGv_i64 zero = tcg_constant_i64(0);
+            TCGv_i64 mone = tcg_constant_i64(-1);
+
+            tcg_gen_op3_i64(INDEX_op_addco, discard, ci, mone);
+            tcg_gen_op3_i64(INDEX_op_addcio, r, a, b);
+            tcg_gen_op3_i64(INDEX_op_addci, co, zero, zero);
+            tcg_temp_free_i64(discard);
+        } else {
+            TCGv_i64 t0 = tcg_temp_ebb_new_i64();
+            TCGv_i64 t1 = tcg_temp_ebb_new_i64();
+
+            tcg_gen_add_i64(t0, a, b);
+            tcg_gen_setcond_i64(TCG_COND_LTU, t1, t0, a);
+            tcg_gen_add_i64(r, t0, ci);
+            tcg_gen_setcond_i64(TCG_COND_LTU, t0, r, t0);
+            tcg_gen_or_i64(co, t0, t1);
+
+            tcg_temp_free_i64(t0);
+            tcg_temp_free_i64(t1);
+        }
+    } else {
+        if (tcg_op_supported(INDEX_op_addci, TCG_TYPE_I32, 0)) {
+            TCGv_i32 discard = tcg_temp_ebb_new_i32();
+            TCGv_i32 zero = tcg_constant_i32(0);
+            TCGv_i32 mone = tcg_constant_i32(-1);
+
+            tcg_gen_op3_i32(INDEX_op_addco, discard, TCGV_LOW(ci), mone);
+            tcg_gen_op3_i32(INDEX_op_addcio, discard, TCGV_HIGH(ci), mone);
+            tcg_gen_op3_i32(INDEX_op_addcio, TCGV_LOW(r),
+                            TCGV_LOW(a), TCGV_LOW(b));
+            tcg_gen_op3_i32(INDEX_op_addcio, TCGV_HIGH(r),
+                            TCGV_HIGH(a), TCGV_HIGH(b));
+            tcg_gen_op3_i32(INDEX_op_addci, TCGV_LOW(co), zero, zero);
+            tcg_temp_free_i32(discard);
+        } else {
+            TCGv_i32 t0 = tcg_temp_ebb_new_i32();
+            TCGv_i32 c0 = tcg_temp_ebb_new_i32();
+            TCGv_i32 c1 = tcg_temp_ebb_new_i32();
+
+            tcg_gen_or_i32(c1, TCGV_LOW(ci), TCGV_HIGH(ci));
+            tcg_gen_setcondi_i32(TCG_COND_NE, c1, c1, 0);
+
+            tcg_gen_add_i32(t0, TCGV_LOW(a), TCGV_LOW(b));
+            tcg_gen_setcond_i32(TCG_COND_LTU, c0, t0, TCGV_LOW(a));
+            tcg_gen_add_i32(TCGV_LOW(r), t0, c1);
+            tcg_gen_setcond_i32(TCG_COND_LTU, c1, TCGV_LOW(r), c1);
+            tcg_gen_or_i32(c1, c1, c0);
+
+            tcg_gen_add_i32(t0, TCGV_HIGH(a), TCGV_HIGH(b));
+            tcg_gen_setcond_i32(TCG_COND_LTU, c0, t0, TCGV_HIGH(a));
+            tcg_gen_add_i32(TCGV_HIGH(r), t0, c1);
+            tcg_gen_setcond_i32(TCG_COND_LTU, c1, TCGV_HIGH(r), c1);
+            tcg_gen_or_i32(TCGV_LOW(co), c0, c1);
+
+            tcg_temp_free_i32(t0);
+            tcg_temp_free_i32(c0);
+            tcg_temp_free_i32(c1);
+        }
+        tcg_gen_movi_i32(TCGV_HIGH(co), 0);
+    }
+}
+
 void tcg_gen_sub2_i64(TCGv_i64 rl, TCGv_i64 rh, TCGv_i64 al,
                       TCGv_i64 ah, TCGv_i64 bl, TCGv_i64 bh)
 {

From eea0f7ea5170b47aa2cd6f6ad077e48702aad6f3 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 18 Jan 2025 01:27:41 -0800
Subject: [PATCH 0482/2760] target/arm: Use tcg_gen_addcio_* for ADCS
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/tcg/translate-a64.c |  8 ++------
 target/arm/tcg/translate.c     | 17 +++--------------
 2 files changed, 5 insertions(+), 20 deletions(-)

diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index e076d4aa05..d9305f9d26 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -1076,11 +1076,9 @@ static void gen_adc_CC(int sf, TCGv_i64 dest, TCGv_i64 t0, TCGv_i64 t1)
         TCGv_i64 cf_64 = tcg_temp_new_i64();
         TCGv_i64 vf_64 = tcg_temp_new_i64();
         TCGv_i64 tmp = tcg_temp_new_i64();
-        TCGv_i64 zero = tcg_constant_i64(0);
 
         tcg_gen_extu_i32_i64(cf_64, cpu_CF);
-        tcg_gen_add2_i64(result, cf_64, t0, zero, cf_64, zero);
-        tcg_gen_add2_i64(result, cf_64, result, cf_64, t1, zero);
+        tcg_gen_addcio_i64(result, cf_64, t0, t1, cf_64);
         tcg_gen_extrl_i64_i32(cpu_CF, cf_64);
         gen_set_NZ64(result);
 
@@ -1094,12 +1092,10 @@ static void gen_adc_CC(int sf, TCGv_i64 dest, TCGv_i64 t0, TCGv_i64 t1)
         TCGv_i32 t0_32 = tcg_temp_new_i32();
         TCGv_i32 t1_32 = tcg_temp_new_i32();
         TCGv_i32 tmp = tcg_temp_new_i32();
-        TCGv_i32 zero = tcg_constant_i32(0);
 
         tcg_gen_extrl_i64_i32(t0_32, t0);
         tcg_gen_extrl_i64_i32(t1_32, t1);
-        tcg_gen_add2_i32(cpu_NF, cpu_CF, t0_32, zero, cpu_CF, zero);
-        tcg_gen_add2_i32(cpu_NF, cpu_CF, cpu_NF, cpu_CF, t1_32, zero);
+        tcg_gen_addcio_i32(cpu_NF, cpu_CF, t0_32, t1_32, cpu_CF);
 
         tcg_gen_mov_i32(cpu_ZF, cpu_NF);
         tcg_gen_xor_i32(cpu_VF, cpu_NF, t0_32);
diff --git a/target/arm/tcg/translate.c b/target/arm/tcg/translate.c
index 273b860d57..88df9c482a 100644
--- a/target/arm/tcg/translate.c
+++ b/target/arm/tcg/translate.c
@@ -494,20 +494,9 @@ static void gen_add_CC(TCGv_i32 dest, TCGv_i32 t0, TCGv_i32 t1)
 static void gen_adc_CC(TCGv_i32 dest, TCGv_i32 t0, TCGv_i32 t1)
 {
     TCGv_i32 tmp = tcg_temp_new_i32();
-    if (tcg_op_supported(INDEX_op_add2_i32, TCG_TYPE_I32, 0)) {
-        tcg_gen_movi_i32(tmp, 0);
-        tcg_gen_add2_i32(cpu_NF, cpu_CF, t0, tmp, cpu_CF, tmp);
-        tcg_gen_add2_i32(cpu_NF, cpu_CF, cpu_NF, cpu_CF, t1, tmp);
-    } else {
-        TCGv_i64 q0 = tcg_temp_new_i64();
-        TCGv_i64 q1 = tcg_temp_new_i64();
-        tcg_gen_extu_i32_i64(q0, t0);
-        tcg_gen_extu_i32_i64(q1, t1);
-        tcg_gen_add_i64(q0, q0, q1);
-        tcg_gen_extu_i32_i64(q1, cpu_CF);
-        tcg_gen_add_i64(q0, q0, q1);
-        tcg_gen_extr_i64_i32(cpu_NF, cpu_CF, q0);
-    }
+
+    tcg_gen_addcio_i32(cpu_NF, cpu_CF, t0, t1, cpu_CF);
+
     tcg_gen_mov_i32(cpu_ZF, cpu_NF);
     tcg_gen_xor_i32(cpu_VF, cpu_NF, t0);
     tcg_gen_xor_i32(tmp, t0, t1);

From 14e9ff8514bcae95d45dc8603f1ef33ad2f1dce1 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 18 Jan 2025 01:35:49 -0800
Subject: [PATCH 0483/2760] target/hppa: Use tcg_gen_addcio_i64
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Use this in do_add, do_sub, and do_ds, all of which need
add with carry-in and carry-out.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/hppa/translate.c | 17 ++++++-----------
 1 file changed, 6 insertions(+), 11 deletions(-)

diff --git a/target/hppa/translate.c b/target/hppa/translate.c
index 14f3833322..88a7d339eb 100644
--- a/target/hppa/translate.c
+++ b/target/hppa/translate.c
@@ -1209,10 +1209,10 @@ static void do_add(DisasContext *ctx, unsigned rt, TCGv_i64 orig_in1,
         cb_msb = tcg_temp_new_i64();
         cb = tcg_temp_new_i64();
 
-        tcg_gen_add2_i64(dest, cb_msb, in1, ctx->zero, in2, ctx->zero);
         if (is_c) {
-            tcg_gen_add2_i64(dest, cb_msb, dest, cb_msb,
-                             get_psw_carry(ctx, d), ctx->zero);
+            tcg_gen_addcio_i64(dest, cb_msb, in1, in2, get_psw_carry(ctx, d));
+        } else {
+            tcg_gen_add2_i64(dest, cb_msb, in1, ctx->zero, in2, ctx->zero);
         }
         tcg_gen_xor_i64(cb, in1, in2);
         tcg_gen_xor_i64(cb, cb, dest);
@@ -1308,9 +1308,7 @@ static void do_sub(DisasContext *ctx, unsigned rt, TCGv_i64 in1,
     if (is_b) {
         /* DEST,C = IN1 + ~IN2 + C.  */
         tcg_gen_not_i64(cb, in2);
-        tcg_gen_add2_i64(dest, cb_msb, in1, ctx->zero,
-                         get_psw_carry(ctx, d), ctx->zero);
-        tcg_gen_add2_i64(dest, cb_msb, dest, cb_msb, cb, ctx->zero);
+        tcg_gen_addcio_i64(dest, cb_msb, in1, cb, get_psw_carry(ctx, d));
         tcg_gen_xor_i64(cb, cb, in1);
         tcg_gen_xor_i64(cb, cb, dest);
     } else {
@@ -3008,9 +3006,7 @@ static bool trans_ds(DisasContext *ctx, arg_rrr_cf *a)
     tcg_gen_xor_i64(add2, in2, addc);
     tcg_gen_andi_i64(addc, addc, 1);
 
-    tcg_gen_add2_i64(dest, cpu_psw_cb_msb, add1, ctx->zero, add2, ctx->zero);
-    tcg_gen_add2_i64(dest, cpu_psw_cb_msb, dest, cpu_psw_cb_msb,
-                     addc, ctx->zero);
+    tcg_gen_addcio_i64(dest, cpu_psw_cb_msb, add1, add2, addc);
 
     /* Write back the result register.  */
     save_gpr(ctx, a->t, dest);
@@ -3553,8 +3549,7 @@ static bool do_addb(DisasContext *ctx, unsigned r, TCGv_i64 in1,
         TCGv_i64 cb = tcg_temp_new_i64();
         TCGv_i64 cb_msb = tcg_temp_new_i64();
 
-        tcg_gen_movi_i64(cb_msb, 0);
-        tcg_gen_add2_i64(dest, cb_msb, in1, cb_msb, in2, cb_msb);
+        tcg_gen_add2_i64(dest, cb_msb, in1, ctx->zero, in2, ctx->zero);
         tcg_gen_xor_i64(cb, in1, in2);
         tcg_gen_xor_i64(cb, cb, dest);
         cb_cond = get_carry(ctx, d, cb, cb_msb);

From fcfbd8f4a9c3cbc09376230093d28e14acf7854b Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 18 Jan 2025 01:47:53 -0800
Subject: [PATCH 0484/2760] target/microblaze: Use tcg_gen_addcio_i32
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Use this in gen_addc and gen_rsubc, both of which need
add with carry-in and carry-out.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/microblaze/translate.c | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/target/microblaze/translate.c b/target/microblaze/translate.c
index 7dcad6cf0d..23f1037236 100644
--- a/target/microblaze/translate.c
+++ b/target/microblaze/translate.c
@@ -311,11 +311,7 @@ static void gen_add(TCGv_i32 out, TCGv_i32 ina, TCGv_i32 inb)
 /* Input and output carry. */
 static void gen_addc(TCGv_i32 out, TCGv_i32 ina, TCGv_i32 inb)
 {
-    TCGv_i32 zero = tcg_constant_i32(0);
-    TCGv_i32 tmp = tcg_temp_new_i32();
-
-    tcg_gen_add2_i32(tmp, cpu_msr_c, ina, zero, cpu_msr_c, zero);
-    tcg_gen_add2_i32(out, cpu_msr_c, tmp, cpu_msr_c, inb, zero);
+    tcg_gen_addcio_i32(out, cpu_msr_c, ina, inb, cpu_msr_c);
 }
 
 /* Input carry, but no output carry. */
@@ -544,12 +540,10 @@ static void gen_rsub(TCGv_i32 out, TCGv_i32 ina, TCGv_i32 inb)
 /* Input and output carry. */
 static void gen_rsubc(TCGv_i32 out, TCGv_i32 ina, TCGv_i32 inb)
 {
-    TCGv_i32 zero = tcg_constant_i32(0);
     TCGv_i32 tmp = tcg_temp_new_i32();
 
     tcg_gen_not_i32(tmp, ina);
-    tcg_gen_add2_i32(tmp, cpu_msr_c, tmp, zero, cpu_msr_c, zero);
-    tcg_gen_add2_i32(out, cpu_msr_c, tmp, cpu_msr_c, inb, zero);
+    tcg_gen_addcio_i32(out, cpu_msr_c, tmp, inb, cpu_msr_c);
 }
 
 /* No input or output carry. */

From 02b9d791be10ea9e4c8fdfe4cfdc2a6a0de7e810 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 18 Jan 2025 01:50:50 -0800
Subject: [PATCH 0485/2760] target/openrisc: Use tcg_gen_addcio_* for ADDC
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/openrisc/translate.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/target/openrisc/translate.c b/target/openrisc/translate.c
index d4ce60188b..baadea4448 100644
--- a/target/openrisc/translate.c
+++ b/target/openrisc/translate.c
@@ -221,8 +221,7 @@ static void gen_addc(DisasContext *dc, TCGv dest, TCGv srca, TCGv srcb)
     TCGv t0 = tcg_temp_new();
     TCGv res = tcg_temp_new();
 
-    tcg_gen_add2_tl(res, cpu_sr_cy, srca, dc->zero, cpu_sr_cy, dc->zero);
-    tcg_gen_add2_tl(res, cpu_sr_cy, res, cpu_sr_cy, srcb, dc->zero);
+    tcg_gen_addcio_tl(res, cpu_sr_cy, srca, srcb, cpu_sr_cy);
     tcg_gen_xor_tl(cpu_sr_ov, srca, srcb);
     tcg_gen_xor_tl(t0, res, srcb);
     tcg_gen_andc_tl(cpu_sr_ov, t0, cpu_sr_ov);

From 3a6ec7d71a4e268a6be319cf2efa780091d42d30 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 18 Jan 2025 01:55:11 -0800
Subject: [PATCH 0486/2760] target/ppc: Use tcg_gen_addcio_tl for ADD and SUBF
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Tested-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/ppc/translate.c | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/target/ppc/translate.c b/target/ppc/translate.c
index fea2f2ce23..62dd008e36 100644
--- a/target/ppc/translate.c
+++ b/target/ppc/translate.c
@@ -1746,11 +1746,10 @@ static inline void gen_op_arith_add(DisasContext *ctx, TCGv ret, TCGv arg1,
                 tcg_gen_mov_tl(ca32, ca);
             }
         } else {
-            TCGv zero = tcg_constant_tl(0);
             if (add_ca) {
-                tcg_gen_add2_tl(t0, ca, arg1, zero, ca, zero);
-                tcg_gen_add2_tl(t0, ca, t0, ca, arg2, zero);
+                tcg_gen_addcio_tl(t0, ca, arg1, arg2, ca);
             } else {
+                TCGv zero = tcg_constant_tl(0);
                 tcg_gen_add2_tl(t0, ca, arg1, zero, arg2, zero);
             }
             gen_op_arith_compute_ca32(ctx, t0, arg1, arg2, ca32, 0);
@@ -1949,11 +1948,9 @@ static inline void gen_op_arith_subf(DisasContext *ctx, TCGv ret, TCGv arg1,
                 tcg_gen_mov_tl(cpu_ca32, cpu_ca);
             }
         } else if (add_ca) {
-            TCGv zero, inv1 = tcg_temp_new();
+            TCGv inv1 = tcg_temp_new();
             tcg_gen_not_tl(inv1, arg1);
-            zero = tcg_constant_tl(0);
-            tcg_gen_add2_tl(t0, cpu_ca, arg2, zero, cpu_ca, zero);
-            tcg_gen_add2_tl(t0, cpu_ca, t0, cpu_ca, inv1, zero);
+            tcg_gen_addcio_tl(t0, cpu_ca, arg2, inv1, cpu_ca);
             gen_op_arith_compute_ca32(ctx, t0, inv1, arg2, cpu_ca32, 0);
         } else {
             tcg_gen_setcond_tl(TCG_COND_GEU, cpu_ca, arg2, arg1);

From 206c23e4720cd2b7668197887d1694bd346e979e Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 18 Jan 2025 01:59:12 -0800
Subject: [PATCH 0487/2760] target/s390x: Use tcg_gen_addcio_i64 for op_addc64
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/s390x/tcg/translate.c | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/target/s390x/tcg/translate.c b/target/s390x/tcg/translate.c
index 00073c5560..a714f9c0c2 100644
--- a/target/s390x/tcg/translate.c
+++ b/target/s390x/tcg/translate.c
@@ -1250,11 +1250,7 @@ static DisasJumpType op_addc32(DisasContext *s, DisasOps *o)
 static DisasJumpType op_addc64(DisasContext *s, DisasOps *o)
 {
     compute_carry(s);
-
-    TCGv_i64 zero = tcg_constant_i64(0);
-    tcg_gen_add2_i64(o->out, cc_src, o->in1, zero, cc_src, zero);
-    tcg_gen_add2_i64(o->out, cc_src, o->out, cc_src, o->in2, zero);
-
+    tcg_gen_addcio_i64(o->out, cc_src, o->in1, o->in2, cc_src);
     return DISAS_NEXT;
 }
 

From 68188214d5b5dc80acc9143f6bdca25fc06f6e2b Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 18 Jan 2025 02:03:03 -0800
Subject: [PATCH 0488/2760] target/sh4: Use tcg_gen_addcio_i32 for addc
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/sh4/translate.c | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/target/sh4/translate.c b/target/sh4/translate.c
index 712a57fb54..712117be22 100644
--- a/target/sh4/translate.c
+++ b/target/sh4/translate.c
@@ -695,14 +695,8 @@ static void _decode_opc(DisasContext * ctx)
         tcg_gen_add_i32(REG(B11_8), REG(B11_8), REG(B7_4));
         return;
     case 0x300e: /* addc Rm,Rn */
-        {
-            TCGv t0, t1;
-            t0 = tcg_constant_tl(0);
-            t1 = tcg_temp_new();
-            tcg_gen_add2_i32(t1, cpu_sr_t, cpu_sr_t, t0, REG(B7_4), t0);
-            tcg_gen_add2_i32(REG(B11_8), cpu_sr_t,
-                             REG(B11_8), t0, t1, cpu_sr_t);
-        }
+        tcg_gen_addcio_i32(REG(B11_8), cpu_sr_t,
+                           REG(B11_8), REG(B7_4), cpu_sr_t);
         return;
     case 0x300f: /* addv Rm,Rn */
         {

From 6ed4d97ff7fbd2ef3d0d3f1f06d89560955873b8 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 18 Jan 2025 02:05:19 -0800
Subject: [PATCH 0489/2760] target/sparc: Use tcg_gen_addcio_tl for
 gen_op_addcc_int

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/sparc/translate.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/target/sparc/translate.c b/target/sparc/translate.c
index adebddf27b..63dd90447b 100644
--- a/target/sparc/translate.c
+++ b/target/sparc/translate.c
@@ -396,8 +396,7 @@ static void gen_op_addcc_int(TCGv dst, TCGv src1, TCGv src2, TCGv cin)
     TCGv z = tcg_constant_tl(0);
 
     if (cin) {
-        tcg_gen_add2_tl(cpu_cc_N, cpu_cc_C, src1, z, cin, z);
-        tcg_gen_add2_tl(cpu_cc_N, cpu_cc_C, cpu_cc_N, cpu_cc_C, src2, z);
+        tcg_gen_addcio_tl(cpu_cc_N, cpu_cc_C, src1, src2, cin);
     } else {
         tcg_gen_add2_tl(cpu_cc_N, cpu_cc_C, src1, z, src2, z);
     }

From 867878c112a0c8bbf7590a948ea291f1f1d61209 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 18 Jan 2025 02:08:55 -0800
Subject: [PATCH 0490/2760] target/tricore: Use tcg_gen_addcio_i32 for
 gen_addc_CC
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/tricore/translate.c | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/target/tricore/translate.c b/target/tricore/translate.c
index ede0c92c1e..ba36c9fcc8 100644
--- a/target/tricore/translate.c
+++ b/target/tricore/translate.c
@@ -1346,15 +1346,11 @@ static inline void gen_addi_CC(TCGv ret, TCGv r1, int32_t con)
 
 static inline void gen_addc_CC(TCGv ret, TCGv r1, TCGv r2)
 {
-    TCGv carry = tcg_temp_new_i32();
-    TCGv t0    = tcg_temp_new_i32();
+    TCGv t0     = tcg_temp_new_i32();
     TCGv result = tcg_temp_new_i32();
 
-    tcg_gen_movi_tl(t0, 0);
-    tcg_gen_setcondi_tl(TCG_COND_NE, carry, cpu_PSW_C, 0);
     /* Addition, carry and set C/V/SV bits */
-    tcg_gen_add2_i32(result, cpu_PSW_C, r1, t0, carry, t0);
-    tcg_gen_add2_i32(result, cpu_PSW_C, result, cpu_PSW_C, r2, t0);
+    tcg_gen_addcio_i32(result, cpu_PSW_C, r1, r2, cpu_PSW_C);
     /* calc V bit */
     tcg_gen_xor_tl(cpu_PSW_V, result, r1);
     tcg_gen_xor_tl(t0, r1, r2);

From 75351891b85f5fe4bd3c1e281d0d9d2dae097e6a Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 15 Jan 2025 02:41:58 -0800
Subject: [PATCH 0491/2760] tcg/aarch64: Implement add/sub carry opcodes

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target-con-set.h |   3 +-
 tcg/aarch64/tcg-target-has.h     |   8 +-
 tcg/aarch64/tcg-target.c.inc     | 227 ++++++++++++++++++++-----------
 3 files changed, 150 insertions(+), 88 deletions(-)

diff --git a/tcg/aarch64/tcg-target-con-set.h b/tcg/aarch64/tcg-target-con-set.h
index 2eda499cd3..d0622e65fb 100644
--- a/tcg/aarch64/tcg-target-con-set.h
+++ b/tcg/aarch64/tcg-target-con-set.h
@@ -24,6 +24,8 @@ C_O1_I2(r, r, rAL)
 C_O1_I2(r, r, rC)
 C_O1_I2(r, r, ri)
 C_O1_I2(r, r, rL)
+C_O1_I2(r, rZ, rA)
+C_O1_I2(r, rz, rMZ)
 C_O1_I2(r, rz, rz)
 C_O1_I2(r, rZ, rZ)
 C_O1_I2(w, 0, w)
@@ -34,4 +36,3 @@ C_O1_I2(w, w, wZ)
 C_O1_I3(w, w, w, w)
 C_O1_I4(r, r, rC, rz, rz)
 C_O2_I1(r, r, r)
-C_O2_I4(r, r, rz, rz, rA, rMZ)
diff --git a/tcg/aarch64/tcg-target-has.h b/tcg/aarch64/tcg-target-has.h
index 011a91c263..695effd77c 100644
--- a/tcg/aarch64/tcg-target-has.h
+++ b/tcg/aarch64/tcg-target-has.h
@@ -13,13 +13,13 @@
 #define have_lse2   (cpuinfo & CPUINFO_LSE2)
 
 /* optional instructions */
-#define TCG_TARGET_HAS_add2_i32         1
-#define TCG_TARGET_HAS_sub2_i32         1
+#define TCG_TARGET_HAS_add2_i32         0
+#define TCG_TARGET_HAS_sub2_i32         0
 #define TCG_TARGET_HAS_extr_i64_i32     0
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
-#define TCG_TARGET_HAS_add2_i64         1
-#define TCG_TARGET_HAS_sub2_i64         1
+#define TCG_TARGET_HAS_add2_i64         0
+#define TCG_TARGET_HAS_sub2_i64         0
 
 /*
  * Without FEAT_LSE2, we must use LDXP+STXP to implement atomic 128-bit load,
diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index 87f8c98ed7..75cf490fd2 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -508,7 +508,9 @@ typedef enum {
 
     /* Add/subtract with carry instructions.  */
     I3503_ADC       = 0x1a000000,
+    I3503_ADCS      = 0x3a000000,
     I3503_SBC       = 0x5a000000,
+    I3503_SBCS      = 0x7a000000,
 
     /* Conditional select instructions.  */
     I3506_CSEL      = 0x1a800000,
@@ -1573,56 +1575,6 @@ static void tcg_out_extrl_i64_i32(TCGContext *s, TCGReg rd, TCGReg rn)
     tcg_out_mov(s, TCG_TYPE_I32, rd, rn);
 }
 
-static void tcg_out_addsub2(TCGContext *s, TCGType ext, TCGReg rl,
-                            TCGReg rh, TCGReg al, TCGReg ah,
-                            tcg_target_long bl, tcg_target_long bh,
-                            bool const_bl, bool const_bh, bool sub)
-{
-    TCGReg orig_rl = rl;
-    AArch64Insn insn;
-
-    if (rl == ah || (!const_bh && rl == bh)) {
-        rl = TCG_REG_TMP0;
-    }
-
-    if (const_bl) {
-        if (bl < 0) {
-            bl = -bl;
-            insn = sub ? I3401_ADDSI : I3401_SUBSI;
-        } else {
-            insn = sub ? I3401_SUBSI : I3401_ADDSI;
-        }
-
-        if (unlikely(al == TCG_REG_XZR)) {
-            /* ??? We want to allow al to be zero for the benefit of
-               negation via subtraction.  However, that leaves open the
-               possibility of adding 0+const in the low part, and the
-               immediate add instructions encode XSP not XZR.  Don't try
-               anything more elaborate here than loading another zero.  */
-            al = TCG_REG_TMP0;
-            tcg_out_movi(s, ext, al, 0);
-        }
-        tcg_out_insn_3401(s, insn, ext, rl, al, bl);
-    } else {
-        tcg_out_insn_3502(s, sub ? I3502_SUBS : I3502_ADDS, ext, rl, al, bl);
-    }
-
-    insn = I3503_ADC;
-    if (const_bh) {
-        /* Note that the only two constants we support are 0 and -1, and
-           that SBC = rn + ~rm + c, so adc -1 is sbc 0, and vice-versa.  */
-        if ((bh != 0) ^ sub) {
-            insn = I3503_SBC;
-        }
-        bh = TCG_REG_XZR;
-    } else if (sub) {
-        insn = I3503_SBC;
-    }
-    tcg_out_insn_3503(s, insn, ext, rh, ah, bh);
-
-    tcg_out_mov(s, ext, orig_rl, rl);
-}
-
 static inline void tcg_out_mb(TCGContext *s, TCGArg a0)
 {
     static const uint32_t sync[] = {
@@ -2078,21 +2030,81 @@ static const TCGOutOpBinary outop_add = {
     .out_rri = tgen_addi,
 };
 
+static void tgen_addco(TCGContext *s, TCGType type,
+                       TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_insn(s, 3502, ADDS, type, a0, a1, a2);
+}
+
+static void tgen_addco_imm(TCGContext *s, TCGType type,
+                           TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    if (a2 >= 0) {
+        tcg_out_insn(s, 3401, ADDSI, type, a0, a1, a2);
+    } else {
+        tcg_out_insn(s, 3401, SUBSI, type, a0, a1, -a2);
+    }
+}
+
 static const TCGOutOpBinary outop_addco = {
-    .base.static_constraint = C_NotImplemented,
+    .base.static_constraint = C_O1_I2(r, r, rA),
+    .out_rrr = tgen_addco,
+    .out_rri = tgen_addco_imm,
 };
 
+static void tgen_addci_rrr(TCGContext *s, TCGType type,
+                           TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_insn(s, 3503, ADC, type, a0, a1, a2);
+}
+
+static void tgen_addci_rri(TCGContext *s, TCGType type,
+                           TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    /*
+     * Note that the only two constants we support are 0 and -1, and
+     * that SBC = rn + ~rm + c, so adc -1 is sbc 0, and vice-versa.
+     */
+    if (a2) {
+        tcg_out_insn(s, 3503, SBC, type, a0, a1, TCG_REG_XZR);
+    } else {
+        tcg_out_insn(s, 3503, ADC, type, a0, a1, TCG_REG_XZR);
+    }
+}
+
 static const TCGOutOpAddSubCarry outop_addci = {
-    .base.static_constraint = C_NotImplemented,
+    .base.static_constraint = C_O1_I2(r, rz, rMZ),
+    .out_rrr = tgen_addci_rrr,
+    .out_rri = tgen_addci_rri,
 };
 
+static void tgen_addcio(TCGContext *s, TCGType type,
+                        TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_insn(s, 3503, ADCS, type, a0, a1, a2);
+}
+
+static void tgen_addcio_imm(TCGContext *s, TCGType type,
+                            TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    /* Use SBCS w/0 for ADCS w/-1 -- see above. */
+    if (a2) {
+        tcg_out_insn(s, 3503, SBCS, type, a0, a1, TCG_REG_XZR);
+    } else {
+        tcg_out_insn(s, 3503, ADCS, type, a0, a1, TCG_REG_XZR);
+    }
+}
+
 static const TCGOutOpBinary outop_addcio = {
-    .base.static_constraint = C_NotImplemented,
+    .base.static_constraint = C_O1_I2(r, rz, rMZ),
+    .out_rrr = tgen_addcio,
+    .out_rri = tgen_addcio_imm,
 };
 
 static void tcg_out_set_carry(TCGContext *s)
 {
-    g_assert_not_reached();
+    tcg_out_insn(s, 3502, SUBS, TCG_TYPE_I32,
+                 TCG_REG_XZR, TCG_REG_XZR, TCG_REG_XZR);
 }
 
 static void tgen_and(TCGContext *s, TCGType type,
@@ -2438,21 +2450,95 @@ static const TCGOutOpSubtract outop_sub = {
     .out_rrr = tgen_sub,
 };
 
+static void tgen_subbo_rrr(TCGContext *s, TCGType type,
+                           TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_insn(s, 3502, SUBS, type, a0, a1, a2);
+}
+
+static void tgen_subbo_rri(TCGContext *s, TCGType type,
+                           TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    if (a2 >= 0) {
+        tcg_out_insn(s, 3401, SUBSI, type, a0, a1, a2);
+    } else {
+        tcg_out_insn(s, 3401, ADDSI, type, a0, a1, -a2);
+    }
+}
+
+static void tgen_subbo_rir(TCGContext *s, TCGType type,
+                           TCGReg a0, tcg_target_long a1, TCGReg a2)
+{
+    tgen_subbo_rrr(s, type, a0, TCG_REG_XZR, a2);
+}
+
+static void tgen_subbo_rii(TCGContext *s, TCGType type,
+                           TCGReg a0, tcg_target_long a1, tcg_target_long a2)
+{
+    if (a2 == 0) {
+        tgen_subbo_rrr(s, type, a0, TCG_REG_XZR, TCG_REG_XZR);
+        return;
+    }
+
+    /*
+     * We want to allow a1 to be zero for the benefit of negation via
+     * subtraction.  However, that leaves open the possibility of
+     * adding 0 +/- const, and the immediate add/sub instructions
+     * encode XSP not XZR.  Since we have 0 - non-zero, borrow is
+     * always set.
+     */
+    tcg_out_movi(s, type, a0, -a2);
+    tcg_out_set_borrow(s);
+}
+
 static const TCGOutOpAddSubCarry outop_subbo = {
-    .base.static_constraint = C_NotImplemented,
+    .base.static_constraint = C_O1_I2(r, rZ, rA),
+    .out_rrr = tgen_subbo_rrr,
+    .out_rri = tgen_subbo_rri,
+    .out_rir = tgen_subbo_rir,
+    .out_rii = tgen_subbo_rii,
 };
 
+static void tgen_subbi_rrr(TCGContext *s, TCGType type,
+                           TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_insn(s, 3503, SBC, type, a0, a1, a2);
+}
+
+static void tgen_subbi_rri(TCGContext *s, TCGType type,
+                           TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    tgen_addci_rri(s, type, a0, a1, ~a2);
+}
+
 static const TCGOutOpAddSubCarry outop_subbi = {
-    .base.static_constraint = C_NotImplemented,
+    .base.static_constraint = C_O1_I2(r, rz, rMZ),
+    .out_rrr = tgen_subbi_rrr,
+    .out_rri = tgen_subbi_rri,
 };
 
+static void tgen_subbio_rrr(TCGContext *s, TCGType type,
+                            TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_insn(s, 3503, SBCS, type, a0, a1, a2);
+}
+
+static void tgen_subbio_rri(TCGContext *s, TCGType type,
+                            TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    tgen_addcio_imm(s, type, a0, a1, ~a2);
+}
+
 static const TCGOutOpAddSubCarry outop_subbio = {
-    .base.static_constraint = C_NotImplemented,
+    .base.static_constraint = C_O1_I2(r, rz, rMZ),
+    .out_rrr = tgen_subbio_rrr,
+    .out_rri = tgen_subbio_rri,
 };
 
 static void tcg_out_set_borrow(TCGContext *s)
 {
-    g_assert_not_reached();
+    tcg_out_insn(s, 3502, ADDS, TCG_TYPE_I32,
+                 TCG_REG_XZR, TCG_REG_XZR, TCG_REG_XZR);
 }
 
 static void tgen_xor(TCGContext *s, TCGType type,
@@ -2759,25 +2845,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType ext,
         tcg_out_qemu_ldst_i128(s, a0, a1, a2, args[3], false);
         break;
 
-    case INDEX_op_add2_i32:
-        tcg_out_addsub2(s, TCG_TYPE_I32, a0, a1, a2, args[3],
-                        (int32_t)args[4], args[5], const_args[4],
-                        const_args[5], false);
-        break;
-    case INDEX_op_add2_i64:
-        tcg_out_addsub2(s, TCG_TYPE_I64, a0, a1, a2, args[3], args[4],
-                        args[5], const_args[4], const_args[5], false);
-        break;
-    case INDEX_op_sub2_i32:
-        tcg_out_addsub2(s, TCG_TYPE_I32, a0, a1, a2, args[3],
-                        (int32_t)args[4], args[5], const_args[4],
-                        const_args[5], true);
-        break;
-    case INDEX_op_sub2_i64:
-        tcg_out_addsub2(s, TCG_TYPE_I64, a0, a1, a2, args[3], args[4],
-                        args[5], const_args[4], const_args[5], true);
-        break;
-
     case INDEX_op_mb:
         tcg_out_mb(s, a0);
         break;
@@ -3271,12 +3338,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_qemu_st_i128:
         return C_O0_I3(rz, rz, r);
 
-    case INDEX_op_add2_i32:
-    case INDEX_op_add2_i64:
-    case INDEX_op_sub2_i32:
-    case INDEX_op_sub2_i64:
-        return C_O2_I4(r, r, rz, rz, rA, rMZ);
-
     case INDEX_op_add_vec:
     case INDEX_op_sub_vec:
     case INDEX_op_mul_vec:

From b15c0d11a28e6be7156b6920a7a5b2179112b1fa Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 15 Jan 2025 23:35:53 +0000
Subject: [PATCH 0492/2760] tcg/arm: Implement add/sub carry opcodes

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/arm/tcg-target-con-set.h |   4 +-
 tcg/arm/tcg-target-has.h     |   4 +-
 tcg/arm/tcg-target.c.inc     | 212 ++++++++++++++++++++++++++---------
 3 files changed, 161 insertions(+), 59 deletions(-)

diff --git a/tcg/arm/tcg-target-con-set.h b/tcg/arm/tcg-target-con-set.h
index f46a8444fb..16b1193228 100644
--- a/tcg/arm/tcg-target-con-set.h
+++ b/tcg/arm/tcg-target-con-set.h
@@ -31,6 +31,8 @@ C_O1_I2(r, r, rIK)
 C_O1_I2(r, r, rIN)
 C_O1_I2(r, r, ri)
 C_O1_I2(r, rI, r)
+C_O1_I2(r, rI, rIK)
+C_O1_I2(r, rI, rIN)
 C_O1_I2(r, rZ, rZ)
 C_O1_I2(w, 0, w)
 C_O1_I2(w, w, w)
@@ -43,5 +45,3 @@ C_O1_I4(r, r, rIN, rIK, 0)
 C_O2_I1(e, p, q)
 C_O2_I2(e, p, q, q)
 C_O2_I2(r, r, r, r)
-C_O2_I4(r, r, r, r, rIN, rIK)
-C_O2_I4(r, r, rI, rI, rIN, rIK)
diff --git a/tcg/arm/tcg-target-has.h b/tcg/arm/tcg-target-has.h
index 3973df1f12..f4bd15c68a 100644
--- a/tcg/arm/tcg-target-has.h
+++ b/tcg/arm/tcg-target-has.h
@@ -24,8 +24,8 @@ extern bool use_neon_instructions;
 #endif
 
 /* optional instructions */
-#define TCG_TARGET_HAS_add2_i32         1
-#define TCG_TARGET_HAS_sub2_i32         1
+#define TCG_TARGET_HAS_add2_i32         0
+#define TCG_TARGET_HAS_sub2_i32         0
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
 #define TCG_TARGET_HAS_qemu_ldst_i128   0
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index aa0397520d..3c9042ebfa 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -178,6 +178,8 @@ typedef enum {
     INSN_DMB_ISH   = 0xf57ff05b,
     INSN_DMB_MCR   = 0xee070fba,
 
+    INSN_MSRI_CPSR = 0x0360f000,
+
     /* Architected nop introduced in v6k.  */
     /* ??? This is an MSR (imm) 0,0,0 insn.  Anyone know if this
        also Just So Happened to do nothing on pre-v6k so that we
@@ -1826,21 +1828,74 @@ static const TCGOutOpBinary outop_add = {
     .out_rri = tgen_addi,
 };
 
+static void tgen_addco(TCGContext *s, TCGType type,
+                       TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_dat_reg(s, COND_AL, ARITH_ADD | TO_CPSR,
+                    a0, a1, a2, SHIFT_IMM_LSL(0));
+}
+
+static void tgen_addco_imm(TCGContext *s, TCGType type,
+                           TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    tcg_out_dat_IN(s, COND_AL, ARITH_ADD | TO_CPSR, ARITH_SUB | TO_CPSR,
+                   a0, a1, a2);
+}
+
 static const TCGOutOpBinary outop_addco = {
-    .base.static_constraint = C_NotImplemented,
+    .base.static_constraint = C_O1_I2(r, r, rIN),
+    .out_rrr = tgen_addco,
+    .out_rri = tgen_addco_imm,
 };
 
+static void tgen_addci(TCGContext *s, TCGType type,
+                       TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_dat_reg(s, COND_AL, ARITH_ADC, a0, a1, a2, SHIFT_IMM_LSL(0));
+}
+
+static void tgen_addci_imm(TCGContext *s, TCGType type,
+                           TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    tcg_out_dat_IK(s, COND_AL, ARITH_ADC, ARITH_SBC, a0, a1, a2);
+}
+
 static const TCGOutOpAddSubCarry outop_addci = {
-    .base.static_constraint = C_NotImplemented,
+    .base.static_constraint = C_O1_I2(r, r, rIK),
+    .out_rrr = tgen_addci,
+    .out_rri = tgen_addci_imm,
 };
 
+static void tgen_addcio(TCGContext *s, TCGType type,
+                        TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_dat_reg(s, COND_AL, ARITH_ADC | TO_CPSR,
+                    a0, a1, a2, SHIFT_IMM_LSL(0));
+}
+
+static void tgen_addcio_imm(TCGContext *s, TCGType type,
+                            TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    tcg_out_dat_IK(s, COND_AL, ARITH_ADC | TO_CPSR, ARITH_SBC | TO_CPSR,
+                   a0, a1, a2);
+}
+
 static const TCGOutOpBinary outop_addcio = {
-    .base.static_constraint = C_NotImplemented,
+    .base.static_constraint = C_O1_I2(r, r, rIK),
+    .out_rrr = tgen_addcio,
+    .out_rri = tgen_addcio_imm,
 };
 
+/* Set C to @c; NZVQ all set to 0. */
+static void tcg_out_movi_apsr_c(TCGContext *s, bool c)
+{
+    int imm12 = encode_imm_nofail(c << 29);
+    tcg_out32(s, (COND_AL << 28) | INSN_MSRI_CPSR | 0x80000 | imm12);
+}
+
 static void tcg_out_set_carry(TCGContext *s)
 {
-    g_assert_not_reached();
+    tcg_out_movi_apsr_c(s, 1);
 }
 
 static void tgen_and(TCGContext *s, TCGType type,
@@ -2152,21 +2207,115 @@ static const TCGOutOpSubtract outop_sub = {
     .out_rir = tgen_subfi,
 };
 
+static void tgen_subbo_rrr(TCGContext *s, TCGType type,
+                           TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_dat_reg(s, COND_AL, ARITH_SUB | TO_CPSR,
+                    a0, a1, a2, SHIFT_IMM_LSL(0));
+}
+
+static void tgen_subbo_rri(TCGContext *s, TCGType type,
+                           TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    tcg_out_dat_IN(s, COND_AL, ARITH_SUB | TO_CPSR, ARITH_ADD | TO_CPSR,
+                   a0, a1, a2);
+}
+
+static void tgen_subbo_rir(TCGContext *s, TCGType type,
+                           TCGReg a0, tcg_target_long a1, TCGReg a2)
+{
+    tcg_out_dat_imm(s, COND_AL, ARITH_RSB | TO_CPSR,
+                    a0, a2, encode_imm_nofail(a1));
+}
+
+static void tgen_subbo_rii(TCGContext *s, TCGType type,
+                           TCGReg a0, tcg_target_long a1, tcg_target_long a2)
+{
+    tcg_out_movi(s, TCG_TYPE_I32, TCG_REG_TMP, a2);
+    tgen_subbo_rir(s, TCG_TYPE_I32, a0, a1, TCG_REG_TMP);
+}
+
 static const TCGOutOpAddSubCarry outop_subbo = {
-    .base.static_constraint = C_NotImplemented,
+    .base.static_constraint = C_O1_I2(r, rI, rIN),
+    .out_rrr = tgen_subbo_rrr,
+    .out_rri = tgen_subbo_rri,
+    .out_rir = tgen_subbo_rir,
+    .out_rii = tgen_subbo_rii,
 };
 
+static void tgen_subbi_rrr(TCGContext *s, TCGType type,
+                           TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_dat_reg(s, COND_AL, ARITH_SBC,
+                    a0, a1, a2, SHIFT_IMM_LSL(0));
+}
+
+static void tgen_subbi_rri(TCGContext *s, TCGType type,
+                           TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    tcg_out_dat_IK(s, COND_AL, ARITH_SBC, ARITH_ADC, a0, a1, a2);
+}
+
+static void tgen_subbi_rir(TCGContext *s, TCGType type,
+                           TCGReg a0, tcg_target_long a1, TCGReg a2)
+{
+    tcg_out_dat_imm(s, COND_AL, ARITH_RSC, a0, a2, encode_imm_nofail(a1));
+}
+
+static void tgen_subbi_rii(TCGContext *s, TCGType type,
+                           TCGReg a0, tcg_target_long a1, tcg_target_long a2)
+{
+    tcg_out_movi(s, TCG_TYPE_I32, TCG_REG_TMP, a2);
+    tgen_subbi_rir(s, TCG_TYPE_I32, a0, a1, TCG_REG_TMP);
+}
+
 static const TCGOutOpAddSubCarry outop_subbi = {
-    .base.static_constraint = C_NotImplemented,
+    .base.static_constraint = C_O1_I2(r, rI, rIK),
+    .out_rrr = tgen_subbi_rrr,
+    .out_rri = tgen_subbi_rri,
+    .out_rir = tgen_subbi_rir,
+    .out_rii = tgen_subbi_rii,
 };
 
+static void tgen_subbio_rrr(TCGContext *s, TCGType type,
+                            TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_dat_reg(s, COND_AL, ARITH_SBC | TO_CPSR,
+                    a0, a1, a2, SHIFT_IMM_LSL(0));
+}
+
+static void tgen_subbio_rri(TCGContext *s, TCGType type,
+                            TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    tcg_out_dat_IK(s, COND_AL, ARITH_SBC | TO_CPSR, ARITH_ADC | TO_CPSR,
+                   a0, a1, a2);
+}
+
+static void tgen_subbio_rir(TCGContext *s, TCGType type,
+                            TCGReg a0, tcg_target_long a1, TCGReg a2)
+{
+    tcg_out_dat_imm(s, COND_AL, ARITH_RSC | TO_CPSR,
+                    a0, a2, encode_imm_nofail(a1));
+}
+
+static void tgen_subbio_rii(TCGContext *s, TCGType type,
+                            TCGReg a0, tcg_target_long a1, tcg_target_long a2)
+{
+    tcg_out_movi(s, TCG_TYPE_I32, TCG_REG_TMP, a2);
+    tgen_subbio_rir(s, TCG_TYPE_I32, a0, a1, TCG_REG_TMP);
+}
+
 static const TCGOutOpAddSubCarry outop_subbio = {
-    .base.static_constraint = C_NotImplemented,
+    .base.static_constraint = C_O1_I2(r, rI, rIK),
+    .out_rrr = tgen_subbio_rrr,
+    .out_rri = tgen_subbio_rri,
+    .out_rir = tgen_subbio_rir,
+    .out_rii = tgen_subbio_rii,
 };
 
 static void tcg_out_set_borrow(TCGContext *s)
 {
-    g_assert_not_reached();
+    tcg_out_movi_apsr_c(s, 0);  /* borrow = !carry */
 }
 
 static void tgen_xor(TCGContext *s, TCGType type,
@@ -2369,8 +2518,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
                        const int const_args[TCG_MAX_OP_ARGS])
 {
-    TCGArg a0, a1, a2, a3, a4, a5;
-
     switch (opc) {
     case INDEX_op_goto_ptr:
         tcg_out_b_reg(s, COND_AL, args[0]);
@@ -2404,47 +2551,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_st32(s, COND_AL, args[0], args[1], args[2]);
         break;
 
-    case INDEX_op_add2_i32:
-        a0 = args[0], a1 = args[1], a2 = args[2];
-        a3 = args[3], a4 = args[4], a5 = args[5];
-        if (a0 == a3 || (a0 == a5 && !const_args[5])) {
-            a0 = TCG_REG_TMP;
-        }
-        tcg_out_dat_rIN(s, COND_AL, ARITH_ADD | TO_CPSR, ARITH_SUB | TO_CPSR,
-                        a0, a2, a4, const_args[4]);
-        tcg_out_dat_rIK(s, COND_AL, ARITH_ADC, ARITH_SBC,
-                        a1, a3, a5, const_args[5]);
-        tcg_out_mov_reg(s, COND_AL, args[0], a0);
-        break;
-    case INDEX_op_sub2_i32:
-        a0 = args[0], a1 = args[1], a2 = args[2];
-        a3 = args[3], a4 = args[4], a5 = args[5];
-        if ((a0 == a3 && !const_args[3]) || (a0 == a5 && !const_args[5])) {
-            a0 = TCG_REG_TMP;
-        }
-        if (const_args[2]) {
-            if (const_args[4]) {
-                tcg_out_movi32(s, COND_AL, a0, a4);
-                a4 = a0;
-            }
-            tcg_out_dat_rI(s, COND_AL, ARITH_RSB | TO_CPSR, a0, a4, a2, 1);
-        } else {
-            tcg_out_dat_rIN(s, COND_AL, ARITH_SUB | TO_CPSR,
-                            ARITH_ADD | TO_CPSR, a0, a2, a4, const_args[4]);
-        }
-        if (const_args[3]) {
-            if (const_args[5]) {
-                tcg_out_movi32(s, COND_AL, a1, a5);
-                a5 = a1;
-            }
-            tcg_out_dat_rI(s, COND_AL, ARITH_RSC, a1, a5, a3, 1);
-        } else {
-            tcg_out_dat_rIK(s, COND_AL, ARITH_SBC, ARITH_ADC,
-                            a1, a3, a5, const_args[5]);
-        }
-        tcg_out_mov_reg(s, COND_AL, args[0], a0);
-        break;
-
     case INDEX_op_qemu_ld_i32:
         tcg_out_qemu_ld(s, args[0], -1, args[1], args[2], TCG_TYPE_I32);
         break;
@@ -2490,10 +2596,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i32:
         return C_O0_I2(r, r);
 
-    case INDEX_op_add2_i32:
-        return C_O2_I4(r, r, r, r, rIN, rIK);
-    case INDEX_op_sub2_i32:
-        return C_O2_I4(r, r, rI, rI, rIN, rIK);
     case INDEX_op_qemu_ld_i32:
         return C_O1_I1(r, q);
     case INDEX_op_qemu_ld_i64:

From 2329da9605b0f1b7bd59f58afb5ab2154d0af137 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 18 Jan 2025 00:38:13 +0000
Subject: [PATCH 0493/2760] tcg/ppc: Implement add/sub carry opcodes

Tested-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/ppc/tcg-target-con-set.h |   5 +-
 tcg/ppc/tcg-target-con-str.h |   1 +
 tcg/ppc/tcg-target-has.h     |  11 +-
 tcg/ppc/tcg-target.c.inc     | 227 ++++++++++++++++++++++-------------
 4 files changed, 154 insertions(+), 90 deletions(-)

diff --git a/tcg/ppc/tcg-target-con-set.h b/tcg/ppc/tcg-target-con-set.h
index 14cd217287..da7a383bff 100644
--- a/tcg/ppc/tcg-target-con-set.h
+++ b/tcg/ppc/tcg-target-con-set.h
@@ -29,7 +29,10 @@ C_O1_I2(r, r, rC)
 C_O1_I2(r, r, rI)
 C_O1_I2(r, r, rT)
 C_O1_I2(r, r, rU)
+C_O1_I2(r, r, rZM)
 C_O1_I2(r, r, rZW)
+C_O1_I2(r, rI, rN)
+C_O1_I2(r, rZM, rZM)
 C_O1_I2(v, v, v)
 C_O1_I3(v, v, v, v)
 C_O1_I4(v, v, v, vZM, v)
@@ -38,5 +41,3 @@ C_O1_I4(r, r, r, rU, rC)
 C_O2_I1(r, r, r)
 C_N1O1_I1(o, m, r)
 C_O2_I2(r, r, r, r)
-C_O2_I4(r, r, rI, rZM, r, r)
-C_O2_I4(r, r, r, r, rI, rZM)
diff --git a/tcg/ppc/tcg-target-con-str.h b/tcg/ppc/tcg-target-con-str.h
index 16b687216e..faf92da47f 100644
--- a/tcg/ppc/tcg-target-con-str.h
+++ b/tcg/ppc/tcg-target-con-str.h
@@ -19,6 +19,7 @@ REGS('v', ALL_VECTOR_REGS)
 CONST('C', TCG_CT_CONST_CMP)
 CONST('I', TCG_CT_CONST_S16)
 CONST('M', TCG_CT_CONST_MONE)
+CONST('N', TCG_CT_CONST_N16)
 CONST('T', TCG_CT_CONST_S32)
 CONST('U', TCG_CT_CONST_U32)
 CONST('W', TCG_CT_CONST_WSZ)
diff --git a/tcg/ppc/tcg-target-has.h b/tcg/ppc/tcg-target-has.h
index 8d832ce99c..4dda668706 100644
--- a/tcg/ppc/tcg-target-has.h
+++ b/tcg/ppc/tcg-target-has.h
@@ -18,16 +18,13 @@
 
 /* optional instructions */
 #define TCG_TARGET_HAS_qemu_st8_i32     0
-
-#if TCG_TARGET_REG_BITS == 64
 #define TCG_TARGET_HAS_add2_i32         0
 #define TCG_TARGET_HAS_sub2_i32         0
+
+#if TCG_TARGET_REG_BITS == 64
 #define TCG_TARGET_HAS_extr_i64_i32     0
-#define TCG_TARGET_HAS_add2_i64         1
-#define TCG_TARGET_HAS_sub2_i64         1
-#else
-#define TCG_TARGET_HAS_add2_i32         1
-#define TCG_TARGET_HAS_sub2_i32         1
+#define TCG_TARGET_HAS_add2_i64         0
+#define TCG_TARGET_HAS_sub2_i64         0
 #endif
 
 #define TCG_TARGET_HAS_qemu_ldst_i128   \
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index 5b04655f3b..91df9610ec 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -89,14 +89,15 @@
 /* Shorthand for size of a register.  */
 #define SZR  (TCG_TARGET_REG_BITS / 8)
 
-#define TCG_CT_CONST_S16  0x100
-#define TCG_CT_CONST_U16  0x200
-#define TCG_CT_CONST_S32  0x400
-#define TCG_CT_CONST_U32  0x800
-#define TCG_CT_CONST_ZERO 0x1000
-#define TCG_CT_CONST_MONE 0x2000
-#define TCG_CT_CONST_WSZ  0x4000
-#define TCG_CT_CONST_CMP  0x8000
+#define TCG_CT_CONST_S16     0x00100
+#define TCG_CT_CONST_U16     0x00200
+#define TCG_CT_CONST_N16     0x00400
+#define TCG_CT_CONST_S32     0x00800
+#define TCG_CT_CONST_U32     0x01000
+#define TCG_CT_CONST_ZERO    0x02000
+#define TCG_CT_CONST_MONE    0x04000
+#define TCG_CT_CONST_WSZ     0x08000
+#define TCG_CT_CONST_CMP     0x10000
 
 #define ALL_GENERAL_REGS  0xffffffffu
 #define ALL_VECTOR_REGS   0xffffffff00000000ull
@@ -342,6 +343,9 @@ static bool tcg_target_const_match(int64_t sval, int ct,
     if ((ct & TCG_CT_CONST_U16) && uval == (uint16_t)uval) {
         return 1;
     }
+    if ((ct & TCG_CT_CONST_N16) && -sval == (int16_t)-sval) {
+        return 1;
+    }
     if ((ct & TCG_CT_CONST_S32) && sval == (int32_t)sval) {
         return 1;
     }
@@ -2863,21 +2867,69 @@ static const TCGOutOpBinary outop_add = {
     .out_rri = tgen_addi,
 };
 
+static void tgen_addco_rrr(TCGContext *s, TCGType type,
+                           TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out32(s, ADDC | TAB(a0, a1, a2));
+}
+
+static void tgen_addco_rri(TCGContext *s, TCGType type,
+                           TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    tcg_out32(s, ADDIC | TAI(a0, a1, a2));
+}
+
+static TCGConstraintSetIndex cset_addco(TCGType type, unsigned flags)
+{
+    /*
+     * Note that the CA bit is defined based on the word size of the
+     * environment.  So in 64-bit mode it's always carry-out of bit 63.
+     * The fallback code using deposit works just as well for TCG_TYPE_I32.
+     */
+    return type == TCG_TYPE_REG ? C_O1_I2(r, r, rI) : C_NotImplemented;
+}
+
 static const TCGOutOpBinary outop_addco = {
-    .base.static_constraint = C_NotImplemented,
+    .base.static_constraint = C_Dynamic,
+    .base.dynamic_constraint = cset_addco,
+    .out_rrr = tgen_addco_rrr,
+    .out_rri = tgen_addco_rri,
+};
+
+static void tgen_addcio_rrr(TCGContext *s, TCGType type,
+                            TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out32(s, ADDE | TAB(a0, a1, a2));
+}
+
+static void tgen_addcio_rri(TCGContext *s, TCGType type,
+                            TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    tcg_out32(s, (a2 ? ADDME : ADDZE) | RT(a0) | RA(a1));
+}
+
+static TCGConstraintSetIndex cset_addcio(TCGType type, unsigned flags)
+{
+    return type == TCG_TYPE_REG ? C_O1_I2(r, r, rZM) : C_NotImplemented;
+}
+
+static const TCGOutOpBinary outop_addcio = {
+    .base.static_constraint = C_Dynamic,
+    .base.dynamic_constraint = cset_addcio,
+    .out_rrr = tgen_addcio_rrr,
+    .out_rri = tgen_addcio_rri,
 };
 
 static const TCGOutOpAddSubCarry outop_addci = {
-    .base.static_constraint = C_NotImplemented,
-};
-
-static const TCGOutOpBinary outop_addcio = {
-    .base.static_constraint = C_NotImplemented,
+    .base.static_constraint = C_Dynamic,
+    .base.dynamic_constraint = cset_addcio,
+    .out_rrr = tgen_addcio_rrr,
+    .out_rri = tgen_addcio_rri,
 };
 
 static void tcg_out_set_carry(TCGContext *s)
 {
-    g_assert_not_reached();
+    tcg_out32(s, SUBFC | TAB(TCG_REG_R0, TCG_REG_R0, TCG_REG_R0));
 }
 
 static void tgen_and(TCGContext *s, TCGType type,
@@ -3284,21 +3336,94 @@ static const TCGOutOpSubtract outop_sub = {
     .out_rir = tgen_subfi,
 };
 
+static void tgen_subbo_rrr(TCGContext *s, TCGType type,
+                           TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out32(s, SUBFC | TAB(a0, a2, a1));
+}
+
+static void tgen_subbo_rri(TCGContext *s, TCGType type,
+                           TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    if (a2 == 0) {
+        tcg_out_movi(s, type, TCG_REG_R0, 0);
+        tgen_subbo_rrr(s, type, a0, a1, TCG_REG_R0);
+    } else {
+        tgen_addco_rri(s, type, a0, a1, -a2);
+    }
+}
+
+/* The underlying insn for subfi is subfic. */
+#define tgen_subbo_rir  tgen_subfi
+
+static void tgen_subbo_rii(TCGContext *s, TCGType type,
+                           TCGReg a0, tcg_target_long a1, tcg_target_long a2)
+{
+    tcg_out_movi(s, type, TCG_REG_R0, a2);
+    tgen_subbo_rir(s, type, a0, a1, TCG_REG_R0);
+}
+
+static TCGConstraintSetIndex cset_subbo(TCGType type, unsigned flags)
+{
+    /* Recall that the CA bit is defined based on the host word size. */
+    return type == TCG_TYPE_REG ? C_O1_I2(r, rI, rN) : C_NotImplemented;
+}
+
 static const TCGOutOpAddSubCarry outop_subbo = {
-    .base.static_constraint = C_NotImplemented,
+    .base.static_constraint = C_Dynamic,
+    .base.dynamic_constraint = cset_subbo,
+    .out_rrr = tgen_subbo_rrr,
+    .out_rri = tgen_subbo_rri,
+    .out_rir = tgen_subbo_rir,
+    .out_rii = tgen_subbo_rii,
 };
 
-static const TCGOutOpAddSubCarry outop_subbi = {
-    .base.static_constraint = C_NotImplemented,
-};
+static void tgen_subbio_rrr(TCGContext *s, TCGType type,
+                            TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out32(s, SUBFE | TAB(a0, a2, a1));
+}
+
+static void tgen_subbio_rri(TCGContext *s, TCGType type,
+                            TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    tgen_addcio_rri(s, type, a0, a1, ~a2);
+}
+
+static void tgen_subbio_rir(TCGContext *s, TCGType type,
+                            TCGReg a0, tcg_target_long a1, TCGReg a2)
+{
+    tcg_debug_assert(a1 == 0 || a1 == -1);
+    tcg_out32(s, (a1 ? SUBFME : SUBFZE) | RT(a0) | RA(a2));
+}
+
+static void tgen_subbio_rii(TCGContext *s, TCGType type,
+                            TCGReg a0, tcg_target_long a1, tcg_target_long a2)
+{
+    tcg_out_movi(s, type, TCG_REG_R0, a2);
+    tgen_subbio_rir(s, type, a0, a1, TCG_REG_R0);
+}
+
+static TCGConstraintSetIndex cset_subbio(TCGType type, unsigned flags)
+{
+    return type == TCG_TYPE_REG ? C_O1_I2(r, rZM, rZM) : C_NotImplemented;
+}
 
 static const TCGOutOpAddSubCarry outop_subbio = {
-    .base.static_constraint = C_NotImplemented,
+    .base.static_constraint = C_Dynamic,
+    .base.dynamic_constraint = cset_subbio,
+    .out_rrr = tgen_subbio_rrr,
+    .out_rri = tgen_subbio_rri,
+    .out_rir = tgen_subbio_rir,
+    .out_rii = tgen_subbio_rii,
 };
 
+#define outop_subbi  outop_subbio
+
 static void tcg_out_set_borrow(TCGContext *s)
 {
-    g_assert_not_reached();
+    /* borrow = !carry */
+    tcg_out32(s, ADDIC | TAI(TCG_REG_R0, TCG_REG_R0, 0));
 }
 
 static void tgen_xor(TCGContext *s, TCGType type,
@@ -3538,8 +3663,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
                        const int const_args[TCG_MAX_OP_ARGS])
 {
-    TCGArg a0, a1;
-
     switch (opc) {
     case INDEX_op_goto_ptr:
         tcg_out32(s, MTSPR | RS(args[0]) | CTR);
@@ -3635,57 +3758,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_qemu_ldst_i128(s, args[0], args[1], args[2], args[3], false);
         break;
 
-#if TCG_TARGET_REG_BITS == 64
-    case INDEX_op_add2_i64:
-#else
-    case INDEX_op_add2_i32:
-#endif
-        /* Note that the CA bit is defined based on the word size of the
-           environment.  So in 64-bit mode it's always carry-out of bit 63.
-           The fallback code using deposit works just as well for 32-bit.  */
-        a0 = args[0], a1 = args[1];
-        if (a0 == args[3] || (!const_args[5] && a0 == args[5])) {
-            a0 = TCG_REG_R0;
-        }
-        if (const_args[4]) {
-            tcg_out32(s, ADDIC | TAI(a0, args[2], args[4]));
-        } else {
-            tcg_out32(s, ADDC | TAB(a0, args[2], args[4]));
-        }
-        if (const_args[5]) {
-            tcg_out32(s, (args[5] ? ADDME : ADDZE) | RT(a1) | RA(args[3]));
-        } else {
-            tcg_out32(s, ADDE | TAB(a1, args[3], args[5]));
-        }
-        if (a0 != args[0]) {
-            tcg_out_mov(s, TCG_TYPE_REG, args[0], a0);
-        }
-        break;
-
-#if TCG_TARGET_REG_BITS == 64
-    case INDEX_op_sub2_i64:
-#else
-    case INDEX_op_sub2_i32:
-#endif
-        a0 = args[0], a1 = args[1];
-        if (a0 == args[5] || (!const_args[3] && a0 == args[3])) {
-            a0 = TCG_REG_R0;
-        }
-        if (const_args[2]) {
-            tcg_out32(s, SUBFIC | TAI(a0, args[4], args[2]));
-        } else {
-            tcg_out32(s, SUBFC | TAB(a0, args[4], args[2]));
-        }
-        if (const_args[3]) {
-            tcg_out32(s, (args[3] ? SUBFME : SUBFZE) | RT(a1) | RA(args[5]));
-        } else {
-            tcg_out32(s, SUBFE | TAB(a1, args[5], args[3]));
-        }
-        if (a0 != args[0]) {
-            tcg_out_mov(s, TCG_TYPE_REG, args[0], a0);
-        }
-        break;
-
     case INDEX_op_mb:
         tcg_out_mb(s, args[0]);
         break;
@@ -4331,13 +4403,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(r, r);
 
-    case INDEX_op_add2_i64:
-    case INDEX_op_add2_i32:
-        return C_O2_I4(r, r, r, r, rI, rZM);
-    case INDEX_op_sub2_i64:
-    case INDEX_op_sub2_i32:
-        return C_O2_I4(r, r, rI, rZM, r, r);
-
     case INDEX_op_qemu_ld_i32:
         return C_O1_I1(r, r);
     case INDEX_op_qemu_ld_i64:

From 1b6e25e300e78cf8d8581245c2f8339c5b423d30 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 18 Jan 2025 13:26:43 -0800
Subject: [PATCH 0494/2760] tcg/s390x: Honor carry_live in tcg_out_movi

Do not clobber flags if they're live.  Required in order
to perform register allocation on add/sub carry opcodes.
LA and AGHI are the same size, so use LA unconditionally.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/s390x/tcg-target.c.inc | 35 +++++++++++++++++++++--------------
 1 file changed, 21 insertions(+), 14 deletions(-)

diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index a30afb455e..e262876614 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -951,25 +951,32 @@ static void tcg_out_movi(TCGContext *s, TCGType type,
     if (pc_off == (int32_t)pc_off) {
         tcg_out_insn(s, RIL, LARL, ret, pc_off);
         if (sval & 1) {
-            tcg_out_insn(s, RI, AGHI, ret, 1);
+            tcg_out_insn(s, RX, LA, ret, ret, TCG_REG_NONE, 1);
         }
         return;
     }
 
-    /* Otherwise, load it by parts. */
-    i = is_const_p16((uint32_t)uval);
-    if (i >= 0) {
-        tcg_out_insn_RI(s, li_insns[i], ret, uval >> (i * 16));
-    } else {
-        tcg_out_insn(s, RIL, LLILF, ret, uval);
-    }
-    uval >>= 32;
-    i = is_const_p16(uval);
-    if (i >= 0) {
-        tcg_out_insn_RI(s, oi_insns[i + 2], ret, uval >> (i * 16));
-    } else {
-        tcg_out_insn(s, RIL, OIHF, ret, uval);
+    if (!s->carry_live) {
+        /* Load by parts, at most 2 instructions. */
+        i = is_const_p16((uint32_t)uval);
+        if (i >= 0) {
+            tcg_out_insn_RI(s, li_insns[i], ret, uval >> (i * 16));
+        } else {
+            tcg_out_insn(s, RIL, LLILF, ret, uval);
+        }
+        uval >>= 32;
+        i = is_const_p16(uval);
+        if (i >= 0) {
+            tcg_out_insn_RI(s, oi_insns[i + 2], ret, uval >> (i * 16));
+        } else {
+            tcg_out_insn(s, RIL, OIHF, ret, uval);
+        }
+        return;
     }
+
+    /* Otherwise, stuff it in the constant pool.  */
+    tcg_out_insn(s, RIL, LGRL, ret, 0);
+    new_pool_label(s, sval, R_390_PC32DBL, s->code_ptr - 2, 2);
 }
 
 /* Emit a load/store type instruction.  Inputs are:

From 19b9fc2a39c733f585388918e4e093f08e2c33eb Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 18 Jan 2025 14:01:12 -0800
Subject: [PATCH 0495/2760] tcg/s390x: Add TCG_CT_CONST_N32

We were using S32 | U32 for add2/sub2.  But the ALGFI and SLGFI
insns that implement this both have uint32_t immediates.
This makes the composite range balanced and
enables use of -0xffffffff ... -0x80000001.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/s390x/tcg-target-con-set.h | 2 +-
 tcg/s390x/tcg-target-con-str.h | 1 +
 tcg/s390x/tcg-target.c.inc     | 8 ++++++--
 3 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/tcg/s390x/tcg-target-con-set.h b/tcg/s390x/tcg-target-con-set.h
index 78f06e3e52..f5d3878070 100644
--- a/tcg/s390x/tcg-target-con-set.h
+++ b/tcg/s390x/tcg-target-con-set.h
@@ -44,4 +44,4 @@ C_O2_I2(o, m, 0, r)
 C_O2_I2(o, m, r, r)
 C_O2_I3(o, m, 0, 1, r)
 C_N1_O1_I4(r, r, 0, 1, ri, r)
-C_N1_O1_I4(r, r, 0, 1, rJU, r)
+C_N1_O1_I4(r, r, 0, 1, rUV, r)
diff --git a/tcg/s390x/tcg-target-con-str.h b/tcg/s390x/tcg-target-con-str.h
index 3e574e0662..636a38a168 100644
--- a/tcg/s390x/tcg-target-con-str.h
+++ b/tcg/s390x/tcg-target-con-str.h
@@ -24,4 +24,5 @@ CONST('M', TCG_CT_CONST_M1)
 CONST('N', TCG_CT_CONST_INV)
 CONST('R', TCG_CT_CONST_INVRISBG)
 CONST('U', TCG_CT_CONST_U32)
+CONST('V', TCG_CT_CONST_N32)
 CONST('Z', TCG_CT_CONST_ZERO)
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index e262876614..9b28083945 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -43,6 +43,7 @@
 #define TCG_CT_CONST_INVRISBG   (1 << 14)
 #define TCG_CT_CONST_CMP        (1 << 15)
 #define TCG_CT_CONST_M1         (1 << 16)
+#define TCG_CT_CONST_N32        (1 << 17)
 
 #define ALL_GENERAL_REGS     MAKE_64BIT_MASK(0, 16)
 #define ALL_VECTOR_REGS      MAKE_64BIT_MASK(32, 32)
@@ -613,7 +614,10 @@ static bool tcg_target_const_match(int64_t val, int ct,
     if ((ct & TCG_CT_CONST_S32) && val == (int32_t)val) {
         return true;
     }
-    if ((ct & TCG_CT_CONST_U32) && val == (uint32_t)val) {
+    if ((ct & TCG_CT_CONST_U32) && uval <= UINT32_MAX) {
+        return true;
+    }
+    if ((ct & TCG_CT_CONST_N32) && -uval <= UINT32_MAX) {
         return true;
     }
     if ((ct & TCG_CT_CONST_S16) && val == (int16_t)val) {
@@ -3548,7 +3552,7 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 
     case INDEX_op_add2_i64:
     case INDEX_op_sub2_i64:
-        return C_N1_O1_I4(r, r, 0, 1, rJU, r);
+        return C_N1_O1_I4(r, r, 0, 1, rUV, r);
 
     case INDEX_op_st_vec:
         return C_O0_I2(v, r);

From cda7f93fa2fbf52e0fc70e4078caf8e7f7d3bd6f Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sun, 19 Jan 2025 09:31:26 -0800
Subject: [PATCH 0496/2760] tcg/s390x: Implement add/sub carry opcodes

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/s390x/tcg-target-con-set.h |   4 +-
 tcg/s390x/tcg-target-has.h     |   8 +-
 tcg/s390x/tcg-target.c.inc     | 153 +++++++++++++++++++--------------
 3 files changed, 96 insertions(+), 69 deletions(-)

diff --git a/tcg/s390x/tcg-target-con-set.h b/tcg/s390x/tcg-target-con-set.h
index f5d3878070..f67fd7898e 100644
--- a/tcg/s390x/tcg-target-con-set.h
+++ b/tcg/s390x/tcg-target-con-set.h
@@ -22,6 +22,7 @@ C_O1_I1(r, r)
 C_O1_I1(v, r)
 C_O1_I1(v, v)
 C_O1_I1(v, vr)
+C_O1_I2(r, 0, r)
 C_O1_I2(r, 0, ri)
 C_O1_I2(r, 0, rI)
 C_O1_I2(r, 0, rJ)
@@ -32,6 +33,7 @@ C_O1_I2(r, r, rI)
 C_O1_I2(r, r, rJ)
 C_O1_I2(r, r, rK)
 C_O1_I2(r, r, rNKR)
+C_O1_I2(r, r, rUV)
 C_O1_I2(r, rZ, r)
 C_O1_I2(v, v, r)
 C_O1_I2(v, v, v)
@@ -43,5 +45,3 @@ C_O2_I1(o, m, r)
 C_O2_I2(o, m, 0, r)
 C_O2_I2(o, m, r, r)
 C_O2_I3(o, m, 0, 1, r)
-C_N1_O1_I4(r, r, 0, 1, ri, r)
-C_N1_O1_I4(r, r, 0, 1, rUV, r)
diff --git a/tcg/s390x/tcg-target-has.h b/tcg/s390x/tcg-target-has.h
index 4a2b71995d..17e61130cd 100644
--- a/tcg/s390x/tcg-target-has.h
+++ b/tcg/s390x/tcg-target-has.h
@@ -29,13 +29,13 @@ extern uint64_t s390_facilities[3];
     ((s390_facilities[FACILITY_##X / 64] >> (63 - FACILITY_##X % 64)) & 1)
 
 /* optional instructions */
-#define TCG_TARGET_HAS_add2_i32       1
-#define TCG_TARGET_HAS_sub2_i32       1
+#define TCG_TARGET_HAS_add2_i32       0
+#define TCG_TARGET_HAS_sub2_i32       0
 #define TCG_TARGET_HAS_extr_i64_i32   0
 #define TCG_TARGET_HAS_qemu_st8_i32   0
 
-#define TCG_TARGET_HAS_add2_i64       1
-#define TCG_TARGET_HAS_sub2_i64       1
+#define TCG_TARGET_HAS_add2_i64       0
+#define TCG_TARGET_HAS_sub2_i64       0
 
 #define TCG_TARGET_HAS_qemu_ldst_i128 1
 
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index 9b28083945..67179de848 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -173,6 +173,8 @@ typedef enum S390Opcode {
     RRE_SLBGR   = 0xb989,
     RRE_XGR     = 0xb982,
 
+    RRFa_ALRK   = 0xb9fa,
+    RRFa_ALGRK  = 0xb9ea,
     RRFa_MGRK   = 0xb9ec,
     RRFa_MSRKC  = 0xb9fd,
     RRFa_MSGRKC = 0xb9ed,
@@ -2259,21 +2261,60 @@ static const TCGOutOpBinary outop_add = {
     .out_rri = tgen_addi,
 };
 
+static void tgen_addco_rrr(TCGContext *s, TCGType type,
+                           TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    if (type != TCG_TYPE_I32) {
+        tcg_out_insn(s, RRFa, ALGRK, a0, a1, a2);
+    } else if (a0 == a1) {
+        tcg_out_insn(s, RR, ALR, a0, a2);
+    } else {
+        tcg_out_insn(s, RRFa, ALRK, a0, a1, a2);
+    }
+}
+
+static void tgen_addco_rri(TCGContext *s, TCGType type,
+                           TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    tcg_out_mov(s, type, a0, a1);
+    if (type == TCG_TYPE_I32) {
+        tcg_out_insn(s, RIL, ALFI, a0, a2);
+    } else if (a2 >= 0) {
+        tcg_out_insn(s, RIL, ALGFI, a0, a2);
+    } else {
+        tcg_out_insn(s, RIL, SLGFI, a0, -a2);
+    }
+}
+
 static const TCGOutOpBinary outop_addco = {
-    .base.static_constraint = C_NotImplemented,
+    .base.static_constraint = C_O1_I2(r, r, rUV),
+    .out_rrr = tgen_addco_rrr,
+    .out_rri = tgen_addco_rri,
+};
+
+static void tgen_addcio(TCGContext *s, TCGType type,
+                        TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    if (type == TCG_TYPE_I32) {
+        tcg_out_insn(s, RRE, ALCR, a0, a2);
+    } else {
+        tcg_out_insn(s, RRE, ALCGR, a0, a2);
+    }
+}
+
+static const TCGOutOpBinary outop_addcio = {
+    .base.static_constraint = C_O1_I2(r, 0, r),
+    .out_rrr = tgen_addcio,
 };
 
 static const TCGOutOpAddSubCarry outop_addci = {
-    .base.static_constraint = C_NotImplemented,
-};
-
-static const TCGOutOpBinary outop_addcio = {
-    .base.static_constraint = C_NotImplemented,
+    .base.static_constraint = C_O1_I2(r, 0, r),
+    .out_rrr = tgen_addcio,
 };
 
 static void tcg_out_set_carry(TCGContext *s)
 {
-    g_assert_not_reached();
+    tcg_out_insn(s, RR, SLR, TCG_REG_R0, TCG_REG_R0); /* cc = 2 */
 }
 
 static void tgen_and(TCGContext *s, TCGType type,
@@ -2794,21 +2835,57 @@ static const TCGOutOpSubtract outop_sub = {
     .out_rrr = tgen_sub,
 };
 
+static void tgen_subbo_rrr(TCGContext *s, TCGType type,
+                           TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    if (type != TCG_TYPE_I32) {
+        tcg_out_insn(s, RRFa, SLGRK, a0, a1, a2);
+    } else if (a0 == a1) {
+        tcg_out_insn(s, RR, SLR, a0, a2);
+    } else {
+        tcg_out_insn(s, RRFa, SLRK, a0, a1, a2);
+    }
+}
+
+static void tgen_subbo_rri(TCGContext *s, TCGType type,
+                           TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    tcg_out_mov(s, type, a0, a1);
+    if (type == TCG_TYPE_I32) {
+        tcg_out_insn(s, RIL, SLFI, a0, a2);
+    } else if (a2 >= 0) {
+        tcg_out_insn(s, RIL, SLGFI, a0, a2);
+    } else {
+        tcg_out_insn(s, RIL, ALGFI, a0, -a2);
+    }
+}
+
 static const TCGOutOpAddSubCarry outop_subbo = {
-    .base.static_constraint = C_NotImplemented,
+    .base.static_constraint = C_O1_I2(r, r, rUV),
+    .out_rrr = tgen_subbo_rrr,
+    .out_rri = tgen_subbo_rri,
 };
 
-static const TCGOutOpAddSubCarry outop_subbi = {
-    .base.static_constraint = C_NotImplemented,
-};
+static void tgen_subbio(TCGContext *s, TCGType type,
+                        TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    if (type == TCG_TYPE_I32) {
+        tcg_out_insn(s, RRE, SLBR, a0, a2);
+    } else {
+        tcg_out_insn(s, RRE, SLBGR, a0, a2);
+    }
+}
 
 static const TCGOutOpAddSubCarry outop_subbio = {
-    .base.static_constraint = C_NotImplemented,
+    .base.static_constraint = C_O1_I2(r, 0, r),
+    .out_rrr = tgen_subbio,
 };
 
+#define outop_subbi  outop_subbio
+
 static void tcg_out_set_borrow(TCGContext *s)
 {
-    g_assert_not_reached();
+    tcg_out_insn(s, RR, CLR, TCG_REG_R0, TCG_REG_R0); /* cc = 0 */
 }
 
 static void tgen_xor(TCGContext *s, TCGType type,
@@ -2967,23 +3044,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_st(s, TCG_TYPE_I32, args[0], args[1], args[2]);
         break;
 
-    case INDEX_op_add2_i32:
-        if (const_args[4]) {
-            tcg_out_insn(s, RIL, ALFI, args[0], args[4]);
-        } else {
-            tcg_out_insn(s, RR, ALR, args[0], args[4]);
-        }
-        tcg_out_insn(s, RRE, ALCR, args[1], args[5]);
-        break;
-    case INDEX_op_sub2_i32:
-        if (const_args[4]) {
-            tcg_out_insn(s, RIL, SLFI, args[0], args[4]);
-        } else {
-            tcg_out_insn(s, RR, SLR, args[0], args[4]);
-        }
-        tcg_out_insn(s, RRE, SLBR, args[1], args[5]);
-        break;
-
     case INDEX_op_br:
         tgen_branch(s, S390_CC_ALWAYS, arg_label(args[0]));
         break;
@@ -3027,31 +3087,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_st(s, TCG_TYPE_I64, args[0], args[1], args[2]);
         break;
 
-    case INDEX_op_add2_i64:
-        if (const_args[4]) {
-            if ((int64_t)args[4] >= 0) {
-                tcg_out_insn(s, RIL, ALGFI, args[0], args[4]);
-            } else {
-                tcg_out_insn(s, RIL, SLGFI, args[0], -args[4]);
-            }
-        } else {
-            tcg_out_insn(s, RRE, ALGR, args[0], args[4]);
-        }
-        tcg_out_insn(s, RRE, ALCGR, args[1], args[5]);
-        break;
-    case INDEX_op_sub2_i64:
-        if (const_args[4]) {
-            if ((int64_t)args[4] >= 0) {
-                tcg_out_insn(s, RIL, SLGFI, args[0], args[4]);
-            } else {
-                tcg_out_insn(s, RIL, ALGFI, args[0], -args[4]);
-            }
-        } else {
-            tcg_out_insn(s, RRE, SLGR, args[0], args[4]);
-        }
-        tcg_out_insn(s, RRE, SLBGR, args[1], args[5]);
-        break;
-
     case INDEX_op_mb:
         /* The host memory model is quite strong, we simply need to
            serialize the instruction stream.  */
@@ -3546,14 +3581,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_qemu_st_i128:
         return C_O0_I3(o, m, r);
 
-    case INDEX_op_add2_i32:
-    case INDEX_op_sub2_i32:
-        return C_N1_O1_I4(r, r, 0, 1, ri, r);
-
-    case INDEX_op_add2_i64:
-    case INDEX_op_sub2_i64:
-        return C_N1_O1_I4(r, r, 0, 1, rUV, r);
-
     case INDEX_op_st_vec:
         return C_O0_I2(v, r);
     case INDEX_op_ld_vec:

From 41dd55c79c0a1b1a4bf573821b81d97e6d4c159a Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sun, 19 Jan 2025 10:01:18 -0800
Subject: [PATCH 0497/2760] tcg/s390x: Use ADD LOGICAL WITH SIGNED IMMEDIATE

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/s390x/tcg-target.c.inc | 22 +++++++++++++++++++++-
 1 file changed, 21 insertions(+), 1 deletion(-)

diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index 67179de848..09c7ca5b44 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -135,6 +135,9 @@ typedef enum S390Opcode {
     RIEc_CLGIJ   = 0xec7d,
     RIEc_CLIJ    = 0xec7f,
 
+    RIEd_ALHSIK  = 0xecda,
+    RIEd_ALGHSIK = 0xecdb,
+
     RIEf_RISBG   = 0xec55,
 
     RIEg_LOCGHI  = 0xec46,
@@ -682,8 +685,16 @@ static void tcg_out_insn_RI(TCGContext *s, S390Opcode op, TCGReg r1, int i2)
     tcg_out32(s, (op << 16) | (r1 << 20) | (i2 & 0xffff));
 }
 
+static void tcg_out_insn_RIEd(TCGContext *s, S390Opcode op,
+                              TCGReg r1, TCGReg r3, int i2)
+{
+    tcg_out16(s, (op & 0xff00) | (r1 << 4) | r3);
+    tcg_out16(s, i2);
+    tcg_out16(s, op & 0xff);
+}
+
 static void tcg_out_insn_RIEg(TCGContext *s, S390Opcode op, TCGReg r1,
-                             int i2, int m3)
+                              int i2, int m3)
 {
     tcg_out16(s, (op & 0xff00) | (r1 << 4) | m3);
     tcg_out32(s, (i2 << 16) | (op & 0xff));
@@ -2276,6 +2287,15 @@ static void tgen_addco_rrr(TCGContext *s, TCGType type,
 static void tgen_addco_rri(TCGContext *s, TCGType type,
                            TCGReg a0, TCGReg a1, tcg_target_long a2)
 {
+    if (a2 == (int16_t)a2) {
+        if (type == TCG_TYPE_I32) {
+            tcg_out_insn(s, RIEd, ALHSIK, a0, a1, a2);
+        } else {
+            tcg_out_insn(s, RIEd, ALGHSIK, a0, a1, a2);
+        }
+        return;
+    }
+
     tcg_out_mov(s, type, a0, a1);
     if (type == TCG_TYPE_I32) {
         tcg_out_insn(s, RIL, ALFI, a0, a2);

From 809069eaa3d803092adaa06cec770d78db44211d Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 20 Jan 2025 16:34:47 -0800
Subject: [PATCH 0498/2760] tcg/sparc64: Hoist tcg_cond_to_bcond lookup out of
 tcg_out_movcc
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Pass the sparc COND_* value not the tcg TCG_COND_* value.
This makes the usage within add2/sub2 clearer.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/sparc64/tcg-target.c.inc | 21 +++++++++++----------
 1 file changed, 11 insertions(+), 10 deletions(-)

diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index 12f0dbd23d..3f97261626 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -652,11 +652,10 @@ static void tcg_out_brcond_i32(TCGContext *s, TCGCond cond, TCGReg arg1,
     tcg_out_nop(s);
 }
 
-static void tcg_out_movcc(TCGContext *s, TCGCond cond, int cc, TCGReg ret,
+static void tcg_out_movcc(TCGContext *s, int scond, int cc, TCGReg ret,
                           int32_t v1, int v1const)
 {
-    tcg_out32(s, ARITH_MOVCC | cc | INSN_RD(ret)
-              | INSN_RS1(tcg_cond_to_bcond[cond])
+    tcg_out32(s, ARITH_MOVCC | cc | INSN_RD(ret) | INSN_RS1(scond)
               | (v1const ? INSN_IMM11(v1) : INSN_RS2(v1)));
 }
 
@@ -665,7 +664,7 @@ static void tcg_out_movcond_i32(TCGContext *s, TCGCond cond, TCGReg ret,
                                 int32_t v1, int v1const)
 {
     tcg_out_cmp(s, cond, c1, c2, c2const);
-    tcg_out_movcc(s, cond, MOVCC_ICC, ret, v1, v1const);
+    tcg_out_movcc(s, tcg_cond_to_bcond[cond], MOVCC_ICC, ret, v1, v1const);
 }
 
 static void tcg_out_brcond_i64(TCGContext *s, TCGCond cond, TCGReg arg1,
@@ -709,7 +708,7 @@ static void tcg_out_movcond_i64(TCGContext *s, TCGCond cond, TCGReg ret,
         tcg_out_movr(s, rcond, ret, c1, v1, v1const);
     } else {
         tcg_out_cmp(s, cond, c1, c2, c2const);
-        tcg_out_movcc(s, cond, MOVCC_XCC, ret, v1, v1const);
+        tcg_out_movcc(s, tcg_cond_to_bcond[cond], MOVCC_XCC, ret, v1, v1const);
     }
 }
 
@@ -763,7 +762,8 @@ static void tcg_out_setcond_i32(TCGContext *s, TCGCond cond, TCGReg ret,
     default:
         tcg_out_cmp(s, cond, c1, c2, c2const);
         tcg_out_movi_s13(s, ret, 0);
-        tcg_out_movcc(s, cond, MOVCC_ICC, ret, neg ? -1 : 1, 1);
+        tcg_out_movcc(s, tcg_cond_to_bcond[cond],
+                      MOVCC_ICC, ret, neg ? -1 : 1, 1);
         return;
     }
 
@@ -818,7 +818,8 @@ static void tcg_out_setcond_i64(TCGContext *s, TCGCond cond, TCGReg ret,
     } else {
         tcg_out_cmp(s, cond, c1, c2, c2const);
         tcg_out_movi_s13(s, ret, 0);
-        tcg_out_movcc(s, cond, MOVCC_XCC, ret, neg ? -1 : 1, 1);
+        tcg_out_movcc(s, tcg_cond_to_bcond[cond],
+                      MOVCC_XCC, ret, neg ? -1 : 1, 1);
     }
 }
 
@@ -956,10 +957,10 @@ static void tcg_out_addsub2_i64(TCGContext *s, TCGReg rl, TCGReg rh,
 	if (rh == ah) {
             tcg_out_arithi(s, TCG_REG_T2, ah, 1,
 			   is_sub ? ARITH_SUB : ARITH_ADD);
-            tcg_out_movcc(s, TCG_COND_LTU, MOVCC_XCC, rh, TCG_REG_T2, 0);
+            tcg_out_movcc(s, COND_CS, MOVCC_XCC, rh, TCG_REG_T2, 0);
 	} else {
             tcg_out_arithi(s, rh, ah, 1, is_sub ? ARITH_SUB : ARITH_ADD);
-	    tcg_out_movcc(s, TCG_COND_GEU, MOVCC_XCC, rh, ah, 0);
+            tcg_out_movcc(s, COND_CC, MOVCC_XCC, rh, ah, 0);
 	}
     } else {
         /*
@@ -974,7 +975,7 @@ static void tcg_out_addsub2_i64(TCGContext *s, TCGReg rl, TCGReg rh,
                            is_sub ? ARITH_SUB : ARITH_ADD);
         }
         /* ... smoosh T2 back to original BH if carry is clear ... */
-        tcg_out_movcc(s, TCG_COND_GEU, MOVCC_XCC, TCG_REG_T2, bh, bhconst);
+        tcg_out_movcc(s, COND_CC, MOVCC_XCC, TCG_REG_T2, bh, bhconst);
 	/* ... and finally perform the arithmetic with the new operand.  */
         tcg_out_arith(s, rh, ah, TCG_REG_T2, is_sub ? ARITH_SUB : ARITH_ADD);
     }

From 9dd1ea33b238d8b661b7541ebdb122b7cae6fd19 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 20 Jan 2025 18:48:06 -0800
Subject: [PATCH 0499/2760] tcg/sparc64: Implement add/sub carry opcodes

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/sparc64/tcg-target-con-set.h |   3 +-
 tcg/sparc64/tcg-target-has.h     |   8 +-
 tcg/sparc64/tcg-target.c.inc     | 300 ++++++++++++++++++++-----------
 3 files changed, 201 insertions(+), 110 deletions(-)

diff --git a/tcg/sparc64/tcg-target-con-set.h b/tcg/sparc64/tcg-target-con-set.h
index 8cec396173..1a57adc0e8 100644
--- a/tcg/sparc64/tcg-target-con-set.h
+++ b/tcg/sparc64/tcg-target-con-set.h
@@ -15,6 +15,7 @@ C_O0_I2(r, rJ)
 C_O1_I1(r, r)
 C_O1_I2(r, r, r)
 C_O1_I2(r, r, rJ)
+C_O1_I2(r, rz, rJ)
+C_O1_I2(r, rz, rz)
 C_O1_I4(r, r, rJ, rI, 0)
 C_O2_I2(r, r, r, r)
-C_O2_I4(r, r, rz, rz, rJ, rJ)
diff --git a/tcg/sparc64/tcg-target-has.h b/tcg/sparc64/tcg-target-has.h
index b8760dd154..caf7679595 100644
--- a/tcg/sparc64/tcg-target-has.h
+++ b/tcg/sparc64/tcg-target-has.h
@@ -14,13 +14,13 @@ extern bool use_vis3_instructions;
 #endif
 
 /* optional instructions */
-#define TCG_TARGET_HAS_add2_i32         1
-#define TCG_TARGET_HAS_sub2_i32         1
+#define TCG_TARGET_HAS_add2_i32         0
+#define TCG_TARGET_HAS_sub2_i32         0
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
 #define TCG_TARGET_HAS_extr_i64_i32     0
-#define TCG_TARGET_HAS_add2_i64         1
-#define TCG_TARGET_HAS_sub2_i64         1
+#define TCG_TARGET_HAS_add2_i64         0
+#define TCG_TARGET_HAS_sub2_i64         0
 
 #define TCG_TARGET_HAS_qemu_ldst_i128   0
 
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index 3f97261626..c2251a6927 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -199,7 +199,9 @@ static TCGReg tcg_target_call_oarg_reg(TCGCallReturnKind kind, int slot)
 #define ARITH_SUB  (INSN_OP(2) | INSN_OP3(0x04))
 #define ARITH_SUBCC (INSN_OP(2) | INSN_OP3(0x14))
 #define ARITH_ADDC (INSN_OP(2) | INSN_OP3(0x08))
+#define ARITH_ADDCCC (INSN_OP(2) | INSN_OP3(0x18))
 #define ARITH_SUBC (INSN_OP(2) | INSN_OP3(0x0c))
+#define ARITH_SUBCCC (INSN_OP(2) | INSN_OP3(0x1c))
 #define ARITH_UMUL (INSN_OP(2) | INSN_OP3(0x0a))
 #define ARITH_SMUL (INSN_OP(2) | INSN_OP3(0x0b))
 #define ARITH_UDIV (INSN_OP(2) | INSN_OP3(0x0e))
@@ -211,6 +213,7 @@ static TCGReg tcg_target_call_oarg_reg(TCGCallReturnKind kind, int slot)
 #define ARITH_MOVR (INSN_OP(2) | INSN_OP3(0x2f))
 
 #define ARITH_ADDXC (INSN_OP(2) | INSN_OP3(0x36) | INSN_OPF(0x11))
+#define ARITH_ADDXCCC (INSN_OP(2) | INSN_OP3(0x36) | INSN_OPF(0x13))
 #define ARITH_UMULXHI (INSN_OP(2) | INSN_OP3(0x36) | INSN_OPF(0x16))
 
 #define SHIFT_SLL  (INSN_OP(2) | INSN_OP3(0x25))
@@ -223,6 +226,7 @@ static TCGReg tcg_target_call_oarg_reg(TCGCallReturnKind kind, int slot)
 
 #define RDY        (INSN_OP(2) | INSN_OP3(0x28) | INSN_RS1(0))
 #define WRY        (INSN_OP(2) | INSN_OP3(0x30) | INSN_RD(0))
+#define WRCCR      (INSN_OP(2) | INSN_OP3(0x30) | INSN_RD(2))
 #define JMPL       (INSN_OP(2) | INSN_OP3(0x38))
 #define RETURN     (INSN_OP(2) | INSN_OP3(0x39))
 #define SAVE       (INSN_OP(2) | INSN_OP3(0x3c))
@@ -366,7 +370,7 @@ static void tcg_out_arithi(TCGContext *s, TCGReg rd, TCGReg rs1,
 }
 
 static void tcg_out_arithc(TCGContext *s, TCGReg rd, TCGReg rs1,
-			   int32_t val2, int val2const, int op)
+                           int32_t val2, int val2const, int op)
 {
     tcg_out32(s, op | INSN_RD(rd) | INSN_RS1(rs1)
               | (val2const ? INSN_IMM13(val2) : INSN_RS2(val2)));
@@ -733,7 +737,7 @@ static void tcg_out_setcond_i32(TCGContext *s, TCGCond cond, TCGReg ret,
         }
         c1 = TCG_REG_G0, c2const = 0;
         cond = (cond == TCG_COND_EQ ? TCG_COND_GEU : TCG_COND_LTU);
-	break;
+        break;
 
     case TCG_COND_TSTEQ:
     case TCG_COND_TSTNE:
@@ -742,7 +746,7 @@ static void tcg_out_setcond_i32(TCGContext *s, TCGCond cond, TCGReg ret,
         c1 = TCG_REG_G0;
         c2 = TCG_REG_T1, c2const = 0;
         cond = (cond == TCG_COND_TSTEQ ? TCG_COND_GEU : TCG_COND_LTU);
-	break;
+        break;
 
     case TCG_COND_GTU:
     case TCG_COND_LEU:
@@ -915,74 +919,6 @@ static const TCGOutOpMovcond outop_movcond = {
     .out = tgen_movcond,
 };
 
-static void tcg_out_addsub2_i32(TCGContext *s, TCGReg rl, TCGReg rh,
-                                TCGReg al, TCGReg ah, int32_t bl, int blconst,
-                                int32_t bh, int bhconst, int opl, int oph)
-{
-    TCGReg tmp = TCG_REG_T1;
-
-    /* Note that the low parts are fully consumed before tmp is set.  */
-    if (rl != ah && (bhconst || rl != bh)) {
-        tmp = rl;
-    }
-
-    tcg_out_arithc(s, tmp, al, bl, blconst, opl);
-    tcg_out_arithc(s, rh, ah, bh, bhconst, oph);
-    tcg_out_mov(s, TCG_TYPE_I32, rl, tmp);
-}
-
-static void tcg_out_addsub2_i64(TCGContext *s, TCGReg rl, TCGReg rh,
-                                TCGReg al, TCGReg ah, int32_t bl, int blconst,
-                                int32_t bh, int bhconst, bool is_sub)
-{
-    TCGReg tmp = TCG_REG_T1;
-
-    /* Note that the low parts are fully consumed before tmp is set.  */
-    if (rl != ah && (bhconst || rl != bh)) {
-        tmp = rl;
-    }
-
-    tcg_out_arithc(s, tmp, al, bl, blconst, is_sub ? ARITH_SUBCC : ARITH_ADDCC);
-
-    if (use_vis3_instructions && !is_sub) {
-        /* Note that ADDXC doesn't accept immediates.  */
-        if (bhconst && bh != 0) {
-           tcg_out_movi_s13(s, TCG_REG_T2, bh);
-           bh = TCG_REG_T2;
-        }
-        tcg_out_arith(s, rh, ah, bh, ARITH_ADDXC);
-    } else if (bh == TCG_REG_G0) {
-	/* If we have a zero, we can perform the operation in two insns,
-           with the arithmetic first, and a conditional move into place.  */
-	if (rh == ah) {
-            tcg_out_arithi(s, TCG_REG_T2, ah, 1,
-			   is_sub ? ARITH_SUB : ARITH_ADD);
-            tcg_out_movcc(s, COND_CS, MOVCC_XCC, rh, TCG_REG_T2, 0);
-	} else {
-            tcg_out_arithi(s, rh, ah, 1, is_sub ? ARITH_SUB : ARITH_ADD);
-            tcg_out_movcc(s, COND_CC, MOVCC_XCC, rh, ah, 0);
-	}
-    } else {
-        /*
-         * Otherwise adjust BH as if there is carry into T2.
-         * Note that constant BH is constrained to 11 bits for the MOVCC,
-         * so the adjustment fits 12 bits.
-         */
-        if (bhconst) {
-            tcg_out_movi_s13(s, TCG_REG_T2, bh + (is_sub ? -1 : 1));
-        } else {
-            tcg_out_arithi(s, TCG_REG_T2, bh, 1,
-                           is_sub ? ARITH_SUB : ARITH_ADD);
-        }
-        /* ... smoosh T2 back to original BH if carry is clear ... */
-        tcg_out_movcc(s, COND_CC, MOVCC_XCC, TCG_REG_T2, bh, bhconst);
-	/* ... and finally perform the arithmetic with the new operand.  */
-        tcg_out_arith(s, rh, ah, TCG_REG_T2, is_sub ? ARITH_SUB : ARITH_ADD);
-    }
-
-    tcg_out_mov(s, TCG_TYPE_I64, rl, tmp);
-}
-
 static void tcg_out_jmpl_const(TCGContext *s, const tcg_insn_unit *dest,
                                bool in_prologue, bool tail_call)
 {
@@ -1382,21 +1318,132 @@ static const TCGOutOpBinary outop_add = {
     .out_rri = tgen_addi,
 };
 
+static void tgen_addco_rrr(TCGContext *s, TCGType type,
+                           TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_arith(s, a0, a1, a2, ARITH_ADDCC);
+}
+
+static void tgen_addco_rri(TCGContext *s, TCGType type,
+                           TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    tcg_out_arithi(s, a0, a1, a2, ARITH_ADDCC);
+}
+
 static const TCGOutOpBinary outop_addco = {
-    .base.static_constraint = C_NotImplemented,
+    .base.static_constraint = C_O1_I2(r, r, rJ),
+    .out_rrr = tgen_addco_rrr,
+    .out_rri = tgen_addco_rri,
 };
 
+static void tgen_addci_rrr(TCGContext *s, TCGType type,
+                           TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    if (type == TCG_TYPE_I32) {
+        tcg_out_arith(s, a0, a1, a2, ARITH_ADDC);
+    } else if (use_vis3_instructions) {
+        tcg_out_arith(s, a0, a1, a2, ARITH_ADDXC);
+    } else {
+        tcg_out_arith(s, TCG_REG_T1, a1, a2, ARITH_ADD);  /* for CC */
+        tcg_out_arithi(s, a0, TCG_REG_T1, 1, ARITH_ADD);  /* for CS */
+        /* Select the correct result based on actual carry value. */
+        tcg_out_movcc(s, COND_CC, MOVCC_XCC, a0, TCG_REG_T1, false);
+    }
+}
+
+static void tgen_addci_rri(TCGContext *s, TCGType type,
+                           TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    if (type == TCG_TYPE_I32) {
+        tcg_out_arithi(s, a0, a1, a2, ARITH_ADDC);
+        return;
+    }
+    /* !use_vis3_instructions */
+    if (a2 != 0) {
+        tcg_out_arithi(s, TCG_REG_T1, a1, a2, ARITH_ADD); /* for CC */
+        tcg_out_arithi(s, a0, TCG_REG_T1, 1, ARITH_ADD);  /* for CS */
+        tcg_out_movcc(s, COND_CC, MOVCC_XCC, a0, TCG_REG_T1, false);
+    } else if (a0 == a1) {
+        tcg_out_arithi(s, TCG_REG_T1, a1, 1, ARITH_ADD);
+        tcg_out_movcc(s, COND_CS, MOVCC_XCC, a0, TCG_REG_T1, false);
+    } else {
+        tcg_out_arithi(s, a0, a1, 1, ARITH_ADD);
+        tcg_out_movcc(s, COND_CC, MOVCC_XCC, a0, a1, false);
+    }
+}
+
+static TCGConstraintSetIndex cset_addci(TCGType type, unsigned flags)
+{
+    if (use_vis3_instructions && type == TCG_TYPE_I64) {
+        /* Note that ADDXC doesn't accept immediates.  */
+        return C_O1_I2(r, rz, rz);
+    }
+    return C_O1_I2(r, rz, rJ);
+}
+
 static const TCGOutOpAddSubCarry outop_addci = {
-    .base.static_constraint = C_NotImplemented,
+    .base.static_constraint = C_Dynamic,
+    .base.dynamic_constraint = cset_addci,
+    .out_rrr = tgen_addci_rrr,
+    .out_rri = tgen_addci_rri,
 };
 
+/* Copy %xcc.c to %icc.c */
+static void tcg_out_dup_xcc_c(TCGContext *s)
+{
+    if (use_vis3_instructions) {
+        tcg_out_arith(s, TCG_REG_T1, TCG_REG_G0, TCG_REG_G0, ARITH_ADDXC);
+    } else {
+        tcg_out_movi_s13(s, TCG_REG_T1, 0);
+        tcg_out_movcc(s, COND_CS, MOVCC_XCC, TCG_REG_T1, 1, true);
+    }
+    /* Write carry-in into %icc via {0,1} + -1. */
+    tcg_out_arithi(s, TCG_REG_G0, TCG_REG_T1, -1, ARITH_ADDCC);
+}
+
+static void tgen_addcio_rrr(TCGContext *s, TCGType type,
+                            TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    if (type != TCG_TYPE_I32) {
+        if (use_vis3_instructions) {
+            tcg_out_arith(s, a0, a1, a2, ARITH_ADDXCCC);
+            return;
+        }
+        tcg_out_dup_xcc_c(s);
+    }
+    tcg_out_arith(s, a0, a1, a2, ARITH_ADDCCC);
+}
+
+static void tgen_addcio_rri(TCGContext *s, TCGType type,
+                            TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    if (type != TCG_TYPE_I32) {
+        /* !use_vis3_instructions */
+        tcg_out_dup_xcc_c(s);
+    }
+    tcg_out_arithi(s, a0, a1, a2, ARITH_ADDCCC);
+}
+
+static TCGConstraintSetIndex cset_addcio(TCGType type, unsigned flags)
+{
+    if (use_vis3_instructions && type == TCG_TYPE_I64) {
+        /* Note that ADDXCCC doesn't accept immediates.  */
+        return C_O1_I2(r, rz, rz);
+    }
+    return C_O1_I2(r, rz, rJ);
+}
+
 static const TCGOutOpBinary outop_addcio = {
-    .base.static_constraint = C_NotImplemented,
+    .base.static_constraint = C_Dynamic,
+    .base.dynamic_constraint = cset_addcio,
+    .out_rrr = tgen_addcio_rrr,
+    .out_rri = tgen_addcio_rri,
 };
 
 static void tcg_out_set_carry(TCGContext *s)
 {
-    g_assert_not_reached();
+    /* 0x11 -> xcc = nzvC, icc = nzvC */
+    tcg_out_arithi(s, 0, TCG_REG_G0, 0x11, WRCCR);
 }
 
 static void tgen_and(TCGContext *s, TCGType type,
@@ -1735,21 +1782,90 @@ static const TCGOutOpSubtract outop_sub = {
     .out_rrr = tgen_sub,
 };
 
+static void tgen_subbo_rrr(TCGContext *s, TCGType type,
+                           TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_arith(s, a0, a1, a2, ARITH_SUBCC);
+}
+
+static void tgen_subbo_rri(TCGContext *s, TCGType type,
+                           TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    tcg_out_arithi(s, a0, a1, a2, ARITH_SUBCC);
+}
+
 static const TCGOutOpAddSubCarry outop_subbo = {
-    .base.static_constraint = C_NotImplemented,
+    .base.static_constraint = C_O1_I2(r, rz, rJ),
+    .out_rrr = tgen_subbo_rrr,
+    .out_rri = tgen_subbo_rri,
 };
 
+static void tgen_subbi_rrr(TCGContext *s, TCGType type,
+                           TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    /* TODO: OSA 2015 added SUBXC */
+    if (type == TCG_TYPE_I32) {
+        tcg_out_arith(s, a0, a1, a2, ARITH_SUBC);
+    } else {
+        tcg_out_arith(s, TCG_REG_T1, a1, a2, ARITH_SUB);  /* for CC */
+        tcg_out_arithi(s, a0, TCG_REG_T1, 1, ARITH_SUB);  /* for CS */
+        /* Select the correct result based on actual borrow value. */
+        tcg_out_movcc(s, COND_CC, MOVCC_XCC, a0, TCG_REG_T1, false);
+    }
+}
+
+static void tgen_subbi_rri(TCGContext *s, TCGType type,
+                           TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    if (type == TCG_TYPE_I32) {
+        tcg_out_arithi(s, a0, a1, a2, ARITH_SUBC);
+    } else if (a2 != 0) {
+        tcg_out_arithi(s, TCG_REG_T1, a1, a2, ARITH_SUB);  /* for CC */
+        tcg_out_arithi(s, a0, TCG_REG_T1, 1, ARITH_SUB);   /* for CS */
+        tcg_out_movcc(s, COND_CC, MOVCC_XCC, a0, TCG_REG_T1, false);
+    } else if (a0 == a1) {
+        tcg_out_arithi(s, TCG_REG_T1, a1, 1, ARITH_SUB);
+        tcg_out_movcc(s, COND_CS, MOVCC_XCC, a0, TCG_REG_T1, false);
+    } else {
+        tcg_out_arithi(s, a0, a1, 1, ARITH_SUB);
+        tcg_out_movcc(s, COND_CC, MOVCC_XCC, a0, a1, false);
+    }
+}
+
 static const TCGOutOpAddSubCarry outop_subbi = {
-    .base.static_constraint = C_NotImplemented,
+    .base.static_constraint = C_O1_I2(r, rz, rJ),
+    .out_rrr = tgen_subbi_rrr,
+    .out_rri = tgen_subbi_rri,
 };
 
+static void tgen_subbio_rrr(TCGContext *s, TCGType type,
+                            TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    if (type != TCG_TYPE_I32) {
+        /* TODO: OSA 2015 added SUBXCCC */
+        tcg_out_dup_xcc_c(s);
+    }
+    tcg_out_arith(s, a0, a1, a2, ARITH_SUBCCC);
+}
+
+static void tgen_subbio_rri(TCGContext *s, TCGType type,
+                            TCGReg a0, TCGReg a1, tcg_target_long a2)
+{
+    if (type != TCG_TYPE_I32) {
+        tcg_out_dup_xcc_c(s);
+    }
+    tcg_out_arithi(s, a0, a1, a2, ARITH_SUBCCC);
+}
+
 static const TCGOutOpAddSubCarry outop_subbio = {
-    .base.static_constraint = C_NotImplemented,
+    .base.static_constraint = C_O1_I2(r, rz, rJ),
+    .out_rrr = tgen_subbio_rrr,
+    .out_rri = tgen_subbio_rri,
 };
 
 static void tcg_out_set_borrow(TCGContext *s)
 {
-    g_assert_not_reached();
+    tcg_out_set_carry(s);  /* borrow == carry */
 }
 
 static void tgen_xor(TCGContext *s, TCGType type,
@@ -1886,17 +2002,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_ldst(s, a0, a1, a2, STW);
         break;
 
-    case INDEX_op_add2_i32:
-        tcg_out_addsub2_i32(s, args[0], args[1], args[2], args[3],
-                            args[4], const_args[4], args[5], const_args[5],
-                            ARITH_ADDCC, ARITH_ADDC);
-        break;
-    case INDEX_op_sub2_i32:
-        tcg_out_addsub2_i32(s, args[0], args[1], args[2], args[3],
-                            args[4], const_args[4], args[5], const_args[5],
-                            ARITH_SUBCC, ARITH_SUBC);
-        break;
-
     case INDEX_op_qemu_ld_i32:
         tcg_out_qemu_ld(s, a0, a1, a2, TCG_TYPE_I32);
         break;
@@ -1920,15 +2025,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_ldst(s, a0, a1, a2, STX);
         break;
 
-    case INDEX_op_add2_i64:
-        tcg_out_addsub2_i64(s, args[0], args[1], args[2], args[3], args[4],
-                            const_args[4], args[5], const_args[5], false);
-        break;
-    case INDEX_op_sub2_i64:
-        tcg_out_addsub2_i64(s, args[0], args[1], args[2], args[3], args[4],
-                            const_args[4], args[5], const_args[5], true);
-        break;
-
     case INDEX_op_mb:
         tcg_out_mb(s, a0);
         break;
@@ -1975,12 +2071,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_qemu_st_i64:
         return C_O0_I2(rz, r);
 
-    case INDEX_op_add2_i32:
-    case INDEX_op_add2_i64:
-    case INDEX_op_sub2_i32:
-    case INDEX_op_sub2_i64:
-        return C_O2_I4(r, r, rz, rz, rJ, rJ);
-
     default:
         return C_NotImplemented;
     }

From 4b0ee858be252ed272a758e5b6f894717e911d51 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 20 Jan 2025 19:46:04 -0800
Subject: [PATCH 0500/2760] tcg/tci: Implement add/sub carry opcodes

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tci.c                    | 120 +++++++++++++++++------------------
 tcg/tci/tcg-target-has.h     |   8 +--
 tcg/tci/tcg-target-opc.h.inc |   1 +
 tcg/tci/tcg-target.c.inc     |  97 +++++++++++++++++-----------
 4 files changed, 125 insertions(+), 101 deletions(-)

diff --git a/tcg/tci.c b/tcg/tci.c
index dc916eb112..a18478a07a 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -179,17 +179,6 @@ static void tci_args_rrrrrc(uint32_t insn, TCGReg *r0, TCGReg *r1,
     *c5 = extract32(insn, 28, 4);
 }
 
-static void tci_args_rrrrrr(uint32_t insn, TCGReg *r0, TCGReg *r1,
-                            TCGReg *r2, TCGReg *r3, TCGReg *r4, TCGReg *r5)
-{
-    *r0 = extract32(insn, 8, 4);
-    *r1 = extract32(insn, 12, 4);
-    *r2 = extract32(insn, 16, 4);
-    *r3 = extract32(insn, 20, 4);
-    *r4 = extract32(insn, 24, 4);
-    *r5 = extract32(insn, 28, 4);
-}
-
 static bool tci_compare32(uint32_t u0, uint32_t u1, TCGCond condition)
 {
     bool result = false;
@@ -361,6 +350,7 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
     tcg_target_ulong regs[TCG_TARGET_NB_REGS];
     uint64_t stack[(TCG_STATIC_CALL_ARGS_SIZE + TCG_STATIC_FRAME_SIZE)
                    / sizeof(uint64_t)];
+    bool carry = false;
 
     regs[TCG_AREG0] = (tcg_target_ulong)env;
     regs[TCG_REG_CALL_STACK] = (uintptr_t)stack;
@@ -369,13 +359,12 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
     for (;;) {
         uint32_t insn;
         TCGOpcode opc;
-        TCGReg r0, r1, r2, r3, r4, r5;
+        TCGReg r0, r1, r2, r3, r4;
         tcg_target_ulong t1;
         TCGCond condition;
         uint8_t pos, len;
         uint32_t tmp32;
         uint64_t tmp64, taddr;
-        uint64_t T1, T2;
         MemOpIdx oi;
         int32_t ofs;
         void *ptr;
@@ -444,9 +433,9 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
 #if TCG_TARGET_REG_BITS == 32
         case INDEX_op_setcond2_i32:
             tci_args_rrrrrc(insn, &r0, &r1, &r2, &r3, &r4, &condition);
-            T1 = tci_uint64(regs[r2], regs[r1]);
-            T2 = tci_uint64(regs[r4], regs[r3]);
-            regs[r0] = tci_compare64(T1, T2, condition);
+            regs[r0] = tci_compare64(tci_uint64(regs[r2], regs[r1]),
+                                     tci_uint64(regs[r4], regs[r3]),
+                                     condition);
             break;
 #elif TCG_TARGET_REG_BITS == 64
         case INDEX_op_setcond:
@@ -471,6 +460,9 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_args_rl(insn, tb_ptr, &r0, &ptr);
             regs[r0] = *(tcg_target_ulong *)ptr;
             break;
+        case INDEX_op_tci_setcarry:
+            carry = true;
+            break;
 
             /* Load/store operations (32 bit). */
 
@@ -575,6 +567,46 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_args_rr(insn, &r0, &r1);
             regs[r0] = ctpop_tr(regs[r1]);
             break;
+        case INDEX_op_addco:
+            tci_args_rrr(insn, &r0, &r1, &r2);
+            t1 = regs[r1] + regs[r2];
+            carry = t1 < regs[r1];
+            regs[r0] = t1;
+            break;
+        case INDEX_op_addci:
+            tci_args_rrr(insn, &r0, &r1, &r2);
+            regs[r0] = regs[r1] + regs[r2] + carry;
+            break;
+        case INDEX_op_addcio:
+            tci_args_rrr(insn, &r0, &r1, &r2);
+            if (carry) {
+                t1 = regs[r1] + regs[r2] + 1;
+                carry = t1 <= regs[r1];
+            } else {
+                t1 = regs[r1] + regs[r2];
+                carry = t1 < regs[r1];
+            }
+            regs[r0] = t1;
+            break;
+        case INDEX_op_subbo:
+            tci_args_rrr(insn, &r0, &r1, &r2);
+            carry = regs[r1] < regs[r2];
+            regs[r0] = regs[r1] - regs[r2];
+            break;
+        case INDEX_op_subbi:
+            tci_args_rrr(insn, &r0, &r1, &r2);
+            regs[r0] = regs[r1] - regs[r2] - carry;
+            break;
+        case INDEX_op_subbio:
+            tci_args_rrr(insn, &r0, &r1, &r2);
+            if (carry) {
+                carry = regs[r1] <= regs[r2];
+                regs[r0] = regs[r1] - regs[r2] - 1;
+            } else {
+                carry = regs[r1] < regs[r2];
+                regs[r0] = regs[r1] - regs[r2];
+            }
+            break;
         case INDEX_op_muls2:
             tci_args_rrrr(insn, &r0, &r1, &r2, &r3);
 #if TCG_TARGET_REG_BITS == 32
@@ -673,22 +705,6 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
                 tb_ptr = ptr;
             }
             break;
-#if TCG_TARGET_REG_BITS == 32 || TCG_TARGET_HAS_add2_i32
-        case INDEX_op_add2_i32:
-            tci_args_rrrrrr(insn, &r0, &r1, &r2, &r3, &r4, &r5);
-            T1 = tci_uint64(regs[r3], regs[r2]);
-            T2 = tci_uint64(regs[r5], regs[r4]);
-            tci_write_reg64(regs, r1, r0, T1 + T2);
-            break;
-#endif
-#if TCG_TARGET_REG_BITS == 32 || TCG_TARGET_HAS_sub2_i32
-        case INDEX_op_sub2_i32:
-            tci_args_rrrrrr(insn, &r0, &r1, &r2, &r3, &r4, &r5);
-            T1 = tci_uint64(regs[r3], regs[r2]);
-            T2 = tci_uint64(regs[r5], regs[r4]);
-            tci_write_reg64(regs, r1, r0, T1 - T2);
-            break;
-#endif
         case INDEX_op_bswap16:
             tci_args_rr(insn, &r0, &r1);
             regs[r0] = bswap16(regs[r1]);
@@ -742,24 +758,6 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tci_args_rrr(insn, &r0, &r1, &r2);
             regs[r0] = regs[r1] ? ctz64(regs[r1]) : regs[r2];
             break;
-#if TCG_TARGET_HAS_add2_i64
-        case INDEX_op_add2_i64:
-            tci_args_rrrrrr(insn, &r0, &r1, &r2, &r3, &r4, &r5);
-            T1 = regs[r2] + regs[r4];
-            T2 = regs[r3] + regs[r5] + (T1 < regs[r2]);
-            regs[r0] = T1;
-            regs[r1] = T2;
-            break;
-#endif
-#if TCG_TARGET_HAS_add2_i64
-        case INDEX_op_sub2_i64:
-            tci_args_rrrrrr(insn, &r0, &r1, &r2, &r3, &r4, &r5);
-            T1 = regs[r2] - regs[r4];
-            T2 = regs[r3] - regs[r5] - (regs[r2] < regs[r4]);
-            regs[r0] = T1;
-            regs[r1] = T2;
-            break;
-#endif
 
             /* Shift/rotate operations (64 bit). */
 
@@ -908,7 +906,7 @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
     const char *op_name;
     uint32_t insn;
     TCGOpcode op;
-    TCGReg r0, r1, r2, r3, r4, r5;
+    TCGReg r0, r1, r2, r3, r4;
     tcg_target_ulong i1;
     int32_t s2;
     TCGCond c;
@@ -968,6 +966,10 @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
                            op_name, str_r(r0), ptr);
         break;
 
+    case INDEX_op_tci_setcarry:
+        info->fprintf_func(info->stream, "%-12s", op_name);
+        break;
+
     case INDEX_op_ld8u_i32:
     case INDEX_op_ld8u_i64:
     case INDEX_op_ld8s_i32:
@@ -1007,6 +1009,9 @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
         break;
 
     case INDEX_op_add:
+    case INDEX_op_addci:
+    case INDEX_op_addcio:
+    case INDEX_op_addco:
     case INDEX_op_and:
     case INDEX_op_andc:
     case INDEX_op_clz:
@@ -1027,6 +1032,9 @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
     case INDEX_op_shl:
     case INDEX_op_shr:
     case INDEX_op_sub:
+    case INDEX_op_subbi:
+    case INDEX_op_subbio:
+    case INDEX_op_subbo:
     case INDEX_op_xor:
     case INDEX_op_tci_ctz32:
     case INDEX_op_tci_clz32:
@@ -1071,16 +1079,6 @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
                            str_r(r2), str_r(r3));
         break;
 
-    case INDEX_op_add2_i32:
-    case INDEX_op_add2_i64:
-    case INDEX_op_sub2_i32:
-    case INDEX_op_sub2_i64:
-        tci_args_rrrrrr(insn, &r0, &r1, &r2, &r3, &r4, &r5);
-        info->fprintf_func(info->stream, "%-12s  %s, %s, %s, %s, %s, %s",
-                           op_name, str_r(r0), str_r(r1), str_r(r2),
-                           str_r(r3), str_r(r4), str_r(r5));
-        break;
-
     case INDEX_op_qemu_ld_i64:
     case INDEX_op_qemu_st_i64:
         if (TCG_TARGET_REG_BITS == 32) {
diff --git a/tcg/tci/tcg-target-has.h b/tcg/tci/tcg-target-has.h
index 6063f32f7b..310d45ba62 100644
--- a/tcg/tci/tcg-target-has.h
+++ b/tcg/tci/tcg-target-has.h
@@ -8,13 +8,13 @@
 #define TCG_TARGET_HAS_H
 
 #define TCG_TARGET_HAS_qemu_st8_i32     0
-#define TCG_TARGET_HAS_add2_i32         1
-#define TCG_TARGET_HAS_sub2_i32         1
+#define TCG_TARGET_HAS_add2_i32         0
+#define TCG_TARGET_HAS_sub2_i32         0
 
 #if TCG_TARGET_REG_BITS == 64
 #define TCG_TARGET_HAS_extr_i64_i32     0
-#define TCG_TARGET_HAS_add2_i64         1
-#define TCG_TARGET_HAS_sub2_i64         1
+#define TCG_TARGET_HAS_add2_i64         0
+#define TCG_TARGET_HAS_sub2_i64         0
 #endif /* TCG_TARGET_REG_BITS == 64 */
 
 #define TCG_TARGET_HAS_qemu_ldst_i128   0
diff --git a/tcg/tci/tcg-target-opc.h.inc b/tcg/tci/tcg-target-opc.h.inc
index 672d9b7323..4eb32ed736 100644
--- a/tcg/tci/tcg-target-opc.h.inc
+++ b/tcg/tci/tcg-target-opc.h.inc
@@ -2,6 +2,7 @@
 /* These opcodes for use between the tci generator and interpreter. */
 DEF(tci_movi, 1, 0, 1, TCG_OPF_NOT_PRESENT)
 DEF(tci_movl, 1, 0, 1, TCG_OPF_NOT_PRESENT)
+DEF(tci_setcarry, 0, 0, 0, TCG_OPF_NOT_PRESENT)
 DEF(tci_clz32, 1, 2, 0, TCG_OPF_NOT_PRESENT)
 DEF(tci_ctz32, 1, 2, 0, TCG_OPF_NOT_PRESENT)
 DEF(tci_divs32, 1, 2, 0, TCG_OPF_NOT_PRESENT)
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index bba96d7a19..35c0c91f3e 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -66,12 +66,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i64:
         return C_O0_I2(r, r);
 
-    case INDEX_op_add2_i32:
-    case INDEX_op_add2_i64:
-    case INDEX_op_sub2_i32:
-    case INDEX_op_sub2_i64:
-        return C_O2_I4(r, r, r, r, r, r);
-
     case INDEX_op_qemu_ld_i32:
         return C_O1_I1(r, r);
     case INDEX_op_qemu_ld_i64:
@@ -346,22 +340,6 @@ static void tcg_out_op_rrrrrc(TCGContext *s, TCGOpcode op,
     tcg_out32(s, insn);
 }
 
-static void tcg_out_op_rrrrrr(TCGContext *s, TCGOpcode op,
-                              TCGReg r0, TCGReg r1, TCGReg r2,
-                              TCGReg r3, TCGReg r4, TCGReg r5)
-{
-    tcg_insn_unit insn = 0;
-
-    insn = deposit32(insn, 0, 8, op);
-    insn = deposit32(insn, 8, 4, r0);
-    insn = deposit32(insn, 12, 4, r1);
-    insn = deposit32(insn, 16, 4, r2);
-    insn = deposit32(insn, 20, 4, r3);
-    insn = deposit32(insn, 24, 4, r4);
-    insn = deposit32(insn, 28, 4, r5);
-    tcg_out32(s, insn);
-}
-
 static void tcg_out_ldst(TCGContext *s, TCGOpcode op, TCGReg val,
                          TCGReg base, intptr_t offset)
 {
@@ -573,21 +551,50 @@ static const TCGOutOpBinary outop_add = {
     .out_rrr = tgen_add,
 };
 
+static TCGConstraintSetIndex cset_addsubcarry(TCGType type, unsigned flags)
+{
+    return type == TCG_TYPE_REG ? C_O1_I2(r, r, r) : C_NotImplemented;
+}
+
+static void tgen_addco(TCGContext *s, TCGType type,
+                       TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_op_rrr(s, INDEX_op_addco, a0, a1, a2);
+}
+
 static const TCGOutOpBinary outop_addco = {
-    .base.static_constraint = C_NotImplemented,
+    .base.static_constraint = C_Dynamic,
+    .base.dynamic_constraint = cset_addsubcarry,
+    .out_rrr = tgen_addco,
 };
 
+static void tgen_addci(TCGContext *s, TCGType type,
+                       TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_op_rrr(s, INDEX_op_addci, a0, a1, a2);
+}
+
 static const TCGOutOpAddSubCarry outop_addci = {
-    .base.static_constraint = C_NotImplemented,
+    .base.static_constraint = C_Dynamic,
+    .base.dynamic_constraint = cset_addsubcarry,
+    .out_rrr = tgen_addci,
 };
 
+static void tgen_addcio(TCGContext *s, TCGType type,
+                        TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_op_rrr(s, INDEX_op_addcio, a0, a1, a2);
+}
+
 static const TCGOutOpBinary outop_addcio = {
-    .base.static_constraint = C_NotImplemented,
+    .base.static_constraint = C_Dynamic,
+    .base.dynamic_constraint = cset_addsubcarry,
+    .out_rrr = tgen_addcio,
 };
 
 static void tcg_out_set_carry(TCGContext *s)
 {
-    g_assert_not_reached();
+    tcg_out_op_v(s, INDEX_op_tci_setcarry);
 }
 
 static void tgen_and(TCGContext *s, TCGType type,
@@ -910,21 +917,45 @@ static const TCGOutOpSubtract outop_sub = {
     .out_rrr = tgen_sub,
 };
 
+static void tgen_subbo(TCGContext *s, TCGType type,
+                       TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_op_rrr(s, INDEX_op_subbo, a0, a1, a2);
+}
+
 static const TCGOutOpAddSubCarry outop_subbo = {
-    .base.static_constraint = C_NotImplemented,
+    .base.static_constraint = C_Dynamic,
+    .base.dynamic_constraint = cset_addsubcarry,
+    .out_rrr = tgen_subbo,
 };
 
+static void tgen_subbi(TCGContext *s, TCGType type,
+                       TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_op_rrr(s, INDEX_op_subbi, a0, a1, a2);
+}
+
 static const TCGOutOpAddSubCarry outop_subbi = {
-    .base.static_constraint = C_NotImplemented,
+    .base.static_constraint = C_Dynamic,
+    .base.dynamic_constraint = cset_addsubcarry,
+    .out_rrr = tgen_subbi,
 };
 
+static void tgen_subbio(TCGContext *s, TCGType type,
+                        TCGReg a0, TCGReg a1, TCGReg a2)
+{
+    tcg_out_op_rrr(s, INDEX_op_subbio, a0, a1, a2);
+}
+
 static const TCGOutOpAddSubCarry outop_subbio = {
-    .base.static_constraint = C_NotImplemented,
+    .base.static_constraint = C_Dynamic,
+    .base.dynamic_constraint = cset_addsubcarry,
+    .out_rrr = tgen_subbio,
 };
 
 static void tcg_out_set_borrow(TCGContext *s)
 {
-    g_assert_not_reached();
+    tcg_out_op_v(s, INDEX_op_tci_setcarry);  /* borrow == carry */
 }
 
 static void tgen_xor(TCGContext *s, TCGType type,
@@ -1129,12 +1160,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_ldst(s, opc, args[0], args[1], args[2]);
         break;
 
-    CASE_32_64(add2)
-    CASE_32_64(sub2)
-        tcg_out_op_rrrrrr(s, opc, args[0], args[1], args[2],
-                          args[3], args[4], args[5]);
-        break;
-
     case INDEX_op_qemu_ld_i64:
     case INDEX_op_qemu_st_i64:
         if (TCG_TARGET_REG_BITS == 32) {

From f2b1708e8080ab1beb0a2bf52a79a51e8de335cb Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 20 Jan 2025 20:15:31 -0800
Subject: [PATCH 0501/2760] tcg: Remove add2/sub2 opcodes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

All uses have been replaced by add/sub carry opcodes.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 docs/devel/tcg-ops.rst           | 14 ++---
 include/tcg/tcg-opc.h            |  5 --
 tcg/aarch64/tcg-target-has.h     |  5 --
 tcg/arm/tcg-target-has.h         |  4 --
 tcg/i386/tcg-target-has.h        |  5 --
 tcg/loongarch64/tcg-target-has.h |  4 --
 tcg/mips/tcg-target-has.h        |  5 --
 tcg/optimize.c                   | 87 --------------------------------
 tcg/ppc/tcg-target-has.h         |  4 --
 tcg/riscv/tcg-target-has.h       |  5 --
 tcg/s390x/tcg-target-has.h       |  7 ---
 tcg/sparc64/tcg-target-has.h     |  7 ---
 tcg/tcg-has.h                    |  2 -
 tcg/tcg-op.c                     | 26 ----------
 tcg/tcg.c                        | 36 -------------
 tcg/tci/tcg-target-has.h         |  4 --
 16 files changed, 3 insertions(+), 217 deletions(-)

diff --git a/docs/devel/tcg-ops.rst b/docs/devel/tcg-ops.rst
index 93bcc70639..a7147407de 100644
--- a/docs/devel/tcg-ops.rst
+++ b/docs/devel/tcg-ops.rst
@@ -654,14 +654,6 @@ Multiword arithmetic support
          code generator will use ``tcg_out_set_borrow`` and then
          the output routine for *subbio*.
 
-   * - add2_i32/i64 *t0_low*, *t0_high*, *t1_low*, *t1_high*, *t2_low*, *t2_high*
-
-       sub2_i32/i64 *t0_low*, *t0_high*, *t1_low*, *t1_high*, *t2_low*, *t2_high*
-
-     - | Similar to add/sub, except that the double-word inputs *t1* and *t2* are
-         formed from two single-word arguments, and the double-word output *t0*
-         is returned in two single-word outputs.
-
    * - mulu2 *t0_low*, *t0_high*, *t1*, *t2*
 
      - | Similar to mul, except two unsigned inputs *t1* and *t2* yielding the full
@@ -952,9 +944,9 @@ Assumptions
 The target word size (``TCG_TARGET_REG_BITS``) is expected to be 32 bit or
 64 bit. It is expected that the pointer has the same size as the word.
 
-On a 32 bit target, all 64 bit operations are converted to 32 bits. A
-few specific operations must be implemented to allow it (see add2_i32,
-sub2_i32, brcond2_i32).
+On a 32 bit target, all 64 bit operations are converted to 32 bits.
+A few specific operations must be implemented to allow it
+(see brcond2_i32, setcond2_i32).
 
 On a 64 bit target, the values are transferred between 32 and 64-bit
 registers using the following ops:
diff --git a/include/tcg/tcg-opc.h b/include/tcg/tcg-opc.h
index 9cc20cd62c..30ba15723a 100644
--- a/include/tcg/tcg-opc.h
+++ b/include/tcg/tcg-opc.h
@@ -102,8 +102,6 @@ DEF(st8_i32, 0, 2, 1, 0)
 DEF(st16_i32, 0, 2, 1, 0)
 DEF(st_i32, 0, 2, 1, 0)
 
-DEF(add2_i32, 2, 4, 0, 0)
-DEF(sub2_i32, 2, 4, 0, 0)
 DEF(brcond2_i32, 0, 4, 2, TCG_OPF_BB_END | TCG_OPF_COND_BRANCH)
 DEF(setcond2_i32, 1, 4, 1, 0)
 
@@ -126,9 +124,6 @@ DEF(extu_i32_i64, 1, 1, 0, 0)
 DEF(extrl_i64_i32, 1, 1, 0, 0)
 DEF(extrh_i64_i32, 1, 1, 0, 0)
 
-DEF(add2_i64, 2, 4, 0, 0)
-DEF(sub2_i64, 2, 4, 0, 0)
-
 #define DATA64_ARGS  (TCG_TARGET_REG_BITS == 64 ? 1 : 2)
 
 /* There are tcg_ctx->insn_start_words here, not just one. */
diff --git a/tcg/aarch64/tcg-target-has.h b/tcg/aarch64/tcg-target-has.h
index 695effd77c..b155e37639 100644
--- a/tcg/aarch64/tcg-target-has.h
+++ b/tcg/aarch64/tcg-target-has.h
@@ -13,14 +13,9 @@
 #define have_lse2   (cpuinfo & CPUINFO_LSE2)
 
 /* optional instructions */
-#define TCG_TARGET_HAS_add2_i32         0
-#define TCG_TARGET_HAS_sub2_i32         0
 #define TCG_TARGET_HAS_extr_i64_i32     0
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
-#define TCG_TARGET_HAS_add2_i64         0
-#define TCG_TARGET_HAS_sub2_i64         0
-
 /*
  * Without FEAT_LSE2, we must use LDXP+STXP to implement atomic 128-bit load,
  * which requires writable pages.  We must defer to the helper for user-only,
diff --git a/tcg/arm/tcg-target-has.h b/tcg/arm/tcg-target-has.h
index f4bd15c68a..187269e5bd 100644
--- a/tcg/arm/tcg-target-has.h
+++ b/tcg/arm/tcg-target-has.h
@@ -24,12 +24,8 @@ extern bool use_neon_instructions;
 #endif
 
 /* optional instructions */
-#define TCG_TARGET_HAS_add2_i32         0
-#define TCG_TARGET_HAS_sub2_i32         0
 #define TCG_TARGET_HAS_qemu_st8_i32     0
-
 #define TCG_TARGET_HAS_qemu_ldst_i128   0
-
 #define TCG_TARGET_HAS_tst              1
 
 #define TCG_TARGET_HAS_v64              use_neon_instructions
diff --git a/tcg/i386/tcg-target-has.h b/tcg/i386/tcg-target-has.h
index a984a6af2e..628e736de7 100644
--- a/tcg/i386/tcg-target-has.h
+++ b/tcg/i386/tcg-target-has.h
@@ -26,14 +26,9 @@
 #define have_avx512vbmi2  ((cpuinfo & CPUINFO_AVX512VBMI2) && have_avx512vl)
 
 /* optional instructions */
-#define TCG_TARGET_HAS_add2_i32         0
-#define TCG_TARGET_HAS_sub2_i32         0
-
 #if TCG_TARGET_REG_BITS == 64
 /* Keep 32-bit values zero-extended in a register.  */
 #define TCG_TARGET_HAS_extr_i64_i32     1
-#define TCG_TARGET_HAS_add2_i64         0
-#define TCG_TARGET_HAS_sub2_i64         0
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 #else
 #define TCG_TARGET_HAS_qemu_st8_i32     1
diff --git a/tcg/loongarch64/tcg-target-has.h b/tcg/loongarch64/tcg-target-has.h
index a1bd71db6a..9c118bd1f6 100644
--- a/tcg/loongarch64/tcg-target-has.h
+++ b/tcg/loongarch64/tcg-target-has.h
@@ -10,14 +10,10 @@
 #include "host/cpuinfo.h"
 
 /* optional instructions */
-#define TCG_TARGET_HAS_add2_i32         0
-#define TCG_TARGET_HAS_sub2_i32         0
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
 /* 64-bit operations */
 #define TCG_TARGET_HAS_extr_i64_i32     1
-#define TCG_TARGET_HAS_add2_i64         0
-#define TCG_TARGET_HAS_sub2_i64         0
 
 #define TCG_TARGET_HAS_qemu_ldst_i128   (cpuinfo & CPUINFO_LSX)
 
diff --git a/tcg/mips/tcg-target-has.h b/tcg/mips/tcg-target-has.h
index 9d86906bf3..d8f9f7beef 100644
--- a/tcg/mips/tcg-target-has.h
+++ b/tcg/mips/tcg-target-has.h
@@ -39,13 +39,8 @@ extern bool use_mips32r2_instructions;
 #endif
 
 /* optional instructions */
-#define TCG_TARGET_HAS_add2_i32         0
-#define TCG_TARGET_HAS_sub2_i32         0
-
 #if TCG_TARGET_REG_BITS == 64
 #define TCG_TARGET_HAS_extr_i64_i32     1
-#define TCG_TARGET_HAS_add2_i64         0
-#define TCG_TARGET_HAS_sub2_i64         0
 #define TCG_TARGET_HAS_ext32s_i64       1
 #define TCG_TARGET_HAS_ext32u_i64       1
 #endif
diff --git a/tcg/optimize.c b/tcg/optimize.c
index 95ec3b426d..52e194aaa9 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -1399,82 +1399,6 @@ static bool fold_addco(OptContext *ctx, TCGOp *op)
     return finish_folding(ctx, op);
 }
 
-static bool fold_addsub2(OptContext *ctx, TCGOp *op, bool add)
-{
-    bool a_const = arg_is_const(op->args[2]) && arg_is_const(op->args[3]);
-    bool b_const = arg_is_const(op->args[4]) && arg_is_const(op->args[5]);
-
-    if (a_const && b_const) {
-        uint64_t al = arg_info(op->args[2])->val;
-        uint64_t ah = arg_info(op->args[3])->val;
-        uint64_t bl = arg_info(op->args[4])->val;
-        uint64_t bh = arg_info(op->args[5])->val;
-        TCGArg rl, rh;
-        TCGOp *op2;
-
-        if (ctx->type == TCG_TYPE_I32) {
-            uint64_t a = deposit64(al, 32, 32, ah);
-            uint64_t b = deposit64(bl, 32, 32, bh);
-
-            if (add) {
-                a += b;
-            } else {
-                a -= b;
-            }
-
-            al = sextract64(a, 0, 32);
-            ah = sextract64(a, 32, 32);
-        } else {
-            Int128 a = int128_make128(al, ah);
-            Int128 b = int128_make128(bl, bh);
-
-            if (add) {
-                a = int128_add(a, b);
-            } else {
-                a = int128_sub(a, b);
-            }
-
-            al = int128_getlo(a);
-            ah = int128_gethi(a);
-        }
-
-        rl = op->args[0];
-        rh = op->args[1];
-
-        /* The proper opcode is supplied by tcg_opt_gen_mov. */
-        op2 = opt_insert_before(ctx, op, 0, 2);
-
-        tcg_opt_gen_movi(ctx, op, rl, al);
-        tcg_opt_gen_movi(ctx, op2, rh, ah);
-        return true;
-    }
-
-    /* Fold sub2 r,x,i to add2 r,x,-i */
-    if (!add && b_const) {
-        uint64_t bl = arg_info(op->args[4])->val;
-        uint64_t bh = arg_info(op->args[5])->val;
-
-        /* Negate the two parts without assembling and disassembling. */
-        bl = -bl;
-        bh = ~bh + !bl;
-
-        op->opc = (ctx->type == TCG_TYPE_I32
-                   ? INDEX_op_add2_i32 : INDEX_op_add2_i64);
-        op->args[4] = arg_new_constant(ctx, bl);
-        op->args[5] = arg_new_constant(ctx, bh);
-    }
-    return finish_folding(ctx, op);
-}
-
-static bool fold_add2(OptContext *ctx, TCGOp *op)
-{
-    /* Note that the high and low parts may be independently swapped. */
-    swap_commutative(op->args[0], &op->args[2], &op->args[4]);
-    swap_commutative(op->args[1], &op->args[3], &op->args[5]);
-
-    return fold_addsub2(ctx, op, true);
-}
-
 static bool fold_and(OptContext *ctx, TCGOp *op)
 {
     uint64_t z1, z2, z_mask, s_mask;
@@ -2811,11 +2735,6 @@ static bool fold_sub(OptContext *ctx, TCGOp *op)
     return finish_folding(ctx, op);
 }
 
-static bool fold_sub2(OptContext *ctx, TCGOp *op)
-{
-    return fold_addsub2(ctx, op, false);
-}
-
 static void squash_prev_borrowout(OptContext *ctx, TCGOp *op)
 {
     TempOptInfo *t2;
@@ -3150,9 +3069,6 @@ void tcg_optimize(TCGContext *s)
         case INDEX_op_addco:
             done = fold_addco(&ctx, op);
             break;
-        CASE_OP_32_64(add2):
-            done = fold_add2(&ctx, op);
-            break;
         case INDEX_op_and:
         case INDEX_op_and_vec:
             done = fold_and(&ctx, op);
@@ -3342,9 +3258,6 @@ void tcg_optimize(TCGContext *s)
         case INDEX_op_sub_vec:
             done = fold_sub_vec(&ctx, op);
             break;
-        CASE_OP_32_64(sub2):
-            done = fold_sub2(&ctx, op);
-            break;
         case INDEX_op_xor:
         case INDEX_op_xor_vec:
             done = fold_xor(&ctx, op);
diff --git a/tcg/ppc/tcg-target-has.h b/tcg/ppc/tcg-target-has.h
index 4dda668706..b978c91a62 100644
--- a/tcg/ppc/tcg-target-has.h
+++ b/tcg/ppc/tcg-target-has.h
@@ -18,13 +18,9 @@
 
 /* optional instructions */
 #define TCG_TARGET_HAS_qemu_st8_i32     0
-#define TCG_TARGET_HAS_add2_i32         0
-#define TCG_TARGET_HAS_sub2_i32         0
 
 #if TCG_TARGET_REG_BITS == 64
 #define TCG_TARGET_HAS_extr_i64_i32     0
-#define TCG_TARGET_HAS_add2_i64         0
-#define TCG_TARGET_HAS_sub2_i64         0
 #endif
 
 #define TCG_TARGET_HAS_qemu_ldst_i128   \
diff --git a/tcg/riscv/tcg-target-has.h b/tcg/riscv/tcg-target-has.h
index c95dc1921e..8cd099546f 100644
--- a/tcg/riscv/tcg-target-has.h
+++ b/tcg/riscv/tcg-target-has.h
@@ -11,13 +11,8 @@
 
 /* optional instructions */
 #define TCG_TARGET_HAS_qemu_st8_i32     0
-
 #define TCG_TARGET_HAS_extr_i64_i32     1
-#define TCG_TARGET_HAS_add2_i64         0
-#define TCG_TARGET_HAS_sub2_i64         0
-
 #define TCG_TARGET_HAS_qemu_ldst_i128   0
-
 #define TCG_TARGET_HAS_tst              0
 
 /* vector instructions */
diff --git a/tcg/s390x/tcg-target-has.h b/tcg/s390x/tcg-target-has.h
index 17e61130cd..c04cc4e377 100644
--- a/tcg/s390x/tcg-target-has.h
+++ b/tcg/s390x/tcg-target-has.h
@@ -29,16 +29,9 @@ extern uint64_t s390_facilities[3];
     ((s390_facilities[FACILITY_##X / 64] >> (63 - FACILITY_##X % 64)) & 1)
 
 /* optional instructions */
-#define TCG_TARGET_HAS_add2_i32       0
-#define TCG_TARGET_HAS_sub2_i32       0
 #define TCG_TARGET_HAS_extr_i64_i32   0
 #define TCG_TARGET_HAS_qemu_st8_i32   0
-
-#define TCG_TARGET_HAS_add2_i64       0
-#define TCG_TARGET_HAS_sub2_i64       0
-
 #define TCG_TARGET_HAS_qemu_ldst_i128 1
-
 #define TCG_TARGET_HAS_tst            1
 
 #define TCG_TARGET_HAS_v64            HAVE_FACILITY(VECTOR)
diff --git a/tcg/sparc64/tcg-target-has.h b/tcg/sparc64/tcg-target-has.h
index caf7679595..d9f5ef3fc9 100644
--- a/tcg/sparc64/tcg-target-has.h
+++ b/tcg/sparc64/tcg-target-has.h
@@ -14,16 +14,9 @@ extern bool use_vis3_instructions;
 #endif
 
 /* optional instructions */
-#define TCG_TARGET_HAS_add2_i32         0
-#define TCG_TARGET_HAS_sub2_i32         0
 #define TCG_TARGET_HAS_qemu_st8_i32     0
-
 #define TCG_TARGET_HAS_extr_i64_i32     0
-#define TCG_TARGET_HAS_add2_i64         0
-#define TCG_TARGET_HAS_sub2_i64         0
-
 #define TCG_TARGET_HAS_qemu_ldst_i128   0
-
 #define TCG_TARGET_HAS_tst              1
 
 #define TCG_TARGET_extract_valid(type, ofs, len) \
diff --git a/tcg/tcg-has.h b/tcg/tcg-has.h
index 50e8d0cda4..2fc0e50d20 100644
--- a/tcg/tcg-has.h
+++ b/tcg/tcg-has.h
@@ -12,8 +12,6 @@
 #if TCG_TARGET_REG_BITS == 32
 /* Turn some undef macros into false macros.  */
 #define TCG_TARGET_HAS_extr_i64_i32     0
-#define TCG_TARGET_HAS_add2_i64         0
-#define TCG_TARGET_HAS_sub2_i64         0
 #endif
 
 #if !defined(TCG_TARGET_HAS_v64) \
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index b0a29278ab..b0139ce05d 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -249,24 +249,6 @@ static void DNI tcg_gen_op5ii_i64(TCGOpcode opc, TCGv_i64 a1, TCGv_i64 a2,
                 tcgv_i64_arg(a3), a4, a5);
 }
 
-static void DNI tcg_gen_op6_i32(TCGOpcode opc, TCGv_i32 a1, TCGv_i32 a2,
-                                TCGv_i32 a3, TCGv_i32 a4,
-                                TCGv_i32 a5, TCGv_i32 a6)
-{
-    tcg_gen_op6(opc, TCG_TYPE_I32, tcgv_i32_arg(a1), tcgv_i32_arg(a2),
-                tcgv_i32_arg(a3), tcgv_i32_arg(a4), tcgv_i32_arg(a5),
-                tcgv_i32_arg(a6));
-}
-
-static void DNI tcg_gen_op6_i64(TCGOpcode opc, TCGv_i64 a1, TCGv_i64 a2,
-                                TCGv_i64 a3, TCGv_i64 a4,
-                                TCGv_i64 a5, TCGv_i64 a6)
-{
-    tcg_gen_op6(opc, TCG_TYPE_I64, tcgv_i64_arg(a1), tcgv_i64_arg(a2),
-                tcgv_i64_arg(a3), tcgv_i64_arg(a4), tcgv_i64_arg(a5),
-                tcgv_i64_arg(a6));
-}
-
 static void DNI tcg_gen_op6i_i32(TCGOpcode opc, TCGv_i32 a1, TCGv_i32 a2,
                                  TCGv_i32 a3, TCGv_i32 a4,
                                  TCGv_i32 a5, TCGArg a6)
@@ -1108,8 +1090,6 @@ void tcg_gen_add2_i32(TCGv_i32 rl, TCGv_i32 rh, TCGv_i32 al,
         tcg_gen_op3_i32(INDEX_op_addci, rh, ah, bh);
         tcg_gen_mov_i32(rl, t0);
         tcg_temp_free_i32(t0);
-    } else if (TCG_TARGET_HAS_add2_i32) {
-        tcg_gen_op6_i32(INDEX_op_add2_i32, rl, rh, al, ah, bl, bh);
     } else {
         TCGv_i32 t0 = tcg_temp_ebb_new_i32();
         TCGv_i32 t1 = tcg_temp_ebb_new_i32();
@@ -1159,8 +1139,6 @@ void tcg_gen_sub2_i32(TCGv_i32 rl, TCGv_i32 rh, TCGv_i32 al,
         tcg_gen_op3_i32(INDEX_op_subbi, rh, ah, bh);
         tcg_gen_mov_i32(rl, t0);
         tcg_temp_free_i32(t0);
-    } else if (TCG_TARGET_HAS_sub2_i32) {
-        tcg_gen_op6_i32(INDEX_op_sub2_i32, rl, rh, al, ah, bl, bh);
     } else {
         TCGv_i32 t0 = tcg_temp_ebb_new_i32();
         TCGv_i32 t1 = tcg_temp_ebb_new_i32();
@@ -2880,8 +2858,6 @@ void tcg_gen_add2_i64(TCGv_i64 rl, TCGv_i64 rh, TCGv_i64 al,
 
         tcg_gen_mov_i64(rl, t0);
         tcg_temp_free_i64(t0);
-    } else if (TCG_TARGET_HAS_add2_i64) {
-        tcg_gen_op6_i64(INDEX_op_add2_i64, rl, rh, al, ah, bl, bh);
     } else {
         TCGv_i64 t0 = tcg_temp_ebb_new_i64();
         TCGv_i64 t1 = tcg_temp_ebb_new_i64();
@@ -2985,8 +2961,6 @@ void tcg_gen_sub2_i64(TCGv_i64 rl, TCGv_i64 rh, TCGv_i64 al,
 
         tcg_gen_mov_i64(rl, t0);
         tcg_temp_free_i64(t0);
-    } else if (TCG_TARGET_HAS_sub2_i64) {
-        tcg_gen_op6_i64(INDEX_op_sub2_i64, rl, rh, al, ah, bl, bh);
     } else {
         TCGv_i64 t0 = tcg_temp_ebb_new_i64();
         TCGv_i64 t1 = tcg_temp_ebb_new_i64();
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 3b9f519ef6..5a498b48b6 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -2430,11 +2430,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_st_i32:
         return true;
 
-    case INDEX_op_add2_i32:
-        return TCG_TARGET_HAS_add2_i32;
-    case INDEX_op_sub2_i32:
-        return TCG_TARGET_HAS_sub2_i32;
-
     case INDEX_op_brcond2_i32:
     case INDEX_op_setcond2_i32:
         return TCG_TARGET_REG_BITS == 32;
@@ -2456,11 +2451,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_extrh_i64_i32:
         return TCG_TARGET_REG_BITS == 64;
 
-    case INDEX_op_add2_i64:
-        return TCG_TARGET_HAS_add2_i64;
-    case INDEX_op_sub2_i64:
-        return TCG_TARGET_HAS_sub2_i64;
-
     case INDEX_op_mov_vec:
     case INDEX_op_dup_vec:
     case INDEX_op_dupm_vec:
@@ -4101,32 +4091,6 @@ liveness_pass_1(TCGContext *s)
             la_reset_pref(ts);
             break;
 
-        case INDEX_op_add2_i32:
-        case INDEX_op_add2_i64:
-            opc_new = INDEX_op_add;
-            goto do_addsub2;
-        case INDEX_op_sub2_i32:
-        case INDEX_op_sub2_i64:
-            opc_new = INDEX_op_sub;
-        do_addsub2:
-            assert_carry_dead(s);
-            /* Test if the high part of the operation is dead, but not
-               the low part.  The result can be optimized to a simple
-               add or sub.  This happens often for x86_64 guest when the
-               cpu mode is set to 32 bit.  */
-            if (arg_temp(op->args[1])->state == TS_DEAD) {
-                if (arg_temp(op->args[0])->state == TS_DEAD) {
-                    goto do_remove;
-                }
-                /* Replace the opcode and adjust the args in place,
-                   leaving 3 unused args at the end.  */
-                op->opc = opc = opc_new;
-                op->args[1] = op->args[2];
-                op->args[2] = op->args[4];
-                /* Fall through and mark the single-word operation live.  */
-            }
-            goto do_not_remove;
-
         case INDEX_op_muls2:
             opc_new = INDEX_op_mul;
             opc_new2 = INDEX_op_mulsh;
diff --git a/tcg/tci/tcg-target-has.h b/tcg/tci/tcg-target-has.h
index 310d45ba62..497e8152b7 100644
--- a/tcg/tci/tcg-target-has.h
+++ b/tcg/tci/tcg-target-has.h
@@ -8,13 +8,9 @@
 #define TCG_TARGET_HAS_H
 
 #define TCG_TARGET_HAS_qemu_st8_i32     0
-#define TCG_TARGET_HAS_add2_i32         0
-#define TCG_TARGET_HAS_sub2_i32         0
 
 #if TCG_TARGET_REG_BITS == 64
 #define TCG_TARGET_HAS_extr_i64_i32     0
-#define TCG_TARGET_HAS_add2_i64         0
-#define TCG_TARGET_HAS_sub2_i64         0
 #endif /* TCG_TARGET_REG_BITS == 64 */
 
 #define TCG_TARGET_HAS_qemu_ldst_i128   0

From e038696c9293f34dc7ccd4adac2c2f221a65a8e3 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 20 Jan 2025 20:47:42 -0800
Subject: [PATCH 0502/2760] tcg: Formalize tcg_out_mb
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Most tcg backends already have a function for this;
the rest can split one out from tcg_out_op.
Call it directly from tcg_gen_code.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target.c.inc     |  6 +-----
 tcg/arm/tcg-target.c.inc         |  6 +-----
 tcg/i386/tcg-target.c.inc        |  5 +----
 tcg/loongarch64/tcg-target.c.inc |  6 +-----
 tcg/mips/tcg-target.c.inc        |  5 +----
 tcg/ppc/tcg-target.c.inc         |  6 +-----
 tcg/riscv/tcg-target.c.inc       |  6 +-----
 tcg/s390x/tcg-target.c.inc       | 20 +++++++++++---------
 tcg/sparc64/tcg-target.c.inc     |  6 +-----
 tcg/tcg.c                        |  4 ++++
 tcg/tci/tcg-target.c.inc         |  9 +++++----
 11 files changed, 28 insertions(+), 51 deletions(-)

diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index 75cf490fd2..d2babd9bab 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -1575,7 +1575,7 @@ static void tcg_out_extrl_i64_i32(TCGContext *s, TCGReg rd, TCGReg rn)
     tcg_out_mov(s, TCG_TYPE_I32, rd, rn);
 }
 
-static inline void tcg_out_mb(TCGContext *s, TCGArg a0)
+static void tcg_out_mb(TCGContext *s, unsigned a0)
 {
     static const uint32_t sync[] = {
         [0 ... TCG_MO_ALL]            = DMB_ISH | DMB_LD | DMB_ST,
@@ -2845,10 +2845,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType ext,
         tcg_out_qemu_ldst_i128(s, a0, a1, a2, args[3], false);
         break;
 
-    case INDEX_op_mb:
-        tcg_out_mb(s, a0);
-        break;
-
     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index 3c9042ebfa..131901dabc 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -1203,7 +1203,7 @@ static void tcg_out_goto_label(TCGContext *s, ARMCond cond, TCGLabel *l)
     }
 }
 
-static void tcg_out_mb(TCGContext *s, TCGArg a0)
+static void tcg_out_mb(TCGContext *s, unsigned a0)
 {
     if (use_armv7_instructions) {
         tcg_out32(s, INSN_DMB_ISH);
@@ -2565,10 +2565,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_qemu_st(s, args[0], args[1], args[2], args[3], TCG_TYPE_I64);
         break;
 
-    case INDEX_op_mb:
-        tcg_out_mb(s, args[0]);
-        break;
-
     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index da05f13b21..bf84f9f455 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -1168,7 +1168,7 @@ static inline void tcg_out_pushi(TCGContext *s, tcg_target_long val)
     }
 }
 
-static inline void tcg_out_mb(TCGContext *s, TCGArg a0)
+static void tcg_out_mb(TCGContext *s, unsigned a0)
 {
     /* Given the strength of x86 memory ordering, we only need care for
        store-load ordering.  Experimentally, "lock orl $0,0(%esp)" is
@@ -3536,9 +3536,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         break;
 #endif
 
-    case INDEX_op_mb:
-        tcg_out_mb(s, a0);
-        break;
     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index 4f640764ef..1ad577ad8d 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -301,7 +301,7 @@ static bool patch_reloc(tcg_insn_unit *code_ptr, int type,
  * TCG intrinsics
  */
 
-static void tcg_out_mb(TCGContext *s, TCGArg a0)
+static void tcg_out_mb(TCGContext *s, unsigned a0)
 {
     /* Baseline LoongArch only has the full barrier, unfortunately.  */
     tcg_out_opc_dbar(s, 0);
@@ -1917,10 +1917,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     TCGArg a3 = args[3];
 
     switch (opc) {
-    case INDEX_op_mb:
-        tcg_out_mb(s, a0);
-        break;
-
     case INDEX_op_goto_ptr:
         tcg_out_opc_jirl(s, TCG_REG_ZERO, a0, 0);
         break;
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index 0c268cef42..b0da661561 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -1491,7 +1491,7 @@ static void tcg_out_qemu_st(TCGContext *s, TCGReg datalo, TCGReg datahi,
     }
 }
 
-static void tcg_out_mb(TCGContext *s, TCGArg a0)
+static void tcg_out_mb(TCGContext *s, unsigned a0)
 {
     static const MIPSInsn sync[] = {
         /* Note that SYNC_MB is a slightly weaker than SYNC 0,
@@ -2352,9 +2352,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    case INDEX_op_mb:
-        tcg_out_mb(s, a0);
-        break;
     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index 91df9610ec..ae18c84ae6 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -2208,7 +2208,7 @@ static const TCGOutOpBrcond2 outop_brcond2 = {
     .out = tgen_brcond2,
 };
 
-static void tcg_out_mb(TCGContext *s, TCGArg a0)
+static void tcg_out_mb(TCGContext *s, unsigned a0)
 {
     uint32_t insn;
 
@@ -3758,10 +3758,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_qemu_ldst_i128(s, args[0], args[1], args[2], args[3], false);
         break;
 
-    case INDEX_op_mb:
-        tcg_out_mb(s, args[0]);
-        break;
-
     case INDEX_op_call:      /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:   /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:   /* Always emitted via tcg_out_goto_tb.  */
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index 707ebb8f6d..df271752b7 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -1582,7 +1582,7 @@ static void tcg_out_call(TCGContext *s, const tcg_insn_unit *arg,
     tcg_out_call_int(s, arg, false);
 }
 
-static void tcg_out_mb(TCGContext *s, TCGArg a0)
+static void tcg_out_mb(TCGContext *s, unsigned a0)
 {
     tcg_insn_unit insn = OPC_FENCE;
 
@@ -2594,10 +2594,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_qemu_st(s, a0, a1, a2, TCG_TYPE_I64);
         break;
 
-    case INDEX_op_mb:
-        tcg_out_mb(s, a0);
-        break;
-
     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index 09c7ca5b44..020d8ba73f 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -3008,6 +3008,17 @@ static const TCGOutOpUnary outop_not = {
     .out_rr = tgen_not,
 };
 
+static void tcg_out_mb(TCGContext *s, unsigned a0)
+{
+    /*
+     * The host memory model is quite strong, we simply need to
+     * serialize the instruction stream.
+     */
+    if (a0 & TCG_MO_ST_LD) {
+        /* fast-bcr-serialization facility (45) is present */
+        tcg_out_insn(s, RR, BCR, 14, 0);
+    }
+}
 
 # define OP_32_64(x) \
         case glue(glue(INDEX_op_,x),_i32): \
@@ -3107,15 +3118,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_st(s, TCG_TYPE_I64, args[0], args[1], args[2]);
         break;
 
-    case INDEX_op_mb:
-        /* The host memory model is quite strong, we simply need to
-           serialize the instruction stream.  */
-        if (args[0] & TCG_MO_ST_LD) {
-            /* fast-bcr-serialization facility (45) is present */
-            tcg_out_insn(s, RR, BCR, 14, 0);
-        }
-        break;
-
     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index c2251a6927..7754627a5d 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -949,7 +949,7 @@ static void tcg_out_call(TCGContext *s, const tcg_insn_unit *dest,
     tcg_out_nop(s);
 }
 
-static void tcg_out_mb(TCGContext *s, TCGArg a0)
+static void tcg_out_mb(TCGContext *s, unsigned a0)
 {
     /* Note that the TCG memory order constants mirror the Sparc MEMBAR.  */
     tcg_out32(s, MEMBAR | (a0 & TCG_MO_ALL));
@@ -2025,10 +2025,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_ldst(s, a0, a1, a2, STX);
         break;
 
-    case INDEX_op_mb:
-        tcg_out_mb(s, a0);
-        break;
-
     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 5a498b48b6..e7478bef77 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -133,6 +133,7 @@ static void tcg_out_addi_ptr(TCGContext *s, TCGReg, TCGReg, tcg_target_long);
 static bool tcg_out_xchg(TCGContext *s, TCGType type, TCGReg r1, TCGReg r2);
 static void tcg_out_exit_tb(TCGContext *s, uintptr_t arg);
 static void tcg_out_goto_tb(TCGContext *s, int which);
+static void tcg_out_mb(TCGContext *s, unsigned bar);
 static void tcg_out_set_carry(TCGContext *s);
 static void tcg_out_set_borrow(TCGContext *s);
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
@@ -6899,6 +6900,9 @@ int tcg_gen_code(TCGContext *s, TranslationBlock *tb, uint64_t pc_start)
         case INDEX_op_goto_tb:
             tcg_out_goto_tb(s, op->args[0]);
             break;
+        case INDEX_op_mb:
+            tcg_out_mb(s, op->args[0]);
+            break;
         case INDEX_op_dup2_vec:
             if (tcg_reg_alloc_dup2(s, op)) {
                 break;
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index 35c0c91f3e..64d4ac07cd 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -1131,6 +1131,11 @@ static const TCGOutOpSetcond2 outop_setcond2 = {
     .out = tgen_setcond2,
 };
 
+static void tcg_out_mb(TCGContext *s, unsigned a0)
+{
+    tcg_out_op_v(s, INDEX_op_mb);
+}
+
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
                        const int const_args[TCG_MAX_OP_ARGS])
@@ -1178,10 +1183,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         }
         break;
 
-    case INDEX_op_mb:
-        tcg_out_op_v(s, opc);
-        break;
-
     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */

From 3752a5a5ba33448fe40556d781e8096b5b9dd916 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 20 Jan 2025 21:17:07 -0800
Subject: [PATCH 0503/2760] tcg: Formalize tcg_out_br

Split these functions out from tcg_out_op.
Call it directly from tcg_gen_code.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target.c.inc     |  6 +-----
 tcg/arm/tcg-target.c.inc         |  8 +++++---
 tcg/i386/tcg-target.c.inc        |  8 +++++---
 tcg/loongarch64/tcg-target.c.inc | 12 ++++++------
 tcg/mips/tcg-target.c.inc        | 10 +++++-----
 tcg/ppc/tcg-target.c.inc         | 26 ++++++++++++--------------
 tcg/riscv/tcg-target.c.inc       | 11 ++++++-----
 tcg/s390x/tcg-target.c.inc       |  9 +++++----
 tcg/sparc64/tcg-target.c.inc     | 10 ++++++----
 tcg/tcg.c                        |  4 ++++
 tcg/tci/tcg-target.c.inc         |  9 +++++----
 11 files changed, 60 insertions(+), 53 deletions(-)

diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index d2babd9bab..fceb6e2796 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -1407,7 +1407,7 @@ static void tcg_out_call(TCGContext *s, const tcg_insn_unit *target,
     tcg_out_call_int(s, target);
 }
 
-static inline void tcg_out_goto_label(TCGContext *s, TCGLabel *l)
+static void tcg_out_br(TCGContext *s, TCGLabel *l)
 {
     if (!l->has_value) {
         tcg_out_reloc(s, s->code_ptr, R_AARCH64_JUMP26, l, 0);
@@ -2779,10 +2779,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType ext,
         tcg_out_insn(s, 3207, BR, a0);
         break;
 
-    case INDEX_op_br:
-        tcg_out_goto_label(s, arg_label(a0));
-        break;
-
     case INDEX_op_ld8u_i32:
     case INDEX_op_ld8u_i64:
         tcg_out_ldst(s, I3312_LDRB, a0, a1, a2, 0);
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index 131901dabc..327b01d377 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -1203,6 +1203,11 @@ static void tcg_out_goto_label(TCGContext *s, ARMCond cond, TCGLabel *l)
     }
 }
 
+static void tcg_out_br(TCGContext *s, TCGLabel *l)
+{
+    tcg_out_goto_label(s, COND_AL, l);
+}
+
 static void tcg_out_mb(TCGContext *s, unsigned a0)
 {
     if (use_armv7_instructions) {
@@ -2522,9 +2527,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     case INDEX_op_goto_ptr:
         tcg_out_b_reg(s, COND_AL, args[0]);
         break;
-    case INDEX_op_br:
-        tcg_out_goto_label(s, COND_AL, arg_label(args[0]));
-        break;
 
     case INDEX_op_ld8u_i32:
         tcg_out_ld8u(s, COND_AL, args[0], args[1], args[2]);
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index bf84f9f455..f89982378b 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -1546,6 +1546,11 @@ static void tcg_out_jxx(TCGContext *s, int opc, TCGLabel *l, bool small)
     }
 }
 
+static void tcg_out_br(TCGContext *s, TCGLabel *l)
+{
+    tcg_out_jxx(s, JCC_JMP, l, 0);
+}
+
 static int tcg_out_cmp(TCGContext *s, TCGCond cond, TCGArg arg1,
                        TCGArg arg2, int const_arg2, int rexw)
 {
@@ -3436,9 +3441,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         /* jmp to the given host address (could be epilogue) */
         tcg_out_modrm(s, OPC_GRP5, EXT5_JMPN_Ev, a0);
         break;
-    case INDEX_op_br:
-        tcg_out_jxx(s, JCC_JMP, arg_label(a0), 0);
-        break;
     OP_32_64(ld8u):
         /* Note that we can ignore REXW for the zero-extend to 64-bit.  */
         tcg_out_modrm_offset(s, OPC_MOVZBL, a0, a1, a2);
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index 1ad577ad8d..cbdc42c157 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -756,6 +756,12 @@ static const TCGOutOpMovcond outop_movcond = {
  * Branch helpers
  */
 
+static void tcg_out_br(TCGContext *s, TCGLabel *l)
+{
+    tcg_out_reloc(s, s->code_ptr, R_LOONGARCH_BR_SD10K16, l, 0);
+    tcg_out_opc_b(s, 0);
+}
+
 static const struct {
     LoongArchInsn op;
     bool swap;
@@ -1921,12 +1927,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_opc_jirl(s, TCG_REG_ZERO, a0, 0);
         break;
 
-    case INDEX_op_br:
-        tcg_out_reloc(s, s->code_ptr, R_LOONGARCH_BR_SD10K16, arg_label(a0),
-                      0);
-        tcg_out_opc_b(s, 0);
-        break;
-
     case INDEX_op_ld8s_i32:
     case INDEX_op_ld8s_i64:
         tcg_out_ldst(s, OPC_LD_B, a0, a1, a2);
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index b0da661561..f4d6ee10b9 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -921,6 +921,11 @@ static const TCGOutOpBrcond outop_brcond = {
     .out_rr = tgen_brcond,
 };
 
+void tcg_out_br(TCGContext *s, TCGLabel *l)
+{
+    tgen_brcond(s, TCG_TYPE_I32, TCG_COND_EQ, TCG_REG_ZERO, TCG_REG_ZERO, l);
+}
+
 static int tcg_out_setcond2_int(TCGContext *s, TCGCond cond, TCGReg ret,
                                 TCGReg al, TCGReg ah, TCGReg bl, TCGReg bh)
 {
@@ -2281,11 +2286,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
             tcg_out_nop(s);
         }
         break;
-    case INDEX_op_br:
-        tgen_brcond(s, TCG_TYPE_I32, TCG_COND_EQ,
-                    TCG_REG_ZERO, TCG_REG_ZERO, arg_label(a0));
-        break;
-
     case INDEX_op_ld8u_i32:
     case INDEX_op_ld8u_i64:
         i1 = OPC_LBU;
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index ae18c84ae6..d88ec8d690 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -1990,6 +1990,18 @@ static const TCGOutOpSetcond outop_negsetcond = {
     .out_rri = tgen_negsetcondi,
 };
 
+void tcg_out_br(TCGContext *s, TCGLabel *l)
+{
+    uint32_t insn = B;
+
+    if (l->has_value) {
+        insn |= reloc_pc24_val(tcg_splitwx_to_rx(s->code_ptr), l->u.value_ptr);
+    } else {
+        tcg_out_reloc(s, s->code_ptr, R_PPC_REL24, l, 0);
+    }
+    tcg_out32(s, insn);
+}
+
 static void tcg_out_bc(TCGContext *s, TCGCond cond, int bd)
 {
     tcg_out32(s, tcg_to_bc[cond] | bd);
@@ -3669,20 +3681,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out32(s, ADDI | TAI(TCG_REG_R3, 0, 0));
         tcg_out32(s, BCCTR | BO_ALWAYS);
         break;
-    case INDEX_op_br:
-        {
-            TCGLabel *l = arg_label(args[0]);
-            uint32_t insn = B;
-
-            if (l->has_value) {
-                insn |= reloc_pc24_val(tcg_splitwx_to_rx(s->code_ptr),
-                                       l->u.value_ptr);
-            } else {
-                tcg_out_reloc(s, s->code_ptr, R_PPC_REL24, l, 0);
-            }
-            tcg_out32(s, insn);
-        }
-        break;
     case INDEX_op_ld8u_i32:
     case INDEX_op_ld8u_i64:
         tcg_out_mem_long(s, LBZ, LBZX, args[0], args[1], args[2]);
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index df271752b7..5d8d8213cb 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -1107,6 +1107,12 @@ static void tcg_out_dupi_vec(TCGContext *s, TCGType type, unsigned vece,
     tcg_out_dup_vec(s, type, vece, dst, TCG_REG_TMP0);
 }
 
+static void tcg_out_br(TCGContext *s, TCGLabel *l)
+{
+    tcg_out_reloc(s, s->code_ptr, R_RISCV_JAL, l, 0);
+    tcg_out_opc_jump(s, OPC_JAL, TCG_REG_ZERO, 0);
+}
+
 static const struct {
     RISCVInsn op;
     bool swap;
@@ -2533,11 +2539,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_opc_imm(s, OPC_JALR, TCG_REG_ZERO, a0, 0);
         break;
 
-    case INDEX_op_br:
-        tcg_out_reloc(s, s->code_ptr, R_RISCV_JAL, arg_label(a0), 0);
-        tcg_out_opc_jump(s, OPC_JAL, TCG_REG_ZERO, 0);
-        break;
-
     case INDEX_op_ld8u_i32:
     case INDEX_op_ld8u_i64:
         tcg_out_ldst(s, OPC_LBU, a0, a1, a2);
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index 020d8ba73f..cdc61de4f8 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -1689,6 +1689,11 @@ static void tgen_branch(TCGContext *s, int cc, TCGLabel *l)
     }
 }
 
+static void tcg_out_br(TCGContext *s, TCGLabel *l)
+{
+    tgen_branch(s, S390_CC_ALWAYS, l);
+}
+
 static void tgen_compare_branch(TCGContext *s, S390Opcode opc, int cc,
                                 TCGReg r1, TCGReg r2, TCGLabel *l)
 {
@@ -3075,10 +3080,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_st(s, TCG_TYPE_I32, args[0], args[1], args[2]);
         break;
 
-    case INDEX_op_br:
-        tgen_branch(s, S390_CC_ALWAYS, arg_label(args[0]));
-        break;
-
     case INDEX_op_qemu_ld_i32:
         tcg_out_qemu_ld(s, args[0], args[1], args[2], TCG_TYPE_I32);
         break;
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index 7754627a5d..0cc7567786 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -641,6 +641,12 @@ static void tcg_out_bpcc(TCGContext *s, int scond, int flags, TCGLabel *l)
     tcg_out_bpcc0(s, scond, flags, off19);
 }
 
+static void tcg_out_br(TCGContext *s, TCGLabel *l)
+{
+    tcg_out_bpcc(s, COND_A, BPCC_PT, l);
+    tcg_out_nop(s);
+}
+
 static void tcg_out_cmp(TCGContext *s, TCGCond cond,
                         TCGReg c1, int32_t c2, int c2const)
 {
@@ -1966,10 +1972,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_arithi(s, TCG_REG_G0, a0, 0, JMPL);
         tcg_out_mov_delay(s, TCG_REG_TB, a0);
         break;
-    case INDEX_op_br:
-        tcg_out_bpcc(s, COND_A, BPCC_PT, arg_label(a0));
-        tcg_out_nop(s);
-        break;
 
 #define OP_32_64(x)                             \
         glue(glue(case INDEX_op_, x), _i32):    \
diff --git a/tcg/tcg.c b/tcg/tcg.c
index e7478bef77..fbb1a43efc 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -134,6 +134,7 @@ static bool tcg_out_xchg(TCGContext *s, TCGType type, TCGReg r1, TCGReg r2);
 static void tcg_out_exit_tb(TCGContext *s, uintptr_t arg);
 static void tcg_out_goto_tb(TCGContext *s, int which);
 static void tcg_out_mb(TCGContext *s, unsigned bar);
+static void tcg_out_br(TCGContext *s, TCGLabel *l);
 static void tcg_out_set_carry(TCGContext *s);
 static void tcg_out_set_borrow(TCGContext *s);
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
@@ -6900,6 +6901,9 @@ int tcg_gen_code(TCGContext *s, TranslationBlock *tb, uint64_t pc_start)
         case INDEX_op_goto_tb:
             tcg_out_goto_tb(s, op->args[0]);
             break;
+        case INDEX_op_br:
+            tcg_out_br(s, arg_label(op->args[0]));
+            break;
         case INDEX_op_mb:
             tcg_out_mb(s, op->args[0]);
             break;
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index 64d4ac07cd..55a1a74fb6 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -1136,6 +1136,11 @@ static void tcg_out_mb(TCGContext *s, unsigned a0)
     tcg_out_op_v(s, INDEX_op_mb);
 }
 
+static void tcg_out_br(TCGContext *s, TCGLabel *l)
+{
+    tcg_out_op_l(s, INDEX_op_br, l);
+}
+
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
                        const int const_args[TCG_MAX_OP_ARGS])
@@ -1145,10 +1150,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_op_r(s, opc, args[0]);
         break;
 
-    case INDEX_op_br:
-        tcg_out_op_l(s, opc, arg_label(args[0]));
-        break;
-
     CASE_32_64(ld8u)
     CASE_32_64(ld8s)
     CASE_32_64(ld16u)

From fee03fdde32c3d5b26429b7e691f78d1ee03d631 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 20 Jan 2025 21:57:32 -0800
Subject: [PATCH 0504/2760] tcg: Formalize tcg_out_goto_ptr

Split these functions out from tcg_out_op.
Define outop_goto_ptr generically.
Call tcg_out_goto_ptr from tcg_reg_alloc_op.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target.c.inc     | 12 +++++-------
 tcg/arm/tcg-target.c.inc         | 12 +++++-------
 tcg/i386/tcg-target.c.inc        | 13 ++++++-------
 tcg/loongarch64/tcg-target.c.inc | 12 +++++-------
 tcg/mips/tcg-target.c.inc        | 22 ++++++++++------------
 tcg/ppc/tcg-target.c.inc         | 15 +++++++--------
 tcg/riscv/tcg-target.c.inc       | 12 +++++-------
 tcg/s390x/tcg-target.c.inc       | 15 +++++----------
 tcg/sparc64/tcg-target.c.inc     | 14 ++++++--------
 tcg/tcg.c                        | 12 ++++++++++++
 tcg/tci/tcg-target.c.inc         | 12 +++++-------
 11 files changed, 71 insertions(+), 80 deletions(-)

diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index fceb6e2796..2678e1f176 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -1986,6 +1986,11 @@ static void tcg_out_goto_tb(TCGContext *s, int which)
     tcg_out_bti(s, BTI_J);
 }
 
+static void tcg_out_goto_ptr(TCGContext *s, TCGReg a0)
+{
+    tcg_out_insn(s, 3207, BR, a0);
+}
+
 void tb_target_set_jmp_target(const TranslationBlock *tb, int n,
                               uintptr_t jmp_rx, uintptr_t jmp_rw)
 {
@@ -2775,10 +2780,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType ext,
     TCGArg a2 = args[2];
 
     switch (opc) {
-    case INDEX_op_goto_ptr:
-        tcg_out_insn(s, 3207, BR, a0);
-        break;
-
     case INDEX_op_ld8u_i32:
     case INDEX_op_ld8u_i64:
         tcg_out_ldst(s, I3312_LDRB, a0, a1, a2, 0);
@@ -3293,9 +3294,6 @@ static TCGConstraintSetIndex
 tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 {
     switch (op) {
-    case INDEX_op_goto_ptr:
-        return C_O0_I1(r);
-
     case INDEX_op_ld8u_i32:
     case INDEX_op_ld8s_i32:
     case INDEX_op_ld16u_i32:
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index 327b01d377..64be0a7e6d 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -1795,6 +1795,11 @@ static void tcg_out_goto_tb(TCGContext *s, int which)
     set_jmp_reset_offset(s, which);
 }
 
+static void tcg_out_goto_ptr(TCGContext *s, TCGReg a0)
+{
+    tcg_out_b_reg(s, COND_AL, a0);
+}
+
 void tb_target_set_jmp_target(const TranslationBlock *tb, int n,
                               uintptr_t jmp_rx, uintptr_t jmp_rw)
 {
@@ -2524,10 +2529,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const int const_args[TCG_MAX_OP_ARGS])
 {
     switch (opc) {
-    case INDEX_op_goto_ptr:
-        tcg_out_b_reg(s, COND_AL, args[0]);
-        break;
-
     case INDEX_op_ld8u_i32:
         tcg_out_ld8u(s, COND_AL, args[0], args[1], args[2]);
         break;
@@ -2579,9 +2580,6 @@ static TCGConstraintSetIndex
 tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 {
     switch (op) {
-    case INDEX_op_goto_ptr:
-        return C_O0_I1(r);
-
     case INDEX_op_ld8u_i32:
     case INDEX_op_ld8s_i32:
     case INDEX_op_ld16u_i32:
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index f89982378b..5ea4a44264 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -2593,6 +2593,12 @@ static void tcg_out_goto_tb(TCGContext *s, int which)
     set_jmp_reset_offset(s, which);
 }
 
+static void tcg_out_goto_ptr(TCGContext *s, TCGReg a0)
+{
+    /* Jump to the given host address (could be epilogue) */
+    tcg_out_modrm(s, OPC_GRP5, EXT5_JMPN_Ev, a0);
+}
+
 void tb_target_set_jmp_target(const TranslationBlock *tb, int n,
                               uintptr_t jmp_rx, uintptr_t jmp_rw)
 {
@@ -3437,10 +3443,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     rexw = type == TCG_TYPE_I32 ? 0 : P_REXW;
 
     switch (opc) {
-    case INDEX_op_goto_ptr:
-        /* jmp to the given host address (could be epilogue) */
-        tcg_out_modrm(s, OPC_GRP5, EXT5_JMPN_Ev, a0);
-        break;
     OP_32_64(ld8u):
         /* Note that we can ignore REXW for the zero-extend to 64-bit.  */
         tcg_out_modrm_offset(s, OPC_MOVZBL, a0, a1, a2);
@@ -4093,9 +4095,6 @@ static TCGConstraintSetIndex
 tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 {
     switch (op) {
-    case INDEX_op_goto_ptr:
-        return C_O0_I1(r);
-
     case INDEX_op_ld8u_i32:
     case INDEX_op_ld8u_i64:
     case INDEX_op_ld8s_i32:
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index cbdc42c157..d89c27c67f 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -1307,6 +1307,11 @@ static void tcg_out_goto_tb(TCGContext *s, int which)
     set_jmp_reset_offset(s, which);
 }
 
+static void tcg_out_goto_ptr(TCGContext *s, TCGReg a0)
+{
+    tcg_out_opc_jirl(s, TCG_REG_ZERO, a0, 0);
+}
+
 void tb_target_set_jmp_target(const TranslationBlock *tb, int n,
                               uintptr_t jmp_rx, uintptr_t jmp_rw)
 {
@@ -1923,10 +1928,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     TCGArg a3 = args[3];
 
     switch (opc) {
-    case INDEX_op_goto_ptr:
-        tcg_out_opc_jirl(s, TCG_REG_ZERO, a0, 0);
-        break;
-
     case INDEX_op_ld8s_i32:
     case INDEX_op_ld8s_i64:
         tcg_out_ldst(s, OPC_LD_B, a0, a1, a2);
@@ -2491,9 +2492,6 @@ static TCGConstraintSetIndex
 tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 {
     switch (op) {
-    case INDEX_op_goto_ptr:
-        return C_O0_I1(r);
-
     case INDEX_op_st8_i32:
     case INDEX_op_st8_i64:
     case INDEX_op_st16_i32:
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index f4d6ee10b9..9455a0a17b 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -1571,6 +1571,16 @@ static void tcg_out_goto_tb(TCGContext *s, int which)
     }
 }
 
+static void tcg_out_goto_ptr(TCGContext *s, TCGReg a0)
+{
+    tcg_out_opc_reg(s, OPC_JR, 0, a0, 0);
+    if (TCG_TARGET_REG_BITS == 64) {
+        tcg_out_mov(s, TCG_TYPE_PTR, TCG_REG_TB, a0);
+    } else {
+        tcg_out_nop(s);
+    }
+}
+
 void tb_target_set_jmp_target(const TranslationBlock *tb, int n,
                               uintptr_t jmp_rx, uintptr_t jmp_rw)
 {
@@ -2277,15 +2287,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     a2 = args[2];
 
     switch (opc) {
-    case INDEX_op_goto_ptr:
-        /* jmp to the given host address (could be epilogue) */
-        tcg_out_opc_reg(s, OPC_JR, 0, a0, 0);
-        if (TCG_TARGET_REG_BITS == 64) {
-            tcg_out_mov(s, TCG_TYPE_PTR, TCG_REG_TB, a0);
-        } else {
-            tcg_out_nop(s);
-        }
-        break;
     case INDEX_op_ld8u_i32:
     case INDEX_op_ld8u_i64:
         i1 = OPC_LBU;
@@ -2364,9 +2365,6 @@ static TCGConstraintSetIndex
 tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 {
     switch (op) {
-    case INDEX_op_goto_ptr:
-        return C_O0_I1(r);
-
     case INDEX_op_ld8u_i32:
     case INDEX_op_ld8s_i32:
     case INDEX_op_ld16u_i32:
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index d88ec8d690..a2a5b1e570 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -2843,6 +2843,13 @@ static void tcg_out_goto_tb(TCGContext *s, int which)
     set_jmp_reset_offset(s, which);
 }
 
+static void tcg_out_goto_ptr(TCGContext *s, TCGReg a0)
+{
+    tcg_out32(s, MTSPR | RS(a0) | CTR);
+    tcg_out32(s, ADDI | TAI(TCG_REG_R3, 0, 0));
+    tcg_out32(s, BCCTR | BO_ALWAYS);
+}
+
 void tb_target_set_jmp_target(const TranslationBlock *tb, int n,
                               uintptr_t jmp_rx, uintptr_t jmp_rw)
 {
@@ -3676,11 +3683,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const int const_args[TCG_MAX_OP_ARGS])
 {
     switch (opc) {
-    case INDEX_op_goto_ptr:
-        tcg_out32(s, MTSPR | RS(args[0]) | CTR);
-        tcg_out32(s, ADDI | TAI(TCG_REG_R3, 0, 0));
-        tcg_out32(s, BCCTR | BO_ALWAYS);
-        break;
     case INDEX_op_ld8u_i32:
     case INDEX_op_ld8u_i64:
         tcg_out_mem_long(s, LBZ, LBZX, args[0], args[1], args[2]);
@@ -4371,9 +4373,6 @@ static TCGConstraintSetIndex
 tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 {
     switch (op) {
-    case INDEX_op_goto_ptr:
-        return C_O0_I1(r);
-
     case INDEX_op_ld8u_i32:
     case INDEX_op_ld8s_i32:
     case INDEX_op_ld16u_i32:
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index 5d8d8213cb..c1bfd93569 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -1915,6 +1915,11 @@ static void tcg_out_goto_tb(TCGContext *s, int which)
     set_jmp_reset_offset(s, which);
 }
 
+static void tcg_out_goto_ptr(TCGContext *s, TCGReg a0)
+{
+    tcg_out_opc_imm(s, OPC_JALR, TCG_REG_ZERO, a0, 0);
+}
+
 void tb_target_set_jmp_target(const TranslationBlock *tb, int n,
                               uintptr_t jmp_rx, uintptr_t jmp_rw)
 {
@@ -2535,10 +2540,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     TCGArg a2 = args[2];
 
     switch (opc) {
-    case INDEX_op_goto_ptr:
-        tcg_out_opc_imm(s, OPC_JALR, TCG_REG_ZERO, a0, 0);
-        break;
-
     case INDEX_op_ld8u_i32:
     case INDEX_op_ld8u_i64:
         tcg_out_ldst(s, OPC_LBU, a0, a1, a2);
@@ -2824,9 +2825,6 @@ static TCGConstraintSetIndex
 tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 {
     switch (op) {
-    case INDEX_op_goto_ptr:
-        return C_O0_I1(r);
-
     case INDEX_op_ld8u_i32:
     case INDEX_op_ld8s_i32:
     case INDEX_op_ld16u_i32:
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index cdc61de4f8..2b2e00c609 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -2213,6 +2213,11 @@ static void tcg_out_goto_tb(TCGContext *s, int which)
     set_jmp_reset_offset(s, which);
 }
 
+static void tcg_out_goto_ptr(TCGContext *s, TCGReg a0)
+{
+    tcg_out_insn(s, RR, BCR, S390_CC_ALWAYS, a0);
+}
+
 void tb_target_set_jmp_target(const TranslationBlock *tb, int n,
                               uintptr_t jmp_rx, uintptr_t jmp_rw)
 {
@@ -3033,14 +3038,7 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
                        const int const_args[TCG_MAX_OP_ARGS])
 {
-    TCGArg a0;
-
     switch (opc) {
-    case INDEX_op_goto_ptr:
-        a0 = args[0];
-        tcg_out_insn(s, RR, BCR, S390_CC_ALWAYS, a0);
-        break;
-
     OP_32_64(ld8u):
         /* ??? LLC (RXY format) is only present with the extended-immediate
            facility, whereas LLGC is always present.  */
@@ -3567,9 +3565,6 @@ static TCGConstraintSetIndex
 tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 {
     switch (op) {
-    case INDEX_op_goto_ptr:
-        return C_O0_I1(r);
-
     case INDEX_op_ld8u_i32:
     case INDEX_op_ld8u_i64:
     case INDEX_op_ld8s_i32:
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index 0cc7567786..208b96487e 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -1300,6 +1300,12 @@ static void tcg_out_goto_tb(TCGContext *s, int which)
     }
 }
 
+static void tcg_out_goto_ptr(TCGContext *s, TCGReg a0)
+{
+    tcg_out_arithi(s, TCG_REG_G0, a0, 0, JMPL);
+    tcg_out_mov_delay(s, TCG_REG_TB, a0);
+}
+
 void tb_target_set_jmp_target(const TranslationBlock *tb, int n,
                               uintptr_t jmp_rx, uintptr_t jmp_rw)
 {
@@ -1968,11 +1974,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     a2 = args[2];
 
     switch (opc) {
-    case INDEX_op_goto_ptr:
-        tcg_out_arithi(s, TCG_REG_G0, a0, 0, JMPL);
-        tcg_out_mov_delay(s, TCG_REG_TB, a0);
-        break;
-
 #define OP_32_64(x)                             \
         glue(glue(case INDEX_op_, x), _i32):    \
         glue(glue(case INDEX_op_, x), _i64)
@@ -2039,9 +2040,6 @@ static TCGConstraintSetIndex
 tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 {
     switch (op) {
-    case INDEX_op_goto_ptr:
-        return C_O0_I1(r);
-
     case INDEX_op_ld8u_i32:
     case INDEX_op_ld8u_i64:
     case INDEX_op_ld8s_i32:
diff --git a/tcg/tcg.c b/tcg/tcg.c
index fbb1a43efc..5ab4f5e752 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -133,6 +133,7 @@ static void tcg_out_addi_ptr(TCGContext *s, TCGReg, TCGReg, tcg_target_long);
 static bool tcg_out_xchg(TCGContext *s, TCGType type, TCGReg r1, TCGReg r2);
 static void tcg_out_exit_tb(TCGContext *s, uintptr_t arg);
 static void tcg_out_goto_tb(TCGContext *s, int which);
+static void tcg_out_goto_ptr(TCGContext *s, TCGReg dest);
 static void tcg_out_mb(TCGContext *s, unsigned bar);
 static void tcg_out_br(TCGContext *s, TCGLabel *l);
 static void tcg_out_set_carry(TCGContext *s);
@@ -1137,6 +1138,10 @@ static const TCGOutOpUnary outop_extrl_i64_i32 = {
 };
 #endif
 
+static const TCGOutOp outop_goto_ptr = {
+    .static_constraint = C_O0_I1(r),
+};
+
 /*
  * Register V as the TCGOutOp for O.
  * This verifies that V is of type T, otherwise give a nice compiler error.
@@ -1198,6 +1203,8 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_subb1o, TCGOutOpAddSubCarry, outop_subbio),
     OUTOP(INDEX_op_xor, TCGOutOpBinary, outop_xor),
 
+    [INDEX_op_goto_ptr] = &outop_goto_ptr,
+
 #if TCG_TARGET_REG_BITS == 32
     OUTOP(INDEX_op_brcond2_i32, TCGOutOpBrcond2, outop_brcond2),
     OUTOP(INDEX_op_setcond2_i32, TCGOutOpSetcond2, outop_setcond2),
@@ -5823,6 +5830,11 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
         g_assert_not_reached();
 #endif
 
+    case INDEX_op_goto_ptr:
+        tcg_debug_assert(!const_args[0]);
+        tcg_out_goto_ptr(s, new_args[0]);
+        break;
+
     default:
         if (def->flags & TCG_OPF_VECTOR) {
             tcg_out_vec_op(s, op->opc, type - TCG_TYPE_V64,
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index 55a1a74fb6..d9cd62ed3d 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -40,9 +40,6 @@ static TCGConstraintSetIndex
 tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 {
     switch (op) {
-    case INDEX_op_goto_ptr:
-        return C_O0_I1(r);
-
     case INDEX_op_ld8u_i32:
     case INDEX_op_ld8s_i32:
     case INDEX_op_ld16u_i32:
@@ -534,6 +531,11 @@ static void tcg_out_goto_tb(TCGContext *s, int which)
     set_jmp_reset_offset(s, which);
 }
 
+static void tcg_out_goto_ptr(TCGContext *s, TCGReg a0)
+{
+    tcg_out_op_r(s, INDEX_op_goto_ptr, a0);
+}
+
 void tb_target_set_jmp_target(const TranslationBlock *tb, int n,
                               uintptr_t jmp_rx, uintptr_t jmp_rw)
 {
@@ -1146,10 +1148,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const int const_args[TCG_MAX_OP_ARGS])
 {
     switch (opc) {
-    case INDEX_op_goto_ptr:
-        tcg_out_op_r(s, opc, args[0]);
-        break;
-
     CASE_32_64(ld8u)
     CASE_32_64(ld8s)
     CASE_32_64(ld16u)

From 0de5c9d1f56332554c48152f535b47a1a0c2af7b Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 21 Jan 2025 20:44:42 -0800
Subject: [PATCH 0505/2760] tcg: Convert ld to TCGOutOpLoad

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target.c.inc     | 113 ++++++++++++++++-----------
 tcg/arm/tcg-target.c.inc         | 126 ++++++++++++++++---------------
 tcg/i386/tcg-target.c.inc        | 112 ++++++++++++++++-----------
 tcg/loongarch64/tcg-target.c.inc | 104 +++++++++++++++----------
 tcg/mips/tcg-target.c.inc        | 108 ++++++++++++++++----------
 tcg/ppc/tcg-target.c.inc         | 110 +++++++++++++++++----------
 tcg/riscv/tcg-target.c.inc       | 107 ++++++++++++++++----------
 tcg/s390x/tcg-target.c.inc       | 122 +++++++++++++++++-------------
 tcg/sparc64/tcg-target.c.inc     | 101 ++++++++++++++++---------
 tcg/tcg.c                        |  46 +++++++++++
 tcg/tci/tcg-target.c.inc         |  91 ++++++++++++++++------
 11 files changed, 721 insertions(+), 419 deletions(-)

diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index 2678e1f176..903a95ad7e 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -2770,6 +2770,74 @@ static const TCGOutOpExtract2 outop_extract2 = {
     .out_rrr = tgen_extract2,
 };
 
+static void tgen_ld8u(TCGContext *s, TCGType type, TCGReg dest,
+                      TCGReg base, ptrdiff_t offset)
+{
+    tcg_out_ldst(s, I3312_LDRB, dest, base, offset, 0);
+}
+
+static const TCGOutOpLoad outop_ld8u = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out = tgen_ld8u,
+};
+
+static void tgen_ld8s(TCGContext *s, TCGType type, TCGReg dest,
+                      TCGReg base, ptrdiff_t offset)
+{
+    AArch64Insn insn = type == TCG_TYPE_I32 ? I3312_LDRSBW : I3312_LDRSBX;
+    tcg_out_ldst(s, insn, dest, base, offset, 0);
+}
+
+static const TCGOutOpLoad outop_ld8s = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out = tgen_ld8s,
+};
+
+static void tgen_ld16u(TCGContext *s, TCGType type, TCGReg dest,
+                       TCGReg base, ptrdiff_t offset)
+{
+    tcg_out_ldst(s, I3312_LDRH, dest, base, offset, 1);
+}
+
+static const TCGOutOpLoad outop_ld16u = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out = tgen_ld16u,
+};
+
+static void tgen_ld16s(TCGContext *s, TCGType type, TCGReg dest,
+                       TCGReg base, ptrdiff_t offset)
+{
+    AArch64Insn insn = type == TCG_TYPE_I32 ? I3312_LDRSHW : I3312_LDRSHX;
+    tcg_out_ldst(s, insn, dest, base, offset, 1);
+}
+
+static const TCGOutOpLoad outop_ld16s = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out = tgen_ld16s,
+};
+
+static void tgen_ld32u(TCGContext *s, TCGType type, TCGReg dest,
+                       TCGReg base, ptrdiff_t offset)
+{
+    tcg_out_ldst(s, I3312_LDRW, dest, base, offset, 2);
+}
+
+static const TCGOutOpLoad outop_ld32u = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out = tgen_ld32u,
+};
+
+static void tgen_ld32s(TCGContext *s, TCGType type, TCGReg dest,
+                       TCGReg base, ptrdiff_t offset)
+{
+    tcg_out_ldst(s, I3312_LDRSWX, dest, base, offset, 2);
+}
+
+static const TCGOutOpLoad outop_ld32s = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out = tgen_ld32s,
+};
+
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType ext,
                        const TCGArg args[TCG_MAX_OP_ARGS],
                        const int const_args[TCG_MAX_OP_ARGS])
@@ -2780,37 +2848,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType ext,
     TCGArg a2 = args[2];
 
     switch (opc) {
-    case INDEX_op_ld8u_i32:
-    case INDEX_op_ld8u_i64:
-        tcg_out_ldst(s, I3312_LDRB, a0, a1, a2, 0);
-        break;
-    case INDEX_op_ld8s_i32:
-        tcg_out_ldst(s, I3312_LDRSBW, a0, a1, a2, 0);
-        break;
-    case INDEX_op_ld8s_i64:
-        tcg_out_ldst(s, I3312_LDRSBX, a0, a1, a2, 0);
-        break;
-    case INDEX_op_ld16u_i32:
-    case INDEX_op_ld16u_i64:
-        tcg_out_ldst(s, I3312_LDRH, a0, a1, a2, 1);
-        break;
-    case INDEX_op_ld16s_i32:
-        tcg_out_ldst(s, I3312_LDRSHW, a0, a1, a2, 1);
-        break;
-    case INDEX_op_ld16s_i64:
-        tcg_out_ldst(s, I3312_LDRSHX, a0, a1, a2, 1);
-        break;
-    case INDEX_op_ld_i32:
-    case INDEX_op_ld32u_i64:
-        tcg_out_ldst(s, I3312_LDRW, a0, a1, a2, 2);
-        break;
-    case INDEX_op_ld32s_i64:
-        tcg_out_ldst(s, I3312_LDRSWX, a0, a1, a2, 2);
-        break;
-    case INDEX_op_ld_i64:
-        tcg_out_ldst(s, I3312_LDRX, a0, a1, a2, 3);
-        break;
-
     case INDEX_op_st8_i32:
     case INDEX_op_st8_i64:
         tcg_out_ldst(s, I3312_STRB, a0, a1, a2, 0);
@@ -3294,20 +3331,6 @@ static TCGConstraintSetIndex
 tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 {
     switch (op) {
-    case INDEX_op_ld8u_i32:
-    case INDEX_op_ld8s_i32:
-    case INDEX_op_ld16u_i32:
-    case INDEX_op_ld16s_i32:
-    case INDEX_op_ld_i32:
-    case INDEX_op_ld8u_i64:
-    case INDEX_op_ld8s_i64:
-    case INDEX_op_ld16u_i64:
-    case INDEX_op_ld16s_i64:
-    case INDEX_op_ld32u_i64:
-    case INDEX_op_ld32s_i64:
-    case INDEX_op_ld_i64:
-        return C_O1_I1(r, r);
-
     case INDEX_op_st8_i32:
     case INDEX_op_st16_i32:
     case INDEX_op_st_i32:
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index 64be0a7e6d..2079dd3bdc 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -1084,26 +1084,6 @@ static void tcg_out_st32(TCGContext *s, ARMCond cond,
         tcg_out_st32_12(s, cond, rd, rn, offset);
 }
 
-static void tcg_out_ld16u(TCGContext *s, ARMCond cond,
-                          TCGReg rd, TCGReg rn, int32_t offset)
-{
-    if (offset > 0xff || offset < -0xff) {
-        tcg_out_movi32(s, cond, TCG_REG_TMP, offset);
-        tcg_out_ld16u_r(s, cond, rd, rn, TCG_REG_TMP);
-    } else
-        tcg_out_ld16u_8(s, cond, rd, rn, offset);
-}
-
-static void tcg_out_ld16s(TCGContext *s, ARMCond cond,
-                          TCGReg rd, TCGReg rn, int32_t offset)
-{
-    if (offset > 0xff || offset < -0xff) {
-        tcg_out_movi32(s, cond, TCG_REG_TMP, offset);
-        tcg_out_ld16s_r(s, cond, rd, rn, TCG_REG_TMP);
-    } else
-        tcg_out_ld16s_8(s, cond, rd, rn, offset);
-}
-
 static void tcg_out_st16(TCGContext *s, ARMCond cond,
                          TCGReg rd, TCGReg rn, int32_t offset)
 {
@@ -1114,26 +1094,6 @@ static void tcg_out_st16(TCGContext *s, ARMCond cond,
         tcg_out_st16_8(s, cond, rd, rn, offset);
 }
 
-static void tcg_out_ld8u(TCGContext *s, ARMCond cond,
-                         TCGReg rd, TCGReg rn, int32_t offset)
-{
-    if (offset > 0xfff || offset < -0xfff) {
-        tcg_out_movi32(s, cond, TCG_REG_TMP, offset);
-        tcg_out_ld8_r(s, cond, rd, rn, TCG_REG_TMP);
-    } else
-        tcg_out_ld8_12(s, cond, rd, rn, offset);
-}
-
-static void tcg_out_ld8s(TCGContext *s, ARMCond cond,
-                         TCGReg rd, TCGReg rn, int32_t offset)
-{
-    if (offset > 0xff || offset < -0xff) {
-        tcg_out_movi32(s, cond, TCG_REG_TMP, offset);
-        tcg_out_ld8s_r(s, cond, rd, rn, TCG_REG_TMP);
-    } else
-        tcg_out_ld8s_8(s, cond, rd, rn, offset);
-}
-
 static void tcg_out_st8(TCGContext *s, ARMCond cond,
                         TCGReg rd, TCGReg rn, int32_t offset)
 {
@@ -2524,26 +2484,75 @@ static const TCGOutOpExtract2 outop_extract2 = {
     .out_rrr = tgen_extract2,
 };
 
+static void tgen_ld8u(TCGContext *s, TCGType type, TCGReg rd,
+                      TCGReg rn, ptrdiff_t offset)
+{
+    if (offset > 0xfff || offset < -0xfff) {
+        tcg_out_movi32(s, COND_AL, TCG_REG_TMP, offset);
+        tcg_out_ld8_r(s, COND_AL, rd, rn, TCG_REG_TMP);
+    } else {
+        tcg_out_ld8_12(s, COND_AL, rd, rn, offset);
+    }
+}
+
+static const TCGOutOpLoad outop_ld8u = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out = tgen_ld8u,
+};
+
+static void tgen_ld8s(TCGContext *s, TCGType type, TCGReg rd,
+                      TCGReg rn, ptrdiff_t offset)
+{
+    if (offset > 0xff || offset < -0xff) {
+        tcg_out_movi32(s, COND_AL, TCG_REG_TMP, offset);
+        tcg_out_ld8s_r(s, COND_AL, rd, rn, TCG_REG_TMP);
+    } else {
+        tcg_out_ld8s_8(s, COND_AL, rd, rn, offset);
+    }
+}
+
+static const TCGOutOpLoad outop_ld8s = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out = tgen_ld8s,
+};
+
+static void tgen_ld16u(TCGContext *s, TCGType type, TCGReg rd,
+                       TCGReg rn, ptrdiff_t offset)
+{
+    if (offset > 0xff || offset < -0xff) {
+        tcg_out_movi32(s, COND_AL, TCG_REG_TMP, offset);
+        tcg_out_ld16u_r(s, COND_AL, rd, rn, TCG_REG_TMP);
+    } else {
+        tcg_out_ld16u_8(s, COND_AL, rd, rn, offset);
+    }
+}
+
+static const TCGOutOpLoad outop_ld16u = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out = tgen_ld16u,
+};
+
+static void tgen_ld16s(TCGContext *s, TCGType type, TCGReg rd,
+                       TCGReg rn, ptrdiff_t offset)
+{
+    if (offset > 0xff || offset < -0xff) {
+        tcg_out_movi32(s, COND_AL, TCG_REG_TMP, offset);
+        tcg_out_ld16s_r(s, COND_AL, rd, rn, TCG_REG_TMP);
+    } else {
+        tcg_out_ld16s_8(s, COND_AL, rd, rn, offset);
+    }
+}
+
+static const TCGOutOpLoad outop_ld16s = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out = tgen_ld16s,
+};
+
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
                        const int const_args[TCG_MAX_OP_ARGS])
 {
     switch (opc) {
-    case INDEX_op_ld8u_i32:
-        tcg_out_ld8u(s, COND_AL, args[0], args[1], args[2]);
-        break;
-    case INDEX_op_ld8s_i32:
-        tcg_out_ld8s(s, COND_AL, args[0], args[1], args[2]);
-        break;
-    case INDEX_op_ld16u_i32:
-        tcg_out_ld16u(s, COND_AL, args[0], args[1], args[2]);
-        break;
-    case INDEX_op_ld16s_i32:
-        tcg_out_ld16s(s, COND_AL, args[0], args[1], args[2]);
-        break;
-    case INDEX_op_ld_i32:
-        tcg_out_ld32u(s, COND_AL, args[0], args[1], args[2]);
-        break;
     case INDEX_op_st8_i32:
         tcg_out_st8(s, COND_AL, args[0], args[1], args[2]);
         break;
@@ -2580,13 +2589,6 @@ static TCGConstraintSetIndex
 tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 {
     switch (op) {
-    case INDEX_op_ld8u_i32:
-    case INDEX_op_ld8s_i32:
-    case INDEX_op_ld16u_i32:
-    case INDEX_op_ld16s_i32:
-    case INDEX_op_ld_i32:
-        return C_O1_I1(r, r);
-
     case INDEX_op_st8_i32:
     case INDEX_op_st16_i32:
     case INDEX_op_st_i32:
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index 5ea4a44264..d16ddcb940 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -3419,13 +3419,81 @@ static const TCGOutOpExtract2 outop_extract2 = {
     .out_rrr = tgen_extract2,
 };
 
+static void tgen_ld8u(TCGContext *s, TCGType type, TCGReg dest,
+                      TCGReg base, ptrdiff_t offset)
+{
+    tcg_out_modrm_offset(s, OPC_MOVZBL, dest, base, offset);
+}
+
+static const TCGOutOpLoad outop_ld8u = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out = tgen_ld8u,
+};
+
+static void tgen_ld8s(TCGContext *s, TCGType type, TCGReg dest,
+                      TCGReg base, ptrdiff_t offset)
+{
+    int rexw = type == TCG_TYPE_I32 ? 0 : P_REXW;
+    tcg_out_modrm_offset(s, OPC_MOVSBL + rexw, dest, base, offset);
+}
+
+static const TCGOutOpLoad outop_ld8s = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out = tgen_ld8s,
+};
+
+static void tgen_ld16u(TCGContext *s, TCGType type, TCGReg dest,
+                       TCGReg base, ptrdiff_t offset)
+{
+    tcg_out_modrm_offset(s, OPC_MOVZWL, dest, base, offset);
+}
+
+static const TCGOutOpLoad outop_ld16u = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out = tgen_ld16u,
+};
+
+static void tgen_ld16s(TCGContext *s, TCGType type, TCGReg dest,
+                       TCGReg base, ptrdiff_t offset)
+{
+    int rexw = type == TCG_TYPE_I32 ? 0 : P_REXW;
+    tcg_out_modrm_offset(s, OPC_MOVSWL + rexw, dest, base, offset);
+}
+
+static const TCGOutOpLoad outop_ld16s = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out = tgen_ld16s,
+};
+
+#if TCG_TARGET_REG_BITS == 64
+static void tgen_ld32u(TCGContext *s, TCGType type, TCGReg dest,
+                       TCGReg base, ptrdiff_t offset)
+{
+    tcg_out_modrm_offset(s, OPC_MOVL_GvEv, dest, base, offset);
+}
+
+static const TCGOutOpLoad outop_ld32u = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out = tgen_ld32u,
+};
+
+static void tgen_ld32s(TCGContext *s, TCGType type, TCGReg dest,
+                       TCGReg base, ptrdiff_t offset)
+{
+    tcg_out_modrm_offset(s, OPC_MOVSLQ, dest, base, offset);
+}
+
+static const TCGOutOpLoad outop_ld32s = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out = tgen_ld32s,
+};
+#endif
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
                        const int const_args[TCG_MAX_OP_ARGS])
 {
     TCGArg a0, a1, a2;
-    int rexw;
 
 #if TCG_TARGET_REG_BITS == 64
 # define OP_32_64(x) \
@@ -3440,30 +3508,8 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     a0 = args[0];
     a1 = args[1];
     a2 = args[2];
-    rexw = type == TCG_TYPE_I32 ? 0 : P_REXW;
 
     switch (opc) {
-    OP_32_64(ld8u):
-        /* Note that we can ignore REXW for the zero-extend to 64-bit.  */
-        tcg_out_modrm_offset(s, OPC_MOVZBL, a0, a1, a2);
-        break;
-    OP_32_64(ld8s):
-        tcg_out_modrm_offset(s, OPC_MOVSBL + rexw, a0, a1, a2);
-        break;
-    OP_32_64(ld16u):
-        /* Note that we can ignore REXW for the zero-extend to 64-bit.  */
-        tcg_out_modrm_offset(s, OPC_MOVZWL, a0, a1, a2);
-        break;
-    OP_32_64(ld16s):
-        tcg_out_modrm_offset(s, OPC_MOVSWL + rexw, a0, a1, a2);
-        break;
-#if TCG_TARGET_REG_BITS == 64
-    case INDEX_op_ld32u_i64:
-#endif
-    case INDEX_op_ld_i32:
-        tcg_out_ld(s, TCG_TYPE_I32, a0, a1, a2);
-        break;
-
     OP_32_64(st8):
         if (const_args[0]) {
             tcg_out_modrm_offset(s, OPC_MOVB_EvIz, 0, a1, a2);
@@ -3524,12 +3570,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         break;
 
 #if TCG_TARGET_REG_BITS == 64
-    case INDEX_op_ld32s_i64:
-        tcg_out_modrm_offset(s, OPC_MOVSLQ, a0, a1, a2);
-        break;
-    case INDEX_op_ld_i64:
-        tcg_out_ld(s, TCG_TYPE_I64, a0, a1, a2);
-        break;
     case INDEX_op_st_i64:
         if (const_args[0]) {
             tcg_out_modrm_offset(s, OPC_MOVL_EvIz | P_REXW, 0, a1, a2);
@@ -4095,20 +4135,6 @@ static TCGConstraintSetIndex
 tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 {
     switch (op) {
-    case INDEX_op_ld8u_i32:
-    case INDEX_op_ld8u_i64:
-    case INDEX_op_ld8s_i32:
-    case INDEX_op_ld8s_i64:
-    case INDEX_op_ld16u_i32:
-    case INDEX_op_ld16u_i64:
-    case INDEX_op_ld16s_i32:
-    case INDEX_op_ld16s_i64:
-    case INDEX_op_ld_i32:
-    case INDEX_op_ld32u_i64:
-    case INDEX_op_ld32s_i64:
-    case INDEX_op_ld_i64:
-        return C_O1_I1(r, r);
-
     case INDEX_op_st8_i32:
     case INDEX_op_st8_i64:
         return C_O0_I2(qi, r);
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index d89c27c67f..66555b8982 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -1917,6 +1917,71 @@ static const TCGOutOpExtract2 outop_extract2 = {
     .base.static_constraint = C_NotImplemented,
 };
 
+static void tgen_ld8u(TCGContext *s, TCGType type, TCGReg dest,
+                      TCGReg base, ptrdiff_t offset)
+{
+    tcg_out_ldst(s, OPC_LD_BU, dest, base, offset);
+}
+
+static const TCGOutOpLoad outop_ld8u = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out = tgen_ld8u,
+};
+
+static void tgen_ld8s(TCGContext *s, TCGType type, TCGReg dest,
+                      TCGReg base, ptrdiff_t offset)
+{
+    tcg_out_ldst(s, OPC_LD_B, dest, base, offset);
+}
+
+static const TCGOutOpLoad outop_ld8s = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out = tgen_ld8s,
+};
+
+static void tgen_ld16u(TCGContext *s, TCGType type, TCGReg dest,
+                       TCGReg base, ptrdiff_t offset)
+{
+    tcg_out_ldst(s, OPC_LD_HU, dest, base, offset);
+}
+
+static const TCGOutOpLoad outop_ld16u = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out = tgen_ld16u,
+};
+
+static void tgen_ld16s(TCGContext *s, TCGType type, TCGReg dest,
+                       TCGReg base, ptrdiff_t offset)
+{
+    tcg_out_ldst(s, OPC_LD_H, dest, base, offset);
+}
+
+static const TCGOutOpLoad outop_ld16s = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out = tgen_ld16s,
+};
+
+static void tgen_ld32u(TCGContext *s, TCGType type, TCGReg dest,
+                       TCGReg base, ptrdiff_t offset)
+{
+    tcg_out_ldst(s, OPC_LD_WU, dest, base, offset);
+}
+
+static const TCGOutOpLoad outop_ld32u = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out = tgen_ld32u,
+};
+
+static void tgen_ld32s(TCGContext *s, TCGType type, TCGReg dest,
+                       TCGReg base, ptrdiff_t offset)
+{
+    tcg_out_ldst(s, OPC_LD_W, dest, base, offset);
+}
+
+static const TCGOutOpLoad outop_ld32s = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out = tgen_ld32s,
+};
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -1928,33 +1993,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     TCGArg a3 = args[3];
 
     switch (opc) {
-    case INDEX_op_ld8s_i32:
-    case INDEX_op_ld8s_i64:
-        tcg_out_ldst(s, OPC_LD_B, a0, a1, a2);
-        break;
-    case INDEX_op_ld8u_i32:
-    case INDEX_op_ld8u_i64:
-        tcg_out_ldst(s, OPC_LD_BU, a0, a1, a2);
-        break;
-    case INDEX_op_ld16s_i32:
-    case INDEX_op_ld16s_i64:
-        tcg_out_ldst(s, OPC_LD_H, a0, a1, a2);
-        break;
-    case INDEX_op_ld16u_i32:
-    case INDEX_op_ld16u_i64:
-        tcg_out_ldst(s, OPC_LD_HU, a0, a1, a2);
-        break;
-    case INDEX_op_ld_i32:
-    case INDEX_op_ld32s_i64:
-        tcg_out_ldst(s, OPC_LD_W, a0, a1, a2);
-        break;
-    case INDEX_op_ld32u_i64:
-        tcg_out_ldst(s, OPC_LD_WU, a0, a1, a2);
-        break;
-    case INDEX_op_ld_i64:
-        tcg_out_ldst(s, OPC_LD_D, a0, a1, a2);
-        break;
-
     case INDEX_op_st8_i32:
     case INDEX_op_st8_i64:
         tcg_out_ldst(s, OPC_ST_B, a0, a1, a2);
@@ -2509,18 +2547,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_qemu_st_i128:
         return C_O0_I3(r, r, r);
 
-    case INDEX_op_ld8s_i32:
-    case INDEX_op_ld8s_i64:
-    case INDEX_op_ld8u_i32:
-    case INDEX_op_ld8u_i64:
-    case INDEX_op_ld16s_i32:
-    case INDEX_op_ld16s_i64:
-    case INDEX_op_ld16u_i32:
-    case INDEX_op_ld16u_i64:
-    case INDEX_op_ld32s_i64:
-    case INDEX_op_ld32u_i64:
-    case INDEX_op_ld_i32:
-    case INDEX_op_ld_i64:
     case INDEX_op_qemu_ld_i32:
     case INDEX_op_qemu_ld_i64:
         return C_O1_I1(r, r);
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index 9455a0a17b..21ed11b78d 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -2274,6 +2274,74 @@ static const TCGOutOpExtract2 outop_extract2 = {
     .base.static_constraint = C_NotImplemented,
 };
 
+static void tgen_ld8u(TCGContext *s, TCGType type, TCGReg dest,
+                      TCGReg base, ptrdiff_t offset)
+{
+    tcg_out_ldst(s, OPC_LBU, dest, base, offset);
+}
+
+static const TCGOutOpLoad outop_ld8u = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out = tgen_ld8u,
+};
+
+static void tgen_ld8s(TCGContext *s, TCGType type, TCGReg dest,
+                      TCGReg base, ptrdiff_t offset)
+{
+    tcg_out_ldst(s, OPC_LB, dest, base, offset);
+}
+
+static const TCGOutOpLoad outop_ld8s = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out = tgen_ld8s,
+};
+
+static void tgen_ld16u(TCGContext *s, TCGType type, TCGReg dest,
+                       TCGReg base, ptrdiff_t offset)
+{
+    tcg_out_ldst(s, OPC_LHU, dest, base, offset);
+}
+
+static const TCGOutOpLoad outop_ld16u = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out = tgen_ld16u,
+};
+
+static void tgen_ld16s(TCGContext *s, TCGType type, TCGReg dest,
+                       TCGReg base, ptrdiff_t offset)
+{
+    tcg_out_ldst(s, OPC_LH, dest, base, offset);
+}
+
+static const TCGOutOpLoad outop_ld16s = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out = tgen_ld16s,
+};
+
+#if TCG_TARGET_REG_BITS == 64
+static void tgen_ld32u(TCGContext *s, TCGType type, TCGReg dest,
+                       TCGReg base, ptrdiff_t offset)
+{
+    tcg_out_ldst(s, OPC_LWU, dest, base, offset);
+}
+
+static const TCGOutOpLoad outop_ld32u = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out = tgen_ld32u,
+};
+
+static void tgen_ld32s(TCGContext *s, TCGType type, TCGReg dest,
+                       TCGReg base, ptrdiff_t offset)
+{
+    tcg_out_ldst(s, OPC_LW, dest, base, offset);
+}
+
+static const TCGOutOpLoad outop_ld32s = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out = tgen_ld32s,
+};
+#endif
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -2287,32 +2355,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     a2 = args[2];
 
     switch (opc) {
-    case INDEX_op_ld8u_i32:
-    case INDEX_op_ld8u_i64:
-        i1 = OPC_LBU;
-        goto do_ldst;
-    case INDEX_op_ld8s_i32:
-    case INDEX_op_ld8s_i64:
-        i1 = OPC_LB;
-        goto do_ldst;
-    case INDEX_op_ld16u_i32:
-    case INDEX_op_ld16u_i64:
-        i1 = OPC_LHU;
-        goto do_ldst;
-    case INDEX_op_ld16s_i32:
-    case INDEX_op_ld16s_i64:
-        i1 = OPC_LH;
-        goto do_ldst;
-    case INDEX_op_ld_i32:
-    case INDEX_op_ld32s_i64:
-        i1 = OPC_LW;
-        goto do_ldst;
-    case INDEX_op_ld32u_i64:
-        i1 = OPC_LWU;
-        goto do_ldst;
-    case INDEX_op_ld_i64:
-        i1 = OPC_LD;
-        goto do_ldst;
     case INDEX_op_st8_i32:
     case INDEX_op_st8_i64:
         i1 = OPC_SB;
@@ -2365,20 +2407,6 @@ static TCGConstraintSetIndex
 tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 {
     switch (op) {
-    case INDEX_op_ld8u_i32:
-    case INDEX_op_ld8s_i32:
-    case INDEX_op_ld16u_i32:
-    case INDEX_op_ld16s_i32:
-    case INDEX_op_ld_i32:
-    case INDEX_op_ld8u_i64:
-    case INDEX_op_ld8s_i64:
-    case INDEX_op_ld16u_i64:
-    case INDEX_op_ld16s_i64:
-    case INDEX_op_ld32s_i64:
-    case INDEX_op_ld32u_i64:
-    case INDEX_op_ld_i64:
-        return C_O1_I1(r, r);
-
     case INDEX_op_st8_i32:
     case INDEX_op_st16_i32:
     case INDEX_op_st_i32:
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index a2a5b1e570..275c5a90a5 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -3677,39 +3677,81 @@ static const TCGOutOpExtract2 outop_extract2 = {
     .base.static_constraint = C_NotImplemented,
 };
 
+static void tgen_ld8u(TCGContext *s, TCGType type, TCGReg dest,
+                      TCGReg base, ptrdiff_t offset)
+{
+    tcg_out_mem_long(s, LBZ, LBZX, dest, base, offset);
+}
+
+static const TCGOutOpLoad outop_ld8u = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out = tgen_ld8u,
+};
+
+static void tgen_ld8s(TCGContext *s, TCGType type, TCGReg dest,
+                      TCGReg base, ptrdiff_t offset)
+{
+    tgen_ld8u(s, type, dest, base, offset);
+    tcg_out_ext8s(s, type, dest, dest);
+}
+
+static const TCGOutOpLoad outop_ld8s = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out = tgen_ld8s,
+};
+
+static void tgen_ld16u(TCGContext *s, TCGType type, TCGReg dest,
+                       TCGReg base, ptrdiff_t offset)
+{
+    tcg_out_mem_long(s, LHZ, LHZX, dest, base, offset);
+}
+
+static const TCGOutOpLoad outop_ld16u = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out = tgen_ld16u,
+};
+
+static void tgen_ld16s(TCGContext *s, TCGType type, TCGReg dest,
+                       TCGReg base, ptrdiff_t offset)
+{
+    tcg_out_mem_long(s, LHA, LHAX, dest, base, offset);
+}
+
+static const TCGOutOpLoad outop_ld16s = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out = tgen_ld16s,
+};
+
+#if TCG_TARGET_REG_BITS == 64
+static void tgen_ld32u(TCGContext *s, TCGType type, TCGReg dest,
+                       TCGReg base, ptrdiff_t offset)
+{
+    tcg_out_mem_long(s, LWZ, LWZX, dest, base, offset);
+}
+
+static const TCGOutOpLoad outop_ld32u = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out = tgen_ld32u,
+};
+
+static void tgen_ld32s(TCGContext *s, TCGType type, TCGReg dest,
+                       TCGReg base, ptrdiff_t offset)
+{
+    tcg_out_mem_long(s, LWA, LWAX, dest, base, offset);
+}
+
+static const TCGOutOpLoad outop_ld32s = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out = tgen_ld32s,
+};
+#endif
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
                        const int const_args[TCG_MAX_OP_ARGS])
 {
     switch (opc) {
-    case INDEX_op_ld8u_i32:
-    case INDEX_op_ld8u_i64:
-        tcg_out_mem_long(s, LBZ, LBZX, args[0], args[1], args[2]);
-        break;
-    case INDEX_op_ld8s_i32:
-    case INDEX_op_ld8s_i64:
-        tcg_out_mem_long(s, LBZ, LBZX, args[0], args[1], args[2]);
-        tcg_out_ext8s(s, TCG_TYPE_REG, args[0], args[0]);
-        break;
-    case INDEX_op_ld16u_i32:
-    case INDEX_op_ld16u_i64:
-        tcg_out_mem_long(s, LHZ, LHZX, args[0], args[1], args[2]);
-        break;
-    case INDEX_op_ld16s_i32:
-    case INDEX_op_ld16s_i64:
-        tcg_out_mem_long(s, LHA, LHAX, args[0], args[1], args[2]);
-        break;
-    case INDEX_op_ld_i32:
-    case INDEX_op_ld32u_i64:
-        tcg_out_mem_long(s, LWZ, LWZX, args[0], args[1], args[2]);
-        break;
-    case INDEX_op_ld32s_i64:
-        tcg_out_mem_long(s, LWA, LWAX, args[0], args[1], args[2]);
-        break;
-    case INDEX_op_ld_i64:
-        tcg_out_mem_long(s, LD, LDX, args[0], args[1], args[2]);
-        break;
     case INDEX_op_st8_i32:
     case INDEX_op_st8_i64:
         tcg_out_mem_long(s, STB, STBX, args[0], args[1], args[2]);
@@ -4373,20 +4415,6 @@ static TCGConstraintSetIndex
 tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 {
     switch (op) {
-    case INDEX_op_ld8u_i32:
-    case INDEX_op_ld8s_i32:
-    case INDEX_op_ld16u_i32:
-    case INDEX_op_ld16s_i32:
-    case INDEX_op_ld_i32:
-    case INDEX_op_ld8u_i64:
-    case INDEX_op_ld8s_i64:
-    case INDEX_op_ld16u_i64:
-    case INDEX_op_ld16s_i64:
-    case INDEX_op_ld32u_i64:
-    case INDEX_op_ld32s_i64:
-    case INDEX_op_ld_i64:
-        return C_O1_I1(r, r);
-
     case INDEX_op_st8_i32:
     case INDEX_op_st16_i32:
     case INDEX_op_st_i32:
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index c1bfd93569..5b987c930f 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -2530,6 +2530,72 @@ static const TCGOutOpExtract2 outop_extract2 = {
     .base.static_constraint = C_NotImplemented,
 };
 
+static void tgen_ld8u(TCGContext *s, TCGType type, TCGReg dest,
+                      TCGReg base, ptrdiff_t offset)
+{
+    tcg_out_ldst(s, OPC_LBU, dest, base, offset);
+}
+
+static const TCGOutOpLoad outop_ld8u = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out = tgen_ld8u,
+};
+
+static void tgen_ld8s(TCGContext *s, TCGType type, TCGReg dest,
+                      TCGReg base, ptrdiff_t offset)
+{
+    tcg_out_ldst(s, OPC_LB, dest, base, offset);
+}
+
+static const TCGOutOpLoad outop_ld8s = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out = tgen_ld8s,
+};
+
+static void tgen_ld16u(TCGContext *s, TCGType type, TCGReg dest,
+                       TCGReg base, ptrdiff_t offset)
+{
+    tcg_out_ldst(s, OPC_LHU, dest, base, offset);
+}
+
+static const TCGOutOpLoad outop_ld16u = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out = tgen_ld16u,
+};
+
+static void tgen_ld16s(TCGContext *s, TCGType type, TCGReg dest,
+                       TCGReg base, ptrdiff_t offset)
+{
+    tcg_out_ldst(s, OPC_LH, dest, base, offset);
+}
+
+static const TCGOutOpLoad outop_ld16s = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out = tgen_ld16s,
+};
+
+static void tgen_ld32u(TCGContext *s, TCGType type, TCGReg dest,
+                       TCGReg base, ptrdiff_t offset)
+{
+    tcg_out_ldst(s, OPC_LWU, dest, base, offset);
+}
+
+static const TCGOutOpLoad outop_ld32u = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out = tgen_ld32u,
+};
+
+static void tgen_ld32s(TCGContext *s, TCGType type, TCGReg dest,
+                       TCGReg base, ptrdiff_t offset)
+{
+    tcg_out_ldst(s, OPC_LW, dest, base, offset);
+}
+
+static const TCGOutOpLoad outop_ld32s = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out = tgen_ld32s,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -2540,33 +2606,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     TCGArg a2 = args[2];
 
     switch (opc) {
-    case INDEX_op_ld8u_i32:
-    case INDEX_op_ld8u_i64:
-        tcg_out_ldst(s, OPC_LBU, a0, a1, a2);
-        break;
-    case INDEX_op_ld8s_i32:
-    case INDEX_op_ld8s_i64:
-        tcg_out_ldst(s, OPC_LB, a0, a1, a2);
-        break;
-    case INDEX_op_ld16u_i32:
-    case INDEX_op_ld16u_i64:
-        tcg_out_ldst(s, OPC_LHU, a0, a1, a2);
-        break;
-    case INDEX_op_ld16s_i32:
-    case INDEX_op_ld16s_i64:
-        tcg_out_ldst(s, OPC_LH, a0, a1, a2);
-        break;
-    case INDEX_op_ld32u_i64:
-        tcg_out_ldst(s, OPC_LWU, a0, a1, a2);
-        break;
-    case INDEX_op_ld_i32:
-    case INDEX_op_ld32s_i64:
-        tcg_out_ldst(s, OPC_LW, a0, a1, a2);
-        break;
-    case INDEX_op_ld_i64:
-        tcg_out_ldst(s, OPC_LD, a0, a1, a2);
-        break;
-
     case INDEX_op_st8_i32:
     case INDEX_op_st8_i64:
         tcg_out_ldst(s, OPC_SB, a0, a1, a2);
@@ -2825,20 +2864,6 @@ static TCGConstraintSetIndex
 tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 {
     switch (op) {
-    case INDEX_op_ld8u_i32:
-    case INDEX_op_ld8s_i32:
-    case INDEX_op_ld16u_i32:
-    case INDEX_op_ld16s_i32:
-    case INDEX_op_ld_i32:
-    case INDEX_op_ld8u_i64:
-    case INDEX_op_ld8s_i64:
-    case INDEX_op_ld16u_i64:
-    case INDEX_op_ld16s_i64:
-    case INDEX_op_ld32s_i64:
-    case INDEX_op_ld32u_i64:
-    case INDEX_op_ld_i64:
-        return C_O1_I1(r, r);
-
     case INDEX_op_st8_i32:
     case INDEX_op_st16_i32:
     case INDEX_op_st_i32:
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index 2b2e00c609..fe7665b21d 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -3030,6 +3030,76 @@ static void tcg_out_mb(TCGContext *s, unsigned a0)
     }
 }
 
+static void tgen_ld8u(TCGContext *s, TCGType type, TCGReg dest,
+                      TCGReg base, ptrdiff_t offset)
+{
+    tcg_out_mem(s, 0, RXY_LLGC, dest, base, TCG_REG_NONE, offset);
+}
+
+static const TCGOutOpLoad outop_ld8u = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out = tgen_ld8u,
+};
+
+static void tgen_ld8s(TCGContext *s, TCGType type, TCGReg dest,
+                      TCGReg base, ptrdiff_t offset)
+{
+    tcg_out_mem(s, 0, RXY_LGB, dest, base, TCG_REG_NONE, offset);
+}
+
+static const TCGOutOpLoad outop_ld8s = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out = tgen_ld8s,
+};
+
+static void tgen_ld16u(TCGContext *s, TCGType type, TCGReg dest,
+                       TCGReg base, ptrdiff_t offset)
+{
+    tcg_out_mem(s, 0, RXY_LLGH, dest, base, TCG_REG_NONE, offset);
+}
+
+static const TCGOutOpLoad outop_ld16u = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out = tgen_ld16u,
+};
+
+static void tgen_ld16s(TCGContext *s, TCGType type, TCGReg dest,
+                       TCGReg base, ptrdiff_t offset)
+{
+    if (type == TCG_TYPE_I32) {
+        tcg_out_mem(s, RX_LH, RXY_LHY, dest, base, TCG_REG_NONE, offset);
+    } else {
+        tcg_out_mem(s, 0, RXY_LGH, dest, base, TCG_REG_NONE, offset);
+    }
+}
+
+static const TCGOutOpLoad outop_ld16s = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out = tgen_ld16s,
+};
+
+static void tgen_ld32u(TCGContext *s, TCGType type, TCGReg dest,
+                       TCGReg base, ptrdiff_t offset)
+{
+    tcg_out_mem(s, 0, RXY_LLGF, dest, base, TCG_REG_NONE, offset);
+}
+
+static const TCGOutOpLoad outop_ld32u = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out = tgen_ld32u,
+};
+
+static void tgen_ld32s(TCGContext *s, TCGType type, TCGReg dest,
+                       TCGReg base, ptrdiff_t offset)
+{
+    tcg_out_mem(s, 0, RXY_LGF, dest, base, TCG_REG_NONE, offset);
+}
+
+static const TCGOutOpLoad outop_ld32s = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out = tgen_ld32s,
+};
+
 # define OP_32_64(x) \
         case glue(glue(INDEX_op_,x),_i32): \
         case glue(glue(INDEX_op_,x),_i64)
@@ -3039,31 +3109,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const int const_args[TCG_MAX_OP_ARGS])
 {
     switch (opc) {
-    OP_32_64(ld8u):
-        /* ??? LLC (RXY format) is only present with the extended-immediate
-           facility, whereas LLGC is always present.  */
-        tcg_out_mem(s, 0, RXY_LLGC, args[0], args[1], TCG_REG_NONE, args[2]);
-        break;
-
-    OP_32_64(ld8s):
-        /* ??? LB is no smaller than LGB, so no point to using it.  */
-        tcg_out_mem(s, 0, RXY_LGB, args[0], args[1], TCG_REG_NONE, args[2]);
-        break;
-
-    OP_32_64(ld16u):
-        /* ??? LLH (RXY format) is only present with the extended-immediate
-           facility, whereas LLGH is always present.  */
-        tcg_out_mem(s, 0, RXY_LLGH, args[0], args[1], TCG_REG_NONE, args[2]);
-        break;
-
-    case INDEX_op_ld16s_i32:
-        tcg_out_mem(s, RX_LH, RXY_LHY, args[0], args[1], TCG_REG_NONE, args[2]);
-        break;
-
-    case INDEX_op_ld_i32:
-        tcg_out_ld(s, TCG_TYPE_I32, args[0], args[1], args[2]);
-        break;
-
     OP_32_64(st8):
         tcg_out_mem(s, RX_STC, RXY_STCY, args[0], args[1],
                     TCG_REG_NONE, args[2]);
@@ -3097,19 +3142,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_qemu_ldst_i128(s, args[0], args[1], args[2], args[3], false);
         break;
 
-    case INDEX_op_ld16s_i64:
-        tcg_out_mem(s, 0, RXY_LGH, args[0], args[1], TCG_REG_NONE, args[2]);
-        break;
-    case INDEX_op_ld32u_i64:
-        tcg_out_mem(s, 0, RXY_LLGF, args[0], args[1], TCG_REG_NONE, args[2]);
-        break;
-    case INDEX_op_ld32s_i64:
-        tcg_out_mem(s, 0, RXY_LGF, args[0], args[1], TCG_REG_NONE, args[2]);
-        break;
-    case INDEX_op_ld_i64:
-        tcg_out_ld(s, TCG_TYPE_I64, args[0], args[1], args[2]);
-        break;
-
     case INDEX_op_st32_i64:
         tcg_out_st(s, TCG_TYPE_I32, args[0], args[1], args[2]);
         break;
@@ -3565,20 +3597,6 @@ static TCGConstraintSetIndex
 tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 {
     switch (op) {
-    case INDEX_op_ld8u_i32:
-    case INDEX_op_ld8u_i64:
-    case INDEX_op_ld8s_i32:
-    case INDEX_op_ld8s_i64:
-    case INDEX_op_ld16u_i32:
-    case INDEX_op_ld16u_i64:
-    case INDEX_op_ld16s_i32:
-    case INDEX_op_ld16s_i64:
-    case INDEX_op_ld_i32:
-    case INDEX_op_ld32u_i64:
-    case INDEX_op_ld32s_i64:
-    case INDEX_op_ld_i64:
-        return C_O1_I1(r, r);
-
     case INDEX_op_st8_i32:
     case INDEX_op_st8_i64:
     case INDEX_op_st16_i32:
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index 208b96487e..59a737dde4 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -1962,6 +1962,73 @@ static const TCGOutOpExtract2 outop_extract2 = {
     .base.static_constraint = C_NotImplemented,
 };
 
+static void tgen_ld8u(TCGContext *s, TCGType type, TCGReg dest,
+                      TCGReg base, ptrdiff_t offset)
+{
+    tcg_out_ldst(s, dest, base, offset, LDUB);
+}
+
+static const TCGOutOpLoad outop_ld8u = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out = tgen_ld8u,
+};
+
+static void tgen_ld8s(TCGContext *s, TCGType type, TCGReg dest,
+                      TCGReg base, ptrdiff_t offset)
+{
+    tcg_out_ldst(s, dest, base, offset, LDSB);
+}
+
+static const TCGOutOpLoad outop_ld8s = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out = tgen_ld8s,
+};
+
+static void tgen_ld16u(TCGContext *s, TCGType type, TCGReg dest,
+                       TCGReg base, ptrdiff_t offset)
+{
+    tcg_out_ldst(s, dest, base, offset, LDUH);
+}
+
+static const TCGOutOpLoad outop_ld16u = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out = tgen_ld16u,
+};
+
+static void tgen_ld16s(TCGContext *s, TCGType type, TCGReg dest,
+                       TCGReg base, ptrdiff_t offset)
+{
+    tcg_out_ldst(s, dest, base, offset, LDSH);
+}
+
+static const TCGOutOpLoad outop_ld16s = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out = tgen_ld16s,
+};
+
+static void tgen_ld32u(TCGContext *s, TCGType type, TCGReg dest,
+                       TCGReg base, ptrdiff_t offset)
+{
+    tcg_out_ldst(s, dest, base, offset, LDUW);
+}
+
+static const TCGOutOpLoad outop_ld32u = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out = tgen_ld32u,
+};
+
+static void tgen_ld32s(TCGContext *s, TCGType type, TCGReg dest,
+                       TCGReg base, ptrdiff_t offset)
+{
+    tcg_out_ldst(s, dest, base, offset, LDSW);
+}
+
+static const TCGOutOpLoad outop_ld32s = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out = tgen_ld32s,
+};
+
+
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
                        const int const_args[TCG_MAX_OP_ARGS])
@@ -1978,22 +2045,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         glue(glue(case INDEX_op_, x), _i32):    \
         glue(glue(case INDEX_op_, x), _i64)
 
-    OP_32_64(ld8u):
-        tcg_out_ldst(s, a0, a1, a2, LDUB);
-        break;
-    OP_32_64(ld8s):
-        tcg_out_ldst(s, a0, a1, a2, LDSB);
-        break;
-    OP_32_64(ld16u):
-        tcg_out_ldst(s, a0, a1, a2, LDUH);
-        break;
-    OP_32_64(ld16s):
-        tcg_out_ldst(s, a0, a1, a2, LDSH);
-        break;
-    case INDEX_op_ld_i32:
-    case INDEX_op_ld32u_i64:
-        tcg_out_ldst(s, a0, a1, a2, LDUW);
-        break;
     OP_32_64(st8):
         tcg_out_ldst(s, a0, a1, a2, STB);
         break;
@@ -2018,12 +2069,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_qemu_st(s, a0, a1, a2, TCG_TYPE_I64);
         break;
 
-    case INDEX_op_ld32s_i64:
-        tcg_out_ldst(s, a0, a1, a2, LDSW);
-        break;
-    case INDEX_op_ld_i64:
-        tcg_out_ldst(s, a0, a1, a2, LDX);
-        break;
     case INDEX_op_st_i64:
         tcg_out_ldst(s, a0, a1, a2, STX);
         break;
@@ -2040,18 +2085,6 @@ static TCGConstraintSetIndex
 tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 {
     switch (op) {
-    case INDEX_op_ld8u_i32:
-    case INDEX_op_ld8u_i64:
-    case INDEX_op_ld8s_i32:
-    case INDEX_op_ld8s_i64:
-    case INDEX_op_ld16u_i32:
-    case INDEX_op_ld16u_i64:
-    case INDEX_op_ld16s_i32:
-    case INDEX_op_ld16s_i64:
-    case INDEX_op_ld_i32:
-    case INDEX_op_ld32u_i64:
-    case INDEX_op_ld32s_i64:
-    case INDEX_op_ld_i64:
     case INDEX_op_qemu_ld_i32:
     case INDEX_op_qemu_ld_i64:
         return C_O1_I1(r, r);
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 5ab4f5e752..4cff888b7e 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1052,6 +1052,12 @@ typedef struct TCGOutOpExtract2 {
                     TCGReg a2, unsigned shr);
 } TCGOutOpExtract2;
 
+typedef struct TCGOutOpLoad {
+    TCGOutOp base;
+    void (*out)(TCGContext *s, TCGType type, TCGReg dest,
+                TCGReg base, intptr_t offset);
+} TCGOutOpLoad;
+
 typedef struct TCGOutOpMovcond {
     TCGOutOp base;
     void (*out)(TCGContext *s, TCGType type, TCGCond cond,
@@ -1142,6 +1148,11 @@ static const TCGOutOp outop_goto_ptr = {
     .static_constraint = C_O0_I1(r),
 };
 
+static const TCGOutOpLoad outop_ld = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out = tcg_out_ld,
+};
+
 /*
  * Register V as the TCGOutOp for O.
  * This verifies that V is of type T, otherwise give a nice compiler error.
@@ -1173,6 +1184,16 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_eqv, TCGOutOpBinary, outop_eqv),
     OUTOP(INDEX_op_extract, TCGOutOpExtract, outop_extract),
     OUTOP(INDEX_op_extract2, TCGOutOpExtract2, outop_extract2),
+    OUTOP(INDEX_op_ld8u_i32, TCGOutOpLoad, outop_ld8u),
+    OUTOP(INDEX_op_ld8u_i64, TCGOutOpLoad, outop_ld8u),
+    OUTOP(INDEX_op_ld8s_i32, TCGOutOpLoad, outop_ld8s),
+    OUTOP(INDEX_op_ld8s_i64, TCGOutOpLoad, outop_ld8s),
+    OUTOP(INDEX_op_ld16u_i32, TCGOutOpLoad, outop_ld16u),
+    OUTOP(INDEX_op_ld16u_i64, TCGOutOpLoad, outop_ld16u),
+    OUTOP(INDEX_op_ld16s_i32, TCGOutOpLoad, outop_ld16s),
+    OUTOP(INDEX_op_ld16s_i64, TCGOutOpLoad, outop_ld16s),
+    OUTOP(INDEX_op_ld_i32, TCGOutOpLoad, outop_ld),
+    OUTOP(INDEX_op_ld_i64, TCGOutOpLoad, outop_ld),
     OUTOP(INDEX_op_movcond, TCGOutOpMovcond, outop_movcond),
     OUTOP(INDEX_op_mul, TCGOutOpBinary, outop_mul),
     OUTOP(INDEX_op_muls2, TCGOutOpMul2, outop_muls2),
@@ -1214,6 +1235,8 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_extu_i32_i64, TCGOutOpUnary, outop_extu_i32_i64),
     OUTOP(INDEX_op_extrl_i64_i32, TCGOutOpUnary, outop_extrl_i64_i32),
     OUTOP(INDEX_op_extrh_i64_i32, TCGOutOpUnary, outop_extrh_i64_i32),
+    OUTOP(INDEX_op_ld32u_i64, TCGOutOpLoad, outop_ld32u),
+    OUTOP(INDEX_op_ld32s_i64, TCGOutOpLoad, outop_ld32s),
 #endif
 };
 
@@ -5740,6 +5763,29 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
         }
         break;
 
+    case INDEX_op_ld32u_i64:
+    case INDEX_op_ld32s_i64:
+        tcg_debug_assert(type == TCG_TYPE_I64);
+        /* fall through */
+    case INDEX_op_ld8u_i32:
+    case INDEX_op_ld8u_i64:
+    case INDEX_op_ld8s_i32:
+    case INDEX_op_ld8s_i64:
+    case INDEX_op_ld16u_i32:
+    case INDEX_op_ld16u_i64:
+    case INDEX_op_ld16s_i32:
+    case INDEX_op_ld16s_i64:
+    case INDEX_op_ld_i32:
+    case INDEX_op_ld_i64:
+        {
+            const TCGOutOpLoad *out =
+                container_of(all_outop[op->opc], TCGOutOpLoad, base);
+
+            tcg_debug_assert(!const_args[1]);
+            out->out(s, type, new_args[0], new_args[1], new_args[2]);
+        }
+        break;
+
     case INDEX_op_muls2:
     case INDEX_op_mulu2:
         {
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index d9cd62ed3d..2dcd561b77 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -40,20 +40,6 @@ static TCGConstraintSetIndex
 tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 {
     switch (op) {
-    case INDEX_op_ld8u_i32:
-    case INDEX_op_ld8s_i32:
-    case INDEX_op_ld16u_i32:
-    case INDEX_op_ld16s_i32:
-    case INDEX_op_ld_i32:
-    case INDEX_op_ld8u_i64:
-    case INDEX_op_ld8s_i64:
-    case INDEX_op_ld16u_i64:
-    case INDEX_op_ld16s_i64:
-    case INDEX_op_ld32u_i64:
-    case INDEX_op_ld32s_i64:
-    case INDEX_op_ld_i64:
-        return C_O1_I1(r, r);
-
     case INDEX_op_st8_i32:
     case INDEX_op_st16_i32:
     case INDEX_op_st_i32:
@@ -1143,19 +1129,80 @@ static void tcg_out_br(TCGContext *s, TCGLabel *l)
     tcg_out_op_l(s, INDEX_op_br, l);
 }
 
+static void tgen_ld8u(TCGContext *s, TCGType type, TCGReg dest,
+                      TCGReg base, ptrdiff_t offset)
+{
+    tcg_out_ldst(s, INDEX_op_ld8u_i32, dest, base, offset);
+}
+
+static const TCGOutOpLoad outop_ld8u = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out = tgen_ld8u,
+};
+
+static void tgen_ld8s(TCGContext *s, TCGType type, TCGReg dest,
+                      TCGReg base, ptrdiff_t offset)
+{
+    tcg_out_ldst(s, INDEX_op_ld8s_i32, dest, base, offset);
+}
+
+static const TCGOutOpLoad outop_ld8s = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out = tgen_ld8s,
+};
+
+static void tgen_ld16u(TCGContext *s, TCGType type, TCGReg dest,
+                       TCGReg base, ptrdiff_t offset)
+{
+    tcg_out_ldst(s, INDEX_op_ld16u_i32, dest, base, offset);
+}
+
+static const TCGOutOpLoad outop_ld16u = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out = tgen_ld16u,
+};
+
+static void tgen_ld16s(TCGContext *s, TCGType type, TCGReg dest,
+                       TCGReg base, ptrdiff_t offset)
+{
+    tcg_out_ldst(s, INDEX_op_ld16s_i32, dest, base, offset);
+}
+
+static const TCGOutOpLoad outop_ld16s = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out = tgen_ld16s,
+};
+
+#if TCG_TARGET_REG_BITS == 64
+static void tgen_ld32u(TCGContext *s, TCGType type, TCGReg dest,
+                       TCGReg base, ptrdiff_t offset)
+{
+    tcg_out_ldst(s, INDEX_op_ld32u_i64, dest, base, offset);
+}
+
+static const TCGOutOpLoad outop_ld32u = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out = tgen_ld32u,
+};
+
+static void tgen_ld32s(TCGContext *s, TCGType type, TCGReg dest,
+                       TCGReg base, ptrdiff_t offset)
+{
+    tcg_out_ldst(s, INDEX_op_ld32s_i64, dest, base, offset);
+}
+
+static const TCGOutOpLoad outop_ld32s = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out = tgen_ld32s,
+};
+#endif
+
+
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
                        const int const_args[TCG_MAX_OP_ARGS])
 {
     switch (opc) {
-    CASE_32_64(ld8u)
-    CASE_32_64(ld8s)
-    CASE_32_64(ld16u)
-    CASE_32_64(ld16s)
-    case INDEX_op_ld_i32:
-    CASE_64(ld32u)
-    CASE_64(ld32s)
-    CASE_64(ld)
     CASE_32_64(st8)
     CASE_32_64(st16)
     case INDEX_op_st_i32:

From e996804d40c10572550a1d3ca936a5dfb29ca0fc Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 21 Jan 2025 21:47:16 -0800
Subject: [PATCH 0506/2760] tcg: Merge INDEX_op_ld*_{i32,i64}
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/tcg/tcg-opc.h    | 19 +++++-------
 tcg/optimize.c           | 27 ++++++++---------
 tcg/tcg-op.c             | 24 +++++++--------
 tcg/tcg.c                | 64 ++++++++++++++--------------------------
 tcg/tci.c                | 43 +++++++++++----------------
 tcg/tci/tcg-target.c.inc | 28 +++++++-----------
 6 files changed, 83 insertions(+), 122 deletions(-)

diff --git a/include/tcg/tcg-opc.h b/include/tcg/tcg-opc.h
index 30ba15723a..6e8fcefaef 100644
--- a/include/tcg/tcg-opc.h
+++ b/include/tcg/tcg-opc.h
@@ -57,6 +57,13 @@ DEF(divu2, 2, 3, 0, TCG_OPF_INT)
 DEF(eqv, 1, 2, 0, TCG_OPF_INT)
 DEF(extract, 1, 1, 2, TCG_OPF_INT)
 DEF(extract2, 1, 2, 1, TCG_OPF_INT)
+DEF(ld8u, 1, 1, 1, TCG_OPF_INT)
+DEF(ld8s, 1, 1, 1, TCG_OPF_INT)
+DEF(ld16u, 1, 1, 1, TCG_OPF_INT)
+DEF(ld16s, 1, 1, 1, TCG_OPF_INT)
+DEF(ld32u, 1, 1, 1, TCG_OPF_INT)
+DEF(ld32s, 1, 1, 1, TCG_OPF_INT)
+DEF(ld, 1, 1, 1, TCG_OPF_INT)
 DEF(movcond, 1, 4, 1, TCG_OPF_INT)
 DEF(mul, 1, 2, 0, TCG_OPF_INT)
 DEF(muls2, 2, 2, 0, TCG_OPF_INT)
@@ -93,11 +100,6 @@ DEF(subbi, 1, 2, 0, TCG_OPF_INT | TCG_OPF_CARRY_IN)
 DEF(subbio, 1, 2, 0, TCG_OPF_INT | TCG_OPF_CARRY_IN | TCG_OPF_CARRY_OUT)
 
 /* load/store */
-DEF(ld8u_i32, 1, 1, 1, 0)
-DEF(ld8s_i32, 1, 1, 1, 0)
-DEF(ld16u_i32, 1, 1, 1, 0)
-DEF(ld16s_i32, 1, 1, 1, 0)
-DEF(ld_i32, 1, 1, 1, 0)
 DEF(st8_i32, 0, 2, 1, 0)
 DEF(st16_i32, 0, 2, 1, 0)
 DEF(st_i32, 0, 2, 1, 0)
@@ -106,13 +108,6 @@ DEF(brcond2_i32, 0, 4, 2, TCG_OPF_BB_END | TCG_OPF_COND_BRANCH)
 DEF(setcond2_i32, 1, 4, 1, 0)
 
 /* load/store */
-DEF(ld8u_i64, 1, 1, 1, 0)
-DEF(ld8s_i64, 1, 1, 1, 0)
-DEF(ld16u_i64, 1, 1, 1, 0)
-DEF(ld16s_i64, 1, 1, 1, 0)
-DEF(ld32u_i64, 1, 1, 1, 0)
-DEF(ld32s_i64, 1, 1, 1, 0)
-DEF(ld_i64, 1, 1, 1, 0)
 DEF(st8_i64, 0, 2, 1, 0)
 DEF(st16_i64, 0, 2, 1, 0)
 DEF(st32_i64, 0, 2, 1, 0)
diff --git a/tcg/optimize.c b/tcg/optimize.c
index 52e194aaa9..d928a38e14 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -2880,22 +2880,22 @@ static bool fold_tcg_ld(OptContext *ctx, TCGOp *op)
 
     /* We can't do any folding with a load, but we can record bits. */
     switch (op->opc) {
-    CASE_OP_32_64(ld8s):
+    case INDEX_op_ld8s:
         s_mask = INT8_MIN;
         break;
-    CASE_OP_32_64(ld8u):
+    case INDEX_op_ld8u:
         z_mask = MAKE_64BIT_MASK(0, 8);
         break;
-    CASE_OP_32_64(ld16s):
+    case INDEX_op_ld16s:
         s_mask = INT16_MIN;
         break;
-    CASE_OP_32_64(ld16u):
+    case INDEX_op_ld16u:
         z_mask = MAKE_64BIT_MASK(0, 16);
         break;
-    case INDEX_op_ld32s_i64:
+    case INDEX_op_ld32s:
         s_mask = INT32_MIN;
         break;
-    case INDEX_op_ld32u_i64:
+    case INDEX_op_ld32u:
         z_mask = MAKE_64BIT_MASK(0, 32);
         break;
     default:
@@ -3126,16 +3126,15 @@ void tcg_optimize(TCGContext *s)
         case INDEX_op_extrh_i64_i32:
             done = fold_extu(&ctx, op);
             break;
-        CASE_OP_32_64(ld8s):
-        CASE_OP_32_64(ld8u):
-        CASE_OP_32_64(ld16s):
-        CASE_OP_32_64(ld16u):
-        case INDEX_op_ld32s_i64:
-        case INDEX_op_ld32u_i64:
+        case INDEX_op_ld8s:
+        case INDEX_op_ld8u:
+        case INDEX_op_ld16s:
+        case INDEX_op_ld16u:
+        case INDEX_op_ld32s:
+        case INDEX_op_ld32u:
             done = fold_tcg_ld(&ctx, op);
             break;
-        case INDEX_op_ld_i32:
-        case INDEX_op_ld_i64:
+        case INDEX_op_ld:
         case INDEX_op_ld_vec:
             done = fold_tcg_ld_memcopy(&ctx, op);
             break;
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index b0139ce05d..680f752cf9 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -1379,27 +1379,27 @@ void tcg_gen_abs_i32(TCGv_i32 ret, TCGv_i32 a)
 
 void tcg_gen_ld8u_i32(TCGv_i32 ret, TCGv_ptr arg2, tcg_target_long offset)
 {
-    tcg_gen_ldst_op_i32(INDEX_op_ld8u_i32, ret, arg2, offset);
+    tcg_gen_ldst_op_i32(INDEX_op_ld8u, ret, arg2, offset);
 }
 
 void tcg_gen_ld8s_i32(TCGv_i32 ret, TCGv_ptr arg2, tcg_target_long offset)
 {
-    tcg_gen_ldst_op_i32(INDEX_op_ld8s_i32, ret, arg2, offset);
+    tcg_gen_ldst_op_i32(INDEX_op_ld8s, ret, arg2, offset);
 }
 
 void tcg_gen_ld16u_i32(TCGv_i32 ret, TCGv_ptr arg2, tcg_target_long offset)
 {
-    tcg_gen_ldst_op_i32(INDEX_op_ld16u_i32, ret, arg2, offset);
+    tcg_gen_ldst_op_i32(INDEX_op_ld16u, ret, arg2, offset);
 }
 
 void tcg_gen_ld16s_i32(TCGv_i32 ret, TCGv_ptr arg2, tcg_target_long offset)
 {
-    tcg_gen_ldst_op_i32(INDEX_op_ld16s_i32, ret, arg2, offset);
+    tcg_gen_ldst_op_i32(INDEX_op_ld16s, ret, arg2, offset);
 }
 
 void tcg_gen_ld_i32(TCGv_i32 ret, TCGv_ptr arg2, tcg_target_long offset)
 {
-    tcg_gen_ldst_op_i32(INDEX_op_ld_i32, ret, arg2, offset);
+    tcg_gen_ldst_op_i32(INDEX_op_ld, ret, arg2, offset);
 }
 
 void tcg_gen_st8_i32(TCGv_i32 arg1, TCGv_ptr arg2, tcg_target_long offset)
@@ -1463,7 +1463,7 @@ void tcg_gen_movi_i64(TCGv_i64 ret, int64_t arg)
 void tcg_gen_ld8u_i64(TCGv_i64 ret, TCGv_ptr arg2, tcg_target_long offset)
 {
     if (TCG_TARGET_REG_BITS == 64) {
-        tcg_gen_ldst_op_i64(INDEX_op_ld8u_i64, ret, arg2, offset);
+        tcg_gen_ldst_op_i64(INDEX_op_ld8u, ret, arg2, offset);
     } else {
         tcg_gen_ld8u_i32(TCGV_LOW(ret), arg2, offset);
         tcg_gen_movi_i32(TCGV_HIGH(ret), 0);
@@ -1473,7 +1473,7 @@ void tcg_gen_ld8u_i64(TCGv_i64 ret, TCGv_ptr arg2, tcg_target_long offset)
 void tcg_gen_ld8s_i64(TCGv_i64 ret, TCGv_ptr arg2, tcg_target_long offset)
 {
     if (TCG_TARGET_REG_BITS == 64) {
-        tcg_gen_ldst_op_i64(INDEX_op_ld8s_i64, ret, arg2, offset);
+        tcg_gen_ldst_op_i64(INDEX_op_ld8s, ret, arg2, offset);
     } else {
         tcg_gen_ld8s_i32(TCGV_LOW(ret), arg2, offset);
         tcg_gen_sari_i32(TCGV_HIGH(ret), TCGV_LOW(ret), 31);
@@ -1483,7 +1483,7 @@ void tcg_gen_ld8s_i64(TCGv_i64 ret, TCGv_ptr arg2, tcg_target_long offset)
 void tcg_gen_ld16u_i64(TCGv_i64 ret, TCGv_ptr arg2, tcg_target_long offset)
 {
     if (TCG_TARGET_REG_BITS == 64) {
-        tcg_gen_ldst_op_i64(INDEX_op_ld16u_i64, ret, arg2, offset);
+        tcg_gen_ldst_op_i64(INDEX_op_ld16u, ret, arg2, offset);
     } else {
         tcg_gen_ld16u_i32(TCGV_LOW(ret), arg2, offset);
         tcg_gen_movi_i32(TCGV_HIGH(ret), 0);
@@ -1493,7 +1493,7 @@ void tcg_gen_ld16u_i64(TCGv_i64 ret, TCGv_ptr arg2, tcg_target_long offset)
 void tcg_gen_ld16s_i64(TCGv_i64 ret, TCGv_ptr arg2, tcg_target_long offset)
 {
     if (TCG_TARGET_REG_BITS == 64) {
-        tcg_gen_ldst_op_i64(INDEX_op_ld16s_i64, ret, arg2, offset);
+        tcg_gen_ldst_op_i64(INDEX_op_ld16s, ret, arg2, offset);
     } else {
         tcg_gen_ld16s_i32(TCGV_LOW(ret), arg2, offset);
         tcg_gen_sari_i32(TCGV_HIGH(ret), TCGV_LOW(ret), 31);
@@ -1503,7 +1503,7 @@ void tcg_gen_ld16s_i64(TCGv_i64 ret, TCGv_ptr arg2, tcg_target_long offset)
 void tcg_gen_ld32u_i64(TCGv_i64 ret, TCGv_ptr arg2, tcg_target_long offset)
 {
     if (TCG_TARGET_REG_BITS == 64) {
-        tcg_gen_ldst_op_i64(INDEX_op_ld32u_i64, ret, arg2, offset);
+        tcg_gen_ldst_op_i64(INDEX_op_ld32u, ret, arg2, offset);
     } else {
         tcg_gen_ld_i32(TCGV_LOW(ret), arg2, offset);
         tcg_gen_movi_i32(TCGV_HIGH(ret), 0);
@@ -1513,7 +1513,7 @@ void tcg_gen_ld32u_i64(TCGv_i64 ret, TCGv_ptr arg2, tcg_target_long offset)
 void tcg_gen_ld32s_i64(TCGv_i64 ret, TCGv_ptr arg2, tcg_target_long offset)
 {
     if (TCG_TARGET_REG_BITS == 64) {
-        tcg_gen_ldst_op_i64(INDEX_op_ld32s_i64, ret, arg2, offset);
+        tcg_gen_ldst_op_i64(INDEX_op_ld32s, ret, arg2, offset);
     } else {
         tcg_gen_ld_i32(TCGV_LOW(ret), arg2, offset);
         tcg_gen_sari_i32(TCGV_HIGH(ret), TCGV_LOW(ret), 31);
@@ -1527,7 +1527,7 @@ void tcg_gen_ld_i64(TCGv_i64 ret, TCGv_ptr arg2, tcg_target_long offset)
      * they cannot be the same temporary -- no chance of overlap.
      */
     if (TCG_TARGET_REG_BITS == 64) {
-        tcg_gen_ldst_op_i64(INDEX_op_ld_i64, ret, arg2, offset);
+        tcg_gen_ldst_op_i64(INDEX_op_ld, ret, arg2, offset);
     } else if (HOST_BIG_ENDIAN) {
         tcg_gen_ld_i32(TCGV_HIGH(ret), arg2, offset);
         tcg_gen_ld_i32(TCGV_LOW(ret), arg2, offset + 4);
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 4cff888b7e..a9d62d9e17 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1184,16 +1184,11 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_eqv, TCGOutOpBinary, outop_eqv),
     OUTOP(INDEX_op_extract, TCGOutOpExtract, outop_extract),
     OUTOP(INDEX_op_extract2, TCGOutOpExtract2, outop_extract2),
-    OUTOP(INDEX_op_ld8u_i32, TCGOutOpLoad, outop_ld8u),
-    OUTOP(INDEX_op_ld8u_i64, TCGOutOpLoad, outop_ld8u),
-    OUTOP(INDEX_op_ld8s_i32, TCGOutOpLoad, outop_ld8s),
-    OUTOP(INDEX_op_ld8s_i64, TCGOutOpLoad, outop_ld8s),
-    OUTOP(INDEX_op_ld16u_i32, TCGOutOpLoad, outop_ld16u),
-    OUTOP(INDEX_op_ld16u_i64, TCGOutOpLoad, outop_ld16u),
-    OUTOP(INDEX_op_ld16s_i32, TCGOutOpLoad, outop_ld16s),
-    OUTOP(INDEX_op_ld16s_i64, TCGOutOpLoad, outop_ld16s),
-    OUTOP(INDEX_op_ld_i32, TCGOutOpLoad, outop_ld),
-    OUTOP(INDEX_op_ld_i64, TCGOutOpLoad, outop_ld),
+    OUTOP(INDEX_op_ld8u, TCGOutOpLoad, outop_ld8u),
+    OUTOP(INDEX_op_ld8s, TCGOutOpLoad, outop_ld8s),
+    OUTOP(INDEX_op_ld16u, TCGOutOpLoad, outop_ld16u),
+    OUTOP(INDEX_op_ld16s, TCGOutOpLoad, outop_ld16s),
+    OUTOP(INDEX_op_ld, TCGOutOpLoad, outop_ld),
     OUTOP(INDEX_op_movcond, TCGOutOpMovcond, outop_movcond),
     OUTOP(INDEX_op_mul, TCGOutOpBinary, outop_mul),
     OUTOP(INDEX_op_muls2, TCGOutOpMul2, outop_muls2),
@@ -1235,8 +1230,8 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_extu_i32_i64, TCGOutOpUnary, outop_extu_i32_i64),
     OUTOP(INDEX_op_extrl_i64_i32, TCGOutOpUnary, outop_extrl_i64_i32),
     OUTOP(INDEX_op_extrh_i64_i32, TCGOutOpUnary, outop_extrh_i64_i32),
-    OUTOP(INDEX_op_ld32u_i64, TCGOutOpLoad, outop_ld32u),
-    OUTOP(INDEX_op_ld32s_i64, TCGOutOpLoad, outop_ld32s),
+    OUTOP(INDEX_op_ld32u, TCGOutOpLoad, outop_ld32u),
+    OUTOP(INDEX_op_ld32s, TCGOutOpLoad, outop_ld32s),
 #endif
 };
 
@@ -2443,6 +2438,11 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_brcond:
     case INDEX_op_deposit:
     case INDEX_op_extract:
+    case INDEX_op_ld8u:
+    case INDEX_op_ld8s:
+    case INDEX_op_ld16u:
+    case INDEX_op_ld16s:
+    case INDEX_op_ld:
     case INDEX_op_mov:
     case INDEX_op_movcond:
     case INDEX_op_negsetcond:
@@ -2452,11 +2452,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_xor:
         return has_type;
 
-    case INDEX_op_ld8u_i32:
-    case INDEX_op_ld8s_i32:
-    case INDEX_op_ld16u_i32:
-    case INDEX_op_ld16s_i32:
-    case INDEX_op_ld_i32:
     case INDEX_op_st8_i32:
     case INDEX_op_st16_i32:
     case INDEX_op_st_i32:
@@ -2466,13 +2461,8 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_setcond2_i32:
         return TCG_TARGET_REG_BITS == 32;
 
-    case INDEX_op_ld8u_i64:
-    case INDEX_op_ld8s_i64:
-    case INDEX_op_ld16u_i64:
-    case INDEX_op_ld16s_i64:
-    case INDEX_op_ld32u_i64:
-    case INDEX_op_ld32s_i64:
-    case INDEX_op_ld_i64:
+    case INDEX_op_ld32u:
+    case INDEX_op_ld32s:
     case INDEX_op_st8_i64:
     case INDEX_op_st16_i64:
     case INDEX_op_st32_i64:
@@ -4428,10 +4418,7 @@ liveness_pass_2(TCGContext *s)
             arg_ts = arg_temp(op->args[i]);
             dir_ts = arg_ts->state_ptr;
             if (dir_ts && arg_ts->state == TS_DEAD) {
-                TCGOpcode lopc = (arg_ts->type == TCG_TYPE_I32
-                                  ? INDEX_op_ld_i32
-                                  : INDEX_op_ld_i64);
-                TCGOp *lop = tcg_op_insert_before(s, op, lopc,
+                TCGOp *lop = tcg_op_insert_before(s, op, INDEX_op_ld,
                                                   arg_ts->type, 3);
 
                 lop->args[0] = temp_arg(dir_ts);
@@ -5763,20 +5750,13 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
         }
         break;
 
-    case INDEX_op_ld32u_i64:
-    case INDEX_op_ld32s_i64:
-        tcg_debug_assert(type == TCG_TYPE_I64);
-        /* fall through */
-    case INDEX_op_ld8u_i32:
-    case INDEX_op_ld8u_i64:
-    case INDEX_op_ld8s_i32:
-    case INDEX_op_ld8s_i64:
-    case INDEX_op_ld16u_i32:
-    case INDEX_op_ld16u_i64:
-    case INDEX_op_ld16s_i32:
-    case INDEX_op_ld16s_i64:
-    case INDEX_op_ld_i32:
-    case INDEX_op_ld_i64:
+    case INDEX_op_ld8u:
+    case INDEX_op_ld8s:
+    case INDEX_op_ld16u:
+    case INDEX_op_ld16s:
+    case INDEX_op_ld32u:
+    case INDEX_op_ld32s:
+    case INDEX_op_ld:
         {
             const TCGOutOpLoad *out =
                 container_of(all_outop[op->opc], TCGOutOpLoad, base);
diff --git a/tcg/tci.c b/tcg/tci.c
index a18478a07a..890ccbe85b 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -466,31 +466,30 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
 
             /* Load/store operations (32 bit). */
 
-        CASE_32_64(ld8u)
+        case INDEX_op_ld8u:
             tci_args_rrs(insn, &r0, &r1, &ofs);
             ptr = (void *)(regs[r1] + ofs);
             regs[r0] = *(uint8_t *)ptr;
             break;
-        CASE_32_64(ld8s)
+        case INDEX_op_ld8s:
             tci_args_rrs(insn, &r0, &r1, &ofs);
             ptr = (void *)(regs[r1] + ofs);
             regs[r0] = *(int8_t *)ptr;
             break;
-        CASE_32_64(ld16u)
+        case INDEX_op_ld16u:
             tci_args_rrs(insn, &r0, &r1, &ofs);
             ptr = (void *)(regs[r1] + ofs);
             regs[r0] = *(uint16_t *)ptr;
             break;
-        CASE_32_64(ld16s)
+        case INDEX_op_ld16s:
             tci_args_rrs(insn, &r0, &r1, &ofs);
             ptr = (void *)(regs[r1] + ofs);
             regs[r0] = *(int16_t *)ptr;
             break;
-        case INDEX_op_ld_i32:
-        CASE_64(ld32u)
+        case INDEX_op_ld:
             tci_args_rrs(insn, &r0, &r1, &ofs);
             ptr = (void *)(regs[r1] + ofs);
-            regs[r0] = *(uint32_t *)ptr;
+            regs[r0] = *(tcg_target_ulong *)ptr;
             break;
         CASE_32_64(st8)
             tci_args_rrs(insn, &r0, &r1, &ofs);
@@ -716,16 +715,16 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
 #if TCG_TARGET_REG_BITS == 64
             /* Load/store operations (64 bit). */
 
-        case INDEX_op_ld32s_i64:
+        case INDEX_op_ld32u:
+            tci_args_rrs(insn, &r0, &r1, &ofs);
+            ptr = (void *)(regs[r1] + ofs);
+            regs[r0] = *(uint32_t *)ptr;
+            break;
+        case INDEX_op_ld32s:
             tci_args_rrs(insn, &r0, &r1, &ofs);
             ptr = (void *)(regs[r1] + ofs);
             regs[r0] = *(int32_t *)ptr;
             break;
-        case INDEX_op_ld_i64:
-            tci_args_rrs(insn, &r0, &r1, &ofs);
-            ptr = (void *)(regs[r1] + ofs);
-            regs[r0] = *(uint64_t *)ptr;
-            break;
         case INDEX_op_st_i64:
             tci_args_rrs(insn, &r0, &r1, &ofs);
             ptr = (void *)(regs[r1] + ofs);
@@ -970,18 +969,12 @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
         info->fprintf_func(info->stream, "%-12s", op_name);
         break;
 
-    case INDEX_op_ld8u_i32:
-    case INDEX_op_ld8u_i64:
-    case INDEX_op_ld8s_i32:
-    case INDEX_op_ld8s_i64:
-    case INDEX_op_ld16u_i32:
-    case INDEX_op_ld16u_i64:
-    case INDEX_op_ld16s_i32:
-    case INDEX_op_ld16s_i64:
-    case INDEX_op_ld32u_i64:
-    case INDEX_op_ld32s_i64:
-    case INDEX_op_ld_i32:
-    case INDEX_op_ld_i64:
+    case INDEX_op_ld8u:
+    case INDEX_op_ld8s:
+    case INDEX_op_ld16u:
+    case INDEX_op_ld16s:
+    case INDEX_op_ld32u:
+    case INDEX_op_ld:
     case INDEX_op_st8_i32:
     case INDEX_op_st8_i64:
     case INDEX_op_st16_i32:
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index 2dcd561b77..d549dc90f5 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -339,18 +339,12 @@ static void tcg_out_ldst(TCGContext *s, TCGOpcode op, TCGReg val,
 static void tcg_out_ld(TCGContext *s, TCGType type, TCGReg val, TCGReg base,
                        intptr_t offset)
 {
-    switch (type) {
-    case TCG_TYPE_I32:
-        tcg_out_ldst(s, INDEX_op_ld_i32, val, base, offset);
-        break;
-#if TCG_TARGET_REG_BITS == 64
-    case TCG_TYPE_I64:
-        tcg_out_ldst(s, INDEX_op_ld_i64, val, base, offset);
-        break;
-#endif
-    default:
-        g_assert_not_reached();
+    TCGOpcode op = INDEX_op_ld;
+
+    if (TCG_TARGET_REG_BITS == 64 && type == TCG_TYPE_I32) {
+        op = INDEX_op_ld32u;
     }
+    tcg_out_ldst(s, op, val, base, offset);
 }
 
 static bool tcg_out_mov(TCGContext *s, TCGType type, TCGReg ret, TCGReg arg)
@@ -1132,7 +1126,7 @@ static void tcg_out_br(TCGContext *s, TCGLabel *l)
 static void tgen_ld8u(TCGContext *s, TCGType type, TCGReg dest,
                       TCGReg base, ptrdiff_t offset)
 {
-    tcg_out_ldst(s, INDEX_op_ld8u_i32, dest, base, offset);
+    tcg_out_ldst(s, INDEX_op_ld8u, dest, base, offset);
 }
 
 static const TCGOutOpLoad outop_ld8u = {
@@ -1143,7 +1137,7 @@ static const TCGOutOpLoad outop_ld8u = {
 static void tgen_ld8s(TCGContext *s, TCGType type, TCGReg dest,
                       TCGReg base, ptrdiff_t offset)
 {
-    tcg_out_ldst(s, INDEX_op_ld8s_i32, dest, base, offset);
+    tcg_out_ldst(s, INDEX_op_ld8s, dest, base, offset);
 }
 
 static const TCGOutOpLoad outop_ld8s = {
@@ -1154,7 +1148,7 @@ static const TCGOutOpLoad outop_ld8s = {
 static void tgen_ld16u(TCGContext *s, TCGType type, TCGReg dest,
                        TCGReg base, ptrdiff_t offset)
 {
-    tcg_out_ldst(s, INDEX_op_ld16u_i32, dest, base, offset);
+    tcg_out_ldst(s, INDEX_op_ld16u, dest, base, offset);
 }
 
 static const TCGOutOpLoad outop_ld16u = {
@@ -1165,7 +1159,7 @@ static const TCGOutOpLoad outop_ld16u = {
 static void tgen_ld16s(TCGContext *s, TCGType type, TCGReg dest,
                        TCGReg base, ptrdiff_t offset)
 {
-    tcg_out_ldst(s, INDEX_op_ld16s_i32, dest, base, offset);
+    tcg_out_ldst(s, INDEX_op_ld16s, dest, base, offset);
 }
 
 static const TCGOutOpLoad outop_ld16s = {
@@ -1177,7 +1171,7 @@ static const TCGOutOpLoad outop_ld16s = {
 static void tgen_ld32u(TCGContext *s, TCGType type, TCGReg dest,
                        TCGReg base, ptrdiff_t offset)
 {
-    tcg_out_ldst(s, INDEX_op_ld32u_i64, dest, base, offset);
+    tcg_out_ldst(s, INDEX_op_ld32u, dest, base, offset);
 }
 
 static const TCGOutOpLoad outop_ld32u = {
@@ -1188,7 +1182,7 @@ static const TCGOutOpLoad outop_ld32u = {
 static void tgen_ld32s(TCGContext *s, TCGType type, TCGReg dest,
                        TCGReg base, ptrdiff_t offset)
 {
-    tcg_out_ldst(s, INDEX_op_ld32s_i64, dest, base, offset);
+    tcg_out_ldst(s, INDEX_op_ld32s, dest, base, offset);
 }
 
 static const TCGOutOpLoad outop_ld32s = {

From 4a686aa9d9dcf8805de654ae09788c4e264c1439 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 22 Jan 2025 12:49:41 -0800
Subject: [PATCH 0507/2760] tcg: Convert st to TCGOutOpStore

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target.c.inc     |  52 +++++++-------
 tcg/arm/tcg-target.c.inc         |  72 +++++++++----------
 tcg/i386/tcg-target.c.inc        | 114 ++++++++++++++-----------------
 tcg/loongarch64/tcg-target.c.inc |  50 +++++++-------
 tcg/mips/tcg-target.c.inc        |  55 ++++++++-------
 tcg/ppc/tcg-target.c.inc         |  52 +++++++-------
 tcg/riscv/tcg-target.c.inc       |  52 +++++++-------
 tcg/s390x/tcg-target.c.inc       |  60 ++++++++--------
 tcg/sparc64/tcg-target.c.inc     |  53 +++++++-------
 tcg/tcg.c                        |  37 ++++++++++
 tcg/tci/tcg-target.c.inc         |  56 ++++++++-------
 11 files changed, 341 insertions(+), 312 deletions(-)

diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index 903a95ad7e..39a44507d1 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -2838,6 +2838,33 @@ static const TCGOutOpLoad outop_ld32s = {
     .out = tgen_ld32s,
 };
 
+static void tgen_st8_r(TCGContext *s, TCGType type, TCGReg data,
+                       TCGReg base, ptrdiff_t offset)
+{
+    tcg_out_ldst(s, I3312_STRB, data, base, offset, 0);
+}
+
+static const TCGOutOpStore outop_st8 = {
+    .base.static_constraint = C_O0_I2(rz, r),
+    .out_r = tgen_st8_r,
+};
+
+static void tgen_st16_r(TCGContext *s, TCGType type, TCGReg data,
+                        TCGReg base, ptrdiff_t offset)
+{
+    tcg_out_ldst(s, I3312_STRH, data, base, offset, 1);
+}
+
+static const TCGOutOpStore outop_st16 = {
+    .base.static_constraint = C_O0_I2(rz, r),
+    .out_r = tgen_st16_r,
+};
+
+static const TCGOutOpStore outop_st = {
+    .base.static_constraint = C_O0_I2(rz, r),
+    .out_r = tcg_out_st,
+};
+
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType ext,
                        const TCGArg args[TCG_MAX_OP_ARGS],
                        const int const_args[TCG_MAX_OP_ARGS])
@@ -2848,22 +2875,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType ext,
     TCGArg a2 = args[2];
 
     switch (opc) {
-    case INDEX_op_st8_i32:
-    case INDEX_op_st8_i64:
-        tcg_out_ldst(s, I3312_STRB, a0, a1, a2, 0);
-        break;
-    case INDEX_op_st16_i32:
-    case INDEX_op_st16_i64:
-        tcg_out_ldst(s, I3312_STRH, a0, a1, a2, 1);
-        break;
-    case INDEX_op_st_i32:
-    case INDEX_op_st32_i64:
-        tcg_out_ldst(s, I3312_STRW, a0, a1, a2, 2);
-        break;
-    case INDEX_op_st_i64:
-        tcg_out_ldst(s, I3312_STRX, a0, a1, a2, 3);
-        break;
-
     case INDEX_op_qemu_ld_i32:
     case INDEX_op_qemu_ld_i64:
         tcg_out_qemu_ld(s, a0, a1, a2, ext);
@@ -3331,15 +3342,6 @@ static TCGConstraintSetIndex
 tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 {
     switch (op) {
-    case INDEX_op_st8_i32:
-    case INDEX_op_st16_i32:
-    case INDEX_op_st_i32:
-    case INDEX_op_st8_i64:
-    case INDEX_op_st16_i64:
-    case INDEX_op_st32_i64:
-    case INDEX_op_st_i64:
-        return C_O0_I2(rz, r);
-
     case INDEX_op_qemu_ld_i32:
     case INDEX_op_qemu_ld_i64:
         return C_O1_I1(r, r);
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index 2079dd3bdc..5b34f61ca1 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -1084,26 +1084,6 @@ static void tcg_out_st32(TCGContext *s, ARMCond cond,
         tcg_out_st32_12(s, cond, rd, rn, offset);
 }
 
-static void tcg_out_st16(TCGContext *s, ARMCond cond,
-                         TCGReg rd, TCGReg rn, int32_t offset)
-{
-    if (offset > 0xff || offset < -0xff) {
-        tcg_out_movi32(s, cond, TCG_REG_TMP, offset);
-        tcg_out_st16_r(s, cond, rd, rn, TCG_REG_TMP);
-    } else
-        tcg_out_st16_8(s, cond, rd, rn, offset);
-}
-
-static void tcg_out_st8(TCGContext *s, ARMCond cond,
-                        TCGReg rd, TCGReg rn, int32_t offset)
-{
-    if (offset > 0xfff || offset < -0xfff) {
-        tcg_out_movi32(s, cond, TCG_REG_TMP, offset);
-        tcg_out_st8_r(s, cond, rd, rn, TCG_REG_TMP);
-    } else
-        tcg_out_st8_12(s, cond, rd, rn, offset);
-}
-
 /*
  * The _goto case is normally between TBs within the same code buffer, and
  * with the code buffer limited to 16MB we wouldn't need the long case.
@@ -2548,21 +2528,48 @@ static const TCGOutOpLoad outop_ld16s = {
     .out = tgen_ld16s,
 };
 
+static void tgen_st8(TCGContext *s, TCGType type, TCGReg rd,
+                     TCGReg rn, ptrdiff_t offset)
+{
+    if (offset > 0xfff || offset < -0xfff) {
+        tcg_out_movi32(s, COND_AL, TCG_REG_TMP, offset);
+        tcg_out_st8_r(s, COND_AL, rd, rn, TCG_REG_TMP);
+    } else {
+        tcg_out_st8_12(s, COND_AL, rd, rn, offset);
+    }
+}
+
+static const TCGOutOpStore outop_st8 = {
+    .base.static_constraint = C_O0_I2(r, r),
+    .out_r = tgen_st8,
+};
+
+static void tgen_st16(TCGContext *s, TCGType type, TCGReg rd,
+                      TCGReg rn, ptrdiff_t offset)
+{
+    if (offset > 0xff || offset < -0xff) {
+        tcg_out_movi32(s, COND_AL, TCG_REG_TMP, offset);
+        tcg_out_st16_r(s, COND_AL, rd, rn, TCG_REG_TMP);
+    } else {
+        tcg_out_st16_8(s, COND_AL, rd, rn, offset);
+    }
+}
+
+static const TCGOutOpStore outop_st16 = {
+    .base.static_constraint = C_O0_I2(r, r),
+    .out_r = tgen_st16,
+};
+
+static const TCGOutOpStore outop_st = {
+    .base.static_constraint = C_O0_I2(r, r),
+    .out_r = tcg_out_st,
+};
+
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
                        const int const_args[TCG_MAX_OP_ARGS])
 {
     switch (opc) {
-    case INDEX_op_st8_i32:
-        tcg_out_st8(s, COND_AL, args[0], args[1], args[2]);
-        break;
-    case INDEX_op_st16_i32:
-        tcg_out_st16(s, COND_AL, args[0], args[1], args[2]);
-        break;
-    case INDEX_op_st_i32:
-        tcg_out_st32(s, COND_AL, args[0], args[1], args[2]);
-        break;
-
     case INDEX_op_qemu_ld_i32:
         tcg_out_qemu_ld(s, args[0], -1, args[1], args[2], TCG_TYPE_I32);
         break;
@@ -2589,11 +2596,6 @@ static TCGConstraintSetIndex
 tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 {
     switch (op) {
-    case INDEX_op_st8_i32:
-    case INDEX_op_st16_i32:
-    case INDEX_op_st_i32:
-        return C_O0_I2(r, r);
-
     case INDEX_op_qemu_ld_i32:
         return C_O1_I1(r, q);
     case INDEX_op_qemu_ld_i64:
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index d16ddcb940..52285bcd54 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -3489,55 +3489,69 @@ static const TCGOutOpLoad outop_ld32s = {
 };
 #endif
 
+static void tgen_st8_r(TCGContext *s, TCGType type, TCGReg data,
+                       TCGReg base, ptrdiff_t offset)
+{
+    tcg_out_modrm_offset(s, OPC_MOVB_EvGv | P_REXB_R, data, base, offset);
+}
+
+static void tgen_st8_i(TCGContext *s, TCGType type, tcg_target_long data,
+                       TCGReg base, ptrdiff_t offset)
+{
+    tcg_out_modrm_offset(s, OPC_MOVB_EvIz, 0, base, offset);
+    tcg_out8(s, data);
+}
+
+static const TCGOutOpStore outop_st8 = {
+    .base.static_constraint = C_O0_I2(qi, r),
+    .out_r = tgen_st8_r,
+    .out_i = tgen_st8_i,
+};
+
+static void tgen_st16_r(TCGContext *s, TCGType type, TCGReg data,
+                        TCGReg base, ptrdiff_t offset)
+{
+    tcg_out_modrm_offset(s, OPC_MOVL_EvGv | P_DATA16, data, base, offset);
+}
+
+static void tgen_st16_i(TCGContext *s, TCGType type, tcg_target_long data,
+                        TCGReg base, ptrdiff_t offset)
+{
+    tcg_out_modrm_offset(s, OPC_MOVL_EvIz | P_DATA16, 0, base, offset);
+    tcg_out16(s, data);
+}
+
+static const TCGOutOpStore outop_st16 = {
+    .base.static_constraint = C_O0_I2(ri, r),
+    .out_r = tgen_st16_r,
+    .out_i = tgen_st16_i,
+};
+
+static void tgen_st_i(TCGContext *s, TCGType type, tcg_target_long data,
+                      TCGReg base, ptrdiff_t offset)
+{
+    bool ok = tcg_out_sti(s, type, data, base, offset);
+    tcg_debug_assert(ok);
+}
+
+static const TCGOutOpStore outop_st = {
+    .base.static_constraint = C_O0_I2(re, r),
+    .out_r = tcg_out_st,
+    .out_i = tgen_st_i,
+};
+
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
                        const int const_args[TCG_MAX_OP_ARGS])
 {
     TCGArg a0, a1, a2;
 
-#if TCG_TARGET_REG_BITS == 64
-# define OP_32_64(x) \
-        case glue(glue(INDEX_op_, x), _i64): \
-        case glue(glue(INDEX_op_, x), _i32)
-#else
-# define OP_32_64(x) \
-        case glue(glue(INDEX_op_, x), _i32)
-#endif
-
     /* Hoist the loads of the most common arguments.  */
     a0 = args[0];
     a1 = args[1];
     a2 = args[2];
 
     switch (opc) {
-    OP_32_64(st8):
-        if (const_args[0]) {
-            tcg_out_modrm_offset(s, OPC_MOVB_EvIz, 0, a1, a2);
-            tcg_out8(s, a0);
-        } else {
-            tcg_out_modrm_offset(s, OPC_MOVB_EvGv | P_REXB_R, a0, a1, a2);
-        }
-        break;
-    OP_32_64(st16):
-        if (const_args[0]) {
-            tcg_out_modrm_offset(s, OPC_MOVL_EvIz | P_DATA16, 0, a1, a2);
-            tcg_out16(s, a0);
-        } else {
-            tcg_out_modrm_offset(s, OPC_MOVL_EvGv | P_DATA16, a0, a1, a2);
-        }
-        break;
-#if TCG_TARGET_REG_BITS == 64
-    case INDEX_op_st32_i64:
-#endif
-    case INDEX_op_st_i32:
-        if (const_args[0]) {
-            tcg_out_modrm_offset(s, OPC_MOVL_EvIz, 0, a1, a2);
-            tcg_out32(s, a0);
-        } else {
-            tcg_out_st(s, TCG_TYPE_I32, a0, a1, a2);
-        }
-        break;
-
     case INDEX_op_qemu_ld_i32:
         tcg_out_qemu_ld(s, a0, -1, a1, a2, TCG_TYPE_I32);
         break;
@@ -3569,25 +3583,12 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_qemu_st(s, a0, a1, a2, args[3], TCG_TYPE_I128);
         break;
 
-#if TCG_TARGET_REG_BITS == 64
-    case INDEX_op_st_i64:
-        if (const_args[0]) {
-            tcg_out_modrm_offset(s, OPC_MOVL_EvIz | P_REXW, 0, a1, a2);
-            tcg_out32(s, a0);
-        } else {
-            tcg_out_st(s, TCG_TYPE_I64, a0, a1, a2);
-        }
-        break;
-#endif
-
     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
     default:
         g_assert_not_reached();
     }
-
-#undef OP_32_64
 }
 
 static int const umin_insn[4] = {
@@ -4135,19 +4136,6 @@ static TCGConstraintSetIndex
 tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 {
     switch (op) {
-    case INDEX_op_st8_i32:
-    case INDEX_op_st8_i64:
-        return C_O0_I2(qi, r);
-
-    case INDEX_op_st16_i32:
-    case INDEX_op_st16_i64:
-    case INDEX_op_st_i32:
-    case INDEX_op_st32_i64:
-        return C_O0_I2(ri, r);
-
-    case INDEX_op_st_i64:
-        return C_O0_I2(re, r);
-
     case INDEX_op_qemu_ld_i32:
         return C_O1_I1(r, L);
 
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index 66555b8982..73a1196d8b 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -1983,6 +1983,33 @@ static const TCGOutOpLoad outop_ld32s = {
     .out = tgen_ld32s,
 };
 
+static void tgen_st8_r(TCGContext *s, TCGType type, TCGReg data,
+                       TCGReg base, ptrdiff_t offset)
+{
+    tcg_out_ldst(s, OPC_ST_B, data, base, offset);
+}
+
+static const TCGOutOpStore outop_st8 = {
+    .base.static_constraint = C_O0_I2(rz, r),
+    .out_r = tgen_st8_r,
+};
+
+static void tgen_st16_r(TCGContext *s, TCGType type, TCGReg data,
+                        TCGReg base, ptrdiff_t offset)
+{
+    tcg_out_ldst(s, OPC_ST_H, data, base, offset);
+}
+
+static const TCGOutOpStore outop_st16 = {
+    .base.static_constraint = C_O0_I2(rz, r),
+    .out_r = tgen_st16_r,
+};
+
+static const TCGOutOpStore outop_st = {
+    .base.static_constraint = C_O0_I2(rz, r),
+    .out_r = tcg_out_st,
+};
+
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
                        const int const_args[TCG_MAX_OP_ARGS])
@@ -1993,22 +2020,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     TCGArg a3 = args[3];
 
     switch (opc) {
-    case INDEX_op_st8_i32:
-    case INDEX_op_st8_i64:
-        tcg_out_ldst(s, OPC_ST_B, a0, a1, a2);
-        break;
-    case INDEX_op_st16_i32:
-    case INDEX_op_st16_i64:
-        tcg_out_ldst(s, OPC_ST_H, a0, a1, a2);
-        break;
-    case INDEX_op_st_i32:
-    case INDEX_op_st32_i64:
-        tcg_out_ldst(s, OPC_ST_W, a0, a1, a2);
-        break;
-    case INDEX_op_st_i64:
-        tcg_out_ldst(s, OPC_ST_D, a0, a1, a2);
-        break;
-
     case INDEX_op_qemu_ld_i32:
         tcg_out_qemu_ld(s, a0, a1, a2, TCG_TYPE_I32);
         break;
@@ -2530,13 +2541,6 @@ static TCGConstraintSetIndex
 tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 {
     switch (op) {
-    case INDEX_op_st8_i32:
-    case INDEX_op_st8_i64:
-    case INDEX_op_st16_i32:
-    case INDEX_op_st16_i64:
-    case INDEX_op_st32_i64:
-    case INDEX_op_st_i32:
-    case INDEX_op_st_i64:
     case INDEX_op_qemu_st_i32:
     case INDEX_op_qemu_st_i64:
         return C_O0_I2(rz, r);
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index 21ed11b78d..5e41729d88 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -2342,12 +2342,38 @@ static const TCGOutOpLoad outop_ld32s = {
 };
 #endif
 
+static void tgen_st8_r(TCGContext *s, TCGType type, TCGReg data,
+                       TCGReg base, ptrdiff_t offset)
+{
+    tcg_out_ldst(s, OPC_SB, data, base, offset);
+}
+
+static const TCGOutOpStore outop_st8 = {
+    .base.static_constraint = C_O0_I2(rz, r),
+    .out_r = tgen_st8_r,
+};
+
+static void tgen_st16_r(TCGContext *s, TCGType type, TCGReg data,
+                        TCGReg base, ptrdiff_t offset)
+{
+    tcg_out_ldst(s, OPC_SH, data, base, offset);
+}
+
+static const TCGOutOpStore outop_st16 = {
+    .base.static_constraint = C_O0_I2(rz, r),
+    .out_r = tgen_st16_r,
+};
+
+static const TCGOutOpStore outop_st = {
+    .base.static_constraint = C_O0_I2(rz, r),
+    .out_r = tcg_out_st,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
                        const int const_args[TCG_MAX_OP_ARGS])
 {
-    MIPSInsn i1;
     TCGArg a0, a1, a2;
 
     a0 = args[0];
@@ -2355,24 +2381,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     a2 = args[2];
 
     switch (opc) {
-    case INDEX_op_st8_i32:
-    case INDEX_op_st8_i64:
-        i1 = OPC_SB;
-        goto do_ldst;
-    case INDEX_op_st16_i32:
-    case INDEX_op_st16_i64:
-        i1 = OPC_SH;
-        goto do_ldst;
-    case INDEX_op_st_i32:
-    case INDEX_op_st32_i64:
-        i1 = OPC_SW;
-        goto do_ldst;
-    case INDEX_op_st_i64:
-        i1 = OPC_SD;
-    do_ldst:
-        tcg_out_ldst(s, i1, a0, a1, a2);
-        break;
-
     case INDEX_op_qemu_ld_i32:
         tcg_out_qemu_ld(s, a0, 0, a1, a2, TCG_TYPE_I32);
         break;
@@ -2407,15 +2415,6 @@ static TCGConstraintSetIndex
 tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 {
     switch (op) {
-    case INDEX_op_st8_i32:
-    case INDEX_op_st16_i32:
-    case INDEX_op_st_i32:
-    case INDEX_op_st8_i64:
-    case INDEX_op_st16_i64:
-    case INDEX_op_st32_i64:
-    case INDEX_op_st_i64:
-        return C_O0_I2(rz, r);
-
     case INDEX_op_qemu_ld_i32:
         return C_O1_I1(r, r);
     case INDEX_op_qemu_st_i32:
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index 275c5a90a5..9cf24831df 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -3746,28 +3746,39 @@ static const TCGOutOpLoad outop_ld32s = {
 };
 #endif
 
+static void tgen_st8(TCGContext *s, TCGType type, TCGReg data,
+                     TCGReg base, ptrdiff_t offset)
+{
+    tcg_out_mem_long(s, STB, STBX, data, base, offset);
+}
+
+static const TCGOutOpStore outop_st8 = {
+    .base.static_constraint = C_O0_I2(r, r),
+    .out_r = tgen_st8,
+};
+
+static void tgen_st16(TCGContext *s, TCGType type, TCGReg data,
+                      TCGReg base, ptrdiff_t offset)
+{
+    tcg_out_mem_long(s, STH, STHX, data, base, offset);
+}
+
+static const TCGOutOpStore outop_st16 = {
+    .base.static_constraint = C_O0_I2(r, r),
+    .out_r = tgen_st16,
+};
+
+static const TCGOutOpStore outop_st = {
+    .base.static_constraint = C_O0_I2(r, r),
+    .out_r = tcg_out_st,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
                        const int const_args[TCG_MAX_OP_ARGS])
 {
     switch (opc) {
-    case INDEX_op_st8_i32:
-    case INDEX_op_st8_i64:
-        tcg_out_mem_long(s, STB, STBX, args[0], args[1], args[2]);
-        break;
-    case INDEX_op_st16_i32:
-    case INDEX_op_st16_i64:
-        tcg_out_mem_long(s, STH, STHX, args[0], args[1], args[2]);
-        break;
-    case INDEX_op_st_i32:
-    case INDEX_op_st32_i64:
-        tcg_out_mem_long(s, STW, STWX, args[0], args[1], args[2]);
-        break;
-    case INDEX_op_st_i64:
-        tcg_out_mem_long(s, STD, STDX, args[0], args[1], args[2]);
-        break;
-
     case INDEX_op_qemu_ld_i32:
         tcg_out_qemu_ld(s, args[0], -1, args[1], args[2], TCG_TYPE_I32);
         break;
@@ -4415,15 +4426,6 @@ static TCGConstraintSetIndex
 tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 {
     switch (op) {
-    case INDEX_op_st8_i32:
-    case INDEX_op_st16_i32:
-    case INDEX_op_st_i32:
-    case INDEX_op_st8_i64:
-    case INDEX_op_st16_i64:
-    case INDEX_op_st32_i64:
-    case INDEX_op_st_i64:
-        return C_O0_I2(r, r);
-
     case INDEX_op_qemu_ld_i32:
         return C_O1_I1(r, r);
     case INDEX_op_qemu_ld_i64:
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index 5b987c930f..bcfdb6c545 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -2596,6 +2596,33 @@ static const TCGOutOpLoad outop_ld32s = {
     .out = tgen_ld32s,
 };
 
+static void tgen_st8_r(TCGContext *s, TCGType type, TCGReg data,
+                       TCGReg base, ptrdiff_t offset)
+{
+    tcg_out_ldst(s, OPC_SB, data, base, offset);
+}
+
+static const TCGOutOpStore outop_st8 = {
+    .base.static_constraint = C_O0_I2(rz, r),
+    .out_r = tgen_st8_r,
+};
+
+static void tgen_st16_r(TCGContext *s, TCGType type, TCGReg data,
+                        TCGReg base, ptrdiff_t offset)
+{
+    tcg_out_ldst(s, OPC_SH, data, base, offset);
+}
+
+static const TCGOutOpStore outop_st16 = {
+    .base.static_constraint = C_O0_I2(rz, r),
+    .out_r = tgen_st16_r,
+};
+
+static const TCGOutOpStore outop_st = {
+    .base.static_constraint = C_O0_I2(rz, r),
+    .out_r = tcg_out_st,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -2606,22 +2633,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     TCGArg a2 = args[2];
 
     switch (opc) {
-    case INDEX_op_st8_i32:
-    case INDEX_op_st8_i64:
-        tcg_out_ldst(s, OPC_SB, a0, a1, a2);
-        break;
-    case INDEX_op_st16_i32:
-    case INDEX_op_st16_i64:
-        tcg_out_ldst(s, OPC_SH, a0, a1, a2);
-        break;
-    case INDEX_op_st_i32:
-    case INDEX_op_st32_i64:
-        tcg_out_ldst(s, OPC_SW, a0, a1, a2);
-        break;
-    case INDEX_op_st_i64:
-        tcg_out_ldst(s, OPC_SD, a0, a1, a2);
-        break;
-
     case INDEX_op_qemu_ld_i32:
         tcg_out_qemu_ld(s, a0, a1, a2, TCG_TYPE_I32);
         break;
@@ -2864,15 +2875,6 @@ static TCGConstraintSetIndex
 tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 {
     switch (op) {
-    case INDEX_op_st8_i32:
-    case INDEX_op_st16_i32:
-    case INDEX_op_st_i32:
-    case INDEX_op_st8_i64:
-    case INDEX_op_st16_i64:
-    case INDEX_op_st32_i64:
-    case INDEX_op_st_i64:
-        return C_O0_I2(rz, r);
-
     case INDEX_op_qemu_ld_i32:
     case INDEX_op_qemu_ld_i64:
         return C_O1_I1(r, r);
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index fe7665b21d..e266c19829 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -3100,29 +3100,39 @@ static const TCGOutOpLoad outop_ld32s = {
     .out = tgen_ld32s,
 };
 
-# define OP_32_64(x) \
-        case glue(glue(INDEX_op_,x),_i32): \
-        case glue(glue(INDEX_op_,x),_i64)
+static void tgen_st8(TCGContext *s, TCGType type, TCGReg data,
+                     TCGReg base, ptrdiff_t offset)
+{
+    tcg_out_mem(s, RX_STC, RXY_STCY, data, base, TCG_REG_NONE, offset);
+}
+
+static const TCGOutOpStore outop_st8 = {
+    .base.static_constraint = C_O0_I2(r, r),
+    .out_r = tgen_st8,
+};
+
+static void tgen_st16(TCGContext *s, TCGType type, TCGReg data,
+                      TCGReg base, ptrdiff_t offset)
+{
+    tcg_out_mem(s, RX_STH, RXY_STHY, data, base, TCG_REG_NONE, offset);
+}
+
+static const TCGOutOpStore outop_st16 = {
+    .base.static_constraint = C_O0_I2(r, r),
+    .out_r = tgen_st16,
+};
+
+static const TCGOutOpStore outop_st = {
+    .base.static_constraint = C_O0_I2(r, r),
+    .out_r = tcg_out_st,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
                        const int const_args[TCG_MAX_OP_ARGS])
 {
     switch (opc) {
-    OP_32_64(st8):
-        tcg_out_mem(s, RX_STC, RXY_STCY, args[0], args[1],
-                    TCG_REG_NONE, args[2]);
-        break;
-
-    OP_32_64(st16):
-        tcg_out_mem(s, RX_STH, RXY_STHY, args[0], args[1],
-                    TCG_REG_NONE, args[2]);
-        break;
-
-    case INDEX_op_st_i32:
-        tcg_out_st(s, TCG_TYPE_I32, args[0], args[1], args[2]);
-        break;
-
     case INDEX_op_qemu_ld_i32:
         tcg_out_qemu_ld(s, args[0], args[1], args[2], TCG_TYPE_I32);
         break;
@@ -3142,13 +3152,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_qemu_ldst_i128(s, args[0], args[1], args[2], args[3], false);
         break;
 
-    case INDEX_op_st32_i64:
-        tcg_out_st(s, TCG_TYPE_I32, args[0], args[1], args[2]);
-        break;
-    case INDEX_op_st_i64:
-        tcg_out_st(s, TCG_TYPE_I64, args[0], args[1], args[2]);
-        break;
-
     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
@@ -3597,15 +3600,6 @@ static TCGConstraintSetIndex
 tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 {
     switch (op) {
-    case INDEX_op_st8_i32:
-    case INDEX_op_st8_i64:
-    case INDEX_op_st16_i32:
-    case INDEX_op_st16_i64:
-    case INDEX_op_st_i32:
-    case INDEX_op_st32_i64:
-    case INDEX_op_st_i64:
-        return C_O0_I2(r, r);
-
     case INDEX_op_qemu_ld_i32:
     case INDEX_op_qemu_ld_i64:
         return C_O1_I1(r, r);
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index 59a737dde4..a0efeee98c 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -2028,6 +2028,33 @@ static const TCGOutOpLoad outop_ld32s = {
     .out = tgen_ld32s,
 };
 
+static void tgen_st8_r(TCGContext *s, TCGType type, TCGReg data,
+                       TCGReg base, ptrdiff_t offset)
+{
+    tcg_out_ldst(s, data, base, offset, STB);
+}
+
+static const TCGOutOpStore outop_st8 = {
+    .base.static_constraint = C_O0_I2(rz, r),
+    .out_r = tgen_st8_r,
+};
+
+static void tgen_st16_r(TCGContext *s, TCGType type, TCGReg data,
+                       TCGReg base, ptrdiff_t offset)
+{
+    tcg_out_ldst(s, data, base, offset, STH);
+}
+
+static const TCGOutOpStore outop_st16 = {
+    .base.static_constraint = C_O0_I2(rz, r),
+    .out_r = tgen_st16_r,
+};
+
+static const TCGOutOpStore outop_st = {
+    .base.static_constraint = C_O0_I2(rz, r),
+    .out_r = tcg_out_st,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
@@ -2041,21 +2068,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     a2 = args[2];
 
     switch (opc) {
-#define OP_32_64(x)                             \
-        glue(glue(case INDEX_op_, x), _i32):    \
-        glue(glue(case INDEX_op_, x), _i64)
-
-    OP_32_64(st8):
-        tcg_out_ldst(s, a0, a1, a2, STB);
-        break;
-    OP_32_64(st16):
-        tcg_out_ldst(s, a0, a1, a2, STH);
-        break;
-    case INDEX_op_st_i32:
-    case INDEX_op_st32_i64:
-        tcg_out_ldst(s, a0, a1, a2, STW);
-        break;
-
     case INDEX_op_qemu_ld_i32:
         tcg_out_qemu_ld(s, a0, a1, a2, TCG_TYPE_I32);
         break;
@@ -2069,10 +2081,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         tcg_out_qemu_st(s, a0, a1, a2, TCG_TYPE_I64);
         break;
 
-    case INDEX_op_st_i64:
-        tcg_out_ldst(s, a0, a1, a2, STX);
-        break;
-
     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
     case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
     case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
@@ -2089,13 +2097,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_qemu_ld_i64:
         return C_O1_I1(r, r);
 
-    case INDEX_op_st8_i32:
-    case INDEX_op_st8_i64:
-    case INDEX_op_st16_i32:
-    case INDEX_op_st16_i64:
-    case INDEX_op_st_i32:
-    case INDEX_op_st32_i64:
-    case INDEX_op_st_i64:
     case INDEX_op_qemu_st_i32:
     case INDEX_op_qemu_st_i64:
         return C_O0_I2(rz, r);
diff --git a/tcg/tcg.c b/tcg/tcg.c
index a9d62d9e17..28791c6567 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1090,6 +1090,14 @@ typedef struct TCGOutOpSetcond2 {
                 TCGArg bl, bool const_bl, TCGArg bh, bool const_bh);
 } TCGOutOpSetcond2;
 
+typedef struct TCGOutOpStore {
+    TCGOutOp base;
+    void (*out_r)(TCGContext *s, TCGType type, TCGReg data,
+                  TCGReg base, intptr_t offset);
+    void (*out_i)(TCGContext *s, TCGType type, tcg_target_long data,
+                  TCGReg base, intptr_t offset);
+} TCGOutOpStore;
+
 typedef struct TCGOutOpSubtract {
     TCGOutOp base;
     void (*out_rrr)(TCGContext *s, TCGType type,
@@ -1211,6 +1219,12 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_sextract, TCGOutOpExtract, outop_sextract),
     OUTOP(INDEX_op_shl, TCGOutOpBinary, outop_shl),
     OUTOP(INDEX_op_shr, TCGOutOpBinary, outop_shr),
+    OUTOP(INDEX_op_st_i32, TCGOutOpStore, outop_st),
+    OUTOP(INDEX_op_st_i64, TCGOutOpStore, outop_st),
+    OUTOP(INDEX_op_st8_i32, TCGOutOpStore, outop_st8),
+    OUTOP(INDEX_op_st8_i64, TCGOutOpStore, outop_st8),
+    OUTOP(INDEX_op_st16_i32, TCGOutOpStore, outop_st16),
+    OUTOP(INDEX_op_st16_i64, TCGOutOpStore, outop_st16),
     OUTOP(INDEX_op_sub, TCGOutOpSubtract, outop_sub),
     OUTOP(INDEX_op_subbi, TCGOutOpAddSubCarry, outop_subbi),
     OUTOP(INDEX_op_subbio, TCGOutOpAddSubCarry, outop_subbio),
@@ -1232,6 +1246,7 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_extrh_i64_i32, TCGOutOpUnary, outop_extrh_i64_i32),
     OUTOP(INDEX_op_ld32u, TCGOutOpLoad, outop_ld32u),
     OUTOP(INDEX_op_ld32s, TCGOutOpLoad, outop_ld32s),
+    OUTOP(INDEX_op_st32_i64, TCGOutOpStore, outop_st),
 #endif
 };
 
@@ -5779,6 +5794,28 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
         }
         break;
 
+    case INDEX_op_st32_i64:
+        /* Use tcg_op_st w/ I32. */
+        type = TCG_TYPE_I32;
+        /* fall through */
+    case INDEX_op_st_i32:
+    case INDEX_op_st_i64:
+    case INDEX_op_st8_i32:
+    case INDEX_op_st8_i64:
+    case INDEX_op_st16_i32:
+    case INDEX_op_st16_i64:
+        {
+            const TCGOutOpStore *out =
+                container_of(all_outop[op->opc], TCGOutOpStore, base);
+
+            if (const_args[0]) {
+                out->out_i(s, type, new_args[0], new_args[1], new_args[2]);
+            } else {
+                out->out_r(s, type, new_args[0], new_args[1], new_args[2]);
+            }
+        }
+        break;
+
     case INDEX_op_brcond:
         {
             const TCGOutOpBrcond *out = &outop_brcond;
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index d549dc90f5..be9270a861 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -40,15 +40,6 @@ static TCGConstraintSetIndex
 tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 {
     switch (op) {
-    case INDEX_op_st8_i32:
-    case INDEX_op_st16_i32:
-    case INDEX_op_st_i32:
-    case INDEX_op_st8_i64:
-    case INDEX_op_st16_i64:
-    case INDEX_op_st32_i64:
-    case INDEX_op_st_i64:
-        return C_O0_I2(r, r);
-
     case INDEX_op_qemu_ld_i32:
         return C_O1_I1(r, r);
     case INDEX_op_qemu_ld_i64:
@@ -487,18 +478,6 @@ static void tcg_out_call(TCGContext *s, const tcg_insn_unit *func,
     tcg_out32(s, insn);
 }
 
-#if TCG_TARGET_REG_BITS == 64
-# define CASE_32_64(x) \
-        case glue(glue(INDEX_op_, x), _i64): \
-        case glue(glue(INDEX_op_, x), _i32):
-# define CASE_64(x) \
-        case glue(glue(INDEX_op_, x), _i64):
-#else
-# define CASE_32_64(x) \
-        case glue(glue(INDEX_op_, x), _i32):
-# define CASE_64(x)
-#endif
-
 static void tcg_out_exit_tb(TCGContext *s, uintptr_t arg)
 {
     tcg_out_op_p(s, INDEX_op_exit_tb, (void *)arg);
@@ -1191,20 +1170,39 @@ static const TCGOutOpLoad outop_ld32s = {
 };
 #endif
 
+static void tgen_st8(TCGContext *s, TCGType type, TCGReg data,
+                     TCGReg base, ptrdiff_t offset)
+{
+    tcg_out_ldst(s, INDEX_op_st8_i32, data, base, offset);
+}
+
+static const TCGOutOpStore outop_st8 = {
+    .base.static_constraint = C_O0_I2(r, r),
+    .out_r = tgen_st8,
+};
+
+static void tgen_st16(TCGContext *s, TCGType type, TCGReg data,
+                      TCGReg base, ptrdiff_t offset)
+{
+    tcg_out_ldst(s, INDEX_op_st16_i32, data, base, offset);
+}
+
+static const TCGOutOpStore outop_st16 = {
+    .base.static_constraint = C_O0_I2(r, r),
+    .out_r = tgen_st16,
+};
+
+static const TCGOutOpStore outop_st = {
+    .base.static_constraint = C_O0_I2(r, r),
+    .out_r = tcg_out_st,
+};
+
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
                        const int const_args[TCG_MAX_OP_ARGS])
 {
     switch (opc) {
-    CASE_32_64(st8)
-    CASE_32_64(st16)
-    case INDEX_op_st_i32:
-    CASE_64(st32)
-    CASE_64(st)
-        tcg_out_ldst(s, opc, args[0], args[1], args[2]);
-        break;
-
     case INDEX_op_qemu_ld_i64:
     case INDEX_op_qemu_st_i64:
         if (TCG_TARGET_REG_BITS == 32) {

From a28f151d61604feae1d6c75b79e67d1c6c6a8b18 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 22 Jan 2025 13:28:55 -0800
Subject: [PATCH 0508/2760] tcg: Merge INDEX_op_st*_{i32,i64}
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/tcg/tcg-opc.h    | 15 ++++----------
 tcg/optimize.c           | 28 +++++++------------------
 tcg/tcg-op.c             | 14 ++++++-------
 tcg/tcg.c                | 45 +++++++++++++---------------------------
 tcg/tci.c                | 36 +++++++++-----------------------
 tcg/tci/tcg-target.c.inc | 20 +++++++-----------
 6 files changed, 50 insertions(+), 108 deletions(-)

diff --git a/include/tcg/tcg-opc.h b/include/tcg/tcg-opc.h
index 6e8fcefaef..a22433d8b5 100644
--- a/include/tcg/tcg-opc.h
+++ b/include/tcg/tcg-opc.h
@@ -86,6 +86,10 @@ DEF(setcond, 1, 2, 1, TCG_OPF_INT)
 DEF(sextract, 1, 1, 2, TCG_OPF_INT)
 DEF(shl, 1, 2, 0, TCG_OPF_INT)
 DEF(shr, 1, 2, 0, TCG_OPF_INT)
+DEF(st8, 0, 2, 1, TCG_OPF_INT)
+DEF(st16, 0, 2, 1, TCG_OPF_INT)
+DEF(st32, 0, 2, 1, TCG_OPF_INT)
+DEF(st, 0, 2, 1, TCG_OPF_INT)
 DEF(sub, 1, 2, 0, TCG_OPF_INT)
 DEF(xor, 1, 2, 0, TCG_OPF_INT)
 
@@ -99,20 +103,9 @@ DEF(subb1o, 1, 2, 0, TCG_OPF_INT | TCG_OPF_CARRY_OUT)
 DEF(subbi, 1, 2, 0, TCG_OPF_INT | TCG_OPF_CARRY_IN)
 DEF(subbio, 1, 2, 0, TCG_OPF_INT | TCG_OPF_CARRY_IN | TCG_OPF_CARRY_OUT)
 
-/* load/store */
-DEF(st8_i32, 0, 2, 1, 0)
-DEF(st16_i32, 0, 2, 1, 0)
-DEF(st_i32, 0, 2, 1, 0)
-
 DEF(brcond2_i32, 0, 4, 2, TCG_OPF_BB_END | TCG_OPF_COND_BRANCH)
 DEF(setcond2_i32, 1, 4, 1, 0)
 
-/* load/store */
-DEF(st8_i64, 0, 2, 1, 0)
-DEF(st16_i64, 0, 2, 1, 0)
-DEF(st32_i64, 0, 2, 1, 0)
-DEF(st_i64, 0, 2, 1, 0)
-
 /* size changing ops */
 DEF(ext_i32_i64, 1, 1, 0, 0)
 DEF(extu_i32_i64, 1, 1, 0, 0)
diff --git a/tcg/optimize.c b/tcg/optimize.c
index d928a38e14..cfb407c7fc 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -30,14 +30,6 @@
 #include "tcg-internal.h"
 #include "tcg-has.h"
 
-#define CASE_OP_32_64(x)                        \
-        glue(glue(case INDEX_op_, x), _i32):    \
-        glue(glue(case INDEX_op_, x), _i64)
-
-#define CASE_OP_32_64_VEC(x)                    \
-        glue(glue(case INDEX_op_, x), _i32):    \
-        glue(glue(case INDEX_op_, x), _i64):    \
-        glue(glue(case INDEX_op_, x), _vec)
 
 typedef struct MemCopyInfo {
     IntervalTreeNode itree;
@@ -2938,19 +2930,16 @@ static bool fold_tcg_st(OptContext *ctx, TCGOp *op)
     }
 
     switch (op->opc) {
-    CASE_OP_32_64(st8):
+    case INDEX_op_st8:
         lm1 = 0;
         break;
-    CASE_OP_32_64(st16):
+    case INDEX_op_st16:
         lm1 = 1;
         break;
-    case INDEX_op_st32_i64:
-    case INDEX_op_st_i32:
+    case INDEX_op_st32:
         lm1 = 3;
         break;
-    case INDEX_op_st_i64:
-        lm1 = 7;
-        break;
+    case INDEX_op_st:
     case INDEX_op_st_vec:
         lm1 = tcg_type_size(ctx->type) - 1;
         break;
@@ -3138,13 +3127,12 @@ void tcg_optimize(TCGContext *s)
         case INDEX_op_ld_vec:
             done = fold_tcg_ld_memcopy(&ctx, op);
             break;
-        CASE_OP_32_64(st8):
-        CASE_OP_32_64(st16):
-        case INDEX_op_st32_i64:
+        case INDEX_op_st8:
+        case INDEX_op_st16:
+        case INDEX_op_st32:
             done = fold_tcg_st(&ctx, op);
             break;
-        case INDEX_op_st_i32:
-        case INDEX_op_st_i64:
+        case INDEX_op_st:
         case INDEX_op_st_vec:
             done = fold_tcg_st_memcopy(&ctx, op);
             break;
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index 680f752cf9..dfa5c38728 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -1404,17 +1404,17 @@ void tcg_gen_ld_i32(TCGv_i32 ret, TCGv_ptr arg2, tcg_target_long offset)
 
 void tcg_gen_st8_i32(TCGv_i32 arg1, TCGv_ptr arg2, tcg_target_long offset)
 {
-    tcg_gen_ldst_op_i32(INDEX_op_st8_i32, arg1, arg2, offset);
+    tcg_gen_ldst_op_i32(INDEX_op_st8, arg1, arg2, offset);
 }
 
 void tcg_gen_st16_i32(TCGv_i32 arg1, TCGv_ptr arg2, tcg_target_long offset)
 {
-    tcg_gen_ldst_op_i32(INDEX_op_st16_i32, arg1, arg2, offset);
+    tcg_gen_ldst_op_i32(INDEX_op_st16, arg1, arg2, offset);
 }
 
 void tcg_gen_st_i32(TCGv_i32 arg1, TCGv_ptr arg2, tcg_target_long offset)
 {
-    tcg_gen_ldst_op_i32(INDEX_op_st_i32, arg1, arg2, offset);
+    tcg_gen_ldst_op_i32(INDEX_op_st, arg1, arg2, offset);
 }
 
 
@@ -1540,7 +1540,7 @@ void tcg_gen_ld_i64(TCGv_i64 ret, TCGv_ptr arg2, tcg_target_long offset)
 void tcg_gen_st8_i64(TCGv_i64 arg1, TCGv_ptr arg2, tcg_target_long offset)
 {
     if (TCG_TARGET_REG_BITS == 64) {
-        tcg_gen_ldst_op_i64(INDEX_op_st8_i64, arg1, arg2, offset);
+        tcg_gen_ldst_op_i64(INDEX_op_st8, arg1, arg2, offset);
     } else {
         tcg_gen_st8_i32(TCGV_LOW(arg1), arg2, offset);
     }
@@ -1549,7 +1549,7 @@ void tcg_gen_st8_i64(TCGv_i64 arg1, TCGv_ptr arg2, tcg_target_long offset)
 void tcg_gen_st16_i64(TCGv_i64 arg1, TCGv_ptr arg2, tcg_target_long offset)
 {
     if (TCG_TARGET_REG_BITS == 64) {
-        tcg_gen_ldst_op_i64(INDEX_op_st16_i64, arg1, arg2, offset);
+        tcg_gen_ldst_op_i64(INDEX_op_st16, arg1, arg2, offset);
     } else {
         tcg_gen_st16_i32(TCGV_LOW(arg1), arg2, offset);
     }
@@ -1558,7 +1558,7 @@ void tcg_gen_st16_i64(TCGv_i64 arg1, TCGv_ptr arg2, tcg_target_long offset)
 void tcg_gen_st32_i64(TCGv_i64 arg1, TCGv_ptr arg2, tcg_target_long offset)
 {
     if (TCG_TARGET_REG_BITS == 64) {
-        tcg_gen_ldst_op_i64(INDEX_op_st32_i64, arg1, arg2, offset);
+        tcg_gen_ldst_op_i64(INDEX_op_st32, arg1, arg2, offset);
     } else {
         tcg_gen_st_i32(TCGV_LOW(arg1), arg2, offset);
     }
@@ -1567,7 +1567,7 @@ void tcg_gen_st32_i64(TCGv_i64 arg1, TCGv_ptr arg2, tcg_target_long offset)
 void tcg_gen_st_i64(TCGv_i64 arg1, TCGv_ptr arg2, tcg_target_long offset)
 {
     if (TCG_TARGET_REG_BITS == 64) {
-        tcg_gen_ldst_op_i64(INDEX_op_st_i64, arg1, arg2, offset);
+        tcg_gen_ldst_op_i64(INDEX_op_st, arg1, arg2, offset);
     } else if (HOST_BIG_ENDIAN) {
         tcg_gen_st_i32(TCGV_HIGH(arg1), arg2, offset);
         tcg_gen_st_i32(TCGV_LOW(arg1), arg2, offset + 4);
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 28791c6567..44b6b8319f 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1219,12 +1219,9 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_sextract, TCGOutOpExtract, outop_sextract),
     OUTOP(INDEX_op_shl, TCGOutOpBinary, outop_shl),
     OUTOP(INDEX_op_shr, TCGOutOpBinary, outop_shr),
-    OUTOP(INDEX_op_st_i32, TCGOutOpStore, outop_st),
-    OUTOP(INDEX_op_st_i64, TCGOutOpStore, outop_st),
-    OUTOP(INDEX_op_st8_i32, TCGOutOpStore, outop_st8),
-    OUTOP(INDEX_op_st8_i64, TCGOutOpStore, outop_st8),
-    OUTOP(INDEX_op_st16_i32, TCGOutOpStore, outop_st16),
-    OUTOP(INDEX_op_st16_i64, TCGOutOpStore, outop_st16),
+    OUTOP(INDEX_op_st, TCGOutOpStore, outop_st),
+    OUTOP(INDEX_op_st8, TCGOutOpStore, outop_st8),
+    OUTOP(INDEX_op_st16, TCGOutOpStore, outop_st16),
     OUTOP(INDEX_op_sub, TCGOutOpSubtract, outop_sub),
     OUTOP(INDEX_op_subbi, TCGOutOpAddSubCarry, outop_subbi),
     OUTOP(INDEX_op_subbio, TCGOutOpAddSubCarry, outop_subbio),
@@ -1246,7 +1243,7 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_extrh_i64_i32, TCGOutOpUnary, outop_extrh_i64_i32),
     OUTOP(INDEX_op_ld32u, TCGOutOpLoad, outop_ld32u),
     OUTOP(INDEX_op_ld32s, TCGOutOpLoad, outop_ld32s),
-    OUTOP(INDEX_op_st32_i64, TCGOutOpStore, outop_st),
+    OUTOP(INDEX_op_st32, TCGOutOpStore, outop_st),
 #endif
 };
 
@@ -2464,24 +2461,19 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_or:
     case INDEX_op_setcond:
     case INDEX_op_sextract:
+    case INDEX_op_st8:
+    case INDEX_op_st16:
+    case INDEX_op_st:
     case INDEX_op_xor:
         return has_type;
 
-    case INDEX_op_st8_i32:
-    case INDEX_op_st16_i32:
-    case INDEX_op_st_i32:
-        return true;
-
     case INDEX_op_brcond2_i32:
     case INDEX_op_setcond2_i32:
         return TCG_TARGET_REG_BITS == 32;
 
     case INDEX_op_ld32u:
     case INDEX_op_ld32s:
-    case INDEX_op_st8_i64:
-    case INDEX_op_st16_i64:
-    case INDEX_op_st32_i64:
-    case INDEX_op_st_i64:
+    case INDEX_op_st32:
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
     case INDEX_op_extrl_i64_i32:
@@ -4494,10 +4486,7 @@ liveness_pass_2(TCGContext *s)
                 arg_ts->state = 0;
 
                 if (NEED_SYNC_ARG(0)) {
-                    TCGOpcode sopc = (arg_ts->type == TCG_TYPE_I32
-                                      ? INDEX_op_st_i32
-                                      : INDEX_op_st_i64);
-                    TCGOp *sop = tcg_op_insert_after(s, op, sopc,
+                    TCGOp *sop = tcg_op_insert_after(s, op, INDEX_op_st,
                                                      arg_ts->type, 3);
                     TCGTemp *out_ts = dir_ts;
 
@@ -4531,10 +4520,7 @@ liveness_pass_2(TCGContext *s)
 
                 /* Sync outputs upon their last write.  */
                 if (NEED_SYNC_ARG(i)) {
-                    TCGOpcode sopc = (arg_ts->type == TCG_TYPE_I32
-                                      ? INDEX_op_st_i32
-                                      : INDEX_op_st_i64);
-                    TCGOp *sop = tcg_op_insert_after(s, op, sopc,
+                    TCGOp *sop = tcg_op_insert_after(s, op, INDEX_op_st,
                                                      arg_ts->type, 3);
 
                     sop->args[0] = temp_arg(dir_ts);
@@ -5794,16 +5780,13 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
         }
         break;
 
-    case INDEX_op_st32_i64:
+    case INDEX_op_st32:
         /* Use tcg_op_st w/ I32. */
         type = TCG_TYPE_I32;
         /* fall through */
-    case INDEX_op_st_i32:
-    case INDEX_op_st_i64:
-    case INDEX_op_st8_i32:
-    case INDEX_op_st8_i64:
-    case INDEX_op_st16_i32:
-    case INDEX_op_st16_i64:
+    case INDEX_op_st:
+    case INDEX_op_st8:
+    case INDEX_op_st16:
         {
             const TCGOutOpStore *out =
                 container_of(all_outop[op->opc], TCGOutOpStore, base);
diff --git a/tcg/tci.c b/tcg/tci.c
index 890ccbe85b..b08288e7d3 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -325,18 +325,6 @@ static void tci_qemu_st(CPUArchState *env, uint64_t taddr, uint64_t val,
     }
 }
 
-#if TCG_TARGET_REG_BITS == 64
-# define CASE_32_64(x) \
-        case glue(glue(INDEX_op_, x), _i64): \
-        case glue(glue(INDEX_op_, x), _i32):
-# define CASE_64(x) \
-        case glue(glue(INDEX_op_, x), _i64):
-#else
-# define CASE_32_64(x) \
-        case glue(glue(INDEX_op_, x), _i32):
-# define CASE_64(x)
-#endif
-
 /* Interpret pseudo code in tb. */
 /*
  * Disable CFI checks.
@@ -491,21 +479,20 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             ptr = (void *)(regs[r1] + ofs);
             regs[r0] = *(tcg_target_ulong *)ptr;
             break;
-        CASE_32_64(st8)
+        case INDEX_op_st8:
             tci_args_rrs(insn, &r0, &r1, &ofs);
             ptr = (void *)(regs[r1] + ofs);
             *(uint8_t *)ptr = regs[r0];
             break;
-        CASE_32_64(st16)
+        case INDEX_op_st16:
             tci_args_rrs(insn, &r0, &r1, &ofs);
             ptr = (void *)(regs[r1] + ofs);
             *(uint16_t *)ptr = regs[r0];
             break;
-        case INDEX_op_st_i32:
-        CASE_64(st32)
+        case INDEX_op_st:
             tci_args_rrs(insn, &r0, &r1, &ofs);
             ptr = (void *)(regs[r1] + ofs);
-            *(uint32_t *)ptr = regs[r0];
+            *(tcg_target_ulong *)ptr = regs[r0];
             break;
 
             /* Arithmetic operations (mixed 32/64 bit). */
@@ -725,10 +712,10 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             ptr = (void *)(regs[r1] + ofs);
             regs[r0] = *(int32_t *)ptr;
             break;
-        case INDEX_op_st_i64:
+        case INDEX_op_st32:
             tci_args_rrs(insn, &r0, &r1, &ofs);
             ptr = (void *)(regs[r1] + ofs);
-            *(uint64_t *)ptr = regs[r0];
+            *(uint32_t *)ptr = regs[r0];
             break;
 
             /* Arithmetic operations (64 bit). */
@@ -975,13 +962,10 @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
     case INDEX_op_ld16s:
     case INDEX_op_ld32u:
     case INDEX_op_ld:
-    case INDEX_op_st8_i32:
-    case INDEX_op_st8_i64:
-    case INDEX_op_st16_i32:
-    case INDEX_op_st16_i64:
-    case INDEX_op_st32_i64:
-    case INDEX_op_st_i32:
-    case INDEX_op_st_i64:
+    case INDEX_op_st8:
+    case INDEX_op_st16:
+    case INDEX_op_st32:
+    case INDEX_op_st:
         tci_args_rrs(insn, &r0, &r1, &s2);
         info->fprintf_func(info->stream, "%-12s  %s, %s, %d",
                            op_name, str_r(r0), str_r(r1), s2);
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index be9270a861..1fb7575061 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -1173,7 +1173,7 @@ static const TCGOutOpLoad outop_ld32s = {
 static void tgen_st8(TCGContext *s, TCGType type, TCGReg data,
                      TCGReg base, ptrdiff_t offset)
 {
-    tcg_out_ldst(s, INDEX_op_st8_i32, data, base, offset);
+    tcg_out_ldst(s, INDEX_op_st8, data, base, offset);
 }
 
 static const TCGOutOpStore outop_st8 = {
@@ -1184,7 +1184,7 @@ static const TCGOutOpStore outop_st8 = {
 static void tgen_st16(TCGContext *s, TCGType type, TCGReg data,
                       TCGReg base, ptrdiff_t offset)
 {
-    tcg_out_ldst(s, INDEX_op_st16_i32, data, base, offset);
+    tcg_out_ldst(s, INDEX_op_st16, data, base, offset);
 }
 
 static const TCGOutOpStore outop_st16 = {
@@ -1232,18 +1232,12 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
 static void tcg_out_st(TCGContext *s, TCGType type, TCGReg val, TCGReg base,
                        intptr_t offset)
 {
-    switch (type) {
-    case TCG_TYPE_I32:
-        tcg_out_ldst(s, INDEX_op_st_i32, val, base, offset);
-        break;
-#if TCG_TARGET_REG_BITS == 64
-    case TCG_TYPE_I64:
-        tcg_out_ldst(s, INDEX_op_st_i64, val, base, offset);
-        break;
-#endif
-    default:
-        g_assert_not_reached();
+    TCGOpcode op = INDEX_op_st;
+
+    if (TCG_TARGET_REG_BITS == 64 && type == TCG_TYPE_I32) {
+        op = INDEX_op_st32;
     }
+    tcg_out_ldst(s, op, val, base, offset);
 }
 
 static inline bool tcg_out_sti(TCGContext *s, TCGType type, TCGArg val,

From bf7ca5fb3032b95fd83dbb9883e904ee28baa229 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 23 Jan 2025 09:46:57 -0800
Subject: [PATCH 0509/2760] tcg: Stash MemOp size in TCGOP_FLAGS
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This will enable removing INDEX_op_qemu_st8_*_i32,
by exposing the operand size to constraint selection.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tcg-op-ldst.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/tcg/tcg-op-ldst.c b/tcg/tcg-op-ldst.c
index 3b073b4ce0..9e4626e51d 100644
--- a/tcg/tcg-op-ldst.c
+++ b/tcg/tcg-op-ldst.c
@@ -91,11 +91,15 @@ static MemOp tcg_canonicalize_memop(MemOp op, bool is64, bool st)
 static void gen_ldst(TCGOpcode opc, TCGType type, TCGTemp *vl, TCGTemp *vh,
                      TCGTemp *addr, MemOpIdx oi)
 {
+    TCGOp *op;
+
     if (vh) {
-        tcg_gen_op4(opc, type, temp_arg(vl), temp_arg(vh), temp_arg(addr), oi);
+        op = tcg_gen_op4(opc, type, temp_arg(vl), temp_arg(vh),
+                         temp_arg(addr), oi);
     } else {
-        tcg_gen_op3(opc, type, temp_arg(vl), temp_arg(addr), oi);
+        op = tcg_gen_op3(opc, type, temp_arg(vl), temp_arg(addr), oi);
     }
+    TCGOP_FLAGS(op) = get_memop(oi) & MO_SIZE;
 }
 
 static void gen_ldst_i64(TCGOpcode opc, TCGv_i64 v, TCGTemp *addr, MemOpIdx oi)

From 33aba058c8fcc9b1581b03a1fbac45d8d91baac6 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sun, 26 Jan 2025 17:34:19 -0800
Subject: [PATCH 0510/2760] tcg: Remove INDEX_op_qemu_st8_*
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The i386 backend can now check TCGOP_FLAGS to select
the correct set of constraints.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 docs/devel/tcg-ops.rst           | 6 ------
 include/tcg/tcg-opc.h            | 4 ----
 tcg/aarch64/tcg-target-has.h     | 1 -
 tcg/arm/tcg-target-has.h         | 1 -
 tcg/i386/tcg-target-con-str.h    | 2 +-
 tcg/i386/tcg-target-has.h        | 3 ---
 tcg/i386/tcg-target.c.inc        | 9 ++++-----
 tcg/loongarch64/tcg-target-has.h | 3 ---
 tcg/mips/tcg-target-has.h        | 1 -
 tcg/optimize.c                   | 1 -
 tcg/ppc/tcg-target-has.h         | 2 --
 tcg/riscv/tcg-target-has.h       | 1 -
 tcg/s390x/tcg-target-has.h       | 1 -
 tcg/sparc64/tcg-target-has.h     | 1 -
 tcg/tcg-op-ldst.c                | 9 ++-------
 tcg/tcg.c                        | 4 ----
 tcg/tci/tcg-target-has.h         | 2 --
 17 files changed, 7 insertions(+), 44 deletions(-)

diff --git a/docs/devel/tcg-ops.rst b/docs/devel/tcg-ops.rst
index a7147407de..f26b837a30 100644
--- a/docs/devel/tcg-ops.rst
+++ b/docs/devel/tcg-ops.rst
@@ -744,8 +744,6 @@ QEMU specific operations
 
        qemu_st_i32/i64/i128 *t0*, *t1*, *flags*, *memidx*
 
-       qemu_st8_i32 *t0*, *t1*, *flags*, *memidx*
-
      - | Load data at the guest address *t1* into *t0*, or store data in *t0* at guest
          address *t1*.  The _i32/_i64/_i128 size applies to the size of the input/output
          register *t0* only.  The address *t1* is always sized according to the guest,
@@ -763,10 +761,6 @@ QEMU specific operations
          64-bit memory access specified in *flags*.
        |
        | For qemu_ld/st_i128, these are only supported for a 64-bit host.
-       |
-       | For i386, qemu_st8_i32 is exactly like qemu_st_i32, except the size of
-         the memory operation is known to be 8-bit.  This allows the backend to
-         provide a different set of register constraints.
 
 
 Host vector operations
diff --git a/include/tcg/tcg-opc.h b/include/tcg/tcg-opc.h
index a22433d8b5..0ce8332aab 100644
--- a/include/tcg/tcg-opc.h
+++ b/include/tcg/tcg-opc.h
@@ -133,10 +133,6 @@ DEF(qemu_ld_i64, DATA64_ARGS, 1, 1,
 DEF(qemu_st_i64, 0, DATA64_ARGS + 1, 1,
     TCG_OPF_CALL_CLOBBER | TCG_OPF_SIDE_EFFECTS)
 
-/* Only used by i386 to cope with stupid register constraints. */
-DEF(qemu_st8_i32, 0, 1 + 1, 1,
-    TCG_OPF_CALL_CLOBBER | TCG_OPF_SIDE_EFFECTS)
-
 /* Only for 64-bit hosts at the moment. */
 DEF(qemu_ld_i128, 2, 1, 1, TCG_OPF_CALL_CLOBBER | TCG_OPF_SIDE_EFFECTS)
 DEF(qemu_st_i128, 0, 3, 1, TCG_OPF_CALL_CLOBBER | TCG_OPF_SIDE_EFFECTS)
diff --git a/tcg/aarch64/tcg-target-has.h b/tcg/aarch64/tcg-target-has.h
index b155e37639..69e83efb69 100644
--- a/tcg/aarch64/tcg-target-has.h
+++ b/tcg/aarch64/tcg-target-has.h
@@ -14,7 +14,6 @@
 
 /* optional instructions */
 #define TCG_TARGET_HAS_extr_i64_i32     0
-#define TCG_TARGET_HAS_qemu_st8_i32     0
 
 /*
  * Without FEAT_LSE2, we must use LDXP+STXP to implement atomic 128-bit load,
diff --git a/tcg/arm/tcg-target-has.h b/tcg/arm/tcg-target-has.h
index 187269e5bd..3bbbde5d59 100644
--- a/tcg/arm/tcg-target-has.h
+++ b/tcg/arm/tcg-target-has.h
@@ -24,7 +24,6 @@ extern bool use_neon_instructions;
 #endif
 
 /* optional instructions */
-#define TCG_TARGET_HAS_qemu_st8_i32     0
 #define TCG_TARGET_HAS_qemu_ldst_i128   0
 #define TCG_TARGET_HAS_tst              1
 
diff --git a/tcg/i386/tcg-target-con-str.h b/tcg/i386/tcg-target-con-str.h
index 52142ab121..dbedff1f54 100644
--- a/tcg/i386/tcg-target-con-str.h
+++ b/tcg/i386/tcg-target-con-str.h
@@ -20,7 +20,7 @@ REGS('r', ALL_GENERAL_REGS)
 REGS('x', ALL_VECTOR_REGS)
 REGS('q', ALL_BYTEL_REGS)     /* regs that can be used as a byte operand */
 REGS('L', ALL_GENERAL_REGS & ~SOFTMMU_RESERVE_REGS)  /* qemu_ld/st */
-REGS('s', ALL_BYTEL_REGS & ~SOFTMMU_RESERVE_REGS)    /* qemu_st8_i32 data */
+REGS('s', ALL_BYTEL_REGS & ~SOFTMMU_RESERVE_REGS)    /* qemu_st MO_8 data */
 
 /*
  * Define constraint letters for constants:
diff --git a/tcg/i386/tcg-target-has.h b/tcg/i386/tcg-target-has.h
index 628e736de7..42647fabbd 100644
--- a/tcg/i386/tcg-target-has.h
+++ b/tcg/i386/tcg-target-has.h
@@ -29,9 +29,6 @@
 #if TCG_TARGET_REG_BITS == 64
 /* Keep 32-bit values zero-extended in a register.  */
 #define TCG_TARGET_HAS_extr_i64_i32     1
-#define TCG_TARGET_HAS_qemu_st8_i32     0
-#else
-#define TCG_TARGET_HAS_qemu_st8_i32     1
 #endif
 
 #define TCG_TARGET_HAS_qemu_ldst_i128 \
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index 52285bcd54..6c4c2ebd0e 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -2457,7 +2457,7 @@ static void tcg_out_qemu_st_direct(TCGContext *s, TCGReg datalo, TCGReg datahi,
 
     switch (memop & MO_SIZE) {
     case MO_8:
-        /* This is handled with constraints on INDEX_op_qemu_st8_i32. */
+        /* This is handled with constraints on INDEX_op_qemu_st_i32. */
         tcg_debug_assert(TCG_TARGET_REG_BITS == 64 || datalo < 4);
         tcg_out_modrm_sib_offset(s, OPC_MOVB_EvGv + P_REXB_R + h.seg,
                                  datalo, h.base, h.index, 0, h.ofs);
@@ -3568,7 +3568,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
         break;
 
     case INDEX_op_qemu_st_i32:
-    case INDEX_op_qemu_st8_i32:
         tcg_out_qemu_st(s, a0, -1, a1, a2, TCG_TYPE_I32);
         break;
     case INDEX_op_qemu_st_i64:
@@ -4140,9 +4139,9 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
         return C_O1_I1(r, L);
 
     case INDEX_op_qemu_st_i32:
-        return C_O0_I2(L, L);
-    case INDEX_op_qemu_st8_i32:
-        return C_O0_I2(s, L);
+        return (TCG_TARGET_REG_BITS == 32 && flags == MO_8
+                ? C_O0_I2(s, L)
+                : C_O0_I2(L, L));
 
     case INDEX_op_qemu_ld_i64:
         return TCG_TARGET_REG_BITS == 64 ? C_O1_I1(r, L) : C_O2_I1(r, r, L);
diff --git a/tcg/loongarch64/tcg-target-has.h b/tcg/loongarch64/tcg-target-has.h
index 9c118bd1f6..32abc6f457 100644
--- a/tcg/loongarch64/tcg-target-has.h
+++ b/tcg/loongarch64/tcg-target-has.h
@@ -9,9 +9,6 @@
 
 #include "host/cpuinfo.h"
 
-/* optional instructions */
-#define TCG_TARGET_HAS_qemu_st8_i32     0
-
 /* 64-bit operations */
 #define TCG_TARGET_HAS_extr_i64_i32     1
 
diff --git a/tcg/mips/tcg-target-has.h b/tcg/mips/tcg-target-has.h
index d8f9f7beef..b9eb338528 100644
--- a/tcg/mips/tcg-target-has.h
+++ b/tcg/mips/tcg-target-has.h
@@ -46,7 +46,6 @@ extern bool use_mips32r2_instructions;
 #endif
 
 /* optional instructions detected at runtime */
-#define TCG_TARGET_HAS_qemu_st8_i32     0
 #define TCG_TARGET_HAS_qemu_ldst_i128   0
 #define TCG_TARGET_HAS_tst              0
 
diff --git a/tcg/optimize.c b/tcg/optimize.c
index cfb407c7fc..4d2220664a 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -3192,7 +3192,6 @@ void tcg_optimize(TCGContext *s)
         case INDEX_op_qemu_ld_i128:
             done = fold_qemu_ld_2reg(&ctx, op);
             break;
-        case INDEX_op_qemu_st8_i32:
         case INDEX_op_qemu_st_i32:
         case INDEX_op_qemu_st_i64:
         case INDEX_op_qemu_st_i128:
diff --git a/tcg/ppc/tcg-target-has.h b/tcg/ppc/tcg-target-has.h
index b978c91a62..81ec5aece7 100644
--- a/tcg/ppc/tcg-target-has.h
+++ b/tcg/ppc/tcg-target-has.h
@@ -17,8 +17,6 @@
 #define have_vsx       (cpuinfo & CPUINFO_VSX)
 
 /* optional instructions */
-#define TCG_TARGET_HAS_qemu_st8_i32     0
-
 #if TCG_TARGET_REG_BITS == 64
 #define TCG_TARGET_HAS_extr_i64_i32     0
 #endif
diff --git a/tcg/riscv/tcg-target-has.h b/tcg/riscv/tcg-target-has.h
index 8cd099546f..aef10c2d9d 100644
--- a/tcg/riscv/tcg-target-has.h
+++ b/tcg/riscv/tcg-target-has.h
@@ -10,7 +10,6 @@
 #include "host/cpuinfo.h"
 
 /* optional instructions */
-#define TCG_TARGET_HAS_qemu_st8_i32     0
 #define TCG_TARGET_HAS_extr_i64_i32     1
 #define TCG_TARGET_HAS_qemu_ldst_i128   0
 #define TCG_TARGET_HAS_tst              0
diff --git a/tcg/s390x/tcg-target-has.h b/tcg/s390x/tcg-target-has.h
index c04cc4e377..0aeb5ba01a 100644
--- a/tcg/s390x/tcg-target-has.h
+++ b/tcg/s390x/tcg-target-has.h
@@ -30,7 +30,6 @@ extern uint64_t s390_facilities[3];
 
 /* optional instructions */
 #define TCG_TARGET_HAS_extr_i64_i32   0
-#define TCG_TARGET_HAS_qemu_st8_i32   0
 #define TCG_TARGET_HAS_qemu_ldst_i128 1
 #define TCG_TARGET_HAS_tst            1
 
diff --git a/tcg/sparc64/tcg-target-has.h b/tcg/sparc64/tcg-target-has.h
index d9f5ef3fc9..af6a949da3 100644
--- a/tcg/sparc64/tcg-target-has.h
+++ b/tcg/sparc64/tcg-target-has.h
@@ -14,7 +14,6 @@ extern bool use_vis3_instructions;
 #endif
 
 /* optional instructions */
-#define TCG_TARGET_HAS_qemu_st8_i32     0
 #define TCG_TARGET_HAS_extr_i64_i32     0
 #define TCG_TARGET_HAS_qemu_ldst_i128   0
 #define TCG_TARGET_HAS_tst              1
diff --git a/tcg/tcg-op-ldst.c b/tcg/tcg-op-ldst.c
index 9e4626e51d..ac1af9f77c 100644
--- a/tcg/tcg-op-ldst.c
+++ b/tcg/tcg-op-ldst.c
@@ -270,7 +270,6 @@ static void tcg_gen_qemu_st_i32_int(TCGv_i32 val, TCGTemp *addr,
 {
     TCGv_i32 swap = NULL;
     MemOpIdx orig_oi, oi;
-    TCGOpcode opc;
 
     tcg_gen_req_mo(TCG_MO_LD_ST | TCG_MO_ST_ST);
     memop = tcg_canonicalize_memop(memop, 0, 1);
@@ -293,12 +292,8 @@ static void tcg_gen_qemu_st_i32_int(TCGv_i32 val, TCGTemp *addr,
         oi = make_memop_idx(memop, idx);
     }
 
-    if (TCG_TARGET_HAS_qemu_st8_i32 && (memop & MO_SIZE) == MO_8) {
-        opc = INDEX_op_qemu_st8_i32;
-    } else {
-        opc = INDEX_op_qemu_st_i32;
-    }
-    gen_ldst(opc, TCG_TYPE_I32, tcgv_i32_temp(val), NULL, addr, oi);
+    gen_ldst(INDEX_op_qemu_st_i32, TCG_TYPE_I32,
+             tcgv_i32_temp(val), NULL, addr, oi);
     plugin_gen_mem_callbacks_i32(val, NULL, addr, orig_oi, QEMU_PLUGIN_MEM_W);
 
     if (swap) {
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 44b6b8319f..5c0cab205c 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -2438,9 +2438,6 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_qemu_st_i64:
         return true;
 
-    case INDEX_op_qemu_st8_i32:
-        return TCG_TARGET_HAS_qemu_st8_i32;
-
     case INDEX_op_qemu_ld_i128:
     case INDEX_op_qemu_st_i128:
         return TCG_TARGET_HAS_qemu_ldst_i128;
@@ -3012,7 +3009,6 @@ void tcg_dump_ops(TCGContext *s, FILE *f, bool have_prefs)
                 break;
             case INDEX_op_qemu_ld_i32:
             case INDEX_op_qemu_st_i32:
-            case INDEX_op_qemu_st8_i32:
             case INDEX_op_qemu_ld_i64:
             case INDEX_op_qemu_st_i64:
             case INDEX_op_qemu_ld_i128:
diff --git a/tcg/tci/tcg-target-has.h b/tcg/tci/tcg-target-has.h
index 497e8152b7..ab07ce1fcb 100644
--- a/tcg/tci/tcg-target-has.h
+++ b/tcg/tci/tcg-target-has.h
@@ -7,8 +7,6 @@
 #ifndef TCG_TARGET_HAS_H
 #define TCG_TARGET_HAS_H
 
-#define TCG_TARGET_HAS_qemu_st8_i32     0
-
 #if TCG_TARGET_REG_BITS == 64
 #define TCG_TARGET_HAS_extr_i64_i32     0
 #endif /* TCG_TARGET_REG_BITS == 64 */

From aae2456ac0b4eb91da7ee8a4b31052f2e8a77af8 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sun, 9 Feb 2025 12:55:15 -0800
Subject: [PATCH 0511/2760] tcg: Merge INDEX_op_{ld,st}_{i32,i64,i128}

Merge into INDEX_op_{ld,st,ld2,st2}, where "2" indicates that two
inputs or outputs are required. This simplifies the processing of
i64/i128 depending on host word size.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/tcg/tcg-opc.h            | 16 ++-----
 tcg/aarch64/tcg-target.c.inc     | 20 ++++-----
 tcg/arm/tcg-target.c.inc         | 16 +++----
 tcg/i386/tcg-target.c.inc        | 50 ++++++---------------
 tcg/loongarch64/tcg-target.c.inc | 28 +++++-------
 tcg/mips/tcg-target.c.inc        | 38 +++++++---------
 tcg/optimize.c                   | 15 ++-----
 tcg/ppc/tcg-target.c.inc         | 47 ++++++++------------
 tcg/riscv/tcg-target.c.inc       | 20 +++------
 tcg/s390x/tcg-target.c.inc       | 28 +++++-------
 tcg/sparc64/tcg-target.c.inc     | 20 +++------
 tcg/tcg-op-ldst.c                | 75 +++++++++++++++++---------------
 tcg/tcg.c                        | 28 +++++++-----
 tcg/tci.c                        | 69 ++++++++++++-----------------
 tcg/tci/tcg-target.c.inc         | 36 ++++++---------
 15 files changed, 200 insertions(+), 306 deletions(-)

diff --git a/include/tcg/tcg-opc.h b/include/tcg/tcg-opc.h
index 0ce8332aab..995b79383e 100644
--- a/include/tcg/tcg-opc.h
+++ b/include/tcg/tcg-opc.h
@@ -124,18 +124,10 @@ DEF(goto_ptr, 0, 1, 0, TCG_OPF_BB_EXIT | TCG_OPF_BB_END)
 DEF(plugin_cb, 0, 0, 1, TCG_OPF_NOT_PRESENT)
 DEF(plugin_mem_cb, 0, 1, 1, TCG_OPF_NOT_PRESENT)
 
-DEF(qemu_ld_i32, 1, 1, 1,
-    TCG_OPF_CALL_CLOBBER | TCG_OPF_SIDE_EFFECTS)
-DEF(qemu_st_i32, 0, 1 + 1, 1,
-    TCG_OPF_CALL_CLOBBER | TCG_OPF_SIDE_EFFECTS)
-DEF(qemu_ld_i64, DATA64_ARGS, 1, 1,
-    TCG_OPF_CALL_CLOBBER | TCG_OPF_SIDE_EFFECTS)
-DEF(qemu_st_i64, 0, DATA64_ARGS + 1, 1,
-    TCG_OPF_CALL_CLOBBER | TCG_OPF_SIDE_EFFECTS)
-
-/* Only for 64-bit hosts at the moment. */
-DEF(qemu_ld_i128, 2, 1, 1, TCG_OPF_CALL_CLOBBER | TCG_OPF_SIDE_EFFECTS)
-DEF(qemu_st_i128, 0, 3, 1, TCG_OPF_CALL_CLOBBER | TCG_OPF_SIDE_EFFECTS)
+DEF(qemu_ld, 1, 1, 1, TCG_OPF_CALL_CLOBBER | TCG_OPF_SIDE_EFFECTS | TCG_OPF_INT)
+DEF(qemu_st, 0, 2, 1, TCG_OPF_CALL_CLOBBER | TCG_OPF_SIDE_EFFECTS | TCG_OPF_INT)
+DEF(qemu_ld2, 2, 1, 1, TCG_OPF_CALL_CLOBBER | TCG_OPF_SIDE_EFFECTS | TCG_OPF_INT)
+DEF(qemu_st2, 0, 3, 1, TCG_OPF_CALL_CLOBBER | TCG_OPF_SIDE_EFFECTS | TCG_OPF_INT)
 
 /* Host vector support.  */
 
diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index 39a44507d1..a48cb46799 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -2875,18 +2875,16 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType ext,
     TCGArg a2 = args[2];
 
     switch (opc) {
-    case INDEX_op_qemu_ld_i32:
-    case INDEX_op_qemu_ld_i64:
+    case INDEX_op_qemu_ld:
         tcg_out_qemu_ld(s, a0, a1, a2, ext);
         break;
-    case INDEX_op_qemu_st_i32:
-    case INDEX_op_qemu_st_i64:
+    case INDEX_op_qemu_st:
         tcg_out_qemu_st(s, a0, a1, a2, ext);
         break;
-    case INDEX_op_qemu_ld_i128:
+    case INDEX_op_qemu_ld2:
         tcg_out_qemu_ldst_i128(s, a0, a1, a2, args[3], true);
         break;
-    case INDEX_op_qemu_st_i128:
+    case INDEX_op_qemu_st2:
         tcg_out_qemu_ldst_i128(s, a0, a1, a2, args[3], false);
         break;
 
@@ -3342,15 +3340,13 @@ static TCGConstraintSetIndex
 tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 {
     switch (op) {
-    case INDEX_op_qemu_ld_i32:
-    case INDEX_op_qemu_ld_i64:
+    case INDEX_op_qemu_ld:
         return C_O1_I1(r, r);
-    case INDEX_op_qemu_ld_i128:
+    case INDEX_op_qemu_ld2:
         return C_O2_I1(r, r, r);
-    case INDEX_op_qemu_st_i32:
-    case INDEX_op_qemu_st_i64:
+    case INDEX_op_qemu_st:
         return C_O0_I2(rz, r);
-    case INDEX_op_qemu_st_i128:
+    case INDEX_op_qemu_st2:
         return C_O0_I3(rz, rz, r);
 
     case INDEX_op_add_vec:
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index 5b34f61ca1..29fd82e9e0 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -2570,17 +2570,17 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const int const_args[TCG_MAX_OP_ARGS])
 {
     switch (opc) {
-    case INDEX_op_qemu_ld_i32:
+    case INDEX_op_qemu_ld:
         tcg_out_qemu_ld(s, args[0], -1, args[1], args[2], TCG_TYPE_I32);
         break;
-    case INDEX_op_qemu_ld_i64:
+    case INDEX_op_qemu_ld2:
         tcg_out_qemu_ld(s, args[0], args[1], args[2], args[3], TCG_TYPE_I64);
         break;
 
-    case INDEX_op_qemu_st_i32:
+    case INDEX_op_qemu_st:
         tcg_out_qemu_st(s, args[0], -1, args[1], args[2], TCG_TYPE_I32);
         break;
-    case INDEX_op_qemu_st_i64:
+    case INDEX_op_qemu_st2:
         tcg_out_qemu_st(s, args[0], args[1], args[2], args[3], TCG_TYPE_I64);
         break;
 
@@ -2596,13 +2596,13 @@ static TCGConstraintSetIndex
 tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 {
     switch (op) {
-    case INDEX_op_qemu_ld_i32:
+    case INDEX_op_qemu_ld:
         return C_O1_I1(r, q);
-    case INDEX_op_qemu_ld_i64:
+    case INDEX_op_qemu_ld2:
         return C_O2_I1(e, p, q);
-    case INDEX_op_qemu_st_i32:
+    case INDEX_op_qemu_st:
         return C_O0_I2(q, q);
-    case INDEX_op_qemu_st_i64:
+    case INDEX_op_qemu_st2:
         return C_O0_I3(Q, p, q);
 
     case INDEX_op_st_vec:
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index 6c4c2ebd0e..cb66f6c27f 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -2457,7 +2457,7 @@ static void tcg_out_qemu_st_direct(TCGContext *s, TCGReg datalo, TCGReg datahi,
 
     switch (memop & MO_SIZE) {
     case MO_8:
-        /* This is handled with constraints on INDEX_op_qemu_st_i32. */
+        /* This is handled with constraints on INDEX_op_qemu_st. */
         tcg_debug_assert(TCG_TARGET_REG_BITS == 64 || datalo < 4);
         tcg_out_modrm_sib_offset(s, OPC_MOVB_EvGv + P_REXB_R + h.seg,
                                  datalo, h.base, h.index, 0, h.ofs);
@@ -3552,34 +3552,18 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     a2 = args[2];
 
     switch (opc) {
-    case INDEX_op_qemu_ld_i32:
-        tcg_out_qemu_ld(s, a0, -1, a1, a2, TCG_TYPE_I32);
+    case INDEX_op_qemu_ld:
+        tcg_out_qemu_ld(s, a0, -1, a1, a2, type);
         break;
-    case INDEX_op_qemu_ld_i64:
-        if (TCG_TARGET_REG_BITS == 64) {
-            tcg_out_qemu_ld(s, a0, -1, a1, a2, TCG_TYPE_I64);
-        } else {
-            tcg_out_qemu_ld(s, a0, a1, a2, args[3], TCG_TYPE_I64);
-        }
-        break;
-    case INDEX_op_qemu_ld_i128:
-        tcg_debug_assert(TCG_TARGET_REG_BITS == 64);
-        tcg_out_qemu_ld(s, a0, a1, a2, args[3], TCG_TYPE_I128);
+    case INDEX_op_qemu_ld2:
+        tcg_out_qemu_ld(s, a0, a1, a2, args[3], type);
         break;
 
-    case INDEX_op_qemu_st_i32:
-        tcg_out_qemu_st(s, a0, -1, a1, a2, TCG_TYPE_I32);
+    case INDEX_op_qemu_st:
+        tcg_out_qemu_st(s, a0, -1, a1, a2, type);
         break;
-    case INDEX_op_qemu_st_i64:
-        if (TCG_TARGET_REG_BITS == 64) {
-            tcg_out_qemu_st(s, a0, -1, a1, a2, TCG_TYPE_I64);
-        } else {
-            tcg_out_qemu_st(s, a0, a1, a2, args[3], TCG_TYPE_I64);
-        }
-        break;
-    case INDEX_op_qemu_st_i128:
-        tcg_debug_assert(TCG_TARGET_REG_BITS == 64);
-        tcg_out_qemu_st(s, a0, a1, a2, args[3], TCG_TYPE_I128);
+    case INDEX_op_qemu_st2:
+        tcg_out_qemu_st(s, a0, a1, a2, args[3], type);
         break;
 
     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
@@ -4135,25 +4119,17 @@ static TCGConstraintSetIndex
 tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 {
     switch (op) {
-    case INDEX_op_qemu_ld_i32:
+    case INDEX_op_qemu_ld:
         return C_O1_I1(r, L);
 
-    case INDEX_op_qemu_st_i32:
+    case INDEX_op_qemu_st:
         return (TCG_TARGET_REG_BITS == 32 && flags == MO_8
                 ? C_O0_I2(s, L)
                 : C_O0_I2(L, L));
 
-    case INDEX_op_qemu_ld_i64:
-        return TCG_TARGET_REG_BITS == 64 ? C_O1_I1(r, L) : C_O2_I1(r, r, L);
-
-    case INDEX_op_qemu_st_i64:
-        return TCG_TARGET_REG_BITS == 64 ? C_O0_I2(L, L) : C_O0_I3(L, L, L);
-
-    case INDEX_op_qemu_ld_i128:
-        tcg_debug_assert(TCG_TARGET_REG_BITS == 64);
+    case INDEX_op_qemu_ld2:
         return C_O2_I1(r, r, L);
-    case INDEX_op_qemu_st_i128:
-        tcg_debug_assert(TCG_TARGET_REG_BITS == 64);
+    case INDEX_op_qemu_st2:
         return C_O0_I3(L, L, L);
 
     case INDEX_op_ld_vec:
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index 73a1196d8b..e4a8b43578 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -2020,22 +2020,16 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     TCGArg a3 = args[3];
 
     switch (opc) {
-    case INDEX_op_qemu_ld_i32:
-        tcg_out_qemu_ld(s, a0, a1, a2, TCG_TYPE_I32);
+    case INDEX_op_qemu_ld:
+        tcg_out_qemu_ld(s, a0, a1, a2, type);
         break;
-    case INDEX_op_qemu_ld_i64:
-        tcg_out_qemu_ld(s, a0, a1, a2, TCG_TYPE_I64);
-        break;
-    case INDEX_op_qemu_ld_i128:
+    case INDEX_op_qemu_ld2:
         tcg_out_qemu_ldst_i128(s, a0, a1, a2, a3, true);
         break;
-    case INDEX_op_qemu_st_i32:
-        tcg_out_qemu_st(s, a0, a1, a2, TCG_TYPE_I32);
+    case INDEX_op_qemu_st:
+        tcg_out_qemu_st(s, a0, a1, a2, type);
         break;
-    case INDEX_op_qemu_st_i64:
-        tcg_out_qemu_st(s, a0, a1, a2, TCG_TYPE_I64);
-        break;
-    case INDEX_op_qemu_st_i128:
+    case INDEX_op_qemu_st2:
         tcg_out_qemu_ldst_i128(s, a0, a1, a2, a3, false);
         break;
 
@@ -2541,18 +2535,16 @@ static TCGConstraintSetIndex
 tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 {
     switch (op) {
-    case INDEX_op_qemu_st_i32:
-    case INDEX_op_qemu_st_i64:
+    case INDEX_op_qemu_st:
         return C_O0_I2(rz, r);
 
-    case INDEX_op_qemu_ld_i128:
+    case INDEX_op_qemu_ld2:
         return C_N2_I1(r, r, r);
 
-    case INDEX_op_qemu_st_i128:
+    case INDEX_op_qemu_st2:
         return C_O0_I3(r, r, r);
 
-    case INDEX_op_qemu_ld_i32:
-    case INDEX_op_qemu_ld_i64:
+    case INDEX_op_qemu_ld:
         return C_O1_I1(r, r);
 
     case INDEX_op_ld_vec:
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index 5e41729d88..eaaf0f2024 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -2381,26 +2381,20 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     a2 = args[2];
 
     switch (opc) {
-    case INDEX_op_qemu_ld_i32:
-        tcg_out_qemu_ld(s, a0, 0, a1, a2, TCG_TYPE_I32);
+    case INDEX_op_qemu_ld:
+        tcg_out_qemu_ld(s, a0, 0, a1, a2, type);
         break;
-    case INDEX_op_qemu_ld_i64:
-        if (TCG_TARGET_REG_BITS == 64) {
-            tcg_out_qemu_ld(s, a0, 0, a1, a2, TCG_TYPE_I64);
-        } else {
-            tcg_out_qemu_ld(s, a0, a1, a2, args[3], TCG_TYPE_I64);
-        }
+    case INDEX_op_qemu_ld2:
+        tcg_debug_assert(TCG_TARGET_REG_BITS == 32);
+        tcg_out_qemu_ld(s, a0, a1, a2, args[3], type);
         break;
 
-    case INDEX_op_qemu_st_i32:
-        tcg_out_qemu_st(s, a0, 0, a1, a2, TCG_TYPE_I32);
+    case INDEX_op_qemu_st:
+        tcg_out_qemu_st(s, a0, 0, a1, a2, type);
         break;
-    case INDEX_op_qemu_st_i64:
-        if (TCG_TARGET_REG_BITS == 64) {
-            tcg_out_qemu_st(s, a0, 0, a1, a2, TCG_TYPE_I64);
-        } else {
-            tcg_out_qemu_st(s, a0, a1, a2, args[3], TCG_TYPE_I64);
-        }
+    case INDEX_op_qemu_st2:
+        tcg_debug_assert(TCG_TARGET_REG_BITS == 32);
+        tcg_out_qemu_st(s, a0, a1, a2, args[3], type);
         break;
 
     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
@@ -2415,14 +2409,14 @@ static TCGConstraintSetIndex
 tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 {
     switch (op) {
-    case INDEX_op_qemu_ld_i32:
+    case INDEX_op_qemu_ld:
         return C_O1_I1(r, r);
-    case INDEX_op_qemu_st_i32:
+    case INDEX_op_qemu_st:
         return C_O0_I2(rz, r);
-    case INDEX_op_qemu_ld_i64:
-        return TCG_TARGET_REG_BITS == 64 ? C_O1_I1(r, r) : C_O2_I1(r, r, r);
-    case INDEX_op_qemu_st_i64:
-        return TCG_TARGET_REG_BITS == 64 ? C_O0_I2(rz, r) : C_O0_I3(rz, rz, r);
+    case INDEX_op_qemu_ld2:
+        return TCG_TARGET_REG_BITS == 64 ? C_NotImplemented : C_O2_I1(r, r, r);
+    case INDEX_op_qemu_st2:
+        return TCG_TARGET_REG_BITS == 64 ? C_NotImplemented : C_O0_I3(rz, rz, r);
 
     default:
         return C_NotImplemented;
diff --git a/tcg/optimize.c b/tcg/optimize.c
index 4d2220664a..10a76c5461 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -3180,21 +3180,14 @@ void tcg_optimize(TCGContext *s)
         case INDEX_op_orc_vec:
             done = fold_orc(&ctx, op);
             break;
-        case INDEX_op_qemu_ld_i32:
+        case INDEX_op_qemu_ld:
             done = fold_qemu_ld_1reg(&ctx, op);
             break;
-        case INDEX_op_qemu_ld_i64:
-            if (TCG_TARGET_REG_BITS == 64) {
-                done = fold_qemu_ld_1reg(&ctx, op);
-                break;
-            }
-            QEMU_FALLTHROUGH;
-        case INDEX_op_qemu_ld_i128:
+        case INDEX_op_qemu_ld2:
             done = fold_qemu_ld_2reg(&ctx, op);
             break;
-        case INDEX_op_qemu_st_i32:
-        case INDEX_op_qemu_st_i64:
-        case INDEX_op_qemu_st_i128:
+        case INDEX_op_qemu_st:
+        case INDEX_op_qemu_st2:
             done = fold_qemu_st(&ctx, op);
             break;
         case INDEX_op_rems:
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index 9cf24831df..bb26769d53 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -3779,35 +3779,27 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const int const_args[TCG_MAX_OP_ARGS])
 {
     switch (opc) {
-    case INDEX_op_qemu_ld_i32:
-        tcg_out_qemu_ld(s, args[0], -1, args[1], args[2], TCG_TYPE_I32);
+    case INDEX_op_qemu_ld:
+        tcg_out_qemu_ld(s, args[0], -1, args[1], args[2], type);
         break;
-    case INDEX_op_qemu_ld_i64:
-        if (TCG_TARGET_REG_BITS == 64) {
-            tcg_out_qemu_ld(s, args[0], -1, args[1], args[2], TCG_TYPE_I64);
-        } else {
+    case INDEX_op_qemu_ld2:
+        if (TCG_TARGET_REG_BITS == 32) {
             tcg_out_qemu_ld(s, args[0], args[1], args[2],
                             args[3], TCG_TYPE_I64);
+            break;
         }
-        break;
-    case INDEX_op_qemu_ld_i128:
-        tcg_debug_assert(TCG_TARGET_REG_BITS == 64);
         tcg_out_qemu_ldst_i128(s, args[0], args[1], args[2], args[3], true);
         break;
 
-    case INDEX_op_qemu_st_i32:
-        tcg_out_qemu_st(s, args[0], -1, args[1], args[2], TCG_TYPE_I32);
+    case INDEX_op_qemu_st:
+        tcg_out_qemu_st(s, args[0], -1, args[1], args[2], type);
         break;
-    case INDEX_op_qemu_st_i64:
-        if (TCG_TARGET_REG_BITS == 64) {
-            tcg_out_qemu_st(s, args[0], -1, args[1], args[2], TCG_TYPE_I64);
-        } else {
+    case INDEX_op_qemu_st2:
+        if (TCG_TARGET_REG_BITS == 32) {
             tcg_out_qemu_st(s, args[0], args[1], args[2],
                             args[3], TCG_TYPE_I64);
+            break;
         }
-        break;
-    case INDEX_op_qemu_st_i128:
-        tcg_debug_assert(TCG_TARGET_REG_BITS == 64);
         tcg_out_qemu_ldst_i128(s, args[0], args[1], args[2], args[3], false);
         break;
 
@@ -4426,20 +4418,17 @@ static TCGConstraintSetIndex
 tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 {
     switch (op) {
-    case INDEX_op_qemu_ld_i32:
+    case INDEX_op_qemu_ld:
         return C_O1_I1(r, r);
-    case INDEX_op_qemu_ld_i64:
-        return TCG_TARGET_REG_BITS == 64 ? C_O1_I1(r, r) : C_O2_I1(r, r, r);
+    case INDEX_op_qemu_ld2:
+        return TCG_TARGET_REG_BITS == 64
+               ? C_N1O1_I1(o, m, r) : C_O2_I1(r, r, r);
 
-    case INDEX_op_qemu_st_i32:
+    case INDEX_op_qemu_st:
         return C_O0_I2(r, r);
-    case INDEX_op_qemu_st_i64:
-        return TCG_TARGET_REG_BITS == 64 ? C_O0_I2(r, r) : C_O0_I3(r, r, r);
-
-    case INDEX_op_qemu_ld_i128:
-        return C_N1O1_I1(o, m, r);
-    case INDEX_op_qemu_st_i128:
-        return C_O0_I3(o, m, r);
+    case INDEX_op_qemu_st2:
+        return TCG_TARGET_REG_BITS == 64
+               ? C_O0_I3(o, m, r) : C_O0_I3(r, r, r);
 
     case INDEX_op_add_vec:
     case INDEX_op_sub_vec:
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index bcfdb6c545..89c7736f9a 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -2633,17 +2633,11 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     TCGArg a2 = args[2];
 
     switch (opc) {
-    case INDEX_op_qemu_ld_i32:
-        tcg_out_qemu_ld(s, a0, a1, a2, TCG_TYPE_I32);
+    case INDEX_op_qemu_ld:
+        tcg_out_qemu_ld(s, a0, a1, a2, type);
         break;
-    case INDEX_op_qemu_ld_i64:
-        tcg_out_qemu_ld(s, a0, a1, a2, TCG_TYPE_I64);
-        break;
-    case INDEX_op_qemu_st_i32:
-        tcg_out_qemu_st(s, a0, a1, a2, TCG_TYPE_I32);
-        break;
-    case INDEX_op_qemu_st_i64:
-        tcg_out_qemu_st(s, a0, a1, a2, TCG_TYPE_I64);
+    case INDEX_op_qemu_st:
+        tcg_out_qemu_st(s, a0, a1, a2, type);
         break;
 
     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
@@ -2875,11 +2869,9 @@ static TCGConstraintSetIndex
 tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 {
     switch (op) {
-    case INDEX_op_qemu_ld_i32:
-    case INDEX_op_qemu_ld_i64:
+    case INDEX_op_qemu_ld:
         return C_O1_I1(r, r);
-    case INDEX_op_qemu_st_i32:
-    case INDEX_op_qemu_st_i64:
+    case INDEX_op_qemu_st:
         return C_O0_I2(rz, r);
 
     case INDEX_op_st_vec:
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index e266c19829..652ce9023e 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -3133,22 +3133,16 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const int const_args[TCG_MAX_OP_ARGS])
 {
     switch (opc) {
-    case INDEX_op_qemu_ld_i32:
-        tcg_out_qemu_ld(s, args[0], args[1], args[2], TCG_TYPE_I32);
+    case INDEX_op_qemu_ld:
+        tcg_out_qemu_ld(s, args[0], args[1], args[2], type);
         break;
-    case INDEX_op_qemu_ld_i64:
-        tcg_out_qemu_ld(s, args[0], args[1], args[2], TCG_TYPE_I64);
+    case INDEX_op_qemu_st:
+        tcg_out_qemu_st(s, args[0], args[1], args[2], type);
         break;
-    case INDEX_op_qemu_st_i32:
-        tcg_out_qemu_st(s, args[0], args[1], args[2], TCG_TYPE_I32);
-        break;
-    case INDEX_op_qemu_st_i64:
-        tcg_out_qemu_st(s, args[0], args[1], args[2], TCG_TYPE_I64);
-        break;
-    case INDEX_op_qemu_ld_i128:
+    case INDEX_op_qemu_ld2:
         tcg_out_qemu_ldst_i128(s, args[0], args[1], args[2], args[3], true);
         break;
-    case INDEX_op_qemu_st_i128:
+    case INDEX_op_qemu_st2:
         tcg_out_qemu_ldst_i128(s, args[0], args[1], args[2], args[3], false);
         break;
 
@@ -3600,15 +3594,13 @@ static TCGConstraintSetIndex
 tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 {
     switch (op) {
-    case INDEX_op_qemu_ld_i32:
-    case INDEX_op_qemu_ld_i64:
+    case INDEX_op_qemu_ld:
         return C_O1_I1(r, r);
-    case INDEX_op_qemu_st_i64:
-    case INDEX_op_qemu_st_i32:
+    case INDEX_op_qemu_st:
         return C_O0_I2(r, r);
-    case INDEX_op_qemu_ld_i128:
+    case INDEX_op_qemu_ld2:
         return C_O2_I1(o, m, r);
-    case INDEX_op_qemu_st_i128:
+    case INDEX_op_qemu_st2:
         return C_O0_I3(o, m, r);
 
     case INDEX_op_st_vec:
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index a0efeee98c..bf27b6b54b 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -2068,17 +2068,11 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     a2 = args[2];
 
     switch (opc) {
-    case INDEX_op_qemu_ld_i32:
-        tcg_out_qemu_ld(s, a0, a1, a2, TCG_TYPE_I32);
+    case INDEX_op_qemu_ld:
+        tcg_out_qemu_ld(s, a0, a1, a2, type);
         break;
-    case INDEX_op_qemu_ld_i64:
-        tcg_out_qemu_ld(s, a0, a1, a2, TCG_TYPE_I64);
-        break;
-    case INDEX_op_qemu_st_i32:
-        tcg_out_qemu_st(s, a0, a1, a2, TCG_TYPE_I32);
-        break;
-    case INDEX_op_qemu_st_i64:
-        tcg_out_qemu_st(s, a0, a1, a2, TCG_TYPE_I64);
+    case INDEX_op_qemu_st:
+        tcg_out_qemu_st(s, a0, a1, a2, type);
         break;
 
     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
@@ -2093,12 +2087,10 @@ static TCGConstraintSetIndex
 tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 {
     switch (op) {
-    case INDEX_op_qemu_ld_i32:
-    case INDEX_op_qemu_ld_i64:
+    case INDEX_op_qemu_ld:
         return C_O1_I1(r, r);
 
-    case INDEX_op_qemu_st_i32:
-    case INDEX_op_qemu_st_i64:
+    case INDEX_op_qemu_st:
         return C_O0_I2(rz, r);
 
     default:
diff --git a/tcg/tcg-op-ldst.c b/tcg/tcg-op-ldst.c
index ac1af9f77c..fa9e52277b 100644
--- a/tcg/tcg-op-ldst.c
+++ b/tcg/tcg-op-ldst.c
@@ -88,28 +88,40 @@ static MemOp tcg_canonicalize_memop(MemOp op, bool is64, bool st)
     return op;
 }
 
-static void gen_ldst(TCGOpcode opc, TCGType type, TCGTemp *vl, TCGTemp *vh,
-                     TCGTemp *addr, MemOpIdx oi)
+static void gen_ldst1(TCGOpcode opc, TCGType type, TCGTemp *v,
+                      TCGTemp *addr, MemOpIdx oi)
 {
-    TCGOp *op;
-
-    if (vh) {
-        op = tcg_gen_op4(opc, type, temp_arg(vl), temp_arg(vh),
-                         temp_arg(addr), oi);
-    } else {
-        op = tcg_gen_op3(opc, type, temp_arg(vl), temp_arg(addr), oi);
-    }
+    TCGOp *op = tcg_gen_op3(opc, type, temp_arg(v), temp_arg(addr), oi);
     TCGOP_FLAGS(op) = get_memop(oi) & MO_SIZE;
 }
 
-static void gen_ldst_i64(TCGOpcode opc, TCGv_i64 v, TCGTemp *addr, MemOpIdx oi)
+static void gen_ldst2(TCGOpcode opc, TCGType type, TCGTemp *vl, TCGTemp *vh,
+                      TCGTemp *addr, MemOpIdx oi)
+{
+    TCGOp *op = tcg_gen_op4(opc, type, temp_arg(vl), temp_arg(vh),
+                            temp_arg(addr), oi);
+    TCGOP_FLAGS(op) = get_memop(oi) & MO_SIZE;
+}
+
+static void gen_ld_i64(TCGv_i64 v, TCGTemp *addr, MemOpIdx oi)
 {
     if (TCG_TARGET_REG_BITS == 32) {
-        TCGTemp *vl = tcgv_i32_temp(TCGV_LOW(v));
-        TCGTemp *vh = tcgv_i32_temp(TCGV_HIGH(v));
-        gen_ldst(opc, TCG_TYPE_I64, vl, vh, addr, oi);
+        gen_ldst2(INDEX_op_qemu_ld2, TCG_TYPE_I64,
+                  tcgv_i32_temp(TCGV_LOW(v)), tcgv_i32_temp(TCGV_HIGH(v)),
+                  addr, oi);
     } else {
-        gen_ldst(opc, TCG_TYPE_I64, tcgv_i64_temp(v), NULL, addr, oi);
+        gen_ldst1(INDEX_op_qemu_ld, TCG_TYPE_I64, tcgv_i64_temp(v), addr, oi);
+    }
+}
+
+static void gen_st_i64(TCGv_i64 v, TCGTemp *addr, MemOpIdx oi)
+{
+    if (TCG_TARGET_REG_BITS == 32) {
+        gen_ldst2(INDEX_op_qemu_st2, TCG_TYPE_I64,
+                  tcgv_i32_temp(TCGV_LOW(v)), tcgv_i32_temp(TCGV_HIGH(v)),
+                  addr, oi);
+    } else {
+        gen_ldst1(INDEX_op_qemu_st, TCG_TYPE_I64, tcgv_i64_temp(v), addr, oi);
     }
 }
 
@@ -236,8 +248,7 @@ static void tcg_gen_qemu_ld_i32_int(TCGv_i32 val, TCGTemp *addr,
     }
 
     copy_addr = plugin_maybe_preserve_addr(addr);
-    gen_ldst(INDEX_op_qemu_ld_i32, TCG_TYPE_I32,
-             tcgv_i32_temp(val), NULL, addr, oi);
+    gen_ldst1(INDEX_op_qemu_ld, TCG_TYPE_I32, tcgv_i32_temp(val), addr, oi);
     plugin_gen_mem_callbacks_i32(val, copy_addr, addr, orig_oi,
                                  QEMU_PLUGIN_MEM_R);
 
@@ -292,8 +303,7 @@ static void tcg_gen_qemu_st_i32_int(TCGv_i32 val, TCGTemp *addr,
         oi = make_memop_idx(memop, idx);
     }
 
-    gen_ldst(INDEX_op_qemu_st_i32, TCG_TYPE_I32,
-             tcgv_i32_temp(val), NULL, addr, oi);
+    gen_ldst1(INDEX_op_qemu_st, TCG_TYPE_I32, tcgv_i32_temp(val), addr, oi);
     plugin_gen_mem_callbacks_i32(val, NULL, addr, orig_oi, QEMU_PLUGIN_MEM_W);
 
     if (swap) {
@@ -340,7 +350,7 @@ static void tcg_gen_qemu_ld_i64_int(TCGv_i64 val, TCGTemp *addr,
     }
 
     copy_addr = plugin_maybe_preserve_addr(addr);
-    gen_ldst_i64(INDEX_op_qemu_ld_i64, val, addr, oi);
+    gen_ld_i64(val, addr, oi);
     plugin_gen_mem_callbacks_i64(val, copy_addr, addr, orig_oi,
                                  QEMU_PLUGIN_MEM_R);
 
@@ -407,7 +417,7 @@ static void tcg_gen_qemu_st_i64_int(TCGv_i64 val, TCGTemp *addr,
         oi = make_memop_idx(memop, idx);
     }
 
-    gen_ldst_i64(INDEX_op_qemu_st_i64, val, addr, oi);
+    gen_st_i64(val, addr, oi);
     plugin_gen_mem_callbacks_i64(val, NULL, addr, orig_oi, QEMU_PLUGIN_MEM_W);
 
     if (swap) {
@@ -546,8 +556,8 @@ static void tcg_gen_qemu_ld_i128_int(TCGv_i128 val, TCGTemp *addr,
             hi = TCGV128_HIGH(val);
         }
 
-        gen_ldst(INDEX_op_qemu_ld_i128, TCG_TYPE_I128, tcgv_i64_temp(lo),
-                 tcgv_i64_temp(hi), addr, oi);
+        gen_ldst2(INDEX_op_qemu_ld2, TCG_TYPE_I128, tcgv_i64_temp(lo),
+                  tcgv_i64_temp(hi), addr, oi);
 
         if (need_bswap) {
             tcg_gen_bswap64_i64(lo, lo);
@@ -575,8 +585,7 @@ static void tcg_gen_qemu_ld_i128_int(TCGv_i128 val, TCGTemp *addr,
             y = TCGV128_LOW(val);
         }
 
-        gen_ldst_i64(INDEX_op_qemu_ld_i64, x, addr,
-                     make_memop_idx(mop[0], idx));
+        gen_ld_i64(x, addr, make_memop_idx(mop[0], idx));
 
         if (need_bswap) {
             tcg_gen_bswap64_i64(x, x);
@@ -592,8 +601,7 @@ static void tcg_gen_qemu_ld_i128_int(TCGv_i128 val, TCGTemp *addr,
             addr_p8 = tcgv_i64_temp(t);
         }
 
-        gen_ldst_i64(INDEX_op_qemu_ld_i64, y, addr_p8,
-                     make_memop_idx(mop[1], idx));
+        gen_ld_i64(y, addr_p8, make_memop_idx(mop[1], idx));
         tcg_temp_free_internal(addr_p8);
 
         if (need_bswap) {
@@ -657,8 +665,8 @@ static void tcg_gen_qemu_st_i128_int(TCGv_i128 val, TCGTemp *addr,
             hi = TCGV128_HIGH(val);
         }
 
-        gen_ldst(INDEX_op_qemu_st_i128, TCG_TYPE_I128,
-                 tcgv_i64_temp(lo), tcgv_i64_temp(hi), addr, oi);
+        gen_ldst2(INDEX_op_qemu_st2, TCG_TYPE_I128,
+                  tcgv_i64_temp(lo), tcgv_i64_temp(hi), addr, oi);
 
         if (need_bswap) {
             tcg_temp_free_i64(lo);
@@ -685,8 +693,7 @@ static void tcg_gen_qemu_st_i128_int(TCGv_i128 val, TCGTemp *addr,
             x = b;
         }
 
-        gen_ldst_i64(INDEX_op_qemu_st_i64, x, addr,
-                     make_memop_idx(mop[0], idx));
+        gen_st_i64(x, addr, make_memop_idx(mop[0], idx));
 
         if (tcg_ctx->addr_type == TCG_TYPE_I32) {
             TCGv_i32 t = tcg_temp_ebb_new_i32();
@@ -700,12 +707,10 @@ static void tcg_gen_qemu_st_i128_int(TCGv_i128 val, TCGTemp *addr,
 
         if (b) {
             tcg_gen_bswap64_i64(b, y);
-            gen_ldst_i64(INDEX_op_qemu_st_i64, b, addr_p8,
-                         make_memop_idx(mop[1], idx));
+            gen_st_i64(b, addr_p8, make_memop_idx(mop[1], idx));
             tcg_temp_free_i64(b);
         } else {
-            gen_ldst_i64(INDEX_op_qemu_st_i64, y, addr_p8,
-                         make_memop_idx(mop[1], idx));
+            gen_st_i64(y, addr_p8, make_memop_idx(mop[1], idx));
         }
         tcg_temp_free_internal(addr_p8);
     } else {
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 5c0cab205c..6c0866d446 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -2432,14 +2432,20 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_exit_tb:
     case INDEX_op_goto_tb:
     case INDEX_op_goto_ptr:
-    case INDEX_op_qemu_ld_i32:
-    case INDEX_op_qemu_st_i32:
-    case INDEX_op_qemu_ld_i64:
-    case INDEX_op_qemu_st_i64:
         return true;
 
-    case INDEX_op_qemu_ld_i128:
-    case INDEX_op_qemu_st_i128:
+    case INDEX_op_qemu_ld:
+    case INDEX_op_qemu_st:
+        tcg_debug_assert(type <= TCG_TYPE_REG);
+        return true;
+
+    case INDEX_op_qemu_ld2:
+    case INDEX_op_qemu_st2:
+        if (TCG_TARGET_REG_BITS == 32) {
+            tcg_debug_assert(type == TCG_TYPE_I64);
+            return true;
+        }
+        tcg_debug_assert(type == TCG_TYPE_I128);
         return TCG_TARGET_HAS_qemu_ldst_i128;
 
     case INDEX_op_add:
@@ -3007,12 +3013,10 @@ void tcg_dump_ops(TCGContext *s, FILE *f, bool have_prefs)
                 }
                 i = 1;
                 break;
-            case INDEX_op_qemu_ld_i32:
-            case INDEX_op_qemu_st_i32:
-            case INDEX_op_qemu_ld_i64:
-            case INDEX_op_qemu_st_i64:
-            case INDEX_op_qemu_ld_i128:
-            case INDEX_op_qemu_st_i128:
+            case INDEX_op_qemu_ld:
+            case INDEX_op_qemu_st:
+            case INDEX_op_qemu_ld2:
+            case INDEX_op_qemu_st2:
                 {
                     const char *s_al, *s_op, *s_at;
                     MemOpIdx oi = op->args[k++];
diff --git a/tcg/tci.c b/tcg/tci.c
index b08288e7d3..700e672616 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -789,46 +789,33 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             tb_ptr = ptr;
             break;
 
-        case INDEX_op_qemu_ld_i32:
+        case INDEX_op_qemu_ld:
             tci_args_rrm(insn, &r0, &r1, &oi);
             taddr = regs[r1];
             regs[r0] = tci_qemu_ld(env, taddr, oi, tb_ptr);
             break;
 
-        case INDEX_op_qemu_ld_i64:
-            if (TCG_TARGET_REG_BITS == 64) {
-                tci_args_rrm(insn, &r0, &r1, &oi);
-                taddr = regs[r1];
-            } else {
-                tci_args_rrrr(insn, &r0, &r1, &r2, &r3);
-                taddr = regs[r2];
-                oi = regs[r3];
-            }
-            tmp64 = tci_qemu_ld(env, taddr, oi, tb_ptr);
-            if (TCG_TARGET_REG_BITS == 32) {
-                tci_write_reg64(regs, r1, r0, tmp64);
-            } else {
-                regs[r0] = tmp64;
-            }
-            break;
-
-        case INDEX_op_qemu_st_i32:
+        case INDEX_op_qemu_st:
             tci_args_rrm(insn, &r0, &r1, &oi);
             taddr = regs[r1];
             tci_qemu_st(env, taddr, regs[r0], oi, tb_ptr);
             break;
 
-        case INDEX_op_qemu_st_i64:
-            if (TCG_TARGET_REG_BITS == 64) {
-                tci_args_rrm(insn, &r0, &r1, &oi);
-                tmp64 = regs[r0];
-                taddr = regs[r1];
-            } else {
-                tci_args_rrrr(insn, &r0, &r1, &r2, &r3);
-                tmp64 = tci_uint64(regs[r1], regs[r0]);
-                taddr = regs[r2];
-                oi = regs[r3];
-            }
+        case INDEX_op_qemu_ld2:
+            tcg_debug_assert(TCG_TARGET_REG_BITS == 32);
+            tci_args_rrrr(insn, &r0, &r1, &r2, &r3);
+            taddr = regs[r2];
+            oi = regs[r3];
+            tmp64 = tci_qemu_ld(env, taddr, oi, tb_ptr);
+            tci_write_reg64(regs, r1, r0, tmp64);
+            break;
+
+        case INDEX_op_qemu_st2:
+            tcg_debug_assert(TCG_TARGET_REG_BITS == 32);
+            tci_args_rrrr(insn, &r0, &r1, &r2, &r3);
+            tmp64 = tci_uint64(regs[r1], regs[r0]);
+            taddr = regs[r2];
+            oi = regs[r3];
             tci_qemu_st(env, taddr, tmp64, oi, tb_ptr);
             break;
 
@@ -1056,23 +1043,21 @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
                            str_r(r2), str_r(r3));
         break;
 
-    case INDEX_op_qemu_ld_i64:
-    case INDEX_op_qemu_st_i64:
-        if (TCG_TARGET_REG_BITS == 32) {
-            tci_args_rrrr(insn, &r0, &r1, &r2, &r3);
-            info->fprintf_func(info->stream, "%-12s  %s, %s, %s, %s",
-                               op_name, str_r(r0), str_r(r1),
-                               str_r(r2), str_r(r3));
-            break;
-        }
-        /* fall through */
-    case INDEX_op_qemu_ld_i32:
-    case INDEX_op_qemu_st_i32:
+    case INDEX_op_qemu_ld:
+    case INDEX_op_qemu_st:
         tci_args_rrm(insn, &r0, &r1, &oi);
         info->fprintf_func(info->stream, "%-12s  %s, %s, %x",
                            op_name, str_r(r0), str_r(r1), oi);
         break;
 
+    case INDEX_op_qemu_ld2:
+    case INDEX_op_qemu_st2:
+        tci_args_rrrr(insn, &r0, &r1, &r2, &r3);
+        info->fprintf_func(info->stream, "%-12s  %s, %s, %s, %s",
+                           op_name, str_r(r0), str_r(r1),
+                           str_r(r2), str_r(r3));
+        break;
+
     case 0:
         /* tcg_out_nop_fill uses zeros */
         if (insn == 0) {
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index 1fb7575061..6b8f71f49e 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -40,14 +40,14 @@ static TCGConstraintSetIndex
 tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 {
     switch (op) {
-    case INDEX_op_qemu_ld_i32:
+    case INDEX_op_qemu_ld:
         return C_O1_I1(r, r);
-    case INDEX_op_qemu_ld_i64:
-        return TCG_TARGET_REG_BITS == 64 ? C_O1_I1(r, r) : C_O2_I1(r, r, r);
-    case INDEX_op_qemu_st_i32:
+    case INDEX_op_qemu_st:
         return C_O0_I2(r, r);
-    case INDEX_op_qemu_st_i64:
-        return TCG_TARGET_REG_BITS == 64 ? C_O0_I2(r, r) : C_O0_I3(r, r, r);
+    case INDEX_op_qemu_ld2:
+        return TCG_TARGET_REG_BITS == 64 ? C_NotImplemented : C_O2_I1(r, r, r);
+    case INDEX_op_qemu_st2:
+        return TCG_TARGET_REG_BITS == 64 ? C_NotImplemented : C_O0_I3(r, r, r);
 
     default:
         return C_NotImplemented;
@@ -1203,22 +1203,14 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const int const_args[TCG_MAX_OP_ARGS])
 {
     switch (opc) {
-    case INDEX_op_qemu_ld_i64:
-    case INDEX_op_qemu_st_i64:
-        if (TCG_TARGET_REG_BITS == 32) {
-            tcg_out_movi(s, TCG_TYPE_I32, TCG_REG_TMP, args[3]);
-            tcg_out_op_rrrr(s, opc, args[0], args[1], args[2], TCG_REG_TMP);
-            break;
-        }
-        /* fall through */
-    case INDEX_op_qemu_ld_i32:
-    case INDEX_op_qemu_st_i32:
-        if (TCG_TARGET_REG_BITS == 64 && s->addr_type == TCG_TYPE_I32) {
-            tcg_out_ext32u(s, TCG_REG_TMP, args[1]);
-            tcg_out_op_rrm(s, opc, args[0], TCG_REG_TMP, args[2]);
-        } else {
-            tcg_out_op_rrm(s, opc, args[0], args[1], args[2]);
-        }
+    case INDEX_op_qemu_ld:
+    case INDEX_op_qemu_st:
+        tcg_out_op_rrm(s, opc, args[0], args[1], args[2]);
+        break;
+    case INDEX_op_qemu_ld2:
+    case INDEX_op_qemu_st2:
+        tcg_out_movi(s, TCG_TYPE_I32, TCG_REG_TMP, args[3]);
+        tcg_out_op_rrrr(s, opc, args[0], args[1], args[2], TCG_REG_TMP);
         break;
 
     case INDEX_op_call:     /* Always emitted via tcg_out_call.  */

From 3bedb9d3e2855606f2b4982ce07f8ae399957c3d Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 11 Feb 2025 13:41:42 -0800
Subject: [PATCH 0512/2760] tcg: Convert qemu_ld{2} to TCGOutOpLoad{2}

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target.c.inc     | 30 +++++++++------
 tcg/arm/tcg-target.c.inc         | 63 +++++++++++++++++++++++---------
 tcg/i386/tcg-target.c.inc        | 47 ++++++++++++++++--------
 tcg/loongarch64/tcg-target.c.inc | 37 ++++++++++---------
 tcg/mips/tcg-target.c.inc        | 57 +++++++++++++++++++++--------
 tcg/ppc/tcg-target.c.inc         | 45 ++++++++++++++---------
 tcg/riscv/tcg-target.c.inc       | 22 ++++++-----
 tcg/s390x/tcg-target.c.inc       | 32 +++++++++-------
 tcg/sparc64/tcg-target.c.inc     | 21 ++++++-----
 tcg/tcg.c                        | 32 +++++++++++++++-
 tcg/tci/tcg-target.c.inc         | 30 ++++++++++++---
 11 files changed, 283 insertions(+), 133 deletions(-)

diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index a48cb46799..feda64afa3 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -1806,8 +1806,8 @@ static void tcg_out_qemu_st_direct(TCGContext *s, MemOp memop,
     }
 }
 
-static void tcg_out_qemu_ld(TCGContext *s, TCGReg data_reg, TCGReg addr_reg,
-                            MemOpIdx oi, TCGType data_type)
+static void tgen_qemu_ld(TCGContext *s, TCGType data_type, TCGReg data_reg,
+                         TCGReg addr_reg, MemOpIdx oi)
 {
     TCGLabelQemuLdst *ldst;
     HostAddress h;
@@ -1822,6 +1822,11 @@ static void tcg_out_qemu_ld(TCGContext *s, TCGReg data_reg, TCGReg addr_reg,
     }
 }
 
+static const TCGOutOpQemuLdSt outop_qemu_ld = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out = tgen_qemu_ld,
+};
+
 static void tcg_out_qemu_st(TCGContext *s, TCGReg data_reg, TCGReg addr_reg,
                             MemOpIdx oi, TCGType data_type)
 {
@@ -1940,6 +1945,17 @@ static void tcg_out_qemu_ldst_i128(TCGContext *s, TCGReg datalo, TCGReg datahi,
     }
 }
 
+static void tgen_qemu_ld2(TCGContext *s, TCGType type, TCGReg datalo,
+                          TCGReg datahi, TCGReg addr_reg, MemOpIdx oi)
+{
+    tcg_out_qemu_ldst_i128(s, datalo, datahi, addr_reg, oi, true);
+}
+
+static const TCGOutOpQemuLdSt2 outop_qemu_ld2 = {
+    .base.static_constraint = C_O2_I1(r, r, r),
+    .out = tgen_qemu_ld2,
+};
+
 static const tcg_insn_unit *tb_ret_addr;
 
 static void tcg_out_exit_tb(TCGContext *s, uintptr_t a0)
@@ -2875,15 +2891,9 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType ext,
     TCGArg a2 = args[2];
 
     switch (opc) {
-    case INDEX_op_qemu_ld:
-        tcg_out_qemu_ld(s, a0, a1, a2, ext);
-        break;
     case INDEX_op_qemu_st:
         tcg_out_qemu_st(s, a0, a1, a2, ext);
         break;
-    case INDEX_op_qemu_ld2:
-        tcg_out_qemu_ldst_i128(s, a0, a1, a2, args[3], true);
-        break;
     case INDEX_op_qemu_st2:
         tcg_out_qemu_ldst_i128(s, a0, a1, a2, args[3], false);
         break;
@@ -3340,10 +3350,6 @@ static TCGConstraintSetIndex
 tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 {
     switch (op) {
-    case INDEX_op_qemu_ld:
-        return C_O1_I1(r, r);
-    case INDEX_op_qemu_ld2:
-        return C_O2_I1(r, r, r);
     case INDEX_op_qemu_st:
         return C_O0_I2(rz, r);
     case INDEX_op_qemu_st2:
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index 29fd82e9e0..681ecc3d7a 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -1586,8 +1586,8 @@ static void tcg_out_qemu_ld_direct(TCGContext *s, MemOp opc, TCGReg datalo,
     }
 }
 
-static void tcg_out_qemu_ld(TCGContext *s, TCGReg datalo, TCGReg datahi,
-                            TCGReg addr, MemOpIdx oi, TCGType data_type)
+static void tgen_qemu_ld(TCGContext *s, TCGType type, TCGReg data,
+                         TCGReg addr, MemOpIdx oi)
 {
     MemOp opc = get_memop(oi);
     TCGLabelQemuLdst *ldst;
@@ -1595,7 +1595,41 @@ static void tcg_out_qemu_ld(TCGContext *s, TCGReg datalo, TCGReg datahi,
 
     ldst = prepare_host_addr(s, &h, addr, oi, true);
     if (ldst) {
-        ldst->type = data_type;
+        ldst->type = type;
+        ldst->datalo_reg = data;
+        ldst->datahi_reg = -1;
+
+        /*
+         * This a conditional BL only to load a pointer within this
+         * opcode into LR for the slow path.  We will not be using
+         * the value for a tail call.
+         */
+        ldst->label_ptr[0] = s->code_ptr;
+        tcg_out_bl_imm(s, COND_NE, 0);
+    }
+
+    tcg_out_qemu_ld_direct(s, opc, data, -1, h);
+
+    if (ldst) {
+        ldst->raddr = tcg_splitwx_to_rx(s->code_ptr);
+    }
+}
+
+static const TCGOutOpQemuLdSt outop_qemu_ld = {
+    .base.static_constraint = C_O1_I1(r, q),
+    .out = tgen_qemu_ld,
+};
+
+static void tgen_qemu_ld2(TCGContext *s, TCGType type, TCGReg datalo,
+                          TCGReg datahi, TCGReg addr, MemOpIdx oi)
+{
+    MemOp opc = get_memop(oi);
+    TCGLabelQemuLdst *ldst;
+    HostAddress h;
+
+    ldst = prepare_host_addr(s, &h, addr, oi, true);
+    if (ldst) {
+        ldst->type = type;
         ldst->datalo_reg = datalo;
         ldst->datahi_reg = datahi;
 
@@ -1606,14 +1640,20 @@ static void tcg_out_qemu_ld(TCGContext *s, TCGReg datalo, TCGReg datahi,
          */
         ldst->label_ptr[0] = s->code_ptr;
         tcg_out_bl_imm(s, COND_NE, 0);
+    }
 
-        tcg_out_qemu_ld_direct(s, opc, datalo, datahi, h);
+    tcg_out_qemu_ld_direct(s, opc, datalo, datahi, h);
+
+    if (ldst) {
         ldst->raddr = tcg_splitwx_to_rx(s->code_ptr);
-    } else {
-        tcg_out_qemu_ld_direct(s, opc, datalo, datahi, h);
     }
 }
 
+static const TCGOutOpQemuLdSt2 outop_qemu_ld2 = {
+    .base.static_constraint = C_O2_I1(e, p, q),
+    .out = tgen_qemu_ld2,
+};
+
 static void tcg_out_qemu_st_direct(TCGContext *s, MemOp opc, TCGReg datalo,
                                    TCGReg datahi, HostAddress h)
 {
@@ -2570,13 +2610,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const int const_args[TCG_MAX_OP_ARGS])
 {
     switch (opc) {
-    case INDEX_op_qemu_ld:
-        tcg_out_qemu_ld(s, args[0], -1, args[1], args[2], TCG_TYPE_I32);
-        break;
-    case INDEX_op_qemu_ld2:
-        tcg_out_qemu_ld(s, args[0], args[1], args[2], args[3], TCG_TYPE_I64);
-        break;
-
     case INDEX_op_qemu_st:
         tcg_out_qemu_st(s, args[0], -1, args[1], args[2], TCG_TYPE_I32);
         break;
@@ -2596,10 +2629,6 @@ static TCGConstraintSetIndex
 tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 {
     switch (op) {
-    case INDEX_op_qemu_ld:
-        return C_O1_I1(r, q);
-    case INDEX_op_qemu_ld2:
-        return C_O2_I1(e, p, q);
     case INDEX_op_qemu_st:
         return C_O0_I2(q, q);
     case INDEX_op_qemu_st2:
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index cb66f6c27f..7ec06f57ee 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -2422,23 +2422,50 @@ static void tcg_out_qemu_ld_direct(TCGContext *s, TCGReg datalo, TCGReg datahi,
     }
 }
 
-static void tcg_out_qemu_ld(TCGContext *s, TCGReg datalo, TCGReg datahi,
-                            TCGReg addr, MemOpIdx oi, TCGType data_type)
+static void tgen_qemu_ld(TCGContext *s, TCGType type, TCGReg data,
+                         TCGReg addr, MemOpIdx oi)
 {
     TCGLabelQemuLdst *ldst;
     HostAddress h;
 
     ldst = prepare_host_addr(s, &h, addr, oi, true);
-    tcg_out_qemu_ld_direct(s, datalo, datahi, h, data_type, get_memop(oi));
+    tcg_out_qemu_ld_direct(s, data, -1, h, type, get_memop(oi));
 
     if (ldst) {
-        ldst->type = data_type;
+        ldst->type = type;
+        ldst->datalo_reg = data;
+        ldst->datahi_reg = -1;
+        ldst->raddr = tcg_splitwx_to_rx(s->code_ptr);
+    }
+}
+
+static const TCGOutOpQemuLdSt outop_qemu_ld = {
+    .base.static_constraint = C_O1_I1(r, L),
+    .out = tgen_qemu_ld,
+};
+
+static void tgen_qemu_ld2(TCGContext *s, TCGType type, TCGReg datalo,
+                          TCGReg datahi, TCGReg addr, MemOpIdx oi)
+{
+    TCGLabelQemuLdst *ldst;
+    HostAddress h;
+
+    ldst = prepare_host_addr(s, &h, addr, oi, true);
+    tcg_out_qemu_ld_direct(s, datalo, datahi, h, type, get_memop(oi));
+
+    if (ldst) {
+        ldst->type = type;
         ldst->datalo_reg = datalo;
         ldst->datahi_reg = datahi;
         ldst->raddr = tcg_splitwx_to_rx(s->code_ptr);
     }
 }
 
+static const TCGOutOpQemuLdSt2 outop_qemu_ld2 = {
+    .base.static_constraint = C_O2_I1(r, r, L),
+    .out = tgen_qemu_ld2,
+};
+
 static void tcg_out_qemu_st_direct(TCGContext *s, TCGReg datalo, TCGReg datahi,
                                    HostAddress h, MemOp memop)
 {
@@ -3552,13 +3579,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     a2 = args[2];
 
     switch (opc) {
-    case INDEX_op_qemu_ld:
-        tcg_out_qemu_ld(s, a0, -1, a1, a2, type);
-        break;
-    case INDEX_op_qemu_ld2:
-        tcg_out_qemu_ld(s, a0, a1, a2, args[3], type);
-        break;
-
     case INDEX_op_qemu_st:
         tcg_out_qemu_st(s, a0, -1, a1, a2, type);
         break;
@@ -4119,16 +4139,11 @@ static TCGConstraintSetIndex
 tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 {
     switch (op) {
-    case INDEX_op_qemu_ld:
-        return C_O1_I1(r, L);
-
     case INDEX_op_qemu_st:
         return (TCG_TARGET_REG_BITS == 32 && flags == MO_8
                 ? C_O0_I2(s, L)
                 : C_O0_I2(L, L));
 
-    case INDEX_op_qemu_ld2:
-        return C_O2_I1(r, r, L);
     case INDEX_op_qemu_st2:
         return C_O0_I3(L, L, L);
 
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index e4a8b43578..e2f0b7f894 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -1167,22 +1167,27 @@ static void tcg_out_qemu_ld_indexed(TCGContext *s, MemOp opc, TCGType type,
     }
 }
 
-static void tcg_out_qemu_ld(TCGContext *s, TCGReg data_reg, TCGReg addr_reg,
-                            MemOpIdx oi, TCGType data_type)
+static void tgen_qemu_ld(TCGContext *s, TCGType type, TCGReg data_reg,
+                         TCGReg addr_reg, MemOpIdx oi)
 {
     TCGLabelQemuLdst *ldst;
     HostAddress h;
 
     ldst = prepare_host_addr(s, &h, addr_reg, oi, true);
-    tcg_out_qemu_ld_indexed(s, get_memop(oi), data_type, data_reg, h);
+    tcg_out_qemu_ld_indexed(s, get_memop(oi), type, data_reg, h);
 
     if (ldst) {
-        ldst->type = data_type;
+        ldst->type = type;
         ldst->datalo_reg = data_reg;
         ldst->raddr = tcg_splitwx_to_rx(s->code_ptr);
     }
 }
 
+static const TCGOutOpQemuLdSt outop_qemu_ld = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out = tgen_qemu_ld,
+};
+
 static void tcg_out_qemu_st_indexed(TCGContext *s, MemOp opc,
                                     TCGReg rd, HostAddress h)
 {
@@ -1270,6 +1275,17 @@ static void tcg_out_qemu_ldst_i128(TCGContext *s, TCGReg data_lo, TCGReg data_hi
     }
 }
 
+static void tgen_qemu_ld2(TCGContext *s, TCGType type, TCGReg datalo,
+                          TCGReg datahi, TCGReg addr_reg, MemOpIdx oi)
+{
+    tcg_out_qemu_ldst_i128(s, datalo, datahi, addr_reg, oi, true);
+}
+
+static const TCGOutOpQemuLdSt2 outop_qemu_ld2 = {
+    .base.static_constraint = C_N2_I1(r, r, r),
+    .out = tgen_qemu_ld2,
+};
+
 /*
  * Entry-points
  */
@@ -2020,12 +2036,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     TCGArg a3 = args[3];
 
     switch (opc) {
-    case INDEX_op_qemu_ld:
-        tcg_out_qemu_ld(s, a0, a1, a2, type);
-        break;
-    case INDEX_op_qemu_ld2:
-        tcg_out_qemu_ldst_i128(s, a0, a1, a2, a3, true);
-        break;
     case INDEX_op_qemu_st:
         tcg_out_qemu_st(s, a0, a1, a2, type);
         break;
@@ -2537,16 +2547,9 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     switch (op) {
     case INDEX_op_qemu_st:
         return C_O0_I2(rz, r);
-
-    case INDEX_op_qemu_ld2:
-        return C_N2_I1(r, r, r);
-
     case INDEX_op_qemu_st2:
         return C_O0_I3(r, r, r);
 
-    case INDEX_op_qemu_ld:
-        return C_O1_I1(r, r);
-
     case INDEX_op_ld_vec:
     case INDEX_op_dupm_vec:
     case INDEX_op_dup_vec:
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index eaaf0f2024..14bffcd404 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -1387,8 +1387,8 @@ static void tcg_out_qemu_ld_unalign(TCGContext *s, TCGReg lo, TCGReg hi,
     }
 }
 
-static void tcg_out_qemu_ld(TCGContext *s, TCGReg datalo, TCGReg datahi,
-                            TCGReg addr, MemOpIdx oi, TCGType data_type)
+static void tgen_qemu_ld(TCGContext *s, TCGType type, TCGReg data,
+                         TCGReg addr, MemOpIdx oi)
 {
     MemOp opc = get_memop(oi);
     TCGLabelQemuLdst *ldst;
@@ -1397,19 +1397,56 @@ static void tcg_out_qemu_ld(TCGContext *s, TCGReg datalo, TCGReg datahi,
     ldst = prepare_host_addr(s, &h, addr, oi, true);
 
     if (use_mips32r6_instructions || h.aa.align >= (opc & MO_SIZE)) {
-        tcg_out_qemu_ld_direct(s, datalo, datahi, h.base, opc, data_type);
+        tcg_out_qemu_ld_direct(s, data, 0, h.base, opc, type);
     } else {
-        tcg_out_qemu_ld_unalign(s, datalo, datahi, h.base, opc, data_type);
+        tcg_out_qemu_ld_unalign(s, data, 0, h.base, opc, type);
     }
 
     if (ldst) {
-        ldst->type = data_type;
+        ldst->type = type;
+        ldst->datalo_reg = data;
+        ldst->datahi_reg = 0;
+        ldst->raddr = tcg_splitwx_to_rx(s->code_ptr);
+    }
+}
+
+static const TCGOutOpQemuLdSt outop_qemu_ld = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out = tgen_qemu_ld,
+};
+
+static void tgen_qemu_ld2(TCGContext *s, TCGType type, TCGReg datalo,
+                          TCGReg datahi, TCGReg addr, MemOpIdx oi)
+{
+    MemOp opc = get_memop(oi);
+    TCGLabelQemuLdst *ldst;
+    HostAddress h;
+
+    tcg_debug_assert(TCG_TARGET_REG_BITS == 32);
+    ldst = prepare_host_addr(s, &h, addr, oi, true);
+
+    if (use_mips32r6_instructions || h.aa.align >= (opc & MO_SIZE)) {
+        tcg_out_qemu_ld_direct(s, datalo, datahi, h.base, opc, type);
+    } else {
+        tcg_out_qemu_ld_unalign(s, datalo, datahi, h.base, opc, type);
+    }
+
+    if (ldst) {
+        ldst->type = type;
         ldst->datalo_reg = datalo;
         ldst->datahi_reg = datahi;
         ldst->raddr = tcg_splitwx_to_rx(s->code_ptr);
     }
 }
 
+static const TCGOutOpQemuLdSt2 outop_qemu_ld2 = {
+    /* Ensure that the mips32 code is compiled but discarded for mips64. */
+    .base.static_constraint =
+        TCG_TARGET_REG_BITS == 32 ? C_O2_I1(r, r, r) : C_NotImplemented,
+    .out =
+        TCG_TARGET_REG_BITS == 32 ? tgen_qemu_ld2 : NULL,
+};
+
 static void tcg_out_qemu_st_direct(TCGContext *s, TCGReg lo, TCGReg hi,
                                    TCGReg base, MemOp opc)
 {
@@ -2381,14 +2418,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     a2 = args[2];
 
     switch (opc) {
-    case INDEX_op_qemu_ld:
-        tcg_out_qemu_ld(s, a0, 0, a1, a2, type);
-        break;
-    case INDEX_op_qemu_ld2:
-        tcg_debug_assert(TCG_TARGET_REG_BITS == 32);
-        tcg_out_qemu_ld(s, a0, a1, a2, args[3], type);
-        break;
-
     case INDEX_op_qemu_st:
         tcg_out_qemu_st(s, a0, 0, a1, a2, type);
         break;
@@ -2409,8 +2438,6 @@ static TCGConstraintSetIndex
 tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 {
     switch (op) {
-    case INDEX_op_qemu_ld:
-        return C_O1_I1(r, r);
     case INDEX_op_qemu_st:
         return C_O0_I2(rz, r);
     case INDEX_op_qemu_ld2:
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index bb26769d53..e4e6b7b2d9 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -2695,6 +2695,33 @@ static void tcg_out_qemu_ldst_i128(TCGContext *s, TCGReg datalo, TCGReg datahi,
     }
 }
 
+static void tgen_qemu_ld(TCGContext *s, TCGType type, TCGReg data,
+                         TCGReg addr, MemOpIdx oi)
+{
+    tcg_out_qemu_ld(s, data, -1, addr, oi, type);
+}
+
+static const TCGOutOpQemuLdSt outop_qemu_ld = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out = tgen_qemu_ld,
+};
+
+static void tgen_qemu_ld2(TCGContext *s, TCGType type, TCGReg datalo,
+                          TCGReg datahi, TCGReg addr, MemOpIdx oi)
+{
+    if (TCG_TARGET_REG_BITS == 32) {
+        tcg_out_qemu_ld(s, datalo, datahi, addr, oi, type);
+    } else {
+        tcg_out_qemu_ldst_i128(s, datalo, datahi, addr, oi, true);
+    }
+}
+
+static const TCGOutOpQemuLdSt2 outop_qemu_ld2 = {
+    .base.static_constraint =
+        TCG_TARGET_REG_BITS == 64 ? C_N1O1_I1(o, m, r) : C_O2_I1(r, r, r),
+    .out = tgen_qemu_ld2,
+};
+
 static void tcg_out_nop_fill(tcg_insn_unit *p, int count)
 {
     int i;
@@ -3779,18 +3806,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const int const_args[TCG_MAX_OP_ARGS])
 {
     switch (opc) {
-    case INDEX_op_qemu_ld:
-        tcg_out_qemu_ld(s, args[0], -1, args[1], args[2], type);
-        break;
-    case INDEX_op_qemu_ld2:
-        if (TCG_TARGET_REG_BITS == 32) {
-            tcg_out_qemu_ld(s, args[0], args[1], args[2],
-                            args[3], TCG_TYPE_I64);
-            break;
-        }
-        tcg_out_qemu_ldst_i128(s, args[0], args[1], args[2], args[3], true);
-        break;
-
     case INDEX_op_qemu_st:
         tcg_out_qemu_st(s, args[0], -1, args[1], args[2], type);
         break;
@@ -4418,12 +4433,6 @@ static TCGConstraintSetIndex
 tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 {
     switch (op) {
-    case INDEX_op_qemu_ld:
-        return C_O1_I1(r, r);
-    case INDEX_op_qemu_ld2:
-        return TCG_TARGET_REG_BITS == 64
-               ? C_N1O1_I1(o, m, r) : C_O2_I1(r, r, r);
-
     case INDEX_op_qemu_st:
         return C_O0_I2(r, r);
     case INDEX_op_qemu_st2:
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index 89c7736f9a..94e6f04fa6 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -1833,22 +1833,31 @@ static void tcg_out_qemu_ld_direct(TCGContext *s, TCGReg val,
     }
 }
 
-static void tcg_out_qemu_ld(TCGContext *s, TCGReg data_reg, TCGReg addr_reg,
-                            MemOpIdx oi, TCGType data_type)
+static void tgen_qemu_ld(TCGContext *s, TCGType type, TCGReg data_reg,
+                         TCGReg addr_reg, MemOpIdx oi)
 {
     TCGLabelQemuLdst *ldst;
     TCGReg base;
 
     ldst = prepare_host_addr(s, &base, addr_reg, oi, true);
-    tcg_out_qemu_ld_direct(s, data_reg, base, get_memop(oi), data_type);
+    tcg_out_qemu_ld_direct(s, data_reg, base, get_memop(oi), type);
 
     if (ldst) {
-        ldst->type = data_type;
+        ldst->type = type;
         ldst->datalo_reg = data_reg;
         ldst->raddr = tcg_splitwx_to_rx(s->code_ptr);
     }
 }
 
+static const TCGOutOpQemuLdSt outop_qemu_ld = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out = tgen_qemu_ld,
+};
+
+static const TCGOutOpQemuLdSt2 outop_qemu_ld2 = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static void tcg_out_qemu_st_direct(TCGContext *s, TCGReg val,
                                    TCGReg base, MemOp opc)
 {
@@ -2633,9 +2642,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     TCGArg a2 = args[2];
 
     switch (opc) {
-    case INDEX_op_qemu_ld:
-        tcg_out_qemu_ld(s, a0, a1, a2, type);
-        break;
     case INDEX_op_qemu_st:
         tcg_out_qemu_st(s, a0, a1, a2, type);
         break;
@@ -2869,8 +2875,6 @@ static TCGConstraintSetIndex
 tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 {
     switch (op) {
-    case INDEX_op_qemu_ld:
-        return C_O1_I1(r, r);
     case INDEX_op_qemu_st:
         return C_O0_I2(rz, r);
 
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index 652ce9023e..bf99b765cf 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -2081,8 +2081,8 @@ static TCGLabelQemuLdst *prepare_host_addr(TCGContext *s, HostAddress *h,
     return ldst;
 }
 
-static void tcg_out_qemu_ld(TCGContext* s, TCGReg data_reg, TCGReg addr_reg,
-                            MemOpIdx oi, TCGType data_type)
+static void tgen_qemu_ld(TCGContext *s, TCGType type, TCGReg data_reg,
+                         TCGReg addr_reg, MemOpIdx oi)
 {
     TCGLabelQemuLdst *ldst;
     HostAddress h;
@@ -2091,12 +2091,17 @@ static void tcg_out_qemu_ld(TCGContext* s, TCGReg data_reg, TCGReg addr_reg,
     tcg_out_qemu_ld_direct(s, get_memop(oi), data_reg, h);
 
     if (ldst) {
-        ldst->type = data_type;
+        ldst->type = type;
         ldst->datalo_reg = data_reg;
         ldst->raddr = tcg_splitwx_to_rx(s->code_ptr);
     }
 }
 
+static const TCGOutOpQemuLdSt outop_qemu_ld = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out = tgen_qemu_ld,
+};
+
 static void tcg_out_qemu_st(TCGContext* s, TCGReg data_reg, TCGReg addr_reg,
                             MemOpIdx oi, TCGType data_type)
 {
@@ -2187,6 +2192,17 @@ static void tcg_out_qemu_ldst_i128(TCGContext *s, TCGReg datalo, TCGReg datahi,
     }
 }
 
+static void tgen_qemu_ld2(TCGContext *s, TCGType type, TCGReg datalo,
+                          TCGReg datahi, TCGReg addr_reg, MemOpIdx oi)
+{
+    tcg_out_qemu_ldst_i128(s, datalo, datahi, addr_reg, oi, true);
+}
+
+static const TCGOutOpQemuLdSt2 outop_qemu_ld2 = {
+    .base.static_constraint = C_O2_I1(o, m, r),
+    .out = tgen_qemu_ld2,
+};
+
 static void tcg_out_exit_tb(TCGContext *s, uintptr_t a0)
 {
     /* Reuse the zeroing that exists for goto_ptr.  */
@@ -3133,15 +3149,9 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const int const_args[TCG_MAX_OP_ARGS])
 {
     switch (opc) {
-    case INDEX_op_qemu_ld:
-        tcg_out_qemu_ld(s, args[0], args[1], args[2], type);
-        break;
     case INDEX_op_qemu_st:
         tcg_out_qemu_st(s, args[0], args[1], args[2], type);
         break;
-    case INDEX_op_qemu_ld2:
-        tcg_out_qemu_ldst_i128(s, args[0], args[1], args[2], args[3], true);
-        break;
     case INDEX_op_qemu_st2:
         tcg_out_qemu_ldst_i128(s, args[0], args[1], args[2], args[3], false);
         break;
@@ -3594,12 +3604,8 @@ static TCGConstraintSetIndex
 tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 {
     switch (op) {
-    case INDEX_op_qemu_ld:
-        return C_O1_I1(r, r);
     case INDEX_op_qemu_st:
         return C_O0_I2(r, r);
-    case INDEX_op_qemu_ld2:
-        return C_O2_I1(o, m, r);
     case INDEX_op_qemu_st2:
         return C_O0_I3(o, m, r);
 
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index bf27b6b54b..4426168354 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -1186,8 +1186,8 @@ static TCGLabelQemuLdst *prepare_host_addr(TCGContext *s, HostAddress *h,
     return ldst;
 }
 
-static void tcg_out_qemu_ld(TCGContext *s, TCGReg data, TCGReg addr,
-                            MemOpIdx oi, TCGType data_type)
+static void tgen_qemu_ld(TCGContext *s, TCGType type, TCGReg data,
+                         TCGReg addr, MemOpIdx oi)
 {
     static const int ld_opc[(MO_SSIZE | MO_BSWAP) + 1] = {
         [MO_UB]   = LDUB,
@@ -1219,12 +1219,21 @@ static void tcg_out_qemu_ld(TCGContext *s, TCGReg data, TCGReg addr,
                     ld_opc[get_memop(oi) & (MO_BSWAP | MO_SSIZE)]);
 
     if (ldst) {
-        ldst->type = data_type;
+        ldst->type = type;
         ldst->datalo_reg = data;
         ldst->raddr = tcg_splitwx_to_rx(s->code_ptr);
     }
 }
 
+static const TCGOutOpQemuLdSt outop_qemu_ld = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out = tgen_qemu_ld,
+};
+
+static const TCGOutOpQemuLdSt2 outop_qemu_ld2 = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static void tcg_out_qemu_st(TCGContext *s, TCGReg data, TCGReg addr,
                             MemOpIdx oi, TCGType data_type)
 {
@@ -2068,9 +2077,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
     a2 = args[2];
 
     switch (opc) {
-    case INDEX_op_qemu_ld:
-        tcg_out_qemu_ld(s, a0, a1, a2, type);
-        break;
     case INDEX_op_qemu_st:
         tcg_out_qemu_st(s, a0, a1, a2, type);
         break;
@@ -2087,9 +2093,6 @@ static TCGConstraintSetIndex
 tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 {
     switch (op) {
-    case INDEX_op_qemu_ld:
-        return C_O1_I1(r, r);
-
     case INDEX_op_qemu_st:
         return C_O0_I2(rz, r);
 
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 6c0866d446..f338deb019 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1071,6 +1071,18 @@ typedef struct TCGOutOpMul2 {
                      TCGReg a0, TCGReg a1, TCGReg a2, TCGReg a3);
 } TCGOutOpMul2;
 
+typedef struct TCGOutOpQemuLdSt {
+    TCGOutOp base;
+    void (*out)(TCGContext *s, TCGType type, TCGReg dest,
+                TCGReg addr, MemOpIdx oi);
+} TCGOutOpQemuLdSt;
+
+typedef struct TCGOutOpQemuLdSt2 {
+    TCGOutOp base;
+    void (*out)(TCGContext *s, TCGType type, TCGReg dlo, TCGReg dhi,
+                TCGReg addr, MemOpIdx oi);
+} TCGOutOpQemuLdSt2;
+
 typedef struct TCGOutOpUnary {
     TCGOutOp base;
     void (*out_rr)(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1);
@@ -1210,6 +1222,8 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_not, TCGOutOpUnary, outop_not),
     OUTOP(INDEX_op_or, TCGOutOpBinary, outop_or),
     OUTOP(INDEX_op_orc, TCGOutOpBinary, outop_orc),
+    OUTOP(INDEX_op_qemu_ld, TCGOutOpQemuLdSt, outop_qemu_ld),
+    OUTOP(INDEX_op_qemu_ld2, TCGOutOpQemuLdSt2, outop_qemu_ld2),
     OUTOP(INDEX_op_rems, TCGOutOpBinary, outop_rems),
     OUTOP(INDEX_op_remu, TCGOutOpBinary, outop_remu),
     OUTOP(INDEX_op_rotl, TCGOutOpBinary, outop_rotl),
@@ -2446,7 +2460,7 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
             return true;
         }
         tcg_debug_assert(type == TCG_TYPE_I128);
-        return TCG_TARGET_HAS_qemu_ldst_i128;
+        goto do_lookup;
 
     case INDEX_op_add:
     case INDEX_op_and:
@@ -2558,6 +2572,7 @@ bool tcg_op_supported(TCGOpcode op, TCGType type, unsigned flags)
                 return false;
             }
 
+    do_lookup:
             outop = all_outop[op];
             tcg_debug_assert(outop != NULL);
 
@@ -5799,6 +5814,21 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
         }
         break;
 
+    case INDEX_op_qemu_ld:
+        {
+            const TCGOutOpQemuLdSt *out = &outop_qemu_ld;
+            out->out(s, type, new_args[0], new_args[1], new_args[2]);
+        }
+        break;
+
+    case INDEX_op_qemu_ld2:
+        {
+            const TCGOutOpQemuLdSt2 *out = &outop_qemu_ld2;
+            out->out(s, type, new_args[0], new_args[1],
+                     new_args[2], new_args[3]);
+        }
+        break;
+
     case INDEX_op_brcond:
         {
             const TCGOutOpBrcond *out = &outop_brcond;
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index 6b8f71f49e..f69e35e6ce 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -40,12 +40,8 @@ static TCGConstraintSetIndex
 tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 {
     switch (op) {
-    case INDEX_op_qemu_ld:
-        return C_O1_I1(r, r);
     case INDEX_op_qemu_st:
         return C_O0_I2(r, r);
-    case INDEX_op_qemu_ld2:
-        return TCG_TARGET_REG_BITS == 64 ? C_NotImplemented : C_O2_I1(r, r, r);
     case INDEX_op_qemu_st2:
         return TCG_TARGET_REG_BITS == 64 ? C_NotImplemented : C_O0_I3(r, r, r);
 
@@ -1197,17 +1193,39 @@ static const TCGOutOpStore outop_st = {
     .out_r = tcg_out_st,
 };
 
+static void tgen_qemu_ld(TCGContext *s, TCGType type, TCGReg data,
+                         TCGReg addr, MemOpIdx oi)
+{
+    tcg_out_op_rrm(s, INDEX_op_qemu_ld, data, addr, oi);
+}
+
+static const TCGOutOpQemuLdSt outop_qemu_ld = {
+    .base.static_constraint = C_O1_I1(r, r),
+    .out = tgen_qemu_ld,
+};
+
+static void tgen_qemu_ld2(TCGContext *s, TCGType type, TCGReg datalo,
+                          TCGReg datahi, TCGReg addr, MemOpIdx oi)
+{
+    tcg_out_movi(s, TCG_TYPE_I32, TCG_REG_TMP, oi);
+    tcg_out_op_rrrr(s, INDEX_op_qemu_ld2, datalo, datahi, addr, TCG_REG_TMP);
+}
+
+static const TCGOutOpQemuLdSt2 outop_qemu_ld2 = {
+    .base.static_constraint =
+        TCG_TARGET_REG_BITS == 64 ? C_NotImplemented : C_O2_I1(r, r, r),
+    .out =
+        TCG_TARGET_REG_BITS == 64 ? NULL : tgen_qemu_ld2,
+};
 
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
                        const int const_args[TCG_MAX_OP_ARGS])
 {
     switch (opc) {
-    case INDEX_op_qemu_ld:
     case INDEX_op_qemu_st:
         tcg_out_op_rrm(s, opc, args[0], args[1], args[2]);
         break;
-    case INDEX_op_qemu_ld2:
     case INDEX_op_qemu_st2:
         tcg_out_movi(s, TCG_TYPE_I32, TCG_REG_TMP, args[3]);
         tcg_out_op_rrrr(s, opc, args[0], args[1], args[2], TCG_REG_TMP);

From 86fe5c2597ca165228ee9cd082886846de4c9ece Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sun, 16 Feb 2025 14:02:00 -0800
Subject: [PATCH 0513/2760] tcg: Convert qemu_st{2} to TCGOutOpLdSt{2}

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target.c.inc     | 45 ++++++++-----------
 tcg/arm/tcg-target.c.inc         | 61 ++++++++++++++++---------
 tcg/i386/tcg-target.c.inc        | 73 ++++++++++++++++--------------
 tcg/loongarch64/tcg-target.c.inc | 47 +++++++++----------
 tcg/mips/tcg-target.c.inc        | 77 +++++++++++++++++---------------
 tcg/ppc/tcg-target.c.inc         | 47 +++++++++++--------
 tcg/riscv/tcg-target.c.inc       | 34 ++++++--------
 tcg/s390x/tcg-target.c.inc       | 42 +++++++++--------
 tcg/sparc64/tcg-target.c.inc     | 42 ++++++-----------
 tcg/tcg.c                        | 12 ++++-
 tcg/tci/tcg-target.c.inc         | 51 +++++++++++----------
 11 files changed, 272 insertions(+), 259 deletions(-)

diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index feda64afa3..59e7992a5f 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -1827,8 +1827,8 @@ static const TCGOutOpQemuLdSt outop_qemu_ld = {
     .out = tgen_qemu_ld,
 };
 
-static void tcg_out_qemu_st(TCGContext *s, TCGReg data_reg, TCGReg addr_reg,
-                            MemOpIdx oi, TCGType data_type)
+static void tgen_qemu_st(TCGContext *s, TCGType data_type, TCGReg data_reg,
+                         TCGReg addr_reg, MemOpIdx oi)
 {
     TCGLabelQemuLdst *ldst;
     HostAddress h;
@@ -1843,6 +1843,11 @@ static void tcg_out_qemu_st(TCGContext *s, TCGReg data_reg, TCGReg addr_reg,
     }
 }
 
+static const TCGOutOpQemuLdSt outop_qemu_st = {
+    .base.static_constraint = C_O0_I2(rz, r),
+    .out = tgen_qemu_st,
+};
+
 static void tcg_out_qemu_ldst_i128(TCGContext *s, TCGReg datalo, TCGReg datahi,
                                    TCGReg addr_reg, MemOpIdx oi, bool is_ld)
 {
@@ -1956,6 +1961,17 @@ static const TCGOutOpQemuLdSt2 outop_qemu_ld2 = {
     .out = tgen_qemu_ld2,
 };
 
+static void tgen_qemu_st2(TCGContext *s, TCGType type, TCGReg datalo,
+                          TCGReg datahi, TCGReg addr_reg, MemOpIdx oi)
+{
+    tcg_out_qemu_ldst_i128(s, datalo, datahi, addr_reg, oi, false);
+}
+
+static const TCGOutOpQemuLdSt2 outop_qemu_st2 = {
+    .base.static_constraint = C_O0_I3(rz, rz, r),
+    .out = tgen_qemu_st2,
+};
+
 static const tcg_insn_unit *tb_ret_addr;
 
 static void tcg_out_exit_tb(TCGContext *s, uintptr_t a0)
@@ -2885,25 +2901,7 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType ext,
                        const TCGArg args[TCG_MAX_OP_ARGS],
                        const int const_args[TCG_MAX_OP_ARGS])
 {
-    /* Hoist the loads of the most common arguments.  */
-    TCGArg a0 = args[0];
-    TCGArg a1 = args[1];
-    TCGArg a2 = args[2];
-
-    switch (opc) {
-    case INDEX_op_qemu_st:
-        tcg_out_qemu_st(s, a0, a1, a2, ext);
-        break;
-    case INDEX_op_qemu_st2:
-        tcg_out_qemu_ldst_i128(s, a0, a1, a2, args[3], false);
-        break;
-
-    case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
-    case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
-    case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
-    default:
-        g_assert_not_reached();
-    }
+    g_assert_not_reached();
 }
 
 static void tcg_out_vec_op(TCGContext *s, TCGOpcode opc,
@@ -3350,11 +3348,6 @@ static TCGConstraintSetIndex
 tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 {
     switch (op) {
-    case INDEX_op_qemu_st:
-        return C_O0_I2(rz, r);
-    case INDEX_op_qemu_st2:
-        return C_O0_I3(rz, rz, r);
-
     case INDEX_op_add_vec:
     case INDEX_op_sub_vec:
     case INDEX_op_mul_vec:
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index 681ecc3d7a..014a441420 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -1711,8 +1711,8 @@ static void tcg_out_qemu_st_direct(TCGContext *s, MemOp opc, TCGReg datalo,
     }
 }
 
-static void tcg_out_qemu_st(TCGContext *s, TCGReg datalo, TCGReg datahi,
-                            TCGReg addr, MemOpIdx oi, TCGType data_type)
+static void tgen_qemu_st(TCGContext *s, TCGType type, TCGReg data,
+                         TCGReg addr, MemOpIdx oi)
 {
     MemOp opc = get_memop(oi);
     TCGLabelQemuLdst *ldst;
@@ -1720,7 +1720,37 @@ static void tcg_out_qemu_st(TCGContext *s, TCGReg datalo, TCGReg datahi,
 
     ldst = prepare_host_addr(s, &h, addr, oi, false);
     if (ldst) {
-        ldst->type = data_type;
+        ldst->type = type;
+        ldst->datalo_reg = data;
+        ldst->datahi_reg = -1;
+
+        h.cond = COND_EQ;
+        tcg_out_qemu_st_direct(s, opc, data, -1, h);
+
+        /* The conditional call is last, as we're going to return here. */
+        ldst->label_ptr[0] = s->code_ptr;
+        tcg_out_bl_imm(s, COND_NE, 0);
+        ldst->raddr = tcg_splitwx_to_rx(s->code_ptr);
+    } else {
+        tcg_out_qemu_st_direct(s, opc, data, -1, h);
+    }
+}
+
+static const TCGOutOpQemuLdSt outop_qemu_st = {
+    .base.static_constraint = C_O0_I2(q, q),
+    .out = tgen_qemu_st,
+};
+
+static void tgen_qemu_st2(TCGContext *s, TCGType type, TCGReg datalo,
+                          TCGReg datahi, TCGReg addr, MemOpIdx oi)
+{
+    MemOp opc = get_memop(oi);
+    TCGLabelQemuLdst *ldst;
+    HostAddress h;
+
+    ldst = prepare_host_addr(s, &h, addr, oi, false);
+    if (ldst) {
+        ldst->type = type;
         ldst->datalo_reg = datalo;
         ldst->datahi_reg = datahi;
 
@@ -1736,6 +1766,11 @@ static void tcg_out_qemu_st(TCGContext *s, TCGReg datalo, TCGReg datahi,
     }
 }
 
+static const TCGOutOpQemuLdSt2 outop_qemu_st2 = {
+    .base.static_constraint = C_O0_I3(Q, p, q),
+    .out = tgen_qemu_st2,
+};
+
 static void tcg_out_epilogue(TCGContext *s);
 
 static void tcg_out_exit_tb(TCGContext *s, uintptr_t arg)
@@ -2609,31 +2644,13 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
                        const int const_args[TCG_MAX_OP_ARGS])
 {
-    switch (opc) {
-    case INDEX_op_qemu_st:
-        tcg_out_qemu_st(s, args[0], -1, args[1], args[2], TCG_TYPE_I32);
-        break;
-    case INDEX_op_qemu_st2:
-        tcg_out_qemu_st(s, args[0], args[1], args[2], args[3], TCG_TYPE_I64);
-        break;
-
-    case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
-    case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
-    case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
-    default:
-        g_assert_not_reached();
-    }
+    g_assert_not_reached();
 }
 
 static TCGConstraintSetIndex
 tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 {
     switch (op) {
-    case INDEX_op_qemu_st:
-        return C_O0_I2(q, q);
-    case INDEX_op_qemu_st2:
-        return C_O0_I3(Q, p, q);
-
     case INDEX_op_st_vec:
         return C_O0_I2(w, r);
     case INDEX_op_ld_vec:
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index 7ec06f57ee..9f294f28ed 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -2484,7 +2484,7 @@ static void tcg_out_qemu_st_direct(TCGContext *s, TCGReg datalo, TCGReg datahi,
 
     switch (memop & MO_SIZE) {
     case MO_8:
-        /* This is handled with constraints on INDEX_op_qemu_st. */
+        /* This is handled with constraints in cset_qemu_st(). */
         tcg_debug_assert(TCG_TARGET_REG_BITS == 64 || datalo < 4);
         tcg_out_modrm_sib_offset(s, OPC_MOVB_EvGv + P_REXB_R + h.seg,
                                  datalo, h.base, h.index, 0, h.ofs);
@@ -2576,8 +2576,38 @@ static void tcg_out_qemu_st_direct(TCGContext *s, TCGReg datalo, TCGReg datahi,
     }
 }
 
-static void tcg_out_qemu_st(TCGContext *s, TCGReg datalo, TCGReg datahi,
-                            TCGReg addr, MemOpIdx oi, TCGType data_type)
+static void tgen_qemu_st(TCGContext *s, TCGType type, TCGReg data,
+                         TCGReg addr, MemOpIdx oi)
+{
+    TCGLabelQemuLdst *ldst;
+    HostAddress h;
+
+    ldst = prepare_host_addr(s, &h, addr, oi, false);
+    tcg_out_qemu_st_direct(s, data, -1, h, get_memop(oi));
+
+    if (ldst) {
+        ldst->type = type;
+        ldst->datalo_reg = data;
+        ldst->datahi_reg = -1;
+        ldst->raddr = tcg_splitwx_to_rx(s->code_ptr);
+    }
+}
+
+static TCGConstraintSetIndex cset_qemu_st(TCGType type, unsigned flags)
+{
+    return flags == MO_8 ? C_O0_I2(s, L) : C_O0_I2(L, L);
+}
+
+static const TCGOutOpQemuLdSt outop_qemu_st = {
+    .base.static_constraint =
+        TCG_TARGET_REG_BITS == 32 ? C_Dynamic : C_O0_I2(L, L),
+    .base.dynamic_constraint =
+        TCG_TARGET_REG_BITS == 32 ? cset_qemu_st : NULL,
+    .out = tgen_qemu_st,
+};
+
+static void tgen_qemu_st2(TCGContext *s, TCGType type, TCGReg datalo,
+                          TCGReg datahi, TCGReg addr, MemOpIdx oi)
 {
     TCGLabelQemuLdst *ldst;
     HostAddress h;
@@ -2586,13 +2616,18 @@ static void tcg_out_qemu_st(TCGContext *s, TCGReg datalo, TCGReg datahi,
     tcg_out_qemu_st_direct(s, datalo, datahi, h, get_memop(oi));
 
     if (ldst) {
-        ldst->type = data_type;
+        ldst->type = type;
         ldst->datalo_reg = datalo;
         ldst->datahi_reg = datahi;
         ldst->raddr = tcg_splitwx_to_rx(s->code_ptr);
     }
 }
 
+static const TCGOutOpQemuLdSt2 outop_qemu_st2 = {
+    .base.static_constraint = C_O0_I3(L, L, L),
+    .out = tgen_qemu_st2,
+};
+
 static void tcg_out_exit_tb(TCGContext *s, uintptr_t a0)
 {
     /* Reuse the zeroing that exists for goto_ptr.  */
@@ -3571,27 +3606,7 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
                        const int const_args[TCG_MAX_OP_ARGS])
 {
-    TCGArg a0, a1, a2;
-
-    /* Hoist the loads of the most common arguments.  */
-    a0 = args[0];
-    a1 = args[1];
-    a2 = args[2];
-
-    switch (opc) {
-    case INDEX_op_qemu_st:
-        tcg_out_qemu_st(s, a0, -1, a1, a2, type);
-        break;
-    case INDEX_op_qemu_st2:
-        tcg_out_qemu_st(s, a0, a1, a2, args[3], type);
-        break;
-
-    case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
-    case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
-    case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
-    default:
-        g_assert_not_reached();
-    }
+    g_assert_not_reached();
 }
 
 static int const umin_insn[4] = {
@@ -4139,14 +4154,6 @@ static TCGConstraintSetIndex
 tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 {
     switch (op) {
-    case INDEX_op_qemu_st:
-        return (TCG_TARGET_REG_BITS == 32 && flags == MO_8
-                ? C_O0_I2(s, L)
-                : C_O0_I2(L, L));
-
-    case INDEX_op_qemu_st2:
-        return C_O0_I3(L, L, L);
-
     case INDEX_op_ld_vec:
     case INDEX_op_dupm_vec:
         return C_O1_I1(x, r);
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index e2f0b7f894..c74ddee644 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -1212,8 +1212,8 @@ static void tcg_out_qemu_st_indexed(TCGContext *s, MemOp opc,
     }
 }
 
-static void tcg_out_qemu_st(TCGContext *s, TCGReg data_reg, TCGReg addr_reg,
-                            MemOpIdx oi, TCGType data_type)
+static void tgen_qemu_st(TCGContext *s, TCGType type, TCGReg data_reg,
+                         TCGReg addr_reg, MemOpIdx oi)
 {
     TCGLabelQemuLdst *ldst;
     HostAddress h;
@@ -1222,12 +1222,17 @@ static void tcg_out_qemu_st(TCGContext *s, TCGReg data_reg, TCGReg addr_reg,
     tcg_out_qemu_st_indexed(s, get_memop(oi), data_reg, h);
 
     if (ldst) {
-        ldst->type = data_type;
+        ldst->type = type;
         ldst->datalo_reg = data_reg;
         ldst->raddr = tcg_splitwx_to_rx(s->code_ptr);
     }
 }
 
+static const TCGOutOpQemuLdSt outop_qemu_st = {
+    .base.static_constraint = C_O0_I2(rz, r),
+    .out = tgen_qemu_st,
+};
+
 static void tcg_out_qemu_ldst_i128(TCGContext *s, TCGReg data_lo, TCGReg data_hi,
                                    TCGReg addr_reg, MemOpIdx oi, bool is_ld)
 {
@@ -1286,6 +1291,17 @@ static const TCGOutOpQemuLdSt2 outop_qemu_ld2 = {
     .out = tgen_qemu_ld2,
 };
 
+static void tgen_qemu_st2(TCGContext *s, TCGType type, TCGReg datalo,
+                          TCGReg datahi, TCGReg addr_reg, MemOpIdx oi)
+{
+    tcg_out_qemu_ldst_i128(s, datalo, datahi, addr_reg, oi, false);
+}
+
+static const TCGOutOpQemuLdSt2 outop_qemu_st2 = {
+    .base.static_constraint = C_O0_I3(r, r, r),
+    .out = tgen_qemu_st2,
+};
+
 /*
  * Entry-points
  */
@@ -2030,25 +2046,7 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
                        const int const_args[TCG_MAX_OP_ARGS])
 {
-    TCGArg a0 = args[0];
-    TCGArg a1 = args[1];
-    TCGArg a2 = args[2];
-    TCGArg a3 = args[3];
-
-    switch (opc) {
-    case INDEX_op_qemu_st:
-        tcg_out_qemu_st(s, a0, a1, a2, type);
-        break;
-    case INDEX_op_qemu_st2:
-        tcg_out_qemu_ldst_i128(s, a0, a1, a2, a3, false);
-        break;
-
-    case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
-    case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
-    case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
-    default:
-        g_assert_not_reached();
-    }
+    g_assert_not_reached();
 }
 
 static bool tcg_out_dup_vec(TCGContext *s, TCGType type, unsigned vece,
@@ -2545,11 +2543,6 @@ static TCGConstraintSetIndex
 tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 {
     switch (op) {
-    case INDEX_op_qemu_st:
-        return C_O0_I2(rz, r);
-    case INDEX_op_qemu_st2:
-        return C_O0_I3(r, r, r);
-
     case INDEX_op_ld_vec:
     case INDEX_op_dupm_vec:
     case INDEX_op_dup_vec:
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index 14bffcd404..1f12500344 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -1510,8 +1510,8 @@ static void tcg_out_qemu_st_unalign(TCGContext *s, TCGReg lo, TCGReg hi,
     }
 }
 
-static void tcg_out_qemu_st(TCGContext *s, TCGReg datalo, TCGReg datahi,
-                            TCGReg addr, MemOpIdx oi, TCGType data_type)
+static void tgen_qemu_st(TCGContext *s, TCGType type, TCGReg data,
+                         TCGReg addr, MemOpIdx oi)
 {
     MemOp opc = get_memop(oi);
     TCGLabelQemuLdst *ldst;
@@ -1519,6 +1519,35 @@ static void tcg_out_qemu_st(TCGContext *s, TCGReg datalo, TCGReg datahi,
 
     ldst = prepare_host_addr(s, &h, addr, oi, false);
 
+    if (use_mips32r6_instructions || h.aa.align >= (opc & MO_SIZE)) {
+        tcg_out_qemu_st_direct(s, data, 0, h.base, opc);
+    } else {
+        tcg_out_qemu_st_unalign(s, data, 0, h.base, opc);
+    }
+
+    if (ldst) {
+        ldst->type = type;
+        ldst->datalo_reg = data;
+        ldst->datahi_reg = 0;
+        ldst->raddr = tcg_splitwx_to_rx(s->code_ptr);
+    }
+}
+
+static const TCGOutOpQemuLdSt outop_qemu_st = {
+    .base.static_constraint = C_O0_I2(rz, r),
+    .out = tgen_qemu_st,
+};
+
+static void tgen_qemu_st2(TCGContext *s, TCGType type, TCGReg datalo,
+                          TCGReg datahi, TCGReg addr, MemOpIdx oi)
+{
+    MemOp opc = get_memop(oi);
+    TCGLabelQemuLdst *ldst;
+    HostAddress h;
+
+    tcg_debug_assert(TCG_TARGET_REG_BITS == 32);
+    ldst = prepare_host_addr(s, &h, addr, oi, false);
+
     if (use_mips32r6_instructions || h.aa.align >= (opc & MO_SIZE)) {
         tcg_out_qemu_st_direct(s, datalo, datahi, h.base, opc);
     } else {
@@ -1526,13 +1555,21 @@ static void tcg_out_qemu_st(TCGContext *s, TCGReg datalo, TCGReg datahi,
     }
 
     if (ldst) {
-        ldst->type = data_type;
+        ldst->type = type;
         ldst->datalo_reg = datalo;
         ldst->datahi_reg = datahi;
         ldst->raddr = tcg_splitwx_to_rx(s->code_ptr);
     }
 }
 
+static const TCGOutOpQemuLdSt2 outop_qemu_st2 = {
+    /* Ensure that the mips32 code is compiled but discarded for mips64. */
+    .base.static_constraint =
+        TCG_TARGET_REG_BITS == 32 ? C_O0_I3(rz, rz, r) : C_NotImplemented,
+    .out =
+        TCG_TARGET_REG_BITS == 32 ? tgen_qemu_st2 : NULL,
+};
+
 static void tcg_out_mb(TCGContext *s, unsigned a0)
 {
     static const MIPSInsn sync[] = {
@@ -2411,43 +2448,13 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
                        const int const_args[TCG_MAX_OP_ARGS])
 {
-    TCGArg a0, a1, a2;
-
-    a0 = args[0];
-    a1 = args[1];
-    a2 = args[2];
-
-    switch (opc) {
-    case INDEX_op_qemu_st:
-        tcg_out_qemu_st(s, a0, 0, a1, a2, type);
-        break;
-    case INDEX_op_qemu_st2:
-        tcg_debug_assert(TCG_TARGET_REG_BITS == 32);
-        tcg_out_qemu_st(s, a0, a1, a2, args[3], type);
-        break;
-
-    case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
-    case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
-    case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
-    default:
-        g_assert_not_reached();
-    }
+    g_assert_not_reached();
 }
 
 static TCGConstraintSetIndex
 tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 {
-    switch (op) {
-    case INDEX_op_qemu_st:
-        return C_O0_I2(rz, r);
-    case INDEX_op_qemu_ld2:
-        return TCG_TARGET_REG_BITS == 64 ? C_NotImplemented : C_O2_I1(r, r, r);
-    case INDEX_op_qemu_st2:
-        return TCG_TARGET_REG_BITS == 64 ? C_NotImplemented : C_O0_I3(rz, rz, r);
-
-    default:
-        return C_NotImplemented;
-    }
+    return C_NotImplemented;
 }
 
 static const int tcg_target_callee_save_regs[] = {
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index e4e6b7b2d9..824cced94a 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -2722,6 +2722,33 @@ static const TCGOutOpQemuLdSt2 outop_qemu_ld2 = {
     .out = tgen_qemu_ld2,
 };
 
+static void tgen_qemu_st(TCGContext *s, TCGType type, TCGReg data,
+                         TCGReg addr, MemOpIdx oi)
+{
+    tcg_out_qemu_st(s, data, -1, addr, oi, type);
+}
+
+static const TCGOutOpQemuLdSt outop_qemu_st = {
+    .base.static_constraint = C_O0_I2(r, r),
+    .out = tgen_qemu_st,
+};
+
+static void tgen_qemu_st2(TCGContext *s, TCGType type, TCGReg datalo,
+                          TCGReg datahi, TCGReg addr, MemOpIdx oi)
+{
+    if (TCG_TARGET_REG_BITS == 32) {
+        tcg_out_qemu_st(s, datalo, datahi, addr, oi, type);
+    } else {
+        tcg_out_qemu_ldst_i128(s, datalo, datahi, addr, oi, false);
+    }
+}
+
+static const TCGOutOpQemuLdSt2 outop_qemu_st2 = {
+    .base.static_constraint =
+        TCG_TARGET_REG_BITS == 64 ? C_O0_I3(o, m, r) : C_O0_I3(r, r, r),
+    .out = tgen_qemu_st2,
+};
+
 static void tcg_out_nop_fill(tcg_insn_unit *p, int count)
 {
     int i;
@@ -3805,25 +3832,7 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
                        const int const_args[TCG_MAX_OP_ARGS])
 {
-    switch (opc) {
-    case INDEX_op_qemu_st:
-        tcg_out_qemu_st(s, args[0], -1, args[1], args[2], type);
-        break;
-    case INDEX_op_qemu_st2:
-        if (TCG_TARGET_REG_BITS == 32) {
-            tcg_out_qemu_st(s, args[0], args[1], args[2],
-                            args[3], TCG_TYPE_I64);
-            break;
-        }
-        tcg_out_qemu_ldst_i128(s, args[0], args[1], args[2], args[3], false);
-        break;
-
-    case INDEX_op_call:      /* Always emitted via tcg_out_call.  */
-    case INDEX_op_exit_tb:   /* Always emitted via tcg_out_exit_tb.  */
-    case INDEX_op_goto_tb:   /* Always emitted via tcg_out_goto_tb.  */
-    default:
-        g_assert_not_reached();
-    }
+    g_assert_not_reached();
 }
 
 int tcg_can_emit_vec_op(TCGOpcode opc, TCGType type, unsigned vece)
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index 94e6f04fa6..eca1283742 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -1882,8 +1882,8 @@ static void tcg_out_qemu_st_direct(TCGContext *s, TCGReg val,
     }
 }
 
-static void tcg_out_qemu_st(TCGContext *s, TCGReg data_reg, TCGReg addr_reg,
-                            MemOpIdx oi, TCGType data_type)
+static void tgen_qemu_st(TCGContext *s, TCGType type, TCGReg data_reg,
+                         TCGReg addr_reg, MemOpIdx oi)
 {
     TCGLabelQemuLdst *ldst;
     TCGReg base;
@@ -1892,12 +1892,21 @@ static void tcg_out_qemu_st(TCGContext *s, TCGReg data_reg, TCGReg addr_reg,
     tcg_out_qemu_st_direct(s, data_reg, base, get_memop(oi));
 
     if (ldst) {
-        ldst->type = data_type;
+        ldst->type = type;
         ldst->datalo_reg = data_reg;
         ldst->raddr = tcg_splitwx_to_rx(s->code_ptr);
     }
 }
 
+static const TCGOutOpQemuLdSt outop_qemu_st = {
+    .base.static_constraint = C_O0_I2(rz, r),
+    .out = tgen_qemu_st,
+};
+
+static const TCGOutOpQemuLdSt2 outop_qemu_st2 = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static const tcg_insn_unit *tb_ret_addr;
 
 static void tcg_out_exit_tb(TCGContext *s, uintptr_t a0)
@@ -2637,21 +2646,7 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
                        const int const_args[TCG_MAX_OP_ARGS])
 {
-    TCGArg a0 = args[0];
-    TCGArg a1 = args[1];
-    TCGArg a2 = args[2];
-
-    switch (opc) {
-    case INDEX_op_qemu_st:
-        tcg_out_qemu_st(s, a0, a1, a2, type);
-        break;
-
-    case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
-    case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
-    case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
-    default:
-        g_assert_not_reached();
-    }
+    g_assert_not_reached();
 }
 
 static void tcg_out_vec_op(TCGContext *s, TCGOpcode opc,
@@ -2875,9 +2870,6 @@ static TCGConstraintSetIndex
 tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 {
     switch (op) {
-    case INDEX_op_qemu_st:
-        return C_O0_I2(rz, r);
-
     case INDEX_op_st_vec:
         return C_O0_I2(v, r);
     case INDEX_op_dup_vec:
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index bf99b765cf..a316c8de41 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -2102,8 +2102,8 @@ static const TCGOutOpQemuLdSt outop_qemu_ld = {
     .out = tgen_qemu_ld,
 };
 
-static void tcg_out_qemu_st(TCGContext* s, TCGReg data_reg, TCGReg addr_reg,
-                            MemOpIdx oi, TCGType data_type)
+static void tgen_qemu_st(TCGContext *s, TCGType type, TCGReg data_reg,
+                         TCGReg addr_reg, MemOpIdx oi)
 {
     TCGLabelQemuLdst *ldst;
     HostAddress h;
@@ -2112,12 +2112,17 @@ static void tcg_out_qemu_st(TCGContext* s, TCGReg data_reg, TCGReg addr_reg,
     tcg_out_qemu_st_direct(s, get_memop(oi), data_reg, h);
 
     if (ldst) {
-        ldst->type = data_type;
+        ldst->type = type;
         ldst->datalo_reg = data_reg;
         ldst->raddr = tcg_splitwx_to_rx(s->code_ptr);
     }
 }
 
+static const TCGOutOpQemuLdSt outop_qemu_st = {
+    .base.static_constraint = C_O0_I2(r, r),
+    .out = tgen_qemu_st,
+};
+
 static void tcg_out_qemu_ldst_i128(TCGContext *s, TCGReg datalo, TCGReg datahi,
                                    TCGReg addr_reg, MemOpIdx oi, bool is_ld)
 {
@@ -2203,6 +2208,17 @@ static const TCGOutOpQemuLdSt2 outop_qemu_ld2 = {
     .out = tgen_qemu_ld2,
 };
 
+static void tgen_qemu_st2(TCGContext *s, TCGType type, TCGReg datalo,
+                          TCGReg datahi, TCGReg addr_reg, MemOpIdx oi)
+{
+    tcg_out_qemu_ldst_i128(s, datalo, datahi, addr_reg, oi, false);
+}
+
+static const TCGOutOpQemuLdSt2 outop_qemu_st2 = {
+    .base.static_constraint = C_O0_I3(o, m, r),
+    .out = tgen_qemu_st2,
+};
+
 static void tcg_out_exit_tb(TCGContext *s, uintptr_t a0)
 {
     /* Reuse the zeroing that exists for goto_ptr.  */
@@ -3148,20 +3164,7 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
                        const int const_args[TCG_MAX_OP_ARGS])
 {
-    switch (opc) {
-    case INDEX_op_qemu_st:
-        tcg_out_qemu_st(s, args[0], args[1], args[2], type);
-        break;
-    case INDEX_op_qemu_st2:
-        tcg_out_qemu_ldst_i128(s, args[0], args[1], args[2], args[3], false);
-        break;
-
-    case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
-    case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
-    case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
-    default:
-        g_assert_not_reached();
-    }
+    g_assert_not_reached();
 }
 
 static bool tcg_out_dup_vec(TCGContext *s, TCGType type, unsigned vece,
@@ -3604,11 +3607,6 @@ static TCGConstraintSetIndex
 tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 {
     switch (op) {
-    case INDEX_op_qemu_st:
-        return C_O0_I2(r, r);
-    case INDEX_op_qemu_st2:
-        return C_O0_I3(o, m, r);
-
     case INDEX_op_st_vec:
         return C_O0_I2(v, r);
     case INDEX_op_ld_vec:
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index 4426168354..d1dd0fa33c 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -1234,8 +1234,8 @@ static const TCGOutOpQemuLdSt2 outop_qemu_ld2 = {
     .base.static_constraint = C_NotImplemented,
 };
 
-static void tcg_out_qemu_st(TCGContext *s, TCGReg data, TCGReg addr,
-                            MemOpIdx oi, TCGType data_type)
+static void tgen_qemu_st(TCGContext *s, TCGType type, TCGReg data,
+                         TCGReg addr, MemOpIdx oi)
 {
     static const int st_opc[(MO_SIZE | MO_BSWAP) + 1] = {
         [MO_UB]   = STB,
@@ -1258,12 +1258,21 @@ static void tcg_out_qemu_st(TCGContext *s, TCGReg data, TCGReg addr,
                     st_opc[get_memop(oi) & (MO_BSWAP | MO_SIZE)]);
 
     if (ldst) {
-        ldst->type = data_type;
+        ldst->type = type;
         ldst->datalo_reg = data;
         ldst->raddr = tcg_splitwx_to_rx(s->code_ptr);
     }
 }
 
+static const TCGOutOpQemuLdSt outop_qemu_st = {
+    .base.static_constraint = C_O0_I2(rz, r),
+    .out = tgen_qemu_st,
+};
+
+static const TCGOutOpQemuLdSt2 outop_qemu_st2 = {
+    .base.static_constraint = C_NotImplemented,
+};
+
 static void tcg_out_exit_tb(TCGContext *s, uintptr_t a0)
 {
     if (check_fit_ptr(a0, 13)) {
@@ -2069,36 +2078,13 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
                        const int const_args[TCG_MAX_OP_ARGS])
 {
-    TCGArg a0, a1, a2;
-
-    /* Hoist the loads of the most common arguments.  */
-    a0 = args[0];
-    a1 = args[1];
-    a2 = args[2];
-
-    switch (opc) {
-    case INDEX_op_qemu_st:
-        tcg_out_qemu_st(s, a0, a1, a2, type);
-        break;
-
-    case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
-    case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
-    case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
-    default:
-        g_assert_not_reached();
-    }
+    g_assert_not_reached();
 }
 
 static TCGConstraintSetIndex
 tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 {
-    switch (op) {
-    case INDEX_op_qemu_st:
-        return C_O0_I2(rz, r);
-
-    default:
-        return C_NotImplemented;
-    }
+    return C_NotImplemented;
 }
 
 static void tcg_target_init(TCGContext *s)
diff --git a/tcg/tcg.c b/tcg/tcg.c
index f338deb019..302f7025e7 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1224,6 +1224,8 @@ static const TCGOutOp * const all_outop[NB_OPS] = {
     OUTOP(INDEX_op_orc, TCGOutOpBinary, outop_orc),
     OUTOP(INDEX_op_qemu_ld, TCGOutOpQemuLdSt, outop_qemu_ld),
     OUTOP(INDEX_op_qemu_ld2, TCGOutOpQemuLdSt2, outop_qemu_ld2),
+    OUTOP(INDEX_op_qemu_st, TCGOutOpQemuLdSt, outop_qemu_st),
+    OUTOP(INDEX_op_qemu_st2, TCGOutOpQemuLdSt2, outop_qemu_st2),
     OUTOP(INDEX_op_rems, TCGOutOpBinary, outop_rems),
     OUTOP(INDEX_op_remu, TCGOutOpBinary, outop_remu),
     OUTOP(INDEX_op_rotl, TCGOutOpBinary, outop_rotl),
@@ -5815,15 +5817,21 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
         break;
 
     case INDEX_op_qemu_ld:
+    case INDEX_op_qemu_st:
         {
-            const TCGOutOpQemuLdSt *out = &outop_qemu_ld;
+            const TCGOutOpQemuLdSt *out =
+                container_of(all_outop[op->opc], TCGOutOpQemuLdSt, base);
+
             out->out(s, type, new_args[0], new_args[1], new_args[2]);
         }
         break;
 
     case INDEX_op_qemu_ld2:
+    case INDEX_op_qemu_st2:
         {
-            const TCGOutOpQemuLdSt2 *out = &outop_qemu_ld2;
+            const TCGOutOpQemuLdSt2 *out =
+                container_of(all_outop[op->opc], TCGOutOpQemuLdSt2, base);
+
             out->out(s, type, new_args[0], new_args[1],
                      new_args[2], new_args[3]);
         }
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index f69e35e6ce..50e205211d 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -39,15 +39,7 @@
 static TCGConstraintSetIndex
 tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 {
-    switch (op) {
-    case INDEX_op_qemu_st:
-        return C_O0_I2(r, r);
-    case INDEX_op_qemu_st2:
-        return TCG_TARGET_REG_BITS == 64 ? C_NotImplemented : C_O0_I3(r, r, r);
-
-    default:
-        return C_NotImplemented;
-    }
+    return C_NotImplemented;
 }
 
 static const int tcg_target_reg_alloc_order[] = {
@@ -1218,25 +1210,36 @@ static const TCGOutOpQemuLdSt2 outop_qemu_ld2 = {
         TCG_TARGET_REG_BITS == 64 ? NULL : tgen_qemu_ld2,
 };
 
+static void tgen_qemu_st(TCGContext *s, TCGType type, TCGReg data,
+                         TCGReg addr, MemOpIdx oi)
+{
+    tcg_out_op_rrm(s, INDEX_op_qemu_st, data, addr, oi);
+}
+
+static const TCGOutOpQemuLdSt outop_qemu_st = {
+    .base.static_constraint = C_O0_I2(r, r),
+    .out = tgen_qemu_st,
+};
+
+static void tgen_qemu_st2(TCGContext *s, TCGType type, TCGReg datalo,
+                          TCGReg datahi, TCGReg addr, MemOpIdx oi)
+{
+    tcg_out_movi(s, TCG_TYPE_I32, TCG_REG_TMP, oi);
+    tcg_out_op_rrrr(s, INDEX_op_qemu_st2, datalo, datahi, addr, TCG_REG_TMP);
+}
+
+static const TCGOutOpQemuLdSt2 outop_qemu_st2 = {
+    .base.static_constraint =
+        TCG_TARGET_REG_BITS == 64 ? C_NotImplemented : C_O0_I3(r, r, r),
+    .out =
+        TCG_TARGET_REG_BITS == 64 ? NULL : tgen_qemu_st2,
+};
+
 static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
                        const TCGArg args[TCG_MAX_OP_ARGS],
                        const int const_args[TCG_MAX_OP_ARGS])
 {
-    switch (opc) {
-    case INDEX_op_qemu_st:
-        tcg_out_op_rrm(s, opc, args[0], args[1], args[2]);
-        break;
-    case INDEX_op_qemu_st2:
-        tcg_out_movi(s, TCG_TYPE_I32, TCG_REG_TMP, args[3]);
-        tcg_out_op_rrrr(s, opc, args[0], args[1], args[2], TCG_REG_TMP);
-        break;
-
-    case INDEX_op_call:     /* Always emitted via tcg_out_call.  */
-    case INDEX_op_exit_tb:  /* Always emitted via tcg_out_exit_tb.  */
-    case INDEX_op_goto_tb:  /* Always emitted via tcg_out_goto_tb.  */
-    default:
-        g_assert_not_reached();
-    }
+    g_assert_not_reached();
 }
 
 static void tcg_out_st(TCGContext *s, TCGType type, TCGReg val, TCGReg base,

From eafecf08059953a2d1d06b6a6ded3c56916cbdd4 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sun, 16 Feb 2025 14:22:48 -0800
Subject: [PATCH 0514/2760] tcg: Remove tcg_out_op
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

All integer opcodes are now converted to TCGOutOp.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target.c.inc     |  7 -------
 tcg/arm/tcg-target.c.inc         |  7 -------
 tcg/i386/tcg-target.c.inc        |  7 -------
 tcg/loongarch64/tcg-target.c.inc |  7 -------
 tcg/mips/tcg-target.c.inc        |  7 -------
 tcg/ppc/tcg-target.c.inc         |  7 -------
 tcg/riscv/tcg-target.c.inc       |  7 -------
 tcg/s390x/tcg-target.c.inc       |  7 -------
 tcg/sparc64/tcg-target.c.inc     |  7 -------
 tcg/tcg.c                        | 12 +++---------
 tcg/tci/tcg-target.c.inc         |  7 -------
 11 files changed, 3 insertions(+), 79 deletions(-)

diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index 59e7992a5f..4cb647cb34 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -2897,13 +2897,6 @@ static const TCGOutOpStore outop_st = {
     .out_r = tcg_out_st,
 };
 
-static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType ext,
-                       const TCGArg args[TCG_MAX_OP_ARGS],
-                       const int const_args[TCG_MAX_OP_ARGS])
-{
-    g_assert_not_reached();
-}
-
 static void tcg_out_vec_op(TCGContext *s, TCGOpcode opc,
                            unsigned vecl, unsigned vece,
                            const TCGArg args[TCG_MAX_OP_ARGS],
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index 014a441420..447e43583e 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -2640,13 +2640,6 @@ static const TCGOutOpStore outop_st = {
     .out_r = tcg_out_st,
 };
 
-static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
-                       const TCGArg args[TCG_MAX_OP_ARGS],
-                       const int const_args[TCG_MAX_OP_ARGS])
-{
-    g_assert_not_reached();
-}
-
 static TCGConstraintSetIndex
 tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 {
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index 9f294f28ed..09fce27b06 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -3602,13 +3602,6 @@ static const TCGOutOpStore outop_st = {
     .out_i = tgen_st_i,
 };
 
-static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
-                       const TCGArg args[TCG_MAX_OP_ARGS],
-                       const int const_args[TCG_MAX_OP_ARGS])
-{
-    g_assert_not_reached();
-}
-
 static int const umin_insn[4] = {
     OPC_PMINUB, OPC_PMINUW, OPC_PMINUD, OPC_VPMINUQ
 };
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index c74ddee644..e5580d69a8 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -2042,13 +2042,6 @@ static const TCGOutOpStore outop_st = {
     .out_r = tcg_out_st,
 };
 
-static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
-                       const TCGArg args[TCG_MAX_OP_ARGS],
-                       const int const_args[TCG_MAX_OP_ARGS])
-{
-    g_assert_not_reached();
-}
-
 static bool tcg_out_dup_vec(TCGContext *s, TCGType type, unsigned vece,
                             TCGReg rd, TCGReg rs)
 {
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index 1f12500344..2c0457e588 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -2444,13 +2444,6 @@ static const TCGOutOpStore outop_st = {
 };
 
 
-static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
-                       const TCGArg args[TCG_MAX_OP_ARGS],
-                       const int const_args[TCG_MAX_OP_ARGS])
-{
-    g_assert_not_reached();
-}
-
 static TCGConstraintSetIndex
 tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 {
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index 824cced94a..2e94778104 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -3828,13 +3828,6 @@ static const TCGOutOpStore outop_st = {
 };
 
 
-static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
-                       const TCGArg args[TCG_MAX_OP_ARGS],
-                       const int const_args[TCG_MAX_OP_ARGS])
-{
-    g_assert_not_reached();
-}
-
 int tcg_can_emit_vec_op(TCGOpcode opc, TCGType type, unsigned vece)
 {
     switch (opc) {
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index eca1283742..f9417d15f7 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -2642,13 +2642,6 @@ static const TCGOutOpStore outop_st = {
 };
 
 
-static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
-                       const TCGArg args[TCG_MAX_OP_ARGS],
-                       const int const_args[TCG_MAX_OP_ARGS])
-{
-    g_assert_not_reached();
-}
-
 static void tcg_out_vec_op(TCGContext *s, TCGOpcode opc,
                            unsigned vecl, unsigned vece,
                            const TCGArg args[TCG_MAX_OP_ARGS],
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index a316c8de41..7ca0071f24 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -3160,13 +3160,6 @@ static const TCGOutOpStore outop_st = {
 };
 
 
-static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
-                       const TCGArg args[TCG_MAX_OP_ARGS],
-                       const int const_args[TCG_MAX_OP_ARGS])
-{
-    g_assert_not_reached();
-}
-
 static bool tcg_out_dup_vec(TCGContext *s, TCGType type, unsigned vece,
                             TCGReg dst, TCGReg src)
 {
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index d1dd0fa33c..83167aa29d 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -2074,13 +2074,6 @@ static const TCGOutOpStore outop_st = {
 };
 
 
-static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
-                       const TCGArg args[TCG_MAX_OP_ARGS],
-                       const int const_args[TCG_MAX_OP_ARGS])
-{
-    g_assert_not_reached();
-}
-
 static TCGConstraintSetIndex
 tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 {
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 302f7025e7..c4e866e9c3 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -138,9 +138,6 @@ static void tcg_out_mb(TCGContext *s, unsigned bar);
 static void tcg_out_br(TCGContext *s, TCGLabel *l);
 static void tcg_out_set_carry(TCGContext *s);
 static void tcg_out_set_borrow(TCGContext *s);
-static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
-                       const TCGArg args[TCG_MAX_OP_ARGS],
-                       const int const_args[TCG_MAX_OP_ARGS]);
 #if TCG_TARGET_MAYBE_vec
 static bool tcg_out_dup_vec(TCGContext *s, TCGType type, unsigned vece,
                             TCGReg dst, TCGReg src);
@@ -5920,12 +5917,9 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
         break;
 
     default:
-        if (def->flags & TCG_OPF_VECTOR) {
-            tcg_out_vec_op(s, op->opc, type - TCG_TYPE_V64,
-                           TCGOP_VECE(op), new_args, const_args);
-        } else {
-            tcg_out_op(s, op->opc, type, new_args, const_args);
-        }
+        tcg_debug_assert(def->flags & TCG_OPF_VECTOR);
+        tcg_out_vec_op(s, op->opc, type - TCG_TYPE_V64,
+                       TCGOP_VECE(op), new_args, const_args);
         break;
     }
 
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index 50e205211d..35c66a4836 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -1235,13 +1235,6 @@ static const TCGOutOpQemuLdSt2 outop_qemu_st2 = {
         TCG_TARGET_REG_BITS == 64 ? NULL : tgen_qemu_st2,
 };
 
-static void tcg_out_op(TCGContext *s, TCGOpcode opc, TCGType type,
-                       const TCGArg args[TCG_MAX_OP_ARGS],
-                       const int const_args[TCG_MAX_OP_ARGS])
-{
-    g_assert_not_reached();
-}
-
 static void tcg_out_st(TCGContext *s, TCGType type, TCGReg val, TCGReg base,
                        intptr_t offset)
 {

From 33b6c61cce2403193f9fc3a221f8a8656ba9cc37 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 25 Apr 2025 11:59:58 -0700
Subject: [PATCH 0515/2760] tcg/sparc64: Unexport use_vis3_instructions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This variable is no longer used outside tcg-target.c.inc.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/sparc64/tcg-target-has.h | 6 ------
 tcg/sparc64/tcg-target.c.inc | 6 ++++--
 2 files changed, 4 insertions(+), 8 deletions(-)

diff --git a/tcg/sparc64/tcg-target-has.h b/tcg/sparc64/tcg-target-has.h
index af6a949da3..b29fd177f6 100644
--- a/tcg/sparc64/tcg-target-has.h
+++ b/tcg/sparc64/tcg-target-has.h
@@ -7,12 +7,6 @@
 #ifndef TCG_TARGET_HAS_H
 #define TCG_TARGET_HAS_H
 
-#if defined(__VIS__) && __VIS__ >= 0x300
-#define use_vis3_instructions  1
-#else
-extern bool use_vis3_instructions;
-#endif
-
 /* optional instructions */
 #define TCG_TARGET_HAS_extr_i64_i32     0
 #define TCG_TARGET_HAS_qemu_ldst_i128   0
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index 83167aa29d..260dd461bd 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -274,8 +274,10 @@ static TCGReg tcg_target_call_oarg_reg(TCGCallReturnKind kind, int slot)
 #define STW_LE     (STWA  | INSN_ASI(ASI_PRIMARY_LITTLE))
 #define STX_LE     (STXA  | INSN_ASI(ASI_PRIMARY_LITTLE))
 
-#ifndef use_vis3_instructions
-bool use_vis3_instructions;
+#if defined(__VIS__) && __VIS__ >= 0x300
+#define use_vis3_instructions  1
+#else
+static bool use_vis3_instructions;
 #endif
 
 static bool check_fit_i64(int64_t val, unsigned int bits)

From 70ab4f4ed9bbe9bcfdb105681291b4695f151522 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 25 Apr 2025 12:57:11 -0700
Subject: [PATCH 0516/2760] tcg/sparc64: Implement CTPOP
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/sparc64/tcg-target.c.inc | 27 ++++++++++++++++++++++-----
 1 file changed, 22 insertions(+), 5 deletions(-)

diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index 260dd461bd..9e004fb511 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -210,6 +210,7 @@ static TCGReg tcg_target_call_oarg_reg(TCGCallReturnKind kind, int slot)
 #define ARITH_UDIVX (INSN_OP(2) | INSN_OP3(0x0d))
 #define ARITH_SDIVX (INSN_OP(2) | INSN_OP3(0x2d))
 #define ARITH_MOVCC (INSN_OP(2) | INSN_OP3(0x2c))
+#define ARITH_POPC (INSN_OP(2) | INSN_OP3(0x2e))
 #define ARITH_MOVR (INSN_OP(2) | INSN_OP3(0x2f))
 
 #define ARITH_ADDXC (INSN_OP(2) | INSN_OP3(0x36) | INSN_OPF(0x11))
@@ -274,6 +275,7 @@ static TCGReg tcg_target_call_oarg_reg(TCGCallReturnKind kind, int slot)
 #define STW_LE     (STWA  | INSN_ASI(ASI_PRIMARY_LITTLE))
 #define STX_LE     (STXA  | INSN_ASI(ASI_PRIMARY_LITTLE))
 
+static bool use_popc_instructions;
 #if defined(__VIS__) && __VIS__ >= 0x300
 #define use_vis3_instructions  1
 #else
@@ -1511,8 +1513,23 @@ static const TCGOutOpBinary outop_clz = {
     .base.static_constraint = C_NotImplemented,
 };
 
+static void tgen_ctpop(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1)
+{
+    tcg_out_arith(s, a0, TCG_REG_G0, a1, ARITH_POPC);
+}
+
+static TCGConstraintSetIndex cset_ctpop(TCGType type, unsigned flags)
+{
+    if (use_popc_instructions && type == TCG_TYPE_I64) {
+        return C_O1_I1(r, r);
+    }
+    return C_NotImplemented;
+}
+
 static const TCGOutOpUnary outop_ctpop = {
-    .base.static_constraint = C_NotImplemented,
+    .base.static_constraint = C_Dynamic,
+    .base.dynamic_constraint = cset_ctpop,
+    .out_rr = tgen_ctpop,
 };
 
 static const TCGOutOpBinary outop_ctz = {
@@ -2084,15 +2101,15 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 
 static void tcg_target_init(TCGContext *s)
 {
+    unsigned long hwcap = qemu_getauxval(AT_HWCAP);
+
     /*
      * Only probe for the platform and capabilities if we haven't already
      * determined maximum values at compile time.
      */
+    use_popc_instructions = (hwcap & HWCAP_SPARC_POPC) != 0;
 #ifndef use_vis3_instructions
-    {
-        unsigned long hwcap = qemu_getauxval(AT_HWCAP);
-        use_vis3_instructions = (hwcap & HWCAP_SPARC_VIS3) != 0;
-    }
+    use_vis3_instructions = (hwcap & HWCAP_SPARC_VIS3) != 0;
 #endif
 
     tcg_target_available_regs[TCG_TYPE_I32] = ALL_GENERAL_REGS;

From 71365ee433125026d9744a0a37142c81ff312b53 Mon Sep 17 00:00:00 2001
From: Vincent Vanlaer <libvirt-e6954efa@volkihar.be>
Date: Sat, 26 Oct 2024 18:30:05 +0200
Subject: [PATCH 0517/2760] block: get type of block allocation in commit_run

bdrv_co_common_block_status_above not only returns whether the block is
allocated, but also if it contains zeroes.

Signed-off-by: Vincent Vanlaer <libvirt-e6954efa@volkihar.be>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Message-Id: <20241026163010.2865002-2-libvirt-e6954efa@volkihar.be>
Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
---
 block/commit.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/block/commit.c b/block/commit.c
index 5df3d05346..ba0ba59316 100644
--- a/block/commit.c
+++ b/block/commit.c
@@ -15,6 +15,8 @@
 #include "qemu/osdep.h"
 #include "qemu/cutils.h"
 #include "trace.h"
+#include "block/block-common.h"
+#include "block/coroutines.h"
 #include "block/block_int.h"
 #include "block/blockjob_int.h"
 #include "qapi/error.h"
@@ -167,9 +169,13 @@ static int coroutine_fn commit_run(Job *job, Error **errp)
             break;
         }
         /* Copy if allocated above the base */
-        ret = blk_co_is_allocated_above(s->top, s->base_overlay, true,
-                                        offset, COMMIT_BUFFER_SIZE, &n);
-        copy = (ret > 0);
+        WITH_GRAPH_RDLOCK_GUARD() {
+            ret = bdrv_co_common_block_status_above(blk_bs(s->top),
+                s->base_overlay, true, true, offset, COMMIT_BUFFER_SIZE,
+                &n, NULL, NULL, NULL);
+        }
+
+        copy = (ret >= 0 && ret & BDRV_BLOCK_ALLOCATED);
         trace_commit_one_iteration(s, offset, n, ret);
         if (copy) {
             assert(n < SIZE_MAX);

From 23743ab282af4fbb80fdc049bff2c93668c73c83 Mon Sep 17 00:00:00 2001
From: Vincent Vanlaer <libvirt-e6954efa@volkihar.be>
Date: Sat, 26 Oct 2024 18:30:06 +0200
Subject: [PATCH 0518/2760] block: move commit_run loop to separate function

Signed-off-by: Vincent Vanlaer <libvirt-e6954efa@volkihar.be>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Message-Id: <20241026163010.2865002-3-libvirt-e6954efa@volkihar.be>
Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
---
 block/commit.c | 87 +++++++++++++++++++++++++++++---------------------
 1 file changed, 51 insertions(+), 36 deletions(-)

diff --git a/block/commit.c b/block/commit.c
index ba0ba59316..3ee0ade7df 100644
--- a/block/commit.c
+++ b/block/commit.c
@@ -128,6 +128,55 @@ static void commit_clean(Job *job)
     blk_unref(s->top);
 }
 
+static int commit_iteration(CommitBlockJob *s, int64_t offset,
+                            int64_t *n, void *buf)
+{
+    int ret = 0;
+    bool copy;
+    bool error_in_source = true;
+
+    /* Copy if allocated above the base */
+    WITH_GRAPH_RDLOCK_GUARD() {
+        ret = bdrv_co_common_block_status_above(blk_bs(s->top),
+            s->base_overlay, true, true, offset, COMMIT_BUFFER_SIZE,
+            n, NULL, NULL, NULL);
+    }
+
+    copy = (ret >= 0 && ret & BDRV_BLOCK_ALLOCATED);
+    trace_commit_one_iteration(s, offset, *n, ret);
+    if (copy) {
+        assert(*n < SIZE_MAX);
+
+        ret = blk_co_pread(s->top, offset, *n, buf, 0);
+        if (ret >= 0) {
+            ret = blk_co_pwrite(s->base, offset, *n, buf, 0);
+            if (ret < 0) {
+                error_in_source = false;
+            }
+        }
+    }
+    if (ret < 0) {
+        BlockErrorAction action = block_job_error_action(&s->common,
+                                                         s->on_error,
+                                                         error_in_source,
+                                                         -ret);
+        if (action == BLOCK_ERROR_ACTION_REPORT) {
+            return ret;
+        } else {
+            *n = 0;
+            return 0;
+        }
+    }
+    /* Publish progress */
+    job_progress_update(&s->common.job, *n);
+
+    if (copy) {
+        block_job_ratelimit_processed_bytes(&s->common, *n);
+    }
+
+    return 0;
+}
+
 static int coroutine_fn commit_run(Job *job, Error **errp)
 {
     CommitBlockJob *s = container_of(job, CommitBlockJob, common.job);
@@ -158,9 +207,6 @@ static int coroutine_fn commit_run(Job *job, Error **errp)
     buf = blk_blockalign(s->top, COMMIT_BUFFER_SIZE);
 
     for (offset = 0; offset < len; offset += n) {
-        bool copy;
-        bool error_in_source = true;
-
         /* Note that even when no rate limit is applied we need to yield
          * with no pending I/O here so that bdrv_drain_all() returns.
          */
@@ -168,42 +214,11 @@ static int coroutine_fn commit_run(Job *job, Error **errp)
         if (job_is_cancelled(&s->common.job)) {
             break;
         }
-        /* Copy if allocated above the base */
-        WITH_GRAPH_RDLOCK_GUARD() {
-            ret = bdrv_co_common_block_status_above(blk_bs(s->top),
-                s->base_overlay, true, true, offset, COMMIT_BUFFER_SIZE,
-                &n, NULL, NULL, NULL);
-        }
 
-        copy = (ret >= 0 && ret & BDRV_BLOCK_ALLOCATED);
-        trace_commit_one_iteration(s, offset, n, ret);
-        if (copy) {
-            assert(n < SIZE_MAX);
+        ret = commit_iteration(s, offset, &n, buf);
 
-            ret = blk_co_pread(s->top, offset, n, buf, 0);
-            if (ret >= 0) {
-                ret = blk_co_pwrite(s->base, offset, n, buf, 0);
-                if (ret < 0) {
-                    error_in_source = false;
-                }
-            }
-        }
         if (ret < 0) {
-            BlockErrorAction action =
-                block_job_error_action(&s->common, s->on_error,
-                                       error_in_source, -ret);
-            if (action == BLOCK_ERROR_ACTION_REPORT) {
-                return ret;
-            } else {
-                n = 0;
-                continue;
-            }
-        }
-        /* Publish progress */
-        job_progress_update(&s->common.job, n);
-
-        if (copy) {
-            block_job_ratelimit_processed_bytes(&s->common, n);
+            return ret;
         }
     }
 

From 2e6a9f03ba1e8145cf71eced2b97611cfa754898 Mon Sep 17 00:00:00 2001
From: Gautam Gala <ggala@linux.ibm.com>
Date: Wed, 23 Apr 2025 10:09:13 +0200
Subject: [PATCH 0519/2760] target/s390x: Introduce constant when checking if
 PV header couldn't be decrypted

Introduce a named constant when checking the Set Secure Configuration parameters
UV call return code for the case where no valid host key was found and therefore
the PV header couldn't be decrypted (0x108).

Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Janosch Frank <frankja@linux.ibm.com>
Signed-off-by: Gautam Gala <ggala@linux.ibm.com>
Message-ID: <20250423080915.1048123-2-ggala@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 target/s390x/kvm/pv.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/target/s390x/kvm/pv.c b/target/s390x/kvm/pv.c
index fe0a72c416..1947a3d669 100644
--- a/target/s390x/kvm/pv.c
+++ b/target/s390x/kvm/pv.c
@@ -147,6 +147,7 @@ bool s390_pv_vm_try_disable_async(S390CcwMachineState *ms)
     return true;
 }
 
+#define UV_RC_SSC_INVAL_HOSTKEY    0x0108
 int s390_pv_set_sec_parms(uint64_t origin, uint64_t length, Error **errp)
 {
     int ret, pvrc;
@@ -158,7 +159,7 @@ int s390_pv_set_sec_parms(uint64_t origin, uint64_t length, Error **errp)
     ret = s390_pv_cmd_pvrc(KVM_PV_SET_SEC_PARMS, &args, &pvrc);
     if (ret) {
         error_setg(errp, "Failed to set secure execution parameters");
-        if (pvrc == 0x108) {
+        if (pvrc == UV_RC_SSC_INVAL_HOSTKEY) {
             error_append_hint(errp, "Please check whether the image is "
                                     "correctly encrypted for this host\n");
         }

From e27cbd17dd5d46f92e2e9610e4ed12b525c548be Mon Sep 17 00:00:00 2001
From: Gautam Gala <ggala@linux.ibm.com>
Date: Wed, 23 Apr 2025 10:09:14 +0200
Subject: [PATCH 0520/2760] target/s390x: Introduce function when exiting PV

Replace an existing macro (s390_pv_cmd_exit) that looks like
a function with an actual function. The function will be used
when exiting PV instead of the macro.

Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Janosch Frank <frankja@linux.ibm.com>
Signed-off-by: Gautam Gala <ggala@linux.ibm.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250423080915.1048123-3-ggala@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 target/s390x/kvm/pv.c | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/target/s390x/kvm/pv.c b/target/s390x/kvm/pv.c
index 1947a3d669..30b64f7f22 100644
--- a/target/s390x/kvm/pv.c
+++ b/target/s390x/kvm/pv.c
@@ -59,14 +59,12 @@ static int __s390_pv_cmd(uint32_t cmd, const char *cmdname, void *data,
  */
 #define s390_pv_cmd(cmd, data) __s390_pv_cmd(cmd, #cmd, data, NULL)
 #define s390_pv_cmd_pvrc(cmd, data, pvrc) __s390_pv_cmd(cmd, #cmd, data, pvrc)
-#define s390_pv_cmd_exit(cmd, data)    \
-{                                      \
-    int rc;                            \
-                                       \
-    rc = __s390_pv_cmd(cmd, #cmd, data, NULL); \
-    if (rc) {                          \
-        exit(1);                       \
-    }                                  \
+
+static void s390_pv_cmd_exit(uint32_t cmd, void *data)
+{
+    if (s390_pv_cmd(cmd, data)) {
+        exit(1);
+    }
 }
 
 int s390_pv_query_info(void)

From 55a494e53e1f0c73ba5cfb1b072fed9035b7961b Mon Sep 17 00:00:00 2001
From: Gautam Gala <ggala@linux.ibm.com>
Date: Wed, 23 Apr 2025 10:09:15 +0200
Subject: [PATCH 0521/2760] target/s390x: Return UVC cmd code, RC and RRC value
 when DIAG 308 Subcode 10 fails to enter secure mode

Extend DIAG308 subcode 10 to return the UVC RC, RRC and command code
in bit positions 32-47, 16-31, and 0-15 of register R1 + 1 if the
function does not complete successfully (in addition to the
previously returned diag response code in bit position 47-63).

Reviewed-by: Janosch Frank <frankja@linux.ibm.com>
Signed-off-by: Gautam Gala <ggala@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Message-ID: <20250423080915.1048123-4-ggala@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 hw/s390x/ipl.c             | 11 ++++----
 hw/s390x/ipl.h             |  6 +++--
 hw/s390x/s390-virtio-ccw.c | 14 ++++++-----
 target/s390x/kvm/pv.c      | 51 +++++++++++++++++++++++++++-----------
 target/s390x/kvm/pv.h      | 26 +++++++++++++------
 5 files changed, 73 insertions(+), 35 deletions(-)

diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c
index 716a6b7869..2f082396c7 100644
--- a/hw/s390x/ipl.c
+++ b/hw/s390x/ipl.c
@@ -26,7 +26,6 @@
 #include "hw/s390x/vfio-ccw.h"
 #include "hw/s390x/css.h"
 #include "hw/s390x/ebcdic.h"
-#include "target/s390x/kvm/pv.h"
 #include "hw/scsi/scsi.h"
 #include "hw/virtio/virtio-net.h"
 #include "ipl.h"
@@ -676,7 +675,7 @@ static void s390_ipl_prepare_qipl(S390CPU *cpu)
     cpu_physical_memory_unmap(addr, len, 1, len);
 }
 
-int s390_ipl_prepare_pv_header(Error **errp)
+int s390_ipl_prepare_pv_header(struct S390PVResponse *pv_resp, Error **errp)
 {
     IplParameterBlock *ipib = s390_ipl_get_iplb_pv();
     IPLBlockPV *ipib_pv = &ipib->pv;
@@ -685,12 +684,13 @@ int s390_ipl_prepare_pv_header(Error **errp)
 
     cpu_physical_memory_read(ipib_pv->pv_header_addr, hdr,
                              ipib_pv->pv_header_len);
-    rc = s390_pv_set_sec_parms((uintptr_t)hdr, ipib_pv->pv_header_len, errp);
+    rc = s390_pv_set_sec_parms((uintptr_t)hdr, ipib_pv->pv_header_len,
+                               pv_resp, errp);
     g_free(hdr);
     return rc;
 }
 
-int s390_ipl_pv_unpack(void)
+int s390_ipl_pv_unpack(struct S390PVResponse *pv_resp)
 {
     IplParameterBlock *ipib = s390_ipl_get_iplb_pv();
     IPLBlockPV *ipib_pv = &ipib->pv;
@@ -699,7 +699,8 @@ int s390_ipl_pv_unpack(void)
     for (i = 0; i < ipib_pv->num_comp; i++) {
         rc = s390_pv_unpack(ipib_pv->components[i].addr,
                             TARGET_PAGE_ALIGN(ipib_pv->components[i].size),
-                            ipib_pv->components[i].tweak_pref);
+                            ipib_pv->components[i].tweak_pref,
+                            pv_resp);
         if (rc) {
             break;
         }
diff --git a/hw/s390x/ipl.h b/hw/s390x/ipl.h
index cb55101f06..505cded490 100644
--- a/hw/s390x/ipl.h
+++ b/hw/s390x/ipl.h
@@ -20,6 +20,7 @@
 #include "hw/qdev-core.h"
 #include "hw/s390x/ipl/qipl.h"
 #include "qom/object.h"
+#include "target/s390x/kvm/pv.h"
 
 #define DIAG308_FLAGS_LP_VALID 0x80
 #define MAX_BOOT_DEVS 8 /* Max number of devices that may have a bootindex */
@@ -28,8 +29,9 @@ void s390_ipl_convert_loadparm(char *ascii_lp, uint8_t *ebcdic_lp);
 void s390_ipl_fmt_loadparm(uint8_t *loadparm, char *str, Error **errp);
 void s390_rebuild_iplb(uint16_t index, IplParameterBlock *iplb);
 void s390_ipl_update_diag308(IplParameterBlock *iplb);
-int s390_ipl_prepare_pv_header(Error **errp);
-int s390_ipl_pv_unpack(void);
+int s390_ipl_prepare_pv_header(struct S390PVResponse *pv_resp,
+                               Error **errp);
+int s390_ipl_pv_unpack(struct S390PVResponse *pv_resp);
 void s390_ipl_prepare_cpu(S390CPU *cpu);
 IplParameterBlock *s390_ipl_get_iplb(void);
 IplParameterBlock *s390_ipl_get_iplb_pv(void);
diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
index 94edd42dd2..d5658afed9 100644
--- a/hw/s390x/s390-virtio-ccw.c
+++ b/hw/s390x/s390-virtio-ccw.c
@@ -365,7 +365,8 @@ static void s390_machine_unprotect(S390CcwMachineState *ms)
     ram_block_discard_disable(false);
 }
 
-static int s390_machine_protect(S390CcwMachineState *ms)
+static int s390_machine_protect(S390CcwMachineState *ms,
+                                struct S390PVResponse *pv_resp)
 {
     Error *local_err = NULL;
     int rc;
@@ -408,19 +409,19 @@ static int s390_machine_protect(S390CcwMachineState *ms)
     }
 
     /* Set SE header and unpack */
-    rc = s390_ipl_prepare_pv_header(&local_err);
+    rc = s390_ipl_prepare_pv_header(pv_resp, &local_err);
     if (rc) {
         goto out_err;
     }
 
     /* Decrypt image */
-    rc = s390_ipl_pv_unpack();
+    rc = s390_ipl_pv_unpack(pv_resp);
     if (rc) {
         goto out_err;
     }
 
     /* Verify integrity */
-    rc = s390_pv_verify();
+    rc = s390_pv_verify(pv_resp);
     if (rc) {
         goto out_err;
     }
@@ -452,6 +453,7 @@ static void s390_pv_prepare_reset(S390CcwMachineState *ms)
 static void s390_machine_reset(MachineState *machine, ResetType type)
 {
     S390CcwMachineState *ms = S390_CCW_MACHINE(machine);
+    struct S390PVResponse pv_resp;
     enum s390_reset reset_type;
     CPUState *cs, *t;
     S390CPU *cpu;
@@ -540,8 +542,8 @@ static void s390_machine_reset(MachineState *machine, ResetType type)
         }
         run_on_cpu(cs, s390_do_cpu_reset, RUN_ON_CPU_NULL);
 
-        if (s390_machine_protect(ms)) {
-            s390_pv_inject_reset_error(cs);
+        if (s390_machine_protect(ms, &pv_resp)) {
+            s390_pv_inject_reset_error(cs, pv_resp);
             /*
              * Continue after the diag308 so the guest knows something
              * went wrong.
diff --git a/target/s390x/kvm/pv.c b/target/s390x/kvm/pv.c
index 30b64f7f22..2bc916a545 100644
--- a/target/s390x/kvm/pv.c
+++ b/target/s390x/kvm/pv.c
@@ -30,7 +30,7 @@ static struct kvm_s390_pv_info_vm info_vm;
 static struct kvm_s390_pv_info_dump info_dump;
 
 static int __s390_pv_cmd(uint32_t cmd, const char *cmdname, void *data,
-                         int *pvrc)
+                         struct S390PVResponse *pv_resp)
 {
     struct kvm_pv_cmd pv_cmd = {
         .cmd = cmd,
@@ -47,8 +47,10 @@ static int __s390_pv_cmd(uint32_t cmd, const char *cmdname, void *data,
                      "IOCTL rc: %d", cmd, cmdname, pv_cmd.rc, pv_cmd.rrc,
                      rc);
     }
-    if (pvrc) {
-        *pvrc = pv_cmd.rc;
+    if (pv_resp) {
+        pv_resp->cmd = cmd;
+        pv_resp->rc = pv_cmd.rc;
+        pv_resp->rrc = pv_cmd.rrc;
     }
     return rc;
 }
@@ -57,8 +59,9 @@ static int __s390_pv_cmd(uint32_t cmd, const char *cmdname, void *data,
  * This macro lets us pass the command as a string to the function so
  * we can print it on an error.
  */
-#define s390_pv_cmd(cmd, data) __s390_pv_cmd(cmd, #cmd, data, NULL)
-#define s390_pv_cmd_pvrc(cmd, data, pvrc) __s390_pv_cmd(cmd, #cmd, data, pvrc)
+#define s390_pv_cmd(cmd, data)  __s390_pv_cmd(cmd, #cmd, data, NULL)
+#define s390_pv_cmd_pv_resp(cmd, data, pv_resp) \
+                                __s390_pv_cmd(cmd, #cmd, data, pv_resp)
 
 static void s390_pv_cmd_exit(uint32_t cmd, void *data)
 {
@@ -146,18 +149,19 @@ bool s390_pv_vm_try_disable_async(S390CcwMachineState *ms)
 }
 
 #define UV_RC_SSC_INVAL_HOSTKEY    0x0108
-int s390_pv_set_sec_parms(uint64_t origin, uint64_t length, Error **errp)
+int s390_pv_set_sec_parms(uint64_t origin, uint64_t length,
+                          struct S390PVResponse *pv_resp, Error **errp)
 {
-    int ret, pvrc;
+    int ret;
     struct kvm_s390_pv_sec_parm args = {
         .origin = origin,
         .length = length,
     };
 
-    ret = s390_pv_cmd_pvrc(KVM_PV_SET_SEC_PARMS, &args, &pvrc);
+    ret = s390_pv_cmd_pv_resp(KVM_PV_SET_SEC_PARMS, &args, pv_resp);
     if (ret) {
         error_setg(errp, "Failed to set secure execution parameters");
-        if (pvrc == UV_RC_SSC_INVAL_HOSTKEY) {
+        if (pv_resp->rc == UV_RC_SSC_INVAL_HOSTKEY) {
             error_append_hint(errp, "Please check whether the image is "
                                     "correctly encrypted for this host\n");
         }
@@ -169,7 +173,8 @@ int s390_pv_set_sec_parms(uint64_t origin, uint64_t length, Error **errp)
 /*
  * Called for each component in the SE type IPL parameter block 0.
  */
-int s390_pv_unpack(uint64_t addr, uint64_t size, uint64_t tweak)
+int s390_pv_unpack(uint64_t addr, uint64_t size,
+                   uint64_t tweak, struct S390PVResponse *pv_resp)
 {
     struct kvm_s390_pv_unp args = {
         .addr = addr,
@@ -177,7 +182,7 @@ int s390_pv_unpack(uint64_t addr, uint64_t size, uint64_t tweak)
         .tweak = tweak,
     };
 
-    return s390_pv_cmd(KVM_PV_UNPACK, &args);
+    return s390_pv_cmd_pv_resp(KVM_PV_UNPACK, &args, pv_resp);
 }
 
 void s390_pv_prep_reset(void)
@@ -185,9 +190,9 @@ void s390_pv_prep_reset(void)
     s390_pv_cmd_exit(KVM_PV_PREP_RESET, NULL);
 }
 
-int s390_pv_verify(void)
+int s390_pv_verify(struct S390PVResponse *pv_resp)
 {
-    return s390_pv_cmd(KVM_PV_VERIFY, NULL);
+    return s390_pv_cmd_pv_resp(KVM_PV_VERIFY, NULL, pv_resp);
 }
 
 void s390_pv_unshare(void)
@@ -195,13 +200,29 @@ void s390_pv_unshare(void)
     s390_pv_cmd_exit(KVM_PV_UNSHARE_ALL, NULL);
 }
 
-void s390_pv_inject_reset_error(CPUState *cs)
+void s390_pv_inject_reset_error(CPUState *cs,
+                                struct S390PVResponse pv_resp)
 {
     int r1 = (cs->kvm_run->s390_sieic.ipa & 0x00f0) >> 4;
     CPUS390XState *env = &S390_CPU(cs)->env;
 
+    union {
+        struct {
+            uint16_t pv_cmd;
+            uint16_t pv_rrc;
+            uint16_t pv_rc;
+            uint16_t diag_rc;
+        };
+        uint64_t regs;
+    } resp = {
+              .pv_cmd = pv_resp.cmd,
+              .pv_rrc = pv_resp.rrc,
+              .pv_rc = pv_resp.rc,
+              .diag_rc = DIAG_308_RC_INVAL_FOR_PV
+             };
+
     /* Report that we are unable to enter protected mode */
-    env->regs[r1 + 1] = DIAG_308_RC_INVAL_FOR_PV;
+    env->regs[r1 + 1] = resp.regs;
 }
 
 uint64_t kvm_s390_pv_dmp_get_size_cpu(void)
diff --git a/target/s390x/kvm/pv.h b/target/s390x/kvm/pv.h
index 5e9c8bd351..94e885e933 100644
--- a/target/s390x/kvm/pv.h
+++ b/target/s390x/kvm/pv.h
@@ -16,6 +16,12 @@
 #include "system/kvm.h"
 #include "hw/s390x/s390-virtio-ccw.h"
 
+struct S390PVResponse {
+    uint16_t cmd;
+    uint16_t rrc;
+    uint16_t rc;
+};
+
 #ifdef CONFIG_KVM
 #include "cpu.h"
 
@@ -42,12 +48,15 @@ int s390_pv_query_info(void);
 int s390_pv_vm_enable(void);
 void s390_pv_vm_disable(void);
 bool s390_pv_vm_try_disable_async(S390CcwMachineState *ms);
-int s390_pv_set_sec_parms(uint64_t origin, uint64_t length, Error **errp);
-int s390_pv_unpack(uint64_t addr, uint64_t size, uint64_t tweak);
+int s390_pv_set_sec_parms(uint64_t origin, uint64_t length,
+                          struct S390PVResponse *pv_resp, Error **errp);
+int s390_pv_unpack(uint64_t addr, uint64_t size, uint64_t tweak,
+                   struct S390PVResponse *pv_resp);
 void s390_pv_prep_reset(void);
-int s390_pv_verify(void);
+int s390_pv_verify(struct S390PVResponse *pv_resp);
 void s390_pv_unshare(void);
-void s390_pv_inject_reset_error(CPUState *cs);
+void s390_pv_inject_reset_error(CPUState *cs,
+                                struct S390PVResponse pv_resp);
 uint64_t kvm_s390_pv_dmp_get_size_cpu(void);
 uint64_t kvm_s390_pv_dmp_get_size_mem_state(void);
 uint64_t kvm_s390_pv_dmp_get_size_completion_data(void);
@@ -63,12 +72,15 @@ static inline int s390_pv_vm_enable(void) { return 0; }
 static inline void s390_pv_vm_disable(void) {}
 static inline bool s390_pv_vm_try_disable_async(S390CcwMachineState *ms) { return false; }
 static inline int s390_pv_set_sec_parms(uint64_t origin, uint64_t length,
+                                        struct S390PVResponse *pv_resp,
                                         Error **errp) { return 0; }
-static inline int s390_pv_unpack(uint64_t addr, uint64_t size, uint64_t tweak) { return 0; }
+static inline int s390_pv_unpack(uint64_t addr, uint64_t size, uint64_t tweak,
+                                 struct S390PVResponse *pv_resp) { return 0; }
 static inline void s390_pv_prep_reset(void) {}
-static inline int s390_pv_verify(void) { return 0; }
+static inline int s390_pv_verify(struct S390PVResponse *pv_resp) { return 0; }
 static inline void s390_pv_unshare(void) {}
-static inline void s390_pv_inject_reset_error(CPUState *cs) {};
+static inline void s390_pv_inject_reset_error(CPUState *cs,
+                                              struct S390PVResponse pv_resp) {};
 static inline uint64_t kvm_s390_pv_dmp_get_size_cpu(void) { return 0; }
 static inline uint64_t kvm_s390_pv_dmp_get_size_mem_state(void) { return 0; }
 static inline uint64_t kvm_s390_pv_dmp_get_size_completion_data(void) { return 0; }

From 71a30d54e6ab1d5c102a8bee2c263414697402ea Mon Sep 17 00:00:00 2001
From: Kevin Wolf <kwolf@redhat.com>
Date: Tue, 29 Apr 2025 17:56:54 +0200
Subject: [PATCH 0522/2760] file-posix: Fix crash on discard_granularity == 0

Block devices that don't support discard have a discard_granularity of
0. Currently, this results in a division by zero when we try to make
sure that it's a multiple of request_alignment. Only try to update
bs->bl.pdiscard_alignment when we got a non-zero discard_granularity
from sysfs.

Fixes: f605796aae4 ('file-posix: probe discard alignment on Linux block devices')
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-ID: <20250429155654.102735-1-kwolf@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 block/file-posix.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/block/file-posix.c b/block/file-posix.c
index 0d6e12f880..0d85123d0f 100644
--- a/block/file-posix.c
+++ b/block/file-posix.c
@@ -1573,7 +1573,7 @@ static void raw_refresh_limits(BlockDriverState *bs, Error **errp)
         int ret;
 
         ret = hdev_get_pdiscard_alignment(&st, &dalign);
-        if (ret == 0) {
+        if (ret == 0 && dalign != 0) {
             uint32_t ralign = bs->bl.request_alignment;
 
             /* Probably never happens, but handle it just in case */

From 6b1c744ec0d66d6d568f9a156282153fc11a21cf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Fri, 25 Apr 2025 13:17:12 +0100
Subject: [PATCH 0523/2760] meson/configure: add 'valgrind' option & --{en,
 dis}able-valgrind flag
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Currently valgrind debugging support for coroutine stacks is enabled
unconditionally when valgrind/valgrind.h is found. There is no way
to disable valgrind support if valgrind.h is present in the build env.

This is bad for distros, as an dependency far down the chain may cause
valgrind.h to become installed, inadvertently enabling QEMU's valgrind
debugging support. It also means if a distro wants valgrind support
there is no way to mandate this.

The solution is to add a 'valgrind' build feature to meson and thus
configure script.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250425121713.1913424-1-berrange@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 meson.build                   | 13 ++++++++++++-
 meson_options.txt             |  2 ++
 scripts/meson-buildoptions.sh |  3 +++
 3 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/meson.build b/meson.build
index 8ae70dbe45..ccd6c71577 100644
--- a/meson.build
+++ b/meson.build
@@ -2618,7 +2618,17 @@ config_host_data.set('CONFIG_FSTRIM', qga_fstrim)
 # has_header
 config_host_data.set('CONFIG_EPOLL', cc.has_header('sys/epoll.h'))
 config_host_data.set('CONFIG_LINUX_MAGIC_H', cc.has_header('linux/magic.h'))
-config_host_data.set('CONFIG_VALGRIND_H', cc.has_header('valgrind/valgrind.h'))
+valgrind = false
+if get_option('valgrind').allowed()
+    if cc.has_header('valgrind/valgrind.h')
+        valgrind = true
+    else
+        if get_option('valgrind').enabled()
+            error('valgrind requested but valgrind.h not found')
+        endif
+    endif
+endif
+config_host_data.set('CONFIG_VALGRIND_H', valgrind)
 config_host_data.set('HAVE_BTRFS_H', cc.has_header('linux/btrfs.h'))
 config_host_data.set('HAVE_DRM_H', cc.has_header('libdrm/drm.h'))
 config_host_data.set('HAVE_OPENAT2_H', cc.has_header('linux/openat2.h'))
@@ -4905,6 +4915,7 @@ endif
 if host_os == 'darwin'
   summary_info += {'ParavirtualizedGraphics support': pvg}
 endif
+summary_info += {'valgrind':          valgrind}
 summary(summary_info, bool_yn: true, section: 'Dependencies')
 
 if host_arch == 'unknown'
diff --git a/meson_options.txt b/meson_options.txt
index 59d973bca0..0b4115e733 100644
--- a/meson_options.txt
+++ b/meson_options.txt
@@ -115,6 +115,8 @@ option('dbus_display', type: 'feature', value: 'auto',
        description: '-display dbus support')
 option('tpm', type : 'feature', value : 'auto',
        description: 'TPM support')
+option('valgrind', type : 'feature', value: 'auto',
+       description: 'valgrind debug support for coroutine stacks')
 
 # Do not enable it by default even for Mingw32, because it doesn't
 # work on Wine.
diff --git a/scripts/meson-buildoptions.sh b/scripts/meson-buildoptions.sh
index 3e8e00852b..d76a239130 100644
--- a/scripts/meson-buildoptions.sh
+++ b/scripts/meson-buildoptions.sh
@@ -198,6 +198,7 @@ meson_options_help() {
   printf "%s\n" '  u2f             U2F emulation support'
   printf "%s\n" '  uadk            UADK Library support'
   printf "%s\n" '  usb-redir       libusbredir support'
+  printf "%s\n" '  valgrind        valgrind debug support for coroutine stacks'
   printf "%s\n" '  vde             vde network backend support'
   printf "%s\n" '  vdi             vdi image format support'
   printf "%s\n" '  vduse-blk-export'
@@ -526,6 +527,8 @@ _meson_option_parse() {
     --disable-ubsan) printf "%s" -Dubsan=false ;;
     --enable-usb-redir) printf "%s" -Dusb_redir=enabled ;;
     --disable-usb-redir) printf "%s" -Dusb_redir=disabled ;;
+    --enable-valgrind) printf "%s" -Dvalgrind=enabled ;;
+    --disable-valgrind) printf "%s" -Dvalgrind=disabled ;;
     --enable-vde) printf "%s" -Dvde=enabled ;;
     --disable-vde) printf "%s" -Dvde=disabled ;;
     --enable-vdi) printf "%s" -Dvdi=enabled ;;

From d64db833d6e3cbe9ea5f36342480f920f3675cea Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Fri, 25 Apr 2025 14:07:10 +0200
Subject: [PATCH 0524/2760] Drop support for Python 3.8
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Python 3.8 went "end of life" in October 2024 and Fedora 42 dropped
this version already, so the "python" CI job is currently failing.
Thus it's time to drop support for this Python version in QEMU, too.

While we're at it, also look for "python3.13" in the configure script.

Message-ID: <20250425120710.879518-1-thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 configure                              | 14 +++++++-------
 docs/about/build-platforms.rst         |  2 +-
 python/Makefile                        |  8 ++++----
 python/setup.cfg                       |  7 +++----
 python/tests/minreqs.txt               |  2 +-
 scripts/qapi/mypy.ini                  |  2 +-
 tests/docker/dockerfiles/python.docker |  1 -
 7 files changed, 17 insertions(+), 19 deletions(-)

diff --git a/configure b/configure
index 000309cf61..40705afdf5 100755
--- a/configure
+++ b/configure
@@ -540,17 +540,17 @@ if test -n "$linux_arch" && ! test -d "$source_path/linux-headers/asm-$linux_arc
 fi
 
 check_py_version() {
-    # We require python >= 3.8.
+    # We require python >= 3.9.
     # NB: a True python conditional creates a non-zero return code (Failure)
-    "$1" -c 'import sys; sys.exit(sys.version_info < (3,8))'
+    "$1" -c 'import sys; sys.exit(sys.version_info < (3,9))'
 }
 
 first_python=
 if test -z "${PYTHON}"; then
     # A bare 'python' is traditionally python 2.x, but some distros
     # have it as python 3.x, so check in both places.
-    for binary in python3 python python3.12 python3.11 \
-                          python3.10 python3.9 python3.8; do
+    for binary in python3 python python3.13 python3.12 python3.11 \
+                          python3.10 python3.9 ; do
         if has "$binary"; then
             python=$(command -v "$binary")
             if check_py_version "$python"; then
@@ -933,7 +933,7 @@ then
     # If first_python is set, there was a binary somewhere even though
     # it was not suitable.  Use it for the error message.
     if test -n "$first_python"; then
-        error_exit "Cannot use '$first_python', Python >= 3.8 is required." \
+        error_exit "Cannot use '$first_python', Python >= 3.9 is required." \
             "Use --python=/path/to/python to specify a supported Python."
     else
         error_exit "Python not found. Use --python=/path/to/python"
@@ -941,11 +941,11 @@ then
 fi
 
 if ! check_py_version "$python"; then
-  error_exit "Cannot use '$python', Python >= 3.8 is required." \
+  error_exit "Cannot use '$python', Python >= 3.9 is required." \
              "Use --python=/path/to/python to specify a supported Python." \
              "Maybe try:" \
              "  openSUSE Leap 15.3+: zypper install python39" \
-             "  CentOS 8: dnf install python38"
+             "  CentOS: dnf install python3.12"
 fi
 
 # Resolve PATH
diff --git a/docs/about/build-platforms.rst b/docs/about/build-platforms.rst
index 52521552c8..c3651871d2 100644
--- a/docs/about/build-platforms.rst
+++ b/docs/about/build-platforms.rst
@@ -101,7 +101,7 @@ Python runtime
   option of the ``configure`` script to point QEMU to a supported
   version of the Python runtime.
 
-  As of QEMU |version|, the minimum supported version of Python is 3.8.
+  As of QEMU |version|, the minimum supported version of Python is 3.9.
 
 Python build dependencies
   Some of QEMU's build dependencies are written in Python.  Usually these
diff --git a/python/Makefile b/python/Makefile
index 1fa4ba2498..764b79ccb2 100644
--- a/python/Makefile
+++ b/python/Makefile
@@ -9,13 +9,13 @@ help:
 	@echo "make check-minreqs:"
 	@echo "    Run tests in the minreqs virtual environment."
 	@echo "    These tests use the oldest dependencies."
-	@echo "    Requires: Python 3.8"
-	@echo "    Hint (Fedora): 'sudo dnf install python3.8'"
+	@echo "    Requires: Python 3.9"
+	@echo "    Hint (Fedora): 'sudo dnf install python3.9'"
 	@echo ""
 	@echo "make check-tox:"
 	@echo "    Run tests against multiple python versions."
 	@echo "    These tests use the newest dependencies."
-	@echo "    Requires: Python 3.8 - 3.11, and tox."
+	@echo "    Requires: Python 3.9 - 3.11, and tox."
 	@echo "    Hint (Fedora): 'sudo dnf install python3-tox python3.11'"
 	@echo "    The variable QEMU_TOX_EXTRA_ARGS can be use to pass extra"
 	@echo "    arguments to tox".
@@ -59,7 +59,7 @@ PIP_INSTALL = pip install --disable-pip-version-check
 min-venv: $(QEMU_MINVENV_DIR) $(QEMU_MINVENV_DIR)/bin/activate
 $(QEMU_MINVENV_DIR) $(QEMU_MINVENV_DIR)/bin/activate: setup.cfg tests/minreqs.txt
 	@echo "VENV $(QEMU_MINVENV_DIR)"
-	@python3.8 -m venv $(QEMU_MINVENV_DIR)
+	@python3.9 -m venv $(QEMU_MINVENV_DIR)
 	@(								\
 		echo "ACTIVATE $(QEMU_MINVENV_DIR)";			\
 		. $(QEMU_MINVENV_DIR)/bin/activate;			\
diff --git a/python/setup.cfg b/python/setup.cfg
index cf5af7e664..c48dff280a 100644
--- a/python/setup.cfg
+++ b/python/setup.cfg
@@ -14,7 +14,6 @@ classifiers =
     Natural Language :: English
     Operating System :: OS Independent
     Programming Language :: Python :: 3 :: Only
-    Programming Language :: Python :: 3.8
     Programming Language :: Python :: 3.9
     Programming Language :: Python :: 3.10
     Programming Language :: Python :: 3.11
@@ -23,7 +22,7 @@ classifiers =
     Typing :: Typed
 
 [options]
-python_requires = >= 3.8
+python_requires = >= 3.9
 packages =
     qemu.qmp
     qemu.machine
@@ -78,7 +77,7 @@ exclude = __pycache__,
 
 [mypy]
 strict = True
-python_version = 3.8
+python_version = 3.9
 warn_unused_configs = True
 namespace_packages = True
 warn_unused_ignores = False
@@ -186,7 +185,7 @@ multi_line_output=3
 # of python available on your system to run this test.
 
 [tox:tox]
-envlist = py38, py39, py310, py311, py312, py313
+envlist = py39, py310, py311, py312, py313
 skip_missing_interpreters = true
 
 [testenv]
diff --git a/python/tests/minreqs.txt b/python/tests/minreqs.txt
index a3f423efd8..6445407ba8 100644
--- a/python/tests/minreqs.txt
+++ b/python/tests/minreqs.txt
@@ -1,5 +1,5 @@
 # This file lists the ***oldest possible dependencies*** needed to run
-# "make check" successfully under ***Python 3.8***. It is used primarily
+# "make check" successfully under ***Python 3.9***. It is used primarily
 # by GitLab CI to ensure that our stated minimum versions in setup.cfg
 # are truthful and regularly validated.
 #
diff --git a/scripts/qapi/mypy.ini b/scripts/qapi/mypy.ini
index 8109470a03..c9dbcec2db 100644
--- a/scripts/qapi/mypy.ini
+++ b/scripts/qapi/mypy.ini
@@ -1,4 +1,4 @@
 [mypy]
 strict = True
 disallow_untyped_calls = False
-python_version = 3.8
+python_version = 3.9
diff --git a/tests/docker/dockerfiles/python.docker b/tests/docker/dockerfiles/python.docker
index 8f0af9ef25..59e70a0248 100644
--- a/tests/docker/dockerfiles/python.docker
+++ b/tests/docker/dockerfiles/python.docker
@@ -15,7 +15,6 @@ ENV PACKAGES \
     python3.11 \
     python3.12 \
     python3.13 \
-    python3.8 \
     python3.9
 
 RUN dnf install -y $PACKAGES

From bcfee4938f8d4e8bf5f49981d3c8a78cf267cb4e Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Thu, 24 Apr 2025 10:54:26 +0200
Subject: [PATCH 0525/2760] tests/functional/test_ppc64_pseries: Skip
 test_ppc64_linux_smt_boot if necessary

The test_ppc64_linux_smt_boot function lacks the set_machine('pseries'),
so this test is currently failing in case the 'pseries' machine has not
been compiled into the binary. Add the check now to fix it.

Message-ID: <20250424085426.663377-1-thuth@redhat.com>
Reviewed-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/functional/test_ppc64_pseries.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tests/functional/test_ppc64_pseries.py b/tests/functional/test_ppc64_pseries.py
index fdc404ed03..67057934e8 100755
--- a/tests/functional/test_ppc64_pseries.py
+++ b/tests/functional/test_ppc64_pseries.py
@@ -63,6 +63,7 @@ class pseriesMachine(QemuSystemTest):
         wait_for_console_pattern(self, self.good_message, self.panic_message)
 
     def test_ppc64_linux_smt_boot(self):
+        self.set_machine('pseries')
         self.vm.add_args('-smp', '4,threads=4')
         self.do_test_ppc64_linux_boot()
         console_pattern = 'CPU maps initialized for 4 threads per core'

From c6d82df70e0ad3477ea97e9dc99b97c2fbfa0c1a Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Tue, 25 Mar 2025 06:51:25 +0100
Subject: [PATCH 0526/2760] meson.build: Put the D-Bus summary into the UI
 section
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We've got a dedicated section for UI options nowadays, so the
D-Bus display should get reported here, too.

Message-ID: <20250325055125.253669-1-thuth@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 meson.build | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meson.build b/meson.build
index ccd6c71577..6c61e1dcae 100644
--- a/meson.build
+++ b/meson.build
@@ -4619,7 +4619,6 @@ summary_info += {'Trace backends':    ','.join(get_option('trace_backends'))}
 if 'simple' in get_option('trace_backends')
   summary_info += {'Trace output file': get_option('trace_file') + '-<pid>'}
 endif
-summary_info += {'D-Bus display':     dbus_display}
 summary_info += {'QOM debugging':     get_option('qom_cast_debug')}
 summary_info += {'Relocatable install': get_option('relocatable')}
 summary_info += {'vhost-kernel support': have_vhost_kernel}
@@ -4802,6 +4801,7 @@ summary_info = {}
 if host_os == 'darwin'
   summary_info += {'Cocoa support':           cocoa}
 endif
+summary_info += {'D-Bus display':     dbus_display}
 summary_info += {'SDL support':       sdl}
 summary_info += {'SDL image support': sdl_image}
 summary_info += {'GTK support':       gtk}

From 35817600089256a234eb23613564d94b80e93ac4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 15 Jan 2025 22:00:48 +0100
Subject: [PATCH 0527/2760] hw/rtc/mc146818rtc: Drop pre-v3 migration stream
 support
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

mc146818rtc's migration stream is at version 3 since commit
56038ef6234 ("RTC: Update the RTC clock only when reading it")
from 12 years ago, released in QEMU v1.3.0!
No versioned machines are that old, we can safely remove
support for older streams and the qdev_set_legacy_instance_id()
call.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Message-ID: <20250115210048.25396-1-philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 hw/rtc/mc146818rtc.c | 18 ++++++++----------
 1 file changed, 8 insertions(+), 10 deletions(-)

diff --git a/hw/rtc/mc146818rtc.c b/hw/rtc/mc146818rtc.c
index 6f787be7af..f9f5cf396f 100644
--- a/hw/rtc/mc146818rtc.c
+++ b/hw/rtc/mc146818rtc.c
@@ -819,7 +819,7 @@ static const VMStateDescription vmstate_rtc_irq_reinject_on_ack_count = {
 static const VMStateDescription vmstate_rtc = {
     .name = "mc146818rtc",
     .version_id = 3,
-    .minimum_version_id = 1,
+    .minimum_version_id = 3,
     .pre_save = rtc_pre_save,
     .post_load = rtc_post_load,
     .fields = (const VMStateField[]) {
@@ -829,13 +829,13 @@ static const VMStateDescription vmstate_rtc = {
         VMSTATE_TIMER_PTR(periodic_timer, MC146818RtcState),
         VMSTATE_INT64(next_periodic_time, MC146818RtcState),
         VMSTATE_UNUSED(3*8),
-        VMSTATE_UINT32_V(irq_coalesced, MC146818RtcState, 2),
-        VMSTATE_UINT32_V(period, MC146818RtcState, 2),
-        VMSTATE_UINT64_V(base_rtc, MC146818RtcState, 3),
-        VMSTATE_UINT64_V(last_update, MC146818RtcState, 3),
-        VMSTATE_INT64_V(offset, MC146818RtcState, 3),
-        VMSTATE_TIMER_PTR_V(update_timer, MC146818RtcState, 3),
-        VMSTATE_UINT64_V(next_alarm_time, MC146818RtcState, 3),
+        VMSTATE_UINT32(irq_coalesced, MC146818RtcState),
+        VMSTATE_UINT32(period, MC146818RtcState),
+        VMSTATE_UINT64(base_rtc, MC146818RtcState),
+        VMSTATE_UINT64(last_update, MC146818RtcState),
+        VMSTATE_INT64(offset, MC146818RtcState),
+        VMSTATE_TIMER_PTR(update_timer, MC146818RtcState),
+        VMSTATE_UINT64(next_alarm_time, MC146818RtcState),
         VMSTATE_END_OF_LIST()
     },
     .subsections = (const VMStateDescription * const []) {
@@ -929,8 +929,6 @@ static void rtc_realizefn(DeviceState *dev, Error **errp)
     memory_region_add_subregion(&s->io, 0, &s->coalesced_io);
     memory_region_add_coalescing(&s->coalesced_io, 0, 1);
 
-    qdev_set_legacy_instance_id(dev, s->io_base, 3);
-
     object_property_add_tm(OBJECT(s), "date", rtc_get_date);
 
     qdev_init_gpio_out(dev, &s->irq, 1);

From dce324fa06b358ccb01bf35611b6fc53b1f56b96 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Wed, 30 Apr 2025 11:10:47 -0700
Subject: [PATCH 0528/2760] docs/devel/build-environment: enhance MSYS2
 instructions

Add missing prerequisite packages, and use more explicit makepkg
command.

Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20250430181047.2043492-1-pierrick.bouvier@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 docs/devel/build-environment.rst | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/devel/build-environment.rst b/docs/devel/build-environment.rst
index f133ef2e01..661f6ea850 100644
--- a/docs/devel/build-environment.rst
+++ b/docs/devel/build-environment.rst
@@ -97,11 +97,11 @@ build QEMU in MSYS2 itself.
 
 ::
 
-    pacman -S wget
+    pacman -S wget base-devel git
     wget https://raw.githubusercontent.com/msys2/MINGW-packages/refs/heads/master/mingw-w64-qemu/PKGBUILD
     # Some packages may be missing for your environment, installation will still
     # be done though.
-    makepkg -s PKGBUILD || true
+    makepkg --syncdeps --nobuild PKGBUILD || true
 
 Build on windows-aarch64
 ++++++++++++++++++++++++

From 43625e35d9319821f6d51cbf2798991bca533b26 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 3 Apr 2025 16:59:29 -0700
Subject: [PATCH 0529/2760] accel/tcg: Add CPUState argument to page_unprotect
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In the next patch, page_unprotect will need to pass
the CPUState to tb_invalidate_phys_page_unwind.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/user-exec.c          | 8 +++++---
 include/user/page-protection.h | 2 +-
 linux-user/elfload.c           | 2 +-
 3 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index 5eef8e7f18..90b345a0cf 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -128,7 +128,7 @@ MMUAccessType adjust_signal_pc(uintptr_t *pc, bool is_write)
 bool handle_sigsegv_accerr_write(CPUState *cpu, sigset_t *old_set,
                                  uintptr_t host_pc, abi_ptr guest_addr)
 {
-    switch (page_unprotect(guest_addr, host_pc)) {
+    switch (page_unprotect(cpu, guest_addr, host_pc)) {
     case 0:
         /*
          * Fault not caused by a page marked unwritable to protect
@@ -584,7 +584,7 @@ bool page_check_range(target_ulong start, target_ulong len, int flags)
                 break;
             }
             /* Asking about writable, but has been protected: undo. */
-            if (!page_unprotect(start, 0)) {
+            if (!page_unprotect(NULL, start, 0)) {
                 ret = false;
                 break;
             }
@@ -704,11 +704,13 @@ void tb_lock_page0(tb_page_addr_t address)
  * immediately exited. (We can only return 2 if the 'pc' argument is
  * non-zero.)
  */
-int page_unprotect(tb_page_addr_t address, uintptr_t pc)
+int page_unprotect(CPUState *cpu, tb_page_addr_t address, uintptr_t pc)
 {
     PageFlagsNode *p;
     bool current_tb_invalidated;
 
+    assert((cpu == NULL) == (pc == 0));
+
     /*
      * Technically this isn't safe inside a signal handler.  However we
      * know this only ever happens in a synchronous SEGV handler, so in
diff --git a/include/user/page-protection.h b/include/user/page-protection.h
index d5c8748d49..1de72e31e6 100644
--- a/include/user/page-protection.h
+++ b/include/user/page-protection.h
@@ -16,7 +16,7 @@
 #include "exec/target_long.h"
 #include "exec/translation-block.h"
 
-int page_unprotect(tb_page_addr_t address, uintptr_t pc);
+int page_unprotect(CPUState *cpu, tb_page_addr_t address, uintptr_t pc);
 
 int page_get_flags(target_ulong address);
 
diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index fbfdec2f17..87c6d3ab9f 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -4260,7 +4260,7 @@ static int wmr_page_unprotect_regions(void *opaque, target_ulong start,
         size_t step = MAX(TARGET_PAGE_SIZE, qemu_real_host_page_size());
 
         while (1) {
-            page_unprotect(start, 0);
+            page_unprotect(NULL, start, 0);
             if (end - start <= step) {
                 break;
             }

From 00f708841f00d8b7046d03ef88045908f394b27d Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 3 Apr 2025 18:06:21 -0700
Subject: [PATCH 0530/2760] accel/tcg: Add CPUState argument to
 tb_invalidate_phys_page_unwind
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Replace existing usage of current_cpu.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/tb-internal.h | 3 ++-
 accel/tcg/tb-maint.c    | 8 ++++----
 accel/tcg/user-exec.c   | 5 +++--
 3 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/accel/tcg/tb-internal.h b/accel/tcg/tb-internal.h
index 08538e2896..1078de6c99 100644
--- a/accel/tcg/tb-internal.h
+++ b/accel/tcg/tb-internal.h
@@ -50,6 +50,7 @@ void tb_invalidate_phys_range_fast(ram_addr_t ram_addr,
                                    uintptr_t retaddr);
 #endif /* CONFIG_SOFTMMU */
 
-bool tb_invalidate_phys_page_unwind(tb_page_addr_t addr, uintptr_t pc);
+bool tb_invalidate_phys_page_unwind(CPUState *cpu, tb_page_addr_t addr,
+                                    uintptr_t pc);
 
 #endif
diff --git a/accel/tcg/tb-maint.c b/accel/tcg/tb-maint.c
index d479f53ae0..714dcaedc9 100644
--- a/accel/tcg/tb-maint.c
+++ b/accel/tcg/tb-maint.c
@@ -1045,7 +1045,8 @@ static void tb_invalidate_phys_page(tb_page_addr_t addr)
  * TB (because it was modified by this store and the guest CPU has
  * precise-SMC semantics).
  */
-bool tb_invalidate_phys_page_unwind(tb_page_addr_t addr, uintptr_t pc)
+bool tb_invalidate_phys_page_unwind(CPUState *cpu, tb_page_addr_t addr,
+                                    uintptr_t pc)
 {
     TranslationBlock *current_tb;
     bool current_tb_modified;
@@ -1083,15 +1084,14 @@ bool tb_invalidate_phys_page_unwind(tb_page_addr_t addr, uintptr_t pc)
              * the CPU state.
              */
             current_tb_modified = true;
-            cpu_restore_state_from_tb(current_cpu, current_tb, pc);
+            cpu_restore_state_from_tb(cpu, current_tb, pc);
         }
         tb_phys_invalidate__locked(tb);
     }
 
     if (current_tb_modified) {
         /* Force execution of one insn next time.  */
-        CPUState *cpu = current_cpu;
-        cpu->cflags_next_tb = 1 | CF_NOIRQ | curr_cflags(current_cpu);
+        cpu->cflags_next_tb = 1 | CF_NOIRQ | curr_cflags(cpu);
         return true;
     }
     return false;
diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index 90b345a0cf..39b76d9654 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -749,7 +749,8 @@ int page_unprotect(CPUState *cpu, tb_page_addr_t address, uintptr_t pc)
             len = TARGET_PAGE_SIZE;
             prot = p->flags | PAGE_WRITE;
             pageflags_set_clear(start, start + len - 1, PAGE_WRITE, 0);
-            current_tb_invalidated = tb_invalidate_phys_page_unwind(start, pc);
+            current_tb_invalidated =
+                tb_invalidate_phys_page_unwind(cpu, start, pc);
         } else {
             start = address & -host_page_size;
             len = host_page_size;
@@ -772,7 +773,7 @@ int page_unprotect(CPUState *cpu, tb_page_addr_t address, uintptr_t pc)
                  * the corresponding translated code.
                  */
                 current_tb_invalidated |=
-                    tb_invalidate_phys_page_unwind(addr, pc);
+                    tb_invalidate_phys_page_unwind(cpu, addr, pc);
             }
         }
         if (prot & PAGE_EXEC) {

From e4ad80ceac03cc47d8351172f0e4625bb40e2b78 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 23 Apr 2025 12:23:30 -0700
Subject: [PATCH 0531/2760] accel/tcg: Add CPUState arg to
 tb_invalidate_phys_page_range__locked
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/tb-maint.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/accel/tcg/tb-maint.c b/accel/tcg/tb-maint.c
index 714dcaedc9..927e9c8ede 100644
--- a/accel/tcg/tb-maint.c
+++ b/accel/tcg/tb-maint.c
@@ -1100,9 +1100,12 @@ bool tb_invalidate_phys_page_unwind(CPUState *cpu, tb_page_addr_t addr,
 /*
  * @p must be non-NULL.
  * Call with all @pages locked.
+ * (@cpu, @retaddr) may be (NULL, 0) outside of a cpu context,
+ * in which case precise_smc need not be detected.
  */
 static void
-tb_invalidate_phys_page_range__locked(struct page_collection *pages,
+tb_invalidate_phys_page_range__locked(CPUState *cpu,
+                                      struct page_collection *pages,
                                       PageDesc *p, tb_page_addr_t start,
                                       tb_page_addr_t last,
                                       uintptr_t retaddr)
@@ -1194,7 +1197,7 @@ void tb_invalidate_phys_range(tb_page_addr_t start, tb_page_addr_t last)
         page_start = index << TARGET_PAGE_BITS;
         page_last = page_start | ~TARGET_PAGE_MASK;
         page_last = MIN(page_last, last);
-        tb_invalidate_phys_page_range__locked(pages, pd,
+        tb_invalidate_phys_page_range__locked(NULL, pages, pd,
                                               page_start, page_last, 0);
     }
     page_collection_unlock(pages);
@@ -1215,7 +1218,7 @@ static void tb_invalidate_phys_page_fast__locked(struct page_collection *pages,
     }
 
     assert_page_locked(p);
-    tb_invalidate_phys_page_range__locked(pages, p, start, start + len - 1, ra);
+    tb_invalidate_phys_page_range__locked(NULL, pages, p, start, start + len - 1, ra);
 }
 
 /*

From 4af02681ff77bf105b11ee1a5ca289ca29b64a54 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 23 Apr 2025 12:37:28 -0700
Subject: [PATCH 0532/2760] accel/tcg: Merge tb_invalidate_phys_range{__locked}
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Merge tb_invalidate_phys_page_fast__locked into its
only caller, tb_invalidate_phys_range_fast.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/tb-maint.c | 36 +++++++++++-------------------------
 1 file changed, 11 insertions(+), 25 deletions(-)

diff --git a/accel/tcg/tb-maint.c b/accel/tcg/tb-maint.c
index 927e9c8ede..c893ea3073 100644
--- a/accel/tcg/tb-maint.c
+++ b/accel/tcg/tb-maint.c
@@ -1203,38 +1203,24 @@ void tb_invalidate_phys_range(tb_page_addr_t start, tb_page_addr_t last)
     page_collection_unlock(pages);
 }
 
-/*
- * Call with all @pages in the range [@start, @start + len[ locked.
- */
-static void tb_invalidate_phys_page_fast__locked(struct page_collection *pages,
-                                                 tb_page_addr_t start,
-                                                 unsigned len, uintptr_t ra)
-{
-    PageDesc *p;
-
-    p = page_find(start >> TARGET_PAGE_BITS);
-    if (!p) {
-        return;
-    }
-
-    assert_page_locked(p);
-    tb_invalidate_phys_page_range__locked(NULL, pages, p, start, start + len - 1, ra);
-}
-
 /*
  * len must be <= 8 and start must be a multiple of len.
  * Called via softmmu_template.h when code areas are written to with
  * iothread mutex not held.
  */
-void tb_invalidate_phys_range_fast(ram_addr_t ram_addr,
-                                   unsigned size,
-                                   uintptr_t retaddr)
+void tb_invalidate_phys_range_fast(ram_addr_t start,
+                                   unsigned len, uintptr_t ra)
 {
-    struct page_collection *pages;
+    PageDesc *p = page_find(start >> TARGET_PAGE_BITS);
 
-    pages = page_collection_lock(ram_addr, ram_addr + size - 1);
-    tb_invalidate_phys_page_fast__locked(pages, ram_addr, size, retaddr);
-    page_collection_unlock(pages);
+    if (p) {
+        ram_addr_t last = start + len - 1;
+        struct page_collection *pages = page_collection_lock(start, last);
+
+        tb_invalidate_phys_page_range__locked(NULL, pages, p,
+                                              start, last, ra);
+        page_collection_unlock(pages);
+    }
 }
 
 #endif /* CONFIG_USER_ONLY */

From 072e057ed90d6bbc4f01ac04e627e63f275f57f0 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 23 Apr 2025 13:06:12 -0700
Subject: [PATCH 0533/2760] accel/tcg: Add CPUState arg to
 tb_invalidate_phys_range
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/tb-maint.c      | 10 ++++++----
 accel/tcg/translate-all.c |  2 +-
 accel/tcg/user-exec.c     |  4 ++--
 include/exec/exec-all.h   |  3 ++-
 system/physmem.c          |  2 +-
 target/arm/helper.c       |  2 +-
 6 files changed, 13 insertions(+), 10 deletions(-)

diff --git a/accel/tcg/tb-maint.c b/accel/tcg/tb-maint.c
index c893ea3073..c7600fc6ac 100644
--- a/accel/tcg/tb-maint.c
+++ b/accel/tcg/tb-maint.c
@@ -1012,7 +1012,8 @@ TranslationBlock *tb_link_page(TranslationBlock *tb)
  * Called with mmap_lock held for user-mode emulation.
  * NOTE: this function must not be called while a TB is running.
  */
-void tb_invalidate_phys_range(tb_page_addr_t start, tb_page_addr_t last)
+void tb_invalidate_phys_range(CPUState *cpu, tb_page_addr_t start,
+                              tb_page_addr_t last)
 {
     TranslationBlock *tb;
     PageForEachNext n;
@@ -1035,7 +1036,7 @@ static void tb_invalidate_phys_page(tb_page_addr_t addr)
 
     start = addr & TARGET_PAGE_MASK;
     last = addr | ~TARGET_PAGE_MASK;
-    tb_invalidate_phys_range(start, last);
+    tb_invalidate_phys_range(NULL, start, last);
 }
 
 /*
@@ -1178,7 +1179,8 @@ tb_invalidate_phys_page_range__locked(CPUState *cpu,
  * access: the virtual CPU will exit the current TB if code is modified inside
  * this TB.
  */
-void tb_invalidate_phys_range(tb_page_addr_t start, tb_page_addr_t last)
+void tb_invalidate_phys_range(CPUState *cpu, tb_page_addr_t start,
+                              tb_page_addr_t last)
 {
     struct page_collection *pages;
     tb_page_addr_t index, index_last;
@@ -1197,7 +1199,7 @@ void tb_invalidate_phys_range(tb_page_addr_t start, tb_page_addr_t last)
         page_start = index << TARGET_PAGE_BITS;
         page_last = page_start | ~TARGET_PAGE_MASK;
         page_last = MIN(page_last, last);
-        tb_invalidate_phys_page_range__locked(NULL, pages, pd,
+        tb_invalidate_phys_page_range__locked(cpu, pages, pd,
                                               page_start, page_last, 0);
     }
     page_collection_unlock(pages);
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index c007b9a190..9bf8728064 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -599,7 +599,7 @@ void tb_check_watchpoint(CPUState *cpu, uintptr_t retaddr)
         cpu_get_tb_cpu_state(env, &pc, &cs_base, &flags);
         addr = get_page_addr_code(env, pc);
         if (addr != -1) {
-            tb_invalidate_phys_range(addr, addr);
+            tb_invalidate_phys_range(cpu, addr, addr);
         }
     }
 }
diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index 39b76d9654..2b12c077e9 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -529,7 +529,7 @@ void page_set_flags(target_ulong start, target_ulong last, int flags)
                                         ~(reset ? 0 : PAGE_STICKY));
     }
     if (inval_tb) {
-        tb_invalidate_phys_range(start, last);
+        tb_invalidate_phys_range(NULL, start, last);
     }
 }
 
@@ -1020,7 +1020,7 @@ int cpu_memory_rw_debug(CPUState *cpu, vaddr addr,
                  * be under mmap_lock() in order to prevent the creation of
                  * another TranslationBlock in between.
                  */
-                tb_invalidate_phys_range(addr, addr + l - 1);
+                tb_invalidate_phys_range(NULL, addr, addr + l - 1);
                 written = pwrite(fd, buf, l,
                                  (off_t)(uintptr_t)g2h_untagged(addr));
                 if (written != l) {
diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index 944b579d91..bee3416e7e 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -122,7 +122,8 @@ int probe_access_full_mmu(CPUArchState *env, vaddr addr, int size,
 
 /* TranslationBlock invalidate API */
 void tb_phys_invalidate(TranslationBlock *tb, tb_page_addr_t page_addr);
-void tb_invalidate_phys_range(tb_page_addr_t start, tb_page_addr_t last);
+void tb_invalidate_phys_range(CPUState *cpu, tb_page_addr_t start,
+                              tb_page_addr_t last);
 void tb_set_jmp_target(TranslationBlock *tb, int n, uintptr_t addr);
 
 #if !defined(CONFIG_USER_ONLY)
diff --git a/system/physmem.c b/system/physmem.c
index 16cf557d1a..637f2d8532 100644
--- a/system/physmem.c
+++ b/system/physmem.c
@@ -2830,7 +2830,7 @@ static void invalidate_and_set_dirty(MemoryRegion *mr, hwaddr addr,
     }
     if (dirty_log_mask & (1 << DIRTY_MEMORY_CODE)) {
         assert(tcg_enabled());
-        tb_invalidate_phys_range(addr, addr + length - 1);
+        tb_invalidate_phys_range(NULL, addr, addr + length - 1);
         dirty_log_mask &= ~(1 << DIRTY_MEMORY_CODE);
     }
     cpu_physical_memory_set_dirty_range(addr, length, dirty_log_mask);
diff --git a/target/arm/helper.c b/target/arm/helper.c
index 7fb6e88630..c6fd290012 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -4987,7 +4987,7 @@ static void ic_ivau_write(CPUARMState *env, const ARMCPRegInfo *ri,
 
     mmap_lock();
 
-    tb_invalidate_phys_range(start_address, end_address);
+    tb_invalidate_phys_range(env_cpu(env), start_address, end_address);
 
     mmap_unlock();
 }

From 7fa0f4a70c1550380b2a3ee1330f70ce6ee98072 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 23 Apr 2025 13:10:45 -0700
Subject: [PATCH 0534/2760] accel/tcg: Add CPUState arg to
 tb_invalidate_phys_range_fast
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c      | 2 +-
 accel/tcg/tb-internal.h | 5 ++---
 accel/tcg/tb-maint.c    | 4 ++--
 3 files changed, 5 insertions(+), 6 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index d9fb68d719..ed6de1e96e 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -1340,7 +1340,7 @@ static void notdirty_write(CPUState *cpu, vaddr mem_vaddr, unsigned size,
     trace_memory_notdirty_write_access(mem_vaddr, ram_addr, size);
 
     if (!cpu_physical_memory_get_dirty_flag(ram_addr, DIRTY_MEMORY_CODE)) {
-        tb_invalidate_phys_range_fast(ram_addr, size, retaddr);
+        tb_invalidate_phys_range_fast(cpu, ram_addr, size, retaddr);
     }
 
     /*
diff --git a/accel/tcg/tb-internal.h b/accel/tcg/tb-internal.h
index 1078de6c99..40439f03c3 100644
--- a/accel/tcg/tb-internal.h
+++ b/accel/tcg/tb-internal.h
@@ -45,9 +45,8 @@ void tb_unlock_pages(TranslationBlock *);
 #endif
 
 #ifdef CONFIG_SOFTMMU
-void tb_invalidate_phys_range_fast(ram_addr_t ram_addr,
-                                   unsigned size,
-                                   uintptr_t retaddr);
+void tb_invalidate_phys_range_fast(CPUState *cpu, ram_addr_t ram_addr,
+                                   unsigned size, uintptr_t retaddr);
 #endif /* CONFIG_SOFTMMU */
 
 bool tb_invalidate_phys_page_unwind(CPUState *cpu, tb_page_addr_t addr,
diff --git a/accel/tcg/tb-maint.c b/accel/tcg/tb-maint.c
index c7600fc6ac..3837f2f633 100644
--- a/accel/tcg/tb-maint.c
+++ b/accel/tcg/tb-maint.c
@@ -1210,7 +1210,7 @@ void tb_invalidate_phys_range(CPUState *cpu, tb_page_addr_t start,
  * Called via softmmu_template.h when code areas are written to with
  * iothread mutex not held.
  */
-void tb_invalidate_phys_range_fast(ram_addr_t start,
+void tb_invalidate_phys_range_fast(CPUState *cpu, ram_addr_t start,
                                    unsigned len, uintptr_t ra)
 {
     PageDesc *p = page_find(start >> TARGET_PAGE_BITS);
@@ -1219,7 +1219,7 @@ void tb_invalidate_phys_range_fast(ram_addr_t start,
         ram_addr_t last = start + len - 1;
         struct page_collection *pages = page_collection_lock(start, last);
 
-        tb_invalidate_phys_page_range__locked(NULL, pages, p,
+        tb_invalidate_phys_page_range__locked(cpu, pages, p,
                                               start, last, ra);
         page_collection_unlock(pages);
     }

From 77ad412b326031687f0eeb7935350e597337c93b Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 5 Apr 2025 08:43:44 -0700
Subject: [PATCH 0535/2760] accel/tcg: Convert TARGET_HAS_PRECISE_SMC to
 TCGCPUOps.precise_smc
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Instead of having a compile-time TARGET_HAS_PRECISE_SMC definition,
have each target set the 'precise_smc' field in the TCGCPUOps
structure.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/tb-maint.c        | 32 +++++++++++++-------------------
 accel/tcg/user-exec.c       | 10 +++++-----
 include/accel/tcg/cpu-ops.h |  7 +++++++
 include/exec/poison.h       |  1 -
 target/i386/cpu.h           |  4 ----
 target/i386/tcg/tcg-cpu.c   |  1 +
 target/s390x/cpu.c          |  1 +
 target/s390x/cpu.h          |  2 --
 8 files changed, 27 insertions(+), 31 deletions(-)

diff --git a/accel/tcg/tb-maint.c b/accel/tcg/tb-maint.c
index 3837f2f633..1596767879 100644
--- a/accel/tcg/tb-maint.c
+++ b/accel/tcg/tb-maint.c
@@ -28,6 +28,7 @@
 #include "exec/mmap-lock.h"
 #include "exec/tb-flush.h"
 #include "exec/target_page.h"
+#include "accel/tcg/cpu-ops.h"
 #include "tb-internal.h"
 #include "system/tcg.h"
 #include "tcg/tcg.h"
@@ -1042,9 +1043,7 @@ static void tb_invalidate_phys_page(tb_page_addr_t addr)
 /*
  * Called with mmap_lock held. If pc is not 0 then it indicates the
  * host PC of the faulting store instruction that caused this invalidate.
- * Returns true if the caller needs to abort execution of the current
- * TB (because it was modified by this store and the guest CPU has
- * precise-SMC semantics).
+ * Returns true if the caller needs to abort execution of the current TB.
  */
 bool tb_invalidate_phys_page_unwind(CPUState *cpu, tb_page_addr_t addr,
                                     uintptr_t pc)
@@ -1059,10 +1058,7 @@ bool tb_invalidate_phys_page_unwind(CPUState *cpu, tb_page_addr_t addr,
      * Without precise smc semantics, or when outside of a TB,
      * we can skip to invalidate.
      */
-#ifndef TARGET_HAS_PRECISE_SMC
-    pc = 0;
-#endif
-    if (!pc) {
+    if (!pc || !cpu || !cpu->cc->tcg_ops->precise_smc) {
         tb_invalidate_phys_page(addr);
         return false;
     }
@@ -1113,14 +1109,16 @@ tb_invalidate_phys_page_range__locked(CPUState *cpu,
 {
     TranslationBlock *tb;
     PageForEachNext n;
-#ifdef TARGET_HAS_PRECISE_SMC
     bool current_tb_modified = false;
-    TranslationBlock *current_tb = retaddr ? tcg_tb_lookup(retaddr) : NULL;
-#endif /* TARGET_HAS_PRECISE_SMC */
+    TranslationBlock *current_tb = NULL;
 
     /* Range may not cross a page. */
     tcg_debug_assert(((start ^ last) & TARGET_PAGE_MASK) == 0);
 
+    if (retaddr && cpu && cpu->cc->tcg_ops->precise_smc) {
+        current_tb = tcg_tb_lookup(retaddr);
+    }
+
     /*
      * We remove all the TBs in the range [start, last].
      * XXX: see if in some cases it could be faster to invalidate all the code
@@ -1138,8 +1136,7 @@ tb_invalidate_phys_page_range__locked(CPUState *cpu,
             tb_last = tb_start + (tb_last & ~TARGET_PAGE_MASK);
         }
         if (!(tb_last < start || tb_start > last)) {
-#ifdef TARGET_HAS_PRECISE_SMC
-            if (current_tb == tb &&
+            if (unlikely(current_tb == tb) &&
                 (tb_cflags(current_tb) & CF_COUNT_MASK) != 1) {
                 /*
                  * If we are modifying the current TB, we must stop
@@ -1149,9 +1146,8 @@ tb_invalidate_phys_page_range__locked(CPUState *cpu,
                  * restore the CPU state.
                  */
                 current_tb_modified = true;
-                cpu_restore_state_from_tb(current_cpu, current_tb, retaddr);
+                cpu_restore_state_from_tb(cpu, current_tb, retaddr);
             }
-#endif /* TARGET_HAS_PRECISE_SMC */
             tb_phys_invalidate__locked(tb);
         }
     }
@@ -1161,15 +1157,13 @@ tb_invalidate_phys_page_range__locked(CPUState *cpu,
         tlb_unprotect_code(start);
     }
 
-#ifdef TARGET_HAS_PRECISE_SMC
-    if (current_tb_modified) {
+    if (unlikely(current_tb_modified)) {
         page_collection_unlock(pages);
         /* Force execution of one insn next time.  */
-        current_cpu->cflags_next_tb = 1 | CF_NOIRQ | curr_cflags(current_cpu);
+        cpu->cflags_next_tb = 1 | CF_NOIRQ | curr_cflags(cpu);
         mmap_unlock();
-        cpu_loop_exit_noexc(current_cpu);
+        cpu_loop_exit_noexc(cpu);
     }
-#endif
 }
 
 /*
diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index 2b12c077e9..112292b729 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -733,12 +733,12 @@ int page_unprotect(CPUState *cpu, tb_page_addr_t address, uintptr_t pc)
          * this thread raced with another one which got here first and
          * set the page to PAGE_WRITE and did the TB invalidate for us.
          */
-#ifdef TARGET_HAS_PRECISE_SMC
-        TranslationBlock *current_tb = tcg_tb_lookup(pc);
-        if (current_tb) {
-            current_tb_invalidated = tb_cflags(current_tb) & CF_INVALID;
+        if (pc && cpu->cc->tcg_ops->precise_smc) {
+            TranslationBlock *current_tb = tcg_tb_lookup(pc);
+            if (current_tb) {
+                current_tb_invalidated = tb_cflags(current_tb) & CF_INVALID;
+            }
         }
-#endif
     } else {
         int host_page_size = qemu_real_host_page_size();
         target_ulong start, len, i;
diff --git a/include/accel/tcg/cpu-ops.h b/include/accel/tcg/cpu-ops.h
index 0e4352513d..60b5e97205 100644
--- a/include/accel/tcg/cpu-ops.h
+++ b/include/accel/tcg/cpu-ops.h
@@ -28,6 +28,13 @@ struct TCGCPUOps {
      */
     bool mttcg_supported;
 
+    /**
+     * @precise_smc: Stores which modify code within the current TB force
+     *               the TB to exit; the next executed instruction will see
+     *               the result of the store.
+     */
+    bool precise_smc;
+
     /**
      * @guest_default_memory_order: default barrier that is required
      *                              for the guest memory ordering.
diff --git a/include/exec/poison.h b/include/exec/poison.h
index bc422719d8..a779adbb7a 100644
--- a/include/exec/poison.h
+++ b/include/exec/poison.h
@@ -37,7 +37,6 @@
 #pragma GCC poison TARGET_NAME
 #pragma GCC poison TARGET_BIG_ENDIAN
 #pragma GCC poison TCG_GUEST_DEFAULT_MO
-#pragma GCC poison TARGET_HAS_PRECISE_SMC
 
 #pragma GCC poison TARGET_LONG_BITS
 #pragma GCC poison TARGET_FMT_lx
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index 54bf9639f1..3182ba413b 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -35,10 +35,6 @@
 
 #define XEN_NR_VIRQS 24
 
-/* support for self modifying code even if the modified instruction is
-   close to the modifying instruction */
-#define TARGET_HAS_PRECISE_SMC
-
 #ifdef TARGET_X86_64
 #define I386_ELF_MACHINE  EM_X86_64
 #define ELF_MACHINE_UNAME "x86_64"
diff --git a/target/i386/tcg/tcg-cpu.c b/target/i386/tcg/tcg-cpu.c
index e53aaa31bf..192812656c 100644
--- a/target/i386/tcg/tcg-cpu.c
+++ b/target/i386/tcg/tcg-cpu.c
@@ -126,6 +126,7 @@ static bool x86_debug_check_breakpoint(CPUState *cs)
 
 const TCGCPUOps x86_tcg_ops = {
     .mttcg_supported = true,
+    .precise_smc = true,
     /*
      * The x86 has a strong memory model with some store-after-load re-ordering
      */
diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
index 3d644f5e23..99ff58affc 100644
--- a/target/s390x/cpu.c
+++ b/target/s390x/cpu.c
@@ -346,6 +346,7 @@ void cpu_get_tb_cpu_state(CPUS390XState *env, vaddr *pc,
 
 static const TCGCPUOps s390_tcg_ops = {
     .mttcg_supported = true,
+    .precise_smc = true,
     /*
      * The z/Architecture has a strong memory model with some
      * store-after-load re-ordering.
diff --git a/target/s390x/cpu.h b/target/s390x/cpu.h
index d9ca2506e2..530d97ccf1 100644
--- a/target/s390x/cpu.h
+++ b/target/s390x/cpu.h
@@ -35,8 +35,6 @@
 
 #define ELF_MACHINE_UNAME "S390X"
 
-#define TARGET_HAS_PRECISE_SMC
-
 #define MMU_USER_IDX 0
 
 #define S390_MAX_CPUS 248

From 80e865668d953c012723c3af9fd1ff7258cef864 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 2 Apr 2025 08:40:31 -0700
Subject: [PATCH 0536/2760] accel/tcg: Simplify CPU_TLB_DYN_MAX_BITS

Stop taking TARGET_VIRT_ADDR_SPACE_BITS into account.

Since we currently bound CPU_TLB_DYN_MAX_BITS to 22,
the new bound with a 4k page size is 20, which isn't
so different.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/tlb-bounds.h | 21 +--------------------
 1 file changed, 1 insertion(+), 20 deletions(-)

diff --git a/accel/tcg/tlb-bounds.h b/accel/tcg/tlb-bounds.h
index efd34d4793..f83d9ac9ee 100644
--- a/accel/tcg/tlb-bounds.h
+++ b/accel/tcg/tlb-bounds.h
@@ -7,26 +7,7 @@
 #define ACCEL_TCG_TLB_BOUNDS_H
 
 #define CPU_TLB_DYN_MIN_BITS 6
+#define CPU_TLB_DYN_MAX_BITS (32 - TARGET_PAGE_BITS)
 #define CPU_TLB_DYN_DEFAULT_BITS 8
 
-# if HOST_LONG_BITS == 32
-/* Make sure we do not require a double-word shift for the TLB load */
-#  define CPU_TLB_DYN_MAX_BITS (32 - TARGET_PAGE_BITS)
-# else /* HOST_LONG_BITS == 64 */
-/*
- * Assuming TARGET_PAGE_BITS==12, with 2**22 entries we can cover 2**(22+12) ==
- * 2**34 == 16G of address space. This is roughly what one would expect a
- * TLB to cover in a modern (as of 2018) x86_64 CPU. For instance, Intel
- * Skylake's Level-2 STLB has 16 1G entries.
- * Also, make sure we do not size the TLB past the guest's address space.
- */
-#  ifdef TARGET_PAGE_BITS_VARY
-#   define CPU_TLB_DYN_MAX_BITS                                  \
-    MIN(22, TARGET_VIRT_ADDR_SPACE_BITS - TARGET_PAGE_BITS)
-#  else
-#   define CPU_TLB_DYN_MAX_BITS                                  \
-    MIN_CONST(22, TARGET_VIRT_ADDR_SPACE_BITS - TARGET_PAGE_BITS)
-#  endif
-# endif
-
 #endif /* ACCEL_TCG_TLB_BOUNDS_H */

From 2e8fe327eb67f90822a3e8a8fb6c914dd573f299 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 2 Apr 2025 12:30:39 -0700
Subject: [PATCH 0537/2760] accel/tcg: Simplify L1_MAP_ADDR_SPACE_BITS

Stop taking TARGET_PHYS_ADDR_SPACE_BITS into account.
Simply allow the entire ram_addr_t space.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/tb-maint.c | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/accel/tcg/tb-maint.c b/accel/tcg/tb-maint.c
index 1596767879..13d0376bc7 100644
--- a/accel/tcg/tb-maint.c
+++ b/accel/tcg/tb-maint.c
@@ -160,11 +160,7 @@ static PageForEachNext foreach_tb_next(PageForEachNext tb,
 /*
  * In system mode we want L1_MAP to be based on ram offsets.
  */
-#if HOST_LONG_BITS < TARGET_PHYS_ADDR_SPACE_BITS
-# define L1_MAP_ADDR_SPACE_BITS  HOST_LONG_BITS
-#else
-# define L1_MAP_ADDR_SPACE_BITS  TARGET_PHYS_ADDR_SPACE_BITS
-#endif
+#define L1_MAP_ADDR_SPACE_BITS  HOST_LONG_BITS
 
 /* Size of the L2 (and L3, etc) page tables.  */
 #define V_L2_BITS 10

From dfda9281266d57899dc03fc613a25587babd67aa Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 5 Apr 2025 09:36:27 -0700
Subject: [PATCH 0538/2760] accel/tcg: Merge internal-target.h into
 internal-common.h
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

There's nothing left in internal-target.h that is
target specific.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cpu-exec.c        |  1 -
 accel/tcg/cputlb.c          |  1 -
 accel/tcg/internal-common.h | 29 +++++++++++++++++++++++
 accel/tcg/internal-target.h | 46 -------------------------------------
 accel/tcg/tb-maint.c        |  1 -
 accel/tcg/translate-all.c   |  1 -
 accel/tcg/user-exec.c       |  1 -
 7 files changed, 29 insertions(+), 51 deletions(-)
 delete mode 100644 accel/tcg/internal-target.h

diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index 87eba83d7d..279df5fae7 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -46,7 +46,6 @@
 #include "tb-context.h"
 #include "tb-internal.h"
 #include "internal-common.h"
-#include "internal-target.h"
 
 /* -icount align implementation. */
 
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index ed6de1e96e..ca69128232 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -43,7 +43,6 @@
 #include "tb-internal.h"
 #include "tlb-bounds.h"
 #include "internal-common.h"
-#include "internal-target.h"
 #ifdef CONFIG_PLUGIN
 #include "qemu/plugin-memory.h"
 #endif
diff --git a/accel/tcg/internal-common.h b/accel/tcg/internal-common.h
index 2f00560d10..573e8438c3 100644
--- a/accel/tcg/internal-common.h
+++ b/accel/tcg/internal-common.h
@@ -11,6 +11,7 @@
 
 #include "exec/cpu-common.h"
 #include "exec/translation-block.h"
+#include "exec/mmap-lock.h"
 
 extern int64_t max_delay;
 extern int64_t max_advance;
@@ -108,4 +109,32 @@ static inline tb_page_addr_t get_page_addr_code(CPUArchState *env,
     return get_page_addr_code_hostp(env, addr, NULL);
 }
 
+/*
+ * Access to the various translations structures need to be serialised
+ * via locks for consistency.  In user-mode emulation access to the
+ * memory related structures are protected with mmap_lock.
+ * In !user-mode we use per-page locks.
+ */
+#ifdef CONFIG_USER_ONLY
+#define assert_memory_lock() tcg_debug_assert(have_mmap_lock())
+#else
+#define assert_memory_lock()
+#endif
+
+#if defined(CONFIG_SOFTMMU) && defined(CONFIG_DEBUG_TCG)
+void assert_no_pages_locked(void);
+#else
+static inline void assert_no_pages_locked(void) { }
+#endif
+
+#ifdef CONFIG_USER_ONLY
+static inline void page_table_config_init(void) { }
+#else
+void page_table_config_init(void);
+#endif
+
+#ifndef CONFIG_USER_ONLY
+G_NORETURN void cpu_io_recompile(CPUState *cpu, uintptr_t retaddr);
+#endif /* CONFIG_USER_ONLY */
+
 #endif
diff --git a/accel/tcg/internal-target.h b/accel/tcg/internal-target.h
deleted file mode 100644
index 9a9cef3140..0000000000
--- a/accel/tcg/internal-target.h
+++ /dev/null
@@ -1,46 +0,0 @@
-/*
- * Internal execution defines for qemu (target specific)
- *
- *  Copyright (c) 2003 Fabrice Bellard
- *
- * SPDX-License-Identifier: LGPL-2.1-or-later
- */
-
-#ifndef ACCEL_TCG_INTERNAL_TARGET_H
-#define ACCEL_TCG_INTERNAL_TARGET_H
-
-#include "cpu-param.h"
-#include "exec/exec-all.h"
-#include "exec/translation-block.h"
-#include "tb-internal.h"
-#include "exec/mmap-lock.h"
-
-/*
- * Access to the various translations structures need to be serialised
- * via locks for consistency.  In user-mode emulation access to the
- * memory related structures are protected with mmap_lock.
- * In !user-mode we use per-page locks.
- */
-#ifdef CONFIG_USER_ONLY
-#define assert_memory_lock() tcg_debug_assert(have_mmap_lock())
-#else
-#define assert_memory_lock()
-#endif
-
-#if defined(CONFIG_SOFTMMU) && defined(CONFIG_DEBUG_TCG)
-void assert_no_pages_locked(void);
-#else
-static inline void assert_no_pages_locked(void) { }
-#endif
-
-#ifdef CONFIG_USER_ONLY
-static inline void page_table_config_init(void) { }
-#else
-void page_table_config_init(void);
-#endif
-
-#ifndef CONFIG_USER_ONLY
-G_NORETURN void cpu_io_recompile(CPUState *cpu, uintptr_t retaddr);
-#endif /* CONFIG_USER_ONLY */
-
-#endif /* ACCEL_TCG_INTERNAL_H */
diff --git a/accel/tcg/tb-maint.c b/accel/tcg/tb-maint.c
index 13d0376bc7..b144fcd4a0 100644
--- a/accel/tcg/tb-maint.c
+++ b/accel/tcg/tb-maint.c
@@ -36,7 +36,6 @@
 #include "tb-context.h"
 #include "tb-internal.h"
 #include "internal-common.h"
-#include "internal-target.h"
 #ifdef CONFIG_USER_ONLY
 #include "user/page-protection.h"
 #endif
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index 9bf8728064..38819a507b 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -66,7 +66,6 @@
 #include "tb-context.h"
 #include "tb-internal.h"
 #include "internal-common.h"
-#include "internal-target.h"
 #include "tcg/perf.h"
 #include "tcg/insn-start-words.h"
 #include "cpu.h"
diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index 112292b729..17e3be337f 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -39,7 +39,6 @@
 #include "tcg/tcg-ldst.h"
 #include "backend-ldst.h"
 #include "internal-common.h"
-#include "internal-target.h"
 #include "tb-internal.h"
 
 __thread uintptr_t helper_retaddr;

From 54bd0b135e53d3afe666c5c960d7b2a0c1767bf4 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 5 Apr 2025 09:45:48 -0700
Subject: [PATCH 0539/2760] accel/tcg: Reduce scope of tb_phys_invalidate,
 tb_set_jmp_target
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Move the declarations of these functions out of exec/exec-all.h
to accel/tcg/internal-common.h.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/internal-common.h | 3 +++
 include/exec/exec-all.h     | 2 --
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/accel/tcg/internal-common.h b/accel/tcg/internal-common.h
index 573e8438c3..98c702422f 100644
--- a/accel/tcg/internal-common.h
+++ b/accel/tcg/internal-common.h
@@ -137,4 +137,7 @@ void page_table_config_init(void);
 G_NORETURN void cpu_io_recompile(CPUState *cpu, uintptr_t retaddr);
 #endif /* CONFIG_USER_ONLY */
 
+void tb_phys_invalidate(TranslationBlock *tb, tb_page_addr_t page_addr);
+void tb_set_jmp_target(TranslationBlock *tb, int n, uintptr_t addr);
+
 #endif
diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index bee3416e7e..24383b6aba 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -121,10 +121,8 @@ int probe_access_full_mmu(CPUArchState *env, vaddr addr, int size,
 #endif /* CONFIG_TCG */
 
 /* TranslationBlock invalidate API */
-void tb_phys_invalidate(TranslationBlock *tb, tb_page_addr_t page_addr);
 void tb_invalidate_phys_range(CPUState *cpu, tb_page_addr_t start,
                               tb_page_addr_t last);
-void tb_set_jmp_target(TranslationBlock *tb, int n, uintptr_t addr);
 
 #if !defined(CONFIG_USER_ONLY)
 

From e1c8eb8cfec059e882066403819288d036fbbe8e Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 24 Apr 2025 22:24:00 +0200
Subject: [PATCH 0540/2760] accel/tcg: Use vaddr for walk_memory_regions
 callback
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Use vaddr instead of target_ulong.  At the same time,
use int instead of unsigned long for flags, to match
page_set_flags().

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/user-exec.c          | 10 +++++-----
 include/user/page-protection.h |  5 ++---
 linux-user/elfload.c           | 19 +++++++++----------
 linux-user/syscall.c           |  8 ++++----
 4 files changed, 20 insertions(+), 22 deletions(-)

diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index 17e3be337f..25d86567e7 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -199,13 +199,13 @@ int walk_memory_regions(void *priv, walk_memory_regions_fn fn)
     return rc;
 }
 
-static int dump_region(void *priv, target_ulong start,
-                       target_ulong end, unsigned long prot)
+static int dump_region(void *opaque, vaddr start, vaddr end, int prot)
 {
-    FILE *f = (FILE *)priv;
+    FILE *f = opaque;
 
-    fprintf(f, TARGET_FMT_lx"-"TARGET_FMT_lx" "TARGET_FMT_lx" %c%c%c\n",
-            start, end, end - start,
+    fprintf(f, TARGET_ABI_FMT_ptr "-" TARGET_ABI_FMT_ptr
+            " " TARGET_ABI_FMT_ptr " %c%c%c\n",
+            (abi_ptr)start, (abi_ptr)end, (abi_ptr)(end - start),
             ((prot & PAGE_READ) ? 'r' : '-'),
             ((prot & PAGE_WRITE) ? 'w' : '-'),
             ((prot & PAGE_EXEC) ? 'x' : '-'));
diff --git a/include/user/page-protection.h b/include/user/page-protection.h
index 1de72e31e6..8f0b769b13 100644
--- a/include/user/page-protection.h
+++ b/include/user/page-protection.h
@@ -14,6 +14,7 @@
 
 #include "cpu-param.h"
 #include "exec/target_long.h"
+#include "exec/vaddr.h"
 #include "exec/translation-block.h"
 
 int page_unprotect(CPUState *cpu, tb_page_addr_t address, uintptr_t pc);
@@ -88,9 +89,7 @@ target_ulong page_find_range_empty(target_ulong min, target_ulong max,
 __attribute__((returns_nonnull))
 void *page_get_target_data(target_ulong address);
 
-typedef int (*walk_memory_regions_fn)(void *, target_ulong,
-                                      target_ulong, unsigned long);
-
+typedef int (*walk_memory_regions_fn)(void *, vaddr, vaddr, int);
 int walk_memory_regions(void *, walk_memory_regions_fn);
 
 void page_dump(FILE *f);
diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 87c6d3ab9f..82ebf6a212 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -4059,8 +4059,7 @@ static void bswap_note(struct elf_note *en)
 /*
  * Calculate file (dump) size of given memory region.
  */
-static size_t vma_dump_size(target_ulong start, target_ulong end,
-                            unsigned long flags)
+static size_t vma_dump_size(vaddr start, vaddr end, int flags)
 {
     /* The area must be readable. */
     if (!(flags & PAGE_READ)) {
@@ -4253,8 +4252,8 @@ static int dump_write(int fd, const void *ptr, size_t size)
     return (0);
 }
 
-static int wmr_page_unprotect_regions(void *opaque, target_ulong start,
-                                      target_ulong end, unsigned long flags)
+static int wmr_page_unprotect_regions(void *opaque, vaddr start,
+                                      vaddr end, int flags)
 {
     if ((flags & (PAGE_WRITE | PAGE_WRITE_ORG)) == PAGE_WRITE_ORG) {
         size_t step = MAX(TARGET_PAGE_SIZE, qemu_real_host_page_size());
@@ -4275,8 +4274,8 @@ typedef struct {
     size_t size;
 } CountAndSizeRegions;
 
-static int wmr_count_and_size_regions(void *opaque, target_ulong start,
-                                      target_ulong end, unsigned long flags)
+static int wmr_count_and_size_regions(void *opaque, vaddr start,
+                                      vaddr end, int flags)
 {
     CountAndSizeRegions *css = opaque;
 
@@ -4290,8 +4289,8 @@ typedef struct {
     off_t offset;
 } FillRegionPhdr;
 
-static int wmr_fill_region_phdr(void *opaque, target_ulong start,
-                                target_ulong end, unsigned long flags)
+static int wmr_fill_region_phdr(void *opaque, vaddr start,
+                                vaddr end, int flags)
 {
     FillRegionPhdr *d = opaque;
     struct elf_phdr *phdr = d->phdr;
@@ -4313,8 +4312,8 @@ static int wmr_fill_region_phdr(void *opaque, target_ulong start,
     return 0;
 }
 
-static int wmr_write_region(void *opaque, target_ulong start,
-                            target_ulong end, unsigned long flags)
+static int wmr_write_region(void *opaque, vaddr start,
+                            vaddr end, int flags)
 {
     int fd = *(int *)opaque;
     size_t size = vma_dump_size(start, end, flags);
diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 5826ac3adb..23b901b713 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -8135,8 +8135,8 @@ static void open_self_maps_4(const struct open_self_maps_data *d,
  * Callback for walk_memory_regions, when read_self_maps() fails.
  * Proceed without the benefit of host /proc/self/maps cross-check.
  */
-static int open_self_maps_3(void *opaque, target_ulong guest_start,
-                            target_ulong guest_end, unsigned long flags)
+static int open_self_maps_3(void *opaque, vaddr guest_start,
+                            vaddr guest_end, int flags)
 {
     static const MapInfo mi = { .is_priv = true };
 
@@ -8147,8 +8147,8 @@ static int open_self_maps_3(void *opaque, target_ulong guest_start,
 /*
  * Callback for walk_memory_regions, when read_self_maps() succeeds.
  */
-static int open_self_maps_2(void *opaque, target_ulong guest_start,
-                            target_ulong guest_end, unsigned long flags)
+static int open_self_maps_2(void *opaque, vaddr guest_start,
+                            vaddr guest_end, int flags)
 {
     const struct open_self_maps_data *d = opaque;
     uintptr_t host_start = (uintptr_t)g2h_untagged(guest_start);

From 5627d5c00a256cc180b659f7c21383e36934a80c Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 24 Apr 2025 22:24:01 +0200
Subject: [PATCH 0541/2760] accel/tcg: Use vaddr in user/page-protection.h
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Anton Johansson <anjo@rev.ng>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/user-exec.c          | 51 ++++++++++++++++------------------
 include/user/page-protection.h | 17 +++++-------
 2 files changed, 31 insertions(+), 37 deletions(-)

diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index 25d86567e7..43d005e24e 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -161,7 +161,7 @@ typedef struct PageFlagsNode {
 
 static IntervalTreeRoot pageflags_root;
 
-static PageFlagsNode *pageflags_find(target_ulong start, target_ulong last)
+static PageFlagsNode *pageflags_find(vaddr start, vaddr last)
 {
     IntervalTreeNode *n;
 
@@ -169,8 +169,7 @@ static PageFlagsNode *pageflags_find(target_ulong start, target_ulong last)
     return n ? container_of(n, PageFlagsNode, itree) : NULL;
 }
 
-static PageFlagsNode *pageflags_next(PageFlagsNode *p, target_ulong start,
-                                     target_ulong last)
+static PageFlagsNode *pageflags_next(PageFlagsNode *p, vaddr start, vaddr last)
 {
     IntervalTreeNode *n;
 
@@ -215,14 +214,14 @@ static int dump_region(void *opaque, vaddr start, vaddr end, int prot)
 /* dump memory mappings */
 void page_dump(FILE *f)
 {
-    const int length = sizeof(target_ulong) * 2;
+    const int length = sizeof(abi_ptr) * 2;
 
     fprintf(f, "%-*s %-*s %-*s %s\n",
             length, "start", length, "end", length, "size", "prot");
     walk_memory_regions(f, dump_region);
 }
 
-int page_get_flags(target_ulong address)
+int page_get_flags(vaddr address)
 {
     PageFlagsNode *p = pageflags_find(address, address);
 
@@ -245,7 +244,7 @@ int page_get_flags(target_ulong address)
 }
 
 /* A subroutine of page_set_flags: insert a new node for [start,last]. */
-static void pageflags_create(target_ulong start, target_ulong last, int flags)
+static void pageflags_create(vaddr start, vaddr last, int flags)
 {
     PageFlagsNode *p = g_new(PageFlagsNode, 1);
 
@@ -256,13 +255,13 @@ static void pageflags_create(target_ulong start, target_ulong last, int flags)
 }
 
 /* A subroutine of page_set_flags: remove everything in [start,last]. */
-static bool pageflags_unset(target_ulong start, target_ulong last)
+static bool pageflags_unset(vaddr start, vaddr last)
 {
     bool inval_tb = false;
 
     while (true) {
         PageFlagsNode *p = pageflags_find(start, last);
-        target_ulong p_last;
+        vaddr p_last;
 
         if (!p) {
             break;
@@ -301,8 +300,7 @@ static bool pageflags_unset(target_ulong start, target_ulong last)
  * A subroutine of page_set_flags: nothing overlaps [start,last],
  * but check adjacent mappings and maybe merge into a single range.
  */
-static void pageflags_create_merge(target_ulong start, target_ulong last,
-                                   int flags)
+static void pageflags_create_merge(vaddr start, vaddr last, int flags)
 {
     PageFlagsNode *next = NULL, *prev = NULL;
 
@@ -353,11 +351,11 @@ static void pageflags_create_merge(target_ulong start, target_ulong last,
 #define PAGE_STICKY  (PAGE_ANON | PAGE_PASSTHROUGH | PAGE_TARGET_STICKY)
 
 /* A subroutine of page_set_flags: add flags to [start,last]. */
-static bool pageflags_set_clear(target_ulong start, target_ulong last,
+static bool pageflags_set_clear(vaddr start, vaddr last,
                                 int set_flags, int clear_flags)
 {
     PageFlagsNode *p;
-    target_ulong p_start, p_last;
+    vaddr p_start, p_last;
     int p_flags, merge_flags;
     bool inval_tb = false;
 
@@ -492,7 +490,7 @@ static bool pageflags_set_clear(target_ulong start, target_ulong last,
     return inval_tb;
 }
 
-void page_set_flags(target_ulong start, target_ulong last, int flags)
+void page_set_flags(vaddr start, vaddr last, int flags)
 {
     bool reset = false;
     bool inval_tb = false;
@@ -532,9 +530,9 @@ void page_set_flags(target_ulong start, target_ulong last, int flags)
     }
 }
 
-bool page_check_range(target_ulong start, target_ulong len, int flags)
+bool page_check_range(vaddr start, vaddr len, int flags)
 {
-    target_ulong last;
+    vaddr last;
     int locked;  /* tri-state: =0: unlocked, +1: global, -1: local */
     bool ret;
 
@@ -610,17 +608,16 @@ bool page_check_range(target_ulong start, target_ulong len, int flags)
     return ret;
 }
 
-bool page_check_range_empty(target_ulong start, target_ulong last)
+bool page_check_range_empty(vaddr start, vaddr last)
 {
     assert(last >= start);
     assert_memory_lock();
     return pageflags_find(start, last) == NULL;
 }
 
-target_ulong page_find_range_empty(target_ulong min, target_ulong max,
-                                   target_ulong len, target_ulong align)
+vaddr page_find_range_empty(vaddr min, vaddr max, vaddr len, vaddr align)
 {
-    target_ulong len_m1, align_m1;
+    vaddr len_m1, align_m1;
 
     assert(min <= max);
     assert(max <= GUEST_ADDR_MAX);
@@ -661,7 +658,7 @@ target_ulong page_find_range_empty(target_ulong min, target_ulong max,
 void tb_lock_page0(tb_page_addr_t address)
 {
     PageFlagsNode *p;
-    target_ulong start, last;
+    vaddr start, last;
     int host_page_size = qemu_real_host_page_size();
     int prot;
 
@@ -740,7 +737,7 @@ int page_unprotect(CPUState *cpu, tb_page_addr_t address, uintptr_t pc)
         }
     } else {
         int host_page_size = qemu_real_host_page_size();
-        target_ulong start, len, i;
+        vaddr start, len, i;
         int prot;
 
         if (host_page_size <= TARGET_PAGE_SIZE) {
@@ -756,7 +753,7 @@ int page_unprotect(CPUState *cpu, tb_page_addr_t address, uintptr_t pc)
             prot = 0;
 
             for (i = 0; i < len; i += TARGET_PAGE_SIZE) {
-                target_ulong addr = start + i;
+                vaddr addr = start + i;
 
                 p = pageflags_find(addr, addr);
                 if (p) {
@@ -883,7 +880,7 @@ typedef struct TargetPageDataNode {
 
 static IntervalTreeRoot targetdata_root;
 
-void page_reset_target_data(target_ulong start, target_ulong last)
+void page_reset_target_data(vaddr start, vaddr last)
 {
     IntervalTreeNode *n, *next;
 
@@ -897,7 +894,7 @@ void page_reset_target_data(target_ulong start, target_ulong last)
          n != NULL;
          n = next,
          next = next ? interval_tree_iter_next(n, start, last) : NULL) {
-        target_ulong n_start, n_last, p_ofs, p_len;
+        vaddr n_start, n_last, p_ofs, p_len;
         TargetPageDataNode *t = container_of(n, TargetPageDataNode, itree);
 
         if (n->start >= start && n->last <= last) {
@@ -921,11 +918,11 @@ void page_reset_target_data(target_ulong start, target_ulong last)
     }
 }
 
-void *page_get_target_data(target_ulong address)
+void *page_get_target_data(vaddr address)
 {
     IntervalTreeNode *n;
     TargetPageDataNode *t;
-    target_ulong page, region, p_ofs;
+    vaddr page, region, p_ofs;
 
     page = address & TARGET_PAGE_MASK;
     region = address & TBD_MASK;
@@ -956,7 +953,7 @@ void *page_get_target_data(target_ulong address)
     return t->data + p_ofs * TARGET_PAGE_DATA_SIZE;
 }
 #else
-void page_reset_target_data(target_ulong start, target_ulong last) { }
+void page_reset_target_data(vaddr start, vaddr last) { }
 #endif /* TARGET_PAGE_DATA_SIZE */
 
 /* The system-mode versions of these helpers are in cputlb.c.  */
diff --git a/include/user/page-protection.h b/include/user/page-protection.h
index 8f0b769b13..86143212fd 100644
--- a/include/user/page-protection.h
+++ b/include/user/page-protection.h
@@ -12,14 +12,12 @@
 #error Cannot include this header from system emulation
 #endif
 
-#include "cpu-param.h"
-#include "exec/target_long.h"
 #include "exec/vaddr.h"
 #include "exec/translation-block.h"
 
 int page_unprotect(CPUState *cpu, tb_page_addr_t address, uintptr_t pc);
 
-int page_get_flags(target_ulong address);
+int page_get_flags(vaddr address);
 
 /**
  * page_set_flags:
@@ -32,9 +30,9 @@ int page_get_flags(target_ulong address);
  * The flag PAGE_WRITE_ORG is positioned automatically depending
  * on PAGE_WRITE.  The mmap_lock should already be held.
  */
-void page_set_flags(target_ulong start, target_ulong last, int flags);
+void page_set_flags(vaddr start, vaddr last, int flags);
 
-void page_reset_target_data(target_ulong start, target_ulong last);
+void page_reset_target_data(vaddr start, vaddr last);
 
 /**
  * page_check_range
@@ -46,7 +44,7 @@ void page_reset_target_data(target_ulong start, target_ulong last);
  * Return false if any page is unmapped.  Thus testing flags == 0 is
  * equivalent to testing for flags == PAGE_VALID.
  */
-bool page_check_range(target_ulong start, target_ulong last, int flags);
+bool page_check_range(vaddr start, vaddr last, int flags);
 
 /**
  * page_check_range_empty:
@@ -58,7 +56,7 @@ bool page_check_range(target_ulong start, target_ulong last, int flags);
  * The memory lock must be held so that the caller will can ensure
  * the result stays true until a new mapping can be installed.
  */
-bool page_check_range_empty(target_ulong start, target_ulong last);
+bool page_check_range_empty(vaddr start, vaddr last);
 
 /**
  * page_find_range_empty
@@ -72,8 +70,7 @@ bool page_check_range_empty(target_ulong start, target_ulong last);
  * The memory lock must be held, as the caller will want to ensure
  * the returned range stays empty until a new mapping can be installed.
  */
-target_ulong page_find_range_empty(target_ulong min, target_ulong max,
-                                   target_ulong len, target_ulong align);
+vaddr page_find_range_empty(vaddr min, vaddr max, vaddr len, vaddr align);
 
 /**
  * page_get_target_data(address)
@@ -87,7 +84,7 @@ target_ulong page_find_range_empty(target_ulong min, target_ulong max,
  * e.g. with the munmap system call.
  */
 __attribute__((returns_nonnull))
-void *page_get_target_data(target_ulong address);
+void *page_get_target_data(vaddr address);
 
 typedef int (*walk_memory_regions_fn)(void *, vaddr, vaddr, int);
 int walk_memory_regions(void *, walk_memory_regions_fn);

From 5f2446eb82bcb89c0969feffdd88c4eea05edfcd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 24 Apr 2025 22:24:03 +0200
Subject: [PATCH 0542/2760] include/exec: Include missing headers in exec-all.h
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

"exec/exec-all.h" declares prototypes such:

  void *probe_access(CPUArchState *env, vaddr addr, int size,
                                        ^^^^^
                     MMUAccessType access_type, int mmu_idx,
                     uintptr_t retaddr);
  MemoryRegionSection *iotlb_to_section(CPUState *cpu,
                                        hwaddr index,
                                        ^^^^^^
                                        MemTxAttrs attrs);
                                        ^^^^^^^^^^

vaddr is defined in "exec/vaddr.h", hwaddr in "exec/hwaddr.h"
and MemTxAttrs in "exec/memattrs.h". All these headers are
indirectly pulled in via "exec/translation-block.h". Since
we will remove "exec/translation-block.h" in the next commit,
include the missing ones, otherwise we'd get errors such:

  include/exec/exec-all.h:51:1: error: unknown type name 'hwaddr'
     51 | hwaddr memory_region_section_get_iotlb(CPUState *cpu,
        | ^

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250424202412.91612-5-philmd@linaro.org>
---
 include/exec/exec-all.h | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index 24383b6aba..c46255e66e 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -20,8 +20,11 @@
 #ifndef EXEC_ALL_H
 #define EXEC_ALL_H
 
+#include "exec/hwaddr.h"
+#include "exec/memattrs.h"
 #include "exec/mmu-access-type.h"
 #include "exec/translation-block.h"
+#include "exec/vaddr.h"
 
 #if defined(CONFIG_TCG)
 #include "accel/tcg/getpc.h"

From 0b87b740c27cabbd4f8447631d026c28ca83f7db Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 24 Apr 2025 22:24:04 +0200
Subject: [PATCH 0543/2760] include/exec: Move tb_invalidate_phys_range to
 translation-block.h
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Anton Johansson <anjo@rev.ng>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/exec-all.h          | 5 -----
 include/exec/translation-block.h | 4 ++++
 2 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index c46255e66e..4c5ad98c6a 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -23,7 +23,6 @@
 #include "exec/hwaddr.h"
 #include "exec/memattrs.h"
 #include "exec/mmu-access-type.h"
-#include "exec/translation-block.h"
 #include "exec/vaddr.h"
 
 #if defined(CONFIG_TCG)
@@ -123,10 +122,6 @@ int probe_access_full_mmu(CPUArchState *env, vaddr addr, int size,
 #endif /* !CONFIG_USER_ONLY */
 #endif /* CONFIG_TCG */
 
-/* TranslationBlock invalidate API */
-void tb_invalidate_phys_range(CPUState *cpu, tb_page_addr_t start,
-                              tb_page_addr_t last);
-
 #if !defined(CONFIG_USER_ONLY)
 
 /**
diff --git a/include/exec/translation-block.h b/include/exec/translation-block.h
index 8b8e730561..cdce399eba 100644
--- a/include/exec/translation-block.h
+++ b/include/exec/translation-block.h
@@ -207,4 +207,8 @@ static inline void tb_set_page_addr1(TranslationBlock *tb,
 #endif
 }
 
+/* TranslationBlock invalidate API */
+void tb_invalidate_phys_range(CPUState *cpu, tb_page_addr_t start,
+                              tb_page_addr_t last);
+
 #endif /* EXEC_TRANSLATION_BLOCK_H */

From 7795eded0477f21c8518176492c4e19d103dde2c Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 24 Apr 2025 22:24:05 +0200
Subject: [PATCH 0544/2760] accel/tcg: Compile tb-maint.c twice
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Anton Johansson <anjo@rev.ng>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/meson.build | 2 +-
 accel/tcg/tb-hash.h   | 3 +--
 accel/tcg/tb-maint.c  | 2 --
 3 files changed, 2 insertions(+), 5 deletions(-)

diff --git a/accel/tcg/meson.build b/accel/tcg/meson.build
index 047afa49a2..3f7b127130 100644
--- a/accel/tcg/meson.build
+++ b/accel/tcg/meson.build
@@ -8,6 +8,7 @@ tcg_ss.add(files(
   'cpu-exec-common.c',
   'tcg-runtime.c',
   'tcg-runtime-gvec.c',
+  'tb-maint.c',
   'translator.c',
 ))
 if get_option('plugins')
@@ -21,7 +22,6 @@ tcg_specific_ss = ss.source_set()
 tcg_specific_ss.add(files(
   'tcg-all.c',
   'cpu-exec.c',
-  'tb-maint.c',
   'translate-all.c',
 ))
 tcg_specific_ss.add(when: 'CONFIG_USER_ONLY', if_true: files('user-exec.c'))
diff --git a/accel/tcg/tb-hash.h b/accel/tcg/tb-hash.h
index 3bc5042d9d..f7b159f04c 100644
--- a/accel/tcg/tb-hash.h
+++ b/accel/tcg/tb-hash.h
@@ -20,8 +20,7 @@
 #ifndef EXEC_TB_HASH_H
 #define EXEC_TB_HASH_H
 
-#include "exec/cpu-defs.h"
-#include "exec/exec-all.h"
+#include "exec/vaddr.h"
 #include "exec/target_page.h"
 #include "exec/translation-block.h"
 #include "qemu/xxhash.h"
diff --git a/accel/tcg/tb-maint.c b/accel/tcg/tb-maint.c
index b144fcd4a0..0048316f99 100644
--- a/accel/tcg/tb-maint.c
+++ b/accel/tcg/tb-maint.c
@@ -20,10 +20,8 @@
 #include "qemu/osdep.h"
 #include "qemu/interval-tree.h"
 #include "qemu/qtree.h"
-#include "cpu.h"
 #include "exec/cputlb.h"
 #include "exec/log.h"
-#include "exec/exec-all.h"
 #include "exec/page-protection.h"
 #include "exec/mmap-lock.h"
 #include "exec/tb-flush.h"

From 3ea423c27f4eabee5068fce27412761fa3db8b0f Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 26 Apr 2025 19:35:00 +0000
Subject: [PATCH 0545/2760] accel/tcg: Remove #error for non-tcg in getpc.h

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/accel/tcg/getpc.h | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/include/accel/tcg/getpc.h b/include/accel/tcg/getpc.h
index 8a97ce34e7..0fc08addcf 100644
--- a/include/accel/tcg/getpc.h
+++ b/include/accel/tcg/getpc.h
@@ -8,10 +8,6 @@
 #ifndef ACCEL_TCG_GETPC_H
 #define ACCEL_TCG_GETPC_H
 
-#ifndef CONFIG_TCG
-#error Can only include this header with TCG
-#endif
-
 /* GETPC is the true target of the return instruction that we'll execute.  */
 #ifdef CONFIG_TCG_INTERPRETER
 extern __thread uintptr_t tci_tb_ptr;

From 0f81774dd1c19de5dedb3c8f2d74e5b9a73d8c12 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 24 Apr 2025 22:24:06 +0200
Subject: [PATCH 0546/2760] target/riscv: Include missing 'accel/tcg/getpc.h'
 in csr.c
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

"accel/tcg/getpc.h" is pulled in indirectly. Include it
explicitly to avoid when refactoring unrelated headers:

  target/riscv/csr.c:2117:25: error: call to undeclared function 'GETPC' [-Wimplicit-function-declaration]
   2117 |     if ((val & RVC) && (GETPC() & ~3) != 0) {
        |                         ^

Note the TODO comment around GETPC() added upon introduction in
commit f18637cd611 ("RISC-V: Add misa runtime write support"):

 2099 static RISCVException write_misa(CPURISCVState *env, int csrno,
 2100                                  target_ulong val)
 2101 {
  ...
 2113     /*
 2114      * Suppress 'C' if next instruction is not aligned
 2115      * TODO: this should check next_pc
 2116      */
 2117     if ((val & RVC) && (GETPC() & ~3) != 0) {
 2118         val &= ~RVC;
 2119     }

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250424202412.91612-8-philmd@linaro.org>
---
 target/riscv/csr.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index c52c87faae..1308643855 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -28,6 +28,7 @@
 #include "exec/cputlb.h"
 #include "exec/tb-flush.h"
 #include "exec/icount.h"
+#include "accel/tcg/getpc.h"
 #include "qemu/guest-random.h"
 #include "qapi/error.h"
 #include <stdbool.h>

From 98db62318ae98be9a57b3c01f7f97a984ac1b79b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 24 Apr 2025 22:24:08 +0200
Subject: [PATCH 0547/2760] accel/tcg: Include 'accel/tcg/getpc.h' in
 'exec/helper-proto'
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Most files including "exec/helper-proto.h" call GETPC().
Include it there (in the common part) instead of the
unspecific "exec/exec-all.h" header.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250424202412.91612-10-philmd@linaro.org>
---
 accel/tcg/translate-all.c          | 1 +
 include/exec/exec-all.h            | 1 -
 include/exec/helper-proto-common.h | 2 ++
 target/avr/helper.c                | 1 -
 4 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index 38819a507b..0408e2522a 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -61,6 +61,7 @@
 #include "system/tcg.h"
 #include "qapi/error.h"
 #include "accel/tcg/cpu-ops.h"
+#include "accel/tcg/getpc.h"
 #include "tb-jmp-cache.h"
 #include "tb-hash.h"
 #include "tb-context.h"
diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index 4c5ad98c6a..816274bf90 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -26,7 +26,6 @@
 #include "exec/vaddr.h"
 
 #if defined(CONFIG_TCG)
-#include "accel/tcg/getpc.h"
 
 /**
  * probe_access:
diff --git a/include/exec/helper-proto-common.h b/include/exec/helper-proto-common.h
index 16782ef46c..76e6c25bec 100644
--- a/include/exec/helper-proto-common.h
+++ b/include/exec/helper-proto-common.h
@@ -13,4 +13,6 @@
 #include "exec/helper-proto.h.inc"
 #undef  HELPER_H
 
+#include "accel/tcg/getpc.h"
+
 #endif /* HELPER_PROTO_COMMON_H */
diff --git a/target/avr/helper.c b/target/avr/helper.c
index afa591470f..b9cd6d5ef2 100644
--- a/target/avr/helper.c
+++ b/target/avr/helper.c
@@ -23,7 +23,6 @@
 #include "qemu/error-report.h"
 #include "cpu.h"
 #include "accel/tcg/cpu-ops.h"
-#include "accel/tcg/getpc.h"
 #include "exec/cputlb.h"
 #include "exec/page-protection.h"
 #include "exec/target_page.h"

From 1381ea53a84234a0aac212baeae922137ad4bbda Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 24 Apr 2025 22:24:09 +0200
Subject: [PATCH 0548/2760] physmem: Move TCG IOTLB methods around
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The next commit will restrict TCG specific code in physmem.c
using some #ifdef'ry. In order to keep it simple, move
iotlb_to_section() and memory_region_section_get_iotlb()
around close together.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250424202412.91612-11-philmd@linaro.org>
---
 system/physmem.c | 50 ++++++++++++++++++++++++------------------------
 1 file changed, 25 insertions(+), 25 deletions(-)

diff --git a/system/physmem.c b/system/physmem.c
index 637f2d8532..ccbeae241c 100644
--- a/system/physmem.c
+++ b/system/physmem.c
@@ -746,6 +746,31 @@ translate_fail:
     return &d->map.sections[PHYS_SECTION_UNASSIGNED];
 }
 
+MemoryRegionSection *iotlb_to_section(CPUState *cpu,
+                                      hwaddr index, MemTxAttrs attrs)
+{
+    int asidx = cpu_asidx_from_attrs(cpu, attrs);
+    CPUAddressSpace *cpuas = &cpu->cpu_ases[asidx];
+    AddressSpaceDispatch *d = cpuas->memory_dispatch;
+    int section_index = index & ~TARGET_PAGE_MASK;
+    MemoryRegionSection *ret;
+
+    assert(section_index < d->map.sections_nb);
+    ret = d->map.sections + section_index;
+    assert(ret->mr);
+    assert(ret->mr->ops);
+
+    return ret;
+}
+
+/* Called from RCU critical section */
+hwaddr memory_region_section_get_iotlb(CPUState *cpu,
+                                       MemoryRegionSection *section)
+{
+    AddressSpaceDispatch *d = flatview_to_dispatch(section->fv);
+    return section - d->map.sections;
+}
+
 void cpu_address_space_init(CPUState *cpu, int asidx,
                             const char *prefix, MemoryRegion *mr)
 {
@@ -1002,14 +1027,6 @@ bool cpu_physical_memory_snapshot_get_dirty(DirtyBitmapSnapshot *snap,
     return false;
 }
 
-/* Called from RCU critical section */
-hwaddr memory_region_section_get_iotlb(CPUState *cpu,
-                                       MemoryRegionSection *section)
-{
-    AddressSpaceDispatch *d = flatview_to_dispatch(section->fv);
-    return section - d->map.sections;
-}
-
 static int subpage_register(subpage_t *mmio, uint32_t start, uint32_t end,
                             uint16_t section);
 static subpage_t *subpage_init(FlatView *fv, hwaddr base);
@@ -2669,23 +2686,6 @@ static uint16_t dummy_section(PhysPageMap *map, FlatView *fv, MemoryRegion *mr)
     return phys_section_add(map, &section);
 }
 
-MemoryRegionSection *iotlb_to_section(CPUState *cpu,
-                                      hwaddr index, MemTxAttrs attrs)
-{
-    int asidx = cpu_asidx_from_attrs(cpu, attrs);
-    CPUAddressSpace *cpuas = &cpu->cpu_ases[asidx];
-    AddressSpaceDispatch *d = cpuas->memory_dispatch;
-    int section_index = index & ~TARGET_PAGE_MASK;
-    MemoryRegionSection *ret;
-
-    assert(section_index < d->map.sections_nb);
-    ret = d->map.sections + section_index;
-    assert(ret->mr);
-    assert(ret->mr->ops);
-
-    return ret;
-}
-
 static void io_mem_init(void)
 {
     memory_region_init_io(&io_mem_unassigned, NULL, &unassigned_mem_ops, NULL,

From f12b717717c45627d667b609326fda54f0ad0394 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 24 Apr 2025 22:24:10 +0200
Subject: [PATCH 0549/2760] physmem: Restrict TCG IOTLB code to TCG accel
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Restrict iotlb_to_section(), address_space_translate_for_iotlb()
and memory_region_section_get_iotlb() to TCG. Declare them in
the new "accel/tcg/iommu.h" header. Declare iotlb_to_section()
using the MemoryRegionSection typedef.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250424202412.91612-12-philmd@linaro.org>
---
 MAINTAINERS               |  2 +-
 accel/tcg/cputlb.c        |  1 +
 include/accel/tcg/iommu.h | 41 +++++++++++++++++++++++++++++++++++++++
 include/exec/exec-all.h   | 26 -------------------------
 system/physmem.c          |  5 +++++
 5 files changed, 48 insertions(+), 27 deletions(-)
 create mode 100644 include/accel/tcg/iommu.h

diff --git a/MAINTAINERS b/MAINTAINERS
index b3f9f2680b..f3f491c8c2 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -168,7 +168,7 @@ F: include/exec/helper*.h.inc
 F: include/exec/helper-info.c.inc
 F: include/exec/page-protection.h
 F: include/system/tcg.h
-F: include/accel/tcg/cpu-ops.h
+F: include/accel/tcg/
 F: host/include/*/host/cpuinfo.h
 F: util/cpuinfo-*.c
 F: include/tcg/
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index ca69128232..d11989f567 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -20,6 +20,7 @@
 #include "qemu/osdep.h"
 #include "qemu/main-loop.h"
 #include "accel/tcg/cpu-ops.h"
+#include "accel/tcg/iommu.h"
 #include "exec/exec-all.h"
 #include "exec/page-protection.h"
 #include "system/memory.h"
diff --git a/include/accel/tcg/iommu.h b/include/accel/tcg/iommu.h
new file mode 100644
index 0000000000..90cfd6c0ed
--- /dev/null
+++ b/include/accel/tcg/iommu.h
@@ -0,0 +1,41 @@
+/*
+ * TCG IOMMU translations.
+ *
+ * Copyright (c) 2003 Fabrice Bellard
+ * SPDX-License-Identifier: LGPL-2.1-or-later
+ */
+#ifndef ACCEL_TCG_IOMMU_H
+#define ACCEL_TCG_IOMMU_H
+
+#ifdef CONFIG_USER_ONLY
+#error Cannot include accel/tcg/iommu.h from user emulation
+#endif
+
+#include "exec/hwaddr.h"
+#include "exec/memattrs.h"
+
+/**
+ * iotlb_to_section:
+ * @cpu: CPU performing the access
+ * @index: TCG CPU IOTLB entry
+ *
+ * Given a TCG CPU IOTLB entry, return the MemoryRegionSection that
+ * it refers to. @index will have been initially created and returned
+ * by memory_region_section_get_iotlb().
+ */
+MemoryRegionSection *iotlb_to_section(CPUState *cpu,
+                                      hwaddr index, MemTxAttrs attrs);
+
+MemoryRegionSection *address_space_translate_for_iotlb(CPUState *cpu,
+                                                       int asidx,
+                                                       hwaddr addr,
+                                                       hwaddr *xlat,
+                                                       hwaddr *plen,
+                                                       MemTxAttrs attrs,
+                                                       int *prot);
+
+hwaddr memory_region_section_get_iotlb(CPUState *cpu,
+                                       MemoryRegionSection *section);
+
+#endif
+
diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index 816274bf90..b9eb9bc4b6 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -21,7 +21,6 @@
 #define EXEC_ALL_H
 
 #include "exec/hwaddr.h"
-#include "exec/memattrs.h"
 #include "exec/mmu-access-type.h"
 #include "exec/vaddr.h"
 
@@ -121,29 +120,4 @@ int probe_access_full_mmu(CPUArchState *env, vaddr addr, int size,
 #endif /* !CONFIG_USER_ONLY */
 #endif /* CONFIG_TCG */
 
-#if !defined(CONFIG_USER_ONLY)
-
-/**
- * iotlb_to_section:
- * @cpu: CPU performing the access
- * @index: TCG CPU IOTLB entry
- *
- * Given a TCG CPU IOTLB entry, return the MemoryRegionSection that
- * it refers to. @index will have been initially created and returned
- * by memory_region_section_get_iotlb().
- */
-struct MemoryRegionSection *iotlb_to_section(CPUState *cpu,
-                                             hwaddr index, MemTxAttrs attrs);
-#endif
-
-#if !defined(CONFIG_USER_ONLY)
-
-MemoryRegionSection *
-address_space_translate_for_iotlb(CPUState *cpu, int asidx, hwaddr addr,
-                                  hwaddr *xlat, hwaddr *plen,
-                                  MemTxAttrs attrs, int *prot);
-hwaddr memory_region_section_get_iotlb(CPUState *cpu,
-                                       MemoryRegionSection *section);
-#endif
-
 #endif
diff --git a/system/physmem.c b/system/physmem.c
index ccbeae241c..f1ec0902c7 100644
--- a/system/physmem.c
+++ b/system/physmem.c
@@ -29,6 +29,7 @@
 
 #ifdef CONFIG_TCG
 #include "accel/tcg/cpu-ops.h"
+#include "accel/tcg/iommu.h"
 #endif /* CONFIG_TCG */
 
 #include "exec/exec-all.h"
@@ -587,6 +588,8 @@ MemoryRegion *flatview_translate(FlatView *fv, hwaddr addr, hwaddr *xlat,
     return mr;
 }
 
+#ifdef CONFIG_TCG
+
 typedef struct TCGIOMMUNotifier {
     IOMMUNotifier n;
     MemoryRegion *mr;
@@ -771,6 +774,8 @@ hwaddr memory_region_section_get_iotlb(CPUState *cpu,
     return section - d->map.sections;
 }
 
+#endif /* CONFIG_TCG */
+
 void cpu_address_space_init(CPUState *cpu, int asidx,
                             const char *prefix, MemoryRegion *mr)
 {

From fe1a3ace13a8b53fc20c74fb7e3337f754396e6b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 24 Apr 2025 22:24:11 +0200
Subject: [PATCH 0550/2760] accel/tcg: Extract probe API out of
 'exec/exec-all.h'
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Declare probe methods in "accel/tcg/probe.h" to emphasize
they are specific to TCG accelerator.

Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250424202412.91612-13-philmd@linaro.org>
---
 accel/tcg/cputlb.c                   |   1 +
 accel/tcg/user-exec.c                |   1 +
 include/accel/tcg/probe.h            | 106 +++++++++++++++++++++++++++
 include/exec/exec-all.h              | 100 -------------------------
 semihosting/uaccess.c                |   1 +
 target/arm/helper.c                  |   1 +
 target/arm/ptw.c                     |   1 +
 target/arm/tcg/helper-a64.c          |   1 +
 target/arm/tcg/mte_helper.c          |   1 +
 target/arm/tcg/op_helper.c           |   1 +
 target/arm/tcg/sve_helper.c          |   1 +
 target/hexagon/mmvec/macros.h        |   1 +
 target/hexagon/op_helper.c           |   1 +
 target/hppa/mem_helper.c             |   1 +
 target/hppa/op_helper.c              |   1 +
 target/i386/tcg/access.c             |   1 +
 target/i386/tcg/seg_helper.c         |   1 +
 target/i386/tcg/system/excp_helper.c |   1 +
 target/mips/tcg/msa_helper.c         |   1 +
 target/ppc/mem_helper.c              |   1 +
 target/riscv/op_helper.c             |   1 +
 target/riscv/vector_helper.c         |   1 +
 target/s390x/tcg/mem_helper.c        |   1 +
 target/xtensa/mmu_helper.c           |   1 +
 24 files changed, 128 insertions(+), 100 deletions(-)
 create mode 100644 include/accel/tcg/probe.h

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index d11989f567..b346af942a 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -21,6 +21,7 @@
 #include "qemu/main-loop.h"
 #include "accel/tcg/cpu-ops.h"
 #include "accel/tcg/iommu.h"
+#include "accel/tcg/probe.h"
 #include "exec/exec-all.h"
 #include "exec/page-protection.h"
 #include "system/memory.h"
diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index 43d005e24e..697fdf1824 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -27,6 +27,7 @@
 #include "qemu/bitops.h"
 #include "qemu/rcu.h"
 #include "accel/tcg/cpu-ldst.h"
+#include "accel/tcg/probe.h"
 #include "user/cpu_loop.h"
 #include "qemu/main-loop.h"
 #include "user/page-protection.h"
diff --git a/include/accel/tcg/probe.h b/include/accel/tcg/probe.h
new file mode 100644
index 0000000000..177bd1608d
--- /dev/null
+++ b/include/accel/tcg/probe.h
@@ -0,0 +1,106 @@
+/*
+ * Probe guest virtual addresses for access permissions.
+ *
+ * Copyright (c) 2003 Fabrice Bellard
+ * SPDX-License-Identifier: LGPL-2.1-or-later
+ */
+#ifndef ACCEL_TCG_PROBE_H
+#define ACCEL_TCG_PROBE_H
+
+#include "exec/mmu-access-type.h"
+#include "exec/vaddr.h"
+
+/**
+ * probe_access:
+ * @env: CPUArchState
+ * @addr: guest virtual address to look up
+ * @size: size of the access
+ * @access_type: read, write or execute permission
+ * @mmu_idx: MMU index to use for lookup
+ * @retaddr: return address for unwinding
+ *
+ * Look up the guest virtual address @addr.  Raise an exception if the
+ * page does not satisfy @access_type.  Raise an exception if the
+ * access (@addr, @size) hits a watchpoint.  For writes, mark a clean
+ * page as dirty.
+ *
+ * Finally, return the host address for a page that is backed by RAM,
+ * or NULL if the page requires I/O.
+ */
+void *probe_access(CPUArchState *env, vaddr addr, int size,
+                   MMUAccessType access_type, int mmu_idx, uintptr_t retaddr);
+
+static inline void *probe_write(CPUArchState *env, vaddr addr, int size,
+                                int mmu_idx, uintptr_t retaddr)
+{
+    return probe_access(env, addr, size, MMU_DATA_STORE, mmu_idx, retaddr);
+}
+
+static inline void *probe_read(CPUArchState *env, vaddr addr, int size,
+                               int mmu_idx, uintptr_t retaddr)
+{
+    return probe_access(env, addr, size, MMU_DATA_LOAD, mmu_idx, retaddr);
+}
+
+/**
+ * probe_access_flags:
+ * @env: CPUArchState
+ * @addr: guest virtual address to look up
+ * @size: size of the access
+ * @access_type: read, write or execute permission
+ * @mmu_idx: MMU index to use for lookup
+ * @nonfault: suppress the fault
+ * @phost: return value for host address
+ * @retaddr: return address for unwinding
+ *
+ * Similar to probe_access, loosely returning the TLB_FLAGS_MASK for
+ * the page, and storing the host address for RAM in @phost.
+ *
+ * If @nonfault is set, do not raise an exception but return TLB_INVALID_MASK.
+ * Do not handle watchpoints, but include TLB_WATCHPOINT in the returned flags.
+ * Do handle clean pages, so exclude TLB_NOTDIRY from the returned flags.
+ * For simplicity, all "mmio-like" flags are folded to TLB_MMIO.
+ */
+int probe_access_flags(CPUArchState *env, vaddr addr, int size,
+                       MMUAccessType access_type, int mmu_idx,
+                       bool nonfault, void **phost, uintptr_t retaddr);
+
+#ifndef CONFIG_USER_ONLY
+
+/**
+ * probe_access_full:
+ * Like probe_access_flags, except also return into @pfull.
+ *
+ * The CPUTLBEntryFull structure returned via @pfull is transient
+ * and must be consumed or copied immediately, before any further
+ * access or changes to TLB @mmu_idx.
+ *
+ * This function will not fault if @nonfault is set, but will
+ * return TLB_INVALID_MASK if the page is not mapped, or is not
+ * accessible with @access_type.
+ *
+ * This function will return TLB_MMIO in order to force the access
+ * to be handled out-of-line if plugins wish to instrument the access.
+ */
+int probe_access_full(CPUArchState *env, vaddr addr, int size,
+                      MMUAccessType access_type, int mmu_idx,
+                      bool nonfault, void **phost,
+                      CPUTLBEntryFull **pfull, uintptr_t retaddr);
+
+/**
+ * probe_access_full_mmu:
+ * Like probe_access_full, except:
+ *
+ * This function is intended to be used for page table accesses by
+ * the target mmu itself.  Since such page walking happens while
+ * handling another potential mmu fault, this function never raises
+ * exceptions (akin to @nonfault true for probe_access_full).
+ * Likewise this function does not trigger plugin instrumentation.
+ */
+int probe_access_full_mmu(CPUArchState *env, vaddr addr, int size,
+                          MMUAccessType access_type, int mmu_idx,
+                          void **phost, CPUTLBEntryFull **pfull);
+
+#endif /* !CONFIG_USER_ONLY */
+
+#endif
diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index b9eb9bc4b6..9ef7569a0b 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -20,104 +20,4 @@
 #ifndef EXEC_ALL_H
 #define EXEC_ALL_H
 
-#include "exec/hwaddr.h"
-#include "exec/mmu-access-type.h"
-#include "exec/vaddr.h"
-
-#if defined(CONFIG_TCG)
-
-/**
- * probe_access:
- * @env: CPUArchState
- * @addr: guest virtual address to look up
- * @size: size of the access
- * @access_type: read, write or execute permission
- * @mmu_idx: MMU index to use for lookup
- * @retaddr: return address for unwinding
- *
- * Look up the guest virtual address @addr.  Raise an exception if the
- * page does not satisfy @access_type.  Raise an exception if the
- * access (@addr, @size) hits a watchpoint.  For writes, mark a clean
- * page as dirty.
- *
- * Finally, return the host address for a page that is backed by RAM,
- * or NULL if the page requires I/O.
- */
-void *probe_access(CPUArchState *env, vaddr addr, int size,
-                   MMUAccessType access_type, int mmu_idx, uintptr_t retaddr);
-
-static inline void *probe_write(CPUArchState *env, vaddr addr, int size,
-                                int mmu_idx, uintptr_t retaddr)
-{
-    return probe_access(env, addr, size, MMU_DATA_STORE, mmu_idx, retaddr);
-}
-
-static inline void *probe_read(CPUArchState *env, vaddr addr, int size,
-                               int mmu_idx, uintptr_t retaddr)
-{
-    return probe_access(env, addr, size, MMU_DATA_LOAD, mmu_idx, retaddr);
-}
-
-/**
- * probe_access_flags:
- * @env: CPUArchState
- * @addr: guest virtual address to look up
- * @size: size of the access
- * @access_type: read, write or execute permission
- * @mmu_idx: MMU index to use for lookup
- * @nonfault: suppress the fault
- * @phost: return value for host address
- * @retaddr: return address for unwinding
- *
- * Similar to probe_access, loosely returning the TLB_FLAGS_MASK for
- * the page, and storing the host address for RAM in @phost.
- *
- * If @nonfault is set, do not raise an exception but return TLB_INVALID_MASK.
- * Do not handle watchpoints, but include TLB_WATCHPOINT in the returned flags.
- * Do handle clean pages, so exclude TLB_NOTDIRY from the returned flags.
- * For simplicity, all "mmio-like" flags are folded to TLB_MMIO.
- */
-int probe_access_flags(CPUArchState *env, vaddr addr, int size,
-                       MMUAccessType access_type, int mmu_idx,
-                       bool nonfault, void **phost, uintptr_t retaddr);
-
-#ifndef CONFIG_USER_ONLY
-
-/**
- * probe_access_full:
- * Like probe_access_flags, except also return into @pfull.
- *
- * The CPUTLBEntryFull structure returned via @pfull is transient
- * and must be consumed or copied immediately, before any further
- * access or changes to TLB @mmu_idx.
- *
- * This function will not fault if @nonfault is set, but will
- * return TLB_INVALID_MASK if the page is not mapped, or is not
- * accessible with @access_type.
- *
- * This function will return TLB_MMIO in order to force the access
- * to be handled out-of-line if plugins wish to instrument the access.
- */
-int probe_access_full(CPUArchState *env, vaddr addr, int size,
-                      MMUAccessType access_type, int mmu_idx,
-                      bool nonfault, void **phost,
-                      CPUTLBEntryFull **pfull, uintptr_t retaddr);
-
-/**
- * probe_access_full_mmu:
- * Like probe_access_full, except:
- *
- * This function is intended to be used for page table accesses by
- * the target mmu itself.  Since such page walking happens while
- * handling another potential mmu fault, this function never raises
- * exceptions (akin to @nonfault true for probe_access_full).
- * Likewise this function does not trigger plugin instrumentation.
- */
-int probe_access_full_mmu(CPUArchState *env, vaddr addr, int size,
-                          MMUAccessType access_type, int mmu_idx,
-                          void **phost, CPUTLBEntryFull **pfull);
-
-#endif /* !CONFIG_USER_ONLY */
-#endif /* CONFIG_TCG */
-
 #endif
diff --git a/semihosting/uaccess.c b/semihosting/uaccess.c
index 81ffecaaba..ebbb300f86 100644
--- a/semihosting/uaccess.c
+++ b/semihosting/uaccess.c
@@ -9,6 +9,7 @@
 
 #include "qemu/osdep.h"
 #include "accel/tcg/cpu-mmu-index.h"
+#include "accel/tcg/probe.h"
 #include "exec/exec-all.h"
 #include "exec/target_page.h"
 #include "exec/tlb-flags.h"
diff --git a/target/arm/helper.c b/target/arm/helper.c
index c6fd290012..2f039b2db3 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -30,6 +30,7 @@
 #include "qapi/error.h"
 #include "qemu/guest-random.h"
 #ifdef CONFIG_TCG
+#include "accel/tcg/probe.h"
 #include "semihosting/common-semi.h"
 #endif
 #include "cpregs.h"
diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index e0e82ae507..87d707b592 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -14,6 +14,7 @@
 #include "exec/page-protection.h"
 #include "exec/target_page.h"
 #include "exec/tlb-flags.h"
+#include "accel/tcg/probe.h"
 #include "cpu.h"
 #include "internals.h"
 #include "cpu-features.h"
diff --git a/target/arm/tcg/helper-a64.c b/target/arm/tcg/helper-a64.c
index 842d9e6000..cfe5faba19 100644
--- a/target/arm/tcg/helper-a64.c
+++ b/target/arm/tcg/helper-a64.c
@@ -31,6 +31,7 @@
 #include "exec/cpu-common.h"
 #include "exec/exec-all.h"
 #include "accel/tcg/cpu-ldst.h"
+#include "accel/tcg/probe.h"
 #include "exec/target_page.h"
 #include "exec/tlb-flags.h"
 #include "qemu/int128.h"
diff --git a/target/arm/tcg/mte_helper.c b/target/arm/tcg/mte_helper.c
index 7dc5fb776b..8fbdcc8fb9 100644
--- a/target/arm/tcg/mte_helper.c
+++ b/target/arm/tcg/mte_helper.c
@@ -30,6 +30,7 @@
 #include "system/ram_addr.h"
 #endif
 #include "accel/tcg/cpu-ldst.h"
+#include "accel/tcg/probe.h"
 #include "exec/helper-proto.h"
 #include "exec/tlb-flags.h"
 #include "accel/tcg/cpu-ops.h"
diff --git a/target/arm/tcg/op_helper.c b/target/arm/tcg/op_helper.c
index 38d49cbb9d..d50b8720ad 100644
--- a/target/arm/tcg/op_helper.c
+++ b/target/arm/tcg/op_helper.c
@@ -25,6 +25,7 @@
 #include "cpu-features.h"
 #include "exec/exec-all.h"
 #include "accel/tcg/cpu-ldst.h"
+#include "accel/tcg/probe.h"
 #include "cpregs.h"
 
 #define SIGNBIT (uint32_t)0x80000000
diff --git a/target/arm/tcg/sve_helper.c b/target/arm/tcg/sve_helper.c
index 87b6b4b3e6..50aca54eaa 100644
--- a/target/arm/tcg/sve_helper.c
+++ b/target/arm/tcg/sve_helper.c
@@ -32,6 +32,7 @@
 #include "sve_ldst_internal.h"
 #include "accel/tcg/cpu-ldst.h"
 #include "accel/tcg/cpu-ops.h"
+#include "accel/tcg/probe.h"
 #ifdef CONFIG_USER_ONLY
 #include "user/page-protection.h"
 #endif
diff --git a/target/hexagon/mmvec/macros.h b/target/hexagon/mmvec/macros.h
index c1a88392c0..c7840fbf2e 100644
--- a/target/hexagon/mmvec/macros.h
+++ b/target/hexagon/mmvec/macros.h
@@ -22,6 +22,7 @@
 #include "arch.h"
 #include "mmvec/system_ext_mmvec.h"
 #include "accel/tcg/getpc.h"
+#include "accel/tcg/probe.h"
 
 #ifndef QEMU_GENERATE
 #define VdV      (*(MMVector *restrict)(VdV_void))
diff --git a/target/hexagon/op_helper.c b/target/hexagon/op_helper.c
index 3f3d86db2b..dd726b4318 100644
--- a/target/hexagon/op_helper.c
+++ b/target/hexagon/op_helper.c
@@ -19,6 +19,7 @@
 #include "qemu/log.h"
 #include "exec/exec-all.h"
 #include "accel/tcg/cpu-ldst.h"
+#include "accel/tcg/probe.h"
 #include "exec/helper-proto.h"
 #include "fpu/softfloat.h"
 #include "cpu.h"
diff --git a/target/hppa/mem_helper.c b/target/hppa/mem_helper.c
index 554d7bf4d1..a5f73aedf8 100644
--- a/target/hppa/mem_helper.c
+++ b/target/hppa/mem_helper.c
@@ -23,6 +23,7 @@
 #include "exec/exec-all.h"
 #include "exec/cputlb.h"
 #include "accel/tcg/cpu-mmu-index.h"
+#include "accel/tcg/probe.h"
 #include "exec/page-protection.h"
 #include "exec/target_page.h"
 #include "exec/helper-proto.h"
diff --git a/target/hppa/op_helper.c b/target/hppa/op_helper.c
index 2398ce2c64..32207c1a4c 100644
--- a/target/hppa/op_helper.c
+++ b/target/hppa/op_helper.c
@@ -23,6 +23,7 @@
 #include "exec/exec-all.h"
 #include "exec/helper-proto.h"
 #include "accel/tcg/cpu-ldst.h"
+#include "accel/tcg/probe.h"
 #include "qemu/timer.h"
 #include "trace.h"
 #ifdef CONFIG_USER_ONLY
diff --git a/target/i386/tcg/access.c b/target/i386/tcg/access.c
index 0fdd587edd..ee5b451459 100644
--- a/target/i386/tcg/access.c
+++ b/target/i386/tcg/access.c
@@ -4,6 +4,7 @@
 #include "qemu/osdep.h"
 #include "cpu.h"
 #include "accel/tcg/cpu-ldst.h"
+#include "accel/tcg/probe.h"
 #include "exec/exec-all.h"
 #include "exec/target_page.h"
 #include "access.h"
diff --git a/target/i386/tcg/seg_helper.c b/target/i386/tcg/seg_helper.c
index 3af902e0ec..e45d71fa1a 100644
--- a/target/i386/tcg/seg_helper.c
+++ b/target/i386/tcg/seg_helper.c
@@ -24,6 +24,7 @@
 #include "exec/helper-proto.h"
 #include "exec/exec-all.h"
 #include "accel/tcg/cpu-ldst.h"
+#include "accel/tcg/probe.h"
 #include "exec/log.h"
 #include "helper-tcg.h"
 #include "seg_helper.h"
diff --git a/target/i386/tcg/system/excp_helper.c b/target/i386/tcg/system/excp_helper.c
index 93614aa3e5..c162621587 100644
--- a/target/i386/tcg/system/excp_helper.c
+++ b/target/i386/tcg/system/excp_helper.c
@@ -20,6 +20,7 @@
 #include "qemu/osdep.h"
 #include "cpu.h"
 #include "accel/tcg/cpu-ldst.h"
+#include "accel/tcg/probe.h"
 #include "exec/cputlb.h"
 #include "exec/page-protection.h"
 #include "exec/target_page.h"
diff --git a/target/mips/tcg/msa_helper.c b/target/mips/tcg/msa_helper.c
index e349344647..fde34a39e1 100644
--- a/target/mips/tcg/msa_helper.c
+++ b/target/mips/tcg/msa_helper.c
@@ -23,6 +23,7 @@
 #include "tcg/tcg.h"
 #include "exec/exec-all.h"
 #include "accel/tcg/cpu-ldst.h"
+#include "accel/tcg/probe.h"
 #include "exec/helper-proto.h"
 #include "exec/memop.h"
 #include "exec/target_page.h"
diff --git a/target/ppc/mem_helper.c b/target/ppc/mem_helper.c
index d7e8d678f4..50f05a915e 100644
--- a/target/ppc/mem_helper.c
+++ b/target/ppc/mem_helper.c
@@ -25,6 +25,7 @@
 #include "exec/helper-proto.h"
 #include "helper_regs.h"
 #include "accel/tcg/cpu-ldst.h"
+#include "accel/tcg/probe.h"
 #include "internal.h"
 #include "qemu/atomic128.h"
 
diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
index 5b0db2c45a..abb1d284dc 100644
--- a/target/riscv/op_helper.c
+++ b/target/riscv/op_helper.c
@@ -24,6 +24,7 @@
 #include "exec/exec-all.h"
 #include "exec/cputlb.h"
 #include "accel/tcg/cpu-ldst.h"
+#include "accel/tcg/probe.h"
 #include "exec/helper-proto.h"
 #include "exec/tlb-flags.h"
 #include "trace.h"
diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
index b8ae704457..5ccb294e31 100644
--- a/target/riscv/vector_helper.c
+++ b/target/riscv/vector_helper.c
@@ -23,6 +23,7 @@
 #include "exec/memop.h"
 #include "exec/exec-all.h"
 #include "accel/tcg/cpu-ldst.h"
+#include "accel/tcg/probe.h"
 #include "exec/page-protection.h"
 #include "exec/helper-proto.h"
 #include "exec/tlb-flags.h"
diff --git a/target/s390x/tcg/mem_helper.c b/target/s390x/tcg/mem_helper.c
index 0cdfd380ce..9e77cde81b 100644
--- a/target/s390x/tcg/mem_helper.c
+++ b/target/s390x/tcg/mem_helper.c
@@ -29,6 +29,7 @@
 #include "exec/cputlb.h"
 #include "exec/page-protection.h"
 #include "accel/tcg/cpu-ldst.h"
+#include "accel/tcg/probe.h"
 #include "exec/target_page.h"
 #include "exec/tlb-flags.h"
 #include "accel/tcg/cpu-ops.h"
diff --git a/target/xtensa/mmu_helper.c b/target/xtensa/mmu_helper.c
index a7dd810055..182c6e35c1 100644
--- a/target/xtensa/mmu_helper.c
+++ b/target/xtensa/mmu_helper.c
@@ -34,6 +34,7 @@
 #include "qemu/host-utils.h"
 #include "exec/cputlb.h"
 #include "accel/tcg/cpu-mmu-index.h"
+#include "accel/tcg/probe.h"
 #include "exec/exec-all.h"
 #include "exec/page-protection.h"
 #include "exec/target_page.h"

From 84307cd6027c4602913177ff09aeefa4743b7234 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 24 Apr 2025 22:24:12 +0200
Subject: [PATCH 0551/2760] include: Remove 'exec/exec-all.h'
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

"exec/exec-all.h" is now fully empty, let's remove it.

Mechanical change running:

  $ sed -i '/exec\/exec-all.h/d' $(git grep -wl exec/exec-all.h)

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250424202412.91612-14-philmd@linaro.org>
---
 MAINTAINERS                             |  1 -
 accel/hvf/hvf-accel-ops.c               |  1 -
 accel/tcg/cputlb.c                      |  1 -
 accel/tcg/translate-all.c               |  1 -
 accel/tcg/user-exec.c                   |  1 -
 bsd-user/main.c                         |  1 -
 bsd-user/qemu.h                         |  1 -
 hw/ppc/spapr_nested.c                   |  1 -
 hw/riscv/riscv-iommu-sys.c              |  1 -
 hw/sh4/sh7750.c                         |  1 -
 include/exec/exec-all.h                 | 23 -----------------------
 include/system/ram_addr.h               |  1 -
 linux-user/main.c                       |  1 -
 linux-user/user-internals.h             |  1 -
 semihosting/uaccess.c                   |  1 -
 system/physmem.c                        |  1 -
 target/alpha/cpu.c                      |  1 -
 target/alpha/fpu_helper.c               |  1 -
 target/alpha/int_helper.c               |  1 -
 target/alpha/mem_helper.c               |  1 -
 target/alpha/translate.c                |  1 -
 target/alpha/vax_helper.c               |  1 -
 target/arm/cpu.c                        |  1 -
 target/arm/debug_helper.c               |  1 -
 target/arm/helper.c                     |  1 -
 target/arm/ptw.c                        |  1 -
 target/arm/tcg/helper-a64.c             |  1 -
 target/arm/tcg/m_helper.c               |  1 -
 target/arm/tcg/mte_helper.c             |  1 -
 target/arm/tcg/mve_helper.c             |  1 -
 target/arm/tcg/op_helper.c              |  1 -
 target/arm/tcg/pauth_helper.c           |  1 -
 target/arm/tcg/sme_helper.c             |  1 -
 target/arm/tcg/sve_helper.c             |  1 -
 target/arm/tcg/tlb_helper.c             |  1 -
 target/arm/tcg/translate-a64.c          |  1 -
 target/arm/tcg/translate.h              |  1 -
 target/avr/cpu.c                        |  1 -
 target/avr/translate.c                  |  1 -
 target/hexagon/cpu.c                    |  1 -
 target/hexagon/op_helper.c              |  1 -
 target/hppa/cpu.c                       |  1 -
 target/hppa/fpu_helper.c                |  1 -
 target/hppa/helper.c                    |  1 -
 target/hppa/mem_helper.c                |  1 -
 target/hppa/op_helper.c                 |  1 -
 target/hppa/sys_helper.c                |  1 -
 target/hppa/translate.c                 |  1 -
 target/i386/tcg/access.c                |  1 -
 target/i386/tcg/excp_helper.c           |  1 -
 target/i386/tcg/helper-tcg.h            |  1 -
 target/i386/tcg/int_helper.c            |  1 -
 target/i386/tcg/mem_helper.c            |  1 -
 target/i386/tcg/mpx_helper.c            |  1 -
 target/i386/tcg/seg_helper.c            |  1 -
 target/i386/tcg/system/bpt_helper.c     |  1 -
 target/i386/tcg/translate.c             |  1 -
 target/i386/tcg/user/excp_helper.c      |  1 -
 target/i386/tcg/user/seg_helper.c       |  1 -
 target/loongarch/cpu.c                  |  1 -
 target/loongarch/tcg/fpu_helper.c       |  1 -
 target/loongarch/tcg/iocsr_helper.c     |  1 -
 target/loongarch/tcg/op_helper.c        |  1 -
 target/loongarch/tcg/tlb_helper.c       |  1 -
 target/loongarch/tcg/vec_helper.c       |  1 -
 target/m68k/fpu_helper.c                |  1 -
 target/m68k/helper.c                    |  1 -
 target/m68k/op_helper.c                 |  1 -
 target/m68k/translate.c                 |  1 -
 target/microblaze/cpu.c                 |  1 -
 target/microblaze/op_helper.c           |  1 -
 target/microblaze/translate.c           |  1 -
 target/mips/cpu.c                       |  1 -
 target/mips/system/physaddr.c           |  1 -
 target/mips/tcg/exception.c             |  1 -
 target/mips/tcg/fpu_helper.c            |  1 -
 target/mips/tcg/ldst_helper.c           |  1 -
 target/mips/tcg/msa_helper.c            |  1 -
 target/mips/tcg/op_helper.c             |  1 -
 target/mips/tcg/system/special_helper.c |  1 -
 target/mips/tcg/system/tlb_helper.c     |  1 -
 target/openrisc/cpu.c                   |  1 -
 target/openrisc/exception.c             |  1 -
 target/openrisc/exception_helper.c      |  1 -
 target/openrisc/fpu_helper.c            |  1 -
 target/openrisc/interrupt.c             |  1 -
 target/openrisc/interrupt_helper.c      |  1 -
 target/openrisc/sys_helper.c            |  1 -
 target/openrisc/translate.c             |  1 -
 target/ppc/excp_helper.c                |  1 -
 target/ppc/fpu_helper.c                 |  1 -
 target/ppc/machine.c                    |  1 -
 target/ppc/mem_helper.c                 |  1 -
 target/ppc/misc_helper.c                |  1 -
 target/ppc/mmu-hash32.c                 |  1 -
 target/ppc/mmu-hash64.c                 |  1 -
 target/ppc/mmu-radix64.c                |  1 -
 target/ppc/mmu_common.c                 |  1 -
 target/ppc/mmu_helper.c                 |  1 -
 target/ppc/power8-pmu.c                 |  1 -
 target/ppc/tcg-excp_helper.c            |  1 -
 target/ppc/timebase_helper.c            |  1 -
 target/ppc/translate.c                  |  1 -
 target/ppc/user_only_helper.c           |  1 -
 target/riscv/cpu.c                      |  1 -
 target/riscv/cpu_helper.c               |  1 -
 target/riscv/crypto_helper.c            |  1 -
 target/riscv/csr.c                      |  1 -
 target/riscv/debug.c                    |  1 -
 target/riscv/fpu_helper.c               |  1 -
 target/riscv/m128_helper.c              |  1 -
 target/riscv/op_helper.c                |  1 -
 target/riscv/tcg/tcg-cpu.c              |  1 -
 target/riscv/translate.c                |  1 -
 target/riscv/vcrypto_helper.c           |  1 -
 target/riscv/vector_helper.c            |  1 -
 target/riscv/zce_helper.c               |  1 -
 target/rx/op_helper.c                   |  1 -
 target/rx/translate.c                   |  1 -
 target/s390x/interrupt.c                |  1 -
 target/s390x/mmu_helper.c               |  1 -
 target/s390x/sigp.c                     |  1 -
 target/s390x/tcg/cc_helper.c            |  1 -
 target/s390x/tcg/crypto_helper.c        |  1 -
 target/s390x/tcg/excp_helper.c          |  1 -
 target/s390x/tcg/fpu_helper.c           |  1 -
 target/s390x/tcg/int_helper.c           |  1 -
 target/s390x/tcg/mem_helper.c           |  1 -
 target/s390x/tcg/misc_helper.c          |  1 -
 target/s390x/tcg/translate.c            |  1 -
 target/s390x/tcg/vec_fpu_helper.c       |  1 -
 target/s390x/tcg/vec_helper.c           |  1 -
 target/sh4/cpu.c                        |  1 -
 target/sh4/helper.c                     |  1 -
 target/sh4/op_helper.c                  |  1 -
 target/sh4/translate.c                  |  1 -
 target/sparc/cpu.c                      |  1 -
 target/sparc/fop_helper.c               |  1 -
 target/sparc/helper.c                   |  1 -
 target/sparc/ldst_helper.c              |  1 -
 target/sparc/machine.c                  |  1 -
 target/sparc/translate.c                |  1 -
 target/sparc/win_helper.c               |  1 -
 target/tricore/cpu.c                    |  1 -
 target/tricore/op_helper.c              |  1 -
 target/tricore/translate.c              |  1 -
 target/xtensa/dbg_helper.c              |  1 -
 target/xtensa/exc_helper.c              |  1 -
 target/xtensa/fpu_helper.c              |  1 -
 target/xtensa/mmu_helper.c              |  1 -
 target/xtensa/op_helper.c               |  1 -
 target/xtensa/translate.c               |  1 -
 target/xtensa/win_helper.c              |  1 -
 153 files changed, 175 deletions(-)
 delete mode 100644 include/exec/exec-all.h

diff --git a/MAINTAINERS b/MAINTAINERS
index f3f491c8c2..3706601ea5 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -493,7 +493,6 @@ M: Richard Henderson <richard.henderson@linaro.org>
 R: Paolo Bonzini <pbonzini@redhat.com>
 S: Maintained
 F: include/exec/cpu*.h
-F: include/exec/exec-all.h
 F: include/exec/target_long.h
 F: include/qemu/accel.h
 F: include/system/accel-*.h
diff --git a/accel/hvf/hvf-accel-ops.c b/accel/hvf/hvf-accel-ops.c
index 5375de7bcf..b8b6116bc8 100644
--- a/accel/hvf/hvf-accel-ops.c
+++ b/accel/hvf/hvf-accel-ops.c
@@ -51,7 +51,6 @@
 #include "qemu/error-report.h"
 #include "qemu/main-loop.h"
 #include "system/address-spaces.h"
-#include "exec/exec-all.h"
 #include "gdbstub/enums.h"
 #include "hw/boards.h"
 #include "system/accel-ops.h"
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index b346af942a..5b6d6f7975 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -22,7 +22,6 @@
 #include "accel/tcg/cpu-ops.h"
 #include "accel/tcg/iommu.h"
 #include "accel/tcg/probe.h"
-#include "exec/exec-all.h"
 #include "exec/page-protection.h"
 #include "system/memory.h"
 #include "accel/tcg/cpu-ldst.h"
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index 0408e2522a..31c7f9927f 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -21,7 +21,6 @@
 
 #include "trace.h"
 #include "disas/disas.h"
-#include "exec/exec-all.h"
 #include "tcg/tcg.h"
 #if defined(CONFIG_USER_ONLY)
 #include "qemu.h"
diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index 697fdf1824..70feee8df9 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -21,7 +21,6 @@
 #include "disas/disas.h"
 #include "cpu.h"
 #include "exec/vaddr.h"
-#include "exec/exec-all.h"
 #include "exec/tlb-flags.h"
 #include "tcg/tcg.h"
 #include "qemu/bitops.h"
diff --git a/bsd-user/main.c b/bsd-user/main.c
index fdb160bed0..fa7645a56e 100644
--- a/bsd-user/main.c
+++ b/bsd-user/main.c
@@ -36,7 +36,6 @@
 #include "qemu/help_option.h"
 #include "qemu/module.h"
 #include "qemu/plugin.h"
-#include "exec/exec-all.h"
 #include "user/guest-base.h"
 #include "user/page-protection.h"
 #include "tcg/startup.h"
diff --git a/bsd-user/qemu.h b/bsd-user/qemu.h
index 244670dd24..93388e7c34 100644
--- a/bsd-user/qemu.h
+++ b/bsd-user/qemu.h
@@ -23,7 +23,6 @@
 #include "cpu.h"
 #include "qemu/units.h"
 #include "accel/tcg/cpu-ldst.h"
-#include "exec/exec-all.h"
 
 #include "user/abitypes.h"
 #include "user/cpu_loop.h"
diff --git a/hw/ppc/spapr_nested.c b/hw/ppc/spapr_nested.c
index 820f752b9e..10cf634da1 100644
--- a/hw/ppc/spapr_nested.c
+++ b/hw/ppc/spapr_nested.c
@@ -1,6 +1,5 @@
 #include "qemu/osdep.h"
 #include "qemu/cutils.h"
-#include "exec/exec-all.h"
 #include "exec/cputlb.h"
 #include "exec/target_long.h"
 #include "helper_regs.h"
diff --git a/hw/riscv/riscv-iommu-sys.c b/hw/riscv/riscv-iommu-sys.c
index be2e3944dc..74e76b94a5 100644
--- a/hw/riscv/riscv-iommu-sys.c
+++ b/hw/riscv/riscv-iommu-sys.c
@@ -26,7 +26,6 @@
 #include "qemu/host-utils.h"
 #include "qemu/module.h"
 #include "qom/object.h"
-#include "exec/exec-all.h"
 #include "trace.h"
 
 #include "riscv-iommu.h"
diff --git a/hw/sh4/sh7750.c b/hw/sh4/sh7750.c
index 41306fb600..300eabc595 100644
--- a/hw/sh4/sh7750.c
+++ b/hw/sh4/sh7750.c
@@ -36,7 +36,6 @@
 #include "sh7750_regnames.h"
 #include "hw/sh4/sh_intc.h"
 #include "hw/timer/tmu012.h"
-#include "exec/exec-all.h"
 #include "exec/cputlb.h"
 #include "trace.h"
 
diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
deleted file mode 100644
index 9ef7569a0b..0000000000
--- a/include/exec/exec-all.h
+++ /dev/null
@@ -1,23 +0,0 @@
-/*
- * internal execution defines for qemu
- *
- *  Copyright (c) 2003 Fabrice Bellard
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, see <http://www.gnu.org/licenses/>.
- */
-
-#ifndef EXEC_ALL_H
-#define EXEC_ALL_H
-
-#endif
diff --git a/include/system/ram_addr.h b/include/system/ram_addr.h
index b4e4425acb..15a1b1a4fa 100644
--- a/include/system/ram_addr.h
+++ b/include/system/ram_addr.h
@@ -24,7 +24,6 @@
 #include "exec/cputlb.h"
 #include "exec/ramlist.h"
 #include "system/ramblock.h"
-#include "exec/exec-all.h"
 #include "system/memory.h"
 #include "exec/target_page.h"
 #include "qemu/rcu.h"
diff --git a/linux-user/main.c b/linux-user/main.c
index e2ec5970be..4af7f49f38 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -40,7 +40,6 @@
 #include "qemu/plugin.h"
 #include "user/guest-base.h"
 #include "user/page-protection.h"
-#include "exec/exec-all.h"
 #include "exec/gdbstub.h"
 #include "gdbstub/user.h"
 #include "tcg/startup.h"
diff --git a/linux-user/user-internals.h b/linux-user/user-internals.h
index 4aa253b566..691b9a1775 100644
--- a/linux-user/user-internals.h
+++ b/linux-user/user-internals.h
@@ -19,7 +19,6 @@
 #define LINUX_USER_USER_INTERNALS_H
 
 #include "user/thunk.h"
-#include "exec/exec-all.h"
 #include "qemu/log.h"
 
 extern char *exec_path;
diff --git a/semihosting/uaccess.c b/semihosting/uaccess.c
index ebbb300f86..4554844e15 100644
--- a/semihosting/uaccess.c
+++ b/semihosting/uaccess.c
@@ -10,7 +10,6 @@
 #include "qemu/osdep.h"
 #include "accel/tcg/cpu-mmu-index.h"
 #include "accel/tcg/probe.h"
-#include "exec/exec-all.h"
 #include "exec/target_page.h"
 #include "exec/tlb-flags.h"
 #include "semihosting/uaccess.h"
diff --git a/system/physmem.c b/system/physmem.c
index f1ec0902c7..3f4fd69d9a 100644
--- a/system/physmem.c
+++ b/system/physmem.c
@@ -32,7 +32,6 @@
 #include "accel/tcg/iommu.h"
 #endif /* CONFIG_TCG */
 
-#include "exec/exec-all.h"
 #include "exec/cputlb.h"
 #include "exec/page-protection.h"
 #include "exec/target_page.h"
diff --git a/target/alpha/cpu.c b/target/alpha/cpu.c
index 27e2008a4e..68414af8d3 100644
--- a/target/alpha/cpu.c
+++ b/target/alpha/cpu.c
@@ -23,7 +23,6 @@
 #include "qapi/error.h"
 #include "qemu/qemu-print.h"
 #include "cpu.h"
-#include "exec/exec-all.h"
 #include "exec/translation-block.h"
 #include "exec/target_page.h"
 #include "fpu/softfloat.h"
diff --git a/target/alpha/fpu_helper.c b/target/alpha/fpu_helper.c
index 6aefb9b851..30f3c7fd18 100644
--- a/target/alpha/fpu_helper.c
+++ b/target/alpha/fpu_helper.c
@@ -19,7 +19,6 @@
 
 #include "qemu/osdep.h"
 #include "cpu.h"
-#include "exec/exec-all.h"
 #include "exec/helper-proto.h"
 #include "fpu/softfloat.h"
 
diff --git a/target/alpha/int_helper.c b/target/alpha/int_helper.c
index 5672696f6f..6bfe63500e 100644
--- a/target/alpha/int_helper.c
+++ b/target/alpha/int_helper.c
@@ -19,7 +19,6 @@
 
 #include "qemu/osdep.h"
 #include "cpu.h"
-#include "exec/exec-all.h"
 #include "exec/helper-proto.h"
 #include "qemu/host-utils.h"
 
diff --git a/target/alpha/mem_helper.c b/target/alpha/mem_helper.c
index a4d5adb40c..2113fe33ae 100644
--- a/target/alpha/mem_helper.c
+++ b/target/alpha/mem_helper.c
@@ -20,7 +20,6 @@
 #include "qemu/osdep.h"
 #include "cpu.h"
 #include "exec/helper-proto.h"
-#include "exec/exec-all.h"
 #include "accel/tcg/cpu-ldst.h"
 
 static void do_unaligned_access(CPUAlphaState *env, vaddr addr, uintptr_t retaddr)
diff --git a/target/alpha/translate.c b/target/alpha/translate.c
index 7f3195a5dc..cebab0318c 100644
--- a/target/alpha/translate.c
+++ b/target/alpha/translate.c
@@ -21,7 +21,6 @@
 #include "cpu.h"
 #include "system/cpus.h"
 #include "qemu/host-utils.h"
-#include "exec/exec-all.h"
 #include "tcg/tcg-op.h"
 #include "exec/helper-proto.h"
 #include "exec/helper-gen.h"
diff --git a/target/alpha/vax_helper.c b/target/alpha/vax_helper.c
index f94fb519db..c1d201e7b4 100644
--- a/target/alpha/vax_helper.c
+++ b/target/alpha/vax_helper.c
@@ -19,7 +19,6 @@
 
 #include "qemu/osdep.h"
 #include "cpu.h"
-#include "exec/exec-all.h"
 #include "exec/helper-proto.h"
 #include "fpu/softfloat.h"
 
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index 5e951675c6..7b801eb3aa 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -33,7 +33,6 @@
 #endif /* CONFIG_TCG */
 #include "internals.h"
 #include "cpu-features.h"
-#include "exec/exec-all.h"
 #include "exec/target_page.h"
 #include "hw/qdev-properties.h"
 #if !defined(CONFIG_USER_ONLY)
diff --git a/target/arm/debug_helper.c b/target/arm/debug_helper.c
index 473ee2af38..de7999f6a9 100644
--- a/target/arm/debug_helper.c
+++ b/target/arm/debug_helper.c
@@ -11,7 +11,6 @@
 #include "internals.h"
 #include "cpu-features.h"
 #include "cpregs.h"
-#include "exec/exec-all.h"
 #include "exec/helper-proto.h"
 #include "exec/watchpoint.h"
 #include "system/tcg.h"
diff --git a/target/arm/helper.c b/target/arm/helper.c
index 2f039b2db3..8de4eb2c1f 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -20,7 +20,6 @@
 #include "qemu/bitops.h"
 #include "qemu/qemu-print.h"
 #include "exec/cputlb.h"
-#include "exec/exec-all.h"
 #include "exec/translation-block.h"
 #include "hw/irq.h"
 #include "system/cpu-timers.h"
diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index 87d707b592..1040a18962 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -10,7 +10,6 @@
 #include "qemu/log.h"
 #include "qemu/range.h"
 #include "qemu/main-loop.h"
-#include "exec/exec-all.h"
 #include "exec/page-protection.h"
 #include "exec/target_page.h"
 #include "exec/tlb-flags.h"
diff --git a/target/arm/tcg/helper-a64.c b/target/arm/tcg/helper-a64.c
index cfe5faba19..9cffda07cd 100644
--- a/target/arm/tcg/helper-a64.c
+++ b/target/arm/tcg/helper-a64.c
@@ -29,7 +29,6 @@
 #include "internals.h"
 #include "qemu/crc32c.h"
 #include "exec/cpu-common.h"
-#include "exec/exec-all.h"
 #include "accel/tcg/cpu-ldst.h"
 #include "accel/tcg/probe.h"
 #include "exec/target_page.h"
diff --git a/target/arm/tcg/m_helper.c b/target/arm/tcg/m_helper.c
index 37dc98dc35..6614719832 100644
--- a/target/arm/tcg/m_helper.c
+++ b/target/arm/tcg/m_helper.c
@@ -15,7 +15,6 @@
 #include "qemu/main-loop.h"
 #include "qemu/bitops.h"
 #include "qemu/log.h"
-#include "exec/exec-all.h"
 #include "exec/page-protection.h"
 #ifdef CONFIG_TCG
 #include "accel/tcg/cpu-ldst.h"
diff --git a/target/arm/tcg/mte_helper.c b/target/arm/tcg/mte_helper.c
index 8fbdcc8fb9..13d7ac0097 100644
--- a/target/arm/tcg/mte_helper.c
+++ b/target/arm/tcg/mte_helper.c
@@ -21,7 +21,6 @@
 #include "qemu/log.h"
 #include "cpu.h"
 #include "internals.h"
-#include "exec/exec-all.h"
 #include "exec/page-protection.h"
 #ifdef CONFIG_USER_ONLY
 #include "user/cpu_loop.h"
diff --git a/target/arm/tcg/mve_helper.c b/target/arm/tcg/mve_helper.c
index f9f67d1f88..506d1c3475 100644
--- a/target/arm/tcg/mve_helper.c
+++ b/target/arm/tcg/mve_helper.c
@@ -23,7 +23,6 @@
 #include "vec_internal.h"
 #include "exec/helper-proto.h"
 #include "accel/tcg/cpu-ldst.h"
-#include "exec/exec-all.h"
 #include "tcg/tcg.h"
 #include "fpu/softfloat.h"
 #include "crypto/clmul.h"
diff --git a/target/arm/tcg/op_helper.c b/target/arm/tcg/op_helper.c
index d50b8720ad..dc3f83c37d 100644
--- a/target/arm/tcg/op_helper.c
+++ b/target/arm/tcg/op_helper.c
@@ -23,7 +23,6 @@
 #include "exec/target_page.h"
 #include "internals.h"
 #include "cpu-features.h"
-#include "exec/exec-all.h"
 #include "accel/tcg/cpu-ldst.h"
 #include "accel/tcg/probe.h"
 #include "cpregs.h"
diff --git a/target/arm/tcg/pauth_helper.c b/target/arm/tcg/pauth_helper.c
index 59bf27541d..c591c3052c 100644
--- a/target/arm/tcg/pauth_helper.c
+++ b/target/arm/tcg/pauth_helper.c
@@ -21,7 +21,6 @@
 #include "cpu.h"
 #include "internals.h"
 #include "cpu-features.h"
-#include "exec/exec-all.h"
 #include "accel/tcg/cpu-ldst.h"
 #include "exec/helper-proto.h"
 #include "tcg/tcg-gvec-desc.h"
diff --git a/target/arm/tcg/sme_helper.c b/target/arm/tcg/sme_helper.c
index 96b84c37a2..3226895cae 100644
--- a/target/arm/tcg/sme_helper.c
+++ b/target/arm/tcg/sme_helper.c
@@ -23,7 +23,6 @@
 #include "tcg/tcg-gvec-desc.h"
 #include "exec/helper-proto.h"
 #include "accel/tcg/cpu-ldst.h"
-#include "exec/exec-all.h"
 #include "qemu/int128.h"
 #include "fpu/softfloat.h"
 #include "vec_internal.h"
diff --git a/target/arm/tcg/sve_helper.c b/target/arm/tcg/sve_helper.c
index 50aca54eaa..9f20ecb51d 100644
--- a/target/arm/tcg/sve_helper.c
+++ b/target/arm/tcg/sve_helper.c
@@ -20,7 +20,6 @@
 #include "qemu/osdep.h"
 #include "cpu.h"
 #include "internals.h"
-#include "exec/exec-all.h"
 #include "exec/page-protection.h"
 #include "exec/helper-proto.h"
 #include "exec/target_page.h"
diff --git a/target/arm/tcg/tlb_helper.c b/target/arm/tcg/tlb_helper.c
index 8841f039bc..5ea4d6590f 100644
--- a/target/arm/tcg/tlb_helper.c
+++ b/target/arm/tcg/tlb_helper.c
@@ -9,7 +9,6 @@
 #include "cpu.h"
 #include "internals.h"
 #include "cpu-features.h"
-#include "exec/exec-all.h"
 #include "exec/helper-proto.h"
 
 
diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index d9305f9d26..52cf47e775 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -17,7 +17,6 @@
  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  */
 #include "qemu/osdep.h"
-#include "exec/exec-all.h"
 #include "exec/target_page.h"
 #include "translate.h"
 #include "translate-a64.h"
diff --git a/target/arm/tcg/translate.h b/target/arm/tcg/translate.h
index 53e485d28a..1bfdb0fb9b 100644
--- a/target/arm/tcg/translate.h
+++ b/target/arm/tcg/translate.h
@@ -4,7 +4,6 @@
 #include "cpu.h"
 #include "tcg/tcg-op.h"
 #include "tcg/tcg-op-gvec.h"
-#include "exec/exec-all.h"
 #include "exec/translator.h"
 #include "exec/translation-block.h"
 #include "exec/helper-gen.h"
diff --git a/target/avr/cpu.c b/target/avr/cpu.c
index 3f261c6fec..69fface7e9 100644
--- a/target/avr/cpu.c
+++ b/target/avr/cpu.c
@@ -21,7 +21,6 @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "qemu/qemu-print.h"
-#include "exec/exec-all.h"
 #include "exec/translation-block.h"
 #include "system/address-spaces.h"
 #include "cpu.h"
diff --git a/target/avr/translate.c b/target/avr/translate.c
index b9c592c899..804b0b21db 100644
--- a/target/avr/translate.c
+++ b/target/avr/translate.c
@@ -22,7 +22,6 @@
 #include "qemu/qemu-print.h"
 #include "tcg/tcg.h"
 #include "cpu.h"
-#include "exec/exec-all.h"
 #include "exec/translation-block.h"
 #include "tcg/tcg-op.h"
 #include "exec/helper-proto.h"
diff --git a/target/hexagon/cpu.c b/target/hexagon/cpu.c
index a5d31c33bd..c1bfa80252 100644
--- a/target/hexagon/cpu.c
+++ b/target/hexagon/cpu.c
@@ -19,7 +19,6 @@
 #include "qemu/qemu-print.h"
 #include "cpu.h"
 #include "internal.h"
-#include "exec/exec-all.h"
 #include "exec/translation-block.h"
 #include "qapi/error.h"
 #include "hw/qdev-properties.h"
diff --git a/target/hexagon/op_helper.c b/target/hexagon/op_helper.c
index dd726b4318..444799d3ad 100644
--- a/target/hexagon/op_helper.c
+++ b/target/hexagon/op_helper.c
@@ -17,7 +17,6 @@
 
 #include "qemu/osdep.h"
 #include "qemu/log.h"
-#include "exec/exec-all.h"
 #include "accel/tcg/cpu-ldst.h"
 #include "accel/tcg/probe.h"
 #include "exec/helper-proto.h"
diff --git a/target/hppa/cpu.c b/target/hppa/cpu.c
index b792cb247a..b083693b57 100644
--- a/target/hppa/cpu.c
+++ b/target/hppa/cpu.c
@@ -24,7 +24,6 @@
 #include "qemu/timer.h"
 #include "cpu.h"
 #include "qemu/module.h"
-#include "exec/exec-all.h"
 #include "exec/translation-block.h"
 #include "exec/target_page.h"
 #include "fpu/softfloat.h"
diff --git a/target/hppa/fpu_helper.c b/target/hppa/fpu_helper.c
index a62d9d3083..ddd0a343d6 100644
--- a/target/hppa/fpu_helper.c
+++ b/target/hppa/fpu_helper.c
@@ -19,7 +19,6 @@
 
 #include "qemu/osdep.h"
 #include "cpu.h"
-#include "exec/exec-all.h"
 #include "exec/helper-proto.h"
 #include "fpu/softfloat.h"
 
diff --git a/target/hppa/helper.c b/target/hppa/helper.c
index ac7f58f0af..d7f8495d98 100644
--- a/target/hppa/helper.c
+++ b/target/hppa/helper.c
@@ -21,7 +21,6 @@
 #include "qemu/log.h"
 #include "cpu.h"
 #include "fpu/softfloat.h"
-#include "exec/exec-all.h"
 #include "exec/helper-proto.h"
 #include "qemu/qemu-print.h"
 #include "hw/hppa/hppa_hardware.h"
diff --git a/target/hppa/mem_helper.c b/target/hppa/mem_helper.c
index a5f73aedf8..9bdd0a6f23 100644
--- a/target/hppa/mem_helper.c
+++ b/target/hppa/mem_helper.c
@@ -20,7 +20,6 @@
 #include "qemu/osdep.h"
 #include "qemu/log.h"
 #include "cpu.h"
-#include "exec/exec-all.h"
 #include "exec/cputlb.h"
 #include "accel/tcg/cpu-mmu-index.h"
 #include "accel/tcg/probe.h"
diff --git a/target/hppa/op_helper.c b/target/hppa/op_helper.c
index 32207c1a4c..0458378abb 100644
--- a/target/hppa/op_helper.c
+++ b/target/hppa/op_helper.c
@@ -20,7 +20,6 @@
 #include "qemu/osdep.h"
 #include "qemu/log.h"
 #include "cpu.h"
-#include "exec/exec-all.h"
 #include "exec/helper-proto.h"
 #include "accel/tcg/cpu-ldst.h"
 #include "accel/tcg/probe.h"
diff --git a/target/hppa/sys_helper.c b/target/hppa/sys_helper.c
index 052a6a88a2..6e65fadcc7 100644
--- a/target/hppa/sys_helper.c
+++ b/target/hppa/sys_helper.c
@@ -20,7 +20,6 @@
 #include "qemu/osdep.h"
 #include "qemu/log.h"
 #include "cpu.h"
-#include "exec/exec-all.h"
 #include "exec/helper-proto.h"
 #include "qemu/timer.h"
 #include "system/runstate.h"
diff --git a/target/hppa/translate.c b/target/hppa/translate.c
index 88a7d339eb..7a81cfcb88 100644
--- a/target/hppa/translate.c
+++ b/target/hppa/translate.c
@@ -20,7 +20,6 @@
 #include "qemu/osdep.h"
 #include "cpu.h"
 #include "qemu/host-utils.h"
-#include "exec/exec-all.h"
 #include "exec/page-protection.h"
 #include "tcg/tcg-op.h"
 #include "tcg/tcg-op-gvec.h"
diff --git a/target/i386/tcg/access.c b/target/i386/tcg/access.c
index ee5b451459..97e3f0e756 100644
--- a/target/i386/tcg/access.c
+++ b/target/i386/tcg/access.c
@@ -5,7 +5,6 @@
 #include "cpu.h"
 #include "accel/tcg/cpu-ldst.h"
 #include "accel/tcg/probe.h"
-#include "exec/exec-all.h"
 #include "exec/target_page.h"
 #include "access.h"
 
diff --git a/target/i386/tcg/excp_helper.c b/target/i386/tcg/excp_helper.c
index de71e68f98..6fb8036d98 100644
--- a/target/i386/tcg/excp_helper.c
+++ b/target/i386/tcg/excp_helper.c
@@ -19,7 +19,6 @@
 
 #include "qemu/osdep.h"
 #include "cpu.h"
-#include "exec/exec-all.h"
 #include "qemu/log.h"
 #include "system/runstate.h"
 #include "exec/helper-proto.h"
diff --git a/target/i386/tcg/helper-tcg.h b/target/i386/tcg/helper-tcg.h
index 54d845379c..6b3f19855f 100644
--- a/target/i386/tcg/helper-tcg.h
+++ b/target/i386/tcg/helper-tcg.h
@@ -20,7 +20,6 @@
 #ifndef I386_HELPER_TCG_H
 #define I386_HELPER_TCG_H
 
-#include "exec/exec-all.h"
 #include "qemu/host-utils.h"
 
 /* Maximum instruction code size */
diff --git a/target/i386/tcg/int_helper.c b/target/i386/tcg/int_helper.c
index 1a02e9d843..46741d9f68 100644
--- a/target/i386/tcg/int_helper.c
+++ b/target/i386/tcg/int_helper.c
@@ -20,7 +20,6 @@
 #include "qemu/osdep.h"
 #include "qemu/log.h"
 #include "cpu.h"
-#include "exec/exec-all.h"
 #include "qemu/host-utils.h"
 #include "exec/helper-proto.h"
 #include "qapi/error.h"
diff --git a/target/i386/tcg/mem_helper.c b/target/i386/tcg/mem_helper.c
index 84a0815217..9e7c2d8029 100644
--- a/target/i386/tcg/mem_helper.c
+++ b/target/i386/tcg/mem_helper.c
@@ -20,7 +20,6 @@
 #include "qemu/osdep.h"
 #include "cpu.h"
 #include "exec/helper-proto.h"
-#include "exec/exec-all.h"
 #include "accel/tcg/cpu-ldst.h"
 #include "qemu/int128.h"
 #include "qemu/atomic128.h"
diff --git a/target/i386/tcg/mpx_helper.c b/target/i386/tcg/mpx_helper.c
index a0f816dfae..fa8abcc482 100644
--- a/target/i386/tcg/mpx_helper.c
+++ b/target/i386/tcg/mpx_helper.c
@@ -21,7 +21,6 @@
 #include "cpu.h"
 #include "exec/helper-proto.h"
 #include "accel/tcg/cpu-ldst.h"
-#include "exec/exec-all.h"
 #include "exec/target_page.h"
 #include "helper-tcg.h"
 
diff --git a/target/i386/tcg/seg_helper.c b/target/i386/tcg/seg_helper.c
index e45d71fa1a..0ca081b286 100644
--- a/target/i386/tcg/seg_helper.c
+++ b/target/i386/tcg/seg_helper.c
@@ -22,7 +22,6 @@
 #include "cpu.h"
 #include "qemu/log.h"
 #include "exec/helper-proto.h"
-#include "exec/exec-all.h"
 #include "accel/tcg/cpu-ldst.h"
 #include "accel/tcg/probe.h"
 #include "exec/log.h"
diff --git a/target/i386/tcg/system/bpt_helper.c b/target/i386/tcg/system/bpt_helper.c
index 08ccd3f5e6..aebb5caac3 100644
--- a/target/i386/tcg/system/bpt_helper.c
+++ b/target/i386/tcg/system/bpt_helper.c
@@ -19,7 +19,6 @@
 
 #include "qemu/osdep.h"
 #include "cpu.h"
-#include "exec/exec-all.h"
 #include "exec/helper-proto.h"
 #include "exec/watchpoint.h"
 #include "tcg/helper-tcg.h"
diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
index 8a641951cd..8c3023407d 100644
--- a/target/i386/tcg/translate.c
+++ b/target/i386/tcg/translate.c
@@ -21,7 +21,6 @@
 #include "qemu/host-utils.h"
 #include "cpu.h"
 #include "accel/tcg/cpu-mmu-index.h"
-#include "exec/exec-all.h"
 #include "exec/translation-block.h"
 #include "tcg/tcg-op.h"
 #include "tcg/tcg-op-gvec.h"
diff --git a/target/i386/tcg/user/excp_helper.c b/target/i386/tcg/user/excp_helper.c
index b3bdb7831a..98fab4cbc3 100644
--- a/target/i386/tcg/user/excp_helper.c
+++ b/target/i386/tcg/user/excp_helper.c
@@ -19,7 +19,6 @@
 
 #include "qemu/osdep.h"
 #include "cpu.h"
-#include "exec/exec-all.h"
 #include "tcg/helper-tcg.h"
 
 void x86_cpu_record_sigsegv(CPUState *cs, vaddr addr,
diff --git a/target/i386/tcg/user/seg_helper.c b/target/i386/tcg/user/seg_helper.c
index 5692dd5195..263f59937f 100644
--- a/target/i386/tcg/user/seg_helper.c
+++ b/target/i386/tcg/user/seg_helper.c
@@ -21,7 +21,6 @@
 #include "qemu/osdep.h"
 #include "cpu.h"
 #include "exec/helper-proto.h"
-#include "exec/exec-all.h"
 #include "accel/tcg/cpu-ldst.h"
 #include "tcg/helper-tcg.h"
 #include "tcg/seg_helper.h"
diff --git a/target/loongarch/cpu.c b/target/loongarch/cpu.c
index 8ad45b453d..c083ad4fd9 100644
--- a/target/loongarch/cpu.c
+++ b/target/loongarch/cpu.c
@@ -15,7 +15,6 @@
 #include "system/kvm.h"
 #include "kvm/kvm_loongarch.h"
 #include "hw/qdev-properties.h"
-#include "exec/exec-all.h"
 #include "exec/translation-block.h"
 #include "cpu.h"
 #include "internals.h"
diff --git a/target/loongarch/tcg/fpu_helper.c b/target/loongarch/tcg/fpu_helper.c
index fc3fd0561e..fc9c64c20a 100644
--- a/target/loongarch/tcg/fpu_helper.c
+++ b/target/loongarch/tcg/fpu_helper.c
@@ -8,7 +8,6 @@
 #include "qemu/osdep.h"
 #include "cpu.h"
 #include "exec/helper-proto.h"
-#include "exec/exec-all.h"
 #include "accel/tcg/cpu-ldst.h"
 #include "fpu/softfloat.h"
 #include "internals.h"
diff --git a/target/loongarch/tcg/iocsr_helper.c b/target/loongarch/tcg/iocsr_helper.c
index e62170de3c..c155f48564 100644
--- a/target/loongarch/tcg/iocsr_helper.c
+++ b/target/loongarch/tcg/iocsr_helper.c
@@ -9,7 +9,6 @@
 #include "cpu.h"
 #include "qemu/host-utils.h"
 #include "exec/helper-proto.h"
-#include "exec/exec-all.h"
 #include "accel/tcg/cpu-ldst.h"
 
 #define GET_MEMTXATTRS(cas) \
diff --git a/target/loongarch/tcg/op_helper.c b/target/loongarch/tcg/op_helper.c
index 94e3b28016..16ac0d43bc 100644
--- a/target/loongarch/tcg/op_helper.c
+++ b/target/loongarch/tcg/op_helper.c
@@ -10,7 +10,6 @@
 #include "cpu.h"
 #include "qemu/host-utils.h"
 #include "exec/helper-proto.h"
-#include "exec/exec-all.h"
 #include "accel/tcg/cpu-ldst.h"
 #include "internals.h"
 #include "qemu/crc32c.h"
diff --git a/target/loongarch/tcg/tlb_helper.c b/target/loongarch/tcg/tlb_helper.c
index af208d75ae..dc48b0f4d2 100644
--- a/target/loongarch/tcg/tlb_helper.c
+++ b/target/loongarch/tcg/tlb_helper.c
@@ -13,7 +13,6 @@
 #include "internals.h"
 #include "exec/helper-proto.h"
 #include "exec/cputlb.h"
-#include "exec/exec-all.h"
 #include "exec/page-protection.h"
 #include "exec/target_page.h"
 #include "accel/tcg/cpu-ldst.h"
diff --git a/target/loongarch/tcg/vec_helper.c b/target/loongarch/tcg/vec_helper.c
index 3faf52cbc4..a270998e63 100644
--- a/target/loongarch/tcg/vec_helper.c
+++ b/target/loongarch/tcg/vec_helper.c
@@ -7,7 +7,6 @@
 
 #include "qemu/osdep.h"
 #include "cpu.h"
-#include "exec/exec-all.h"
 #include "exec/helper-proto.h"
 #include "fpu/softfloat.h"
 #include "internals.h"
diff --git a/target/m68k/fpu_helper.c b/target/m68k/fpu_helper.c
index ac4a0d85be..56012863c8 100644
--- a/target/m68k/fpu_helper.c
+++ b/target/m68k/fpu_helper.c
@@ -21,7 +21,6 @@
 #include "qemu/osdep.h"
 #include "cpu.h"
 #include "exec/helper-proto.h"
-#include "exec/exec-all.h"
 #include "accel/tcg/cpu-ldst.h"
 #include "softfloat.h"
 
diff --git a/target/m68k/helper.c b/target/m68k/helper.c
index 3b880dd4d9..15f110fa7a 100644
--- a/target/m68k/helper.c
+++ b/target/m68k/helper.c
@@ -21,7 +21,6 @@
 #include "qemu/osdep.h"
 #include "cpu.h"
 #include "exec/cputlb.h"
-#include "exec/exec-all.h"
 #include "exec/page-protection.h"
 #include "exec/target_page.h"
 #include "exec/gdbstub.h"
diff --git a/target/m68k/op_helper.c b/target/m68k/op_helper.c
index 242aecccbb..f29ae12af8 100644
--- a/target/m68k/op_helper.c
+++ b/target/m68k/op_helper.c
@@ -20,7 +20,6 @@
 #include "qemu/log.h"
 #include "cpu.h"
 #include "exec/helper-proto.h"
-#include "exec/exec-all.h"
 #include "accel/tcg/cpu-ldst.h"
 #include "semihosting/semihost.h"
 
diff --git a/target/m68k/translate.c b/target/m68k/translate.c
index b1266a7875..97afceb129 100644
--- a/target/m68k/translate.c
+++ b/target/m68k/translate.c
@@ -20,7 +20,6 @@
 
 #include "qemu/osdep.h"
 #include "cpu.h"
-#include "exec/exec-all.h"
 #include "exec/translation-block.h"
 #include "exec/target_page.h"
 #include "tcg/tcg-op.h"
diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
index 00a2730de4..2720e5c1d2 100644
--- a/target/microblaze/cpu.c
+++ b/target/microblaze/cpu.c
@@ -27,7 +27,6 @@
 #include "cpu.h"
 #include "qemu/module.h"
 #include "hw/qdev-properties.h"
-#include "exec/exec-all.h"
 #include "accel/tcg/cpu-ldst.h"
 #include "exec/gdbstub.h"
 #include "exec/translation-block.h"
diff --git a/target/microblaze/op_helper.c b/target/microblaze/op_helper.c
index 4624ce5b67..9e838dfa15 100644
--- a/target/microblaze/op_helper.c
+++ b/target/microblaze/op_helper.c
@@ -23,7 +23,6 @@
 #include "cpu.h"
 #include "exec/helper-proto.h"
 #include "qemu/host-utils.h"
-#include "exec/exec-all.h"
 #include "accel/tcg/cpu-ldst.h"
 #include "fpu/softfloat.h"
 
diff --git a/target/microblaze/translate.c b/target/microblaze/translate.c
index 23f1037236..671b1ae4db 100644
--- a/target/microblaze/translate.c
+++ b/target/microblaze/translate.c
@@ -20,7 +20,6 @@
 
 #include "qemu/osdep.h"
 #include "cpu.h"
-#include "exec/exec-all.h"
 #include "accel/tcg/cpu-ldst.h"
 #include "tcg/tcg-op.h"
 #include "exec/helper-proto.h"
diff --git a/target/mips/cpu.c b/target/mips/cpu.c
index d13361a150..96fe4da255 100644
--- a/target/mips/cpu.c
+++ b/target/mips/cpu.c
@@ -29,7 +29,6 @@
 #include "qemu/module.h"
 #include "system/kvm.h"
 #include "system/qtest.h"
-#include "exec/exec-all.h"
 #include "hw/qdev-properties.h"
 #include "hw/qdev-clock.h"
 #include "fpu_helper.h"
diff --git a/target/mips/system/physaddr.c b/target/mips/system/physaddr.c
index 505781d84c..b8e1a5ac98 100644
--- a/target/mips/system/physaddr.c
+++ b/target/mips/system/physaddr.c
@@ -18,7 +18,6 @@
  */
 #include "qemu/osdep.h"
 #include "cpu.h"
-#include "exec/exec-all.h"
 #include "exec/page-protection.h"
 #include "../internal.h"
 
diff --git a/target/mips/tcg/exception.c b/target/mips/tcg/exception.c
index 1a8902ea1b..d32bcebf46 100644
--- a/target/mips/tcg/exception.c
+++ b/target/mips/tcg/exception.c
@@ -23,7 +23,6 @@
 #include "cpu.h"
 #include "internal.h"
 #include "exec/helper-proto.h"
-#include "exec/exec-all.h"
 #include "exec/translation-block.h"
 
 target_ulong exception_resume_pc(CPUMIPSState *env)
diff --git a/target/mips/tcg/fpu_helper.c b/target/mips/tcg/fpu_helper.c
index 45d593de48..36af980802 100644
--- a/target/mips/tcg/fpu_helper.c
+++ b/target/mips/tcg/fpu_helper.c
@@ -24,7 +24,6 @@
 #include "cpu.h"
 #include "internal.h"
 #include "exec/helper-proto.h"
-#include "exec/exec-all.h"
 #include "fpu/softfloat.h"
 #include "fpu_helper.h"
 
diff --git a/target/mips/tcg/ldst_helper.c b/target/mips/tcg/ldst_helper.c
index 2fb879fcbc..10319bf03a 100644
--- a/target/mips/tcg/ldst_helper.c
+++ b/target/mips/tcg/ldst_helper.c
@@ -23,7 +23,6 @@
 #include "qemu/osdep.h"
 #include "cpu.h"
 #include "exec/helper-proto.h"
-#include "exec/exec-all.h"
 #include "accel/tcg/cpu-ldst.h"
 #include "exec/memop.h"
 #include "internal.h"
diff --git a/target/mips/tcg/msa_helper.c b/target/mips/tcg/msa_helper.c
index fde34a39e1..f554b3d10e 100644
--- a/target/mips/tcg/msa_helper.c
+++ b/target/mips/tcg/msa_helper.c
@@ -21,7 +21,6 @@
 #include "cpu.h"
 #include "internal.h"
 #include "tcg/tcg.h"
-#include "exec/exec-all.h"
 #include "accel/tcg/cpu-ldst.h"
 #include "accel/tcg/probe.h"
 #include "exec/helper-proto.h"
diff --git a/target/mips/tcg/op_helper.c b/target/mips/tcg/op_helper.c
index 65403f1a87..b906d10204 100644
--- a/target/mips/tcg/op_helper.c
+++ b/target/mips/tcg/op_helper.c
@@ -22,7 +22,6 @@
 #include "cpu.h"
 #include "internal.h"
 #include "exec/helper-proto.h"
-#include "exec/exec-all.h"
 #include "exec/memop.h"
 #include "fpu_helper.h"
 
diff --git a/target/mips/tcg/system/special_helper.c b/target/mips/tcg/system/special_helper.c
index 3ce3ae1e12..b54cbe88a3 100644
--- a/target/mips/tcg/system/special_helper.c
+++ b/target/mips/tcg/system/special_helper.c
@@ -22,7 +22,6 @@
 #include "qemu/log.h"
 #include "cpu.h"
 #include "exec/helper-proto.h"
-#include "exec/exec-all.h"
 #include "exec/translation-block.h"
 #include "internal.h"
 
diff --git a/target/mips/tcg/system/tlb_helper.c b/target/mips/tcg/system/tlb_helper.c
index e477ef812a..eccaf3624c 100644
--- a/target/mips/tcg/system/tlb_helper.c
+++ b/target/mips/tcg/system/tlb_helper.c
@@ -22,7 +22,6 @@
 #include "cpu.h"
 #include "internal.h"
 #include "exec/cputlb.h"
-#include "exec/exec-all.h"
 #include "exec/page-protection.h"
 #include "exec/target_page.h"
 #include "accel/tcg/cpu-ldst.h"
diff --git a/target/openrisc/cpu.c b/target/openrisc/cpu.c
index 2ec267efec..8c8165d666 100644
--- a/target/openrisc/cpu.c
+++ b/target/openrisc/cpu.c
@@ -21,7 +21,6 @@
 #include "qapi/error.h"
 #include "qemu/qemu-print.h"
 #include "cpu.h"
-#include "exec/exec-all.h"
 #include "exec/translation-block.h"
 #include "fpu/softfloat-helpers.h"
 #include "tcg/tcg.h"
diff --git a/target/openrisc/exception.c b/target/openrisc/exception.c
index 8699c3dcea..e213be36b6 100644
--- a/target/openrisc/exception.c
+++ b/target/openrisc/exception.c
@@ -19,7 +19,6 @@
 
 #include "qemu/osdep.h"
 #include "cpu.h"
-#include "exec/exec-all.h"
 #include "exception.h"
 
 G_NORETURN void raise_exception(OpenRISCCPU *cpu, uint32_t excp)
diff --git a/target/openrisc/exception_helper.c b/target/openrisc/exception_helper.c
index 1f5be4bed9..c2c9d13652 100644
--- a/target/openrisc/exception_helper.c
+++ b/target/openrisc/exception_helper.c
@@ -19,7 +19,6 @@
 
 #include "qemu/osdep.h"
 #include "cpu.h"
-#include "exec/exec-all.h"
 #include "exec/helper-proto.h"
 #include "exception.h"
 
diff --git a/target/openrisc/fpu_helper.c b/target/openrisc/fpu_helper.c
index 8b81d2f62f..dba997255c 100644
--- a/target/openrisc/fpu_helper.c
+++ b/target/openrisc/fpu_helper.c
@@ -20,7 +20,6 @@
 
 #include "qemu/osdep.h"
 #include "cpu.h"
-#include "exec/exec-all.h"
 #include "exec/helper-proto.h"
 #include "fpu/softfloat.h"
 
diff --git a/target/openrisc/interrupt.c b/target/openrisc/interrupt.c
index b3b5b40577..486823094c 100644
--- a/target/openrisc/interrupt.c
+++ b/target/openrisc/interrupt.c
@@ -20,7 +20,6 @@
 #include "qemu/osdep.h"
 #include "qemu/log.h"
 #include "cpu.h"
-#include "exec/exec-all.h"
 #include "gdbstub/helpers.h"
 #include "qemu/host-utils.h"
 #ifndef CONFIG_USER_ONLY
diff --git a/target/openrisc/interrupt_helper.c b/target/openrisc/interrupt_helper.c
index ab4ea88b69..1553ebc71b 100644
--- a/target/openrisc/interrupt_helper.c
+++ b/target/openrisc/interrupt_helper.c
@@ -20,7 +20,6 @@
 
 #include "qemu/osdep.h"
 #include "cpu.h"
-#include "exec/exec-all.h"
 #include "exec/helper-proto.h"
 
 void HELPER(rfe)(CPUOpenRISCState *env)
diff --git a/target/openrisc/sys_helper.c b/target/openrisc/sys_helper.c
index 92badf017f..951f8e247a 100644
--- a/target/openrisc/sys_helper.c
+++ b/target/openrisc/sys_helper.c
@@ -20,7 +20,6 @@
 
 #include "qemu/osdep.h"
 #include "cpu.h"
-#include "exec/exec-all.h"
 #include "exec/cputlb.h"
 #include "exec/target_page.h"
 #include "exec/helper-proto.h"
diff --git a/target/openrisc/translate.c b/target/openrisc/translate.c
index baadea4448..5ab3bc7021 100644
--- a/target/openrisc/translate.c
+++ b/target/openrisc/translate.c
@@ -21,7 +21,6 @@
 #include "qemu/osdep.h"
 #include "cpu.h"
 #include "accel/tcg/cpu-mmu-index.h"
-#include "exec/exec-all.h"
 #include "tcg/tcg-op.h"
 #include "qemu/log.h"
 #include "qemu/bitops.h"
diff --git a/target/ppc/excp_helper.c b/target/ppc/excp_helper.c
index da8b525a41..1efdc4066e 100644
--- a/target/ppc/excp_helper.c
+++ b/target/ppc/excp_helper.c
@@ -24,7 +24,6 @@
 #include "system/system.h"
 #include "system/runstate.h"
 #include "cpu.h"
-#include "exec/exec-all.h"
 #include "internal.h"
 #include "helper_regs.h"
 #include "hw/ppc/ppc.h"
diff --git a/target/ppc/fpu_helper.c b/target/ppc/fpu_helper.c
index d93cfed17b..07b782f971 100644
--- a/target/ppc/fpu_helper.c
+++ b/target/ppc/fpu_helper.c
@@ -19,7 +19,6 @@
 #include "qemu/osdep.h"
 #include "cpu.h"
 #include "exec/helper-proto.h"
-#include "exec/exec-all.h"
 #include "internal.h"
 #include "fpu/softfloat.h"
 
diff --git a/target/ppc/machine.c b/target/ppc/machine.c
index 98df5b4a3a..d72e5ecb94 100644
--- a/target/ppc/machine.c
+++ b/target/ppc/machine.c
@@ -1,6 +1,5 @@
 #include "qemu/osdep.h"
 #include "cpu.h"
-#include "exec/exec-all.h"
 #include "system/kvm.h"
 #include "system/tcg.h"
 #include "helper_regs.h"
diff --git a/target/ppc/mem_helper.c b/target/ppc/mem_helper.c
index 50f05a915e..aa1af44d22 100644
--- a/target/ppc/mem_helper.c
+++ b/target/ppc/mem_helper.c
@@ -19,7 +19,6 @@
 
 #include "qemu/osdep.h"
 #include "cpu.h"
-#include "exec/exec-all.h"
 #include "exec/target_page.h"
 #include "qemu/host-utils.h"
 #include "exec/helper-proto.h"
diff --git a/target/ppc/misc_helper.c b/target/ppc/misc_helper.c
index 46ae454afd..e7d9462518 100644
--- a/target/ppc/misc_helper.c
+++ b/target/ppc/misc_helper.c
@@ -20,7 +20,6 @@
 #include "qemu/osdep.h"
 #include "qemu/log.h"
 #include "cpu.h"
-#include "exec/exec-all.h"
 #include "exec/cputlb.h"
 #include "exec/helper-proto.h"
 #include "qemu/error-report.h"
diff --git a/target/ppc/mmu-hash32.c b/target/ppc/mmu-hash32.c
index 5bd3efe70e..8b980a5aa9 100644
--- a/target/ppc/mmu-hash32.c
+++ b/target/ppc/mmu-hash32.c
@@ -20,7 +20,6 @@
 
 #include "qemu/osdep.h"
 #include "cpu.h"
-#include "exec/exec-all.h"
 #include "exec/page-protection.h"
 #include "exec/target_page.h"
 #include "system/kvm.h"
diff --git a/target/ppc/mmu-hash64.c b/target/ppc/mmu-hash64.c
index 3ba4810497..dd337558aa 100644
--- a/target/ppc/mmu-hash64.c
+++ b/target/ppc/mmu-hash64.c
@@ -20,7 +20,6 @@
 #include "qemu/osdep.h"
 #include "qemu/units.h"
 #include "cpu.h"
-#include "exec/exec-all.h"
 #include "exec/page-protection.h"
 #include "qemu/error-report.h"
 #include "qemu/qemu-print.h"
diff --git a/target/ppc/mmu-radix64.c b/target/ppc/mmu-radix64.c
index 4ab5f3bb92..33ac341290 100644
--- a/target/ppc/mmu-radix64.c
+++ b/target/ppc/mmu-radix64.c
@@ -19,7 +19,6 @@
 
 #include "qemu/osdep.h"
 #include "cpu.h"
-#include "exec/exec-all.h"
 #include "exec/page-protection.h"
 #include "qemu/error-report.h"
 #include "system/kvm.h"
diff --git a/target/ppc/mmu_common.c b/target/ppc/mmu_common.c
index 394a0c9bb6..52d48615ac 100644
--- a/target/ppc/mmu_common.c
+++ b/target/ppc/mmu_common.c
@@ -24,7 +24,6 @@
 #include "kvm_ppc.h"
 #include "mmu-hash64.h"
 #include "mmu-hash32.h"
-#include "exec/exec-all.h"
 #include "exec/page-protection.h"
 #include "exec/target_page.h"
 #include "exec/log.h"
diff --git a/target/ppc/mmu_helper.c b/target/ppc/mmu_helper.c
index 2138666122..ac60705402 100644
--- a/target/ppc/mmu_helper.c
+++ b/target/ppc/mmu_helper.c
@@ -25,7 +25,6 @@
 #include "mmu-hash64.h"
 #include "mmu-hash32.h"
 #include "exec/cputlb.h"
-#include "exec/exec-all.h"
 #include "exec/page-protection.h"
 #include "exec/target_page.h"
 #include "exec/log.h"
diff --git a/target/ppc/power8-pmu.c b/target/ppc/power8-pmu.c
index db9ee8e96b..2a7a5b493a 100644
--- a/target/ppc/power8-pmu.c
+++ b/target/ppc/power8-pmu.c
@@ -13,7 +13,6 @@
 #include "qemu/osdep.h"
 #include "cpu.h"
 #include "helper_regs.h"
-#include "exec/exec-all.h"
 #include "exec/helper-proto.h"
 #include "qemu/error-report.h"
 #include "qemu/timer.h"
diff --git a/target/ppc/tcg-excp_helper.c b/target/ppc/tcg-excp_helper.c
index 2b15e5f2f0..f835be5156 100644
--- a/target/ppc/tcg-excp_helper.c
+++ b/target/ppc/tcg-excp_helper.c
@@ -21,7 +21,6 @@
 #include "qemu/log.h"
 #include "target/ppc/cpu.h"
 #include "accel/tcg/cpu-ldst.h"
-#include "exec/exec-all.h"
 #include "exec/helper-proto.h"
 #include "system/runstate.h"
 
diff --git a/target/ppc/timebase_helper.c b/target/ppc/timebase_helper.c
index 73120323b4..7209b418fb 100644
--- a/target/ppc/timebase_helper.c
+++ b/target/ppc/timebase_helper.c
@@ -20,7 +20,6 @@
 #include "cpu.h"
 #include "hw/ppc/ppc.h"
 #include "exec/helper-proto.h"
-#include "exec/exec-all.h"
 #include "qemu/log.h"
 #include "qemu/main-loop.h"
 
diff --git a/target/ppc/translate.c b/target/ppc/translate.c
index 62dd008e36..27f90c3cc5 100644
--- a/target/ppc/translate.c
+++ b/target/ppc/translate.c
@@ -21,7 +21,6 @@
 #include "qemu/osdep.h"
 #include "cpu.h"
 #include "internal.h"
-#include "exec/exec-all.h"
 #include "exec/target_page.h"
 #include "tcg/tcg-op.h"
 #include "tcg/tcg-op-gvec.h"
diff --git a/target/ppc/user_only_helper.c b/target/ppc/user_only_helper.c
index a4d07a0d0d..ae210eb847 100644
--- a/target/ppc/user_only_helper.c
+++ b/target/ppc/user_only_helper.c
@@ -20,7 +20,6 @@
 
 #include "qemu/osdep.h"
 #include "cpu.h"
-#include "exec/exec-all.h"
 #include "internal.h"
 
 void ppc_cpu_record_sigsegv(CPUState *cs, vaddr address,
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index e0604f4c78..d92874baa0 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -24,7 +24,6 @@
 #include "cpu.h"
 #include "cpu_vendorid.h"
 #include "internals.h"
-#include "exec/exec-all.h"
 #include "qapi/error.h"
 #include "qapi/visitor.h"
 #include "qemu/error-report.h"
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index 619c76cc00..f2e90a9889 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -24,7 +24,6 @@
 #include "internals.h"
 #include "pmu.h"
 #include "exec/cputlb.h"
-#include "exec/exec-all.h"
 #include "exec/page-protection.h"
 #include "exec/target_page.h"
 #include "system/memory.h"
diff --git a/target/riscv/crypto_helper.c b/target/riscv/crypto_helper.c
index bb084e00ef..a0fb54bc50 100644
--- a/target/riscv/crypto_helper.c
+++ b/target/riscv/crypto_helper.c
@@ -19,7 +19,6 @@
 
 #include "qemu/osdep.h"
 #include "cpu.h"
-#include "exec/exec-all.h"
 #include "exec/helper-proto.h"
 #include "crypto/aes.h"
 #include "crypto/aes-round.h"
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index 1308643855..a32e1455c9 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -24,7 +24,6 @@
 #include "tcg/tcg-cpu.h"
 #include "pmu.h"
 #include "time_helper.h"
-#include "exec/exec-all.h"
 #include "exec/cputlb.h"
 #include "exec/tb-flush.h"
 #include "exec/icount.h"
diff --git a/target/riscv/debug.c b/target/riscv/debug.c
index 8564f0b371..5664466749 100644
--- a/target/riscv/debug.c
+++ b/target/riscv/debug.c
@@ -28,7 +28,6 @@
 #include "qapi/error.h"
 #include "cpu.h"
 #include "trace.h"
-#include "exec/exec-all.h"
 #include "exec/helper-proto.h"
 #include "exec/watchpoint.h"
 #include "system/cpu-timers.h"
diff --git a/target/riscv/fpu_helper.c b/target/riscv/fpu_helper.c
index 91b1a56d10..706bdfa61d 100644
--- a/target/riscv/fpu_helper.c
+++ b/target/riscv/fpu_helper.c
@@ -19,7 +19,6 @@
 #include "qemu/osdep.h"
 #include "cpu.h"
 #include "qemu/host-utils.h"
-#include "exec/exec-all.h"
 #include "exec/helper-proto.h"
 #include "fpu/softfloat.h"
 #include "internals.h"
diff --git a/target/riscv/m128_helper.c b/target/riscv/m128_helper.c
index ec14aaa901..7d9b83b1b2 100644
--- a/target/riscv/m128_helper.c
+++ b/target/riscv/m128_helper.c
@@ -19,7 +19,6 @@
 
 #include "qemu/osdep.h"
 #include "cpu.h"
-#include "exec/exec-all.h"
 #include "exec/helper-proto.h"
 
 target_ulong HELPER(divu_i128)(CPURISCVState *env,
diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
index abb1d284dc..05316f2088 100644
--- a/target/riscv/op_helper.c
+++ b/target/riscv/op_helper.c
@@ -21,7 +21,6 @@
 #include "qemu/osdep.h"
 #include "cpu.h"
 #include "internals.h"
-#include "exec/exec-all.h"
 #include "exec/cputlb.h"
 #include "accel/tcg/cpu-ldst.h"
 #include "accel/tcg/probe.h"
diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index 54ac54f2e1..2f757c2a5e 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -18,7 +18,6 @@
  */
 
 #include "qemu/osdep.h"
-#include "exec/exec-all.h"
 #include "exec/translation-block.h"
 #include "tcg-cpu.h"
 #include "cpu.h"
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index cef61b5b29..85128f997b 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -20,7 +20,6 @@
 #include "qemu/log.h"
 #include "cpu.h"
 #include "tcg/tcg-op.h"
-#include "exec/exec-all.h"
 #include "exec/helper-proto.h"
 #include "exec/helper-gen.h"
 #include "exec/target_page.h"
diff --git a/target/riscv/vcrypto_helper.c b/target/riscv/vcrypto_helper.c
index 1526de96f5..9a0d9b4f53 100644
--- a/target/riscv/vcrypto_helper.c
+++ b/target/riscv/vcrypto_helper.c
@@ -26,7 +26,6 @@
 #include "crypto/aes-round.h"
 #include "crypto/sm4.h"
 #include "exec/memop.h"
-#include "exec/exec-all.h"
 #include "exec/helper-proto.h"
 #include "internals.h"
 #include "vector_internals.h"
diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
index 5ccb294e31..8eea3e6df0 100644
--- a/target/riscv/vector_helper.c
+++ b/target/riscv/vector_helper.c
@@ -21,7 +21,6 @@
 #include "qemu/bitops.h"
 #include "cpu.h"
 #include "exec/memop.h"
-#include "exec/exec-all.h"
 #include "accel/tcg/cpu-ldst.h"
 #include "accel/tcg/probe.h"
 #include "exec/page-protection.h"
diff --git a/target/riscv/zce_helper.c b/target/riscv/zce_helper.c
index 50d65f386c..55221f5f37 100644
--- a/target/riscv/zce_helper.c
+++ b/target/riscv/zce_helper.c
@@ -18,7 +18,6 @@
 
 #include "qemu/osdep.h"
 #include "cpu.h"
-#include "exec/exec-all.h"
 #include "exec/helper-proto.h"
 #include "accel/tcg/cpu-ldst.h"
 
diff --git a/target/rx/op_helper.c b/target/rx/op_helper.c
index a2f1f3824d..2b190a4b2c 100644
--- a/target/rx/op_helper.c
+++ b/target/rx/op_helper.c
@@ -19,7 +19,6 @@
 #include "qemu/osdep.h"
 #include "qemu/bitops.h"
 #include "cpu.h"
-#include "exec/exec-all.h"
 #include "exec/helper-proto.h"
 #include "accel/tcg/cpu-ldst.h"
 #include "fpu/softfloat.h"
diff --git a/target/rx/translate.c b/target/rx/translate.c
index bbda703be8..19a9584a82 100644
--- a/target/rx/translate.c
+++ b/target/rx/translate.c
@@ -20,7 +20,6 @@
 #include "qemu/bswap.h"
 #include "qemu/qemu-print.h"
 #include "cpu.h"
-#include "exec/exec-all.h"
 #include "tcg/tcg-op.h"
 #include "exec/helper-proto.h"
 #include "exec/helper-gen.h"
diff --git a/target/s390x/interrupt.c b/target/s390x/interrupt.c
index 4ae6e2ddea..1dca835c5d 100644
--- a/target/s390x/interrupt.c
+++ b/target/s390x/interrupt.c
@@ -11,7 +11,6 @@
 #include "cpu.h"
 #include "kvm/kvm_s390x.h"
 #include "s390x-internal.h"
-#include "exec/exec-all.h"
 #include "system/kvm.h"
 #include "system/tcg.h"
 #include "hw/s390x/ioinst.h"
diff --git a/target/s390x/mmu_helper.c b/target/s390x/mmu_helper.c
index 0e133cb9a5..00946e9c0f 100644
--- a/target/s390x/mmu_helper.c
+++ b/target/s390x/mmu_helper.c
@@ -23,7 +23,6 @@
 #include "kvm/kvm_s390x.h"
 #include "system/kvm.h"
 #include "system/tcg.h"
-#include "exec/exec-all.h"
 #include "exec/page-protection.h"
 #include "exec/target_page.h"
 #include "hw/hw.h"
diff --git a/target/s390x/sigp.c b/target/s390x/sigp.c
index a3347f1236..5e95c4978f 100644
--- a/target/s390x/sigp.c
+++ b/target/s390x/sigp.c
@@ -16,7 +16,6 @@
 #include "system/runstate.h"
 #include "system/address-spaces.h"
 #include "exec/cputlb.h"
-#include "exec/exec-all.h"
 #include "system/tcg.h"
 #include "trace.h"
 #include "qapi/qapi-types-machine.h"
diff --git a/target/s390x/tcg/cc_helper.c b/target/s390x/tcg/cc_helper.c
index b36f8cdc8b..6595ac763c 100644
--- a/target/s390x/tcg/cc_helper.c
+++ b/target/s390x/tcg/cc_helper.c
@@ -22,7 +22,6 @@
 #include "cpu.h"
 #include "s390x-internal.h"
 #include "tcg_s390x.h"
-#include "exec/exec-all.h"
 #include "exec/helper-proto.h"
 #include "qemu/host-utils.h"
 
diff --git a/target/s390x/tcg/crypto_helper.c b/target/s390x/tcg/crypto_helper.c
index 642c1b18c4..4447bb66ee 100644
--- a/target/s390x/tcg/crypto_helper.c
+++ b/target/s390x/tcg/crypto_helper.c
@@ -17,7 +17,6 @@
 #include "s390x-internal.h"
 #include "tcg_s390x.h"
 #include "exec/helper-proto.h"
-#include "exec/exec-all.h"
 #include "accel/tcg/cpu-ldst.h"
 
 static uint64_t R(uint64_t x, int c)
diff --git a/target/s390x/tcg/excp_helper.c b/target/s390x/tcg/excp_helper.c
index 6cd813e1ab..e4c75d0ce0 100644
--- a/target/s390x/tcg/excp_helper.c
+++ b/target/s390x/tcg/excp_helper.c
@@ -23,7 +23,6 @@
 #include "cpu.h"
 #include "exec/helper-proto.h"
 #include "exec/cputlb.h"
-#include "exec/exec-all.h"
 #include "exec/target_page.h"
 #include "exec/watchpoint.h"
 #include "s390x-internal.h"
diff --git a/target/s390x/tcg/fpu_helper.c b/target/s390x/tcg/fpu_helper.c
index 5041c13962..1ba43715ac 100644
--- a/target/s390x/tcg/fpu_helper.c
+++ b/target/s390x/tcg/fpu_helper.c
@@ -22,7 +22,6 @@
 #include "cpu.h"
 #include "s390x-internal.h"
 #include "tcg_s390x.h"
-#include "exec/exec-all.h"
 #include "exec/helper-proto.h"
 #include "fpu/softfloat.h"
 
diff --git a/target/s390x/tcg/int_helper.c b/target/s390x/tcg/int_helper.c
index 253c036415..fbda396f5b 100644
--- a/target/s390x/tcg/int_helper.c
+++ b/target/s390x/tcg/int_helper.c
@@ -22,7 +22,6 @@
 #include "cpu.h"
 #include "s390x-internal.h"
 #include "tcg_s390x.h"
-#include "exec/exec-all.h"
 #include "qemu/host-utils.h"
 #include "exec/helper-proto.h"
 #include "accel/tcg/cpu-ldst.h"
diff --git a/target/s390x/tcg/mem_helper.c b/target/s390x/tcg/mem_helper.c
index 9e77cde81b..857005b120 100644
--- a/target/s390x/tcg/mem_helper.c
+++ b/target/s390x/tcg/mem_helper.c
@@ -25,7 +25,6 @@
 #include "tcg_s390x.h"
 #include "exec/helper-proto.h"
 #include "exec/cpu-common.h"
-#include "exec/exec-all.h"
 #include "exec/cputlb.h"
 #include "exec/page-protection.h"
 #include "accel/tcg/cpu-ldst.h"
diff --git a/target/s390x/tcg/misc_helper.c b/target/s390x/tcg/misc_helper.c
index d5088493ea..f7101be574 100644
--- a/target/s390x/tcg/misc_helper.c
+++ b/target/s390x/tcg/misc_helper.c
@@ -26,7 +26,6 @@
 #include "qemu/host-utils.h"
 #include "exec/helper-proto.h"
 #include "qemu/timer.h"
-#include "exec/exec-all.h"
 #include "exec/cputlb.h"
 #include "accel/tcg/cpu-ldst.h"
 #include "exec/target_page.h"
diff --git a/target/s390x/tcg/translate.c b/target/s390x/tcg/translate.c
index a714f9c0c2..c7e8574438 100644
--- a/target/s390x/tcg/translate.c
+++ b/target/s390x/tcg/translate.c
@@ -31,7 +31,6 @@
 #include "qemu/osdep.h"
 #include "cpu.h"
 #include "s390x-internal.h"
-#include "exec/exec-all.h"
 #include "tcg/tcg-op.h"
 #include "tcg/tcg-op-gvec.h"
 #include "qemu/log.h"
diff --git a/target/s390x/tcg/vec_fpu_helper.c b/target/s390x/tcg/vec_fpu_helper.c
index 1bbaa82fe8..744f800fb6 100644
--- a/target/s390x/tcg/vec_fpu_helper.c
+++ b/target/s390x/tcg/vec_fpu_helper.c
@@ -15,7 +15,6 @@
 #include "vec.h"
 #include "tcg_s390x.h"
 #include "tcg/tcg-gvec-desc.h"
-#include "exec/exec-all.h"
 #include "exec/helper-proto.h"
 #include "fpu/softfloat.h"
 
diff --git a/target/s390x/tcg/vec_helper.c b/target/s390x/tcg/vec_helper.c
index 781ccc565b..46ec4a947d 100644
--- a/target/s390x/tcg/vec_helper.c
+++ b/target/s390x/tcg/vec_helper.c
@@ -17,7 +17,6 @@
 #include "tcg/tcg-gvec-desc.h"
 #include "exec/helper-proto.h"
 #include "accel/tcg/cpu-ldst.h"
-#include "exec/exec-all.h"
 
 void HELPER(gvec_vbperm)(void *v1, const void *v2, const void *v3,
                          uint32_t desc)
diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
index 57d7b5fbc8..1885e7d5b2 100644
--- a/target/sh4/cpu.c
+++ b/target/sh4/cpu.c
@@ -24,7 +24,6 @@
 #include "qemu/qemu-print.h"
 #include "cpu.h"
 #include "migration/vmstate.h"
-#include "exec/exec-all.h"
 #include "exec/translation-block.h"
 #include "fpu/softfloat-helpers.h"
 #include "tcg/tcg.h"
diff --git a/target/sh4/helper.c b/target/sh4/helper.c
index b41d14d5d7..fb7642bda1 100644
--- a/target/sh4/helper.c
+++ b/target/sh4/helper.c
@@ -21,7 +21,6 @@
 
 #include "cpu.h"
 #include "exec/cputlb.h"
-#include "exec/exec-all.h"
 #include "exec/page-protection.h"
 #include "exec/target_page.h"
 #include "exec/log.h"
diff --git a/target/sh4/op_helper.c b/target/sh4/op_helper.c
index e7fcad3c1b..557b1bf497 100644
--- a/target/sh4/op_helper.c
+++ b/target/sh4/op_helper.c
@@ -19,7 +19,6 @@
 #include "qemu/osdep.h"
 #include "cpu.h"
 #include "exec/helper-proto.h"
-#include "exec/exec-all.h"
 #include "accel/tcg/cpu-ldst.h"
 #include "fpu/softfloat.h"
 
diff --git a/target/sh4/translate.c b/target/sh4/translate.c
index 712117be22..bf8828fce8 100644
--- a/target/sh4/translate.c
+++ b/target/sh4/translate.c
@@ -19,7 +19,6 @@
 
 #include "qemu/osdep.h"
 #include "cpu.h"
-#include "exec/exec-all.h"
 #include "tcg/tcg-op.h"
 #include "exec/helper-proto.h"
 #include "exec/helper-gen.h"
diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
index bc753d5f62..690e74f109 100644
--- a/target/sparc/cpu.c
+++ b/target/sparc/cpu.c
@@ -23,7 +23,6 @@
 #include "qemu/module.h"
 #include "qemu/qemu-print.h"
 #include "accel/tcg/cpu-mmu-index.h"
-#include "exec/exec-all.h"
 #include "exec/translation-block.h"
 #include "hw/qdev-properties.h"
 #include "qapi/visitor.h"
diff --git a/target/sparc/fop_helper.c b/target/sparc/fop_helper.c
index c25097d07f..a49334150d 100644
--- a/target/sparc/fop_helper.c
+++ b/target/sparc/fop_helper.c
@@ -19,7 +19,6 @@
 
 #include "qemu/osdep.h"
 #include "cpu.h"
-#include "exec/exec-all.h"
 #include "exec/helper-proto.h"
 #include "fpu/softfloat.h"
 
diff --git a/target/sparc/helper.c b/target/sparc/helper.c
index 7846ddd6f6..9163b9d46a 100644
--- a/target/sparc/helper.c
+++ b/target/sparc/helper.c
@@ -19,7 +19,6 @@
 
 #include "qemu/osdep.h"
 #include "cpu.h"
-#include "exec/exec-all.h"
 #include "qemu/timer.h"
 #include "qemu/host-utils.h"
 #include "exec/helper-proto.h"
diff --git a/target/sparc/ldst_helper.c b/target/sparc/ldst_helper.c
index 4c5dba19d1..2c63eb9e03 100644
--- a/target/sparc/ldst_helper.c
+++ b/target/sparc/ldst_helper.c
@@ -23,7 +23,6 @@
 #include "cpu.h"
 #include "tcg/tcg.h"
 #include "exec/helper-proto.h"
-#include "exec/exec-all.h"
 #include "exec/cputlb.h"
 #include "exec/page-protection.h"
 #include "exec/target_page.h"
diff --git a/target/sparc/machine.c b/target/sparc/machine.c
index 222e5709c5..4dd75aff74 100644
--- a/target/sparc/machine.c
+++ b/target/sparc/machine.c
@@ -1,6 +1,5 @@
 #include "qemu/osdep.h"
 #include "cpu.h"
-#include "exec/exec-all.h"
 #include "qemu/timer.h"
 
 #include "migration/cpu.h"
diff --git a/target/sparc/translate.c b/target/sparc/translate.c
index 63dd90447b..b922e53bf1 100644
--- a/target/sparc/translate.c
+++ b/target/sparc/translate.c
@@ -22,7 +22,6 @@
 
 #include "cpu.h"
 #include "exec/helper-proto.h"
-#include "exec/exec-all.h"
 #include "exec/target_page.h"
 #include "tcg/tcg-op.h"
 #include "tcg/tcg-op-gvec.h"
diff --git a/target/sparc/win_helper.c b/target/sparc/win_helper.c
index 0c4b09f2c1..9ad9d01e8b 100644
--- a/target/sparc/win_helper.c
+++ b/target/sparc/win_helper.c
@@ -20,7 +20,6 @@
 #include "qemu/osdep.h"
 #include "qemu/main-loop.h"
 #include "cpu.h"
-#include "exec/exec-all.h"
 #include "exec/helper-proto.h"
 #include "trace.h"
 
diff --git a/target/tricore/cpu.c b/target/tricore/cpu.c
index 098cd06c54..9f19e903bc 100644
--- a/target/tricore/cpu.c
+++ b/target/tricore/cpu.c
@@ -20,7 +20,6 @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "cpu.h"
-#include "exec/exec-all.h"
 #include "exec/translation-block.h"
 #include "qemu/error-report.h"
 #include "tcg/debug-assert.h"
diff --git a/target/tricore/op_helper.c b/target/tricore/op_helper.c
index ae559b6922..9910c13f4b 100644
--- a/target/tricore/op_helper.c
+++ b/target/tricore/op_helper.c
@@ -18,7 +18,6 @@
 #include "cpu.h"
 #include "qemu/host-utils.h"
 #include "exec/helper-proto.h"
-#include "exec/exec-all.h"
 #include "accel/tcg/cpu-ldst.h"
 #include <zlib.h> /* for crc32 */
 
diff --git a/target/tricore/translate.c b/target/tricore/translate.c
index ba36c9fcc8..3d0e7a10bd 100644
--- a/target/tricore/translate.c
+++ b/target/tricore/translate.c
@@ -20,7 +20,6 @@
 
 #include "qemu/osdep.h"
 #include "cpu.h"
-#include "exec/exec-all.h"
 #include "tcg/tcg-op.h"
 #include "accel/tcg/cpu-ldst.h"
 #include "qemu/qemu-print.h"
diff --git a/target/xtensa/dbg_helper.c b/target/xtensa/dbg_helper.c
index c4f4298a50..3b91f7c38a 100644
--- a/target/xtensa/dbg_helper.c
+++ b/target/xtensa/dbg_helper.c
@@ -30,7 +30,6 @@
 #include "cpu.h"
 #include "exec/helper-proto.h"
 #include "qemu/host-utils.h"
-#include "exec/exec-all.h"
 #include "exec/watchpoint.h"
 #include "system/address-spaces.h"
 
diff --git a/target/xtensa/exc_helper.c b/target/xtensa/exc_helper.c
index ca629f071d..b611c9bf97 100644
--- a/target/xtensa/exc_helper.c
+++ b/target/xtensa/exc_helper.c
@@ -32,7 +32,6 @@
 #include "exec/helper-proto.h"
 #include "qemu/host-utils.h"
 #include "qemu/atomic.h"
-#include "exec/exec-all.h"
 
 void HELPER(exception)(CPUXtensaState *env, uint32_t excp)
 {
diff --git a/target/xtensa/fpu_helper.c b/target/xtensa/fpu_helper.c
index 53fc7cfd2a..5358060c50 100644
--- a/target/xtensa/fpu_helper.c
+++ b/target/xtensa/fpu_helper.c
@@ -30,7 +30,6 @@
 #include "cpu.h"
 #include "exec/helper-proto.h"
 #include "qemu/host-utils.h"
-#include "exec/exec-all.h"
 #include "fpu/softfloat.h"
 
 enum {
diff --git a/target/xtensa/mmu_helper.c b/target/xtensa/mmu_helper.c
index 182c6e35c1..71330fc84b 100644
--- a/target/xtensa/mmu_helper.c
+++ b/target/xtensa/mmu_helper.c
@@ -35,7 +35,6 @@
 #include "exec/cputlb.h"
 #include "accel/tcg/cpu-mmu-index.h"
 #include "accel/tcg/probe.h"
-#include "exec/exec-all.h"
 #include "exec/page-protection.h"
 #include "exec/target_page.h"
 #include "system/memory.h"
diff --git a/target/xtensa/op_helper.c b/target/xtensa/op_helper.c
index c125fa4946..fc47ebaaf5 100644
--- a/target/xtensa/op_helper.c
+++ b/target/xtensa/op_helper.c
@@ -30,7 +30,6 @@
 #include "exec/helper-proto.h"
 #include "exec/page-protection.h"
 #include "qemu/host-utils.h"
-#include "exec/exec-all.h"
 #include "system/memory.h"
 #include "qemu/atomic.h"
 #include "qemu/timer.h"
diff --git a/target/xtensa/translate.c b/target/xtensa/translate.c
index 2af83c07c2..34ae2f4e16 100644
--- a/target/xtensa/translate.c
+++ b/target/xtensa/translate.c
@@ -31,7 +31,6 @@
 #include "qemu/osdep.h"
 
 #include "cpu.h"
-#include "exec/exec-all.h"
 #include "tcg/tcg-op.h"
 #include "qemu/log.h"
 #include "qemu/qemu-print.h"
diff --git a/target/xtensa/win_helper.c b/target/xtensa/win_helper.c
index ec9ff44db0..4b25f8f4de 100644
--- a/target/xtensa/win_helper.c
+++ b/target/xtensa/win_helper.c
@@ -30,7 +30,6 @@
 #include "cpu.h"
 #include "exec/helper-proto.h"
 #include "qemu/host-utils.h"
-#include "exec/exec-all.h"
 
 static void copy_window_from_phys(CPUXtensaState *env,
                                   uint32_t window, uint32_t phys, uint32_t n)

From 9a1e3713232f9641353e63fd279eb83cc723faf2 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 26 Apr 2025 20:20:24 +0000
Subject: [PATCH 0552/2760] accel/tcg: Generalize fake_user_interrupt test
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Test for the hook being present instead of ifdef TARGET_I386.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cpu-exec.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index 279df5fae7..8ff4a34509 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -732,10 +732,10 @@ static inline bool cpu_handle_exception(CPUState *cpu, int *ret)
      * If user mode only, we simulate a fake exception which will be
      * handled outside the cpu execution loop.
      */
-#if defined(TARGET_I386)
     const TCGCPUOps *tcg_ops = cpu->cc->tcg_ops;
-    tcg_ops->fake_user_interrupt(cpu);
-#endif /* TARGET_I386 */
+    if (tcg_ops->fake_user_interrupt) {
+        tcg_ops->fake_user_interrupt(cpu);
+    }
     *ret = cpu->exception_index;
     cpu->exception_index = -1;
     return true;

From 81ef6a2295740c4b2de9db2f81ebb9ad346b8cfc Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sun, 27 Apr 2025 11:02:25 -0700
Subject: [PATCH 0553/2760] accel/tcg: Unconditionally use CPU_DUMP_CCOP in
 log_cpu_exec

This flag is only tested by target/i386, so including this
makes no functional change.  This is similar to other places
like cpu-target.c which use CPU_DUMP_CCOP unconditionally.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cpu-exec.c | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index 8ff4a34509..ff979a2c57 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -285,14 +285,11 @@ static void log_cpu_exec(vaddr pc, CPUState *cpu,
         if (qemu_loglevel_mask(CPU_LOG_TB_CPU)) {
             FILE *logfile = qemu_log_trylock();
             if (logfile) {
-                int flags = 0;
+                int flags = CPU_DUMP_CCOP;
 
                 if (qemu_loglevel_mask(CPU_LOG_TB_FPU)) {
                     flags |= CPU_DUMP_FPU;
                 }
-#if defined(TARGET_I386)
-                flags |= CPU_DUMP_CCOP;
-#endif
                 if (qemu_loglevel_mask(CPU_LOG_TB_VPU)) {
                     flags |= CPU_DUMP_VPU;
                 }

From 9181ab452893a3f45cdc0f6196fbb9e389a4e5cd Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sun, 27 Apr 2025 11:31:30 -0700
Subject: [PATCH 0554/2760] accel/tcg: Introduce TCGCPUOps.cpu_exec_reset
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Initialize all instances with cpu_reset(), so that there
is no functional change.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cpu-exec.c        | 3 ++-
 include/accel/tcg/cpu-ops.h | 2 ++
 target/alpha/cpu.c          | 1 +
 target/arm/cpu.c            | 1 +
 target/arm/tcg/cpu-v7m.c    | 1 +
 target/avr/cpu.c            | 1 +
 target/hppa/cpu.c           | 1 +
 target/i386/tcg/tcg-cpu.c   | 1 +
 target/loongarch/cpu.c      | 1 +
 target/m68k/cpu.c           | 1 +
 target/microblaze/cpu.c     | 1 +
 target/mips/cpu.c           | 1 +
 target/openrisc/cpu.c       | 1 +
 target/ppc/cpu_init.c       | 1 +
 target/riscv/tcg/tcg-cpu.c  | 1 +
 target/rx/cpu.c             | 1 +
 target/s390x/cpu.c          | 1 +
 target/sh4/cpu.c            | 1 +
 target/sparc/cpu.c          | 1 +
 target/tricore/cpu.c        | 1 +
 target/xtensa/cpu.c         | 1 +
 21 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index ff979a2c57..010f38edaa 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -834,7 +834,7 @@ static inline bool cpu_handle_interrupt(CPUState *cpu,
 #else
         else if (interrupt_request & CPU_INTERRUPT_RESET) {
             replay_interrupt();
-            cpu_reset(cpu);
+            cpu->cc->tcg_ops->cpu_exec_reset(cpu);
             bql_unlock();
             return true;
         }
@@ -1070,6 +1070,7 @@ bool tcg_exec_realizefn(CPUState *cpu, Error **errp)
 #ifndef CONFIG_USER_ONLY
         assert(tcg_ops->cpu_exec_halt);
         assert(tcg_ops->cpu_exec_interrupt);
+        assert(tcg_ops->cpu_exec_reset);
 #endif /* !CONFIG_USER_ONLY */
         assert(tcg_ops->translate_code);
         assert(tcg_ops->mmu_index);
diff --git a/include/accel/tcg/cpu-ops.h b/include/accel/tcg/cpu-ops.h
index 60b5e97205..3ff72b8d9d 100644
--- a/include/accel/tcg/cpu-ops.h
+++ b/include/accel/tcg/cpu-ops.h
@@ -155,6 +155,8 @@ struct TCGCPUOps {
     void (*do_interrupt)(CPUState *cpu);
     /** @cpu_exec_interrupt: Callback for processing interrupts in cpu_exec */
     bool (*cpu_exec_interrupt)(CPUState *cpu, int interrupt_request);
+    /** @cpu_exec_reset: Callback for reset in cpu_exec.  */
+    void (*cpu_exec_reset)(CPUState *cpu);
     /**
      * @cpu_exec_halt: Callback for handling halt in cpu_exec.
      *
diff --git a/target/alpha/cpu.c b/target/alpha/cpu.c
index 68414af8d3..d4e66aa432 100644
--- a/target/alpha/cpu.c
+++ b/target/alpha/cpu.c
@@ -251,6 +251,7 @@ static const TCGCPUOps alpha_tcg_ops = {
     .tlb_fill = alpha_cpu_tlb_fill,
     .cpu_exec_interrupt = alpha_cpu_exec_interrupt,
     .cpu_exec_halt = alpha_cpu_has_work,
+    .cpu_exec_reset = cpu_reset,
     .do_interrupt = alpha_cpu_do_interrupt,
     .do_transaction_failed = alpha_cpu_do_transaction_failed,
     .do_unaligned_access = alpha_cpu_do_unaligned_access,
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index 7b801eb3aa..3dde70b04a 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -2705,6 +2705,7 @@ static const TCGCPUOps arm_tcg_ops = {
     .tlb_fill_align = arm_cpu_tlb_fill_align,
     .cpu_exec_interrupt = arm_cpu_exec_interrupt,
     .cpu_exec_halt = arm_cpu_exec_halt,
+    .cpu_exec_reset = cpu_reset,
     .do_interrupt = arm_cpu_do_interrupt,
     .do_transaction_failed = arm_cpu_do_transaction_failed,
     .do_unaligned_access = arm_cpu_do_unaligned_access,
diff --git a/target/arm/tcg/cpu-v7m.c b/target/arm/tcg/cpu-v7m.c
index b34b657857..5c8c374885 100644
--- a/target/arm/tcg/cpu-v7m.c
+++ b/target/arm/tcg/cpu-v7m.c
@@ -250,6 +250,7 @@ static const TCGCPUOps arm_v7m_tcg_ops = {
     .tlb_fill_align = arm_cpu_tlb_fill_align,
     .cpu_exec_interrupt = arm_v7m_cpu_exec_interrupt,
     .cpu_exec_halt = arm_cpu_exec_halt,
+    .cpu_exec_reset = cpu_reset,
     .do_interrupt = arm_v7m_cpu_do_interrupt,
     .do_transaction_failed = arm_cpu_do_transaction_failed,
     .do_unaligned_access = arm_cpu_do_unaligned_access,
diff --git a/target/avr/cpu.c b/target/avr/cpu.c
index 69fface7e9..50b835e1ae 100644
--- a/target/avr/cpu.c
+++ b/target/avr/cpu.c
@@ -232,6 +232,7 @@ static const TCGCPUOps avr_tcg_ops = {
     .mmu_index = avr_cpu_mmu_index,
     .cpu_exec_interrupt = avr_cpu_exec_interrupt,
     .cpu_exec_halt = avr_cpu_has_work,
+    .cpu_exec_reset = cpu_reset,
     .tlb_fill = avr_cpu_tlb_fill,
     .do_interrupt = avr_cpu_do_interrupt,
 };
diff --git a/target/hppa/cpu.c b/target/hppa/cpu.c
index b083693b57..60b618a22b 100644
--- a/target/hppa/cpu.c
+++ b/target/hppa/cpu.c
@@ -271,6 +271,7 @@ static const TCGCPUOps hppa_tcg_ops = {
     .tlb_fill_align = hppa_cpu_tlb_fill_align,
     .cpu_exec_interrupt = hppa_cpu_exec_interrupt,
     .cpu_exec_halt = hppa_cpu_has_work,
+    .cpu_exec_reset = cpu_reset,
     .do_interrupt = hppa_cpu_do_interrupt,
     .do_unaligned_access = hppa_cpu_do_unaligned_access,
     .do_transaction_failed = hppa_cpu_do_transaction_failed,
diff --git a/target/i386/tcg/tcg-cpu.c b/target/i386/tcg/tcg-cpu.c
index 192812656c..5d1c758ae3 100644
--- a/target/i386/tcg/tcg-cpu.c
+++ b/target/i386/tcg/tcg-cpu.c
@@ -147,6 +147,7 @@ const TCGCPUOps x86_tcg_ops = {
     .do_interrupt = x86_cpu_do_interrupt,
     .cpu_exec_halt = x86_cpu_exec_halt,
     .cpu_exec_interrupt = x86_cpu_exec_interrupt,
+    .cpu_exec_reset = cpu_reset,
     .do_unaligned_access = x86_cpu_do_unaligned_access,
     .debug_excp_handler = breakpoint_handler,
     .debug_check_breakpoint = x86_debug_check_breakpoint,
diff --git a/target/loongarch/cpu.c b/target/loongarch/cpu.c
index c083ad4fd9..c64cba72dd 100644
--- a/target/loongarch/cpu.c
+++ b/target/loongarch/cpu.c
@@ -877,6 +877,7 @@ static const TCGCPUOps loongarch_tcg_ops = {
     .tlb_fill = loongarch_cpu_tlb_fill,
     .cpu_exec_interrupt = loongarch_cpu_exec_interrupt,
     .cpu_exec_halt = loongarch_cpu_has_work,
+    .cpu_exec_reset = cpu_reset,
     .do_interrupt = loongarch_cpu_do_interrupt,
     .do_transaction_failed = loongarch_cpu_do_transaction_failed,
 #endif
diff --git a/target/m68k/cpu.c b/target/m68k/cpu.c
index 6f33b86c7d..f446c6c8f7 100644
--- a/target/m68k/cpu.c
+++ b/target/m68k/cpu.c
@@ -602,6 +602,7 @@ static const TCGCPUOps m68k_tcg_ops = {
     .tlb_fill = m68k_cpu_tlb_fill,
     .cpu_exec_interrupt = m68k_cpu_exec_interrupt,
     .cpu_exec_halt = m68k_cpu_has_work,
+    .cpu_exec_reset = cpu_reset,
     .do_interrupt = m68k_cpu_do_interrupt,
     .do_transaction_failed = m68k_cpu_transaction_failed,
 #endif /* !CONFIG_USER_ONLY */
diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
index 2720e5c1d2..f305ed04f6 100644
--- a/target/microblaze/cpu.c
+++ b/target/microblaze/cpu.c
@@ -440,6 +440,7 @@ static const TCGCPUOps mb_tcg_ops = {
     .tlb_fill = mb_cpu_tlb_fill,
     .cpu_exec_interrupt = mb_cpu_exec_interrupt,
     .cpu_exec_halt = mb_cpu_has_work,
+    .cpu_exec_reset = cpu_reset,
     .do_interrupt = mb_cpu_do_interrupt,
     .do_transaction_failed = mb_cpu_transaction_failed,
     .do_unaligned_access = mb_cpu_do_unaligned_access,
diff --git a/target/mips/cpu.c b/target/mips/cpu.c
index 96fe4da255..09ed330027 100644
--- a/target/mips/cpu.c
+++ b/target/mips/cpu.c
@@ -563,6 +563,7 @@ static const TCGCPUOps mips_tcg_ops = {
     .tlb_fill = mips_cpu_tlb_fill,
     .cpu_exec_interrupt = mips_cpu_exec_interrupt,
     .cpu_exec_halt = mips_cpu_has_work,
+    .cpu_exec_reset = cpu_reset,
     .do_interrupt = mips_cpu_do_interrupt,
     .do_transaction_failed = mips_cpu_do_transaction_failed,
     .do_unaligned_access = mips_cpu_do_unaligned_access,
diff --git a/target/openrisc/cpu.c b/target/openrisc/cpu.c
index 8c8165d666..94776e0ad8 100644
--- a/target/openrisc/cpu.c
+++ b/target/openrisc/cpu.c
@@ -255,6 +255,7 @@ static const TCGCPUOps openrisc_tcg_ops = {
     .tlb_fill = openrisc_cpu_tlb_fill,
     .cpu_exec_interrupt = openrisc_cpu_exec_interrupt,
     .cpu_exec_halt = openrisc_cpu_has_work,
+    .cpu_exec_reset = cpu_reset,
     .do_interrupt = openrisc_cpu_do_interrupt,
 #endif /* !CONFIG_USER_ONLY */
 };
diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
index b0973b6df9..3a01731402 100644
--- a/target/ppc/cpu_init.c
+++ b/target/ppc/cpu_init.c
@@ -7492,6 +7492,7 @@ static const TCGCPUOps ppc_tcg_ops = {
   .tlb_fill = ppc_cpu_tlb_fill,
   .cpu_exec_interrupt = ppc_cpu_exec_interrupt,
   .cpu_exec_halt = ppc_cpu_has_work,
+  .cpu_exec_reset = cpu_reset,
   .do_interrupt = ppc_cpu_do_interrupt,
   .cpu_exec_enter = ppc_cpu_exec_enter,
   .cpu_exec_exit = ppc_cpu_exec_exit,
diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index 2f757c2a5e..50782e0f0e 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -153,6 +153,7 @@ const TCGCPUOps riscv_tcg_ops = {
     .tlb_fill = riscv_cpu_tlb_fill,
     .cpu_exec_interrupt = riscv_cpu_exec_interrupt,
     .cpu_exec_halt = riscv_cpu_has_work,
+    .cpu_exec_reset = cpu_reset,
     .do_interrupt = riscv_cpu_do_interrupt,
     .do_transaction_failed = riscv_cpu_do_transaction_failed,
     .do_unaligned_access = riscv_cpu_do_unaligned_access,
diff --git a/target/rx/cpu.c b/target/rx/cpu.c
index a51b543028..de2e6a22ff 100644
--- a/target/rx/cpu.c
+++ b/target/rx/cpu.c
@@ -217,6 +217,7 @@ static const TCGCPUOps rx_tcg_ops = {
 
     .cpu_exec_interrupt = rx_cpu_exec_interrupt,
     .cpu_exec_halt = rx_cpu_has_work,
+    .cpu_exec_reset = cpu_reset,
     .do_interrupt = rx_cpu_do_interrupt,
 };
 
diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
index 99ff58affc..71338aae77 100644
--- a/target/s390x/cpu.c
+++ b/target/s390x/cpu.c
@@ -365,6 +365,7 @@ static const TCGCPUOps s390_tcg_ops = {
     .tlb_fill = s390_cpu_tlb_fill,
     .cpu_exec_interrupt = s390_cpu_exec_interrupt,
     .cpu_exec_halt = s390_cpu_has_work,
+    .cpu_exec_reset = cpu_reset,
     .do_interrupt = s390_cpu_do_interrupt,
     .debug_excp_handler = s390x_cpu_debug_excp_handler,
     .do_unaligned_access = s390x_cpu_do_unaligned_access,
diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
index 1885e7d5b2..681237c511 100644
--- a/target/sh4/cpu.c
+++ b/target/sh4/cpu.c
@@ -275,6 +275,7 @@ static const TCGCPUOps superh_tcg_ops = {
     .tlb_fill = superh_cpu_tlb_fill,
     .cpu_exec_interrupt = superh_cpu_exec_interrupt,
     .cpu_exec_halt = superh_cpu_has_work,
+    .cpu_exec_reset = cpu_reset,
     .do_interrupt = superh_cpu_do_interrupt,
     .do_unaligned_access = superh_cpu_do_unaligned_access,
     .io_recompile_replay_branch = superh_io_recompile_replay_branch,
diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
index 690e74f109..bbdea8556a 100644
--- a/target/sparc/cpu.c
+++ b/target/sparc/cpu.c
@@ -1034,6 +1034,7 @@ static const TCGCPUOps sparc_tcg_ops = {
     .tlb_fill = sparc_cpu_tlb_fill,
     .cpu_exec_interrupt = sparc_cpu_exec_interrupt,
     .cpu_exec_halt = sparc_cpu_has_work,
+    .cpu_exec_reset = cpu_reset,
     .do_interrupt = sparc_cpu_do_interrupt,
     .do_transaction_failed = sparc_cpu_do_transaction_failed,
     .do_unaligned_access = sparc_cpu_do_unaligned_access,
diff --git a/target/tricore/cpu.c b/target/tricore/cpu.c
index 9f19e903bc..0fcac697f6 100644
--- a/target/tricore/cpu.c
+++ b/target/tricore/cpu.c
@@ -182,6 +182,7 @@ static const TCGCPUOps tricore_tcg_ops = {
     .tlb_fill = tricore_cpu_tlb_fill,
     .cpu_exec_interrupt = tricore_cpu_exec_interrupt,
     .cpu_exec_halt = tricore_cpu_has_work,
+    .cpu_exec_reset = cpu_reset,
 };
 
 static void tricore_cpu_class_init(ObjectClass *c, const void *data)
diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
index 27d6e40195..9dcb883208 100644
--- a/target/xtensa/cpu.c
+++ b/target/xtensa/cpu.c
@@ -246,6 +246,7 @@ static const TCGCPUOps xtensa_tcg_ops = {
     .tlb_fill = xtensa_cpu_tlb_fill,
     .cpu_exec_interrupt = xtensa_cpu_exec_interrupt,
     .cpu_exec_halt = xtensa_cpu_has_work,
+    .cpu_exec_reset = cpu_reset,
     .do_interrupt = xtensa_cpu_do_interrupt,
     .do_transaction_failed = xtensa_cpu_do_transaction_failed,
     .do_unaligned_access = xtensa_cpu_do_unaligned_access,

From c2d5897d3b712402d9543570c550a40cc0836522 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sun, 27 Apr 2025 11:44:23 -0700
Subject: [PATCH 0555/2760] target/i386: Split out x86_cpu_exec_reset

Note that target/i386/cpu.h defines CPU_INTERRUPT_INIT
as CPU_INTERRUPT_RESET.  Therefore we can handle the
new TCGCPUOps.cpu_exec_reset hook.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cpu-exec.c      | 39 ++++++++++++++-------------------------
 target/i386/tcg/tcg-cpu.c | 11 ++++++++++-
 2 files changed, 24 insertions(+), 26 deletions(-)

diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index 010f38edaa..c21c5d202d 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -819,33 +819,22 @@ static inline bool cpu_handle_interrupt(CPUState *cpu,
             cpu->exception_index = EXCP_HLT;
             bql_unlock();
             return true;
-        }
-#if defined(TARGET_I386)
-        else if (interrupt_request & CPU_INTERRUPT_INIT) {
-            X86CPU *x86_cpu = X86_CPU(cpu);
-            CPUArchState *env = &x86_cpu->env;
-            replay_interrupt();
-            cpu_svm_check_intercept_param(env, SVM_EXIT_INIT, 0, 0);
-            do_cpu_init(x86_cpu);
-            cpu->exception_index = EXCP_HALTED;
-            bql_unlock();
-            return true;
-        }
-#else
-        else if (interrupt_request & CPU_INTERRUPT_RESET) {
-            replay_interrupt();
-            cpu->cc->tcg_ops->cpu_exec_reset(cpu);
-            bql_unlock();
-            return true;
-        }
-#endif /* !TARGET_I386 */
-        /* The target hook has 3 exit conditions:
-           False when the interrupt isn't processed,
-           True when it is, and we should restart on a new TB,
-           and via longjmp via cpu_loop_exit.  */
-        else {
+        } else {
             const TCGCPUOps *tcg_ops = cpu->cc->tcg_ops;
 
+            if (interrupt_request & CPU_INTERRUPT_RESET) {
+                replay_interrupt();
+                tcg_ops->cpu_exec_reset(cpu);
+                bql_unlock();
+                return true;
+            }
+
+            /*
+             * The target hook has 3 exit conditions:
+             * False when the interrupt isn't processed,
+             * True when it is, and we should restart on a new TB,
+             * and via longjmp via cpu_loop_exit.
+             */
             if (tcg_ops->cpu_exec_interrupt(cpu, interrupt_request)) {
                 if (!tcg_ops->need_replay_interrupt ||
                     tcg_ops->need_replay_interrupt(interrupt_request)) {
diff --git a/target/i386/tcg/tcg-cpu.c b/target/i386/tcg/tcg-cpu.c
index 5d1c758ae3..f3f0380e70 100644
--- a/target/i386/tcg/tcg-cpu.c
+++ b/target/i386/tcg/tcg-cpu.c
@@ -120,6 +120,15 @@ static bool x86_debug_check_breakpoint(CPUState *cs)
     /* RF disables all architectural breakpoints. */
     return !(env->eflags & RF_MASK);
 }
+
+static void x86_cpu_exec_reset(CPUState *cs)
+{
+    CPUArchState *env = cpu_env(cs);
+
+    cpu_svm_check_intercept_param(env, SVM_EXIT_INIT, 0, 0);
+    do_cpu_init(env_archcpu(env));
+    cs->exception_index = EXCP_HALTED;
+}
 #endif
 
 #include "accel/tcg/cpu-ops.h"
@@ -147,7 +156,7 @@ const TCGCPUOps x86_tcg_ops = {
     .do_interrupt = x86_cpu_do_interrupt,
     .cpu_exec_halt = x86_cpu_exec_halt,
     .cpu_exec_interrupt = x86_cpu_exec_interrupt,
-    .cpu_exec_reset = cpu_reset,
+    .cpu_exec_reset = x86_cpu_exec_reset,
     .do_unaligned_access = x86_cpu_do_unaligned_access,
     .debug_excp_handler = breakpoint_handler,
     .debug_check_breakpoint = x86_debug_check_breakpoint,

From a59a876999344be426144a3e6d163885220c1e93 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sun, 27 Apr 2025 15:15:14 -0700
Subject: [PATCH 0556/2760] accel/tcg: Hoist cpu_get_tb_cpu_state decl to
 accl/tcg/cpu-ops.h

For some targets, simply remove the local definition.
For other targets, move the inline definition out of line.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/accel/tcg/cpu-ops.h |  3 ++
 target/alpha/cpu.c          | 14 ++++++--
 target/alpha/cpu.h          | 11 ------
 target/arm/cpu.h            |  3 --
 target/arm/helper.c         |  1 +
 target/avr/cpu.c            | 21 +++++++++--
 target/avr/cpu.h            | 18 ----------
 target/hexagon/cpu.c        | 18 ++++++++--
 target/hexagon/cpu.h        | 15 --------
 target/hppa/cpu.c           |  3 +-
 target/hppa/cpu.h           |  3 --
 target/i386/cpu.h           | 14 --------
 target/i386/tcg/tcg-cpu.c   | 17 +++++++--
 target/loongarch/cpu.c      | 15 ++++++--
 target/loongarch/cpu.h      | 12 -------
 target/m68k/cpu.c           | 19 ++++++++--
 target/m68k/cpu.h           | 16 ---------
 target/microblaze/cpu.c     | 11 ++++--
 target/microblaze/cpu.h     |  8 -----
 target/mips/cpu.c           |  9 +++++
 target/mips/cpu.h           |  9 -----
 target/openrisc/cpu.c       | 13 +++++--
 target/openrisc/cpu.h       | 10 ------
 target/ppc/cpu.h            | 13 -------
 target/ppc/helper_regs.c    | 16 ++++-----
 target/riscv/cpu.h          |  3 --
 target/rx/cpu.c             | 12 +++++--
 target/rx/cpu.h             |  9 -----
 target/s390x/cpu.c          |  1 +
 target/s390x/cpu.h          |  9 -----
 target/sh4/cpu.c            | 18 ++++++++--
 target/sh4/cpu.h            | 15 --------
 target/sparc/cpu.h          |  3 --
 target/tricore/cpu.c        | 15 ++++++--
 target/tricore/cpu.h        | 12 -------
 target/xtensa/cpu.c         | 71 +++++++++++++++++++++++++++++++++++--
 target/xtensa/cpu.h         | 68 -----------------------------------
 37 files changed, 243 insertions(+), 285 deletions(-)

diff --git a/include/accel/tcg/cpu-ops.h b/include/accel/tcg/cpu-ops.h
index 3ff72b8d9d..f5e5746976 100644
--- a/include/accel/tcg/cpu-ops.h
+++ b/include/accel/tcg/cpu-ops.h
@@ -18,6 +18,9 @@
 #include "exec/vaddr.h"
 #include "tcg/tcg-mo.h"
 
+void cpu_get_tb_cpu_state(CPUArchState *env, vaddr *pc,
+                          uint64_t *cs_base, uint32_t *flags);
+
 struct TCGCPUOps {
     /**
      * mttcg_supported: multi-threaded TCG is supported
diff --git a/target/alpha/cpu.c b/target/alpha/cpu.c
index d4e66aa432..134806e755 100644
--- a/target/alpha/cpu.c
+++ b/target/alpha/cpu.c
@@ -25,6 +25,7 @@
 #include "cpu.h"
 #include "exec/translation-block.h"
 #include "exec/target_page.h"
+#include "accel/tcg/cpu-ops.h"
 #include "fpu/softfloat.h"
 
 
@@ -40,6 +41,17 @@ static vaddr alpha_cpu_get_pc(CPUState *cs)
     return env->pc;
 }
 
+void cpu_get_tb_cpu_state(CPUAlphaState *env, vaddr *pc,
+                          uint64_t *cs_base, uint32_t *pflags)
+{
+    *pc = env->pc;
+    *cs_base = 0;
+    *pflags = env->flags & ENV_FLAG_TB_MASK;
+#ifdef CONFIG_USER_ONLY
+    *pflags |= TB_FLAG_UNALIGN * !env_cpu(env)->prctl_unalign_sigbus;
+#endif
+}
+
 static void alpha_cpu_synchronize_from_tb(CPUState *cs,
                                           const TranslationBlock *tb)
 {
@@ -231,8 +243,6 @@ static const struct SysemuCPUOps alpha_sysemu_ops = {
 };
 #endif
 
-#include "accel/tcg/cpu-ops.h"
-
 static const TCGCPUOps alpha_tcg_ops = {
     /* Alpha processors have a weak memory model */
     .guest_default_memory_order = 0,
diff --git a/target/alpha/cpu.h b/target/alpha/cpu.h
index 849f673489..45944e46b5 100644
--- a/target/alpha/cpu.h
+++ b/target/alpha/cpu.h
@@ -464,17 +464,6 @@ void alpha_cpu_do_transaction_failed(CPUState *cs, hwaddr physaddr,
                                      MemTxResult response, uintptr_t retaddr);
 #endif
 
-static inline void cpu_get_tb_cpu_state(CPUAlphaState *env, vaddr *pc,
-                                        uint64_t *cs_base, uint32_t *pflags)
-{
-    *pc = env->pc;
-    *cs_base = 0;
-    *pflags = env->flags & ENV_FLAG_TB_MASK;
-#ifdef CONFIG_USER_ONLY
-    *pflags |= TB_FLAG_UNALIGN * !env_cpu(env)->prctl_unalign_sigbus;
-#endif
-}
-
 #ifdef CONFIG_USER_ONLY
 /* Copied from linux ieee_swcr_to_fpcr.  */
 static inline uint64_t alpha_ieee_swcr_to_fpcr(uint64_t swcr)
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index fdcf8cd1ae..be4449ca06 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -3119,9 +3119,6 @@ static inline bool bswap_code(bool sctlr_b)
 #endif
 }
 
-void cpu_get_tb_cpu_state(CPUARMState *env, vaddr *pc,
-                          uint64_t *cs_base, uint32_t *flags);
-
 enum {
     QEMU_PSCI_CONDUIT_DISABLED = 0,
     QEMU_PSCI_CONDUIT_SMC = 1,
diff --git a/target/arm/helper.c b/target/arm/helper.c
index 8de4eb2c1f..98adeb7086 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -30,6 +30,7 @@
 #include "qemu/guest-random.h"
 #ifdef CONFIG_TCG
 #include "accel/tcg/probe.h"
+#include "accel/tcg/cpu-ops.h"
 #include "semihosting/common-semi.h"
 #endif
 #include "cpregs.h"
diff --git a/target/avr/cpu.c b/target/avr/cpu.c
index 50b835e1ae..d9fecb272e 100644
--- a/target/avr/cpu.c
+++ b/target/avr/cpu.c
@@ -27,6 +27,7 @@
 #include "disas/dis-asm.h"
 #include "tcg/debug-assert.h"
 #include "hw/qdev-properties.h"
+#include "accel/tcg/cpu-ops.h"
 
 static void avr_cpu_set_pc(CPUState *cs, vaddr value)
 {
@@ -53,6 +54,24 @@ static int avr_cpu_mmu_index(CPUState *cs, bool ifetch)
     return ifetch ? MMU_CODE_IDX : MMU_DATA_IDX;
 }
 
+void cpu_get_tb_cpu_state(CPUAVRState *env, vaddr *pc,
+                          uint64_t *cs_base, uint32_t *pflags)
+{
+    uint32_t flags = 0;
+
+    *pc = env->pc_w * 2;
+    *cs_base = 0;
+
+    if (env->fullacc) {
+        flags |= TB_FLAGS_FULL_ACCESS;
+    }
+    if (env->skip) {
+        flags |= TB_FLAGS_SKIP;
+    }
+
+    *pflags = flags;
+}
+
 static void avr_cpu_synchronize_from_tb(CPUState *cs,
                                         const TranslationBlock *tb)
 {
@@ -220,8 +239,6 @@ static const struct SysemuCPUOps avr_sysemu_ops = {
     .get_phys_page_debug = avr_cpu_get_phys_page_debug,
 };
 
-#include "accel/tcg/cpu-ops.h"
-
 static const TCGCPUOps avr_tcg_ops = {
     .guest_default_memory_order = 0,
     .mttcg_supported = false,
diff --git a/target/avr/cpu.h b/target/avr/cpu.h
index d6666175a9..518e243d81 100644
--- a/target/avr/cpu.h
+++ b/target/avr/cpu.h
@@ -205,24 +205,6 @@ enum {
     TB_FLAGS_SKIP = 2,
 };
 
-static inline void cpu_get_tb_cpu_state(CPUAVRState *env, vaddr *pc,
-                                        uint64_t *cs_base, uint32_t *pflags)
-{
-    uint32_t flags = 0;
-
-    *pc = env->pc_w * 2;
-    *cs_base = 0;
-
-    if (env->fullacc) {
-        flags |= TB_FLAGS_FULL_ACCESS;
-    }
-    if (env->skip) {
-        flags |= TB_FLAGS_SKIP;
-    }
-
-    *pflags = flags;
-}
-
 static inline int cpu_interrupts_enabled(CPUAVRState *env)
 {
     return env->sregI != 0;
diff --git a/target/hexagon/cpu.c b/target/hexagon/cpu.c
index c1bfa80252..2272f1222b 100644
--- a/target/hexagon/cpu.c
+++ b/target/hexagon/cpu.c
@@ -25,6 +25,7 @@
 #include "fpu/softfloat-helpers.h"
 #include "tcg/tcg.h"
 #include "exec/gdbstub.h"
+#include "accel/tcg/cpu-ops.h"
 
 static void hexagon_v66_cpu_init(Object *obj) { }
 static void hexagon_v67_cpu_init(Object *obj) { }
@@ -254,6 +255,21 @@ static vaddr hexagon_cpu_get_pc(CPUState *cs)
     return cpu_env(cs)->gpr[HEX_REG_PC];
 }
 
+void cpu_get_tb_cpu_state(CPUHexagonState *env, vaddr *pc,
+                          uint64_t *cs_base, uint32_t *flags)
+{
+    uint32_t hex_flags = 0;
+    *pc = env->gpr[HEX_REG_PC];
+    *cs_base = 0;
+    if (*pc == env->gpr[HEX_REG_SA0]) {
+        hex_flags = FIELD_DP32(hex_flags, TB_FLAGS, IS_TIGHT_LOOP, 1);
+    }
+    *flags = hex_flags;
+    if (*pc & PCALIGN_MASK) {
+        hexagon_raise_exception_err(env, HEX_CAUSE_PC_NOT_ALIGNED, 0);
+    }
+}
+
 static void hexagon_cpu_synchronize_from_tb(CPUState *cs,
                                             const TranslationBlock *tb)
 {
@@ -321,8 +337,6 @@ static void hexagon_cpu_init(Object *obj)
 {
 }
 
-#include "accel/tcg/cpu-ops.h"
-
 static const TCGCPUOps hexagon_tcg_ops = {
     /* MTTCG not yet supported: require strict ordering */
     .guest_default_memory_order = TCG_MO_ALL,
diff --git a/target/hexagon/cpu.h b/target/hexagon/cpu.h
index c065fa8ddc..43a854f517 100644
--- a/target/hexagon/cpu.h
+++ b/target/hexagon/cpu.h
@@ -137,21 +137,6 @@ G_NORETURN void hexagon_raise_exception_err(CPUHexagonState *env,
                                             uint32_t exception,
                                             uintptr_t pc);
 
-static inline void cpu_get_tb_cpu_state(CPUHexagonState *env, vaddr *pc,
-                                        uint64_t *cs_base, uint32_t *flags)
-{
-    uint32_t hex_flags = 0;
-    *pc = env->gpr[HEX_REG_PC];
-    *cs_base = 0;
-    if (*pc == env->gpr[HEX_REG_SA0]) {
-        hex_flags = FIELD_DP32(hex_flags, TB_FLAGS, IS_TIGHT_LOOP, 1);
-    }
-    *flags = hex_flags;
-    if (*pc & PCALIGN_MASK) {
-        hexagon_raise_exception_err(env, HEX_CAUSE_PC_NOT_ALIGNED, 0);
-    }
-}
-
 typedef HexagonCPU ArchCPU;
 
 void hexagon_translate_init(void);
diff --git a/target/hppa/cpu.c b/target/hppa/cpu.c
index 60b618a22b..4cdaf98ab1 100644
--- a/target/hppa/cpu.c
+++ b/target/hppa/cpu.c
@@ -29,6 +29,7 @@
 #include "fpu/softfloat.h"
 #include "tcg/tcg.h"
 #include "hw/hppa/hppa_hardware.h"
+#include "accel/tcg/cpu-ops.h"
 
 static void hppa_cpu_set_pc(CPUState *cs, vaddr value)
 {
@@ -249,8 +250,6 @@ static const struct SysemuCPUOps hppa_sysemu_ops = {
 };
 #endif
 
-#include "accel/tcg/cpu-ops.h"
-
 static const TCGCPUOps hppa_tcg_ops = {
     /* PA-RISC 1.x processors have a strong memory model.  */
     /*
diff --git a/target/hppa/cpu.h b/target/hppa/cpu.h
index acc9937240..11d59d11ca 100644
--- a/target/hppa/cpu.h
+++ b/target/hppa/cpu.h
@@ -351,9 +351,6 @@ hwaddr hppa_abs_to_phys_pa2_w1(vaddr addr);
 #define CS_BASE_DIFFPAGE    (1 << 12)
 #define CS_BASE_DIFFSPACE   (1 << 13)
 
-void cpu_get_tb_cpu_state(CPUHPPAState *env, vaddr *pc,
-                          uint64_t *cs_base, uint32_t *pflags);
-
 target_ulong cpu_hppa_get_psw(CPUHPPAState *env);
 void cpu_hppa_put_psw(CPUHPPAState *env, target_ulong);
 void update_gva_offset_mask(CPUHPPAState *env);
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index 3182ba413b..4f8ed8868e 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -2599,20 +2599,6 @@ static inline bool is_mmu_index_32(int mmu_index)
 #include "hw/i386/apic.h"
 #endif
 
-static inline void cpu_get_tb_cpu_state(CPUX86State *env, vaddr *pc,
-                                        uint64_t *cs_base, uint32_t *flags)
-{
-    *flags = env->hflags |
-        (env->eflags & (IOPL_MASK | TF_MASK | RF_MASK | VM_MASK | AC_MASK));
-    if (env->hflags & HF_CS64_MASK) {
-        *cs_base = 0;
-        *pc = env->eip;
-    } else {
-        *cs_base = env->segs[R_CS].base;
-        *pc = (uint32_t)(*cs_base + env->eip);
-    }
-}
-
 void do_cpu_init(X86CPU *cpu);
 
 #define MCE_INJECT_BROADCAST    1
diff --git a/target/i386/tcg/tcg-cpu.c b/target/i386/tcg/tcg-cpu.c
index f3f0380e70..bb6f82befb 100644
--- a/target/i386/tcg/tcg-cpu.c
+++ b/target/i386/tcg/tcg-cpu.c
@@ -24,6 +24,7 @@
 #include "accel/accel-cpu-target.h"
 #include "exec/translation-block.h"
 #include "exec/target_page.h"
+#include "accel/tcg/cpu-ops.h"
 #include "tcg-cpu.h"
 
 /* Frob eflags into and out of the CPU temporary format.  */
@@ -47,6 +48,20 @@ static void x86_cpu_exec_exit(CPUState *cs)
     env->eflags = cpu_compute_eflags(env);
 }
 
+void cpu_get_tb_cpu_state(CPUX86State *env, vaddr *pc,
+                          uint64_t *cs_base, uint32_t *flags)
+{
+    *flags = env->hflags |
+        (env->eflags & (IOPL_MASK | TF_MASK | RF_MASK | VM_MASK | AC_MASK));
+    if (env->hflags & HF_CS64_MASK) {
+        *cs_base = 0;
+        *pc = env->eip;
+    } else {
+        *cs_base = env->segs[R_CS].base;
+        *pc = (uint32_t)(*cs_base + env->eip);
+    }
+}
+
 static void x86_cpu_synchronize_from_tb(CPUState *cs,
                                         const TranslationBlock *tb)
 {
@@ -131,8 +146,6 @@ static void x86_cpu_exec_reset(CPUState *cs)
 }
 #endif
 
-#include "accel/tcg/cpu-ops.h"
-
 const TCGCPUOps x86_tcg_ops = {
     .mttcg_supported = true,
     .precise_smc = true,
diff --git a/target/loongarch/cpu.c b/target/loongarch/cpu.c
index c64cba72dd..be770b7e19 100644
--- a/target/loongarch/cpu.c
+++ b/target/loongarch/cpu.c
@@ -29,6 +29,7 @@
 #endif
 #ifdef CONFIG_TCG
 #include "accel/tcg/cpu-ldst.h"
+#include "accel/tcg/cpu-ops.h"
 #include "tcg/tcg.h"
 #endif
 #include "tcg/tcg_loongarch.h"
@@ -335,6 +336,18 @@ static bool loongarch_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
 }
 #endif
 
+void cpu_get_tb_cpu_state(CPULoongArchState *env, vaddr *pc,
+                          uint64_t *cs_base, uint32_t *flags)
+{
+    *pc = env->pc;
+    *cs_base = 0;
+    *flags = env->CSR_CRMD & (R_CSR_CRMD_PLV_MASK | R_CSR_CRMD_PG_MASK);
+    *flags |= FIELD_EX64(env->CSR_EUEN, CSR_EUEN, FPE) * HW_FLAGS_EUEN_FPE;
+    *flags |= FIELD_EX64(env->CSR_EUEN, CSR_EUEN, SXE) * HW_FLAGS_EUEN_SXE;
+    *flags |= FIELD_EX64(env->CSR_EUEN, CSR_EUEN, ASXE) * HW_FLAGS_EUEN_ASXE;
+    *flags |= is_va32(env) * HW_FLAGS_VA32;
+}
+
 static void loongarch_cpu_synchronize_from_tb(CPUState *cs,
                                               const TranslationBlock *tb)
 {
@@ -861,8 +874,6 @@ static void loongarch_cpu_dump_state(CPUState *cs, FILE *f, int flags)
 }
 
 #ifdef CONFIG_TCG
-#include "accel/tcg/cpu-ops.h"
-
 static const TCGCPUOps loongarch_tcg_ops = {
     .guest_default_memory_order = 0,
     .mttcg_supported = true,
diff --git a/target/loongarch/cpu.h b/target/loongarch/cpu.h
index 70ff56e60c..262bf87f7b 100644
--- a/target/loongarch/cpu.h
+++ b/target/loongarch/cpu.h
@@ -492,18 +492,6 @@ static inline void set_pc(CPULoongArchState *env, uint64_t value)
 #define HW_FLAGS_VA32       0x20
 #define HW_FLAGS_EUEN_ASXE  0x40
 
-static inline void cpu_get_tb_cpu_state(CPULoongArchState *env, vaddr *pc,
-                                        uint64_t *cs_base, uint32_t *flags)
-{
-    *pc = env->pc;
-    *cs_base = 0;
-    *flags = env->CSR_CRMD & (R_CSR_CRMD_PLV_MASK | R_CSR_CRMD_PG_MASK);
-    *flags |= FIELD_EX64(env->CSR_EUEN, CSR_EUEN, FPE) * HW_FLAGS_EUEN_FPE;
-    *flags |= FIELD_EX64(env->CSR_EUEN, CSR_EUEN, SXE) * HW_FLAGS_EUEN_SXE;
-    *flags |= FIELD_EX64(env->CSR_EUEN, CSR_EUEN, ASXE) * HW_FLAGS_EUEN_ASXE;
-    *flags |= is_va32(env) * HW_FLAGS_VA32;
-}
-
 #define CPU_RESOLVING_TYPE TYPE_LOONGARCH_CPU
 
 void loongarch_cpu_post_init(Object *obj);
diff --git a/target/m68k/cpu.c b/target/m68k/cpu.c
index f446c6c8f7..2b4ec40509 100644
--- a/target/m68k/cpu.c
+++ b/target/m68k/cpu.c
@@ -23,6 +23,7 @@
 #include "cpu.h"
 #include "migration/vmstate.h"
 #include "fpu/softfloat.h"
+#include "accel/tcg/cpu-ops.h"
 
 static void m68k_cpu_set_pc(CPUState *cs, vaddr value)
 {
@@ -38,6 +39,22 @@ static vaddr m68k_cpu_get_pc(CPUState *cs)
     return cpu->env.pc;
 }
 
+void cpu_get_tb_cpu_state(CPUM68KState *env, vaddr *pc,
+                          uint64_t *cs_base, uint32_t *flags)
+{
+    *pc = env->pc;
+    *cs_base = 0;
+    *flags = (env->macsr >> 4) & TB_FLAGS_MACSR;
+    if (env->sr & SR_S) {
+        *flags |= TB_FLAGS_MSR_S;
+        *flags |= (env->sfc << (TB_FLAGS_SFC_S_BIT - 2)) & TB_FLAGS_SFC_S;
+        *flags |= (env->dfc << (TB_FLAGS_DFC_S_BIT - 2)) & TB_FLAGS_DFC_S;
+    }
+    if (M68K_SR_TRACE(env->sr) == M68K_SR_TRACE_ANY_INS) {
+        *flags |= TB_FLAGS_TRACE;
+    }
+}
+
 static void m68k_restore_state_to_opc(CPUState *cs,
                                       const TranslationBlock *tb,
                                       const uint64_t *data)
@@ -586,8 +603,6 @@ static const struct SysemuCPUOps m68k_sysemu_ops = {
 };
 #endif /* !CONFIG_USER_ONLY */
 
-#include "accel/tcg/cpu-ops.h"
-
 static const TCGCPUOps m68k_tcg_ops = {
     /* MTTCG not yet supported: require strict ordering */
     .guest_default_memory_order = TCG_MO_ALL,
diff --git a/target/m68k/cpu.h b/target/m68k/cpu.h
index 39d0b9d6d7..d9db6a486a 100644
--- a/target/m68k/cpu.h
+++ b/target/m68k/cpu.h
@@ -605,22 +605,6 @@ void m68k_cpu_transaction_failed(CPUState *cs, hwaddr physaddr, vaddr addr,
 #define TB_FLAGS_TRACE          16
 #define TB_FLAGS_TRACE_BIT      (1 << TB_FLAGS_TRACE)
 
-static inline void cpu_get_tb_cpu_state(CPUM68KState *env, vaddr *pc,
-                                        uint64_t *cs_base, uint32_t *flags)
-{
-    *pc = env->pc;
-    *cs_base = 0;
-    *flags = (env->macsr >> 4) & TB_FLAGS_MACSR;
-    if (env->sr & SR_S) {
-        *flags |= TB_FLAGS_MSR_S;
-        *flags |= (env->sfc << (TB_FLAGS_SFC_S_BIT - 2)) & TB_FLAGS_SFC_S;
-        *flags |= (env->dfc << (TB_FLAGS_DFC_S_BIT - 2)) & TB_FLAGS_DFC_S;
-    }
-    if (M68K_SR_TRACE(env->sr) == M68K_SR_TRACE_ANY_INS) {
-        *flags |= TB_FLAGS_TRACE;
-    }
-}
-
 void dump_mmu(CPUM68KState *env);
 
 #endif
diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
index f305ed04f6..105ede0b1e 100644
--- a/target/microblaze/cpu.c
+++ b/target/microblaze/cpu.c
@@ -31,6 +31,7 @@
 #include "exec/gdbstub.h"
 #include "exec/translation-block.h"
 #include "fpu/softfloat-helpers.h"
+#include "accel/tcg/cpu-ops.h"
 #include "tcg/tcg.h"
 
 static const struct {
@@ -94,6 +95,14 @@ static vaddr mb_cpu_get_pc(CPUState *cs)
     return cpu->env.pc;
 }
 
+void cpu_get_tb_cpu_state(CPUMBState *env, vaddr *pc,
+                          uint64_t *cs_base, uint32_t *flags)
+{
+    *pc = env->pc;
+    *flags = (env->iflags & IFLAGS_TB_MASK) | (env->msr & MSR_TB_MASK);
+    *cs_base = (*flags & IMM_FLAG ? env->imm : 0);
+}
+
 static void mb_cpu_synchronize_from_tb(CPUState *cs,
                                        const TranslationBlock *tb)
 {
@@ -423,8 +432,6 @@ static const struct SysemuCPUOps mb_sysemu_ops = {
 };
 #endif
 
-#include "accel/tcg/cpu-ops.h"
-
 static const TCGCPUOps mb_tcg_ops = {
     /* MicroBlaze is always in-order. */
     .guest_default_memory_order = TCG_MO_ALL,
diff --git a/target/microblaze/cpu.h b/target/microblaze/cpu.h
index d511f22a55..6ad8643f2e 100644
--- a/target/microblaze/cpu.h
+++ b/target/microblaze/cpu.h
@@ -419,14 +419,6 @@ static inline bool mb_cpu_is_big_endian(CPUState *cs)
     return !cpu->cfg.endi;
 }
 
-static inline void cpu_get_tb_cpu_state(CPUMBState *env, vaddr *pc,
-                                        uint64_t *cs_base, uint32_t *flags)
-{
-    *pc = env->pc;
-    *flags = (env->iflags & IFLAGS_TB_MASK) | (env->msr & MSR_TB_MASK);
-    *cs_base = (*flags & IMM_FLAG ? env->imm : 0);
-}
-
 #if !defined(CONFIG_USER_ONLY)
 bool mb_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
                      MMUAccessType access_type, int mmu_idx,
diff --git a/target/mips/cpu.c b/target/mips/cpu.c
index 09ed330027..ab00adf86b 100644
--- a/target/mips/cpu.c
+++ b/target/mips/cpu.c
@@ -549,6 +549,15 @@ static int mips_cpu_mmu_index(CPUState *cs, bool ifunc)
     return mips_env_mmu_index(cpu_env(cs));
 }
 
+void cpu_get_tb_cpu_state(CPUMIPSState *env, vaddr *pc,
+                          uint64_t *cs_base, uint32_t *flags)
+{
+    *pc = env->active_tc.PC;
+    *cs_base = 0;
+    *flags = env->hflags & (MIPS_HFLAG_TMASK | MIPS_HFLAG_BMASK |
+                            MIPS_HFLAG_HWRENA_ULR);
+}
+
 static const TCGCPUOps mips_tcg_ops = {
     .mttcg_supported = TARGET_LONG_BITS == 32,
     .guest_default_memory_order = 0,
diff --git a/target/mips/cpu.h b/target/mips/cpu.h
index d16f9a7220..5cd4c6c818 100644
--- a/target/mips/cpu.h
+++ b/target/mips/cpu.h
@@ -1366,15 +1366,6 @@ void cpu_mips_clock_init(MIPSCPU *cpu);
 /* helper.c */
 target_ulong exception_resume_pc(CPUMIPSState *env);
 
-static inline void cpu_get_tb_cpu_state(CPUMIPSState *env, vaddr *pc,
-                                        uint64_t *cs_base, uint32_t *flags)
-{
-    *pc = env->active_tc.PC;
-    *cs_base = 0;
-    *flags = env->hflags & (MIPS_HFLAG_TMASK | MIPS_HFLAG_BMASK |
-                            MIPS_HFLAG_HWRENA_ULR);
-}
-
 /**
  * mips_cpu_create_with_clock:
  * @typename: a MIPS CPU type.
diff --git a/target/openrisc/cpu.c b/target/openrisc/cpu.c
index 94776e0ad8..d798127d67 100644
--- a/target/openrisc/cpu.c
+++ b/target/openrisc/cpu.c
@@ -23,6 +23,7 @@
 #include "cpu.h"
 #include "exec/translation-block.h"
 #include "fpu/softfloat-helpers.h"
+#include "accel/tcg/cpu-ops.h"
 #include "tcg/tcg.h"
 
 static void openrisc_cpu_set_pc(CPUState *cs, vaddr value)
@@ -40,6 +41,16 @@ static vaddr openrisc_cpu_get_pc(CPUState *cs)
     return cpu->env.pc;
 }
 
+void cpu_get_tb_cpu_state(CPUOpenRISCState *env, vaddr *pc,
+                          uint64_t *cs_base, uint32_t *flags)
+{
+    *pc = env->pc;
+    *cs_base = 0;
+    *flags = (env->dflag ? TB_FLAGS_DFLAG : 0)
+           | (cpu_get_gpr(env, 0) ? 0 : TB_FLAGS_R0_0)
+           | (env->sr & (SR_SM | SR_DME | SR_IME | SR_OVE));
+}
+
 static void openrisc_cpu_synchronize_from_tb(CPUState *cs,
                                              const TranslationBlock *tb)
 {
@@ -239,8 +250,6 @@ static const struct SysemuCPUOps openrisc_sysemu_ops = {
 };
 #endif
 
-#include "accel/tcg/cpu-ops.h"
-
 static const TCGCPUOps openrisc_tcg_ops = {
     .guest_default_memory_order = 0,
     .mttcg_supported = true,
diff --git a/target/openrisc/cpu.h b/target/openrisc/cpu.h
index 569819bfb0..f4bcf00b07 100644
--- a/target/openrisc/cpu.h
+++ b/target/openrisc/cpu.h
@@ -349,16 +349,6 @@ static inline void cpu_set_gpr(CPUOpenRISCState *env, int i, uint32_t val)
     env->shadow_gpr[0][i] = val;
 }
 
-static inline void cpu_get_tb_cpu_state(CPUOpenRISCState *env, vaddr *pc,
-                                        uint64_t *cs_base, uint32_t *flags)
-{
-    *pc = env->pc;
-    *cs_base = 0;
-    *flags = (env->dflag ? TB_FLAGS_DFLAG : 0)
-           | (cpu_get_gpr(env, 0) ? 0 : TB_FLAGS_R0_0)
-           | (env->sr & (SR_SM | SR_DME | SR_IME | SR_OVE));
-}
-
 static inline uint32_t cpu_get_sr(const CPUOpenRISCState *env)
 {
     return (env->sr
diff --git a/target/ppc/cpu.h b/target/ppc/cpu.h
index 13115a89ff..6b90543811 100644
--- a/target/ppc/cpu.h
+++ b/target/ppc/cpu.h
@@ -2751,19 +2751,6 @@ void cpu_write_xer(CPUPPCState *env, target_ulong xer);
  */
 #define is_book3s_arch2x(ctx) (!!((ctx)->insns_flags & PPC_SEGMENT_64B))
 
-#ifdef CONFIG_DEBUG_TCG
-void cpu_get_tb_cpu_state(CPUPPCState *env, vaddr *pc,
-                          uint64_t *cs_base, uint32_t *flags);
-#else
-static inline void cpu_get_tb_cpu_state(CPUPPCState *env, vaddr *pc,
-                                        uint64_t *cs_base, uint32_t *flags)
-{
-    *pc = env->nip;
-    *cs_base = 0;
-    *flags = env->hflags;
-}
-#endif
-
 G_NORETURN void raise_exception_err_ra(CPUPPCState *env, uint32_t exception,
                                        uint32_t error_code, uintptr_t raddr);
 
diff --git a/target/ppc/helper_regs.c b/target/ppc/helper_regs.c
index f211bc9830..8d248bcbb9 100644
--- a/target/ppc/helper_regs.c
+++ b/target/ppc/helper_regs.c
@@ -27,6 +27,7 @@
 #include "power8-pmu.h"
 #include "cpu-models.h"
 #include "spr_common.h"
+#include "accel/tcg/cpu-ops.h"
 
 /* Swap temporary saved registers with GPRs */
 void hreg_swap_gpr_tgpr(CPUPPCState *env)
@@ -255,26 +256,25 @@ void hreg_update_pmu_hflags(CPUPPCState *env)
     env->hflags |= hreg_compute_pmu_hflags_value(env);
 }
 
-#ifdef CONFIG_DEBUG_TCG
 void cpu_get_tb_cpu_state(CPUPPCState *env, vaddr *pc,
                           uint64_t *cs_base, uint32_t *flags)
 {
     uint32_t hflags_current = env->hflags;
-    uint32_t hflags_rebuilt;
 
-    *pc = env->nip;
-    *cs_base = 0;
-    *flags = hflags_current;
-
-    hflags_rebuilt = hreg_compute_hflags_value(env);
+#ifdef CONFIG_DEBUG_TCG
+    uint32_t hflags_rebuilt = hreg_compute_hflags_value(env);
     if (unlikely(hflags_current != hflags_rebuilt)) {
         cpu_abort(env_cpu(env),
                   "TCG hflags mismatch (current:0x%08x rebuilt:0x%08x)\n",
                   hflags_current, hflags_rebuilt);
     }
-}
 #endif
 
+    *pc = env->nip;
+    *cs_base = 0;
+    *flags = hflags_current;
+}
+
 void cpu_interrupt_exittb(CPUState *cs)
 {
     /*
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index 167909c89b..c66ac3bc27 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -802,9 +802,6 @@ static inline uint32_t vext_get_vlmax(uint32_t vlenb, uint32_t vsew,
     return vlen >> (vsew + 3 - lmul);
 }
 
-void cpu_get_tb_cpu_state(CPURISCVState *env, vaddr *pc,
-                          uint64_t *cs_base, uint32_t *pflags);
-
 bool riscv_cpu_is_32bit(RISCVCPU *cpu);
 
 bool riscv_cpu_virt_mem_enabled(CPURISCVState *env);
diff --git a/target/rx/cpu.c b/target/rx/cpu.c
index de2e6a22ff..e8b47be675 100644
--- a/target/rx/cpu.c
+++ b/target/rx/cpu.c
@@ -28,6 +28,7 @@
 #include "hw/loader.h"
 #include "fpu/softfloat.h"
 #include "tcg/debug-assert.h"
+#include "accel/tcg/cpu-ops.h"
 
 static void rx_cpu_set_pc(CPUState *cs, vaddr value)
 {
@@ -43,6 +44,15 @@ static vaddr rx_cpu_get_pc(CPUState *cs)
     return cpu->env.pc;
 }
 
+void cpu_get_tb_cpu_state(CPURXState *env, vaddr *pc,
+                          uint64_t *cs_base, uint32_t *flags)
+{
+    *pc = env->pc;
+    *cs_base = 0;
+    *flags = FIELD_DP32(0, PSW, PM, env->psw_pm);
+    *flags = FIELD_DP32(*flags, PSW, U, env->psw_u);
+}
+
 static void rx_cpu_synchronize_from_tb(CPUState *cs,
                                        const TranslationBlock *tb)
 {
@@ -201,8 +211,6 @@ static const struct SysemuCPUOps rx_sysemu_ops = {
     .get_phys_page_debug = rx_cpu_get_phys_page_debug,
 };
 
-#include "accel/tcg/cpu-ops.h"
-
 static const TCGCPUOps rx_tcg_ops = {
     /* MTTCG not yet supported: require strict ordering */
     .guest_default_memory_order = TCG_MO_ALL,
diff --git a/target/rx/cpu.h b/target/rx/cpu.h
index 5c19c83219..ba5761b647 100644
--- a/target/rx/cpu.h
+++ b/target/rx/cpu.h
@@ -153,15 +153,6 @@ void rx_cpu_unpack_psw(CPURXState *env, uint32_t psw, int rte);
 #define RX_CPU_IRQ 0
 #define RX_CPU_FIR 1
 
-static inline void cpu_get_tb_cpu_state(CPURXState *env, vaddr *pc,
-                                        uint64_t *cs_base, uint32_t *flags)
-{
-    *pc = env->pc;
-    *cs_base = 0;
-    *flags = FIELD_DP32(0, PSW, PM, env->psw_pm);
-    *flags = FIELD_DP32(*flags, PSW, U, env->psw_u);
-}
-
 static inline uint32_t rx_cpu_pack_psw(CPURXState *env)
 {
     uint32_t psw = 0;
diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
index 71338aae77..435b2034ff 100644
--- a/target/s390x/cpu.c
+++ b/target/s390x/cpu.c
@@ -302,6 +302,7 @@ static const Property s390x_cpu_properties[] = {
 
 #ifdef CONFIG_TCG
 #include "accel/tcg/cpu-ops.h"
+#include "tcg/tcg_s390x.h"
 
 static int s390x_cpu_mmu_index(CPUState *cs, bool ifetch)
 {
diff --git a/target/s390x/cpu.h b/target/s390x/cpu.h
index 530d97ccf1..aa931cb674 100644
--- a/target/s390x/cpu.h
+++ b/target/s390x/cpu.h
@@ -411,15 +411,6 @@ static inline int s390x_env_mmu_index(CPUS390XState *env, bool ifetch)
 #endif
 }
 
-#ifdef CONFIG_TCG
-
-#include "tcg/tcg_s390x.h"
-
-void cpu_get_tb_cpu_state(CPUS390XState *env, vaddr *pc,
-                          uint64_t *cs_base, uint32_t *flags);
-
-#endif /* CONFIG_TCG */
-
 /* PER bits from control register 9 */
 #define PER_CR9_EVENT_BRANCH                    0x80000000
 #define PER_CR9_EVENT_IFETCH                    0x40000000
diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
index 681237c511..5fb18bf55e 100644
--- a/target/sh4/cpu.c
+++ b/target/sh4/cpu.c
@@ -26,6 +26,7 @@
 #include "migration/vmstate.h"
 #include "exec/translation-block.h"
 #include "fpu/softfloat-helpers.h"
+#include "accel/tcg/cpu-ops.h"
 #include "tcg/tcg.h"
 
 static void superh_cpu_set_pc(CPUState *cs, vaddr value)
@@ -42,6 +43,21 @@ static vaddr superh_cpu_get_pc(CPUState *cs)
     return cpu->env.pc;
 }
 
+void cpu_get_tb_cpu_state(CPUSH4State *env, vaddr *pc,
+                          uint64_t *cs_base, uint32_t *flags)
+{
+    *pc = env->pc;
+    /* For a gUSA region, notice the end of the region.  */
+    *cs_base = env->flags & TB_FLAG_GUSA_MASK ? env->gregs[0] : 0;
+    *flags = env->flags
+            | (env->fpscr & TB_FLAG_FPSCR_MASK)
+            | (env->sr & TB_FLAG_SR_MASK)
+            | (env->movcal_backup ? TB_FLAG_PENDING_MOVCA : 0); /* Bit 3 */
+#ifdef CONFIG_USER_ONLY
+    *flags |= TB_FLAG_UNALIGN * !env_cpu(env)->prctl_unalign_sigbus;
+#endif
+}
+
 static void superh_cpu_synchronize_from_tb(CPUState *cs,
                                            const TranslationBlock *tb)
 {
@@ -258,8 +274,6 @@ static const struct SysemuCPUOps sh4_sysemu_ops = {
 };
 #endif
 
-#include "accel/tcg/cpu-ops.h"
-
 static const TCGCPUOps superh_tcg_ops = {
     /* MTTCG not yet supported: require strict ordering */
     .guest_default_memory_order = TCG_MO_ALL,
diff --git a/target/sh4/cpu.h b/target/sh4/cpu.h
index 906f99ddf0..c41ab70dd7 100644
--- a/target/sh4/cpu.h
+++ b/target/sh4/cpu.h
@@ -380,19 +380,4 @@ static inline void cpu_write_sr(CPUSH4State *env, target_ulong sr)
     env->sr = sr & ~((1u << SR_M) | (1u << SR_Q) | (1u << SR_T));
 }
 
-static inline void cpu_get_tb_cpu_state(CPUSH4State *env, vaddr *pc,
-                                        uint64_t *cs_base, uint32_t *flags)
-{
-    *pc = env->pc;
-    /* For a gUSA region, notice the end of the region.  */
-    *cs_base = env->flags & TB_FLAG_GUSA_MASK ? env->gregs[0] : 0;
-    *flags = env->flags
-            | (env->fpscr & TB_FLAG_FPSCR_MASK)
-            | (env->sr & TB_FLAG_SR_MASK)
-            | (env->movcal_backup ? TB_FLAG_PENDING_MOVCA : 0); /* Bit 3 */
-#ifdef CONFIG_USER_ONLY
-    *flags |= TB_FLAG_UNALIGN * !env_cpu(env)->prctl_unalign_sigbus;
-#endif
-}
-
 #endif /* SH4_CPU_H */
diff --git a/target/sparc/cpu.h b/target/sparc/cpu.h
index 37fd1e066e..31cb3d97eb 100644
--- a/target/sparc/cpu.h
+++ b/target/sparc/cpu.h
@@ -741,9 +741,6 @@ trap_state* cpu_tsptr(CPUSPARCState* env);
 #define TB_FLAG_FSR_QNE      (1 << 8)
 #define TB_FLAG_ASI_SHIFT    24
 
-void cpu_get_tb_cpu_state(CPUSPARCState *env, vaddr *pc,
-                          uint64_t *cs_base, uint32_t *pflags);
-
 static inline bool tb_fpu_enabled(int tb_flags)
 {
 #if defined(CONFIG_USER_ONLY)
diff --git a/target/tricore/cpu.c b/target/tricore/cpu.c
index 0fcac697f6..81b3bb6362 100644
--- a/target/tricore/cpu.c
+++ b/target/tricore/cpu.c
@@ -23,6 +23,7 @@
 #include "exec/translation-block.h"
 #include "qemu/error-report.h"
 #include "tcg/debug-assert.h"
+#include "accel/tcg/cpu-ops.h"
 
 static inline void set_feature(CPUTriCoreState *env, int feature)
 {
@@ -44,6 +45,18 @@ static vaddr tricore_cpu_get_pc(CPUState *cs)
     return cpu_env(cs)->PC;
 }
 
+void cpu_get_tb_cpu_state(CPUTriCoreState *env, vaddr *pc,
+                          uint64_t *cs_base, uint32_t *flags)
+{
+    uint32_t new_flags = 0;
+    *pc = env->PC;
+    *cs_base = 0;
+
+    new_flags |= FIELD_DP32(new_flags, TB_FLAGS, PRIV,
+            extract32(env->PSW, 10, 2));
+    *flags = new_flags;
+}
+
 static void tricore_cpu_synchronize_from_tb(CPUState *cs,
                                             const TranslationBlock *tb)
 {
@@ -168,8 +181,6 @@ static const struct SysemuCPUOps tricore_sysemu_ops = {
     .get_phys_page_debug = tricore_cpu_get_phys_page_debug,
 };
 
-#include "accel/tcg/cpu-ops.h"
-
 static const TCGCPUOps tricore_tcg_ops = {
     /* MTTCG not yet supported: require strict ordering */
     .guest_default_memory_order = TCG_MO_ALL,
diff --git a/target/tricore/cpu.h b/target/tricore/cpu.h
index c76e65f818..82085fbc32 100644
--- a/target/tricore/cpu.h
+++ b/target/tricore/cpu.h
@@ -258,18 +258,6 @@ void tricore_tcg_init(void);
 void tricore_translate_code(CPUState *cs, TranslationBlock *tb,
                             int *max_insns, vaddr pc, void *host_pc);
 
-static inline void cpu_get_tb_cpu_state(CPUTriCoreState *env, vaddr *pc,
-                                        uint64_t *cs_base, uint32_t *flags)
-{
-    uint32_t new_flags = 0;
-    *pc = env->PC;
-    *cs_base = 0;
-
-    new_flags |= FIELD_DP32(new_flags, TB_FLAGS, PRIV,
-            extract32(env->PSW, 10, 2));
-    *flags = new_flags;
-}
-
 #define CPU_RESOLVING_TYPE TYPE_TRICORE_CPU
 
 /* helpers.c */
diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
index 9dcb883208..c78ef9421c 100644
--- a/target/xtensa/cpu.c
+++ b/target/xtensa/cpu.c
@@ -35,6 +35,7 @@
 #include "qemu/module.h"
 #include "migration/vmstate.h"
 #include "hw/qdev-clock.h"
+#include "accel/tcg/cpu-ops.h"
 #ifndef CONFIG_USER_ONLY
 #include "system/memory.h"
 #endif
@@ -54,6 +55,74 @@ static vaddr xtensa_cpu_get_pc(CPUState *cs)
     return cpu->env.pc;
 }
 
+void cpu_get_tb_cpu_state(CPUXtensaState *env, vaddr *pc,
+                          uint64_t *cs_base, uint32_t *flags)
+{
+    *pc = env->pc;
+    *cs_base = 0;
+    *flags = 0;
+    *flags |= xtensa_get_ring(env);
+    if (env->sregs[PS] & PS_EXCM) {
+        *flags |= XTENSA_TBFLAG_EXCM;
+    } else if (xtensa_option_enabled(env->config, XTENSA_OPTION_LOOP)) {
+        target_ulong lend_dist =
+            env->sregs[LEND] - (env->pc & -(1u << TARGET_PAGE_BITS));
+
+        /*
+         * 0 in the csbase_lend field means that there may not be a loopback
+         * for any instruction that starts inside this page. Any other value
+         * means that an instruction that ends at this offset from the page
+         * start may loop back and will need loopback code to be generated.
+         *
+         * lend_dist is 0 when LEND points to the start of the page, but
+         * no instruction that starts inside this page may end at offset 0,
+         * so it's still correct.
+         *
+         * When an instruction ends at a page boundary it may only start in
+         * the previous page. lend_dist will be encoded as TARGET_PAGE_SIZE
+         * for the TB that contains this instruction.
+         */
+        if (lend_dist < (1u << TARGET_PAGE_BITS) + env->config->max_insn_size) {
+            target_ulong lbeg_off = env->sregs[LEND] - env->sregs[LBEG];
+
+            *cs_base = lend_dist;
+            if (lbeg_off < 256) {
+                *cs_base |= lbeg_off << XTENSA_CSBASE_LBEG_OFF_SHIFT;
+            }
+        }
+    }
+    if (xtensa_option_enabled(env->config, XTENSA_OPTION_EXTENDED_L32R) &&
+            (env->sregs[LITBASE] & 1)) {
+        *flags |= XTENSA_TBFLAG_LITBASE;
+    }
+    if (xtensa_option_enabled(env->config, XTENSA_OPTION_DEBUG)) {
+        if (xtensa_get_cintlevel(env) < env->config->debug_level) {
+            *flags |= XTENSA_TBFLAG_DEBUG;
+        }
+        if (xtensa_get_cintlevel(env) < env->sregs[ICOUNTLEVEL]) {
+            *flags |= XTENSA_TBFLAG_ICOUNT;
+        }
+    }
+    if (xtensa_option_enabled(env->config, XTENSA_OPTION_COPROCESSOR)) {
+        *flags |= env->sregs[CPENABLE] << XTENSA_TBFLAG_CPENABLE_SHIFT;
+    }
+    if (xtensa_option_enabled(env->config, XTENSA_OPTION_WINDOWED_REGISTER) &&
+        (env->sregs[PS] & (PS_WOE | PS_EXCM)) == PS_WOE) {
+        uint32_t windowstart = xtensa_replicate_windowstart(env) >>
+            (env->sregs[WINDOW_BASE] + 1);
+        uint32_t w = ctz32(windowstart | 0x8);
+
+        *flags |= (w << XTENSA_TBFLAG_WINDOW_SHIFT) | XTENSA_TBFLAG_CWOE;
+        *flags |= extract32(env->sregs[PS], PS_CALLINC_SHIFT,
+                            PS_CALLINC_LEN) << XTENSA_TBFLAG_CALLINC_SHIFT;
+    } else {
+        *flags |= 3 << XTENSA_TBFLAG_WINDOW_SHIFT;
+    }
+    if (env->yield_needed) {
+        *flags |= XTENSA_TBFLAG_YIELD;
+    }
+}
+
 static void xtensa_restore_state_to_opc(CPUState *cs,
                                         const TranslationBlock *tb,
                                         const uint64_t *data)
@@ -229,8 +298,6 @@ static const struct SysemuCPUOps xtensa_sysemu_ops = {
 };
 #endif
 
-#include "accel/tcg/cpu-ops.h"
-
 static const TCGCPUOps xtensa_tcg_ops = {
     /* Xtensa processors have a weak memory model */
     .guest_default_memory_order = 0,
diff --git a/target/xtensa/cpu.h b/target/xtensa/cpu.h
index c03ed71c94..74122ebe15 100644
--- a/target/xtensa/cpu.h
+++ b/target/xtensa/cpu.h
@@ -733,74 +733,6 @@ static inline uint32_t xtensa_replicate_windowstart(CPUXtensaState *env)
 #define XTENSA_CSBASE_LBEG_OFF_MASK 0x00ff0000
 #define XTENSA_CSBASE_LBEG_OFF_SHIFT 16
 
-static inline void cpu_get_tb_cpu_state(CPUXtensaState *env, vaddr *pc,
-                                        uint64_t *cs_base, uint32_t *flags)
-{
-    *pc = env->pc;
-    *cs_base = 0;
-    *flags = 0;
-    *flags |= xtensa_get_ring(env);
-    if (env->sregs[PS] & PS_EXCM) {
-        *flags |= XTENSA_TBFLAG_EXCM;
-    } else if (xtensa_option_enabled(env->config, XTENSA_OPTION_LOOP)) {
-        target_ulong lend_dist =
-            env->sregs[LEND] - (env->pc & -(1u << TARGET_PAGE_BITS));
-
-        /*
-         * 0 in the csbase_lend field means that there may not be a loopback
-         * for any instruction that starts inside this page. Any other value
-         * means that an instruction that ends at this offset from the page
-         * start may loop back and will need loopback code to be generated.
-         *
-         * lend_dist is 0 when LEND points to the start of the page, but
-         * no instruction that starts inside this page may end at offset 0,
-         * so it's still correct.
-         *
-         * When an instruction ends at a page boundary it may only start in
-         * the previous page. lend_dist will be encoded as TARGET_PAGE_SIZE
-         * for the TB that contains this instruction.
-         */
-        if (lend_dist < (1u << TARGET_PAGE_BITS) + env->config->max_insn_size) {
-            target_ulong lbeg_off = env->sregs[LEND] - env->sregs[LBEG];
-
-            *cs_base = lend_dist;
-            if (lbeg_off < 256) {
-                *cs_base |= lbeg_off << XTENSA_CSBASE_LBEG_OFF_SHIFT;
-            }
-        }
-    }
-    if (xtensa_option_enabled(env->config, XTENSA_OPTION_EXTENDED_L32R) &&
-            (env->sregs[LITBASE] & 1)) {
-        *flags |= XTENSA_TBFLAG_LITBASE;
-    }
-    if (xtensa_option_enabled(env->config, XTENSA_OPTION_DEBUG)) {
-        if (xtensa_get_cintlevel(env) < env->config->debug_level) {
-            *flags |= XTENSA_TBFLAG_DEBUG;
-        }
-        if (xtensa_get_cintlevel(env) < env->sregs[ICOUNTLEVEL]) {
-            *flags |= XTENSA_TBFLAG_ICOUNT;
-        }
-    }
-    if (xtensa_option_enabled(env->config, XTENSA_OPTION_COPROCESSOR)) {
-        *flags |= env->sregs[CPENABLE] << XTENSA_TBFLAG_CPENABLE_SHIFT;
-    }
-    if (xtensa_option_enabled(env->config, XTENSA_OPTION_WINDOWED_REGISTER) &&
-        (env->sregs[PS] & (PS_WOE | PS_EXCM)) == PS_WOE) {
-        uint32_t windowstart = xtensa_replicate_windowstart(env) >>
-            (env->sregs[WINDOW_BASE] + 1);
-        uint32_t w = ctz32(windowstart | 0x8);
-
-        *flags |= (w << XTENSA_TBFLAG_WINDOW_SHIFT) | XTENSA_TBFLAG_CWOE;
-        *flags |= extract32(env->sregs[PS], PS_CALLINC_SHIFT,
-                            PS_CALLINC_LEN) << XTENSA_TBFLAG_CALLINC_SHIFT;
-    } else {
-        *flags |= 3 << XTENSA_TBFLAG_WINDOW_SHIFT;
-    }
-    if (env->yield_needed) {
-        *flags |= XTENSA_TBFLAG_YIELD;
-    }
-}
-
 XtensaCPU *xtensa_cpu_create_with_clock(const char *cpu_type,
                                         Clock *cpu_refclk);
 

From b6aeb8d243c5ab8b914b55f0036e8289a99322c8 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 29 Apr 2025 11:35:26 -0700
Subject: [PATCH 0557/2760] target/arm: Move cpu_get_tb_cpu_state to hflags.c

This is a tcg-specific function, so move it to a tcg file.
Also move mve_no_pred, a static function only used within
cpu_get_tb_cpu_state.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/helper.c     | 110 ----------------------------------------
 target/arm/tcg/hflags.c | 110 ++++++++++++++++++++++++++++++++++++++++
 2 files changed, 110 insertions(+), 110 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index 98adeb7086..360e6ac0f5 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -30,7 +30,6 @@
 #include "qemu/guest-random.h"
 #ifdef CONFIG_TCG
 #include "accel/tcg/probe.h"
-#include "accel/tcg/cpu-ops.h"
 #include "semihosting/common-semi.h"
 #endif
 #include "cpregs.h"
@@ -11424,115 +11423,6 @@ ARMMMUIdx arm_mmu_idx(CPUARMState *env)
     return arm_mmu_idx_el(env, arm_current_el(env));
 }
 
-static bool mve_no_pred(CPUARMState *env)
-{
-    /*
-     * Return true if there is definitely no predication of MVE
-     * instructions by VPR or LTPSIZE. (Returning false even if there
-     * isn't any predication is OK; generated code will just be
-     * a little worse.)
-     * If the CPU does not implement MVE then this TB flag is always 0.
-     *
-     * NOTE: if you change this logic, the "recalculate s->mve_no_pred"
-     * logic in gen_update_fp_context() needs to be updated to match.
-     *
-     * We do not include the effect of the ECI bits here -- they are
-     * tracked in other TB flags. This simplifies the logic for
-     * "when did we emit code that changes the MVE_NO_PRED TB flag
-     * and thus need to end the TB?".
-     */
-    if (cpu_isar_feature(aa32_mve, env_archcpu(env))) {
-        return false;
-    }
-    if (env->v7m.vpr) {
-        return false;
-    }
-    if (env->v7m.ltpsize < 4) {
-        return false;
-    }
-    return true;
-}
-
-void cpu_get_tb_cpu_state(CPUARMState *env, vaddr *pc,
-                          uint64_t *cs_base, uint32_t *pflags)
-{
-    CPUARMTBFlags flags;
-
-    assert_hflags_rebuild_correctly(env);
-    flags = env->hflags;
-
-    if (EX_TBFLAG_ANY(flags, AARCH64_STATE)) {
-        *pc = env->pc;
-        if (cpu_isar_feature(aa64_bti, env_archcpu(env))) {
-            DP_TBFLAG_A64(flags, BTYPE, env->btype);
-        }
-    } else {
-        *pc = env->regs[15];
-
-        if (arm_feature(env, ARM_FEATURE_M)) {
-            if (arm_feature(env, ARM_FEATURE_M_SECURITY) &&
-                FIELD_EX32(env->v7m.fpccr[M_REG_S], V7M_FPCCR, S)
-                != env->v7m.secure) {
-                DP_TBFLAG_M32(flags, FPCCR_S_WRONG, 1);
-            }
-
-            if ((env->v7m.fpccr[env->v7m.secure] & R_V7M_FPCCR_ASPEN_MASK) &&
-                (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK) ||
-                 (env->v7m.secure &&
-                  !(env->v7m.control[M_REG_S] & R_V7M_CONTROL_SFPA_MASK)))) {
-                /*
-                 * ASPEN is set, but FPCA/SFPA indicate that there is no
-                 * active FP context; we must create a new FP context before
-                 * executing any FP insn.
-                 */
-                DP_TBFLAG_M32(flags, NEW_FP_CTXT_NEEDED, 1);
-            }
-
-            bool is_secure = env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_S_MASK;
-            if (env->v7m.fpccr[is_secure] & R_V7M_FPCCR_LSPACT_MASK) {
-                DP_TBFLAG_M32(flags, LSPACT, 1);
-            }
-
-            if (mve_no_pred(env)) {
-                DP_TBFLAG_M32(flags, MVE_NO_PRED, 1);
-            }
-        } else {
-            /*
-             * Note that XSCALE_CPAR shares bits with VECSTRIDE.
-             * Note that VECLEN+VECSTRIDE are RES0 for M-profile.
-             */
-            if (arm_feature(env, ARM_FEATURE_XSCALE)) {
-                DP_TBFLAG_A32(flags, XSCALE_CPAR, env->cp15.c15_cpar);
-            } else {
-                DP_TBFLAG_A32(flags, VECLEN, env->vfp.vec_len);
-                DP_TBFLAG_A32(flags, VECSTRIDE, env->vfp.vec_stride);
-            }
-            if (env->vfp.xregs[ARM_VFP_FPEXC] & (1 << 30)) {
-                DP_TBFLAG_A32(flags, VFPEN, 1);
-            }
-        }
-
-        DP_TBFLAG_AM32(flags, THUMB, env->thumb);
-        DP_TBFLAG_AM32(flags, CONDEXEC, env->condexec_bits);
-    }
-
-    /*
-     * The SS_ACTIVE and PSTATE_SS bits correspond to the state machine
-     * states defined in the ARM ARM for software singlestep:
-     *  SS_ACTIVE   PSTATE.SS   State
-     *     0            x       Inactive (the TB flag for SS is always 0)
-     *     1            0       Active-pending
-     *     1            1       Active-not-pending
-     * SS_ACTIVE is set in hflags; PSTATE__SS is computed every TB.
-     */
-    if (EX_TBFLAG_ANY(flags, SS_ACTIVE) && (env->pstate & PSTATE_SS)) {
-        DP_TBFLAG_ANY(flags, PSTATE__SS, 1);
-    }
-
-    *pflags = flags.flags;
-    *cs_base = flags.flags2;
-}
-
 #ifdef TARGET_AARCH64
 /*
  * The manual says that when SVE is enabled and VQ is widened the
diff --git a/target/arm/tcg/hflags.c b/target/arm/tcg/hflags.c
index e51d9f7b15..e530f65ed7 100644
--- a/target/arm/tcg/hflags.c
+++ b/target/arm/tcg/hflags.c
@@ -10,6 +10,7 @@
 #include "internals.h"
 #include "cpu-features.h"
 #include "exec/helper-proto.h"
+#include "accel/tcg/cpu-ops.h"
 #include "cpregs.h"
 
 static inline bool fgt_svc(CPUARMState *env, int el)
@@ -513,3 +514,112 @@ void assert_hflags_rebuild_correctly(CPUARMState *env)
     }
 #endif
 }
+
+static bool mve_no_pred(CPUARMState *env)
+{
+    /*
+     * Return true if there is definitely no predication of MVE
+     * instructions by VPR or LTPSIZE. (Returning false even if there
+     * isn't any predication is OK; generated code will just be
+     * a little worse.)
+     * If the CPU does not implement MVE then this TB flag is always 0.
+     *
+     * NOTE: if you change this logic, the "recalculate s->mve_no_pred"
+     * logic in gen_update_fp_context() needs to be updated to match.
+     *
+     * We do not include the effect of the ECI bits here -- they are
+     * tracked in other TB flags. This simplifies the logic for
+     * "when did we emit code that changes the MVE_NO_PRED TB flag
+     * and thus need to end the TB?".
+     */
+    if (cpu_isar_feature(aa32_mve, env_archcpu(env))) {
+        return false;
+    }
+    if (env->v7m.vpr) {
+        return false;
+    }
+    if (env->v7m.ltpsize < 4) {
+        return false;
+    }
+    return true;
+}
+
+void cpu_get_tb_cpu_state(CPUARMState *env, vaddr *pc,
+                          uint64_t *cs_base, uint32_t *pflags)
+{
+    CPUARMTBFlags flags;
+
+    assert_hflags_rebuild_correctly(env);
+    flags = env->hflags;
+
+    if (EX_TBFLAG_ANY(flags, AARCH64_STATE)) {
+        *pc = env->pc;
+        if (cpu_isar_feature(aa64_bti, env_archcpu(env))) {
+            DP_TBFLAG_A64(flags, BTYPE, env->btype);
+        }
+    } else {
+        *pc = env->regs[15];
+
+        if (arm_feature(env, ARM_FEATURE_M)) {
+            if (arm_feature(env, ARM_FEATURE_M_SECURITY) &&
+                FIELD_EX32(env->v7m.fpccr[M_REG_S], V7M_FPCCR, S)
+                != env->v7m.secure) {
+                DP_TBFLAG_M32(flags, FPCCR_S_WRONG, 1);
+            }
+
+            if ((env->v7m.fpccr[env->v7m.secure] & R_V7M_FPCCR_ASPEN_MASK) &&
+                (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK) ||
+                 (env->v7m.secure &&
+                  !(env->v7m.control[M_REG_S] & R_V7M_CONTROL_SFPA_MASK)))) {
+                /*
+                 * ASPEN is set, but FPCA/SFPA indicate that there is no
+                 * active FP context; we must create a new FP context before
+                 * executing any FP insn.
+                 */
+                DP_TBFLAG_M32(flags, NEW_FP_CTXT_NEEDED, 1);
+            }
+
+            bool is_secure = env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_S_MASK;
+            if (env->v7m.fpccr[is_secure] & R_V7M_FPCCR_LSPACT_MASK) {
+                DP_TBFLAG_M32(flags, LSPACT, 1);
+            }
+
+            if (mve_no_pred(env)) {
+                DP_TBFLAG_M32(flags, MVE_NO_PRED, 1);
+            }
+        } else {
+            /*
+             * Note that XSCALE_CPAR shares bits with VECSTRIDE.
+             * Note that VECLEN+VECSTRIDE are RES0 for M-profile.
+             */
+            if (arm_feature(env, ARM_FEATURE_XSCALE)) {
+                DP_TBFLAG_A32(flags, XSCALE_CPAR, env->cp15.c15_cpar);
+            } else {
+                DP_TBFLAG_A32(flags, VECLEN, env->vfp.vec_len);
+                DP_TBFLAG_A32(flags, VECSTRIDE, env->vfp.vec_stride);
+            }
+            if (env->vfp.xregs[ARM_VFP_FPEXC] & (1 << 30)) {
+                DP_TBFLAG_A32(flags, VFPEN, 1);
+            }
+        }
+
+        DP_TBFLAG_AM32(flags, THUMB, env->thumb);
+        DP_TBFLAG_AM32(flags, CONDEXEC, env->condexec_bits);
+    }
+
+    /*
+     * The SS_ACTIVE and PSTATE_SS bits correspond to the state machine
+     * states defined in the ARM ARM for software singlestep:
+     *  SS_ACTIVE   PSTATE.SS   State
+     *     0            x       Inactive (the TB flag for SS is always 0)
+     *     1            0       Active-pending
+     *     1            1       Active-not-pending
+     * SS_ACTIVE is set in hflags; PSTATE__SS is computed every TB.
+     */
+    if (EX_TBFLAG_ANY(flags, SS_ACTIVE) && (env->pstate & PSTATE_SS)) {
+        DP_TBFLAG_ANY(flags, PSTATE__SS, 1);
+    }
+
+    *pflags = flags.flags;
+    *cs_base = flags.flags2;
+}

From 9da84372c4e9efedc5326e71358197930ee06445 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 29 Apr 2025 11:37:24 -0700
Subject: [PATCH 0558/2760] target/arm: Unexport
 assert_hflags_rebuild_correctly

This function is no longer used outside of hflags.c.
We can remove the stub as well.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/internals.h  | 2 --
 target/arm/tcg-stubs.c  | 4 ----
 target/arm/tcg/hflags.c | 2 +-
 3 files changed, 1 insertion(+), 7 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index 4d3d84ffeb..382a4d1015 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -1906,8 +1906,6 @@ static inline bool arm_fgt_active(CPUARMState *env, int el)
         (!arm_feature(env, ARM_FEATURE_EL3) || (env->cp15.scr_el3 & SCR_FGTEN));
 }
 
-void assert_hflags_rebuild_correctly(CPUARMState *env);
-
 /*
  * Although the ARM implementation of hardware assisted debugging
  * allows for different breakpoints per-core, the current GDB
diff --git a/target/arm/tcg-stubs.c b/target/arm/tcg-stubs.c
index 93a15cad61..5e5166c049 100644
--- a/target/arm/tcg-stubs.c
+++ b/target/arm/tcg-stubs.c
@@ -21,10 +21,6 @@ void raise_exception_ra(CPUARMState *env, uint32_t excp, uint32_t syndrome,
 {
     g_assert_not_reached();
 }
-/* Temporarily while cpu_get_tb_cpu_state() is still in common code */
-void assert_hflags_rebuild_correctly(CPUARMState *env)
-{
-}
 
 /* TLBI insns are only used by TCG, so we don't need to do anything for KVM */
 void define_tlb_insn_regs(ARMCPU *cpu)
diff --git a/target/arm/tcg/hflags.c b/target/arm/tcg/hflags.c
index e530f65ed7..5315264c28 100644
--- a/target/arm/tcg/hflags.c
+++ b/target/arm/tcg/hflags.c
@@ -499,7 +499,7 @@ void HELPER(rebuild_hflags_a64)(CPUARMState *env, int el)
     env->hflags = rebuild_hflags_a64(env, el, fp_el, mmu_idx);
 }
 
-void assert_hflags_rebuild_correctly(CPUARMState *env)
+static void assert_hflags_rebuild_correctly(CPUARMState *env)
 {
 #ifdef CONFIG_DEBUG_TCG
     CPUARMTBFlags c = env->hflags;

From 5b1c93be57ce6364eb7bbaaab6ecbf2b1d5d979e Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sun, 27 Apr 2025 14:15:45 -0700
Subject: [PATCH 0559/2760] target/riscv: Move cpu_get_tb_cpu_state to
 tcg-cpu.c
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This function is only relevant to tcg.
Move it to a tcg-specific file.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/riscv/cpu_helper.c  | 97 -------------------------------------
 target/riscv/tcg/tcg-cpu.c | 98 ++++++++++++++++++++++++++++++++++++++
 2 files changed, 98 insertions(+), 97 deletions(-)

diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index f2e90a9889..d5039f69a9 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -135,103 +135,6 @@ bool riscv_env_smode_dbltrp_enabled(CPURISCVState *env, bool virt)
 #endif
 }
 
-void cpu_get_tb_cpu_state(CPURISCVState *env, vaddr *pc,
-                          uint64_t *cs_base, uint32_t *pflags)
-{
-    RISCVCPU *cpu = env_archcpu(env);
-    RISCVExtStatus fs, vs;
-    uint32_t flags = 0;
-    bool pm_signext = riscv_cpu_virt_mem_enabled(env);
-
-    *pc = env->xl == MXL_RV32 ? env->pc & UINT32_MAX : env->pc;
-    *cs_base = 0;
-
-    if (cpu->cfg.ext_zve32x) {
-        /*
-         * If env->vl equals to VLMAX, we can use generic vector operation
-         * expanders (GVEC) to accerlate the vector operations.
-         * However, as LMUL could be a fractional number. The maximum
-         * vector size can be operated might be less than 8 bytes,
-         * which is not supported by GVEC. So we set vl_eq_vlmax flag to true
-         * only when maxsz >= 8 bytes.
-         */
-
-        /* lmul encoded as in DisasContext::lmul */
-        int8_t lmul = sextract32(FIELD_EX64(env->vtype, VTYPE, VLMUL), 0, 3);
-        uint32_t vsew = FIELD_EX64(env->vtype, VTYPE, VSEW);
-        uint32_t vlmax = vext_get_vlmax(cpu->cfg.vlenb, vsew, lmul);
-        uint32_t maxsz = vlmax << vsew;
-        bool vl_eq_vlmax = (env->vstart == 0) && (vlmax == env->vl) &&
-                           (maxsz >= 8);
-        flags = FIELD_DP32(flags, TB_FLAGS, VILL, env->vill);
-        flags = FIELD_DP32(flags, TB_FLAGS, SEW, vsew);
-        flags = FIELD_DP32(flags, TB_FLAGS, LMUL,
-                           FIELD_EX64(env->vtype, VTYPE, VLMUL));
-        flags = FIELD_DP32(flags, TB_FLAGS, VL_EQ_VLMAX, vl_eq_vlmax);
-        flags = FIELD_DP32(flags, TB_FLAGS, VTA,
-                           FIELD_EX64(env->vtype, VTYPE, VTA));
-        flags = FIELD_DP32(flags, TB_FLAGS, VMA,
-                           FIELD_EX64(env->vtype, VTYPE, VMA));
-        flags = FIELD_DP32(flags, TB_FLAGS, VSTART_EQ_ZERO, env->vstart == 0);
-    } else {
-        flags = FIELD_DP32(flags, TB_FLAGS, VILL, 1);
-    }
-
-    if (cpu_get_fcfien(env)) {
-        /*
-         * For Forward CFI, only the expectation of a lpad at
-         * the start of the block is tracked via env->elp. env->elp
-         * is turned on during jalr translation.
-         */
-        flags = FIELD_DP32(flags, TB_FLAGS, FCFI_LP_EXPECTED, env->elp);
-        flags = FIELD_DP32(flags, TB_FLAGS, FCFI_ENABLED, 1);
-    }
-
-    if (cpu_get_bcfien(env)) {
-        flags = FIELD_DP32(flags, TB_FLAGS, BCFI_ENABLED, 1);
-    }
-
-#ifdef CONFIG_USER_ONLY
-    fs = EXT_STATUS_DIRTY;
-    vs = EXT_STATUS_DIRTY;
-#else
-    flags = FIELD_DP32(flags, TB_FLAGS, PRIV, env->priv);
-
-    flags |= riscv_env_mmu_index(env, 0);
-    fs = get_field(env->mstatus, MSTATUS_FS);
-    vs = get_field(env->mstatus, MSTATUS_VS);
-
-    if (env->virt_enabled) {
-        flags = FIELD_DP32(flags, TB_FLAGS, VIRT_ENABLED, 1);
-        /*
-         * Merge DISABLED and !DIRTY states using MIN.
-         * We will set both fields when dirtying.
-         */
-        fs = MIN(fs, get_field(env->mstatus_hs, MSTATUS_FS));
-        vs = MIN(vs, get_field(env->mstatus_hs, MSTATUS_VS));
-    }
-
-    /* With Zfinx, floating point is enabled/disabled by Smstateen. */
-    if (!riscv_has_ext(env, RVF)) {
-        fs = (smstateen_acc_ok(env, 0, SMSTATEEN0_FCSR) == RISCV_EXCP_NONE)
-             ? EXT_STATUS_DIRTY : EXT_STATUS_DISABLED;
-    }
-
-    if (cpu->cfg.debug && !icount_enabled()) {
-        flags = FIELD_DP32(flags, TB_FLAGS, ITRIGGER, env->itrigger_enabled);
-    }
-#endif
-
-    flags = FIELD_DP32(flags, TB_FLAGS, FS, fs);
-    flags = FIELD_DP32(flags, TB_FLAGS, VS, vs);
-    flags = FIELD_DP32(flags, TB_FLAGS, XL, env->xl);
-    flags = FIELD_DP32(flags, TB_FLAGS, AXL, cpu_address_xl(env));
-    flags = FIELD_DP32(flags, TB_FLAGS, PM_PMM, riscv_pm_get_pmm(env));
-    flags = FIELD_DP32(flags, TB_FLAGS, PM_SIGNEXTEND, pm_signext);
-
-    *pflags = flags;
-}
-
 RISCVPmPmm riscv_pm_get_pmm(CPURISCVState *env)
 {
 #ifndef CONFIG_USER_ONLY
diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index 50782e0f0e..e67de7dfe2 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -36,6 +36,7 @@
 #ifndef CONFIG_USER_ONLY
 #include "hw/boards.h"
 #include "system/tcg.h"
+#include "exec/icount.h"
 #endif
 
 /* Hash that stores user set extensions */
@@ -97,6 +98,103 @@ static int riscv_cpu_mmu_index(CPUState *cs, bool ifetch)
     return riscv_env_mmu_index(cpu_env(cs), ifetch);
 }
 
+void cpu_get_tb_cpu_state(CPURISCVState *env, vaddr *pc,
+                          uint64_t *cs_base, uint32_t *pflags)
+{
+    RISCVCPU *cpu = env_archcpu(env);
+    RISCVExtStatus fs, vs;
+    uint32_t flags = 0;
+    bool pm_signext = riscv_cpu_virt_mem_enabled(env);
+
+    *pc = env->xl == MXL_RV32 ? env->pc & UINT32_MAX : env->pc;
+    *cs_base = 0;
+
+    if (cpu->cfg.ext_zve32x) {
+        /*
+         * If env->vl equals to VLMAX, we can use generic vector operation
+         * expanders (GVEC) to accerlate the vector operations.
+         * However, as LMUL could be a fractional number. The maximum
+         * vector size can be operated might be less than 8 bytes,
+         * which is not supported by GVEC. So we set vl_eq_vlmax flag to true
+         * only when maxsz >= 8 bytes.
+         */
+
+        /* lmul encoded as in DisasContext::lmul */
+        int8_t lmul = sextract32(FIELD_EX64(env->vtype, VTYPE, VLMUL), 0, 3);
+        uint32_t vsew = FIELD_EX64(env->vtype, VTYPE, VSEW);
+        uint32_t vlmax = vext_get_vlmax(cpu->cfg.vlenb, vsew, lmul);
+        uint32_t maxsz = vlmax << vsew;
+        bool vl_eq_vlmax = (env->vstart == 0) && (vlmax == env->vl) &&
+                           (maxsz >= 8);
+        flags = FIELD_DP32(flags, TB_FLAGS, VILL, env->vill);
+        flags = FIELD_DP32(flags, TB_FLAGS, SEW, vsew);
+        flags = FIELD_DP32(flags, TB_FLAGS, LMUL,
+                           FIELD_EX64(env->vtype, VTYPE, VLMUL));
+        flags = FIELD_DP32(flags, TB_FLAGS, VL_EQ_VLMAX, vl_eq_vlmax);
+        flags = FIELD_DP32(flags, TB_FLAGS, VTA,
+                           FIELD_EX64(env->vtype, VTYPE, VTA));
+        flags = FIELD_DP32(flags, TB_FLAGS, VMA,
+                           FIELD_EX64(env->vtype, VTYPE, VMA));
+        flags = FIELD_DP32(flags, TB_FLAGS, VSTART_EQ_ZERO, env->vstart == 0);
+    } else {
+        flags = FIELD_DP32(flags, TB_FLAGS, VILL, 1);
+    }
+
+    if (cpu_get_fcfien(env)) {
+        /*
+         * For Forward CFI, only the expectation of a lpad at
+         * the start of the block is tracked via env->elp. env->elp
+         * is turned on during jalr translation.
+         */
+        flags = FIELD_DP32(flags, TB_FLAGS, FCFI_LP_EXPECTED, env->elp);
+        flags = FIELD_DP32(flags, TB_FLAGS, FCFI_ENABLED, 1);
+    }
+
+    if (cpu_get_bcfien(env)) {
+        flags = FIELD_DP32(flags, TB_FLAGS, BCFI_ENABLED, 1);
+    }
+
+#ifdef CONFIG_USER_ONLY
+    fs = EXT_STATUS_DIRTY;
+    vs = EXT_STATUS_DIRTY;
+#else
+    flags = FIELD_DP32(flags, TB_FLAGS, PRIV, env->priv);
+
+    flags |= riscv_env_mmu_index(env, 0);
+    fs = get_field(env->mstatus, MSTATUS_FS);
+    vs = get_field(env->mstatus, MSTATUS_VS);
+
+    if (env->virt_enabled) {
+        flags = FIELD_DP32(flags, TB_FLAGS, VIRT_ENABLED, 1);
+        /*
+         * Merge DISABLED and !DIRTY states using MIN.
+         * We will set both fields when dirtying.
+         */
+        fs = MIN(fs, get_field(env->mstatus_hs, MSTATUS_FS));
+        vs = MIN(vs, get_field(env->mstatus_hs, MSTATUS_VS));
+    }
+
+    /* With Zfinx, floating point is enabled/disabled by Smstateen. */
+    if (!riscv_has_ext(env, RVF)) {
+        fs = (smstateen_acc_ok(env, 0, SMSTATEEN0_FCSR) == RISCV_EXCP_NONE)
+             ? EXT_STATUS_DIRTY : EXT_STATUS_DISABLED;
+    }
+
+    if (cpu->cfg.debug && !icount_enabled()) {
+        flags = FIELD_DP32(flags, TB_FLAGS, ITRIGGER, env->itrigger_enabled);
+    }
+#endif
+
+    flags = FIELD_DP32(flags, TB_FLAGS, FS, fs);
+    flags = FIELD_DP32(flags, TB_FLAGS, VS, vs);
+    flags = FIELD_DP32(flags, TB_FLAGS, XL, env->xl);
+    flags = FIELD_DP32(flags, TB_FLAGS, AXL, cpu_address_xl(env));
+    flags = FIELD_DP32(flags, TB_FLAGS, PM_PMM, riscv_pm_get_pmm(env));
+    flags = FIELD_DP32(flags, TB_FLAGS, PM_SIGNEXTEND, pm_signext);
+
+    *pflags = flags;
+}
+
 static void riscv_cpu_synchronize_from_tb(CPUState *cs,
                                           const TranslationBlock *tb)
 {

From 4759aae43235cd00e1c9b67ff5bd920db89fddc5 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sun, 27 Apr 2025 15:32:11 -0700
Subject: [PATCH 0560/2760] accel/tcg: Return TCGTBCPUState from
 cpu_get_tb_cpu_state

Combine 3 different pointer returns into one structure return.

Include a cflags field in TCGTBCPUState, not filled in by
cpu_get_tb_cpu_state, but used by all callers.  This fills
a hole in the structure and is useful in some subroutines.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cpu-exec.c             | 56 +++++++++++++-------------------
 accel/tcg/translate-all.c        |  8 ++---
 include/accel/tcg/cpu-ops.h      |  4 +--
 include/accel/tcg/tb-cpu-state.h | 18 ++++++++++
 target/alpha/cpu.c               | 13 ++++----
 target/arm/tcg/hflags.c          | 17 ++++++----
 target/avr/cpu.c                 |  9 ++---
 target/hexagon/cpu.c             | 15 +++++----
 target/hppa/cpu.c                | 10 +++---
 target/i386/tcg/tcg-cpu.c        | 19 +++++++----
 target/loongarch/cpu.c           | 20 +++++++-----
 target/m68k/cpu.c                | 21 +++++++-----
 target/microblaze/cpu.c          | 13 +++++---
 target/mips/cpu.c                | 14 ++++----
 target/openrisc/cpu.c            | 16 +++++----
 target/ppc/helper_regs.c         |  8 ++---
 target/riscv/tcg/tcg-cpu.c       | 12 +++----
 target/rx/cpu.c                  | 14 ++++----
 target/s390x/cpu.c               | 14 ++++----
 target/sh4/cpu.c                 | 22 +++++++++----
 target/sparc/cpu.c               | 17 ++++++----
 target/tricore/cpu.c             | 14 ++++----
 target/xtensa/cpu.c              | 40 +++++++++++++----------
 23 files changed, 218 insertions(+), 176 deletions(-)
 create mode 100644 include/accel/tcg/tb-cpu-state.h

diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index c21c5d202d..f7e7e7949d 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -385,9 +385,6 @@ const void *HELPER(lookup_tb_ptr)(CPUArchState *env)
 {
     CPUState *cpu = env_cpu(env);
     TranslationBlock *tb;
-    vaddr pc;
-    uint64_t cs_base;
-    uint32_t flags, cflags;
 
     /*
      * By definition we've just finished a TB, so I/O is OK.
@@ -397,20 +394,21 @@ const void *HELPER(lookup_tb_ptr)(CPUArchState *env)
      * The next TB, if we chain to it, will clear the flag again.
      */
     cpu->neg.can_do_io = true;
-    cpu_get_tb_cpu_state(env, &pc, &cs_base, &flags);
 
-    cflags = curr_cflags(cpu);
-    if (check_for_breakpoints(cpu, pc, &cflags)) {
+    TCGTBCPUState s = cpu_get_tb_cpu_state(cpu);
+    s.cflags = curr_cflags(cpu);
+
+    if (check_for_breakpoints(cpu, s.pc, &s.cflags)) {
         cpu_loop_exit(cpu);
     }
 
-    tb = tb_lookup(cpu, pc, cs_base, flags, cflags);
+    tb = tb_lookup(cpu, s.pc, s.cs_base, s.flags, s.cflags);
     if (tb == NULL) {
         return tcg_code_gen_epilogue;
     }
 
     if (qemu_loglevel_mask(CPU_LOG_TB_CPU | CPU_LOG_EXEC)) {
-        log_cpu_exec(pc, cpu, tb);
+        log_cpu_exec(s.pc, cpu, tb);
     }
 
     return tb->tc.ptr;
@@ -560,11 +558,7 @@ static void cpu_exec_longjmp_cleanup(CPUState *cpu)
 
 void cpu_exec_step_atomic(CPUState *cpu)
 {
-    CPUArchState *env = cpu_env(cpu);
     TranslationBlock *tb;
-    vaddr pc;
-    uint64_t cs_base;
-    uint32_t flags, cflags;
     int tb_exit;
 
     if (sigsetjmp(cpu->jmp_env, 0) == 0) {
@@ -573,13 +567,13 @@ void cpu_exec_step_atomic(CPUState *cpu)
         g_assert(!cpu->running);
         cpu->running = true;
 
-        cpu_get_tb_cpu_state(env, &pc, &cs_base, &flags);
+        TCGTBCPUState s = cpu_get_tb_cpu_state(cpu);
+        s.cflags = curr_cflags(cpu);
 
-        cflags = curr_cflags(cpu);
         /* Execute in a serial context. */
-        cflags &= ~CF_PARALLEL;
+        s.cflags &= ~CF_PARALLEL;
         /* After 1 insn, return and release the exclusive lock. */
-        cflags |= CF_NO_GOTO_TB | CF_NO_GOTO_PTR | 1;
+        s.cflags |= CF_NO_GOTO_TB | CF_NO_GOTO_PTR | 1;
         /*
          * No need to check_for_breakpoints here.
          * We only arrive in cpu_exec_step_atomic after beginning execution
@@ -587,16 +581,16 @@ void cpu_exec_step_atomic(CPUState *cpu)
          * Any breakpoint for this insn will have been recognized earlier.
          */
 
-        tb = tb_lookup(cpu, pc, cs_base, flags, cflags);
+        tb = tb_lookup(cpu, s.pc, s.cs_base, s.flags, s.cflags);
         if (tb == NULL) {
             mmap_lock();
-            tb = tb_gen_code(cpu, pc, cs_base, flags, cflags);
+            tb = tb_gen_code(cpu, s.pc, s.cs_base, s.flags, s.cflags);
             mmap_unlock();
         }
 
         cpu_exec_enter(cpu);
         /* execute the generated code */
-        trace_exec_tb(tb, pc);
+        trace_exec_tb(tb, s.pc);
         cpu_tb_exec(cpu, tb, &tb_exit);
         cpu_exec_exit(cpu);
     } else {
@@ -941,11 +935,8 @@ cpu_exec_loop(CPUState *cpu, SyncClocks *sc)
 
         while (!cpu_handle_interrupt(cpu, &last_tb)) {
             TranslationBlock *tb;
-            vaddr pc;
-            uint64_t cs_base;
-            uint32_t flags, cflags;
-
-            cpu_get_tb_cpu_state(cpu_env(cpu), &pc, &cs_base, &flags);
+            TCGTBCPUState s = cpu_get_tb_cpu_state(cpu);
+            s.cflags = cpu->cflags_next_tb;
 
             /*
              * When requested, use an exact setting for cflags for the next
@@ -954,33 +945,32 @@ cpu_exec_loop(CPUState *cpu, SyncClocks *sc)
              * have CF_INVALID set, -1 is a convenient invalid value that
              * does not require tcg headers for cpu_common_reset.
              */
-            cflags = cpu->cflags_next_tb;
-            if (cflags == -1) {
-                cflags = curr_cflags(cpu);
+            if (s.cflags == -1) {
+                s.cflags = curr_cflags(cpu);
             } else {
                 cpu->cflags_next_tb = -1;
             }
 
-            if (check_for_breakpoints(cpu, pc, &cflags)) {
+            if (check_for_breakpoints(cpu, s.pc, &s.cflags)) {
                 break;
             }
 
-            tb = tb_lookup(cpu, pc, cs_base, flags, cflags);
+            tb = tb_lookup(cpu, s.pc, s.cs_base, s.flags, s.cflags);
             if (tb == NULL) {
                 CPUJumpCache *jc;
                 uint32_t h;
 
                 mmap_lock();
-                tb = tb_gen_code(cpu, pc, cs_base, flags, cflags);
+                tb = tb_gen_code(cpu, s.pc, s.cs_base, s.flags, s.cflags);
                 mmap_unlock();
 
                 /*
                  * We add the TB in the virtual pc hash table
                  * for the fast lookup
                  */
-                h = tb_jmp_cache_hash_func(pc);
+                h = tb_jmp_cache_hash_func(s.pc);
                 jc = cpu->tb_jmp_cache;
-                jc->array[h].pc = pc;
+                jc->array[h].pc = s.pc;
                 qatomic_set(&jc->array[h].tb, tb);
             }
 
@@ -1000,7 +990,7 @@ cpu_exec_loop(CPUState *cpu, SyncClocks *sc)
                 tb_add_jump(last_tb, tb_exit, tb);
             }
 
-            cpu_loop_exec_tb(cpu, tb, pc, &last_tb, &tb_exit);
+            cpu_loop_exec_tb(cpu, tb, s.pc, &last_tb, &tb_exit);
 
             /* Try to align the host and virtual clocks
                if the guest is in advance */
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index 31c7f9927f..f2766cedfc 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -590,13 +590,9 @@ void tb_check_watchpoint(CPUState *cpu, uintptr_t retaddr)
         /* The exception probably happened in a helper.  The CPU state should
            have been saved before calling it. Fetch the PC from there.  */
         CPUArchState *env = cpu_env(cpu);
-        vaddr pc;
-        uint64_t cs_base;
-        tb_page_addr_t addr;
-        uint32_t flags;
+        TCGTBCPUState s = cpu_get_tb_cpu_state(cpu);
+        tb_page_addr_t addr = get_page_addr_code(env, s.pc);
 
-        cpu_get_tb_cpu_state(env, &pc, &cs_base, &flags);
-        addr = get_page_addr_code(env, pc);
         if (addr != -1) {
             tb_invalidate_phys_range(cpu, addr, addr);
         }
diff --git a/include/accel/tcg/cpu-ops.h b/include/accel/tcg/cpu-ops.h
index f5e5746976..43a39c2e13 100644
--- a/include/accel/tcg/cpu-ops.h
+++ b/include/accel/tcg/cpu-ops.h
@@ -16,10 +16,10 @@
 #include "exec/memop.h"
 #include "exec/mmu-access-type.h"
 #include "exec/vaddr.h"
+#include "accel/tcg/tb-cpu-state.h"
 #include "tcg/tcg-mo.h"
 
-void cpu_get_tb_cpu_state(CPUArchState *env, vaddr *pc,
-                          uint64_t *cs_base, uint32_t *flags);
+TCGTBCPUState cpu_get_tb_cpu_state(CPUState *cs);
 
 struct TCGCPUOps {
     /**
diff --git a/include/accel/tcg/tb-cpu-state.h b/include/accel/tcg/tb-cpu-state.h
new file mode 100644
index 0000000000..8f912900ca
--- /dev/null
+++ b/include/accel/tcg/tb-cpu-state.h
@@ -0,0 +1,18 @@
+/* SPDX-License-Identifier: LGPL-2.1-or-later */
+/*
+ * Definition of TCGTBCPUState.
+ */
+
+#ifndef EXEC_TB_CPU_STATE_H
+#define EXEC_TB_CPU_STATE_H
+
+#include "exec/vaddr.h"
+
+typedef struct TCGTBCPUState {
+    vaddr pc;
+    uint32_t flags;
+    uint32_t cflags;
+    uint64_t cs_base;
+} TCGTBCPUState;
+
+#endif
diff --git a/target/alpha/cpu.c b/target/alpha/cpu.c
index 134806e755..90e3a2e748 100644
--- a/target/alpha/cpu.c
+++ b/target/alpha/cpu.c
@@ -41,15 +41,16 @@ static vaddr alpha_cpu_get_pc(CPUState *cs)
     return env->pc;
 }
 
-void cpu_get_tb_cpu_state(CPUAlphaState *env, vaddr *pc,
-                          uint64_t *cs_base, uint32_t *pflags)
+TCGTBCPUState cpu_get_tb_cpu_state(CPUState *cs)
 {
-    *pc = env->pc;
-    *cs_base = 0;
-    *pflags = env->flags & ENV_FLAG_TB_MASK;
+    CPUAlphaState *env = cpu_env(cs);
+    uint32_t flags = env->flags & ENV_FLAG_TB_MASK;
+
 #ifdef CONFIG_USER_ONLY
-    *pflags |= TB_FLAG_UNALIGN * !env_cpu(env)->prctl_unalign_sigbus;
+    flags |= TB_FLAG_UNALIGN * !cs->prctl_unalign_sigbus;
 #endif
+
+    return (TCGTBCPUState){ .pc = env->pc, .flags = flags };
 }
 
 static void alpha_cpu_synchronize_from_tb(CPUState *cs,
diff --git a/target/arm/tcg/hflags.c b/target/arm/tcg/hflags.c
index 5315264c28..b49381924b 100644
--- a/target/arm/tcg/hflags.c
+++ b/target/arm/tcg/hflags.c
@@ -10,6 +10,7 @@
 #include "internals.h"
 #include "cpu-features.h"
 #include "exec/helper-proto.h"
+#include "exec/translation-block.h"
 #include "accel/tcg/cpu-ops.h"
 #include "cpregs.h"
 
@@ -544,21 +545,22 @@ static bool mve_no_pred(CPUARMState *env)
     return true;
 }
 
-void cpu_get_tb_cpu_state(CPUARMState *env, vaddr *pc,
-                          uint64_t *cs_base, uint32_t *pflags)
+TCGTBCPUState cpu_get_tb_cpu_state(CPUState *cs)
 {
+    CPUARMState *env = cpu_env(cs);
     CPUARMTBFlags flags;
+    vaddr pc;
 
     assert_hflags_rebuild_correctly(env);
     flags = env->hflags;
 
     if (EX_TBFLAG_ANY(flags, AARCH64_STATE)) {
-        *pc = env->pc;
+        pc = env->pc;
         if (cpu_isar_feature(aa64_bti, env_archcpu(env))) {
             DP_TBFLAG_A64(flags, BTYPE, env->btype);
         }
     } else {
-        *pc = env->regs[15];
+        pc = env->regs[15];
 
         if (arm_feature(env, ARM_FEATURE_M)) {
             if (arm_feature(env, ARM_FEATURE_M_SECURITY) &&
@@ -620,6 +622,9 @@ void cpu_get_tb_cpu_state(CPUARMState *env, vaddr *pc,
         DP_TBFLAG_ANY(flags, PSTATE__SS, 1);
     }
 
-    *pflags = flags.flags;
-    *cs_base = flags.flags2;
+    return (TCGTBCPUState){
+        .pc = pc,
+        .flags = flags.flags,
+        .cs_base = flags.flags2,
+    };
 }
diff --git a/target/avr/cpu.c b/target/avr/cpu.c
index d9fecb272e..683195b61d 100644
--- a/target/avr/cpu.c
+++ b/target/avr/cpu.c
@@ -54,14 +54,11 @@ static int avr_cpu_mmu_index(CPUState *cs, bool ifetch)
     return ifetch ? MMU_CODE_IDX : MMU_DATA_IDX;
 }
 
-void cpu_get_tb_cpu_state(CPUAVRState *env, vaddr *pc,
-                          uint64_t *cs_base, uint32_t *pflags)
+TCGTBCPUState cpu_get_tb_cpu_state(CPUState *cs)
 {
+    CPUAVRState *env = cpu_env(cs);
     uint32_t flags = 0;
 
-    *pc = env->pc_w * 2;
-    *cs_base = 0;
-
     if (env->fullacc) {
         flags |= TB_FLAGS_FULL_ACCESS;
     }
@@ -69,7 +66,7 @@ void cpu_get_tb_cpu_state(CPUAVRState *env, vaddr *pc,
         flags |= TB_FLAGS_SKIP;
     }
 
-    *pflags = flags;
+    return (TCGTBCPUState){ .pc = env->pc_w * 2, .flags = flags };
 }
 
 static void avr_cpu_synchronize_from_tb(CPUState *cs,
diff --git a/target/hexagon/cpu.c b/target/hexagon/cpu.c
index 2272f1222b..a7f76dd089 100644
--- a/target/hexagon/cpu.c
+++ b/target/hexagon/cpu.c
@@ -255,19 +255,20 @@ static vaddr hexagon_cpu_get_pc(CPUState *cs)
     return cpu_env(cs)->gpr[HEX_REG_PC];
 }
 
-void cpu_get_tb_cpu_state(CPUHexagonState *env, vaddr *pc,
-                          uint64_t *cs_base, uint32_t *flags)
+TCGTBCPUState cpu_get_tb_cpu_state(CPUState *cs)
 {
+    CPUHexagonState *env = cpu_env(cs);
+    vaddr pc = env->gpr[HEX_REG_PC];
     uint32_t hex_flags = 0;
-    *pc = env->gpr[HEX_REG_PC];
-    *cs_base = 0;
-    if (*pc == env->gpr[HEX_REG_SA0]) {
+
+    if (pc == env->gpr[HEX_REG_SA0]) {
         hex_flags = FIELD_DP32(hex_flags, TB_FLAGS, IS_TIGHT_LOOP, 1);
     }
-    *flags = hex_flags;
-    if (*pc & PCALIGN_MASK) {
+    if (pc & PCALIGN_MASK) {
         hexagon_raise_exception_err(env, HEX_CAUSE_PC_NOT_ALIGNED, 0);
     }
+
+    return (TCGTBCPUState){ .pc = pc, .flags = hex_flags };
 }
 
 static void hexagon_cpu_synchronize_from_tb(CPUState *cs,
diff --git a/target/hppa/cpu.c b/target/hppa/cpu.c
index 4cdaf98ab1..40cbc191bb 100644
--- a/target/hppa/cpu.c
+++ b/target/hppa/cpu.c
@@ -51,11 +51,12 @@ static vaddr hppa_cpu_get_pc(CPUState *cs)
                          env->iaoq_f & -4);
 }
 
-void cpu_get_tb_cpu_state(CPUHPPAState *env, vaddr *pc,
-                          uint64_t *pcsbase, uint32_t *pflags)
+TCGTBCPUState cpu_get_tb_cpu_state(CPUState *cs)
 {
+    CPUHPPAState *env = cpu_env(cs);
     uint32_t flags = 0;
     uint64_t cs_base = 0;
+    vaddr pc;
 
     /*
      * TB lookup assumes that PC contains the complete virtual address.
@@ -63,7 +64,7 @@ void cpu_get_tb_cpu_state(CPUHPPAState *env, vaddr *pc,
      * incomplete virtual address.  This also means that we must separate
      * out current cpu privilege from the low bits of IAOQ_F.
      */
-    *pc = hppa_cpu_get_pc(env_cpu(env));
+    pc = hppa_cpu_get_pc(env_cpu(env));
     flags |= (env->iaoq_f & 3) << TB_FLAG_PRIV_SHIFT;
 
     /*
@@ -99,8 +100,7 @@ void cpu_get_tb_cpu_state(CPUHPPAState *env, vaddr *pc,
     }
 #endif
 
-    *pcsbase = cs_base;
-    *pflags = flags;
+    return (TCGTBCPUState){ .pc = pc, .flags = flags, .cs_base = cs_base };
 }
 
 static void hppa_cpu_synchronize_from_tb(CPUState *cs,
diff --git a/target/i386/tcg/tcg-cpu.c b/target/i386/tcg/tcg-cpu.c
index bb6f82befb..3004fb3023 100644
--- a/target/i386/tcg/tcg-cpu.c
+++ b/target/i386/tcg/tcg-cpu.c
@@ -48,18 +48,23 @@ static void x86_cpu_exec_exit(CPUState *cs)
     env->eflags = cpu_compute_eflags(env);
 }
 
-void cpu_get_tb_cpu_state(CPUX86State *env, vaddr *pc,
-                          uint64_t *cs_base, uint32_t *flags)
+TCGTBCPUState cpu_get_tb_cpu_state(CPUState *cs)
 {
-    *flags = env->hflags |
+    CPUX86State *env = cpu_env(cs);
+    uint32_t flags, cs_base;
+    vaddr pc;
+
+    flags = env->hflags |
         (env->eflags & (IOPL_MASK | TF_MASK | RF_MASK | VM_MASK | AC_MASK));
     if (env->hflags & HF_CS64_MASK) {
-        *cs_base = 0;
-        *pc = env->eip;
+        cs_base = 0;
+        pc = env->eip;
     } else {
-        *cs_base = env->segs[R_CS].base;
-        *pc = (uint32_t)(*cs_base + env->eip);
+        cs_base = env->segs[R_CS].base;
+        pc = (uint32_t)(cs_base + env->eip);
     }
+
+    return (TCGTBCPUState){ .pc = pc, .flags = flags, .cs_base = cs_base };
 }
 
 static void x86_cpu_synchronize_from_tb(CPUState *cs,
diff --git a/target/loongarch/cpu.c b/target/loongarch/cpu.c
index be770b7e19..446cf43914 100644
--- a/target/loongarch/cpu.c
+++ b/target/loongarch/cpu.c
@@ -336,16 +336,18 @@ static bool loongarch_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
 }
 #endif
 
-void cpu_get_tb_cpu_state(CPULoongArchState *env, vaddr *pc,
-                          uint64_t *cs_base, uint32_t *flags)
+TCGTBCPUState cpu_get_tb_cpu_state(CPUState *cs)
 {
-    *pc = env->pc;
-    *cs_base = 0;
-    *flags = env->CSR_CRMD & (R_CSR_CRMD_PLV_MASK | R_CSR_CRMD_PG_MASK);
-    *flags |= FIELD_EX64(env->CSR_EUEN, CSR_EUEN, FPE) * HW_FLAGS_EUEN_FPE;
-    *flags |= FIELD_EX64(env->CSR_EUEN, CSR_EUEN, SXE) * HW_FLAGS_EUEN_SXE;
-    *flags |= FIELD_EX64(env->CSR_EUEN, CSR_EUEN, ASXE) * HW_FLAGS_EUEN_ASXE;
-    *flags |= is_va32(env) * HW_FLAGS_VA32;
+    CPULoongArchState *env = cpu_env(cs);
+    uint32_t flags;
+
+    flags = env->CSR_CRMD & (R_CSR_CRMD_PLV_MASK | R_CSR_CRMD_PG_MASK);
+    flags |= FIELD_EX64(env->CSR_EUEN, CSR_EUEN, FPE) * HW_FLAGS_EUEN_FPE;
+    flags |= FIELD_EX64(env->CSR_EUEN, CSR_EUEN, SXE) * HW_FLAGS_EUEN_SXE;
+    flags |= FIELD_EX64(env->CSR_EUEN, CSR_EUEN, ASXE) * HW_FLAGS_EUEN_ASXE;
+    flags |= is_va32(env) * HW_FLAGS_VA32;
+
+    return (TCGTBCPUState){ .pc = env->pc, .flags = flags };
 }
 
 static void loongarch_cpu_synchronize_from_tb(CPUState *cs,
diff --git a/target/m68k/cpu.c b/target/m68k/cpu.c
index 2b4ec40509..b75ed6e887 100644
--- a/target/m68k/cpu.c
+++ b/target/m68k/cpu.c
@@ -23,6 +23,7 @@
 #include "cpu.h"
 #include "migration/vmstate.h"
 #include "fpu/softfloat.h"
+#include "exec/translation-block.h"
 #include "accel/tcg/cpu-ops.h"
 
 static void m68k_cpu_set_pc(CPUState *cs, vaddr value)
@@ -39,20 +40,22 @@ static vaddr m68k_cpu_get_pc(CPUState *cs)
     return cpu->env.pc;
 }
 
-void cpu_get_tb_cpu_state(CPUM68KState *env, vaddr *pc,
-                          uint64_t *cs_base, uint32_t *flags)
+TCGTBCPUState cpu_get_tb_cpu_state(CPUState *cs)
 {
-    *pc = env->pc;
-    *cs_base = 0;
-    *flags = (env->macsr >> 4) & TB_FLAGS_MACSR;
+    CPUM68KState *env = cpu_env(cs);
+    uint32_t flags;
+
+    flags = (env->macsr >> 4) & TB_FLAGS_MACSR;
     if (env->sr & SR_S) {
-        *flags |= TB_FLAGS_MSR_S;
-        *flags |= (env->sfc << (TB_FLAGS_SFC_S_BIT - 2)) & TB_FLAGS_SFC_S;
-        *flags |= (env->dfc << (TB_FLAGS_DFC_S_BIT - 2)) & TB_FLAGS_DFC_S;
+        flags |= TB_FLAGS_MSR_S;
+        flags |= (env->sfc << (TB_FLAGS_SFC_S_BIT - 2)) & TB_FLAGS_SFC_S;
+        flags |= (env->dfc << (TB_FLAGS_DFC_S_BIT - 2)) & TB_FLAGS_DFC_S;
     }
     if (M68K_SR_TRACE(env->sr) == M68K_SR_TRACE_ANY_INS) {
-        *flags |= TB_FLAGS_TRACE;
+        flags |= TB_FLAGS_TRACE;
     }
+
+    return (TCGTBCPUState){ .pc = env->pc, .flags = flags };
 }
 
 static void m68k_restore_state_to_opc(CPUState *cs,
diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
index 105ede0b1e..72a0d0583c 100644
--- a/target/microblaze/cpu.c
+++ b/target/microblaze/cpu.c
@@ -95,12 +95,15 @@ static vaddr mb_cpu_get_pc(CPUState *cs)
     return cpu->env.pc;
 }
 
-void cpu_get_tb_cpu_state(CPUMBState *env, vaddr *pc,
-                          uint64_t *cs_base, uint32_t *flags)
+TCGTBCPUState cpu_get_tb_cpu_state(CPUState *cs)
 {
-    *pc = env->pc;
-    *flags = (env->iflags & IFLAGS_TB_MASK) | (env->msr & MSR_TB_MASK);
-    *cs_base = (*flags & IMM_FLAG ? env->imm : 0);
+    CPUMBState *env = cpu_env(cs);
+
+    return (TCGTBCPUState){
+        .pc = env->pc,
+        .flags = (env->iflags & IFLAGS_TB_MASK) | (env->msr & MSR_TB_MASK),
+        .cs_base = (env->iflags & IMM_FLAG ? env->imm : 0),
+    };
 }
 
 static void mb_cpu_synchronize_from_tb(CPUState *cs,
diff --git a/target/mips/cpu.c b/target/mips/cpu.c
index ab00adf86b..b0f7612a64 100644
--- a/target/mips/cpu.c
+++ b/target/mips/cpu.c
@@ -549,13 +549,15 @@ static int mips_cpu_mmu_index(CPUState *cs, bool ifunc)
     return mips_env_mmu_index(cpu_env(cs));
 }
 
-void cpu_get_tb_cpu_state(CPUMIPSState *env, vaddr *pc,
-                          uint64_t *cs_base, uint32_t *flags)
+TCGTBCPUState cpu_get_tb_cpu_state(CPUState *cs)
 {
-    *pc = env->active_tc.PC;
-    *cs_base = 0;
-    *flags = env->hflags & (MIPS_HFLAG_TMASK | MIPS_HFLAG_BMASK |
-                            MIPS_HFLAG_HWRENA_ULR);
+    CPUMIPSState *env = cpu_env(cs);
+
+    return (TCGTBCPUState){
+        .pc = env->active_tc.PC,
+        .flags = env->hflags & (MIPS_HFLAG_TMASK | MIPS_HFLAG_BMASK |
+                                MIPS_HFLAG_HWRENA_ULR),
+    };
 }
 
 static const TCGCPUOps mips_tcg_ops = {
diff --git a/target/openrisc/cpu.c b/target/openrisc/cpu.c
index d798127d67..aba4639bbb 100644
--- a/target/openrisc/cpu.c
+++ b/target/openrisc/cpu.c
@@ -41,14 +41,16 @@ static vaddr openrisc_cpu_get_pc(CPUState *cs)
     return cpu->env.pc;
 }
 
-void cpu_get_tb_cpu_state(CPUOpenRISCState *env, vaddr *pc,
-                          uint64_t *cs_base, uint32_t *flags)
+TCGTBCPUState cpu_get_tb_cpu_state(CPUState *cs)
 {
-    *pc = env->pc;
-    *cs_base = 0;
-    *flags = (env->dflag ? TB_FLAGS_DFLAG : 0)
-           | (cpu_get_gpr(env, 0) ? 0 : TB_FLAGS_R0_0)
-           | (env->sr & (SR_SM | SR_DME | SR_IME | SR_OVE));
+    CPUOpenRISCState *env = cpu_env(cs);
+
+    return (TCGTBCPUState){
+        .pc = env->pc,
+        .flags = ((env->dflag ? TB_FLAGS_DFLAG : 0)
+                  | (cpu_get_gpr(env, 0) ? 0 : TB_FLAGS_R0_0)
+                  | (env->sr & (SR_SM | SR_DME | SR_IME | SR_OVE))),
+    };
 }
 
 static void openrisc_cpu_synchronize_from_tb(CPUState *cs,
diff --git a/target/ppc/helper_regs.c b/target/ppc/helper_regs.c
index 8d248bcbb9..ccaf2b0343 100644
--- a/target/ppc/helper_regs.c
+++ b/target/ppc/helper_regs.c
@@ -256,9 +256,9 @@ void hreg_update_pmu_hflags(CPUPPCState *env)
     env->hflags |= hreg_compute_pmu_hflags_value(env);
 }
 
-void cpu_get_tb_cpu_state(CPUPPCState *env, vaddr *pc,
-                          uint64_t *cs_base, uint32_t *flags)
+TCGTBCPUState cpu_get_tb_cpu_state(CPUState *cs)
 {
+    CPUPPCState *env = cpu_env(cs);
     uint32_t hflags_current = env->hflags;
 
 #ifdef CONFIG_DEBUG_TCG
@@ -270,9 +270,7 @@ void cpu_get_tb_cpu_state(CPUPPCState *env, vaddr *pc,
     }
 #endif
 
-    *pc = env->nip;
-    *cs_base = 0;
-    *flags = hflags_current;
+    return (TCGTBCPUState){ .pc = env->nip, .flags = hflags_current };
 }
 
 void cpu_interrupt_exittb(CPUState *cs)
diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index e67de7dfe2..927153377e 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -98,17 +98,14 @@ static int riscv_cpu_mmu_index(CPUState *cs, bool ifetch)
     return riscv_env_mmu_index(cpu_env(cs), ifetch);
 }
 
-void cpu_get_tb_cpu_state(CPURISCVState *env, vaddr *pc,
-                          uint64_t *cs_base, uint32_t *pflags)
+TCGTBCPUState cpu_get_tb_cpu_state(CPUState *cs)
 {
+    CPURISCVState *env = cpu_env(cs);
     RISCVCPU *cpu = env_archcpu(env);
     RISCVExtStatus fs, vs;
     uint32_t flags = 0;
     bool pm_signext = riscv_cpu_virt_mem_enabled(env);
 
-    *pc = env->xl == MXL_RV32 ? env->pc & UINT32_MAX : env->pc;
-    *cs_base = 0;
-
     if (cpu->cfg.ext_zve32x) {
         /*
          * If env->vl equals to VLMAX, we can use generic vector operation
@@ -192,7 +189,10 @@ void cpu_get_tb_cpu_state(CPURISCVState *env, vaddr *pc,
     flags = FIELD_DP32(flags, TB_FLAGS, PM_PMM, riscv_pm_get_pmm(env));
     flags = FIELD_DP32(flags, TB_FLAGS, PM_SIGNEXTEND, pm_signext);
 
-    *pflags = flags;
+    return (TCGTBCPUState){
+        .pc = env->xl == MXL_RV32 ? env->pc & UINT32_MAX : env->pc,
+        .flags = flags
+    };
 }
 
 static void riscv_cpu_synchronize_from_tb(CPUState *cs,
diff --git a/target/rx/cpu.c b/target/rx/cpu.c
index e8b47be675..be778c9f65 100644
--- a/target/rx/cpu.c
+++ b/target/rx/cpu.c
@@ -44,13 +44,15 @@ static vaddr rx_cpu_get_pc(CPUState *cs)
     return cpu->env.pc;
 }
 
-void cpu_get_tb_cpu_state(CPURXState *env, vaddr *pc,
-                          uint64_t *cs_base, uint32_t *flags)
+TCGTBCPUState cpu_get_tb_cpu_state(CPUState *cs)
 {
-    *pc = env->pc;
-    *cs_base = 0;
-    *flags = FIELD_DP32(0, PSW, PM, env->psw_pm);
-    *flags = FIELD_DP32(*flags, PSW, U, env->psw_u);
+    CPURXState *env = cpu_env(cs);
+    uint32_t flags = 0;
+
+    flags = FIELD_DP32(flags, PSW, PM, env->psw_pm);
+    flags = FIELD_DP32(flags, PSW, U, env->psw_u);
+
+    return (TCGTBCPUState){ .pc = env->pc, .flags = flags };
 }
 
 static void rx_cpu_synchronize_from_tb(CPUState *cs,
diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
index 435b2034ff..279289f265 100644
--- a/target/s390x/cpu.c
+++ b/target/s390x/cpu.c
@@ -309,9 +309,9 @@ static int s390x_cpu_mmu_index(CPUState *cs, bool ifetch)
     return s390x_env_mmu_index(cpu_env(cs), ifetch);
 }
 
-void cpu_get_tb_cpu_state(CPUS390XState *env, vaddr *pc,
-                          uint64_t *cs_base, uint32_t *pflags)
+TCGTBCPUState cpu_get_tb_cpu_state(CPUState *cs)
 {
+    CPUS390XState *env = cpu_env(cs);
     uint32_t flags;
 
     if (env->psw.addr & 1) {
@@ -323,9 +323,6 @@ void cpu_get_tb_cpu_state(CPUS390XState *env, vaddr *pc,
         tcg_s390_program_interrupt(env, PGM_SPECIFICATION, 0);
     }
 
-    *pc = env->psw.addr;
-    *cs_base = env->ex_value;
-
     flags = (env->psw.mask >> FLAG_MASK_PSW_SHIFT) & FLAG_MASK_PSW;
     if (env->psw.mask & PSW_MASK_PER) {
         flags |= env->cregs[9] & (FLAG_MASK_PER_BRANCH |
@@ -342,7 +339,12 @@ void cpu_get_tb_cpu_state(CPUS390XState *env, vaddr *pc,
     if (env->cregs[0] & CR0_VECTOR) {
         flags |= FLAG_MASK_VECTOR;
     }
-    *pflags = flags;
+
+    return (TCGTBCPUState){
+        .pc = env->psw.addr,
+        .flags = flags,
+        .cs_base = env->ex_value,
+    };
 }
 
 static const TCGCPUOps s390_tcg_ops = {
diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
index 5fb18bf55e..cbd43b55e5 100644
--- a/target/sh4/cpu.c
+++ b/target/sh4/cpu.c
@@ -43,19 +43,27 @@ static vaddr superh_cpu_get_pc(CPUState *cs)
     return cpu->env.pc;
 }
 
-void cpu_get_tb_cpu_state(CPUSH4State *env, vaddr *pc,
-                          uint64_t *cs_base, uint32_t *flags)
+TCGTBCPUState cpu_get_tb_cpu_state(CPUState *cs)
 {
-    *pc = env->pc;
-    /* For a gUSA region, notice the end of the region.  */
-    *cs_base = env->flags & TB_FLAG_GUSA_MASK ? env->gregs[0] : 0;
-    *flags = env->flags
+    CPUSH4State *env = cpu_env(cs);
+    uint32_t flags;
+
+    flags = env->flags
             | (env->fpscr & TB_FLAG_FPSCR_MASK)
             | (env->sr & TB_FLAG_SR_MASK)
             | (env->movcal_backup ? TB_FLAG_PENDING_MOVCA : 0); /* Bit 3 */
 #ifdef CONFIG_USER_ONLY
-    *flags |= TB_FLAG_UNALIGN * !env_cpu(env)->prctl_unalign_sigbus;
+    flags |= TB_FLAG_UNALIGN * !cs->prctl_unalign_sigbus;
 #endif
+
+    return (TCGTBCPUState){
+        .pc = env->pc,
+        .flags = flags,
+#ifdef CONFIG_USER_ONLY
+        /* For a gUSA region, notice the end of the region.  */
+        .cs_base = flags & TB_FLAG_GUSA_MASK ? env->gregs[0] : 0,
+#endif
+    };
 }
 
 static void superh_cpu_synchronize_from_tb(CPUState *cs,
diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
index bbdea8556a..6166b81f71 100644
--- a/target/sparc/cpu.c
+++ b/target/sparc/cpu.c
@@ -716,13 +716,11 @@ static void sparc_cpu_synchronize_from_tb(CPUState *cs,
     cpu->env.npc = tb->cs_base;
 }
 
-void cpu_get_tb_cpu_state(CPUSPARCState *env, vaddr *pc,
-                          uint64_t *cs_base, uint32_t *pflags)
+TCGTBCPUState cpu_get_tb_cpu_state(CPUState *cs)
 {
-    uint32_t flags;
-    *pc = env->pc;
-    *cs_base = env->npc;
-    flags = cpu_mmu_index(env_cpu(env), false);
+    CPUSPARCState *env = cpu_env(cs);
+    uint32_t flags = cpu_mmu_index(cs, false);
+
 #ifndef CONFIG_USER_ONLY
     if (cpu_supervisor_mode(env)) {
         flags |= TB_FLAG_SUPER;
@@ -751,7 +749,12 @@ void cpu_get_tb_cpu_state(CPUSPARCState *env, vaddr *pc,
     }
 #endif /* !CONFIG_USER_ONLY */
 #endif /* TARGET_SPARC64 */
-    *pflags = flags;
+
+    return (TCGTBCPUState){
+        .pc = env->pc,
+        .flags = flags,
+        .cs_base = env->npc,
+    };
 }
 
 static void sparc_restore_state_to_opc(CPUState *cs,
diff --git a/target/tricore/cpu.c b/target/tricore/cpu.c
index 81b3bb6362..1151a812b6 100644
--- a/target/tricore/cpu.c
+++ b/target/tricore/cpu.c
@@ -45,16 +45,14 @@ static vaddr tricore_cpu_get_pc(CPUState *cs)
     return cpu_env(cs)->PC;
 }
 
-void cpu_get_tb_cpu_state(CPUTriCoreState *env, vaddr *pc,
-                          uint64_t *cs_base, uint32_t *flags)
+TCGTBCPUState cpu_get_tb_cpu_state(CPUState *cs)
 {
-    uint32_t new_flags = 0;
-    *pc = env->PC;
-    *cs_base = 0;
+    CPUTriCoreState *env = cpu_env(cs);
 
-    new_flags |= FIELD_DP32(new_flags, TB_FLAGS, PRIV,
-            extract32(env->PSW, 10, 2));
-    *flags = new_flags;
+    return (TCGTBCPUState){
+        .pc = env->PC,
+        .flags = FIELD_DP32(0, TB_FLAGS, PRIV, extract32(env->PSW, 10, 2)),
+    };
 }
 
 static void tricore_cpu_synchronize_from_tb(CPUState *cs,
diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
index c78ef9421c..431b7ebd7b 100644
--- a/target/xtensa/cpu.c
+++ b/target/xtensa/cpu.c
@@ -55,15 +55,15 @@ static vaddr xtensa_cpu_get_pc(CPUState *cs)
     return cpu->env.pc;
 }
 
-void cpu_get_tb_cpu_state(CPUXtensaState *env, vaddr *pc,
-                          uint64_t *cs_base, uint32_t *flags)
+TCGTBCPUState cpu_get_tb_cpu_state(CPUState *cs)
 {
-    *pc = env->pc;
-    *cs_base = 0;
-    *flags = 0;
-    *flags |= xtensa_get_ring(env);
+    CPUXtensaState *env = cpu_env(cs);
+    uint32_t flags = 0;
+    target_ulong cs_base = 0;
+
+    flags |= xtensa_get_ring(env);
     if (env->sregs[PS] & PS_EXCM) {
-        *flags |= XTENSA_TBFLAG_EXCM;
+        flags |= XTENSA_TBFLAG_EXCM;
     } else if (xtensa_option_enabled(env->config, XTENSA_OPTION_LOOP)) {
         target_ulong lend_dist =
             env->sregs[LEND] - (env->pc & -(1u << TARGET_PAGE_BITS));
@@ -85,26 +85,26 @@ void cpu_get_tb_cpu_state(CPUXtensaState *env, vaddr *pc,
         if (lend_dist < (1u << TARGET_PAGE_BITS) + env->config->max_insn_size) {
             target_ulong lbeg_off = env->sregs[LEND] - env->sregs[LBEG];
 
-            *cs_base = lend_dist;
+            cs_base = lend_dist;
             if (lbeg_off < 256) {
-                *cs_base |= lbeg_off << XTENSA_CSBASE_LBEG_OFF_SHIFT;
+                cs_base |= lbeg_off << XTENSA_CSBASE_LBEG_OFF_SHIFT;
             }
         }
     }
     if (xtensa_option_enabled(env->config, XTENSA_OPTION_EXTENDED_L32R) &&
             (env->sregs[LITBASE] & 1)) {
-        *flags |= XTENSA_TBFLAG_LITBASE;
+        flags |= XTENSA_TBFLAG_LITBASE;
     }
     if (xtensa_option_enabled(env->config, XTENSA_OPTION_DEBUG)) {
         if (xtensa_get_cintlevel(env) < env->config->debug_level) {
-            *flags |= XTENSA_TBFLAG_DEBUG;
+            flags |= XTENSA_TBFLAG_DEBUG;
         }
         if (xtensa_get_cintlevel(env) < env->sregs[ICOUNTLEVEL]) {
-            *flags |= XTENSA_TBFLAG_ICOUNT;
+            flags |= XTENSA_TBFLAG_ICOUNT;
         }
     }
     if (xtensa_option_enabled(env->config, XTENSA_OPTION_COPROCESSOR)) {
-        *flags |= env->sregs[CPENABLE] << XTENSA_TBFLAG_CPENABLE_SHIFT;
+        flags |= env->sregs[CPENABLE] << XTENSA_TBFLAG_CPENABLE_SHIFT;
     }
     if (xtensa_option_enabled(env->config, XTENSA_OPTION_WINDOWED_REGISTER) &&
         (env->sregs[PS] & (PS_WOE | PS_EXCM)) == PS_WOE) {
@@ -112,15 +112,21 @@ void cpu_get_tb_cpu_state(CPUXtensaState *env, vaddr *pc,
             (env->sregs[WINDOW_BASE] + 1);
         uint32_t w = ctz32(windowstart | 0x8);
 
-        *flags |= (w << XTENSA_TBFLAG_WINDOW_SHIFT) | XTENSA_TBFLAG_CWOE;
-        *flags |= extract32(env->sregs[PS], PS_CALLINC_SHIFT,
+        flags |= (w << XTENSA_TBFLAG_WINDOW_SHIFT) | XTENSA_TBFLAG_CWOE;
+        flags |= extract32(env->sregs[PS], PS_CALLINC_SHIFT,
                             PS_CALLINC_LEN) << XTENSA_TBFLAG_CALLINC_SHIFT;
     } else {
-        *flags |= 3 << XTENSA_TBFLAG_WINDOW_SHIFT;
+        flags |= 3 << XTENSA_TBFLAG_WINDOW_SHIFT;
     }
     if (env->yield_needed) {
-        *flags |= XTENSA_TBFLAG_YIELD;
+        flags |= XTENSA_TBFLAG_YIELD;
     }
+
+    return (TCGTBCPUState){
+        .pc = env->pc,
+        .flags = flags,
+        .cs_base = cs_base,
+    };
 }
 
 static void xtensa_restore_state_to_opc(CPUState *cs,

From c37f8978d9e23066132a0717b8cb4ed37a0cbd96 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sun, 27 Apr 2025 17:22:04 -0700
Subject: [PATCH 0561/2760] accel/tcg: Move cpu_get_tb_cpu_state to TCGCPUOps

Move the global function name to a hook on TCGCPUOps.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cpu-exec.c        | 7 ++++---
 accel/tcg/translate-all.c   | 2 +-
 include/accel/tcg/cpu-ops.h | 8 ++++++--
 target/alpha/cpu.c          | 3 ++-
 target/arm/cpu.c            | 1 +
 target/arm/internals.h      | 2 ++
 target/arm/tcg/cpu-v7m.c    | 1 +
 target/arm/tcg/hflags.c     | 2 +-
 target/avr/cpu.c            | 3 ++-
 target/hexagon/cpu.c        | 3 ++-
 target/hppa/cpu.c           | 3 ++-
 target/i386/tcg/tcg-cpu.c   | 3 ++-
 target/loongarch/cpu.c      | 3 ++-
 target/m68k/cpu.c           | 3 ++-
 target/microblaze/cpu.c     | 3 ++-
 target/mips/cpu.c           | 3 ++-
 target/openrisc/cpu.c       | 3 ++-
 target/ppc/cpu_init.c       | 2 +-
 target/ppc/helper_regs.c    | 3 ++-
 target/ppc/internal.h       | 3 +++
 target/riscv/tcg/tcg-cpu.c  | 3 ++-
 target/rx/cpu.c             | 3 ++-
 target/s390x/cpu.c          | 3 ++-
 target/sh4/cpu.c            | 3 ++-
 target/sparc/cpu.c          | 3 ++-
 target/tricore/cpu.c        | 3 ++-
 target/xtensa/cpu.c         | 3 ++-
 27 files changed, 56 insertions(+), 26 deletions(-)

diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index f7e7e7949d..4a405d7b56 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -395,7 +395,7 @@ const void *HELPER(lookup_tb_ptr)(CPUArchState *env)
      */
     cpu->neg.can_do_io = true;
 
-    TCGTBCPUState s = cpu_get_tb_cpu_state(cpu);
+    TCGTBCPUState s = cpu->cc->tcg_ops->get_tb_cpu_state(cpu);
     s.cflags = curr_cflags(cpu);
 
     if (check_for_breakpoints(cpu, s.pc, &s.cflags)) {
@@ -567,7 +567,7 @@ void cpu_exec_step_atomic(CPUState *cpu)
         g_assert(!cpu->running);
         cpu->running = true;
 
-        TCGTBCPUState s = cpu_get_tb_cpu_state(cpu);
+        TCGTBCPUState s = cpu->cc->tcg_ops->get_tb_cpu_state(cpu);
         s.cflags = curr_cflags(cpu);
 
         /* Execute in a serial context. */
@@ -935,7 +935,7 @@ cpu_exec_loop(CPUState *cpu, SyncClocks *sc)
 
         while (!cpu_handle_interrupt(cpu, &last_tb)) {
             TranslationBlock *tb;
-            TCGTBCPUState s = cpu_get_tb_cpu_state(cpu);
+            TCGTBCPUState s = cpu->cc->tcg_ops->get_tb_cpu_state(cpu);
             s.cflags = cpu->cflags_next_tb;
 
             /*
@@ -1052,6 +1052,7 @@ bool tcg_exec_realizefn(CPUState *cpu, Error **errp)
         assert(tcg_ops->cpu_exec_reset);
 #endif /* !CONFIG_USER_ONLY */
         assert(tcg_ops->translate_code);
+        assert(tcg_ops->get_tb_cpu_state);
         assert(tcg_ops->mmu_index);
         tcg_ops->initialize();
         tcg_target_initialized = true;
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index f2766cedfc..97aadee52c 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -590,7 +590,7 @@ void tb_check_watchpoint(CPUState *cpu, uintptr_t retaddr)
         /* The exception probably happened in a helper.  The CPU state should
            have been saved before calling it. Fetch the PC from there.  */
         CPUArchState *env = cpu_env(cpu);
-        TCGTBCPUState s = cpu_get_tb_cpu_state(cpu);
+        TCGTBCPUState s = cpu->cc->tcg_ops->get_tb_cpu_state(cpu);
         tb_page_addr_t addr = get_page_addr_code(env, s.pc);
 
         if (addr != -1) {
diff --git a/include/accel/tcg/cpu-ops.h b/include/accel/tcg/cpu-ops.h
index 43a39c2e13..23cd6af0b2 100644
--- a/include/accel/tcg/cpu-ops.h
+++ b/include/accel/tcg/cpu-ops.h
@@ -19,8 +19,6 @@
 #include "accel/tcg/tb-cpu-state.h"
 #include "tcg/tcg-mo.h"
 
-TCGTBCPUState cpu_get_tb_cpu_state(CPUState *cs);
-
 struct TCGCPUOps {
     /**
      * mttcg_supported: multi-threaded TCG is supported
@@ -63,6 +61,12 @@ struct TCGCPUOps {
      */
     void (*translate_code)(CPUState *cpu, TranslationBlock *tb,
                            int *max_insns, vaddr pc, void *host_pc);
+    /**
+     * @get_tb_cpu_state: Extract CPU state for a TCG #TranslationBlock
+     *
+     * Fill in all data required to select or compile a TranslationBlock.
+     */
+    TCGTBCPUState (*get_tb_cpu_state)(CPUState *cs);
     /**
      * @synchronize_from_tb: Synchronize state from a TCG #TranslationBlock
      *
diff --git a/target/alpha/cpu.c b/target/alpha/cpu.c
index 90e3a2e748..890b84c032 100644
--- a/target/alpha/cpu.c
+++ b/target/alpha/cpu.c
@@ -41,7 +41,7 @@ static vaddr alpha_cpu_get_pc(CPUState *cs)
     return env->pc;
 }
 
-TCGTBCPUState cpu_get_tb_cpu_state(CPUState *cs)
+static TCGTBCPUState alpha_get_tb_cpu_state(CPUState *cs)
 {
     CPUAlphaState *env = cpu_env(cs);
     uint32_t flags = env->flags & ENV_FLAG_TB_MASK;
@@ -251,6 +251,7 @@ static const TCGCPUOps alpha_tcg_ops = {
 
     .initialize = alpha_translate_init,
     .translate_code = alpha_translate_code,
+    .get_tb_cpu_state = alpha_get_tb_cpu_state,
     .synchronize_from_tb = alpha_cpu_synchronize_from_tb,
     .restore_state_to_opc = alpha_restore_state_to_opc,
     .mmu_index = alpha_cpu_mmu_index,
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index 3dde70b04a..2020aec54a 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -2693,6 +2693,7 @@ static const TCGCPUOps arm_tcg_ops = {
 
     .initialize = arm_translate_init,
     .translate_code = arm_translate_code,
+    .get_tb_cpu_state = arm_get_tb_cpu_state,
     .synchronize_from_tb = arm_cpu_synchronize_from_tb,
     .debug_excp_handler = arm_debug_excp_handler,
     .restore_state_to_opc = arm_restore_state_to_opc,
diff --git a/target/arm/internals.h b/target/arm/internals.h
index 382a4d1015..660d3a88e0 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -28,6 +28,7 @@
 #include "exec/hwaddr.h"
 #include "exec/vaddr.h"
 #include "exec/breakpoint.h"
+#include "accel/tcg/tb-cpu-state.h"
 #include "hw/registerfields.h"
 #include "tcg/tcg-gvec-desc.h"
 #include "system/memory.h"
@@ -372,6 +373,7 @@ void arm_restore_state_to_opc(CPUState *cs,
                               const uint64_t *data);
 
 #ifdef CONFIG_TCG
+TCGTBCPUState arm_get_tb_cpu_state(CPUState *cs);
 void arm_cpu_synchronize_from_tb(CPUState *cs, const TranslationBlock *tb);
 
 /* Our implementation of TCGCPUOps::cpu_exec_halt */
diff --git a/target/arm/tcg/cpu-v7m.c b/target/arm/tcg/cpu-v7m.c
index 5c8c374885..95b23d9b55 100644
--- a/target/arm/tcg/cpu-v7m.c
+++ b/target/arm/tcg/cpu-v7m.c
@@ -238,6 +238,7 @@ static const TCGCPUOps arm_v7m_tcg_ops = {
 
     .initialize = arm_translate_init,
     .translate_code = arm_translate_code,
+    .get_tb_cpu_state = arm_get_tb_cpu_state,
     .synchronize_from_tb = arm_cpu_synchronize_from_tb,
     .debug_excp_handler = arm_debug_excp_handler,
     .restore_state_to_opc = arm_restore_state_to_opc,
diff --git a/target/arm/tcg/hflags.c b/target/arm/tcg/hflags.c
index b49381924b..fd407a7b28 100644
--- a/target/arm/tcg/hflags.c
+++ b/target/arm/tcg/hflags.c
@@ -545,7 +545,7 @@ static bool mve_no_pred(CPUARMState *env)
     return true;
 }
 
-TCGTBCPUState cpu_get_tb_cpu_state(CPUState *cs)
+TCGTBCPUState arm_get_tb_cpu_state(CPUState *cs)
 {
     CPUARMState *env = cpu_env(cs);
     CPUARMTBFlags flags;
diff --git a/target/avr/cpu.c b/target/avr/cpu.c
index 683195b61d..250241541b 100644
--- a/target/avr/cpu.c
+++ b/target/avr/cpu.c
@@ -54,7 +54,7 @@ static int avr_cpu_mmu_index(CPUState *cs, bool ifetch)
     return ifetch ? MMU_CODE_IDX : MMU_DATA_IDX;
 }
 
-TCGTBCPUState cpu_get_tb_cpu_state(CPUState *cs)
+static TCGTBCPUState avr_get_tb_cpu_state(CPUState *cs)
 {
     CPUAVRState *env = cpu_env(cs);
     uint32_t flags = 0;
@@ -241,6 +241,7 @@ static const TCGCPUOps avr_tcg_ops = {
     .mttcg_supported = false,
     .initialize = avr_cpu_tcg_init,
     .translate_code = avr_cpu_translate_code,
+    .get_tb_cpu_state = avr_get_tb_cpu_state,
     .synchronize_from_tb = avr_cpu_synchronize_from_tb,
     .restore_state_to_opc = avr_restore_state_to_opc,
     .mmu_index = avr_cpu_mmu_index,
diff --git a/target/hexagon/cpu.c b/target/hexagon/cpu.c
index a7f76dd089..a5a04173ab 100644
--- a/target/hexagon/cpu.c
+++ b/target/hexagon/cpu.c
@@ -255,7 +255,7 @@ static vaddr hexagon_cpu_get_pc(CPUState *cs)
     return cpu_env(cs)->gpr[HEX_REG_PC];
 }
 
-TCGTBCPUState cpu_get_tb_cpu_state(CPUState *cs)
+static TCGTBCPUState hexagon_get_tb_cpu_state(CPUState *cs)
 {
     CPUHexagonState *env = cpu_env(cs);
     vaddr pc = env->gpr[HEX_REG_PC];
@@ -344,6 +344,7 @@ static const TCGCPUOps hexagon_tcg_ops = {
     .mttcg_supported = false,
     .initialize = hexagon_translate_init,
     .translate_code = hexagon_translate_code,
+    .get_tb_cpu_state = hexagon_get_tb_cpu_state,
     .synchronize_from_tb = hexagon_cpu_synchronize_from_tb,
     .restore_state_to_opc = hexagon_restore_state_to_opc,
     .mmu_index = hexagon_cpu_mmu_index,
diff --git a/target/hppa/cpu.c b/target/hppa/cpu.c
index 40cbc191bb..6465181543 100644
--- a/target/hppa/cpu.c
+++ b/target/hppa/cpu.c
@@ -51,7 +51,7 @@ static vaddr hppa_cpu_get_pc(CPUState *cs)
                          env->iaoq_f & -4);
 }
 
-TCGTBCPUState cpu_get_tb_cpu_state(CPUState *cs)
+static TCGTBCPUState hppa_get_tb_cpu_state(CPUState *cs)
 {
     CPUHPPAState *env = cpu_env(cs);
     uint32_t flags = 0;
@@ -262,6 +262,7 @@ static const TCGCPUOps hppa_tcg_ops = {
 
     .initialize = hppa_translate_init,
     .translate_code = hppa_translate_code,
+    .get_tb_cpu_state = hppa_get_tb_cpu_state,
     .synchronize_from_tb = hppa_cpu_synchronize_from_tb,
     .restore_state_to_opc = hppa_restore_state_to_opc,
     .mmu_index = hppa_cpu_mmu_index,
diff --git a/target/i386/tcg/tcg-cpu.c b/target/i386/tcg/tcg-cpu.c
index 3004fb3023..179dfdf064 100644
--- a/target/i386/tcg/tcg-cpu.c
+++ b/target/i386/tcg/tcg-cpu.c
@@ -48,7 +48,7 @@ static void x86_cpu_exec_exit(CPUState *cs)
     env->eflags = cpu_compute_eflags(env);
 }
 
-TCGTBCPUState cpu_get_tb_cpu_state(CPUState *cs)
+static TCGTBCPUState x86_get_tb_cpu_state(CPUState *cs)
 {
     CPUX86State *env = cpu_env(cs);
     uint32_t flags, cs_base;
@@ -160,6 +160,7 @@ const TCGCPUOps x86_tcg_ops = {
     .guest_default_memory_order = TCG_MO_ALL & ~TCG_MO_ST_LD,
     .initialize = tcg_x86_init,
     .translate_code = x86_translate_code,
+    .get_tb_cpu_state = x86_get_tb_cpu_state,
     .synchronize_from_tb = x86_cpu_synchronize_from_tb,
     .restore_state_to_opc = x86_restore_state_to_opc,
     .mmu_index = x86_cpu_mmu_index,
diff --git a/target/loongarch/cpu.c b/target/loongarch/cpu.c
index 446cf43914..f7535d1be7 100644
--- a/target/loongarch/cpu.c
+++ b/target/loongarch/cpu.c
@@ -336,7 +336,7 @@ static bool loongarch_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
 }
 #endif
 
-TCGTBCPUState cpu_get_tb_cpu_state(CPUState *cs)
+static TCGTBCPUState loongarch_get_tb_cpu_state(CPUState *cs)
 {
     CPULoongArchState *env = cpu_env(cs);
     uint32_t flags;
@@ -882,6 +882,7 @@ static const TCGCPUOps loongarch_tcg_ops = {
 
     .initialize = loongarch_translate_init,
     .translate_code = loongarch_translate_code,
+    .get_tb_cpu_state = loongarch_get_tb_cpu_state,
     .synchronize_from_tb = loongarch_cpu_synchronize_from_tb,
     .restore_state_to_opc = loongarch_restore_state_to_opc,
     .mmu_index = loongarch_cpu_mmu_index,
diff --git a/target/m68k/cpu.c b/target/m68k/cpu.c
index b75ed6e887..c5196a612e 100644
--- a/target/m68k/cpu.c
+++ b/target/m68k/cpu.c
@@ -40,7 +40,7 @@ static vaddr m68k_cpu_get_pc(CPUState *cs)
     return cpu->env.pc;
 }
 
-TCGTBCPUState cpu_get_tb_cpu_state(CPUState *cs)
+static TCGTBCPUState m68k_get_tb_cpu_state(CPUState *cs)
 {
     CPUM68KState *env = cpu_env(cs);
     uint32_t flags;
@@ -613,6 +613,7 @@ static const TCGCPUOps m68k_tcg_ops = {
 
     .initialize = m68k_tcg_init,
     .translate_code = m68k_translate_code,
+    .get_tb_cpu_state = m68k_get_tb_cpu_state,
     .restore_state_to_opc = m68k_restore_state_to_opc,
     .mmu_index = m68k_cpu_mmu_index,
 
diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
index 72a0d0583c..d069e40e70 100644
--- a/target/microblaze/cpu.c
+++ b/target/microblaze/cpu.c
@@ -95,7 +95,7 @@ static vaddr mb_cpu_get_pc(CPUState *cs)
     return cpu->env.pc;
 }
 
-TCGTBCPUState cpu_get_tb_cpu_state(CPUState *cs)
+static TCGTBCPUState mb_get_tb_cpu_state(CPUState *cs)
 {
     CPUMBState *env = cpu_env(cs);
 
@@ -442,6 +442,7 @@ static const TCGCPUOps mb_tcg_ops = {
 
     .initialize = mb_tcg_init,
     .translate_code = mb_translate_code,
+    .get_tb_cpu_state = mb_get_tb_cpu_state,
     .synchronize_from_tb = mb_cpu_synchronize_from_tb,
     .restore_state_to_opc = mb_restore_state_to_opc,
     .mmu_index = mb_cpu_mmu_index,
diff --git a/target/mips/cpu.c b/target/mips/cpu.c
index b0f7612a64..4cbfb9435a 100644
--- a/target/mips/cpu.c
+++ b/target/mips/cpu.c
@@ -549,7 +549,7 @@ static int mips_cpu_mmu_index(CPUState *cs, bool ifunc)
     return mips_env_mmu_index(cpu_env(cs));
 }
 
-TCGTBCPUState cpu_get_tb_cpu_state(CPUState *cs)
+static TCGTBCPUState mips_get_tb_cpu_state(CPUState *cs)
 {
     CPUMIPSState *env = cpu_env(cs);
 
@@ -566,6 +566,7 @@ static const TCGCPUOps mips_tcg_ops = {
 
     .initialize = mips_tcg_init,
     .translate_code = mips_translate_code,
+    .get_tb_cpu_state = mips_get_tb_cpu_state,
     .synchronize_from_tb = mips_cpu_synchronize_from_tb,
     .restore_state_to_opc = mips_restore_state_to_opc,
     .mmu_index = mips_cpu_mmu_index,
diff --git a/target/openrisc/cpu.c b/target/openrisc/cpu.c
index aba4639bbb..054ad33360 100644
--- a/target/openrisc/cpu.c
+++ b/target/openrisc/cpu.c
@@ -41,7 +41,7 @@ static vaddr openrisc_cpu_get_pc(CPUState *cs)
     return cpu->env.pc;
 }
 
-TCGTBCPUState cpu_get_tb_cpu_state(CPUState *cs)
+static TCGTBCPUState openrisc_get_tb_cpu_state(CPUState *cs)
 {
     CPUOpenRISCState *env = cpu_env(cs);
 
@@ -258,6 +258,7 @@ static const TCGCPUOps openrisc_tcg_ops = {
 
     .initialize = openrisc_translate_init,
     .translate_code = openrisc_translate_code,
+    .get_tb_cpu_state = openrisc_get_tb_cpu_state,
     .synchronize_from_tb = openrisc_cpu_synchronize_from_tb,
     .restore_state_to_opc = openrisc_restore_state_to_opc,
     .mmu_index = openrisc_cpu_mmu_index,
diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
index 3a01731402..cf88a18244 100644
--- a/target/ppc/cpu_init.c
+++ b/target/ppc/cpu_init.c
@@ -45,7 +45,6 @@
 #include "internal.h"
 #include "spr_common.h"
 #include "power8-pmu.h"
-
 #ifndef CONFIG_USER_ONLY
 #include "hw/boards.h"
 #include "hw/intc/intc.h"
@@ -7483,6 +7482,7 @@ static const TCGCPUOps ppc_tcg_ops = {
   .guest_default_memory_order = 0,
   .initialize = ppc_translate_init,
   .translate_code = ppc_translate_code,
+  .get_tb_cpu_state = ppc_get_tb_cpu_state,
   .restore_state_to_opc = ppc_restore_state_to_opc,
   .mmu_index = ppc_cpu_mmu_index,
 
diff --git a/target/ppc/helper_regs.c b/target/ppc/helper_regs.c
index ccaf2b0343..7e5726871e 100644
--- a/target/ppc/helper_regs.c
+++ b/target/ppc/helper_regs.c
@@ -28,6 +28,7 @@
 #include "cpu-models.h"
 #include "spr_common.h"
 #include "accel/tcg/cpu-ops.h"
+#include "internal.h"
 
 /* Swap temporary saved registers with GPRs */
 void hreg_swap_gpr_tgpr(CPUPPCState *env)
@@ -256,7 +257,7 @@ void hreg_update_pmu_hflags(CPUPPCState *env)
     env->hflags |= hreg_compute_pmu_hflags_value(env);
 }
 
-TCGTBCPUState cpu_get_tb_cpu_state(CPUState *cs)
+TCGTBCPUState ppc_get_tb_cpu_state(CPUState *cs)
 {
     CPUPPCState *env = cpu_env(cs);
     uint32_t hflags_current = env->hflags;
diff --git a/target/ppc/internal.h b/target/ppc/internal.h
index 9012d3809c..7723350227 100644
--- a/target/ppc/internal.h
+++ b/target/ppc/internal.h
@@ -21,6 +21,7 @@
 #include "exec/breakpoint.h"
 #include "hw/registerfields.h"
 #include "exec/page-protection.h"
+#include "accel/tcg/tb-cpu-state.h"
 
 /* PM instructions */
 typedef enum {
@@ -308,4 +309,6 @@ static inline int ger_pack_masks(int pmsk, int ymsk, int xmsk)
     return msk;
 }
 
+TCGTBCPUState ppc_get_tb_cpu_state(CPUState *cs);
+
 #endif /* PPC_INTERNAL_H */
diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index 927153377e..55e00972b7 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -98,7 +98,7 @@ static int riscv_cpu_mmu_index(CPUState *cs, bool ifetch)
     return riscv_env_mmu_index(cpu_env(cs), ifetch);
 }
 
-TCGTBCPUState cpu_get_tb_cpu_state(CPUState *cs)
+static TCGTBCPUState riscv_get_tb_cpu_state(CPUState *cs)
 {
     CPURISCVState *env = cpu_env(cs);
     RISCVCPU *cpu = env_archcpu(env);
@@ -243,6 +243,7 @@ const TCGCPUOps riscv_tcg_ops = {
 
     .initialize = riscv_translate_init,
     .translate_code = riscv_translate_code,
+    .get_tb_cpu_state = riscv_get_tb_cpu_state,
     .synchronize_from_tb = riscv_cpu_synchronize_from_tb,
     .restore_state_to_opc = riscv_restore_state_to_opc,
     .mmu_index = riscv_cpu_mmu_index,
diff --git a/target/rx/cpu.c b/target/rx/cpu.c
index be778c9f65..36eba75545 100644
--- a/target/rx/cpu.c
+++ b/target/rx/cpu.c
@@ -44,7 +44,7 @@ static vaddr rx_cpu_get_pc(CPUState *cs)
     return cpu->env.pc;
 }
 
-TCGTBCPUState cpu_get_tb_cpu_state(CPUState *cs)
+static TCGTBCPUState rx_get_tb_cpu_state(CPUState *cs)
 {
     CPURXState *env = cpu_env(cs);
     uint32_t flags = 0;
@@ -220,6 +220,7 @@ static const TCGCPUOps rx_tcg_ops = {
 
     .initialize = rx_translate_init,
     .translate_code = rx_translate_code,
+    .get_tb_cpu_state = rx_get_tb_cpu_state,
     .synchronize_from_tb = rx_cpu_synchronize_from_tb,
     .restore_state_to_opc = rx_restore_state_to_opc,
     .mmu_index = rx_cpu_mmu_index,
diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
index 279289f265..9c1158ebcc 100644
--- a/target/s390x/cpu.c
+++ b/target/s390x/cpu.c
@@ -309,7 +309,7 @@ static int s390x_cpu_mmu_index(CPUState *cs, bool ifetch)
     return s390x_env_mmu_index(cpu_env(cs), ifetch);
 }
 
-TCGTBCPUState cpu_get_tb_cpu_state(CPUState *cs)
+static TCGTBCPUState s390x_get_tb_cpu_state(CPUState *cs)
 {
     CPUS390XState *env = cpu_env(cs);
     uint32_t flags;
@@ -358,6 +358,7 @@ static const TCGCPUOps s390_tcg_ops = {
 
     .initialize = s390x_translate_init,
     .translate_code = s390x_translate_code,
+    .get_tb_cpu_state = s390x_get_tb_cpu_state,
     .restore_state_to_opc = s390x_restore_state_to_opc,
     .mmu_index = s390x_cpu_mmu_index,
 
diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
index cbd43b55e5..b35f18e250 100644
--- a/target/sh4/cpu.c
+++ b/target/sh4/cpu.c
@@ -43,7 +43,7 @@ static vaddr superh_cpu_get_pc(CPUState *cs)
     return cpu->env.pc;
 }
 
-TCGTBCPUState cpu_get_tb_cpu_state(CPUState *cs)
+static TCGTBCPUState superh_get_tb_cpu_state(CPUState *cs)
 {
     CPUSH4State *env = cpu_env(cs);
     uint32_t flags;
@@ -289,6 +289,7 @@ static const TCGCPUOps superh_tcg_ops = {
 
     .initialize = sh4_translate_init,
     .translate_code = sh4_translate_code,
+    .get_tb_cpu_state = superh_get_tb_cpu_state,
     .synchronize_from_tb = superh_cpu_synchronize_from_tb,
     .restore_state_to_opc = superh_restore_state_to_opc,
     .mmu_index = sh4_cpu_mmu_index,
diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
index 6166b81f71..2a3e408923 100644
--- a/target/sparc/cpu.c
+++ b/target/sparc/cpu.c
@@ -716,7 +716,7 @@ static void sparc_cpu_synchronize_from_tb(CPUState *cs,
     cpu->env.npc = tb->cs_base;
 }
 
-TCGTBCPUState cpu_get_tb_cpu_state(CPUState *cs)
+static TCGTBCPUState sparc_get_tb_cpu_state(CPUState *cs)
 {
     CPUSPARCState *env = cpu_env(cs);
     uint32_t flags = cpu_mmu_index(cs, false);
@@ -1029,6 +1029,7 @@ static const TCGCPUOps sparc_tcg_ops = {
 
     .initialize = sparc_tcg_init,
     .translate_code = sparc_translate_code,
+    .get_tb_cpu_state = sparc_get_tb_cpu_state,
     .synchronize_from_tb = sparc_cpu_synchronize_from_tb,
     .restore_state_to_opc = sparc_restore_state_to_opc,
     .mmu_index = sparc_cpu_mmu_index,
diff --git a/target/tricore/cpu.c b/target/tricore/cpu.c
index 1151a812b6..e56f90fde9 100644
--- a/target/tricore/cpu.c
+++ b/target/tricore/cpu.c
@@ -45,7 +45,7 @@ static vaddr tricore_cpu_get_pc(CPUState *cs)
     return cpu_env(cs)->PC;
 }
 
-TCGTBCPUState cpu_get_tb_cpu_state(CPUState *cs)
+static TCGTBCPUState tricore_get_tb_cpu_state(CPUState *cs)
 {
     CPUTriCoreState *env = cpu_env(cs);
 
@@ -185,6 +185,7 @@ static const TCGCPUOps tricore_tcg_ops = {
     .mttcg_supported = false,
     .initialize = tricore_tcg_init,
     .translate_code = tricore_translate_code,
+    .get_tb_cpu_state = tricore_get_tb_cpu_state,
     .synchronize_from_tb = tricore_cpu_synchronize_from_tb,
     .restore_state_to_opc = tricore_restore_state_to_opc,
     .mmu_index = tricore_cpu_mmu_index,
diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
index 431b7ebd7b..91b71b6caa 100644
--- a/target/xtensa/cpu.c
+++ b/target/xtensa/cpu.c
@@ -55,7 +55,7 @@ static vaddr xtensa_cpu_get_pc(CPUState *cs)
     return cpu->env.pc;
 }
 
-TCGTBCPUState cpu_get_tb_cpu_state(CPUState *cs)
+static TCGTBCPUState xtensa_get_tb_cpu_state(CPUState *cs)
 {
     CPUXtensaState *env = cpu_env(cs);
     uint32_t flags = 0;
@@ -312,6 +312,7 @@ static const TCGCPUOps xtensa_tcg_ops = {
     .initialize = xtensa_translate_init,
     .translate_code = xtensa_translate_code,
     .debug_excp_handler = xtensa_breakpoint_handler,
+    .get_tb_cpu_state = xtensa_get_tb_cpu_state,
     .restore_state_to_opc = xtensa_restore_state_to_opc,
     .mmu_index = xtensa_cpu_mmu_index,
 

From b46357db323bf21d2816970a2f15540dfff84ecc Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 29 Apr 2025 12:13:18 -0700
Subject: [PATCH 0562/2760] accel/tcg: Pass TCGTBCPUState to tb_lookup

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cpu-exec.c | 28 +++++++++++++---------------
 1 file changed, 13 insertions(+), 15 deletions(-)

diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index 4a405d7b56..808983e461 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -232,35 +232,33 @@ static TranslationBlock *tb_htable_lookup(CPUState *cpu, vaddr pc,
  *
  * Returns: an existing translation block or NULL.
  */
-static inline TranslationBlock *tb_lookup(CPUState *cpu, vaddr pc,
-                                          uint64_t cs_base, uint32_t flags,
-                                          uint32_t cflags)
+static inline TranslationBlock *tb_lookup(CPUState *cpu, TCGTBCPUState s)
 {
     TranslationBlock *tb;
     CPUJumpCache *jc;
     uint32_t hash;
 
     /* we should never be trying to look up an INVALID tb */
-    tcg_debug_assert(!(cflags & CF_INVALID));
+    tcg_debug_assert(!(s.cflags & CF_INVALID));
 
-    hash = tb_jmp_cache_hash_func(pc);
+    hash = tb_jmp_cache_hash_func(s.pc);
     jc = cpu->tb_jmp_cache;
 
     tb = qatomic_read(&jc->array[hash].tb);
     if (likely(tb &&
-               jc->array[hash].pc == pc &&
-               tb->cs_base == cs_base &&
-               tb->flags == flags &&
-               tb_cflags(tb) == cflags)) {
+               jc->array[hash].pc == s.pc &&
+               tb->cs_base == s.cs_base &&
+               tb->flags == s.flags &&
+               tb_cflags(tb) == s.cflags)) {
         goto hit;
     }
 
-    tb = tb_htable_lookup(cpu, pc, cs_base, flags, cflags);
+    tb = tb_htable_lookup(cpu, s.pc, s.cs_base, s.flags, s.cflags);
     if (tb == NULL) {
         return NULL;
     }
 
-    jc->array[hash].pc = pc;
+    jc->array[hash].pc = s.pc;
     qatomic_set(&jc->array[hash].tb, tb);
 
 hit:
@@ -268,7 +266,7 @@ hit:
      * As long as tb is not NULL, the contents are consistent.  Therefore,
      * the virtual PC has to match for non-CF_PCREL translations.
      */
-    assert((tb_cflags(tb) & CF_PCREL) || tb->pc == pc);
+    assert((tb_cflags(tb) & CF_PCREL) || tb->pc == s.pc);
     return tb;
 }
 
@@ -402,7 +400,7 @@ const void *HELPER(lookup_tb_ptr)(CPUArchState *env)
         cpu_loop_exit(cpu);
     }
 
-    tb = tb_lookup(cpu, s.pc, s.cs_base, s.flags, s.cflags);
+    tb = tb_lookup(cpu, s);
     if (tb == NULL) {
         return tcg_code_gen_epilogue;
     }
@@ -581,7 +579,7 @@ void cpu_exec_step_atomic(CPUState *cpu)
          * Any breakpoint for this insn will have been recognized earlier.
          */
 
-        tb = tb_lookup(cpu, s.pc, s.cs_base, s.flags, s.cflags);
+        tb = tb_lookup(cpu, s);
         if (tb == NULL) {
             mmap_lock();
             tb = tb_gen_code(cpu, s.pc, s.cs_base, s.flags, s.cflags);
@@ -955,7 +953,7 @@ cpu_exec_loop(CPUState *cpu, SyncClocks *sc)
                 break;
             }
 
-            tb = tb_lookup(cpu, s.pc, s.cs_base, s.flags, s.cflags);
+            tb = tb_lookup(cpu, s);
             if (tb == NULL) {
                 CPUJumpCache *jc;
                 uint32_t h;

From 088caf3de4e48e70d6716195afc0e47edd823ac0 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 29 Apr 2025 13:02:32 -0700
Subject: [PATCH 0563/2760] accel/tcg: Pass TCGTBCPUState to tb_htable_lookup

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cpu-exec.c | 20 +++++++++-----------
 1 file changed, 9 insertions(+), 11 deletions(-)

diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index 808983e461..8e6899950e 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -195,26 +195,24 @@ static bool tb_lookup_cmp(const void *p, const void *d)
     return false;
 }
 
-static TranslationBlock *tb_htable_lookup(CPUState *cpu, vaddr pc,
-                                          uint64_t cs_base, uint32_t flags,
-                                          uint32_t cflags)
+static TranslationBlock *tb_htable_lookup(CPUState *cpu, TCGTBCPUState s)
 {
     tb_page_addr_t phys_pc;
     struct tb_desc desc;
     uint32_t h;
 
     desc.env = cpu_env(cpu);
-    desc.cs_base = cs_base;
-    desc.flags = flags;
-    desc.cflags = cflags;
-    desc.pc = pc;
-    phys_pc = get_page_addr_code(desc.env, pc);
+    desc.cs_base = s.cs_base;
+    desc.flags = s.flags;
+    desc.cflags = s.cflags;
+    desc.pc = s.pc;
+    phys_pc = get_page_addr_code(desc.env, s.pc);
     if (phys_pc == -1) {
         return NULL;
     }
     desc.page_addr0 = phys_pc;
-    h = tb_hash_func(phys_pc, (cflags & CF_PCREL ? 0 : pc),
-                     flags, cs_base, cflags);
+    h = tb_hash_func(phys_pc, (s.cflags & CF_PCREL ? 0 : s.pc),
+                     s.flags, s.cs_base, s.cflags);
     return qht_lookup_custom(&tb_ctx.htable, &desc, h, tb_lookup_cmp);
 }
 
@@ -253,7 +251,7 @@ static inline TranslationBlock *tb_lookup(CPUState *cpu, TCGTBCPUState s)
         goto hit;
     }
 
-    tb = tb_htable_lookup(cpu, s.pc, s.cs_base, s.flags, s.cflags);
+    tb = tb_htable_lookup(cpu, s);
     if (tb == NULL) {
         return NULL;
     }

From cec7176a23bfb46ce54481f278e235f58eb9c456 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 29 Apr 2025 18:39:08 -0700
Subject: [PATCH 0564/2760] accel/tcg: Use TCGTBCPUState in struct tb_desc

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cpu-exec.c | 20 +++++++-------------
 1 file changed, 7 insertions(+), 13 deletions(-)

diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index 8e6899950e..4ad84c2db8 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -150,12 +150,9 @@ static void init_delay_params(SyncClocks *sc, const CPUState *cpu)
 #endif /* CONFIG USER ONLY */
 
 struct tb_desc {
-    vaddr pc;
-    uint64_t cs_base;
+    TCGTBCPUState s;
     CPUArchState *env;
     tb_page_addr_t page_addr0;
-    uint32_t flags;
-    uint32_t cflags;
 };
 
 static bool tb_lookup_cmp(const void *p, const void *d)
@@ -163,11 +160,11 @@ static bool tb_lookup_cmp(const void *p, const void *d)
     const TranslationBlock *tb = p;
     const struct tb_desc *desc = d;
 
-    if ((tb_cflags(tb) & CF_PCREL || tb->pc == desc->pc) &&
+    if ((tb_cflags(tb) & CF_PCREL || tb->pc == desc->s.pc) &&
         tb_page_addr0(tb) == desc->page_addr0 &&
-        tb->cs_base == desc->cs_base &&
-        tb->flags == desc->flags &&
-        tb_cflags(tb) == desc->cflags) {
+        tb->cs_base == desc->s.cs_base &&
+        tb->flags == desc->s.flags &&
+        tb_cflags(tb) == desc->s.cflags) {
         /* check next page if needed */
         tb_page_addr_t tb_phys_page1 = tb_page_addr1(tb);
         if (tb_phys_page1 == -1) {
@@ -185,7 +182,7 @@ static bool tb_lookup_cmp(const void *p, const void *d)
              * is different for the new TB.  Therefore any exception raised
              * here by the faulting lookup is not premature.
              */
-            virt_page1 = TARGET_PAGE_ALIGN(desc->pc);
+            virt_page1 = TARGET_PAGE_ALIGN(desc->s.pc);
             phys_page1 = get_page_addr_code(desc->env, virt_page1);
             if (tb_phys_page1 == phys_page1) {
                 return true;
@@ -201,11 +198,8 @@ static TranslationBlock *tb_htable_lookup(CPUState *cpu, TCGTBCPUState s)
     struct tb_desc desc;
     uint32_t h;
 
+    desc.s = s;
     desc.env = cpu_env(cpu);
-    desc.cs_base = s.cs_base;
-    desc.flags = s.flags;
-    desc.cflags = s.cflags;
-    desc.pc = s.pc;
     phys_pc = get_page_addr_code(desc.env, s.pc);
     if (phys_pc == -1) {
         return NULL;

From 18a77386f15d4fed13b3d162e73e784e1da1f862 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 29 Apr 2025 18:59:26 -0700
Subject: [PATCH 0565/2760] accel/tcg: Pass TCGTBCPUState to tb_gen_code

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cpu-exec.c        |  4 ++--
 accel/tcg/internal-common.h |  5 ++---
 accel/tcg/translate-all.c   | 28 +++++++++++++---------------
 3 files changed, 17 insertions(+), 20 deletions(-)

diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index 4ad84c2db8..a7436d2873 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -574,7 +574,7 @@ void cpu_exec_step_atomic(CPUState *cpu)
         tb = tb_lookup(cpu, s);
         if (tb == NULL) {
             mmap_lock();
-            tb = tb_gen_code(cpu, s.pc, s.cs_base, s.flags, s.cflags);
+            tb = tb_gen_code(cpu, s);
             mmap_unlock();
         }
 
@@ -951,7 +951,7 @@ cpu_exec_loop(CPUState *cpu, SyncClocks *sc)
                 uint32_t h;
 
                 mmap_lock();
-                tb = tb_gen_code(cpu, s.pc, s.cs_base, s.flags, s.cflags);
+                tb = tb_gen_code(cpu, s);
                 mmap_unlock();
 
                 /*
diff --git a/accel/tcg/internal-common.h b/accel/tcg/internal-common.h
index 98c702422f..1dbc45dd95 100644
--- a/accel/tcg/internal-common.h
+++ b/accel/tcg/internal-common.h
@@ -12,6 +12,7 @@
 #include "exec/cpu-common.h"
 #include "exec/translation-block.h"
 #include "exec/mmap-lock.h"
+#include "accel/tcg/tb-cpu-state.h"
 
 extern int64_t max_delay;
 extern int64_t max_advance;
@@ -46,9 +47,7 @@ static inline bool cpu_plugin_mem_cbs_enabled(const CPUState *cpu)
 #endif
 }
 
-TranslationBlock *tb_gen_code(CPUState *cpu, vaddr pc,
-                              uint64_t cs_base, uint32_t flags,
-                              int cflags);
+TranslationBlock *tb_gen_code(CPUState *cpu, TCGTBCPUState s);
 void page_init(void);
 void tb_htable_init(void);
 void tb_reset_jump(TranslationBlock *tb, int n);
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index 97aadee52c..7b0bd50904 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -290,9 +290,7 @@ static int setjmp_gen_code(CPUArchState *env, TranslationBlock *tb,
 }
 
 /* Called with mmap_lock held for user mode emulation.  */
-TranslationBlock *tb_gen_code(CPUState *cpu,
-                              vaddr pc, uint64_t cs_base,
-                              uint32_t flags, int cflags)
+TranslationBlock *tb_gen_code(CPUState *cpu, TCGTBCPUState s)
 {
     CPUArchState *env = cpu_env(cpu);
     TranslationBlock *tb, *existing_tb;
@@ -305,14 +303,14 @@ TranslationBlock *tb_gen_code(CPUState *cpu,
     assert_memory_lock();
     qemu_thread_jit_write();
 
-    phys_pc = get_page_addr_code_hostp(env, pc, &host_pc);
+    phys_pc = get_page_addr_code_hostp(env, s.pc, &host_pc);
 
     if (phys_pc == -1) {
         /* Generate a one-shot TB with 1 insn in it */
-        cflags = (cflags & ~CF_COUNT_MASK) | 1;
+        s.cflags = (s.cflags & ~CF_COUNT_MASK) | 1;
     }
 
-    max_insns = cflags & CF_COUNT_MASK;
+    max_insns = s.cflags & CF_COUNT_MASK;
     if (max_insns == 0) {
         max_insns = TCG_MAX_INSNS;
     }
@@ -332,12 +330,12 @@ TranslationBlock *tb_gen_code(CPUState *cpu,
 
     gen_code_buf = tcg_ctx->code_gen_ptr;
     tb->tc.ptr = tcg_splitwx_to_rx(gen_code_buf);
-    if (!(cflags & CF_PCREL)) {
-        tb->pc = pc;
+    if (!(s.cflags & CF_PCREL)) {
+        tb->pc = s.pc;
     }
-    tb->cs_base = cs_base;
-    tb->flags = flags;
-    tb->cflags = cflags;
+    tb->cs_base = s.cs_base;
+    tb->flags = s.flags;
+    tb->cflags = s.cflags;
     tb_set_page_addr0(tb, phys_pc);
     tb_set_page_addr1(tb, -1);
     if (phys_pc != -1) {
@@ -355,9 +353,9 @@ TranslationBlock *tb_gen_code(CPUState *cpu,
     tcg_ctx->guest_mo = cpu->cc->tcg_ops->guest_default_memory_order;
 
  restart_translate:
-    trace_translate_block(tb, pc, tb->tc.ptr);
+    trace_translate_block(tb, s.pc, tb->tc.ptr);
 
-    gen_code_size = setjmp_gen_code(env, tb, pc, host_pc, &max_insns, &ti);
+    gen_code_size = setjmp_gen_code(env, tb, s.pc, host_pc, &max_insns, &ti);
     if (unlikely(gen_code_size < 0)) {
         switch (gen_code_size) {
         case -1:
@@ -434,10 +432,10 @@ TranslationBlock *tb_gen_code(CPUState *cpu,
      * For CF_PCREL, attribute all executions of the generated code
      * to its first mapping.
      */
-    perf_report_code(pc, tb, tcg_splitwx_to_rx(gen_code_buf));
+    perf_report_code(s.pc, tb, tcg_splitwx_to_rx(gen_code_buf));
 
     if (qemu_loglevel_mask(CPU_LOG_TB_OUT_ASM) &&
-        qemu_log_in_addr_range(pc)) {
+        qemu_log_in_addr_range(s.pc)) {
         FILE *logfile = qemu_log_trylock();
         if (logfile) {
             int code_size, data_size;

From 0baf907b718e1602383b973de7822c25db4c4a36 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 28 Apr 2025 10:16:52 -0700
Subject: [PATCH 0566/2760] accel/tcg: Split out accel/tcg/helper-retaddr.h
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Move set_helper_retaddr and clear_helper_retaddr
to a new header file.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cpu-exec.c               |  1 +
 accel/tcg/user-exec.c              |  1 +
 include/accel/tcg/cpu-ldst.h       | 34 -----------------------
 include/accel/tcg/helper-retaddr.h | 43 ++++++++++++++++++++++++++++++
 target/arm/tcg/helper-a64.c        |  1 +
 target/arm/tcg/sme_helper.c        |  1 +
 target/arm/tcg/sve_helper.c        |  1 +
 target/ppc/mem_helper.c            |  1 +
 target/s390x/tcg/mem_helper.c      |  1 +
 9 files changed, 50 insertions(+), 34 deletions(-)
 create mode 100644 include/accel/tcg/helper-retaddr.h

diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index a7436d2873..a8fbda31ba 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -24,6 +24,7 @@
 #include "hw/core/cpu.h"
 #include "accel/tcg/cpu-ldst.h"
 #include "accel/tcg/cpu-ops.h"
+#include "accel/tcg/helper-retaddr.h"
 #include "trace.h"
 #include "disas/disas.h"
 #include "exec/cpu-common.h"
diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index 70feee8df9..68e01fc584 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -26,6 +26,7 @@
 #include "qemu/bitops.h"
 #include "qemu/rcu.h"
 #include "accel/tcg/cpu-ldst.h"
+#include "accel/tcg/helper-retaddr.h"
 #include "accel/tcg/probe.h"
 #include "user/cpu_loop.h"
 #include "qemu/main-loop.h"
diff --git a/include/accel/tcg/cpu-ldst.h b/include/accel/tcg/cpu-ldst.h
index f97a730703..44a62b54da 100644
--- a/include/accel/tcg/cpu-ldst.h
+++ b/include/accel/tcg/cpu-ldst.h
@@ -526,38 +526,4 @@ void *tlb_vaddr_to_host(CPUArchState *env, vaddr addr,
                         MMUAccessType access_type, int mmu_idx);
 #endif
 
-/*
- * For user-only, helpers that use guest to host address translation
- * must protect the actual host memory access by recording 'retaddr'
- * for the signal handler.  This is required for a race condition in
- * which another thread unmaps the page between a probe and the
- * actual access.
- */
-#ifdef CONFIG_USER_ONLY
-extern __thread uintptr_t helper_retaddr;
-
-static inline void set_helper_retaddr(uintptr_t ra)
-{
-    helper_retaddr = ra;
-    /*
-     * Ensure that this write is visible to the SIGSEGV handler that
-     * may be invoked due to a subsequent invalid memory operation.
-     */
-    signal_barrier();
-}
-
-static inline void clear_helper_retaddr(void)
-{
-    /*
-     * Ensure that previous memory operations have succeeded before
-     * removing the data visible to the signal handler.
-     */
-    signal_barrier();
-    helper_retaddr = 0;
-}
-#else
-#define set_helper_retaddr(ra)   do { } while (0)
-#define clear_helper_retaddr()   do { } while (0)
-#endif
-
 #endif /* ACCEL_TCG_CPU_LDST_H */
diff --git a/include/accel/tcg/helper-retaddr.h b/include/accel/tcg/helper-retaddr.h
new file mode 100644
index 0000000000..037fda2b83
--- /dev/null
+++ b/include/accel/tcg/helper-retaddr.h
@@ -0,0 +1,43 @@
+/*
+ * Get user helper pc for memory unwinding.
+ * SPDX-License-Identifier: LGPL-2.1-or-later
+ */
+
+#ifndef ACCEL_TCG_HELPER_RETADDR_H
+#define ACCEL_TCG_HELPER_RETADDR_H
+
+/*
+ * For user-only, helpers that use guest to host address translation
+ * must protect the actual host memory access by recording 'retaddr'
+ * for the signal handler.  This is required for a race condition in
+ * which another thread unmaps the page between a probe and the
+ * actual access.
+ */
+#ifdef CONFIG_USER_ONLY
+extern __thread uintptr_t helper_retaddr;
+
+static inline void set_helper_retaddr(uintptr_t ra)
+{
+    helper_retaddr = ra;
+    /*
+     * Ensure that this write is visible to the SIGSEGV handler that
+     * may be invoked due to a subsequent invalid memory operation.
+     */
+    signal_barrier();
+}
+
+static inline void clear_helper_retaddr(void)
+{
+    /*
+     * Ensure that previous memory operations have succeeded before
+     * removing the data visible to the signal handler.
+     */
+    signal_barrier();
+    helper_retaddr = 0;
+}
+#else
+#define set_helper_retaddr(ra)   do { } while (0)
+#define clear_helper_retaddr()   do { } while (0)
+#endif
+
+#endif /* ACCEL_TCG_HELPER_RETADDR_H */
diff --git a/target/arm/tcg/helper-a64.c b/target/arm/tcg/helper-a64.c
index 9cffda07cd..4f618ae390 100644
--- a/target/arm/tcg/helper-a64.c
+++ b/target/arm/tcg/helper-a64.c
@@ -30,6 +30,7 @@
 #include "qemu/crc32c.h"
 #include "exec/cpu-common.h"
 #include "accel/tcg/cpu-ldst.h"
+#include "accel/tcg/helper-retaddr.h"
 #include "accel/tcg/probe.h"
 #include "exec/target_page.h"
 #include "exec/tlb-flags.h"
diff --git a/target/arm/tcg/sme_helper.c b/target/arm/tcg/sme_helper.c
index 3226895cae..de0c6e54d4 100644
--- a/target/arm/tcg/sme_helper.c
+++ b/target/arm/tcg/sme_helper.c
@@ -23,6 +23,7 @@
 #include "tcg/tcg-gvec-desc.h"
 #include "exec/helper-proto.h"
 #include "accel/tcg/cpu-ldst.h"
+#include "accel/tcg/helper-retaddr.h"
 #include "qemu/int128.h"
 #include "fpu/softfloat.h"
 #include "vec_internal.h"
diff --git a/target/arm/tcg/sve_helper.c b/target/arm/tcg/sve_helper.c
index 9f20ecb51d..a2c363a4e1 100644
--- a/target/arm/tcg/sve_helper.c
+++ b/target/arm/tcg/sve_helper.c
@@ -30,6 +30,7 @@
 #include "vec_internal.h"
 #include "sve_ldst_internal.h"
 #include "accel/tcg/cpu-ldst.h"
+#include "accel/tcg/helper-retaddr.h"
 #include "accel/tcg/cpu-ops.h"
 #include "accel/tcg/probe.h"
 #ifdef CONFIG_USER_ONLY
diff --git a/target/ppc/mem_helper.c b/target/ppc/mem_helper.c
index aa1af44d22..6ab71a6fcb 100644
--- a/target/ppc/mem_helper.c
+++ b/target/ppc/mem_helper.c
@@ -24,6 +24,7 @@
 #include "exec/helper-proto.h"
 #include "helper_regs.h"
 #include "accel/tcg/cpu-ldst.h"
+#include "accel/tcg/helper-retaddr.h"
 #include "accel/tcg/probe.h"
 #include "internal.h"
 #include "qemu/atomic128.h"
diff --git a/target/s390x/tcg/mem_helper.c b/target/s390x/tcg/mem_helper.c
index 857005b120..a03609a140 100644
--- a/target/s390x/tcg/mem_helper.c
+++ b/target/s390x/tcg/mem_helper.c
@@ -32,6 +32,7 @@
 #include "exec/target_page.h"
 #include "exec/tlb-flags.h"
 #include "accel/tcg/cpu-ops.h"
+#include "accel/tcg/helper-retaddr.h"
 #include "qemu/int128.h"
 #include "qemu/atomic128.h"
 

From 5e5a9aea793cfd67541153105b6046436f6ae4a8 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 28 Apr 2025 10:20:41 -0700
Subject: [PATCH 0567/2760] accel/tcg: Compile cpu-exec.c twice

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cpu-exec.c  | 2 --
 accel/tcg/meson.build | 2 +-
 2 files changed, 1 insertion(+), 3 deletions(-)

diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index a8fbda31ba..cc5f362305 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -22,7 +22,6 @@
 #include "qapi/error.h"
 #include "qapi/type-helpers.h"
 #include "hw/core/cpu.h"
-#include "accel/tcg/cpu-ldst.h"
 #include "accel/tcg/cpu-ops.h"
 #include "accel/tcg/helper-retaddr.h"
 #include "trace.h"
@@ -37,7 +36,6 @@
 #include "qemu/rcu.h"
 #include "exec/log.h"
 #include "qemu/main-loop.h"
-#include "cpu.h"
 #include "exec/icount.h"
 #include "exec/replay-core.h"
 #include "system/tcg.h"
diff --git a/accel/tcg/meson.build b/accel/tcg/meson.build
index 3f7b127130..0bb089299b 100644
--- a/accel/tcg/meson.build
+++ b/accel/tcg/meson.build
@@ -5,6 +5,7 @@ endif
 tcg_ss = ss.source_set()
 
 tcg_ss.add(files(
+  'cpu-exec.c',
   'cpu-exec-common.c',
   'tcg-runtime.c',
   'tcg-runtime-gvec.c',
@@ -21,7 +22,6 @@ libsystem_ss.add_all(tcg_ss)
 tcg_specific_ss = ss.source_set()
 tcg_specific_ss.add(files(
   'tcg-all.c',
-  'cpu-exec.c',
   'translate-all.c',
 ))
 tcg_specific_ss.add(when: 'CONFIG_USER_ONLY', if_true: files('user-exec.c'))

From 28502121be7b1422af55bbed6f65a273b889ef01 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Sun, 23 Mar 2025 22:46:34 +0100
Subject: [PATCH 0568/2760] system/vl: Filter machine list available for a
 particular target binary
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Binaries can register a QOM type to filter their machines
by filling their TargetInfo::machine_typename field.

This can be used by example by main() -> machine_help_func()
to filter the machines list.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/qemu/target-info-impl.h | 2 ++
 include/qemu/target-info.h      | 8 ++++++++
 system/vl.c                     | 3 ++-
 target-info-stub.c              | 2 ++
 target-info.c                   | 5 +++++
 5 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/include/qemu/target-info-impl.h b/include/qemu/target-info-impl.h
index d30805f7f2..d0e8c86176 100644
--- a/include/qemu/target-info-impl.h
+++ b/include/qemu/target-info-impl.h
@@ -14,6 +14,8 @@
 typedef struct TargetInfo {
     /* runtime equivalent of TARGET_NAME definition */
     const char *target_name;
+    /* QOM typename machines for this binary must implement */
+    const char *machine_typename;
 } TargetInfo;
 
 /**
diff --git a/include/qemu/target-info.h b/include/qemu/target-info.h
index 58d4136897..2b6ccabb11 100644
--- a/include/qemu/target-info.h
+++ b/include/qemu/target-info.h
@@ -16,6 +16,14 @@
  */
 const char *target_name(void);
 
+/**
+ * target_machine_typename:
+ *
+ * Returns: Name of the QOM interface implemented by machines
+ *          usable on this target binary.
+ */
+const char *target_machine_typename(void);
+
 /**
  * target_cpu_type:
  *
diff --git a/system/vl.c b/system/vl.c
index 520956f4a1..7223f1ff17 100644
--- a/system/vl.c
+++ b/system/vl.c
@@ -27,6 +27,7 @@
 #include "qemu/datadir.h"
 #include "qemu/units.h"
 #include "qemu/module.h"
+#include "qemu/target-info.h"
 #include "exec/cpu-common.h"
 #include "exec/page-vary.h"
 #include "hw/qdev-properties.h"
@@ -1564,7 +1565,7 @@ static void machine_help_func(const QDict *qdict)
     GSList *el;
     const char *type = qdict_get_try_str(qdict, "type");
 
-    machines = object_class_get_list(TYPE_MACHINE, false);
+    machines = object_class_get_list(target_machine_typename(), false);
     if (type) {
         ObjectClass *machine_class = OBJECT_CLASS(find_machine(type, machines));
         if (machine_class) {
diff --git a/target-info-stub.c b/target-info-stub.c
index 773a10188c..bcf834f71d 100644
--- a/target-info-stub.c
+++ b/target-info-stub.c
@@ -9,10 +9,12 @@
 #include "qemu/osdep.h"
 #include "qemu/target-info.h"
 #include "qemu/target-info-impl.h"
+#include "hw/boards.h"
 #include "cpu.h"
 
 static const TargetInfo target_info_stub = {
     .target_name = TARGET_NAME,
+    .machine_typename = TYPE_MACHINE,
 };
 
 const TargetInfo *target_info(void)
diff --git a/target-info.c b/target-info.c
index 84b18931e7..0042769e3a 100644
--- a/target-info.c
+++ b/target-info.c
@@ -14,3 +14,8 @@ const char *target_name(void)
 {
     return target_info()->target_name;
 }
+
+const char *target_machine_typename(void)
+{
+    return target_info()->machine_typename;
+}

From b113dfa081a6a7e061551a70e6ede7af0941a845 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 29 Apr 2025 20:18:03 +0200
Subject: [PATCH 0569/2760] qemu/target_info: Add %target_cpu_type field to
 TargetInfo
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 include/qemu/target-info-impl.h | 2 ++
 target-info-stub.c              | 6 +-----
 target-info.c                   | 5 +++++
 3 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/include/qemu/target-info-impl.h b/include/qemu/target-info-impl.h
index d0e8c86176..76766eeaae 100644
--- a/include/qemu/target-info-impl.h
+++ b/include/qemu/target-info-impl.h
@@ -14,6 +14,8 @@
 typedef struct TargetInfo {
     /* runtime equivalent of TARGET_NAME definition */
     const char *target_name;
+    /* runtime equivalent of CPU_RESOLVING_TYPE definition */
+    const char *cpu_type;
     /* QOM typename machines for this binary must implement */
     const char *machine_typename;
 } TargetInfo;
diff --git a/target-info-stub.c b/target-info-stub.c
index bcf834f71d..86da297277 100644
--- a/target-info-stub.c
+++ b/target-info-stub.c
@@ -14,6 +14,7 @@
 
 static const TargetInfo target_info_stub = {
     .target_name = TARGET_NAME,
+    .cpu_type = CPU_RESOLVING_TYPE,
     .machine_typename = TYPE_MACHINE,
 };
 
@@ -21,8 +22,3 @@ const TargetInfo *target_info(void)
 {
     return &target_info_stub;
 }
-
-const char *target_cpu_type(void)
-{
-    return CPU_RESOLVING_TYPE;
-}
diff --git a/target-info.c b/target-info.c
index 0042769e3a..5f5ef1f932 100644
--- a/target-info.c
+++ b/target-info.c
@@ -15,6 +15,11 @@ const char *target_name(void)
     return target_info()->target_name;
 }
 
+const char *target_cpu_type(void)
+{
+    return target_info()->cpu_type;
+}
+
 const char *target_machine_typename(void)
 {
     return target_info()->machine_typename;

From c1be135ad5b124b08715ca836b95b738c6b9d7d4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Sun, 23 Mar 2025 13:20:24 +0100
Subject: [PATCH 0570/2760] qemu: Introduce target_long_bits()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 include/qemu/target-info-impl.h | 2 ++
 include/qemu/target-info.h      | 7 +++++++
 target-info-stub.c              | 1 +
 target-info.c                   | 5 +++++
 4 files changed, 15 insertions(+)

diff --git a/include/qemu/target-info-impl.h b/include/qemu/target-info-impl.h
index 76766eeaae..1b51cbcfe1 100644
--- a/include/qemu/target-info-impl.h
+++ b/include/qemu/target-info-impl.h
@@ -14,6 +14,8 @@
 typedef struct TargetInfo {
     /* runtime equivalent of TARGET_NAME definition */
     const char *target_name;
+    /* runtime equivalent of TARGET_LONG_BITS definition */
+    unsigned long_bits;
     /* runtime equivalent of CPU_RESOLVING_TYPE definition */
     const char *cpu_type;
     /* QOM typename machines for this binary must implement */
diff --git a/include/qemu/target-info.h b/include/qemu/target-info.h
index 2b6ccabb11..850a2958b9 100644
--- a/include/qemu/target-info.h
+++ b/include/qemu/target-info.h
@@ -16,6 +16,13 @@
  */
 const char *target_name(void);
 
+/**
+ * target_long_bits:
+ *
+ * Returns: number of bits in a long type for this target (i.e. 64).
+ */
+unsigned target_long_bits(void);
+
 /**
  * target_machine_typename:
  *
diff --git a/target-info-stub.c b/target-info-stub.c
index 86da297277..fecc0e7128 100644
--- a/target-info-stub.c
+++ b/target-info-stub.c
@@ -14,6 +14,7 @@
 
 static const TargetInfo target_info_stub = {
     .target_name = TARGET_NAME,
+    .long_bits = TARGET_LONG_BITS,
     .cpu_type = CPU_RESOLVING_TYPE,
     .machine_typename = TYPE_MACHINE,
 };
diff --git a/target-info.c b/target-info.c
index 5f5ef1f932..16fdca7aaa 100644
--- a/target-info.c
+++ b/target-info.c
@@ -15,6 +15,11 @@ const char *target_name(void)
     return target_info()->target_name;
 }
 
+unsigned target_long_bits(void)
+{
+    return target_info()->long_bits;
+}
+
 const char *target_cpu_type(void)
 {
     return target_info()->cpu_type;

From 0648c76ad198e91515771fbbeaac3a3807669a4a Mon Sep 17 00:00:00 2001
From: Vincent Vanlaer <libvirt-e6954efa@volkihar.be>
Date: Sat, 26 Oct 2024 18:30:07 +0200
Subject: [PATCH 0571/2760] block: refactor error handling of commit_iteration

Signed-off-by: Vincent Vanlaer <libvirt-e6954efa@volkihar.be>
Message-Id: <20241026163010.2865002-4-libvirt-e6954efa@volkihar.be>
[vsementsov]: move action declaration to the top of the function
Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
---
 block/commit.c | 67 ++++++++++++++++++++++++++++----------------------
 1 file changed, 38 insertions(+), 29 deletions(-)

diff --git a/block/commit.c b/block/commit.c
index 3ee0ade7df..5c6596a52e 100644
--- a/block/commit.c
+++ b/block/commit.c
@@ -129,51 +129,60 @@ static void commit_clean(Job *job)
 }
 
 static int commit_iteration(CommitBlockJob *s, int64_t offset,
-                            int64_t *n, void *buf)
+                            int64_t *requested_bytes, void *buf)
 {
+    BlockErrorAction action;
+    int64_t bytes = *requested_bytes;
     int ret = 0;
-    bool copy;
     bool error_in_source = true;
 
     /* Copy if allocated above the base */
     WITH_GRAPH_RDLOCK_GUARD() {
         ret = bdrv_co_common_block_status_above(blk_bs(s->top),
             s->base_overlay, true, true, offset, COMMIT_BUFFER_SIZE,
-            n, NULL, NULL, NULL);
+            &bytes, NULL, NULL, NULL);
     }
 
-    copy = (ret >= 0 && ret & BDRV_BLOCK_ALLOCATED);
-    trace_commit_one_iteration(s, offset, *n, ret);
-    if (copy) {
-        assert(*n < SIZE_MAX);
+    trace_commit_one_iteration(s, offset, bytes, ret);
 
-        ret = blk_co_pread(s->top, offset, *n, buf, 0);
-        if (ret >= 0) {
-            ret = blk_co_pwrite(s->base, offset, *n, buf, 0);
-            if (ret < 0) {
-                error_in_source = false;
-            }
-        }
-    }
     if (ret < 0) {
-        BlockErrorAction action = block_job_error_action(&s->common,
-                                                         s->on_error,
-                                                         error_in_source,
-                                                         -ret);
-        if (action == BLOCK_ERROR_ACTION_REPORT) {
-            return ret;
-        } else {
-            *n = 0;
-            return 0;
-        }
+        goto fail;
     }
-    /* Publish progress */
-    job_progress_update(&s->common.job, *n);
 
-    if (copy) {
-        block_job_ratelimit_processed_bytes(&s->common, *n);
+    if (ret & BDRV_BLOCK_ALLOCATED) {
+        assert(bytes < SIZE_MAX);
+
+        ret = blk_co_pread(s->top, offset, bytes, buf, 0);
+        if (ret < 0) {
+            goto fail;
+        }
+
+        ret = blk_co_pwrite(s->base, offset, bytes, buf, 0);
+        if (ret < 0) {
+            error_in_source = false;
+            goto fail;
+        }
+
+        block_job_ratelimit_processed_bytes(&s->common, bytes);
     }
 
+    /* Publish progress */
+
+    job_progress_update(&s->common.job, bytes);
+
+    *requested_bytes = bytes;
+
+    return 0;
+
+fail:
+    action = block_job_error_action(&s->common, s->on_error,
+                                    error_in_source, -ret);
+    if (action == BLOCK_ERROR_ACTION_REPORT) {
+        return ret;
+    }
+
+    *requested_bytes = 0;
+
     return 0;
 }
 

From 6f3199f99600fe75f32f78574e507f347de80854 Mon Sep 17 00:00:00 2001
From: Vincent Vanlaer <libvirt-e6954efa@volkihar.be>
Date: Sat, 26 Oct 2024 18:30:08 +0200
Subject: [PATCH 0572/2760] block: allow commit to unmap zero blocks

Non-active block commits do not discard blocks only containing zeros,
causing images to lose sparseness after the commit. This commit fixes
that by writing zero blocks using blk_co_pwrite_zeroes rather than
writing them out as any other arbitrary data.

Signed-off-by: Vincent Vanlaer <libvirt-e6954efa@volkihar.be>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Message-Id: <20241026163010.2865002-5-libvirt-e6954efa@volkihar.be>
Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
---
 block/commit.c | 40 ++++++++++++++++++++++++++++++----------
 1 file changed, 30 insertions(+), 10 deletions(-)

diff --git a/block/commit.c b/block/commit.c
index 5c6596a52e..7cc8c0f0df 100644
--- a/block/commit.c
+++ b/block/commit.c
@@ -150,19 +150,39 @@ static int commit_iteration(CommitBlockJob *s, int64_t offset,
     }
 
     if (ret & BDRV_BLOCK_ALLOCATED) {
-        assert(bytes < SIZE_MAX);
+        if (ret & BDRV_BLOCK_ZERO) {
+            /*
+             * If the top (sub)clusters are smaller than the base
+             * (sub)clusters, this will not unmap unless the underlying device
+             * does some tracking of these requests. Ideally, we would find
+             * the maximal extent of the zero clusters.
+             */
+            ret = blk_co_pwrite_zeroes(s->base, offset, bytes,
+                                       BDRV_REQ_MAY_UNMAP);
+            if (ret < 0) {
+                error_in_source = false;
+                goto fail;
+            }
+        } else {
+            assert(bytes < SIZE_MAX);
 
-        ret = blk_co_pread(s->top, offset, bytes, buf, 0);
-        if (ret < 0) {
-            goto fail;
-        }
-
-        ret = blk_co_pwrite(s->base, offset, bytes, buf, 0);
-        if (ret < 0) {
-            error_in_source = false;
-            goto fail;
+            ret = blk_co_pread(s->top, offset, bytes, buf, 0);
+            if (ret < 0) {
+                goto fail;
+            }
+
+            ret = blk_co_pwrite(s->base, offset, bytes, buf, 0);
+            if (ret < 0) {
+                error_in_source = false;
+                goto fail;
+            }
         }
 
+        /*
+         * Whether zeroes actually end up on disk depends on the details of
+         * the underlying driver. Therefore, this might rate limit more than
+         * is necessary.
+         */
         block_job_ratelimit_processed_bytes(&s->common, bytes);
     }
 

From 68aba2a9350345d109f8036f9eff68b81b1c2167 Mon Sep 17 00:00:00 2001
From: Vincent Vanlaer <libvirt-e6954efa@volkihar.be>
Date: Sat, 26 Oct 2024 18:30:09 +0200
Subject: [PATCH 0573/2760] block: add test non-active commit with zeroed data

Signed-off-by: Vincent Vanlaer <libvirt-e6954efa@volkihar.be>
Tested-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Message-Id: <20241026163010.2865002-6-libvirt-e6954efa@volkihar.be>
Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
---
 tests/qemu-iotests/tests/commit-zero-blocks   | 96 +++++++++++++++++++
 .../qemu-iotests/tests/commit-zero-blocks.out | 54 +++++++++++
 2 files changed, 150 insertions(+)
 create mode 100755 tests/qemu-iotests/tests/commit-zero-blocks
 create mode 100644 tests/qemu-iotests/tests/commit-zero-blocks.out

diff --git a/tests/qemu-iotests/tests/commit-zero-blocks b/tests/qemu-iotests/tests/commit-zero-blocks
new file mode 100755
index 0000000000..de00273e72
--- /dev/null
+++ b/tests/qemu-iotests/tests/commit-zero-blocks
@@ -0,0 +1,96 @@
+#!/usr/bin/env bash
+# group: rw quick
+#
+# Test for commit of discarded blocks
+#
+# This tests committing a live snapshot where some of the blocks that
+# are present in the base image are discarded in the intermediate image.
+# This intends to check that these blocks are also discarded in the base
+# image after the commit.
+#
+# Copyright (C) 2024 Vincent Vanlaer.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+# creator
+owner=libvirt-e6954efa@volkihar.be
+
+seq=`basename $0`
+echo "QA output created by $seq"
+
+status=1	# failure is the default!
+
+_cleanup()
+{
+    _cleanup_qemu
+    _rm_test_img "${TEST_IMG}.base"
+    _rm_test_img "${TEST_IMG}.mid"
+    _cleanup_test_img
+}
+trap "_cleanup; exit \$status" 0 1 2 3 15
+
+# get standard environment, filters and checks
+cd ..
+. ./common.rc
+. ./common.filter
+. ./common.qemu
+
+_supported_fmt qcow2
+_supported_proto file
+
+size="1M"
+
+TEST_IMG="$TEST_IMG.base" _make_test_img $size
+TEST_IMG="$TEST_IMG.mid" _make_test_img -b "$TEST_IMG.base" -F $IMGFMT $size
+_make_test_img -b "${TEST_IMG}.mid" -F $IMGFMT $size
+
+$QEMU_IO -c "write -P 0x01 64k 128k" "$TEST_IMG.base" | _filter_qemu_io
+$QEMU_IO -c "discard 64k 64k" "$TEST_IMG.mid" | _filter_qemu_io
+
+echo
+echo "=== Base image info before commit ==="
+TEST_IMG="${TEST_IMG}.base" _img_info | _filter_img_info
+$QEMU_IMG map --output=json "$TEST_IMG.base" | _filter_qemu_img_map
+
+echo
+echo "=== Middle image info before commit ==="
+TEST_IMG="${TEST_IMG}.mid" _img_info | _filter_img_info
+$QEMU_IMG map --output=json "$TEST_IMG.mid" | _filter_qemu_img_map
+
+echo
+echo === Running QEMU Live Commit Test ===
+echo
+
+qemu_comm_method="qmp"
+_launch_qemu -drive file="${TEST_IMG}",if=virtio,id=test
+h=$QEMU_HANDLE
+
+_send_qemu_cmd $h "{ 'execute': 'qmp_capabilities' }" "return"
+
+_send_qemu_cmd $h "{ 'execute': 'block-commit',
+                                 'arguments': { 'device': 'test',
+                                 'top': '"${TEST_IMG}.mid"',
+                                 'base': '"${TEST_IMG}.base"'} }" '"status": "null"'
+
+_cleanup_qemu
+
+echo
+echo "=== Base image info after commit ==="
+TEST_IMG="${TEST_IMG}.base" _img_info | _filter_img_info
+$QEMU_IMG map --output=json "$TEST_IMG.base" | _filter_qemu_img_map
+
+# success, all done
+echo "*** done"
+rm -f $seq.full
+status=0
diff --git a/tests/qemu-iotests/tests/commit-zero-blocks.out b/tests/qemu-iotests/tests/commit-zero-blocks.out
new file mode 100644
index 0000000000..85bdc46aaf
--- /dev/null
+++ b/tests/qemu-iotests/tests/commit-zero-blocks.out
@@ -0,0 +1,54 @@
+QA output created by commit-zero-blocks
+Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=1048576
+Formatting 'TEST_DIR/t.IMGFMT.mid', fmt=IMGFMT size=1048576 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1048576 backing_file=TEST_DIR/t.IMGFMT.mid backing_fmt=IMGFMT
+wrote 131072/131072 bytes at offset 65536
+128 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+discard 65536/65536 bytes at offset 65536
+64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+
+=== Base image info before commit ===
+image: TEST_DIR/t.IMGFMT.base
+file format: IMGFMT
+virtual size: 1 MiB (1048576 bytes)
+[{ "start": 0, "length": 65536, "depth": 0, "present": false, "zero": true, "data": false, "compressed": false},
+{ "start": 65536, "length": 131072, "depth": 0, "present": true, "zero": false, "data": true, "compressed": false, "offset": OFFSET},
+{ "start": 196608, "length": 851968, "depth": 0, "present": false, "zero": true, "data": false, "compressed": false}]
+
+=== Middle image info before commit ===
+image: TEST_DIR/t.IMGFMT.mid
+file format: IMGFMT
+virtual size: 1 MiB (1048576 bytes)
+backing file: TEST_DIR/t.IMGFMT.base
+backing file format: IMGFMT
+[{ "start": 0, "length": 65536, "depth": 1, "present": false, "zero": true, "data": false, "compressed": false},
+{ "start": 65536, "length": 65536, "depth": 0, "present": true, "zero": true, "data": false, "compressed": false},
+{ "start": 131072, "length": 65536, "depth": 1, "present": true, "zero": false, "data": true, "compressed": false, "offset": OFFSET},
+{ "start": 196608, "length": 851968, "depth": 1, "present": false, "zero": true, "data": false, "compressed": false}]
+
+=== Running QEMU Live Commit Test ===
+
+{ 'execute': 'qmp_capabilities' }
+{"return": {}}
+{ 'execute': 'block-commit',
+                                 'arguments': { 'device': 'test',
+                                 'top': 'TEST_DIR/t.IMGFMT.mid',
+                                 'base': 'TEST_DIR/t.IMGFMT.base'} }
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "created", "id": "test"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "test"}}
+{"return": {}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "waiting", "id": "test"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "pending", "id": "test"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_COMPLETED", "data": {"device": "test", "len": 1048576, "offset": 1048576, "speed": 0, "type": "commit"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "concluded", "id": "test"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "null", "id": "test"}}
+
+=== Base image info after commit ===
+image: TEST_DIR/t.IMGFMT.base
+file format: IMGFMT
+virtual size: 1 MiB (1048576 bytes)
+[{ "start": 0, "length": 65536, "depth": 0, "present": false, "zero": true, "data": false, "compressed": false},
+{ "start": 65536, "length": 65536, "depth": 0, "present": true, "zero": true, "data": false, "compressed": false},
+{ "start": 131072, "length": 65536, "depth": 0, "present": true, "zero": false, "data": true, "compressed": false, "offset": OFFSET},
+{ "start": 196608, "length": 851968, "depth": 0, "present": false, "zero": true, "data": false, "compressed": false}]
+*** done

From da17dd5c5ee8e33124da0bf91aed11491d0c04de Mon Sep 17 00:00:00 2001
From: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Date: Wed, 9 Apr 2025 11:42:30 +0300
Subject: [PATCH 0574/2760] qapi: synchronize jobs and block-jobs documentation

Actualize documentation and synchronize it for commands which actually
call the same functions internally.

Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Message-ID: <20250409084232.28201-2-vsementsov@yandex-team.ru>
---
 qapi/block-core.json | 61 ++++++++++++++++++++++++++------------------
 qapi/job.json        | 30 ++++++++++++++++++++--
 2 files changed, 64 insertions(+), 27 deletions(-)

diff --git a/qapi/block-core.json b/qapi/block-core.json
index b1937780e1..6beab0dc12 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
@@ -2956,13 +2956,14 @@
 #
 # Pause an active background block operation.
 #
-# This command returns immediately after marking the active background
-# block operation for pausing.  It is an error to call this command if
-# no operation is in progress or if the job is already paused.
+# This command returns immediately after marking the active job for
+# pausing.  Pausing an already paused job is an error.
 #
-# The operation will pause as soon as possible.  No event is emitted
-# when the operation is actually paused.  Cancelling a paused job
-# automatically resumes it.
+# The job will pause as soon as possible, which means transitioning
+# into the PAUSED state if it was RUNNING, or into STANDBY if it was
+# READY.  The corresponding JOB_STATUS_CHANGE event will be emitted.
+#
+# Cancelling a paused job automatically resumes it.
 #
 # @device: The job identifier.  This used to be a device name (hence
 #     the name of the parameter), but since QEMU 2.7 it can have other
@@ -2982,9 +2983,8 @@
 #
 # Resume an active background block operation.
 #
-# This command returns immediately after resuming a paused background
-# block operation.  It is an error to call this command if no
-# operation is in progress or if the job is not paused.
+# This command returns immediately after resuming a paused job.
+# Resuming an already running job is an error.
 #
 # This command also clears the error status of the job.
 #
@@ -3004,10 +3004,15 @@
 ##
 # @block-job-complete:
 #
-# Manually trigger completion of an active background block operation.
-# This is supported for drive mirroring, where it also switches the
-# device to write to the target path only.  The ability to complete is
-# signaled with a BLOCK_JOB_READY event.
+# Manually trigger completion of an active job in the READY or STANDBY
+# state.  Completing the job in any other state is an error.
+#
+# This is supported only for drive mirroring, where it also switches
+# the device to write to the target path only. Note that drive
+# mirroring includes drive-mirror, blockdev-mirror and block-commit
+# job (only in case of "active commit", when the node being commited
+# is used by the guest). The ability to complete is signaled with a
+# BLOCK_JOB_READY event.
 #
 # This command completes an active background block operation
 # synchronously.  The ordering of this command's return with the
@@ -3017,8 +3022,6 @@
 # rerror/werror arguments that were specified when starting the
 # operation.
 #
-# A cancelled or paused job cannot be completed.
-#
 # @device: The job identifier.  This used to be a device name (hence
 #     the name of the parameter), but since QEMU 2.7 it can have other
 #     values.
@@ -3035,10 +3038,13 @@
 ##
 # @block-job-dismiss:
 #
-# For jobs that have already concluded, remove them from the
-# block-job-query list.  This command only needs to be run for jobs
-# which were started with QEMU 2.12+ job lifetime management
-# semantics.
+# Deletes a job that is in the CONCLUDED state.  This command only
+# needs to be run explicitly for jobs that don't have automatic
+# dismiss enabled. In turn, automatic dismiss may be enabled only
+# for jobs that have @auto-dismiss option, which are drive-backup,
+# blockdev-backup, drive-mirror, blockdev-mirror, block-commit and
+# block-stream. @auto-dismiss is enabled by default for these
+# jobs.
 #
 # This command will refuse to operate on any job that has not yet
 # reached its terminal state, JOB_STATUS_CONCLUDED.  For jobs that
@@ -3055,12 +3061,17 @@
 ##
 # @block-job-finalize:
 #
-# Once a job that has manual=true reaches the pending state, it can be
-# instructed to finalize any graph changes and do any necessary
-# cleanup via this command.  For jobs in a transaction, instructing
-# one job to finalize will force ALL jobs in the transaction to
-# finalize, so it is only necessary to instruct a single member job to
-# finalize.
+# Instructs all jobs in a transaction (or a single job if it is not
+# part of any transaction) to finalize any graph changes and do any
+# necessary cleanup.  This command requires that all involved jobs are
+# in the PENDING state.
+#
+# For jobs in a transaction, instructing one job to finalize will
+# force ALL jobs in the transaction to finalize, so it is only
+# necessary to instruct a single member job to finalize.
+#
+# The command is applicable only to jobs which have @auto-finalize option
+# and only when this option is set to false.
 #
 # @id: The job identifier.
 #
diff --git a/qapi/job.json b/qapi/job.json
index cfc3beedd2..b03f80bc84 100644
--- a/qapi/job.json
+++ b/qapi/job.json
@@ -156,6 +156,9 @@
 # This command returns immediately after resuming a paused job.
 # Resuming an already running job is an error.
 #
+# This command also clears the error status for block-jobs (stream,
+# commit, mirror, backup).
+#
 # @id: The job identifier.
 #
 # Since: 3.0
@@ -184,7 +187,23 @@
 ##
 # @job-complete:
 #
-# Manually trigger completion of an active job in the READY state.
+# Manually trigger completion of an active job in the READY or STANDBY
+# state.  Completing the job in any other state is an error.
+#
+# This is supported only for drive mirroring, where it also switches
+# the device to write to the target path only. Note that drive
+# mirroring includes drive-mirror, blockdev-mirror and block-commit
+# job (only in case of "active commit", when the node being commited
+# is used by the guest). The ability to complete is signaled with a
+# BLOCK_JOB_READY event.
+#
+# This command completes an active background block operation
+# synchronously.  The ordering of this command's return with the
+# BLOCK_JOB_COMPLETED event is not defined.  Note that if an I/O error
+# occurs during the processing of this command: 1) the command itself
+# will fail; 2) the error will be processed according to the
+# rerror/werror arguments that were specified when starting the
+# operation.
 #
 # @id: The job identifier.
 #
@@ -197,7 +216,11 @@
 #
 # Deletes a job that is in the CONCLUDED state.  This command only
 # needs to be run explicitly for jobs that don't have automatic
-# dismiss enabled.
+# dismiss enabled. In turn, automatic dismiss may be enabled only
+# for jobs that have @auto-dismiss option, which are drive-backup,
+# blockdev-backup, drive-mirror, blockdev-mirror, block-commit and
+# block-stream. @auto-dismiss is enabled by default for these
+# jobs.
 #
 # This command will refuse to operate on any job that has not yet
 # reached its terminal state, JOB_STATUS_CONCLUDED.  For jobs that
@@ -222,6 +245,9 @@
 # force ALL jobs in the transaction to finalize, so it is only
 # necessary to instruct a single member job to finalize.
 #
+# The command is applicable only to jobs which have @auto-finalize option
+# and only when this option is set to false.
+#
 # @id: The identifier of any job in the transaction, or of a job that
 #     is not part of any transaction.
 #

From b836bf2ab68fbc1e253c10bee95fa36399762967 Mon Sep 17 00:00:00 2001
From: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Date: Wed, 9 Apr 2025 11:42:31 +0300
Subject: [PATCH 0575/2760] qapi/block-core: deprecate some block-job- APIs

For change, pause, resume, complete, dismiss and finalize actions
corresponding job- and block-job commands are almost equal. The
difference is in find_block_job_locked() vs find_job_locked()
functions. What's different?

1. find_block_job_locked() checks whether the found job is a block-job.
   This is OK when moving to more generic API, no needs to document this
   change.

2. find_block_job_locked() reports DeviceNotActive on failure, when
   find_job_locked() reports GenericError. So, let's document this
   difference in deprecated.txt. Still, for dismiss and finalize errors
   are not documented at all, so be silent in deprecated.txt as well.

ACKed-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Message-ID: <20250409084232.28201-3-vsementsov@yandex-team.ru>
---
 docs/about/deprecated.rst | 31 +++++++++++++++++++++++++++++++
 qapi/block-core.json      | 30 ++++++++++++++++++++++++++++++
 2 files changed, 61 insertions(+)

diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst
index 05381441a9..b0d3ae6b32 100644
--- a/docs/about/deprecated.rst
+++ b/docs/about/deprecated.rst
@@ -148,6 +148,37 @@ options are removed in favor of using explicit ``blockdev-create`` and
 ``blockdev-add`` calls. See :doc:`/interop/live-block-operations` for
 details.
 
+``block-job-pause`` (since 10.1)
+''''''''''''''''''''''''''''''''
+
+Use ``job-pause`` instead. The only difference is that ``job-pause``
+always reports GenericError on failure when ``block-job-pause`` reports
+DeviceNotActive when block-job is not found.
+
+``block-job-resume`` (since 10.1)
+'''''''''''''''''''''''''''''''''
+
+Use ``job-resume`` instead. The only difference is that ``job-resume``
+always reports GenericError on failure when ``block-job-resume`` reports
+DeviceNotActive when block-job is not found.
+
+``block-job-complete`` (since 10.1)
+'''''''''''''''''''''''''''''''''''
+
+Use ``job-complete`` instead. The only difference is that ``job-complete``
+always reports GenericError on failure when ``block-job-complete`` reports
+DeviceNotActive when block-job is not found.
+
+``block-job-dismiss`` (since 10.1)
+''''''''''''''''''''''''''''''''''
+
+Use ``job-dismiss`` instead.
+
+``block-job-finalize`` (since 10.1)
+'''''''''''''''''''''''''''''''''''
+
+Use ``job-finalize`` instead.
+
 ``query-migrationthreads`` (since 9.2)
 ''''''''''''''''''''''''''''''''''''''
 
diff --git a/qapi/block-core.json b/qapi/block-core.json
index 6beab0dc12..22061227ca 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
@@ -2969,6 +2969,11 @@
 #     the name of the parameter), but since QEMU 2.7 it can have other
 #     values.
 #
+# Features:
+#
+# @deprecated: This command is deprecated.  Use @job-pause
+#     instead.
+#
 # Errors:
 #     - If no background operation is active on this device,
 #       DeviceNotActive
@@ -2976,6 +2981,7 @@
 # Since: 1.3
 ##
 { 'command': 'block-job-pause', 'data': { 'device': 'str' },
+  'features': ['deprecated'],
   'allow-preconfig': true }
 
 ##
@@ -2992,6 +2998,11 @@
 #     the name of the parameter), but since QEMU 2.7 it can have other
 #     values.
 #
+# Features:
+#
+# @deprecated: This command is deprecated.  Use @job-resume
+#     instead.
+#
 # Errors:
 #     - If no background operation is active on this device,
 #       DeviceNotActive
@@ -2999,6 +3010,7 @@
 # Since: 1.3
 ##
 { 'command': 'block-job-resume', 'data': { 'device': 'str' },
+  'features': ['deprecated'],
   'allow-preconfig': true }
 
 ##
@@ -3026,6 +3038,11 @@
 #     the name of the parameter), but since QEMU 2.7 it can have other
 #     values.
 #
+# Features:
+#
+# @deprecated: This command is deprecated.  Use @job-complete
+#     instead.
+#
 # Errors:
 #     - If no background operation is active on this device,
 #       DeviceNotActive
@@ -3033,6 +3050,7 @@
 # Since: 1.3
 ##
 { 'command': 'block-job-complete', 'data': { 'device': 'str' },
+  'features': ['deprecated'],
   'allow-preconfig': true }
 
 ##
@@ -3053,9 +3071,15 @@
 #
 # @id: The job identifier.
 #
+# Features:
+#
+# @deprecated: This command is deprecated.  Use @job-dismiss
+#     instead.
+#
 # Since: 2.12
 ##
 { 'command': 'block-job-dismiss', 'data': { 'id': 'str' },
+  'features': ['deprecated'],
   'allow-preconfig': true }
 
 ##
@@ -3075,9 +3099,15 @@
 #
 # @id: The job identifier.
 #
+# Features:
+#
+# @deprecated: This command is deprecated.  Use @job-finalize
+#     instead.
+#
 # Since: 2.12
 ##
 { 'command': 'block-job-finalize', 'data': { 'id': 'str' },
+  'features': ['deprecated'],
   'allow-preconfig': true }
 
 ##

From e1d8fabc20adb6a766773adb4a9b5bfe93e329bb Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 30 Apr 2025 13:57:30 -0700
Subject: [PATCH 0576/2760] tcg: Define INSN_START_WORDS as constant 3

Use the same value for all targets.

Rename TARGET_INSN_START_WORDS and do not depend on
TARGET_INSN_START_EXTRA_WORDS.
Remove TCGContext.insn_start_words.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/translate-all.c      | 19 +++++++++----------
 include/tcg/insn-start-words.h | 11 +++++------
 include/tcg/tcg-op.h           | 17 ++++++++++++++---
 include/tcg/tcg-opc.h          |  3 +--
 include/tcg/tcg.h              | 12 +++++++-----
 target/i386/helper.c           |  2 +-
 target/openrisc/sys_helper.c   |  2 +-
 tcg/perf.c                     |  5 ++---
 tcg/tcg.c                      | 12 +++++-------
 9 files changed, 45 insertions(+), 38 deletions(-)

diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index 7b0bd50904..fa4998b341 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -120,7 +120,7 @@ static int64_t decode_sleb128(const uint8_t **pp)
 /* Encode the data collected about the instructions while compiling TB.
    Place the data at BLOCK, and return the number of bytes consumed.
 
-   The logical table consists of TARGET_INSN_START_WORDS target_ulong's,
+   The logical table consists of INSN_START_WORDS uint64_t's,
    which come from the target's insn_start data, followed by a uintptr_t
    which comes from the host pc of the end of the code implementing the insn.
 
@@ -140,13 +140,13 @@ static int encode_search(TranslationBlock *tb, uint8_t *block)
     for (i = 0, n = tb->icount; i < n; ++i) {
         uint64_t prev, curr;
 
-        for (j = 0; j < TARGET_INSN_START_WORDS; ++j) {
+        for (j = 0; j < INSN_START_WORDS; ++j) {
             if (i == 0) {
                 prev = (!(tb_cflags(tb) & CF_PCREL) && j == 0 ? tb->pc : 0);
             } else {
-                prev = insn_data[(i - 1) * TARGET_INSN_START_WORDS + j];
+                prev = insn_data[(i - 1) * INSN_START_WORDS + j];
             }
-            curr = insn_data[i * TARGET_INSN_START_WORDS + j];
+            curr = insn_data[i * INSN_START_WORDS + j];
             p = encode_sleb128(p, curr - prev);
         }
         prev = (i == 0 ? 0 : insn_end_off[i - 1]);
@@ -178,7 +178,7 @@ static int cpu_unwind_data_from_tb(TranslationBlock *tb, uintptr_t host_pc,
         return -1;
     }
 
-    memset(data, 0, sizeof(uint64_t) * TARGET_INSN_START_WORDS);
+    memset(data, 0, sizeof(uint64_t) * INSN_START_WORDS);
     if (!(tb_cflags(tb) & CF_PCREL)) {
         data[0] = tb->pc;
     }
@@ -188,7 +188,7 @@ static int cpu_unwind_data_from_tb(TranslationBlock *tb, uintptr_t host_pc,
      * at which the end of the insn exceeds host_pc.
      */
     for (i = 0; i < num_insns; ++i) {
-        for (j = 0; j < TARGET_INSN_START_WORDS; ++j) {
+        for (j = 0; j < INSN_START_WORDS; ++j) {
             data[j] += decode_sleb128(&p);
         }
         iter_pc += decode_sleb128(&p);
@@ -206,7 +206,7 @@ static int cpu_unwind_data_from_tb(TranslationBlock *tb, uintptr_t host_pc,
 void cpu_restore_state_from_tb(CPUState *cpu, TranslationBlock *tb,
                                uintptr_t host_pc)
 {
-    uint64_t data[TARGET_INSN_START_WORDS];
+    uint64_t data[INSN_START_WORDS];
     int insns_left = cpu_unwind_data_from_tb(tb, host_pc, data);
 
     if (insns_left < 0) {
@@ -349,7 +349,6 @@ TranslationBlock *tb_gen_code(CPUState *cpu, TCGTBCPUState s)
     tcg_ctx->page_mask = TARGET_PAGE_MASK;
     tcg_ctx->tlb_dyn_max_bits = CPU_TLB_DYN_MAX_BITS;
 #endif
-    tcg_ctx->insn_start_words = TARGET_INSN_START_WORDS;
     tcg_ctx->guest_mo = cpu->cc->tcg_ops->guest_default_memory_order;
 
  restart_translate:
@@ -457,7 +456,7 @@ TranslationBlock *tb_gen_code(CPUState *cpu, TCGTBCPUState s)
             fprintf(logfile, "OUT: [size=%d]\n", gen_code_size);
             fprintf(logfile,
                     "  -- guest addr 0x%016" PRIx64 " + tb prologue\n",
-                    tcg_ctx->gen_insn_data[insn * TARGET_INSN_START_WORDS]);
+                    tcg_ctx->gen_insn_data[insn * INSN_START_WORDS]);
             chunk_start = tcg_ctx->gen_insn_end_off[insn];
             disas(logfile, tb->tc.ptr, chunk_start);
 
@@ -470,7 +469,7 @@ TranslationBlock *tb_gen_code(CPUState *cpu, TCGTBCPUState s)
                 size_t chunk_end = tcg_ctx->gen_insn_end_off[insn];
                 if (chunk_end > chunk_start) {
                     fprintf(logfile, "  -- guest addr 0x%016" PRIx64 "\n",
-                            tcg_ctx->gen_insn_data[insn * TARGET_INSN_START_WORDS]);
+                            tcg_ctx->gen_insn_data[insn * INSN_START_WORDS]);
                     disas(logfile, tb->tc.ptr + chunk_start,
                           chunk_end - chunk_start);
                     chunk_start = chunk_end;
diff --git a/include/tcg/insn-start-words.h b/include/tcg/insn-start-words.h
index d416d19bcf..c52aec50a7 100644
--- a/include/tcg/insn-start-words.h
+++ b/include/tcg/insn-start-words.h
@@ -1,13 +1,12 @@
 /* SPDX-License-Identifier: MIT */
 /*
- * Define TARGET_INSN_START_WORDS
+ * Define INSN_START_WORDS
  * Copyright (c) 2008 Fabrice Bellard
  */
 
-#ifndef TARGET_INSN_START_WORDS
+#ifndef TCG_INSN_START_WORDS
+#define TCG_INSN_START_WORDS
 
-#include "cpu-param.h"
+#define INSN_START_WORDS 3
 
-# define TARGET_INSN_START_WORDS (1 + TARGET_INSN_START_EXTRA_WORDS)
-
-#endif /* TARGET_INSN_START_WORDS */
+#endif /* TCG_INSN_START_WORDS */
diff --git a/include/tcg/tcg-op.h b/include/tcg/tcg-op.h
index 59d19755e6..c912578fdd 100644
--- a/include/tcg/tcg-op.h
+++ b/include/tcg/tcg-op.h
@@ -9,6 +9,7 @@
 #define TCG_TCG_OP_H
 
 #include "tcg/tcg-op-common.h"
+#include "tcg/insn-start-words.h"
 #include "exec/target_long.h"
 
 #ifndef TARGET_LONG_BITS
@@ -23,24 +24,34 @@
 # error
 #endif
 
+#if INSN_START_WORDS != 3
+# error Mismatch with insn-start-words.h
+#endif
+
 #if TARGET_INSN_START_EXTRA_WORDS == 0
 static inline void tcg_gen_insn_start(target_ulong pc)
 {
-    TCGOp *op = tcg_emit_op(INDEX_op_insn_start, 64 / TCG_TARGET_REG_BITS);
+    TCGOp *op = tcg_emit_op(INDEX_op_insn_start,
+                            INSN_START_WORDS * 64 / TCG_TARGET_REG_BITS);
     tcg_set_insn_start_param(op, 0, pc);
+    tcg_set_insn_start_param(op, 1, 0);
+    tcg_set_insn_start_param(op, 2, 0);
 }
 #elif TARGET_INSN_START_EXTRA_WORDS == 1
 static inline void tcg_gen_insn_start(target_ulong pc, target_ulong a1)
 {
-    TCGOp *op = tcg_emit_op(INDEX_op_insn_start, 2 * 64 / TCG_TARGET_REG_BITS);
+    TCGOp *op = tcg_emit_op(INDEX_op_insn_start,
+                            INSN_START_WORDS * 64 / TCG_TARGET_REG_BITS);
     tcg_set_insn_start_param(op, 0, pc);
     tcg_set_insn_start_param(op, 1, a1);
+    tcg_set_insn_start_param(op, 2, 0);
 }
 #elif TARGET_INSN_START_EXTRA_WORDS == 2
 static inline void tcg_gen_insn_start(target_ulong pc, target_ulong a1,
                                       target_ulong a2)
 {
-    TCGOp *op = tcg_emit_op(INDEX_op_insn_start, 3 * 64 / TCG_TARGET_REG_BITS);
+    TCGOp *op = tcg_emit_op(INDEX_op_insn_start,
+                            INSN_START_WORDS * 64 / TCG_TARGET_REG_BITS);
     tcg_set_insn_start_param(op, 0, pc);
     tcg_set_insn_start_param(op, 1, a1);
     tcg_set_insn_start_param(op, 2, a2);
diff --git a/include/tcg/tcg-opc.h b/include/tcg/tcg-opc.h
index 995b79383e..e988edd93a 100644
--- a/include/tcg/tcg-opc.h
+++ b/include/tcg/tcg-opc.h
@@ -114,8 +114,7 @@ DEF(extrh_i64_i32, 1, 1, 0, 0)
 
 #define DATA64_ARGS  (TCG_TARGET_REG_BITS == 64 ? 1 : 2)
 
-/* There are tcg_ctx->insn_start_words here, not just one. */
-DEF(insn_start, 0, 0, DATA64_ARGS, TCG_OPF_NOT_PRESENT)
+DEF(insn_start, 0, 0, DATA64_ARGS * INSN_START_WORDS, TCG_OPF_NOT_PRESENT)
 
 DEF(exit_tb, 0, 0, 1, TCG_OPF_BB_EXIT | TCG_OPF_BB_END | TCG_OPF_NOT_PRESENT)
 DEF(goto_tb, 0, 0, 1, TCG_OPF_BB_EXIT | TCG_OPF_BB_END | TCG_OPF_NOT_PRESENT)
diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
index aa300a2f8b..a8c00c72cc 100644
--- a/include/tcg/tcg.h
+++ b/include/tcg/tcg.h
@@ -34,6 +34,7 @@
 #include "tcg-target-reg-bits.h"
 #include "tcg-target.h"
 #include "tcg/tcg-cond.h"
+#include "tcg/insn-start-words.h"
 #include "tcg/debug-assert.h"
 
 /* XXX: make safe guess about sizes */
@@ -359,7 +360,6 @@ struct TCGContext {
     int page_mask;
     uint8_t page_bits;
     uint8_t tlb_dyn_max_bits;
-    uint8_t insn_start_words;
     TCGBar guest_mo;
 
     TCGRegSet reserved_regs;
@@ -582,18 +582,19 @@ static inline TCGv_vec temp_tcgv_vec(TCGTemp *t)
     return (TCGv_vec)temp_tcgv_i32(t);
 }
 
-static inline TCGArg tcg_get_insn_param(TCGOp *op, int arg)
+static inline TCGArg tcg_get_insn_param(TCGOp *op, unsigned arg)
 {
     return op->args[arg];
 }
 
-static inline void tcg_set_insn_param(TCGOp *op, int arg, TCGArg v)
+static inline void tcg_set_insn_param(TCGOp *op, unsigned arg, TCGArg v)
 {
     op->args[arg] = v;
 }
 
-static inline uint64_t tcg_get_insn_start_param(TCGOp *op, int arg)
+static inline uint64_t tcg_get_insn_start_param(TCGOp *op, unsigned arg)
 {
+    tcg_debug_assert(arg < INSN_START_WORDS);
     if (TCG_TARGET_REG_BITS == 64) {
         return tcg_get_insn_param(op, arg);
     } else {
@@ -602,8 +603,9 @@ static inline uint64_t tcg_get_insn_start_param(TCGOp *op, int arg)
     }
 }
 
-static inline void tcg_set_insn_start_param(TCGOp *op, int arg, uint64_t v)
+static inline void tcg_set_insn_start_param(TCGOp *op, unsigned arg, uint64_t v)
 {
+    tcg_debug_assert(arg < INSN_START_WORDS);
     if (TCG_TARGET_REG_BITS == 64) {
         tcg_set_insn_param(op, arg, v);
     } else {
diff --git a/target/i386/helper.c b/target/i386/helper.c
index 197fdac7dd..e0aaed3c4c 100644
--- a/target/i386/helper.c
+++ b/target/i386/helper.c
@@ -526,7 +526,7 @@ void cpu_x86_inject_mce(Monitor *mon, X86CPU *cpu, int bank,
 static inline target_ulong get_memio_eip(CPUX86State *env)
 {
 #ifdef CONFIG_TCG
-    uint64_t data[TARGET_INSN_START_WORDS];
+    uint64_t data[INSN_START_WORDS];
     CPUState *cs = env_cpu(env);
 
     if (!cpu_unwind_state_data(cs, cs->mem_io_pc, data)) {
diff --git a/target/openrisc/sys_helper.c b/target/openrisc/sys_helper.c
index 951f8e247a..d96b41a01c 100644
--- a/target/openrisc/sys_helper.c
+++ b/target/openrisc/sys_helper.c
@@ -218,7 +218,7 @@ target_ulong HELPER(mfspr)(CPUOpenRISCState *env, target_ulong rd,
 {
     OpenRISCCPU *cpu = env_archcpu(env);
 #ifndef CONFIG_USER_ONLY
-    uint64_t data[TARGET_INSN_START_WORDS];
+    uint64_t data[INSN_START_WORDS];
     MachineState *ms = MACHINE(qdev_get_machine());
     CPUState *cs = env_cpu(env);
     int idx;
diff --git a/tcg/perf.c b/tcg/perf.c
index 412a987d95..4e8d2c1bee 100644
--- a/tcg/perf.c
+++ b/tcg/perf.c
@@ -313,7 +313,7 @@ void perf_report_code(uint64_t guest_pc, TranslationBlock *tb,
                       const void *start)
 {
     struct debuginfo_query *q;
-    size_t insn, start_words;
+    size_t insn;
     uint64_t *gen_insn_data;
 
     if (!perfmap && !jitdump) {
@@ -329,11 +329,10 @@ void perf_report_code(uint64_t guest_pc, TranslationBlock *tb,
 
     /* Query debuginfo for each guest instruction. */
     gen_insn_data = tcg_ctx->gen_insn_data;
-    start_words = tcg_ctx->insn_start_words;
 
     for (insn = 0; insn < tb->icount; insn++) {
         /* FIXME: This replicates the restore_state_to_opc() logic. */
-        q[insn].address = gen_insn_data[insn * start_words + 0];
+        q[insn].address = gen_insn_data[insn * INSN_START_WORDS + 0];
         if (tb_cflags(tb) & CF_PCREL) {
             q[insn].address |= (guest_pc & qemu_target_page_mask());
         }
diff --git a/tcg/tcg.c b/tcg/tcg.c
index c4e866e9c3..648333a9fb 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1989,7 +1989,6 @@ void tcg_func_start(TCGContext *s)
     QSIMPLEQ_INIT(&s->labels);
 
     tcg_debug_assert(s->addr_type <= TCG_TYPE_REG);
-    tcg_debug_assert(s->insn_start_words > 0);
 }
 
 static TCGTemp *tcg_temp_alloc(TCGContext *s)
@@ -2943,7 +2942,7 @@ void tcg_dump_ops(TCGContext *s, FILE *f, bool have_prefs)
             nb_oargs = 0;
             col += ne_fprintf(f, "\n ----");
 
-            for (i = 0, k = s->insn_start_words; i < k; ++i) {
+            for (i = 0, k = INSN_START_WORDS; i < k; ++i) {
                 col += ne_fprintf(f, " %016" PRIx64,
                                   tcg_get_insn_start_param(op, i));
             }
@@ -6835,7 +6834,7 @@ static void tcg_out_st_helper_args(TCGContext *s, const TCGLabelQemuLdst *ldst,
 
 int tcg_gen_code(TCGContext *s, TranslationBlock *tb, uint64_t pc_start)
 {
-    int i, start_words, num_insns;
+    int i, num_insns;
     TCGOp *op;
 
     if (unlikely(qemu_loglevel_mask(CPU_LOG_TB_OP)
@@ -6925,9 +6924,8 @@ int tcg_gen_code(TCGContext *s, TranslationBlock *tb, uint64_t pc_start)
     QSIMPLEQ_INIT(&s->ldst_labels);
     s->pool_labels = NULL;
 
-    start_words = s->insn_start_words;
     s->gen_insn_data =
-        tcg_malloc(sizeof(uint64_t) * s->gen_tb->icount * start_words);
+        tcg_malloc(sizeof(uint64_t) * s->gen_tb->icount * INSN_START_WORDS);
 
     tcg_out_tb_start(s);
 
@@ -6969,8 +6967,8 @@ int tcg_gen_code(TCGContext *s, TranslationBlock *tb, uint64_t pc_start)
                 assert(s->gen_insn_end_off[num_insns] == off);
             }
             num_insns++;
-            for (i = 0; i < start_words; ++i) {
-                s->gen_insn_data[num_insns * start_words + i] =
+            for (i = 0; i < INSN_START_WORDS; ++i) {
+                s->gen_insn_data[num_insns * INSN_START_WORDS + i] =
                     tcg_get_insn_start_param(op, i);
             }
             break;

From 9401f91b9b0c46886388735b3f2033a9c254895a Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 30 Apr 2025 14:35:47 -0700
Subject: [PATCH 0577/2760] accel/tcg: Don't use TARGET_LONG_BITS in
 decode_sleb128
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When we changed decode_sleb128 from target_long to
int64_t, we failed to adjust the shift limit.

Cc: qemu-stable@nongnu.org
Fixes: c9ad8d27caa ("tcg: Widen gen_insn_data to uint64_t")
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/translate-all.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index fa4998b341..acf32e6c08 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -109,7 +109,7 @@ static int64_t decode_sleb128(const uint8_t **pp)
         val |= (int64_t)(byte & 0x7f) << shift;
         shift += 7;
     } while (byte & 0x80);
-    if (shift < TARGET_LONG_BITS && (byte & 0x40)) {
+    if (shift < 64 && (byte & 0x40)) {
         val |= -(int64_t)1 << shift;
     }
 

From d2bbc0d6b90cd82b3cecb2d57bb317ba982a30a3 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 30 Apr 2025 14:40:30 -0700
Subject: [PATCH 0578/2760] accel/tcg: Use target_long_bits() in
 translate-all.c

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/translate-all.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index acf32e6c08..6b6e10be9d 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -54,6 +54,7 @@
 #include "qemu/qemu-print.h"
 #include "qemu/main-loop.h"
 #include "qemu/cacheinfo.h"
+#include "qemu/target-info.h"
 #include "qemu/timer.h"
 #include "exec/log.h"
 #include "exec/icount.h"
@@ -343,7 +344,7 @@ TranslationBlock *tb_gen_code(CPUState *cpu, TCGTBCPUState s)
     }
 
     tcg_ctx->gen_tb = tb;
-    tcg_ctx->addr_type = TARGET_LONG_BITS == 32 ? TCG_TYPE_I32 : TCG_TYPE_I64;
+    tcg_ctx->addr_type = target_long_bits() == 32 ? TCG_TYPE_I32 : TCG_TYPE_I64;
 #ifdef CONFIG_SOFTMMU
     tcg_ctx->page_bits = TARGET_PAGE_BITS;
     tcg_ctx->page_mask = TARGET_PAGE_MASK;

From b5dee28732209eaf93656807810c9c5340e907e1 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 30 Apr 2025 15:10:46 -0700
Subject: [PATCH 0579/2760] accel/tcg: Build translate-all.c twice

Remove lots and lots of unused headers.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/meson.build     |  2 +-
 accel/tcg/translate-all.c | 32 --------------------------------
 2 files changed, 1 insertion(+), 33 deletions(-)

diff --git a/accel/tcg/meson.build b/accel/tcg/meson.build
index 0bb089299b..7eb4619aea 100644
--- a/accel/tcg/meson.build
+++ b/accel/tcg/meson.build
@@ -10,6 +10,7 @@ tcg_ss.add(files(
   'tcg-runtime.c',
   'tcg-runtime-gvec.c',
   'tb-maint.c',
+  'translate-all.c',
   'translator.c',
 ))
 if get_option('plugins')
@@ -22,7 +23,6 @@ libsystem_ss.add_all(tcg_ss)
 tcg_specific_ss = ss.source_set()
 tcg_specific_ss.add(files(
   'tcg-all.c',
-  'translate-all.c',
 ))
 tcg_specific_ss.add(when: 'CONFIG_USER_ONLY', if_true: files('user-exec.c'))
 specific_ss.add_all(when: 'CONFIG_TCG', if_true: tcg_specific_ss)
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index 6b6e10be9d..451b383aa8 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -22,46 +22,15 @@
 #include "trace.h"
 #include "disas/disas.h"
 #include "tcg/tcg.h"
-#if defined(CONFIG_USER_ONLY)
-#include "qemu.h"
-#if defined(__FreeBSD__) || defined(__FreeBSD_kernel__)
-#include <sys/param.h>
-#if __FreeBSD_version >= 700104
-#define HAVE_KINFO_GETVMMAP
-#define sigqueue sigqueue_freebsd  /* avoid redefinition */
-#include <sys/proc.h>
-#include <machine/profile.h>
-#define _KERNEL
-#include <sys/user.h>
-#undef _KERNEL
-#undef sigqueue
-#include <libutil.h>
-#endif
-#endif
-#else
-#include "system/ram_addr.h"
-#endif
-
-#include "cpu-param.h"
-#include "exec/cputlb.h"
-#include "exec/page-protection.h"
 #include "exec/mmap-lock.h"
 #include "tb-internal.h"
 #include "tlb-bounds.h"
-#include "exec/translator.h"
 #include "exec/tb-flush.h"
-#include "qemu/bitmap.h"
-#include "qemu/qemu-print.h"
-#include "qemu/main-loop.h"
 #include "qemu/cacheinfo.h"
 #include "qemu/target-info.h"
-#include "qemu/timer.h"
 #include "exec/log.h"
 #include "exec/icount.h"
-#include "system/tcg.h"
-#include "qapi/error.h"
 #include "accel/tcg/cpu-ops.h"
-#include "accel/tcg/getpc.h"
 #include "tb-jmp-cache.h"
 #include "tb-hash.h"
 #include "tb-context.h"
@@ -69,7 +38,6 @@
 #include "internal-common.h"
 #include "tcg/perf.h"
 #include "tcg/insn-start-words.h"
-#include "cpu.h"
 
 TBContext tb_ctx;
 

From 97f0d52435ec9da8fd58dc73b6765181fcb25965 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 30 Apr 2025 15:25:29 -0700
Subject: [PATCH 0580/2760] accel/tcg: Build tcg-all.c twice

Remove some unused headers.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/meson.build | 4 +---
 accel/tcg/tcg-all.c   | 6 +-----
 2 files changed, 2 insertions(+), 8 deletions(-)

diff --git a/accel/tcg/meson.build b/accel/tcg/meson.build
index 7eb4619aea..d6bd304add 100644
--- a/accel/tcg/meson.build
+++ b/accel/tcg/meson.build
@@ -10,6 +10,7 @@ tcg_ss.add(files(
   'tcg-runtime.c',
   'tcg-runtime-gvec.c',
   'tb-maint.c',
+  'tcg-all.c',
   'translate-all.c',
   'translator.c',
 ))
@@ -21,9 +22,6 @@ libuser_ss.add_all(tcg_ss)
 libsystem_ss.add_all(tcg_ss)
 
 tcg_specific_ss = ss.source_set()
-tcg_specific_ss.add(files(
-  'tcg-all.c',
-))
 tcg_specific_ss.add(when: 'CONFIG_USER_ONLY', if_true: files('user-exec.c'))
 specific_ss.add_all(when: 'CONFIG_TCG', if_true: tcg_specific_ss)
 
diff --git a/accel/tcg/tcg-all.c b/accel/tcg/tcg-all.c
index 0ce34ac912..6e5dc333d5 100644
--- a/accel/tcg/tcg-all.c
+++ b/accel/tcg/tcg-all.c
@@ -36,15 +36,11 @@
 #include "qapi/qapi-builtin-visit.h"
 #include "qemu/units.h"
 #include "qemu/target-info.h"
-#if defined(CONFIG_USER_ONLY)
-#include "hw/qdev-core.h"
-#else
+#ifndef CONFIG_USER_ONLY
 #include "hw/boards.h"
-#include "system/tcg.h"
 #endif
 #include "accel/tcg/cpu-ops.h"
 #include "internal-common.h"
-#include "cpu-param.h"
 
 
 struct TCGState {

From e578dcc7e1590b20a84036afe5bdfa8d23a6048e Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Tue, 29 Apr 2025 14:28:20 +0800
Subject: [PATCH 0581/2760] pc-bios: Add AST27x0 vBootrom
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The boot ROM is a minimal implementation designed to load an AST27x0 boot image.
Its source code is available at:
https://github.com/google/vbootrom
Commit id: d6e3386709b3e49322a94ffadc2aaab9944ab77b
Build Information:
```
Build Date : Apr 29 2025 01:23:18
FW Version : git-d6e3386
```

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Nabih Estefan <nabihestefan@google.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Tested-by: Nabih Estefan <nabihestefan@google.com>
Link: https://lore.kernel.org/qemu-devel/20250429062822.1184920-2-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 MAINTAINERS                 |   1 +
 pc-bios/README              |   6 ++++++
 pc-bios/ast27x0_bootrom.bin | Bin 0 -> 15552 bytes
 pc-bios/meson.build         |   1 +
 4 files changed, 8 insertions(+)
 create mode 100644 pc-bios/ast27x0_bootrom.bin

diff --git a/MAINTAINERS b/MAINTAINERS
index b3f9f2680b..cc94e62be4 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1174,6 +1174,7 @@ F: docs/system/arm/fby35.rst
 F: tests/*/*aspeed*
 F: tests/*/*ast2700*
 F: hw/arm/fby35.c
+F: pc-bios/ast27x0_bootrom.bin
 
 NRF51
 M: Joel Stanley <joel@jms.id.au>
diff --git a/pc-bios/README b/pc-bios/README
index f0f13e15f2..d009c37895 100644
--- a/pc-bios/README
+++ b/pc-bios/README
@@ -89,6 +89,12 @@
   more features over time as needed. The source code is available at:
   https://github.com/google/vbootrom
 
+- ast27x0_bootrom.bin is a simplified, free (Apache 2.0) boot ROM for
+  ASPEED AST27x0 BMC SOC. It currently implements the bare minimum to
+  load, parse, initialize and run boot images stored in SPI flash, but may grow
+  more features over time as needed. The source code is available at:
+  https://github.com/google/vbootrom
+
 - hppa-firmware.img (32-bit) and hppa-firmware64.img (64-bit) are firmware
   files for the HP-PARISC (hppa) architecture.
   They are built form the SeaBIOS-hppa sources, which is a fork of SeaBIOS
diff --git a/pc-bios/ast27x0_bootrom.bin b/pc-bios/ast27x0_bootrom.bin
new file mode 100644
index 0000000000000000000000000000000000000000..0b9b3a2360e375bb6007ecdf13b39d931870f6fa
GIT binary patch
literal 15552
zcmZ=_U=U$vU=ZP8U=ZPCU=ZPAU=U$oU|;~z+zbpN3JeXG%o!L&92godnKCelBrr5w
zGG<^9X<%r$WXQlEa)6=Xl0E~2$ODFkOS(|KApJuH*DEkz{r~^JI0Hk&rG*R@R~1<t
zCOI-PY++($h;U|b_?gVWur*$R`Rbql|HbFqGhe-L&wMq3LH^pO|Nq4meHkO17#3V|
za$vY<pP<yen3*Bs2s1;(Q)Y&U`3$VDS1~Yzq`5fkXk%d5*&@I&@%R7#;x5b#5vfS>
zYzz%S$nstc3{#XC86q4Q7=F&TW4=0Hf%z)TUIqsFYgfQ-WnfTXU=RR>@d6tV3C3VP
zOdLi#K-JkRGhh8%y=Ns8L&K%N%nTDh2Q#kx8qKuwD>K8YZ_JEZS6LaR9AIMDD$Kxe
zp?Hz@L=gst3sX*MPkj8DVd5iZkyQ_w#k3wUi>}gUXP9z;kzp$X1H%P|JK9h=;Z@m;
z3{ya1_&L~d<=1GZm4B;`tk|#2eDwfx{I$=_46EM!|1bX7-eG6G07GFT149S{gTqb+
zjssC&{{I)RS70bS$iNW7$l;)=z;PhTk>fy=LIcC9xBvf(L+ln_1-36hXJQ~D!<1+L
z|BFNXvvVawLi?qJ8H+w4`{{c!^U9yuEGvI&GyIeVyNhE20|UcEF(!s7j0_AH6jgL5
zg3aqNnP|(%FolVM;eyi?lZjxt9VQUD7bX+U7@_JdOd(<!rV|ap<}qAgXfT<m$H*{6
ziQ&Md5Qcz>pP89fJz!>9<-p7^#es>zG>Oe&C)kcPrV}4B3$JqGI1r`8$S_5mf#JgU
zGV_TKnZ;K<U>07rhMi%`LuLjo2c{opVD(eXCrU6fOwnOr5J_@!m>AC>@>=ol{}4xp
zfQ!lu3oe1xRG3ZVhq<H0WTG%b!zI7}|EItF|6d$rrYHl$g{_~=C+f2>O!>mhpf!a7
zYW5qei6AwgH1LpFL<^)goE2oh=&Enb468($Kx`4M1q=)(AUQp#{tr-d^Z);!4oWW$
zu=wY&nD~%cY}FeEP~0<IU}!O!D8bNhN&El*>1GTJB9E9EK<Ne&cO@1RA2BdYdAyl%
zBFt`ZxZkmuIE{^A$`59SRSgUbTOQ>*?2Kn%C|m<hBMcW9K0xev{{O$Y2!rtHMTeBS
zL3V<}!NzjpSq6qFAU%&EX%u4D7R!mpq2dp!9X9P}VtD<9J8{z%CXwzbO;cx~sCBWL
zxCgAZVdq0;iB%7nMOMW!LH%>ZYT{M~hABVt8+J-Ci>`j~<9`S&-t3_9*1!l2+bQM~
zSHZ%;#&+Uz7`w$}qBujtrDy;CPY0E!pm3F9V7L(V*?gij1H*;t`xX<AGBZs1%FLhz
zQumedhuQbP|F?kb0sB$JZsHUMhAE(Y^?+G?6)10gPj+7UGuvh5Z*7O4f2)tf^BE*w
zMZxj<kOdT%Qs8)<&&V+40V9J6DC{3GORsv!3{hjj#xUh4G~6HLJM5HaU?}uq1m#VJ
z3k)IF;J7Vi0GR_(zY6Nk>;M0Y!_0W~@Bj2K%nYj*urO>vkMA@FhAE)%pU=ebI+KAR
z<N<f$rYTGe-4B?>R)O={66=W-j0{si_I?+dG7A)s%FM#2;qkl0a$+brZX9-^$C*D^
z9294g;5hpL%MVwqCVDV1Ou793zc|>AE!Go3_Qf$WOj*FlU^;`5VGGDj^30GlA;Jtw
z6EkK#VwOOp)g#su%^4V`+<}y}7Z`eMz+tiX|9|m#73Qmq3>*^_MI3%I$S?>g2QW-b
zVsO~`=)b<10t3TNP<aPaqaecYlaa?^rxJst5fcx?P9=thASMQeosR??gcKQ=xa3(F
zb}F(k7%}oN?0hKD5X8vAu#<tIAqZp!q<q`A5>~E>FmOz0lydmFkda}FundDxy%s}Z
zA_GIn0>*|Q1qS<TAh`$3!djqo@`0Ig)!*tv;B>*jB!3Mg2IC{l-U2rpR6ajoW}XPH
z50n`vK44~B`GA>eq6kAnP#9ywB~W?#z?$Lb1GWaC2h|Ka|JO6@eAvyg^6_NOl}~4L
zt$ZHO@H2tQ!IFWI!4#A}A25r6-2qCcf2+@c-2t*!ehNdOqZmU-0-J-S`~il-1ZIYi
zVm5|}ObiV{ApP<i7z-D&K;<_u79N1gvoJISDMQsT{QYkte}=K}04qaC2Qxzm$jk-8
z3?cFp7z-EhF@!8&X$ac*|NnH5c~iI;1lRrlKiz<VL8O=qVvjQ;#4d&d41tU?3_|uQ
z422qh{)ad*FiV5n^7H?HagbUShK3+!hK8WW|No1F?Em}!zqtGZ#zMxw|3e-aJN$fD
z?XdF*3xi1`>ko5A8-|IBA8IE(G-mk8$l&nve=?(`Jp;o>2M&iSMoxwh2DXNvp8x-+
z^D!`pfb@a%FJwg3C(hvTlaZm}(swq7ixw;l6CY$%SR^nqm`-70<OaEG#sB}}N(u~u
zkE$8K<)hBO{~-^|9ey$#Q0)Hr|G#+2|NqlL<rj#Z{QJKt*nAxnckR6O|G&7h0)yb=
zYKEQlpuGMIVa6piIdt<CcpN4v{&Bh7kda`KkfCbvfSGj_$d9Zn3>R4>9IAN!{|{lP
zahS}))DXnV))3Ulz~CLvz?hv2s@GW<E`t10en6r7ftZ6u!_WUF9{>MO2ZbpM1H*-u
z8+H>PD>F`HU~0JZ8eG>fu1d{Nw0Qsjzc?(s5}ALPGa~s%oS|XocIF@37O*x1ng0Jj
z{Q<N1X;Anvb6lJCotbe}QiIrRrvnUvN*SgWpmIqO6sF9~tKwA{KEC+(KjeFz!{h~7
z<rbjuR{j5f`hPYC!^Z#rLzbe2bIu<`7=h9Ps0;?RKc=uT2#WvzKYb>&OkiMS*a9jS
zlq4K}E@A++j~sp~NHF|_<!1$khM<2?wV-lZIU~s;nSsGnK10a@lsA|&lq{TB7$*LL
zw{7;VWQMiXxEX$e@@PE+)9VBVh7g5}WD5sI2Gay4=58kjW{|&wc7n=UX5m$zxj}UT
zB=3XFO~_KVNM>P}2uc^Aa!FB!L5PXL!4ecV4Gat+O$-dC_6!V#3=H#Ufz&gwFiiXb
zbtgzIDC|J(I%ft4%X$XJYzBd*Ss-^d|Nn0aQV%loAv41&B?bq}BnAdk1qO!GAaPK5
zgW9_wd60jZGm<P+GLkIn8CbGG<rc_{<p2Lo6Bt;$LFz&3K>m$qV1E68ks*XNBiTYF
zBiUj;11ng4DhtEJCkzaxV0lp6AS2mAF(cW6fq@aM|1mS`Dv%#R;SFl5gUox(%&_Vi
zGvlhKpmrGp!&XpxK9Rw}@*y*W=@Vw=RUrEwFf*@O!octo<c35R2TM>`H8O$PKWwYE
zfXb2o|F?qFHiGnl+eK`vKxIlJ3&TWEoX=-quzUh8Zx5~jnFVU|!psASgZc>|{UE!(
z!{c^8xa<YBX+Y)tW3c}HE1xhktOAwytHF7h8Pp!?2IcF&)gZH3R)Ne0xf7)4Z#6>w
zQ)b3h&zPB3&Hev>dIJMPH^{F049wuPvM?jr;vhJkDO)^XW?2O?3uX>u1|)5Kg~oRi
zBf}OaP=01;xWt^1VxgLmViC{4@*0#*T38q+)-$kXJN*A2lEA<U4s%dg!_qV}1LJ8>
z`fOrk2mzS^O5dO~z3Bh{tspmp;*tewA1Dq%dF|K#|KcFG!r}|W2FW=xFodA%0jY)f
zd*4b>x&(#OXK23o1<wDNX&;sbltBGC2BvP1K2RK`h&WixXJE_*`3vOcL{Qnq&~OQ4
zCrA%G&1WQl@~DYC1LJF$n?U&k<Q7=}1*8Y!uKg=P`atet5CG?)>G2#6pBPyfLO|{N
z#dqfiEoR(R1nMJv{QrNtJOgufA|peHLjc3Xw;(<XL*YsWh7gAY22dM)y1WZRp(i6l
zhyr7S5Dx=`h_g~dkn_K#MIe0(LHZ^zOuP?@Z$<`_2j%ic_6!W!4;UJR6ecuCA;+-;
zQ-csFd>I%Ugh1{-z|bHB%ir=W427JG3?cFy4229J+JT|4k)`1h18c)2hK5FPdC<Vz
za0wL03@i<oK<2>w$`HUX5#-l>pmMzWAh?bPmEEB5ljm^w^pJxg1f~`iE(`C@4_e5$
zs|Zv-%QG-$Gjc%uzxMzC>5rKiv_S4z$qosF6`(M2VJOsKX9%fhV90*V#t;Guy9fXO
zPY2}_2LXnO^TGLqL2JH)!s`=^ptjHta|Z{8i8KHIpAHI-CIyEo4n~HMdIyF=2L*<S
zFBlj?CLzh4WMl{dg_$G+g9xa8o)5BznL$fof<u+_|NkKl6Bs78{r^8bnSnw3(7*p7
z_6*F~&Hw&~I2bTYZ213wI<or1fB%O#G%!r8f~t4=3sDa;pTS^0Mx21s4J=MTaSVzR
zSa^ZTEl}7pC@@S+gZNjAfq_x`srh^<M#dlJPZ=0YSs9qL7cnq|BnU7}jQ#(A`hEt6
zY)~5;R91u983_Rl6T?Aa=)h3;l7S&aiGfL536ysyFiZ^m|9^Ts14H(TfB!=iYaAx4
zIH+_dFtBtZryEc_zF=lr1#{CQh6W*!o0u3Gc0OljSoM;bQLBleA?Wh||I-zi7`A}&
zgCk>u5F;bQPBlRWLB@myL0lXMqCoN7z`_s`&&yEQ!N?H8sIVXiBz6GAc7U)Gm>5E|
z7#o5>_CH|e(t?*y4N!TIT7`u{pmORVGn*Eu9sPirebq4rChpB3`~Uq1*>9=v|G()W
z22SsX%$!;v`8EIlPj~qHf6Fl*2Ek(`azbn%w}aXg%xqwJkoy;d^#A$4g_*%&Cnz5!
za~z0DWMI=)GH|HM`29cRK>))<H3bGi7EoB)Fcfn9{U1^<!%%qg&;O9a49wp391fon
z{`?P7Ghh&W2ru6u?e>TA3_BMx{4h%Zg&nj#4vP0j%#2#`EDoO>|NjqpRLn4ODadRV
zhQfoOHl4h~PLMw#;ZB-4lR@V2U^nM2v~Kw?&#?0iGt;Vt3_r}Tg33*KhMljO8MGLf
zewe?Oci0JX&jV)ORS%iDwdz6UaWE7v0F@0Y422F%3?ZOA3UX%;1H+aEMu(jYEDVAT
zj0`&;Fmr1m_c7M|{lBG=(E-%I32bC!*s1vUzZuB<Z~y;`gXq%?Kg{YC84Ml&{STSX
z$nY^+aDEi1y~oYaAOsrsLH0k$O(1ul1-X~uhxtQ!hn@B;;5JJXvYiYJkg^V@_Z`&F
zptjcoc?PK8_*U(PmKzR?Kg=J<L;AgM86bXp2#Nz{Mijp=GBgN*+A<Jx_k!zg(D<22
zjl<+Ahm=oGVPm)mYM+TPh;)PdP|QrL%4!@Y*E5N{=450D0gcZ<`bEO4AbqjJ;PMiZ
z7Q{gPaqw7>{J;Ox6Brmw6SB%I8vgw^0k!)<VFJpFi<o|xL+nS?`_Q(HR>Hsk(?Nb|
z5MY=X^$%3Hux4j4GK4&0X3%=b%(ChMGutZhfB&b0>T6IQgXJ#=h6W*!8$dLuZUE(B
z(3l)Z3}zRs>}GI))M=n{S|LX!IF*4x8&ubW%HdDYGOERa;bP(i#cl@%#_stJs;?Oo
z=FdX54^%cG>JUUYg2oR%Gc#&E+ROkNE7Jmv!8`!@gNLE;0RuzGXMKmA@+u64ilDNb
ziJ{Peu|cSKQ-c(&zx%fu5uWk_421{&{s)CQxSnI+IdBW)A5?!K>;}c#7iOkaUxgWd
zn$|c>Rsxk7j6cjmK<S%_VJA55gdKi@#%<8!E<uT5BB=aX;H1!9%*4=r<=_7;32Y8K
zpMvUTCWf7$wjU%M5%z)YLK=7d`1k*GP&_?g`(eJo2vVmBGl+4=GYDs|WMc?%VG#BP
zjl06?&guXEPj_Mv_6C)qiOdWk(^!9)F9>3oI1!Xr9U%4jf+mKEz5oADzt6;w-NeEW
z!ptD%4Qh8MO=ywY>}1>x@(UwFL(q=D|EC{dX4q1~04l$QPd6|z?8KE$9hDk_9Kr1m
zMsU03A+wnGHpU-jAiIh{b~7+$D>E{LfZA0r|NIY8s&Sb7^#6bHCdLM#FASh@<%Ub3
zvBxB69tG7WpfuOS#IO_8=LV&5P(NV{ybMJRv(L=Ts~~v`GG4v-@Birw7=M_<#-&3b
zd3x0XMvz||el|hk;HLtM!%t8-mcRt*i-F=0<VWN*11g_EZUMOgRJVcR3^XneYGZ@y
zJW!njs!y!{|DS$<fnn=2aCr`Dle59=Dh3vZpQ)g<^Z);rV=N4UpK<sD<_A#St^yh-
zt#O$AnVA7Rwx0L*|MUiCgr9Ojd6xNy`DG{L?#)cX-Jp0b7Gjtv1`2N*hQbq|F*Ro4
zRS#Jkf~NfWKfM7oHpIdJ8ZX=eisP9eF+6b!%10&8xB>M|K=BXilY{*Kw|Y0coCD=g
zh`X6qePd?U0*wcKXJ*uL`ul%6$n6S@Kg>Tfi)-DebC~?!n_=ezZ-<?X48mHDj6cjk
zV|&Gm=0}0T9F|`p<3dN_Wgw_ddC0^N^2iu8HY^Oz|DZPFcV>oFpti+Be}|p-nHaOr
zfXg({IGyOKD}O*`9)s!ktO^VBzyD1@<9DEZ!pPAO#Pk<jj&A+W#8~L?2Q+3Ytn~;y
zt|hX{<{!k(pfOB{KatZJ!z$P~KBzqS%FL+c@duPYg;#;fJ<yovS8!P%f>Mqn(k!ID
zhV@JS{{27w0jRzL$1iICWdFba;^=*Kh<i}Y_=m@gbvVt~1&%w=97t7-!{ndLOshck
z6(|lt<NRNlSyn;fP-@i=X4X{~|3kv0f#HXlC@aHO5r&3KV&L(6(NzzbLGdBBY7=yv
z7gSy_aDdtgj1yP?1C2R>(yrL5WB(xSz=!b;JO48=W*-E{mDH+-%#y1zp>ef?kzp$&
z9YDellny}S*ng{!!P5fFzP<ndPrv>Dzql|n!%k3Mn#|ZBbo2jz@y$#OJ8!`A*8Y|7
zwsHW&!~js80cxW$GK3^CFl+&}s~s2^c7p04P~8Ko_dtA5KM=&P`3IXz+Q0G{w7mf8
z+t?zRl>#-Z0jF7Pt5_KtE`iKj0CyXXbQR6C@*AiuV`kLa_#4!h5d){KN1%MnEUJYZ
zKCm(h;a`ZEPd776gr%_-Xt{TQkzq?h5W_@%sJmZ)`ZoFvI~fcZCW8873820ti^EPk
zkh~0}PoU@kG6z(*fyRpwb*Q2N@;DT7Il!oeNJGr4zDqOw{Laj@>Jc;ZDy@J2r-R%8
zs!z*7{Q*!KF=m{ogp@`=VfuiH;b#IP!`4y;hAj{L9d<5Y0*`rLf|bkPr9tCYh_c~8
z5W~b<fB#RHw_zysU}OlHBE&FpK9|EMP`dzB*K$Gq1M2%EI5A9o_y50mf)T?+(0n5#
zKS9C_l>WakBjs<Tc<?7O9_Ay(EfWL71}77Ha3A<FC_aK2SAzWh1=NlK)jbRhTOR5=
z?6enPC<KK)SiOw>M37q8{MQXo--8jM?jWeG6YRJW)DDBi{iVPE#X(^MX}clf2-9zj
z;QA4izl9kZghUw{f?#<GRImQ~1IgnGpfZ_-!4TA@hom*goB_-}P+JK!UICgjIST4m
zGBIRtRcep|waKA%MG&Z6GnI*9C!(%^hB0_NhH=%y%?uMkemlVM!~6lL?Z&}i=)lMj
zav3}>+7JXO_Yi&o^&t|V?EnTQ$oK@re|x~?7$oi(SAoKpk%3`?Vu<}jNcqg96~n+V
zMS%%aXEJC#`OGl!F|()^XwDc^{~3eoV^H|oJM09Fae~_Tj0Y6E6+gsVG%_%lGBP+=
z+V5c~bO4PfGBiNapfD)?A?B{p-SL?j63$<lnY1A3pJ7$QZ}1$LRs+Ki^ZiT=g*u>g
z%FrML318@32sm9M%mvL)EUI&uEWd}Lu=J2=Hv=m}2&f(hxjX1Ls148XQA}X!EYRHX
zAtq28P#o58S*7sz{}#|V^k-(VRWb~aIo^6E(br9X{)c>H7GA}|z#wvsjbY+`Cb8EK
ze*X_Sz~o>FvM1sH|ByvYVy7YYh^?}K+9M3MM?@=`NzD5Zv)C$-+5i7S{N(WWzu7tP
z+-pM+Y`pSsHMEWjW?Tu$Q;e$~Ff*>I{ROHIgja#vv&@h(9@alw2hTg$_2%KxTMO3<
zO=n<xk<vp2B0Yf8T>`jW$e;yE3!wTMmL5R)hy^sJ4(%_j2GyV7{MK*@qz*X`K;j*{
zTb=Q^^%~r*JK<>;QD!nh>s>~zAI!{Jp!)fDG3&|?zaV)Nlz!yd847b48A5{L=?9WO
zVRhy2V%L?(bG|#-7%mDkGz5X>>ZBPOf_||!1pUuu*jdlSP?)eNyy^^S+$`H+=Obom
zEztU&#yW?|UzizJDY7tJRL)McsNcg-2pWr>!p0Ej#KI6L&%l)Z`rrQ$Mh59@#S8PL
zs+k$N<r$>26G81W@Z3G5J>UuIx8ytQ1daVCFfeTW%*><(TALEXAi_PLSt9!tXm0Y5
zNq03ngWwc)20^D9hso`~{!ia^%EqFeNj%#TR6k{d`rgvntA6|sna{>h_~80{sVPhh
z-XQ<%KV@QZ06bPBto3LyXiidW)!E;Wa5@QEGs4DT2wGoLFT`MY@Z0~8V8#X^P&=%c
zp+RU9JPwfSE+%l@1!~iQ>R(viod^y41co2xCX7GKKxHQ+-$KJ3oNp2J5vUyk>O1}S
zX8@Ne3JXH3K;?=(3xi=76GMo-0D~dOEye<qr9gENsE(6o5XmkUYLv2P5X}aa@nH-M
zTMjTW>;#Fg`tv^oG_M3|`-1Y_l;5B{#GnQ0D}nrS7w(sRptU<ep#I3?Vupz){{Nre
z$k-qRYF{fXXpjPpi7*H>O2P6Qs2oR6!=UmLR6o4|*E>JVnOGPCVRaEGZ-B<%Vfr`x
zhtxYTKEgcYFlB(&IZUg*GP8jD1wWV>wZ1bmud;@QD+4$$N`Tw+pn7OWox|j4Xgmrt
z{xCxc>tyGZf2$E;{n(gsBB(rq)MFy6ctHIjP<ieTD$hl;7czjxI6(aY@l_Xo{-3_!
z?|&1RT993iP<uf0b&#+?lpkM(8GeG&f+7n;pgj+Rp$0QU2&gRMg}NKmZU>nG8v6l_
zN9aM#dcg3*3{+OY`ZCC62F&j7p!N!bX!e1BkiG}V9MCw<W`+hK&>R)SEr_}eH1+{1
zBS33wKx5pHw8^we^XLERA}kDo-#}}4>OkX3V%b@cx++Kz+&%}b%Mt~b*AssJpPs<T
zV3JhlFd5tr0<9weg~`AFTNoKcPZzT>1Qs(fdW*6^+DM==F;JX?!XMJ+Lex#j?gOp=
z0@c5u@LKct|8xdMhOJ-h9d<&(08+Ohul4$B->?&u&O{kRyFq0Vs9sw1?|;ZbCgIbd
zx^2bJ|I<PBeeofMZjf9C149UCE)_H`c!jY+=+%E%dmNF@Kw$&Qv!L_<>bG?L{Xbm+
z<PLua=y(Oh9iTE2IsJg#0cyuw|M7qNSO12c;w%h;rA!ESB{MLDh%ht=f#L?{z6PlK
zDh?@hGu1dumS+}y4QhAFGl+xJ8)$6`$R8#@|4&!=^WOyI_Rq``;Pq`F_k-4qAcr3)
z?7lFwK=TQ+7AQQUK>brjhOMA+mk0I^J3;+!@HkVn(@K!ppm@O*rl2ru289`T%o~!P
zU~Uim`F}bi3xnW8dxo8fhZMW*8AM-qGBAXg{QbY>0Aqs?C?8B?U@*P%=l>RvolpM%
z7r(~F5D041Ai^DzM?mdVNFRe~6%zx)1gACj6Lmo2MGOpEL2WwpHXNv}3+lsog2pBo
z7z!VV&zAy?DL}#kVkRUkKy7eFEl_&;%FMLN@aO;O55Q#vs9q6S1<EVI&^!n#J03B^
z`k*4KKy|x33xi=c14Br|zyGGNJP1mQ$oUYw8WKT(*G1Zt=4I#Qm*?3r<m4x&Fhr{s
z$1126TPYM2<rkzDl~gL^<(DX=<(KBAa3Lf!^U4x)GE)?CQuESFG88maQxuXaOHzw<
z6jCb+Qj<$kQxr@T@{1HKG`ScQ;uRDW6ym`ELL-x4;dq1ym<7@RV?Y$ZNU&&pJXAw`
zJXeiEje>%{g1$n0yn-f}jDeD1HBdH4Hb!4Tp++C17-YP@f`UQ~SX;b4L}h%uLX1Ah
zWPOk_h(@sSP}9M-fY>NF9*I{2;(%SMub>ZdSPaNaus(%&kQ~Tz{Tc-@1ri1s57rNs
z)JG;k(hBi93Lr5MRsg$PA8I-%1Zv{JW`gvC{Q*$`@|V5>*eEWr3W$yv5Ty?xA+quM
z3N`UH5RrJ0UJwCt8i=lm2iv3%GDiWz1nJU`*RP3(XyM{wP%UOKFtjo<wlcI}a4aZN
zFtSuIGB7e_a4OBrNl|b~EJ;<cQcx{cP%Y+SNY5<MO)*O~HnuQha0^!mOD!tS%+CYM
zb1}GqQkMcGMY(x~C}id)rl%?-mM9ohsOD5CXcT8wrCNbF6_8Y>$;IH8kD(r%Minyi
z6p9k_(o;dob1D>cp|nPENooPujGPKhE(U$D6~!Q9piG6l{FGE!IxkJi&o6<b_Kd`0
zg}i(PP~K2TOi3w9EiP7sW&~t0sL@;uDTyVCC^|s`C^}N}QeY;*b%ApoNTrnmEGsEE
zDCDQ56{kW&0m;tHymW-Bl6<HS_4M=<7*g`{Qn?tS!S0Vm<XljwxOs*^%_z>!EU*H3
z3S=P{Lt;r9Ls|;dyU1SEQAkV7$w^8~&Q>VNS18p51&TsyUJ9zK;ie%6heBdr3djbS
z0bC5OMMe2VRtio&#)b+SAw{LdpfbWOvnaPbu_#s7Q4`@<9fgd<oRZAEbUiKxF0azu
z0+4@8^6_Yer4%kM1_MJQV-r&|a|_GFq~w&;G=`kaywVDtf{etxl$=xs{luKi#NyOq
z2L1T>;>z5l{G8(Wc!uQs+=9fC%%q%DMA-;gM9#p#z*rT;z)~T{D9t0!V8Fn@Ai==E
zaOUFw{}(`N9d#Y~9OiP&V|SU%HidO6%QWV2u6uW{Ub}pSkHJybk(+^m!G(c=!H0o?
zA>-2j{}n6@3?Om7g1LP2cs(ZbOyQo&HH~vR#|-wFY_nKrvoP)Cx_9^X&0E)RpqK%&
z3RGB6VPIgGaqa(q6_5Y}WC8mM1_p)|*Z%(p*#i;=xp5Bz1H+AL|NqB;1VC<7n9DMc
z*=aJ<6h>dJdv{^3bAmA~7#J8nfYe_9|382k>c#_%b0y}9J53gwBI-O<WSX$sbfFo7
z{#^I&qB;(=DME*lfkEWf|NlB5GoTpcUKd6N28~+?_k!FV!N|a1aqIv82#`9s+ngse
z`G8yo2{w@421W*k3?wr_VxUFp4Y&UP*8u5-`Ja)2Val!l{}qtL_AoLqEI?Ctfsuh>
z%dP+a1EA_a;q-)&f#Jig|NlW@$l%K-Fqdf_qiz7#y}Nu2PP$Iqu6zu4@9Bcv2$liw
zEntvfVqi$Q{r|rS$Q(yqCx|Y0h#m%r8XG1ChLYRh#WM`x_y+6u0~-uV79hVQFflMJ
zx&8k?Y?}f|tb~by;mmDBT!O?pm>3xT+(r$<IZO-;Ja_*82l)YPJ~)1zCo{R;yL%ZF
zgwU`#!o<KJatG>GsMrlA1_qNmsA2eqiGji6&j0^BAU{F<z`)GF;Be<ZXaNC|ACgi0
zpu)_+aN*AX|Df~((h7<L3uXp}FL$8v0S`MDQ203NGB7ZJ;x2}nf#JiQ|Nm_mK^a8X
z5fX+>P7p=T5UwsHEIUBy@!tRcJs=C<=EXylLfyKCnSmkW-v9p=AoHAI=0$<s>ZI$)
z4RY57W(J0u`~UxYz{~-MnJZWgC{93XzA!T|EFhppf`x(M$o>EScc7R9u?uF74GRN9
z!~<yDg4_(Y%M-<}1QrH{f(PjN0FwAX=78e1g@u7($%Fs@D`0jR%w?O$>NJ^U3bWf(
zrfG~I6OjuFP}uHZVPJUi;Q#*&kREtg1VF+I5wzg)?FkD5gUUnHc>lq|z##Jwsq6r!
z-9Wh8L3YTnGBAWZ{Qo}(WCzH92zP-L!pax09UiQph4TOZbAZ%B(_joM14G9{gczvY
zC}3q^sCoGRe*s7xs+rDHnY=*7D%@O9*eqaWVA%8U|9=fooTI9D0)<T$NC#3u49ZJa
zSQ!{LJVN*vWX=m#28I=nu!gZS$eds_b3o}thK+&Y%_C@8;tVeXz+nVRZy<9W*cccj
z9wVg_L>PhHmw;w2C=ZpeF)++|{Qv(8SQrG%<(kLoG?`-xyVF#*X{^rES!OVULKw9O
z2Ir{_Yzzz@PyYW0)ivNU0b!rZR3^`RcdtT%4;0pS*cccxo<PePP}qUfr_*F6cSIQs
zsvJN?2}nH;I|D-vk?KL^nGHJw!-OYD{z#b1GmqP8Cd({lm&sgHIHz(<V|Sj;HiH#Z
zoS@Zqp!8M4&cI;t6v;2(Gzdxqpn}<v+YywSopizeUct`55b+cm7a+f2Q|qkD0P@Eb
zkUyRxmCGn$G>y?4QFk+d>M9lv28IPs|Nk$6#Rpiu^JJC~L^y%!0UZtohBr_D|33gz
zhZ%2Spo$YYuY%l@!ok2$@{Bn5fYQ_y4hDu9&;I}KfY}3fk1MD=0J{j<>TrhD>mWTR
zKyJg(11>|r=@3+-BfAUa?>`(23=Yqc$|kTqPLo-@5&j0nlL{vTL&0+-_c(ysLQbHz
zkn2>IaCn*ng;4+}1H+l;|NjfX@+(5E6R6?jG#%UmxQ_0Y4o(J!B`?s+QgB<w6Xs8l
zn>TPWFzg_p4wT1kfZXu{YdPaOl?miQXhw15c7c0<fdQNzK$}1rUgCEPs2yel+9dk&
z|Nj=4U%~A?XIOjB8Pwo&fwcJMFoRlTx9_0k0tN<9n6+>*Fa*5%|NjguzA@7k$iXOK
z1}dNSa4|4Ec?GSPL3sk4zr8@Y23!Y&(!~QV28JK6kn#;!4LDpu84XfcIC6uE0dTSc
zg`Eg!qt@&H|3U3ba2bQ?9<1dPD6I!@GcZhfjZ}|=)08tP?M`J10u_cZD;dD;>;`TI
zh7Yg*|6c&}J6d{ip3W3|?=IZy;QYOXn}H$b&Hw)mD0-l6b5Pj^k6K9hKH+9ySn~!w
z-#UZJTX=En0m`^Y&2doJ$?z~Rn7l<Q+tJ(xYRaOg;{YB8h8=Iw^Sbk77LWztMw=ry
fC{I=JFfcrMi(ck{^Q-ezrVx0NG++mL5;q0_XW(Eo

literal 0
HcmV?d00001

diff --git a/pc-bios/meson.build b/pc-bios/meson.build
index 34d8cc4f33..79bb2e1800 100644
--- a/pc-bios/meson.build
+++ b/pc-bios/meson.build
@@ -28,6 +28,7 @@ if unpack_edk2_blobs
 endif
 
 blobs = [
+  'ast27x0_bootrom.bin',
   'bios.bin',
   'bios-256k.bin',
   'bios-microvm.bin',

From 57be554c2984de3261d1e5d446d797d8e5b2c997 Mon Sep 17 00:00:00 2001
From: Li Zhijian <lizhijian@fujitsu.com>
Date: Wed, 5 Mar 2025 14:28:21 +0800
Subject: [PATCH 0582/2760] migration: check RDMA and capabilities are
 compatible on both sides

Depending on the order of starting RDMA and setting capability,
they can be categorized into the following scenarios:
Source:
 S1: [set capabilities] -> [Start RDMA outgoing]
Destination:
 D1: [set capabilities] -> [Start RDMA incoming]
 D2: [Start RDMA incoming] -> [set capabilities]

Previously, compatibility between RDMA and capabilities was verified only
in scenario D1, potentially causing migration failures in other situations.

For scenarios S1 and D1, we can seamlessly incorporate
migration_transport_compatible() to address compatibility between
channels and capabilities vs transport.

For scenario D2, ensure compatibility within migrate_caps_check().

Reviewed-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Li Zhijian <lizhijian@fujitsu.com>
Message-ID: <20250305062825.772629-3-lizhijian@fujitsu.com>
Signed-off-by: Fabiano Rosas <farosas@suse.de>
---
 migration/migration.c | 30 ++++++++++++++++++++----------
 migration/options.c   | 21 +++++++++++++++++++++
 migration/options.h   |  1 +
 3 files changed, 42 insertions(+), 10 deletions(-)

diff --git a/migration/migration.c b/migration/migration.c
index 55ec4bfab6..54fce997aa 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -259,6 +259,24 @@ migration_channels_and_transport_compatible(MigrationAddress *addr,
     return true;
 }
 
+static bool
+migration_capabilities_and_transport_compatible(MigrationAddress *addr,
+                                                Error **errp)
+{
+    if (addr->transport == MIGRATION_ADDRESS_TYPE_RDMA) {
+        return migrate_rdma_caps_check(migrate_get_current()->capabilities,
+                                       errp);
+    }
+
+    return true;
+}
+
+static bool migration_transport_compatible(MigrationAddress *addr, Error **errp)
+{
+    return migration_channels_and_transport_compatible(addr, errp) &&
+           migration_capabilities_and_transport_compatible(addr, errp);
+}
+
 static gint page_request_addr_cmp(gconstpointer ap, gconstpointer bp)
 {
     uintptr_t a = (uintptr_t) ap, b = (uintptr_t) bp;
@@ -750,7 +768,7 @@ static void qemu_start_incoming_migration(const char *uri, bool has_channels,
     }
 
     /* transport mechanism not suitable for migration? */
-    if (!migration_channels_and_transport_compatible(addr, errp)) {
+    if (!migration_transport_compatible(addr, errp)) {
         return;
     }
 
@@ -769,14 +787,6 @@ static void qemu_start_incoming_migration(const char *uri, bool has_channels,
         }
 #ifdef CONFIG_RDMA
     } else if (addr->transport == MIGRATION_ADDRESS_TYPE_RDMA) {
-        if (migrate_xbzrle()) {
-            error_setg(errp, "RDMA and XBZRLE can't be used together");
-            return;
-        }
-        if (migrate_multifd()) {
-            error_setg(errp, "RDMA and multifd can't be used together");
-            return;
-        }
         rdma_start_incoming_migration(&addr->u.rdma, errp);
 #endif
     } else if (addr->transport == MIGRATION_ADDRESS_TYPE_EXEC) {
@@ -2208,7 +2218,7 @@ void qmp_migrate(const char *uri, bool has_channels,
     }
 
     /* transport mechanism not suitable for migration? */
-    if (!migration_channels_and_transport_compatible(addr, errp)) {
+    if (!migration_transport_compatible(addr, errp)) {
         return;
     }
 
diff --git a/migration/options.c b/migration/options.c
index b0ac2ea408..1f3602839d 100644
--- a/migration/options.c
+++ b/migration/options.c
@@ -448,6 +448,20 @@ static bool migrate_incoming_started(void)
     return !!migration_incoming_get_current()->transport_data;
 }
 
+bool migrate_rdma_caps_check(bool *caps, Error **errp)
+{
+    if (caps[MIGRATION_CAPABILITY_XBZRLE]) {
+        error_setg(errp, "RDMA and XBZRLE can't be used together");
+        return false;
+    }
+    if (caps[MIGRATION_CAPABILITY_MULTIFD]) {
+        error_setg(errp, "RDMA and multifd can't be used together");
+        return false;
+    }
+
+    return true;
+}
+
 /**
  * @migration_caps_check - check capability compatibility
  *
@@ -611,6 +625,13 @@ bool migrate_caps_check(bool *old_caps, bool *new_caps, Error **errp)
         }
     }
 
+    /*
+     * On destination side, check the cases that capability is being set
+     * after incoming thread has started.
+     */
+    if (migrate_rdma() && !migrate_rdma_caps_check(new_caps, errp)) {
+        return false;
+    }
     return true;
 }
 
diff --git a/migration/options.h b/migration/options.h
index 762be4e641..82d839709e 100644
--- a/migration/options.h
+++ b/migration/options.h
@@ -57,6 +57,7 @@ bool migrate_tls(void);
 
 /* capabilities helpers */
 
+bool migrate_rdma_caps_check(bool *caps, Error **errp);
 bool migrate_caps_check(bool *old_caps, bool *new_caps, Error **errp);
 
 /* parameters */

From 103fa641953bfadfe88fbe5f16c0afc9f1e508db Mon Sep 17 00:00:00 2001
From: Li Zhijian <lizhijian@fujitsu.com>
Date: Wed, 5 Mar 2025 14:28:22 +0800
Subject: [PATCH 0583/2760] migration: disable RDMA + postcopy-ram

It's believed that RDMA + postcopy-ram has been broken for a while.
Rather than spending time re-enabling it, let's simply disable it as a
trade-off.

Reviewed-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Li Zhijian <lizhijian@fujitsu.com>
Message-ID: <20250305062825.772629-4-lizhijian@fujitsu.com>
Signed-off-by: Fabiano Rosas <farosas@suse.de>
---
 migration/options.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/migration/options.c b/migration/options.c
index 1f3602839d..4ba8fcb7dc 100644
--- a/migration/options.c
+++ b/migration/options.c
@@ -458,6 +458,10 @@ bool migrate_rdma_caps_check(bool *caps, Error **errp)
         error_setg(errp, "RDMA and multifd can't be used together");
         return false;
     }
+    if (caps[MIGRATION_CAPABILITY_POSTCOPY_RAM]) {
+        error_setg(errp, "RDMA and postcopy-ram can't be used together");
+        return false;
+    }
 
     return true;
 }

From 4ecd6beaf9ff4ad88a33eab78789335a6e929564 Mon Sep 17 00:00:00 2001
From: Li Zhijian <lizhijian@fujitsu.com>
Date: Wed, 5 Mar 2025 14:28:23 +0800
Subject: [PATCH 0584/2760] migration/rdma: Remove redundant
 migration_in_postcopy checks

Since we have disabled RDMA + postcopy, it's safe to remove
the migration_in_postcopy() that follows the migrate_rdma().

Reviewed-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Li Zhijian <lizhijian@fujitsu.com>
Message-ID: <20250305062825.772629-5-lizhijian@fujitsu.com>
Signed-off-by: Fabiano Rosas <farosas@suse.de>
---
 migration/rdma.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/migration/rdma.c b/migration/rdma.c
index b31652baac..a3c3b432d1 100644
--- a/migration/rdma.c
+++ b/migration/rdma.c
@@ -3284,7 +3284,7 @@ err:
 int rdma_control_save_page(QEMUFile *f, ram_addr_t block_offset,
                            ram_addr_t offset, size_t size)
 {
-    if (!migrate_rdma() || migration_in_postcopy()) {
+    if (!migrate_rdma()) {
         return RAM_SAVE_CONTROL_NOT_SUPP;
     }
 
@@ -3829,7 +3829,7 @@ int rdma_block_notification_handle(QEMUFile *f, const char *name)
 
 int rdma_registration_start(QEMUFile *f, uint64_t flags)
 {
-    if (!migrate_rdma() || migration_in_postcopy()) {
+    if (!migrate_rdma()) {
         return 0;
     }
 
@@ -3861,7 +3861,7 @@ int rdma_registration_stop(QEMUFile *f, uint64_t flags)
     RDMAControlHeader head = { .len = 0, .repeat = 1 };
     int ret;
 
-    if (!migrate_rdma() || migration_in_postcopy()) {
+    if (!migrate_rdma()) {
         return 0;
     }
 

From 5e7ca4a7d79da6c9e584886879002f24917c8d27 Mon Sep 17 00:00:00 2001
From: Li Zhijian <lizhijian@fujitsu.com>
Date: Wed, 5 Mar 2025 14:28:24 +0800
Subject: [PATCH 0585/2760] migration: Unfold control_save_page()

control_save_page() is for RDMA only, unfold it to make the code more
clear.
In addition:
 - Similar to other branches style in ram_save_target_page(), involve RDMA
   only if the condition 'migrate_rdma()' is true.
 - Further simplify the code by removing the RAM_SAVE_CONTROL_NOT_SUPP.

Reviewed-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Li Zhijian <lizhijian@fujitsu.com>
Message-ID: <20250305062825.772629-6-lizhijian@fujitsu.com>
Signed-off-by: Fabiano Rosas <farosas@suse.de>
---
 migration/ram.c  | 34 +++++++---------------------------
 migration/rdma.c |  7 ++-----
 migration/rdma.h |  3 +--
 3 files changed, 10 insertions(+), 34 deletions(-)

diff --git a/migration/ram.c b/migration/ram.c
index cb8b2ed493..1181a99cf6 100644
--- a/migration/ram.c
+++ b/migration/ram.c
@@ -1143,32 +1143,6 @@ static int save_zero_page(RAMState *rs, PageSearchStatus *pss,
     return len;
 }
 
-/*
- * @pages: the number of pages written by the control path,
- *        < 0 - error
- *        > 0 - number of pages written
- *
- * Return true if the pages has been saved, otherwise false is returned.
- */
-static bool control_save_page(PageSearchStatus *pss,
-                              ram_addr_t offset, int *pages)
-{
-    int ret;
-
-    ret = rdma_control_save_page(pss->pss_channel, pss->block->offset, offset,
-                                 TARGET_PAGE_SIZE);
-    if (ret == RAM_SAVE_CONTROL_NOT_SUPP) {
-        return false;
-    }
-
-    if (ret == RAM_SAVE_CONTROL_DELAYED) {
-        *pages = 1;
-        return true;
-    }
-    *pages = ret;
-    return true;
-}
-
 /*
  * directly send the page to the stream
  *
@@ -1965,7 +1939,13 @@ static int ram_save_target_page(RAMState *rs, PageSearchStatus *pss)
     int res;
 
     /* Hand over to RDMA first */
-    if (control_save_page(pss, offset, &res)) {
+    if (migrate_rdma()) {
+        res = rdma_control_save_page(pss->pss_channel, pss->block->offset,
+                                     offset, TARGET_PAGE_SIZE);
+
+        if (res == RAM_SAVE_CONTROL_DELAYED) {
+            res = 1;
+        }
         return res;
     }
 
diff --git a/migration/rdma.c b/migration/rdma.c
index a3c3b432d1..4875ca1987 100644
--- a/migration/rdma.c
+++ b/migration/rdma.c
@@ -3284,14 +3284,11 @@ err:
 int rdma_control_save_page(QEMUFile *f, ram_addr_t block_offset,
                            ram_addr_t offset, size_t size)
 {
-    if (!migrate_rdma()) {
-        return RAM_SAVE_CONTROL_NOT_SUPP;
-    }
+    assert(migrate_rdma());
 
     int ret = qemu_rdma_save_page(f, block_offset, offset, size);
 
-    if (ret != RAM_SAVE_CONTROL_DELAYED &&
-        ret != RAM_SAVE_CONTROL_NOT_SUPP) {
+    if (ret != RAM_SAVE_CONTROL_DELAYED) {
         if (ret < 0) {
             qemu_file_set_error(f, ret);
         }
diff --git a/migration/rdma.h b/migration/rdma.h
index 4d3386b84a..f74f16a459 100644
--- a/migration/rdma.h
+++ b/migration/rdma.h
@@ -33,7 +33,6 @@ void rdma_start_incoming_migration(InetSocketAddress *host_port, Error **errp);
 #define RAM_CONTROL_ROUND     1
 #define RAM_CONTROL_FINISH    3
 
-#define RAM_SAVE_CONTROL_NOT_SUPP -1000
 #define RAM_SAVE_CONTROL_DELAYED  -2000
 
 #ifdef CONFIG_RDMA
@@ -56,7 +55,7 @@ static inline
 int rdma_control_save_page(QEMUFile *f, ram_addr_t block_offset,
                            ram_addr_t offset, size_t size)
 {
-    return RAM_SAVE_CONTROL_NOT_SUPP;
+    g_assert_not_reached();
 }
 #endif
 #endif

From 7d9849c3c41463ab9ba40348a8606927dc0fb85d Mon Sep 17 00:00:00 2001
From: Li Zhijian <lizhijian@fujitsu.com>
Date: Tue, 11 Mar 2025 10:42:21 +0800
Subject: [PATCH 0586/2760] migration: Add qtest for migration over RDMA
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This qtest requires there is a RDMA(RoCE) link in the host.
In order to make the test work smoothly, introduce a
scripts/rdma-migration-helper.sh to detect existing RoCE link before
running the test.

Test will be skipped if there is no available RoCE link.
 # Start of rdma tests
 # Running /x86_64/migration/precopy/rdma/plain
 ok 1 /x86_64/migration/precopy/rdma/plain # SKIP No rdma link available
 # To enable the test:
 # Run 'scripts/rdma-migration-helper.sh setup' with root to setup a new rdma/rxe link and rerun the test
 # Optional: run 'scripts/rdma-migration-helper.sh clean' to revert the 'setup'

 # End of rdma tests

Cc: Philippe Mathieu-Daudé <philmd@linaro.org>
Cc: Stefan Hajnoczi <stefanha@gmail.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Li Zhijian <lizhijian@fujitsu.com>
Message-ID: <20250311024221.363421-1-lizhijian@fujitsu.com>
[add 'head -1' to script, reformat test message]
Signed-off-by: Fabiano Rosas <farosas@suse.de>
---
 MAINTAINERS                           |  1 +
 scripts/rdma-migration-helper.sh      | 70 +++++++++++++++++++++++++++
 tests/qtest/migration/precopy-tests.c | 66 +++++++++++++++++++++++++
 3 files changed, 137 insertions(+)
 create mode 100755 scripts/rdma-migration-helper.sh

diff --git a/MAINTAINERS b/MAINTAINERS
index b3f9f2680b..8cd96269b2 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3538,6 +3538,7 @@ R: Li Zhijian <lizhijian@fujitsu.com>
 R: Peter Xu <peterx@redhat.com>
 S: Odd Fixes
 F: migration/rdma*
+F: scripts/rdma-migration-helper.sh
 
 Migration dirty limit and dirty page rate
 M: Hyman Huang <yong.huang@smartx.com>
diff --git a/scripts/rdma-migration-helper.sh b/scripts/rdma-migration-helper.sh
new file mode 100755
index 0000000000..a39f2fb0e5
--- /dev/null
+++ b/scripts/rdma-migration-helper.sh
@@ -0,0 +1,70 @@
+#!/bin/bash
+
+# Copied from blktests
+get_ipv4_addr()
+{
+    ip -4 -o addr show dev "$1" |
+        sed -n 's/.*[[:blank:]]inet[[:blank:]]*\([^[:blank:]/]*\).*/\1/p' |
+        head -1 | tr -d '\n'
+}
+
+# existing rdma interfaces
+rdma_interfaces()
+{
+    rdma link show | sed -nE 's/^link .* netdev ([^ ]+).*$/\1 /p'
+}
+
+# existing valid ipv4 interfaces
+ipv4_interfaces()
+{
+    ip -o addr show | awk '/inet / {print $2}' | grep -v -w lo
+}
+
+rdma_rxe_detect()
+{
+    for r in $(rdma_interfaces)
+    do
+        ipv4_interfaces | grep -qw $r && get_ipv4_addr $r && return
+    done
+
+    return 1
+}
+
+rdma_rxe_setup()
+{
+    for i in $(ipv4_interfaces)
+    do
+        rdma_interfaces | grep -qw $i && continue
+        rdma link add "${i}_rxe" type rxe netdev "$i" && {
+            echo "Setup new rdma/rxe ${i}_rxe for $i with $(get_ipv4_addr $i)"
+            return
+        }
+    done
+
+    echo "Failed to setup any new rdma/rxe link" >&2
+    return 1
+}
+
+rdma_rxe_clean()
+{
+    modprobe -r rdma_rxe
+}
+
+operation=${1:-detect}
+
+command -v rdma >/dev/null || {
+    echo "Command 'rdma' is not available, please install it first." >&2
+    exit 1
+}
+
+if [ "$operation" == "setup" ] || [ "$operation" == "clean" ]; then
+    [ "$UID" == 0 ] || {
+        echo "Root privilege is required to setup/clean a rdma/rxe link" >&2
+        exit 1
+    }
+    rdma_rxe_"$operation"
+elif [ "$operation" == "detect" ]; then
+    rdma_rxe_detect
+else
+    echo "Usage: $0 [setup | detect | clean]"
+fi
diff --git a/tests/qtest/migration/precopy-tests.c b/tests/qtest/migration/precopy-tests.c
index ba273d10b9..565630dddf 100644
--- a/tests/qtest/migration/precopy-tests.c
+++ b/tests/qtest/migration/precopy-tests.c
@@ -99,6 +99,68 @@ static void test_precopy_unix_dirty_ring(void)
     test_precopy_common(&args);
 }
 
+#ifdef CONFIG_RDMA
+
+#define RDMA_MIGRATION_HELPER "scripts/rdma-migration-helper.sh"
+static int new_rdma_link(char *buffer)
+{
+    char cmd[256];
+    bool verbose = g_getenv("QTEST_LOG");
+
+    snprintf(cmd, sizeof(cmd), "%s detect %s", RDMA_MIGRATION_HELPER,
+             verbose ? "" : "2>/dev/null");
+
+    FILE *pipe = popen(cmd, "r");
+    if (pipe == NULL) {
+        perror("Failed to run script");
+        return -1;
+    }
+
+    int idx = 0;
+    while (fgets(buffer + idx, 128 - idx, pipe) != NULL) {
+        idx += strlen(buffer);
+    }
+
+    int status = pclose(pipe);
+    if (status == -1) {
+        perror("Error reported by pclose()");
+        return -1;
+    } else if (WIFEXITED(status)) {
+        return WEXITSTATUS(status);
+    }
+
+    return -1;
+}
+
+static void test_precopy_rdma_plain(void)
+{
+    char buffer[128] = {};
+
+    if (new_rdma_link(buffer)) {
+        g_test_skip("No rdma link available\n"
+                    "# To enable the test:\n"
+                    "# Run \'" RDMA_MIGRATION_HELPER " setup\' with root to "
+                    "setup a new rdma/rxe link and rerun the test\n"
+                    "# Optional: run 'scripts/rdma-migration-helper.sh clean' "
+                    "to revert the 'setup'");
+        return;
+    }
+
+    /*
+     * TODO: query a free port instead of hard code.
+     * 29200=('R'+'D'+'M'+'A')*100
+     **/
+    g_autofree char *uri = g_strdup_printf("rdma:%s:29200", buffer);
+
+    MigrateCommon args = {
+        .listen_uri = uri,
+        .connect_uri = uri,
+    };
+
+    test_precopy_common(&args);
+}
+#endif
+
 static void test_precopy_tcp_plain(void)
 {
     MigrateCommon args = {
@@ -1124,6 +1186,10 @@ static void migration_test_add_precopy_smoke(MigrationTestEnv *env)
                        test_multifd_tcp_uri_none);
     migration_test_add("/migration/multifd/tcp/plain/cancel",
                        test_multifd_tcp_cancel);
+#ifdef CONFIG_RDMA
+    migration_test_add("/migration/precopy/rdma/plain",
+                       test_precopy_rdma_plain);
+#endif
 }
 
 void migration_test_add_precopy(MigrationTestEnv *env)

From b407c9e74753ca0dbc00832bf5fcec44efd05308 Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Mon, 7 Apr 2025 09:28:33 +0200
Subject: [PATCH 0587/2760] migration: Fix latent bug in
 migrate_params_test_apply()

migrate_params_test_apply() neglects to apply tls_authz.  Currently
harmless, because migrate_params_check() doesn't care.  Fix it anyway.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Message-ID: <20250407072833.2118928-1-armbru@redhat.com>
Signed-off-by: Fabiano Rosas <farosas@suse.de>
---
 migration/options.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/migration/options.c b/migration/options.c
index 4ba8fcb7dc..b6ae95358d 100644
--- a/migration/options.c
+++ b/migration/options.c
@@ -1218,6 +1218,11 @@ static void migrate_params_test_apply(MigrateSetParameters *params,
         dest->tls_hostname = params->tls_hostname->u.s;
     }
 
+    if (params->tls_authz) {
+        assert(params->tls_authz->type == QTYPE_QSTRING);
+        dest->tls_authz = params->tls_authz->u.s;
+    }
+
     if (params->has_max_bandwidth) {
         dest->max_bandwidth = params->max_bandwidth;
     }

From 56e3c89f44ecebc946fbe4ffed325d1a79b26e38 Mon Sep 17 00:00:00 2001
From: Prasad Pandit <pjp@fedoraproject.org>
Date: Fri, 11 Apr 2025 17:15:28 +0530
Subject: [PATCH 0588/2760] migration/multifd: move macros to multifd header

Move MULTIFD_ macros to the header file so that
they are accessible from other source files.

Reviewed-by: Fabiano Rosas <farosas@suse.de>
Signed-off-by: Prasad Pandit <pjp@fedoraproject.org>
Reviewed-by: Peter Xu <peterx@redhat.com>
Message-ID: <20250411114534.3370816-2-ppandit@redhat.com>
Signed-off-by: Fabiano Rosas <farosas@suse.de>
---
 migration/multifd.c | 5 -----
 migration/multifd.h | 5 +++++
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/migration/multifd.c b/migration/multifd.c
index 86c83e43c0..ec108af624 100644
--- a/migration/multifd.c
+++ b/migration/multifd.c
@@ -36,11 +36,6 @@
 #include "io/channel-socket.h"
 #include "yank_functions.h"
 
-/* Multiple fd's */
-
-#define MULTIFD_MAGIC 0x11223344U
-#define MULTIFD_VERSION 1
-
 typedef struct {
     uint32_t magic;
     uint32_t version;
diff --git a/migration/multifd.h b/migration/multifd.h
index 2d337e7b3b..9b6d81e7ed 100644
--- a/migration/multifd.h
+++ b/migration/multifd.h
@@ -49,6 +49,11 @@ bool multifd_queue_page(RAMBlock *block, ram_addr_t offset);
 bool multifd_recv(void);
 MultiFDRecvData *multifd_get_recv_data(void);
 
+/* Multiple fd's */
+
+#define MULTIFD_MAGIC 0x11223344U
+#define MULTIFD_VERSION 1
+
 /* Multifd Compression flags */
 #define MULTIFD_FLAG_SYNC (1 << 0)
 

From 00f3fcef1981eb23f98b956d9cda2df528bfef40 Mon Sep 17 00:00:00 2001
From: Prasad Pandit <pjp@fedoraproject.org>
Date: Fri, 11 Apr 2025 17:15:29 +0530
Subject: [PATCH 0589/2760] migration: refactor channel discovery mechanism

The various logical migration channels don't have a
standardized way of advertising themselves and their
connections may be seen out of order by the migration
destination. When a new connection arrives, the incoming
migration currently make use of heuristics to determine
which channel it belongs to.

The next few patches will need to change how the multifd
and postcopy capabilities interact and that affects the
channel discovery heuristic.

Refactor the channel discovery heuristic to make it less
opaque and simplify the subsequent patches.

Signed-off-by: Prasad Pandit <pjp@fedoraproject.org>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Message-ID: <20250411114534.3370816-3-ppandit@redhat.com>
Signed-off-by: Fabiano Rosas <farosas@suse.de>
---
 migration/migration.c | 130 +++++++++++++++++++++++-------------------
 1 file changed, 70 insertions(+), 60 deletions(-)

diff --git a/migration/migration.c b/migration/migration.c
index 54fce997aa..f18cadcc5e 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -95,6 +95,9 @@ enum mig_rp_message_type {
     MIG_RP_MSG_MAX
 };
 
+/* Migration channel types */
+enum { CH_MAIN, CH_MULTIFD, CH_POSTCOPY };
+
 /* When we add fault tolerance, we could have several
    migrations at once.  For now we don't need to add
    dynamic creation of migration */
@@ -941,9 +944,8 @@ static void migration_incoming_setup(QEMUFile *f)
 {
     MigrationIncomingState *mis = migration_incoming_get_current();
 
-    if (!mis->from_src_file) {
-        mis->from_src_file = f;
-    }
+    assert(!mis->from_src_file);
+    mis->from_src_file = f;
     qemu_file_set_blocking(f, false);
 }
 
@@ -995,28 +997,19 @@ void migration_fd_process_incoming(QEMUFile *f)
     migration_incoming_process();
 }
 
-/*
- * Returns true when we want to start a new incoming migration process,
- * false otherwise.
- */
-static bool migration_should_start_incoming(bool main_channel)
+static bool migration_has_main_and_multifd_channels(void)
 {
-    /* Multifd doesn't start unless all channels are established */
-    if (migrate_multifd()) {
-        return migration_has_all_channels();
+    MigrationIncomingState *mis = migration_incoming_get_current();
+    if (!mis->from_src_file) {
+        /* main channel not established */
+        return false;
     }
 
-    /* Preempt channel only starts when the main channel is created */
-    if (migrate_postcopy_preempt()) {
-        return main_channel;
+    if (migrate_multifd() && !multifd_recv_all_channels_created()) {
+        return false;
     }
 
-    /*
-     * For all the rest types of migration, we should only reach here when
-     * it's the main channel that's being created, and we should always
-     * proceed with this channel.
-     */
-    assert(main_channel);
+    /* main and all multifd channels are established */
     return true;
 }
 
@@ -1025,59 +1018,81 @@ void migration_ioc_process_incoming(QIOChannel *ioc, Error **errp)
     MigrationIncomingState *mis = migration_incoming_get_current();
     Error *local_err = NULL;
     QEMUFile *f;
-    bool default_channel = true;
+    uint8_t channel;
     uint32_t channel_magic = 0;
     int ret = 0;
 
-    if (migrate_multifd() && !migrate_mapped_ram() &&
-        !migrate_postcopy_ram() &&
-        qio_channel_has_feature(ioc, QIO_CHANNEL_FEATURE_READ_MSG_PEEK)) {
-        /*
-         * With multiple channels, it is possible that we receive channels
-         * out of order on destination side, causing incorrect mapping of
-         * source channels on destination side. Check channel MAGIC to
-         * decide type of channel. Please note this is best effort, postcopy
-         * preempt channel does not send any magic number so avoid it for
-         * postcopy live migration. Also tls live migration already does
-         * tls handshake while initializing main channel so with tls this
-         * issue is not possible.
-         */
-        ret = migration_channel_read_peek(ioc, (void *)&channel_magic,
-                                          sizeof(channel_magic), errp);
+    if (!migration_has_main_and_multifd_channels()) {
+        if (qio_channel_has_feature(ioc, QIO_CHANNEL_FEATURE_READ_MSG_PEEK)) {
+            /*
+             * With multiple channels, it is possible that we receive channels
+             * out of order on destination side, causing incorrect mapping of
+             * source channels on destination side. Check channel MAGIC to
+             * decide type of channel. Please note this is best effort,
+             * postcopy preempt channel does not send any magic number so
+             * avoid it for postcopy live migration. Also tls live migration
+             * already does tls handshake while initializing main channel so
+             * with tls this issue is not possible.
+             */
+            ret = migration_channel_read_peek(ioc, (void *)&channel_magic,
+                                              sizeof(channel_magic), errp);
+            if (ret != 0) {
+                return;
+            }
 
-        if (ret != 0) {
+            channel_magic = be32_to_cpu(channel_magic);
+            if (channel_magic == QEMU_VM_FILE_MAGIC) {
+                channel = CH_MAIN;
+            } else if (channel_magic == MULTIFD_MAGIC) {
+                assert(migrate_multifd());
+                channel = CH_MULTIFD;
+            } else if (!mis->from_src_file &&
+                        mis->state == MIGRATION_STATUS_POSTCOPY_PAUSED) {
+                /* reconnect main channel for postcopy recovery */
+                channel = CH_MAIN;
+            } else {
+                error_setg(errp, "unknown channel magic: %u", channel_magic);
+                return;
+            }
+        } else if (mis->from_src_file && migrate_multifd()) {
+            /*
+             * Non-peekable channels like tls/file are processed as
+             * multifd channels when multifd is enabled.
+             */
+            channel = CH_MULTIFD;
+        } else if (!mis->from_src_file) {
+            channel = CH_MAIN;
+        } else {
+            error_setg(errp, "non-peekable channel used without multifd");
             return;
         }
-
-        default_channel = (channel_magic == cpu_to_be32(QEMU_VM_FILE_MAGIC));
     } else {
-        default_channel = !mis->from_src_file;
+        assert(migrate_postcopy_preempt());
+        channel = CH_POSTCOPY;
     }
 
     if (multifd_recv_setup(errp) != 0) {
         return;
     }
 
-    if (default_channel) {
+    if (channel == CH_MAIN) {
         f = qemu_file_new_input(ioc);
         migration_incoming_setup(f);
-    } else {
+    } else if (channel == CH_MULTIFD) {
         /* Multiple connections */
-        assert(migration_needs_multiple_sockets());
-        if (migrate_multifd()) {
-            multifd_recv_new_channel(ioc, &local_err);
-        } else {
-            assert(migrate_postcopy_preempt());
-            f = qemu_file_new_input(ioc);
-            postcopy_preempt_new_channel(mis, f);
-        }
+        multifd_recv_new_channel(ioc, &local_err);
         if (local_err) {
             error_propagate(errp, local_err);
             return;
         }
+    } else if (channel == CH_POSTCOPY) {
+        assert(!mis->postcopy_qemufile_dst);
+        f = qemu_file_new_input(ioc);
+        postcopy_preempt_new_channel(mis, f);
+        return;
     }
 
-    if (migration_should_start_incoming(default_channel)) {
+    if (migration_has_main_and_multifd_channels()) {
         /* If it's a recovery, we're done */
         if (postcopy_try_recover()) {
             return;
@@ -1094,18 +1109,13 @@ void migration_ioc_process_incoming(QIOChannel *ioc, Error **errp)
  */
 bool migration_has_all_channels(void)
 {
-    MigrationIncomingState *mis = migration_incoming_get_current();
-
-    if (!mis->from_src_file) {
+    if (!migration_has_main_and_multifd_channels()) {
         return false;
     }
 
-    if (migrate_multifd()) {
-        return multifd_recv_all_channels_created();
-    }
-
-    if (migrate_postcopy_preempt()) {
-        return mis->postcopy_qemufile_dst != NULL;
+    MigrationIncomingState *mis = migration_incoming_get_current();
+    if (migrate_postcopy_preempt() && !mis->postcopy_qemufile_dst) {
+        return false;
     }
 
     return true;

From 1d481116015428c02f7e3635f9bc0b88b0978fdc Mon Sep 17 00:00:00 2001
From: Peter Xu <peterx@redhat.com>
Date: Fri, 11 Apr 2025 17:15:30 +0530
Subject: [PATCH 0590/2760] migration: Add save_postcopy_prepare() savevm
 handler

Add a savevm handler for a module to opt-in sending extra sections right
before postcopy starts, and before VM is stopped.

RAM will start to use this new savevm handler in the next patch to do flush
and sync for multifd pages.

Note that we choose to do it before VM stopped because the current only
potential user is not sensitive to VM status, so doing it before VM is
stopped is preferred to enlarge any postcopy downtime.

It is still a bit unfortunate that we need to introduce such a new savevm
handler just for the only use case, however it's so far the cleanest.

Signed-off-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Prasad Pandit <pjp@fedoraproject.org>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Message-ID: <20250411114534.3370816-4-ppandit@redhat.com>
Signed-off-by: Fabiano Rosas <farosas@suse.de>
---
 include/migration/register.h | 15 +++++++++++++++
 migration/migration.c        |  4 ++++
 migration/savevm.c           | 33 +++++++++++++++++++++++++++++++++
 migration/savevm.h           |  1 +
 4 files changed, 53 insertions(+)

diff --git a/include/migration/register.h b/include/migration/register.h
index c041ce32f2..b79dc81b8d 100644
--- a/include/migration/register.h
+++ b/include/migration/register.h
@@ -189,6 +189,21 @@ typedef struct SaveVMHandlers {
 
     /* This runs outside the BQL!  */
 
+    /**
+     * @save_postcopy_prepare
+     *
+     * This hook will be invoked on the source side right before switching
+     * to postcopy (before VM stopped).
+     *
+     * @f:      QEMUFile where to send the data
+     * @opaque: Data pointer passed to register_savevm_live()
+     * @errp:   Error** used to report error message
+     *
+     * Returns: true if succeeded, false if error occured.  When false is
+     * returned, @errp must be set.
+     */
+    bool (*save_postcopy_prepare)(QEMUFile *f, void *opaque, Error **errp);
+
     /**
      * @state_pending_estimate
      *
diff --git a/migration/migration.c b/migration/migration.c
index f18cadcc5e..4697732bef 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -2727,6 +2727,10 @@ static int postcopy_start(MigrationState *ms, Error **errp)
         }
     }
 
+    if (!qemu_savevm_state_postcopy_prepare(ms->to_dst_file, errp)) {
+        return -1;
+    }
+
     trace_postcopy_start();
     bql_lock();
     trace_postcopy_start_set_run();
diff --git a/migration/savevm.c b/migration/savevm.c
index 0c12e373b4..006514c3e3 100644
--- a/migration/savevm.c
+++ b/migration/savevm.c
@@ -1523,6 +1523,39 @@ void qemu_savevm_state_complete_postcopy(QEMUFile *f)
     qemu_fflush(f);
 }
 
+bool qemu_savevm_state_postcopy_prepare(QEMUFile *f, Error **errp)
+{
+    SaveStateEntry *se;
+    bool ret;
+
+    QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
+        if (!se->ops || !se->ops->save_postcopy_prepare) {
+            continue;
+        }
+
+        if (se->ops->is_active) {
+            if (!se->ops->is_active(se->opaque)) {
+                continue;
+            }
+        }
+
+        trace_savevm_section_start(se->idstr, se->section_id);
+
+        save_section_header(f, se, QEMU_VM_SECTION_PART);
+        ret = se->ops->save_postcopy_prepare(f, se->opaque, errp);
+        save_section_footer(f, se);
+
+        trace_savevm_section_end(se->idstr, se->section_id, ret);
+
+        if (!ret) {
+            assert(*errp);
+            return false;
+        }
+    }
+
+    return true;
+}
+
 int qemu_savevm_state_complete_precopy_iterable(QEMUFile *f, bool in_postcopy)
 {
     int64_t start_ts_each, end_ts_each;
diff --git a/migration/savevm.h b/migration/savevm.h
index 138c39a7f9..2d5e9c7166 100644
--- a/migration/savevm.h
+++ b/migration/savevm.h
@@ -45,6 +45,7 @@ void qemu_savevm_state_pending_exact(uint64_t *must_precopy,
 void qemu_savevm_state_pending_estimate(uint64_t *must_precopy,
                                         uint64_t *can_postcopy);
 int qemu_savevm_state_complete_precopy_iterable(QEMUFile *f, bool in_postcopy);
+bool qemu_savevm_state_postcopy_prepare(QEMUFile *f, Error **errp);
 void qemu_savevm_send_ping(QEMUFile *f, uint32_t value);
 void qemu_savevm_send_open_return_path(QEMUFile *f);
 int qemu_savevm_send_packaged(QEMUFile *f, const uint8_t *buf, size_t len);

From ad8d82ffbb8b8034f58a570911e6e9c6328c9384 Mon Sep 17 00:00:00 2001
From: Peter Xu <peterx@redhat.com>
Date: Fri, 11 Apr 2025 17:15:31 +0530
Subject: [PATCH 0591/2760] migration/ram: Implement save_postcopy_prepare()

Implement save_postcopy_prepare(), preparing for the enablement
of both multifd and postcopy.

Signed-off-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Prasad Pandit <pjp@fedoraproject.org>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Message-ID: <20250411114534.3370816-5-ppandit@redhat.com>
Signed-off-by: Fabiano Rosas <farosas@suse.de>
---
 migration/ram.c | 37 +++++++++++++++++++++++++++++++++++++
 1 file changed, 37 insertions(+)

diff --git a/migration/ram.c b/migration/ram.c
index 1181a99cf6..a749e4a421 100644
--- a/migration/ram.c
+++ b/migration/ram.c
@@ -4398,6 +4398,42 @@ static int ram_resume_prepare(MigrationState *s, void *opaque)
     return 0;
 }
 
+static bool ram_save_postcopy_prepare(QEMUFile *f, void *opaque, Error **errp)
+{
+    int ret;
+
+    if (migrate_multifd()) {
+        /*
+         * When multifd is enabled, source QEMU needs to make sure all the
+         * pages queued before postcopy starts have been flushed.
+         *
+         * The load of these pages must happen before switching to postcopy.
+         * It's because loading of guest pages (so far) in multifd recv
+         * threads is still non-atomic, so the load cannot happen with vCPUs
+         * running on the destination side.
+         *
+         * This flush and sync will guarantee that those pages are loaded
+         * _before_ postcopy starts on the destination. The rationale is,
+         * this happens before VM stops (and before source QEMU sends all
+         * the rest of the postcopy messages).  So when the destination QEMU
+         * receives the postcopy messages, it must have received the sync
+         * message on the main channel (either RAM_SAVE_FLAG_MULTIFD_FLUSH,
+         * or RAM_SAVE_FLAG_EOS), and such message would guarantee that
+         * all previous guest pages queued in the multifd channels are
+         * completely loaded.
+         */
+        ret = multifd_ram_flush_and_sync(f);
+        if (ret < 0) {
+            error_setg(errp, "%s: multifd flush and sync failed", __func__);
+            return false;
+        }
+    }
+
+    qemu_put_be64(f, RAM_SAVE_FLAG_EOS);
+
+    return true;
+}
+
 void postcopy_preempt_shutdown_file(MigrationState *s)
 {
     qemu_put_be64(s->postcopy_qemufile_src, RAM_SAVE_FLAG_EOS);
@@ -4417,6 +4453,7 @@ static SaveVMHandlers savevm_ram_handlers = {
     .load_setup = ram_load_setup,
     .load_cleanup = ram_load_cleanup,
     .resume_prepare = ram_resume_prepare,
+    .save_postcopy_prepare = ram_save_postcopy_prepare,
 };
 
 static void ram_mig_ram_block_resized(RAMBlockNotifier *n, void *host,

From 115cec9d663c1a2f5a73df4a5ca02b3a676e8a2a Mon Sep 17 00:00:00 2001
From: Prasad Pandit <pjp@fedoraproject.org>
Date: Fri, 11 Apr 2025 17:15:33 +0530
Subject: [PATCH 0592/2760] tests/qtest/migration: consolidate set capabilities

Migration capabilities are set in multiple '.start_hook'
functions for various tests. Instead, consolidate setting
capabilities in 'migrate_start_set_capabilities()' function
which is called from the 'migrate_start()' function.
While simplifying the capabilities setting, it helps
to declutter the qtest sources.

Suggested-by: Fabiano Rosas <farosas@suse.de>
Signed-off-by: Prasad Pandit <pjp@fedoraproject.org>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Message-ID: <20250411114534.3370816-7-ppandit@redhat.com>
[fix open brace]
Signed-off-by: Fabiano Rosas <farosas@suse.de>
---
 tests/qtest/migration/compression-tests.c | 22 +++++--
 tests/qtest/migration/cpr-tests.c         |  6 +-
 tests/qtest/migration/file-tests.c        | 58 ++++++++----------
 tests/qtest/migration/framework.c         | 75 +++++++++++++++--------
 tests/qtest/migration/framework.h         |  9 ++-
 tests/qtest/migration/misc-tests.c        |  4 +-
 tests/qtest/migration/postcopy-tests.c    |  8 ++-
 tests/qtest/migration/precopy-tests.c     | 29 +++++----
 tests/qtest/migration/tls-tests.c         | 23 ++++++-
 9 files changed, 150 insertions(+), 84 deletions(-)

diff --git a/tests/qtest/migration/compression-tests.c b/tests/qtest/migration/compression-tests.c
index 8b58401b84..41e79f031b 100644
--- a/tests/qtest/migration/compression-tests.c
+++ b/tests/qtest/migration/compression-tests.c
@@ -35,6 +35,9 @@ static void test_multifd_tcp_zstd(void)
 {
     MigrateCommon args = {
         .listen_uri = "defer",
+        .start = {
+            .caps[MIGRATION_CAPABILITY_MULTIFD] = true,
+        },
         .start_hook = migrate_hook_start_precopy_tcp_multifd_zstd,
     };
     test_precopy_common(&args);
@@ -56,6 +59,9 @@ static void test_multifd_tcp_qatzip(void)
 {
     MigrateCommon args = {
         .listen_uri = "defer",
+        .start = {
+            .caps[MIGRATION_CAPABILITY_MULTIFD] = true,
+        },
         .start_hook = migrate_hook_start_precopy_tcp_multifd_qatzip,
     };
     test_precopy_common(&args);
@@ -74,6 +80,9 @@ static void test_multifd_tcp_qpl(void)
 {
     MigrateCommon args = {
         .listen_uri = "defer",
+        .start = {
+            .caps[MIGRATION_CAPABILITY_MULTIFD] = true,
+        },
         .start_hook = migrate_hook_start_precopy_tcp_multifd_qpl,
     };
     test_precopy_common(&args);
@@ -92,6 +101,9 @@ static void test_multifd_tcp_uadk(void)
 {
     MigrateCommon args = {
         .listen_uri = "defer",
+        .start = {
+            .caps[MIGRATION_CAPABILITY_MULTIFD] = true,
+        },
         .start_hook = migrate_hook_start_precopy_tcp_multifd_uadk,
     };
     test_precopy_common(&args);
@@ -103,10 +115,6 @@ migrate_hook_start_xbzrle(QTestState *from,
                           QTestState *to)
 {
     migrate_set_parameter_int(from, "xbzrle-cache-size", 33554432);
-
-    migrate_set_capability(from, "xbzrle", true);
-    migrate_set_capability(to, "xbzrle", true);
-
     return NULL;
 }
 
@@ -118,6 +126,9 @@ static void test_precopy_unix_xbzrle(void)
         .listen_uri = uri,
         .start_hook = migrate_hook_start_xbzrle,
         .iterations = 2,
+        .start = {
+            .caps[MIGRATION_CAPABILITY_XBZRLE] = true,
+        },
         /*
          * XBZRLE needs pages to be modified when doing the 2nd+ round
          * iteration to have real data pushed to the stream.
@@ -146,6 +157,9 @@ static void test_multifd_tcp_zlib(void)
 {
     MigrateCommon args = {
         .listen_uri = "defer",
+        .start = {
+            .caps[MIGRATION_CAPABILITY_MULTIFD] = true,
+        },
         .start_hook = migrate_hook_start_precopy_tcp_multifd_zlib,
     };
     test_precopy_common(&args);
diff --git a/tests/qtest/migration/cpr-tests.c b/tests/qtest/migration/cpr-tests.c
index 4758841824..5536e14610 100644
--- a/tests/qtest/migration/cpr-tests.c
+++ b/tests/qtest/migration/cpr-tests.c
@@ -24,9 +24,6 @@ static void *migrate_hook_start_mode_reboot(QTestState *from, QTestState *to)
     migrate_set_parameter_str(from, "mode", "cpr-reboot");
     migrate_set_parameter_str(to, "mode", "cpr-reboot");
 
-    migrate_set_capability(from, "x-ignore-shared", true);
-    migrate_set_capability(to, "x-ignore-shared", true);
-
     return NULL;
 }
 
@@ -39,6 +36,9 @@ static void test_mode_reboot(void)
         .connect_uri = uri,
         .listen_uri = "defer",
         .start_hook = migrate_hook_start_mode_reboot,
+        .start = {
+            .caps[MIGRATION_CAPABILITY_X_IGNORE_SHARED] = true,
+        },
     };
 
     test_file_common(&args, true);
diff --git a/tests/qtest/migration/file-tests.c b/tests/qtest/migration/file-tests.c
index f260e2871d..4d78ce0855 100644
--- a/tests/qtest/migration/file-tests.c
+++ b/tests/qtest/migration/file-tests.c
@@ -107,15 +107,6 @@ static void test_precopy_file_offset_bad(void)
     test_file_common(&args, false);
 }
 
-static void *migrate_hook_start_mapped_ram(QTestState *from,
-                                           QTestState *to)
-{
-    migrate_set_capability(from, "mapped-ram", true);
-    migrate_set_capability(to, "mapped-ram", true);
-
-    return NULL;
-}
-
 static void test_precopy_file_mapped_ram_live(void)
 {
     g_autofree char *uri = g_strdup_printf("file:%s/%s", tmpfs,
@@ -123,7 +114,9 @@ static void test_precopy_file_mapped_ram_live(void)
     MigrateCommon args = {
         .connect_uri = uri,
         .listen_uri = "defer",
-        .start_hook = migrate_hook_start_mapped_ram,
+        .start = {
+            .caps[MIGRATION_CAPABILITY_MAPPED_RAM] = true,
+        },
     };
 
     test_file_common(&args, false);
@@ -136,26 +129,14 @@ static void test_precopy_file_mapped_ram(void)
     MigrateCommon args = {
         .connect_uri = uri,
         .listen_uri = "defer",
-        .start_hook = migrate_hook_start_mapped_ram,
+        .start = {
+            .caps[MIGRATION_CAPABILITY_MAPPED_RAM] = true,
+        },
     };
 
     test_file_common(&args, true);
 }
 
-static void *migrate_hook_start_multifd_mapped_ram(QTestState *from,
-                                                   QTestState *to)
-{
-    migrate_hook_start_mapped_ram(from, to);
-
-    migrate_set_parameter_int(from, "multifd-channels", 4);
-    migrate_set_parameter_int(to, "multifd-channels", 4);
-
-    migrate_set_capability(from, "multifd", true);
-    migrate_set_capability(to, "multifd", true);
-
-    return NULL;
-}
-
 static void test_multifd_file_mapped_ram_live(void)
 {
     g_autofree char *uri = g_strdup_printf("file:%s/%s", tmpfs,
@@ -163,7 +144,10 @@ static void test_multifd_file_mapped_ram_live(void)
     MigrateCommon args = {
         .connect_uri = uri,
         .listen_uri = "defer",
-        .start_hook = migrate_hook_start_multifd_mapped_ram,
+        .start = {
+            .caps[MIGRATION_CAPABILITY_MULTIFD] = true,
+            .caps[MIGRATION_CAPABILITY_MAPPED_RAM] = true,
+        },
     };
 
     test_file_common(&args, false);
@@ -176,7 +160,10 @@ static void test_multifd_file_mapped_ram(void)
     MigrateCommon args = {
         .connect_uri = uri,
         .listen_uri = "defer",
-        .start_hook = migrate_hook_start_multifd_mapped_ram,
+        .start = {
+            .caps[MIGRATION_CAPABILITY_MULTIFD] = true,
+            .caps[MIGRATION_CAPABILITY_MAPPED_RAM] = true,
+        },
     };
 
     test_file_common(&args, true);
@@ -185,8 +172,6 @@ static void test_multifd_file_mapped_ram(void)
 static void *migrate_hook_start_multifd_mapped_ram_dio(QTestState *from,
                                                        QTestState *to)
 {
-    migrate_hook_start_multifd_mapped_ram(from, to);
-
     migrate_set_parameter_bool(from, "direct-io", true);
     migrate_set_parameter_bool(to, "direct-io", true);
 
@@ -201,6 +186,10 @@ static void test_multifd_file_mapped_ram_dio(void)
         .connect_uri = uri,
         .listen_uri = "defer",
         .start_hook = migrate_hook_start_multifd_mapped_ram_dio,
+        .start = {
+            .caps[MIGRATION_CAPABILITY_MAPPED_RAM] = true,
+            .caps[MIGRATION_CAPABILITY_MULTIFD] = true,
+        },
     };
 
     if (!probe_o_direct_support(tmpfs)) {
@@ -246,7 +235,6 @@ static void *migrate_hook_start_multifd_mapped_ram_fdset_dio(QTestState *from,
     fdset_add_fds(from, file, O_WRONLY, 2, true);
     fdset_add_fds(to, file, O_RDONLY, 2, true);
 
-    migrate_hook_start_multifd_mapped_ram(from, to);
     migrate_set_parameter_bool(from, "direct-io", true);
     migrate_set_parameter_bool(to, "direct-io", true);
 
@@ -261,8 +249,6 @@ static void *migrate_hook_start_multifd_mapped_ram_fdset(QTestState *from,
     fdset_add_fds(from, file, O_WRONLY, 2, false);
     fdset_add_fds(to, file, O_RDONLY, 2, false);
 
-    migrate_hook_start_multifd_mapped_ram(from, to);
-
     return NULL;
 }
 
@@ -275,6 +261,10 @@ static void test_multifd_file_mapped_ram_fdset(void)
         .listen_uri = "defer",
         .start_hook = migrate_hook_start_multifd_mapped_ram_fdset,
         .end_hook = migrate_hook_end_multifd_mapped_ram_fdset,
+        .start = {
+            .caps[MIGRATION_CAPABILITY_MAPPED_RAM] = true,
+            .caps[MIGRATION_CAPABILITY_MULTIFD] = true,
+        },
     };
 
     test_file_common(&args, true);
@@ -289,6 +279,10 @@ static void test_multifd_file_mapped_ram_fdset_dio(void)
         .listen_uri = "defer",
         .start_hook = migrate_hook_start_multifd_mapped_ram_fdset_dio,
         .end_hook = migrate_hook_end_multifd_mapped_ram_fdset,
+        .start = {
+            .caps[MIGRATION_CAPABILITY_MAPPED_RAM] = true,
+            .caps[MIGRATION_CAPABILITY_MULTIFD] = true,
+        },
     };
 
     if (!probe_o_direct_support(tmpfs)) {
diff --git a/tests/qtest/migration/framework.c b/tests/qtest/migration/framework.c
index 10e1d04b58..e48b80a127 100644
--- a/tests/qtest/migration/framework.c
+++ b/tests/qtest/migration/framework.c
@@ -30,6 +30,7 @@
 #define QEMU_VM_FILE_MAGIC 0x5145564d
 #define QEMU_ENV_SRC "QTEST_QEMU_BINARY_SRC"
 #define QEMU_ENV_DST "QTEST_QEMU_BINARY_DST"
+#define MULTIFD_TEST_CHANNELS 4
 
 unsigned start_address;
 unsigned end_address;
@@ -207,6 +208,51 @@ static QList *migrate_start_get_qmp_capabilities(const MigrateStart *args)
     return capabilities;
 }
 
+static void migrate_start_set_capabilities(QTestState *from, QTestState *to,
+                                           MigrateStart *args)
+{
+    /*
+     * MigrationCapability_lookup and MIGRATION_CAPABILITY_ constants
+     * are from qapi-types-migration.h.
+     */
+    for (uint8_t i = 0; i < MIGRATION_CAPABILITY__MAX; i++) {
+        if (!args->caps[i]) {
+            continue;
+        }
+        if (from) {
+            migrate_set_capability(from,
+                            MigrationCapability_lookup.array[i], true);
+        }
+        if (to) {
+            migrate_set_capability(to,
+                            MigrationCapability_lookup.array[i], true);
+        }
+    }
+
+    /*
+     * Always enable migration events.  Libvirt always uses it, let's try
+     * to mimic as closer as that.
+     */
+    migrate_set_capability(from, "events", true);
+    if (!args->defer_target_connect) {
+        migrate_set_capability(to, "events", true);
+    }
+
+    /*
+     * Default number of channels should be fine for most
+     * tests. Individual tests can override by calling
+     * migrate_set_parameter() directly.
+     */
+    if (args->caps[MIGRATION_CAPABILITY_MULTIFD]) {
+        migrate_set_parameter_int(from, "multifd-channels",
+                                  MULTIFD_TEST_CHANNELS);
+        migrate_set_parameter_int(to, "multifd-channels",
+                                  MULTIFD_TEST_CHANNELS);
+    }
+
+    return;
+}
+
 int migrate_start(QTestState **from, QTestState **to, const char *uri,
                   MigrateStart *args)
 {
@@ -379,14 +425,7 @@ int migrate_start(QTestState **from, QTestState **to, const char *uri,
         unlink(shmem_path);
     }
 
-    /*
-     * Always enable migration events.  Libvirt always uses it, let's try
-     * to mimic as closer as that.
-     */
-    migrate_set_capability(*from, "events", true);
-    if (!args->defer_target_connect) {
-        migrate_set_capability(*to, "events", true);
-    }
+    migrate_start_set_capabilities(*from, *to, args);
 
     return 0;
 }
@@ -432,6 +471,10 @@ static int migrate_postcopy_prepare(QTestState **from_ptr,
 {
     QTestState *from, *to;
 
+    /* set postcopy capabilities */
+    args->start.caps[MIGRATION_CAPABILITY_POSTCOPY_BLOCKTIME] = true;
+    args->start.caps[MIGRATION_CAPABILITY_POSTCOPY_RAM] = true;
+
     if (migrate_start(&from, &to, "defer", &args->start)) {
         return -1;
     }
@@ -440,17 +483,7 @@ static int migrate_postcopy_prepare(QTestState **from_ptr,
         args->postcopy_data = args->start_hook(from, to);
     }
 
-    migrate_set_capability(from, "postcopy-ram", true);
-    migrate_set_capability(to, "postcopy-ram", true);
-    migrate_set_capability(to, "postcopy-blocktime", true);
-
-    if (args->postcopy_preempt) {
-        migrate_set_capability(from, "postcopy-preempt", true);
-        migrate_set_capability(to, "postcopy-preempt", true);
-    }
-
     migrate_ensure_non_converge(from);
-
     migrate_prepare_for_dirty_mem(from);
     qtest_qmp_assert_success(to, "{ 'execute': 'migrate-incoming',"
                              "  'arguments': { "
@@ -948,15 +981,9 @@ void *migrate_hook_start_precopy_tcp_multifd_common(QTestState *from,
                                                     QTestState *to,
                                                     const char *method)
 {
-    migrate_set_parameter_int(from, "multifd-channels", 16);
-    migrate_set_parameter_int(to, "multifd-channels", 16);
-
     migrate_set_parameter_str(from, "multifd-compression", method);
     migrate_set_parameter_str(to, "multifd-compression", method);
 
-    migrate_set_capability(from, "multifd", true);
-    migrate_set_capability(to, "multifd", true);
-
     /* Start incoming migration from the 1st socket */
     migrate_incoming_qmp(to, "tcp:127.0.0.1:0", NULL, "{}");
 
diff --git a/tests/qtest/migration/framework.h b/tests/qtest/migration/framework.h
index e4a11870f6..01e425e64e 100644
--- a/tests/qtest/migration/framework.h
+++ b/tests/qtest/migration/framework.h
@@ -12,6 +12,7 @@
 #define TEST_FRAMEWORK_H
 
 #include "libqtest.h"
+#include <qapi/qapi-types-migration.h>
 
 #define FILE_TEST_FILENAME "migfile"
 #define FILE_TEST_OFFSET 0x1000
@@ -120,6 +121,13 @@ typedef struct {
 
     /* Do not connect to target monitor and qtest sockets in qtest_init */
     bool defer_target_connect;
+
+    /*
+     * Migration capabilities to be set in both source and
+     * destination. For unilateral capabilities, use
+     * migration_set_capabilities().
+     */
+    bool caps[MIGRATION_CAPABILITY__MAX];
 } MigrateStart;
 
 typedef enum PostcopyRecoveryFailStage {
@@ -207,7 +215,6 @@ typedef struct {
 
     /* Postcopy specific fields */
     void *postcopy_data;
-    bool postcopy_preempt;
     PostcopyRecoveryFailStage postcopy_recovery_fail_stage;
 } MigrateCommon;
 
diff --git a/tests/qtest/migration/misc-tests.c b/tests/qtest/migration/misc-tests.c
index 2e612d9e38..54995256d8 100644
--- a/tests/qtest/migration/misc-tests.c
+++ b/tests/qtest/migration/misc-tests.c
@@ -98,6 +98,7 @@ static void test_ignore_shared(void)
     QTestState *from, *to;
     MigrateStart args = {
         .use_shmem = true,
+        .caps[MIGRATION_CAPABILITY_X_IGNORE_SHARED] = true,
     };
 
     if (migrate_start(&from, &to, uri, &args)) {
@@ -107,9 +108,6 @@ static void test_ignore_shared(void)
     migrate_ensure_non_converge(from);
     migrate_prepare_for_dirty_mem(from);
 
-    migrate_set_capability(from, "x-ignore-shared", true);
-    migrate_set_capability(to, "x-ignore-shared", true);
-
     /* Wait for the first serial output from the source */
     wait_for_serial("src_serial");
 
diff --git a/tests/qtest/migration/postcopy-tests.c b/tests/qtest/migration/postcopy-tests.c
index 982457bed1..483e3ff99f 100644
--- a/tests/qtest/migration/postcopy-tests.c
+++ b/tests/qtest/migration/postcopy-tests.c
@@ -39,7 +39,9 @@ static void test_postcopy_suspend(void)
 static void test_postcopy_preempt(void)
 {
     MigrateCommon args = {
-        .postcopy_preempt = true,
+        .start = {
+            .caps[MIGRATION_CAPABILITY_POSTCOPY_PREEMPT] = true,
+        },
     };
 
     test_postcopy_common(&args);
@@ -73,7 +75,9 @@ static void test_postcopy_recovery_fail_reconnect(void)
 static void test_postcopy_preempt_recovery(void)
 {
     MigrateCommon args = {
-        .postcopy_preempt = true,
+        .start = {
+            .caps[MIGRATION_CAPABILITY_POSTCOPY_PREEMPT] = true,
+        },
     };
 
     test_postcopy_recovery_common(&args);
diff --git a/tests/qtest/migration/precopy-tests.c b/tests/qtest/migration/precopy-tests.c
index 565630dddf..87b0a7e8ef 100644
--- a/tests/qtest/migration/precopy-tests.c
+++ b/tests/qtest/migration/precopy-tests.c
@@ -170,23 +170,14 @@ static void test_precopy_tcp_plain(void)
     test_precopy_common(&args);
 }
 
-static void *migrate_hook_start_switchover_ack(QTestState *from, QTestState *to)
-{
-
-    migrate_set_capability(from, "return-path", true);
-    migrate_set_capability(to, "return-path", true);
-
-    migrate_set_capability(from, "switchover-ack", true);
-    migrate_set_capability(to, "switchover-ack", true);
-
-    return NULL;
-}
-
 static void test_precopy_tcp_switchover_ack(void)
 {
     MigrateCommon args = {
         .listen_uri = "tcp:127.0.0.1:0",
-        .start_hook = migrate_hook_start_switchover_ack,
+        .start = {
+            .caps[MIGRATION_CAPABILITY_RETURN_PATH] = true,
+            .caps[MIGRATION_CAPABILITY_SWITCHOVER_ACK] = true,
+        },
         /*
          * Source VM must be running in order to consider the switchover ACK
          * when deciding to do switchover or not.
@@ -455,6 +446,9 @@ static void test_multifd_tcp_uri_none(void)
     MigrateCommon args = {
         .listen_uri = "defer",
         .start_hook = migrate_hook_start_precopy_tcp_multifd,
+        .start = {
+            .caps[MIGRATION_CAPABILITY_MULTIFD] = true,
+        },
         /*
          * Multifd is more complicated than most of the features, it
          * directly takes guest page buffers when sending, make sure
@@ -470,6 +464,9 @@ static void test_multifd_tcp_zero_page_legacy(void)
     MigrateCommon args = {
         .listen_uri = "defer",
         .start_hook = migrate_hook_start_precopy_tcp_multifd_zero_page_legacy,
+        .start = {
+            .caps[MIGRATION_CAPABILITY_MULTIFD] = true,
+        },
         /*
          * Multifd is more complicated than most of the features, it
          * directly takes guest page buffers when sending, make sure
@@ -485,6 +482,9 @@ static void test_multifd_tcp_no_zero_page(void)
     MigrateCommon args = {
         .listen_uri = "defer",
         .start_hook = migrate_hook_start_precopy_tcp_multifd_no_zero_page,
+        .start = {
+            .caps[MIGRATION_CAPABILITY_MULTIFD] = true,
+        },
         /*
          * Multifd is more complicated than most of the features, it
          * directly takes guest page buffers when sending, make sure
@@ -501,6 +501,9 @@ static void test_multifd_tcp_channels_none(void)
         .listen_uri = "defer",
         .start_hook = migrate_hook_start_precopy_tcp_multifd,
         .live = true,
+        .start = {
+            .caps[MIGRATION_CAPABILITY_MULTIFD] = true,
+        },
         .connect_channels = ("[ { 'channel-type': 'main',"
                              "    'addr': { 'transport': 'socket',"
                              "              'type': 'inet',"
diff --git a/tests/qtest/migration/tls-tests.c b/tests/qtest/migration/tls-tests.c
index 2cb4a44bcd..72f44defbb 100644
--- a/tests/qtest/migration/tls-tests.c
+++ b/tests/qtest/migration/tls-tests.c
@@ -375,9 +375,11 @@ static void test_postcopy_tls_psk(void)
 static void test_postcopy_preempt_tls_psk(void)
 {
     MigrateCommon args = {
-        .postcopy_preempt = true,
         .start_hook = migrate_hook_start_tls_psk_match,
         .end_hook = migrate_hook_end_tls_psk,
+        .start = {
+            .caps[MIGRATION_CAPABILITY_POSTCOPY_PREEMPT] = true,
+        },
     };
 
     test_postcopy_common(&args);
@@ -397,9 +399,11 @@ static void test_postcopy_recovery_tls_psk(void)
 static void test_postcopy_preempt_all(void)
 {
     MigrateCommon args = {
-        .postcopy_preempt = true,
         .start_hook = migrate_hook_start_tls_psk_match,
         .end_hook = migrate_hook_end_tls_psk,
+        .start = {
+            .caps[MIGRATION_CAPABILITY_POSTCOPY_PREEMPT] = true,
+        },
     };
 
     test_postcopy_recovery_common(&args);
@@ -631,6 +635,9 @@ static void test_multifd_tcp_tls_psk_match(void)
         .listen_uri = "defer",
         .start_hook = migrate_hook_start_multifd_tcp_tls_psk_match,
         .end_hook = migrate_hook_end_tls_psk,
+        .start = {
+            .caps[MIGRATION_CAPABILITY_MULTIFD] = true,
+        },
     };
     test_precopy_common(&args);
 }
@@ -640,6 +647,7 @@ static void test_multifd_tcp_tls_psk_mismatch(void)
     MigrateCommon args = {
         .start = {
             .hide_stderr = true,
+            .caps[MIGRATION_CAPABILITY_MULTIFD] = true,
         },
         .listen_uri = "defer",
         .start_hook = migrate_hook_start_multifd_tcp_tls_psk_mismatch,
@@ -656,6 +664,9 @@ static void test_multifd_tcp_tls_x509_default_host(void)
         .listen_uri = "defer",
         .start_hook = migrate_hook_start_multifd_tls_x509_default_host,
         .end_hook = migrate_hook_end_tls_x509,
+        .start = {
+            .caps[MIGRATION_CAPABILITY_MULTIFD] = true,
+        },
     };
     test_precopy_common(&args);
 }
@@ -666,6 +677,9 @@ static void test_multifd_tcp_tls_x509_override_host(void)
         .listen_uri = "defer",
         .start_hook = migrate_hook_start_multifd_tls_x509_override_host,
         .end_hook = migrate_hook_end_tls_x509,
+        .start = {
+            .caps[MIGRATION_CAPABILITY_MULTIFD] = true,
+        },
     };
     test_precopy_common(&args);
 }
@@ -688,6 +702,7 @@ static void test_multifd_tcp_tls_x509_mismatch_host(void)
     MigrateCommon args = {
         .start = {
             .hide_stderr = true,
+            .caps[MIGRATION_CAPABILITY_MULTIFD] = true,
         },
         .listen_uri = "defer",
         .start_hook = migrate_hook_start_multifd_tls_x509_mismatch_host,
@@ -703,6 +718,9 @@ static void test_multifd_tcp_tls_x509_allow_anon_client(void)
         .listen_uri = "defer",
         .start_hook = migrate_hook_start_multifd_tls_x509_allow_anon_client,
         .end_hook = migrate_hook_end_tls_x509,
+        .start = {
+            .caps[MIGRATION_CAPABILITY_MULTIFD] = true,
+        },
     };
     test_precopy_common(&args);
 }
@@ -712,6 +730,7 @@ static void test_multifd_tcp_tls_x509_reject_anon_client(void)
     MigrateCommon args = {
         .start = {
             .hide_stderr = true,
+            .caps[MIGRATION_CAPABILITY_MULTIFD] = true,
         },
         .listen_uri = "defer",
         .start_hook = migrate_hook_start_multifd_tls_x509_reject_anon_client,

From 20d82622812d888478d04a2d0d8575d70eb5d749 Mon Sep 17 00:00:00 2001
From: Peter Xu <peterx@redhat.com>
Date: Thu, 24 Apr 2025 18:07:05 -0400
Subject: [PATCH 0593/2760] migration/postcopy: Spatial locality page hint for
 preempt mode

The preempt mode postcopy has been introduced for a while.  From latency
POV, it should always win the vanilla postcopy.

However there's one thing missing when preempt mode is enabled right now,
which is the spatial locality hint when there're page requests from the
destination side.

In vanilla postcopy, as long as a page request was unqueued, it will update
the PSS of the precopy background stream, so that after a page request the
background thread will move the pages after whatever was requested.  It's
pretty much a natural behavior when there's only one channel anyway, and
one scanner to send the pages.

Preempt mode didn't follow that, because preempt mode has its own channel
and its own PSS (which doesn't linearly scan the guest memory, but
dedicated to resolve page requested from destination).  So the page request
process and the background migration process are completely separate.

This patch adds the hint explicitly for preempt mode.  With that, whenever
the preempt mode receives a page request on the source, it will service the
remote page fault in the return path, then it'll provide a hint to the
background thread so that we'll start sending the pages right after the
requested ones in the background, assuming the follow up pages have a
higher chance to be accessed later.

NOTE: since the background migration thread and return path thread run
completely concurrently, it doesn't always mean the hint will be applied
every single time.  For example, it's possible that the return path thread
receives multiple page requests in a row without the background thread
getting the chance to consume one.  In such case, the preempt thread only
provide the hint if the previous hint has been consumed.  After all,
there's no point queuing hints when we only have one linear scanner.

This could measureably improve the simple sequential memory access pattern
during postcopy (when preempt is on).  For random accesses, I can measure a
slight increase of remote page fault latency from ~500us -> ~600us, that
could be a trade-off to have such hint mechanism, and after all that's
still greatly improved comparing to vanilla postcopy on random (~10ms).

The patch is verified by our QE team in a video streaming test case, to
reduce the pause of the video from ~1min to a few seconds when switching
over to postcopy with preempt mode.

Reported-by: Xiaohui Li <xiaohli@redhat.com>
Tested-by: Xiaohui Li <xiaohli@redhat.com>
Reviewed-by: Juraj Marcin <jmarcin@redhat.com>
Link: https://lore.kernel.org/r/20250424220705.195544-1-peterx@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/ram.c | 97 ++++++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 96 insertions(+), 1 deletion(-)

diff --git a/migration/ram.c b/migration/ram.c
index a749e4a421..e12913b43e 100644
--- a/migration/ram.c
+++ b/migration/ram.c
@@ -91,6 +91,36 @@
 
 XBZRLECacheStats xbzrle_counters;
 
+/*
+ * This structure locates a specific location of a guest page.  In QEMU,
+ * it's described in a tuple of (ramblock, offset).
+ */
+struct PageLocation {
+    RAMBlock *block;
+    unsigned long offset;
+};
+typedef struct PageLocation PageLocation;
+
+/**
+ * PageLocationHint: describes a hint to a page location
+ *
+ * @valid     set if the hint is vaild and to be consumed
+ * @location: the hint content
+ *
+ * In postcopy preempt mode, the urgent channel may provide hints to the
+ * background channel, so that QEMU source can try to migrate whatever is
+ * right after the requested urgent pages.
+ *
+ * This is based on the assumption that the VM (already running on the
+ * destination side) tends to access the memory with spatial locality.
+ * This is also the default behavior of vanilla postcopy (preempt off).
+ */
+struct PageLocationHint {
+    bool valid;
+    PageLocation location;
+};
+typedef struct PageLocationHint PageLocationHint;
+
 /* used by the search for pages to send */
 struct PageSearchStatus {
     /* The migration channel used for a specific host page */
@@ -395,6 +425,13 @@ struct RAMState {
      * RAM migration.
      */
     unsigned int postcopy_bmap_sync_requested;
+    /*
+     * Page hint during postcopy when preempt mode is on.  Return path
+     * thread sets it, while background migration thread consumes it.
+     *
+     * Protected by @bitmap_mutex.
+     */
+    PageLocationHint page_hint;
 };
 typedef struct RAMState RAMState;
 
@@ -2019,6 +2056,21 @@ static void pss_host_page_finish(PageSearchStatus *pss)
     pss->host_page_start = pss->host_page_end = 0;
 }
 
+static void ram_page_hint_update(RAMState *rs, PageSearchStatus *pss)
+{
+    PageLocationHint *hint = &rs->page_hint;
+
+    /* If there's a pending hint not consumed, don't bother */
+    if (hint->valid) {
+        return;
+    }
+
+    /* Provide a hint to the background stream otherwise */
+    hint->location.block = pss->block;
+    hint->location.offset = pss->page;
+    hint->valid = true;
+}
+
 /*
  * Send an urgent host page specified by `pss'.  Need to be called with
  * bitmap_mutex held.
@@ -2064,6 +2116,7 @@ out:
     /* For urgent requests, flush immediately if sent */
     if (sent) {
         qemu_fflush(pss->pss_channel);
+        ram_page_hint_update(rs, pss);
     }
     return ret;
 }
@@ -2151,6 +2204,30 @@ static int ram_save_host_page(RAMState *rs, PageSearchStatus *pss)
     return (res < 0 ? res : pages);
 }
 
+static bool ram_page_hint_valid(RAMState *rs)
+{
+    /* There's only page hint during postcopy preempt mode */
+    if (!postcopy_preempt_active()) {
+        return false;
+    }
+
+    return rs->page_hint.valid;
+}
+
+static void ram_page_hint_collect(RAMState *rs, RAMBlock **block,
+                                  unsigned long *page)
+{
+    PageLocationHint *hint = &rs->page_hint;
+
+    assert(hint->valid);
+
+    *block = hint->location.block;
+    *page = hint->location.offset;
+
+    /* Mark the hint consumed */
+    hint->valid = false;
+}
+
 /**
  * ram_find_and_save_block: finds a dirty page and sends it to f
  *
@@ -2167,6 +2244,8 @@ static int ram_save_host_page(RAMState *rs, PageSearchStatus *pss)
 static int ram_find_and_save_block(RAMState *rs)
 {
     PageSearchStatus *pss = &rs->pss[RAM_CHANNEL_PRECOPY];
+    unsigned long next_page;
+    RAMBlock *next_block;
     int pages = 0;
 
     /* No dirty page as there is zero RAM */
@@ -2186,7 +2265,14 @@ static int ram_find_and_save_block(RAMState *rs)
         rs->last_page = 0;
     }
 
-    pss_init(pss, rs->last_seen_block, rs->last_page);
+    if (ram_page_hint_valid(rs)) {
+        ram_page_hint_collect(rs, &next_block, &next_page);
+    } else {
+        next_block = rs->last_seen_block;
+        next_page = rs->last_page;
+    }
+
+    pss_init(pss, next_block, next_page);
 
     while (true){
         if (!get_queued_page(rs, pss)) {
@@ -2319,6 +2405,13 @@ static void ram_save_cleanup(void *opaque)
     ram_state_cleanup(rsp);
 }
 
+static void ram_page_hint_reset(PageLocationHint *hint)
+{
+    hint->location.block = NULL;
+    hint->location.offset = 0;
+    hint->valid = false;
+}
+
 static void ram_state_reset(RAMState *rs)
 {
     int i;
@@ -2331,6 +2424,8 @@ static void ram_state_reset(RAMState *rs)
     rs->last_page = 0;
     rs->last_version = ram_list.version;
     rs->xbzrle_started = false;
+
+    ram_page_hint_reset(&rs->page_hint);
 }
 
 #define MAX_WAIT 50 /* ms, half buffered_file limit */

From 0bafd6e9cbcdb1d857240f9f8c5df98a472b1b27 Mon Sep 17 00:00:00 2001
From: Jack Wang <jinpu.wang@ionos.com>
Date: Wed, 2 Apr 2025 07:13:06 +0200
Subject: [PATCH 0594/2760] migration/rdma: Remove qemu_rdma_broken_ipv6_kernel

I hit following error which testing migration in pure RoCE env:
"-incoming rdma:[::]:8089: RDMA ERROR: You only have RoCE / iWARP devices in your
systems and your management software has specified '[::]', but IPv6 over RoCE /
iWARP is not supported in Linux.#012'."

In our setup, we use rdma bind on ipv6 on target host, while connect from source
with ipv4, remove the qemu_rdma_broken_ipv6_kernel, migration just work
fine.

Checking the git history, the function was added since introducing of
rdma migration, which is more than 10 years ago. linux-rdma has
improved support on RoCE/iWARP for ipv6 over past years. There are a few fixes
back in 2016 seems related to the issue, eg:
aeb76df46d11 ("IB/core: Set routable RoCE gid type for ipv4/ipv6 networks")

other fixes back in 2018, eg:
052eac6eeb56 RDMA/cma: Update RoCE multicast routines to use net namespace
8d20a1f0ecd5 RDMA/cma: Fix rdma_cm raw IB path setting for RoCE
9327c7afdce3 RDMA/cma: Provide a function to set RoCE path record L2 parameters
5c181bda77f4 RDMA/cma: Set default GID type as RoCE when resolving RoCE route
3c7f67d1880d IB/cma: Fix default RoCE type setting
be1d325a3358 IB/core: Set RoCEv2 MGID according to spec
63a5f483af0e IB/cma: Set default gid type to RoCEv2

So remove the outdated function and it's usage.

Cc: Peter Xu <peterx@redhat.com>
Cc: Li Zhijian <lizhijian@fujitsu.com>
Cc: Yu Zhang <yu.zhang@ionos.com>
Cc: Fabiano Rosas <farosas@suse.de>
Cc: qemu-devel@nongnu.org
Cc: linux-rdma@vger.kernel.org
Cc: michael@flatgalaxy.com
Signed-off-by: Jack Wang <jinpu.wang@ionos.com>
Tested-by: Li zhijian <lizhijian@fujitsu.com>
Reviewed-by: Michael Galaxy <mrgalaxy@nvidia.com>
Link: https://lore.kernel.org/r/20250402051306.6509-1-jinpu.wang@ionos.com
[peterx: some cosmetic changes]
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/rdma.c | 180 ++---------------------------------------------
 1 file changed, 4 insertions(+), 176 deletions(-)

diff --git a/migration/rdma.c b/migration/rdma.c
index 4875ca1987..2d839fce6c 100644
--- a/migration/rdma.c
+++ b/migration/rdma.c
@@ -767,149 +767,6 @@ static void qemu_rdma_dump_gid(const char *who, struct rdma_cm_id *id)
     trace_qemu_rdma_dump_gid(who, sgid, dgid);
 }
 
-/*
- * As of now, IPv6 over RoCE / iWARP is not supported by linux.
- * We will try the next addrinfo struct, and fail if there are
- * no other valid addresses to bind against.
- *
- * If user is listening on '[::]', then we will not have a opened a device
- * yet and have no way of verifying if the device is RoCE or not.
- *
- * In this case, the source VM will throw an error for ALL types of
- * connections (both IPv4 and IPv6) if the destination machine does not have
- * a regular infiniband network available for use.
- *
- * The only way to guarantee that an error is thrown for broken kernels is
- * for the management software to choose a *specific* interface at bind time
- * and validate what time of hardware it is.
- *
- * Unfortunately, this puts the user in a fix:
- *
- *  If the source VM connects with an IPv4 address without knowing that the
- *  destination has bound to '[::]' the migration will unconditionally fail
- *  unless the management software is explicitly listening on the IPv4
- *  address while using a RoCE-based device.
- *
- *  If the source VM connects with an IPv6 address, then we're OK because we can
- *  throw an error on the source (and similarly on the destination).
- *
- *  But in mixed environments, this will be broken for a while until it is fixed
- *  inside linux.
- *
- * We do provide a *tiny* bit of help in this function: We can list all of the
- * devices in the system and check to see if all the devices are RoCE or
- * Infiniband.
- *
- * If we detect that we have a *pure* RoCE environment, then we can safely
- * thrown an error even if the management software has specified '[::]' as the
- * bind address.
- *
- * However, if there is are multiple hetergeneous devices, then we cannot make
- * this assumption and the user just has to be sure they know what they are
- * doing.
- *
- * Patches are being reviewed on linux-rdma.
- */
-static int qemu_rdma_broken_ipv6_kernel(struct ibv_context *verbs, Error **errp)
-{
-    /* This bug only exists in linux, to our knowledge. */
-#ifdef CONFIG_LINUX
-    struct ibv_port_attr port_attr;
-
-    /*
-     * Verbs are only NULL if management has bound to '[::]'.
-     *
-     * Let's iterate through all the devices and see if there any pure IB
-     * devices (non-ethernet).
-     *
-     * If not, then we can safely proceed with the migration.
-     * Otherwise, there are no guarantees until the bug is fixed in linux.
-     */
-    if (!verbs) {
-        int num_devices;
-        struct ibv_device **dev_list = ibv_get_device_list(&num_devices);
-        bool roce_found = false;
-        bool ib_found = false;
-
-        for (int x = 0; x < num_devices; x++) {
-            verbs = ibv_open_device(dev_list[x]);
-            /*
-             * ibv_open_device() is not documented to set errno.  If
-             * it does, it's somebody else's doc bug.  If it doesn't,
-             * the use of errno below is wrong.
-             * TODO Find out whether ibv_open_device() sets errno.
-             */
-            if (!verbs) {
-                if (errno == EPERM) {
-                    continue;
-                } else {
-                    error_setg_errno(errp, errno,
-                                     "could not open RDMA device context");
-                    return -1;
-                }
-            }
-
-            if (ibv_query_port(verbs, 1, &port_attr)) {
-                ibv_close_device(verbs);
-                error_setg(errp,
-                           "RDMA ERROR: Could not query initial IB port");
-                return -1;
-            }
-
-            if (port_attr.link_layer == IBV_LINK_LAYER_INFINIBAND) {
-                ib_found = true;
-            } else if (port_attr.link_layer == IBV_LINK_LAYER_ETHERNET) {
-                roce_found = true;
-            }
-
-            ibv_close_device(verbs);
-
-        }
-
-        if (roce_found) {
-            if (ib_found) {
-                warn_report("migrations may fail:"
-                            " IPv6 over RoCE / iWARP in linux"
-                            " is broken. But since you appear to have a"
-                            " mixed RoCE / IB environment, be sure to only"
-                            " migrate over the IB fabric until the kernel "
-                            " fixes the bug.");
-            } else {
-                error_setg(errp, "RDMA ERROR: "
-                           "You only have RoCE / iWARP devices in your systems"
-                           " and your management software has specified '[::]'"
-                           ", but IPv6 over RoCE / iWARP is not supported in Linux.");
-                return -1;
-            }
-        }
-
-        return 0;
-    }
-
-    /*
-     * If we have a verbs context, that means that some other than '[::]' was
-     * used by the management software for binding. In which case we can
-     * actually warn the user about a potentially broken kernel.
-     */
-
-    /* IB ports start with 1, not 0 */
-    if (ibv_query_port(verbs, 1, &port_attr)) {
-        error_setg(errp, "RDMA ERROR: Could not query initial IB port");
-        return -1;
-    }
-
-    if (port_attr.link_layer == IBV_LINK_LAYER_ETHERNET) {
-        error_setg(errp, "RDMA ERROR: "
-                   "Linux kernel's RoCE / iWARP does not support IPv6 "
-                   "(but patches on linux-rdma in progress)");
-        return -1;
-    }
-
-#endif
-
-    return 0;
-}
-
 /*
  * Figure out which RDMA device corresponds to the requested IP hostname
  * Also create the initial connection manager identifiers for opening
@@ -917,7 +774,6 @@ static int qemu_rdma_broken_ipv6_kernel(struct ibv_context *verbs, Error **errp)
  */
 static int qemu_rdma_resolve_host(RDMAContext *rdma, Error **errp)
 {
-    Error *err = NULL;
     int ret;
     struct rdma_addrinfo *res;
     char port_str[16];
@@ -953,9 +809,8 @@ static int qemu_rdma_resolve_host(RDMAContext *rdma, Error **errp)
         goto err_resolve_get_addr;
     }
 
-    /* Try all addresses, saving the first error in @err */
+    /* Try all addresses, exit loop on first success of resolving address */
     for (struct rdma_addrinfo *e = res; e != NULL; e = e->ai_next) {
-        Error **local_errp = err ? NULL : &err;
 
         inet_ntop(e->ai_family,
             &((struct sockaddr_in *) e->ai_dst_addr)->sin_addr, ip, sizeof ip);
@@ -964,25 +819,12 @@ static int qemu_rdma_resolve_host(RDMAContext *rdma, Error **errp)
         ret = rdma_resolve_addr(rdma->cm_id, NULL, e->ai_dst_addr,
                 RDMA_RESOLVE_TIMEOUT_MS);
         if (ret >= 0) {
-            if (e->ai_family == AF_INET6) {
-                ret = qemu_rdma_broken_ipv6_kernel(rdma->cm_id->verbs,
-                                                   local_errp);
-                if (ret < 0) {
-                    continue;
-                }
-            }
-            error_free(err);
             goto route;
         }
     }
 
     rdma_freeaddrinfo(res);
-    if (err) {
-        error_propagate(errp, err);
-    } else {
-        error_setg(errp, "RDMA ERROR: could not resolve address %s",
-                   rdma->host);
-    }
+    error_setg(errp, "RDMA ERROR: could not resolve address %s", rdma->host);
     goto err_resolve_get_addr;
 
 route:
@@ -2611,7 +2453,6 @@ err_rdma_source_connect:
 
 static int qemu_rdma_dest_init(RDMAContext *rdma, Error **errp)
 {
-    Error *err = NULL;
     int ret;
     struct rdma_cm_id *listen_id;
     char ip[40] = "unknown";
@@ -2661,9 +2502,8 @@ static int qemu_rdma_dest_init(RDMAContext *rdma, Error **errp)
         goto err_dest_init_bind_addr;
     }
 
-    /* Try all addresses, saving the first error in @err */
+    /* Try all addresses */
     for (e = res; e != NULL; e = e->ai_next) {
-        Error **local_errp = err ? NULL : &err;
 
         inet_ntop(e->ai_family,
             &((struct sockaddr_in *) e->ai_dst_addr)->sin_addr, ip, sizeof ip);
@@ -2672,24 +2512,12 @@ static int qemu_rdma_dest_init(RDMAContext *rdma, Error **errp)
         if (ret < 0) {
             continue;
         }
-        if (e->ai_family == AF_INET6) {
-            ret = qemu_rdma_broken_ipv6_kernel(listen_id->verbs,
-                                               local_errp);
-            if (ret < 0) {
-                continue;
-            }
-        }
-        error_free(err);
         break;
     }
 
     rdma_freeaddrinfo(res);
     if (!e) {
-        if (err) {
-            error_propagate(errp, err);
-        } else {
-            error_setg(errp, "RDMA ERROR: Error: could not rdma_bind_addr!");
-        }
+        error_setg(errp, "RDMA ERROR: Error: could not rdma_bind_addr!");
         goto err_dest_init_bind_addr;
     }
 

From e674fedbd1fd9953bc30026670aba6779848280a Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Tue, 29 Apr 2025 17:21:39 +0200
Subject: [PATCH 0595/2760] scripts/vmstate-static-checker.py: Allow new name
 for ghes_addr_le field

ghes_addr_le has been renamed to hw_error_le in commit 652f6d86cbb
("acpi/ghes: better name the offset of the hardware error firmware").
Adjust the checker script to allow that changed field name.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Link: https://lore.kernel.org/r/20250429152141.294380-3-thuth@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 scripts/vmstate-static-checker.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/scripts/vmstate-static-checker.py b/scripts/vmstate-static-checker.py
index 9c0e6b81f2..25aca839a0 100755
--- a/scripts/vmstate-static-checker.py
+++ b/scripts/vmstate-static-checker.py
@@ -42,6 +42,7 @@ def check_fields_match(name, s_field, d_field):
     # Some fields changed names between qemu versions.  This list
     # is used to allow such changes in each section / description.
     changed_names = {
+        'acpi-ghes': ['ghes_addr_le', 'hw_error_le'],
         'apic': ['timer', 'timer_expiry'],
         'e1000': ['dev', 'parent_obj'],
         'ehci': ['dev', 'pcidev'],

From 6f8e6aed81277ec14d5a5dcafdd00dadf7ac465c Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Mon, 14 Apr 2025 22:49:35 +0800
Subject: [PATCH 0596/2760] rust/vmstate: Add support for field_exists checks

Unfortunately, at present it's not possible to have a const
"with_exist_check" method to append test_fn after vmstate_struct (due
to error on "constant functions cannot evaluate destructors" for `F`).

Before the vmstate builder, the only way to support "test_fn" is to
extend vmstate_struct macro to add the such new optional member (and
fortunately, Rust can still parse the current expansion!).

Abstract the previous callback implementation of vmstate_validate into
a separate macro, and moves it before vmstate_struct for vmstate_struct
to call.

Note that there's no need to add any extra flag for a new test_fn added
in the VMStateField.

Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250414144943.1112885-2-zhao1.liu@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/qemu-api/src/vmstate.rs | 70 +++++++++++++++++++-----------------
 1 file changed, 37 insertions(+), 33 deletions(-)

diff --git a/rust/qemu-api/src/vmstate.rs b/rust/qemu-api/src/vmstate.rs
index 1b2b12eadd..8c4a5bee3c 100644
--- a/rust/qemu-api/src/vmstate.rs
+++ b/rust/qemu-api/src/vmstate.rs
@@ -200,13 +200,14 @@ pub const fn vmstate_varray_flag<T: VMState>(_: PhantomData<T>) -> VMStateFlags
 /// and [`impl_vmstate_forward!`](crate::impl_vmstate_forward) help with this.
 #[macro_export]
 macro_rules! vmstate_of {
-    ($struct_name:ty, $field_name:ident $([0 .. $num:ident $(* $factor:expr)?])? $(,)?) => {
+    ($struct_name:ty, $field_name:ident $([0 .. $num:ident $(* $factor:expr)?])? $(, $test_fn:expr)? $(,)?) => {
         $crate::bindings::VMStateField {
             name: ::core::concat!(::core::stringify!($field_name), "\0")
                 .as_bytes()
                 .as_ptr() as *const ::std::os::raw::c_char,
             offset: $crate::offset_of!($struct_name, $field_name),
             $(num_offset: $crate::offset_of!($struct_name, $num),)?
+            $(field_exists: $crate::vmstate_exist_fn!($struct_name, $test_fn),)?
             // The calls to `call_func_with_field!` are the magic that
             // computes most of the VMStateField from the type of the field.
             info: $crate::info_enum_to_ref!($crate::call_func_with_field!(
@@ -435,6 +436,38 @@ macro_rules! vmstate_unused {
     }};
 }
 
+pub extern "C" fn rust_vms_test_field_exists<T, F: for<'a> FnCall<(&'a T, u8), bool>>(
+    opaque: *mut c_void,
+    version_id: c_int,
+) -> bool {
+    // SAFETY: the opaque was passed as a reference to `T`.
+    let owner: &T = unsafe { &*(opaque.cast::<T>()) };
+    let version: u8 = version_id.try_into().unwrap();
+    F::call((owner, version))
+}
+
+pub type VMSFieldExistCb = unsafe extern "C" fn(
+    opaque: *mut std::os::raw::c_void,
+    version_id: std::os::raw::c_int,
+) -> bool;
+
+#[macro_export]
+macro_rules! vmstate_exist_fn {
+    ($struct_name:ty, $test_fn:expr) => {{
+        const fn test_cb_builder__<T, F: for<'a> $crate::callbacks::FnCall<(&'a T, u8), bool>>(
+            _phantom: ::core::marker::PhantomData<F>,
+        ) -> $crate::vmstate::VMSFieldExistCb {
+            let _: () = F::ASSERT_IS_SOME;
+            $crate::vmstate::rust_vms_test_field_exists::<T, F>
+        }
+
+        const fn phantom__<T>(_: &T) -> ::core::marker::PhantomData<T> {
+            ::core::marker::PhantomData
+        }
+        Some(test_cb_builder__::<$struct_name, _>(phantom__(&$test_fn)))
+    }};
+}
+
 // FIXME: including the `vmsd` field in a `const` is not possible without
 // the const_refs_static feature (stabilized in Rust 1.83.0).  Without it,
 // it is not possible to use VMS_STRUCT in a transparent manner using
@@ -445,7 +478,7 @@ macro_rules! vmstate_unused {
 #[doc(alias = "VMSTATE_STRUCT")]
 #[macro_export]
 macro_rules! vmstate_struct {
-    ($struct_name:ty, $field_name:ident $([0 .. $num:ident $(* $factor:expr)?])?, $vmsd:expr, $type:ty $(,)?) => {
+    ($struct_name:ty, $field_name:ident $([0 .. $num:ident $(* $factor:expr)?])?, $vmsd:expr, $type:ty $(, $test_fn:expr)? $(,)?) => {
         $crate::bindings::VMStateField {
             name: ::core::concat!(::core::stringify!($field_name), "\0")
                 .as_bytes()
@@ -458,6 +491,7 @@ macro_rules! vmstate_struct {
             size: ::core::mem::size_of::<$type>(),
             flags: $crate::bindings::VMStateFlags::VMS_STRUCT,
             vmsd: $vmsd,
+            $(field_exists: $crate::vmstate_exist_fn!($struct_name, $test_fn),)?
             ..$crate::zeroable::Zeroable::ZERO
          } $(.with_varray_flag_unchecked(
                   $crate::call_func_with_field!(
@@ -514,43 +548,13 @@ macro_rules! vmstate_fields {
     }}
 }
 
-pub extern "C" fn rust_vms_test_field_exists<T, F: for<'a> FnCall<(&'a T, u8), bool>>(
-    opaque: *mut c_void,
-    version_id: c_int,
-) -> bool {
-    let owner: &T = unsafe { &*(opaque.cast::<T>()) };
-    let version: u8 = version_id.try_into().unwrap();
-    // SAFETY: the opaque was passed as a reference to `T`.
-    F::call((owner, version))
-}
-
-pub type VMSFieldExistCb = unsafe extern "C" fn(
-    opaque: *mut std::os::raw::c_void,
-    version_id: std::os::raw::c_int,
-) -> bool;
-
 #[doc(alias = "VMSTATE_VALIDATE")]
 #[macro_export]
 macro_rules! vmstate_validate {
     ($struct_name:ty, $test_name:expr, $test_fn:expr $(,)?) => {
         $crate::bindings::VMStateField {
             name: ::std::ffi::CStr::as_ptr($test_name),
-            field_exists: {
-                const fn test_cb_builder__<
-                    T,
-                    F: for<'a> $crate::callbacks::FnCall<(&'a T, u8), bool>,
-                >(
-                    _phantom: ::core::marker::PhantomData<F>,
-                ) -> $crate::vmstate::VMSFieldExistCb {
-                    let _: () = F::ASSERT_IS_SOME;
-                    $crate::vmstate::rust_vms_test_field_exists::<T, F>
-                }
-
-                const fn phantom__<T>(_: &T) -> ::core::marker::PhantomData<T> {
-                    ::core::marker::PhantomData
-                }
-                Some(test_cb_builder__::<$struct_name, _>(phantom__(&$test_fn)))
-            },
+            field_exists: $crate::vmstate_exist_fn!($struct_name, $test_fn),
             flags: $crate::bindings::VMStateFlags(
                 $crate::bindings::VMStateFlags::VMS_MUST_EXIST.0
                     | $crate::bindings::VMStateFlags::VMS_ARRAY.0,

From 756ea88fff96252dd76cf388fb8678cb97dd2658 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 2 May 2025 09:45:38 +0200
Subject: [PATCH 0597/2760] vmstate: support varray for vmstate_clock!

Make vmstate_struct and vmstate_clock more similar; they are basically the
same thing, except for the clock case having a built-in VMStateDescription.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/qemu-api/src/vmstate.rs | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/rust/qemu-api/src/vmstate.rs b/rust/qemu-api/src/vmstate.rs
index 8c4a5bee3c..9ae97c389c 100644
--- a/rust/qemu-api/src/vmstate.rs
+++ b/rust/qemu-api/src/vmstate.rs
@@ -507,7 +507,7 @@ macro_rules! vmstate_struct {
 #[doc(alias = "VMSTATE_CLOCK")]
 #[macro_export]
 macro_rules! vmstate_clock {
-    ($struct_name:ty, $field_name:ident) => {{
+    ($struct_name:ty, $field_name:ident $([0 .. $num:ident $(* $factor:expr)?])?) => {{
         $crate::bindings::VMStateField {
             name: ::core::concat!(::core::stringify!($field_name), "\0")
                 .as_bytes()
@@ -516,7 +516,7 @@ macro_rules! vmstate_clock {
                 $crate::assert_field_type!(
                     $struct_name,
                     $field_name,
-                    $crate::qom::Owned<$crate::qdev::Clock>
+                    $crate::qom::Owned<$crate::qdev::Clock> $(, num = $num)?
                 );
                 $crate::offset_of!($struct_name, $field_name)
             },
@@ -527,7 +527,14 @@ macro_rules! vmstate_clock {
             ),
             vmsd: unsafe { ::core::ptr::addr_of!($crate::bindings::vmstate_clock) },
             ..$crate::zeroable::Zeroable::ZERO
-        }
+         } $(.with_varray_flag_unchecked(
+                  $crate::call_func_with_field!(
+                      $crate::vmstate::vmstate_varray_flag,
+                      $struct_name,
+                      $num
+                  )
+              )
+           $(.with_varray_multiply($factor))?)?
     }};
 }
 

From fff99a88be34c82270c918b711f8fc3affd504d5 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 2 May 2025 10:56:06 +0200
Subject: [PATCH 0598/2760] rust: assertions: Support index field wrapped in
 BqlCell

Currently, if the `num` field of a varray is not a numeric type, such as
being placed in a wrapper, the array variant of assert_field_type will
fail the check.

HPET currently wraps num_timers in BqlCell<>. Although BqlCell<> is not
necessary from strictly speaking, it makes sense for vmstate to respect
BqlCell.

The failure of assert_field_type is because it cannot convert BqlCell<T>
into usize for use as the index.  Use a constant 0 instead for the index,
by avoiding $(...)? and extracting the common parts of
assert_field_type! into an internal case.

Commit message based on a patch by Zhao Liu <zhao1.liu@intel.com>.

Link: https://lore.kernel.org/r/20250414144943.1112885-3-zhao1.liu@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/qemu-api/src/assertions.rs | 25 +++++++++----------------
 1 file changed, 9 insertions(+), 16 deletions(-)

diff --git a/rust/qemu-api/src/assertions.rs b/rust/qemu-api/src/assertions.rs
index eb12e9499a..a2d38c877d 100644
--- a/rust/qemu-api/src/assertions.rs
+++ b/rust/qemu-api/src/assertions.rs
@@ -78,33 +78,26 @@ macro_rules! assert_same_type {
 /// ```
 #[macro_export]
 macro_rules! assert_field_type {
-    ($t:ty, $i:tt, $ti:ty) => {
+    (@internal $param_name:ident, $ti:ty, $t:ty, $($field:tt)*) => {
         const _: () = {
             #[allow(unused)]
-            fn assert_field_type(v: $t) {
-                fn types_must_be_equal<T, U>(_: T)
+            fn assert_field_type($param_name: &$t) {
+                fn types_must_be_equal<T, U>(_: &T)
                 where
                     T: $crate::assertions::EqType<Itself = U>,
                 {
                 }
-                types_must_be_equal::<_, $ti>(v.$i);
+                types_must_be_equal::<_, $ti>(&$($field)*);
             }
         };
     };
 
+    ($t:ty, $i:tt, $ti:ty) => {
+        $crate::assert_field_type!(@internal v, $ti, $t, v.$i);
+    };
+
     ($t:ty, $i:tt, $ti:ty, num = $num:ident) => {
-        const _: () = {
-            #[allow(unused)]
-            fn assert_field_type(v: $t) {
-                fn types_must_be_equal<T, U>(_: T)
-                where
-                    T: $crate::assertions::EqType<Itself = U>,
-                {
-                }
-                let index: usize = v.$num.try_into().unwrap();
-                types_must_be_equal::<_, &$ti>(&v.$i[index]);
-            }
-        };
+        $crate::assert_field_type!(@internal v, $ti, $t, v.$i[0]);
     };
 }
 

From cff1ec67509cacc2ea30d19ba61fa0ab0772e119 Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Mon, 14 Apr 2025 22:49:37 +0800
Subject: [PATCH 0599/2760] rust/vmstate_test: Test varray with num field
 wrapped in BqlCell

Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250414144943.1112885-4-zhao1.liu@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/qemu-api/tests/vmstate_tests.rs | 41 ++++++++++++++++++++++------
 1 file changed, 33 insertions(+), 8 deletions(-)

diff --git a/rust/qemu-api/tests/vmstate_tests.rs b/rust/qemu-api/tests/vmstate_tests.rs
index 8b93492a68..f7a93117e1 100644
--- a/rust/qemu-api/tests/vmstate_tests.rs
+++ b/rust/qemu-api/tests/vmstate_tests.rs
@@ -28,7 +28,7 @@ const FOO_ARRAY_MAX: usize = 3;
 //     - VMSTATE_VARRAY_UINT16_UNSAFE
 //     - VMSTATE_VARRAY_MULTIPLY
 #[repr(C)]
-#[derive(qemu_api_macros::offsets)]
+#[derive(Default, qemu_api_macros::offsets)]
 struct FooA {
     arr: [u8; FOO_ARRAY_MAX],
     num: u16,
@@ -147,8 +147,9 @@ fn test_vmstate_varray_multiply() {
 //     - VMSTATE_STRUCT_VARRAY_UINT8
 //     - (no C version) MULTIPLY variant of VMSTATE_STRUCT_VARRAY_UINT32
 //     - VMSTATE_ARRAY
+//     - VMSTATE_STRUCT_VARRAY_UINT8 with BqlCell wrapper & test_fn
 #[repr(C)]
-#[derive(qemu_api_macros::offsets)]
+#[derive(Default, qemu_api_macros::offsets)]
 struct FooB {
     arr_a: [FooA; FOO_ARRAY_MAX],
     num_a: u8,
@@ -158,6 +159,12 @@ struct FooB {
     val: bool,
     // FIXME: Use Timer array. Now we can't since it's hard to link savevm.c to test.
     arr_i64: [i64; FOO_ARRAY_MAX],
+    arr_a_wrap: [FooA; FOO_ARRAY_MAX],
+    num_a_wrap: BqlCell<u32>,
+}
+
+fn validate_foob(_state: &FooB, _version_id: u8) -> bool {
+    true
 }
 
 static VMSTATE_FOOB: VMStateDescription = VMStateDescription {
@@ -170,13 +177,14 @@ static VMSTATE_FOOB: VMStateDescription = VMStateDescription {
         vmstate_struct!(FooB, arr_a[0 .. num_a], &VMSTATE_FOOA, FooA).with_version_id(1),
         vmstate_struct!(FooB, arr_a_mul[0 .. num_a_mul * 32], &VMSTATE_FOOA, FooA).with_version_id(2),
         vmstate_of!(FooB, arr_i64),
+        vmstate_struct!(FooB, arr_a_wrap[0 .. num_a_wrap], &VMSTATE_FOOA, FooA, validate_foob),
     },
     ..Zeroable::ZERO
 };
 
 #[test]
 fn test_vmstate_bool_v() {
-    let foo_fields: &[VMStateField] = unsafe { slice::from_raw_parts(VMSTATE_FOOB.fields, 6) };
+    let foo_fields: &[VMStateField] = unsafe { slice::from_raw_parts(VMSTATE_FOOB.fields, 7) };
 
     // 1st VMStateField ("val") in VMSTATE_FOOB (corresponding to VMSTATE_BOOL_V)
     assert_eq!(
@@ -196,7 +204,7 @@ fn test_vmstate_bool_v() {
 
 #[test]
 fn test_vmstate_uint64() {
-    let foo_fields: &[VMStateField] = unsafe { slice::from_raw_parts(VMSTATE_FOOB.fields, 6) };
+    let foo_fields: &[VMStateField] = unsafe { slice::from_raw_parts(VMSTATE_FOOB.fields, 7) };
 
     // 2nd VMStateField ("wrap") in VMSTATE_FOOB (corresponding to VMSTATE_U64)
     assert_eq!(
@@ -216,7 +224,7 @@ fn test_vmstate_uint64() {
 
 #[test]
 fn test_vmstate_struct_varray_uint8() {
-    let foo_fields: &[VMStateField] = unsafe { slice::from_raw_parts(VMSTATE_FOOB.fields, 6) };
+    let foo_fields: &[VMStateField] = unsafe { slice::from_raw_parts(VMSTATE_FOOB.fields, 7) };
 
     // 3rd VMStateField ("arr_a") in VMSTATE_FOOB (corresponding to
     // VMSTATE_STRUCT_VARRAY_UINT8)
@@ -240,7 +248,7 @@ fn test_vmstate_struct_varray_uint8() {
 
 #[test]
 fn test_vmstate_struct_varray_uint32_multiply() {
-    let foo_fields: &[VMStateField] = unsafe { slice::from_raw_parts(VMSTATE_FOOB.fields, 6) };
+    let foo_fields: &[VMStateField] = unsafe { slice::from_raw_parts(VMSTATE_FOOB.fields, 7) };
 
     // 4th VMStateField ("arr_a_mul") in VMSTATE_FOOB (corresponding to
     // (no C version) MULTIPLY variant of VMSTATE_STRUCT_VARRAY_UINT32)
@@ -266,7 +274,7 @@ fn test_vmstate_struct_varray_uint32_multiply() {
 
 #[test]
 fn test_vmstate_macro_array() {
-    let foo_fields: &[VMStateField] = unsafe { slice::from_raw_parts(VMSTATE_FOOB.fields, 6) };
+    let foo_fields: &[VMStateField] = unsafe { slice::from_raw_parts(VMSTATE_FOOB.fields, 7) };
 
     // 5th VMStateField ("arr_i64") in VMSTATE_FOOB (corresponding to
     // VMSTATE_ARRAY)
@@ -283,9 +291,26 @@ fn test_vmstate_macro_array() {
     assert_eq!(foo_fields[4].flags, VMStateFlags::VMS_ARRAY);
     assert!(foo_fields[4].vmsd.is_null());
     assert!(foo_fields[4].field_exists.is_none());
+}
+
+#[test]
+fn test_vmstate_struct_varray_uint8_wrapper() {
+    let foo_fields: &[VMStateField] = unsafe { slice::from_raw_parts(VMSTATE_FOOB.fields, 7) };
+    let mut foo_b: FooB = Default::default();
+    let foo_b_p = std::ptr::addr_of_mut!(foo_b).cast::<c_void>();
+
+    // 6th VMStateField ("arr_a_wrap") in VMSTATE_FOOB (corresponding to
+    // VMSTATE_STRUCT_VARRAY_UINT8). Other fields are checked in
+    // test_vmstate_struct_varray_uint8.
+    assert_eq!(
+        unsafe { CStr::from_ptr(foo_fields[5].name) }.to_bytes_with_nul(),
+        b"arr_a_wrap\0"
+    );
+    assert_eq!(foo_fields[5].num_offset, 228);
+    assert!(unsafe { foo_fields[5].field_exists.unwrap()(foo_b_p, 0) });
 
     // The last VMStateField in VMSTATE_FOOB.
-    assert_eq!(foo_fields[5].flags, VMStateFlags::VMS_END);
+    assert_eq!(foo_fields[6].flags, VMStateFlags::VMS_END);
 }
 
 // =========================== Test VMSTATE_FOOC ===========================

From 8d9502b4e947a9cfcf1d1940cc70d1579b53ecaf Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Mon, 14 Apr 2025 22:49:39 +0800
Subject: [PATCH 0600/2760] rust/timer: Define NANOSECONDS_PER_SECOND binding
 as u64

NANOSECONDS_PER_SECOND is often used in operations with get_ns(), which
currently returns a u64.

Therefore, define a new NANOSECONDS_PER_SECOND binding is with u64 type
to eliminate unnecessary type conversions (from u32 to u64).

Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250414144943.1112885-6-zhao1.liu@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/qemu-api/src/timer.rs | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/rust/qemu-api/src/timer.rs b/rust/qemu-api/src/timer.rs
index f0b04ef95d..e769f8bc91 100644
--- a/rust/qemu-api/src/timer.rs
+++ b/rust/qemu-api/src/timer.rs
@@ -121,3 +121,5 @@ impl ClockType {
 pub const CLOCK_VIRTUAL: ClockType = ClockType {
     id: QEMUClockType::QEMU_CLOCK_VIRTUAL,
 };
+
+pub const NANOSECONDS_PER_SECOND: u64 = 1000000000;

From db46654af893abed53dce35ebab86056ac9b3004 Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Mon, 14 Apr 2025 22:49:42 +0800
Subject: [PATCH 0601/2760] rust/hpet: Support migration

Based on commit 1433e38cc8 ("hpet: do not overwrite properties on
post_load"), add the basic migration support to Rust HPET.

The current migration implementation introduces multiple unsafe
callbacks. Before the vmstate builder, one possible cleanup approach is
to wrap callbacks in the vmstate binding using a method similar to the
vmstate_exist_fn macro.

However, this approach would also create a lot of repetitive code (since
vmstate has so many callbacks: pre_load, post_load, pre_save, post_save,
needed and dev_unplug_pending). Although it would be cleaner, it would
somewhat deviate from the path of the vmstate builder.

Therefore, firstly focus on completing the functionality of HPET, and
those current unsafe callbacks can at least clearly indicate the needed
functionality of vmstate. The next step is to consider refactoring
vmstate to move towards the vmstate builder direction.

Additionally, update rust.rst about Rust HPET can support migration.

Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250414144943.1112885-9-zhao1.liu@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 docs/devel/rust.rst            |   3 +-
 rust/hw/timer/hpet/src/hpet.rs | 146 ++++++++++++++++++++++++++++++++-
 2 files changed, 146 insertions(+), 3 deletions(-)

diff --git a/docs/devel/rust.rst b/docs/devel/rust.rst
index 88bdec1eb2..3cc2841d4d 100644
--- a/docs/devel/rust.rst
+++ b/docs/devel/rust.rst
@@ -153,8 +153,7 @@ QEMU includes four crates:
 
 .. [#issues] The ``pl011`` crate is synchronized with ``hw/char/pl011.c``
    as of commit 02b1f7f61928.  The ``hpet`` crate is synchronized as of
-   commit f32352ff9e.  Both are lacking tracing functionality; ``hpet``
-   is also lacking support for migration.
+   commit 1433e38cc8.  Both are lacking tracing functionality.
 
 This section explains how to work with them.
 
diff --git a/rust/hw/timer/hpet/src/hpet.rs b/rust/hw/timer/hpet/src/hpet.rs
index cbd2ed4f6b..12de2ba59a 100644
--- a/rust/hw/timer/hpet/src/hpet.rs
+++ b/rust/hw/timer/hpet/src/hpet.rs
@@ -4,6 +4,7 @@
 
 use std::{
     ffi::CStr,
+    os::raw::{c_int, c_void},
     pin::Pin,
     ptr::{addr_of_mut, null_mut, NonNull},
     slice::from_ref,
@@ -25,7 +26,10 @@ use qemu_api::{
     qom::{ObjectImpl, ObjectType, ParentField},
     qom_isa,
     sysbus::{SysBusDevice, SysBusDeviceImpl},
-    timer::{Timer, CLOCK_VIRTUAL},
+    timer::{Timer, CLOCK_VIRTUAL, NANOSECONDS_PER_SECOND},
+    vmstate::VMStateDescription,
+    vmstate_fields, vmstate_of, vmstate_struct, vmstate_subsections, vmstate_validate,
+    zeroable::Zeroable,
 };
 
 use crate::fw_cfg::HPETFwConfig;
@@ -561,6 +565,7 @@ pub struct HPETState {
     #[doc(alias = "timer")]
     timers: [BqlRefCell<HPETTimer>; HPET_MAX_TIMERS as usize],
     num_timers: BqlCell<u8>,
+    num_timers_save: BqlCell<u8>,
 
     /// Instance id (HPET timer block ID).
     hpet_id: BqlCell<usize>,
@@ -839,6 +844,49 @@ impl HPETState {
             }
         }
     }
+
+    fn pre_save(&self) -> i32 {
+        if self.is_hpet_enabled() {
+            self.counter.set(self.get_ticks());
+        }
+
+        /*
+         * The number of timers must match on source and destination, but it was
+         * also added to the migration stream.  Check that it matches the value
+         * that was configured.
+         */
+        self.num_timers_save.set(self.num_timers.get());
+        0
+    }
+
+    fn post_load(&self, _version_id: u8) -> i32 {
+        for timer in self.timers.iter().take(self.get_num_timers()) {
+            let mut t = timer.borrow_mut();
+
+            t.cmp64 = t.calculate_cmp64(t.get_state().counter.get(), t.cmp);
+            t.last = CLOCK_VIRTUAL.get_ns() - NANOSECONDS_PER_SECOND;
+        }
+
+        // Recalculate the offset between the main counter and guest time
+        if !self.hpet_offset_saved {
+            self.hpet_offset
+                .set(ticks_to_ns(self.counter.get()) - CLOCK_VIRTUAL.get_ns());
+        }
+
+        0
+    }
+
+    fn is_rtc_irq_level_needed(&self) -> bool {
+        self.rtc_irq_level.get() != 0
+    }
+
+    fn is_offset_needed(&self) -> bool {
+        self.is_hpet_enabled() && self.hpet_offset_saved
+    }
+
+    fn validate_num_timers(&self, _version_id: u8) -> bool {
+        self.num_timers.get() == self.num_timers_save.get()
+    }
 }
 
 qom_isa!(HPETState: SysBusDevice, DeviceState, Object);
@@ -895,11 +943,107 @@ qemu_api::declare_properties! {
     ),
 }
 
+unsafe extern "C" fn hpet_rtc_irq_level_needed(opaque: *mut c_void) -> bool {
+    // SAFETY:
+    // the pointer is convertible to a reference
+    let state: &HPETState = unsafe { NonNull::new(opaque.cast::<HPETState>()).unwrap().as_ref() };
+    state.is_rtc_irq_level_needed()
+}
+
+unsafe extern "C" fn hpet_offset_needed(opaque: *mut c_void) -> bool {
+    // SAFETY:
+    // the pointer is convertible to a reference
+    let state: &HPETState = unsafe { NonNull::new(opaque.cast::<HPETState>()).unwrap().as_ref() };
+    state.is_offset_needed()
+}
+
+unsafe extern "C" fn hpet_pre_save(opaque: *mut c_void) -> c_int {
+    // SAFETY:
+    // the pointer is convertible to a reference
+    let state: &mut HPETState =
+        unsafe { NonNull::new(opaque.cast::<HPETState>()).unwrap().as_mut() };
+    state.pre_save() as c_int
+}
+
+unsafe extern "C" fn hpet_post_load(opaque: *mut c_void, version_id: c_int) -> c_int {
+    // SAFETY:
+    // the pointer is convertible to a reference
+    let state: &mut HPETState =
+        unsafe { NonNull::new(opaque.cast::<HPETState>()).unwrap().as_mut() };
+    let version: u8 = version_id.try_into().unwrap();
+    state.post_load(version) as c_int
+}
+
+static VMSTATE_HPET_RTC_IRQ_LEVEL: VMStateDescription = VMStateDescription {
+    name: c_str!("hpet/rtc_irq_level").as_ptr(),
+    version_id: 1,
+    minimum_version_id: 1,
+    needed: Some(hpet_rtc_irq_level_needed),
+    fields: vmstate_fields! {
+        vmstate_of!(HPETState, rtc_irq_level),
+    },
+    ..Zeroable::ZERO
+};
+
+static VMSTATE_HPET_OFFSET: VMStateDescription = VMStateDescription {
+    name: c_str!("hpet/offset").as_ptr(),
+    version_id: 1,
+    minimum_version_id: 1,
+    needed: Some(hpet_offset_needed),
+    fields: vmstate_fields! {
+        vmstate_of!(HPETState, hpet_offset),
+    },
+    ..Zeroable::ZERO
+};
+
+static VMSTATE_HPET_TIMER: VMStateDescription = VMStateDescription {
+    name: c_str!("hpet_timer").as_ptr(),
+    version_id: 1,
+    minimum_version_id: 1,
+    fields: vmstate_fields! {
+        vmstate_of!(HPETTimer, index),
+        vmstate_of!(HPETTimer, config),
+        vmstate_of!(HPETTimer, cmp),
+        vmstate_of!(HPETTimer, fsb),
+        vmstate_of!(HPETTimer, period),
+        vmstate_of!(HPETTimer, wrap_flag),
+        vmstate_of!(HPETTimer, qemu_timer),
+    },
+    ..Zeroable::ZERO
+};
+
+const VALIDATE_TIMERS_NAME: &CStr = c_str!("num_timers must match");
+
+static VMSTATE_HPET: VMStateDescription = VMStateDescription {
+    name: c_str!("hpet").as_ptr(),
+    version_id: 2,
+    minimum_version_id: 1,
+    pre_save: Some(hpet_pre_save),
+    post_load: Some(hpet_post_load),
+    fields: vmstate_fields! {
+        vmstate_of!(HPETState, config),
+        vmstate_of!(HPETState, int_status),
+        vmstate_of!(HPETState, counter),
+        vmstate_of!(HPETState, num_timers_save).with_version_id(2),
+        vmstate_validate!(HPETState, VALIDATE_TIMERS_NAME, HPETState::validate_num_timers),
+        vmstate_struct!(HPETState, timers[0 .. num_timers], &VMSTATE_HPET_TIMER, BqlRefCell<HPETTimer>, HPETState::validate_num_timers).with_version_id(0),
+    },
+    subsections: vmstate_subsections! {
+        VMSTATE_HPET_RTC_IRQ_LEVEL,
+        VMSTATE_HPET_OFFSET,
+    },
+    ..Zeroable::ZERO
+};
+
 impl DeviceImpl for HPETState {
     fn properties() -> &'static [Property] {
         &HPET_PROPERTIES
     }
 
+    fn vmsd() -> Option<&'static VMStateDescription> {
+        Some(&VMSTATE_HPET)
+    }
+
     const REALIZE: Option<fn(&Self)> = Some(Self::realize);
 }
 

From 7c93067fe7e44f89a720fa5f0faf180697d5ac7e Mon Sep 17 00:00:00 2001
From: Magnus Kulke <magnuskulke@linux.microsoft.com>
Date: Tue, 29 Apr 2025 11:33:19 +0200
Subject: [PATCH 0602/2760] target/i386/emulate: remove rflags leftovers

Fixes: c901905ea670 ("target/i386/emulate: remove flags_mask")

In c901905ea670 rflags have been removed from `x86_decode`, but there
were some leftovers.

Signed-off-by: Magnus Kulke <magnuskulke@linux.microsoft.com>
Link: https://lore.kernel.org/r/20250429093319.5010-1-magnuskulke@linux.microsoft.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/emulate/x86_decode.c | 17 ++++++-----------
 1 file changed, 6 insertions(+), 11 deletions(-)

diff --git a/target/i386/emulate/x86_decode.c b/target/i386/emulate/x86_decode.c
index 7fee219687..7efa2f570e 100644
--- a/target/i386/emulate/x86_decode.c
+++ b/target/i386/emulate/x86_decode.c
@@ -1408,7 +1408,7 @@ struct decode_tbl _2op_inst[] = {
 };
 
 struct decode_x87_tbl invl_inst_x87 = {0x0, 0, 0, 0, 0, false, false, NULL,
-                                       NULL, decode_invalid, 0};
+                                       NULL, decode_invalid};
 
 struct decode_x87_tbl _x87_inst[] = {
     {0xd8, 0, 3, X86_DECODE_CMD_FADD, 10, false, false,
@@ -1456,8 +1456,7 @@ struct decode_x87_tbl _x87_inst[] = {
      decode_x87_modrm_st0, NULL, decode_d9_4},
     {0xd9, 4, 0, X86_DECODE_CMD_INVL, 4, false, false,
      decode_x87_modrm_bytep, NULL, NULL},
-    {0xd9, 5, 3, X86_DECODE_CMD_FLDxx, 10, false, false, NULL, NULL, NULL,
-     RFLAGS_MASK_NONE},
+    {0xd9, 5, 3, X86_DECODE_CMD_FLDxx, 10, false, false, NULL, NULL, NULL},
     {0xd9, 5, 0, X86_DECODE_CMD_FLDCW, 2, false, false,
      decode_x87_modrm_bytep, NULL, NULL},
 
@@ -1478,20 +1477,17 @@ struct decode_x87_tbl _x87_inst[] = {
      decode_x87_modrm_st0, NULL},
     {0xda, 3, 3, X86_DECODE_CMD_FCMOV, 10, false, false, decode_x87_modrm_st0,
      decode_x87_modrm_st0, NULL},
-    {0xda, 4, 3, X86_DECODE_CMD_INVL, 10, false, false, NULL, NULL, NULL,
-     RFLAGS_MASK_NONE},
+    {0xda, 4, 3, X86_DECODE_CMD_INVL, 10, false, false, NULL, NULL, NULL},
     {0xda, 4, 0, X86_DECODE_CMD_FSUB, 4, false, false, decode_x87_modrm_st0,
      decode_x87_modrm_intp, NULL},
     {0xda, 5, 3, X86_DECODE_CMD_FUCOM, 10, false, true, decode_x87_modrm_st0,
      decode_decode_x87_modrm_st0, NULL},
     {0xda, 5, 0, X86_DECODE_CMD_FSUB, 4, true, false, decode_x87_modrm_st0,
      decode_x87_modrm_intp, NULL},
-    {0xda, 6, 3, X86_DECODE_CMD_INVL, 10, false, false, NULL, NULL, NULL,
-     RFLAGS_MASK_NONE},
+    {0xda, 6, 3, X86_DECODE_CMD_INVL, 10, false, false, NULL, NULL, NULL},
     {0xda, 6, 0, X86_DECODE_CMD_FDIV, 4, false, false, decode_x87_modrm_st0,
      decode_x87_modrm_intp, NULL},
-    {0xda, 7, 3, X86_DECODE_CMD_INVL, 10, false, false, NULL, NULL, NULL,
-     RFLAGS_MASK_NONE},
+    {0xda, 7, 3, X86_DECODE_CMD_INVL, 10, false, false, NULL, NULL, NULL},
     {0xda, 7, 0, X86_DECODE_CMD_FDIV, 4, true, false, decode_x87_modrm_st0,
      decode_x87_modrm_intp, NULL},
 
@@ -1511,8 +1507,7 @@ struct decode_x87_tbl _x87_inst[] = {
      decode_x87_modrm_intp, NULL, NULL},
     {0xdb, 4, 3, X86_DECODE_CMD_INVL, 10, false, false, NULL, NULL,
      decode_db_4},
-    {0xdb, 4, 0, X86_DECODE_CMD_INVL, 10, false, false, NULL, NULL, NULL,
-     RFLAGS_MASK_NONE},
+    {0xdb, 4, 0, X86_DECODE_CMD_INVL, 10, false, false, NULL, NULL, NULL},
     {0xdb, 5, 3, X86_DECODE_CMD_FUCOMI, 10, false, false,
      decode_x87_modrm_st0, decode_x87_modrm_st0, NULL},
     {0xdb, 5, 0, X86_DECODE_CMD_FLD, 10, false, false,

From 785f945bd5ace415419d0fe4944fa5fce1bc1865 Mon Sep 17 00:00:00 2001
From: Wei Liu <wei.liu@kernel.org>
Date: Tue, 29 Apr 2025 06:24:51 +0000
Subject: [PATCH 0603/2760] target/i386/hvf: fix a compilation error

Include exec/target_page.h to fix the following build error.

x86_64-softmmu.a.p/target_i386_hvf_hvf.c.o -c ../target/i386/hvf/hvf.c
../target/i386/hvf/hvf.c:139:49: error: use of undeclared identifier 'TARGET_PAGE_SIZE'
  139 |             uint64_t dirty_page_start = gpa & ~(TARGET_PAGE_SIZE - 1u);
      |                                                 ^
../target/i386/hvf/hvf.c:141:45: error: use of undeclared identifier 'TARGET_PAGE_SIZE'
  141 |             hv_vm_protect(dirty_page_start, TARGET_PAGE_SIZE,
      |                                             ^

Signed-off-by: Wei Liu <wei.liu@kernel.org>
Link: https://lore.kernel.org/r/aBBws1ikCDfyC0RI@liuwe-devbox-ubuntu-v2.tail21d00.ts.net
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/hvf/hvf.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target/i386/hvf/hvf.c b/target/i386/hvf/hvf.c
index 23ebf2550a..99e37a33e5 100644
--- a/target/i386/hvf/hvf.c
+++ b/target/i386/hvf/hvf.c
@@ -76,6 +76,7 @@
 #include "qemu/main-loop.h"
 #include "qemu/accel.h"
 #include "target/i386/cpu.h"
+#include "exec/target_page.h"
 
 static Error *invtsc_mig_blocker;
 

From e54ef98c8a80d16158bab4341d9a898701270528 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Thu, 13 Feb 2025 19:37:07 +0100
Subject: [PATCH 0604/2760] target/i386: do not trigger IRQ shadow for LSS

Because LSS need not trigger an IRQ shadow, gen_movl_seg can't just use
the destination register to decide whether to inhibit IRQs.  Add an
argument.

Cc: qemu-stable@nongnu.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/tcg/emit.c.inc  |  4 ++--
 target/i386/tcg/translate.c | 27 ++++++++++++++++-----------
 2 files changed, 18 insertions(+), 13 deletions(-)

diff --git a/target/i386/tcg/emit.c.inc b/target/i386/tcg/emit.c.inc
index e3166e70a5..1a7fab9333 100644
--- a/target/i386/tcg/emit.c.inc
+++ b/target/i386/tcg/emit.c.inc
@@ -342,7 +342,7 @@ static void gen_writeback(DisasContext *s, X86DecodedInsn *decode, int opn, TCGv
         break;
     case X86_OP_SEG:
         /* Note that gen_movl_seg takes care of interrupt shadow and TF.  */
-        gen_movl_seg(s, op->n, s->T0);
+        gen_movl_seg(s, op->n, v, op->n == R_SS);
         break;
     case X86_OP_INT:
         if (op->has_ea) {
@@ -2382,7 +2382,7 @@ static void gen_lxx_seg(DisasContext *s, X86DecodedInsn *decode, int seg)
     gen_op_ld_v(s, MO_16, s->T1, s->A0);
 
     /* load the segment here to handle exceptions properly */
-    gen_movl_seg(s, seg, s->T1);
+    gen_movl_seg(s, seg, s->T1, false);
 }
 
 static void gen_LDS(DisasContext *s, X86DecodedInsn *decode)
diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
index 8a641951cd..a4e935b043 100644
--- a/target/i386/tcg/translate.c
+++ b/target/i386/tcg/translate.c
@@ -2026,27 +2026,32 @@ static void gen_op_movl_seg_real(DisasContext *s, X86Seg seg_reg, TCGv seg)
 
 /* move SRC to seg_reg and compute if the CPU state may change. Never
    call this function with seg_reg == R_CS */
-static void gen_movl_seg(DisasContext *s, X86Seg seg_reg, TCGv src)
+static void gen_movl_seg(DisasContext *s, X86Seg seg_reg, TCGv src, bool inhibit_irq)
 {
     if (PE(s) && !VM86(s)) {
         TCGv_i32 sel = tcg_temp_new_i32();
 
         tcg_gen_trunc_tl_i32(sel, src);
         gen_helper_load_seg(tcg_env, tcg_constant_i32(seg_reg), sel);
-        /* abort translation because the addseg value may change or
-           because ss32 may change. For R_SS, translation must always
-           stop as a special handling must be done to disable hardware
-           interrupts for the next instruction */
-        if (seg_reg == R_SS) {
-            s->base.is_jmp = DISAS_EOB_INHIBIT_IRQ;
-        } else if (CODE32(s) && seg_reg < R_FS) {
+
+        /* For move to DS/ES/SS, the addseg or ss32 flags may change.  */
+        if (CODE32(s) && seg_reg < R_FS) {
             s->base.is_jmp = DISAS_EOB_NEXT;
         }
     } else {
         gen_op_movl_seg_real(s, seg_reg, src);
-        if (seg_reg == R_SS) {
-            s->base.is_jmp = DISAS_EOB_INHIBIT_IRQ;
-        }
+    }
+
+    /*
+     * For MOV or POP to SS (but not LSS) translation must always
+     * stop as a special handling must be done to disable hardware
+     * interrupts for the next instruction.
+     *
+     * DISAS_EOB_INHIBIT_IRQ is a superset of DISAS_EOB_NEXT which
+     * might have been set above.
+     */
+    if (inhibit_irq) {
+        s->base.is_jmp = DISAS_EOB_INHIBIT_IRQ;
     }
 }
 

From 1e94ddc6854431064c94a7d8f2f2886def285829 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Mon, 15 Jul 2024 10:35:06 +0200
Subject: [PATCH 0605/2760] target/i386: do not block singlestep for STI

STI will trigger a singlestep exception even if it has inhibit-IRQ
behavior.  Do not suppress single-step for all IRQ-inhibiting
instructions, instead special case MOV SS and POP SS.

Cc: qemu-stable@nongnu.org
Fixes: f0f0136abba ("target/i386: no single-step exception after MOV or POP SS", 2024-05-25)
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/tcg/translate.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
index a4e935b043..ed43c95c1d 100644
--- a/target/i386/tcg/translate.c
+++ b/target/i386/tcg/translate.c
@@ -2047,11 +2047,15 @@ static void gen_movl_seg(DisasContext *s, X86Seg seg_reg, TCGv src, bool inhibit
      * stop as a special handling must be done to disable hardware
      * interrupts for the next instruction.
      *
+     * This is the last instruction, so it's okay to overwrite
+     * HF_TF_MASK; the next TB will start with the flag set.
+     *
      * DISAS_EOB_INHIBIT_IRQ is a superset of DISAS_EOB_NEXT which
      * might have been set above.
      */
     if (inhibit_irq) {
         s->base.is_jmp = DISAS_EOB_INHIBIT_IRQ;
+        s->flags &= ~HF_TF_MASK;
     }
 }
 
@@ -2302,7 +2306,7 @@ gen_eob(DisasContext *s, int mode)
     if (mode == DISAS_EOB_RECHECK_TF) {
         gen_helper_rechecking_single_step(tcg_env);
         tcg_gen_exit_tb(NULL, 0);
-    } else if ((s->flags & HF_TF_MASK) && mode != DISAS_EOB_INHIBIT_IRQ) {
+    } else if (s->flags & HF_TF_MASK) {
         gen_helper_single_step(tcg_env);
     } else if (mode == DISAS_JUMP &&
                /* give irqs a chance to happen */

From 8dc4f981004f17efe2d28f26b180f618f24f46de Mon Sep 17 00:00:00 2001
From: BALATON Zoltan <balaton@eik.bme.hu>
Date: Fri, 2 May 2025 11:55:24 +0200
Subject: [PATCH 0606/2760] hw/char/serial: Remove unused prog_if compat
 property
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This property was added to preserve previous value when this was fixed
in version 2.1 but the last machine using it was already removed when
adding diva-gsp leaving this property unused and unnecessary.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Helge Deller <deller@gmx.de>
Link: https://lore.kernel.org/r/20250502095524.DE1F355D264@zero.eik.bme.hu
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/char/diva-gsp.c         |  6 ++----
 hw/char/serial-pci-multi.c |  7 ++-----
 hw/char/serial-pci.c       | 10 ++--------
 3 files changed, 6 insertions(+), 17 deletions(-)

diff --git a/hw/char/diva-gsp.c b/hw/char/diva-gsp.c
index 60f933191d..e1f0713cb7 100644
--- a/hw/char/diva-gsp.c
+++ b/hw/char/diva-gsp.c
@@ -51,7 +51,6 @@ typedef struct PCIDivaSerialState {
     SerialState  state[PCI_SERIAL_MAX_PORTS];
     uint32_t     level[PCI_SERIAL_MAX_PORTS];
     qemu_irq     *irqs;
-    uint8_t      prog_if;
     bool         disable;
 } PCIDivaSerialState;
 
@@ -124,8 +123,8 @@ static void diva_pci_realize(PCIDevice *dev, Error **errp)
     size_t i, offset = 0;
     size_t portmask = di.omask;
 
-    pci->dev.config[PCI_CLASS_PROG] = pci->prog_if;
-    pci->dev.config[PCI_INTERRUPT_PIN] = 0x01;
+    pci->dev.config[PCI_CLASS_PROG] = 2; /* 16550 compatible */
+    pci->dev.config[PCI_INTERRUPT_PIN] = 1;
     memory_region_init(&pci->membar, OBJECT(pci), "serial_ports", 4096);
     pci_register_bar(&pci->dev, 0, PCI_BASE_ADDRESS_SPACE_MEMORY, &pci->membar);
     pci->irqs = qemu_allocate_irqs(multi_serial_irq_mux, pci, di.nports);
@@ -178,7 +177,6 @@ static const Property diva_serial_properties[] = {
     DEFINE_PROP_CHR("chardev2",  PCIDivaSerialState, state[1].chr),
     DEFINE_PROP_CHR("chardev3",  PCIDivaSerialState, state[2].chr),
     DEFINE_PROP_CHR("chardev4",  PCIDivaSerialState, state[3].chr),
-    DEFINE_PROP_UINT8("prog_if",  PCIDivaSerialState, prog_if, 0x02),
     DEFINE_PROP_UINT32("subvendor", PCIDivaSerialState, subvendor,
                                     PCI_DEVICE_ID_HP_DIVA_TOSCA1),
 };
diff --git a/hw/char/serial-pci-multi.c b/hw/char/serial-pci-multi.c
index fb184c2e6d..13df272691 100644
--- a/hw/char/serial-pci-multi.c
+++ b/hw/char/serial-pci-multi.c
@@ -46,7 +46,6 @@ typedef struct PCIMultiSerialState {
     SerialState  state[PCI_SERIAL_MAX_PORTS];
     uint32_t     level[PCI_SERIAL_MAX_PORTS];
     IRQState     irqs[PCI_SERIAL_MAX_PORTS];
-    uint8_t      prog_if;
 } PCIMultiSerialState;
 
 static void multi_serial_pci_exit(PCIDevice *dev)
@@ -97,8 +96,8 @@ static void multi_serial_pci_realize(PCIDevice *dev, Error **errp)
     SerialState *s;
     size_t i, nports = multi_serial_get_port_count(pc);
 
-    pci->dev.config[PCI_CLASS_PROG] = pci->prog_if;
-    pci->dev.config[PCI_INTERRUPT_PIN] = 0x01;
+    pci->dev.config[PCI_CLASS_PROG] = 2; /* 16550 compatible */
+    pci->dev.config[PCI_INTERRUPT_PIN] = 1;
     memory_region_init(&pci->iobar, OBJECT(pci), "multiserial", 8 * nports);
     pci_register_bar(&pci->dev, 0, PCI_BASE_ADDRESS_SPACE_IO, &pci->iobar);
 
@@ -133,7 +132,6 @@ static const VMStateDescription vmstate_pci_multi_serial = {
 static const Property multi_2x_serial_pci_properties[] = {
     DEFINE_PROP_CHR("chardev1",  PCIMultiSerialState, state[0].chr),
     DEFINE_PROP_CHR("chardev2",  PCIMultiSerialState, state[1].chr),
-    DEFINE_PROP_UINT8("prog_if",  PCIMultiSerialState, prog_if, 0x02),
 };
 
 static const Property multi_4x_serial_pci_properties[] = {
@@ -141,7 +139,6 @@ static const Property multi_4x_serial_pci_properties[] = {
     DEFINE_PROP_CHR("chardev2",  PCIMultiSerialState, state[1].chr),
     DEFINE_PROP_CHR("chardev3",  PCIMultiSerialState, state[2].chr),
     DEFINE_PROP_CHR("chardev4",  PCIMultiSerialState, state[3].chr),
-    DEFINE_PROP_UINT8("prog_if",  PCIMultiSerialState, prog_if, 0x02),
 };
 
 static void multi_2x_serial_pci_class_initfn(ObjectClass *klass,
diff --git a/hw/char/serial-pci.c b/hw/char/serial-pci.c
index 8707e81914..46efabc4cb 100644
--- a/hw/char/serial-pci.c
+++ b/hw/char/serial-pci.c
@@ -38,7 +38,6 @@
 struct PCISerialState {
     PCIDevice dev;
     SerialState state;
-    uint8_t prog_if;
 };
 
 #define TYPE_PCI_SERIAL "pci-serial"
@@ -53,8 +52,8 @@ static void serial_pci_realize(PCIDevice *dev, Error **errp)
         return;
     }
 
-    pci->dev.config[PCI_CLASS_PROG] = pci->prog_if;
-    pci->dev.config[PCI_INTERRUPT_PIN] = 0x01;
+    pci->dev.config[PCI_CLASS_PROG] = 2; /* 16550 compatible */
+    pci->dev.config[PCI_INTERRUPT_PIN] = 1;
     s->irq = pci_allocate_irq(&pci->dev);
 
     memory_region_init_io(&s->io, OBJECT(pci), &serial_io_ops, s, "serial", 8);
@@ -81,10 +80,6 @@ static const VMStateDescription vmstate_pci_serial = {
     }
 };
 
-static const Property serial_pci_properties[] = {
-    DEFINE_PROP_UINT8("prog_if",  PCISerialState, prog_if, 0x02),
-};
-
 static void serial_pci_class_initfn(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -96,7 +91,6 @@ static void serial_pci_class_initfn(ObjectClass *klass, const void *data)
     pc->revision = 1;
     pc->class_id = PCI_CLASS_COMMUNICATION_SERIAL;
     dc->vmsd = &vmstate_pci_serial;
-    device_class_set_props(dc, serial_pci_properties);
     set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
 }
 

From ffd5a60e9b67e14f7bac7ea29300ea46a944e508 Mon Sep 17 00:00:00 2001
From: Stefan Zabka <git@zabka.it>
Date: Fri, 2 May 2025 23:27:48 +0200
Subject: [PATCH 0607/2760] rust: centralize config in workspace root

This commit bundles common config option in the workspace
root and applies them through <config>.workspace = true

Signed-off-by: Stefan Zabka <git@zabka.it>
Link: https://lore.kernel.org/r/20250502212748.124953-1-git@zabka.it
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/Cargo.toml                 |  7 +++++++
 rust/hw/char/pl011/Cargo.toml   | 11 ++++++-----
 rust/hw/timer/hpet/Cargo.toml   |  9 ++++++---
 rust/qemu-api-macros/Cargo.toml | 11 ++++++-----
 rust/qemu-api/Cargo.toml        | 15 +++++++--------
 5 files changed, 32 insertions(+), 21 deletions(-)

diff --git a/rust/Cargo.toml b/rust/Cargo.toml
index ab1185a814..5ace47c69b 100644
--- a/rust/Cargo.toml
+++ b/rust/Cargo.toml
@@ -7,6 +7,13 @@ members = [
     "hw/timer/hpet",
 ]
 
+[workspace.package]
+edition = "2021"
+homepage = "https://www.qemu.org"
+license = "GPL-2.0-or-later"
+repository = "https://gitlab.com/qemu-project/qemu/"
+rust-version = "1.63.0"
+
 [workspace.lints.rust]
 unexpected_cfgs = { level = "deny", check-cfg = [
     'cfg(MESON)', 'cfg(HAVE_GLIB_WITH_ALIGNED_ALLOC)',
diff --git a/rust/hw/char/pl011/Cargo.toml b/rust/hw/char/pl011/Cargo.toml
index f2296cad58..a1f431ab4a 100644
--- a/rust/hw/char/pl011/Cargo.toml
+++ b/rust/hw/char/pl011/Cargo.toml
@@ -1,15 +1,16 @@
 [package]
 name = "pl011"
 version = "0.1.0"
-edition = "2021"
 authors = ["Manos Pitsidianakis <manos.pitsidianakis@linaro.org>"]
-license = "GPL-2.0-or-later"
 description = "pl011 device model for QEMU"
 resolver = "2"
 publish = false
-keywords = []
-categories = []
-rust-version = "1.63.0"
+
+edition.workspace = true
+homepage.workspace = true
+license.workspace = true
+repository.workspace = true
+rust-version.workspace = true
 
 [lib]
 crate-type = ["staticlib"]
diff --git a/rust/hw/timer/hpet/Cargo.toml b/rust/hw/timer/hpet/Cargo.toml
index 147f216e72..6f07502784 100644
--- a/rust/hw/timer/hpet/Cargo.toml
+++ b/rust/hw/timer/hpet/Cargo.toml
@@ -1,11 +1,14 @@
 [package]
 name = "hpet"
 version = "0.1.0"
-edition = "2021"
 authors = ["Zhao Liu <zhao1.liu@intel.com>"]
-license = "GPL-2.0-or-later"
 description = "IA-PC High Precision Event Timer emulation in Rust"
-rust-version = "1.63.0"
+
+edition.workspace = true
+homepage.workspace = true
+license.workspace = true
+repository.workspace = true
+rust-version.workspace = true
 
 [lib]
 crate-type = ["staticlib"]
diff --git a/rust/qemu-api-macros/Cargo.toml b/rust/qemu-api-macros/Cargo.toml
index 89dee1cfb3..0cd40c8e16 100644
--- a/rust/qemu-api-macros/Cargo.toml
+++ b/rust/qemu-api-macros/Cargo.toml
@@ -1,15 +1,16 @@
 [package]
 name = "qemu_api_macros"
 version = "0.1.0"
-edition = "2021"
 authors = ["Manos Pitsidianakis <manos.pitsidianakis@linaro.org>"]
-license = "GPL-2.0-or-later"
 description = "Rust bindings for QEMU - Utility macros"
 resolver = "2"
 publish = false
-keywords = []
-categories = []
-rust-version = "1.63.0"
+
+edition.workspace = true
+homepage.workspace = true
+license.workspace = true
+repository.workspace = true
+rust-version.workspace = true
 
 [lib]
 proc-macro = true
diff --git a/rust/qemu-api/Cargo.toml b/rust/qemu-api/Cargo.toml
index 57747bc934..ca1b04269f 100644
--- a/rust/qemu-api/Cargo.toml
+++ b/rust/qemu-api/Cargo.toml
@@ -1,18 +1,17 @@
 [package]
 name = "qemu_api"
 version = "0.1.0"
-edition = "2021"
 authors = ["Manos Pitsidianakis <manos.pitsidianakis@linaro.org>"]
-license = "GPL-2.0-or-later"
-readme = "README.md"
-homepage = "https://www.qemu.org"
 description = "Rust bindings for QEMU"
-repository = "https://gitlab.com/qemu-project/qemu/"
+readme = "README.md"
 resolver = "2"
 publish = false
-keywords = []
-categories = []
-rust-version = "1.63.0"
+
+edition.workspace = true
+homepage.workspace = true
+license.workspace = true
+repository.workspace = true
+rust-version.workspace = true
 
 [dependencies]
 qemu_api_macros = { path = "../qemu-api-macros" }

From 03f50d7ee756eecbd4481c3008b5e01e999729c7 Mon Sep 17 00:00:00 2001
From: Andrey Drobyshev <andrey.drobyshev@virtuozzo.com>
Date: Sat, 3 May 2025 00:47:29 +0300
Subject: [PATCH 0608/2760] monitor: don't wake up qmp_dispatcher_co coroutine
 upon cleanup

Since the commit 3e6bed61 ("monitor: cleanup detection of qmp_dispatcher_co
shutting down"), coroutine pointer qmp_dispatcher_co is set to NULL upon
cleanup.  If a QMP command is sent after monitor_cleanup() (e.g. after
shutdown), this may lead to SEGFAULT on aio_co_wake(NULL).

As mentioned in the comment inside monitor_cleanup(), the intention is to
allow incoming requests while shutting down, but simply leave them
without any response.  Let's do exactly that, and if qmp_dispatcher_co
coroutine pointer has already been set to NULL, let's simply skip the
aio_co_wake() part.

Signed-off-by: Andrey Drobyshev <andrey.drobyshev@virtuozzo.com>
Link: https://lore.kernel.org/r/20250502214729.928380-2-andrey.drobyshev@virtuozzo.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 monitor/qmp.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/monitor/qmp.c b/monitor/qmp.c
index 2f46cf9e49..cb99a12d94 100644
--- a/monitor/qmp.c
+++ b/monitor/qmp.c
@@ -356,7 +356,8 @@ void qmp_dispatcher_co_wake(void)
     /* Write request before reading qmp_dispatcher_co_busy.  */
     smp_mb__before_rmw();
 
-    if (!qatomic_xchg(&qmp_dispatcher_co_busy, true)) {
+    if (!qatomic_xchg(&qmp_dispatcher_co_busy, true) &&
+            qatomic_read(&qmp_dispatcher_co)) {
         aio_co_wake(qmp_dispatcher_co);
     }
 }

From ba27ba302a264117c8b8427f944ced1bed17c438 Mon Sep 17 00:00:00 2001
From: Troy Lee <troy_lee@aspeedtech.com>
Date: Mon, 17 Mar 2025 14:59:38 +0800
Subject: [PATCH 0609/2760] hw/arm: ast27x0: Wire up EHCI controllers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

AST27x0 has 4 EHCI controllers, where each CPU and I/O die has 2
instances. This patch use existing TYPE_PLATFORM_EHCI. After wiring up
the EHCI controller, the ast2700a1-evb can find up to 4 USB EHCI
interfaces.

ehci-platform 12061000.usb: EHCI Host Controller
ehci-platform 12061000.usb: new USB bus registered, assigned bus number 2
ehci-platform 12063000.usb: EHCI Host Controller
ehci-platform 12063000.usb: new USB bus registered, assigned bus number 3
ehci-platform 12061000.usb: irq 88, io mem 0x12061000
ehci-platform 12063000.usb: irq 90, io mem 0x12063000
ehci-platform 14121000.usb: EHCI Host Controller
ehci-platform 14123000.usb: EHCI Host Controller
ehci-platform 12061000.usb: USB 2.0 started, EHCI 1.00
ehci-platform 14121000.usb: new USB bus registered, assigned bus number 5
ehci-platform 14123000.usb: new USB bus registered, assigned bus number 6
ehci-platform 14121000.usb: irq 91, io mem 0x14121000
ehci-platform 14123000.usb: irq 92, io mem 0x14123000
ehci-platform 12063000.usb: USB 2.0 started, EHCI 1.00
usb usb2: Manufacturer: Linux 6.6.78-dirty-bafd2830c17c-gbafd2830c17c-dirty ehci_hcd
usb usb3: Manufacturer: Linux 6.6.78-dirty-bafd2830c17c-gbafd2830c17c-dirty ehci_hcd
ehci-platform 14121000.usb: USB 2.0 started, EHCI 1.00
usb usb5: Manufacturer: Linux 6.6.78-dirty-bafd2830c17c-gbafd2830c17c-dirty ehci_hcd
ehci-platform 14123000.usb: USB 2.0 started, EHCI 1.00
usb usb6: Manufacturer: Linux 6.6.78-dirty-bafd2830c17c-gbafd2830c17c-dirty ehci_hcd

Note that, AST27x0A0 only has 2 EHCI controllers due to hw issue.

Signed-off-by: Troy Lee <troy_lee@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250317065938.1902272-2-troy_lee@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed_ast27x0.c     | 28 ++++++++++++++++++++++++++++
 include/hw/arm/aspeed_soc.h |  4 +++-
 2 files changed, 31 insertions(+), 1 deletion(-)

diff --git a/hw/arm/aspeed_ast27x0.c b/hw/arm/aspeed_ast27x0.c
index 63a366f7e8..ea4a611b90 100644
--- a/hw/arm/aspeed_ast27x0.c
+++ b/hw/arm/aspeed_ast27x0.c
@@ -25,6 +25,8 @@
 
 static const hwaddr aspeed_soc_ast2700_memmap[] = {
     [ASPEED_DEV_SRAM]      =  0x10000000,
+    [ASPEED_DEV_EHCI1]     =  0x12061000,
+    [ASPEED_DEV_EHCI2]     =  0x12063000,
     [ASPEED_DEV_HACE]      =  0x12070000,
     [ASPEED_DEV_EMMC]      =  0x12090000,
     [ASPEED_DEV_INTC]      =  0x12100000,
@@ -47,6 +49,8 @@ static const hwaddr aspeed_soc_ast2700_memmap[] = {
     [ASPEED_DEV_ETH2]      =  0x14060000,
     [ASPEED_DEV_ETH3]      =  0x14070000,
     [ASPEED_DEV_SDHCI]     =  0x14080000,
+    [ASPEED_DEV_EHCI3]     =  0x14121000,
+    [ASPEED_DEV_EHCI4]     =  0x14123000,
     [ASPEED_DEV_ADC]       =  0x14C00000,
     [ASPEED_DEV_SCUIO]     =  0x14C02000,
     [ASPEED_DEV_GPIO]      =  0x14C0B000,
@@ -91,6 +95,8 @@ static const int aspeed_soc_ast2700a0_irqmap[] = {
     [ASPEED_DEV_TIMER7]    = 22,
     [ASPEED_DEV_TIMER8]    = 23,
     [ASPEED_DEV_DP]        = 28,
+    [ASPEED_DEV_EHCI1]     = 33,
+    [ASPEED_DEV_EHCI2]     = 37,
     [ASPEED_DEV_LPC]       = 128,
     [ASPEED_DEV_IBT]       = 128,
     [ASPEED_DEV_KCS]       = 128,
@@ -137,6 +143,8 @@ static const int aspeed_soc_ast2700a1_irqmap[] = {
     [ASPEED_DEV_TIMER7]    = 22,
     [ASPEED_DEV_TIMER8]    = 23,
     [ASPEED_DEV_DP]        = 28,
+    [ASPEED_DEV_EHCI1]     = 33,
+    [ASPEED_DEV_EHCI2]     = 37,
     [ASPEED_DEV_LPC]       = 192,
     [ASPEED_DEV_IBT]       = 192,
     [ASPEED_DEV_KCS]       = 192,
@@ -212,6 +220,8 @@ static const int ast2700_gic132_gic196_intcmap[] = {
     [ASPEED_DEV_UART10]    = 16,
     [ASPEED_DEV_UART11]    = 17,
     [ASPEED_DEV_UART12]    = 18,
+    [ASPEED_DEV_EHCI3]     = 28,
+    [ASPEED_DEV_EHCI4]     = 29,
 };
 
 /* GICINT 133 */
@@ -434,6 +444,11 @@ static void aspeed_soc_ast2700_init(Object *obj)
         object_initialize_child(obj, "spi[*]", &s->spi[i], typename);
     }
 
+    for (i = 0; i < sc->ehcis_num; i++) {
+        object_initialize_child(obj, "ehci[*]", &s->ehci[i],
+                                TYPE_PLATFORM_EHCI);
+    }
+
     snprintf(typename, sizeof(typename), "aspeed.sdmc-%s", socname);
     object_initialize_child(obj, "sdmc", &s->sdmc, typename);
     object_property_add_alias(obj, "ram-size", OBJECT(&s->sdmc),
@@ -709,6 +724,17 @@ static void aspeed_soc_ast2700_realize(DeviceState *dev, Error **errp)
                         ASPEED_SMC_GET_CLASS(&s->spi[i])->flash_window_base);
     }
 
+    /* EHCI */
+    for (i = 0; i < sc->ehcis_num; i++) {
+        if (!sysbus_realize(SYS_BUS_DEVICE(&s->ehci[i]), errp)) {
+            return;
+        }
+        aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->ehci[i]), 0,
+                        sc->memmap[ASPEED_DEV_EHCI1 + i]);
+        sysbus_connect_irq(SYS_BUS_DEVICE(&s->ehci[i]), 0,
+                           aspeed_soc_get_irq(s, ASPEED_DEV_EHCI1 + i));
+    }
+
     /*
      * SDMC - SDRAM Memory Controller
      * The SDMC controller is unlocked at SPL stage.
@@ -900,6 +926,7 @@ static void aspeed_soc_ast2700a0_class_init(ObjectClass *oc, const void *data)
     sc->silicon_rev  = AST2700_A0_SILICON_REV;
     sc->sram_size    = 0x20000;
     sc->spis_num     = 3;
+    sc->ehcis_num    = 2;
     sc->wdts_num     = 8;
     sc->macs_num     = 1;
     sc->uarts_num    = 13;
@@ -927,6 +954,7 @@ static void aspeed_soc_ast2700a1_class_init(ObjectClass *oc, const void *data)
     sc->silicon_rev  = AST2700_A1_SILICON_REV;
     sc->sram_size    = 0x20000;
     sc->spis_num     = 3;
+    sc->ehcis_num    = 4;
     sc->wdts_num     = 8;
     sc->macs_num     = 3;
     sc->uarts_num    = 13;
diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index f069d17d16..c1e80c8908 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -43,7 +43,7 @@
 #include "hw/intc/arm_gicv3.h"
 
 #define ASPEED_SPIS_NUM  3
-#define ASPEED_EHCIS_NUM 2
+#define ASPEED_EHCIS_NUM 4
 #define ASPEED_WDTS_NUM  8
 #define ASPEED_CPUS_NUM  4
 #define ASPEED_MACS_NUM  4
@@ -192,6 +192,8 @@ enum {
     ASPEED_DEV_SPI2,
     ASPEED_DEV_EHCI1,
     ASPEED_DEV_EHCI2,
+    ASPEED_DEV_EHCI3,
+    ASPEED_DEV_EHCI4,
     ASPEED_DEV_VIC,
     ASPEED_DEV_INTC,
     ASPEED_DEV_INTCIO,

From 47cdaa46f3f2c6710911543f2ec836eeb624969e Mon Sep 17 00:00:00 2001
From: Joe Komlodi <komlodi@google.com>
Date: Tue, 22 Apr 2025 00:27:47 +0000
Subject: [PATCH 0610/2760] hw/ssi/aspeed_smc: Allow 64-bit wide flash accesses
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

cde3247651dc998da5dc1005148302a90d72f21f fixed atomicity for LDRD, which
ends up making accesses 64-bits wide. However, the AST2600 bootloader
can sometimes compile with LDRD instructions, which causes the acceses
to fail when accessing the memory-mapped SPI flash.

To fix this, increase the MMIO region valid access size to allow for
64-bit accesses.

Signed-off-by: Joe Komlodi <komlodi@google.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250422002747.2593465-1-komlodi@google.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/ssi/aspeed_smc.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/ssi/aspeed_smc.c b/hw/ssi/aspeed_smc.c
index 0d38f95c7a..614528b8ef 100644
--- a/hw/ssi/aspeed_smc.c
+++ b/hw/ssi/aspeed_smc.c
@@ -359,7 +359,7 @@ static const MemoryRegionOps aspeed_smc_flash_default_ops = {
     .endianness = DEVICE_LITTLE_ENDIAN,
     .valid = {
         .min_access_size = 1,
-        .max_access_size = 4,
+        .max_access_size = 8,
     },
 };
 
@@ -670,7 +670,7 @@ static const MemoryRegionOps aspeed_smc_flash_ops = {
     .endianness = DEVICE_LITTLE_ENDIAN,
     .valid = {
         .min_access_size = 1,
-        .max_access_size = 4,
+        .max_access_size = 8,
     },
 };
 

From 9b671ea9bd88e8ad14325eac4240850792458136 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Wed, 23 Apr 2025 09:40:05 +0800
Subject: [PATCH 0611/2760] tests/functional/aspeed: Update test ASPEED SDK
 v09.06 for AST2500
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250423014008.147542-2-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 tests/functional/test_arm_aspeed_ast2500.py | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/tests/functional/test_arm_aspeed_ast2500.py b/tests/functional/test_arm_aspeed_ast2500.py
index a3b44572fc..6923fe8701 100755
--- a/tests/functional/test_arm_aspeed_ast2500.py
+++ b/tests/functional/test_arm_aspeed_ast2500.py
@@ -37,14 +37,14 @@ class AST2500Machine(AspeedTest):
 
         self.do_test_arm_aspeed_buildroot_poweroff()
 
-    ASSET_SDK_V806_AST2500 = Asset(
-        'https://github.com/AspeedTech-BMC/openbmc/releases/download/v08.06/ast2500-default-obmc.tar.gz',
-        'e1755f3cadff69190438c688d52dd0f0d399b70a1e14b1d3d5540fc4851d38ca')
+    ASSET_SDK_V906_AST2500 = Asset(
+        'https://github.com/AspeedTech-BMC/openbmc/releases/download/v09.06/ast2500-default-obmc.tar.gz',
+        '542db84645b4efd8aed50385d7f4dd1caff379a987032311cfa7b563a3addb2a')
 
     def test_arm_ast2500_evb_sdk(self):
         self.set_machine('ast2500-evb')
 
-        self.archive_extract(self.ASSET_SDK_V806_AST2500)
+        self.archive_extract(self.ASSET_SDK_V906_AST2500)
 
         self.do_test_arm_aspeed_sdk_start(
             self.scratch_file("ast2500-default", "image-bmc"))

From 88bff6d5b2955d4b629a664c21cb7d91ff8a236c Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Wed, 23 Apr 2025 09:40:06 +0800
Subject: [PATCH 0612/2760] tests/functional/aspeed: Update test ASPEED SDK
 v09.06 for AST2600
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Update test for AST2600 production revision A3.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250423014008.147542-3-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 tests/functional/test_arm_aspeed_ast2600.py | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/tests/functional/test_arm_aspeed_ast2600.py b/tests/functional/test_arm_aspeed_ast2600.py
index 5ef52f0659..fdae4c939d 100755
--- a/tests/functional/test_arm_aspeed_ast2600.py
+++ b/tests/functional/test_arm_aspeed_ast2600.py
@@ -97,26 +97,27 @@ class AST2600Machine(AspeedTest):
 
         self.do_test_arm_aspeed_buildroot_poweroff()
 
-    ASSET_SDK_V806_AST2600_A2 = Asset(
-        'https://github.com/AspeedTech-BMC/openbmc/releases/download/v08.06/ast2600-a2-obmc.tar.gz',
-        '9083506135f622d5e7351fcf7d4e1c7125cee5ba16141220c0ba88931f3681a4')
+    ASSET_SDK_V906_AST2600 = Asset(
+        'https://github.com/AspeedTech-BMC/openbmc/releases/download/v09.06/ast2600-default-obmc.tar.gz',
+        '768d76e247896ad78c154b9cff4f766da2ce65f217d620b286a4a03a8a4f68f5')
 
     def test_arm_ast2600_evb_sdk(self):
         self.set_machine('ast2600-evb')
 
-        self.archive_extract(self.ASSET_SDK_V806_AST2600_A2)
+        self.archive_extract(self.ASSET_SDK_V906_AST2600)
 
         self.vm.add_args('-device',
             'tmp105,bus=aspeed.i2c.bus.5,address=0x4d,id=tmp-test')
         self.vm.add_args('-device',
             'ds1338,bus=aspeed.i2c.bus.5,address=0x32')
         self.do_test_arm_aspeed_sdk_start(
-            self.scratch_file("ast2600-a2", "image-bmc"))
+            self.scratch_file("ast2600-default", "image-bmc"))
 
-        self.wait_for_console_pattern('ast2600-a2 login:')
+        self.wait_for_console_pattern('ast2600-default login:')
 
         exec_command_and_wait_for_pattern(self, 'root', 'Password:')
-        exec_command_and_wait_for_pattern(self, '0penBmc', 'root@ast2600-a2:~#')
+        exec_command_and_wait_for_pattern(self, '0penBmc',
+                                          'root@ast2600-default:~#')
 
         exec_command_and_wait_for_pattern(self,
             'echo lm75 0x4d > /sys/class/i2c-dev/i2c-5/device/new_device',

From 53f3285e11876aae97d4240d944d45a4fe6c4597 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Wed, 23 Apr 2025 09:40:07 +0800
Subject: [PATCH 0613/2760] tests/functional/aspeed: Update test ASPEED SDK
 v03.00 for AST1030
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250423014008.147542-4-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 tests/functional/test_arm_aspeed_ast1030.py | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/tests/functional/test_arm_aspeed_ast1030.py b/tests/functional/test_arm_aspeed_ast1030.py
index d45d9f7c1c..77037f0179 100755
--- a/tests/functional/test_arm_aspeed_ast1030.py
+++ b/tests/functional/test_arm_aspeed_ast1030.py
@@ -12,17 +12,17 @@ from qemu_test import exec_command_and_wait_for_pattern
 
 class AST1030Machine(LinuxKernelTest):
 
-    ASSET_ZEPHYR_1_04 = Asset(
+    ASSET_ZEPHYR_3_00 = Asset(
         ('https://github.com/AspeedTech-BMC'
-         '/zephyr/releases/download/v00.01.04/ast1030-evb-demo.zip'),
-        '4ac6210adcbc61294927918707c6762483fd844dde5e07f3ba834ad1f91434d3')
+         '/zephyr/releases/download/v00.03.00/ast1030-evb-demo.zip'),
+        '37fe3ecd4a1b9d620971a15b96492a81093435396eeac69b6f3e384262ff555f')
 
-    def test_ast1030_zephyros_1_04(self):
+    def test_ast1030_zephyros_3_00(self):
         self.set_machine('ast1030-evb')
 
         kernel_name = "ast1030-evb-demo/zephyr.elf"
         kernel_file = self.archive_extract(
-            self.ASSET_ZEPHYR_1_04, member=kernel_name)
+            self.ASSET_ZEPHYR_3_00, member=kernel_name)
 
         self.vm.set_console()
         self.vm.add_args('-kernel', kernel_file, '-nographic')

From 8bc296c9b1122916166c021492c470c522e0fd16 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Wed, 23 Apr 2025 15:23:37 +0800
Subject: [PATCH 0614/2760] hw/arm/aspeed_ast27x0: Rename variable sram_name to
 name in ast2700 realize
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The variable "sram_name" was only used for naming the SRAM memory region.
Rename it to "name" for consistency with similar code and avoid unnecessary
new local variable declarations.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Tested-by: Nabih Estefan <nabihestefan@google.com>
Link: https://lore.kernel.org/qemu-devel/20250423072350.541742-2-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed_ast27x0.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/hw/arm/aspeed_ast27x0.c b/hw/arm/aspeed_ast27x0.c
index ea4a611b90..2e21c3a98f 100644
--- a/hw/arm/aspeed_ast27x0.c
+++ b/hw/arm/aspeed_ast27x0.c
@@ -592,7 +592,7 @@ static void aspeed_soc_ast2700_realize(DeviceState *dev, Error **errp)
     AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
     AspeedINTCClass *ic = ASPEED_INTC_GET_CLASS(&a->intc[0]);
     AspeedINTCClass *icio = ASPEED_INTC_GET_CLASS(&a->intc[1]);
-    g_autofree char *sram_name = NULL;
+    g_autofree char *name = NULL;
     qemu_irq irq;
 
     /* Default boot region (SPI memory or ROMs) */
@@ -664,9 +664,9 @@ static void aspeed_soc_ast2700_realize(DeviceState *dev, Error **errp)
     }
 
     /* SRAM */
-    sram_name = g_strdup_printf("aspeed.sram.%d", CPU(&a->cpu[0])->cpu_index);
-    if (!memory_region_init_ram(&s->sram, OBJECT(s), sram_name, sc->sram_size,
-                                 errp)) {
+    name = g_strdup_printf("aspeed.sram.%d", CPU(&a->cpu[0])->cpu_index);
+    if (!memory_region_init_ram(&s->sram, OBJECT(s), name, sc->sram_size,
+                                errp)) {
         return;
     }
     memory_region_add_subregion(s->memory,

From 80c734ce92e3b68cdb8e82dfd094b3ba23900f17 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Wed, 23 Apr 2025 15:23:43 +0800
Subject: [PATCH 0615/2760] tests/functional/aspeed: Move I2C test into shared
 helper for AST2700 reuse
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Move the I2C test case into a common helper function (do_ast2700_i2c_test) so it
can be reused across multiple AST2700-based test cases. This reduces duplication
and improves maintainability.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Nabih Estefan <nabihestefan@google.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250423072350.541742-8-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 tests/functional/test_aarch64_aspeed.py | 28 +++++++++++++------------
 1 file changed, 15 insertions(+), 13 deletions(-)

diff --git a/tests/functional/test_aarch64_aspeed.py b/tests/functional/test_aarch64_aspeed.py
index c7f3b3b319..4b6851db2a 100755
--- a/tests/functional/test_aarch64_aspeed.py
+++ b/tests/functional/test_aarch64_aspeed.py
@@ -18,6 +18,8 @@ class AST2x00MachineSDK(QemuSystemTest):
     def do_test_aarch64_aspeed_sdk_start(self, image):
         self.require_netdev('user')
         self.vm.set_console()
+        self.vm.add_args('-device',
+                         'tmp105,bus=aspeed.i2c.bus.1,address=0x4d,id=tmp-test')
         self.vm.add_args('-drive', 'file=' + image + ',if=mtd,format=raw',
                          '-net', 'nic', '-net', 'user', '-snapshot')
 
@@ -35,6 +37,17 @@ class AST2x00MachineSDK(QemuSystemTest):
             'https://github.com/AspeedTech-BMC/openbmc/releases/download/v09.05/ast2700-default-obmc.tar.gz',
             'c1f4496aec06743c812a6e9a1a18d032f34d62f3ddb6956e924fef62aa2046a5')
 
+    def do_ast2700_i2c_test(self):
+        exec_command_and_wait_for_pattern(self,
+            'echo lm75 0x4d > /sys/class/i2c-dev/i2c-1/device/new_device ',
+            'i2c i2c-1: new_device: Instantiated device lm75 at 0x4d')
+        exec_command_and_wait_for_pattern(self,
+            'cat /sys/bus/i2c/devices/1-004d/hwmon/hwmon*/temp1_input', '0')
+        self.vm.cmd('qom-set', path='/machine/peripheral/tmp-test',
+                    property='temperature', value=18000)
+        exec_command_and_wait_for_pattern(self,
+            'cat /sys/bus/i2c/devices/1-004d/hwmon/hwmon*/temp1_input', '18000')
+
     def start_ast2700_test(self, name):
         num_cpu = 4
         uboot_size = os.path.getsize(self.scratch_file(name,
@@ -73,8 +86,6 @@ class AST2x00MachineSDK(QemuSystemTest):
                              f'loader,addr=0x430000000,cpu-num={i}')
 
         self.vm.add_args('-smp', str(num_cpu))
-        self.vm.add_args('-device',
-                         'tmp105,bus=aspeed.i2c.bus.1,address=0x4d,id=tmp-test')
         self.do_test_aarch64_aspeed_sdk_start(
             self.scratch_file(name, 'image-bmc'))
 
@@ -83,28 +94,19 @@ class AST2x00MachineSDK(QemuSystemTest):
         exec_command_and_wait_for_pattern(self, 'root', 'Password:')
         exec_command_and_wait_for_pattern(self, '0penBmc', f'root@{name}:~#')
 
-        exec_command_and_wait_for_pattern(self,
-            'echo lm75 0x4d > /sys/class/i2c-dev/i2c-1/device/new_device ',
-            'i2c i2c-1: new_device: Instantiated device lm75 at 0x4d')
-        exec_command_and_wait_for_pattern(self,
-            'cat /sys/bus/i2c/devices/1-004d/hwmon/hwmon*/temp1_input', '0')
-        self.vm.cmd('qom-set', path='/machine/peripheral/tmp-test',
-                    property='temperature', value=18000)
-        exec_command_and_wait_for_pattern(self,
-            'cat /sys/bus/i2c/devices/1-004d/hwmon/hwmon*/temp1_input', '18000')
-
     def test_aarch64_ast2700_evb_sdk_v09_05(self):
         self.set_machine('ast2700-evb')
 
         self.archive_extract(self.ASSET_SDK_V905_AST2700)
         self.start_ast2700_test('ast2700-a0-default')
+        self.do_ast2700_i2c_test()
 
     def test_aarch64_ast2700a1_evb_sdk_v09_05(self):
         self.set_machine('ast2700a1-evb')
 
         self.archive_extract(self.ASSET_SDK_V905_AST2700A1)
         self.start_ast2700_test('ast2700-default')
-
+        self.do_ast2700_i2c_test()
 
 if __name__ == '__main__':
     QemuSystemTest.main()

From b2a7c02a9a6d350005f722ca3df50df20d7f051e Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Wed, 23 Apr 2025 15:23:44 +0800
Subject: [PATCH 0616/2760] tests/functional/aspeed: Update test ASPEED SDK
 v09.06
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250423072350.541742-9-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 tests/functional/test_aarch64_aspeed.py | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/tests/functional/test_aarch64_aspeed.py b/tests/functional/test_aarch64_aspeed.py
index 4b6851db2a..b6e2be1f82 100755
--- a/tests/functional/test_aarch64_aspeed.py
+++ b/tests/functional/test_aarch64_aspeed.py
@@ -29,13 +29,13 @@ class AST2x00MachineSDK(QemuSystemTest):
         wait_for_console_pattern(self, '## Loading kernel from FIT Image')
         wait_for_console_pattern(self, 'Starting kernel ...')
 
-    ASSET_SDK_V905_AST2700 = Asset(
-            'https://github.com/AspeedTech-BMC/openbmc/releases/download/v09.05/ast2700-a0-default-obmc.tar.gz',
-            'cfbbd1cce72f2a3b73b9080c41eecdadebb7077fba4f7806d72ac99f3e84b74a')
+    ASSET_SDK_V906_AST2700 = Asset(
+            'https://github.com/AspeedTech-BMC/openbmc/releases/download/v09.06/ast2700-a0-default-obmc.tar.gz',
+            '7247b6f19dbfb700686f8d9f723ac23f3eb229226c0589cb9b06b80d1b61f3cb')
 
-    ASSET_SDK_V905_AST2700A1 = Asset(
-            'https://github.com/AspeedTech-BMC/openbmc/releases/download/v09.05/ast2700-default-obmc.tar.gz',
-            'c1f4496aec06743c812a6e9a1a18d032f34d62f3ddb6956e924fef62aa2046a5')
+    ASSET_SDK_V906_AST2700A1 = Asset(
+            'https://github.com/AspeedTech-BMC/openbmc/releases/download/v09.06/ast2700-default-obmc.tar.gz',
+            'f1d53e0be8a404ecce3e105f72bc50fa4e090ad13160ffa91b10a6e0233a9dc6')
 
     def do_ast2700_i2c_test(self):
         exec_command_and_wait_for_pattern(self,
@@ -94,17 +94,17 @@ class AST2x00MachineSDK(QemuSystemTest):
         exec_command_and_wait_for_pattern(self, 'root', 'Password:')
         exec_command_and_wait_for_pattern(self, '0penBmc', f'root@{name}:~#')
 
-    def test_aarch64_ast2700_evb_sdk_v09_05(self):
+    def test_aarch64_ast2700_evb_sdk_v09_06(self):
         self.set_machine('ast2700-evb')
 
-        self.archive_extract(self.ASSET_SDK_V905_AST2700)
+        self.archive_extract(self.ASSET_SDK_V906_AST2700)
         self.start_ast2700_test('ast2700-a0-default')
         self.do_ast2700_i2c_test()
 
-    def test_aarch64_ast2700a1_evb_sdk_v09_05(self):
+    def test_aarch64_ast2700a1_evb_sdk_v09_06(self):
         self.set_machine('ast2700a1-evb')
 
-        self.archive_extract(self.ASSET_SDK_V905_AST2700A1)
+        self.archive_extract(self.ASSET_SDK_V906_AST2700A1)
         self.start_ast2700_test('ast2700-default')
         self.do_ast2700_i2c_test()
 

From af93cef791b5976b9b6d977da36e25999a6cebe1 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Wed, 23 Apr 2025 15:23:45 +0800
Subject: [PATCH 0617/2760] tests/functional/aspeed: extract boot and login
 sequence into helper function
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Extracted repeated boot and login steps into a new helper function.
No change in functional behavior.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250423072350.541742-10-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 tests/functional/test_aarch64_aspeed.py | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/tests/functional/test_aarch64_aspeed.py b/tests/functional/test_aarch64_aspeed.py
index b6e2be1f82..1e1f3f9ece 100755
--- a/tests/functional/test_aarch64_aspeed.py
+++ b/tests/functional/test_aarch64_aspeed.py
@@ -25,10 +25,15 @@ class AST2x00MachineSDK(QemuSystemTest):
 
         self.vm.launch()
 
+    def verify_openbmc_boot_and_login(self, name):
         wait_for_console_pattern(self, 'U-Boot 2023.10')
         wait_for_console_pattern(self, '## Loading kernel from FIT Image')
         wait_for_console_pattern(self, 'Starting kernel ...')
 
+        wait_for_console_pattern(self, f'{name} login:')
+        exec_command_and_wait_for_pattern(self, 'root', 'Password:')
+        exec_command_and_wait_for_pattern(self, '0penBmc', f'root@{name}:~#')
+
     ASSET_SDK_V906_AST2700 = Asset(
             'https://github.com/AspeedTech-BMC/openbmc/releases/download/v09.06/ast2700-a0-default-obmc.tar.gz',
             '7247b6f19dbfb700686f8d9f723ac23f3eb229226c0589cb9b06b80d1b61f3cb')
@@ -89,16 +94,12 @@ class AST2x00MachineSDK(QemuSystemTest):
         self.do_test_aarch64_aspeed_sdk_start(
             self.scratch_file(name, 'image-bmc'))
 
-        wait_for_console_pattern(self, f'{name} login:')
-
-        exec_command_and_wait_for_pattern(self, 'root', 'Password:')
-        exec_command_and_wait_for_pattern(self, '0penBmc', f'root@{name}:~#')
-
     def test_aarch64_ast2700_evb_sdk_v09_06(self):
         self.set_machine('ast2700-evb')
 
         self.archive_extract(self.ASSET_SDK_V906_AST2700)
         self.start_ast2700_test('ast2700-a0-default')
+        self.verify_openbmc_boot_and_login('ast2700-a0-default')
         self.do_ast2700_i2c_test()
 
     def test_aarch64_ast2700a1_evb_sdk_v09_06(self):
@@ -106,6 +107,7 @@ class AST2x00MachineSDK(QemuSystemTest):
 
         self.archive_extract(self.ASSET_SDK_V906_AST2700A1)
         self.start_ast2700_test('ast2700-default')
+        self.verify_openbmc_boot_and_login('ast2700-default')
         self.do_ast2700_i2c_test()
 
 if __name__ == '__main__':

From 2e143da2fbd92d9c3ae2d7a315efca5c6af24e69 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Thu, 24 Apr 2025 15:51:29 +0800
Subject: [PATCH 0618/2760] hw/arm/aspeed_ast27x0 Introduce vbootrom memory
 region
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Introduce a new vbootrom memory region. The region is mapped at address
"0x00000000" and has a size of 128KB, identical to the SRAM region size.
This memory region is intended for loading a vbootrom image file as part of the
boot process.

The vbootrom registered in the SoC's address space using the ASPEED_DEV_VBOOTROM
index.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Nabih Estefan <nabihestefan@google.com>
Tested-by: Nabih Estefan <nabihestefan@google.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250424075135.3715128-2-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed_ast27x0.c     | 9 +++++++++
 include/hw/arm/aspeed_soc.h | 2 ++
 2 files changed, 11 insertions(+)

diff --git a/hw/arm/aspeed_ast27x0.c b/hw/arm/aspeed_ast27x0.c
index 2e21c3a98f..a289e65e49 100644
--- a/hw/arm/aspeed_ast27x0.c
+++ b/hw/arm/aspeed_ast27x0.c
@@ -24,6 +24,7 @@
 #include "qemu/log.h"
 
 static const hwaddr aspeed_soc_ast2700_memmap[] = {
+    [ASPEED_DEV_VBOOTROM]  =  0x00000000,
     [ASPEED_DEV_SRAM]      =  0x10000000,
     [ASPEED_DEV_EHCI1]     =  0x12061000,
     [ASPEED_DEV_EHCI2]     =  0x12063000,
@@ -672,6 +673,14 @@ static void aspeed_soc_ast2700_realize(DeviceState *dev, Error **errp)
     memory_region_add_subregion(s->memory,
                                 sc->memmap[ASPEED_DEV_SRAM], &s->sram);
 
+    /* VBOOTROM */
+    if (!memory_region_init_ram(&s->vbootrom, OBJECT(s), "aspeed.vbootrom",
+                                0x20000, errp)) {
+        return;
+    }
+    memory_region_add_subregion(s->memory,
+                                sc->memmap[ASPEED_DEV_VBOOTROM], &s->vbootrom);
+
     /* SCU */
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->scu), errp)) {
         return;
diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index c1e80c8908..4dcb1010dc 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -59,6 +59,7 @@ struct AspeedSoCState {
     MemoryRegion sram;
     MemoryRegion spi_boot_container;
     MemoryRegion spi_boot;
+    MemoryRegion vbootrom;
     AddressSpace dram_as;
     AspeedRtcState rtc;
     AspeedTimerCtrlState timerctrl;
@@ -169,6 +170,7 @@ struct AspeedSoCClass {
 const char *aspeed_soc_cpu_type(AspeedSoCClass *sc);
 
 enum {
+    ASPEED_DEV_VBOOTROM,
     ASPEED_DEV_SPI_BOOT,
     ASPEED_DEV_IOMEM,
     ASPEED_DEV_UART0,

From ee447054404ed8bbdea0eece888da354afe38d97 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Thu, 24 Apr 2025 15:51:31 +0800
Subject: [PATCH 0619/2760] hw/arm/aspeed: Add support for loading vbootrom
 image via "-bios"
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Introduce "aspeed_load_vbootrom()" to support loading a virtual boot ROM image
into the vbootrom memory region, using the "-bios" command-line option.

Introduce a new "vbootrom" field in the AspeedMachineClass to indicate whether
a machine supports the virtual boot ROM region.

Set this field to true by default for the AST2700-A0 and AST2700-A1 EVB
machines.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Nabih Estefan <nabihestefan@google.com>
Tested-by: Nabih Estefan <nabihestefan@google.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250424075135.3715128-4-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed.c         | 36 ++++++++++++++++++++++++++++++++++++
 include/hw/arm/aspeed.h |  1 +
 2 files changed, 37 insertions(+)

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index 20f418fb63..d0b333646e 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -27,6 +27,7 @@
 #include "system/reset.h"
 #include "hw/loader.h"
 #include "qemu/error-report.h"
+#include "qemu/datadir.h"
 #include "qemu/units.h"
 #include "hw/qdev-clock.h"
 #include "system/system.h"
@@ -305,6 +306,33 @@ static void aspeed_install_boot_rom(AspeedMachineState *bmc, BlockBackend *blk,
                    rom_size, &error_abort);
 }
 
+#define VBOOTROM_FILE_NAME  "ast27x0_bootrom.bin"
+
+/*
+ * This function locates the vbootrom image file specified via the command line
+ * using the -bios option. It loads the specified image into the vbootrom
+ * memory region and handles errors if the file cannot be found or loaded.
+ */
+static void aspeed_load_vbootrom(AspeedMachineState *bmc, const char *bios_name,
+                                 Error **errp)
+{
+    g_autofree char *filename = NULL;
+    AspeedSoCState *soc = bmc->soc;
+    int ret;
+
+    filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, bios_name);
+    if (!filename) {
+        error_setg(errp, "Could not find vbootrom image '%s'", bios_name);
+        return;
+    }
+
+    ret = load_image_mr(filename, &soc->vbootrom);
+    if (ret < 0) {
+        error_setg(errp, "Failed to load vbootrom image '%s'", bios_name);
+        return;
+    }
+}
+
 void aspeed_board_init_flashes(AspeedSMCState *s, const char *flashtype,
                                       unsigned int count, int unit0)
 {
@@ -380,6 +408,7 @@ static void aspeed_machine_init(MachineState *machine)
     AspeedMachineClass *amc = ASPEED_MACHINE_GET_CLASS(machine);
     AspeedSoCClass *sc;
     int i;
+    const char *bios_name = NULL;
     DriveInfo *emmc0 = NULL;
     bool boot_emmc;
 
@@ -482,6 +511,11 @@ static void aspeed_machine_init(MachineState *machine)
         }
     }
 
+    if (amc->vbootrom) {
+        bios_name = machine->firmware ?: VBOOTROM_FILE_NAME;
+        aspeed_load_vbootrom(bmc, bios_name, &error_abort);
+    }
+
     arm_load_kernel(ARM_CPU(first_cpu), machine, &aspeed_board_binfo);
 }
 
@@ -1701,6 +1735,7 @@ static void aspeed_machine_ast2700a0_evb_class_init(ObjectClass *oc,
     amc->macs_mask = ASPEED_MAC0_ON | ASPEED_MAC1_ON | ASPEED_MAC2_ON;
     amc->uart_default = ASPEED_DEV_UART12;
     amc->i2c_init  = ast2700_evb_i2c_init;
+    amc->vbootrom = true;
     mc->auto_create_sdcard = true;
     mc->default_ram_size = 1 * GiB;
     aspeed_machine_class_init_cpus_defaults(mc);
@@ -1722,6 +1757,7 @@ static void aspeed_machine_ast2700a1_evb_class_init(ObjectClass *oc,
     amc->macs_mask = ASPEED_MAC0_ON | ASPEED_MAC1_ON | ASPEED_MAC2_ON;
     amc->uart_default = ASPEED_DEV_UART12;
     amc->i2c_init  = ast2700_evb_i2c_init;
+    amc->vbootrom = true;
     mc->auto_create_sdcard = true;
     mc->default_ram_size = 1 * GiB;
     aspeed_machine_class_init_cpus_defaults(mc);
diff --git a/include/hw/arm/aspeed.h b/include/hw/arm/aspeed.h
index 9cae45a1c9..973277bea6 100644
--- a/include/hw/arm/aspeed.h
+++ b/include/hw/arm/aspeed.h
@@ -40,6 +40,7 @@ struct AspeedMachineClass {
     void (*i2c_init)(AspeedMachineState *bmc);
     uint32_t uart_default;
     bool sdhci_wp_inverted;
+    bool vbootrom;
 };
 
 

From 9e3d7afd7da40c9a1ba1a6b4e1103037f3a77da8 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Thu, 24 Apr 2025 15:51:32 +0800
Subject: [PATCH 0620/2760] tests/functional/aspeed: Add to test vbootrom for
 AST2700
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add the AST2700 functional test to boot using the vbootrom image
instead of manually loading boot components with -device loader.
The boot ROM binary is now passed via the
-bios option, using the image located in pc-bios/ast27x0_bootrom.bin.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250424075135.3715128-5-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 tests/functional/test_aarch64_aspeed.py | 26 +++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/tests/functional/test_aarch64_aspeed.py b/tests/functional/test_aarch64_aspeed.py
index 1e1f3f9ece..d02dc7991c 100755
--- a/tests/functional/test_aarch64_aspeed.py
+++ b/tests/functional/test_aarch64_aspeed.py
@@ -25,6 +25,18 @@ class AST2x00MachineSDK(QemuSystemTest):
 
         self.vm.launch()
 
+    def verify_vbootrom_firmware_flow(self):
+        wait_for_console_pattern(self, 'Found valid FIT image')
+        wait_for_console_pattern(self, '[uboot] loading')
+        wait_for_console_pattern(self, 'done')
+        wait_for_console_pattern(self, '[fdt] loading')
+        wait_for_console_pattern(self, 'done')
+        wait_for_console_pattern(self, '[tee] loading')
+        wait_for_console_pattern(self, 'done')
+        wait_for_console_pattern(self, '[atf] loading')
+        wait_for_console_pattern(self, 'done')
+        wait_for_console_pattern(self, 'Jumping to BL31 (Trusted Firmware-A)')
+
     def verify_openbmc_boot_and_login(self, name):
         wait_for_console_pattern(self, 'U-Boot 2023.10')
         wait_for_console_pattern(self, '## Loading kernel from FIT Image')
@@ -94,6 +106,11 @@ class AST2x00MachineSDK(QemuSystemTest):
         self.do_test_aarch64_aspeed_sdk_start(
             self.scratch_file(name, 'image-bmc'))
 
+    def start_ast2700_test_vbootrom(self, name):
+        self.vm.add_args('-bios', 'ast27x0_bootrom.bin')
+        self.do_test_aarch64_aspeed_sdk_start(
+                self.scratch_file(name, 'image-bmc'))
+
     def test_aarch64_ast2700_evb_sdk_v09_06(self):
         self.set_machine('ast2700-evb')
 
@@ -110,5 +127,14 @@ class AST2x00MachineSDK(QemuSystemTest):
         self.verify_openbmc_boot_and_login('ast2700-default')
         self.do_ast2700_i2c_test()
 
+    def test_aarch64_ast2700a1_evb_sdk_vbootrom_v09_06(self):
+        self.set_machine('ast2700a1-evb')
+
+        self.archive_extract(self.ASSET_SDK_V906_AST2700A1)
+        self.start_ast2700_test_vbootrom('ast2700-default')
+        self.verify_vbootrom_firmware_flow()
+        self.verify_openbmc_boot_and_login('ast2700-default')
+        self.do_ast2700_i2c_test()
+
 if __name__ == '__main__':
     QemuSystemTest.main()

From 3eb01cfe9b85cd64255f6ef93346a3de17fa9632 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Thu, 24 Apr 2025 15:51:33 +0800
Subject: [PATCH 0621/2760] docs/system/arm/aspeed: move AST2700 content to new
 section
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Moved AST2700-related content from the general Aspeed board list into a
dedicated section for Aspeed 2700 family boards. Improves clarity and
readability.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250424075135.3715128-6-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 docs/system/arm/aspeed.rst | 70 ++++++++++++++++++++++++++++++++++----
 1 file changed, 63 insertions(+), 7 deletions(-)

diff --git a/docs/system/arm/aspeed.rst b/docs/system/arm/aspeed.rst
index 97fd6a0e7f..08a33b7008 100644
--- a/docs/system/arm/aspeed.rst
+++ b/docs/system/arm/aspeed.rst
@@ -1,12 +1,11 @@
-Aspeed family boards (``ast2500-evb``, ``ast2600-evb``, ``ast2700-evb``, ``bletchley-bmc``, ``fuji-bmc``, ``fby35-bmc``, ``fp5280g2-bmc``, ``g220a-bmc``, ``palmetto-bmc``, ``qcom-dc-scm-v1-bmc``, ``qcom-firework-bmc``, ``quanta-q71l-bmc``, ``rainier-bmc``, ``romulus-bmc``, ``sonorapass-bmc``, ``supermicrox11-bmc``, ``supermicrox11spi-bmc``, ``tiogapass-bmc``, ``witherspoon-bmc``, ``yosemitev2-bmc``)
+Aspeed family boards (``ast2500-evb``, ``ast2600-evb``, ``bletchley-bmc``, ``fuji-bmc``, ``fby35-bmc``, ``fp5280g2-bmc``, ``g220a-bmc``, ``palmetto-bmc``, ``qcom-dc-scm-v1-bmc``, ``qcom-firework-bmc``, ``quanta-q71l-bmc``, ``rainier-bmc``, ``romulus-bmc``, ``sonorapass-bmc``, ``supermicrox11-bmc``, ``supermicrox11spi-bmc``, ``tiogapass-bmc``, ``witherspoon-bmc``, ``yosemitev2-bmc``)
 ==================================================================================================================================================================================================================================================================================================================================================================================================================
 
 The QEMU Aspeed machines model BMCs of various OpenPOWER systems and
 Aspeed evaluation boards. They are based on different releases of the
 Aspeed SoC : the AST2400 integrating an ARM926EJ-S CPU (400MHz), the
 AST2500 with an ARM1176JZS CPU (800MHz), the AST2600
-with dual cores ARM Cortex-A7 CPUs (1.2GHz) and more recently the AST2700
-with quad cores ARM Cortex-A35 64 bits CPUs (1.6GHz)
+with dual cores ARM Cortex-A7 CPUs (1.2GHz).
 
 The SoC comes with RAM, Gigabit ethernet, USB, SD/MMC, USB, SPI, I2C,
 etc.
@@ -39,10 +38,6 @@ AST2600 SoC based machines :
 - ``qcom-dc-scm-v1-bmc``   Qualcomm DC-SCM V1 BMC
 - ``qcom-firework-bmc``    Qualcomm Firework BMC
 
-AST2700 SoC based machines :
-
-- ``ast2700-evb``          Aspeed AST2700 Evaluation board (Cortex-A35)
-
 Supported devices
 -----------------
 
@@ -247,6 +242,67 @@ under Linux), use :
 
   -M ast2500-evb,bmc-console=uart3
 
+Aspeed 2700 family boards (``ast2700-evb``)
+==================================================================
+
+The QEMU Aspeed machines model BMCs of Aspeed evaluation boards.
+They are based on different releases of the Aspeed SoC :
+the AST2700 with quad cores ARM Cortex-A35 64 bits CPUs (1.6GHz).
+
+The SoC comes with RAM, Gigabit ethernet, USB, SD/MMC, USB, SPI, I2C,
+etc.
+
+AST2700 SoC based machines :
+
+- ``ast2700-evb``          Aspeed AST2700 Evaluation board (Cortex-A35)
+
+Supported devices
+-----------------
+ * Interrupt Controller
+ * Timer Controller
+ * RTC Controller
+ * I2C Controller
+ * System Control Unit (SCU)
+ * SRAM mapping
+ * X-DMA Controller (basic interface)
+ * Static Memory Controller (SMC or FMC) - Only SPI Flash support
+ * SPI Memory Controller
+ * USB 2.0 Controller
+ * SD/MMC storage controllers
+ * SDRAM controller (dummy interface for basic settings and training)
+ * Watchdog Controller
+ * GPIO Controller (Master only)
+ * UART
+ * Ethernet controllers
+ * Front LEDs (PCA9552 on I2C bus)
+ * LPC Peripheral Controller (a subset of subdevices are supported)
+ * Hash/Crypto Engine (HACE) - Hash support only. TODO: Crypto
+ * ADC
+ * eMMC Boot Controller (dummy)
+ * PECI Controller (minimal)
+ * I3C Controller
+ * Internal Bridge Controller (SLI dummy)
+
+Missing devices
+---------------
+ * Coprocessor support
+ * PWM and Fan Controller
+ * Slave GPIO Controller
+ * Super I/O Controller
+ * PCI-Express 1 Controller
+ * Graphic Display Controller
+ * MCTP Controller
+ * Mailbox Controller
+ * Virtual UART
+ * eSPI Controller
+
+Boot options
+------------
+
+Images can be downloaded from the ASPEED Forked OpenBMC GitHub release repository :
+
+   https://github.com/AspeedTech-BMC/openbmc/releases
+
 Booting the ast2700-evb machine
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 

From d2b857ef9a997237ebedda53c3db50b264baf4fc Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Thu, 24 Apr 2025 15:51:34 +0800
Subject: [PATCH 0622/2760] docs/system/arm/aspeed: Support vbootrom for
 AST2700
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Using the vbootrom image support and the boot ROM binary is
now passed via the -bios option, using the image located in
pc-bios/ast27x0_bootrom.bin.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Nabih Estefan <nabihestefan@google.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250424075135.3715128-7-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 docs/system/arm/aspeed.rst | 29 ++++++++++++++++++++++++++++-
 1 file changed, 28 insertions(+), 1 deletion(-)

diff --git a/docs/system/arm/aspeed.rst b/docs/system/arm/aspeed.rst
index 08a33b7008..014545f444 100644
--- a/docs/system/arm/aspeed.rst
+++ b/docs/system/arm/aspeed.rst
@@ -306,7 +306,14 @@ Images can be downloaded from the ASPEED Forked OpenBMC GitHub release repositor
 Booting the ast2700-evb machine
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
-Boot the AST2700 machine from the flash image, use an MTD drive :
+Boot the AST2700 machine from the flash image.
+
+There are two supported methods for booting the AST2700 machine with a flash image:
+
+Manual boot using ``-device loader``:
+
+It causes all 4 CPU cores to start execution from address ``0x430000000``, which
+corresponds to the BL31 image load address.
 
 .. code-block:: bash
 
@@ -326,6 +333,26 @@ Boot the AST2700 machine from the flash image, use an MTD drive :
        -drive file=${IMGDIR}/image-bmc,format=raw,if=mtd \
        -nographic
 
+Boot using a virtual boot ROM (``-bios``):
+
+If users do not specify the ``-bios option``, QEMU will attempt to load the
+default vbootrom image ``ast27x0_bootrom.bin`` from either the current working
+directory or the ``pc-bios`` directory within the QEMU source tree.
+
+.. code-block:: bash
+
+  $ qemu-system-aarch64 -M ast2700-evb \
+      -drive file=image-bmc,format=raw,if=mtd \
+      -nographic
+
+The ``-bios`` option allows users to specify a custom path for the vbootrom
+image to be loaded during boot. This will load the vbootrom image from the
+specified path in the ${HOME} directory.
+
+.. code-block:: bash
+
+  -bios ${HOME}/ast27x0_bootrom.bin
+
 Aspeed minibmc family boards (``ast1030-evb``)
 ==================================================================
 

From 91064bea6b2d747a981cb3bd2904e56f443e6c67 Mon Sep 17 00:00:00 2001
From: Steven Lee <steven_lee@aspeedtech.com>
Date: Fri, 2 May 2025 18:34:37 +0800
Subject: [PATCH 0623/2760] aspeed: ast27x0: Map unimplemented devices in SoC
 memory
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Maps following unimplemented devices in SoC memory
- dpmcu
- iomem
- iomem0
- iomem1
- ltpi

Iomem, Iomem0 and Iomem1 include unimplemented controllers in the memory ranges 0x0 - 0x1000000, 0x120000000 - 0x121000000 and
0x14000000 - 0x141000000.

For instance:
- USB hub at 0x12010000
- eSPI at 0x14C5000
- PWM at 0x140C0000

DPMCU stands for Display Port MCU controller. LTPI is used to connect to AST1700.
AST1700 is an I/O expander that supports the DC-SCM 2.1 LTPI protocol.
It provides AST2700 with additional GPIO, UART, I3C, and other interfaces.

Signed-off-by: Steven Lee <steven_lee@aspeedtech.com>
Change-Id: Iae4db49a4818af3e2c43c16a27fc76329d2405d6
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250502103449.3091642-2-steven_lee@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed_ast27x0.c     | 52 ++++++++++++++++++++++++++++++++-----
 include/hw/arm/aspeed_soc.h |  6 +++++
 2 files changed, 51 insertions(+), 7 deletions(-)

diff --git a/hw/arm/aspeed_ast27x0.c b/hw/arm/aspeed_ast27x0.c
index a289e65e49..21769669df 100644
--- a/hw/arm/aspeed_ast27x0.c
+++ b/hw/arm/aspeed_ast27x0.c
@@ -23,9 +23,17 @@
 #include "qobject/qlist.h"
 #include "qemu/log.h"
 
+#define AST2700_SOC_IO_SIZE          0x01000000
+#define AST2700_SOC_IOMEM_SIZE       0x01000000
+#define AST2700_SOC_DPMCU_SIZE       0x00040000
+#define AST2700_SOC_LTPI_SIZE        0x01000000
+
 static const hwaddr aspeed_soc_ast2700_memmap[] = {
+    [ASPEED_DEV_IOMEM]     =  0x00000000,
     [ASPEED_DEV_VBOOTROM]  =  0x00000000,
     [ASPEED_DEV_SRAM]      =  0x10000000,
+    [ASPEED_DEV_DPMCU]     =  0x11000000,
+    [ASPEED_DEV_IOMEM0]    =  0x12000000,
     [ASPEED_DEV_EHCI1]     =  0x12061000,
     [ASPEED_DEV_EHCI2]     =  0x12063000,
     [ASPEED_DEV_HACE]      =  0x12070000,
@@ -39,6 +47,7 @@ static const hwaddr aspeed_soc_ast2700_memmap[] = {
     [ASPEED_DEV_TIMER1]    =  0x12C10000,
     [ASPEED_DEV_SLI]       =  0x12C17000,
     [ASPEED_DEV_UART4]     =  0X12C1A000,
+    [ASPEED_DEV_IOMEM1]    =  0x14000000,
     [ASPEED_DEV_FMC]       =  0x14000000,
     [ASPEED_DEV_SPI0]      =  0x14010000,
     [ASPEED_DEV_SPI1]      =  0x14020000,
@@ -73,6 +82,7 @@ static const hwaddr aspeed_soc_ast2700_memmap[] = {
     [ASPEED_DEV_UART12]    =  0X14C33B00,
     [ASPEED_DEV_WDT]       =  0x14C37000,
     [ASPEED_DEV_SPI_BOOT]  =  0x100000000,
+    [ASPEED_DEV_LTPI]      =  0x300000000,
     [ASPEED_DEV_SDRAM]     =  0x400000000,
 };
 
@@ -507,6 +517,16 @@ static void aspeed_soc_ast2700_init(Object *obj)
 
     snprintf(typename, sizeof(typename), "aspeed.hace-%s", socname);
     object_initialize_child(obj, "hace", &s->hace, typename);
+    object_initialize_child(obj, "dpmcu", &s->dpmcu,
+                            TYPE_UNIMPLEMENTED_DEVICE);
+    object_initialize_child(obj, "ltpi", &s->ltpi,
+                            TYPE_UNIMPLEMENTED_DEVICE);
+    object_initialize_child(obj, "iomem", &s->iomem,
+                            TYPE_UNIMPLEMENTED_DEVICE);
+    object_initialize_child(obj, "iomem0", &s->iomem0,
+                            TYPE_UNIMPLEMENTED_DEVICE);
+    object_initialize_child(obj, "iomem1", &s->iomem1,
+                            TYPE_UNIMPLEMENTED_DEVICE);
 }
 
 /*
@@ -542,8 +562,11 @@ static bool aspeed_soc_ast2700_gic_realize(DeviceState *dev, Error **errp)
     if (!sysbus_realize(gicbusdev, errp)) {
         return false;
     }
-    sysbus_mmio_map(gicbusdev, 0, sc->memmap[ASPEED_GIC_DIST]);
-    sysbus_mmio_map(gicbusdev, 1, sc->memmap[ASPEED_GIC_REDIST]);
+
+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&a->gic), 0,
+                    sc->memmap[ASPEED_GIC_DIST]);
+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&a->gic), 1,
+                    sc->memmap[ASPEED_GIC_REDIST]);
 
     for (i = 0; i < sc->num_cpus; i++) {
         DeviceState *cpudev = DEVICE(&a->cpu[i]);
@@ -911,11 +934,26 @@ static void aspeed_soc_ast2700_realize(DeviceState *dev, Error **errp)
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->hace), 0,
                        aspeed_soc_get_irq(s, ASPEED_DEV_HACE));
 
-    create_unimplemented_device("ast2700.dpmcu", 0x11000000, 0x40000);
-    create_unimplemented_device("ast2700.iomem0", 0x12000000, 0x01000000);
-    create_unimplemented_device("ast2700.iomem1", 0x14000000, 0x01000000);
-    create_unimplemented_device("ast2700.ltpi", 0x30000000, 0x1000000);
-    create_unimplemented_device("ast2700.io", 0x0, 0x4000000);
+    aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&s->dpmcu),
+                                  "aspeed.dpmcu",
+                                  sc->memmap[ASPEED_DEV_DPMCU],
+                                  AST2700_SOC_DPMCU_SIZE);
+    aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&s->ltpi),
+                                  "aspeed.ltpi",
+                                  sc->memmap[ASPEED_DEV_LTPI],
+                                  AST2700_SOC_LTPI_SIZE);
+    aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&s->iomem),
+                                  "aspeed.io",
+                                  sc->memmap[ASPEED_DEV_IOMEM],
+                                  AST2700_SOC_IO_SIZE);
+    aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&s->iomem0),
+                                  "aspeed.iomem0",
+                                  sc->memmap[ASPEED_DEV_IOMEM0],
+                                  AST2700_SOC_IOMEM_SIZE);
+    aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&s->iomem1),
+                                  "aspeed.iomem1",
+                                  sc->memmap[ASPEED_DEV_IOMEM1],
+                                  AST2700_SOC_IOMEM_SIZE);
 }
 
 static void aspeed_soc_ast2700a0_class_init(ObjectClass *oc, const void *data)
diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index 4dcb1010dc..5fcfd2fe2e 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -91,6 +91,8 @@ struct AspeedSoCState {
     SerialMM uart[ASPEED_UARTS_NUM];
     Clock *sysclk;
     UnimplementedDeviceState iomem;
+    UnimplementedDeviceState iomem0;
+    UnimplementedDeviceState iomem1;
     UnimplementedDeviceState video;
     UnimplementedDeviceState emmc_boot_controller;
     UnimplementedDeviceState dpmcu;
@@ -98,6 +100,7 @@ struct AspeedSoCState {
     UnimplementedDeviceState espi;
     UnimplementedDeviceState udc;
     UnimplementedDeviceState sgpiom;
+    UnimplementedDeviceState ltpi;
     UnimplementedDeviceState jtag[ASPEED_JTAG_NUM];
     AspeedAPB2OPBState fsi[2];
 };
@@ -173,6 +176,9 @@ enum {
     ASPEED_DEV_VBOOTROM,
     ASPEED_DEV_SPI_BOOT,
     ASPEED_DEV_IOMEM,
+    ASPEED_DEV_IOMEM0,
+    ASPEED_DEV_IOMEM1,
+    ASPEED_DEV_LTPI,
     ASPEED_DEV_UART0,
     ASPEED_DEV_UART1,
     ASPEED_DEV_UART2,

From 78110f821aa0c372bb8141ce8ec9f543f8660c36 Mon Sep 17 00:00:00 2001
From: Steven Lee <steven_lee@aspeedtech.com>
Date: Fri, 2 May 2025 18:34:38 +0800
Subject: [PATCH 0624/2760] aspeed: ast27x0: Correct hex notation for device
 addresses
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Corrected the hexadecimal notation for several device addresses in the
aspeed_soc_ast2700_memmap array by changing the uppercase 'X' to
lowercase 'x'.

Signed-off-by: Steven Lee <steven_lee@aspeedtech.com>
Change-Id: I45426e18ea8e68d7ccdf9b60c4ea235c4da33cc3
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250502103449.3091642-3-steven_lee@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed_ast27x0.c | 28 ++++++++++++++--------------
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/hw/arm/aspeed_ast27x0.c b/hw/arm/aspeed_ast27x0.c
index 21769669df..1974a25766 100644
--- a/hw/arm/aspeed_ast27x0.c
+++ b/hw/arm/aspeed_ast27x0.c
@@ -46,7 +46,7 @@ static const hwaddr aspeed_soc_ast2700_memmap[] = {
     [ASPEED_DEV_RTC]       =  0x12C0F000,
     [ASPEED_DEV_TIMER1]    =  0x12C10000,
     [ASPEED_DEV_SLI]       =  0x12C17000,
-    [ASPEED_DEV_UART4]     =  0X12C1A000,
+    [ASPEED_DEV_UART4]     =  0x12C1A000,
     [ASPEED_DEV_IOMEM1]    =  0x14000000,
     [ASPEED_DEV_FMC]       =  0x14000000,
     [ASPEED_DEV_SPI0]      =  0x14010000,
@@ -67,19 +67,19 @@ static const hwaddr aspeed_soc_ast2700_memmap[] = {
     [ASPEED_DEV_I2C]       =  0x14C0F000,
     [ASPEED_DEV_INTCIO]    =  0x14C18000,
     [ASPEED_DEV_SLIIO]     =  0x14C1E000,
-    [ASPEED_DEV_VUART]     =  0X14C30000,
-    [ASPEED_DEV_UART0]     =  0X14C33000,
-    [ASPEED_DEV_UART1]     =  0X14C33100,
-    [ASPEED_DEV_UART2]     =  0X14C33200,
-    [ASPEED_DEV_UART3]     =  0X14C33300,
-    [ASPEED_DEV_UART5]     =  0X14C33400,
-    [ASPEED_DEV_UART6]     =  0X14C33500,
-    [ASPEED_DEV_UART7]     =  0X14C33600,
-    [ASPEED_DEV_UART8]     =  0X14C33700,
-    [ASPEED_DEV_UART9]     =  0X14C33800,
-    [ASPEED_DEV_UART10]    =  0X14C33900,
-    [ASPEED_DEV_UART11]    =  0X14C33A00,
-    [ASPEED_DEV_UART12]    =  0X14C33B00,
+    [ASPEED_DEV_VUART]     =  0x14C30000,
+    [ASPEED_DEV_UART0]     =  0x14C33000,
+    [ASPEED_DEV_UART1]     =  0x14C33100,
+    [ASPEED_DEV_UART2]     =  0x14C33200,
+    [ASPEED_DEV_UART3]     =  0x14C33300,
+    [ASPEED_DEV_UART5]     =  0x14C33400,
+    [ASPEED_DEV_UART6]     =  0x14C33500,
+    [ASPEED_DEV_UART7]     =  0x14C33600,
+    [ASPEED_DEV_UART8]     =  0x14C33700,
+    [ASPEED_DEV_UART9]     =  0x14C33800,
+    [ASPEED_DEV_UART10]    =  0x14C33900,
+    [ASPEED_DEV_UART11]    =  0x14C33A00,
+    [ASPEED_DEV_UART12]    =  0x14C33B00,
     [ASPEED_DEV_WDT]       =  0x14C37000,
     [ASPEED_DEV_SPI_BOOT]  =  0x100000000,
     [ASPEED_DEV_LTPI]      =  0x300000000,

From 8872b6717c37001e8f2e6c4ed0af20b1811d8f58 Mon Sep 17 00:00:00 2001
From: Steven Lee <steven_lee@aspeedtech.com>
Date: Fri, 2 May 2025 18:34:39 +0800
Subject: [PATCH 0625/2760] hw/intc/aspeed: Add support for AST2700 SSP INTC
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Define new types for ast2700ssp INTC and INTCIO
- Add register definitions for SSP INTC and INTCIO
- Implement write handlers for SSP INTC and INTCIO
- Register new types in aspeed_intc_register_types

The design of the SSP INTC and INTCIO controllers is similar to
AST2700, with the following differences:

- AST2700
  Support GICINT128 to GICINT136 in INTC
  The INTCIO GIC_192_201 has 10 output pins, mapped as follows:
    Bit 0 -> GIC 192
    Bit 1 -> GIC 193
    Bit 2 -> GIC 194
    Bit 3 -> GIC 195
    Bit 4 -> GIC 196

- AST2700-ssp
  Support SSPINT128 to SSPINT136 in INTC
  The INTCIO SSPINT_160_169 has 10 output pins, mapped as follows:
    Bit 0 -> SSPINT 160
    Bit 1 -> SSPINT 161
    Bit 2 -> SSPINT 162
    Bit 3 -> SSPINT 163
    Bit 4 -> SSPINT 164

Signed-off-by: Steven Lee <steven_lee@aspeedtech.com>
Change-Id: Ib8cb0e264505cef48e17f173e057f3b2d1ea35c4
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250502103449.3091642-4-steven_lee@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/intc/aspeed_intc.c         | 211 ++++++++++++++++++++++++++++++++++
 include/hw/intc/aspeed_intc.h |   3 +
 2 files changed, 214 insertions(+)

diff --git a/hw/intc/aspeed_intc.c b/hw/intc/aspeed_intc.c
index be7f516a3b..e889246951 100644
--- a/hw/intc/aspeed_intc.c
+++ b/hw/intc/aspeed_intc.c
@@ -62,6 +62,50 @@ REG32(GICINT196_STATUS,     0x44)
 REG32(GICINT197_EN,         0x50)
 REG32(GICINT197_STATUS,     0x54)
 
+/*
+ * SSP INTC Registers
+ */
+REG32(SSPINT128_EN,             0x2000)
+REG32(SSPINT128_STATUS,         0x2004)
+REG32(SSPINT129_EN,             0x2100)
+REG32(SSPINT129_STATUS,         0x2104)
+REG32(SSPINT130_EN,             0x2200)
+REG32(SSPINT130_STATUS,         0x2204)
+REG32(SSPINT131_EN,             0x2300)
+REG32(SSPINT131_STATUS,         0x2304)
+REG32(SSPINT132_EN,             0x2400)
+REG32(SSPINT132_STATUS,         0x2404)
+REG32(SSPINT133_EN,             0x2500)
+REG32(SSPINT133_STATUS,         0x2504)
+REG32(SSPINT134_EN,             0x2600)
+REG32(SSPINT134_STATUS,         0x2604)
+REG32(SSPINT135_EN,             0x2700)
+REG32(SSPINT135_STATUS,         0x2704)
+REG32(SSPINT136_EN,             0x2800)
+REG32(SSPINT136_STATUS,         0x2804)
+REG32(SSPINT137_EN,             0x2900)
+REG32(SSPINT137_STATUS,         0x2904)
+REG32(SSPINT138_EN,             0x2A00)
+REG32(SSPINT138_STATUS,         0x2A04)
+REG32(SSPINT160_169_EN,         0x2B00)
+REG32(SSPINT160_169_STATUS,     0x2B04)
+
+/*
+ * SSP INTCIO Registers
+ */
+REG32(SSPINT160_EN,         0x180)
+REG32(SSPINT160_STATUS,     0x184)
+REG32(SSPINT161_EN,         0x190)
+REG32(SSPINT161_STATUS,     0x194)
+REG32(SSPINT162_EN,         0x1A0)
+REG32(SSPINT162_STATUS,     0x1A4)
+REG32(SSPINT163_EN,         0x1B0)
+REG32(SSPINT163_STATUS,     0x1B4)
+REG32(SSPINT164_EN,         0x1C0)
+REG32(SSPINT164_STATUS,     0x1C4)
+REG32(SSPINT165_EN,         0x1D0)
+REG32(SSPINT165_STATUS,     0x1D4)
+
 static const AspeedINTCIRQ *aspeed_intc_get_irq(AspeedINTCClass *aic,
                                                 uint32_t reg)
 {
@@ -450,6 +494,50 @@ static void aspeed_intc_write(void *opaque, hwaddr offset, uint64_t data,
     }
 }
 
+static void aspeed_ssp_intc_write(void *opaque, hwaddr offset, uint64_t data,
+                                        unsigned size)
+{
+    AspeedINTCState *s = ASPEED_INTC(opaque);
+    const char *name = object_get_typename(OBJECT(s));
+    uint32_t reg = offset >> 2;
+
+    trace_aspeed_intc_write(name, offset, size, data);
+
+    switch (reg) {
+    case R_SSPINT128_EN:
+    case R_SSPINT129_EN:
+    case R_SSPINT130_EN:
+    case R_SSPINT131_EN:
+    case R_SSPINT132_EN:
+    case R_SSPINT133_EN:
+    case R_SSPINT134_EN:
+    case R_SSPINT135_EN:
+    case R_SSPINT136_EN:
+    case R_SSPINT160_169_EN:
+        aspeed_intc_enable_handler(s, offset, data);
+        break;
+    case R_SSPINT128_STATUS:
+    case R_SSPINT129_STATUS:
+    case R_SSPINT130_STATUS:
+    case R_SSPINT131_STATUS:
+    case R_SSPINT132_STATUS:
+    case R_SSPINT133_STATUS:
+    case R_SSPINT134_STATUS:
+    case R_SSPINT135_STATUS:
+    case R_SSPINT136_STATUS:
+        aspeed_intc_status_handler(s, offset, data);
+        break;
+    case R_SSPINT160_169_STATUS:
+        aspeed_intc_status_handler_multi_outpins(s, offset, data);
+        break;
+    default:
+        s->regs[reg] = data;
+        break;
+    }
+
+    return;
+}
+
 static uint64_t aspeed_intcio_read(void *opaque, hwaddr offset,
                                    unsigned int size)
 {
@@ -496,6 +584,39 @@ static void aspeed_intcio_write(void *opaque, hwaddr offset, uint64_t data,
     }
 }
 
+static void aspeed_ssp_intcio_write(void *opaque, hwaddr offset, uint64_t data,
+                                unsigned size)
+{
+    AspeedINTCState *s = ASPEED_INTC(opaque);
+    const char *name = object_get_typename(OBJECT(s));
+    uint32_t reg = offset >> 2;
+
+    trace_aspeed_intc_write(name, offset, size, data);
+
+    switch (reg) {
+    case R_SSPINT160_EN:
+    case R_SSPINT161_EN:
+    case R_SSPINT162_EN:
+    case R_SSPINT163_EN:
+    case R_SSPINT164_EN:
+    case R_SSPINT165_EN:
+        aspeed_intc_enable_handler(s, offset, data);
+        break;
+    case R_SSPINT160_STATUS:
+    case R_SSPINT161_STATUS:
+    case R_SSPINT162_STATUS:
+    case R_SSPINT163_STATUS:
+    case R_SSPINT164_STATUS:
+    case R_SSPINT165_STATUS:
+        aspeed_intc_status_handler(s, offset, data);
+        break;
+    default:
+        s->regs[reg] = data;
+        break;
+    }
+
+    return;
+}
 
 static const MemoryRegionOps aspeed_intc_ops = {
     .read = aspeed_intc_read,
@@ -517,6 +638,26 @@ static const MemoryRegionOps aspeed_intcio_ops = {
     }
 };
 
+static const MemoryRegionOps aspeed_ssp_intc_ops = {
+    .read = aspeed_intc_read,
+    .write = aspeed_ssp_intc_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+    .valid = {
+        .min_access_size = 4,
+        .max_access_size = 4,
+    }
+};
+
+static const MemoryRegionOps aspeed_ssp_intcio_ops = {
+    .read = aspeed_intcio_read,
+    .write = aspeed_ssp_intcio_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+    .valid = {
+        .min_access_size = 4,
+        .max_access_size = 4,
+    }
+};
+
 static void aspeed_intc_instance_init(Object *obj)
 {
     AspeedINTCState *s = ASPEED_INTC(obj);
@@ -674,11 +815,81 @@ static const TypeInfo aspeed_2700_intcio_info = {
     .class_init = aspeed_2700_intcio_class_init,
 };
 
+static AspeedINTCIRQ aspeed_2700ssp_intc_irqs[ASPEED_INTC_MAX_INPINS] = {
+    {0, 0, 10, R_SSPINT160_169_EN, R_SSPINT160_169_STATUS},
+    {1, 10, 1, R_SSPINT128_EN, R_SSPINT128_STATUS},
+    {2, 11, 1, R_SSPINT129_EN, R_SSPINT129_STATUS},
+    {3, 12, 1, R_SSPINT130_EN, R_SSPINT130_STATUS},
+    {4, 13, 1, R_SSPINT131_EN, R_SSPINT131_STATUS},
+    {5, 14, 1, R_SSPINT132_EN, R_SSPINT132_STATUS},
+    {6, 15, 1, R_SSPINT133_EN, R_SSPINT133_STATUS},
+    {7, 16, 1, R_SSPINT134_EN, R_SSPINT134_STATUS},
+    {8, 17, 1, R_SSPINT135_EN, R_SSPINT135_STATUS},
+    {9, 18, 1, R_SSPINT136_EN, R_SSPINT136_STATUS},
+};
+
+static void aspeed_2700ssp_intc_class_init(ObjectClass *klass, const void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    AspeedINTCClass *aic = ASPEED_INTC_CLASS(klass);
+
+    dc->desc = "ASPEED 2700 SSP INTC Controller";
+    aic->num_lines = 32;
+    aic->num_inpins = 10;
+    aic->num_outpins = 19;
+    aic->mem_size = 0x4000;
+    aic->nr_regs = 0x2B08 >> 2;
+    aic->reg_offset = 0x0;
+    aic->reg_ops = &aspeed_ssp_intc_ops;
+    aic->irq_table = aspeed_2700ssp_intc_irqs;
+    aic->irq_table_count = ARRAY_SIZE(aspeed_2700ssp_intc_irqs);
+}
+
+static const TypeInfo aspeed_2700ssp_intc_info = {
+    .name = TYPE_ASPEED_2700SSP_INTC,
+    .parent = TYPE_ASPEED_INTC,
+    .class_init = aspeed_2700ssp_intc_class_init,
+};
+
+static AspeedINTCIRQ aspeed_2700ssp_intcio_irqs[ASPEED_INTC_MAX_INPINS] = {
+    {0, 0, 1, R_SSPINT160_EN, R_SSPINT160_STATUS},
+    {1, 1, 1, R_SSPINT161_EN, R_SSPINT161_STATUS},
+    {2, 2, 1, R_SSPINT162_EN, R_SSPINT162_STATUS},
+    {3, 3, 1, R_SSPINT163_EN, R_SSPINT163_STATUS},
+    {4, 4, 1, R_SSPINT164_EN, R_SSPINT164_STATUS},
+    {5, 5, 1, R_SSPINT165_EN, R_SSPINT165_STATUS},
+};
+
+static void aspeed_2700ssp_intcio_class_init(ObjectClass *klass, const void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    AspeedINTCClass *aic = ASPEED_INTC_CLASS(klass);
+
+    dc->desc = "ASPEED 2700 SSP INTC IO Controller";
+    aic->num_lines = 32;
+    aic->num_inpins = 6;
+    aic->num_outpins = 6;
+    aic->mem_size = 0x400;
+    aic->nr_regs = 0x1d8 >> 2;
+    aic->reg_offset = 0;
+    aic->reg_ops = &aspeed_ssp_intcio_ops;
+    aic->irq_table = aspeed_2700ssp_intcio_irqs;
+    aic->irq_table_count = ARRAY_SIZE(aspeed_2700ssp_intcio_irqs);
+}
+
+static const TypeInfo aspeed_2700ssp_intcio_info = {
+    .name = TYPE_ASPEED_2700SSP_INTCIO,
+    .parent = TYPE_ASPEED_INTC,
+    .class_init = aspeed_2700ssp_intcio_class_init,
+};
+
 static void aspeed_intc_register_types(void)
 {
     type_register_static(&aspeed_intc_info);
     type_register_static(&aspeed_2700_intc_info);
     type_register_static(&aspeed_2700_intcio_info);
+    type_register_static(&aspeed_2700ssp_intc_info);
+    type_register_static(&aspeed_2700ssp_intcio_info);
 }
 
 type_init(aspeed_intc_register_types);
diff --git a/include/hw/intc/aspeed_intc.h b/include/hw/intc/aspeed_intc.h
index 3727ba24be..746f159bf3 100644
--- a/include/hw/intc/aspeed_intc.h
+++ b/include/hw/intc/aspeed_intc.h
@@ -15,6 +15,9 @@
 #define TYPE_ASPEED_INTC "aspeed.intc"
 #define TYPE_ASPEED_2700_INTC TYPE_ASPEED_INTC "-ast2700"
 #define TYPE_ASPEED_2700_INTCIO TYPE_ASPEED_INTC "io-ast2700"
+#define TYPE_ASPEED_2700SSP_INTC TYPE_ASPEED_INTC "-ast2700ssp"
+#define TYPE_ASPEED_2700SSP_INTCIO TYPE_ASPEED_INTC "io-ast2700ssp"
+
 OBJECT_DECLARE_TYPE(AspeedINTCState, AspeedINTCClass, ASPEED_INTC)
 
 #define ASPEED_INTC_MAX_INPINS 10

From c528f10dce8eeaabe97f216d6488a6b8509b7067 Mon Sep 17 00:00:00 2001
From: Steven Lee <steven_lee@aspeedtech.com>
Date: Fri, 2 May 2025 18:34:40 +0800
Subject: [PATCH 0626/2760] hw/intc/aspeed: Add support for AST2700 TSP INTC
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Define new types for ast2700tsp INTC and INTCIO
- Add register definitions for TSP INTC and INTCIO
- Implement write handlers for TSP INTC and INTCIO
- Register new types in aspeed_intc_register_types

The design of the TSP INTC and INTCIO controllers is similar to
AST2700, with the following differences:

- AST2700
  Support GICINT128 to GICINT136 in INTC
  The INTCIO GIC_192_201 has 10 output pins, mapped as follows:
    Bit 0 -> GIC 192
    Bit 1 -> GIC 193
    Bit 2 -> GIC 194
    Bit 3 -> GIC 195
    Bit 4 -> GIC 196

- AST2700-tsp
  Support TSPINT128 to TSPINT136 in INTC
  The INTCIO TSPINT_160_169 has 10 output pins, mapped as follows:
    Bit 0 -> TSPINT 160
    Bit 1 -> TSPINT 161
    Bit 2 -> TSPINT 162
    Bit 3 -> TSPINT 163
    Bit 4 -> TSPINT 164

Signed-off-by: Steven Lee <steven_lee@aspeedtech.com>
Change-Id: I3f3aca4b90129640369cf4a92deb4b9a12df5b70
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250502103449.3091642-5-steven_lee@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/intc/aspeed_intc.c         | 209 +++++++++++++++++++++++++++++++++-
 include/hw/intc/aspeed_intc.h |   2 +
 2 files changed, 209 insertions(+), 2 deletions(-)

diff --git a/hw/intc/aspeed_intc.c b/hw/intc/aspeed_intc.c
index e889246951..33fcbe729c 100644
--- a/hw/intc/aspeed_intc.c
+++ b/hw/intc/aspeed_intc.c
@@ -106,6 +106,51 @@ REG32(SSPINT164_STATUS,     0x1C4)
 REG32(SSPINT165_EN,         0x1D0)
 REG32(SSPINT165_STATUS,     0x1D4)
 
+/*
+ * TSP INTC Registers
+ */
+REG32(TSPINT128_EN,             0x3000)
+REG32(TSPINT128_STATUS,         0x3004)
+REG32(TSPINT129_EN,             0x3100)
+REG32(TSPINT129_STATUS,         0x3104)
+REG32(TSPINT130_EN,             0x3200)
+REG32(TSPINT130_STATUS,         0x3204)
+REG32(TSPINT131_EN,             0x3300)
+REG32(TSPINT131_STATUS,         0x3304)
+REG32(TSPINT132_EN,             0x3400)
+REG32(TSPINT132_STATUS,         0x3404)
+REG32(TSPINT133_EN,             0x3500)
+REG32(TSPINT133_STATUS,         0x3504)
+REG32(TSPINT134_EN,             0x3600)
+REG32(TSPINT134_STATUS,         0x3604)
+REG32(TSPINT135_EN,             0x3700)
+REG32(TSPINT135_STATUS,         0x3704)
+REG32(TSPINT136_EN,             0x3800)
+REG32(TSPINT136_STATUS,         0x3804)
+REG32(TSPINT137_EN,             0x3900)
+REG32(TSPINT137_STATUS,         0x3904)
+REG32(TSPINT138_EN,             0x3A00)
+REG32(TSPINT138_STATUS,         0x3A04)
+REG32(TSPINT160_169_EN,         0x3B00)
+REG32(TSPINT160_169_STATUS,     0x3B04)
+
+/*
+ * TSP INTCIO Registers
+ */
+
+REG32(TSPINT160_EN,         0x200)
+REG32(TSPINT160_STATUS,     0x204)
+REG32(TSPINT161_EN,         0x210)
+REG32(TSPINT161_STATUS,     0x214)
+REG32(TSPINT162_EN,         0x220)
+REG32(TSPINT162_STATUS,     0x224)
+REG32(TSPINT163_EN,         0x230)
+REG32(TSPINT163_STATUS,     0x234)
+REG32(TSPINT164_EN,         0x240)
+REG32(TSPINT164_STATUS,     0x244)
+REG32(TSPINT165_EN,         0x250)
+REG32(TSPINT165_STATUS,     0x254)
+
 static const AspeedINTCIRQ *aspeed_intc_get_irq(AspeedINTCClass *aic,
                                                 uint32_t reg)
 {
@@ -534,8 +579,48 @@ static void aspeed_ssp_intc_write(void *opaque, hwaddr offset, uint64_t data,
         s->regs[reg] = data;
         break;
     }
+}
 
-    return;
+static void aspeed_tsp_intc_write(void *opaque, hwaddr offset, uint64_t data,
+                                        unsigned size)
+{
+    AspeedINTCState *s = ASPEED_INTC(opaque);
+    const char *name = object_get_typename(OBJECT(s));
+    uint32_t reg = offset >> 2;
+
+    trace_aspeed_intc_write(name, offset, size, data);
+
+    switch (reg) {
+    case R_TSPINT128_EN:
+    case R_TSPINT129_EN:
+    case R_TSPINT130_EN:
+    case R_TSPINT131_EN:
+    case R_TSPINT132_EN:
+    case R_TSPINT133_EN:
+    case R_TSPINT134_EN:
+    case R_TSPINT135_EN:
+    case R_TSPINT136_EN:
+    case R_TSPINT160_169_EN:
+        aspeed_intc_enable_handler(s, offset, data);
+        break;
+    case R_TSPINT128_STATUS:
+    case R_TSPINT129_STATUS:
+    case R_TSPINT130_STATUS:
+    case R_TSPINT131_STATUS:
+    case R_TSPINT132_STATUS:
+    case R_TSPINT133_STATUS:
+    case R_TSPINT134_STATUS:
+    case R_TSPINT135_STATUS:
+    case R_TSPINT136_STATUS:
+        aspeed_intc_status_handler(s, offset, data);
+        break;
+    case R_TSPINT160_169_STATUS:
+        aspeed_intc_status_handler_multi_outpins(s, offset, data);
+        break;
+    default:
+        s->regs[reg] = data;
+        break;
+    }
 }
 
 static uint64_t aspeed_intcio_read(void *opaque, hwaddr offset,
@@ -614,8 +699,38 @@ static void aspeed_ssp_intcio_write(void *opaque, hwaddr offset, uint64_t data,
         s->regs[reg] = data;
         break;
     }
+}
 
-    return;
+static void aspeed_tsp_intcio_write(void *opaque, hwaddr offset, uint64_t data,
+                                unsigned size)
+{
+    AspeedINTCState *s = ASPEED_INTC(opaque);
+    const char *name = object_get_typename(OBJECT(s));
+    uint32_t reg = offset >> 2;
+
+    trace_aspeed_intc_write(name, offset, size, data);
+
+    switch (reg) {
+    case R_TSPINT160_EN:
+    case R_TSPINT161_EN:
+    case R_TSPINT162_EN:
+    case R_TSPINT163_EN:
+    case R_TSPINT164_EN:
+    case R_TSPINT165_EN:
+        aspeed_intc_enable_handler(s, offset, data);
+        break;
+    case R_TSPINT160_STATUS:
+    case R_TSPINT161_STATUS:
+    case R_TSPINT162_STATUS:
+    case R_TSPINT163_STATUS:
+    case R_TSPINT164_STATUS:
+    case R_TSPINT165_STATUS:
+        aspeed_intc_status_handler(s, offset, data);
+        break;
+    default:
+        s->regs[reg] = data;
+        break;
+    }
 }
 
 static const MemoryRegionOps aspeed_intc_ops = {
@@ -658,6 +773,26 @@ static const MemoryRegionOps aspeed_ssp_intcio_ops = {
     }
 };
 
+static const MemoryRegionOps aspeed_tsp_intc_ops = {
+    .read = aspeed_intc_read,
+    .write = aspeed_tsp_intc_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+    .valid = {
+        .min_access_size = 4,
+        .max_access_size = 4,
+    }
+};
+
+static const MemoryRegionOps aspeed_tsp_intcio_ops = {
+    .read = aspeed_intcio_read,
+    .write = aspeed_tsp_intcio_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+    .valid = {
+        .min_access_size = 4,
+        .max_access_size = 4,
+    }
+};
+
 static void aspeed_intc_instance_init(Object *obj)
 {
     AspeedINTCState *s = ASPEED_INTC(obj);
@@ -883,6 +1018,74 @@ static const TypeInfo aspeed_2700ssp_intcio_info = {
     .class_init = aspeed_2700ssp_intcio_class_init,
 };
 
+static AspeedINTCIRQ aspeed_2700tsp_intc_irqs[ASPEED_INTC_MAX_INPINS] = {
+    {0, 0, 10, R_TSPINT160_169_EN, R_TSPINT160_169_STATUS},
+    {1, 10, 1, R_TSPINT128_EN, R_TSPINT128_STATUS},
+    {2, 11, 1, R_TSPINT129_EN, R_TSPINT129_STATUS},
+    {3, 12, 1, R_TSPINT130_EN, R_TSPINT130_STATUS},
+    {4, 13, 1, R_TSPINT131_EN, R_TSPINT131_STATUS},
+    {5, 14, 1, R_TSPINT132_EN, R_TSPINT132_STATUS},
+    {6, 15, 1, R_TSPINT133_EN, R_TSPINT133_STATUS},
+    {7, 16, 1, R_TSPINT134_EN, R_TSPINT134_STATUS},
+    {8, 17, 1, R_TSPINT135_EN, R_TSPINT135_STATUS},
+    {9, 18, 1, R_TSPINT136_EN, R_TSPINT136_STATUS},
+};
+
+static void aspeed_2700tsp_intc_class_init(ObjectClass *klass, const void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    AspeedINTCClass *aic = ASPEED_INTC_CLASS(klass);
+
+    dc->desc = "ASPEED 2700 TSP INTC Controller";
+    aic->num_lines = 32;
+    aic->num_inpins = 10;
+    aic->num_outpins = 19;
+    aic->mem_size = 0x4000;
+    aic->nr_regs = 0x3B08 >> 2;
+    aic->reg_offset = 0;
+    aic->reg_ops = &aspeed_tsp_intc_ops;
+    aic->irq_table = aspeed_2700tsp_intc_irqs;
+    aic->irq_table_count = ARRAY_SIZE(aspeed_2700tsp_intc_irqs);
+}
+
+static const TypeInfo aspeed_2700tsp_intc_info = {
+    .name = TYPE_ASPEED_2700TSP_INTC,
+    .parent = TYPE_ASPEED_INTC,
+    .class_init = aspeed_2700tsp_intc_class_init,
+};
+
+static AspeedINTCIRQ aspeed_2700tsp_intcio_irqs[ASPEED_INTC_MAX_INPINS] = {
+    {0, 0, 1, R_TSPINT160_EN, R_TSPINT160_STATUS},
+    {1, 1, 1, R_TSPINT161_EN, R_TSPINT161_STATUS},
+    {2, 2, 1, R_TSPINT162_EN, R_TSPINT162_STATUS},
+    {3, 3, 1, R_TSPINT163_EN, R_TSPINT163_STATUS},
+    {4, 4, 1, R_TSPINT164_EN, R_TSPINT164_STATUS},
+    {5, 5, 1, R_TSPINT165_EN, R_TSPINT165_STATUS},
+};
+
+static void aspeed_2700tsp_intcio_class_init(ObjectClass *klass, const void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    AspeedINTCClass *aic = ASPEED_INTC_CLASS(klass);
+
+    dc->desc = "ASPEED 2700 TSP INTC IO Controller";
+    aic->num_lines = 32;
+    aic->num_inpins = 6;
+    aic->num_outpins = 6;
+    aic->mem_size = 0x400;
+    aic->nr_regs = 0x258 >> 2;
+    aic->reg_offset = 0x0;
+    aic->reg_ops = &aspeed_tsp_intcio_ops;
+    aic->irq_table = aspeed_2700tsp_intcio_irqs;
+    aic->irq_table_count = ARRAY_SIZE(aspeed_2700tsp_intcio_irqs);
+}
+
+static const TypeInfo aspeed_2700tsp_intcio_info = {
+    .name = TYPE_ASPEED_2700TSP_INTCIO,
+    .parent = TYPE_ASPEED_INTC,
+    .class_init = aspeed_2700tsp_intcio_class_init,
+};
+
 static void aspeed_intc_register_types(void)
 {
     type_register_static(&aspeed_intc_info);
@@ -890,6 +1093,8 @@ static void aspeed_intc_register_types(void)
     type_register_static(&aspeed_2700_intcio_info);
     type_register_static(&aspeed_2700ssp_intc_info);
     type_register_static(&aspeed_2700ssp_intcio_info);
+    type_register_static(&aspeed_2700tsp_intc_info);
+    type_register_static(&aspeed_2700tsp_intcio_info);
 }
 
 type_init(aspeed_intc_register_types);
diff --git a/include/hw/intc/aspeed_intc.h b/include/hw/intc/aspeed_intc.h
index 746f159bf3..51288384a5 100644
--- a/include/hw/intc/aspeed_intc.h
+++ b/include/hw/intc/aspeed_intc.h
@@ -17,6 +17,8 @@
 #define TYPE_ASPEED_2700_INTCIO TYPE_ASPEED_INTC "io-ast2700"
 #define TYPE_ASPEED_2700SSP_INTC TYPE_ASPEED_INTC "-ast2700ssp"
 #define TYPE_ASPEED_2700SSP_INTCIO TYPE_ASPEED_INTC "io-ast2700ssp"
+#define TYPE_ASPEED_2700TSP_INTC TYPE_ASPEED_INTC "-ast2700tsp"
+#define TYPE_ASPEED_2700TSP_INTCIO TYPE_ASPEED_INTC "io-ast2700tsp"
 
 OBJECT_DECLARE_TYPE(AspeedINTCState, AspeedINTCClass, ASPEED_INTC)
 

From 541da2604fe157d9db5995808097230a9f966b4a Mon Sep 17 00:00:00 2001
From: Steven Lee <steven_lee@aspeedtech.com>
Date: Fri, 2 May 2025 18:34:41 +0800
Subject: [PATCH 0627/2760] hw/arm/aspeed_ast27x0-ssp: Introduce AST27x0 A1 SSP
 SoC
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The AST2700 SSP (Secondary Service Processor) is a Cortex-M4 coprocessor.
This patch adds support for A1 SSP with the following updates:

- Introduce Aspeed27x0SSPSoCState structure in aspeed_soc.h
- Define memory map and IRQ map for AST27x0 A1 SSP SoC
- Implement initialization and realization functions
- Add support for UART, INTC, and SCU devices
- Map unimplemented devices for IPC and SCUIO

The IRQ mapping is similar to AST2700 CA35 SoC, featuring a two-level
interrupt controller.

Difference from AST2700:

    - AST2700
      - Support GICINT128 to GICINT136 in INTC
      - The INTCIO GIC_192_201 has 10 output pins, mapped as follows:
          Bit 0 -> GIC 192
          Bit 1 -> GIC 193
          Bit 2 -> GIC 194
          Bit 3 -> GIC 195
          Bit 4 -> GIC 196

    - AST2700-ssp
      - Support SSPINT128 to SSPINT136 in INTC
      - The INTCIO SSPINT_160_169 has 10 output pins, mapped as follows:
          Bit 0 -> SSPINT 160
          Bit 1 -> SSPINT 161
          Bit 2 -> SSPINT 162
          Bit 3 -> SSPINT 163
          Bit 4 -> SSPINT 164

Signed-off-by: Steven Lee <steven_lee@aspeedtech.com>
Change-Id: I924bf1a657f1e83f9e16d6673713f4a06ecdb496
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250502103449.3091642-6-steven_lee@aspeedtech.com
[ clg: removed local 'Error* err' in aspeed_soc_ast27x0ssp_realize() ]
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed_ast27x0-ssp.c | 294 ++++++++++++++++++++++++++++++++++++
 hw/arm/meson.build          |   1 +
 include/hw/arm/aspeed_soc.h |  14 ++
 3 files changed, 309 insertions(+)
 create mode 100644 hw/arm/aspeed_ast27x0-ssp.c

diff --git a/hw/arm/aspeed_ast27x0-ssp.c b/hw/arm/aspeed_ast27x0-ssp.c
new file mode 100644
index 0000000000..80ec5996c1
--- /dev/null
+++ b/hw/arm/aspeed_ast27x0-ssp.c
@@ -0,0 +1,294 @@
+/*
+ * ASPEED Ast27x0 SSP SoC
+ *
+ * Copyright (C) 2025 ASPEED Technology Inc.
+ *
+ * This code is licensed under the GPL version 2 or later.  See
+ * the COPYING file in the top-level directory.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "hw/qdev-clock.h"
+#include "hw/misc/unimp.h"
+#include "hw/arm/aspeed_soc.h"
+
+#define AST2700_SSP_RAM_SIZE (32 * MiB)
+
+static const hwaddr aspeed_soc_ast27x0ssp_memmap[] = {
+    [ASPEED_DEV_SRAM]      =  0x00000000,
+    [ASPEED_DEV_INTC]      =  0x72100000,
+    [ASPEED_DEV_SCU]       =  0x72C02000,
+    [ASPEED_DEV_SCUIO]     =  0x74C02000,
+    [ASPEED_DEV_UART0]     =  0x74C33000,
+    [ASPEED_DEV_UART1]     =  0x74C33100,
+    [ASPEED_DEV_UART2]     =  0x74C33200,
+    [ASPEED_DEV_UART3]     =  0x74C33300,
+    [ASPEED_DEV_UART4]     =  0x72C1A000,
+    [ASPEED_DEV_INTCIO]    =  0x74C18000,
+    [ASPEED_DEV_IPC0]      =  0x72C1C000,
+    [ASPEED_DEV_IPC1]      =  0x74C39000,
+    [ASPEED_DEV_UART5]     =  0x74C33400,
+    [ASPEED_DEV_UART6]     =  0x74C33500,
+    [ASPEED_DEV_UART7]     =  0x74C33600,
+    [ASPEED_DEV_UART8]     =  0x74C33700,
+    [ASPEED_DEV_UART9]     =  0x74C33800,
+    [ASPEED_DEV_UART10]    =  0x74C33900,
+    [ASPEED_DEV_UART11]    =  0x74C33A00,
+    [ASPEED_DEV_UART12]    =  0x74C33B00,
+    [ASPEED_DEV_TIMER1]    =  0x72C10000,
+};
+
+static const int aspeed_soc_ast27x0ssp_irqmap[] = {
+    [ASPEED_DEV_SCU]       = 12,
+    [ASPEED_DEV_UART0]     = 164,
+    [ASPEED_DEV_UART1]     = 164,
+    [ASPEED_DEV_UART2]     = 164,
+    [ASPEED_DEV_UART3]     = 164,
+    [ASPEED_DEV_UART4]     = 8,
+    [ASPEED_DEV_UART5]     = 164,
+    [ASPEED_DEV_UART6]     = 164,
+    [ASPEED_DEV_UART7]     = 164,
+    [ASPEED_DEV_UART8]     = 164,
+    [ASPEED_DEV_UART9]     = 164,
+    [ASPEED_DEV_UART10]    = 164,
+    [ASPEED_DEV_UART11]    = 164,
+    [ASPEED_DEV_UART12]    = 164,
+    [ASPEED_DEV_TIMER1]    = 16,
+};
+
+/* SSPINT 164 */
+static const int ast2700_ssp132_ssp164_intcmap[] = {
+    [ASPEED_DEV_UART0]     = 7,
+    [ASPEED_DEV_UART1]     = 8,
+    [ASPEED_DEV_UART2]     = 9,
+    [ASPEED_DEV_UART3]     = 10,
+    [ASPEED_DEV_UART5]     = 11,
+    [ASPEED_DEV_UART6]     = 12,
+    [ASPEED_DEV_UART7]     = 13,
+    [ASPEED_DEV_UART8]     = 14,
+    [ASPEED_DEV_UART9]     = 15,
+    [ASPEED_DEV_UART10]    = 16,
+    [ASPEED_DEV_UART11]    = 17,
+    [ASPEED_DEV_UART12]    = 18,
+};
+
+struct nvic_intc_irq_info {
+    int irq;
+    int intc_idx;
+    int orgate_idx;
+    const int *ptr;
+};
+
+static struct nvic_intc_irq_info ast2700_ssp_intcmap[] = {
+    {160, 1, 0, NULL},
+    {161, 1, 1, NULL},
+    {162, 1, 2, NULL},
+    {163, 1, 3, NULL},
+    {164, 1, 4, ast2700_ssp132_ssp164_intcmap},
+    {165, 1, 5, NULL},
+    {166, 1, 6, NULL},
+    {167, 1, 7, NULL},
+    {168, 1, 8, NULL},
+    {169, 1, 9, NULL},
+    {128, 0, 1, NULL},
+    {129, 0, 2, NULL},
+    {130, 0, 3, NULL},
+    {131, 0, 4, NULL},
+    {132, 0, 5, ast2700_ssp132_ssp164_intcmap},
+    {133, 0, 6, NULL},
+    {134, 0, 7, NULL},
+    {135, 0, 8, NULL},
+    {136, 0, 9, NULL},
+};
+
+static qemu_irq aspeed_soc_ast27x0ssp_get_irq(AspeedSoCState *s, int dev)
+{
+    Aspeed27x0SSPSoCState *a = ASPEED27X0SSP_SOC(s);
+    AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
+
+    int or_idx;
+    int idx;
+    int i;
+
+    for (i = 0; i < ARRAY_SIZE(ast2700_ssp_intcmap); i++) {
+        if (sc->irqmap[dev] == ast2700_ssp_intcmap[i].irq) {
+            assert(ast2700_ssp_intcmap[i].ptr);
+            or_idx = ast2700_ssp_intcmap[i].orgate_idx;
+            idx = ast2700_ssp_intcmap[i].intc_idx;
+            return qdev_get_gpio_in(DEVICE(&a->intc[idx].orgates[or_idx]),
+                                    ast2700_ssp_intcmap[i].ptr[dev]);
+        }
+    }
+
+    return qdev_get_gpio_in(DEVICE(&a->armv7m), sc->irqmap[dev]);
+}
+
+static void aspeed_soc_ast27x0ssp_init(Object *obj)
+{
+    Aspeed27x0SSPSoCState *a = ASPEED27X0SSP_SOC(obj);
+    AspeedSoCState *s = ASPEED_SOC(obj);
+    AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
+    int i;
+
+    object_initialize_child(obj, "armv7m", &a->armv7m, TYPE_ARMV7M);
+    object_initialize_child(obj, "scu", &s->scu, TYPE_ASPEED_2700_SCU);
+    s->sysclk = qdev_init_clock_in(DEVICE(s), "sysclk", NULL, NULL, 0);
+    qdev_prop_set_uint32(DEVICE(&s->scu), "silicon-rev", sc->silicon_rev);
+
+    for (i = 0; i < sc->uarts_num; i++) {
+        object_initialize_child(obj, "uart[*]", &s->uart[i], TYPE_SERIAL_MM);
+    }
+
+    object_initialize_child(obj, "intc0", &a->intc[0],
+                            TYPE_ASPEED_2700SSP_INTC);
+    object_initialize_child(obj, "intc1", &a->intc[1],
+                            TYPE_ASPEED_2700SSP_INTCIO);
+
+    object_initialize_child(obj, "timerctrl", &s->timerctrl,
+                            TYPE_UNIMPLEMENTED_DEVICE);
+    object_initialize_child(obj, "ipc0", &a->ipc[0],
+                            TYPE_UNIMPLEMENTED_DEVICE);
+    object_initialize_child(obj, "ipc1", &a->ipc[1],
+                            TYPE_UNIMPLEMENTED_DEVICE);
+    object_initialize_child(obj, "scuio", &a->scuio,
+                            TYPE_UNIMPLEMENTED_DEVICE);
+}
+
+static void aspeed_soc_ast27x0ssp_realize(DeviceState *dev_soc, Error **errp)
+{
+    Aspeed27x0SSPSoCState *a = ASPEED27X0SSP_SOC(dev_soc);
+    AspeedSoCState *s = ASPEED_SOC(dev_soc);
+    AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
+    DeviceState *armv7m;
+    g_autofree char *sram_name = NULL;
+    int i;
+
+    if (!clock_has_source(s->sysclk)) {
+        error_setg(errp, "sysclk clock must be wired up by the board code");
+        return;
+    }
+
+    /* AST27X0 SSP Core */
+    armv7m = DEVICE(&a->armv7m);
+    qdev_prop_set_uint32(armv7m, "num-irq", 256);
+    qdev_prop_set_string(armv7m, "cpu-type", aspeed_soc_cpu_type(sc));
+    qdev_connect_clock_in(armv7m, "cpuclk", s->sysclk);
+    object_property_set_link(OBJECT(&a->armv7m), "memory",
+                             OBJECT(s->memory), &error_abort);
+    sysbus_realize(SYS_BUS_DEVICE(&a->armv7m), &error_abort);
+
+    sram_name = g_strdup_printf("aspeed.dram.%d",
+                                CPU(a->armv7m.cpu)->cpu_index);
+
+    if (!memory_region_init_ram(&s->sram, OBJECT(s), sram_name, sc->sram_size,
+                                errp)) {
+        return;
+    }
+    memory_region_add_subregion(s->memory,
+                                sc->memmap[ASPEED_DEV_SRAM],
+                                &s->sram);
+
+    /* SCU */
+    if (!sysbus_realize(SYS_BUS_DEVICE(&s->scu), errp)) {
+        return;
+    }
+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->scu), 0, sc->memmap[ASPEED_DEV_SCU]);
+
+    /* INTC */
+    if (!sysbus_realize(SYS_BUS_DEVICE(&a->intc[0]), errp)) {
+        return;
+    }
+
+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&a->intc[0]), 0,
+                    sc->memmap[ASPEED_DEV_INTC]);
+
+    /* INTCIO */
+    if (!sysbus_realize(SYS_BUS_DEVICE(&a->intc[1]), errp)) {
+        return;
+    }
+
+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&a->intc[1]), 0,
+                    sc->memmap[ASPEED_DEV_INTCIO]);
+
+    /* irq source orgates -> INTC0 */
+    for (i = 0; i < ASPEED_INTC_GET_CLASS(&a->intc[0])->num_inpins; i++) {
+        qdev_connect_gpio_out(DEVICE(&a->intc[0].orgates[i]), 0,
+                              qdev_get_gpio_in(DEVICE(&a->intc[0]), i));
+    }
+    for (i = 0; i < ASPEED_INTC_GET_CLASS(&a->intc[0])->num_outpins; i++) {
+        assert(i < ARRAY_SIZE(ast2700_ssp_intcmap));
+        sysbus_connect_irq(SYS_BUS_DEVICE(&a->intc[0]), i,
+                           qdev_get_gpio_in(DEVICE(&a->armv7m),
+                                            ast2700_ssp_intcmap[i].irq));
+    }
+    /* irq source orgates -> INTCIO */
+    for (i = 0; i < ASPEED_INTC_GET_CLASS(&a->intc[1])->num_inpins; i++) {
+        qdev_connect_gpio_out(DEVICE(&a->intc[1].orgates[i]), 0,
+                              qdev_get_gpio_in(DEVICE(&a->intc[1]), i));
+    }
+    /* INTCIO -> INTC */
+    for (i = 0; i < ASPEED_INTC_GET_CLASS(&a->intc[1])->num_outpins; i++) {
+        sysbus_connect_irq(SYS_BUS_DEVICE(&a->intc[1]), i,
+                        qdev_get_gpio_in(DEVICE(&a->intc[0].orgates[0]), i));
+    }
+    /* UART */
+    if (!aspeed_soc_uart_realize(s, errp)) {
+        return;
+    }
+
+    aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&s->timerctrl),
+                                  "aspeed.timerctrl",
+                                  sc->memmap[ASPEED_DEV_TIMER1], 0x200);
+    aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&a->ipc[0]),
+                                  "aspeed.ipc0",
+                                  sc->memmap[ASPEED_DEV_IPC0], 0x1000);
+    aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&a->ipc[1]),
+                                  "aspeed.ipc1",
+                                  sc->memmap[ASPEED_DEV_IPC1], 0x1000);
+    aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&a->scuio),
+                                  "aspeed.scuio",
+                                  sc->memmap[ASPEED_DEV_SCUIO], 0x1000);
+}
+
+static void aspeed_soc_ast27x0ssp_class_init(ObjectClass *klass, const void *data)
+{
+    static const char * const valid_cpu_types[] = {
+        ARM_CPU_TYPE_NAME("cortex-m4"), /* TODO: cortex-m4f */
+        NULL
+    };
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    AspeedSoCClass *sc = ASPEED_SOC_CLASS(dc);
+
+    /* Reason: The Aspeed SoC can only be instantiated from a board */
+    dc->user_creatable = false;
+    dc->realize = aspeed_soc_ast27x0ssp_realize;
+
+    sc->valid_cpu_types = valid_cpu_types;
+    sc->silicon_rev = AST2700_A1_SILICON_REV;
+    sc->sram_size = AST2700_SSP_RAM_SIZE;
+    sc->spis_num = 0;
+    sc->ehcis_num = 0;
+    sc->wdts_num = 0;
+    sc->macs_num = 0;
+    sc->uarts_num = 13;
+    sc->uarts_base = ASPEED_DEV_UART0;
+    sc->irqmap = aspeed_soc_ast27x0ssp_irqmap;
+    sc->memmap = aspeed_soc_ast27x0ssp_memmap;
+    sc->num_cpus = 1;
+    sc->get_irq = aspeed_soc_ast27x0ssp_get_irq;
+}
+
+static const TypeInfo aspeed_soc_ast27x0ssp_types[] = {
+    {
+        .name           = TYPE_ASPEED27X0SSP_SOC,
+        .parent         = TYPE_ASPEED_SOC,
+        .instance_size  = sizeof(Aspeed27x0SSPSoCState),
+        .instance_init  = aspeed_soc_ast27x0ssp_init,
+        .class_init     = aspeed_soc_ast27x0ssp_class_init,
+    },
+};
+
+DEFINE_TYPES(aspeed_soc_ast27x0ssp_types)
diff --git a/hw/arm/meson.build b/hw/arm/meson.build
index 09b1cfe5b5..39b74a89ed 100644
--- a/hw/arm/meson.build
+++ b/hw/arm/meson.build
@@ -44,6 +44,7 @@ arm_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files(
   'aspeed_soc_common.c',
   'aspeed_ast2400.c',
   'aspeed_ast2600.c',
+  'aspeed_ast27x0-ssp.c',
   'aspeed_ast10x0.c',
   'aspeed_eeprom.c',
   'fby35.c'))
diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index 5fcfd2fe2e..32be90bc35 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -146,6 +146,18 @@ struct Aspeed10x0SoCState {
     ARMv7MState armv7m;
 };
 
+struct Aspeed27x0SSPSoCState {
+    AspeedSoCState parent;
+    AspeedINTCState intc[2];
+    UnimplementedDeviceState ipc[2];
+    UnimplementedDeviceState scuio;
+
+    ARMv7MState armv7m;
+};
+
+#define TYPE_ASPEED27X0SSP_SOC "aspeed27x0ssp-soc"
+OBJECT_DECLARE_SIMPLE_TYPE(Aspeed27x0SSPSoCState, ASPEED27X0SSP_SOC)
+
 #define TYPE_ASPEED10X0_SOC "aspeed10x0-soc"
 OBJECT_DECLARE_SIMPLE_TYPE(Aspeed10x0SoCState, ASPEED10X0_SOC)
 
@@ -259,6 +271,8 @@ enum {
     ASPEED_DEV_SLIIO,
     ASPEED_GIC_DIST,
     ASPEED_GIC_REDIST,
+    ASPEED_DEV_IPC0,
+    ASPEED_DEV_IPC1,
 };
 
 qemu_irq aspeed_soc_get_irq(AspeedSoCState *s, int dev);

From 2d64e6a009e1efbf6d9ae63a3dc5d35f356641e7 Mon Sep 17 00:00:00 2001
From: Steven Lee <steven_lee@aspeedtech.com>
Date: Fri, 2 May 2025 18:34:42 +0800
Subject: [PATCH 0628/2760] hw/arm/aspeed_ast27x0-tsp: Introduce AST27x0 A1 TSP
 SoC
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

AST2700 TSP(Tertiary Service Processor) is a Cortex-M4 coprocessor
The patch adds support for TSP with following update:

- Introduce Aspeed27x0TSPSoCState structure in aspeed_soc.h
- Implement initialization and realization functions
- Add support for UART, INTC, and SCU devices
- Map unimplemented devices for IPC and SCUIO
- Defined memory map and IRQ maps for AST27x0 A1 TSP SoC

The IRQ mapping is similar to AST2700 CA35 SoC, featuring a two-level
interrupt controller.

Difference from AST2700:

    - AST2700
      - Support GICINT128 to GICINT136 in INTC
      - The INTCIO GIC_192_201 has 10 output pins, mapped as follows:
          Bit 0 -> GIC 192
          Bit 1 -> GIC 193
          Bit 2 -> GIC 194
          Bit 3 -> GIC 195
          Bit 4 -> GIC 196

    - AST2700-tsp
      - Support TSPINT128 to TSPINT136 in INTC
      - The INTCIO TSPINT_160_169 has 10 output pins, mapped as follows:
          Bit 0 -> TSPINT 160
          Bit 1 -> TSPINT 161
          Bit 2 -> TSPINT 162
          Bit 3 -> TSPINT 163
          Bit 4 -> TSPINT 164

Signed-off-by: Steven Lee <steven_lee@aspeedtech.com>
Change-Id: I69eec2b68b26ef04187b2922c5f2e584b9076c66
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250502103449.3091642-7-steven_lee@aspeedtech.com
[ clg: removed local 'Error* err' in aspeed_soc_ast27x0tsp_realize() ]
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed_ast27x0-tsp.c | 294 ++++++++++++++++++++++++++++++++++++
 hw/arm/meson.build          |   1 +
 include/hw/arm/aspeed_soc.h |  12 ++
 3 files changed, 307 insertions(+)
 create mode 100644 hw/arm/aspeed_ast27x0-tsp.c

diff --git a/hw/arm/aspeed_ast27x0-tsp.c b/hw/arm/aspeed_ast27x0-tsp.c
new file mode 100644
index 0000000000..4e0efaef07
--- /dev/null
+++ b/hw/arm/aspeed_ast27x0-tsp.c
@@ -0,0 +1,294 @@
+/*
+ * ASPEED Ast27x0 TSP SoC
+ *
+ * Copyright (C) 2025 ASPEED Technology Inc.
+ *
+ * This code is licensed under the GPL version 2 or later.  See
+ * the COPYING file in the top-level directory.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "hw/qdev-clock.h"
+#include "hw/misc/unimp.h"
+#include "hw/arm/aspeed_soc.h"
+
+#define AST2700_TSP_RAM_SIZE (32 * MiB)
+
+static const hwaddr aspeed_soc_ast27x0tsp_memmap[] = {
+    [ASPEED_DEV_SRAM]      =  0x00000000,
+    [ASPEED_DEV_INTC]      =  0x72100000,
+    [ASPEED_DEV_SCU]       =  0x72C02000,
+    [ASPEED_DEV_SCUIO]     =  0x74C02000,
+    [ASPEED_DEV_UART0]     =  0x74C33000,
+    [ASPEED_DEV_UART1]     =  0x74C33100,
+    [ASPEED_DEV_UART2]     =  0x74C33200,
+    [ASPEED_DEV_UART3]     =  0x74C33300,
+    [ASPEED_DEV_UART4]     =  0x72C1A000,
+    [ASPEED_DEV_INTCIO]    =  0x74C18000,
+    [ASPEED_DEV_IPC0]      =  0x72C1C000,
+    [ASPEED_DEV_IPC1]      =  0x74C39000,
+    [ASPEED_DEV_UART5]     =  0x74C33400,
+    [ASPEED_DEV_UART6]     =  0x74C33500,
+    [ASPEED_DEV_UART7]     =  0x74C33600,
+    [ASPEED_DEV_UART8]     =  0x74C33700,
+    [ASPEED_DEV_UART9]     =  0x74C33800,
+    [ASPEED_DEV_UART10]    =  0x74C33900,
+    [ASPEED_DEV_UART11]    =  0x74C33A00,
+    [ASPEED_DEV_UART12]    =  0x74C33B00,
+    [ASPEED_DEV_TIMER1]    =  0x72C10000,
+};
+
+static const int aspeed_soc_ast27x0tsp_irqmap[] = {
+    [ASPEED_DEV_SCU]       = 12,
+    [ASPEED_DEV_UART0]     = 164,
+    [ASPEED_DEV_UART1]     = 164,
+    [ASPEED_DEV_UART2]     = 164,
+    [ASPEED_DEV_UART3]     = 164,
+    [ASPEED_DEV_UART4]     = 8,
+    [ASPEED_DEV_UART5]     = 164,
+    [ASPEED_DEV_UART6]     = 164,
+    [ASPEED_DEV_UART7]     = 164,
+    [ASPEED_DEV_UART8]     = 164,
+    [ASPEED_DEV_UART9]     = 164,
+    [ASPEED_DEV_UART10]    = 164,
+    [ASPEED_DEV_UART11]    = 164,
+    [ASPEED_DEV_UART12]    = 164,
+    [ASPEED_DEV_TIMER1]    = 16,
+};
+
+/* TSPINT 164 */
+static const int ast2700_tsp132_tsp164_intcmap[] = {
+    [ASPEED_DEV_UART0]     = 7,
+    [ASPEED_DEV_UART1]     = 8,
+    [ASPEED_DEV_UART2]     = 9,
+    [ASPEED_DEV_UART3]     = 10,
+    [ASPEED_DEV_UART5]     = 11,
+    [ASPEED_DEV_UART6]     = 12,
+    [ASPEED_DEV_UART7]     = 13,
+    [ASPEED_DEV_UART8]     = 14,
+    [ASPEED_DEV_UART9]     = 15,
+    [ASPEED_DEV_UART10]    = 16,
+    [ASPEED_DEV_UART11]    = 17,
+    [ASPEED_DEV_UART12]    = 18,
+};
+
+struct nvic_intc_irq_info {
+    int irq;
+    int intc_idx;
+    int orgate_idx;
+    const int *ptr;
+};
+
+static struct nvic_intc_irq_info ast2700_tsp_intcmap[] = {
+    {160, 1, 0, NULL},
+    {161, 1, 1, NULL},
+    {162, 1, 2, NULL},
+    {163, 1, 3, NULL},
+    {164, 1, 4, ast2700_tsp132_tsp164_intcmap},
+    {165, 1, 5, NULL},
+    {166, 1, 6, NULL},
+    {167, 1, 7, NULL},
+    {168, 1, 8, NULL},
+    {169, 1, 9, NULL},
+    {128, 0, 1, NULL},
+    {129, 0, 2, NULL},
+    {130, 0, 3, NULL},
+    {131, 0, 4, NULL},
+    {132, 0, 5, ast2700_tsp132_tsp164_intcmap},
+    {133, 0, 6, NULL},
+    {134, 0, 7, NULL},
+    {135, 0, 8, NULL},
+    {136, 0, 9, NULL},
+};
+
+static qemu_irq aspeed_soc_ast27x0tsp_get_irq(AspeedSoCState *s, int dev)
+{
+    Aspeed27x0TSPSoCState *a = ASPEED27X0TSP_SOC(s);
+    AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
+
+    int or_idx;
+    int idx;
+    int i;
+
+    for (i = 0; i < ARRAY_SIZE(ast2700_tsp_intcmap); i++) {
+        if (sc->irqmap[dev] == ast2700_tsp_intcmap[i].irq) {
+            assert(ast2700_tsp_intcmap[i].ptr);
+            or_idx = ast2700_tsp_intcmap[i].orgate_idx;
+            idx = ast2700_tsp_intcmap[i].intc_idx;
+            return qdev_get_gpio_in(DEVICE(&a->intc[idx].orgates[or_idx]),
+                                    ast2700_tsp_intcmap[i].ptr[dev]);
+        }
+    }
+
+    return qdev_get_gpio_in(DEVICE(&a->armv7m), sc->irqmap[dev]);
+}
+
+static void aspeed_soc_ast27x0tsp_init(Object *obj)
+{
+    Aspeed27x0TSPSoCState *a = ASPEED27X0TSP_SOC(obj);
+    AspeedSoCState *s = ASPEED_SOC(obj);
+    AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
+    int i;
+
+    object_initialize_child(obj, "armv7m", &a->armv7m, TYPE_ARMV7M);
+    object_initialize_child(obj, "scu", &s->scu, TYPE_ASPEED_2700_SCU);
+    s->sysclk = qdev_init_clock_in(DEVICE(s), "sysclk", NULL, NULL, 0);
+    qdev_prop_set_uint32(DEVICE(&s->scu), "silicon-rev", sc->silicon_rev);
+
+    for (i = 0; i < sc->uarts_num; i++) {
+        object_initialize_child(obj, "uart[*]", &s->uart[i], TYPE_SERIAL_MM);
+    }
+
+    object_initialize_child(obj, "intc0", &a->intc[0],
+                            TYPE_ASPEED_2700TSP_INTC);
+    object_initialize_child(obj, "intc1", &a->intc[1],
+                            TYPE_ASPEED_2700TSP_INTCIO);
+
+    object_initialize_child(obj, "timerctrl", &s->timerctrl,
+                            TYPE_UNIMPLEMENTED_DEVICE);
+    object_initialize_child(obj, "ipc0", &a->ipc[0],
+                            TYPE_UNIMPLEMENTED_DEVICE);
+    object_initialize_child(obj, "ipc1", &a->ipc[1],
+                            TYPE_UNIMPLEMENTED_DEVICE);
+    object_initialize_child(obj, "scuio", &a->scuio,
+                            TYPE_UNIMPLEMENTED_DEVICE);
+}
+
+static void aspeed_soc_ast27x0tsp_realize(DeviceState *dev_soc, Error **errp)
+{
+    Aspeed27x0TSPSoCState *a = ASPEED27X0TSP_SOC(dev_soc);
+    AspeedSoCState *s = ASPEED_SOC(dev_soc);
+    AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
+    DeviceState *armv7m;
+    g_autofree char *sram_name = NULL;
+    int i;
+
+    if (!clock_has_source(s->sysclk)) {
+        error_setg(errp, "sysclk clock must be wired up by the board code");
+        return;
+    }
+
+    /* AST27X0 TSP Core */
+    armv7m = DEVICE(&a->armv7m);
+    qdev_prop_set_uint32(armv7m, "num-irq", 256);
+    qdev_prop_set_string(armv7m, "cpu-type", aspeed_soc_cpu_type(sc));
+    qdev_connect_clock_in(armv7m, "cpuclk", s->sysclk);
+    object_property_set_link(OBJECT(&a->armv7m), "memory",
+                             OBJECT(s->memory), &error_abort);
+    sysbus_realize(SYS_BUS_DEVICE(&a->armv7m), &error_abort);
+
+    sram_name = g_strdup_printf("aspeed.dram.%d",
+                                CPU(a->armv7m.cpu)->cpu_index);
+
+    if (!memory_region_init_ram(&s->sram, OBJECT(s), sram_name, sc->sram_size,
+                                errp)) {
+        return;
+    }
+    memory_region_add_subregion(s->memory,
+                                sc->memmap[ASPEED_DEV_SRAM],
+                                &s->sram);
+
+    /* SCU */
+    if (!sysbus_realize(SYS_BUS_DEVICE(&s->scu), errp)) {
+        return;
+    }
+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->scu), 0, sc->memmap[ASPEED_DEV_SCU]);
+
+    /* INTC */
+    if (!sysbus_realize(SYS_BUS_DEVICE(&a->intc[0]), errp)) {
+        return;
+    }
+
+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&a->intc[0]), 0,
+                    sc->memmap[ASPEED_DEV_INTC]);
+
+    /* INTCIO */
+    if (!sysbus_realize(SYS_BUS_DEVICE(&a->intc[1]), errp)) {
+        return;
+    }
+
+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&a->intc[1]), 0,
+                    sc->memmap[ASPEED_DEV_INTCIO]);
+
+    /* irq source orgates -> INTC */
+    for (i = 0; i < ASPEED_INTC_GET_CLASS(&a->intc[0])->num_inpins; i++) {
+        qdev_connect_gpio_out(DEVICE(&a->intc[0].orgates[i]), 0,
+                              qdev_get_gpio_in(DEVICE(&a->intc[0]), i));
+    }
+    for (i = 0; i < ASPEED_INTC_GET_CLASS(&a->intc[0])->num_outpins; i++) {
+        assert(i < ARRAY_SIZE(ast2700_tsp_intcmap));
+        sysbus_connect_irq(SYS_BUS_DEVICE(&a->intc[0]), i,
+                           qdev_get_gpio_in(DEVICE(&a->armv7m),
+                                            ast2700_tsp_intcmap[i].irq));
+    }
+    /* irq source orgates -> INTC */
+    for (i = 0; i < ASPEED_INTC_GET_CLASS(&a->intc[1])->num_inpins; i++) {
+        qdev_connect_gpio_out(DEVICE(&a->intc[1].orgates[i]), 0,
+                              qdev_get_gpio_in(DEVICE(&a->intc[1]), i));
+    }
+    /* INTCIO -> INTC */
+    for (i = 0; i < ASPEED_INTC_GET_CLASS(&a->intc[1])->num_outpins; i++) {
+        sysbus_connect_irq(SYS_BUS_DEVICE(&a->intc[1]), i,
+                        qdev_get_gpio_in(DEVICE(&a->intc[0].orgates[0]), i));
+    }
+    /* UART */
+    if (!aspeed_soc_uart_realize(s, errp)) {
+        return;
+    }
+
+    aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&s->timerctrl),
+                                  "aspeed.timerctrl",
+                                  sc->memmap[ASPEED_DEV_TIMER1], 0x200);
+    aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&a->ipc[0]),
+                                  "aspeed.ipc0",
+                                  sc->memmap[ASPEED_DEV_IPC0], 0x1000);
+    aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&a->ipc[1]),
+                                  "aspeed.ipc1",
+                                  sc->memmap[ASPEED_DEV_IPC1], 0x1000);
+    aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&a->scuio),
+                                  "aspeed.scuio",
+                                  sc->memmap[ASPEED_DEV_SCUIO], 0x1000);
+}
+
+static void aspeed_soc_ast27x0tsp_class_init(ObjectClass *klass, const void *data)
+{
+    static const char * const valid_cpu_types[] = {
+        ARM_CPU_TYPE_NAME("cortex-m4"), /* TODO cortex-m4f */
+        NULL
+    };
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    AspeedSoCClass *sc = ASPEED_SOC_CLASS(dc);
+
+    /* Reason: The Aspeed SoC can only be instantiated from a board */
+    dc->user_creatable = false;
+    dc->realize = aspeed_soc_ast27x0tsp_realize;
+
+    sc->valid_cpu_types = valid_cpu_types;
+    sc->silicon_rev = AST2700_A1_SILICON_REV;
+    sc->sram_size = AST2700_TSP_RAM_SIZE;
+    sc->spis_num = 0;
+    sc->ehcis_num = 0;
+    sc->wdts_num = 0;
+    sc->macs_num = 0;
+    sc->uarts_num = 13;
+    sc->uarts_base = ASPEED_DEV_UART0;
+    sc->irqmap = aspeed_soc_ast27x0tsp_irqmap;
+    sc->memmap = aspeed_soc_ast27x0tsp_memmap;
+    sc->num_cpus = 1;
+    sc->get_irq = aspeed_soc_ast27x0tsp_get_irq;
+}
+
+static const TypeInfo aspeed_soc_ast27x0tsp_types[] = {
+    {
+        .name           = TYPE_ASPEED27X0TSP_SOC,
+        .parent         = TYPE_ASPEED_SOC,
+        .instance_size  = sizeof(Aspeed27x0TSPSoCState),
+        .instance_init  = aspeed_soc_ast27x0tsp_init,
+        .class_init     = aspeed_soc_ast27x0tsp_class_init,
+    },
+};
+
+DEFINE_TYPES(aspeed_soc_ast27x0tsp_types)
diff --git a/hw/arm/meson.build b/hw/arm/meson.build
index 39b74a89ed..98c5631506 100644
--- a/hw/arm/meson.build
+++ b/hw/arm/meson.build
@@ -45,6 +45,7 @@ arm_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files(
   'aspeed_ast2400.c',
   'aspeed_ast2600.c',
   'aspeed_ast27x0-ssp.c',
+  'aspeed_ast27x0-tsp.c',
   'aspeed_ast10x0.c',
   'aspeed_eeprom.c',
   'fby35.c'))
diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index 32be90bc35..217ef0eafd 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -158,6 +158,18 @@ struct Aspeed27x0SSPSoCState {
 #define TYPE_ASPEED27X0SSP_SOC "aspeed27x0ssp-soc"
 OBJECT_DECLARE_SIMPLE_TYPE(Aspeed27x0SSPSoCState, ASPEED27X0SSP_SOC)
 
+struct Aspeed27x0TSPSoCState {
+    AspeedSoCState parent;
+    AspeedINTCState intc[2];
+    UnimplementedDeviceState ipc[2];
+    UnimplementedDeviceState scuio;
+
+    ARMv7MState armv7m;
+};
+
+#define TYPE_ASPEED27X0TSP_SOC "aspeed27x0tsp-soc"
+OBJECT_DECLARE_SIMPLE_TYPE(Aspeed27x0TSPSoCState, ASPEED27X0TSP_SOC)
+
 #define TYPE_ASPEED10X0_SOC "aspeed10x0-soc"
 OBJECT_DECLARE_SIMPLE_TYPE(Aspeed10x0SoCState, ASPEED10X0_SOC)
 

From a74faf35efc5befb95d57041c9321a90a0edbb6d Mon Sep 17 00:00:00 2001
From: Steven Lee <steven_lee@aspeedtech.com>
Date: Fri, 2 May 2025 18:34:43 +0800
Subject: [PATCH 0629/2760] hw/arm: Introduce ASPEED AST2700 A1 full core
 machine
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Added new machine type `ast2700fc` with full core support.
- Defined `Ast2700FCState` structure for the new machine type.
- Implemented initialization functions for CA35, SSP, and TSP components.
- Updated `ast2700fc_types` to include the new machine type.
- Set machine class properties for `ast2700fc`.

Test Step:
- Download ast2700-default-obmc.tar.gz from AspeedTech-BMC OpenBmc
  release page.
- Run the following QEMU command:

  ```
  IMGDIR=~/path/to/image
  UBOOT_SIZE=$(stat --format=%s -L ${IMGDIR}/u-boot-nodtb.bin)

  ./qemu-system-aarch64 -machine ast2700fc \
  -device loader,force-raw=on,addr=0x400000000,file=${IMGDIR}/u-boot-nodtb.bin \
  -device loader,force-raw=on,addr=$((0x400000000 + ${UBOOT_SIZE})),file=${IMGDIR}/u-boot.dtb \
  -device loader,force-raw=on,addr=0x430000000,file=${IMGDIR}/bl31.bin \
  -device loader,force-raw=on,addr=0x430080000,file=${IMGDIR}/tee-raw.bin \
  -device loader,cpu-num=0,addr=0x430000000 \
  -device loader,cpu-num=1,addr=0x430000000 \
  -device loader,cpu-num=2,addr=0x430000000 \
  -device loader,cpu-num=3,addr=0x430000000 \
  -device loader,file=${IMGDIR}/ast2700-ssp.elf,cpu-num=4 \
  -device loader,file=${IMGDIR}/ast2700-tsp.elf,cpu-num=5 \
  -drive file=${IMGDIR}/image-bmc,if=mtd,format=raw \
  -serial pty -serial pty -serial pty \
  -snapshot \
  -S -nographic
  ```

- After starting QEMU, serial devices will be redirected:

  char device redirected to /dev/pts/51 (label serial0)
  char device redirected to /dev/pts/52 (label serial1)
  char device redirected to /dev/pts/53 (label serial2)

- serial0 is the console for the four Cortex-A35 primary processors,
  serial1 and serial2 are the consoles for the two Cortex-M4 coprocessors.

- Connect to the consoles using a terminal emulator.

Signed-off-by: Steven Lee <steven_lee@aspeedtech.com>
Change-Id: I32447b9372a78eb53a07135afef59c2a19202328
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250502103449.3091642-8-steven_lee@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed_ast27x0-fc.c | 192 +++++++++++++++++++++++++++++++++++++
 hw/arm/meson.build         |   4 +-
 2 files changed, 195 insertions(+), 1 deletion(-)
 create mode 100644 hw/arm/aspeed_ast27x0-fc.c

diff --git a/hw/arm/aspeed_ast27x0-fc.c b/hw/arm/aspeed_ast27x0-fc.c
new file mode 100644
index 0000000000..125a3ade40
--- /dev/null
+++ b/hw/arm/aspeed_ast27x0-fc.c
@@ -0,0 +1,192 @@
+/*
+ * ASPEED SoC 2700 family
+ *
+ * Copyright (C) 2025 ASPEED Technology Inc.
+ *
+ * This code is licensed under the GPL version 2 or later.  See
+ * the COPYING file in the top-level directory.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/units.h"
+#include "qapi/error.h"
+#include "system/block-backend.h"
+#include "system/system.h"
+#include "hw/arm/aspeed.h"
+#include "hw/boards.h"
+#include "hw/qdev-clock.h"
+#include "hw/arm/aspeed_soc.h"
+#include "hw/loader.h"
+#include "hw/arm/boot.h"
+#include "hw/block/flash.h"
+
+
+#define TYPE_AST2700A1FC MACHINE_TYPE_NAME("ast2700fc")
+OBJECT_DECLARE_SIMPLE_TYPE(Ast2700FCState, AST2700A1FC);
+
+static struct arm_boot_info ast2700fc_board_info = {
+    .board_id = -1, /* device-tree-only board */
+};
+
+struct Ast2700FCState {
+    MachineState parent_obj;
+
+    MemoryRegion ca35_memory;
+    MemoryRegion ca35_dram;
+    MemoryRegion ssp_memory;
+    MemoryRegion tsp_memory;
+
+    Clock *ssp_sysclk;
+    Clock *tsp_sysclk;
+
+    Aspeed27x0SoCState ca35;
+    Aspeed27x0SSPSoCState ssp;
+    Aspeed27x0TSPSoCState tsp;
+
+    bool mmio_exec;
+};
+
+#define AST2700FC_BMC_RAM_SIZE (2 * GiB)
+#define AST2700FC_CM4_DRAM_SIZE (32 * MiB)
+
+#define AST2700FC_HW_STRAP1 0x000000C0
+#define AST2700FC_HW_STRAP2 0x00000003
+#define AST2700FC_FMC_MODEL "w25q01jvq"
+#define AST2700FC_SPI_MODEL "w25q512jv"
+
+static void ast2700fc_ca35_init(MachineState *machine)
+{
+    Ast2700FCState *s = AST2700A1FC(machine);
+    AspeedSoCState *soc;
+    AspeedSoCClass *sc;
+
+    object_initialize_child(OBJECT(s), "ca35", &s->ca35, "ast2700-a1");
+    soc = ASPEED_SOC(&s->ca35);
+    sc = ASPEED_SOC_GET_CLASS(soc);
+
+    memory_region_init(&s->ca35_memory, OBJECT(&s->ca35), "ca35-memory",
+                       UINT64_MAX);
+
+    if (!memory_region_init_ram(&s->ca35_dram, OBJECT(&s->ca35), "ca35-dram",
+                                AST2700FC_BMC_RAM_SIZE, &error_abort)) {
+        return;
+    }
+    if (!object_property_set_link(OBJECT(&s->ca35), "memory",
+                                  OBJECT(&s->ca35_memory),
+                                  &error_abort)) {
+        return;
+    };
+    if (!object_property_set_link(OBJECT(&s->ca35), "dram",
+                                  OBJECT(&s->ca35_dram), &error_abort)) {
+        return;
+    }
+    if (!object_property_set_int(OBJECT(&s->ca35), "ram-size",
+                                 AST2700FC_BMC_RAM_SIZE, &error_abort)) {
+        return;
+    }
+    if (!object_property_set_int(OBJECT(&s->ca35), "hw-strap1",
+                                 AST2700FC_HW_STRAP1, &error_abort)) {
+        return;
+    }
+    if (!object_property_set_int(OBJECT(&s->ca35), "hw-strap2",
+                                 AST2700FC_HW_STRAP2, &error_abort)) {
+        return;
+    }
+    aspeed_soc_uart_set_chr(soc, ASPEED_DEV_UART12, serial_hd(0));
+    if (!qdev_realize(DEVICE(&s->ca35), NULL, &error_abort)) {
+        return;
+    }
+
+    /*
+     * AST2700 EVB has a LM75 temperature sensor on I2C bus 0 at address 0x4d.
+     */
+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 0), "tmp105", 0x4d);
+
+    aspeed_board_init_flashes(&soc->fmc, AST2700FC_FMC_MODEL, 2, 0);
+    aspeed_board_init_flashes(&soc->spi[0], AST2700FC_SPI_MODEL, 1, 2);
+
+    ast2700fc_board_info.ram_size = machine->ram_size;
+    ast2700fc_board_info.loader_start = sc->memmap[ASPEED_DEV_SDRAM];
+
+    arm_load_kernel(ARM_CPU(first_cpu), machine, &ast2700fc_board_info);
+}
+
+static void ast2700fc_ssp_init(MachineState *machine)
+{
+    AspeedSoCState *soc;
+    Ast2700FCState *s = AST2700A1FC(machine);
+    s->ssp_sysclk = clock_new(OBJECT(s), "SSP_SYSCLK");
+    clock_set_hz(s->ssp_sysclk, 200000000ULL);
+
+    object_initialize_child(OBJECT(s), "ssp", &s->ssp, TYPE_ASPEED27X0SSP_SOC);
+    memory_region_init(&s->ssp_memory, OBJECT(&s->ssp), "ssp-memory",
+                       UINT64_MAX);
+
+    qdev_connect_clock_in(DEVICE(&s->ssp), "sysclk", s->ssp_sysclk);
+    if (!object_property_set_link(OBJECT(&s->ssp), "memory",
+                                  OBJECT(&s->ssp_memory), &error_abort)) {
+        return;
+    }
+
+    soc = ASPEED_SOC(&s->ssp);
+    aspeed_soc_uart_set_chr(soc, ASPEED_DEV_UART4, serial_hd(1));
+    if (!qdev_realize(DEVICE(&s->ssp), NULL, &error_abort)) {
+        return;
+    }
+}
+
+static void ast2700fc_tsp_init(MachineState *machine)
+{
+    AspeedSoCState *soc;
+    Ast2700FCState *s = AST2700A1FC(machine);
+    s->tsp_sysclk = clock_new(OBJECT(s), "TSP_SYSCLK");
+    clock_set_hz(s->tsp_sysclk, 200000000ULL);
+
+    object_initialize_child(OBJECT(s), "tsp", &s->tsp, TYPE_ASPEED27X0TSP_SOC);
+    memory_region_init(&s->tsp_memory, OBJECT(&s->tsp), "tsp-memory",
+                       UINT64_MAX);
+
+    qdev_connect_clock_in(DEVICE(&s->tsp), "sysclk", s->tsp_sysclk);
+    if (!object_property_set_link(OBJECT(&s->tsp), "memory",
+                                  OBJECT(&s->tsp_memory), &error_abort)) {
+        return;
+    }
+
+    soc = ASPEED_SOC(&s->tsp);
+    aspeed_soc_uart_set_chr(soc, ASPEED_DEV_UART7, serial_hd(2));
+    if (!qdev_realize(DEVICE(&s->tsp), NULL, &error_abort)) {
+        return;
+    }
+}
+
+static void ast2700fc_init(MachineState *machine)
+{
+    ast2700fc_ca35_init(machine);
+    ast2700fc_ssp_init(machine);
+    ast2700fc_tsp_init(machine);
+}
+
+static void ast2700fc_class_init(ObjectClass *oc, const void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+
+    mc->alias = "ast2700fc";
+    mc->desc = "ast2700 full core support";
+    mc->init = ast2700fc_init;
+    mc->no_floppy = 1;
+    mc->no_cdrom = 1;
+    mc->min_cpus = mc->max_cpus = mc->default_cpus = 6;
+}
+
+static const TypeInfo ast2700fc_types[] = {
+    {
+        .name           = MACHINE_TYPE_NAME("ast2700fc"),
+        .parent         = TYPE_MACHINE,
+        .class_init     = ast2700fc_class_init,
+        .instance_size  = sizeof(Ast2700FCState),
+    },
+};
+
+DEFINE_TYPES(ast2700fc_types)
diff --git a/hw/arm/meson.build b/hw/arm/meson.build
index 98c5631506..5098795f61 100644
--- a/hw/arm/meson.build
+++ b/hw/arm/meson.build
@@ -49,7 +49,9 @@ arm_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files(
   'aspeed_ast10x0.c',
   'aspeed_eeprom.c',
   'fby35.c'))
-arm_common_ss.add(when: ['CONFIG_ASPEED_SOC', 'TARGET_AARCH64'], if_true: files('aspeed_ast27x0.c'))
+arm_common_ss.add(when: ['CONFIG_ASPEED_SOC', 'TARGET_AARCH64'], if_true: files(
+  'aspeed_ast27x0.c',
+  'aspeed_ast27x0-fc.c',))
 arm_common_ss.add(when: 'CONFIG_MPS2', if_true: files('mps2.c'))
 arm_common_ss.add(when: 'CONFIG_MPS2', if_true: files('mps2-tz.c'))
 arm_common_ss.add(when: 'CONFIG_MSF2', if_true: files('msf2-soc.c'))

From 81c74475433c69f6a4d67fcba463622c63667807 Mon Sep 17 00:00:00 2001
From: Steven Lee <steven_lee@aspeedtech.com>
Date: Mon, 5 May 2025 11:06:18 +0800
Subject: [PATCH 0630/2760] tests/function/aspeed: Add functional test for
 ast2700fc
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Introduce a new test suite for ast2700fc machine.
Rename the original test_aarch64_aspeed.py to
test_aarch64_aspeed_ast2700.py.

Signed-off-by: Steven Lee <steven_lee@aspeedtech.com>
Change-Id: I3855f55c9f6e5cca1270c179445f549f8d81f36c
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250505030618.3612042-1-steven_lee@aspeedtech.com
[ clg: Added new tests in meson.build ]
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 tests/functional/meson.build                  |   6 +-
 ...peed.py => test_aarch64_aspeed_ast2700.py} |   0
 .../test_aarch64_aspeed_ast2700fc.py          | 135 ++++++++++++++++++
 3 files changed, 139 insertions(+), 2 deletions(-)
 rename tests/functional/{test_aarch64_aspeed.py => test_aarch64_aspeed_ast2700.py} (100%)
 create mode 100755 tests/functional/test_aarch64_aspeed_ast2700fc.py

diff --git a/tests/functional/meson.build b/tests/functional/meson.build
index b317ad42c5..ab9df03b1f 100644
--- a/tests/functional/meson.build
+++ b/tests/functional/meson.build
@@ -11,7 +11,8 @@ endif
 
 # Timeouts for individual tests that can be slow e.g. with debugging enabled
 test_timeouts = {
-  'aarch64_aspeed' : 600,
+  'aarch64_aspeed_ast2700' : 600,
+  'aarch64_aspeed_ast2700fc' : 600,
   'aarch64_raspi4' : 480,
   'aarch64_reverse_debug' : 180,
   'aarch64_rme_virt' : 1200,
@@ -79,7 +80,8 @@ tests_aarch64_system_quick = [
 ]
 
 tests_aarch64_system_thorough = [
-  'aarch64_aspeed',
+  'aarch64_aspeed_ast2700',
+  'aarch64_aspeed_ast2700fc',
   'aarch64_raspi3',
   'aarch64_raspi4',
   'aarch64_replay',
diff --git a/tests/functional/test_aarch64_aspeed.py b/tests/functional/test_aarch64_aspeed_ast2700.py
similarity index 100%
rename from tests/functional/test_aarch64_aspeed.py
rename to tests/functional/test_aarch64_aspeed_ast2700.py
diff --git a/tests/functional/test_aarch64_aspeed_ast2700fc.py b/tests/functional/test_aarch64_aspeed_ast2700fc.py
new file mode 100755
index 0000000000..b85370e182
--- /dev/null
+++ b/tests/functional/test_aarch64_aspeed_ast2700fc.py
@@ -0,0 +1,135 @@
+#!/usr/bin/env python3
+#
+# Functional test that boots the ASPEED SoCs with firmware
+#
+# Copyright (C) 2022 ASPEED Technology Inc
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+import os
+
+from qemu_test import QemuSystemTest, Asset
+from qemu_test import wait_for_console_pattern
+from qemu_test import exec_command_and_wait_for_pattern
+
+
+class AST2x00MachineSDK(QemuSystemTest):
+
+    def do_test_aarch64_aspeed_sdk_start(self, image):
+        self.require_netdev('user')
+        self.vm.set_console()
+        self.vm.add_args('-device',
+                         'tmp105,bus=aspeed.i2c.bus.1,address=0x4d,id=tmp-test')
+        self.vm.add_args('-drive', 'file=' + image + ',if=mtd,format=raw',
+                         '-net', 'nic', '-net', 'user', '-snapshot')
+
+        self.vm.launch()
+
+    def verify_openbmc_boot_and_login(self, name):
+        wait_for_console_pattern(self, 'U-Boot 2023.10')
+        wait_for_console_pattern(self, '## Loading kernel from FIT Image')
+        wait_for_console_pattern(self, 'Starting kernel ...')
+
+        wait_for_console_pattern(self, f'{name} login:')
+        exec_command_and_wait_for_pattern(self, 'root', 'Password:')
+        exec_command_and_wait_for_pattern(self, '0penBmc', f'root@{name}:~#')
+
+    ASSET_SDK_V906_AST2700 = Asset(
+            'https://github.com/AspeedTech-BMC/openbmc/releases/download/v09.06/ast2700-default-obmc.tar.gz',
+            'f1d53e0be8a404ecce3e105f72bc50fa4e090ad13160ffa91b10a6e0233a9dc6')
+
+    def do_ast2700_i2c_test(self):
+        exec_command_and_wait_for_pattern(self,
+            'echo lm75 0x4d > /sys/class/i2c-dev/i2c-1/device/new_device ',
+            'i2c i2c-1: new_device: Instantiated device lm75 at 0x4d')
+        exec_command_and_wait_for_pattern(self,
+            'cat /sys/bus/i2c/devices/1-004d/hwmon/hwmon*/temp1_input', '0')
+        self.vm.cmd('qom-set', path='/machine/peripheral/tmp-test',
+                    property='temperature', value=18000)
+        exec_command_and_wait_for_pattern(self,
+            'cat /sys/bus/i2c/devices/1-004d/hwmon/hwmon*/temp1_input', '18000')
+
+    def do_ast2700fc_ssp_test(self):
+        self.vm.shutdown()
+        self.vm.set_console(console_index=1)
+        self.vm.launch()
+
+        exec_command_and_wait_for_pattern(self, '\012', 'ssp:~$')
+        exec_command_and_wait_for_pattern(self, 'version',
+                                          'Zephyr version 3.7.1')
+        exec_command_and_wait_for_pattern(self, 'md 72c02000 1',
+                                          '[72c02000] 06010103')
+
+    def do_ast2700fc_tsp_test(self):
+        self.vm.shutdown()
+        self.vm.set_console(console_index=2)
+        self.vm.launch()
+
+        exec_command_and_wait_for_pattern(self, '\012', 'tsp:~$')
+        exec_command_and_wait_for_pattern(self, 'version',
+                                          'Zephyr version 3.7.1')
+        exec_command_and_wait_for_pattern(self, 'md 72c02000 1',
+                                          '[72c02000] 06010103')
+
+    def start_ast2700fc_test(self, name):
+        ca35_core = 4
+        uboot_size = os.path.getsize(self.scratch_file(name,
+                                                       'u-boot-nodtb.bin'))
+        uboot_dtb_load_addr = hex(0x400000000 + uboot_size)
+
+        load_images_list = [
+            {
+                'addr': '0x400000000',
+                'file': self.scratch_file(name,
+                                          'u-boot-nodtb.bin')
+            },
+            {
+                'addr': str(uboot_dtb_load_addr),
+                'file': self.scratch_file(name, 'u-boot.dtb')
+            },
+            {
+                'addr': '0x430000000',
+                'file': self.scratch_file(name, 'bl31.bin')
+            },
+            {
+                'addr': '0x430080000',
+                'file': self.scratch_file(name, 'optee',
+                                          'tee-raw.bin')
+            }
+        ]
+
+        for load_image in load_images_list:
+            addr = load_image['addr']
+            file = load_image['file']
+            self.vm.add_args('-device',
+                             f'loader,force-raw=on,addr={addr},file={file}')
+
+        for i in range(ca35_core):
+            self.vm.add_args('-device',
+                             f'loader,addr=0x430000000,cpu-num={i}')
+
+        load_elf_list = {
+            'ssp': self.scratch_file(name, 'zephyr-aspeed-ssp.elf'),
+            'tsp': self.scratch_file(name, 'zephyr-aspeed-tsp.elf')
+        }
+
+        for cpu_num, key in enumerate(load_elf_list, start=4):
+            file = load_elf_list[key]
+            self.vm.add_args('-device',
+                             f'loader,file={file},cpu-num={cpu_num}')
+
+        self.do_test_aarch64_aspeed_sdk_start(
+                self.scratch_file(name, 'image-bmc'))
+
+    def test_aarch64_ast2700fc_sdk_v09_06(self):
+        self.set_machine('ast2700fc')
+
+        self.archive_extract(self.ASSET_SDK_V906_AST2700)
+        self.start_ast2700fc_test('ast2700-default')
+        self.verify_openbmc_boot_and_login('ast2700-default')
+        self.do_ast2700_i2c_test()
+        self.do_ast2700fc_ssp_test()
+        self.do_ast2700fc_tsp_test()
+
+if __name__ == '__main__':
+    QemuSystemTest.main()

From f32ef57f7de98ec36da52b0a13bd5d18ac4bd583 Mon Sep 17 00:00:00 2001
From: Steven Lee <steven_lee@aspeedtech.com>
Date: Fri, 2 May 2025 18:34:45 +0800
Subject: [PATCH 0631/2760] docs: Add support for ast2700fc machine
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Updated Aspeed family boards list to include `ast2700fc`.
- Added boot instructions for the `ast2700fc` machine.
- Detailed the configuration and loading of firmware for the
  Cortex-A35 and Cortex-M4 processors.

Signed-off-by: Steven Lee <steven_lee@aspeedtech.com>
Change-Id: Id41312e9c7cf79bc55c6f24a87a7ad9993dc7261
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250502103449.3091642-10-steven_lee@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 docs/system/arm/aspeed.rst | 69 ++++++++++++++++++++++++++++++++++++--
 1 file changed, 66 insertions(+), 3 deletions(-)

diff --git a/docs/system/arm/aspeed.rst b/docs/system/arm/aspeed.rst
index 014545f444..58a8020eec 100644
--- a/docs/system/arm/aspeed.rst
+++ b/docs/system/arm/aspeed.rst
@@ -1,5 +1,5 @@
-Aspeed family boards (``ast2500-evb``, ``ast2600-evb``, ``bletchley-bmc``, ``fuji-bmc``, ``fby35-bmc``, ``fp5280g2-bmc``, ``g220a-bmc``, ``palmetto-bmc``, ``qcom-dc-scm-v1-bmc``, ``qcom-firework-bmc``, ``quanta-q71l-bmc``, ``rainier-bmc``, ``romulus-bmc``, ``sonorapass-bmc``, ``supermicrox11-bmc``, ``supermicrox11spi-bmc``, ``tiogapass-bmc``, ``witherspoon-bmc``, ``yosemitev2-bmc``)
-==================================================================================================================================================================================================================================================================================================================================================================================================================
+Aspeed family boards (``ast2500-evb``, ``ast2600-evb``, ``ast2700-evb``, ``ast2700fc``, ``bletchley-bmc``, ``fuji-bmc``, ``fby35-bmc``, ``fp5280g2-bmc``, ``g220a-bmc``, ``palmetto-bmc``, ``qcom-dc-scm-v1-bmc``, ``qcom-firework-bmc``, ``quanta-q71l-bmc``, ``rainier-bmc``, ``romulus-bmc``, ``sonorapass-bmc``, ``supermicrox11-bmc``, ``supermicrox11spi-bmc``, ``tiogapass-bmc``, ``witherspoon-bmc``, ``yosemitev2-bmc``)
+=================================================================================================================================================================================================================================================================================================================================================================================================================================
 
 The QEMU Aspeed machines model BMCs of various OpenPOWER systems and
 Aspeed evaluation boards. They are based on different releases of the
@@ -255,6 +255,7 @@ etc.
 AST2700 SoC based machines :
 
 - ``ast2700-evb``          Aspeed AST2700 Evaluation board (Cortex-A35)
+- ``ast2700fc``            Aspeed AST2700 Evaluation board (Cortex-A35 + Cortex-M4)
 
 Supported devices
 -----------------
@@ -285,7 +286,6 @@ Supported devices
 
 Missing devices
 ---------------
- * Coprocessor support
  * PWM and Fan Controller
  * Slave GPIO Controller
  * Super I/O Controller
@@ -353,6 +353,69 @@ specified path in the ${HOME} directory.
 
   -bios ${HOME}/ast27x0_bootrom.bin
 
+Booting the ast2700fc machine
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+AST2700 features four Cortex-A35 primary processors and two Cortex-M4 coprocessors.
+**ast2700-evb** machine focuses on emulating the four Cortex-A35 primary processors,
+**ast2700fc** machine extends **ast2700-evb** by adding support for the two Cortex-M4 coprocessors.
+
+Steps to boot the AST2700fc machine:
+
+1. Ensure you have the following AST2700A1 binaries available in a directory
+
+ * u-boot-nodtb.bin
+ * u-boot.dtb
+ * bl31.bin
+ * optee/tee-raw.bin
+ * image-bmc
+ * zephyr-aspeed-ssp.elf (for SSP firmware, CPU 5)
+ * zephyr-aspeed-tsp.elf (for TSP firmware, CPU 6)
+
+2. Execute the following command to start ``ast2700fc`` machine:
+
+.. code-block:: bash
+
+  IMGDIR=ast2700-default
+  UBOOT_SIZE=$(stat --format=%s -L ${IMGDIR}/u-boot-nodtb.bin)
+
+  $ qemu-system-aarch64 -M ast2700fc \
+       -device loader,force-raw=on,addr=0x400000000,file=${IMGDIR}/u-boot-nodtb.bin \
+       -device loader,force-raw=on,addr=$((0x400000000 + ${UBOOT_SIZE})),file=${IMGDIR}/u-boot.dtb \
+       -device loader,force-raw=on,addr=0x430000000,file=${IMGDIR}/bl31.bin \
+       -device loader,force-raw=on,addr=0x430080000,file=${IMGDIR}/optee/tee-raw.bin \
+       -device loader,cpu-num=0,addr=0x430000000 \
+       -device loader,cpu-num=1,addr=0x430000000 \
+       -device loader,cpu-num=2,addr=0x430000000 \
+       -device loader,cpu-num=3,addr=0x430000000 \
+       -drive file=${IMGDIR}/image-bmc,if=mtd,format=raw \
+       -device loader,file=${IMGDIR}/zephyr-aspeed-ssp.elf,cpu-num=4 \
+       -device loader,file=${IMGDIR}/zephyr-aspeed-tsp.elf,cpu-num=5 \
+       -serial pty -serial pty -serial pty \
+       -snapshot \
+       -S -nographic
+
+After launching QEMU, serial devices will be automatically redirected.
+Example output:
+
+.. code-block:: bash
+
+   char device redirected to /dev/pts/55 (label serial0)
+   char device redirected to /dev/pts/56 (label serial1)
+   char device redirected to /dev/pts/57 (label serial2)
+
+- serial0: Console for the four Cortex-A35 primary processors.
+- serial1 and serial2: Consoles for the two Cortex-M4 coprocessors.
+
+Use ``tio`` or another terminal emulator to connect to the consoles:
+
+.. code-block:: bash
+
+   $ tio /dev/pts/55
+   $ tio /dev/pts/56
+   $ tio /dev/pts/57
+
+
 Aspeed minibmc family boards (``ast1030-evb``)
 ==================================================================
 

From 61da38db70affd925226ce1e8a61d761c20d045b Mon Sep 17 00:00:00 2001
From: Christian Schoenebeck <qemu_oss@crudebyte.com>
Date: Fri, 7 Mar 2025 10:22:56 +0100
Subject: [PATCH 0632/2760] 9pfs: fix concurrent v9fs_reclaim_fd() calls

Even though this function is serialized to be always called from main
thread, v9fs_reclaim_fd() is dispatching the coroutine to a worker thread
in between via its v9fs_co_*() calls, hence leading to the situation where
v9fs_reclaim_fd() is effectively executed multiple times simultaniously,
which renders its LRU algorithm useless and causes high latency.

Fix this by adding a simple boolean variable to ensure this function is
only called once at a time. No synchronization needed for this boolean
variable as this function is only entered and returned on main thread.

Fixes: 7a46274529c ('hw/9pfs: Add file descriptor reclaim support')
Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
Reviewed-by: Greg Kurz <groug@kaod.org>
Message-Id: <5c622067efd66dd4ee5eca740dcf263f41db20b2.1741339452.git.qemu_oss@crudebyte.com>
---
 hw/9pfs/9p.c | 10 ++++++++++
 hw/9pfs/9p.h |  1 +
 2 files changed, 11 insertions(+)

diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c
index 7cad2bce62..4f9c2dde9c 100644
--- a/hw/9pfs/9p.c
+++ b/hw/9pfs/9p.c
@@ -435,6 +435,12 @@ void coroutine_fn v9fs_reclaim_fd(V9fsPDU *pdu)
     GHashTableIter iter;
     gpointer fid;
 
+    /* prevent multiple coroutines running this function simultaniously */
+    if (s->reclaiming) {
+        return;
+    }
+    s->reclaiming = true;
+
     g_hash_table_iter_init(&iter, s->fids);
 
     QSLIST_HEAD(, V9fsFidState) reclaim_list =
@@ -510,6 +516,8 @@ void coroutine_fn v9fs_reclaim_fd(V9fsPDU *pdu)
          */
         put_fid(pdu, f);
     }
+
+    s->reclaiming = false;
 }
 
 /*
@@ -4324,6 +4332,8 @@ int v9fs_device_realize_common(V9fsState *s, const V9fsTransport *t,
     s->ctx.fst = &fse->fst;
     fsdev_throttle_init(s->ctx.fst);
 
+    s->reclaiming = false;
+
     rc = 0;
 out:
     if (rc) {
diff --git a/hw/9pfs/9p.h b/hw/9pfs/9p.h
index 5e041e1f60..259ad32ed1 100644
--- a/hw/9pfs/9p.h
+++ b/hw/9pfs/9p.h
@@ -362,6 +362,7 @@ struct V9fsState {
     uint64_t qp_ndevices; /* Amount of entries in qpd_table. */
     uint16_t qp_affix_next;
     uint64_t qp_fullpath_next;
+    bool reclaiming;
 };
 
 /* 9p2000.L open flags */

From 89f7b4da7662ecc6840ffb0846045f03f9714bc6 Mon Sep 17 00:00:00 2001
From: Christian Schoenebeck <qemu_oss@crudebyte.com>
Date: Fri, 7 Mar 2025 10:23:02 +0100
Subject: [PATCH 0633/2760] 9pfs: fix FD leak and reduce latency of
 v9fs_reclaim_fd()

This patch fixes two different bugs in v9fs_reclaim_fd():

1. Reduce latency:

This function calls v9fs_co_close() and v9fs_co_closedir() in a loop. Each
one of the calls adds two thread hops (between main thread and a fs driver
background thread). Each thread hop adds latency, which sums up in
function's loop to a significant duration.

Reduce overall latency by open coding what v9fs_co_close() and
v9fs_co_closedir() do, executing those and the loop itself altogether in
only one background thread block, hence reducing the total amount of
thread hops to only two.

2. Fix file descriptor leak:

The existing code called v9fs_co_close() and v9fs_co_closedir() to close
file descriptors. Both functions check right at the beginning if the 9p
request was cancelled:

    if (v9fs_request_cancelled(pdu)) {
        return -EINTR;
    }

So if client sent a 'Tflush' message, v9fs_co_close() / v9fs_co_closedir()
returned without having closed the file descriptor and v9fs_reclaim_fd()
subsequently freed the FID without its file descriptor being closed, hence
leaking those file descriptors.

This 2nd bug is fixed by this patch as well by open coding v9fs_co_close()
and v9fs_co_closedir() inside of v9fs_reclaim_fd() and not performing the
v9fs_request_cancelled(pdu) check there.

Fixes: 7a46274529c ('hw/9pfs: Add file descriptor reclaim support')
Fixes: bccacf6c792 ('hw/9pfs: Implement TFLUSH operation')
Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
Reviewed-by: Greg Kurz <groug@kaod.org>
Message-Id: <5747469d3f039c53147e850b456943a1d4b5485c.1741339452.git.qemu_oss@crudebyte.com>
---
 hw/9pfs/9p.c | 29 ++++++++++++++++++++---------
 1 file changed, 20 insertions(+), 9 deletions(-)

diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c
index 4f9c2dde9c..80b190ff5b 100644
--- a/hw/9pfs/9p.c
+++ b/hw/9pfs/9p.c
@@ -434,6 +434,8 @@ void coroutine_fn v9fs_reclaim_fd(V9fsPDU *pdu)
     V9fsFidState *f;
     GHashTableIter iter;
     gpointer fid;
+    int err;
+    int nclosed = 0;
 
     /* prevent multiple coroutines running this function simultaniously */
     if (s->reclaiming) {
@@ -446,10 +448,10 @@ void coroutine_fn v9fs_reclaim_fd(V9fsPDU *pdu)
     QSLIST_HEAD(, V9fsFidState) reclaim_list =
         QSLIST_HEAD_INITIALIZER(reclaim_list);
 
+    /* Pick FIDs to be closed, collect them on reclaim_list. */
     while (g_hash_table_iter_next(&iter, &fid, (gpointer *) &f)) {
         /*
-         * Unlink fids cannot be reclaimed. Check
-         * for them and skip them. Also skip fids
+         * Unlinked fids cannot be reclaimed, skip those, and also skip fids
          * currently being operated on.
          */
         if (f->ref || f->flags & FID_NON_RECLAIMABLE) {
@@ -499,17 +501,26 @@ void coroutine_fn v9fs_reclaim_fd(V9fsPDU *pdu)
         }
     }
     /*
-     * Now close the fid in reclaim list. Free them if they
-     * are already clunked.
+     * Close the picked FIDs altogether on a background I/O driver thread. Do
+     * this all at once to keep latency (i.e. amount of thread hops between main
+     * thread <-> fs driver background thread) as low as possible.
      */
+    v9fs_co_run_in_worker({
+        QSLIST_FOREACH(f, &reclaim_list, reclaim_next) {
+            err = (f->fid_type == P9_FID_DIR) ?
+                s->ops->closedir(&s->ctx, &f->fs_reclaim) :
+                s->ops->close(&s->ctx, &f->fs_reclaim);
+            if (!err) {
+                /* total_open_fd must only be mutated on main thread */
+                nclosed++;
+            }
+        }
+    });
+    total_open_fd -= nclosed;
+    /* Free the closed FIDs. */
     while (!QSLIST_EMPTY(&reclaim_list)) {
         f = QSLIST_FIRST(&reclaim_list);
         QSLIST_REMOVE(&reclaim_list, f, V9fsFidState, reclaim_next);
-        if (f->fid_type == P9_FID_FILE) {
-            v9fs_co_close(pdu, &f->fs_reclaim);
-        } else if (f->fid_type == P9_FID_DIR) {
-            v9fs_co_closedir(pdu, &f->fs_reclaim);
-        }
         /*
          * Now drop the fid reference, free it
          * if clunked.

From 4f82ce8cd94f2601fb2b2e4cfe0cf5b44131817e Mon Sep 17 00:00:00 2001
From: Greg Kurz <groug@kaod.org>
Date: Wed, 12 Mar 2025 16:29:27 +0100
Subject: [PATCH 0634/2760] 9pfs: local : Introduce local_fid_fd() helper

Factor out duplicated code to a single helper. More users to come.

Signed-off-by: Greg Kurz <groug@kaod.org>
Reviewed-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
Message-Id: <20250312152933.383967-2-groug@kaod.org>
Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
---
 hw/9pfs/9p-local.c | 25 +++++++++++--------------
 1 file changed, 11 insertions(+), 14 deletions(-)

diff --git a/hw/9pfs/9p-local.c b/hw/9pfs/9p-local.c
index 928523afcc..99b9560a52 100644
--- a/hw/9pfs/9p-local.c
+++ b/hw/9pfs/9p-local.c
@@ -766,16 +766,19 @@ out:
     return err;
 }
 
+static int local_fid_fd(int fid_type, V9fsFidOpenState *fs)
+{
+    if (fid_type == P9_FID_DIR) {
+        return dirfd(fs->dir.stream);
+    } else {
+        return fs->fd;
+    }
+}
+
 static int local_fstat(FsContext *fs_ctx, int fid_type,
                        V9fsFidOpenState *fs, struct stat *stbuf)
 {
-    int err, fd;
-
-    if (fid_type == P9_FID_DIR) {
-        fd = dirfd(fs->dir.stream);
-    } else {
-        fd = fs->fd;
-    }
+    int err, fd = local_fid_fd(fid_type, fs);
 
     err = fstat(fd, stbuf);
     if (err) {
@@ -1167,13 +1170,7 @@ out:
 static int local_fsync(FsContext *ctx, int fid_type,
                        V9fsFidOpenState *fs, int datasync)
 {
-    int fd;
-
-    if (fid_type == P9_FID_DIR) {
-        fd = dirfd(fs->dir.stream);
-    } else {
-        fd = fs->fd;
-    }
+    int fd = local_fid_fd(fid_type, fs);
 
     if (datasync) {
         return qemu_fdatasync(fd);

From f2bb367d2b265c6c0ead1e0d4a8f7c43310b3107 Mon Sep 17 00:00:00 2001
From: Greg Kurz <groug@kaod.org>
Date: Wed, 12 Mar 2025 16:29:28 +0100
Subject: [PATCH 0635/2760] 9pfs: Don't use file descriptors in core code

v9fs_getattr() currently peeks into V9fsFidOpenState to know if a fid
has a valid file descriptor or directory stream. Even though the fields
are accessible, this is an implementation detail of the local backend
that should not be manipulated directly by the server code.

Abstract that with a new has_valid_file_handle() backend operation.

Signed-off-by: Greg Kurz <groug@kaod.org>
Reviewed-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
Message-Id: <20250312152933.383967-3-groug@kaod.org>
Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
---
 fsdev/file-op-9p.h | 1 +
 hw/9pfs/9p-local.c | 8 ++++++++
 hw/9pfs/9p-synth.c | 6 ++++++
 hw/9pfs/9p.c       | 9 ++++++---
 4 files changed, 21 insertions(+), 3 deletions(-)

diff --git a/fsdev/file-op-9p.h b/fsdev/file-op-9p.h
index 4997677460..b815cea44e 100644
--- a/fsdev/file-op-9p.h
+++ b/fsdev/file-op-9p.h
@@ -164,6 +164,7 @@ struct FileOperations {
     int (*renameat)(FsContext *ctx, V9fsPath *olddir, const char *old_name,
                     V9fsPath *newdir, const char *new_name);
     int (*unlinkat)(FsContext *ctx, V9fsPath *dir, const char *name, int flags);
+    bool (*has_valid_file_handle)(int fid_type, V9fsFidOpenState *fs);
 };
 
 #endif
diff --git a/hw/9pfs/9p-local.c b/hw/9pfs/9p-local.c
index 99b9560a52..b16132299f 100644
--- a/hw/9pfs/9p-local.c
+++ b/hw/9pfs/9p-local.c
@@ -1572,6 +1572,13 @@ static int local_parse_opts(QemuOpts *opts, FsDriverEntry *fse, Error **errp)
     return 0;
 }
 
+static bool local_has_valid_file_handle(int fid_type, V9fsFidOpenState *fs)
+{
+    return
+        (fid_type == P9_FID_FILE && fs->fd != -1) ||
+        (fid_type == P9_FID_DIR && fs->dir.stream != NULL);
+}
+
 FileOperations local_ops = {
     .parse_opts = local_parse_opts,
     .init  = local_init,
@@ -1609,4 +1616,5 @@ FileOperations local_ops = {
     .name_to_path = local_name_to_path,
     .renameat  = local_renameat,
     .unlinkat = local_unlinkat,
+    .has_valid_file_handle = local_has_valid_file_handle,
 };
diff --git a/hw/9pfs/9p-synth.c b/hw/9pfs/9p-synth.c
index 2abaf3a291..be0492b400 100644
--- a/hw/9pfs/9p-synth.c
+++ b/hw/9pfs/9p-synth.c
@@ -615,6 +615,11 @@ static int synth_init(FsContext *ctx, Error **errp)
     return 0;
 }
 
+static bool synth_has_valid_file_handle(int fid_type, V9fsFidOpenState *fs)
+{
+    return false;
+}
+
 FileOperations synth_ops = {
     .init         = synth_init,
     .lstat        = synth_lstat,
@@ -650,4 +655,5 @@ FileOperations synth_ops = {
     .name_to_path = synth_name_to_path,
     .renameat     = synth_renameat,
     .unlinkat     = synth_unlinkat,
+    .has_valid_file_handle = synth_has_valid_file_handle,
 };
diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c
index 80b190ff5b..4586822d24 100644
--- a/hw/9pfs/9p.c
+++ b/hw/9pfs/9p.c
@@ -1593,6 +1593,11 @@ out_nofid:
     pdu_complete(pdu, err);
 }
 
+static bool fid_has_valid_file_handle(V9fsState *s, V9fsFidState *fidp)
+{
+    return s->ops->has_valid_file_handle(fidp->fid_type, &fidp->fs);
+}
+
 static void coroutine_fn v9fs_getattr(void *opaque)
 {
     int32_t fid;
@@ -1615,9 +1620,7 @@ static void coroutine_fn v9fs_getattr(void *opaque)
         retval = -ENOENT;
         goto out_nofid;
     }
-    if ((fidp->fid_type == P9_FID_FILE && fidp->fs.fd != -1) ||
-        (fidp->fid_type == P9_FID_DIR && fidp->fs.dir.stream))
-    {
+    if (fid_has_valid_file_handle(pdu->s, fidp)) {
         retval = v9fs_co_fstat(pdu, fidp, &stbuf);
     } else {
         retval = v9fs_co_lstat(pdu, &fidp->path, &stbuf);

From 0c798dd52355f3489b29bba0dfd7df0e24cfa1dd Mon Sep 17 00:00:00 2001
From: Greg Kurz <groug@kaod.org>
Date: Wed, 12 Mar 2025 16:29:29 +0100
Subject: [PATCH 0636/2760] 9pfs: Introduce ftruncate file op

Add an ftruncate operation to the fs driver and use if when a fid has
a valid file descriptor. This is required to support more cases where
the client wants to do an action on an unlinked file which it still
has an open file decriptor for.

Only 9P2000.L was considered.

Signed-off-by: Greg Kurz <groug@kaod.org>
Reviewed-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
Message-Id: <20250312152933.383967-4-groug@kaod.org>
Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
---
 fsdev/file-op-9p.h |  2 ++
 hw/9pfs/9p-local.c |  9 +++++++++
 hw/9pfs/9p-synth.c |  8 ++++++++
 hw/9pfs/9p.c       |  6 +++++-
 hw/9pfs/cofs.c     | 18 ++++++++++++++++++
 hw/9pfs/coth.h     |  2 ++
 6 files changed, 44 insertions(+), 1 deletion(-)

diff --git a/fsdev/file-op-9p.h b/fsdev/file-op-9p.h
index b815cea44e..26ba1438c0 100644
--- a/fsdev/file-op-9p.h
+++ b/fsdev/file-op-9p.h
@@ -152,6 +152,8 @@ struct FileOperations {
     int (*fstat)(FsContext *, int, V9fsFidOpenState *, struct stat *);
     int (*rename)(FsContext *, const char *, const char *);
     int (*truncate)(FsContext *, V9fsPath *, off_t);
+    int (*ftruncate)(FsContext *ctx, int fid_type, V9fsFidOpenState *fs,
+                     off_t size);
     int (*fsync)(FsContext *, int, V9fsFidOpenState *, int);
     int (*statfs)(FsContext *s, V9fsPath *path, struct statfs *stbuf);
     ssize_t (*lgetxattr)(FsContext *, V9fsPath *,
diff --git a/hw/9pfs/9p-local.c b/hw/9pfs/9p-local.c
index b16132299f..0b33da8d2a 100644
--- a/hw/9pfs/9p-local.c
+++ b/hw/9pfs/9p-local.c
@@ -1042,6 +1042,14 @@ static int local_truncate(FsContext *ctx, V9fsPath *fs_path, off_t size)
     return ret;
 }
 
+static int local_ftruncate(FsContext *ctx, int fid_type, V9fsFidOpenState *fs,
+                           off_t size)
+{
+    int fd = local_fid_fd(fid_type, fs);
+
+    return ftruncate(fd, size);
+}
+
 static int local_chown(FsContext *fs_ctx, V9fsPath *fs_path, FsCred *credp)
 {
     char *dirpath = g_path_get_dirname(fs_path->data);
@@ -1617,4 +1625,5 @@ FileOperations local_ops = {
     .renameat  = local_renameat,
     .unlinkat = local_unlinkat,
     .has_valid_file_handle = local_has_valid_file_handle,
+    .ftruncate = local_ftruncate,
 };
diff --git a/hw/9pfs/9p-synth.c b/hw/9pfs/9p-synth.c
index be0492b400..3d28afc4d0 100644
--- a/hw/9pfs/9p-synth.c
+++ b/hw/9pfs/9p-synth.c
@@ -356,6 +356,13 @@ static int synth_truncate(FsContext *ctx, V9fsPath *path, off_t offset)
     return -1;
 }
 
+static int synth_ftruncate(FsContext *ctx, int fid_type, V9fsFidOpenState *fs,
+                           off_t size)
+{
+    errno = ENOSYS;
+    return -1;
+}
+
 static int synth_chmod(FsContext *fs_ctx, V9fsPath *path, FsCred *credp)
 {
     errno = EPERM;
@@ -656,4 +663,5 @@ FileOperations synth_ops = {
     .renameat     = synth_renameat,
     .unlinkat     = synth_unlinkat,
     .has_valid_file_handle = synth_has_valid_file_handle,
+    .ftruncate    = synth_ftruncate,
 };
diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c
index 4586822d24..c96f2d2d3d 100644
--- a/hw/9pfs/9p.c
+++ b/hw/9pfs/9p.c
@@ -1752,7 +1752,11 @@ static void coroutine_fn v9fs_setattr(void *opaque)
         }
     }
     if (v9iattr.valid & (P9_ATTR_SIZE)) {
-        err = v9fs_co_truncate(pdu, &fidp->path, v9iattr.size);
+        if (fid_has_valid_file_handle(pdu->s, fidp)) {
+            err = v9fs_co_ftruncate(pdu, fidp, v9iattr.size);
+        } else {
+            err = v9fs_co_truncate(pdu, &fidp->path, v9iattr.size);
+        }
         if (err < 0) {
             goto out;
         }
diff --git a/hw/9pfs/cofs.c b/hw/9pfs/cofs.c
index 67e3ae5c5c..893466fb1a 100644
--- a/hw/9pfs/cofs.c
+++ b/hw/9pfs/cofs.c
@@ -184,6 +184,24 @@ int coroutine_fn v9fs_co_truncate(V9fsPDU *pdu, V9fsPath *path, off_t size)
     return err;
 }
 
+int coroutine_fn v9fs_co_ftruncate(V9fsPDU *pdu, V9fsFidState *fidp, off_t size)
+{
+    int err;
+    V9fsState *s = pdu->s;
+
+    if (v9fs_request_cancelled(pdu)) {
+        return -EINTR;
+    }
+    v9fs_co_run_in_worker(
+        {
+            err = s->ops->ftruncate(&s->ctx, fidp->fid_type, &fidp->fs, size);
+            if (err < 0) {
+                err = -errno;
+            }
+        });
+    return err;
+}
+
 int coroutine_fn v9fs_co_mknod(V9fsPDU *pdu, V9fsFidState *fidp,
                                V9fsString *name, uid_t uid, gid_t gid,
                                dev_t dev, mode_t mode, struct stat *stbuf)
diff --git a/hw/9pfs/coth.h b/hw/9pfs/coth.h
index 2c54249b35..62e922dc12 100644
--- a/hw/9pfs/coth.h
+++ b/hw/9pfs/coth.h
@@ -73,6 +73,8 @@ int coroutine_fn v9fs_co_chmod(V9fsPDU *, V9fsPath *, mode_t);
 int coroutine_fn v9fs_co_utimensat(V9fsPDU *, V9fsPath *, struct timespec [2]);
 int coroutine_fn v9fs_co_chown(V9fsPDU *, V9fsPath *, uid_t, gid_t);
 int coroutine_fn v9fs_co_truncate(V9fsPDU *, V9fsPath *, off_t);
+int coroutine_fn v9fs_co_ftruncate(V9fsPDU *pdu, V9fsFidState *fidp,
+                                   off_t size);
 int coroutine_fn v9fs_co_llistxattr(V9fsPDU *, V9fsPath *, void *, size_t);
 int coroutine_fn v9fs_co_lgetxattr(V9fsPDU *, V9fsPath *,
                                    V9fsString *, void *, size_t);

From 371a269ff8ce561c28e4fa03bb49e4940f990637 Mon Sep 17 00:00:00 2001
From: Greg Kurz <groug@kaod.org>
Date: Wed, 12 Mar 2025 16:29:30 +0100
Subject: [PATCH 0637/2760] 9pfs: Introduce futimens file op

Add an futimens operation to the fs driver and use if when a fid has
a valid file descriptor. This is required to support more cases where
the client wants to do an action on an unlinked file which it still
has an open file decriptor for.

Only 9P2000.L was considered.

Signed-off-by: Greg Kurz <groug@kaod.org>
Reviewed-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
Message-Id: <20250312152933.383967-5-groug@kaod.org>
Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
---
 fsdev/file-op-9p.h |  2 ++
 hw/9pfs/9p-local.c |  9 +++++++++
 hw/9pfs/9p-synth.c |  8 ++++++++
 hw/9pfs/9p-util.h  |  1 +
 hw/9pfs/9p.c       |  6 +++++-
 hw/9pfs/cofs.c     | 19 +++++++++++++++++++
 hw/9pfs/coth.h     |  2 ++
 7 files changed, 46 insertions(+), 1 deletion(-)

diff --git a/fsdev/file-op-9p.h b/fsdev/file-op-9p.h
index 26ba1438c0..b9dae8c84c 100644
--- a/fsdev/file-op-9p.h
+++ b/fsdev/file-op-9p.h
@@ -129,6 +129,8 @@ struct FileOperations {
     int (*chown)(FsContext *, V9fsPath *, FsCred *);
     int (*mknod)(FsContext *, V9fsPath *, const char *, FsCred *);
     int (*utimensat)(FsContext *, V9fsPath *, const struct timespec *);
+    int (*futimens)(FsContext *ctx, int fid_type, V9fsFidOpenState *fs,
+                    const struct timespec *times);
     int (*remove)(FsContext *, const char *);
     int (*symlink)(FsContext *, const char *, V9fsPath *,
                    const char *, FsCred *);
diff --git a/hw/9pfs/9p-local.c b/hw/9pfs/9p-local.c
index 0b33da8d2a..31e216227c 100644
--- a/hw/9pfs/9p-local.c
+++ b/hw/9pfs/9p-local.c
@@ -1100,6 +1100,14 @@ out:
     return ret;
 }
 
+static int local_futimens(FsContext *s, int fid_type, V9fsFidOpenState *fs,
+                          const struct timespec *times)
+{
+    int fd = local_fid_fd(fid_type, fs);
+
+    return qemu_futimens(fd, times);
+}
+
 static int local_unlinkat_common(FsContext *ctx, int dirfd, const char *name,
                                  int flags)
 {
@@ -1626,4 +1634,5 @@ FileOperations local_ops = {
     .unlinkat = local_unlinkat,
     .has_valid_file_handle = local_has_valid_file_handle,
     .ftruncate = local_ftruncate,
+    .futimens = local_futimens,
 };
diff --git a/hw/9pfs/9p-synth.c b/hw/9pfs/9p-synth.c
index 3d28afc4d0..9cd1884224 100644
--- a/hw/9pfs/9p-synth.c
+++ b/hw/9pfs/9p-synth.c
@@ -424,6 +424,13 @@ static int synth_utimensat(FsContext *fs_ctx, V9fsPath *path,
     return 0;
 }
 
+static int synth_futimens(FsContext *fs_ctx, int fid_type, V9fsFidOpenState *fs,
+                          const struct timespec *buf)
+{
+    errno = ENOSYS;
+    return -1;
+}
+
 static int synth_remove(FsContext *ctx, const char *path)
 {
     errno = EPERM;
@@ -664,4 +671,5 @@ FileOperations synth_ops = {
     .unlinkat     = synth_unlinkat,
     .has_valid_file_handle = synth_has_valid_file_handle,
     .ftruncate    = synth_ftruncate,
+    .futimens     = synth_futimens,
 };
diff --git a/hw/9pfs/9p-util.h b/hw/9pfs/9p-util.h
index 7bc4ec8e85..a1924fe3f0 100644
--- a/hw/9pfs/9p-util.h
+++ b/hw/9pfs/9p-util.h
@@ -103,6 +103,7 @@ static inline int errno_to_dotl(int err) {
 #define qemu_renameat   renameat
 #define qemu_utimensat  utimensat
 #define qemu_unlinkat   unlinkat
+#define qemu_futimens   futimens
 
 static inline void close_preserve_errno(int fd)
 {
diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c
index c96f2d2d3d..b22df3aa2b 100644
--- a/hw/9pfs/9p.c
+++ b/hw/9pfs/9p.c
@@ -1727,7 +1727,11 @@ static void coroutine_fn v9fs_setattr(void *opaque)
         } else {
             times[1].tv_nsec = UTIME_OMIT;
         }
-        err = v9fs_co_utimensat(pdu, &fidp->path, times);
+        if (fid_has_valid_file_handle(pdu->s, fidp)) {
+            err = v9fs_co_futimens(pdu, fidp, times);
+        } else {
+            err = v9fs_co_utimensat(pdu, &fidp->path, times);
+        }
         if (err < 0) {
             goto out;
         }
diff --git a/hw/9pfs/cofs.c b/hw/9pfs/cofs.c
index 893466fb1a..12fa8c9fe9 100644
--- a/hw/9pfs/cofs.c
+++ b/hw/9pfs/cofs.c
@@ -139,6 +139,25 @@ int coroutine_fn v9fs_co_utimensat(V9fsPDU *pdu, V9fsPath *path,
     return err;
 }
 
+int coroutine_fn v9fs_co_futimens(V9fsPDU *pdu, V9fsFidState *fidp,
+                                  struct timespec times[2])
+{
+    int err;
+    V9fsState *s = pdu->s;
+
+    if (v9fs_request_cancelled(pdu)) {
+        return -EINTR;
+    }
+    v9fs_co_run_in_worker(
+        {
+            err = s->ops->futimens(&s->ctx, fidp->fid_type, &fidp->fs, times);
+            if (err < 0) {
+                err = -errno;
+            }
+        });
+    return err;
+}
+
 int coroutine_fn v9fs_co_chown(V9fsPDU *pdu, V9fsPath *path, uid_t uid,
                                gid_t gid)
 {
diff --git a/hw/9pfs/coth.h b/hw/9pfs/coth.h
index 62e922dc12..7906fa7782 100644
--- a/hw/9pfs/coth.h
+++ b/hw/9pfs/coth.h
@@ -71,6 +71,8 @@ int coroutine_fn v9fs_co_statfs(V9fsPDU *, V9fsPath *, struct statfs *);
 int coroutine_fn v9fs_co_lstat(V9fsPDU *, V9fsPath *, struct stat *);
 int coroutine_fn v9fs_co_chmod(V9fsPDU *, V9fsPath *, mode_t);
 int coroutine_fn v9fs_co_utimensat(V9fsPDU *, V9fsPath *, struct timespec [2]);
+int coroutine_fn v9fs_co_futimens(V9fsPDU *pdu, V9fsFidState *fidp,
+                                  struct timespec times[2]);
 int coroutine_fn v9fs_co_chown(V9fsPDU *, V9fsPath *, uid_t, gid_t);
 int coroutine_fn v9fs_co_truncate(V9fsPDU *, V9fsPath *, off_t);
 int coroutine_fn v9fs_co_ftruncate(V9fsPDU *pdu, V9fsFidState *fidp,

From 4719a2d59176a6c850e2b4f1af44cecd25430fce Mon Sep 17 00:00:00 2001
From: Christian Schoenebeck <qemu_oss@crudebyte.com>
Date: Wed, 12 Mar 2025 16:29:31 +0100
Subject: [PATCH 0638/2760] tests/9p: add 'Tsetattr' request to test client

Add and implement functions to 9pfs test client for sending a 9p2000.L
'Tsetattr' request and receiving its 'Rsetattr' response counterpart.

Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
Signed-off-by: Greg Kurz <groug@kaod.org>
Message-Id: <20250312152933.383967-6-groug@kaod.org>
---
 tests/qtest/libqos/virtio-9p-client.c | 49 +++++++++++++++++++++++++++
 tests/qtest/libqos/virtio-9p-client.h | 34 +++++++++++++++++++
 tests/qtest/virtio-9p-test.c          |  1 +
 3 files changed, 84 insertions(+)

diff --git a/tests/qtest/libqos/virtio-9p-client.c b/tests/qtest/libqos/virtio-9p-client.c
index 98b77db51d..6ab4501c6e 100644
--- a/tests/qtest/libqos/virtio-9p-client.c
+++ b/tests/qtest/libqos/virtio-9p-client.c
@@ -557,6 +557,55 @@ void v9fs_rgetattr(P9Req *req, v9fs_attr *attr)
     v9fs_req_free(req);
 }
 
+/*
+ * size[4] Tsetattr tag[2] fid[4] valid[4] mode[4] uid[4] gid[4] size[8]
+ *                  atime_sec[8] atime_nsec[8] mtime_sec[8] mtime_nsec[8]
+ */
+TSetAttrRes v9fs_tsetattr(TSetAttrOpt opt)
+{
+    P9Req *req;
+    uint32_t err;
+
+    g_assert(opt.client);
+
+    req = v9fs_req_init(
+        opt.client, 4/*fid*/ + 4/*valid*/ + 4/*mode*/ + 4/*uid*/ + 4/*gid*/ +
+        8/*size*/ + 8/*atime_sec*/ + 8/*atime_nsec*/ + 8/*mtime_sec*/ +
+        8/*mtime_nsec*/, P9_TSETATTR, opt.tag
+    );
+    v9fs_uint32_write(req, opt.fid);
+    v9fs_uint32_write(req, (uint32_t) opt.attr.valid);
+    v9fs_uint32_write(req, opt.attr.mode);
+    v9fs_uint32_write(req, opt.attr.uid);
+    v9fs_uint32_write(req, opt.attr.gid);
+    v9fs_uint64_write(req, opt.attr.size);
+    v9fs_uint64_write(req, opt.attr.atime_sec);
+    v9fs_uint64_write(req, opt.attr.atime_nsec);
+    v9fs_uint64_write(req, opt.attr.mtime_sec);
+    v9fs_uint64_write(req, opt.attr.mtime_nsec);
+    v9fs_req_send(req);
+
+    if (!opt.requestOnly) {
+        v9fs_req_wait_for_reply(req, NULL);
+        if (opt.expectErr) {
+            v9fs_rlerror(req, &err);
+            g_assert_cmpint(err, ==, opt.expectErr);
+        } else {
+            v9fs_rsetattr(req);
+        }
+        req = NULL; /* request was freed */
+    }
+
+    return (TSetAttrRes) { .req = req };
+}
+
+/* size[4] Rsetattr tag[2] */
+void v9fs_rsetattr(P9Req *req)
+{
+    v9fs_req_recv(req, P9_RSETATTR);
+    v9fs_req_free(req);
+}
+
 /* size[4] Treaddir tag[2] fid[4] offset[8] count[4] */
 TReadDirRes v9fs_treaddir(TReadDirOpt opt)
 {
diff --git a/tests/qtest/libqos/virtio-9p-client.h b/tests/qtest/libqos/virtio-9p-client.h
index 78228eb97d..e3221a3104 100644
--- a/tests/qtest/libqos/virtio-9p-client.h
+++ b/tests/qtest/libqos/virtio-9p-client.h
@@ -65,6 +65,16 @@ typedef struct v9fs_attr {
 #define P9_GETATTR_BASIC    0x000007ffULL /* Mask for fields up to BLOCKS */
 #define P9_GETATTR_ALL      0x00003fffULL /* Mask for ALL fields */
 
+#define P9_SETATTR_MODE         0x00000001UL
+#define P9_SETATTR_UID          0x00000002UL
+#define P9_SETATTR_GID          0x00000004UL
+#define P9_SETATTR_SIZE         0x00000008UL
+#define P9_SETATTR_ATIME        0x00000010UL
+#define P9_SETATTR_MTIME        0x00000020UL
+#define P9_SETATTR_CTIME        0x00000040UL
+#define P9_SETATTR_ATIME_SET    0x00000080UL
+#define P9_SETATTR_MTIME_SET    0x00000100UL
+
 struct V9fsDirent {
     v9fs_qid qid;
     uint64_t offset;
@@ -182,6 +192,28 @@ typedef struct TGetAttrRes {
     P9Req *req;
 } TGetAttrRes;
 
+/* options for 'Tsetattr' 9p request */
+typedef struct TSetAttrOpt {
+    /* 9P client being used (mandatory) */
+    QVirtio9P *client;
+    /* user supplied tag number being returned with response (optional) */
+    uint16_t tag;
+    /* file ID of file/dir whose attributes shall be modified (required) */
+    uint32_t fid;
+    /* new attribute values to be set by 9p server */
+    v9fs_attr attr;
+    /* only send Tsetattr request but not wait for a reply? (optional) */
+    bool requestOnly;
+    /* do we expect an Rlerror response, if yes which error code? (optional) */
+    uint32_t expectErr;
+} TSetAttrOpt;
+
+/* result of 'Tsetattr' 9p request */
+typedef struct TSetAttrRes {
+    /* if requestOnly was set: request object for further processing */
+    P9Req *req;
+} TSetAttrRes;
+
 /* options for 'Treaddir' 9p request */
 typedef struct TReadDirOpt {
     /* 9P client being used (mandatory) */
@@ -470,6 +502,8 @@ TWalkRes v9fs_twalk(TWalkOpt opt);
 void v9fs_rwalk(P9Req *req, uint16_t *nwqid, v9fs_qid **wqid);
 TGetAttrRes v9fs_tgetattr(TGetAttrOpt);
 void v9fs_rgetattr(P9Req *req, v9fs_attr *attr);
+TSetAttrRes v9fs_tsetattr(TSetAttrOpt opt);
+void v9fs_rsetattr(P9Req *req);
 TReadDirRes v9fs_treaddir(TReadDirOpt);
 void v9fs_rreaddir(P9Req *req, uint32_t *count, uint32_t *nentries,
                    struct V9fsDirent **entries);
diff --git a/tests/qtest/virtio-9p-test.c b/tests/qtest/virtio-9p-test.c
index ab3a12c816..f515a9bb15 100644
--- a/tests/qtest/virtio-9p-test.c
+++ b/tests/qtest/virtio-9p-test.c
@@ -20,6 +20,7 @@
 #define tversion(...) v9fs_tversion((TVersionOpt) __VA_ARGS__)
 #define tattach(...) v9fs_tattach((TAttachOpt) __VA_ARGS__)
 #define tgetattr(...) v9fs_tgetattr((TGetAttrOpt) __VA_ARGS__)
+#define tsetattr(...) v9fs_tsetattr((TSetAttrOpt) __VA_ARGS__)
 #define treaddir(...) v9fs_treaddir((TReadDirOpt) __VA_ARGS__)
 #define tlopen(...) v9fs_tlopen((TLOpenOpt) __VA_ARGS__)
 #define twrite(...) v9fs_twrite((TWriteOpt) __VA_ARGS__)

From 610dc187e52605c8ea8d14c5e7d8e7384f8af290 Mon Sep 17 00:00:00 2001
From: Greg Kurz <groug@kaod.org>
Date: Wed, 12 Mar 2025 16:29:32 +0100
Subject: [PATCH 0639/2760] tests/9p: Test `Tsetattr` can truncate unlinked
 file

Enhance the `use-after-unlink` test with a new check for the
case where the client wants to alter the size of an unlinked
file for which it still has an active fid.

Suggested-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
Signed-off-by: Greg Kurz <groug@kaod.org>
Reviewed-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
Message-Id: <20250312152933.383967-7-groug@kaod.org>
Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
---
 tests/qtest/virtio-9p-test.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/tests/qtest/virtio-9p-test.c b/tests/qtest/virtio-9p-test.c
index f515a9bb15..ac38ccf595 100644
--- a/tests/qtest/virtio-9p-test.c
+++ b/tests/qtest/virtio-9p-test.c
@@ -736,6 +736,20 @@ static void fs_use_after_unlink(void *obj, void *data,
         .data = buf
     }).count;
     g_assert_cmpint(count, ==, write_count);
+
+    /* truncate file to (arbitrarily chosen) size 2001 */
+    tsetattr({
+        .client = v9p, .fid = fid_file, .attr = (v9fs_attr) {
+            .valid = P9_SETATTR_SIZE,
+            .size = 2001
+        }
+     });
+    /* truncate apparently succeeded, let's double-check the size */
+    tgetattr({
+        .client = v9p, .fid = fid_file, .request_mask = P9_GETATTR_BASIC,
+        .rgetattr.attr = &attr
+    });
+    g_assert_cmpint(attr.size, ==, 2001);
 }
 
 static void cleanup_9p_local_driver(void *data)

From cdafeda35709ddf8cd982a7eb653c2a5028c8074 Mon Sep 17 00:00:00 2001
From: Christian Schoenebeck <qemu_oss@crudebyte.com>
Date: Thu, 20 Mar 2025 13:16:20 +0100
Subject: [PATCH 0640/2760] 9pfs: fix 'total_open_fd' decrementation

According to 'man 2 close' errors returned by close() should only be used
for either diagnostic purposes or for catching data loss due to a previous
write error, as an error result of close() usually indicates a deferred
error of a previous write operation.

Therefore not decrementing 'total_open_fd' on a close() error is wrong
and would yield in a higher open file descriptor count than actually the
case, leading to 9p server reclaiming open file descriptors too soon.

Based-on: <20250312152933.383967-7-groug@kaod.org>
Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
Reviewed-by: Greg Kurz <groug@kaod.org>
Message-Id: <E1tvEyJ-004dMa-So@kylie.crudebyte.com>
---
 hw/9pfs/9p.c     | 10 +++++++++-
 hw/9pfs/codir.c  |  7 ++++++-
 hw/9pfs/cofile.c |  7 ++++++-
 3 files changed, 21 insertions(+), 3 deletions(-)

diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c
index b22df3aa2b..8b001b9112 100644
--- a/hw/9pfs/9p.c
+++ b/hw/9pfs/9p.c
@@ -510,7 +510,15 @@ void coroutine_fn v9fs_reclaim_fd(V9fsPDU *pdu)
             err = (f->fid_type == P9_FID_DIR) ?
                 s->ops->closedir(&s->ctx, &f->fs_reclaim) :
                 s->ops->close(&s->ctx, &f->fs_reclaim);
-            if (!err) {
+
+            /* 'man 2 close' suggests to ignore close() errors except of EBADF */
+            if (unlikely(err && errno == EBADF)) {
+                /*
+                 * unexpected case as FIDs were picked above by having a valid
+                 * file descriptor
+                 */
+                error_report("9pfs: v9fs_reclaim_fd() WARNING: close() failed with EBADF");
+            } else {
                 /* total_open_fd must only be mutated on main thread */
                 nclosed++;
             }
diff --git a/hw/9pfs/codir.c b/hw/9pfs/codir.c
index 2068a4779d..bce7dd96e9 100644
--- a/hw/9pfs/codir.c
+++ b/hw/9pfs/codir.c
@@ -20,6 +20,7 @@
 #include "fsdev/qemu-fsdev.h"
 #include "qemu/thread.h"
 #include "qemu/main-loop.h"
+#include "qemu/error-report.h"
 #include "coth.h"
 #include "9p-xattr.h"
 #include "9p-util.h"
@@ -353,7 +354,11 @@ int coroutine_fn v9fs_co_closedir(V9fsPDU *pdu, V9fsFidOpenState *fs)
                 err = -errno;
             }
         });
-    if (!err) {
+    /* 'man 2 close' suggests to ignore close() errors except of EBADF */
+    if (unlikely(err && errno == EBADF)) {
+        /* unexpected case as we should have checked for a valid file handle */
+        error_report("9pfs: WARNING: v9fs_co_closedir() failed with EBADF");
+    } else {
         total_open_fd--;
     }
     return err;
diff --git a/hw/9pfs/cofile.c b/hw/9pfs/cofile.c
index 71174c3e4a..6e775c8e41 100644
--- a/hw/9pfs/cofile.c
+++ b/hw/9pfs/cofile.c
@@ -20,6 +20,7 @@
 #include "fsdev/qemu-fsdev.h"
 #include "qemu/thread.h"
 #include "qemu/main-loop.h"
+#include "qemu/error-report.h"
 #include "coth.h"
 
 int coroutine_fn v9fs_co_st_gen(V9fsPDU *pdu, V9fsPath *path, mode_t st_mode,
@@ -197,7 +198,11 @@ int coroutine_fn v9fs_co_close(V9fsPDU *pdu, V9fsFidOpenState *fs)
                 err = -errno;
             }
         });
-    if (!err) {
+    /* 'man 2 close' suggests to ignore close() errors except of EBADF */
+    if (unlikely(err && errno == EBADF)) {
+        /* unexpected case as we should have checked for a valid file handle */
+        error_report("9pfs: WARNING: v9fs_co_close() failed with EBADF");
+    } else {
         total_open_fd--;
     }
     return err;

From d551b822f7ac329c763267659950992849d7e735 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 30 Apr 2025 15:33:05 -0700
Subject: [PATCH 0641/2760] accel/tcg: Use vaddr in cpu_loop.h

Use vaddr instead of abi_ptr or target_ulong for a guest address.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/user-exec.c   |  2 +-
 bsd-user/signal.c       |  4 ++--
 include/user/cpu_loop.h | 12 +++++-------
 linux-user/signal.c     |  4 ++--
 4 files changed, 10 insertions(+), 12 deletions(-)

diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index 68e01fc584..e1f4c4eacf 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -126,7 +126,7 @@ MMUAccessType adjust_signal_pc(uintptr_t *pc, bool is_write)
  * guest, we'd end up in an infinite loop of retrying the faulting access.
  */
 bool handle_sigsegv_accerr_write(CPUState *cpu, sigset_t *old_set,
-                                 uintptr_t host_pc, abi_ptr guest_addr)
+                                 uintptr_t host_pc, vaddr guest_addr)
 {
     switch (page_unprotect(cpu, guest_addr, host_pc)) {
     case 0:
diff --git a/bsd-user/signal.c b/bsd-user/signal.c
index 1aa0fd79d6..dadcc037dc 100644
--- a/bsd-user/signal.c
+++ b/bsd-user/signal.c
@@ -1030,7 +1030,7 @@ void process_pending_signals(CPUArchState *env)
     ts->in_sigsuspend = false;
 }
 
-void cpu_loop_exit_sigsegv(CPUState *cpu, target_ulong addr,
+void cpu_loop_exit_sigsegv(CPUState *cpu, vaddr addr,
                            MMUAccessType access_type, bool maperr, uintptr_t ra)
 {
     const TCGCPUOps *tcg_ops = cpu->cc->tcg_ops;
@@ -1046,7 +1046,7 @@ void cpu_loop_exit_sigsegv(CPUState *cpu, target_ulong addr,
     cpu_loop_exit_restore(cpu, ra);
 }
 
-void cpu_loop_exit_sigbus(CPUState *cpu, target_ulong addr,
+void cpu_loop_exit_sigbus(CPUState *cpu, vaddr addr,
                           MMUAccessType access_type, uintptr_t ra)
 {
     const TCGCPUOps *tcg_ops = cpu->cc->tcg_ops;
diff --git a/include/user/cpu_loop.h b/include/user/cpu_loop.h
index 589c66543f..ad8a1d711f 100644
--- a/include/user/cpu_loop.h
+++ b/include/user/cpu_loop.h
@@ -20,11 +20,9 @@
 #ifndef USER_CPU_LOOP_H
 #define USER_CPU_LOOP_H
 
-#include "exec/abi_ptr.h"
+#include "exec/vaddr.h"
 #include "exec/mmu-access-type.h"
-#include "exec/log.h"
-#include "exec/target_long.h"
-#include "special-errno.h"
+
 
 /**
  * adjust_signal_pc:
@@ -46,7 +44,7 @@ MMUAccessType adjust_signal_pc(uintptr_t *pc, bool is_write);
  * Return true if the write fault has been handled, and should be re-tried.
  */
 bool handle_sigsegv_accerr_write(CPUState *cpu, sigset_t *old_set,
-                                 uintptr_t host_pc, abi_ptr guest_addr);
+                                 uintptr_t host_pc, vaddr guest_addr);
 
 /**
  * cpu_loop_exit_sigsegv:
@@ -59,7 +57,7 @@ bool handle_sigsegv_accerr_write(CPUState *cpu, sigset_t *old_set,
  * Use the TCGCPUOps hook to record cpu state, do guest operating system
  * specific things to raise SIGSEGV, and jump to the main cpu loop.
  */
-G_NORETURN void cpu_loop_exit_sigsegv(CPUState *cpu, target_ulong addr,
+G_NORETURN void cpu_loop_exit_sigsegv(CPUState *cpu, vaddr addr,
                                       MMUAccessType access_type,
                                       bool maperr, uintptr_t ra);
 
@@ -73,7 +71,7 @@ G_NORETURN void cpu_loop_exit_sigsegv(CPUState *cpu, target_ulong addr,
  * Use the TCGCPUOps hook to record cpu state, do guest operating system
  * specific things to raise SIGBUS, and jump to the main cpu loop.
  */
-G_NORETURN void cpu_loop_exit_sigbus(CPUState *cpu, target_ulong addr,
+G_NORETURN void cpu_loop_exit_sigbus(CPUState *cpu, vaddr addr,
                                      MMUAccessType access_type,
                                      uintptr_t ra);
 
diff --git a/linux-user/signal.c b/linux-user/signal.c
index 4dafc2c3a2..cd0e7398aa 100644
--- a/linux-user/signal.c
+++ b/linux-user/signal.c
@@ -750,7 +750,7 @@ void force_sigsegv(int oldsig)
 }
 #endif
 
-void cpu_loop_exit_sigsegv(CPUState *cpu, target_ulong addr,
+void cpu_loop_exit_sigsegv(CPUState *cpu, vaddr addr,
                            MMUAccessType access_type, bool maperr, uintptr_t ra)
 {
     const TCGCPUOps *tcg_ops = cpu->cc->tcg_ops;
@@ -766,7 +766,7 @@ void cpu_loop_exit_sigsegv(CPUState *cpu, target_ulong addr,
     cpu_loop_exit_restore(cpu, ra);
 }
 
-void cpu_loop_exit_sigbus(CPUState *cpu, target_ulong addr,
+void cpu_loop_exit_sigbus(CPUState *cpu, vaddr addr,
                           MMUAccessType access_type, uintptr_t ra)
 {
     const TCGCPUOps *tcg_ops = cpu->cc->tcg_ops;

From 9b74d403b30e64256b4b94cbc01c76a0382ca5e8 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 30 Apr 2025 16:54:31 -0700
Subject: [PATCH 0642/2760] accel/tcg: Move user-only tlb_vaddr_to_host out of
 line
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

At the same time, fix a mis-match between user and system
by using vaddr not abi_ptr for the address parameter.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/user-exec.c        | 6 ++++++
 include/accel/tcg/cpu-ldst.h | 8 --------
 2 files changed, 6 insertions(+), 8 deletions(-)

diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index e1f4c4eacf..adc5296ba5 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -850,6 +850,12 @@ void *probe_access(CPUArchState *env, vaddr addr, int size,
     return size ? g2h(env_cpu(env), addr) : NULL;
 }
 
+void *tlb_vaddr_to_host(CPUArchState *env, vaddr addr,
+                        MMUAccessType access_type, int mmu_idx)
+{
+    return g2h(env_cpu(env), addr);
+}
+
 tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, vaddr addr,
                                         void **hostp)
 {
diff --git a/include/accel/tcg/cpu-ldst.h b/include/accel/tcg/cpu-ldst.h
index 44a62b54da..00e6419e13 100644
--- a/include/accel/tcg/cpu-ldst.h
+++ b/include/accel/tcg/cpu-ldst.h
@@ -515,15 +515,7 @@ static inline uint64_t cpu_ldq_code(CPUArchState *env, abi_ptr addr)
  * Otherwise (TLB entry is for an I/O access, guest software
  * TLB fill required, etc) return NULL.
  */
-#ifdef CONFIG_USER_ONLY
-static inline void *tlb_vaddr_to_host(CPUArchState *env, abi_ptr addr,
-                                      MMUAccessType access_type, int mmu_idx)
-{
-    return g2h(env_cpu(env), addr);
-}
-#else
 void *tlb_vaddr_to_host(CPUArchState *env, vaddr addr,
                         MMUAccessType access_type, int mmu_idx);
-#endif
 
 #endif /* ACCEL_TCG_CPU_LDST_H */

From a21959a8a835783b556d4a1d18aaa2fad4b7ea62 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 30 Apr 2025 17:09:28 -0700
Subject: [PATCH 0643/2760] accel/tcg: Move tlb_vaddr_to_host declaration to
 probe.h

This is a probing function, not a load/store function.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/accel/tcg/cpu-ldst.h | 16 ----------------
 include/accel/tcg/probe.h    | 16 ++++++++++++++++
 2 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/include/accel/tcg/cpu-ldst.h b/include/accel/tcg/cpu-ldst.h
index 00e6419e13..0de7f5eaa6 100644
--- a/include/accel/tcg/cpu-ldst.h
+++ b/include/accel/tcg/cpu-ldst.h
@@ -502,20 +502,4 @@ static inline uint64_t cpu_ldq_code(CPUArchState *env, abi_ptr addr)
     return cpu_ldq_code_mmu(env, addr, oi, 0);
 }
 
-/**
- * tlb_vaddr_to_host:
- * @env: CPUArchState
- * @addr: guest virtual address to look up
- * @access_type: 0 for read, 1 for write, 2 for execute
- * @mmu_idx: MMU index to use for lookup
- *
- * Look up the specified guest virtual index in the TCG softmmu TLB.
- * If we can translate a host virtual address suitable for direct RAM
- * access, without causing a guest exception, then return it.
- * Otherwise (TLB entry is for an I/O access, guest software
- * TLB fill required, etc) return NULL.
- */
-void *tlb_vaddr_to_host(CPUArchState *env, vaddr addr,
-                        MMUAccessType access_type, int mmu_idx);
-
 #endif /* ACCEL_TCG_CPU_LDST_H */
diff --git a/include/accel/tcg/probe.h b/include/accel/tcg/probe.h
index 177bd1608d..dd9ecbbdf1 100644
--- a/include/accel/tcg/probe.h
+++ b/include/accel/tcg/probe.h
@@ -103,4 +103,20 @@ int probe_access_full_mmu(CPUArchState *env, vaddr addr, int size,
 
 #endif /* !CONFIG_USER_ONLY */
 
+/**
+ * tlb_vaddr_to_host:
+ * @env: CPUArchState
+ * @addr: guest virtual address to look up
+ * @access_type: 0 for read, 1 for write, 2 for execute
+ * @mmu_idx: MMU index to use for lookup
+ *
+ * Look up the specified guest virtual index in the TCG softmmu TLB.
+ * If we can translate a host virtual address suitable for direct RAM
+ * access, without causing a guest exception, then return it.
+ * Otherwise (TLB entry is for an I/O access, guest software
+ * TLB fill required, etc) return NULL.
+ */
+void *tlb_vaddr_to_host(CPUArchState *env, vaddr addr,
+                        MMUAccessType access_type, int mmu_idx);
+
 #endif

From b5555a077f7a2e655b0a4aec9328d70497a7dd65 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 30 Apr 2025 17:17:56 -0700
Subject: [PATCH 0644/2760] accel/tcg: Use target_long_bits() in cputlb.c

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c | 25 +++++++++++++------------
 1 file changed, 13 insertions(+), 12 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index 5b6d6f7975..35c467aace 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -19,6 +19,7 @@
 
 #include "qemu/osdep.h"
 #include "qemu/main-loop.h"
+#include "qemu/target-info.h"
 #include "accel/tcg/cpu-ops.h"
 #include "accel/tcg/iommu.h"
 #include "accel/tcg/probe.h"
@@ -771,19 +772,19 @@ void tlb_flush_range_by_mmuidx(CPUState *cpu, vaddr addr,
 
     assert_cpu_is_self(cpu);
 
+    /* If no page bits are significant, this devolves to tlb_flush. */
+    if (bits < TARGET_PAGE_BITS) {
+        tlb_flush_by_mmuidx(cpu, idxmap);
+        return;
+    }
     /*
      * If all bits are significant, and len is small,
      * this devolves to tlb_flush_page.
      */
-    if (bits >= TARGET_LONG_BITS && len <= TARGET_PAGE_SIZE) {
+    if (len <= TARGET_PAGE_SIZE && bits >= target_long_bits()) {
         tlb_flush_page_by_mmuidx(cpu, addr, idxmap);
         return;
     }
-    /* If no page bits are significant, this devolves to tlb_flush. */
-    if (bits < TARGET_PAGE_BITS) {
-        tlb_flush_by_mmuidx(cpu, idxmap);
-        return;
-    }
 
     /* This should already be page aligned */
     d.addr = addr & TARGET_PAGE_MASK;
@@ -809,19 +810,19 @@ void tlb_flush_range_by_mmuidx_all_cpus_synced(CPUState *src_cpu,
     TLBFlushRangeData d, *p;
     CPUState *dst_cpu;
 
+    /* If no page bits are significant, this devolves to tlb_flush. */
+    if (bits < TARGET_PAGE_BITS) {
+        tlb_flush_by_mmuidx_all_cpus_synced(src_cpu, idxmap);
+        return;
+    }
     /*
      * If all bits are significant, and len is small,
      * this devolves to tlb_flush_page.
      */
-    if (bits >= TARGET_LONG_BITS && len <= TARGET_PAGE_SIZE) {
+    if (len <= TARGET_PAGE_SIZE && bits >= target_long_bits()) {
         tlb_flush_page_by_mmuidx_all_cpus_synced(src_cpu, addr, idxmap);
         return;
     }
-    /* If no page bits are significant, this devolves to tlb_flush. */
-    if (bits < TARGET_PAGE_BITS) {
-        tlb_flush_by_mmuidx_all_cpus_synced(src_cpu, idxmap);
-        return;
-    }
 
     /* This should already be page aligned */
     d.addr = addr & TARGET_PAGE_MASK;

From 4b2de658f13df52ccbf41c3399ab4f7adbcc6080 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 30 Apr 2025 17:26:28 -0700
Subject: [PATCH 0645/2760] accel/tcg: Use vaddr for plugin_{load,store}_cb
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Avoid the use of abi_ptr within ldst_common.c.inc.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/ldst_common.c.inc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/accel/tcg/ldst_common.c.inc b/accel/tcg/ldst_common.c.inc
index 9791a4e9ef..57f3e06192 100644
--- a/accel/tcg/ldst_common.c.inc
+++ b/accel/tcg/ldst_common.c.inc
@@ -123,7 +123,7 @@ void helper_st_i128(CPUArchState *env, uint64_t addr, Int128 val, MemOpIdx oi)
  * Load helpers for cpu_ldst.h
  */
 
-static void plugin_load_cb(CPUArchState *env, abi_ptr addr,
+static void plugin_load_cb(CPUArchState *env, vaddr addr,
                            uint64_t value_low,
                            uint64_t value_high,
                            MemOpIdx oi)
@@ -193,7 +193,7 @@ Int128 cpu_ld16_mmu(CPUArchState *env, vaddr addr,
  * Store helpers for cpu_ldst.h
  */
 
-static void plugin_store_cb(CPUArchState *env, abi_ptr addr,
+static void plugin_store_cb(CPUArchState *env, vaddr addr,
                             uint64_t value_low,
                             uint64_t value_high,
                             MemOpIdx oi)

From 0566f364f79c452af99f437a7784397b03775c72 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 30 Apr 2025 17:31:43 -0700
Subject: [PATCH 0646/2760] accel/tcg: Build cputlb.c once
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c    | 3 ++-
 accel/tcg/meson.build | 5 +----
 2 files changed, 3 insertions(+), 5 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index 35c467aace..5f6d7c601c 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -25,7 +25,8 @@
 #include "accel/tcg/probe.h"
 #include "exec/page-protection.h"
 #include "system/memory.h"
-#include "accel/tcg/cpu-ldst.h"
+#include "accel/tcg/cpu-ldst-common.h"
+#include "accel/tcg/cpu-mmu-index.h"
 #include "exec/cputlb.h"
 #include "exec/tb-flush.h"
 #include "system/ram_addr.h"
diff --git a/accel/tcg/meson.build b/accel/tcg/meson.build
index d6bd304add..9b86051b82 100644
--- a/accel/tcg/meson.build
+++ b/accel/tcg/meson.build
@@ -25,15 +25,12 @@ tcg_specific_ss = ss.source_set()
 tcg_specific_ss.add(when: 'CONFIG_USER_ONLY', if_true: files('user-exec.c'))
 specific_ss.add_all(when: 'CONFIG_TCG', if_true: tcg_specific_ss)
 
-specific_ss.add(when: ['CONFIG_SYSTEM_ONLY', 'CONFIG_TCG'], if_true: files(
-  'cputlb.c',
-))
-
 libuser_ss.add(files(
   'user-exec-stub.c',
 ))
 
 libsystem_ss.add(files(
+  'cputlb.c',
   'icount-common.c',
   'monitor.c',
   'tcg-accel-ops.c',

From 30da476066d6470e1064eb564e348af945a1a656 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 30 Apr 2025 18:07:47 -0700
Subject: [PATCH 0647/2760] include/user: Convert GUEST_ADDR_MAX to a variable

Remove GUEST_ADDR_MAX and add guest_addr_max.
Initialize it in *-user/main.c, after reserved_va.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/user-exec.c     |  4 ++--
 bsd-user/main.c           |  8 ++++++++
 include/user/guest-host.h | 27 +++++++--------------------
 linux-user/main.c         |  8 ++++++++
 4 files changed, 25 insertions(+), 22 deletions(-)

diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index adc5296ba5..f674fd875e 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -500,7 +500,7 @@ void page_set_flags(vaddr start, vaddr last, int flags)
        guest address space.  If this assert fires, it probably indicates
        a missing call to h2g_valid.  */
     assert(start <= last);
-    assert(last <= GUEST_ADDR_MAX);
+    assert(last <= guest_addr_max);
     /* Only set PAGE_ANON with new mappings. */
     assert(!(flags & PAGE_ANON) || (flags & PAGE_RESET));
     assert_memory_lock();
@@ -621,7 +621,7 @@ vaddr page_find_range_empty(vaddr min, vaddr max, vaddr len, vaddr align)
     vaddr len_m1, align_m1;
 
     assert(min <= max);
-    assert(max <= GUEST_ADDR_MAX);
+    assert(max <= guest_addr_max);
     assert(len != 0);
     assert(is_power_of_2(align));
     assert_memory_lock();
diff --git a/bsd-user/main.c b/bsd-user/main.c
index fa7645a56e..603fc80ba7 100644
--- a/bsd-user/main.c
+++ b/bsd-user/main.c
@@ -89,6 +89,7 @@ bool have_guest_base;
 #endif
 
 unsigned long reserved_va;
+unsigned long guest_addr_max;
 
 const char *interp_prefix = CONFIG_QEMU_INTERP_PREFIX;
 const char *qemu_uname_release;
@@ -500,6 +501,13 @@ int main(int argc, char **argv)
         /* MAX_RESERVED_VA + 1 is a large power of 2, so is aligned. */
         reserved_va = max_reserved_va;
     }
+    if (reserved_va != 0) {
+        guest_addr_max = reserved_va;
+    } else if (MIN(TARGET_VIRT_ADDR_SPACE_BITS, TARGET_ABI_BITS) <= 32) {
+        guest_addr_max = UINT32_MAX;
+    } else {
+        guest_addr_max = ~0ul;
+    }
 
     if (getenv("QEMU_STRACE")) {
         do_strace = 1;
diff --git a/include/user/guest-host.h b/include/user/guest-host.h
index 8d2079bbbb..8e10d36948 100644
--- a/include/user/guest-host.h
+++ b/include/user/guest-host.h
@@ -23,23 +23,11 @@
 extern unsigned long reserved_va;
 
 /*
- * Limit the guest addresses as best we can.
- *
- * When not using -R reserved_va, we cannot really limit the guest
- * to less address space than the host.  For 32-bit guests, this
- * acts as a sanity check that we're not giving the guest an address
- * that it cannot even represent.  For 64-bit guests... the address
- * might not be what the real kernel would give, but it is at least
- * representable in the guest.
- *
- * TODO: Improve address allocation to avoid this problem, and to
- * avoid setting bits at the top of guest addresses that might need
- * to be used for tags.
+ * The last byte of the guest address space.
+ * If reserved_va is non-zero, guest_addr_max matches.
+ * If reserved_va is zero, guest_addr_max equals the full guest space.
  */
-#define GUEST_ADDR_MAX_                                                 \
-    ((MIN_CONST(TARGET_VIRT_ADDR_SPACE_BITS, TARGET_ABI_BITS) <= 32) ?  \
-     UINT32_MAX : ~0ul)
-#define GUEST_ADDR_MAX    (reserved_va ? : GUEST_ADDR_MAX_)
+extern unsigned long guest_addr_max;
 
 #ifndef TARGET_TAGGED_ADDRESSES
 static inline abi_ptr cpu_untagged_addr(CPUState *cs, abi_ptr x)
@@ -61,17 +49,16 @@ static inline void *g2h(CPUState *cs, abi_ptr x)
 
 static inline bool guest_addr_valid_untagged(abi_ulong x)
 {
-    return x <= GUEST_ADDR_MAX;
+    return x <= guest_addr_max;
 }
 
 static inline bool guest_range_valid_untagged(abi_ulong start, abi_ulong len)
 {
-    return len - 1 <= GUEST_ADDR_MAX && start <= GUEST_ADDR_MAX - len + 1;
+    return len - 1 <= guest_addr_max && start <= guest_addr_max - len + 1;
 }
 
 #define h2g_valid(x) \
-    (HOST_LONG_BITS <= TARGET_VIRT_ADDR_SPACE_BITS || \
-     (uintptr_t)(x) - guest_base <= GUEST_ADDR_MAX)
+    ((uintptr_t)(x) - guest_base <= guest_addr_max)
 
 #define h2g_nocheck(x) ({ \
     uintptr_t __ret = (uintptr_t)(x) - guest_base; \
diff --git a/linux-user/main.c b/linux-user/main.c
index 4af7f49f38..5ac5b55dc6 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -122,6 +122,7 @@ static const char *last_log_filename;
 #endif
 
 unsigned long reserved_va;
+unsigned long guest_addr_max;
 
 static void usage(int exitcode);
 
@@ -858,6 +859,13 @@ int main(int argc, char **argv, char **envp)
         /* MAX_RESERVED_VA + 1 is a large power of 2, so is aligned. */
         reserved_va = max_reserved_va;
     }
+    if (reserved_va != 0) {
+        guest_addr_max = reserved_va;
+    } else if (MIN(TARGET_VIRT_ADDR_SPACE_BITS, TARGET_ABI_BITS) <= 32) {
+        guest_addr_max = UINT32_MAX;
+    } else {
+        guest_addr_max = ~0ul;
+    }
 
     /*
      * Temporarily disable

From 7804c84a56f9265813eb87db0bdae063279af030 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 30 Apr 2025 18:20:04 -0700
Subject: [PATCH 0648/2760] include/user: Use vaddr in guest-host.h

Replace abi_ptr and abi_ulong with vaddr.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/user/guest-host.h | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/include/user/guest-host.h b/include/user/guest-host.h
index 8e10d36948..0656f2e356 100644
--- a/include/user/guest-host.h
+++ b/include/user/guest-host.h
@@ -8,7 +8,7 @@
 #ifndef USER_GUEST_HOST_H
 #define USER_GUEST_HOST_H
 
-#include "user/abitypes.h"
+#include "exec/vaddr.h"
 #include "user/guest-base.h"
 #include "cpu.h"
 
@@ -30,29 +30,29 @@ extern unsigned long reserved_va;
 extern unsigned long guest_addr_max;
 
 #ifndef TARGET_TAGGED_ADDRESSES
-static inline abi_ptr cpu_untagged_addr(CPUState *cs, abi_ptr x)
+static inline vaddr cpu_untagged_addr(CPUState *cs, vaddr x)
 {
     return x;
 }
 #endif
 
 /* All direct uses of g2h and h2g need to go away for usermode softmmu.  */
-static inline void *g2h_untagged(abi_ptr x)
+static inline void *g2h_untagged(vaddr x)
 {
     return (void *)((uintptr_t)(x) + guest_base);
 }
 
-static inline void *g2h(CPUState *cs, abi_ptr x)
+static inline void *g2h(CPUState *cs, vaddr x)
 {
     return g2h_untagged(cpu_untagged_addr(cs, x));
 }
 
-static inline bool guest_addr_valid_untagged(abi_ulong x)
+static inline bool guest_addr_valid_untagged(vaddr x)
 {
     return x <= guest_addr_max;
 }
 
-static inline bool guest_range_valid_untagged(abi_ulong start, abi_ulong len)
+static inline bool guest_range_valid_untagged(vaddr start, vaddr len)
 {
     return len - 1 <= guest_addr_max && start <= guest_addr_max - len + 1;
 }
@@ -62,7 +62,7 @@ static inline bool guest_range_valid_untagged(abi_ulong start, abi_ulong len)
 
 #define h2g_nocheck(x) ({ \
     uintptr_t __ret = (uintptr_t)(x) - guest_base; \
-    (abi_ptr)__ret; \
+    (vaddr)__ret; \
 })
 
 #define h2g(x) ({ \

From 2c0b261fcd259f0e027633c744d279d255b4ff49 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 30 Apr 2025 18:46:41 -0700
Subject: [PATCH 0649/2760] accel/tcg: Move TARGET_TAGGED_ADDRESSES to
 TCGCPUOps.untagged_addr

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/accel/tcg/cpu-ops.h |  7 +++++++
 include/user/guest-host.h   |  8 +++++---
 target/arm/cpu-param.h      |  7 +------
 target/arm/cpu.c            | 27 ++++++++++++++++++++++++++-
 target/arm/cpu.h            | 32 +-------------------------------
 5 files changed, 40 insertions(+), 41 deletions(-)

diff --git a/include/accel/tcg/cpu-ops.h b/include/accel/tcg/cpu-ops.h
index 23cd6af0b2..cd22e5d5b9 100644
--- a/include/accel/tcg/cpu-ops.h
+++ b/include/accel/tcg/cpu-ops.h
@@ -157,6 +157,13 @@ struct TCGCPUOps {
      */
     void (*record_sigbus)(CPUState *cpu, vaddr addr,
                           MMUAccessType access_type, uintptr_t ra);
+
+    /**
+     * untagged_addr: Remove an ignored tag from an address
+     * @cpu: cpu context
+     * @addr: tagged guest address
+     */
+    vaddr (*untagged_addr)(CPUState *cs, vaddr addr);
 #else
     /** @do_interrupt: Callback for interrupt handling.  */
     void (*do_interrupt)(CPUState *cpu);
diff --git a/include/user/guest-host.h b/include/user/guest-host.h
index 0656f2e356..8f7ef75896 100644
--- a/include/user/guest-host.h
+++ b/include/user/guest-host.h
@@ -10,7 +10,7 @@
 
 #include "exec/vaddr.h"
 #include "user/guest-base.h"
-#include "cpu.h"
+#include "accel/tcg/cpu-ops.h"
 
 /*
  * If non-zero, the guest virtual address space is a contiguous subset
@@ -29,12 +29,14 @@ extern unsigned long reserved_va;
  */
 extern unsigned long guest_addr_max;
 
-#ifndef TARGET_TAGGED_ADDRESSES
 static inline vaddr cpu_untagged_addr(CPUState *cs, vaddr x)
 {
+    const TCGCPUOps *tcg_ops = cs->cc->tcg_ops;
+    if (tcg_ops->untagged_addr) {
+        return tcg_ops->untagged_addr(cs, x);
+    }
     return x;
 }
-#endif
 
 /* All direct uses of g2h and h2g need to go away for usermode softmmu.  */
 static inline void *g2h_untagged(vaddr x)
diff --git a/target/arm/cpu-param.h b/target/arm/cpu-param.h
index 5c5bc8a009..8b46c7c570 100644
--- a/target/arm/cpu-param.h
+++ b/target/arm/cpu-param.h
@@ -17,14 +17,9 @@
 #endif
 
 #ifdef CONFIG_USER_ONLY
-# ifdef TARGET_AARCH64
-#  define TARGET_TAGGED_ADDRESSES
-# ifdef __FreeBSD__
-#  define TARGET_PAGE_BITS 12
-# else
+# if defined(TARGET_AARCH64) && defined(CONFIG_LINUX)
 /* Allow user-only to vary page size from 4k */
 #  define TARGET_PAGE_BITS_VARY
-# endif
 # else
 #  define TARGET_PAGE_BITS 12
 # endif
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index 2020aec54a..45cb6fd7ee 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -2671,7 +2671,31 @@ static const char *arm_gdb_get_core_xml_file(CPUState *cs)
     return "arm-core.xml";
 }
 
-#ifndef CONFIG_USER_ONLY
+#ifdef CONFIG_USER_ONLY
+/**
+ * aarch64_untagged_addr:
+ *
+ * Remove any address tag from @x.  This is explicitly related to the
+ * linux syscall TIF_TAGGED_ADDR setting, not TBI in general.
+ *
+ * There should be a better place to put this, but we need this in
+ * include/exec/cpu_ldst.h, and not some place linux-user specific.
+ *
+ * Note that arm-*-user will never set tagged_addr_enable.
+ */
+static vaddr aarch64_untagged_addr(CPUState *cs, vaddr x)
+{
+    CPUARMState *env = cpu_env(cs);
+    if (env->tagged_addr_enable) {
+        /*
+         * TBI is enabled for userspace but not kernelspace addresses.
+         * Only clear the tag if bit 55 is clear.
+         */
+        x &= sextract64(x, 0, 56);
+    }
+    return x;
+}
+#else
 #include "hw/core/sysemu-cpu-ops.h"
 
 static const struct SysemuCPUOps arm_sysemu_ops = {
@@ -2702,6 +2726,7 @@ static const TCGCPUOps arm_tcg_ops = {
 #ifdef CONFIG_USER_ONLY
     .record_sigsegv = arm_cpu_record_sigsegv,
     .record_sigbus = arm_cpu_record_sigbus,
+    .untagged_addr = aarch64_untagged_addr,
 #else
     .tlb_fill_align = arm_cpu_tlb_fill_align,
     .cpu_exec_interrupt = arm_cpu_exec_interrupt,
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index be4449ca06..23720b2b17 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -783,12 +783,9 @@ typedef struct CPUArchState {
 #else /* CONFIG_USER_ONLY */
     /* For usermode syscall translation.  */
     bool eabi;
-#endif /* CONFIG_USER_ONLY */
-
-#ifdef TARGET_TAGGED_ADDRESSES
     /* Linux syscall tagged address support */
     bool tagged_addr_enable;
-#endif
+#endif /* CONFIG_USER_ONLY */
 } CPUARMState;
 
 static inline void set_feature(CPUARMState *env, int feature)
@@ -3217,34 +3214,7 @@ extern const uint64_t pred_esz_masks[5];
 #define TAG_GRANULE      (1 << LOG2_TAG_GRANULE)
 
 #ifdef CONFIG_USER_ONLY
-
 #define TARGET_PAGE_DATA_SIZE (TARGET_PAGE_SIZE >> (LOG2_TAG_GRANULE + 1))
-
-#ifdef TARGET_TAGGED_ADDRESSES
-/**
- * cpu_untagged_addr:
- * @cs: CPU context
- * @x: tagged address
- *
- * Remove any address tag from @x.  This is explicitly related to the
- * linux syscall TIF_TAGGED_ADDR setting, not TBI in general.
- *
- * There should be a better place to put this, but we need this in
- * include/exec/cpu_ldst.h, and not some place linux-user specific.
- */
-static inline target_ulong cpu_untagged_addr(CPUState *cs, target_ulong x)
-{
-    CPUARMState *env = cpu_env(cs);
-    if (env->tagged_addr_enable) {
-        /*
-         * TBI is enabled for userspace but not kernelspace addresses.
-         * Only clear the tag if bit 55 is clear.
-         */
-        x &= sextract64(x, 0, 56);
-    }
-    return x;
-}
-#endif /* TARGET_TAGGED_ADDRESSES */
 #endif /* CONFIG_USER_ONLY */
 
 #endif

From 964080d3563f1211b70051c8ea5add752586da09 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 30 Apr 2025 20:23:59 -0700
Subject: [PATCH 0650/2760] accel/tcg: Remove TARGET_PAGE_DATA_SIZE

This macro is used by only one target, and even then under
unusual conditions -- AArch64 with mmap's PROT_MTE flag.

Since page size for aarch64-linux-user is variable, the
per-page data size is also variable.
Since page_reset_target_data via target_munmap does not
have ready access to CPUState, simply pass in the size
from the first allocation and remember that.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/user-exec.c          | 26 ++++++++++++++++----------
 include/user/page-protection.h |  8 +++++---
 target/arm/cpu.h               |  4 ----
 target/arm/tcg/mte_helper.c    |  4 ++--
 4 files changed, 23 insertions(+), 19 deletions(-)

diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index f674fd875e..46b1e97c30 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -870,7 +870,6 @@ tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, vaddr addr,
     return addr;
 }
 
-#ifdef TARGET_PAGE_DATA_SIZE
 /*
  * Allocate chunks of target data together.  For the only current user,
  * if we allocate one hunk per page, we have overhead of 40/128 or 40%.
@@ -886,10 +885,16 @@ typedef struct TargetPageDataNode {
 } TargetPageDataNode;
 
 static IntervalTreeRoot targetdata_root;
+static size_t target_page_data_size;
 
 void page_reset_target_data(vaddr start, vaddr last)
 {
     IntervalTreeNode *n, *next;
+    size_t size = target_page_data_size;
+
+    if (likely(size == 0)) {
+        return;
+    }
 
     assert_memory_lock();
 
@@ -920,17 +925,22 @@ void page_reset_target_data(vaddr start, vaddr last)
         n_last = MIN(last, n->last);
         p_len = (n_last + 1 - n_start) >> TARGET_PAGE_BITS;
 
-        memset(t->data + p_ofs * TARGET_PAGE_DATA_SIZE, 0,
-               p_len * TARGET_PAGE_DATA_SIZE);
+        memset(t->data + p_ofs * size, 0, p_len * size);
     }
 }
 
-void *page_get_target_data(vaddr address)
+void *page_get_target_data(vaddr address, size_t size)
 {
     IntervalTreeNode *n;
     TargetPageDataNode *t;
     vaddr page, region, p_ofs;
 
+    /* Remember the size from the first call, and it should be constant. */
+    if (unlikely(target_page_data_size != size)) {
+        assert(target_page_data_size == 0);
+        target_page_data_size = size;
+    }
+
     page = address & TARGET_PAGE_MASK;
     region = address & TBD_MASK;
 
@@ -945,8 +955,7 @@ void *page_get_target_data(vaddr address)
         mmap_lock();
         n = interval_tree_iter_first(&targetdata_root, page, page);
         if (!n) {
-            t = g_malloc0(sizeof(TargetPageDataNode)
-                          + TPD_PAGES * TARGET_PAGE_DATA_SIZE);
+            t = g_malloc0(sizeof(TargetPageDataNode) + TPD_PAGES * size);
             n = &t->itree;
             n->start = region;
             n->last = region | ~TBD_MASK;
@@ -957,11 +966,8 @@ void *page_get_target_data(vaddr address)
 
     t = container_of(n, TargetPageDataNode, itree);
     p_ofs = (page - region) >> TARGET_PAGE_BITS;
-    return t->data + p_ofs * TARGET_PAGE_DATA_SIZE;
+    return t->data + p_ofs * size;
 }
-#else
-void page_reset_target_data(vaddr start, vaddr last) { }
-#endif /* TARGET_PAGE_DATA_SIZE */
 
 /* The system-mode versions of these helpers are in cputlb.c.  */
 
diff --git a/include/user/page-protection.h b/include/user/page-protection.h
index 86143212fd..4bde664e4a 100644
--- a/include/user/page-protection.h
+++ b/include/user/page-protection.h
@@ -73,18 +73,20 @@ bool page_check_range_empty(vaddr start, vaddr last);
 vaddr page_find_range_empty(vaddr min, vaddr max, vaddr len, vaddr align);
 
 /**
- * page_get_target_data(address)
+ * page_get_target_data
  * @address: guest virtual address
+ * @size: per-page size
  *
- * Return TARGET_PAGE_DATA_SIZE bytes of out-of-band data to associate
+ * Return @size bytes of out-of-band data to associate
  * with the guest page at @address, allocating it if necessary.  The
  * caller should already have verified that the address is valid.
+ * The value of @size must be the same for every call.
  *
  * The memory will be freed when the guest page is deallocated,
  * e.g. with the munmap system call.
  */
 __attribute__((returns_nonnull))
-void *page_get_target_data(vaddr address);
+void *page_get_target_data(vaddr address, size_t size);
 
 typedef int (*walk_memory_regions_fn)(void *, vaddr, vaddr, int);
 int walk_memory_regions(void *, walk_memory_regions_fn);
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index 23720b2b17..6ed6409cb7 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -3213,8 +3213,4 @@ extern const uint64_t pred_esz_masks[5];
 #define LOG2_TAG_GRANULE 4
 #define TAG_GRANULE      (1 << LOG2_TAG_GRANULE)
 
-#ifdef CONFIG_USER_ONLY
-#define TARGET_PAGE_DATA_SIZE (TARGET_PAGE_SIZE >> (LOG2_TAG_GRANULE + 1))
-#endif /* CONFIG_USER_ONLY */
-
 #endif
diff --git a/target/arm/tcg/mte_helper.c b/target/arm/tcg/mte_helper.c
index 13d7ac0097..0efc18a181 100644
--- a/target/arm/tcg/mte_helper.c
+++ b/target/arm/tcg/mte_helper.c
@@ -37,7 +37,6 @@
 #include "qemu/guest-random.h"
 #include "mte_helper.h"
 
-
 static int choose_nonexcluded_tag(int tag, int offset, uint16_t exclude)
 {
     if (exclude == 0xffff) {
@@ -63,6 +62,7 @@ uint8_t *allocation_tag_mem_probe(CPUARMState *env, int ptr_mmu_idx,
                                   bool probe, uintptr_t ra)
 {
 #ifdef CONFIG_USER_ONLY
+    const size_t page_data_size = TARGET_PAGE_SIZE >> (LOG2_TAG_GRANULE + 1);
     uint64_t clean_ptr = useronly_clean_ptr(ptr);
     int flags = page_get_flags(clean_ptr);
     uint8_t *tags;
@@ -83,7 +83,7 @@ uint8_t *allocation_tag_mem_probe(CPUARMState *env, int ptr_mmu_idx,
         return NULL;
     }
 
-    tags = page_get_target_data(clean_ptr);
+    tags = page_get_target_data(clean_ptr, page_data_size);
 
     index = extract32(ptr, LOG2_TAG_GRANULE + 1,
                       TARGET_PAGE_BITS - LOG2_TAG_GRANULE - 1);

From 03c981e7d63eaa03e6b7c4b9ef59b45b0b985876 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 30 Apr 2025 20:30:22 -0700
Subject: [PATCH 0651/2760] accel/tcg: Avoid abi_ptr in user-exec.c

In page_dump/dump_region, use guest_addr_max to check the
size of the guest address space and size the output
appropriately.  This will change output with small values
of -R reserved_va, but shouldn't affect anything else.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/user-exec.c | 22 ++++++++++++++++------
 1 file changed, 16 insertions(+), 6 deletions(-)

diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index 46b1e97c30..085da0c036 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -29,6 +29,7 @@
 #include "accel/tcg/helper-retaddr.h"
 #include "accel/tcg/probe.h"
 #include "user/cpu_loop.h"
+#include "user/guest-host.h"
 #include "qemu/main-loop.h"
 #include "user/page-protection.h"
 #include "exec/page-protection.h"
@@ -202,10 +203,19 @@ int walk_memory_regions(void *priv, walk_memory_regions_fn fn)
 static int dump_region(void *opaque, vaddr start, vaddr end, int prot)
 {
     FILE *f = opaque;
+    uint64_t mask;
+    int width;
 
-    fprintf(f, TARGET_ABI_FMT_ptr "-" TARGET_ABI_FMT_ptr
-            " " TARGET_ABI_FMT_ptr " %c%c%c\n",
-            (abi_ptr)start, (abi_ptr)end, (abi_ptr)(end - start),
+    if (guest_addr_max <= UINT32_MAX) {
+        mask = UINT32_MAX, width = 8;
+    } else {
+        mask = UINT64_MAX, width = 16;
+    }
+
+    fprintf(f, "%0*" PRIx64 "-%0*" PRIx64 " %0*" PRIx64 " %c%c%c\n",
+            width, start & mask,
+            width, end & mask,
+            width, (end - start) & mask,
             ((prot & PAGE_READ) ? 'r' : '-'),
             ((prot & PAGE_WRITE) ? 'w' : '-'),
             ((prot & PAGE_EXEC) ? 'x' : '-'));
@@ -215,10 +225,10 @@ static int dump_region(void *opaque, vaddr start, vaddr end, int prot)
 /* dump memory mappings */
 void page_dump(FILE *f)
 {
-    const int length = sizeof(abi_ptr) * 2;
+    int width = guest_addr_max <= UINT32_MAX ? 8 : 16;
 
     fprintf(f, "%-*s %-*s %-*s %s\n",
-            length, "start", length, "end", length, "size", "prot");
+            width, "start", width, "end", width, "size", "prot");
     walk_memory_regions(f, dump_region);
 }
 
@@ -1135,7 +1145,7 @@ static uint64_t do_ld8_mmu(CPUState *cpu, vaddr addr, MemOpIdx oi,
     return ret;
 }
 
-static Int128 do_ld16_mmu(CPUState *cpu, abi_ptr addr,
+static Int128 do_ld16_mmu(CPUState *cpu, vaddr addr,
                           MemOpIdx oi, uintptr_t ra)
 {
     void *haddr;

From 768cb76d14f1a50c00d60fbb1d393996c76645d8 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 30 Apr 2025 20:31:10 -0700
Subject: [PATCH 0652/2760] accel/tcg: Build user-exec.c once

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/meson.build | 5 +----
 accel/tcg/user-exec.c | 5 ++---
 2 files changed, 3 insertions(+), 7 deletions(-)

diff --git a/accel/tcg/meson.build b/accel/tcg/meson.build
index 9b86051b82..d6f533f9a1 100644
--- a/accel/tcg/meson.build
+++ b/accel/tcg/meson.build
@@ -21,11 +21,8 @@ endif
 libuser_ss.add_all(tcg_ss)
 libsystem_ss.add_all(tcg_ss)
 
-tcg_specific_ss = ss.source_set()
-tcg_specific_ss.add(when: 'CONFIG_USER_ONLY', if_true: files('user-exec.c'))
-specific_ss.add_all(when: 'CONFIG_TCG', if_true: tcg_specific_ss)
-
 libuser_ss.add(files(
+  'user-exec.c',
   'user-exec-stub.c',
 ))
 
diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index 085da0c036..f25d80e2dc 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -19,13 +19,12 @@
 #include "qemu/osdep.h"
 #include "accel/tcg/cpu-ops.h"
 #include "disas/disas.h"
-#include "cpu.h"
 #include "exec/vaddr.h"
 #include "exec/tlb-flags.h"
 #include "tcg/tcg.h"
 #include "qemu/bitops.h"
 #include "qemu/rcu.h"
-#include "accel/tcg/cpu-ldst.h"
+#include "accel/tcg/cpu-ldst-common.h"
 #include "accel/tcg/helper-retaddr.h"
 #include "accel/tcg/probe.h"
 #include "user/cpu_loop.h"
@@ -33,7 +32,7 @@
 #include "qemu/main-loop.h"
 #include "user/page-protection.h"
 #include "exec/page-protection.h"
-#include "exec/helper-proto.h"
+#include "exec/helper-proto-common.h"
 #include "qemu/atomic128.h"
 #include "qemu/bswap.h"
 #include "qemu/int128.h"

From 36ad84ecb26d6a28c78d079dc51063d972600592 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Fri, 7 Mar 2025 09:34:41 +0800
Subject: [PATCH 0653/2760] hw/intc/loongarch_ipi: Add reset support

Add reset support with ipi object, register reset callback and clear
internal registers when virt machine resets.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
---
 hw/intc/loongarch_ipi.c         | 29 +++++++++++++++++++++++++++++
 include/hw/intc/loongarch_ipi.h |  1 +
 2 files changed, 30 insertions(+)

diff --git a/hw/intc/loongarch_ipi.c b/hw/intc/loongarch_ipi.c
index 2f8bb57828..74372a2039 100644
--- a/hw/intc/loongarch_ipi.c
+++ b/hw/intc/loongarch_ipi.c
@@ -93,6 +93,32 @@ static void loongarch_ipi_realize(DeviceState *dev, Error **errp)
     }
 }
 
+static void loongarch_ipi_reset_hold(Object *obj, ResetType type)
+{
+    int i;
+    LoongarchIPIClass *lic = LOONGARCH_IPI_GET_CLASS(obj);
+    LoongsonIPICommonState *lics = LOONGSON_IPI_COMMON(obj);
+    IPICore *core;
+
+    if (lic->parent_phases.hold) {
+        lic->parent_phases.hold(obj, type);
+    }
+
+    for (i = 0; i < lics->num_cpu; i++) {
+        core = lics->cpu + i;
+        /* IPI with targeted CPU available however not present */
+        if (!core->cpu) {
+            continue;
+        }
+
+        core->status = 0;
+        core->en = 0;
+        core->set = 0;
+        core->clear = 0;
+        memset(core->buf, 0, sizeof(core->buf));
+    }
+}
+
 static void loongarch_ipi_cpu_plug(HotplugHandler *hotplug_dev,
                                    DeviceState *dev, Error **errp)
 {
@@ -145,10 +171,13 @@ static void loongarch_ipi_class_init(ObjectClass *klass, const void *data)
     LoongsonIPICommonClass *licc = LOONGSON_IPI_COMMON_CLASS(klass);
     HotplugHandlerClass *hc = HOTPLUG_HANDLER_CLASS(klass);
     LoongarchIPIClass *lic = LOONGARCH_IPI_CLASS(klass);
+    ResettableClass *rc = RESETTABLE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
 
     device_class_set_parent_realize(dc, loongarch_ipi_realize,
                                     &lic->parent_realize);
+    resettable_class_set_parent_phases(rc, NULL, loongarch_ipi_reset_hold,
+                                       NULL, &lic->parent_phases);
     licc->get_iocsr_as = get_iocsr_as;
     licc->cpu_by_arch_id = loongarch_cpu_by_arch_id;
     hc->plug = loongarch_ipi_cpu_plug;
diff --git a/include/hw/intc/loongarch_ipi.h b/include/hw/intc/loongarch_ipi.h
index 923bf21ecb..a7c6bf85d3 100644
--- a/include/hw/intc/loongarch_ipi.h
+++ b/include/hw/intc/loongarch_ipi.h
@@ -21,6 +21,7 @@ struct LoongarchIPIState {
 struct LoongarchIPIClass {
     LoongsonIPICommonClass parent_class;
     DeviceRealize parent_realize;
+    ResettablePhases parent_phases;
 };
 
 #endif

From 86e4a64751a728aae24fa95d76d6c313aa82cf82 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Fri, 7 Mar 2025 10:12:09 +0800
Subject: [PATCH 0654/2760] hw/intc/loongarch_extioi: Add reset support

Add reset support with extioi irqchip, and register reset callback
support with new API resettable_class_set_parent_phases(). Clear
internal HW registers and SW state when virt machine resets.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
---
 hw/intc/loongarch_extioi_common.c         | 41 +++++++++++++++++++++++
 include/hw/intc/loongarch_extioi_common.h |  1 +
 2 files changed, 42 insertions(+)

diff --git a/hw/intc/loongarch_extioi_common.c b/hw/intc/loongarch_extioi_common.c
index 9e1589060c..4a904b3bc1 100644
--- a/hw/intc/loongarch_extioi_common.c
+++ b/hw/intc/loongarch_extioi_common.c
@@ -108,6 +108,43 @@ static void loongarch_extioi_common_realize(DeviceState *dev, Error **errp)
     }
 }
 
+static void loongarch_extioi_common_reset_hold(Object *obj, ResetType type)
+{
+    LoongArchExtIOICommonClass *lecc = LOONGARCH_EXTIOI_COMMON_GET_CLASS(obj);
+    LoongArchExtIOICommonState *s = LOONGARCH_EXTIOI_COMMON(obj);
+    ExtIOICore *core;
+    int i;
+
+    if (lecc->parent_phases.hold) {
+        lecc->parent_phases.hold(obj, type);
+    }
+
+    /* Clear HW registers for the board */
+    memset(s->nodetype, 0, sizeof(s->nodetype));
+    memset(s->bounce, 0, sizeof(s->bounce));
+    memset(s->isr, 0, sizeof(s->isr));
+    memset(s->enable, 0, sizeof(s->enable));
+    memset(s->ipmap, 0, sizeof(s->ipmap));
+    memset(s->coremap, 0, sizeof(s->coremap));
+    memset(s->sw_pending, 0, sizeof(s->sw_pending));
+    memset(s->sw_ipmap, 0, sizeof(s->sw_ipmap));
+    memset(s->sw_coremap, 0, sizeof(s->sw_coremap));
+
+    for (i = 0; i < s->num_cpu; i++) {
+        core = s->cpu + i;
+        /* EXTIOI with targeted CPU available however not present */
+        if (!core->cpu) {
+            continue;
+        }
+
+        /* Clear HW registers for CPUs */
+        memset(core->coreisr, 0, sizeof(core->coreisr));
+        memset(core->sw_isr, 0, sizeof(core->sw_isr));
+    }
+
+    s->status = 0;
+}
+
 static int loongarch_extioi_common_pre_save(void *opaque)
 {
     LoongArchExtIOICommonState *s = (LoongArchExtIOICommonState *)opaque;
@@ -180,9 +217,13 @@ static void loongarch_extioi_common_class_init(ObjectClass *klass,
     DeviceClass *dc = DEVICE_CLASS(klass);
     LoongArchExtIOICommonClass *lecc = LOONGARCH_EXTIOI_COMMON_CLASS(klass);
     HotplugHandlerClass *hc = HOTPLUG_HANDLER_CLASS(klass);
+    ResettableClass *rc = RESETTABLE_CLASS(klass);
 
     device_class_set_parent_realize(dc, loongarch_extioi_common_realize,
                                     &lecc->parent_realize);
+    resettable_class_set_parent_phases(rc, NULL,
+                                       loongarch_extioi_common_reset_hold,
+                                       NULL, &lecc->parent_phases);
     device_class_set_props(dc, extioi_properties);
     dc->vmsd = &vmstate_loongarch_extioi;
     hc->plug = loongarch_extioi_cpu_plug;
diff --git a/include/hw/intc/loongarch_extioi_common.h b/include/hw/intc/loongarch_extioi_common.h
index 22d7880977..735bfee80a 100644
--- a/include/hw/intc/loongarch_extioi_common.h
+++ b/include/hw/intc/loongarch_extioi_common.h
@@ -94,6 +94,7 @@ struct LoongArchExtIOICommonClass {
     SysBusDeviceClass parent_class;
 
     DeviceRealize parent_realize;
+    ResettablePhases parent_phases;
     int (*pre_save)(void *s);
     int (*post_load)(void *s, int version_id);
 };

From bba709ff694cc6f844ca32d333b6be7adc7bd6b4 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Fri, 7 Mar 2025 10:23:21 +0800
Subject: [PATCH 0655/2760] hw/intc/loongarch_extioi: Replace legacy reset
 callback with new api

Replace legacy reset callback register device_class_set_legacy_reset()
with new function resettable_class_set_parent_phases(). With new API,
it will call reset callback of parent object and then itself.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
---
 hw/intc/loongarch_extioi.c         | 12 ++++++++----
 include/hw/intc/loongarch_extioi.h |  1 +
 2 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/hw/intc/loongarch_extioi.c b/hw/intc/loongarch_extioi.c
index f4fe961a98..7c38c4c9b7 100644
--- a/hw/intc/loongarch_extioi.c
+++ b/hw/intc/loongarch_extioi.c
@@ -377,11 +377,13 @@ static void loongarch_extioi_unrealize(DeviceState *dev)
     g_free(s->cpu);
 }
 
-static void loongarch_extioi_reset(DeviceState *d)
+static void loongarch_extioi_reset_hold(Object *obj, ResetType type)
 {
-    LoongArchExtIOICommonState *s = LOONGARCH_EXTIOI_COMMON(d);
+    LoongArchExtIOIClass *lec = LOONGARCH_EXTIOI_GET_CLASS(obj);
 
-    s->status = 0;
+    if (lec->parent_phases.hold) {
+        lec->parent_phases.hold(obj, type);
+    }
 }
 
 static int vmstate_extioi_post_load(void *opaque, int version_id)
@@ -406,12 +408,14 @@ static void loongarch_extioi_class_init(ObjectClass *klass, const void *data)
     DeviceClass *dc = DEVICE_CLASS(klass);
     LoongArchExtIOIClass *lec = LOONGARCH_EXTIOI_CLASS(klass);
     LoongArchExtIOICommonClass *lecc = LOONGARCH_EXTIOI_COMMON_CLASS(klass);
+    ResettableClass *rc = RESETTABLE_CLASS(klass);
 
     device_class_set_parent_realize(dc, loongarch_extioi_realize,
                                     &lec->parent_realize);
     device_class_set_parent_unrealize(dc, loongarch_extioi_unrealize,
                                       &lec->parent_unrealize);
-    device_class_set_legacy_reset(dc, loongarch_extioi_reset);
+    resettable_class_set_parent_phases(rc, NULL, loongarch_extioi_reset_hold,
+                                       NULL, &lec->parent_phases);
     lecc->post_load = vmstate_extioi_post_load;
 }
 
diff --git a/include/hw/intc/loongarch_extioi.h b/include/hw/intc/loongarch_extioi.h
index 351f18afcf..4a6ae903e9 100644
--- a/include/hw/intc/loongarch_extioi.h
+++ b/include/hw/intc/loongarch_extioi.h
@@ -22,6 +22,7 @@ struct LoongArchExtIOIClass {
 
     DeviceRealize parent_realize;
     DeviceUnrealize parent_unrealize;
+    ResettablePhases parent_phases;
 };
 
 #endif /* LOONGARCH_EXTIOI_H */

From 5101435e6d784c6d5bb267ca019b721a028dbc47 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Fri, 7 Mar 2025 11:57:31 +0800
Subject: [PATCH 0656/2760] hw/intc/loongarch_pch: Add reset support

Add reset support with LoongArch pci irqchip, and register reset
callback support with new API resettable_class_set_parent_phases().
Clear internal HW registers and SW state when virt machine resets.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
---
 hw/intc/loongarch_pic_common.c         | 25 +++++++++++++++++++++++++
 include/hw/intc/loongarch_pic_common.h |  1 +
 2 files changed, 26 insertions(+)

diff --git a/hw/intc/loongarch_pic_common.c b/hw/intc/loongarch_pic_common.c
index fdb250c418..6dccacc741 100644
--- a/hw/intc/loongarch_pic_common.c
+++ b/hw/intc/loongarch_pic_common.c
@@ -44,6 +44,27 @@ static void loongarch_pic_common_realize(DeviceState *dev, Error **errp)
     }
 }
 
+static void loongarch_pic_common_reset_hold(Object *obj, ResetType type)
+{
+    LoongArchPICCommonState *s = LOONGARCH_PIC_COMMON(obj);
+    int i;
+
+    s->int_mask = UINT64_MAX;
+    s->htmsi_en = 0x0;
+    s->intedge  = 0x0;
+    s->intclr   = 0x0;
+    s->auto_crtl0 = 0x0;
+    s->auto_crtl1 = 0x0;
+    for (i = 0; i < 64; i++) {
+        s->route_entry[i] = 0x1;
+        s->htmsi_vector[i] = 0x0;
+    }
+    s->intirr = 0x0;
+    s->intisr = 0x0;
+    s->last_intirr = 0x0;
+    s->int_polarity = 0x0;
+}
+
 static const Property loongarch_pic_common_properties[] = {
     DEFINE_PROP_UINT32("pch_pic_irq_num", LoongArchPICCommonState, irq_num, 0),
 };
@@ -76,9 +97,13 @@ static void loongarch_pic_common_class_init(ObjectClass *klass,
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     LoongArchPICCommonClass *lpcc = LOONGARCH_PIC_COMMON_CLASS(klass);
+    ResettableClass *rc = RESETTABLE_CLASS(klass);
 
     device_class_set_parent_realize(dc, loongarch_pic_common_realize,
                                     &lpcc->parent_realize);
+    resettable_class_set_parent_phases(rc, NULL,
+                                       loongarch_pic_common_reset_hold,
+                                       NULL, &lpcc->parent_phases);
     device_class_set_props(dc, loongarch_pic_common_properties);
     dc->vmsd = &vmstate_loongarch_pic_common;
 }
diff --git a/include/hw/intc/loongarch_pic_common.h b/include/hw/intc/loongarch_pic_common.h
index 43cce48978..d301377cd7 100644
--- a/include/hw/intc/loongarch_pic_common.h
+++ b/include/hw/intc/loongarch_pic_common.h
@@ -76,6 +76,7 @@ struct LoongArchPICCommonClass {
     SysBusDeviceClass parent_class;
 
     DeviceRealize parent_realize;
+    ResettablePhases parent_phases;
     int (*pre_save)(LoongArchPICCommonState *s);
     int (*post_load)(LoongArchPICCommonState *s, int version_id);
 };

From a41a74ca5323f4d30ac7eb48ec1d54a09fae5baa Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Fri, 7 Mar 2025 14:20:13 +0800
Subject: [PATCH 0657/2760] hw/intc/loongarch_pch: Replace legacy reset
 callback with new api

Replace legacy reset callback register device_class_set_legacy_reset()
with new function resettable_class_set_parent_phases(). With new API,
it will call reset callback of parent object.

The internal state has been cleared in parent object
LOONGARCH_PIC_COMMON, here parent_phases.hold() is directly called.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
---
 hw/intc/loongarch_pch_pic.c         | 24 +++++++-----------------
 include/hw/intc/loongarch_pch_pic.h |  1 +
 2 files changed, 8 insertions(+), 17 deletions(-)

diff --git a/hw/intc/loongarch_pch_pic.c b/hw/intc/loongarch_pch_pic.c
index 6c2b6de3f0..834096265a 100644
--- a/hw/intc/loongarch_pch_pic.c
+++ b/hw/intc/loongarch_pch_pic.c
@@ -354,25 +354,13 @@ static const MemoryRegionOps loongarch_pch_pic_reg8_ops = {
     .endianness = DEVICE_LITTLE_ENDIAN,
 };
 
-static void loongarch_pch_pic_reset(DeviceState *d)
+static void loongarch_pic_reset_hold(Object *obj, ResetType type)
 {
-    LoongArchPICCommonState *s = LOONGARCH_PIC_COMMON(d);
-    int i;
+    LoongarchPICClass *lpc = LOONGARCH_PIC_GET_CLASS(obj);
 
-    s->int_mask = -1;
-    s->htmsi_en = 0x0;
-    s->intedge  = 0x0;
-    s->intclr   = 0x0;
-    s->auto_crtl0 = 0x0;
-    s->auto_crtl1 = 0x0;
-    for (i = 0; i < 64; i++) {
-        s->route_entry[i] = 0x1;
-        s->htmsi_vector[i] = 0x0;
+    if (lpc->parent_phases.hold) {
+        lpc->parent_phases.hold(obj, type);
     }
-    s->intirr = 0x0;
-    s->intisr = 0x0;
-    s->last_intirr = 0x0;
-    s->int_polarity = 0x0;
 }
 
 static void loongarch_pic_realize(DeviceState *dev, Error **errp)
@@ -408,8 +396,10 @@ static void loongarch_pic_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     LoongarchPICClass *lpc = LOONGARCH_PIC_CLASS(klass);
+    ResettableClass *rc = RESETTABLE_CLASS(klass);
 
-    device_class_set_legacy_reset(dc, loongarch_pch_pic_reset);
+    resettable_class_set_parent_phases(rc, NULL, loongarch_pic_reset_hold,
+                                       NULL, &lpc->parent_phases);
     device_class_set_parent_realize(dc, loongarch_pic_realize,
                                     &lpc->parent_realize);
 }
diff --git a/include/hw/intc/loongarch_pch_pic.h b/include/hw/intc/loongarch_pch_pic.h
index 481cc58aed..839a59a43b 100644
--- a/include/hw/intc/loongarch_pch_pic.h
+++ b/include/hw/intc/loongarch_pch_pic.h
@@ -22,6 +22,7 @@ struct LoongarchPICClass {
     LoongArchPICCommonClass parent_class;
 
     DeviceRealize parent_realize;
+    ResettablePhases parent_phases;
 };
 
 #endif /* HW_LOONGARCH_PCH_PIC_H */

From 73047c825e25a18127dddb89eff0c0bf97a26aed Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Fri, 25 Apr 2025 10:05:04 +0800
Subject: [PATCH 0658/2760] hw/loongarch/virt: Get physical entry address with
 elf file

With load_elf() api, image load low address and high address is converted
to physical address if parameter translate_fn is provided. However
executing entry address is still virtual address. Here convert entry
address into physical address, since MMU is disabled when system power on,
the first PC instruction should be physical address.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Song Gao <gaosong@loongson.cn>
---
 hw/loongarch/boot.c                    | 1 +
 tests/tcg/loongarch64/system/kernel.ld | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/loongarch/boot.c b/hw/loongarch/boot.c
index 354cf458c8..0324d6adcb 100644
--- a/hw/loongarch/boot.c
+++ b/hw/loongarch/boot.c
@@ -245,6 +245,7 @@ static int64_t load_kernel_info(struct loongarch_boot_info *info)
                            &kernel_entry, &kernel_low,
                            &kernel_high, NULL, ELFDATA2LSB,
                            EM_LOONGARCH, 1, 0);
+    kernel_entry = cpu_loongarch_virt_to_phys(NULL, kernel_entry);
     if (kernel_size < 0) {
         kernel_size = load_loongarch_linux_image(info->kernel_filename,
                                                  &kernel_entry, &kernel_low,
diff --git a/tests/tcg/loongarch64/system/kernel.ld b/tests/tcg/loongarch64/system/kernel.ld
index f1a7c0168c..56d8588f1a 100644
--- a/tests/tcg/loongarch64/system/kernel.ld
+++ b/tests/tcg/loongarch64/system/kernel.ld
@@ -3,7 +3,7 @@ ENTRY(_start)
 SECTIONS
 {
     /* Linux kernel legacy start address.  */
-    . = 0x9000000000200000;
+    . = 0x200000;
     _text = .;
     .text : {
         *(.text)

From d0897c6970b3717fe707c8d5a807fe2baf836ddd Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Fri, 28 Feb 2025 09:44:12 +0800
Subject: [PATCH 0659/2760] hw/loongarch/virt: Replace RSDT with XSDT table

XSDT table is introduced in ACPI Specification 5.0, it supports 64-bit
address in the table. There is LoongArch system support from ACPI
Specification 6.4 and later, XSDT is supported by LoongArch system.

Here replace RSDT with XSDT table.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
---
 hw/loongarch/virt-acpi-build.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/hw/loongarch/virt-acpi-build.c b/hw/loongarch/virt-acpi-build.c
index fced6c445a..073b6de75c 100644
--- a/hw/loongarch/virt-acpi-build.c
+++ b/hw/loongarch/virt-acpi-build.c
@@ -514,7 +514,7 @@ static void acpi_build(AcpiBuildTables *tables, MachineState *machine)
     LoongArchVirtMachineState *lvms = LOONGARCH_VIRT_MACHINE(machine);
     GArray *table_offsets;
     AcpiFadtData fadt_data;
-    unsigned facs, rsdt, dsdt;
+    unsigned facs, xsdt, dsdt;
     uint8_t *u;
     GArray *tables_blob = tables->table_data;
 
@@ -600,17 +600,17 @@ static void acpi_build(AcpiBuildTables *tables, MachineState *machine)
     }
 
     /* RSDT is pointed to by RSDP */
-    rsdt = tables_blob->len;
-    build_rsdt(tables_blob, tables->linker, table_offsets,
+    xsdt = tables_blob->len;
+    build_xsdt(tables_blob, tables->linker, table_offsets,
                lvms->oem_id, lvms->oem_table_id);
 
     /* RSDP is in FSEG memory, so allocate it separately */
     {
         AcpiRsdpData rsdp_data = {
-            .revision = 0,
+            .revision = 2,
             .oem_id = lvms->oem_id,
-            .xsdt_tbl_offset = NULL,
-            .rsdt_tbl_offset = &rsdt,
+            .xsdt_tbl_offset = &xsdt,
+            .rsdt_tbl_offset = NULL,
         };
         build_rsdp(tables->rsdp, tables->linker, &rsdp_data);
     }

From 445c9c645befa759b95b21108447704ab328ae03 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Tue, 4 Mar 2025 14:59:17 +0800
Subject: [PATCH 0660/2760] hw/loongarch/virt: Allow user to customize OEM ID
 and OEM table ID

On LoongArch virt machine, the default OEM ID and OEM table ID is
"BOCHS " and "BXPC    ". Here property x-oem-id and x-oem-table-id
is added on virt machine to set customized OEM ID and OEM table ID.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
---
 hw/loongarch/virt.c | 58 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 58 insertions(+)

diff --git a/hw/loongarch/virt.c b/hw/loongarch/virt.c
index 779544fada..7ad7fb68ff 100644
--- a/hw/loongarch/virt.c
+++ b/hw/loongarch/virt.c
@@ -773,6 +773,48 @@ static void virt_set_acpi(Object *obj, Visitor *v, const char *name,
     visit_type_OnOffAuto(v, name, &lvms->acpi, errp);
 }
 
+static char *virt_get_oem_id(Object *obj, Error **errp)
+{
+    LoongArchVirtMachineState *lvms = LOONGARCH_VIRT_MACHINE(obj);
+
+    return g_strdup(lvms->oem_id);
+}
+
+static void virt_set_oem_id(Object *obj, const char *value, Error **errp)
+{
+    LoongArchVirtMachineState *lvms = LOONGARCH_VIRT_MACHINE(obj);
+    size_t len = strlen(value);
+
+    if (len > 6) {
+        error_setg(errp,
+                   "User specified oem-id value is bigger than 6 bytes in size");
+        return;
+    }
+
+    strncpy(lvms->oem_id, value, 6);
+}
+
+static char *virt_get_oem_table_id(Object *obj, Error **errp)
+{
+    LoongArchVirtMachineState *lvms = LOONGARCH_VIRT_MACHINE(obj);
+
+    return g_strdup(lvms->oem_table_id);
+}
+
+static void virt_set_oem_table_id(Object *obj, const char *value,
+                                  Error **errp)
+{
+    LoongArchVirtMachineState *lvms = LOONGARCH_VIRT_MACHINE(obj);
+    size_t len = strlen(value);
+
+    if (len > 8) {
+        error_setg(errp,
+                   "User specified oem-table-id value is bigger than 8 bytes in size");
+        return;
+    }
+    strncpy(lvms->oem_table_id, value, 8);
+}
+
 static void virt_initfn(Object *obj)
 {
     LoongArchVirtMachineState *lvms = LOONGARCH_VIRT_MACHINE(obj);
@@ -1177,6 +1219,22 @@ static void virt_class_init(ObjectClass *oc, const void *data)
 #ifdef CONFIG_TPM
     machine_class_allow_dynamic_sysbus_dev(mc, TYPE_TPM_TIS_SYSBUS);
 #endif
+    object_class_property_add_str(oc, "x-oem-id",
+                                  virt_get_oem_id,
+                                  virt_set_oem_id);
+    object_class_property_set_description(oc, "x-oem-id",
+                                          "Override the default value of field OEMID "
+                                          "in ACPI table header."
+                                          "The string may be up to 6 bytes in size");
+
+
+    object_class_property_add_str(oc, "x-oem-table-id",
+                                  virt_get_oem_table_id,
+                                  virt_set_oem_table_id);
+    object_class_property_set_description(oc, "x-oem-table-id",
+                                          "Override the default value of field OEM Table ID "
+                                          "in ACPI table header."
+                                          "The string may be up to 8 bytes in size");
 }
 
 static const TypeInfo virt_machine_types[] = {

From bb5101aadc1675790983c7911092dd9abeec4651 Mon Sep 17 00:00:00 2001
From: Qiang Yu <yuq825@gmail.com>
Date: Thu, 27 Mar 2025 10:58:43 +0800
Subject: [PATCH 0661/2760] ui/dmabuf: extend QemuDmaBuf to support multi-plane
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

mesa/radeonsi is going to support explicit modifier which
may export a multi-plane texture. For example, texture with
DCC enabled (a compressed format) has two planes, one with
compressed data, the other with meta data for compression.

v2:
  * change API qemu_dmabuf_get_fd/offset/stride to
    qemu_dmabuf_get_fds/offsets/strides.
  * change API qemu_dmabuf_dup_fd to qemu_dmabuf_dup_fds.
  * add an extra arg to these API for the length of the
    array.

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Qiang Yu <yuq825@gmail.com>
[ Fix style ]
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-ID: <20250327025848.46962-2-yuq825@gmail.com>
---
 hw/display/vhost-user-gpu.c     |  6 ++-
 hw/display/virtio-gpu-udmabuf.c |  6 ++-
 hw/vfio/display.c               |  7 +--
 include/ui/dmabuf.h             | 20 ++++----
 ui/dbus-listener.c              | 10 ++--
 ui/dmabuf.c                     | 82 +++++++++++++++++++++++----------
 ui/egl-helpers.c                |  4 +-
 ui/spice-display.c              |  4 +-
 8 files changed, 90 insertions(+), 49 deletions(-)

diff --git a/hw/display/vhost-user-gpu.c b/hw/display/vhost-user-gpu.c
index 06c4e7e190..a367daac82 100644
--- a/hw/display/vhost-user-gpu.c
+++ b/hw/display/vhost-user-gpu.c
@@ -249,6 +249,8 @@ vhost_user_gpu_handle_display(VhostUserGPU *g, VhostUserGpuMsg *msg)
     case VHOST_USER_GPU_DMABUF_SCANOUT: {
         VhostUserGpuDMABUFScanout *m = &msg->payload.dmabuf_scanout;
         int fd = qemu_chr_fe_get_msgfd(&g->vhost_chr);
+        uint32_t offset = 0;
+        uint32_t stride = m->fd_stride;
         uint64_t modifier = 0;
         QemuDmaBuf *dmabuf;
 
@@ -282,10 +284,10 @@ vhost_user_gpu_handle_display(VhostUserGPU *g, VhostUserGpuMsg *msg)
         }
 
         dmabuf = qemu_dmabuf_new(m->width, m->height,
-                                 m->fd_stride, 0, 0,
+                                 &offset, &stride, 0, 0,
                                  m->fd_width, m->fd_height,
                                  m->fd_drm_fourcc, modifier,
-                                 fd, false, m->fd_flags &
+                                 &fd, 1, false, m->fd_flags &
                                  VIRTIO_GPU_RESOURCE_FLAG_Y_0_TOP);
 
         dpy_gl_scanout_dmabuf(con, dmabuf);
diff --git a/hw/display/virtio-gpu-udmabuf.c b/hw/display/virtio-gpu-udmabuf.c
index 0510577475..01b0024ead 100644
--- a/hw/display/virtio-gpu-udmabuf.c
+++ b/hw/display/virtio-gpu-udmabuf.c
@@ -176,16 +176,18 @@ static VGPUDMABuf
                           struct virtio_gpu_rect *r)
 {
     VGPUDMABuf *dmabuf;
+    uint32_t offset = 0;
 
     if (res->dmabuf_fd < 0) {
         return NULL;
     }
 
     dmabuf = g_new0(VGPUDMABuf, 1);
-    dmabuf->buf = qemu_dmabuf_new(r->width, r->height, fb->stride,
+    dmabuf->buf = qemu_dmabuf_new(r->width, r->height,
+                                  &offset, &fb->stride,
                                   r->x, r->y, fb->width, fb->height,
                                   qemu_pixman_to_drm_format(fb->format),
-                                  0, res->dmabuf_fd, true, false);
+                                  0, &res->dmabuf_fd, 1, true, false);
     dmabuf->scanout_id = scanout_id;
     QTAILQ_INSERT_HEAD(&g->dmabuf.bufs, dmabuf, next);
 
diff --git a/hw/vfio/display.c b/hw/vfio/display.c
index f3e6581f15..9c6f5aa265 100644
--- a/hw/vfio/display.c
+++ b/hw/vfio/display.c
@@ -213,6 +213,7 @@ static VFIODMABuf *vfio_display_get_dmabuf(VFIOPCIDevice *vdev,
     struct vfio_device_gfx_plane_info plane;
     VFIODMABuf *dmabuf;
     int fd, ret;
+    uint32_t offset = 0;
 
     memset(&plane, 0, sizeof(plane));
     plane.argsz = sizeof(plane);
@@ -245,10 +246,10 @@ static VFIODMABuf *vfio_display_get_dmabuf(VFIOPCIDevice *vdev,
 
     dmabuf = g_new0(VFIODMABuf, 1);
     dmabuf->dmabuf_id  = plane.dmabuf_id;
-    dmabuf->buf = qemu_dmabuf_new(plane.width, plane.height,
-                                  plane.stride, 0, 0, plane.width,
+    dmabuf->buf = qemu_dmabuf_new(plane.width, plane.height, &offset,
+                                  &plane.stride, 0, 0, plane.width,
                                   plane.height, plane.drm_format,
-                                  plane.drm_format_mod, fd, false, false);
+                                  plane.drm_format_mod, &fd, 1, false, false);
 
     if (plane_type == DRM_PLANE_TYPE_CURSOR) {
         vfio_display_update_cursor(dmabuf, &plane);
diff --git a/include/ui/dmabuf.h b/include/ui/dmabuf.h
index dc74ba895a..3decdca497 100644
--- a/include/ui/dmabuf.h
+++ b/include/ui/dmabuf.h
@@ -10,24 +10,29 @@
 #ifndef DMABUF_H
 #define DMABUF_H
 
+#define DMABUF_MAX_PLANES 4
+
 typedef struct QemuDmaBuf QemuDmaBuf;
 
 QemuDmaBuf *qemu_dmabuf_new(uint32_t width, uint32_t height,
-                            uint32_t stride, uint32_t x,
-                            uint32_t y, uint32_t backing_width,
-                            uint32_t backing_height, uint32_t fourcc,
-                            uint64_t modifier, int dmabuf_fd,
+                            const uint32_t *offset, const uint32_t *stride,
+                            uint32_t x, uint32_t y,
+                            uint32_t backing_width, uint32_t backing_height,
+                            uint32_t fourcc, uint64_t modifier,
+                            const int32_t *dmabuf_fd, uint32_t num_planes,
                             bool allow_fences, bool y0_top);
 void qemu_dmabuf_free(QemuDmaBuf *dmabuf);
 
 G_DEFINE_AUTOPTR_CLEANUP_FUNC(QemuDmaBuf, qemu_dmabuf_free);
 
-int qemu_dmabuf_get_fd(QemuDmaBuf *dmabuf);
-int qemu_dmabuf_dup_fd(QemuDmaBuf *dmabuf);
+const int *qemu_dmabuf_get_fds(QemuDmaBuf *dmabuf, int *nfds);
+void qemu_dmabuf_dup_fds(QemuDmaBuf *dmabuf, int *fds, int nfds);
 void qemu_dmabuf_close(QemuDmaBuf *dmabuf);
 uint32_t qemu_dmabuf_get_width(QemuDmaBuf *dmabuf);
 uint32_t qemu_dmabuf_get_height(QemuDmaBuf *dmabuf);
-uint32_t qemu_dmabuf_get_stride(QemuDmaBuf *dmabuf);
+const uint32_t *qemu_dmabuf_get_offsets(QemuDmaBuf *dmabuf, int *noffsets);
+const uint32_t *qemu_dmabuf_get_strides(QemuDmaBuf *dmabuf, int *nstrides);
+uint32_t qemu_dmabuf_get_num_planes(QemuDmaBuf *dmabuf);
 uint32_t qemu_dmabuf_get_fourcc(QemuDmaBuf *dmabuf);
 uint64_t qemu_dmabuf_get_modifier(QemuDmaBuf *dmabuf);
 uint32_t qemu_dmabuf_get_texture(QemuDmaBuf *dmabuf);
@@ -44,6 +49,5 @@ void qemu_dmabuf_set_texture(QemuDmaBuf *dmabuf, uint32_t texture);
 void qemu_dmabuf_set_fence_fd(QemuDmaBuf *dmabuf, int32_t fence_fd);
 void qemu_dmabuf_set_sync(QemuDmaBuf *dmabuf, void *sync);
 void qemu_dmabuf_set_draw_submitted(QemuDmaBuf *dmabuf, bool draw_submitted);
-void qemu_dmabuf_set_fd(QemuDmaBuf *dmabuf, int32_t fd);
 
 #endif
diff --git a/ui/dbus-listener.c b/ui/dbus-listener.c
index 51244c9240..65373d519c 100644
--- a/ui/dbus-listener.c
+++ b/ui/dbus-listener.c
@@ -299,7 +299,7 @@ static void dbus_scanout_dmabuf(DisplayChangeListener *dcl,
     uint64_t modifier;
     bool y0_top;
 
-    fd = qemu_dmabuf_get_fd(dmabuf);
+    fd = qemu_dmabuf_get_fds(dmabuf, NULL)[0];
     fd_list = g_unix_fd_list_new();
     if (g_unix_fd_list_append(fd_list, fd, &err) != 0) {
         error_report("Failed to setup dmabuf fdlist: %s", err->message);
@@ -310,7 +310,7 @@ static void dbus_scanout_dmabuf(DisplayChangeListener *dcl,
 
     width = qemu_dmabuf_get_width(dmabuf);
     height = qemu_dmabuf_get_height(dmabuf);
-    stride = qemu_dmabuf_get_stride(dmabuf);
+    stride = qemu_dmabuf_get_strides(dmabuf, NULL)[0];
     fourcc = qemu_dmabuf_get_fourcc(dmabuf);
     modifier = qemu_dmabuf_get_modifier(dmabuf);
     y0_top = qemu_dmabuf_get_y0_top(dmabuf);
@@ -505,7 +505,7 @@ static void dbus_scanout_texture(DisplayChangeListener *dcl,
 #ifdef CONFIG_GBM
     g_autoptr(QemuDmaBuf) dmabuf = NULL;
     int fd;
-    uint32_t stride, fourcc;
+    uint32_t offset = 0, stride, fourcc;
     uint64_t modifier;
 
     assert(tex_id);
@@ -515,8 +515,8 @@ static void dbus_scanout_texture(DisplayChangeListener *dcl,
         error_report("%s: failed to get fd for texture", __func__);
         return;
     }
-    dmabuf = qemu_dmabuf_new(w, h, stride, x, y, backing_width,
-                             backing_height, fourcc, modifier, fd,
+    dmabuf = qemu_dmabuf_new(w, h, &offset, &stride, x, y, backing_width,
+                             backing_height, fourcc, modifier, &fd, 1,
                              false, backing_y_0_top);
 
     dbus_scanout_dmabuf(dcl, dmabuf);
diff --git a/ui/dmabuf.c b/ui/dmabuf.c
index df7a09703f..7433a268f0 100644
--- a/ui/dmabuf.c
+++ b/ui/dmabuf.c
@@ -11,10 +11,12 @@
 #include "ui/dmabuf.h"
 
 struct QemuDmaBuf {
-    int       fd;
+    int       fd[DMABUF_MAX_PLANES];
     uint32_t  width;
     uint32_t  height;
-    uint32_t  stride;
+    uint32_t  offset[DMABUF_MAX_PLANES];
+    uint32_t  stride[DMABUF_MAX_PLANES];
+    uint32_t  num_planes;
     uint32_t  fourcc;
     uint64_t  modifier;
     uint32_t  texture;
@@ -30,28 +32,33 @@ struct QemuDmaBuf {
 };
 
 QemuDmaBuf *qemu_dmabuf_new(uint32_t width, uint32_t height,
-                            uint32_t stride, uint32_t x,
-                            uint32_t y, uint32_t backing_width,
-                            uint32_t backing_height, uint32_t fourcc,
-                            uint64_t modifier, int32_t dmabuf_fd,
+                            const uint32_t *offset, const uint32_t *stride,
+                            uint32_t x, uint32_t y,
+                            uint32_t backing_width, uint32_t backing_height,
+                            uint32_t fourcc, uint64_t modifier,
+                            const int32_t *dmabuf_fd, uint32_t num_planes,
                             bool allow_fences, bool y0_top) {
     QemuDmaBuf *dmabuf;
 
+    assert(num_planes > 0 && num_planes <= DMABUF_MAX_PLANES);
+
     dmabuf = g_new0(QemuDmaBuf, 1);
 
     dmabuf->width = width;
     dmabuf->height = height;
-    dmabuf->stride = stride;
+    memcpy(dmabuf->offset, offset, num_planes * sizeof(*offset));
+    memcpy(dmabuf->stride, stride, num_planes * sizeof(*stride));
     dmabuf->x = x;
     dmabuf->y = y;
     dmabuf->backing_width = backing_width;
     dmabuf->backing_height = backing_height;
     dmabuf->fourcc = fourcc;
     dmabuf->modifier = modifier;
-    dmabuf->fd = dmabuf_fd;
+    memcpy(dmabuf->fd, dmabuf_fd, num_planes * sizeof(*dmabuf_fd));
     dmabuf->allow_fences = allow_fences;
     dmabuf->y0_top = y0_top;
     dmabuf->fence_fd = -1;
+    dmabuf->num_planes = num_planes;
 
     return dmabuf;
 }
@@ -65,31 +72,40 @@ void qemu_dmabuf_free(QemuDmaBuf *dmabuf)
     g_free(dmabuf);
 }
 
-int qemu_dmabuf_get_fd(QemuDmaBuf *dmabuf)
+const int *qemu_dmabuf_get_fds(QemuDmaBuf *dmabuf, int *nfds)
 {
     assert(dmabuf != NULL);
 
+    if (nfds) {
+        *nfds = ARRAY_SIZE(dmabuf->fd);
+    }
+
     return dmabuf->fd;
 }
 
-int qemu_dmabuf_dup_fd(QemuDmaBuf *dmabuf)
+void qemu_dmabuf_dup_fds(QemuDmaBuf *dmabuf, int *fds, int nfds)
 {
-    assert(dmabuf != NULL);
+    int i;
 
-    if (dmabuf->fd >= 0) {
-        return dup(dmabuf->fd);
-    } else {
-        return -1;
+    assert(dmabuf != NULL);
+    assert(nfds >= dmabuf->num_planes);
+
+    for (i = 0; i < dmabuf->num_planes; i++) {
+        fds[i] = dmabuf->fd[i] >= 0 ? dup(dmabuf->fd[i]) : -1;
     }
 }
 
 void qemu_dmabuf_close(QemuDmaBuf *dmabuf)
 {
+    int i;
+
     assert(dmabuf != NULL);
 
-    if (dmabuf->fd >= 0) {
-        close(dmabuf->fd);
-        dmabuf->fd = -1;
+    for (i = 0; i < dmabuf->num_planes; i++) {
+        if (dmabuf->fd[i] >= 0) {
+            close(dmabuf->fd[i]);
+            dmabuf->fd[i] = -1;
+        }
     }
 }
 
@@ -107,13 +123,35 @@ uint32_t qemu_dmabuf_get_height(QemuDmaBuf *dmabuf)
     return dmabuf->height;
 }
 
-uint32_t qemu_dmabuf_get_stride(QemuDmaBuf *dmabuf)
+const uint32_t *qemu_dmabuf_get_offsets(QemuDmaBuf *dmabuf, int *noffsets)
 {
     assert(dmabuf != NULL);
 
+    if (noffsets) {
+        *noffsets = ARRAY_SIZE(dmabuf->offset);
+    }
+
+    return dmabuf->offset;
+}
+
+const uint32_t *qemu_dmabuf_get_strides(QemuDmaBuf *dmabuf, int *nstrides)
+{
+    assert(dmabuf != NULL);
+
+    if (nstrides) {
+        *nstrides = ARRAY_SIZE(dmabuf->stride);
+    }
+
     return dmabuf->stride;
 }
 
+uint32_t qemu_dmabuf_get_num_planes(QemuDmaBuf *dmabuf)
+{
+    assert(dmabuf != NULL);
+
+    return dmabuf->num_planes;
+}
+
 uint32_t qemu_dmabuf_get_fourcc(QemuDmaBuf *dmabuf)
 {
     assert(dmabuf != NULL);
@@ -221,9 +259,3 @@ void qemu_dmabuf_set_draw_submitted(QemuDmaBuf *dmabuf, bool draw_submitted)
     assert(dmabuf != NULL);
     dmabuf->draw_submitted = draw_submitted;
 }
-
-void qemu_dmabuf_set_fd(QemuDmaBuf *dmabuf, int32_t fd)
-{
-    assert(dmabuf != NULL);
-    dmabuf->fd = fd;
-}
diff --git a/ui/egl-helpers.c b/ui/egl-helpers.c
index d591159480..d194d004b7 100644
--- a/ui/egl-helpers.c
+++ b/ui/egl-helpers.c
@@ -323,9 +323,9 @@ void egl_dmabuf_import_texture(QemuDmaBuf *dmabuf)
     attrs[i++] = qemu_dmabuf_get_fourcc(dmabuf);
 
     attrs[i++] = EGL_DMA_BUF_PLANE0_FD_EXT;
-    attrs[i++] = qemu_dmabuf_get_fd(dmabuf);
+    attrs[i++] = qemu_dmabuf_get_fds(dmabuf, NULL)[0];
     attrs[i++] = EGL_DMA_BUF_PLANE0_PITCH_EXT;
-    attrs[i++] = qemu_dmabuf_get_stride(dmabuf);
+    attrs[i++] = qemu_dmabuf_get_strides(dmabuf, NULL)[0];
     attrs[i++] = EGL_DMA_BUF_PLANE0_OFFSET_EXT;
     attrs[i++] = 0;
 #ifdef EGL_DMA_BUF_PLANE0_MODIFIER_LO_EXT
diff --git a/ui/spice-display.c b/ui/spice-display.c
index c794ae0649..40547edb5e 100644
--- a/ui/spice-display.c
+++ b/ui/spice-display.c
@@ -1075,10 +1075,10 @@ static void qemu_spice_gl_update(DisplayChangeListener *dcl,
                                      stride, fourcc, false);
             }
         } else {
-            stride = qemu_dmabuf_get_stride(dmabuf);
+            stride = qemu_dmabuf_get_strides(dmabuf, NULL)[0];
             fourcc = qemu_dmabuf_get_fourcc(dmabuf);
             y_0_top = qemu_dmabuf_get_y0_top(dmabuf);
-            fd = qemu_dmabuf_dup_fd(dmabuf);
+            qemu_dmabuf_dup_fds(dmabuf, &fd, 1);
 
             trace_qemu_spice_gl_forward_dmabuf(ssd->qxl.id, width, height);
             /* note: spice server will close the fd, so hand over a dup */

From 806c861dc6b92019765aed09a016db460cd345fb Mon Sep 17 00:00:00 2001
From: Qiang Yu <yuq825@gmail.com>
Date: Thu, 27 Mar 2025 10:58:44 +0800
Subject: [PATCH 0662/2760] ui/egl: require
 EGL_EXT_image_dma_buf_import_modifiers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

It's used already, just check it explicitly.

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Qiang Yu <yuq825@gmail.com>
Message-ID: <20250327025848.46962-3-yuq825@gmail.com>
---
 ui/egl-helpers.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/ui/egl-helpers.c b/ui/egl-helpers.c
index d194d004b7..432863d702 100644
--- a/ui/egl-helpers.c
+++ b/ui/egl-helpers.c
@@ -257,6 +257,11 @@ int egl_rendernode_init(const char *rendernode, DisplayGLMode mode)
         error_report("egl: EGL_MESA_image_dma_buf_export not supported");
         goto err;
     }
+    if (!epoxy_has_egl_extension(qemu_egl_display,
+                                 "EGL_EXT_image_dma_buf_import_modifiers")) {
+        error_report("egl: EGL_EXT_image_dma_buf_import_modifiers not supported");
+        goto err;
+    }
 
     qemu_egl_rn_ctx = qemu_egl_init_ctx();
     if (!qemu_egl_rn_ctx) {
@@ -308,7 +313,7 @@ void egl_dmabuf_import_texture(QemuDmaBuf *dmabuf)
     EGLImageKHR image = EGL_NO_IMAGE_KHR;
     EGLint attrs[64];
     int i = 0;
-    uint64_t modifier;
+    uint64_t modifier = qemu_dmabuf_get_modifier(dmabuf);
     uint32_t texture = qemu_dmabuf_get_texture(dmabuf);
 
     if (texture != 0) {
@@ -328,15 +333,12 @@ void egl_dmabuf_import_texture(QemuDmaBuf *dmabuf)
     attrs[i++] = qemu_dmabuf_get_strides(dmabuf, NULL)[0];
     attrs[i++] = EGL_DMA_BUF_PLANE0_OFFSET_EXT;
     attrs[i++] = 0;
-#ifdef EGL_DMA_BUF_PLANE0_MODIFIER_LO_EXT
-    modifier = qemu_dmabuf_get_modifier(dmabuf);
     if (modifier) {
         attrs[i++] = EGL_DMA_BUF_PLANE0_MODIFIER_LO_EXT;
         attrs[i++] = (modifier >>  0) & 0xffffffff;
         attrs[i++] = EGL_DMA_BUF_PLANE0_MODIFIER_HI_EXT;
         attrs[i++] = (modifier >> 32) & 0xffffffff;
     }
-#endif
     attrs[i++] = EGL_NONE;
 
     image = eglCreateImageKHR(qemu_egl_display,

From ac70568902c3fb77516d93b169cddd0bcaabfb4e Mon Sep 17 00:00:00 2001
From: Qiang Yu <yuq825@gmail.com>
Date: Thu, 27 Mar 2025 10:58:45 +0800
Subject: [PATCH 0663/2760] ui/egl: use DRM_FORMAT_MOD_INVALID as default
 modifier
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

0 is used as DRM_FORMAT_MOD_LINEAR already.

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Qiang Yu <yuq825@gmail.com>
Message-ID: <20250327025848.46962-4-yuq825@gmail.com>
---
 hw/display/vhost-user-gpu.c     | 3 ++-
 hw/display/virtio-gpu-udmabuf.c | 4 +++-
 ui/egl-helpers.c                | 3 ++-
 3 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/hw/display/vhost-user-gpu.c b/hw/display/vhost-user-gpu.c
index a367daac82..43d4c08a2e 100644
--- a/hw/display/vhost-user-gpu.c
+++ b/hw/display/vhost-user-gpu.c
@@ -18,6 +18,7 @@
 #include "chardev/char-fe.h"
 #include "qapi/error.h"
 #include "migration/blocker.h"
+#include "standard-headers/drm/drm_fourcc.h"
 
 typedef enum VhostUserGpuRequest {
     VHOST_USER_GPU_NONE = 0,
@@ -251,7 +252,7 @@ vhost_user_gpu_handle_display(VhostUserGPU *g, VhostUserGpuMsg *msg)
         int fd = qemu_chr_fe_get_msgfd(&g->vhost_chr);
         uint32_t offset = 0;
         uint32_t stride = m->fd_stride;
-        uint64_t modifier = 0;
+        uint64_t modifier = DRM_FORMAT_MOD_INVALID;
         QemuDmaBuf *dmabuf;
 
         if (m->scanout_id >= g->parent_obj.conf.max_outputs) {
diff --git a/hw/display/virtio-gpu-udmabuf.c b/hw/display/virtio-gpu-udmabuf.c
index 01b0024ead..d804f321aa 100644
--- a/hw/display/virtio-gpu-udmabuf.c
+++ b/hw/display/virtio-gpu-udmabuf.c
@@ -25,6 +25,7 @@
 #include <linux/memfd.h>
 #include "qemu/memfd.h"
 #include "standard-headers/linux/udmabuf.h"
+#include "standard-headers/drm/drm_fourcc.h"
 
 static void virtio_gpu_create_udmabuf(struct virtio_gpu_simple_resource *res)
 {
@@ -187,7 +188,8 @@ static VGPUDMABuf
                                   &offset, &fb->stride,
                                   r->x, r->y, fb->width, fb->height,
                                   qemu_pixman_to_drm_format(fb->format),
-                                  0, &res->dmabuf_fd, 1, true, false);
+                                  DRM_FORMAT_MOD_INVALID, &res->dmabuf_fd,
+                                  1, true, false);
     dmabuf->scanout_id = scanout_id;
     QTAILQ_INSERT_HEAD(&g->dmabuf.bufs, dmabuf, next);
 
diff --git a/ui/egl-helpers.c b/ui/egl-helpers.c
index 432863d702..8c0e394d2b 100644
--- a/ui/egl-helpers.c
+++ b/ui/egl-helpers.c
@@ -23,6 +23,7 @@
 #include "system/system.h"
 #include "qapi/error.h"
 #include "trace.h"
+#include "standard-headers/drm/drm_fourcc.h"
 
 EGLDisplay *qemu_egl_display;
 EGLConfig qemu_egl_config;
@@ -333,7 +334,7 @@ void egl_dmabuf_import_texture(QemuDmaBuf *dmabuf)
     attrs[i++] = qemu_dmabuf_get_strides(dmabuf, NULL)[0];
     attrs[i++] = EGL_DMA_BUF_PLANE0_OFFSET_EXT;
     attrs[i++] = 0;
-    if (modifier) {
+    if (modifier != DRM_FORMAT_MOD_INVALID) {
         attrs[i++] = EGL_DMA_BUF_PLANE0_MODIFIER_LO_EXT;
         attrs[i++] = (modifier >>  0) & 0xffffffff;
         attrs[i++] = EGL_DMA_BUF_PLANE0_MODIFIER_HI_EXT;

From 0e15d0b92700000db66e19c68ad2d50aace860d8 Mon Sep 17 00:00:00 2001
From: Qiang Yu <yuq825@gmail.com>
Date: Thu, 27 Mar 2025 10:58:46 +0800
Subject: [PATCH 0664/2760] ui/egl: support multi-plane dmabuf when egl
 export/import
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

v2:
  * use new dmabuf API and check length

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Qiang Yu <yuq825@gmail.com>
[ Fix style ]
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-ID: <20250327025848.46962-5-yuq825@gmail.com>
---
 include/ui/egl-helpers.h |  5 ++-
 ui/dbus-listener.c       | 19 +++++----
 ui/egl-helpers.c         | 92 ++++++++++++++++++++++++++++++----------
 ui/spice-display.c       | 60 +++++++++++++++++---------
 4 files changed, 124 insertions(+), 52 deletions(-)

diff --git a/include/ui/egl-helpers.h b/include/ui/egl-helpers.h
index 4b8c0d2281..fb80e15142 100644
--- a/include/ui/egl-helpers.h
+++ b/include/ui/egl-helpers.h
@@ -46,8 +46,9 @@ extern int qemu_egl_rn_fd;
 extern struct gbm_device *qemu_egl_rn_gbm_dev;
 
 int egl_rendernode_init(const char *rendernode, DisplayGLMode mode);
-int egl_get_fd_for_texture(uint32_t tex_id, EGLint *stride, EGLint *fourcc,
-                           EGLuint64KHR *modifier);
+bool egl_dmabuf_export_texture(uint32_t tex_id, int *fd, EGLint *offset,
+                               EGLint *stride, EGLint *fourcc, int *num_planes,
+                               EGLuint64KHR *modifier);
 
 void egl_dmabuf_import_texture(QemuDmaBuf *dmabuf);
 void egl_dmabuf_release_texture(QemuDmaBuf *dmabuf);
diff --git a/ui/dbus-listener.c b/ui/dbus-listener.c
index 65373d519c..90147972cd 100644
--- a/ui/dbus-listener.c
+++ b/ui/dbus-listener.c
@@ -504,19 +504,22 @@ static void dbus_scanout_texture(DisplayChangeListener *dcl,
                                backing_width, backing_height, x, y, w, h);
 #ifdef CONFIG_GBM
     g_autoptr(QemuDmaBuf) dmabuf = NULL;
-    int fd;
-    uint32_t offset = 0, stride, fourcc;
+    int fd[DMABUF_MAX_PLANES], num_planes;
+    uint32_t offset[DMABUF_MAX_PLANES], stride[DMABUF_MAX_PLANES], fourcc;
     uint64_t modifier;
 
     assert(tex_id);
-    fd = egl_get_fd_for_texture(tex_id, (EGLint *)&stride, (EGLint *)&fourcc,
-                                &modifier);
-    if (fd < 0) {
-        error_report("%s: failed to get fd for texture", __func__);
+    if (!egl_dmabuf_export_texture(tex_id, fd, (EGLint *)offset, (EGLint *)stride,
+                                   (EGLint *)&fourcc, &num_planes, &modifier)) {
+        error_report("%s: failed to export dmabuf for texture", __func__);
         return;
     }
-    dmabuf = qemu_dmabuf_new(w, h, &offset, &stride, x, y, backing_width,
-                             backing_height, fourcc, modifier, &fd, 1,
+    if (num_planes > 1) {
+        error_report("%s: does not support multi-plane dmabuf", __func__);
+        return;
+    }
+    dmabuf = qemu_dmabuf_new(w, h, offset, stride, x, y, backing_width,
+                             backing_height, fourcc, modifier, fd, num_planes,
                              false, backing_y_0_top);
 
     dbus_scanout_dmabuf(dcl, dmabuf);
diff --git a/ui/egl-helpers.c b/ui/egl-helpers.c
index 8c0e394d2b..9cda2bbbee 100644
--- a/ui/egl-helpers.c
+++ b/ui/egl-helpers.c
@@ -283,44 +283,86 @@ err:
     return -1;
 }
 
-int egl_get_fd_for_texture(uint32_t tex_id, EGLint *stride, EGLint *fourcc,
-                           EGLuint64KHR *modifier)
+bool egl_dmabuf_export_texture(uint32_t tex_id, int *fd, EGLint *offset,
+                               EGLint *stride, EGLint *fourcc, int *num_planes,
+                               EGLuint64KHR *modifier)
 {
     EGLImageKHR image;
-    EGLint num_planes, fd;
+    EGLuint64KHR modifiers[DMABUF_MAX_PLANES];
 
     image = eglCreateImageKHR(qemu_egl_display, eglGetCurrentContext(),
                               EGL_GL_TEXTURE_2D_KHR,
                               (EGLClientBuffer)(unsigned long)tex_id,
                               NULL);
     if (!image) {
-        return -1;
+        return false;
     }
 
     eglExportDMABUFImageQueryMESA(qemu_egl_display, image, fourcc,
-                                  &num_planes, modifier);
-    if (num_planes != 1) {
-        eglDestroyImageKHR(qemu_egl_display, image);
-        return -1;
-    }
-    eglExportDMABUFImageMESA(qemu_egl_display, image, &fd, stride, NULL);
+                                  num_planes, modifiers);
+    eglExportDMABUFImageMESA(qemu_egl_display, image, fd, stride, offset);
     eglDestroyImageKHR(qemu_egl_display, image);
 
-    return fd;
+    /* Only first modifier matters. */
+    if (modifier) {
+        *modifier = modifiers[0];
+    }
+
+    return true;
 }
 
 void egl_dmabuf_import_texture(QemuDmaBuf *dmabuf)
 {
     EGLImageKHR image = EGL_NO_IMAGE_KHR;
     EGLint attrs[64];
-    int i = 0;
+    int i = 0, j;
     uint64_t modifier = qemu_dmabuf_get_modifier(dmabuf);
     uint32_t texture = qemu_dmabuf_get_texture(dmabuf);
+    int nfds, noffsets, nstrides;
+    const int *fds = qemu_dmabuf_get_fds(dmabuf, &nfds);
+    const uint32_t *offsets = qemu_dmabuf_get_offsets(dmabuf, &noffsets);
+    const uint32_t *strides = qemu_dmabuf_get_strides(dmabuf, &nstrides);
+    uint32_t num_planes = qemu_dmabuf_get_num_planes(dmabuf);
+
+    EGLint fd_attrs[] = {
+        EGL_DMA_BUF_PLANE0_FD_EXT,
+        EGL_DMA_BUF_PLANE1_FD_EXT,
+        EGL_DMA_BUF_PLANE2_FD_EXT,
+        EGL_DMA_BUF_PLANE3_FD_EXT,
+    };
+    EGLint offset_attrs[] = {
+        EGL_DMA_BUF_PLANE0_OFFSET_EXT,
+        EGL_DMA_BUF_PLANE1_OFFSET_EXT,
+        EGL_DMA_BUF_PLANE2_OFFSET_EXT,
+        EGL_DMA_BUF_PLANE3_OFFSET_EXT,
+    };
+    EGLint stride_attrs[] = {
+        EGL_DMA_BUF_PLANE0_PITCH_EXT,
+        EGL_DMA_BUF_PLANE1_PITCH_EXT,
+        EGL_DMA_BUF_PLANE2_PITCH_EXT,
+        EGL_DMA_BUF_PLANE3_PITCH_EXT,
+    };
+    EGLint modifier_lo_attrs[] = {
+        EGL_DMA_BUF_PLANE0_MODIFIER_LO_EXT,
+        EGL_DMA_BUF_PLANE1_MODIFIER_LO_EXT,
+        EGL_DMA_BUF_PLANE2_MODIFIER_LO_EXT,
+        EGL_DMA_BUF_PLANE3_MODIFIER_LO_EXT,
+    };
+    EGLint modifier_hi_attrs[] = {
+        EGL_DMA_BUF_PLANE0_MODIFIER_HI_EXT,
+        EGL_DMA_BUF_PLANE1_MODIFIER_HI_EXT,
+        EGL_DMA_BUF_PLANE2_MODIFIER_HI_EXT,
+        EGL_DMA_BUF_PLANE3_MODIFIER_HI_EXT,
+    };
 
     if (texture != 0) {
         return;
     }
 
+    assert(nfds >= num_planes);
+    assert(noffsets >= num_planes);
+    assert(nstrides >= num_planes);
+
     attrs[i++] = EGL_WIDTH;
     attrs[i++] = qemu_dmabuf_get_backing_width(dmabuf);
     attrs[i++] = EGL_HEIGHT;
@@ -328,18 +370,22 @@ void egl_dmabuf_import_texture(QemuDmaBuf *dmabuf)
     attrs[i++] = EGL_LINUX_DRM_FOURCC_EXT;
     attrs[i++] = qemu_dmabuf_get_fourcc(dmabuf);
 
-    attrs[i++] = EGL_DMA_BUF_PLANE0_FD_EXT;
-    attrs[i++] = qemu_dmabuf_get_fds(dmabuf, NULL)[0];
-    attrs[i++] = EGL_DMA_BUF_PLANE0_PITCH_EXT;
-    attrs[i++] = qemu_dmabuf_get_strides(dmabuf, NULL)[0];
-    attrs[i++] = EGL_DMA_BUF_PLANE0_OFFSET_EXT;
-    attrs[i++] = 0;
-    if (modifier != DRM_FORMAT_MOD_INVALID) {
-        attrs[i++] = EGL_DMA_BUF_PLANE0_MODIFIER_LO_EXT;
-        attrs[i++] = (modifier >>  0) & 0xffffffff;
-        attrs[i++] = EGL_DMA_BUF_PLANE0_MODIFIER_HI_EXT;
-        attrs[i++] = (modifier >> 32) & 0xffffffff;
+    for (j = 0; j < num_planes; j++) {
+        attrs[i++] = fd_attrs[j];
+        /* fd[1-3] may be -1 if using a joint buffer for all planes */
+        attrs[i++] = fds[j] >= 0 ? fds[j] : fds[0];
+        attrs[i++] = stride_attrs[j];
+        attrs[i++] = strides[j];
+        attrs[i++] = offset_attrs[j];
+        attrs[i++] = offsets[j];
+        if (modifier != DRM_FORMAT_MOD_INVALID) {
+            attrs[i++] = modifier_lo_attrs[j];
+            attrs[i++] = (modifier >>  0) & 0xffffffff;
+            attrs[i++] = modifier_hi_attrs[j];
+            attrs[i++] = (modifier >> 32) & 0xffffffff;
+        }
     }
+
     attrs[i++] = EGL_NONE;
 
     image = eglCreateImageKHR(qemu_egl_display,
diff --git a/ui/spice-display.c b/ui/spice-display.c
index 40547edb5e..a9fee87a72 100644
--- a/ui/spice-display.c
+++ b/ui/spice-display.c
@@ -876,19 +876,24 @@ static void spice_gl_switch(DisplayChangeListener *dcl,
                             struct DisplaySurface *new_surface)
 {
     SimpleSpiceDisplay *ssd = container_of(dcl, SimpleSpiceDisplay, dcl);
-    EGLint stride, fourcc;
-    int fd;
 
     if (ssd->ds) {
         surface_gl_destroy_texture(ssd->gls, ssd->ds);
     }
     ssd->ds = new_surface;
     if (ssd->ds) {
+        uint32_t offset[DMABUF_MAX_PLANES], stride[DMABUF_MAX_PLANES];
+        int fd[DMABUF_MAX_PLANES], num_planes, fourcc;
+
         surface_gl_create_texture(ssd->gls, ssd->ds);
-        fd = egl_get_fd_for_texture(ssd->ds->texture,
-                                    &stride, &fourcc,
-                                    NULL);
-        if (fd < 0) {
+        if (!egl_dmabuf_export_texture(ssd->ds->texture, fd, (EGLint *)offset,
+                                       (EGLint *)stride, &fourcc, &num_planes, NULL)) {
+            surface_gl_destroy_texture(ssd->gls, ssd->ds);
+            return;
+        }
+
+        if (num_planes > 1) {
+            fprintf(stderr, "%s: does not support multi-plane texture\n", __func__);
             surface_gl_destroy_texture(ssd->gls, ssd->ds);
             return;
         }
@@ -899,10 +904,10 @@ static void spice_gl_switch(DisplayChangeListener *dcl,
                                     fourcc);
 
         /* note: spice server will close the fd */
-        spice_qxl_gl_scanout(&ssd->qxl, fd,
+        spice_qxl_gl_scanout(&ssd->qxl, fd[0],
                              surface_width(ssd->ds),
                              surface_height(ssd->ds),
-                             stride, fourcc, false);
+                             stride[0], fourcc, false);
         ssd->have_surface = true;
         ssd->have_scanout = false;
 
@@ -941,20 +946,24 @@ static void qemu_spice_gl_scanout_texture(DisplayChangeListener *dcl,
                                           void *d3d_tex2d)
 {
     SimpleSpiceDisplay *ssd = container_of(dcl, SimpleSpiceDisplay, dcl);
-    EGLint stride = 0, fourcc = 0;
-    int fd = -1;
+    EGLint offset[DMABUF_MAX_PLANES], stride[DMABUF_MAX_PLANES], fourcc = 0;
+    int fd[DMABUF_MAX_PLANES], num_planes;
 
     assert(tex_id);
-    fd = egl_get_fd_for_texture(tex_id, &stride, &fourcc, NULL);
-    if (fd < 0) {
-        fprintf(stderr, "%s: failed to get fd for texture\n", __func__);
+    if (!egl_dmabuf_export_texture(tex_id, fd, offset, stride, &fourcc,
+                                   &num_planes, NULL)) {
+        fprintf(stderr, "%s: failed to export dmabuf for texture\n", __func__);
+        return;
+    }
+    if (num_planes > 1) {
+        fprintf(stderr, "%s: does not support multi-plane dmabuf\n", __func__);
         return;
     }
     trace_qemu_spice_gl_scanout_texture(ssd->qxl.id, w, h, fourcc);
 
     /* note: spice server will close the fd */
-    spice_qxl_gl_scanout(&ssd->qxl, fd, backing_width, backing_height,
-                         stride, fourcc, y_0_top);
+    spice_qxl_gl_scanout(&ssd->qxl, fd[0], backing_width, backing_height,
+                         stride[0], fourcc, y_0_top);
     qemu_spice_gl_monitor_config(ssd, x, y, w, h);
     ssd->have_surface = false;
     ssd->have_scanout = true;
@@ -1064,15 +1073,28 @@ static void qemu_spice_gl_update(DisplayChangeListener *dcl,
             /* dest framebuffer */
             if (ssd->blit_fb.width  != width ||
                 ssd->blit_fb.height != height) {
+                int fds[DMABUF_MAX_PLANES], num_planes;
+                uint32_t offsets[DMABUF_MAX_PLANES], strides[DMABUF_MAX_PLANES];
+
                 trace_qemu_spice_gl_render_dmabuf(ssd->qxl.id, width,
                                                   height);
                 egl_fb_destroy(&ssd->blit_fb);
                 egl_fb_setup_new_tex(&ssd->blit_fb,
                                      width, height);
-                fd = egl_get_fd_for_texture(ssd->blit_fb.texture,
-                                            &stride, &fourcc, NULL);
-                spice_qxl_gl_scanout(&ssd->qxl, fd, width, height,
-                                     stride, fourcc, false);
+                if (!egl_dmabuf_export_texture(ssd->blit_fb.texture, fds,
+                                               (EGLint *)offsets, (EGLint *)strides,
+                                               &fourcc, &num_planes, NULL)) {
+                    fprintf(stderr,
+                            "%s: failed to export dmabuf for texture\n", __func__);
+                    return;
+                }
+                if (num_planes > 1) {
+                    fprintf(stderr,
+                            "%s: does not support multi-plane dmabuf\n", __func__);
+                    return;
+                }
+                spice_qxl_gl_scanout(&ssd->qxl, fds[0], width, height,
+                                     strides[0], fourcc, false);
             }
         } else {
             stride = qemu_dmabuf_get_strides(dmabuf, NULL)[0];

From 10aaad0edc7ff827f91583cd537b6f11b77e6e79 Mon Sep 17 00:00:00 2001
From: Qiang Yu <yuq825@gmail.com>
Date: Thu, 27 Mar 2025 10:58:47 +0800
Subject: [PATCH 0665/2760] ui/dbus: change dbus ScanoutDMABUF interface
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

To handle multi plane.

v3:
  * rename interface
  * add x/y/backing_width/backing_height arg

v2:
  * use new dmabuf API and check length

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Qiang Yu <yuq825@gmail.com>
Message-ID: <20250327025848.46962-6-yuq825@gmail.com>
[ Fix style ]
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 ui/dbus-display1.xml |  45 +++++++++++++++++
 ui/dbus-listener.c   | 114 ++++++++++++++++++++++++++++++++++++++++---
 2 files changed, 152 insertions(+), 7 deletions(-)

diff --git a/ui/dbus-display1.xml b/ui/dbus-display1.xml
index 72deefa455..4a41a7e0f3 100644
--- a/ui/dbus-display1.xml
+++ b/ui/dbus-display1.xml
@@ -614,6 +614,51 @@
     </method>
   </interface>
 
+  <!--
+      org.qemu.Display1.Listener.Unix.ScanoutDMABUF2:
+
+      This optional client-side interface can complement
+      org.qemu.Display1.Listener on ``/org/qemu/Display1/Listener`` for
+      Unix-specific DMABUF scanout setup which support multi plane.
+  -->
+  <?if $(env.HOST_OS) != windows?>
+  <interface name="org.qemu.Display1.Listener.Unix.ScanoutDMABUF2">
+    <!--
+        ScanoutDMABUF2:
+        @dmabuf: DMABUF file descriptor of each plane.
+        @x: display x offset, in pixels
+        @y: display y offset, in pixels
+        @width: display width, in pixels.
+        @height: display height, in pixels.
+        @offset: offset of each plane, in bytes.
+        @stride: stride of each plane, in bytes.
+        @num_planes: plane number.
+        @fourcc: DMABUF fourcc.
+        @backing_width: backing framebuffer width, in pixels
+        @backing_height: backing framebuffer height, in pixels
+        @modifier: DMABUF modifier.
+        @y0_top: whether Y position 0 is the top or not.
+
+        Resize and update the display content with DMABUF.
+    -->
+    <method name="ScanoutDMABUF2">
+      <arg type="ah" name="dmabuf" direction="in"/>
+      <arg type="u" name="x" direction="in"/>
+      <arg type="u" name="y" direction="in"/>
+      <arg type="u" name="width" direction="in"/>
+      <arg type="u" name="height" direction="in"/>
+      <arg type="au" name="offset" direction="in"/>
+      <arg type="au" name="stride" direction="in"/>
+      <arg type="u" name="num_planes" direction="in"/>
+      <arg type="u" name="fourcc" direction="in"/>
+      <arg type="u" name="backing_width" direction="in"/>
+      <arg type="u" name="backing_height" direction="in"/>
+      <arg type="t" name="modifier" direction="in"/>
+      <arg type="b" name="y0_top" direction="in"/>
+    </method>
+  </interface>
+  <?endif?>
+
   <!--
       org.qemu.Display1.Clipboard:
 
diff --git a/ui/dbus-listener.c b/ui/dbus-listener.c
index 90147972cd..42875b8eed 100644
--- a/ui/dbus-listener.c
+++ b/ui/dbus-listener.c
@@ -85,6 +85,7 @@ struct _DBusDisplayListener {
 #endif
 #else /* !WIN32 */
     QemuDBusDisplay1ListenerUnixMap *map_proxy;
+    QemuDBusDisplay1ListenerUnixScanoutDMABUF2 *scanout_dmabuf_v2_proxy;
 #endif
 
     guint dbus_filter;
@@ -288,10 +289,9 @@ static void dbus_call_update_gl(DisplayChangeListener *dcl,
 }
 
 #ifdef CONFIG_GBM
-static void dbus_scanout_dmabuf(DisplayChangeListener *dcl,
-                                QemuDmaBuf *dmabuf)
+static void dbus_scanout_dmabuf_v1(DBusDisplayListener *ddl,
+                                   QemuDmaBuf *dmabuf)
 {
-    DBusDisplayListener *ddl = container_of(dcl, DBusDisplayListener, dcl);
     g_autoptr(GError) err = NULL;
     g_autoptr(GUnixFDList) fd_list = NULL;
     int fd;
@@ -322,6 +322,87 @@ static void dbus_scanout_dmabuf(DisplayChangeListener *dcl,
         y0_top, G_DBUS_CALL_FLAGS_NONE,
         -1, fd_list, NULL, NULL, NULL);
 }
+
+static void dbus_scanout_dmabuf_v2(DBusDisplayListener *ddl,
+                                   QemuDmaBuf *dmabuf)
+{
+    g_autoptr(GError) err = NULL;
+    g_autoptr(GUnixFDList) fd_list = NULL;
+    int i, fd_index[DMABUF_MAX_PLANES], num_fds;
+    uint32_t x, y, width, height, fourcc, backing_width, backing_height;
+    GVariant *fd, *offset, *stride, *fd_handles[DMABUF_MAX_PLANES];
+    uint64_t modifier;
+    bool y0_top;
+    int nfds, noffsets, nstrides;
+    const int *fds = qemu_dmabuf_get_fds(dmabuf, &nfds);
+    const uint32_t *offsets = qemu_dmabuf_get_offsets(dmabuf, &noffsets);
+    const uint32_t *strides = qemu_dmabuf_get_strides(dmabuf, &nstrides);
+    uint32_t num_planes = qemu_dmabuf_get_num_planes(dmabuf);
+
+    assert(nfds >= num_planes);
+    assert(noffsets >= num_planes);
+    assert(nstrides >= num_planes);
+
+    fd_list = g_unix_fd_list_new();
+
+    for (num_fds = 0; num_fds < num_planes; num_fds++) {
+        int plane_fd = fds[num_fds];
+
+        if (plane_fd < 0) {
+            break;
+        }
+
+        fd_index[num_fds] = g_unix_fd_list_append(fd_list, plane_fd, &err);
+        if (fd_index[num_fds] < 0) {
+            error_report("Failed to setup dmabuf fdlist: %s", err->message);
+            return;
+        }
+    }
+
+    ddl_discard_display_messages(ddl);
+
+    x = qemu_dmabuf_get_x(dmabuf);
+    y = qemu_dmabuf_get_y(dmabuf);
+    width = qemu_dmabuf_get_width(dmabuf);
+    height = qemu_dmabuf_get_height(dmabuf);
+    fourcc = qemu_dmabuf_get_fourcc(dmabuf);
+    backing_width = qemu_dmabuf_get_backing_width(dmabuf);
+    backing_height = qemu_dmabuf_get_backing_height(dmabuf);
+    modifier = qemu_dmabuf_get_modifier(dmabuf);
+    y0_top = qemu_dmabuf_get_y0_top(dmabuf);
+
+    offset = g_variant_new_fixed_array(G_VARIANT_TYPE_UINT32,
+                                       offsets, num_planes, sizeof(uint32_t));
+    stride = g_variant_new_fixed_array(G_VARIANT_TYPE_UINT32,
+                                       strides, num_planes, sizeof(uint32_t));
+
+    for (i = 0; i < num_fds; i++) {
+        fd_handles[i] = g_variant_new_handle(fd_index[i]);
+    }
+    fd = g_variant_new_array(G_VARIANT_TYPE_HANDLE, fd_handles, num_fds);
+
+    qemu_dbus_display1_listener_unix_scanout_dmabuf2_call_scanout_dmabuf2(
+        ddl->scanout_dmabuf_v2_proxy, fd, x, y, width, height, offset, stride,
+        num_planes, fourcc, backing_width, backing_height, modifier, y0_top,
+        G_DBUS_CALL_FLAGS_NONE, -1, fd_list, NULL, NULL, NULL);
+}
+
+static void dbus_scanout_dmabuf(DisplayChangeListener *dcl,
+                                QemuDmaBuf *dmabuf)
+{
+    DBusDisplayListener *ddl = container_of(dcl, DBusDisplayListener, dcl);
+
+    if (ddl->scanout_dmabuf_v2_proxy) {
+        dbus_scanout_dmabuf_v2(ddl, dmabuf);
+    } else {
+        if (qemu_dmabuf_get_num_planes(dmabuf) > 1) {
+            g_debug("org.qemu.Display1.Listener.ScanoutDMABUF "
+                    "does not support mutli plane");
+            return;
+        }
+        dbus_scanout_dmabuf_v1(ddl, dmabuf);
+    }
+}
 #endif /* GBM */
 #endif /* OPENGL */
 
@@ -514,10 +595,6 @@ static void dbus_scanout_texture(DisplayChangeListener *dcl,
         error_report("%s: failed to export dmabuf for texture", __func__);
         return;
     }
-    if (num_planes > 1) {
-        error_report("%s: does not support multi-plane dmabuf", __func__);
-        return;
-    }
     dmabuf = qemu_dmabuf_new(w, h, offset, stride, x, y, backing_width,
                              backing_height, fourcc, modifier, fd, num_planes,
                              false, backing_y_0_top);
@@ -886,6 +963,8 @@ dbus_display_listener_dispose(GObject *object)
 #ifdef CONFIG_OPENGL
     egl_fb_destroy(&ddl->fb);
 #endif
+#else /* !WIN32 */
+    g_clear_object(&ddl->scanout_dmabuf_v2_proxy);
 #endif
 
     G_OBJECT_CLASS(dbus_display_listener_parent_class)->dispose(object);
@@ -1074,6 +1153,26 @@ dbus_display_listener_setup_shared_map(DBusDisplayListener *ddl)
 #endif
 }
 
+static void dbus_display_listener_setup_scanout_dmabuf_v2(DBusDisplayListener *ddl)
+{
+#ifndef WIN32
+    g_autoptr(GError) err = NULL;
+
+    if (!dbus_display_listener_implements(
+            ddl, "org.qemu.Display1.Listener.Unix.ScanoutDMABUF2")) {
+        return;
+    }
+    ddl->scanout_dmabuf_v2_proxy =
+        qemu_dbus_display1_listener_unix_scanout_dmabuf2_proxy_new_sync(
+            ddl->conn, G_DBUS_PROXY_FLAGS_DO_NOT_AUTO_START, NULL,
+            "/org/qemu/Display1/Listener", NULL, &err);
+    if (!ddl->scanout_dmabuf_v2_proxy) {
+        g_debug("Failed to setup Unix scanout dmabuf v2 proxy: %s", err->message);
+        return;
+    }
+#endif
+}
+
 static GDBusMessage *
 dbus_filter(GDBusConnection *connection,
             GDBusMessage    *message,
@@ -1162,6 +1261,7 @@ dbus_display_listener_new(const char *bus_name,
     dbus_display_listener_setup_shared_map(ddl);
     trace_dbus_can_share_map(ddl->can_share_map);
     dbus_display_listener_setup_d3d11(ddl);
+    dbus_display_listener_setup_scanout_dmabuf_v2(ddl);
 
     con = qemu_console_lookup_by_index(dbus_display_console_get_index(console));
     assert(con);

From 98a050ca93afd8686b78c3a71cbeef23e0bc420b Mon Sep 17 00:00:00 2001
From: Qiang Yu <yuq825@gmail.com>
Date: Thu, 27 Mar 2025 10:58:48 +0800
Subject: [PATCH 0666/2760] ui/spice: support multi plane dmabuf scanout
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We need spice version >= 0.15.3 which has spice_qxl_gl_scanout2
API for multi plane scanout support.

v2:
  * use new dmabuf API and check length
  * check spice_qxl_gl_scanout2 present instead of
    bump spice version dependency

Signed-off-by: Qiang Yu <yuq825@gmail.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Tested-by: Marc-André Lureau <marcandre.lureau@redhat.com>
[ Fix style ]
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-ID: <20250327025848.46962-7-yuq825@gmail.com>
---
 meson.build        |  5 +++
 ui/spice-display.c | 98 ++++++++++++++++++++++++++++++----------------
 2 files changed, 69 insertions(+), 34 deletions(-)

diff --git a/meson.build b/meson.build
index 8ae70dbe45..9831f0bd71 100644
--- a/meson.build
+++ b/meson.build
@@ -3168,6 +3168,11 @@ if host_os == 'windows'
     }''', name: '_lock_file and _unlock_file'))
 endif
 
+if spice.found()
+  config_host_data.set('HAVE_SPICE_QXL_GL_SCANOUT2',
+    cc.has_function('spice_qxl_gl_scanout2', dependencies: spice))
+endif
+
 if host_os == 'windows'
   mingw_has_setjmp_longjmp = cc.links('''
     #include <setjmp.h>
diff --git a/ui/spice-display.c b/ui/spice-display.c
index a9fee87a72..9c39d2c5c8 100644
--- a/ui/spice-display.c
+++ b/ui/spice-display.c
@@ -28,6 +28,8 @@
 
 #include "ui/spice-display.h"
 
+#include "standard-headers/drm/drm_fourcc.h"
+
 bool spice_opengl;
 
 int qemu_spice_rect_is_empty(const QXLRect* r)
@@ -872,6 +874,26 @@ static void spice_gl_update(DisplayChangeListener *dcl,
     ssd->gl_updates++;
 }
 
+static void spice_server_gl_scanout(QXLInstance *qxl,
+                                    const int *fd,
+                                    uint32_t width, uint32_t height,
+                                    const uint32_t *offset,
+                                    const uint32_t *stride,
+                                    uint32_t num_planes, uint32_t format,
+                                    uint64_t modifier, int y_0_top)
+{
+#ifdef HAVE_SPICE_QXL_GL_SCANOUT2
+    spice_qxl_gl_scanout2(qxl, fd, width, height, offset, stride,
+                          num_planes, format, modifier, y_0_top);
+#else
+    if (num_planes <= 1) {
+        spice_qxl_gl_scanout(qxl, fd[0], width, height, stride[0], format, y_0_top);
+    } else {
+        error_report("SPICE server does not support multi plane GL scanout");
+    }
+#endif
+}
+
 static void spice_gl_switch(DisplayChangeListener *dcl,
                             struct DisplaySurface *new_surface)
 {
@@ -884,16 +906,16 @@ static void spice_gl_switch(DisplayChangeListener *dcl,
     if (ssd->ds) {
         uint32_t offset[DMABUF_MAX_PLANES], stride[DMABUF_MAX_PLANES];
         int fd[DMABUF_MAX_PLANES], num_planes, fourcc;
+        uint64_t modifier;
 
         surface_gl_create_texture(ssd->gls, ssd->ds);
-        if (!egl_dmabuf_export_texture(ssd->ds->texture, fd, (EGLint *)offset,
-                                       (EGLint *)stride, &fourcc, &num_planes, NULL)) {
-            surface_gl_destroy_texture(ssd->gls, ssd->ds);
-            return;
-        }
-
-        if (num_planes > 1) {
-            fprintf(stderr, "%s: does not support multi-plane texture\n", __func__);
+        if (!egl_dmabuf_export_texture(ssd->ds->texture,
+                                       fd,
+                                       (EGLint *)offset,
+                                       (EGLint *)stride,
+                                       &fourcc,
+                                       &num_planes,
+                                       &modifier)) {
             surface_gl_destroy_texture(ssd->gls, ssd->ds);
             return;
         }
@@ -904,10 +926,11 @@ static void spice_gl_switch(DisplayChangeListener *dcl,
                                     fourcc);
 
         /* note: spice server will close the fd */
-        spice_qxl_gl_scanout(&ssd->qxl, fd[0],
-                             surface_width(ssd->ds),
-                             surface_height(ssd->ds),
-                             stride[0], fourcc, false);
+        spice_server_gl_scanout(&ssd->qxl, fd,
+                                surface_width(ssd->ds),
+                                surface_height(ssd->ds),
+                                offset, stride, num_planes,
+                                fourcc, modifier, false);
         ssd->have_surface = true;
         ssd->have_scanout = false;
 
@@ -930,7 +953,8 @@ static void qemu_spice_gl_scanout_disable(DisplayChangeListener *dcl)
     SimpleSpiceDisplay *ssd = container_of(dcl, SimpleSpiceDisplay, dcl);
 
     trace_qemu_spice_gl_scanout_disable(ssd->qxl.id);
-    spice_qxl_gl_scanout(&ssd->qxl, -1, 0, 0, 0, 0, false);
+    spice_server_gl_scanout(&ssd->qxl, NULL, 0, 0, NULL, NULL, 0, DRM_FORMAT_INVALID,
+                            DRM_FORMAT_MOD_INVALID, false);
     qemu_spice_gl_monitor_config(ssd, 0, 0, 0, 0);
     ssd->have_surface = false;
     ssd->have_scanout = false;
@@ -948,22 +972,21 @@ static void qemu_spice_gl_scanout_texture(DisplayChangeListener *dcl,
     SimpleSpiceDisplay *ssd = container_of(dcl, SimpleSpiceDisplay, dcl);
     EGLint offset[DMABUF_MAX_PLANES], stride[DMABUF_MAX_PLANES], fourcc = 0;
     int fd[DMABUF_MAX_PLANES], num_planes;
+    uint64_t modifier;
 
     assert(tex_id);
     if (!egl_dmabuf_export_texture(tex_id, fd, offset, stride, &fourcc,
-                                   &num_planes, NULL)) {
+                                   &num_planes, &modifier)) {
         fprintf(stderr, "%s: failed to export dmabuf for texture\n", __func__);
         return;
     }
-    if (num_planes > 1) {
-        fprintf(stderr, "%s: does not support multi-plane dmabuf\n", __func__);
-        return;
-    }
+
     trace_qemu_spice_gl_scanout_texture(ssd->qxl.id, w, h, fourcc);
 
     /* note: spice server will close the fd */
-    spice_qxl_gl_scanout(&ssd->qxl, fd[0], backing_width, backing_height,
-                         stride[0], fourcc, y_0_top);
+    spice_server_gl_scanout(&ssd->qxl, fd, backing_width, backing_height,
+                            (uint32_t *)offset, (uint32_t *)stride, num_planes,
+                            fourcc, modifier, y_0_top);
     qemu_spice_gl_monitor_config(ssd, x, y, w, h);
     ssd->have_surface = false;
     ssd->have_scanout = true;
@@ -1034,11 +1057,10 @@ static void qemu_spice_gl_update(DisplayChangeListener *dcl,
                                  uint32_t x, uint32_t y, uint32_t w, uint32_t h)
 {
     SimpleSpiceDisplay *ssd = container_of(dcl, SimpleSpiceDisplay, dcl);
-    EGLint stride = 0, fourcc = 0;
+    EGLint fourcc = 0;
     bool render_cursor = false;
     bool y_0_top = false; /* FIXME */
     uint64_t cookie;
-    int fd;
     uint32_t width, height, texture;
 
     if (!ssd->have_scanout) {
@@ -1075,6 +1097,7 @@ static void qemu_spice_gl_update(DisplayChangeListener *dcl,
                 ssd->blit_fb.height != height) {
                 int fds[DMABUF_MAX_PLANES], num_planes;
                 uint32_t offsets[DMABUF_MAX_PLANES], strides[DMABUF_MAX_PLANES];
+                uint64_t modifier;
 
                 trace_qemu_spice_gl_render_dmabuf(ssd->qxl.id, width,
                                                   height);
@@ -1083,29 +1106,36 @@ static void qemu_spice_gl_update(DisplayChangeListener *dcl,
                                      width, height);
                 if (!egl_dmabuf_export_texture(ssd->blit_fb.texture, fds,
                                                (EGLint *)offsets, (EGLint *)strides,
-                                               &fourcc, &num_planes, NULL)) {
+                                               &fourcc, &num_planes, &modifier)) {
                     fprintf(stderr,
                             "%s: failed to export dmabuf for texture\n", __func__);
                     return;
                 }
-                if (num_planes > 1) {
-                    fprintf(stderr,
-                            "%s: does not support multi-plane dmabuf\n", __func__);
-                    return;
-                }
-                spice_qxl_gl_scanout(&ssd->qxl, fds[0], width, height,
-                                     strides[0], fourcc, false);
+
+                spice_server_gl_scanout(&ssd->qxl, fds, width, height, offsets, strides,
+                                        num_planes, fourcc, modifier, false);
             }
         } else {
-            stride = qemu_dmabuf_get_strides(dmabuf, NULL)[0];
+            int fds[DMABUF_MAX_PLANES];
+            int noffsets, nstrides;
+            const uint32_t *offsets = qemu_dmabuf_get_offsets(dmabuf, &noffsets);
+            const uint32_t *strides = qemu_dmabuf_get_strides(dmabuf, &nstrides);
+            uint32_t num_planes = qemu_dmabuf_get_num_planes(dmabuf);
+
+            assert(noffsets >= num_planes);
+            assert(nstrides >= num_planes);
+
             fourcc = qemu_dmabuf_get_fourcc(dmabuf);
             y_0_top = qemu_dmabuf_get_y0_top(dmabuf);
-            qemu_dmabuf_dup_fds(dmabuf, &fd, 1);
+            qemu_dmabuf_dup_fds(dmabuf, fds, DMABUF_MAX_PLANES);
 
             trace_qemu_spice_gl_forward_dmabuf(ssd->qxl.id, width, height);
             /* note: spice server will close the fd, so hand over a dup */
-            spice_qxl_gl_scanout(&ssd->qxl, fd, width, height,
-                                 stride, fourcc, y_0_top);
+            spice_server_gl_scanout(&ssd->qxl, fds, width, height,
+                                    offsets, strides, num_planes,
+                                    fourcc,
+                                    qemu_dmabuf_get_modifier(dmabuf),
+                                    y_0_top);
         }
         qemu_spice_gl_monitor_config(ssd, 0, 0, width, height);
         ssd->guest_dmabuf_refresh = false;

From 97cdd1b0a7a010702a1d118b74c3af3bb2edb35c Mon Sep 17 00:00:00 2001
From: Tim Lee <timlee660101@gmail.com>
Date: Mon, 28 Apr 2025 10:29:34 +0800
Subject: [PATCH 0667/2760] hw/arm/npcm8xx_boards: Correct valid_cpu_types
 setting of NPCM8XX SoC

NPCM8XX SoC is the successor of the NPCM7XX. It features quad-core
Cortex-A35 (Armv8, 64-bit) CPUs and some additional peripherals.
Correct the `valid_cpu_types` setting to match the NPCM8XX SoC.

Cc: qemu-stable@nongnu.org
Fixes: 7e70eb3cad7c83 ("hw/arm: Add NPCM845 Evaluation board")
Signed-off-by: Tim Lee <timlee660101@gmail.com>
Message-id: 20250428022934.3081139-1-timlee660101@gmail.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Tyrone Ting <kfting@nuvoton.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/npcm8xx_boards.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/arm/npcm8xx_boards.c b/hw/arm/npcm8xx_boards.c
index 9d9f6d0c9a..3bf3e1f8f1 100644
--- a/hw/arm/npcm8xx_boards.c
+++ b/hw/arm/npcm8xx_boards.c
@@ -213,7 +213,7 @@ static void npcm8xx_machine_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     static const char * const valid_cpu_types[] = {
-        ARM_CPU_TYPE_NAME("cortex-a9"),
+        ARM_CPU_TYPE_NAME("cortex-a35"),
         NULL
     };
 

From 90f0078d023fc364c870188075f530f84f652758 Mon Sep 17 00:00:00 2001
From: Mads Ynddal <m.ynddal@samsung.com>
Date: Wed, 2 Apr 2025 15:52:28 +0200
Subject: [PATCH 0668/2760] hvf: avoid repeatedly setting trap debug for each
 cpu
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

hvf_arch_set_traps is already called from a context of a specific
CPUState, so we don't need to do a nested CPU_FOREACH.

It also results in an error from hv_vcpu_set_sys_reg, as it may only be
called from the thread owning the vCPU.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2895
Tested-by: Daniel Gomez <da.gomez@samsung.com>
Signed-off-by: Mads Ynddal <m.ynddal@samsung.com>
Reported-by: Daniel Gomez <da.gomez@samsung.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20250402135229.28143-2-mads@ynddal.dk
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/hvf/hvf.c | 27 +++++++++++----------------
 1 file changed, 11 insertions(+), 16 deletions(-)

diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index 34ca36fab5..42258cc2d8 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -2278,28 +2278,23 @@ static inline bool hvf_arm_hw_debug_active(CPUState *cpu)
     return ((cur_hw_wps > 0) || (cur_hw_bps > 0));
 }
 
-static void hvf_arch_set_traps(void)
+static void hvf_arch_set_traps(CPUState *cpu)
 {
-    CPUState *cpu;
     bool should_enable_traps = false;
     hv_return_t r = HV_SUCCESS;
 
     /* Check whether guest debugging is enabled for at least one vCPU; if it
      * is, enable exiting the guest on all vCPUs */
-    CPU_FOREACH(cpu) {
-        should_enable_traps |= cpu->accel->guest_debug_enabled;
-    }
-    CPU_FOREACH(cpu) {
-        /* Set whether debug exceptions exit the guest */
-        r = hv_vcpu_set_trap_debug_exceptions(cpu->accel->fd,
-                                              should_enable_traps);
-        assert_hvf_ok(r);
+    should_enable_traps |= cpu->accel->guest_debug_enabled;
+    /* Set whether debug exceptions exit the guest */
+    r = hv_vcpu_set_trap_debug_exceptions(cpu->accel->fd,
+                                            should_enable_traps);
+    assert_hvf_ok(r);
 
-        /* Set whether accesses to debug registers exit the guest */
-        r = hv_vcpu_set_trap_debug_reg_accesses(cpu->accel->fd,
-                                                should_enable_traps);
-        assert_hvf_ok(r);
-    }
+    /* Set whether accesses to debug registers exit the guest */
+    r = hv_vcpu_set_trap_debug_reg_accesses(cpu->accel->fd,
+                                            should_enable_traps);
+    assert_hvf_ok(r);
 }
 
 void hvf_arch_update_guest_debug(CPUState *cpu)
@@ -2340,7 +2335,7 @@ void hvf_arch_update_guest_debug(CPUState *cpu)
             deposit64(env->cp15.mdscr_el1, MDSCR_EL1_MDE_SHIFT, 1, 0);
     }
 
-    hvf_arch_set_traps();
+    hvf_arch_set_traps(cpu);
 }
 
 bool hvf_arch_supports_guest_debug(void)

From d5bd8d8267eba7379d94e0c2e46e54dd475d9886 Mon Sep 17 00:00:00 2001
From: Mads Ynddal <m.ynddal@samsung.com>
Date: Wed, 2 Apr 2025 15:52:29 +0200
Subject: [PATCH 0669/2760] hvf: only update sysreg from owning thread
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

hv_vcpu_set_sys_reg should only be called from the owning thread of the
vCPU, so to avoid crashes, the call to hvf_update_guest_debug is
dispatched to the individual threads.

Tested-by: Daniel Gomez <da.gomez@samsung.com>
Signed-off-by: Mads Ynddal <m.ynddal@samsung.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20250402135229.28143-3-mads@ynddal.dk
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 accel/hvf/hvf-all.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/accel/hvf/hvf-all.c b/accel/hvf/hvf-all.c
index d404e01ade..3fc65d6b23 100644
--- a/accel/hvf/hvf-all.c
+++ b/accel/hvf/hvf-all.c
@@ -58,8 +58,13 @@ int hvf_sw_breakpoints_active(CPUState *cpu)
     return !QTAILQ_EMPTY(&hvf_state->hvf_sw_breakpoints);
 }
 
-int hvf_update_guest_debug(CPUState *cpu)
+static void do_hvf_update_guest_debug(CPUState *cpu, run_on_cpu_data arg)
 {
     hvf_arch_update_guest_debug(cpu);
+}
+
+int hvf_update_guest_debug(CPUState *cpu)
+{
+    run_on_cpu(cpu, do_hvf_update_guest_debug, RUN_ON_CPU_NULL);
     return 0;
 }

From e47a9e886f2df1c8aae47dae03f07d417bb73dd5 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 14 Apr 2025 08:30:24 -0700
Subject: [PATCH 0670/2760] target/arm/ptw: extract
 arm_mmu_idx_to_security_space
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We'll reuse this function later.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-id: 20250414153027.1486719-2-pierrick.bouvier@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 21 ++++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index e0e82ae507..bdb4de7c04 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -3551,13 +3551,9 @@ bool get_phys_addr_with_space_nogpc(CPUARMState *env, vaddr address,
                                memop, result, fi);
 }
 
-bool get_phys_addr(CPUARMState *env, vaddr address,
-                   MMUAccessType access_type, MemOp memop, ARMMMUIdx mmu_idx,
-                   GetPhysAddrResult *result, ARMMMUFaultInfo *fi)
+static ARMSecuritySpace
+arm_mmu_idx_to_security_space(CPUARMState *env, ARMMMUIdx mmu_idx)
 {
-    S1Translate ptw = {
-        .in_mmu_idx = mmu_idx,
-    };
     ARMSecuritySpace ss;
 
     switch (mmu_idx) {
@@ -3618,7 +3614,18 @@ bool get_phys_addr(CPUARMState *env, vaddr address,
         g_assert_not_reached();
     }
 
-    ptw.in_space = ss;
+    return ss;
+}
+
+bool get_phys_addr(CPUARMState *env, vaddr address,
+                   MMUAccessType access_type, MemOp memop, ARMMMUIdx mmu_idx,
+                   GetPhysAddrResult *result, ARMMMUFaultInfo *fi)
+{
+    S1Translate ptw = {
+        .in_mmu_idx = mmu_idx,
+        .in_space = arm_mmu_idx_to_security_space(env, mmu_idx),
+    };
+
     return get_phys_addr_gpc(env, &ptw, address, access_type,
                              memop, result, fi);
 }

From b6af88fafa586b1571b0db7f00356ad65a713061 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 14 Apr 2025 08:30:25 -0700
Subject: [PATCH 0671/2760] target/arm/ptw: get current security_space for
 current mmu_idx

It should be equivalent to previous code.
Allow to call common function to get a page address later.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-id: 20250414153027.1486719-3-pierrick.bouvier@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index bdb4de7c04..0ae9c5a3f4 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -3636,7 +3636,7 @@ hwaddr arm_cpu_get_phys_page_attrs_debug(CPUState *cs, vaddr addr,
     ARMCPU *cpu = ARM_CPU(cs);
     CPUARMState *env = &cpu->env;
     ARMMMUIdx mmu_idx = arm_mmu_idx(env);
-    ARMSecuritySpace ss = arm_security_space(env);
+    ARMSecuritySpace ss = arm_mmu_idx_to_security_space(env, mmu_idx);
     S1Translate ptw = {
         .in_mmu_idx = mmu_idx,
         .in_space = ss,

From 63201878f1cab185110f4d738ca41e05689aebd7 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 14 Apr 2025 08:30:26 -0700
Subject: [PATCH 0672/2760] target/arm/ptw: extract arm_cpu_get_phys_page
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Allow to call that function easily several times in next commit.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-id: 20250414153027.1486719-4-pierrick.bouvier@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 24 ++++++++++++++----------
 1 file changed, 14 insertions(+), 10 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index 0ae9c5a3f4..3e00e4a8bb 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -3630,23 +3630,17 @@ bool get_phys_addr(CPUARMState *env, vaddr address,
                              memop, result, fi);
 }
 
-hwaddr arm_cpu_get_phys_page_attrs_debug(CPUState *cs, vaddr addr,
-                                         MemTxAttrs *attrs)
+static hwaddr arm_cpu_get_phys_page(CPUARMState *env, vaddr addr,
+                                    MemTxAttrs *attrs, ARMMMUIdx mmu_idx)
 {
-    ARMCPU *cpu = ARM_CPU(cs);
-    CPUARMState *env = &cpu->env;
-    ARMMMUIdx mmu_idx = arm_mmu_idx(env);
-    ARMSecuritySpace ss = arm_mmu_idx_to_security_space(env, mmu_idx);
     S1Translate ptw = {
         .in_mmu_idx = mmu_idx,
-        .in_space = ss,
+        .in_space = arm_mmu_idx_to_security_space(env, mmu_idx),
         .in_debug = true,
     };
     GetPhysAddrResult res = {};
     ARMMMUFaultInfo fi = {};
-    bool ret;
-
-    ret = get_phys_addr_gpc(env, &ptw, addr, MMU_DATA_LOAD, 0, &res, &fi);
+    bool ret = get_phys_addr_gpc(env, &ptw, addr, MMU_DATA_LOAD, 0, &res, &fi);
     *attrs = res.f.attrs;
 
     if (ret) {
@@ -3654,3 +3648,13 @@ hwaddr arm_cpu_get_phys_page_attrs_debug(CPUState *cs, vaddr addr,
     }
     return res.f.phys_addr;
 }
+
+hwaddr arm_cpu_get_phys_page_attrs_debug(CPUState *cs, vaddr addr,
+                                         MemTxAttrs *attrs)
+{
+    ARMCPU *cpu = ARM_CPU(cs);
+    CPUARMState *env = &cpu->env;
+    ARMMMUIdx mmu_idx = arm_mmu_idx(env);
+
+    return arm_cpu_get_phys_page(env, addr, attrs, mmu_idx);
+}

From e1781b38af5e5c2e8a4b8f11e3e54de393a82eb2 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 14 Apr 2025 08:30:27 -0700
Subject: [PATCH 0673/2760] target/arm/ptw: fix
 arm_cpu_get_phys_page_attrs_debug

It was reported that QEMU monitor command gva2gpa was reporting unmapped
memory for a valid access (qemu-system-aarch64), during a copy from
kernel to user space (__arch_copy_to_user symbol in Linux) [1].
This was affecting cpu_memory_rw_debug also, which
is used in numerous places in our codebase. After investigating, the
problem was specific to arm_cpu_get_phys_page_attrs_debug.

When performing user access from a privileged space, we need to do a
second lookup for user mmu idx, following what get_a64_user_mem_index is
doing at translation time.

[1] https://lists.nongnu.org/archive/html/qemu-discuss/2025-04/msg00013.html

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-id: 20250414153027.1486719-5-pierrick.bouvier@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 22 +++++++++++++++++++++-
 1 file changed, 21 insertions(+), 1 deletion(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index 3e00e4a8bb..d0a53d0987 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -3656,5 +3656,25 @@ hwaddr arm_cpu_get_phys_page_attrs_debug(CPUState *cs, vaddr addr,
     CPUARMState *env = &cpu->env;
     ARMMMUIdx mmu_idx = arm_mmu_idx(env);
 
-    return arm_cpu_get_phys_page(env, addr, attrs, mmu_idx);
+    hwaddr res = arm_cpu_get_phys_page(env, addr, attrs, mmu_idx);
+
+    if (res != -1) {
+        return res;
+    }
+
+    /*
+     * Memory may be accessible for an "unprivileged load/store" variant.
+     * In this case, get_a64_user_mem_index function generates an op using an
+     * unprivileged mmu idx, so we need to try with it.
+     */
+    switch (mmu_idx) {
+    case ARMMMUIdx_E10_1:
+    case ARMMMUIdx_E10_1_PAN:
+        return arm_cpu_get_phys_page(env, addr, attrs, ARMMMUIdx_E10_0);
+    case ARMMMUIdx_E20_2:
+    case ARMMMUIdx_E20_2_PAN:
+        return arm_cpu_get_phys_page(env, addr, attrs, ARMMMUIdx_E20_0);
+    default:
+        return -1;
+    }
 }

From 1731ec33c38ccc9b7629182e896737d2e31789c0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 16 Jan 2025 15:59:32 +0100
Subject: [PATCH 0674/2760] hw/arm/virt: Remove deprecated virt-2.6 machine
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This machine has been supported for a period of more than 6 years.
According to our versioned machine support policy (see commit
ce80c4fa6ff "docs: document special exception for machine type
deprecation & removal") it can now be removed.

Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c | 12 ------------
 1 file changed, 12 deletions(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index 177f3dd22c..17a88aa9b2 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -3667,15 +3667,3 @@ static void virt_machine_2_7_options(MachineClass *mc)
     mc->minimum_page_bits = 0;
 }
 DEFINE_VIRT_MACHINE(2, 7)
-
-static void virt_machine_2_6_options(MachineClass *mc)
-{
-    VirtMachineClass *vmc = VIRT_MACHINE_CLASS(OBJECT_CLASS(mc));
-
-    virt_machine_2_7_options(mc);
-    compat_props_add(mc->compat_props, hw_compat_2_6, hw_compat_2_6_len);
-    vmc->disallow_affinity_adjustment = true;
-    /* Disable PMU for 2.6 as PMU support was first introduced in 2.7 */
-    vmc->no_pmu = true;
-}
-DEFINE_VIRT_MACHINE(2, 6)

From 514712d5277de5237a49a4852f0f90c51696f94c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 16 Jan 2025 15:59:33 +0100
Subject: [PATCH 0675/2760] hw/arm/virt: Remove VirtMachineClass::no_pmu field
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The VirtMachineClass::no_pmu field was only used by
virt-2.6 machine, which got removed. Remove it and
simplify machvirt_init().

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c         | 4 ----
 include/hw/arm/virt.h | 1 -
 2 files changed, 5 deletions(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index 17a88aa9b2..e82b8a4566 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -2273,10 +2273,6 @@ static void machvirt_init(MachineState *machine)
             object_property_set_bool(cpuobj, "kvm-steal-time", false, NULL);
         }
 
-        if (vmc->no_pmu && object_property_find(cpuobj, "pmu")) {
-            object_property_set_bool(cpuobj, "pmu", false, NULL);
-        }
-
         if (vmc->no_tcg_lpa2 && object_property_find(cpuobj, "lpa2")) {
             object_property_set_bool(cpuobj, "lpa2", false, NULL);
         }
diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
index c8e94e6aed..27c5bb585c 100644
--- a/include/hw/arm/virt.h
+++ b/include/hw/arm/virt.h
@@ -120,7 +120,6 @@ struct VirtMachineClass {
     bool disallow_affinity_adjustment;
     bool no_its;
     bool no_tcg_its;
-    bool no_pmu;
     bool claim_edge_triggered_timers;
     bool smbios_old_sys_ver;
     bool no_highmem_compact;

From 7f48918a372120a63f18712aa27de5e13b76bbf7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 16 Jan 2025 15:59:34 +0100
Subject: [PATCH 0676/2760] hw/arm/virt: Remove
 VirtMachineClass::disallow_affinity_adjustment
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The VirtMachineClass::disallow_affinity_adjustment
field was only used by virt-2.6 machine, which got
removed. Remove it and simplify virt_cpu_mp_affinity().

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
[PMM: Remove now-unused variable]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c         | 31 +++++++++++++++----------------
 include/hw/arm/virt.h |  1 -
 2 files changed, 15 insertions(+), 17 deletions(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index e82b8a4566..9d82cf78b0 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -1770,24 +1770,23 @@ void virt_machine_done(Notifier *notifier, void *data)
 
 static uint64_t virt_cpu_mp_affinity(VirtMachineState *vms, int idx)
 {
-    uint8_t clustersz = ARM_DEFAULT_CPUS_PER_CLUSTER;
-    VirtMachineClass *vmc = VIRT_MACHINE_GET_CLASS(vms);
+    uint8_t clustersz;
 
-    if (!vmc->disallow_affinity_adjustment) {
-        /* Adjust MPIDR like 64-bit KVM hosts, which incorporate the
-         * GIC's target-list limitations. 32-bit KVM hosts currently
-         * always create clusters of 4 CPUs, but that is expected to
-         * change when they gain support for gicv3. When KVM is enabled
-         * it will override the changes we make here, therefore our
-         * purposes are to make TCG consistent (with 64-bit KVM hosts)
-         * and to improve SGI efficiency.
-         */
-        if (vms->gic_version == VIRT_GIC_VERSION_2) {
-            clustersz = GIC_TARGETLIST_BITS;
-        } else {
-            clustersz = GICV3_TARGETLIST_BITS;
-        }
+    /*
+     * Adjust MPIDR like 64-bit KVM hosts, which incorporate the
+     * GIC's target-list limitations. 32-bit KVM hosts currently
+     * always create clusters of 4 CPUs, but that is expected to
+     * change when they gain support for gicv3. When KVM is enabled
+     * it will override the changes we make here, therefore our
+     * purposes are to make TCG consistent (with 64-bit KVM hosts)
+     * and to improve SGI efficiency.
+     */
+    if (vms->gic_version == VIRT_GIC_VERSION_2) {
+        clustersz = GIC_TARGETLIST_BITS;
+    } else {
+        clustersz = GICV3_TARGETLIST_BITS;
     }
+
     return arm_build_mp_affinity(idx, clustersz);
 }
 
diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
index 27c5bb585c..5d3b25509f 100644
--- a/include/hw/arm/virt.h
+++ b/include/hw/arm/virt.h
@@ -117,7 +117,6 @@ typedef enum VirtGICType {
 
 struct VirtMachineClass {
     MachineClass parent;
-    bool disallow_affinity_adjustment;
     bool no_its;
     bool no_tcg_its;
     bool claim_edge_triggered_timers;

From 390becbf7faa8e7ecb10386ec21d52e1fcb16c96 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 16 Jan 2025 15:59:35 +0100
Subject: [PATCH 0677/2760] hw/arm/virt: Remove deprecated virt-2.7 machine
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This machine has been supported for a period of more than 6 years.
According to our versioned machine support policy (see commit
ce80c4fa6ff "docs: document special exception for machine type
deprecation & removal") it can now be removed.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c | 13 -------------
 1 file changed, 13 deletions(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index 9d82cf78b0..a2a213717c 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -3649,16 +3649,3 @@ static void virt_machine_2_8_options(MachineClass *mc)
     vmc->claim_edge_triggered_timers = true;
 }
 DEFINE_VIRT_MACHINE(2, 8)
-
-static void virt_machine_2_7_options(MachineClass *mc)
-{
-    VirtMachineClass *vmc = VIRT_MACHINE_CLASS(OBJECT_CLASS(mc));
-
-    virt_machine_2_8_options(mc);
-    compat_props_add(mc->compat_props, hw_compat_2_7, hw_compat_2_7_len);
-    /* ITS was introduced with 2.8 */
-    vmc->no_its = true;
-    /* Stick with 1K pages for migration compatibility */
-    mc->minimum_page_bits = 0;
-}
-DEFINE_VIRT_MACHINE(2, 7)

From 8d23b1df72124d82441f1ca0b484b7a4cabc542e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 16 Jan 2025 15:59:36 +0100
Subject: [PATCH 0678/2760] hw/arm/virt: Remove VirtMachineClass::no_its field
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The VirtMachineClass::no_its field was only used by
virt-2.7 machine, which got removed. Remove it and
simplify virt_instance_init() and virt_acpi_build().

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt-acpi-build.c |  5 ++---
 hw/arm/virt.c            | 16 ++++++----------
 include/hw/arm/virt.h    |  1 -
 3 files changed, 8 insertions(+), 14 deletions(-)

diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
index 3ac8f8e178..1c8b61f9f8 100644
--- a/hw/arm/virt-acpi-build.c
+++ b/hw/arm/virt-acpi-build.c
@@ -670,7 +670,6 @@ static void
 build_madt(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
 {
     int i;
-    VirtMachineClass *vmc = VIRT_MACHINE_GET_CLASS(vms);
     const MemMapEntry *memmap = vms->memmap;
     AcpiTable table = { .sig = "APIC", .rev = 4, .oem_id = vms->oem_id,
                         .oem_table_id = vms->oem_table_id };
@@ -741,7 +740,7 @@ build_madt(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
                                           memmap[VIRT_HIGH_GIC_REDIST2].size);
         }
 
-        if (its_class_name() && !vmc->no_its) {
+        if (its_class_name()) {
             /*
              * ACPI spec, Revision 6.0 Errata A
              * (original 6.0 definition has invalid Length)
@@ -973,7 +972,7 @@ void virt_acpi_build(VirtMachineState *vms, AcpiBuildTables *tables)
                           vms->oem_table_id);
     }
 
-    if (its_class_name() && !vmc->no_its) {
+    if (its_class_name()) {
         acpi_add_table(table_offsets, tables_blob);
         build_iort(tables_blob, tables->linker, vms);
     }
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index a2a213717c..9c4efcd855 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -3347,17 +3347,13 @@ static void virt_instance_init(Object *obj)
     vms->highmem_mmio = true;
     vms->highmem_redists = true;
 
-    if (vmc->no_its) {
-        vms->its = false;
-    } else {
-        /* Default allows ITS instantiation */
-        vms->its = true;
+    /* Default allows ITS instantiation */
+    vms->its = true;
 
-        if (vmc->no_tcg_its) {
-            vms->tcg_its = false;
-        } else {
-            vms->tcg_its = true;
-        }
+    if (vmc->no_tcg_its) {
+        vms->tcg_its = false;
+    } else {
+        vms->tcg_its = true;
     }
 
     /* Default disallows iommu instantiation */
diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
index 5d3b25509f..463ac09615 100644
--- a/include/hw/arm/virt.h
+++ b/include/hw/arm/virt.h
@@ -117,7 +117,6 @@ typedef enum VirtGICType {
 
 struct VirtMachineClass {
     MachineClass parent;
-    bool no_its;
     bool no_tcg_its;
     bool claim_edge_triggered_timers;
     bool smbios_old_sys_ver;

From f54854f98416e2da29cde1b2e4f97efec47af984 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 16 Jan 2025 15:59:37 +0100
Subject: [PATCH 0679/2760] hw/arm/virt: Remove deprecated virt-2.8 machine
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This machine has been supported for a period of more than 6 years.
According to our versioned machine support policy (see commit
ce80c4fa6ff "docs: document special exception for machine type
deprecation & removal") it can now be removed.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c | 13 -------------
 1 file changed, 13 deletions(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index 9c4efcd855..4ef3f043a2 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -3632,16 +3632,3 @@ static void virt_machine_2_9_options(MachineClass *mc)
     compat_props_add(mc->compat_props, hw_compat_2_9, hw_compat_2_9_len);
 }
 DEFINE_VIRT_MACHINE(2, 9)
-
-static void virt_machine_2_8_options(MachineClass *mc)
-{
-    VirtMachineClass *vmc = VIRT_MACHINE_CLASS(OBJECT_CLASS(mc));
-
-    virt_machine_2_9_options(mc);
-    compat_props_add(mc->compat_props, hw_compat_2_8, hw_compat_2_8_len);
-    /* For 2.8 and earlier we falsely claimed in the DT that
-     * our timers were edge-triggered, not level-triggered.
-     */
-    vmc->claim_edge_triggered_timers = true;
-}
-DEFINE_VIRT_MACHINE(2, 8)

From 2d53ca0b228b403c69fe0db0339cb3d1ef0839df Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 16 Jan 2025 15:59:38 +0100
Subject: [PATCH 0680/2760] hw/arm/virt: Remove
 VirtMachineClass::claim_edge_triggered_timers field
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The VirtMachineClass::claim_edge_triggered_timers field
was only used by virt-2.8 machine, which got removed.
Remove it and simplify fdt_add_timer_nodes() and build_gtdt().

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt-acpi-build.c | 5 +----
 hw/arm/virt.c            | 5 -----
 include/hw/arm/virt.h    | 1 -
 3 files changed, 1 insertion(+), 10 deletions(-)

diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
index 1c8b61f9f8..7e8e0f0298 100644
--- a/hw/arm/virt-acpi-build.c
+++ b/hw/arm/virt-acpi-build.c
@@ -537,15 +537,12 @@ build_srat(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
 static void
 build_gtdt(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
 {
-    VirtMachineClass *vmc = VIRT_MACHINE_GET_CLASS(vms);
     /*
      * Table 5-117 Flag Definitions
      * set only "Timer interrupt Mode" and assume "Timer Interrupt
      * polarity" bit as '0: Interrupt is Active high'
      */
-    uint32_t irqflags = vmc->claim_edge_triggered_timers ?
-        1 : /* Interrupt is Edge triggered */
-        0;  /* Interrupt is Level triggered  */
+    const uint32_t irqflags = 0;  /* Interrupt is Level triggered  */
     AcpiTable table = { .sig = "GTDT", .rev = 3, .oem_id = vms->oem_id,
                         .oem_table_id = vms->oem_table_id };
 
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index 4ef3f043a2..13cbd2275e 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -370,14 +370,9 @@ static void fdt_add_timer_nodes(const VirtMachineState *vms)
      * the correct information.
      */
     ARMCPU *armcpu;
-    VirtMachineClass *vmc = VIRT_MACHINE_GET_CLASS(vms);
     uint32_t irqflags = GIC_FDT_IRQ_FLAGS_LEVEL_HI;
     MachineState *ms = MACHINE(vms);
 
-    if (vmc->claim_edge_triggered_timers) {
-        irqflags = GIC_FDT_IRQ_FLAGS_EDGE_LO_HI;
-    }
-
     if (vms->gic_version == VIRT_GIC_VERSION_2) {
         irqflags = deposit32(irqflags, GIC_FDT_IRQ_PPI_CPU_START,
                              GIC_FDT_IRQ_PPI_CPU_WIDTH,
diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
index 463ac09615..9c531e28d0 100644
--- a/include/hw/arm/virt.h
+++ b/include/hw/arm/virt.h
@@ -118,7 +118,6 @@ typedef enum VirtGICType {
 struct VirtMachineClass {
     MachineClass parent;
     bool no_tcg_its;
-    bool claim_edge_triggered_timers;
     bool smbios_old_sys_ver;
     bool no_highmem_compact;
     bool no_highmem_ecam;

From 684dd748e0d4b14ddcedddcac5982bc36bedeb69 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 16 Jan 2025 15:59:39 +0100
Subject: [PATCH 0681/2760] hw/arm/virt: Remove deprecated virt-2.9 machine
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This machine has been supported for a period of more than 6 years.
According to our versioned machine support policy (see commit
ce80c4fa6ff "docs: document special exception for machine type
deprecation & removal") it can now be removed.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index 13cbd2275e..1c84297fab 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -3620,10 +3620,3 @@ static void virt_machine_2_10_options(MachineClass *mc)
     mc->ignore_memory_transaction_failures = true;
 }
 DEFINE_VIRT_MACHINE(2, 10)
-
-static void virt_machine_2_9_options(MachineClass *mc)
-{
-    virt_machine_2_10_options(mc);
-    compat_props_add(mc->compat_props, hw_compat_2_9, hw_compat_2_9_len);
-}
-DEFINE_VIRT_MACHINE(2, 9)

From 21119f57cbd161899542f00cf6bb5087dea3c4e6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 16 Jan 2025 15:59:40 +0100
Subject: [PATCH 0682/2760] hw/arm/virt: Remove deprecated virt-2.10 machine
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This machine has been supported for a period of more than 6 years.
According to our versioned machine support policy (see commit
ce80c4fa6ff "docs: document special exception for machine type
deprecation & removal") it can now be removed.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c | 9 ---------
 1 file changed, 9 deletions(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index 1c84297fab..6e10b2b085 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -3611,12 +3611,3 @@ static void virt_machine_2_11_options(MachineClass *mc)
     vmc->smbios_old_sys_ver = true;
 }
 DEFINE_VIRT_MACHINE(2, 11)
-
-static void virt_machine_2_10_options(MachineClass *mc)
-{
-    virt_machine_2_11_options(mc);
-    compat_props_add(mc->compat_props, hw_compat_2_10, hw_compat_2_10_len);
-    /* before 2.11 we never faulted accesses to bad addresses */
-    mc->ignore_memory_transaction_failures = true;
-}
-DEFINE_VIRT_MACHINE(2, 10)

From ea461b203833d37500ba87eb2b8c2129978dd631 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 16 Jan 2025 15:59:41 +0100
Subject: [PATCH 0683/2760] hw/arm/virt: Remove deprecated virt-2.11 machine
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This machine has been supported for a period of more than 6 years.
According to our versioned machine support policy (see commit
ce80c4fa6ff "docs: document special exception for machine type
deprecation & removal") it can now be removed.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index 6e10b2b085..4b21f3226f 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -3601,13 +3601,3 @@ static void virt_machine_2_12_options(MachineClass *mc)
     mc->max_cpus = 255;
 }
 DEFINE_VIRT_MACHINE(2, 12)
-
-static void virt_machine_2_11_options(MachineClass *mc)
-{
-    VirtMachineClass *vmc = VIRT_MACHINE_CLASS(OBJECT_CLASS(mc));
-
-    virt_machine_2_12_options(mc);
-    compat_props_add(mc->compat_props, hw_compat_2_11, hw_compat_2_11_len);
-    vmc->smbios_old_sys_ver = true;
-}
-DEFINE_VIRT_MACHINE(2, 11)

From 50e5b00067a7cf9a4770ed826b95a3add1c344a4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 16 Jan 2025 15:59:42 +0100
Subject: [PATCH 0684/2760] hw/arm/virt: Remove
 VirtMachineClass::smbios_old_sys_ver field
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The VirtMachineClass::smbios_old_sys_ver field was
only used by virt-2.11 machine, which got removed.
Remove it and simplify virt_build_smbios().

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c         | 4 +---
 include/hw/arm/virt.h | 1 -
 2 files changed, 1 insertion(+), 4 deletions(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index 4b21f3226f..3488bc4fb9 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -1699,7 +1699,6 @@ static void virt_build_smbios(VirtMachineState *vms)
 {
     MachineClass *mc = MACHINE_GET_CLASS(vms);
     MachineState *ms = MACHINE(vms);
-    VirtMachineClass *vmc = VIRT_MACHINE_GET_CLASS(vms);
     uint8_t *smbios_tables, *smbios_anchor;
     size_t smbios_tables_len, smbios_anchor_len;
     struct smbios_phys_mem_area mem_array;
@@ -1709,8 +1708,7 @@ static void virt_build_smbios(VirtMachineState *vms)
         product = "KVM Virtual Machine";
     }
 
-    smbios_set_defaults("QEMU", product,
-                        vmc->smbios_old_sys_ver ? "1.0" : mc->name);
+    smbios_set_defaults("QEMU", product, mc->name);
 
     /* build the array of physical mem area from base_memmap */
     mem_array.address = vms->memmap[VIRT_MEM].base;
diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
index 9c531e28d0..b2cc012a40 100644
--- a/include/hw/arm/virt.h
+++ b/include/hw/arm/virt.h
@@ -118,7 +118,6 @@ typedef enum VirtGICType {
 struct VirtMachineClass {
     MachineClass parent;
     bool no_tcg_its;
-    bool smbios_old_sys_ver;
     bool no_highmem_compact;
     bool no_highmem_ecam;
     bool no_ged;   /* Machines < 4.2 have no support for ACPI GED device */

From c51af4e8fb024e98a794e3fc919117d0538b02c9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 16 Jan 2025 15:59:43 +0100
Subject: [PATCH 0685/2760] hw/arm/virt: Remove deprecated virt-2.12 machine
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This machine has been supported for a period of more than 6 years.
According to our versioned machine support policy (see commit
ce80c4fa6ff "docs: document special exception for machine type
deprecation & removal") it can now be removed.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c | 11 -----------
 1 file changed, 11 deletions(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index 3488bc4fb9..d047983c80 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -3588,14 +3588,3 @@ static void virt_machine_3_0_options(MachineClass *mc)
     compat_props_add(mc->compat_props, hw_compat_3_0, hw_compat_3_0_len);
 }
 DEFINE_VIRT_MACHINE(3, 0)
-
-static void virt_machine_2_12_options(MachineClass *mc)
-{
-    VirtMachineClass *vmc = VIRT_MACHINE_CLASS(OBJECT_CLASS(mc));
-
-    virt_machine_3_0_options(mc);
-    compat_props_add(mc->compat_props, hw_compat_2_12, hw_compat_2_12_len);
-    vmc->no_highmem_ecam = true;
-    mc->max_cpus = 255;
-}
-DEFINE_VIRT_MACHINE(2, 12)

From 358a1bc71359f03bfb64154ed3238f7c571e7872 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 16 Jan 2025 15:59:44 +0100
Subject: [PATCH 0686/2760] hw/arm/virt: Remove
 VirtMachineClass::no_highmem_ecam field
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The VirtMachineClass::no_highmem_ecam field was only
used by virt-2.12 machine, which got removed. Remove it
and simplify virt_instance_init().

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c         | 2 +-
 include/hw/arm/virt.h | 1 -
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index d047983c80..bd1a68673a 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -3336,7 +3336,7 @@ static void virt_instance_init(Object *obj)
     vms->highmem_compact = !vmc->no_highmem_compact;
     vms->gic_version = VIRT_GIC_VERSION_NOSEL;
 
-    vms->highmem_ecam = !vmc->no_highmem_ecam;
+    vms->highmem_ecam = true;
     vms->highmem_mmio = true;
     vms->highmem_redists = true;
 
diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
index b2cc012a40..9a1b0f53d2 100644
--- a/include/hw/arm/virt.h
+++ b/include/hw/arm/virt.h
@@ -119,7 +119,6 @@ struct VirtMachineClass {
     MachineClass parent;
     bool no_tcg_its;
     bool no_highmem_compact;
-    bool no_highmem_ecam;
     bool no_ged;   /* Machines < 4.2 have no support for ACPI GED device */
     bool kvm_no_adjvtime;
     bool no_kvm_steal_time;

From cef2274dfab2e0a1795297b98dd89d59e1d01e85 Mon Sep 17 00:00:00 2001
From: Bernhard Beschow <shentey@gmail.com>
Date: Wed, 9 Apr 2025 22:26:30 +0200
Subject: [PATCH 0687/2760] tests/functional: Add test for imx8mp-evk board
 with USDHC coverage

Introduce a functional test which boots Debian 12 on the imx8mp-evk board. Since
the root filesystem resides on an SD card, the test also verifies the basic
operation of the USDHC.

Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-id: 20250409202630.19667-1-shentey@gmail.com
[PMM: added extra blank line as suggested by thuth;
 set timeout to 240s]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 MAINTAINERS                                 |  1 +
 tests/functional/meson.build                |  2 +
 tests/functional/test_aarch64_imx8mp_evk.py | 67 +++++++++++++++++++++
 3 files changed, 70 insertions(+)
 create mode 100755 tests/functional/test_aarch64_imx8mp_evk.py

diff --git a/MAINTAINERS b/MAINTAINERS
index e748b6375e..ba70254946 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -843,6 +843,7 @@ F: include/hw/arm/fsl-imx8mp.h
 F: include/hw/misc/imx8mp_*.h
 F: include/hw/pci-host/fsl_imx8m_phy.h
 F: docs/system/arm/imx8mp-evk.rst
+F: tests/functional/test_aarch64_imx8mp_evk.py
 F: tests/qtest/rs5c372-test.c
 
 MPS2 / MPS3
diff --git a/tests/functional/meson.build b/tests/functional/meson.build
index ab9df03b1f..52b4706cfe 100644
--- a/tests/functional/meson.build
+++ b/tests/functional/meson.build
@@ -13,6 +13,7 @@ endif
 test_timeouts = {
   'aarch64_aspeed_ast2700' : 600,
   'aarch64_aspeed_ast2700fc' : 600,
+  'aarch64_imx8mp_evk' : 240,
   'aarch64_raspi4' : 480,
   'aarch64_reverse_debug' : 180,
   'aarch64_rme_virt' : 1200,
@@ -82,6 +83,7 @@ tests_aarch64_system_quick = [
 tests_aarch64_system_thorough = [
   'aarch64_aspeed_ast2700',
   'aarch64_aspeed_ast2700fc',
+  'aarch64_imx8mp_evk',
   'aarch64_raspi3',
   'aarch64_raspi4',
   'aarch64_replay',
diff --git a/tests/functional/test_aarch64_imx8mp_evk.py b/tests/functional/test_aarch64_imx8mp_evk.py
new file mode 100755
index 0000000000..638bf9e131
--- /dev/null
+++ b/tests/functional/test_aarch64_imx8mp_evk.py
@@ -0,0 +1,67 @@
+#!/usr/bin/env python3
+#
+# Functional test that boots a Linux kernel and checks the console
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+from qemu_test import LinuxKernelTest, Asset
+
+
+class Imx8mpEvkMachine(LinuxKernelTest):
+
+    ASSET_IMAGE = Asset(
+        ('https://cloud.debian.org/images/cloud/bookworm/20231210-1590/'
+         'debian-12-generic-arm64-20231210-1590.tar.xz'),
+        '7ebf1577b32d5af6204df74b54ca2e4675de9b5a9fa14f3ff70b88eeb7b3b359')
+
+    KERNEL_OFFSET = 0x51000000
+    KERNEL_SIZE = 32622528
+    INITRD_OFFSET = 0x76000000
+    INITRD_SIZE = 30987766
+    DTB_OFFSET = 0x64F51000
+    DTB_SIZE = 45 * 1024
+
+    def extract(self, in_path, out_path, offset, size):
+        try:
+            with open(in_path, "rb") as source:
+                source.seek(offset)
+                data = source.read(size)
+            with open(out_path, "wb") as target:
+                target.write(data)
+        except (IOError, ValueError) as e:
+            self.log.error(f"Failed to extract {out_path}: {e}")
+            raise
+
+    def setUp(self):
+        super().setUp()
+
+        self.image_path = self.scratch_file("disk.raw")
+        self.kernel_path = self.scratch_file("linux")
+        self.initrd_path = self.scratch_file("initrd.zstd")
+        self.dtb_path = self.scratch_file("imx8mp-evk.dtb")
+
+        self.archive_extract(self.ASSET_IMAGE)
+        self.extract(self.image_path, self.kernel_path,
+                     self.KERNEL_OFFSET, self.KERNEL_SIZE)
+        self.extract(self.image_path, self.initrd_path,
+                     self.INITRD_OFFSET, self.INITRD_SIZE)
+        self.extract(self.image_path, self.dtb_path,
+                     self.DTB_OFFSET, self.DTB_SIZE)
+
+    def test_aarch64_imx8mp_evk_usdhc(self):
+        self.set_machine('imx8mp-evk')
+        self.vm.set_console(console_index=1)
+        self.vm.add_args('-m', '2G',
+                         '-smp', '4',
+                         '-kernel', self.kernel_path,
+                         '-initrd', self.initrd_path,
+                         '-dtb', self.dtb_path,
+                         '-append', 'root=/dev/mmcblk2p1',
+                         '-drive', f'file={self.image_path},if=sd,bus=2,'
+                                    'format=raw,id=mmcblk2,snapshot=on')
+
+        self.vm.launch()
+        self.wait_for_console_pattern('Welcome to ')
+
+if __name__ == '__main__':
+    LinuxKernelTest.main()

From 641f1c53862aec64810c0b93b5b1de49d55fda92 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 2 May 2025 10:21:42 +0200
Subject: [PATCH 0688/2760] lcitool: use newer Rust for Debian and Ubuntu

On Debian, the rustc-web package provides a newer Rust compiler (1.78)
for all architectures except mips64el.

On Ubuntu, Rust versions up to 1.80 (?) are available as of this writing
for both Jammy (22.04) and Noble (24.04).  However, the path to rustc
and rustdoc must be provided by hand to the configure script using
either command line arguments or environment variables.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 docs/about/build-platforms.rst                        | 11 ++++++++---
 scripts/ci/setup/ubuntu/ubuntu-2204-aarch64.yaml      |  2 +-
 scripts/ci/setup/ubuntu/ubuntu-2204-s390x.yaml        |  2 +-
 tests/docker/dockerfiles/debian-amd64-cross.docker    |  2 +-
 tests/docker/dockerfiles/debian-arm64-cross.docker    |  2 +-
 tests/docker/dockerfiles/debian-armhf-cross.docker    |  2 +-
 tests/docker/dockerfiles/debian-i686-cross.docker     |  2 +-
 tests/docker/dockerfiles/debian-mips64el-cross.docker |  2 +-
 tests/docker/dockerfiles/debian-mipsel-cross.docker   |  2 +-
 tests/docker/dockerfiles/debian-ppc64el-cross.docker  |  2 +-
 tests/docker/dockerfiles/debian-s390x-cross.docker    |  2 +-
 tests/docker/dockerfiles/debian.docker                |  2 +-
 tests/docker/dockerfiles/ubuntu2204.docker            |  3 ++-
 tests/lcitool/mappings.yml                            |  5 +++++
 tests/lcitool/refresh                                 |  5 +++--
 15 files changed, 29 insertions(+), 17 deletions(-)

diff --git a/docs/about/build-platforms.rst b/docs/about/build-platforms.rst
index c3651871d2..8ecbd6b26f 100644
--- a/docs/about/build-platforms.rst
+++ b/docs/about/build-platforms.rst
@@ -118,9 +118,14 @@ Rust build dependencies
   include bindgen or have an older version, it is recommended to install
   a newer version using ``cargo install bindgen-cli``.
 
-  Developers may want to use Cargo-based tools in the QEMU source tree;
-  this requires Cargo 1.74.0.  Note that Cargo is not required in order
-  to build QEMU.
+  QEMU requires Rust 1.77.0.  This is available on all supported platforms
+  with one exception, namely the ``mips64el`` architecture on Debian bookworm.
+  For all other architectures, Debian bookworm provides a new-enough Rust
+  compiler in the ``rustc-web`` package.
+
+  Also, on Ubuntu 22.04 or 24.04 this requires the ``rustc-1.77``
+  (or newer) package.  The path to ``rustc`` and ``rustdoc`` must be
+  provided manually to the configure script.
 
 Optional build dependencies
   Build components whose absence does not affect the ability to build QEMU
diff --git a/scripts/ci/setup/ubuntu/ubuntu-2204-aarch64.yaml b/scripts/ci/setup/ubuntu/ubuntu-2204-aarch64.yaml
index dbcd2e076d..f11e980826 100644
--- a/scripts/ci/setup/ubuntu/ubuntu-2204-aarch64.yaml
+++ b/scripts/ci/setup/ubuntu/ubuntu-2204-aarch64.yaml
@@ -114,7 +114,7 @@ packages:
   - python3-venv
   - python3-yaml
   - rpm2cpio
-  - rustc
+  - rustc-1.77
   - sed
   - socat
   - sparse
diff --git a/scripts/ci/setup/ubuntu/ubuntu-2204-s390x.yaml b/scripts/ci/setup/ubuntu/ubuntu-2204-s390x.yaml
index 4b8ee3d885..6559cb2934 100644
--- a/scripts/ci/setup/ubuntu/ubuntu-2204-s390x.yaml
+++ b/scripts/ci/setup/ubuntu/ubuntu-2204-s390x.yaml
@@ -112,7 +112,7 @@ packages:
   - python3-venv
   - python3-yaml
   - rpm2cpio
-  - rustc
+  - rustc-1.77
   - sed
   - socat
   - sparse
diff --git a/tests/docker/dockerfiles/debian-amd64-cross.docker b/tests/docker/dockerfiles/debian-amd64-cross.docker
index 0535585428..081f3e00f7 100644
--- a/tests/docker/dockerfiles/debian-amd64-cross.docker
+++ b/tests/docker/dockerfiles/debian-amd64-cross.docker
@@ -50,7 +50,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       python3-venv \
                       python3-yaml \
                       rpm2cpio \
-                      rustc \
+                      rustc-web \
                       sed \
                       socat \
                       sparse \
diff --git a/tests/docker/dockerfiles/debian-arm64-cross.docker b/tests/docker/dockerfiles/debian-arm64-cross.docker
index 6b1e4fc827..91c555a36e 100644
--- a/tests/docker/dockerfiles/debian-arm64-cross.docker
+++ b/tests/docker/dockerfiles/debian-arm64-cross.docker
@@ -50,7 +50,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       python3-venv \
                       python3-yaml \
                       rpm2cpio \
-                      rustc \
+                      rustc-web \
                       sed \
                       socat \
                       sparse \
diff --git a/tests/docker/dockerfiles/debian-armhf-cross.docker b/tests/docker/dockerfiles/debian-armhf-cross.docker
index cf0fe63af9..f0e2efcda0 100644
--- a/tests/docker/dockerfiles/debian-armhf-cross.docker
+++ b/tests/docker/dockerfiles/debian-armhf-cross.docker
@@ -50,7 +50,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       python3-venv \
                       python3-yaml \
                       rpm2cpio \
-                      rustc \
+                      rustc-web \
                       sed \
                       socat \
                       sparse \
diff --git a/tests/docker/dockerfiles/debian-i686-cross.docker b/tests/docker/dockerfiles/debian-i686-cross.docker
index 1c84dfb945..025beb1ce2 100644
--- a/tests/docker/dockerfiles/debian-i686-cross.docker
+++ b/tests/docker/dockerfiles/debian-i686-cross.docker
@@ -50,7 +50,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       python3-venv \
                       python3-yaml \
                       rpm2cpio \
-                      rustc \
+                      rustc-web \
                       sed \
                       socat \
                       sparse \
diff --git a/tests/docker/dockerfiles/debian-mips64el-cross.docker b/tests/docker/dockerfiles/debian-mips64el-cross.docker
index 257204eae4..4a941dd870 100644
--- a/tests/docker/dockerfiles/debian-mips64el-cross.docker
+++ b/tests/docker/dockerfiles/debian-mips64el-cross.docker
@@ -50,7 +50,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       python3-venv \
                       python3-yaml \
                       rpm2cpio \
-                      rustc \
+                      rustc-web \
                       sed \
                       socat \
                       sparse \
diff --git a/tests/docker/dockerfiles/debian-mipsel-cross.docker b/tests/docker/dockerfiles/debian-mipsel-cross.docker
index 395c84d65b..4d3e5d711b 100644
--- a/tests/docker/dockerfiles/debian-mipsel-cross.docker
+++ b/tests/docker/dockerfiles/debian-mipsel-cross.docker
@@ -50,7 +50,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       python3-venv \
                       python3-yaml \
                       rpm2cpio \
-                      rustc \
+                      rustc-web \
                       sed \
                       socat \
                       sparse \
diff --git a/tests/docker/dockerfiles/debian-ppc64el-cross.docker b/tests/docker/dockerfiles/debian-ppc64el-cross.docker
index 1ae227ccde..22b4457ba9 100644
--- a/tests/docker/dockerfiles/debian-ppc64el-cross.docker
+++ b/tests/docker/dockerfiles/debian-ppc64el-cross.docker
@@ -50,7 +50,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       python3-venv \
                       python3-yaml \
                       rpm2cpio \
-                      rustc \
+                      rustc-web \
                       sed \
                       socat \
                       sparse \
diff --git a/tests/docker/dockerfiles/debian-s390x-cross.docker b/tests/docker/dockerfiles/debian-s390x-cross.docker
index afa81a57ba..13ec52c8ad 100644
--- a/tests/docker/dockerfiles/debian-s390x-cross.docker
+++ b/tests/docker/dockerfiles/debian-s390x-cross.docker
@@ -50,7 +50,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       python3-venv \
                       python3-yaml \
                       rpm2cpio \
-                      rustc \
+                      rustc-web \
                       sed \
                       socat \
                       sparse \
diff --git a/tests/docker/dockerfiles/debian.docker b/tests/docker/dockerfiles/debian.docker
index 5b3bac43cc..0a57c1a1d3 100644
--- a/tests/docker/dockerfiles/debian.docker
+++ b/tests/docker/dockerfiles/debian.docker
@@ -122,7 +122,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       python3-venv \
                       python3-yaml \
                       rpm2cpio \
-                      rustc \
+                      rustc-web \
                       sed \
                       socat \
                       sparse \
diff --git a/tests/docker/dockerfiles/ubuntu2204.docker b/tests/docker/dockerfiles/ubuntu2204.docker
index 88ce4ef9a9..4a1cf2bdff 100644
--- a/tests/docker/dockerfiles/ubuntu2204.docker
+++ b/tests/docker/dockerfiles/ubuntu2204.docker
@@ -121,7 +121,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       python3-venv \
                       python3-yaml \
                       rpm2cpio \
-                      rustc \
+                      rustc-1.77 \
                       sed \
                       socat \
                       sparse \
@@ -150,6 +150,7 @@ ENV LANG "en_US.UTF-8"
 ENV MAKE "/usr/bin/make"
 ENV NINJA "/usr/bin/ninja"
 ENV PYTHON "/usr/bin/python3"
+ENV RUSTC=/usr/bin/rustc-1.77
 ENV CARGO_HOME=/usr/local/cargo
 ENV PATH=$CARGO_HOME/bin:$PATH
 RUN DEBIAN_FRONTEND=noninteractive eatmydata \
diff --git a/tests/lcitool/mappings.yml b/tests/lcitool/mappings.yml
index 74eb13d62b..673baf3936 100644
--- a/tests/lcitool/mappings.yml
+++ b/tests/lcitool/mappings.yml
@@ -64,6 +64,11 @@ mappings:
   python3-wheel:
     OpenSUSELeap15: python311-pip
 
+  rust:
+    Debian12: rustc-web
+    Ubuntu2204: rustc-1.77
+    Ubuntu2404: rustc-1.77
+
 pypi_mappings:
   # Request more recent version
   meson:
diff --git a/tests/lcitool/refresh b/tests/lcitool/refresh
index aa551aca9b..8474ea822f 100755
--- a/tests/lcitool/refresh
+++ b/tests/lcitool/refresh
@@ -141,7 +141,8 @@ fedora_rustup_nightly_extras = [
     'RUN $CARGO --list\n',
 ]
 
-ubuntu2204_bindgen_extras = [
+ubuntu2204_rust_extras = [
+    "ENV RUSTC=/usr/bin/rustc-1.77\n",
     "ENV CARGO_HOME=/usr/local/cargo\n",
     'ENV PATH=$CARGO_HOME/bin:$PATH\n',
     "RUN DEBIAN_FRONTEND=noninteractive eatmydata \\\n",
@@ -170,7 +171,7 @@ try:
     generate_dockerfile("fedora", "fedora-40")
     generate_dockerfile("opensuse-leap", "opensuse-leap-15")
     generate_dockerfile("ubuntu2204", "ubuntu-2204",
-                        trailer="".join(ubuntu2204_bindgen_extras))
+                        trailer="".join(ubuntu2204_rust_extras))
 
     #
     # Non-fatal Rust-enabled build

From e0b2b74f70a85b16e9d4a9b6111e09956ae4cfd9 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 2 May 2025 23:36:11 +0200
Subject: [PATCH 0689/2760] meson, cargo: require Rust 1.77.0

Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 meson.build      | 6 +++---
 rust/Cargo.toml  | 2 +-
 rust/clippy.toml | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/meson.build b/meson.build
index 6c61e1dcae..8eb3de5d68 100644
--- a/meson.build
+++ b/meson.build
@@ -94,12 +94,12 @@ have_rust = have_rust and add_languages('rust', native: true,
     required: get_option('rust').disable_auto_if(not have_system))
 if have_rust
   rustc = meson.get_compiler('rust')
-  if rustc.version().version_compare('<1.63.0')
+  if rustc.version().version_compare('<1.77.0')
     if get_option('rust').enabled()
-      error('rustc version ' + rustc.version() + ' is unsupported. Please upgrade to at least 1.63.0')
+      error('rustc version ' + rustc.version() + ' is unsupported. Please upgrade to at least 1.77.0')
     else
       warning('rustc version ' + rustc.version() + ' is unsupported, disabling Rust compilation.')
-      message('Please upgrade to at least 1.63.0 to use Rust.')
+      message('Please upgrade to at least 1.77.0 to use Rust.')
       have_rust = false
     endif
   endif
diff --git a/rust/Cargo.toml b/rust/Cargo.toml
index 5ace47c69b..eda7980b31 100644
--- a/rust/Cargo.toml
+++ b/rust/Cargo.toml
@@ -12,7 +12,7 @@ edition = "2021"
 homepage = "https://www.qemu.org"
 license = "GPL-2.0-or-later"
 repository = "https://gitlab.com/qemu-project/qemu/"
-rust-version = "1.63.0"
+rust-version = "1.77.0"
 
 [workspace.lints.rust]
 unexpected_cfgs = { level = "deny", check-cfg = [
diff --git a/rust/clippy.toml b/rust/clippy.toml
index 5d190f91de..933e46a2ff 100644
--- a/rust/clippy.toml
+++ b/rust/clippy.toml
@@ -1,2 +1,2 @@
 doc-valid-idents = ["PrimeCell", ".."]
-msrv = "1.63.0"
+msrv = "1.77.0"

From e4fb0be1d1d6b67df7709d84d16133b64f455ce8 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 2 May 2025 10:18:35 +0200
Subject: [PATCH 0690/2760] rust: use std::ffi instead of std::os::raw

This is allowed since Rust 1.64.0.

Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 docs/devel/rust.rst                    | 2 --
 rust/hw/char/pl011/src/device_class.rs | 2 +-
 rust/hw/timer/hpet/src/hpet.rs         | 3 +--
 rust/qemu-api/src/chardev.rs           | 3 +--
 rust/qemu-api/src/irq.rs               | 6 +++++-
 rust/qemu-api/src/lib.rs               | 2 +-
 rust/qemu-api/src/memory.rs            | 3 +--
 rust/qemu-api/src/qdev.rs              | 3 +--
 rust/qemu-api/src/qom.rs               | 3 +--
 rust/qemu-api/src/timer.rs             | 2 +-
 rust/qemu-api/src/vmstate.rs           | 2 +-
 rust/qemu-api/tests/vmstate_tests.rs   | 7 ++++++-
 12 files changed, 20 insertions(+), 18 deletions(-)

diff --git a/docs/devel/rust.rst b/docs/devel/rust.rst
index 3cc2841d4d..c7dfba98de 100644
--- a/docs/devel/rust.rst
+++ b/docs/devel/rust.rst
@@ -74,8 +74,6 @@ Supported tools
 QEMU supports rustc version 1.63.0 and newer.  Notably, the following features
 are missing:
 
-* ``core::ffi`` (1.64.0).  Use ``std::os::raw`` and ``std::ffi`` instead.
-
 * ``cast_mut()``/``cast_const()`` (1.65.0).  Use ``as`` instead.
 
 * "let ... else" (1.65.0).  Use ``if let`` instead.  This is currently patched
diff --git a/rust/hw/char/pl011/src/device_class.rs b/rust/hw/char/pl011/src/device_class.rs
index b4d4a7eb43..cd2dc33c20 100644
--- a/rust/hw/char/pl011/src/device_class.rs
+++ b/rust/hw/char/pl011/src/device_class.rs
@@ -3,7 +3,7 @@
 // SPDX-License-Identifier: GPL-2.0-or-later
 
 use std::{
-    os::raw::{c_int, c_void},
+    ffi::{c_int, c_void},
     ptr::NonNull,
 };
 
diff --git a/rust/hw/timer/hpet/src/hpet.rs b/rust/hw/timer/hpet/src/hpet.rs
index 12de2ba59a..d4364f2f2f 100644
--- a/rust/hw/timer/hpet/src/hpet.rs
+++ b/rust/hw/timer/hpet/src/hpet.rs
@@ -3,8 +3,7 @@
 // SPDX-License-Identifier: GPL-2.0-or-later
 
 use std::{
-    ffi::CStr,
-    os::raw::{c_int, c_void},
+    ffi::{c_int, c_void, CStr},
     pin::Pin,
     ptr::{addr_of_mut, null_mut, NonNull},
     slice::from_ref,
diff --git a/rust/qemu-api/src/chardev.rs b/rust/qemu-api/src/chardev.rs
index 11e6c45afa..146a4852da 100644
--- a/rust/qemu-api/src/chardev.rs
+++ b/rust/qemu-api/src/chardev.rs
@@ -10,11 +10,10 @@
 //! called.
 
 use std::{
-    ffi::CStr,
+    ffi::{c_int, c_void, CStr},
     fmt::{self, Debug},
     io::{self, ErrorKind, Write},
     marker::PhantomPinned,
-    os::raw::{c_int, c_void},
     ptr::addr_of_mut,
     slice,
 };
diff --git a/rust/qemu-api/src/irq.rs b/rust/qemu-api/src/irq.rs
index 1222d4fde3..1526e6f63a 100644
--- a/rust/qemu-api/src/irq.rs
+++ b/rust/qemu-api/src/irq.rs
@@ -4,7 +4,11 @@
 
 //! Bindings for interrupt sources
 
-use std::{ffi::CStr, marker::PhantomData, os::raw::c_int, ptr};
+use std::{
+    ffi::{c_int, CStr},
+    marker::PhantomData,
+    ptr,
+};
 
 use crate::{
     bindings::{self, qemu_set_irq},
diff --git a/rust/qemu-api/src/lib.rs b/rust/qemu-api/src/lib.rs
index 05f38b51d3..c3641e893b 100644
--- a/rust/qemu-api/src/lib.rs
+++ b/rust/qemu-api/src/lib.rs
@@ -33,7 +33,7 @@ pub mod zeroable;
 
 use std::{
     alloc::{GlobalAlloc, Layout},
-    os::raw::c_void,
+    ffi::c_void,
 };
 
 #[cfg(HAVE_GLIB_WITH_ALIGNED_ALLOC)]
diff --git a/rust/qemu-api/src/memory.rs b/rust/qemu-api/src/memory.rs
index fdb1ea11fc..9ef2694bd6 100644
--- a/rust/qemu-api/src/memory.rs
+++ b/rust/qemu-api/src/memory.rs
@@ -5,9 +5,8 @@
 //! Bindings for `MemoryRegion`, `MemoryRegionOps` and `MemTxAttrs`
 
 use std::{
-    ffi::{CStr, CString},
+    ffi::{c_uint, c_void, CStr, CString},
     marker::PhantomData,
-    os::raw::{c_uint, c_void},
 };
 
 pub use bindings::{hwaddr, MemTxAttrs};
diff --git a/rust/qemu-api/src/qdev.rs b/rust/qemu-api/src/qdev.rs
index 18b4a9ba68..17c7fecabe 100644
--- a/rust/qemu-api/src/qdev.rs
+++ b/rust/qemu-api/src/qdev.rs
@@ -5,8 +5,7 @@
 //! Bindings to create devices and access device functionality from Rust.
 
 use std::{
-    ffi::{CStr, CString},
-    os::raw::{c_int, c_void},
+    ffi::{c_int, c_void, CStr, CString},
     ptr::NonNull,
 };
 
diff --git a/rust/qemu-api/src/qom.rs b/rust/qemu-api/src/qom.rs
index f1b4022157..6929e4d33a 100644
--- a/rust/qemu-api/src/qom.rs
+++ b/rust/qemu-api/src/qom.rs
@@ -93,11 +93,10 @@
 //! without incurring into violations of orphan rules for traits.
 
 use std::{
-    ffi::CStr,
+    ffi::{c_void, CStr},
     fmt,
     mem::ManuallyDrop,
     ops::{Deref, DerefMut},
-    os::raw::c_void,
     ptr::NonNull,
 };
 
diff --git a/rust/qemu-api/src/timer.rs b/rust/qemu-api/src/timer.rs
index e769f8bc91..d697fd742b 100644
--- a/rust/qemu-api/src/timer.rs
+++ b/rust/qemu-api/src/timer.rs
@@ -3,7 +3,7 @@
 // SPDX-License-Identifier: GPL-2.0-or-later
 
 use std::{
-    os::raw::{c_int, c_void},
+    ffi::{c_int, c_void},
     pin::Pin,
 };
 
diff --git a/rust/qemu-api/src/vmstate.rs b/rust/qemu-api/src/vmstate.rs
index 9ae97c389c..c0f29f7418 100644
--- a/rust/qemu-api/src/vmstate.rs
+++ b/rust/qemu-api/src/vmstate.rs
@@ -25,7 +25,7 @@
 //!   functionality that is missing from `vmstate_of!`.
 
 use core::{marker::PhantomData, mem, ptr::NonNull};
-use std::os::raw::{c_int, c_void};
+use std::ffi::{c_int, c_void};
 
 pub use crate::bindings::{VMStateDescription, VMStateField};
 use crate::{
diff --git a/rust/qemu-api/tests/vmstate_tests.rs b/rust/qemu-api/tests/vmstate_tests.rs
index f7a93117e1..9a56ffd238 100644
--- a/rust/qemu-api/tests/vmstate_tests.rs
+++ b/rust/qemu-api/tests/vmstate_tests.rs
@@ -2,7 +2,12 @@
 // Author(s): Zhao Liu <zhai1.liu@intel.com>
 // SPDX-License-Identifier: GPL-2.0-or-later
 
-use std::{ffi::CStr, mem::size_of, os::raw::c_void, ptr::NonNull, slice};
+use std::{
+    ffi::{c_void, CStr},
+    mem::size_of,
+    ptr::NonNull,
+    slice,
+};
 
 use qemu_api::{
     bindings::{

From 51209c2aed343a45f79b522706c807abbdcf01a3 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 2 May 2025 10:28:11 +0200
Subject: [PATCH 0691/2760] rust: let bilge use "let ... else"

"let ... else" was stabilized in 1.65.0; bumping the minimum supported
Rust version means we don't need to patch it out anymore.

Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 docs/devel/rust.rst                           |  3 --
 subprojects/bilge-impl-0.2-rs.wrap            |  1 -
 .../packagefiles/bilge-impl-1.63.0.patch      | 45 -------------------
 3 files changed, 49 deletions(-)
 delete mode 100644 subprojects/packagefiles/bilge-impl-1.63.0.patch

diff --git a/docs/devel/rust.rst b/docs/devel/rust.rst
index c7dfba98de..8167ff49aa 100644
--- a/docs/devel/rust.rst
+++ b/docs/devel/rust.rst
@@ -76,9 +76,6 @@ are missing:
 
 * ``cast_mut()``/``cast_const()`` (1.65.0).  Use ``as`` instead.
 
-* "let ... else" (1.65.0).  Use ``if let`` instead.  This is currently patched
-  in QEMU's vendored copy of the bilge crate.
-
 * Generic Associated Types (1.65.0)
 
 * ``CStr::from_bytes_with_nul()`` as a ``const`` function (1.72.0).
diff --git a/subprojects/bilge-impl-0.2-rs.wrap b/subprojects/bilge-impl-0.2-rs.wrap
index d14c3dc769..4f84eca1cc 100644
--- a/subprojects/bilge-impl-0.2-rs.wrap
+++ b/subprojects/bilge-impl-0.2-rs.wrap
@@ -5,7 +5,6 @@ source_filename = bilge-impl-0.2.0.tar.gz
 source_hash = feb11e002038ad243af39c2068c8a72bcf147acf05025dcdb916fcc000adb2d8
 #method = cargo
 patch_directory = bilge-impl-0.2-rs
-diff_files = bilge-impl-1.63.0.patch
 
 # bump this version number on every change to meson.build or the patches:
 # v2
diff --git a/subprojects/packagefiles/bilge-impl-1.63.0.patch b/subprojects/packagefiles/bilge-impl-1.63.0.patch
deleted file mode 100644
index 987428a6d6..0000000000
--- a/subprojects/packagefiles/bilge-impl-1.63.0.patch
+++ /dev/null
@@ -1,45 +0,0 @@
---- a/src/shared/discriminant_assigner.rs
-+++ b/src/shared/discriminant_assigner.rs
-@@ -26,20 +26,20 @@
-         let discriminant_expr = &discriminant.1;
-         let variant_name = &variant.ident;
- 
--        let Expr::Lit(ExprLit { lit: Lit::Int(int), .. }) = discriminant_expr else {
-+        if let Expr::Lit(ExprLit { lit: Lit::Int(int), .. }) = discriminant_expr {
-+            let discriminant_value: u128 = int.base10_parse().unwrap_or_else(unreachable);
-+            if discriminant_value > self.max_value() {
-+                abort!(variant, "Value of variant exceeds the given number of bits")
-+            }
-+
-+            Some(discriminant_value)
-+        } else {
-             abort!(
-                 discriminant_expr,
-                 "variant `{}` is not a number", variant_name;
-                 help = "only literal integers currently supported"
-             )
--        };
--
--        let discriminant_value: u128 = int.base10_parse().unwrap_or_else(unreachable);
--        if discriminant_value > self.max_value() {
--            abort!(variant, "Value of variant exceeds the given number of bits")
-         }
--
--        Some(discriminant_value)
-     }
- 
-     fn assign(&mut self, variant: &Variant) -> u128 {
---- a/src/shared/fallback.rs
-+++ b/src/shared/fallback.rs
-@@ -22,8 +22,9 @@
-             }
-             Unnamed(fields) => {
-                 let variant_fields = fields.unnamed.iter();
--                let Ok(fallback_value) = variant_fields.exactly_one() else {
--                    abort!(variant, "fallback variant must have exactly one field"; help = "use only one field or change to a unit variant")
-+                let fallback_value = match variant_fields.exactly_one() {
-+                    Ok(ok) => ok,
-+                    _ => abort!(variant, "fallback variant must have exactly one field"; help = "use only one field or change to a unit variant")
-                 };
- 
-                 if !is_last_variant {

From 465a4b80e2afd93f2eb4c9f55233788ebfb47ac0 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 2 May 2025 11:42:48 +0200
Subject: [PATCH 0692/2760] rust: qemu_api_macros: make pattern matching more
 readable and efficient

"let ... else" is useful when visiting syntax trees; it avoids multiple
levels of indentation and places the error close to the pattern.

While at it, use "ref" to avoid moving the syntax tree objects.

Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/qemu-api-macros/src/lib.rs | 84 +++++++++++++++------------------
 1 file changed, 37 insertions(+), 47 deletions(-)

diff --git a/rust/qemu-api-macros/src/lib.rs b/rust/qemu-api-macros/src/lib.rs
index eda0d46d12..0bffd2691b 100644
--- a/rust/qemu-api-macros/src/lib.rs
+++ b/rust/qemu-api-macros/src/lib.rs
@@ -16,50 +16,41 @@ fn get_fields<'a>(
     input: &'a DeriveInput,
     msg: &str,
 ) -> Result<&'a Punctuated<Field, Comma>, MacroError> {
-    if let Data::Struct(s) = &input.data {
-        if let Fields::Named(fs) = &s.fields {
-            Ok(&fs.named)
-        } else {
-            Err(MacroError::Message(
-                format!("Named fields required for {}", msg),
-                input.ident.span(),
-            ))
-        }
-    } else {
-        Err(MacroError::Message(
+    let Data::Struct(ref s) = &input.data else {
+        return Err(MacroError::Message(
             format!("Struct required for {}", msg),
             input.ident.span(),
-        ))
-    }
+        ));
+    };
+    let Fields::Named(ref fs) = &s.fields else {
+        return Err(MacroError::Message(
+            format!("Named fields required for {}", msg),
+            input.ident.span(),
+        ));
+    };
+    Ok(&fs.named)
 }
 
 fn get_unnamed_field<'a>(input: &'a DeriveInput, msg: &str) -> Result<&'a Field, MacroError> {
-    if let Data::Struct(s) = &input.data {
-        let unnamed = match &s.fields {
-            Fields::Unnamed(FieldsUnnamed {
-                unnamed: ref fields,
-                ..
-            }) => fields,
-            _ => {
-                return Err(MacroError::Message(
-                    format!("Tuple struct required for {}", msg),
-                    s.fields.span(),
-                ))
-            }
-        };
-        if unnamed.len() != 1 {
-            return Err(MacroError::Message(
-                format!("A single field is required for {}", msg),
-                s.fields.span(),
-            ));
-        }
-        Ok(&unnamed[0])
-    } else {
-        Err(MacroError::Message(
+    let Data::Struct(ref s) = &input.data else {
+        return Err(MacroError::Message(
             format!("Struct required for {}", msg),
             input.ident.span(),
-        ))
+        ));
+    };
+    let Fields::Unnamed(FieldsUnnamed { ref unnamed, .. }) = &s.fields else {
+        return Err(MacroError::Message(
+            format!("Tuple struct required for {}", msg),
+            s.fields.span(),
+        ));
+    };
+    if unnamed.len() != 1 {
+        return Err(MacroError::Message(
+            format!("A single field is required for {}", msg),
+            s.fields.span(),
+        ));
     }
+    Ok(&unnamed[0])
 }
 
 fn is_c_repr(input: &DeriveInput, msg: &str) -> Result<(), MacroError> {
@@ -210,20 +201,19 @@ fn get_repr_uN(input: &DeriveInput, msg: &str) -> Result<Path, MacroError> {
 }
 
 fn get_variants(input: &DeriveInput) -> Result<&Punctuated<Variant, Comma>, MacroError> {
-    if let Data::Enum(e) = &input.data {
-        if let Some(v) = e.variants.iter().find(|v| v.fields != Fields::Unit) {
-            return Err(MacroError::Message(
-                "Cannot derive TryInto for enum with non-unit variants.".to_string(),
-                v.fields.span(),
-            ));
-        }
-        Ok(&e.variants)
-    } else {
-        Err(MacroError::Message(
+    let Data::Enum(ref e) = &input.data else {
+        return Err(MacroError::Message(
             "Cannot derive TryInto for union or struct.".to_string(),
             input.ident.span(),
-        ))
+        ));
+    };
+    if let Some(v) = e.variants.iter().find(|v| v.fields != Fields::Unit) {
+        return Err(MacroError::Message(
+            "Cannot derive TryInto for enum with non-unit variants.".to_string(),
+            v.fields.span(),
+        ));
     }
+    Ok(&e.variants)
 }
 
 #[rustfmt::skip::macros(quote)]

From 0823837224be428d643dc7000fa534f8aedea5fd Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 2 May 2025 10:31:28 +0200
Subject: [PATCH 0693/2760] rust: use MaybeUninit::zeroed() in const context

Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 docs/devel/rust.rst              |   4 --
 rust/hw/timer/hpet/src/fw_cfg.rs |   6 +-
 rust/qemu-api/src/zeroable.rs    | 106 +++++--------------------------
 3 files changed, 20 insertions(+), 96 deletions(-)

diff --git a/docs/devel/rust.rst b/docs/devel/rust.rst
index 8167ff49aa..13a002cfe6 100644
--- a/docs/devel/rust.rst
+++ b/docs/devel/rust.rst
@@ -83,10 +83,6 @@ are missing:
 * "Return position ``impl Trait`` in Traits" (1.75.0, blocker for including
   the pinned-init create).
 
-* ``MaybeUninit::zeroed()`` as a ``const`` function (1.75.0).  QEMU's
-  ``Zeroable`` trait can be implemented without ``MaybeUninit::zeroed()``,
-  so this would be just a cleanup.
-
 * ``c"" literals`` (stable in 1.77.0).  QEMU provides a ``c_str!()`` macro
   to define ``CStr`` constants easily
 
diff --git a/rust/hw/timer/hpet/src/fw_cfg.rs b/rust/hw/timer/hpet/src/fw_cfg.rs
index bef03727ea..aa08d28351 100644
--- a/rust/hw/timer/hpet/src/fw_cfg.rs
+++ b/rust/hw/timer/hpet/src/fw_cfg.rs
@@ -4,7 +4,7 @@
 
 use std::ptr::addr_of_mut;
 
-use qemu_api::{cell::bql_locked, impl_zeroable, zeroable::Zeroable};
+use qemu_api::{cell::bql_locked, zeroable::Zeroable};
 
 /// Each `HPETState` represents a Event Timer Block. The v1 spec supports
 /// up to 8 blocks. QEMU only uses 1 block (in PC machine).
@@ -18,7 +18,7 @@ pub struct HPETFwEntry {
     pub min_tick: u16,
     pub page_prot: u8,
 }
-impl_zeroable!(HPETFwEntry);
+unsafe impl Zeroable for HPETFwEntry {}
 
 #[repr(C, packed)]
 #[derive(Copy, Clone, Default)]
@@ -26,7 +26,7 @@ pub struct HPETFwConfig {
     pub count: u8,
     pub hpet: [HPETFwEntry; HPET_MAX_NUM_EVENT_TIMER_BLOCK],
 }
-impl_zeroable!(HPETFwConfig);
+unsafe impl Zeroable for HPETFwConfig {}
 
 #[allow(non_upper_case_globals)]
 #[no_mangle]
diff --git a/rust/qemu-api/src/zeroable.rs b/rust/qemu-api/src/zeroable.rs
index a3415a2ebc..d8239d0856 100644
--- a/rust/qemu-api/src/zeroable.rs
+++ b/rust/qemu-api/src/zeroable.rs
@@ -4,89 +4,17 @@
 
 /// Encapsulates the requirement that
 /// `MaybeUninit::<Self>::zeroed().assume_init()` does not cause undefined
-/// behavior.  This trait in principle could be implemented as just:
-///
-/// ```
-/// pub unsafe trait Zeroable: Default {
-///     const ZERO: Self = unsafe { ::core::mem::MaybeUninit::<Self>::zeroed().assume_init() };
-/// }
-/// ```
-///
-/// The need for a manual implementation is only because `zeroed()` cannot
-/// be used as a `const fn` prior to Rust 1.75.0. Once we can assume a new
-/// enough version of the compiler, we could provide a `#[derive(Zeroable)]`
-/// macro to check at compile-time that all struct fields are Zeroable, and
-/// use the above blanket implementation of the `ZERO` constant.
+/// behavior.
 ///
 /// # Safety
 ///
-/// Because the implementation of `ZERO` is manual, it does not make
-/// any assumption on the safety of `zeroed()`.  However, other users of the
-/// trait could use it that way.  Do not add this trait to a type unless
-/// all-zeroes is a valid value for the type.  In particular, remember that
-/// raw pointers can be zero, but references and `NonNull<T>` cannot
+/// Do not add this trait to a type unless all-zeroes is a valid value for the
+/// type.  In particular, raw pointers can be zero, but references and
+/// `NonNull<T>` cannot.
 pub unsafe trait Zeroable: Default {
-    const ZERO: Self;
-}
-
-/// A macro that acts similarly to [`core::mem::zeroed()`], only is const
-///
-/// ## Safety
-///
-/// Similar to `core::mem::zeroed()`, except this zeroes padding bits. Zeroed
-/// padding usually isn't relevant to safety, but might be if a C union is used.
-///
-/// Just like for `core::mem::zeroed()`, an all zero byte pattern might not
-/// be a valid value for a type, as is the case for references `&T` and `&mut
-/// T`. Reference types trigger a (denied by default) lint and cause immediate
-/// undefined behavior if the lint is ignored
-///
-/// ```rust compile_fail
-/// use const_zero::const_zero;
-/// // error: any use of this value will cause an error
-/// // note: `#[deny(const_err)]` on by default
-/// const STR: &str = unsafe{const_zero!(&'static str)};
-/// ```
-///
-/// `const_zero` does not work on unsized types:
-///
-/// ```rust compile_fail
-/// use const_zero::const_zero;
-/// // error[E0277]: the size for values of type `[u8]` cannot be known at compilation time
-/// const BYTES: [u8] = unsafe{const_zero!([u8])};
-/// ```
-/// ## Differences with `core::mem::zeroed`
-///
-/// `const_zero` zeroes padding bits, while `core::mem::zeroed` doesn't
-#[macro_export]
-macro_rules! const_zero {
-    // This macro to produce a type-generic zero constant is taken from the
-    // const_zero crate (v0.1.1):
-    //
-    //     https://docs.rs/const-zero/latest/src/const_zero/lib.rs.html
-    //
-    // and used under MIT license
-    ($type_:ty) => {{
-        const TYPE_SIZE: ::core::primitive::usize = ::core::mem::size_of::<$type_>();
-        union TypeAsBytes {
-            bytes: [::core::primitive::u8; TYPE_SIZE],
-            inner: ::core::mem::ManuallyDrop<$type_>,
-        }
-        const ZERO_BYTES: TypeAsBytes = TypeAsBytes {
-            bytes: [0; TYPE_SIZE],
-        };
-        ::core::mem::ManuallyDrop::<$type_>::into_inner(ZERO_BYTES.inner)
-    }};
-}
-
-/// A wrapper to implement the `Zeroable` trait through the `const_zero` macro.
-#[macro_export]
-macro_rules! impl_zeroable {
-    ($type:ty) => {
-        unsafe impl $crate::zeroable::Zeroable for $type {
-            const ZERO: Self = unsafe { $crate::const_zero!($type) };
-        }
-    };
+    /// Return a value of Self whose memory representation consists of all
+    /// zeroes, with the possible exclusion of padding bytes.
+    const ZERO: Self = unsafe { ::core::mem::MaybeUninit::<Self>::zeroed().assume_init() };
 }
 
 // bindgen does not derive Default here
@@ -97,13 +25,13 @@ impl Default for crate::bindings::VMStateFlags {
     }
 }
 
-impl_zeroable!(crate::bindings::Property__bindgen_ty_1);
-impl_zeroable!(crate::bindings::Property);
-impl_zeroable!(crate::bindings::VMStateFlags);
-impl_zeroable!(crate::bindings::VMStateField);
-impl_zeroable!(crate::bindings::VMStateDescription);
-impl_zeroable!(crate::bindings::MemoryRegionOps__bindgen_ty_1);
-impl_zeroable!(crate::bindings::MemoryRegionOps__bindgen_ty_2);
-impl_zeroable!(crate::bindings::MemoryRegionOps);
-impl_zeroable!(crate::bindings::MemTxAttrs);
-impl_zeroable!(crate::bindings::CharBackend);
+unsafe impl Zeroable for crate::bindings::Property__bindgen_ty_1 {}
+unsafe impl Zeroable for crate::bindings::Property {}
+unsafe impl Zeroable for crate::bindings::VMStateFlags {}
+unsafe impl Zeroable for crate::bindings::VMStateField {}
+unsafe impl Zeroable for crate::bindings::VMStateDescription {}
+unsafe impl Zeroable for crate::bindings::MemoryRegionOps__bindgen_ty_1 {}
+unsafe impl Zeroable for crate::bindings::MemoryRegionOps__bindgen_ty_2 {}
+unsafe impl Zeroable for crate::bindings::MemoryRegionOps {}
+unsafe impl Zeroable for crate::bindings::MemTxAttrs {}
+unsafe impl Zeroable for crate::bindings::CharBackend {}

From 3a1c694d74deb478d9822e585e90c5903852eb84 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 2 May 2025 17:58:54 +0200
Subject: [PATCH 0694/2760] rust: qom: fix TODO about zeroability of classes

The proposed suggestion is not correct.  First it is not necessary for
*all* classes to be Zeroable, only for Rust-defined ones; classes
defined in C never implement ObjectImpl.

Second, the parent class field need not be Zeroable.  For example,
ChardevClass's chr_write and chr_be_event fields cannot be NULL,
therefore ChardevClass cannot be Zeroable.  However, char_class_init()
initializes them, therefore ChardevClass could be subclassed by Rust code.

Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/qemu-api/src/qom.rs | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/rust/qemu-api/src/qom.rs b/rust/qemu-api/src/qom.rs
index 6929e4d33a..52e3a1ec98 100644
--- a/rust/qemu-api/src/qom.rs
+++ b/rust/qemu-api/src/qom.rs
@@ -534,9 +534,10 @@ pub trait ObjectImpl: ObjectType + IsA<Object> {
     /// While `klass`'s parent class is initialized on entry, the other fields
     /// are all zero; it is therefore assumed that all fields in `T` can be
     /// zeroed, otherwise it would not be possible to provide the class as a
-    /// `&mut T`.  TODO: add a bound of [`Zeroable`](crate::zeroable::Zeroable)
-    /// to T; this is more easily done once Zeroable does not require a manual
-    /// implementation (Rust 1.75.0).
+    /// `&mut T`.  TODO: it may be possible to add an unsafe trait that checks
+    /// that all fields *after the parent class* (but not the parent class
+    /// itself) are Zeroable.  This unsafe trait can be added via a derive
+    /// macro.
     const CLASS_INIT: fn(&mut Self::Class);
 }
 

From 5df3fe062fb0be9a6689dc0336087b214dd30e5c Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 14 Feb 2025 11:34:44 +0100
Subject: [PATCH 0695/2760] rust: enable clippy::ptr_cast_constness

Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 docs/devel/rust.rst            | 2 --
 rust/Cargo.toml                | 2 +-
 rust/hw/timer/hpet/src/hpet.rs | 2 +-
 rust/qemu-api/src/cell.rs      | 2 +-
 rust/qemu-api/src/chardev.rs   | 2 +-
 rust/qemu-api/src/qom.rs       | 4 ++--
 rust/qemu-api/src/timer.rs     | 2 +-
 7 files changed, 7 insertions(+), 9 deletions(-)

diff --git a/docs/devel/rust.rst b/docs/devel/rust.rst
index 13a002cfe6..a315f66886 100644
--- a/docs/devel/rust.rst
+++ b/docs/devel/rust.rst
@@ -74,8 +74,6 @@ Supported tools
 QEMU supports rustc version 1.63.0 and newer.  Notably, the following features
 are missing:
 
-* ``cast_mut()``/``cast_const()`` (1.65.0).  Use ``as`` instead.
-
 * Generic Associated Types (1.65.0)
 
 * ``CStr::from_bytes_with_nul()`` as a ``const`` function (1.72.0).
diff --git a/rust/Cargo.toml b/rust/Cargo.toml
index eda7980b31..a328634d94 100644
--- a/rust/Cargo.toml
+++ b/rust/Cargo.toml
@@ -71,6 +71,7 @@ no_effect_underscore_binding = "deny"
 option_option = "deny"
 or_fun_call = "deny"
 ptr_as_ptr = "deny"
+ptr_cast_constness = "deny"
 pub_underscore_fields = "deny"
 redundant_clone = "deny"
 redundant_closure_for_method_calls = "deny"
@@ -92,7 +93,6 @@ used_underscore_binding = "deny"
 
 # nice to have, but cannot be enabled yet
 #wildcard_imports = "deny"   # still have many bindings::* imports
-#ptr_cast_constness = "deny" # needs 1.65.0 for cast_mut()/cast_const()
 
 # these may have false positives
 #option_if_let_else = "deny"
diff --git a/rust/hw/timer/hpet/src/hpet.rs b/rust/hw/timer/hpet/src/hpet.rs
index d4364f2f2f..b7a1be05de 100644
--- a/rust/hw/timer/hpet/src/hpet.rs
+++ b/rust/hw/timer/hpet/src/hpet.rs
@@ -219,7 +219,7 @@ impl HPETTimer {
             // SAFETY: the HPETTimer will only be used after the timer
             // is initialized below.
             qemu_timer: unsafe { Timer::new() },
-            state: NonNull::new(state as *const _ as *mut _).unwrap(),
+            state: NonNull::new((state as *const HPETState).cast_mut()).unwrap(),
             config: 0,
             cmp: 0,
             fsb: 0,
diff --git a/rust/qemu-api/src/cell.rs b/rust/qemu-api/src/cell.rs
index ab0785a269..1cb9fdcd53 100644
--- a/rust/qemu-api/src/cell.rs
+++ b/rust/qemu-api/src/cell.rs
@@ -1016,7 +1016,7 @@ impl<T> Opaque<T> {
 
     /// Returns a raw pointer to the opaque data.
     pub const fn as_ptr(&self) -> *const T {
-        self.as_mut_ptr() as *const _
+        self.as_mut_ptr().cast_const()
     }
 
     /// Returns a raw pointer to the opaque data that can be passed to a
diff --git a/rust/qemu-api/src/chardev.rs b/rust/qemu-api/src/chardev.rs
index 146a4852da..6e0590d758 100644
--- a/rust/qemu-api/src/chardev.rs
+++ b/rust/qemu-api/src/chardev.rs
@@ -160,7 +160,7 @@ impl CharBackend {
                 receive_cb,
                 event_cb,
                 None,
-                (owner as *const T as *mut T).cast::<c_void>(),
+                (owner as *const T).cast_mut().cast::<c_void>(),
                 core::ptr::null_mut(),
                 true,
             );
diff --git a/rust/qemu-api/src/qom.rs b/rust/qemu-api/src/qom.rs
index 52e3a1ec98..41e5a5e29a 100644
--- a/rust/qemu-api/src/qom.rs
+++ b/rust/qemu-api/src/qom.rs
@@ -388,7 +388,7 @@ where
     {
         #[allow(clippy::as_ptr_cast_mut)]
         {
-            self.as_ptr::<U>() as *mut _
+            self.as_ptr::<U>().cast_mut()
         }
     }
 }
@@ -638,7 +638,7 @@ impl<T: ObjectType> Owned<T> {
         // SAFETY NOTE: while NonNull requires a mutable pointer, only
         // Deref is implemented so the pointer passed to from_raw
         // remains const
-        Owned(NonNull::new(ptr as *mut T).unwrap())
+        Owned(NonNull::new(ptr.cast_mut()).unwrap())
     }
 
     /// Obtain a raw C pointer from a reference.  `src` is consumed
diff --git a/rust/qemu-api/src/timer.rs b/rust/qemu-api/src/timer.rs
index d697fd742b..868bd88575 100644
--- a/rust/qemu-api/src/timer.rs
+++ b/rust/qemu-api/src/timer.rs
@@ -81,7 +81,7 @@ impl Timer {
                 scale as c_int,
                 attributes as c_int,
                 Some(timer_cb),
-                (opaque as *const T).cast::<c_void>() as *mut c_void,
+                (opaque as *const T).cast::<c_void>().cast_mut(),
             )
         }
     }

From b134a09ffab3b918979007cf40f603e5b54ed597 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 2 May 2025 10:35:49 +0200
Subject: [PATCH 0696/2760] rust: remove offset_of replacement

Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 docs/devel/rust.rst                  |   6 -
 rust/Cargo.lock                      |   1 -
 rust/Cargo.toml                      |   2 +-
 rust/hw/char/pl011/src/device.rs     |   4 +-
 rust/hw/timer/hpet/src/hpet.rs       |   4 +-
 rust/qemu-api-macros/src/lib.rs      |  29 +----
 rust/qemu-api/Cargo.toml             |   3 -
 rust/qemu-api/build.rs               |   7 --
 rust/qemu-api/meson.build            |   4 -
 rust/qemu-api/src/lib.rs             |   4 -
 rust/qemu-api/src/offset_of.rs       | 168 ---------------------------
 rust/qemu-api/src/qdev.rs            |   6 +-
 rust/qemu-api/src/vmstate.rs         |  10 +-
 rust/qemu-api/tests/tests.rs         |   2 -
 rust/qemu-api/tests/vmstate_tests.rs |   5 +-
 15 files changed, 16 insertions(+), 239 deletions(-)
 delete mode 100644 rust/qemu-api/src/offset_of.rs

diff --git a/docs/devel/rust.rst b/docs/devel/rust.rst
index a315f66886..5cfafc532c 100644
--- a/docs/devel/rust.rst
+++ b/docs/devel/rust.rst
@@ -84,12 +84,6 @@ are missing:
 * ``c"" literals`` (stable in 1.77.0).  QEMU provides a ``c_str!()`` macro
   to define ``CStr`` constants easily
 
-* ``offset_of!`` (stable in 1.77.0).  QEMU uses ``offset_of!()`` heavily; it
-  provides a replacement in the ``qemu_api`` crate, but it does not support
-  lifetime parameters and therefore ``&'a Something`` fields in the struct
-  may have to be replaced by ``NonNull<Something>``.  *Nested* ``offset_of!``
-  was only stabilized in Rust 1.82.0, but it is not used.
-
 * inline const expression (stable in 1.79.0), currently worked around with
   associated constants in the ``FnCall`` trait.
 
diff --git a/rust/Cargo.lock b/rust/Cargo.lock
index 2ebf0a11ea..13d580c693 100644
--- a/rust/Cargo.lock
+++ b/rust/Cargo.lock
@@ -108,7 +108,6 @@ version = "0.1.0"
 dependencies = [
  "libc",
  "qemu_api_macros",
- "version_check",
 ]
 
 [[package]]
diff --git a/rust/Cargo.toml b/rust/Cargo.toml
index a328634d94..4f6fe17b50 100644
--- a/rust/Cargo.toml
+++ b/rust/Cargo.toml
@@ -17,7 +17,7 @@ rust-version = "1.77.0"
 [workspace.lints.rust]
 unexpected_cfgs = { level = "deny", check-cfg = [
     'cfg(MESON)', 'cfg(HAVE_GLIB_WITH_ALIGNED_ALLOC)',
-    'cfg(has_offset_of)'] }
+] }
 
 # Occasionally, we may need to silence warnings and clippy lints that
 # were only introduced in newer Rust compiler versions.  Do not croak
diff --git a/rust/hw/char/pl011/src/device.rs b/rust/hw/char/pl011/src/device.rs
index bb2a0f207a..7c563ade9c 100644
--- a/rust/hw/char/pl011/src/device.rs
+++ b/rust/hw/char/pl011/src/device.rs
@@ -74,7 +74,7 @@ impl std::ops::Index<u32> for Fifo {
 }
 
 #[repr(C)]
-#[derive(Debug, Default, qemu_api_macros::offsets)]
+#[derive(Debug, Default)]
 pub struct PL011Registers {
     #[doc(alias = "fr")]
     pub flags: registers::Flags,
@@ -98,7 +98,7 @@ pub struct PL011Registers {
 }
 
 #[repr(C)]
-#[derive(qemu_api_macros::Object, qemu_api_macros::offsets)]
+#[derive(qemu_api_macros::Object)]
 /// PL011 Device Model in QEMU
 pub struct PL011State {
     pub parent_obj: ParentField<SysBusDevice>,
diff --git a/rust/hw/timer/hpet/src/hpet.rs b/rust/hw/timer/hpet/src/hpet.rs
index b7a1be05de..719343a20c 100644
--- a/rust/hw/timer/hpet/src/hpet.rs
+++ b/rust/hw/timer/hpet/src/hpet.rs
@@ -183,7 +183,7 @@ fn timer_handler(timer_cell: &BqlRefCell<HPETTimer>) {
 
 /// HPET Timer Abstraction
 #[repr(C)]
-#[derive(Debug, qemu_api_macros::offsets)]
+#[derive(Debug)]
 pub struct HPETTimer {
     /// timer N index within the timer block (`HPETState`)
     #[doc(alias = "tn")]
@@ -523,7 +523,7 @@ impl HPETTimer {
 
 /// HPET Event Timer Block Abstraction
 #[repr(C)]
-#[derive(qemu_api_macros::Object, qemu_api_macros::offsets)]
+#[derive(qemu_api_macros::Object)]
 pub struct HPETState {
     parent_obj: ParentField<SysBusDevice>,
     iomem: MemoryRegion,
diff --git a/rust/qemu-api-macros/src/lib.rs b/rust/qemu-api-macros/src/lib.rs
index 0bffd2691b..dc14cac4ff 100644
--- a/rust/qemu-api-macros/src/lib.rs
+++ b/rust/qemu-api-macros/src/lib.rs
@@ -6,7 +6,7 @@ use proc_macro::TokenStream;
 use quote::quote;
 use syn::{
     parse_macro_input, parse_quote, punctuated::Punctuated, spanned::Spanned, token::Comma, Data,
-    DeriveInput, Field, Fields, FieldsUnnamed, Ident, Meta, Path, Token, Type, Variant, Visibility,
+    DeriveInput, Field, Fields, FieldsUnnamed, Ident, Meta, Path, Token, Variant,
 };
 
 mod utils;
@@ -151,33 +151,6 @@ pub fn derive_opaque(input: TokenStream) -> TokenStream {
     TokenStream::from(expanded)
 }
 
-#[rustfmt::skip::macros(quote)]
-fn derive_offsets_or_error(input: DeriveInput) -> Result<proc_macro2::TokenStream, MacroError> {
-    is_c_repr(&input, "#[derive(offsets)]")?;
-
-    let name = &input.ident;
-    let fields = get_fields(&input, "#[derive(offsets)]")?;
-    let field_names: Vec<&Ident> = fields.iter().map(|f| f.ident.as_ref().unwrap()).collect();
-    let field_types: Vec<&Type> = fields.iter().map(|f| &f.ty).collect();
-    let field_vis: Vec<&Visibility> = fields.iter().map(|f| &f.vis).collect();
-
-    Ok(quote! {
-	::qemu_api::with_offsets! {
-	    struct #name {
-		#(#field_vis #field_names: #field_types,)*
-	    }
-	}
-    })
-}
-
-#[proc_macro_derive(offsets)]
-pub fn derive_offsets(input: TokenStream) -> TokenStream {
-    let input = parse_macro_input!(input as DeriveInput);
-    let expanded = derive_offsets_or_error(input).unwrap_or_else(Into::into);
-
-    TokenStream::from(expanded)
-}
-
 #[allow(non_snake_case)]
 fn get_repr_uN(input: &DeriveInput, msg: &str) -> Result<Path, MacroError> {
     let repr = input.attrs.iter().find(|attr| attr.path().is_ident("repr"));
diff --git a/rust/qemu-api/Cargo.toml b/rust/qemu-api/Cargo.toml
index ca1b04269f..c96cf50e7a 100644
--- a/rust/qemu-api/Cargo.toml
+++ b/rust/qemu-api/Cargo.toml
@@ -17,9 +17,6 @@ rust-version.workspace = true
 qemu_api_macros = { path = "../qemu-api-macros" }
 libc = "0.2.162"
 
-[build-dependencies]
-version_check = "~0.9"
-
 [features]
 default = ["debug_cell"]
 allocator = []
diff --git a/rust/qemu-api/build.rs b/rust/qemu-api/build.rs
index 471e6c633d..470be2a4d5 100644
--- a/rust/qemu-api/build.rs
+++ b/rust/qemu-api/build.rs
@@ -8,8 +8,6 @@ use std::os::unix::fs::symlink as symlink_file;
 use std::os::windows::fs::symlink_file;
 use std::{env, fs::remove_file, io::Result, path::Path};
 
-use version_check as rustc;
-
 fn main() -> Result<()> {
     // Placing bindings.inc.rs in the source directory is supported
     // but not documented or encouraged.
@@ -38,11 +36,6 @@ fn main() -> Result<()> {
     }
     symlink_file(file, dest_path)?;
 
-    // Check for available rustc features
-    if rustc::is_min_version("1.77.0").unwrap_or(false) {
-        println!("cargo:rustc-cfg=has_offset_of");
-    }
-
     println!("cargo:rerun-if-changed=build.rs");
     Ok(())
 }
diff --git a/rust/qemu-api/meson.build b/rust/qemu-api/meson.build
index 858685ddd4..95e65643ae 100644
--- a/rust/qemu-api/meson.build
+++ b/rust/qemu-api/meson.build
@@ -5,9 +5,6 @@ _qemu_api_cfg = run_command(rustc_args,
 libc_dep = dependency('libc-0.2-rs')
 
 # _qemu_api_cfg += ['--cfg', 'feature="allocator"']
-if rustc.version().version_compare('>=1.77.0')
-  _qemu_api_cfg += ['--cfg', 'has_offset_of']
-endif
 if get_option('debug_mutex')
   _qemu_api_cfg += ['--cfg', 'feature="debug_cell"']
 endif
@@ -28,7 +25,6 @@ _qemu_api_rs = static_library(
       'src/irq.rs',
       'src/memory.rs',
       'src/module.rs',
-      'src/offset_of.rs',
       'src/prelude.rs',
       'src/qdev.rs',
       'src/qom.rs',
diff --git a/rust/qemu-api/src/lib.rs b/rust/qemu-api/src/lib.rs
index c3641e893b..90c1963666 100644
--- a/rust/qemu-api/src/lib.rs
+++ b/rust/qemu-api/src/lib.rs
@@ -23,7 +23,6 @@ pub mod errno;
 pub mod irq;
 pub mod memory;
 pub mod module;
-pub mod offset_of;
 pub mod qdev;
 pub mod qom;
 pub mod sysbus;
@@ -165,6 +164,3 @@ unsafe impl GlobalAlloc for QemuAllocator {
         }
     }
 }
-
-#[cfg(has_offset_of)]
-pub use core::mem::offset_of;
diff --git a/rust/qemu-api/src/offset_of.rs b/rust/qemu-api/src/offset_of.rs
deleted file mode 100644
index 373229bbde..0000000000
--- a/rust/qemu-api/src/offset_of.rs
+++ /dev/null
@@ -1,168 +0,0 @@
-// SPDX-License-Identifier: MIT
-
-#![doc(hidden)]
-//! This module provides macros that emulate the functionality of
-//! `core::mem::offset_of` on older versions of Rust.
-//!
-//! Documentation is hidden because it only exposes macros, which
-//! are exported directly from `qemu_api`.
-
-/// This macro provides the same functionality as `core::mem::offset_of`,
-/// except that only one level of field access is supported.  The declaration
-/// of the struct must be wrapped with `with_offsets! { }`.
-///
-/// It is needed because `offset_of!` was only stabilized in Rust 1.77.
-#[cfg(not(has_offset_of))]
-#[macro_export]
-macro_rules! offset_of {
-    ($Container:ty, $field:ident) => {
-        <$Container>::OFFSET_TO__.$field
-    };
-}
-
-/// A wrapper for struct declarations, that allows using `offset_of!` in
-/// versions of Rust prior to 1.77
-#[macro_export]
-macro_rules! with_offsets {
-    // This method to generate field offset constants comes from:
-    //
-    //     https://play.rust-lang.org/?version=stable&mode=debug&edition=2018&gist=10a22a9b8393abd7b541d8fc844bc0df
-    //
-    // used under MIT license with permission of Yandros aka Daniel Henry-Mantilla
-    (
-        $(#[$struct_meta:meta])*
-        $struct_vis:vis
-        struct $StructName:ident {
-            $(
-                $(#[$field_meta:meta])*
-                $field_vis:vis
-                $field_name:ident : $field_ty:ty
-            ),*
-            $(,)?
-        }
-    ) => (
-        #[cfg(not(has_offset_of))]
-        const _: () = {
-            struct StructOffsetsHelper<T>(std::marker::PhantomData<T>);
-            const END_OF_PREV_FIELD: usize = 0;
-
-            // populate StructOffsetsHelper<T> with associated consts,
-            // one for each field
-            $crate::with_offsets! {
-                @struct $StructName
-                @names [ $($field_name)* ]
-                @tys [ $($field_ty ,)*]
-            }
-
-            // now turn StructOffsetsHelper<T>'s consts into a single struct,
-            // applying field visibility.  This provides better error messages
-            // than if offset_of! used StructOffsetsHelper::<T> directly.
-            pub
-            struct StructOffsets {
-                $(
-                    $field_vis
-                    $field_name: usize,
-                )*
-            }
-            impl $StructName {
-                pub
-                const OFFSET_TO__: StructOffsets = StructOffsets {
-                    $(
-                        $field_name: StructOffsetsHelper::<$StructName>::$field_name,
-                    )*
-                };
-            }
-        };
-    );
-
-    (
-        @struct $StructName:ident
-        @names []
-        @tys []
-    ) => ();
-
-    (
-        @struct $StructName:ident
-        @names [$field_name:ident $($other_names:tt)*]
-        @tys [$field_ty:ty , $($other_tys:tt)*]
-    ) => (
-        #[allow(non_local_definitions)]
-        #[allow(clippy::modulo_one)]
-        impl StructOffsetsHelper<$StructName> {
-            #[allow(nonstandard_style)]
-            const $field_name: usize = {
-                const ALIGN: usize = std::mem::align_of::<$field_ty>();
-                const TRAIL: usize = END_OF_PREV_FIELD % ALIGN;
-                END_OF_PREV_FIELD + (if TRAIL == 0 { 0usize } else { ALIGN - TRAIL })
-            };
-        }
-        const _: () = {
-            const END_OF_PREV_FIELD: usize =
-                StructOffsetsHelper::<$StructName>::$field_name +
-                std::mem::size_of::<$field_ty>()
-            ;
-            $crate::with_offsets! {
-                @struct $StructName
-                @names [$($other_names)*]
-                @tys [$($other_tys)*]
-            }
-        };
-    );
-}
-
-#[cfg(test)]
-mod tests {
-    use crate::offset_of;
-
-    #[repr(C)]
-    struct Foo {
-        a: u16,
-        b: u32,
-        c: u64,
-        d: u16,
-    }
-
-    #[repr(C)]
-    struct Bar {
-        pub a: u16,
-        pub b: u64,
-        c: Foo,
-        d: u64,
-    }
-
-    crate::with_offsets! {
-        #[repr(C)]
-        struct Bar {
-            pub a: u16,
-            pub b: u64,
-            c: Foo,
-            d: u64,
-        }
-    }
-
-    #[repr(C)]
-    pub struct Baz {
-        b: u32,
-        a: u8,
-    }
-    crate::with_offsets! {
-        #[repr(C)]
-        pub struct Baz {
-            b: u32,
-            a: u8,
-        }
-    }
-
-    #[test]
-    fn test_offset_of() {
-        const OFFSET_TO_C: usize = offset_of!(Bar, c);
-
-        assert_eq!(offset_of!(Bar, a), 0);
-        assert_eq!(offset_of!(Bar, b), 8);
-        assert_eq!(OFFSET_TO_C, 16);
-        assert_eq!(offset_of!(Bar, d), 40);
-
-        assert_eq!(offset_of!(Baz, b), 0);
-        assert_eq!(offset_of!(Baz, a), 4);
-    }
-}
diff --git a/rust/qemu-api/src/qdev.rs b/rust/qemu-api/src/qdev.rs
index 17c7fecabe..1279d7a58d 100644
--- a/rust/qemu-api/src/qdev.rs
+++ b/rust/qemu-api/src/qdev.rs
@@ -190,7 +190,7 @@ macro_rules! define_property {
             // use associated function syntax for type checking
             name: ::std::ffi::CStr::as_ptr($name),
             info: $prop,
-            offset: $crate::offset_of!($state, $field) as isize,
+            offset: ::std::mem::offset_of!($state, $field) as isize,
             bitnr: $bitnr,
             set_default: true,
             defval: $crate::bindings::Property__bindgen_ty_1 { u: $defval as u64 },
@@ -202,7 +202,7 @@ macro_rules! define_property {
             // use associated function syntax for type checking
             name: ::std::ffi::CStr::as_ptr($name),
             info: $prop,
-            offset: $crate::offset_of!($state, $field) as isize,
+            offset: ::std::mem::offset_of!($state, $field) as isize,
             set_default: true,
             defval: $crate::bindings::Property__bindgen_ty_1 { u: $defval as u64 },
             ..$crate::zeroable::Zeroable::ZERO
@@ -213,7 +213,7 @@ macro_rules! define_property {
             // use associated function syntax for type checking
             name: ::std::ffi::CStr::as_ptr($name),
             info: $prop,
-            offset: $crate::offset_of!($state, $field) as isize,
+            offset: ::std::mem::offset_of!($state, $field) as isize,
             set_default: false,
             ..$crate::zeroable::Zeroable::ZERO
         }
diff --git a/rust/qemu-api/src/vmstate.rs b/rust/qemu-api/src/vmstate.rs
index c0f29f7418..205f35a21f 100644
--- a/rust/qemu-api/src/vmstate.rs
+++ b/rust/qemu-api/src/vmstate.rs
@@ -205,8 +205,8 @@ macro_rules! vmstate_of {
             name: ::core::concat!(::core::stringify!($field_name), "\0")
                 .as_bytes()
                 .as_ptr() as *const ::std::os::raw::c_char,
-            offset: $crate::offset_of!($struct_name, $field_name),
-            $(num_offset: $crate::offset_of!($struct_name, $num),)?
+            offset: ::std::mem::offset_of!($struct_name, $field_name),
+            $(num_offset: ::std::mem::offset_of!($struct_name, $num),)?
             $(field_exists: $crate::vmstate_exist_fn!($struct_name, $test_fn),)?
             // The calls to `call_func_with_field!` are the magic that
             // computes most of the VMStateField from the type of the field.
@@ -483,10 +483,10 @@ macro_rules! vmstate_struct {
             name: ::core::concat!(::core::stringify!($field_name), "\0")
                 .as_bytes()
                 .as_ptr() as *const ::std::os::raw::c_char,
-            $(num_offset: $crate::offset_of!($struct_name, $num),)?
+            $(num_offset: ::std::mem::offset_of!($struct_name, $num),)?
             offset: {
                 $crate::assert_field_type!($struct_name, $field_name, $type $(, num = $num)?);
-                $crate::offset_of!($struct_name, $field_name)
+                ::std::mem::offset_of!($struct_name, $field_name)
             },
             size: ::core::mem::size_of::<$type>(),
             flags: $crate::bindings::VMStateFlags::VMS_STRUCT,
@@ -518,7 +518,7 @@ macro_rules! vmstate_clock {
                     $field_name,
                     $crate::qom::Owned<$crate::qdev::Clock> $(, num = $num)?
                 );
-                $crate::offset_of!($struct_name, $field_name)
+                ::std::mem::offset_of!($struct_name, $field_name)
             },
             size: ::core::mem::size_of::<*const $crate::qdev::Clock>(),
             flags: $crate::bindings::VMStateFlags(
diff --git a/rust/qemu-api/tests/tests.rs b/rust/qemu-api/tests/tests.rs
index 99a7aab6fe..d045808c3a 100644
--- a/rust/qemu-api/tests/tests.rs
+++ b/rust/qemu-api/tests/tests.rs
@@ -26,7 +26,6 @@ pub static VMSTATE: VMStateDescription = VMStateDescription {
     ..Zeroable::ZERO
 };
 
-#[derive(qemu_api_macros::offsets)]
 #[repr(C)]
 #[derive(qemu_api_macros::Object)]
 pub struct DummyState {
@@ -79,7 +78,6 @@ impl DeviceImpl for DummyState {
     }
 }
 
-#[derive(qemu_api_macros::offsets)]
 #[repr(C)]
 #[derive(qemu_api_macros::Object)]
 pub struct DummyChildState {
diff --git a/rust/qemu-api/tests/vmstate_tests.rs b/rust/qemu-api/tests/vmstate_tests.rs
index 9a56ffd238..cc3527a9b6 100644
--- a/rust/qemu-api/tests/vmstate_tests.rs
+++ b/rust/qemu-api/tests/vmstate_tests.rs
@@ -33,7 +33,7 @@ const FOO_ARRAY_MAX: usize = 3;
 //     - VMSTATE_VARRAY_UINT16_UNSAFE
 //     - VMSTATE_VARRAY_MULTIPLY
 #[repr(C)]
-#[derive(Default, qemu_api_macros::offsets)]
+#[derive(Default)]
 struct FooA {
     arr: [u8; FOO_ARRAY_MAX],
     num: u16,
@@ -154,7 +154,7 @@ fn test_vmstate_varray_multiply() {
 //     - VMSTATE_ARRAY
 //     - VMSTATE_STRUCT_VARRAY_UINT8 with BqlCell wrapper & test_fn
 #[repr(C)]
-#[derive(Default, qemu_api_macros::offsets)]
+#[derive(Default)]
 struct FooB {
     arr_a: [FooA; FOO_ARRAY_MAX],
     num_a: u8,
@@ -329,7 +329,6 @@ struct FooCWrapper([Opaque<*mut u8>; FOO_ARRAY_MAX]); // Though Opaque<> array i
 impl_vmstate_forward!(FooCWrapper);
 
 #[repr(C)]
-#[derive(qemu_api_macros::offsets)]
 struct FooC {
     ptr: *const i32,
     ptr_a: NonNull<FooA>,

From f117857b39fb42c56be23316e2d76db5b13cec8d Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 2 May 2025 10:39:08 +0200
Subject: [PATCH 0697/2760] rust: replace c_str! with c"" literals

Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 docs/devel/rust.rst                    |  6 +--
 rust/hw/char/pl011/src/device_class.rs | 11 +++--
 rust/hw/char/pl011/src/lib.rs          |  6 +--
 rust/hw/timer/hpet/src/hpet.rs         | 19 ++++----
 rust/hw/timer/hpet/src/lib.rs          |  4 +-
 rust/qemu-api/meson.build              |  1 -
 rust/qemu-api/src/c_str.rs             | 61 --------------------------
 rust/qemu-api/src/cell.rs              |  4 +-
 rust/qemu-api/src/lib.rs               |  1 -
 rust/qemu-api/src/vmstate.rs           |  2 +-
 rust/qemu-api/tests/tests.rs           |  9 ++--
 rust/qemu-api/tests/vmstate_tests.rs   | 15 +++----
 12 files changed, 32 insertions(+), 107 deletions(-)
 delete mode 100644 rust/qemu-api/src/c_str.rs

diff --git a/docs/devel/rust.rst b/docs/devel/rust.rst
index 5cfafc532c..557cee72f3 100644
--- a/docs/devel/rust.rst
+++ b/docs/devel/rust.rst
@@ -81,9 +81,6 @@ are missing:
 * "Return position ``impl Trait`` in Traits" (1.75.0, blocker for including
   the pinned-init create).
 
-* ``c"" literals`` (stable in 1.77.0).  QEMU provides a ``c_str!()`` macro
-  to define ``CStr`` constants easily
-
 * inline const expression (stable in 1.79.0), currently worked around with
   associated constants in the ``FnCall`` trait.
 
@@ -166,7 +163,6 @@ module           status
 ``bitops``       complete
 ``callbacks``    complete
 ``cell``         stable
-``c_str``        complete
 ``errno``        complete
 ``irq``          complete
 ``memory``       stable
@@ -423,7 +419,7 @@ Adding dependencies
 Generally, the set of dependent crates is kept small.  Think twice before
 adding a new external crate, especially if it comes with a large set of
 dependencies itself.  Sometimes QEMU only needs a small subset of the
-functionality; see for example QEMU's ``assertions`` or ``c_str`` modules.
+functionality; see for example QEMU's ``assertions`` module.
 
 On top of this recommendation, adding external crates to QEMU is a
 slightly complicated process, mostly due to the need to teach Meson how
diff --git a/rust/hw/char/pl011/src/device_class.rs b/rust/hw/char/pl011/src/device_class.rs
index cd2dc33c20..d328d84632 100644
--- a/rust/hw/char/pl011/src/device_class.rs
+++ b/rust/hw/char/pl011/src/device_class.rs
@@ -9,7 +9,6 @@ use std::{
 
 use qemu_api::{
     bindings::{qdev_prop_bool, qdev_prop_chr},
-    c_str,
     prelude::*,
     vmstate::VMStateDescription,
     vmstate_clock, vmstate_fields, vmstate_of, vmstate_struct, vmstate_subsections, vmstate_unused,
@@ -25,7 +24,7 @@ extern "C" fn pl011_clock_needed(opaque: *mut c_void) -> bool {
 
 /// Migration subsection for [`PL011State`] clock.
 static VMSTATE_PL011_CLOCK: VMStateDescription = VMStateDescription {
-    name: c_str!("pl011/clock").as_ptr(),
+    name: c"pl011/clock".as_ptr(),
     version_id: 1,
     minimum_version_id: 1,
     needed: Some(pl011_clock_needed),
@@ -46,7 +45,7 @@ extern "C" fn pl011_post_load(opaque: *mut c_void, version_id: c_int) -> c_int {
 }
 
 static VMSTATE_PL011_REGS: VMStateDescription = VMStateDescription {
-    name: c_str!("pl011/regs").as_ptr(),
+    name: c"pl011/regs".as_ptr(),
     version_id: 2,
     minimum_version_id: 2,
     fields: vmstate_fields! {
@@ -70,7 +69,7 @@ static VMSTATE_PL011_REGS: VMStateDescription = VMStateDescription {
 };
 
 pub static VMSTATE_PL011: VMStateDescription = VMStateDescription {
-    name: c_str!("pl011").as_ptr(),
+    name: c"pl011".as_ptr(),
     version_id: 2,
     minimum_version_id: 2,
     post_load: Some(pl011_post_load),
@@ -87,14 +86,14 @@ pub static VMSTATE_PL011: VMStateDescription = VMStateDescription {
 qemu_api::declare_properties! {
     PL011_PROPERTIES,
     qemu_api::define_property!(
-        c_str!("chardev"),
+        c"chardev",
         PL011State,
         char_backend,
         unsafe { &qdev_prop_chr },
         CharBackend
     ),
     qemu_api::define_property!(
-        c_str!("migrate-clk"),
+        c"migrate-clk",
         PL011State,
         migrate_clock,
         unsafe { &qdev_prop_bool },
diff --git a/rust/hw/char/pl011/src/lib.rs b/rust/hw/char/pl011/src/lib.rs
index dbae76991c..5c4fbc9d14 100644
--- a/rust/hw/char/pl011/src/lib.rs
+++ b/rust/hw/char/pl011/src/lib.rs
@@ -12,13 +12,11 @@
 //! See [`PL011State`](crate::device::PL011State) for the device model type and
 //! the [`registers`] module for register types.
 
-use qemu_api::c_str;
-
 mod device;
 mod device_class;
 mod registers;
 
 pub use device::pl011_create;
 
-pub const TYPE_PL011: &::std::ffi::CStr = c_str!("pl011");
-pub const TYPE_PL011_LUMINARY: &::std::ffi::CStr = c_str!("pl011_luminary");
+pub const TYPE_PL011: &::std::ffi::CStr = c"pl011";
+pub const TYPE_PL011_LUMINARY: &::std::ffi::CStr = c"pl011_luminary";
diff --git a/rust/hw/timer/hpet/src/hpet.rs b/rust/hw/timer/hpet/src/hpet.rs
index 719343a20c..779681d650 100644
--- a/rust/hw/timer/hpet/src/hpet.rs
+++ b/rust/hw/timer/hpet/src/hpet.rs
@@ -14,7 +14,6 @@ use qemu_api::{
         address_space_memory, address_space_stl_le, qdev_prop_bit, qdev_prop_bool,
         qdev_prop_uint32, qdev_prop_uint8,
     },
-    c_str,
     cell::{BqlCell, BqlRefCell},
     irq::InterruptSource,
     memory::{
@@ -908,7 +907,7 @@ impl ObjectImpl for HPETState {
 qemu_api::declare_properties! {
     HPET_PROPERTIES,
     qemu_api::define_property!(
-        c_str!("timers"),
+        c"timers",
         HPETState,
         num_timers,
         unsafe { &qdev_prop_uint8 },
@@ -916,7 +915,7 @@ qemu_api::declare_properties! {
         default = HPET_MIN_TIMERS
     ),
     qemu_api::define_property!(
-        c_str!("msi"),
+        c"msi",
         HPETState,
         flags,
         unsafe { &qdev_prop_bit },
@@ -925,7 +924,7 @@ qemu_api::declare_properties! {
         default = false,
     ),
     qemu_api::define_property!(
-        c_str!("hpet-intcap"),
+        c"hpet-intcap",
         HPETState,
         int_route_cap,
         unsafe { &qdev_prop_uint32 },
@@ -933,7 +932,7 @@ qemu_api::declare_properties! {
         default = 0
     ),
     qemu_api::define_property!(
-        c_str!("hpet-offset-saved"),
+        c"hpet-offset-saved",
         HPETState,
         hpet_offset_saved,
         unsafe { &qdev_prop_bool },
@@ -974,7 +973,7 @@ unsafe extern "C" fn hpet_post_load(opaque: *mut c_void, version_id: c_int) -> c
 }
 
 static VMSTATE_HPET_RTC_IRQ_LEVEL: VMStateDescription = VMStateDescription {
-    name: c_str!("hpet/rtc_irq_level").as_ptr(),
+    name: c"hpet/rtc_irq_level".as_ptr(),
     version_id: 1,
     minimum_version_id: 1,
     needed: Some(hpet_rtc_irq_level_needed),
@@ -985,7 +984,7 @@ static VMSTATE_HPET_RTC_IRQ_LEVEL: VMStateDescription = VMStateDescription {
 };
 
 static VMSTATE_HPET_OFFSET: VMStateDescription = VMStateDescription {
-    name: c_str!("hpet/offset").as_ptr(),
+    name: c"hpet/offset".as_ptr(),
     version_id: 1,
     minimum_version_id: 1,
     needed: Some(hpet_offset_needed),
@@ -996,7 +995,7 @@ static VMSTATE_HPET_OFFSET: VMStateDescription = VMStateDescription {
 };
 
 static VMSTATE_HPET_TIMER: VMStateDescription = VMStateDescription {
-    name: c_str!("hpet_timer").as_ptr(),
+    name: c"hpet_timer".as_ptr(),
     version_id: 1,
     minimum_version_id: 1,
     fields: vmstate_fields! {
@@ -1011,10 +1010,10 @@ static VMSTATE_HPET_TIMER: VMStateDescription = VMStateDescription {
     ..Zeroable::ZERO
 };
 
-const VALIDATE_TIMERS_NAME: &CStr = c_str!("num_timers must match");
+const VALIDATE_TIMERS_NAME: &CStr = c"num_timers must match";
 
 static VMSTATE_HPET: VMStateDescription = VMStateDescription {
-    name: c_str!("hpet").as_ptr(),
+    name: c"hpet".as_ptr(),
     version_id: 2,
     minimum_version_id: 1,
     pre_save: Some(hpet_pre_save),
diff --git a/rust/hw/timer/hpet/src/lib.rs b/rust/hw/timer/hpet/src/lib.rs
index 5e7c961c28..1954584a87 100644
--- a/rust/hw/timer/hpet/src/lib.rs
+++ b/rust/hw/timer/hpet/src/lib.rs
@@ -7,9 +7,7 @@
 //! This library implements a device model for the IA-PC HPET (High
 //! Precision Event Timers) device in QEMU.
 
-use qemu_api::c_str;
-
 pub mod fw_cfg;
 pub mod hpet;
 
-pub const TYPE_HPET: &::std::ffi::CStr = c_str!("hpet");
+pub const TYPE_HPET: &::std::ffi::CStr = c"hpet";
diff --git a/rust/qemu-api/meson.build b/rust/qemu-api/meson.build
index 95e65643ae..1696df705b 100644
--- a/rust/qemu-api/meson.build
+++ b/rust/qemu-api/meson.build
@@ -20,7 +20,6 @@ _qemu_api_rs = static_library(
       'src/callbacks.rs',
       'src/cell.rs',
       'src/chardev.rs',
-      'src/c_str.rs',
       'src/errno.rs',
       'src/irq.rs',
       'src/memory.rs',
diff --git a/rust/qemu-api/src/c_str.rs b/rust/qemu-api/src/c_str.rs
deleted file mode 100644
index 3fa61b59c7..0000000000
--- a/rust/qemu-api/src/c_str.rs
+++ /dev/null
@@ -1,61 +0,0 @@
-// Copyright 2024 Red Hat, Inc.
-// Author(s): Paolo Bonzini <pbonzini@redhat.com>
-// SPDX-License-Identifier: GPL-2.0-or-later
-
-#![doc(hidden)]
-//! This module provides a macro to define a constant of type
-//! [`CStr`](std::ffi::CStr), for compatibility with versions of
-//! Rust that lack `c""` literals.
-//!
-//! Documentation is hidden because it only exposes macros, which
-//! are exported directly from `qemu_api`.
-
-#[macro_export]
-/// Given a string constant _without_ embedded or trailing NULs, return
-/// a `CStr`.
-///
-/// Needed for compatibility with Rust <1.77.
-macro_rules! c_str {
-    ($str:expr) => {{
-        const STRING: &str = concat!($str, "\0");
-        const BYTES: &[u8] = STRING.as_bytes();
-
-        // "for" is not allowed in const context... oh well,
-        // everybody loves some lisp.  This could be turned into
-        // a procedural macro if this is a problem; alternatively
-        // Rust 1.72 makes CStr::from_bytes_with_nul a const function.
-        const fn f(b: &[u8], i: usize) {
-            if i == b.len() - 1 {
-            } else if b[i] == 0 {
-                panic!("c_str argument contains NUL")
-            } else {
-                f(b, i + 1)
-            }
-        }
-        f(BYTES, 0);
-
-        // SAFETY: absence of NULs apart from the final byte was checked above
-        unsafe { std::ffi::CStr::from_bytes_with_nul_unchecked(BYTES) }
-    }};
-}
-
-#[cfg(test)]
-mod tests {
-    use std::ffi::CStr;
-
-    use crate::c_str;
-
-    #[test]
-    fn test_cstr_macro() {
-        let good = c_str!("🦀");
-        let good_bytes = b"\xf0\x9f\xa6\x80\0";
-        assert_eq!(good.to_bytes_with_nul(), good_bytes);
-    }
-
-    #[test]
-    fn test_cstr_macro_const() {
-        const GOOD: &CStr = c_str!("🦀");
-        const GOOD_BYTES: &[u8] = b"\xf0\x9f\xa6\x80\0";
-        assert_eq!(GOOD.to_bytes_with_nul(), GOOD_BYTES);
-    }
-}
diff --git a/rust/qemu-api/src/cell.rs b/rust/qemu-api/src/cell.rs
index 1cb9fdcd53..05ce09f6cb 100644
--- a/rust/qemu-api/src/cell.rs
+++ b/rust/qemu-api/src/cell.rs
@@ -77,13 +77,13 @@
 //!
 //! ```
 //! # use qemu_api::prelude::*;
-//! # use qemu_api::{c_str, cell::BqlRefCell, irq::InterruptSource, irq::IRQState};
+//! # use qemu_api::{cell::BqlRefCell, irq::InterruptSource, irq::IRQState};
 //! # use qemu_api::{sysbus::SysBusDevice, qom::Owned, qom::ParentField};
 //! # const N_GPIOS: usize = 8;
 //! # struct PL061Registers { /* ... */ }
 //! # unsafe impl ObjectType for PL061State {
 //! #     type Class = <SysBusDevice as ObjectType>::Class;
-//! #     const TYPE_NAME: &'static std::ffi::CStr = c_str!("pl061");
+//! #     const TYPE_NAME: &'static std::ffi::CStr = c"pl061";
 //! # }
 //! struct PL061State {
 //!     parent_obj: ParentField<SysBusDevice>,
diff --git a/rust/qemu-api/src/lib.rs b/rust/qemu-api/src/lib.rs
index 90c1963666..234a94e3c2 100644
--- a/rust/qemu-api/src/lib.rs
+++ b/rust/qemu-api/src/lib.rs
@@ -15,7 +15,6 @@ pub mod prelude;
 
 pub mod assertions;
 pub mod bitops;
-pub mod c_str;
 pub mod callbacks;
 pub mod cell;
 pub mod chardev;
diff --git a/rust/qemu-api/src/vmstate.rs b/rust/qemu-api/src/vmstate.rs
index 205f35a21f..9c8b2398e9 100644
--- a/rust/qemu-api/src/vmstate.rs
+++ b/rust/qemu-api/src/vmstate.rs
@@ -427,7 +427,7 @@ unsafe impl<T: VMState, const N: usize> VMState for [T; N] {
 macro_rules! vmstate_unused {
     ($size:expr) => {{
         $crate::bindings::VMStateField {
-            name: $crate::c_str!("unused").as_ptr(),
+            name: c"unused".as_ptr(),
             size: $size,
             info: unsafe { ::core::ptr::addr_of!($crate::bindings::vmstate_info_unused_buffer) },
             flags: $crate::bindings::VMStateFlags::VMS_BUFFER,
diff --git a/rust/qemu-api/tests/tests.rs b/rust/qemu-api/tests/tests.rs
index d045808c3a..a658a49fcf 100644
--- a/rust/qemu-api/tests/tests.rs
+++ b/rust/qemu-api/tests/tests.rs
@@ -6,7 +6,6 @@ use std::{ffi::CStr, ptr::addr_of};
 
 use qemu_api::{
     bindings::{module_call_init, module_init_type, qdev_prop_bool},
-    c_str,
     cell::{self, BqlCell},
     declare_properties, define_property,
     prelude::*,
@@ -21,7 +20,7 @@ mod vmstate_tests;
 
 // Test that macros can compile.
 pub static VMSTATE: VMStateDescription = VMStateDescription {
-    name: c_str!("name").as_ptr(),
+    name: c"name".as_ptr(),
     unmigratable: true,
     ..Zeroable::ZERO
 };
@@ -48,7 +47,7 @@ impl DummyClass {
 declare_properties! {
     DUMMY_PROPERTIES,
         define_property!(
-            c_str!("migrate-clk"),
+            c"migrate-clk",
             DummyState,
             migrate_clock,
             unsafe { &qdev_prop_bool },
@@ -58,7 +57,7 @@ declare_properties! {
 
 unsafe impl ObjectType for DummyState {
     type Class = DummyClass;
-    const TYPE_NAME: &'static CStr = c_str!("dummy");
+    const TYPE_NAME: &'static CStr = c"dummy";
 }
 
 impl ObjectImpl for DummyState {
@@ -92,7 +91,7 @@ pub struct DummyChildClass {
 
 unsafe impl ObjectType for DummyChildState {
     type Class = DummyChildClass;
-    const TYPE_NAME: &'static CStr = c_str!("dummy_child");
+    const TYPE_NAME: &'static CStr = c"dummy_child";
 }
 
 impl ObjectImpl for DummyChildState {
diff --git a/rust/qemu-api/tests/vmstate_tests.rs b/rust/qemu-api/tests/vmstate_tests.rs
index cc3527a9b6..ad0fc5cd5d 100644
--- a/rust/qemu-api/tests/vmstate_tests.rs
+++ b/rust/qemu-api/tests/vmstate_tests.rs
@@ -14,7 +14,6 @@ use qemu_api::{
         vmstate_info_bool, vmstate_info_int32, vmstate_info_int64, vmstate_info_int8,
         vmstate_info_uint64, vmstate_info_uint8, vmstate_info_unused_buffer, VMStateFlags,
     },
-    c_str,
     cell::{BqlCell, Opaque},
     impl_vmstate_forward,
     vmstate::{VMStateDescription, VMStateField},
@@ -43,7 +42,7 @@ struct FooA {
 }
 
 static VMSTATE_FOOA: VMStateDescription = VMStateDescription {
-    name: c_str!("foo_a").as_ptr(),
+    name: c"foo_a".as_ptr(),
     version_id: 1,
     minimum_version_id: 1,
     fields: vmstate_fields! {
@@ -173,7 +172,7 @@ fn validate_foob(_state: &FooB, _version_id: u8) -> bool {
 }
 
 static VMSTATE_FOOB: VMStateDescription = VMStateDescription {
-    name: c_str!("foo_b").as_ptr(),
+    name: c"foo_b".as_ptr(),
     version_id: 2,
     minimum_version_id: 1,
     fields: vmstate_fields! {
@@ -337,7 +336,7 @@ struct FooC {
 }
 
 static VMSTATE_FOOC: VMStateDescription = VMStateDescription {
-    name: c_str!("foo_c").as_ptr(),
+    name: c"foo_c".as_ptr(),
     version_id: 3,
     minimum_version_id: 1,
     fields: vmstate_fields! {
@@ -452,13 +451,13 @@ fn validate_food_2(_state: &FooD, _version_id: u8) -> bool {
 }
 
 static VMSTATE_FOOD: VMStateDescription = VMStateDescription {
-    name: c_str!("foo_d").as_ptr(),
+    name: c"foo_d".as_ptr(),
     version_id: 3,
     minimum_version_id: 1,
     fields: vmstate_fields! {
-        vmstate_validate!(FooD, c_str!("foo_d_0"), FooD::validate_food_0),
-        vmstate_validate!(FooD, c_str!("foo_d_1"), FooD::validate_food_1),
-        vmstate_validate!(FooD, c_str!("foo_d_2"), validate_food_2),
+        vmstate_validate!(FooD, c"foo_d_0", FooD::validate_food_0),
+        vmstate_validate!(FooD, c"foo_d_1", FooD::validate_food_1),
+        vmstate_validate!(FooD, c"foo_d_2", validate_food_2),
     },
     ..Zeroable::ZERO
 };

From 1017041ff4f04e3bdff6404b366d53c836f5d2fe Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 2 May 2025 10:40:54 +0200
Subject: [PATCH 0698/2760] docs: rust: update for newer minimum supported
 version

Remove leftover notes for Rust changes between 1.63.0 and 1.77.0.

Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 docs/devel/rust.rst | 15 +--------------
 1 file changed, 1 insertion(+), 14 deletions(-)

diff --git a/docs/devel/rust.rst b/docs/devel/rust.rst
index 557cee72f3..4de8637502 100644
--- a/docs/devel/rust.rst
+++ b/docs/devel/rust.rst
@@ -71,16 +71,9 @@ Building Rust code with ``--enable-modules`` is not supported yet.
 Supported tools
 '''''''''''''''
 
-QEMU supports rustc version 1.63.0 and newer.  Notably, the following features
+QEMU supports rustc version 1.77.0 and newer.  Notably, the following features
 are missing:
 
-* Generic Associated Types (1.65.0)
-
-* ``CStr::from_bytes_with_nul()`` as a ``const`` function (1.72.0).
-
-* "Return position ``impl Trait`` in Traits" (1.75.0, blocker for including
-  the pinned-init create).
-
 * inline const expression (stable in 1.79.0), currently worked around with
   associated constants in the ``FnCall`` trait.
 
@@ -105,12 +98,6 @@ are missing:
 
 __ https://github.com/rust-lang/rust/pull/125258
 
-It is expected that QEMU will advance its minimum supported version of
-rustc to 1.77.0 as soon as possible; as of January 2025, blockers
-for that right now are Debian bookworm and 32-bit MIPS processors.
-This unfortunately means that references to statics in constants will
-remain an issue.
-
 QEMU also supports version 0.60.x of bindgen, which is missing option
 ``--generate-cstr``.  This option requires version 0.66.x and will
 be adopted as soon as supporting these older versions is not necessary

From 7abf0d95ac6437b38437ad75711c081363995285 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 2 May 2025 21:58:09 +0200
Subject: [PATCH 0699/2760] target/i386/emulate: fix target_ulong format
 strings

Do not assume that TARGET_FMT_lx is %llx.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/emulate/x86_decode.c | 2 +-
 target/i386/emulate/x86_emu.c    | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/i386/emulate/x86_decode.c b/target/i386/emulate/x86_decode.c
index 7efa2f570e..88be9479a8 100644
--- a/target/i386/emulate/x86_decode.c
+++ b/target/i386/emulate/x86_decode.c
@@ -26,7 +26,7 @@
 
 static void decode_invalid(CPUX86State *env, struct x86_decode *decode)
 {
-    printf("%llx: failed to decode instruction ", env->eip);
+    printf(TARGET_FMT_lx ": failed to decode instruction ", env->eip);
     for (int i = 0; i < decode->opcode_len; i++) {
         printf("%x ", decode->opcode[i]);
     }
diff --git a/target/i386/emulate/x86_emu.c b/target/i386/emulate/x86_emu.c
index 26a4876aac..7773b51b95 100644
--- a/target/i386/emulate/x86_emu.c
+++ b/target/i386/emulate/x86_emu.c
@@ -1241,7 +1241,7 @@ static void init_cmd_handler(void)
 bool exec_instruction(CPUX86State *env, struct x86_decode *ins)
 {
     if (!_cmd_handler[ins->cmd].handler) {
-        printf("Unimplemented handler (%llx) for %d (%x %x) \n", env->eip,
+        printf("Unimplemented handler (" TARGET_FMT_lx ") for %d (%x %x) \n", env->eip,
                 ins->cmd, ins->opcode[0],
                 ins->opcode_len > 1 ? ins->opcode[1] : 0);
         env->eip += ins->len;

From c6b04613bdc9a911c0fbe7c114a421991721f878 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Mon, 5 May 2025 12:19:55 +0200
Subject: [PATCH 0700/2760] rust: clippy: enable uninlined_format_args lint

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/Cargo.toml                 |  1 +
 rust/clippy.toml                |  1 +
 rust/qemu-api-macros/src/lib.rs | 16 ++++++++--------
 rust/qemu-api/build.rs          |  4 ++--
 4 files changed, 12 insertions(+), 10 deletions(-)

diff --git a/rust/Cargo.toml b/rust/Cargo.toml
index 4f6fe17b50..d9faeecb10 100644
--- a/rust/Cargo.toml
+++ b/rust/Cargo.toml
@@ -89,6 +89,7 @@ suspicious_operation_groupings = "deny"
 transmute_ptr_to_ptr = "deny"
 transmute_undefined_repr = "deny"
 type_repetition_in_bounds = "deny"
+uninlined_format_args = "deny"
 used_underscore_binding = "deny"
 
 # nice to have, but cannot be enabled yet
diff --git a/rust/clippy.toml b/rust/clippy.toml
index 933e46a2ff..58a62c0e63 100644
--- a/rust/clippy.toml
+++ b/rust/clippy.toml
@@ -1,2 +1,3 @@
 doc-valid-idents = ["PrimeCell", ".."]
+allow-mixed-uninlined-format-args = false
 msrv = "1.77.0"
diff --git a/rust/qemu-api-macros/src/lib.rs b/rust/qemu-api-macros/src/lib.rs
index dc14cac4ff..f97449bb30 100644
--- a/rust/qemu-api-macros/src/lib.rs
+++ b/rust/qemu-api-macros/src/lib.rs
@@ -18,13 +18,13 @@ fn get_fields<'a>(
 ) -> Result<&'a Punctuated<Field, Comma>, MacroError> {
     let Data::Struct(ref s) = &input.data else {
         return Err(MacroError::Message(
-            format!("Struct required for {}", msg),
+            format!("Struct required for {msg}"),
             input.ident.span(),
         ));
     };
     let Fields::Named(ref fs) = &s.fields else {
         return Err(MacroError::Message(
-            format!("Named fields required for {}", msg),
+            format!("Named fields required for {msg}"),
             input.ident.span(),
         ));
     };
@@ -34,19 +34,19 @@ fn get_fields<'a>(
 fn get_unnamed_field<'a>(input: &'a DeriveInput, msg: &str) -> Result<&'a Field, MacroError> {
     let Data::Struct(ref s) = &input.data else {
         return Err(MacroError::Message(
-            format!("Struct required for {}", msg),
+            format!("Struct required for {msg}"),
             input.ident.span(),
         ));
     };
     let Fields::Unnamed(FieldsUnnamed { ref unnamed, .. }) = &s.fields else {
         return Err(MacroError::Message(
-            format!("Tuple struct required for {}", msg),
+            format!("Tuple struct required for {msg}"),
             s.fields.span(),
         ));
     };
     if unnamed.len() != 1 {
         return Err(MacroError::Message(
-            format!("A single field is required for {}", msg),
+            format!("A single field is required for {msg}"),
             s.fields.span(),
         ));
     }
@@ -60,7 +60,7 @@ fn is_c_repr(input: &DeriveInput, msg: &str) -> Result<(), MacroError> {
         Ok(())
     } else {
         Err(MacroError::Message(
-            format!("#[repr(C)] required for {}", msg),
+            format!("#[repr(C)] required for {msg}"),
             input.ident.span(),
         ))
     }
@@ -73,7 +73,7 @@ fn is_transparent_repr(input: &DeriveInput, msg: &str) -> Result<(), MacroError>
         Ok(())
     } else {
         Err(MacroError::Message(
-            format!("#[repr(transparent)] required for {}", msg),
+            format!("#[repr(transparent)] required for {msg}"),
             input.ident.span(),
         ))
     }
@@ -168,7 +168,7 @@ fn get_repr_uN(input: &DeriveInput, msg: &str) -> Result<Path, MacroError> {
     }
 
     Err(MacroError::Message(
-        format!("#[repr(u8/u16/u32/u64) required for {}", msg),
+        format!("#[repr(u8/u16/u32/u64) required for {msg}"),
         input.ident.span(),
     ))
 }
diff --git a/rust/qemu-api/build.rs b/rust/qemu-api/build.rs
index 470be2a4d5..1e720641d2 100644
--- a/rust/qemu-api/build.rs
+++ b/rust/qemu-api/build.rs
@@ -14,7 +14,7 @@ fn main() -> Result<()> {
     let path = env::var("MESON_BUILD_ROOT")
         .unwrap_or_else(|_| format!("{}/src", env!("CARGO_MANIFEST_DIR")));
 
-    let file = format!("{}/bindings.inc.rs", path);
+    let file = format!("{path}/bindings.inc.rs");
     let file = Path::new(&file);
     if !Path::new(&file).exists() {
         panic!(concat!(
@@ -29,7 +29,7 @@ fn main() -> Result<()> {
     }
 
     let out_dir = env::var("OUT_DIR").unwrap();
-    let dest_path = format!("{}/bindings.inc.rs", out_dir);
+    let dest_path = format!("{out_dir}/bindings.inc.rs");
     let dest_path = Path::new(&dest_path);
     if dest_path.symlink_metadata().is_ok() {
         remove_file(dest_path)?;

From eb8f7292e1315be0e36000a847b77153dcf460ef Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Mon, 5 May 2025 16:23:26 +0200
Subject: [PATCH 0701/2760] ci: run RISC-V cross jobs by default

The riscv64-debian-cross container is based on Trixie rather than sid
these days, so it is pretty much as stable as the others.  Enable it
by default.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 .gitlab-ci.d/container-cross.yml | 3 ---
 .gitlab-ci.d/crossbuilds.yml     | 5 -----
 2 files changed, 8 deletions(-)

diff --git a/.gitlab-ci.d/container-cross.yml b/.gitlab-ci.d/container-cross.yml
index 34c0e729ad..e45ea17cf1 100644
--- a/.gitlab-ci.d/container-cross.yml
+++ b/.gitlab-ci.d/container-cross.yml
@@ -67,11 +67,8 @@ ppc64el-debian-cross-container:
 riscv64-debian-cross-container:
   extends: .container_job_template
   stage: containers
-  # as we are currently based on 'sid/unstable' we may break so...
-  allow_failure: true
   variables:
     NAME: debian-riscv64-cross
-    QEMU_JOB_OPTIONAL: 1
 
 s390x-debian-cross-container:
   extends: .container_job_template
diff --git a/.gitlab-ci.d/crossbuilds.yml b/.gitlab-ci.d/crossbuilds.yml
index 7ae0f966f1..3f76c901ba 100644
--- a/.gitlab-ci.d/crossbuilds.yml
+++ b/.gitlab-ci.d/crossbuilds.yml
@@ -118,12 +118,8 @@ cross-ppc64el-kvm-only:
     IMAGE: debian-ppc64el-cross
     EXTRA_CONFIGURE_OPTS: --disable-tcg --without-default-devices
 
-# The riscv64 cross-builds currently use a 'sid' container to get
-# compilers and libraries. Until something more stable is found we
-# allow_failure so as not to block CI.
 cross-riscv64-system:
   extends: .cross_system_build_job
-  allow_failure: true
   needs:
     job: riscv64-debian-cross-container
   variables:
@@ -131,7 +127,6 @@ cross-riscv64-system:
 
 cross-riscv64-user:
   extends: .cross_user_build_job
-  allow_failure: true
   needs:
     job: riscv64-debian-cross-container
   variables:

From 821ee1c31427a4e08af030469311c2d8ed96f1d1 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Tue, 6 May 2025 15:49:27 +0200
Subject: [PATCH 0702/2760] docs: build-system: fix typo

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 docs/devel/build-system.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/devel/build-system.rst b/docs/devel/build-system.rst
index 258cfad3fe..2c884197a2 100644
--- a/docs/devel/build-system.rst
+++ b/docs/devel/build-system.rst
@@ -168,7 +168,7 @@ The required versions of the packages are stored in a configuration file
 ``pythondeps.toml``.  The format is custom to QEMU, but it is documented
 at the top of the file itself and it should be easy to understand.  The
 requirements should make it possible to use the version that is packaged
-that is provided by supported distros.
+by QEMU's supported distros.
 
 When dependencies are downloaded, instead, ``configure`` uses a "known
 good" version that is also listed in ``pythondeps.toml``.  In this

From 44d3ec593b0afd2f8cfaf2ba2149465ee3541695 Mon Sep 17 00:00:00 2001
From: Kohei Tokunaga <ktokunaga.mail@gmail.com>
Date: Mon, 28 Apr 2025 15:38:53 +0900
Subject: [PATCH 0703/2760] target/arm/helper.c: Fix type conflict of GLib
 function pointers

On Emscripten, function pointer casts can result in runtime failures due to
strict function signature checks. This affects the use of g_list_sort and
g_slist_sort, which internally perform function pointer casts that are not
supported by Emscripten. To avoid these issues, g_list_sort_with_data and
g_slist_sort_with_data should be used instead, as they do not rely on
function pointer casting.

Signed-off-by: Kohei Tokunaga <ktokunaga.mail@gmail.com>
Link: https://lore.kernel.org/r/7d56c82382e8b4f1694b6d7883b2ce3084fdc72d.1745820062.git.ktokunaga.mail@gmail.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/arm/helper.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index 7fb6e88630..c7ff9f657c 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -222,7 +222,7 @@ static void count_cpreg(gpointer key, gpointer opaque)
     }
 }
 
-static gint cpreg_key_compare(gconstpointer a, gconstpointer b)
+static gint cpreg_key_compare(gconstpointer a, gconstpointer b, gpointer d)
 {
     uint64_t aidx = cpreg_to_kvm_id((uintptr_t)a);
     uint64_t bidx = cpreg_to_kvm_id((uintptr_t)b);
@@ -246,7 +246,7 @@ void init_cpreg_list(ARMCPU *cpu)
     int arraylen;
 
     keys = g_hash_table_get_keys(cpu->cp_regs);
-    keys = g_list_sort(keys, cpreg_key_compare);
+    keys = g_list_sort_with_data(keys, cpreg_key_compare, NULL);
 
     cpu->cpreg_array_len = 0;
 

From 84cb7025fa9378993dbd6242ab2c3fa556ed2a2c Mon Sep 17 00:00:00 2001
From: Kohei Tokunaga <ktokunaga.mail@gmail.com>
Date: Mon, 28 Apr 2025 15:38:54 +0900
Subject: [PATCH 0704/2760] target/i386/cpu.c: Fix type conflict of GLib
 function pointers

On Emscripten, function pointer casts can result in runtime failures due to
strict function signature checks. This affects the use of g_list_sort and
g_slist_sort, which internally perform function pointer casts that are not
supported by Emscripten. To avoid these issues, g_list_sort_with_data and
g_slist_sort_with_data should be used instead, as they do not rely on
function pointer casting.

Signed-off-by: Kohei Tokunaga <ktokunaga.mail@gmail.com>
Link: https://lore.kernel.org/r/8ee6c2b02c97d5db358c3eb290d00afe71d1ceb7.1745820062.git.ktokunaga.mail@gmail.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 6f21d5ed22..1ca6307c72 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -6240,7 +6240,7 @@ static void listflags(GList *features)
 }
 
 /* Sort alphabetically by type name, respecting X86CPUClass::ordering. */
-static gint x86_cpu_list_compare(gconstpointer a, gconstpointer b)
+static gint x86_cpu_list_compare(gconstpointer a, gconstpointer b, gpointer d)
 {
     ObjectClass *class_a = (ObjectClass *)a;
     ObjectClass *class_b = (ObjectClass *)b;
@@ -6261,7 +6261,7 @@ static gint x86_cpu_list_compare(gconstpointer a, gconstpointer b)
 static GSList *get_sorted_cpu_model_list(void)
 {
     GSList *list = object_class_get_list(TYPE_X86_CPU, false);
-    list = g_slist_sort(list, x86_cpu_list_compare);
+    list = g_slist_sort_with_data(list, x86_cpu_list_compare, NULL);
     return list;
 }
 
@@ -6318,6 +6318,11 @@ static void x86_cpu_list_entry(gpointer data, gpointer user_data)
     qemu_printf("  %-20s  %s\n", name, desc);
 }
 
+static gint strcmp_wrap(gconstpointer a, gconstpointer b, gpointer d)
+{
+    return strcmp(a, b);
+}
+
 /* list available CPU models and flags */
 static void x86_cpu_list(void)
 {
@@ -6340,7 +6345,7 @@ static void x86_cpu_list(void)
         }
     }
 
-    names = g_list_sort(names, (GCompareFunc)strcmp);
+    names = g_list_sort_with_data(names, strcmp_wrap, NULL);
 
     qemu_printf("\nRecognized CPUID flags:\n");
     listflags(names);

From bea4eb18c501e8b55debb1bdc6ccfee2791e1643 Mon Sep 17 00:00:00 2001
From: Kohei Tokunaga <ktokunaga.mail@gmail.com>
Date: Mon, 28 Apr 2025 15:38:57 +0900
Subject: [PATCH 0705/2760] target/ppc: Fix type conflict of GLib function
 pointers

On Emscripten, function pointer casts can result in runtime failures due to
strict function signature checks. This affects the use of g_list_sort and
g_slist_sort, which internally perform function pointer casts that are not
supported by Emscripten. To avoid these issues, g_list_sort_with_data and
g_slist_sort_with_data should be used instead, as they do not rely on
function pointer casting.

Signed-off-by: Kohei Tokunaga <ktokunaga.mail@gmail.com>
Link: https://lore.kernel.org/r/d917055d35f5ff7316ccdcbdf57af9a7bd85bf29.1745820062.git.ktokunaga.mail@gmail.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/ppc/cpu_init.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
index b0973b6df9..09a8d4ff72 100644
--- a/target/ppc/cpu_init.c
+++ b/target/ppc/cpu_init.c
@@ -7115,7 +7115,7 @@ PowerPCCPUClass *ppc_cpu_get_family_class(PowerPCCPUClass *pcc)
 }
 
 /* Sort by PVR, ordering special case "host" last. */
-static gint ppc_cpu_list_compare(gconstpointer a, gconstpointer b)
+static gint ppc_cpu_list_compare(gconstpointer a, gconstpointer b, gpointer d)
 {
     ObjectClass *oc_a = (ObjectClass *)a;
     ObjectClass *oc_b = (ObjectClass *)b;
@@ -7183,7 +7183,7 @@ static void ppc_cpu_list(void)
 
     qemu_printf("Available CPUs:\n");
     list = object_class_get_list(TYPE_POWERPC_CPU, false);
-    list = g_slist_sort(list, ppc_cpu_list_compare);
+    list = g_slist_sort_with_data(list, ppc_cpu_list_compare, NULL);
     g_slist_foreach(list, ppc_cpu_list_entry, NULL);
     g_slist_free(list);
 

From c4eb098bc1cf3dbcc3627352031c086a6969a7cf Mon Sep 17 00:00:00 2001
From: Kohei Tokunaga <ktokunaga.mail@gmail.com>
Date: Mon, 28 Apr 2025 15:38:58 +0900
Subject: [PATCH 0706/2760] target/s390x: Fix type conflict of GLib function
 pointers

On Emscripten, function pointer casts can result in runtime failures due to
strict function signature checks. This affects the use of g_list_sort and
g_slist_sort, which internally perform function pointer casts that are not
supported by Emscripten. To avoid these issues, g_list_sort_with_data and
g_slist_sort_with_data should be used instead, as they do not rely on
function pointer casting.

Signed-off-by: Kohei Tokunaga <ktokunaga.mail@gmail.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Link: https://lore.kernel.org/r/e91c4e266b839f62b5c41173a05896b210ae1180.1745820062.git.ktokunaga.mail@gmail.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/s390x/cpu_models.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/s390x/cpu_models.c b/target/s390x/cpu_models.c
index 8951f1b36f..954a7a99a9 100644
--- a/target/s390x/cpu_models.c
+++ b/target/s390x/cpu_models.c
@@ -373,7 +373,7 @@ static void s390_print_cpu_model_list_entry(gpointer data, gpointer user_data)
     g_free(name);
 }
 
-static gint s390_cpu_list_compare(gconstpointer a, gconstpointer b)
+static gint s390_cpu_list_compare(gconstpointer a, gconstpointer b, gpointer d)
 {
     const S390CPUClass *cc_a = S390_CPU_CLASS((ObjectClass *)a);
     const S390CPUClass *cc_b = S390_CPU_CLASS((ObjectClass *)b);
@@ -415,7 +415,7 @@ void s390_cpu_list(void)
 
     qemu_printf("Available CPUs:\n");
     list = object_class_get_list(TYPE_S390_CPU, false);
-    list = g_slist_sort(list, s390_cpu_list_compare);
+    list = g_slist_sort_with_data(list, s390_cpu_list_compare, NULL);
     g_slist_foreach(list, s390_print_cpu_model_list_entry, NULL);
     g_slist_free(list);
 

From 4cd5a25557cab10f8ef81407bed0dd6512526c1c Mon Sep 17 00:00:00 2001
From: Kohei Tokunaga <ktokunaga.mail@gmail.com>
Date: Mon, 28 Apr 2025 15:38:59 +0900
Subject: [PATCH 0707/2760] include/glib-compat.h: Poison g_list_sort and
 g_slist_sort

On Emscripten, function pointer casts can result in runtime failures due to
strict function signature checks. This affects the use of g_list_sort and
g_slist_sort, which internally perform function pointer casts that are not
supported by Emscripten. To avoid these issues, g_list_sort_with_data and
g_slist_sort_with_data should be used instead, as they do not rely on
function pointer casting.

Signed-off-by: Kohei Tokunaga <ktokunaga.mail@gmail.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Link: https://lore.kernel.org/r/fa57c8069d6c723f5b947560677f4ca596334330.1745820062.git.ktokunaga.mail@gmail.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 include/glib-compat.h | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/include/glib-compat.h b/include/glib-compat.h
index 86be439ba0..2e32b90f05 100644
--- a/include/glib-compat.h
+++ b/include/glib-compat.h
@@ -36,6 +36,13 @@
 #include <pwd.h>
 #endif
 
+/*
+ * These functions perform function pointer casts which can cause function call
+ * failure on Emscripten. Use g_slist_sort_with_data and g_list_sort_with_data
+ * instead of these functions.
+ */
+#pragma GCC poison g_slist_sort g_list_sort
+
 /*
  * Note that because of the GLIB_VERSION_MAX_ALLOWED constant above, allowing
  * use of functions from newer GLib via this compat header needs a little

From 4c7c05171902d2da678f85c035efdf412ce91c4f Mon Sep 17 00:00:00 2001
From: Kohei Tokunaga <ktokunaga.mail@gmail.com>
Date: Mon, 28 Apr 2025 15:39:00 +0900
Subject: [PATCH 0708/2760] util/cacheflush.c: Update cache flushing mechanism
 for Emscripten
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Although __builtin___clear_cache is used to flush the instruction cache for
a specified memory region, this operation doesn't apply to wasm, as its
memory isn't executable. Moreover, Emscripten does not support this builtin
and fails to compile it with the following error.

> fatal error: error in backend: llvm.clear_cache is not supported on wasm

To resolve this, this commit removes the call to __builtin___clear_cache for
Emscripten build.

Signed-off-by: Kohei Tokunaga <ktokunaga.mail@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/r/2926a798fa52a3a5b11c3df4edd1643d2b7cdcb9.1745820062.git.ktokunaga.mail@gmail.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 include/qemu/cacheflush.h | 7 +++++++
 util/cacheflush.c         | 4 ++++
 2 files changed, 11 insertions(+)

diff --git a/include/qemu/cacheflush.h b/include/qemu/cacheflush.h
index ae20bcda73..76eb55d818 100644
--- a/include/qemu/cacheflush.h
+++ b/include/qemu/cacheflush.h
@@ -26,6 +26,13 @@ static inline void flush_idcache_range(uintptr_t rx, uintptr_t rw, size_t len)
     /* icache is coherent and does not require flushing. */
 }
 
+#elif defined(EMSCRIPTEN)
+
+static inline void flush_idcache_range(uintptr_t rx, uintptr_t rw, size_t len)
+{
+    /* Wasm doesn't have executable region of memory. */
+}
+
 #else
 
 void flush_idcache_range(uintptr_t rx, uintptr_t rw, size_t len);
diff --git a/util/cacheflush.c b/util/cacheflush.c
index 1d12899a39..17c58918de 100644
--- a/util/cacheflush.c
+++ b/util/cacheflush.c
@@ -229,6 +229,10 @@ static void __attribute__((constructor)) init_cache_info(void)
 
 /* Caches are coherent and do not require flushing; symbol inline. */
 
+#elif defined(EMSCRIPTEN)
+
+/* Wasm doesn't have executable region of memory. */
+
 #elif defined(__aarch64__) && !defined(CONFIG_WIN32)
 /*
  * For Windows, we use generic implementation of flush_idcache_range, that

From 45e82e495d6a9bf59ee80ed2d4c362596f1b559e Mon Sep 17 00:00:00 2001
From: Kohei Tokunaga <ktokunaga.mail@gmail.com>
Date: Mon, 28 Apr 2025 15:39:01 +0900
Subject: [PATCH 0709/2760] block: Add including of ioctl header for Emscripten
 build
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Including <sys/ioctl.h> is still required on Emscripten, just like on other
platforms, to make the ioctl function available.

Signed-off-by: Kohei Tokunaga <ktokunaga.mail@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Link: https://lore.kernel.org/r/49b6ecdbd23ff83e3f191ef8a9f7cc2feeaea43f.1745820062.git.ktokunaga.mail@gmail.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 block/file-posix.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/block/file-posix.c b/block/file-posix.c
index 0d85123d0f..a845e2836f 100644
--- a/block/file-posix.c
+++ b/block/file-posix.c
@@ -110,6 +110,10 @@
 #include <sys/diskslice.h>
 #endif
 
+#ifdef EMSCRIPTEN
+#include <sys/ioctl.h>
+#endif
+
 /* OS X does not have O_DSYNC */
 #ifndef O_DSYNC
 #ifdef O_SYNC

From 208808242f8a34ac93e73c1c1dbafe4c00498f5e Mon Sep 17 00:00:00 2001
From: Kohei Tokunaga <ktokunaga.mail@gmail.com>
Date: Mon, 28 Apr 2025 15:39:02 +0900
Subject: [PATCH 0710/2760] block: Fix type conflict of the copy_file_range
 stub
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Emscripten doesn't provide copy_file_range implementation but it declares
this function in its headers. Meson correctly detects the missing
implementation and unsets HAVE_COPY_FILE_RANGE. However, the stub defined in
file-posix.c causes a type conflict with the declaration from Emscripten
during compilation.

To fix this error, this commit updates the stub implementation in
file-posix.c to exactly match the declaration in Emscripten's headers. The
manpage also aligns with this signature.

Signed-off-by: Kohei Tokunaga <ktokunaga.mail@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Link: https://lore.kernel.org/r/938d2beba15d4bd496a600ee401995fbaa385c62.1745820062.git.ktokunaga.mail@gmail.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 block/file-posix.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/block/file-posix.c b/block/file-posix.c
index a845e2836f..ef52ed9169 100644
--- a/block/file-posix.c
+++ b/block/file-posix.c
@@ -2080,8 +2080,11 @@ static int handle_aiocb_write_zeroes_unmap(void *opaque)
 }
 
 #ifndef HAVE_COPY_FILE_RANGE
-static off_t copy_file_range(int in_fd, off_t *in_off, int out_fd,
-                             off_t *out_off, size_t len, unsigned int flags)
+#ifndef EMSCRIPTEN
+static
+#endif
+ssize_t copy_file_range(int in_fd, off_t *in_off, int out_fd,
+                        off_t *out_off, size_t len, unsigned int flags)
 {
 #ifdef __NR_copy_file_range
     return syscall(__NR_copy_file_range, in_fd, in_off, out_fd,

From 0f46bf659f015d4860c7212b4a6f0656b312d4f4 Mon Sep 17 00:00:00 2001
From: Kohei Tokunaga <ktokunaga.mail@gmail.com>
Date: Mon, 28 Apr 2025 15:39:03 +0900
Subject: [PATCH 0711/2760] include/qemu/osdep.h: Add Emscripten-specific OS
 dependencies

On emscripten, some implementations in os-posix.c can't be used such as
daemonizing and changing user. This commit introduces os-wasm.c and
os-wasm.h which are forked from os-posix.c and os-posix.h and patched for
targetting Emscripten.

Signed-off-by: Kohei Tokunaga <ktokunaga.mail@gmail.com>
Link: https://lore.kernel.org/r/9fc7b106ecf86675b4532bd6778b7b5945442f89.1745820062.git.ktokunaga.mail@gmail.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 MAINTAINERS              |   6 ++
 include/qemu/osdep.h     |   8 ++-
 include/system/os-wasm.h | 104 ++++++++++++++++++++++++++++++++++
 os-wasm.c                | 119 +++++++++++++++++++++++++++++++++++++++
 4 files changed, 235 insertions(+), 2 deletions(-)
 create mode 100644 include/system/os-wasm.h
 create mode 100644 os-wasm.c

diff --git a/MAINTAINERS b/MAINTAINERS
index e748b6375e..2e23dad4bc 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -628,6 +628,12 @@ F: .gitlab-ci.d/cirrus/macos-*
 F: */*.m
 F: scripts/entitlement.sh
 
+WebAssembly
+M: Kohei Tokunaga <ktokunaga.mail@gmail.com>
+S: Maintained
+F: include/system/os-wasm.h
+F: os-wasm.c
+
 Alpha Machines
 --------------
 M: Richard Henderson <richard.henderson@linaro.org>
diff --git a/include/qemu/osdep.h b/include/qemu/osdep.h
index 4397a90680..96fe51bc39 100644
--- a/include/qemu/osdep.h
+++ b/include/qemu/osdep.h
@@ -8,7 +8,7 @@
  * To avoid getting into possible circular include dependencies, this
  * file should not include any other QEMU headers, with the exceptions
  * of config-host.h, config-target.h, qemu/compiler.h,
- * system/os-posix.h, system/os-win32.h, glib-compat.h and
+ * system/os-posix.h, system/os-win32.h, system/os-wasm.h, glib-compat.h and
  * qemu/typedefs.h, all of which are doing a similar job to this file
  * and are under similar constraints.
  *
@@ -164,10 +164,14 @@ QEMU_EXTERN_C int daemon(int, int);
 #include "system/os-win32.h"
 #endif
 
-#ifdef CONFIG_POSIX
+#if defined(CONFIG_POSIX) && !defined(EMSCRIPTEN)
 #include "system/os-posix.h"
 #endif
 
+#if defined(EMSCRIPTEN)
+#include "system/os-wasm.h"
+#endif
+
 #ifdef __cplusplus
 extern "C" {
 #endif
diff --git a/include/system/os-wasm.h b/include/system/os-wasm.h
new file mode 100644
index 0000000000..3abb3aaa03
--- /dev/null
+++ b/include/system/os-wasm.h
@@ -0,0 +1,104 @@
+/* SPDX-License-Identifier: MIT */
+/*
+ * posix specific declarations forked from os-posix.h, removing functions not
+ * working on Emscripten
+ *
+ * Copyright (c) 2003-2008 Fabrice Bellard
+ * Copyright (c) 2010 Jes Sorensen <Jes.Sorensen@redhat.com>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#ifndef QEMU_OS_WASM_H
+#define QEMU_OS_WASM_H
+
+#include <sys/mman.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <netinet/tcp.h>
+#include <arpa/inet.h>
+#include <netdb.h>
+#include <sys/un.h>
+
+#ifdef CONFIG_SYSMACROS
+#include <sys/sysmacros.h>
+#endif
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+void os_set_line_buffering(void);
+void os_setup_early_signal_handling(void);
+void os_set_proc_name(const char *s);
+void os_setup_signal_handling(void);
+void os_setup_limits(void);
+void os_setup_post(void);
+int os_mlock(bool on_fault);
+static inline int os_set_daemonize(bool d)
+{
+    return -1;
+};
+bool is_daemonized(void);
+static inline void os_daemonize(void) {}
+
+/**
+ * qemu_alloc_stack:
+ * @sz: pointer to a size_t holding the requested usable stack size
+ *
+ * Allocate memory that can be used as a stack, for instance for
+ * coroutines. If the memory cannot be allocated, this function
+ * will abort (like g_malloc()). This function also inserts an
+ * additional guard page to catch a potential stack overflow.
+ * Note that the memory required for the guard page and alignment
+ * and minimal stack size restrictions will increase the value of sz.
+ *
+ * The allocated stack must be freed with qemu_free_stack().
+ *
+ * Returns: pointer to (the lowest address of) the stack memory.
+ */
+void *qemu_alloc_stack(size_t *sz);
+
+/**
+ * qemu_free_stack:
+ * @stack: stack to free
+ * @sz: size of stack in bytes
+ *
+ * Free a stack allocated via qemu_alloc_stack(). Note that sz must
+ * be exactly the adjusted stack size returned by qemu_alloc_stack.
+ */
+void qemu_free_stack(void *stack, size_t sz);
+
+/* POSIX and Mingw32 differ in the name of the stdio lock functions.  */
+
+static inline void qemu_flockfile(FILE *f)
+{
+    flockfile(f);
+}
+
+static inline void qemu_funlockfile(FILE *f)
+{
+    funlockfile(f);
+}
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/os-wasm.c b/os-wasm.c
new file mode 100644
index 0000000000..d240c180c5
--- /dev/null
+++ b/os-wasm.c
@@ -0,0 +1,119 @@
+/* SPDX-License-Identifier: MIT */
+/*
+ * os-wasm.c
+ * Forked from os-posix.c, removing functions not working on Emscripten
+ *
+ * Copyright (c) 2003-2008 Fabrice Bellard
+ * Copyright (c) 2010 Red Hat, Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#include "qemu/osdep.h"
+#include <sys/resource.h>
+#include <sys/wait.h>
+#include <pwd.h>
+#include <grp.h>
+#include <libgen.h>
+
+#include "qemu/error-report.h"
+#include "qemu/log.h"
+#include "system/runstate.h"
+#include "qemu/cutils.h"
+
+void os_setup_post(void){}
+void os_set_line_buffering(void)
+{
+    setvbuf(stdout, NULL, _IOLBF, 0);
+}
+void os_setup_early_signal_handling(void)
+{
+    struct sigaction act;
+    sigfillset(&act.sa_mask);
+    act.sa_flags = 0;
+    act.sa_handler = SIG_IGN;
+    sigaction(SIGPIPE, &act, NULL);
+}
+void os_set_proc_name(const char *s)
+{
+    error_report("Change of process name not supported by your OS");
+    exit(1);
+}
+static void termsig_handler(int signal, siginfo_t *info, void *c)
+{
+    qemu_system_killed(info->si_signo, info->si_pid);
+}
+
+void os_setup_signal_handling(void)
+{
+    struct sigaction act;
+
+    memset(&act, 0, sizeof(act));
+    act.sa_sigaction = termsig_handler;
+    act.sa_flags = SA_SIGINFO;
+    sigaction(SIGINT,  &act, NULL);
+    sigaction(SIGHUP,  &act, NULL);
+    sigaction(SIGTERM, &act, NULL);
+}
+void os_setup_limits(void)
+{
+    struct rlimit nofile;
+
+    if (getrlimit(RLIMIT_NOFILE, &nofile) < 0) {
+        warn_report("unable to query NOFILE limit: %s", strerror(errno));
+        return;
+    }
+
+    if (nofile.rlim_cur == nofile.rlim_max) {
+        return;
+    }
+
+    nofile.rlim_cur = nofile.rlim_max;
+
+    if (setrlimit(RLIMIT_NOFILE, &nofile) < 0) {
+        warn_report("unable to set NOFILE limit: %s", strerror(errno));
+        return;
+    }
+}
+int os_mlock(bool on_fault)
+{
+#ifdef HAVE_MLOCKALL
+    int ret = 0;
+    int flags = MCL_CURRENT | MCL_FUTURE;
+
+    if (on_fault) {
+#ifdef HAVE_MLOCK_ONFAULT
+        flags |= MCL_ONFAULT;
+#else
+        error_report("mlockall: on_fault not supported");
+        return -EINVAL;
+#endif
+    }
+
+    ret = mlockall(flags);
+    if (ret < 0) {
+        error_report("mlockall: %s", strerror(errno));
+    }
+
+    return ret;
+#else
+    (void)on_fault;
+    return -ENOSYS;
+#endif
+}

From 1a8964424036cdfe1bd11180953d4e95123990f5 Mon Sep 17 00:00:00 2001
From: Kohei Tokunaga <ktokunaga.mail@gmail.com>
Date: Mon, 28 Apr 2025 15:39:04 +0900
Subject: [PATCH 0712/2760] Disable options unsupported on Emscripten
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Daemonizing and run-with aren't supported on Emscripten so disable these
flags.

Signed-off-by: Kohei Tokunaga <ktokunaga.mail@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/r/79c5e591b634762703f3eef6427a192d145799e4.1745820062.git.ktokunaga.mail@gmail.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 qemu-options.hx | 4 ++--
 system/vl.c     | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/qemu-options.hx b/qemu-options.hx
index dc694a99a3..aab53bcfe8 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -4862,7 +4862,7 @@ SRST
     Start right away with a saved state (``loadvm`` in monitor)
 ERST
 
-#ifndef _WIN32
+#if !defined(_WIN32) && !defined(EMSCRIPTEN)
 DEF("daemonize", 0, QEMU_OPTION_daemonize, \
     "-daemonize      daemonize QEMU after initializing\n", QEMU_ARCH_ALL)
 #endif
@@ -5249,7 +5249,7 @@ HXCOMM Internal use
 DEF("qtest", HAS_ARG, QEMU_OPTION_qtest, "", QEMU_ARCH_ALL)
 DEF("qtest-log", HAS_ARG, QEMU_OPTION_qtest_log, "", QEMU_ARCH_ALL)
 
-#ifdef CONFIG_POSIX
+#if defined(CONFIG_POSIX) && !defined(EMSCRIPTEN)
 DEF("run-with", HAS_ARG, QEMU_OPTION_run_with,
     "-run-with [async-teardown=on|off][,chroot=dir][user=username|uid:gid]\n"
     "                Set miscellaneous QEMU process lifecycle options:\n"
diff --git a/system/vl.c b/system/vl.c
index 520956f4a1..b69d5bb81e 100644
--- a/system/vl.c
+++ b/system/vl.c
@@ -767,7 +767,7 @@ static QemuOptsList qemu_smp_opts = {
     },
 };
 
-#if defined(CONFIG_POSIX)
+#if defined(CONFIG_POSIX) && !defined(EMSCRIPTEN)
 static QemuOptsList qemu_run_with_opts = {
     .name = "run-with",
     .head = QTAILQ_HEAD_INITIALIZER(qemu_run_with_opts.head),
@@ -3678,7 +3678,7 @@ void qemu_init(int argc, char **argv)
             case QEMU_OPTION_nouserconfig:
                 /* Nothing to be parsed here. Especially, do not error out below. */
                 break;
-#if defined(CONFIG_POSIX)
+#if defined(CONFIG_POSIX) && !defined(EMSCRIPTEN)
             case QEMU_OPTION_daemonize:
                 os_set_daemonize(true);
                 break;

From 8e72b0eb1842ac9813228ad9d9c29203f3823d99 Mon Sep 17 00:00:00 2001
From: Kohei Tokunaga <ktokunaga.mail@gmail.com>
Date: Mon, 28 Apr 2025 15:39:05 +0900
Subject: [PATCH 0713/2760] util: exclude mmap-alloc.c from compilation target
 on Emscripten

Emscripten does not support partial unmapping of mmapped memory
regions[1]. This limitation prevents correct implementation of qemu_ram_mmap
and qemu_ram_munmap, which rely on partial unmap behavior.

As a workaround, this commit excludes mmap-alloc.c from the Emscripten
build. Instead, for Emscripten build, this modifies qemu_anon_ram_alloc to
use qemu_memalign in place of qemu_ram_mmap, and disable memory backends
that rely on mmap, such as memory-backend-file and memory-backend-shm.

[1] https://github.com/emscripten-core/emscripten/blob/d4a74336f23214bf3304d9eb0d03966786b30a36/system/lib/libc/emscripten_mmap.c#L61

Signed-off-by: Kohei Tokunaga <ktokunaga.mail@gmail.com>
Link: https://lore.kernel.org/r/76834f933ee4f14eeb5289d21c59d306886e58e9.1745820062.git.ktokunaga.mail@gmail.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 backends/meson.build |  6 ++++--
 system/memory.c      |  2 +-
 system/physmem.c     |  9 +++++----
 util/meson.build     |  4 +++-
 util/oslib-posix.c   | 28 ++++++++++++++++++++++++++++
 5 files changed, 41 insertions(+), 8 deletions(-)

diff --git a/backends/meson.build b/backends/meson.build
index da714b93d1..9b88d22685 100644
--- a/backends/meson.build
+++ b/backends/meson.build
@@ -12,8 +12,10 @@ system_ss.add([files(
 
 if host_os != 'windows'
   system_ss.add(files('rng-random.c'))
-  system_ss.add(files('hostmem-file.c'))
-  system_ss.add([files('hostmem-shm.c'), rt])
+  if host_os != 'emscripten'
+    system_ss.add(files('hostmem-file.c'))
+    system_ss.add([files('hostmem-shm.c'), rt])
+  endif
 endif
 if host_os == 'linux'
   system_ss.add(files('hostmem-memfd.c'))
diff --git a/system/memory.c b/system/memory.c
index 71434e7ad0..63b983efcd 100644
--- a/system/memory.c
+++ b/system/memory.c
@@ -1627,7 +1627,7 @@ bool memory_region_init_resizeable_ram(MemoryRegion *mr,
     return true;
 }
 
-#ifdef CONFIG_POSIX
+#if defined(CONFIG_POSIX) && !defined(EMSCRIPTEN)
 bool memory_region_init_ram_from_file(MemoryRegion *mr,
                                       Object *owner,
                                       const char *name,
diff --git a/system/physmem.c b/system/physmem.c
index 16cf557d1a..4a7a2e5e12 100644
--- a/system/physmem.c
+++ b/system/physmem.c
@@ -1243,7 +1243,7 @@ long qemu_maxrampagesize(void)
     return pagesize;
 }
 
-#ifdef CONFIG_POSIX
+#if defined(CONFIG_POSIX) && !defined(EMSCRIPTEN)
 static int64_t get_file_size(int fd)
 {
     int64_t size;
@@ -1978,7 +1978,7 @@ out_free:
     }
 }
 
-#ifdef CONFIG_POSIX
+#if defined(CONFIG_POSIX) && !defined(EMSCRIPTEN)
 RAMBlock *qemu_ram_alloc_from_fd(ram_addr_t size, ram_addr_t max_size,
                                  qemu_ram_resize_cb resized, MemoryRegion *mr,
                                  uint32_t ram_flags, int fd, off_t offset,
@@ -2158,7 +2158,8 @@ RAMBlock *qemu_ram_alloc_internal(ram_addr_t size, ram_addr_t max_size,
     assert(!host ^ (ram_flags & RAM_PREALLOC));
     assert(max_size >= size);
 
-#ifdef CONFIG_POSIX         /* ignore RAM_SHARED for Windows */
+    /* ignore RAM_SHARED for Windows and emscripten*/
+#if defined(CONFIG_POSIX) && !defined(EMSCRIPTEN)
     if (!host) {
         if (!share_flags && current_machine->aux_ram_share) {
             ram_flags |= RAM_SHARED;
@@ -2255,7 +2256,7 @@ static void reclaim_ramblock(RAMBlock *block)
         ;
     } else if (xen_enabled()) {
         xen_invalidate_map_cache_entry(block->host);
-#ifndef _WIN32
+#if !defined(_WIN32) && !defined(EMSCRIPTEN)
     } else if (block->fd >= 0) {
         qemu_ram_munmap(block->fd, block->host, block->max_length);
         close(block->fd);
diff --git a/util/meson.build b/util/meson.build
index 780b5977a8..e5cd327e27 100644
--- a/util/meson.build
+++ b/util/meson.build
@@ -11,7 +11,9 @@ if host_os != 'windows'
   endif
   util_ss.add(files('compatfd.c'))
   util_ss.add(files('event_notifier-posix.c'))
-  util_ss.add(files('mmap-alloc.c'))
+  if host_os != 'emscripten'
+    util_ss.add(files('mmap-alloc.c'))
+  endif
   freebsd_dep = []
   if host_os == 'freebsd'
     freebsd_dep = util
diff --git a/util/oslib-posix.c b/util/oslib-posix.c
index a697c602c6..4ff577e5de 100644
--- a/util/oslib-posix.c
+++ b/util/oslib-posix.c
@@ -58,6 +58,7 @@
 #include <lwp.h>
 #endif
 
+#include "qemu/memalign.h"
 #include "qemu/mmap-alloc.h"
 
 #define MAX_MEM_PREALLOC_THREAD_COUNT 16
@@ -210,11 +211,21 @@ void *qemu_anon_ram_alloc(size_t size, uint64_t *alignment, bool shared,
     const uint32_t qemu_map_flags = (shared ? QEMU_MAP_SHARED : 0) |
                                     (noreserve ? QEMU_MAP_NORESERVE : 0);
     size_t align = QEMU_VMALLOC_ALIGN;
+#ifndef EMSCRIPTEN
     void *ptr = qemu_ram_mmap(-1, size, align, qemu_map_flags, 0);
 
     if (ptr == MAP_FAILED) {
         return NULL;
     }
+#else
+    /*
+     * qemu_ram_mmap is not implemented for Emscripten. Use qemu_memalign
+     * for the anonymous allocation. noreserve is ignored as there is no swap
+     * space on Emscripten, and shared is ignored as there is no other
+     * processes on Emscripten.
+     */
+    void *ptr = qemu_memalign(align, size);
+#endif
 
     if (alignment) {
         *alignment = align;
@@ -227,7 +238,16 @@ void *qemu_anon_ram_alloc(size_t size, uint64_t *alignment, bool shared,
 void qemu_anon_ram_free(void *ptr, size_t size)
 {
     trace_qemu_anon_ram_free(ptr, size);
+#ifndef EMSCRIPTEN
     qemu_ram_munmap(-1, ptr, size);
+#else
+    /*
+     * qemu_ram_munmap is not implemented for Emscripten and qemu_memalign
+     * was used for the allocation. Use the corresponding freeing function
+     * here.
+     */
+    qemu_vfree(ptr);
+#endif
 }
 
 void qemu_socket_set_block(int fd)
@@ -588,7 +608,15 @@ bool qemu_prealloc_mem(int fd, char *area, size_t sz, int max_threads,
 {
     static gsize initialized;
     int ret;
+#ifndef EMSCRIPTEN
     size_t hpagesize = qemu_fd_getpagesize(fd);
+#else
+    /*
+     * mmap-alloc.c is excluded from Emscripten build, so qemu_fd_getpagesize
+     * is unavailable. Fallback to the lower level implementation.
+     */
+    size_t hpagesize = qemu_real_host_page_size();
+#endif
     size_t numpages = DIV_ROUND_UP(sz, hpagesize);
     bool use_madv_populate_write;
     struct sigaction act;

From 5b78d120ffa2c343728600082777a49cbc825ee1 Mon Sep 17 00:00:00 2001
From: Kohei Tokunaga <ktokunaga.mail@gmail.com>
Date: Mon, 28 Apr 2025 15:39:06 +0900
Subject: [PATCH 0714/2760] util: Add coroutine backend for emscripten

Emscripten does not support couroutine methods currently used by QEMU but
provides a coroutine implementation called "fiber". This commit introduces a
coroutine backend using fiber. Note that fiber does not support submitting
coroutines to other threads.

Signed-off-by: Kohei Tokunaga <ktokunaga.mail@gmail.com>
Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
Link: https://lore.kernel.org/r/006b683fd578ed6303a2dc8679094da9a7e6dfb4.1745820062.git.ktokunaga.mail@gmail.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 MAINTAINERS           |   1 +
 util/coroutine-wasm.c | 127 ++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 128 insertions(+)
 create mode 100644 util/coroutine-wasm.c

diff --git a/MAINTAINERS b/MAINTAINERS
index 2e23dad4bc..55c47fcd37 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -633,6 +633,7 @@ M: Kohei Tokunaga <ktokunaga.mail@gmail.com>
 S: Maintained
 F: include/system/os-wasm.h
 F: os-wasm.c
+F: util/coroutine-wasm.c
 
 Alpha Machines
 --------------
diff --git a/util/coroutine-wasm.c b/util/coroutine-wasm.c
new file mode 100644
index 0000000000..cb1ec92509
--- /dev/null
+++ b/util/coroutine-wasm.c
@@ -0,0 +1,127 @@
+/*
+ * emscripten fiber coroutine initialization code
+ * based on coroutine-ucontext.c
+ *
+ * Copyright (C) 2006  Anthony Liguori <anthony@codemonkey.ws>
+ * Copyright (C) 2011  Kevin Wolf <kwolf@redhat.com>
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.0 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/coroutine_int.h"
+#include "qemu/coroutine-tls.h"
+
+#include <emscripten/fiber.h>
+
+typedef struct {
+    Coroutine base;
+    void *stack;
+    size_t stack_size;
+
+    void *asyncify_stack;
+    size_t asyncify_stack_size;
+
+    CoroutineAction action;
+
+    emscripten_fiber_t fiber;
+} CoroutineEmscripten;
+
+/**
+ * Per-thread coroutine bookkeeping
+ */
+QEMU_DEFINE_STATIC_CO_TLS(Coroutine *, current);
+QEMU_DEFINE_STATIC_CO_TLS(CoroutineEmscripten *, leader);
+size_t leader_asyncify_stack_size = COROUTINE_STACK_SIZE;
+
+static void coroutine_trampoline(void *co_)
+{
+    Coroutine *co = co_;
+
+    while (true) {
+        co->entry(co->entry_arg);
+        qemu_coroutine_switch(co, co->caller, COROUTINE_TERMINATE);
+    }
+}
+
+Coroutine *qemu_coroutine_new(void)
+{
+    CoroutineEmscripten *co;
+
+    co = g_malloc0(sizeof(*co));
+
+    co->stack_size = COROUTINE_STACK_SIZE;
+    co->stack = qemu_alloc_stack(&co->stack_size);
+
+    co->asyncify_stack_size = COROUTINE_STACK_SIZE;
+    co->asyncify_stack = g_malloc0(co->asyncify_stack_size);
+    emscripten_fiber_init(&co->fiber, coroutine_trampoline, &co->base,
+                          co->stack, co->stack_size, co->asyncify_stack,
+                          co->asyncify_stack_size);
+
+    return &co->base;
+}
+
+void qemu_coroutine_delete(Coroutine *co_)
+{
+    CoroutineEmscripten *co = DO_UPCAST(CoroutineEmscripten, base, co_);
+
+    qemu_free_stack(co->stack, co->stack_size);
+    g_free(co->asyncify_stack);
+    g_free(co);
+}
+
+CoroutineAction qemu_coroutine_switch(Coroutine *from_, Coroutine *to_,
+                      CoroutineAction action)
+{
+    CoroutineEmscripten *from = DO_UPCAST(CoroutineEmscripten, base, from_);
+    CoroutineEmscripten *to = DO_UPCAST(CoroutineEmscripten, base, to_);
+
+    set_current(to_);
+    to->action = action;
+    emscripten_fiber_swap(&from->fiber, &to->fiber);
+    return from->action;
+}
+
+Coroutine *qemu_coroutine_self(void)
+{
+    Coroutine *self = get_current();
+
+    if (!self) {
+        CoroutineEmscripten *leaderp = get_leader();
+        if (!leaderp) {
+            leaderp = g_malloc0(sizeof(*leaderp));
+            leaderp->asyncify_stack = g_malloc0(leader_asyncify_stack_size);
+            leaderp->asyncify_stack_size = leader_asyncify_stack_size;
+            emscripten_fiber_init_from_current_context(
+                &leaderp->fiber,
+                leaderp->asyncify_stack,
+                leaderp->asyncify_stack_size);
+            leaderp->stack = leaderp->fiber.stack_limit;
+            leaderp->stack_size =
+                leaderp->fiber.stack_base - leaderp->fiber.stack_limit;
+            set_leader(leaderp);
+        }
+        self = &leaderp->base;
+        set_current(self);
+    }
+    return self;
+}
+
+bool qemu_in_coroutine(void)
+{
+    Coroutine *self = get_current();
+
+    return self && self->caller;
+}

From ccc403ed5844613849deeaf18cba380b55b6e9bf Mon Sep 17 00:00:00 2001
From: Kohei Tokunaga <ktokunaga.mail@gmail.com>
Date: Mon, 28 Apr 2025 15:39:07 +0900
Subject: [PATCH 0715/2760] meson: Add wasm build in build scripts

has_int128_type is set to false on emscripten as of now to avoid errors by
libffi. Tests are disabled on emscripten because they rely on host
features that aren't supported by emscripten (e.g. fork and unix
socket).

Signed-off-by: Kohei Tokunaga <ktokunaga.mail@gmail.com>
Link: https://lore.kernel.org/r/ad03b3b180335f59e785e930968077bf15c46260.1745820062.git.ktokunaga.mail@gmail.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 MAINTAINERS                   |  1 +
 configs/meson/emscripten.txt  |  8 ++++++++
 configure                     |  7 +++++++
 meson.build                   | 29 ++++++++++++++++++++++++-----
 meson_options.txt             |  2 +-
 scripts/meson-buildoptions.sh |  2 +-
 6 files changed, 42 insertions(+), 7 deletions(-)
 create mode 100644 configs/meson/emscripten.txt

diff --git a/MAINTAINERS b/MAINTAINERS
index 55c47fcd37..02b75ea9e1 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -634,6 +634,7 @@ S: Maintained
 F: include/system/os-wasm.h
 F: os-wasm.c
 F: util/coroutine-wasm.c
+F: configs/meson/emscripten.txt
 
 Alpha Machines
 --------------
diff --git a/configs/meson/emscripten.txt b/configs/meson/emscripten.txt
new file mode 100644
index 0000000000..4230e88005
--- /dev/null
+++ b/configs/meson/emscripten.txt
@@ -0,0 +1,8 @@
+[built-in options]
+c_args = ['-pthread']
+cpp_args = ['-pthread']
+objc_args = ['-pthread']
+# -sPROXY_TO_PTHREAD link time flag always requires -pthread even during
+# configuration so explicitly add the flag here.
+c_link_args = ['-pthread','-sASYNCIFY=1','-sPROXY_TO_PTHREAD=1','-sFORCE_FILESYSTEM','-sALLOW_TABLE_GROWTH','-sTOTAL_MEMORY=2GB','-sWASM_BIGINT','-sEXPORT_ES6=1','-sASYNCIFY_IMPORTS=ffi_call_js','-sEXPORTED_RUNTIME_METHODS=addFunction,removeFunction,TTY,FS']
+cpp_link_args = ['-pthread','-sASYNCIFY=1','-sPROXY_TO_PTHREAD=1','-sFORCE_FILESYSTEM','-sALLOW_TABLE_GROWTH','-sTOTAL_MEMORY=2GB','-sWASM_BIGINT','-sEXPORT_ES6=1','-sASYNCIFY_IMPORTS=ffi_call_js','-sEXPORTED_RUNTIME_METHODS=addFunction,removeFunction,TTY,FS']
diff --git a/configure b/configure
index 40705afdf5..2ce8d29fac 100755
--- a/configure
+++ b/configure
@@ -360,6 +360,10 @@ elif check_define __NetBSD__; then
   host_os=netbsd
 elif check_define __APPLE__; then
   host_os=darwin
+elif check_define EMSCRIPTEN ; then
+  host_os=emscripten
+  cpu=wasm32
+  cross_compile="yes"
 else
   # This is a fatal error, but don't report it yet, because we
   # might be going to just print the --help text, or it might
@@ -526,6 +530,9 @@ case "$cpu" in
     linux_arch=x86
     CPU_CFLAGS="-m64"
     ;;
+  wasm32)
+    CPU_CFLAGS="-m32"
+    ;;
 esac
 
 if test -n "$host_arch" && {
diff --git a/meson.build b/meson.build
index 8eb3de5d68..27f1150152 100644
--- a/meson.build
+++ b/meson.build
@@ -50,9 +50,9 @@ genh = []
 qapi_trace_events = []
 
 bsd_oses = ['gnu/kfreebsd', 'freebsd', 'netbsd', 'openbsd', 'dragonfly', 'darwin']
-supported_oses = ['windows', 'freebsd', 'netbsd', 'openbsd', 'darwin', 'sunos', 'linux']
+supported_oses = ['windows', 'freebsd', 'netbsd', 'openbsd', 'darwin', 'sunos', 'linux', 'emscripten']
 supported_cpus = ['ppc', 'ppc64', 's390x', 'riscv32', 'riscv64', 'x86', 'x86_64',
-  'arm', 'aarch64', 'loongarch64', 'mips', 'mips64', 'sparc64']
+  'arm', 'aarch64', 'loongarch64', 'mips', 'mips64', 'sparc64', 'wasm32']
 
 cpu = host_machine.cpu_family()
 
@@ -353,6 +353,8 @@ foreach lang : all_languages
       # endif
       #endif''')
     # ok
+  elif compiler.get_id() == 'emscripten'
+    # ok
   else
     error('You either need GCC v7.4 or Clang v10.0 (or XCode Clang v15.0) to compile QEMU')
   endif
@@ -470,7 +472,10 @@ endif
 # instead, we can't add -no-pie because it overrides -shared: the linker then
 # tries to build an executable instead of a shared library and fails.  So
 # don't add -no-pie anywhere and cross fingers. :(
-if not get_option('b_pie')
+#
+# Emscripten doesn't support -no-pie but meson can't catch the compiler
+# warning. So explicitly omit the flag for Emscripten.
+if not get_option('b_pie') and host_os != 'emscripten'
   qemu_common_flags += cc.get_supported_arguments('-fno-pie', '-no-pie')
 endif
 
@@ -514,6 +519,8 @@ ucontext_probe = '''
 supported_backends = []
 if host_os == 'windows'
   supported_backends += ['windows']
+elif host_os == 'emscripten'
+  supported_backends += ['wasm']
 else
   if host_os != 'darwin' and cc.links(ucontext_probe)
     supported_backends += ['ucontext']
@@ -902,6 +909,10 @@ if get_option('tcg').allowed()
     if not get_option('tcg_interpreter')
       error('Unsupported CPU @0@, try --enable-tcg-interpreter'.format(cpu))
     endif
+  elif host_arch == 'wasm32'
+    if not get_option('tcg_interpreter')
+      error('WebAssembly host requires --enable-tcg-interpreter')
+    endif
   elif get_option('tcg_interpreter')
     warning('Use of the TCG interpreter is not recommended on this host')
     warning('architecture. There is a native TCG execution backend available')
@@ -2962,7 +2973,9 @@ config_host_data.set('CONFIG_ATOMIC64', cc.links('''
     return 0;
   }''', args: qemu_isa_flags))
 
-has_int128_type = cc.compiles('''
+# has_int128_type is set to false on Emscripten to avoid errors by libffi
+# during runtime.
+has_int128_type = host_os != 'emscripten' and cc.compiles('''
   __int128_t a;
   __uint128_t b;
   int main(void) { b = a; }''')
@@ -3775,6 +3788,8 @@ if have_block
   # os-win32.c does not
   if host_os == 'windows'
     system_ss.add(files('os-win32.c'))
+  elif host_os == 'emscripten'
+    blockdev_ss.add(files('os-wasm.c'))
   else
     blockdev_ss.add(files('os-posix.c'))
   endif
@@ -4516,7 +4531,11 @@ subdir('scripts')
 subdir('tools')
 subdir('pc-bios')
 subdir('docs')
-subdir('tests')
+# Tests are disabled on emscripten because they rely on host features that aren't
+# supported by emscripten (e.g. fork and unix socket).
+if host_os != 'emscripten'
+  subdir('tests')
+endif
 if gtk.found()
   subdir('po')
 endif
diff --git a/meson_options.txt b/meson_options.txt
index 0b4115e733..cc66b46c63 100644
--- a/meson_options.txt
+++ b/meson_options.txt
@@ -34,7 +34,7 @@ option('fuzzing_engine', type : 'string', value : '',
 option('trace_file', type: 'string', value: 'trace',
        description: 'Trace file prefix for simple backend')
 option('coroutine_backend', type: 'combo',
-       choices: ['ucontext', 'sigaltstack', 'windows', 'auto'],
+       choices: ['ucontext', 'sigaltstack', 'windows', 'wasm', 'auto'],
        value: 'auto', description: 'coroutine backend to use')
 
 # Everything else can be set via --enable/--disable-* option
diff --git a/scripts/meson-buildoptions.sh b/scripts/meson-buildoptions.sh
index d76a239130..8a67a14e2e 100644
--- a/scripts/meson-buildoptions.sh
+++ b/scripts/meson-buildoptions.sh
@@ -80,7 +80,7 @@ meson_options_help() {
   printf "%s\n" '  --tls-priority=VALUE     Default TLS protocol/cipher priority string'
   printf "%s\n" '                           [NORMAL]'
   printf "%s\n" '  --with-coroutine=CHOICE  coroutine backend to use (choices:'
-  printf "%s\n" '                           auto/sigaltstack/ucontext/windows)'
+  printf "%s\n" '                           auto/sigaltstack/ucontext/windows/wasm)'
   printf "%s\n" '  --with-pkgversion=VALUE  use specified string as sub-version of the'
   printf "%s\n" '                           package'
   printf "%s\n" '  --with-suffix=VALUE      Suffix for QEMU data/modules/config directories'

From 8574be0ebc8ad7729ad146055317550e5f6c3e1d Mon Sep 17 00:00:00 2001
From: Kohei Tokunaga <ktokunaga.mail@gmail.com>
Date: Mon, 28 Apr 2025 15:39:08 +0900
Subject: [PATCH 0716/2760] tests: Add Dockerfile containing dependencies for
 Emscripten build

The added Dockerfile is based on the emsdk image, which includes the
Emscripten toolchain. It also cross-compiles the necessary dependencies
(glib, libffi, pixman, and zlib) for the Emscripten target environment.

Signed-off-by: Kohei Tokunaga <ktokunaga.mail@gmail.com>
Link: https://lore.kernel.org/r/8bed6e9d46ef09328a87320928b5dec575d1e435.1745820062.git.ktokunaga.mail@gmail.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 MAINTAINERS                                   |   1 +
 .../dockerfiles/emsdk-wasm32-cross.docker     | 145 ++++++++++++++++++
 2 files changed, 146 insertions(+)
 create mode 100644 tests/docker/dockerfiles/emsdk-wasm32-cross.docker

diff --git a/MAINTAINERS b/MAINTAINERS
index 02b75ea9e1..9b5e41f616 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -635,6 +635,7 @@ F: include/system/os-wasm.h
 F: os-wasm.c
 F: util/coroutine-wasm.c
 F: configs/meson/emscripten.txt
+F: tests/docker/dockerfiles/emsdk-wasm32-cross.docker
 
 Alpha Machines
 --------------
diff --git a/tests/docker/dockerfiles/emsdk-wasm32-cross.docker b/tests/docker/dockerfiles/emsdk-wasm32-cross.docker
new file mode 100644
index 0000000000..60a7d02f56
--- /dev/null
+++ b/tests/docker/dockerfiles/emsdk-wasm32-cross.docker
@@ -0,0 +1,145 @@
+# syntax = docker/dockerfile:1.5
+
+ARG EMSDK_VERSION_QEMU=3.1.50
+ARG ZLIB_VERSION=1.3.1
+ARG GLIB_MINOR_VERSION=2.84
+ARG GLIB_VERSION=${GLIB_MINOR_VERSION}.0
+ARG PIXMAN_VERSION=0.44.2
+ARG FFI_VERSION=v3.4.7
+ARG MESON_VERSION=1.5.0
+
+FROM emscripten/emsdk:$EMSDK_VERSION_QEMU AS build-base
+ARG MESON_VERSION
+ENV TARGET=/builddeps/target
+ENV CPATH="$TARGET/include"
+ENV PKG_CONFIG_PATH="$TARGET/lib/pkgconfig"
+ENV EM_PKG_CONFIG_PATH="$PKG_CONFIG_PATH"
+ENV CFLAGS="-O3 -pthread -DWASM_BIGINT"
+ENV CXXFLAGS="$CFLAGS"
+ENV LDFLAGS="-sWASM_BIGINT -sASYNCIFY=1 -L$TARGET/lib"
+RUN apt-get update && apt-get install -y \
+    autoconf \
+    build-essential \
+    libglib2.0-dev \
+    libtool \
+    pkgconf \
+    ninja-build \
+    python3-pip
+RUN pip3 install meson==${MESON_VERSION} tomli
+RUN mkdir /build
+WORKDIR /build
+RUN mkdir -p $TARGET
+RUN <<EOF
+cat <<EOT > /cross.meson
+[host_machine]
+system = 'emscripten'
+cpu_family = 'wasm32'
+cpu = 'wasm32'
+endian = 'little'
+
+[binaries]
+c = 'emcc'
+cpp = 'em++'
+ar = 'emar'
+ranlib = 'emranlib'
+pkgconfig = ['pkg-config', '--static']
+EOT
+EOF
+
+FROM build-base AS zlib-dev
+ARG ZLIB_VERSION
+RUN mkdir -p /zlib
+RUN curl -Ls https://zlib.net/zlib-$ZLIB_VERSION.tar.xz | \
+    tar xJC /zlib --strip-components=1
+WORKDIR /zlib
+RUN emconfigure ./configure --prefix=$TARGET --static
+RUN emmake make install -j$(nproc)
+
+FROM build-base AS libffi-dev
+ARG FFI_VERSION
+RUN mkdir -p /libffi
+RUN git clone https://github.com/libffi/libffi /libffi
+WORKDIR /libffi
+RUN git checkout $FFI_VERSION
+RUN autoreconf -fiv
+RUN emconfigure ./configure --host=wasm32-unknown-linux \
+    --prefix=$TARGET --enable-static \
+    --disable-shared --disable-dependency-tracking \
+    --disable-builddir --disable-multi-os-directory \
+    --disable-raw-api --disable-docs
+RUN emmake make install SUBDIRS='include' -j$(nproc)
+
+FROM build-base AS pixman-dev
+ARG PIXMAN_VERSION
+RUN mkdir /pixman/
+RUN git clone  https://gitlab.freedesktop.org/pixman/pixman /pixman/
+WORKDIR /pixman
+RUN git checkout pixman-$PIXMAN_VERSION
+RUN <<EOF
+cat <<EOT >> /cross.meson
+[built-in options]
+c_args = [$(printf "'%s', " $CFLAGS | sed 's/, $//')]
+cpp_args = [$(printf "'%s', " $CFLAGS | sed 's/, $//')]
+objc_args = [$(printf "'%s', " $CFLAGS | sed 's/, $//')]
+c_link_args = [$(printf "'%s', " $LDFLAGS | sed 's/, $//')]
+cpp_link_args = [$(printf "'%s', " $LDFLAGS | sed 's/, $//')]
+EOT
+EOF
+RUN meson setup _build --prefix=$TARGET --cross-file=/cross.meson \
+    --default-library=static \
+    --buildtype=release -Dtests=disabled -Ddemos=disabled
+RUN meson install -C _build
+
+FROM build-base AS glib-dev
+ARG GLIB_VERSION
+ARG GLIB_MINOR_VERSION
+RUN mkdir -p /stub
+WORKDIR /stub
+RUN <<EOF
+cat <<'EOT' > res_query.c
+#include <netdb.h>
+int res_query(const char *name, int class,
+              int type, unsigned char *dest, int len)
+{
+    h_errno = HOST_NOT_FOUND;
+    return -1;
+}
+EOT
+EOF
+RUN emcc ${CFLAGS} -c res_query.c -fPIC -o libresolv.o
+RUN ar rcs libresolv.a libresolv.o
+RUN mkdir -p $TARGET/lib/
+RUN cp libresolv.a $TARGET/lib/
+
+RUN mkdir -p /glib
+RUN curl -Lks https://download.gnome.org/sources/glib/${GLIB_MINOR_VERSION}/glib-$GLIB_VERSION.tar.xz | \
+    tar xJC /glib --strip-components=1
+
+COPY --link --from=zlib-dev /builddeps/ /builddeps/
+COPY --link --from=libffi-dev /builddeps/ /builddeps/
+
+WORKDIR /glib
+RUN <<EOF
+CFLAGS="$CFLAGS -Wno-incompatible-function-pointer-types" ;
+cat <<EOT >> /cross.meson
+[built-in options]
+c_args = [$(printf "'%s', " $CFLAGS | sed 's/, $//')]
+cpp_args = [$(printf "'%s', " $CFLAGS | sed 's/, $//')]
+objc_args = [$(printf "'%s', " $CFLAGS | sed 's/, $//')]
+c_link_args = [$(printf "'%s', " $LDFLAGS | sed 's/, $//')]
+cpp_link_args = [$(printf "'%s', " $LDFLAGS | sed 's/, $//')]
+EOT
+EOF
+RUN meson setup _build --prefix=$TARGET --cross-file=/cross.meson \
+    --default-library=static --buildtype=release --force-fallback-for=pcre2 \
+    -Dselinux=disabled -Dxattr=false -Dlibmount=disabled -Dnls=disabled \
+    -Dtests=false -Dglib_debug=disabled -Dglib_assert=false -Dglib_checks=false
+# FIXME: emscripten doesn't provide some pthread functions in the final link,
+#        which isn't detected during meson setup.
+RUN sed -i -E "/#define HAVE_POSIX_SPAWN 1/d" ./_build/config.h
+RUN sed -i -E "/#define HAVE_PTHREAD_GETNAME_NP 1/d" ./_build/config.h
+RUN meson install -C _build
+
+FROM build-base
+COPY --link --from=glib-dev /builddeps/ /builddeps/
+COPY --link --from=pixman-dev /builddeps/ /builddeps/

From e6b9b79c3076777b791f72ebdbc9d37ad8005fe9 Mon Sep 17 00:00:00 2001
From: Kohei Tokunaga <ktokunaga.mail@gmail.com>
Date: Mon, 28 Apr 2025 15:39:09 +0900
Subject: [PATCH 0717/2760] gitlab: Enable CI for wasm build

Add GitLab CI job that builds QEMU using emscripten. The build runs in the
container defined in tests/docker/dockerfiles/emsdk-wasm32-cross.docker.

Signed-off-by: Kohei Tokunaga <ktokunaga.mail@gmail.com>
Link: https://lore.kernel.org/r/ade0deb2dc65618a91755590f6729485b4001b94.1745820062.git.ktokunaga.mail@gmail.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 .gitlab-ci.d/buildtest-template.yml | 27 +++++++++++++++++++++++++++
 .gitlab-ci.d/buildtest.yml          |  9 +++++++++
 .gitlab-ci.d/container-cross.yml    |  5 +++++
 3 files changed, 41 insertions(+)

diff --git a/.gitlab-ci.d/buildtest-template.yml b/.gitlab-ci.d/buildtest-template.yml
index d4f145fdb5..118371e377 100644
--- a/.gitlab-ci.d/buildtest-template.yml
+++ b/.gitlab-ci.d/buildtest-template.yml
@@ -115,3 +115,30 @@
     - du -chs ${CI_PROJECT_DIR}/*-cache
   variables:
     QEMU_JOB_FUNCTIONAL: 1
+
+.wasm_build_job_template:
+  extends: .base_job_template
+  stage: build
+  image: $CI_REGISTRY_IMAGE/qemu/$IMAGE:$QEMU_CI_CONTAINER_TAG
+  before_script:
+    - source scripts/ci/gitlab-ci-section
+    - section_start setup "Pre-script setup"
+    - JOBS=$(expr $(nproc) + 1)
+    - section_end setup
+  script:
+    - du -sh .git
+    - mkdir build
+    - cd build
+    - section_start configure "Running configure"
+    - emconfigure ../configure --disable-docs
+          ${TARGETS:+--target-list="$TARGETS"}
+          $CONFIGURE_ARGS ||
+      { cat config.log meson-logs/meson-log.txt && exit 1; }
+    - if test -n "$LD_JOBS";
+      then
+        pyvenv/bin/meson configure . -Dbackend_max_links="$LD_JOBS" ;
+      fi || exit 1;
+    - section_end configure
+    - section_start build "Building QEMU"
+    - emmake make -j"$JOBS"
+    - section_end build
diff --git a/.gitlab-ci.d/buildtest.yml b/.gitlab-ci.d/buildtest.yml
index 431bc07d8f..248aaed137 100644
--- a/.gitlab-ci.d/buildtest.yml
+++ b/.gitlab-ci.d/buildtest.yml
@@ -792,3 +792,12 @@ coverity:
       when: never
     # Always manual on forks even if $QEMU_CI == "2"
     - when: manual
+
+build-wasm:
+  extends: .wasm_build_job_template
+  timeout: 2h
+  needs:
+    job: wasm-emsdk-cross-container
+  variables:
+    IMAGE: emsdk-wasm32-cross
+    CONFIGURE_ARGS: --static --disable-tools --enable-debug --enable-tcg-interpreter
diff --git a/.gitlab-ci.d/container-cross.yml b/.gitlab-ci.d/container-cross.yml
index e45ea17cf1..8d3be53b75 100644
--- a/.gitlab-ci.d/container-cross.yml
+++ b/.gitlab-ci.d/container-cross.yml
@@ -91,3 +91,8 @@ win64-fedora-cross-container:
   extends: .container_job_template
   variables:
     NAME: fedora-win64-cross
+
+wasm-emsdk-cross-container:
+  extends: .container_job_template
+  variables:
+    NAME: emsdk-wasm32-cross

From d5df2bb0faad0e766cdd9f705d41b6092391153a Mon Sep 17 00:00:00 2001
From: Tim Lee <timlee660101@gmail.com>
Date: Mon, 14 Apr 2025 10:06:29 +0800
Subject: [PATCH 0718/2760] hw/arm: Attach PSPI module to NPCM8XX SoC
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Nuvoton's PSPI is a general purpose SPI module which enables
connections to SPI-based peripheral devices. Attach it to the NPCM8XX.

Tested:
NPCM8XX PSPI driver probed successfully from dmesg log.

Signed-off-by: Tim Lee <timlee660101@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Hao Wu <wuhaotsh@google.com>
Reviewed-by: Tyrone Ting <kfting@nuvoton.com>
Message-id: 20250414020629.1867106-1-timlee660101@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/npcm8xx.c         | 11 ++++++++++-
 include/hw/arm/npcm8xx.h |  2 ++
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/hw/arm/npcm8xx.c b/hw/arm/npcm8xx.c
index 5cc67b132f..d7ee306de7 100644
--- a/hw/arm/npcm8xx.c
+++ b/hw/arm/npcm8xx.c
@@ -67,6 +67,9 @@
 /* SDHCI Modules */
 #define NPCM8XX_MMC_BA          0xf0842000
 
+/* PSPI Modules */
+#define NPCM8XX_PSPI_BA         0xf0201000
+
 /* Run PLL1 at 1600 MHz */
 #define NPCM8XX_PLLCON1_FIXUP_VAL   0x00402101
 /* Run the CPU from PLL1 and UART from PLL2 */
@@ -83,6 +86,7 @@ enum NPCM8xxInterrupt {
     NPCM8XX_PECI_IRQ            = 6,
     NPCM8XX_KCS_HIB_IRQ         = 9,
     NPCM8XX_MMC_IRQ             = 26,
+    NPCM8XX_PSPI_IRQ            = 28,
     NPCM8XX_TIMER0_IRQ          = 32,   /* Timer Module 0 */
     NPCM8XX_TIMER1_IRQ,
     NPCM8XX_TIMER2_IRQ,
@@ -441,6 +445,7 @@ static void npcm8xx_init(Object *obj)
     }
 
     object_initialize_child(obj, "mmc", &s->mmc, TYPE_NPCM7XX_SDHCI);
+    object_initialize_child(obj, "pspi", &s->pspi, TYPE_NPCM_PSPI);
 }
 
 static void npcm8xx_realize(DeviceState *dev, Error **errp)
@@ -705,6 +710,11 @@ static void npcm8xx_realize(DeviceState *dev, Error **errp)
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->mmc), 0,
             npcm8xx_irq(s, NPCM8XX_MMC_IRQ));
 
+    /* PSPI */
+    sysbus_realize(SYS_BUS_DEVICE(&s->pspi), &error_abort);
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->pspi), 0, NPCM8XX_PSPI_BA);
+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->pspi), 0,
+            npcm8xx_irq(s, NPCM8XX_PSPI_IRQ));
 
     create_unimplemented_device("npcm8xx.shm",          0xc0001000,   4 * KiB);
     create_unimplemented_device("npcm8xx.gicextra",     0xdfffa000,  24 * KiB);
@@ -720,7 +730,6 @@ static void npcm8xx_realize(DeviceState *dev, Error **errp)
     create_unimplemented_device("npcm8xx.siox[1]",      0xf0101000,   4 * KiB);
     create_unimplemented_device("npcm8xx.siox[2]",      0xf0102000,   4 * KiB);
     create_unimplemented_device("npcm8xx.tmps",         0xf0188000,   4 * KiB);
-    create_unimplemented_device("npcm8xx.pspi",         0xf0201000,   4 * KiB);
     create_unimplemented_device("npcm8xx.viru1",        0xf0204000,   4 * KiB);
     create_unimplemented_device("npcm8xx.viru2",        0xf0205000,   4 * KiB);
     create_unimplemented_device("npcm8xx.jtm1",         0xf0208000,   4 * KiB);
diff --git a/include/hw/arm/npcm8xx.h b/include/hw/arm/npcm8xx.h
index 9812e6fa7e..3436abff99 100644
--- a/include/hw/arm/npcm8xx.h
+++ b/include/hw/arm/npcm8xx.h
@@ -36,6 +36,7 @@
 #include "hw/usb/hcd-ehci.h"
 #include "hw/usb/hcd-ohci.h"
 #include "target/arm/cpu.h"
+#include "hw/ssi/npcm_pspi.h"
 
 #define NPCM8XX_MAX_NUM_CPUS    (4)
 
@@ -99,6 +100,7 @@ struct NPCM8xxState {
     OHCISysBusState     ohci[2];
     NPCM7xxFIUState     fiu[3];
     NPCM7xxSDHCIState   mmc;
+    NPCMPSPIState       pspi;
 };
 
 struct NPCM8xxClass {

From 8ed7c0b6488a7f20318d6ba414f1cbcd0ed92afe Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Thu, 1 May 2025 13:55:44 +0100
Subject: [PATCH 0719/2760] target/arm: Don't assert() for ISB/SB inside IT
 block

If the guest code has an ISB or SB insn inside an IT block, we
generate incorrect code which trips a TCG assertion:

qemu-system-arm: ../tcg/tcg-op.c:3343: void tcg_gen_goto_tb(unsigned int): Assertion `(tcg_ctx->goto_tb_issue_mask & (1 << idx)) == 0' failed.

This is because we call gen_goto_tb(dc, 1, ...) twice:

 brcond_i32 ZF,$0x0,ne,$L1
 add_i32 pc,pc,$0x4
 goto_tb $0x1
 exit_tb $0x73d948001b81
 set_label $L1
 add_i32 pc,pc,$0x4
 goto_tb $0x1
 exit_tb $0x73d948001b81

Both calls are in arm_tr_tb_stop(), one for the
DISAS_NEXT/DISAS_TOO_MANY handling, and one for the dc->condjump
condition-failed codepath.  The DISAS_NEXT handling doesn't have this
problem because arm_post_translate_insn() does the handling of "emit
the label for the condition-failed conditional execution" and so
arm_tr_tb_stop() doesn't have dc->condjump set.  But for
DISAS_TOO_MANY we don't do that.

Fix the bug by making arm_post_translate_insn() handle the
DISAS_TOO_MANY case.  This only affects the SB and ISB insns when
used in Thumb mode inside an IT block: only these insns specifically
set is_jmp to TOO_MANY, and their A32 encodings are unconditional.

For the major TOO_MANY case (breaking the TB because it would cross a
page boundary) we do that check and set is_jmp to TOO_MANY only after
the call to arm_post_translate_insn(); so arm_post_translate_insn()
sees is_jmp == DISAS_NEXT, and  we emit the correct code for that
situation.

With this fix we generate the somewhat more sensible set of TCG ops:
 brcond_i32 ZF,$0x0,ne,$L1
 set_label $L1
 add_i32 pc,pc,$0x4
 goto_tb $0x1
 exit_tb $0x7c5434001b81

(NB: the TCG optimizer doesn't optimize out the jump-to-next, but
we can't really avoid emitting it because we don't know at the
point we're emitting the handling for the condexec check whether
this insn is going to happen to be a nop for us or not.)

Cc: qemu-stable@nongnu.org
Fixes: https://gitlab.com/qemu-project/qemu/-/issues/2942
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250501125544.727038-1-peter.maydell@linaro.org
---
 target/arm/tcg/translate.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/target/arm/tcg/translate.c b/target/arm/tcg/translate.c
index 88df9c482a..e773ab7268 100644
--- a/target/arm/tcg/translate.c
+++ b/target/arm/tcg/translate.c
@@ -7760,7 +7760,8 @@ static bool arm_check_ss_active(DisasContext *dc)
 
 static void arm_post_translate_insn(DisasContext *dc)
 {
-    if (dc->condjmp && dc->base.is_jmp == DISAS_NEXT) {
+    if (dc->condjmp &&
+        (dc->base.is_jmp == DISAS_NEXT || dc->base.is_jmp == DISAS_TOO_MANY)) {
         if (dc->pc_save != dc->condlabel.pc_save) {
             gen_update_pc(dc, dc->condlabel.pc_save - dc->pc_save);
         }

From 82707dd4f07613eed8d639956a43bddffca5cd5c Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Thu, 1 May 2025 10:31:26 +0100
Subject: [PATCH 0720/2760] docs: Don't define duplicate label in
 qemu-block-drivers.rst.inc

Sphinx requires that labels within documents are unique across the
whole manual.  This is because the "create a hyperlink" directive
specifies only the name of the label, not a filename+label.  Some
Sphinx versions will warn about duplicate labels, but even if there
is no warning there is still an ambiguity and no guarantee that the
hyperlink will be created to the right target.

For QEMU this is awkward, because we have various .rst.inc fragments
which we include into multiple .rst files.  If you define a label in
the .rst.inc file then it will be a duplicate label.  We have mostly
worked around this by not putting labels into those .rst.inc files,
or by adding "insert a label" functionality into the hxtool extension
(see commit 1eeb432a953b0 "doc/sphinx/hxtool.py: add optional label
argument to SRST directive").

Unfortunately in commit 7f6314427e78 ("docs/devel: add a codebase
section") we accidentally added a duplicate label, because not all
Sphinx versions warn about the mistake.

In this case the link was only from the developer docs codebase
summary, so as the simplest fix for the stable branch, we drop
the link entirely.

Cc: qemu-stable@nongnu.org
Fixes: 1eeb432a953b0 "doc/sphinx/hxtool.py: add optional label argument to SRST directive"
Reported-by: Dario Faggioli <dfaggioli@suse.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Acked-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-id: 20250501093126.716667-1-peter.maydell@linaro.org
---
 docs/devel/codebase.rst                | 2 +-
 docs/system/qemu-block-drivers.rst.inc | 2 --
 2 files changed, 1 insertion(+), 3 deletions(-)

diff --git a/docs/devel/codebase.rst b/docs/devel/codebase.rst
index 40273e7d31..2a3143787a 100644
--- a/docs/devel/codebase.rst
+++ b/docs/devel/codebase.rst
@@ -116,7 +116,7 @@ yet, so sometimes the source code is all you have.
 * `monitor <https://gitlab.com/qemu-project/qemu/-/tree/master/monitor>`_:
   `Monitor <QEMU monitor>` implementation (HMP & QMP).
 * `nbd <https://gitlab.com/qemu-project/qemu/-/tree/master/nbd>`_:
-  QEMU `NBD (Network Block Device) <nbd>` server.
+  QEMU NBD (Network Block Device) server.
 * `net <https://gitlab.com/qemu-project/qemu/-/tree/master/net>`_:
   Network (host) support.
 * `pc-bios <https://gitlab.com/qemu-project/qemu/-/tree/master/pc-bios>`_:
diff --git a/docs/system/qemu-block-drivers.rst.inc b/docs/system/qemu-block-drivers.rst.inc
index cfe1acb78a..384e95ba76 100644
--- a/docs/system/qemu-block-drivers.rst.inc
+++ b/docs/system/qemu-block-drivers.rst.inc
@@ -500,8 +500,6 @@ What you should *never* do:
 - expect it to work when loadvm'ing
 - write to the FAT directory on the host system while accessing it with the guest system
 
-.. _nbd:
-
 NBD access
 ~~~~~~~~~~
 

From d3a161cdd56a768b89f164935033249dc16d5250 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Tue, 18 Mar 2025 11:42:22 +0000
Subject: [PATCH 0721/2760] target/arm/kvm: Drop support for kernels without
 KVM_ARM_PREFERRED_TARGET
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Our KVM code includes backwards compatibility support for ancient
kernels which don't support the KVM_ARM_PREFERRED_TARGET ioctl.  This
ioctl was introduced in kernel commit 42c4e0c77ac91 in September
2013 and is in v3.12, so it's reasonable to assume it's present.

(We already dropped support for kernels without KVM_CAP_DEVICE_CTRL,
a feature added to the kernel in April 2013, in our commit
84f298ea3e; so there are only about six months' worth of kernels,
from v3.9 to v3.11, that we don't already fail to run on and that
this commit is dropping handling for.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250318114222.1018200-1-peter.maydell@linaro.org
---
 target/arm/arm-qmp-cmds.c |  2 +-
 target/arm/kvm.c          | 55 ++++++---------------------------------
 target/arm/kvm_arm.h      |  7 +----
 3 files changed, 10 insertions(+), 54 deletions(-)

diff --git a/target/arm/arm-qmp-cmds.c b/target/arm/arm-qmp-cmds.c
index 883c0a0e8c..a1a944adb4 100644
--- a/target/arm/arm-qmp-cmds.c
+++ b/target/arm/arm-qmp-cmds.c
@@ -46,7 +46,7 @@ static inline void gic_cap_kvm_probe(GICCapability *v2, GICCapability *v3)
 #ifdef CONFIG_KVM
     int fdarray[3];
 
-    if (!kvm_arm_create_scratch_host_vcpu(NULL, fdarray, NULL)) {
+    if (!kvm_arm_create_scratch_host_vcpu(fdarray, NULL)) {
         return;
     }
 
diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index 97de8c7e93..9c62d12b23 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -100,8 +100,7 @@ static int kvm_arm_vcpu_finalize(ARMCPU *cpu, int feature)
     return kvm_vcpu_ioctl(CPU(cpu), KVM_ARM_VCPU_FINALIZE, &feature);
 }
 
-bool kvm_arm_create_scratch_host_vcpu(const uint32_t *cpus_to_try,
-                                      int *fdarray,
+bool kvm_arm_create_scratch_host_vcpu(int *fdarray,
                                       struct kvm_vcpu_init *init)
 {
     int ret = 0, kvmfd = -1, vmfd = -1, cpufd = -1;
@@ -150,40 +149,13 @@ bool kvm_arm_create_scratch_host_vcpu(const uint32_t *cpus_to_try,
         struct kvm_vcpu_init preferred;
 
         ret = ioctl(vmfd, KVM_ARM_PREFERRED_TARGET, &preferred);
-        if (!ret) {
-            init->target = preferred.target;
+        if (ret < 0) {
+            goto err;
         }
+        init->target = preferred.target;
     }
-    if (ret >= 0) {
-        ret = ioctl(cpufd, KVM_ARM_VCPU_INIT, init);
-        if (ret < 0) {
-            goto err;
-        }
-    } else if (cpus_to_try) {
-        /* Old kernel which doesn't know about the
-         * PREFERRED_TARGET ioctl: we know it will only support
-         * creating one kind of guest CPU which is its preferred
-         * CPU type.
-         */
-        struct kvm_vcpu_init try;
-
-        while (*cpus_to_try != QEMU_KVM_ARM_TARGET_NONE) {
-            try.target = *cpus_to_try++;
-            memcpy(try.features, init->features, sizeof(init->features));
-            ret = ioctl(cpufd, KVM_ARM_VCPU_INIT, &try);
-            if (ret >= 0) {
-                break;
-            }
-        }
-        if (ret < 0) {
-            goto err;
-        }
-        init->target = try.target;
-    } else {
-        /* Treat a NULL cpus_to_try argument the same as an empty
-         * list, which means we will fail the call since this must
-         * be an old kernel which doesn't support PREFERRED_TARGET.
-         */
+    ret = ioctl(cpufd, KVM_ARM_VCPU_INIT, init);
+    if (ret < 0) {
         goto err;
     }
 
@@ -259,17 +231,6 @@ static bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
     uint64_t features = 0;
     int err;
 
-    /* Old kernels may not know about the PREFERRED_TARGET ioctl: however
-     * we know these will only support creating one kind of guest CPU,
-     * which is its preferred CPU type. Fortunately these old kernels
-     * support only a very limited number of CPUs.
-     */
-    static const uint32_t cpus_to_try[] = {
-        KVM_ARM_TARGET_AEM_V8,
-        KVM_ARM_TARGET_FOUNDATION_V8,
-        KVM_ARM_TARGET_CORTEX_A57,
-        QEMU_KVM_ARM_TARGET_NONE
-    };
     /*
      * target = -1 informs kvm_arm_create_scratch_host_vcpu()
      * to use the preferred target
@@ -300,7 +261,7 @@ static bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
         features |= 1ULL << ARM_FEATURE_PMU;
     }
 
-    if (!kvm_arm_create_scratch_host_vcpu(cpus_to_try, fdarray, &init)) {
+    if (!kvm_arm_create_scratch_host_vcpu(fdarray, &init)) {
         return false;
     }
 
@@ -1835,7 +1796,7 @@ uint32_t kvm_arm_sve_get_vls(ARMCPU *cpu)
 
         probed = true;
 
-        if (!kvm_arm_create_scratch_host_vcpu(NULL, fdarray, &init)) {
+        if (!kvm_arm_create_scratch_host_vcpu(fdarray, &init)) {
             error_report("failed to create scratch VCPU with SVE enabled");
             abort();
         }
diff --git a/target/arm/kvm_arm.h b/target/arm/kvm_arm.h
index 05c3de8cd4..5f17fc2f3d 100644
--- a/target/arm/kvm_arm.h
+++ b/target/arm/kvm_arm.h
@@ -97,10 +97,6 @@ void kvm_arm_reset_vcpu(ARMCPU *cpu);
 #ifdef CONFIG_KVM
 /**
  * kvm_arm_create_scratch_host_vcpu:
- * @cpus_to_try: array of QEMU_KVM_ARM_TARGET_* values (terminated with
- * QEMU_KVM_ARM_TARGET_NONE) to try as fallback if the kernel does not
- * know the PREFERRED_TARGET ioctl. Passing NULL is the same as passing
- * an empty array.
  * @fdarray: filled in with kvmfd, vmfd, cpufd file descriptors in that order
  * @init: filled in with the necessary values for creating a host
  * vcpu. If NULL is provided, will not init the vCPU (though the cpufd
@@ -113,8 +109,7 @@ void kvm_arm_reset_vcpu(ARMCPU *cpu);
  * Returns: true on success (and fdarray and init are filled in),
  * false on failure (and fdarray and init are not valid).
  */
-bool kvm_arm_create_scratch_host_vcpu(const uint32_t *cpus_to_try,
-                                      int *fdarray,
+bool kvm_arm_create_scratch_host_vcpu(int *fdarray,
                                       struct kvm_vcpu_init *init);
 
 /**

From 30f7e6b6926451335cf9f95aff5439c6230d9329 Mon Sep 17 00:00:00 2001
From: Bernhard Beschow <shentey@gmail.com>
Date: Thu, 1 May 2025 20:34:43 +0200
Subject: [PATCH 0722/2760] hw/pci-host/designware: Remove unused include
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The DEFINE_TYPES() macro doesn't need the qemu/module.h include.

Fixes: 13a07eb146c8 ("hw/pci-host/designware: Declare CPU QOM types using DEFINE_TYPES() macro")
Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250501183445.2389-2-shentey@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/pci-host/designware.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/hw/pci-host/designware.c b/hw/pci-host/designware.c
index 183f838392..b4bff14579 100644
--- a/hw/pci-host/designware.c
+++ b/hw/pci-host/designware.c
@@ -20,7 +20,6 @@
 
 #include "qemu/osdep.h"
 #include "qapi/error.h"
-#include "qemu/module.h"
 #include "qemu/log.h"
 #include "qemu/bitops.h"
 #include "hw/pci/msi.h"

From 4fb17d01ef35411280475c0a80e1312baad5dc12 Mon Sep 17 00:00:00 2001
From: Bernhard Beschow <shentey@gmail.com>
Date: Thu, 1 May 2025 20:34:44 +0200
Subject: [PATCH 0723/2760] hw/pci-host/designware: Fix viewport configuration
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Commit 6970f91ac781, "hw/pci-host/designware: Use deposit/extract
API" accidentally introduced a copy-and-paste error, causing Linux
6.14 to hang when initializing the PCIe bridge on the imx8mp-evk
machine.  This fix corrects the error.

Fixes: 6970f91ac781 ("hw/pci-host/designware: Use deposit/extract API")
Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250501183445.2389-3-shentey@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/pci-host/designware.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/pci-host/designware.c b/hw/pci-host/designware.c
index b4bff14579..f6e49ce9b8 100644
--- a/hw/pci-host/designware.c
+++ b/hw/pci-host/designware.c
@@ -348,14 +348,14 @@ static void designware_pcie_root_config_write(PCIDevice *d, uint32_t address,
 
     case DESIGNWARE_PCIE_ATU_LOWER_BASE:
     case DESIGNWARE_PCIE_ATU_UPPER_BASE:
-        viewport->base = deposit64(root->msi.base,
+        viewport->base = deposit64(viewport->base,
                                    address == DESIGNWARE_PCIE_ATU_LOWER_BASE
                                    ? 0 : 32, 32, val);
         break;
 
     case DESIGNWARE_PCIE_ATU_LOWER_TARGET:
     case DESIGNWARE_PCIE_ATU_UPPER_TARGET:
-        viewport->target = deposit64(root->msi.base,
+        viewport->target = deposit64(viewport->target,
                                      address == DESIGNWARE_PCIE_ATU_LOWER_TARGET
                                      ? 0 : 32, 32, val);
         break;

From eba837a31b9579e30cc6d7ecb4b5c2662a6ffaba Mon Sep 17 00:00:00 2001
From: Bernhard Beschow <shentey@gmail.com>
Date: Thu, 1 May 2025 20:34:45 +0200
Subject: [PATCH 0724/2760] hw/gpio/imx_gpio: Fix interpretation of GDIR
 polarity

According to the i.MX 8M Plus reference manual, a GPIO pin is
configured as an output when the corresponding bit in the GDIR
register is set.  The function imx_gpio_set_int_line() is intended to
be a no-op if the pin is configured as an output, returning early in
such cases.  However, it inverts the condition.  Fix this by
returning early when the bit is set.

cc: qemu-stable@nongnu.org
Fixes: f44272809779 ("i.MX: Add GPIO device")
Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Message-id: 20250501183445.2389-4-shentey@gmail.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/gpio/imx_gpio.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/gpio/imx_gpio.c b/hw/gpio/imx_gpio.c
index f23c52af26..450ece4548 100644
--- a/hw/gpio/imx_gpio.c
+++ b/hw/gpio/imx_gpio.c
@@ -72,7 +72,7 @@ static void imx_gpio_update_int(IMXGPIOState *s)
 static void imx_gpio_set_int_line(IMXGPIOState *s, int line, IMXGPIOLevel level)
 {
     /* if this signal isn't configured as an input signal, nothing to do */
-    if (!extract32(s->gdir, line, 1)) {
+    if (extract32(s->gdir, line, 1)) {
         return;
     }
 

From ecb0cfb8a2b09fb0352b7adb83f18888be47a1cf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 29 Apr 2025 17:39:04 +0200
Subject: [PATCH 0725/2760] hw/arm/virt: Update comment about Multiprocessor
 Affinity Register
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Support on ARMv7 has been dropped in commit 82bf7ae84ce
("target/arm: Remove KVM support for 32-bit Arm hosts").
Update the comment in virt_cpu_mp_affinity() to avoid
mentioning it.

Suggested-by: Andrew Jones <ajones@ventanamicro.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250429153907.31866-2-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index bd1a68673a..03fef07c9d 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -1766,12 +1766,7 @@ static uint64_t virt_cpu_mp_affinity(VirtMachineState *vms, int idx)
     uint8_t clustersz;
 
     /*
-     * Adjust MPIDR like 64-bit KVM hosts, which incorporate the
-     * GIC's target-list limitations. 32-bit KVM hosts currently
-     * always create clusters of 4 CPUs, but that is expected to
-     * change when they gain support for gicv3. When KVM is enabled
-     * it will override the changes we make here, therefore our
-     * purposes are to make TCG consistent (with 64-bit KVM hosts)
+     * Adjust MPIDR to make TCG consistent (with 64-bit KVM hosts)
      * and to improve SGI efficiency.
      */
     if (vms->gic_version == VIRT_GIC_VERSION_2) {

From bac2532735d485dc3da38ece44300ad0abf5b51c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 29 Apr 2025 17:39:05 +0200
Subject: [PATCH 0726/2760] hw/arm/virt: Remove deprecated virt-3.0 machine
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This machine has been supported for a period of more than 6 years.
According to our versioned machine support policy (see commit
ce80c4fa6ff "docs: document special exception for machine type
deprecation & removal") it can now be removed.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250429153907.31866-3-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index 03fef07c9d..1e4841f036 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -3576,10 +3576,3 @@ static void virt_machine_3_1_options(MachineClass *mc)
     compat_props_add(mc->compat_props, hw_compat_3_1, hw_compat_3_1_len);
 }
 DEFINE_VIRT_MACHINE(3, 1)
-
-static void virt_machine_3_0_options(MachineClass *mc)
-{
-    virt_machine_3_1_options(mc);
-    compat_props_add(mc->compat_props, hw_compat_3_0, hw_compat_3_0_len);
-}
-DEFINE_VIRT_MACHINE(3, 0)

From c4aca607c199a3706ef77e123afed377fb913b4f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 29 Apr 2025 17:39:06 +0200
Subject: [PATCH 0727/2760] hw/arm/virt: Remove deprecated virt-3.1 machine
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This machine has been supported for a period of more than 6 years.
According to our versioned machine support policy (see commit
ce80c4fa6ff "docs: document special exception for machine type
deprecation & removal") it can now be removed.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250429153907.31866-4-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index 1e4841f036..61fd855768 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -3569,10 +3569,3 @@ static void virt_machine_4_0_options(MachineClass *mc)
     compat_props_add(mc->compat_props, hw_compat_4_0, hw_compat_4_0_len);
 }
 DEFINE_VIRT_MACHINE(4, 0)
-
-static void virt_machine_3_1_options(MachineClass *mc)
-{
-    virt_machine_4_0_options(mc);
-    compat_props_add(mc->compat_props, hw_compat_3_1, hw_compat_3_1_len);
-}
-DEFINE_VIRT_MACHINE(3, 1)

From 607e1208b53ac713a76d158f4abc4cd2e8870051 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 29 Apr 2025 17:39:07 +0200
Subject: [PATCH 0728/2760] hw/arm/virt: Remove deprecated virt-4.0 machine
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This machine has been supported for a period of more than 6 years.
According to our versioned machine support policy (see commit
ce80c4fa6ff "docs: document special exception for machine type
deprecation & removal") it can now be removed.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250429153907.31866-5-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index 61fd855768..9a6cd085a3 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -3562,10 +3562,3 @@ static void virt_machine_4_1_options(MachineClass *mc)
     mc->auto_enable_numa_with_memhp = false;
 }
 DEFINE_VIRT_MACHINE(4, 1)
-
-static void virt_machine_4_0_options(MachineClass *mc)
-{
-    virt_machine_4_1_options(mc);
-    compat_props_add(mc->compat_props, hw_compat_4_0, hw_compat_4_0_len);
-}
-DEFINE_VIRT_MACHINE(4, 0)

From a4b20f737cda06bb8706a83e27f7fa89863ae689 Mon Sep 17 00:00:00 2001
From: Aleksandr Partanen <alex.pentagrid@gmail.com>
Date: Thu, 10 Apr 2025 17:46:04 +0300
Subject: [PATCH 0729/2760] xen: mapcache: Fix finding matching entry

If we have request without lock and hit unlocked or invalid
entry during the search, we remap it immediately,
even if we have matching entry in next entries in bucket.
This leads to duplication of mappings of the same size,
and to possibility of selecting the wrong element
during invalidation and underflow it's entry->lock counter

Signed-off-by: Aleksandr Partanen <alex.pentagrid@gmail.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
---
 hw/xen/xen-mapcache.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/hw/xen/xen-mapcache.c b/hw/xen/xen-mapcache.c
index 698b5c53ed..2c8f861fdb 100644
--- a/hw/xen/xen-mapcache.c
+++ b/hw/xen/xen-mapcache.c
@@ -376,12 +376,12 @@ tryagain:
 
     entry = &mc->entry[address_index % mc->nr_buckets];
 
-    while (entry && (lock || entry->lock) && entry->vaddr_base &&
-            (entry->paddr_index != address_index || entry->size != cache_size ||
+    while (entry && (!entry->vaddr_base ||
+            entry->paddr_index != address_index || entry->size != cache_size ||
              !test_bits(address_offset >> XC_PAGE_SHIFT,
                  test_bit_size >> XC_PAGE_SHIFT,
                  entry->valid_mapping))) {
-        if (!free_entry && !entry->lock) {
+        if (!free_entry && (!entry->lock || !entry->vaddr_base)) {
             free_entry = entry;
             free_pentry = pentry;
         }

From 88fb705600a3b612c571efc9f1a6aed923a18dcc Mon Sep 17 00:00:00 2001
From: "Edgar E. Iglesias" <edgar.iglesias@amd.com>
Date: Fri, 25 Apr 2025 15:16:01 +0200
Subject: [PATCH 0730/2760] xen: mapcache: Split mapcache_grants by ro and rw
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Today, we don't track write-abiliy in the cache, if a user
requests a readable mapping followed by a writeable mapping
on the same page, the second lookup will incorrectly hit
the readable entry.

Split mapcache_grants by ro and rw access. Grants will now
have separate ways in the cache depending on writeability.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
---
 hw/xen/xen-mapcache.c | 26 +++++++++++++++++++-------
 1 file changed, 19 insertions(+), 7 deletions(-)

diff --git a/hw/xen/xen-mapcache.c b/hw/xen/xen-mapcache.c
index 2c8f861fdb..e31d379702 100644
--- a/hw/xen/xen-mapcache.c
+++ b/hw/xen/xen-mapcache.c
@@ -75,7 +75,8 @@ typedef struct MapCache {
 } MapCache;
 
 static MapCache *mapcache;
-static MapCache *mapcache_grants;
+static MapCache *mapcache_grants_ro;
+static MapCache *mapcache_grants_rw;
 static xengnttab_handle *xen_region_gnttabdev;
 
 static inline void mapcache_lock(MapCache *mc)
@@ -176,9 +177,12 @@ void xen_map_cache_init(phys_offset_to_gaddr_t f, void *opaque)
      * Grant mappings must use XC_PAGE_SIZE granularity since we can't
      * map anything beyond the number of pages granted to us.
      */
-    mapcache_grants = xen_map_cache_init_single(f, opaque,
-                                                XC_PAGE_SHIFT,
-                                                max_mcache_size);
+    mapcache_grants_ro = xen_map_cache_init_single(f, opaque,
+                                                   XC_PAGE_SHIFT,
+                                                   max_mcache_size);
+    mapcache_grants_rw = xen_map_cache_init_single(f, opaque,
+                                                   XC_PAGE_SHIFT,
+                                                   max_mcache_size);
 
     setrlimit(RLIMIT_AS, &rlimit_as);
 }
@@ -456,9 +460,13 @@ uint8_t *xen_map_cache(MemoryRegion *mr,
                        bool is_write)
 {
     bool grant = xen_mr_is_grants(mr);
-    MapCache *mc = grant ? mapcache_grants : mapcache;
+    MapCache *mc = mapcache;
     uint8_t *p;
 
+    if (grant) {
+        mc = is_write ? mapcache_grants_rw : mapcache_grants_ro;
+    }
+
     if (grant && !lock) {
         /*
          * Grants are only supported via address_space_map(). Anything
@@ -523,7 +531,10 @@ ram_addr_t xen_ram_addr_from_mapcache(void *ptr)
 
     addr = xen_ram_addr_from_mapcache_single(mapcache, ptr);
     if (addr == RAM_ADDR_INVALID) {
-        addr = xen_ram_addr_from_mapcache_single(mapcache_grants, ptr);
+        addr = xen_ram_addr_from_mapcache_single(mapcache_grants_ro, ptr);
+    }
+    if (addr == RAM_ADDR_INVALID) {
+        addr = xen_ram_addr_from_mapcache_single(mapcache_grants_rw, ptr);
     }
 
     return addr;
@@ -626,7 +637,8 @@ static void xen_invalidate_map_cache_entry_single(MapCache *mc, uint8_t *buffer)
 static void xen_invalidate_map_cache_entry_all(uint8_t *buffer)
 {
     xen_invalidate_map_cache_entry_single(mapcache, buffer);
-    xen_invalidate_map_cache_entry_single(mapcache_grants, buffer);
+    xen_invalidate_map_cache_entry_single(mapcache_grants_ro, buffer);
+    xen_invalidate_map_cache_entry_single(mapcache_grants_rw, buffer);
 }
 
 static void xen_invalidate_map_cache_entry_bh(void *opaque)

From 9b23bf5024b5c7d91cfe9233f71859208f4ffa94 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 31 Mar 2025 16:42:28 -0700
Subject: [PATCH 0731/2760] bsd-user: add option to enable plugins
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Nothing prevent plugins to be enabled on this platform for user
binaries, only the option in the driver is missing.

Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250331234228.3475706-1-pierrick.bouvier@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 bsd-user/main.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/bsd-user/main.c b/bsd-user/main.c
index 603fc80ba7..7c0a059c3b 100644
--- a/bsd-user/main.c
+++ b/bsd-user/main.c
@@ -175,6 +175,9 @@ static void usage(void)
            "-strace           log system calls\n"
            "-trace            [[enable=]<pattern>][,events=<file>][,file=<file>]\n"
            "                  specify tracing options\n"
+#ifdef CONFIG_PLUGIN
+           "-plugin           [file=]<file>[,<argname>=<argvalue>]\n"
+#endif
            "\n"
            "Environment variables:\n"
            "QEMU_STRACE       Print system calls and arguments similar to the\n"
@@ -225,6 +228,8 @@ static void init_task_state(TaskState *ts)
     };
 }
 
+static QemuPluginList plugins = QTAILQ_HEAD_INITIALIZER(plugins);
+
 void gemu_log(const char *fmt, ...)
 {
     va_list ap;
@@ -307,6 +312,7 @@ int main(int argc, char **argv)
     cpu_model = NULL;
 
     qemu_add_opts(&qemu_trace_opts);
+    qemu_plugin_add_opts();
 
     optind = 1;
     for (;;) {
@@ -399,6 +405,11 @@ int main(int argc, char **argv)
             do_strace = 1;
         } else if (!strcmp(r, "trace")) {
             trace_opt_parse(optarg);
+#ifdef CONFIG_PLUGIN
+        } else if (!strcmp(r, "plugin")) {
+            r = argv[optind++];
+            qemu_plugin_opt_parse(r, &plugins);
+#endif
         } else if (!strcmp(r, "0")) {
             argv0 = argv[optind++];
         } else {
@@ -433,6 +444,7 @@ int main(int argc, char **argv)
         exit(1);
     }
     trace_init_file();
+    qemu_plugin_load_list(&plugins, &error_fatal);
 
     /* Zero out regs */
     memset(regs, 0, sizeof(struct target_pt_regs));

From 67ce2866a76935cdea39f03e282844e3c4559f12 Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Mon, 3 Mar 2025 13:09:57 -0800
Subject: [PATCH 0732/2760] qom: Factor qom_resolve_path() out
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Factor out a helper to resolve the user's path and print error messages.
No functional change.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <1741036202-265696-2-git-send-email-steven.sistare@oracle.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 qom/qom-qmp-cmds.c | 21 +++++++++++++++------
 1 file changed, 15 insertions(+), 6 deletions(-)

diff --git a/qom/qom-qmp-cmds.c b/qom/qom-qmp-cmds.c
index e866547618..293755f409 100644
--- a/qom/qom-qmp-cmds.c
+++ b/qom/qom-qmp-cmds.c
@@ -28,15 +28,11 @@
 #include "qom/object_interfaces.h"
 #include "qom/qom-qobject.h"
 
-ObjectPropertyInfoList *qmp_qom_list(const char *path, Error **errp)
+static Object *qom_resolve_path(const char *path, Error **errp)
 {
-    Object *obj;
     bool ambiguous = false;
-    ObjectPropertyInfoList *props = NULL;
-    ObjectProperty *prop;
-    ObjectPropertyIterator iter;
+    Object *obj = object_resolve_path(path, &ambiguous);
 
-    obj = object_resolve_path(path, &ambiguous);
     if (obj == NULL) {
         if (ambiguous) {
             error_setg(errp, "Path '%s' is ambiguous", path);
@@ -44,6 +40,19 @@ ObjectPropertyInfoList *qmp_qom_list(const char *path, Error **errp)
             error_set(errp, ERROR_CLASS_DEVICE_NOT_FOUND,
                       "Device '%s' not found", path);
         }
+    }
+    return obj;
+}
+
+ObjectPropertyInfoList *qmp_qom_list(const char *path, Error **errp)
+{
+    Object *obj;
+    ObjectPropertyInfoList *props = NULL;
+    ObjectProperty *prop;
+    ObjectPropertyIterator iter;
+
+    obj = qom_resolve_path(path, errp);
+    if (obj == NULL) {
         return NULL;
     }
 

From dd54fc2a6b95e067bc4c3a139a0169114dba594a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 29 Apr 2025 10:42:26 +0200
Subject: [PATCH 0733/2760] target/migration: Inline VMSTATE_CPU()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

VMSTATE_CPU() is only used in 4 places and doesn't provide
much, directly inline it using VMSTATE_STRUCT().

This removes the last COMPILING_PER_TARGET in "hw/core/cpu.h".

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Acked-by: Peter Xu <peterx@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250429085148.11876-1-philmd@linaro.org>
---
 include/hw/core/cpu.h       | 12 ------------
 target/alpha/machine.c      |  2 +-
 target/hppa/machine.c       |  2 +-
 target/microblaze/machine.c |  2 +-
 target/openrisc/machine.c   |  2 +-
 5 files changed, 4 insertions(+), 16 deletions(-)

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index 12b2ff1f7d..1e87f7d393 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -1121,20 +1121,8 @@ bool cpu_exec_realizefn(CPUState *cpu, Error **errp);
 void cpu_exec_unrealizefn(CPUState *cpu);
 void cpu_exec_reset_hold(CPUState *cpu);
 
-#ifdef COMPILING_PER_TARGET
-
 extern const VMStateDescription vmstate_cpu_common;
 
-#define VMSTATE_CPU() {                                                     \
-    .name = "parent_obj",                                                   \
-    .size = sizeof(CPUState),                                               \
-    .vmsd = &vmstate_cpu_common,                                            \
-    .flags = VMS_STRUCT,                                                    \
-    .offset = 0,                                                            \
-}
-
-#endif /* COMPILING_PER_TARGET */
-
 #define UNASSIGNED_CPU_INDEX -1
 #define UNASSIGNED_CLUSTER_INDEX -1
 
diff --git a/target/alpha/machine.c b/target/alpha/machine.c
index f09834f635..5f302b166d 100644
--- a/target/alpha/machine.c
+++ b/target/alpha/machine.c
@@ -74,7 +74,7 @@ static const VMStateDescription vmstate_env = {
 };
 
 static const VMStateField vmstate_cpu_fields[] = {
-    VMSTATE_CPU(),
+    VMSTATE_STRUCT(parent_obj, AlphaCPU, 0, vmstate_cpu_common, CPUState),
     VMSTATE_STRUCT(env, AlphaCPU, 1, vmstate_env, CPUAlphaState),
     VMSTATE_END_OF_LIST()
 };
diff --git a/target/hppa/machine.c b/target/hppa/machine.c
index bb47a2e689..13e555151a 100644
--- a/target/hppa/machine.c
+++ b/target/hppa/machine.c
@@ -216,7 +216,7 @@ static const VMStateDescription vmstate_env = {
 };
 
 static const VMStateField vmstate_cpu_fields[] = {
-    VMSTATE_CPU(),
+    VMSTATE_STRUCT(parent_obj, HPPACPU, 0, vmstate_cpu_common, CPUState),
     VMSTATE_STRUCT(env, HPPACPU, 1, vmstate_env, CPUHPPAState),
     VMSTATE_END_OF_LIST()
 };
diff --git a/target/microblaze/machine.c b/target/microblaze/machine.c
index 51705e4f5c..a4cf38dc89 100644
--- a/target/microblaze/machine.c
+++ b/target/microblaze/machine.c
@@ -93,7 +93,7 @@ static const VMStateDescription vmstate_env = {
 };
 
 static const VMStateField vmstate_cpu_fields[] = {
-    VMSTATE_CPU(),
+    VMSTATE_STRUCT(parent_obj, MicroBlazeCPU, 0, vmstate_cpu_common, CPUState),
     VMSTATE_STRUCT(env, MicroBlazeCPU, 1, vmstate_env, CPUMBState),
     VMSTATE_END_OF_LIST()
 };
diff --git a/target/openrisc/machine.c b/target/openrisc/machine.c
index 3574e571cb..081c706d02 100644
--- a/target/openrisc/machine.c
+++ b/target/openrisc/machine.c
@@ -136,7 +136,7 @@ const VMStateDescription vmstate_openrisc_cpu = {
     .minimum_version_id = 1,
     .post_load = cpu_post_load,
     .fields = (const VMStateField[]) {
-        VMSTATE_CPU(),
+        VMSTATE_STRUCT(parent_obj, OpenRISCCPU, 0, vmstate_cpu_common, CPUState),
         VMSTATE_STRUCT(env, OpenRISCCPU, 1, vmstate_env, CPUOpenRISCState),
         VMSTATE_END_OF_LIST()
     }

From b3b3ad22c8d2e408511a08562f4277e36dedd5d8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 7 May 2025 22:35:37 +0200
Subject: [PATCH 0734/2760] accel/hvf: Include missing 'hw/core/cpu.h' header
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since commit d5bd8d8267e ("hvf: only update sysreg from owning
thread") hvf-all.c accesses the run_on_cpu_data type and calls
run_on_cpu(), both defined in the "hw/core/cpu.h" header.
Fortunately, it is indirectly included via:

  "system/hvf.h"
    -> "target/arm/cpu.h"
         -> "target/arm/cpu-qom.h"
              -> "hw/core/cpu.h"

"system/hvf.h" however doesn't need "target/arm/cpu.h" and we
want to remove it there. In order to do that we first need to
include it in hvf-all.c, otherwise we get:

  ../accel/hvf/hvf-all.c:61:54: error: unknown type name 'run_on_cpu_data'
   61 | static void do_hvf_update_guest_debug(CPUState *cpu, run_on_cpu_data arg)
      |                                                      ^
  ../accel/hvf/hvf-all.c:68:5: error: call to undeclared function 'run_on_cpu'
   68 |     run_on_cpu(cpu, do_hvf_update_guest_debug, RUN_ON_CPU_NULL);
      |     ^
  ../accel/hvf/hvf-all.c:68:48: error: use of undeclared identifier 'RUN_ON_CPU_NULL'
   68 |     run_on_cpu(cpu, do_hvf_update_guest_debug, RUN_ON_CPU_NULL);
      |                                                ^

Cc: Mads Ynddal <m.ynddal@samsung.com>
Reported-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Mads Ynddal <mads@ynddal.dk>
Message-Id: <20250507204401.45379-1-philmd@linaro.org>
---
 accel/hvf/hvf-all.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/accel/hvf/hvf-all.c b/accel/hvf/hvf-all.c
index 3fc65d6b23..8c387fda24 100644
--- a/accel/hvf/hvf-all.c
+++ b/accel/hvf/hvf-all.c
@@ -12,6 +12,7 @@
 #include "qemu/error-report.h"
 #include "system/hvf.h"
 #include "system/hvf_int.h"
+#include "hw/core/cpu.h"
 
 const char *hvf_return_string(hv_return_t ret)
 {

From 0af34b1daccb08649a5a3c5d2d3843e5efc89ec9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 2 Apr 2025 13:17:28 +0200
Subject: [PATCH 0735/2760] system/hvf: Avoid including 'cpu.h'
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

"system/hvf.h" doesn't need to include a full "cpu.h",
only "exec/vaddr.h" and "qemu/queue.h" are required.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20250403235821.9909-27-philmd@linaro.org>
---
 include/system/hvf.h     | 3 ++-
 include/system/hvf_int.h | 2 ++
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/include/system/hvf.h b/include/system/hvf.h
index 730f927f03..d50049e1a1 100644
--- a/include/system/hvf.h
+++ b/include/system/hvf.h
@@ -14,10 +14,11 @@
 #define HVF_H
 
 #include "qemu/accel.h"
+#include "qemu/queue.h"
+#include "exec/vaddr.h"
 #include "qom/object.h"
 
 #ifdef COMPILING_PER_TARGET
-#include "cpu.h"
 
 #ifdef CONFIG_HVF
 extern bool hvf_allowed;
diff --git a/include/system/hvf_int.h b/include/system/hvf_int.h
index 42ae18433f..8c8b84012d 100644
--- a/include/system/hvf_int.h
+++ b/include/system/hvf_int.h
@@ -11,6 +11,8 @@
 #ifndef HVF_INT_H
 #define HVF_INT_H
 
+#include "qemu/queue.h"
+
 #ifdef __aarch64__
 #include <Hypervisor/Hypervisor.h>
 typedef hv_vcpu_t hvf_vcpuid;

From 962f9f18d29ac8d229e391e4756ca586cb07e8b5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 4 Apr 2025 00:59:48 +0200
Subject: [PATCH 0736/2760] system/hvf: Expose hvf_enabled() to common code
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Currently hvf_enabled() is restricted to target-specific code.
By defining CONFIG_HVF_IS_POSSIBLE we allow its use anywhere.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20250403235821.9909-28-philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 MAINTAINERS             |  1 +
 accel/stubs/hvf-stub.c  | 12 ++++++++++++
 accel/stubs/meson.build |  1 +
 include/system/hvf.h    | 14 +++++++++-----
 4 files changed, 23 insertions(+), 5 deletions(-)
 create mode 100644 accel/stubs/hvf-stub.c

diff --git a/MAINTAINERS b/MAINTAINERS
index 7c2b9e69ad..13f2a52c5e 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -525,6 +525,7 @@ R: Phil Dennis-Jordan <phil@philjordan.eu>
 W: https://wiki.qemu.org/Features/HVF
 S: Maintained
 F: accel/hvf/
+F: accel/stubs/hvf-stub.c
 F: include/system/hvf.h
 F: include/system/hvf_int.h
 
diff --git a/accel/stubs/hvf-stub.c b/accel/stubs/hvf-stub.c
new file mode 100644
index 0000000000..42eadc5ca9
--- /dev/null
+++ b/accel/stubs/hvf-stub.c
@@ -0,0 +1,12 @@
+/*
+ * HVF stubs for QEMU
+ *
+ *  Copyright (c) Linaro
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "system/hvf.h"
+
+bool hvf_allowed;
diff --git a/accel/stubs/meson.build b/accel/stubs/meson.build
index 91a2d21925..8ca1a4529e 100644
--- a/accel/stubs/meson.build
+++ b/accel/stubs/meson.build
@@ -2,5 +2,6 @@ system_stubs_ss = ss.source_set()
 system_stubs_ss.add(when: 'CONFIG_XEN', if_false: files('xen-stub.c'))
 system_stubs_ss.add(when: 'CONFIG_KVM', if_false: files('kvm-stub.c'))
 system_stubs_ss.add(when: 'CONFIG_TCG', if_false: files('tcg-stub.c'))
+system_stubs_ss.add(when: 'CONFIG_HVF', if_false: files('hvf-stub.c'))
 
 specific_ss.add_all(when: ['CONFIG_SYSTEM_ONLY'], if_true: system_stubs_ss)
diff --git a/include/system/hvf.h b/include/system/hvf.h
index d50049e1a1..7b45a2e198 100644
--- a/include/system/hvf.h
+++ b/include/system/hvf.h
@@ -19,15 +19,19 @@
 #include "qom/object.h"
 
 #ifdef COMPILING_PER_TARGET
+# ifdef CONFIG_HVF
+#  define CONFIG_HVF_IS_POSSIBLE
+# endif /* !CONFIG_HVF */
+#else
+# define CONFIG_HVF_IS_POSSIBLE
+#endif /* COMPILING_PER_TARGET */
 
-#ifdef CONFIG_HVF
+#ifdef CONFIG_HVF_IS_POSSIBLE
 extern bool hvf_allowed;
 #define hvf_enabled() (hvf_allowed)
-#else /* !CONFIG_HVF */
+#else /* !CONFIG_HVF_IS_POSSIBLE */
 #define hvf_enabled() 0
-#endif /* !CONFIG_HVF */
-
-#endif /* COMPILING_PER_TARGET */
+#endif /* !CONFIG_HVF_IS_POSSIBLE */
 
 #define TYPE_HVF_ACCEL ACCEL_CLASS_NAME("hvf")
 

From 7d49a5e8bfcaa550211d10476fa14df02bd41bdb Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Thu, 24 Apr 2025 16:28:22 -0700
Subject: [PATCH 0737/2760] hw/hyperv/hv-balloon-stub: common compilation unit
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20250424232829.141163-2-pierrick.bouvier@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/hyperv/meson.build | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/hyperv/meson.build b/hw/hyperv/meson.build
index d3d2668c71..f4aa0a5ada 100644
--- a/hw/hyperv/meson.build
+++ b/hw/hyperv/meson.build
@@ -2,4 +2,5 @@ specific_ss.add(when: 'CONFIG_HYPERV', if_true: files('hyperv.c'))
 specific_ss.add(when: 'CONFIG_HYPERV_TESTDEV', if_true: files('hyperv_testdev.c'))
 specific_ss.add(when: 'CONFIG_VMBUS', if_true: files('vmbus.c'))
 specific_ss.add(when: 'CONFIG_SYNDBG', if_true: files('syndbg.c'))
-specific_ss.add(when: 'CONFIG_HV_BALLOON', if_true: files('hv-balloon.c', 'hv-balloon-page_range_tree.c', 'hv-balloon-our_range_memslots.c'), if_false: files('hv-balloon-stub.c'))
+specific_ss.add(when: 'CONFIG_HV_BALLOON', if_true: files('hv-balloon.c', 'hv-balloon-page_range_tree.c', 'hv-balloon-our_range_memslots.c'))
+system_ss.add(when: 'CONFIG_HV_BALLOON', if_false: files('hv-balloon-stub.c'))

From 690bc5f98ac3117407ce387b09f202eaea8223a6 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Thu, 24 Apr 2025 16:28:23 -0700
Subject: [PATCH 0738/2760] hw/hyperv/hyperv.h: header cleanup
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20250424232829.141163-3-pierrick.bouvier@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 include/hw/hyperv/hyperv.h | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/include/hw/hyperv/hyperv.h b/include/hw/hyperv/hyperv.h
index d717b4e13d..63a8b65278 100644
--- a/include/hw/hyperv/hyperv.h
+++ b/include/hw/hyperv/hyperv.h
@@ -10,7 +10,8 @@
 #ifndef HW_HYPERV_HYPERV_H
 #define HW_HYPERV_HYPERV_H
 
-#include "cpu-qom.h"
+#include "exec/hwaddr.h"
+#include "hw/core/cpu.h"
 #include "hw/hyperv/hyperv-proto.h"
 
 typedef struct HvSintRoute HvSintRoute;

From 4a695643a9e79d56c72c460ab0663303698931a6 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Thu, 24 Apr 2025 16:28:24 -0700
Subject: [PATCH 0739/2760] hw/hyperv/vmbus: common compilation unit
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20250424232829.141163-4-pierrick.bouvier@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/hyperv/meson.build | 2 +-
 hw/hyperv/vmbus.c     | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/hyperv/meson.build b/hw/hyperv/meson.build
index f4aa0a5ada..c855fdcf04 100644
--- a/hw/hyperv/meson.build
+++ b/hw/hyperv/meson.build
@@ -1,6 +1,6 @@
 specific_ss.add(when: 'CONFIG_HYPERV', if_true: files('hyperv.c'))
 specific_ss.add(when: 'CONFIG_HYPERV_TESTDEV', if_true: files('hyperv_testdev.c'))
-specific_ss.add(when: 'CONFIG_VMBUS', if_true: files('vmbus.c'))
+system_ss.add(when: 'CONFIG_VMBUS', if_true: files('vmbus.c'))
 specific_ss.add(when: 'CONFIG_SYNDBG', if_true: files('syndbg.c'))
 specific_ss.add(when: 'CONFIG_HV_BALLOON', if_true: files('hv-balloon.c', 'hv-balloon-page_range_tree.c', 'hv-balloon-our_range_memslots.c'))
 system_ss.add(when: 'CONFIG_HV_BALLOON', if_false: files('hv-balloon-stub.c'))
diff --git a/hw/hyperv/vmbus.c b/hw/hyperv/vmbus.c
index b147ea06d8..961406cdd6 100644
--- a/hw/hyperv/vmbus.c
+++ b/hw/hyperv/vmbus.c
@@ -19,7 +19,7 @@
 #include "hw/hyperv/vmbus.h"
 #include "hw/hyperv/vmbus-bridge.h"
 #include "hw/sysbus.h"
-#include "cpu.h"
+#include "exec/target_page.h"
 #include "trace.h"
 
 enum {

From 3efb9d22622110ca6cae18599169ab6ca2cc1a07 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Thu, 24 Apr 2025 16:28:25 -0700
Subject: [PATCH 0740/2760] hw/hyperv/syndbg: common compilation unit
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We assume that page size is 4KB only, to dimension buffer size for
receiving message.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20250424232829.141163-5-pierrick.bouvier@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/hyperv/meson.build | 2 +-
 hw/hyperv/syndbg.c    | 9 ++++++---
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/hw/hyperv/meson.build b/hw/hyperv/meson.build
index c855fdcf04..a9f2045a9a 100644
--- a/hw/hyperv/meson.build
+++ b/hw/hyperv/meson.build
@@ -1,6 +1,6 @@
 specific_ss.add(when: 'CONFIG_HYPERV', if_true: files('hyperv.c'))
 specific_ss.add(when: 'CONFIG_HYPERV_TESTDEV', if_true: files('hyperv_testdev.c'))
 system_ss.add(when: 'CONFIG_VMBUS', if_true: files('vmbus.c'))
-specific_ss.add(when: 'CONFIG_SYNDBG', if_true: files('syndbg.c'))
+system_ss.add(when: 'CONFIG_SYNDBG', if_true: files('syndbg.c'))
 specific_ss.add(when: 'CONFIG_HV_BALLOON', if_true: files('hv-balloon.c', 'hv-balloon-page_range_tree.c', 'hv-balloon-our_range_memslots.c'))
 system_ss.add(when: 'CONFIG_HV_BALLOON', if_false: files('hv-balloon-stub.c'))
diff --git a/hw/hyperv/syndbg.c b/hw/hyperv/syndbg.c
index ca291826a0..8b8a14750d 100644
--- a/hw/hyperv/syndbg.c
+++ b/hw/hyperv/syndbg.c
@@ -10,11 +10,11 @@
 #include "qemu/error-report.h"
 #include "qemu/main-loop.h"
 #include "qemu/sockets.h"
+#include "qemu/units.h"
 #include "qapi/error.h"
 #include "migration/vmstate.h"
 #include "hw/qdev-properties.h"
 #include "hw/loader.h"
-#include "cpu.h"
 #include "exec/target_page.h"
 #include "hw/hyperv/hyperv.h"
 #include "hw/hyperv/vmbus-bridge.h"
@@ -184,12 +184,15 @@ static bool create_udp_pkt(HvSynDbg *syndbg, void *pkt, uint32_t pkt_len,
     return true;
 }
 
+#define MSG_BUFSZ (4 * KiB)
+
 static uint16_t handle_recv_msg(HvSynDbg *syndbg, uint64_t outgpa,
                                 uint32_t count, bool is_raw, uint32_t options,
                                 uint64_t timeout, uint32_t *retrieved_count)
 {
     uint16_t ret;
-    uint8_t data_buf[TARGET_PAGE_SIZE - UDP_PKT_HEADER_SIZE];
+    g_assert(MSG_BUFSZ >= qemu_target_page_size());
+    uint8_t data_buf[MSG_BUFSZ];
     hwaddr out_len;
     void *out_data;
     ssize_t recv_byte_count;
@@ -202,7 +205,7 @@ static uint16_t handle_recv_msg(HvSynDbg *syndbg, uint64_t outgpa,
         recv_byte_count = 0;
     } else {
         recv_byte_count = recv(syndbg->socket, data_buf,
-                               MIN(sizeof(data_buf), count), MSG_WAITALL);
+                               MIN(MSG_BUFSZ, count), MSG_WAITALL);
         if (recv_byte_count == -1) {
             return HV_STATUS_INVALID_PARAMETER;
         }

From 8def07485b9c08592b59ffe4953477286b9e947c Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Thu, 24 Apr 2025 16:28:26 -0700
Subject: [PATCH 0741/2760] hw/hyperv/balloon: common balloon compilation units
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20250424232829.141163-6-pierrick.bouvier@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/hyperv/meson.build | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/hyperv/meson.build b/hw/hyperv/meson.build
index a9f2045a9a..5acd709bdd 100644
--- a/hw/hyperv/meson.build
+++ b/hw/hyperv/meson.build
@@ -2,5 +2,5 @@ specific_ss.add(when: 'CONFIG_HYPERV', if_true: files('hyperv.c'))
 specific_ss.add(when: 'CONFIG_HYPERV_TESTDEV', if_true: files('hyperv_testdev.c'))
 system_ss.add(when: 'CONFIG_VMBUS', if_true: files('vmbus.c'))
 system_ss.add(when: 'CONFIG_SYNDBG', if_true: files('syndbg.c'))
-specific_ss.add(when: 'CONFIG_HV_BALLOON', if_true: files('hv-balloon.c', 'hv-balloon-page_range_tree.c', 'hv-balloon-our_range_memslots.c'))
+system_ss.add(when: 'CONFIG_HV_BALLOON', if_true: files('hv-balloon.c', 'hv-balloon-page_range_tree.c', 'hv-balloon-our_range_memslots.c'))
 system_ss.add(when: 'CONFIG_HV_BALLOON', if_false: files('hv-balloon-stub.c'))

From b554e754fcf13f0606092abfc1007204316a4ff5 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Thu, 24 Apr 2025 16:28:27 -0700
Subject: [PATCH 0742/2760] hw/hyperv/hyperv_testdev: common compilation unit
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20250424232829.141163-7-pierrick.bouvier@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/hyperv/meson.build | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/hyperv/meson.build b/hw/hyperv/meson.build
index 5acd709bdd..ef5a596c8a 100644
--- a/hw/hyperv/meson.build
+++ b/hw/hyperv/meson.build
@@ -1,5 +1,5 @@
 specific_ss.add(when: 'CONFIG_HYPERV', if_true: files('hyperv.c'))
-specific_ss.add(when: 'CONFIG_HYPERV_TESTDEV', if_true: files('hyperv_testdev.c'))
+system_ss.add(when: 'CONFIG_HYPERV_TESTDEV', if_true: files('hyperv_testdev.c'))
 system_ss.add(when: 'CONFIG_VMBUS', if_true: files('vmbus.c'))
 system_ss.add(when: 'CONFIG_SYNDBG', if_true: files('syndbg.c'))
 system_ss.add(when: 'CONFIG_HV_BALLOON', if_true: files('hv-balloon.c', 'hv-balloon-page_range_tree.c', 'hv-balloon-our_range_memslots.c'))

From 40316f9536cb62a05916ae5eff91e736c468b053 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Thu, 24 Apr 2025 16:28:29 -0700
Subject: [PATCH 0743/2760] hw/hyperv/hyperv: common compilation unit
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250424232829.141163-9-pierrick.bouvier@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/hyperv/hyperv.c    | 3 ++-
 hw/hyperv/meson.build | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/hw/hyperv/hyperv.c b/hw/hyperv/hyperv.c
index 0271cfd271..e4d0688dbf 100644
--- a/hw/hyperv/hyperv.c
+++ b/hw/hyperv/hyperv.c
@@ -13,6 +13,8 @@
 #include "qapi/error.h"
 #include "system/address-spaces.h"
 #include "system/memory.h"
+#include "exec/target_page.h"
+#include "linux/kvm.h"
 #include "system/kvm.h"
 #include "qemu/bitops.h"
 #include "qemu/error-report.h"
@@ -23,7 +25,6 @@
 #include "hw/hyperv/hyperv.h"
 #include "qom/object.h"
 #include "target/i386/kvm/hyperv-proto.h"
-#include "target/i386/cpu.h"
 #include "exec/target_page.h"
 
 struct SynICState {
diff --git a/hw/hyperv/meson.build b/hw/hyperv/meson.build
index ef5a596c8a..d1cf781f04 100644
--- a/hw/hyperv/meson.build
+++ b/hw/hyperv/meson.build
@@ -1,4 +1,4 @@
-specific_ss.add(when: 'CONFIG_HYPERV', if_true: files('hyperv.c'))
+system_ss.add(when: 'CONFIG_HYPERV', if_true: files('hyperv.c'))
 system_ss.add(when: 'CONFIG_HYPERV_TESTDEV', if_true: files('hyperv_testdev.c'))
 system_ss.add(when: 'CONFIG_VMBUS', if_true: files('vmbus.c'))
 system_ss.add(when: 'CONFIG_SYNDBG', if_true: files('syndbg.c'))

From 4c5712eb0a454ab400ef7f29ced424f1fbf86d69 Mon Sep 17 00:00:00 2001
From: Eric Auger <eric.auger@redhat.com>
Date: Mon, 28 Apr 2025 12:25:27 +0200
Subject: [PATCH 0744/2760] hw/pci/pcie_port: Fix pcie_slot_is_hotpluggbale_bus
 typo
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Gustavo Romero <gustavo.romero@linaro.org>
Message-ID: <20250428102628.378046-2-eric.auger@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/pci/pcie_port.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/pci/pcie_port.c b/hw/pci/pcie_port.c
index 54f639e3d4..f3841a2656 100644
--- a/hw/pci/pcie_port.c
+++ b/hw/pci/pcie_port.c
@@ -188,7 +188,7 @@ int pcie_count_ds_ports(PCIBus *bus)
     return dsp_count;
 }
 
-static bool pcie_slot_is_hotpluggbale_bus(HotplugHandler *plug_handler,
+static bool pcie_slot_is_hotpluggable_bus(HotplugHandler *plug_handler,
                                           BusState *bus)
 {
     PCIESlot *s = PCIE_SLOT(bus->parent);
@@ -221,7 +221,7 @@ static void pcie_slot_class_init(ObjectClass *oc, const void *data)
     hc->plug = pcie_cap_slot_plug_cb;
     hc->unplug = pcie_cap_slot_unplug_cb;
     hc->unplug_request = pcie_cap_slot_unplug_request_cb;
-    hc->is_hotpluggable_bus = pcie_slot_is_hotpluggbale_bus;
+    hc->is_hotpluggable_bus = pcie_slot_is_hotpluggable_bus;
 }
 
 static const TypeInfo pcie_slot_type_info = {

From 353ad624f5b2920c98bca0b00d901271d5fd2684 Mon Sep 17 00:00:00 2001
From: Eric Auger <eric.auger@redhat.com>
Date: Mon, 28 Apr 2025 12:25:28 +0200
Subject: [PATCH 0745/2760] hw/acpi/ged: Fix wrong identation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Gustavo Romero <gustavo.romero@linaro.org>
Message-ID: <20250428102628.378046-3-eric.auger@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/acpi/generic_event_device.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/hw/acpi/generic_event_device.c b/hw/acpi/generic_event_device.c
index d8adfea648..7a62f8d5bc 100644
--- a/hw/acpi/generic_event_device.c
+++ b/hw/acpi/generic_event_device.c
@@ -458,11 +458,11 @@ static void acpi_ged_initfn(Object *obj)
      * container for memory hotplug IO and expose it as GED sysbus
      * MMIO so that boards can map it separately.
      */
-     memory_region_init(&s->container_memhp, OBJECT(dev), "memhp container",
-                        MEMORY_HOTPLUG_IO_LEN);
-     sysbus_init_mmio(sbd, &s->container_memhp);
-     acpi_memory_hotplug_init(&s->container_memhp, OBJECT(dev),
-                              &s->memhp_state, 0);
+    memory_region_init(&s->container_memhp, OBJECT(dev), "memhp container",
+                       MEMORY_HOTPLUG_IO_LEN);
+    sysbus_init_mmio(sbd, &s->container_memhp);
+    acpi_memory_hotplug_init(&s->container_memhp, OBJECT(dev),
+                             &s->memhp_state, 0);
 
     memory_region_init_io(&ged_st->regs, obj, &ged_regs_ops, ged_st,
                           TYPE_ACPI_GED "-regs", ACPI_GED_REG_COUNT);

From 43edad68ca5bdbfb4164b46624f3b5ceb2395772 Mon Sep 17 00:00:00 2001
From: Eric Auger <eric.auger@redhat.com>
Date: Mon, 28 Apr 2025 12:25:29 +0200
Subject: [PATCH 0746/2760] hw/i386/acpi-build: Fix
 build_append_notfication_callback typo
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Rename build_append_notfication_callback into
build_append_notification_callback

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Gustavo Romero <gustavo.romero@linaro.org>
Message-ID: <20250428102628.378046-4-eric.auger@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/i386/acpi-build.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
index 3fffa4a332..85c8a8566b 100644
--- a/hw/i386/acpi-build.c
+++ b/hw/i386/acpi-build.c
@@ -589,8 +589,8 @@ void build_append_pci_bus_devices(Aml *parent_scope, PCIBus *bus)
     }
 }
 
-static bool build_append_notfication_callback(Aml *parent_scope,
-                                              const PCIBus *bus)
+static bool build_append_notification_callback(Aml *parent_scope,
+                                               const PCIBus *bus)
 {
     Aml *method;
     PCIBus *sec;
@@ -604,7 +604,7 @@ static bool build_append_notfication_callback(Aml *parent_scope,
             continue;
         }
         nr_notifiers = nr_notifiers +
-                       build_append_notfication_callback(br_scope, sec);
+                       build_append_notification_callback(br_scope, sec);
         /*
          * add new child scope to parent
          * and keep track of bus that have PCNT,
@@ -1773,7 +1773,7 @@ build_dsdt(GArray *table_data, BIOSLinker *linker,
         PCIBus *b = PCI_HOST_BRIDGE(pci_host)->bus;
 
         scope = aml_scope("\\_SB.PCI0");
-        has_pcnt = build_append_notfication_callback(scope, b);
+        has_pcnt = build_append_notification_callback(scope, b);
         if (has_pcnt) {
             aml_append(dsdt, scope);
         }

From dc6da00ed77dce16975b4ca6e521fbebd5f741a5 Mon Sep 17 00:00:00 2001
From: Gustavo Romero <gustavo.romero@linaro.org>
Date: Sun, 4 May 2025 21:56:37 +0000
Subject: [PATCH 0747/2760] hw/i386/acpi-build: Update document reference
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Update the reference for QEMU's ACPI PCI hotplug device interface. Also,
use the possessive form in the comment.

Signed-off-by: Gustavo Romero <gustavo.romero@linaro.org>
Message-ID: <20250504215639.54860-9-gustavo.romero@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/i386/acpi-build.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/i386/acpi-build.h b/hw/i386/acpi-build.h
index 0dce155c8c..275ec058a1 100644
--- a/hw/i386/acpi-build.h
+++ b/hw/i386/acpi-build.h
@@ -5,7 +5,7 @@
 
 extern const struct AcpiGenericAddress x86_nvdimm_acpi_dsmio;
 
-/* PCI Hot-plug registers bases. See docs/spec/acpi_pci_hotplug.txt */
+/* PCI Hot-plug registers' base. See docs/specs/acpi_pci_hotplug.rst */
 #define ACPI_PCIHP_SEJ_BASE 0x8
 #define ACPI_PCIHP_BNMR_BASE 0x10
 

From 35cb01fce6ea8aade77cbc3d7d77c83321bbaf9b Mon Sep 17 00:00:00 2001
From: Gustavo Romero <gustavo.romero@linaro.org>
Date: Sun, 4 May 2025 21:56:35 +0000
Subject: [PATCH 0748/2760] hw/i386/acpi-build: Fix typo and grammar in comment
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fix typo and verb conjugation in a comment about FADT initialization.

Signed-off-by: Gustavo Romero <gustavo.romero@linaro.org>
Message-ID: <20250504215639.54860-7-gustavo.romero@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/i386/acpi-build.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
index 85c8a8566b..f40ad062f9 100644
--- a/hw/i386/acpi-build.c
+++ b/hw/i386/acpi-build.c
@@ -139,7 +139,7 @@ static void init_common_fadt_data(MachineState *ms, Object *o,
     /*
      * "ICH9-LPC" or "PIIX4_PM" has "smm-compat" property to keep the old
      * behavior for compatibility irrelevant to smm_enabled, which doesn't
-     * comforms to ACPI spec.
+     * conform to the ACPI spec.
      */
     bool smm_enabled = object_property_get_bool(o, "smm-compat", NULL) ?
         true : x86_machine_is_smm_enabled(x86ms);

From 54e54e594bc8273d210f7ff4448c165a989cbbe8 Mon Sep 17 00:00:00 2001
From: Bernhard Beschow <shentey@gmail.com>
Date: Wed, 7 May 2025 14:40:40 +0200
Subject: [PATCH 0749/2760] hw/i2c/imx: Always set interrupt status bit if
 interrupt condition occurs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

According to the i.MX 8M Plus reference manual, the status flag
I2C_I2SR[IIF] continues to be set when an interrupt condition
occurs even when I2C interrupts are disabled (I2C_I2CR[IIEN] is
clear). However, the device model only sets the flag when I2C
interrupts are enabled which causes U-Boot to loop forever. Fix
the device model by always setting the flag and let I2C_I2CR[IIEN]
guard I2C interrupts only.

Also remove the comment in the code since it merely stated the
obvious and would be outdated now.

Cc: qemu-stable@nongnu.org
Fixes: 20d0f9cf6a41 ("i.MX: Add I2C controller emulator")
Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Acked-by: Corey Minyard <cminyard@mvista.com>
Message-ID: <20250507124040.425773-1-shentey@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/i2c/imx_i2c.c | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/hw/i2c/imx_i2c.c b/hw/i2c/imx_i2c.c
index 91f84c2ad7..d26177c85d 100644
--- a/hw/i2c/imx_i2c.c
+++ b/hw/i2c/imx_i2c.c
@@ -79,13 +79,12 @@ static void imx_i2c_reset(DeviceState *dev)
 
 static inline void imx_i2c_raise_interrupt(IMXI2CState *s)
 {
-    /*
-     * raise an interrupt if the device is enabled and it is configured
-     * to generate some interrupts.
-     */
-    if (imx_i2c_is_enabled(s) && imx_i2c_interrupt_is_enabled(s)) {
+    if (imx_i2c_is_enabled(s)) {
         s->i2sr |= I2SR_IIF;
-        qemu_irq_raise(s->irq);
+
+        if (imx_i2c_interrupt_is_enabled(s)) {
+            qemu_irq_raise(s->irq);
+        }
     }
 }
 

From b17d69a1dab6dd5acf2646f24866d1ee66983ae0 Mon Sep 17 00:00:00 2001
From: Farhan Ali <alifm@linux.ibm.com>
Date: Wed, 30 Apr 2025 11:50:10 -0700
Subject: [PATCH 0750/2760] util: Add functions for s390x mmio read/write

Starting with z15 (or newer) we can execute mmio
instructions from userspace. On older platforms
where we don't have these instructions available
we can fallback to using system calls to access
the PCI mapped resources.

This patch adds helper functions for mmio reads
and writes for s390x.

Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Farhan Ali <alifm@linux.ibm.com>
Acked-by: Thomas Huth <thuth@redhat.com>
Message-id: 20250430185012.2303-2-alifm@linux.ibm.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 include/qemu/s390x_pci_mmio.h |  24 ++++++
 util/meson.build              |   2 +
 util/s390x_pci_mmio.c         | 146 ++++++++++++++++++++++++++++++++++
 3 files changed, 172 insertions(+)
 create mode 100644 include/qemu/s390x_pci_mmio.h
 create mode 100644 util/s390x_pci_mmio.c

diff --git a/include/qemu/s390x_pci_mmio.h b/include/qemu/s390x_pci_mmio.h
new file mode 100644
index 0000000000..c5f63ecefa
--- /dev/null
+++ b/include/qemu/s390x_pci_mmio.h
@@ -0,0 +1,24 @@
+/*
+ * s390x PCI MMIO definitions
+ *
+ * Copyright 2025 IBM Corp.
+ * Author(s): Farhan Ali <alifm@linux.ibm.com>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+#ifndef S390X_PCI_MMIO_H
+#define S390X_PCI_MMIO_H
+
+#ifdef __s390x__
+uint8_t s390x_pci_mmio_read_8(const void *ioaddr);
+uint16_t s390x_pci_mmio_read_16(const void *ioaddr);
+uint32_t s390x_pci_mmio_read_32(const void *ioaddr);
+uint64_t s390x_pci_mmio_read_64(const void *ioaddr);
+
+void s390x_pci_mmio_write_8(void *ioaddr, uint8_t val);
+void s390x_pci_mmio_write_16(void *ioaddr, uint16_t val);
+void s390x_pci_mmio_write_32(void *ioaddr, uint32_t val);
+void s390x_pci_mmio_write_64(void *ioaddr, uint64_t val);
+#endif /* __s390x__ */
+
+#endif /* S390X_PCI_MMIO_H */
diff --git a/util/meson.build b/util/meson.build
index 780b5977a8..acb21592f9 100644
--- a/util/meson.build
+++ b/util/meson.build
@@ -131,4 +131,6 @@ elif cpu in ['ppc', 'ppc64']
   util_ss.add(files('cpuinfo-ppc.c'))
 elif cpu in ['riscv32', 'riscv64']
   util_ss.add(files('cpuinfo-riscv.c'))
+elif cpu == 's390x'
+  util_ss.add(files('s390x_pci_mmio.c'))
 endif
diff --git a/util/s390x_pci_mmio.c b/util/s390x_pci_mmio.c
new file mode 100644
index 0000000000..5ab24fa474
--- /dev/null
+++ b/util/s390x_pci_mmio.c
@@ -0,0 +1,146 @@
+/*
+ * s390x PCI MMIO definitions
+ *
+ * Copyright 2025 IBM Corp.
+ * Author(s): Farhan Ali <alifm@linux.ibm.com>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include <sys/syscall.h>
+#include "qemu/s390x_pci_mmio.h"
+#include "elf.h"
+
+union register_pair {
+    unsigned __int128 pair;
+    struct {
+        uint64_t even;
+        uint64_t odd;
+    };
+};
+
+static bool is_mio_supported;
+
+static __attribute__((constructor)) void check_is_mio_supported(void)
+{
+    is_mio_supported = !!(qemu_getauxval(AT_HWCAP) & HWCAP_S390_PCI_MIO);
+}
+
+static uint64_t s390x_pcilgi(const void *ioaddr, size_t len)
+{
+    union register_pair ioaddr_len = { .even = (uint64_t)ioaddr,
+                                       .odd = len };
+    uint64_t val;
+    int cc;
+
+    asm volatile(
+        /* pcilgi */
+        ".insn   rre,0xb9d60000,%[val],%[ioaddr_len]\n"
+        "ipm     %[cc]\n"
+        "srl     %[cc],28\n"
+        : [cc] "=d"(cc), [val] "=d"(val),
+        [ioaddr_len] "+d"(ioaddr_len.pair) :: "cc");
+
+    if (cc) {
+        val = -1ULL;
+    }
+
+    return val;
+}
+
+static void s390x_pcistgi(void *ioaddr, uint64_t val, size_t len)
+{
+    union register_pair ioaddr_len = {.even = (uint64_t)ioaddr, .odd = len};
+
+    asm volatile (
+        /* pcistgi */
+        ".insn   rre,0xb9d40000,%[val],%[ioaddr_len]\n"
+        : [ioaddr_len] "+d" (ioaddr_len.pair)
+        : [val] "d" (val)
+        : "cc", "memory");
+}
+
+uint8_t s390x_pci_mmio_read_8(const void *ioaddr)
+{
+    uint8_t val = 0;
+
+    if (is_mio_supported) {
+        val = s390x_pcilgi(ioaddr, sizeof(val));
+    } else {
+        syscall(__NR_s390_pci_mmio_read, ioaddr, &val, sizeof(val));
+    }
+    return val;
+}
+
+uint16_t s390x_pci_mmio_read_16(const void *ioaddr)
+{
+    uint16_t val = 0;
+
+    if (is_mio_supported) {
+        val = s390x_pcilgi(ioaddr, sizeof(val));
+    } else {
+        syscall(__NR_s390_pci_mmio_read, ioaddr, &val, sizeof(val));
+    }
+    return val;
+}
+
+uint32_t s390x_pci_mmio_read_32(const void *ioaddr)
+{
+    uint32_t val = 0;
+
+    if (is_mio_supported) {
+        val = s390x_pcilgi(ioaddr, sizeof(val));
+    } else {
+        syscall(__NR_s390_pci_mmio_read, ioaddr, &val, sizeof(val));
+    }
+    return val;
+}
+
+uint64_t s390x_pci_mmio_read_64(const void *ioaddr)
+{
+    uint64_t val = 0;
+
+    if (is_mio_supported) {
+        val = s390x_pcilgi(ioaddr, sizeof(val));
+    } else {
+        syscall(__NR_s390_pci_mmio_read, ioaddr, &val, sizeof(val));
+    }
+    return val;
+}
+
+void s390x_pci_mmio_write_8(void *ioaddr, uint8_t val)
+{
+    if (is_mio_supported) {
+        s390x_pcistgi(ioaddr, val, sizeof(val));
+    } else {
+        syscall(__NR_s390_pci_mmio_write, ioaddr, &val, sizeof(val));
+    }
+}
+
+void s390x_pci_mmio_write_16(void *ioaddr, uint16_t val)
+{
+    if (is_mio_supported) {
+        s390x_pcistgi(ioaddr, val, sizeof(val));
+    } else {
+        syscall(__NR_s390_pci_mmio_write, ioaddr, &val, sizeof(val));
+    }
+}
+
+void s390x_pci_mmio_write_32(void *ioaddr, uint32_t val)
+{
+    if (is_mio_supported) {
+        s390x_pcistgi(ioaddr, val, sizeof(val));
+    } else {
+        syscall(__NR_s390_pci_mmio_write, ioaddr, &val, sizeof(val));
+    }
+}
+
+void s390x_pci_mmio_write_64(void *ioaddr, uint64_t val)
+{
+    if (is_mio_supported) {
+        s390x_pcistgi(ioaddr, val, sizeof(val));
+    } else {
+        syscall(__NR_s390_pci_mmio_write, ioaddr, &val, sizeof(val));
+    }
+}

From 40f940923f8978ce1ffe8e735cc42ade2e519be3 Mon Sep 17 00:00:00 2001
From: Farhan Ali <alifm@linux.ibm.com>
Date: Wed, 30 Apr 2025 11:50:11 -0700
Subject: [PATCH 0751/2760] include: Add a header to define host PCI MMIO
 functions

Add a generic API for host PCI MMIO reads/writes
(e.g. Linux VFIO BAR accesses). The functions access
little endian memory and returns the result in
host cpu endianness.

Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Farhan Ali <alifm@linux.ibm.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-id: 20250430185012.2303-3-alifm@linux.ibm.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 include/qemu/host-pci-mmio.h | 136 +++++++++++++++++++++++++++++++++++
 1 file changed, 136 insertions(+)
 create mode 100644 include/qemu/host-pci-mmio.h

diff --git a/include/qemu/host-pci-mmio.h b/include/qemu/host-pci-mmio.h
new file mode 100644
index 0000000000..a8ed9938ac
--- /dev/null
+++ b/include/qemu/host-pci-mmio.h
@@ -0,0 +1,136 @@
+/*
+ * API for host PCI MMIO accesses (e.g. Linux VFIO BARs)
+ *
+ * Copyright 2025 IBM Corp.
+ * Author(s): Farhan Ali <alifm@linux.ibm.com>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef HOST_PCI_MMIO_H
+#define HOST_PCI_MMIO_H
+
+#include "qemu/bswap.h"
+#include "qemu/s390x_pci_mmio.h"
+
+static inline uint8_t host_pci_ldub_p(const void *ioaddr)
+{
+    uint8_t ret = 0;
+#ifdef __s390x__
+    ret = s390x_pci_mmio_read_8(ioaddr);
+#else
+    ret = ldub_p(ioaddr);
+#endif
+
+    return ret;
+}
+
+static inline uint16_t host_pci_lduw_le_p(const void *ioaddr)
+{
+    uint16_t ret = 0;
+#ifdef __s390x__
+    ret = le16_to_cpu(s390x_pci_mmio_read_16(ioaddr));
+#else
+    ret = lduw_le_p(ioaddr);
+#endif
+
+    return ret;
+}
+
+static inline uint32_t host_pci_ldl_le_p(const void *ioaddr)
+{
+    uint32_t ret = 0;
+#ifdef __s390x__
+    ret = le32_to_cpu(s390x_pci_mmio_read_32(ioaddr));
+#else
+    ret = ldl_le_p(ioaddr);
+#endif
+
+    return ret;
+}
+
+static inline uint64_t host_pci_ldq_le_p(const void *ioaddr)
+{
+    uint64_t ret = 0;
+#ifdef __s390x__
+    ret = le64_to_cpu(s390x_pci_mmio_read_64(ioaddr));
+#else
+    ret = ldq_le_p(ioaddr);
+#endif
+
+    return ret;
+}
+
+static inline void host_pci_stb_p(void *ioaddr, uint8_t val)
+{
+#ifdef __s390x__
+    s390x_pci_mmio_write_8(ioaddr, val);
+#else
+    stb_p(ioaddr, val);
+#endif
+}
+
+static inline void host_pci_stw_le_p(void *ioaddr, uint16_t val)
+{
+#ifdef __s390x__
+    s390x_pci_mmio_write_16(ioaddr, cpu_to_le16(val));
+#else
+    stw_le_p(ioaddr, val);
+#endif
+}
+
+static inline void host_pci_stl_le_p(void *ioaddr, uint32_t val)
+{
+#ifdef __s390x__
+    s390x_pci_mmio_write_32(ioaddr, cpu_to_le32(val));
+#else
+    stl_le_p(ioaddr, val);
+#endif
+}
+
+static inline void host_pci_stq_le_p(void *ioaddr, uint64_t val)
+{
+#ifdef __s390x__
+    s390x_pci_mmio_write_64(ioaddr, cpu_to_le64(val));
+#else
+    stq_le_p(ioaddr, val);
+#endif
+}
+
+static inline uint64_t host_pci_ldn_le_p(const void *ioaddr, int sz)
+{
+    switch (sz) {
+    case 1:
+        return host_pci_ldub_p(ioaddr);
+    case 2:
+        return host_pci_lduw_le_p(ioaddr);
+    case 4:
+        return host_pci_ldl_le_p(ioaddr);
+    case 8:
+        return host_pci_ldq_le_p(ioaddr);
+    default:
+        g_assert_not_reached();
+    }
+}
+
+static inline void host_pci_stn_le_p(void *ioaddr, int sz, uint64_t v)
+{
+    switch (sz) {
+    case 1:
+        host_pci_stb_p(ioaddr, v);
+        break;
+    case 2:
+        host_pci_stw_le_p(ioaddr, v);
+        break;
+    case 4:
+        host_pci_stl_le_p(ioaddr, v);
+        break;
+    case 8:
+        host_pci_stq_le_p(ioaddr, v);
+        break;
+    default:
+        g_assert_not_reached();
+    }
+}
+
+#endif

From 624379be3a8136db420ec3a3fee36fe91e9f789e Mon Sep 17 00:00:00 2001
From: Farhan Ali <alifm@linux.ibm.com>
Date: Wed, 30 Apr 2025 11:50:12 -0700
Subject: [PATCH 0752/2760] block/nvme: Use host PCI MMIO API
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Use the host PCI MMIO functions to read/write
to NVMe registers, rather than directly accessing
them.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Farhan Ali <alifm@linux.ibm.com>
Message-id: 20250430185012.2303-4-alifm@linux.ibm.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 block/nvme.c | 41 +++++++++++++++++++++++------------------
 1 file changed, 23 insertions(+), 18 deletions(-)

diff --git a/block/nvme.c b/block/nvme.c
index bbf7c23dcd..8df53ee4ca 100644
--- a/block/nvme.c
+++ b/block/nvme.c
@@ -18,6 +18,7 @@
 #include "qobject/qstring.h"
 #include "qemu/defer-call.h"
 #include "qemu/error-report.h"
+#include "qemu/host-pci-mmio.h"
 #include "qemu/main-loop.h"
 #include "qemu/module.h"
 #include "qemu/cutils.h"
@@ -60,7 +61,7 @@ typedef struct {
     uint8_t  *queue;
     uint64_t iova;
     /* Hardware MMIO register */
-    volatile uint32_t *doorbell;
+    uint32_t *doorbell;
 } NVMeQueue;
 
 typedef struct {
@@ -100,7 +101,7 @@ struct BDRVNVMeState {
     QEMUVFIOState *vfio;
     void *bar0_wo_map;
     /* Memory mapped registers */
-    volatile struct {
+    struct {
         uint32_t sq_tail;
         uint32_t cq_head;
     } *doorbells;
@@ -292,7 +293,7 @@ static void nvme_kick(NVMeQueuePair *q)
     assert(!(q->sq.tail & 0xFF00));
     /* Fence the write to submission queue entry before notifying the device. */
     smp_wmb();
-    *q->sq.doorbell = cpu_to_le32(q->sq.tail);
+    host_pci_stl_le_p(q->sq.doorbell, q->sq.tail);
     q->inflight += q->need_kick;
     q->need_kick = 0;
 }
@@ -441,7 +442,7 @@ static bool nvme_process_completion(NVMeQueuePair *q)
     if (progress) {
         /* Notify the device so it can post more completions. */
         smp_mb_release();
-        *q->cq.doorbell = cpu_to_le32(q->cq.head);
+        host_pci_stl_le_p(q->cq.doorbell, q->cq.head);
         nvme_wake_free_req_locked(q);
     }
 
@@ -460,7 +461,7 @@ static void nvme_process_completion_bh(void *opaque)
      * so notify the device that it has space to fill in more completions now.
      */
     smp_mb_release();
-    *q->cq.doorbell = cpu_to_le32(q->cq.head);
+    host_pci_stl_le_p(q->cq.doorbell, q->cq.head);
     nvme_wake_free_req_locked(q);
 
     nvme_process_completion(q);
@@ -749,9 +750,10 @@ static int nvme_init(BlockDriverState *bs, const char *device, int namespace,
     int ret;
     uint64_t cap;
     uint32_t ver;
+    uint32_t cc;
     uint64_t timeout_ms;
     uint64_t deadline, now;
-    volatile NvmeBar *regs = NULL;
+    NvmeBar *regs = NULL;
 
     qemu_co_mutex_init(&s->dma_map_lock);
     qemu_co_queue_init(&s->dma_flush_queue);
@@ -779,7 +781,7 @@ static int nvme_init(BlockDriverState *bs, const char *device, int namespace,
     /* Perform initialize sequence as described in NVMe spec "7.6.1
      * Initialization". */
 
-    cap = le64_to_cpu(regs->cap);
+    cap = host_pci_ldq_le_p(&regs->cap);
     trace_nvme_controller_capability_raw(cap);
     trace_nvme_controller_capability("Maximum Queue Entries Supported",
                                      1 + NVME_CAP_MQES(cap));
@@ -805,16 +807,17 @@ static int nvme_init(BlockDriverState *bs, const char *device, int namespace,
     bs->bl.request_alignment = s->page_size;
     timeout_ms = MIN(500 * NVME_CAP_TO(cap), 30000);
 
-    ver = le32_to_cpu(regs->vs);
+    ver = host_pci_ldl_le_p(&regs->vs);
     trace_nvme_controller_spec_version(extract32(ver, 16, 16),
                                        extract32(ver, 8, 8),
                                        extract32(ver, 0, 8));
 
     /* Reset device to get a clean state. */
-    regs->cc = cpu_to_le32(le32_to_cpu(regs->cc) & 0xFE);
+    cc = host_pci_ldl_le_p(&regs->cc);
+    host_pci_stl_le_p(&regs->cc, cc & 0xFE);
     /* Wait for CSTS.RDY = 0. */
     deadline = qemu_clock_get_ns(QEMU_CLOCK_REALTIME) + timeout_ms * SCALE_MS;
-    while (NVME_CSTS_RDY(le32_to_cpu(regs->csts))) {
+    while (NVME_CSTS_RDY(host_pci_ldl_le_p(&regs->csts))) {
         if (qemu_clock_get_ns(QEMU_CLOCK_REALTIME) > deadline) {
             error_setg(errp, "Timeout while waiting for device to reset (%"
                              PRId64 " ms)",
@@ -843,19 +846,21 @@ static int nvme_init(BlockDriverState *bs, const char *device, int namespace,
     s->queues[INDEX_ADMIN] = q;
     s->queue_count = 1;
     QEMU_BUILD_BUG_ON((NVME_QUEUE_SIZE - 1) & 0xF000);
-    regs->aqa = cpu_to_le32(((NVME_QUEUE_SIZE - 1) << AQA_ACQS_SHIFT) |
-                            ((NVME_QUEUE_SIZE - 1) << AQA_ASQS_SHIFT));
-    regs->asq = cpu_to_le64(q->sq.iova);
-    regs->acq = cpu_to_le64(q->cq.iova);
+    host_pci_stl_le_p(&regs->aqa,
+                        ((NVME_QUEUE_SIZE - 1) << AQA_ACQS_SHIFT) |
+                        ((NVME_QUEUE_SIZE - 1) << AQA_ASQS_SHIFT));
+    host_pci_stq_le_p(&regs->asq, q->sq.iova);
+    host_pci_stq_le_p(&regs->acq, q->cq.iova);
 
     /* After setting up all control registers we can enable device now. */
-    regs->cc = cpu_to_le32((ctz32(NVME_CQ_ENTRY_BYTES) << CC_IOCQES_SHIFT) |
-                           (ctz32(NVME_SQ_ENTRY_BYTES) << CC_IOSQES_SHIFT) |
-                           CC_EN_MASK);
+    host_pci_stl_le_p(&regs->cc,
+                      (ctz32(NVME_CQ_ENTRY_BYTES) << CC_IOCQES_SHIFT) |
+                      (ctz32(NVME_SQ_ENTRY_BYTES) << CC_IOSQES_SHIFT) |
+                      CC_EN_MASK);
     /* Wait for CSTS.RDY = 1. */
     now = qemu_clock_get_ns(QEMU_CLOCK_REALTIME);
     deadline = now + timeout_ms * SCALE_MS;
-    while (!NVME_CSTS_RDY(le32_to_cpu(regs->csts))) {
+    while (!NVME_CSTS_RDY(host_pci_ldl_le_p(&regs->csts))) {
         if (qemu_clock_get_ns(QEMU_CLOCK_REALTIME) > deadline) {
             error_setg(errp, "Timeout while waiting for device to start (%"
                              PRId64 " ms)",

From a97dfb2337665b0017eb27f17849b68be7c31777 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Thu, 8 May 2025 11:51:22 +0200
Subject: [PATCH 0753/2760] tests/qtest/q35-test: Remove the obsolete
 test_without_smram_base test
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

With the release of QEMU 10.1, the pc-q35-4.1 machine will be older
than 6 years and thus will get disabled automatically by the
MACHINE_VER_DELETION() macro. Remove the related test to avoid
that the q35-test is failing when the machine is not available anymore.

Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/qtest/q35-test.c | 37 +------------------------------------
 1 file changed, 1 insertion(+), 36 deletions(-)

diff --git a/tests/qtest/q35-test.c b/tests/qtest/q35-test.c
index 75d4078b79..62fff49fc8 100644
--- a/tests/qtest/q35-test.c
+++ b/tests/qtest/q35-test.c
@@ -246,41 +246,6 @@ static void test_smram_smbase_lock(void)
     qtest_quit(qts);
 }
 
-static void test_without_smram_base(void)
-{
-    QPCIBus *pcibus;
-    QPCIDevice *pcidev;
-    QTestState *qts;
-    int i;
-
-    qts = qtest_init("-M pc-q35-4.1");
-
-    pcibus = qpci_new_pc(qts, NULL);
-    g_assert(pcibus != NULL);
-
-    pcidev = qpci_device_find(pcibus, 0);
-    g_assert(pcidev != NULL);
-
-    /* check that RAM is accessible */
-    qtest_writeb(qts, SMBASE, SMRAM_TEST_PATTERN);
-    g_assert_cmpint(qtest_readb(qts, SMBASE), ==, SMRAM_TEST_PATTERN);
-
-    /* check that writing to 0x9c succeeds */
-    for (i = 0; i <= 0xff; i++) {
-        qpci_config_writeb(pcidev, MCH_HOST_BRIDGE_F_SMBASE, i);
-        g_assert(qpci_config_readb(pcidev, MCH_HOST_BRIDGE_F_SMBASE) == i);
-    }
-
-    /* check that RAM is still accessible */
-    qtest_writeb(qts, SMBASE, SMRAM_TEST_PATTERN + 1);
-    g_assert_cmpint(qtest_readb(qts, SMBASE), ==, (SMRAM_TEST_PATTERN + 1));
-
-    g_free(pcidev);
-    qpci_free_pc(pcibus);
-
-    qtest_quit(qts);
-}
-
 int main(int argc, char **argv)
 {
     g_test_init(&argc, &argv, NULL);
@@ -293,6 +258,6 @@ int main(int argc, char **argv)
     qtest_add_data_func("/q35/tseg-size/ext/16mb", &tseg_ext_16mb,
                         test_tseg_size);
     qtest_add_func("/q35/smram/smbase_lock", test_smram_smbase_lock);
-    qtest_add_func("/q35/smram/legacy_smbase", test_without_smram_base);
+
     return g_test_run();
 }

From 3dfa5a5c71cd67712b301db19ecc96118ceb10a5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 29 Apr 2025 13:17:43 +0100
Subject: [PATCH 0754/2760] Revert "include/hw: temporarily disable deletion of
 versioned machine types"
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This reverts commit c9fd2d9a48ee3c195cf83cc611b87b09f02f0013.

When we introduced the specialized machine type deprecation policy, we
allow automatic deprecation to take effect immediately, but blocked the
automatic deletion of machine types for 2 releases. This ensured we
complied with the historical deprecation policy during the transition
window. Startnig with the 10.1.0 dev cycle, the old machine types would
be candidates for removal under both the old and new deprecation
policies.

Thus we can now enable automatic deletion of old machine types, which
takes effect by skipping the QOM type registration. This prevents the
machine types being listed with '-machine help', and blocks their
creation. The actual code can be purged at a convenient time of the
maintainer's choosing.

In the case of the x86_64 target, this change results in the blocking
of the following machine types:

  pc-i440fx-4.0        Standard PC (i440FX + PIIX, 1996) (deprecated)
  pc-i440fx-3.1        Standard PC (i440FX + PIIX, 1996) (deprecated)
  pc-i440fx-3.0        Standard PC (i440FX + PIIX, 1996) (deprecated)
  pc-i440fx-2.9        Standard PC (i440FX + PIIX, 1996) (deprecated)
  pc-i440fx-2.8        Standard PC (i440FX + PIIX, 1996) (deprecated)
  pc-i440fx-2.7        Standard PC (i440FX + PIIX, 1996) (deprecated)
  pc-i440fx-2.6        Standard PC (i440FX + PIIX, 1996) (deprecated)
  pc-i440fx-2.5        Standard PC (i440FX + PIIX, 1996) (deprecated)
  pc-i440fx-2.4        Standard PC (i440FX + PIIX, 1996) (deprecated)
  pc-i440fx-2.12       Standard PC (i440FX + PIIX, 1996) (deprecated)
  pc-i440fx-2.11       Standard PC (i440FX + PIIX, 1996) (deprecated)
  pc-i440fx-2.10       Standard PC (i440FX + PIIX, 1996) (deprecated)
  pc-q35-4.0.1         Standard PC (Q35 + ICH9, 2009) (deprecated)
  pc-q35-4.0           Standard PC (Q35 + ICH9, 2009) (deprecated)
  pc-q35-3.1           Standard PC (Q35 + ICH9, 2009) (deprecated)
  pc-q35-3.0           Standard PC (Q35 + ICH9, 2009) (deprecated)
  pc-q35-2.9           Standard PC (Q35 + ICH9, 2009) (deprecated)
  pc-q35-2.8           Standard PC (Q35 + ICH9, 2009) (deprecated)
  pc-q35-2.7           Standard PC (Q35 + ICH9, 2009) (deprecated)
  pc-q35-2.6           Standard PC (Q35 + ICH9, 2009) (deprecated)
  pc-q35-2.5           Standard PC (Q35 + ICH9, 2009) (deprecated)
  pc-q35-2.4           Standard PC (Q35 + ICH9, 2009) (deprecated)
  pc-q35-2.12          Standard PC (Q35 + ICH9, 2009) (deprecated)
  pc-q35-2.11          Standard PC (Q35 + ICH9, 2009) (deprecated)
  pc-q35-2.10          Standard PC (Q35 + ICH9, 2009) (deprecated)

Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 include/hw/boards.h | 19 +------------------
 1 file changed, 1 insertion(+), 18 deletions(-)

diff --git a/include/hw/boards.h b/include/hw/boards.h
index 765dc8dd35..74a8e96b2e 100644
--- a/include/hw/boards.h
+++ b/include/hw/boards.h
@@ -719,28 +719,11 @@ struct MachineState {
  * suitable period of time has passed, it will cause
  * execution of the method to return, avoiding registration
  * of the machine
- *
- * The new deprecation and deletion policy for versioned
- * machine types was introduced in QEMU 9.1.0.
- *
- * Under the new policy a number of old machine types (any
- * prior to 2.12) would be liable for immediate deletion
- * which would be a violation of our historical deprecation
- * and removal policy
- *
- * Thus deletions are temporarily gated on existance of
- * the env variable "QEMU_DELETE_MACHINES" / QEMU version
- * number >= 10.1.0. This gate can be deleted in the 10.1.0
- * dev cycle
  */
 #define MACHINE_VER_DELETION(...) \
     do { \
         if (MACHINE_VER_SHOULD_DELETE(__VA_ARGS__)) { \
-            if (getenv("QEMU_DELETE_MACHINES") || \
-                QEMU_VERSION_MAJOR > 10 || (QEMU_VERSION_MAJOR == 10 && \
-                                            QEMU_VERSION_MINOR >= 1)) { \
-                return; \
-            } \
+            return; \
         } \
     } while (0)
 

From f59ee044067a2eeff0d53c7e87b8295835ac190a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 25 Feb 2025 19:36:23 +0000
Subject: [PATCH 0755/2760] include/hw/boards: cope with dev/rc versions in
 deprecation checks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When VERSION is set to a development snapshot (micro >= 50), or a release
candidate (micro >= 90) we have an off-by-1 in determining deprecation
and deletion thresholds for versioned machine types. In such cases we need
to use the next major/minor version in threshold checks.

This adapts the deprecation macros to do "next version" prediction when
seeing a dev/rc version number.

This ensures users of release candidates get an accurate view of machines
that will be deprecated/deleted in the final release.

This requires hardcoding our current release policy of 3 releases per
year, with a major bump at the start of each year, and that dev/rc
versions have micro >= 50.

Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 include/hw/boards.h | 33 ++++++++++++++++++++++++++++++++-
 1 file changed, 32 insertions(+), 1 deletion(-)

diff --git a/include/hw/boards.h b/include/hw/boards.h
index 74a8e96b2e..a6784fe984 100644
--- a/include/hw/boards.h
+++ b/include/hw/boards.h
@@ -650,11 +650,42 @@ struct MachineState {
     " years old are subject to deletion after " \
     stringify(MACHINE_VER_DELETION_MAJOR) " years"
 
-#define _MACHINE_VER_IS_EXPIRED_IMPL(cutoff, major, minor) \
+#define _MACHINE_VER_IS_CURRENT_EXPIRED(cutoff, major, minor) \
     (((QEMU_VERSION_MAJOR - major) > cutoff) || \
      (((QEMU_VERSION_MAJOR - major) == cutoff) && \
       (QEMU_VERSION_MINOR - minor) >= 0))
 
+#define _MACHINE_VER_IS_NEXT_MINOR_EXPIRED(cutoff, major, minor) \
+    (((QEMU_VERSION_MAJOR - major) > cutoff) || \
+     (((QEMU_VERSION_MAJOR - major) == cutoff) && \
+      ((QEMU_VERSION_MINOR + 1) - minor) >= 0))
+
+#define _MACHINE_VER_IS_NEXT_MAJOR_EXPIRED(cutoff, major, minor) \
+    ((((QEMU_VERSION_MAJOR + 1) - major) > cutoff) ||            \
+     ((((QEMU_VERSION_MAJOR + 1) - major) == cutoff) &&          \
+      (0 - minor) >= 0))
+
+/*
+ * - The first check applies to formal releases
+ * - The second check applies to dev snapshots / release candidates
+ *   where the next major version is the same.
+ *   e.g. 9.0.50, 9.1.50, 9.0.90, 9.1.90
+ * - The third check applies to dev snapshots / release candidates
+ *   where the next major version will change.
+ *   e.g. 9.2.50, 9.2.90
+ *
+ * NB: this assumes we do 3 minor releases per year, before bumping major,
+ * and dev snapshots / release candidates are numbered with micro >= 50
+ * If this ever changes the logic below will need modifying....
+ */
+#define _MACHINE_VER_IS_EXPIRED_IMPL(cutoff, major, minor) \
+    ((QEMU_VERSION_MICRO < 50 && \
+      _MACHINE_VER_IS_CURRENT_EXPIRED(cutoff, major, minor)) || \
+     (QEMU_VERSION_MICRO >= 50 && QEMU_VERSION_MINOR < 2 && \
+      _MACHINE_VER_IS_NEXT_MINOR_EXPIRED(cutoff, major, minor)) || \
+     (QEMU_VERSION_MICRO >= 50 && QEMU_VERSION_MINOR == 2 && \
+      _MACHINE_VER_IS_NEXT_MAJOR_EXPIRED(cutoff, major, minor)))
+
 #define _MACHINE_VER_IS_EXPIRED2(cutoff, major, minor) \
     _MACHINE_VER_IS_EXPIRED_IMPL(cutoff, major, minor)
 #define _MACHINE_VER_IS_EXPIRED3(cutoff, major, minor, micro) \

From ae8ac80c50c2d50e3e17cf5ab35083d2da106235 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 25 Feb 2025 19:39:12 +0000
Subject: [PATCH 0756/2760] docs/about/deprecated: auto-generate a note for
 versioned machine types
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We deprecate versioned machine types on a fixed schedule. This allows us
to auto-generate a paragraph in the deprecated.rst document that always
has accurate version info.

Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 docs/about/deprecated.rst |  7 +++++++
 docs/conf.py              | 33 ++++++++++++++++++++++++++++++++-
 2 files changed, 39 insertions(+), 1 deletion(-)

diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst
index 05381441a9..1a1b423030 100644
--- a/docs/about/deprecated.rst
+++ b/docs/about/deprecated.rst
@@ -278,6 +278,13 @@ CPU implementation for a while before removing all support.
 System emulator machines
 ------------------------
 
+Versioned machine types (aarch64, arm, i386, m68k, ppc64, s390x, x86_64)
+''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
+
+In accordance with our versioned machine type deprecation policy, all machine
+types with version |VER_MACHINE_DEPRECATION_VERSION|, or older, have been
+deprecated.
+
 Arm ``virt`` machine ``dtb-kaslr-seed`` property (since 7.1)
 ''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
 
diff --git a/docs/conf.py b/docs/conf.py
index 7b5712e122..60dcf2a541 100644
--- a/docs/conf.py
+++ b/docs/conf.py
@@ -117,6 +117,27 @@ finally:
     else:
         version = release = "unknown version"
 
+bits = version.split(".")
+
+major = int(bits[0])
+minor = int(bits[1])
+micro = int(bits[2])
+
+# Check for a dev snapshot, so we can adjust to next
+# predicted release version.
+#
+# This assumes we do 3 releases per year, so must bump
+# major if minor == 2
+if micro >= 50:
+    micro = 0
+    if minor == 2:
+        major += 1
+        minor = 0
+    else:
+        minor += 1
+
+ver_machine_deprecation_version = "%d.%d.0" % (major - 3, minor)
+
 # The language for content autogenerated by Sphinx. Refer to documentation
 # for a list of supported languages.
 #
@@ -145,7 +166,17 @@ suppress_warnings = ["ref.option"]
 # environment variable is not set is for the benefit of readthedocs
 # style document building; our Makefile always sets the variable.
 confdir = os.getenv('CONFDIR', "/etc/qemu")
-rst_epilog = ".. |CONFDIR| replace:: ``" + confdir + "``\n"
+
+vars = {
+    "CONFDIR": confdir,
+    "VER_MACHINE_DEPRECATION_VERSION": ver_machine_deprecation_version,
+}
+
+rst_epilog = "".join([
+    ".. |" + key + "| replace:: ``" + vars[key] + "``\n"
+    for key in vars.keys()
+])
+
 # We slurp in the defs.rst.inc and literally include it into rst_epilog,
 # because Sphinx's include:: directive doesn't work with absolute paths
 # and there isn't any one single relative path that will work for all

From 83e256c0df7433c05d28b11690323fba7ad9dbf0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 25 Feb 2025 19:39:12 +0000
Subject: [PATCH 0757/2760] docs/about/removed-features: auto-generate a note
 for versioned machine types
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We remove versioned machine types on a fixed schedule. This allows us
to auto-generate a paragraph in the removed-features.rst document that
always has accurate version info.

Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 docs/about/removed-features.rst | 10 ++++++----
 docs/conf.py                    |  2 ++
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/docs/about/removed-features.rst b/docs/about/removed-features.rst
index 790a5e481c..063284d4f8 100644
--- a/docs/about/removed-features.rst
+++ b/docs/about/removed-features.rst
@@ -981,10 +981,12 @@ from Linux in 2021, and is not supported anymore by QEMU either.
 System emulator machines
 ------------------------
 
-Note: Versioned machine types that have been introduced in a QEMU version
-that has initially been released more than 6 years before are considered
-obsolete and will be removed without further notice in this document.
-Please use newer machine types instead.
+Versioned machine types (aarch64, arm, i386, m68k, ppc64, s390x, x86_64)
+''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
+
+In accordance with our versioned machine type deprecation policy, all machine
+types with version |VER_MACHINE_DELETION_VERSION|, or older, have been
+removed.
 
 ``s390-virtio`` (removed in 2.6)
 ''''''''''''''''''''''''''''''''
diff --git a/docs/conf.py b/docs/conf.py
index 60dcf2a541..248ff8cf5d 100644
--- a/docs/conf.py
+++ b/docs/conf.py
@@ -137,6 +137,7 @@ if micro >= 50:
         minor += 1
 
 ver_machine_deprecation_version = "%d.%d.0" % (major - 3, minor)
+ver_machine_deletion_version = "%d.%d.0" % (major - 6, minor)
 
 # The language for content autogenerated by Sphinx. Refer to documentation
 # for a list of supported languages.
@@ -170,6 +171,7 @@ confdir = os.getenv('CONFDIR', "/etc/qemu")
 vars = {
     "CONFDIR": confdir,
     "VER_MACHINE_DEPRECATION_VERSION": ver_machine_deprecation_version,
+    "VER_MACHINE_DELETION_VERSION": ver_machine_deletion_version,
 }
 
 rst_epilog = "".join([

From 3fbb0a1397a9acea523f3c8062df8c6f8032788d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 25 Feb 2025 19:41:16 +0000
Subject: [PATCH 0758/2760] include/hw/boards: add warning about changing
 deprecation logic
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

If we change the deprecation logic in include/hw/boards.h, we must make
a corresponding change to docs/conf.py and docs/about/deprecated.rst.
Add comments to these files as a warning to future maintainers to keep
these files in sync.

Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 docs/conf.py        | 4 ++++
 include/hw/boards.h | 6 +++++-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/docs/conf.py b/docs/conf.py
index 248ff8cf5d..f892a6e1da 100644
--- a/docs/conf.py
+++ b/docs/conf.py
@@ -136,6 +136,10 @@ if micro >= 50:
     else:
         minor += 1
 
+# These thresholds must match the constants
+# MACHINE_VER_DELETION_MAJOR  & MACHINE_VER_DEPRECATION_MAJOR
+# defined in include/hw/boards.h and the introductory text in
+# docs/about/deprecated.rst
 ver_machine_deprecation_version = "%d.%d.0" % (major - 3, minor)
 ver_machine_deletion_version = "%d.%d.0" % (major - 6, minor)
 
diff --git a/include/hw/boards.h b/include/hw/boards.h
index a6784fe984..a7b1fcffae 100644
--- a/include/hw/boards.h
+++ b/include/hw/boards.h
@@ -636,7 +636,11 @@ struct MachineState {
 /*
  * How many years/major releases for each phase
  * of the life cycle. Assumes use of versioning
- * scheme where major is bumped each year
+ * scheme where major is bumped each year.
+ *
+ * These values must match the ver_machine_deprecation_version
+ * and ver_machine_deletion_version logic in docs/conf.py and
+ * the text in docs/about/deprecated.rst
  */
 #define MACHINE_VER_DELETION_MAJOR 6
 #define MACHINE_VER_DEPRECATION_MAJOR 3

From 4b1f5b73e060971c434e70694d571adfee553027 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Thu, 8 May 2025 20:09:18 +0200
Subject: [PATCH 0759/2760] tests/functional: Use -no-shutdown in the
 hppa_seabios test
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

qemu-system-hppa shuts down automatically when the BIOS is
unable to boot from any device. So this test currently fails
occasionally when QEMU already quit, but the test still
expected it to be around (e.g. to shut it down cleanly).
Adding a "-no-shutdown" seems to make it reliable.
While we're at it, also remove the stray "self.machine" in
there that does not have any purpose.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-id: 20250508180918.228757-1-thuth@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 tests/functional/test_hppa_seabios.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/functional/test_hppa_seabios.py b/tests/functional/test_hppa_seabios.py
index a44d1a3eeb..661b2464e1 100755
--- a/tests/functional/test_hppa_seabios.py
+++ b/tests/functional/test_hppa_seabios.py
@@ -17,9 +17,9 @@ class HppaSeabios(QemuSystemTest):
     def boot_seabios(self):
         mach = self.machine
         bits = self.MACH_BITS[mach]
+        self.vm.add_args('-no-shutdown')
         self.vm.set_console()
         self.vm.launch()
-        self.machine
         wait_for_console_pattern(self, f'SeaBIOS PA-RISC {bits}-bit Firmware')
         wait_for_console_pattern(self, f'Emulated machine:     HP {mach} ({bits}-bit')
 

From 2cc3643df568c9d274781ef896368fd50514fb3e Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Fri, 2 May 2025 07:22:38 -0700
Subject: [PATCH 0760/2760] vfio/container: ram discard disable helper
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Define a helper to set ram discard disable, generate error messages,
and cleanup on failure.  The second vfio_ram_block_discard_disable
call site now performs VFIO_GROUP_UNSET_CONTAINER immediately on failure,
instead of relying on the close of the container fd to do so in the kernel,
but this is equivalent.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Cedric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/1746195760-101443-2-git-send-email-steven.sistare@oracle.com
[ clg: vfio_attach_discard_disable() -> vfio_container_attach_discard_disable() ]
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/container.c | 48 +++++++++++++++++++++++++--------------------
 1 file changed, 27 insertions(+), 21 deletions(-)

diff --git a/hw/vfio/container.c b/hw/vfio/container.c
index 77ff56b43f..2ea137fb02 100644
--- a/hw/vfio/container.c
+++ b/hw/vfio/container.c
@@ -511,16 +511,10 @@ static bool vfio_legacy_setup(VFIOContainerBase *bcontainer, Error **errp)
     return true;
 }
 
-static bool vfio_container_connect(VFIOGroup *group, AddressSpace *as,
-                                   Error **errp)
+static bool vfio_container_attach_discard_disable(VFIOContainer *container,
+                                            VFIOGroup *group, Error **errp)
 {
-    VFIOContainer *container;
-    VFIOContainerBase *bcontainer;
-    int ret, fd;
-    VFIOAddressSpace *space;
-    VFIOIOMMUClass *vioc;
-
-    space = vfio_address_space_get(as);
+    int ret;
 
     /*
      * VFIO is currently incompatible with discarding of RAM insofar as the
@@ -553,18 +547,32 @@ static bool vfio_container_connect(VFIOGroup *group, AddressSpace *as,
      * details once we know which type of IOMMU we are using.
      */
 
+    ret = vfio_ram_block_discard_disable(container, true);
+    if (ret) {
+        error_setg_errno(errp, -ret, "Cannot set discarding of RAM broken");
+        if (ioctl(group->fd, VFIO_GROUP_UNSET_CONTAINER, &container->fd)) {
+            error_report("vfio: error disconnecting group %d from"
+                         " container", group->groupid);
+        }
+    }
+    return !ret;
+}
+
+static bool vfio_container_connect(VFIOGroup *group, AddressSpace *as,
+                                   Error **errp)
+{
+    VFIOContainer *container;
+    VFIOContainerBase *bcontainer;
+    int ret, fd;
+    VFIOAddressSpace *space;
+    VFIOIOMMUClass *vioc;
+
+    space = vfio_address_space_get(as);
+
     QLIST_FOREACH(bcontainer, &space->containers, next) {
         container = container_of(bcontainer, VFIOContainer, bcontainer);
         if (!ioctl(group->fd, VFIO_GROUP_SET_CONTAINER, &container->fd)) {
-            ret = vfio_ram_block_discard_disable(container, true);
-            if (ret) {
-                error_setg_errno(errp, -ret,
-                                 "Cannot set discarding of RAM broken");
-                if (ioctl(group->fd, VFIO_GROUP_UNSET_CONTAINER,
-                          &container->fd)) {
-                    error_report("vfio: error disconnecting group %d from"
-                                 " container", group->groupid);
-                }
+            if (!vfio_container_attach_discard_disable(container, group, errp)) {
                 return false;
             }
             group->container = container;
@@ -596,9 +604,7 @@ static bool vfio_container_connect(VFIOGroup *group, AddressSpace *as,
         goto free_container_exit;
     }
 
-    ret = vfio_ram_block_discard_disable(container, true);
-    if (ret) {
-        error_setg_errno(errp, -ret, "Cannot set discarding of RAM broken");
+    if (!vfio_container_attach_discard_disable(container, group, errp)) {
         goto unregister_container_exit;
     }
 

From a1f267a7d4d9f60ca013e89ca7562cbb483d7d83 Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Fri, 2 May 2025 07:22:39 -0700
Subject: [PATCH 0761/2760] vfio/container: reform vfio_container_connect
 cleanup
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Replace the proliferation of exit labels in vfio_container_connect with
conditionals for cleaning each piece of state.  No functional change.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Cedric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/1746195760-101443-3-git-send-email-steven.sistare@oracle.com
[ clg: vfio_attach_discard_disable() -> vfio_container_attach_discard_disable() ]
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/container.c | 60 +++++++++++++++++++++++++--------------------
 1 file changed, 33 insertions(+), 27 deletions(-)

diff --git a/hw/vfio/container.c b/hw/vfio/container.c
index 2ea137fb02..4b2864cfa8 100644
--- a/hw/vfio/container.c
+++ b/hw/vfio/container.c
@@ -563,9 +563,12 @@ static bool vfio_container_connect(VFIOGroup *group, AddressSpace *as,
 {
     VFIOContainer *container;
     VFIOContainerBase *bcontainer;
-    int ret, fd;
+    int ret, fd = -1;
     VFIOAddressSpace *space;
-    VFIOIOMMUClass *vioc;
+    VFIOIOMMUClass *vioc = NULL;
+    bool new_container = false;
+    bool group_was_added = false;
+    bool discard_disabled = false;
 
     space = vfio_address_space_get(as);
 
@@ -584,35 +587,37 @@ static bool vfio_container_connect(VFIOGroup *group, AddressSpace *as,
 
     fd = qemu_open("/dev/vfio/vfio", O_RDWR, errp);
     if (fd < 0) {
-        goto put_space_exit;
+        goto fail;
     }
 
     ret = ioctl(fd, VFIO_GET_API_VERSION);
     if (ret != VFIO_API_VERSION) {
         error_setg(errp, "supported vfio version: %d, "
                    "reported version: %d", VFIO_API_VERSION, ret);
-        goto close_fd_exit;
+        goto fail;
     }
 
     container = vfio_create_container(fd, group, errp);
     if (!container) {
-        goto close_fd_exit;
+        goto fail;
     }
+    new_container = true;
     bcontainer = &container->bcontainer;
 
     if (!vfio_cpr_register_container(bcontainer, errp)) {
-        goto free_container_exit;
+        goto fail;
     }
 
     if (!vfio_container_attach_discard_disable(container, group, errp)) {
-        goto unregister_container_exit;
+        goto fail;
     }
+    discard_disabled = true;
 
     vioc = VFIO_IOMMU_GET_CLASS(bcontainer);
     assert(vioc->setup);
 
     if (!vioc->setup(bcontainer, errp)) {
-        goto enable_discards_exit;
+        goto fail;
     }
 
     vfio_group_add_kvm_device(group);
@@ -621,35 +626,36 @@ static bool vfio_container_connect(VFIOGroup *group, AddressSpace *as,
 
     group->container = container;
     QLIST_INSERT_HEAD(&container->group_list, group, container_next);
+    group_was_added = true;
 
     if (!vfio_listener_register(bcontainer, errp)) {
-        goto listener_release_exit;
+        goto fail;
     }
 
     bcontainer->initialized = true;
 
     return true;
-listener_release_exit:
-    QLIST_REMOVE(group, container_next);
-    vfio_group_del_kvm_device(group);
+
+fail:
     vfio_listener_unregister(bcontainer);
-    if (vioc->release) {
+
+    if (group_was_added) {
+        QLIST_REMOVE(group, container_next);
+        vfio_group_del_kvm_device(group);
+    }
+    if (vioc && vioc->release) {
         vioc->release(bcontainer);
     }
-
-enable_discards_exit:
-    vfio_ram_block_discard_disable(container, false);
-
-unregister_container_exit:
-    vfio_cpr_unregister_container(bcontainer);
-
-free_container_exit:
-    object_unref(container);
-
-close_fd_exit:
-    close(fd);
-
-put_space_exit:
+    if (discard_disabled) {
+        vfio_ram_block_discard_disable(container, false);
+    }
+    if (new_container) {
+        vfio_cpr_unregister_container(bcontainer);
+        object_unref(container);
+    }
+    if (fd >= 0) {
+        close(fd);
+    }
     vfio_address_space_put(space);
 
     return false;

From 07f86929e5e1f8506fbdd4c3522c91d74b206ad3 Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Fri, 2 May 2025 07:22:40 -0700
Subject: [PATCH 0762/2760] vfio/container: vfio_container_group_add
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add vfio_container_group_add to de-dup some code.  No functional change.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Cedric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/1746195760-101443-4-git-send-email-steven.sistare@oracle.com
[ clg: vfio_attach_discard_disable() -> vfio_container_attach_discard_disable() ]
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/container.c | 47 ++++++++++++++++++++++++---------------------
 1 file changed, 25 insertions(+), 22 deletions(-)

diff --git a/hw/vfio/container.c b/hw/vfio/container.c
index 4b2864cfa8..a761f0958b 100644
--- a/hw/vfio/container.c
+++ b/hw/vfio/container.c
@@ -558,6 +558,26 @@ static bool vfio_container_attach_discard_disable(VFIOContainer *container,
     return !ret;
 }
 
+static bool vfio_container_group_add(VFIOContainer *container, VFIOGroup *group,
+                                     Error **errp)
+{
+    if (!vfio_container_attach_discard_disable(container, group, errp)) {
+        return false;
+    }
+    group->container = container;
+    QLIST_INSERT_HEAD(&container->group_list, group, container_next);
+    vfio_group_add_kvm_device(group);
+    return true;
+}
+
+static void vfio_container_group_del(VFIOContainer *container, VFIOGroup *group)
+{
+    QLIST_REMOVE(group, container_next);
+    group->container = NULL;
+    vfio_group_del_kvm_device(group);
+    vfio_ram_block_discard_disable(container, false);
+}
+
 static bool vfio_container_connect(VFIOGroup *group, AddressSpace *as,
                                    Error **errp)
 {
@@ -568,20 +588,13 @@ static bool vfio_container_connect(VFIOGroup *group, AddressSpace *as,
     VFIOIOMMUClass *vioc = NULL;
     bool new_container = false;
     bool group_was_added = false;
-    bool discard_disabled = false;
 
     space = vfio_address_space_get(as);
 
     QLIST_FOREACH(bcontainer, &space->containers, next) {
         container = container_of(bcontainer, VFIOContainer, bcontainer);
         if (!ioctl(group->fd, VFIO_GROUP_SET_CONTAINER, &container->fd)) {
-            if (!vfio_container_attach_discard_disable(container, group, errp)) {
-                return false;
-            }
-            group->container = container;
-            QLIST_INSERT_HEAD(&container->group_list, group, container_next);
-            vfio_group_add_kvm_device(group);
-            return true;
+            return vfio_container_group_add(container, group, errp);
         }
     }
 
@@ -608,11 +621,6 @@ static bool vfio_container_connect(VFIOGroup *group, AddressSpace *as,
         goto fail;
     }
 
-    if (!vfio_container_attach_discard_disable(container, group, errp)) {
-        goto fail;
-    }
-    discard_disabled = true;
-
     vioc = VFIO_IOMMU_GET_CLASS(bcontainer);
     assert(vioc->setup);
 
@@ -620,12 +628,11 @@ static bool vfio_container_connect(VFIOGroup *group, AddressSpace *as,
         goto fail;
     }
 
-    vfio_group_add_kvm_device(group);
-
     vfio_address_space_insert(space, bcontainer);
 
-    group->container = container;
-    QLIST_INSERT_HEAD(&container->group_list, group, container_next);
+    if (!vfio_container_group_add(container, group, errp)) {
+        goto fail;
+    }
     group_was_added = true;
 
     if (!vfio_listener_register(bcontainer, errp)) {
@@ -640,15 +647,11 @@ fail:
     vfio_listener_unregister(bcontainer);
 
     if (group_was_added) {
-        QLIST_REMOVE(group, container_next);
-        vfio_group_del_kvm_device(group);
+        vfio_container_group_del(container, group);
     }
     if (vioc && vioc->release) {
         vioc->release(bcontainer);
     }
-    if (discard_disabled) {
-        vfio_ram_block_discard_disable(container, false);
-    }
     if (new_container) {
         vfio_cpr_unregister_container(bcontainer);
         object_unref(container);

From dd69d846046f697863ebbd18f9a3544d36720476 Mon Sep 17 00:00:00 2001
From: Tomita Moeko <tomitamoeko@gmail.com>
Date: Tue, 6 May 2025 01:02:57 +0800
Subject: [PATCH 0763/2760] vfio/igd: Restrict legacy mode to Gen6-9 devices
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Intel only provides legacy VBIOS for IGD up to Gen9, and there is no
CSM support on later devices. Additionally, Seabios can only handle
32-bit BDSM register used until Gen9. Since legacy mode requires VGA
capability, restrict it to Gen6 through Gen9 devices.

Link: https://lore.kernel.org/qemu-devel/20250325172239.27926-1-tomitamoeko@gmail.com/T/
Signed-off-by: Tomita Moeko <tomitamoeko@gmail.com>
Reviewed-by: Corvin Köhne <c.koehne@beckhoff.com>
Reviewed-by: Alex Williamson <alex.williamson@redhat.com>
Tested-by: Alex Williamson <alex.williamson@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250505170305.23622-2-tomitamoeko@gmail.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 docs/igd-assign.txt | 1 +
 hw/vfio/igd.c       | 6 +++++-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/docs/igd-assign.txt b/docs/igd-assign.txt
index 3aed7956d5..95beb76812 100644
--- a/docs/igd-assign.txt
+++ b/docs/igd-assign.txt
@@ -47,6 +47,7 @@ Intel document [1] shows how to dump VBIOS to file. For UEFI Option ROM, see
 
 QEMU also provides a "Legacy" mode that implicitly enables full functionality
 on IGD, it is automatically enabled when
+* IGD generation is 6 to 9 (Sandy Bridge to Comet Lake)
 * Machine type is i440fx
 * IGD is assigned to guest BDF 00:02.0
 * ROM BAR or romfile is present
diff --git a/hw/vfio/igd.c b/hw/vfio/igd.c
index d7e4728fdc..e06484c911 100644
--- a/hw/vfio/igd.c
+++ b/hw/vfio/igd.c
@@ -517,11 +517,13 @@ static bool vfio_pci_igd_config_quirk(VFIOPCIDevice *vdev, Error **errp)
 
     /*
      * For backward compatibility, enable legacy mode when
+     * - Device geneation is 6 to 9 (including both)
      * - Machine type is i440fx (pc_piix)
      * - IGD device is at guest BDF 00:02.0
      * - Not manually disabled by x-igd-legacy-mode=off
      */
     if ((vdev->igd_legacy_mode != ON_OFF_AUTO_OFF) &&
+        (gen >= 6 && gen <= 9) &&
         !strcmp(MACHINE_GET_CLASS(qdev_get_machine())->family, "pc_piix") &&
         (&vdev->pdev == pci_find_device(pci_device_root_bus(&vdev->pdev),
         0, PCI_DEVFN(0x2, 0)))) {
@@ -566,7 +568,9 @@ static bool vfio_pci_igd_config_quirk(VFIOPCIDevice *vdev, Error **errp)
         vdev->features |= VFIO_FEATURE_ENABLE_IGD_LPC;
     } else if (vdev->igd_legacy_mode == ON_OFF_AUTO_ON) {
         error_setg(&err,
-                   "Machine is not i440fx or assigned BDF is not 00:02.0");
+                   "Machine is not i440fx, assigned BDF is not 00:02.0, "
+                   "or device %04x (gen %d) doesn't support legacy mode",
+                   vdev->device_id, gen);
         goto error;
     }
 

From 1d5f84f349d27f1d3ea6a0a6261253269fc1cf68 Mon Sep 17 00:00:00 2001
From: Tomita Moeko <tomitamoeko@gmail.com>
Date: Tue, 6 May 2025 01:02:58 +0800
Subject: [PATCH 0764/2760] vfio/igd: Always emulate ASLS (OpRegion) register
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

ASLS register represents the base address of OpRegion, and it is
programmed with HPA. In IGD passthrough scenario, it needs to be
reprogrammed with GPA by guest firmware. To prevent guest accessing
wrong memory range, ASLS should always be emulated and cleared.

In GVT-g scenario, emulating ASLS is unnecessary as access is handled
by kvmgt backend [1].

[1]: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/drivers/gpu/drm/i915/gvt/cfg_space.c?h=v6.14#n295

Signed-off-by: Tomita Moeko <tomitamoeko@gmail.com>
Reviewed-by: Corvin Köhne <c.koehne@beckhoff.com>
Reviewed-by: Alex Williamson <alex.williamson@redhat.com>
Tested-by: Alex Williamson <alex.williamson@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250505170305.23622-3-tomitamoeko@gmail.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/igd.c | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/hw/vfio/igd.c b/hw/vfio/igd.c
index e06484c911..b1fce76f72 100644
--- a/hw/vfio/igd.c
+++ b/hw/vfio/igd.c
@@ -182,10 +182,6 @@ static bool vfio_pci_igd_opregion_init(VFIOPCIDevice *vdev,
 
     trace_vfio_pci_igd_opregion_enabled(vdev->vbasedev.name);
 
-    pci_set_long(vdev->pdev.config + IGD_ASLS, 0);
-    pci_set_long(vdev->pdev.wmask + IGD_ASLS, ~0);
-    pci_set_long(vdev->emulated_config_bits + IGD_ASLS, ~0);
-
     return true;
 }
 
@@ -584,7 +580,15 @@ static bool vfio_pci_igd_config_quirk(VFIOPCIDevice *vdev, Error **errp)
     if ((vdev->features & VFIO_FEATURE_ENABLE_IGD_LPC) &&
         !vfio_pci_igd_setup_lpc_bridge(vdev, errp)) {
         goto error;
-     }
+    }
+
+    /*
+     * ASLS (OpRegion address) is read-only, emulated
+     * It contains HPA, guest firmware need to reprogram it with GPA.
+     */
+    pci_set_long(vdev->pdev.config + IGD_ASLS, 0);
+    pci_set_long(vdev->pdev.wmask + IGD_ASLS, ~0);
+    pci_set_long(vdev->emulated_config_bits + IGD_ASLS, ~0);
 
     /*
      * Allow user to override dsm size using x-igd-gms option, in multiples of

From c0273e77f2d7aab3312eb557b49332da528ff66b Mon Sep 17 00:00:00 2001
From: Tomita Moeko <tomitamoeko@gmail.com>
Date: Tue, 6 May 2025 01:02:59 +0800
Subject: [PATCH 0765/2760] vfio/igd: Detect IGD device by OpRegion
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

There is currently no straightforward way to distinguish if a Intel
graphics device is IGD or discrete GPU. However, only IGD devices have
OpRegion. Use the presence of VFIO_REGION_SUBTYPE_INTEL_IGD_OPREGION
to identify IGD devices. Still, OpRegion on hotplugged IGD device is
not supported.

Signed-off-by: Tomita Moeko <tomitamoeko@gmail.com>
Reviewed-by: Corvin Köhne <c.koehne@beckhoff.com>
Reviewed-by: Alex Williamson <alex.williamson@redhat.com>
Tested-by: Alex Williamson <alex.williamson@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250505170305.23622-4-tomitamoeko@gmail.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/igd.c | 30 ++++++++++++++++--------------
 1 file changed, 16 insertions(+), 14 deletions(-)

diff --git a/hw/vfio/igd.c b/hw/vfio/igd.c
index b1fce76f72..347253d08c 100644
--- a/hw/vfio/igd.c
+++ b/hw/vfio/igd.c
@@ -185,9 +185,10 @@ static bool vfio_pci_igd_opregion_init(VFIOPCIDevice *vdev,
     return true;
 }
 
-static bool vfio_pci_igd_setup_opregion(VFIOPCIDevice *vdev, Error **errp)
+static bool vfio_pci_igd_opregion_detect(VFIOPCIDevice *vdev,
+                                         struct vfio_region_info **opregion,
+                                         Error **errp)
 {
-    g_autofree struct vfio_region_info *opregion = NULL;
     int ret;
 
     /* Hotplugging is not supported for opregion access */
@@ -198,17 +199,13 @@ static bool vfio_pci_igd_setup_opregion(VFIOPCIDevice *vdev, Error **errp)
 
     ret = vfio_device_get_region_info_type(&vdev->vbasedev,
                     VFIO_REGION_TYPE_PCI_VENDOR_TYPE | PCI_VENDOR_ID_INTEL,
-                    VFIO_REGION_SUBTYPE_INTEL_IGD_OPREGION, &opregion);
+                    VFIO_REGION_SUBTYPE_INTEL_IGD_OPREGION, opregion);
     if (ret) {
         error_setg_errno(errp, -ret,
                          "Device does not supports IGD OpRegion feature");
         return false;
     }
 
-    if (!vfio_pci_igd_opregion_init(vdev, opregion, errp)) {
-        return false;
-    }
-
     return true;
 }
 
@@ -480,6 +477,7 @@ void vfio_probe_igd_bar0_quirk(VFIOPCIDevice *vdev, int nr)
 
 static bool vfio_pci_igd_config_quirk(VFIOPCIDevice *vdev, Error **errp)
 {
+    g_autofree struct vfio_region_info *opregion = NULL;
     int ret, gen;
     uint64_t gms_size;
     uint64_t *bdsm_size;
@@ -487,16 +485,17 @@ static bool vfio_pci_igd_config_quirk(VFIOPCIDevice *vdev, Error **errp)
     bool legacy_mode_enabled = false;
     Error *err = NULL;
 
-    /*
-     * This must be an Intel VGA device at address 00:02.0 for us to even
-     * consider enabling legacy mode.  The vBIOS has dependencies on the
-     * PCI bus address.
-     */
     if (!vfio_pci_is(vdev, PCI_VENDOR_ID_INTEL, PCI_ANY_ID) ||
         !vfio_is_vga(vdev)) {
         return true;
     }
 
+    /* IGD device always comes with OpRegion */
+    if (!vfio_pci_igd_opregion_detect(vdev, &opregion, errp)) {
+        return true;
+    }
+    info_report("OpRegion detected on Intel display %x.", vdev->device_id);
+
     /*
      * IGD is not a standard, they like to change their specs often.  We
      * only attempt to support back to SandBridge and we hope that newer
@@ -572,7 +571,7 @@ static bool vfio_pci_igd_config_quirk(VFIOPCIDevice *vdev, Error **errp)
 
     /* Setup OpRegion access */
     if ((vdev->features & VFIO_FEATURE_ENABLE_IGD_OPREGION) &&
-        !vfio_pci_igd_setup_opregion(vdev, errp)) {
+        !vfio_pci_igd_opregion_init(vdev, opregion, errp)) {
         goto error;
     }
 
@@ -672,8 +671,11 @@ error:
  */
 static bool vfio_pci_kvmgt_config_quirk(VFIOPCIDevice *vdev, Error **errp)
 {
+    g_autofree struct vfio_region_info *opregion = NULL;
+
     if ((vdev->features & VFIO_FEATURE_ENABLE_IGD_OPREGION) &&
-        !vfio_pci_igd_setup_opregion(vdev, errp)) {
+        (!vfio_pci_igd_opregion_detect(vdev, &opregion, errp) ||
+         !vfio_pci_igd_opregion_init(vdev, opregion, errp))) {
         return false;
     }
 

From 2bd33abcf16b50de8e71b1db98186d6fa67f9a39 Mon Sep 17 00:00:00 2001
From: Tomita Moeko <tomitamoeko@gmail.com>
Date: Tue, 6 May 2025 01:03:00 +0800
Subject: [PATCH 0766/2760] vfio/igd: Check vendor and device ID on GVT-g mdev
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Check the vendor and device ID on GVT-g mdev to ensure it is a supported
device [1]. This extra check is required for automatically enabling
OpRegion access later.

Note that Cherryview and Gemini Lake are marked as supported here since
current code cannot distinguish them with other Gen8 and Gen9 devices.
Since mdev cannot be created on these devices, this has no functional
impact.

[1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/drivers/gpu/drm/i915/intel_gvt.c?h=v6.14#n52

Signed-off-by: Tomita Moeko <tomitamoeko@gmail.com>
Reviewed-by: Corvin Köhne <c.koehne@beckhoff.com>
Reviewed-by: Alex Williamson <alex.williamson@redhat.com>
Tested-by: Alex Williamson <alex.williamson@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250505170305.23622-5-tomitamoeko@gmail.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/igd.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/hw/vfio/igd.c b/hw/vfio/igd.c
index 347253d08c..f5dd475028 100644
--- a/hw/vfio/igd.c
+++ b/hw/vfio/igd.c
@@ -672,6 +672,18 @@ error:
 static bool vfio_pci_kvmgt_config_quirk(VFIOPCIDevice *vdev, Error **errp)
 {
     g_autofree struct vfio_region_info *opregion = NULL;
+    int gen;
+
+    if (!vfio_pci_is(vdev, PCI_VENDOR_ID_INTEL, PCI_ANY_ID) ||
+        !vfio_is_vga(vdev)) {
+        return true;
+    }
+
+    /* FIXME: Cherryview is Gen8, but don't support GVT-g */
+    gen = igd_gen(vdev);
+    if (gen != 8 && gen != 9) {
+        return true;
+    }
 
     if ((vdev->features & VFIO_FEATURE_ENABLE_IGD_OPREGION) &&
         (!vfio_pci_igd_opregion_detect(vdev, &opregion, errp) ||

From 106cdbcef4ef1c99c2c66b68f8c3349363fac97b Mon Sep 17 00:00:00 2001
From: Tomita Moeko <tomitamoeko@gmail.com>
Date: Tue, 6 May 2025 01:03:01 +0800
Subject: [PATCH 0767/2760] vfio/igd: Check OpRegion support on GVT-g mdev
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The Intel GVT-g backend `kvmgt` always emulates OpRegion for vGPU,
make sure the OpRegion is present for enabling access to it
automatically later.

Also, hotplugging GVT-g vGPU is now always disallowed regardless of
OpRegion to prevent potential issues. Intel has never claimed support
for GVT-g hotplugging.

Signed-off-by: Tomita Moeko <tomitamoeko@gmail.com>
Reviewed-by: Corvin Köhne <c.koehne@beckhoff.com>
Reviewed-by: Alex Williamson <alex.williamson@redhat.com>
Tested-by: Alex Williamson <alex.williamson@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250505170305.23622-6-tomitamoeko@gmail.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/igd.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/hw/vfio/igd.c b/hw/vfio/igd.c
index f5dd475028..9dec32818c 100644
--- a/hw/vfio/igd.c
+++ b/hw/vfio/igd.c
@@ -685,9 +685,13 @@ static bool vfio_pci_kvmgt_config_quirk(VFIOPCIDevice *vdev, Error **errp)
         return true;
     }
 
+    if (!vfio_pci_igd_opregion_detect(vdev, &opregion, errp)) {
+        /* Should never reach here, KVMGT always emulates OpRegion */
+        return false;
+    }
+
     if ((vdev->features & VFIO_FEATURE_ENABLE_IGD_OPREGION) &&
-        (!vfio_pci_igd_opregion_detect(vdev, &opregion, errp) ||
-         !vfio_pci_igd_opregion_init(vdev, opregion, errp))) {
+        !vfio_pci_igd_opregion_init(vdev, opregion, errp)) {
         return false;
     }
 

From 16cbb43302a228f804c067992f6f61787934f3e9 Mon Sep 17 00:00:00 2001
From: Tomita Moeko <tomitamoeko@gmail.com>
Date: Tue, 6 May 2025 01:03:02 +0800
Subject: [PATCH 0768/2760] vfio/igd: Enable OpRegion by default
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

As the presence of OpRegion is used to detect IGD device now, and
guest driver usually depends on OpRegion to work. Enable OpRegion
on IGD devices by default for out-of-the-box passthrough experience
(except pre-boot display output), especially for libvirt users.

Example of IGD passthrough with libvirt:
<hostdev mode="subsystem" type="pci" managed="yes">
  <source>
    <address domain="0x0000" bus="0x00" slot="0x02" function="0x0"/>
  </source>
  <rom file="/path/to/igd/rom"/>
  <address type="pci" domain="0x0000" bus="0x00" slot="0x02" function="0x0"/>
 </hostdev>

Signed-off-by: Tomita Moeko <tomitamoeko@gmail.com>
Reviewed-by: Corvin Köhne <c.koehne@beckhoff.com>
Reviewed-by: Alex Williamson <alex.williamson@redhat.com>
Tested-by: Alex Williamson <alex.williamson@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250505170305.23622-7-tomitamoeko@gmail.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 docs/igd-assign.txt | 4 ++--
 hw/vfio/pci.c       | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/docs/igd-assign.txt b/docs/igd-assign.txt
index 95beb76812..fc444503ff 100644
--- a/docs/igd-assign.txt
+++ b/docs/igd-assign.txt
@@ -102,7 +102,7 @@ digital formats work well.
 
 Options
 =======
-* x-igd-opregion=[on|*off*]
+* x-igd-opregion=[*on*|off]
   Copy host IGD OpRegion and expose it to guest with fw_cfg
 
 * x-igd-lpc=[on|*off*]
@@ -124,7 +124,7 @@ Examples
 
 * Adding IGD with OpRegion and LPC ID hack, but without VGA ranges
   (For UEFI guests)
-  -device vfio-pci,host=00:02.0,id=hostdev0,addr=2.0,x-igd-legacy-mode=off,x-igd-opregion=on,x-igd-lpc=on,romfile=efi_oprom.rom
+  -device vfio-pci,host=00:02.0,id=hostdev0,addr=2.0,x-igd-legacy-mode=off,x-igd-lpc=on,romfile=efi_oprom.rom
 
 
 Guest firmware
diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index 6908bcc0d3..e1fab21b47 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -3385,7 +3385,7 @@ static const Property vfio_pci_dev_properties[] = {
     DEFINE_PROP_BIT("x-req", VFIOPCIDevice, features,
                     VFIO_FEATURE_ENABLE_REQ_BIT, true),
     DEFINE_PROP_BIT("x-igd-opregion", VFIOPCIDevice, features,
-                    VFIO_FEATURE_ENABLE_IGD_OPREGION_BIT, false),
+                    VFIO_FEATURE_ENABLE_IGD_OPREGION_BIT, true),
     DEFINE_PROP_BIT("x-igd-lpc", VFIOPCIDevice, features,
                     VFIO_FEATURE_ENABLE_IGD_LPC_BIT, false),
     DEFINE_PROP_ON_OFF_AUTO("x-igd-legacy-mode", VFIOPCIDevice,

From 395a1f7941f4e46044c865ea0c39d1eef0eaddc6 Mon Sep 17 00:00:00 2001
From: Tomita Moeko <tomitamoeko@gmail.com>
Date: Tue, 6 May 2025 01:03:03 +0800
Subject: [PATCH 0769/2760] vfio/igd: Allow overriding GMS with 0xf0 to 0xfe on
 Gen9+
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

On Gen9 and later IGD devices, GMS 0xf0 to 0xfe represents 4MB to 60MB
pre-allocated memory size in 4MB increments. Allow users overriding
GMS with these values.

Signed-off-by: Tomita Moeko <tomitamoeko@gmail.com>
Reviewed-by: Corvin Köhne <c.koehne@beckhoff.com>
Reviewed-by: Alex Williamson <alex.williamson@redhat.com>
Tested-by: Alex Williamson <alex.williamson@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250505170305.23622-8-tomitamoeko@gmail.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/igd.c | 59 +++++++++++++++++++++++++++++++++++----------------
 1 file changed, 41 insertions(+), 18 deletions(-)

diff --git a/hw/vfio/igd.c b/hw/vfio/igd.c
index 9dec32818c..8ad9d723e2 100644
--- a/hw/vfio/igd.c
+++ b/hw/vfio/igd.c
@@ -412,6 +412,44 @@ static bool vfio_pci_igd_setup_lpc_bridge(VFIOPCIDevice *vdev, Error **errp)
     return true;
 }
 
+static bool vfio_pci_igd_override_gms(int gen, uint32_t gms, uint32_t *gmch)
+{
+    bool ret = false;
+
+    if (gen == -1) {
+        error_report("x-igd-gms is not supported on this device");
+    } else if (gen < 8) {
+        if (gms <= 0x10) {
+            *gmch &= ~(IGD_GMCH_GEN6_GMS_MASK << IGD_GMCH_GEN6_GMS_SHIFT);
+            *gmch |= gms << IGD_GMCH_GEN6_GMS_SHIFT;
+            ret = true;
+        } else {
+            error_report(QERR_INVALID_PARAMETER_VALUE, "x-igd-gms", "0~0x10");
+        }
+    } else if (gen == 8) {
+        if (gms <= 0x40) {
+            *gmch &= ~(IGD_GMCH_GEN8_GMS_MASK << IGD_GMCH_GEN8_GMS_SHIFT);
+            *gmch |= gms << IGD_GMCH_GEN8_GMS_SHIFT;
+            ret = true;
+        } else {
+            error_report(QERR_INVALID_PARAMETER_VALUE, "x-igd-gms", "0~0x40");
+        }
+    } else {
+        /* 0x0  to 0x40: 32MB increments starting at 0MB */
+        /* 0xf0 to 0xfe: 4MB increments starting at 4MB */
+        if ((gms <= 0x40) || (gms >= 0xf0 && gms <= 0xfe)) {
+            *gmch &= ~(IGD_GMCH_GEN8_GMS_MASK << IGD_GMCH_GEN8_GMS_SHIFT);
+            *gmch |= gms << IGD_GMCH_GEN8_GMS_SHIFT;
+            ret = true;
+        } else {
+            error_report(QERR_INVALID_PARAMETER_VALUE,
+                         "x-igd-gms", "0~0x40 or 0xf0~0xfe");
+        }
+    }
+
+    return ret;
+}
+
 #define IGD_GGC_MMIO_OFFSET     0x108040
 #define IGD_BDSM_MMIO_OFFSET    0x1080C0
 
@@ -594,24 +632,9 @@ static bool vfio_pci_igd_config_quirk(VFIOPCIDevice *vdev, Error **errp)
      * 32MiB. This option should only be used when the desired size cannot be
      * set from DVMT Pre-Allocated option in host BIOS.
      */
-    if (vdev->igd_gms) {
-        if (gen < 8) {
-            if (vdev->igd_gms <= 0x10) {
-                gmch &= ~(IGD_GMCH_GEN6_GMS_MASK << IGD_GMCH_GEN6_GMS_SHIFT);
-                gmch |= vdev->igd_gms << IGD_GMCH_GEN6_GMS_SHIFT;
-            } else {
-                error_report(QERR_INVALID_PARAMETER_VALUE,
-                             "x-igd-gms", "0~0x10");
-            }
-        } else {
-            if (vdev->igd_gms <= 0x40) {
-                gmch &= ~(IGD_GMCH_GEN8_GMS_MASK << IGD_GMCH_GEN8_GMS_SHIFT);
-                gmch |= vdev->igd_gms << IGD_GMCH_GEN8_GMS_SHIFT;
-            } else {
-                error_report(QERR_INVALID_PARAMETER_VALUE,
-                             "x-igd-gms", "0~0x40");
-            }
-        }
+    if (vdev->igd_gms &&
+        !vfio_pci_igd_override_gms(gen, vdev->igd_gms, &gmch)) {
+        return false;
     }
 
     gms_size = igd_stolen_memory_size(gen, gmch);

From 36e4047a9b1c6577f3f09a75abf39f886837cb60 Mon Sep 17 00:00:00 2001
From: Tomita Moeko <tomitamoeko@gmail.com>
Date: Tue, 6 May 2025 01:03:04 +0800
Subject: [PATCH 0770/2760] vfio/igd: Only emulate GGC register when x-igd-gms
 is set
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

x-igd-gms is used for overriding DSM region size in GGC register in
both config space and MMIO BAR0, by default host value is used.
There is no need to emulate it in default case.

Signed-off-by: Tomita Moeko <tomitamoeko@gmail.com>
Reviewed-by: Corvin Köhne <c.koehne@beckhoff.com>
Reviewed-by: Alex Williamson <alex.williamson@redhat.com>
Tested-by: Alex Williamson <alex.williamson@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250505170305.23622-9-tomitamoeko@gmail.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/igd.c | 47 +++++++++++++++++++++++++----------------------
 1 file changed, 25 insertions(+), 22 deletions(-)

diff --git a/hw/vfio/igd.c b/hw/vfio/igd.c
index 8ad9d723e2..886d44f017 100644
--- a/hw/vfio/igd.c
+++ b/hw/vfio/igd.c
@@ -478,22 +478,24 @@ void vfio_probe_igd_bar0_quirk(VFIOPCIDevice *vdev, int nr)
         return;
     }
 
-    ggc_quirk = vfio_quirk_alloc(1);
-    ggc_mirror = ggc_quirk->data = g_malloc0(sizeof(*ggc_mirror));
-    ggc_mirror->mem = ggc_quirk->mem;
-    ggc_mirror->vdev = vdev;
-    ggc_mirror->bar = nr;
-    ggc_mirror->offset = IGD_GGC_MMIO_OFFSET;
-    ggc_mirror->config_offset = IGD_GMCH;
+    if (vdev->igd_gms) {
+        ggc_quirk = vfio_quirk_alloc(1);
+        ggc_mirror = ggc_quirk->data = g_malloc0(sizeof(*ggc_mirror));
+        ggc_mirror->mem = ggc_quirk->mem;
+        ggc_mirror->vdev = vdev;
+        ggc_mirror->bar = nr;
+        ggc_mirror->offset = IGD_GGC_MMIO_OFFSET;
+        ggc_mirror->config_offset = IGD_GMCH;
 
-    memory_region_init_io(ggc_mirror->mem, OBJECT(vdev),
-                          &vfio_generic_mirror_quirk, ggc_mirror,
-                          "vfio-igd-ggc-quirk", 2);
-    memory_region_add_subregion_overlap(vdev->bars[nr].region.mem,
-                                        ggc_mirror->offset, ggc_mirror->mem,
-                                        1);
+        memory_region_init_io(ggc_mirror->mem, OBJECT(vdev),
+                              &vfio_generic_mirror_quirk, ggc_mirror,
+                              "vfio-igd-ggc-quirk", 2);
+        memory_region_add_subregion_overlap(vdev->bars[nr].region.mem,
+                                            ggc_mirror->offset, ggc_mirror->mem,
+                                            1);
 
-    QLIST_INSERT_HEAD(&vdev->bars[nr].quirks, ggc_quirk, next);
+        QLIST_INSERT_HEAD(&vdev->bars[nr].quirks, ggc_quirk, next);
+    }
 
     bdsm_quirk = vfio_quirk_alloc(1);
     bdsm_mirror = bdsm_quirk->data = g_malloc0(sizeof(*bdsm_mirror));
@@ -632,9 +634,15 @@ static bool vfio_pci_igd_config_quirk(VFIOPCIDevice *vdev, Error **errp)
      * 32MiB. This option should only be used when the desired size cannot be
      * set from DVMT Pre-Allocated option in host BIOS.
      */
-    if (vdev->igd_gms &&
-        !vfio_pci_igd_override_gms(gen, vdev->igd_gms, &gmch)) {
-        return false;
+    if (vdev->igd_gms) {
+        if (!vfio_pci_igd_override_gms(gen, vdev->igd_gms, &gmch)) {
+            return false;
+        }
+
+        /* GMCH is read-only, emulated */
+        pci_set_long(vdev->pdev.config + IGD_GMCH, gmch);
+        pci_set_long(vdev->pdev.wmask + IGD_GMCH, 0);
+        pci_set_long(vdev->emulated_config_bits + IGD_GMCH, ~0);
     }
 
     gms_size = igd_stolen_memory_size(gen, gmch);
@@ -652,11 +660,6 @@ static bool vfio_pci_igd_config_quirk(VFIOPCIDevice *vdev, Error **errp)
     fw_cfg_add_file(fw_cfg_find(), "etc/igd-bdsm-size",
                     bdsm_size, sizeof(*bdsm_size));
 
-    /* GMCH is read-only, emulated */
-    pci_set_long(vdev->pdev.config + IGD_GMCH, gmch);
-    pci_set_long(vdev->pdev.wmask + IGD_GMCH, 0);
-    pci_set_long(vdev->emulated_config_bits + IGD_GMCH, ~0);
-
     /* BDSM is read-write, emulated.  The BIOS needs to be able to write it */
     if (gen < 11) {
         pci_set_long(vdev->pdev.config + IGD_BDSM, 0);

From 7969cf4639794e0af84862a269daac72adcfb554 Mon Sep 17 00:00:00 2001
From: Tomita Moeko <tomitamoeko@gmail.com>
Date: Tue, 6 May 2025 01:03:05 +0800
Subject: [PATCH 0771/2760] vfio/igd: Remove generation limitation for IGD
 passthrough
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Starting from Intel Core Ultra Series (Meteor Lake), Data Stolen Memory
has became a part of LMEMBAR (MMIO BAR2) [1][2], meaning that BDSM and
GGC register quirks are no longer needed on these platforms.

To support Meteor/Arrow/Lunar Lake and future IGD devices, remove the
generation limitation in IGD passthrough, and apply BDSM and GGC quirks
only to known Gen6-12 devices.

[1] https://edc.intel.com/content/www/us/en/design/publications/14th-generation-core-processors-cfg-and-mem-registers/d2-f0-processor-graphics-registers/
[2] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/drivers/gpu/drm/i915/gem/i915_gem_stolen.c?h=v6.14#n142

Signed-off-by: Tomita Moeko <tomitamoeko@gmail.com>
Reviewed-by: Corvin Köhne <c.koehne@beckhoff.com>
Reviewed-by: Alex Williamson <alex.williamson@redhat.com>
Tested-by: Alex Williamson <alex.williamson@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250505170305.23622-10-tomitamoeko@gmail.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 docs/igd-assign.txt |  6 +++++
 hw/vfio/igd.c       | 58 ++++++++++++++++-----------------------------
 2 files changed, 27 insertions(+), 37 deletions(-)

diff --git a/docs/igd-assign.txt b/docs/igd-assign.txt
index fc444503ff..af4e8391fc 100644
--- a/docs/igd-assign.txt
+++ b/docs/igd-assign.txt
@@ -157,6 +157,12 @@ fw_cfg requirements on the VM firmware:
    it's expected that this fw_cfg file is only relevant to a single PCI
    class VGA device with Intel vendor ID, appearing at PCI bus address 00:02.0.
 
+   Starting from Meteor Lake, IGD devices access stolen memory via its MMIO
+   BAR2 (LMEMBAR) and removed the BDSM register in config space. There is
+   no need for guest firmware to allocate data stolen memory in guest address
+   space and write it to BDSM register. Value of this fw_cfg file is 0 in
+   such case.
+
 Upstream Seabios has OpRegion and BDSM (pre-Gen11 device only) support.
 However, the support is not accepted by upstream EDK2/OVMF. A recommended
 solution is to create a virtual OpRom with following DXE drivers:
diff --git a/hw/vfio/igd.c b/hw/vfio/igd.c
index 886d44f017..3ee1a73b57 100644
--- a/hw/vfio/igd.c
+++ b/hw/vfio/igd.c
@@ -103,6 +103,7 @@ static int igd_gen(VFIOPCIDevice *vdev)
     /*
      * Unfortunately, Intel changes it's specification quite often. This makes
      * it impossible to use a suitable default value for unknown devices.
+     * Return -1 for not applying any generation-specific quirks.
      */
     return -1;
 }
@@ -459,20 +460,12 @@ void vfio_probe_igd_bar0_quirk(VFIOPCIDevice *vdev, int nr)
     VFIOConfigMirrorQuirk *ggc_mirror, *bdsm_mirror;
     int gen;
 
-    /*
-     * This must be an Intel VGA device at address 00:02.0 for us to even
-     * consider enabling legacy mode. Some driver have dependencies on the PCI
-     * bus address.
-     */
     if (!vfio_pci_is(vdev, PCI_VENDOR_ID_INTEL, PCI_ANY_ID) ||
         !vfio_is_vga(vdev) || nr != 0) {
         return;
     }
 
-    /*
-     * Only on IGD devices of gen 11 and above, the BDSM register is mirrored
-     * into MMIO space and read from MMIO space by the Windows driver.
-     */
+    /* Only on IGD Gen6-12 device needs quirks in BAR 0 */
     gen = igd_gen(vdev);
     if (gen < 6) {
         return;
@@ -519,7 +512,7 @@ static bool vfio_pci_igd_config_quirk(VFIOPCIDevice *vdev, Error **errp)
 {
     g_autofree struct vfio_region_info *opregion = NULL;
     int ret, gen;
-    uint64_t gms_size;
+    uint64_t gms_size = 0;
     uint64_t *bdsm_size;
     uint32_t gmch;
     bool legacy_mode_enabled = false;
@@ -536,18 +529,7 @@ static bool vfio_pci_igd_config_quirk(VFIOPCIDevice *vdev, Error **errp)
     }
     info_report("OpRegion detected on Intel display %x.", vdev->device_id);
 
-    /*
-     * IGD is not a standard, they like to change their specs often.  We
-     * only attempt to support back to SandBridge and we hope that newer
-     * devices maintain compatibility with generation 8.
-     */
     gen = igd_gen(vdev);
-    if (gen == -1) {
-        error_report("IGD device %s is unsupported in legacy mode, "
-                     "try SandyBridge or newer", vdev->vbasedev.name);
-        return true;
-    }
-
     gmch = vfio_pci_read_config(&vdev->pdev, IGD_GMCH, 4);
 
     /*
@@ -645,32 +627,34 @@ static bool vfio_pci_igd_config_quirk(VFIOPCIDevice *vdev, Error **errp)
         pci_set_long(vdev->emulated_config_bits + IGD_GMCH, ~0);
     }
 
-    gms_size = igd_stolen_memory_size(gen, gmch);
+    if (gen > 0) {
+        gms_size = igd_stolen_memory_size(gen, gmch);
+
+        /* BDSM is read-write, emulated. BIOS needs to be able to write it */
+        if (gen < 11) {
+            pci_set_long(vdev->pdev.config + IGD_BDSM, 0);
+            pci_set_long(vdev->pdev.wmask + IGD_BDSM, ~0);
+            pci_set_long(vdev->emulated_config_bits + IGD_BDSM, ~0);
+        } else {
+            pci_set_quad(vdev->pdev.config + IGD_BDSM_GEN11, 0);
+            pci_set_quad(vdev->pdev.wmask + IGD_BDSM_GEN11, ~0);
+            pci_set_quad(vdev->emulated_config_bits + IGD_BDSM_GEN11, ~0);
+        }
+    }
 
     /*
      * Request reserved memory for stolen memory via fw_cfg.  VM firmware
      * must allocate a 1MB aligned reserved memory region below 4GB with
-     * the requested size (in bytes) for use by the Intel PCI class VGA
-     * device at VM address 00:02.0.  The base address of this reserved
-     * memory region must be written to the device BDSM register at PCI
-     * config offset 0x5C.
+     * the requested size (in bytes) for use by the IGD device. The base
+     * address of this reserved memory region must be written to the
+     * device BDSM register.
+     * For newer device without BDSM register, this fw_cfg item is 0.
      */
     bdsm_size = g_malloc(sizeof(*bdsm_size));
     *bdsm_size = cpu_to_le64(gms_size);
     fw_cfg_add_file(fw_cfg_find(), "etc/igd-bdsm-size",
                     bdsm_size, sizeof(*bdsm_size));
 
-    /* BDSM is read-write, emulated.  The BIOS needs to be able to write it */
-    if (gen < 11) {
-        pci_set_long(vdev->pdev.config + IGD_BDSM, 0);
-        pci_set_long(vdev->pdev.wmask + IGD_BDSM, ~0);
-        pci_set_long(vdev->emulated_config_bits + IGD_BDSM, ~0);
-    } else {
-        pci_set_quad(vdev->pdev.config + IGD_BDSM_GEN11, 0);
-        pci_set_quad(vdev->pdev.wmask + IGD_BDSM_GEN11, ~0);
-        pci_set_quad(vdev->emulated_config_bits + IGD_BDSM_GEN11, ~0);
-    }
-
     trace_vfio_pci_igd_bdsm_enabled(vdev->vbasedev.name, (gms_size / MiB));
 
     return true;

From f4df9f261866452a842762b7bad6031d3f5f7c35 Mon Sep 17 00:00:00 2001
From: Rorie Reyes <rreyes@linux.ibm.com>
Date: Fri, 25 Apr 2025 01:23:56 -0400
Subject: [PATCH 0772/2760] linux-header: update-linux-header script changes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Kernel commit 8a141be3233a changed from using
ASSEMBLY to ASSEMBLER
Updated the update-linux-header script to match

Signed-off-by: Rorie Reyes <rreyes@linux.ibm.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250425052401.8287-2-rreyes@linux.ibm.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 scripts/update-linux-headers.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/update-linux-headers.sh b/scripts/update-linux-headers.sh
index 8913e4fb99..b43b8ef75a 100755
--- a/scripts/update-linux-headers.sh
+++ b/scripts/update-linux-headers.sh
@@ -177,7 +177,7 @@ EOF
 
         # Remove everything except the macros from bootparam.h avoiding the
         # unnecessary import of several video/ist/etc headers
-        sed -e '/__ASSEMBLY__/,/__ASSEMBLY__/d' \
+        sed -e '/__ASSEMBLER__/,/__ASSEMBLER__/d' \
                "$hdrdir/include/asm/bootparam.h" > "$hdrdir/bootparam.h"
         cp_portable "$hdrdir/bootparam.h" \
                     "$output/include/standard-headers/asm-$arch"

From 1cab5a02ab8144aad2abd001835e49104e4aae0f Mon Sep 17 00:00:00 2001
From: Rorie Reyes <rreyes@linux.ibm.com>
Date: Fri, 25 Apr 2025 01:23:57 -0400
Subject: [PATCH 0773/2760] linux-headers: Update to Linux v6.15-rc3
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Update headers to retrieve uapi information for vfio-ap

Signed-off-by: Rorie Reyes <rreyes@linux.ibm.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250425052401.8287-3-rreyes@linux.ibm.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 include/standard-headers/asm-x86/setup_data.h |   4 +-
 include/standard-headers/drm/drm_fourcc.h     |  41 ++++++
 include/standard-headers/linux/const.h        |   2 +-
 include/standard-headers/linux/ethtool.h      |  22 +++
 include/standard-headers/linux/fuse.h         |  12 +-
 include/standard-headers/linux/pci_regs.h     |  13 +-
 include/standard-headers/linux/virtio_net.h   |  13 ++
 include/standard-headers/linux/virtio_snd.h   |   2 +-
 linux-headers/asm-arm64/kvm.h                 |  11 ++
 linux-headers/asm-arm64/unistd_64.h           |   1 +
 linux-headers/asm-generic/mman-common.h       |   1 +
 linux-headers/asm-generic/unistd.h            |   4 +-
 linux-headers/asm-loongarch/unistd_64.h       |   1 +
 linux-headers/asm-mips/unistd_n32.h           |   1 +
 linux-headers/asm-mips/unistd_n64.h           |   1 +
 linux-headers/asm-mips/unistd_o32.h           |   1 +
 linux-headers/asm-powerpc/unistd_32.h         |   1 +
 linux-headers/asm-powerpc/unistd_64.h         |   1 +
 linux-headers/asm-riscv/kvm.h                 |   2 +
 linux-headers/asm-riscv/unistd_32.h           |   1 +
 linux-headers/asm-riscv/unistd_64.h           |   1 +
 linux-headers/asm-s390/unistd_32.h            |   1 +
 linux-headers/asm-s390/unistd_64.h            |   1 +
 linux-headers/asm-x86/kvm.h                   |   3 +
 linux-headers/asm-x86/unistd_32.h             |   1 +
 linux-headers/asm-x86/unistd_64.h             |   1 +
 linux-headers/asm-x86/unistd_x32.h            |   1 +
 linux-headers/linux/bits.h                    |   8 +-
 linux-headers/linux/const.h                   |   2 +-
 linux-headers/linux/iommufd.h                 | 129 +++++++++++++++++-
 linux-headers/linux/kvm.h                     |   1 +
 linux-headers/linux/psp-sev.h                 |  21 ++-
 linux-headers/linux/stddef.h                  |   2 +
 linux-headers/linux/vfio.h                    |  30 ++--
 34 files changed, 301 insertions(+), 36 deletions(-)

diff --git a/include/standard-headers/asm-x86/setup_data.h b/include/standard-headers/asm-x86/setup_data.h
index 09355f54c5..a483d72f42 100644
--- a/include/standard-headers/asm-x86/setup_data.h
+++ b/include/standard-headers/asm-x86/setup_data.h
@@ -18,7 +18,7 @@
 #define SETUP_INDIRECT			(1<<31)
 #define SETUP_TYPE_MAX			(SETUP_ENUM_MAX | SETUP_INDIRECT)
 
-#ifndef __ASSEMBLY__
+#ifndef __ASSEMBLER__
 
 #include "standard-headers/linux/types.h"
 
@@ -78,6 +78,6 @@ struct ima_setup_data {
 	uint64_t size;
 } QEMU_PACKED;
 
-#endif /* __ASSEMBLY__ */
+#endif /* __ASSEMBLER__ */
 
 #endif /* _ASM_X86_SETUP_DATA_H */
diff --git a/include/standard-headers/drm/drm_fourcc.h b/include/standard-headers/drm/drm_fourcc.h
index 708647776f..a8b759dcbc 100644
--- a/include/standard-headers/drm/drm_fourcc.h
+++ b/include/standard-headers/drm/drm_fourcc.h
@@ -420,6 +420,7 @@ extern "C" {
 #define DRM_FORMAT_MOD_VENDOR_ARM     0x08
 #define DRM_FORMAT_MOD_VENDOR_ALLWINNER 0x09
 #define DRM_FORMAT_MOD_VENDOR_AMLOGIC 0x0a
+#define DRM_FORMAT_MOD_VENDOR_MTK     0x0b
 
 /* add more to the end as needed */
 
@@ -1452,6 +1453,46 @@ drm_fourcc_canonicalize_nvidia_format_mod(uint64_t modifier)
  */
 #define AMLOGIC_FBC_OPTION_MEM_SAVING		(1ULL << 0)
 
+/* MediaTek modifiers
+ * Bits  Parameter                Notes
+ * ----- ------------------------ ---------------------------------------------
+ *   7: 0 TILE LAYOUT              Values are MTK_FMT_MOD_TILE_*
+ *  15: 8 COMPRESSION              Values are MTK_FMT_MOD_COMPRESS_*
+ *  23:16 10 BIT LAYOUT            Values are MTK_FMT_MOD_10BIT_LAYOUT_*
+ *
+ */
+
+#define DRM_FORMAT_MOD_MTK(__flags)		fourcc_mod_code(MTK, __flags)
+
+/*
+ * MediaTek Tiled Modifier
+ * The lowest 8 bits of the modifier is used to specify the tiling
+ * layout. Only the 16L_32S tiling is used for now, but we define an
+ * "untiled" version and leave room for future expansion.
+ */
+#define MTK_FMT_MOD_TILE_MASK     0xf
+#define MTK_FMT_MOD_TILE_NONE     0x0
+#define MTK_FMT_MOD_TILE_16L32S   0x1
+
+/*
+ * Bits 8-15 specify compression options
+ */
+#define MTK_FMT_MOD_COMPRESS_MASK (0xf << 8)
+#define MTK_FMT_MOD_COMPRESS_NONE (0x0 << 8)
+#define MTK_FMT_MOD_COMPRESS_V1   (0x1 << 8)
+
+/*
+ * Bits 16-23 specify how the bits of 10 bit formats are
+ * stored out in memory
+ */
+#define MTK_FMT_MOD_10BIT_LAYOUT_MASK      (0xf << 16)
+#define MTK_FMT_MOD_10BIT_LAYOUT_PACKED    (0x0 << 16)
+#define MTK_FMT_MOD_10BIT_LAYOUT_LSBTILED  (0x1 << 16)
+#define MTK_FMT_MOD_10BIT_LAYOUT_LSBRASTER (0x2 << 16)
+
+/* alias for the most common tiling format */
+#define DRM_FORMAT_MOD_MTK_16L_32S_TILE  DRM_FORMAT_MOD_MTK(MTK_FMT_MOD_TILE_16L32S)
+
 /*
  * AMD modifiers
  *
diff --git a/include/standard-headers/linux/const.h b/include/standard-headers/linux/const.h
index 2122610de7..95ede23342 100644
--- a/include/standard-headers/linux/const.h
+++ b/include/standard-headers/linux/const.h
@@ -33,7 +33,7 @@
  * Missing __asm__ support
  *
  * __BIT128() would not work in the __asm__ code, as it shifts an
- * 'unsigned __init128' data type as direct representation of
+ * 'unsigned __int128' data type as direct representation of
  * 128 bit constants is not supported in the gcc compiler, as
  * they get silently truncated.
  *
diff --git a/include/standard-headers/linux/ethtool.h b/include/standard-headers/linux/ethtool.h
index e83382531c..5d1ad5fdea 100644
--- a/include/standard-headers/linux/ethtool.h
+++ b/include/standard-headers/linux/ethtool.h
@@ -2059,6 +2059,24 @@ enum ethtool_link_mode_bit_indices {
 	ETHTOOL_LINK_MODE_10baseT1S_Half_BIT		 = 100,
 	ETHTOOL_LINK_MODE_10baseT1S_P2MP_Half_BIT	 = 101,
 	ETHTOOL_LINK_MODE_10baseT1BRR_Full_BIT		 = 102,
+	ETHTOOL_LINK_MODE_200000baseCR_Full_BIT		 = 103,
+	ETHTOOL_LINK_MODE_200000baseKR_Full_BIT		 = 104,
+	ETHTOOL_LINK_MODE_200000baseDR_Full_BIT		 = 105,
+	ETHTOOL_LINK_MODE_200000baseDR_2_Full_BIT	 = 106,
+	ETHTOOL_LINK_MODE_200000baseSR_Full_BIT		 = 107,
+	ETHTOOL_LINK_MODE_200000baseVR_Full_BIT		 = 108,
+	ETHTOOL_LINK_MODE_400000baseCR2_Full_BIT	 = 109,
+	ETHTOOL_LINK_MODE_400000baseKR2_Full_BIT	 = 110,
+	ETHTOOL_LINK_MODE_400000baseDR2_Full_BIT	 = 111,
+	ETHTOOL_LINK_MODE_400000baseDR2_2_Full_BIT	 = 112,
+	ETHTOOL_LINK_MODE_400000baseSR2_Full_BIT	 = 113,
+	ETHTOOL_LINK_MODE_400000baseVR2_Full_BIT	 = 114,
+	ETHTOOL_LINK_MODE_800000baseCR4_Full_BIT	 = 115,
+	ETHTOOL_LINK_MODE_800000baseKR4_Full_BIT	 = 116,
+	ETHTOOL_LINK_MODE_800000baseDR4_Full_BIT	 = 117,
+	ETHTOOL_LINK_MODE_800000baseDR4_2_Full_BIT	 = 118,
+	ETHTOOL_LINK_MODE_800000baseSR4_Full_BIT	 = 119,
+	ETHTOOL_LINK_MODE_800000baseVR4_Full_BIT	 = 120,
 
 	/* must be last entry */
 	__ETHTOOL_LINK_MODE_MASK_NBITS
@@ -2271,6 +2289,10 @@ static inline int ethtool_validate_duplex(uint8_t duplex)
  * be exploited to reduce the RSS queue spread.
  */
 #define	RXH_XFRM_SYM_XOR	(1 << 0)
+/* Similar to SYM_XOR, except that one copy of the XOR'ed fields is replaced by
+ * an OR of the same fields
+ */
+#define	RXH_XFRM_SYM_OR_XOR	(1 << 1)
 #define	RXH_XFRM_NO_CHANGE	0xff
 
 /* L2-L4 network traffic flow types */
diff --git a/include/standard-headers/linux/fuse.h b/include/standard-headers/linux/fuse.h
index d303effb2a..a2b5815d89 100644
--- a/include/standard-headers/linux/fuse.h
+++ b/include/standard-headers/linux/fuse.h
@@ -229,6 +229,9 @@
  *    - FUSE_URING_IN_OUT_HEADER_SZ
  *    - FUSE_URING_OP_IN_OUT_SZ
  *    - enum fuse_uring_cmd
+ *
+ *  7.43
+ *  - add FUSE_REQUEST_TIMEOUT
  */
 
 #ifndef _LINUX_FUSE_H
@@ -260,7 +263,7 @@
 #define FUSE_KERNEL_VERSION 7
 
 /** Minor version number of this interface */
-#define FUSE_KERNEL_MINOR_VERSION 42
+#define FUSE_KERNEL_MINOR_VERSION 43
 
 /** The node ID of the root inode */
 #define FUSE_ROOT_ID 1
@@ -431,6 +434,8 @@ struct fuse_file_lock {
  *		    of the request ID indicates resend requests
  * FUSE_ALLOW_IDMAP: allow creation of idmapped mounts
  * FUSE_OVER_IO_URING: Indicate that client supports io-uring
+ * FUSE_REQUEST_TIMEOUT: kernel supports timing out requests.
+ *			 init_out.request_timeout contains the timeout (in secs)
  */
 #define FUSE_ASYNC_READ		(1 << 0)
 #define FUSE_POSIX_LOCKS	(1 << 1)
@@ -473,11 +478,11 @@ struct fuse_file_lock {
 #define FUSE_PASSTHROUGH	(1ULL << 37)
 #define FUSE_NO_EXPORT_SUPPORT	(1ULL << 38)
 #define FUSE_HAS_RESEND		(1ULL << 39)
-
 /* Obsolete alias for FUSE_DIRECT_IO_ALLOW_MMAP */
 #define FUSE_DIRECT_IO_RELAX	FUSE_DIRECT_IO_ALLOW_MMAP
 #define FUSE_ALLOW_IDMAP	(1ULL << 40)
 #define FUSE_OVER_IO_URING	(1ULL << 41)
+#define FUSE_REQUEST_TIMEOUT	(1ULL << 42)
 
 /**
  * CUSE INIT request/reply flags
@@ -905,7 +910,8 @@ struct fuse_init_out {
 	uint16_t	map_alignment;
 	uint32_t	flags2;
 	uint32_t	max_stack_depth;
-	uint32_t	unused[6];
+	uint16_t	request_timeout;
+	uint16_t	unused[11];
 };
 
 #define CUSE_INIT_INFO_MAX 4096
diff --git a/include/standard-headers/linux/pci_regs.h b/include/standard-headers/linux/pci_regs.h
index 3445c4970e..ba326710f9 100644
--- a/include/standard-headers/linux/pci_regs.h
+++ b/include/standard-headers/linux/pci_regs.h
@@ -486,6 +486,7 @@
 #define   PCI_EXP_TYPE_RC_EC	   0xa	/* Root Complex Event Collector */
 #define  PCI_EXP_FLAGS_SLOT	0x0100	/* Slot implemented */
 #define  PCI_EXP_FLAGS_IRQ	0x3e00	/* Interrupt message number */
+#define  PCI_EXP_FLAGS_FLIT	0x8000	/* Flit Mode Supported */
 #define PCI_EXP_DEVCAP		0x04	/* Device capabilities */
 #define  PCI_EXP_DEVCAP_PAYLOAD	0x00000007 /* Max_Payload_Size */
 #define  PCI_EXP_DEVCAP_PHANTOM	0x00000018 /* Phantom functions */
@@ -795,6 +796,8 @@
 #define  PCI_ERR_CAP_ECRC_CHKC		0x00000080 /* ECRC Check Capable */
 #define  PCI_ERR_CAP_ECRC_CHKE		0x00000100 /* ECRC Check Enable */
 #define  PCI_ERR_CAP_PREFIX_LOG_PRESENT	0x00000800 /* TLP Prefix Log Present */
+#define  PCI_ERR_CAP_TLP_LOG_FLIT	0x00040000 /* TLP was logged in Flit Mode */
+#define  PCI_ERR_CAP_TLP_LOG_SIZE	0x00f80000 /* Logged TLP Size (only in Flit mode) */
 #define PCI_ERR_HEADER_LOG	0x1c	/* Header Log Register (16 bytes) */
 #define PCI_ERR_ROOT_COMMAND	0x2c	/* Root Error Command */
 #define  PCI_ERR_ROOT_CMD_COR_EN	0x00000001 /* Correctable Err Reporting Enable */
@@ -1013,7 +1016,7 @@
 
 /* Resizable BARs */
 #define PCI_REBAR_CAP		4	/* capability register */
-#define  PCI_REBAR_CAP_SIZES		0x00FFFFF0  /* supported BAR sizes */
+#define  PCI_REBAR_CAP_SIZES		0xFFFFFFF0  /* supported BAR sizes */
 #define PCI_REBAR_CTRL		8	/* control register */
 #define  PCI_REBAR_CTRL_BAR_IDX		0x00000007  /* BAR index */
 #define  PCI_REBAR_CTRL_NBAR_MASK	0x000000E0  /* # of resizable BARs */
@@ -1061,8 +1064,9 @@
 #define  PCI_EXP_DPC_CAP_RP_EXT		0x0020	/* Root Port Extensions */
 #define  PCI_EXP_DPC_CAP_POISONED_TLP	0x0040	/* Poisoned TLP Egress Blocking Supported */
 #define  PCI_EXP_DPC_CAP_SW_TRIGGER	0x0080	/* Software Triggering Supported */
-#define  PCI_EXP_DPC_RP_PIO_LOG_SIZE	0x0F00	/* RP PIO Log Size */
+#define  PCI_EXP_DPC_RP_PIO_LOG_SIZE	0x0F00	/* RP PIO Log Size [3:0] */
 #define  PCI_EXP_DPC_CAP_DL_ACTIVE	0x1000	/* ERR_COR signal on DL_Active supported */
+#define  PCI_EXP_DPC_RP_PIO_LOG_SIZE4	0x2000	/* RP PIO Log Size [4] */
 
 #define PCI_EXP_DPC_CTL			0x06	/* DPC control */
 #define  PCI_EXP_DPC_CTL_EN_FATAL	0x0001	/* Enable trigger on ERR_FATAL message */
@@ -1205,9 +1209,12 @@
 #define PCI_DOE_DATA_OBJECT_DISC_REQ_3_INDEX		0x000000ff
 #define PCI_DOE_DATA_OBJECT_DISC_REQ_3_VER		0x0000ff00
 #define PCI_DOE_DATA_OBJECT_DISC_RSP_3_VID		0x0000ffff
-#define PCI_DOE_DATA_OBJECT_DISC_RSP_3_PROTOCOL		0x00ff0000
+#define PCI_DOE_DATA_OBJECT_DISC_RSP_3_TYPE		0x00ff0000
 #define PCI_DOE_DATA_OBJECT_DISC_RSP_3_NEXT_INDEX	0xff000000
 
+/* Deprecated old name, replaced with PCI_DOE_DATA_OBJECT_DISC_RSP_3_TYPE */
+#define PCI_DOE_DATA_OBJECT_DISC_RSP_3_PROTOCOL		PCI_DOE_DATA_OBJECT_DISC_RSP_3_TYPE
+
 /* Compute Express Link (CXL r3.1, sec 8.1.5) */
 #define PCI_DVSEC_CXL_PORT				3
 #define PCI_DVSEC_CXL_PORT_CTL				0x0c
diff --git a/include/standard-headers/linux/virtio_net.h b/include/standard-headers/linux/virtio_net.h
index fc594fe5fc..982e854f14 100644
--- a/include/standard-headers/linux/virtio_net.h
+++ b/include/standard-headers/linux/virtio_net.h
@@ -327,6 +327,19 @@ struct virtio_net_rss_config {
 	uint8_t hash_key_data[/* hash_key_length */];
 };
 
+struct virtio_net_rss_config_hdr {
+	uint32_t hash_types;
+	uint16_t indirection_table_mask;
+	uint16_t unclassified_queue;
+	uint16_t indirection_table[/* 1 + indirection_table_mask */];
+};
+
+struct virtio_net_rss_config_trailer {
+	uint16_t max_tx_vq;
+	uint8_t hash_key_length;
+	uint8_t hash_key_data[/* hash_key_length */];
+};
+
  #define VIRTIO_NET_CTRL_MQ_RSS_CONFIG          1
 
 /*
diff --git a/include/standard-headers/linux/virtio_snd.h b/include/standard-headers/linux/virtio_snd.h
index 860f12e0a4..160d57899f 100644
--- a/include/standard-headers/linux/virtio_snd.h
+++ b/include/standard-headers/linux/virtio_snd.h
@@ -25,7 +25,7 @@ struct virtio_snd_config {
 	uint32_t streams;
 	/* # of available channel maps */
 	uint32_t chmaps;
-	/* # of available control elements */
+	/* # of available control elements (if VIRTIO_SND_F_CTLS) */
 	uint32_t controls;
 };
 
diff --git a/linux-headers/asm-arm64/kvm.h b/linux-headers/asm-arm64/kvm.h
index ec1e82bdc8..4e6aff08df 100644
--- a/linux-headers/asm-arm64/kvm.h
+++ b/linux-headers/asm-arm64/kvm.h
@@ -105,6 +105,7 @@ struct kvm_regs {
 #define KVM_ARM_VCPU_PTRAUTH_ADDRESS	5 /* VCPU uses address authentication */
 #define KVM_ARM_VCPU_PTRAUTH_GENERIC	6 /* VCPU uses generic authentication */
 #define KVM_ARM_VCPU_HAS_EL2		7 /* Support nested virtualization */
+#define KVM_ARM_VCPU_HAS_EL2_E2H0	8 /* Limit NV support to E2H RES0 */
 
 struct kvm_vcpu_init {
 	__u32 target;
@@ -365,6 +366,7 @@ enum {
 	KVM_REG_ARM_STD_HYP_BIT_PV_TIME	= 0,
 };
 
+/* Vendor hyper call function numbers 0-63 */
 #define KVM_REG_ARM_VENDOR_HYP_BMAP		KVM_REG_ARM_FW_FEAT_BMAP_REG(2)
 
 enum {
@@ -372,6 +374,14 @@ enum {
 	KVM_REG_ARM_VENDOR_HYP_BIT_PTP		= 1,
 };
 
+/* Vendor hyper call function numbers 64-127 */
+#define KVM_REG_ARM_VENDOR_HYP_BMAP_2		KVM_REG_ARM_FW_FEAT_BMAP_REG(3)
+
+enum {
+	KVM_REG_ARM_VENDOR_HYP_BIT_DISCOVER_IMPL_VER	= 0,
+	KVM_REG_ARM_VENDOR_HYP_BIT_DISCOVER_IMPL_CPUS	= 1,
+};
+
 /* Device Control API on vm fd */
 #define KVM_ARM_VM_SMCCC_CTRL		0
 #define   KVM_ARM_VM_SMCCC_FILTER	0
@@ -394,6 +404,7 @@ enum {
 #define KVM_DEV_ARM_VGIC_GRP_CPU_SYSREGS 6
 #define KVM_DEV_ARM_VGIC_GRP_LEVEL_INFO  7
 #define KVM_DEV_ARM_VGIC_GRP_ITS_REGS 8
+#define KVM_DEV_ARM_VGIC_GRP_MAINT_IRQ  9
 #define KVM_DEV_ARM_VGIC_LINE_LEVEL_INFO_SHIFT	10
 #define KVM_DEV_ARM_VGIC_LINE_LEVEL_INFO_MASK \
 			(0x3fffffULL << KVM_DEV_ARM_VGIC_LINE_LEVEL_INFO_SHIFT)
diff --git a/linux-headers/asm-arm64/unistd_64.h b/linux-headers/asm-arm64/unistd_64.h
index d4e90fff76..ee9aaebdf3 100644
--- a/linux-headers/asm-arm64/unistd_64.h
+++ b/linux-headers/asm-arm64/unistd_64.h
@@ -323,6 +323,7 @@
 #define __NR_getxattrat 464
 #define __NR_listxattrat 465
 #define __NR_removexattrat 466
+#define __NR_open_tree_attr 467
 
 
 #endif /* _ASM_UNISTD_64_H */
diff --git a/linux-headers/asm-generic/mman-common.h b/linux-headers/asm-generic/mman-common.h
index 1ea2c4c33b..ef1c27fa3c 100644
--- a/linux-headers/asm-generic/mman-common.h
+++ b/linux-headers/asm-generic/mman-common.h
@@ -85,6 +85,7 @@
 /* compatibility flags */
 #define MAP_FILE	0
 
+#define PKEY_UNRESTRICTED	0x0
 #define PKEY_DISABLE_ACCESS	0x1
 #define PKEY_DISABLE_WRITE	0x2
 #define PKEY_ACCESS_MASK	(PKEY_DISABLE_ACCESS |\
diff --git a/linux-headers/asm-generic/unistd.h b/linux-headers/asm-generic/unistd.h
index 88dc393c2b..2892a45023 100644
--- a/linux-headers/asm-generic/unistd.h
+++ b/linux-headers/asm-generic/unistd.h
@@ -849,9 +849,11 @@ __SYSCALL(__NR_getxattrat, sys_getxattrat)
 __SYSCALL(__NR_listxattrat, sys_listxattrat)
 #define __NR_removexattrat 466
 __SYSCALL(__NR_removexattrat, sys_removexattrat)
+#define __NR_open_tree_attr 467
+__SYSCALL(__NR_open_tree_attr, sys_open_tree_attr)
 
 #undef __NR_syscalls
-#define __NR_syscalls 467
+#define __NR_syscalls 468
 
 /*
  * 32 bit systems traditionally used different
diff --git a/linux-headers/asm-loongarch/unistd_64.h b/linux-headers/asm-loongarch/unistd_64.h
index 23fb96a8a7..50d22df8f7 100644
--- a/linux-headers/asm-loongarch/unistd_64.h
+++ b/linux-headers/asm-loongarch/unistd_64.h
@@ -319,6 +319,7 @@
 #define __NR_getxattrat 464
 #define __NR_listxattrat 465
 #define __NR_removexattrat 466
+#define __NR_open_tree_attr 467
 
 
 #endif /* _ASM_UNISTD_64_H */
diff --git a/linux-headers/asm-mips/unistd_n32.h b/linux-headers/asm-mips/unistd_n32.h
index 9a75719644..bdcc2f460b 100644
--- a/linux-headers/asm-mips/unistd_n32.h
+++ b/linux-headers/asm-mips/unistd_n32.h
@@ -395,5 +395,6 @@
 #define __NR_getxattrat (__NR_Linux + 464)
 #define __NR_listxattrat (__NR_Linux + 465)
 #define __NR_removexattrat (__NR_Linux + 466)
+#define __NR_open_tree_attr (__NR_Linux + 467)
 
 #endif /* _ASM_UNISTD_N32_H */
diff --git a/linux-headers/asm-mips/unistd_n64.h b/linux-headers/asm-mips/unistd_n64.h
index 7086783b0c..3b6b0193b6 100644
--- a/linux-headers/asm-mips/unistd_n64.h
+++ b/linux-headers/asm-mips/unistd_n64.h
@@ -371,5 +371,6 @@
 #define __NR_getxattrat (__NR_Linux + 464)
 #define __NR_listxattrat (__NR_Linux + 465)
 #define __NR_removexattrat (__NR_Linux + 466)
+#define __NR_open_tree_attr (__NR_Linux + 467)
 
 #endif /* _ASM_UNISTD_N64_H */
diff --git a/linux-headers/asm-mips/unistd_o32.h b/linux-headers/asm-mips/unistd_o32.h
index b3825823e4..4609a4b4d3 100644
--- a/linux-headers/asm-mips/unistd_o32.h
+++ b/linux-headers/asm-mips/unistd_o32.h
@@ -441,5 +441,6 @@
 #define __NR_getxattrat (__NR_Linux + 464)
 #define __NR_listxattrat (__NR_Linux + 465)
 #define __NR_removexattrat (__NR_Linux + 466)
+#define __NR_open_tree_attr (__NR_Linux + 467)
 
 #endif /* _ASM_UNISTD_O32_H */
diff --git a/linux-headers/asm-powerpc/unistd_32.h b/linux-headers/asm-powerpc/unistd_32.h
index 38ee4dc35d..5d38a427e0 100644
--- a/linux-headers/asm-powerpc/unistd_32.h
+++ b/linux-headers/asm-powerpc/unistd_32.h
@@ -448,6 +448,7 @@
 #define __NR_getxattrat 464
 #define __NR_listxattrat 465
 #define __NR_removexattrat 466
+#define __NR_open_tree_attr 467
 
 
 #endif /* _ASM_UNISTD_32_H */
diff --git a/linux-headers/asm-powerpc/unistd_64.h b/linux-headers/asm-powerpc/unistd_64.h
index 5e5f156834..860a488e4d 100644
--- a/linux-headers/asm-powerpc/unistd_64.h
+++ b/linux-headers/asm-powerpc/unistd_64.h
@@ -420,6 +420,7 @@
 #define __NR_getxattrat 464
 #define __NR_listxattrat 465
 #define __NR_removexattrat 466
+#define __NR_open_tree_attr 467
 
 
 #endif /* _ASM_UNISTD_64_H */
diff --git a/linux-headers/asm-riscv/kvm.h b/linux-headers/asm-riscv/kvm.h
index f06bc5efcd..5f59fd226c 100644
--- a/linux-headers/asm-riscv/kvm.h
+++ b/linux-headers/asm-riscv/kvm.h
@@ -182,6 +182,8 @@ enum KVM_RISCV_ISA_EXT_ID {
 	KVM_RISCV_ISA_EXT_SVVPTC,
 	KVM_RISCV_ISA_EXT_ZABHA,
 	KVM_RISCV_ISA_EXT_ZICCRSE,
+	KVM_RISCV_ISA_EXT_ZAAMO,
+	KVM_RISCV_ISA_EXT_ZALRSC,
 	KVM_RISCV_ISA_EXT_MAX,
 };
 
diff --git a/linux-headers/asm-riscv/unistd_32.h b/linux-headers/asm-riscv/unistd_32.h
index 74f6127aed..a5e769f1d9 100644
--- a/linux-headers/asm-riscv/unistd_32.h
+++ b/linux-headers/asm-riscv/unistd_32.h
@@ -314,6 +314,7 @@
 #define __NR_getxattrat 464
 #define __NR_listxattrat 465
 #define __NR_removexattrat 466
+#define __NR_open_tree_attr 467
 
 
 #endif /* _ASM_UNISTD_32_H */
diff --git a/linux-headers/asm-riscv/unistd_64.h b/linux-headers/asm-riscv/unistd_64.h
index bb6a15a2ec..8df4d64841 100644
--- a/linux-headers/asm-riscv/unistd_64.h
+++ b/linux-headers/asm-riscv/unistd_64.h
@@ -324,6 +324,7 @@
 #define __NR_getxattrat 464
 #define __NR_listxattrat 465
 #define __NR_removexattrat 466
+#define __NR_open_tree_attr 467
 
 
 #endif /* _ASM_UNISTD_64_H */
diff --git a/linux-headers/asm-s390/unistd_32.h b/linux-headers/asm-s390/unistd_32.h
index 620201cb36..85eedbd18e 100644
--- a/linux-headers/asm-s390/unistd_32.h
+++ b/linux-headers/asm-s390/unistd_32.h
@@ -439,5 +439,6 @@
 #define __NR_getxattrat 464
 #define __NR_listxattrat 465
 #define __NR_removexattrat 466
+#define __NR_open_tree_attr 467
 
 #endif /* _ASM_S390_UNISTD_32_H */
diff --git a/linux-headers/asm-s390/unistd_64.h b/linux-headers/asm-s390/unistd_64.h
index e7e4a10aaf..c03b1b9701 100644
--- a/linux-headers/asm-s390/unistd_64.h
+++ b/linux-headers/asm-s390/unistd_64.h
@@ -387,5 +387,6 @@
 #define __NR_getxattrat 464
 #define __NR_listxattrat 465
 #define __NR_removexattrat 466
+#define __NR_open_tree_attr 467
 
 #endif /* _ASM_S390_UNISTD_64_H */
diff --git a/linux-headers/asm-x86/kvm.h b/linux-headers/asm-x86/kvm.h
index 86f2c34e7a..dc591fb17e 100644
--- a/linux-headers/asm-x86/kvm.h
+++ b/linux-headers/asm-x86/kvm.h
@@ -557,6 +557,9 @@ struct kvm_x86_mce {
 #define KVM_XEN_HVM_CONFIG_PVCLOCK_TSC_UNSTABLE	(1 << 7)
 #define KVM_XEN_HVM_CONFIG_SHARED_INFO_HVA	(1 << 8)
 
+#define KVM_XEN_MSR_MIN_INDEX			0x40000000u
+#define KVM_XEN_MSR_MAX_INDEX			0x4fffffffu
+
 struct kvm_xen_hvm_config {
 	__u32 flags;
 	__u32 msr;
diff --git a/linux-headers/asm-x86/unistd_32.h b/linux-headers/asm-x86/unistd_32.h
index a2eb492a75..491d6b4eb6 100644
--- a/linux-headers/asm-x86/unistd_32.h
+++ b/linux-headers/asm-x86/unistd_32.h
@@ -457,6 +457,7 @@
 #define __NR_getxattrat 464
 #define __NR_listxattrat 465
 #define __NR_removexattrat 466
+#define __NR_open_tree_attr 467
 
 
 #endif /* _ASM_UNISTD_32_H */
diff --git a/linux-headers/asm-x86/unistd_64.h b/linux-headers/asm-x86/unistd_64.h
index 2f5fc400f5..7cf88bf9bd 100644
--- a/linux-headers/asm-x86/unistd_64.h
+++ b/linux-headers/asm-x86/unistd_64.h
@@ -380,6 +380,7 @@
 #define __NR_getxattrat 464
 #define __NR_listxattrat 465
 #define __NR_removexattrat 466
+#define __NR_open_tree_attr 467
 
 
 #endif /* _ASM_UNISTD_64_H */
diff --git a/linux-headers/asm-x86/unistd_x32.h b/linux-headers/asm-x86/unistd_x32.h
index fecd832e7f..82959111e6 100644
--- a/linux-headers/asm-x86/unistd_x32.h
+++ b/linux-headers/asm-x86/unistd_x32.h
@@ -333,6 +333,7 @@
 #define __NR_getxattrat (__X32_SYSCALL_BIT + 464)
 #define __NR_listxattrat (__X32_SYSCALL_BIT + 465)
 #define __NR_removexattrat (__X32_SYSCALL_BIT + 466)
+#define __NR_open_tree_attr (__X32_SYSCALL_BIT + 467)
 #define __NR_rt_sigaction (__X32_SYSCALL_BIT + 512)
 #define __NR_rt_sigreturn (__X32_SYSCALL_BIT + 513)
 #define __NR_ioctl (__X32_SYSCALL_BIT + 514)
diff --git a/linux-headers/linux/bits.h b/linux-headers/linux/bits.h
index c0d00c0a98..58596d18f4 100644
--- a/linux-headers/linux/bits.h
+++ b/linux-headers/linux/bits.h
@@ -4,13 +4,9 @@
 #ifndef _LINUX_BITS_H
 #define _LINUX_BITS_H
 
-#define __GENMASK(h, l) \
-        (((~_UL(0)) - (_UL(1) << (l)) + 1) & \
-         (~_UL(0) >> (__BITS_PER_LONG - 1 - (h))))
+#define __GENMASK(h, l) (((~_UL(0)) << (l)) & (~_UL(0) >> (BITS_PER_LONG - 1 - (h))))
 
-#define __GENMASK_ULL(h, l) \
-        (((~_ULL(0)) - (_ULL(1) << (l)) + 1) & \
-         (~_ULL(0) >> (__BITS_PER_LONG_LONG - 1 - (h))))
+#define __GENMASK_ULL(h, l) (((~_ULL(0)) << (l)) & (~_ULL(0) >> (BITS_PER_LONG_LONG - 1 - (h))))
 
 #define __GENMASK_U128(h, l) \
 	((_BIT128((h)) << 1) - (_BIT128(l)))
diff --git a/linux-headers/linux/const.h b/linux-headers/linux/const.h
index 2122610de7..95ede23342 100644
--- a/linux-headers/linux/const.h
+++ b/linux-headers/linux/const.h
@@ -33,7 +33,7 @@
  * Missing __asm__ support
  *
  * __BIT128() would not work in the __asm__ code, as it shifts an
- * 'unsigned __init128' data type as direct representation of
+ * 'unsigned __int128' data type as direct representation of
  * 128 bit constants is not supported in the gcc compiler, as
  * they get silently truncated.
  *
diff --git a/linux-headers/linux/iommufd.h b/linux-headers/linux/iommufd.h
index ccbdca5e11..cb0f7d6b4d 100644
--- a/linux-headers/linux/iommufd.h
+++ b/linux-headers/linux/iommufd.h
@@ -55,6 +55,7 @@ enum {
 	IOMMUFD_CMD_VIOMMU_ALLOC = 0x90,
 	IOMMUFD_CMD_VDEVICE_ALLOC = 0x91,
 	IOMMUFD_CMD_IOAS_CHANGE_PROCESS = 0x92,
+	IOMMUFD_CMD_VEVENTQ_ALLOC = 0x93,
 };
 
 /**
@@ -392,6 +393,9 @@ struct iommu_vfio_ioas {
  *                          Any domain attached to the non-PASID part of the
  *                          device must also be flagged, otherwise attaching a
  *                          PASID will blocked.
+ *                          For the user that wants to attach PASID, ioas is
+ *                          not recommended for both the non-PASID part
+ *                          and PASID part of the device.
  *                          If IOMMU does not support PASID it will return
  *                          error (-EOPNOTSUPP).
  */
@@ -608,9 +612,17 @@ enum iommu_hw_info_type {
  *                                   IOMMU_HWPT_GET_DIRTY_BITMAP
  *                                   IOMMU_HWPT_SET_DIRTY_TRACKING
  *
+ * @IOMMU_HW_CAP_PCI_PASID_EXEC: Execute Permission Supported, user ignores it
+ *                               when the struct
+ *                               iommu_hw_info::out_max_pasid_log2 is zero.
+ * @IOMMU_HW_CAP_PCI_PASID_PRIV: Privileged Mode Supported, user ignores it
+ *                               when the struct
+ *                               iommu_hw_info::out_max_pasid_log2 is zero.
  */
 enum iommufd_hw_capabilities {
 	IOMMU_HW_CAP_DIRTY_TRACKING = 1 << 0,
+	IOMMU_HW_CAP_PCI_PASID_EXEC = 1 << 1,
+	IOMMU_HW_CAP_PCI_PASID_PRIV = 1 << 2,
 };
 
 /**
@@ -626,6 +638,9 @@ enum iommufd_hw_capabilities {
  *                 iommu_hw_info_type.
  * @out_capabilities: Output the generic iommu capability info type as defined
  *                    in the enum iommu_hw_capabilities.
+ * @out_max_pasid_log2: Output the width of PASIDs. 0 means no PASID support.
+ *                      PCI devices turn to out_capabilities to check if the
+ *                      specific capabilities is supported or not.
  * @__reserved: Must be 0
  *
  * Query an iommu type specific hardware information data from an iommu behind
@@ -649,7 +664,8 @@ struct iommu_hw_info {
 	__u32 data_len;
 	__aligned_u64 data_uptr;
 	__u32 out_data_type;
-	__u32 __reserved;
+	__u8 out_max_pasid_log2;
+	__u8 __reserved[3];
 	__aligned_u64 out_capabilities;
 };
 #define IOMMU_GET_HW_INFO _IO(IOMMUFD_TYPE, IOMMUFD_CMD_GET_HW_INFO)
@@ -1014,4 +1030,115 @@ struct iommu_ioas_change_process {
 #define IOMMU_IOAS_CHANGE_PROCESS \
 	_IO(IOMMUFD_TYPE, IOMMUFD_CMD_IOAS_CHANGE_PROCESS)
 
+/**
+ * enum iommu_veventq_flag - flag for struct iommufd_vevent_header
+ * @IOMMU_VEVENTQ_FLAG_LOST_EVENTS: vEVENTQ has lost vEVENTs
+ */
+enum iommu_veventq_flag {
+	IOMMU_VEVENTQ_FLAG_LOST_EVENTS = (1U << 0),
+};
+
+/**
+ * struct iommufd_vevent_header - Virtual Event Header for a vEVENTQ Status
+ * @flags: Combination of enum iommu_veventq_flag
+ * @sequence: The sequence index of a vEVENT in the vEVENTQ, with a range of
+ *            [0, INT_MAX] where the following index of INT_MAX is 0
+ *
+ * Each iommufd_vevent_header reports a sequence index of the following vEVENT:
+ *
+ * +----------------------+-------+----------------------+-------+---+-------+
+ * | header0 {sequence=0} | data0 | header1 {sequence=1} | data1 |...| dataN |
+ * +----------------------+-------+----------------------+-------+---+-------+
+ *
+ * And this sequence index is expected to be monotonic to the sequence index of
+ * the previous vEVENT. If two adjacent sequence indexes has a delta larger than
+ * 1, it means that delta - 1 number of vEVENTs has lost, e.g. two lost vEVENTs:
+ *
+ * +-----+----------------------+-------+----------------------+-------+-----+
+ * | ... | header3 {sequence=3} | data3 | header6 {sequence=6} | data6 | ... |
+ * +-----+----------------------+-------+----------------------+-------+-----+
+ *
+ * If a vEVENT lost at the tail of the vEVENTQ and there is no following vEVENT
+ * providing the next sequence index, an IOMMU_VEVENTQ_FLAG_LOST_EVENTS header
+ * would be added to the tail, and no data would follow this header:
+ *
+ * +--+----------------------+-------+-----------------------------------------+
+ * |..| header3 {sequence=3} | data3 | header4 {flags=LOST_EVENTS, sequence=4} |
+ * +--+----------------------+-------+-----------------------------------------+
+ */
+struct iommufd_vevent_header {
+	__u32 flags;
+	__u32 sequence;
+};
+
+/**
+ * enum iommu_veventq_type - Virtual Event Queue Type
+ * @IOMMU_VEVENTQ_TYPE_DEFAULT: Reserved for future use
+ * @IOMMU_VEVENTQ_TYPE_ARM_SMMUV3: ARM SMMUv3 Virtual Event Queue
+ */
+enum iommu_veventq_type {
+	IOMMU_VEVENTQ_TYPE_DEFAULT = 0,
+	IOMMU_VEVENTQ_TYPE_ARM_SMMUV3 = 1,
+};
+
+/**
+ * struct iommu_vevent_arm_smmuv3 - ARM SMMUv3 Virtual Event
+ *                                  (IOMMU_VEVENTQ_TYPE_ARM_SMMUV3)
+ * @evt: 256-bit ARM SMMUv3 Event record, little-endian.
+ *       Reported event records: (Refer to "7.3 Event records" in SMMUv3 HW Spec)
+ *       - 0x04 C_BAD_STE
+ *       - 0x06 F_STREAM_DISABLED
+ *       - 0x08 C_BAD_SUBSTREAMID
+ *       - 0x0a C_BAD_CD
+ *       - 0x10 F_TRANSLATION
+ *       - 0x11 F_ADDR_SIZE
+ *       - 0x12 F_ACCESS
+ *       - 0x13 F_PERMISSION
+ *
+ * StreamID field reports a virtual device ID. To receive a virtual event for a
+ * device, a vDEVICE must be allocated via IOMMU_VDEVICE_ALLOC.
+ */
+struct iommu_vevent_arm_smmuv3 {
+	__aligned_le64 evt[4];
+};
+
+/**
+ * struct iommu_veventq_alloc - ioctl(IOMMU_VEVENTQ_ALLOC)
+ * @size: sizeof(struct iommu_veventq_alloc)
+ * @flags: Must be 0
+ * @viommu_id: virtual IOMMU ID to associate the vEVENTQ with
+ * @type: Type of the vEVENTQ. Must be defined in enum iommu_veventq_type
+ * @veventq_depth: Maximum number of events in the vEVENTQ
+ * @out_veventq_id: The ID of the new vEVENTQ
+ * @out_veventq_fd: The fd of the new vEVENTQ. User space must close the
+ *                  successfully returned fd after using it
+ * @__reserved: Must be 0
+ *
+ * Explicitly allocate a virtual event queue interface for a vIOMMU. A vIOMMU
+ * can have multiple FDs for different types, but is confined to one per @type.
+ * User space should open the @out_veventq_fd to read vEVENTs out of a vEVENTQ,
+ * if there are vEVENTs available. A vEVENTQ will lose events due to overflow,
+ * if the number of the vEVENTs hits @veventq_depth.
+ *
+ * Each vEVENT in a vEVENTQ encloses a struct iommufd_vevent_header followed by
+ * a type-specific data structure, in a normal case:
+ *
+ * +-+---------+-------+---------+-------+-----+---------+-------+-+
+ * | | header0 | data0 | header1 | data1 | ... | headerN | dataN | |
+ * +-+---------+-------+---------+-------+-----+---------+-------+-+
+ *
+ * unless a tailing IOMMU_VEVENTQ_FLAG_LOST_EVENTS header is logged (refer to
+ * struct iommufd_vevent_header).
+ */
+struct iommu_veventq_alloc {
+	__u32 size;
+	__u32 flags;
+	__u32 viommu_id;
+	__u32 type;
+	__u32 veventq_depth;
+	__u32 out_veventq_id;
+	__u32 out_veventq_fd;
+	__u32 __reserved;
+};
+#define IOMMU_VEVENTQ_ALLOC _IO(IOMMUFD_TYPE, IOMMUFD_CMD_VEVENTQ_ALLOC)
 #endif
diff --git a/linux-headers/linux/kvm.h b/linux-headers/linux/kvm.h
index 27181b3dd8..e5f3e8b5a0 100644
--- a/linux-headers/linux/kvm.h
+++ b/linux-headers/linux/kvm.h
@@ -921,6 +921,7 @@ struct kvm_enable_cap {
 #define KVM_CAP_PRE_FAULT_MEMORY 236
 #define KVM_CAP_X86_APIC_BUS_CYCLES_NS 237
 #define KVM_CAP_X86_GUEST_MODE 238
+#define KVM_CAP_ARM_WRITABLE_IMP_ID_REGS 239
 
 struct kvm_irq_routing_irqchip {
 	__u32 irqchip;
diff --git a/linux-headers/linux/psp-sev.h b/linux-headers/linux/psp-sev.h
index 17bf191573..113c4ceb78 100644
--- a/linux-headers/linux/psp-sev.h
+++ b/linux-headers/linux/psp-sev.h
@@ -73,13 +73,20 @@ typedef enum {
 	SEV_RET_INVALID_PARAM,
 	SEV_RET_RESOURCE_LIMIT,
 	SEV_RET_SECURE_DATA_INVALID,
-	SEV_RET_INVALID_KEY = 0x27,
-	SEV_RET_INVALID_PAGE_SIZE,
-	SEV_RET_INVALID_PAGE_STATE,
-	SEV_RET_INVALID_MDATA_ENTRY,
-	SEV_RET_INVALID_PAGE_OWNER,
-	SEV_RET_INVALID_PAGE_AEAD_OFLOW,
-	SEV_RET_RMP_INIT_REQUIRED,
+	SEV_RET_INVALID_PAGE_SIZE          = 0x0019,
+	SEV_RET_INVALID_PAGE_STATE         = 0x001A,
+	SEV_RET_INVALID_MDATA_ENTRY        = 0x001B,
+	SEV_RET_INVALID_PAGE_OWNER         = 0x001C,
+	SEV_RET_AEAD_OFLOW                 = 0x001D,
+	SEV_RET_EXIT_RING_BUFFER           = 0x001F,
+	SEV_RET_RMP_INIT_REQUIRED          = 0x0020,
+	SEV_RET_BAD_SVN                    = 0x0021,
+	SEV_RET_BAD_VERSION                = 0x0022,
+	SEV_RET_SHUTDOWN_REQUIRED          = 0x0023,
+	SEV_RET_UPDATE_FAILED              = 0x0024,
+	SEV_RET_RESTORE_REQUIRED           = 0x0025,
+	SEV_RET_RMP_INITIALIZATION_FAILED  = 0x0026,
+	SEV_RET_INVALID_KEY                = 0x0027,
 	SEV_RET_MAX,
 } sev_ret_code;
 
diff --git a/linux-headers/linux/stddef.h b/linux-headers/linux/stddef.h
index e1416f7937..e1fcfcf3b3 100644
--- a/linux-headers/linux/stddef.h
+++ b/linux-headers/linux/stddef.h
@@ -70,4 +70,6 @@
 #define __counted_by_be(m)
 #endif
 
+#define __kernel_nonstring
+
 #endif /* _LINUX_STDDEF_H */
diff --git a/linux-headers/linux/vfio.h b/linux-headers/linux/vfio.h
index 1b5e254d6a..79bf8c0cc5 100644
--- a/linux-headers/linux/vfio.h
+++ b/linux-headers/linux/vfio.h
@@ -671,6 +671,7 @@ enum {
  */
 enum {
 	VFIO_AP_REQ_IRQ_INDEX,
+	VFIO_AP_CFG_CHG_IRQ_INDEX,
 	VFIO_AP_NUM_IRQS
 };
 
@@ -931,29 +932,34 @@ struct vfio_device_bind_iommufd {
  * VFIO_DEVICE_ATTACH_IOMMUFD_PT - _IOW(VFIO_TYPE, VFIO_BASE + 19,
  *					struct vfio_device_attach_iommufd_pt)
  * @argsz:	User filled size of this data.
- * @flags:	Must be 0.
+ * @flags:	Flags for attach.
  * @pt_id:	Input the target id which can represent an ioas or a hwpt
  *		allocated via iommufd subsystem.
  *		Output the input ioas id or the attached hwpt id which could
  *		be the specified hwpt itself or a hwpt automatically created
  *		for the specified ioas by kernel during the attachment.
+ * @pasid:	The pasid to be attached, only meaningful when
+ *		VFIO_DEVICE_ATTACH_PASID is set in @flags
  *
  * Associate the device with an address space within the bound iommufd.
  * Undo by VFIO_DEVICE_DETACH_IOMMUFD_PT or device fd close.  This is only
  * allowed on cdev fds.
  *
- * If a vfio device is currently attached to a valid hw_pagetable, without doing
- * a VFIO_DEVICE_DETACH_IOMMUFD_PT, a second VFIO_DEVICE_ATTACH_IOMMUFD_PT ioctl
- * passing in another hw_pagetable (hwpt) id is allowed. This action, also known
- * as a hw_pagetable replacement, will replace the device's currently attached
- * hw_pagetable with a new hw_pagetable corresponding to the given pt_id.
+ * If a vfio device or a pasid of this device is currently attached to a valid
+ * hw_pagetable (hwpt), without doing a VFIO_DEVICE_DETACH_IOMMUFD_PT, a second
+ * VFIO_DEVICE_ATTACH_IOMMUFD_PT ioctl passing in another hwpt id is allowed.
+ * This action, also known as a hw_pagetable replacement, will replace the
+ * currently attached hwpt of the device or the pasid of this device with a new
+ * hwpt corresponding to the given pt_id.
  *
  * Return: 0 on success, -errno on failure.
  */
 struct vfio_device_attach_iommufd_pt {
 	__u32	argsz;
 	__u32	flags;
+#define VFIO_DEVICE_ATTACH_PASID	(1 << 0)
 	__u32	pt_id;
+	__u32	pasid;
 };
 
 #define VFIO_DEVICE_ATTACH_IOMMUFD_PT		_IO(VFIO_TYPE, VFIO_BASE + 19)
@@ -962,17 +968,21 @@ struct vfio_device_attach_iommufd_pt {
  * VFIO_DEVICE_DETACH_IOMMUFD_PT - _IOW(VFIO_TYPE, VFIO_BASE + 20,
  *					struct vfio_device_detach_iommufd_pt)
  * @argsz:	User filled size of this data.
- * @flags:	Must be 0.
+ * @flags:	Flags for detach.
+ * @pasid:	The pasid to be detached, only meaningful when
+ *		VFIO_DEVICE_DETACH_PASID is set in @flags
  *
- * Remove the association of the device and its current associated address
- * space.  After it, the device should be in a blocking DMA state.  This is only
- * allowed on cdev fds.
+ * Remove the association of the device or a pasid of the device and its current
+ * associated address space.  After it, the device or the pasid should be in a
+ * blocking DMA state.  This is only allowed on cdev fds.
  *
  * Return: 0 on success, -errno on failure.
  */
 struct vfio_device_detach_iommufd_pt {
 	__u32	argsz;
 	__u32	flags;
+#define VFIO_DEVICE_DETACH_PASID	(1 << 0)
+	__u32	pasid;
 };
 
 #define VFIO_DEVICE_DETACH_IOMMUFD_PT		_IO(VFIO_TYPE, VFIO_BASE + 20)

From a901682f53b51c07dc27aab7e30256855a2a1f2f Mon Sep 17 00:00:00 2001
From: John Levon <john.levon@nutanix.com>
Date: Wed, 7 May 2025 16:20:06 +0100
Subject: [PATCH 0774/2760] vfio: add vfio_device_prepare()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Commonize some initialization code shared by the legacy and iommufd vfio
implementations.

Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: John Levon <john.levon@nutanix.com>
Link: https://lore.kernel.org/qemu-devel/20250507152020.1254632-2-john.levon@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/container.c           | 14 ++------------
 hw/vfio/device.c              | 14 ++++++++++++++
 hw/vfio/iommufd.c             |  9 +--------
 include/hw/vfio/vfio-device.h |  3 +++
 4 files changed, 20 insertions(+), 20 deletions(-)

diff --git a/hw/vfio/container.c b/hw/vfio/container.c
index a761f0958b..d30c1a141d 100644
--- a/hw/vfio/container.c
+++ b/hw/vfio/container.c
@@ -826,18 +826,14 @@ static bool vfio_device_get(VFIOGroup *group, const char *name,
         }
     }
 
+    vfio_device_prepare(vbasedev, &group->container->bcontainer, info);
+
     vbasedev->fd = fd;
     vbasedev->group = group;
     QLIST_INSERT_HEAD(&group->device_list, vbasedev, next);
 
-    vbasedev->num_irqs = info->num_irqs;
-    vbasedev->num_regions = info->num_regions;
-    vbasedev->flags = info->flags;
-
     trace_vfio_device_get(name, info->flags, info->num_regions, info->num_irqs);
 
-    vbasedev->reset_works = !!(info->flags & VFIO_DEVICE_FLAGS_RESET);
-
     return true;
 }
 
@@ -890,7 +886,6 @@ static bool vfio_legacy_attach_device(const char *name, VFIODevice *vbasedev,
     int groupid = vfio_device_get_groupid(vbasedev, errp);
     VFIODevice *vbasedev_iter;
     VFIOGroup *group;
-    VFIOContainerBase *bcontainer;
 
     if (groupid < 0) {
         return false;
@@ -919,11 +914,6 @@ static bool vfio_legacy_attach_device(const char *name, VFIODevice *vbasedev,
         goto device_put_exit;
     }
 
-    bcontainer = &group->container->bcontainer;
-    vbasedev->bcontainer = bcontainer;
-    QLIST_INSERT_HEAD(&bcontainer->device_list, vbasedev, container_next);
-    QLIST_INSERT_HEAD(&vfio_device_list, vbasedev, global_next);
-
     return true;
 
 device_put_exit:
diff --git a/hw/vfio/device.c b/hw/vfio/device.c
index d625a7c4db..f3b9902d21 100644
--- a/hw/vfio/device.c
+++ b/hw/vfio/device.c
@@ -398,3 +398,17 @@ void vfio_device_detach(VFIODevice *vbasedev)
     }
     VFIO_IOMMU_GET_CLASS(vbasedev->bcontainer)->detach_device(vbasedev);
 }
+
+void vfio_device_prepare(VFIODevice *vbasedev, VFIOContainerBase *bcontainer,
+                         struct vfio_device_info *info)
+{
+    vbasedev->num_irqs = info->num_irqs;
+    vbasedev->num_regions = info->num_regions;
+    vbasedev->flags = info->flags;
+    vbasedev->reset_works = !!(info->flags & VFIO_DEVICE_FLAGS_RESET);
+
+    vbasedev->bcontainer = bcontainer;
+    QLIST_INSERT_HEAD(&bcontainer->device_list, vbasedev, container_next);
+
+    QLIST_INSERT_HEAD(&vfio_device_list, vbasedev, global_next);
+}
diff --git a/hw/vfio/iommufd.c b/hw/vfio/iommufd.c
index 232c06dd15..83033c352a 100644
--- a/hw/vfio/iommufd.c
+++ b/hw/vfio/iommufd.c
@@ -588,14 +588,7 @@ found_container:
         iommufd_cdev_ram_block_discard_disable(false);
     }
 
-    vbasedev->group = 0;
-    vbasedev->num_irqs = dev_info.num_irqs;
-    vbasedev->num_regions = dev_info.num_regions;
-    vbasedev->flags = dev_info.flags;
-    vbasedev->reset_works = !!(dev_info.flags & VFIO_DEVICE_FLAGS_RESET);
-    vbasedev->bcontainer = bcontainer;
-    QLIST_INSERT_HEAD(&bcontainer->device_list, vbasedev, container_next);
-    QLIST_INSERT_HEAD(&vfio_device_list, vbasedev, global_next);
+    vfio_device_prepare(vbasedev, bcontainer, &dev_info);
 
     trace_iommufd_cdev_device_info(vbasedev->name, devfd, vbasedev->num_irqs,
                                    vbasedev->num_regions, vbasedev->flags);
diff --git a/include/hw/vfio/vfio-device.h b/include/hw/vfio/vfio-device.h
index 81c95bb51e..081929ca4b 100644
--- a/include/hw/vfio/vfio-device.h
+++ b/include/hw/vfio/vfio-device.h
@@ -134,6 +134,9 @@ typedef QLIST_HEAD(VFIODeviceList, VFIODevice) VFIODeviceList;
 extern VFIODeviceList vfio_device_list;
 
 #ifdef CONFIG_LINUX
+void vfio_device_prepare(VFIODevice *vbasedev, VFIOContainerBase *bcontainer,
+                         struct vfio_device_info *info);
+
 int vfio_device_get_region_info(VFIODevice *vbasedev, int index,
                                 struct vfio_region_info **info);
 int vfio_device_get_region_info_type(VFIODevice *vbasedev, uint32_t type,

From d60fb709cf948b3dc508eb88162f5666a49762ae Mon Sep 17 00:00:00 2001
From: John Levon <john.levon@nutanix.com>
Date: Wed, 7 May 2025 16:20:07 +0100
Subject: [PATCH 0775/2760] vfio: add vfio_device_unprepare()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add a helper that's the inverse of vfio_device_prepare().

Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: John Levon <john.levon@nutanix.com>
Link: https://lore.kernel.org/qemu-devel/20250507152020.1254632-3-john.levon@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/container.c           | 6 +++---
 hw/vfio/device.c              | 7 +++++++
 hw/vfio/iommufd.c             | 4 +---
 include/hw/vfio/vfio-device.h | 2 ++
 4 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/hw/vfio/container.c b/hw/vfio/container.c
index d30c1a141d..cf23aa799f 100644
--- a/hw/vfio/container.c
+++ b/hw/vfio/container.c
@@ -927,10 +927,10 @@ static void vfio_legacy_detach_device(VFIODevice *vbasedev)
 {
     VFIOGroup *group = vbasedev->group;
 
-    QLIST_REMOVE(vbasedev, global_next);
-    QLIST_REMOVE(vbasedev, container_next);
-    vbasedev->bcontainer = NULL;
     trace_vfio_device_detach(vbasedev->name, group->groupid);
+
+    vfio_device_unprepare(vbasedev);
+
     object_unref(vbasedev->hiod);
     vfio_device_put(vbasedev);
     vfio_group_put(group);
diff --git a/hw/vfio/device.c b/hw/vfio/device.c
index f3b9902d21..31c441a3df 100644
--- a/hw/vfio/device.c
+++ b/hw/vfio/device.c
@@ -412,3 +412,10 @@ void vfio_device_prepare(VFIODevice *vbasedev, VFIOContainerBase *bcontainer,
 
     QLIST_INSERT_HEAD(&vfio_device_list, vbasedev, global_next);
 }
+
+void vfio_device_unprepare(VFIODevice *vbasedev)
+{
+    QLIST_REMOVE(vbasedev, container_next);
+    QLIST_REMOVE(vbasedev, global_next);
+    vbasedev->bcontainer = NULL;
+}
diff --git a/hw/vfio/iommufd.c b/hw/vfio/iommufd.c
index 83033c352a..62ecb758f1 100644
--- a/hw/vfio/iommufd.c
+++ b/hw/vfio/iommufd.c
@@ -615,9 +615,7 @@ static void iommufd_cdev_detach(VFIODevice *vbasedev)
     VFIOIOMMUFDContainer *container = container_of(bcontainer,
                                                    VFIOIOMMUFDContainer,
                                                    bcontainer);
-    QLIST_REMOVE(vbasedev, global_next);
-    QLIST_REMOVE(vbasedev, container_next);
-    vbasedev->bcontainer = NULL;
+    vfio_device_unprepare(vbasedev);
 
     if (!vbasedev->ram_block_discard_allowed) {
         iommufd_cdev_ram_block_discard_disable(false);
diff --git a/include/hw/vfio/vfio-device.h b/include/hw/vfio/vfio-device.h
index 081929ca4b..342c4ba3bf 100644
--- a/include/hw/vfio/vfio-device.h
+++ b/include/hw/vfio/vfio-device.h
@@ -137,6 +137,8 @@ extern VFIODeviceList vfio_device_list;
 void vfio_device_prepare(VFIODevice *vbasedev, VFIOContainerBase *bcontainer,
                          struct vfio_device_info *info);
 
+void vfio_device_unprepare(VFIODevice *vbasedev);
+
 int vfio_device_get_region_info(VFIODevice *vbasedev, int index,
                                 struct vfio_region_info **info);
 int vfio_device_get_region_info_type(VFIODevice *vbasedev, uint32_t type,

From ef73671f0bfc7bd852439e42ab4260104d902055 Mon Sep 17 00:00:00 2001
From: John Levon <john.levon@nutanix.com>
Date: Wed, 7 May 2025 16:20:08 +0100
Subject: [PATCH 0776/2760] vfio: add vfio_attach_device_by_iommu_type()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Allow attachment by explicitly passing a TYPE_VFIO_IOMMU_* string;
vfio-user will use this later.

Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: John Levon <john.levon@nutanix.com>
Link: https://lore.kernel.org/qemu-devel/20250507152020.1254632-4-john.levon@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/device.c              | 22 +++++++++++++++-------
 include/hw/vfio/vfio-device.h |  3 +++
 2 files changed, 18 insertions(+), 7 deletions(-)

diff --git a/hw/vfio/device.c b/hw/vfio/device.c
index 31c441a3df..9673b0717e 100644
--- a/hw/vfio/device.c
+++ b/hw/vfio/device.c
@@ -376,21 +376,29 @@ VFIODevice *vfio_get_vfio_device(Object *obj)
     }
 }
 
-bool vfio_device_attach(char *name, VFIODevice *vbasedev,
-                        AddressSpace *as, Error **errp)
+bool vfio_device_attach_by_iommu_type(const char *iommu_type, char *name,
+                                      VFIODevice *vbasedev, AddressSpace *as,
+                                      Error **errp)
 {
     const VFIOIOMMUClass *ops =
-        VFIO_IOMMU_CLASS(object_class_by_name(TYPE_VFIO_IOMMU_LEGACY));
-
-    if (vbasedev->iommufd) {
-        ops = VFIO_IOMMU_CLASS(object_class_by_name(TYPE_VFIO_IOMMU_IOMMUFD));
-    }
+        VFIO_IOMMU_CLASS(object_class_by_name(iommu_type));
 
     assert(ops);
 
     return ops->attach_device(name, vbasedev, as, errp);
 }
 
+bool vfio_device_attach(char *name, VFIODevice *vbasedev,
+                        AddressSpace *as, Error **errp)
+{
+    const char *iommu_type = vbasedev->iommufd ?
+                             TYPE_VFIO_IOMMU_IOMMUFD :
+                             TYPE_VFIO_IOMMU_LEGACY;
+
+    return vfio_device_attach_by_iommu_type(iommu_type, name, vbasedev,
+                                            as, errp);
+}
+
 void vfio_device_detach(VFIODevice *vbasedev)
 {
     if (!vbasedev->bcontainer) {
diff --git a/include/hw/vfio/vfio-device.h b/include/hw/vfio/vfio-device.h
index 342c4ba3bf..8b1437ba66 100644
--- a/include/hw/vfio/vfio-device.h
+++ b/include/hw/vfio/vfio-device.h
@@ -127,6 +127,9 @@ bool vfio_device_hiod_create_and_realize(VFIODevice *vbasedev,
                                          const char *typename, Error **errp);
 bool vfio_device_attach(char *name, VFIODevice *vbasedev,
                         AddressSpace *as, Error **errp);
+bool vfio_device_attach_by_iommu_type(const char *iommu_type, char *name,
+                                      VFIODevice *vbasedev, AddressSpace *as,
+                                      Error **errp);
 void vfio_device_detach(VFIODevice *vbasedev);
 VFIODevice *vfio_get_vfio_device(Object *obj);
 

From 5321e623ebe27deef7cfb793a71d23affa77d157 Mon Sep 17 00:00:00 2001
From: John Levon <john.levon@nutanix.com>
Date: Wed, 7 May 2025 16:20:09 +0100
Subject: [PATCH 0777/2760] vfio: add vfio_device_get_irq_info() helper
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add a helper similar to vfio_device_get_region_info() and use it
everywhere.

Replace a couple of needless allocations with stack variables.

As a side-effect, this fixes a minor error reporting issue in the call
from vfio_msix_early_setup().

Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: John Levon <john.levon@nutanix.com>
Link: https://lore.kernel.org/qemu-devel/20250507152020.1254632-5-john.levon@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/ap.c                  | 19 ++++++++++---------
 hw/vfio/ccw.c                 | 20 +++++++++++---------
 hw/vfio/device.c              | 15 +++++++++++++++
 hw/vfio/pci.c                 | 23 +++++++++++------------
 hw/vfio/platform.c            |  6 +++---
 include/hw/vfio/vfio-device.h |  3 +++
 6 files changed, 53 insertions(+), 33 deletions(-)

diff --git a/hw/vfio/ap.c b/hw/vfio/ap.c
index 1207c08d8d..785c0a0197 100644
--- a/hw/vfio/ap.c
+++ b/hw/vfio/ap.c
@@ -74,10 +74,10 @@ static bool vfio_ap_register_irq_notifier(VFIOAPDevice *vapdev,
                                           unsigned int irq, Error **errp)
 {
     int fd;
-    size_t argsz;
+    int ret;
     IOHandler *fd_read;
     EventNotifier *notifier;
-    g_autofree struct vfio_irq_info *irq_info = NULL;
+    struct vfio_irq_info irq_info;
     VFIODevice *vdev = &vapdev->vdev;
 
     switch (irq) {
@@ -96,14 +96,15 @@ static bool vfio_ap_register_irq_notifier(VFIOAPDevice *vapdev,
         return false;
     }
 
-    argsz = sizeof(*irq_info);
-    irq_info = g_malloc0(argsz);
-    irq_info->index = irq;
-    irq_info->argsz = argsz;
+    ret = vfio_device_get_irq_info(vdev, irq, &irq_info);
 
-    if (ioctl(vdev->fd, VFIO_DEVICE_GET_IRQ_INFO,
-              irq_info) < 0 || irq_info->count < 1) {
-        error_setg_errno(errp, errno, "vfio: Error getting irq info");
+    if (ret < 0) {
+        error_setg_errno(errp, -ret, "vfio: Error getting irq info");
+        return false;
+    }
+
+    if (irq_info.count < 1) {
+        error_setg(errp, "vfio: Error getting irq info, count=0");
         return false;
     }
 
diff --git a/hw/vfio/ccw.c b/hw/vfio/ccw.c
index fde0c3fbef..ab3fabf991 100644
--- a/hw/vfio/ccw.c
+++ b/hw/vfio/ccw.c
@@ -376,8 +376,8 @@ static bool vfio_ccw_register_irq_notifier(VFIOCCWDevice *vcdev,
                                            Error **errp)
 {
     VFIODevice *vdev = &vcdev->vdev;
-    g_autofree struct vfio_irq_info *irq_info = NULL;
-    size_t argsz;
+    struct vfio_irq_info irq_info;
+    int ret;
     int fd;
     EventNotifier *notifier;
     IOHandler *fd_read;
@@ -406,13 +406,15 @@ static bool vfio_ccw_register_irq_notifier(VFIOCCWDevice *vcdev,
         return false;
     }
 
-    argsz = sizeof(*irq_info);
-    irq_info = g_malloc0(argsz);
-    irq_info->index = irq;
-    irq_info->argsz = argsz;
-    if (ioctl(vdev->fd, VFIO_DEVICE_GET_IRQ_INFO,
-              irq_info) < 0 || irq_info->count < 1) {
-        error_setg_errno(errp, errno, "vfio: Error getting irq info");
+    ret = vfio_device_get_irq_info(vdev, irq, &irq_info);
+
+    if (ret < 0) {
+        error_setg_errno(errp, -ret, "vfio: Error getting irq info");
+        return false;
+    }
+
+    if (irq_info.count < 1) {
+        error_setg(errp, "vfio: Error getting irq info, count=0");
         return false;
     }
 
diff --git a/hw/vfio/device.c b/hw/vfio/device.c
index 9673b0717e..5d837092cb 100644
--- a/hw/vfio/device.c
+++ b/hw/vfio/device.c
@@ -185,6 +185,21 @@ bool vfio_device_irq_set_signaling(VFIODevice *vbasedev, int index, int subindex
     return false;
 }
 
+int vfio_device_get_irq_info(VFIODevice *vbasedev, int index,
+                             struct vfio_irq_info *info)
+{
+    int ret;
+
+    memset(info, 0, sizeof(*info));
+
+    info->argsz = sizeof(*info);
+    info->index = index;
+
+    ret = ioctl(vbasedev->fd, VFIO_DEVICE_GET_IRQ_INFO, info);
+
+    return ret < 0 ? -errno : ret;
+}
+
 int vfio_device_get_region_info(VFIODevice *vbasedev, int index,
                                 struct vfio_region_info **info)
 {
diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index e1fab21b47..5ccfc67aef 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -1555,8 +1555,7 @@ static bool vfio_msix_early_setup(VFIOPCIDevice *vdev, Error **errp)
     uint16_t ctrl;
     uint32_t table, pba;
     int ret, fd = vdev->vbasedev.fd;
-    struct vfio_irq_info irq_info = { .argsz = sizeof(irq_info),
-                                      .index = VFIO_PCI_MSIX_IRQ_INDEX };
+    struct vfio_irq_info irq_info;
     VFIOMSIXInfo *msix;
 
     pos = pci_find_capability(&vdev->pdev, PCI_CAP_ID_MSIX);
@@ -1593,7 +1592,8 @@ static bool vfio_msix_early_setup(VFIOPCIDevice *vdev, Error **errp)
     msix->pba_offset = pba & ~PCI_MSIX_FLAGS_BIRMASK;
     msix->entries = (ctrl & PCI_MSIX_FLAGS_QSIZE) + 1;
 
-    ret = ioctl(vdev->vbasedev.fd, VFIO_DEVICE_GET_IRQ_INFO, &irq_info);
+    ret = vfio_device_get_irq_info(&vdev->vbasedev, VFIO_PCI_MSIX_IRQ_INDEX,
+                                   &irq_info);
     if (ret < 0) {
         error_setg_errno(errp, -ret, "failed to get MSI-X irq info");
         g_free(msix);
@@ -2736,7 +2736,7 @@ static bool vfio_populate_device(VFIOPCIDevice *vdev, Error **errp)
 {
     VFIODevice *vbasedev = &vdev->vbasedev;
     g_autofree struct vfio_region_info *reg_info = NULL;
-    struct vfio_irq_info irq_info = { .argsz = sizeof(irq_info) };
+    struct vfio_irq_info irq_info;
     int i, ret = -1;
 
     /* Sanity check device */
@@ -2797,12 +2797,10 @@ static bool vfio_populate_device(VFIOPCIDevice *vdev, Error **errp)
         }
     }
 
-    irq_info.index = VFIO_PCI_ERR_IRQ_INDEX;
-
-    ret = ioctl(vdev->vbasedev.fd, VFIO_DEVICE_GET_IRQ_INFO, &irq_info);
+    ret = vfio_device_get_irq_info(vbasedev, VFIO_PCI_ERR_IRQ_INDEX, &irq_info);
     if (ret) {
         /* This can fail for an old kernel or legacy PCI dev */
-        trace_vfio_populate_device_get_irq_info_failure(strerror(errno));
+        trace_vfio_populate_device_get_irq_info_failure(strerror(-ret));
     } else if (irq_info.count == 1) {
         vdev->pci_aer = true;
     } else {
@@ -2911,17 +2909,18 @@ static void vfio_req_notifier_handler(void *opaque)
 
 static void vfio_register_req_notifier(VFIOPCIDevice *vdev)
 {
-    struct vfio_irq_info irq_info = { .argsz = sizeof(irq_info),
-                                      .index = VFIO_PCI_REQ_IRQ_INDEX };
+    struct vfio_irq_info irq_info;
     Error *err = NULL;
     int32_t fd;
+    int ret;
 
     if (!(vdev->features & VFIO_FEATURE_ENABLE_REQ)) {
         return;
     }
 
-    if (ioctl(vdev->vbasedev.fd,
-              VFIO_DEVICE_GET_IRQ_INFO, &irq_info) < 0 || irq_info.count < 1) {
+    ret = vfio_device_get_irq_info(&vdev->vbasedev, VFIO_PCI_REQ_IRQ_INDEX,
+                                   &irq_info);
+    if (ret < 0 || irq_info.count < 1) {
         return;
     }
 
diff --git a/hw/vfio/platform.c b/hw/vfio/platform.c
index ffb3681607..9a21f2e50a 100644
--- a/hw/vfio/platform.c
+++ b/hw/vfio/platform.c
@@ -474,10 +474,10 @@ static bool vfio_populate_device(VFIODevice *vbasedev, Error **errp)
     QSIMPLEQ_INIT(&vdev->pending_intp_queue);
 
     for (i = 0; i < vbasedev->num_irqs; i++) {
-        struct vfio_irq_info irq = { .argsz = sizeof(irq) };
+        struct vfio_irq_info irq;
+
+        ret = vfio_device_get_irq_info(vbasedev, i, &irq);
 
-        irq.index = i;
-        ret = ioctl(vbasedev->fd, VFIO_DEVICE_GET_IRQ_INFO, &irq);
         if (ret) {
             error_setg_errno(errp, -ret, "failed to get device irq info");
             goto irq_err;
diff --git a/include/hw/vfio/vfio-device.h b/include/hw/vfio/vfio-device.h
index 8b1437ba66..a7eaaa31e7 100644
--- a/include/hw/vfio/vfio-device.h
+++ b/include/hw/vfio/vfio-device.h
@@ -147,6 +147,9 @@ int vfio_device_get_region_info(VFIODevice *vbasedev, int index,
 int vfio_device_get_region_info_type(VFIODevice *vbasedev, uint32_t type,
                                      uint32_t subtype, struct vfio_region_info **info);
 bool vfio_device_has_region_cap(VFIODevice *vbasedev, int region, uint16_t cap_type);
+
+int vfio_device_get_irq_info(VFIODevice *vbasedev, int index,
+                                struct vfio_irq_info *info);
 #endif
 
 /* Returns 0 on success, or a negative errno. */

From 2e27becf17be231bc15588a51c0b61efec68d021 Mon Sep 17 00:00:00 2001
From: John Levon <john.levon@nutanix.com>
Date: Wed, 7 May 2025 16:20:10 +0100
Subject: [PATCH 0778/2760] vfio: consistently handle return value for helpers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Various bits of code that call vfio device APIs should consistently use
the "return -errno" approach for passing errors back, rather than
presuming errno is (still) set correctly.

Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: John Levon <john.levon@nutanix.com>
Link: https://lore.kernel.org/qemu-devel/20250507152020.1254632-6-john.levon@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/pci.c | 33 ++++++++++++++++++++-------------
 1 file changed, 20 insertions(+), 13 deletions(-)

diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index 5ccfc67aef..866cf58d04 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -398,7 +398,7 @@ static int vfio_enable_msix_no_vec(VFIOPCIDevice *vdev)
 
     ret = ioctl(vdev->vbasedev.fd, VFIO_DEVICE_SET_IRQS, irq_set);
 
-    return ret;
+    return ret < 0 ? -errno : ret;
 }
 
 static int vfio_enable_vectors(VFIOPCIDevice *vdev, bool msix)
@@ -459,7 +459,7 @@ static int vfio_enable_vectors(VFIOPCIDevice *vdev, bool msix)
 
     g_free(irq_set);
 
-    return ret;
+    return ret < 0 ? -errno : ret;
 }
 
 static void vfio_add_kvm_msi_virq(VFIOPCIDevice *vdev, VFIOMSIVector *vector,
@@ -581,7 +581,8 @@ static int vfio_msix_vector_do_use(PCIDevice *pdev, unsigned int nr,
             vfio_device_irq_disable(&vdev->vbasedev, VFIO_PCI_MSIX_IRQ_INDEX);
             ret = vfio_enable_vectors(vdev, true);
             if (ret) {
-                error_report("vfio: failed to enable vectors, %d", ret);
+                error_report("vfio: failed to enable vectors, %s",
+                             strerror(-ret));
             }
         } else {
             Error *err = NULL;
@@ -695,7 +696,8 @@ static void vfio_msix_enable(VFIOPCIDevice *vdev)
     if (vdev->nr_vectors) {
         ret = vfio_enable_vectors(vdev, true);
         if (ret) {
-            error_report("vfio: failed to enable vectors, %d", ret);
+            error_report("vfio: failed to enable vectors, %s",
+                         strerror(-ret));
         }
     } else {
         /*
@@ -712,7 +714,8 @@ static void vfio_msix_enable(VFIOPCIDevice *vdev)
          */
         ret = vfio_enable_msix_no_vec(vdev);
         if (ret) {
-            error_report("vfio: failed to enable MSI-X, %d", ret);
+            error_report("vfio: failed to enable MSI-X, %s",
+                         strerror(-ret));
         }
     }
 
@@ -765,7 +768,8 @@ retry:
     ret = vfio_enable_vectors(vdev, false);
     if (ret) {
         if (ret < 0) {
-            error_report("vfio: Error: Failed to setup MSI fds: %m");
+            error_report("vfio: Error: Failed to setup MSI fds: %s",
+                         strerror(-ret));
         } else {
             error_report("vfio: Error: Failed to enable %d "
                          "MSI vectors, retry with %d", vdev->nr_vectors, ret);
@@ -882,17 +886,21 @@ static void vfio_update_msi(VFIOPCIDevice *vdev)
 static void vfio_pci_load_rom(VFIOPCIDevice *vdev)
 {
     g_autofree struct vfio_region_info *reg_info = NULL;
+    VFIODevice *vbasedev = &vdev->vbasedev;
     uint64_t size;
     off_t off = 0;
     ssize_t bytes;
+    int ret;
 
-    if (vfio_device_get_region_info(&vdev->vbasedev,
-                                    VFIO_PCI_ROM_REGION_INDEX, &reg_info)) {
-        error_report("vfio: Error getting ROM info: %m");
+    ret = vfio_device_get_region_info(vbasedev, VFIO_PCI_ROM_REGION_INDEX,
+                                      &reg_info);
+
+    if (ret != 0) {
+        error_report("vfio: Error getting ROM info: %s", strerror(-ret));
         return;
     }
 
-    trace_vfio_pci_load_rom(vdev->vbasedev.name, (unsigned long)reg_info->size,
+    trace_vfio_pci_load_rom(vbasedev->name, (unsigned long)reg_info->size,
                             (unsigned long)reg_info->offset,
                             (unsigned long)reg_info->flags);
 
@@ -901,8 +909,7 @@ static void vfio_pci_load_rom(VFIOPCIDevice *vdev)
 
     if (!vdev->rom_size) {
         vdev->rom_read_failed = true;
-        error_report("vfio-pci: Cannot read device rom at "
-                    "%s", vdev->vbasedev.name);
+        error_report("vfio-pci: Cannot read device rom at %s", vbasedev->name);
         error_printf("Device option ROM contents are probably invalid "
                     "(check dmesg).\nSkip option ROM probe with rombar=0, "
                     "or load from file with romfile=\n");
@@ -913,7 +920,7 @@ static void vfio_pci_load_rom(VFIOPCIDevice *vdev)
     memset(vdev->rom, 0xff, size);
 
     while (size) {
-        bytes = pread(vdev->vbasedev.fd, vdev->rom + off,
+        bytes = pread(vbasedev->fd, vdev->rom + off,
                       size, vdev->rom_offset + off);
         if (bytes == 0) {
             break;

From 5363a1a117ea6e1af520d1faed303f944975f760 Mon Sep 17 00:00:00 2001
From: John Levon <john.levon@nutanix.com>
Date: Wed, 7 May 2025 16:20:11 +0100
Subject: [PATCH 0779/2760] vfio: add strread/writeerror()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add simple helpers to correctly report failures from read/write routines
using the return -errno style.

Signed-off-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250507152020.1254632-7-john.levon@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 include/hw/vfio/vfio-device.h | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/include/hw/vfio/vfio-device.h b/include/hw/vfio/vfio-device.h
index a7eaaa31e7..4a32202943 100644
--- a/include/hw/vfio/vfio-device.h
+++ b/include/hw/vfio/vfio-device.h
@@ -115,6 +115,20 @@ struct VFIODeviceOps {
     int (*vfio_load_config)(VFIODevice *vdev, QEMUFile *f);
 };
 
+/*
+ * Given a return value of either a short number of bytes read or -errno,
+ * construct a meaningful error message.
+ */
+#define strreaderror(ret) \
+    (ret < 0 ? strerror(-ret) : "short read")
+
+/*
+ * Given a return value of either a short number of bytes written or -errno,
+ * construct a meaningful error message.
+ */
+#define strwriteerror(ret) \
+    (ret < 0 ? strerror(-ret) : "short write")
+
 void vfio_device_irq_disable(VFIODevice *vbasedev, int index);
 void vfio_device_irq_unmask(VFIODevice *vbasedev, int index);
 void vfio_device_irq_mask(VFIODevice *vbasedev, int index);

From cae04b56347be59718f1a778d0ad588a205bf409 Mon Sep 17 00:00:00 2001
From: John Levon <john.levon@nutanix.com>
Date: Wed, 7 May 2025 16:20:12 +0100
Subject: [PATCH 0780/2760] vfio: add vfio_pci_config_space_read/write()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add these helpers that access config space and return an -errno style
return.

Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: John Levon <john.levon@nutanix.com>
Link: https://lore.kernel.org/qemu-devel/20250507152020.1254632-8-john.levon@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/pci.c | 123 ++++++++++++++++++++++++++++++++------------------
 1 file changed, 80 insertions(+), 43 deletions(-)

diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index 866cf58d04..f65c9463ce 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -967,6 +967,28 @@ static void vfio_pci_load_rom(VFIOPCIDevice *vdev)
     }
 }
 
+/* "Raw" read of underlying config space. */
+static int vfio_pci_config_space_read(VFIOPCIDevice *vdev, off_t offset,
+                                      uint32_t size, void *data)
+{
+    ssize_t ret;
+
+    ret = pread(vdev->vbasedev.fd, data, size, vdev->config_offset + offset);
+
+    return ret < 0 ? -errno : (int)ret;
+}
+
+/* "Raw" write of underlying config space. */
+static int vfio_pci_config_space_write(VFIOPCIDevice *vdev, off_t offset,
+                                       uint32_t size, void *data)
+{
+    ssize_t ret;
+
+    ret = pwrite(vdev->vbasedev.fd, data, size, vdev->config_offset + offset);
+
+    return ret < 0 ? -errno : (int)ret;
+}
+
 static uint64_t vfio_rom_read(void *opaque, hwaddr addr, unsigned size)
 {
     VFIOPCIDevice *vdev = opaque;
@@ -1019,10 +1041,9 @@ static const MemoryRegionOps vfio_rom_ops = {
 
 static void vfio_pci_size_rom(VFIOPCIDevice *vdev)
 {
+    VFIODevice *vbasedev = &vdev->vbasedev;
     uint32_t orig, size = cpu_to_le32((uint32_t)PCI_ROM_ADDRESS_MASK);
-    off_t offset = vdev->config_offset + PCI_ROM_ADDRESS;
     char *name;
-    int fd = vdev->vbasedev.fd;
 
     if (vdev->pdev.romfile || !vdev->pdev.rom_bar) {
         /* Since pci handles romfile, just print a message and return */
@@ -1039,11 +1060,12 @@ static void vfio_pci_size_rom(VFIOPCIDevice *vdev)
      * Use the same size ROM BAR as the physical device.  The contents
      * will get filled in later when the guest tries to read it.
      */
-    if (pread(fd, &orig, 4, offset) != 4 ||
-        pwrite(fd, &size, 4, offset) != 4 ||
-        pread(fd, &size, 4, offset) != 4 ||
-        pwrite(fd, &orig, 4, offset) != 4) {
-        error_report("%s(%s) failed: %m", __func__, vdev->vbasedev.name);
+    if (vfio_pci_config_space_read(vdev, PCI_ROM_ADDRESS, 4, &orig) != 4 ||
+        vfio_pci_config_space_write(vdev, PCI_ROM_ADDRESS, 4, &size) != 4 ||
+        vfio_pci_config_space_read(vdev, PCI_ROM_ADDRESS, 4, &size) != 4 ||
+        vfio_pci_config_space_write(vdev, PCI_ROM_ADDRESS, 4, &orig) != 4) {
+
+        error_report("%s(%s) ROM access failed", __func__, vbasedev->name);
         return;
     }
 
@@ -1223,6 +1245,7 @@ static void vfio_sub_page_bar_update_mapping(PCIDevice *pdev, int bar)
 uint32_t vfio_pci_read_config(PCIDevice *pdev, uint32_t addr, int len)
 {
     VFIOPCIDevice *vdev = VFIO_PCI(pdev);
+    VFIODevice *vbasedev = &vdev->vbasedev;
     uint32_t emu_bits = 0, emu_val = 0, phys_val = 0, val;
 
     memcpy(&emu_bits, vdev->emulated_config_bits + addr, len);
@@ -1235,12 +1258,12 @@ uint32_t vfio_pci_read_config(PCIDevice *pdev, uint32_t addr, int len)
     if (~emu_bits & (0xffffffffU >> (32 - len * 8))) {
         ssize_t ret;
 
-        ret = pread(vdev->vbasedev.fd, &phys_val, len,
-                    vdev->config_offset + addr);
+        ret = vfio_pci_config_space_read(vdev, addr, len, &phys_val);
         if (ret != len) {
-            error_report("%s(%s, 0x%x, 0x%x) failed: %m",
-                         __func__, vdev->vbasedev.name, addr, len);
-            return -errno;
+            error_report("%s(%s, 0x%x, 0x%x) failed: %s",
+                         __func__, vbasedev->name, addr, len,
+                         strreaderror(ret));
+            return -1;
         }
         phys_val = le32_to_cpu(phys_val);
     }
@@ -1256,15 +1279,18 @@ void vfio_pci_write_config(PCIDevice *pdev,
                            uint32_t addr, uint32_t val, int len)
 {
     VFIOPCIDevice *vdev = VFIO_PCI(pdev);
+    VFIODevice *vbasedev = &vdev->vbasedev;
     uint32_t val_le = cpu_to_le32(val);
+    int ret;
 
     trace_vfio_pci_write_config(vdev->vbasedev.name, addr, val, len);
 
     /* Write everything to VFIO, let it filter out what we can't write */
-    if (pwrite(vdev->vbasedev.fd, &val_le, len, vdev->config_offset + addr)
-                != len) {
-        error_report("%s(%s, 0x%x, 0x%x, 0x%x) failed: %m",
-                     __func__, vdev->vbasedev.name, addr, val, len);
+    ret = vfio_pci_config_space_write(vdev, addr, len, &val_le);
+    if (ret != len) {
+        error_report("%s(%s, 0x%x, 0x%x, 0x%x) failed: %s",
+                     __func__, vbasedev->name, addr, val, len,
+                    strwriteerror(ret));
     }
 
     /* MSI/MSI-X Enabling/Disabling */
@@ -1352,9 +1378,11 @@ static bool vfio_msi_setup(VFIOPCIDevice *vdev, int pos, Error **errp)
     int ret, entries;
     Error *err = NULL;
 
-    if (pread(vdev->vbasedev.fd, &ctrl, sizeof(ctrl),
-              vdev->config_offset + pos + PCI_CAP_FLAGS) != sizeof(ctrl)) {
-        error_setg_errno(errp, errno, "failed reading MSI PCI_CAP_FLAGS");
+    ret = vfio_pci_config_space_read(vdev, pos + PCI_CAP_FLAGS,
+                                     sizeof(ctrl), &ctrl);
+    if (ret != sizeof(ctrl)) {
+        error_setg(errp, "failed reading MSI PCI_CAP_FLAGS: %s",
+                   strreaderror(ret));
         return false;
     }
     ctrl = le16_to_cpu(ctrl);
@@ -1561,30 +1589,35 @@ static bool vfio_msix_early_setup(VFIOPCIDevice *vdev, Error **errp)
     uint8_t pos;
     uint16_t ctrl;
     uint32_t table, pba;
-    int ret, fd = vdev->vbasedev.fd;
     struct vfio_irq_info irq_info;
     VFIOMSIXInfo *msix;
+    int ret;
 
     pos = pci_find_capability(&vdev->pdev, PCI_CAP_ID_MSIX);
     if (!pos) {
         return true;
     }
 
-    if (pread(fd, &ctrl, sizeof(ctrl),
-              vdev->config_offset + pos + PCI_MSIX_FLAGS) != sizeof(ctrl)) {
-        error_setg_errno(errp, errno, "failed to read PCI MSIX FLAGS");
+    ret = vfio_pci_config_space_read(vdev, pos + PCI_MSIX_FLAGS,
+                                     sizeof(ctrl), &ctrl);
+    if (ret != sizeof(ctrl)) {
+        error_setg(errp, "failed to read PCI MSIX FLAGS: %s",
+                   strreaderror(ret));
         return false;
     }
 
-    if (pread(fd, &table, sizeof(table),
-              vdev->config_offset + pos + PCI_MSIX_TABLE) != sizeof(table)) {
-        error_setg_errno(errp, errno, "failed to read PCI MSIX TABLE");
+    ret = vfio_pci_config_space_read(vdev, pos + PCI_MSIX_TABLE,
+                                     sizeof(table), &table);
+    if (ret != sizeof(table)) {
+        error_setg(errp, "failed to read PCI MSIX TABLE: %s",
+                   strreaderror(ret));
         return false;
     }
 
-    if (pread(fd, &pba, sizeof(pba),
-              vdev->config_offset + pos + PCI_MSIX_PBA) != sizeof(pba)) {
-        error_setg_errno(errp, errno, "failed to read PCI MSIX PBA");
+    ret = vfio_pci_config_space_read(vdev, pos + PCI_MSIX_PBA,
+                                     sizeof(pba), &pba);
+    if (ret != sizeof(pba)) {
+        error_setg(errp, "failed to read PCI MSIX PBA: %s", strreaderror(ret));
         return false;
     }
 
@@ -1744,10 +1777,10 @@ static void vfio_bar_prepare(VFIOPCIDevice *vdev, int nr)
     }
 
     /* Determine what type of BAR this is for registration */
-    ret = pread(vdev->vbasedev.fd, &pci_bar, sizeof(pci_bar),
-                vdev->config_offset + PCI_BASE_ADDRESS_0 + (4 * nr));
+    ret = vfio_pci_config_space_read(vdev, PCI_BASE_ADDRESS_0 + (4 * nr),
+                                     sizeof(pci_bar), &pci_bar);
     if (ret != sizeof(pci_bar)) {
-        error_report("vfio: Failed to read BAR %d (%m)", nr);
+        error_report("vfio: Failed to read BAR %d: %s", nr, strreaderror(ret));
         return;
     }
 
@@ -2450,21 +2483,23 @@ void vfio_pci_pre_reset(VFIOPCIDevice *vdev)
 
 void vfio_pci_post_reset(VFIOPCIDevice *vdev)
 {
+    VFIODevice *vbasedev = &vdev->vbasedev;
     Error *err = NULL;
-    int nr;
+    int ret, nr;
 
     if (!vfio_intx_enable(vdev, &err)) {
         error_reportf_err(err, VFIO_MSG_PREFIX, vdev->vbasedev.name);
     }
 
     for (nr = 0; nr < PCI_NUM_REGIONS - 1; ++nr) {
-        off_t addr = vdev->config_offset + PCI_BASE_ADDRESS_0 + (4 * nr);
+        off_t addr = PCI_BASE_ADDRESS_0 + (4 * nr);
         uint32_t val = 0;
         uint32_t len = sizeof(val);
 
-        if (pwrite(vdev->vbasedev.fd, &val, len, addr) != len) {
-            error_report("%s(%s) reset bar %d failed: %m", __func__,
-                         vdev->vbasedev.name, nr);
+        ret = vfio_pci_config_space_write(vdev, addr, len, &val);
+        if (ret != len) {
+            error_report("%s(%s) reset bar %d failed: %s", __func__,
+                         vbasedev->name, nr, strwriteerror(ret));
         }
     }
 
@@ -3101,6 +3136,7 @@ static void vfio_realize(PCIDevice *pdev, Error **errp)
     int i, ret;
     char uuid[UUID_STR_LEN];
     g_autofree char *name = NULL;
+    uint32_t config_space_size;
 
     if (vbasedev->fd < 0 && !vbasedev->sysfsdev) {
         if (!(~vdev->host.domain || ~vdev->host.bus ||
@@ -3155,13 +3191,14 @@ static void vfio_realize(PCIDevice *pdev, Error **errp)
         goto error;
     }
 
+    config_space_size = MIN(pci_config_size(&vdev->pdev), vdev->config_size);
+
     /* Get a copy of config space */
-    ret = pread(vbasedev->fd, vdev->pdev.config,
-                MIN(pci_config_size(&vdev->pdev), vdev->config_size),
-                vdev->config_offset);
-    if (ret < (int)MIN(pci_config_size(&vdev->pdev), vdev->config_size)) {
-        ret = ret < 0 ? -errno : -EFAULT;
-        error_setg_errno(errp, -ret, "failed to read device config space");
+    ret = vfio_pci_config_space_read(vdev, 0, config_space_size,
+                                     vdev->pdev.config);
+    if (ret < (int)config_space_size) {
+        ret = ret < 0 ? -ret : EFAULT;
+        error_setg_errno(errp, ret, "failed to read device config space");
         goto error;
     }
 

From 5a22b505914bcb1d19a533eb5a36c907169b5ee3 Mon Sep 17 00:00:00 2001
From: John Levon <john.levon@nutanix.com>
Date: Wed, 7 May 2025 16:20:13 +0100
Subject: [PATCH 0781/2760] vfio: add unmap_all flag to DMA unmap callback
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We'll use this parameter shortly; this just adds the plumbing.

Signed-off-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250507152020.1254632-9-john.levon@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/container-base.c              |  4 ++--
 hw/vfio/container.c                   |  8 ++++++--
 hw/vfio/iommufd.c                     |  6 +++++-
 hw/vfio/listener.c                    |  8 ++++----
 include/hw/vfio/vfio-container-base.h | 15 +++++++++++++--
 5 files changed, 30 insertions(+), 11 deletions(-)

diff --git a/hw/vfio/container-base.c b/hw/vfio/container-base.c
index 09340fd97a..3ff473a45c 100644
--- a/hw/vfio/container-base.c
+++ b/hw/vfio/container-base.c
@@ -85,12 +85,12 @@ int vfio_container_dma_map(VFIOContainerBase *bcontainer,
 
 int vfio_container_dma_unmap(VFIOContainerBase *bcontainer,
                              hwaddr iova, ram_addr_t size,
-                             IOMMUTLBEntry *iotlb)
+                             IOMMUTLBEntry *iotlb, bool unmap_all)
 {
     VFIOIOMMUClass *vioc = VFIO_IOMMU_GET_CLASS(bcontainer);
 
     g_assert(vioc->dma_unmap);
-    return vioc->dma_unmap(bcontainer, iova, size, iotlb);
+    return vioc->dma_unmap(bcontainer, iova, size, iotlb, unmap_all);
 }
 
 bool vfio_container_add_section_window(VFIOContainerBase *bcontainer,
diff --git a/hw/vfio/container.c b/hw/vfio/container.c
index cf23aa799f..d5f4e66f1c 100644
--- a/hw/vfio/container.c
+++ b/hw/vfio/container.c
@@ -124,7 +124,7 @@ unmap_exit:
  */
 static int vfio_legacy_dma_unmap(const VFIOContainerBase *bcontainer,
                                  hwaddr iova, ram_addr_t size,
-                                 IOMMUTLBEntry *iotlb)
+                                 IOMMUTLBEntry *iotlb, bool unmap_all)
 {
     const VFIOContainer *container = container_of(bcontainer, VFIOContainer,
                                                   bcontainer);
@@ -138,6 +138,10 @@ static int vfio_legacy_dma_unmap(const VFIOContainerBase *bcontainer,
     int ret;
     Error *local_err = NULL;
 
+    if (unmap_all) {
+        return -ENOTSUP;
+    }
+
     if (iotlb && vfio_container_dirty_tracking_is_started(bcontainer)) {
         if (!vfio_container_devices_dirty_tracking_is_supported(bcontainer) &&
             bcontainer->dirty_pages_supported) {
@@ -205,7 +209,7 @@ static int vfio_legacy_dma_map(const VFIOContainerBase *bcontainer, hwaddr iova,
      */
     if (ioctl(container->fd, VFIO_IOMMU_MAP_DMA, &map) == 0 ||
         (errno == EBUSY &&
-         vfio_legacy_dma_unmap(bcontainer, iova, size, NULL) == 0 &&
+         vfio_legacy_dma_unmap(bcontainer, iova, size, NULL, false) == 0 &&
          ioctl(container->fd, VFIO_IOMMU_MAP_DMA, &map) == 0)) {
         return 0;
     }
diff --git a/hw/vfio/iommufd.c b/hw/vfio/iommufd.c
index 62ecb758f1..6b2764c044 100644
--- a/hw/vfio/iommufd.c
+++ b/hw/vfio/iommufd.c
@@ -46,11 +46,15 @@ static int iommufd_cdev_map(const VFIOContainerBase *bcontainer, hwaddr iova,
 
 static int iommufd_cdev_unmap(const VFIOContainerBase *bcontainer,
                               hwaddr iova, ram_addr_t size,
-                              IOMMUTLBEntry *iotlb)
+                              IOMMUTLBEntry *iotlb, bool unmap_all)
 {
     const VFIOIOMMUFDContainer *container =
         container_of(bcontainer, VFIOIOMMUFDContainer, bcontainer);
 
+    if (unmap_all) {
+        return -ENOTSUP;
+    }
+
     /* TODO: Handle dma_unmap_bitmap with iotlb args (migration) */
     return iommufd_backend_unmap_dma(container->be,
                                      container->ioas_id, iova, size);
diff --git a/hw/vfio/listener.c b/hw/vfio/listener.c
index 6f77e18a7a..c5183700db 100644
--- a/hw/vfio/listener.c
+++ b/hw/vfio/listener.c
@@ -172,7 +172,7 @@ static void vfio_iommu_map_notify(IOMMUNotifier *n, IOMMUTLBEntry *iotlb)
         }
     } else {
         ret = vfio_container_dma_unmap(bcontainer, iova,
-                                       iotlb->addr_mask + 1, iotlb);
+                                       iotlb->addr_mask + 1, iotlb, false);
         if (ret) {
             error_setg(&local_err,
                        "vfio_container_dma_unmap(%p, 0x%"HWADDR_PRIx", "
@@ -201,7 +201,7 @@ static void vfio_ram_discard_notify_discard(RamDiscardListener *rdl,
     int ret;
 
     /* Unmap with a single call. */
-    ret = vfio_container_dma_unmap(bcontainer, iova, size , NULL);
+    ret = vfio_container_dma_unmap(bcontainer, iova, size , NULL, false);
     if (ret) {
         error_report("%s: vfio_container_dma_unmap() failed: %s", __func__,
                      strerror(-ret));
@@ -638,7 +638,7 @@ static void vfio_listener_region_del(MemoryListener *listener,
             /* The unmap ioctl doesn't accept a full 64-bit span. */
             llsize = int128_rshift(llsize, 1);
             ret = vfio_container_dma_unmap(bcontainer, iova,
-                                           int128_get64(llsize), NULL);
+                                           int128_get64(llsize), NULL, false);
             if (ret) {
                 error_report("vfio_container_dma_unmap(%p, 0x%"HWADDR_PRIx", "
                              "0x%"HWADDR_PRIx") = %d (%s)",
@@ -648,7 +648,7 @@ static void vfio_listener_region_del(MemoryListener *listener,
             iova += int128_get64(llsize);
         }
         ret = vfio_container_dma_unmap(bcontainer, iova,
-                                       int128_get64(llsize), NULL);
+                                       int128_get64(llsize), NULL, false);
         if (ret) {
             error_report("vfio_container_dma_unmap(%p, 0x%"HWADDR_PRIx", "
                          "0x%"HWADDR_PRIx") = %d (%s)",
diff --git a/include/hw/vfio/vfio-container-base.h b/include/hw/vfio/vfio-container-base.h
index 5527e02722..59f07d26e8 100644
--- a/include/hw/vfio/vfio-container-base.h
+++ b/include/hw/vfio/vfio-container-base.h
@@ -81,7 +81,7 @@ int vfio_container_dma_map(VFIOContainerBase *bcontainer,
                            void *vaddr, bool readonly);
 int vfio_container_dma_unmap(VFIOContainerBase *bcontainer,
                              hwaddr iova, ram_addr_t size,
-                             IOMMUTLBEntry *iotlb);
+                             IOMMUTLBEntry *iotlb, bool unmap_all);
 bool vfio_container_add_section_window(VFIOContainerBase *bcontainer,
                                        MemoryRegionSection *section,
                                        Error **errp);
@@ -120,9 +120,20 @@ struct VFIOIOMMUClass {
     int (*dma_map)(const VFIOContainerBase *bcontainer,
                    hwaddr iova, ram_addr_t size,
                    void *vaddr, bool readonly);
+    /**
+     * @dma_unmap
+     *
+     * Unmap an address range from the container.
+     *
+     * @bcontainer: #VFIOContainerBase to use for unmap
+     * @iova: start address to unmap
+     * @size: size of the range to unmap
+     * @iotlb: The IOMMU TLB mapping entry (or NULL)
+     * @unmap_all: if set, unmap the entire address space
+     */
     int (*dma_unmap)(const VFIOContainerBase *bcontainer,
                      hwaddr iova, ram_addr_t size,
-                     IOMMUTLBEntry *iotlb);
+                     IOMMUTLBEntry *iotlb, bool unmap_all);
     bool (*attach_device)(const char *name, VFIODevice *vbasedev,
                           AddressSpace *as, Error **errp);
     void (*detach_device)(VFIODevice *vbasedev);

From 9458d9b4dc6a9d1c51772fc8a29a48ab47521430 Mon Sep 17 00:00:00 2001
From: John Levon <john.levon@nutanix.com>
Date: Wed, 7 May 2025 16:20:14 +0100
Subject: [PATCH 0782/2760] vfio: implement unmap all for DMA unmap callbacks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Handle unmap_all in the DMA unmap handlers rather than in the caller.

Signed-off-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250507152020.1254632-10-john.levon@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/container.c | 41 +++++++++++++++++++++++++++++++----------
 hw/vfio/iommufd.c   | 15 ++++++++++++++-
 hw/vfio/listener.c  | 19 ++++++-------------
 3 files changed, 51 insertions(+), 24 deletions(-)

diff --git a/hw/vfio/container.c b/hw/vfio/container.c
index d5f4e66f1c..a9f0dbaec4 100644
--- a/hw/vfio/container.c
+++ b/hw/vfio/container.c
@@ -119,12 +119,9 @@ unmap_exit:
     return ret;
 }
 
-/*
- * DMA - Mapping and unmapping for the "type1" IOMMU interface used on x86
- */
-static int vfio_legacy_dma_unmap(const VFIOContainerBase *bcontainer,
-                                 hwaddr iova, ram_addr_t size,
-                                 IOMMUTLBEntry *iotlb, bool unmap_all)
+static int vfio_legacy_dma_unmap_one(const VFIOContainerBase *bcontainer,
+                                     hwaddr iova, ram_addr_t size,
+                                     IOMMUTLBEntry *iotlb)
 {
     const VFIOContainer *container = container_of(bcontainer, VFIOContainer,
                                                   bcontainer);
@@ -138,10 +135,6 @@ static int vfio_legacy_dma_unmap(const VFIOContainerBase *bcontainer,
     int ret;
     Error *local_err = NULL;
 
-    if (unmap_all) {
-        return -ENOTSUP;
-    }
-
     if (iotlb && vfio_container_dirty_tracking_is_started(bcontainer)) {
         if (!vfio_container_devices_dirty_tracking_is_supported(bcontainer) &&
             bcontainer->dirty_pages_supported) {
@@ -185,6 +178,34 @@ static int vfio_legacy_dma_unmap(const VFIOContainerBase *bcontainer,
     return 0;
 }
 
+/*
+ * DMA - Mapping and unmapping for the "type1" IOMMU interface used on x86
+ */
+static int vfio_legacy_dma_unmap(const VFIOContainerBase *bcontainer,
+                                 hwaddr iova, ram_addr_t size,
+                                 IOMMUTLBEntry *iotlb, bool unmap_all)
+{
+    int ret;
+
+    if (unmap_all) {
+        /* The unmap ioctl doesn't accept a full 64-bit span. */
+        Int128 llsize = int128_rshift(int128_2_64(), 1);
+
+        ret = vfio_legacy_dma_unmap_one(bcontainer, 0, int128_get64(llsize),
+                                        iotlb);
+
+        if (ret == 0) {
+            ret = vfio_legacy_dma_unmap_one(bcontainer, int128_get64(llsize),
+                                            int128_get64(llsize), iotlb);
+        }
+
+    } else {
+        ret = vfio_legacy_dma_unmap_one(bcontainer, iova, size, iotlb);
+    }
+
+    return ret;
+}
+
 static int vfio_legacy_dma_map(const VFIOContainerBase *bcontainer, hwaddr iova,
                                ram_addr_t size, void *vaddr, bool readonly)
 {
diff --git a/hw/vfio/iommufd.c b/hw/vfio/iommufd.c
index 6b2764c044..af1c7ab10a 100644
--- a/hw/vfio/iommufd.c
+++ b/hw/vfio/iommufd.c
@@ -51,8 +51,21 @@ static int iommufd_cdev_unmap(const VFIOContainerBase *bcontainer,
     const VFIOIOMMUFDContainer *container =
         container_of(bcontainer, VFIOIOMMUFDContainer, bcontainer);
 
+    /* unmap in halves */
     if (unmap_all) {
-        return -ENOTSUP;
+        Int128 llsize = int128_rshift(int128_2_64(), 1);
+        int ret;
+
+        ret = iommufd_backend_unmap_dma(container->be, container->ioas_id,
+                                        0, int128_get64(llsize));
+
+        if (ret == 0) {
+            ret = iommufd_backend_unmap_dma(container->be, container->ioas_id,
+                                            int128_get64(llsize),
+                                            int128_get64(llsize));
+        }
+
+        return ret;
     }
 
     /* TODO: Handle dma_unmap_bitmap with iotlb args (migration) */
diff --git a/hw/vfio/listener.c b/hw/vfio/listener.c
index c5183700db..e7ade7d62e 100644
--- a/hw/vfio/listener.c
+++ b/hw/vfio/listener.c
@@ -634,21 +634,14 @@ static void vfio_listener_region_del(MemoryListener *listener,
     }
 
     if (try_unmap) {
+        bool unmap_all = false;
+
         if (int128_eq(llsize, int128_2_64())) {
-            /* The unmap ioctl doesn't accept a full 64-bit span. */
-            llsize = int128_rshift(llsize, 1);
-            ret = vfio_container_dma_unmap(bcontainer, iova,
-                                           int128_get64(llsize), NULL, false);
-            if (ret) {
-                error_report("vfio_container_dma_unmap(%p, 0x%"HWADDR_PRIx", "
-                             "0x%"HWADDR_PRIx") = %d (%s)",
-                             bcontainer, iova, int128_get64(llsize), ret,
-                             strerror(-ret));
-            }
-            iova += int128_get64(llsize);
+            unmap_all = true;
+            llsize = int128_zero();
         }
-        ret = vfio_container_dma_unmap(bcontainer, iova,
-                                       int128_get64(llsize), NULL, false);
+        ret = vfio_container_dma_unmap(bcontainer, iova, int128_get64(llsize),
+                                       NULL, unmap_all);
         if (ret) {
             error_report("vfio_container_dma_unmap(%p, 0x%"HWADDR_PRIx", "
                          "0x%"HWADDR_PRIx") = %d (%s)",

From 38bf025d0dc80c1ae6e8f36093c5145c08b332d9 Mon Sep 17 00:00:00 2001
From: John Levon <john.levon@nutanix.com>
Date: Wed, 7 May 2025 16:20:15 +0100
Subject: [PATCH 0783/2760] vfio: add device IO ops vector
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

For vfio-user, device operations such as IRQ handling and region
read/writes are implemented in userspace over the control socket, not
ioctl() to the vfio kernel driver; add an ops vector to generalize this,
and implement vfio_device_io_ops_ioctl for interacting with the kernel
vfio driver.

Originally-by: John Johnson <john.g.johnson@oracle.com>
Signed-off-by: Elena Ufimtseva <elena.ufimtseva@oracle.com>
Signed-off-by: Jagannathan Raman <jag.raman@oracle.com>
Signed-off-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250507152020.1254632-11-john.levon@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/container-base.c      |  6 +--
 hw/vfio/device.c              | 74 +++++++++++++++++++++++++++++------
 hw/vfio/listener.c            | 13 +++---
 hw/vfio/pci.c                 | 10 ++---
 include/hw/vfio/vfio-device.h | 38 ++++++++++++++++++
 5 files changed, 114 insertions(+), 27 deletions(-)

diff --git a/hw/vfio/container-base.c b/hw/vfio/container-base.c
index 3ff473a45c..1c6ca94b60 100644
--- a/hw/vfio/container-base.c
+++ b/hw/vfio/container-base.c
@@ -198,11 +198,7 @@ static int vfio_device_dma_logging_report(VFIODevice *vbasedev, hwaddr iova,
     feature->flags = VFIO_DEVICE_FEATURE_GET |
                      VFIO_DEVICE_FEATURE_DMA_LOGGING_REPORT;
 
-    if (ioctl(vbasedev->fd, VFIO_DEVICE_FEATURE, feature)) {
-        return -errno;
-    }
-
-    return 0;
+    return vbasedev->io_ops->device_feature(vbasedev, feature);
 }
 
 static int vfio_container_iommu_query_dirty_bitmap(const VFIOContainerBase *bcontainer,
diff --git a/hw/vfio/device.c b/hw/vfio/device.c
index 5d837092cb..40a196bfb9 100644
--- a/hw/vfio/device.c
+++ b/hw/vfio/device.c
@@ -82,7 +82,7 @@ void vfio_device_irq_disable(VFIODevice *vbasedev, int index)
         .count = 0,
     };
 
-    ioctl(vbasedev->fd, VFIO_DEVICE_SET_IRQS, &irq_set);
+    vbasedev->io_ops->set_irqs(vbasedev, &irq_set);
 }
 
 void vfio_device_irq_unmask(VFIODevice *vbasedev, int index)
@@ -95,7 +95,7 @@ void vfio_device_irq_unmask(VFIODevice *vbasedev, int index)
         .count = 1,
     };
 
-    ioctl(vbasedev->fd, VFIO_DEVICE_SET_IRQS, &irq_set);
+    vbasedev->io_ops->set_irqs(vbasedev, &irq_set);
 }
 
 void vfio_device_irq_mask(VFIODevice *vbasedev, int index)
@@ -108,7 +108,7 @@ void vfio_device_irq_mask(VFIODevice *vbasedev, int index)
         .count = 1,
     };
 
-    ioctl(vbasedev->fd, VFIO_DEVICE_SET_IRQS, &irq_set);
+    vbasedev->io_ops->set_irqs(vbasedev, &irq_set);
 }
 
 static inline const char *action_to_str(int action)
@@ -167,7 +167,7 @@ bool vfio_device_irq_set_signaling(VFIODevice *vbasedev, int index, int subindex
     pfd = (int32_t *)&irq_set->data;
     *pfd = fd;
 
-    if (!ioctl(vbasedev->fd, VFIO_DEVICE_SET_IRQS, irq_set)) {
+    if (!vbasedev->io_ops->set_irqs(vbasedev, irq_set)) {
         return true;
     }
 
@@ -188,22 +188,19 @@ bool vfio_device_irq_set_signaling(VFIODevice *vbasedev, int index, int subindex
 int vfio_device_get_irq_info(VFIODevice *vbasedev, int index,
                              struct vfio_irq_info *info)
 {
-    int ret;
-
     memset(info, 0, sizeof(*info));
 
     info->argsz = sizeof(*info);
     info->index = index;
 
-    ret = ioctl(vbasedev->fd, VFIO_DEVICE_GET_IRQ_INFO, info);
-
-    return ret < 0 ? -errno : ret;
+    return vbasedev->io_ops->get_irq_info(vbasedev, info);
 }
 
 int vfio_device_get_region_info(VFIODevice *vbasedev, int index,
                                 struct vfio_region_info **info)
 {
     size_t argsz = sizeof(struct vfio_region_info);
+    int ret;
 
     *info = g_malloc0(argsz);
 
@@ -211,10 +208,11 @@ int vfio_device_get_region_info(VFIODevice *vbasedev, int index,
 retry:
     (*info)->argsz = argsz;
 
-    if (ioctl(vbasedev->fd, VFIO_DEVICE_GET_REGION_INFO, *info)) {
+    ret = vbasedev->io_ops->get_region_info(vbasedev, *info);
+    if (ret != 0) {
         g_free(*info);
         *info = NULL;
-        return -errno;
+        return ret;
     }
 
     if ((*info)->argsz > argsz) {
@@ -320,11 +318,14 @@ void vfio_device_set_fd(VFIODevice *vbasedev, const char *str, Error **errp)
     vbasedev->fd = fd;
 }
 
+static VFIODeviceIOOps vfio_device_io_ops_ioctl;
+
 void vfio_device_init(VFIODevice *vbasedev, int type, VFIODeviceOps *ops,
                       DeviceState *dev, bool ram_discard)
 {
     vbasedev->type = type;
     vbasedev->ops = ops;
+    vbasedev->io_ops = &vfio_device_io_ops_ioctl;
     vbasedev->dev = dev;
     vbasedev->fd = -1;
 
@@ -442,3 +443,54 @@ void vfio_device_unprepare(VFIODevice *vbasedev)
     QLIST_REMOVE(vbasedev, global_next);
     vbasedev->bcontainer = NULL;
 }
+
+/*
+ * Traditional ioctl() based io
+ */
+
+static int vfio_device_io_device_feature(VFIODevice *vbasedev,
+                                         struct vfio_device_feature *feature)
+{
+    int ret;
+
+    ret = ioctl(vbasedev->fd, VFIO_DEVICE_FEATURE, feature);
+
+    return ret < 0 ? -errno : ret;
+}
+
+static int vfio_device_io_get_region_info(VFIODevice *vbasedev,
+                                          struct vfio_region_info *info)
+{
+    int ret;
+
+    ret = ioctl(vbasedev->fd, VFIO_DEVICE_GET_REGION_INFO, info);
+
+    return ret < 0 ? -errno : ret;
+}
+
+static int vfio_device_io_get_irq_info(VFIODevice *vbasedev,
+                                       struct vfio_irq_info *info)
+{
+    int ret;
+
+    ret = ioctl(vbasedev->fd, VFIO_DEVICE_GET_IRQ_INFO, info);
+
+    return ret < 0 ? -errno : ret;
+}
+
+static int vfio_device_io_set_irqs(VFIODevice *vbasedev,
+                                   struct vfio_irq_set *irqs)
+{
+    int ret;
+
+    ret = ioctl(vbasedev->fd, VFIO_DEVICE_SET_IRQS, irqs);
+
+    return ret < 0 ? -errno : ret;
+}
+
+static VFIODeviceIOOps vfio_device_io_ops_ioctl = {
+    .device_feature = vfio_device_io_device_feature,
+    .get_region_info = vfio_device_io_get_region_info,
+    .get_irq_info = vfio_device_io_get_irq_info,
+    .set_irqs = vfio_device_io_set_irqs,
+};
diff --git a/hw/vfio/listener.c b/hw/vfio/listener.c
index e7ade7d62e..2b93ca55b6 100644
--- a/hw/vfio/listener.c
+++ b/hw/vfio/listener.c
@@ -794,13 +794,17 @@ static void vfio_devices_dma_logging_stop(VFIOContainerBase *bcontainer)
                      VFIO_DEVICE_FEATURE_DMA_LOGGING_STOP;
 
     QLIST_FOREACH(vbasedev, &bcontainer->device_list, container_next) {
+        int ret;
+
         if (!vbasedev->dirty_tracking) {
             continue;
         }
 
-        if (ioctl(vbasedev->fd, VFIO_DEVICE_FEATURE, feature)) {
+        ret = vbasedev->io_ops->device_feature(vbasedev, feature);
+
+        if (ret != 0) {
             warn_report("%s: Failed to stop DMA logging, err %d (%s)",
-                        vbasedev->name, -errno, strerror(errno));
+                        vbasedev->name, -ret, strerror(-ret));
         }
         vbasedev->dirty_tracking = false;
     }
@@ -901,10 +905,9 @@ static bool vfio_devices_dma_logging_start(VFIOContainerBase *bcontainer,
             continue;
         }
 
-        ret = ioctl(vbasedev->fd, VFIO_DEVICE_FEATURE, feature);
+        ret = vbasedev->io_ops->device_feature(vbasedev, feature);
         if (ret) {
-            ret = -errno;
-            error_setg_errno(errp, errno, "%s: Failed to start DMA logging",
+            error_setg_errno(errp, -ret, "%s: Failed to start DMA logging",
                              vbasedev->name);
             goto out;
         }
diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index f65c9463ce..da2ffc9bf3 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -381,7 +381,7 @@ static void vfio_msi_interrupt(void *opaque)
 static int vfio_enable_msix_no_vec(VFIOPCIDevice *vdev)
 {
     g_autofree struct vfio_irq_set *irq_set = NULL;
-    int ret = 0, argsz;
+    int argsz;
     int32_t *fd;
 
     argsz = sizeof(*irq_set) + sizeof(*fd);
@@ -396,9 +396,7 @@ static int vfio_enable_msix_no_vec(VFIOPCIDevice *vdev)
     fd = (int32_t *)&irq_set->data;
     *fd = -1;
 
-    ret = ioctl(vdev->vbasedev.fd, VFIO_DEVICE_SET_IRQS, irq_set);
-
-    return ret < 0 ? -errno : ret;
+    return vdev->vbasedev.io_ops->set_irqs(&vdev->vbasedev, irq_set);
 }
 
 static int vfio_enable_vectors(VFIOPCIDevice *vdev, bool msix)
@@ -455,11 +453,11 @@ static int vfio_enable_vectors(VFIOPCIDevice *vdev, bool msix)
         fds[i] = fd;
     }
 
-    ret = ioctl(vdev->vbasedev.fd, VFIO_DEVICE_SET_IRQS, irq_set);
+    ret = vdev->vbasedev.io_ops->set_irqs(&vdev->vbasedev, irq_set);
 
     g_free(irq_set);
 
-    return ret < 0 ? -errno : ret;
+    return ret;
 }
 
 static void vfio_add_kvm_msi_virq(VFIOPCIDevice *vdev, VFIOMSIVector *vector,
diff --git a/include/hw/vfio/vfio-device.h b/include/hw/vfio/vfio-device.h
index 4a32202943..7e1e81e76b 100644
--- a/include/hw/vfio/vfio-device.h
+++ b/include/hw/vfio/vfio-device.h
@@ -41,6 +41,7 @@ enum {
 };
 
 typedef struct VFIODeviceOps VFIODeviceOps;
+typedef struct VFIODeviceIOOps VFIODeviceIOOps;
 typedef struct VFIOMigration VFIOMigration;
 
 typedef struct IOMMUFDBackend IOMMUFDBackend;
@@ -66,6 +67,7 @@ typedef struct VFIODevice {
     OnOffAuto migration_multifd_transfer;
     bool migration_events;
     VFIODeviceOps *ops;
+    VFIODeviceIOOps *io_ops;
     unsigned int num_irqs;
     unsigned int num_regions;
     unsigned int flags;
@@ -151,6 +153,42 @@ typedef QLIST_HEAD(VFIODeviceList, VFIODevice) VFIODeviceList;
 extern VFIODeviceList vfio_device_list;
 
 #ifdef CONFIG_LINUX
+/*
+ * How devices communicate with the server.  The default option is through
+ * ioctl() to the kernel VFIO driver, but vfio-user can use a socket to a remote
+ * process.
+ */
+struct VFIODeviceIOOps {
+    /**
+     * @device_feature
+     *
+     * Fill in feature info for the given device.
+     */
+    int (*device_feature)(VFIODevice *vdev, struct vfio_device_feature *);
+
+    /**
+     * @get_region_info
+     *
+     * Fill in @info with information on the region given by @info->index.
+     */
+    int (*get_region_info)(VFIODevice *vdev,
+                           struct vfio_region_info *info);
+
+    /**
+     * @get_irq_info
+     *
+     * Fill in @irq with information on the IRQ given by @info->index.
+     */
+    int (*get_irq_info)(VFIODevice *vdev, struct vfio_irq_info *irq);
+
+    /**
+     * @set_irqs
+     *
+     * Configure IRQs as defined by @irqs.
+     */
+    int (*set_irqs)(VFIODevice *vdev, struct vfio_irq_set *irqs);
+};
+
 void vfio_device_prepare(VFIODevice *vbasedev, VFIOContainerBase *bcontainer,
                          struct vfio_device_info *info);
 

From 95cdb024515b107e2574c5cbef0a43cafa0db77f Mon Sep 17 00:00:00 2001
From: John Levon <john.levon@nutanix.com>
Date: Wed, 7 May 2025 16:20:16 +0100
Subject: [PATCH 0784/2760] vfio: add region info cache
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Instead of requesting region information on demand with
VFIO_DEVICE_GET_REGION_INFO, maintain a cache: this will become
necessary for performance for vfio-user, where this call becomes a
message over the control socket, so is of higher overhead than the
traditional path.

We will also need it to generalize region accesses, as that means we
can't use ->config_offset for configuration space accesses, but must
look up the region offset (if relevant) each time.

Originally-by: John Johnson <john.g.johnson@oracle.com>
Signed-off-by: Elena Ufimtseva <elena.ufimtseva@oracle.com>
Signed-off-by: Jagannathan Raman <jag.raman@oracle.com>
Signed-off-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250507152020.1254632-12-john.levon@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/ccw.c                 |  5 -----
 hw/vfio/device.c              | 25 +++++++++++++++++++++----
 hw/vfio/igd.c                 | 10 +++++-----
 hw/vfio/pci.c                 |  6 +++---
 hw/vfio/region.c              |  2 +-
 include/hw/vfio/vfio-device.h |  1 +
 6 files changed, 31 insertions(+), 18 deletions(-)

diff --git a/hw/vfio/ccw.c b/hw/vfio/ccw.c
index ab3fabf991..cea9d6e005 100644
--- a/hw/vfio/ccw.c
+++ b/hw/vfio/ccw.c
@@ -504,7 +504,6 @@ static bool vfio_ccw_get_region(VFIOCCWDevice *vcdev, Error **errp)
 
     vcdev->io_region_offset = info->offset;
     vcdev->io_region = g_malloc0(info->size);
-    g_free(info);
 
     /* check for the optional async command region */
     ret = vfio_device_get_region_info_type(vdev, VFIO_REGION_TYPE_CCW,
@@ -517,7 +516,6 @@ static bool vfio_ccw_get_region(VFIOCCWDevice *vcdev, Error **errp)
         }
         vcdev->async_cmd_region_offset = info->offset;
         vcdev->async_cmd_region = g_malloc0(info->size);
-        g_free(info);
     }
 
     ret = vfio_device_get_region_info_type(vdev, VFIO_REGION_TYPE_CCW,
@@ -530,7 +528,6 @@ static bool vfio_ccw_get_region(VFIOCCWDevice *vcdev, Error **errp)
         }
         vcdev->schib_region_offset = info->offset;
         vcdev->schib_region = g_malloc(info->size);
-        g_free(info);
     }
 
     ret = vfio_device_get_region_info_type(vdev, VFIO_REGION_TYPE_CCW,
@@ -544,7 +541,6 @@ static bool vfio_ccw_get_region(VFIOCCWDevice *vcdev, Error **errp)
         }
         vcdev->crw_region_offset = info->offset;
         vcdev->crw_region = g_malloc(info->size);
-        g_free(info);
     }
 
     return true;
@@ -554,7 +550,6 @@ out_err:
     g_free(vcdev->schib_region);
     g_free(vcdev->async_cmd_region);
     g_free(vcdev->io_region);
-    g_free(info);
     return false;
 }
 
diff --git a/hw/vfio/device.c b/hw/vfio/device.c
index 40a196bfb9..77b0675abe 100644
--- a/hw/vfio/device.c
+++ b/hw/vfio/device.c
@@ -202,6 +202,12 @@ int vfio_device_get_region_info(VFIODevice *vbasedev, int index,
     size_t argsz = sizeof(struct vfio_region_info);
     int ret;
 
+    /* check cache */
+    if (vbasedev->reginfo[index] != NULL) {
+        *info = vbasedev->reginfo[index];
+        return 0;
+    }
+
     *info = g_malloc0(argsz);
 
     (*info)->index = index;
@@ -222,6 +228,9 @@ retry:
         goto retry;
     }
 
+    /* fill cache */
+    vbasedev->reginfo[index] = *info;
+
     return 0;
 }
 
@@ -240,7 +249,6 @@ int vfio_device_get_region_info_type(VFIODevice *vbasedev, uint32_t type,
 
         hdr = vfio_get_region_info_cap(*info, VFIO_REGION_INFO_CAP_TYPE);
         if (!hdr) {
-            g_free(*info);
             continue;
         }
 
@@ -252,8 +260,6 @@ int vfio_device_get_region_info_type(VFIODevice *vbasedev, uint32_t type,
         if (cap_type->type == type && cap_type->subtype == subtype) {
             return 0;
         }
-
-        g_free(*info);
     }
 
     *info = NULL;
@@ -262,7 +268,7 @@ int vfio_device_get_region_info_type(VFIODevice *vbasedev, uint32_t type,
 
 bool vfio_device_has_region_cap(VFIODevice *vbasedev, int region, uint16_t cap_type)
 {
-    g_autofree struct vfio_region_info *info = NULL;
+    struct vfio_region_info *info = NULL;
     bool ret = false;
 
     if (!vfio_device_get_region_info(vbasedev, region, &info)) {
@@ -435,10 +441,21 @@ void vfio_device_prepare(VFIODevice *vbasedev, VFIOContainerBase *bcontainer,
     QLIST_INSERT_HEAD(&bcontainer->device_list, vbasedev, container_next);
 
     QLIST_INSERT_HEAD(&vfio_device_list, vbasedev, global_next);
+
+    vbasedev->reginfo = g_new0(struct vfio_region_info *,
+                               vbasedev->num_regions);
 }
 
 void vfio_device_unprepare(VFIODevice *vbasedev)
 {
+    int i;
+
+    for (i = 0; i < vbasedev->num_regions; i++) {
+        g_free(vbasedev->reginfo[i]);
+    }
+    g_free(vbasedev->reginfo);
+    vbasedev->reginfo = NULL;
+
     QLIST_REMOVE(vbasedev, container_next);
     QLIST_REMOVE(vbasedev, global_next);
     vbasedev->bcontainer = NULL;
diff --git a/hw/vfio/igd.c b/hw/vfio/igd.c
index 3ee1a73b57..e7952d15a0 100644
--- a/hw/vfio/igd.c
+++ b/hw/vfio/igd.c
@@ -349,8 +349,8 @@ static int vfio_pci_igd_lpc_init(VFIOPCIDevice *vdev,
 
 static bool vfio_pci_igd_setup_lpc_bridge(VFIOPCIDevice *vdev, Error **errp)
 {
-    g_autofree struct vfio_region_info *host = NULL;
-    g_autofree struct vfio_region_info *lpc = NULL;
+    struct vfio_region_info *host = NULL;
+    struct vfio_region_info *lpc = NULL;
     PCIDevice *lpc_bridge;
     int ret;
 
@@ -510,7 +510,7 @@ void vfio_probe_igd_bar0_quirk(VFIOPCIDevice *vdev, int nr)
 
 static bool vfio_pci_igd_config_quirk(VFIOPCIDevice *vdev, Error **errp)
 {
-    g_autofree struct vfio_region_info *opregion = NULL;
+    struct vfio_region_info *opregion = NULL;
     int ret, gen;
     uint64_t gms_size = 0;
     uint64_t *bdsm_size;
@@ -551,7 +551,7 @@ static bool vfio_pci_igd_config_quirk(VFIOPCIDevice *vdev, Error **errp)
          * - OpRegion
          * - Same LPC bridge and Host bridge VID/DID/SVID/SSID as host
          */
-        g_autofree struct vfio_region_info *rom = NULL;
+        struct vfio_region_info *rom = NULL;
 
         legacy_mode_enabled = true;
         info_report("IGD legacy mode enabled, "
@@ -681,7 +681,7 @@ error:
  */
 static bool vfio_pci_kvmgt_config_quirk(VFIOPCIDevice *vdev, Error **errp)
 {
-    g_autofree struct vfio_region_info *opregion = NULL;
+    struct vfio_region_info *opregion = NULL;
     int gen;
 
     if (!vfio_pci_is(vdev, PCI_VENDOR_ID_INTEL, PCI_ANY_ID) ||
diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index da2ffc9bf3..9136cf52c8 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -883,8 +883,8 @@ static void vfio_update_msi(VFIOPCIDevice *vdev)
 
 static void vfio_pci_load_rom(VFIOPCIDevice *vdev)
 {
-    g_autofree struct vfio_region_info *reg_info = NULL;
     VFIODevice *vbasedev = &vdev->vbasedev;
+    struct vfio_region_info *reg_info = NULL;
     uint64_t size;
     off_t off = 0;
     ssize_t bytes;
@@ -2710,7 +2710,7 @@ static VFIODeviceOps vfio_pci_ops = {
 bool vfio_populate_vga(VFIOPCIDevice *vdev, Error **errp)
 {
     VFIODevice *vbasedev = &vdev->vbasedev;
-    g_autofree struct vfio_region_info *reg_info = NULL;
+    struct vfio_region_info *reg_info = NULL;
     int ret;
 
     ret = vfio_device_get_region_info(vbasedev, VFIO_PCI_VGA_REGION_INDEX, &reg_info);
@@ -2775,7 +2775,7 @@ bool vfio_populate_vga(VFIOPCIDevice *vdev, Error **errp)
 static bool vfio_populate_device(VFIOPCIDevice *vdev, Error **errp)
 {
     VFIODevice *vbasedev = &vdev->vbasedev;
-    g_autofree struct vfio_region_info *reg_info = NULL;
+    struct vfio_region_info *reg_info = NULL;
     struct vfio_irq_info irq_info;
     int i, ret = -1;
 
diff --git a/hw/vfio/region.c b/hw/vfio/region.c
index 04bf9eb098..ef2630cac3 100644
--- a/hw/vfio/region.c
+++ b/hw/vfio/region.c
@@ -182,7 +182,7 @@ static int vfio_setup_region_sparse_mmaps(VFIORegion *region,
 int vfio_region_setup(Object *obj, VFIODevice *vbasedev, VFIORegion *region,
                       int index, const char *name)
 {
-    g_autofree struct vfio_region_info *info = NULL;
+    struct vfio_region_info *info = NULL;
     int ret;
 
     ret = vfio_device_get_region_info(vbasedev, index, &info);
diff --git a/include/hw/vfio/vfio-device.h b/include/hw/vfio/vfio-device.h
index 7e1e81e76b..4fff3dcee3 100644
--- a/include/hw/vfio/vfio-device.h
+++ b/include/hw/vfio/vfio-device.h
@@ -83,6 +83,7 @@ typedef struct VFIODevice {
     IOMMUFDBackend *iommufd;
     VFIOIOASHwpt *hwpt;
     QLIST_ENTRY(VFIODevice) hwpt_next;
+    struct vfio_region_info **reginfo;
 } VFIODevice;
 
 struct VFIODeviceOps {

From 776066ac90a2b57fedb6b0186b30c5a9e9e1c9bd Mon Sep 17 00:00:00 2001
From: John Levon <john.levon@nutanix.com>
Date: Wed, 7 May 2025 16:20:17 +0100
Subject: [PATCH 0785/2760] vfio: add read/write to device IO ops vector
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Now we have the region info cache, add ->region_read/write device I/O
operations instead of explicit pread()/pwrite() system calls.

Signed-off-by: John Levon <john.levon@nutanix.com>
Link: https://lore.kernel.org/qemu-devel/20250507152020.1254632-13-john.levon@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/device.c              | 34 ++++++++++++++++++++++++++++++++++
 hw/vfio/pci.c                 | 28 ++++++++++++++--------------
 hw/vfio/region.c              | 17 +++++++++++------
 include/hw/vfio/vfio-device.h | 18 ++++++++++++++++++
 4 files changed, 77 insertions(+), 20 deletions(-)

diff --git a/hw/vfio/device.c b/hw/vfio/device.c
index 77b0675abe..0b2cd90d64 100644
--- a/hw/vfio/device.c
+++ b/hw/vfio/device.c
@@ -505,9 +505,43 @@ static int vfio_device_io_set_irqs(VFIODevice *vbasedev,
     return ret < 0 ? -errno : ret;
 }
 
+static int vfio_device_io_region_read(VFIODevice *vbasedev, uint8_t index,
+                                      off_t off, uint32_t size, void *data)
+{
+    struct vfio_region_info *info;
+    int ret;
+
+    ret = vfio_device_get_region_info(vbasedev, index, &info);
+    if (ret != 0) {
+        return ret;
+    }
+
+    ret = pread(vbasedev->fd, data, size, info->offset + off);
+
+    return ret < 0 ? -errno : ret;
+}
+
+static int vfio_device_io_region_write(VFIODevice *vbasedev, uint8_t index,
+                                       off_t off, uint32_t size, void *data)
+{
+    struct vfio_region_info *info;
+    int ret;
+
+    ret = vfio_device_get_region_info(vbasedev, index, &info);
+    if (ret != 0) {
+        return ret;
+    }
+
+    ret = pwrite(vbasedev->fd, data, size, info->offset + off);
+
+    return ret < 0 ? -errno : ret;
+}
+
 static VFIODeviceIOOps vfio_device_io_ops_ioctl = {
     .device_feature = vfio_device_io_device_feature,
     .get_region_info = vfio_device_io_get_region_info,
     .get_irq_info = vfio_device_io_get_irq_info,
     .set_irqs = vfio_device_io_set_irqs,
+    .region_read = vfio_device_io_region_read,
+    .region_write = vfio_device_io_region_write,
 };
diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index 9136cf52c8..1236de315d 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -918,18 +918,22 @@ static void vfio_pci_load_rom(VFIOPCIDevice *vdev)
     memset(vdev->rom, 0xff, size);
 
     while (size) {
-        bytes = pread(vbasedev->fd, vdev->rom + off,
-                      size, vdev->rom_offset + off);
+        bytes = vbasedev->io_ops->region_read(vbasedev,
+                                              VFIO_PCI_ROM_REGION_INDEX,
+                                              off, size, vdev->rom + off);
+
         if (bytes == 0) {
             break;
         } else if (bytes > 0) {
             off += bytes;
             size -= bytes;
         } else {
-            if (errno == EINTR || errno == EAGAIN) {
+            if (bytes == -EINTR || bytes == -EAGAIN) {
                 continue;
             }
-            error_report("vfio: Error reading device ROM: %m");
+            error_report("vfio: Error reading device ROM: %s",
+                         strreaderror(bytes));
+
             break;
         }
     }
@@ -969,22 +973,18 @@ static void vfio_pci_load_rom(VFIOPCIDevice *vdev)
 static int vfio_pci_config_space_read(VFIOPCIDevice *vdev, off_t offset,
                                       uint32_t size, void *data)
 {
-    ssize_t ret;
-
-    ret = pread(vdev->vbasedev.fd, data, size, vdev->config_offset + offset);
-
-    return ret < 0 ? -errno : (int)ret;
+    return vdev->vbasedev.io_ops->region_read(&vdev->vbasedev,
+                                              VFIO_PCI_CONFIG_REGION_INDEX,
+                                              offset, size, data);
 }
 
 /* "Raw" write of underlying config space. */
 static int vfio_pci_config_space_write(VFIOPCIDevice *vdev, off_t offset,
                                        uint32_t size, void *data)
 {
-    ssize_t ret;
-
-    ret = pwrite(vdev->vbasedev.fd, data, size, vdev->config_offset + offset);
-
-    return ret < 0 ? -errno : (int)ret;
+    return vdev->vbasedev.io_ops->region_write(&vdev->vbasedev,
+                                               VFIO_PCI_CONFIG_REGION_INDEX,
+                                               offset, size, data);
 }
 
 static uint64_t vfio_rom_read(void *opaque, hwaddr addr, unsigned size)
diff --git a/hw/vfio/region.c b/hw/vfio/region.c
index ef2630cac3..34752c3f65 100644
--- a/hw/vfio/region.c
+++ b/hw/vfio/region.c
@@ -45,6 +45,7 @@ void vfio_region_write(void *opaque, hwaddr addr,
         uint32_t dword;
         uint64_t qword;
     } buf;
+    int ret;
 
     switch (size) {
     case 1:
@@ -64,11 +65,13 @@ void vfio_region_write(void *opaque, hwaddr addr,
         break;
     }
 
-    if (pwrite(vbasedev->fd, &buf, size, region->fd_offset + addr) != size) {
+    ret = vbasedev->io_ops->region_write(vbasedev, region->nr,
+                                         addr, size, &buf);
+    if (ret != size) {
         error_report("%s(%s:region%d+0x%"HWADDR_PRIx", 0x%"PRIx64
-                     ",%d) failed: %m",
+                     ",%d) failed: %s",
                      __func__, vbasedev->name, region->nr,
-                     addr, data, size);
+                     addr, data, size, strwriteerror(ret));
     }
 
     trace_vfio_region_write(vbasedev->name, region->nr, addr, data, size);
@@ -96,11 +99,13 @@ uint64_t vfio_region_read(void *opaque,
         uint64_t qword;
     } buf;
     uint64_t data = 0;
+    int ret;
 
-    if (pread(vbasedev->fd, &buf, size, region->fd_offset + addr) != size) {
-        error_report("%s(%s:region%d+0x%"HWADDR_PRIx", %d) failed: %m",
+    ret = vbasedev->io_ops->region_read(vbasedev, region->nr, addr, size, &buf);
+    if (ret != size) {
+        error_report("%s(%s:region%d+0x%"HWADDR_PRIx", %d) failed: %s",
                      __func__, vbasedev->name, region->nr,
-                     addr, size);
+                     addr, size, strreaderror(ret));
         return (uint64_t)-1;
     }
     switch (size) {
diff --git a/include/hw/vfio/vfio-device.h b/include/hw/vfio/vfio-device.h
index 4fff3dcee3..8bcb3c19f6 100644
--- a/include/hw/vfio/vfio-device.h
+++ b/include/hw/vfio/vfio-device.h
@@ -188,6 +188,24 @@ struct VFIODeviceIOOps {
      * Configure IRQs as defined by @irqs.
      */
     int (*set_irqs)(VFIODevice *vdev, struct vfio_irq_set *irqs);
+
+    /**
+     * @region_read
+     *
+     * Read @size bytes from the region @nr at offset @off into the buffer
+     * @data.
+     */
+    int (*region_read)(VFIODevice *vdev, uint8_t nr, off_t off, uint32_t size,
+                       void *data);
+
+    /**
+     * @region_write
+     *
+     * Write @size bytes to the region @nr at offset @off from the buffer
+     * @data.
+     */
+    int (*region_write)(VFIODevice *vdev, uint8_t nr, off_t off, uint32_t size,
+                        void *data);
 };
 
 void vfio_device_prepare(VFIODevice *vbasedev, VFIOContainerBase *bcontainer,

From d4e392d0a99b8018453e26f907e33b89724697a6 Mon Sep 17 00:00:00 2001
From: John Levon <john.levon@nutanix.com>
Date: Wed, 7 May 2025 16:20:18 +0100
Subject: [PATCH 0786/2760] vfio: add vfio-pci-base class
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Split out parts of TYPE_VFIO_PCI into a base TYPE_VFIO_PCI_BASE,
although we have not yet introduced another subclass, so all the
properties have remained in TYPE_VFIO_PCI.

Note that currently there is no need for additional data for
TYPE_VFIO_PCI, so it shares the same C struct type as
TYPE_VFIO_PCI_BASE, VFIOPCIDevice.

Originally-by: John Johnson <john.g.johnson@oracle.com>
Signed-off-by: Elena Ufimtseva <elena.ufimtseva@oracle.com>
Signed-off-by: Jagannathan Raman <jag.raman@oracle.com>
Signed-off-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250507152020.1254632-14-john.levon@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/device.c |  2 +-
 hw/vfio/pci.c    | 62 +++++++++++++++++++++++++++++++-----------------
 hw/vfio/pci.h    | 10 +++++++-
 3 files changed, 50 insertions(+), 24 deletions(-)

diff --git a/hw/vfio/device.c b/hw/vfio/device.c
index 0b2cd90d64..9fba2c7272 100644
--- a/hw/vfio/device.c
+++ b/hw/vfio/device.c
@@ -392,7 +392,7 @@ bool vfio_device_hiod_create_and_realize(VFIODevice *vbasedev,
 VFIODevice *vfio_get_vfio_device(Object *obj)
 {
     if (object_dynamic_cast(obj, TYPE_VFIO_PCI)) {
-        return &VFIO_PCI(obj)->vbasedev;
+        return &VFIO_PCI_BASE(obj)->vbasedev;
     } else {
         return NULL;
     }
diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index 1236de315d..a1bfdfe375 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -241,7 +241,7 @@ static void vfio_intx_update(VFIOPCIDevice *vdev, PCIINTxRoute *route)
 
 static void vfio_intx_routing_notifier(PCIDevice *pdev)
 {
-    VFIOPCIDevice *vdev = VFIO_PCI(pdev);
+    VFIOPCIDevice *vdev = VFIO_PCI_BASE(pdev);
     PCIINTxRoute route;
 
     if (vdev->interrupt != VFIO_INT_INTx) {
@@ -514,7 +514,7 @@ static void vfio_update_kvm_msi_virq(VFIOMSIVector *vector, MSIMessage msg,
 static int vfio_msix_vector_do_use(PCIDevice *pdev, unsigned int nr,
                                    MSIMessage *msg, IOHandler *handler)
 {
-    VFIOPCIDevice *vdev = VFIO_PCI(pdev);
+    VFIOPCIDevice *vdev = VFIO_PCI_BASE(pdev);
     VFIOMSIVector *vector;
     int ret;
     bool resizing = !!(vdev->nr_vectors < nr + 1);
@@ -620,7 +620,7 @@ static int vfio_msix_vector_use(PCIDevice *pdev,
 
 static void vfio_msix_vector_release(PCIDevice *pdev, unsigned int nr)
 {
-    VFIOPCIDevice *vdev = VFIO_PCI(pdev);
+    VFIOPCIDevice *vdev = VFIO_PCI_BASE(pdev);
     VFIOMSIVector *vector = &vdev->msi_vectors[nr];
 
     trace_vfio_msix_vector_release(vdev->vbasedev.name, nr);
@@ -1196,7 +1196,7 @@ static const MemoryRegionOps vfio_vga_ops = {
  */
 static void vfio_sub_page_bar_update_mapping(PCIDevice *pdev, int bar)
 {
-    VFIOPCIDevice *vdev = VFIO_PCI(pdev);
+    VFIOPCIDevice *vdev = VFIO_PCI_BASE(pdev);
     VFIORegion *region = &vdev->bars[bar].region;
     MemoryRegion *mmap_mr, *region_mr, *base_mr;
     PCIIORegion *r;
@@ -1242,7 +1242,7 @@ static void vfio_sub_page_bar_update_mapping(PCIDevice *pdev, int bar)
  */
 uint32_t vfio_pci_read_config(PCIDevice *pdev, uint32_t addr, int len)
 {
-    VFIOPCIDevice *vdev = VFIO_PCI(pdev);
+    VFIOPCIDevice *vdev = VFIO_PCI_BASE(pdev);
     VFIODevice *vbasedev = &vdev->vbasedev;
     uint32_t emu_bits = 0, emu_val = 0, phys_val = 0, val;
 
@@ -1276,7 +1276,7 @@ uint32_t vfio_pci_read_config(PCIDevice *pdev, uint32_t addr, int len)
 void vfio_pci_write_config(PCIDevice *pdev,
                            uint32_t addr, uint32_t val, int len)
 {
-    VFIOPCIDevice *vdev = VFIO_PCI(pdev);
+    VFIOPCIDevice *vdev = VFIO_PCI_BASE(pdev);
     VFIODevice *vbasedev = &vdev->vbasedev;
     uint32_t val_le = cpu_to_le32(val);
     int ret;
@@ -3129,7 +3129,7 @@ static bool vfio_interrupt_setup(VFIOPCIDevice *vdev, Error **errp)
 static void vfio_realize(PCIDevice *pdev, Error **errp)
 {
     ERRP_GUARD();
-    VFIOPCIDevice *vdev = VFIO_PCI(pdev);
+    VFIOPCIDevice *vdev = VFIO_PCI_BASE(pdev);
     VFIODevice *vbasedev = &vdev->vbasedev;
     int i, ret;
     char uuid[UUID_STR_LEN];
@@ -3300,7 +3300,7 @@ error:
 
 static void vfio_instance_finalize(Object *obj)
 {
-    VFIOPCIDevice *vdev = VFIO_PCI(obj);
+    VFIOPCIDevice *vdev = VFIO_PCI_BASE(obj);
 
     vfio_display_finalize(vdev);
     vfio_bars_finalize(vdev);
@@ -3318,7 +3318,7 @@ static void vfio_instance_finalize(Object *obj)
 
 static void vfio_exitfn(PCIDevice *pdev)
 {
-    VFIOPCIDevice *vdev = VFIO_PCI(pdev);
+    VFIOPCIDevice *vdev = VFIO_PCI_BASE(pdev);
     VFIODevice *vbasedev = &vdev->vbasedev;
 
     vfio_unregister_req_notifier(vdev);
@@ -3342,7 +3342,7 @@ static void vfio_exitfn(PCIDevice *pdev)
 
 static void vfio_pci_reset(DeviceState *dev)
 {
-    VFIOPCIDevice *vdev = VFIO_PCI(dev);
+    VFIOPCIDevice *vdev = VFIO_PCI_BASE(dev);
 
     trace_vfio_pci_reset(vdev->vbasedev.name);
 
@@ -3382,7 +3382,7 @@ post_reset:
 static void vfio_instance_init(Object *obj)
 {
     PCIDevice *pci_dev = PCI_DEVICE(obj);
-    VFIOPCIDevice *vdev = VFIO_PCI(obj);
+    VFIOPCIDevice *vdev = VFIO_PCI_BASE(obj);
     VFIODevice *vbasedev = &vdev->vbasedev;
 
     device_add_bootindex_property(obj, &vdev->bootindex,
@@ -3403,6 +3403,31 @@ static void vfio_instance_init(Object *obj)
     pci_dev->cap_present |= QEMU_PCI_CAP_EXPRESS;
 }
 
+static void vfio_pci_base_dev_class_init(ObjectClass *klass, const void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    PCIDeviceClass *pdc = PCI_DEVICE_CLASS(klass);
+
+    dc->desc = "VFIO PCI base device";
+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
+    pdc->exit = vfio_exitfn;
+    pdc->config_read = vfio_pci_read_config;
+    pdc->config_write = vfio_pci_write_config;
+}
+
+static const TypeInfo vfio_pci_base_dev_info = {
+    .name = TYPE_VFIO_PCI_BASE,
+    .parent = TYPE_PCI_DEVICE,
+    .instance_size = 0,
+    .abstract = true,
+    .class_init = vfio_pci_base_dev_class_init,
+    .interfaces = (const InterfaceInfo[]) {
+        { INTERFACE_PCIE_DEVICE },
+        { INTERFACE_CONVENTIONAL_PCI_DEVICE },
+        { }
+    },
+};
+
 static PropertyInfo vfio_pci_migration_multifd_transfer_prop;
 
 static const Property vfio_pci_dev_properties[] = {
@@ -3473,7 +3498,8 @@ static const Property vfio_pci_dev_properties[] = {
 #ifdef CONFIG_IOMMUFD
 static void vfio_pci_set_fd(Object *obj, const char *str, Error **errp)
 {
-    vfio_device_set_fd(&VFIO_PCI(obj)->vbasedev, str, errp);
+    VFIOPCIDevice *vdev = VFIO_PCI_BASE(obj);
+    vfio_device_set_fd(&vdev->vbasedev, str, errp);
 }
 #endif
 
@@ -3488,11 +3514,7 @@ static void vfio_pci_dev_class_init(ObjectClass *klass, const void *data)
     object_class_property_add_str(klass, "fd", NULL, vfio_pci_set_fd);
 #endif
     dc->desc = "VFIO-based PCI device assignment";
-    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
     pdc->realize = vfio_realize;
-    pdc->exit = vfio_exitfn;
-    pdc->config_read = vfio_pci_read_config;
-    pdc->config_write = vfio_pci_write_config;
 
     object_class_property_set_description(klass, /* 1.3 */
                                           "host",
@@ -3617,16 +3639,11 @@ static void vfio_pci_dev_class_init(ObjectClass *klass, const void *data)
 
 static const TypeInfo vfio_pci_dev_info = {
     .name = TYPE_VFIO_PCI,
-    .parent = TYPE_PCI_DEVICE,
+    .parent = TYPE_VFIO_PCI_BASE,
     .instance_size = sizeof(VFIOPCIDevice),
     .class_init = vfio_pci_dev_class_init,
     .instance_init = vfio_instance_init,
     .instance_finalize = vfio_instance_finalize,
-    .interfaces = (const InterfaceInfo[]) {
-        { INTERFACE_PCIE_DEVICE },
-        { INTERFACE_CONVENTIONAL_PCI_DEVICE },
-        { }
-    },
 };
 
 static const Property vfio_pci_dev_nohotplug_properties[] = {
@@ -3673,6 +3690,7 @@ static void register_vfio_pci_dev_type(void)
     vfio_pci_migration_multifd_transfer_prop = qdev_prop_on_off_auto;
     vfio_pci_migration_multifd_transfer_prop.realized_set_allowed = true;
 
+    type_register_static(&vfio_pci_base_dev_info);
     type_register_static(&vfio_pci_dev_info);
     type_register_static(&vfio_pci_nohotplug_dev_info);
 }
diff --git a/hw/vfio/pci.h b/hw/vfio/pci.h
index f835b1dbc2..5ce0fb916f 100644
--- a/hw/vfio/pci.h
+++ b/hw/vfio/pci.h
@@ -118,8 +118,16 @@ typedef struct VFIOMSIXInfo {
     bool noresize;
 } VFIOMSIXInfo;
 
+/*
+ * TYPE_VFIO_PCI_BASE is an abstract type used to share code
+ * between VFIO implementations that use a kernel driver
+ * with those that use user sockets.
+ */
+#define TYPE_VFIO_PCI_BASE "vfio-pci-base"
+OBJECT_DECLARE_SIMPLE_TYPE(VFIOPCIDevice, VFIO_PCI_BASE)
+
 #define TYPE_VFIO_PCI "vfio-pci"
-OBJECT_DECLARE_SIMPLE_TYPE(VFIOPCIDevice, VFIO_PCI)
+/* TYPE_VFIO_PCI shares struct VFIOPCIDevice. */
 
 struct VFIOPCIDevice {
     PCIDevice pdev;

From d9b7d8b6993b5193480e5a972902e3e9bbc4d8a1 Mon Sep 17 00:00:00 2001
From: John Levon <john.levon@nutanix.com>
Date: Wed, 7 May 2025 16:20:19 +0100
Subject: [PATCH 0787/2760] vfio/container: pass listener_begin/commit
 callbacks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The vfio-user container will later need to hook into these callbacks;
set up vfio to use them, and optionally pass them through to the
container.

Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: John Levon <john.levon@nutanix.com>
Link: https://lore.kernel.org/qemu-devel/20250507152020.1254632-15-john.levon@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/listener.c                    | 28 +++++++++++++++++++++++++++
 include/hw/vfio/vfio-container-base.h |  2 ++
 2 files changed, 30 insertions(+)

diff --git a/hw/vfio/listener.c b/hw/vfio/listener.c
index 2b93ca55b6..bfacb3d8d9 100644
--- a/hw/vfio/listener.c
+++ b/hw/vfio/listener.c
@@ -411,6 +411,32 @@ static bool vfio_get_section_iova_range(VFIOContainerBase *bcontainer,
     return true;
 }
 
+static void vfio_listener_begin(MemoryListener *listener)
+{
+    VFIOContainerBase *bcontainer = container_of(listener, VFIOContainerBase,
+                                                 listener);
+    void (*listener_begin)(VFIOContainerBase *bcontainer);
+
+    listener_begin = VFIO_IOMMU_GET_CLASS(bcontainer)->listener_begin;
+
+    if (listener_begin) {
+        listener_begin(bcontainer);
+    }
+}
+
+static void vfio_listener_commit(MemoryListener *listener)
+{
+    VFIOContainerBase *bcontainer = container_of(listener, VFIOContainerBase,
+                                                 listener);
+    void (*listener_commit)(VFIOContainerBase *bcontainer);
+
+    listener_commit = VFIO_IOMMU_GET_CLASS(bcontainer)->listener_begin;
+
+    if (listener_commit) {
+        listener_commit(bcontainer);
+    }
+}
+
 static void vfio_device_error_append(VFIODevice *vbasedev, Error **errp)
 {
     /*
@@ -1161,6 +1187,8 @@ static void vfio_listener_log_sync(MemoryListener *listener,
 
 static const MemoryListener vfio_memory_listener = {
     .name = "vfio",
+    .begin = vfio_listener_begin,
+    .commit = vfio_listener_commit,
     .region_add = vfio_listener_region_add,
     .region_del = vfio_listener_region_del,
     .log_global_start = vfio_listener_log_global_start,
diff --git a/include/hw/vfio/vfio-container-base.h b/include/hw/vfio/vfio-container-base.h
index 59f07d26e8..3d392b0fd8 100644
--- a/include/hw/vfio/vfio-container-base.h
+++ b/include/hw/vfio/vfio-container-base.h
@@ -117,6 +117,8 @@ struct VFIOIOMMUClass {
 
     /* basic feature */
     bool (*setup)(VFIOContainerBase *bcontainer, Error **errp);
+    void (*listener_begin)(VFIOContainerBase *bcontainer);
+    void (*listener_commit)(VFIOContainerBase *bcontainer);
     int (*dma_map)(const VFIOContainerBase *bcontainer,
                    hwaddr iova, ram_addr_t size,
                    void *vaddr, bool readonly);

From 246069e850327b3d5c7f460461fc0bbf0f817654 Mon Sep 17 00:00:00 2001
From: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Date: Thu, 10 Apr 2025 19:22:50 +0300
Subject: [PATCH 0788/2760] qtest: introduce qtest_init_ext
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Merge qtest_init_with_env_and_capabilities() and qtest_init_with_env()
into one qtest_init_ext().

Reasons:

1. qtest_init_with_env() is just wrong: it gets do_connect parameter
   but always pass true to qtest_init_with_env_and_capabilities().
   Happily, all qtest_init_with_env() callers pass true as well.

2. qtest_init_with_env() is not used outside of libqtest.c, so no
   reason to keep it as public function

3. and in libqtest.c it's used not often, so no problem to use
   more generic function instead.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Message-ID: <20250410162250.329941-1-vsementsov@yandex-team.ru>
Signed-off-by: Fabiano Rosas <farosas@suse.de>
---
 tests/qtest/libqtest.c            | 18 +++++-------------
 tests/qtest/libqtest.h            | 30 +++++++-----------------------
 tests/qtest/migration/framework.c |  7 +++----
 3 files changed, 15 insertions(+), 40 deletions(-)

diff --git a/tests/qtest/libqtest.c b/tests/qtest/libqtest.c
index 358580361d..94526b7f9c 100644
--- a/tests/qtest/libqtest.c
+++ b/tests/qtest/libqtest.c
@@ -574,10 +574,8 @@ void qtest_qmp_handshake(QTestState *s, QList *capabilities)
     }
 }
 
-QTestState *qtest_init_with_env_and_capabilities(const char *var,
-                                                 const char *extra_args,
-                                                 QList *capabilities,
-                                                 bool do_connect)
+QTestState *qtest_init_ext(const char *var, const char *extra_args,
+                           QList *capabilities, bool do_connect)
 {
     QTestState *s = qtest_init_internal(qtest_qemu_binary(var), extra_args,
                                         do_connect);
@@ -594,15 +592,9 @@ QTestState *qtest_init_with_env_and_capabilities(const char *var,
     return s;
 }
 
-QTestState *qtest_init_with_env(const char *var, const char *extra_args,
-                                bool do_connect)
-{
-    return qtest_init_with_env_and_capabilities(var, extra_args, NULL, true);
-}
-
 QTestState *qtest_init(const char *extra_args)
 {
-    return qtest_init_with_env(NULL, extra_args, true);
+    return qtest_init_ext(NULL, extra_args, NULL, true);
 }
 
 QTestState *qtest_vinitf(const char *fmt, va_list ap)
@@ -1662,7 +1654,7 @@ static struct MachInfo *qtest_get_machines(const char *var)
 
     silence_spawn_log = !g_test_verbose();
 
-    qts = qtest_init_with_env(qemu_var, "-machine none", true);
+    qts = qtest_init_ext(qemu_var, "-machine none", NULL, true);
     response = qtest_qmp(qts, "{ 'execute': 'query-machines' }");
     g_assert(response);
     list = qdict_get_qlist(response, "return");
@@ -1717,7 +1709,7 @@ static struct CpuModel *qtest_get_cpu_models(void)
 
     silence_spawn_log = !g_test_verbose();
 
-    qts = qtest_init_with_env(NULL, "-machine none", true);
+    qts = qtest_init_ext(NULL, "-machine none", NULL, true);
     response = qtest_qmp(qts, "{ 'execute': 'query-cpu-definitions' }");
     g_assert(response);
     list = qdict_get_qlist(response, "return");
diff --git a/tests/qtest/libqtest.h b/tests/qtest/libqtest.h
index 930a91dcb7..b3f2e7fbef 100644
--- a/tests/qtest/libqtest.h
+++ b/tests/qtest/libqtest.h
@@ -57,37 +57,21 @@ QTestState *qtest_vinitf(const char *fmt, va_list ap) G_GNUC_PRINTF(1, 0);
 QTestState *qtest_init(const char *extra_args);
 
 /**
- * qtest_init_with_env:
- * @var: Environment variable from where to take the QEMU binary
- * @extra_args: Other arguments to pass to QEMU.  CAUTION: these
- * arguments are subject to word splitting and shell evaluation.
- * @do_connect: connect to qemu monitor and qtest socket.
- *
- * Like qtest_init(), but use a different environment variable for the
- * QEMU binary.
- *
- * Returns: #QTestState instance.
- */
-QTestState *qtest_init_with_env(const char *var, const char *extra_args,
-                                bool do_connect);
-
-/**
- * qtest_init_with_env_and_capabilities:
+ * qtest_init_ext:
  * @var: Environment variable from where to take the QEMU binary
  * @extra_args: Other arguments to pass to QEMU.  CAUTION: these
  * arguments are subject to word splitting and shell evaluation.
  * @capabilities: list of QMP capabilities (strings) to enable
  * @do_connect: connect to qemu monitor and qtest socket.
  *
- * Like qtest_init_with_env(), but enable specified capabilities during
- * hadshake.
+ * Like qtest_init(), but use a different environment variable for the
+ * QEMU binary, allow specify capabilities and skip connecting
+ * to QEMU monitor.
  *
  * Returns: #QTestState instance.
  */
-QTestState *qtest_init_with_env_and_capabilities(const char *var,
-                                                 const char *extra_args,
-                                                 QList *capabilities,
-                                                 bool do_connect);
+QTestState *qtest_init_ext(const char *var, const char *extra_args,
+                           QList *capabilities, bool do_connect);
 
 /**
  * qtest_init_without_qmp_handshake:
@@ -102,7 +86,7 @@ QTestState *qtest_init_without_qmp_handshake(const char *extra_args);
  * qtest_connect
  * @s: #QTestState instance to connect
  * Connect to qemu monitor and qtest socket, after skipping them in
- * qtest_init_with_env.  Does not handshake with the monitor.
+ * qtest_init_ext.  Does not handshake with the monitor.
  */
 void qtest_connect(QTestState *s);
 
diff --git a/tests/qtest/migration/framework.c b/tests/qtest/migration/framework.c
index e48b80a127..407c9023c0 100644
--- a/tests/qtest/migration/framework.c
+++ b/tests/qtest/migration/framework.c
@@ -382,8 +382,7 @@ int migrate_start(QTestState **from, QTestState **to, const char *uri,
                                  args->opts_source ? args->opts_source : "",
                                  ignore_stderr);
     if (!args->only_target) {
-        *from = qtest_init_with_env_and_capabilities(QEMU_ENV_SRC, cmd_source,
-                                                     capabilities, true);
+        *from = qtest_init_ext(QEMU_ENV_SRC, cmd_source, capabilities, true);
         qtest_qmp_set_event_callback(*from,
                                      migrate_watch_for_events,
                                      &src_state);
@@ -411,8 +410,8 @@ int migrate_start(QTestState **from, QTestState **to, const char *uri,
                                  shmem_opts ? shmem_opts : "",
                                  args->opts_target ? args->opts_target : "",
                                  ignore_stderr);
-    *to = qtest_init_with_env_and_capabilities(QEMU_ENV_DST, cmd_target,
-                                               capabilities, !args->defer_target_connect);
+    *to = qtest_init_ext(QEMU_ENV_DST, cmd_target, capabilities,
+                         !args->defer_target_connect);
     qtest_qmp_set_event_callback(*to,
                                  migrate_watch_for_events,
                                  &dst_state);

From 3008224ca8a7415323f67d58d8c03e69bde49092 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Wed, 30 Apr 2025 15:28:17 +0200
Subject: [PATCH 0789/2760] tests/qtest/libqos: Avoid double swapping when
 using modern virtio
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The logic in the qvirtio_read/write function is rather a headache,
involving byte-swapping when the target is big endian, just to
maybe involve another byte-swapping  in the qtest_read/write
function immediately afterwards (on the QEMU side). Let's do it in
a more obvious way here: For virtio 1.0, we know that the values have
to be little endian, so let's read/write the bytes in that well known
order here.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250430132817.610903-1-thuth@redhat.com>
Signed-off-by: Fabiano Rosas <farosas@suse.de>
---
 tests/qtest/libqos/virtio.c | 44 ++++++++++++++++++++++++-------------
 1 file changed, 29 insertions(+), 15 deletions(-)

diff --git a/tests/qtest/libqos/virtio.c b/tests/qtest/libqos/virtio.c
index 2e7979652f..5a709d0bc5 100644
--- a/tests/qtest/libqos/virtio.c
+++ b/tests/qtest/libqos/virtio.c
@@ -25,49 +25,63 @@
  */
 static uint16_t qvirtio_readw(QVirtioDevice *d, QTestState *qts, uint64_t addr)
 {
-    uint16_t val = qtest_readw(qts, addr);
+    uint16_t val;
 
-    if (d->features & (1ull << VIRTIO_F_VERSION_1) && qtest_big_endian(qts)) {
-        val = bswap16(val);
+    if (d->features & (1ull << VIRTIO_F_VERSION_1)) {
+        qtest_memread(qts, addr, &val, sizeof(val));
+        val = le16_to_cpu(val);
+    } else {
+        val = qtest_readw(qts, addr);
     }
+
     return val;
 }
 
 static uint32_t qvirtio_readl(QVirtioDevice *d, QTestState *qts, uint64_t addr)
 {
-    uint32_t val = qtest_readl(qts, addr);
+    uint32_t val;
 
-    if (d->features & (1ull << VIRTIO_F_VERSION_1) && qtest_big_endian(qts)) {
-        val = bswap32(val);
+    if (d->features & (1ull << VIRTIO_F_VERSION_1)) {
+        qtest_memread(qts, addr, &val, sizeof(val));
+        val = le32_to_cpu(val);
+    } else {
+        val = qtest_readl(qts, addr);
     }
+
     return val;
 }
 
 static void qvirtio_writew(QVirtioDevice *d, QTestState *qts,
                            uint64_t addr, uint16_t val)
 {
-    if (d->features & (1ull << VIRTIO_F_VERSION_1) && qtest_big_endian(qts)) {
-        val = bswap16(val);
+    if (d->features & (1ull << VIRTIO_F_VERSION_1)) {
+        val = cpu_to_le16(val);
+        qtest_memwrite(qts, addr, &val, sizeof(val));
+    } else {
+        qtest_writew(qts, addr, val);
     }
-    qtest_writew(qts, addr, val);
 }
 
 static void qvirtio_writel(QVirtioDevice *d, QTestState *qts,
                            uint64_t addr, uint32_t val)
 {
-    if (d->features & (1ull << VIRTIO_F_VERSION_1) && qtest_big_endian(qts)) {
-        val = bswap32(val);
+    if (d->features & (1ull << VIRTIO_F_VERSION_1)) {
+        val = cpu_to_le32(val);
+        qtest_memwrite(qts, addr, &val, sizeof(val));
+    } else {
+        qtest_writel(qts, addr, val);
     }
-    qtest_writel(qts, addr, val);
 }
 
 static void qvirtio_writeq(QVirtioDevice *d, QTestState *qts,
                            uint64_t addr, uint64_t val)
 {
-    if (d->features & (1ull << VIRTIO_F_VERSION_1) && qtest_big_endian(qts)) {
-        val = bswap64(val);
+    if (d->features & (1ull << VIRTIO_F_VERSION_1)) {
+        val = cpu_to_le64(val);
+        qtest_memwrite(qts, addr, &val, sizeof(val));
+    } else {
+        qtest_writeq(qts, addr, val);
     }
-    qtest_writeq(qts, addr, val);
 }
 
 uint8_t qvirtio_config_readb(QVirtioDevice *d, uint64_t addr)

From 98008aa41b93b2477782205dcbd9ce5978f26a7e Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Fri, 14 Mar 2025 16:51:30 +0800
Subject: [PATCH 0790/2760] tests/qtest/cpu-plug-test: Add cpu hotplug support
 for LoongArch

Add cpu hotplug testcase support for LoongArch system, it passes to
run with command "make check-qtest-loongarch64" as following:
  qemu:qtest+qtest-loongarch64 / qtest-loongarch64/cpu-plug-test OK 0.38s 1 subtests passed

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250314085130.4184272-1-maobibo@loongson.cn>
Signed-off-by: Fabiano Rosas <farosas@suse.de>
---
 tests/qtest/cpu-plug-test.c | 24 ++++++++++++++++++++++++
 tests/qtest/meson.build     |  3 ++-
 2 files changed, 26 insertions(+), 1 deletion(-)

diff --git a/tests/qtest/cpu-plug-test.c b/tests/qtest/cpu-plug-test.c
index 6633abfc10..44d704680b 100644
--- a/tests/qtest/cpu-plug-test.c
+++ b/tests/qtest/cpu-plug-test.c
@@ -156,6 +156,28 @@ static void add_s390x_test_case(const char *mname)
     g_free(path);
 }
 
+static void add_loongarch_test_case(const char *mname)
+{
+    char *path;
+    PlugTestData *data;
+
+    data = g_new(PlugTestData, 1);
+    data->machine = g_strdup(mname);
+    data->cpu_model = "la464";
+    data->device_model = g_strdup("la464-loongarch-cpu");
+    data->sockets = 1;
+    data->cores = 3;
+    data->threads = 1;
+    data->maxcpus = data->sockets * data->cores * data->threads;
+
+    path = g_strdup_printf("cpu-plug/%s/device-add/%ux%ux%u&maxcpus=%u",
+                           mname, data->sockets, data->cores,
+                           data->threads, data->maxcpus);
+    qtest_add_data_func_full(path, data, test_plug_with_device_add,
+                             test_data_free);
+    g_free(path);
+}
+
 int main(int argc, char **argv)
 {
     const char *arch = qtest_get_arch();
@@ -168,6 +190,8 @@ int main(int argc, char **argv)
         qtest_cb_for_every_machine(add_pseries_test_case, g_test_quick());
     } else if (g_str_equal(arch, "s390x")) {
         qtest_cb_for_every_machine(add_s390x_test_case, g_test_quick());
+    } else if (g_str_equal(arch, "loongarch64")) {
+        add_loongarch_test_case("virt");
     }
 
     return g_test_run();
diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
index 3136d15e0f..7daf619845 100644
--- a/tests/qtest/meson.build
+++ b/tests/qtest/meson.build
@@ -148,7 +148,8 @@ qtests_hppa = \
 
 qtests_loongarch64 = qtests_filter + \
   (config_all_devices.has_key('CONFIG_LOONGARCH_VIRT') ? ['numa-test'] : []) + \
-  ['boot-serial-test']
+  ['boot-serial-test',
+   'cpu-plug-test']
 
 qtests_m68k = ['boot-serial-test'] + \
   qtests_filter

From 1abe9d78ef8de40ef43aaacfc83a095ebe648bd9 Mon Sep 17 00:00:00 2001
From: Gustavo Romero <gustavo.romero@linaro.org>
Date: Sun, 4 May 2025 21:56:30 +0000
Subject: [PATCH 0791/2760] hw/pci/pci.c: Turn DPRINTF into trace events

Remove PCI_DPRINTF() macro and use trace events instead.

Signed-off-by: Gustavo Romero <gustavo.romero@linaro.org>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/pci/pci.c        | 19 ++++++-------------
 hw/pci/trace-events |  4 ++++
 2 files changed, 10 insertions(+), 13 deletions(-)

diff --git a/hw/pci/pci.c b/hw/pci/pci.c
index fe38c4c028..352b3d12c8 100644
--- a/hw/pci/pci.c
+++ b/hw/pci/pci.c
@@ -54,13 +54,6 @@
 #include "hw/xen/xen.h"
 #include "hw/i386/kvm/xen_evtchn.h"
 
-//#define DEBUG_PCI
-#ifdef DEBUG_PCI
-# define PCI_DPRINTF(format, ...)       printf(format, ## __VA_ARGS__)
-#else
-# define PCI_DPRINTF(format, ...)       do { } while (0)
-#endif
-
 bool pci_available = true;
 
 static char *pcibus_get_dev_path(DeviceState *dev);
@@ -2439,12 +2432,12 @@ static void pci_patch_ids(PCIDevice *pdev, uint8_t *ptr, uint32_t size)
     /* Only a valid rom will be patched. */
     rom_magic = pci_get_word(ptr);
     if (rom_magic != 0xaa55) {
-        PCI_DPRINTF("Bad ROM magic %04x\n", rom_magic);
+        trace_pci_bad_rom_magic(rom_magic, 0xaa55);
         return;
     }
     pcir_offset = pci_get_word(ptr + 0x18);
     if (pcir_offset + 8 >= size || memcmp(ptr + pcir_offset, "PCIR", 4)) {
-        PCI_DPRINTF("Bad PCIR offset 0x%x or signature\n", pcir_offset);
+        trace_pci_bad_pcir_offset(pcir_offset);
         return;
     }
 
@@ -2453,8 +2446,8 @@ static void pci_patch_ids(PCIDevice *pdev, uint8_t *ptr, uint32_t size)
     rom_vendor_id = pci_get_word(ptr + pcir_offset + 4);
     rom_device_id = pci_get_word(ptr + pcir_offset + 6);
 
-    PCI_DPRINTF("%s: ROM id %04x%04x / PCI id %04x%04x\n", pdev->romfile,
-                vendor_id, device_id, rom_vendor_id, rom_device_id);
+    trace_pci_rom_and_pci_ids(pdev->romfile, vendor_id, device_id,
+                              rom_vendor_id, rom_device_id);
 
     checksum = ptr[6];
 
@@ -2462,7 +2455,7 @@ static void pci_patch_ids(PCIDevice *pdev, uint8_t *ptr, uint32_t size)
         /* Patch vendor id and checksum (at offset 6 for etherboot roms). */
         checksum += (uint8_t)rom_vendor_id + (uint8_t)(rom_vendor_id >> 8);
         checksum -= (uint8_t)vendor_id + (uint8_t)(vendor_id >> 8);
-        PCI_DPRINTF("ROM checksum %02x / %02x\n", ptr[6], checksum);
+        trace_pci_rom_checksum_change(ptr[6], checksum);
         ptr[6] = checksum;
         pci_set_word(ptr + pcir_offset + 4, vendor_id);
     }
@@ -2471,7 +2464,7 @@ static void pci_patch_ids(PCIDevice *pdev, uint8_t *ptr, uint32_t size)
         /* Patch device id and checksum (at offset 6 for etherboot roms). */
         checksum += (uint8_t)rom_device_id + (uint8_t)(rom_device_id >> 8);
         checksum -= (uint8_t)device_id + (uint8_t)(device_id >> 8);
-        PCI_DPRINTF("ROM checksum %02x / %02x\n", ptr[6], checksum);
+        trace_pci_rom_checksum_change(ptr[6], checksum);
         ptr[6] = checksum;
         pci_set_word(ptr + pcir_offset + 6, device_id);
     }
diff --git a/hw/pci/trace-events b/hw/pci/trace-events
index 6a9968962f..02c80d3ec8 100644
--- a/hw/pci/trace-events
+++ b/hw/pci/trace-events
@@ -6,6 +6,10 @@ pci_pm_transition(const char *dev, uint32_t bus, uint32_t slot, uint32_t func, u
 pci_update_mappings_del(const char *dev, uint32_t bus, uint32_t slot, uint32_t func, int bar, uint64_t addr, uint64_t size) "%s %02x:%02x.%x %d,0x%"PRIx64"+0x%"PRIx64
 pci_update_mappings_add(const char *dev, uint32_t bus, uint32_t slot, uint32_t func, int bar, uint64_t addr, uint64_t size) "%s %02x:%02x.%x %d,0x%"PRIx64"+0x%"PRIx64
 pci_route_irq(int dev_irq, const char *dev_path, int parent_irq, const char *parent_path) "IRQ %d @%s -> IRQ %d @%s"
+pci_bad_rom_magic(uint16_t bad_rom_magic, uint16_t good_rom_magic) "Bad ROM magic number: %04"PRIX16". Should be: %04"PRIX16
+pci_bad_pcir_offset(uint16_t pcir_offset) "Bad PCIR offset 0x%"PRIx16" or signature"
+pci_rom_and_pci_ids(char *romfile, uint16_t vendor_id, uint16_t device_id, uint16_t rom_vendor_id, uint16_t rom_device_id) "%s: ROM ID %04"PRIx16":%04"PRIx16" | PCI ID %04"PRIx16":%04"PRIx16
+pci_rom_checksum_change(uint8_t old_checksum, uint8_t new_checksum) "ROM checksum changed from %02"PRIx8" to %02"PRIx8
 
 # pci_host.c
 pci_cfg_read(const char *dev, uint32_t bus, uint32_t slot, uint32_t func, unsigned offs, unsigned val) "%s %02x:%02x.%x @0x%x -> 0x%x"

From 947c2b6d8bacb9cc2bcc2f54cb7367753f761a71 Mon Sep 17 00:00:00 2001
From: Gustavo Romero <gustavo.romero@linaro.org>
Date: Sun, 4 May 2025 21:56:31 +0000
Subject: [PATCH 0792/2760] hw/isa/ich9: Remove stray empty comment

Remove stray empty comment in IRQ routing function.

Signed-off-by: Gustavo Romero <gustavo.romero@linaro.org>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/isa/lpc_ich9.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/hw/isa/lpc_ich9.c b/hw/isa/lpc_ich9.c
index 71afb45b63..304dffac32 100644
--- a/hw/isa/lpc_ich9.c
+++ b/hw/isa/lpc_ich9.c
@@ -182,7 +182,6 @@ static uint64_t ich9_cc_read(void *opaque, hwaddr addr,
 }
 
 /* IRQ routing */
-/* */
 static void ich9_lpc_rout(uint8_t pirq_rout, int *pic_irq, int *pic_dis)
 {
     *pic_irq = pirq_rout & ICH9_LPC_PIRQ_ROUT_MASK;

From a917fd7a930115ac09e9680b51776252234697ac Mon Sep 17 00:00:00 2001
From: Gustavo Romero <gustavo.romero@linaro.org>
Date: Sun, 4 May 2025 21:56:35 +0000
Subject: [PATCH 0793/2760] hw/i386/acpi-build: Fix typo and grammar in comment

Fix typo and verb conjugation in a comment about FADT initialization.

Signed-off-by: Gustavo Romero <gustavo.romero@linaro.org>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/i386/acpi-build.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
index 3fffa4a332..b5836417a0 100644
--- a/hw/i386/acpi-build.c
+++ b/hw/i386/acpi-build.c
@@ -139,7 +139,7 @@ static void init_common_fadt_data(MachineState *ms, Object *o,
     /*
      * "ICH9-LPC" or "PIIX4_PM" has "smm-compat" property to keep the old
      * behavior for compatibility irrelevant to smm_enabled, which doesn't
-     * comforms to ACPI spec.
+     * conform to the ACPI spec.
      */
     bool smm_enabled = object_property_get_bool(o, "smm-compat", NULL) ?
         true : x86_machine_is_smm_enabled(x86ms);

From 67958690c8a14eb9451eb04815c125089e2ea4a5 Mon Sep 17 00:00:00 2001
From: Gustavo Romero <gustavo.romero@linaro.org>
Date: Sun, 4 May 2025 21:56:37 +0000
Subject: [PATCH 0794/2760] hw/i386/acpi-build: Update document reference

Update the reference for QEMU's ACPI PCI hotplug device interface. Also,
use the possessive form in the comment.

Signed-off-by: Gustavo Romero <gustavo.romero@linaro.org>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/i386/acpi-build.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/i386/acpi-build.h b/hw/i386/acpi-build.h
index 0dce155c8c..275ec058a1 100644
--- a/hw/i386/acpi-build.h
+++ b/hw/i386/acpi-build.h
@@ -5,7 +5,7 @@
 
 extern const struct AcpiGenericAddress x86_nvdimm_acpi_dsmio;
 
-/* PCI Hot-plug registers bases. See docs/spec/acpi_pci_hotplug.txt */
+/* PCI Hot-plug registers' base. See docs/specs/acpi_pci_hotplug.rst */
 #define ACPI_PCIHP_SEJ_BASE 0x8
 #define ACPI_PCIHP_BNMR_BASE 0x10
 

From be06edd3edac94406a5b121c151d72fa493a0ae1 Mon Sep 17 00:00:00 2001
From: Gustavo Romero <gustavo.romero@linaro.org>
Date: Sun, 4 May 2025 21:56:39 +0000
Subject: [PATCH 0795/2760] hw/acpi/ich9: Remove ICH9_DEBUG macro

Remove the ICH9_DEBUG macro, which is only used to dump the value of the
pm_io_base parameter, passed to ich9_pm_iospace_update(). It provides
little to no value and is not worth converting to a trace event.

Signed-off-by: Gustavo Romero <gustavo.romero@linaro.org>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/acpi/ich9.c | 11 -----------
 1 file changed, 11 deletions(-)

diff --git a/hw/acpi/ich9.c b/hw/acpi/ich9.c
index c7a735bf64..9c0b7437b7 100644
--- a/hw/acpi/ich9.c
+++ b/hw/acpi/ich9.c
@@ -41,15 +41,6 @@
 #include "hw/mem/pc-dimm.h"
 #include "hw/mem/nvdimm.h"
 
-//#define DEBUG
-
-#ifdef DEBUG
-#define ICH9_DEBUG(fmt, ...) \
-do { printf("%s "fmt, __func__, ## __VA_ARGS__); } while (0)
-#else
-#define ICH9_DEBUG(fmt, ...)    do { } while (0)
-#endif
-
 static void ich9_pm_update_sci_fn(ACPIREGS *regs)
 {
     ICH9LPCPMRegs *pm = container_of(regs, ICH9LPCPMRegs, acpi_regs);
@@ -135,8 +126,6 @@ static const MemoryRegionOps ich9_smi_ops = {
 
 void ich9_pm_iospace_update(ICH9LPCPMRegs *pm, uint32_t pm_io_base)
 {
-    ICH9_DEBUG("to 0x%x\n", pm_io_base);
-
     assert((pm_io_base & ICH9_PMIO_MASK) == 0);
 
     pm->pm_io_base = pm_io_base;

From cc9c8fcf3cbffb64402a70a4473092f463cd4e87 Mon Sep 17 00:00:00 2001
From: Gustavo Romero <gustavo.romero@linaro.org>
Date: Sun, 4 May 2025 21:56:36 +0000
Subject: [PATCH 0796/2760] hw/i386/acpi-build: Fix typo in function name

Fix missing "i" in the name of the function responsible for adding the call to
the PCI notification method (PCNT) in the ACPI table.

Signed-off-by: Gustavo Romero <gustavo.romero@linaro.org>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/i386/acpi-build.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
index b5836417a0..f40ad062f9 100644
--- a/hw/i386/acpi-build.c
+++ b/hw/i386/acpi-build.c
@@ -589,8 +589,8 @@ void build_append_pci_bus_devices(Aml *parent_scope, PCIBus *bus)
     }
 }
 
-static bool build_append_notfication_callback(Aml *parent_scope,
-                                              const PCIBus *bus)
+static bool build_append_notification_callback(Aml *parent_scope,
+                                               const PCIBus *bus)
 {
     Aml *method;
     PCIBus *sec;
@@ -604,7 +604,7 @@ static bool build_append_notfication_callback(Aml *parent_scope,
             continue;
         }
         nr_notifiers = nr_notifiers +
-                       build_append_notfication_callback(br_scope, sec);
+                       build_append_notification_callback(br_scope, sec);
         /*
          * add new child scope to parent
          * and keep track of bus that have PCNT,
@@ -1773,7 +1773,7 @@ build_dsdt(GArray *table_data, BIOSLinker *linker,
         PCIBus *b = PCI_HOST_BRIDGE(pci_host)->bus;
 
         scope = aml_scope("\\_SB.PCI0");
-        has_pcnt = build_append_notfication_callback(scope, b);
+        has_pcnt = build_append_notification_callback(scope, b);
         if (has_pcnt) {
             aml_append(dsdt, scope);
         }

From f6527ddff85ac7600fb73b3c835bf7bb5f3e3478 Mon Sep 17 00:00:00 2001
From: Gustavo Romero <gustavo.romero@linaro.org>
Date: Sun, 4 May 2025 21:56:34 +0000
Subject: [PATCH 0797/2760] hw/core/machine: Fix indentation

Fix indentation for some elements in the hardware compat arrays.

Signed-off-by: Gustavo Romero <gustavo.romero@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/core/machine.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/hw/core/machine.c b/hw/core/machine.c
index ed01798d37..b8ae155dfa 100644
--- a/hw/core/machine.c
+++ b/hw/core/machine.c
@@ -41,7 +41,7 @@ GlobalProperty hw_compat_10_0[] = {};
 const size_t hw_compat_10_0_len = G_N_ELEMENTS(hw_compat_10_0);
 
 GlobalProperty hw_compat_9_2[] = {
-    {"arm-cpu", "backcompat-pauth-default-use-qarma5", "true"},
+    { "arm-cpu", "backcompat-pauth-default-use-qarma5", "true"},
     { "virtio-balloon-pci", "vectors", "0" },
     { "virtio-balloon-pci-transitional", "vectors", "0" },
     { "virtio-balloon-pci-non-transitional", "vectors", "0" },
@@ -58,12 +58,12 @@ GlobalProperty hw_compat_9_1[] = {
 const size_t hw_compat_9_1_len = G_N_ELEMENTS(hw_compat_9_1);
 
 GlobalProperty hw_compat_9_0[] = {
-    {"arm-cpu", "backcompat-cntfrq", "true" },
+    { "arm-cpu", "backcompat-cntfrq", "true" },
     { "scsi-hd", "migrate-emulated-scsi-request", "false" },
     { "scsi-cd", "migrate-emulated-scsi-request", "false" },
-    {"vfio-pci", "skip-vsc-check", "false" },
+    { "vfio-pci", "skip-vsc-check", "false" },
     { "virtio-pci", "x-pcie-pm-no-soft-reset", "off" },
-    {"sd-card", "spec_version", "2" },
+    { "sd-card", "spec_version", "2" },
 };
 const size_t hw_compat_9_0_len = G_N_ELEMENTS(hw_compat_9_0);
 

From 6b9ef6f9a8c5a8f53739579afa0b671573f69cd0 Mon Sep 17 00:00:00 2001
From: Gustavo Romero <gustavo.romero@linaro.org>
Date: Sun, 4 May 2025 21:56:33 +0000
Subject: [PATCH 0798/2760] qom/object: Fix typo in comment

Fix duplicate preposition in comment.

Signed-off-by: Gustavo Romero <gustavo.romero@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 qom/object.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/qom/object.c b/qom/object.c
index 664f0f24ae..7b013f40a0 100644
--- a/qom/object.c
+++ b/qom/object.c
@@ -485,7 +485,7 @@ bool object_apply_global_props(Object *obj, const GPtrArray *props,
  * Slot 0: accelerator's global property defaults
  * Slot 1: machine's global property defaults
  * Slot 2: global properties from legacy command line option
- * Each is a GPtrArray of of GlobalProperty.
+ * Each is a GPtrArray of GlobalProperty.
  * Applied in order, later entries override earlier ones.
  */
 static GPtrArray *object_compat_props[3];

From 55b38d23454ffc8907897aed3fa75d3fc8d27333 Mon Sep 17 00:00:00 2001
From: Gustavo Romero <gustavo.romero@linaro.org>
Date: Sun, 4 May 2025 21:56:32 +0000
Subject: [PATCH 0799/2760] hw/net/e1000: Remove stray empty comment in header

In the header file, remove a stray empty comment in the Offload Context
Descriptor struct.

Signed-off-by: Gustavo Romero <gustavo.romero@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/net/e1000x_regs.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/net/e1000x_regs.h b/hw/net/e1000x_regs.h
index cd896fc0ca..e9a74de6f4 100644
--- a/hw/net/e1000x_regs.h
+++ b/hw/net/e1000x_regs.h
@@ -900,7 +900,7 @@ struct e1000_context_desc {
             uint16_t tucse;     /* TCP checksum end */
         } tcp_fields;
     } upper_setup;
-    uint32_t cmd_and_length;    /* */
+    uint32_t cmd_and_length;
     union {
         uint32_t data;
         struct {

From 4394d23e4952e8c8fbef7e3a132414e7891d8062 Mon Sep 17 00:00:00 2001
From: Gustavo Romero <gustavo.romero@linaro.org>
Date: Sun, 4 May 2025 21:56:29 +0000
Subject: [PATCH 0800/2760] hw/pci-host/gpex-acpi: Fix typo in comment

Fix typo in a comment about the creation of the ACPI CRS method.

Signed-off-by: Gustavo Romero <gustavo.romero@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/pci-host/gpex-acpi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/pci-host/gpex-acpi.c b/hw/pci-host/gpex-acpi.c
index e8b4c64c5f..0aba47c71c 100644
--- a/hw/pci-host/gpex-acpi.c
+++ b/hw/pci-host/gpex-acpi.c
@@ -182,7 +182,7 @@ void acpi_dsdt_add_gpex(Aml *scope, struct GPEXConfig *cfg)
 
             /*
              * Resources defined for PXBs are composed of the following parts:
-             * 1. The resources the pci-brige/pcie-root-port need.
+             * 1. The resources the pci-bridge/pcie-root-port need.
              * 2. The resources the devices behind pxb need.
              */
             crs = build_crs(PCI_HOST_BRIDGE(BUS(bus)->parent), &crs_range_set,

From 07153411cd57e8d6933ab8a43035ed097deee696 Mon Sep 17 00:00:00 2001
From: Gustavo Romero <gustavo.romero@linaro.org>
Date: Sun, 4 May 2025 21:56:38 +0000
Subject: [PATCH 0801/2760] hw/acpi/pcihp: Fix typo in function name

Fix typo in QEMU's ACPI PCI hotplug API function name that checks
whether a given bus is hotplug-capable.

Signed-off-by: Gustavo Romero <gustavo.romero@linaro.org>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/acpi/acpi-pci-hotplug-stub.c | 2 +-
 hw/acpi/ich9.c                  | 2 +-
 hw/acpi/pcihp.c                 | 2 +-
 hw/acpi/piix4.c                 | 2 +-
 include/hw/acpi/pcihp.h         | 2 +-
 5 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/hw/acpi/acpi-pci-hotplug-stub.c b/hw/acpi/acpi-pci-hotplug-stub.c
index b67b4a92da..b7bc6e40a1 100644
--- a/hw/acpi/acpi-pci-hotplug-stub.c
+++ b/hw/acpi/acpi-pci-hotplug-stub.c
@@ -34,7 +34,7 @@ void acpi_pcihp_reset(AcpiPciHpState *s)
 {
 }
 
-bool acpi_pcihp_is_hotpluggbale_bus(AcpiPciHpState *s, BusState *bus)
+bool acpi_pcihp_is_hotpluggable_bus(AcpiPciHpState *s, BusState *bus)
 {
     return true;
 }
diff --git a/hw/acpi/ich9.c b/hw/acpi/ich9.c
index 9c0b7437b7..967b67485e 100644
--- a/hw/acpi/ich9.c
+++ b/hw/acpi/ich9.c
@@ -559,7 +559,7 @@ void ich9_pm_device_unplug_cb(HotplugHandler *hotplug_dev, DeviceState *dev,
 bool ich9_pm_is_hotpluggable_bus(HotplugHandler *hotplug_dev, BusState *bus)
 {
     ICH9LPCState *lpc = ICH9_LPC_DEVICE(hotplug_dev);
-    return acpi_pcihp_is_hotpluggbale_bus(&lpc->pm.acpi_pci_hotplug, bus);
+    return acpi_pcihp_is_hotpluggable_bus(&lpc->pm.acpi_pci_hotplug, bus);
 }
 
 void ich9_pm_ospm_status(AcpiDeviceIf *adev, ACPIOSTInfoList ***list)
diff --git a/hw/acpi/pcihp.c b/hw/acpi/pcihp.c
index 5f79c9016b..aac90013d4 100644
--- a/hw/acpi/pcihp.c
+++ b/hw/acpi/pcihp.c
@@ -371,7 +371,7 @@ void acpi_pcihp_device_unplug_request_cb(HotplugHandler *hotplug_dev,
     acpi_send_event(DEVICE(hotplug_dev), ACPI_PCI_HOTPLUG_STATUS);
 }
 
-bool acpi_pcihp_is_hotpluggbale_bus(AcpiPciHpState *s, BusState *bus)
+bool acpi_pcihp_is_hotpluggable_bus(AcpiPciHpState *s, BusState *bus)
 {
     Object *o = OBJECT(bus->parent);
 
diff --git a/hw/acpi/piix4.c b/hw/acpi/piix4.c
index b16d45f03e..d98b80df6d 100644
--- a/hw/acpi/piix4.c
+++ b/hw/acpi/piix4.c
@@ -406,7 +406,7 @@ static bool piix4_is_hotpluggable_bus(HotplugHandler *hotplug_dev,
                                       BusState *bus)
 {
     PIIX4PMState *s = PIIX4_PM(hotplug_dev);
-    return acpi_pcihp_is_hotpluggbale_bus(&s->acpi_pci_hotplug, bus);
+    return acpi_pcihp_is_hotpluggable_bus(&s->acpi_pci_hotplug, bus);
 }
 
 static void piix4_pm_machine_ready(Notifier *n, void *opaque)
diff --git a/include/hw/acpi/pcihp.h b/include/hw/acpi/pcihp.h
index ac21a95913..a97904bada 100644
--- a/include/hw/acpi/pcihp.h
+++ b/include/hw/acpi/pcihp.h
@@ -58,7 +58,7 @@ typedef struct AcpiPciHpState {
 void acpi_pcihp_init(Object *owner, AcpiPciHpState *, PCIBus *root,
                      MemoryRegion *io, uint16_t io_base);
 
-bool acpi_pcihp_is_hotpluggbale_bus(AcpiPciHpState *s, BusState *bus);
+bool acpi_pcihp_is_hotpluggable_bus(AcpiPciHpState *s, BusState *bus);
 void acpi_pcihp_device_pre_plug_cb(HotplugHandler *hotplug_dev,
                                    DeviceState *dev, Error **errp);
 void acpi_pcihp_device_plug_cb(HotplugHandler *hotplug_dev, AcpiPciHpState *s,

From 688e4a6e7757f6f2e5da3c15b8efe6ed737e34b5 Mon Sep 17 00:00:00 2001
From: Michael Tokarev <mjt@tls.msk.ru>
Date: Wed, 7 May 2025 19:59:34 +0300
Subject: [PATCH 0802/2760] linux-user/mmap.c: fix "of of" typo in comment

Suggested-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 linux-user/mmap.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/linux-user/mmap.c b/linux-user/mmap.c
index f88a80c31e..002e1e668e 100644
--- a/linux-user/mmap.c
+++ b/linux-user/mmap.c
@@ -645,7 +645,7 @@ static abi_long mmap_h_eq_g(abi_ulong start, abi_ulong len,
  *
  * However, this case is rather common with executable images,
  * so the workaround is important for even trivial tests, whereas
- * the mmap of of a file being extended is less common.
+ * the mmap of a file being extended is less common.
  */
 static abi_long mmap_h_lt_g(abi_ulong start, abi_ulong len, int host_prot,
                             int mmap_flags, int page_flags, int fd,

From 8c3edfa94cc981f1964e6c957314f0248fd9b4c3 Mon Sep 17 00:00:00 2001
From: Michael Tokarev <mjt@tls.msk.ru>
Date: Wed, 7 May 2025 20:03:13 +0300
Subject: [PATCH 0803/2760] block.c: fix "the the" typo in comment

Suggested-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 block.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/block.c b/block.c
index 0ece805e41..f222e1a50a 100644
--- a/block.c
+++ b/block.c
@@ -3153,7 +3153,7 @@ bdrv_attach_child_common(BlockDriverState *child_bs,
      * stop new requests from coming in. This is fine, we don't care about the
      * old requests here, they are not for this child. If another place enters a
      * drain section for the same parent, but wants it to be fully quiesced, it
-     * will not run most of the the code in .drained_begin() again (which is not
+     * will not run most of the code in .drained_begin() again (which is not
      * a problem, we already did this), but it will still poll until the parent
      * is fully quiesced, so it will not be negatively affected either.
      */

From f9028224e74bd9d25bdaac05b76cac03d53fbaee Mon Sep 17 00:00:00 2001
From: Michael Tokarev <mjt@tls.msk.ru>
Date: Wed, 7 May 2025 20:03:13 +0300
Subject: [PATCH 0804/2760] hw/xen/xen-hvm-common.c: fix "the the" typo in
 comment

Suggested-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/xen/xen-hvm-common.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/xen/xen-hvm-common.c b/hw/xen/xen-hvm-common.c
index 9a677e8ed7..78e0bc8f64 100644
--- a/hw/xen/xen-hvm-common.c
+++ b/hw/xen/xen-hvm-common.c
@@ -711,7 +711,7 @@ static int xen_map_ioreq_server(XenIOState *state)
     /*
      * If we fail to map the shared page with xenforeignmemory_map_resource()
      * or if we're using buffered ioreqs, we need xen_get_ioreq_server_info()
-     * to provide the the addresses to map the shared page and/or to get the
+     * to provide the addresses to map the shared page and/or to get the
      * event-channel port for buffered ioreqs.
      */
     if (state->shared_page == NULL || state->has_bufioreq) {

From e3933824d225b9a0aad6d4d78cb5f902a604b310 Mon Sep 17 00:00:00 2001
From: Michael Tokarev <mjt@tls.msk.ru>
Date: Wed, 7 May 2025 20:03:13 +0300
Subject: [PATCH 0805/2760] include/exec/cpu-common.h: fix "the the" typo in
 comment

Suggested-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 include/exec/cpu-common.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/exec/cpu-common.h b/include/exec/cpu-common.h
index dab1e7e580..a68485547d 100644
--- a/include/exec/cpu-common.h
+++ b/include/exec/cpu-common.h
@@ -182,7 +182,7 @@ void list_cpus(void);
  * @host_pc: the host pc within the translation
  * @data: output data
  *
- * Attempt to load the the unwind state for a host pc occurring in
+ * Attempt to load the unwind state for a host pc occurring in
  * translated code.  If @host_pc is not in translated code, the
  * function returns false; otherwise @data is loaded.
  * This is the same unwind info as given to restore_state_to_opc.

From c7c513389c6cb8c6dd60e55d1c99244de4e93663 Mon Sep 17 00:00:00 2001
From: Michael Tokarev <mjt@tls.msk.ru>
Date: Wed, 7 May 2025 20:03:14 +0300
Subject: [PATCH 0806/2760] include/hw/xen/interface/io/blkif.h: fix "the the"
 typo in comment

Suggested-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 include/hw/xen/interface/io/blkif.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/hw/xen/interface/io/blkif.h b/include/hw/xen/interface/io/blkif.h
index 22f1eef0c0..c5527999d1 100644
--- a/include/hw/xen/interface/io/blkif.h
+++ b/include/hw/xen/interface/io/blkif.h
@@ -324,7 +324,7 @@
  *      access (even when it should be read-only). If the frontend hits the
  *      maximum number of allowed persistently mapped grants, it can fallback
  *      to non persistent mode. This will cause a performance degradation,
- *      since the the backend driver will still try to map those grants
+ *      since the backend driver will still try to map those grants
  *      persistently. Since the persistent grants protocol is compatible with
  *      the previous protocol, a frontend driver can choose to work in
  *      persistent mode even when the backend doesn't support it.

From 2ddf5a8714221568dbdd8119ca123933cf5fad46 Mon Sep 17 00:00:00 2001
From: Michael Tokarev <mjt@tls.msk.ru>
Date: Wed, 7 May 2025 20:03:14 +0300
Subject: [PATCH 0807/2760] qapi/qom.json: fix "the the" typo in comment

Suggested-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 qapi/qom.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/qapi/qom.json b/qapi/qom.json
index 28ce24cd8d..04c118e4d6 100644
--- a/qapi/qom.json
+++ b/qapi/qom.json
@@ -871,7 +871,7 @@
 #     link characteristics read from PCIe Configuration space.
 #     To get the full path latency from CPU to CXL attached DRAM
 #     CXL device:  Add the latency from CPU to Generic Port (from
-#     HMAT indexed via the the node ID in this SRAT structure) to
+#     HMAT indexed via the node ID in this SRAT structure) to
 #     that for CXL bus links, the latency across intermediate switches
 #     and from the EP port to the actual memory.  Bandwidth is more
 #     complex as there may be interleaving across multiple devices

From 231a8420deed10046e0d8cf23a8a134dc7626cb4 Mon Sep 17 00:00:00 2001
From: Michael Tokarev <mjt@tls.msk.ru>
Date: Wed, 7 May 2025 20:07:16 +0300
Subject: [PATCH 0808/2760] hw/display/apple-gfx.m: fix "in in" typo in comment

Suggested-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/display/apple-gfx.m | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/display/apple-gfx.m b/hw/display/apple-gfx.m
index 2ff1c90df7..8dde1f138d 100644
--- a/hw/display/apple-gfx.m
+++ b/hw/display/apple-gfx.m
@@ -69,7 +69,7 @@ struct PGTask_s {
     mach_vm_address_t address;
     uint64_t len;
     /*
-     * All unique MemoryRegions for which a mapping has been created in in this
+     * All unique MemoryRegions for which a mapping has been created in this
      * task, and on which we have thus called memory_region_ref(). There are
      * usually very few regions of system RAM in total, so we expect this array
      * to be very short. Therefore, no need for sorting or fancy search

From 323727cfbfe68b6c62fc656ad7c99f60051d1d86 Mon Sep 17 00:00:00 2001
From: Michael Tokarev <mjt@tls.msk.ru>
Date: Wed, 7 May 2025 20:07:16 +0300
Subject: [PATCH 0809/2760] qapi/machine-target.json: fix "in in" typo in
 comment

Suggested-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 qapi/machine-target.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/qapi/machine-target.json b/qapi/machine-target.json
index 541f93eeb7..426ce4ee82 100644
--- a/qapi/machine-target.json
+++ b/qapi/machine-target.json
@@ -350,7 +350,7 @@
 #     migration-safe in the future (since 4.1)
 #
 # @deprecated: If true, this CPU model is deprecated and may be
-#     removed in in some future version of QEMU according to the QEMU
+#     removed in some future version of QEMU according to the QEMU
 #     deprecation policy.  (since 5.2)
 #
 # @unavailable-features is a list of QOM property names that represent

From fd53da209620dffab43a051bc4cc1950df6babab Mon Sep 17 00:00:00 2001
From: Integral <integral@archlinuxcn.org>
Date: Sun, 6 Apr 2025 16:45:18 +0800
Subject: [PATCH 0810/2760] docs: replace `-hda` with `-drive` & update `root=`
 kernel parameter

According to QEMU manual:

Older options like `-hda` are essentially macros which expand into
`-drive` options for various drive interfaces. The original forms
bake in a lot of assumptions from the days when QEMU was emulating a
legacy PC, they are not recommended for modern configurations.

Signed-off-by: Integral <integral@archlinuxcn.org>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 docs/system/gdb.rst         | 2 +-
 docs/system/linuxboot.rst   | 6 +++---
 docs/system/target-mips.rst | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/docs/system/gdb.rst b/docs/system/gdb.rst
index 4228cb56bb..d50470b135 100644
--- a/docs/system/gdb.rst
+++ b/docs/system/gdb.rst
@@ -20,7 +20,7 @@ connection, use the ``-gdb dev`` option instead of ``-s``. See
 
 .. parsed-literal::
 
-   |qemu_system| -s -S -kernel bzImage -hda rootdisk.img -append "root=/dev/hda"
+   |qemu_system| -s -S -kernel bzImage -drive file=rootdisk.img,format=raw -append "root=/dev/sda"
 
 QEMU will launch but will silently wait for gdb to connect.
 
diff --git a/docs/system/linuxboot.rst b/docs/system/linuxboot.rst
index 5db2e560dc..2328b4a73d 100644
--- a/docs/system/linuxboot.rst
+++ b/docs/system/linuxboot.rst
@@ -11,7 +11,7 @@ The syntax is:
 
 .. parsed-literal::
 
-   |qemu_system| -kernel bzImage -hda rootdisk.img -append "root=/dev/hda"
+   |qemu_system| -kernel bzImage -drive file=rootdisk.img,format=raw -append "root=/dev/sda"
 
 Use ``-kernel`` to provide the Linux kernel image and ``-append`` to
 give the kernel command line arguments. The ``-initrd`` option can be
@@ -23,8 +23,8 @@ virtual serial port and the QEMU monitor to the console with the
 
 .. parsed-literal::
 
-   |qemu_system| -kernel bzImage -hda rootdisk.img \
-                    -append "root=/dev/hda console=ttyS0" -nographic
+   |qemu_system| -kernel bzImage -drive file=rootdisk.img,format=raw \
+                    -append "root=/dev/sda console=ttyS0" -nographic
 
 Use Ctrl-a c to switch between the serial console and the monitor (see
 :ref:`GUI_keys`).
diff --git a/docs/system/target-mips.rst b/docs/system/target-mips.rst
index 83239fb9df..9028c3b304 100644
--- a/docs/system/target-mips.rst
+++ b/docs/system/target-mips.rst
@@ -112,5 +112,5 @@ https://mipsdistros.mips.com/LinuxDistro/nanomips/kernels/v4.15.18-432-gb2eb9a8b
 Start system emulation of Malta board with nanoMIPS I7200 CPU::
 
    qemu-system-mipsel -cpu I7200 -kernel <kernel_image_file> \
-       -M malta -serial stdio -m <memory_size> -hda <disk_image_file> \
+       -M malta -serial stdio -m <memory_size> -drive file=<disk_image_file>,format=raw \
        -append "mem=256m@0x0 rw console=ttyS0 vga=cirrus vesa=0x111 root=/dev/sda"

From 2f418cc9915284cb8eb7d607ec70fe13fe55ce5c Mon Sep 17 00:00:00 2001
From: Gustavo Romero <gustavo.romero@linaro.org>
Date: Fri, 9 May 2025 16:21:58 +0100
Subject: [PATCH 0811/2760] docs/devel/testing/functional: Fix typo

Fix the duplication of the word 'run'.

Signed-off-by: Gustavo Romero <gustavo.romero@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 docs/devel/testing/functional.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/devel/testing/functional.rst b/docs/devel/testing/functional.rst
index 8030cb4299..9e56dd1b11 100644
--- a/docs/devel/testing/functional.rst
+++ b/docs/devel/testing/functional.rst
@@ -274,7 +274,7 @@ speed mode in the meson.build file, while the "quick" speed mode is
 fine for functional tests that can be run without downloading files.
 ``make check`` then only runs the quick functional tests along with
 the other quick tests from the other test suites. If you choose to
-run only run ``make check-functional``, the "thorough" tests will be
+run only ``make check-functional``, the "thorough" tests will be
 executed, too. And to run all functional tests along with the others,
 you can use something like::
 

From 5346686182472c21a782a9346feaabe72b26f509 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 5 Jul 2024 09:12:20 +0200
Subject: [PATCH 0812/2760] meson: drop --enable-avx* options

Just detect compiler support and always enable the optimizations if
it is avilable; warn if the user did request AVX2/AVX512 use via
-Dx86_version= but the intrinsics are not available.

Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 meson.build                   | 30 +++++++++++++++++++-----------
 meson_options.txt             |  4 ----
 scripts/meson-buildoptions.sh |  6 ------
 3 files changed, 19 insertions(+), 21 deletions(-)

diff --git a/meson.build b/meson.build
index e819a7084c..f20a172299 100644
--- a/meson.build
+++ b/meson.build
@@ -3097,22 +3097,16 @@ config_host_data.set('CONFIG_ASM_HWPROBE_H',
                      cc.has_header_symbol('asm/hwprobe.h',
                                           'RISCV_HWPROBE_EXT_ZBA'))
 
-config_host_data.set('CONFIG_AVX2_OPT', get_option('avx2') \
-  .require(have_cpuid_h, error_message: 'cpuid.h not available, cannot enable AVX2') \
-  .require(cc.links('''
-    #include <cpuid.h>
+if have_cpuid_h
+  have_avx2 = cc.links('''
     #include <immintrin.h>
     static int __attribute__((target("avx2"))) bar(void *a) {
       __m256i x = *(__m256i *)a;
       return _mm256_testz_si256(x, x);
     }
     int main(int argc, char *argv[]) { return bar(argv[argc - 1]); }
-  '''), error_message: 'AVX2 not available').allowed())
-
-config_host_data.set('CONFIG_AVX512BW_OPT', get_option('avx512bw') \
-  .require(have_cpuid_h, error_message: 'cpuid.h not available, cannot enable AVX512BW') \
-  .require(cc.links('''
-    #include <cpuid.h>
+  ''')
+  have_avx512bw = cc.links('''
     #include <immintrin.h>
     static int __attribute__((target("avx512bw"))) bar(void *a) {
       __m512i *x = a;
@@ -3120,7 +3114,21 @@ config_host_data.set('CONFIG_AVX512BW_OPT', get_option('avx512bw') \
       return res[1];
     }
     int main(int argc, char *argv[]) { return bar(argv[0]); }
-  '''), error_message: 'AVX512BW not available').allowed())
+  ''')
+  if get_option('x86_version') >= '3' and not have_avx2
+    error('Cannot enable AVX optimizations due to missing intrinsics')
+  elif get_option('x86_version') >= '4' and not have_avx512bw
+    error('Cannot enable AVX512 optimizations due to missing intrinsics')
+  endif
+else
+  have_avx2 = false
+  have_avx512bw = false
+  if get_option('x86_version') >= '3'
+    error('Cannot enable AVX optimizations due to missing cpuid.h')
+  endif
+endif
+config_host_data.set('CONFIG_AVX2_OPT', have_avx2)
+config_host_data.set('CONFIG_AVX512BW_OPT', have_avx512bw)
 
 # For both AArch64 and AArch32, detect if builtins are available.
 config_host_data.set('CONFIG_ARM_AES_BUILTIN', cc.compiles('''
diff --git a/meson_options.txt b/meson_options.txt
index cc66b46c63..a442be2995 100644
--- a/meson_options.txt
+++ b/meson_options.txt
@@ -123,10 +123,6 @@ option('valgrind', type : 'feature', value: 'auto',
 option('membarrier', type: 'feature', value: 'disabled',
        description: 'membarrier system call (for Linux 4.14+ or Windows')
 
-option('avx2', type: 'feature', value: 'auto',
-       description: 'AVX2 optimizations')
-option('avx512bw', type: 'feature', value: 'auto',
-       description: 'AVX512BW optimizations')
 option('keyring', type: 'feature', value: 'auto',
        description: 'Linux keyring support')
 option('libkeyutils', type: 'feature', value: 'auto',
diff --git a/scripts/meson-buildoptions.sh b/scripts/meson-buildoptions.sh
index 8a67a14e2e..f09ef9604f 100644
--- a/scripts/meson-buildoptions.sh
+++ b/scripts/meson-buildoptions.sh
@@ -97,8 +97,6 @@ meson_options_help() {
   printf "%s\n" '  alsa            ALSA sound support'
   printf "%s\n" '  attr            attr/xattr support'
   printf "%s\n" '  auth-pam        PAM access control'
-  printf "%s\n" '  avx2            AVX2 optimizations'
-  printf "%s\n" '  avx512bw        AVX512BW optimizations'
   printf "%s\n" '  blkio           libblkio block device driver'
   printf "%s\n" '  bochs           bochs image format support'
   printf "%s\n" '  bpf             eBPF support'
@@ -244,10 +242,6 @@ _meson_option_parse() {
     --audio-drv-list=*) quote_sh "-Daudio_drv_list=$2" ;;
     --enable-auth-pam) printf "%s" -Dauth_pam=enabled ;;
     --disable-auth-pam) printf "%s" -Dauth_pam=disabled ;;
-    --enable-avx2) printf "%s" -Davx2=enabled ;;
-    --disable-avx2) printf "%s" -Davx2=disabled ;;
-    --enable-avx512bw) printf "%s" -Davx512bw=enabled ;;
-    --disable-avx512bw) printf "%s" -Davx512bw=disabled ;;
     --enable-gcov) printf "%s" -Db_coverage=true ;;
     --disable-gcov) printf "%s" -Db_coverage=false ;;
     --enable-lto) printf "%s" -Db_lto=true ;;

From e3c426cb78d47b42af9ab296408115cab20f2060 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Mon, 9 May 2022 12:50:29 +0200
Subject: [PATCH 0813/2760] meson: do not check supported TCG architecture if
 no emulators built
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Errors about TCI are pointless if only tools are being built; suppress
them even if the user did not specify --disable-tcg.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 accel/tcg/meson.build |  2 +-
 meson.build           | 10 ++++++----
 tcg/meson.build       |  2 +-
 3 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/accel/tcg/meson.build b/accel/tcg/meson.build
index d6f533f9a1..97d5e5a711 100644
--- a/accel/tcg/meson.build
+++ b/accel/tcg/meson.build
@@ -1,4 +1,4 @@
-if not get_option('tcg').allowed()
+if not have_tcg
    subdir_done()
 endif
 
diff --git a/meson.build b/meson.build
index f20a172299..a2cebd4465 100644
--- a/meson.build
+++ b/meson.build
@@ -247,6 +247,8 @@ have_vhost_net_vdpa = have_vhost_vdpa and get_option('vhost_net').allowed()
 have_vhost_net_kernel = have_vhost_kernel and get_option('vhost_net').allowed()
 have_vhost_net = have_vhost_net_kernel or have_vhost_net_user or have_vhost_net_vdpa
 
+have_tcg = get_option('tcg').allowed() and (have_system or have_user)
+
 have_tools = get_option('tools') \
   .disable_auto_if(not have_system) \
   .allowed()
@@ -863,7 +865,7 @@ elif host_os == 'haiku'
             cc.find_library('network'),
             cc.find_library('bsd')]
 elif host_os == 'openbsd'
-  if get_option('tcg').allowed() and target_dirs.length() > 0
+  if have_tcg
     # Disable OpenBSD W^X if available
     emulator_link_args = cc.get_supported_link_arguments('-Wl,-z,wxneeded')
   endif
@@ -904,7 +906,7 @@ if host_os == 'netbsd'
 endif
 
 tcg_arch = host_arch
-if get_option('tcg').allowed()
+if have_tcg
   if host_arch == 'unknown'
     if not get_option('tcg_interpreter')
       error('Unsupported CPU @0@, try --enable-tcg-interpreter'.format(cpu))
@@ -2534,7 +2536,7 @@ config_host_data.set('CONFIG_PIXMAN', pixman.found())
 config_host_data.set('CONFIG_SLIRP', slirp.found())
 config_host_data.set('CONFIG_SNAPPY', snappy.found())
 config_host_data.set('CONFIG_SOLARIS', host_os == 'sunos')
-if get_option('tcg').allowed()
+if have_tcg
   config_host_data.set('CONFIG_TCG', 1)
   config_host_data.set('CONFIG_TCG_INTERPRETER', tcg_arch == 'tci')
 endif
@@ -4959,7 +4961,7 @@ if host_arch == 'unknown'
   message('compile or work on this host CPU. You can help by volunteering')
   message('to maintain it and providing a build host for our continuous')
   message('integration setup.')
-  if get_option('tcg').allowed() and target_dirs.length() > 0
+  if have_tcg
     message()
     message('configure has succeeded and you can continue to build, but')
     message('QEMU will use a slow interpreter to emulate the target CPU.')
diff --git a/tcg/meson.build b/tcg/meson.build
index 7df378d773..bd2821e4b5 100644
--- a/tcg/meson.build
+++ b/tcg/meson.build
@@ -1,4 +1,4 @@
-if not get_option('tcg').allowed()
+if not have_tcg
    subdir_done()
 endif
 

From 911115838b29f222e47e5942b3182caf08ed08fd Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Thu, 8 May 2025 15:13:38 +0200
Subject: [PATCH 0814/2760] meson: remove unnecessary dependencies from
 specific_ss

All dependencies that are in common_ss (which includes system_ss) automatically
have their include path added when building the target-specific files.  So the
hack in ui/meson.build is not needed anymore since commit 727bb5b477e ("meson:
pick libfdt from common_ss when building target-specific files", 2024-05-10);
drop it.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 ui/meson.build | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/ui/meson.build b/ui/meson.build
index 35fb04cadf..6371422c46 100644
--- a/ui/meson.build
+++ b/ui/meson.build
@@ -1,7 +1,4 @@
 system_ss.add(pixman)
-specific_ss.add(when: ['CONFIG_SYSTEM_ONLY'], if_true: pixman)   # for the include path
-specific_ss.add(when: ['CONFIG_SYSTEM_ONLY'], if_true: opengl)   # for the include path
-
 system_ss.add(png)
 system_ss.add(files(
   'clipboard.c',

From 95d313127d5f4b4c3030222f4d45c49686b11f1d Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 24 May 2024 11:26:54 +0200
Subject: [PATCH 0815/2760] modinfo: lookup compile_commands.json by object
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since modinfo support was added, Meson fixed several issues with
extract_objects and compile_commands.json lookups can be simplified.
If the lookup uses the object file as key, there is no need to use the
command line to distinguish among all entries for a given source.

Ninja 1.9 is required in order to produce the 'output' key in
compile_commands.json; it is available in CentOS Stream 9, Debian 11, SLES
15.2, Ubuntu 20.04 and in all recent BSD distros.  Samurai also has it.

Cc: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 meson.build                | 14 ++++----------
 scripts/modinfo-collect.py | 23 +++++++++++------------
 2 files changed, 15 insertions(+), 22 deletions(-)

diff --git a/meson.build b/meson.build
index a2cebd4465..7f91500bb7 100644
--- a/meson.build
+++ b/meson.build
@@ -3903,16 +3903,11 @@ foreach d, list : modules
                     install: true,
                     install_dir: qemu_moddir)
       if module_ss.sources() != []
-        # FIXME: Should use sl.extract_all_objects(recursive: true) as
-        # input. Sources can be used multiple times but objects are
-        # unique when it comes to lookup in compile_commands.json.
-        # Depnds on a mesion version with
-        # https://github.com/mesonbuild/meson/pull/8900
         modinfo_files += custom_target(d + '-' + m + '.modinfo',
                                        output: d + '-' + m + '.modinfo',
-                                       input: module_ss.sources() + genh,
+                                       input: sl.extract_all_objects(recursive: true),
                                        capture: true,
-                                       command: [modinfo_collect, module_ss.sources()])
+                                       command: [modinfo_collect, '@INPUT@'])
       endif
     else
       if d == 'block'
@@ -3951,12 +3946,11 @@ foreach d, list : target_modules
                     dependencies: target_module_ss.dependencies(),
                     install: true,
                     install_dir: qemu_moddir)
-            # FIXME: Should use sl.extract_all_objects(recursive: true) too.
             modinfo_files += custom_target(module_name + '.modinfo',
                                            output: module_name + '.modinfo',
-                                           input: target_module_ss.sources() + genh,
+                                           input: sl.extract_all_objects(recursive: true),
                                            capture: true,
-                                           command: [modinfo_collect, '--target', target, target_module_ss.sources()])
+                                           command: [modinfo_collect, '--target', target, '@INPUT@'])
           endif
         endif
       endforeach
diff --git a/scripts/modinfo-collect.py b/scripts/modinfo-collect.py
index 4e7584df66..48bd92bd61 100644
--- a/scripts/modinfo-collect.py
+++ b/scripts/modinfo-collect.py
@@ -7,15 +7,6 @@ import json
 import shlex
 import subprocess
 
-def find_command(src, target, compile_commands):
-    for command in compile_commands:
-        if command['file'] != src:
-            continue
-        if target != '' and command['command'].find(target) == -1:
-            continue
-        return command['command']
-    return 'false'
-
 def process_command(src, command):
     skip = False
     out = []
@@ -43,14 +34,22 @@ def main(args):
         print("MODINFO_DEBUG target %s" % target)
         arch = target[:-8] # cut '-softmmu'
         print("MODINFO_START arch \"%s\" MODINFO_END" % arch)
+
     with open('compile_commands.json') as f:
-        compile_commands = json.load(f)
-    for src in args:
+        compile_commands_json = json.load(f)
+    compile_commands = { x['output']: x for x in compile_commands_json }
+
+    for obj in args:
+        entry = compile_commands.get(obj, None)
+        if not entry:
+            sys.stderr.print('modinfo: Could not find object file', obj)
+            sys.exit(1)
+        src = entry['file']
         if not src.endswith('.c'):
             print("MODINFO_DEBUG skip %s" % src)
             continue
+        command = entry['command']
         print("MODINFO_DEBUG src %s" % src)
-        command = find_command(src, target, compile_commands)
         cmdline = process_command(src, command)
         print("MODINFO_DEBUG cmd", cmdline)
         result = subprocess.run(cmdline, stdout = subprocess.PIPE,

From cc1f4b34d011e908dcaf24721f1d5808e02ab0bd Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Thu, 8 May 2025 10:29:42 +0200
Subject: [PATCH 0816/2760] rust: pl011: Rename RX FIFO methods
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In preparation of having a TX FIFO, rename the RX FIFO methods.
This is the Rust version of commit 40871ca758cf ("hw/char/pl011:
Rename RX FIFO methods").

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/hw/char/pl011/src/device.rs | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/rust/hw/char/pl011/src/device.rs b/rust/hw/char/pl011/src/device.rs
index 7c563ade9c..94b3165984 100644
--- a/rust/hw/char/pl011/src/device.rs
+++ b/rust/hw/char/pl011/src/device.rs
@@ -329,7 +329,7 @@ impl PL011Registers {
         // hardware flow-control is enabled.
         //
         // For simplicity, the above described is not emulated.
-        self.loopback_enabled() && self.put_fifo(value)
+        self.loopback_enabled() && self.fifo_rx_put(value)
     }
 
     #[must_use]
@@ -439,7 +439,7 @@ impl PL011Registers {
     }
 
     #[must_use]
-    pub fn put_fifo(&mut self, value: registers::Data) -> bool {
+    pub fn fifo_rx_put(&mut self, value: registers::Data) -> bool {
         let depth = self.fifo_depth();
         assert!(depth > 0);
         let slot = (self.read_pos + self.read_count) & (depth - 1);
@@ -589,7 +589,7 @@ impl PL011State {
         }
         let mut regs = self.regs.borrow_mut();
         let c: u32 = buf[0].into();
-        let update_irq = !regs.loopback_enabled() && regs.put_fifo(c.into());
+        let update_irq = !regs.loopback_enabled() && regs.fifo_rx_put(c.into());
         // Release the BqlRefCell before calling self.update()
         drop(regs);
 
@@ -602,7 +602,7 @@ impl PL011State {
         let mut update_irq = false;
         let mut regs = self.regs.borrow_mut();
         if event == Event::CHR_EVENT_BREAK && !regs.loopback_enabled() {
-            update_irq = regs.put_fifo(registers::Data::BREAK);
+            update_irq = regs.fifo_rx_put(registers::Data::BREAK);
         }
         // Release the BqlRefCell before calling self.update()
         drop(regs);

From 3d3911f16b6ceb9ed202aadf2cd75ded516a1a0b Mon Sep 17 00:00:00 2001
From: Raman Dzehtsiar <raman.dzehtsiar@gmail.com>
Date: Mon, 14 Apr 2025 11:00:25 +0200
Subject: [PATCH 0817/2760] blockdev-backup: Add error handling option for
 copy-before-write jobs

This patch extends the blockdev-backup QMP command to allow users to specify
how to behave when IO errors occur during copy-before-write operations.
Previously, the behavior was fixed and could not be controlled by the user.

The new 'on-cbw-error' option can be set to one of two values:
- 'break-guest-write': Forwards the IO error to the guest and triggers
  the on-source-error policy. This preserves snapshot integrity at the
  expense of guest IO operations.
- 'break-snapshot': Allows the guest OS to continue running normally,
  but invalidates the snapshot and aborts related jobs. This prioritizes
  guest operation over backup consistency.

This enhancement provides more flexibility for backup operations in different
environments where requirements for guest availability versus backup
consistency may vary.

The default behavior remains unchanged to maintain backward compatibility.

Signed-off-by: Raman Dzehtsiar <Raman.Dzehtsiar@gmail.com>
Message-ID: <20250414090025.828660-1-Raman.Dzehtsiar@gmail.com>
Acked-by: Markus Armbruster <armbru@redhat.com>
[vsementsov: fix long lines]
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Tested-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
---
 block/backup.c                                |  3 +-
 block/copy-before-write.c                     |  2 +
 block/copy-before-write.h                     |  1 +
 block/replication.c                           |  4 +-
 blockdev.c                                    |  6 ++
 include/block/block_int-global-state.h        |  2 +
 qapi/block-core.json                          |  4 +
 tests/qemu-iotests/tests/copy-before-write    | 95 +++++++++++++++++++
 .../qemu-iotests/tests/copy-before-write.out  |  4 +-
 9 files changed, 117 insertions(+), 4 deletions(-)

diff --git a/block/backup.c b/block/backup.c
index 79652bf57b..0151e84395 100644
--- a/block/backup.c
+++ b/block/backup.c
@@ -361,6 +361,7 @@ BlockJob *backup_job_create(const char *job_id, BlockDriverState *bs,
                   BackupPerf *perf,
                   BlockdevOnError on_source_error,
                   BlockdevOnError on_target_error,
+                  OnCbwError on_cbw_error,
                   int creation_flags,
                   BlockCompletionFunc *cb, void *opaque,
                   JobTxn *txn, Error **errp)
@@ -458,7 +459,7 @@ BlockJob *backup_job_create(const char *job_id, BlockDriverState *bs,
     }
 
     cbw = bdrv_cbw_append(bs, target, filter_node_name, discard_source,
-                          perf->min_cluster_size, &bcs, errp);
+                          perf->min_cluster_size, &bcs, on_cbw_error, errp);
     if (!cbw) {
         goto error;
     }
diff --git a/block/copy-before-write.c b/block/copy-before-write.c
index fd470f5f92..00af0b18ac 100644
--- a/block/copy-before-write.c
+++ b/block/copy-before-write.c
@@ -551,6 +551,7 @@ BlockDriverState *bdrv_cbw_append(BlockDriverState *source,
                                   bool discard_source,
                                   uint64_t min_cluster_size,
                                   BlockCopyState **bcs,
+                                  OnCbwError on_cbw_error,
                                   Error **errp)
 {
     BDRVCopyBeforeWriteState *state;
@@ -568,6 +569,7 @@ BlockDriverState *bdrv_cbw_append(BlockDriverState *source,
     }
     qdict_put_str(opts, "file", bdrv_get_node_name(source));
     qdict_put_str(opts, "target", bdrv_get_node_name(target));
+    qdict_put_str(opts, "on-cbw-error", OnCbwError_str(on_cbw_error));
 
     if (min_cluster_size > INT64_MAX) {
         error_setg(errp, "min-cluster-size too large: %" PRIu64 " > %" PRIi64,
diff --git a/block/copy-before-write.h b/block/copy-before-write.h
index 2a5d4ba693..eb93364e85 100644
--- a/block/copy-before-write.h
+++ b/block/copy-before-write.h
@@ -42,6 +42,7 @@ BlockDriverState *bdrv_cbw_append(BlockDriverState *source,
                                   bool discard_source,
                                   uint64_t min_cluster_size,
                                   BlockCopyState **bcs,
+                                  OnCbwError on_cbw_error,
                                   Error **errp);
 void bdrv_cbw_drop(BlockDriverState *bs);
 
diff --git a/block/replication.c b/block/replication.c
index d6625c51fe..07f274de9e 100644
--- a/block/replication.c
+++ b/block/replication.c
@@ -583,7 +583,9 @@ static void replication_start(ReplicationState *rs, ReplicationMode mode,
                                 0, MIRROR_SYNC_MODE_NONE, NULL, 0, false, false,
                                 NULL, &perf,
                                 BLOCKDEV_ON_ERROR_REPORT,
-                                BLOCKDEV_ON_ERROR_REPORT, JOB_INTERNAL,
+                                BLOCKDEV_ON_ERROR_REPORT,
+                                ON_CBW_ERROR_BREAK_GUEST_WRITE,
+                                JOB_INTERNAL,
                                 backup_job_completed, bs, NULL, &local_err);
         if (local_err) {
             error_propagate(errp, local_err);
diff --git a/blockdev.c b/blockdev.c
index 1d1f27cfff..818ec42511 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -2641,6 +2641,7 @@ static BlockJob *do_backup_common(BackupCommon *backup,
     BdrvDirtyBitmap *bmap = NULL;
     BackupPerf perf = { .max_workers = 64 };
     int job_flags = JOB_DEFAULT;
+    OnCbwError on_cbw_error = ON_CBW_ERROR_BREAK_GUEST_WRITE;
 
     if (!backup->has_speed) {
         backup->speed = 0;
@@ -2745,6 +2746,10 @@ static BlockJob *do_backup_common(BackupCommon *backup,
         job_flags |= JOB_MANUAL_DISMISS;
     }
 
+    if (backup->has_on_cbw_error) {
+        on_cbw_error = backup->on_cbw_error;
+    }
+
     job = backup_job_create(backup->job_id, bs, target_bs, backup->speed,
                             backup->sync, bmap, backup->bitmap_mode,
                             backup->compress, backup->discard_source,
@@ -2752,6 +2757,7 @@ static BlockJob *do_backup_common(BackupCommon *backup,
                             &perf,
                             backup->on_source_error,
                             backup->on_target_error,
+                            on_cbw_error,
                             job_flags, NULL, NULL, txn, errp);
     return job;
 }
diff --git a/include/block/block_int-global-state.h b/include/block/block_int-global-state.h
index eb2d92a226..0d93783763 100644
--- a/include/block/block_int-global-state.h
+++ b/include/block/block_int-global-state.h
@@ -179,6 +179,7 @@ void mirror_start(const char *job_id, BlockDriverState *bs,
  *        all ".has_*" fields are ignored.
  * @on_source_error: The action to take upon error reading from the source.
  * @on_target_error: The action to take upon error writing to the target.
+ * @on_cbw_error: The action to take upon error in copy-before-write operations.
  * @creation_flags: Flags that control the behavior of the Job lifetime.
  *                  See @BlockJobCreateFlags
  * @cb: Completion function for the job.
@@ -198,6 +199,7 @@ BlockJob *backup_job_create(const char *job_id, BlockDriverState *bs,
                             BackupPerf *perf,
                             BlockdevOnError on_source_error,
                             BlockdevOnError on_target_error,
+                            OnCbwError on_cbw_error,
                             int creation_flags,
                             BlockCompletionFunc *cb, void *opaque,
                             JobTxn *txn, Error **errp);
diff --git a/qapi/block-core.json b/qapi/block-core.json
index 22061227ca..91c70e24a7 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
@@ -1602,6 +1602,9 @@
 #     default 'report' (no limitations, since this applies to a
 #     different block device than @device).
 #
+# @on-cbw-error: policy defining behavior on I/O errors in
+#     copy-before-write jobs; defaults to break-guest-write.  (Since 10.1)
+#
 # @auto-finalize: When false, this job will wait in a PENDING state
 #     after it has finished its work, waiting for @block-job-finalize
 #     before making any block graph changes.  When true, this job will
@@ -1641,6 +1644,7 @@
             '*compress': 'bool',
             '*on-source-error': 'BlockdevOnError',
             '*on-target-error': 'BlockdevOnError',
+            '*on-cbw-error': 'OnCbwError',
             '*auto-finalize': 'bool', '*auto-dismiss': 'bool',
             '*filter-node-name': 'str',
             '*discard-source': 'bool',
diff --git a/tests/qemu-iotests/tests/copy-before-write b/tests/qemu-iotests/tests/copy-before-write
index 498c558008..236cb8ac37 100755
--- a/tests/qemu-iotests/tests/copy-before-write
+++ b/tests/qemu-iotests/tests/copy-before-write
@@ -99,6 +99,68 @@ class TestCbwError(iotests.QMPTestCase):
         log = iotests.filter_qemu_io(log)
         return log
 
+    def do_cbw_error_via_blockdev_backup(self, on_cbw_error=None):
+        self.vm.cmd('blockdev-add', {
+            'node-name': 'source',
+            'driver': iotests.imgfmt,
+            'file': {
+                'driver': 'file',
+                'filename': source_img
+            }
+        })
+
+        self.vm.cmd('blockdev-add', {
+            'node-name': 'target',
+            'driver': iotests.imgfmt,
+            'file': {
+                'driver': 'blkdebug',
+                'image': {
+                    'driver': 'file',
+                    'filename': temp_img
+                },
+                'inject-error': [
+                    {
+                        'event': 'write_aio',
+                        'errno': 5,
+                        'immediately': False,
+                        'once': True
+                    }
+                ]
+            }
+        })
+
+        blockdev_backup_options = {
+            'device': 'source',
+            'target': 'target',
+            'sync': 'none',
+            'job-id': 'job-id',
+            'filter-node-name': 'cbw'
+        }
+
+        if on_cbw_error:
+            blockdev_backup_options['on-cbw-error'] = on_cbw_error
+
+        self.vm.cmd('blockdev-backup', blockdev_backup_options)
+
+        self.vm.cmd('blockdev-add', {
+            'node-name': 'access',
+            'driver': 'snapshot-access',
+            'file': 'cbw'
+        })
+
+        result = self.vm.qmp('human-monitor-command',
+                             command_line='qemu-io cbw "write 0 1M"')
+        self.assert_qmp(result, 'return', '')
+
+        result = self.vm.qmp('human-monitor-command',
+                             command_line='qemu-io access "read 0 1M"')
+        self.assert_qmp(result, 'return', '')
+
+        self.vm.shutdown()
+        log = self.vm.get_log()
+        log = iotests.filter_qemu_io(log)
+        return log
+
     def test_break_snapshot_on_cbw_error(self):
         """break-snapshot behavior:
         Guest write succeed, but further snapshot-read fails, as snapshot is
@@ -123,6 +185,39 @@ read failed: Permission denied
 write failed: Input/output error
 read 1048576/1048576 bytes at offset 0
 1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+""")
+
+    def test_break_snapshot_policy_forwarding(self):
+        """Ensure CBW filter accepts break-snapshot policy
+        specified in blockdev-backup QMP command.
+        """
+        log = self.do_cbw_error_via_blockdev_backup('break-snapshot')
+        self.assertEqual(log, """\
+wrote 1048576/1048576 bytes at offset 0
+1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+read failed: Permission denied
+""")
+
+    def test_break_guest_write_policy_forwarding(self):
+        """Ensure CBW filter accepts break-guest-write policy
+        specified in blockdev-backup QMP command.
+        """
+        log = self.do_cbw_error_via_blockdev_backup('break-guest-write')
+        self.assertEqual(log, """\
+write failed: Input/output error
+read 1048576/1048576 bytes at offset 0
+1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+""")
+
+    def test_default_on_cbw_error_policy_forwarding(self):
+        """Ensure break-guest-write policy is used by default when
+        on-cbw-error is not explicitly specified.
+        """
+        log = self.do_cbw_error_via_blockdev_backup()
+        self.assertEqual(log, """\
+write failed: Input/output error
+read 1048576/1048576 bytes at offset 0
+1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 """)
 
     def do_cbw_timeout(self, on_cbw_error):
diff --git a/tests/qemu-iotests/tests/copy-before-write.out b/tests/qemu-iotests/tests/copy-before-write.out
index 89968f35d7..2f7d3902f2 100644
--- a/tests/qemu-iotests/tests/copy-before-write.out
+++ b/tests/qemu-iotests/tests/copy-before-write.out
@@ -1,5 +1,5 @@
-....
+.......
 ----------------------------------------------------------------------
-Ran 4 tests
+Ran 7 tests
 
 OK

From ac2c4d3aed5bf91eaed861d3b98f839ea4357643 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Thu, 8 May 2025 10:29:43 +0200
Subject: [PATCH 0818/2760] rust: pl011: Really use RX FIFO depth
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

While we model a 16-elements RX FIFO since the PL011 model was
introduced in commit cdbdb648b7c ("ARM Versatile Platform Baseboard
emulation"), we only read 1 char at a time!

Have can_receive() return how many elements are available, and use that
in receive().

This is the Rust version of commit 3e0f118f825 ("hw/char/pl011: Really
use RX FIFO depth"); but it also adds back a comment that is present
in commit f576e0733cc ("hw/char/pl011: Add support for loopback") and
absent in the Rust code.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 docs/devel/rust.rst              |  2 +-
 rust/hw/char/pl011/src/device.rs | 19 +++++++++++++------
 2 files changed, 14 insertions(+), 7 deletions(-)

diff --git a/docs/devel/rust.rst b/docs/devel/rust.rst
index 4de8637502..171d908e0b 100644
--- a/docs/devel/rust.rst
+++ b/docs/devel/rust.rst
@@ -119,7 +119,7 @@ QEMU includes four crates:
   for the ``hw/char/pl011.c`` and ``hw/timer/hpet.c`` files.
 
 .. [#issues] The ``pl011`` crate is synchronized with ``hw/char/pl011.c``
-   as of commit 02b1f7f61928.  The ``hpet`` crate is synchronized as of
+   as of commit 3e0f118f82.  The ``hpet`` crate is synchronized as of
    commit 1433e38cc8.  Both are lacking tracing functionality.
 
 This section explains how to work with them.
diff --git a/rust/hw/char/pl011/src/device.rs b/rust/hw/char/pl011/src/device.rs
index 94b3165984..bde3be65c5 100644
--- a/rust/hw/char/pl011/src/device.rs
+++ b/rust/hw/char/pl011/src/device.rs
@@ -580,19 +580,26 @@ impl PL011State {
     fn can_receive(&self) -> u32 {
         let regs = self.regs.borrow();
         // trace_pl011_can_receive(s->lcr, s->read_count, r);
-        u32::from(regs.read_count < regs.fifo_depth())
+        regs.fifo_depth() - regs.read_count
     }
 
     fn receive(&self, buf: &[u8]) {
-        if buf.is_empty() {
+        let mut regs = self.regs.borrow_mut();
+        if regs.loopback_enabled() {
+            // In loopback mode, the RX input signal is internally disconnected
+            // from the entire receiving logics; thus, all inputs are ignored,
+            // and BREAK detection on RX input signal is also not performed.
             return;
         }
-        let mut regs = self.regs.borrow_mut();
-        let c: u32 = buf[0].into();
-        let update_irq = !regs.loopback_enabled() && regs.fifo_rx_put(c.into());
+
+        let mut update_irq = false;
+        for &c in buf {
+            let c: u32 = c.into();
+            update_irq |= regs.fifo_rx_put(c.into());
+        }
+
         // Release the BqlRefCell before calling self.update()
         drop(regs);
-
         if update_irq {
             self.update();
         }

From 336dbe8e9993da447630f7edb59152dd7edcdcd1 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Wed, 10 Jul 2024 23:24:22 +0200
Subject: [PATCH 0819/2760] target/i386: ignore misplaced REX prefixes

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/tcg/decode-new.c.inc | 36 ++++++++++++++++++++++++--------
 1 file changed, 27 insertions(+), 9 deletions(-)

diff --git a/target/i386/tcg/decode-new.c.inc b/target/i386/tcg/decode-new.c.inc
index cda32ee678..55216e0d24 100644
--- a/target/i386/tcg/decode-new.c.inc
+++ b/target/i386/tcg/decode-new.c.inc
@@ -2542,7 +2542,13 @@ static void disas_insn(DisasContext *s, CPUState *cpu)
     s->has_modrm = false;
     s->prefix = 0;
 
- next_byte:
+ next_byte:;
+#ifdef TARGET_X86_64
+    /* clear any REX prefix followed by other prefixes.  */
+    int rex;
+    rex = -1;
+ next_byte_rex:
+#endif
     b = x86_ldub_code(env, s);
 
     /* Collect prefixes.  */
@@ -2585,13 +2591,12 @@ static void disas_insn(DisasContext *s, CPUState *cpu)
 #ifdef TARGET_X86_64
     case 0x40 ... 0x4f:
         if (CODE64(s)) {
-            /* REX prefix */
-            s->prefix |= PREFIX_REX;
-            s->vex_w = (b >> 3) & 1;
-            s->rex_r = (b & 0x4) << 1;
-            s->rex_x = (b & 0x2) << 2;
-            s->rex_b = (b & 0x1) << 3;
-            goto next_byte;
+            /*
+             * REX prefix; ignored unless it is the last prefix, so
+             * for now just stash it
+             */
+            rex = b;
+            goto next_byte_rex;
         }
         break;
 #endif
@@ -2618,10 +2623,13 @@ static void disas_insn(DisasContext *s, CPUState *cpu)
 
             /* 4.1.1-4.1.3: No preceding lock, 66, f2, f3, or rex prefixes. */
             if (s->prefix & (PREFIX_REPZ | PREFIX_REPNZ
-                             | PREFIX_LOCK | PREFIX_DATA | PREFIX_REX)) {
+                             | PREFIX_LOCK | PREFIX_DATA)) {
                 goto illegal_op;
             }
 #ifdef TARGET_X86_64
+            if (rex != -1) {
+                goto illegal_op;
+            }
             s->rex_r = (~vex2 >> 4) & 8;
 #endif
             if (b == 0xc5) {
@@ -2661,6 +2669,16 @@ static void disas_insn(DisasContext *s, CPUState *cpu)
 
     /* Post-process prefixes.  */
     if (CODE64(s)) {
+#ifdef TARGET_X86_64
+        if (rex != -1) {
+            s->prefix |= PREFIX_REX;
+            s->vex_w = (rex >> 3) & 1;
+            s->rex_r = (rex & 0x4) << 1;
+            s->rex_x = (rex & 0x2) << 2;
+            s->rex_b = (rex & 0x1) << 3;
+        }
+#endif
+
         /*
          * In 64-bit mode, the default data size is 32-bit.  Select 64-bit
          * data with rex_w, and 16-bit data with 0x66; rex_w takes precedence

From 0f1f06ca61d8f1290780829728603c570834b3c0 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Thu, 20 Jun 2024 19:53:59 +0200
Subject: [PATCH 0820/2760] target/i386: list TCG-supported features for
 CPUID[80000021h].EAX

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 1ca6307c72..1656de3dcc 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -922,6 +922,17 @@ void x86_cpu_vendor_words2str(char *dst, uint32_t vendor1,
 #define TCG_8000_0008_EBX  (CPUID_8000_0008_EBX_XSAVEERPTR | \
           CPUID_8000_0008_EBX_WBNOINVD | CPUID_8000_0008_EBX_KERNEL_FEATURES)
 
+#if defined CONFIG_USER_ONLY
+#define CPUID_8000_0021_EAX_KERNEL_FEATURES CPUID_8000_0021_EAX_AUTO_IBRS
+#else
+#define CPUID_8000_0021_EAX_KERNEL_FEATURES 0
+#endif
+
+#define TCG_8000_0021_EAX_FEATURES ( \
+            CPUID_8000_0021_EAX_NO_NESTED_DATA_BP | \
+            CPUID_8000_0021_EAX_NULL_SEL_CLR_BASE | \
+            CPUID_8000_0021_EAX_KERNEL_FEATURES)
+
 FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
     [FEAT_1_EDX] = {
         .type = CPUID_FEATURE_WORD,
@@ -1249,7 +1260,7 @@ FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
             "ibpb-brtype", "srso-no", "srso-user-kernel-no", NULL,
         },
         .cpuid = { .eax = 0x80000021, .reg = R_EAX, },
-        .tcg_features = 0,
+        .tcg_features = TCG_8000_0021_EAX_FEATURES,
         .unmigratable_flags = 0,
     },
     [FEAT_8000_0021_EBX] = {

From c7c332831fa79c6d58ac53dab1c195041a4ba687 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Wed, 10 Jul 2024 22:53:59 +0200
Subject: [PATCH 0821/2760] target/i386: move push of error code to
 switch_tss_ra

Move it there so that it can be done before the TSS trap bit is
processed.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/tcg/seg_helper.c | 72 ++++++++++++++++++++----------------
 1 file changed, 41 insertions(+), 31 deletions(-)

diff --git a/target/i386/tcg/seg_helper.c b/target/i386/tcg/seg_helper.c
index 0ca081b286..cb90ccd2ad 100644
--- a/target/i386/tcg/seg_helper.c
+++ b/target/i386/tcg/seg_helper.c
@@ -326,10 +326,10 @@ static void tss_set_busy(CPUX86State *env, int tss_selector, bool value,
 #define SWITCH_TSS_IRET 1
 #define SWITCH_TSS_CALL 2
 
-/* return 0 if switching to a 16-bit selector */
-static int switch_tss_ra(CPUX86State *env, int tss_selector,
-                         uint32_t e1, uint32_t e2, int source,
-                         uint32_t next_eip, uintptr_t retaddr)
+static void switch_tss_ra(CPUX86State *env, int tss_selector,
+                          uint32_t e1, uint32_t e2, int source,
+                          uint32_t next_eip, bool has_error_code,
+                          uint32_t error_code, uintptr_t retaddr)
 {
     int tss_limit, tss_limit_max, type, old_tss_limit_max, old_type, i;
     target_ulong tss_base;
@@ -599,14 +599,38 @@ static int switch_tss_ra(CPUX86State *env, int tss_selector,
         cpu_x86_update_dr7(env, env->dr[7] & ~DR7_LOCAL_BP_MASK);
     }
 #endif
-    return type >> 3;
+
+    if (has_error_code) {
+        int cpl = env->hflags & HF_CPL_MASK;
+        StackAccess sa;
+
+        /* push the error code */
+        sa.env = env;
+        sa.ra = retaddr;
+        sa.mmu_index = x86_mmu_index_pl(env, cpl);
+        sa.sp = env->regs[R_ESP];
+        if (env->segs[R_SS].flags & DESC_B_MASK) {
+            sa.sp_mask = 0xffffffff;
+        } else {
+            sa.sp_mask = 0xffff;
+        }
+        sa.ss_base = env->segs[R_SS].base;
+        if (type & 8) {
+            pushl(&sa, error_code);
+        } else {
+            pushw(&sa, error_code);
+        }
+        SET_ESP(sa.sp, sa.sp_mask);
+    }
 }
 
-static int switch_tss(CPUX86State *env, int tss_selector,
-                      uint32_t e1, uint32_t e2, int source,
-                      uint32_t next_eip)
+static void switch_tss(CPUX86State *env, int tss_selector,
+                       uint32_t e1, uint32_t e2, int source,
+                       uint32_t next_eip, bool has_error_code,
+                       int error_code)
 {
-    return switch_tss_ra(env, tss_selector, e1, e2, source, next_eip, 0);
+    switch_tss_ra(env, tss_selector, e1, e2, source, next_eip,
+                  has_error_code, error_code, 0);
 }
 
 static inline unsigned int get_sp_mask(unsigned int e2)
@@ -719,25 +743,8 @@ static void do_interrupt_protected(CPUX86State *env, int intno, int is_int,
         if (!(e2 & DESC_P_MASK)) {
             raise_exception_err(env, EXCP0B_NOSEG, intno * 8 + 2);
         }
-        shift = switch_tss(env, intno * 8, e1, e2, SWITCH_TSS_CALL, old_eip);
-        if (has_error_code) {
-            /* push the error code on the destination stack */
-            cpl = env->hflags & HF_CPL_MASK;
-            sa.mmu_index = x86_mmu_index_pl(env, cpl);
-            if (env->segs[R_SS].flags & DESC_B_MASK) {
-                sa.sp_mask = 0xffffffff;
-            } else {
-                sa.sp_mask = 0xffff;
-            }
-            sa.sp = env->regs[R_ESP];
-            sa.ss_base = env->segs[R_SS].base;
-            if (shift) {
-                pushl(&sa, error_code);
-            } else {
-                pushw(&sa, error_code);
-            }
-            SET_ESP(sa.sp, sa.sp_mask);
-        }
+        switch_tss(env, intno * 8, e1, e2, SWITCH_TSS_CALL, old_eip,
+                   has_error_code, error_code);
         return;
     }
 
@@ -1533,7 +1540,8 @@ void helper_ljmp_protected(CPUX86State *env, int new_cs, target_ulong new_eip,
             if (dpl < cpl || dpl < rpl) {
                 raise_exception_err_ra(env, EXCP0D_GPF, new_cs & 0xfffc, GETPC());
             }
-            switch_tss_ra(env, new_cs, e1, e2, SWITCH_TSS_JMP, next_eip, GETPC());
+            switch_tss_ra(env, new_cs, e1, e2, SWITCH_TSS_JMP, next_eip,
+                          false, 0, GETPC());
             break;
         case 4: /* 286 call gate */
         case 12: /* 386 call gate */
@@ -1745,7 +1753,8 @@ void helper_lcall_protected(CPUX86State *env, int new_cs, target_ulong new_eip,
             if (dpl < cpl || dpl < rpl) {
                 raise_exception_err_ra(env, EXCP0D_GPF, new_cs & 0xfffc, GETPC());
             }
-            switch_tss_ra(env, new_cs, e1, e2, SWITCH_TSS_CALL, next_eip, GETPC());
+            switch_tss_ra(env, new_cs, e1, e2, SWITCH_TSS_CALL, next_eip,
+                          false, 0, GETPC());
             return;
         case 4: /* 286 call gate */
         case 12: /* 386 call gate */
@@ -2256,7 +2265,8 @@ void helper_iret_protected(CPUX86State *env, int shift, int next_eip)
         if (type != 3) {
             raise_exception_err_ra(env, EXCP0A_TSS, tss_selector & 0xfffc, GETPC());
         }
-        switch_tss_ra(env, tss_selector, e1, e2, SWITCH_TSS_IRET, next_eip, GETPC());
+        switch_tss_ra(env, tss_selector, e1, e2, SWITCH_TSS_IRET, next_eip,
+                      false, 0, GETPC());
     } else {
         helper_ret_protected(env, shift, 1, 0, GETPC());
     }

From ad441b8b7913a26b18edbc076c74ca0cdbfa4ee5 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Wed, 14 Aug 2024 12:33:02 +0200
Subject: [PATCH 0822/2760] target/i386: implement TSS trap bit

Now that we can do so after the error code has been pushed, raising
the #DB exception for task-switch traps is trivial.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/tcg/seg_helper.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/target/i386/tcg/seg_helper.c b/target/i386/tcg/seg_helper.c
index cb90ccd2ad..071f3fbd83 100644
--- a/target/i386/tcg/seg_helper.c
+++ b/target/i386/tcg/seg_helper.c
@@ -473,10 +473,6 @@ static void switch_tss_ra(CPUX86State *env, int tss_selector,
         new_segs[R_GS] = 0;
         new_trap = 0;
     }
-    /* XXX: avoid a compiler warning, see
-     http://support.amd.com/us/Processor_TechDocs/24593.pdf
-     chapters 12.2.5 and 13.2.4 on how to implement TSS Trap bit */
-    (void)new_trap;
 
     /* clear busy bit (it is restartable) */
     if (source == SWITCH_TSS_JMP || source == SWITCH_TSS_IRET) {
@@ -622,6 +618,11 @@ static void switch_tss_ra(CPUX86State *env, int tss_selector,
         }
         SET_ESP(sa.sp, sa.sp_mask);
     }
+
+    if (new_trap) {
+        env->dr[6] |= DR6_BT;
+        raise_exception_ra(env, EXCP01_DB, retaddr);
+    }
 }
 
 static void switch_tss(CPUX86State *env, int tss_selector,

From 77a2dba45cc9a1be7fec6ab88f43d2fa18af52a3 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 2 May 2025 22:21:42 +0200
Subject: [PATCH 0823/2760] target/i386/emulate: stop overloading
 decode->op[N].ptr

decode->op[N].ptr can contain either a host pointer (!) in CPUState
or a guest virtual address.  Pass the whole struct to read_val_ext
and write_val_ext, so that it can decide the contents based on the
operand type.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/emulate/x86_decode.c |  74 +++++++++----------
 target/i386/emulate/x86_decode.h |   9 ++-
 target/i386/emulate/x86_emu.c    | 119 ++++++++++++++++---------------
 target/i386/emulate/x86_emu.h    |   8 +--
 4 files changed, 109 insertions(+), 101 deletions(-)

diff --git a/target/i386/emulate/x86_decode.c b/target/i386/emulate/x86_decode.c
index 88be9479a8..2eca39802e 100644
--- a/target/i386/emulate/x86_decode.c
+++ b/target/i386/emulate/x86_decode.c
@@ -109,8 +109,8 @@ static void decode_modrm_reg(CPUX86State *env, struct x86_decode *decode,
 {
     op->type = X86_VAR_REG;
     op->reg = decode->modrm.reg;
-    op->ptr = get_reg_ref(env, op->reg, decode->rex.rex, decode->rex.r,
-                          decode->operand_size);
+    op->regptr = get_reg_ref(env, op->reg, decode->rex.rex, decode->rex.r,
+                             decode->operand_size);
 }
 
 static void decode_rax(CPUX86State *env, struct x86_decode *decode,
@@ -119,8 +119,8 @@ static void decode_rax(CPUX86State *env, struct x86_decode *decode,
     op->type = X86_VAR_REG;
     op->reg = R_EAX;
     /* Since reg is always AX, REX prefix has no impact. */
-    op->ptr = get_reg_ref(env, op->reg, false, 0,
-                          decode->operand_size);
+    op->regptr = get_reg_ref(env, op->reg, false, 0,
+                             decode->operand_size);
 }
 
 static inline void decode_immediate(CPUX86State *env, struct x86_decode *decode,
@@ -262,16 +262,16 @@ static void decode_incgroup(CPUX86State *env, struct x86_decode *decode)
 {
     decode->op[0].type = X86_VAR_REG;
     decode->op[0].reg = decode->opcode[0] - 0x40;
-    decode->op[0].ptr = get_reg_ref(env, decode->op[0].reg, decode->rex.rex,
-                                    decode->rex.b, decode->operand_size);
+    decode->op[0].regptr = get_reg_ref(env, decode->op[0].reg, decode->rex.rex,
+                                       decode->rex.b, decode->operand_size);
 }
 
 static void decode_decgroup(CPUX86State *env, struct x86_decode *decode)
 {
     decode->op[0].type = X86_VAR_REG;
     decode->op[0].reg = decode->opcode[0] - 0x48;
-    decode->op[0].ptr = get_reg_ref(env, decode->op[0].reg, decode->rex.rex,
-                                    decode->rex.b, decode->operand_size);
+    decode->op[0].regptr = get_reg_ref(env, decode->op[0].reg, decode->rex.rex,
+                                       decode->rex.b, decode->operand_size);
 }
 
 static void decode_incgroup2(CPUX86State *env, struct x86_decode *decode)
@@ -287,16 +287,16 @@ static void decode_pushgroup(CPUX86State *env, struct x86_decode *decode)
 {
     decode->op[0].type = X86_VAR_REG;
     decode->op[0].reg = decode->opcode[0] - 0x50;
-    decode->op[0].ptr = get_reg_ref(env, decode->op[0].reg, decode->rex.rex,
-                                    decode->rex.b, decode->operand_size);
+    decode->op[0].regptr = get_reg_ref(env, decode->op[0].reg, decode->rex.rex,
+                                       decode->rex.b, decode->operand_size);
 }
 
 static void decode_popgroup(CPUX86State *env, struct x86_decode *decode)
 {
     decode->op[0].type = X86_VAR_REG;
     decode->op[0].reg = decode->opcode[0] - 0x58;
-    decode->op[0].ptr = get_reg_ref(env, decode->op[0].reg, decode->rex.rex,
-                                    decode->rex.b, decode->operand_size);
+    decode->op[0].regptr = get_reg_ref(env, decode->op[0].reg, decode->rex.rex,
+                                       decode->rex.b, decode->operand_size);
 }
 
 static void decode_jxx(CPUX86State *env, struct x86_decode *decode)
@@ -377,16 +377,16 @@ static void decode_xchgroup(CPUX86State *env, struct x86_decode *decode)
 {
     decode->op[0].type = X86_VAR_REG;
     decode->op[0].reg = decode->opcode[0] - 0x90;
-    decode->op[0].ptr = get_reg_ref(env, decode->op[0].reg, decode->rex.rex,
-                                    decode->rex.b, decode->operand_size);
+    decode->op[0].regptr = get_reg_ref(env, decode->op[0].reg, decode->rex.rex,
+                                       decode->rex.b, decode->operand_size);
 }
 
 static void decode_movgroup(CPUX86State *env, struct x86_decode *decode)
 {
     decode->op[0].type = X86_VAR_REG;
     decode->op[0].reg = decode->opcode[0] - 0xb8;
-    decode->op[0].ptr = get_reg_ref(env, decode->op[0].reg, decode->rex.rex,
-                                    decode->rex.b, decode->operand_size);
+    decode->op[0].regptr = get_reg_ref(env, decode->op[0].reg, decode->rex.rex,
+                                       decode->rex.b, decode->operand_size);
     decode_immediate(env, decode, &decode->op[1], decode->operand_size);
 }
 
@@ -394,15 +394,15 @@ static void fetch_moffs(CPUX86State *env, struct x86_decode *decode,
                         struct x86_decode_op *op)
 {
     op->type = X86_VAR_OFFSET;
-    op->ptr = decode_bytes(env, decode, decode->addressing_size);
+    op->addr = decode_bytes(env, decode, decode->addressing_size);
 }
 
 static void decode_movgroup8(CPUX86State *env, struct x86_decode *decode)
 {
     decode->op[0].type = X86_VAR_REG;
     decode->op[0].reg = decode->opcode[0] - 0xb0;
-    decode->op[0].ptr = get_reg_ref(env, decode->op[0].reg, decode->rex.rex,
-                                    decode->rex.b, decode->operand_size);
+    decode->op[0].regptr = get_reg_ref(env, decode->op[0].reg, decode->rex.rex,
+                                       decode->rex.b, decode->operand_size);
     decode_immediate(env, decode, &decode->op[1], decode->operand_size);
 }
 
@@ -411,8 +411,8 @@ static void decode_rcx(CPUX86State *env, struct x86_decode *decode,
 {
     op->type = X86_VAR_REG;
     op->reg = R_ECX;
-    op->ptr = get_reg_ref(env, op->reg, decode->rex.rex, decode->rex.b,
-                          decode->operand_size);
+    op->regptr = get_reg_ref(env, op->reg, decode->rex.rex, decode->rex.b,
+                             decode->operand_size);
 }
 
 struct decode_tbl {
@@ -631,8 +631,8 @@ static void decode_bswap(CPUX86State *env, struct x86_decode *decode)
 {
     decode->op[0].type = X86_VAR_REG;
     decode->op[0].reg = decode->opcode[1] - 0xc8;
-    decode->op[0].ptr = get_reg_ref(env, decode->op[0].reg, decode->rex.rex,
-                                    decode->rex.b, decode->operand_size);
+    decode->op[0].regptr = get_reg_ref(env, decode->op[0].reg, decode->rex.rex,
+                                       decode->rex.b, decode->operand_size);
 }
 
 static void decode_d9_4(CPUX86State *env, struct x86_decode *decode)
@@ -1656,16 +1656,16 @@ void calc_modrm_operand16(CPUX86State *env, struct x86_decode *decode,
     }
 calc_addr:
     if (X86_DECODE_CMD_LEA == decode->cmd) {
-        op->ptr = (uint16_t)ptr;
+        op->addr = (uint16_t)ptr;
     } else {
-        op->ptr = decode_linear_addr(env, decode, (uint16_t)ptr, seg);
+        op->addr = decode_linear_addr(env, decode, (uint16_t)ptr, seg);
     }
 }
 
-target_ulong get_reg_ref(CPUX86State *env, int reg, int rex_present,
+void *get_reg_ref(CPUX86State *env, int reg, int rex_present,
                          int is_extended, int size)
 {
-    target_ulong ptr = 0;
+    void *ptr = NULL;
 
     if (is_extended) {
         reg |= R_R8;
@@ -1674,13 +1674,13 @@ target_ulong get_reg_ref(CPUX86State *env, int reg, int rex_present,
     switch (size) {
     case 1:
         if (is_extended || reg < 4 || rex_present) {
-            ptr = (target_ulong)&RL(env, reg);
+            ptr = &RL(env, reg);
         } else {
-            ptr = (target_ulong)&RH(env, reg - 4);
+            ptr = &RH(env, reg - 4);
         }
         break;
     default:
-        ptr = (target_ulong)&RRX(env, reg);
+        ptr = &RRX(env, reg);
         break;
     }
     return ptr;
@@ -1691,7 +1691,7 @@ target_ulong get_reg_val(CPUX86State *env, int reg, int rex_present,
 {
     target_ulong val = 0;
     memcpy(&val,
-           (void *)get_reg_ref(env, reg, rex_present, is_extended, size),
+           get_reg_ref(env, reg, rex_present, is_extended, size),
            size);
     return val;
 }
@@ -1758,9 +1758,9 @@ void calc_modrm_operand32(CPUX86State *env, struct x86_decode *decode,
     }
 
     if (X86_DECODE_CMD_LEA == decode->cmd) {
-        op->ptr = (uint32_t)ptr;
+        op->addr = (uint32_t)ptr;
     } else {
-        op->ptr = decode_linear_addr(env, decode, (uint32_t)ptr, seg);
+        op->addr = decode_linear_addr(env, decode, (uint32_t)ptr, seg);
     }
 }
 
@@ -1788,9 +1788,9 @@ void calc_modrm_operand64(CPUX86State *env, struct x86_decode *decode,
     }
 
     if (X86_DECODE_CMD_LEA == decode->cmd) {
-        op->ptr = ptr;
+        op->addr = ptr;
     } else {
-        op->ptr = decode_linear_addr(env, decode, ptr, seg);
+        op->addr = decode_linear_addr(env, decode, ptr, seg);
     }
 }
 
@@ -1801,8 +1801,8 @@ void calc_modrm_operand(CPUX86State *env, struct x86_decode *decode,
     if (3 == decode->modrm.mod) {
         op->reg = decode->modrm.reg;
         op->type = X86_VAR_REG;
-        op->ptr = get_reg_ref(env, decode->modrm.rm, decode->rex.rex,
-                              decode->rex.b, decode->operand_size);
+        op->regptr = get_reg_ref(env, decode->modrm.rm, decode->rex.rex,
+                                 decode->rex.b, decode->operand_size);
         return;
     }
 
diff --git a/target/i386/emulate/x86_decode.h b/target/i386/emulate/x86_decode.h
index 87cc728598..927645af1a 100644
--- a/target/i386/emulate/x86_decode.h
+++ b/target/i386/emulate/x86_decode.h
@@ -266,7 +266,10 @@ typedef struct x86_decode_op {
     int reg;
     target_ulong val;
 
-    target_ulong ptr;
+    union {
+        target_ulong addr;
+        void *regptr;
+    };
 } x86_decode_op;
 
 typedef struct x86_decode {
@@ -301,8 +304,8 @@ uint64_t sign(uint64_t val, int size);
 
 uint32_t decode_instruction(CPUX86State *env, struct x86_decode *decode);
 
-target_ulong get_reg_ref(CPUX86State *env, int reg, int rex_present,
-                         int is_extended, int size);
+void *get_reg_ref(CPUX86State *env, int reg, int rex_present,
+                  int is_extended, int size);
 target_ulong get_reg_val(CPUX86State *env, int reg, int rex_present,
                          int is_extended, int size);
 void calc_modrm_operand(CPUX86State *env, struct x86_decode *decode,
diff --git a/target/i386/emulate/x86_emu.c b/target/i386/emulate/x86_emu.c
index 7773b51b95..4c07f08942 100644
--- a/target/i386/emulate/x86_emu.c
+++ b/target/i386/emulate/x86_emu.c
@@ -52,7 +52,7 @@
         uint8_t v2 = (uint8_t)decode->op[1].val;    \
         uint8_t diff = v1 cmd v2;                   \
         if (save_res) {                              \
-            write_val_ext(env, decode->op[0].ptr, diff, 1);  \
+            write_val_ext(env, &decode->op[0], diff, 1);  \
         } \
         FLAGS_FUNC##8(env, v1, v2, diff);           \
         break;                                      \
@@ -63,7 +63,7 @@
         uint16_t v2 = (uint16_t)decode->op[1].val;  \
         uint16_t diff = v1 cmd v2;                  \
         if (save_res) {                              \
-            write_val_ext(env, decode->op[0].ptr, diff, 2); \
+            write_val_ext(env, &decode->op[0], diff, 2); \
         } \
         FLAGS_FUNC##16(env, v1, v2, diff);          \
         break;                                      \
@@ -74,7 +74,7 @@
         uint32_t v2 = (uint32_t)decode->op[1].val;  \
         uint32_t diff = v1 cmd v2;                  \
         if (save_res) {                              \
-            write_val_ext(env, decode->op[0].ptr, diff, 4); \
+            write_val_ext(env, &decode->op[0], diff, 4); \
         } \
         FLAGS_FUNC##32(env, v1, v2, diff);          \
         break;                                      \
@@ -121,7 +121,7 @@ void write_reg(CPUX86State *env, int reg, target_ulong val, int size)
     }
 }
 
-target_ulong read_val_from_reg(target_ulong reg_ptr, int size)
+target_ulong read_val_from_reg(void *reg_ptr, int size)
 {
     target_ulong val;
     
@@ -144,7 +144,7 @@ target_ulong read_val_from_reg(target_ulong reg_ptr, int size)
     return val;
 }
 
-void write_val_to_reg(target_ulong reg_ptr, target_ulong val, int size)
+void write_val_to_reg(void *reg_ptr, target_ulong val, int size)
 {
     switch (size) {
     case 1:
@@ -164,18 +164,18 @@ void write_val_to_reg(target_ulong reg_ptr, target_ulong val, int size)
     }
 }
 
-static bool is_host_reg(CPUX86State *env, target_ulong ptr)
+static void write_val_to_mem(CPUX86State *env, target_ulong ptr, target_ulong val, int size)
 {
-    return (ptr - (target_ulong)&env->regs[0]) < sizeof(env->regs);
+    emul_ops->write_mem(env_cpu(env), &val, ptr, size);
 }
 
-void write_val_ext(CPUX86State *env, target_ulong ptr, target_ulong val, int size)
+void write_val_ext(CPUX86State *env, struct x86_decode_op *decode, target_ulong val, int size)
 {
-    if (is_host_reg(env, ptr)) {
-        write_val_to_reg(ptr, val, size);
-        return;
+    if (decode->type == X86_VAR_REG) {
+        write_val_to_reg(decode->regptr, val, size);
+    } else {
+        write_val_to_mem(env, decode->addr, val, size);
     }
-    emul_ops->write_mem(env_cpu(env), &val, ptr, size);
 }
 
 uint8_t *read_mmio(CPUX86State *env, target_ulong ptr, int bytes)
@@ -185,15 +185,11 @@ uint8_t *read_mmio(CPUX86State *env, target_ulong ptr, int bytes)
 }
 
 
-target_ulong read_val_ext(CPUX86State *env, target_ulong ptr, int size)
+static target_ulong read_val_from_mem(CPUX86State *env, target_long ptr, int size)
 {
     target_ulong val;
     uint8_t *mmio_ptr;
 
-    if (is_host_reg(env, ptr)) {
-        return read_val_from_reg(ptr, size);
-    }
-
     mmio_ptr = read_mmio(env, ptr, size);
     switch (size) {
     case 1:
@@ -215,6 +211,15 @@ target_ulong read_val_ext(CPUX86State *env, target_ulong ptr, int size)
     return val;
 }
 
+target_ulong read_val_ext(CPUX86State *env, struct x86_decode_op *decode, int size)
+{
+    if (decode->type == X86_VAR_REG) {
+        return read_val_from_reg(decode->regptr, size);
+    } else {
+        return read_val_from_mem(env, decode->addr, size);
+    }
+}
+
 static void fetch_operands(CPUX86State *env, struct x86_decode *decode,
                            int n, bool val_op0, bool val_op1, bool val_op2)
 {
@@ -226,25 +231,25 @@ static void fetch_operands(CPUX86State *env, struct x86_decode *decode,
         case X86_VAR_IMMEDIATE:
             break;
         case X86_VAR_REG:
-            VM_PANIC_ON(!decode->op[i].ptr);
+            VM_PANIC_ON(!decode->op[i].regptr);
             if (calc_val[i]) {
-                decode->op[i].val = read_val_from_reg(decode->op[i].ptr,
+                decode->op[i].val = read_val_from_reg(decode->op[i].regptr,
                                                       decode->operand_size);
             }
             break;
         case X86_VAR_RM:
             calc_modrm_operand(env, decode, &decode->op[i]);
             if (calc_val[i]) {
-                decode->op[i].val = read_val_ext(env, decode->op[i].ptr,
+                decode->op[i].val = read_val_ext(env, &decode->op[i],
                                                  decode->operand_size);
             }
             break;
         case X86_VAR_OFFSET:
-            decode->op[i].ptr = decode_linear_addr(env, decode,
-                                                   decode->op[i].ptr,
-                                                   R_DS);
+            decode->op[i].addr = decode_linear_addr(env, decode,
+                                                    decode->op[i].addr,
+                                                    R_DS);
             if (calc_val[i]) {
-                decode->op[i].val = read_val_ext(env, decode->op[i].ptr,
+                decode->op[i].val = read_val_ext(env, &decode->op[i],
                                                  decode->operand_size);
             }
             break;
@@ -257,7 +262,7 @@ static void fetch_operands(CPUX86State *env, struct x86_decode *decode,
 static void exec_mov(CPUX86State *env, struct x86_decode *decode)
 {
     fetch_operands(env, decode, 2, false, true, false);
-    write_val_ext(env, decode->op[0].ptr, decode->op[1].val,
+    write_val_ext(env, &decode->op[0], decode->op[1].val,
                   decode->operand_size);
 
     env->eip += decode->len;
@@ -312,7 +317,7 @@ static void exec_neg(CPUX86State *env, struct x86_decode *decode)
     fetch_operands(env, decode, 2, true, true, false);
 
     val = 0 - sign(decode->op[1].val, decode->operand_size);
-    write_val_ext(env, decode->op[1].ptr, val, decode->operand_size);
+    write_val_ext(env, &decode->op[1], val, decode->operand_size);
 
     if (4 == decode->operand_size) {
         SET_FLAGS_OSZAPC_SUB32(env, 0, 0 - val, val);
@@ -363,7 +368,7 @@ static void exec_not(CPUX86State *env, struct x86_decode *decode)
 {
     fetch_operands(env, decode, 1, true, false, false);
 
-    write_val_ext(env, decode->op[0].ptr, ~decode->op[0].val,
+    write_val_ext(env, &decode->op[0], ~decode->op[0].val,
                   decode->operand_size);
     env->eip += decode->len;
 }
@@ -382,8 +387,8 @@ void exec_movzx(CPUX86State *env, struct x86_decode *decode)
     }
     decode->operand_size = src_op_size;
     calc_modrm_operand(env, decode, &decode->op[1]);
-    decode->op[1].val = read_val_ext(env, decode->op[1].ptr, src_op_size);
-    write_val_ext(env, decode->op[0].ptr, decode->op[1].val, op_size);
+    decode->op[1].val = read_val_ext(env, &decode->op[1], src_op_size);
+    write_val_ext(env, &decode->op[0], decode->op[1].val, op_size);
 
     env->eip += decode->len;
 }
@@ -535,8 +540,8 @@ static void exec_movs_single(CPUX86State *env, struct x86_decode *decode)
     dst_addr = linear_addr_size(env_cpu(env), RDI(env),
                                 decode->addressing_size, R_ES);
 
-    val = read_val_ext(env, src_addr, decode->operand_size);
-    write_val_ext(env, dst_addr, val, decode->operand_size);
+    val = read_val_from_mem(env, src_addr, decode->operand_size);
+    write_val_to_mem(env, dst_addr, val, decode->operand_size);
 
     string_increment_reg(env, R_ESI, decode);
     string_increment_reg(env, R_EDI, decode);
@@ -563,9 +568,9 @@ static void exec_cmps_single(CPUX86State *env, struct x86_decode *decode)
                                 decode->addressing_size, R_ES);
 
     decode->op[0].type = X86_VAR_IMMEDIATE;
-    decode->op[0].val = read_val_ext(env, src_addr, decode->operand_size);
+    decode->op[0].val = read_val_from_mem(env, src_addr, decode->operand_size);
     decode->op[1].type = X86_VAR_IMMEDIATE;
-    decode->op[1].val = read_val_ext(env, dst_addr, decode->operand_size);
+    decode->op[1].val = read_val_from_mem(env, dst_addr, decode->operand_size);
 
     EXEC_2OP_FLAGS_CMD(env, decode, -, SET_FLAGS_OSZAPC_SUB, false);
 
@@ -697,15 +702,15 @@ static void do_bt(CPUX86State *env, struct x86_decode *decode, int flag)
     if (decode->op[0].type != X86_VAR_REG) {
         if (4 == decode->operand_size) {
             displacement = ((int32_t) (decode->op[1].val & 0xffffffe0)) / 32;
-            decode->op[0].ptr += 4 * displacement;
+            decode->op[0].addr += 4 * displacement;
         } else if (2 == decode->operand_size) {
             displacement = ((int16_t) (decode->op[1].val & 0xfff0)) / 16;
-            decode->op[0].ptr += 2 * displacement;
+            decode->op[0].addr += 2 * displacement;
         } else {
             VM_PANIC("bt 64bit\n");
         }
     }
-    decode->op[0].val = read_val_ext(env, decode->op[0].ptr,
+    decode->op[0].val = read_val_ext(env, &decode->op[0],
                                      decode->operand_size);
     cf = (decode->op[0].val >> index) & 0x01;
 
@@ -723,7 +728,7 @@ static void do_bt(CPUX86State *env, struct x86_decode *decode, int flag)
         decode->op[0].val &= ~(1u << index);
         break;
     }
-    write_val_ext(env, decode->op[0].ptr, decode->op[0].val,
+    write_val_ext(env, &decode->op[0], decode->op[0].val,
                   decode->operand_size);
     set_CF(env, cf);
 }
@@ -775,7 +780,7 @@ void exec_shl(CPUX86State *env, struct x86_decode *decode)
             of = cf ^ (res >> 7);
         }
 
-        write_val_ext(env, decode->op[0].ptr, res, 1);
+        write_val_ext(env, &decode->op[0], res, 1);
         SET_FLAGS_OSZAPC_LOGIC8(env, 0, 0, res);
         SET_FLAGS_OxxxxC(env, of, cf);
         break;
@@ -791,7 +796,7 @@ void exec_shl(CPUX86State *env, struct x86_decode *decode)
             of = cf ^ (res >> 15); /* of = cf ^ result15 */
         }
 
-        write_val_ext(env, decode->op[0].ptr, res, 2);
+        write_val_ext(env, &decode->op[0], res, 2);
         SET_FLAGS_OSZAPC_LOGIC16(env, 0, 0, res);
         SET_FLAGS_OxxxxC(env, of, cf);
         break;
@@ -800,7 +805,7 @@ void exec_shl(CPUX86State *env, struct x86_decode *decode)
     {
         uint32_t res = decode->op[0].val << count;
 
-        write_val_ext(env, decode->op[0].ptr, res, 4);
+        write_val_ext(env, &decode->op[0], res, 4);
         SET_FLAGS_OSZAPC_LOGIC32(env, 0, 0, res);
         cf = (decode->op[0].val >> (32 - count)) & 0x1;
         of = cf ^ (res >> 31); /* of = cf ^ result31 */
@@ -831,10 +836,10 @@ void exec_movsx(CPUX86State *env, struct x86_decode *decode)
 
     decode->operand_size = src_op_size;
     calc_modrm_operand(env, decode, &decode->op[1]);
-    decode->op[1].val = sign(read_val_ext(env, decode->op[1].ptr, src_op_size),
+    decode->op[1].val = sign(read_val_ext(env, &decode->op[1], src_op_size),
                              src_op_size);
 
-    write_val_ext(env, decode->op[0].ptr, decode->op[1].val, op_size);
+    write_val_ext(env, &decode->op[0], decode->op[1].val, op_size);
 
     env->eip += decode->len;
 }
@@ -862,7 +867,7 @@ void exec_ror(CPUX86State *env, struct x86_decode *decode)
             count &= 0x7; /* use only bottom 3 bits */
             res = ((uint8_t)decode->op[0].val >> count) |
                    ((uint8_t)decode->op[0].val << (8 - count));
-            write_val_ext(env, decode->op[0].ptr, res, 1);
+            write_val_ext(env, &decode->op[0], res, 1);
             bit6 = (res >> 6) & 1;
             bit7 = (res >> 7) & 1;
             /* set eflags: ROR count affects the following flags: C, O */
@@ -886,7 +891,7 @@ void exec_ror(CPUX86State *env, struct x86_decode *decode)
             count &= 0x0f;  /* use only 4 LSB's */
             res = ((uint16_t)decode->op[0].val >> count) |
                    ((uint16_t)decode->op[0].val << (16 - count));
-            write_val_ext(env, decode->op[0].ptr, res, 2);
+            write_val_ext(env, &decode->op[0], res, 2);
 
             bit14 = (res >> 14) & 1;
             bit15 = (res >> 15) & 1;
@@ -904,7 +909,7 @@ void exec_ror(CPUX86State *env, struct x86_decode *decode)
         if (count) {
             res = ((uint32_t)decode->op[0].val >> count) |
                    ((uint32_t)decode->op[0].val << (32 - count));
-            write_val_ext(env, decode->op[0].ptr, res, 4);
+            write_val_ext(env, &decode->op[0], res, 4);
 
             bit31 = (res >> 31) & 1;
             bit30 = (res >> 30) & 1;
@@ -941,7 +946,7 @@ void exec_rol(CPUX86State *env, struct x86_decode *decode)
             res = ((uint8_t)decode->op[0].val << count) |
                    ((uint8_t)decode->op[0].val >> (8 - count));
 
-            write_val_ext(env, decode->op[0].ptr, res, 1);
+            write_val_ext(env, &decode->op[0], res, 1);
             /* set eflags:
              * ROL count affects the following flags: C, O
              */
@@ -968,7 +973,7 @@ void exec_rol(CPUX86State *env, struct x86_decode *decode)
             res = ((uint16_t)decode->op[0].val << count) |
                    ((uint16_t)decode->op[0].val >> (16 - count));
 
-            write_val_ext(env, decode->op[0].ptr, res, 2);
+            write_val_ext(env, &decode->op[0], res, 2);
             bit0  = (res & 0x1);
             bit15 = (res >> 15);
             /* of = cf ^ result15 */
@@ -986,7 +991,7 @@ void exec_rol(CPUX86State *env, struct x86_decode *decode)
             res = ((uint32_t)decode->op[0].val << count) |
                    ((uint32_t)decode->op[0].val >> (32 - count));
 
-            write_val_ext(env, decode->op[0].ptr, res, 4);
+            write_val_ext(env, &decode->op[0], res, 4);
             bit0  = (res & 0x1);
             bit31 = (res >> 31);
             /* of = cf ^ result31 */
@@ -1024,7 +1029,7 @@ void exec_rcl(CPUX86State *env, struct x86_decode *decode)
                    (op1_8 >> (9 - count));
         }
 
-        write_val_ext(env, decode->op[0].ptr, res, 1);
+        write_val_ext(env, &decode->op[0], res, 1);
 
         cf = (op1_8 >> (8 - count)) & 0x01;
         of = cf ^ (res >> 7); /* of = cf ^ result7 */
@@ -1050,7 +1055,7 @@ void exec_rcl(CPUX86State *env, struct x86_decode *decode)
                    (op1_16 >> (17 - count));
         }
 
-        write_val_ext(env, decode->op[0].ptr, res, 2);
+        write_val_ext(env, &decode->op[0], res, 2);
 
         cf = (op1_16 >> (16 - count)) & 0x1;
         of = cf ^ (res >> 15); /* of = cf ^ result15 */
@@ -1073,7 +1078,7 @@ void exec_rcl(CPUX86State *env, struct x86_decode *decode)
                    (op1_32 >> (33 - count));
         }
 
-        write_val_ext(env, decode->op[0].ptr, res, 4);
+        write_val_ext(env, &decode->op[0], res, 4);
 
         cf = (op1_32 >> (32 - count)) & 0x1;
         of = cf ^ (res >> 31); /* of = cf ^ result31 */
@@ -1105,7 +1110,7 @@ void exec_rcr(CPUX86State *env, struct x86_decode *decode)
         res = (op1_8 >> count) | (get_CF(env) << (8 - count)) |
                (op1_8 << (9 - count));
 
-        write_val_ext(env, decode->op[0].ptr, res, 1);
+        write_val_ext(env, &decode->op[0], res, 1);
 
         cf = (op1_8 >> (count - 1)) & 0x1;
         of = (((res << 1) ^ res) >> 7) & 0x1; /* of = result6 ^ result7 */
@@ -1124,7 +1129,7 @@ void exec_rcr(CPUX86State *env, struct x86_decode *decode)
         res = (op1_16 >> count) | (get_CF(env) << (16 - count)) |
                (op1_16 << (17 - count));
 
-        write_val_ext(env, decode->op[0].ptr, res, 2);
+        write_val_ext(env, &decode->op[0], res, 2);
 
         cf = (op1_16 >> (count - 1)) & 0x1;
         of = ((uint16_t)((res << 1) ^ res) >> 15) & 0x1; /* of = result15 ^
@@ -1148,7 +1153,7 @@ void exec_rcr(CPUX86State *env, struct x86_decode *decode)
                    (op1_32 << (33 - count));
         }
 
-        write_val_ext(env, decode->op[0].ptr, res, 4);
+        write_val_ext(env, &decode->op[0], res, 4);
 
         cf = (op1_32 >> (count - 1)) & 0x1;
         of = ((res << 1) ^ res) >> 31; /* of = result30 ^ result31 */
@@ -1163,9 +1168,9 @@ static void exec_xchg(CPUX86State *env, struct x86_decode *decode)
 {
     fetch_operands(env, decode, 2, true, true, false);
 
-    write_val_ext(env, decode->op[0].ptr, decode->op[1].val,
+    write_val_ext(env, &decode->op[0], decode->op[1].val,
                   decode->operand_size);
-    write_val_ext(env, decode->op[1].ptr, decode->op[0].val,
+    write_val_ext(env, &decode->op[1], decode->op[0].val,
                   decode->operand_size);
 
     env->eip += decode->len;
@@ -1174,7 +1179,7 @@ static void exec_xchg(CPUX86State *env, struct x86_decode *decode)
 static void exec_xadd(CPUX86State *env, struct x86_decode *decode)
 {
     EXEC_2OP_FLAGS_CMD(env, decode, +, SET_FLAGS_OSZAPC_ADD, true);
-    write_val_ext(env, decode->op[1].ptr, decode->op[0].val,
+    write_val_ext(env, &decode->op[1], decode->op[0].val,
                   decode->operand_size);
 
     env->eip += decode->len;
diff --git a/target/i386/emulate/x86_emu.h b/target/i386/emulate/x86_emu.h
index 555b567e2c..a1a961284b 100644
--- a/target/i386/emulate/x86_emu.h
+++ b/target/i386/emulate/x86_emu.h
@@ -42,11 +42,11 @@ void x86_emul_raise_exception(CPUX86State *env, int exception_index, int error_c
 
 target_ulong read_reg(CPUX86State *env, int reg, int size);
 void write_reg(CPUX86State *env, int reg, target_ulong val, int size);
-target_ulong read_val_from_reg(target_ulong reg_ptr, int size);
-void write_val_to_reg(target_ulong reg_ptr, target_ulong val, int size);
-void write_val_ext(CPUX86State *env, target_ulong ptr, target_ulong val, int size);
+target_ulong read_val_from_reg(void *reg_ptr, int size);
+void write_val_to_reg(void *reg_ptr, target_ulong val, int size);
+void write_val_ext(CPUX86State *env, struct x86_decode_op *decode, target_ulong val, int size);
 uint8_t *read_mmio(CPUX86State *env, target_ulong ptr, int bytes);
-target_ulong read_val_ext(CPUX86State *env, target_ulong ptr, int size);
+target_ulong read_val_ext(CPUX86State *env, struct x86_decode_op *decode, int size);
 
 void exec_movzx(CPUX86State *env, struct x86_decode *decode);
 void exec_shl(CPUX86State *env, struct x86_decode *decode);

From 5b80dcf95b9a196c15c12b0226f93732c1b1a843 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Thu, 3 Apr 2025 23:07:20 +0200
Subject: [PATCH 0824/2760] target/i386/emulate: mostly rewrite flags handling

While Bochs's algorithms are pretty solid, there are small opportunities
to improve them or to make their logic more similar to TCG's handling
of condition codes.

- use a single bit for the difference between bits 0..7 of result and PF.
This is useful because "set only ZF" is not a common case.

- place SD in the same place as SF

- move CF and PO at bits 62 and 63 when target_ulong is 64-bits wide,
  so that 64-bit ALU operations need fewer shifts

- use rotates to move CF and AF from auxbits to their eflags position

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/emulate/x86_emu.c   |   4 +-
 target/i386/emulate/x86_flags.c | 197 ++++++++++++++------------------
 target/i386/emulate/x86_flags.h |  12 +-
 3 files changed, 86 insertions(+), 127 deletions(-)

diff --git a/target/i386/emulate/x86_emu.c b/target/i386/emulate/x86_emu.c
index 4c07f08942..61bd5af5bb 100644
--- a/target/i386/emulate/x86_emu.c
+++ b/target/i386/emulate/x86_emu.c
@@ -474,10 +474,10 @@ static inline void string_rep(CPUX86State *env, struct x86_decode *decode,
     while (rcx--) {
         func(env, decode);
         write_reg(env, R_ECX, rcx, decode->addressing_size);
-        if ((PREFIX_REP == rep) && !get_ZF(env)) {
+        if ((PREFIX_REP == rep) && !env->lflags.result) {
             break;
         }
-        if ((PREFIX_REPN == rep) && get_ZF(env)) {
+        if ((PREFIX_REPN == rep) && env->lflags.result) {
             break;
         }
     }
diff --git a/target/i386/emulate/x86_flags.c b/target/i386/emulate/x86_flags.c
index 84e27364a0..42f11d7de1 100644
--- a/target/i386/emulate/x86_flags.c
+++ b/target/i386/emulate/x86_flags.c
@@ -29,41 +29,50 @@
 #include "x86.h"
 
 
-/* this is basically bocsh code */
+/*
+ * The algorithms here are similar to those in Bochs.  After an ALU
+ * operation, RESULT can be used to compute ZF, SF and PF, whereas
+ * AUXBITS is used to compute AF, CF and OF.  In reality, SF and PF are the
+ * XOR of the value computed from RESULT and the value found in bits 7 and 2
+ * of AUXBITS; this way the same logic can be used to compute the flags
+ * both before and after an ALU operation.
+ *
+ * Compared to the TCG CC_OP codes, this avoids conditionals when converting
+ * to and from the RFLAGS representation.
+ */
 
-#define LF_SIGN_BIT     31
+#define LF_SIGN_BIT    (TARGET_LONG_BITS - 1)
 
-#define LF_BIT_SD      (0)          /* lazy Sign Flag Delta            */
-#define LF_BIT_AF      (3)          /* lazy Adjust flag                */
-#define LF_BIT_PDB     (8)          /* lazy Parity Delta Byte (8 bits) */
-#define LF_BIT_CF      (31)         /* lazy Carry Flag                 */
-#define LF_BIT_PO      (30)         /* lazy Partial Overflow = CF ^ OF */
+#define LF_BIT_PD      (2)          /* lazy Parity Delta, same bit as PF */
+#define LF_BIT_AF      (3)          /* lazy Adjust flag */
+#define LF_BIT_SD      (7)          /* lazy Sign Flag Delta, same bit as SF */
+#define LF_BIT_CF      (TARGET_LONG_BITS - 1) /* lazy Carry Flag */
+#define LF_BIT_PO      (TARGET_LONG_BITS - 2) /* lazy Partial Overflow = CF ^ OF */
 
-#define LF_MASK_SD     (0x01 << LF_BIT_SD)
-#define LF_MASK_AF     (0x01 << LF_BIT_AF)
-#define LF_MASK_PDB    (0xFF << LF_BIT_PDB)
-#define LF_MASK_CF     (0x01 << LF_BIT_CF)
-#define LF_MASK_PO     (0x01 << LF_BIT_PO)
+#define LF_MASK_PD     ((target_ulong)0x01 << LF_BIT_PD)
+#define LF_MASK_AF     ((target_ulong)0x01 << LF_BIT_AF)
+#define LF_MASK_SD     ((target_ulong)0x01 << LF_BIT_SD)
+#define LF_MASK_CF     ((target_ulong)0x01 << LF_BIT_CF)
+#define LF_MASK_PO     ((target_ulong)0x01 << LF_BIT_PO)
 
 /* ******************* */
 /* OSZAPC */
 /* ******************* */
 
-/* size, carries, result */
+/* use carries to fill in AF, PO and CF, while ensuring PD and SD are clear.
+ * for full-word operations just clear PD and SD; for smaller operand
+ * sizes only keep AF in the low byte and shift the carries left to
+ * place PO and CF in the top two bits.
+ */
 #define SET_FLAGS_OSZAPC_SIZE(size, lf_carries, lf_result) { \
-    target_ulong temp = ((lf_carries) & (LF_MASK_AF)) | \
-    (((lf_carries) >> (size - 2)) << LF_BIT_PO); \
     env->lflags.result = (target_ulong)(int##size##_t)(lf_result); \
-    if ((size) == 32) { \
-        temp = ((lf_carries) & ~(LF_MASK_PDB | LF_MASK_SD)); \
-    } else if ((size) == 16) { \
-        temp = ((lf_carries) & (LF_MASK_AF)) | ((lf_carries) << 16); \
-    } else if ((size) == 8)  { \
-        temp = ((lf_carries) & (LF_MASK_AF)) | ((lf_carries) << 24); \
+    target_ulong temp = (lf_carries); \
+    if ((size) == TARGET_LONG_BITS) { \
+        temp = temp & ~(LF_MASK_PD | LF_MASK_SD); \
     } else { \
-        VM_PANIC("unimplemented");  \
+        temp = (temp & LF_MASK_AF) | (temp << (TARGET_LONG_BITS - (size))); \
     } \
-    env->lflags.auxbits = (target_ulong)(uint32_t)temp; \
+    env->lflags.auxbits = temp; \
 }
 
 /* carries, result */
@@ -77,23 +86,18 @@
 /* ******************* */
 /* OSZAP */
 /* ******************* */
-/* size, carries, result */
+/* same as setting OSZAPC, but preserve CF and flip PO if the old value of CF
+ * did not match the high bit of lf_carries. */
 #define SET_FLAGS_OSZAP_SIZE(size, lf_carries, lf_result) { \
-    target_ulong temp = ((lf_carries) & (LF_MASK_AF)) | \
-    (((lf_carries) >> (size - 2)) << LF_BIT_PO); \
-    if ((size) == 32) { \
-        temp = ((lf_carries) & ~(LF_MASK_PDB | LF_MASK_SD)); \
-    } else if ((size) == 16) { \
-        temp = ((lf_carries) & (LF_MASK_AF)) | ((lf_carries) << 16); \
-    } else if ((size) == 8) { \
-        temp = ((lf_carries) & (LF_MASK_AF)) | ((lf_carries) << 24); \
-    } else { \
-        VM_PANIC("unimplemented");      \
-    } \
     env->lflags.result = (target_ulong)(int##size##_t)(lf_result); \
-    target_ulong delta_c = (env->lflags.auxbits ^ temp) & LF_MASK_CF; \
-    delta_c ^= (delta_c >> 1); \
-    env->lflags.auxbits = (target_ulong)(uint32_t)(temp ^ delta_c); \
+    target_ulong temp = (lf_carries); \
+    if ((size) == TARGET_LONG_BITS) { \
+        temp = (temp & ~(LF_MASK_PD | LF_MASK_SD)); \
+    } else { \
+        temp = (temp & LF_MASK_AF) | (temp << (TARGET_LONG_BITS - (size))); \
+    } \
+    target_ulong cf_changed = ((target_long)(env->lflags.auxbits ^ temp)) < 0; \
+    env->lflags.auxbits = temp ^ (cf_changed * (LF_MASK_PO | LF_MASK_CF)); \
 }
 
 /* carries, result */
@@ -104,11 +108,11 @@
 #define SET_FLAGS_OSZAP_32(carries, result) \
     SET_FLAGS_OSZAP_SIZE(32, carries, result)
 
-void SET_FLAGS_OxxxxC(CPUX86State *env, uint32_t new_of, uint32_t new_cf)
+void SET_FLAGS_OxxxxC(CPUX86State *env, bool new_of, bool new_cf)
 {
-    uint32_t temp_po = new_of ^ new_cf;
     env->lflags.auxbits &= ~(LF_MASK_PO | LF_MASK_CF);
-    env->lflags.auxbits |= (temp_po << LF_BIT_PO) | (new_cf << LF_BIT_CF);
+    env->lflags.auxbits |= (-(target_ulong)new_cf << LF_BIT_PO);
+    env->lflags.auxbits ^= ((target_ulong)new_of << LF_BIT_PO);
 }
 
 void SET_FLAGS_OSZAPC_SUB32(CPUX86State *env, uint32_t v1, uint32_t v2,
@@ -202,104 +206,69 @@ void SET_FLAGS_OSZAPC_LOGIC8(CPUX86State *env, uint8_t v1, uint8_t v2,
     SET_FLAGS_OSZAPC_8(0, diff);
 }
 
-bool get_PF(CPUX86State *env)
+static inline uint32_t get_PF(CPUX86State *env)
 {
-    uint32_t temp = (255 & env->lflags.result);
-    temp = temp ^ (255 & (env->lflags.auxbits >> LF_BIT_PDB));
-    temp = (temp ^ (temp >> 4)) & 0x0F;
-    return (0x9669U >> temp) & 1;
+    uint8_t temp = env->lflags.result;
+    return ((parity8(temp) - 1) ^ env->lflags.auxbits) & CC_P;
 }
 
-void set_PF(CPUX86State *env, bool val)
+static inline uint32_t get_OF(CPUX86State *env)
 {
-    uint32_t temp = (255 & env->lflags.result) ^ (!val);
-    env->lflags.auxbits &= ~(LF_MASK_PDB);
-    env->lflags.auxbits |= (temp << LF_BIT_PDB);
-}
-
-bool get_OF(CPUX86State *env)
-{
-    return ((env->lflags.auxbits + (1U << LF_BIT_PO)) >> LF_BIT_CF) & 1;
+    return ((env->lflags.auxbits >> (LF_BIT_CF - 11)) + CC_O / 2) & CC_O;
 }
 
 bool get_CF(CPUX86State *env)
 {
-    return (env->lflags.auxbits >> LF_BIT_CF) & 1;
-}
-
-void set_OF(CPUX86State *env, bool val)
-{
-    bool old_cf = get_CF(env);
-    SET_FLAGS_OxxxxC(env, val, old_cf);
+    return ((target_long)env->lflags.auxbits) < 0;
 }
 
 void set_CF(CPUX86State *env, bool val)
 {
-    bool old_of = get_OF(env);
-    SET_FLAGS_OxxxxC(env, old_of, val);
+    /* If CF changes, flip PO and CF */
+    target_ulong temp = -(target_ulong)val;
+    target_ulong cf_changed = ((target_long)(env->lflags.auxbits ^ temp)) < 0;
+    env->lflags.auxbits ^= cf_changed * (LF_MASK_PO | LF_MASK_CF);
 }
 
-bool get_AF(CPUX86State *env)
+static inline uint32_t get_ZF(CPUX86State *env)
 {
-    return (env->lflags.auxbits >> LF_BIT_AF) & 1;
+    return env->lflags.result ? 0 : CC_Z;
 }
 
-void set_AF(CPUX86State *env, bool val)
+static inline uint32_t get_SF(CPUX86State *env)
 {
-    env->lflags.auxbits &= ~(LF_MASK_AF);
-    env->lflags.auxbits |= val << LF_BIT_AF;
-}
-
-bool get_ZF(CPUX86State *env)
-{
-    return !env->lflags.result;
-}
-
-void set_ZF(CPUX86State *env, bool val)
-{
-    if (val) {
-        env->lflags.auxbits ^=
-         (((env->lflags.result >> LF_SIGN_BIT) & 1) << LF_BIT_SD);
-        /* merge the parity bits into the Parity Delta Byte */
-        uint32_t temp_pdb = (255 & env->lflags.result);
-        env->lflags.auxbits ^= (temp_pdb << LF_BIT_PDB);
-        /* now zero the .result value */
-        env->lflags.result = 0;
-    } else {
-        env->lflags.result |= (1 << 8);
-    }
-}
-
-bool get_SF(CPUX86State *env)
-{
-    return ((env->lflags.result >> LF_SIGN_BIT) ^
-            (env->lflags.auxbits >> LF_BIT_SD)) & 1;
-}
-
-void set_SF(CPUX86State *env, bool val)
-{
-    bool temp_sf = get_SF(env);
-    env->lflags.auxbits ^= (temp_sf ^ val) << LF_BIT_SD;
+    return ((env->lflags.result >> (LF_SIGN_BIT - LF_BIT_SD)) ^
+            env->lflags.auxbits) & CC_S;
 }
 
 void lflags_to_rflags(CPUX86State *env)
 {
     env->eflags &= ~(CC_C|CC_P|CC_A|CC_Z|CC_S|CC_O);
-    env->eflags |= get_CF(env) ? CC_C : 0;
-    env->eflags |= get_PF(env) ? CC_P : 0;
-    env->eflags |= get_AF(env) ? CC_A : 0;
-    env->eflags |= get_ZF(env) ? CC_Z : 0;
-    env->eflags |= get_SF(env) ? CC_S : 0;
-    env->eflags |= get_OF(env) ? CC_O : 0;
+    /* rotate left by one to move carry-out bits into CF and AF */
+    env->eflags |= (
+        (env->lflags.auxbits << 1) |
+        (env->lflags.auxbits >> (TARGET_LONG_BITS - 1))) & (CC_C | CC_A);
+    env->eflags |= get_SF(env);
+    env->eflags |= get_PF(env);
+    env->eflags |= get_ZF(env);
+    env->eflags |= get_OF(env);
 }
 
 void rflags_to_lflags(CPUX86State *env)
 {
-    env->lflags.auxbits = env->lflags.result = 0;
-    set_OF(env, env->eflags & CC_O);
-    set_SF(env, env->eflags & CC_S);
-    set_ZF(env, env->eflags & CC_Z);
-    set_AF(env, env->eflags & CC_A);
-    set_PF(env, env->eflags & CC_P);
-    set_CF(env, env->eflags & CC_C);
+    target_ulong cf_xor_of;
+
+    env->lflags.auxbits = CC_P;
+    env->lflags.auxbits ^= env->eflags & (CC_S | CC_P);
+
+    /* rotate right by one to move CF and AF into the carry-out positions */
+    env->lflags.auxbits |= (
+        (env->eflags >> 1) |
+        (env->eflags << (TARGET_LONG_BITS - 1))) & (CC_C | CC_A);
+
+    cf_xor_of = (env->eflags & (CC_C | CC_O)) + (CC_O - CC_C);
+    env->lflags.auxbits |= -cf_xor_of & LF_MASK_PO;
+
+    /* Leave the low byte zero so that parity is not affected.  */
+    env->lflags.result = !(env->eflags & CC_Z) << 8;
 }
diff --git a/target/i386/emulate/x86_flags.h b/target/i386/emulate/x86_flags.h
index 6c175007b5..28b008e577 100644
--- a/target/i386/emulate/x86_flags.h
+++ b/target/i386/emulate/x86_flags.h
@@ -28,20 +28,10 @@
 void lflags_to_rflags(CPUX86State *env);
 void rflags_to_lflags(CPUX86State *env);
 
-bool get_PF(CPUX86State *env);
-void set_PF(CPUX86State *env, bool val);
 bool get_CF(CPUX86State *env);
 void set_CF(CPUX86State *env, bool val);
-bool get_AF(CPUX86State *env);
-void set_AF(CPUX86State *env, bool val);
-bool get_ZF(CPUX86State *env);
-void set_ZF(CPUX86State *env, bool val);
-bool get_SF(CPUX86State *env);
-void set_SF(CPUX86State *env, bool val);
-bool get_OF(CPUX86State *env);
-void set_OF(CPUX86State *env, bool val);
 
-void SET_FLAGS_OxxxxC(CPUX86State *env, uint32_t new_of, uint32_t new_cf);
+void SET_FLAGS_OxxxxC(CPUX86State *env, bool new_of, bool new_cf);
 
 void SET_FLAGS_OSZAPC_SUB32(CPUX86State *env, uint32_t v1, uint32_t v2,
                             uint32_t diff);

From d521fdc73f6ec09fd3f7a37913a6344c86b6c32c Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Thu, 24 Apr 2025 17:12:45 +0200
Subject: [PATCH 0825/2760] target/i386: remove lflags

Just use cc_dst and cc_src for the same purpose.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.h               |  6 ----
 target/i386/emulate/x86_emu.c   |  4 +--
 target/i386/emulate/x86_flags.c | 55 ++++++++++++++++-----------------
 3 files changed, 29 insertions(+), 36 deletions(-)

diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index 4f8ed8868e..c51e0a43d0 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -1805,11 +1805,6 @@ typedef struct CPUCaches {
         CPUCacheInfo *l3_cache;
 } CPUCaches;
 
-typedef struct X86LazyFlags {
-    target_ulong result;
-    target_ulong auxbits;
-} X86LazyFlags;
-
 typedef struct CPUArchState {
     /* standard registers */
     target_ulong regs[CPU_NB_REGS];
@@ -2102,7 +2097,6 @@ typedef struct CPUArchState {
     QemuMutex xen_timers_lock;
 #endif
 #if defined(CONFIG_HVF)
-    X86LazyFlags lflags;
     void *emu_mmio_buf;
 #endif
 
diff --git a/target/i386/emulate/x86_emu.c b/target/i386/emulate/x86_emu.c
index 61bd5af5bb..4890e0a4e5 100644
--- a/target/i386/emulate/x86_emu.c
+++ b/target/i386/emulate/x86_emu.c
@@ -474,10 +474,10 @@ static inline void string_rep(CPUX86State *env, struct x86_decode *decode,
     while (rcx--) {
         func(env, decode);
         write_reg(env, R_ECX, rcx, decode->addressing_size);
-        if ((PREFIX_REP == rep) && !env->lflags.result) {
+        if ((PREFIX_REP == rep) && !env->cc_dst) {
             break;
         }
-        if ((PREFIX_REPN == rep) && env->lflags.result) {
+        if ((PREFIX_REPN == rep) && env->cc_dst) {
             break;
         }
     }
diff --git a/target/i386/emulate/x86_flags.c b/target/i386/emulate/x86_flags.c
index 42f11d7de1..47bc19778c 100644
--- a/target/i386/emulate/x86_flags.c
+++ b/target/i386/emulate/x86_flags.c
@@ -31,10 +31,10 @@
 
 /*
  * The algorithms here are similar to those in Bochs.  After an ALU
- * operation, RESULT can be used to compute ZF, SF and PF, whereas
- * AUXBITS is used to compute AF, CF and OF.  In reality, SF and PF are the
- * XOR of the value computed from RESULT and the value found in bits 7 and 2
- * of AUXBITS; this way the same logic can be used to compute the flags
+ * operation, CC_DST can be used to compute ZF, SF and PF, whereas
+ * CC_SRC is used to compute AF, CF and OF.  In reality, SF and PF are the
+ * XOR of the value computed from CC_DST and the value found in bits 7 and 2
+ * of CC_SRC; this way the same logic can be used to compute the flags
  * both before and after an ALU operation.
  *
  * Compared to the TCG CC_OP codes, this avoids conditionals when converting
@@ -65,14 +65,14 @@
  * place PO and CF in the top two bits.
  */
 #define SET_FLAGS_OSZAPC_SIZE(size, lf_carries, lf_result) { \
-    env->lflags.result = (target_ulong)(int##size##_t)(lf_result); \
+    env->cc_dst = (target_ulong)(int##size##_t)(lf_result); \
     target_ulong temp = (lf_carries); \
     if ((size) == TARGET_LONG_BITS) { \
         temp = temp & ~(LF_MASK_PD | LF_MASK_SD); \
     } else { \
         temp = (temp & LF_MASK_AF) | (temp << (TARGET_LONG_BITS - (size))); \
     } \
-    env->lflags.auxbits = temp; \
+    env->cc_src = temp; \
 }
 
 /* carries, result */
@@ -89,15 +89,15 @@
 /* same as setting OSZAPC, but preserve CF and flip PO if the old value of CF
  * did not match the high bit of lf_carries. */
 #define SET_FLAGS_OSZAP_SIZE(size, lf_carries, lf_result) { \
-    env->lflags.result = (target_ulong)(int##size##_t)(lf_result); \
+    env->cc_dst = (target_ulong)(int##size##_t)(lf_result); \
     target_ulong temp = (lf_carries); \
     if ((size) == TARGET_LONG_BITS) { \
         temp = (temp & ~(LF_MASK_PD | LF_MASK_SD)); \
     } else { \
         temp = (temp & LF_MASK_AF) | (temp << (TARGET_LONG_BITS - (size))); \
     } \
-    target_ulong cf_changed = ((target_long)(env->lflags.auxbits ^ temp)) < 0; \
-    env->lflags.auxbits = temp ^ (cf_changed * (LF_MASK_PO | LF_MASK_CF)); \
+    target_ulong cf_changed = ((target_long)(env->cc_src ^ temp)) < 0; \
+    env->cc_src = temp ^ (cf_changed * (LF_MASK_PO | LF_MASK_CF)); \
 }
 
 /* carries, result */
@@ -110,9 +110,9 @@
 
 void SET_FLAGS_OxxxxC(CPUX86State *env, bool new_of, bool new_cf)
 {
-    env->lflags.auxbits &= ~(LF_MASK_PO | LF_MASK_CF);
-    env->lflags.auxbits |= (-(target_ulong)new_cf << LF_BIT_PO);
-    env->lflags.auxbits ^= ((target_ulong)new_of << LF_BIT_PO);
+    env->cc_src &= ~(LF_MASK_PO | LF_MASK_CF);
+    env->cc_src |= (-(target_ulong)new_cf << LF_BIT_PO);
+    env->cc_src ^= ((target_ulong)new_of << LF_BIT_PO);
 }
 
 void SET_FLAGS_OSZAPC_SUB32(CPUX86State *env, uint32_t v1, uint32_t v2,
@@ -208,37 +208,36 @@ void SET_FLAGS_OSZAPC_LOGIC8(CPUX86State *env, uint8_t v1, uint8_t v2,
 
 static inline uint32_t get_PF(CPUX86State *env)
 {
-    uint8_t temp = env->lflags.result;
-    return ((parity8(temp) - 1) ^ env->lflags.auxbits) & CC_P;
+    return ((parity8(env->cc_dst) - 1) ^ env->cc_src) & CC_P;
 }
 
 static inline uint32_t get_OF(CPUX86State *env)
 {
-    return ((env->lflags.auxbits >> (LF_BIT_CF - 11)) + CC_O / 2) & CC_O;
+    return ((env->cc_src >> (LF_BIT_CF - 11)) + CC_O / 2) & CC_O;
 }
 
 bool get_CF(CPUX86State *env)
 {
-    return ((target_long)env->lflags.auxbits) < 0;
+    return ((target_long)env->cc_src) < 0;
 }
 
 void set_CF(CPUX86State *env, bool val)
 {
     /* If CF changes, flip PO and CF */
     target_ulong temp = -(target_ulong)val;
-    target_ulong cf_changed = ((target_long)(env->lflags.auxbits ^ temp)) < 0;
-    env->lflags.auxbits ^= cf_changed * (LF_MASK_PO | LF_MASK_CF);
+    target_ulong cf_changed = ((target_long)(env->cc_src ^ temp)) < 0;
+    env->cc_src ^= cf_changed * (LF_MASK_PO | LF_MASK_CF);
 }
 
 static inline uint32_t get_ZF(CPUX86State *env)
 {
-    return env->lflags.result ? 0 : CC_Z;
+    return env->cc_dst ? 0 : CC_Z;
 }
 
 static inline uint32_t get_SF(CPUX86State *env)
 {
-    return ((env->lflags.result >> (LF_SIGN_BIT - LF_BIT_SD)) ^
-            env->lflags.auxbits) & CC_S;
+    return ((env->cc_dst >> (LF_SIGN_BIT - LF_BIT_SD)) ^
+            env->cc_src) & CC_S;
 }
 
 void lflags_to_rflags(CPUX86State *env)
@@ -246,8 +245,8 @@ void lflags_to_rflags(CPUX86State *env)
     env->eflags &= ~(CC_C|CC_P|CC_A|CC_Z|CC_S|CC_O);
     /* rotate left by one to move carry-out bits into CF and AF */
     env->eflags |= (
-        (env->lflags.auxbits << 1) |
-        (env->lflags.auxbits >> (TARGET_LONG_BITS - 1))) & (CC_C | CC_A);
+        (env->cc_src << 1) |
+        (env->cc_src >> (TARGET_LONG_BITS - 1))) & (CC_C | CC_A);
     env->eflags |= get_SF(env);
     env->eflags |= get_PF(env);
     env->eflags |= get_ZF(env);
@@ -258,17 +257,17 @@ void rflags_to_lflags(CPUX86State *env)
 {
     target_ulong cf_xor_of;
 
-    env->lflags.auxbits = CC_P;
-    env->lflags.auxbits ^= env->eflags & (CC_S | CC_P);
+    env->cc_src = CC_P;
+    env->cc_src ^= env->eflags & (CC_S | CC_P);
 
     /* rotate right by one to move CF and AF into the carry-out positions */
-    env->lflags.auxbits |= (
+    env->cc_src |= (
         (env->eflags >> 1) |
         (env->eflags << (TARGET_LONG_BITS - 1))) & (CC_C | CC_A);
 
     cf_xor_of = (env->eflags & (CC_C | CC_O)) + (CC_O - CC_C);
-    env->lflags.auxbits |= -cf_xor_of & LF_MASK_PO;
+    env->cc_src |= -cf_xor_of & LF_MASK_PO;
 
     /* Leave the low byte zero so that parity is not affected.  */
-    env->lflags.result = !(env->eflags & CC_Z) << 8;
+    env->cc_dst = !(env->eflags & CC_Z) << 8;
 }

From 428c0acd953a626dab55e2c07401ce99c2271119 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Mon, 12 May 2025 10:39:19 +0200
Subject: [PATCH 0826/2760] linux-headers: update from 6.15 + kvm/next

This brings in the userspace TDX API.

Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 linux-headers/asm-x86/kvm.h | 71 +++++++++++++++++++++++++++++++++++++
 linux-headers/linux/kvm.h   |  1 +
 2 files changed, 72 insertions(+)

diff --git a/linux-headers/asm-x86/kvm.h b/linux-headers/asm-x86/kvm.h
index dc591fb17e..7fb57ccb2a 100644
--- a/linux-headers/asm-x86/kvm.h
+++ b/linux-headers/asm-x86/kvm.h
@@ -439,6 +439,7 @@ struct kvm_sync_regs {
 #define KVM_X86_QUIRK_MWAIT_NEVER_UD_FAULTS	(1 << 6)
 #define KVM_X86_QUIRK_SLOT_ZAP_ALL		(1 << 7)
 #define KVM_X86_QUIRK_STUFF_FEATURE_MSRS	(1 << 8)
+#define KVM_X86_QUIRK_IGNORE_GUEST_PAT		(1 << 9)
 
 #define KVM_STATE_NESTED_FORMAT_VMX	0
 #define KVM_STATE_NESTED_FORMAT_SVM	1
@@ -928,4 +929,74 @@ struct kvm_hyperv_eventfd {
 #define KVM_X86_SNP_VM		4
 #define KVM_X86_TDX_VM		5
 
+/* Trust Domain eXtension sub-ioctl() commands. */
+enum kvm_tdx_cmd_id {
+	KVM_TDX_CAPABILITIES = 0,
+	KVM_TDX_INIT_VM,
+	KVM_TDX_INIT_VCPU,
+	KVM_TDX_INIT_MEM_REGION,
+	KVM_TDX_FINALIZE_VM,
+	KVM_TDX_GET_CPUID,
+
+	KVM_TDX_CMD_NR_MAX,
+};
+
+struct kvm_tdx_cmd {
+	/* enum kvm_tdx_cmd_id */
+	__u32 id;
+	/* flags for sub-commend. If sub-command doesn't use this, set zero. */
+	__u32 flags;
+	/*
+	 * data for each sub-command. An immediate or a pointer to the actual
+	 * data in process virtual address.  If sub-command doesn't use it,
+	 * set zero.
+	 */
+	__u64 data;
+	/*
+	 * Auxiliary error code.  The sub-command may return TDX SEAMCALL
+	 * status code in addition to -Exxx.
+	 */
+	__u64 hw_error;
+};
+
+struct kvm_tdx_capabilities {
+	__u64 supported_attrs;
+	__u64 supported_xfam;
+	__u64 reserved[254];
+
+	/* Configurable CPUID bits for userspace */
+	struct kvm_cpuid2 cpuid;
+};
+
+struct kvm_tdx_init_vm {
+	__u64 attributes;
+	__u64 xfam;
+	__u64 mrconfigid[6];	/* sha384 digest */
+	__u64 mrowner[6];	/* sha384 digest */
+	__u64 mrownerconfig[6];	/* sha384 digest */
+
+	/* The total space for TD_PARAMS before the CPUIDs is 256 bytes */
+	__u64 reserved[12];
+
+	/*
+	 * Call KVM_TDX_INIT_VM before vcpu creation, thus before
+	 * KVM_SET_CPUID2.
+	 * This configuration supersedes KVM_SET_CPUID2s for VCPUs because the
+	 * TDX module directly virtualizes those CPUIDs without VMM.  The user
+	 * space VMM, e.g. qemu, should make KVM_SET_CPUID2 consistent with
+	 * those values.  If it doesn't, KVM may have wrong idea of vCPUIDs of
+	 * the guest, and KVM may wrongly emulate CPUIDs or MSRs that the TDX
+	 * module doesn't virtualize.
+	 */
+	struct kvm_cpuid2 cpuid;
+};
+
+#define KVM_TDX_MEASURE_MEMORY_REGION   _BITULL(0)
+
+struct kvm_tdx_init_mem_region {
+	__u64 source_addr;
+	__u64 gpa;
+	__u64 nr_pages;
+};
+
 #endif /* _ASM_X86_KVM_H */
diff --git a/linux-headers/linux/kvm.h b/linux-headers/linux/kvm.h
index e5f3e8b5a0..99cc82a275 100644
--- a/linux-headers/linux/kvm.h
+++ b/linux-headers/linux/kvm.h
@@ -369,6 +369,7 @@ struct kvm_run {
 #define KVM_SYSTEM_EVENT_WAKEUP         4
 #define KVM_SYSTEM_EVENT_SUSPEND        5
 #define KVM_SYSTEM_EVENT_SEV_TERM       6
+#define KVM_SYSTEM_EVENT_TDX_FATAL      7
 			__u32 type;
 			__u32 ndata;
 			union {

From bbdbc47b5c6907e065f84e751d127dae3cebfd54 Mon Sep 17 00:00:00 2001
From: Zheng Huang <hz1624917200@gmail.com>
Date: Fri, 9 May 2025 19:21:35 +0800
Subject: [PATCH 0827/2760] hw/audio/cs4231a: fix assertion error in
 isa_bus_get_irq

This patch fixes an assertion error in isa_bus_get_irq() in
/hw/isa/isa-bus.c by adding a constraint to the irq property.
Patch v1 misused ISA_NUM_IRQS, pls ignore that.

Signed-off-by: Zheng Huang <hz1624917200@gmail.com>
Link: https://lore.kernel.org/r/6d228069-e38f-4c46-813f-edcccc5c47e4@gmail.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/audio/cs4231a.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/hw/audio/cs4231a.c b/hw/audio/cs4231a.c
index 06b44da869..eb9a45805b 100644
--- a/hw/audio/cs4231a.c
+++ b/hw/audio/cs4231a.c
@@ -682,6 +682,10 @@ static void cs4231a_realizefn (DeviceState *dev, Error **errp)
         return;
     }
 
+    if (s->irq >= ISA_NUM_IRQS) {
+        error_setg(errp, "Invalid IRQ %d (max %d)", s->irq, ISA_NUM_IRQS - 1);
+        return;
+    }
     s->pic = isa_bus_get_irq(bus, s->irq);
     k = ISADMA_GET_CLASS(s->isa_dma);
     k->register_channel(s->isa_dma, s->dma, cs_dma_read, s);

From 74978391b2da0116b9109d52931f342118d5a122 Mon Sep 17 00:00:00 2001
From: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
Date: Mon, 12 May 2025 10:26:04 -0700
Subject: [PATCH 0828/2760] target/i386: Make ITS_NO available to guests

When a system is not affected by Indirect Target Selection (ITS)
vulnerability, VMMs set ITS_NO bit in MSR IA32_ARCH_CAPABILITIES to let the
guest know that it is not affected.

Make it available to guests.

Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
Link: https://lore.kernel.org/r/8c1797e488b42650f62d816f25c58726eb522fad.1745946029.git.pawan.kumar.gupta@linux.intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 1656de3dcc..ec908d7d36 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -1383,6 +1383,14 @@ FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
             "bhi-no", NULL, NULL, NULL,
             "pbrsb-no", NULL, "gds-no", "rfds-no",
             "rfds-clear", NULL, NULL, NULL,
+            NULL, NULL, NULL, NULL,
+            NULL, NULL, NULL, NULL,
+            NULL, NULL, NULL, NULL,
+            NULL, NULL, NULL, NULL,
+            NULL, NULL, NULL, NULL,
+            NULL, NULL, NULL, NULL,
+            NULL, NULL, NULL, NULL,
+            NULL, NULL, "its-no", NULL,
         },
         .msr = {
             .index = MSR_IA32_ARCH_CAPABILITIES,

From cda6d7e282af53264228cdb4b233f624ab074161 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Tue, 6 May 2025 08:21:40 +0200
Subject: [PATCH 0829/2760] hw/s390x/s390-virtio-ccw: Remove the deprecated
 2.10 machine type
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The s390-ccw-virtio-2.10 machine is older than 6 years, so according
to our machine support policy, it can be removed now.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250506062148.306084-2-thuth@redhat.com>
Reviewed-by: Eric Farman <farman@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 hw/s390x/s390-virtio-ccw.c | 12 ------------
 1 file changed, 12 deletions(-)

diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
index d5658afed9..206124f7a4 100644
--- a/hw/s390x/s390-virtio-ccw.c
+++ b/hw/s390x/s390-virtio-ccw.c
@@ -1275,18 +1275,6 @@ static void ccw_machine_2_11_class_options(MachineClass *mc)
 }
 DEFINE_CCW_MACHINE(2, 11);
 
-static void ccw_machine_2_10_instance_options(MachineState *machine)
-{
-    ccw_machine_2_11_instance_options(machine);
-}
-
-static void ccw_machine_2_10_class_options(MachineClass *mc)
-{
-    ccw_machine_2_11_class_options(mc);
-    compat_props_add(mc->compat_props, hw_compat_2_10, hw_compat_2_10_len);
-}
-DEFINE_CCW_MACHINE(2, 10);
-
 #endif
 
 static void ccw_machine_register_types(void)

From ea9544b7e8e1e1ce971877e1e1367d98209543ef Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Tue, 6 May 2025 08:21:41 +0200
Subject: [PATCH 0830/2760] hw/s390x/s390-virtio-ccw: Remove the deprecated
 2.11 machine type
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The s390-ccw-virtio-2.11 machine is older than 6 years, so according
to our machine support policy, it can be removed now.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250506062148.306084-3-thuth@redhat.com>
Reviewed-by: Eric Farman <farman@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 hw/s390x/s390-virtio-ccw.c | 25 -------------------------
 1 file changed, 25 deletions(-)

diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
index 206124f7a4..104a24ee00 100644
--- a/hw/s390x/s390-virtio-ccw.c
+++ b/hw/s390x/s390-virtio-ccw.c
@@ -1252,31 +1252,6 @@ static void ccw_machine_2_12_class_options(MachineClass *mc)
 }
 DEFINE_CCW_MACHINE(2, 12);
 
-#ifdef CONFIG_S390X_LEGACY_CPUS
-
-static void ccw_machine_2_11_instance_options(MachineState *machine)
-{
-    static const S390FeatInit qemu_cpu_feat = { S390_FEAT_LIST_QEMU_V2_11 };
-    ccw_machine_2_12_instance_options(machine);
-
-    /* before 2.12 we emulated the very first z900 */
-    s390_set_qemu_cpu_model(0x2064, 7, 1, qemu_cpu_feat);
-}
-
-static void ccw_machine_2_11_class_options(MachineClass *mc)
-{
-    static GlobalProperty compat[] = {
-        { TYPE_SCLP_EVENT_FACILITY, "allow_all_mask_sizes", "off", },
-    };
-
-    ccw_machine_2_12_class_options(mc);
-    compat_props_add(mc->compat_props, hw_compat_2_11, hw_compat_2_11_len);
-    compat_props_add(mc->compat_props, compat, G_N_ELEMENTS(compat));
-}
-DEFINE_CCW_MACHINE(2, 11);
-
-#endif
-
 static void ccw_machine_register_types(void)
 {
     type_register_static(&ccw_machine_info);

From b80fadee690f9eef193e4ad4113ee2f2265ac174 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Tue, 6 May 2025 08:21:42 +0200
Subject: [PATCH 0831/2760] hw/s390x/event-facility: Remove the obsolete
 "allow_all_mask_sizes" code
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Now that the machine types 2.11 and older have been removed, we
don't need the "allow_all_mask_sizes" compatibility handling code
anymore and can remove it now.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250506062148.306084-4-thuth@redhat.com>
Reviewed-by: Eric Farman <farman@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 hw/s390x/event-facility.c | 37 +------------------------------------
 1 file changed, 1 insertion(+), 36 deletions(-)

diff --git a/hw/s390x/event-facility.c b/hw/s390x/event-facility.c
index 1afe364573..7b7bf237fe 100644
--- a/hw/s390x/event-facility.c
+++ b/hw/s390x/event-facility.c
@@ -45,13 +45,6 @@ struct SCLPEventFacility {
         uint32_t receive_mask_pieces[2];
         sccb_mask_t receive_mask;
     };
-    /*
-     * when false, we keep the same broken, backwards compatible behaviour as
-     * before, allowing only masks of size exactly 4; when true, we implement
-     * the architecture correctly, allowing all valid mask sizes. Needed for
-     * migration toward older versions.
-     */
-    bool allow_all_mask_sizes;
     /* length of the receive mask */
     uint16_t mask_length;
 };
@@ -294,8 +287,7 @@ static void write_event_mask(SCLPEventFacility *ef, SCCB *sccb)
     uint16_t mask_length = be16_to_cpu(we_mask->mask_length);
     sccb_mask_t tmp_mask;
 
-    if (!mask_length || (mask_length > SCLP_EVENT_MASK_LEN_MAX) ||
-        ((mask_length != 4) && !ef->allow_all_mask_sizes)) {
+    if (!mask_length || mask_length > SCLP_EVENT_MASK_LEN_MAX) {
         sccb->h.response_code = cpu_to_be16(SCLP_RC_INVALID_MASK_LENGTH);
         return;
     }
@@ -355,13 +347,6 @@ static bool vmstate_event_facility_mask64_needed(void *opaque)
     return (ef->receive_mask & 0xFFFFFFFF) != 0;
 }
 
-static bool vmstate_event_facility_mask_length_needed(void *opaque)
-{
-    SCLPEventFacility *ef = opaque;
-
-    return ef->allow_all_mask_sizes;
-}
-
 static const VMStateDescription vmstate_event_facility_mask64 = {
     .name = "vmstate-event-facility/mask64",
     .version_id = 0,
@@ -377,7 +362,6 @@ static const VMStateDescription vmstate_event_facility_mask_length = {
     .name = "vmstate-event-facility/mask_length",
     .version_id = 0,
     .minimum_version_id = 0,
-    .needed = vmstate_event_facility_mask_length_needed,
     .fields = (const VMStateField[]) {
         VMSTATE_UINT16(mask_length, SCLPEventFacility),
         VMSTATE_END_OF_LIST()
@@ -399,31 +383,12 @@ static const VMStateDescription vmstate_event_facility = {
      }
 };
 
-static void sclp_event_set_allow_all_mask_sizes(Object *obj, bool value,
-                                                       Error **errp)
-{
-    SCLPEventFacility *ef = (SCLPEventFacility *)obj;
-
-    ef->allow_all_mask_sizes = value;
-}
-
-static bool sclp_event_get_allow_all_mask_sizes(Object *obj, Error **errp)
-{
-    SCLPEventFacility *ef = (SCLPEventFacility *)obj;
-
-    return ef->allow_all_mask_sizes;
-}
-
 static void init_event_facility(Object *obj)
 {
     SCLPEventFacility *event_facility = EVENT_FACILITY(obj);
     DeviceState *sdev = DEVICE(obj);
 
     event_facility->mask_length = 4;
-    event_facility->allow_all_mask_sizes = true;
-    object_property_add_bool(obj, "allow_all_mask_sizes",
-                             sclp_event_get_allow_all_mask_sizes,
-                             sclp_event_set_allow_all_mask_sizes);
 
     /* Spawn a new bus for SCLP events */
     qbus_init(&event_facility->sbus, sizeof(event_facility->sbus),

From edce9fe075fac9f8189829a040e760f8c301a012 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Tue, 6 May 2025 08:21:43 +0200
Subject: [PATCH 0832/2760] target/s390x: Rename the qemu_V2_11 feature set to
 qemu_MIN
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Now that the v2.11 machine type has been removed, it does not make
sense to keep the qemu_V2_11 feature set around. This is rather
the (minimum) feature set of the oldest supported machine now, so
rename it to qemu_MIN.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250506062148.306084-5-thuth@redhat.com>
Reviewed-by: Eric Farman <farman@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 target/s390x/gen-features.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/target/s390x/gen-features.c b/target/s390x/gen-features.c
index 41840677ce..754fc843d2 100644
--- a/target/s390x/gen-features.c
+++ b/target/s390x/gen-features.c
@@ -844,7 +844,8 @@ static uint16_t default_GEN17_GA1[] = {
 
 /* QEMU (CPU model) features */
 
-static uint16_t qemu_V2_11[] = {
+static uint16_t qemu_MIN[] = {
+    /* Features supported by the default CPU of the oldest machine type */
     S390_FEAT_GROUP_PLO,
     S390_FEAT_ESAN3,
     S390_FEAT_ZARCH,
@@ -1053,7 +1054,7 @@ static FeatGroupDefSpec FeatGroupDef[] = {
  * QEMU (CPU model) features
  *******************************/
 static FeatGroupDefSpec QemuFeatDef[] = {
-    QEMU_FEAT_INITIALIZER(V2_11),
+    QEMU_FEAT_INITIALIZER(MIN),
     QEMU_FEAT_INITIALIZER(V3_1),
     QEMU_FEAT_INITIALIZER(V4_0),
     QEMU_FEAT_INITIALIZER(V4_1),

From fa3452c3914505e7352379179c10a22cc9017f84 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Tue, 6 May 2025 08:21:44 +0200
Subject: [PATCH 0833/2760] hw/s390x/s390-virtio-ccw: Remove the deprecated
 2.12 machine type
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The s390-ccw-virtio-2.12 machine is older than 6 years, so according to
our machine support policy, it can be removed now.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250506062148.306084-6-thuth@redhat.com>
Reviewed-by: Eric Farman <farman@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 hw/s390x/s390-virtio-ccw.c | 14 --------------
 1 file changed, 14 deletions(-)

diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
index 104a24ee00..db3d26b2e4 100644
--- a/hw/s390x/s390-virtio-ccw.c
+++ b/hw/s390x/s390-virtio-ccw.c
@@ -1238,20 +1238,6 @@ static void ccw_machine_3_0_class_options(MachineClass *mc)
 }
 DEFINE_CCW_MACHINE(3, 0);
 
-static void ccw_machine_2_12_instance_options(MachineState *machine)
-{
-    ccw_machine_3_0_instance_options(machine);
-    s390_cpudef_featoff_greater(11, 1, S390_FEAT_PPA15);
-    s390_cpudef_featoff_greater(11, 1, S390_FEAT_BPB);
-}
-
-static void ccw_machine_2_12_class_options(MachineClass *mc)
-{
-    ccw_machine_3_0_class_options(mc);
-    compat_props_add(mc->compat_props, hw_compat_2_12, hw_compat_2_12_len);
-}
-DEFINE_CCW_MACHINE(2, 12);
-
 static void ccw_machine_register_types(void)
 {
     type_register_static(&ccw_machine_info);

From 240e7c36e75767ef102bd2c532947800aa0030d6 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Tue, 6 May 2025 08:21:45 +0200
Subject: [PATCH 0834/2760] hw/s390x/s390-virtio-ccw: Remove the deprecated 3.0
 machine type
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The s390-ccw-virtio-3.0 machine is older than 6 years, so according to
our machine support policy, it can be removed now.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250506062148.306084-7-thuth@redhat.com>
Reviewed-by: Eric Farman <farman@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 hw/s390x/s390-virtio-ccw.c | 15 ---------------
 1 file changed, 15 deletions(-)

diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
index db3d26b2e4..bec4690e85 100644
--- a/hw/s390x/s390-virtio-ccw.c
+++ b/hw/s390x/s390-virtio-ccw.c
@@ -1223,21 +1223,6 @@ static void ccw_machine_3_1_class_options(MachineClass *mc)
 }
 DEFINE_CCW_MACHINE(3, 1);
 
-static void ccw_machine_3_0_instance_options(MachineState *machine)
-{
-    ccw_machine_3_1_instance_options(machine);
-}
-
-static void ccw_machine_3_0_class_options(MachineClass *mc)
-{
-    S390CcwMachineClass *s390mc = S390_CCW_MACHINE_CLASS(mc);
-
-    s390mc->hpage_1m_allowed = false;
-    ccw_machine_3_1_class_options(mc);
-    compat_props_add(mc->compat_props, hw_compat_3_0, hw_compat_3_0_len);
-}
-DEFINE_CCW_MACHINE(3, 0);
-
 static void ccw_machine_register_types(void)
 {
     type_register_static(&ccw_machine_info);

From bbe6f504ef181f3745762818249bbf7ca44bf363 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Tue, 6 May 2025 08:21:46 +0200
Subject: [PATCH 0835/2760] hw/s390x: Remove the obsolete hpage_1m_allowed
 switch
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The s390-ccw-virtio-3.0 machine was the last one that used the
hpage_1m_allowed switch. Since we removed this machine type, we
can now remove the switch and the related code, too. This allows
us to get rid of the get_machine_class() hack and the big fat
warning comment there.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250506062148.306084-8-thuth@redhat.com>
Reviewed-by: Eric Farman <farman@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 hw/s390x/s390-virtio-ccw.c         | 35 ------------------------------
 include/hw/s390x/s390-virtio-ccw.h |  4 ----
 target/s390x/kvm/kvm.c             |  6 -----
 3 files changed, 45 deletions(-)

diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
index bec4690e85..b013bcd076 100644
--- a/hw/s390x/s390-virtio-ccw.c
+++ b/hw/s390x/s390-virtio-ccw.c
@@ -748,39 +748,6 @@ static inline void machine_set_dea_key_wrap(Object *obj, bool value,
     ms->dea_key_wrap = value;
 }
 
-static S390CcwMachineClass *current_mc;
-
-/*
- * Get the class of the s390-ccw-virtio machine that is currently in use.
- * Note: libvirt is using the "none" machine to probe for the features of the
- * host CPU, so in case this is called with the "none" machine, the function
- * returns the TYPE_S390_CCW_MACHINE base class. In this base class, all the
- * various "*_allowed" variables are enabled, so that the *_allowed() wrappers
- * below return the correct default value for the "none" machine.
- *
- * Attention! Do *not* add additional new wrappers for CPU features via this
- * mechanism anymore. CPU features should be handled via the CPU models,
- * i.e. checking with s390_has_feat() should be sufficient.
- */
-static S390CcwMachineClass *get_machine_class(void)
-{
-    if (unlikely(!current_mc)) {
-        /*
-        * No s390 ccw machine was instantiated, we are likely to
-        * be called for the 'none' machine. The properties will
-        * have their after-initialization values.
-        */
-        current_mc = S390_CCW_MACHINE_CLASS(
-                     object_class_by_name(TYPE_S390_CCW_MACHINE));
-    }
-    return current_mc;
-}
-
-bool hpage_1m_allowed(void)
-{
-    return get_machine_class()->hpage_1m_allowed;
-}
-
 static void machine_get_loadparm(Object *obj, Visitor *v,
                                  const char *name, void *opaque,
                                  Error **errp)
@@ -814,7 +781,6 @@ static void ccw_machine_class_init(ObjectClass *oc, const void *data)
     S390CcwMachineClass *s390mc = S390_CCW_MACHINE_CLASS(mc);
     DumpSKeysInterface *dsi = DUMP_SKEYS_INTERFACE_CLASS(oc);
 
-    s390mc->hpage_1m_allowed = true;
     s390mc->max_threads = 1;
     mc->reset = s390_machine_reset;
     mc->block_default_type = IF_VIRTIO;
@@ -888,7 +854,6 @@ static const TypeInfo ccw_machine_info = {
 #define DEFINE_CCW_MACHINE_IMPL(latest, ...)                                  \
     static void MACHINE_VER_SYM(mach_init, ccw, __VA_ARGS__)(MachineState *mach) \
     {                                                                         \
-        current_mc = S390_CCW_MACHINE_CLASS(MACHINE_GET_CLASS(mach));         \
         MACHINE_VER_SYM(instance_options, ccw, __VA_ARGS__)(mach);            \
         ccw_init(mach);                                                       \
     }                                                                         \
diff --git a/include/hw/s390x/s390-virtio-ccw.h b/include/hw/s390x/s390-virtio-ccw.h
index 686d9497d2..321b26df30 100644
--- a/include/hw/s390x/s390-virtio-ccw.h
+++ b/include/hw/s390x/s390-virtio-ccw.h
@@ -53,11 +53,7 @@ struct S390CcwMachineClass {
     MachineClass parent_class;
 
     /*< public >*/
-    bool hpage_1m_allowed;
     int max_threads;
 };
 
-/* 1M huge page mappings allowed by the machine */
-bool hpage_1m_allowed(void);
-
 #endif
diff --git a/target/s390x/kvm/kvm.c b/target/s390x/kvm/kvm.c
index b9f1422197..6cd2ebc5f1 100644
--- a/target/s390x/kvm/kvm.c
+++ b/target/s390x/kvm/kvm.c
@@ -298,12 +298,6 @@ void kvm_s390_set_max_pagesize(uint64_t pagesize, Error **errp)
         return;
     }
 
-    if (!hpage_1m_allowed()) {
-        error_setg(errp, "This QEMU machine does not support huge page "
-                   "mappings");
-        return;
-    }
-
     if (pagesize != 1 * MiB) {
         error_setg(errp, "Memory backing with 2G pages was specified, "
                    "but KVM does not support this memory backing");

From 3b912daea079445aad40d8e189c40597b229cf10 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Tue, 6 May 2025 08:21:47 +0200
Subject: [PATCH 0836/2760] hw/s390x/s390-virtio-ccw: Remove the deprecated 3.1
 machine type
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The s390-ccw-virtio-3.1 machine is older than 6 years, so according to
our machine support policy, it can be removed now. The v3.1 CPU feature
group gets merged into the minimum CPU feature group now.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250506062148.306084-9-thuth@redhat.com>
Reviewed-by: Eric Farman <farman@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 hw/s390x/s390-virtio-ccw.c  | 16 ----------------
 target/s390x/gen-features.c |  4 ----
 2 files changed, 20 deletions(-)

diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
index b013bcd076..95c12a4177 100644
--- a/hw/s390x/s390-virtio-ccw.c
+++ b/hw/s390x/s390-virtio-ccw.c
@@ -1172,22 +1172,6 @@ static void ccw_machine_4_0_class_options(MachineClass *mc)
 }
 DEFINE_CCW_MACHINE(4, 0);
 
-static void ccw_machine_3_1_instance_options(MachineState *machine)
-{
-    static const S390FeatInit qemu_cpu_feat = { S390_FEAT_LIST_QEMU_V3_1 };
-    ccw_machine_4_0_instance_options(machine);
-    s390_cpudef_featoff_greater(14, 1, S390_FEAT_MULTIPLE_EPOCH);
-    s390_cpudef_group_featoff_greater(14, 1, S390_FEAT_GROUP_MULTIPLE_EPOCH_PTFF);
-    s390_set_qemu_cpu_model(0x2827, 12, 2, qemu_cpu_feat);
-}
-
-static void ccw_machine_3_1_class_options(MachineClass *mc)
-{
-    ccw_machine_4_0_class_options(mc);
-    compat_props_add(mc->compat_props, hw_compat_3_1, hw_compat_3_1_len);
-}
-DEFINE_CCW_MACHINE(3, 1);
-
 static void ccw_machine_register_types(void)
 {
     type_register_static(&ccw_machine_info);
diff --git a/target/s390x/gen-features.c b/target/s390x/gen-features.c
index 754fc843d2..4346b92431 100644
--- a/target/s390x/gen-features.c
+++ b/target/s390x/gen-features.c
@@ -849,9 +849,6 @@ static uint16_t qemu_MIN[] = {
     S390_FEAT_GROUP_PLO,
     S390_FEAT_ESAN3,
     S390_FEAT_ZARCH,
-};
-
-static uint16_t qemu_V3_1[] = {
     S390_FEAT_DAT_ENH,
     S390_FEAT_IDTE_SEGMENT,
     S390_FEAT_STFLE,
@@ -1055,7 +1052,6 @@ static FeatGroupDefSpec FeatGroupDef[] = {
  *******************************/
 static FeatGroupDefSpec QemuFeatDef[] = {
     QEMU_FEAT_INITIALIZER(MIN),
-    QEMU_FEAT_INITIALIZER(V3_1),
     QEMU_FEAT_INITIALIZER(V4_0),
     QEMU_FEAT_INITIALIZER(V4_1),
     QEMU_FEAT_INITIALIZER(V6_0),

From 1b432c51cd12e778079ee0cfd7e4c51aad928c65 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Tue, 6 May 2025 08:21:48 +0200
Subject: [PATCH 0837/2760] hw/s390x/s390-virtio-ccw: Remove the deprecated 4.0
 machine type
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The s390-ccw-virtio-4.0 machine is older than 6 years, so according to
our machine support policy, it can be removed now. The corresponding
v4.0 CPU feature group gets merged into the minimum feature group now.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250506062148.306084-10-thuth@redhat.com>
Reviewed-by: Eric Farman <farman@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 hw/s390x/s390-virtio-ccw.c  | 14 --------------
 target/s390x/gen-features.c |  4 ----
 2 files changed, 18 deletions(-)

diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
index 95c12a4177..431d6b782a 100644
--- a/hw/s390x/s390-virtio-ccw.c
+++ b/hw/s390x/s390-virtio-ccw.c
@@ -1158,20 +1158,6 @@ static void ccw_machine_4_1_class_options(MachineClass *mc)
 }
 DEFINE_CCW_MACHINE(4, 1);
 
-static void ccw_machine_4_0_instance_options(MachineState *machine)
-{
-    static const S390FeatInit qemu_cpu_feat = { S390_FEAT_LIST_QEMU_V4_0 };
-    ccw_machine_4_1_instance_options(machine);
-    s390_set_qemu_cpu_model(0x2827, 12, 2, qemu_cpu_feat);
-}
-
-static void ccw_machine_4_0_class_options(MachineClass *mc)
-{
-    ccw_machine_4_1_class_options(mc);
-    compat_props_add(mc->compat_props, hw_compat_4_0, hw_compat_4_0_len);
-}
-DEFINE_CCW_MACHINE(4, 0);
-
 static void ccw_machine_register_types(void)
 {
     type_register_static(&ccw_machine_info);
diff --git a/target/s390x/gen-features.c b/target/s390x/gen-features.c
index 4346b92431..a814ece82f 100644
--- a/target/s390x/gen-features.c
+++ b/target/s390x/gen-features.c
@@ -878,9 +878,6 @@ static uint16_t qemu_MIN[] = {
     S390_FEAT_ADAPTER_INT_SUPPRESSION,
     S390_FEAT_MSA_EXT_3,
     S390_FEAT_MSA_EXT_4,
-};
-
-static uint16_t qemu_V4_0[] = {
     /*
      * Only BFP bits are implemented (HFP, DFP, PFPO and DIVIDE TO INTEGER not
      * implemented yet).
@@ -1052,7 +1049,6 @@ static FeatGroupDefSpec FeatGroupDef[] = {
  *******************************/
 static FeatGroupDefSpec QemuFeatDef[] = {
     QEMU_FEAT_INITIALIZER(MIN),
-    QEMU_FEAT_INITIALIZER(V4_0),
     QEMU_FEAT_INITIALIZER(V4_1),
     QEMU_FEAT_INITIALIZER(V6_0),
     QEMU_FEAT_INITIALIZER(V6_2),

From bdf12f2a56bf3f13c52eb51f0a994bbfe40706b2 Mon Sep 17 00:00:00 2001
From: Fabiano Rosas <farosas@suse.de>
Date: Fri, 9 May 2025 14:49:38 -0300
Subject: [PATCH 0838/2760] s390x: Fix leak in machine_set_loadparm
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

ASAN spotted a leaking string in machine_set_loadparm():

Direct leak of 9 byte(s) in 1 object(s) allocated from:
    #0 0x560ffb5bb379 in malloc ../projects/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3
    #1 0x7f1aca926518 in g_malloc ../glib/gmem.c:106
    #2 0x7f1aca94113e in g_strdup ../glib/gstrfuncs.c:364
    #3 0x560ffc8afbf9 in qobject_input_type_str ../qapi/qobject-input-visitor.c:542:12
    #4 0x560ffc8a80ff in visit_type_str ../qapi/qapi-visit-core.c:349:10
    #5 0x560ffbe6053a in machine_set_loadparm ../hw/s390x/s390-virtio-ccw.c:802:10
    #6 0x560ffc0c5e52 in object_property_set ../qom/object.c:1450:5
    #7 0x560ffc0d4175 in object_property_set_qobject ../qom/qom-qobject.c:28:10
    #8 0x560ffc0c6004 in object_property_set_str ../qom/object.c:1458:15
    #9 0x560ffbe2ae60 in update_machine_ipl_properties ../hw/s390x/ipl.c:569:9
    #10 0x560ffbe2aa65 in s390_ipl_update_diag308 ../hw/s390x/ipl.c:594:5
    #11 0x560ffbdee132 in handle_diag_308 ../target/s390x/diag.c:147:9
    #12 0x560ffbebb956 in helper_diag ../target/s390x/tcg/misc_helper.c:137:9
    #13 0x7f1a3c51c730  (/memfd:tcg-jit (deleted)+0x39730)

Cc: qemu-stable@nongnu.org
Signed-off-by: Fabiano Rosas <farosas@suse.de>
Message-ID: <20250509174938.25935-1-farosas@suse.de>
Fixes: 1fd396e3228 ("s390x: Register TYPE_S390_CCW_MACHINE properties as class properties")
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 hw/s390x/s390-virtio-ccw.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
index 431d6b782a..f69a4d8ed3 100644
--- a/hw/s390x/s390-virtio-ccw.c
+++ b/hw/s390x/s390-virtio-ccw.c
@@ -771,6 +771,7 @@ static void machine_set_loadparm(Object *obj, Visitor *v,
     }
 
     s390_ipl_fmt_loadparm(ms->loadparm, val, errp);
+    g_free(val);
 }
 
 static void ccw_machine_class_init(ObjectClass *oc, const void *data)

From ab9bbee3c7da3d5dcce03bd7379bc7d05243a9af Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Wed, 7 May 2025 10:31:33 +0800
Subject: [PATCH 0839/2760] hw/intc/loongarch_pch: Modify name of some
 registers

For some registers with width 8 bytes, its name is something like
PCH_PIC_INT_ID_LO and PCH_PIC_INT_ID_HI. From hardware manual,
register name is PCH_PIC_INT_ID instead. Here name PCH_PIC_INT_ID
is used, and PCH_PIC_INT_ID + 4 is used for PCH_PIC_INT_ID_HI.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Clement Mathieu--Drif <clement.mathieu--drif@eviden.com>
Reviewed-by: Song Gao <gaosong@loongson.cn>
Message-Id: <20250507023148.1877287-2-maobibo@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 hw/intc/loongarch_pch_pic.c            | 50 +++++++++++++-------------
 hw/loongarch/virt.c                    |  2 +-
 include/hw/intc/loongarch_pic_common.h | 27 +++++---------
 3 files changed, 36 insertions(+), 43 deletions(-)

diff --git a/hw/intc/loongarch_pch_pic.c b/hw/intc/loongarch_pch_pic.c
index 834096265a..748213d5a1 100644
--- a/hw/intc/loongarch_pch_pic.c
+++ b/hw/intc/loongarch_pch_pic.c
@@ -79,10 +79,10 @@ static uint64_t loongarch_pch_pic_low_readw(void *opaque, hwaddr addr,
     uint32_t offset = addr & 0xfff;
 
     switch (offset) {
-    case PCH_PIC_INT_ID_LO:
+    case PCH_PIC_INT_ID:
         val = PCH_PIC_INT_ID_VAL;
         break;
-    case PCH_PIC_INT_ID_HI:
+    case PCH_PIC_INT_ID + 4:
         /*
          * With 7A1000 manual
          *   bit  0-15 pch irqchip version
@@ -90,28 +90,29 @@ static uint64_t loongarch_pch_pic_low_readw(void *opaque, hwaddr addr,
          */
         val = deposit32(PCH_PIC_INT_ID_VER, 16, 16, s->irq_num - 1);
         break;
-    case PCH_PIC_INT_MASK_LO:
+    case PCH_PIC_INT_MASK:
         val = (uint32_t)s->int_mask;
         break;
-    case PCH_PIC_INT_MASK_HI:
+    case PCH_PIC_INT_MASK + 4:
         val = s->int_mask >> 32;
         break;
-    case PCH_PIC_INT_EDGE_LO:
+    case PCH_PIC_INT_EDGE:
         val = (uint32_t)s->intedge;
         break;
-    case PCH_PIC_INT_EDGE_HI:
+    case PCH_PIC_INT_EDGE + 4:
         val = s->intedge >> 32;
         break;
-    case PCH_PIC_HTMSI_EN_LO:
+    case PCH_PIC_HTMSI_EN:
         val = (uint32_t)s->htmsi_en;
         break;
-    case PCH_PIC_HTMSI_EN_HI:
+    case PCH_PIC_HTMSI_EN + 4:
         val = s->htmsi_en >> 32;
         break;
-    case PCH_PIC_AUTO_CTRL0_LO:
-    case PCH_PIC_AUTO_CTRL0_HI:
-    case PCH_PIC_AUTO_CTRL1_LO:
-    case PCH_PIC_AUTO_CTRL1_HI:
+    case PCH_PIC_AUTO_CTRL0:
+    case PCH_PIC_AUTO_CTRL0 + 4:
+    case PCH_PIC_AUTO_CTRL1:
+    case PCH_PIC_AUTO_CTRL1 + 4:
+        /* PCH PIC connect to EXTIOI always, discard auto_ctrl access */
         break;
     default:
         break;
@@ -140,7 +141,7 @@ static void loongarch_pch_pic_low_writew(void *opaque, hwaddr addr,
     trace_loongarch_pch_pic_low_writew(size, addr, data);
 
     switch (offset) {
-    case PCH_PIC_INT_MASK_LO:
+    case PCH_PIC_INT_MASK:
         old = s->int_mask;
         s->int_mask = get_writew_val(old, data, 0);
         old_valid = (uint32_t)old;
@@ -151,7 +152,7 @@ static void loongarch_pch_pic_low_writew(void *opaque, hwaddr addr,
             pch_pic_update_irq(s, (~old_valid & data), 0);
         }
         break;
-    case PCH_PIC_INT_MASK_HI:
+    case PCH_PIC_INT_MASK + 4:
         old = s->int_mask;
         s->int_mask = get_writew_val(old, data, 1);
         old_valid = (uint32_t)(old >> 32);
@@ -164,20 +165,20 @@ static void loongarch_pch_pic_low_writew(void *opaque, hwaddr addr,
             pch_pic_update_irq(s, int_mask << 32, 0);
         }
         break;
-    case PCH_PIC_INT_EDGE_LO:
+    case PCH_PIC_INT_EDGE:
         s->intedge = get_writew_val(s->intedge, data, 0);
         break;
-    case PCH_PIC_INT_EDGE_HI:
+    case PCH_PIC_INT_EDGE + 4:
         s->intedge = get_writew_val(s->intedge, data, 1);
         break;
-    case PCH_PIC_INT_CLEAR_LO:
+    case PCH_PIC_INT_CLEAR:
         if (s->intedge & data) {
             s->intirr &= (~data);
             pch_pic_update_irq(s, data, 0);
             s->intisr &= (~data);
         }
         break;
-    case PCH_PIC_INT_CLEAR_HI:
+    case PCH_PIC_INT_CLEAR + 4:
         value <<= 32;
         if (s->intedge & value) {
             s->intirr &= (~value);
@@ -185,16 +186,17 @@ static void loongarch_pch_pic_low_writew(void *opaque, hwaddr addr,
             s->intisr &= (~value);
         }
         break;
-    case PCH_PIC_HTMSI_EN_LO:
+    case PCH_PIC_HTMSI_EN:
         s->htmsi_en = get_writew_val(s->htmsi_en, data, 0);
         break;
-    case PCH_PIC_HTMSI_EN_HI:
+    case PCH_PIC_HTMSI_EN + 4:
         s->htmsi_en = get_writew_val(s->htmsi_en, data, 1);
         break;
-    case PCH_PIC_AUTO_CTRL0_LO:
-    case PCH_PIC_AUTO_CTRL0_HI:
-    case PCH_PIC_AUTO_CTRL1_LO:
-    case PCH_PIC_AUTO_CTRL1_HI:
+    case PCH_PIC_AUTO_CTRL0:
+    case PCH_PIC_AUTO_CTRL0 + 4:
+    case PCH_PIC_AUTO_CTRL1:
+    case PCH_PIC_AUTO_CTRL1 + 4:
+        /* discard auto_ctrl access */
         break;
     default:
         break;
diff --git a/hw/loongarch/virt.c b/hw/loongarch/virt.c
index 7ad7fb68ff..8a4958aade 100644
--- a/hw/loongarch/virt.c
+++ b/hw/loongarch/virt.c
@@ -433,7 +433,7 @@ static void virt_irq_init(LoongArchVirtMachineState *lvms)
                             VIRT_IOAPIC_REG_BASE + PCH_PIC_ROUTE_ENTRY_OFFSET,
                             sysbus_mmio_get_region(d, 1));
     memory_region_add_subregion(get_system_memory(),
-                            VIRT_IOAPIC_REG_BASE + PCH_PIC_INT_STATUS_LO,
+                            VIRT_IOAPIC_REG_BASE + PCH_PIC_INT_STATUS,
                             sysbus_mmio_get_region(d, 2));
 
     /* Connect pch_pic irqs to extioi */
diff --git a/include/hw/intc/loongarch_pic_common.h b/include/hw/intc/loongarch_pic_common.h
index d301377cd7..8826d15aa7 100644
--- a/include/hw/intc/loongarch_pic_common.h
+++ b/include/hw/intc/loongarch_pic_common.h
@@ -12,28 +12,19 @@
 
 #define PCH_PIC_INT_ID_VAL              0x7000000UL
 #define PCH_PIC_INT_ID_VER              0x1UL
-#define PCH_PIC_INT_ID_LO               0x00
-#define PCH_PIC_INT_ID_HI               0x04
-#define PCH_PIC_INT_MASK_LO             0x20
-#define PCH_PIC_INT_MASK_HI             0x24
-#define PCH_PIC_HTMSI_EN_LO             0x40
-#define PCH_PIC_HTMSI_EN_HI             0x44
-#define PCH_PIC_INT_EDGE_LO             0x60
-#define PCH_PIC_INT_EDGE_HI             0x64
-#define PCH_PIC_INT_CLEAR_LO            0x80
-#define PCH_PIC_INT_CLEAR_HI            0x84
-#define PCH_PIC_AUTO_CTRL0_LO           0xc0
-#define PCH_PIC_AUTO_CTRL0_HI           0xc4
-#define PCH_PIC_AUTO_CTRL1_LO           0xe0
-#define PCH_PIC_AUTO_CTRL1_HI           0xe4
+#define PCH_PIC_INT_ID                  0x00
+#define PCH_PIC_INT_MASK                0x20
+#define PCH_PIC_HTMSI_EN                0x40
+#define PCH_PIC_INT_EDGE                0x60
+#define PCH_PIC_INT_CLEAR               0x80
+#define PCH_PIC_AUTO_CTRL0              0xc0
+#define PCH_PIC_AUTO_CTRL1              0xe0
 #define PCH_PIC_ROUTE_ENTRY_OFFSET      0x100
 #define PCH_PIC_ROUTE_ENTRY_END         0x13f
 #define PCH_PIC_HTMSI_VEC_OFFSET        0x200
 #define PCH_PIC_HTMSI_VEC_END           0x23f
-#define PCH_PIC_INT_STATUS_LO           0x3a0
-#define PCH_PIC_INT_STATUS_HI           0x3a4
-#define PCH_PIC_INT_POL_LO              0x3e0
-#define PCH_PIC_INT_POL_HI              0x3e4
+#define PCH_PIC_INT_STATUS              0x3a0
+#define PCH_PIC_INT_POL                 0x3e0
 
 #define STATUS_LO_START                 0
 #define STATUS_HI_START                 0x4

From 4f0f2ab5640efe7f27b193f2bf66656890d6143f Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Wed, 7 May 2025 10:31:34 +0800
Subject: [PATCH 0840/2760] hw/intc/loongarch_pch: Modify register name
 PCH_PIC_xxx_OFFSET with PCH_PIC_xxx

Macro PCH_PIC_HTMSI_VEC_OFFSET and PCH_PIC_ROUTE_ENTRY_OFFSET is renamed
as PCH_PIC_HTMSI_VEC and PCH_PIC_ROUTE_ENTRY separately, it is easier to
understand.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Clement Mathieu--Drif <clement.mathieu--drif@eviden.com>
Reviewed-by: Song Gao <gaosong@loongson.cn>
Message-Id: <20250507023148.1877287-3-maobibo@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 hw/intc/loongarch_pch_pic.c            | 20 ++++++++++----------
 hw/loongarch/virt.c                    |  2 +-
 include/hw/intc/loongarch_pic_common.h |  4 ++--
 3 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/hw/intc/loongarch_pch_pic.c b/hw/intc/loongarch_pch_pic.c
index 748213d5a1..52ae360fdc 100644
--- a/hw/intc/loongarch_pch_pic.c
+++ b/hw/intc/loongarch_pch_pic.c
@@ -263,18 +263,18 @@ static uint64_t loongarch_pch_pic_readb(void *opaque, hwaddr addr,
 {
     LoongArchPICCommonState *s = LOONGARCH_PIC_COMMON(opaque);
     uint64_t val = 0;
-    uint32_t offset = (addr & 0xfff) + PCH_PIC_ROUTE_ENTRY_OFFSET;
+    uint32_t offset = (addr & 0xfff) + PCH_PIC_ROUTE_ENTRY;
     int64_t offset_tmp;
 
     switch (offset) {
-    case PCH_PIC_HTMSI_VEC_OFFSET ... PCH_PIC_HTMSI_VEC_END:
-        offset_tmp = offset - PCH_PIC_HTMSI_VEC_OFFSET;
+    case PCH_PIC_HTMSI_VEC ... PCH_PIC_HTMSI_VEC_END:
+        offset_tmp = offset - PCH_PIC_HTMSI_VEC;
         if (offset_tmp >= 0 && offset_tmp < 64) {
             val = s->htmsi_vector[offset_tmp];
         }
         break;
-    case PCH_PIC_ROUTE_ENTRY_OFFSET ... PCH_PIC_ROUTE_ENTRY_END:
-        offset_tmp = offset - PCH_PIC_ROUTE_ENTRY_OFFSET;
+    case PCH_PIC_ROUTE_ENTRY ... PCH_PIC_ROUTE_ENTRY_END:
+        offset_tmp = offset - PCH_PIC_ROUTE_ENTRY;
         if (offset_tmp >= 0 && offset_tmp < 64) {
             val = s->route_entry[offset_tmp];
         }
@@ -292,19 +292,19 @@ static void loongarch_pch_pic_writeb(void *opaque, hwaddr addr,
 {
     LoongArchPICCommonState *s = LOONGARCH_PIC_COMMON(opaque);
     int32_t offset_tmp;
-    uint32_t offset = (addr & 0xfff) + PCH_PIC_ROUTE_ENTRY_OFFSET;
+    uint32_t offset = (addr & 0xfff) + PCH_PIC_ROUTE_ENTRY;
 
     trace_loongarch_pch_pic_writeb(size, addr, data);
 
     switch (offset) {
-    case PCH_PIC_HTMSI_VEC_OFFSET ... PCH_PIC_HTMSI_VEC_END:
-        offset_tmp = offset - PCH_PIC_HTMSI_VEC_OFFSET;
+    case PCH_PIC_HTMSI_VEC ... PCH_PIC_HTMSI_VEC_END:
+        offset_tmp = offset - PCH_PIC_HTMSI_VEC;
         if (offset_tmp >= 0 && offset_tmp < 64) {
             s->htmsi_vector[offset_tmp] = (uint8_t)(data & 0xff);
         }
         break;
-    case PCH_PIC_ROUTE_ENTRY_OFFSET ... PCH_PIC_ROUTE_ENTRY_END:
-        offset_tmp = offset - PCH_PIC_ROUTE_ENTRY_OFFSET;
+    case PCH_PIC_ROUTE_ENTRY ... PCH_PIC_ROUTE_ENTRY_END:
+        offset_tmp = offset - PCH_PIC_ROUTE_ENTRY;
         if (offset_tmp >= 0 && offset_tmp < 64) {
             s->route_entry[offset_tmp] = (uint8_t)(data & 0xff);
         }
diff --git a/hw/loongarch/virt.c b/hw/loongarch/virt.c
index 8a4958aade..ebcef0a92b 100644
--- a/hw/loongarch/virt.c
+++ b/hw/loongarch/virt.c
@@ -430,7 +430,7 @@ static void virt_irq_init(LoongArchVirtMachineState *lvms)
     memory_region_add_subregion(get_system_memory(), VIRT_IOAPIC_REG_BASE,
                             sysbus_mmio_get_region(d, 0));
     memory_region_add_subregion(get_system_memory(),
-                            VIRT_IOAPIC_REG_BASE + PCH_PIC_ROUTE_ENTRY_OFFSET,
+                            VIRT_IOAPIC_REG_BASE + PCH_PIC_ROUTE_ENTRY,
                             sysbus_mmio_get_region(d, 1));
     memory_region_add_subregion(get_system_memory(),
                             VIRT_IOAPIC_REG_BASE + PCH_PIC_INT_STATUS,
diff --git a/include/hw/intc/loongarch_pic_common.h b/include/hw/intc/loongarch_pic_common.h
index 8826d15aa7..caf712eae0 100644
--- a/include/hw/intc/loongarch_pic_common.h
+++ b/include/hw/intc/loongarch_pic_common.h
@@ -19,9 +19,9 @@
 #define PCH_PIC_INT_CLEAR               0x80
 #define PCH_PIC_AUTO_CTRL0              0xc0
 #define PCH_PIC_AUTO_CTRL1              0xe0
-#define PCH_PIC_ROUTE_ENTRY_OFFSET      0x100
+#define PCH_PIC_ROUTE_ENTRY             0x100
 #define PCH_PIC_ROUTE_ENTRY_END         0x13f
-#define PCH_PIC_HTMSI_VEC_OFFSET        0x200
+#define PCH_PIC_HTMSI_VEC               0x200
 #define PCH_PIC_HTMSI_VEC_END           0x23f
 #define PCH_PIC_INT_STATUS              0x3a0
 #define PCH_PIC_INT_POL                 0x3e0

From e95e4e818b7821a66c4346761c6f63b93177685a Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Wed, 7 May 2025 10:31:35 +0800
Subject: [PATCH 0841/2760] hw/intc/loongarch_pch: Remove some duplicate macro

The meaning of macro definition STATUS_LO_START is simliar with
PCH_PIC_INT_STATUS, only that offset is different, the same for
macro POL_LO_START. Now remove these duplicated macro definitions.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
Message-Id: <20250507023148.1877287-4-maobibo@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 hw/intc/loongarch_pch_pic.c            | 20 ++++++++++----------
 include/hw/intc/loongarch_pic_common.h |  5 -----
 2 files changed, 10 insertions(+), 15 deletions(-)

diff --git a/hw/intc/loongarch_pch_pic.c b/hw/intc/loongarch_pch_pic.c
index 52ae360fdc..17ab071a6b 100644
--- a/hw/intc/loongarch_pch_pic.c
+++ b/hw/intc/loongarch_pch_pic.c
@@ -208,19 +208,19 @@ static uint64_t loongarch_pch_pic_high_readw(void *opaque, hwaddr addr,
 {
     LoongArchPICCommonState *s = LOONGARCH_PIC_COMMON(opaque);
     uint64_t val = 0;
-    uint32_t offset = addr & 0xfff;
+    uint32_t offset = addr + PCH_PIC_INT_STATUS;
 
     switch (offset) {
-    case STATUS_LO_START:
+    case PCH_PIC_INT_STATUS:
         val = (uint32_t)(s->intisr & (~s->int_mask));
         break;
-    case STATUS_HI_START:
+    case PCH_PIC_INT_STATUS + 4:
         val = (s->intisr & (~s->int_mask)) >> 32;
         break;
-    case POL_LO_START:
+    case PCH_PIC_INT_POL:
         val = (uint32_t)s->int_polarity;
         break;
-    case POL_HI_START:
+    case PCH_PIC_INT_POL + 4:
         val = s->int_polarity >> 32;
         break;
     default:
@@ -236,21 +236,21 @@ static void loongarch_pch_pic_high_writew(void *opaque, hwaddr addr,
 {
     LoongArchPICCommonState *s = LOONGARCH_PIC_COMMON(opaque);
     uint32_t offset, data = (uint32_t)value;
-    offset = addr & 0xfff;
+    offset = addr + PCH_PIC_INT_STATUS;
 
     trace_loongarch_pch_pic_high_writew(size, addr, data);
 
     switch (offset) {
-    case STATUS_LO_START:
+    case PCH_PIC_INT_STATUS:
         s->intisr = get_writew_val(s->intisr, data, 0);
         break;
-    case STATUS_HI_START:
+    case PCH_PIC_INT_STATUS + 4:
         s->intisr = get_writew_val(s->intisr, data, 1);
         break;
-    case POL_LO_START:
+    case PCH_PIC_INT_POL:
         s->int_polarity = get_writew_val(s->int_polarity, data, 0);
         break;
-    case POL_HI_START:
+    case PCH_PIC_INT_POL + 4:
         s->int_polarity = get_writew_val(s->int_polarity, data, 1);
         break;
     default:
diff --git a/include/hw/intc/loongarch_pic_common.h b/include/hw/intc/loongarch_pic_common.h
index caf712eae0..2b4b483c63 100644
--- a/include/hw/intc/loongarch_pic_common.h
+++ b/include/hw/intc/loongarch_pic_common.h
@@ -26,11 +26,6 @@
 #define PCH_PIC_INT_STATUS              0x3a0
 #define PCH_PIC_INT_POL                 0x3e0
 
-#define STATUS_LO_START                 0
-#define STATUS_HI_START                 0x4
-#define POL_LO_START                    0x40
-#define POL_HI_START                    0x44
-
 #define TYPE_LOONGARCH_PIC_COMMON "loongarch_pic_common"
 OBJECT_DECLARE_TYPE(LoongArchPICCommonState,
                     LoongArchPICCommonClass, LOONGARCH_PIC_COMMON)

From c2658b0de5cb24b6eb49751c92380d30f1d9258f Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Wed, 7 May 2025 10:31:36 +0800
Subject: [PATCH 0842/2760] hw/intc/loongarch_pch: Set version information at
 initial stage

Register PCH_PIC_INT_ID constains version and supported irq number
information, and it is read only register. The detailed value can
be set at initial stage, rather than read callback.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
Message-Id: <20250507023148.1877287-5-maobibo@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 hw/intc/loongarch_pch_pic.c            |  9 ++-------
 hw/intc/loongarch_pic_common.c         | 13 +++++++++++++
 include/hw/intc/loongarch_pic_common.h | 17 +++++++++++++++--
 3 files changed, 30 insertions(+), 9 deletions(-)

diff --git a/hw/intc/loongarch_pch_pic.c b/hw/intc/loongarch_pch_pic.c
index 17ab071a6b..f732c292f8 100644
--- a/hw/intc/loongarch_pch_pic.c
+++ b/hw/intc/loongarch_pch_pic.c
@@ -80,15 +80,10 @@ static uint64_t loongarch_pch_pic_low_readw(void *opaque, hwaddr addr,
 
     switch (offset) {
     case PCH_PIC_INT_ID:
-        val = PCH_PIC_INT_ID_VAL;
+        val = s->id.data & UINT_MAX;
         break;
     case PCH_PIC_INT_ID + 4:
-        /*
-         * With 7A1000 manual
-         *   bit  0-15 pch irqchip version
-         *   bit 16-31 irq number supported with pch irqchip
-         */
-        val = deposit32(PCH_PIC_INT_ID_VER, 16, 16, s->irq_num - 1);
+        val = s->id.data >> 32;
         break;
     case PCH_PIC_INT_MASK:
         val = (uint32_t)s->int_mask;
diff --git a/hw/intc/loongarch_pic_common.c b/hw/intc/loongarch_pic_common.c
index 6dccacc741..de170501cf 100644
--- a/hw/intc/loongarch_pic_common.c
+++ b/hw/intc/loongarch_pic_common.c
@@ -49,6 +49,19 @@ static void loongarch_pic_common_reset_hold(Object *obj, ResetType type)
     LoongArchPICCommonState *s = LOONGARCH_PIC_COMMON(obj);
     int i;
 
+    /*
+     * With Loongson 7A1000 user manual
+     * Chapter 5.2 "Description of Interrupt-related Registers"
+     *
+     * Interrupt controller identification register 1
+     *   Bit 24-31 Interrupt Controller ID
+     * Interrupt controller identification register 2
+     *   Bit  0-7  Interrupt Controller version number
+     *   Bit 16-23 The number of interrupt sources supported
+     */
+    s->id.desc.id = PCH_PIC_INT_ID_VAL;
+    s->id.desc.version = PCH_PIC_INT_ID_VER;
+    s->id.desc.irq_num = s->irq_num - 1;
     s->int_mask = UINT64_MAX;
     s->htmsi_en = 0x0;
     s->intedge  = 0x0;
diff --git a/include/hw/intc/loongarch_pic_common.h b/include/hw/intc/loongarch_pic_common.h
index 2b4b483c63..7a9a2bdd46 100644
--- a/include/hw/intc/loongarch_pic_common.h
+++ b/include/hw/intc/loongarch_pic_common.h
@@ -10,9 +10,9 @@
 #include "hw/pci-host/ls7a.h"
 #include "hw/sysbus.h"
 
-#define PCH_PIC_INT_ID_VAL              0x7000000UL
-#define PCH_PIC_INT_ID_VER              0x1UL
 #define PCH_PIC_INT_ID                  0x00
+#define  PCH_PIC_INT_ID_VAL             0x7
+#define  PCH_PIC_INT_ID_VER             0x1
 #define PCH_PIC_INT_MASK                0x20
 #define PCH_PIC_HTMSI_EN                0x40
 #define PCH_PIC_INT_EDGE                0x60
@@ -30,10 +30,23 @@
 OBJECT_DECLARE_TYPE(LoongArchPICCommonState,
                     LoongArchPICCommonClass, LOONGARCH_PIC_COMMON)
 
+union LoongArchPIC_ID {
+    struct {
+        uint8_t _reserved_0[3];
+        uint8_t id;
+        uint8_t version;
+        uint8_t _reserved_1;
+        uint8_t irq_num;
+        uint8_t _reserved_2;
+    } QEMU_PACKED desc;
+    uint64_t data;
+};
+
 struct LoongArchPICCommonState {
     SysBusDevice parent_obj;
 
     qemu_irq parent_irq[64];
+    union LoongArchPIC_ID id; /* 0x00  interrupt ID register */
     uint64_t int_mask;        /* 0x020 interrupt mask register */
     uint64_t htmsi_en;        /* 0x040 1=msi */
     uint64_t intedge;         /* 0x060 edge=1 level=0 */

From ab3ab67348b1e34630272b05f9f7f187fd6a1f8f Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Wed, 7 May 2025 10:31:37 +0800
Subject: [PATCH 0843/2760] hw/intc/loongarch_pch: Use relative address in
 MemoryRegionOps

Parameter address for read and write callback in MemoryRegionOps is
relative offset with base address of this MemoryRegionOps. It can
be directly used as offset and offset calculation can be removed.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
Message-Id: <20250507023148.1877287-6-maobibo@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 hw/intc/loongarch_pch_pic.c | 34 ++++++++++++++++------------------
 1 file changed, 16 insertions(+), 18 deletions(-)

diff --git a/hw/intc/loongarch_pch_pic.c b/hw/intc/loongarch_pch_pic.c
index f732c292f8..9b64bf938f 100644
--- a/hw/intc/loongarch_pch_pic.c
+++ b/hw/intc/loongarch_pch_pic.c
@@ -76,9 +76,8 @@ static uint64_t loongarch_pch_pic_low_readw(void *opaque, hwaddr addr,
 {
     LoongArchPICCommonState *s = LOONGARCH_PIC_COMMON(opaque);
     uint64_t val = 0;
-    uint32_t offset = addr & 0xfff;
 
-    switch (offset) {
+    switch (addr) {
     case PCH_PIC_INT_ID:
         val = s->id.data & UINT_MAX;
         break;
@@ -129,13 +128,12 @@ static void loongarch_pch_pic_low_writew(void *opaque, hwaddr addr,
                                          uint64_t value, unsigned size)
 {
     LoongArchPICCommonState *s = LOONGARCH_PIC_COMMON(opaque);
-    uint32_t offset, old_valid, data = (uint32_t)value;
+    uint32_t old_valid, data = (uint32_t)value;
     uint64_t old, int_mask;
-    offset = addr & 0xfff;
 
     trace_loongarch_pch_pic_low_writew(size, addr, data);
 
-    switch (offset) {
+    switch (addr) {
     case PCH_PIC_INT_MASK:
         old = s->int_mask;
         s->int_mask = get_writew_val(old, data, 0);
@@ -203,9 +201,9 @@ static uint64_t loongarch_pch_pic_high_readw(void *opaque, hwaddr addr,
 {
     LoongArchPICCommonState *s = LOONGARCH_PIC_COMMON(opaque);
     uint64_t val = 0;
-    uint32_t offset = addr + PCH_PIC_INT_STATUS;
 
-    switch (offset) {
+    addr += PCH_PIC_INT_STATUS;
+    switch (addr) {
     case PCH_PIC_INT_STATUS:
         val = (uint32_t)(s->intisr & (~s->int_mask));
         break;
@@ -230,12 +228,12 @@ static void loongarch_pch_pic_high_writew(void *opaque, hwaddr addr,
                                      uint64_t value, unsigned size)
 {
     LoongArchPICCommonState *s = LOONGARCH_PIC_COMMON(opaque);
-    uint32_t offset, data = (uint32_t)value;
-    offset = addr + PCH_PIC_INT_STATUS;
+    uint32_t data = (uint32_t)value;
 
+    addr += PCH_PIC_INT_STATUS;
     trace_loongarch_pch_pic_high_writew(size, addr, data);
 
-    switch (offset) {
+    switch (addr) {
     case PCH_PIC_INT_STATUS:
         s->intisr = get_writew_val(s->intisr, data, 0);
         break;
@@ -258,18 +256,18 @@ static uint64_t loongarch_pch_pic_readb(void *opaque, hwaddr addr,
 {
     LoongArchPICCommonState *s = LOONGARCH_PIC_COMMON(opaque);
     uint64_t val = 0;
-    uint32_t offset = (addr & 0xfff) + PCH_PIC_ROUTE_ENTRY;
     int64_t offset_tmp;
 
-    switch (offset) {
+    addr += PCH_PIC_ROUTE_ENTRY;
+    switch (addr) {
     case PCH_PIC_HTMSI_VEC ... PCH_PIC_HTMSI_VEC_END:
-        offset_tmp = offset - PCH_PIC_HTMSI_VEC;
+        offset_tmp = addr - PCH_PIC_HTMSI_VEC;
         if (offset_tmp >= 0 && offset_tmp < 64) {
             val = s->htmsi_vector[offset_tmp];
         }
         break;
     case PCH_PIC_ROUTE_ENTRY ... PCH_PIC_ROUTE_ENTRY_END:
-        offset_tmp = offset - PCH_PIC_ROUTE_ENTRY;
+        offset_tmp = addr - PCH_PIC_ROUTE_ENTRY;
         if (offset_tmp >= 0 && offset_tmp < 64) {
             val = s->route_entry[offset_tmp];
         }
@@ -287,19 +285,19 @@ static void loongarch_pch_pic_writeb(void *opaque, hwaddr addr,
 {
     LoongArchPICCommonState *s = LOONGARCH_PIC_COMMON(opaque);
     int32_t offset_tmp;
-    uint32_t offset = (addr & 0xfff) + PCH_PIC_ROUTE_ENTRY;
 
+    addr += PCH_PIC_ROUTE_ENTRY;
     trace_loongarch_pch_pic_writeb(size, addr, data);
 
-    switch (offset) {
+    switch (addr) {
     case PCH_PIC_HTMSI_VEC ... PCH_PIC_HTMSI_VEC_END:
-        offset_tmp = offset - PCH_PIC_HTMSI_VEC;
+        offset_tmp = addr - PCH_PIC_HTMSI_VEC;
         if (offset_tmp >= 0 && offset_tmp < 64) {
             s->htmsi_vector[offset_tmp] = (uint8_t)(data & 0xff);
         }
         break;
     case PCH_PIC_ROUTE_ENTRY ... PCH_PIC_ROUTE_ENTRY_END:
-        offset_tmp = offset - PCH_PIC_ROUTE_ENTRY;
+        offset_tmp = addr - PCH_PIC_ROUTE_ENTRY;
         if (offset_tmp >= 0 && offset_tmp < 64) {
             s->route_entry[offset_tmp] = (uint8_t)(data & 0xff);
         }

From 53339a8120d9be6a448f29dd1138bab2fa15e34d Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Wed, 7 May 2025 10:31:38 +0800
Subject: [PATCH 0844/2760] hw/intc/loongarch_pch: Discard write operation with
 ISR register

With the latest 7A1000 user manual, interrupt status register ISR is
read only. Here discard write operation with ISR register.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
Message-Id: <20250507023148.1877287-7-maobibo@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 hw/intc/loongarch_pch_pic.c | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/hw/intc/loongarch_pch_pic.c b/hw/intc/loongarch_pch_pic.c
index 9b64bf938f..e6fcf645eb 100644
--- a/hw/intc/loongarch_pch_pic.c
+++ b/hw/intc/loongarch_pch_pic.c
@@ -234,12 +234,6 @@ static void loongarch_pch_pic_high_writew(void *opaque, hwaddr addr,
     trace_loongarch_pch_pic_high_writew(size, addr, data);
 
     switch (addr) {
-    case PCH_PIC_INT_STATUS:
-        s->intisr = get_writew_val(s->intisr, data, 0);
-        break;
-    case PCH_PIC_INT_STATUS + 4:
-        s->intisr = get_writew_val(s->intisr, data, 1);
-        break;
     case PCH_PIC_INT_POL:
         s->int_polarity = get_writew_val(s->int_polarity, data, 0);
         break;

From 9e29bf4e4c5d34ace0c75737f740f1f86236dba9 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Wed, 7 May 2025 10:31:39 +0800
Subject: [PATCH 0845/2760] hw/intc/loongarch_pch: Use generic read callback
 for iomem32_low region

For memory region iomem32_low, generic read callback is used.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
Message-Id: <20250507023148.1877287-8-maobibo@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 hw/intc/loongarch_pch_pic.c | 67 ++++++++++++++++++++++++++-----------
 1 file changed, 47 insertions(+), 20 deletions(-)

diff --git a/hw/intc/loongarch_pch_pic.c b/hw/intc/loongarch_pch_pic.c
index e6fcf645eb..599a27197f 100644
--- a/hw/intc/loongarch_pch_pic.c
+++ b/hw/intc/loongarch_pch_pic.c
@@ -7,6 +7,7 @@
 
 #include "qemu/osdep.h"
 #include "qemu/bitops.h"
+#include "qemu/log.h"
 #include "hw/irq.h"
 #include "hw/intc/loongarch_pch_pic.h"
 #include "trace.h"
@@ -71,47 +72,73 @@ static void pch_pic_irq_handler(void *opaque, int irq, int level)
     pch_pic_update_irq(s, mask, level);
 }
 
-static uint64_t loongarch_pch_pic_low_readw(void *opaque, hwaddr addr,
-                                            unsigned size)
+static uint64_t pch_pic_read(void *opaque, hwaddr addr, uint64_t field_mask)
 {
     LoongArchPICCommonState *s = LOONGARCH_PIC_COMMON(opaque);
     uint64_t val = 0;
+    uint32_t offset;
 
+    offset = addr & 7;
+    addr -= offset;
     switch (addr) {
     case PCH_PIC_INT_ID:
-        val = s->id.data & UINT_MAX;
-        break;
-    case PCH_PIC_INT_ID + 4:
-        val = s->id.data >> 32;
+        val = s->id.data;
         break;
     case PCH_PIC_INT_MASK:
-        val = (uint32_t)s->int_mask;
-        break;
-    case PCH_PIC_INT_MASK + 4:
-        val = s->int_mask >> 32;
+        val = s->int_mask;
         break;
     case PCH_PIC_INT_EDGE:
-        val = (uint32_t)s->intedge;
-        break;
-    case PCH_PIC_INT_EDGE + 4:
-        val = s->intedge >> 32;
+        val = s->intedge;
         break;
     case PCH_PIC_HTMSI_EN:
-        val = (uint32_t)s->htmsi_en;
-        break;
-    case PCH_PIC_HTMSI_EN + 4:
-        val = s->htmsi_en >> 32;
+        val = s->htmsi_en;
         break;
     case PCH_PIC_AUTO_CTRL0:
-    case PCH_PIC_AUTO_CTRL0 + 4:
     case PCH_PIC_AUTO_CTRL1:
-    case PCH_PIC_AUTO_CTRL1 + 4:
         /* PCH PIC connect to EXTIOI always, discard auto_ctrl access */
         break;
     default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "pch_pic_read: Bad address 0x%"PRIx64"\n", addr);
         break;
     }
 
+    return (val >> (offset * 8)) & field_mask;
+}
+
+static uint64_t loongarch_pch_pic_read(void *opaque, hwaddr addr,
+                                       unsigned size)
+{
+    uint64_t val = 0;
+
+    switch (size) {
+    case 1:
+        val = pch_pic_read(opaque, addr, UCHAR_MAX);
+        break;
+    case 2:
+        val = pch_pic_read(opaque, addr, USHRT_MAX);
+        break;
+    case 4:
+        val = pch_pic_read(opaque, addr, UINT_MAX);
+        break;
+    case 8:
+        val = pch_pic_read(opaque, addr, UINT64_MAX);
+        break;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "loongarch_pch_pic_read: Bad size %d\n", size);
+        break;
+    }
+
+    return val;
+}
+
+static uint64_t loongarch_pch_pic_low_readw(void *opaque, hwaddr addr,
+                                            unsigned size)
+{
+    uint64_t val;
+
+    val = loongarch_pch_pic_read(opaque, addr, size);
     trace_loongarch_pch_pic_low_readw(size, addr, val);
     return val;
 }

From 6dab13c4152b5b3c35b627483bfdce2d331d95f2 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Wed, 7 May 2025 10:31:40 +0800
Subject: [PATCH 0846/2760] hw/intc/loongarch_pch: Use generic read callback
 for iomem32_high region

Add register read operation emulation in generic read function
loongarch_pch_pic_read(), and use this function for iomem32_high region.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
Message-Id: <20250507023148.1877287-9-maobibo@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 hw/intc/loongarch_pch_pic.c | 27 ++++++++-------------------
 1 file changed, 8 insertions(+), 19 deletions(-)

diff --git a/hw/intc/loongarch_pch_pic.c b/hw/intc/loongarch_pch_pic.c
index 599a27197f..e477a6033b 100644
--- a/hw/intc/loongarch_pch_pic.c
+++ b/hw/intc/loongarch_pch_pic.c
@@ -97,6 +97,12 @@ static uint64_t pch_pic_read(void *opaque, hwaddr addr, uint64_t field_mask)
     case PCH_PIC_AUTO_CTRL1:
         /* PCH PIC connect to EXTIOI always, discard auto_ctrl access */
         break;
+    case PCH_PIC_INT_STATUS:
+        val = s->intisr & (~s->int_mask);
+        break;
+    case PCH_PIC_INT_POL:
+        val = s->int_polarity;
+        break;
     default:
         qemu_log_mask(LOG_GUEST_ERROR,
                       "pch_pic_read: Bad address 0x%"PRIx64"\n", addr);
@@ -226,27 +232,10 @@ static void loongarch_pch_pic_low_writew(void *opaque, hwaddr addr,
 static uint64_t loongarch_pch_pic_high_readw(void *opaque, hwaddr addr,
                                         unsigned size)
 {
-    LoongArchPICCommonState *s = LOONGARCH_PIC_COMMON(opaque);
-    uint64_t val = 0;
+    uint64_t val;
 
     addr += PCH_PIC_INT_STATUS;
-    switch (addr) {
-    case PCH_PIC_INT_STATUS:
-        val = (uint32_t)(s->intisr & (~s->int_mask));
-        break;
-    case PCH_PIC_INT_STATUS + 4:
-        val = (s->intisr & (~s->int_mask)) >> 32;
-        break;
-    case PCH_PIC_INT_POL:
-        val = (uint32_t)s->int_polarity;
-        break;
-    case PCH_PIC_INT_POL + 4:
-        val = s->int_polarity >> 32;
-        break;
-    default:
-        break;
-    }
-
+    val = loongarch_pch_pic_read(opaque, addr, size);
     trace_loongarch_pch_pic_high_readw(size, addr, val);
     return val;
 }

From 81de67213d29a401bc341abe75abd120ad22b25a Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Wed, 7 May 2025 10:31:41 +0800
Subject: [PATCH 0847/2760] hw/intc/loongarch_pch: Use generic read callback
 for iomem8 region

Add iomem8 region register read operation emulation in generic read
function loongarch_pch_pic_read(), and use this function for iomem8
region.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
Message-Id: <20250507023148.1877287-10-maobibo@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 hw/intc/loongarch_pch_pic.c | 28 ++++++++--------------------
 1 file changed, 8 insertions(+), 20 deletions(-)

diff --git a/hw/intc/loongarch_pch_pic.c b/hw/intc/loongarch_pch_pic.c
index e477a6033b..dbfc178e5d 100644
--- a/hw/intc/loongarch_pch_pic.c
+++ b/hw/intc/loongarch_pch_pic.c
@@ -103,6 +103,12 @@ static uint64_t pch_pic_read(void *opaque, hwaddr addr, uint64_t field_mask)
     case PCH_PIC_INT_POL:
         val = s->int_polarity;
         break;
+    case PCH_PIC_HTMSI_VEC ... PCH_PIC_HTMSI_VEC_END:
+        val = *(uint64_t *)(s->htmsi_vector + addr - PCH_PIC_HTMSI_VEC);
+        break;
+    case PCH_PIC_ROUTE_ENTRY ... PCH_PIC_ROUTE_ENTRY_END:
+        val = *(uint64_t *)(s->route_entry + addr - PCH_PIC_ROUTE_ENTRY);
+        break;
     default:
         qemu_log_mask(LOG_GUEST_ERROR,
                       "pch_pic_read: Bad address 0x%"PRIx64"\n", addr);
@@ -264,28 +270,10 @@ static void loongarch_pch_pic_high_writew(void *opaque, hwaddr addr,
 static uint64_t loongarch_pch_pic_readb(void *opaque, hwaddr addr,
                                         unsigned size)
 {
-    LoongArchPICCommonState *s = LOONGARCH_PIC_COMMON(opaque);
-    uint64_t val = 0;
-    int64_t offset_tmp;
+    uint64_t val;
 
     addr += PCH_PIC_ROUTE_ENTRY;
-    switch (addr) {
-    case PCH_PIC_HTMSI_VEC ... PCH_PIC_HTMSI_VEC_END:
-        offset_tmp = addr - PCH_PIC_HTMSI_VEC;
-        if (offset_tmp >= 0 && offset_tmp < 64) {
-            val = s->htmsi_vector[offset_tmp];
-        }
-        break;
-    case PCH_PIC_ROUTE_ENTRY ... PCH_PIC_ROUTE_ENTRY_END:
-        offset_tmp = addr - PCH_PIC_ROUTE_ENTRY;
-        if (offset_tmp >= 0 && offset_tmp < 64) {
-            val = s->route_entry[offset_tmp];
-        }
-        break;
-    default:
-        break;
-    }
-
+    val = loongarch_pch_pic_read(opaque, addr, size);
     trace_loongarch_pch_pic_readb(size, addr, val);
     return val;
 }

From f5dc4993fc5cee1a6fcfca1e4728af2fe965f98e Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Wed, 7 May 2025 10:31:42 +0800
Subject: [PATCH 0848/2760] hw/intc/loongarch_pch: Use generic write callback
 for iomem32_low region

For memory region iomem32_low, generic write callback is used.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
Message-Id: <20250507023148.1877287-11-maobibo@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 hw/intc/loongarch_pch_pic.c | 140 +++++++++++++++++++-----------------
 1 file changed, 73 insertions(+), 67 deletions(-)

diff --git a/hw/intc/loongarch_pch_pic.c b/hw/intc/loongarch_pch_pic.c
index dbfc178e5d..07f9b07b09 100644
--- a/hw/intc/loongarch_pch_pic.c
+++ b/hw/intc/loongarch_pch_pic.c
@@ -118,6 +118,53 @@ static uint64_t pch_pic_read(void *opaque, hwaddr addr, uint64_t field_mask)
     return (val >> (offset * 8)) & field_mask;
 }
 
+static void pch_pic_write(void *opaque, hwaddr addr, uint64_t value,
+                          uint64_t field_mask)
+{
+    LoongArchPICCommonState *s = LOONGARCH_PIC_COMMON(opaque);
+    uint32_t offset;
+    uint64_t old, mask, data;
+
+    offset = addr & 7;
+    addr -= offset;
+    mask = field_mask << (offset * 8);
+    data = (value & field_mask) << (offset * 8);
+    switch (addr) {
+    case PCH_PIC_INT_MASK:
+        old = s->int_mask;
+        s->int_mask = (old & ~mask) | data;
+        if (old & ~data) {
+            pch_pic_update_irq(s, old & ~data, 1);
+        }
+
+        if (~old & data) {
+            pch_pic_update_irq(s, ~old & data, 0);
+        }
+        break;
+    case PCH_PIC_INT_EDGE:
+        s->intedge = (s->intedge & ~mask) | data;
+        break;
+    case PCH_PIC_INT_CLEAR:
+        if (s->intedge & data) {
+            s->intirr &= ~data;
+            pch_pic_update_irq(s, data, 0);
+            s->intisr &= ~data;
+        }
+        break;
+    case PCH_PIC_HTMSI_EN:
+        s->htmsi_en = (s->htmsi_en & ~mask) | data;
+        break;
+    case PCH_PIC_AUTO_CTRL0:
+    case PCH_PIC_AUTO_CTRL1:
+        /* Discard auto_ctrl access */
+        break;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "pch_pic_write: Bad address 0x%"PRIx64"\n", addr);
+        break;
+    }
+}
+
 static uint64_t loongarch_pch_pic_read(void *opaque, hwaddr addr,
                                        unsigned size)
 {
@@ -145,6 +192,30 @@ static uint64_t loongarch_pch_pic_read(void *opaque, hwaddr addr,
     return val;
 }
 
+static void loongarch_pch_pic_write(void *opaque, hwaddr addr,
+                                    uint64_t value, unsigned size)
+{
+    switch (size) {
+    case 1:
+        pch_pic_write(opaque, addr, value, UCHAR_MAX);
+        break;
+    case 2:
+        pch_pic_write(opaque, addr, value, USHRT_MAX);
+        break;
+        break;
+    case 4:
+        pch_pic_write(opaque, addr, value, UINT_MAX);
+        break;
+    case 8:
+        pch_pic_write(opaque, addr, value, UINT64_MAX);
+        break;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "loongarch_pch_pic_write: Bad size %d\n", size);
+        break;
+    }
+}
+
 static uint64_t loongarch_pch_pic_low_readw(void *opaque, hwaddr addr,
                                             unsigned size)
 {
@@ -166,73 +237,8 @@ static uint64_t get_writew_val(uint64_t value, uint32_t target, bool hi)
 static void loongarch_pch_pic_low_writew(void *opaque, hwaddr addr,
                                          uint64_t value, unsigned size)
 {
-    LoongArchPICCommonState *s = LOONGARCH_PIC_COMMON(opaque);
-    uint32_t old_valid, data = (uint32_t)value;
-    uint64_t old, int_mask;
-
-    trace_loongarch_pch_pic_low_writew(size, addr, data);
-
-    switch (addr) {
-    case PCH_PIC_INT_MASK:
-        old = s->int_mask;
-        s->int_mask = get_writew_val(old, data, 0);
-        old_valid = (uint32_t)old;
-        if (old_valid & ~data) {
-            pch_pic_update_irq(s, (old_valid & ~data), 1);
-        }
-        if (~old_valid & data) {
-            pch_pic_update_irq(s, (~old_valid & data), 0);
-        }
-        break;
-    case PCH_PIC_INT_MASK + 4:
-        old = s->int_mask;
-        s->int_mask = get_writew_val(old, data, 1);
-        old_valid = (uint32_t)(old >> 32);
-        int_mask = old_valid & ~data;
-        if (int_mask) {
-            pch_pic_update_irq(s, int_mask << 32, 1);
-        }
-        int_mask = ~old_valid & data;
-        if (int_mask) {
-            pch_pic_update_irq(s, int_mask << 32, 0);
-        }
-        break;
-    case PCH_PIC_INT_EDGE:
-        s->intedge = get_writew_val(s->intedge, data, 0);
-        break;
-    case PCH_PIC_INT_EDGE + 4:
-        s->intedge = get_writew_val(s->intedge, data, 1);
-        break;
-    case PCH_PIC_INT_CLEAR:
-        if (s->intedge & data) {
-            s->intirr &= (~data);
-            pch_pic_update_irq(s, data, 0);
-            s->intisr &= (~data);
-        }
-        break;
-    case PCH_PIC_INT_CLEAR + 4:
-        value <<= 32;
-        if (s->intedge & value) {
-            s->intirr &= (~value);
-            pch_pic_update_irq(s, value, 0);
-            s->intisr &= (~value);
-        }
-        break;
-    case PCH_PIC_HTMSI_EN:
-        s->htmsi_en = get_writew_val(s->htmsi_en, data, 0);
-        break;
-    case PCH_PIC_HTMSI_EN + 4:
-        s->htmsi_en = get_writew_val(s->htmsi_en, data, 1);
-        break;
-    case PCH_PIC_AUTO_CTRL0:
-    case PCH_PIC_AUTO_CTRL0 + 4:
-    case PCH_PIC_AUTO_CTRL1:
-    case PCH_PIC_AUTO_CTRL1 + 4:
-        /* discard auto_ctrl access */
-        break;
-    default:
-        break;
-    }
+    trace_loongarch_pch_pic_low_writew(size, addr, value);
+    loongarch_pch_pic_write(opaque, addr, value, size);
 }
 
 static uint64_t loongarch_pch_pic_high_readw(void *opaque, hwaddr addr,

From 2618d65036d4c05771727784ec665132689e2608 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Wed, 7 May 2025 10:31:43 +0800
Subject: [PATCH 0849/2760] hw/intc/loongarch_pch: Use generic write callback
 for iomem32_high region

Add iomem32_high region register write operation emulation in generic
write function loongarch_pch_pic_write(), and use this function for
iomem32_high region.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
Message-Id: <20250507023148.1877287-12-maobibo@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 hw/intc/loongarch_pch_pic.c | 28 +++++-----------------------
 1 file changed, 5 insertions(+), 23 deletions(-)

diff --git a/hw/intc/loongarch_pch_pic.c b/hw/intc/loongarch_pch_pic.c
index 07f9b07b09..50bcc23d7d 100644
--- a/hw/intc/loongarch_pch_pic.c
+++ b/hw/intc/loongarch_pch_pic.c
@@ -158,6 +158,9 @@ static void pch_pic_write(void *opaque, hwaddr addr, uint64_t value,
     case PCH_PIC_AUTO_CTRL1:
         /* Discard auto_ctrl access */
         break;
+    case PCH_PIC_INT_POL:
+        s->int_polarity = (s->int_polarity & ~mask) | data;
+        break;
     default:
         qemu_log_mask(LOG_GUEST_ERROR,
                       "pch_pic_write: Bad address 0x%"PRIx64"\n", addr);
@@ -226,14 +229,6 @@ static uint64_t loongarch_pch_pic_low_readw(void *opaque, hwaddr addr,
     return val;
 }
 
-static uint64_t get_writew_val(uint64_t value, uint32_t target, bool hi)
-{
-    uint64_t mask = 0xffffffff00000000;
-    uint64_t data = target;
-
-    return hi ? (value & ~mask) | (data << 32) : (value & mask) | data;
-}
-
 static void loongarch_pch_pic_low_writew(void *opaque, hwaddr addr,
                                          uint64_t value, unsigned size)
 {
@@ -255,22 +250,9 @@ static uint64_t loongarch_pch_pic_high_readw(void *opaque, hwaddr addr,
 static void loongarch_pch_pic_high_writew(void *opaque, hwaddr addr,
                                      uint64_t value, unsigned size)
 {
-    LoongArchPICCommonState *s = LOONGARCH_PIC_COMMON(opaque);
-    uint32_t data = (uint32_t)value;
-
     addr += PCH_PIC_INT_STATUS;
-    trace_loongarch_pch_pic_high_writew(size, addr, data);
-
-    switch (addr) {
-    case PCH_PIC_INT_POL:
-        s->int_polarity = get_writew_val(s->int_polarity, data, 0);
-        break;
-    case PCH_PIC_INT_POL + 4:
-        s->int_polarity = get_writew_val(s->int_polarity, data, 1);
-        break;
-    default:
-        break;
-    }
+    trace_loongarch_pch_pic_high_writew(size, addr, value);
+    loongarch_pch_pic_write(opaque, addr, value, size);
 }
 
 static uint64_t loongarch_pch_pic_readb(void *opaque, hwaddr addr,

From a6fdd0032ce5c7cd5c49a1bfbcedf6c08e136682 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Wed, 7 May 2025 10:37:50 +0800
Subject: [PATCH 0850/2760] hw/intc/loongarch_pch: Use generic write callback
 for iomem8 region

Add iomem8 region register write operation emulation in generic write
function loongarch_pch_pic_write(), and use this function for iomem8
region.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
Message-Id: <20250507023754.1877445-1-maobibo@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 hw/intc/loongarch_pch_pic.c | 31 ++++++++++---------------------
 1 file changed, 10 insertions(+), 21 deletions(-)

diff --git a/hw/intc/loongarch_pch_pic.c b/hw/intc/loongarch_pch_pic.c
index 50bcc23d7d..556349a150 100644
--- a/hw/intc/loongarch_pch_pic.c
+++ b/hw/intc/loongarch_pch_pic.c
@@ -123,7 +123,7 @@ static void pch_pic_write(void *opaque, hwaddr addr, uint64_t value,
 {
     LoongArchPICCommonState *s = LOONGARCH_PIC_COMMON(opaque);
     uint32_t offset;
-    uint64_t old, mask, data;
+    uint64_t old, mask, data, *ptemp;
 
     offset = addr & 7;
     addr -= offset;
@@ -161,6 +161,14 @@ static void pch_pic_write(void *opaque, hwaddr addr, uint64_t value,
     case PCH_PIC_INT_POL:
         s->int_polarity = (s->int_polarity & ~mask) | data;
         break;
+    case PCH_PIC_HTMSI_VEC ... PCH_PIC_HTMSI_VEC_END:
+        ptemp = (uint64_t *)(s->htmsi_vector + addr - PCH_PIC_HTMSI_VEC);
+        *ptemp = (*ptemp & ~mask) | data;
+        break;
+    case PCH_PIC_ROUTE_ENTRY ... PCH_PIC_ROUTE_ENTRY_END:
+        ptemp = (uint64_t *)(s->route_entry + addr - PCH_PIC_ROUTE_ENTRY);
+        *ptemp = (*ptemp & ~mask) | data;
+        break;
     default:
         qemu_log_mask(LOG_GUEST_ERROR,
                       "pch_pic_write: Bad address 0x%"PRIx64"\n", addr);
@@ -269,28 +277,9 @@ static uint64_t loongarch_pch_pic_readb(void *opaque, hwaddr addr,
 static void loongarch_pch_pic_writeb(void *opaque, hwaddr addr,
                                      uint64_t data, unsigned size)
 {
-    LoongArchPICCommonState *s = LOONGARCH_PIC_COMMON(opaque);
-    int32_t offset_tmp;
-
     addr += PCH_PIC_ROUTE_ENTRY;
     trace_loongarch_pch_pic_writeb(size, addr, data);
-
-    switch (addr) {
-    case PCH_PIC_HTMSI_VEC ... PCH_PIC_HTMSI_VEC_END:
-        offset_tmp = addr - PCH_PIC_HTMSI_VEC;
-        if (offset_tmp >= 0 && offset_tmp < 64) {
-            s->htmsi_vector[offset_tmp] = (uint8_t)(data & 0xff);
-        }
-        break;
-    case PCH_PIC_ROUTE_ENTRY ... PCH_PIC_ROUTE_ENTRY_END:
-        offset_tmp = addr - PCH_PIC_ROUTE_ENTRY;
-        if (offset_tmp >= 0 && offset_tmp < 64) {
-            s->route_entry[offset_tmp] = (uint8_t)(data & 0xff);
-        }
-        break;
-    default:
-        break;
-    }
+    loongarch_pch_pic_write(opaque, addr, data, size);
 }
 
 static const MemoryRegionOps loongarch_pch_pic_reg32_low_ops = {

From ba23cce0dcc75d2211f875e758305e3636e7c0a4 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Wed, 7 May 2025 10:37:51 +0800
Subject: [PATCH 0851/2760] hw/intc/loongarch_pch: Use unified trace event for
 memory region ops

Add trace event trace_loongarch_pch_pic_read(), replaces the following
three events:
  trace_loongarch_pch_pic_low_readw()
  trace_loongarch_pch_pic_high_readw()
  trace_loongarch_pch_pic_readb()
The similiar with write trace event.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
Message-Id: <20250507023754.1877445-2-maobibo@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 hw/intc/loongarch_pch_pic.c | 24 ++++++------------------
 hw/intc/trace-events        |  8 ++------
 2 files changed, 8 insertions(+), 24 deletions(-)

diff --git a/hw/intc/loongarch_pch_pic.c b/hw/intc/loongarch_pch_pic.c
index 556349a150..c06ef0df3f 100644
--- a/hw/intc/loongarch_pch_pic.c
+++ b/hw/intc/loongarch_pch_pic.c
@@ -200,12 +200,15 @@ static uint64_t loongarch_pch_pic_read(void *opaque, hwaddr addr,
         break;
     }
 
+    trace_loongarch_pch_pic_read(size, addr, val);
     return val;
 }
 
 static void loongarch_pch_pic_write(void *opaque, hwaddr addr,
                                     uint64_t value, unsigned size)
 {
+    trace_loongarch_pch_pic_write(size, addr, value);
+
     switch (size) {
     case 1:
         pch_pic_write(opaque, addr, value, UCHAR_MAX);
@@ -230,55 +233,40 @@ static void loongarch_pch_pic_write(void *opaque, hwaddr addr,
 static uint64_t loongarch_pch_pic_low_readw(void *opaque, hwaddr addr,
                                             unsigned size)
 {
-    uint64_t val;
-
-    val = loongarch_pch_pic_read(opaque, addr, size);
-    trace_loongarch_pch_pic_low_readw(size, addr, val);
-    return val;
+    return loongarch_pch_pic_read(opaque, addr, size);
 }
 
 static void loongarch_pch_pic_low_writew(void *opaque, hwaddr addr,
                                          uint64_t value, unsigned size)
 {
-    trace_loongarch_pch_pic_low_writew(size, addr, value);
     loongarch_pch_pic_write(opaque, addr, value, size);
 }
 
 static uint64_t loongarch_pch_pic_high_readw(void *opaque, hwaddr addr,
                                         unsigned size)
 {
-    uint64_t val;
-
     addr += PCH_PIC_INT_STATUS;
-    val = loongarch_pch_pic_read(opaque, addr, size);
-    trace_loongarch_pch_pic_high_readw(size, addr, val);
-    return val;
+    return loongarch_pch_pic_read(opaque, addr, size);
 }
 
 static void loongarch_pch_pic_high_writew(void *opaque, hwaddr addr,
                                      uint64_t value, unsigned size)
 {
     addr += PCH_PIC_INT_STATUS;
-    trace_loongarch_pch_pic_high_writew(size, addr, value);
     loongarch_pch_pic_write(opaque, addr, value, size);
 }
 
 static uint64_t loongarch_pch_pic_readb(void *opaque, hwaddr addr,
                                         unsigned size)
 {
-    uint64_t val;
-
     addr += PCH_PIC_ROUTE_ENTRY;
-    val = loongarch_pch_pic_read(opaque, addr, size);
-    trace_loongarch_pch_pic_readb(size, addr, val);
-    return val;
+    return loongarch_pch_pic_read(opaque, addr, size);
 }
 
 static void loongarch_pch_pic_writeb(void *opaque, hwaddr addr,
                                      uint64_t data, unsigned size)
 {
     addr += PCH_PIC_ROUTE_ENTRY;
-    trace_loongarch_pch_pic_writeb(size, addr, data);
     loongarch_pch_pic_write(opaque, addr, data, size);
 }
 
diff --git a/hw/intc/trace-events b/hw/intc/trace-events
index 0ba9a02e73..334aa6a97b 100644
--- a/hw/intc/trace-events
+++ b/hw/intc/trace-events
@@ -314,12 +314,8 @@ loongson_ipi_read(unsigned size, uint64_t addr, uint64_t val) "size: %u addr: 0x
 loongson_ipi_write(unsigned size, uint64_t addr, uint64_t val) "size: %u addr: 0x%"PRIx64 "val: 0x%"PRIx64
 # loongarch_pch_pic.c
 loongarch_pch_pic_irq_handler(int irq, int level) "irq %d level %d"
-loongarch_pch_pic_low_readw(unsigned size, uint64_t addr, uint64_t val) "size: %u addr: 0x%"PRIx64 "val: 0x%" PRIx64
-loongarch_pch_pic_low_writew(unsigned size, uint64_t addr, uint64_t val) "size: %u addr: 0x%"PRIx64 "val: 0x%" PRIx64
-loongarch_pch_pic_high_readw(unsigned size, uint64_t addr, uint64_t val) "size: %u addr: 0x%"PRIx64 "val: 0x%" PRIx64
-loongarch_pch_pic_high_writew(unsigned size, uint64_t addr, uint64_t val) "size: %u addr: 0x%"PRIx64 "val: 0x%" PRIx64
-loongarch_pch_pic_readb(unsigned size, uint64_t addr, uint64_t val) "size: %u addr: 0x%"PRIx64 "val: 0x%" PRIx64
-loongarch_pch_pic_writeb(unsigned size, uint64_t addr, uint64_t val) "size: %u addr: 0x%"PRIx64 "val: 0x%" PRIx64
+loongarch_pch_pic_read(unsigned size, uint64_t addr, uint64_t val) "size: %u addr: 0x%"PRIx64 "val: 0x%" PRIx64
+loongarch_pch_pic_write(unsigned size, uint64_t addr, uint64_t val) "size: %u addr: 0x%"PRIx64 "val: 0x%" PRIx64
 
 # loongarch_pch_msi.c
 loongarch_msi_set_irq(int irq_num) "set msi irq %d"

From ce5efc2f44d1a2809c4adb2bad2083db29a03c71 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Wed, 7 May 2025 10:37:52 +0800
Subject: [PATCH 0852/2760] hw/intc/loongarch_pch: Rename memory region
 iomem32_low with iomem

Rename memory region iomem32_low with iomem, also change ops name
as follows:
  loongarch_pch_pic_reg32_low_ops  --> loongarch_pch_pic_ops
  loongarch_pch_pic_low_readw      --> loongarch_pch_pic_read
  loongarch_pch_pic_low_writew     --> loongarch_pch_pic_write

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
Message-Id: <20250507023754.1877445-3-maobibo@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 hw/intc/loongarch_pch_pic.c            | 26 +++++++-------------------
 include/hw/intc/loongarch_pic_common.h |  2 +-
 2 files changed, 8 insertions(+), 20 deletions(-)

diff --git a/hw/intc/loongarch_pch_pic.c b/hw/intc/loongarch_pch_pic.c
index c06ef0df3f..076b984d93 100644
--- a/hw/intc/loongarch_pch_pic.c
+++ b/hw/intc/loongarch_pch_pic.c
@@ -230,18 +230,6 @@ static void loongarch_pch_pic_write(void *opaque, hwaddr addr,
     }
 }
 
-static uint64_t loongarch_pch_pic_low_readw(void *opaque, hwaddr addr,
-                                            unsigned size)
-{
-    return loongarch_pch_pic_read(opaque, addr, size);
-}
-
-static void loongarch_pch_pic_low_writew(void *opaque, hwaddr addr,
-                                         uint64_t value, unsigned size)
-{
-    loongarch_pch_pic_write(opaque, addr, value, size);
-}
-
 static uint64_t loongarch_pch_pic_high_readw(void *opaque, hwaddr addr,
                                         unsigned size)
 {
@@ -270,9 +258,9 @@ static void loongarch_pch_pic_writeb(void *opaque, hwaddr addr,
     loongarch_pch_pic_write(opaque, addr, data, size);
 }
 
-static const MemoryRegionOps loongarch_pch_pic_reg32_low_ops = {
-    .read = loongarch_pch_pic_low_readw,
-    .write = loongarch_pch_pic_low_writew,
+static const MemoryRegionOps loongarch_pch_pic_ops = {
+    .read = loongarch_pch_pic_read,
+    .write = loongarch_pch_pic_write,
     .valid = {
         .min_access_size = 4,
         .max_access_size = 8,
@@ -336,15 +324,15 @@ static void loongarch_pic_realize(DeviceState *dev, Error **errp)
 
     qdev_init_gpio_out(dev, s->parent_irq, s->irq_num);
     qdev_init_gpio_in(dev, pch_pic_irq_handler, s->irq_num);
-    memory_region_init_io(&s->iomem32_low, OBJECT(dev),
-                          &loongarch_pch_pic_reg32_low_ops,
-                          s, PCH_PIC_NAME(.reg32_part1), 0x100);
+    memory_region_init_io(&s->iomem, OBJECT(dev),
+                          &loongarch_pch_pic_ops,
+                          s, TYPE_LOONGARCH_PIC, 0x100);
     memory_region_init_io(&s->iomem8, OBJECT(dev), &loongarch_pch_pic_reg8_ops,
                           s, PCH_PIC_NAME(.reg8), 0x2a0);
     memory_region_init_io(&s->iomem32_high, OBJECT(dev),
                           &loongarch_pch_pic_reg32_high_ops,
                           s, PCH_PIC_NAME(.reg32_part2), 0xc60);
-    sysbus_init_mmio(sbd, &s->iomem32_low);
+    sysbus_init_mmio(sbd, &s->iomem);
     sysbus_init_mmio(sbd, &s->iomem8);
     sysbus_init_mmio(sbd, &s->iomem32_high);
 
diff --git a/include/hw/intc/loongarch_pic_common.h b/include/hw/intc/loongarch_pic_common.h
index 7a9a2bdd46..dc03056227 100644
--- a/include/hw/intc/loongarch_pic_common.h
+++ b/include/hw/intc/loongarch_pic_common.h
@@ -65,7 +65,7 @@ struct LoongArchPICCommonState {
     uint8_t route_entry[64];  /* 0x100 - 0x138 */
     uint8_t htmsi_vector[64]; /* 0x200 - 0x238 */
 
-    MemoryRegion iomem32_low;
+    MemoryRegion iomem;
     MemoryRegion iomem32_high;
     MemoryRegion iomem8;
     unsigned int irq_num;

From 2493ff01dc7c9b06a0579f6e66c3df69da4d5d23 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Wed, 7 May 2025 10:37:53 +0800
Subject: [PATCH 0853/2760] hw/intc/loongarch_pch: Set flexible memory access
 size with iomem region

The original iomem region only supports 4 bytes access size, set it ok
with 1/2/4/8 bytes. Also unaligned memory access is not supported.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
Message-Id: <20250507023754.1877445-4-maobibo@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 hw/intc/loongarch_pch_pic.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/hw/intc/loongarch_pch_pic.c b/hw/intc/loongarch_pch_pic.c
index 076b984d93..e9126a0c1f 100644
--- a/hw/intc/loongarch_pch_pic.c
+++ b/hw/intc/loongarch_pch_pic.c
@@ -262,12 +262,19 @@ static const MemoryRegionOps loongarch_pch_pic_ops = {
     .read = loongarch_pch_pic_read,
     .write = loongarch_pch_pic_write,
     .valid = {
-        .min_access_size = 4,
+        .min_access_size = 1,
         .max_access_size = 8,
+        /*
+         * PCH PIC device would not work correctly if the guest was doing
+         * unaligned access. This might not be a limitation on the real
+         * device but in practice there is no reason for a guest to access
+         * this device unaligned.
+         */
+        .unaligned = false,
     },
     .impl = {
-        .min_access_size = 4,
-        .max_access_size = 4,
+        .min_access_size = 1,
+        .max_access_size = 8,
     },
     .endianness = DEVICE_LITTLE_ENDIAN,
 };

From f4881c67ba8a852687566610949d8e9ab0542a31 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Wed, 7 May 2025 10:37:54 +0800
Subject: [PATCH 0854/2760] hw/intc/loongarch_pch: Merge three memory region
 into one

Since memory region iomem supports memory access size with 1/2/4/8,
it can be used for memory region iomem8 and iomem32_high. Now remove
memory region iomem8 and iomem32_high, merge them into iomem together.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
Message-Id: <20250507023754.1877445-5-maobibo@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 hw/intc/loongarch_pch_pic.c            | 66 +-------------------------
 hw/loongarch/virt.c                    |  6 ---
 include/hw/intc/loongarch_pic_common.h |  2 -
 3 files changed, 1 insertion(+), 73 deletions(-)

diff --git a/hw/intc/loongarch_pch_pic.c b/hw/intc/loongarch_pch_pic.c
index e9126a0c1f..cbba2fc284 100644
--- a/hw/intc/loongarch_pch_pic.c
+++ b/hw/intc/loongarch_pch_pic.c
@@ -230,34 +230,6 @@ static void loongarch_pch_pic_write(void *opaque, hwaddr addr,
     }
 }
 
-static uint64_t loongarch_pch_pic_high_readw(void *opaque, hwaddr addr,
-                                        unsigned size)
-{
-    addr += PCH_PIC_INT_STATUS;
-    return loongarch_pch_pic_read(opaque, addr, size);
-}
-
-static void loongarch_pch_pic_high_writew(void *opaque, hwaddr addr,
-                                     uint64_t value, unsigned size)
-{
-    addr += PCH_PIC_INT_STATUS;
-    loongarch_pch_pic_write(opaque, addr, value, size);
-}
-
-static uint64_t loongarch_pch_pic_readb(void *opaque, hwaddr addr,
-                                        unsigned size)
-{
-    addr += PCH_PIC_ROUTE_ENTRY;
-    return loongarch_pch_pic_read(opaque, addr, size);
-}
-
-static void loongarch_pch_pic_writeb(void *opaque, hwaddr addr,
-                                     uint64_t data, unsigned size)
-{
-    addr += PCH_PIC_ROUTE_ENTRY;
-    loongarch_pch_pic_write(opaque, addr, data, size);
-}
-
 static const MemoryRegionOps loongarch_pch_pic_ops = {
     .read = loongarch_pch_pic_read,
     .write = loongarch_pch_pic_write,
@@ -279,34 +251,6 @@ static const MemoryRegionOps loongarch_pch_pic_ops = {
     .endianness = DEVICE_LITTLE_ENDIAN,
 };
 
-static const MemoryRegionOps loongarch_pch_pic_reg32_high_ops = {
-    .read = loongarch_pch_pic_high_readw,
-    .write = loongarch_pch_pic_high_writew,
-    .valid = {
-        .min_access_size = 4,
-        .max_access_size = 8,
-    },
-    .impl = {
-        .min_access_size = 4,
-        .max_access_size = 4,
-    },
-    .endianness = DEVICE_LITTLE_ENDIAN,
-};
-
-static const MemoryRegionOps loongarch_pch_pic_reg8_ops = {
-    .read = loongarch_pch_pic_readb,
-    .write = loongarch_pch_pic_writeb,
-    .valid = {
-        .min_access_size = 1,
-        .max_access_size = 1,
-    },
-    .impl = {
-        .min_access_size = 1,
-        .max_access_size = 1,
-    },
-    .endianness = DEVICE_LITTLE_ENDIAN,
-};
-
 static void loongarch_pic_reset_hold(Object *obj, ResetType type)
 {
     LoongarchPICClass *lpc = LOONGARCH_PIC_GET_CLASS(obj);
@@ -333,16 +277,8 @@ static void loongarch_pic_realize(DeviceState *dev, Error **errp)
     qdev_init_gpio_in(dev, pch_pic_irq_handler, s->irq_num);
     memory_region_init_io(&s->iomem, OBJECT(dev),
                           &loongarch_pch_pic_ops,
-                          s, TYPE_LOONGARCH_PIC, 0x100);
-    memory_region_init_io(&s->iomem8, OBJECT(dev), &loongarch_pch_pic_reg8_ops,
-                          s, PCH_PIC_NAME(.reg8), 0x2a0);
-    memory_region_init_io(&s->iomem32_high, OBJECT(dev),
-                          &loongarch_pch_pic_reg32_high_ops,
-                          s, PCH_PIC_NAME(.reg32_part2), 0xc60);
+                          s, TYPE_LOONGARCH_PIC, VIRT_PCH_REG_SIZE);
     sysbus_init_mmio(sbd, &s->iomem);
-    sysbus_init_mmio(sbd, &s->iomem8);
-    sysbus_init_mmio(sbd, &s->iomem32_high);
-
 }
 
 static void loongarch_pic_class_init(ObjectClass *klass, const void *data)
diff --git a/hw/loongarch/virt.c b/hw/loongarch/virt.c
index ebcef0a92b..1b504047db 100644
--- a/hw/loongarch/virt.c
+++ b/hw/loongarch/virt.c
@@ -429,12 +429,6 @@ static void virt_irq_init(LoongArchVirtMachineState *lvms)
     sysbus_realize_and_unref(d, &error_fatal);
     memory_region_add_subregion(get_system_memory(), VIRT_IOAPIC_REG_BASE,
                             sysbus_mmio_get_region(d, 0));
-    memory_region_add_subregion(get_system_memory(),
-                            VIRT_IOAPIC_REG_BASE + PCH_PIC_ROUTE_ENTRY,
-                            sysbus_mmio_get_region(d, 1));
-    memory_region_add_subregion(get_system_memory(),
-                            VIRT_IOAPIC_REG_BASE + PCH_PIC_INT_STATUS,
-                            sysbus_mmio_get_region(d, 2));
 
     /* Connect pch_pic irqs to extioi */
     for (i = 0; i < num; i++) {
diff --git a/include/hw/intc/loongarch_pic_common.h b/include/hw/intc/loongarch_pic_common.h
index dc03056227..9349a055d0 100644
--- a/include/hw/intc/loongarch_pic_common.h
+++ b/include/hw/intc/loongarch_pic_common.h
@@ -66,8 +66,6 @@ struct LoongArchPICCommonState {
     uint8_t htmsi_vector[64]; /* 0x200 - 0x238 */
 
     MemoryRegion iomem;
-    MemoryRegion iomem32_high;
-    MemoryRegion iomem8;
     unsigned int irq_num;
 };
 

From a3d5f62254a48b7c260d5aa7bd8e8467a0bb8ea3 Mon Sep 17 00:00:00 2001
From: Xianglai Li <lixianglai@loongson.cn>
Date: Tue, 6 May 2025 16:09:46 +0800
Subject: [PATCH 0855/2760] hw/loongarch/boot: Adjust the loading position of
 the initrd

When only the -kernel parameter is used to load the elf kernel, the initrd
is loaded in the ram. If the initrd size is too large, the loading fails,
resulting in a VM startup failure. This patch first loads initrd near
the kernel.

When the nearby memory space of the kernel is insufficient, it tries to
load it to the starting position of high memory. If there is still not
enough, qemu will report an error and ask the user to increase the memory
space for the virtual machine to boot.

Signed-off-by: Xianglai Li <lixianglai@loongson.cn>
Message-Id: <20250506080946.817092-1-lixianglai@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 hw/loongarch/boot.c | 52 +++++++++++++++++++++++++++++++++++++--------
 1 file changed, 43 insertions(+), 9 deletions(-)

diff --git a/hw/loongarch/boot.c b/hw/loongarch/boot.c
index 0324d6adcb..9b6292eaa1 100644
--- a/hw/loongarch/boot.c
+++ b/hw/loongarch/boot.c
@@ -235,6 +235,45 @@ static int64_t load_loongarch_linux_image(const char *filename,
     return size;
 }
 
+static ram_addr_t alloc_initrd_memory(struct loongarch_boot_info *info,
+                uint64_t advice_start, ssize_t rd_size)
+{
+    hwaddr base, ram_size, gap, low_end;
+    ram_addr_t initrd_end, initrd_start;
+
+    base = VIRT_LOWMEM_BASE;
+    gap = VIRT_LOWMEM_SIZE;
+    initrd_start = advice_start;
+    initrd_end = initrd_start + rd_size;
+
+    ram_size = info->ram_size;
+    low_end = base + MIN(ram_size, gap);
+    if (initrd_end <= low_end) {
+        return initrd_start;
+    }
+
+    if (ram_size <= gap) {
+        error_report("The low memory too small for initial ram disk '%s',"
+             "You need to expand the ram",
+             info->initrd_filename);
+        exit(1);
+    }
+
+    /*
+     * Try to load initrd in the high memory
+     */
+    ram_size -= gap;
+    initrd_start = VIRT_HIGHMEM_BASE;
+    if (rd_size <= ram_size) {
+        return initrd_start;
+    }
+
+    error_report("The high memory too small for initial ram disk '%s',"
+         "You need to expand the ram",
+         info->initrd_filename);
+    exit(1);
+}
+
 static int64_t load_kernel_info(struct loongarch_boot_info *info)
 {
     uint64_t kernel_entry, kernel_low, kernel_high;
@@ -263,15 +302,10 @@ static int64_t load_kernel_info(struct loongarch_boot_info *info)
         initrd_size = get_image_size(info->initrd_filename);
         if (initrd_size > 0) {
             initrd_offset = ROUND_UP(kernel_high + 4 * kernel_size, 64 * KiB);
-
-            if (initrd_offset + initrd_size > info->ram_size) {
-                error_report("memory too small for initial ram disk '%s'",
-                             info->initrd_filename);
-                exit(1);
-            }
-
-            initrd_size = load_image_targphys(info->initrd_filename, initrd_offset,
-                                              info->ram_size - initrd_offset);
+            initrd_offset = alloc_initrd_memory(info, initrd_offset,
+                                                initrd_size);
+            initrd_size = load_image_targphys(info->initrd_filename,
+                                              initrd_offset, initrd_size);
         }
 
         if (initrd_size == (target_ulong)-1) {

From 98cbac128f1c38fa62becf5b89bc662c9218a780 Mon Sep 17 00:00:00 2001
From: Davidlohr Bueso <dave@stgolabs.net>
Date: Wed, 5 Mar 2025 09:24:52 +0000
Subject: [PATCH 0856/2760] hw/cxl: Support aborting background commands

As of 3.1 spec, background commands can be canceled with a new
abort command. Implement the support, which is advertised in
the CEL. No ad-hoc context undoing is necessary as all the
command logic of the running bg command is done upon completion.
Arbitrarily, the on-going background cmd will not be aborted if
already at least 85% done;

A mutex is introduced to stabilize mbox request cancel command vs
the timer callback being fired scenarios (as well as reading the
mbox registers). While some operations under critical regions
may be unnecessary (irq notifying, cmd callbacks), this is not
a path where performance is important, so simplicity is preferred.

Tested-by: Ajay Joshi <ajay.opensrc@micron.com>
Reviewed-by: Ajay Joshi <ajay.opensrc@micron.com>
Signed-off-by: Davidlohr Bueso <dave@stgolabs.net>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Message-Id: <20250305092501.191929-2-Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/cxl/cxl-device-utils.c    | 14 ++++---
 hw/cxl/cxl-mailbox-utils.c   | 72 ++++++++++++++++++++++++++++++++----
 hw/mem/cxl_type3.c           |  8 +++-
 include/hw/cxl/cxl_device.h  |  4 ++
 include/hw/cxl/cxl_mailbox.h |  1 +
 5 files changed, 86 insertions(+), 13 deletions(-)

diff --git a/hw/cxl/cxl-device-utils.c b/hw/cxl/cxl-device-utils.c
index 52ad1e4c3f..e150d74457 100644
--- a/hw/cxl/cxl-device-utils.c
+++ b/hw/cxl/cxl-device-utils.c
@@ -95,11 +95,15 @@ static uint64_t mailbox_reg_read(void *opaque, hwaddr offset, unsigned size)
         }
         if (offset == A_CXL_DEV_MAILBOX_STS) {
             uint64_t status_reg = cxl_dstate->mbox_reg_state64[offset / size];
-            if (cci->bg.complete_pct) {
-                status_reg = FIELD_DP64(status_reg, CXL_DEV_MAILBOX_STS, BG_OP,
-                                        0);
-                cxl_dstate->mbox_reg_state64[offset / size] = status_reg;
-            }
+            int bgop;
+
+            qemu_mutex_lock(&cci->bg.lock);
+            bgop = !(cci->bg.complete_pct == 100 || cci->bg.aborted);
+
+            status_reg = FIELD_DP64(status_reg, CXL_DEV_MAILBOX_STS, BG_OP,
+                                    bgop);
+            cxl_dstate->mbox_reg_state64[offset / size] = status_reg;
+            qemu_mutex_unlock(&cci->bg.lock);
         }
         return cxl_dstate->mbox_reg_state64[offset / size];
     default:
diff --git a/hw/cxl/cxl-mailbox-utils.c b/hw/cxl/cxl-mailbox-utils.c
index 516c01d840..4401f446d9 100644
--- a/hw/cxl/cxl-mailbox-utils.c
+++ b/hw/cxl/cxl-mailbox-utils.c
@@ -56,6 +56,7 @@ enum {
     INFOSTAT    = 0x00,
         #define IS_IDENTIFY   0x1
         #define BACKGROUND_OPERATION_STATUS    0x2
+        #define BACKGROUND_OPERATION_ABORT     0x5
     EVENTS      = 0x01,
         #define GET_RECORDS   0x0
         #define CLEAR_RECORDS   0x1
@@ -636,6 +637,41 @@ static CXLRetCode cmd_infostat_bg_op_sts(const struct cxl_cmd *cmd,
     return CXL_MBOX_SUCCESS;
 }
 
+/*
+ * CXL r3.1 Section 8.2.9.1.5:
+ * Request Abort Background Operation (Opcode 0005h)
+ */
+static CXLRetCode cmd_infostat_bg_op_abort(const struct cxl_cmd *cmd,
+                                           uint8_t *payload_in,
+                                           size_t len_in,
+                                           uint8_t *payload_out,
+                                           size_t *len_out,
+                                           CXLCCI *cci)
+{
+    int bg_set = cci->bg.opcode >> 8;
+    int bg_cmd = cci->bg.opcode & 0xff;
+    const struct cxl_cmd *bg_c = &cci->cxl_cmd_set[bg_set][bg_cmd];
+
+    if (!(bg_c->effect & CXL_MBOX_BACKGROUND_OPERATION_ABORT)) {
+        return CXL_MBOX_REQUEST_ABORT_NOTSUP;
+    }
+
+    qemu_mutex_lock(&cci->bg.lock);
+    if (cci->bg.runtime) {
+        /* operation is near complete, let it finish */
+        if (cci->bg.complete_pct < 85) {
+            timer_del(cci->bg.timer);
+            cci->bg.ret_code = CXL_MBOX_ABORTED;
+            cci->bg.starttime = 0;
+            cci->bg.runtime = 0;
+            cci->bg.aborted = true;
+        }
+    }
+    qemu_mutex_unlock(&cci->bg.lock);
+
+    return CXL_MBOX_SUCCESS;
+}
+
 #define CXL_FW_SLOTS 2
 #define CXL_FW_SIZE  0x02000000 /* 32 mb */
 
@@ -2715,6 +2751,8 @@ static CXLRetCode cmd_dcd_release_dyn_cap(const struct cxl_cmd *cmd,
 }
 
 static const struct cxl_cmd cxl_cmd_set[256][256] = {
+    [INFOSTAT][BACKGROUND_OPERATION_ABORT] = { "BACKGROUND_OPERATION_ABORT",
+        cmd_infostat_bg_op_abort, 0, 0 },
     [EVENTS][GET_RECORDS] = { "EVENTS_GET_RECORDS",
         cmd_events_get_records, 1, 0 },
     [EVENTS][CLEAR_RECORDS] = { "EVENTS_CLEAR_RECORDS",
@@ -2727,9 +2765,11 @@ static const struct cxl_cmd cxl_cmd_set[256][256] = {
     [FIRMWARE_UPDATE][GET_INFO] = { "FIRMWARE_UPDATE_GET_INFO",
         cmd_firmware_update_get_info, 0, 0 },
     [FIRMWARE_UPDATE][TRANSFER] = { "FIRMWARE_UPDATE_TRANSFER",
-        cmd_firmware_update_transfer, ~0, CXL_MBOX_BACKGROUND_OPERATION },
+        cmd_firmware_update_transfer, ~0,
+        CXL_MBOX_BACKGROUND_OPERATION | CXL_MBOX_BACKGROUND_OPERATION_ABORT },
     [FIRMWARE_UPDATE][ACTIVATE] = { "FIRMWARE_UPDATE_ACTIVATE",
-        cmd_firmware_update_activate, 2, CXL_MBOX_BACKGROUND_OPERATION },
+        cmd_firmware_update_activate, 2,
+        CXL_MBOX_BACKGROUND_OPERATION | CXL_MBOX_BACKGROUND_OPERATION_ABORT },
     [TIMESTAMP][GET] = { "TIMESTAMP_GET", cmd_timestamp_get, 0, 0 },
     [TIMESTAMP][SET] = { "TIMESTAMP_SET", cmd_timestamp_set,
                          8, CXL_MBOX_IMMEDIATE_POLICY_CHANGE },
@@ -2758,7 +2798,8 @@ static const struct cxl_cmd cxl_cmd_set[256][256] = {
     [SANITIZE][OVERWRITE] = { "SANITIZE_OVERWRITE", cmd_sanitize_overwrite, 0,
         (CXL_MBOX_IMMEDIATE_DATA_CHANGE |
          CXL_MBOX_SECURITY_STATE_CHANGE |
-         CXL_MBOX_BACKGROUND_OPERATION)},
+         CXL_MBOX_BACKGROUND_OPERATION |
+         CXL_MBOX_BACKGROUND_OPERATION_ABORT)},
     [PERSISTENT_MEM][GET_SECURITY_STATE] = { "GET_SECURITY_STATE",
         cmd_get_security_state, 0, 0 },
     [MEDIA_AND_POISON][GET_POISON_LIST] = { "MEDIA_AND_POISON_GET_POISON_LIST",
@@ -2771,7 +2812,8 @@ static const struct cxl_cmd cxl_cmd_set[256][256] = {
         "MEDIA_AND_POISON_GET_SCAN_MEDIA_CAPABILITIES",
         cmd_media_get_scan_media_capabilities, 16, 0 },
     [MEDIA_AND_POISON][SCAN_MEDIA] = { "MEDIA_AND_POISON_SCAN_MEDIA",
-        cmd_media_scan_media, 17, CXL_MBOX_BACKGROUND_OPERATION },
+        cmd_media_scan_media, 17,
+        (CXL_MBOX_BACKGROUND_OPERATION | CXL_MBOX_BACKGROUND_OPERATION_ABORT)},
     [MEDIA_AND_POISON][GET_SCAN_MEDIA_RESULTS] = {
         "MEDIA_AND_POISON_GET_SCAN_MEDIA_RESULTS",
         cmd_media_get_scan_media_results, 0, 0 },
@@ -2795,6 +2837,8 @@ static const struct cxl_cmd cxl_cmd_set_sw[256][256] = {
     [INFOSTAT][IS_IDENTIFY] = { "IDENTIFY", cmd_infostat_identify, 0, 0 },
     [INFOSTAT][BACKGROUND_OPERATION_STATUS] = { "BACKGROUND_OPERATION_STATUS",
         cmd_infostat_bg_op_sts, 0, 0 },
+    [INFOSTAT][BACKGROUND_OPERATION_ABORT] = { "BACKGROUND_OPERATION_ABORT",
+        cmd_infostat_bg_op_abort, 0, 0 },
     [TIMESTAMP][GET] = { "TIMESTAMP_GET", cmd_timestamp_get, 0, 0 },
     [TIMESTAMP][SET] = { "TIMESTAMP_SET", cmd_timestamp_set, 8,
                          CXL_MBOX_IMMEDIATE_POLICY_CHANGE },
@@ -2881,6 +2925,7 @@ int cxl_process_cci_message(CXLCCI *cci, uint8_t set, uint8_t cmd,
         cci->bg.opcode = (set << 8) | cmd;
 
         cci->bg.complete_pct = 0;
+        cci->bg.aborted = false;
         cci->bg.ret_code = 0;
 
         now = qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL);
@@ -2894,10 +2939,12 @@ int cxl_process_cci_message(CXLCCI *cci, uint8_t set, uint8_t cmd,
 static void bg_timercb(void *opaque)
 {
     CXLCCI *cci = opaque;
-    uint64_t now = qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL);
-    uint64_t total_time = cci->bg.starttime + cci->bg.runtime;
+    uint64_t now, total_time;
 
-    assert(cci->bg.runtime > 0);
+    qemu_mutex_lock(&cci->bg.lock);
+
+    now = qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL);
+    total_time = cci->bg.starttime + cci->bg.runtime;
 
     if (now >= total_time) { /* we are done */
         uint16_t ret = CXL_MBOX_SUCCESS;
@@ -2950,6 +2997,8 @@ static void bg_timercb(void *opaque)
             msi_notify(pdev, cxl_dstate->mbox_msi_n);
         }
     }
+
+    qemu_mutex_unlock(&cci->bg.lock);
 }
 
 static void cxl_rebuild_cel(CXLCCI *cci)
@@ -2978,12 +3027,21 @@ void cxl_init_cci(CXLCCI *cci, size_t payload_max)
     cci->bg.complete_pct = 0;
     cci->bg.starttime = 0;
     cci->bg.runtime = 0;
+    cci->bg.aborted = false;
     cci->bg.timer = timer_new_ms(QEMU_CLOCK_VIRTUAL,
                                  bg_timercb, cci);
+    qemu_mutex_init(&cci->bg.lock);
 
     memset(&cci->fw, 0, sizeof(cci->fw));
     cci->fw.active_slot = 1;
     cci->fw.slot[cci->fw.active_slot - 1] = true;
+    cci->initialized = true;
+}
+
+void cxl_destroy_cci(CXLCCI *cci)
+{
+    qemu_mutex_destroy(&cci->bg.lock);
+    cci->initialized = false;
 }
 
 static void cxl_copy_cci_commands(CXLCCI *cci, const struct cxl_cmd (*cxl_cmds)[256])
diff --git a/hw/mem/cxl_type3.c b/hw/mem/cxl_type3.c
index bba923f8ea..aacd078118 100644
--- a/hw/mem/cxl_type3.c
+++ b/hw/mem/cxl_type3.c
@@ -969,6 +969,7 @@ static void ct3_exit(PCIDevice *pci_dev)
     cxl_doe_cdat_release(cxl_cstate);
     msix_uninit_exclusive_bar(pci_dev);
     g_free(regs->special_ops);
+    cxl_destroy_cci(&ct3d->cci);
     if (ct3d->dc.host_dc) {
         cxl_destroy_dc_regions(ct3d);
         address_space_destroy(&ct3d->dc.host_dc_as);
@@ -1224,12 +1225,17 @@ static void ct3d_reset(DeviceState *dev)
      * Bring up an endpoint to target with MCTP over VDM.
      * This device is emulating an MLD with single LD for now.
      */
+    if (ct3d->vdm_fm_owned_ld_mctp_cci.initialized) {
+        cxl_destroy_cci(&ct3d->vdm_fm_owned_ld_mctp_cci);
+    }
     cxl_initialize_t3_fm_owned_ld_mctpcci(&ct3d->vdm_fm_owned_ld_mctp_cci,
                                           DEVICE(ct3d), DEVICE(ct3d),
                                           512); /* Max payload made up */
+    if (ct3d->ld0_cci.initialized) {
+        cxl_destroy_cci(&ct3d->ld0_cci);
+    }
     cxl_initialize_t3_ld_cci(&ct3d->ld0_cci, DEVICE(ct3d), DEVICE(ct3d),
                              512); /* Max payload made up */
-
 }
 
 static const Property ct3_props[] = {
diff --git a/include/hw/cxl/cxl_device.h b/include/hw/cxl/cxl_device.h
index 3a0ee7e8e7..d21695507f 100644
--- a/include/hw/cxl/cxl_device.h
+++ b/include/hw/cxl/cxl_device.h
@@ -176,10 +176,12 @@ typedef struct CXLCCI {
         uint16_t opcode;
         uint16_t complete_pct;
         uint16_t ret_code; /* Current value of retcode */
+        bool aborted;
         uint64_t starttime;
         /* set by each bg cmd, cleared by the bg_timer when complete */
         uint64_t runtime;
         QEMUTimer *timer;
+        QemuMutex lock; /* serializes mbox abort vs timer cb */
     } bg;
 
     /* firmware update */
@@ -201,6 +203,7 @@ typedef struct CXLCCI {
     DeviceState *d;
     /* Pointer to the device hosting the protocol conversion */
     DeviceState *intf;
+    bool initialized;
 } CXLCCI;
 
 typedef struct cxl_device_state {
@@ -316,6 +319,7 @@ void cxl_initialize_mailbox_t3(CXLCCI *cci, DeviceState *d, size_t payload_max);
 void cxl_initialize_mailbox_swcci(CXLCCI *cci, DeviceState *intf,
                                   DeviceState *d, size_t payload_max);
 void cxl_init_cci(CXLCCI *cci, size_t payload_max);
+void cxl_destroy_cci(CXLCCI *cci);
 void cxl_add_cci_commands(CXLCCI *cci, const struct cxl_cmd (*cxl_cmd_set)[256],
                           size_t payload_max);
 int cxl_process_cci_message(CXLCCI *cci, uint8_t set, uint8_t cmd,
diff --git a/include/hw/cxl/cxl_mailbox.h b/include/hw/cxl/cxl_mailbox.h
index beb048052e..9008402d1c 100644
--- a/include/hw/cxl/cxl_mailbox.h
+++ b/include/hw/cxl/cxl_mailbox.h
@@ -14,5 +14,6 @@
 #define CXL_MBOX_IMMEDIATE_LOG_CHANGE (1 << 4)
 #define CXL_MBOX_SECURITY_STATE_CHANGE (1 << 5)
 #define CXL_MBOX_BACKGROUND_OPERATION (1 << 6)
+#define CXL_MBOX_BACKGROUND_OPERATION_ABORT (1 << 7)
 
 #endif

From 1000158f031818bf286454c8691da9b4f33c4d02 Mon Sep 17 00:00:00 2001
From: Davidlohr Bueso <dave@stgolabs.net>
Date: Wed, 5 Mar 2025 09:24:53 +0000
Subject: [PATCH 0857/2760] hw/cxl: Support get/set mctp response payload size

Add Get/Set Response Message Limit commands.

Signed-off-by: Davidlohr Bueso <dave@stgolabs.net>
Reviewed-by: Fan Ni <fan.ni@samsung.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Message-Id: <20250305092501.191929-3-Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/cxl/cxl-mailbox-utils.c | 58 ++++++++++++++++++++++++++++++++++++--
 1 file changed, 56 insertions(+), 2 deletions(-)

diff --git a/hw/cxl/cxl-mailbox-utils.c b/hw/cxl/cxl-mailbox-utils.c
index 4401f446d9..bd25df033a 100644
--- a/hw/cxl/cxl-mailbox-utils.c
+++ b/hw/cxl/cxl-mailbox-utils.c
@@ -7,6 +7,8 @@
  * COPYING file in the top-level directory.
  */
 
+#include <math.h>
+
 #include "qemu/osdep.h"
 #include "hw/pci/msi.h"
 #include "hw/pci/msix.h"
@@ -56,6 +58,8 @@ enum {
     INFOSTAT    = 0x00,
         #define IS_IDENTIFY   0x1
         #define BACKGROUND_OPERATION_STATUS    0x2
+        #define GET_RESPONSE_MSG_LIMIT         0x3
+        #define SET_RESPONSE_MSG_LIMIT         0x4
         #define BACKGROUND_OPERATION_ABORT     0x5
     EVENTS      = 0x01,
         #define GET_RECORDS   0x0
@@ -413,12 +417,58 @@ static CXLRetCode cmd_infostat_identify(const struct cxl_cmd *cmd,
         is_identify->component_type = 0x3; /* Type 3 */
     }
 
-    /* TODO: Allow this to vary across different CCIs */
-    is_identify->max_message_size = 9; /* 512 bytes - MCTP_CXL_MAILBOX_BYTES */
+    is_identify->max_message_size = (uint8_t)log2(cci->payload_max);
     *len_out = sizeof(*is_identify);
     return CXL_MBOX_SUCCESS;
 }
 
+/* CXL r3.1 section 8.2.9.1.3: Get Response Message Limit (Opcode 0003h) */
+static CXLRetCode cmd_get_response_msg_limit(const struct cxl_cmd *cmd,
+                                             uint8_t *payload_in,
+                                             size_t len_in,
+                                             uint8_t *payload_out,
+                                             size_t *len_out,
+                                             CXLCCI *cci)
+{
+    struct {
+        uint8_t rsp_limit;
+    } QEMU_PACKED *get_rsp_msg_limit = (void *)payload_out;
+    QEMU_BUILD_BUG_ON(sizeof(*get_rsp_msg_limit) != 1);
+
+    get_rsp_msg_limit->rsp_limit = (uint8_t)log2(cci->payload_max);
+
+    *len_out = sizeof(*get_rsp_msg_limit);
+    return CXL_MBOX_SUCCESS;
+}
+
+/* CXL r3.1 section 8.2.9.1.4: Set Response Message Limit (Opcode 0004h) */
+static CXLRetCode cmd_set_response_msg_limit(const struct cxl_cmd *cmd,
+                                             uint8_t *payload_in,
+                                             size_t len_in,
+                                             uint8_t *payload_out,
+                                             size_t *len_out,
+                                             CXLCCI *cci)
+{
+    struct {
+        uint8_t rsp_limit;
+    } QEMU_PACKED *in = (void *)payload_in;
+    QEMU_BUILD_BUG_ON(sizeof(*in) != 1);
+    struct {
+        uint8_t rsp_limit;
+    } QEMU_PACKED *out = (void *)payload_out;
+    QEMU_BUILD_BUG_ON(sizeof(*out) != 1);
+
+    if (in->rsp_limit < 8 || in->rsp_limit > 10) {
+        return CXL_MBOX_INVALID_INPUT;
+    }
+
+    cci->payload_max = 1 << in->rsp_limit;
+    out->rsp_limit = in->rsp_limit;
+
+    *len_out = sizeof(*out);
+    return CXL_MBOX_SUCCESS;
+}
+
 static void cxl_set_dsp_active_bm(PCIBus *b, PCIDevice *d,
                                   void *private)
 {
@@ -3105,6 +3155,10 @@ void cxl_initialize_t3_ld_cci(CXLCCI *cci, DeviceState *d, DeviceState *intf,
 
 static const struct cxl_cmd cxl_cmd_set_t3_fm_owned_ld_mctp[256][256] = {
     [INFOSTAT][IS_IDENTIFY] = { "IDENTIFY", cmd_infostat_identify, 0,  0},
+    [INFOSTAT][GET_RESPONSE_MSG_LIMIT] = { "GET_RESPONSE_MSG_LIMIT",
+                                           cmd_get_response_msg_limit, 0, 0 },
+    [INFOSTAT][SET_RESPONSE_MSG_LIMIT] = { "SET_RESPONSE_MSG_LIMIT",
+                                           cmd_set_response_msg_limit, 1, 0 },
     [LOGS][GET_SUPPORTED] = { "LOGS_GET_SUPPORTED", cmd_logs_get_supported, 0,
                               0 },
     [LOGS][GET_LOG] = { "LOGS_GET_LOG", cmd_logs_get_log, 0x18, 0 },

From 77a8e9fe0ecb71b260d17f43221df5b18769b359 Mon Sep 17 00:00:00 2001
From: Vinayak Holikatti <vinayak.kh@samsung.com>
Date: Wed, 5 Mar 2025 09:24:54 +0000
Subject: [PATCH 0858/2760] hw/cxl/cxl-mailbox-utils: Add support for Media
 operations discovery commands cxl r3.2 (8.2.10.9.5.3)

CXL spec 3.2 section 8.2.10.9.5.3 describes media operations commands.
CXL devices supports media operations discovery command.

Signed-off-by: Vinayak Holikatti <vinayak.kh@samsung.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Message-Id: <20250305092501.191929-4-Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/cxl/cxl-mailbox-utils.c | 125 +++++++++++++++++++++++++++++++++++++
 1 file changed, 125 insertions(+)

diff --git a/hw/cxl/cxl-mailbox-utils.c b/hw/cxl/cxl-mailbox-utils.c
index bd25df033a..79b35d1405 100644
--- a/hw/cxl/cxl-mailbox-utils.c
+++ b/hw/cxl/cxl-mailbox-utils.c
@@ -89,6 +89,7 @@ enum {
     SANITIZE    = 0x44,
         #define OVERWRITE     0x0
         #define SECURE_ERASE  0x1
+        #define MEDIA_OPERATIONS 0x2
     PERSISTENT_MEM = 0x45,
         #define GET_SECURITY_STATE     0x0
     MEDIA_AND_POISON = 0x43,
@@ -1705,6 +1706,126 @@ static CXLRetCode cmd_sanitize_overwrite(const struct cxl_cmd *cmd,
     return CXL_MBOX_BG_STARTED;
 }
 
+enum {
+    MEDIA_OP_CLASS_GENERAL  = 0x0,
+        #define MEDIA_OP_GEN_SUBC_DISCOVERY 0x0
+    MEDIA_OP_CLASS_SANITIZE = 0x1,
+        #define MEDIA_OP_SAN_SUBC_SANITIZE 0x0
+        #define MEDIA_OP_SAN_SUBC_ZERO 0x1
+};
+
+struct media_op_supported_list_entry {
+    uint8_t media_op_class;
+    uint8_t media_op_subclass;
+};
+
+struct media_op_discovery_out_pl {
+    uint64_t dpa_range_granularity;
+    uint16_t total_supported_operations;
+    uint16_t num_of_supported_operations;
+    struct media_op_supported_list_entry entry[];
+} QEMU_PACKED;
+
+static const struct media_op_supported_list_entry media_op_matrix[] = {
+    { MEDIA_OP_CLASS_GENERAL, MEDIA_OP_GEN_SUBC_DISCOVERY },
+    { MEDIA_OP_CLASS_SANITIZE, MEDIA_OP_SAN_SUBC_SANITIZE },
+    { MEDIA_OP_CLASS_SANITIZE, MEDIA_OP_SAN_SUBC_ZERO },
+};
+
+static CXLRetCode media_operations_discovery(uint8_t *payload_in,
+                                             size_t len_in,
+                                             uint8_t *payload_out,
+                                             size_t *len_out)
+{
+    struct {
+        uint8_t media_operation_class;
+        uint8_t media_operation_subclass;
+        uint8_t rsvd[2];
+        uint32_t dpa_range_count;
+        struct {
+            uint16_t start_index;
+            uint16_t num_ops;
+        } discovery_osa;
+    } QEMU_PACKED *media_op_in_disc_pl = (void *)payload_in;
+    struct media_op_discovery_out_pl *media_out_pl =
+        (struct media_op_discovery_out_pl *)payload_out;
+    int num_ops, start_index, i;
+    int count = 0;
+
+    if (len_in < sizeof(*media_op_in_disc_pl)) {
+        return CXL_MBOX_INVALID_PAYLOAD_LENGTH;
+    }
+
+    num_ops = media_op_in_disc_pl->discovery_osa.num_ops;
+    start_index = media_op_in_disc_pl->discovery_osa.start_index;
+
+    /*
+     * As per spec CXL r3.2 8.2.10.9.5.3 dpa_range_count should be zero and
+     * start index should not exceed the total number of entries for discovery
+     * sub class command.
+     */
+    if (media_op_in_disc_pl->dpa_range_count ||
+        start_index > ARRAY_SIZE(media_op_matrix)) {
+        return CXL_MBOX_INVALID_INPUT;
+    }
+
+    media_out_pl->dpa_range_granularity = CXL_CACHE_LINE_SIZE;
+    media_out_pl->total_supported_operations =
+                                     ARRAY_SIZE(media_op_matrix);
+    if (num_ops > 0) {
+        for (i = start_index; i < start_index + num_ops; i++) {
+            media_out_pl->entry[count].media_op_class =
+                    media_op_matrix[i].media_op_class;
+            media_out_pl->entry[count].media_op_subclass =
+                        media_op_matrix[i].media_op_subclass;
+            count++;
+            if (count == num_ops) {
+                break;
+            }
+        }
+    }
+
+    media_out_pl->num_of_supported_operations = count;
+    *len_out = sizeof(*media_out_pl) + count * sizeof(*media_out_pl->entry);
+    return CXL_MBOX_SUCCESS;
+}
+
+static CXLRetCode cmd_media_operations(const struct cxl_cmd *cmd,
+                                       uint8_t *payload_in,
+                                       size_t len_in,
+                                       uint8_t *payload_out,
+                                       size_t *len_out,
+                                       CXLCCI *cci)
+{
+    struct {
+        uint8_t media_operation_class;
+        uint8_t media_operation_subclass;
+        uint8_t rsvd[2];
+        uint32_t dpa_range_count;
+    } QEMU_PACKED *media_op_in_common_pl = (void *)payload_in;
+    uint8_t media_op_cl = 0;
+    uint8_t media_op_subclass = 0;
+
+    if (len_in < sizeof(*media_op_in_common_pl)) {
+        return CXL_MBOX_INVALID_PAYLOAD_LENGTH;
+    }
+
+    media_op_cl = media_op_in_common_pl->media_operation_class;
+    media_op_subclass = media_op_in_common_pl->media_operation_subclass;
+
+    switch (media_op_cl) {
+    case MEDIA_OP_CLASS_GENERAL:
+        if (media_op_subclass != MEDIA_OP_GEN_SUBC_DISCOVERY) {
+            return CXL_MBOX_UNSUPPORTED;
+        }
+
+        return media_operations_discovery(payload_in, len_in, payload_out,
+                                             len_out);
+    default:
+        return CXL_MBOX_UNSUPPORTED;
+    }
+}
+
 static CXLRetCode cmd_get_security_state(const struct cxl_cmd *cmd,
                                          uint8_t *payload_in,
                                          size_t len_in,
@@ -2850,6 +2971,10 @@ static const struct cxl_cmd cxl_cmd_set[256][256] = {
          CXL_MBOX_SECURITY_STATE_CHANGE |
          CXL_MBOX_BACKGROUND_OPERATION |
          CXL_MBOX_BACKGROUND_OPERATION_ABORT)},
+    [SANITIZE][MEDIA_OPERATIONS] = { "MEDIA_OPERATIONS", cmd_media_operations,
+        ~0,
+        (CXL_MBOX_IMMEDIATE_DATA_CHANGE |
+         CXL_MBOX_BACKGROUND_OPERATION)},
     [PERSISTENT_MEM][GET_SECURITY_STATE] = { "GET_SECURITY_STATE",
         cmd_get_security_state, 0, 0 },
     [MEDIA_AND_POISON][GET_POISON_LIST] = { "MEDIA_AND_POISON_GET_POISON_LIST",

From 484df0704ea592ebd5993c15d63ea38f309ec6e0 Mon Sep 17 00:00:00 2001
From: Vinayak Holikatti <vinayak.kh@samsung.com>
Date: Wed, 5 Mar 2025 09:24:55 +0000
Subject: [PATCH 0859/2760] hw/cxl: factor out calculation of sanitize duration
 from cmd_santize_overwrite

Move the code of calculation of sanitize duration into function
for usability by other sanitize routines

Estimate times based on:
             https://pmem.io/documents/NVDIMM_DSM_Interface-V1.8.pdf

Signed-off-by: Davidlohr Bueso <dave@stgolabs.net>
Signed-off-by: Vinayak Holikatti <vinayak.kh@samsung.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Message-Id: <20250305092501.191929-5-Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/cxl/cxl-mailbox-utils.c | 63 ++++++++++++++++++++++----------------
 1 file changed, 36 insertions(+), 27 deletions(-)

diff --git a/hw/cxl/cxl-mailbox-utils.c b/hw/cxl/cxl-mailbox-utils.c
index 79b35d1405..9f9d475678 100644
--- a/hw/cxl/cxl-mailbox-utils.c
+++ b/hw/cxl/cxl-mailbox-utils.c
@@ -1640,6 +1640,41 @@ static void __do_sanitization(CXLType3Dev *ct3d)
     cxl_discard_all_event_records(&ct3d->cxl_dstate);
 }
 
+static int get_sanitize_duration(uint64_t total_mem)
+{
+    int secs = 0;
+
+    if (total_mem <= 512) {
+        secs = 4;
+    } else if (total_mem <= 1024) {
+        secs = 8;
+    } else if (total_mem <= 2 * 1024) {
+        secs = 15;
+    } else if (total_mem <= 4 * 1024) {
+        secs = 30;
+    } else if (total_mem <= 8 * 1024) {
+        secs = 60;
+    } else if (total_mem <= 16 * 1024) {
+        secs = 2 * 60;
+    } else if (total_mem <= 32 * 1024) {
+        secs = 4 * 60;
+    } else if (total_mem <= 64 * 1024) {
+        secs = 8 * 60;
+    } else if (total_mem <= 128 * 1024) {
+        secs = 15 * 60;
+    } else if (total_mem <= 256 * 1024) {
+        secs = 30 * 60;
+    } else if (total_mem <= 512 * 1024) {
+        secs = 60 * 60;
+    } else if (total_mem <= 1024 * 1024) {
+        secs = 120 * 60;
+    } else {
+        secs = 240 * 60; /* max 4 hrs */
+    }
+
+    return secs;
+}
+
 /*
  * CXL r3.1 Section 8.2.9.9.5.1: Sanitize (Opcode 4400h)
  *
@@ -1668,33 +1703,7 @@ static CXLRetCode cmd_sanitize_overwrite(const struct cxl_cmd *cmd,
     int secs;
 
     total_mem = (ct3d->cxl_dstate.vmem_size + ct3d->cxl_dstate.pmem_size) >> 20;
-    if (total_mem <= 512) {
-        secs = 4;
-    } else if (total_mem <= 1024) {
-        secs = 8;
-    } else if (total_mem <= 2 * 1024) {
-        secs = 15;
-    } else if (total_mem <= 4 * 1024) {
-        secs = 30;
-    } else if (total_mem <= 8 * 1024) {
-        secs = 60;
-    } else if (total_mem <= 16 * 1024) {
-        secs = 2 * 60;
-    } else if (total_mem <= 32 * 1024) {
-        secs = 4 * 60;
-    } else if (total_mem <= 64 * 1024) {
-        secs = 8 * 60;
-    } else if (total_mem <= 128 * 1024) {
-        secs = 15 * 60;
-    } else if (total_mem <= 256 * 1024) {
-        secs = 30 * 60;
-    } else if (total_mem <= 512 * 1024) {
-        secs = 60 * 60;
-    } else if (total_mem <= 1024 * 1024) {
-        secs = 120 * 60;
-    } else {
-        secs = 240 * 60; /* max 4 hrs */
-    }
+    secs = get_sanitize_duration(total_mem);
 
     /* EBUSY other bg cmds as of now */
     cci->bg.runtime = secs * 1000UL;

From 40ab4ed107757e1c5bdccc906e8a44cb4e2cb7a4 Mon Sep 17 00:00:00 2001
From: Vinayak Holikatti <vinayak.kh@samsung.com>
Date: Wed, 5 Mar 2025 09:24:56 +0000
Subject: [PATCH 0860/2760] hw/cxl/cxl-mailbox-utils: Media operations Sanitize
 and Write Zeros commands CXL r3.2(8.2.10.9.5.3)

CXL spec 3.2 section 8.2.10.9.5.3 describes media operations commands.
CXL devices supports media operations Sanitize and Write zero command.

Signed-off-by: Vinayak Holikatti <vinayak.kh@samsung.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Message-Id: <20250305092501.191929-6-Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/cxl/cxl-mailbox-utils.c  | 204 ++++++++++++++++++++++++++++++++++++
 include/hw/cxl/cxl_device.h |   4 +
 2 files changed, 208 insertions(+)

diff --git a/hw/cxl/cxl-mailbox-utils.c b/hw/cxl/cxl-mailbox-utils.c
index 9f9d475678..2c6db70e5f 100644
--- a/hw/cxl/cxl-mailbox-utils.c
+++ b/hw/cxl/cxl-mailbox-utils.c
@@ -1715,6 +1715,131 @@ static CXLRetCode cmd_sanitize_overwrite(const struct cxl_cmd *cmd,
     return CXL_MBOX_BG_STARTED;
 }
 
+struct dpa_range_list_entry {
+    uint64_t starting_dpa;
+    uint64_t length;
+} QEMU_PACKED;
+
+struct CXLSanitizeInfo {
+    uint32_t dpa_range_count;
+    uint8_t fill_value;
+    struct dpa_range_list_entry dpa_range_list[];
+} QEMU_PACKED;
+
+static uint64_t get_vmr_size(CXLType3Dev *ct3d, MemoryRegion **vmr)
+{
+    MemoryRegion *mr;
+    if (ct3d->hostvmem) {
+        mr = host_memory_backend_get_memory(ct3d->hostvmem);
+        if (vmr) {
+            *vmr = mr;
+        }
+        return memory_region_size(mr);
+    }
+    return 0;
+}
+
+static uint64_t get_pmr_size(CXLType3Dev *ct3d, MemoryRegion **pmr)
+{
+    MemoryRegion *mr;
+    if (ct3d->hostpmem) {
+        mr = host_memory_backend_get_memory(ct3d->hostpmem);
+        if (pmr) {
+            *pmr = mr;
+        }
+        return memory_region_size(mr);
+    }
+    return 0;
+}
+
+static uint64_t get_dc_size(CXLType3Dev *ct3d, MemoryRegion **dc_mr)
+{
+    MemoryRegion *mr;
+    if (ct3d->dc.host_dc) {
+        mr = host_memory_backend_get_memory(ct3d->dc.host_dc);
+        if (dc_mr) {
+            *dc_mr = mr;
+        }
+        return memory_region_size(mr);
+    }
+    return 0;
+}
+
+static int validate_dpa_addr(CXLType3Dev *ct3d, uint64_t dpa_addr,
+                             size_t length)
+{
+    uint64_t vmr_size, pmr_size, dc_size;
+
+    if ((dpa_addr % CXL_CACHE_LINE_SIZE) ||
+        (length % CXL_CACHE_LINE_SIZE)  ||
+        (length <= 0)) {
+        return -EINVAL;
+    }
+
+    vmr_size = get_vmr_size(ct3d, NULL);
+    pmr_size = get_pmr_size(ct3d, NULL);
+    dc_size = get_dc_size(ct3d, NULL);
+
+    if (dpa_addr + length > vmr_size + pmr_size + dc_size) {
+        return -EINVAL;
+    }
+
+    if (dpa_addr > vmr_size + pmr_size) {
+        if (!ct3_test_region_block_backed(ct3d, dpa_addr, length)) {
+            return -ENODEV;
+        }
+    }
+
+    return 0;
+}
+
+static int sanitize_range(CXLType3Dev *ct3d, uint64_t dpa_addr, size_t length,
+                          uint8_t fill_value)
+{
+
+    uint64_t vmr_size, pmr_size;
+    AddressSpace *as = NULL;
+    MemTxAttrs mem_attrs = {};
+
+    vmr_size = get_vmr_size(ct3d, NULL);
+    pmr_size = get_pmr_size(ct3d, NULL);
+
+    if (dpa_addr < vmr_size) {
+        as = &ct3d->hostvmem_as;
+    } else if (dpa_addr < vmr_size + pmr_size) {
+        as = &ct3d->hostpmem_as;
+    } else {
+        if (!ct3_test_region_block_backed(ct3d, dpa_addr, length)) {
+            return -ENODEV;
+        }
+        as = &ct3d->dc.host_dc_as;
+    }
+
+    return address_space_set(as, dpa_addr, fill_value, length, mem_attrs);
+}
+
+/* Perform the actual device zeroing */
+static void __do_sanitize(CXLType3Dev *ct3d)
+{
+    struct CXLSanitizeInfo  *san_info = ct3d->media_op_sanitize;
+    int dpa_range_count = san_info->dpa_range_count;
+    int rc = 0;
+    int i;
+
+    for (i = 0; i < dpa_range_count; i++) {
+        rc = sanitize_range(ct3d, san_info->dpa_range_list[i].starting_dpa,
+                            san_info->dpa_range_list[i].length,
+                            san_info->fill_value);
+        if (rc) {
+            goto exit;
+        }
+    }
+exit:
+    g_free(ct3d->media_op_sanitize);
+    ct3d->media_op_sanitize = NULL;
+    return;
+}
+
 enum {
     MEDIA_OP_CLASS_GENERAL  = 0x0,
         #define MEDIA_OP_GEN_SUBC_DISCOVERY 0x0
@@ -1799,6 +1924,65 @@ static CXLRetCode media_operations_discovery(uint8_t *payload_in,
     return CXL_MBOX_SUCCESS;
 }
 
+static CXLRetCode media_operations_sanitize(CXLType3Dev *ct3d,
+                                            uint8_t *payload_in,
+                                            size_t len_in,
+                                            uint8_t *payload_out,
+                                            size_t *len_out,
+                                            uint8_t fill_value,
+                                            CXLCCI *cci)
+{
+    struct media_operations_sanitize {
+        uint8_t media_operation_class;
+        uint8_t media_operation_subclass;
+        uint8_t rsvd[2];
+        uint32_t dpa_range_count;
+        struct dpa_range_list_entry dpa_range_list[];
+    } QEMU_PACKED *media_op_in_sanitize_pl = (void *)payload_in;
+    uint32_t dpa_range_count = media_op_in_sanitize_pl->dpa_range_count;
+    uint64_t total_mem = 0;
+    size_t dpa_range_list_size;
+    int secs = 0, i;
+
+    if (dpa_range_count == 0) {
+        return CXL_MBOX_SUCCESS;
+    }
+
+    dpa_range_list_size = dpa_range_count * sizeof(struct dpa_range_list_entry);
+    if (len_in < (sizeof(*media_op_in_sanitize_pl) + dpa_range_list_size)) {
+        return CXL_MBOX_INVALID_PAYLOAD_LENGTH;
+    }
+
+    for (i = 0; i < dpa_range_count; i++) {
+        uint64_t start_dpa =
+            media_op_in_sanitize_pl->dpa_range_list[i].starting_dpa;
+        uint64_t length = media_op_in_sanitize_pl->dpa_range_list[i].length;
+
+        if (validate_dpa_addr(ct3d, start_dpa, length)) {
+            return CXL_MBOX_INVALID_INPUT;
+        }
+        total_mem += length;
+    }
+    ct3d->media_op_sanitize = g_malloc0(sizeof(struct CXLSanitizeInfo) +
+                                        dpa_range_list_size);
+
+    ct3d->media_op_sanitize->dpa_range_count = dpa_range_count;
+    ct3d->media_op_sanitize->fill_value = fill_value;
+    memcpy(ct3d->media_op_sanitize->dpa_range_list,
+           media_op_in_sanitize_pl->dpa_range_list,
+           dpa_range_list_size);
+    secs = get_sanitize_duration(total_mem >> 20);
+
+    /* EBUSY other bg cmds as of now */
+    cci->bg.runtime = secs * 1000UL;
+    *len_out = 0;
+    /*
+     * media op sanitize is targeted so no need to disable media or
+     * clear event logs
+     */
+    return CXL_MBOX_BG_STARTED;
+}
+
 static CXLRetCode cmd_media_operations(const struct cxl_cmd *cmd,
                                        uint8_t *payload_in,
                                        size_t len_in,
@@ -1812,6 +1996,7 @@ static CXLRetCode cmd_media_operations(const struct cxl_cmd *cmd,
         uint8_t rsvd[2];
         uint32_t dpa_range_count;
     } QEMU_PACKED *media_op_in_common_pl = (void *)payload_in;
+    CXLType3Dev *ct3d = CXL_TYPE3(cci->d);
     uint8_t media_op_cl = 0;
     uint8_t media_op_subclass = 0;
 
@@ -1830,6 +2015,19 @@ static CXLRetCode cmd_media_operations(const struct cxl_cmd *cmd,
 
         return media_operations_discovery(payload_in, len_in, payload_out,
                                              len_out);
+    case MEDIA_OP_CLASS_SANITIZE:
+        switch (media_op_subclass) {
+        case MEDIA_OP_SAN_SUBC_SANITIZE:
+            return media_operations_sanitize(ct3d, payload_in, len_in,
+                                             payload_out, len_out, 0xF,
+                                             cci);
+        case MEDIA_OP_SAN_SUBC_ZERO:
+            return media_operations_sanitize(ct3d, payload_in, len_in,
+                                             payload_out, len_out, 0,
+                                             cci);
+        default:
+            return CXL_MBOX_UNSUPPORTED;
+        }
     default:
         return CXL_MBOX_UNSUPPORTED;
     }
@@ -3147,6 +3345,12 @@ static void bg_timercb(void *opaque)
             cxl_dev_enable_media(&ct3d->cxl_dstate);
         }
         break;
+        case 0x4402: /* Media Operations sanitize */
+        {
+            CXLType3Dev *ct3d = CXL_TYPE3(cci->d);
+            __do_sanitize(ct3d);
+        }
+        break;
         case 0x4304: /* scan media */
         {
             CXLType3Dev *ct3d = CXL_TYPE3(cci->d);
diff --git a/include/hw/cxl/cxl_device.h b/include/hw/cxl/cxl_device.h
index d21695507f..3ec7be3809 100644
--- a/include/hw/cxl/cxl_device.h
+++ b/include/hw/cxl/cxl_device.h
@@ -540,6 +540,8 @@ typedef struct CXLSetFeatureInfo {
     size_t data_size;
 } CXLSetFeatureInfo;
 
+struct CXLSanitizeInfo;
+
 struct CXLType3Dev {
     /* Private */
     PCIDevice parent_obj;
@@ -606,6 +608,8 @@ struct CXLType3Dev {
         uint8_t num_regions; /* 0-8 regions */
         CXLDCRegion regions[DCD_MAX_NUM_REGION];
     } dc;
+
+    struct CXLSanitizeInfo *media_op_sanitize;
 };
 
 #define TYPE_CXL_TYPE3 "cxl-type3"

From a3e0b1ff37e930095a417666ab3e12715394fb9b Mon Sep 17 00:00:00 2001
From: Sweta Kumari <s5.kumari@samsung.com>
Date: Wed, 5 Mar 2025 09:24:57 +0000
Subject: [PATCH 0861/2760] hw/cxl/cxl-mailbox-utils: CXL CCI Get/Set alert
 config commands

1) get alert configuration(Opcode 4201h)
2) set alert configuration(Opcode 4202h)

Signed-off-by: Sweta Kumari <s5.kumari@samsung.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Message-Id: <20250305092501.191929-7-Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/cxl/cxl-mailbox-utils.c  | 105 ++++++++++++++++++++++++++++++++++++
 hw/mem/cxl_type3.c          |  14 +++++
 include/hw/cxl/cxl_device.h |  15 ++++++
 3 files changed, 134 insertions(+)

diff --git a/hw/cxl/cxl-mailbox-utils.c b/hw/cxl/cxl-mailbox-utils.c
index 2c6db70e5f..299f232f26 100644
--- a/hw/cxl/cxl-mailbox-utils.c
+++ b/hw/cxl/cxl-mailbox-utils.c
@@ -28,6 +28,11 @@
 #define CXL_DC_EVENT_LOG_SIZE 8
 #define CXL_NUM_EXTENTS_SUPPORTED 512
 #define CXL_NUM_TAGS_SUPPORTED 0
+#define CXL_ALERTS_LIFE_USED_WARN_THRESH (1 << 0)
+#define CXL_ALERTS_OVER_TEMP_WARN_THRESH (1 << 1)
+#define CXL_ALERTS_UNDER_TEMP_WARN_THRESH (1 << 2)
+#define CXL_ALERTS_COR_VMEM_ERR_WARN_THRESH (1 << 3)
+#define CXL_ALERTS_COR_PMEM_ERR_WARN_THRESH (1 << 4)
 
 /*
  * How to add a new command, example. The command set FOO, with cmd BAR.
@@ -86,6 +91,9 @@ enum {
         #define GET_PARTITION_INFO     0x0
         #define GET_LSA       0x2
         #define SET_LSA       0x3
+    HEALTH_INFO_ALERTS = 0x42,
+        #define GET_ALERT_CONFIG 0x1
+        #define SET_ALERT_CONFIG 0x2
     SANITIZE    = 0x44,
         #define OVERWRITE     0x0
         #define SECURE_ERASE  0x1
@@ -1610,6 +1618,97 @@ static CXLRetCode cmd_ccls_set_lsa(const struct cxl_cmd *cmd,
     return CXL_MBOX_SUCCESS;
 }
 
+/* CXL r3.2 Section 8.2.10.9.3.2 Get Alert Configuration (Opcode 4201h) */
+static CXLRetCode cmd_get_alert_config(const struct cxl_cmd *cmd,
+                                       uint8_t *payload_in,
+                                       size_t len_in,
+                                       uint8_t *payload_out,
+                                       size_t *len_out,
+                                       CXLCCI *cci)
+{
+    CXLType3Dev *ct3d = CXL_TYPE3(cci->d);
+    CXLAlertConfig *out = (CXLAlertConfig *)payload_out;
+
+    memcpy(out, &ct3d->alert_config, sizeof(ct3d->alert_config));
+    *len_out = sizeof(ct3d->alert_config);
+
+    return CXL_MBOX_SUCCESS;
+}
+
+/* CXL r3.2 Section 8.2.10.9.3.3 Set Alert Configuration (Opcode 4202h) */
+static CXLRetCode cmd_set_alert_config(const struct cxl_cmd *cmd,
+                                       uint8_t *payload_in,
+                                       size_t len_in,
+                                       uint8_t *payload_out,
+                                       size_t *len_out,
+                                       CXLCCI *cci)
+{
+    CXLType3Dev *ct3d = CXL_TYPE3(cci->d);
+    CXLAlertConfig *alert_config = &ct3d->alert_config;
+    struct {
+        uint8_t valid_alert_actions;
+        uint8_t enable_alert_actions;
+        uint8_t life_used_warn_thresh;
+        uint8_t rsvd;
+        uint16_t over_temp_warn_thresh;
+        uint16_t under_temp_warn_thresh;
+        uint16_t cor_vmem_err_warn_thresh;
+        uint16_t cor_pmem_err_warn_thresh;
+    } QEMU_PACKED *in = (void *)payload_in;
+
+    if (in->valid_alert_actions & CXL_ALERTS_LIFE_USED_WARN_THRESH) {
+        /*
+         * CXL r3.2 Table 8-149 The life used warning threshold shall be
+         * less than the life used critical alert value.
+         */
+        if (in->life_used_warn_thresh >=
+            alert_config->life_used_crit_alert_thresh) {
+            return CXL_MBOX_INVALID_INPUT;
+        }
+        alert_config->life_used_warn_thresh = in->life_used_warn_thresh;
+        alert_config->enable_alerts |= CXL_ALERTS_LIFE_USED_WARN_THRESH;
+    }
+
+    if (in->valid_alert_actions & CXL_ALERTS_OVER_TEMP_WARN_THRESH) {
+        /*
+         * CXL r3.2 Table 8-149 The Device Over-Temperature Warning Threshold
+         * shall be less than the the Device Over-Temperature Critical
+         * Alert Threshold.
+         */
+        if (in->over_temp_warn_thresh >=
+            alert_config->over_temp_crit_alert_thresh) {
+            return CXL_MBOX_INVALID_INPUT;
+        }
+        alert_config->over_temp_warn_thresh = in->over_temp_warn_thresh;
+        alert_config->enable_alerts |= CXL_ALERTS_OVER_TEMP_WARN_THRESH;
+    }
+
+    if (in->valid_alert_actions & CXL_ALERTS_UNDER_TEMP_WARN_THRESH) {
+        /*
+         * CXL r3.2 Table 8-149 The Device Under-Temperature Warning Threshold
+         * shall be higher than the the Device Under-Temperature Critical
+         * Alert Threshold.
+         */
+        if (in->under_temp_warn_thresh <=
+            alert_config->under_temp_crit_alert_thresh) {
+            return CXL_MBOX_INVALID_INPUT;
+        }
+        alert_config->under_temp_warn_thresh = in->under_temp_warn_thresh;
+        alert_config->enable_alerts |= CXL_ALERTS_UNDER_TEMP_WARN_THRESH;
+    }
+
+    if (in->valid_alert_actions & CXL_ALERTS_COR_VMEM_ERR_WARN_THRESH) {
+        alert_config->cor_vmem_err_warn_thresh = in->cor_vmem_err_warn_thresh;
+        alert_config->enable_alerts |= CXL_ALERTS_COR_VMEM_ERR_WARN_THRESH;
+    }
+
+    if (in->valid_alert_actions & CXL_ALERTS_COR_PMEM_ERR_WARN_THRESH) {
+        alert_config->cor_pmem_err_warn_thresh = in->cor_pmem_err_warn_thresh;
+        alert_config->enable_alerts |= CXL_ALERTS_COR_PMEM_ERR_WARN_THRESH;
+    }
+    return CXL_MBOX_SUCCESS;
+}
+
 /* Perform the actual device zeroing */
 static void __do_sanitization(CXLType3Dev *ct3d)
 {
@@ -3173,6 +3272,12 @@ static const struct cxl_cmd cxl_cmd_set[256][256] = {
     [CCLS][GET_LSA] = { "CCLS_GET_LSA", cmd_ccls_get_lsa, 8, 0 },
     [CCLS][SET_LSA] = { "CCLS_SET_LSA", cmd_ccls_set_lsa,
         ~0, CXL_MBOX_IMMEDIATE_CONFIG_CHANGE | CXL_MBOX_IMMEDIATE_DATA_CHANGE },
+    [HEALTH_INFO_ALERTS][GET_ALERT_CONFIG] = {
+        "HEALTH_INFO_ALERTS_GET_ALERT_CONFIG",
+        cmd_get_alert_config, 0, 0 },
+    [HEALTH_INFO_ALERTS][SET_ALERT_CONFIG] = {
+        "HEALTH_INFO_ALERTS_SET_ALERT_CONFIG",
+        cmd_set_alert_config, 12, CXL_MBOX_IMMEDIATE_POLICY_CHANGE },
     [SANITIZE][OVERWRITE] = { "SANITIZE_OVERWRITE", cmd_sanitize_overwrite, 0,
         (CXL_MBOX_IMMEDIATE_DATA_CHANGE |
          CXL_MBOX_SECURITY_STATE_CHANGE |
diff --git a/hw/mem/cxl_type3.c b/hw/mem/cxl_type3.c
index aacd078118..94e7274912 100644
--- a/hw/mem/cxl_type3.c
+++ b/hw/mem/cxl_type3.c
@@ -843,6 +843,19 @@ static DOEProtocol doe_cdat_prot[] = {
     { }
 };
 
+/* Initialize CXL device alerts with default threshold values. */
+static void init_alert_config(CXLType3Dev *ct3d)
+{
+    ct3d->alert_config = (CXLAlertConfig) {
+        .life_used_crit_alert_thresh = 75,
+        .life_used_warn_thresh = 40,
+        .over_temp_crit_alert_thresh = 35,
+        .under_temp_crit_alert_thresh = 10,
+        .over_temp_warn_thresh = 25,
+        .under_temp_warn_thresh = 20
+    };
+}
+
 static void ct3_realize(PCIDevice *pci_dev, Error **errp)
 {
     ERRP_GUARD();
@@ -910,6 +923,7 @@ static void ct3_realize(PCIDevice *pci_dev, Error **errp)
         goto err_msix_uninit;
     }
 
+    init_alert_config(ct3d);
     pcie_cap_deverr_init(pci_dev);
     /* Leave a bit of room for expansion */
     rc = pcie_aer_init(pci_dev, PCI_ERR_VER, 0x200, PCI_ERR_SIZEOF, errp);
diff --git a/include/hw/cxl/cxl_device.h b/include/hw/cxl/cxl_device.h
index 3ec7be3809..ed6cd50c67 100644
--- a/include/hw/cxl/cxl_device.h
+++ b/include/hw/cxl/cxl_device.h
@@ -542,6 +542,19 @@ typedef struct CXLSetFeatureInfo {
 
 struct CXLSanitizeInfo;
 
+typedef struct CXLAlertConfig {
+    uint8_t valid_alerts;
+    uint8_t enable_alerts;
+    uint8_t life_used_crit_alert_thresh;
+    uint8_t life_used_warn_thresh;
+    uint16_t over_temp_crit_alert_thresh;
+    uint16_t under_temp_crit_alert_thresh;
+    uint16_t over_temp_warn_thresh;
+    uint16_t under_temp_warn_thresh;
+    uint16_t cor_vmem_err_warn_thresh;
+    uint16_t cor_pmem_err_warn_thresh;
+} QEMU_PACKED CXLAlertConfig;
+
 struct CXLType3Dev {
     /* Private */
     PCIDevice parent_obj;
@@ -563,6 +576,8 @@ struct CXLType3Dev {
     CXLCCI vdm_fm_owned_ld_mctp_cci;
     CXLCCI ld0_cci;
 
+    CXLAlertConfig alert_config;
+
     /* PCIe link characteristics */
     PCIExpLinkSpeed speed;
     PCIExpLinkWidth width;

From abde58f8644491503c058c2ff0775613f251c8e6 Mon Sep 17 00:00:00 2001
From: Yuquan Wang <wangyuquan1236@phytium.com.cn>
Date: Wed, 5 Mar 2025 09:24:59 +0000
Subject: [PATCH 0862/2760] docs/cxl: Add serial number for persistent-memdev

Add serial number parameter in the cxl persistent examples.

Signed-off-by: Yuquan Wang <wangyuquan1236@phytium.com.cn>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Message-Id: <20250305092501.191929-9-Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 docs/system/devices/cxl.rst | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/docs/system/devices/cxl.rst b/docs/system/devices/cxl.rst
index 882b036f5e..e307caf3f8 100644
--- a/docs/system/devices/cxl.rst
+++ b/docs/system/devices/cxl.rst
@@ -308,7 +308,7 @@ A very simple setup with just one directly attached CXL Type 3 Persistent Memory
   -object memory-backend-file,id=cxl-lsa1,share=on,mem-path=/tmp/lsa.raw,size=256M \
   -device pxb-cxl,bus_nr=12,bus=pcie.0,id=cxl.1 \
   -device cxl-rp,port=0,bus=cxl.1,id=root_port13,chassis=0,slot=2 \
-  -device cxl-type3,bus=root_port13,persistent-memdev=cxl-mem1,lsa=cxl-lsa1,id=cxl-pmem0 \
+  -device cxl-type3,bus=root_port13,persistent-memdev=cxl-mem1,lsa=cxl-lsa1,id=cxl-pmem0,sn=0x1 \
   -M cxl-fmw.0.targets.0=cxl.1,cxl-fmw.0.size=4G
 
 A very simple setup with just one directly attached CXL Type 3 Volatile Memory device::
@@ -349,13 +349,13 @@ the CXL Type3 device directly attached (no switches).::
   -device pxb-cxl,bus_nr=12,bus=pcie.0,id=cxl.1 \
   -device pxb-cxl,bus_nr=222,bus=pcie.0,id=cxl.2 \
   -device cxl-rp,port=0,bus=cxl.1,id=root_port13,chassis=0,slot=2 \
-  -device cxl-type3,bus=root_port13,persistent-memdev=cxl-mem1,lsa=cxl-lsa1,id=cxl-pmem0 \
+  -device cxl-type3,bus=root_port13,persistent-memdev=cxl-mem1,lsa=cxl-lsa1,id=cxl-pmem0,sn=0x1 \
   -device cxl-rp,port=1,bus=cxl.1,id=root_port14,chassis=0,slot=3 \
-  -device cxl-type3,bus=root_port14,persistent-memdev=cxl-mem2,lsa=cxl-lsa2,id=cxl-pmem1 \
+  -device cxl-type3,bus=root_port14,persistent-memdev=cxl-mem2,lsa=cxl-lsa2,id=cxl-pmem1,sn=0x2 \
   -device cxl-rp,port=0,bus=cxl.2,id=root_port15,chassis=0,slot=5 \
-  -device cxl-type3,bus=root_port15,persistent-memdev=cxl-mem3,lsa=cxl-lsa3,id=cxl-pmem2 \
+  -device cxl-type3,bus=root_port15,persistent-memdev=cxl-mem3,lsa=cxl-lsa3,id=cxl-pmem2,sn=0x3 \
   -device cxl-rp,port=1,bus=cxl.2,id=root_port16,chassis=0,slot=6 \
-  -device cxl-type3,bus=root_port16,persistent-memdev=cxl-mem4,lsa=cxl-lsa4,id=cxl-pmem3 \
+  -device cxl-type3,bus=root_port16,persistent-memdev=cxl-mem4,lsa=cxl-lsa4,id=cxl-pmem3,sn=0x4 \
   -M cxl-fmw.0.targets.0=cxl.1,cxl-fmw.0.targets.1=cxl.2,cxl-fmw.0.size=4G,cxl-fmw.0.interleave-granularity=8k
 
 An example of 4 devices below a switch suitable for 1, 2 or 4 way interleave::
@@ -375,13 +375,13 @@ An example of 4 devices below a switch suitable for 1, 2 or 4 way interleave::
   -device cxl-rp,port=1,bus=cxl.1,id=root_port1,chassis=0,slot=1 \
   -device cxl-upstream,bus=root_port0,id=us0 \
   -device cxl-downstream,port=0,bus=us0,id=swport0,chassis=0,slot=4 \
-  -device cxl-type3,bus=swport0,persistent-memdev=cxl-mem0,lsa=cxl-lsa0,id=cxl-pmem0 \
+  -device cxl-type3,bus=swport0,persistent-memdev=cxl-mem0,lsa=cxl-lsa0,id=cxl-pmem0,sn=0x1 \
   -device cxl-downstream,port=1,bus=us0,id=swport1,chassis=0,slot=5 \
-  -device cxl-type3,bus=swport1,persistent-memdev=cxl-mem1,lsa=cxl-lsa1,id=cxl-pmem1 \
+  -device cxl-type3,bus=swport1,persistent-memdev=cxl-mem1,lsa=cxl-lsa1,id=cxl-pmem1,sn=0x2 \
   -device cxl-downstream,port=2,bus=us0,id=swport2,chassis=0,slot=6 \
-  -device cxl-type3,bus=swport2,persistent-memdev=cxl-mem2,lsa=cxl-lsa2,id=cxl-pmem2 \
+  -device cxl-type3,bus=swport2,persistent-memdev=cxl-mem2,lsa=cxl-lsa2,id=cxl-pmem2,sn=0x3 \
   -device cxl-downstream,port=3,bus=us0,id=swport3,chassis=0,slot=7 \
-  -device cxl-type3,bus=swport3,persistent-memdev=cxl-mem3,lsa=cxl-lsa3,id=cxl-pmem3 \
+  -device cxl-type3,bus=swport3,persistent-memdev=cxl-mem3,lsa=cxl-lsa3,id=cxl-pmem3,sn=0x4 \
   -M cxl-fmw.0.targets.0=cxl.1,cxl-fmw.0.size=4G,cxl-fmw.0.interleave-granularity=4k
 
 Deprecations

From 3a031e395dc65239d031890d038bc354af61dc35 Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <akihiko.odaki@daynix.com>
Date: Fri, 14 Mar 2025 15:14:50 +0900
Subject: [PATCH 0863/2760] hw/pci: Do not add ROM BAR for SR-IOV VF

A SR-IOV VF cannot have a ROM BAR.

Co-developed-by: Yui Washizu <yui.washidu@gmail.com>
Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Message-Id: <20250314-sriov-v9-1-57dae8ae3ab5@daynix.com>
Tested-by: Yui Washizu <yui.washidu@gmail.com>
Tested-by: Pasha Tatashin <pasha.tatashin@soleen.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/pci/pci.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/hw/pci/pci.c b/hw/pci/pci.c
index fe38c4c028..6d9d3ce90f 100644
--- a/hw/pci/pci.c
+++ b/hw/pci/pci.c
@@ -2522,6 +2522,14 @@ static void pci_add_option_rom(PCIDevice *pdev, bool is_default_rom,
         return;
     }
 
+    if (pci_is_vf(pdev)) {
+        if (pdev->rom_bar > 0) {
+            error_setg(errp, "ROM BAR cannot be enabled for SR-IOV VF");
+        }
+
+        return;
+    }
+
     if (load_file || pdev->romsize == UINT32_MAX) {
         path = qemu_find_file(QEMU_FILE_TYPE_BIOS, pdev->romfile);
         if (path == NULL) {

From a5745ac183e606937f22bfbf59a7f18e74f3c464 Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <akihiko.odaki@daynix.com>
Date: Fri, 14 Mar 2025 15:14:51 +0900
Subject: [PATCH 0864/2760] hw/pci: Fix SR-IOV VF number calculation

pci_config_get_bar_addr() had a division by vf_stride. vf_stride needs
to be non-zero when there are multiple VFs, but the specification does
not prohibit to make it zero when there is only one VF.

Do not perform the division for the first VF to avoid division by zero.

Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Message-Id: <20250314-sriov-v9-2-57dae8ae3ab5@daynix.com>
Tested-by: Yui Washizu <yui.washidu@gmail.com>
Tested-by: Pasha Tatashin <pasha.tatashin@soleen.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/pci/pci.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/hw/pci/pci.c b/hw/pci/pci.c
index 6d9d3ce90f..039cf1e256 100644
--- a/hw/pci/pci.c
+++ b/hw/pci/pci.c
@@ -1594,7 +1594,11 @@ static pcibus_t pci_config_get_bar_addr(PCIDevice *d, int reg,
             pci_get_word(pf->config + sriov_cap + PCI_SRIOV_VF_OFFSET);
         uint16_t vf_stride =
             pci_get_word(pf->config + sriov_cap + PCI_SRIOV_VF_STRIDE);
-        uint32_t vf_num = (d->devfn - (pf->devfn + vf_offset)) / vf_stride;
+        uint32_t vf_num = d->devfn - (pf->devfn + vf_offset);
+
+        if (vf_num) {
+            vf_num /= vf_stride;
+        }
 
         if (type & PCI_BASE_ADDRESS_MEM_TYPE_64) {
             new_addr = pci_get_quad(pf->config + bar);

From 92b6ce3dba26bd3734b528bda7f9a9dee2ee7bb4 Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <akihiko.odaki@daynix.com>
Date: Fri, 14 Mar 2025 15:14:52 +0900
Subject: [PATCH 0865/2760] pcie_sriov: Ensure PF and VF are mutually exclusive

A device cannot be a SR-IOV PF and a VF at the same time.

Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Message-Id: <20250314-sriov-v9-3-57dae8ae3ab5@daynix.com>
Tested-by: Yui Washizu <yui.washidu@gmail.com>
Tested-by: Pasha Tatashin <pasha.tatashin@soleen.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/pci/pcie_sriov.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/hw/pci/pcie_sriov.c b/hw/pci/pcie_sriov.c
index 1eb4358256..109b2ebccc 100644
--- a/hw/pci/pcie_sriov.c
+++ b/hw/pci/pcie_sriov.c
@@ -42,6 +42,11 @@ bool pcie_sriov_pf_init(PCIDevice *dev, uint16_t offset,
     uint8_t *cfg = dev->config + offset;
     uint8_t *wmask;
 
+    if (pci_is_vf(dev)) {
+        error_setg(errp, "a device cannot be a SR-IOV PF and a VF at the same time");
+        return false;
+    }
+
     if (total_vfs &&
         (uint32_t)devfn + (uint32_t)(total_vfs - 1) * vf_stride >= PCI_DEVFN_MAX) {
         error_setg(errp, "VF addr overflows");

From d2f5bb7849e463646173564fdadf40e32a32bf6e Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <akihiko.odaki@daynix.com>
Date: Fri, 14 Mar 2025 15:14:53 +0900
Subject: [PATCH 0866/2760] pcie_sriov: Check PCI Express for SR-IOV PF

SR-IOV requires PCI Express.

Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Message-Id: <20250314-sriov-v9-4-57dae8ae3ab5@daynix.com>
Tested-by: Yui Washizu <yui.washidu@gmail.com>
Tested-by: Pasha Tatashin <pasha.tatashin@soleen.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/pci/pcie_sriov.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/hw/pci/pcie_sriov.c b/hw/pci/pcie_sriov.c
index 109b2ebccc..a5b546abe8 100644
--- a/hw/pci/pcie_sriov.c
+++ b/hw/pci/pcie_sriov.c
@@ -42,6 +42,11 @@ bool pcie_sriov_pf_init(PCIDevice *dev, uint16_t offset,
     uint8_t *cfg = dev->config + offset;
     uint8_t *wmask;
 
+    if (!pci_is_express(dev)) {
+        error_setg(errp, "PCI Express is required for SR-IOV PF");
+        return false;
+    }
+
     if (pci_is_vf(dev)) {
         error_setg(errp, "a device cannot be a SR-IOV PF and a VF at the same time");
         return false;

From 19e55471d4e8a494cfda7470e701829e3a873bdc Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <akihiko.odaki@daynix.com>
Date: Fri, 14 Mar 2025 15:14:54 +0900
Subject: [PATCH 0867/2760] pcie_sriov: Allow user to create SR-IOV device

A user can create a SR-IOV device by specifying the PF with the
sriov-pf property of the VFs. The VFs must be added before the PF.

A user-creatable VF must have PCIDeviceClass::sriov_vf_user_creatable
set. Such a VF cannot refer to the PF because it is created before the
PF.

A PF that user-creatable VFs can be attached calls
pcie_sriov_pf_init_from_user_created_vfs() during realization and
pcie_sriov_pf_exit() when exiting.

Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Message-Id: <20250314-sriov-v9-5-57dae8ae3ab5@daynix.com>
Tested-by: Yui Washizu <yui.washidu@gmail.com>
Tested-by: Pasha Tatashin <pasha.tatashin@soleen.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/pci/pci.c                |  62 +++++---
 hw/pci/pcie_sriov.c         | 288 ++++++++++++++++++++++++++++--------
 include/hw/pci/pci_device.h |   6 +-
 include/hw/pci/pcie_sriov.h |  18 +++
 4 files changed, 291 insertions(+), 83 deletions(-)

diff --git a/hw/pci/pci.c b/hw/pci/pci.c
index 039cf1e256..de07096347 100644
--- a/hw/pci/pci.c
+++ b/hw/pci/pci.c
@@ -101,6 +101,7 @@ static const Property pci_props[] = {
                     QEMU_PCIE_ARI_NEXTFN_1_BITNR, false),
     DEFINE_PROP_SIZE32("x-max-bounce-buffer-size", PCIDevice,
                      max_bounce_buffer_size, DEFAULT_MAX_BOUNCE_BUFFER_SIZE),
+    DEFINE_PROP_STRING("sriov-pf", PCIDevice, sriov_pf),
     DEFINE_PROP_BIT("x-pcie-ext-tag", PCIDevice, cap_present,
                     QEMU_PCIE_EXT_TAG_BITNR, true),
     { .name = "busnr", .info = &prop_pci_busnr },
@@ -1112,13 +1113,8 @@ static void pci_init_multifunction(PCIBus *bus, PCIDevice *dev, Error **errp)
         dev->config[PCI_HEADER_TYPE] |= PCI_HEADER_TYPE_MULTI_FUNCTION;
     }
 
-    /*
-     * With SR/IOV and ARI, a device at function 0 need not be a multifunction
-     * device, as it may just be a VF that ended up with function 0 in
-     * the legacy PCI interpretation. Avoid failing in such cases:
-     */
-    if (pci_is_vf(dev) &&
-        dev->exp.sriov_vf.pf->cap_present & QEMU_PCI_CAP_MULTIFUNCTION) {
+    /* SR/IOV is not handled here. */
+    if (pci_is_vf(dev)) {
         return;
     }
 
@@ -1151,7 +1147,8 @@ static void pci_init_multifunction(PCIBus *bus, PCIDevice *dev, Error **errp)
     }
     /* function 0 indicates single function, so function > 0 must be NULL */
     for (func = 1; func < PCI_FUNC_MAX; ++func) {
-        if (bus->devices[PCI_DEVFN(slot, func)]) {
+        PCIDevice *device = bus->devices[PCI_DEVFN(slot, func)];
+        if (device && !pci_is_vf(device)) {
             error_setg(errp, "PCI: %x.0 indicates single function, "
                        "but %x.%x is already populated.",
                        slot, slot, func);
@@ -1439,6 +1436,7 @@ static void pci_qdev_unrealize(DeviceState *dev)
 
     pci_unregister_io_regions(pci_dev);
     pci_del_option_rom(pci_dev);
+    pcie_sriov_unregister_device(pci_dev);
 
     if (pc->exit) {
         pc->exit(pci_dev);
@@ -1470,7 +1468,6 @@ void pci_register_bar(PCIDevice *pci_dev, int region_num,
     pcibus_t size = memory_region_size(memory);
     uint8_t hdr_type;
 
-    assert(!pci_is_vf(pci_dev)); /* VFs must use pcie_sriov_vf_register_bar */
     assert(region_num >= 0);
     assert(region_num < PCI_NUM_REGIONS);
     assert(is_power_of_2(size));
@@ -1482,7 +1479,6 @@ void pci_register_bar(PCIDevice *pci_dev, int region_num,
 
     r = &pci_dev->io_regions[region_num];
     assert(!r->size);
-    r->addr = PCI_BAR_UNMAPPED;
     r->size = size;
     r->type = type;
     r->memory = memory;
@@ -1490,22 +1486,35 @@ void pci_register_bar(PCIDevice *pci_dev, int region_num,
                         ? pci_get_bus(pci_dev)->address_space_io
                         : pci_get_bus(pci_dev)->address_space_mem;
 
-    wmask = ~(size - 1);
-    if (region_num == PCI_ROM_SLOT) {
-        /* ROM enable bit is writable */
-        wmask |= PCI_ROM_ADDRESS_ENABLE;
-    }
+    if (pci_is_vf(pci_dev)) {
+        PCIDevice *pf = pci_dev->exp.sriov_vf.pf;
+        assert(!pf || type == pf->exp.sriov_pf.vf_bar_type[region_num]);
 
-    addr = pci_bar(pci_dev, region_num);
-    pci_set_long(pci_dev->config + addr, type);
-
-    if (!(r->type & PCI_BASE_ADDRESS_SPACE_IO) &&
-        r->type & PCI_BASE_ADDRESS_MEM_TYPE_64) {
-        pci_set_quad(pci_dev->wmask + addr, wmask);
-        pci_set_quad(pci_dev->cmask + addr, ~0ULL);
+        r->addr = pci_bar_address(pci_dev, region_num, r->type, r->size);
+        if (r->addr != PCI_BAR_UNMAPPED) {
+            memory_region_add_subregion_overlap(r->address_space,
+                                                r->addr, r->memory, 1);
+        }
     } else {
-        pci_set_long(pci_dev->wmask + addr, wmask & 0xffffffff);
-        pci_set_long(pci_dev->cmask + addr, 0xffffffff);
+        r->addr = PCI_BAR_UNMAPPED;
+
+        wmask = ~(size - 1);
+        if (region_num == PCI_ROM_SLOT) {
+            /* ROM enable bit is writable */
+            wmask |= PCI_ROM_ADDRESS_ENABLE;
+        }
+
+        addr = pci_bar(pci_dev, region_num);
+        pci_set_long(pci_dev->config + addr, type);
+
+        if (!(r->type & PCI_BASE_ADDRESS_SPACE_IO) &&
+            r->type & PCI_BASE_ADDRESS_MEM_TYPE_64) {
+            pci_set_quad(pci_dev->wmask + addr, wmask);
+            pci_set_quad(pci_dev->cmask + addr, ~0ULL);
+        } else {
+            pci_set_long(pci_dev->wmask + addr, wmask & 0xffffffff);
+            pci_set_long(pci_dev->cmask + addr, 0xffffffff);
+        }
     }
 }
 
@@ -2272,6 +2281,11 @@ static void pci_qdev_realize(DeviceState *qdev, Error **errp)
         }
     }
 
+    if (!pcie_sriov_register_device(pci_dev, errp)) {
+        pci_qdev_unrealize(DEVICE(pci_dev));
+        return;
+    }
+
     /*
      * A PCIe Downstream Port that do not have ARI Forwarding enabled must
      * associate only Device 0 with the device attached to the bus
diff --git a/hw/pci/pcie_sriov.c b/hw/pci/pcie_sriov.c
index a5b546abe8..08f707e847 100644
--- a/hw/pci/pcie_sriov.c
+++ b/hw/pci/pcie_sriov.c
@@ -15,11 +15,12 @@
 #include "hw/pci/pcie.h"
 #include "hw/pci/pci_bus.h"
 #include "hw/qdev-properties.h"
-#include "qemu/error-report.h"
 #include "qemu/range.h"
 #include "qapi/error.h"
 #include "trace.h"
 
+static GHashTable *pfs;
+
 static void unparent_vfs(PCIDevice *dev, uint16_t total_vfs)
 {
     for (uint16_t i = 0; i < total_vfs; i++) {
@@ -31,13 +32,43 @@ static void unparent_vfs(PCIDevice *dev, uint16_t total_vfs)
     dev->exp.sriov_pf.vf = NULL;
 }
 
-bool pcie_sriov_pf_init(PCIDevice *dev, uint16_t offset,
-                        const char *vfname, uint16_t vf_dev_id,
-                        uint16_t init_vfs, uint16_t total_vfs,
-                        uint16_t vf_offset, uint16_t vf_stride,
-                        Error **errp)
+static void register_vfs(PCIDevice *dev)
+{
+    uint16_t num_vfs;
+    uint16_t i;
+    uint16_t sriov_cap = dev->exp.sriov_cap;
+
+    assert(sriov_cap > 0);
+    num_vfs = pci_get_word(dev->config + sriov_cap + PCI_SRIOV_NUM_VF);
+
+    trace_sriov_register_vfs(dev->name, PCI_SLOT(dev->devfn),
+                             PCI_FUNC(dev->devfn), num_vfs);
+    for (i = 0; i < num_vfs; i++) {
+        pci_set_enabled(dev->exp.sriov_pf.vf[i], true);
+    }
+
+    pci_set_word(dev->wmask + sriov_cap + PCI_SRIOV_NUM_VF, 0);
+}
+
+static void unregister_vfs(PCIDevice *dev)
+{
+    uint8_t *cfg = dev->config + dev->exp.sriov_cap;
+    uint16_t i;
+
+    trace_sriov_unregister_vfs(dev->name, PCI_SLOT(dev->devfn),
+                               PCI_FUNC(dev->devfn));
+    for (i = 0; i < pci_get_word(cfg + PCI_SRIOV_TOTAL_VF); i++) {
+        pci_set_enabled(dev->exp.sriov_pf.vf[i], false);
+    }
+
+    pci_set_word(dev->wmask + dev->exp.sriov_cap + PCI_SRIOV_NUM_VF, 0xffff);
+}
+
+static bool pcie_sriov_pf_init_common(PCIDevice *dev, uint16_t offset,
+                                      uint16_t vf_dev_id, uint16_t init_vfs,
+                                      uint16_t total_vfs, uint16_t vf_offset,
+                                      uint16_t vf_stride, Error **errp)
 {
-    BusState *bus = qdev_get_parent_bus(&dev->qdev);
     int32_t devfn = dev->devfn + vf_offset;
     uint8_t *cfg = dev->config + offset;
     uint8_t *wmask;
@@ -94,6 +125,28 @@ bool pcie_sriov_pf_init(PCIDevice *dev, uint16_t offset,
 
     qdev_prop_set_bit(&dev->qdev, "multifunction", true);
 
+    return true;
+}
+
+bool pcie_sriov_pf_init(PCIDevice *dev, uint16_t offset,
+                        const char *vfname, uint16_t vf_dev_id,
+                        uint16_t init_vfs, uint16_t total_vfs,
+                        uint16_t vf_offset, uint16_t vf_stride,
+                        Error **errp)
+{
+    BusState *bus = qdev_get_parent_bus(&dev->qdev);
+    int32_t devfn = dev->devfn + vf_offset;
+
+    if (pfs && g_hash_table_contains(pfs, dev->qdev.id)) {
+        error_setg(errp, "attaching user-created SR-IOV VF unsupported");
+        return false;
+    }
+
+    if (!pcie_sriov_pf_init_common(dev, offset, vf_dev_id, init_vfs,
+                                   total_vfs, vf_offset, vf_stride, errp)) {
+        return false;
+    }
+
     dev->exp.sriov_pf.vf = g_new(PCIDevice *, total_vfs);
 
     for (uint16_t i = 0; i < total_vfs; i++) {
@@ -123,7 +176,22 @@ void pcie_sriov_pf_exit(PCIDevice *dev)
 {
     uint8_t *cfg = dev->config + dev->exp.sriov_cap;
 
-    unparent_vfs(dev, pci_get_word(cfg + PCI_SRIOV_TOTAL_VF));
+    if (dev->exp.sriov_pf.vf_user_created) {
+        uint16_t ven_id = pci_get_word(dev->config + PCI_VENDOR_ID);
+        uint16_t total_vfs = pci_get_word(dev->config + PCI_SRIOV_TOTAL_VF);
+        uint16_t vf_dev_id = pci_get_word(dev->config + PCI_SRIOV_VF_DID);
+
+        unregister_vfs(dev);
+
+        for (uint16_t i = 0; i < total_vfs; i++) {
+            dev->exp.sriov_pf.vf[i]->exp.sriov_vf.pf = NULL;
+
+            pci_config_set_vendor_id(dev->exp.sriov_pf.vf[i]->config, ven_id);
+            pci_config_set_device_id(dev->exp.sriov_pf.vf[i]->config, vf_dev_id);
+        }
+    } else {
+        unparent_vfs(dev, pci_get_word(cfg + PCI_SRIOV_TOTAL_VF));
+    }
 }
 
 void pcie_sriov_pf_init_vf_bar(PCIDevice *dev, int region_num,
@@ -156,69 +224,173 @@ void pcie_sriov_pf_init_vf_bar(PCIDevice *dev, int region_num,
 void pcie_sriov_vf_register_bar(PCIDevice *dev, int region_num,
                                 MemoryRegion *memory)
 {
-    PCIIORegion *r;
-    PCIBus *bus = pci_get_bus(dev);
     uint8_t type;
-    pcibus_t size = memory_region_size(memory);
 
-    assert(pci_is_vf(dev)); /* PFs must use pci_register_bar */
-    assert(region_num >= 0);
-    assert(region_num < PCI_NUM_REGIONS);
+    assert(dev->exp.sriov_vf.pf);
     type = dev->exp.sriov_vf.pf->exp.sriov_pf.vf_bar_type[region_num];
 
-    if (!is_power_of_2(size)) {
-        error_report("%s: PCI region size must be a power"
-                     " of two - type=0x%x, size=0x%"FMT_PCIBUS,
-                     __func__, type, size);
-        exit(1);
-    }
-
-    r = &dev->io_regions[region_num];
-    r->memory = memory;
-    r->address_space =
-        type & PCI_BASE_ADDRESS_SPACE_IO
-        ? bus->address_space_io
-        : bus->address_space_mem;
-    r->size = size;
-    r->type = type;
-
-    r->addr = pci_bar_address(dev, region_num, r->type, r->size);
-    if (r->addr != PCI_BAR_UNMAPPED) {
-        memory_region_add_subregion_overlap(r->address_space,
-                                            r->addr, r->memory, 1);
-    }
+    return pci_register_bar(dev, region_num, type, memory);
 }
 
-static void register_vfs(PCIDevice *dev)
+static gint compare_vf_devfns(gconstpointer a, gconstpointer b)
 {
-    uint16_t num_vfs;
-    uint16_t i;
-    uint16_t sriov_cap = dev->exp.sriov_cap;
-
-    assert(sriov_cap > 0);
-    num_vfs = pci_get_word(dev->config + sriov_cap + PCI_SRIOV_NUM_VF);
-
-    trace_sriov_register_vfs(dev->name, PCI_SLOT(dev->devfn),
-                             PCI_FUNC(dev->devfn), num_vfs);
-    for (i = 0; i < num_vfs; i++) {
-        pci_set_enabled(dev->exp.sriov_pf.vf[i], true);
-    }
-
-    pci_set_word(dev->wmask + sriov_cap + PCI_SRIOV_NUM_VF, 0);
+    return (*(PCIDevice **)a)->devfn - (*(PCIDevice **)b)->devfn;
 }
 
-static void unregister_vfs(PCIDevice *dev)
+int16_t pcie_sriov_pf_init_from_user_created_vfs(PCIDevice *dev,
+                                                 uint16_t offset,
+                                                 Error **errp)
 {
-    uint8_t *cfg = dev->config + dev->exp.sriov_cap;
+    GPtrArray *pf;
+    PCIDevice **vfs;
+    BusState *bus = qdev_get_parent_bus(DEVICE(dev));
+    uint16_t ven_id = pci_get_word(dev->config + PCI_VENDOR_ID);
+    uint16_t vf_dev_id;
+    uint16_t vf_offset;
+    uint16_t vf_stride;
     uint16_t i;
 
-    trace_sriov_unregister_vfs(dev->name, PCI_SLOT(dev->devfn),
-                               PCI_FUNC(dev->devfn));
-    for (i = 0; i < pci_get_word(cfg + PCI_SRIOV_TOTAL_VF); i++) {
-        pci_set_enabled(dev->exp.sriov_pf.vf[i], false);
+    if (!pfs || !dev->qdev.id) {
+        return 0;
     }
 
-    pci_set_word(dev->wmask + dev->exp.sriov_cap + PCI_SRIOV_NUM_VF, 0xffff);
+    pf = g_hash_table_lookup(pfs, dev->qdev.id);
+    if (!pf) {
+        return 0;
+    }
+
+    if (pf->len > UINT16_MAX) {
+        error_setg(errp, "too many VFs");
+        return -1;
+    }
+
+    g_ptr_array_sort(pf, compare_vf_devfns);
+    vfs = (void *)pf->pdata;
+
+    if (vfs[0]->devfn <= dev->devfn) {
+        error_setg(errp, "a VF function number is less than the PF function number");
+        return -1;
+    }
+
+    vf_dev_id = pci_get_word(vfs[0]->config + PCI_DEVICE_ID);
+    vf_offset = vfs[0]->devfn - dev->devfn;
+    vf_stride = pf->len < 2 ? 0 : vfs[1]->devfn - vfs[0]->devfn;
+
+    for (i = 0; i < pf->len; i++) {
+        if (bus != qdev_get_parent_bus(&vfs[i]->qdev)) {
+            error_setg(errp, "SR-IOV VF parent bus mismatches with PF");
+            return -1;
+        }
+
+        if (ven_id != pci_get_word(vfs[i]->config + PCI_VENDOR_ID)) {
+            error_setg(errp, "SR-IOV VF vendor ID mismatches with PF");
+            return -1;
+        }
+
+        if (vf_dev_id != pci_get_word(vfs[i]->config + PCI_DEVICE_ID)) {
+            error_setg(errp, "inconsistent SR-IOV VF device IDs");
+            return -1;
+        }
+
+        for (size_t j = 0; j < PCI_NUM_REGIONS; j++) {
+            if (vfs[i]->io_regions[j].size != vfs[0]->io_regions[j].size ||
+                vfs[i]->io_regions[j].type != vfs[0]->io_regions[j].type) {
+                error_setg(errp, "inconsistent SR-IOV BARs");
+                return -1;
+            }
+        }
+
+        if (vfs[i]->devfn - vfs[0]->devfn != vf_stride * i) {
+            error_setg(errp, "inconsistent SR-IOV stride");
+            return -1;
+        }
+    }
+
+    if (!pcie_sriov_pf_init_common(dev, offset, vf_dev_id, pf->len,
+                                   pf->len, vf_offset, vf_stride, errp)) {
+        return -1;
+    }
+
+    for (i = 0; i < pf->len; i++) {
+        vfs[i]->exp.sriov_vf.pf = dev;
+        vfs[i]->exp.sriov_vf.vf_number = i;
+
+        /* set vid/did according to sr/iov spec - they are not used */
+        pci_config_set_vendor_id(vfs[i]->config, 0xffff);
+        pci_config_set_device_id(vfs[i]->config, 0xffff);
+    }
+
+    dev->exp.sriov_pf.vf = vfs;
+    dev->exp.sriov_pf.vf_user_created = true;
+
+    for (i = 0; i < PCI_NUM_REGIONS; i++) {
+        PCIIORegion *region = &vfs[0]->io_regions[i];
+
+        if (region->size) {
+            pcie_sriov_pf_init_vf_bar(dev, i, region->type, region->size);
+        }
+    }
+
+    return PCI_EXT_CAP_SRIOV_SIZEOF;
+}
+
+bool pcie_sriov_register_device(PCIDevice *dev, Error **errp)
+{
+    if (!dev->exp.sriov_pf.vf && dev->qdev.id &&
+        pfs && g_hash_table_contains(pfs, dev->qdev.id)) {
+        error_setg(errp, "attaching user-created SR-IOV VF unsupported");
+        return false;
+    }
+
+    if (dev->sriov_pf) {
+        PCIDevice *pci_pf;
+        GPtrArray *pf;
+
+        if (!PCI_DEVICE_GET_CLASS(dev)->sriov_vf_user_creatable) {
+            error_setg(errp, "user cannot create SR-IOV VF with this device type");
+            return false;
+        }
+
+        if (!pci_is_express(dev)) {
+            error_setg(errp, "PCI Express is required for SR-IOV VF");
+            return false;
+        }
+
+        if (!pci_qdev_find_device(dev->sriov_pf, &pci_pf)) {
+            error_setg(errp, "PCI device specified as SR-IOV PF already exists");
+            return false;
+        }
+
+        if (!pfs) {
+            pfs = g_hash_table_new_full(g_str_hash, g_str_equal, g_free, NULL);
+        }
+
+        pf = g_hash_table_lookup(pfs, dev->sriov_pf);
+        if (!pf) {
+            pf = g_ptr_array_new();
+            g_hash_table_insert(pfs, g_strdup(dev->sriov_pf), pf);
+        }
+
+        g_ptr_array_add(pf, dev);
+    }
+
+    return true;
+}
+
+void pcie_sriov_unregister_device(PCIDevice *dev)
+{
+    if (dev->sriov_pf && pfs) {
+        GPtrArray *pf = g_hash_table_lookup(pfs, dev->sriov_pf);
+
+        if (pf) {
+            g_ptr_array_remove_fast(pf, dev);
+
+            if (!pf->len) {
+                g_hash_table_remove(pfs, dev->sriov_pf);
+                g_ptr_array_free(pf, FALSE);
+            }
+        }
+    }
 }
 
 void pcie_sriov_config_write(PCIDevice *dev, uint32_t address,
@@ -314,7 +486,7 @@ void pcie_sriov_pf_add_sup_pgsize(PCIDevice *dev, uint16_t opt_sup_pgsize)
 
 uint16_t pcie_sriov_vf_number(PCIDevice *dev)
 {
-    assert(pci_is_vf(dev));
+    assert(dev->exp.sriov_vf.pf);
     return dev->exp.sriov_vf.vf_number;
 }
 
diff --git a/include/hw/pci/pci_device.h b/include/hw/pci/pci_device.h
index 345b12eaac..e41d95b0b0 100644
--- a/include/hw/pci/pci_device.h
+++ b/include/hw/pci/pci_device.h
@@ -38,6 +38,8 @@ struct PCIDeviceClass {
     uint16_t subsystem_id;              /* only for header type = 0 */
 
     const char *romfile;                /* rom bar */
+
+    bool sriov_vf_user_creatable;
 };
 
 enum PCIReqIDType {
@@ -177,6 +179,8 @@ struct PCIDevice {
      * realizing the device.
      */
     uint32_t max_bounce_buffer_size;
+
+    char *sriov_pf;
 };
 
 static inline int pci_intx(PCIDevice *pci_dev)
@@ -209,7 +213,7 @@ static inline int pci_is_express_downstream_port(const PCIDevice *d)
 
 static inline int pci_is_vf(const PCIDevice *d)
 {
-    return d->exp.sriov_vf.pf != NULL;
+    return d->sriov_pf || d->exp.sriov_vf.pf != NULL;
 }
 
 static inline uint32_t pci_config_size(const PCIDevice *d)
diff --git a/include/hw/pci/pcie_sriov.h b/include/hw/pci/pcie_sriov.h
index c5d2d318d3..f75b8f22ee 100644
--- a/include/hw/pci/pcie_sriov.h
+++ b/include/hw/pci/pcie_sriov.h
@@ -18,6 +18,7 @@
 typedef struct PCIESriovPF {
     uint8_t vf_bar_type[PCI_NUM_REGIONS];   /* Store type for each VF bar */
     PCIDevice **vf;     /* Pointer to an array of num_vfs VF devices */
+    bool vf_user_created; /* If VFs are created by user */
 } PCIESriovPF;
 
 typedef struct PCIESriovVF {
@@ -40,6 +41,23 @@ void pcie_sriov_pf_init_vf_bar(PCIDevice *dev, int region_num,
 void pcie_sriov_vf_register_bar(PCIDevice *dev, int region_num,
                                 MemoryRegion *memory);
 
+/**
+ * pcie_sriov_pf_init_from_user_created_vfs() - Initialize PF with user-created
+ *                                              VFs.
+ * @dev: A PCIe device being realized.
+ * @offset: The offset of the SR-IOV capability.
+ * @errp: pointer to Error*, to store an error if it happens.
+ *
+ * Return: The size of added capability. 0 if the user did not create VFs.
+ *         -1 if failed.
+ */
+int16_t pcie_sriov_pf_init_from_user_created_vfs(PCIDevice *dev,
+                                                 uint16_t offset,
+                                                 Error **errp);
+
+bool pcie_sriov_register_device(PCIDevice *dev, Error **errp);
+void pcie_sriov_unregister_device(PCIDevice *dev);
+
 /*
  * Default (minimal) page size support values
  * as required by the SR/IOV standard:

From 3f9cfaa92c96d604e98f16ade5af4742460e4c0f Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <akihiko.odaki@daynix.com>
Date: Fri, 14 Mar 2025 15:14:55 +0900
Subject: [PATCH 0868/2760] virtio-pci: Implement SR-IOV PF

Allow user to attach SR-IOV VF to a virtio-pci PF.

Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Message-Id: <20250314-sriov-v9-6-57dae8ae3ab5@daynix.com>
Tested-by: Yui Washizu <yui.washidu@gmail.com>
Tested-by: Pasha Tatashin <pasha.tatashin@soleen.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/virtio/virtio-pci.c         | 20 +++++++++++++++-----
 include/hw/virtio/virtio-pci.h |  1 +
 2 files changed, 16 insertions(+), 5 deletions(-)

diff --git a/hw/virtio/virtio-pci.c b/hw/virtio/virtio-pci.c
index 0fa8fe4955..fee65d3645 100644
--- a/hw/virtio/virtio-pci.c
+++ b/hw/virtio/virtio-pci.c
@@ -1962,6 +1962,7 @@ static void virtio_pci_device_plugged(DeviceState *d, Error **errp)
     uint8_t *config;
     uint32_t size;
     VirtIODevice *vdev = virtio_bus_get_device(bus);
+    int16_t res;
 
     /*
      * Virtio capabilities present without
@@ -2109,6 +2110,14 @@ static void virtio_pci_device_plugged(DeviceState *d, Error **errp)
         pci_register_bar(&proxy->pci_dev, proxy->legacy_io_bar_idx,
                          PCI_BASE_ADDRESS_SPACE_IO, &proxy->bar);
     }
+
+    res = pcie_sriov_pf_init_from_user_created_vfs(&proxy->pci_dev,
+                                                   proxy->last_pcie_cap_offset,
+                                                   errp);
+    if (res > 0) {
+        proxy->last_pcie_cap_offset += res;
+        virtio_add_feature(&vdev->host_features, VIRTIO_F_SR_IOV);
+    }
 }
 
 static void virtio_pci_device_unplugged(DeviceState *d)
@@ -2199,7 +2208,7 @@ static void virtio_pci_realize(PCIDevice *pci_dev, Error **errp)
 
     if (pcie_port && pci_is_express(pci_dev)) {
         int pos;
-        uint16_t last_pcie_cap_offset = PCI_CONFIG_SPACE_SIZE;
+        proxy->last_pcie_cap_offset = PCI_CONFIG_SPACE_SIZE;
 
         pos = pcie_endpoint_cap_init(pci_dev, 0);
         assert(pos > 0);
@@ -2216,9 +2225,9 @@ static void virtio_pci_realize(PCIDevice *pci_dev, Error **errp)
         pci_set_word(pci_dev->config + pos + PCI_PM_PMC, 0x3);
 
         if (proxy->flags & VIRTIO_PCI_FLAG_AER) {
-            pcie_aer_init(pci_dev, PCI_ERR_VER, last_pcie_cap_offset,
+            pcie_aer_init(pci_dev, PCI_ERR_VER, proxy->last_pcie_cap_offset,
                           PCI_ERR_SIZEOF, NULL);
-            last_pcie_cap_offset += PCI_ERR_SIZEOF;
+            proxy->last_pcie_cap_offset += PCI_ERR_SIZEOF;
         }
 
         if (proxy->flags & VIRTIO_PCI_FLAG_INIT_DEVERR) {
@@ -2243,9 +2252,9 @@ static void virtio_pci_realize(PCIDevice *pci_dev, Error **errp)
         }
 
         if (proxy->flags & VIRTIO_PCI_FLAG_ATS) {
-            pcie_ats_init(pci_dev, last_pcie_cap_offset,
+            pcie_ats_init(pci_dev, proxy->last_pcie_cap_offset,
                           proxy->flags & VIRTIO_PCI_FLAG_ATS_PAGE_ALIGNED);
-            last_pcie_cap_offset += PCI_EXT_CAP_ATS_SIZEOF;
+            proxy->last_pcie_cap_offset += PCI_EXT_CAP_ATS_SIZEOF;
         }
 
         if (proxy->flags & VIRTIO_PCI_FLAG_INIT_FLR) {
@@ -2273,6 +2282,7 @@ static void virtio_pci_exit(PCIDevice *pci_dev)
                      !pci_bus_is_root(pci_get_bus(pci_dev));
     bool modern_pio = proxy->flags & VIRTIO_PCI_FLAG_MODERN_PIO_NOTIFY;
 
+    pcie_sriov_pf_exit(&proxy->pci_dev);
     msix_uninit_exclusive_bar(pci_dev);
     if (proxy->flags & VIRTIO_PCI_FLAG_AER && pcie_port &&
         pci_is_express(pci_dev)) {
diff --git a/include/hw/virtio/virtio-pci.h b/include/hw/virtio/virtio-pci.h
index 31ec144509..1dbc3851b0 100644
--- a/include/hw/virtio/virtio-pci.h
+++ b/include/hw/virtio/virtio-pci.h
@@ -155,6 +155,7 @@ struct VirtIOPCIProxy {
     uint32_t modern_io_bar_idx;
     uint32_t modern_mem_bar_idx;
     int config_cap;
+    uint16_t last_pcie_cap_offset;
     uint32_t flags;
     bool disable_modern;
     bool ignore_backend_features;

From 49f7cb18db0790f7f32cb85dc35ffc25e44a828b Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <akihiko.odaki@daynix.com>
Date: Fri, 14 Mar 2025 15:14:56 +0900
Subject: [PATCH 0869/2760] virtio-net: Implement SR-IOV VF

A virtio-net device can be added as a SR-IOV VF to another virtio-pci
device that will be the PF.

Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Message-Id: <20250314-sriov-v9-7-57dae8ae3ab5@daynix.com>
Tested-by: Yui Washizu <yui.washidu@gmail.com>
Tested-by: Pasha Tatashin <pasha.tatashin@soleen.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/virtio/virtio-net-pci.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/virtio/virtio-net-pci.c b/hw/virtio/virtio-net-pci.c
index 8cf9788bc3..f857a84f11 100644
--- a/hw/virtio/virtio-net-pci.c
+++ b/hw/virtio/virtio-net-pci.c
@@ -74,6 +74,7 @@ static void virtio_net_pci_class_init(ObjectClass *klass, const void *data)
     k->device_id = PCI_DEVICE_ID_VIRTIO_NET;
     k->revision = VIRTIO_PCI_ABI_VERSION;
     k->class_id = PCI_CLASS_NETWORK_ETHERNET;
+    k->sriov_vf_user_creatable = true;
     set_bit(DEVICE_CATEGORY_NETWORK, dc->categories);
     device_class_set_props(dc, virtio_net_properties);
     vpciklass->realize = virtio_net_pci_realize;

From 6f9bebf1dc6b54b63be739ea247b3942f841b9e3 Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <akihiko.odaki@daynix.com>
Date: Fri, 14 Mar 2025 15:14:57 +0900
Subject: [PATCH 0870/2760] docs: Document composable SR-IOV device

Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Message-Id: <20250314-sriov-v9-8-57dae8ae3ab5@daynix.com>
Tested-by: Yui Washizu <yui.washidu@gmail.com>
Tested-by: Pasha Tatashin <pasha.tatashin@soleen.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 MAINTAINERS           |  1 +
 docs/system/index.rst |  1 +
 docs/system/sriov.rst | 36 ++++++++++++++++++++++++++++++++++++
 3 files changed, 38 insertions(+)
 create mode 100644 docs/system/sriov.rst

diff --git a/MAINTAINERS b/MAINTAINERS
index 6dacd6d004..b579358cdd 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2058,6 +2058,7 @@ F: hw/pci-bridge/*
 F: qapi/pci.json
 F: docs/pci*
 F: docs/specs/*pci*
+F: docs/system/sriov.rst
 
 PCIE DOE
 M: Huai-Cheng Kuo <hchkuo@avery-design.com.tw>
diff --git a/docs/system/index.rst b/docs/system/index.rst
index c21065e519..718e9d3c56 100644
--- a/docs/system/index.rst
+++ b/docs/system/index.rst
@@ -39,3 +39,4 @@ or Hypervisor.Framework.
    multi-process
    confidential-guest-support
    vm-templating
+   sriov
diff --git a/docs/system/sriov.rst b/docs/system/sriov.rst
new file mode 100644
index 0000000000..a851a66a4b
--- /dev/null
+++ b/docs/system/sriov.rst
@@ -0,0 +1,36 @@
+.. SPDX-License-Identifier: GPL-2.0-or-later
+
+Compsable SR-IOV device
+=======================
+
+SR-IOV (Single Root I/O Virtualization) is an optional extended capability of a
+PCI Express device. It allows a single physical function (PF) to appear as
+multiple virtual functions (VFs) for the main purpose of eliminating software
+overhead in I/O from virtual machines.
+
+There are devices with predefined SR-IOV configurations, but it is also possible
+to compose an SR-IOV device yourself. Composing an SR-IOV device is currently
+only supported by virtio-net-pci.
+
+Users can configure an SR-IOV-capable virtio-net device by adding
+virtio-net-pci functions to a bus. Below is a command line example:
+
+.. code-block:: shell
+
+    -netdev user,id=n -netdev user,id=o
+    -netdev user,id=p -netdev user,id=q
+    -device pcie-root-port,id=b
+    -device virtio-net-pci,bus=b,addr=0x0.0x3,netdev=q,sriov-pf=f
+    -device virtio-net-pci,bus=b,addr=0x0.0x2,netdev=p,sriov-pf=f
+    -device virtio-net-pci,bus=b,addr=0x0.0x1,netdev=o,sriov-pf=f
+    -device virtio-net-pci,bus=b,addr=0x0.0x0,netdev=n,id=f
+
+The VFs specify the paired PF with ``sriov-pf`` property. The PF must be
+added after all VFs. It is the user's responsibility to ensure that VFs have
+function numbers larger than one of the PF, and that the function numbers
+have a consistent stride.
+
+You may also need to perform additional steps to activate the SR-IOV feature on
+your guest. For Linux, refer to [1]_.
+
+.. [1] https://docs.kernel.org/PCI/pci-iov-howto.html

From d0c280d3fac644c26a86d2fb70c5920b3d5bef85 Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <akihiko.odaki@daynix.com>
Date: Fri, 14 Mar 2025 15:14:58 +0900
Subject: [PATCH 0871/2760] pcie_sriov: Make a PCI device with user-created VF
 ARI-capable

Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Message-Id: <20250314-sriov-v9-9-57dae8ae3ab5@daynix.com>
Tested-by: Yui Washizu <yui.washidu@gmail.com>
Tested-by: Pasha Tatashin <pasha.tatashin@soleen.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 docs/system/sriov.rst       |  3 ++-
 hw/pci/pcie_sriov.c         |  8 +++++++-
 hw/virtio/virtio-pci.c      | 16 ++++++++++------
 include/hw/pci/pcie_sriov.h |  7 +++++--
 4 files changed, 24 insertions(+), 10 deletions(-)

diff --git a/docs/system/sriov.rst b/docs/system/sriov.rst
index a851a66a4b..d12178f3c3 100644
--- a/docs/system/sriov.rst
+++ b/docs/system/sriov.rst
@@ -28,7 +28,8 @@ virtio-net-pci functions to a bus. Below is a command line example:
 The VFs specify the paired PF with ``sriov-pf`` property. The PF must be
 added after all VFs. It is the user's responsibility to ensure that VFs have
 function numbers larger than one of the PF, and that the function numbers
-have a consistent stride.
+have a consistent stride. Both the PF and VFs are ARI-capable so you can have
+255 VFs at maximum.
 
 You may also need to perform additional steps to activate the SR-IOV feature on
 your guest. For Linux, refer to [1]_.
diff --git a/hw/pci/pcie_sriov.c b/hw/pci/pcie_sriov.c
index 08f707e847..3ad18744f4 100644
--- a/hw/pci/pcie_sriov.c
+++ b/hw/pci/pcie_sriov.c
@@ -245,6 +245,7 @@ int16_t pcie_sriov_pf_init_from_user_created_vfs(PCIDevice *dev,
     PCIDevice **vfs;
     BusState *bus = qdev_get_parent_bus(DEVICE(dev));
     uint16_t ven_id = pci_get_word(dev->config + PCI_VENDOR_ID);
+    uint16_t size = PCI_EXT_CAP_SRIOV_SIZEOF;
     uint16_t vf_dev_id;
     uint16_t vf_offset;
     uint16_t vf_stride;
@@ -311,6 +312,11 @@ int16_t pcie_sriov_pf_init_from_user_created_vfs(PCIDevice *dev,
         return -1;
     }
 
+    if (!pcie_find_capability(dev, PCI_EXT_CAP_ID_ARI)) {
+        pcie_ari_init(dev, offset + size);
+        size += PCI_ARI_SIZEOF;
+    }
+
     for (i = 0; i < pf->len; i++) {
         vfs[i]->exp.sriov_vf.pf = dev;
         vfs[i]->exp.sriov_vf.vf_number = i;
@@ -331,7 +337,7 @@ int16_t pcie_sriov_pf_init_from_user_created_vfs(PCIDevice *dev,
         }
     }
 
-    return PCI_EXT_CAP_SRIOV_SIZEOF;
+    return size;
 }
 
 bool pcie_sriov_register_device(PCIDevice *dev, Error **errp)
diff --git a/hw/virtio/virtio-pci.c b/hw/virtio/virtio-pci.c
index fee65d3645..9b48aa8c3e 100644
--- a/hw/virtio/virtio-pci.c
+++ b/hw/virtio/virtio-pci.c
@@ -2111,12 +2111,16 @@ static void virtio_pci_device_plugged(DeviceState *d, Error **errp)
                          PCI_BASE_ADDRESS_SPACE_IO, &proxy->bar);
     }
 
-    res = pcie_sriov_pf_init_from_user_created_vfs(&proxy->pci_dev,
-                                                   proxy->last_pcie_cap_offset,
-                                                   errp);
-    if (res > 0) {
-        proxy->last_pcie_cap_offset += res;
-        virtio_add_feature(&vdev->host_features, VIRTIO_F_SR_IOV);
+    if (pci_is_vf(&proxy->pci_dev)) {
+        pcie_ari_init(&proxy->pci_dev, proxy->last_pcie_cap_offset);
+        proxy->last_pcie_cap_offset += PCI_ARI_SIZEOF;
+    } else {
+        res = pcie_sriov_pf_init_from_user_created_vfs(
+            &proxy->pci_dev, proxy->last_pcie_cap_offset, errp);
+        if (res > 0) {
+            proxy->last_pcie_cap_offset += res;
+            virtio_add_feature(&vdev->host_features, VIRTIO_F_SR_IOV);
+        }
     }
 }
 
diff --git a/include/hw/pci/pcie_sriov.h b/include/hw/pci/pcie_sriov.h
index f75b8f22ee..aeaa38cf34 100644
--- a/include/hw/pci/pcie_sriov.h
+++ b/include/hw/pci/pcie_sriov.h
@@ -43,12 +43,15 @@ void pcie_sriov_vf_register_bar(PCIDevice *dev, int region_num,
 
 /**
  * pcie_sriov_pf_init_from_user_created_vfs() - Initialize PF with user-created
- *                                              VFs.
+ *                                              VFs, adding ARI to PF
  * @dev: A PCIe device being realized.
  * @offset: The offset of the SR-IOV capability.
  * @errp: pointer to Error*, to store an error if it happens.
  *
- * Return: The size of added capability. 0 if the user did not create VFs.
+ * Initializes a PF with user-created VFs, adding the ARI extended capability to
+ * the PF. The VFs should call pcie_ari_init() to form an ARI device.
+ *
+ * Return: The size of added capabilities. 0 if the user did not create VFs.
  *         -1 if failed.
  */
 int16_t pcie_sriov_pf_init_from_user_created_vfs(PCIDevice *dev,

From 8717987fb528ff704e275a1a99f59a20e0b272f5 Mon Sep 17 00:00:00 2001
From: Stephen Bates <sbates@raithlin.com>
Date: Tue, 15 Apr 2025 10:29:56 -0600
Subject: [PATCH 0872/2760] pci-testdev.c: Add membar-backed option for backing
 membar

The pci-testdev device allows for an optional BAR. We have
historically used this without backing to test that systems and OSes
can accomodate large PCI BARs. However to help test p2pdma operations
it is helpful to add an option to back this BAR with host memory.

We add a membar-backed boolean parameter and when set to true or on we
do a host RAM backing. The default is false which ensures backward
compatability.

Signed-off-by: Stephen Bates <sbates@raithlin.com>
Message-Id: <Z_6JhDtn5PlaDgB_@MKMSTEBATES01.amd.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/misc/pci-testdev.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/hw/misc/pci-testdev.c b/hw/misc/pci-testdev.c
index 3f6a8bba84..ba71c5069f 100644
--- a/hw/misc/pci-testdev.c
+++ b/hw/misc/pci-testdev.c
@@ -90,6 +90,7 @@ struct PCITestDevState {
     int current;
 
     uint64_t membar_size;
+    bool membar_backed;
     MemoryRegion membar;
 };
 
@@ -258,8 +259,14 @@ static void pci_testdev_realize(PCIDevice *pci_dev, Error **errp)
     pci_register_bar(pci_dev, 1, PCI_BASE_ADDRESS_SPACE_IO, &d->portio);
 
     if (d->membar_size) {
-        memory_region_init(&d->membar, OBJECT(d), "pci-testdev-membar",
-                           d->membar_size);
+        if (d->membar_backed)
+            memory_region_init_ram(&d->membar, OBJECT(d),
+                                   "pci-testdev-membar-backed",
+                                   d->membar_size, NULL);
+        else
+            memory_region_init(&d->membar, OBJECT(d),
+                               "pci-testdev-membar",
+                               d->membar_size);
         pci_register_bar(pci_dev, 2,
                          PCI_BASE_ADDRESS_SPACE_MEMORY |
                          PCI_BASE_ADDRESS_MEM_PREFETCH |
@@ -321,6 +328,7 @@ static void qdev_pci_testdev_reset(DeviceState *dev)
 
 static const Property pci_testdev_properties[] = {
     DEFINE_PROP_SIZE("membar", PCITestDevState, membar_size, 0),
+    DEFINE_PROP_BOOL("membar-backed", PCITestDevState, membar_backed, false),
 };
 
 static void pci_testdev_class_init(ObjectClass *klass, const void *data)

From e0f300b36da1ee794fd81aa95f56e7bc9f010d46 Mon Sep 17 00:00:00 2001
From: Haoqian He <haoqian.he@smartx.com>
Date: Tue, 15 Apr 2025 22:47:26 -0400
Subject: [PATCH 0873/2760] system/runstate: add VM state change cb with return
 value

This patch adds the new VM state change cb type `VMChangeStateHandlerWithRet`,
which has return value for `VMChangeStateEntry`.

Thus, we can register a new VM state change cb with return value for device.
Note that `VMChangeStateHandler` and `VMChangeStateHandlerWithRet` are mutually
exclusive and cannot be provided at the same time.

This patch is the pre patch for 'vhost-user: return failure if backend crashes
when live migration', which makes the live migration aware of the loss of
connection with the vhost-user backend and aborts the live migration.

Virtio device will use VMChangeStateHandlerWithRet.

Signed-off-by: Haoqian He <haoqian.he@smartx.com>
Message-Id: <20250416024729.3289157-2-haoqian.he@smartx.com>
Tested-by: Lei Yang <leiyang@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/block/virtio-blk.c             |  2 +-
 hw/core/vm-change-state-handler.c | 18 ++++++++++------
 hw/scsi/scsi-bus.c                |  2 +-
 hw/vfio/migration.c               |  2 +-
 hw/virtio/virtio.c                |  2 +-
 include/system/runstate.h         | 13 +++++++++---
 system/cpus.c                     |  8 +++++--
 system/runstate.c                 | 35 ++++++++++++++++++++++++++-----
 8 files changed, 62 insertions(+), 20 deletions(-)

diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
index b54d01d3a2..ea948d18fd 100644
--- a/hw/block/virtio-blk.c
+++ b/hw/block/virtio-blk.c
@@ -1802,7 +1802,7 @@ static void virtio_blk_device_realize(DeviceState *dev, Error **errp)
      * called after ->start_ioeventfd() has already set blk's AioContext.
      */
     s->change =
-        qdev_add_vm_change_state_handler(dev, virtio_blk_dma_restart_cb, s);
+        qdev_add_vm_change_state_handler(dev, virtio_blk_dma_restart_cb, NULL, s);
 
     blk_ram_registrar_init(&s->blk_ram_registrar, s->blk);
     blk_set_dev_ops(s->blk, &virtio_block_ops, s);
diff --git a/hw/core/vm-change-state-handler.c b/hw/core/vm-change-state-handler.c
index 7064995578..99c642b558 100644
--- a/hw/core/vm-change-state-handler.c
+++ b/hw/core/vm-change-state-handler.c
@@ -40,6 +40,7 @@ static int qdev_get_dev_tree_depth(DeviceState *dev)
  * qdev_add_vm_change_state_handler:
  * @dev: the device that owns this handler
  * @cb: the callback function to be invoked
+ * @cb_ret: the callback function with return value to be invoked
  * @opaque: user data passed to the callback function
  *
  * This function works like qemu_add_vm_change_state_handler() except callbacks
@@ -50,25 +51,30 @@ static int qdev_get_dev_tree_depth(DeviceState *dev)
  * controller's callback is invoked before the children on its bus when the VM
  * starts running.  The order is reversed when the VM stops running.
  *
+ * Note that the parameter `cb` and `cb_ret` are mutually exclusive.
+ *
  * Returns: an entry to be freed with qemu_del_vm_change_state_handler()
  */
 VMChangeStateEntry *qdev_add_vm_change_state_handler(DeviceState *dev,
                                                      VMChangeStateHandler *cb,
+                                                     VMChangeStateHandlerWithRet *cb_ret,
                                                      void *opaque)
 {
-    return qdev_add_vm_change_state_handler_full(dev, cb, NULL, opaque);
+    assert(!cb || !cb_ret);
+    return qdev_add_vm_change_state_handler_full(dev, cb, NULL, cb_ret, opaque);
 }
 
 /*
  * Exactly like qdev_add_vm_change_state_handler() but passes a prepare_cb
- * argument too.
+ * and the cb_ret arguments too.
  */
 VMChangeStateEntry *qdev_add_vm_change_state_handler_full(
-    DeviceState *dev, VMChangeStateHandler *cb,
-    VMChangeStateHandler *prepare_cb, void *opaque)
+    DeviceState *dev, VMChangeStateHandler *cb, VMChangeStateHandler *prepare_cb,
+    VMChangeStateHandlerWithRet *cb_ret, void *opaque)
 {
     int depth = qdev_get_dev_tree_depth(dev);
 
-    return qemu_add_vm_change_state_handler_prio_full(cb, prepare_cb, opaque,
-                                                      depth);
+    assert(!cb || !cb_ret);
+    return qemu_add_vm_change_state_handler_prio_full(cb, prepare_cb, cb_ret,
+                                                      opaque, depth);
 }
diff --git a/hw/scsi/scsi-bus.c b/hw/scsi/scsi-bus.c
index 70be4a7367..9b12ee7f1c 100644
--- a/hw/scsi/scsi-bus.c
+++ b/hw/scsi/scsi-bus.c
@@ -400,7 +400,7 @@ static void scsi_qdev_realize(DeviceState *qdev, Error **errp)
         return;
     }
     dev->vmsentry = qdev_add_vm_change_state_handler(DEVICE(dev),
-            scsi_dma_restart_cb, dev);
+            scsi_dma_restart_cb, NULL, dev);
 }
 
 static void scsi_qdev_unrealize(DeviceState *qdev)
diff --git a/hw/vfio/migration.c b/hw/vfio/migration.c
index 1dceab1b19..b76697bd1a 100644
--- a/hw/vfio/migration.c
+++ b/hw/vfio/migration.c
@@ -1016,7 +1016,7 @@ static int vfio_migration_init(VFIODevice *vbasedev)
                      vfio_vmstate_change_prepare :
                      NULL;
     migration->vm_state = qdev_add_vm_change_state_handler_full(
-        vbasedev->dev, vfio_vmstate_change, prepare_cb, vbasedev);
+        vbasedev->dev, vfio_vmstate_change, prepare_cb, NULL, vbasedev);
     migration_add_notifier(&migration->migration_state,
                            vfio_migration_state_notifier);
 
diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
index 480c2e5036..e3b62522ec 100644
--- a/hw/virtio/virtio.c
+++ b/hw/virtio/virtio.c
@@ -3489,7 +3489,7 @@ void virtio_init(VirtIODevice *vdev, uint16_t device_id, size_t config_size)
         vdev->config = NULL;
     }
     vdev->vmstate = qdev_add_vm_change_state_handler(DEVICE(vdev),
-            virtio_vmstate_change, vdev);
+            virtio_vmstate_change, NULL, vdev);
     vdev->device_endian = virtio_default_endian();
     vdev->use_guest_notifier_mask = true;
 }
diff --git a/include/system/runstate.h b/include/system/runstate.h
index bffc3719d4..fdd5c4a517 100644
--- a/include/system/runstate.h
+++ b/include/system/runstate.h
@@ -12,6 +12,7 @@ bool runstate_needs_reset(void);
 void runstate_replay_enable(void);
 
 typedef void VMChangeStateHandler(void *opaque, bool running, RunState state);
+typedef int VMChangeStateHandlerWithRet(void *opaque, bool running, RunState state);
 
 VMChangeStateEntry *qemu_add_vm_change_state_handler(VMChangeStateHandler *cb,
                                                      void *opaque);
@@ -20,21 +21,27 @@ VMChangeStateEntry *qemu_add_vm_change_state_handler_prio(
 VMChangeStateEntry *
 qemu_add_vm_change_state_handler_prio_full(VMChangeStateHandler *cb,
                                            VMChangeStateHandler *prepare_cb,
+                                           VMChangeStateHandlerWithRet *cb_ret,
                                            void *opaque, int priority);
 VMChangeStateEntry *qdev_add_vm_change_state_handler(DeviceState *dev,
                                                      VMChangeStateHandler *cb,
+                                                     VMChangeStateHandlerWithRet *cb_ret,
                                                      void *opaque);
 VMChangeStateEntry *qdev_add_vm_change_state_handler_full(
-    DeviceState *dev, VMChangeStateHandler *cb,
-    VMChangeStateHandler *prepare_cb, void *opaque);
+    DeviceState *dev, VMChangeStateHandler *cb, VMChangeStateHandler *prepare_cb,
+    VMChangeStateHandlerWithRet *cb_ret, void *opaque);
 void qemu_del_vm_change_state_handler(VMChangeStateEntry *e);
 /**
  * vm_state_notify: Notify the state of the VM
  *
  * @running: whether the VM is running or not.
  * @state: the #RunState of the VM.
+ *
+ * Return the result of the callback which has return value.
+ * If no callback has return value, still return 0 and the
+ * upper layer should not do additional processing.
  */
-void vm_state_notify(bool running, RunState state);
+int vm_state_notify(bool running, RunState state);
 
 static inline bool shutdown_caused_by_guest(ShutdownCause cause)
 {
diff --git a/system/cpus.c b/system/cpus.c
index 2cc5f887ab..d16b0dff98 100644
--- a/system/cpus.c
+++ b/system/cpus.c
@@ -299,14 +299,18 @@ static int do_vm_stop(RunState state, bool send_stop)
         if (oldstate == RUN_STATE_RUNNING) {
             pause_all_vcpus();
         }
-        vm_state_notify(0, state);
+        ret = vm_state_notify(0, state);
         if (send_stop) {
             qapi_event_send_stop();
         }
     }
 
     bdrv_drain_all();
-    ret = bdrv_flush_all();
+    /*
+     * Even if vm_state_notify() return failure,
+     * it would be better to flush as before.
+     */
+    ret |= bdrv_flush_all();
     trace_vm_stop_flush_all(ret);
 
     return ret;
diff --git a/system/runstate.c b/system/runstate.c
index 272801d307..de74d962bc 100644
--- a/system/runstate.c
+++ b/system/runstate.c
@@ -297,6 +297,7 @@ void qemu_system_vmstop_request(RunState state)
 struct VMChangeStateEntry {
     VMChangeStateHandler *cb;
     VMChangeStateHandler *prepare_cb;
+    VMChangeStateHandlerWithRet *cb_ret;
     void *opaque;
     QTAILQ_ENTRY(VMChangeStateEntry) entries;
     int priority;
@@ -320,14 +321,15 @@ static QTAILQ_HEAD(, VMChangeStateEntry) vm_change_state_head =
 VMChangeStateEntry *qemu_add_vm_change_state_handler_prio(
         VMChangeStateHandler *cb, void *opaque, int priority)
 {
-    return qemu_add_vm_change_state_handler_prio_full(cb, NULL, opaque,
-                                                      priority);
+    return qemu_add_vm_change_state_handler_prio_full(cb, NULL, NULL,
+                                                      opaque, priority);
 }
 
 /**
  * qemu_add_vm_change_state_handler_prio_full:
  * @cb: the main callback to invoke
  * @prepare_cb: a callback to invoke before the main callback
+ * @cb_ret: the main callback to invoke with return value
  * @opaque: user data passed to the callbacks
  * @priority: low priorities execute first when the vm runs and the reverse is
  *            true when the vm stops
@@ -344,6 +346,7 @@ VMChangeStateEntry *qemu_add_vm_change_state_handler_prio(
 VMChangeStateEntry *
 qemu_add_vm_change_state_handler_prio_full(VMChangeStateHandler *cb,
                                            VMChangeStateHandler *prepare_cb,
+                                           VMChangeStateHandlerWithRet *cb_ret,
                                            void *opaque, int priority)
 {
     VMChangeStateEntry *e;
@@ -352,6 +355,7 @@ qemu_add_vm_change_state_handler_prio_full(VMChangeStateHandler *cb,
     e = g_malloc0(sizeof(*e));
     e->cb = cb;
     e->prepare_cb = prepare_cb;
+    e->cb_ret = cb_ret;
     e->opaque = opaque;
     e->priority = priority;
 
@@ -379,9 +383,10 @@ void qemu_del_vm_change_state_handler(VMChangeStateEntry *e)
     g_free(e);
 }
 
-void vm_state_notify(bool running, RunState state)
+int vm_state_notify(bool running, RunState state)
 {
     VMChangeStateEntry *e, *next;
+    int ret = 0;
 
     trace_vm_state_notify(running, state, RunState_str(state));
 
@@ -393,7 +398,17 @@ void vm_state_notify(bool running, RunState state)
         }
 
         QTAILQ_FOREACH_SAFE(e, &vm_change_state_head, entries, next) {
-            e->cb(e->opaque, running, state);
+            if (e->cb) {
+                e->cb(e->opaque, running, state);
+            } else if (e->cb_ret) {
+                /*
+                 * Here ignore the return value of cb_ret because
+                 * we only care about the stopping the device during
+                 * the VM live migration to indicate whether the
+                 * connection between qemu and backend is normal.
+                 */
+                e->cb_ret(e->opaque, running, state);
+            }
         }
     } else {
         QTAILQ_FOREACH_REVERSE_SAFE(e, &vm_change_state_head, entries, next) {
@@ -403,9 +418,19 @@ void vm_state_notify(bool running, RunState state)
         }
 
         QTAILQ_FOREACH_REVERSE_SAFE(e, &vm_change_state_head, entries, next) {
-            e->cb(e->opaque, running, state);
+            if (e->cb) {
+                e->cb(e->opaque, running, state);
+            } else if (e->cb_ret) {
+                /*
+                 * We should execute all registered callbacks even if
+                 * one of them returns failure, otherwise, some cleanup
+                 * work of the device will be skipped.
+                 */
+                ret |= e->cb_ret(e->opaque, running, state);
+            }
         }
     }
+    return ret;
 }
 
 static ShutdownCause reset_requested;

From 5a317017b827e338358792cd07663f8ea25f1ffe Mon Sep 17 00:00:00 2001
From: Haoqian He <haoqian.he@smartx.com>
Date: Tue, 15 Apr 2025 22:47:27 -0400
Subject: [PATCH 0874/2760] vhost: return failure if stop virtqueue failed in
 vhost_dev_stop

This patch captures the error of vhost_virtqueue_stop() in vhost_dev_stop()
and returns the error upward.

Specifically, if QEMU is disconnected from the vhost backend, some actions
in vhost_dev_stop() will fail, such as sending vhost-user messages to the
backend (GET_VRING_BASE, SET_VRING_ENABLE) and vhost_reset_status.

Considering that both set_vring_enable and vhost_reset_status require setting
the specific virtio feature bit, we can capture vhost_virtqueue_stop()'s
error to indicate that QEMU has lost connection with the backend.

This patch is the pre patch for 'vhost-user: return failure if backend crashes
when live migration', which makes the live migration aware of the loss of
connection with the vhost-user backend and aborts the live migration.

Signed-off-by: Haoqian He <haoqian.he@smartx.com>
Message-Id: <20250416024729.3289157-3-haoqian.he@smartx.com>
Tested-by: Lei Yang <leiyang@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/virtio/vhost.c         | 23 +++++++++++++----------
 include/hw/virtio/vhost.h |  8 +++++---
 2 files changed, 18 insertions(+), 13 deletions(-)

diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c
index 4cae7c1664..fc43853704 100644
--- a/hw/virtio/vhost.c
+++ b/hw/virtio/vhost.c
@@ -1367,10 +1367,10 @@ fail_alloc_desc:
     return r;
 }
 
-void vhost_virtqueue_stop(struct vhost_dev *dev,
-                          struct VirtIODevice *vdev,
-                          struct vhost_virtqueue *vq,
-                          unsigned idx)
+int vhost_virtqueue_stop(struct vhost_dev *dev,
+                         struct VirtIODevice *vdev,
+                         struct vhost_virtqueue *vq,
+                         unsigned idx)
 {
     int vhost_vq_index = dev->vhost_ops->vhost_get_vq_index(dev, idx);
     struct vhost_vring_state state = {
@@ -1380,7 +1380,7 @@ void vhost_virtqueue_stop(struct vhost_dev *dev,
 
     if (virtio_queue_get_desc_addr(vdev, idx) == 0) {
         /* Don't stop the virtqueue which might have not been started */
-        return;
+        return 0;
     }
 
     r = dev->vhost_ops->vhost_get_vring_base(dev, &state);
@@ -1411,6 +1411,7 @@ void vhost_virtqueue_stop(struct vhost_dev *dev,
                        0, virtio_queue_get_avail_size(vdev, idx));
     vhost_memory_unmap(dev, vq->desc, virtio_queue_get_desc_size(vdev, idx),
                        0, virtio_queue_get_desc_size(vdev, idx));
+    return r;
 }
 
 static int vhost_virtqueue_set_busyloop_timeout(struct vhost_dev *dev,
@@ -2135,9 +2136,10 @@ fail_features:
 }
 
 /* Host notifiers must be enabled at this point. */
-void vhost_dev_stop(struct vhost_dev *hdev, VirtIODevice *vdev, bool vrings)
+int vhost_dev_stop(struct vhost_dev *hdev, VirtIODevice *vdev, bool vrings)
 {
     int i;
+    int rc = 0;
 
     /* should only be called after backend is connected */
     assert(hdev->vhost_ops);
@@ -2156,10 +2158,10 @@ void vhost_dev_stop(struct vhost_dev *hdev, VirtIODevice *vdev, bool vrings)
         vhost_dev_set_vring_enable(hdev, false);
     }
     for (i = 0; i < hdev->nvqs; ++i) {
-        vhost_virtqueue_stop(hdev,
-                             vdev,
-                             hdev->vqs + i,
-                             hdev->vq_index + i);
+        rc |= vhost_virtqueue_stop(hdev,
+                                   vdev,
+                                   hdev->vqs + i,
+                                   hdev->vq_index + i);
     }
     if (hdev->vhost_ops->vhost_reset_status) {
         hdev->vhost_ops->vhost_reset_status(hdev);
@@ -2176,6 +2178,7 @@ void vhost_dev_stop(struct vhost_dev *hdev, VirtIODevice *vdev, bool vrings)
     hdev->started = false;
     vdev->vhost_started = false;
     hdev->vdev = NULL;
+    return rc;
 }
 
 int vhost_net_set_backend(struct vhost_dev *hdev,
diff --git a/include/hw/virtio/vhost.h b/include/hw/virtio/vhost.h
index bb4b58e115..38800a7156 100644
--- a/include/hw/virtio/vhost.h
+++ b/include/hw/virtio/vhost.h
@@ -232,8 +232,10 @@ int vhost_dev_start(struct vhost_dev *hdev, VirtIODevice *vdev, bool vrings);
  * Stop the vhost device. After the device is stopped the notifiers
  * can be disabled (@vhost_dev_disable_notifiers) and the device can
  * be torn down (@vhost_dev_cleanup).
+ *
+ * Return: 0 on success, != 0 on error when stopping dev.
  */
-void vhost_dev_stop(struct vhost_dev *hdev, VirtIODevice *vdev, bool vrings);
+int vhost_dev_stop(struct vhost_dev *hdev, VirtIODevice *vdev, bool vrings);
 
 /**
  * DOC: vhost device configuration handling
@@ -333,8 +335,8 @@ int vhost_device_iotlb_miss(struct vhost_dev *dev, uint64_t iova, int write);
 
 int vhost_virtqueue_start(struct vhost_dev *dev, struct VirtIODevice *vdev,
                           struct vhost_virtqueue *vq, unsigned idx);
-void vhost_virtqueue_stop(struct vhost_dev *dev, struct VirtIODevice *vdev,
-                          struct vhost_virtqueue *vq, unsigned idx);
+int vhost_virtqueue_stop(struct vhost_dev *dev, struct VirtIODevice *vdev,
+                         struct vhost_virtqueue *vq, unsigned idx);
 
 void vhost_dev_reset_inflight(struct vhost_inflight *inflight);
 void vhost_dev_free_inflight(struct vhost_inflight *inflight);

From bc85aae4204509420f0a4403ca728801170d9351 Mon Sep 17 00:00:00 2001
From: Haoqian He <haoqian.he@smartx.com>
Date: Tue, 15 Apr 2025 22:47:28 -0400
Subject: [PATCH 0875/2760] vhost-user: return failure if backend crash when
 live migration

Live migration should be terminated if the vhost-user backend crashes
before the migration completes.

Specifically, since the vhost device will be stopped when VM is stopped
before the end of the live migration, in current implementation if the
backend crashes, vhost-user device set_status() won't return failure,
live migration won't perceive the disconnection between QEMU and the
backend.

When the VM is migrated to the destination, the inflight IO will be
resubmitted, and if the IO was completed out of order before, it will
cause IO error.

To fix this issue:
1. Add the return value to set_status() for VirtioDeviceClass.
  a. For the vhost-user device, return failure when the backend crashes.
  b. For other virtio devices, always return 0.
2. Return failure if vhost_dev_stop() failed for vhost-user device.

If QEMU loses connection with the vhost-user backend, virtio set_status()
can return failure to the upper layer, migration_completion() can handle
the error, terminate the live migration, and restore the VM, so that
inflight IO can be completed normally.

Signed-off-by: Haoqian He <haoqian.he@smartx.com>
Message-Id: <20250416024729.3289157-4-haoqian.he@smartx.com>
Tested-by: Lei Yang <leiyang@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 backends/vhost-user.c                  | 20 +++++++++----------
 hw/block/vhost-user-blk.c              | 27 ++++++++++++++------------
 hw/block/virtio-blk.c                  |  5 +++--
 hw/char/virtio-serial-bus.c            |  3 ++-
 hw/display/vhost-user-gpu.c            | 12 +++++++++---
 hw/input/virtio-input.c                |  3 ++-
 hw/net/virtio-net.c                    |  3 ++-
 hw/scsi/vhost-scsi-common.c            | 13 +++++++------
 hw/scsi/vhost-scsi.c                   |  5 +++--
 hw/scsi/vhost-user-scsi.c              | 18 ++++++++++-------
 hw/virtio/vdpa-dev.c                   |  5 +++--
 hw/virtio/vhost-user-base.c            | 23 +++++++++++++---------
 hw/virtio/vhost-user-fs.c              | 23 +++++++++++++---------
 hw/virtio/vhost-user-scmi.c            | 27 +++++++++++++++-----------
 hw/virtio/vhost-user-vsock.c           | 15 +++++++++-----
 hw/virtio/vhost-vsock-common.c         | 12 ++++++------
 hw/virtio/vhost-vsock.c                | 11 ++++++-----
 hw/virtio/virtio-balloon.c             |  3 ++-
 hw/virtio/virtio-crypto.c              |  3 ++-
 hw/virtio/virtio-iommu.c               |  3 ++-
 hw/virtio/virtio-rng.c                 |  5 +++--
 hw/virtio/virtio.c                     | 22 ++++++++++++++-------
 include/hw/virtio/vhost-scsi-common.h  |  2 +-
 include/hw/virtio/vhost-vsock-common.h |  2 +-
 include/hw/virtio/virtio.h             |  2 +-
 include/system/vhost-user-backend.h    |  2 +-
 26 files changed, 160 insertions(+), 109 deletions(-)

diff --git a/backends/vhost-user.c b/backends/vhost-user.c
index 94274a619d..42845329e7 100644
--- a/backends/vhost-user.c
+++ b/backends/vhost-user.c
@@ -97,30 +97,28 @@ err_host_notifiers:
     vhost_dev_disable_notifiers(&b->dev, b->vdev);
 }
 
-void
+int
 vhost_user_backend_stop(VhostUserBackend *b)
 {
     BusState *qbus = BUS(qdev_get_parent_bus(DEVICE(b->vdev)));
     VirtioBusClass *k = VIRTIO_BUS_GET_CLASS(qbus);
-    int ret = 0;
+    int ret;
 
     if (!b->started) {
-        return;
+        return 0;
     }
 
-    vhost_dev_stop(&b->dev, b->vdev, true);
+    ret = vhost_dev_stop(&b->dev, b->vdev, true);
 
-    if (k->set_guest_notifiers) {
-        ret = k->set_guest_notifiers(qbus->parent,
-                                     b->dev.nvqs, false);
-        if (ret < 0) {
-            error_report("vhost guest notifier cleanup failed: %d", ret);
-        }
+    if (k->set_guest_notifiers &&
+        k->set_guest_notifiers(qbus->parent, b->dev.nvqs, false) < 0) {
+        error_report("vhost guest notifier cleanup failed: %d", ret);
+        return -1;
     }
-    assert(ret >= 0);
 
     vhost_dev_disable_notifiers(&b->dev, b->vdev);
     b->started = false;
+    return ret;
 }
 
 static void set_chardev(Object *obj, const char *value, Error **errp)
diff --git a/hw/block/vhost-user-blk.c b/hw/block/vhost-user-blk.c
index 4bb5ed299e..0eebbcd80d 100644
--- a/hw/block/vhost-user-blk.c
+++ b/hw/block/vhost-user-blk.c
@@ -204,7 +204,7 @@ err_host_notifiers:
     return ret;
 }
 
-static void vhost_user_blk_stop(VirtIODevice *vdev)
+static int vhost_user_blk_stop(VirtIODevice *vdev)
 {
     VHostUserBlk *s = VHOST_USER_BLK(vdev);
     BusState *qbus = BUS(qdev_get_parent_bus(DEVICE(vdev)));
@@ -212,26 +212,26 @@ static void vhost_user_blk_stop(VirtIODevice *vdev)
     int ret;
 
     if (!s->started_vu) {
-        return;
+        return 0;
     }
     s->started_vu = false;
 
     if (!k->set_guest_notifiers) {
-        return;
+        return 0;
     }
 
-    vhost_dev_stop(&s->dev, vdev, true);
+    ret = vhost_dev_stop(&s->dev, vdev, true);
 
-    ret = k->set_guest_notifiers(qbus->parent, s->dev.nvqs, false);
-    if (ret < 0) {
+    if (k->set_guest_notifiers(qbus->parent, s->dev.nvqs, false) < 0) {
         error_report("vhost guest notifier cleanup failed: %d", ret);
-        return;
+        return -1;
     }
 
     vhost_dev_disable_notifiers(&s->dev, vdev);
+    return ret;
 }
 
-static void vhost_user_blk_set_status(VirtIODevice *vdev, uint8_t status)
+static int vhost_user_blk_set_status(VirtIODevice *vdev, uint8_t status)
 {
     VHostUserBlk *s = VHOST_USER_BLK(vdev);
     bool should_start = virtio_device_should_start(vdev, status);
@@ -239,11 +239,11 @@ static void vhost_user_blk_set_status(VirtIODevice *vdev, uint8_t status)
     int ret;
 
     if (!s->connected) {
-        return;
+        return -1;
     }
 
     if (vhost_dev_is_started(&s->dev) == should_start) {
-        return;
+        return 0;
     }
 
     if (should_start) {
@@ -253,9 +253,12 @@ static void vhost_user_blk_set_status(VirtIODevice *vdev, uint8_t status)
             qemu_chr_fe_disconnect(&s->chardev);
         }
     } else {
-        vhost_user_blk_stop(vdev);
+        ret = vhost_user_blk_stop(vdev);
+        if (ret < 0) {
+            return ret;
+        }
     }
-
+    return 0;
 }
 
 static uint64_t vhost_user_blk_get_features(VirtIODevice *vdev,
diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
index ea948d18fd..9bab2716c1 100644
--- a/hw/block/virtio-blk.c
+++ b/hw/block/virtio-blk.c
@@ -1270,7 +1270,7 @@ static uint64_t virtio_blk_get_features(VirtIODevice *vdev, uint64_t features,
     return features;
 }
 
-static void virtio_blk_set_status(VirtIODevice *vdev, uint8_t status)
+static int virtio_blk_set_status(VirtIODevice *vdev, uint8_t status)
 {
     VirtIOBlock *s = VIRTIO_BLK(vdev);
 
@@ -1279,7 +1279,7 @@ static void virtio_blk_set_status(VirtIODevice *vdev, uint8_t status)
     }
 
     if (!(status & VIRTIO_CONFIG_S_DRIVER_OK)) {
-        return;
+        return 0;
     }
 
     /* A guest that supports VIRTIO_BLK_F_CONFIG_WCE must be able to send
@@ -1302,6 +1302,7 @@ static void virtio_blk_set_status(VirtIODevice *vdev, uint8_t status)
                                    virtio_vdev_has_feature(vdev,
                                                            VIRTIO_BLK_F_WCE));
     }
+    return 0;
 }
 
 static void virtio_blk_save_device(VirtIODevice *vdev, QEMUFile *f)
diff --git a/hw/char/virtio-serial-bus.c b/hw/char/virtio-serial-bus.c
index eb79f5258b..673c50f0be 100644
--- a/hw/char/virtio-serial-bus.c
+++ b/hw/char/virtio-serial-bus.c
@@ -622,7 +622,7 @@ static void guest_reset(VirtIOSerial *vser)
     }
 }
 
-static void set_status(VirtIODevice *vdev, uint8_t status)
+static int set_status(VirtIODevice *vdev, uint8_t status)
 {
     VirtIOSerial *vser;
     VirtIOSerialPort *port;
@@ -650,6 +650,7 @@ static void set_status(VirtIODevice *vdev, uint8_t status)
             vsc->enable_backend(port, vdev->vm_running);
         }
     }
+    return 0;
 }
 
 static void vser_reset(VirtIODevice *vdev)
diff --git a/hw/display/vhost-user-gpu.c b/hw/display/vhost-user-gpu.c
index 43d4c08a2e..9fc6bbcd2c 100644
--- a/hw/display/vhost-user-gpu.c
+++ b/hw/display/vhost-user-gpu.c
@@ -516,7 +516,7 @@ vhost_user_gpu_set_config(VirtIODevice *vdev,
     }
 }
 
-static void
+static int
 vhost_user_gpu_set_status(VirtIODevice *vdev, uint8_t val)
 {
     VhostUserGPU *g = VHOST_USER_GPU(vdev);
@@ -525,18 +525,24 @@ vhost_user_gpu_set_status(VirtIODevice *vdev, uint8_t val)
     if (val & VIRTIO_CONFIG_S_DRIVER_OK && vdev->vm_running) {
         if (!vhost_user_gpu_do_set_socket(g, &err)) {
             error_report_err(err);
-            return;
+            return 0;
         }
         vhost_user_backend_start(g->vhost);
     } else {
+        int ret;
+
         /* unblock any wait and stop processing */
         if (g->vhost_gpu_fd != -1) {
             vhost_user_gpu_update_blocked(g, true);
             qemu_chr_fe_deinit(&g->vhost_chr, true);
             g->vhost_gpu_fd = -1;
         }
-        vhost_user_backend_stop(g->vhost);
+        ret = vhost_user_backend_stop(g->vhost);
+        if (ret < 0) {
+            return ret;
+        }
     }
+    return 0;
 }
 
 static bool
diff --git a/hw/input/virtio-input.c b/hw/input/virtio-input.c
index 1818cbddc7..a3f554f211 100644
--- a/hw/input/virtio-input.c
+++ b/hw/input/virtio-input.c
@@ -189,7 +189,7 @@ static uint64_t virtio_input_get_features(VirtIODevice *vdev, uint64_t f,
     return f;
 }
 
-static void virtio_input_set_status(VirtIODevice *vdev, uint8_t val)
+static int virtio_input_set_status(VirtIODevice *vdev, uint8_t val)
 {
     VirtIOInputClass *vic = VIRTIO_INPUT_GET_CLASS(vdev);
     VirtIOInput *vinput = VIRTIO_INPUT(vdev);
@@ -202,6 +202,7 @@ static void virtio_input_set_status(VirtIODevice *vdev, uint8_t val)
             }
         }
     }
+    return 0;
 }
 
 static void virtio_input_reset(VirtIODevice *vdev)
diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index 2de037c273..221252e00a 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -382,7 +382,7 @@ static void virtio_net_drop_tx_queue_data(VirtIODevice *vdev, VirtQueue *vq)
     }
 }
 
-static void virtio_net_set_status(struct VirtIODevice *vdev, uint8_t status)
+static int virtio_net_set_status(struct VirtIODevice *vdev, uint8_t status)
 {
     VirtIONet *n = VIRTIO_NET(vdev);
     VirtIONetQueue *q;
@@ -437,6 +437,7 @@ static void virtio_net_set_status(struct VirtIODevice *vdev, uint8_t status)
             }
         }
     }
+    return 0;
 }
 
 static void virtio_net_set_link_status(NetClientState *nc)
diff --git a/hw/scsi/vhost-scsi-common.c b/hw/scsi/vhost-scsi-common.c
index 4c8637045d..43525ba46d 100644
--- a/hw/scsi/vhost-scsi-common.c
+++ b/hw/scsi/vhost-scsi-common.c
@@ -101,24 +101,25 @@ err_host_notifiers:
     return ret;
 }
 
-void vhost_scsi_common_stop(VHostSCSICommon *vsc)
+int vhost_scsi_common_stop(VHostSCSICommon *vsc)
 {
     VirtIODevice *vdev = VIRTIO_DEVICE(vsc);
     BusState *qbus = BUS(qdev_get_parent_bus(DEVICE(vdev)));
     VirtioBusClass *k = VIRTIO_BUS_GET_CLASS(qbus);
     int ret = 0;
 
-    vhost_dev_stop(&vsc->dev, vdev, true);
+    ret = vhost_dev_stop(&vsc->dev, vdev, true);
 
     if (k->set_guest_notifiers) {
-        ret = k->set_guest_notifiers(qbus->parent, vsc->dev.nvqs, false);
-        if (ret < 0) {
-                error_report("vhost guest notifier cleanup failed: %d", ret);
+        int r = k->set_guest_notifiers(qbus->parent, vsc->dev.nvqs, false);
+        if (r < 0) {
+            error_report("vhost guest notifier cleanup failed: %d", ret);
+            return r;
         }
     }
-    assert(ret >= 0);
 
     vhost_dev_disable_notifiers(&vsc->dev, vdev);
+    return ret;
 }
 
 uint64_t vhost_scsi_common_get_features(VirtIODevice *vdev, uint64_t features,
diff --git a/hw/scsi/vhost-scsi.c b/hw/scsi/vhost-scsi.c
index 10fde8eee0..dd4250ebe8 100644
--- a/hw/scsi/vhost-scsi.c
+++ b/hw/scsi/vhost-scsi.c
@@ -114,7 +114,7 @@ static void vhost_scsi_stop(VHostSCSI *s)
     vhost_scsi_common_stop(vsc);
 }
 
-static void vhost_scsi_set_status(VirtIODevice *vdev, uint8_t val)
+static int vhost_scsi_set_status(VirtIODevice *vdev, uint8_t val)
 {
     VHostSCSI *s = VHOST_SCSI(vdev);
     VHostSCSICommon *vsc = VHOST_SCSI_COMMON(s);
@@ -125,7 +125,7 @@ static void vhost_scsi_set_status(VirtIODevice *vdev, uint8_t val)
     }
 
     if (vhost_dev_is_started(&vsc->dev) == start) {
-        return;
+        return 0;
     }
 
     if (start) {
@@ -139,6 +139,7 @@ static void vhost_scsi_set_status(VirtIODevice *vdev, uint8_t val)
     } else {
         vhost_scsi_stop(s);
     }
+    return 0;
 }
 
 static void vhost_dummy_handle_output(VirtIODevice *vdev, VirtQueue *vq)
diff --git a/hw/scsi/vhost-user-scsi.c b/hw/scsi/vhost-user-scsi.c
index 8298e8cc6d..25f2d894e7 100644
--- a/hw/scsi/vhost-user-scsi.c
+++ b/hw/scsi/vhost-user-scsi.c
@@ -52,19 +52,19 @@ static int vhost_user_scsi_start(VHostUserSCSI *s, Error **errp)
     return ret;
 }
 
-static void vhost_user_scsi_stop(VHostUserSCSI *s)
+static int vhost_user_scsi_stop(VHostUserSCSI *s)
 {
     VHostSCSICommon *vsc = VHOST_SCSI_COMMON(s);
 
     if (!s->started_vu) {
-        return;
+        return 0;
     }
     s->started_vu = false;
 
-    vhost_scsi_common_stop(vsc);
+    return vhost_scsi_common_stop(vsc);
 }
 
-static void vhost_user_scsi_set_status(VirtIODevice *vdev, uint8_t status)
+static int vhost_user_scsi_set_status(VirtIODevice *vdev, uint8_t status)
 {
     VHostUserSCSI *s = (VHostUserSCSI *)vdev;
     DeviceState *dev = DEVICE(vdev);
@@ -75,11 +75,11 @@ static void vhost_user_scsi_set_status(VirtIODevice *vdev, uint8_t status)
     int ret;
 
     if (!s->connected) {
-        return;
+        return -1;
     }
 
     if (vhost_dev_is_started(&vsc->dev) == should_start) {
-        return;
+        return 0;
     }
 
     if (should_start) {
@@ -91,8 +91,12 @@ static void vhost_user_scsi_set_status(VirtIODevice *vdev, uint8_t status)
             qemu_chr_fe_disconnect(&vs->conf.chardev);
         }
     } else {
-        vhost_user_scsi_stop(s);
+        ret = vhost_user_scsi_stop(s);
+        if (ret) {
+            return ret;
+        }
     }
+    return 0;
 }
 
 static void vhost_user_scsi_handle_output(VirtIODevice *vdev, VirtQueue *vq)
diff --git a/hw/virtio/vdpa-dev.c b/hw/virtio/vdpa-dev.c
index dd8837ce4e..d1da40afc8 100644
--- a/hw/virtio/vdpa-dev.c
+++ b/hw/virtio/vdpa-dev.c
@@ -312,7 +312,7 @@ static void vhost_vdpa_device_stop(VirtIODevice *vdev)
     vhost_dev_disable_notifiers(&s->dev, vdev);
 }
 
-static void vhost_vdpa_device_set_status(VirtIODevice *vdev, uint8_t status)
+static int vhost_vdpa_device_set_status(VirtIODevice *vdev, uint8_t status)
 {
     VhostVdpaDevice *s = VHOST_VDPA_DEVICE(vdev);
     bool should_start = virtio_device_started(vdev, status);
@@ -324,7 +324,7 @@ static void vhost_vdpa_device_set_status(VirtIODevice *vdev, uint8_t status)
     }
 
     if (s->started == should_start) {
-        return;
+        return 0;
     }
 
     if (should_start) {
@@ -335,6 +335,7 @@ static void vhost_vdpa_device_set_status(VirtIODevice *vdev, uint8_t status)
     } else {
         vhost_vdpa_device_stop(vdev);
     }
+    return 0;
 }
 
 static const Property vhost_vdpa_device_properties[] = {
diff --git a/hw/virtio/vhost-user-base.c b/hw/virtio/vhost-user-base.c
index 77143320a2..ff67a020b4 100644
--- a/hw/virtio/vhost-user-base.c
+++ b/hw/virtio/vhost-user-base.c
@@ -66,7 +66,7 @@ err_host_notifiers:
     vhost_dev_disable_notifiers(&vub->vhost_dev, vdev);
 }
 
-static void vub_stop(VirtIODevice *vdev)
+static int vub_stop(VirtIODevice *vdev)
 {
     VHostUserBase *vub = VHOST_USER_BASE(vdev);
     BusState *qbus = BUS(qdev_get_parent_bus(DEVICE(vdev)));
@@ -74,34 +74,39 @@ static void vub_stop(VirtIODevice *vdev)
     int ret;
 
     if (!k->set_guest_notifiers) {
-        return;
+        return 0;
     }
 
-    vhost_dev_stop(&vub->vhost_dev, vdev, true);
+    ret = vhost_dev_stop(&vub->vhost_dev, vdev, true);
 
-    ret = k->set_guest_notifiers(qbus->parent, vub->vhost_dev.nvqs, false);
-    if (ret < 0) {
+    if (k->set_guest_notifiers(qbus->parent, vub->vhost_dev.nvqs, false) < 0) {
         error_report("vhost guest notifier cleanup failed: %d", ret);
-        return;
+        return -1;
     }
 
     vhost_dev_disable_notifiers(&vub->vhost_dev, vdev);
+    return ret;
 }
 
-static void vub_set_status(VirtIODevice *vdev, uint8_t status)
+static int vub_set_status(VirtIODevice *vdev, uint8_t status)
 {
     VHostUserBase *vub = VHOST_USER_BASE(vdev);
     bool should_start = virtio_device_should_start(vdev, status);
 
     if (vhost_dev_is_started(&vub->vhost_dev) == should_start) {
-        return;
+        return 0;
     }
 
     if (should_start) {
         vub_start(vdev);
     } else {
-        vub_stop(vdev);
+        int ret;
+        ret = vub_stop(vdev);
+        if (ret < 0) {
+            return ret;
+        }
     }
+    return 0;
 }
 
 /*
diff --git a/hw/virtio/vhost-user-fs.c b/hw/virtio/vhost-user-fs.c
index f6d1fc8804..e77c69eb12 100644
--- a/hw/virtio/vhost-user-fs.c
+++ b/hw/virtio/vhost-user-fs.c
@@ -100,7 +100,7 @@ err_host_notifiers:
     vhost_dev_disable_notifiers(&fs->vhost_dev, vdev);
 }
 
-static void vuf_stop(VirtIODevice *vdev)
+static int vuf_stop(VirtIODevice *vdev)
 {
     VHostUserFS *fs = VHOST_USER_FS(vdev);
     BusState *qbus = BUS(qdev_get_parent_bus(DEVICE(vdev)));
@@ -108,34 +108,39 @@ static void vuf_stop(VirtIODevice *vdev)
     int ret;
 
     if (!k->set_guest_notifiers) {
-        return;
+        return 0;
     }
 
-    vhost_dev_stop(&fs->vhost_dev, vdev, true);
+    ret = vhost_dev_stop(&fs->vhost_dev, vdev, true);
 
-    ret = k->set_guest_notifiers(qbus->parent, fs->vhost_dev.nvqs, false);
-    if (ret < 0) {
+    if (k->set_guest_notifiers(qbus->parent, fs->vhost_dev.nvqs, false) < 0) {
         error_report("vhost guest notifier cleanup failed: %d", ret);
-        return;
+        return -1;
     }
 
     vhost_dev_disable_notifiers(&fs->vhost_dev, vdev);
+    return ret;
 }
 
-static void vuf_set_status(VirtIODevice *vdev, uint8_t status)
+static int vuf_set_status(VirtIODevice *vdev, uint8_t status)
 {
     VHostUserFS *fs = VHOST_USER_FS(vdev);
     bool should_start = virtio_device_should_start(vdev, status);
 
     if (vhost_dev_is_started(&fs->vhost_dev) == should_start) {
-        return;
+        return 0;
     }
 
     if (should_start) {
         vuf_start(vdev);
     } else {
-        vuf_stop(vdev);
+        int ret;
+        ret = vuf_stop(vdev);
+        if (ret < 0) {
+            return ret;
+        }
     }
+    return 0;
 }
 
 static uint64_t vuf_get_features(VirtIODevice *vdev,
diff --git a/hw/virtio/vhost-user-scmi.c b/hw/virtio/vhost-user-scmi.c
index 7a0f622181..f9264c4374 100644
--- a/hw/virtio/vhost-user-scmi.c
+++ b/hw/virtio/vhost-user-scmi.c
@@ -83,7 +83,7 @@ err_host_notifiers:
     return ret;
 }
 
-static void vu_scmi_stop(VirtIODevice *vdev)
+static int vu_scmi_stop(VirtIODevice *vdev)
 {
     VHostUserSCMI *scmi = VHOST_USER_SCMI(vdev);
     BusState *qbus = BUS(qdev_get_parent_bus(DEVICE(vdev)));
@@ -93,41 +93,46 @@ static void vu_scmi_stop(VirtIODevice *vdev)
 
     /* vhost_dev_is_started() check in the callers is not fully reliable. */
     if (!scmi->started_vu) {
-        return;
+        return 0;
     }
     scmi->started_vu = false;
 
     if (!k->set_guest_notifiers) {
-        return;
+        return 0;
     }
 
-    vhost_dev_stop(vhost_dev, vdev, true);
+    ret = vhost_dev_stop(vhost_dev, vdev, true);
 
-    ret = k->set_guest_notifiers(qbus->parent, vhost_dev->nvqs, false);
-    if (ret < 0) {
+    if (k->set_guest_notifiers(qbus->parent, vhost_dev->nvqs, false) < 0) {
         error_report("vhost guest notifier cleanup failed: %d", ret);
-        return;
+        return -1;
     }
     vhost_dev_disable_notifiers(vhost_dev, vdev);
+    return ret;
 }
 
-static void vu_scmi_set_status(VirtIODevice *vdev, uint8_t status)
+static int vu_scmi_set_status(VirtIODevice *vdev, uint8_t status)
 {
     VHostUserSCMI *scmi = VHOST_USER_SCMI(vdev);
     bool should_start = virtio_device_should_start(vdev, status);
 
     if (!scmi->connected) {
-        return;
+        return -1;
     }
     if (vhost_dev_is_started(&scmi->vhost_dev) == should_start) {
-        return;
+        return 0;
     }
 
     if (should_start) {
         vu_scmi_start(vdev);
     } else {
-        vu_scmi_stop(vdev);
+        int ret;
+        ret = vu_scmi_stop(vdev);
+        if (ret < 0) {
+            return ret;
+        }
     }
+    return 0;
 }
 
 static uint64_t vu_scmi_get_features(VirtIODevice *vdev, uint64_t features,
diff --git a/hw/virtio/vhost-user-vsock.c b/hw/virtio/vhost-user-vsock.c
index 2776792f59..993c287348 100644
--- a/hw/virtio/vhost-user-vsock.c
+++ b/hw/virtio/vhost-user-vsock.c
@@ -54,23 +54,28 @@ const VhostDevConfigOps vsock_ops = {
     .vhost_dev_config_notifier = vuv_handle_config_change,
 };
 
-static void vuv_set_status(VirtIODevice *vdev, uint8_t status)
+static int vuv_set_status(VirtIODevice *vdev, uint8_t status)
 {
     VHostVSockCommon *vvc = VHOST_VSOCK_COMMON(vdev);
     bool should_start = virtio_device_should_start(vdev, status);
+    int ret;
 
     if (vhost_dev_is_started(&vvc->vhost_dev) == should_start) {
-        return;
+        return 0;
     }
 
     if (should_start) {
-        int ret = vhost_vsock_common_start(vdev);
+        ret = vhost_vsock_common_start(vdev);
         if (ret < 0) {
-            return;
+            return ret;
         }
     } else {
-        vhost_vsock_common_stop(vdev);
+        ret = vhost_vsock_common_stop(vdev);
+        if (ret < 0) {
+            return ret;
+        }
     }
+    return 0;
 }
 
 static uint64_t vuv_get_features(VirtIODevice *vdev,
diff --git a/hw/virtio/vhost-vsock-common.c b/hw/virtio/vhost-vsock-common.c
index 4b4fbb45cc..c6c44d8989 100644
--- a/hw/virtio/vhost-vsock-common.c
+++ b/hw/virtio/vhost-vsock-common.c
@@ -95,7 +95,7 @@ err_host_notifiers:
     return ret;
 }
 
-void vhost_vsock_common_stop(VirtIODevice *vdev)
+int vhost_vsock_common_stop(VirtIODevice *vdev)
 {
     VHostVSockCommon *vvc = VHOST_VSOCK_COMMON(vdev);
     BusState *qbus = BUS(qdev_get_parent_bus(DEVICE(vdev)));
@@ -103,18 +103,18 @@ void vhost_vsock_common_stop(VirtIODevice *vdev)
     int ret;
 
     if (!k->set_guest_notifiers) {
-        return;
+        return 0;
     }
 
-    vhost_dev_stop(&vvc->vhost_dev, vdev, true);
+    ret = vhost_dev_stop(&vvc->vhost_dev, vdev, true);
 
-    ret = k->set_guest_notifiers(qbus->parent, vvc->vhost_dev.nvqs, false);
-    if (ret < 0) {
+    if (k->set_guest_notifiers(qbus->parent, vvc->vhost_dev.nvqs, false) < 0) {
         error_report("vhost guest notifier cleanup failed: %d", ret);
-        return;
+        return -1;
     }
 
     vhost_dev_disable_notifiers(&vvc->vhost_dev, vdev);
+    return ret;
 }
 
 
diff --git a/hw/virtio/vhost-vsock.c b/hw/virtio/vhost-vsock.c
index b73dc723c2..6e4088831f 100644
--- a/hw/virtio/vhost-vsock.c
+++ b/hw/virtio/vhost-vsock.c
@@ -67,37 +67,38 @@ static int vhost_vsock_set_running(VirtIODevice *vdev, int start)
 }
 
 
-static void vhost_vsock_set_status(VirtIODevice *vdev, uint8_t status)
+static int vhost_vsock_set_status(VirtIODevice *vdev, uint8_t status)
 {
     VHostVSockCommon *vvc = VHOST_VSOCK_COMMON(vdev);
     bool should_start = virtio_device_should_start(vdev, status);
     int ret;
 
     if (vhost_dev_is_started(&vvc->vhost_dev) == should_start) {
-        return;
+        return 0;
     }
 
     if (should_start) {
         ret = vhost_vsock_common_start(vdev);
         if (ret < 0) {
-            return;
+            return 0;
         }
 
         ret = vhost_vsock_set_running(vdev, 1);
         if (ret < 0) {
             vhost_vsock_common_stop(vdev);
             error_report("Error starting vhost vsock: %d", -ret);
-            return;
+            return 0;
         }
     } else {
         ret = vhost_vsock_set_running(vdev, 0);
         if (ret < 0) {
             error_report("vhost vsock set running failed: %d", ret);
-            return;
+            return 0;
         }
 
         vhost_vsock_common_stop(vdev);
     }
+    return 0;
 }
 
 static uint64_t vhost_vsock_get_features(VirtIODevice *vdev,
diff --git a/hw/virtio/virtio-balloon.c b/hw/virtio/virtio-balloon.c
index 91510ec2e2..db787d00b3 100644
--- a/hw/virtio/virtio-balloon.c
+++ b/hw/virtio/virtio-balloon.c
@@ -958,7 +958,7 @@ static void virtio_balloon_device_reset(VirtIODevice *vdev)
     s->poison_val = 0;
 }
 
-static void virtio_balloon_set_status(VirtIODevice *vdev, uint8_t status)
+static int virtio_balloon_set_status(VirtIODevice *vdev, uint8_t status)
 {
     VirtIOBalloon *s = VIRTIO_BALLOON(vdev);
 
@@ -988,6 +988,7 @@ static void virtio_balloon_set_status(VirtIODevice *vdev, uint8_t status)
             qemu_mutex_unlock(&s->free_page_lock);
         }
     }
+    return 0;
 }
 
 static ResettableState *virtio_balloon_get_reset_state(Object *obj)
diff --git a/hw/virtio/virtio-crypto.c b/hw/virtio/virtio-crypto.c
index e24d6914b6..517f2089c5 100644
--- a/hw/virtio/virtio-crypto.c
+++ b/hw/virtio/virtio-crypto.c
@@ -1197,11 +1197,12 @@ static void virtio_crypto_vhost_status(VirtIOCrypto *c, uint8_t status)
     }
 }
 
-static void virtio_crypto_set_status(VirtIODevice *vdev, uint8_t status)
+static int virtio_crypto_set_status(VirtIODevice *vdev, uint8_t status)
 {
     VirtIOCrypto *vcrypto = VIRTIO_CRYPTO(vdev);
 
     virtio_crypto_vhost_status(vcrypto, status);
+    return 0;
 }
 
 static void virtio_crypto_guest_notifier_mask(VirtIODevice *vdev, int idx,
diff --git a/hw/virtio/virtio-iommu.c b/hw/virtio/virtio-iommu.c
index 54060988ef..3500f1b082 100644
--- a/hw/virtio/virtio-iommu.c
+++ b/hw/virtio/virtio-iommu.c
@@ -1522,9 +1522,10 @@ static void virtio_iommu_device_reset_exit(Object *obj, ResetType type)
                                    NULL, NULL, virtio_iommu_put_endpoint);
 }
 
-static void virtio_iommu_set_status(VirtIODevice *vdev, uint8_t status)
+static int virtio_iommu_set_status(VirtIODevice *vdev, uint8_t status)
 {
     trace_virtio_iommu_device_status(status);
+    return 0;
 }
 
 static void virtio_iommu_instance_init(Object *obj)
diff --git a/hw/virtio/virtio-rng.c b/hw/virtio/virtio-rng.c
index dcb3c71d6a..3df5d2576e 100644
--- a/hw/virtio/virtio-rng.c
+++ b/hw/virtio/virtio-rng.c
@@ -159,17 +159,18 @@ static void check_rate_limit(void *opaque)
     vrng->activate_timer = true;
 }
 
-static void virtio_rng_set_status(VirtIODevice *vdev, uint8_t status)
+static int virtio_rng_set_status(VirtIODevice *vdev, uint8_t status)
 {
     VirtIORNG *vrng = VIRTIO_RNG(vdev);
 
     if (!vdev->vm_running) {
-        return;
+        return 0;
     }
     vdev->status = status;
 
     /* Something changed, try to process buffers */
     virtio_rng_process(vrng);
+    return 0;
 }
 
 static void virtio_rng_device_realize(DeviceState *dev, Error **errp)
diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
index e3b62522ec..1b55d8d8a2 100644
--- a/hw/virtio/virtio.c
+++ b/hw/virtio/virtio.c
@@ -2221,12 +2221,12 @@ int virtio_set_status(VirtIODevice *vdev, uint8_t val)
 {
     VirtioDeviceClass *k = VIRTIO_DEVICE_GET_CLASS(vdev);
     trace_virtio_set_status(vdev, val);
+    int ret = 0;
 
     if (virtio_vdev_has_feature(vdev, VIRTIO_F_VERSION_1)) {
         if (!(vdev->status & VIRTIO_CONFIG_S_FEATURES_OK) &&
             val & VIRTIO_CONFIG_S_FEATURES_OK) {
-            int ret = virtio_validate_features(vdev);
-
+            ret = virtio_validate_features(vdev);
             if (ret) {
                 return ret;
             }
@@ -2239,11 +2239,15 @@ int virtio_set_status(VirtIODevice *vdev, uint8_t val)
     }
 
     if (k->set_status) {
-        k->set_status(vdev, val);
+        ret = k->set_status(vdev, val);
+        if (ret) {
+            qemu_log("set %s status to %d failed, old status: %d\n",
+                     vdev->name, val, vdev->status);
+        }
     }
     vdev->status = val;
 
-    return 0;
+    return ret;
 }
 
 static enum virtio_device_endian virtio_default_endian(void)
@@ -3419,7 +3423,7 @@ void virtio_cleanup(VirtIODevice *vdev)
     qemu_del_vm_change_state_handler(vdev->vmstate);
 }
 
-static void virtio_vmstate_change(void *opaque, bool running, RunState state)
+static int virtio_vmstate_change(void *opaque, bool running, RunState state)
 {
     VirtIODevice *vdev = opaque;
     BusState *qbus = qdev_get_parent_bus(DEVICE(vdev));
@@ -3436,8 +3440,12 @@ static void virtio_vmstate_change(void *opaque, bool running, RunState state)
     }
 
     if (!backend_run) {
-        virtio_set_status(vdev, vdev->status);
+        int ret = virtio_set_status(vdev, vdev->status);
+        if (ret) {
+            return ret;
+        }
     }
+    return 0;
 }
 
 void virtio_instance_init_common(Object *proxy_obj, void *data,
@@ -3489,7 +3497,7 @@ void virtio_init(VirtIODevice *vdev, uint16_t device_id, size_t config_size)
         vdev->config = NULL;
     }
     vdev->vmstate = qdev_add_vm_change_state_handler(DEVICE(vdev),
-            virtio_vmstate_change, NULL, vdev);
+            NULL, virtio_vmstate_change, vdev);
     vdev->device_endian = virtio_default_endian();
     vdev->use_guest_notifier_mask = true;
 }
diff --git a/include/hw/virtio/vhost-scsi-common.h b/include/hw/virtio/vhost-scsi-common.h
index c5d2c09455..d54d9c916f 100644
--- a/include/hw/virtio/vhost-scsi-common.h
+++ b/include/hw/virtio/vhost-scsi-common.h
@@ -40,7 +40,7 @@ struct VHostSCSICommon {
 };
 
 int vhost_scsi_common_start(VHostSCSICommon *vsc, Error **errp);
-void vhost_scsi_common_stop(VHostSCSICommon *vsc);
+int vhost_scsi_common_stop(VHostSCSICommon *vsc);
 char *vhost_scsi_common_get_fw_dev_path(FWPathProvider *p, BusState *bus,
                                         DeviceState *dev);
 void vhost_scsi_common_set_config(VirtIODevice *vdev, const uint8_t *config);
diff --git a/include/hw/virtio/vhost-vsock-common.h b/include/hw/virtio/vhost-vsock-common.h
index 75a74e8a99..01bf6062af 100644
--- a/include/hw/virtio/vhost-vsock-common.h
+++ b/include/hw/virtio/vhost-vsock-common.h
@@ -42,7 +42,7 @@ struct VHostVSockCommon {
 };
 
 int vhost_vsock_common_start(VirtIODevice *vdev);
-void vhost_vsock_common_stop(VirtIODevice *vdev);
+int vhost_vsock_common_stop(VirtIODevice *vdev);
 int vhost_vsock_common_pre_save(void *opaque);
 int vhost_vsock_common_post_load(void *opaque, int version_id);
 void vhost_vsock_common_realize(VirtIODevice *vdev);
diff --git a/include/hw/virtio/virtio.h b/include/hw/virtio/virtio.h
index 7e0c471ea4..214d4a77e9 100644
--- a/include/hw/virtio/virtio.h
+++ b/include/hw/virtio/virtio.h
@@ -186,7 +186,7 @@ struct VirtioDeviceClass {
     void (*get_config)(VirtIODevice *vdev, uint8_t *config);
     void (*set_config)(VirtIODevice *vdev, const uint8_t *config);
     void (*reset)(VirtIODevice *vdev);
-    void (*set_status)(VirtIODevice *vdev, uint8_t val);
+    int (*set_status)(VirtIODevice *vdev, uint8_t val);
     /* Device must validate queue_index.  */
     void (*queue_reset)(VirtIODevice *vdev, uint32_t queue_index);
     /* Device must validate queue_index.  */
diff --git a/include/system/vhost-user-backend.h b/include/system/vhost-user-backend.h
index 5ed953cd53..5634ebdb2e 100644
--- a/include/system/vhost-user-backend.h
+++ b/include/system/vhost-user-backend.h
@@ -43,6 +43,6 @@ struct VhostUserBackend {
 int vhost_user_backend_dev_init(VhostUserBackend *b, VirtIODevice *vdev,
                                 unsigned nvqs, Error **errp);
 void vhost_user_backend_start(VhostUserBackend *b);
-void vhost_user_backend_stop(VhostUserBackend *b);
+int vhost_user_backend_stop(VhostUserBackend *b);
 
 #endif

From 1a5a2629eab94297a37e4adcc5fb69beb7bb0b0c Mon Sep 17 00:00:00 2001
From: Dongli Zhang <dongli.zhang@oracle.com>
Date: Sun, 2 Feb 2025 16:52:15 -0800
Subject: [PATCH 0876/2760] vhost-scsi: support VIRTIO_SCSI_F_HOTPLUG

So far there isn't way to test host kernel vhost-scsi event queue path,
because VIRTIO_SCSI_F_HOTPLUG isn't supported by QEMU.

virtio-scsi.c and vhost-user-scsi.c already support VIRTIO_SCSI_F_HOTPLUG
as property "hotplug".

Add support to vhost-scsi.c to help evaluate and test event queue.

To test the feature:

1. Create vhost-scsi target with targetcli.

targetcli /backstores/fileio create name=storage file_or_dev=disk01.raw
targetcli /vhost create naa.1123451234512345
targetcli /vhost/naa.1123451234512345/tpg1/luns create /backstores/fileio/storage

2. Create QEMU instance with vhost-scsi.

-device vhost-scsi-pci,wwpn=naa.1123451234512345,hotplug=true

3. Once guest bootup, hotplug a new LUN from host.

targetcli /backstores/fileio create name=storage02 file_or_dev=disk02.raw
targetcli /vhost/naa.1123451234512345/tpg1/luns create /backstores/fileio/storage02

Signed-off-by: Dongli Zhang <dongli.zhang@oracle.com>
Message-Id: <20250203005215.1502-1-dongli.zhang@oracle.com>
Acked-by: Stefano Garzarella <sgarzare@redhat.com>
---
 hw/scsi/vhost-scsi.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/hw/scsi/vhost-scsi.c b/hw/scsi/vhost-scsi.c
index dd4250ebe8..cdf405b0f8 100644
--- a/hw/scsi/vhost-scsi.c
+++ b/hw/scsi/vhost-scsi.c
@@ -359,6 +359,9 @@ static const Property vhost_scsi_properties[] = {
     DEFINE_PROP_BIT64("t10_pi", VHostSCSICommon, host_features,
                                                  VIRTIO_SCSI_F_T10_PI,
                                                  false),
+    DEFINE_PROP_BIT64("hotplug", VHostSCSICommon, host_features,
+                                                  VIRTIO_SCSI_F_HOTPLUG,
+                                                  false),
     DEFINE_PROP_BOOL("migratable", VHostSCSICommon, migratable, false),
     DEFINE_PROP_BOOL("worker_per_virtqueue", VirtIOSCSICommon,
                      conf.worker_per_virtqueue, false),

From 0caed25cd171c611781589b5402161d27d57229c Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <akihiko.odaki@daynix.com>
Date: Mon, 21 Apr 2025 21:17:20 +0900
Subject: [PATCH 0877/2760] virtio: Call set_features during reset

virtio-net expects set_features() will be called when the feature set
used by the guest changes to update the number of virtqueues but it is
not called during reset, which will clear all features, leaving the
queues added for VIRTIO_NET_F_MQ or VIRTIO_NET_F_RSS. Not only these
extra queues are visible to the guest, they will cause segmentation
fault during migration.

Call set_features() during reset to remove those queues for virtio-net
as we call set_status(). It will also prevent similar bugs for
virtio-net and other devices in the future.

Fixes: f9d6dbf0bf6e ("virtio-net: remove virtio queues if the guest doesn't support multiqueue")
Buglink: https://issues.redhat.com/browse/RHEL-73842
Cc: qemu-stable@nongnu.org
Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Message-Id: <20250421-reset-v2-1-e4c1ead88ea1@daynix.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/virtio/virtio.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
index 1b55d8d8a2..3300f4afb0 100644
--- a/hw/virtio/virtio.c
+++ b/hw/virtio/virtio.c
@@ -2320,6 +2320,8 @@ void virtio_queue_enable(VirtIODevice *vdev, uint32_t queue_index)
     }
 }
 
+static int virtio_set_features_nocheck(VirtIODevice *vdev, uint64_t val);
+
 void virtio_reset(void *opaque)
 {
     VirtIODevice *vdev = opaque;
@@ -2350,7 +2352,7 @@ void virtio_reset(void *opaque)
     vdev->start_on_kick = false;
     vdev->started = false;
     vdev->broken = false;
-    vdev->guest_features = 0;
+    virtio_set_features_nocheck(vdev, 0);
     vdev->queue_sel = 0;
     vdev->status = 0;
     vdev->disabled = false;

From 77a9408fc774ad99dcd16ea08f31b96b590fbf99 Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <akihiko.odaki@daynix.com>
Date: Mon, 21 Apr 2025 21:17:21 +0900
Subject: [PATCH 0878/2760] virtio: Move virtio_reset()

Move virtio_reset() to a later part of the file to remove the forward
declaration of virtio_set_features_nocheck() and to prepare the
situation that we need more operations to perform during reset.

Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Message-Id: <20250421-reset-v2-2-e4c1ead88ea1@daynix.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/virtio/virtio.c | 88 ++++++++++++++++++++++------------------------
 1 file changed, 43 insertions(+), 45 deletions(-)

diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
index 3300f4afb0..2e98cecf64 100644
--- a/hw/virtio/virtio.c
+++ b/hw/virtio/virtio.c
@@ -2320,51 +2320,6 @@ void virtio_queue_enable(VirtIODevice *vdev, uint32_t queue_index)
     }
 }
 
-static int virtio_set_features_nocheck(VirtIODevice *vdev, uint64_t val);
-
-void virtio_reset(void *opaque)
-{
-    VirtIODevice *vdev = opaque;
-    VirtioDeviceClass *k = VIRTIO_DEVICE_GET_CLASS(vdev);
-    int i;
-
-    virtio_set_status(vdev, 0);
-    if (current_cpu) {
-        /* Guest initiated reset */
-        vdev->device_endian = virtio_current_cpu_endian();
-    } else {
-        /* System reset */
-        vdev->device_endian = virtio_default_endian();
-    }
-
-    if (k->get_vhost) {
-        struct vhost_dev *hdev = k->get_vhost(vdev);
-        /* Only reset when vhost back-end is connected */
-        if (hdev && hdev->vhost_ops) {
-            vhost_reset_device(hdev);
-        }
-    }
-
-    if (k->reset) {
-        k->reset(vdev);
-    }
-
-    vdev->start_on_kick = false;
-    vdev->started = false;
-    vdev->broken = false;
-    virtio_set_features_nocheck(vdev, 0);
-    vdev->queue_sel = 0;
-    vdev->status = 0;
-    vdev->disabled = false;
-    qatomic_set(&vdev->isr, 0);
-    vdev->config_vector = VIRTIO_NO_VECTOR;
-    virtio_notify_vector(vdev, vdev->config_vector);
-
-    for(i = 0; i < VIRTIO_QUEUE_MAX; i++) {
-        __virtio_queue_reset(vdev, i);
-    }
-}
-
 void virtio_queue_set_addr(VirtIODevice *vdev, int n, hwaddr addr)
 {
     if (!vdev->vq[n].vring.num) {
@@ -3175,6 +3130,49 @@ int virtio_set_features(VirtIODevice *vdev, uint64_t val)
     return ret;
 }
 
+void virtio_reset(void *opaque)
+{
+    VirtIODevice *vdev = opaque;
+    VirtioDeviceClass *k = VIRTIO_DEVICE_GET_CLASS(vdev);
+    int i;
+
+    virtio_set_status(vdev, 0);
+    if (current_cpu) {
+        /* Guest initiated reset */
+        vdev->device_endian = virtio_current_cpu_endian();
+    } else {
+        /* System reset */
+        vdev->device_endian = virtio_default_endian();
+    }
+
+    if (k->get_vhost) {
+        struct vhost_dev *hdev = k->get_vhost(vdev);
+        /* Only reset when vhost back-end is connected */
+        if (hdev && hdev->vhost_ops) {
+            vhost_reset_device(hdev);
+        }
+    }
+
+    if (k->reset) {
+        k->reset(vdev);
+    }
+
+    vdev->start_on_kick = false;
+    vdev->started = false;
+    vdev->broken = false;
+    virtio_set_features_nocheck(vdev, 0);
+    vdev->queue_sel = 0;
+    vdev->status = 0;
+    vdev->disabled = false;
+    qatomic_set(&vdev->isr, 0);
+    vdev->config_vector = VIRTIO_NO_VECTOR;
+    virtio_notify_vector(vdev, vdev->config_vector);
+
+    for (i = 0; i < VIRTIO_QUEUE_MAX; i++) {
+        __virtio_queue_reset(vdev, i);
+    }
+}
+
 static void virtio_device_check_notification_compatibility(VirtIODevice *vdev,
                                                            Error **errp)
 {

From b1c84782bfddeaa0070f5ae57ac2e4e3992f9f19 Mon Sep 17 00:00:00 2001
From: CLEMENT MATHIEU--DRIF <clement.mathieu--drif@eviden.com>
Date: Wed, 30 Apr 2025 12:48:06 +0000
Subject: [PATCH 0879/2760] intel_iommu: Use BQL_LOCK_GUARD to manage cleanup
 automatically

vtd_switch_address_space needs to take the BQL if not already held.
Use BQL_LOCK_GUARD to make the iommu implementation more consistent.

Signed-off-by: Clement Mathieu--Drif <clement.mathieu--drif@eviden.com>
Message-Id: <20250430124750.240412-2-clement.mathieu--drif@eviden.com>
Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/intel_iommu.c | 10 +---------
 1 file changed, 1 insertion(+), 9 deletions(-)

diff --git a/hw/i386/intel_iommu.c b/hw/i386/intel_iommu.c
index 5f8ed1243d..b925e65b02 100644
--- a/hw/i386/intel_iommu.c
+++ b/hw/i386/intel_iommu.c
@@ -1728,8 +1728,6 @@ static bool vtd_as_pt_enabled(VTDAddressSpace *as)
 static bool vtd_switch_address_space(VTDAddressSpace *as)
 {
     bool use_iommu, pt;
-    /* Whether we need to take the BQL on our own */
-    bool take_bql = !bql_locked();
 
     assert(as);
 
@@ -1746,9 +1744,7 @@ static bool vtd_switch_address_space(VTDAddressSpace *as)
      * from vtd_pt_enable_fast_path(). However the memory APIs need
      * it. We'd better make sure we have had it already, or, take it.
      */
-    if (take_bql) {
-        bql_lock();
-    }
+    BQL_LOCK_GUARD();
 
     /* Turn off first then on the other */
     if (use_iommu) {
@@ -1801,10 +1797,6 @@ static bool vtd_switch_address_space(VTDAddressSpace *as)
         memory_region_set_enabled(&as->iommu_ir_fault, false);
     }
 
-    if (take_bql) {
-        bql_unlock();
-    }
-
     return use_iommu;
 }
 

From 6ea7a5762aa1aacb7a5410e4b805bb8c99c6f133 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Thu, 8 May 2025 16:41:16 +0200
Subject: [PATCH 0880/2760] include/hw/dma/xlnx_dpdma: Remove dependency on
 console.h
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

console.h brings a dependency on the <epoxy/opengl.h> and the pixman
header file (if available), so we should avoid to include this file
if it is not really necessary. console.h does not seem to be necessary
for the xlnx_dpdma code, so drop the include here.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250508144120.163009-2-thuth@redhat.com>
---
 include/hw/dma/xlnx_dpdma.h | 1 -
 1 file changed, 1 deletion(-)

diff --git a/include/hw/dma/xlnx_dpdma.h b/include/hw/dma/xlnx_dpdma.h
index 1ec0d265be..484b2e377f 100644
--- a/include/hw/dma/xlnx_dpdma.h
+++ b/include/hw/dma/xlnx_dpdma.h
@@ -26,7 +26,6 @@
 #define XLNX_DPDMA_H
 
 #include "hw/sysbus.h"
-#include "ui/console.h"
 #include "system/dma.h"
 #include "qom/object.h"
 

From 7c312d8539fe69338f7343b6514f2dc77ae2efa6 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Thu, 24 Apr 2025 11:06:40 +0200
Subject: [PATCH 0881/2760] tests/functional/test_s390x_tuxrun: Check whether
 the machine is available

The s390x tuxrun test lacks the call to self.set_machine(), so this
test is currently failing in case the 's390-ccw-virtio' machine has
not been compiled into the binary. Add the check now to fix it.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250424090640.664217-1-thuth@redhat.com>
---
 tests/functional/test_s390x_tuxrun.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tests/functional/test_s390x_tuxrun.py b/tests/functional/test_s390x_tuxrun.py
index a7db4bfd84..8df3c6893b 100755
--- a/tests/functional/test_s390x_tuxrun.py
+++ b/tests/functional/test_s390x_tuxrun.py
@@ -24,6 +24,7 @@ class TuxRunS390xTest(TuxRunBaselineTest):
         'bff7971fc2fef56372d98afe4557b82fd0a785a241e44c29b058e577ad1bbb44')
 
     def test_s390(self):
+        self.set_machine('s390-ccw-virtio')
         self.wait_for_shutdown=False
         self.common_tuxrun(kernel_asset=self.ASSET_S390X_KERNEL,
                            rootfs_asset=self.ASSET_S390X_ROOTFS,

From c23d3339ce8fc936d8c60a023ea2b052d847dc78 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Tue, 25 Mar 2025 09:17:13 +0100
Subject: [PATCH 0882/2760] tests/functional: Skip the screendump tests if the
 command is not available

It is possible nowadays to compile QEMU without pixman support - in that
case the screendump command is not available and the related tests fail.
Thus skip these tests if the screendump command could not be executed.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250325081713.283490-2-thuth@redhat.com>
---
 tests/functional/test_arm_integratorcp.py | 6 ++++--
 tests/functional/test_m68k_nextcube.py    | 6 ++++--
 tests/functional/test_mips64el_malta.py   | 6 ++++--
 3 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/tests/functional/test_arm_integratorcp.py b/tests/functional/test_arm_integratorcp.py
index a85b339d77..4f00924aa0 100755
--- a/tests/functional/test_arm_integratorcp.py
+++ b/tests/functional/test_arm_integratorcp.py
@@ -73,8 +73,10 @@ class IntegratorMachine(QemuSystemTest):
         framebuffer_ready = 'Console: switching to colour frame buffer device'
         wait_for_console_pattern(self, framebuffer_ready)
         self.vm.cmd('human-monitor-command', command_line='stop')
-        self.vm.cmd('human-monitor-command',
-                    command_line='screendump %s' % screendump_path)
+        res = self.vm.cmd('human-monitor-command',
+                          command_line='screendump %s' % screendump_path)
+        if 'unknown command' in res:
+            self.skipTest('screendump not available')
         logger = logging.getLogger('framebuffer')
 
         cpu_count = 1
diff --git a/tests/functional/test_m68k_nextcube.py b/tests/functional/test_m68k_nextcube.py
index ff773a7994..13c72bd136 100755
--- a/tests/functional/test_m68k_nextcube.py
+++ b/tests/functional/test_m68k_nextcube.py
@@ -32,8 +32,10 @@ class NextCubeMachine(QemuSystemTest):
         # TODO: wait for the 'displaysurface_create 1120x832' trace-event.
         time.sleep(2)
 
-        self.vm.cmd('human-monitor-command',
-                    command_line='screendump %s' % screenshot_path)
+        res = self.vm.cmd('human-monitor-command',
+                          command_line='screendump %s' % screenshot_path)
+        if 'unknown command' in res:
+            self.skipTest('screendump not available')
 
     @skipIfMissingImports("PIL")
     def test_bootrom_framebuffer_size(self):
diff --git a/tests/functional/test_mips64el_malta.py b/tests/functional/test_mips64el_malta.py
index dd37212f9d..3cc79b74c1 100755
--- a/tests/functional/test_mips64el_malta.py
+++ b/tests/functional/test_mips64el_malta.py
@@ -155,8 +155,10 @@ class MaltaMachineFramebuffer(LinuxKernelTest):
         framebuffer_ready = 'Console: switching to colour frame buffer device'
         self.wait_for_console_pattern(framebuffer_ready)
         self.vm.cmd('human-monitor-command', command_line='stop')
-        self.vm.cmd('human-monitor-command',
-                    command_line='screendump %s' % screendump_path)
+        res = self.vm.cmd('human-monitor-command',
+                          command_line='screendump %s' % screendump_path)
+        if 'unknown command' in res:
+            self.skipTest('screendump not available')
         logger = logging.getLogger('framebuffer')
 
         match_threshold = 0.95

From 1b85dff5f0be30ddbcb7edbd3c084c9c5ee351ca Mon Sep 17 00:00:00 2001
From: CLEMENT MATHIEU--DRIF <clement.mathieu--drif@eviden.com>
Date: Wed, 30 Apr 2025 12:48:06 +0000
Subject: [PATCH 0883/2760] intel_iommu: Take locks when looking for and
 creating address spaces

vtd_find_add_as can be called by multiple threads which leads to a race
condition. Taking the IOMMU lock ensures we avoid such a race.
Moreover we also need to take the bql to avoid an assert to fail in
memory_region_add_subregion_overlap when actually allocating a new
address space.

Signed-off-by: Clement Mathieu--Drif <clement.mathieu--drif@eviden.com>
Message-Id: <20250430124750.240412-3-clement.mathieu--drif@eviden.com>
Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/intel_iommu.c | 25 ++++++++++++++++++++++++-
 1 file changed, 24 insertions(+), 1 deletion(-)

diff --git a/hw/i386/intel_iommu.c b/hw/i386/intel_iommu.c
index b925e65b02..69d72ad35c 100644
--- a/hw/i386/intel_iommu.c
+++ b/hw/i386/intel_iommu.c
@@ -4205,9 +4205,30 @@ VTDAddressSpace *vtd_find_add_as(IntelIOMMUState *s, PCIBus *bus,
     VTDAddressSpace *vtd_dev_as;
     char name[128];
 
+    vtd_iommu_lock(s);
     vtd_dev_as = g_hash_table_lookup(s->vtd_address_spaces, &key);
+    vtd_iommu_unlock(s);
+
     if (!vtd_dev_as) {
-        struct vtd_as_key *new_key = g_malloc(sizeof(*new_key));
+        struct vtd_as_key *new_key;
+        /* Slow path */
+
+        /*
+         * memory_region_add_subregion_overlap requires the bql,
+         * make sure we own it.
+         */
+        BQL_LOCK_GUARD();
+        vtd_iommu_lock(s);
+
+        /* Check again as we released the lock for a moment */
+        vtd_dev_as = g_hash_table_lookup(s->vtd_address_spaces, &key);
+        if (vtd_dev_as) {
+            vtd_iommu_unlock(s);
+            return vtd_dev_as;
+        }
+
+        /* Still nothing, allocate a new address space */
+        new_key = g_malloc(sizeof(*new_key));
 
         new_key->bus = bus;
         new_key->devfn = devfn;
@@ -4298,6 +4319,8 @@ VTDAddressSpace *vtd_find_add_as(IntelIOMMUState *s, PCIBus *bus,
         vtd_switch_address_space(vtd_dev_as);
 
         g_hash_table_insert(s->vtd_address_spaces, new_key, vtd_dev_as);
+
+        vtd_iommu_unlock(s);
     }
     return vtd_dev_as;
 }

From f864a3235ea1d1d714b3cde2d9a810ea6344a7b5 Mon Sep 17 00:00:00 2001
From: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
Date: Sun, 4 May 2025 17:04:04 +0000
Subject: [PATCH 0884/2760] hw/i386/amd_iommu: Isolate AMDVI-PCI from amd-iommu
 device to allow full control over the PCI device creation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Current amd-iommu model internally creates an AMDVI-PCI device. Here is
a snippet from info qtree:

  bus: main-system-bus
    type System
    dev: amd-iommu, id ""
      xtsup = false
      pci-id = ""
      intremap = "on"
      device-iotlb = false
      pt = true
    ...
    dev: q35-pcihost, id ""
      MCFG = -1 (0xffffffffffffffff)
      pci-hole64-size = 34359738368 (32 GiB)
      below-4g-mem-size = 134217728 (128 MiB)
      above-4g-mem-size = 0 (0 B)
      smm-ranges = true
      x-pci-hole64-fix = true
      x-config-reg-migration-enabled = true
      bypass-iommu = false
      bus: pcie.0
        type PCIE
        dev: AMDVI-PCI, id ""
          addr = 01.0
          romfile = ""
          romsize = 4294967295 (0xffffffff)
          rombar = -1 (0xffffffffffffffff)
          multifunction = false
          x-pcie-lnksta-dllla = true
          x-pcie-extcap-init = true
          failover_pair_id = ""
          acpi-index = 0 (0x0)
          x-pcie-err-unc-mask = true
          x-pcie-ari-nextfn-1 = false
          x-max-bounce-buffer-size = 4096 (4 KiB)
          x-pcie-ext-tag = true
          busnr = 0 (0x0)
          class Class 0806, addr 00:01.0, pci id 1022:0000 (sub 1af4:1100)
    ...

This prohibits users from specifying the PCI topology for the amd-iommu device,
which becomes a problem when trying to support VM migration since it does not
guarantee the same enumeration of AMD IOMMU device.

Therefore, allow the 'AMDVI-PCI' device to optionally be pre-created and
associated with a 'amd-iommu' device via a new 'pci-id' parameter on the
latter.

For example:
  -device AMDVI-PCI,id=iommupci0,bus=pcie.0,addr=0x05 \
  -device amd-iommu,intremap=on,pt=on,xtsup=on,pci-id=iommupci0 \

For backward-compatibility, internally create the AMDVI-PCI device if not
specified on the CLI.

Co-developed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
Message-Id: <20250504170405.12623-2-suravee.suthikulpanit@amd.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/acpi-build.c |  8 +++----
 hw/i386/amd_iommu.c  | 53 ++++++++++++++++++++++++++------------------
 hw/i386/amd_iommu.h  |  3 ++-
 3 files changed, 38 insertions(+), 26 deletions(-)

diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
index f40ad062f9..61851cc840 100644
--- a/hw/i386/acpi-build.c
+++ b/hw/i386/acpi-build.c
@@ -2333,10 +2333,10 @@ build_amd_iommu(GArray *table_data, BIOSLinker *linker, const char *oem_id,
     build_append_int_noprefix(table_data, ivhd_blob->len + 24, 2);
     /* DeviceID */
     build_append_int_noprefix(table_data,
-                              object_property_get_int(OBJECT(&s->pci), "addr",
+                              object_property_get_int(OBJECT(s->pci), "addr",
                                                       &error_abort), 2);
     /* Capability offset */
-    build_append_int_noprefix(table_data, s->pci.capab_offset, 2);
+    build_append_int_noprefix(table_data, s->pci->capab_offset, 2);
     /* IOMMU base address */
     build_append_int_noprefix(table_data, s->mr_mmio.addr, 8);
     /* PCI Segment Group */
@@ -2368,10 +2368,10 @@ build_amd_iommu(GArray *table_data, BIOSLinker *linker, const char *oem_id,
     build_append_int_noprefix(table_data, ivhd_blob->len + 40, 2);
     /* DeviceID */
     build_append_int_noprefix(table_data,
-                              object_property_get_int(OBJECT(&s->pci), "addr",
+                              object_property_get_int(OBJECT(s->pci), "addr",
                                                       &error_abort), 2);
     /* Capability offset */
-    build_append_int_noprefix(table_data, s->pci.capab_offset, 2);
+    build_append_int_noprefix(table_data, s->pci->capab_offset, 2);
     /* IOMMU base address */
     build_append_int_noprefix(table_data, s->mr_mmio.addr, 8);
     /* PCI Segment Group */
diff --git a/hw/i386/amd_iommu.c b/hw/i386/amd_iommu.c
index 2cf7e24a21..f5466fdc98 100644
--- a/hw/i386/amd_iommu.c
+++ b/hw/i386/amd_iommu.c
@@ -167,11 +167,11 @@ static void amdvi_generate_msi_interrupt(AMDVIState *s)
 {
     MSIMessage msg = {};
     MemTxAttrs attrs = {
-        .requester_id = pci_requester_id(&s->pci.dev)
+        .requester_id = pci_requester_id(&s->pci->dev)
     };
 
-    if (msi_enabled(&s->pci.dev)) {
-        msg = msi_get_message(&s->pci.dev, 0);
+    if (msi_enabled(&s->pci->dev)) {
+        msg = msi_get_message(&s->pci->dev, 0);
         address_space_stl_le(&address_space_memory, msg.address, msg.data,
                              attrs, NULL);
     }
@@ -239,7 +239,7 @@ static void amdvi_page_fault(AMDVIState *s, uint16_t devid,
     info |= AMDVI_EVENT_IOPF_I | AMDVI_EVENT_IOPF;
     amdvi_encode_event(evt, devid, addr, info);
     amdvi_log_event(s, evt);
-    pci_word_test_and_set_mask(s->pci.dev.config + PCI_STATUS,
+    pci_word_test_and_set_mask(s->pci->dev.config + PCI_STATUS,
             PCI_STATUS_SIG_TARGET_ABORT);
 }
 /*
@@ -256,7 +256,7 @@ static void amdvi_log_devtab_error(AMDVIState *s, uint16_t devid,
 
     amdvi_encode_event(evt, devid, devtab, info);
     amdvi_log_event(s, evt);
-    pci_word_test_and_set_mask(s->pci.dev.config + PCI_STATUS,
+    pci_word_test_and_set_mask(s->pci->dev.config + PCI_STATUS,
             PCI_STATUS_SIG_TARGET_ABORT);
 }
 /* log an event trying to access command buffer
@@ -269,7 +269,7 @@ static void amdvi_log_command_error(AMDVIState *s, hwaddr addr)
 
     amdvi_encode_event(evt, 0, addr, info);
     amdvi_log_event(s, evt);
-    pci_word_test_and_set_mask(s->pci.dev.config + PCI_STATUS,
+    pci_word_test_and_set_mask(s->pci->dev.config + PCI_STATUS,
             PCI_STATUS_SIG_TARGET_ABORT);
 }
 /* log an illegal command event
@@ -310,7 +310,7 @@ static void amdvi_log_pagetab_error(AMDVIState *s, uint16_t devid,
     info |= AMDVI_EVENT_PAGE_TAB_HW_ERROR;
     amdvi_encode_event(evt, devid, addr, info);
     amdvi_log_event(s, evt);
-    pci_word_test_and_set_mask(s->pci.dev.config + PCI_STATUS,
+    pci_word_test_and_set_mask(s->pci->dev.config + PCI_STATUS,
              PCI_STATUS_SIG_TARGET_ABORT);
 }
 
@@ -1607,7 +1607,7 @@ static void amdvi_sysbus_reset(DeviceState *dev)
 {
     AMDVIState *s = AMD_IOMMU_DEVICE(dev);
 
-    msi_reset(&s->pci.dev);
+    msi_reset(&s->pci->dev);
     amdvi_init(s);
 }
 
@@ -1619,14 +1619,32 @@ static void amdvi_sysbus_realize(DeviceState *dev, Error **errp)
     X86MachineState *x86ms = X86_MACHINE(ms);
     PCIBus *bus = pcms->pcibus;
 
+    if (s->pci_id) {
+        PCIDevice *pdev = NULL;
+        int ret = pci_qdev_find_device(s->pci_id, &pdev);
+
+        if (ret) {
+            error_report("Cannot find PCI device '%s'", s->pci_id);
+            return;
+        }
+
+        if (!object_dynamic_cast(OBJECT(pdev), TYPE_AMD_IOMMU_PCI)) {
+            error_report("Device '%s' must be an AMDVI-PCI device type", s->pci_id);
+            return;
+        }
+
+        s->pci = AMD_IOMMU_PCI(pdev);
+    } else {
+        s->pci = AMD_IOMMU_PCI(object_new(TYPE_AMD_IOMMU_PCI));
+        /* This device should take care of IOMMU PCI properties */
+        if (!qdev_realize(DEVICE(s->pci), &bus->qbus, errp)) {
+            return;
+        }
+    }
+
     s->iotlb = g_hash_table_new_full(amdvi_uint64_hash,
                                      amdvi_uint64_equal, g_free, g_free);
 
-    /* This device should take care of IOMMU PCI properties */
-    if (!qdev_realize(DEVICE(&s->pci), &bus->qbus, errp)) {
-        return;
-    }
-
     /* Pseudo address space under root PCI bus. */
     x86ms->ioapic_as = amdvi_host_dma_iommu(bus, s, AMDVI_IOAPIC_SB_DEVID);
 
@@ -1663,6 +1681,7 @@ static void amdvi_sysbus_realize(DeviceState *dev, Error **errp)
 
 static const Property amdvi_properties[] = {
     DEFINE_PROP_BOOL("xtsup", AMDVIState, xtsup, false),
+    DEFINE_PROP_STRING("pci-id", AMDVIState, pci_id),
 };
 
 static const VMStateDescription vmstate_amdvi_sysbus = {
@@ -1670,13 +1689,6 @@ static const VMStateDescription vmstate_amdvi_sysbus = {
     .unmigratable = 1
 };
 
-static void amdvi_sysbus_instance_init(Object *klass)
-{
-    AMDVIState *s = AMD_IOMMU_DEVICE(klass);
-
-    object_initialize(&s->pci, sizeof(s->pci), TYPE_AMD_IOMMU_PCI);
-}
-
 static void amdvi_sysbus_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -1696,7 +1708,6 @@ static const TypeInfo amdvi_sysbus = {
     .name = TYPE_AMD_IOMMU_DEVICE,
     .parent = TYPE_X86_IOMMU_DEVICE,
     .instance_size = sizeof(AMDVIState),
-    .instance_init = amdvi_sysbus_instance_init,
     .class_init = amdvi_sysbus_class_init
 };
 
diff --git a/hw/i386/amd_iommu.h b/hw/i386/amd_iommu.h
index 28125130c6..7a28181d9c 100644
--- a/hw/i386/amd_iommu.h
+++ b/hw/i386/amd_iommu.h
@@ -315,7 +315,8 @@ struct AMDVIPCIState {
 
 struct AMDVIState {
     X86IOMMUState iommu;        /* IOMMU bus device             */
-    AMDVIPCIState pci;          /* IOMMU PCI device             */
+    AMDVIPCIState *pci;         /* IOMMU PCI device             */
+    char *pci_id;               /* ID of AMDVI-PCI device, if user created */
 
     uint32_t version;
 

From 28931c2e1591deb4bfaaf744fdc8813e96c230f1 Mon Sep 17 00:00:00 2001
From: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
Date: Sun, 4 May 2025 17:04:05 +0000
Subject: [PATCH 0885/2760] hw/i386/amd_iommu: Allow migration when explicitly
 create the AMDVI-PCI device

Add migration support for AMD IOMMU model by saving necessary AMDVIState
parameters for MMIO registers, device table, command buffer, and event
buffers.

Also change devtab_len type from size_t to uint64_t to avoid 32-bit build
issue.

Signed-off-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
Message-Id: <20250504170405.12623-3-suravee.suthikulpanit@amd.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/amd_iommu.c | 48 +++++++++++++++++++++++++++++++++++++++++++++
 hw/i386/amd_iommu.h |  2 +-
 2 files changed, 49 insertions(+), 1 deletion(-)

diff --git a/hw/i386/amd_iommu.c b/hw/i386/amd_iommu.c
index f5466fdc98..0775c8f3bb 100644
--- a/hw/i386/amd_iommu.c
+++ b/hw/i386/amd_iommu.c
@@ -1611,8 +1611,55 @@ static void amdvi_sysbus_reset(DeviceState *dev)
     amdvi_init(s);
 }
 
+static const VMStateDescription vmstate_amdvi_sysbus_migratable = {
+    .name = "amd-iommu",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .priority = MIG_PRI_IOMMU,
+    .fields = (VMStateField[]) {
+      /* Updated in  amdvi_handle_control_write() */
+      VMSTATE_BOOL(enabled, AMDVIState),
+      VMSTATE_BOOL(ga_enabled, AMDVIState),
+      VMSTATE_BOOL(ats_enabled, AMDVIState),
+      VMSTATE_BOOL(cmdbuf_enabled, AMDVIState),
+      VMSTATE_BOOL(completion_wait_intr, AMDVIState),
+      VMSTATE_BOOL(evtlog_enabled, AMDVIState),
+      VMSTATE_BOOL(evtlog_intr, AMDVIState),
+      /* Updated in amdvi_handle_devtab_write() */
+      VMSTATE_UINT64(devtab, AMDVIState),
+      VMSTATE_UINT64(devtab_len, AMDVIState),
+      /* Updated in amdvi_handle_cmdbase_write() */
+      VMSTATE_UINT64(cmdbuf, AMDVIState),
+      VMSTATE_UINT64(cmdbuf_len, AMDVIState),
+      /* Updated in amdvi_handle_cmdhead_write() */
+      VMSTATE_UINT32(cmdbuf_head, AMDVIState),
+      /* Updated in amdvi_handle_cmdtail_write() */
+      VMSTATE_UINT32(cmdbuf_tail, AMDVIState),
+      /* Updated in amdvi_handle_evtbase_write() */
+      VMSTATE_UINT64(evtlog, AMDVIState),
+      VMSTATE_UINT32(evtlog_len, AMDVIState),
+      /* Updated in amdvi_handle_evthead_write() */
+      VMSTATE_UINT32(evtlog_head, AMDVIState),
+      /* Updated in amdvi_handle_evttail_write() */
+      VMSTATE_UINT32(evtlog_tail, AMDVIState),
+      /* Updated in amdvi_handle_pprbase_write() */
+      VMSTATE_UINT64(ppr_log, AMDVIState),
+      VMSTATE_UINT32(pprlog_len, AMDVIState),
+      /* Updated in amdvi_handle_pprhead_write() */
+      VMSTATE_UINT32(pprlog_head, AMDVIState),
+      /* Updated in amdvi_handle_tailhead_write() */
+      VMSTATE_UINT32(pprlog_tail, AMDVIState),
+      /* MMIO registers */
+      VMSTATE_UINT8_ARRAY(mmior, AMDVIState, AMDVI_MMIO_SIZE),
+      VMSTATE_UINT8_ARRAY(romask, AMDVIState, AMDVI_MMIO_SIZE),
+      VMSTATE_UINT8_ARRAY(w1cmask, AMDVIState, AMDVI_MMIO_SIZE),
+      VMSTATE_END_OF_LIST()
+    }
+};
+
 static void amdvi_sysbus_realize(DeviceState *dev, Error **errp)
 {
+    DeviceClass *dc = (DeviceClass *) object_get_class(OBJECT(dev));
     AMDVIState *s = AMD_IOMMU_DEVICE(dev);
     MachineState *ms = MACHINE(qdev_get_machine());
     PCMachineState *pcms = PC_MACHINE(ms);
@@ -1634,6 +1681,7 @@ static void amdvi_sysbus_realize(DeviceState *dev, Error **errp)
         }
 
         s->pci = AMD_IOMMU_PCI(pdev);
+        dc->vmsd = &vmstate_amdvi_sysbus_migratable;
     } else {
         s->pci = AMD_IOMMU_PCI(object_new(TYPE_AMD_IOMMU_PCI));
         /* This device should take care of IOMMU PCI properties */
diff --git a/hw/i386/amd_iommu.h b/hw/i386/amd_iommu.h
index 7a28181d9c..5672bdef89 100644
--- a/hw/i386/amd_iommu.h
+++ b/hw/i386/amd_iommu.h
@@ -329,7 +329,7 @@ struct AMDVIState {
     bool excl_enabled;
 
     hwaddr devtab;               /* base address device table    */
-    size_t devtab_len;           /* device table length          */
+    uint64_t devtab_len;         /* device table length          */
 
     hwaddr cmdbuf;               /* command buffer base address  */
     uint64_t cmdbuf_len;         /* command buffer length        */

From 9c6675e8a5824f4c41c3d122c4b848a67d9d0350 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Wed, 14 May 2025 14:29:45 +0100
Subject: [PATCH 0886/2760] target/microblaze: Use 'obj' in DEVICE() casts in
 mb_cpu_initfn()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We're about to make a change that removes the only other use
of the 'cpu' local variable in mb_cpu_initfn(); since the
DEVICE() casts work fine with the Object*, use that instead,
so that we can remove the local variable when we make the
following change.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250429132200.605611-2-peter.maydell@linaro.org
---
 target/microblaze/cpu.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
index d069e40e70..d895d68395 100644
--- a/target/microblaze/cpu.c
+++ b/target/microblaze/cpu.c
@@ -344,11 +344,11 @@ static void mb_cpu_initfn(Object *obj)
 
 #ifndef CONFIG_USER_ONLY
     /* Inbound IRQ and FIR lines */
-    qdev_init_gpio_in(DEVICE(cpu), microblaze_cpu_set_irq, 2);
-    qdev_init_gpio_in_named(DEVICE(cpu), mb_cpu_ns_axi_dp, "ns_axi_dp", 1);
-    qdev_init_gpio_in_named(DEVICE(cpu), mb_cpu_ns_axi_ip, "ns_axi_ip", 1);
-    qdev_init_gpio_in_named(DEVICE(cpu), mb_cpu_ns_axi_dc, "ns_axi_dc", 1);
-    qdev_init_gpio_in_named(DEVICE(cpu), mb_cpu_ns_axi_ic, "ns_axi_ic", 1);
+    qdev_init_gpio_in(DEVICE(obj), microblaze_cpu_set_irq, 2);
+    qdev_init_gpio_in_named(DEVICE(obj), mb_cpu_ns_axi_dp, "ns_axi_dp", 1);
+    qdev_init_gpio_in_named(DEVICE(obj), mb_cpu_ns_axi_ip, "ns_axi_ip", 1);
+    qdev_init_gpio_in_named(DEVICE(obj), mb_cpu_ns_axi_dc, "ns_axi_dc", 1);
+    qdev_init_gpio_in_named(DEVICE(obj), mb_cpu_ns_axi_ic, "ns_axi_ic", 1);
 #endif
 
     /* Restricted 'endianness' property is equivalent of 'little-endian' */

From 6222ae143da0408c7e5b727082975dc394f5a23f Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Wed, 14 May 2025 14:29:45 +0100
Subject: [PATCH 0887/2760] target/microblaze: Delay gdb_register_coprocessor()
 to realize
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Currently the microblaze code calls gdb_register_coprocessor() in its
initfn.  This works, but we would like to delay setting up GDB
registers until realize.  All other target architectures only call
gdb_register_coprocessor() in realize, after the call to
cpu_exec_realizefn().

Move the microblaze gdb_register_coprocessor() use, bringing it
in line with other targets.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250429132200.605611-3-peter.maydell@linaro.org
---
 target/microblaze/cpu.c | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
index d895d68395..615a959200 100644
--- a/target/microblaze/cpu.c
+++ b/target/microblaze/cpu.c
@@ -263,6 +263,11 @@ static void mb_cpu_realizefn(DeviceState *dev, Error **errp)
         return;
     }
 
+    gdb_register_coprocessor(cs, mb_cpu_gdb_read_stack_protect,
+                             mb_cpu_gdb_write_stack_protect,
+                             gdb_find_static_feature("microblaze-stack-protect.xml"),
+                             0);
+
     qemu_init_vcpu(cs);
 
     version = cpu->cfg.version ? cpu->cfg.version : DEFAULT_CPU_VERSION;
@@ -335,13 +340,6 @@ static void mb_cpu_realizefn(DeviceState *dev, Error **errp)
 
 static void mb_cpu_initfn(Object *obj)
 {
-    MicroBlazeCPU *cpu = MICROBLAZE_CPU(obj);
-
-    gdb_register_coprocessor(CPU(cpu), mb_cpu_gdb_read_stack_protect,
-                             mb_cpu_gdb_write_stack_protect,
-                             gdb_find_static_feature("microblaze-stack-protect.xml"),
-                             0);
-
 #ifndef CONFIG_USER_ONLY
     /* Inbound IRQ and FIR lines */
     qdev_init_gpio_in(DEVICE(obj), microblaze_cpu_set_irq, 2);

From b4ae54989b911876540ba4ba9090901235e3047a Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Wed, 14 May 2025 14:29:45 +0100
Subject: [PATCH 0888/2760] hw/core/cpu-common: Don't init gdbstub until
 cpu_exec_realizefn()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Currently we call gdb_init_cpu() in cpu_common_initfn(), which is
very early in the CPU object's init->realize creation sequence.  In
particular this happens before the architecture-specific subclass's
init fn has even run.  This means that gdb_init_cpu() can only do
things that depend strictly on the class, not on the object, because
the CPUState* that it is passed is currently half-initialized.

In commit a1f728ecc90cf6c6 we accidentally broke this rule, by adding
a call to the gdb_get_core_xml_file method which takes the CPUState.
At the moment we get away with this because the only implementation
doesn't actually look at the pointer it is passed.  However the whole
reason we created that method was so that we could make the "which
XML file?" decision based on a property of the CPU object, and we
currently can't change the Arm implementation of the method to do
what we want without causing wrong behaviour or a crash.

The ordering restrictions here are:
 * we must call gdb_init_cpu before:
   - any call to gdb_register_coprocessor()
   - any use of the gdb_num_regs field (this is only used
     in code that's about to call gdb_register_coprocessor()
     and wants to know the first register number of the
     set of registers it's about to add)
 * we must call gdb_init_cpu after CPU properties have been
   set, which is to say somewhere in realize

The function cpu_exec_realizefn() meets both of these requirements,
as it is called by the architecture-specific CPU realize function
early in realize, before any calls ot gdb_register_coprocessor().
Move the gdb_init_cpu() call to there.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250429132200.605611-4-peter.maydell@linaro.org
---
 hw/core/cpu-common.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/core/cpu-common.c b/hw/core/cpu-common.c
index 92c40b6bf8..39e674aca2 100644
--- a/hw/core/cpu-common.c
+++ b/hw/core/cpu-common.c
@@ -234,6 +234,8 @@ bool cpu_exec_realizefn(CPUState *cpu, Error **errp)
         return false;
     }
 
+    gdb_init_cpu(cpu);
+
     /* Wait until cpu initialization complete before exposing cpu. */
     cpu_list_add(cpu);
 
@@ -304,7 +306,6 @@ static void cpu_common_initfn(Object *obj)
     /* cache the cpu class for the hotpath */
     cpu->cc = CPU_GET_CLASS(cpu);
 
-    gdb_init_cpu(cpu);
     cpu->cpu_index = UNASSIGNED_CPU_INDEX;
     cpu->cluster_index = UNASSIGNED_CLUSTER_INDEX;
     cpu->as = NULL;

From d2c655a5f42ef7466c70cb223a9b9fc292f6b593 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Wed, 14 May 2025 14:29:46 +0100
Subject: [PATCH 0889/2760] target/arm: Present AArch64 gdbstub based on
 ARM_FEATURE_AARCH64
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Currently we provide an AArch64 gdbstub for CPUs which are
TYPE_AARCH64_CPU, and an AArch32 gdbstub for those which are only
TYPE_ARM_CPU.  This mostly does the right thing, except in the
corner case of KVM with -cpu host,aarch64=off.  That produces a CPU
which is TYPE_AARCH64_CPU but which has ARM_FEATURE_AARCH64 removed
and which to the guest is in AArch32 mode.

Now we have moved all the handling of AArch64-vs-AArch32 gdbstub
behaviour into TYPE_ARM_CPU we can change the condition we use for
whether to select the AArch64 gdbstub to look at ARM_FEATURE_AARCH64.
This will mean that we now correctly provide an AArch32 gdbstub for
aarch64=off CPUs.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250429132200.605611-5-peter.maydell@linaro.org
---
 target/arm/internals.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index 660d3a88e0..a396c0be3b 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -1833,7 +1833,7 @@ void aarch64_add_sme_properties(Object *obj);
 /* Return true if the gdbstub is presenting an AArch64 CPU */
 static inline bool arm_gdbstub_is_aarch64(ARMCPU *cpu)
 {
-    return object_dynamic_cast(OBJECT(cpu), TYPE_AARCH64_CPU);
+    return arm_feature(&cpu->env, ARM_FEATURE_AARCH64);
 }
 
 /* Read the CONTROL register as the MRS instruction would. */

From 0ab97bc070f9df7fd155707c7800667cbf26790f Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Wed, 14 May 2025 14:29:46 +0100
Subject: [PATCH 0890/2760] target/arm: Move aarch64 CPU property code to
 TYPE_ARM_CPU
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The only thing we have left in the TYPE_AARCH64_CPU class that makes
it different to TYPE_ARM_CPU is that we register the handling of the
"aarch64" property there.

Move the handling of this property to the base class, where we make
it a property of the object rather than of the class, and add it
to the CPU if it has the ARM_FEATURE_AARCH64 property present at
init.  This is in line with how we handle other Arm CPU properties,
and should not change which CPUs it's visible for.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250429132200.605611-6-peter.maydell@linaro.org
---
 target/arm/cpu.c   | 36 ++++++++++++++++++++++++++++++++++++
 target/arm/cpu64.c | 33 ---------------------------------
 2 files changed, 36 insertions(+), 33 deletions(-)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index 45cb6fd7ee..603f08d05a 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -1609,6 +1609,35 @@ static void arm_set_pmu(Object *obj, bool value, Error **errp)
     cpu->has_pmu = value;
 }
 
+static bool aarch64_cpu_get_aarch64(Object *obj, Error **errp)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+
+    return arm_feature(&cpu->env, ARM_FEATURE_AARCH64);
+}
+
+static void aarch64_cpu_set_aarch64(Object *obj, bool value, Error **errp)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+
+    /*
+     * At this time, this property is only allowed if KVM is enabled.  This
+     * restriction allows us to avoid fixing up functionality that assumes a
+     * uniform execution state like do_interrupt.
+     */
+    if (value == false) {
+        if (!kvm_enabled() || !kvm_arm_aarch32_supported()) {
+            error_setg(errp, "'aarch64' feature cannot be disabled "
+                             "unless KVM is enabled and 32-bit EL1 "
+                             "is supported");
+            return;
+        }
+        unset_feature(&cpu->env, ARM_FEATURE_AARCH64);
+    } else {
+        set_feature(&cpu->env, ARM_FEATURE_AARCH64);
+    }
+}
+
 unsigned int gt_cntfrq_period_ns(ARMCPU *cpu)
 {
     /*
@@ -1736,6 +1765,13 @@ void arm_cpu_post_init(Object *obj)
      */
     arm_cpu_propagate_feature_implications(cpu);
 
+    if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
+        object_property_add_bool(obj, "aarch64", aarch64_cpu_get_aarch64,
+                                       aarch64_cpu_set_aarch64);
+        object_property_set_description(obj, "aarch64",
+                                        "Set on/off to enable/disable aarch64 "
+                                        "execution state ");
+    }
     if (arm_feature(&cpu->env, ARM_FEATURE_CBAR) ||
         arm_feature(&cpu->env, ARM_FEATURE_CBAR_RO)) {
         qdev_property_add_static(DEVICE(obj), &arm_cpu_reset_cbar_property);
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index 00629a5d1d..e527465a3c 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -781,45 +781,12 @@ static const ARMCPUInfo aarch64_cpus[] = {
 #endif
 };
 
-static bool aarch64_cpu_get_aarch64(Object *obj, Error **errp)
-{
-    ARMCPU *cpu = ARM_CPU(obj);
-
-    return arm_feature(&cpu->env, ARM_FEATURE_AARCH64);
-}
-
-static void aarch64_cpu_set_aarch64(Object *obj, bool value, Error **errp)
-{
-    ARMCPU *cpu = ARM_CPU(obj);
-
-    /* At this time, this property is only allowed if KVM is enabled.  This
-     * restriction allows us to avoid fixing up functionality that assumes a
-     * uniform execution state like do_interrupt.
-     */
-    if (value == false) {
-        if (!kvm_enabled() || !kvm_arm_aarch32_supported()) {
-            error_setg(errp, "'aarch64' feature cannot be disabled "
-                             "unless KVM is enabled and 32-bit EL1 "
-                             "is supported");
-            return;
-        }
-        unset_feature(&cpu->env, ARM_FEATURE_AARCH64);
-    } else {
-        set_feature(&cpu->env, ARM_FEATURE_AARCH64);
-    }
-}
-
 static void aarch64_cpu_finalizefn(Object *obj)
 {
 }
 
 static void aarch64_cpu_class_init(ObjectClass *oc, const void *data)
 {
-    object_class_property_add_bool(oc, "aarch64", aarch64_cpu_get_aarch64,
-                                   aarch64_cpu_set_aarch64);
-    object_class_property_set_description(oc, "aarch64",
-                                          "Set on/off to enable/disable aarch64 "
-                                          "execution state ");
 }
 
 static void aarch64_cpu_instance_init(Object *obj)

From c6650a8c6cc18cdc4a46a6eef41b7d57e6bc0b2b Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Wed, 14 May 2025 14:29:46 +0100
Subject: [PATCH 0891/2760] target/arm/kvm: don't check TYPE_AARCH64_CPU
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We want to merge TYPE_AARCH64_CPU with TYPE_ARM_CPU, so enforcing in
kvm_arch_init_vcpu() that the CPU class is a subclass of
TYPE_AARCH64_CPU will no longer be possible.

It's safe to just remove this test, because any purely-AArch32 CPU
will fail the "kvm_target isn't set" check, because we no longer
support the old AArch32-host KVM setup and so CPUs like the Cortex-A7
no longer set cpu->kvm_target. Only the 'host', 'max', and the
odd special cases 'cortex-a53' and 'cortex-a57' set kvm_target.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250429132200.605611-7-peter.maydell@linaro.org
---
 target/arm/kvm.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index 9c62d12b23..85911e3024 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -1843,8 +1843,7 @@ int kvm_arch_init_vcpu(CPUState *cs)
     CPUARMState *env = &cpu->env;
     uint64_t psciver;
 
-    if (cpu->kvm_target == QEMU_KVM_ARM_TARGET_NONE ||
-        !object_dynamic_cast(OBJECT(cpu), TYPE_AARCH64_CPU)) {
+    if (cpu->kvm_target == QEMU_KVM_ARM_TARGET_NONE) {
         error_report("KVM is not supported for this guest CPU type");
         return -EINVAL;
     }

From ec7e5a90fea996f04ea24e81b680a87bc975354a Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Wed, 14 May 2025 14:29:46 +0100
Subject: [PATCH 0892/2760] target/arm: Remove TYPE_AARCH64_CPU
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The TYPE_AARCH64_CPU class is an abstract type that is the parent of
all the AArch64 CPUs.  It now has no special behaviour of its own, so
we can eliminate it and make the AArch64 CPUs directly inherit from
TYPE_ARM_CPU.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250429132200.605611-8-peter.maydell@linaro.org
---
 target/arm/cpu-qom.h   |  5 -----
 target/arm/cpu.h       |  4 ----
 target/arm/cpu64.c     | 49 +-----------------------------------------
 target/arm/internals.h |  1 -
 target/arm/tcg/cpu64.c |  2 +-
 5 files changed, 2 insertions(+), 59 deletions(-)

diff --git a/target/arm/cpu-qom.h b/target/arm/cpu-qom.h
index b497667d61..2fcb0e1252 100644
--- a/target/arm/cpu-qom.h
+++ b/target/arm/cpu-qom.h
@@ -28,11 +28,6 @@ OBJECT_DECLARE_CPU_TYPE(ARMCPU, ARMCPUClass, ARM_CPU)
 
 #define TYPE_ARM_MAX_CPU "max-" TYPE_ARM_CPU
 
-#define TYPE_AARCH64_CPU "aarch64-cpu"
-typedef struct AArch64CPUClass AArch64CPUClass;
-DECLARE_CLASS_CHECKERS(AArch64CPUClass, AARCH64_CPU,
-                       TYPE_AARCH64_CPU)
-
 #define ARM_CPU_TYPE_SUFFIX "-" TYPE_ARM_CPU
 #define ARM_CPU_TYPE_NAME(name) (name ARM_CPU_TYPE_SUFFIX)
 
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index 6ed6409cb7..302c24e232 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -1138,10 +1138,6 @@ struct ARMCPUClass {
     ResettablePhases parent_phases;
 };
 
-struct AArch64CPUClass {
-    ARMCPUClass parent_class;
-};
-
 /* Callback functions for the generic timer's timers. */
 void arm_gt_ptimer_cb(void *opaque);
 void arm_gt_vtimer_cb(void *opaque);
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index e527465a3c..200da1c489 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -781,59 +781,12 @@ static const ARMCPUInfo aarch64_cpus[] = {
 #endif
 };
 
-static void aarch64_cpu_finalizefn(Object *obj)
-{
-}
-
-static void aarch64_cpu_class_init(ObjectClass *oc, const void *data)
-{
-}
-
-static void aarch64_cpu_instance_init(Object *obj)
-{
-    ARMCPUClass *acc = ARM_CPU_GET_CLASS(obj);
-
-    acc->info->initfn(obj);
-    arm_cpu_post_init(obj);
-}
-
-static void cpu_register_class_init(ObjectClass *oc, const void *data)
-{
-    ARMCPUClass *acc = ARM_CPU_CLASS(oc);
-
-    acc->info = data;
-}
-
-void aarch64_cpu_register(const ARMCPUInfo *info)
-{
-    TypeInfo type_info = {
-        .parent = TYPE_AARCH64_CPU,
-        .instance_init = aarch64_cpu_instance_init,
-        .class_init = info->class_init ?: cpu_register_class_init,
-        .class_data = info,
-    };
-
-    type_info.name = g_strdup_printf("%s-" TYPE_ARM_CPU, info->name);
-    type_register_static(&type_info);
-    g_free((void *)type_info.name);
-}
-
-static const TypeInfo aarch64_cpu_type_info = {
-    .name = TYPE_AARCH64_CPU,
-    .parent = TYPE_ARM_CPU,
-    .instance_finalize = aarch64_cpu_finalizefn,
-    .abstract = true,
-    .class_init = aarch64_cpu_class_init,
-};
-
 static void aarch64_cpu_register_types(void)
 {
     size_t i;
 
-    type_register_static(&aarch64_cpu_type_info);
-
     for (i = 0; i < ARRAY_SIZE(aarch64_cpus); ++i) {
-        aarch64_cpu_register(&aarch64_cpus[i]);
+        arm_cpu_register(&aarch64_cpus[i]);
     }
 }
 
diff --git a/target/arm/internals.h b/target/arm/internals.h
index a396c0be3b..702eb1a548 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -354,7 +354,6 @@ static inline int r14_bank_number(int mode)
 }
 
 void arm_cpu_register(const ARMCPUInfo *info);
-void aarch64_cpu_register(const ARMCPUInfo *info);
 
 void register_cp_regs_for_features(ARMCPU *cpu);
 void init_cpreg_list(ARMCPU *cpu);
diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
index 29ab0ac79d..5d8ed2794d 100644
--- a/target/arm/tcg/cpu64.c
+++ b/target/arm/tcg/cpu64.c
@@ -1316,7 +1316,7 @@ static void aarch64_cpu_register_types(void)
     size_t i;
 
     for (i = 0; i < ARRAY_SIZE(aarch64_cpus); ++i) {
-        aarch64_cpu_register(&aarch64_cpus[i]);
+        arm_cpu_register(&aarch64_cpus[i]);
     }
 }
 

From 6414b7709d404bf410da360bab865133832ade85 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Wed, 14 May 2025 14:29:47 +0100
Subject: [PATCH 0893/2760] rust: pl011: Cut down amount of text quoted from
 PL011 TRM
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Currently the comments in the Rust pl011 register.rs file include
large amounts of text from the PL011 TRM.  This is much more
commentary than we typically quote from a device reference manual,
and much of it is not relevant to QEMU.  Compress and rephrase the
comments so that we are not quoting such a large volume of TRM text.

We add a URL for the TRM; readers who need more detail on the
function of the register bits can find it there, presented in
context with the overall description of the hardware.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
---
 rust/hw/char/pl011/src/registers.rs | 261 ++++++----------------------
 1 file changed, 51 insertions(+), 210 deletions(-)

diff --git a/rust/hw/char/pl011/src/registers.rs b/rust/hw/char/pl011/src/registers.rs
index cd92fa2c30..690feb6378 100644
--- a/rust/hw/char/pl011/src/registers.rs
+++ b/rust/hw/char/pl011/src/registers.rs
@@ -5,13 +5,13 @@
 //! Device registers exposed as typed structs which are backed by arbitrary
 //! integer bitmaps. [`Data`], [`Control`], [`LineControl`], etc.
 
+// For more detail see the PL011 Technical Reference Manual DDI0183:
+// https://developer.arm.com/documentation/ddi0183/latest/
+
 use bilge::prelude::*;
 use qemu_api::impl_vmstate_bitsized;
 
 /// Offset of each register from the base memory address of the device.
-///
-/// # Source
-/// ARM DDI 0183G, Table 3-1 p.3-3
 #[doc(alias = "offset")]
 #[allow(non_camel_case_types)]
 #[repr(u64)]
@@ -87,48 +87,11 @@ pub struct Errors {
     _reserved_unpredictable: u4,
 }
 
-// TODO: FIFO Mode has different semantics
 /// Data Register, `UARTDR`
 ///
-/// The `UARTDR` register is the data register.
-///
-/// For words to be transmitted:
-///
-/// - if the FIFOs are enabled, data written to this location is pushed onto the
-///   transmit
-/// FIFO
-/// - if the FIFOs are not enabled, data is stored in the transmitter holding
-///   register (the
-/// bottom word of the transmit FIFO).
-///
-/// The write operation initiates transmission from the UART. The data is
-/// prefixed with a start bit, appended with the appropriate parity bit
-/// (if parity is enabled), and a stop bit. The resultant word is then
-/// transmitted.
-///
-/// For received words:
-///
-/// - if the FIFOs are enabled, the data byte and the 4-bit status (break,
-///   frame, parity,
-/// and overrun) is pushed onto the 12-bit wide receive FIFO
-/// - if the FIFOs are not enabled, the data byte and status are stored in the
-///   receiving
-/// holding register (the bottom word of the receive FIFO).
-///
-/// The received data byte is read by performing reads from the `UARTDR`
-/// register along with the corresponding status information. The status
-/// information can also be read by a read of the `UARTRSR/UARTECR`
-/// register.
-///
-/// # Note
-///
-/// You must disable the UART before any of the control registers are
-/// reprogrammed. When the UART is disabled in the middle of
-/// transmission or reception, it completes the current character before
-/// stopping.
-///
-/// # Source
-/// ARM DDI 0183G 3.3.1 Data Register, UARTDR
+/// The `UARTDR` register is the data register; write for TX and
+/// read for RX. It is a 12-bit register, where bits 7..0 are the
+/// character and bits 11..8 are error bits.
 #[bitsize(32)]
 #[derive(Clone, Copy, Default, DebugBits, FromBits)]
 #[doc(alias = "UARTDR")]
@@ -144,30 +107,17 @@ impl Data {
     pub const BREAK: Self = Self { value: 1 << 10 };
 }
 
-// TODO: FIFO Mode has different semantics
 /// Receive Status Register / Error Clear Register, `UARTRSR/UARTECR`
 ///
-/// The UARTRSR/UARTECR register is the receive status register/error clear
-/// register. Receive status can also be read from the `UARTRSR`
-/// register. If the status is read from this register, then the status
-/// information for break, framing and parity corresponds to the
-/// data character read from the [Data register](Data), `UARTDR` prior to
-/// reading the UARTRSR register. The status information for overrun is
-/// set immediately when an overrun condition occurs.
+/// This register provides a different way to read the four receive
+/// status error bits that can be found in bits 11..8 of the UARTDR
+/// on a read. It gets updated when the guest reads UARTDR, and the
+/// status bits correspond to that character that was just read.
 ///
-///
-/// # Note
-/// The received data character must be read first from the [Data
-/// Register](Data), `UARTDR` before reading the error status associated
-/// with that data character from the `UARTRSR` register. This read
-/// sequence cannot be reversed, because the `UARTRSR` register is
-/// updated only when a read occurs from the `UARTDR` register. However,
-/// the status information can also be obtained by reading the `UARTDR`
-/// register
-///
-/// # Source
-/// ARM DDI 0183G 3.3.2 Receive Status Register/Error Clear Register,
-/// UARTRSR/UARTECR
+/// The TRM confusingly describes this offset as UARTRSR for reads
+/// and UARTECR for writes, but really it's a single error status
+/// register where writing anything to the register clears the error
+/// bits.
 #[bitsize(32)]
 #[derive(Clone, Copy, DebugBits, FromBits)]
 pub struct ReceiveStatusErrorClear {
@@ -196,54 +146,29 @@ impl Default for ReceiveStatusErrorClear {
 #[bitsize(32)]
 #[derive(Clone, Copy, DebugBits, FromBits)]
 /// Flag Register, `UARTFR`
+///
+/// This has the usual inbound RS232 modem-control signals, plus flags
+/// for RX and TX FIFO fill levels and a BUSY flag.
 #[doc(alias = "UARTFR")]
 pub struct Flags {
-    /// CTS Clear to send. This bit is the complement of the UART clear to
-    /// send, `nUARTCTS`, modem status input. That is, the bit is 1
-    /// when `nUARTCTS` is LOW.
+    /// CTS: Clear to send
     pub clear_to_send: bool,
-    /// DSR Data set ready. This bit is the complement of the UART data set
-    /// ready, `nUARTDSR`, modem status input. That is, the bit is 1 when
-    /// `nUARTDSR` is LOW.
+    /// DSR: Data set ready
     pub data_set_ready: bool,
-    /// DCD Data carrier detect. This bit is the complement of the UART data
-    /// carrier detect, `nUARTDCD`, modem status input. That is, the bit is
-    /// 1 when `nUARTDCD` is LOW.
+    /// DCD: Data carrier detect
     pub data_carrier_detect: bool,
-    /// BUSY UART busy. If this bit is set to 1, the UART is busy
-    /// transmitting data. This bit remains set until the complete
-    /// byte, including all the stop bits, has been sent from the
-    /// shift register. This bit is set as soon as the transmit FIFO
-    /// becomes non-empty, regardless of whether the UART is enabled
-    /// or not.
+    /// BUSY: UART busy. In real hardware, set while the UART is
+    /// busy transmitting data. QEMU's implementation never sets BUSY.
     pub busy: bool,
-    /// RXFE Receive FIFO empty. The meaning of this bit depends on the
-    /// state of the FEN bit in the UARTLCR_H register. If the FIFO
-    /// is disabled, this bit is set when the receive holding
-    /// register is empty. If the FIFO is enabled, the RXFE bit is
-    /// set when the receive FIFO is empty.
+    /// RXFE: Receive FIFO empty
     pub receive_fifo_empty: bool,
-    /// TXFF Transmit FIFO full. The meaning of this bit depends on the
-    /// state of the FEN bit in the UARTLCR_H register. If the FIFO
-    /// is disabled, this bit is set when the transmit holding
-    /// register is full. If the FIFO is enabled, the TXFF bit is
-    /// set when the transmit FIFO is full.
+    /// TXFF: Transmit FIFO full
     pub transmit_fifo_full: bool,
-    /// RXFF Receive FIFO full. The meaning of this bit depends on the state
-    /// of the FEN bit in the UARTLCR_H register. If the FIFO is
-    /// disabled, this bit is set when the receive holding register
-    /// is full. If the FIFO is enabled, the RXFF bit is set when
-    /// the receive FIFO is full.
+    /// RXFF: Receive FIFO full
     pub receive_fifo_full: bool,
-    /// Transmit FIFO empty. The meaning of this bit depends on the state of
-    /// the FEN bit in the [Line Control register](LineControl),
-    /// `UARTLCR_H`. If the FIFO is disabled, this bit is set when the
-    /// transmit holding register is empty. If the FIFO is enabled,
-    /// the TXFE bit is set when the transmit FIFO is empty. This
-    /// bit does not indicate if there is data in the transmit shift
-    /// register.
+    /// TXFE: Transmit FIFO empty
     pub transmit_fifo_empty: bool,
-    /// `RI`, is `true` when `nUARTRI` is `LOW`.
+    /// RI: Ring indicator
     pub ring_indicator: bool,
     _reserved_zero_no_modify: u23,
 }
@@ -270,54 +195,23 @@ impl Default for Flags {
 /// Line Control Register, `UARTLCR_H`
 #[doc(alias = "UARTLCR_H")]
 pub struct LineControl {
-    /// BRK Send break.
-    ///
-    /// If this bit is set to `1`, a low-level is continually output on the
-    /// `UARTTXD` output, after completing transmission of the
-    /// current character. For the proper execution of the break command,
-    /// the software must set this bit for at least two complete
-    /// frames. For normal use, this bit must be cleared to `0`.
+    /// BRK: Send break
     pub send_break: bool,
-    /// 1 PEN Parity enable:
-    ///
-    /// - 0 = parity is disabled and no parity bit added to the data frame
-    /// - 1 = parity checking and generation is enabled.
-    ///
-    /// See Table 3-11 on page 3-14 for the parity truth table.
+    /// PEN: Parity enable
     pub parity_enabled: bool,
-    /// EPS Even parity select. Controls the type of parity the UART uses
-    /// during transmission and reception:
-    /// - 0 = odd parity. The UART generates or checks for an odd number of 1s
-    ///   in the data and parity bits.
-    /// - 1 = even parity. The UART generates or checks for an even number of 1s
-    ///   in the data and parity bits.
-    /// This bit has no effect when the `PEN` bit disables parity checking
-    /// and generation. See Table 3-11 on page 3-14 for the parity
-    /// truth table.
+    /// EPS: Even parity select
     pub parity: Parity,
-    /// 3 STP2 Two stop bits select. If this bit is set to 1, two stop bits
-    /// are transmitted at the end of the frame. The receive
-    /// logic does not check for two stop bits being received.
+    /// STP2: Two stop bits select
     pub two_stops_bits: bool,
-    /// FEN Enable FIFOs:
-    /// 0 = FIFOs are disabled (character mode) that is, the FIFOs become
-    /// 1-byte-deep holding registers 1 = transmit and receive FIFO
-    /// buffers are enabled (FIFO mode).
+    /// FEN: Enable FIFOs
     pub fifos_enabled: Mode,
-    /// WLEN Word length. These bits indicate the number of data bits
-    /// transmitted or received in a frame as follows: b11 = 8 bits
+    /// WLEN: Word length in bits
+    /// b11 = 8 bits
     /// b10 = 7 bits
     /// b01 = 6 bits
     /// b00 = 5 bits.
     pub word_length: WordLength,
-    /// 7 SPS Stick parity select.
-    /// 0 = stick parity is disabled
-    /// 1 = either:
-    /// • if the EPS bit is 0 then the parity bit is transmitted and checked
-    /// as a 1 • if the EPS bit is 1 then the parity bit is
-    /// transmitted and checked as a 0. This bit has no effect when
-    /// the PEN bit disables parity checking and generation. See Table 3-11
-    /// on page 3-14 for the parity truth table.
+    /// SPS Stick parity select
     pub sticky_parity: bool,
     /// 31:8 - Reserved, do not modify, read as zero.
     _reserved_zero_no_modify: u24,
@@ -342,11 +236,7 @@ impl Default for LineControl {
 /// `EPS` "Even parity select", field of [Line Control
 /// register](LineControl).
 pub enum Parity {
-    /// - 0 = odd parity. The UART generates or checks for an odd number of 1s
-    ///   in the data and parity bits.
     Odd = 0,
-    /// - 1 = even parity. The UART generates or checks for an even number of 1s
-    ///   in the data and parity bits.
     Even = 1,
 }
 
@@ -381,88 +271,39 @@ pub enum WordLength {
 
 /// Control Register, `UARTCR`
 ///
-/// The `UARTCR` register is the control register. All the bits are cleared
-/// to `0` on reset except for bits `9` and `8` that are set to `1`.
-///
-/// # Source
-/// ARM DDI 0183G, 3.3.8 Control Register, `UARTCR`, Table 3-12
+/// The `UARTCR` register is the control register. It contains various
+/// enable bits, and the bits to write to set the usual outbound RS232
+/// modem control signals. All bits reset to 0 except TXE and RXE.
 #[bitsize(32)]
 #[doc(alias = "UARTCR")]
 #[derive(Clone, Copy, DebugBits, FromBits)]
 pub struct Control {
-    /// `UARTEN` UART enable: 0 = UART is disabled. If the UART is disabled
-    /// in the middle of transmission or reception, it completes the current
-    /// character before stopping. 1 = the UART is enabled. Data
-    /// transmission and reception occurs for either UART signals or SIR
-    /// signals depending on the setting of the SIREN bit.
+    /// `UARTEN` UART enable: 0 = UART is disabled.
     pub enable_uart: bool,
-    /// `SIREN` `SIR` enable: 0 = IrDA SIR ENDEC is disabled. `nSIROUT`
-    /// remains LOW (no light pulse generated), and signal transitions on
-    /// SIRIN have no effect. 1 = IrDA SIR ENDEC is enabled. Data is
-    /// transmitted and received on nSIROUT and SIRIN. UARTTXD remains HIGH,
-    /// in the marking state. Signal transitions on UARTRXD or modem status
-    /// inputs have no effect. This bit has no effect if the UARTEN bit
-    /// disables the UART.
+    /// `SIREN` `SIR` enable: disable or enable IrDA SIR ENDEC.
+    /// QEMU does not model this.
     pub enable_sir: bool,
-    /// `SIRLP` SIR low-power IrDA mode. This bit selects the IrDA encoding
-    /// mode. If this bit is cleared to 0, low-level bits are transmitted as
-    /// an active high pulse with a width of 3/ 16th of the bit period. If
-    /// this bit is set to 1, low-level bits are transmitted with a pulse
-    /// width that is 3 times the period of the IrLPBaud16 input signal,
-    /// regardless of the selected bit rate. Setting this bit uses less
-    /// power, but might reduce transmission distances.
+    /// `SIRLP` SIR low-power IrDA mode. QEMU does not model this.
     pub sir_lowpower_irda_mode: u1,
     /// Reserved, do not modify, read as zero.
     _reserved_zero_no_modify: u4,
-    /// `LBE` Loopback enable. If this bit is set to 1 and the SIREN bit is
-    /// set to 1 and the SIRTEST bit in the Test Control register, UARTTCR
-    /// on page 4-5 is set to 1, then the nSIROUT path is inverted, and fed
-    /// through to the SIRIN path. The SIRTEST bit in the test register must
-    /// be set to 1 to override the normal half-duplex SIR operation. This
-    /// must be the requirement for accessing the test registers during
-    /// normal operation, and SIRTEST must be cleared to 0 when loopback
-    /// testing is finished. This feature reduces the amount of external
-    /// coupling required during system test. If this bit is set to 1, and
-    /// the SIRTEST bit is set to 0, the UARTTXD path is fed through to the
-    /// UARTRXD path. In either SIR mode or UART mode, when this bit is set,
-    /// the modem outputs are also fed through to the modem inputs. This bit
-    /// is cleared to 0 on reset, to disable loopback.
+    /// `LBE` Loopback enable: feed UART output back to the input
     pub enable_loopback: bool,
-    /// `TXE` Transmit enable. If this bit is set to 1, the transmit section
-    /// of the UART is enabled. Data transmission occurs for either UART
-    /// signals, or SIR signals depending on the setting of the SIREN bit.
-    /// When the UART is disabled in the middle of transmission, it
-    /// completes the current character before stopping.
+    /// `TXE` Transmit enable
     pub enable_transmit: bool,
-    /// `RXE` Receive enable. If this bit is set to 1, the receive section
-    /// of the UART is enabled. Data reception occurs for either UART
-    /// signals or SIR signals depending on the setting of the SIREN bit.
-    /// When the UART is disabled in the middle of reception, it completes
-    /// the current character before stopping.
+    /// `RXE` Receive enable
     pub enable_receive: bool,
-    /// `DTR` Data transmit ready. This bit is the complement of the UART
-    /// data transmit ready, `nUARTDTR`, modem status output. That is, when
-    /// the bit is programmed to a 1 then `nUARTDTR` is LOW.
+    /// `DTR` Data transmit ready
     pub data_transmit_ready: bool,
-    /// `RTS` Request to send. This bit is the complement of the UART
-    /// request to send, `nUARTRTS`, modem status output. That is, when the
-    /// bit is programmed to a 1 then `nUARTRTS` is LOW.
+    /// `RTS` Request to send
     pub request_to_send: bool,
-    /// `Out1` This bit is the complement of the UART Out1 (`nUARTOut1`)
-    /// modem status output. That is, when the bit is programmed to a 1 the
-    /// output is 0. For DTE this can be used as Data Carrier Detect (DCD).
+    /// `Out1` UART Out1 signal; can be used as DCD
     pub out_1: bool,
-    /// `Out2` This bit is the complement of the UART Out2 (`nUARTOut2`)
-    /// modem status output. That is, when the bit is programmed to a 1, the
-    /// output is 0. For DTE this can be used as Ring Indicator (RI).
+    /// `Out2` UART Out2 signal; can be used as RI
     pub out_2: bool,
-    /// `RTSEn` RTS hardware flow control enable. If this bit is set to 1,
-    /// RTS hardware flow control is enabled. Data is only requested when
-    /// there is space in the receive FIFO for it to be received.
+    /// `RTSEn` RTS hardware flow control enable
     pub rts_hardware_flow_control_enable: bool,
-    /// `CTSEn` CTS hardware flow control enable. If this bit is set to 1,
-    /// CTS hardware flow control is enabled. Data is only transmitted when
-    /// the `nUARTCTS` signal is asserted.
+    /// `CTSEn` CTS hardware flow control enable
     pub cts_hardware_flow_control_enable: bool,
     /// 31:16 - Reserved, do not modify, read as zero.
     _reserved_zero_no_modify2: u16,

From edf838289b7fc698013f18d7a8a83b6b50ec41bb Mon Sep 17 00:00:00 2001
From: Santiago Monserrat Campanello <santimonserr@gmail.com>
Date: Wed, 14 May 2025 14:29:47 +0100
Subject: [PATCH 0894/2760] hw/arm: Replace TABs for spaces in OMAP board and
 device code

In hw/arm and include/hw/arm, some source files for the OMAP SoC
and the sx1 boards that are our only remaining OMAP boards still
have hard-coded tabs (almost entirely used for the indent on
inline comments, not for actual code indent).

Replace the tabs with spaces using vim :retab. I used 4 spaces
except in some defines and comments where I tried to put
everything aligned in the same column for better readability.

This commit is a purely whitespace-only change.

Signed-off-by: Santiago Monserrat Campanello <santimonserr@gmail.com>
Message-id: 20250505131130.82206-1-santimonserr@gmail.com
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/373
[PMM: expanded commit message]
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/omap1.c           | 1016 +++++++++++++++++++-------------------
 hw/arm/omap_sx1.c        |    2 +-
 hw/dma/omap_dma.c        |  334 ++++++-------
 hw/gpio/omap_gpio.c      |   28 +-
 hw/i2c/omap_i2c.c        |  178 +++----
 hw/intc/omap_intc.c      |  154 +++---
 hw/misc/omap_clk.c       |  470 +++++++++---------
 hw/timer/pxa2xx_timer.c  |   76 +--
 include/hw/arm/omap.h    |  534 ++++++++++----------
 include/hw/arm/sharpsl.h |    2 +-
 include/hw/arm/soc_dma.h |    4 +-
 11 files changed, 1399 insertions(+), 1399 deletions(-)

diff --git a/hw/arm/omap1.c b/hw/arm/omap1.c
index 91d7e3f04b..74458fb7c6 100644
--- a/hw/arm/omap1.c
+++ b/hw/arm/omap1.c
@@ -144,7 +144,7 @@ static inline void omap_timer_update(struct omap_mpu_timer_s *timer)
     int64_t expires;
 
     if (timer->enable && timer->st && timer->rate) {
-        timer->val = timer->reset_val;	/* Should skip this on clk enable */
+        timer->val = timer->reset_val;  /* Should skip this on clk enable */
         expires = muldiv64((uint64_t) timer->val << (timer->ptv + 1),
                            NANOSECONDS_PER_SECOND, timer->rate);
 
@@ -212,13 +212,13 @@ static uint64_t omap_mpu_timer_read(void *opaque, hwaddr addr,
     }
 
     switch (addr) {
-    case 0x00:	/* CNTL_TIMER */
+    case 0x00:  /* CNTL_TIMER */
         return (s->enable << 5) | (s->ptv << 2) | (s->ar << 1) | s->st;
 
-    case 0x04:	/* LOAD_TIM */
+    case 0x04:  /* LOAD_TIM */
         break;
 
-    case 0x08:	/* READ_TIM */
+    case 0x08:  /* READ_TIM */
         return omap_timer_read(s);
     }
 
@@ -237,7 +237,7 @@ static void omap_mpu_timer_write(void *opaque, hwaddr addr,
     }
 
     switch (addr) {
-    case 0x00:	/* CNTL_TIMER */
+    case 0x00:  /* CNTL_TIMER */
         omap_timer_sync(s);
         s->enable = (value >> 5) & 1;
         s->ptv = (value >> 2) & 7;
@@ -246,11 +246,11 @@ static void omap_mpu_timer_write(void *opaque, hwaddr addr,
         omap_timer_update(s);
         return;
 
-    case 0x04:	/* LOAD_TIM */
+    case 0x04:  /* LOAD_TIM */
         s->reset_val = value;
         return;
 
-    case 0x08:	/* READ_TIM */
+    case 0x08:  /* READ_TIM */
         OMAP_RO_REG(addr);
         break;
 
@@ -318,14 +318,14 @@ static uint64_t omap_wd_timer_read(void *opaque, hwaddr addr,
     }
 
     switch (addr) {
-    case 0x00:	/* CNTL_TIMER */
+    case 0x00:  /* CNTL_TIMER */
         return (s->timer.ptv << 9) | (s->timer.ar << 8) |
                 (s->timer.st << 7) | (s->free << 1);
 
-    case 0x04:	/* READ_TIMER */
+    case 0x04:  /* READ_TIMER */
         return omap_timer_read(&s->timer);
 
-    case 0x08:	/* TIMER_MODE */
+    case 0x08:  /* TIMER_MODE */
         return s->mode << 15;
     }
 
@@ -344,7 +344,7 @@ static void omap_wd_timer_write(void *opaque, hwaddr addr,
     }
 
     switch (addr) {
-    case 0x00:	/* CNTL_TIMER */
+    case 0x00:  /* CNTL_TIMER */
         omap_timer_sync(&s->timer);
         s->timer.ptv = (value >> 9) & 7;
         s->timer.ar = (value >> 8) & 1;
@@ -353,11 +353,11 @@ static void omap_wd_timer_write(void *opaque, hwaddr addr,
         omap_timer_update(&s->timer);
         break;
 
-    case 0x04:	/* LOAD_TIMER */
+    case 0x04:  /* LOAD_TIMER */
         s->timer.reset_val = value & 0xffff;
         break;
 
-    case 0x08:	/* TIMER_MODE */
+    case 0x08:  /* TIMER_MODE */
         if (!s->mode && ((value >> 15) & 1))
             omap_clk_get(s->timer.clk);
         s->mode |= (value >> 15) & 1;
@@ -442,13 +442,13 @@ static uint64_t omap_os_timer_read(void *opaque, hwaddr addr,
     }
 
     switch (offset) {
-    case 0x00:	/* TVR */
+    case 0x00:  /* TVR */
         return s->timer.reset_val;
 
-    case 0x04:	/* TCR */
+    case 0x04:  /* TCR */
         return omap_timer_read(&s->timer);
 
-    case 0x08:	/* CR */
+    case 0x08:  /* CR */
         return (s->timer.ar << 3) | (s->timer.it_ena << 2) | s->timer.st;
 
     default:
@@ -470,15 +470,15 @@ static void omap_os_timer_write(void *opaque, hwaddr addr,
     }
 
     switch (offset) {
-    case 0x00:	/* TVR */
+    case 0x00:  /* TVR */
         s->timer.reset_val = value & 0x00ffffff;
         break;
 
-    case 0x04:	/* TCR */
+    case 0x04:  /* TCR */
         OMAP_RO_REG(addr);
         break;
 
-    case 0x08:	/* CR */
+    case 0x08:  /* CR */
         s->timer.ar = (value >> 3) & 1;
         s->timer.it_ena = (value >> 2) & 1;
         if (s->timer.st != (value & 1) || (value & 2)) {
@@ -543,34 +543,34 @@ static uint64_t omap_ulpd_pm_read(void *opaque, hwaddr addr,
     }
 
     switch (addr) {
-    case 0x14:	/* IT_STATUS */
+    case 0x14:  /* IT_STATUS */
         ret = s->ulpd_pm_regs[addr >> 2];
         s->ulpd_pm_regs[addr >> 2] = 0;
         qemu_irq_lower(qdev_get_gpio_in(s->ih[1], OMAP_INT_GAUGE_32K));
         return ret;
 
-    case 0x18:	/* Reserved */
-    case 0x1c:	/* Reserved */
-    case 0x20:	/* Reserved */
-    case 0x28:	/* Reserved */
-    case 0x2c:	/* Reserved */
+    case 0x18:  /* Reserved */
+    case 0x1c:  /* Reserved */
+    case 0x20:  /* Reserved */
+    case 0x28:  /* Reserved */
+    case 0x2c:  /* Reserved */
         OMAP_BAD_REG(addr);
         /* fall through */
-    case 0x00:	/* COUNTER_32_LSB */
-    case 0x04:	/* COUNTER_32_MSB */
-    case 0x08:	/* COUNTER_HIGH_FREQ_LSB */
-    case 0x0c:	/* COUNTER_HIGH_FREQ_MSB */
-    case 0x10:	/* GAUGING_CTRL */
-    case 0x24:	/* SETUP_ANALOG_CELL3_ULPD1 */
-    case 0x30:	/* CLOCK_CTRL */
-    case 0x34:	/* SOFT_REQ */
-    case 0x38:	/* COUNTER_32_FIQ */
-    case 0x3c:	/* DPLL_CTRL */
-    case 0x40:	/* STATUS_REQ */
+    case 0x00:  /* COUNTER_32_LSB */
+    case 0x04:  /* COUNTER_32_MSB */
+    case 0x08:  /* COUNTER_HIGH_FREQ_LSB */
+    case 0x0c:  /* COUNTER_HIGH_FREQ_MSB */
+    case 0x10:  /* GAUGING_CTRL */
+    case 0x24:  /* SETUP_ANALOG_CELL3_ULPD1 */
+    case 0x30:  /* CLOCK_CTRL */
+    case 0x34:  /* SOFT_REQ */
+    case 0x38:  /* COUNTER_32_FIQ */
+    case 0x3c:  /* DPLL_CTRL */
+    case 0x40:  /* STATUS_REQ */
         /* XXX: check clk::usecount state for every clock */
-    case 0x48:	/* LOCL_TIME */
-    case 0x4c:	/* APLL_CTRL */
-    case 0x50:	/* POWER_CTRL */
+    case 0x48:  /* LOCL_TIME */
+    case 0x4c:  /* APLL_CTRL */
+    case 0x50:  /* POWER_CTRL */
         return s->ulpd_pm_regs[addr >> 2];
     }
 
@@ -581,22 +581,22 @@ static uint64_t omap_ulpd_pm_read(void *opaque, hwaddr addr,
 static inline void omap_ulpd_clk_update(struct omap_mpu_state_s *s,
                 uint16_t diff, uint16_t value)
 {
-    if (diff & (1 << 4))				/* USB_MCLK_EN */
+    if (diff & (1 << 4))                /* USB_MCLK_EN */
         omap_clk_onoff(omap_findclk(s, "usb_clk0"), (value >> 4) & 1);
-    if (diff & (1 << 5))				/* DIS_USB_PVCI_CLK */
+    if (diff & (1 << 5))                /* DIS_USB_PVCI_CLK */
         omap_clk_onoff(omap_findclk(s, "usb_w2fc_ck"), (~value >> 5) & 1);
 }
 
 static inline void omap_ulpd_req_update(struct omap_mpu_state_s *s,
                 uint16_t diff, uint16_t value)
 {
-    if (diff & (1 << 0))				/* SOFT_DPLL_REQ */
+    if (diff & (1 << 0))                /* SOFT_DPLL_REQ */
         omap_clk_canidle(omap_findclk(s, "dpll4"), (~value >> 0) & 1);
-    if (diff & (1 << 1))				/* SOFT_COM_REQ */
+    if (diff & (1 << 1))                /* SOFT_COM_REQ */
         omap_clk_canidle(omap_findclk(s, "com_mclk_out"), (~value >> 1) & 1);
-    if (diff & (1 << 2))				/* SOFT_SDW_REQ */
+    if (diff & (1 << 2))                /* SOFT_SDW_REQ */
         omap_clk_canidle(omap_findclk(s, "bt_mclk_out"), (~value >> 2) & 1);
-    if (diff & (1 << 3))				/* SOFT_USB_REQ */
+    if (diff & (1 << 3))                /* SOFT_USB_REQ */
         omap_clk_canidle(omap_findclk(s, "usb_clk0"), (~value >> 3) & 1);
 }
 
@@ -615,16 +615,16 @@ static void omap_ulpd_pm_write(void *opaque, hwaddr addr,
     }
 
     switch (addr) {
-    case 0x00:	/* COUNTER_32_LSB */
-    case 0x04:	/* COUNTER_32_MSB */
-    case 0x08:	/* COUNTER_HIGH_FREQ_LSB */
-    case 0x0c:	/* COUNTER_HIGH_FREQ_MSB */
-    case 0x14:	/* IT_STATUS */
-    case 0x40:	/* STATUS_REQ */
+    case 0x00:  /* COUNTER_32_LSB */
+    case 0x04:  /* COUNTER_32_MSB */
+    case 0x08:  /* COUNTER_HIGH_FREQ_LSB */
+    case 0x0c:  /* COUNTER_HIGH_FREQ_MSB */
+    case 0x14:  /* IT_STATUS */
+    case 0x40:  /* STATUS_REQ */
         OMAP_RO_REG(addr);
         break;
 
-    case 0x10:	/* GAUGING_CTRL */
+    case 0x10:  /* GAUGING_CTRL */
         /* Bits 0 and 1 seem to be confused in the OMAP 310 TRM */
         if ((s->ulpd_pm_regs[addr >> 2] ^ value) & 1) {
             now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
@@ -638,50 +638,50 @@ static void omap_ulpd_pm_write(void *opaque, hwaddr addr,
                 ticks = muldiv64(now, 32768, NANOSECONDS_PER_SECOND);
                 s->ulpd_pm_regs[0x00 >> 2] = (ticks >>  0) & 0xffff;
                 s->ulpd_pm_regs[0x04 >> 2] = (ticks >> 16) & 0xffff;
-                if (ticks >> 32)	/* OVERFLOW_32K */
+                if (ticks >> 32)    /* OVERFLOW_32K */
                     s->ulpd_pm_regs[0x14 >> 2] |= 1 << 2;
 
                 /* High frequency ticks */
                 ticks = muldiv64(now, 12000000, NANOSECONDS_PER_SECOND);
                 s->ulpd_pm_regs[0x08 >> 2] = (ticks >>  0) & 0xffff;
                 s->ulpd_pm_regs[0x0c >> 2] = (ticks >> 16) & 0xffff;
-                if (ticks >> 32)	/* OVERFLOW_HI_FREQ */
+                if (ticks >> 32)    /* OVERFLOW_HI_FREQ */
                     s->ulpd_pm_regs[0x14 >> 2] |= 1 << 1;
 
-                s->ulpd_pm_regs[0x14 >> 2] |= 1 << 0;	/* IT_GAUGING */
+                s->ulpd_pm_regs[0x14 >> 2] |= 1 << 0;   /* IT_GAUGING */
                 qemu_irq_raise(qdev_get_gpio_in(s->ih[1], OMAP_INT_GAUGE_32K));
             }
         }
         s->ulpd_pm_regs[addr >> 2] = value;
         break;
 
-    case 0x18:	/* Reserved */
-    case 0x1c:	/* Reserved */
-    case 0x20:	/* Reserved */
-    case 0x28:	/* Reserved */
-    case 0x2c:	/* Reserved */
+    case 0x18:  /* Reserved */
+    case 0x1c:  /* Reserved */
+    case 0x20:  /* Reserved */
+    case 0x28:  /* Reserved */
+    case 0x2c:  /* Reserved */
         OMAP_BAD_REG(addr);
         /* fall through */
-    case 0x24:	/* SETUP_ANALOG_CELL3_ULPD1 */
-    case 0x38:	/* COUNTER_32_FIQ */
-    case 0x48:	/* LOCL_TIME */
-    case 0x50:	/* POWER_CTRL */
+    case 0x24:  /* SETUP_ANALOG_CELL3_ULPD1 */
+    case 0x38:  /* COUNTER_32_FIQ */
+    case 0x48:  /* LOCL_TIME */
+    case 0x50:  /* POWER_CTRL */
         s->ulpd_pm_regs[addr >> 2] = value;
         break;
 
-    case 0x30:	/* CLOCK_CTRL */
+    case 0x30:  /* CLOCK_CTRL */
         diff = s->ulpd_pm_regs[addr >> 2] ^ value;
         s->ulpd_pm_regs[addr >> 2] = value & 0x3f;
         omap_ulpd_clk_update(s, diff, value);
         break;
 
-    case 0x34:	/* SOFT_REQ */
+    case 0x34:  /* SOFT_REQ */
         diff = s->ulpd_pm_regs[addr >> 2] ^ value;
         s->ulpd_pm_regs[addr >> 2] = value & 0x1f;
         omap_ulpd_req_update(s, diff, value);
         break;
 
-    case 0x3c:	/* DPLL_CTRL */
+    case 0x3c:  /* DPLL_CTRL */
         /* XXX: OMAP310 TRM claims bit 3 is PLL_ENABLE, and bit 4 is
          * omitted altogether, probably a typo.  */
         /* This register has identical semantics with DPLL(1:3) control
@@ -689,11 +689,11 @@ static void omap_ulpd_pm_write(void *opaque, hwaddr addr,
         diff = s->ulpd_pm_regs[addr >> 2] & value;
         s->ulpd_pm_regs[addr >> 2] = value & 0x2fff;
         if (diff & (0x3ff << 2)) {
-            if (value & (1 << 4)) {			/* PLL_ENABLE */
-                div = ((value >> 5) & 3) + 1;		/* PLL_DIV */
-                mult = MIN((value >> 7) & 0x1f, 1);	/* PLL_MULT */
+            if (value & (1 << 4)) {         /* PLL_ENABLE */
+                div = ((value >> 5) & 3) + 1;       /* PLL_DIV */
+                mult = MIN((value >> 7) & 0x1f, 1); /* PLL_MULT */
             } else {
-                div = bypass_div[((value >> 2) & 3)];	/* BYPASS_DIV */
+                div = bypass_div[((value >> 2) & 3)];   /* BYPASS_DIV */
                 mult = 1;
             }
             omap_clk_setrate(omap_findclk(s, "dpll4"), div, mult);
@@ -708,10 +708,10 @@ static void omap_ulpd_pm_write(void *opaque, hwaddr addr,
         s->ulpd_pm_regs[addr >> 2] |= 2;
         break;
 
-    case 0x4c:	/* APLL_CTRL */
+    case 0x4c:  /* APLL_CTRL */
         diff = s->ulpd_pm_regs[addr >> 2] & value;
         s->ulpd_pm_regs[addr >> 2] = value & 0xf;
-        if (diff & (1 << 0))				/* APLL_NDPLL_SWITCH */
+        if (diff & (1 << 0))                /* APLL_NDPLL_SWITCH */
             omap_clk_reparent(omap_findclk(s, "ck_48m"), omap_findclk(s,
                                     (value & (1 << 0)) ? "apll" : "dpll4"));
         break;
@@ -775,43 +775,43 @@ static uint64_t omap_pin_cfg_read(void *opaque, hwaddr addr,
     }
 
     switch (addr) {
-    case 0x00:	/* FUNC_MUX_CTRL_0 */
-    case 0x04:	/* FUNC_MUX_CTRL_1 */
-    case 0x08:	/* FUNC_MUX_CTRL_2 */
+    case 0x00:  /* FUNC_MUX_CTRL_0 */
+    case 0x04:  /* FUNC_MUX_CTRL_1 */
+    case 0x08:  /* FUNC_MUX_CTRL_2 */
         return s->func_mux_ctrl[addr >> 2];
 
-    case 0x0c:	/* COMP_MODE_CTRL_0 */
+    case 0x0c:  /* COMP_MODE_CTRL_0 */
         return s->comp_mode_ctrl[0];
 
-    case 0x10:	/* FUNC_MUX_CTRL_3 */
-    case 0x14:	/* FUNC_MUX_CTRL_4 */
-    case 0x18:	/* FUNC_MUX_CTRL_5 */
-    case 0x1c:	/* FUNC_MUX_CTRL_6 */
-    case 0x20:	/* FUNC_MUX_CTRL_7 */
-    case 0x24:	/* FUNC_MUX_CTRL_8 */
-    case 0x28:	/* FUNC_MUX_CTRL_9 */
-    case 0x2c:	/* FUNC_MUX_CTRL_A */
-    case 0x30:	/* FUNC_MUX_CTRL_B */
-    case 0x34:	/* FUNC_MUX_CTRL_C */
-    case 0x38:	/* FUNC_MUX_CTRL_D */
+    case 0x10:  /* FUNC_MUX_CTRL_3 */
+    case 0x14:  /* FUNC_MUX_CTRL_4 */
+    case 0x18:  /* FUNC_MUX_CTRL_5 */
+    case 0x1c:  /* FUNC_MUX_CTRL_6 */
+    case 0x20:  /* FUNC_MUX_CTRL_7 */
+    case 0x24:  /* FUNC_MUX_CTRL_8 */
+    case 0x28:  /* FUNC_MUX_CTRL_9 */
+    case 0x2c:  /* FUNC_MUX_CTRL_A */
+    case 0x30:  /* FUNC_MUX_CTRL_B */
+    case 0x34:  /* FUNC_MUX_CTRL_C */
+    case 0x38:  /* FUNC_MUX_CTRL_D */
         return s->func_mux_ctrl[(addr >> 2) - 1];
 
-    case 0x40:	/* PULL_DWN_CTRL_0 */
-    case 0x44:	/* PULL_DWN_CTRL_1 */
-    case 0x48:	/* PULL_DWN_CTRL_2 */
-    case 0x4c:	/* PULL_DWN_CTRL_3 */
+    case 0x40:  /* PULL_DWN_CTRL_0 */
+    case 0x44:  /* PULL_DWN_CTRL_1 */
+    case 0x48:  /* PULL_DWN_CTRL_2 */
+    case 0x4c:  /* PULL_DWN_CTRL_3 */
         return s->pull_dwn_ctrl[(addr & 0xf) >> 2];
 
-    case 0x50:	/* GATE_INH_CTRL_0 */
+    case 0x50:  /* GATE_INH_CTRL_0 */
         return s->gate_inh_ctrl[0];
 
-    case 0x60:	/* VOLTAGE_CTRL_0 */
+    case 0x60:  /* VOLTAGE_CTRL_0 */
         return s->voltage_ctrl[0];
 
-    case 0x70:	/* TEST_DBG_CTRL_0 */
+    case 0x70:  /* TEST_DBG_CTRL_0 */
         return s->test_dbg_ctrl[0];
 
-    case 0x80:	/* MOD_CONF_CTRL_0 */
+    case 0x80:  /* MOD_CONF_CTRL_0 */
         return s->mod_conf_ctrl[0];
     }
 
@@ -823,10 +823,10 @@ static inline void omap_pin_funcmux0_update(struct omap_mpu_state_s *s,
                 uint32_t diff, uint32_t value)
 {
     if (s->compat1509) {
-        if (diff & (1 << 9))			/* BLUETOOTH */
+        if (diff & (1 << 9))            /* BLUETOOTH */
             omap_clk_onoff(omap_findclk(s, "bt_mclk_out"),
                             (~value >> 9) & 1);
-        if (diff & (1 << 7))			/* USB.CLKO */
+        if (diff & (1 << 7))            /* USB.CLKO */
             omap_clk_onoff(omap_findclk(s, "usb.clko"),
                             (value >> 7) & 1);
     }
@@ -856,23 +856,23 @@ static inline void omap_pin_modconf1_update(struct omap_mpu_state_s *s,
                           omap_findclk(s, ((value >> 31) & 1) ?
                                        "ck_48m" : "armper_ck"));
     }
-    if (diff & (1 << 30))			/* CONF_MOD_UART2_CLK_MODE_R */
+    if (diff & (1 << 30))           /* CONF_MOD_UART2_CLK_MODE_R */
          omap_clk_reparent(omap_findclk(s, "uart2_ck"),
                          omap_findclk(s, ((value >> 30) & 1) ?
                                  "ck_48m" : "armper_ck"));
-    if (diff & (1 << 29))			/* CONF_MOD_UART1_CLK_MODE_R */
+    if (diff & (1 << 29))           /* CONF_MOD_UART1_CLK_MODE_R */
          omap_clk_reparent(omap_findclk(s, "uart1_ck"),
                          omap_findclk(s, ((value >> 29) & 1) ?
                                  "ck_48m" : "armper_ck"));
-    if (diff & (1 << 23))			/* CONF_MOD_MMC_SD_CLK_REQ_R */
+    if (diff & (1 << 23))           /* CONF_MOD_MMC_SD_CLK_REQ_R */
          omap_clk_reparent(omap_findclk(s, "mmc_ck"),
                          omap_findclk(s, ((value >> 23) & 1) ?
                                  "ck_48m" : "armper_ck"));
-    if (diff & (1 << 12))			/* CONF_MOD_COM_MCLK_12_48_S */
+    if (diff & (1 << 12))           /* CONF_MOD_COM_MCLK_12_48_S */
          omap_clk_reparent(omap_findclk(s, "com_mclk_out"),
                          omap_findclk(s, ((value >> 12) & 1) ?
                                  "ck_48m" : "armper_ck"));
-    if (diff & (1 << 9))			/* CONF_MOD_USB_HOST_HHC_UHO */
+    if (diff & (1 << 9))            /* CONF_MOD_USB_HOST_HHC_UHO */
          omap_clk_onoff(omap_findclk(s, "usb_hhc_ck"), (value >> 9) & 1);
 }
 
@@ -888,63 +888,63 @@ static void omap_pin_cfg_write(void *opaque, hwaddr addr,
     }
 
     switch (addr) {
-    case 0x00:	/* FUNC_MUX_CTRL_0 */
+    case 0x00:  /* FUNC_MUX_CTRL_0 */
         diff = s->func_mux_ctrl[addr >> 2] ^ value;
         s->func_mux_ctrl[addr >> 2] = value;
         omap_pin_funcmux0_update(s, diff, value);
         return;
 
-    case 0x04:	/* FUNC_MUX_CTRL_1 */
+    case 0x04:  /* FUNC_MUX_CTRL_1 */
         diff = s->func_mux_ctrl[addr >> 2] ^ value;
         s->func_mux_ctrl[addr >> 2] = value;
         omap_pin_funcmux1_update(s, diff, value);
         return;
 
-    case 0x08:	/* FUNC_MUX_CTRL_2 */
+    case 0x08:  /* FUNC_MUX_CTRL_2 */
         s->func_mux_ctrl[addr >> 2] = value;
         return;
 
-    case 0x0c:	/* COMP_MODE_CTRL_0 */
+    case 0x0c:  /* COMP_MODE_CTRL_0 */
         s->comp_mode_ctrl[0] = value;
         s->compat1509 = (value != 0x0000eaef);
         omap_pin_funcmux0_update(s, ~0, s->func_mux_ctrl[0]);
         omap_pin_funcmux1_update(s, ~0, s->func_mux_ctrl[1]);
         return;
 
-    case 0x10:	/* FUNC_MUX_CTRL_3 */
-    case 0x14:	/* FUNC_MUX_CTRL_4 */
-    case 0x18:	/* FUNC_MUX_CTRL_5 */
-    case 0x1c:	/* FUNC_MUX_CTRL_6 */
-    case 0x20:	/* FUNC_MUX_CTRL_7 */
-    case 0x24:	/* FUNC_MUX_CTRL_8 */
-    case 0x28:	/* FUNC_MUX_CTRL_9 */
-    case 0x2c:	/* FUNC_MUX_CTRL_A */
-    case 0x30:	/* FUNC_MUX_CTRL_B */
-    case 0x34:	/* FUNC_MUX_CTRL_C */
-    case 0x38:	/* FUNC_MUX_CTRL_D */
+    case 0x10:  /* FUNC_MUX_CTRL_3 */
+    case 0x14:  /* FUNC_MUX_CTRL_4 */
+    case 0x18:  /* FUNC_MUX_CTRL_5 */
+    case 0x1c:  /* FUNC_MUX_CTRL_6 */
+    case 0x20:  /* FUNC_MUX_CTRL_7 */
+    case 0x24:  /* FUNC_MUX_CTRL_8 */
+    case 0x28:  /* FUNC_MUX_CTRL_9 */
+    case 0x2c:  /* FUNC_MUX_CTRL_A */
+    case 0x30:  /* FUNC_MUX_CTRL_B */
+    case 0x34:  /* FUNC_MUX_CTRL_C */
+    case 0x38:  /* FUNC_MUX_CTRL_D */
         s->func_mux_ctrl[(addr >> 2) - 1] = value;
         return;
 
-    case 0x40:	/* PULL_DWN_CTRL_0 */
-    case 0x44:	/* PULL_DWN_CTRL_1 */
-    case 0x48:	/* PULL_DWN_CTRL_2 */
-    case 0x4c:	/* PULL_DWN_CTRL_3 */
+    case 0x40:  /* PULL_DWN_CTRL_0 */
+    case 0x44:  /* PULL_DWN_CTRL_1 */
+    case 0x48:  /* PULL_DWN_CTRL_2 */
+    case 0x4c:  /* PULL_DWN_CTRL_3 */
         s->pull_dwn_ctrl[(addr & 0xf) >> 2] = value;
         return;
 
-    case 0x50:	/* GATE_INH_CTRL_0 */
+    case 0x50:  /* GATE_INH_CTRL_0 */
         s->gate_inh_ctrl[0] = value;
         return;
 
-    case 0x60:	/* VOLTAGE_CTRL_0 */
+    case 0x60:  /* VOLTAGE_CTRL_0 */
         s->voltage_ctrl[0] = value;
         return;
 
-    case 0x70:	/* TEST_DBG_CTRL_0 */
+    case 0x70:  /* TEST_DBG_CTRL_0 */
         s->test_dbg_ctrl[0] = value;
         return;
 
-    case 0x80:	/* MOD_CONF_CTRL_0 */
+    case 0x80:  /* MOD_CONF_CTRL_0 */
         diff = s->mod_conf_ctrl[0] ^ value;
         s->mod_conf_ctrl[0] = value;
         omap_pin_modconf1_update(s, diff, value);
@@ -998,17 +998,17 @@ static uint64_t omap_id_read(void *opaque, hwaddr addr,
     }
 
     switch (addr) {
-    case 0xfffe1800:	/* DIE_ID_LSB */
+    case 0xfffe1800:    /* DIE_ID_LSB */
         return 0xc9581f0e;
-    case 0xfffe1804:	/* DIE_ID_MSB */
+    case 0xfffe1804:    /* DIE_ID_MSB */
         return 0xa8858bfa;
 
-    case 0xfffe2000:	/* PRODUCT_ID_LSB */
+    case 0xfffe2000:    /* PRODUCT_ID_LSB */
         return 0x00aaaafc;
-    case 0xfffe2004:	/* PRODUCT_ID_MSB */
+    case 0xfffe2004:    /* PRODUCT_ID_MSB */
         return 0xcafeb574;
 
-    case 0xfffed400:	/* JTAG_ID_LSB */
+    case 0xfffed400:    /* JTAG_ID_LSB */
         switch (s->mpu_model) {
         case omap310:
             return 0x03310315;
@@ -1019,7 +1019,7 @@ static uint64_t omap_id_read(void *opaque, hwaddr addr,
         }
         break;
 
-    case 0xfffed404:	/* JTAG_ID_MSB */
+    case 0xfffed404:    /* JTAG_ID_MSB */
         switch (s->mpu_model) {
         case omap310:
             return 0xfb57402f;
@@ -1080,22 +1080,22 @@ static uint64_t omap_mpui_read(void *opaque, hwaddr addr,
     }
 
     switch (addr) {
-    case 0x00:	/* CTRL */
+    case 0x00:  /* CTRL */
         return s->mpui_ctrl;
-    case 0x04:	/* DEBUG_ADDR */
+    case 0x04:  /* DEBUG_ADDR */
         return 0x01ffffff;
-    case 0x08:	/* DEBUG_DATA */
+    case 0x08:  /* DEBUG_DATA */
         return 0xffffffff;
-    case 0x0c:	/* DEBUG_FLAG */
+    case 0x0c:  /* DEBUG_FLAG */
         return 0x00000800;
-    case 0x10:	/* STATUS */
+    case 0x10:  /* STATUS */
         return 0x00000000;
 
     /* Not in OMAP310 */
-    case 0x14:	/* DSP_STATUS */
-    case 0x18:	/* DSP_BOOT_CONFIG */
+    case 0x14:  /* DSP_STATUS */
+    case 0x18:  /* DSP_BOOT_CONFIG */
         return 0x00000000;
-    case 0x1c:	/* DSP_MPUI_CONFIG */
+    case 0x1c:  /* DSP_MPUI_CONFIG */
         return 0x0000ffff;
     }
 
@@ -1114,20 +1114,20 @@ static void omap_mpui_write(void *opaque, hwaddr addr,
     }
 
     switch (addr) {
-    case 0x00:	/* CTRL */
+    case 0x00:  /* CTRL */
         s->mpui_ctrl = value & 0x007fffff;
         break;
 
-    case 0x04:	/* DEBUG_ADDR */
-    case 0x08:	/* DEBUG_DATA */
-    case 0x0c:	/* DEBUG_FLAG */
-    case 0x10:	/* STATUS */
+    case 0x04:  /* DEBUG_ADDR */
+    case 0x08:  /* DEBUG_DATA */
+    case 0x0c:  /* DEBUG_FLAG */
+    case 0x10:  /* STATUS */
     /* Not in OMAP310 */
-    case 0x14:	/* DSP_STATUS */
+    case 0x14:  /* DSP_STATUS */
         OMAP_RO_REG(addr);
         break;
-    case 0x18:	/* DSP_BOOT_CONFIG */
-    case 0x1c:	/* DSP_MPUI_CONFIG */
+    case 0x18:  /* DSP_BOOT_CONFIG */
+    case 0x1c:  /* DSP_MPUI_CONFIG */
         break;
 
     default:
@@ -1178,19 +1178,19 @@ static uint64_t omap_tipb_bridge_read(void *opaque, hwaddr addr,
     }
 
     switch (addr) {
-    case 0x00:	/* TIPB_CNTL */
+    case 0x00:  /* TIPB_CNTL */
         return s->control;
-    case 0x04:	/* TIPB_BUS_ALLOC */
+    case 0x04:  /* TIPB_BUS_ALLOC */
         return s->alloc;
-    case 0x08:	/* MPU_TIPB_CNTL */
+    case 0x08:  /* MPU_TIPB_CNTL */
         return s->buffer;
-    case 0x0c:	/* ENHANCED_TIPB_CNTL */
+    case 0x0c:  /* ENHANCED_TIPB_CNTL */
         return s->enh_control;
-    case 0x10:	/* ADDRESS_DBG */
-    case 0x14:	/* DATA_DEBUG_LOW */
-    case 0x18:	/* DATA_DEBUG_HIGH */
+    case 0x10:  /* ADDRESS_DBG */
+    case 0x14:  /* DATA_DEBUG_LOW */
+    case 0x18:  /* DATA_DEBUG_HIGH */
         return 0xffff;
-    case 0x1c:	/* DEBUG_CNTR_SIG */
+    case 0x1c:  /* DEBUG_CNTR_SIG */
         return 0x00f8;
     }
 
@@ -1209,27 +1209,27 @@ static void omap_tipb_bridge_write(void *opaque, hwaddr addr,
     }
 
     switch (addr) {
-    case 0x00:	/* TIPB_CNTL */
+    case 0x00:  /* TIPB_CNTL */
         s->control = value & 0xffff;
         break;
 
-    case 0x04:	/* TIPB_BUS_ALLOC */
+    case 0x04:  /* TIPB_BUS_ALLOC */
         s->alloc = value & 0x003f;
         break;
 
-    case 0x08:	/* MPU_TIPB_CNTL */
+    case 0x08:  /* MPU_TIPB_CNTL */
         s->buffer = value & 0x0003;
         break;
 
-    case 0x0c:	/* ENHANCED_TIPB_CNTL */
+    case 0x0c:  /* ENHANCED_TIPB_CNTL */
         s->width_intr = !(value & 2);
         s->enh_control = value & 0x000f;
         break;
 
-    case 0x10:	/* ADDRESS_DBG */
-    case 0x14:	/* DATA_DEBUG_LOW */
-    case 0x18:	/* DATA_DEBUG_HIGH */
-    case 0x1c:	/* DEBUG_CNTR_SIG */
+    case 0x10:  /* ADDRESS_DBG */
+    case 0x14:  /* DATA_DEBUG_LOW */
+    case 0x18:  /* DATA_DEBUG_HIGH */
+    case 0x1c:  /* DEBUG_CNTR_SIG */
         OMAP_RO_REG(addr);
         break;
 
@@ -1280,23 +1280,23 @@ static uint64_t omap_tcmi_read(void *opaque, hwaddr addr,
     }
 
     switch (addr) {
-    case 0x00:	/* IMIF_PRIO */
-    case 0x04:	/* EMIFS_PRIO */
-    case 0x08:	/* EMIFF_PRIO */
-    case 0x0c:	/* EMIFS_CONFIG */
-    case 0x10:	/* EMIFS_CS0_CONFIG */
-    case 0x14:	/* EMIFS_CS1_CONFIG */
-    case 0x18:	/* EMIFS_CS2_CONFIG */
-    case 0x1c:	/* EMIFS_CS3_CONFIG */
-    case 0x24:	/* EMIFF_MRS */
-    case 0x28:	/* TIMEOUT1 */
-    case 0x2c:	/* TIMEOUT2 */
-    case 0x30:	/* TIMEOUT3 */
-    case 0x3c:	/* EMIFF_SDRAM_CONFIG_2 */
-    case 0x40:	/* EMIFS_CFG_DYN_WAIT */
+    case 0x00:  /* IMIF_PRIO */
+    case 0x04:  /* EMIFS_PRIO */
+    case 0x08:  /* EMIFF_PRIO */
+    case 0x0c:  /* EMIFS_CONFIG */
+    case 0x10:  /* EMIFS_CS0_CONFIG */
+    case 0x14:  /* EMIFS_CS1_CONFIG */
+    case 0x18:  /* EMIFS_CS2_CONFIG */
+    case 0x1c:  /* EMIFS_CS3_CONFIG */
+    case 0x24:  /* EMIFF_MRS */
+    case 0x28:  /* TIMEOUT1 */
+    case 0x2c:  /* TIMEOUT2 */
+    case 0x30:  /* TIMEOUT3 */
+    case 0x3c:  /* EMIFF_SDRAM_CONFIG_2 */
+    case 0x40:  /* EMIFS_CFG_DYN_WAIT */
         return s->tcmi_regs[addr >> 2];
 
-    case 0x20:	/* EMIFF_SDRAM_CONFIG */
+    case 0x20:  /* EMIFF_SDRAM_CONFIG */
         ret = s->tcmi_regs[addr >> 2];
         s->tcmi_regs[addr >> 2] &= ~1; /* XXX: Clear SLRF on SDRAM access */
         /* XXX: We can try using the VGA_DIRTY flag for this */
@@ -1318,23 +1318,23 @@ static void omap_tcmi_write(void *opaque, hwaddr addr,
     }
 
     switch (addr) {
-    case 0x00:	/* IMIF_PRIO */
-    case 0x04:	/* EMIFS_PRIO */
-    case 0x08:	/* EMIFF_PRIO */
-    case 0x10:	/* EMIFS_CS0_CONFIG */
-    case 0x14:	/* EMIFS_CS1_CONFIG */
-    case 0x18:	/* EMIFS_CS2_CONFIG */
-    case 0x1c:	/* EMIFS_CS3_CONFIG */
-    case 0x20:	/* EMIFF_SDRAM_CONFIG */
-    case 0x24:	/* EMIFF_MRS */
-    case 0x28:	/* TIMEOUT1 */
-    case 0x2c:	/* TIMEOUT2 */
-    case 0x30:	/* TIMEOUT3 */
-    case 0x3c:	/* EMIFF_SDRAM_CONFIG_2 */
-    case 0x40:	/* EMIFS_CFG_DYN_WAIT */
+    case 0x00:  /* IMIF_PRIO */
+    case 0x04:  /* EMIFS_PRIO */
+    case 0x08:  /* EMIFF_PRIO */
+    case 0x10:  /* EMIFS_CS0_CONFIG */
+    case 0x14:  /* EMIFS_CS1_CONFIG */
+    case 0x18:  /* EMIFS_CS2_CONFIG */
+    case 0x1c:  /* EMIFS_CS3_CONFIG */
+    case 0x20:  /* EMIFF_SDRAM_CONFIG */
+    case 0x24:  /* EMIFF_MRS */
+    case 0x28:  /* TIMEOUT1 */
+    case 0x2c:  /* TIMEOUT2 */
+    case 0x30:  /* TIMEOUT3 */
+    case 0x3c:  /* EMIFF_SDRAM_CONFIG_2 */
+    case 0x40:  /* EMIFS_CFG_DYN_WAIT */
         s->tcmi_regs[addr >> 2] = value;
         break;
-    case 0x0c:	/* EMIFS_CONFIG */
+    case 0x0c:  /* EMIFS_CONFIG */
         s->tcmi_regs[addr >> 2] = (value & 0xf) | (1 << 4);
         break;
 
@@ -1393,7 +1393,7 @@ static uint64_t omap_dpll_read(void *opaque, hwaddr addr,
         return omap_badwidth_read16(opaque, addr);
     }
 
-    if (addr == 0x00)	/* CTL_REG */
+    if (addr == 0x00)   /* CTL_REG */
         return s->mode;
 
     OMAP_BAD_REG(addr);
@@ -1413,16 +1413,16 @@ static void omap_dpll_write(void *opaque, hwaddr addr,
         return;
     }
 
-    if (addr == 0x00) {	/* CTL_REG */
+    if (addr == 0x00) { /* CTL_REG */
         /* See omap_ulpd_pm_write() too */
         diff = s->mode & value;
         s->mode = value & 0x2fff;
         if (diff & (0x3ff << 2)) {
-            if (value & (1 << 4)) {			/* PLL_ENABLE */
-                div = ((value >> 5) & 3) + 1;		/* PLL_DIV */
-                mult = MIN((value >> 7) & 0x1f, 1);	/* PLL_MULT */
+            if (value & (1 << 4)) {         /* PLL_ENABLE */
+                div = ((value >> 5) & 3) + 1;       /* PLL_DIV */
+                mult = MIN((value >> 7) & 0x1f, 1); /* PLL_MULT */
             } else {
-                div = bypass_div[((value >> 2) & 3)];	/* BYPASS_DIV */
+                div = bypass_div[((value >> 2) & 3)];   /* BYPASS_DIV */
                 mult = 1;
             }
             omap_clk_setrate(s->dpll, div, mult);
@@ -1474,31 +1474,31 @@ static uint64_t omap_clkm_read(void *opaque, hwaddr addr,
     }
 
     switch (addr) {
-    case 0x00:	/* ARM_CKCTL */
+    case 0x00:  /* ARM_CKCTL */
         return s->clkm.arm_ckctl;
 
-    case 0x04:	/* ARM_IDLECT1 */
+    case 0x04:  /* ARM_IDLECT1 */
         return s->clkm.arm_idlect1;
 
-    case 0x08:	/* ARM_IDLECT2 */
+    case 0x08:  /* ARM_IDLECT2 */
         return s->clkm.arm_idlect2;
 
-    case 0x0c:	/* ARM_EWUPCT */
+    case 0x0c:  /* ARM_EWUPCT */
         return s->clkm.arm_ewupct;
 
-    case 0x10:	/* ARM_RSTCT1 */
+    case 0x10:  /* ARM_RSTCT1 */
         return s->clkm.arm_rstct1;
 
-    case 0x14:	/* ARM_RSTCT2 */
+    case 0x14:  /* ARM_RSTCT2 */
         return s->clkm.arm_rstct2;
 
-    case 0x18:	/* ARM_SYSST */
+    case 0x18:  /* ARM_SYSST */
         return (s->clkm.clocking_scheme << 11) | s->clkm.cold_start;
 
-    case 0x1c:	/* ARM_CKOUT1 */
+    case 0x1c:  /* ARM_CKOUT1 */
         return s->clkm.arm_ckout1;
 
-    case 0x20:	/* ARM_CKOUT2 */
+    case 0x20:  /* ARM_CKOUT2 */
         break;
     }
 
@@ -1511,7 +1511,7 @@ static inline void omap_clkm_ckctl_update(struct omap_mpu_state_s *s,
 {
     omap_clk clk;
 
-    if (diff & (1 << 14)) {				/* ARM_INTHCK_SEL */
+    if (diff & (1 << 14)) {             /* ARM_INTHCK_SEL */
         if (value & (1 << 14))
             /* Reserved */;
         else {
@@ -1519,7 +1519,7 @@ static inline void omap_clkm_ckctl_update(struct omap_mpu_state_s *s,
             omap_clk_reparent(clk, omap_findclk(s, "tc_ck"));
         }
     }
-    if (diff & (1 << 12)) {				/* ARM_TIMXO */
+    if (diff & (1 << 12)) {             /* ARM_TIMXO */
         clk = omap_findclk(s, "armtim_ck");
         if (value & (1 << 12))
             omap_clk_reparent(clk, omap_findclk(s, "clkin"));
@@ -1527,27 +1527,27 @@ static inline void omap_clkm_ckctl_update(struct omap_mpu_state_s *s,
             omap_clk_reparent(clk, omap_findclk(s, "ck_gen1"));
     }
     /* XXX: en_dspck */
-    if (diff & (3 << 10)) {				/* DSPMMUDIV */
+    if (diff & (3 << 10)) {             /* DSPMMUDIV */
         clk = omap_findclk(s, "dspmmu_ck");
         omap_clk_setrate(clk, 1 << ((value >> 10) & 3), 1);
     }
-    if (diff & (3 << 8)) {				/* TCDIV */
+    if (diff & (3 << 8)) {              /* TCDIV */
         clk = omap_findclk(s, "tc_ck");
         omap_clk_setrate(clk, 1 << ((value >> 8) & 3), 1);
     }
-    if (diff & (3 << 6)) {				/* DSPDIV */
+    if (diff & (3 << 6)) {              /* DSPDIV */
         clk = omap_findclk(s, "dsp_ck");
         omap_clk_setrate(clk, 1 << ((value >> 6) & 3), 1);
     }
-    if (diff & (3 << 4)) {				/* ARMDIV */
+    if (diff & (3 << 4)) {              /* ARMDIV */
         clk = omap_findclk(s, "arm_ck");
         omap_clk_setrate(clk, 1 << ((value >> 4) & 3), 1);
     }
-    if (diff & (3 << 2)) {				/* LCDDIV */
+    if (diff & (3 << 2)) {              /* LCDDIV */
         clk = omap_findclk(s, "lcd_ck");
         omap_clk_setrate(clk, 1 << ((value >> 2) & 3), 1);
     }
-    if (diff & (3 << 0)) {				/* PERDIV */
+    if (diff & (3 << 0)) {              /* PERDIV */
         clk = omap_findclk(s, "armper_ck");
         omap_clk_setrate(clk, 1 << ((value >> 0) & 3), 1);
     }
@@ -1566,25 +1566,25 @@ static inline void omap_clkm_idlect1_update(struct omap_mpu_state_s *s,
         qemu_system_shutdown_request(SHUTDOWN_CAUSE_GUEST_SHUTDOWN);
     }
 
-#define SET_CANIDLE(clock, bit)				\
-    if (diff & (1 << bit)) {				\
-        clk = omap_findclk(s, clock);			\
-        omap_clk_canidle(clk, (value >> bit) & 1);	\
+#define SET_CANIDLE(clock, bit)                     \
+    if (diff & (1 << bit)) {                        \
+        clk = omap_findclk(s, clock);               \
+        omap_clk_canidle(clk, (value >> bit) & 1);  \
     }
-    SET_CANIDLE("mpuwd_ck", 0)				/* IDLWDT_ARM */
-    SET_CANIDLE("armxor_ck", 1)				/* IDLXORP_ARM */
-    SET_CANIDLE("mpuper_ck", 2)				/* IDLPER_ARM */
-    SET_CANIDLE("lcd_ck", 3)				/* IDLLCD_ARM */
-    SET_CANIDLE("lb_ck", 4)				/* IDLLB_ARM */
-    SET_CANIDLE("hsab_ck", 5)				/* IDLHSAB_ARM */
-    SET_CANIDLE("tipb_ck", 6)				/* IDLIF_ARM */
-    SET_CANIDLE("dma_ck", 6)				/* IDLIF_ARM */
-    SET_CANIDLE("tc_ck", 6)				/* IDLIF_ARM */
-    SET_CANIDLE("dpll1", 7)				/* IDLDPLL_ARM */
-    SET_CANIDLE("dpll2", 7)				/* IDLDPLL_ARM */
-    SET_CANIDLE("dpll3", 7)				/* IDLDPLL_ARM */
-    SET_CANIDLE("mpui_ck", 8)				/* IDLAPI_ARM */
-    SET_CANIDLE("armtim_ck", 9)				/* IDLTIM_ARM */
+    SET_CANIDLE("mpuwd_ck", 0)          /* IDLWDT_ARM */
+    SET_CANIDLE("armxor_ck", 1)         /* IDLXORP_ARM */
+    SET_CANIDLE("mpuper_ck", 2)         /* IDLPER_ARM */
+    SET_CANIDLE("lcd_ck", 3)            /* IDLLCD_ARM */
+    SET_CANIDLE("lb_ck", 4)             /* IDLLB_ARM */
+    SET_CANIDLE("hsab_ck", 5)           /* IDLHSAB_ARM */
+    SET_CANIDLE("tipb_ck", 6)           /* IDLIF_ARM */
+    SET_CANIDLE("dma_ck", 6)            /* IDLIF_ARM */
+    SET_CANIDLE("tc_ck", 6)             /* IDLIF_ARM */
+    SET_CANIDLE("dpll1", 7)             /* IDLDPLL_ARM */
+    SET_CANIDLE("dpll2", 7)             /* IDLDPLL_ARM */
+    SET_CANIDLE("dpll3", 7)             /* IDLDPLL_ARM */
+    SET_CANIDLE("mpui_ck", 8)           /* IDLAPI_ARM */
+    SET_CANIDLE("armtim_ck", 9)         /* IDLTIM_ARM */
 }
 
 static inline void omap_clkm_idlect2_update(struct omap_mpu_state_s *s,
@@ -1592,22 +1592,22 @@ static inline void omap_clkm_idlect2_update(struct omap_mpu_state_s *s,
 {
     omap_clk clk;
 
-#define SET_ONOFF(clock, bit)				\
-    if (diff & (1 << bit)) {				\
-        clk = omap_findclk(s, clock);			\
-        omap_clk_onoff(clk, (value >> bit) & 1);	\
+#define SET_ONOFF(clock, bit)                       \
+    if (diff & (1 << bit)) {                        \
+        clk = omap_findclk(s, clock);               \
+        omap_clk_onoff(clk, (value >> bit) & 1);    \
     }
-    SET_ONOFF("mpuwd_ck", 0)				/* EN_WDTCK */
-    SET_ONOFF("armxor_ck", 1)				/* EN_XORPCK */
-    SET_ONOFF("mpuper_ck", 2)				/* EN_PERCK */
-    SET_ONOFF("lcd_ck", 3)				/* EN_LCDCK */
-    SET_ONOFF("lb_ck", 4)				/* EN_LBCK */
-    SET_ONOFF("hsab_ck", 5)				/* EN_HSABCK */
-    SET_ONOFF("mpui_ck", 6)				/* EN_APICK */
-    SET_ONOFF("armtim_ck", 7)				/* EN_TIMCK */
-    SET_CANIDLE("dma_ck", 8)				/* DMACK_REQ */
-    SET_ONOFF("arm_gpio_ck", 9)				/* EN_GPIOCK */
-    SET_ONOFF("lbfree_ck", 10)				/* EN_LBFREECK */
+    SET_ONOFF("mpuwd_ck", 0)            /* EN_WDTCK */
+    SET_ONOFF("armxor_ck", 1)           /* EN_XORPCK */
+    SET_ONOFF("mpuper_ck", 2)           /* EN_PERCK */
+    SET_ONOFF("lcd_ck", 3)              /* EN_LCDCK */
+    SET_ONOFF("lb_ck", 4)               /* EN_LBCK */
+    SET_ONOFF("hsab_ck", 5)             /* EN_HSABCK */
+    SET_ONOFF("mpui_ck", 6)             /* EN_APICK */
+    SET_ONOFF("armtim_ck", 7)           /* EN_TIMCK */
+    SET_CANIDLE("dma_ck", 8)            /* DMACK_REQ */
+    SET_ONOFF("arm_gpio_ck", 9)         /* EN_GPIOCK */
+    SET_ONOFF("lbfree_ck", 10)          /* EN_LBFREECK */
 }
 
 static inline void omap_clkm_ckout1_update(struct omap_mpu_state_s *s,
@@ -1615,7 +1615,7 @@ static inline void omap_clkm_ckout1_update(struct omap_mpu_state_s *s,
 {
     omap_clk clk;
 
-    if (diff & (3 << 4)) {				/* TCLKOUT */
+    if (diff & (3 << 4)) {              /* TCLKOUT */
         clk = omap_findclk(s, "tclk_out");
         switch ((value >> 4) & 3) {
         case 1:
@@ -1630,7 +1630,7 @@ static inline void omap_clkm_ckout1_update(struct omap_mpu_state_s *s,
             omap_clk_onoff(clk, 0);
         }
     }
-    if (diff & (3 << 2)) {				/* DCLKOUT */
+    if (diff & (3 << 2)) {              /* DCLKOUT */
         clk = omap_findclk(s, "dclk_out");
         switch ((value >> 2) & 3) {
         case 0:
@@ -1647,7 +1647,7 @@ static inline void omap_clkm_ckout1_update(struct omap_mpu_state_s *s,
             break;
         }
     }
-    if (diff & (3 << 0)) {				/* ACLKOUT */
+    if (diff & (3 << 0)) {              /* ACLKOUT */
         clk = omap_findclk(s, "aclk_out");
         switch ((value >> 0) & 3) {
         case 1:
@@ -1685,51 +1685,51 @@ static void omap_clkm_write(void *opaque, hwaddr addr,
     }
 
     switch (addr) {
-    case 0x00:	/* ARM_CKCTL */
+    case 0x00:  /* ARM_CKCTL */
         diff = s->clkm.arm_ckctl ^ value;
         s->clkm.arm_ckctl = value & 0x7fff;
         omap_clkm_ckctl_update(s, diff, value);
         return;
 
-    case 0x04:	/* ARM_IDLECT1 */
+    case 0x04:  /* ARM_IDLECT1 */
         diff = s->clkm.arm_idlect1 ^ value;
         s->clkm.arm_idlect1 = value & 0x0fff;
         omap_clkm_idlect1_update(s, diff, value);
         return;
 
-    case 0x08:	/* ARM_IDLECT2 */
+    case 0x08:  /* ARM_IDLECT2 */
         diff = s->clkm.arm_idlect2 ^ value;
         s->clkm.arm_idlect2 = value & 0x07ff;
         omap_clkm_idlect2_update(s, diff, value);
         return;
 
-    case 0x0c:	/* ARM_EWUPCT */
+    case 0x0c:  /* ARM_EWUPCT */
         s->clkm.arm_ewupct = value & 0x003f;
         return;
 
-    case 0x10:	/* ARM_RSTCT1 */
+    case 0x10:  /* ARM_RSTCT1 */
         diff = s->clkm.arm_rstct1 ^ value;
         s->clkm.arm_rstct1 = value & 0x0007;
         if (value & 9) {
             qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
             s->clkm.cold_start = 0xa;
         }
-        if (diff & ~value & 4) {				/* DSP_RST */
+        if (diff & ~value & 4) {                /* DSP_RST */
             omap_mpui_reset(s);
             omap_tipb_bridge_reset(s->private_tipb);
             omap_tipb_bridge_reset(s->public_tipb);
         }
-        if (diff & 2) {						/* DSP_EN */
+        if (diff & 2) {                     /* DSP_EN */
             clk = omap_findclk(s, "dsp_ck");
             omap_clk_canidle(clk, (~value >> 1) & 1);
         }
         return;
 
-    case 0x14:	/* ARM_RSTCT2 */
+    case 0x14:  /* ARM_RSTCT2 */
         s->clkm.arm_rstct2 = value & 0x0001;
         return;
 
-    case 0x18:	/* ARM_SYSST */
+    case 0x18:  /* ARM_SYSST */
         if ((s->clkm.clocking_scheme ^ (value >> 11)) & 7) {
             s->clkm.clocking_scheme = (value >> 11) & 7;
             trace_omap1_pwl_clocking_scheme(
@@ -1738,13 +1738,13 @@ static void omap_clkm_write(void *opaque, hwaddr addr,
         s->clkm.cold_start &= value & 0x3f;
         return;
 
-    case 0x1c:	/* ARM_CKOUT1 */
+    case 0x1c:  /* ARM_CKOUT1 */
         diff = s->clkm.arm_ckout1 ^ value;
         s->clkm.arm_ckout1 = value & 0x003f;
         omap_clkm_ckout1_update(s, diff, value);
         return;
 
-    case 0x20:	/* ARM_CKOUT2 */
+    case 0x20:  /* ARM_CKOUT2 */
     default:
         OMAP_BAD_REG(addr);
     }
@@ -1767,16 +1767,16 @@ static uint64_t omap_clkdsp_read(void *opaque, hwaddr addr,
     }
 
     switch (addr) {
-    case 0x04:	/* DSP_IDLECT1 */
+    case 0x04:  /* DSP_IDLECT1 */
         return s->clkm.dsp_idlect1;
 
-    case 0x08:	/* DSP_IDLECT2 */
+    case 0x08:  /* DSP_IDLECT2 */
         return s->clkm.dsp_idlect2;
 
-    case 0x14:	/* DSP_RSTCT2 */
+    case 0x14:  /* DSP_RSTCT2 */
         return s->clkm.dsp_rstct2;
 
-    case 0x18:	/* DSP_SYSST */
+    case 0x18:  /* DSP_SYSST */
         return (s->clkm.clocking_scheme << 11) | s->clkm.cold_start |
                 (cpu->halted << 6);      /* Quite useless... */
     }
@@ -1790,7 +1790,7 @@ static inline void omap_clkdsp_idlect1_update(struct omap_mpu_state_s *s,
 {
     omap_clk clk;
 
-    SET_CANIDLE("dspxor_ck", 1);			/* IDLXORP_DSP */
+    SET_CANIDLE("dspxor_ck", 1);            /* IDLXORP_DSP */
 }
 
 static inline void omap_clkdsp_idlect2_update(struct omap_mpu_state_s *s,
@@ -1798,7 +1798,7 @@ static inline void omap_clkdsp_idlect2_update(struct omap_mpu_state_s *s,
 {
     omap_clk clk;
 
-    SET_ONOFF("dspxor_ck", 1);				/* EN_XORPCK */
+    SET_ONOFF("dspxor_ck", 1);              /* EN_XORPCK */
 }
 
 static void omap_clkdsp_write(void *opaque, hwaddr addr,
@@ -1813,23 +1813,23 @@ static void omap_clkdsp_write(void *opaque, hwaddr addr,
     }
 
     switch (addr) {
-    case 0x04:	/* DSP_IDLECT1 */
+    case 0x04:  /* DSP_IDLECT1 */
         diff = s->clkm.dsp_idlect1 ^ value;
         s->clkm.dsp_idlect1 = value & 0x01f7;
         omap_clkdsp_idlect1_update(s, diff, value);
         break;
 
-    case 0x08:	/* DSP_IDLECT2 */
+    case 0x08:  /* DSP_IDLECT2 */
         s->clkm.dsp_idlect2 = value & 0x0037;
         diff = s->clkm.dsp_idlect1 ^ value;
         omap_clkdsp_idlect2_update(s, diff, value);
         break;
 
-    case 0x14:	/* DSP_RSTCT2 */
+    case 0x14:  /* DSP_RSTCT2 */
         s->clkm.dsp_rstct2 = value & 0x0001;
         break;
 
-    case 0x18:	/* DSP_SYSST */
+    case 0x18:  /* DSP_SYSST */
         s->clkm.cold_start &= value & 0x3f;
         break;
 
@@ -1928,8 +1928,8 @@ static void omap_mpuio_set(void *opaque, int line, int level)
             qemu_irq_raise(s->irq);
             /* TODO: wakeup */
         }
-        if ((s->event & (1 << 0)) &&		/* SET_GPIO_EVENT_MODE */
-                (s->event >> 1) == line)	/* PIN_SELECT */
+        if ((s->event & (1 << 0)) &&        /* SET_GPIO_EVENT_MODE */
+                (s->event >> 1) == line)    /* PIN_SELECT */
             s->latch = s->inputs;
     }
 }
@@ -1959,47 +1959,47 @@ static uint64_t omap_mpuio_read(void *opaque, hwaddr addr,
     }
 
     switch (offset) {
-    case 0x00:	/* INPUT_LATCH */
+    case 0x00:  /* INPUT_LATCH */
         return s->inputs;
 
-    case 0x04:	/* OUTPUT_REG */
+    case 0x04:  /* OUTPUT_REG */
         return s->outputs;
 
-    case 0x08:	/* IO_CNTL */
+    case 0x08:  /* IO_CNTL */
         return s->dir;
 
-    case 0x10:	/* KBR_LATCH */
+    case 0x10:  /* KBR_LATCH */
         return s->row_latch;
 
-    case 0x14:	/* KBC_REG */
+    case 0x14:  /* KBC_REG */
         return s->cols;
 
-    case 0x18:	/* GPIO_EVENT_MODE_REG */
+    case 0x18:  /* GPIO_EVENT_MODE_REG */
         return s->event;
 
-    case 0x1c:	/* GPIO_INT_EDGE_REG */
+    case 0x1c:  /* GPIO_INT_EDGE_REG */
         return s->edge;
 
-    case 0x20:	/* KBD_INT */
+    case 0x20:  /* KBD_INT */
         return (~s->row_latch & 0x1f) && !s->kbd_mask;
 
-    case 0x24:	/* GPIO_INT */
+    case 0x24:  /* GPIO_INT */
         ret = s->ints;
         s->ints &= s->mask;
         if (ret)
             qemu_irq_lower(s->irq);
         return ret;
 
-    case 0x28:	/* KBD_MASKIT */
+    case 0x28:  /* KBD_MASKIT */
         return s->kbd_mask;
 
-    case 0x2c:	/* GPIO_MASKIT */
+    case 0x2c:  /* GPIO_MASKIT */
         return s->mask;
 
-    case 0x30:	/* GPIO_DEBOUNCING_REG */
+    case 0x30:  /* GPIO_DEBOUNCING_REG */
         return s->debounce;
 
-    case 0x34:	/* GPIO_LATCH_REG */
+    case 0x34:  /* GPIO_LATCH_REG */
         return s->latch;
     }
 
@@ -2021,7 +2021,7 @@ static void omap_mpuio_write(void *opaque, hwaddr addr,
     }
 
     switch (offset) {
-    case 0x04:	/* OUTPUT_REG */
+    case 0x04:  /* OUTPUT_REG */
         diff = (s->outputs ^ value) & ~s->dir;
         s->outputs = value;
         while ((ln = ctz32(diff)) != 32) {
@@ -2031,7 +2031,7 @@ static void omap_mpuio_write(void *opaque, hwaddr addr,
         }
         break;
 
-    case 0x08:	/* IO_CNTL */
+    case 0x08:  /* IO_CNTL */
         diff = s->outputs & (s->dir ^ value);
         s->dir = value;
 
@@ -2043,37 +2043,37 @@ static void omap_mpuio_write(void *opaque, hwaddr addr,
         }
         break;
 
-    case 0x14:	/* KBC_REG */
+    case 0x14:  /* KBC_REG */
         s->cols = value;
         omap_mpuio_kbd_update(s);
         break;
 
-    case 0x18:	/* GPIO_EVENT_MODE_REG */
+    case 0x18:  /* GPIO_EVENT_MODE_REG */
         s->event = value & 0x1f;
         break;
 
-    case 0x1c:	/* GPIO_INT_EDGE_REG */
+    case 0x1c:  /* GPIO_INT_EDGE_REG */
         s->edge = value;
         break;
 
-    case 0x28:	/* KBD_MASKIT */
+    case 0x28:  /* KBD_MASKIT */
         s->kbd_mask = value & 1;
         omap_mpuio_kbd_update(s);
         break;
 
-    case 0x2c:	/* GPIO_MASKIT */
+    case 0x2c:  /* GPIO_MASKIT */
         s->mask = value;
         break;
 
-    case 0x30:	/* GPIO_DEBOUNCING_REG */
+    case 0x30:  /* GPIO_DEBOUNCING_REG */
         s->debounce = value & 0x1ff;
         break;
 
-    case 0x00:	/* INPUT_LATCH */
-    case 0x10:	/* KBR_LATCH */
-    case 0x20:	/* KBD_INT */
-    case 0x24:	/* GPIO_INT */
-    case 0x34:	/* GPIO_LATCH_REG */
+    case 0x00:  /* INPUT_LATCH */
+    case 0x10:  /* KBR_LATCH */
+    case 0x20:  /* KBD_INT */
+    case 0x24:  /* GPIO_INT */
+    case 0x34:  /* GPIO_LATCH_REG */
         OMAP_RO_REG(addr);
         return;
 
@@ -2176,24 +2176,24 @@ struct omap_uwire_s {
 
 static void omap_uwire_transfer_start(struct omap_uwire_s *s)
 {
-    int chipselect = (s->control >> 10) & 3;		/* INDEX */
+    int chipselect = (s->control >> 10) & 3;        /* INDEX */
 
-    if ((s->control >> 5) & 0x1f) {			/* NB_BITS_WR */
+    if ((s->control >> 5) & 0x1f) {         /* NB_BITS_WR */
         if (s->control & (1 << 12)) {       /* CS_CMD */
             qemu_log_mask(LOG_UNIMP, "uWireSlave TX CS:%d data:0x%04x\n",
                           chipselect,
                           s->txbuf >> (16 - ((s->control >> 5) & 0x1f)));
         }
-        s->control &= ~(1 << 14);			/* CSRB */
+        s->control &= ~(1 << 14);           /* CSRB */
         /* TODO: depending on s->setup[4] bits [1:0] assert an IRQ or
          * a DRQ.  When is the level IRQ supposed to be reset?  */
     }
 
-    if ((s->control >> 0) & 0x1f) {			/* NB_BITS_RD */
+    if ((s->control >> 0) & 0x1f) {         /* NB_BITS_RD */
         if (s->control & (1 << 12)) {       /* CS_CMD */
             qemu_log_mask(LOG_UNIMP, "uWireSlave RX CS:%d\n", chipselect);
         }
-        s->control |= 1 << 15;				/* RDRB */
+        s->control |= 1 << 15;              /* RDRB */
         /* TODO: depending on s->setup[4] bits [1:0] assert an IRQ or
          * a DRQ.  When is the level IRQ supposed to be reset?  */
     }
@@ -2209,22 +2209,22 @@ static uint64_t omap_uwire_read(void *opaque, hwaddr addr, unsigned size)
     }
 
     switch (offset) {
-    case 0x00:	/* RDR */
-        s->control &= ~(1 << 15);			/* RDRB */
+    case 0x00:  /* RDR */
+        s->control &= ~(1 << 15);           /* RDRB */
         return s->rxbuf;
 
-    case 0x04:	/* CSR */
+    case 0x04:  /* CSR */
         return s->control;
 
-    case 0x08:	/* SR1 */
+    case 0x08:  /* SR1 */
         return s->setup[0];
-    case 0x0c:	/* SR2 */
+    case 0x0c:  /* SR2 */
         return s->setup[1];
-    case 0x10:	/* SR3 */
+    case 0x10:  /* SR3 */
         return s->setup[2];
-    case 0x14:	/* SR4 */
+    case 0x14:  /* SR4 */
         return s->setup[3];
-    case 0x18:	/* SR5 */
+    case 0x18:  /* SR5 */
         return s->setup[4];
     }
 
@@ -2244,39 +2244,39 @@ static void omap_uwire_write(void *opaque, hwaddr addr,
     }
 
     switch (offset) {
-    case 0x00:	/* TDR */
-        s->txbuf = value;				/* TD */
-        if ((s->setup[4] & (1 << 2)) &&			/* AUTO_TX_EN */
-                        ((s->setup[4] & (1 << 3)) ||	/* CS_TOGGLE_TX_EN */
-                         (s->control & (1 << 12)))) {	/* CS_CMD */
-            s->control |= 1 << 14;			/* CSRB */
+    case 0x00:  /* TDR */
+        s->txbuf = value;                               /* TD */
+        if ((s->setup[4] & (1 << 2)) &&                 /* AUTO_TX_EN */
+                        ((s->setup[4] & (1 << 3)) ||    /* CS_TOGGLE_TX_EN */
+                         (s->control & (1 << 12)))) {   /* CS_CMD */
+            s->control |= 1 << 14;                      /* CSRB */
             omap_uwire_transfer_start(s);
         }
         break;
 
-    case 0x04:	/* CSR */
+    case 0x04:  /* CSR */
         s->control = value & 0x1fff;
-        if (value & (1 << 13))				/* START */
+        if (value & (1 << 13))  /* START */
             omap_uwire_transfer_start(s);
         break;
 
-    case 0x08:	/* SR1 */
+    case 0x08:  /* SR1 */
         s->setup[0] = value & 0x003f;
         break;
 
-    case 0x0c:	/* SR2 */
+    case 0x0c:  /* SR2 */
         s->setup[1] = value & 0x0fc0;
         break;
 
-    case 0x10:	/* SR3 */
+    case 0x10:  /* SR3 */
         s->setup[2] = value & 0x0003;
         break;
 
-    case 0x14:	/* SR4 */
+    case 0x14:  /* SR4 */
         s->setup[3] = value & 0x0001;
         break;
 
-    case 0x18:	/* SR5 */
+    case 0x18:  /* SR5 */
         s->setup[4] = value & 0x000f;
         break;
 
@@ -2350,9 +2350,9 @@ static uint64_t omap_pwl_read(void *opaque, hwaddr addr, unsigned size)
     }
 
     switch (offset) {
-    case 0x00:	/* PWL_LEVEL */
+    case 0x00:  /* PWL_LEVEL */
         return s->level;
-    case 0x04:	/* PWL_CTRL */
+    case 0x04:  /* PWL_CTRL */
         return s->enable;
     }
     OMAP_BAD_REG(addr);
@@ -2371,11 +2371,11 @@ static void omap_pwl_write(void *opaque, hwaddr addr,
     }
 
     switch (offset) {
-    case 0x00:	/* PWL_LEVEL */
+    case 0x00:  /* PWL_LEVEL */
         s->level = value;
         omap_pwl_update(s);
         break;
-    case 0x04:	/* PWL_CTRL */
+    case 0x04:  /* PWL_CTRL */
         s->enable = value & 1;
         omap_pwl_update(s);
         break;
@@ -2443,11 +2443,11 @@ static uint64_t omap_pwt_read(void *opaque, hwaddr addr, unsigned size)
     }
 
     switch (offset) {
-    case 0x00:	/* FRC */
+    case 0x00:  /* FRC */
         return s->frc;
-    case 0x04:	/* VCR */
+    case 0x04:  /* VCR */
         return s->vrc;
-    case 0x08:	/* GCR */
+    case 0x08:  /* GCR */
         return s->gcr;
     }
     OMAP_BAD_REG(addr);
@@ -2466,10 +2466,10 @@ static void omap_pwt_write(void *opaque, hwaddr addr,
     }
 
     switch (offset) {
-    case 0x00:	/* FRC */
+    case 0x00:  /* FRC */
         s->frc = value & 0x3f;
         break;
-    case 0x04:	/* VRC */
+    case 0x04:  /* VRC */
         if ((value ^ s->vrc) & 1) {
             if (value & 1) {
                 trace_omap1_pwt_buzz(
@@ -2494,7 +2494,7 @@ static void omap_pwt_write(void *opaque, hwaddr addr,
         }
         s->vrc = value & 0x7f;
         break;
-    case 0x08:	/* GCR */
+    case 0x08:  /* GCR */
         s->gcr = value & 3;
         break;
     default:
@@ -2577,69 +2577,69 @@ static uint64_t omap_rtc_read(void *opaque, hwaddr addr, unsigned size)
     }
 
     switch (offset) {
-    case 0x00:	/* SECONDS_REG */
+    case 0x00:  /* SECONDS_REG */
         return to_bcd(s->current_tm.tm_sec);
 
-    case 0x04:	/* MINUTES_REG */
+    case 0x04:  /* MINUTES_REG */
         return to_bcd(s->current_tm.tm_min);
 
-    case 0x08:	/* HOURS_REG */
+    case 0x08:  /* HOURS_REG */
         if (s->pm_am)
             return ((s->current_tm.tm_hour > 11) << 7) |
                     to_bcd(((s->current_tm.tm_hour - 1) % 12) + 1);
         else
             return to_bcd(s->current_tm.tm_hour);
 
-    case 0x0c:	/* DAYS_REG */
+    case 0x0c:  /* DAYS_REG */
         return to_bcd(s->current_tm.tm_mday);
 
-    case 0x10:	/* MONTHS_REG */
+    case 0x10:  /* MONTHS_REG */
         return to_bcd(s->current_tm.tm_mon + 1);
 
-    case 0x14:	/* YEARS_REG */
+    case 0x14:  /* YEARS_REG */
         return to_bcd(s->current_tm.tm_year % 100);
 
-    case 0x18:	/* WEEK_REG */
+    case 0x18:  /* WEEK_REG */
         return s->current_tm.tm_wday;
 
-    case 0x20:	/* ALARM_SECONDS_REG */
+    case 0x20:  /* ALARM_SECONDS_REG */
         return to_bcd(s->alarm_tm.tm_sec);
 
-    case 0x24:	/* ALARM_MINUTES_REG */
+    case 0x24:  /* ALARM_MINUTES_REG */
         return to_bcd(s->alarm_tm.tm_min);
 
-    case 0x28:	/* ALARM_HOURS_REG */
+    case 0x28:  /* ALARM_HOURS_REG */
         if (s->pm_am)
             return ((s->alarm_tm.tm_hour > 11) << 7) |
                     to_bcd(((s->alarm_tm.tm_hour - 1) % 12) + 1);
         else
             return to_bcd(s->alarm_tm.tm_hour);
 
-    case 0x2c:	/* ALARM_DAYS_REG */
+    case 0x2c:  /* ALARM_DAYS_REG */
         return to_bcd(s->alarm_tm.tm_mday);
 
-    case 0x30:	/* ALARM_MONTHS_REG */
+    case 0x30:  /* ALARM_MONTHS_REG */
         return to_bcd(s->alarm_tm.tm_mon + 1);
 
-    case 0x34:	/* ALARM_YEARS_REG */
+    case 0x34:  /* ALARM_YEARS_REG */
         return to_bcd(s->alarm_tm.tm_year % 100);
 
-    case 0x40:	/* RTC_CTRL_REG */
+    case 0x40:  /* RTC_CTRL_REG */
         return (s->pm_am << 3) | (s->auto_comp << 2) |
                 (s->round << 1) | s->running;
 
-    case 0x44:	/* RTC_STATUS_REG */
+    case 0x44:  /* RTC_STATUS_REG */
         i = s->status;
         s->status &= ~0x3d;
         return i;
 
-    case 0x48:	/* RTC_INTERRUPTS_REG */
+    case 0x48:  /* RTC_INTERRUPTS_REG */
         return s->interrupts;
 
-    case 0x4c:	/* RTC_COMP_LSB_REG */
+    case 0x4c:  /* RTC_COMP_LSB_REG */
         return ((uint16_t) s->comp_reg) & 0xff;
 
-    case 0x50:	/* RTC_COMP_MSB_REG */
+    case 0x50:  /* RTC_COMP_MSB_REG */
         return ((uint16_t) s->comp_reg) >> 8;
     }
 
@@ -2661,17 +2661,17 @@ static void omap_rtc_write(void *opaque, hwaddr addr,
     }
 
     switch (offset) {
-    case 0x00:	/* SECONDS_REG */
+    case 0x00:  /* SECONDS_REG */
         s->ti -= s->current_tm.tm_sec;
         s->ti += from_bcd(value);
         return;
 
-    case 0x04:	/* MINUTES_REG */
+    case 0x04:  /* MINUTES_REG */
         s->ti -= s->current_tm.tm_min * 60;
         s->ti += from_bcd(value) * 60;
         return;
 
-    case 0x08:	/* HOURS_REG */
+    case 0x08:  /* HOURS_REG */
         s->ti -= s->current_tm.tm_hour * 3600;
         if (s->pm_am) {
             s->ti += (from_bcd(value & 0x3f) & 12) * 3600;
@@ -2680,12 +2680,12 @@ static void omap_rtc_write(void *opaque, hwaddr addr,
             s->ti += from_bcd(value & 0x3f) * 3600;
         return;
 
-    case 0x0c:	/* DAYS_REG */
+    case 0x0c:  /* DAYS_REG */
         s->ti -= s->current_tm.tm_mday * 86400;
         s->ti += from_bcd(value) * 86400;
         return;
 
-    case 0x10:	/* MONTHS_REG */
+    case 0x10:  /* MONTHS_REG */
         memcpy(&new_tm, &s->current_tm, sizeof(new_tm));
         new_tm.tm_mon = from_bcd(value);
         ti[0] = mktimegm(&s->current_tm);
@@ -2701,7 +2701,7 @@ static void omap_rtc_write(void *opaque, hwaddr addr,
         }
         return;
 
-    case 0x14:	/* YEARS_REG */
+    case 0x14:  /* YEARS_REG */
         memcpy(&new_tm, &s->current_tm, sizeof(new_tm));
         new_tm.tm_year += from_bcd(value) - (new_tm.tm_year % 100);
         ti[0] = mktimegm(&s->current_tm);
@@ -2717,20 +2717,20 @@ static void omap_rtc_write(void *opaque, hwaddr addr,
         }
         return;
 
-    case 0x18:	/* WEEK_REG */
-        return;	/* Ignored */
+    case 0x18:  /* WEEK_REG */
+        return; /* Ignored */
 
-    case 0x20:	/* ALARM_SECONDS_REG */
+    case 0x20:  /* ALARM_SECONDS_REG */
         s->alarm_tm.tm_sec = from_bcd(value);
         omap_rtc_alarm_update(s);
         return;
 
-    case 0x24:	/* ALARM_MINUTES_REG */
+    case 0x24:  /* ALARM_MINUTES_REG */
         s->alarm_tm.tm_min = from_bcd(value);
         omap_rtc_alarm_update(s);
         return;
 
-    case 0x28:	/* ALARM_HOURS_REG */
+    case 0x28:  /* ALARM_HOURS_REG */
         if (s->pm_am)
             s->alarm_tm.tm_hour =
                     ((from_bcd(value & 0x3f)) % 12) +
@@ -2740,22 +2740,22 @@ static void omap_rtc_write(void *opaque, hwaddr addr,
         omap_rtc_alarm_update(s);
         return;
 
-    case 0x2c:	/* ALARM_DAYS_REG */
+    case 0x2c:  /* ALARM_DAYS_REG */
         s->alarm_tm.tm_mday = from_bcd(value);
         omap_rtc_alarm_update(s);
         return;
 
-    case 0x30:	/* ALARM_MONTHS_REG */
+    case 0x30:  /* ALARM_MONTHS_REG */
         s->alarm_tm.tm_mon = from_bcd(value);
         omap_rtc_alarm_update(s);
         return;
 
-    case 0x34:	/* ALARM_YEARS_REG */
+    case 0x34:  /* ALARM_YEARS_REG */
         s->alarm_tm.tm_year = from_bcd(value);
         omap_rtc_alarm_update(s);
         return;
 
-    case 0x40:	/* RTC_CTRL_REG */
+    case 0x40:  /* RTC_CTRL_REG */
         s->pm_am = (value >> 3) & 1;
         s->auto_comp = (value >> 2) & 1;
         s->round = (value >> 1) & 1;
@@ -2764,21 +2764,21 @@ static void omap_rtc_write(void *opaque, hwaddr addr,
         s->status |= s->running << 1;
         return;
 
-    case 0x44:	/* RTC_STATUS_REG */
+    case 0x44:  /* RTC_STATUS_REG */
         s->status &= ~((value & 0xc0) ^ 0x80);
         omap_rtc_interrupts_update(s);
         return;
 
-    case 0x48:	/* RTC_INTERRUPTS_REG */
+    case 0x48:  /* RTC_INTERRUPTS_REG */
         s->interrupts = value;
         return;
 
-    case 0x4c:	/* RTC_COMP_LSB_REG */
+    case 0x4c:  /* RTC_COMP_LSB_REG */
         s->comp_reg &= 0xff00;
         s->comp_reg |= 0x00ff & value;
         return;
 
-    case 0x50:	/* RTC_COMP_MSB_REG */
+    case 0x50:  /* RTC_COMP_MSB_REG */
         s->comp_reg &= 0x00ff;
         s->comp_reg |= 0xff00 & (value << 8);
         return;
@@ -2929,12 +2929,12 @@ static void omap_mcbsp_intr_update(struct omap_mcbsp_s *s)
 {
     int irq;
 
-    switch ((s->spcr[0] >> 4) & 3) {			/* RINTM */
+    switch ((s->spcr[0] >> 4) & 3) {            /* RINTM */
     case 0:
-        irq = (s->spcr[0] >> 1) & 1;			/* RRDY */
+        irq = (s->spcr[0] >> 1) & 1;            /* RRDY */
         break;
     case 3:
-        irq = (s->spcr[0] >> 3) & 1;			/* RSYNCERR */
+        irq = (s->spcr[0] >> 3) & 1;            /* RSYNCERR */
         break;
     default:
         irq = 0;
@@ -2944,12 +2944,12 @@ static void omap_mcbsp_intr_update(struct omap_mcbsp_s *s)
     if (irq)
         qemu_irq_pulse(s->rxirq);
 
-    switch ((s->spcr[1] >> 4) & 3) {			/* XINTM */
+    switch ((s->spcr[1] >> 4) & 3) {            /* XINTM */
     case 0:
-        irq = (s->spcr[1] >> 1) & 1;			/* XRDY */
+        irq = (s->spcr[1] >> 1) & 1;            /* XRDY */
         break;
     case 3:
-        irq = (s->spcr[1] >> 3) & 1;			/* XSYNCERR */
+        irq = (s->spcr[1] >> 3) & 1;            /* XSYNCERR */
         break;
     default:
         irq = 0;
@@ -2962,9 +2962,9 @@ static void omap_mcbsp_intr_update(struct omap_mcbsp_s *s)
 
 static void omap_mcbsp_rx_newdata(struct omap_mcbsp_s *s)
 {
-    if ((s->spcr[0] >> 1) & 1)				/* RRDY */
-        s->spcr[0] |= 1 << 2;				/* RFULL */
-    s->spcr[0] |= 1 << 1;				/* RRDY */
+    if ((s->spcr[0] >> 1) & 1)              /* RRDY */
+        s->spcr[0] |= 1 << 2;               /* RFULL */
+    s->spcr[0] |= 1 << 1;                   /* RRDY */
     qemu_irq_raise(s->rxdrq);
     omap_mcbsp_intr_update(s);
 }
@@ -3004,14 +3004,14 @@ static void omap_mcbsp_rx_stop(struct omap_mcbsp_s *s)
 
 static void omap_mcbsp_rx_done(struct omap_mcbsp_s *s)
 {
-    s->spcr[0] &= ~(1 << 1);				/* RRDY */
+    s->spcr[0] &= ~(1 << 1);                /* RRDY */
     qemu_irq_lower(s->rxdrq);
     omap_mcbsp_intr_update(s);
 }
 
 static void omap_mcbsp_tx_newdata(struct omap_mcbsp_s *s)
 {
-    s->spcr[1] |= 1 << 1;				/* XRDY */
+    s->spcr[1] |= 1 << 1;               /* XRDY */
     qemu_irq_raise(s->txdrq);
     omap_mcbsp_intr_update(s);
 }
@@ -3046,7 +3046,7 @@ static void omap_mcbsp_tx_start(struct omap_mcbsp_s *s)
 
 static void omap_mcbsp_tx_done(struct omap_mcbsp_s *s)
 {
-    s->spcr[1] &= ~(1 << 1);				/* XRDY */
+    s->spcr[1] &= ~(1 << 1);                /* XRDY */
     qemu_irq_lower(s->txdrq);
     omap_mcbsp_intr_update(s);
     if (s->codec && s->codec->cts)
@@ -3064,27 +3064,27 @@ static void omap_mcbsp_req_update(struct omap_mcbsp_s *s)
 {
     int prev_rx_rate, prev_tx_rate;
     int rx_rate = 0, tx_rate = 0;
-    int cpu_rate = 1500000;	/* XXX */
+    int cpu_rate = 1500000; /* XXX */
 
     /* TODO: check CLKSTP bit */
-    if (s->spcr[1] & (1 << 6)) {			/* GRST */
-        if (s->spcr[0] & (1 << 0)) {			/* RRST */
-            if ((s->srgr[1] & (1 << 13)) &&		/* CLKSM */
-                            (s->pcr & (1 << 8))) {	/* CLKRM */
-                if (~s->pcr & (1 << 7))			/* SCLKME */
+    if (s->spcr[1] & (1 << 6)) {                        /* GRST */
+        if (s->spcr[0] & (1 << 0)) {                    /* RRST */
+            if ((s->srgr[1] & (1 << 13)) &&             /* CLKSM */
+                            (s->pcr & (1 << 8))) {      /* CLKRM */
+                if (~s->pcr & (1 << 7))                 /* SCLKME */
                     rx_rate = cpu_rate /
-                            ((s->srgr[0] & 0xff) + 1);	/* CLKGDV */
+                            ((s->srgr[0] & 0xff) + 1);  /* CLKGDV */
             } else
                 if (s->codec)
                     rx_rate = s->codec->rx_rate;
         }
 
-        if (s->spcr[1] & (1 << 0)) {			/* XRST */
-            if ((s->srgr[1] & (1 << 13)) &&		/* CLKSM */
-                            (s->pcr & (1 << 9))) {	/* CLKXM */
-                if (~s->pcr & (1 << 7))			/* SCLKME */
+        if (s->spcr[1] & (1 << 0)) {                    /* XRST */
+            if ((s->srgr[1] & (1 << 13)) &&             /* CLKSM */
+                            (s->pcr & (1 << 9))) {      /* CLKXM */
+                if (~s->pcr & (1 << 7))                 /* SCLKME */
                     tx_rate = cpu_rate /
-                            ((s->srgr[0] & 0xff) + 1);	/* CLKGDV */
+                            ((s->srgr[0] & 0xff) + 1);  /* CLKGDV */
             } else
                 if (s->codec)
                     tx_rate = s->codec->tx_rate;
@@ -3121,11 +3121,11 @@ static uint64_t omap_mcbsp_read(void *opaque, hwaddr addr,
     }
 
     switch (offset) {
-    case 0x00:	/* DRR2 */
-        if (((s->rcr[0] >> 5) & 7) < 3)			/* RWDLEN1 */
+    case 0x00:  /* DRR2 */
+        if (((s->rcr[0] >> 5) & 7) < 3)         /* RWDLEN1 */
             return 0x0000;
         /* Fall through.  */
-    case 0x02:	/* DRR1 */
+    case 0x02:  /* DRR1 */
         if (s->rx_req < 2) {
             qemu_log_mask(LOG_GUEST_ERROR, "%s: Rx FIFO underrun\n", __func__);
             omap_mcbsp_rx_done(s);
@@ -3143,63 +3143,63 @@ static uint64_t omap_mcbsp_read(void *opaque, hwaddr addr,
         }
         return 0x0000;
 
-    case 0x04:	/* DXR2 */
-    case 0x06:	/* DXR1 */
+    case 0x04:  /* DXR2 */
+    case 0x06:  /* DXR1 */
         return 0x0000;
 
-    case 0x08:	/* SPCR2 */
+    case 0x08:  /* SPCR2 */
         return s->spcr[1];
-    case 0x0a:	/* SPCR1 */
+    case 0x0a:  /* SPCR1 */
         return s->spcr[0];
-    case 0x0c:	/* RCR2 */
+    case 0x0c:  /* RCR2 */
         return s->rcr[1];
-    case 0x0e:	/* RCR1 */
+    case 0x0e:  /* RCR1 */
         return s->rcr[0];
-    case 0x10:	/* XCR2 */
+    case 0x10:  /* XCR2 */
         return s->xcr[1];
-    case 0x12:	/* XCR1 */
+    case 0x12:  /* XCR1 */
         return s->xcr[0];
-    case 0x14:	/* SRGR2 */
+    case 0x14:  /* SRGR2 */
         return s->srgr[1];
-    case 0x16:	/* SRGR1 */
+    case 0x16:  /* SRGR1 */
         return s->srgr[0];
-    case 0x18:	/* MCR2 */
+    case 0x18:  /* MCR2 */
         return s->mcr[1];
-    case 0x1a:	/* MCR1 */
+    case 0x1a:  /* MCR1 */
         return s->mcr[0];
-    case 0x1c:	/* RCERA */
+    case 0x1c:  /* RCERA */
         return s->rcer[0];
-    case 0x1e:	/* RCERB */
+    case 0x1e:  /* RCERB */
         return s->rcer[1];
-    case 0x20:	/* XCERA */
+    case 0x20:  /* XCERA */
         return s->xcer[0];
-    case 0x22:	/* XCERB */
+    case 0x22:  /* XCERB */
         return s->xcer[1];
-    case 0x24:	/* PCR0 */
+    case 0x24:  /* PCR0 */
         return s->pcr;
-    case 0x26:	/* RCERC */
+    case 0x26:  /* RCERC */
         return s->rcer[2];
-    case 0x28:	/* RCERD */
+    case 0x28:  /* RCERD */
         return s->rcer[3];
-    case 0x2a:	/* XCERC */
+    case 0x2a:  /* XCERC */
         return s->xcer[2];
-    case 0x2c:	/* XCERD */
+    case 0x2c:  /* XCERD */
         return s->xcer[3];
-    case 0x2e:	/* RCERE */
+    case 0x2e:  /* RCERE */
         return s->rcer[4];
-    case 0x30:	/* RCERF */
+    case 0x30:  /* RCERF */
         return s->rcer[5];
-    case 0x32:	/* XCERE */
+    case 0x32:  /* XCERE */
         return s->xcer[4];
-    case 0x34:	/* XCERF */
+    case 0x34:  /* XCERF */
         return s->xcer[5];
-    case 0x36:	/* RCERG */
+    case 0x36:  /* RCERG */
         return s->rcer[6];
-    case 0x38:	/* RCERH */
+    case 0x38:  /* RCERH */
         return s->rcer[7];
-    case 0x3a:	/* XCERG */
+    case 0x3a:  /* XCERG */
         return s->xcer[6];
-    case 0x3c:	/* XCERH */
+    case 0x3c:  /* XCERH */
         return s->xcer[7];
     }
 
@@ -3214,16 +3214,16 @@ static void omap_mcbsp_writeh(void *opaque, hwaddr addr,
     int offset = addr & OMAP_MPUI_REG_MASK;
 
     switch (offset) {
-    case 0x00:	/* DRR2 */
-    case 0x02:	/* DRR1 */
+    case 0x00:  /* DRR2 */
+    case 0x02:  /* DRR1 */
         OMAP_RO_REG(addr);
         return;
 
-    case 0x04:	/* DXR2 */
-        if (((s->xcr[0] >> 5) & 7) < 3)			/* XWDLEN1 */
+    case 0x04:  /* DXR2 */
+        if (((s->xcr[0] >> 5) & 7) < 3)         /* XWDLEN1 */
             return;
         /* Fall through.  */
-    case 0x06:	/* DXR1 */
+    case 0x06:  /* DXR1 */
         if (s->tx_req > 1) {
             s->tx_req -= 2;
             if (s->codec && s->codec->cts) {
@@ -3237,15 +3237,15 @@ static void omap_mcbsp_writeh(void *opaque, hwaddr addr,
         }
         return;
 
-    case 0x08:	/* SPCR2 */
+    case 0x08:  /* SPCR2 */
         s->spcr[1] &= 0x0002;
         s->spcr[1] |= 0x03f9 & value;
-        s->spcr[1] |= 0x0004 & (value << 2);		/* XEMPTY := XRST */
-        if (~value & 1)					/* XRST */
+        s->spcr[1] |= 0x0004 & (value << 2);        /* XEMPTY := XRST */
+        if (~value & 1)                             /* XRST */
             s->spcr[1] &= ~6;
         omap_mcbsp_req_update(s);
         return;
-    case 0x0a:	/* SPCR1 */
+    case 0x0a:  /* SPCR1 */
         s->spcr[0] &= 0x0006;
         s->spcr[0] |= 0xf8f9 & value;
         if (value & (1 << 15)) {                        /* DLB */
@@ -3253,7 +3253,7 @@ static void omap_mcbsp_writeh(void *opaque, hwaddr addr,
                           "%s: Digital Loopback mode enable attempt\n",
                           __func__);
         }
-        if (~value & 1) {				/* RRST */
+        if (~value & 1) {               /* RRST */
             s->spcr[0] &= ~6;
             s->rx_req = 0;
             omap_mcbsp_rx_done(s);
@@ -3261,27 +3261,27 @@ static void omap_mcbsp_writeh(void *opaque, hwaddr addr,
         omap_mcbsp_req_update(s);
         return;
 
-    case 0x0c:	/* RCR2 */
+    case 0x0c:  /* RCR2 */
         s->rcr[1] = value & 0xffff;
         return;
-    case 0x0e:	/* RCR1 */
+    case 0x0e:  /* RCR1 */
         s->rcr[0] = value & 0x7fe0;
         return;
-    case 0x10:	/* XCR2 */
+    case 0x10:  /* XCR2 */
         s->xcr[1] = value & 0xffff;
         return;
-    case 0x12:	/* XCR1 */
+    case 0x12:  /* XCR1 */
         s->xcr[0] = value & 0x7fe0;
         return;
-    case 0x14:	/* SRGR2 */
+    case 0x14:  /* SRGR2 */
         s->srgr[1] = value & 0xffff;
         omap_mcbsp_req_update(s);
         return;
-    case 0x16:	/* SRGR1 */
+    case 0x16:  /* SRGR1 */
         s->srgr[0] = value & 0xffff;
         omap_mcbsp_req_update(s);
         return;
-    case 0x18:	/* MCR2 */
+    case 0x18:  /* MCR2 */
         s->mcr[1] = value & 0x03e3;
         if (value & 3) {                                /* XMCM */
             qemu_log_mask(LOG_UNIMP,
@@ -3289,7 +3289,7 @@ static void omap_mcbsp_writeh(void *opaque, hwaddr addr,
                           __func__);
         }
         return;
-    case 0x1a:	/* MCR1 */
+    case 0x1a:  /* MCR1 */
         s->mcr[0] = value & 0x03e1;
         if (value & 1) {                                /* RMCM */
             qemu_log_mask(LOG_UNIMP,
@@ -3297,55 +3297,55 @@ static void omap_mcbsp_writeh(void *opaque, hwaddr addr,
                           __func__);
         }
         return;
-    case 0x1c:	/* RCERA */
+    case 0x1c:  /* RCERA */
         s->rcer[0] = value & 0xffff;
         return;
-    case 0x1e:	/* RCERB */
+    case 0x1e:  /* RCERB */
         s->rcer[1] = value & 0xffff;
         return;
-    case 0x20:	/* XCERA */
+    case 0x20:  /* XCERA */
         s->xcer[0] = value & 0xffff;
         return;
-    case 0x22:	/* XCERB */
+    case 0x22:  /* XCERB */
         s->xcer[1] = value & 0xffff;
         return;
-    case 0x24:	/* PCR0 */
+    case 0x24:  /* PCR0 */
         s->pcr = value & 0x7faf;
         return;
-    case 0x26:	/* RCERC */
+    case 0x26:  /* RCERC */
         s->rcer[2] = value & 0xffff;
         return;
-    case 0x28:	/* RCERD */
+    case 0x28:  /* RCERD */
         s->rcer[3] = value & 0xffff;
         return;
-    case 0x2a:	/* XCERC */
+    case 0x2a:  /* XCERC */
         s->xcer[2] = value & 0xffff;
         return;
-    case 0x2c:	/* XCERD */
+    case 0x2c:  /* XCERD */
         s->xcer[3] = value & 0xffff;
         return;
-    case 0x2e:	/* RCERE */
+    case 0x2e:  /* RCERE */
         s->rcer[4] = value & 0xffff;
         return;
-    case 0x30:	/* RCERF */
+    case 0x30:  /* RCERF */
         s->rcer[5] = value & 0xffff;
         return;
-    case 0x32:	/* XCERE */
+    case 0x32:  /* XCERE */
         s->xcer[4] = value & 0xffff;
         return;
-    case 0x34:	/* XCERF */
+    case 0x34:  /* XCERF */
         s->xcer[5] = value & 0xffff;
         return;
-    case 0x36:	/* RCERG */
+    case 0x36:  /* RCERG */
         s->rcer[6] = value & 0xffff;
         return;
-    case 0x38:	/* RCERH */
+    case 0x38:  /* RCERH */
         s->rcer[7] = value & 0xffff;
         return;
-    case 0x3a:	/* XCERG */
+    case 0x3a:  /* XCERG */
         s->xcer[6] = value & 0xffff;
         return;
-    case 0x3c:	/* XCERH */
+    case 0x3c:  /* XCERH */
         s->xcer[7] = value & 0xffff;
         return;
     }
@@ -3359,8 +3359,8 @@ static void omap_mcbsp_writew(void *opaque, hwaddr addr,
     struct omap_mcbsp_s *s = opaque;
     int offset = addr & OMAP_MPUI_REG_MASK;
 
-    if (offset == 0x04) {				/* DXR */
-        if (((s->xcr[0] >> 5) & 7) < 3)			/* XWDLEN1 */
+    if (offset == 0x04) {                       /* DXR */
+        if (((s->xcr[0] >> 5) & 7) < 3)         /* XWDLEN1 */
             return;
         if (s->tx_req > 3) {
             s->tx_req -= 4;
@@ -3504,15 +3504,15 @@ static void omap_lpg_update(struct omap_lpg_s *s)
     int64_t on, period = 1, ticks = 1000;
     static const int per[8] = { 1, 2, 4, 8, 12, 16, 20, 24 };
 
-    if (~s->control & (1 << 6))					/* LPGRES */
+    if (~s->control & (1 << 6))                 /* LPGRES */
         on = 0;
-    else if (s->control & (1 << 7))				/* PERM_ON */
+    else if (s->control & (1 << 7))             /* PERM_ON */
         on = period;
     else {
-        period = muldiv64(ticks, per[s->control & 7],		/* PERCTRL */
+        period = muldiv64(ticks, per[s->control & 7],       /* PERCTRL */
                         256 / 32);
         on = (s->clk && s->power) ? muldiv64(ticks,
-                        per[(s->control >> 3) & 7], 256) : 0;	/* ONCTRL */
+                        per[(s->control >> 3) & 7], 256) : 0;   /* ONCTRL */
     }
 
     timer_del(s->tm);
@@ -3550,10 +3550,10 @@ static uint64_t omap_lpg_read(void *opaque, hwaddr addr, unsigned size)
     }
 
     switch (offset) {
-    case 0x00:	/* LCR */
+    case 0x00:  /* LCR */
         return s->control;
 
-    case 0x04:	/* PMR */
+    case 0x04:  /* PMR */
         return s->power;
     }
 
@@ -3573,14 +3573,14 @@ static void omap_lpg_write(void *opaque, hwaddr addr,
     }
 
     switch (offset) {
-    case 0x00:	/* LCR */
-        if (~value & (1 << 6))					/* LPGRES */
+    case 0x00:  /* LCR */
+        if (~value & (1 << 6))                  /* LPGRES */
             omap_lpg_reset(s);
         s->control = value & 0xff;
         omap_lpg_update(s);
         return;
 
-    case 0x04:	/* PMR */
+    case 0x04:  /* PMR */
         s->power = value & 0x01;
         omap_lpg_update(s);
         return;
@@ -3630,7 +3630,7 @@ static uint64_t omap_mpui_io_read(void *opaque, hwaddr addr,
         return omap_badwidth_read16(opaque, addr);
     }
 
-    if (addr == OMAP_MPUI_BASE)	/* CMR */
+    if (addr == OMAP_MPUI_BASE) /* CMR */
         return 0xfe4d;
 
     OMAP_BAD_REG(addr);
@@ -3703,25 +3703,25 @@ static const struct omap_map_s {
     const char *name;
 } omap15xx_dsp_mm[] = {
     /* Strobe 0 */
-    { 0xe1010000, 0xfffb0000, 0x800, "UART1 BT" },		/* CS0 */
-    { 0xe1010800, 0xfffb0800, 0x800, "UART2 COM" },		/* CS1 */
-    { 0xe1011800, 0xfffb1800, 0x800, "McBSP1 audio" },		/* CS3 */
-    { 0xe1012000, 0xfffb2000, 0x800, "MCSI2 communication" },	/* CS4 */
-    { 0xe1012800, 0xfffb2800, 0x800, "MCSI1 BT u-Law" },	/* CS5 */
-    { 0xe1013000, 0xfffb3000, 0x800, "uWire" },			/* CS6 */
-    { 0xe1013800, 0xfffb3800, 0x800, "I^2C" },			/* CS7 */
-    { 0xe1014000, 0xfffb4000, 0x800, "USB W2FC" },		/* CS8 */
-    { 0xe1014800, 0xfffb4800, 0x800, "RTC" },			/* CS9 */
-    { 0xe1015000, 0xfffb5000, 0x800, "MPUIO" },			/* CS10 */
-    { 0xe1015800, 0xfffb5800, 0x800, "PWL" },			/* CS11 */
-    { 0xe1016000, 0xfffb6000, 0x800, "PWT" },			/* CS12 */
-    { 0xe1017000, 0xfffb7000, 0x800, "McBSP3" },		/* CS14 */
-    { 0xe1017800, 0xfffb7800, 0x800, "MMC" },			/* CS15 */
-    { 0xe1019000, 0xfffb9000, 0x800, "32-kHz timer" },		/* CS18 */
-    { 0xe1019800, 0xfffb9800, 0x800, "UART3" },			/* CS19 */
-    { 0xe101c800, 0xfffbc800, 0x800, "TIPB switches" },		/* CS25 */
+    { 0xe1010000, 0xfffb0000, 0x800, "UART1 BT" },              /* CS0 */
+    { 0xe1010800, 0xfffb0800, 0x800, "UART2 COM" },             /* CS1 */
+    { 0xe1011800, 0xfffb1800, 0x800, "McBSP1 audio" },          /* CS3 */
+    { 0xe1012000, 0xfffb2000, 0x800, "MCSI2 communication" },   /* CS4 */
+    { 0xe1012800, 0xfffb2800, 0x800, "MCSI1 BT u-Law" },        /* CS5 */
+    { 0xe1013000, 0xfffb3000, 0x800, "uWire" },                 /* CS6 */
+    { 0xe1013800, 0xfffb3800, 0x800, "I^2C" },                  /* CS7 */
+    { 0xe1014000, 0xfffb4000, 0x800, "USB W2FC" },              /* CS8 */
+    { 0xe1014800, 0xfffb4800, 0x800, "RTC" },                   /* CS9 */
+    { 0xe1015000, 0xfffb5000, 0x800, "MPUIO" },                 /* CS10 */
+    { 0xe1015800, 0xfffb5800, 0x800, "PWL" },                   /* CS11 */
+    { 0xe1016000, 0xfffb6000, 0x800, "PWT" },                   /* CS12 */
+    { 0xe1017000, 0xfffb7000, 0x800, "McBSP3" },                /* CS14 */
+    { 0xe1017800, 0xfffb7800, 0x800, "MMC" },                   /* CS15 */
+    { 0xe1019000, 0xfffb9000, 0x800, "32-kHz timer" },          /* CS18 */
+    { 0xe1019800, 0xfffb9800, 0x800, "UART3" },                 /* CS19 */
+    { 0xe101c800, 0xfffbc800, 0x800, "TIPB switches" },         /* CS25 */
     /* Strobe 1 */
-    { 0xe101e000, 0xfffce000, 0x800, "GPIOs" },			/* CS28 */
+    { 0xe101e000, 0xfffce000, 0x800, "GPIOs" },                 /* CS28 */
 
     { 0 }
 };
@@ -4025,18 +4025,18 @@ struct omap_mpu_state_s *omap310_mpu_init(MemoryRegion *dram,
                               0xfffbd800, omap_findclk(s, "clk32-kHz"));
 
     /* Register mappings not currently implemented:
-     * MCSI2 Comm	fffb2000 - fffb27ff (not mapped on OMAP310)
-     * MCSI1 Bluetooth	fffb2800 - fffb2fff (not mapped on OMAP310)
-     * USB W2FC		fffb4000 - fffb47ff
-     * Camera Interface	fffb6800 - fffb6fff
-     * USB Host		fffba000 - fffba7ff
-     * FAC		fffba800 - fffbafff
-     * HDQ/1-Wire	fffbc000 - fffbc7ff
-     * TIPB switches	fffbc800 - fffbcfff
-     * Mailbox		fffcf000 - fffcf7ff
-     * Local bus IF	fffec100 - fffec1ff
-     * Local bus MMU	fffec200 - fffec2ff
-     * DSP MMU		fffed200 - fffed2ff
+     * MCSI2 Comm       fffb2000 - fffb27ff (not mapped on OMAP310)
+     * MCSI1 Bluetooth  fffb2800 - fffb2fff (not mapped on OMAP310)
+     * USB W2FC         fffb4000 - fffb47ff
+     * Camera Interface fffb6800 - fffb6fff
+     * USB Host         fffba000 - fffba7ff
+     * FAC              fffba800 - fffbafff
+     * HDQ/1-Wire       fffbc000 - fffbc7ff
+     * TIPB switches    fffbc800 - fffbcfff
+     * Mailbox          fffcf000 - fffcf7ff
+     * Local bus IF     fffec100 - fffec1ff
+     * Local bus MMU    fffec200 - fffec2ff
+     * DSP MMU          fffed200 - fffed2ff
      */
 
     omap_setup_dsp_mapping(system_memory, omap15xx_dsp_mm);
diff --git a/hw/arm/omap_sx1.c b/hw/arm/omap_sx1.c
index 1d89a202bb..5d4a31b7ae 100644
--- a/hw/arm/omap_sx1.c
+++ b/hw/arm/omap_sx1.c
@@ -1,7 +1,7 @@
 /* omap_sx1.c Support for the Siemens SX1 smartphone emulation.
  *
  *   Copyright (C) 2008
- * 	Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
+ *   Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
  *   Copyright (C) 2007 Vladimir Ananiev <vovan888@gmail.com>
  *
  *   based on PalmOne's (TM) PDAs support (palm.c)
diff --git a/hw/dma/omap_dma.c b/hw/dma/omap_dma.c
index 9a8c3c34a0..101f91f4a3 100644
--- a/hw/dma/omap_dma.c
+++ b/hw/dma/omap_dma.c
@@ -131,9 +131,9 @@ struct omap_dma_s {
 #define LAST_FRAME_INTR (1 << 4)
 #define END_BLOCK_INTR  (1 << 5)
 #define SYNC            (1 << 6)
-#define END_PKT_INTR	(1 << 7)
-#define TRANS_ERR_INTR	(1 << 8)
-#define MISALIGN_INTR	(1 << 11)
+#define END_PKT_INTR    (1 << 7)
+#define TRANS_ERR_INTR  (1 << 8)
+#define MISALIGN_INTR   (1 << 11)
 
 static inline void omap_dma_interrupts_update(struct omap_dma_s *s)
 {
@@ -526,12 +526,12 @@ static void omap_dma_transfer_setup(struct soc_dma_ch_s *dma)
 
     /* Check all the conditions that terminate the transfer starting
      * with those that can occur the soonest.  */
-#define INTR_CHECK(cond, id, nelements)	\
-    if (cond) {			\
-        elements[id] = nelements;	\
-        if (elements[id] < min_elems)	\
-            min_elems = elements[id];	\
-    } else				\
+#define INTR_CHECK(cond, id, nelements) \
+    if (cond) {         \
+        elements[id] = nelements;   \
+        if (elements[id] < min_elems)   \
+            min_elems = elements[id];   \
+    } else              \
         elements[id] = INT_MAX;
 
     /* Elements */
@@ -740,7 +740,7 @@ static int omap_dma_ch_reg_read(struct omap_dma_s *s,
                 struct omap_dma_channel_s *ch, int reg, uint16_t *value)
 {
     switch (reg) {
-    case 0x00:	/* SYS_DMA_CSDP_CH0 */
+    case 0x00:  /* SYS_DMA_CSDP_CH0 */
         *value = (ch->burst[1] << 14) |
                 (ch->pack[1] << 13) |
                 (ch->port[1] << 9) |
@@ -750,9 +750,9 @@ static int omap_dma_ch_reg_read(struct omap_dma_s *s,
                 (ch->data_type >> 1);
         break;
 
-    case 0x02:	/* SYS_DMA_CCR_CH0 */
+    case 0x02:  /* SYS_DMA_CCR_CH0 */
         if (s->model <= omap_dma_3_1)
-            *value = 0 << 10;			/* FIFO_FLUSH reads as 0 */
+            *value = 0 << 10;           /* FIFO_FLUSH reads as 0 */
         else
             *value = ch->omap_3_1_compatible_disable << 10;
         *value |= (ch->mode[1] << 14) |
@@ -765,11 +765,11 @@ static int omap_dma_ch_reg_read(struct omap_dma_s *s,
                 (ch->fs << 5) | ch->sync;
         break;
 
-    case 0x04:	/* SYS_DMA_CICR_CH0 */
+    case 0x04:  /* SYS_DMA_CICR_CH0 */
         *value = ch->interrupts;
         break;
 
-    case 0x06:	/* SYS_DMA_CSR_CH0 */
+    case 0x06:  /* SYS_DMA_CSR_CH0 */
         *value = ch->status;
         ch->status &= SYNC;
         if (!ch->omap_3_1_compatible_disable && ch->sibling) {
@@ -779,77 +779,77 @@ static int omap_dma_ch_reg_read(struct omap_dma_s *s,
         qemu_irq_lower(ch->irq);
         break;
 
-    case 0x08:	/* SYS_DMA_CSSA_L_CH0 */
+    case 0x08:  /* SYS_DMA_CSSA_L_CH0 */
         *value = ch->addr[0] & 0x0000ffff;
         break;
 
-    case 0x0a:	/* SYS_DMA_CSSA_U_CH0 */
+    case 0x0a:  /* SYS_DMA_CSSA_U_CH0 */
         *value = ch->addr[0] >> 16;
         break;
 
-    case 0x0c:	/* SYS_DMA_CDSA_L_CH0 */
+    case 0x0c:  /* SYS_DMA_CDSA_L_CH0 */
         *value = ch->addr[1] & 0x0000ffff;
         break;
 
-    case 0x0e:	/* SYS_DMA_CDSA_U_CH0 */
+    case 0x0e:  /* SYS_DMA_CDSA_U_CH0 */
         *value = ch->addr[1] >> 16;
         break;
 
-    case 0x10:	/* SYS_DMA_CEN_CH0 */
+    case 0x10:  /* SYS_DMA_CEN_CH0 */
         *value = ch->elements;
         break;
 
-    case 0x12:	/* SYS_DMA_CFN_CH0 */
+    case 0x12:  /* SYS_DMA_CFN_CH0 */
         *value = ch->frames;
         break;
 
-    case 0x14:	/* SYS_DMA_CFI_CH0 */
+    case 0x14:  /* SYS_DMA_CFI_CH0 */
         *value = ch->frame_index[0];
         break;
 
-    case 0x16:	/* SYS_DMA_CEI_CH0 */
+    case 0x16:  /* SYS_DMA_CEI_CH0 */
         *value = ch->element_index[0];
         break;
 
-    case 0x18:	/* SYS_DMA_CPC_CH0 or DMA_CSAC */
+    case 0x18:  /* SYS_DMA_CPC_CH0 or DMA_CSAC */
         if (ch->omap_3_1_compatible_disable)
-            *value = ch->active_set.src & 0xffff;	/* CSAC */
+            *value = ch->active_set.src & 0xffff;   /* CSAC */
         else
             *value = ch->cpc;
         break;
 
-    case 0x1a:	/* DMA_CDAC */
-        *value = ch->active_set.dest & 0xffff;	/* CDAC */
+    case 0x1a:  /* DMA_CDAC */
+        *value = ch->active_set.dest & 0xffff;  /* CDAC */
         break;
 
-    case 0x1c:	/* DMA_CDEI */
+    case 0x1c:  /* DMA_CDEI */
         *value = ch->element_index[1];
         break;
 
-    case 0x1e:	/* DMA_CDFI */
+    case 0x1e:  /* DMA_CDFI */
         *value = ch->frame_index[1];
         break;
 
-    case 0x20:	/* DMA_COLOR_L */
+    case 0x20:  /* DMA_COLOR_L */
         *value = ch->color & 0xffff;
         break;
 
-    case 0x22:	/* DMA_COLOR_U */
+    case 0x22:  /* DMA_COLOR_U */
         *value = ch->color >> 16;
         break;
 
-    case 0x24:	/* DMA_CCR2 */
+    case 0x24:  /* DMA_CCR2 */
         *value = (ch->bs << 2) |
                 (ch->transparent_copy << 1) |
                 ch->constant_fill;
         break;
 
-    case 0x28:	/* DMA_CLNK_CTRL */
+    case 0x28:  /* DMA_CLNK_CTRL */
         *value = (ch->link_enabled << 15) |
                 (ch->link_next_ch & 0xf);
         break;
 
-    case 0x2a:	/* DMA_LCH_CTRL */
+    case 0x2a:  /* DMA_LCH_CTRL */
         *value = (ch->interleave_disabled << 15) |
                 ch->type;
         break;
@@ -864,7 +864,7 @@ static int omap_dma_ch_reg_write(struct omap_dma_s *s,
                 struct omap_dma_channel_s *ch, int reg, uint16_t value)
 {
     switch (reg) {
-    case 0x00:	/* SYS_DMA_CSDP_CH0 */
+    case 0x00:  /* SYS_DMA_CSDP_CH0 */
         ch->burst[1] = (value & 0xc000) >> 14;
         ch->pack[1] = (value & 0x2000) >> 13;
         ch->port[1] = (enum omap_dma_port) ((value & 0x1e00) >> 9);
@@ -887,7 +887,7 @@ static int omap_dma_ch_reg_write(struct omap_dma_s *s,
         }
         break;
 
-    case 0x02:	/* SYS_DMA_CCR_CH0 */
+    case 0x02:  /* SYS_DMA_CCR_CH0 */
         ch->mode[1] = (omap_dma_addressing_t) ((value & 0xc000) >> 14);
         ch->mode[0] = (omap_dma_addressing_t) ((value & 0x3000) >> 12);
         ch->end_prog = (value & 0x0800) >> 11;
@@ -909,88 +909,88 @@ static int omap_dma_ch_reg_write(struct omap_dma_s *s,
 
         break;
 
-    case 0x04:	/* SYS_DMA_CICR_CH0 */
+    case 0x04:  /* SYS_DMA_CICR_CH0 */
         ch->interrupts = value & 0x3f;
         break;
 
-    case 0x06:	/* SYS_DMA_CSR_CH0 */
+    case 0x06:  /* SYS_DMA_CSR_CH0 */
         OMAP_RO_REG((hwaddr) reg);
         break;
 
-    case 0x08:	/* SYS_DMA_CSSA_L_CH0 */
+    case 0x08:  /* SYS_DMA_CSSA_L_CH0 */
         ch->addr[0] &= 0xffff0000;
         ch->addr[0] |= value;
         break;
 
-    case 0x0a:	/* SYS_DMA_CSSA_U_CH0 */
+    case 0x0a:  /* SYS_DMA_CSSA_U_CH0 */
         ch->addr[0] &= 0x0000ffff;
         ch->addr[0] |= (uint32_t) value << 16;
         break;
 
-    case 0x0c:	/* SYS_DMA_CDSA_L_CH0 */
+    case 0x0c:  /* SYS_DMA_CDSA_L_CH0 */
         ch->addr[1] &= 0xffff0000;
         ch->addr[1] |= value;
         break;
 
-    case 0x0e:	/* SYS_DMA_CDSA_U_CH0 */
+    case 0x0e:  /* SYS_DMA_CDSA_U_CH0 */
         ch->addr[1] &= 0x0000ffff;
         ch->addr[1] |= (uint32_t) value << 16;
         break;
 
-    case 0x10:	/* SYS_DMA_CEN_CH0 */
+    case 0x10:  /* SYS_DMA_CEN_CH0 */
         ch->elements = value;
         break;
 
-    case 0x12:	/* SYS_DMA_CFN_CH0 */
+    case 0x12:  /* SYS_DMA_CFN_CH0 */
         ch->frames = value;
         break;
 
-    case 0x14:	/* SYS_DMA_CFI_CH0 */
+    case 0x14:  /* SYS_DMA_CFI_CH0 */
         ch->frame_index[0] = (int16_t) value;
         break;
 
-    case 0x16:	/* SYS_DMA_CEI_CH0 */
+    case 0x16:  /* SYS_DMA_CEI_CH0 */
         ch->element_index[0] = (int16_t) value;
         break;
 
-    case 0x18:	/* SYS_DMA_CPC_CH0 or DMA_CSAC */
+    case 0x18:  /* SYS_DMA_CPC_CH0 or DMA_CSAC */
         OMAP_RO_REG((hwaddr) reg);
         break;
 
-    case 0x1c:	/* DMA_CDEI */
+    case 0x1c:  /* DMA_CDEI */
         ch->element_index[1] = (int16_t) value;
         break;
 
-    case 0x1e:	/* DMA_CDFI */
+    case 0x1e:  /* DMA_CDFI */
         ch->frame_index[1] = (int16_t) value;
         break;
 
-    case 0x20:	/* DMA_COLOR_L */
+    case 0x20:  /* DMA_COLOR_L */
         ch->color &= 0xffff0000;
         ch->color |= value;
         break;
 
-    case 0x22:	/* DMA_COLOR_U */
+    case 0x22:  /* DMA_COLOR_U */
         ch->color &= 0xffff;
         ch->color |= (uint32_t)value << 16;
         break;
 
-    case 0x24:	/* DMA_CCR2 */
+    case 0x24:  /* DMA_CCR2 */
         ch->bs = (value >> 2) & 0x1;
         ch->transparent_copy = (value >> 1) & 0x1;
         ch->constant_fill = value & 0x1;
         break;
 
-    case 0x28:	/* DMA_CLNK_CTRL */
+    case 0x28:  /* DMA_CLNK_CTRL */
         ch->link_enabled = (value >> 15) & 0x1;
-        if (value & (1 << 14)) {			/* Stop_Lnk */
+        if (value & (1 << 14)) {            /* Stop_Lnk */
             ch->link_enabled = 0;
             omap_dma_disable_channel(s, ch);
         }
         ch->link_next_ch = value & 0x1f;
         break;
 
-    case 0x2a:	/* DMA_LCH_CTRL */
+    case 0x2a:  /* DMA_LCH_CTRL */
         ch->interleave_disabled = (value >> 15) & 0x1;
         ch->type = value & 0xf;
         break;
@@ -1005,7 +1005,7 @@ static int omap_dma_3_2_lcd_write(struct omap_dma_lcd_channel_s *s, int offset,
                 uint16_t value)
 {
     switch (offset) {
-    case 0xbc0:	/* DMA_LCD_CSDP */
+    case 0xbc0: /* DMA_LCD_CSDP */
         s->brust_f2 = (value >> 14) & 0x3;
         s->pack_f2 = (value >> 13) & 0x1;
         s->data_type_f2 = (1 << ((value >> 11) & 0x3));
@@ -1014,7 +1014,7 @@ static int omap_dma_3_2_lcd_write(struct omap_dma_lcd_channel_s *s, int offset,
         s->data_type_f1 = (1 << ((value >> 0) & 0x3));
         break;
 
-    case 0xbc2:	/* DMA_LCD_CCR */
+    case 0xbc2: /* DMA_LCD_CCR */
         s->mode_f2 = (value >> 14) & 0x3;
         s->mode_f1 = (value >> 12) & 0x3;
         s->end_prog = (value >> 11) & 0x1;
@@ -1026,7 +1026,7 @@ static int omap_dma_3_2_lcd_write(struct omap_dma_lcd_channel_s *s, int offset,
         s->bs = (value >> 4) & 0x1;
         break;
 
-    case 0xbc4:	/* DMA_LCD_CTRL */
+    case 0xbc4: /* DMA_LCD_CTRL */
         s->dst = (value >> 8) & 0x1;
         s->src = ((value >> 6) & 0x3) << 1;
         s->condition = 0;
@@ -1035,91 +1035,91 @@ static int omap_dma_3_2_lcd_write(struct omap_dma_lcd_channel_s *s, int offset,
         s->dual = value & 1;
         break;
 
-    case 0xbc8:	/* TOP_B1_L */
+    case 0xbc8: /* TOP_B1_L */
         s->src_f1_top &= 0xffff0000;
         s->src_f1_top |= 0x0000ffff & value;
         break;
 
-    case 0xbca:	/* TOP_B1_U */
+    case 0xbca: /* TOP_B1_U */
         s->src_f1_top &= 0x0000ffff;
         s->src_f1_top |= (uint32_t)value << 16;
         break;
 
-    case 0xbcc:	/* BOT_B1_L */
+    case 0xbcc: /* BOT_B1_L */
         s->src_f1_bottom &= 0xffff0000;
         s->src_f1_bottom |= 0x0000ffff & value;
         break;
 
-    case 0xbce:	/* BOT_B1_U */
+    case 0xbce: /* BOT_B1_U */
         s->src_f1_bottom &= 0x0000ffff;
         s->src_f1_bottom |= (uint32_t) value << 16;
         break;
 
-    case 0xbd0:	/* TOP_B2_L */
+    case 0xbd0: /* TOP_B2_L */
         s->src_f2_top &= 0xffff0000;
         s->src_f2_top |= 0x0000ffff & value;
         break;
 
-    case 0xbd2:	/* TOP_B2_U */
+    case 0xbd2: /* TOP_B2_U */
         s->src_f2_top &= 0x0000ffff;
         s->src_f2_top |= (uint32_t) value << 16;
         break;
 
-    case 0xbd4:	/* BOT_B2_L */
+    case 0xbd4: /* BOT_B2_L */
         s->src_f2_bottom &= 0xffff0000;
         s->src_f2_bottom |= 0x0000ffff & value;
         break;
 
-    case 0xbd6:	/* BOT_B2_U */
+    case 0xbd6: /* BOT_B2_U */
         s->src_f2_bottom &= 0x0000ffff;
         s->src_f2_bottom |= (uint32_t) value << 16;
         break;
 
-    case 0xbd8:	/* DMA_LCD_SRC_EI_B1 */
+    case 0xbd8: /* DMA_LCD_SRC_EI_B1 */
         s->element_index_f1 = value;
         break;
 
-    case 0xbda:	/* DMA_LCD_SRC_FI_B1_L */
+    case 0xbda: /* DMA_LCD_SRC_FI_B1_L */
         s->frame_index_f1 &= 0xffff0000;
         s->frame_index_f1 |= 0x0000ffff & value;
         break;
 
-    case 0xbf4:	/* DMA_LCD_SRC_FI_B1_U */
+    case 0xbf4: /* DMA_LCD_SRC_FI_B1_U */
         s->frame_index_f1 &= 0x0000ffff;
         s->frame_index_f1 |= (uint32_t) value << 16;
         break;
 
-    case 0xbdc:	/* DMA_LCD_SRC_EI_B2 */
+    case 0xbdc: /* DMA_LCD_SRC_EI_B2 */
         s->element_index_f2 = value;
         break;
 
-    case 0xbde:	/* DMA_LCD_SRC_FI_B2_L */
+    case 0xbde: /* DMA_LCD_SRC_FI_B2_L */
         s->frame_index_f2 &= 0xffff0000;
         s->frame_index_f2 |= 0x0000ffff & value;
         break;
 
-    case 0xbf6:	/* DMA_LCD_SRC_FI_B2_U */
+    case 0xbf6: /* DMA_LCD_SRC_FI_B2_U */
         s->frame_index_f2 &= 0x0000ffff;
         s->frame_index_f2 |= (uint32_t) value << 16;
         break;
 
-    case 0xbe0:	/* DMA_LCD_SRC_EN_B1 */
+    case 0xbe0: /* DMA_LCD_SRC_EN_B1 */
         s->elements_f1 = value;
         break;
 
-    case 0xbe4:	/* DMA_LCD_SRC_FN_B1 */
+    case 0xbe4: /* DMA_LCD_SRC_FN_B1 */
         s->frames_f1 = value;
         break;
 
-    case 0xbe2:	/* DMA_LCD_SRC_EN_B2 */
+    case 0xbe2: /* DMA_LCD_SRC_EN_B2 */
         s->elements_f2 = value;
         break;
 
-    case 0xbe6:	/* DMA_LCD_SRC_FN_B2 */
+    case 0xbe6: /* DMA_LCD_SRC_FN_B2 */
         s->frames_f2 = value;
         break;
 
-    case 0xbea:	/* DMA_LCD_LCH_CTRL */
+    case 0xbea: /* DMA_LCD_LCH_CTRL */
         s->lch_type = value & 0xf;
         break;
 
@@ -1133,7 +1133,7 @@ static int omap_dma_3_2_lcd_read(struct omap_dma_lcd_channel_s *s, int offset,
                 uint16_t *ret)
 {
     switch (offset) {
-    case 0xbc0:	/* DMA_LCD_CSDP */
+    case 0xbc0: /* DMA_LCD_CSDP */
         *ret = (s->brust_f2 << 14) |
             (s->pack_f2 << 13) |
             ((s->data_type_f2 >> 1) << 11) |
@@ -1142,7 +1142,7 @@ static int omap_dma_3_2_lcd_read(struct omap_dma_lcd_channel_s *s, int offset,
             ((s->data_type_f1 >> 1) << 0);
         break;
 
-    case 0xbc2:	/* DMA_LCD_CCR */
+    case 0xbc2: /* DMA_LCD_CCR */
         *ret = (s->mode_f2 << 14) |
             (s->mode_f1 << 12) |
             (s->end_prog << 11) |
@@ -1154,7 +1154,7 @@ static int omap_dma_3_2_lcd_read(struct omap_dma_lcd_channel_s *s, int offset,
             (s->bs << 4);
         break;
 
-    case 0xbc4:	/* DMA_LCD_CTRL */
+    case 0xbc4: /* DMA_LCD_CTRL */
         qemu_irq_lower(s->irq);
         *ret = (s->dst << 8) |
             ((s->src & 0x6) << 5) |
@@ -1163,79 +1163,79 @@ static int omap_dma_3_2_lcd_read(struct omap_dma_lcd_channel_s *s, int offset,
             s->dual;
         break;
 
-    case 0xbc8:	/* TOP_B1_L */
+    case 0xbc8: /* TOP_B1_L */
         *ret = s->src_f1_top & 0xffff;
         break;
 
-    case 0xbca:	/* TOP_B1_U */
+    case 0xbca: /* TOP_B1_U */
         *ret = s->src_f1_top >> 16;
         break;
 
-    case 0xbcc:	/* BOT_B1_L */
+    case 0xbcc: /* BOT_B1_L */
         *ret = s->src_f1_bottom & 0xffff;
         break;
 
-    case 0xbce:	/* BOT_B1_U */
+    case 0xbce: /* BOT_B1_U */
         *ret = s->src_f1_bottom >> 16;
         break;
 
-    case 0xbd0:	/* TOP_B2_L */
+    case 0xbd0: /* TOP_B2_L */
         *ret = s->src_f2_top & 0xffff;
         break;
 
-    case 0xbd2:	/* TOP_B2_U */
+    case 0xbd2: /* TOP_B2_U */
         *ret = s->src_f2_top >> 16;
         break;
 
-    case 0xbd4:	/* BOT_B2_L */
+    case 0xbd4: /* BOT_B2_L */
         *ret = s->src_f2_bottom & 0xffff;
         break;
 
-    case 0xbd6:	/* BOT_B2_U */
+    case 0xbd6: /* BOT_B2_U */
         *ret = s->src_f2_bottom >> 16;
         break;
 
-    case 0xbd8:	/* DMA_LCD_SRC_EI_B1 */
+    case 0xbd8: /* DMA_LCD_SRC_EI_B1 */
         *ret = s->element_index_f1;
         break;
 
-    case 0xbda:	/* DMA_LCD_SRC_FI_B1_L */
+    case 0xbda: /* DMA_LCD_SRC_FI_B1_L */
         *ret = s->frame_index_f1 & 0xffff;
         break;
 
-    case 0xbf4:	/* DMA_LCD_SRC_FI_B1_U */
+    case 0xbf4: /* DMA_LCD_SRC_FI_B1_U */
         *ret = s->frame_index_f1 >> 16;
         break;
 
-    case 0xbdc:	/* DMA_LCD_SRC_EI_B2 */
+    case 0xbdc: /* DMA_LCD_SRC_EI_B2 */
         *ret = s->element_index_f2;
         break;
 
-    case 0xbde:	/* DMA_LCD_SRC_FI_B2_L */
+    case 0xbde: /* DMA_LCD_SRC_FI_B2_L */
         *ret = s->frame_index_f2 & 0xffff;
         break;
 
-    case 0xbf6:	/* DMA_LCD_SRC_FI_B2_U */
+    case 0xbf6: /* DMA_LCD_SRC_FI_B2_U */
         *ret = s->frame_index_f2 >> 16;
         break;
 
-    case 0xbe0:	/* DMA_LCD_SRC_EN_B1 */
+    case 0xbe0: /* DMA_LCD_SRC_EN_B1 */
         *ret = s->elements_f1;
         break;
 
-    case 0xbe4:	/* DMA_LCD_SRC_FN_B1 */
+    case 0xbe4: /* DMA_LCD_SRC_FN_B1 */
         *ret = s->frames_f1;
         break;
 
-    case 0xbe2:	/* DMA_LCD_SRC_EN_B2 */
+    case 0xbe2: /* DMA_LCD_SRC_EN_B2 */
         *ret = s->elements_f2;
         break;
 
-    case 0xbe6:	/* DMA_LCD_SRC_FN_B2 */
+    case 0xbe6: /* DMA_LCD_SRC_FN_B2 */
         *ret = s->frames_f2;
         break;
 
-    case 0xbea:	/* DMA_LCD_LCH_CTRL */
+    case 0xbea: /* DMA_LCD_LCH_CTRL */
         *ret = s->lch_type;
         break;
 
@@ -1249,7 +1249,7 @@ static int omap_dma_3_1_lcd_write(struct omap_dma_lcd_channel_s *s, int offset,
                 uint16_t value)
 {
     switch (offset) {
-    case 0x300:	/* SYS_DMA_LCD_CTRL */
+    case 0x300: /* SYS_DMA_LCD_CTRL */
         s->src = (value & 0x40) ? imif : emiff;
         s->condition = 0;
         /* Assume no bus errors and thus no BUS_ERROR irq bits.  */
@@ -1257,42 +1257,42 @@ static int omap_dma_3_1_lcd_write(struct omap_dma_lcd_channel_s *s, int offset,
         s->dual = value & 1;
         break;
 
-    case 0x302:	/* SYS_DMA_LCD_TOP_F1_L */
+    case 0x302: /* SYS_DMA_LCD_TOP_F1_L */
         s->src_f1_top &= 0xffff0000;
         s->src_f1_top |= 0x0000ffff & value;
         break;
 
-    case 0x304:	/* SYS_DMA_LCD_TOP_F1_U */
+    case 0x304: /* SYS_DMA_LCD_TOP_F1_U */
         s->src_f1_top &= 0x0000ffff;
         s->src_f1_top |= (uint32_t)value << 16;
         break;
 
-    case 0x306:	/* SYS_DMA_LCD_BOT_F1_L */
+    case 0x306: /* SYS_DMA_LCD_BOT_F1_L */
         s->src_f1_bottom &= 0xffff0000;
         s->src_f1_bottom |= 0x0000ffff & value;
         break;
 
-    case 0x308:	/* SYS_DMA_LCD_BOT_F1_U */
+    case 0x308: /* SYS_DMA_LCD_BOT_F1_U */
         s->src_f1_bottom &= 0x0000ffff;
         s->src_f1_bottom |= (uint32_t)value << 16;
         break;
 
-    case 0x30a:	/* SYS_DMA_LCD_TOP_F2_L */
+    case 0x30a: /* SYS_DMA_LCD_TOP_F2_L */
         s->src_f2_top &= 0xffff0000;
         s->src_f2_top |= 0x0000ffff & value;
         break;
 
-    case 0x30c:	/* SYS_DMA_LCD_TOP_F2_U */
+    case 0x30c: /* SYS_DMA_LCD_TOP_F2_U */
         s->src_f2_top &= 0x0000ffff;
         s->src_f2_top |= (uint32_t)value << 16;
         break;
 
-    case 0x30e:	/* SYS_DMA_LCD_BOT_F2_L */
+    case 0x30e: /* SYS_DMA_LCD_BOT_F2_L */
         s->src_f2_bottom &= 0xffff0000;
         s->src_f2_bottom |= 0x0000ffff & value;
         break;
 
-    case 0x310:	/* SYS_DMA_LCD_BOT_F2_U */
+    case 0x310: /* SYS_DMA_LCD_BOT_F2_U */
         s->src_f2_bottom &= 0x0000ffff;
         s->src_f2_bottom |= (uint32_t)value << 16;
         break;
@@ -1309,7 +1309,7 @@ static int omap_dma_3_1_lcd_read(struct omap_dma_lcd_channel_s *s, int offset,
     int i;
 
     switch (offset) {
-    case 0x300:	/* SYS_DMA_LCD_CTRL */
+    case 0x300: /* SYS_DMA_LCD_CTRL */
         i = s->condition;
         s->condition = 0;
         qemu_irq_lower(s->irq);
@@ -1317,35 +1317,35 @@ static int omap_dma_3_1_lcd_read(struct omap_dma_lcd_channel_s *s, int offset,
                 (s->interrupts << 1) | s->dual;
         break;
 
-    case 0x302:	/* SYS_DMA_LCD_TOP_F1_L */
+    case 0x302: /* SYS_DMA_LCD_TOP_F1_L */
         *ret = s->src_f1_top & 0xffff;
         break;
 
-    case 0x304:	/* SYS_DMA_LCD_TOP_F1_U */
+    case 0x304: /* SYS_DMA_LCD_TOP_F1_U */
         *ret = s->src_f1_top >> 16;
         break;
 
-    case 0x306:	/* SYS_DMA_LCD_BOT_F1_L */
+    case 0x306: /* SYS_DMA_LCD_BOT_F1_L */
         *ret = s->src_f1_bottom & 0xffff;
         break;
 
-    case 0x308:	/* SYS_DMA_LCD_BOT_F1_U */
+    case 0x308: /* SYS_DMA_LCD_BOT_F1_U */
         *ret = s->src_f1_bottom >> 16;
         break;
 
-    case 0x30a:	/* SYS_DMA_LCD_TOP_F2_L */
+    case 0x30a: /* SYS_DMA_LCD_TOP_F2_L */
         *ret = s->src_f2_top & 0xffff;
         break;
 
-    case 0x30c:	/* SYS_DMA_LCD_TOP_F2_U */
+    case 0x30c: /* SYS_DMA_LCD_TOP_F2_U */
         *ret = s->src_f2_top >> 16;
         break;
 
-    case 0x30e:	/* SYS_DMA_LCD_BOT_F2_L */
+    case 0x30e: /* SYS_DMA_LCD_BOT_F2_L */
         *ret = s->src_f2_bottom & 0xffff;
         break;
 
-    case 0x310:	/* SYS_DMA_LCD_BOT_F2_U */
+    case 0x310: /* SYS_DMA_LCD_BOT_F2_U */
         *ret = s->src_f2_bottom >> 16;
         break;
 
@@ -1358,18 +1358,18 @@ static int omap_dma_3_1_lcd_read(struct omap_dma_lcd_channel_s *s, int offset,
 static int omap_dma_sys_write(struct omap_dma_s *s, int offset, uint16_t value)
 {
     switch (offset) {
-    case 0x400:	/* SYS_DMA_GCR */
+    case 0x400: /* SYS_DMA_GCR */
         s->gcr = value;
         break;
 
-    case 0x404:	/* DMA_GSCR */
+    case 0x404: /* DMA_GSCR */
         if (value & 0x8)
             omap_dma_disable_3_1_mapping(s);
         else
             omap_dma_enable_3_1_mapping(s);
         break;
 
-    case 0x408:	/* DMA_GRST */
+    case 0x408: /* DMA_GRST */
         if (value & 0x1)
             omap_dma_reset(s->dma);
         break;
@@ -1384,57 +1384,57 @@ static int omap_dma_sys_read(struct omap_dma_s *s, int offset,
                 uint16_t *ret)
 {
     switch (offset) {
-    case 0x400:	/* SYS_DMA_GCR */
+    case 0x400: /* SYS_DMA_GCR */
         *ret = s->gcr;
         break;
 
-    case 0x404:	/* DMA_GSCR */
+    case 0x404: /* DMA_GSCR */
         *ret = s->omap_3_1_mapping_disabled << 3;
         break;
 
-    case 0x408:	/* DMA_GRST */
+    case 0x408: /* DMA_GRST */
         *ret = 0;
         break;
 
-    case 0x442:	/* DMA_HW_ID */
-    case 0x444:	/* DMA_PCh2_ID */
-    case 0x446:	/* DMA_PCh0_ID */
-    case 0x448:	/* DMA_PCh1_ID */
-    case 0x44a:	/* DMA_PChG_ID */
-    case 0x44c:	/* DMA_PChD_ID */
+    case 0x442: /* DMA_HW_ID */
+    case 0x444: /* DMA_PCh2_ID */
+    case 0x446: /* DMA_PCh0_ID */
+    case 0x448: /* DMA_PCh1_ID */
+    case 0x44a: /* DMA_PChG_ID */
+    case 0x44c: /* DMA_PChD_ID */
         *ret = 1;
         break;
 
-    case 0x44e:	/* DMA_CAPS_0_U */
+    case 0x44e: /* DMA_CAPS_0_U */
         *ret = (s->caps[0] >> 16) & 0xffff;
         break;
-    case 0x450:	/* DMA_CAPS_0_L */
+    case 0x450: /* DMA_CAPS_0_L */
         *ret = (s->caps[0] >>  0) & 0xffff;
         break;
 
-    case 0x452:	/* DMA_CAPS_1_U */
+    case 0x452: /* DMA_CAPS_1_U */
         *ret = (s->caps[1] >> 16) & 0xffff;
         break;
-    case 0x454:	/* DMA_CAPS_1_L */
+    case 0x454: /* DMA_CAPS_1_L */
         *ret = (s->caps[1] >>  0) & 0xffff;
         break;
 
-    case 0x456:	/* DMA_CAPS_2 */
+    case 0x456: /* DMA_CAPS_2 */
         *ret = s->caps[2];
         break;
 
-    case 0x458:	/* DMA_CAPS_3 */
+    case 0x458: /* DMA_CAPS_3 */
         *ret = s->caps[3];
         break;
 
-    case 0x45a:	/* DMA_CAPS_4 */
+    case 0x45a: /* DMA_CAPS_4 */
         *ret = s->caps[4];
         break;
 
-    case 0x460:	/* DMA_PCh2_SR */
-    case 0x480:	/* DMA_PCh0_SR */
-    case 0x482:	/* DMA_PCh1_SR */
-    case 0x4c0:	/* DMA_PChD_SR_0 */
+    case 0x460: /* DMA_PCh2_SR */
+    case 0x480: /* DMA_PCh0_SR */
+    case 0x482: /* DMA_PCh1_SR */
+    case 0x4c0: /* DMA_PChD_SR_0 */
         qemu_log_mask(LOG_UNIMP,
                       "%s: Physical Channel Status Registers not implemented\n",
                       __func__);
@@ -1582,38 +1582,38 @@ static void omap_dma_setcaps(struct omap_dma_s *s)
     case omap_dma_3_2:
         /* XXX Only available for sDMA */
         s->caps[0] =
-                (1 << 19) |	/* Constant Fill Capability */
-                (1 << 18);	/* Transparent BLT Capability */
+                (1 << 19) | /* Constant Fill Capability */
+                (1 << 18);  /* Transparent BLT Capability */
         s->caps[1] =
-                (1 << 1);	/* 1-bit palettized capability (DMA 3.2 only) */
+                (1 << 1);   /* 1-bit palettized capability (DMA 3.2 only) */
         s->caps[2] =
-                (1 << 8) |	/* SEPARATE_SRC_AND_DST_INDEX_CPBLTY */
-                (1 << 7) |	/* DST_DOUBLE_INDEX_ADRS_CPBLTY */
-                (1 << 6) |	/* DST_SINGLE_INDEX_ADRS_CPBLTY */
-                (1 << 5) |	/* DST_POST_INCRMNT_ADRS_CPBLTY */
-                (1 << 4) |	/* DST_CONST_ADRS_CPBLTY */
-                (1 << 3) |	/* SRC_DOUBLE_INDEX_ADRS_CPBLTY */
-                (1 << 2) |	/* SRC_SINGLE_INDEX_ADRS_CPBLTY */
-                (1 << 1) |	/* SRC_POST_INCRMNT_ADRS_CPBLTY */
-                (1 << 0);	/* SRC_CONST_ADRS_CPBLTY */
+                (1 << 8) |  /* SEPARATE_SRC_AND_DST_INDEX_CPBLTY */
+                (1 << 7) |  /* DST_DOUBLE_INDEX_ADRS_CPBLTY */
+                (1 << 6) |  /* DST_SINGLE_INDEX_ADRS_CPBLTY */
+                (1 << 5) |  /* DST_POST_INCRMNT_ADRS_CPBLTY */
+                (1 << 4) |  /* DST_CONST_ADRS_CPBLTY */
+                (1 << 3) |  /* SRC_DOUBLE_INDEX_ADRS_CPBLTY */
+                (1 << 2) |  /* SRC_SINGLE_INDEX_ADRS_CPBLTY */
+                (1 << 1) |  /* SRC_POST_INCRMNT_ADRS_CPBLTY */
+                (1 << 0);   /* SRC_CONST_ADRS_CPBLTY */
         s->caps[3] =
-                (1 << 6) |	/* BLOCK_SYNCHR_CPBLTY (DMA 4 only) */
-                (1 << 7) |	/* PKT_SYNCHR_CPBLTY (DMA 4 only) */
-                (1 << 5) |	/* CHANNEL_CHAINING_CPBLTY */
-                (1 << 4) |	/* LCh_INTERLEAVE_CPBLTY */
-                (1 << 3) |	/* AUTOINIT_REPEAT_CPBLTY (DMA 3.2 only) */
-                (1 << 2) |	/* AUTOINIT_ENDPROG_CPBLTY (DMA 3.2 only) */
-                (1 << 1) |	/* FRAME_SYNCHR_CPBLTY */
-                (1 << 0);	/* ELMNT_SYNCHR_CPBLTY */
+                (1 << 6) |  /* BLOCK_SYNCHR_CPBLTY (DMA 4 only) */
+                (1 << 7) |  /* PKT_SYNCHR_CPBLTY (DMA 4 only) */
+                (1 << 5) |  /* CHANNEL_CHAINING_CPBLTY */
+                (1 << 4) |  /* LCh_INTERLEAVE_CPBLTY */
+                (1 << 3) |  /* AUTOINIT_REPEAT_CPBLTY (DMA 3.2 only) */
+                (1 << 2) |  /* AUTOINIT_ENDPROG_CPBLTY (DMA 3.2 only) */
+                (1 << 1) |  /* FRAME_SYNCHR_CPBLTY */
+                (1 << 0);   /* ELMNT_SYNCHR_CPBLTY */
         s->caps[4] =
-                (1 << 7) |	/* PKT_INTERRUPT_CPBLTY (DMA 4 only) */
-                (1 << 6) |	/* SYNC_STATUS_CPBLTY */
-                (1 << 5) |	/* BLOCK_INTERRUPT_CPBLTY */
-                (1 << 4) |	/* LAST_FRAME_INTERRUPT_CPBLTY */
-                (1 << 3) |	/* FRAME_INTERRUPT_CPBLTY */
-                (1 << 2) |	/* HALF_FRAME_INTERRUPT_CPBLTY */
-                (1 << 1) |	/* EVENT_DROP_INTERRUPT_CPBLTY */
-                (1 << 0);	/* TIMEOUT_INTERRUPT_CPBLTY (DMA 3.2 only) */
+                (1 << 7) |  /* PKT_INTERRUPT_CPBLTY (DMA 4 only) */
+                (1 << 6) |  /* SYNC_STATUS_CPBLTY */
+                (1 << 5) |  /* BLOCK_INTERRUPT_CPBLTY */
+                (1 << 4) |  /* LAST_FRAME_INTERRUPT_CPBLTY */
+                (1 << 3) |  /* FRAME_INTERRUPT_CPBLTY */
+                (1 << 2) |  /* HALF_FRAME_INTERRUPT_CPBLTY */
+                (1 << 1) |  /* EVENT_DROP_INTERRUPT_CPBLTY */
+                (1 << 0);   /* TIMEOUT_INTERRUPT_CPBLTY (DMA 3.2 only) */
         break;
     }
 }
diff --git a/hw/gpio/omap_gpio.c b/hw/gpio/omap_gpio.c
index 61ea7862af..f27806b774 100644
--- a/hw/gpio/omap_gpio.c
+++ b/hw/gpio/omap_gpio.c
@@ -80,25 +80,25 @@ static uint64_t omap_gpio_read(void *opaque, hwaddr addr,
     }
 
     switch (offset) {
-    case 0x00:	/* DATA_INPUT */
+    case 0x00:  /* DATA_INPUT */
         return s->inputs & s->pins;
 
-    case 0x04:	/* DATA_OUTPUT */
+    case 0x04:  /* DATA_OUTPUT */
         return s->outputs;
 
-    case 0x08:	/* DIRECTION_CONTROL */
+    case 0x08:  /* DIRECTION_CONTROL */
         return s->dir;
 
-    case 0x0c:	/* INTERRUPT_CONTROL */
+    case 0x0c:  /* INTERRUPT_CONTROL */
         return s->edge;
 
-    case 0x10:	/* INTERRUPT_MASK */
+    case 0x10:  /* INTERRUPT_MASK */
         return s->mask;
 
-    case 0x14:	/* INTERRUPT_STATUS */
+    case 0x14:  /* INTERRUPT_STATUS */
         return s->ints;
 
-    case 0x18:	/* PIN_CONTROL (not in OMAP310) */
+    case 0x18:  /* PIN_CONTROL (not in OMAP310) */
         OMAP_BAD_REG(addr);
         return s->pins;
     }
@@ -121,11 +121,11 @@ static void omap_gpio_write(void *opaque, hwaddr addr,
     }
 
     switch (offset) {
-    case 0x00:	/* DATA_INPUT */
+    case 0x00:  /* DATA_INPUT */
         OMAP_RO_REG(addr);
         return;
 
-    case 0x04:	/* DATA_OUTPUT */
+    case 0x04:  /* DATA_OUTPUT */
         diff = (s->outputs ^ value) & ~s->dir;
         s->outputs = value;
         while ((ln = ctz32(diff)) != 32) {
@@ -135,7 +135,7 @@ static void omap_gpio_write(void *opaque, hwaddr addr,
         }
         break;
 
-    case 0x08:	/* DIRECTION_CONTROL */
+    case 0x08:  /* DIRECTION_CONTROL */
         diff = s->outputs & (s->dir ^ value);
         s->dir = value;
 
@@ -147,21 +147,21 @@ static void omap_gpio_write(void *opaque, hwaddr addr,
         }
         break;
 
-    case 0x0c:	/* INTERRUPT_CONTROL */
+    case 0x0c:  /* INTERRUPT_CONTROL */
         s->edge = value;
         break;
 
-    case 0x10:	/* INTERRUPT_MASK */
+    case 0x10:  /* INTERRUPT_MASK */
         s->mask = value;
         break;
 
-    case 0x14:	/* INTERRUPT_STATUS */
+    case 0x14:  /* INTERRUPT_STATUS */
         s->ints &= ~value;
         if (!s->ints)
             qemu_irq_lower(s->irq);
         break;
 
-    case 0x18:	/* PIN_CONTROL (not in OMAP310 TRM) */
+    case 0x18:  /* PIN_CONTROL (not in OMAP310 TRM) */
         OMAP_BAD_REG(addr);
         s->pins = value;
         break;
diff --git a/hw/i2c/omap_i2c.c b/hw/i2c/omap_i2c.c
index 2e45266e74..751bf748fd 100644
--- a/hw/i2c/omap_i2c.c
+++ b/hw/i2c/omap_i2c.c
@@ -55,16 +55,16 @@ struct OMAPI2CState {
     uint16_t test;
 };
 
-#define OMAP2_INTR_REV	0x34
-#define OMAP2_GC_REV	0x34
+#define OMAP2_INTR_REV  0x34
+#define OMAP2_GC_REV    0x34
 
 static void omap_i2c_interrupts_update(OMAPI2CState *s)
 {
     qemu_set_irq(s->irq, s->stat & s->mask);
-    if ((s->dma >> 15) & 1)					/* RDMA_EN */
-        qemu_set_irq(s->drq[0], (s->stat >> 3) & 1);		/* RRDY */
-    if ((s->dma >> 7) & 1)					/* XDMA_EN */
-        qemu_set_irq(s->drq[1], (s->stat >> 4) & 1);		/* XRDY */
+    if ((s->dma >> 15) & 1)                             /* RDMA_EN */
+        qemu_set_irq(s->drq[0], (s->stat >> 3) & 1);    /* RRDY */
+    if ((s->dma >> 7) & 1)                              /* XDMA_EN */
+        qemu_set_irq(s->drq[1], (s->stat >> 4) & 1);    /* XRDY */
 }
 
 static void omap_i2c_fifo_run(OMAPI2CState *s)
@@ -74,25 +74,25 @@ static void omap_i2c_fifo_run(OMAPI2CState *s)
     if (!i2c_bus_busy(s->bus))
         return;
 
-    if ((s->control >> 2) & 1) {				/* RM */
-        if ((s->control >> 1) & 1) {				/* STP */
+    if ((s->control >> 2) & 1) {                /* RM */
+        if ((s->control >> 1) & 1) {            /* STP */
             i2c_end_transfer(s->bus);
-            s->control &= ~(1 << 1);				/* STP */
+            s->control &= ~(1 << 1);            /* STP */
             s->count_cur = s->count;
             s->txlen = 0;
-        } else if ((s->control >> 9) & 1) {			/* TRX */
+        } else if ((s->control >> 9) & 1) {     /* TRX */
             while (ack && s->txlen)
                 ack = (i2c_send(s->bus,
                                         (s->fifo >> ((-- s->txlen) << 3)) &
                                         0xff) >= 0);
-            s->stat |= 1 << 4;					/* XRDY */
+            s->stat |= 1 << 4;                  /* XRDY */
         } else {
             while (s->rxlen < 4)
                 s->fifo |= i2c_recv(s->bus) << ((s->rxlen ++) << 3);
-            s->stat |= 1 << 3;					/* RRDY */
+            s->stat |= 1 << 3;                  /* RRDY */
         }
     } else {
-        if ((s->control >> 9) & 1) {				/* TRX */
+        if ((s->control >> 9) & 1) {            /* TRX */
             while (ack && s->count_cur && s->txlen) {
                 ack = (i2c_send(s->bus,
                                         (s->fifo >> ((-- s->txlen) << 3)) &
@@ -100,12 +100,12 @@ static void omap_i2c_fifo_run(OMAPI2CState *s)
                 s->count_cur --;
             }
             if (ack && s->count_cur)
-                s->stat |= 1 << 4;				/* XRDY */
+                s->stat |= 1 << 4;              /* XRDY */
             else
-                s->stat &= ~(1 << 4);				/* XRDY */
+                s->stat &= ~(1 << 4);           /* XRDY */
             if (!s->count_cur) {
-                s->stat |= 1 << 2;				/* ARDY */
-                s->control &= ~(1 << 10);			/* MST */
+                s->stat |= 1 << 2;              /* ARDY */
+                s->control &= ~(1 << 10);       /* MST */
             }
         } else {
             while (s->count_cur && s->rxlen < 4) {
@@ -113,26 +113,26 @@ static void omap_i2c_fifo_run(OMAPI2CState *s)
                 s->count_cur --;
             }
             if (s->rxlen)
-                s->stat |= 1 << 3;				/* RRDY */
+                s->stat |= 1 << 3;              /* RRDY */
             else
-                s->stat &= ~(1 << 3);				/* RRDY */
+                s->stat &= ~(1 << 3);           /* RRDY */
         }
         if (!s->count_cur) {
-            if ((s->control >> 1) & 1) {			/* STP */
+            if ((s->control >> 1) & 1) {        /* STP */
                 i2c_end_transfer(s->bus);
-                s->control &= ~(1 << 1);			/* STP */
+                s->control &= ~(1 << 1);        /* STP */
                 s->count_cur = s->count;
                 s->txlen = 0;
             } else {
-                s->stat |= 1 << 2;				/* ARDY */
-                s->control &= ~(1 << 10);			/* MST */
+                s->stat |= 1 << 2;              /* ARDY */
+                s->control &= ~(1 << 10);       /* MST */
             }
         }
     }
 
-    s->stat |= (!ack) << 1;					/* NACK */
+    s->stat |= (!ack) << 1;                     /* NACK */
     if (!ack)
-        s->control &= ~(1 << 1);				/* STP */
+        s->control &= ~(1 << 1);                /* STP */
 }
 
 static void omap_i2c_reset(DeviceState *dev)
@@ -163,16 +163,16 @@ static uint32_t omap_i2c_read(void *opaque, hwaddr addr)
     uint16_t ret;
 
     switch (offset) {
-    case 0x00:	/* I2C_REV */
-        return s->revision;					/* REV */
+    case 0x00:  /* I2C_REV */
+        return s->revision;                     /* REV */
 
-    case 0x04:	/* I2C_IE */
+    case 0x04:  /* I2C_IE */
         return s->mask;
 
-    case 0x08:	/* I2C_STAT */
+    case 0x08:  /* I2C_STAT */
         return s->stat | (i2c_bus_busy(s->bus) << 12);
 
-    case 0x0c:	/* I2C_IV */
+    case 0x0c:  /* I2C_IV */
         if (s->revision >= OMAP2_INTR_REV)
             break;
         ret = ctz32(s->stat & s->mask);
@@ -185,18 +185,18 @@ static uint32_t omap_i2c_read(void *opaque, hwaddr addr)
         omap_i2c_interrupts_update(s);
         return ret;
 
-    case 0x10:	/* I2C_SYSS */
-        return (s->control >> 15) & 1;				/* I2C_EN */
+    case 0x10:  /* I2C_SYSS */
+        return (s->control >> 15) & 1;  /* I2C_EN */
 
-    case 0x14:	/* I2C_BUF */
+    case 0x14:  /* I2C_BUF */
         return s->dma;
 
-    case 0x18:	/* I2C_CNT */
-        return s->count_cur;					/* DCOUNT */
+    case 0x18:  /* I2C_CNT */
+        return s->count_cur;    /* DCOUNT */
 
-    case 0x1c:	/* I2C_DATA */
+    case 0x1c:  /* I2C_DATA */
         ret = 0;
-        if (s->control & (1 << 14)) {				/* BE */
+        if (s->control & (1 << 14)) {   /* BE */
             ret |= ((s->fifo >> 0) & 0xff) << 8;
             ret |= ((s->fifo >> 8) & 0xff) << 0;
         } else {
@@ -204,7 +204,7 @@ static uint32_t omap_i2c_read(void *opaque, hwaddr addr)
             ret |= ((s->fifo >> 0) & 0xff) << 0;
         }
         if (s->rxlen == 1) {
-            s->stat |= 1 << 15;					/* SBD */
+            s->stat |= 1 << 15;                 /* SBD */
             s->rxlen = 0;
         } else if (s->rxlen > 1) {
             if (s->rxlen > 2)
@@ -214,41 +214,41 @@ static uint32_t omap_i2c_read(void *opaque, hwaddr addr)
             /* XXX: remote access (qualifier) error - what's that?  */
         }
         if (!s->rxlen) {
-            s->stat &= ~(1 << 3);				/* RRDY */
-            if (((s->control >> 10) & 1) &&			/* MST */
-                            ((~s->control >> 9) & 1)) {		/* TRX */
-                s->stat |= 1 << 2;				/* ARDY */
-                s->control &= ~(1 << 10);			/* MST */
+            s->stat &= ~(1 << 3);                           /* RRDY */
+            if (((s->control >> 10) & 1) &&                 /* MST */
+                            ((~s->control >> 9) & 1)) {     /* TRX */
+                s->stat |= 1 << 2;                          /* ARDY */
+                s->control &= ~(1 << 10);                   /* MST */
             }
         }
-        s->stat &= ~(1 << 11);					/* ROVR */
+        s->stat &= ~(1 << 11);                              /* ROVR */
         omap_i2c_fifo_run(s);
         omap_i2c_interrupts_update(s);
         return ret;
 
-    case 0x20:	/* I2C_SYSC */
+    case 0x20:  /* I2C_SYSC */
         return 0;
 
-    case 0x24:	/* I2C_CON */
+    case 0x24:  /* I2C_CON */
         return s->control;
 
-    case 0x28:	/* I2C_OA */
+    case 0x28:  /* I2C_OA */
         return s->addr[0];
 
-    case 0x2c:	/* I2C_SA */
+    case 0x2c:  /* I2C_SA */
         return s->addr[1];
 
-    case 0x30:	/* I2C_PSC */
+    case 0x30:  /* I2C_PSC */
         return s->divider;
 
-    case 0x34:	/* I2C_SCLL */
+    case 0x34:  /* I2C_SCLL */
         return s->times[0];
 
-    case 0x38:	/* I2C_SCLH */
+    case 0x38:  /* I2C_SCLH */
         return s->times[1];
 
-    case 0x3c:	/* I2C_SYSTEST */
-        if (s->test & (1 << 15)) {				/* ST_EN */
+    case 0x3c:  /* I2C_SYSTEST */
+        if (s->test & (1 << 15)) {              /* ST_EN */
             s->test ^= 0xa;
             return s->test;
         } else
@@ -267,17 +267,17 @@ static void omap_i2c_write(void *opaque, hwaddr addr,
     int nack;
 
     switch (offset) {
-    case 0x00:	/* I2C_REV */
-    case 0x0c:	/* I2C_IV */
-    case 0x10:	/* I2C_SYSS */
+    case 0x00:  /* I2C_REV */
+    case 0x0c:  /* I2C_IV */
+    case 0x10:  /* I2C_SYSS */
         OMAP_RO_REG(addr);
         return;
 
-    case 0x04:	/* I2C_IE */
+    case 0x04:  /* I2C_IE */
         s->mask = value & (s->revision < OMAP2_GC_REV ? 0x1f : 0x3f);
         break;
 
-    case 0x08:	/* I2C_STAT */
+    case 0x08:  /* I2C_STAT */
         if (s->revision < OMAP2_INTR_REV) {
             OMAP_RO_REG(addr);
             return;
@@ -288,40 +288,40 @@ static void omap_i2c_write(void *opaque, hwaddr addr,
         omap_i2c_interrupts_update(s);
         break;
 
-    case 0x14:	/* I2C_BUF */
+    case 0x14:  /* I2C_BUF */
         s->dma = value & 0x8080;
-        if (value & (1 << 15))					/* RDMA_EN */
-            s->mask &= ~(1 << 3);				/* RRDY_IE */
-        if (value & (1 << 7))					/* XDMA_EN */
-            s->mask &= ~(1 << 4);				/* XRDY_IE */
+        if (value & (1 << 15))                  /* RDMA_EN */
+            s->mask &= ~(1 << 3);               /* RRDY_IE */
+        if (value & (1 << 7))                   /* XDMA_EN */
+            s->mask &= ~(1 << 4);               /* XRDY_IE */
         break;
 
-    case 0x18:	/* I2C_CNT */
-        s->count = value;					/* DCOUNT */
+    case 0x18:  /* I2C_CNT */
+        s->count = value;                   /* DCOUNT */
         break;
 
-    case 0x1c:	/* I2C_DATA */
+    case 0x1c:  /* I2C_DATA */
         if (s->txlen > 2) {
             /* XXX: remote access (qualifier) error - what's that?  */
             break;
         }
         s->fifo <<= 16;
         s->txlen += 2;
-        if (s->control & (1 << 14)) {				/* BE */
+        if (s->control & (1 << 14)) {           /* BE */
             s->fifo |= ((value >> 8) & 0xff) << 8;
             s->fifo |= ((value >> 0) & 0xff) << 0;
         } else {
             s->fifo |= ((value >> 0) & 0xff) << 8;
             s->fifo |= ((value >> 8) & 0xff) << 0;
         }
-        s->stat &= ~(1 << 10);					/* XUDF */
+        s->stat &= ~(1 << 10);                  /* XUDF */
         if (s->txlen > 2)
-            s->stat &= ~(1 << 4);				/* XRDY */
+            s->stat &= ~(1 << 4);               /* XRDY */
         omap_i2c_fifo_run(s);
         omap_i2c_interrupts_update(s);
         break;
 
-    case 0x20:	/* I2C_SYSC */
+    case 0x20:  /* I2C_SYSC */
         if (s->revision < OMAP2_INTR_REV) {
             OMAP_BAD_REG(addr);
             return;
@@ -332,9 +332,9 @@ static void omap_i2c_write(void *opaque, hwaddr addr,
         }
         break;
 
-    case 0x24:	/* I2C_CON */
+    case 0x24:  /* I2C_CON */
         s->control = value & 0xcf87;
-        if (~value & (1 << 15)) {				/* I2C_EN */
+        if (~value & (1 << 15)) {               /* I2C_EN */
             if (s->revision < OMAP2_INTR_REV) {
                 omap_i2c_reset(DEVICE(s));
             }
@@ -351,14 +351,14 @@ static void omap_i2c_write(void *opaque, hwaddr addr,
                           __func__);
             break;
         }
-        if ((value & (1 << 15)) && value & (1 << 0)) {		/* STT */
-            nack = !!i2c_start_transfer(s->bus, s->addr[1],	/* SA */
-                            (~value >> 9) & 1);			/* TRX */
-            s->stat |= nack << 1;				/* NACK */
-            s->control &= ~(1 << 0);				/* STT */
+        if ((value & (1 << 15)) && value & (1 << 0)) {      /* STT */
+            nack = !!i2c_start_transfer(s->bus, s->addr[1], /* SA */
+                            (~value >> 9) & 1);             /* TRX */
+            s->stat |= nack << 1;                           /* NACK */
+            s->control &= ~(1 << 0);                        /* STT */
             s->fifo = 0;
             if (nack)
-                s->control &= ~(1 << 1);			/* STP */
+                s->control &= ~(1 << 1);                    /* STP */
             else {
                 s->count_cur = s->count;
                 omap_i2c_fifo_run(s);
@@ -367,34 +367,34 @@ static void omap_i2c_write(void *opaque, hwaddr addr,
         }
         break;
 
-    case 0x28:	/* I2C_OA */
+    case 0x28:  /* I2C_OA */
         s->addr[0] = value & 0x3ff;
         break;
 
-    case 0x2c:	/* I2C_SA */
+    case 0x2c:  /* I2C_SA */
         s->addr[1] = value & 0x3ff;
         break;
 
-    case 0x30:	/* I2C_PSC */
+    case 0x30:  /* I2C_PSC */
         s->divider = value;
         break;
 
-    case 0x34:	/* I2C_SCLL */
+    case 0x34:  /* I2C_SCLL */
         s->times[0] = value;
         break;
 
-    case 0x38:	/* I2C_SCLH */
+    case 0x38:  /* I2C_SCLH */
         s->times[1] = value;
         break;
 
-    case 0x3c:	/* I2C_SYSTEST */
+    case 0x3c:  /* I2C_SYSTEST */
         s->test = value & 0xf80f;
-        if (value & (1 << 11))					/* SBB */
+        if (value & (1 << 11))                  /* SBB */
             if (s->revision >= OMAP2_INTR_REV) {
                 s->stat |= 0x3f;
                 omap_i2c_interrupts_update(s);
             }
-        if (value & (1 << 15)) {                    /* ST_EN */
+        if (value & (1 << 15)) {                /* ST_EN */
             qemu_log_mask(LOG_UNIMP,
                           "%s: System Test not supported\n", __func__);
         }
@@ -413,7 +413,7 @@ static void omap_i2c_writeb(void *opaque, hwaddr addr,
     int offset = addr & OMAP_MPUI_REG_MASK;
 
     switch (offset) {
-    case 0x1c:	/* I2C_DATA */
+    case 0x1c:  /* I2C_DATA */
         if (s->txlen > 2) {
             /* XXX: remote access (qualifier) error - what's that?  */
             break;
@@ -421,9 +421,9 @@ static void omap_i2c_writeb(void *opaque, hwaddr addr,
         s->fifo <<= 8;
         s->txlen += 1;
         s->fifo |= value & 0xff;
-        s->stat &= ~(1 << 10);					/* XUDF */
+        s->stat &= ~(1 << 10);                  /* XUDF */
         if (s->txlen > 2)
-            s->stat &= ~(1 << 4);				/* XRDY */
+            s->stat &= ~(1 << 4);               /* XRDY */
         omap_i2c_fifo_run(s);
         omap_i2c_interrupts_update(s);
         break;
diff --git a/hw/intc/omap_intc.c b/hw/intc/omap_intc.c
index 9e8737be33..c61158bddd 100644
--- a/hw/intc/omap_intc.c
+++ b/hw/intc/omap_intc.c
@@ -102,8 +102,8 @@ static inline void omap_inth_update(OMAPIntcState *s, int is_fiq)
     }
 }
 
-#define INT_FALLING_EDGE	0
-#define INT_LOW_LEVEL		1
+#define INT_FALLING_EDGE    0
+#define INT_LOW_LEVEL       1
 
 static void omap_set_intr(void *opaque, int irq, int req)
 {
@@ -142,13 +142,13 @@ static uint64_t omap_inth_read(void *opaque, hwaddr addr,
     offset &= 0xff;
 
     switch (offset) {
-    case 0x00:	/* ITR */
+    case 0x00:  /* ITR */
         return bank->irqs;
 
-    case 0x04:	/* MIR */
+    case 0x04:  /* MIR */
         return bank->mask;
 
-    case 0x10:	/* SIR_IRQ_CODE */
+    case 0x10:  /* SIR_IRQ_CODE */
     case 0x14:  /* SIR_FIQ_CODE */
         if (bank_no != 0)
             break;
@@ -159,49 +159,49 @@ static uint64_t omap_inth_read(void *opaque, hwaddr addr,
             bank->irqs &= ~(1 << i);
         return line_no;
 
-    case 0x18:	/* CONTROL_REG */
+    case 0x18:  /* CONTROL_REG */
         if (bank_no != 0)
             break;
         return 0;
 
-    case 0x1c:	/* ILR0 */
-    case 0x20:	/* ILR1 */
-    case 0x24:	/* ILR2 */
-    case 0x28:	/* ILR3 */
-    case 0x2c:	/* ILR4 */
-    case 0x30:	/* ILR5 */
-    case 0x34:	/* ILR6 */
-    case 0x38:	/* ILR7 */
-    case 0x3c:	/* ILR8 */
-    case 0x40:	/* ILR9 */
-    case 0x44:	/* ILR10 */
-    case 0x48:	/* ILR11 */
-    case 0x4c:	/* ILR12 */
-    case 0x50:	/* ILR13 */
-    case 0x54:	/* ILR14 */
-    case 0x58:	/* ILR15 */
-    case 0x5c:	/* ILR16 */
-    case 0x60:	/* ILR17 */
-    case 0x64:	/* ILR18 */
-    case 0x68:	/* ILR19 */
-    case 0x6c:	/* ILR20 */
-    case 0x70:	/* ILR21 */
-    case 0x74:	/* ILR22 */
-    case 0x78:	/* ILR23 */
-    case 0x7c:	/* ILR24 */
-    case 0x80:	/* ILR25 */
-    case 0x84:	/* ILR26 */
-    case 0x88:	/* ILR27 */
-    case 0x8c:	/* ILR28 */
-    case 0x90:	/* ILR29 */
-    case 0x94:	/* ILR30 */
-    case 0x98:	/* ILR31 */
+    case 0x1c:  /* ILR0 */
+    case 0x20:  /* ILR1 */
+    case 0x24:  /* ILR2 */
+    case 0x28:  /* ILR3 */
+    case 0x2c:  /* ILR4 */
+    case 0x30:  /* ILR5 */
+    case 0x34:  /* ILR6 */
+    case 0x38:  /* ILR7 */
+    case 0x3c:  /* ILR8 */
+    case 0x40:  /* ILR9 */
+    case 0x44:  /* ILR10 */
+    case 0x48:  /* ILR11 */
+    case 0x4c:  /* ILR12 */
+    case 0x50:  /* ILR13 */
+    case 0x54:  /* ILR14 */
+    case 0x58:  /* ILR15 */
+    case 0x5c:  /* ILR16 */
+    case 0x60:  /* ILR17 */
+    case 0x64:  /* ILR18 */
+    case 0x68:  /* ILR19 */
+    case 0x6c:  /* ILR20 */
+    case 0x70:  /* ILR21 */
+    case 0x74:  /* ILR22 */
+    case 0x78:  /* ILR23 */
+    case 0x7c:  /* ILR24 */
+    case 0x80:  /* ILR25 */
+    case 0x84:  /* ILR26 */
+    case 0x88:  /* ILR27 */
+    case 0x8c:  /* ILR28 */
+    case 0x90:  /* ILR29 */
+    case 0x94:  /* ILR30 */
+    case 0x98:  /* ILR31 */
         i = (offset - 0x1c) >> 2;
         return (bank->priority[i] << 2) |
                 (((bank->sens_edge >> i) & 1) << 1) |
                 ((bank->fiq >> i) & 1);
 
-    case 0x9c:	/* ISR */
+    case 0x9c:  /* ISR */
         return 0x00000000;
 
     }
@@ -219,24 +219,24 @@ static void omap_inth_write(void *opaque, hwaddr addr,
     offset &= 0xff;
 
     switch (offset) {
-    case 0x00:	/* ITR */
+    case 0x00:  /* ITR */
         /* Important: ignore the clearing if the IRQ is level-triggered and
            the input bit is 1 */
         bank->irqs &= value | (bank->inputs & bank->sens_edge);
         return;
 
-    case 0x04:	/* MIR */
+    case 0x04:  /* MIR */
         bank->mask = value;
         omap_inth_update(s, 0);
         omap_inth_update(s, 1);
         return;
 
-    case 0x10:	/* SIR_IRQ_CODE */
-    case 0x14:	/* SIR_FIQ_CODE */
+    case 0x10:  /* SIR_IRQ_CODE */
+    case 0x14:  /* SIR_FIQ_CODE */
         OMAP_RO_REG(addr);
         break;
 
-    case 0x18:	/* CONTROL_REG */
+    case 0x18:  /* CONTROL_REG */
         if (bank_no != 0)
             break;
         if (value & 2) {
@@ -251,38 +251,38 @@ static void omap_inth_write(void *opaque, hwaddr addr,
         }
         return;
 
-    case 0x1c:	/* ILR0 */
-    case 0x20:	/* ILR1 */
-    case 0x24:	/* ILR2 */
-    case 0x28:	/* ILR3 */
-    case 0x2c:	/* ILR4 */
-    case 0x30:	/* ILR5 */
-    case 0x34:	/* ILR6 */
-    case 0x38:	/* ILR7 */
-    case 0x3c:	/* ILR8 */
-    case 0x40:	/* ILR9 */
-    case 0x44:	/* ILR10 */
-    case 0x48:	/* ILR11 */
-    case 0x4c:	/* ILR12 */
-    case 0x50:	/* ILR13 */
-    case 0x54:	/* ILR14 */
-    case 0x58:	/* ILR15 */
-    case 0x5c:	/* ILR16 */
-    case 0x60:	/* ILR17 */
-    case 0x64:	/* ILR18 */
-    case 0x68:	/* ILR19 */
-    case 0x6c:	/* ILR20 */
-    case 0x70:	/* ILR21 */
-    case 0x74:	/* ILR22 */
-    case 0x78:	/* ILR23 */
-    case 0x7c:	/* ILR24 */
-    case 0x80:	/* ILR25 */
-    case 0x84:	/* ILR26 */
-    case 0x88:	/* ILR27 */
-    case 0x8c:	/* ILR28 */
-    case 0x90:	/* ILR29 */
-    case 0x94:	/* ILR30 */
-    case 0x98:	/* ILR31 */
+    case 0x1c:  /* ILR0 */
+    case 0x20:  /* ILR1 */
+    case 0x24:  /* ILR2 */
+    case 0x28:  /* ILR3 */
+    case 0x2c:  /* ILR4 */
+    case 0x30:  /* ILR5 */
+    case 0x34:  /* ILR6 */
+    case 0x38:  /* ILR7 */
+    case 0x3c:  /* ILR8 */
+    case 0x40:  /* ILR9 */
+    case 0x44:  /* ILR10 */
+    case 0x48:  /* ILR11 */
+    case 0x4c:  /* ILR12 */
+    case 0x50:  /* ILR13 */
+    case 0x54:  /* ILR14 */
+    case 0x58:  /* ILR15 */
+    case 0x5c:  /* ILR16 */
+    case 0x60:  /* ILR17 */
+    case 0x64:  /* ILR18 */
+    case 0x68:  /* ILR19 */
+    case 0x6c:  /* ILR20 */
+    case 0x70:  /* ILR21 */
+    case 0x74:  /* ILR22 */
+    case 0x78:  /* ILR23 */
+    case 0x7c:  /* ILR24 */
+    case 0x80:  /* ILR25 */
+    case 0x84:  /* ILR26 */
+    case 0x88:  /* ILR27 */
+    case 0x8c:  /* ILR28 */
+    case 0x90:  /* ILR29 */
+    case 0x94:  /* ILR30 */
+    case 0x98:  /* ILR31 */
         i = (offset - 0x1c) >> 2;
         bank->priority[i] = (value >> 2) & 0x1f;
         bank->sens_edge &= ~(1 << i);
@@ -291,7 +291,7 @@ static void omap_inth_write(void *opaque, hwaddr addr,
         bank->fiq |= (value & 1) << i;
         return;
 
-    case 0x9c:	/* ISR */
+    case 0x9c:  /* ISR */
         for (i = 0; i < 32; i ++)
             if (value & (1 << i)) {
                 omap_set_intr(s, 32 * bank_no + i, 1);
diff --git a/hw/misc/omap_clk.c b/hw/misc/omap_clk.c
index 0157c9be75..da95c4ace5 100644
--- a/hw/misc/omap_clk.c
+++ b/hw/misc/omap_clk.c
@@ -30,170 +30,170 @@ struct clk {
     struct clk *parent;
     struct clk *child1;
     struct clk *sibling;
-#define ALWAYS_ENABLED		(1 << 0)
-#define CLOCK_IN_OMAP310	(1 << 10)
-#define CLOCK_IN_OMAP730	(1 << 11)
-#define CLOCK_IN_OMAP1510	(1 << 12)
-#define CLOCK_IN_OMAP16XX	(1 << 13)
+#define ALWAYS_ENABLED      (1 << 0)
+#define CLOCK_IN_OMAP310    (1 << 10)
+#define CLOCK_IN_OMAP730    (1 << 11)
+#define CLOCK_IN_OMAP1510   (1 << 12)
+#define CLOCK_IN_OMAP16XX   (1 << 13)
     uint32_t flags;
     int id;
 
-    int running;		/* Is currently ticking */
-    int enabled;		/* Is enabled, regardless of its input clk */
-    unsigned long rate;		/* Current rate (if .running) */
-    unsigned int divisor;	/* Rate relative to input (if .enabled) */
-    unsigned int multiplier;	/* Rate relative to input (if .enabled) */
-    qemu_irq users[16];		/* Who to notify on change */
-    int usecount;		/* Automatically idle when unused */
+    int running;             /* Is currently ticking                    */
+    int enabled;             /* Is enabled, regardless of its input clk */
+    unsigned long rate;      /* Current rate (if .running)              */
+    unsigned int divisor;    /* Rate relative to input (if .enabled)    */
+    unsigned int multiplier; /* Rate relative to input (if .enabled)    */
+    qemu_irq users[16];      /* Who to notify on change                 */
+    int usecount;            /* Automatically idle when unused          */
 };
 
 static struct clk xtal_osc12m = {
-    .name	= "xtal_osc_12m",
-    .rate	= 12000000,
-    .flags	= CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX | CLOCK_IN_OMAP310,
+    .name   = "xtal_osc_12m",
+    .rate   = 12000000,
+    .flags  = CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX | CLOCK_IN_OMAP310,
 };
 
 static struct clk xtal_osc32k = {
-    .name	= "xtal_osc_32k",
-    .rate	= 32768,
-    .flags	= CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX | CLOCK_IN_OMAP310,
+    .name   = "xtal_osc_32k",
+    .rate   = 32768,
+    .flags  = CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX | CLOCK_IN_OMAP310,
 };
 
 static struct clk ck_ref = {
-    .name	= "ck_ref",
-    .alias	= "clkin",
-    .parent	= &xtal_osc12m,
-    .flags	= CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX | CLOCK_IN_OMAP310 |
+    .name   = "ck_ref",
+    .alias  = "clkin",
+    .parent = &xtal_osc12m,
+    .flags  = CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX | CLOCK_IN_OMAP310 |
             ALWAYS_ENABLED,
 };
 
 /* If a dpll is disabled it becomes a bypass, child clocks don't stop */
 static struct clk dpll1 = {
-    .name	= "dpll1",
-    .parent	= &ck_ref,
-    .flags	= CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX | CLOCK_IN_OMAP310 |
+    .name   = "dpll1",
+    .parent = &ck_ref,
+    .flags  = CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX | CLOCK_IN_OMAP310 |
             ALWAYS_ENABLED,
 };
 
 static struct clk dpll2 = {
-    .name	= "dpll2",
-    .parent	= &ck_ref,
-    .flags	= CLOCK_IN_OMAP310 | ALWAYS_ENABLED,
+    .name   = "dpll2",
+    .parent = &ck_ref,
+    .flags  = CLOCK_IN_OMAP310 | ALWAYS_ENABLED,
 };
 
 static struct clk dpll3 = {
-    .name	= "dpll3",
-    .parent	= &ck_ref,
-    .flags	= CLOCK_IN_OMAP310 | ALWAYS_ENABLED,
+    .name   = "dpll3",
+    .parent = &ck_ref,
+    .flags  = CLOCK_IN_OMAP310 | ALWAYS_ENABLED,
 };
 
 static struct clk dpll4 = {
-    .name	= "dpll4",
-    .parent	= &ck_ref,
-    .multiplier	= 4,
-    .flags	= CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX | CLOCK_IN_OMAP310,
+    .name   = "dpll4",
+    .parent = &ck_ref,
+    .multiplier = 4,
+    .flags  = CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX | CLOCK_IN_OMAP310,
 };
 
 static struct clk apll = {
-    .name	= "apll",
-    .parent	= &ck_ref,
-    .multiplier	= 48,
-    .divisor	= 12,
-    .flags	= CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX | CLOCK_IN_OMAP310,
+    .name   = "apll",
+    .parent = &ck_ref,
+    .multiplier = 48,
+    .divisor    = 12,
+    .flags  = CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX | CLOCK_IN_OMAP310,
 };
 
 static struct clk ck_48m = {
-    .name	= "ck_48m",
-    .parent	= &dpll4,	/* either dpll4 or apll */
-    .flags	= CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX | CLOCK_IN_OMAP310,
+    .name   = "ck_48m",
+    .parent = &dpll4,   /* either dpll4 or apll */
+    .flags  = CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX | CLOCK_IN_OMAP310,
 };
 
 static struct clk ck_dpll1out = {
-    .name	= "ck_dpll1out",
-    .parent	= &dpll1,
-    .flags	= CLOCK_IN_OMAP16XX,
+    .name   = "ck_dpll1out",
+    .parent = &dpll1,
+    .flags  = CLOCK_IN_OMAP16XX,
 };
 
 static struct clk sossi_ck = {
-    .name	= "ck_sossi",
-    .parent	= &ck_dpll1out,
-    .flags	= CLOCK_IN_OMAP16XX,
+    .name   = "ck_sossi",
+    .parent = &ck_dpll1out,
+    .flags  = CLOCK_IN_OMAP16XX,
 };
 
 static struct clk clkm1 = {
-    .name	= "clkm1",
-    .alias	= "ck_gen1",
-    .parent	= &dpll1,
-    .flags	= CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX | CLOCK_IN_OMAP310 |
+    .name   = "clkm1",
+    .alias  = "ck_gen1",
+    .parent = &dpll1,
+    .flags  = CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX | CLOCK_IN_OMAP310 |
             ALWAYS_ENABLED,
 };
 
 static struct clk clkm2 = {
-    .name	= "clkm2",
-    .alias	= "ck_gen2",
-    .parent	= &dpll1,
-    .flags	= CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX | CLOCK_IN_OMAP310 |
+    .name   = "clkm2",
+    .alias  = "ck_gen2",
+    .parent = &dpll1,
+    .flags  = CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX | CLOCK_IN_OMAP310 |
             ALWAYS_ENABLED,
 };
 
 static struct clk clkm3 = {
-    .name	= "clkm3",
-    .alias	= "ck_gen3",
-    .parent	= &dpll1,	/* either dpll1 or ck_ref */
-    .flags	= CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX | CLOCK_IN_OMAP310 |
+    .name   = "clkm3",
+    .alias  = "ck_gen3",
+    .parent = &dpll1,   /* either dpll1 or ck_ref */
+    .flags  = CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX | CLOCK_IN_OMAP310 |
             ALWAYS_ENABLED,
 };
 
 static struct clk arm_ck = {
-    .name	= "arm_ck",
-    .alias	= "mpu_ck",
-    .parent	= &clkm1,
-    .flags	= CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX | CLOCK_IN_OMAP310 |
+    .name   = "arm_ck",
+    .alias  = "mpu_ck",
+    .parent = &clkm1,
+    .flags  = CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX | CLOCK_IN_OMAP310 |
             ALWAYS_ENABLED,
 };
 
 static struct clk armper_ck = {
-    .name	= "armper_ck",
-    .alias	= "mpuper_ck",
-    .parent	= &clkm1,
-    .flags	= CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX | CLOCK_IN_OMAP310,
+    .name   = "armper_ck",
+    .alias  = "mpuper_ck",
+    .parent = &clkm1,
+    .flags  = CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX | CLOCK_IN_OMAP310,
 };
 
 static struct clk arm_gpio_ck = {
-    .name	= "arm_gpio_ck",
-    .alias	= "mpu_gpio_ck",
-    .parent	= &clkm1,
-    .divisor	= 1,
-    .flags	= CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP310,
+    .name   = "arm_gpio_ck",
+    .alias  = "mpu_gpio_ck",
+    .parent = &clkm1,
+    .divisor    = 1,
+    .flags  = CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP310,
 };
 
 static struct clk armxor_ck = {
-    .name	= "armxor_ck",
-    .alias	= "mpuxor_ck",
-    .parent	= &ck_ref,
-    .flags	= CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX | CLOCK_IN_OMAP310,
+    .name   = "armxor_ck",
+    .alias  = "mpuxor_ck",
+    .parent = &ck_ref,
+    .flags  = CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX | CLOCK_IN_OMAP310,
 };
 
 static struct clk armtim_ck = {
-    .name	= "armtim_ck",
-    .alias	= "mputim_ck",
-    .parent	= &ck_ref,	/* either CLKIN or DPLL1 */
-    .flags	= CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX | CLOCK_IN_OMAP310,
+    .name   = "armtim_ck",
+    .alias  = "mputim_ck",
+    .parent = &ck_ref,  /* either CLKIN or DPLL1 */
+    .flags  = CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX | CLOCK_IN_OMAP310,
 };
 
 static struct clk armwdt_ck = {
-    .name	= "armwdt_ck",
-    .alias	= "mpuwd_ck",
-    .parent	= &clkm1,
-    .divisor	= 14,
-    .flags	= CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX | CLOCK_IN_OMAP310 |
+    .name   = "armwdt_ck",
+    .alias  = "mpuwd_ck",
+    .parent = &clkm1,
+    .divisor    = 14,
+    .flags  = CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX | CLOCK_IN_OMAP310 |
             ALWAYS_ENABLED,
 };
 
 static struct clk arminth_ck16xx = {
-    .name	= "arminth_ck",
-    .parent	= &arm_ck,
-    .flags	= CLOCK_IN_OMAP16XX | ALWAYS_ENABLED,
+    .name   = "arminth_ck",
+    .parent = &arm_ck,
+    .flags  = CLOCK_IN_OMAP16XX | ALWAYS_ENABLED,
     /* Note: On 16xx the frequency can be divided by 2 by programming
      * ARM_CKCTL:ARM_INTHCK_SEL(14) to 1
      *
@@ -202,48 +202,48 @@ static struct clk arminth_ck16xx = {
 };
 
 static struct clk dsp_ck = {
-    .name	= "dsp_ck",
-    .parent	= &clkm2,
-    .flags	= CLOCK_IN_OMAP310 | CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX,
+    .name   = "dsp_ck",
+    .parent = &clkm2,
+    .flags  = CLOCK_IN_OMAP310 | CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX,
 };
 
 static struct clk dspmmu_ck = {
-    .name	= "dspmmu_ck",
-    .parent	= &clkm2,
-    .flags	= CLOCK_IN_OMAP310 | CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX |
+    .name   = "dspmmu_ck",
+    .parent = &clkm2,
+    .flags  = CLOCK_IN_OMAP310 | CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX |
             ALWAYS_ENABLED,
 };
 
 static struct clk dspper_ck = {
-    .name	= "dspper_ck",
-    .parent	= &clkm2,
-    .flags	= CLOCK_IN_OMAP310 | CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX,
+    .name   = "dspper_ck",
+    .parent = &clkm2,
+    .flags  = CLOCK_IN_OMAP310 | CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX,
 };
 
 static struct clk dspxor_ck = {
-    .name	= "dspxor_ck",
-    .parent	= &ck_ref,
-    .flags	= CLOCK_IN_OMAP310 | CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX,
+    .name   = "dspxor_ck",
+    .parent = &ck_ref,
+    .flags  = CLOCK_IN_OMAP310 | CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX,
 };
 
 static struct clk dsptim_ck = {
-    .name	= "dsptim_ck",
-    .parent	= &ck_ref,
-    .flags	= CLOCK_IN_OMAP310 | CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX,
+    .name   = "dsptim_ck",
+    .parent = &ck_ref,
+    .flags  = CLOCK_IN_OMAP310 | CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX,
 };
 
 static struct clk tc_ck = {
-    .name	= "tc_ck",
-    .parent	= &clkm3,
-    .flags	= CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX |
+    .name   = "tc_ck",
+    .parent = &clkm3,
+    .flags  = CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX |
             CLOCK_IN_OMAP730 | CLOCK_IN_OMAP310 |
             ALWAYS_ENABLED,
 };
 
 static struct clk arminth_ck15xx = {
-    .name	= "arminth_ck",
-    .parent	= &tc_ck,
-    .flags	= CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP310 | ALWAYS_ENABLED,
+    .name   = "arminth_ck",
+    .parent = &tc_ck,
+    .flags  = CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP310 | ALWAYS_ENABLED,
     /* Note: On 1510 the frequency follows TC_CK
      *
      * 16xx version is in MPU clocks.
@@ -252,259 +252,259 @@ static struct clk arminth_ck15xx = {
 
 static struct clk tipb_ck = {
     /* No-idle controlled by "tc_ck" */
-    .name	= "tipb_ck",
-    .parent	= &tc_ck,
-    .flags	= CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP310 | ALWAYS_ENABLED,
+    .name   = "tipb_ck",
+    .parent = &tc_ck,
+    .flags  = CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP310 | ALWAYS_ENABLED,
 };
 
 static struct clk l3_ocpi_ck = {
     /* No-idle controlled by "tc_ck" */
-    .name	= "l3_ocpi_ck",
-    .parent	= &tc_ck,
-    .flags	= CLOCK_IN_OMAP16XX,
+    .name   = "l3_ocpi_ck",
+    .parent = &tc_ck,
+    .flags  = CLOCK_IN_OMAP16XX,
 };
 
 static struct clk tc1_ck = {
-    .name	= "tc1_ck",
-    .parent	= &tc_ck,
-    .flags	= CLOCK_IN_OMAP16XX,
+    .name   = "tc1_ck",
+    .parent = &tc_ck,
+    .flags  = CLOCK_IN_OMAP16XX,
 };
 
 static struct clk tc2_ck = {
-    .name	= "tc2_ck",
-    .parent	= &tc_ck,
-    .flags	= CLOCK_IN_OMAP16XX,
+    .name   = "tc2_ck",
+    .parent = &tc_ck,
+    .flags  = CLOCK_IN_OMAP16XX,
 };
 
 static struct clk dma_ck = {
     /* No-idle controlled by "tc_ck" */
-    .name	= "dma_ck",
-    .parent	= &tc_ck,
-    .flags	= CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX | CLOCK_IN_OMAP310 |
+    .name   = "dma_ck",
+    .parent = &tc_ck,
+    .flags  = CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX | CLOCK_IN_OMAP310 |
             ALWAYS_ENABLED,
 };
 
 static struct clk dma_lcdfree_ck = {
-    .name	= "dma_lcdfree_ck",
-    .parent	= &tc_ck,
-    .flags	= CLOCK_IN_OMAP16XX | ALWAYS_ENABLED,
+    .name   = "dma_lcdfree_ck",
+    .parent = &tc_ck,
+    .flags  = CLOCK_IN_OMAP16XX | ALWAYS_ENABLED,
 };
 
 static struct clk api_ck = {
-    .name	= "api_ck",
-    .alias	= "mpui_ck",
-    .parent	= &tc_ck,
-    .flags	= CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX | CLOCK_IN_OMAP310,
+    .name   = "api_ck",
+    .alias  = "mpui_ck",
+    .parent = &tc_ck,
+    .flags  = CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX | CLOCK_IN_OMAP310,
 };
 
 static struct clk lb_ck = {
-    .name	= "lb_ck",
-    .parent	= &tc_ck,
-    .flags	= CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP310,
+    .name   = "lb_ck",
+    .parent = &tc_ck,
+    .flags  = CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP310,
 };
 
 static struct clk lbfree_ck = {
-    .name	= "lbfree_ck",
-    .parent	= &tc_ck,
-    .flags	= CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP310,
+    .name   = "lbfree_ck",
+    .parent = &tc_ck,
+    .flags  = CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP310,
 };
 
 static struct clk hsab_ck = {
-    .name	= "hsab_ck",
-    .parent	= &tc_ck,
-    .flags	= CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP310,
+    .name   = "hsab_ck",
+    .parent = &tc_ck,
+    .flags  = CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP310,
 };
 
 static struct clk rhea1_ck = {
-    .name	= "rhea1_ck",
-    .parent	= &tc_ck,
-    .flags	= CLOCK_IN_OMAP16XX | ALWAYS_ENABLED,
+    .name   = "rhea1_ck",
+    .parent = &tc_ck,
+    .flags  = CLOCK_IN_OMAP16XX | ALWAYS_ENABLED,
 };
 
 static struct clk rhea2_ck = {
-    .name	= "rhea2_ck",
-    .parent	= &tc_ck,
-    .flags	= CLOCK_IN_OMAP16XX | ALWAYS_ENABLED,
+    .name   = "rhea2_ck",
+    .parent = &tc_ck,
+    .flags  = CLOCK_IN_OMAP16XX | ALWAYS_ENABLED,
 };
 
 static struct clk lcd_ck_16xx = {
-    .name	= "lcd_ck",
-    .parent	= &clkm3,
-    .flags	= CLOCK_IN_OMAP16XX | CLOCK_IN_OMAP730,
+    .name   = "lcd_ck",
+    .parent = &clkm3,
+    .flags  = CLOCK_IN_OMAP16XX | CLOCK_IN_OMAP730,
 };
 
 static struct clk lcd_ck_1510 = {
-    .name	= "lcd_ck",
-    .parent	= &clkm3,
-    .flags	= CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP310,
+    .name   = "lcd_ck",
+    .parent = &clkm3,
+    .flags  = CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP310,
 };
 
 static struct clk uart1_1510 = {
-    .name	= "uart1_ck",
+    .name   = "uart1_ck",
     /* Direct from ULPD, no real parent */
-    .parent	= &armper_ck,	/* either armper_ck or dpll4 */
-    .rate	= 12000000,
-    .flags	= CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP310 | ALWAYS_ENABLED,
+    .parent = &armper_ck,   /* either armper_ck or dpll4 */
+    .rate   = 12000000,
+    .flags  = CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP310 | ALWAYS_ENABLED,
 };
 
 static struct clk uart1_16xx = {
-    .name	= "uart1_ck",
+    .name   = "uart1_ck",
     /* Direct from ULPD, no real parent */
-    .parent	= &armper_ck,
-    .rate	= 48000000,
-    .flags	= CLOCK_IN_OMAP16XX,
+    .parent = &armper_ck,
+    .rate   = 48000000,
+    .flags  = CLOCK_IN_OMAP16XX,
 };
 
 static struct clk uart2_ck = {
-    .name	= "uart2_ck",
+    .name   = "uart2_ck",
     /* Direct from ULPD, no real parent */
-    .parent	= &armper_ck,	/* either armper_ck or dpll4 */
-    .rate	= 12000000,
-    .flags	= CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX | CLOCK_IN_OMAP310 |
+    .parent = &armper_ck,   /* either armper_ck or dpll4 */
+    .rate   = 12000000,
+    .flags  = CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX | CLOCK_IN_OMAP310 |
             ALWAYS_ENABLED,
 };
 
 static struct clk uart3_1510 = {
-    .name	= "uart3_ck",
+    .name   = "uart3_ck",
     /* Direct from ULPD, no real parent */
-    .parent	= &armper_ck,	/* either armper_ck or dpll4 */
-    .rate	= 12000000,
-    .flags	= CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP310 | ALWAYS_ENABLED,
+    .parent = &armper_ck,   /* either armper_ck or dpll4 */
+    .rate   = 12000000,
+    .flags  = CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP310 | ALWAYS_ENABLED,
 };
 
 static struct clk uart3_16xx = {
-    .name	= "uart3_ck",
+    .name   = "uart3_ck",
     /* Direct from ULPD, no real parent */
-    .parent	= &armper_ck,
-    .rate	= 48000000,
-    .flags	= CLOCK_IN_OMAP16XX,
+    .parent = &armper_ck,
+    .rate   = 48000000,
+    .flags  = CLOCK_IN_OMAP16XX,
 };
 
-static struct clk usb_clk0 = {	/* 6 MHz output on W4_USB_CLK0 */
-    .name	= "usb_clk0",
-    .alias	= "usb.clko",
+static struct clk usb_clk0 = {  /* 6 MHz output on W4_USB_CLK0 */
+    .name   = "usb_clk0",
+    .alias  = "usb.clko",
     /* Direct from ULPD, no parent */
-    .rate	= 6000000,
-    .flags	= CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX | CLOCK_IN_OMAP310,
+    .rate   = 6000000,
+    .flags  = CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX | CLOCK_IN_OMAP310,
 };
 
 static struct clk usb_hhc_ck1510 = {
-    .name	= "usb_hhc_ck",
+    .name   = "usb_hhc_ck",
     /* Direct from ULPD, no parent */
-    .rate	= 48000000, /* Actually 2 clocks, 12MHz and 48MHz */
-    .flags	= CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP310,
+    .rate   = 48000000, /* Actually 2 clocks, 12MHz and 48MHz */
+    .flags  = CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP310,
 };
 
 static struct clk usb_hhc_ck16xx = {
-    .name	= "usb_hhc_ck",
+    .name   = "usb_hhc_ck",
     /* Direct from ULPD, no parent */
-    .rate	= 48000000,
+    .rate   = 48000000,
     /* OTG_SYSCON_2.OTG_PADEN == 0 (not 1510-compatible) */
-    .flags	= CLOCK_IN_OMAP16XX,
+    .flags  = CLOCK_IN_OMAP16XX,
 };
 
 static struct clk usb_w2fc_mclk = {
-    .name	= "usb_w2fc_mclk",
-    .alias	= "usb_w2fc_ck",
-    .parent	= &ck_48m,
-    .rate	= 48000000,
-    .flags	= CLOCK_IN_OMAP310 | CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX,
+    .name   = "usb_w2fc_mclk",
+    .alias  = "usb_w2fc_ck",
+    .parent = &ck_48m,
+    .rate   = 48000000,
+    .flags  = CLOCK_IN_OMAP310 | CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX,
 };
 
 static struct clk mclk_1510 = {
-    .name	= "mclk",
+    .name   = "mclk",
     /* Direct from ULPD, no parent. May be enabled by ext hardware. */
-    .rate	= 12000000,
-    .flags	= CLOCK_IN_OMAP1510,
+    .rate   = 12000000,
+    .flags  = CLOCK_IN_OMAP1510,
 };
 
 static struct clk bclk_310 = {
-    .name	= "bt_mclk_out",	/* Alias midi_mclk_out? */
-    .parent	= &armper_ck,
-    .flags	= CLOCK_IN_OMAP310,
+    .name   = "bt_mclk_out",    /* Alias midi_mclk_out? */
+    .parent = &armper_ck,
+    .flags  = CLOCK_IN_OMAP310,
 };
 
 static struct clk mclk_310 = {
-    .name	= "com_mclk_out",
-    .parent	= &armper_ck,
-    .flags	= CLOCK_IN_OMAP310,
+    .name   = "com_mclk_out",
+    .parent = &armper_ck,
+    .flags  = CLOCK_IN_OMAP310,
 };
 
 static struct clk mclk_16xx = {
-    .name	= "mclk",
+    .name   = "mclk",
     /* Direct from ULPD, no parent. May be enabled by ext hardware. */
-    .flags	= CLOCK_IN_OMAP16XX,
+    .flags  = CLOCK_IN_OMAP16XX,
 };
 
 static struct clk bclk_1510 = {
-    .name	= "bclk",
+    .name   = "bclk",
     /* Direct from ULPD, no parent. May be enabled by ext hardware. */
-    .rate	= 12000000,
-    .flags	= CLOCK_IN_OMAP1510,
+    .rate   = 12000000,
+    .flags  = CLOCK_IN_OMAP1510,
 };
 
 static struct clk bclk_16xx = {
-    .name	= "bclk",
+    .name   = "bclk",
     /* Direct from ULPD, no parent. May be enabled by ext hardware. */
-    .flags	= CLOCK_IN_OMAP16XX,
+    .flags  = CLOCK_IN_OMAP16XX,
 };
 
 static struct clk mmc1_ck = {
-    .name	= "mmc_ck",
-    .id		= 1,
+    .name   = "mmc_ck",
+    .id     = 1,
     /* Functional clock is direct from ULPD, interface clock is ARMPER */
-    .parent	= &armper_ck,	/* either armper_ck or dpll4 */
-    .rate	= 48000000,
-    .flags	= CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX | CLOCK_IN_OMAP310,
+    .parent = &armper_ck,   /* either armper_ck or dpll4 */
+    .rate   = 48000000,
+    .flags  = CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX | CLOCK_IN_OMAP310,
 };
 
 static struct clk mmc2_ck = {
-    .name	= "mmc_ck",
-    .id		= 2,
+    .name   = "mmc_ck",
+    .id     = 2,
     /* Functional clock is direct from ULPD, interface clock is ARMPER */
-    .parent	= &armper_ck,
-    .rate	= 48000000,
-    .flags	= CLOCK_IN_OMAP16XX,
+    .parent = &armper_ck,
+    .rate   = 48000000,
+    .flags  = CLOCK_IN_OMAP16XX,
 };
 
 static struct clk cam_mclk = {
-    .name	= "cam.mclk",
-    .flags	= CLOCK_IN_OMAP310 | CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX,
-    .rate	= 12000000,
+    .name   = "cam.mclk",
+    .flags  = CLOCK_IN_OMAP310 | CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX,
+    .rate   = 12000000,
 };
 
 static struct clk cam_exclk = {
-    .name	= "cam.exclk",
-    .flags	= CLOCK_IN_OMAP310 | CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX,
+    .name   = "cam.exclk",
+    .flags  = CLOCK_IN_OMAP310 | CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX,
     /* Either 12M from cam.mclk or 48M from dpll4 */
-    .parent	= &cam_mclk,
+    .parent = &cam_mclk,
 };
 
 static struct clk cam_lclk = {
-    .name	= "cam.lclk",
-    .flags	= CLOCK_IN_OMAP310 | CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX,
+    .name   = "cam.lclk",
+    .flags  = CLOCK_IN_OMAP310 | CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX,
 };
 
 static struct clk i2c_fck = {
-    .name	= "i2c_fck",
-    .id		= 1,
-    .flags	= CLOCK_IN_OMAP310 | CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX |
+    .name   = "i2c_fck",
+    .id     = 1,
+    .flags  = CLOCK_IN_OMAP310 | CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX |
             ALWAYS_ENABLED,
-    .parent	= &armxor_ck,
+    .parent = &armxor_ck,
 };
 
 static struct clk i2c_ick = {
-    .name	= "i2c_ick",
-    .id		= 1,
-    .flags	= CLOCK_IN_OMAP16XX | ALWAYS_ENABLED,
-    .parent	= &armper_ck,
+    .name   = "i2c_ick",
+    .id     = 1,
+    .flags  = CLOCK_IN_OMAP16XX | ALWAYS_ENABLED,
+    .parent = &armper_ck,
 };
 
 static struct clk clk32k = {
-    .name	= "clk32-kHz",
-    .flags	= CLOCK_IN_OMAP310 | CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX |
+    .name   = "clk32-kHz",
+    .flags  = CLOCK_IN_OMAP310 | CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX |
             ALWAYS_ENABLED,
-    .parent	= &xtal_osc32k,
+    .parent = &xtal_osc32k,
 };
 
 static struct clk *onchip_clks[] = {
diff --git a/hw/timer/pxa2xx_timer.c b/hw/timer/pxa2xx_timer.c
index 7a94366b0f..6d4ac31574 100644
--- a/hw/timer/pxa2xx_timer.c
+++ b/hw/timer/pxa2xx_timer.c
@@ -19,41 +19,41 @@
 #include "qom/object.h"
 #include "system/watchdog.h"
 
-#define OSMR0	0x00
-#define OSMR1	0x04
-#define OSMR2	0x08
-#define OSMR3	0x0c
-#define OSMR4	0x80
-#define OSMR5	0x84
-#define OSMR6	0x88
-#define OSMR7	0x8c
-#define OSMR8	0x90
-#define OSMR9	0x94
-#define OSMR10	0x98
-#define OSMR11	0x9c
-#define OSCR	0x10	/* OS Timer Count */
-#define OSCR4	0x40
-#define OSCR5	0x44
-#define OSCR6	0x48
-#define OSCR7	0x4c
-#define OSCR8	0x50
-#define OSCR9	0x54
-#define OSCR10	0x58
-#define OSCR11	0x5c
-#define OSSR	0x14	/* Timer status register */
-#define OWER	0x18
-#define OIER	0x1c	/* Interrupt enable register  3-0 to E3-E0 */
-#define OMCR4	0xc0	/* OS Match Control registers */
-#define OMCR5	0xc4
-#define OMCR6	0xc8
-#define OMCR7	0xcc
-#define OMCR8	0xd0
-#define OMCR9	0xd4
-#define OMCR10	0xd8
-#define OMCR11	0xdc
-#define OSNR	0x20
+#define OSMR0   0x00
+#define OSMR1   0x04
+#define OSMR2   0x08
+#define OSMR3   0x0c
+#define OSMR4   0x80
+#define OSMR5   0x84
+#define OSMR6   0x88
+#define OSMR7   0x8c
+#define OSMR8   0x90
+#define OSMR9   0x94
+#define OSMR10  0x98
+#define OSMR11  0x9c
+#define OSCR    0x10    /* OS Timer Count */
+#define OSCR4   0x40
+#define OSCR5   0x44
+#define OSCR6   0x48
+#define OSCR7   0x4c
+#define OSCR8   0x50
+#define OSCR9   0x54
+#define OSCR10  0x58
+#define OSCR11  0x5c
+#define OSSR    0x14    /* Timer status register */
+#define OWER    0x18
+#define OIER    0x1c    /* Interrupt enable register  3-0 to E3-E0 */
+#define OMCR4   0xc0    /* OS Match Control registers */
+#define OMCR5   0xc4
+#define OMCR6   0xc8
+#define OMCR7   0xcc
+#define OMCR8   0xd0
+#define OMCR9   0xd4
+#define OMCR10  0xd8
+#define OMCR11  0xdc
+#define OSNR    0x20
 
-#define PXA25X_FREQ	3686400	/* 3.6864 MHz */
+#define PXA25X_FREQ 3686400 /* 3.6864 MHz */
 
 static int pxa2xx_timer4_freq[8] = {
     [0] = 0,
@@ -106,7 +106,7 @@ struct PXA2xxTimerInfo {
     PXA2xxTimer4 tm4[8];
 };
 
-#define PXA2XX_TIMER_HAVE_TM4	0
+#define PXA2XX_TIMER_HAVE_TM4   0
 
 static inline int pxa2xx_timer_has_tm4(PXA2xxTimerInfo *s)
 {
@@ -230,7 +230,7 @@ static uint64_t pxa2xx_timer_read(void *opaque, hwaddr offset,
                      NANOSECONDS_PER_SECOND);
     case OIER:
         return s->irq_enabled;
-    case OSSR:	/* Status register */
+    case OSSR:  /* Status register */
         return s->events;
     case OWER:
         return s->reset3;
@@ -336,7 +336,7 @@ static void pxa2xx_timer_write(void *opaque, hwaddr offset,
     case OIER:
         s->irq_enabled = value & 0xfff;
         break;
-    case OSSR:	/* Status register */
+    case OSSR:  /* Status register */
         value &= s->events;
         s->events &= ~value;
         for (i = 0; i < 4; i ++, value >>= 1)
@@ -345,7 +345,7 @@ static void pxa2xx_timer_write(void *opaque, hwaddr offset,
         if (pxa2xx_timer_has_tm4(s) && !(s->events & 0xff0) && value)
             qemu_irq_lower(s->irq4);
         break;
-    case OWER:	/* XXX: Reset on OSMR3 match? */
+    case OWER:  /* XXX: Reset on OSMR3 match? */
         s->reset3 = value;
         break;
     case OMCR7:  tm ++;
diff --git a/include/hw/arm/omap.h b/include/hw/arm/omap.h
index 6185507373..bdb2e887e4 100644
--- a/include/hw/arm/omap.h
+++ b/include/hw/arm/omap.h
@@ -25,24 +25,24 @@
 #include "qemu/log.h"
 #include "qom/object.h"
 
-# define OMAP_EMIFS_BASE	0x00000000
-# define OMAP_CS0_BASE		0x00000000
-# define OMAP_CS1_BASE		0x04000000
-# define OMAP_CS2_BASE		0x08000000
-# define OMAP_CS3_BASE		0x0c000000
-# define OMAP_EMIFF_BASE	0x10000000
-# define OMAP_IMIF_BASE		0x20000000
-# define OMAP_LOCALBUS_BASE	0x30000000
-# define OMAP_MPUI_BASE		0xe1000000
+#define OMAP_EMIFS_BASE    0x00000000
+#define OMAP_CS0_BASE      0x00000000
+#define OMAP_CS1_BASE      0x04000000
+#define OMAP_CS2_BASE      0x08000000
+#define OMAP_CS3_BASE      0x0c000000
+#define OMAP_EMIFF_BASE    0x10000000
+#define OMAP_IMIF_BASE     0x20000000
+#define OMAP_LOCALBUS_BASE 0x30000000
+#define OMAP_MPUI_BASE     0xe1000000
 
-# define OMAP730_SRAM_SIZE	0x00032000
-# define OMAP15XX_SRAM_SIZE	0x00030000
-# define OMAP16XX_SRAM_SIZE	0x00004000
-# define OMAP1611_SRAM_SIZE	0x0003e800
-# define OMAP_CS0_SIZE		0x04000000
-# define OMAP_CS1_SIZE		0x04000000
-# define OMAP_CS2_SIZE		0x04000000
-# define OMAP_CS3_SIZE		0x04000000
+#define OMAP730_SRAM_SIZE  0x00032000
+#define OMAP15XX_SRAM_SIZE 0x00030000
+#define OMAP16XX_SRAM_SIZE 0x00004000
+#define OMAP1611_SRAM_SIZE 0x0003e800
+#define OMAP_CS0_SIZE      0x04000000
+#define OMAP_CS1_SIZE      0x04000000
+#define OMAP_CS2_SIZE      0x04000000
+#define OMAP_CS3_SIZE      0x04000000
 
 /* omap_clk.c */
 struct omap_mpu_state_s;
@@ -103,228 +103,228 @@ void omap_gpio_set_clk(Omap1GpioState *gpio, omap_clk clk);
  * Common IRQ numbers for level 1 interrupt handler
  * See /usr/include/asm-arm/arch-omap/irqs.h in Linux.
  */
-# define OMAP_INT_CAMERA		1
-# define OMAP_INT_FIQ			3
-# define OMAP_INT_RTDX			6
-# define OMAP_INT_DSP_MMU_ABORT		7
-# define OMAP_INT_HOST			8
-# define OMAP_INT_ABORT			9
-# define OMAP_INT_BRIDGE_PRIV		13
-# define OMAP_INT_GPIO_BANK1		14
-# define OMAP_INT_UART3			15
-# define OMAP_INT_TIMER3		16
-# define OMAP_INT_DMA_CH0_6		19
-# define OMAP_INT_DMA_CH1_7		20
-# define OMAP_INT_DMA_CH2_8		21
-# define OMAP_INT_DMA_CH3		22
-# define OMAP_INT_DMA_CH4		23
-# define OMAP_INT_DMA_CH5		24
-# define OMAP_INT_DMA_LCD		25
-# define OMAP_INT_TIMER1		26
-# define OMAP_INT_WD_TIMER		27
-# define OMAP_INT_BRIDGE_PUB		28
-# define OMAP_INT_TIMER2		30
-# define OMAP_INT_LCD_CTRL		31
+#define OMAP_INT_CAMERA            1
+#define OMAP_INT_FIQ               3
+#define OMAP_INT_RTDX              6
+#define OMAP_INT_DSP_MMU_ABORT     7
+#define OMAP_INT_HOST              8
+#define OMAP_INT_ABORT             9
+#define OMAP_INT_BRIDGE_PRIV       13
+#define OMAP_INT_GPIO_BANK1        14
+#define OMAP_INT_UART3             15
+#define OMAP_INT_TIMER3            16
+#define OMAP_INT_DMA_CH0_6         19
+#define OMAP_INT_DMA_CH1_7         20
+#define OMAP_INT_DMA_CH2_8         21
+#define OMAP_INT_DMA_CH3           22
+#define OMAP_INT_DMA_CH4           23
+#define OMAP_INT_DMA_CH5           24
+#define OMAP_INT_DMA_LCD           25
+#define OMAP_INT_TIMER1            26
+#define OMAP_INT_WD_TIMER          27
+#define OMAP_INT_BRIDGE_PUB        28
+#define OMAP_INT_TIMER2            30
+#define OMAP_INT_LCD_CTRL          31
 
 /*
  * Common OMAP-15xx IRQ numbers for level 1 interrupt handler
  */
-# define OMAP_INT_15XX_IH2_IRQ		0
-# define OMAP_INT_15XX_LB_MMU		17
-# define OMAP_INT_15XX_LOCAL_BUS	29
+#define OMAP_INT_15XX_IH2_IRQ      0
+#define OMAP_INT_15XX_LB_MMU       17
+#define OMAP_INT_15XX_LOCAL_BUS    29
 
 /*
  * OMAP-1510 specific IRQ numbers for level 1 interrupt handler
  */
-# define OMAP_INT_1510_SPI_TX		4
-# define OMAP_INT_1510_SPI_RX		5
-# define OMAP_INT_1510_DSP_MAILBOX1	10
-# define OMAP_INT_1510_DSP_MAILBOX2	11
+#define OMAP_INT_1510_SPI_TX       4
+#define OMAP_INT_1510_SPI_RX       5
+#define OMAP_INT_1510_DSP_MAILBOX1 10
+#define OMAP_INT_1510_DSP_MAILBOX2 11
 
 /*
  * OMAP-310 specific IRQ numbers for level 1 interrupt handler
  */
-# define OMAP_INT_310_McBSP2_TX		4
-# define OMAP_INT_310_McBSP2_RX		5
-# define OMAP_INT_310_HSB_MAILBOX1	12
-# define OMAP_INT_310_HSAB_MMU		18
+#define OMAP_INT_310_McBSP2_TX     4
+#define OMAP_INT_310_McBSP2_RX     5
+#define OMAP_INT_310_HSB_MAILBOX1  12
+#define OMAP_INT_310_HSAB_MMU      18
 
 /*
  * OMAP-1610 specific IRQ numbers for level 1 interrupt handler
  */
-# define OMAP_INT_1610_IH2_IRQ		0
-# define OMAP_INT_1610_IH2_FIQ		2
-# define OMAP_INT_1610_McBSP2_TX	4
-# define OMAP_INT_1610_McBSP2_RX	5
-# define OMAP_INT_1610_DSP_MAILBOX1	10
-# define OMAP_INT_1610_DSP_MAILBOX2	11
-# define OMAP_INT_1610_LCD_LINE		12
-# define OMAP_INT_1610_GPTIMER1		17
-# define OMAP_INT_1610_GPTIMER2		18
-# define OMAP_INT_1610_SSR_FIFO_0	29
+#define OMAP_INT_1610_IH2_IRQ      0
+#define OMAP_INT_1610_IH2_FIQ      2
+#define OMAP_INT_1610_McBSP2_TX    4
+#define OMAP_INT_1610_McBSP2_RX    5
+#define OMAP_INT_1610_DSP_MAILBOX1 10
+#define OMAP_INT_1610_DSP_MAILBOX2 11
+#define OMAP_INT_1610_LCD_LINE     12
+#define OMAP_INT_1610_GPTIMER1     17
+#define OMAP_INT_1610_GPTIMER2     18
+#define OMAP_INT_1610_SSR_FIFO_0   29
 
 /*
  * OMAP-730 specific IRQ numbers for level 1 interrupt handler
  */
-# define OMAP_INT_730_IH2_FIQ		0
-# define OMAP_INT_730_IH2_IRQ		1
-# define OMAP_INT_730_USB_NON_ISO	2
-# define OMAP_INT_730_USB_ISO		3
-# define OMAP_INT_730_ICR		4
-# define OMAP_INT_730_EAC		5
-# define OMAP_INT_730_GPIO_BANK1	6
-# define OMAP_INT_730_GPIO_BANK2	7
-# define OMAP_INT_730_GPIO_BANK3	8
-# define OMAP_INT_730_McBSP2TX		10
-# define OMAP_INT_730_McBSP2RX		11
-# define OMAP_INT_730_McBSP2RX_OVF	12
-# define OMAP_INT_730_LCD_LINE		14
-# define OMAP_INT_730_GSM_PROTECT	15
-# define OMAP_INT_730_TIMER3		16
-# define OMAP_INT_730_GPIO_BANK5	17
-# define OMAP_INT_730_GPIO_BANK6	18
-# define OMAP_INT_730_SPGIO_WR		29
+#define OMAP_INT_730_IH2_FIQ       0
+#define OMAP_INT_730_IH2_IRQ       1
+#define OMAP_INT_730_USB_NON_ISO   2
+#define OMAP_INT_730_USB_ISO       3
+#define OMAP_INT_730_ICR           4
+#define OMAP_INT_730_EAC           5
+#define OMAP_INT_730_GPIO_BANK1    6
+#define OMAP_INT_730_GPIO_BANK2    7
+#define OMAP_INT_730_GPIO_BANK3    8
+#define OMAP_INT_730_McBSP2TX      10
+#define OMAP_INT_730_McBSP2RX      11
+#define OMAP_INT_730_McBSP2RX_OVF  12
+#define OMAP_INT_730_LCD_LINE      14
+#define OMAP_INT_730_GSM_PROTECT   15
+#define OMAP_INT_730_TIMER3        16
+#define OMAP_INT_730_GPIO_BANK5    17
+#define OMAP_INT_730_GPIO_BANK6    18
+#define OMAP_INT_730_SPGIO_WR      29
 
 /*
  * Common IRQ numbers for level 2 interrupt handler
  */
-# define OMAP_INT_KEYBOARD		1
-# define OMAP_INT_uWireTX		2
-# define OMAP_INT_uWireRX		3
-# define OMAP_INT_I2C			4
-# define OMAP_INT_MPUIO			5
-# define OMAP_INT_USB_HHC_1		6
-# define OMAP_INT_McBSP3TX		10
-# define OMAP_INT_McBSP3RX		11
-# define OMAP_INT_McBSP1TX		12
-# define OMAP_INT_McBSP1RX		13
-# define OMAP_INT_UART1			14
-# define OMAP_INT_UART2			15
-# define OMAP_INT_USB_W2FC		20
-# define OMAP_INT_1WIRE			21
-# define OMAP_INT_OS_TIMER		22
-# define OMAP_INT_OQN			23
-# define OMAP_INT_GAUGE_32K		24
-# define OMAP_INT_RTC_TIMER		25
-# define OMAP_INT_RTC_ALARM		26
-# define OMAP_INT_DSP_MMU		28
+#define OMAP_INT_KEYBOARD      1
+#define OMAP_INT_uWireTX       2
+#define OMAP_INT_uWireRX       3
+#define OMAP_INT_I2C           4
+#define OMAP_INT_MPUIO         5
+#define OMAP_INT_USB_HHC_1     6
+#define OMAP_INT_McBSP3TX      10
+#define OMAP_INT_McBSP3RX      11
+#define OMAP_INT_McBSP1TX      12
+#define OMAP_INT_McBSP1RX      13
+#define OMAP_INT_UART1         14
+#define OMAP_INT_UART2         15
+#define OMAP_INT_USB_W2FC      20
+#define OMAP_INT_1WIRE         21
+#define OMAP_INT_OS_TIMER      22
+#define OMAP_INT_OQN           23
+#define OMAP_INT_GAUGE_32K     24
+#define OMAP_INT_RTC_TIMER     25
+#define OMAP_INT_RTC_ALARM     26
+#define OMAP_INT_DSP_MMU       28
 
 /*
  * OMAP-1510 specific IRQ numbers for level 2 interrupt handler
  */
-# define OMAP_INT_1510_BT_MCSI1TX	16
-# define OMAP_INT_1510_BT_MCSI1RX	17
-# define OMAP_INT_1510_SoSSI_MATCH	19
-# define OMAP_INT_1510_MEM_STICK	27
-# define OMAP_INT_1510_COM_SPI_RO	31
+#define OMAP_INT_1510_BT_MCSI1TX   16
+#define OMAP_INT_1510_BT_MCSI1RX   17
+#define OMAP_INT_1510_SoSSI_MATCH  19
+#define OMAP_INT_1510_MEM_STICK    27
+#define OMAP_INT_1510_COM_SPI_RO   31
 
 /*
  * OMAP-310 specific IRQ numbers for level 2 interrupt handler
  */
-# define OMAP_INT_310_FAC		0
-# define OMAP_INT_310_USB_HHC_2		7
-# define OMAP_INT_310_MCSI1_FE		16
-# define OMAP_INT_310_MCSI2_FE		17
-# define OMAP_INT_310_USB_W2FC_ISO	29
-# define OMAP_INT_310_USB_W2FC_NON_ISO	30
-# define OMAP_INT_310_McBSP2RX_OF	31
+#define OMAP_INT_310_FAC               0
+#define OMAP_INT_310_USB_HHC_2         7
+#define OMAP_INT_310_MCSI1_FE          16
+#define OMAP_INT_310_MCSI2_FE          17
+#define OMAP_INT_310_USB_W2FC_ISO      29
+#define OMAP_INT_310_USB_W2FC_NON_ISO  30
+#define OMAP_INT_310_McBSP2RX_OF       31
 
 /*
  * OMAP-1610 specific IRQ numbers for level 2 interrupt handler
  */
-# define OMAP_INT_1610_FAC		0
-# define OMAP_INT_1610_USB_HHC_2	7
-# define OMAP_INT_1610_USB_OTG		8
-# define OMAP_INT_1610_SoSSI		9
-# define OMAP_INT_1610_BT_MCSI1TX	16
-# define OMAP_INT_1610_BT_MCSI1RX	17
-# define OMAP_INT_1610_SoSSI_MATCH	19
-# define OMAP_INT_1610_MEM_STICK	27
-# define OMAP_INT_1610_McBSP2RX_OF	31
-# define OMAP_INT_1610_STI		32
-# define OMAP_INT_1610_STI_WAKEUP	33
-# define OMAP_INT_1610_GPTIMER3		34
-# define OMAP_INT_1610_GPTIMER4		35
-# define OMAP_INT_1610_GPTIMER5		36
-# define OMAP_INT_1610_GPTIMER6		37
-# define OMAP_INT_1610_GPTIMER7		38
-# define OMAP_INT_1610_GPTIMER8		39
-# define OMAP_INT_1610_GPIO_BANK2	40
-# define OMAP_INT_1610_GPIO_BANK3	41
-# define OMAP_INT_1610_MMC2		42
-# define OMAP_INT_1610_CF		43
-# define OMAP_INT_1610_WAKE_UP_REQ	46
-# define OMAP_INT_1610_GPIO_BANK4	48
-# define OMAP_INT_1610_SPI		49
-# define OMAP_INT_1610_DMA_CH6		53
-# define OMAP_INT_1610_DMA_CH7		54
-# define OMAP_INT_1610_DMA_CH8		55
-# define OMAP_INT_1610_DMA_CH9		56
-# define OMAP_INT_1610_DMA_CH10		57
-# define OMAP_INT_1610_DMA_CH11		58
-# define OMAP_INT_1610_DMA_CH12		59
-# define OMAP_INT_1610_DMA_CH13		60
-# define OMAP_INT_1610_DMA_CH14		61
-# define OMAP_INT_1610_DMA_CH15		62
-# define OMAP_INT_1610_NAND		63
+#define OMAP_INT_1610_FAC          0
+#define OMAP_INT_1610_USB_HHC_2    7
+#define OMAP_INT_1610_USB_OTG      8
+#define OMAP_INT_1610_SoSSI        9
+#define OMAP_INT_1610_BT_MCSI1TX   16
+#define OMAP_INT_1610_BT_MCSI1RX   17
+#define OMAP_INT_1610_SoSSI_MATCH  19
+#define OMAP_INT_1610_MEM_STICK    27
+#define OMAP_INT_1610_McBSP2RX_OF  31
+#define OMAP_INT_1610_STI          32
+#define OMAP_INT_1610_STI_WAKEUP   33
+#define OMAP_INT_1610_GPTIMER3     34
+#define OMAP_INT_1610_GPTIMER4     35
+#define OMAP_INT_1610_GPTIMER5     36
+#define OMAP_INT_1610_GPTIMER6     37
+#define OMAP_INT_1610_GPTIMER7     38
+#define OMAP_INT_1610_GPTIMER8     39
+#define OMAP_INT_1610_GPIO_BANK2   40
+#define OMAP_INT_1610_GPIO_BANK3   41
+#define OMAP_INT_1610_MMC2         42
+#define OMAP_INT_1610_CF           43
+#define OMAP_INT_1610_WAKE_UP_REQ  46
+#define OMAP_INT_1610_GPIO_BANK4   48
+#define OMAP_INT_1610_SPI          49
+#define OMAP_INT_1610_DMA_CH6      53
+#define OMAP_INT_1610_DMA_CH7      54
+#define OMAP_INT_1610_DMA_CH8      55
+#define OMAP_INT_1610_DMA_CH9      56
+#define OMAP_INT_1610_DMA_CH10     57
+#define OMAP_INT_1610_DMA_CH11     58
+#define OMAP_INT_1610_DMA_CH12     59
+#define OMAP_INT_1610_DMA_CH13     60
+#define OMAP_INT_1610_DMA_CH14     61
+#define OMAP_INT_1610_DMA_CH15     62
+#define OMAP_INT_1610_NAND         63
 
 /*
  * OMAP-730 specific IRQ numbers for level 2 interrupt handler
  */
-# define OMAP_INT_730_HW_ERRORS		0
-# define OMAP_INT_730_NFIQ_PWR_FAIL	1
-# define OMAP_INT_730_CFCD		2
-# define OMAP_INT_730_CFIREQ		3
-# define OMAP_INT_730_I2C		4
-# define OMAP_INT_730_PCC		5
-# define OMAP_INT_730_MPU_EXT_NIRQ	6
-# define OMAP_INT_730_SPI_100K_1	7
-# define OMAP_INT_730_SYREN_SPI		8
-# define OMAP_INT_730_VLYNQ		9
-# define OMAP_INT_730_GPIO_BANK4	10
-# define OMAP_INT_730_McBSP1TX		11
-# define OMAP_INT_730_McBSP1RX		12
-# define OMAP_INT_730_McBSP1RX_OF	13
-# define OMAP_INT_730_UART_MODEM_IRDA_2	14
-# define OMAP_INT_730_UART_MODEM_1	15
-# define OMAP_INT_730_MCSI		16
-# define OMAP_INT_730_uWireTX		17
-# define OMAP_INT_730_uWireRX		18
-# define OMAP_INT_730_SMC_CD		19
-# define OMAP_INT_730_SMC_IREQ		20
-# define OMAP_INT_730_HDQ_1WIRE		21
-# define OMAP_INT_730_TIMER32K		22
-# define OMAP_INT_730_MMC_SDIO		23
-# define OMAP_INT_730_UPLD		24
-# define OMAP_INT_730_USB_HHC_1		27
-# define OMAP_INT_730_USB_HHC_2		28
-# define OMAP_INT_730_USB_GENI		29
-# define OMAP_INT_730_USB_OTG		30
-# define OMAP_INT_730_CAMERA_IF		31
-# define OMAP_INT_730_RNG		32
-# define OMAP_INT_730_DUAL_MODE_TIMER	33
-# define OMAP_INT_730_DBB_RF_EN		34
-# define OMAP_INT_730_MPUIO_KEYPAD	35
-# define OMAP_INT_730_SHA1_MD5		36
-# define OMAP_INT_730_SPI_100K_2	37
-# define OMAP_INT_730_RNG_IDLE		38
-# define OMAP_INT_730_MPUIO		39
-# define OMAP_INT_730_LLPC_LCD_CTRL_OFF	40
-# define OMAP_INT_730_LLPC_OE_FALLING	41
-# define OMAP_INT_730_LLPC_OE_RISING	42
-# define OMAP_INT_730_LLPC_VSYNC	43
-# define OMAP_INT_730_WAKE_UP_REQ	46
-# define OMAP_INT_730_DMA_CH6		53
-# define OMAP_INT_730_DMA_CH7		54
-# define OMAP_INT_730_DMA_CH8		55
-# define OMAP_INT_730_DMA_CH9		56
-# define OMAP_INT_730_DMA_CH10		57
-# define OMAP_INT_730_DMA_CH11		58
-# define OMAP_INT_730_DMA_CH12		59
-# define OMAP_INT_730_DMA_CH13		60
-# define OMAP_INT_730_DMA_CH14		61
-# define OMAP_INT_730_DMA_CH15		62
-# define OMAP_INT_730_NAND		63
+#define OMAP_INT_730_HW_ERRORS         0
+#define OMAP_INT_730_NFIQ_PWR_FAIL     1
+#define OMAP_INT_730_CFCD              2
+#define OMAP_INT_730_CFIREQ            3
+#define OMAP_INT_730_I2C               4
+#define OMAP_INT_730_PCC               5
+#define OMAP_INT_730_MPU_EXT_NIRQ      6
+#define OMAP_INT_730_SPI_100K_1        7
+#define OMAP_INT_730_SYREN_SPI         8
+#define OMAP_INT_730_VLYNQ             9
+#define OMAP_INT_730_GPIO_BANK4        10
+#define OMAP_INT_730_McBSP1TX          11
+#define OMAP_INT_730_McBSP1RX          12
+#define OMAP_INT_730_McBSP1RX_OF       13
+#define OMAP_INT_730_UART_MODEM_IRDA_2 14
+#define OMAP_INT_730_UART_MODEM_1      15
+#define OMAP_INT_730_MCSI              16
+#define OMAP_INT_730_uWireTX           17
+#define OMAP_INT_730_uWireRX           18
+#define OMAP_INT_730_SMC_CD            19
+#define OMAP_INT_730_SMC_IREQ          20
+#define OMAP_INT_730_HDQ_1WIRE         21
+#define OMAP_INT_730_TIMER32K          22
+#define OMAP_INT_730_MMC_SDIO          23
+#define OMAP_INT_730_UPLD              24
+#define OMAP_INT_730_USB_HHC_1         27
+#define OMAP_INT_730_USB_HHC_2         28
+#define OMAP_INT_730_USB_GENI          29
+#define OMAP_INT_730_USB_OTG           30
+#define OMAP_INT_730_CAMERA_IF         31
+#define OMAP_INT_730_RNG               32
+#define OMAP_INT_730_DUAL_MODE_TIMER   33
+#define OMAP_INT_730_DBB_RF_EN         34
+#define OMAP_INT_730_MPUIO_KEYPAD      35
+#define OMAP_INT_730_SHA1_MD5          36
+#define OMAP_INT_730_SPI_100K_2        37
+#define OMAP_INT_730_RNG_IDLE          38
+#define OMAP_INT_730_MPUIO             39
+#define OMAP_INT_730_LLPC_LCD_CTRL_OFF 40
+#define OMAP_INT_730_LLPC_OE_FALLING   41
+#define OMAP_INT_730_LLPC_OE_RISING    42
+#define OMAP_INT_730_LLPC_VSYNC        43
+#define OMAP_INT_730_WAKE_UP_REQ       46
+#define OMAP_INT_730_DMA_CH6           53
+#define OMAP_INT_730_DMA_CH7           54
+#define OMAP_INT_730_DMA_CH8           55
+#define OMAP_INT_730_DMA_CH9           56
+#define OMAP_INT_730_DMA_CH10          57
+#define OMAP_INT_730_DMA_CH11          58
+#define OMAP_INT_730_DMA_CH12          59
+#define OMAP_INT_730_DMA_CH13          60
+#define OMAP_INT_730_DMA_CH14          61
+#define OMAP_INT_730_DMA_CH15          62
+#define OMAP_INT_730_NAND              63
 
 /* omap_dma.c */
 enum omap_dma_model {
@@ -353,9 +353,9 @@ struct dma_irq_map {
 enum omap_dma_port {
     emiff = 0,
     emifs,
-    imif,	/* omap16xx: ocp_t1 */
+    imif,   /* omap16xx: ocp_t1 */
     tipb,
-    local,	/* omap16xx: ocp_t2 */
+    local,  /* omap16xx: ocp_t2 */
     tipb_mpui,
     __omap_dma_port_last,
 };
@@ -418,65 +418,65 @@ struct omap_dma_lcd_channel_s {
  * DMA request numbers for OMAP1
  * See /usr/include/asm-arm/arch-omap/dma.h in Linux.
  */
-# define OMAP_DMA_NO_DEVICE		0
-# define OMAP_DMA_MCSI1_TX		1
-# define OMAP_DMA_MCSI1_RX		2
-# define OMAP_DMA_I2C_RX		3
-# define OMAP_DMA_I2C_TX		4
-# define OMAP_DMA_EXT_NDMA_REQ0		5
-# define OMAP_DMA_EXT_NDMA_REQ1		6
-# define OMAP_DMA_UWIRE_TX		7
-# define OMAP_DMA_MCBSP1_TX		8
-# define OMAP_DMA_MCBSP1_RX		9
-# define OMAP_DMA_MCBSP3_TX		10
-# define OMAP_DMA_MCBSP3_RX		11
-# define OMAP_DMA_UART1_TX		12
-# define OMAP_DMA_UART1_RX		13
-# define OMAP_DMA_UART2_TX		14
-# define OMAP_DMA_UART2_RX		15
-# define OMAP_DMA_MCBSP2_TX		16
-# define OMAP_DMA_MCBSP2_RX		17
-# define OMAP_DMA_UART3_TX		18
-# define OMAP_DMA_UART3_RX		19
-# define OMAP_DMA_CAMERA_IF_RX		20
-# define OMAP_DMA_MMC_TX		21
-# define OMAP_DMA_MMC_RX		22
-# define OMAP_DMA_NAND			23	/* Not in OMAP310 */
-# define OMAP_DMA_IRQ_LCD_LINE		24	/* Not in OMAP310 */
-# define OMAP_DMA_MEMORY_STICK		25	/* Not in OMAP310 */
-# define OMAP_DMA_USB_W2FC_RX0		26
-# define OMAP_DMA_USB_W2FC_RX1		27
-# define OMAP_DMA_USB_W2FC_RX2		28
-# define OMAP_DMA_USB_W2FC_TX0		29
-# define OMAP_DMA_USB_W2FC_TX1		30
-# define OMAP_DMA_USB_W2FC_TX2		31
+#define OMAP_DMA_NO_DEVICE         0
+#define OMAP_DMA_MCSI1_TX          1
+#define OMAP_DMA_MCSI1_RX          2
+#define OMAP_DMA_I2C_RX            3
+#define OMAP_DMA_I2C_TX            4
+#define OMAP_DMA_EXT_NDMA_REQ0     5
+#define OMAP_DMA_EXT_NDMA_REQ1     6
+#define OMAP_DMA_UWIRE_TX          7
+#define OMAP_DMA_MCBSP1_TX         8
+#define OMAP_DMA_MCBSP1_RX         9
+#define OMAP_DMA_MCBSP3_TX         10
+#define OMAP_DMA_MCBSP3_RX         11
+#define OMAP_DMA_UART1_TX          12
+#define OMAP_DMA_UART1_RX          13
+#define OMAP_DMA_UART2_TX          14
+#define OMAP_DMA_UART2_RX          15
+#define OMAP_DMA_MCBSP2_TX         16
+#define OMAP_DMA_MCBSP2_RX         17
+#define OMAP_DMA_UART3_TX          18
+#define OMAP_DMA_UART3_RX          19
+#define OMAP_DMA_CAMERA_IF_RX      20
+#define OMAP_DMA_MMC_TX            21
+#define OMAP_DMA_MMC_RX            22
+#define OMAP_DMA_NAND              23  /* Not in OMAP310 */
+#define OMAP_DMA_IRQ_LCD_LINE      24  /* Not in OMAP310 */
+#define OMAP_DMA_MEMORY_STICK      25  /* Not in OMAP310 */
+#define OMAP_DMA_USB_W2FC_RX0      26
+#define OMAP_DMA_USB_W2FC_RX1      27
+#define OMAP_DMA_USB_W2FC_RX2      28
+#define OMAP_DMA_USB_W2FC_TX0      29
+#define OMAP_DMA_USB_W2FC_TX1      30
+#define OMAP_DMA_USB_W2FC_TX2      31
 
 /* These are only for 1610 */
-# define OMAP_DMA_CRYPTO_DES_IN		32
-# define OMAP_DMA_SPI_TX		33
-# define OMAP_DMA_SPI_RX		34
-# define OMAP_DMA_CRYPTO_HASH		35
-# define OMAP_DMA_CCP_ATTN		36
-# define OMAP_DMA_CCP_FIFO_NOT_EMPTY	37
-# define OMAP_DMA_CMT_APE_TX_CHAN_0	38
-# define OMAP_DMA_CMT_APE_RV_CHAN_0	39
-# define OMAP_DMA_CMT_APE_TX_CHAN_1	40
-# define OMAP_DMA_CMT_APE_RV_CHAN_1	41
-# define OMAP_DMA_CMT_APE_TX_CHAN_2	42
-# define OMAP_DMA_CMT_APE_RV_CHAN_2	43
-# define OMAP_DMA_CMT_APE_TX_CHAN_3	44
-# define OMAP_DMA_CMT_APE_RV_CHAN_3	45
-# define OMAP_DMA_CMT_APE_TX_CHAN_4	46
-# define OMAP_DMA_CMT_APE_RV_CHAN_4	47
-# define OMAP_DMA_CMT_APE_TX_CHAN_5	48
-# define OMAP_DMA_CMT_APE_RV_CHAN_5	49
-# define OMAP_DMA_CMT_APE_TX_CHAN_6	50
-# define OMAP_DMA_CMT_APE_RV_CHAN_6	51
-# define OMAP_DMA_CMT_APE_TX_CHAN_7	52
-# define OMAP_DMA_CMT_APE_RV_CHAN_7	53
-# define OMAP_DMA_MMC2_TX		54
-# define OMAP_DMA_MMC2_RX		55
-# define OMAP_DMA_CRYPTO_DES_OUT	56
+#define OMAP_DMA_CRYPTO_DES_IN         32
+#define OMAP_DMA_SPI_TX                33
+#define OMAP_DMA_SPI_RX                34
+#define OMAP_DMA_CRYPTO_HASH           35
+#define OMAP_DMA_CCP_ATTN              36
+#define OMAP_DMA_CCP_FIFO_NOT_EMPTY    37
+#define OMAP_DMA_CMT_APE_TX_CHAN_0     38
+#define OMAP_DMA_CMT_APE_RV_CHAN_0     39
+#define OMAP_DMA_CMT_APE_TX_CHAN_1     40
+#define OMAP_DMA_CMT_APE_RV_CHAN_1     41
+#define OMAP_DMA_CMT_APE_TX_CHAN_2     42
+#define OMAP_DMA_CMT_APE_RV_CHAN_2     43
+#define OMAP_DMA_CMT_APE_TX_CHAN_3     44
+#define OMAP_DMA_CMT_APE_RV_CHAN_3     45
+#define OMAP_DMA_CMT_APE_TX_CHAN_4     46
+#define OMAP_DMA_CMT_APE_RV_CHAN_4     47
+#define OMAP_DMA_CMT_APE_TX_CHAN_5     48
+#define OMAP_DMA_CMT_APE_RV_CHAN_5     49
+#define OMAP_DMA_CMT_APE_TX_CHAN_6     50
+#define OMAP_DMA_CMT_APE_RV_CHAN_6     51
+#define OMAP_DMA_CMT_APE_TX_CHAN_7     52
+#define OMAP_DMA_CMT_APE_RV_CHAN_7     53
+#define OMAP_DMA_MMC2_TX               54
+#define OMAP_DMA_MMC2_RX               55
+#define OMAP_DMA_CRYPTO_DES_OUT        56
 
 struct omap_uart_s;
 struct omap_uart_s *omap_uart_init(hwaddr base,
@@ -542,14 +542,14 @@ void omap_mmc_set_clk(DeviceState *dev, omap_clk clk);
 /* omap_i2c.c */
 I2CBus *omap_i2c_bus(DeviceState *omap_i2c);
 
-# define cpu_is_omap310(cpu)		(cpu->mpu_model == omap310)
-# define cpu_is_omap1510(cpu)		(cpu->mpu_model == omap1510)
-# define cpu_is_omap1610(cpu)		(cpu->mpu_model == omap1610)
-# define cpu_is_omap1710(cpu)		(cpu->mpu_model == omap1710)
+#define cpu_is_omap310(cpu)        (cpu->mpu_model == omap310)
+#define cpu_is_omap1510(cpu)       (cpu->mpu_model == omap1510)
+#define cpu_is_omap1610(cpu)       (cpu->mpu_model == omap1610)
+#define cpu_is_omap1710(cpu)       (cpu->mpu_model == omap1710)
 
-# define cpu_is_omap15xx(cpu)		\
+#define cpu_is_omap15xx(cpu)       \
         (cpu_is_omap310(cpu) || cpu_is_omap1510(cpu))
-# define cpu_is_omap16xx(cpu)		\
+#define cpu_is_omap16xx(cpu)       \
         (cpu_is_omap1610(cpu) || cpu_is_omap1710(cpu))
 
 struct omap_mpu_state_s {
@@ -685,14 +685,14 @@ void omap_badwidth_write32(void *opaque, hwaddr addr,
 
 void omap_mpu_wakeup(void *opaque, int irq, int req);
 
-# define OMAP_BAD_REG(paddr)		\
+#define OMAP_BAD_REG(paddr)        \
         qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad register %#08"HWADDR_PRIx"\n", \
                       __func__, paddr)
-# define OMAP_RO_REG(paddr)		\
+#define OMAP_RO_REG(paddr)     \
         qemu_log_mask(LOG_GUEST_ERROR, "%s: Read-only register %#08" \
                                        HWADDR_PRIx "\n", \
                       __func__, paddr)
 
-# define OMAP_MPUI_REG_MASK		0x000007ff
+#define OMAP_MPUI_REG_MASK     0x000007ff
 
 #endif
diff --git a/include/hw/arm/sharpsl.h b/include/hw/arm/sharpsl.h
index e986b28c52..1e3992fcd0 100644
--- a/include/hw/arm/sharpsl.h
+++ b/include/hw/arm/sharpsl.h
@@ -11,7 +11,7 @@
 
 /* zaurus.c */
 
-#define SL_PXA_PARAM_BASE	0xa0000a00
+#define SL_PXA_PARAM_BASE   0xa0000a00
 void sl_bootparam_write(hwaddr ptr);
 
 #endif
diff --git a/include/hw/arm/soc_dma.h b/include/hw/arm/soc_dma.h
index e93a7499a8..bcdb91425a 100644
--- a/include/hw/arm/soc_dma.h
+++ b/include/hw/arm/soc_dma.h
@@ -54,7 +54,7 @@ struct soc_dma_ch_s {
     int bytes;
     /* Initialised by the DMA module, call soc_dma_ch_update after writing.  */
     enum soc_dma_access_type type[2];
-    hwaddr vaddr[2];	/* Updated by .transfer_fn().  */
+    hwaddr vaddr[2];    /* Updated by .transfer_fn().  */
     /* Private */
     void *paddr[2];
     soc_dma_io_t io_fn[2];
@@ -70,7 +70,7 @@ struct soc_dma_ch_s {
 struct soc_dma_s {
     /* Following fields are set by the SoC DMA module and can be used
      * by anybody.  */
-    uint64_t drqbmp;	/* Is zeroed by soc_dma_reset() */
+    uint64_t drqbmp;    /* Is zeroed by soc_dma_reset() */
     qemu_irq *drq;
     void *opaque;
     int64_t freq;

From 2a952e052ab0dab5dc309f9521e655e1011c92a8 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Wed, 14 May 2025 14:29:47 +0100
Subject: [PATCH 0895/2760] MAINTAINERS: Add an entry for the Bananapi machine

This machine was still missing from the MAINTAINERS file. Since there
is likely no active maintainer around for this machine (I didn't spot
any contributions from Qianfan Zhao in the git log after 2023), I'm
suggesting Peter as maintainer with status set to "Odd fixes".

Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-id: 20250508072706.114278-1-thuth@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 MAINTAINERS | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/MAINTAINERS b/MAINTAINERS
index 6dacd6d004..ca0ffc02d4 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -732,6 +732,16 @@ F: include/hw/timer/armv7m_systick.h
 F: include/hw/misc/armv7m_ras.h
 F: tests/qtest/test-arm-mptimer.c
 
+Bananapi M2U
+M: Peter Maydell <peter.maydell@linaro.org>
+L: qemu-arm@nongnu.org
+S: Odd Fixes
+F: docs/system/arm/bananapi_m2u.rst
+F: hw/*/allwinner-r40*.c
+F: hw/arm/bananapi_m2u.c
+F: include/hw/*/allwinner-r40*.h
+F: tests/functional/test_arm_bpim2u.py
+
 B-L475E-IOT01A IoT Node
 M: Samuel Tardieu <sam@rfc1149.net>
 L: qemu-arm@nongnu.org

From 133edc4f220c9c415f68832e6341f461bf04152a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 12 May 2025 11:04:15 -0700
Subject: [PATCH 0896/2760] target/arm: Replace target_ulong -> vaddr for
 HWBreakpoint
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-id: 20250512180502.2395029-2-pierrick.bouvier@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/hyp_gdbstub.c | 6 +++---
 target/arm/internals.h   | 6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/target/arm/hyp_gdbstub.c b/target/arm/hyp_gdbstub.c
index 0512d67f8c..bb5969720c 100644
--- a/target/arm/hyp_gdbstub.c
+++ b/target/arm/hyp_gdbstub.c
@@ -54,7 +54,7 @@ GArray *hw_breakpoints, *hw_watchpoints;
  * here so future PC comparisons will work properly.
  */
 
-int insert_hw_breakpoint(target_ulong addr)
+int insert_hw_breakpoint(vaddr addr)
 {
     HWBreakpoint brk = {
         .bcr = 0x1,                             /* BCR E=1, enable */
@@ -80,7 +80,7 @@ int insert_hw_breakpoint(target_ulong addr)
  * Delete a breakpoint and shuffle any above down
  */
 
-int delete_hw_breakpoint(target_ulong pc)
+int delete_hw_breakpoint(vaddr pc)
 {
     int i;
     for (i = 0; i < hw_breakpoints->len; i++) {
@@ -226,7 +226,7 @@ int delete_hw_watchpoint(vaddr addr, vaddr len, int type)
     return -ENOENT;
 }
 
-bool find_hw_breakpoint(CPUState *cpu, target_ulong pc)
+bool find_hw_breakpoint(CPUState *cpu, vaddr pc)
 {
     int i;
 
diff --git a/target/arm/internals.h b/target/arm/internals.h
index 702eb1a548..3360de9150 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -1948,9 +1948,9 @@ extern GArray *hw_breakpoints, *hw_watchpoints;
 #define get_hw_bp(i)    (&g_array_index(hw_breakpoints, HWBreakpoint, i))
 #define get_hw_wp(i)    (&g_array_index(hw_watchpoints, HWWatchpoint, i))
 
-bool find_hw_breakpoint(CPUState *cpu, target_ulong pc);
-int insert_hw_breakpoint(target_ulong pc);
-int delete_hw_breakpoint(target_ulong pc);
+bool find_hw_breakpoint(CPUState *cpu, vaddr pc);
+int insert_hw_breakpoint(vaddr pc);
+int delete_hw_breakpoint(vaddr pc);
 
 bool check_watchpoint_in_range(int i, vaddr addr);
 CPUWatchpoint *find_hw_watchpoint(CPUState *cpu, vaddr addr);

From af3ca6e7f09d8ed0e8c9a3fff55d7a68b5019033 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 12 May 2025 11:04:16 -0700
Subject: [PATCH 0897/2760] include/system/hvf: missing vaddr include
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

On MacOS x86_64:
In file included from ../target/i386/hvf/x86_task.c:13:
/Users/runner/work/qemu/qemu/include/system/hvf.h:42:5: error: unknown type name 'vaddr'
    vaddr pc;
    ^
/Users/runner/work/qemu/qemu/include/system/hvf.h:43:5: error: unknown type name 'vaddr'
    vaddr saved_insn;
    ^
/Users/runner/work/qemu/qemu/include/system/hvf.h:45:5: error: type name requires a specifier or qualifier
    QTAILQ_ENTRY(hvf_sw_breakpoint) entry;
    ^
/Users/runner/work/qemu/qemu/include/system/hvf.h:45:18: error: a parameter list without types is only allowed in a function definition
    QTAILQ_ENTRY(hvf_sw_breakpoint) entry;
                 ^
/Users/runner/work/qemu/qemu/include/system/hvf.h:45:36: error: expected ';' at end of declaration list
    QTAILQ_ENTRY(hvf_sw_breakpoint) entry;

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-id: 20250512180502.2395029-3-pierrick.bouvier@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/system/hvf.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/include/system/hvf.h b/include/system/hvf.h
index 7b45a2e198..a9a502f0c8 100644
--- a/include/system/hvf.h
+++ b/include/system/hvf.h
@@ -17,6 +17,7 @@
 #include "qemu/queue.h"
 #include "exec/vaddr.h"
 #include "qom/object.h"
+#include "exec/vaddr.h"
 
 #ifdef COMPILING_PER_TARGET
 # ifdef CONFIG_HVF

From b2bb3f3576e5dc99218607dde09e25ac0e55693c Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 12 May 2025 11:04:17 -0700
Subject: [PATCH 0898/2760] meson: add common libs for target and target_system

Following what we did for hw/, we need target specific common libraries
for target. We need 2 different libraries:
- code common to a base architecture
- system code common to a base architecture

For user code, it can stay compiled per target for now.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-id: 20250512180502.2395029-4-pierrick.bouvier@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 meson.build | 78 +++++++++++++++++++++++++++++++++++++++++------------
 1 file changed, 61 insertions(+), 17 deletions(-)

diff --git a/meson.build b/meson.build
index 7f91500bb7..ad2053f968 100644
--- a/meson.build
+++ b/meson.build
@@ -3709,6 +3709,8 @@ target_arch = {}
 target_system_arch = {}
 target_user_arch = {}
 hw_common_arch = {}
+target_common_arch = {}
+target_common_system_arch = {}
 
 # NOTE: the trace/ subdirectory needs the qapi_trace_events variable
 # that is filled in by qapi/.
@@ -4107,29 +4109,59 @@ common_all = static_library('common',
 
 # construct common libraries per base architecture
 hw_common_arch_libs = {}
+target_common_arch_libs = {}
+target_common_system_arch_libs = {}
 foreach target : target_dirs
   config_target = config_target_mak[target]
   target_base_arch = config_target['TARGET_BASE_ARCH']
+  target_inc = [include_directories('target' / target_base_arch)]
+  inc = [common_user_inc + target_inc]
 
-  # check if already generated
-  if target_base_arch in hw_common_arch_libs
-    continue
-  endif
+  # prevent common code to access cpu compile time definition,
+  # but still allow access to cpu.h
+  target_c_args = ['-DCPU_DEFS_H']
+  target_system_c_args = target_c_args + ['-DCOMPILING_SYSTEM_VS_USER', '-DCONFIG_SOFTMMU']
 
   if target_base_arch in hw_common_arch
-    target_inc = [include_directories('target' / target_base_arch)]
-    src = hw_common_arch[target_base_arch]
-    lib = static_library(
-      'hw_' + target_base_arch,
-      build_by_default: false,
-      sources: src.all_sources() + genh,
-      include_directories: common_user_inc + target_inc,
-      implicit_include_directories: false,
-      # prevent common code to access cpu compile time
-      # definition, but still allow access to cpu.h
-      c_args: ['-DCPU_DEFS_H', '-DCOMPILING_SYSTEM_VS_USER', '-DCONFIG_SOFTMMU'],
-      dependencies: src.all_dependencies())
-    hw_common_arch_libs += {target_base_arch: lib}
+    if target_base_arch not in hw_common_arch_libs
+      src = hw_common_arch[target_base_arch]
+      lib = static_library(
+        'hw_' + target_base_arch,
+        build_by_default: false,
+        sources: src.all_sources() + genh,
+        include_directories: inc,
+        c_args: target_system_c_args,
+        dependencies: src.all_dependencies())
+      hw_common_arch_libs += {target_base_arch: lib}
+    endif
+  endif
+
+  if target_base_arch in target_common_arch
+    if target_base_arch not in target_common_arch_libs
+      src = target_common_arch[target_base_arch]
+      lib = static_library(
+        'target_' + target_base_arch,
+        build_by_default: false,
+        sources: src.all_sources() + genh,
+        include_directories: inc,
+        c_args: target_c_args,
+        dependencies: src.all_dependencies())
+      target_common_arch_libs += {target_base_arch: lib}
+    endif
+  endif
+
+  if target_base_arch in target_common_system_arch
+    if target_base_arch not in target_common_system_arch_libs
+      src = target_common_system_arch[target_base_arch]
+      lib = static_library(
+        'target_system_' + target_base_arch,
+        build_by_default: false,
+        sources: src.all_sources() + genh,
+        include_directories: inc,
+        c_args: target_system_c_args,
+        dependencies: src.all_dependencies())
+      target_common_system_arch_libs += {target_base_arch: lib}
+    endif
   endif
 endforeach
 
@@ -4300,12 +4332,24 @@ foreach target : target_dirs
   target_common = common_ss.apply(config_target, strict: false)
   objects = [common_all.extract_objects(target_common.sources())]
   arch_deps += target_common.dependencies()
+  if target_base_arch in target_common_arch_libs
+    src = target_common_arch[target_base_arch].apply(config_target, strict: false)
+    lib = target_common_arch_libs[target_base_arch]
+    objects += lib.extract_objects(src.sources())
+    arch_deps += src.dependencies()
+  endif
   if target_type == 'system' and target_base_arch in hw_common_arch_libs
     src = hw_common_arch[target_base_arch].apply(config_target, strict: false)
     lib = hw_common_arch_libs[target_base_arch]
     objects += lib.extract_objects(src.sources())
     arch_deps += src.dependencies()
   endif
+  if target_type == 'system' and target_base_arch in target_common_system_arch_libs
+    src = target_common_system_arch[target_base_arch].apply(config_target, strict: false)
+    lib = target_common_system_arch_libs[target_base_arch]
+    objects += lib.extract_objects(src.sources())
+    arch_deps += src.dependencies()
+  endif
 
   target_specific = specific_ss.apply(config_target, strict: false)
   arch_srcs += target_specific.sources()

From 9a27ee9ca4999cd9f299dfc33e8af7d789ddc6c6 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 12 May 2025 11:04:18 -0700
Subject: [PATCH 0899/2760] target/arm: move kvm stubs and remove CONFIG_KVM
 from kvm_arm.h
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add a forward decl for struct kvm_vcpu_init to avoid pulling all kvm
headers.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250512180502.2395029-5-pierrick.bouvier@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/kvm-stub.c | 77 +++++++++++++++++++++++++++++++++++++++
 target/arm/kvm_arm.h  | 83 +------------------------------------------
 2 files changed, 78 insertions(+), 82 deletions(-)

diff --git a/target/arm/kvm-stub.c b/target/arm/kvm-stub.c
index 965a486b32..2b73d0598c 100644
--- a/target/arm/kvm-stub.c
+++ b/target/arm/kvm-stub.c
@@ -22,3 +22,80 @@ bool write_list_to_kvmstate(ARMCPU *cpu, int level)
 {
     g_assert_not_reached();
 }
+
+/*
+ * It's safe to call these functions without KVM support.
+ * They should either do nothing or return "not supported".
+ */
+bool kvm_arm_aarch32_supported(void)
+{
+    return false;
+}
+
+bool kvm_arm_pmu_supported(void)
+{
+    return false;
+}
+
+bool kvm_arm_sve_supported(void)
+{
+    return false;
+}
+
+bool kvm_arm_mte_supported(void)
+{
+    return false;
+}
+
+/*
+ * These functions should never actually be called without KVM support.
+ */
+void kvm_arm_set_cpu_features_from_host(ARMCPU *cpu)
+{
+    g_assert_not_reached();
+}
+
+void kvm_arm_add_vcpu_properties(ARMCPU *cpu)
+{
+    g_assert_not_reached();
+}
+
+int kvm_arm_get_max_vm_ipa_size(MachineState *ms, bool *fixed_ipa)
+{
+    g_assert_not_reached();
+}
+
+int kvm_arm_vgic_probe(void)
+{
+    g_assert_not_reached();
+}
+
+void kvm_arm_pmu_set_irq(ARMCPU *cpu, int irq)
+{
+    g_assert_not_reached();
+}
+
+void kvm_arm_pmu_init(ARMCPU *cpu)
+{
+    g_assert_not_reached();
+}
+
+void kvm_arm_pvtime_init(ARMCPU *cpu, uint64_t ipa)
+{
+    g_assert_not_reached();
+}
+
+void kvm_arm_steal_time_finalize(ARMCPU *cpu, Error **errp)
+{
+    g_assert_not_reached();
+}
+
+uint32_t kvm_arm_sve_get_vls(ARMCPU *cpu)
+{
+    g_assert_not_reached();
+}
+
+void kvm_arm_enable_mte(Object *cpuobj, Error **errp)
+{
+    g_assert_not_reached();
+}
diff --git a/target/arm/kvm_arm.h b/target/arm/kvm_arm.h
index 5f17fc2f3d..5bf5d56648 100644
--- a/target/arm/kvm_arm.h
+++ b/target/arm/kvm_arm.h
@@ -94,7 +94,7 @@ void kvm_arm_cpu_post_load(ARMCPU *cpu);
  */
 void kvm_arm_reset_vcpu(ARMCPU *cpu);
 
-#ifdef CONFIG_KVM
+struct kvm_vcpu_init;
 /**
  * kvm_arm_create_scratch_host_vcpu:
  * @fdarray: filled in with kvmfd, vmfd, cpufd file descriptors in that order
@@ -216,85 +216,4 @@ int kvm_arm_set_irq(int cpu, int irqtype, int irq, int level);
 
 void kvm_arm_enable_mte(Object *cpuobj, Error **errp);
 
-#else
-
-/*
- * It's safe to call these functions without KVM support.
- * They should either do nothing or return "not supported".
- */
-static inline bool kvm_arm_aarch32_supported(void)
-{
-    return false;
-}
-
-static inline bool kvm_arm_pmu_supported(void)
-{
-    return false;
-}
-
-static inline bool kvm_arm_sve_supported(void)
-{
-    return false;
-}
-
-static inline bool kvm_arm_mte_supported(void)
-{
-    return false;
-}
-
-/*
- * These functions should never actually be called without KVM support.
- */
-static inline void kvm_arm_set_cpu_features_from_host(ARMCPU *cpu)
-{
-    g_assert_not_reached();
-}
-
-static inline void kvm_arm_add_vcpu_properties(ARMCPU *cpu)
-{
-    g_assert_not_reached();
-}
-
-static inline int kvm_arm_get_max_vm_ipa_size(MachineState *ms, bool *fixed_ipa)
-{
-    g_assert_not_reached();
-}
-
-static inline int kvm_arm_vgic_probe(void)
-{
-    g_assert_not_reached();
-}
-
-static inline void kvm_arm_pmu_set_irq(ARMCPU *cpu, int irq)
-{
-    g_assert_not_reached();
-}
-
-static inline void kvm_arm_pmu_init(ARMCPU *cpu)
-{
-    g_assert_not_reached();
-}
-
-static inline void kvm_arm_pvtime_init(ARMCPU *cpu, uint64_t ipa)
-{
-    g_assert_not_reached();
-}
-
-static inline void kvm_arm_steal_time_finalize(ARMCPU *cpu, Error **errp)
-{
-    g_assert_not_reached();
-}
-
-static inline uint32_t kvm_arm_sve_get_vls(ARMCPU *cpu)
-{
-    g_assert_not_reached();
-}
-
-static inline void kvm_arm_enable_mte(Object *cpuobj, Error **errp)
-{
-    g_assert_not_reached();
-}
-
-#endif
-
 #endif

From 2bff5f4715c85854bc133b56f5f09606f0ed9a5b Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 12 May 2025 11:04:19 -0700
Subject: [PATCH 0900/2760] target/arm/kvm-stub: add kvm_arm_reset_vcpu stub
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Needed in target/arm/cpu.c once kvm is possible.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250512180502.2395029-6-pierrick.bouvier@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/kvm-stub.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/target/arm/kvm-stub.c b/target/arm/kvm-stub.c
index 2b73d0598c..e34d3f5e6b 100644
--- a/target/arm/kvm-stub.c
+++ b/target/arm/kvm-stub.c
@@ -99,3 +99,8 @@ void kvm_arm_enable_mte(Object *cpuobj, Error **errp)
 {
     g_assert_not_reached();
 }
+
+void kvm_arm_reset_vcpu(ARMCPU *cpu)
+{
+    g_assert_not_reached();
+}

From 3a2964ccb4ebec97764d2b6168b60b778cc52b2f Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 12 May 2025 11:04:20 -0700
Subject: [PATCH 0901/2760] target/arm/cpu: move arm_cpu_kvm_set_irq to kvm.c
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Allow to get rid of CONFIG_KVM in target/arm/cpu.c

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-id: 20250512180502.2395029-7-pierrick.bouvier@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.c      | 31 -------------------------------
 target/arm/kvm-stub.c |  5 +++++
 target/arm/kvm.c      | 29 +++++++++++++++++++++++++++++
 target/arm/kvm_arm.h  |  2 ++
 4 files changed, 36 insertions(+), 31 deletions(-)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index 603f08d05a..6604769341 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -1098,37 +1098,6 @@ static void arm_cpu_set_irq(void *opaque, int irq, int level)
     }
 }
 
-static void arm_cpu_kvm_set_irq(void *opaque, int irq, int level)
-{
-#ifdef CONFIG_KVM
-    ARMCPU *cpu = opaque;
-    CPUARMState *env = &cpu->env;
-    CPUState *cs = CPU(cpu);
-    uint32_t linestate_bit;
-    int irq_id;
-
-    switch (irq) {
-    case ARM_CPU_IRQ:
-        irq_id = KVM_ARM_IRQ_CPU_IRQ;
-        linestate_bit = CPU_INTERRUPT_HARD;
-        break;
-    case ARM_CPU_FIQ:
-        irq_id = KVM_ARM_IRQ_CPU_FIQ;
-        linestate_bit = CPU_INTERRUPT_FIQ;
-        break;
-    default:
-        g_assert_not_reached();
-    }
-
-    if (level) {
-        env->irq_line_state |= linestate_bit;
-    } else {
-        env->irq_line_state &= ~linestate_bit;
-    }
-    kvm_arm_set_irq(cs->cpu_index, KVM_ARM_IRQ_TYPE_CPU, irq_id, !!level);
-#endif
-}
-
 static bool arm_cpu_virtio_is_big_endian(CPUState *cs)
 {
     ARMCPU *cpu = ARM_CPU(cs);
diff --git a/target/arm/kvm-stub.c b/target/arm/kvm-stub.c
index e34d3f5e6b..4806365cdc 100644
--- a/target/arm/kvm-stub.c
+++ b/target/arm/kvm-stub.c
@@ -104,3 +104,8 @@ void kvm_arm_reset_vcpu(ARMCPU *cpu)
 {
     g_assert_not_reached();
 }
+
+void arm_cpu_kvm_set_irq(void *arm_cpu, int irq, int level)
+{
+    g_assert_not_reached();
+}
diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index 85911e3024..82668d6438 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -2428,3 +2428,32 @@ void kvm_arm_enable_mte(Object *cpuobj, Error **errp)
         cpu->kvm_mte = true;
     }
 }
+
+void arm_cpu_kvm_set_irq(void *arm_cpu, int irq, int level)
+{
+    ARMCPU *cpu = arm_cpu;
+    CPUARMState *env = &cpu->env;
+    CPUState *cs = CPU(cpu);
+    uint32_t linestate_bit;
+    int irq_id;
+
+    switch (irq) {
+    case ARM_CPU_IRQ:
+        irq_id = KVM_ARM_IRQ_CPU_IRQ;
+        linestate_bit = CPU_INTERRUPT_HARD;
+        break;
+    case ARM_CPU_FIQ:
+        irq_id = KVM_ARM_IRQ_CPU_FIQ;
+        linestate_bit = CPU_INTERRUPT_FIQ;
+        break;
+    default:
+        g_assert_not_reached();
+    }
+
+    if (level) {
+        env->irq_line_state |= linestate_bit;
+    } else {
+        env->irq_line_state &= ~linestate_bit;
+    }
+    kvm_arm_set_irq(cs->cpu_index, KVM_ARM_IRQ_TYPE_CPU, irq_id, !!level);
+}
diff --git a/target/arm/kvm_arm.h b/target/arm/kvm_arm.h
index 5bf5d56648..b638e09a68 100644
--- a/target/arm/kvm_arm.h
+++ b/target/arm/kvm_arm.h
@@ -216,4 +216,6 @@ int kvm_arm_set_irq(int cpu, int irqtype, int irq, int level);
 
 void kvm_arm_enable_mte(Object *cpuobj, Error **errp);
 
+void arm_cpu_kvm_set_irq(void *arm_cpu, int irq, int level);
+
 #endif

From 911a63dd25bf1f244ff8561f800a25b8033fbc87 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 12 May 2025 11:04:21 -0700
Subject: [PATCH 0902/2760] target/arm/cpu: remove TARGET_BIG_ENDIAN dependency

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Anton Johansson <anjo@rev.ng>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-id: 20250512180502.2395029-8-pierrick.bouvier@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index 6604769341..c7e00e6432 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -23,6 +23,7 @@
 #include "qemu/timer.h"
 #include "qemu/log.h"
 #include "exec/page-vary.h"
+#include "exec/tswap.h"
 #include "target/arm/idau.h"
 #include "qemu/module.h"
 #include "qapi/error.h"
@@ -1171,7 +1172,7 @@ static void arm_disas_set_info(CPUState *cpu, disassemble_info *info)
 
     info->endian = BFD_ENDIAN_LITTLE;
     if (bswap_code(sctlr_b)) {
-        info->endian = TARGET_BIG_ENDIAN ? BFD_ENDIAN_LITTLE : BFD_ENDIAN_BIG;
+        info->endian = target_big_endian() ? BFD_ENDIAN_LITTLE : BFD_ENDIAN_BIG;
     }
     info->flags &= ~INSN_ARM_BE32;
 #ifndef CONFIG_USER_ONLY

From 07e13d5fb5d289d4ae758cfd1f77356052789ad2 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 12 May 2025 11:04:22 -0700
Subject: [PATCH 0903/2760] target/arm/cpu: remove TARGET_AARCH64 around
 aarch64_cpu_dump_state common

Call is guarded by is_a64(env), so it's safe to expose without needing
to assert anything.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-id: 20250512180502.2395029-9-pierrick.bouvier@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.c | 11 -----------
 1 file changed, 11 deletions(-)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index c7e00e6432..ec9bc72c3d 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -1182,8 +1182,6 @@ static void arm_disas_set_info(CPUState *cpu, disassemble_info *info)
 #endif
 }
 
-#ifdef TARGET_AARCH64
-
 static void aarch64_cpu_dump_state(CPUState *cs, FILE *f, int flags)
 {
     ARMCPU *cpu = ARM_CPU(cs);
@@ -1341,15 +1339,6 @@ static void aarch64_cpu_dump_state(CPUState *cs, FILE *f, int flags)
     }
 }
 
-#else
-
-static inline void aarch64_cpu_dump_state(CPUState *cs, FILE *f, int flags)
-{
-    g_assert_not_reached();
-}
-
-#endif
-
 static void arm_cpu_dump_state(CPUState *cs, FILE *f, int flags)
 {
     ARMCPU *cpu = ARM_CPU(cs);

From 2a028eab3909687f1799b53488cd199fe4775126 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 12 May 2025 11:04:23 -0700
Subject: [PATCH 0904/2760] target/arm/cpu: remove TARGET_AARCH64 in
 arm_cpu_finalize_features
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Need to stub cpu64 finalize functions.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-id: 20250512180502.2395029-10-pierrick.bouvier@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.c         |  2 --
 target/arm/cpu32-stubs.c | 26 ++++++++++++++++++++++++++
 target/arm/meson.build   | 11 +++++++----
 3 files changed, 33 insertions(+), 6 deletions(-)
 create mode 100644 target/arm/cpu32-stubs.c

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index ec9bc72c3d..ca5ed7892e 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -1913,7 +1913,6 @@ void arm_cpu_finalize_features(ARMCPU *cpu, Error **errp)
 {
     Error *local_err = NULL;
 
-#ifdef TARGET_AARCH64
     if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
         arm_cpu_sve_finalize(cpu, &local_err);
         if (local_err != NULL) {
@@ -1949,7 +1948,6 @@ void arm_cpu_finalize_features(ARMCPU *cpu, Error **errp)
             return;
         }
     }
-#endif
 
     if (kvm_enabled()) {
         kvm_arm_steal_time_finalize(cpu, &local_err);
diff --git a/target/arm/cpu32-stubs.c b/target/arm/cpu32-stubs.c
new file mode 100644
index 0000000000..81be44d846
--- /dev/null
+++ b/target/arm/cpu32-stubs.c
@@ -0,0 +1,26 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#include "qemu/osdep.h"
+#include "target/arm/cpu.h"
+#include "target/arm/internals.h"
+#include <glib.h>
+
+void arm_cpu_sme_finalize(ARMCPU *cpu, Error **errp)
+{
+    g_assert_not_reached();
+}
+
+void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp)
+{
+    g_assert_not_reached();
+}
+
+void arm_cpu_pauth_finalize(ARMCPU *cpu, Error **errp)
+{
+    g_assert_not_reached();
+}
+
+void arm_cpu_lpa2_finalize(ARMCPU *cpu, Error **errp)
+{
+    g_assert_not_reached();
+}
diff --git a/target/arm/meson.build b/target/arm/meson.build
index 3065081d24..c39ddc4427 100644
--- a/target/arm/meson.build
+++ b/target/arm/meson.build
@@ -11,10 +11,13 @@ arm_ss.add(zlib)
 arm_ss.add(when: 'CONFIG_KVM', if_true: files('hyp_gdbstub.c', 'kvm.c'), if_false: files('kvm-stub.c'))
 arm_ss.add(when: 'CONFIG_HVF', if_true: files('hyp_gdbstub.c'))
 
-arm_ss.add(when: 'TARGET_AARCH64', if_true: files(
-  'cpu64.c',
-  'gdbstub64.c',
-))
+arm_ss.add(when: 'TARGET_AARCH64',
+  if_true: files(
+    'cpu64.c',
+    'gdbstub64.c'),
+  if_false: files(
+    'cpu32-stubs.c'),
+)
 
 arm_system_ss = ss.source_set()
 arm_system_ss.add(files(

From 5ae609b629e9de4e4c6d18ecc33bdb1f02e431d6 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 12 May 2025 11:04:24 -0700
Subject: [PATCH 0905/2760] target/arm/cpu: compile file twice (user, system)
 only

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-id: 20250512180502.2395029-11-pierrick.bouvier@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/meson.build | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/target/arm/meson.build b/target/arm/meson.build
index c39ddc4427..89e305eb56 100644
--- a/target/arm/meson.build
+++ b/target/arm/meson.build
@@ -1,6 +1,6 @@
 arm_ss = ss.source_set()
+arm_common_ss = ss.source_set()
 arm_ss.add(files(
-  'cpu.c',
   'debug_helper.c',
   'gdbstub.c',
   'helper.c',
@@ -20,6 +20,7 @@ arm_ss.add(when: 'TARGET_AARCH64',
 )
 
 arm_system_ss = ss.source_set()
+arm_common_system_ss = ss.source_set()
 arm_system_ss.add(files(
   'arch_dump.c',
   'arm-powerctl.c',
@@ -30,6 +31,9 @@ arm_system_ss.add(files(
 ))
 
 arm_user_ss = ss.source_set()
+arm_user_ss.add(files('cpu.c'))
+
+arm_common_system_ss.add(files('cpu.c'), capstone)
 
 subdir('hvf')
 
@@ -42,3 +46,5 @@ endif
 target_arch += {'arm': arm_ss}
 target_system_arch += {'arm': arm_system_ss}
 target_user_arch += {'arm': arm_user_ss}
+target_common_arch += {'arm': arm_common_ss}
+target_common_system_arch += {'arm': arm_common_system_ss}

From b757ae80c6f389dd8d6f8069e413a52c7ef76c20 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 12 May 2025 11:04:25 -0700
Subject: [PATCH 0906/2760] target/arm/cpu32-stubs.c: compile file twice (user,
 system)

It could be squashed with commit introducing it, but I would prefer to
introduce target/arm/cpu.c first.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-id: 20250512180502.2395029-12-pierrick.bouvier@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/meson.build | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/target/arm/meson.build b/target/arm/meson.build
index 89e305eb56..de214fe5d5 100644
--- a/target/arm/meson.build
+++ b/target/arm/meson.build
@@ -11,13 +11,9 @@ arm_ss.add(zlib)
 arm_ss.add(when: 'CONFIG_KVM', if_true: files('hyp_gdbstub.c', 'kvm.c'), if_false: files('kvm-stub.c'))
 arm_ss.add(when: 'CONFIG_HVF', if_true: files('hyp_gdbstub.c'))
 
-arm_ss.add(when: 'TARGET_AARCH64',
-  if_true: files(
-    'cpu64.c',
-    'gdbstub64.c'),
-  if_false: files(
-    'cpu32-stubs.c'),
-)
+arm_ss.add(when: 'TARGET_AARCH64', if_true: files(
+  'cpu64.c',
+  'gdbstub64.c'))
 
 arm_system_ss = ss.source_set()
 arm_common_system_ss = ss.source_set()
@@ -32,8 +28,12 @@ arm_system_ss.add(files(
 
 arm_user_ss = ss.source_set()
 arm_user_ss.add(files('cpu.c'))
+arm_user_ss.add(when: 'TARGET_AARCH64', if_false: files(
+  'cpu32-stubs.c'))
 
 arm_common_system_ss.add(files('cpu.c'), capstone)
+arm_common_system_ss.add(when: 'TARGET_AARCH64', if_false: files(
+  'cpu32-stubs.c'))
 
 subdir('hvf')
 

From 21a75f792f088d0aabebf6b7d96490e37fe8b779 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 12 May 2025 11:04:26 -0700
Subject: [PATCH 0907/2760] tcg: add vaddr type for helpers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Defined as an alias of i32/i64 depending on host pointer size.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250512180502.2395029-13-pierrick.bouvier@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/exec/helper-head.h.inc | 11 +++++++++++
 include/tcg/tcg-op-common.h    |  1 +
 include/tcg/tcg.h              | 14 ++++++++++++++
 tcg/tcg.c                      |  5 +++++
 4 files changed, 31 insertions(+)

diff --git a/include/exec/helper-head.h.inc b/include/exec/helper-head.h.inc
index bce5db06ef..5b248fd713 100644
--- a/include/exec/helper-head.h.inc
+++ b/include/exec/helper-head.h.inc
@@ -58,6 +58,17 @@
 # define dh_ctype_tl target_ulong
 #endif /* COMPILING_PER_TARGET */
 
+#if __SIZEOF_POINTER__ == 4
+# define dh_alias_vaddr i32
+# define dh_typecode_vaddr dh_typecode_i32
+#elif __SIZEOF_POINTER__ == 8
+# define dh_alias_vaddr i64
+# define dh_typecode_vaddr dh_typecode_i64
+#else
+# error "sizeof pointer is different from {4,8}"
+#endif /* __SIZEOF_POINTER__ */
+# define dh_ctype_vaddr uintptr_t
+
 /* We can't use glue() here because it falls foul of C preprocessor
    recursive expansion rules.  */
 #define dh_retvar_decl0_void void
diff --git a/include/tcg/tcg-op-common.h b/include/tcg/tcg-op-common.h
index b439bdb385..e1071adebf 100644
--- a/include/tcg/tcg-op-common.h
+++ b/include/tcg/tcg-op-common.h
@@ -14,6 +14,7 @@
 
 TCGv_i32 tcg_constant_i32(int32_t val);
 TCGv_i64 tcg_constant_i64(int64_t val);
+TCGv_vaddr tcg_constant_vaddr(uintptr_t val);
 TCGv_vec tcg_constant_vec(TCGType type, unsigned vece, int64_t val);
 TCGv_vec tcg_constant_vec_matching(TCGv_vec match, unsigned vece, int64_t val);
 
diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
index a8c00c72cc..3fa5a7aed2 100644
--- a/include/tcg/tcg.h
+++ b/include/tcg/tcg.h
@@ -189,6 +189,7 @@ typedef tcg_target_ulong TCGArg;
     * TCGv_i64  : 64 bit integer type
     * TCGv_i128 : 128 bit integer type
     * TCGv_ptr  : a host pointer type
+    * TCGv_vaddr: an integer type wide enough to hold a target pointer type
     * TCGv_vec  : a host vector type; the exact size is not exposed
                   to the CPU front-end code.
     * TCGv      : an integer type the same size as target_ulong
@@ -217,6 +218,14 @@ typedef struct TCGv_ptr_d *TCGv_ptr;
 typedef struct TCGv_vec_d *TCGv_vec;
 typedef TCGv_ptr TCGv_env;
 
+#if __SIZEOF_POINTER__ == 4
+typedef TCGv_i32 TCGv_vaddr;
+#elif __SIZEOF_POINTER__ == 8
+typedef TCGv_i64 TCGv_vaddr;
+#else
+# error "sizeof pointer is different from {4,8}"
+#endif /* __SIZEOF_POINTER__ */
+
 /* call flags */
 /* Helper does not read globals (either directly or through an exception). It
    implies TCG_CALL_NO_WRITE_GLOBALS. */
@@ -577,6 +586,11 @@ static inline TCGv_ptr temp_tcgv_ptr(TCGTemp *t)
     return (TCGv_ptr)temp_tcgv_i32(t);
 }
 
+static inline TCGv_vaddr temp_tcgv_vaddr(TCGTemp *t)
+{
+    return (TCGv_vaddr)temp_tcgv_i32(t);
+}
+
 static inline TCGv_vec temp_tcgv_vec(TCGTemp *t)
 {
     return (TCGv_vec)temp_tcgv_i32(t);
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 648333a9fb..ae27a2607d 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -2367,6 +2367,11 @@ TCGv_i64 tcg_constant_i64(int64_t val)
     return temp_tcgv_i64(tcg_constant_internal(TCG_TYPE_I64, val));
 }
 
+TCGv_vaddr tcg_constant_vaddr(uintptr_t val)
+{
+    return temp_tcgv_vaddr(tcg_constant_internal(TCG_TYPE_PTR, val));
+}
+
 TCGv_ptr tcg_constant_ptr_int(intptr_t val)
 {
     return temp_tcgv_ptr(tcg_constant_internal(TCG_TYPE_PTR, val));

From a0307ea3dde1089d764a4449b62815023a1abbc6 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 12 May 2025 11:04:27 -0700
Subject: [PATCH 0908/2760] target/arm/helper: use vaddr instead of
 target_ulong for exception_pc_alignment
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250512180502.2395029-14-pierrick.bouvier@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.h            | 2 +-
 target/arm/tcg/tlb_helper.c    | 2 +-
 target/arm/tcg/translate-a64.c | 2 +-
 target/arm/tcg/translate.c     | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/target/arm/helper.h b/target/arm/helper.h
index 0907505839..95b9211c6f 100644
--- a/target/arm/helper.h
+++ b/target/arm/helper.h
@@ -49,7 +49,7 @@ DEF_HELPER_3(exception_with_syndrome, noreturn, env, i32, i32)
 DEF_HELPER_4(exception_with_syndrome_el, noreturn, env, i32, i32, i32)
 DEF_HELPER_2(exception_bkpt_insn, noreturn, env, i32)
 DEF_HELPER_2(exception_swstep, noreturn, env, i32)
-DEF_HELPER_2(exception_pc_alignment, noreturn, env, tl)
+DEF_HELPER_2(exception_pc_alignment, noreturn, env, vaddr)
 DEF_HELPER_1(setend, void, env)
 DEF_HELPER_2(wfi, void, env, i32)
 DEF_HELPER_1(wfe, void, env)
diff --git a/target/arm/tcg/tlb_helper.c b/target/arm/tcg/tlb_helper.c
index 5ea4d6590f..d9e6c827d4 100644
--- a/target/arm/tcg/tlb_helper.c
+++ b/target/arm/tcg/tlb_helper.c
@@ -276,7 +276,7 @@ void arm_cpu_do_unaligned_access(CPUState *cs, vaddr vaddr,
     arm_deliver_fault(cpu, vaddr, access_type, mmu_idx, &fi);
 }
 
-void helper_exception_pc_alignment(CPUARMState *env, target_ulong pc)
+void helper_exception_pc_alignment(CPUARMState *env, vaddr pc)
 {
     ARMMMUFaultInfo fi = { .type = ARMFault_Alignment };
     int target_el = exception_target_el(env);
diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index 52cf47e775..ac80f572a2 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -10242,7 +10242,7 @@ static void aarch64_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
          * start of the TB.
          */
         assert(s->base.num_insns == 1);
-        gen_helper_exception_pc_alignment(tcg_env, tcg_constant_tl(pc));
+        gen_helper_exception_pc_alignment(tcg_env, tcg_constant_vaddr(pc));
         s->base.is_jmp = DISAS_NORETURN;
         s->base.pc_next = QEMU_ALIGN_UP(pc, 4);
         return;
diff --git a/target/arm/tcg/translate.c b/target/arm/tcg/translate.c
index e773ab7268..9962f43b1d 100644
--- a/target/arm/tcg/translate.c
+++ b/target/arm/tcg/translate.c
@@ -7791,7 +7791,7 @@ static void arm_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
          * be possible after an indirect branch, at the start of the TB.
          */
         assert(dc->base.num_insns == 1);
-        gen_helper_exception_pc_alignment(tcg_env, tcg_constant_tl(pc));
+        gen_helper_exception_pc_alignment(tcg_env, tcg_constant_vaddr(pc));
         dc->base.is_jmp = DISAS_NORETURN;
         dc->base.pc_next = QEMU_ALIGN_UP(pc, 4);
         return;

From 5296a79b5a14d072af6fe2c8a8c00793862f18d4 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 12 May 2025 11:04:28 -0700
Subject: [PATCH 0909/2760] target/arm/helper: use vaddr instead of
 target_ulong for probe_access
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250512180502.2395029-15-pierrick.bouvier@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.h        | 2 +-
 target/arm/tcg/op_helper.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/helper.h b/target/arm/helper.h
index 95b9211c6f..0a4fc90fa8 100644
--- a/target/arm/helper.h
+++ b/target/arm/helper.h
@@ -104,7 +104,7 @@ DEF_HELPER_FLAGS_1(rebuild_hflags_a32_newel, TCG_CALL_NO_RWG, void, env)
 DEF_HELPER_FLAGS_2(rebuild_hflags_a32, TCG_CALL_NO_RWG, void, env, int)
 DEF_HELPER_FLAGS_2(rebuild_hflags_a64, TCG_CALL_NO_RWG, void, env, int)
 
-DEF_HELPER_FLAGS_5(probe_access, TCG_CALL_NO_WG, void, env, tl, i32, i32, i32)
+DEF_HELPER_FLAGS_5(probe_access, TCG_CALL_NO_WG, void, env, vaddr, i32, i32, i32)
 
 DEF_HELPER_1(vfp_get_fpscr, i32, env)
 DEF_HELPER_2(vfp_set_fpscr, void, env, i32)
diff --git a/target/arm/tcg/op_helper.c b/target/arm/tcg/op_helper.c
index dc3f83c37d..575e566280 100644
--- a/target/arm/tcg/op_helper.c
+++ b/target/arm/tcg/op_helper.c
@@ -1222,7 +1222,7 @@ uint32_t HELPER(ror_cc)(CPUARMState *env, uint32_t x, uint32_t i)
     }
 }
 
-void HELPER(probe_access)(CPUARMState *env, target_ulong ptr,
+void HELPER(probe_access)(CPUARMState *env, vaddr ptr,
                           uint32_t access_type, uint32_t mmu_idx,
                           uint32_t size)
 {

From a7a3ae9edc65032c6362bb3af6fe611df10aa705 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 12 May 2025 11:04:29 -0700
Subject: [PATCH 0910/2760] target/arm/helper: extract common helpers

Allow later commits to include only the "new" tcg/helper.h, thus
preventing to pull aarch64 helpers (+ target/arm/helper.h contains a
ifdef TARGET_AARCH64).

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-id: 20250512180502.2395029-16-pierrick.bouvier@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.h     | 1152 +-------------------------------------
 target/arm/tcg/helper.h | 1153 +++++++++++++++++++++++++++++++++++++++
 2 files changed, 1155 insertions(+), 1150 deletions(-)
 create mode 100644 target/arm/tcg/helper.h

diff --git a/target/arm/helper.h b/target/arm/helper.h
index 0a4fc90fa8..f340a49a28 100644
--- a/target/arm/helper.h
+++ b/target/arm/helper.h
@@ -1,1154 +1,6 @@
-DEF_HELPER_FLAGS_1(sxtb16, TCG_CALL_NO_RWG_SE, i32, i32)
-DEF_HELPER_FLAGS_1(uxtb16, TCG_CALL_NO_RWG_SE, i32, i32)
+/* SPDX-License-Identifier: GPL-2.0-or-later */
 
-DEF_HELPER_3(add_setq, i32, env, i32, i32)
-DEF_HELPER_3(add_saturate, i32, env, i32, i32)
-DEF_HELPER_3(sub_saturate, i32, env, i32, i32)
-DEF_HELPER_3(add_usaturate, i32, env, i32, i32)
-DEF_HELPER_3(sub_usaturate, i32, env, i32, i32)
-DEF_HELPER_FLAGS_3(sdiv, TCG_CALL_NO_RWG, s32, env, s32, s32)
-DEF_HELPER_FLAGS_3(udiv, TCG_CALL_NO_RWG, i32, env, i32, i32)
-DEF_HELPER_FLAGS_1(rbit, TCG_CALL_NO_RWG_SE, i32, i32)
-
-#define PAS_OP(pfx)  \
-    DEF_HELPER_3(pfx ## add8, i32, i32, i32, ptr) \
-    DEF_HELPER_3(pfx ## sub8, i32, i32, i32, ptr) \
-    DEF_HELPER_3(pfx ## sub16, i32, i32, i32, ptr) \
-    DEF_HELPER_3(pfx ## add16, i32, i32, i32, ptr) \
-    DEF_HELPER_3(pfx ## addsubx, i32, i32, i32, ptr) \
-    DEF_HELPER_3(pfx ## subaddx, i32, i32, i32, ptr)
-
-PAS_OP(s)
-PAS_OP(u)
-#undef PAS_OP
-
-#define PAS_OP(pfx)  \
-    DEF_HELPER_2(pfx ## add8, i32, i32, i32) \
-    DEF_HELPER_2(pfx ## sub8, i32, i32, i32) \
-    DEF_HELPER_2(pfx ## sub16, i32, i32, i32) \
-    DEF_HELPER_2(pfx ## add16, i32, i32, i32) \
-    DEF_HELPER_2(pfx ## addsubx, i32, i32, i32) \
-    DEF_HELPER_2(pfx ## subaddx, i32, i32, i32)
-PAS_OP(q)
-PAS_OP(sh)
-PAS_OP(uq)
-PAS_OP(uh)
-#undef PAS_OP
-
-DEF_HELPER_3(ssat, i32, env, i32, i32)
-DEF_HELPER_3(usat, i32, env, i32, i32)
-DEF_HELPER_3(ssat16, i32, env, i32, i32)
-DEF_HELPER_3(usat16, i32, env, i32, i32)
-
-DEF_HELPER_FLAGS_2(usad8, TCG_CALL_NO_RWG_SE, i32, i32, i32)
-
-DEF_HELPER_FLAGS_3(sel_flags, TCG_CALL_NO_RWG_SE,
-                   i32, i32, i32, i32)
-DEF_HELPER_2(exception_internal, noreturn, env, i32)
-DEF_HELPER_3(exception_with_syndrome, noreturn, env, i32, i32)
-DEF_HELPER_4(exception_with_syndrome_el, noreturn, env, i32, i32, i32)
-DEF_HELPER_2(exception_bkpt_insn, noreturn, env, i32)
-DEF_HELPER_2(exception_swstep, noreturn, env, i32)
-DEF_HELPER_2(exception_pc_alignment, noreturn, env, vaddr)
-DEF_HELPER_1(setend, void, env)
-DEF_HELPER_2(wfi, void, env, i32)
-DEF_HELPER_1(wfe, void, env)
-DEF_HELPER_2(wfit, void, env, i64)
-DEF_HELPER_1(yield, void, env)
-DEF_HELPER_1(pre_hvc, void, env)
-DEF_HELPER_2(pre_smc, void, env, i32)
-DEF_HELPER_1(vesb, void, env)
-
-DEF_HELPER_3(cpsr_write, void, env, i32, i32)
-DEF_HELPER_2(cpsr_write_eret, void, env, i32)
-DEF_HELPER_1(cpsr_read, i32, env)
-
-DEF_HELPER_3(v7m_msr, void, env, i32, i32)
-DEF_HELPER_2(v7m_mrs, i32, env, i32)
-
-DEF_HELPER_2(v7m_bxns, void, env, i32)
-DEF_HELPER_2(v7m_blxns, void, env, i32)
-
-DEF_HELPER_3(v7m_tt, i32, env, i32, i32)
-
-DEF_HELPER_1(v7m_preserve_fp_state, void, env)
-
-DEF_HELPER_2(v7m_vlstm, void, env, i32)
-DEF_HELPER_2(v7m_vlldm, void, env, i32)
-
-DEF_HELPER_2(v8m_stackcheck, void, env, i32)
-
-DEF_HELPER_FLAGS_2(check_bxj_trap, TCG_CALL_NO_WG, void, env, i32)
-
-DEF_HELPER_4(access_check_cp_reg, cptr, env, i32, i32, i32)
-DEF_HELPER_FLAGS_2(lookup_cp_reg, TCG_CALL_NO_RWG_SE, cptr, env, i32)
-DEF_HELPER_FLAGS_2(tidcp_el0, TCG_CALL_NO_WG, void, env, i32)
-DEF_HELPER_FLAGS_2(tidcp_el1, TCG_CALL_NO_WG, void, env, i32)
-DEF_HELPER_3(set_cp_reg, void, env, cptr, i32)
-DEF_HELPER_2(get_cp_reg, i32, env, cptr)
-DEF_HELPER_3(set_cp_reg64, void, env, cptr, i64)
-DEF_HELPER_2(get_cp_reg64, i64, env, cptr)
-
-DEF_HELPER_2(get_r13_banked, i32, env, i32)
-DEF_HELPER_3(set_r13_banked, void, env, i32, i32)
-
-DEF_HELPER_3(mrs_banked, i32, env, i32, i32)
-DEF_HELPER_4(msr_banked, void, env, i32, i32, i32)
-
-DEF_HELPER_2(get_user_reg, i32, env, i32)
-DEF_HELPER_3(set_user_reg, void, env, i32, i32)
-
-DEF_HELPER_FLAGS_1(rebuild_hflags_m32_newel, TCG_CALL_NO_RWG, void, env)
-DEF_HELPER_FLAGS_2(rebuild_hflags_m32, TCG_CALL_NO_RWG, void, env, int)
-DEF_HELPER_FLAGS_1(rebuild_hflags_a32_newel, TCG_CALL_NO_RWG, void, env)
-DEF_HELPER_FLAGS_2(rebuild_hflags_a32, TCG_CALL_NO_RWG, void, env, int)
-DEF_HELPER_FLAGS_2(rebuild_hflags_a64, TCG_CALL_NO_RWG, void, env, int)
-
-DEF_HELPER_FLAGS_5(probe_access, TCG_CALL_NO_WG, void, env, vaddr, i32, i32, i32)
-
-DEF_HELPER_1(vfp_get_fpscr, i32, env)
-DEF_HELPER_2(vfp_set_fpscr, void, env, i32)
-
-DEF_HELPER_3(vfp_addh, f16, f16, f16, fpst)
-DEF_HELPER_3(vfp_adds, f32, f32, f32, fpst)
-DEF_HELPER_3(vfp_addd, f64, f64, f64, fpst)
-DEF_HELPER_3(vfp_subh, f16, f16, f16, fpst)
-DEF_HELPER_3(vfp_subs, f32, f32, f32, fpst)
-DEF_HELPER_3(vfp_subd, f64, f64, f64, fpst)
-DEF_HELPER_3(vfp_mulh, f16, f16, f16, fpst)
-DEF_HELPER_3(vfp_muls, f32, f32, f32, fpst)
-DEF_HELPER_3(vfp_muld, f64, f64, f64, fpst)
-DEF_HELPER_3(vfp_divh, f16, f16, f16, fpst)
-DEF_HELPER_3(vfp_divs, f32, f32, f32, fpst)
-DEF_HELPER_3(vfp_divd, f64, f64, f64, fpst)
-DEF_HELPER_3(vfp_maxh, f16, f16, f16, fpst)
-DEF_HELPER_3(vfp_maxs, f32, f32, f32, fpst)
-DEF_HELPER_3(vfp_maxd, f64, f64, f64, fpst)
-DEF_HELPER_3(vfp_minh, f16, f16, f16, fpst)
-DEF_HELPER_3(vfp_mins, f32, f32, f32, fpst)
-DEF_HELPER_3(vfp_mind, f64, f64, f64, fpst)
-DEF_HELPER_3(vfp_maxnumh, f16, f16, f16, fpst)
-DEF_HELPER_3(vfp_maxnums, f32, f32, f32, fpst)
-DEF_HELPER_3(vfp_maxnumd, f64, f64, f64, fpst)
-DEF_HELPER_3(vfp_minnumh, f16, f16, f16, fpst)
-DEF_HELPER_3(vfp_minnums, f32, f32, f32, fpst)
-DEF_HELPER_3(vfp_minnumd, f64, f64, f64, fpst)
-DEF_HELPER_2(vfp_sqrth, f16, f16, fpst)
-DEF_HELPER_2(vfp_sqrts, f32, f32, fpst)
-DEF_HELPER_2(vfp_sqrtd, f64, f64, fpst)
-DEF_HELPER_3(vfp_cmph, void, f16, f16, env)
-DEF_HELPER_3(vfp_cmps, void, f32, f32, env)
-DEF_HELPER_3(vfp_cmpd, void, f64, f64, env)
-DEF_HELPER_3(vfp_cmpeh, void, f16, f16, env)
-DEF_HELPER_3(vfp_cmpes, void, f32, f32, env)
-DEF_HELPER_3(vfp_cmped, void, f64, f64, env)
-
-DEF_HELPER_2(vfp_fcvtds, f64, f32, fpst)
-DEF_HELPER_2(vfp_fcvtsd, f32, f64, fpst)
-DEF_HELPER_FLAGS_2(bfcvt, TCG_CALL_NO_RWG, i32, f32, fpst)
-DEF_HELPER_FLAGS_2(bfcvt_pair, TCG_CALL_NO_RWG, i32, i64, fpst)
-
-DEF_HELPER_2(vfp_uitoh, f16, i32, fpst)
-DEF_HELPER_2(vfp_uitos, f32, i32, fpst)
-DEF_HELPER_2(vfp_uitod, f64, i32, fpst)
-DEF_HELPER_2(vfp_sitoh, f16, i32, fpst)
-DEF_HELPER_2(vfp_sitos, f32, i32, fpst)
-DEF_HELPER_2(vfp_sitod, f64, i32, fpst)
-
-DEF_HELPER_2(vfp_touih, i32, f16, fpst)
-DEF_HELPER_2(vfp_touis, i32, f32, fpst)
-DEF_HELPER_2(vfp_touid, i32, f64, fpst)
-DEF_HELPER_2(vfp_touizh, i32, f16, fpst)
-DEF_HELPER_2(vfp_touizs, i32, f32, fpst)
-DEF_HELPER_2(vfp_touizd, i32, f64, fpst)
-DEF_HELPER_2(vfp_tosih, s32, f16, fpst)
-DEF_HELPER_2(vfp_tosis, s32, f32, fpst)
-DEF_HELPER_2(vfp_tosid, s32, f64, fpst)
-DEF_HELPER_2(vfp_tosizh, s32, f16, fpst)
-DEF_HELPER_2(vfp_tosizs, s32, f32, fpst)
-DEF_HELPER_2(vfp_tosizd, s32, f64, fpst)
-
-DEF_HELPER_3(vfp_toshh_round_to_zero, i32, f16, i32, fpst)
-DEF_HELPER_3(vfp_toslh_round_to_zero, i32, f16, i32, fpst)
-DEF_HELPER_3(vfp_touhh_round_to_zero, i32, f16, i32, fpst)
-DEF_HELPER_3(vfp_toulh_round_to_zero, i32, f16, i32, fpst)
-DEF_HELPER_3(vfp_toshs_round_to_zero, i32, f32, i32, fpst)
-DEF_HELPER_3(vfp_tosls_round_to_zero, i32, f32, i32, fpst)
-DEF_HELPER_3(vfp_touhs_round_to_zero, i32, f32, i32, fpst)
-DEF_HELPER_3(vfp_touls_round_to_zero, i32, f32, i32, fpst)
-DEF_HELPER_3(vfp_toshd_round_to_zero, i64, f64, i32, fpst)
-DEF_HELPER_3(vfp_tosld_round_to_zero, i64, f64, i32, fpst)
-DEF_HELPER_3(vfp_tosqd_round_to_zero, i64, f64, i32, fpst)
-DEF_HELPER_3(vfp_touhd_round_to_zero, i64, f64, i32, fpst)
-DEF_HELPER_3(vfp_tould_round_to_zero, i64, f64, i32, fpst)
-DEF_HELPER_3(vfp_touqd_round_to_zero, i64, f64, i32, fpst)
-DEF_HELPER_3(vfp_touhh, i32, f16, i32, fpst)
-DEF_HELPER_3(vfp_toshh, i32, f16, i32, fpst)
-DEF_HELPER_3(vfp_toulh, i32, f16, i32, fpst)
-DEF_HELPER_3(vfp_toslh, i32, f16, i32, fpst)
-DEF_HELPER_3(vfp_touqh, i64, f16, i32, fpst)
-DEF_HELPER_3(vfp_tosqh, i64, f16, i32, fpst)
-DEF_HELPER_3(vfp_toshs, i32, f32, i32, fpst)
-DEF_HELPER_3(vfp_tosls, i32, f32, i32, fpst)
-DEF_HELPER_3(vfp_tosqs, i64, f32, i32, fpst)
-DEF_HELPER_3(vfp_touhs, i32, f32, i32, fpst)
-DEF_HELPER_3(vfp_touls, i32, f32, i32, fpst)
-DEF_HELPER_3(vfp_touqs, i64, f32, i32, fpst)
-DEF_HELPER_3(vfp_toshd, i64, f64, i32, fpst)
-DEF_HELPER_3(vfp_tosld, i64, f64, i32, fpst)
-DEF_HELPER_3(vfp_tosqd, i64, f64, i32, fpst)
-DEF_HELPER_3(vfp_touhd, i64, f64, i32, fpst)
-DEF_HELPER_3(vfp_tould, i64, f64, i32, fpst)
-DEF_HELPER_3(vfp_touqd, i64, f64, i32, fpst)
-DEF_HELPER_3(vfp_shtos, f32, i32, i32, fpst)
-DEF_HELPER_3(vfp_sltos, f32, i32, i32, fpst)
-DEF_HELPER_3(vfp_sqtos, f32, i64, i32, fpst)
-DEF_HELPER_3(vfp_uhtos, f32, i32, i32, fpst)
-DEF_HELPER_3(vfp_ultos, f32, i32, i32, fpst)
-DEF_HELPER_3(vfp_uqtos, f32, i64, i32, fpst)
-DEF_HELPER_3(vfp_shtod, f64, i64, i32, fpst)
-DEF_HELPER_3(vfp_sltod, f64, i64, i32, fpst)
-DEF_HELPER_3(vfp_sqtod, f64, i64, i32, fpst)
-DEF_HELPER_3(vfp_uhtod, f64, i64, i32, fpst)
-DEF_HELPER_3(vfp_ultod, f64, i64, i32, fpst)
-DEF_HELPER_3(vfp_uqtod, f64, i64, i32, fpst)
-DEF_HELPER_3(vfp_shtoh, f16, i32, i32, fpst)
-DEF_HELPER_3(vfp_uhtoh, f16, i32, i32, fpst)
-DEF_HELPER_3(vfp_sltoh, f16, i32, i32, fpst)
-DEF_HELPER_3(vfp_ultoh, f16, i32, i32, fpst)
-DEF_HELPER_3(vfp_sqtoh, f16, i64, i32, fpst)
-DEF_HELPER_3(vfp_uqtoh, f16, i64, i32, fpst)
-
-DEF_HELPER_3(vfp_shtos_round_to_nearest, f32, i32, i32, fpst)
-DEF_HELPER_3(vfp_sltos_round_to_nearest, f32, i32, i32, fpst)
-DEF_HELPER_3(vfp_uhtos_round_to_nearest, f32, i32, i32, fpst)
-DEF_HELPER_3(vfp_ultos_round_to_nearest, f32, i32, i32, fpst)
-DEF_HELPER_3(vfp_shtod_round_to_nearest, f64, i64, i32, fpst)
-DEF_HELPER_3(vfp_sltod_round_to_nearest, f64, i64, i32, fpst)
-DEF_HELPER_3(vfp_uhtod_round_to_nearest, f64, i64, i32, fpst)
-DEF_HELPER_3(vfp_ultod_round_to_nearest, f64, i64, i32, fpst)
-DEF_HELPER_3(vfp_shtoh_round_to_nearest, f16, i32, i32, fpst)
-DEF_HELPER_3(vfp_uhtoh_round_to_nearest, f16, i32, i32, fpst)
-DEF_HELPER_3(vfp_sltoh_round_to_nearest, f16, i32, i32, fpst)
-DEF_HELPER_3(vfp_ultoh_round_to_nearest, f16, i32, i32, fpst)
-
-DEF_HELPER_FLAGS_2(set_rmode, TCG_CALL_NO_RWG, i32, i32, fpst)
-
-DEF_HELPER_FLAGS_3(vfp_fcvt_f16_to_f32, TCG_CALL_NO_RWG, f32, f16, fpst, i32)
-DEF_HELPER_FLAGS_3(vfp_fcvt_f32_to_f16, TCG_CALL_NO_RWG, f16, f32, fpst, i32)
-DEF_HELPER_FLAGS_3(vfp_fcvt_f16_to_f64, TCG_CALL_NO_RWG, f64, f16, fpst, i32)
-DEF_HELPER_FLAGS_3(vfp_fcvt_f64_to_f16, TCG_CALL_NO_RWG, f16, f64, fpst, i32)
-
-DEF_HELPER_4(vfp_muladdd, f64, f64, f64, f64, fpst)
-DEF_HELPER_4(vfp_muladds, f32, f32, f32, f32, fpst)
-DEF_HELPER_4(vfp_muladdh, f16, f16, f16, f16, fpst)
-
-DEF_HELPER_FLAGS_2(recpe_f16, TCG_CALL_NO_RWG, f16, f16, fpst)
-DEF_HELPER_FLAGS_2(recpe_f32, TCG_CALL_NO_RWG, f32, f32, fpst)
-DEF_HELPER_FLAGS_2(recpe_rpres_f32, TCG_CALL_NO_RWG, f32, f32, fpst)
-DEF_HELPER_FLAGS_2(recpe_f64, TCG_CALL_NO_RWG, f64, f64, fpst)
-DEF_HELPER_FLAGS_2(rsqrte_f16, TCG_CALL_NO_RWG, f16, f16, fpst)
-DEF_HELPER_FLAGS_2(rsqrte_f32, TCG_CALL_NO_RWG, f32, f32, fpst)
-DEF_HELPER_FLAGS_2(rsqrte_rpres_f32, TCG_CALL_NO_RWG, f32, f32, fpst)
-DEF_HELPER_FLAGS_2(rsqrte_f64, TCG_CALL_NO_RWG, f64, f64, fpst)
-DEF_HELPER_FLAGS_1(recpe_u32, TCG_CALL_NO_RWG, i32, i32)
-DEF_HELPER_FLAGS_1(rsqrte_u32, TCG_CALL_NO_RWG, i32, i32)
-DEF_HELPER_FLAGS_4(neon_tbl, TCG_CALL_NO_RWG, i64, env, i32, i64, i64)
-
-DEF_HELPER_3(shl_cc, i32, env, i32, i32)
-DEF_HELPER_3(shr_cc, i32, env, i32, i32)
-DEF_HELPER_3(sar_cc, i32, env, i32, i32)
-DEF_HELPER_3(ror_cc, i32, env, i32, i32)
-
-DEF_HELPER_FLAGS_2(rinth_exact, TCG_CALL_NO_RWG, f16, f16, fpst)
-DEF_HELPER_FLAGS_2(rints_exact, TCG_CALL_NO_RWG, f32, f32, fpst)
-DEF_HELPER_FLAGS_2(rintd_exact, TCG_CALL_NO_RWG, f64, f64, fpst)
-DEF_HELPER_FLAGS_2(rinth, TCG_CALL_NO_RWG, f16, f16, fpst)
-DEF_HELPER_FLAGS_2(rints, TCG_CALL_NO_RWG, f32, f32, fpst)
-DEF_HELPER_FLAGS_2(rintd, TCG_CALL_NO_RWG, f64, f64, fpst)
-
-DEF_HELPER_FLAGS_2(vjcvt, TCG_CALL_NO_RWG, i32, f64, env)
-DEF_HELPER_FLAGS_2(fjcvtzs, TCG_CALL_NO_RWG, i64, f64, fpst)
-
-DEF_HELPER_FLAGS_3(check_hcr_el2_trap, TCG_CALL_NO_WG, void, env, i32, i32)
-
-/* neon_helper.c */
-DEF_HELPER_2(neon_pmin_u8, i32, i32, i32)
-DEF_HELPER_2(neon_pmin_s8, i32, i32, i32)
-DEF_HELPER_2(neon_pmin_u16, i32, i32, i32)
-DEF_HELPER_2(neon_pmin_s16, i32, i32, i32)
-DEF_HELPER_2(neon_pmax_u8, i32, i32, i32)
-DEF_HELPER_2(neon_pmax_s8, i32, i32, i32)
-DEF_HELPER_2(neon_pmax_u16, i32, i32, i32)
-DEF_HELPER_2(neon_pmax_s16, i32, i32, i32)
-
-DEF_HELPER_2(neon_shl_u16, i32, i32, i32)
-DEF_HELPER_2(neon_shl_s16, i32, i32, i32)
-DEF_HELPER_2(neon_rshl_u8, i32, i32, i32)
-DEF_HELPER_2(neon_rshl_s8, i32, i32, i32)
-DEF_HELPER_2(neon_rshl_u16, i32, i32, i32)
-DEF_HELPER_2(neon_rshl_s16, i32, i32, i32)
-DEF_HELPER_2(neon_rshl_u32, i32, i32, i32)
-DEF_HELPER_2(neon_rshl_s32, i32, i32, i32)
-DEF_HELPER_2(neon_rshl_u64, i64, i64, i64)
-DEF_HELPER_2(neon_rshl_s64, i64, i64, i64)
-DEF_HELPER_3(neon_qshl_u8, i32, env, i32, i32)
-DEF_HELPER_3(neon_qshl_s8, i32, env, i32, i32)
-DEF_HELPER_3(neon_qshl_u16, i32, env, i32, i32)
-DEF_HELPER_3(neon_qshl_s16, i32, env, i32, i32)
-DEF_HELPER_3(neon_qshl_u32, i32, env, i32, i32)
-DEF_HELPER_3(neon_qshl_s32, i32, env, i32, i32)
-DEF_HELPER_3(neon_qshl_u64, i64, env, i64, i64)
-DEF_HELPER_3(neon_qshl_s64, i64, env, i64, i64)
-DEF_HELPER_3(neon_qshlu_s8, i32, env, i32, i32)
-DEF_HELPER_3(neon_qshlu_s16, i32, env, i32, i32)
-DEF_HELPER_3(neon_qshlu_s32, i32, env, i32, i32)
-DEF_HELPER_3(neon_qshlu_s64, i64, env, i64, i64)
-DEF_HELPER_3(neon_qrshl_u8, i32, env, i32, i32)
-DEF_HELPER_3(neon_qrshl_s8, i32, env, i32, i32)
-DEF_HELPER_3(neon_qrshl_u16, i32, env, i32, i32)
-DEF_HELPER_3(neon_qrshl_s16, i32, env, i32, i32)
-DEF_HELPER_3(neon_qrshl_u32, i32, env, i32, i32)
-DEF_HELPER_3(neon_qrshl_s32, i32, env, i32, i32)
-DEF_HELPER_3(neon_qrshl_u64, i64, env, i64, i64)
-DEF_HELPER_3(neon_qrshl_s64, i64, env, i64, i64)
-DEF_HELPER_FLAGS_5(neon_sqshl_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_5(neon_sqshl_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_5(neon_sqshl_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_5(neon_sqshl_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_5(neon_uqshl_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_5(neon_uqshl_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_5(neon_uqshl_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_5(neon_uqshl_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_5(neon_sqrshl_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_5(neon_sqrshl_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_5(neon_sqrshl_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_5(neon_sqrshl_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_5(neon_uqrshl_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_5(neon_uqrshl_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_5(neon_uqrshl_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_5(neon_uqrshl_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_4(neon_sqshli_b, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_4(neon_sqshli_h, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_4(neon_sqshli_s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_4(neon_sqshli_d, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_4(neon_uqshli_b, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_4(neon_uqshli_h, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_4(neon_uqshli_s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_4(neon_uqshli_d, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_4(neon_sqshlui_b, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_4(neon_sqshlui_h, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_4(neon_sqshlui_s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_4(neon_sqshlui_d, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
-
-DEF_HELPER_FLAGS_4(gvec_srshl_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_srshl_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_srshl_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_srshl_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(gvec_urshl_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_urshl_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_urshl_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_urshl_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_2(neon_add_u8, i32, i32, i32)
-DEF_HELPER_2(neon_add_u16, i32, i32, i32)
-DEF_HELPER_2(neon_sub_u8, i32, i32, i32)
-DEF_HELPER_2(neon_sub_u16, i32, i32, i32)
-DEF_HELPER_2(neon_mul_u8, i32, i32, i32)
-DEF_HELPER_2(neon_mul_u16, i32, i32, i32)
-
-DEF_HELPER_2(neon_tst_u8, i32, i32, i32)
-DEF_HELPER_2(neon_tst_u16, i32, i32, i32)
-DEF_HELPER_2(neon_tst_u32, i32, i32, i32)
-
-DEF_HELPER_1(neon_clz_u8, i32, i32)
-DEF_HELPER_1(neon_clz_u16, i32, i32)
-DEF_HELPER_1(neon_cls_s8, i32, i32)
-DEF_HELPER_1(neon_cls_s16, i32, i32)
-DEF_HELPER_1(neon_cls_s32, i32, i32)
-DEF_HELPER_FLAGS_3(gvec_cnt_b, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(gvec_rbit_b, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-
-DEF_HELPER_3(neon_qdmulh_s16, i32, env, i32, i32)
-DEF_HELPER_3(neon_qrdmulh_s16, i32, env, i32, i32)
-DEF_HELPER_4(neon_qrdmlah_s16, i32, env, i32, i32, i32)
-DEF_HELPER_4(neon_qrdmlsh_s16, i32, env, i32, i32, i32)
-DEF_HELPER_3(neon_qdmulh_s32, i32, env, i32, i32)
-DEF_HELPER_3(neon_qrdmulh_s32, i32, env, i32, i32)
-DEF_HELPER_4(neon_qrdmlah_s32, i32, env, s32, s32, s32)
-DEF_HELPER_4(neon_qrdmlsh_s32, i32, env, s32, s32, s32)
-
-DEF_HELPER_1(neon_narrow_u8, i64, i64)
-DEF_HELPER_1(neon_narrow_u16, i64, i64)
-DEF_HELPER_2(neon_unarrow_sat8, i64, env, i64)
-DEF_HELPER_2(neon_narrow_sat_u8, i64, env, i64)
-DEF_HELPER_2(neon_narrow_sat_s8, i64, env, i64)
-DEF_HELPER_2(neon_unarrow_sat16, i64, env, i64)
-DEF_HELPER_2(neon_narrow_sat_u16, i64, env, i64)
-DEF_HELPER_2(neon_narrow_sat_s16, i64, env, i64)
-DEF_HELPER_2(neon_unarrow_sat32, i64, env, i64)
-DEF_HELPER_2(neon_narrow_sat_u32, i64, env, i64)
-DEF_HELPER_2(neon_narrow_sat_s32, i64, env, i64)
-DEF_HELPER_1(neon_narrow_high_u8, i32, i64)
-DEF_HELPER_1(neon_narrow_high_u16, i32, i64)
-DEF_HELPER_1(neon_narrow_round_high_u8, i32, i64)
-DEF_HELPER_1(neon_narrow_round_high_u16, i32, i64)
-DEF_HELPER_1(neon_widen_u8, i64, i32)
-DEF_HELPER_1(neon_widen_s8, i64, i32)
-DEF_HELPER_1(neon_widen_u16, i64, i32)
-DEF_HELPER_1(neon_widen_s16, i64, i32)
-
-DEF_HELPER_FLAGS_1(neon_addlp_s8, TCG_CALL_NO_RWG_SE, i64, i64)
-DEF_HELPER_FLAGS_1(neon_addlp_s16, TCG_CALL_NO_RWG_SE, i64, i64)
-DEF_HELPER_3(neon_addl_saturate_s32, i64, env, i64, i64)
-DEF_HELPER_3(neon_addl_saturate_s64, i64, env, i64, i64)
-DEF_HELPER_2(neon_abdl_u16, i64, i32, i32)
-DEF_HELPER_2(neon_abdl_s16, i64, i32, i32)
-DEF_HELPER_2(neon_abdl_u32, i64, i32, i32)
-DEF_HELPER_2(neon_abdl_s32, i64, i32, i32)
-DEF_HELPER_2(neon_abdl_u64, i64, i32, i32)
-DEF_HELPER_2(neon_abdl_s64, i64, i32, i32)
-DEF_HELPER_2(neon_mull_u8, i64, i32, i32)
-DEF_HELPER_2(neon_mull_s8, i64, i32, i32)
-DEF_HELPER_2(neon_mull_u16, i64, i32, i32)
-DEF_HELPER_2(neon_mull_s16, i64, i32, i32)
-
-DEF_HELPER_1(neon_negl_u16, i64, i64)
-DEF_HELPER_1(neon_negl_u32, i64, i64)
-
-DEF_HELPER_FLAGS_2(neon_qabs_s8, TCG_CALL_NO_RWG, i32, env, i32)
-DEF_HELPER_FLAGS_2(neon_qabs_s16, TCG_CALL_NO_RWG, i32, env, i32)
-DEF_HELPER_FLAGS_2(neon_qabs_s32, TCG_CALL_NO_RWG, i32, env, i32)
-DEF_HELPER_FLAGS_2(neon_qabs_s64, TCG_CALL_NO_RWG, i64, env, i64)
-DEF_HELPER_FLAGS_2(neon_qneg_s8, TCG_CALL_NO_RWG, i32, env, i32)
-DEF_HELPER_FLAGS_2(neon_qneg_s16, TCG_CALL_NO_RWG, i32, env, i32)
-DEF_HELPER_FLAGS_2(neon_qneg_s32, TCG_CALL_NO_RWG, i32, env, i32)
-DEF_HELPER_FLAGS_2(neon_qneg_s64, TCG_CALL_NO_RWG, i64, env, i64)
-
-DEF_HELPER_3(neon_ceq_f32, i32, i32, i32, fpst)
-DEF_HELPER_3(neon_cge_f32, i32, i32, i32, fpst)
-DEF_HELPER_3(neon_cgt_f32, i32, i32, i32, fpst)
-DEF_HELPER_3(neon_acge_f32, i32, i32, i32, fpst)
-DEF_HELPER_3(neon_acgt_f32, i32, i32, i32, fpst)
-DEF_HELPER_3(neon_acge_f64, i64, i64, i64, fpst)
-DEF_HELPER_3(neon_acgt_f64, i64, i64, i64, fpst)
-
-/* iwmmxt_helper.c */
-DEF_HELPER_2(iwmmxt_maddsq, i64, i64, i64)
-DEF_HELPER_2(iwmmxt_madduq, i64, i64, i64)
-DEF_HELPER_2(iwmmxt_sadb, i64, i64, i64)
-DEF_HELPER_2(iwmmxt_sadw, i64, i64, i64)
-DEF_HELPER_2(iwmmxt_mulslw, i64, i64, i64)
-DEF_HELPER_2(iwmmxt_mulshw, i64, i64, i64)
-DEF_HELPER_2(iwmmxt_mululw, i64, i64, i64)
-DEF_HELPER_2(iwmmxt_muluhw, i64, i64, i64)
-DEF_HELPER_2(iwmmxt_macsw, i64, i64, i64)
-DEF_HELPER_2(iwmmxt_macuw, i64, i64, i64)
-DEF_HELPER_1(iwmmxt_setpsr_nz, i32, i64)
-
-#define DEF_IWMMXT_HELPER_SIZE_ENV(name) \
-DEF_HELPER_3(iwmmxt_##name##b, i64, env, i64, i64) \
-DEF_HELPER_3(iwmmxt_##name##w, i64, env, i64, i64) \
-DEF_HELPER_3(iwmmxt_##name##l, i64, env, i64, i64) \
-
-DEF_IWMMXT_HELPER_SIZE_ENV(unpackl)
-DEF_IWMMXT_HELPER_SIZE_ENV(unpackh)
-
-DEF_HELPER_2(iwmmxt_unpacklub, i64, env, i64)
-DEF_HELPER_2(iwmmxt_unpackluw, i64, env, i64)
-DEF_HELPER_2(iwmmxt_unpacklul, i64, env, i64)
-DEF_HELPER_2(iwmmxt_unpackhub, i64, env, i64)
-DEF_HELPER_2(iwmmxt_unpackhuw, i64, env, i64)
-DEF_HELPER_2(iwmmxt_unpackhul, i64, env, i64)
-DEF_HELPER_2(iwmmxt_unpacklsb, i64, env, i64)
-DEF_HELPER_2(iwmmxt_unpacklsw, i64, env, i64)
-DEF_HELPER_2(iwmmxt_unpacklsl, i64, env, i64)
-DEF_HELPER_2(iwmmxt_unpackhsb, i64, env, i64)
-DEF_HELPER_2(iwmmxt_unpackhsw, i64, env, i64)
-DEF_HELPER_2(iwmmxt_unpackhsl, i64, env, i64)
-
-DEF_IWMMXT_HELPER_SIZE_ENV(cmpeq)
-DEF_IWMMXT_HELPER_SIZE_ENV(cmpgtu)
-DEF_IWMMXT_HELPER_SIZE_ENV(cmpgts)
-
-DEF_IWMMXT_HELPER_SIZE_ENV(mins)
-DEF_IWMMXT_HELPER_SIZE_ENV(minu)
-DEF_IWMMXT_HELPER_SIZE_ENV(maxs)
-DEF_IWMMXT_HELPER_SIZE_ENV(maxu)
-
-DEF_IWMMXT_HELPER_SIZE_ENV(subn)
-DEF_IWMMXT_HELPER_SIZE_ENV(addn)
-DEF_IWMMXT_HELPER_SIZE_ENV(subu)
-DEF_IWMMXT_HELPER_SIZE_ENV(addu)
-DEF_IWMMXT_HELPER_SIZE_ENV(subs)
-DEF_IWMMXT_HELPER_SIZE_ENV(adds)
-
-DEF_HELPER_3(iwmmxt_avgb0, i64, env, i64, i64)
-DEF_HELPER_3(iwmmxt_avgb1, i64, env, i64, i64)
-DEF_HELPER_3(iwmmxt_avgw0, i64, env, i64, i64)
-DEF_HELPER_3(iwmmxt_avgw1, i64, env, i64, i64)
-
-DEF_HELPER_3(iwmmxt_align, i64, i64, i64, i32)
-DEF_HELPER_4(iwmmxt_insr, i64, i64, i32, i32, i32)
-
-DEF_HELPER_1(iwmmxt_bcstb, i64, i32)
-DEF_HELPER_1(iwmmxt_bcstw, i64, i32)
-DEF_HELPER_1(iwmmxt_bcstl, i64, i32)
-
-DEF_HELPER_1(iwmmxt_addcb, i64, i64)
-DEF_HELPER_1(iwmmxt_addcw, i64, i64)
-DEF_HELPER_1(iwmmxt_addcl, i64, i64)
-
-DEF_HELPER_1(iwmmxt_msbb, i32, i64)
-DEF_HELPER_1(iwmmxt_msbw, i32, i64)
-DEF_HELPER_1(iwmmxt_msbl, i32, i64)
-
-DEF_HELPER_3(iwmmxt_srlw, i64, env, i64, i32)
-DEF_HELPER_3(iwmmxt_srll, i64, env, i64, i32)
-DEF_HELPER_3(iwmmxt_srlq, i64, env, i64, i32)
-DEF_HELPER_3(iwmmxt_sllw, i64, env, i64, i32)
-DEF_HELPER_3(iwmmxt_slll, i64, env, i64, i32)
-DEF_HELPER_3(iwmmxt_sllq, i64, env, i64, i32)
-DEF_HELPER_3(iwmmxt_sraw, i64, env, i64, i32)
-DEF_HELPER_3(iwmmxt_sral, i64, env, i64, i32)
-DEF_HELPER_3(iwmmxt_sraq, i64, env, i64, i32)
-DEF_HELPER_3(iwmmxt_rorw, i64, env, i64, i32)
-DEF_HELPER_3(iwmmxt_rorl, i64, env, i64, i32)
-DEF_HELPER_3(iwmmxt_rorq, i64, env, i64, i32)
-DEF_HELPER_3(iwmmxt_shufh, i64, env, i64, i32)
-
-DEF_HELPER_3(iwmmxt_packuw, i64, env, i64, i64)
-DEF_HELPER_3(iwmmxt_packul, i64, env, i64, i64)
-DEF_HELPER_3(iwmmxt_packuq, i64, env, i64, i64)
-DEF_HELPER_3(iwmmxt_packsw, i64, env, i64, i64)
-DEF_HELPER_3(iwmmxt_packsl, i64, env, i64, i64)
-DEF_HELPER_3(iwmmxt_packsq, i64, env, i64, i64)
-
-DEF_HELPER_3(iwmmxt_muladdsl, i64, i64, i32, i32)
-DEF_HELPER_3(iwmmxt_muladdsw, i64, i64, i32, i32)
-DEF_HELPER_3(iwmmxt_muladdswl, i64, i64, i32, i32)
-
-DEF_HELPER_FLAGS_2(neon_unzip8, TCG_CALL_NO_RWG, void, ptr, ptr)
-DEF_HELPER_FLAGS_2(neon_unzip16, TCG_CALL_NO_RWG, void, ptr, ptr)
-DEF_HELPER_FLAGS_2(neon_qunzip8, TCG_CALL_NO_RWG, void, ptr, ptr)
-DEF_HELPER_FLAGS_2(neon_qunzip16, TCG_CALL_NO_RWG, void, ptr, ptr)
-DEF_HELPER_FLAGS_2(neon_qunzip32, TCG_CALL_NO_RWG, void, ptr, ptr)
-DEF_HELPER_FLAGS_2(neon_zip8, TCG_CALL_NO_RWG, void, ptr, ptr)
-DEF_HELPER_FLAGS_2(neon_zip16, TCG_CALL_NO_RWG, void, ptr, ptr)
-DEF_HELPER_FLAGS_2(neon_qzip8, TCG_CALL_NO_RWG, void, ptr, ptr)
-DEF_HELPER_FLAGS_2(neon_qzip16, TCG_CALL_NO_RWG, void, ptr, ptr)
-DEF_HELPER_FLAGS_2(neon_qzip32, TCG_CALL_NO_RWG, void, ptr, ptr)
-
-DEF_HELPER_FLAGS_4(crypto_aese, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(crypto_aesd, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(crypto_aesmc, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(crypto_aesimc, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(crypto_sha1su0, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(crypto_sha1c, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(crypto_sha1p, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(crypto_sha1m, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(crypto_sha1h, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(crypto_sha1su1, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(crypto_sha256h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(crypto_sha256h2, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(crypto_sha256su0, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(crypto_sha256su1, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(crypto_sha512h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(crypto_sha512h2, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(crypto_sha512su0, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(crypto_sha512su1, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(crypto_sm3tt1a, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(crypto_sm3tt1b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(crypto_sm3tt2a, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(crypto_sm3tt2b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(crypto_sm3partw1, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(crypto_sm3partw2, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(crypto_sm4e, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(crypto_sm4ekey, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(crypto_rax1, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_3(crc32, TCG_CALL_NO_RWG_SE, i32, i32, i32, i32)
-DEF_HELPER_FLAGS_3(crc32c, TCG_CALL_NO_RWG_SE, i32, i32, i32, i32)
-
-DEF_HELPER_FLAGS_5(gvec_qrdmlah_s16, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(gvec_qrdmlsh_s16, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(gvec_qrdmlah_s32, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(gvec_qrdmlsh_s32, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_5(sve2_sqrdmlah_b, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(sve2_sqrdmlsh_b, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(sve2_sqrdmlah_h, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(sve2_sqrdmlsh_h, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(sve2_sqrdmlah_s, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(sve2_sqrdmlsh_s, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(sve2_sqrdmlah_d, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(sve2_sqrdmlsh_d, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_5(gvec_sdot_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(gvec_udot_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(gvec_sdot_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(gvec_udot_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(gvec_usdot_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_5(gvec_sdot_idx_b, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(gvec_udot_idx_b, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(gvec_sdot_idx_h, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(gvec_udot_idx_h, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(gvec_sudot_idx_b, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(gvec_usdot_idx_b, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_5(gvec_fcaddh, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_5(gvec_fcadds, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_5(gvec_fcaddd, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, fpst, i32)
-
-DEF_HELPER_FLAGS_6(gvec_fcmlah, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_6(gvec_fcmlah_idx, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_6(gvec_fcmlas, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_6(gvec_fcmlas_idx, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_6(gvec_fcmlad, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, fpst, i32)
-
-DEF_HELPER_FLAGS_4(gvec_sstoh, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_4(gvec_sitos, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_4(gvec_ustoh, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_4(gvec_uitos, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_4(gvec_tosszh, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_4(gvec_tosizs, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_4(gvec_touszh, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_4(gvec_touizs, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
-
-DEF_HELPER_FLAGS_4(gvec_vcvt_sf, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_4(gvec_vcvt_uf, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_4(gvec_vcvt_rz_fs, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_4(gvec_vcvt_rz_fu, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
-
-DEF_HELPER_FLAGS_4(gvec_vcvt_sh, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_4(gvec_vcvt_uh, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_4(gvec_vcvt_rz_hs, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_4(gvec_vcvt_rz_hu, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
-
-DEF_HELPER_FLAGS_4(gvec_vcvt_sd, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_4(gvec_vcvt_ud, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_4(gvec_vcvt_rz_ds, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_4(gvec_vcvt_rz_du, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
-
-DEF_HELPER_FLAGS_4(gvec_vcvt_rm_sd, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_4(gvec_vcvt_rm_ud, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_4(gvec_vcvt_rm_ss, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_4(gvec_vcvt_rm_us, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_4(gvec_vcvt_rm_sh, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_4(gvec_vcvt_rm_uh, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
-
-DEF_HELPER_FLAGS_4(gvec_vrint_rm_h, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_4(gvec_vrint_rm_s, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
-
-DEF_HELPER_FLAGS_4(gvec_vrintx_h, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_4(gvec_vrintx_s, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
-
-DEF_HELPER_FLAGS_4(gvec_frecpe_h, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_4(gvec_frecpe_s, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_4(gvec_frecpe_rpres_s, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_4(gvec_frecpe_d, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
-
-DEF_HELPER_FLAGS_4(gvec_frsqrte_h, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_4(gvec_frsqrte_s, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_4(gvec_frsqrte_rpres_s, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_4(gvec_frsqrte_d, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
-
-DEF_HELPER_FLAGS_4(gvec_fcgt0_h, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_4(gvec_fcgt0_s, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_4(gvec_fcgt0_d, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
-
-DEF_HELPER_FLAGS_4(gvec_fcge0_h, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_4(gvec_fcge0_s, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_4(gvec_fcge0_d, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
-
-DEF_HELPER_FLAGS_4(gvec_fceq0_h, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_4(gvec_fceq0_s, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_4(gvec_fceq0_d, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
-
-DEF_HELPER_FLAGS_4(gvec_fcle0_h, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_4(gvec_fcle0_s, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_4(gvec_fcle0_d, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
-
-DEF_HELPER_FLAGS_4(gvec_fclt0_h, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_4(gvec_fclt0_s, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_4(gvec_fclt0_d, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
-
-DEF_HELPER_FLAGS_5(gvec_fadd_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_5(gvec_fadd_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_5(gvec_fadd_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-
-DEF_HELPER_FLAGS_5(gvec_fsub_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_5(gvec_fsub_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_5(gvec_fsub_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-
-DEF_HELPER_FLAGS_5(gvec_fmul_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_5(gvec_fmul_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_5(gvec_fmul_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-
-DEF_HELPER_FLAGS_5(gvec_fabd_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_5(gvec_fabd_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_5(gvec_fabd_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-
-DEF_HELPER_FLAGS_5(gvec_ah_fabd_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_5(gvec_ah_fabd_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_5(gvec_ah_fabd_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-
-DEF_HELPER_FLAGS_5(gvec_fceq_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_5(gvec_fceq_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_5(gvec_fceq_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-
-DEF_HELPER_FLAGS_5(gvec_fcge_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_5(gvec_fcge_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_5(gvec_fcge_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-
-DEF_HELPER_FLAGS_5(gvec_fcgt_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_5(gvec_fcgt_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_5(gvec_fcgt_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-
-DEF_HELPER_FLAGS_5(gvec_facge_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_5(gvec_facge_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_5(gvec_facge_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-
-DEF_HELPER_FLAGS_5(gvec_facgt_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_5(gvec_facgt_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_5(gvec_facgt_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-
-DEF_HELPER_FLAGS_5(gvec_fmax_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_5(gvec_fmax_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_5(gvec_fmax_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-
-DEF_HELPER_FLAGS_5(gvec_fmin_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_5(gvec_fmin_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_5(gvec_fmin_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-
-DEF_HELPER_FLAGS_5(gvec_fmaxnum_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_5(gvec_fmaxnum_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_5(gvec_fmaxnum_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-
-DEF_HELPER_FLAGS_5(gvec_fminnum_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_5(gvec_fminnum_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_5(gvec_fminnum_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-
-DEF_HELPER_FLAGS_5(gvec_recps_nf_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_5(gvec_recps_nf_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-
-DEF_HELPER_FLAGS_5(gvec_rsqrts_nf_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_5(gvec_rsqrts_nf_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-
-DEF_HELPER_FLAGS_5(gvec_fmla_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_5(gvec_fmla_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-
-DEF_HELPER_FLAGS_5(gvec_fmls_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_5(gvec_fmls_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-
-DEF_HELPER_FLAGS_5(gvec_vfma_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_5(gvec_vfma_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_5(gvec_vfma_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-
-DEF_HELPER_FLAGS_5(gvec_vfms_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_5(gvec_vfms_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_5(gvec_vfms_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-
-DEF_HELPER_FLAGS_5(gvec_ah_vfms_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_5(gvec_ah_vfms_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_5(gvec_ah_vfms_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-
-DEF_HELPER_FLAGS_5(gvec_ftsmul_h, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_5(gvec_ftsmul_s, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_5(gvec_ftsmul_d, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, fpst, i32)
-
-DEF_HELPER_FLAGS_5(gvec_fmul_idx_h, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_5(gvec_fmul_idx_s, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_5(gvec_fmul_idx_d, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, fpst, i32)
-
-DEF_HELPER_FLAGS_5(gvec_fmla_nf_idx_h, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_5(gvec_fmla_nf_idx_s, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, fpst, i32)
-
-DEF_HELPER_FLAGS_5(gvec_fmls_nf_idx_h, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_5(gvec_fmls_nf_idx_s, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, fpst, i32)
-
-DEF_HELPER_FLAGS_6(gvec_fmla_idx_h, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_6(gvec_fmla_idx_s, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_6(gvec_fmla_idx_d, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, fpst, i32)
-
-DEF_HELPER_FLAGS_6(gvec_fmls_idx_h, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_6(gvec_fmls_idx_s, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_6(gvec_fmls_idx_d, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, fpst, i32)
-
-DEF_HELPER_FLAGS_6(gvec_ah_fmls_idx_h, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_6(gvec_ah_fmls_idx_s, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_6(gvec_ah_fmls_idx_d, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, fpst, i32)
-
-DEF_HELPER_FLAGS_5(gvec_uqadd_b, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(gvec_uqadd_h, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(gvec_uqadd_s, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(gvec_uqadd_d, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(gvec_sqadd_b, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(gvec_sqadd_h, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(gvec_sqadd_s, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(gvec_sqadd_d, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(gvec_uqsub_b, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(gvec_uqsub_h, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(gvec_uqsub_s, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(gvec_uqsub_d, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(gvec_sqsub_b, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(gvec_sqsub_h, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(gvec_sqsub_s, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(gvec_sqsub_d, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(gvec_usqadd_b, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(gvec_usqadd_h, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(gvec_usqadd_s, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(gvec_usqadd_d, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(gvec_suqadd_b, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(gvec_suqadd_h, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(gvec_suqadd_s, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(gvec_suqadd_d, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_5(gvec_fmlal_a32, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_5(gvec_fmlal_a64, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_5(gvec_fmlal_idx_a32, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_5(gvec_fmlal_idx_a64, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, env, i32)
-
-DEF_HELPER_FLAGS_2(frint32_s, TCG_CALL_NO_RWG, f32, f32, fpst)
-DEF_HELPER_FLAGS_2(frint64_s, TCG_CALL_NO_RWG, f32, f32, fpst)
-DEF_HELPER_FLAGS_2(frint32_d, TCG_CALL_NO_RWG, f64, f64, fpst)
-DEF_HELPER_FLAGS_2(frint64_d, TCG_CALL_NO_RWG, f64, f64, fpst)
-
-DEF_HELPER_FLAGS_3(gvec_ceq0_b, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(gvec_ceq0_h, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(gvec_clt0_b, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(gvec_clt0_h, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(gvec_cle0_b, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(gvec_cle0_h, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(gvec_cgt0_b, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(gvec_cgt0_h, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(gvec_cge0_b, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(gvec_cge0_h, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(gvec_smulh_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_smulh_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_smulh_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_smulh_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(gvec_umulh_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_umulh_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_umulh_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_umulh_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(gvec_sshl_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_sshl_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_ushl_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_ushl_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(gvec_pmul_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_pmull_q, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(neon_pmull_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_3(gvec_ssra_b, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(gvec_ssra_h, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(gvec_ssra_s, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(gvec_ssra_d, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_3(gvec_usra_b, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(gvec_usra_h, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(gvec_usra_s, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(gvec_usra_d, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_3(gvec_srshr_b, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(gvec_srshr_h, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(gvec_srshr_s, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(gvec_srshr_d, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_3(gvec_urshr_b, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(gvec_urshr_h, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(gvec_urshr_s, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(gvec_urshr_d, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_3(gvec_srsra_b, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(gvec_srsra_h, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(gvec_srsra_s, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(gvec_srsra_d, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_3(gvec_ursra_b, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(gvec_ursra_h, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(gvec_ursra_s, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(gvec_ursra_d, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_3(gvec_sri_b, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(gvec_sri_h, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(gvec_sri_s, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(gvec_sri_d, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_3(gvec_sli_b, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(gvec_sli_h, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(gvec_sli_s, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(gvec_sli_d, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(gvec_sabd_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_sabd_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_sabd_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_sabd_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(gvec_uabd_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_uabd_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_uabd_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_uabd_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(gvec_saba_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_saba_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_saba_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_saba_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(gvec_uaba_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_uaba_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_uaba_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_uaba_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(gvec_mul_idx_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_mul_idx_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_mul_idx_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_5(gvec_mla_idx_h, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(gvec_mla_idx_s, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(gvec_mla_idx_d, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_5(gvec_mls_idx_h, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(gvec_mls_idx_s, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(gvec_mls_idx_d, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_5(neon_sqdmulh_h, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(neon_sqdmulh_s, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_5(neon_sqrdmulh_h, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(neon_sqrdmulh_s, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_5(neon_sqdmulh_idx_h, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(neon_sqdmulh_idx_s, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_5(neon_sqrdmulh_idx_h, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(neon_sqrdmulh_idx_s, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_5(neon_sqrdmlah_idx_h, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(neon_sqrdmlah_idx_s, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_5(neon_sqrdmlsh_idx_h, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(neon_sqrdmlsh_idx_s, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(sve2_sqdmulh_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(sve2_sqdmulh_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(sve2_sqdmulh_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(sve2_sqdmulh_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(sve2_sqrdmulh_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(sve2_sqrdmulh_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(sve2_sqrdmulh_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(sve2_sqrdmulh_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(sve2_sqdmulh_idx_h, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(sve2_sqdmulh_idx_s, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(sve2_sqdmulh_idx_d, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(sve2_sqrdmulh_idx_h, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(sve2_sqrdmulh_idx_s, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(sve2_sqrdmulh_idx_d, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_6(sve2_fmlal_zzzw_s, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_6(sve2_fmlal_zzxw_s, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, env, i32)
-
-DEF_HELPER_FLAGS_4(gvec_xar_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_5(gvec_smmla_b, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(gvec_ummla_b, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(gvec_usmmla_b, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_6(gvec_bfdot, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, env, i32)
-DEF_HELPER_FLAGS_6(gvec_bfdot_idx, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, env, i32)
-
-DEF_HELPER_FLAGS_6(gvec_bfmmla, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, env, i32)
-
-DEF_HELPER_FLAGS_6(gvec_bfmlal, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_6(gvec_bfmlal_idx, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, fpst, i32)
-
-DEF_HELPER_FLAGS_5(gvec_sclamp_b, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(gvec_sclamp_h, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(gvec_sclamp_s, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(gvec_sclamp_d, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_5(gvec_uclamp_b, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(gvec_uclamp_h, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(gvec_uclamp_s, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(gvec_uclamp_d, TCG_CALL_NO_RWG,
-                   void, ptr, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_5(gvec_faddp_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_5(gvec_faddp_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_5(gvec_faddp_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-
-DEF_HELPER_FLAGS_5(gvec_fmaxp_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_5(gvec_fmaxp_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_5(gvec_fmaxp_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-
-DEF_HELPER_FLAGS_5(gvec_fminp_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_5(gvec_fminp_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_5(gvec_fminp_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-
-DEF_HELPER_FLAGS_5(gvec_fmaxnump_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_5(gvec_fmaxnump_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_5(gvec_fmaxnump_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-
-DEF_HELPER_FLAGS_5(gvec_fminnump_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_5(gvec_fminnump_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_5(gvec_fminnump_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-
-DEF_HELPER_FLAGS_4(gvec_addp_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_addp_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_addp_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_addp_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(gvec_smaxp_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_smaxp_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_smaxp_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(gvec_sminp_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_sminp_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_sminp_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(gvec_umaxp_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_umaxp_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_umaxp_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(gvec_uminp_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_uminp_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_uminp_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_3(gvec_urecpe_s, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(gvec_ursqrte_s, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+#include "tcg/helper.h"
 
 #ifdef TARGET_AARCH64
 #include "tcg/helper-a64.h"
diff --git a/target/arm/tcg/helper.h b/target/arm/tcg/helper.h
new file mode 100644
index 0000000000..80db7c2c37
--- /dev/null
+++ b/target/arm/tcg/helper.h
@@ -0,0 +1,1153 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+DEF_HELPER_FLAGS_1(sxtb16, TCG_CALL_NO_RWG_SE, i32, i32)
+DEF_HELPER_FLAGS_1(uxtb16, TCG_CALL_NO_RWG_SE, i32, i32)
+
+DEF_HELPER_3(add_setq, i32, env, i32, i32)
+DEF_HELPER_3(add_saturate, i32, env, i32, i32)
+DEF_HELPER_3(sub_saturate, i32, env, i32, i32)
+DEF_HELPER_3(add_usaturate, i32, env, i32, i32)
+DEF_HELPER_3(sub_usaturate, i32, env, i32, i32)
+DEF_HELPER_FLAGS_3(sdiv, TCG_CALL_NO_RWG, s32, env, s32, s32)
+DEF_HELPER_FLAGS_3(udiv, TCG_CALL_NO_RWG, i32, env, i32, i32)
+DEF_HELPER_FLAGS_1(rbit, TCG_CALL_NO_RWG_SE, i32, i32)
+
+#define PAS_OP(pfx)  \
+    DEF_HELPER_3(pfx ## add8, i32, i32, i32, ptr) \
+    DEF_HELPER_3(pfx ## sub8, i32, i32, i32, ptr) \
+    DEF_HELPER_3(pfx ## sub16, i32, i32, i32, ptr) \
+    DEF_HELPER_3(pfx ## add16, i32, i32, i32, ptr) \
+    DEF_HELPER_3(pfx ## addsubx, i32, i32, i32, ptr) \
+    DEF_HELPER_3(pfx ## subaddx, i32, i32, i32, ptr)
+
+PAS_OP(s)
+PAS_OP(u)
+#undef PAS_OP
+
+#define PAS_OP(pfx)  \
+    DEF_HELPER_2(pfx ## add8, i32, i32, i32) \
+    DEF_HELPER_2(pfx ## sub8, i32, i32, i32) \
+    DEF_HELPER_2(pfx ## sub16, i32, i32, i32) \
+    DEF_HELPER_2(pfx ## add16, i32, i32, i32) \
+    DEF_HELPER_2(pfx ## addsubx, i32, i32, i32) \
+    DEF_HELPER_2(pfx ## subaddx, i32, i32, i32)
+PAS_OP(q)
+PAS_OP(sh)
+PAS_OP(uq)
+PAS_OP(uh)
+#undef PAS_OP
+
+DEF_HELPER_3(ssat, i32, env, i32, i32)
+DEF_HELPER_3(usat, i32, env, i32, i32)
+DEF_HELPER_3(ssat16, i32, env, i32, i32)
+DEF_HELPER_3(usat16, i32, env, i32, i32)
+
+DEF_HELPER_FLAGS_2(usad8, TCG_CALL_NO_RWG_SE, i32, i32, i32)
+
+DEF_HELPER_FLAGS_3(sel_flags, TCG_CALL_NO_RWG_SE,
+                   i32, i32, i32, i32)
+DEF_HELPER_2(exception_internal, noreturn, env, i32)
+DEF_HELPER_3(exception_with_syndrome, noreturn, env, i32, i32)
+DEF_HELPER_4(exception_with_syndrome_el, noreturn, env, i32, i32, i32)
+DEF_HELPER_2(exception_bkpt_insn, noreturn, env, i32)
+DEF_HELPER_2(exception_swstep, noreturn, env, i32)
+DEF_HELPER_2(exception_pc_alignment, noreturn, env, vaddr)
+DEF_HELPER_1(setend, void, env)
+DEF_HELPER_2(wfi, void, env, i32)
+DEF_HELPER_1(wfe, void, env)
+DEF_HELPER_2(wfit, void, env, i64)
+DEF_HELPER_1(yield, void, env)
+DEF_HELPER_1(pre_hvc, void, env)
+DEF_HELPER_2(pre_smc, void, env, i32)
+DEF_HELPER_1(vesb, void, env)
+
+DEF_HELPER_3(cpsr_write, void, env, i32, i32)
+DEF_HELPER_2(cpsr_write_eret, void, env, i32)
+DEF_HELPER_1(cpsr_read, i32, env)
+
+DEF_HELPER_3(v7m_msr, void, env, i32, i32)
+DEF_HELPER_2(v7m_mrs, i32, env, i32)
+
+DEF_HELPER_2(v7m_bxns, void, env, i32)
+DEF_HELPER_2(v7m_blxns, void, env, i32)
+
+DEF_HELPER_3(v7m_tt, i32, env, i32, i32)
+
+DEF_HELPER_1(v7m_preserve_fp_state, void, env)
+
+DEF_HELPER_2(v7m_vlstm, void, env, i32)
+DEF_HELPER_2(v7m_vlldm, void, env, i32)
+
+DEF_HELPER_2(v8m_stackcheck, void, env, i32)
+
+DEF_HELPER_FLAGS_2(check_bxj_trap, TCG_CALL_NO_WG, void, env, i32)
+
+DEF_HELPER_4(access_check_cp_reg, cptr, env, i32, i32, i32)
+DEF_HELPER_FLAGS_2(lookup_cp_reg, TCG_CALL_NO_RWG_SE, cptr, env, i32)
+DEF_HELPER_FLAGS_2(tidcp_el0, TCG_CALL_NO_WG, void, env, i32)
+DEF_HELPER_FLAGS_2(tidcp_el1, TCG_CALL_NO_WG, void, env, i32)
+DEF_HELPER_3(set_cp_reg, void, env, cptr, i32)
+DEF_HELPER_2(get_cp_reg, i32, env, cptr)
+DEF_HELPER_3(set_cp_reg64, void, env, cptr, i64)
+DEF_HELPER_2(get_cp_reg64, i64, env, cptr)
+
+DEF_HELPER_2(get_r13_banked, i32, env, i32)
+DEF_HELPER_3(set_r13_banked, void, env, i32, i32)
+
+DEF_HELPER_3(mrs_banked, i32, env, i32, i32)
+DEF_HELPER_4(msr_banked, void, env, i32, i32, i32)
+
+DEF_HELPER_2(get_user_reg, i32, env, i32)
+DEF_HELPER_3(set_user_reg, void, env, i32, i32)
+
+DEF_HELPER_FLAGS_1(rebuild_hflags_m32_newel, TCG_CALL_NO_RWG, void, env)
+DEF_HELPER_FLAGS_2(rebuild_hflags_m32, TCG_CALL_NO_RWG, void, env, int)
+DEF_HELPER_FLAGS_1(rebuild_hflags_a32_newel, TCG_CALL_NO_RWG, void, env)
+DEF_HELPER_FLAGS_2(rebuild_hflags_a32, TCG_CALL_NO_RWG, void, env, int)
+DEF_HELPER_FLAGS_2(rebuild_hflags_a64, TCG_CALL_NO_RWG, void, env, int)
+
+DEF_HELPER_FLAGS_5(probe_access, TCG_CALL_NO_WG, void, env, vaddr, i32, i32, i32)
+
+DEF_HELPER_1(vfp_get_fpscr, i32, env)
+DEF_HELPER_2(vfp_set_fpscr, void, env, i32)
+
+DEF_HELPER_3(vfp_addh, f16, f16, f16, fpst)
+DEF_HELPER_3(vfp_adds, f32, f32, f32, fpst)
+DEF_HELPER_3(vfp_addd, f64, f64, f64, fpst)
+DEF_HELPER_3(vfp_subh, f16, f16, f16, fpst)
+DEF_HELPER_3(vfp_subs, f32, f32, f32, fpst)
+DEF_HELPER_3(vfp_subd, f64, f64, f64, fpst)
+DEF_HELPER_3(vfp_mulh, f16, f16, f16, fpst)
+DEF_HELPER_3(vfp_muls, f32, f32, f32, fpst)
+DEF_HELPER_3(vfp_muld, f64, f64, f64, fpst)
+DEF_HELPER_3(vfp_divh, f16, f16, f16, fpst)
+DEF_HELPER_3(vfp_divs, f32, f32, f32, fpst)
+DEF_HELPER_3(vfp_divd, f64, f64, f64, fpst)
+DEF_HELPER_3(vfp_maxh, f16, f16, f16, fpst)
+DEF_HELPER_3(vfp_maxs, f32, f32, f32, fpst)
+DEF_HELPER_3(vfp_maxd, f64, f64, f64, fpst)
+DEF_HELPER_3(vfp_minh, f16, f16, f16, fpst)
+DEF_HELPER_3(vfp_mins, f32, f32, f32, fpst)
+DEF_HELPER_3(vfp_mind, f64, f64, f64, fpst)
+DEF_HELPER_3(vfp_maxnumh, f16, f16, f16, fpst)
+DEF_HELPER_3(vfp_maxnums, f32, f32, f32, fpst)
+DEF_HELPER_3(vfp_maxnumd, f64, f64, f64, fpst)
+DEF_HELPER_3(vfp_minnumh, f16, f16, f16, fpst)
+DEF_HELPER_3(vfp_minnums, f32, f32, f32, fpst)
+DEF_HELPER_3(vfp_minnumd, f64, f64, f64, fpst)
+DEF_HELPER_2(vfp_sqrth, f16, f16, fpst)
+DEF_HELPER_2(vfp_sqrts, f32, f32, fpst)
+DEF_HELPER_2(vfp_sqrtd, f64, f64, fpst)
+DEF_HELPER_3(vfp_cmph, void, f16, f16, env)
+DEF_HELPER_3(vfp_cmps, void, f32, f32, env)
+DEF_HELPER_3(vfp_cmpd, void, f64, f64, env)
+DEF_HELPER_3(vfp_cmpeh, void, f16, f16, env)
+DEF_HELPER_3(vfp_cmpes, void, f32, f32, env)
+DEF_HELPER_3(vfp_cmped, void, f64, f64, env)
+
+DEF_HELPER_2(vfp_fcvtds, f64, f32, fpst)
+DEF_HELPER_2(vfp_fcvtsd, f32, f64, fpst)
+DEF_HELPER_FLAGS_2(bfcvt, TCG_CALL_NO_RWG, i32, f32, fpst)
+DEF_HELPER_FLAGS_2(bfcvt_pair, TCG_CALL_NO_RWG, i32, i64, fpst)
+
+DEF_HELPER_2(vfp_uitoh, f16, i32, fpst)
+DEF_HELPER_2(vfp_uitos, f32, i32, fpst)
+DEF_HELPER_2(vfp_uitod, f64, i32, fpst)
+DEF_HELPER_2(vfp_sitoh, f16, i32, fpst)
+DEF_HELPER_2(vfp_sitos, f32, i32, fpst)
+DEF_HELPER_2(vfp_sitod, f64, i32, fpst)
+
+DEF_HELPER_2(vfp_touih, i32, f16, fpst)
+DEF_HELPER_2(vfp_touis, i32, f32, fpst)
+DEF_HELPER_2(vfp_touid, i32, f64, fpst)
+DEF_HELPER_2(vfp_touizh, i32, f16, fpst)
+DEF_HELPER_2(vfp_touizs, i32, f32, fpst)
+DEF_HELPER_2(vfp_touizd, i32, f64, fpst)
+DEF_HELPER_2(vfp_tosih, s32, f16, fpst)
+DEF_HELPER_2(vfp_tosis, s32, f32, fpst)
+DEF_HELPER_2(vfp_tosid, s32, f64, fpst)
+DEF_HELPER_2(vfp_tosizh, s32, f16, fpst)
+DEF_HELPER_2(vfp_tosizs, s32, f32, fpst)
+DEF_HELPER_2(vfp_tosizd, s32, f64, fpst)
+
+DEF_HELPER_3(vfp_toshh_round_to_zero, i32, f16, i32, fpst)
+DEF_HELPER_3(vfp_toslh_round_to_zero, i32, f16, i32, fpst)
+DEF_HELPER_3(vfp_touhh_round_to_zero, i32, f16, i32, fpst)
+DEF_HELPER_3(vfp_toulh_round_to_zero, i32, f16, i32, fpst)
+DEF_HELPER_3(vfp_toshs_round_to_zero, i32, f32, i32, fpst)
+DEF_HELPER_3(vfp_tosls_round_to_zero, i32, f32, i32, fpst)
+DEF_HELPER_3(vfp_touhs_round_to_zero, i32, f32, i32, fpst)
+DEF_HELPER_3(vfp_touls_round_to_zero, i32, f32, i32, fpst)
+DEF_HELPER_3(vfp_toshd_round_to_zero, i64, f64, i32, fpst)
+DEF_HELPER_3(vfp_tosld_round_to_zero, i64, f64, i32, fpst)
+DEF_HELPER_3(vfp_tosqd_round_to_zero, i64, f64, i32, fpst)
+DEF_HELPER_3(vfp_touhd_round_to_zero, i64, f64, i32, fpst)
+DEF_HELPER_3(vfp_tould_round_to_zero, i64, f64, i32, fpst)
+DEF_HELPER_3(vfp_touqd_round_to_zero, i64, f64, i32, fpst)
+DEF_HELPER_3(vfp_touhh, i32, f16, i32, fpst)
+DEF_HELPER_3(vfp_toshh, i32, f16, i32, fpst)
+DEF_HELPER_3(vfp_toulh, i32, f16, i32, fpst)
+DEF_HELPER_3(vfp_toslh, i32, f16, i32, fpst)
+DEF_HELPER_3(vfp_touqh, i64, f16, i32, fpst)
+DEF_HELPER_3(vfp_tosqh, i64, f16, i32, fpst)
+DEF_HELPER_3(vfp_toshs, i32, f32, i32, fpst)
+DEF_HELPER_3(vfp_tosls, i32, f32, i32, fpst)
+DEF_HELPER_3(vfp_tosqs, i64, f32, i32, fpst)
+DEF_HELPER_3(vfp_touhs, i32, f32, i32, fpst)
+DEF_HELPER_3(vfp_touls, i32, f32, i32, fpst)
+DEF_HELPER_3(vfp_touqs, i64, f32, i32, fpst)
+DEF_HELPER_3(vfp_toshd, i64, f64, i32, fpst)
+DEF_HELPER_3(vfp_tosld, i64, f64, i32, fpst)
+DEF_HELPER_3(vfp_tosqd, i64, f64, i32, fpst)
+DEF_HELPER_3(vfp_touhd, i64, f64, i32, fpst)
+DEF_HELPER_3(vfp_tould, i64, f64, i32, fpst)
+DEF_HELPER_3(vfp_touqd, i64, f64, i32, fpst)
+DEF_HELPER_3(vfp_shtos, f32, i32, i32, fpst)
+DEF_HELPER_3(vfp_sltos, f32, i32, i32, fpst)
+DEF_HELPER_3(vfp_sqtos, f32, i64, i32, fpst)
+DEF_HELPER_3(vfp_uhtos, f32, i32, i32, fpst)
+DEF_HELPER_3(vfp_ultos, f32, i32, i32, fpst)
+DEF_HELPER_3(vfp_uqtos, f32, i64, i32, fpst)
+DEF_HELPER_3(vfp_shtod, f64, i64, i32, fpst)
+DEF_HELPER_3(vfp_sltod, f64, i64, i32, fpst)
+DEF_HELPER_3(vfp_sqtod, f64, i64, i32, fpst)
+DEF_HELPER_3(vfp_uhtod, f64, i64, i32, fpst)
+DEF_HELPER_3(vfp_ultod, f64, i64, i32, fpst)
+DEF_HELPER_3(vfp_uqtod, f64, i64, i32, fpst)
+DEF_HELPER_3(vfp_shtoh, f16, i32, i32, fpst)
+DEF_HELPER_3(vfp_uhtoh, f16, i32, i32, fpst)
+DEF_HELPER_3(vfp_sltoh, f16, i32, i32, fpst)
+DEF_HELPER_3(vfp_ultoh, f16, i32, i32, fpst)
+DEF_HELPER_3(vfp_sqtoh, f16, i64, i32, fpst)
+DEF_HELPER_3(vfp_uqtoh, f16, i64, i32, fpst)
+
+DEF_HELPER_3(vfp_shtos_round_to_nearest, f32, i32, i32, fpst)
+DEF_HELPER_3(vfp_sltos_round_to_nearest, f32, i32, i32, fpst)
+DEF_HELPER_3(vfp_uhtos_round_to_nearest, f32, i32, i32, fpst)
+DEF_HELPER_3(vfp_ultos_round_to_nearest, f32, i32, i32, fpst)
+DEF_HELPER_3(vfp_shtod_round_to_nearest, f64, i64, i32, fpst)
+DEF_HELPER_3(vfp_sltod_round_to_nearest, f64, i64, i32, fpst)
+DEF_HELPER_3(vfp_uhtod_round_to_nearest, f64, i64, i32, fpst)
+DEF_HELPER_3(vfp_ultod_round_to_nearest, f64, i64, i32, fpst)
+DEF_HELPER_3(vfp_shtoh_round_to_nearest, f16, i32, i32, fpst)
+DEF_HELPER_3(vfp_uhtoh_round_to_nearest, f16, i32, i32, fpst)
+DEF_HELPER_3(vfp_sltoh_round_to_nearest, f16, i32, i32, fpst)
+DEF_HELPER_3(vfp_ultoh_round_to_nearest, f16, i32, i32, fpst)
+
+DEF_HELPER_FLAGS_2(set_rmode, TCG_CALL_NO_RWG, i32, i32, fpst)
+
+DEF_HELPER_FLAGS_3(vfp_fcvt_f16_to_f32, TCG_CALL_NO_RWG, f32, f16, fpst, i32)
+DEF_HELPER_FLAGS_3(vfp_fcvt_f32_to_f16, TCG_CALL_NO_RWG, f16, f32, fpst, i32)
+DEF_HELPER_FLAGS_3(vfp_fcvt_f16_to_f64, TCG_CALL_NO_RWG, f64, f16, fpst, i32)
+DEF_HELPER_FLAGS_3(vfp_fcvt_f64_to_f16, TCG_CALL_NO_RWG, f16, f64, fpst, i32)
+
+DEF_HELPER_4(vfp_muladdd, f64, f64, f64, f64, fpst)
+DEF_HELPER_4(vfp_muladds, f32, f32, f32, f32, fpst)
+DEF_HELPER_4(vfp_muladdh, f16, f16, f16, f16, fpst)
+
+DEF_HELPER_FLAGS_2(recpe_f16, TCG_CALL_NO_RWG, f16, f16, fpst)
+DEF_HELPER_FLAGS_2(recpe_f32, TCG_CALL_NO_RWG, f32, f32, fpst)
+DEF_HELPER_FLAGS_2(recpe_rpres_f32, TCG_CALL_NO_RWG, f32, f32, fpst)
+DEF_HELPER_FLAGS_2(recpe_f64, TCG_CALL_NO_RWG, f64, f64, fpst)
+DEF_HELPER_FLAGS_2(rsqrte_f16, TCG_CALL_NO_RWG, f16, f16, fpst)
+DEF_HELPER_FLAGS_2(rsqrte_f32, TCG_CALL_NO_RWG, f32, f32, fpst)
+DEF_HELPER_FLAGS_2(rsqrte_rpres_f32, TCG_CALL_NO_RWG, f32, f32, fpst)
+DEF_HELPER_FLAGS_2(rsqrte_f64, TCG_CALL_NO_RWG, f64, f64, fpst)
+DEF_HELPER_FLAGS_1(recpe_u32, TCG_CALL_NO_RWG, i32, i32)
+DEF_HELPER_FLAGS_1(rsqrte_u32, TCG_CALL_NO_RWG, i32, i32)
+DEF_HELPER_FLAGS_4(neon_tbl, TCG_CALL_NO_RWG, i64, env, i32, i64, i64)
+
+DEF_HELPER_3(shl_cc, i32, env, i32, i32)
+DEF_HELPER_3(shr_cc, i32, env, i32, i32)
+DEF_HELPER_3(sar_cc, i32, env, i32, i32)
+DEF_HELPER_3(ror_cc, i32, env, i32, i32)
+
+DEF_HELPER_FLAGS_2(rinth_exact, TCG_CALL_NO_RWG, f16, f16, fpst)
+DEF_HELPER_FLAGS_2(rints_exact, TCG_CALL_NO_RWG, f32, f32, fpst)
+DEF_HELPER_FLAGS_2(rintd_exact, TCG_CALL_NO_RWG, f64, f64, fpst)
+DEF_HELPER_FLAGS_2(rinth, TCG_CALL_NO_RWG, f16, f16, fpst)
+DEF_HELPER_FLAGS_2(rints, TCG_CALL_NO_RWG, f32, f32, fpst)
+DEF_HELPER_FLAGS_2(rintd, TCG_CALL_NO_RWG, f64, f64, fpst)
+
+DEF_HELPER_FLAGS_2(vjcvt, TCG_CALL_NO_RWG, i32, f64, env)
+DEF_HELPER_FLAGS_2(fjcvtzs, TCG_CALL_NO_RWG, i64, f64, fpst)
+
+DEF_HELPER_FLAGS_3(check_hcr_el2_trap, TCG_CALL_NO_WG, void, env, i32, i32)
+
+/* neon_helper.c */
+DEF_HELPER_2(neon_pmin_u8, i32, i32, i32)
+DEF_HELPER_2(neon_pmin_s8, i32, i32, i32)
+DEF_HELPER_2(neon_pmin_u16, i32, i32, i32)
+DEF_HELPER_2(neon_pmin_s16, i32, i32, i32)
+DEF_HELPER_2(neon_pmax_u8, i32, i32, i32)
+DEF_HELPER_2(neon_pmax_s8, i32, i32, i32)
+DEF_HELPER_2(neon_pmax_u16, i32, i32, i32)
+DEF_HELPER_2(neon_pmax_s16, i32, i32, i32)
+
+DEF_HELPER_2(neon_shl_u16, i32, i32, i32)
+DEF_HELPER_2(neon_shl_s16, i32, i32, i32)
+DEF_HELPER_2(neon_rshl_u8, i32, i32, i32)
+DEF_HELPER_2(neon_rshl_s8, i32, i32, i32)
+DEF_HELPER_2(neon_rshl_u16, i32, i32, i32)
+DEF_HELPER_2(neon_rshl_s16, i32, i32, i32)
+DEF_HELPER_2(neon_rshl_u32, i32, i32, i32)
+DEF_HELPER_2(neon_rshl_s32, i32, i32, i32)
+DEF_HELPER_2(neon_rshl_u64, i64, i64, i64)
+DEF_HELPER_2(neon_rshl_s64, i64, i64, i64)
+DEF_HELPER_3(neon_qshl_u8, i32, env, i32, i32)
+DEF_HELPER_3(neon_qshl_s8, i32, env, i32, i32)
+DEF_HELPER_3(neon_qshl_u16, i32, env, i32, i32)
+DEF_HELPER_3(neon_qshl_s16, i32, env, i32, i32)
+DEF_HELPER_3(neon_qshl_u32, i32, env, i32, i32)
+DEF_HELPER_3(neon_qshl_s32, i32, env, i32, i32)
+DEF_HELPER_3(neon_qshl_u64, i64, env, i64, i64)
+DEF_HELPER_3(neon_qshl_s64, i64, env, i64, i64)
+DEF_HELPER_3(neon_qshlu_s8, i32, env, i32, i32)
+DEF_HELPER_3(neon_qshlu_s16, i32, env, i32, i32)
+DEF_HELPER_3(neon_qshlu_s32, i32, env, i32, i32)
+DEF_HELPER_3(neon_qshlu_s64, i64, env, i64, i64)
+DEF_HELPER_3(neon_qrshl_u8, i32, env, i32, i32)
+DEF_HELPER_3(neon_qrshl_s8, i32, env, i32, i32)
+DEF_HELPER_3(neon_qrshl_u16, i32, env, i32, i32)
+DEF_HELPER_3(neon_qrshl_s16, i32, env, i32, i32)
+DEF_HELPER_3(neon_qrshl_u32, i32, env, i32, i32)
+DEF_HELPER_3(neon_qrshl_s32, i32, env, i32, i32)
+DEF_HELPER_3(neon_qrshl_u64, i64, env, i64, i64)
+DEF_HELPER_3(neon_qrshl_s64, i64, env, i64, i64)
+DEF_HELPER_FLAGS_5(neon_sqshl_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_5(neon_sqshl_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_5(neon_sqshl_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_5(neon_sqshl_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_5(neon_uqshl_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_5(neon_uqshl_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_5(neon_uqshl_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_5(neon_uqshl_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_5(neon_sqrshl_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_5(neon_sqrshl_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_5(neon_sqrshl_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_5(neon_sqrshl_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_5(neon_uqrshl_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_5(neon_uqrshl_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_5(neon_uqrshl_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_5(neon_uqrshl_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(neon_sqshli_b, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(neon_sqshli_h, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(neon_sqshli_s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(neon_sqshli_d, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(neon_uqshli_b, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(neon_uqshli_h, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(neon_uqshli_s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(neon_uqshli_d, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(neon_sqshlui_b, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(neon_sqshlui_h, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(neon_sqshlui_s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(neon_sqshlui_d, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+
+DEF_HELPER_FLAGS_4(gvec_srshl_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(gvec_srshl_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(gvec_srshl_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(gvec_srshl_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(gvec_urshl_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(gvec_urshl_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(gvec_urshl_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(gvec_urshl_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_2(neon_add_u8, i32, i32, i32)
+DEF_HELPER_2(neon_add_u16, i32, i32, i32)
+DEF_HELPER_2(neon_sub_u8, i32, i32, i32)
+DEF_HELPER_2(neon_sub_u16, i32, i32, i32)
+DEF_HELPER_2(neon_mul_u8, i32, i32, i32)
+DEF_HELPER_2(neon_mul_u16, i32, i32, i32)
+
+DEF_HELPER_2(neon_tst_u8, i32, i32, i32)
+DEF_HELPER_2(neon_tst_u16, i32, i32, i32)
+DEF_HELPER_2(neon_tst_u32, i32, i32, i32)
+
+DEF_HELPER_1(neon_clz_u8, i32, i32)
+DEF_HELPER_1(neon_clz_u16, i32, i32)
+DEF_HELPER_1(neon_cls_s8, i32, i32)
+DEF_HELPER_1(neon_cls_s16, i32, i32)
+DEF_HELPER_1(neon_cls_s32, i32, i32)
+DEF_HELPER_FLAGS_3(gvec_cnt_b, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(gvec_rbit_b, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+
+DEF_HELPER_3(neon_qdmulh_s16, i32, env, i32, i32)
+DEF_HELPER_3(neon_qrdmulh_s16, i32, env, i32, i32)
+DEF_HELPER_4(neon_qrdmlah_s16, i32, env, i32, i32, i32)
+DEF_HELPER_4(neon_qrdmlsh_s16, i32, env, i32, i32, i32)
+DEF_HELPER_3(neon_qdmulh_s32, i32, env, i32, i32)
+DEF_HELPER_3(neon_qrdmulh_s32, i32, env, i32, i32)
+DEF_HELPER_4(neon_qrdmlah_s32, i32, env, s32, s32, s32)
+DEF_HELPER_4(neon_qrdmlsh_s32, i32, env, s32, s32, s32)
+
+DEF_HELPER_1(neon_narrow_u8, i64, i64)
+DEF_HELPER_1(neon_narrow_u16, i64, i64)
+DEF_HELPER_2(neon_unarrow_sat8, i64, env, i64)
+DEF_HELPER_2(neon_narrow_sat_u8, i64, env, i64)
+DEF_HELPER_2(neon_narrow_sat_s8, i64, env, i64)
+DEF_HELPER_2(neon_unarrow_sat16, i64, env, i64)
+DEF_HELPER_2(neon_narrow_sat_u16, i64, env, i64)
+DEF_HELPER_2(neon_narrow_sat_s16, i64, env, i64)
+DEF_HELPER_2(neon_unarrow_sat32, i64, env, i64)
+DEF_HELPER_2(neon_narrow_sat_u32, i64, env, i64)
+DEF_HELPER_2(neon_narrow_sat_s32, i64, env, i64)
+DEF_HELPER_1(neon_narrow_high_u8, i32, i64)
+DEF_HELPER_1(neon_narrow_high_u16, i32, i64)
+DEF_HELPER_1(neon_narrow_round_high_u8, i32, i64)
+DEF_HELPER_1(neon_narrow_round_high_u16, i32, i64)
+DEF_HELPER_1(neon_widen_u8, i64, i32)
+DEF_HELPER_1(neon_widen_s8, i64, i32)
+DEF_HELPER_1(neon_widen_u16, i64, i32)
+DEF_HELPER_1(neon_widen_s16, i64, i32)
+
+DEF_HELPER_FLAGS_1(neon_addlp_s8, TCG_CALL_NO_RWG_SE, i64, i64)
+DEF_HELPER_FLAGS_1(neon_addlp_s16, TCG_CALL_NO_RWG_SE, i64, i64)
+DEF_HELPER_3(neon_addl_saturate_s32, i64, env, i64, i64)
+DEF_HELPER_3(neon_addl_saturate_s64, i64, env, i64, i64)
+DEF_HELPER_2(neon_abdl_u16, i64, i32, i32)
+DEF_HELPER_2(neon_abdl_s16, i64, i32, i32)
+DEF_HELPER_2(neon_abdl_u32, i64, i32, i32)
+DEF_HELPER_2(neon_abdl_s32, i64, i32, i32)
+DEF_HELPER_2(neon_abdl_u64, i64, i32, i32)
+DEF_HELPER_2(neon_abdl_s64, i64, i32, i32)
+DEF_HELPER_2(neon_mull_u8, i64, i32, i32)
+DEF_HELPER_2(neon_mull_s8, i64, i32, i32)
+DEF_HELPER_2(neon_mull_u16, i64, i32, i32)
+DEF_HELPER_2(neon_mull_s16, i64, i32, i32)
+
+DEF_HELPER_1(neon_negl_u16, i64, i64)
+DEF_HELPER_1(neon_negl_u32, i64, i64)
+
+DEF_HELPER_FLAGS_2(neon_qabs_s8, TCG_CALL_NO_RWG, i32, env, i32)
+DEF_HELPER_FLAGS_2(neon_qabs_s16, TCG_CALL_NO_RWG, i32, env, i32)
+DEF_HELPER_FLAGS_2(neon_qabs_s32, TCG_CALL_NO_RWG, i32, env, i32)
+DEF_HELPER_FLAGS_2(neon_qabs_s64, TCG_CALL_NO_RWG, i64, env, i64)
+DEF_HELPER_FLAGS_2(neon_qneg_s8, TCG_CALL_NO_RWG, i32, env, i32)
+DEF_HELPER_FLAGS_2(neon_qneg_s16, TCG_CALL_NO_RWG, i32, env, i32)
+DEF_HELPER_FLAGS_2(neon_qneg_s32, TCG_CALL_NO_RWG, i32, env, i32)
+DEF_HELPER_FLAGS_2(neon_qneg_s64, TCG_CALL_NO_RWG, i64, env, i64)
+
+DEF_HELPER_3(neon_ceq_f32, i32, i32, i32, fpst)
+DEF_HELPER_3(neon_cge_f32, i32, i32, i32, fpst)
+DEF_HELPER_3(neon_cgt_f32, i32, i32, i32, fpst)
+DEF_HELPER_3(neon_acge_f32, i32, i32, i32, fpst)
+DEF_HELPER_3(neon_acgt_f32, i32, i32, i32, fpst)
+DEF_HELPER_3(neon_acge_f64, i64, i64, i64, fpst)
+DEF_HELPER_3(neon_acgt_f64, i64, i64, i64, fpst)
+
+/* iwmmxt_helper.c */
+DEF_HELPER_2(iwmmxt_maddsq, i64, i64, i64)
+DEF_HELPER_2(iwmmxt_madduq, i64, i64, i64)
+DEF_HELPER_2(iwmmxt_sadb, i64, i64, i64)
+DEF_HELPER_2(iwmmxt_sadw, i64, i64, i64)
+DEF_HELPER_2(iwmmxt_mulslw, i64, i64, i64)
+DEF_HELPER_2(iwmmxt_mulshw, i64, i64, i64)
+DEF_HELPER_2(iwmmxt_mululw, i64, i64, i64)
+DEF_HELPER_2(iwmmxt_muluhw, i64, i64, i64)
+DEF_HELPER_2(iwmmxt_macsw, i64, i64, i64)
+DEF_HELPER_2(iwmmxt_macuw, i64, i64, i64)
+DEF_HELPER_1(iwmmxt_setpsr_nz, i32, i64)
+
+#define DEF_IWMMXT_HELPER_SIZE_ENV(name) \
+DEF_HELPER_3(iwmmxt_##name##b, i64, env, i64, i64) \
+DEF_HELPER_3(iwmmxt_##name##w, i64, env, i64, i64) \
+DEF_HELPER_3(iwmmxt_##name##l, i64, env, i64, i64) \
+
+DEF_IWMMXT_HELPER_SIZE_ENV(unpackl)
+DEF_IWMMXT_HELPER_SIZE_ENV(unpackh)
+
+DEF_HELPER_2(iwmmxt_unpacklub, i64, env, i64)
+DEF_HELPER_2(iwmmxt_unpackluw, i64, env, i64)
+DEF_HELPER_2(iwmmxt_unpacklul, i64, env, i64)
+DEF_HELPER_2(iwmmxt_unpackhub, i64, env, i64)
+DEF_HELPER_2(iwmmxt_unpackhuw, i64, env, i64)
+DEF_HELPER_2(iwmmxt_unpackhul, i64, env, i64)
+DEF_HELPER_2(iwmmxt_unpacklsb, i64, env, i64)
+DEF_HELPER_2(iwmmxt_unpacklsw, i64, env, i64)
+DEF_HELPER_2(iwmmxt_unpacklsl, i64, env, i64)
+DEF_HELPER_2(iwmmxt_unpackhsb, i64, env, i64)
+DEF_HELPER_2(iwmmxt_unpackhsw, i64, env, i64)
+DEF_HELPER_2(iwmmxt_unpackhsl, i64, env, i64)
+
+DEF_IWMMXT_HELPER_SIZE_ENV(cmpeq)
+DEF_IWMMXT_HELPER_SIZE_ENV(cmpgtu)
+DEF_IWMMXT_HELPER_SIZE_ENV(cmpgts)
+
+DEF_IWMMXT_HELPER_SIZE_ENV(mins)
+DEF_IWMMXT_HELPER_SIZE_ENV(minu)
+DEF_IWMMXT_HELPER_SIZE_ENV(maxs)
+DEF_IWMMXT_HELPER_SIZE_ENV(maxu)
+
+DEF_IWMMXT_HELPER_SIZE_ENV(subn)
+DEF_IWMMXT_HELPER_SIZE_ENV(addn)
+DEF_IWMMXT_HELPER_SIZE_ENV(subu)
+DEF_IWMMXT_HELPER_SIZE_ENV(addu)
+DEF_IWMMXT_HELPER_SIZE_ENV(subs)
+DEF_IWMMXT_HELPER_SIZE_ENV(adds)
+
+DEF_HELPER_3(iwmmxt_avgb0, i64, env, i64, i64)
+DEF_HELPER_3(iwmmxt_avgb1, i64, env, i64, i64)
+DEF_HELPER_3(iwmmxt_avgw0, i64, env, i64, i64)
+DEF_HELPER_3(iwmmxt_avgw1, i64, env, i64, i64)
+
+DEF_HELPER_3(iwmmxt_align, i64, i64, i64, i32)
+DEF_HELPER_4(iwmmxt_insr, i64, i64, i32, i32, i32)
+
+DEF_HELPER_1(iwmmxt_bcstb, i64, i32)
+DEF_HELPER_1(iwmmxt_bcstw, i64, i32)
+DEF_HELPER_1(iwmmxt_bcstl, i64, i32)
+
+DEF_HELPER_1(iwmmxt_addcb, i64, i64)
+DEF_HELPER_1(iwmmxt_addcw, i64, i64)
+DEF_HELPER_1(iwmmxt_addcl, i64, i64)
+
+DEF_HELPER_1(iwmmxt_msbb, i32, i64)
+DEF_HELPER_1(iwmmxt_msbw, i32, i64)
+DEF_HELPER_1(iwmmxt_msbl, i32, i64)
+
+DEF_HELPER_3(iwmmxt_srlw, i64, env, i64, i32)
+DEF_HELPER_3(iwmmxt_srll, i64, env, i64, i32)
+DEF_HELPER_3(iwmmxt_srlq, i64, env, i64, i32)
+DEF_HELPER_3(iwmmxt_sllw, i64, env, i64, i32)
+DEF_HELPER_3(iwmmxt_slll, i64, env, i64, i32)
+DEF_HELPER_3(iwmmxt_sllq, i64, env, i64, i32)
+DEF_HELPER_3(iwmmxt_sraw, i64, env, i64, i32)
+DEF_HELPER_3(iwmmxt_sral, i64, env, i64, i32)
+DEF_HELPER_3(iwmmxt_sraq, i64, env, i64, i32)
+DEF_HELPER_3(iwmmxt_rorw, i64, env, i64, i32)
+DEF_HELPER_3(iwmmxt_rorl, i64, env, i64, i32)
+DEF_HELPER_3(iwmmxt_rorq, i64, env, i64, i32)
+DEF_HELPER_3(iwmmxt_shufh, i64, env, i64, i32)
+
+DEF_HELPER_3(iwmmxt_packuw, i64, env, i64, i64)
+DEF_HELPER_3(iwmmxt_packul, i64, env, i64, i64)
+DEF_HELPER_3(iwmmxt_packuq, i64, env, i64, i64)
+DEF_HELPER_3(iwmmxt_packsw, i64, env, i64, i64)
+DEF_HELPER_3(iwmmxt_packsl, i64, env, i64, i64)
+DEF_HELPER_3(iwmmxt_packsq, i64, env, i64, i64)
+
+DEF_HELPER_3(iwmmxt_muladdsl, i64, i64, i32, i32)
+DEF_HELPER_3(iwmmxt_muladdsw, i64, i64, i32, i32)
+DEF_HELPER_3(iwmmxt_muladdswl, i64, i64, i32, i32)
+
+DEF_HELPER_FLAGS_2(neon_unzip8, TCG_CALL_NO_RWG, void, ptr, ptr)
+DEF_HELPER_FLAGS_2(neon_unzip16, TCG_CALL_NO_RWG, void, ptr, ptr)
+DEF_HELPER_FLAGS_2(neon_qunzip8, TCG_CALL_NO_RWG, void, ptr, ptr)
+DEF_HELPER_FLAGS_2(neon_qunzip16, TCG_CALL_NO_RWG, void, ptr, ptr)
+DEF_HELPER_FLAGS_2(neon_qunzip32, TCG_CALL_NO_RWG, void, ptr, ptr)
+DEF_HELPER_FLAGS_2(neon_zip8, TCG_CALL_NO_RWG, void, ptr, ptr)
+DEF_HELPER_FLAGS_2(neon_zip16, TCG_CALL_NO_RWG, void, ptr, ptr)
+DEF_HELPER_FLAGS_2(neon_qzip8, TCG_CALL_NO_RWG, void, ptr, ptr)
+DEF_HELPER_FLAGS_2(neon_qzip16, TCG_CALL_NO_RWG, void, ptr, ptr)
+DEF_HELPER_FLAGS_2(neon_qzip32, TCG_CALL_NO_RWG, void, ptr, ptr)
+
+DEF_HELPER_FLAGS_4(crypto_aese, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(crypto_aesd, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(crypto_aesmc, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(crypto_aesimc, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(crypto_sha1su0, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(crypto_sha1c, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(crypto_sha1p, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(crypto_sha1m, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(crypto_sha1h, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(crypto_sha1su1, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(crypto_sha256h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(crypto_sha256h2, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(crypto_sha256su0, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(crypto_sha256su1, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(crypto_sha512h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(crypto_sha512h2, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(crypto_sha512su0, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(crypto_sha512su1, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(crypto_sm3tt1a, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(crypto_sm3tt1b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(crypto_sm3tt2a, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(crypto_sm3tt2b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(crypto_sm3partw1, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(crypto_sm3partw2, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(crypto_sm4e, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(crypto_sm4ekey, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(crypto_rax1, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_3(crc32, TCG_CALL_NO_RWG_SE, i32, i32, i32, i32)
+DEF_HELPER_FLAGS_3(crc32c, TCG_CALL_NO_RWG_SE, i32, i32, i32, i32)
+
+DEF_HELPER_FLAGS_5(gvec_qrdmlah_s16, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_qrdmlsh_s16, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_qrdmlah_s32, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_qrdmlsh_s32, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_5(sve2_sqrdmlah_b, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(sve2_sqrdmlsh_b, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(sve2_sqrdmlah_h, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(sve2_sqrdmlsh_h, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(sve2_sqrdmlah_s, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(sve2_sqrdmlsh_s, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(sve2_sqrdmlah_d, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(sve2_sqrdmlsh_d, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_5(gvec_sdot_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_udot_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_sdot_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_udot_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_usdot_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_5(gvec_sdot_idx_b, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_udot_idx_b, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_sdot_idx_h, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_udot_idx_h, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_sudot_idx_b, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_usdot_idx_b, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_5(gvec_fcaddh, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_fcadds, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_fcaddd, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, fpst, i32)
+
+DEF_HELPER_FLAGS_6(gvec_fcmlah, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_6(gvec_fcmlah_idx, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_6(gvec_fcmlas, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_6(gvec_fcmlas_idx, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_6(gvec_fcmlad, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, fpst, i32)
+
+DEF_HELPER_FLAGS_4(gvec_sstoh, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_4(gvec_sitos, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_4(gvec_ustoh, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_4(gvec_uitos, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_4(gvec_tosszh, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_4(gvec_tosizs, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_4(gvec_touszh, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_4(gvec_touizs, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
+
+DEF_HELPER_FLAGS_4(gvec_vcvt_sf, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_4(gvec_vcvt_uf, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_4(gvec_vcvt_rz_fs, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_4(gvec_vcvt_rz_fu, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
+
+DEF_HELPER_FLAGS_4(gvec_vcvt_sh, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_4(gvec_vcvt_uh, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_4(gvec_vcvt_rz_hs, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_4(gvec_vcvt_rz_hu, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
+
+DEF_HELPER_FLAGS_4(gvec_vcvt_sd, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_4(gvec_vcvt_ud, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_4(gvec_vcvt_rz_ds, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_4(gvec_vcvt_rz_du, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
+
+DEF_HELPER_FLAGS_4(gvec_vcvt_rm_sd, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_4(gvec_vcvt_rm_ud, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_4(gvec_vcvt_rm_ss, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_4(gvec_vcvt_rm_us, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_4(gvec_vcvt_rm_sh, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_4(gvec_vcvt_rm_uh, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
+
+DEF_HELPER_FLAGS_4(gvec_vrint_rm_h, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_4(gvec_vrint_rm_s, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
+
+DEF_HELPER_FLAGS_4(gvec_vrintx_h, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_4(gvec_vrintx_s, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
+
+DEF_HELPER_FLAGS_4(gvec_frecpe_h, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_4(gvec_frecpe_s, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_4(gvec_frecpe_rpres_s, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_4(gvec_frecpe_d, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
+
+DEF_HELPER_FLAGS_4(gvec_frsqrte_h, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_4(gvec_frsqrte_s, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_4(gvec_frsqrte_rpres_s, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_4(gvec_frsqrte_d, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
+
+DEF_HELPER_FLAGS_4(gvec_fcgt0_h, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_4(gvec_fcgt0_s, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_4(gvec_fcgt0_d, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
+
+DEF_HELPER_FLAGS_4(gvec_fcge0_h, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_4(gvec_fcge0_s, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_4(gvec_fcge0_d, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
+
+DEF_HELPER_FLAGS_4(gvec_fceq0_h, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_4(gvec_fceq0_s, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_4(gvec_fceq0_d, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
+
+DEF_HELPER_FLAGS_4(gvec_fcle0_h, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_4(gvec_fcle0_s, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_4(gvec_fcle0_d, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
+
+DEF_HELPER_FLAGS_4(gvec_fclt0_h, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_4(gvec_fclt0_s, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_4(gvec_fclt0_d, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
+
+DEF_HELPER_FLAGS_5(gvec_fadd_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_fadd_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_fadd_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+
+DEF_HELPER_FLAGS_5(gvec_fsub_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_fsub_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_fsub_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+
+DEF_HELPER_FLAGS_5(gvec_fmul_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_fmul_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_fmul_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+
+DEF_HELPER_FLAGS_5(gvec_fabd_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_fabd_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_fabd_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+
+DEF_HELPER_FLAGS_5(gvec_ah_fabd_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_ah_fabd_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_ah_fabd_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+
+DEF_HELPER_FLAGS_5(gvec_fceq_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_fceq_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_fceq_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+
+DEF_HELPER_FLAGS_5(gvec_fcge_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_fcge_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_fcge_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+
+DEF_HELPER_FLAGS_5(gvec_fcgt_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_fcgt_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_fcgt_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+
+DEF_HELPER_FLAGS_5(gvec_facge_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_facge_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_facge_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+
+DEF_HELPER_FLAGS_5(gvec_facgt_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_facgt_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_facgt_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+
+DEF_HELPER_FLAGS_5(gvec_fmax_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_fmax_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_fmax_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+
+DEF_HELPER_FLAGS_5(gvec_fmin_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_fmin_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_fmin_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+
+DEF_HELPER_FLAGS_5(gvec_fmaxnum_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_fmaxnum_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_fmaxnum_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+
+DEF_HELPER_FLAGS_5(gvec_fminnum_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_fminnum_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_fminnum_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+
+DEF_HELPER_FLAGS_5(gvec_recps_nf_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_recps_nf_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+
+DEF_HELPER_FLAGS_5(gvec_rsqrts_nf_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_rsqrts_nf_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+
+DEF_HELPER_FLAGS_5(gvec_fmla_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_fmla_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+
+DEF_HELPER_FLAGS_5(gvec_fmls_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_fmls_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+
+DEF_HELPER_FLAGS_5(gvec_vfma_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_vfma_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_vfma_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+
+DEF_HELPER_FLAGS_5(gvec_vfms_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_vfms_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_vfms_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+
+DEF_HELPER_FLAGS_5(gvec_ah_vfms_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_ah_vfms_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_ah_vfms_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+
+DEF_HELPER_FLAGS_5(gvec_ftsmul_h, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_ftsmul_s, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_ftsmul_d, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, fpst, i32)
+
+DEF_HELPER_FLAGS_5(gvec_fmul_idx_h, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_fmul_idx_s, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_fmul_idx_d, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, fpst, i32)
+
+DEF_HELPER_FLAGS_5(gvec_fmla_nf_idx_h, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_fmla_nf_idx_s, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, fpst, i32)
+
+DEF_HELPER_FLAGS_5(gvec_fmls_nf_idx_h, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_fmls_nf_idx_s, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, fpst, i32)
+
+DEF_HELPER_FLAGS_6(gvec_fmla_idx_h, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_6(gvec_fmla_idx_s, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_6(gvec_fmla_idx_d, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, fpst, i32)
+
+DEF_HELPER_FLAGS_6(gvec_fmls_idx_h, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_6(gvec_fmls_idx_s, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_6(gvec_fmls_idx_d, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, fpst, i32)
+
+DEF_HELPER_FLAGS_6(gvec_ah_fmls_idx_h, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_6(gvec_ah_fmls_idx_s, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_6(gvec_ah_fmls_idx_d, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, fpst, i32)
+
+DEF_HELPER_FLAGS_5(gvec_uqadd_b, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_uqadd_h, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_uqadd_s, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_uqadd_d, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_sqadd_b, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_sqadd_h, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_sqadd_s, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_sqadd_d, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_uqsub_b, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_uqsub_h, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_uqsub_s, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_uqsub_d, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_sqsub_b, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_sqsub_h, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_sqsub_s, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_sqsub_d, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_usqadd_b, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_usqadd_h, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_usqadd_s, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_usqadd_d, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_suqadd_b, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_suqadd_h, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_suqadd_s, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_suqadd_d, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_5(gvec_fmlal_a32, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_5(gvec_fmlal_a64, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_5(gvec_fmlal_idx_a32, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_5(gvec_fmlal_idx_a64, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, env, i32)
+
+DEF_HELPER_FLAGS_2(frint32_s, TCG_CALL_NO_RWG, f32, f32, fpst)
+DEF_HELPER_FLAGS_2(frint64_s, TCG_CALL_NO_RWG, f32, f32, fpst)
+DEF_HELPER_FLAGS_2(frint32_d, TCG_CALL_NO_RWG, f64, f64, fpst)
+DEF_HELPER_FLAGS_2(frint64_d, TCG_CALL_NO_RWG, f64, f64, fpst)
+
+DEF_HELPER_FLAGS_3(gvec_ceq0_b, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(gvec_ceq0_h, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(gvec_clt0_b, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(gvec_clt0_h, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(gvec_cle0_b, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(gvec_cle0_h, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(gvec_cgt0_b, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(gvec_cgt0_h, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(gvec_cge0_b, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(gvec_cge0_h, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(gvec_smulh_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(gvec_smulh_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(gvec_smulh_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(gvec_smulh_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(gvec_umulh_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(gvec_umulh_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(gvec_umulh_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(gvec_umulh_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(gvec_sshl_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(gvec_sshl_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(gvec_ushl_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(gvec_ushl_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(gvec_pmul_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(gvec_pmull_q, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(neon_pmull_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_3(gvec_ssra_b, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(gvec_ssra_h, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(gvec_ssra_s, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(gvec_ssra_d, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_3(gvec_usra_b, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(gvec_usra_h, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(gvec_usra_s, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(gvec_usra_d, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_3(gvec_srshr_b, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(gvec_srshr_h, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(gvec_srshr_s, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(gvec_srshr_d, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_3(gvec_urshr_b, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(gvec_urshr_h, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(gvec_urshr_s, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(gvec_urshr_d, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_3(gvec_srsra_b, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(gvec_srsra_h, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(gvec_srsra_s, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(gvec_srsra_d, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_3(gvec_ursra_b, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(gvec_ursra_h, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(gvec_ursra_s, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(gvec_ursra_d, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_3(gvec_sri_b, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(gvec_sri_h, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(gvec_sri_s, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(gvec_sri_d, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_3(gvec_sli_b, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(gvec_sli_h, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(gvec_sli_s, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(gvec_sli_d, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(gvec_sabd_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(gvec_sabd_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(gvec_sabd_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(gvec_sabd_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(gvec_uabd_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(gvec_uabd_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(gvec_uabd_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(gvec_uabd_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(gvec_saba_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(gvec_saba_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(gvec_saba_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(gvec_saba_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(gvec_uaba_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(gvec_uaba_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(gvec_uaba_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(gvec_uaba_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(gvec_mul_idx_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(gvec_mul_idx_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(gvec_mul_idx_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_5(gvec_mla_idx_h, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_mla_idx_s, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_mla_idx_d, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_5(gvec_mls_idx_h, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_mls_idx_s, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_mls_idx_d, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_5(neon_sqdmulh_h, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(neon_sqdmulh_s, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_5(neon_sqrdmulh_h, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(neon_sqrdmulh_s, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_5(neon_sqdmulh_idx_h, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(neon_sqdmulh_idx_s, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_5(neon_sqrdmulh_idx_h, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(neon_sqrdmulh_idx_s, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_5(neon_sqrdmlah_idx_h, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(neon_sqrdmlah_idx_s, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_5(neon_sqrdmlsh_idx_h, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(neon_sqrdmlsh_idx_s, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(sve2_sqdmulh_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sve2_sqdmulh_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sve2_sqdmulh_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sve2_sqdmulh_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(sve2_sqrdmulh_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sve2_sqrdmulh_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sve2_sqrdmulh_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sve2_sqrdmulh_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(sve2_sqdmulh_idx_h, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sve2_sqdmulh_idx_s, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sve2_sqdmulh_idx_d, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(sve2_sqrdmulh_idx_h, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sve2_sqrdmulh_idx_s, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sve2_sqrdmulh_idx_d, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_6(sve2_fmlal_zzzw_s, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_6(sve2_fmlal_zzxw_s, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, env, i32)
+
+DEF_HELPER_FLAGS_4(gvec_xar_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_5(gvec_smmla_b, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_ummla_b, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_usmmla_b, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_6(gvec_bfdot, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_6(gvec_bfdot_idx, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, env, i32)
+
+DEF_HELPER_FLAGS_6(gvec_bfmmla, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, env, i32)
+
+DEF_HELPER_FLAGS_6(gvec_bfmlal, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_6(gvec_bfmlal_idx, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, fpst, i32)
+
+DEF_HELPER_FLAGS_5(gvec_sclamp_b, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_sclamp_h, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_sclamp_s, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_sclamp_d, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_5(gvec_uclamp_b, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_uclamp_h, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_uclamp_s, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_uclamp_d, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_5(gvec_faddp_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_faddp_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_faddp_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+
+DEF_HELPER_FLAGS_5(gvec_fmaxp_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_fmaxp_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_fmaxp_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+
+DEF_HELPER_FLAGS_5(gvec_fminp_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_fminp_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_fminp_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+
+DEF_HELPER_FLAGS_5(gvec_fmaxnump_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_fmaxnump_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_fmaxnump_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+
+DEF_HELPER_FLAGS_5(gvec_fminnump_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_fminnump_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_fminnump_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+
+DEF_HELPER_FLAGS_4(gvec_addp_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(gvec_addp_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(gvec_addp_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(gvec_addp_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(gvec_smaxp_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(gvec_smaxp_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(gvec_smaxp_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(gvec_sminp_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(gvec_sminp_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(gvec_sminp_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(gvec_umaxp_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(gvec_umaxp_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(gvec_umaxp_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(gvec_uminp_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(gvec_uminp_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(gvec_uminp_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_3(gvec_urecpe_s, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(gvec_ursqrte_s, TCG_CALL_NO_RWG, void, ptr, ptr, i32)

From f9fba6ddfc854f427e00d62c1e4888ce9a1a7c34 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 12 May 2025 11:04:30 -0700
Subject: [PATCH 0911/2760] target/arm/debug_helper: only include common
 helpers

Avoid pulling helper.h which contains TARGET_AARCH64.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-id: 20250512180502.2395029-17-pierrick.bouvier@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/debug_helper.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/target/arm/debug_helper.c b/target/arm/debug_helper.c
index de7999f6a9..cad0a5db70 100644
--- a/target/arm/debug_helper.c
+++ b/target/arm/debug_helper.c
@@ -11,10 +11,12 @@
 #include "internals.h"
 #include "cpu-features.h"
 #include "cpregs.h"
-#include "exec/helper-proto.h"
 #include "exec/watchpoint.h"
 #include "system/tcg.h"
 
+#define HELPER_H "tcg/helper.h"
+#include "exec/helper-proto.h.inc"
+
 #ifdef CONFIG_TCG
 /* Return the Exception Level targeted by debug exceptions. */
 static int arm_debug_target_el(CPUARMState *env)

From 61dcfb2ef255d17a23262170457568af52fb0516 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 12 May 2025 11:04:31 -0700
Subject: [PATCH 0912/2760] target/arm/debug_helper: remove target_ulong
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-id: 20250512180502.2395029-18-pierrick.bouvier@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/debug_helper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/debug_helper.c b/target/arm/debug_helper.c
index cad0a5db70..69fb1d0d9f 100644
--- a/target/arm/debug_helper.c
+++ b/target/arm/debug_helper.c
@@ -380,7 +380,7 @@ bool arm_debug_check_breakpoint(CPUState *cs)
 {
     ARMCPU *cpu = ARM_CPU(cs);
     CPUARMState *env = &cpu->env;
-    target_ulong pc;
+    vaddr pc;
     int n;
 
     /*

From 64961a801500035b9a039c474b6225e0cfd3f44e Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 12 May 2025 11:04:32 -0700
Subject: [PATCH 0913/2760] target/arm/debug_helper: compile file twice (user,
 system)

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-id: 20250512180502.2395029-19-pierrick.bouvier@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/meson.build | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/target/arm/meson.build b/target/arm/meson.build
index de214fe5d5..48a6bf5935 100644
--- a/target/arm/meson.build
+++ b/target/arm/meson.build
@@ -1,7 +1,6 @@
 arm_ss = ss.source_set()
 arm_common_ss = ss.source_set()
 arm_ss.add(files(
-  'debug_helper.c',
   'gdbstub.c',
   'helper.c',
   'vfp_fpscr.c',
@@ -29,11 +28,18 @@ arm_system_ss.add(files(
 arm_user_ss = ss.source_set()
 arm_user_ss.add(files('cpu.c'))
 arm_user_ss.add(when: 'TARGET_AARCH64', if_false: files(
-  'cpu32-stubs.c'))
+  'cpu32-stubs.c',
+))
+arm_user_ss.add(files(
+  'debug_helper.c',
+))
 
 arm_common_system_ss.add(files('cpu.c'), capstone)
 arm_common_system_ss.add(when: 'TARGET_AARCH64', if_false: files(
   'cpu32-stubs.c'))
+arm_common_system_ss.add(files(
+  'debug_helper.c',
+))
 
 subdir('hvf')
 

From 2fdfdeb2f2a46ee5b96918dfd18cdeedf3bba013 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 12 May 2025 11:04:33 -0700
Subject: [PATCH 0914/2760] target/arm/helper: restrict include to common
 helpers

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-id: 20250512180502.2395029-20-pierrick.bouvier@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index 4a2d1ecbfe..3795dccd16 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -12,7 +12,6 @@
 #include "cpu.h"
 #include "internals.h"
 #include "cpu-features.h"
-#include "exec/helper-proto.h"
 #include "exec/page-protection.h"
 #include "exec/mmap-lock.h"
 #include "qemu/main-loop.h"
@@ -35,6 +34,9 @@
 #include "cpregs.h"
 #include "target/arm/gtimer.h"
 
+#define HELPER_H "tcg/helper.h"
+#include "exec/helper-proto.h.inc"
+
 #define ARM_CPU_FREQ 1000000000 /* FIXME: 1 GHz, should be configurable */
 
 static void switch_mode(CPUARMState *env, int mode);

From d626a26dd1ce0ede8e5e5a1c73f089f5e711f9e8 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 12 May 2025 11:04:34 -0700
Subject: [PATCH 0915/2760] target/arm/helper: replace target_ulong by vaddr
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-id: 20250512180502.2395029-21-pierrick.bouvier@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index 3795dccd16..d2607107eb 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -10621,7 +10621,7 @@ static void arm_cpu_do_interrupt_aarch64(CPUState *cs)
     ARMCPU *cpu = ARM_CPU(cs);
     CPUARMState *env = &cpu->env;
     unsigned int new_el = env->exception.target_el;
-    target_ulong addr = env->cp15.vbar_el[new_el];
+    vaddr addr = env->cp15.vbar_el[new_el];
     unsigned int new_mode = aarch64_pstate_mode(new_el, true);
     unsigned int old_mode;
     unsigned int cur_el = arm_current_el(env);

From 8eb048210e150d9f4fb7225f598de605a3633f67 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 12 May 2025 11:04:35 -0700
Subject: [PATCH 0916/2760] target/arm/helper: expose aarch64 cpu registration
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

associated define_arm_cp_regs are guarded by
"cpu_isar_feature(aa64_*)", so it's safe to expose that code for arm
target (32 bit).

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-id: 20250512180502.2395029-22-pierrick.bouvier@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index d2607107eb..92a975bbf7 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -6590,7 +6590,6 @@ static const ARMCPRegInfo zcr_reginfo[] = {
       .writefn = zcr_write, .raw_writefn = raw_write },
 };
 
-#ifdef TARGET_AARCH64
 static CPAccessResult access_tpidr2(CPUARMState *env, const ARMCPRegInfo *ri,
                                     bool isread)
 {
@@ -6824,7 +6823,6 @@ static const ARMCPRegInfo nmi_reginfo[] = {
       .writefn = aa64_allint_write, .readfn = aa64_allint_read,
       .resetfn = arm_cp_reset_ignore },
 };
-#endif /* TARGET_AARCH64 */
 
 static void define_pmu_regs(ARMCPU *cpu)
 {
@@ -7016,7 +7014,6 @@ static const ARMCPRegInfo lor_reginfo[] = {
       .type = ARM_CP_CONST, .resetvalue = 0 },
 };
 
-#ifdef TARGET_AARCH64
 static CPAccessResult access_pauth(CPUARMState *env, const ARMCPRegInfo *ri,
                                    bool isread)
 {
@@ -7509,8 +7506,6 @@ static const ARMCPRegInfo nv2_reginfo[] = {
       .fieldoffset = offsetof(CPUARMState, cp15.vncr_el2) },
 };
 
-#endif /* TARGET_AARCH64 */
-
 static CPAccessResult access_predinv(CPUARMState *env, const ARMCPRegInfo *ri,
                                      bool isread)
 {
@@ -8951,7 +8946,6 @@ void register_cp_regs_for_features(ARMCPU *cpu)
         define_one_arm_cp_reg(cpu, &hcrx_el2_reginfo);
     }
 
-#ifdef TARGET_AARCH64
     if (cpu_isar_feature(aa64_sme, cpu)) {
         define_arm_cp_regs(cpu, sme_reginfo);
     }
@@ -9012,7 +9006,6 @@ void register_cp_regs_for_features(ARMCPU *cpu)
     if (cpu_isar_feature(aa64_nmi, cpu)) {
         define_arm_cp_regs(cpu, nmi_reginfo);
     }
-#endif
 
     if (cpu_isar_feature(any_predinv, cpu)) {
         define_arm_cp_regs(cpu, predinv_reginfo);

From 15e9ed7d7c376175285fe7694ef99b0a4c90f5b2 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 12 May 2025 11:04:36 -0700
Subject: [PATCH 0917/2760] target/arm/helper: remove remaining TARGET_AARCH64
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

They were hiding aarch64_sve_narrow_vq and aarch64_sve_change_el, which
we can expose safely.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250512180502.2395029-23-pierrick.bouvier@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 9 +--------
 1 file changed, 1 insertion(+), 8 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index 92a975bbf7..aae8554e8f 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -29,6 +29,7 @@
 #include "qemu/guest-random.h"
 #ifdef CONFIG_TCG
 #include "accel/tcg/probe.h"
+#include "accel/tcg/getpc.h"
 #include "semihosting/common-semi.h"
 #endif
 #include "cpregs.h"
@@ -6565,9 +6566,7 @@ static void zcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
      */
     new_len = sve_vqm1_for_el(env, cur_el);
     if (new_len < old_len) {
-#ifdef TARGET_AARCH64
         aarch64_sve_narrow_vq(env, new_len + 1);
-#endif
     }
 }
 
@@ -10625,9 +10624,7 @@ static void arm_cpu_do_interrupt_aarch64(CPUState *cs)
          * Note that new_el can never be 0.  If cur_el is 0, then
          * el0_a64 is is_a64(), else el0_a64 is ignored.
          */
-#ifdef TARGET_AARCH64
         aarch64_sve_change_el(env, cur_el, new_el, is_a64(env));
-#endif
     }
 
     if (cur_el < new_el) {
@@ -11418,7 +11415,6 @@ ARMMMUIdx arm_mmu_idx(CPUARMState *env)
     return arm_mmu_idx_el(env, arm_current_el(env));
 }
 
-#ifdef TARGET_AARCH64
 /*
  * The manual says that when SVE is enabled and VQ is widened the
  * implementation is allowed to zero the previously inaccessible
@@ -11530,12 +11526,9 @@ void aarch64_sve_change_el(CPUARMState *env, int old_el,
 
     /* When changing vector length, clear inaccessible state.  */
     if (new_len < old_len) {
-#ifdef TARGET_AARCH64
         aarch64_sve_narrow_vq(env, new_len + 1);
-#endif
     }
 }
-#endif
 
 #ifndef CONFIG_USER_ONLY
 ARMSecuritySpace arm_security_space(CPUARMState *env)

From 9cf590f214c77faa98f9d315519de0961187b8ff Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 12 May 2025 11:04:37 -0700
Subject: [PATCH 0918/2760] target/arm/helper: compile file twice (user,
 system)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250512180502.2395029-24-pierrick.bouvier@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/meson.build | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/target/arm/meson.build b/target/arm/meson.build
index 48a6bf5935..c8c80c3f96 100644
--- a/target/arm/meson.build
+++ b/target/arm/meson.build
@@ -2,7 +2,6 @@ arm_ss = ss.source_set()
 arm_common_ss = ss.source_set()
 arm_ss.add(files(
   'gdbstub.c',
-  'helper.c',
   'vfp_fpscr.c',
 ))
 arm_ss.add(zlib)
@@ -32,6 +31,7 @@ arm_user_ss.add(when: 'TARGET_AARCH64', if_false: files(
 ))
 arm_user_ss.add(files(
   'debug_helper.c',
+  'helper.c',
 ))
 
 arm_common_system_ss.add(files('cpu.c'), capstone)
@@ -39,6 +39,7 @@ arm_common_system_ss.add(when: 'TARGET_AARCH64', if_false: files(
   'cpu32-stubs.c'))
 arm_common_system_ss.add(files(
   'debug_helper.c',
+  'helper.c',
 ))
 
 subdir('hvf')

From d4952244a9ce67a4fc85962ea50e8be0ec140e1e Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 12 May 2025 11:04:38 -0700
Subject: [PATCH 0919/2760] target/arm/vfp_fpscr: compile file twice (user,
 system)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250512180502.2395029-25-pierrick.bouvier@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/meson.build | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/target/arm/meson.build b/target/arm/meson.build
index c8c80c3f96..06d479570e 100644
--- a/target/arm/meson.build
+++ b/target/arm/meson.build
@@ -2,7 +2,6 @@ arm_ss = ss.source_set()
 arm_common_ss = ss.source_set()
 arm_ss.add(files(
   'gdbstub.c',
-  'vfp_fpscr.c',
 ))
 arm_ss.add(zlib)
 
@@ -32,6 +31,7 @@ arm_user_ss.add(when: 'TARGET_AARCH64', if_false: files(
 arm_user_ss.add(files(
   'debug_helper.c',
   'helper.c',
+  'vfp_fpscr.c',
 ))
 
 arm_common_system_ss.add(files('cpu.c'), capstone)
@@ -40,6 +40,7 @@ arm_common_system_ss.add(when: 'TARGET_AARCH64', if_false: files(
 arm_common_system_ss.add(files(
   'debug_helper.c',
   'helper.c',
+  'vfp_fpscr.c',
 ))
 
 subdir('hvf')

From 89356e123bfe09459bf0c596d6dce660971f6541 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 12 May 2025 11:04:39 -0700
Subject: [PATCH 0920/2760] target/arm/arch_dump: remove TARGET_AARCH64
 conditionals
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Associated code is protected by cpu_isar_feature(aa64*)

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-id: 20250512180502.2395029-26-pierrick.bouvier@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/arch_dump.c | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/target/arm/arch_dump.c b/target/arm/arch_dump.c
index c40df4e7fd..1dd79849c1 100644
--- a/target/arm/arch_dump.c
+++ b/target/arm/arch_dump.c
@@ -143,7 +143,6 @@ static int aarch64_write_elf64_prfpreg(WriteCoreDumpFunction f,
     return 0;
 }
 
-#ifdef TARGET_AARCH64
 static off_t sve_zreg_offset(uint32_t vq, int n)
 {
     off_t off = sizeof(struct aarch64_user_sve_header);
@@ -231,7 +230,6 @@ static int aarch64_write_elf64_sve(WriteCoreDumpFunction f,
 
     return 0;
 }
-#endif
 
 int arm_cpu_write_elf64_note(WriteCoreDumpFunction f, CPUState *cs,
                              int cpuid, DumpState *s)
@@ -273,11 +271,9 @@ int arm_cpu_write_elf64_note(WriteCoreDumpFunction f, CPUState *cs,
         return ret;
     }
 
-#ifdef TARGET_AARCH64
     if (cpu_isar_feature(aa64_sve, cpu)) {
         ret = aarch64_write_elf64_sve(f, env, cpuid, s);
     }
-#endif
 
     return ret;
 }
@@ -451,11 +447,9 @@ ssize_t cpu_get_note_size(int class, int machine, int nr_cpus)
     if (class == ELFCLASS64) {
         note_size = AARCH64_PRSTATUS_NOTE_SIZE;
         note_size += AARCH64_PRFPREG_NOTE_SIZE;
-#ifdef TARGET_AARCH64
         if (cpu_isar_feature(aa64_sve, cpu)) {
             note_size += AARCH64_SVE_NOTE_SIZE(&cpu->env);
         }
-#endif
     } else {
         note_size = ARM_PRSTATUS_NOTE_SIZE;
         if (cpu_isar_feature(aa32_vfp_simd, cpu)) {

From 55bb7a9ad097419b5406ed1e816339ed652f3017 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 12 May 2025 11:04:40 -0700
Subject: [PATCH 0921/2760] target/arm/arch_dump: compile file once (system)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250512180502.2395029-27-pierrick.bouvier@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/meson.build | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/meson.build b/target/arm/meson.build
index 06d479570e..95a2b077dd 100644
--- a/target/arm/meson.build
+++ b/target/arm/meson.build
@@ -15,7 +15,6 @@ arm_ss.add(when: 'TARGET_AARCH64', if_true: files(
 arm_system_ss = ss.source_set()
 arm_common_system_ss = ss.source_set()
 arm_system_ss.add(files(
-  'arch_dump.c',
   'arm-powerctl.c',
   'arm-qmp-cmds.c',
   'cortex-regs.c',
@@ -38,6 +37,7 @@ arm_common_system_ss.add(files('cpu.c'), capstone)
 arm_common_system_ss.add(when: 'TARGET_AARCH64', if_false: files(
   'cpu32-stubs.c'))
 arm_common_system_ss.add(files(
+  'arch_dump.c',
   'debug_helper.c',
   'helper.c',
   'vfp_fpscr.c',

From 262a5ce86ebfd7975ed6b5075a512d33e0ef1d1d Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 12 May 2025 11:04:41 -0700
Subject: [PATCH 0922/2760] target/arm/arm-powerctl: compile file once (system)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250512180502.2395029-28-pierrick.bouvier@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/meson.build | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/meson.build b/target/arm/meson.build
index 95a2b077dd..7db573f4a9 100644
--- a/target/arm/meson.build
+++ b/target/arm/meson.build
@@ -15,7 +15,6 @@ arm_ss.add(when: 'TARGET_AARCH64', if_true: files(
 arm_system_ss = ss.source_set()
 arm_common_system_ss = ss.source_set()
 arm_system_ss.add(files(
-  'arm-powerctl.c',
   'arm-qmp-cmds.c',
   'cortex-regs.c',
   'machine.c',
@@ -38,6 +37,7 @@ arm_common_system_ss.add(when: 'TARGET_AARCH64', if_false: files(
   'cpu32-stubs.c'))
 arm_common_system_ss.add(files(
   'arch_dump.c',
+  'arm-powerctl.c',
   'debug_helper.c',
   'helper.c',
   'vfp_fpscr.c',

From 7d5df02e7a5a8cd3673850db8eace624314a363c Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 12 May 2025 11:04:42 -0700
Subject: [PATCH 0923/2760] target/arm/cortex-regs: compile file once (system)

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-id: 20250512180502.2395029-29-pierrick.bouvier@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/meson.build | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/meson.build b/target/arm/meson.build
index 7db573f4a9..6e0327b6f5 100644
--- a/target/arm/meson.build
+++ b/target/arm/meson.build
@@ -16,7 +16,6 @@ arm_system_ss = ss.source_set()
 arm_common_system_ss = ss.source_set()
 arm_system_ss.add(files(
   'arm-qmp-cmds.c',
-  'cortex-regs.c',
   'machine.c',
   'ptw.c',
 ))
@@ -38,6 +37,7 @@ arm_common_system_ss.add(when: 'TARGET_AARCH64', if_false: files(
 arm_common_system_ss.add(files(
   'arch_dump.c',
   'arm-powerctl.c',
+  'cortex-regs.c',
   'debug_helper.c',
   'helper.c',
   'vfp_fpscr.c',

From 03bc7858fd87fc622b2671b319c2de8aad7aefd5 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 12 May 2025 11:04:43 -0700
Subject: [PATCH 0924/2760] target/arm/ptw: replace target_ulong with int64_t
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

sextract64 returns a signed value.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-id: 20250512180502.2395029-30-pierrick.bouvier@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index 89979c07e5..68ec3f5e75 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -1660,7 +1660,7 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
     uint64_t ttbr;
     hwaddr descaddr, indexmask, indexmask_grainsize;
     uint32_t tableattrs;
-    target_ulong page_size;
+    uint64_t page_size;
     uint64_t attrs;
     int32_t stride;
     int addrsize, inputsize, outputsize;
@@ -1733,7 +1733,7 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
      * validation to do here.
      */
     if (inputsize < addrsize) {
-        target_ulong top_bits = sextract64(address, inputsize,
+        uint64_t top_bits = sextract64(address, inputsize,
                                            addrsize - inputsize);
         if (-top_bits != param.select) {
             /* The gap between the two regions is a Translation fault */

From bdfbf92c34acec649fa7d8cd0389c2b6629c88ad Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 12 May 2025 11:04:44 -0700
Subject: [PATCH 0925/2760] target/arm/ptw: replace TARGET_AARCH64 by
 CONFIG_ATOMIC64 from arm_casq_ptw

This function needs 64 bit compare exchange, so we hide implementation
for hosts not supporting it (some 32 bit target, which don't run 64 bit
guests anyway).

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-id: 20250512180502.2395029-31-pierrick.bouvier@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index 68ec3f5e75..44170d831c 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -737,7 +737,7 @@ static uint64_t arm_casq_ptw(CPUARMState *env, uint64_t old_val,
                              uint64_t new_val, S1Translate *ptw,
                              ARMMMUFaultInfo *fi)
 {
-#if defined(TARGET_AARCH64) && defined(CONFIG_TCG)
+#if defined(CONFIG_ATOMIC64) && defined(CONFIG_TCG)
     uint64_t cur_val;
     void *host = ptw->out_host;
 

From aeacf43ae6f59139ab16adad7cd8c8e9f443536d Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 12 May 2025 11:04:45 -0700
Subject: [PATCH 0926/2760] target/arm/ptw: compile file once (system)

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-id: 20250512180502.2395029-32-pierrick.bouvier@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/meson.build | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/meson.build b/target/arm/meson.build
index 6e0327b6f5..151184da71 100644
--- a/target/arm/meson.build
+++ b/target/arm/meson.build
@@ -17,7 +17,6 @@ arm_common_system_ss = ss.source_set()
 arm_system_ss.add(files(
   'arm-qmp-cmds.c',
   'machine.c',
-  'ptw.c',
 ))
 
 arm_user_ss = ss.source_set()
@@ -40,6 +39,7 @@ arm_common_system_ss.add(files(
   'cortex-regs.c',
   'debug_helper.c',
   'helper.c',
+  'ptw.c',
   'vfp_fpscr.c',
 ))
 

From f86d42205c2eba2486fd305679f5963bb97b0371 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 12 May 2025 11:04:46 -0700
Subject: [PATCH 0927/2760] target/arm/meson: accelerator files are not needed
 in user mode
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250512180502.2395029-33-pierrick.bouvier@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/meson.build | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/target/arm/meson.build b/target/arm/meson.build
index 151184da71..29a36fb3c5 100644
--- a/target/arm/meson.build
+++ b/target/arm/meson.build
@@ -5,9 +5,6 @@ arm_ss.add(files(
 ))
 arm_ss.add(zlib)
 
-arm_ss.add(when: 'CONFIG_KVM', if_true: files('hyp_gdbstub.c', 'kvm.c'), if_false: files('kvm-stub.c'))
-arm_ss.add(when: 'CONFIG_HVF', if_true: files('hyp_gdbstub.c'))
-
 arm_ss.add(when: 'TARGET_AARCH64', if_true: files(
   'cpu64.c',
   'gdbstub64.c'))
@@ -18,6 +15,8 @@ arm_system_ss.add(files(
   'arm-qmp-cmds.c',
   'machine.c',
 ))
+arm_system_ss.add(when: 'CONFIG_KVM', if_true: files('hyp_gdbstub.c', 'kvm.c'), if_false: files('kvm-stub.c'))
+arm_system_ss.add(when: 'CONFIG_HVF', if_true: files('hyp_gdbstub.c'))
 
 arm_user_ss = ss.source_set()
 arm_user_ss.add(files('cpu.c'))

From cee0762c2b6236639979ba42a179d9d015057d94 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 12 May 2025 11:04:47 -0700
Subject: [PATCH 0928/2760] target/arm/kvm-stub: compile file once (system)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-id: 20250512180502.2395029-34-pierrick.bouvier@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/meson.build | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/target/arm/meson.build b/target/arm/meson.build
index 29a36fb3c5..bb1c09676d 100644
--- a/target/arm/meson.build
+++ b/target/arm/meson.build
@@ -15,7 +15,7 @@ arm_system_ss.add(files(
   'arm-qmp-cmds.c',
   'machine.c',
 ))
-arm_system_ss.add(when: 'CONFIG_KVM', if_true: files('hyp_gdbstub.c', 'kvm.c'), if_false: files('kvm-stub.c'))
+arm_system_ss.add(when: 'CONFIG_KVM', if_true: files('hyp_gdbstub.c', 'kvm.c'))
 arm_system_ss.add(when: 'CONFIG_HVF', if_true: files('hyp_gdbstub.c'))
 
 arm_user_ss = ss.source_set()
@@ -32,6 +32,7 @@ arm_user_ss.add(files(
 arm_common_system_ss.add(files('cpu.c'), capstone)
 arm_common_system_ss.add(when: 'TARGET_AARCH64', if_false: files(
   'cpu32-stubs.c'))
+arm_common_system_ss.add(when: 'CONFIG_KVM', if_false: files('kvm-stub.c'))
 arm_common_system_ss.add(files(
   'arch_dump.c',
   'arm-powerctl.c',

From d31eaa5bdbd5cf05d8313beb7149c33c4a6d750e Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 12 May 2025 11:04:48 -0700
Subject: [PATCH 0929/2760] target/arm/machine: reduce migration include to
 avoid target specific definitions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250512180502.2395029-35-pierrick.bouvier@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/machine.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/target/arm/machine.c b/target/arm/machine.c
index 978249fb71..f7956898fa 100644
--- a/target/arm/machine.c
+++ b/target/arm/machine.c
@@ -6,7 +6,8 @@
 #include "kvm_arm.h"
 #include "internals.h"
 #include "cpu-features.h"
-#include "migration/cpu.h"
+#include "migration/qemu-file-types.h"
+#include "migration/vmstate.h"
 #include "target/arm/gtimer.h"
 
 static bool vfp_needed(void *opaque)

From cb9f95996a5d2941da5a41cc168145aca3051a55 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 12 May 2025 11:04:49 -0700
Subject: [PATCH 0930/2760] target/arm/machine: remove TARGET_AARCH64 from
 migration state
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This exposes two new subsections for arm: vmstate_sve and vmstate_za.
Those sections have a ".needed" callback, which already allow to skip
them when not needed.

vmstate_sve .needed is checking cpu_isar_feature(aa64_sve, cpu).
vmstate_za .needed is checking ZA flag in cpu->env.svcr.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250512180502.2395029-36-pierrick.bouvier@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/machine.c | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/target/arm/machine.c b/target/arm/machine.c
index f7956898fa..868246a98c 100644
--- a/target/arm/machine.c
+++ b/target/arm/machine.c
@@ -241,7 +241,6 @@ static const VMStateDescription vmstate_iwmmxt = {
     }
 };
 
-#ifdef TARGET_AARCH64
 /* The expression ARM_MAX_VQ - 2 is 0 for pure AArch32 build,
  * and ARMPredicateReg is actively empty.  This triggers errors
  * in the expansion of the VMSTATE macros.
@@ -321,7 +320,6 @@ static const VMStateDescription vmstate_za = {
         VMSTATE_END_OF_LIST()
     }
 };
-#endif /* AARCH64 */
 
 static bool serror_needed(void *opaque)
 {
@@ -1102,10 +1100,8 @@ const VMStateDescription vmstate_arm_cpu = {
         &vmstate_pmsav7,
         &vmstate_pmsav8,
         &vmstate_m_security,
-#ifdef TARGET_AARCH64
         &vmstate_sve,
         &vmstate_za,
-#endif
         &vmstate_serror,
         &vmstate_irq_line_state,
         &vmstate_wfxt_timer,

From 1dfe5a0c2e3da5d315cb45dbd7336bf20ea9a0ae Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 12 May 2025 11:04:50 -0700
Subject: [PATCH 0931/2760] target/arm/machine: move cpu_post_load kvm bits to
 kvm_arm_cpu_post_load function
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250512180502.2395029-37-pierrick.bouvier@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/kvm.c     | 13 ++++++++++++-
 target/arm/kvm_arm.h |  4 +++-
 target/arm/machine.c |  8 +-------
 3 files changed, 16 insertions(+), 9 deletions(-)

diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index 82668d6438..a2791aa866 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -938,13 +938,24 @@ void kvm_arm_cpu_pre_save(ARMCPU *cpu)
     }
 }
 
-void kvm_arm_cpu_post_load(ARMCPU *cpu)
+bool kvm_arm_cpu_post_load(ARMCPU *cpu)
 {
+    if (!write_list_to_kvmstate(cpu, KVM_PUT_FULL_STATE)) {
+        return false;
+    }
+    /* Note that it's OK for the TCG side not to know about
+     * every register in the list; KVM is authoritative if
+     * we're using it.
+     */
+    write_list_to_cpustate(cpu);
+
     /* KVM virtual time adjustment */
     if (cpu->kvm_adjvtime) {
         cpu->kvm_vtime = *kvm_arm_get_cpreg_ptr(cpu, KVM_REG_ARM_TIMER_CNT);
         cpu->kvm_vtime_dirty = true;
     }
+
+    return true;
 }
 
 void kvm_arm_reset_vcpu(ARMCPU *cpu)
diff --git a/target/arm/kvm_arm.h b/target/arm/kvm_arm.h
index b638e09a68..c4178d1327 100644
--- a/target/arm/kvm_arm.h
+++ b/target/arm/kvm_arm.h
@@ -83,8 +83,10 @@ void kvm_arm_cpu_pre_save(ARMCPU *cpu);
  * @cpu: ARMCPU
  *
  * Called from cpu_post_load() to update KVM CPU state from the cpreg list.
+ *
+ * Returns: true on success, or false if write_list_to_kvmstate failed.
  */
-void kvm_arm_cpu_post_load(ARMCPU *cpu);
+bool kvm_arm_cpu_post_load(ARMCPU *cpu);
 
 /**
  * kvm_arm_reset_vcpu:
diff --git a/target/arm/machine.c b/target/arm/machine.c
index 868246a98c..e442d48524 100644
--- a/target/arm/machine.c
+++ b/target/arm/machine.c
@@ -976,15 +976,9 @@ static int cpu_post_load(void *opaque, int version_id)
     }
 
     if (kvm_enabled()) {
-        if (!write_list_to_kvmstate(cpu, KVM_PUT_FULL_STATE)) {
+        if (!kvm_arm_cpu_post_load(cpu)) {
             return -1;
         }
-        /* Note that it's OK for the TCG side not to know about
-         * every register in the list; KVM is authoritative if
-         * we're using it.
-         */
-        write_list_to_cpustate(cpu);
-        kvm_arm_cpu_post_load(cpu);
     } else {
         if (!write_list_to_cpustate(cpu)) {
             return -1;

From 1388256782014a7f6c730332f3561c6e1f94cc80 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 12 May 2025 11:04:51 -0700
Subject: [PATCH 0932/2760] target/arm/kvm-stub: add missing stubs

Those become needed once kvm_enabled can't be known at compile time.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-id: 20250512180502.2395029-38-pierrick.bouvier@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/kvm-stub.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/target/arm/kvm-stub.c b/target/arm/kvm-stub.c
index 4806365cdc..34e57fab01 100644
--- a/target/arm/kvm-stub.c
+++ b/target/arm/kvm-stub.c
@@ -109,3 +109,13 @@ void arm_cpu_kvm_set_irq(void *arm_cpu, int irq, int level)
 {
     g_assert_not_reached();
 }
+
+void kvm_arm_cpu_pre_save(ARMCPU *cpu)
+{
+    g_assert_not_reached();
+}
+
+bool kvm_arm_cpu_post_load(ARMCPU *cpu)
+{
+    g_assert_not_reached();
+}

From 2c5058cc1eb77ed5340448aa6dea13ae4f4f1593 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 12 May 2025 11:04:52 -0700
Subject: [PATCH 0933/2760] target/arm/machine: compile file once (system)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250512180502.2395029-39-pierrick.bouvier@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/meson.build | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/meson.build b/target/arm/meson.build
index bb1c09676d..b404fa5486 100644
--- a/target/arm/meson.build
+++ b/target/arm/meson.build
@@ -13,7 +13,6 @@ arm_system_ss = ss.source_set()
 arm_common_system_ss = ss.source_set()
 arm_system_ss.add(files(
   'arm-qmp-cmds.c',
-  'machine.c',
 ))
 arm_system_ss.add(when: 'CONFIG_KVM', if_true: files('hyp_gdbstub.c', 'kvm.c'))
 arm_system_ss.add(when: 'CONFIG_HVF', if_true: files('hyp_gdbstub.c'))
@@ -39,6 +38,7 @@ arm_common_system_ss.add(files(
   'cortex-regs.c',
   'debug_helper.c',
   'helper.c',
+  'machine.c',
   'ptw.c',
   'vfp_fpscr.c',
 ))

From 368b42f6dd64521b9282ddefa9e267eca621271c Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 12 May 2025 11:04:53 -0700
Subject: [PATCH 0934/2760] target/arm/tcg/vec_internal: use forward
 declaration for CPUARMState

Needed so this header can be included without requiring cpu.h.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-id: 20250512180502.2395029-40-pierrick.bouvier@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/vec_internal.h | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/target/arm/tcg/vec_internal.h b/target/arm/tcg/vec_internal.h
index 6b93b5aeb9..c02f9c37f8 100644
--- a/target/arm/tcg/vec_internal.h
+++ b/target/arm/tcg/vec_internal.h
@@ -22,6 +22,8 @@
 
 #include "fpu/softfloat.h"
 
+typedef struct CPUArchState CPUARMState;
+
 /*
  * Note that vector data is stored in host-endian 64-bit chunks,
  * so addressing units smaller than that needs a host-endian fixup.

From 9f8d002499e06f60878f803cb6ad70f1220a3ce4 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 12 May 2025 11:04:54 -0700
Subject: [PATCH 0935/2760] target/arm/tcg/crypto_helper: compile file once

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-id: 20250512180502.2395029-41-pierrick.bouvier@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/crypto_helper.c | 6 ++++--
 target/arm/tcg/meson.build     | 5 ++++-
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/target/arm/tcg/crypto_helper.c b/target/arm/tcg/crypto_helper.c
index 7cadd61e12..3428bd1bf0 100644
--- a/target/arm/tcg/crypto_helper.c
+++ b/target/arm/tcg/crypto_helper.c
@@ -10,14 +10,16 @@
  */
 
 #include "qemu/osdep.h"
+#include "qemu/bitops.h"
 
-#include "cpu.h"
-#include "exec/helper-proto.h"
 #include "tcg/tcg-gvec-desc.h"
 #include "crypto/aes-round.h"
 #include "crypto/sm4.h"
 #include "vec_internal.h"
 
+#define HELPER_H "tcg/helper.h"
+#include "exec/helper-proto.h.inc"
+
 union CRYPTO_STATE {
     uint8_t    bytes[16];
     uint32_t   words[4];
diff --git a/target/arm/tcg/meson.build b/target/arm/tcg/meson.build
index dd12ccedb1..2f73eefe38 100644
--- a/target/arm/tcg/meson.build
+++ b/target/arm/tcg/meson.build
@@ -30,7 +30,6 @@ arm_ss.add(files(
   'translate-mve.c',
   'translate-neon.c',
   'translate-vfp.c',
-  'crypto_helper.c',
   'hflags.c',
   'iwmmxt_helper.c',
   'm_helper.c',
@@ -63,3 +62,7 @@ arm_system_ss.add(files(
 
 arm_system_ss.add(when: 'CONFIG_ARM_V7M', if_true: files('cpu-v7m.c'))
 arm_user_ss.add(when: 'TARGET_AARCH64', if_false: files('cpu-v7m.c'))
+
+arm_common_ss.add(files(
+  'crypto_helper.c',
+))

From 12ae629d231b01e065b60288e82573842654054c Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 12 May 2025 11:04:55 -0700
Subject: [PATCH 0936/2760] target/arm/tcg/hflags: compile file twice (system,
 user)

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-id: 20250512180502.2395029-42-pierrick.bouvier@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/hflags.c    | 4 +++-
 target/arm/tcg/meson.build | 8 +++++++-
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/target/arm/tcg/hflags.c b/target/arm/tcg/hflags.c
index fd407a7b28..1ccec63bbd 100644
--- a/target/arm/tcg/hflags.c
+++ b/target/arm/tcg/hflags.c
@@ -9,11 +9,13 @@
 #include "cpu.h"
 #include "internals.h"
 #include "cpu-features.h"
-#include "exec/helper-proto.h"
 #include "exec/translation-block.h"
 #include "accel/tcg/cpu-ops.h"
 #include "cpregs.h"
 
+#define HELPER_H "tcg/helper.h"
+#include "exec/helper-proto.h.inc"
+
 static inline bool fgt_svc(CPUARMState *env, int el)
 {
     /*
diff --git a/target/arm/tcg/meson.build b/target/arm/tcg/meson.build
index 2f73eefe38..cee00b24cd 100644
--- a/target/arm/tcg/meson.build
+++ b/target/arm/tcg/meson.build
@@ -30,7 +30,6 @@ arm_ss.add(files(
   'translate-mve.c',
   'translate-neon.c',
   'translate-vfp.c',
-  'hflags.c',
   'iwmmxt_helper.c',
   'm_helper.c',
   'mve_helper.c',
@@ -66,3 +65,10 @@ arm_user_ss.add(when: 'TARGET_AARCH64', if_false: files('cpu-v7m.c'))
 arm_common_ss.add(files(
   'crypto_helper.c',
 ))
+
+arm_common_system_ss.add(files(
+  'hflags.c',
+))
+arm_user_ss.add(files(
+  'hflags.c',
+))

From d5f8252cd15bf0dc3ac458e7e78427905966cfbf Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 12 May 2025 11:04:56 -0700
Subject: [PATCH 0937/2760] target/arm/tcg/iwmmxt_helper: compile file twice
 (system, user)

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-id: 20250512180502.2395029-43-pierrick.bouvier@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/iwmmxt_helper.c | 4 +++-
 target/arm/tcg/meson.build     | 3 ++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/target/arm/tcg/iwmmxt_helper.c b/target/arm/tcg/iwmmxt_helper.c
index 610b1b2103..ba054b6b4d 100644
--- a/target/arm/tcg/iwmmxt_helper.c
+++ b/target/arm/tcg/iwmmxt_helper.c
@@ -22,7 +22,9 @@
 #include "qemu/osdep.h"
 
 #include "cpu.h"
-#include "exec/helper-proto.h"
+
+#define HELPER_H "tcg/helper.h"
+#include "exec/helper-proto.h.inc"
 
 /* iwMMXt macros extracted from GNU gdb.  */
 
diff --git a/target/arm/tcg/meson.build b/target/arm/tcg/meson.build
index cee00b24cd..02dfe768c5 100644
--- a/target/arm/tcg/meson.build
+++ b/target/arm/tcg/meson.build
@@ -30,7 +30,6 @@ arm_ss.add(files(
   'translate-mve.c',
   'translate-neon.c',
   'translate-vfp.c',
-  'iwmmxt_helper.c',
   'm_helper.c',
   'mve_helper.c',
   'neon_helper.c',
@@ -68,7 +67,9 @@ arm_common_ss.add(files(
 
 arm_common_system_ss.add(files(
   'hflags.c',
+  'iwmmxt_helper.c',
 ))
 arm_user_ss.add(files(
   'hflags.c',
+  'iwmmxt_helper.c',
 ))

From b586c86a8ea1bbf2bc7070153b38b8c75ff8b979 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 12 May 2025 11:04:57 -0700
Subject: [PATCH 0938/2760] target/arm/tcg/neon_helper: compile file twice
 (system, user)

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-id: 20250512180502.2395029-44-pierrick.bouvier@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/meson.build   | 3 ++-
 target/arm/tcg/neon_helper.c | 4 +++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/target/arm/tcg/meson.build b/target/arm/tcg/meson.build
index 02dfe768c5..af786196d2 100644
--- a/target/arm/tcg/meson.build
+++ b/target/arm/tcg/meson.build
@@ -32,7 +32,6 @@ arm_ss.add(files(
   'translate-vfp.c',
   'm_helper.c',
   'mve_helper.c',
-  'neon_helper.c',
   'op_helper.c',
   'tlb_helper.c',
   'vec_helper.c',
@@ -68,8 +67,10 @@ arm_common_ss.add(files(
 arm_common_system_ss.add(files(
   'hflags.c',
   'iwmmxt_helper.c',
+  'neon_helper.c',
 ))
 arm_user_ss.add(files(
   'hflags.c',
   'iwmmxt_helper.c',
+  'neon_helper.c',
 ))
diff --git a/target/arm/tcg/neon_helper.c b/target/arm/tcg/neon_helper.c
index e2cc7cf4ee..2cc8241f1e 100644
--- a/target/arm/tcg/neon_helper.c
+++ b/target/arm/tcg/neon_helper.c
@@ -9,11 +9,13 @@
 
 #include "qemu/osdep.h"
 #include "cpu.h"
-#include "exec/helper-proto.h"
 #include "tcg/tcg-gvec-desc.h"
 #include "fpu/softfloat.h"
 #include "vec_internal.h"
 
+#define HELPER_H "tcg/helper.h"
+#include "exec/helper-proto.h.inc"
+
 #define SIGNBIT (uint32_t)0x80000000
 #define SIGNBIT64 ((uint64_t)1 << 63)
 

From cbf565b00fb350eb2d2b79fce437ee88060fd3f9 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 12 May 2025 11:04:58 -0700
Subject: [PATCH 0939/2760] target/arm/tcg/tlb_helper: compile file twice
 (system, user)

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-id: 20250512180502.2395029-45-pierrick.bouvier@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/meson.build  | 3 ++-
 target/arm/tcg/tlb_helper.c | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/target/arm/tcg/meson.build b/target/arm/tcg/meson.build
index af786196d2..49c8f4390a 100644
--- a/target/arm/tcg/meson.build
+++ b/target/arm/tcg/meson.build
@@ -33,7 +33,6 @@ arm_ss.add(files(
   'm_helper.c',
   'mve_helper.c',
   'op_helper.c',
-  'tlb_helper.c',
   'vec_helper.c',
   'tlb-insns.c',
   'arith_helper.c',
@@ -68,9 +67,11 @@ arm_common_system_ss.add(files(
   'hflags.c',
   'iwmmxt_helper.c',
   'neon_helper.c',
+  'tlb_helper.c',
 ))
 arm_user_ss.add(files(
   'hflags.c',
   'iwmmxt_helper.c',
   'neon_helper.c',
+  'tlb_helper.c',
 ))
diff --git a/target/arm/tcg/tlb_helper.c b/target/arm/tcg/tlb_helper.c
index d9e6c827d4..23c72a99f5 100644
--- a/target/arm/tcg/tlb_helper.c
+++ b/target/arm/tcg/tlb_helper.c
@@ -9,8 +9,9 @@
 #include "cpu.h"
 #include "internals.h"
 #include "cpu-features.h"
-#include "exec/helper-proto.h"
 
+#define HELPER_H "tcg/helper.h"
+#include "exec/helper-proto.h.inc"
 
 /*
  * Returns true if the stage 1 translation regime is using LPAE format page

From c04f6b5908bb1eff09955e89c239ff0c03de4754 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 12 May 2025 11:04:59 -0700
Subject: [PATCH 0940/2760] target/arm/helper: restrict define_tlb_insn_regs to
 system target

Allows to include target/arm/tcg/tlb-insns.c only for system targets.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-id: 20250512180502.2395029-46-pierrick.bouvier@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index aae8554e8f..7631210287 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -7764,7 +7764,9 @@ void register_cp_regs_for_features(ARMCPU *cpu)
         define_arm_cp_regs(cpu, not_v8_cp_reginfo);
     }
 
+#ifndef CONFIG_USER_ONLY
     define_tlb_insn_regs(cpu);
+#endif
 
     if (arm_feature(env, ARM_FEATURE_V6)) {
         /* The ID registers all have impdef reset values */

From 31f4a08971d84bf97cf598a67d95ba8338adad1e Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 12 May 2025 11:05:00 -0700
Subject: [PATCH 0941/2760] target/arm/tcg/tlb-insns: compile file once
 (system)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

aarch64 specific code is guarded by cpu_isar_feature(aa64*), so it's
safe to expose it.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250512180502.2395029-47-pierrick.bouvier@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/meson.build | 2 +-
 target/arm/tcg/tlb-insns.c | 7 -------
 2 files changed, 1 insertion(+), 8 deletions(-)

diff --git a/target/arm/tcg/meson.build b/target/arm/tcg/meson.build
index 49c8f4390a..5d32658540 100644
--- a/target/arm/tcg/meson.build
+++ b/target/arm/tcg/meson.build
@@ -34,7 +34,6 @@ arm_ss.add(files(
   'mve_helper.c',
   'op_helper.c',
   'vec_helper.c',
-  'tlb-insns.c',
   'arith_helper.c',
   'vfp_helper.c',
 ))
@@ -68,6 +67,7 @@ arm_common_system_ss.add(files(
   'iwmmxt_helper.c',
   'neon_helper.c',
   'tlb_helper.c',
+  'tlb-insns.c',
 ))
 arm_user_ss.add(files(
   'hflags.c',
diff --git a/target/arm/tcg/tlb-insns.c b/target/arm/tcg/tlb-insns.c
index 0407ad5542..95c26c6d46 100644
--- a/target/arm/tcg/tlb-insns.c
+++ b/target/arm/tcg/tlb-insns.c
@@ -35,7 +35,6 @@ static CPAccessResult access_ttlbis(CPUARMState *env, const ARMCPRegInfo *ri,
     return CP_ACCESS_OK;
 }
 
-#ifdef TARGET_AARCH64
 /* Check for traps from EL1 due to HCR_EL2.TTLB or TTLBOS. */
 static CPAccessResult access_ttlbos(CPUARMState *env, const ARMCPRegInfo *ri,
                                     bool isread)
@@ -46,7 +45,6 @@ static CPAccessResult access_ttlbos(CPUARMState *env, const ARMCPRegInfo *ri,
     }
     return CP_ACCESS_OK;
 }
-#endif
 
 /* IS variants of TLB operations must affect all cores */
 static void tlbiall_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -802,7 +800,6 @@ static const ARMCPRegInfo tlbi_el3_cp_reginfo[] = {
       .writefn = tlbi_aa64_vae3_write },
 };
 
-#ifdef TARGET_AARCH64
 typedef struct {
     uint64_t base;
     uint64_t length;
@@ -1270,8 +1267,6 @@ static const ARMCPRegInfo tlbi_rme_reginfo[] = {
       .writefn = tlbi_aa64_paallos_write },
 };
 
-#endif
-
 void define_tlb_insn_regs(ARMCPU *cpu)
 {
     CPUARMState *env = &cpu->env;
@@ -1299,7 +1294,6 @@ void define_tlb_insn_regs(ARMCPU *cpu)
     if (arm_feature(env, ARM_FEATURE_EL3)) {
         define_arm_cp_regs(cpu, tlbi_el3_cp_reginfo);
     }
-#ifdef TARGET_AARCH64
     if (cpu_isar_feature(aa64_tlbirange, cpu)) {
         define_arm_cp_regs(cpu, tlbirange_reginfo);
     }
@@ -1309,5 +1303,4 @@ void define_tlb_insn_regs(ARMCPU *cpu)
     if (cpu_isar_feature(aa64_rme, cpu)) {
         define_arm_cp_regs(cpu, tlbi_rme_reginfo);
     }
-#endif
 }

From c0b623cb1c0d2de64631486d391c55f2e8874eda Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 12 May 2025 11:05:01 -0700
Subject: [PATCH 0942/2760] target/arm/tcg/arith_helper: compile file once

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-id: 20250512180502.2395029-48-pierrick.bouvier@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/arith_helper.c | 5 +++--
 target/arm/tcg/meson.build    | 2 +-
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/target/arm/tcg/arith_helper.c b/target/arm/tcg/arith_helper.c
index 9a555c7966..670139819d 100644
--- a/target/arm/tcg/arith_helper.c
+++ b/target/arm/tcg/arith_helper.c
@@ -6,11 +6,12 @@
  * SPDX-License-Identifier: GPL-2.0-or-later
  */
 #include "qemu/osdep.h"
-#include "cpu.h"
-#include "exec/helper-proto.h"
 #include "qemu/crc32c.h"
 #include <zlib.h> /* for crc32 */
 
+#define HELPER_H "tcg/helper.h"
+#include "exec/helper-proto.h.inc"
+
 /*
  * Note that signed overflow is undefined in C.  The following routines are
  * careful to use unsigned types where modulo arithmetic is required.
diff --git a/target/arm/tcg/meson.build b/target/arm/tcg/meson.build
index 5d32658540..7502c5cded 100644
--- a/target/arm/tcg/meson.build
+++ b/target/arm/tcg/meson.build
@@ -34,7 +34,6 @@ arm_ss.add(files(
   'mve_helper.c',
   'op_helper.c',
   'vec_helper.c',
-  'arith_helper.c',
   'vfp_helper.c',
 ))
 
@@ -59,6 +58,7 @@ arm_system_ss.add(when: 'CONFIG_ARM_V7M', if_true: files('cpu-v7m.c'))
 arm_user_ss.add(when: 'TARGET_AARCH64', if_false: files('cpu-v7m.c'))
 
 arm_common_ss.add(files(
+  'arith_helper.c',
   'crypto_helper.c',
 ))
 

From 9eb5427ac0d56ca050e34776b6de428892609bd5 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 12 May 2025 11:05:02 -0700
Subject: [PATCH 0943/2760] target/arm/tcg/vfp_helper: compile file twice
 (system, user)

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-id: 20250512180502.2395029-49-pierrick.bouvier@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/meson.build  | 3 ++-
 target/arm/tcg/vfp_helper.c | 4 +++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/target/arm/tcg/meson.build b/target/arm/tcg/meson.build
index 7502c5cded..2d1502ba88 100644
--- a/target/arm/tcg/meson.build
+++ b/target/arm/tcg/meson.build
@@ -34,7 +34,6 @@ arm_ss.add(files(
   'mve_helper.c',
   'op_helper.c',
   'vec_helper.c',
-  'vfp_helper.c',
 ))
 
 arm_ss.add(when: 'TARGET_AARCH64', if_true: files(
@@ -68,10 +67,12 @@ arm_common_system_ss.add(files(
   'neon_helper.c',
   'tlb_helper.c',
   'tlb-insns.c',
+  'vfp_helper.c',
 ))
 arm_user_ss.add(files(
   'hflags.c',
   'iwmmxt_helper.c',
   'neon_helper.c',
   'tlb_helper.c',
+  'vfp_helper.c',
 ))
diff --git a/target/arm/tcg/vfp_helper.c b/target/arm/tcg/vfp_helper.c
index b32e2f4e27..b1324c5c0a 100644
--- a/target/arm/tcg/vfp_helper.c
+++ b/target/arm/tcg/vfp_helper.c
@@ -19,12 +19,14 @@
 
 #include "qemu/osdep.h"
 #include "cpu.h"
-#include "exec/helper-proto.h"
 #include "internals.h"
 #include "cpu-features.h"
 #include "fpu/softfloat.h"
 #include "qemu/log.h"
 
+#define HELPER_H "tcg/helper.h"
+#include "exec/helper-proto.h.inc"
+
 /*
  * Set the float_status behaviour to match the Arm defaults:
  *  * tininess-before-rounding

From c33159dec79069514f78faecfe268439226b0f5b Mon Sep 17 00:00:00 2001
From: Eric Blake <eblake@redhat.com>
Date: Fri, 9 May 2025 15:40:18 -0500
Subject: [PATCH 0944/2760] block: Expand block status mode from bool to flags

This patch is purely mechanical, changing bool want_zero into an
unsigned int for bitwise-or of flags.  As of this patch, all
implementations are unchanged (the old want_zero==true is now
mode==BDRV_WANT_PRECISE which is a superset of BDRV_WANT_ZERO); but
the callers in io.c that used to pass want_zero==false are now
prepared for future driver changes that can now distinguish bewteen
BDRV_WANT_ZERO vs. BDRV_WANT_ALLOCATED.  The next patch will actually
change the file-posix driver along those lines, now that we have
more-specific hints.

As for the background why this patch is useful: right now, the
file-posix driver recognizes that if allocation is being queried, the
entire image can be reported as allocated (there is no backing file to
refer to) - but this throws away information on whether the entire
image reads as zero (trivially true if lseek(SEEK_HOLE) at offset 0
returns -ENXIO, a bit more complicated to prove if the raw file was
created with 'qemu-img create' since we intentionally allocate a small
chunk of all-zero data to help with alignment probing).  Later patches
will add a generic algorithm for seeing if an entire file reads as
zeroes.

Signed-off-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-ID: <20250509204341.3553601-16-eblake@redhat.com>
---
 block/blkdebug.c                 |  6 ++--
 block/copy-before-write.c        |  4 +--
 block/coroutines.h               |  4 +--
 block/file-posix.c               |  4 +--
 block/gluster.c                  |  4 +--
 block/io.c                       | 51 ++++++++++++++++----------------
 block/iscsi.c                    |  6 ++--
 block/nbd.c                      |  4 +--
 block/null.c                     |  6 ++--
 block/parallels.c                |  6 ++--
 block/qcow.c                     |  2 +-
 block/qcow2.c                    |  6 ++--
 block/qed.c                      |  6 ++--
 block/quorum.c                   |  4 +--
 block/raw-format.c               |  4 +--
 block/rbd.c                      |  6 ++--
 block/snapshot-access.c          |  4 +--
 block/vdi.c                      |  4 +--
 block/vmdk.c                     |  2 +-
 block/vpc.c                      |  2 +-
 block/vvfat.c                    |  6 ++--
 include/block/block-common.h     | 11 +++++++
 include/block/block_int-common.h | 27 +++++++++--------
 include/block/block_int-io.h     |  4 +--
 tests/unit/test-block-iothread.c |  2 +-
 25 files changed, 99 insertions(+), 86 deletions(-)

diff --git a/block/blkdebug.c b/block/blkdebug.c
index 1c1967f8e0..c54aee0c84 100644
--- a/block/blkdebug.c
+++ b/block/blkdebug.c
@@ -751,9 +751,9 @@ blkdebug_co_pdiscard(BlockDriverState *bs, int64_t offset, int64_t bytes)
 }
 
 static int coroutine_fn GRAPH_RDLOCK
-blkdebug_co_block_status(BlockDriverState *bs, bool want_zero, int64_t offset,
-                         int64_t bytes, int64_t *pnum, int64_t *map,
-                         BlockDriverState **file)
+blkdebug_co_block_status(BlockDriverState *bs, unsigned int mode,
+                         int64_t offset, int64_t bytes, int64_t *pnum,
+                         int64_t *map, BlockDriverState **file)
 {
     int err;
 
diff --git a/block/copy-before-write.c b/block/copy-before-write.c
index 00af0b18ac..36d5d3ed9b 100644
--- a/block/copy-before-write.c
+++ b/block/copy-before-write.c
@@ -291,8 +291,8 @@ cbw_co_preadv_snapshot(BlockDriverState *bs, int64_t offset, int64_t bytes,
 }
 
 static int coroutine_fn GRAPH_RDLOCK
-cbw_co_snapshot_block_status(BlockDriverState *bs,
-                             bool want_zero, int64_t offset, int64_t bytes,
+cbw_co_snapshot_block_status(BlockDriverState *bs, unsigned int mode,
+                             int64_t offset, int64_t bytes,
                              int64_t *pnum, int64_t *map,
                              BlockDriverState **file)
 {
diff --git a/block/coroutines.h b/block/coroutines.h
index 79e5efbf75..892646bb7a 100644
--- a/block/coroutines.h
+++ b/block/coroutines.h
@@ -47,7 +47,7 @@ int coroutine_fn GRAPH_RDLOCK
 bdrv_co_common_block_status_above(BlockDriverState *bs,
                                   BlockDriverState *base,
                                   bool include_base,
-                                  bool want_zero,
+                                  unsigned int mode,
                                   int64_t offset,
                                   int64_t bytes,
                                   int64_t *pnum,
@@ -78,7 +78,7 @@ int co_wrapper_mixed_bdrv_rdlock
 bdrv_common_block_status_above(BlockDriverState *bs,
                                BlockDriverState *base,
                                bool include_base,
-                               bool want_zero,
+                               unsigned int mode,
                                int64_t offset,
                                int64_t bytes,
                                int64_t *pnum,
diff --git a/block/file-posix.c b/block/file-posix.c
index ef52ed9169..805a1a2949 100644
--- a/block/file-posix.c
+++ b/block/file-posix.c
@@ -3273,7 +3273,7 @@ static int find_allocation(BlockDriverState *bs, off_t start,
  * well exceed it.
  */
 static int coroutine_fn raw_co_block_status(BlockDriverState *bs,
-                                            bool want_zero,
+                                            unsigned int mode,
                                             int64_t offset,
                                             int64_t bytes, int64_t *pnum,
                                             int64_t *map,
@@ -3289,7 +3289,7 @@ static int coroutine_fn raw_co_block_status(BlockDriverState *bs,
         return ret;
     }
 
-    if (!want_zero) {
+    if (mode != BDRV_WANT_PRECISE) {
         *pnum = bytes;
         *map = offset;
         *file = bs;
diff --git a/block/gluster.c b/block/gluster.c
index 8712aa606a..1a2ef53e9b 100644
--- a/block/gluster.c
+++ b/block/gluster.c
@@ -1461,7 +1461,7 @@ exit:
  * (Based on raw_co_block_status() from file-posix.c.)
  */
 static int coroutine_fn qemu_gluster_co_block_status(BlockDriverState *bs,
-                                                     bool want_zero,
+                                                     unsigned int mode,
                                                      int64_t offset,
                                                      int64_t bytes,
                                                      int64_t *pnum,
@@ -1478,7 +1478,7 @@ static int coroutine_fn qemu_gluster_co_block_status(BlockDriverState *bs,
         return ret;
     }
 
-    if (!want_zero) {
+    if (mode != BDRV_WANT_PRECISE) {
         *pnum = bytes;
         *map = offset;
         *file = bs;
diff --git a/block/io.c b/block/io.c
index 6d98b0abb9..b5b143cd1b 100644
--- a/block/io.c
+++ b/block/io.c
@@ -2364,10 +2364,8 @@ int bdrv_flush_all(void)
  * Drivers not implementing the functionality are assumed to not support
  * backing files, hence all their sectors are reported as allocated.
  *
- * If 'want_zero' is true, the caller is querying for mapping
- * purposes, with a focus on valid BDRV_BLOCK_OFFSET_VALID, _DATA, and
- * _ZERO where possible; otherwise, the result favors larger 'pnum',
- * with a focus on accurate BDRV_BLOCK_ALLOCATED.
+ * 'mode' serves as a hint as to which results are favored; see the
+ * BDRV_WANT_* macros for details.
  *
  * If 'offset' is beyond the end of the disk image the return value is
  * BDRV_BLOCK_EOF and 'pnum' is set to 0.
@@ -2387,7 +2385,7 @@ int bdrv_flush_all(void)
  * set to the host mapping and BDS corresponding to the guest offset.
  */
 static int coroutine_fn GRAPH_RDLOCK
-bdrv_co_do_block_status(BlockDriverState *bs, bool want_zero,
+bdrv_co_do_block_status(BlockDriverState *bs, unsigned int mode,
                         int64_t offset, int64_t bytes,
                         int64_t *pnum, int64_t *map, BlockDriverState **file)
 {
@@ -2476,7 +2474,7 @@ bdrv_co_do_block_status(BlockDriverState *bs, bool want_zero,
             local_file = bs;
             local_map = aligned_offset;
         } else {
-            ret = bs->drv->bdrv_co_block_status(bs, want_zero, aligned_offset,
+            ret = bs->drv->bdrv_co_block_status(bs, mode, aligned_offset,
                                                 aligned_bytes, pnum, &local_map,
                                                 &local_file);
 
@@ -2488,10 +2486,10 @@ bdrv_co_do_block_status(BlockDriverState *bs, bool want_zero,
              * the cache requires an RCU update, so double check here to avoid
              * such an update if possible.
              *
-             * Check want_zero, because we only want to update the cache when we
+             * Check mode, because we only want to update the cache when we
              * have accurate information about what is zero and what is data.
              */
-            if (want_zero &&
+            if (mode == BDRV_WANT_PRECISE &&
                 ret == (BDRV_BLOCK_DATA | BDRV_BLOCK_OFFSET_VALID) &&
                 QLIST_EMPTY(&bs->children))
             {
@@ -2548,7 +2546,7 @@ bdrv_co_do_block_status(BlockDriverState *bs, bool want_zero,
 
     if (ret & BDRV_BLOCK_RAW) {
         assert(ret & BDRV_BLOCK_OFFSET_VALID && local_file);
-        ret = bdrv_co_do_block_status(local_file, want_zero, local_map,
+        ret = bdrv_co_do_block_status(local_file, mode, local_map,
                                       *pnum, pnum, &local_map, &local_file);
         goto out;
     }
@@ -2560,7 +2558,7 @@ bdrv_co_do_block_status(BlockDriverState *bs, bool want_zero,
 
         if (!cow_bs) {
             ret |= BDRV_BLOCK_ZERO;
-        } else if (want_zero) {
+        } else if (mode == BDRV_WANT_PRECISE) {
             int64_t size2 = bdrv_co_getlength(cow_bs);
 
             if (size2 >= 0 && offset >= size2) {
@@ -2569,14 +2567,14 @@ bdrv_co_do_block_status(BlockDriverState *bs, bool want_zero,
         }
     }
 
-    if (want_zero && ret & BDRV_BLOCK_RECURSE &&
+    if (mode == BDRV_WANT_PRECISE && ret & BDRV_BLOCK_RECURSE &&
         local_file && local_file != bs &&
         (ret & BDRV_BLOCK_DATA) && !(ret & BDRV_BLOCK_ZERO) &&
         (ret & BDRV_BLOCK_OFFSET_VALID)) {
         int64_t file_pnum;
         int ret2;
 
-        ret2 = bdrv_co_do_block_status(local_file, want_zero, local_map,
+        ret2 = bdrv_co_do_block_status(local_file, mode, local_map,
                                        *pnum, &file_pnum, NULL, NULL);
         if (ret2 >= 0) {
             /* Ignore errors.  This is just providing extra information, it
@@ -2627,7 +2625,7 @@ int coroutine_fn
 bdrv_co_common_block_status_above(BlockDriverState *bs,
                                   BlockDriverState *base,
                                   bool include_base,
-                                  bool want_zero,
+                                  unsigned int mode,
                                   int64_t offset,
                                   int64_t bytes,
                                   int64_t *pnum,
@@ -2654,7 +2652,7 @@ bdrv_co_common_block_status_above(BlockDriverState *bs,
         return 0;
     }
 
-    ret = bdrv_co_do_block_status(bs, want_zero, offset, bytes, pnum,
+    ret = bdrv_co_do_block_status(bs, mode, offset, bytes, pnum,
                                   map, file);
     ++*depth;
     if (ret < 0 || *pnum == 0 || ret & BDRV_BLOCK_ALLOCATED || bs == base) {
@@ -2671,7 +2669,7 @@ bdrv_co_common_block_status_above(BlockDriverState *bs,
     for (p = bdrv_filter_or_cow_bs(bs); include_base || p != base;
          p = bdrv_filter_or_cow_bs(p))
     {
-        ret = bdrv_co_do_block_status(p, want_zero, offset, bytes, pnum,
+        ret = bdrv_co_do_block_status(p, mode, offset, bytes, pnum,
                                       map, file);
         ++*depth;
         if (ret < 0) {
@@ -2734,7 +2732,8 @@ int coroutine_fn bdrv_co_block_status_above(BlockDriverState *bs,
                                             BlockDriverState **file)
 {
     IO_CODE();
-    return bdrv_co_common_block_status_above(bs, base, false, true, offset,
+    return bdrv_co_common_block_status_above(bs, base, false,
+                                             BDRV_WANT_PRECISE, offset,
                                              bytes, pnum, map, file, NULL);
 }
 
@@ -2765,8 +2764,9 @@ int coroutine_fn bdrv_co_is_zero_fast(BlockDriverState *bs, int64_t offset,
         return 1;
     }
 
-    ret = bdrv_co_common_block_status_above(bs, NULL, false, false, offset,
-                                            bytes, &pnum, NULL, NULL, NULL);
+    ret = bdrv_co_common_block_status_above(bs, NULL, false, BDRV_WANT_ZERO,
+                                            offset, bytes, &pnum, NULL, NULL,
+                                            NULL);
 
     if (ret < 0) {
         return ret;
@@ -2782,9 +2782,9 @@ int coroutine_fn bdrv_co_is_allocated(BlockDriverState *bs, int64_t offset,
     int64_t dummy;
     IO_CODE();
 
-    ret = bdrv_co_common_block_status_above(bs, bs, true, false, offset,
-                                            bytes, pnum ? pnum : &dummy, NULL,
-                                            NULL, NULL);
+    ret = bdrv_co_common_block_status_above(bs, bs, true, BDRV_WANT_ALLOCATED,
+                                            offset, bytes, pnum ? pnum : &dummy,
+                                            NULL, NULL, NULL);
     if (ret < 0) {
         return ret;
     }
@@ -2817,7 +2817,8 @@ int coroutine_fn bdrv_co_is_allocated_above(BlockDriverState *bs,
     int ret;
     IO_CODE();
 
-    ret = bdrv_co_common_block_status_above(bs, base, include_base, false,
+    ret = bdrv_co_common_block_status_above(bs, base, include_base,
+                                            BDRV_WANT_ALLOCATED,
                                             offset, bytes, pnum, NULL, NULL,
                                             &depth);
     if (ret < 0) {
@@ -3698,8 +3699,8 @@ bdrv_co_preadv_snapshot(BdrvChild *child, int64_t offset, int64_t bytes,
 }
 
 int coroutine_fn
-bdrv_co_snapshot_block_status(BlockDriverState *bs,
-                              bool want_zero, int64_t offset, int64_t bytes,
+bdrv_co_snapshot_block_status(BlockDriverState *bs, unsigned int mode,
+                              int64_t offset, int64_t bytes,
                               int64_t *pnum, int64_t *map,
                               BlockDriverState **file)
 {
@@ -3717,7 +3718,7 @@ bdrv_co_snapshot_block_status(BlockDriverState *bs,
     }
 
     bdrv_inc_in_flight(bs);
-    ret = drv->bdrv_co_snapshot_block_status(bs, want_zero, offset, bytes,
+    ret = drv->bdrv_co_snapshot_block_status(bs, mode, offset, bytes,
                                              pnum, map, file);
     bdrv_dec_in_flight(bs);
 
diff --git a/block/iscsi.c b/block/iscsi.c
index 2f0f4dac09..15b96ee880 100644
--- a/block/iscsi.c
+++ b/block/iscsi.c
@@ -694,9 +694,9 @@ out_unlock:
 
 
 static int coroutine_fn iscsi_co_block_status(BlockDriverState *bs,
-                                              bool want_zero, int64_t offset,
-                                              int64_t bytes, int64_t *pnum,
-                                              int64_t *map,
+                                              unsigned int mode,
+                                              int64_t offset, int64_t bytes,
+                                              int64_t *pnum, int64_t *map,
                                               BlockDriverState **file)
 {
     IscsiLun *iscsilun = bs->opaque;
diff --git a/block/nbd.c b/block/nbd.c
index 887841bc81..d5a2b21c6d 100644
--- a/block/nbd.c
+++ b/block/nbd.c
@@ -1397,8 +1397,8 @@ nbd_client_co_pdiscard(BlockDriverState *bs, int64_t offset, int64_t bytes)
 }
 
 static int coroutine_fn GRAPH_RDLOCK nbd_client_co_block_status(
-        BlockDriverState *bs, bool want_zero, int64_t offset, int64_t bytes,
-        int64_t *pnum, int64_t *map, BlockDriverState **file)
+        BlockDriverState *bs, unsigned int mode, int64_t offset,
+        int64_t bytes, int64_t *pnum, int64_t *map, BlockDriverState **file)
 {
     int ret, request_ret;
     NBDExtent64 extent = { 0 };
diff --git a/block/null.c b/block/null.c
index dc0b1fdbd9..4e448d593d 100644
--- a/block/null.c
+++ b/block/null.c
@@ -227,9 +227,9 @@ static int null_reopen_prepare(BDRVReopenState *reopen_state,
 }
 
 static int coroutine_fn null_co_block_status(BlockDriverState *bs,
-                                             bool want_zero, int64_t offset,
-                                             int64_t bytes, int64_t *pnum,
-                                             int64_t *map,
+                                             unsigned int mode,
+                                             int64_t offset, int64_t bytes,
+                                             int64_t *pnum, int64_t *map,
                                              BlockDriverState **file)
 {
     BDRVNullState *s = bs->opaque;
diff --git a/block/parallels.c b/block/parallels.c
index 347ca127f3..3a375e2a8a 100644
--- a/block/parallels.c
+++ b/block/parallels.c
@@ -416,9 +416,9 @@ parallels_co_flush_to_os(BlockDriverState *bs)
 }
 
 static int coroutine_fn GRAPH_RDLOCK
-parallels_co_block_status(BlockDriverState *bs, bool want_zero, int64_t offset,
-                          int64_t bytes, int64_t *pnum, int64_t *map,
-                          BlockDriverState **file)
+parallels_co_block_status(BlockDriverState *bs, unsigned int mode,
+                          int64_t offset, int64_t bytes, int64_t *pnum,
+                          int64_t *map, BlockDriverState **file)
 {
     BDRVParallelsState *s = bs->opaque;
     int count;
diff --git a/block/qcow.c b/block/qcow.c
index da8ad4d243..8a3e7591a9 100644
--- a/block/qcow.c
+++ b/block/qcow.c
@@ -530,7 +530,7 @@ get_cluster_offset(BlockDriverState *bs, uint64_t offset, int allocate,
 }
 
 static int coroutine_fn GRAPH_RDLOCK
-qcow_co_block_status(BlockDriverState *bs, bool want_zero,
+qcow_co_block_status(BlockDriverState *bs, unsigned int mode,
                      int64_t offset, int64_t bytes, int64_t *pnum,
                      int64_t *map, BlockDriverState **file)
 {
diff --git a/block/qcow2.c b/block/qcow2.c
index 7774e7f090..66fba89b41 100644
--- a/block/qcow2.c
+++ b/block/qcow2.c
@@ -2141,9 +2141,9 @@ static void qcow2_join_options(QDict *options, QDict *old_options)
 }
 
 static int coroutine_fn GRAPH_RDLOCK
-qcow2_co_block_status(BlockDriverState *bs, bool want_zero, int64_t offset,
-                      int64_t count, int64_t *pnum, int64_t *map,
-                      BlockDriverState **file)
+qcow2_co_block_status(BlockDriverState *bs, unsigned int mode,
+                      int64_t offset, int64_t count, int64_t *pnum,
+                      int64_t *map, BlockDriverState **file)
 {
     BDRVQcow2State *s = bs->opaque;
     uint64_t host_offset;
diff --git a/block/qed.c b/block/qed.c
index ac24449ffb..4a36fb3929 100644
--- a/block/qed.c
+++ b/block/qed.c
@@ -833,9 +833,9 @@ fail:
 }
 
 static int coroutine_fn GRAPH_RDLOCK
-bdrv_qed_co_block_status(BlockDriverState *bs, bool want_zero, int64_t pos,
-                         int64_t bytes, int64_t *pnum, int64_t *map,
-                         BlockDriverState **file)
+bdrv_qed_co_block_status(BlockDriverState *bs, unsigned int mode,
+                         int64_t pos, int64_t bytes, int64_t *pnum,
+                         int64_t *map, BlockDriverState **file)
 {
     BDRVQEDState *s = bs->opaque;
     size_t len = MIN(bytes, SIZE_MAX);
diff --git a/block/quorum.c b/block/quorum.c
index 30747a6df9..ed8ce801ee 100644
--- a/block/quorum.c
+++ b/block/quorum.c
@@ -1226,7 +1226,7 @@ static void quorum_child_perm(BlockDriverState *bs, BdrvChild *c,
  * region contains zeroes, and BDRV_BLOCK_DATA otherwise.
  */
 static int coroutine_fn GRAPH_RDLOCK
-quorum_co_block_status(BlockDriverState *bs, bool want_zero,
+quorum_co_block_status(BlockDriverState *bs, unsigned int mode,
                        int64_t offset, int64_t count,
                        int64_t *pnum, int64_t *map, BlockDriverState **file)
 {
@@ -1238,7 +1238,7 @@ quorum_co_block_status(BlockDriverState *bs, bool want_zero,
     for (i = 0; i < s->num_children; i++) {
         int64_t bytes;
         ret = bdrv_co_common_block_status_above(s->children[i]->bs, NULL, false,
-                                                want_zero, offset, count,
+                                                mode, offset, count,
                                                 &bytes, NULL, NULL, NULL);
         if (ret < 0) {
             quorum_report_bad(QUORUM_OP_TYPE_READ, offset, count,
diff --git a/block/raw-format.c b/block/raw-format.c
index e08526e2ec..df16ac1ea2 100644
--- a/block/raw-format.c
+++ b/block/raw-format.c
@@ -283,8 +283,8 @@ fail:
 }
 
 static int coroutine_fn GRAPH_RDLOCK
-raw_co_block_status(BlockDriverState *bs, bool want_zero, int64_t offset,
-                    int64_t bytes, int64_t *pnum, int64_t *map,
+raw_co_block_status(BlockDriverState *bs, unsigned int mode,
+                    int64_t offset, int64_t bytes, int64_t *pnum, int64_t *map,
                     BlockDriverState **file)
 {
     BDRVRawState *s = bs->opaque;
diff --git a/block/rbd.c b/block/rbd.c
index 7446e66659..951cd63f9a 100644
--- a/block/rbd.c
+++ b/block/rbd.c
@@ -1503,9 +1503,9 @@ static int qemu_rbd_diff_iterate_cb(uint64_t offs, size_t len,
 }
 
 static int coroutine_fn qemu_rbd_co_block_status(BlockDriverState *bs,
-                                                 bool want_zero, int64_t offset,
-                                                 int64_t bytes, int64_t *pnum,
-                                                 int64_t *map,
+                                                 unsigned int mode,
+                                                 int64_t offset, int64_t bytes,
+                                                 int64_t *pnum, int64_t *map,
                                                  BlockDriverState **file)
 {
     BDRVRBDState *s = bs->opaque;
diff --git a/block/snapshot-access.c b/block/snapshot-access.c
index 71ac83c01f..17ed2402db 100644
--- a/block/snapshot-access.c
+++ b/block/snapshot-access.c
@@ -41,11 +41,11 @@ snapshot_access_co_preadv_part(BlockDriverState *bs,
 
 static int coroutine_fn GRAPH_RDLOCK
 snapshot_access_co_block_status(BlockDriverState *bs,
-                                bool want_zero, int64_t offset,
+                                unsigned int mode, int64_t offset,
                                 int64_t bytes, int64_t *pnum,
                                 int64_t *map, BlockDriverState **file)
 {
-    return bdrv_co_snapshot_block_status(bs->file->bs, want_zero, offset,
+    return bdrv_co_snapshot_block_status(bs->file->bs, mode, offset,
                                          bytes, pnum, map, file);
 }
 
diff --git a/block/vdi.c b/block/vdi.c
index a2da6ecab0..3ddc62a569 100644
--- a/block/vdi.c
+++ b/block/vdi.c
@@ -523,8 +523,8 @@ static int vdi_reopen_prepare(BDRVReopenState *state,
 }
 
 static int coroutine_fn GRAPH_RDLOCK
-vdi_co_block_status(BlockDriverState *bs, bool want_zero, int64_t offset,
-                    int64_t bytes, int64_t *pnum, int64_t *map,
+vdi_co_block_status(BlockDriverState *bs, unsigned int mode,
+                    int64_t offset, int64_t bytes, int64_t *pnum, int64_t *map,
                     BlockDriverState **file)
 {
     BDRVVdiState *s = (BDRVVdiState *)bs->opaque;
diff --git a/block/vmdk.c b/block/vmdk.c
index 2adec49912..9c7ab037e1 100644
--- a/block/vmdk.c
+++ b/block/vmdk.c
@@ -1777,7 +1777,7 @@ static inline uint64_t vmdk_find_offset_in_cluster(VmdkExtent *extent,
 }
 
 static int coroutine_fn GRAPH_RDLOCK
-vmdk_co_block_status(BlockDriverState *bs, bool want_zero,
+vmdk_co_block_status(BlockDriverState *bs, unsigned int mode,
                      int64_t offset, int64_t bytes, int64_t *pnum,
                      int64_t *map, BlockDriverState **file)
 {
diff --git a/block/vpc.c b/block/vpc.c
index 0309e319f6..801ff5793f 100644
--- a/block/vpc.c
+++ b/block/vpc.c
@@ -726,7 +726,7 @@ fail:
 }
 
 static int coroutine_fn GRAPH_RDLOCK
-vpc_co_block_status(BlockDriverState *bs, bool want_zero,
+vpc_co_block_status(BlockDriverState *bs, unsigned int mode,
                     int64_t offset, int64_t bytes,
                     int64_t *pnum, int64_t *map,
                     BlockDriverState **file)
diff --git a/block/vvfat.c b/block/vvfat.c
index 91d69b3cc8..814796d918 100644
--- a/block/vvfat.c
+++ b/block/vvfat.c
@@ -3134,9 +3134,9 @@ vvfat_co_pwritev(BlockDriverState *bs, int64_t offset, int64_t bytes,
 }
 
 static int coroutine_fn vvfat_co_block_status(BlockDriverState *bs,
-                                              bool want_zero, int64_t offset,
-                                              int64_t bytes, int64_t *n,
-                                              int64_t *map,
+                                              unsigned int mode,
+                                              int64_t offset, int64_t bytes,
+                                              int64_t *n, int64_t *map,
                                               BlockDriverState **file)
 {
     *n = bytes;
diff --git a/include/block/block-common.h b/include/block/block-common.h
index 0b831ef87b..c8c626daea 100644
--- a/include/block/block-common.h
+++ b/include/block/block-common.h
@@ -333,6 +333,17 @@ typedef enum {
 #define BDRV_BLOCK_RECURSE      0x40
 #define BDRV_BLOCK_COMPRESSED   0x80
 
+/*
+ * Block status hints: the bitwise-or of these flags emphasize what
+ * the caller hopes to learn, and some drivers may be able to give
+ * faster answers by doing less work when the hint permits.
+ */
+#define BDRV_WANT_ZERO          BDRV_BLOCK_ZERO
+#define BDRV_WANT_OFFSET_VALID  BDRV_BLOCK_OFFSET_VALID
+#define BDRV_WANT_ALLOCATED     BDRV_BLOCK_ALLOCATED
+#define BDRV_WANT_PRECISE       (BDRV_WANT_ZERO | BDRV_WANT_OFFSET_VALID | \
+                                 BDRV_WANT_OFFSET_VALID)
+
 typedef QTAILQ_HEAD(BlockReopenQueue, BlockReopenQueueEntry) BlockReopenQueue;
 
 typedef struct BDRVReopenState {
diff --git a/include/block/block_int-common.h b/include/block/block_int-common.h
index 0d8187f656..2982dd3118 100644
--- a/include/block/block_int-common.h
+++ b/include/block/block_int-common.h
@@ -604,15 +604,16 @@ struct BlockDriver {
      * according to the current layer, and should only need to set
      * BDRV_BLOCK_DATA, BDRV_BLOCK_ZERO, BDRV_BLOCK_OFFSET_VALID,
      * and/or BDRV_BLOCK_RAW; if the current layer defers to a backing
-     * layer, the result should be 0 (and not BDRV_BLOCK_ZERO).  See
-     * block.h for the overall meaning of the bits.  As a hint, the
-     * flag want_zero is true if the caller cares more about precise
-     * mappings (favor accurate _OFFSET_VALID/_ZERO) or false for
-     * overall allocation (favor larger *pnum, perhaps by reporting
-     * _DATA instead of _ZERO).  The block layer guarantees input
-     * clamped to bdrv_getlength() and aligned to request_alignment,
-     * as well as non-NULL pnum, map, and file; in turn, the driver
-     * must return an error or set pnum to an aligned non-zero value.
+     * layer, the result should be 0 (and not BDRV_BLOCK_ZERO).  The
+     * caller will synthesize BDRV_BLOCK_ALLOCATED based on the
+     * non-zero results.  See block.h for the overall meaning of the
+     * bits.  As a hint, the flags in @mode may include a bitwise-or
+     * of BDRV_WANT_ALLOCATED, BDRV_WANT_OFFSET_VALID, or
+     * BDRV_WANT_ZERO based on what the caller is looking for in the
+     * results.  The block layer guarantees input clamped to
+     * bdrv_getlength() and aligned to request_alignment, as well as
+     * non-NULL pnum, map, and file; in turn, the driver must return
+     * an error or set pnum to an aligned non-zero value.
      *
      * Note that @bytes is just a hint on how big of a region the
      * caller wants to inspect.  It is not a limit on *pnum.
@@ -624,8 +625,8 @@ struct BlockDriver {
      * to clamping *pnum for return to its caller.
      */
     int coroutine_fn GRAPH_RDLOCK_PTR (*bdrv_co_block_status)(
-        BlockDriverState *bs,
-        bool want_zero, int64_t offset, int64_t bytes, int64_t *pnum,
+        BlockDriverState *bs, unsigned int mode,
+        int64_t offset, int64_t bytes, int64_t *pnum,
         int64_t *map, BlockDriverState **file);
 
     /*
@@ -649,8 +650,8 @@ struct BlockDriver {
         QEMUIOVector *qiov, size_t qiov_offset);
 
     int coroutine_fn GRAPH_RDLOCK_PTR (*bdrv_co_snapshot_block_status)(
-        BlockDriverState *bs, bool want_zero, int64_t offset, int64_t bytes,
-        int64_t *pnum, int64_t *map, BlockDriverState **file);
+        BlockDriverState *bs, unsigned int mode, int64_t offset,
+        int64_t bytes, int64_t *pnum, int64_t *map, BlockDriverState **file);
 
     int coroutine_fn GRAPH_RDLOCK_PTR (*bdrv_co_pdiscard_snapshot)(
         BlockDriverState *bs, int64_t offset, int64_t bytes);
diff --git a/include/block/block_int-io.h b/include/block/block_int-io.h
index 4a7cf2b4fd..4f94eb3c5a 100644
--- a/include/block/block_int-io.h
+++ b/include/block/block_int-io.h
@@ -38,8 +38,8 @@
 int coroutine_fn GRAPH_RDLOCK bdrv_co_preadv_snapshot(BdrvChild *child,
     int64_t offset, int64_t bytes, QEMUIOVector *qiov, size_t qiov_offset);
 int coroutine_fn GRAPH_RDLOCK bdrv_co_snapshot_block_status(
-    BlockDriverState *bs, bool want_zero, int64_t offset, int64_t bytes,
-    int64_t *pnum, int64_t *map, BlockDriverState **file);
+    BlockDriverState *bs, unsigned int mode, int64_t offset,
+    int64_t bytes, int64_t *pnum, int64_t *map, BlockDriverState **file);
 int coroutine_fn GRAPH_RDLOCK bdrv_co_pdiscard_snapshot(BlockDriverState *bs,
     int64_t offset, int64_t bytes);
 
diff --git a/tests/unit/test-block-iothread.c b/tests/unit/test-block-iothread.c
index 2b358eaaa8..e26b3be593 100644
--- a/tests/unit/test-block-iothread.c
+++ b/tests/unit/test-block-iothread.c
@@ -63,7 +63,7 @@ bdrv_test_co_truncate(BlockDriverState *bs, int64_t offset, bool exact,
 }
 
 static int coroutine_fn bdrv_test_co_block_status(BlockDriverState *bs,
-                                                  bool want_zero,
+                                                  unsigned int mode,
                                                   int64_t offset, int64_t count,
                                                   int64_t *pnum, int64_t *map,
                                                   BlockDriverState **file)

From a6a0a7fb0e327d17594c971b4a39de14e025b415 Mon Sep 17 00:00:00 2001
From: Eric Blake <eblake@redhat.com>
Date: Fri, 9 May 2025 15:40:19 -0500
Subject: [PATCH 0945/2760] file-posix, gluster: Handle zero block status hint
 better

Although the previous patch to change 'bool want_zero' into a bitmask
made no semantic change, it is now time to differentiate.  When the
caller specifically wants to know what parts of the file read as zero,
we need to use lseek and actually reporting holes, rather than
short-circuiting and advertising full allocation.

This change will be utilized in later patches to let mirroring
optimize for the case when the destination already reads as zeroes.

Signed-off-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-ID: <20250509204341.3553601-17-eblake@redhat.com>
---
 block/file-posix.c | 3 ++-
 block/gluster.c    | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/block/file-posix.c b/block/file-posix.c
index 805a1a2949..ec95b74869 100644
--- a/block/file-posix.c
+++ b/block/file-posix.c
@@ -3289,7 +3289,8 @@ static int coroutine_fn raw_co_block_status(BlockDriverState *bs,
         return ret;
     }
 
-    if (mode != BDRV_WANT_PRECISE) {
+    if (!(mode & BDRV_WANT_ZERO)) {
+        /* There is no backing file - all bytes are allocated in this file.  */
         *pnum = bytes;
         *map = offset;
         *file = bs;
diff --git a/block/gluster.c b/block/gluster.c
index 1a2ef53e9b..89abd40f31 100644
--- a/block/gluster.c
+++ b/block/gluster.c
@@ -1478,7 +1478,7 @@ static int coroutine_fn qemu_gluster_co_block_status(BlockDriverState *bs,
         return ret;
     }
 
-    if (mode != BDRV_WANT_PRECISE) {
+    if (!(mode & BDRV_WANT_ZERO)) {
         *pnum = bytes;
         *map = offset;
         *file = bs;

From 31bf15d97dd1d205a3b264675f9a1b3bd1939068 Mon Sep 17 00:00:00 2001
From: Eric Blake <eblake@redhat.com>
Date: Fri, 9 May 2025 15:40:20 -0500
Subject: [PATCH 0946/2760] block: Let bdrv_co_is_zero_fast consolidate
 adjacent extents

Some BDS drivers have a cap on how much block status they can supply
in one query (for example, NBD talking to an older server cannot
inspect more than 4G per query; and qcow2 tends to cap its answers
rather than cross a cluster boundary of an L1 table).  Although the
existing callers of bdrv_co_is_zero_fast are not passing in that large
of a 'bytes' parameter, an upcoming caller wants to query the entire
image at once, and will thus benefit from being able to treat adjacent
zero regions in a coalesced manner, rather than claiming the region is
non-zero merely because pnum was truncated and didn't match the
incoming bytes.

While refactoring this into a loop, note that there is no need to
assign pnum prior to calling bdrv_co_common_block_status_above() (it
is guaranteed to be assigned deeper in the callstack).

Signed-off-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-ID: <20250509204341.3553601-18-eblake@redhat.com>
---
 block/io.c | 29 ++++++++++++++++-------------
 1 file changed, 16 insertions(+), 13 deletions(-)

diff --git a/block/io.c b/block/io.c
index b5b143cd1b..50dc0e193f 100644
--- a/block/io.c
+++ b/block/io.c
@@ -2751,28 +2751,31 @@ int coroutine_fn bdrv_co_block_status(BlockDriverState *bs, int64_t offset,
  * by @offset and @bytes is known to read as zeroes.
  * Return 1 if that is the case, 0 otherwise and -errno on error.
  * This test is meant to be fast rather than accurate so returning 0
- * does not guarantee non-zero data.
+ * does not guarantee non-zero data; but a return of 1 is reliable.
  */
 int coroutine_fn bdrv_co_is_zero_fast(BlockDriverState *bs, int64_t offset,
                                       int64_t bytes)
 {
     int ret;
-    int64_t pnum = bytes;
+    int64_t pnum;
     IO_CODE();
 
-    if (!bytes) {
-        return 1;
+    while (bytes) {
+        ret = bdrv_co_common_block_status_above(bs, NULL, false,
+                                                BDRV_WANT_ZERO, offset, bytes,
+                                                &pnum, NULL, NULL, NULL);
+
+        if (ret < 0) {
+            return ret;
+        }
+        if (!(ret & BDRV_BLOCK_ZERO)) {
+            return 0;
+        }
+        offset += pnum;
+        bytes -= pnum;
     }
 
-    ret = bdrv_co_common_block_status_above(bs, NULL, false, BDRV_WANT_ZERO,
-                                            offset, bytes, &pnum, NULL, NULL,
-                                            NULL);
-
-    if (ret < 0) {
-        return ret;
-    }
-
-    return (pnum == bytes) && (ret & BDRV_BLOCK_ZERO);
+    return 1;
 }
 
 int coroutine_fn bdrv_co_is_allocated(BlockDriverState *bs, int64_t offset,

From 52726096707c5c8b90597c445de897fa64d56e73 Mon Sep 17 00:00:00 2001
From: Eric Blake <eblake@redhat.com>
Date: Fri, 9 May 2025 15:40:21 -0500
Subject: [PATCH 0947/2760] block: Add new bdrv_co_is_all_zeroes() function

There are some optimizations that require knowing if an image starts
out as reading all zeroes, such as making blockdev-mirror faster by
skipping the copying of source zeroes to the destination.  The
existing bdrv_co_is_zero_fast() is a good building block for answering
this question, but it tends to give an answer of 0 for a file we just
created via QMP 'blockdev-create' or similar (such as 'qemu-img create
-f raw').  Why?  Because file-posix.c insists on allocating a tiny
header to any file rather than leaving it 100% sparse, due to some
filesystems that are unable to answer alignment probes on a hole.  But
teaching file-posix.c to read the tiny header doesn't scale - the
problem of a small header is also visible when libvirt sets up an NBD
client to a just-created file on a migration destination host.

So, we need a wrapper function that handles a bit more complexity in a
common manner for all block devices - when the BDS is mostly a hole,
but has a small non-hole header, it is still worth the time to read
that header and check if it reads as all zeroes before giving up and
returning a pessimistic answer.

Signed-off-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-ID: <20250509204341.3553601-19-eblake@redhat.com>
---
 block/io.c               | 62 ++++++++++++++++++++++++++++++++++++++++
 include/block/block-io.h |  2 ++
 2 files changed, 64 insertions(+)

diff --git a/block/io.c b/block/io.c
index 50dc0e193f..4fd7768f9c 100644
--- a/block/io.c
+++ b/block/io.c
@@ -38,10 +38,14 @@
 #include "qemu/error-report.h"
 #include "qemu/main-loop.h"
 #include "system/replay.h"
+#include "qemu/units.h"
 
 /* Maximum bounce buffer for copy-on-read and write zeroes, in bytes */
 #define MAX_BOUNCE_BUFFER (32768 << BDRV_SECTOR_BITS)
 
+/* Maximum read size for checking if data reads as zero, in bytes */
+#define MAX_ZERO_CHECK_BUFFER (128 * KiB)
+
 static void coroutine_fn GRAPH_RDLOCK
 bdrv_parent_cb_resize(BlockDriverState *bs);
 
@@ -2778,6 +2782,64 @@ int coroutine_fn bdrv_co_is_zero_fast(BlockDriverState *bs, int64_t offset,
     return 1;
 }
 
+/*
+ * Check @bs (and its backing chain) to see if the entire image is known
+ * to read as zeroes.
+ * Return 1 if that is the case, 0 otherwise and -errno on error.
+ * This test is meant to be fast rather than accurate so returning 0
+ * does not guarantee non-zero data; however, a return of 1 is reliable,
+ * and this function can report 1 in more cases than bdrv_co_is_zero_fast.
+ */
+int coroutine_fn bdrv_co_is_all_zeroes(BlockDriverState *bs)
+{
+    int ret;
+    int64_t pnum, bytes;
+    char *buf;
+    QEMUIOVector local_qiov;
+    IO_CODE();
+
+    bytes = bdrv_co_getlength(bs);
+    if (bytes < 0) {
+        return bytes;
+    }
+
+    /* First probe - see if the entire image reads as zero */
+    ret = bdrv_co_common_block_status_above(bs, NULL, false, BDRV_WANT_ZERO,
+                                            0, bytes, &pnum, NULL, NULL,
+                                            NULL);
+    if (ret < 0) {
+        return ret;
+    }
+    if (ret & BDRV_BLOCK_ZERO) {
+        return bdrv_co_is_zero_fast(bs, pnum, bytes - pnum);
+    }
+
+    /*
+     * Because of the way 'blockdev-create' works, raw files tend to
+     * be created with a non-sparse region at the front to make
+     * alignment probing easier.  If the block starts with only a
+     * small allocated region, it is still worth the effort to see if
+     * the rest of the image is still sparse, coupled with manually
+     * reading the first region to see if it reads zero after all.
+     */
+    if (pnum > MAX_ZERO_CHECK_BUFFER) {
+        return 0;
+    }
+    ret = bdrv_co_is_zero_fast(bs, pnum, bytes - pnum);
+    if (ret <= 0) {
+        return ret;
+    }
+    /* Only the head of the image is unknown, and it's small.  Read it.  */
+    buf = qemu_blockalign(bs, pnum);
+    qemu_iovec_init_buf(&local_qiov, buf, pnum);
+    ret = bdrv_driver_preadv(bs, 0, pnum, &local_qiov, 0, 0);
+    if (ret >= 0) {
+        ret = buffer_is_zero(buf, pnum);
+    }
+    qemu_vfree(buf);
+    return ret;
+}
+
 int coroutine_fn bdrv_co_is_allocated(BlockDriverState *bs, int64_t offset,
                                       int64_t bytes, int64_t *pnum)
 {
diff --git a/include/block/block-io.h b/include/block/block-io.h
index b49e0537dd..b99cc98d26 100644
--- a/include/block/block-io.h
+++ b/include/block/block-io.h
@@ -161,6 +161,8 @@ bdrv_is_allocated_above(BlockDriverState *bs, BlockDriverState *base,
 
 int coroutine_fn GRAPH_RDLOCK
 bdrv_co_is_zero_fast(BlockDriverState *bs, int64_t offset, int64_t bytes);
+int coroutine_fn GRAPH_RDLOCK
+bdrv_co_is_all_zeroes(BlockDriverState *bs);
 
 int GRAPH_RDLOCK
 bdrv_apply_auto_read_only(BlockDriverState *bs, const char *errmsg,

From eb89627899bb84148d272394e885725eff456ae9 Mon Sep 17 00:00:00 2001
From: Eric Blake <eblake@redhat.com>
Date: Fri, 9 May 2025 15:40:22 -0500
Subject: [PATCH 0948/2760] iotests: Improve iotest 194 to mirror data

Mirroring a completely sparse image to a sparse destination should be
practically instantaneous.  It isn't yet, but the test will be more
realistic if it has some non-zero to mirror as well as the holes.

Signed-off-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-ID: <20250509204341.3553601-20-eblake@redhat.com>
---
 tests/qemu-iotests/194 | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tests/qemu-iotests/194 b/tests/qemu-iotests/194
index c0ce82dd25..d0b9c084f5 100755
--- a/tests/qemu-iotests/194
+++ b/tests/qemu-iotests/194
@@ -34,6 +34,7 @@ with iotests.FilePath('source.img') as source_img_path, \
 
     img_size = '1G'
     iotests.qemu_img_create('-f', iotests.imgfmt, source_img_path, img_size)
+    iotests.qemu_io('-f', iotests.imgfmt, '-c', 'write 512M 1M', source_img_path)
     iotests.qemu_img_create('-f', iotests.imgfmt, dest_img_path, img_size)
 
     iotests.log('Launching VMs...')

From 870f8963cf1a84f8ec929b05a6d68906974a76c5 Mon Sep 17 00:00:00 2001
From: Eric Blake <eblake@redhat.com>
Date: Fri, 9 May 2025 15:40:23 -0500
Subject: [PATCH 0949/2760] mirror: Minor refactoring

Commit 5791ba52 (v9.2) pre-initialized ret in mirror_dirty_init to
silence a false positive compiler warning, even though in all code
paths where ret is used, it was guaranteed to be reassigned
beforehand.  But since the function returns -errno, and -1 is not
always the right errno, it's better to initialize to -EIO.

An upcoming patch wants to track two bitmaps in
do_sync_target_write(); this will be easier if the current variables
related to the dirty bitmap are renamed.

Signed-off-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-ID: <20250509204341.3553601-21-eblake@redhat.com>
---
 block/mirror.c | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/block/mirror.c b/block/mirror.c
index a53582f17b..34c6c5252e 100644
--- a/block/mirror.c
+++ b/block/mirror.c
@@ -841,7 +841,7 @@ static int coroutine_fn GRAPH_UNLOCKED mirror_dirty_init(MirrorBlockJob *s)
     int64_t offset;
     BlockDriverState *bs;
     BlockDriverState *target_bs = blk_bs(s->target);
-    int ret = -1;
+    int ret = -EIO;
     int64_t count;
 
     bdrv_graph_co_rdlock();
@@ -1341,7 +1341,7 @@ do_sync_target_write(MirrorBlockJob *job, MirrorMethod method,
 {
     int ret;
     size_t qiov_offset = 0;
-    int64_t bitmap_offset, bitmap_end;
+    int64_t dirty_bitmap_offset, dirty_bitmap_end;
 
     if (!QEMU_IS_ALIGNED(offset, job->granularity) &&
         bdrv_dirty_bitmap_get(job->dirty_bitmap, offset))
@@ -1388,11 +1388,11 @@ do_sync_target_write(MirrorBlockJob *job, MirrorMethod method,
      * Tails are either clean or shrunk, so for bitmap resetting
      * we safely align the range down.
      */
-    bitmap_offset = QEMU_ALIGN_UP(offset, job->granularity);
-    bitmap_end = QEMU_ALIGN_DOWN(offset + bytes, job->granularity);
-    if (bitmap_offset < bitmap_end) {
-        bdrv_reset_dirty_bitmap(job->dirty_bitmap, bitmap_offset,
-                                bitmap_end - bitmap_offset);
+    dirty_bitmap_offset = QEMU_ALIGN_UP(offset, job->granularity);
+    dirty_bitmap_end = QEMU_ALIGN_DOWN(offset + bytes, job->granularity);
+    if (dirty_bitmap_offset < dirty_bitmap_end) {
+        bdrv_reset_dirty_bitmap(job->dirty_bitmap, dirty_bitmap_offset,
+                                dirty_bitmap_end - dirty_bitmap_offset);
     }
 
     job_progress_increase_remaining(&job->common.job, bytes);
@@ -1430,10 +1430,10 @@ do_sync_target_write(MirrorBlockJob *job, MirrorMethod method,
          * at function start, and they must be still dirty, as we've locked
          * the region for in-flight op.
          */
-        bitmap_offset = QEMU_ALIGN_DOWN(offset, job->granularity);
-        bitmap_end = QEMU_ALIGN_UP(offset + bytes, job->granularity);
-        bdrv_set_dirty_bitmap(job->dirty_bitmap, bitmap_offset,
-                              bitmap_end - bitmap_offset);
+        dirty_bitmap_offset = QEMU_ALIGN_DOWN(offset, job->granularity);
+        dirty_bitmap_end = QEMU_ALIGN_UP(offset + bytes, job->granularity);
+        bdrv_set_dirty_bitmap(job->dirty_bitmap, dirty_bitmap_offset,
+                              dirty_bitmap_end - dirty_bitmap_offset);
         qatomic_set(&job->actively_synced, false);
 
         action = mirror_error_action(job, false, -ret);

From 9474d97bd7421b4fe7c806ab0949697514d11e88 Mon Sep 17 00:00:00 2001
From: Eric Blake <eblake@redhat.com>
Date: Fri, 9 May 2025 15:40:24 -0500
Subject: [PATCH 0950/2760] mirror: Pass full sync mode rather than bool to
 internals

Out of the five possible values for MirrorSyncMode, INCREMENTAL and
BITMAP are already rejected up front in mirror_start, leaving NONE,
TOP, and FULL as the remaining values that the code was collapsing
into a single bool is_none_mode.  Furthermore, mirror_dirty_init() is
only reachable for modes TOP and FULL, as further guided by
s->zero_target.  However, upcoming patches want to further optimize
the pre-zeroing pass of a sync=full mirror in mirror_dirty_init(),
while avoiding that pass on a sync=top action.  Instead of throwing
away context by collapsing these two values into
s->is_none_mode=false, it is better to pass s->sync_mode throughout
the entire operation.  For active commit, the desired semantics match
sync mode TOP.

Signed-off-by: Eric Blake <eblake@redhat.com>
Message-ID: <20250509204341.3553601-22-eblake@redhat.com>
Reviewed-by: Sunny Zhu <sunnyzhyy@qq.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 block/mirror.c | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/block/mirror.c b/block/mirror.c
index 34c6c5252e..2599b75d09 100644
--- a/block/mirror.c
+++ b/block/mirror.c
@@ -51,7 +51,7 @@ typedef struct MirrorBlockJob {
     BlockDriverState *to_replace;
     /* Used to block operations on the drive-mirror-replace target */
     Error *replace_blocker;
-    bool is_none_mode;
+    MirrorSyncMode sync_mode;
     BlockMirrorBackingMode backing_mode;
     /* Whether the target image requires explicit zero-initialization */
     bool zero_target;
@@ -723,9 +723,10 @@ static int mirror_exit_common(Job *job)
                              &error_abort);
 
     if (!abort && s->backing_mode == MIRROR_SOURCE_BACKING_CHAIN) {
-        BlockDriverState *backing = s->is_none_mode ? src : s->base;
+        BlockDriverState *backing;
         BlockDriverState *unfiltered_target = bdrv_skip_filters(target_bs);
 
+        backing = s->sync_mode == MIRROR_SYNC_MODE_NONE ? src : s->base;
         if (bdrv_cow_bs(unfiltered_target) != backing) {
             bdrv_set_backing_hd(unfiltered_target, backing, &local_err);
             if (local_err) {
@@ -1020,7 +1021,7 @@ static int coroutine_fn mirror_run(Job *job, Error **errp)
     mirror_free_init(s);
 
     s->last_pause_ns = qemu_clock_get_ns(QEMU_CLOCK_REALTIME);
-    if (!s->is_none_mode) {
+    if (s->sync_mode != MIRROR_SYNC_MODE_NONE) {
         ret = mirror_dirty_init(s);
         if (ret < 0 || job_is_cancelled(&s->common.job)) {
             goto immediate_exit;
@@ -1711,6 +1712,7 @@ static BlockJob *mirror_start_job(
                              int creation_flags, BlockDriverState *target,
                              const char *replaces, int64_t speed,
                              uint32_t granularity, int64_t buf_size,
+                             MirrorSyncMode sync_mode,
                              BlockMirrorBackingMode backing_mode,
                              bool zero_target,
                              BlockdevOnError on_source_error,
@@ -1719,7 +1721,7 @@ static BlockJob *mirror_start_job(
                              BlockCompletionFunc *cb,
                              void *opaque,
                              const BlockJobDriver *driver,
-                             bool is_none_mode, BlockDriverState *base,
+                             BlockDriverState *base,
                              bool auto_complete, const char *filter_node_name,
                              bool is_mirror, MirrorCopyMode copy_mode,
                              bool base_ro,
@@ -1878,7 +1880,7 @@ static BlockJob *mirror_start_job(
     s->replaces = g_strdup(replaces);
     s->on_source_error = on_source_error;
     s->on_target_error = on_target_error;
-    s->is_none_mode = is_none_mode;
+    s->sync_mode = sync_mode;
     s->backing_mode = backing_mode;
     s->zero_target = zero_target;
     qatomic_set(&s->copy_mode, copy_mode);
@@ -2015,7 +2017,6 @@ void mirror_start(const char *job_id, BlockDriverState *bs,
                   bool unmap, const char *filter_node_name,
                   MirrorCopyMode copy_mode, Error **errp)
 {
-    bool is_none_mode;
     BlockDriverState *base;
 
     GLOBAL_STATE_CODE();
@@ -2028,14 +2029,13 @@ void mirror_start(const char *job_id, BlockDriverState *bs,
     }
 
     bdrv_graph_rdlock_main_loop();
-    is_none_mode = mode == MIRROR_SYNC_MODE_NONE;
     base = mode == MIRROR_SYNC_MODE_TOP ? bdrv_backing_chain_next(bs) : NULL;
     bdrv_graph_rdunlock_main_loop();
 
     mirror_start_job(job_id, bs, creation_flags, target, replaces,
-                     speed, granularity, buf_size, backing_mode, zero_target,
-                     on_source_error, on_target_error, unmap, NULL, NULL,
-                     &mirror_job_driver, is_none_mode, base, false,
+                     speed, granularity, buf_size, mode, backing_mode,
+                     zero_target, on_source_error, on_target_error, unmap,
+                     NULL, NULL, &mirror_job_driver, base, false,
                      filter_node_name, true, copy_mode, false, errp);
 }
 
@@ -2061,9 +2061,9 @@ BlockJob *commit_active_start(const char *job_id, BlockDriverState *bs,
 
     job = mirror_start_job(
                      job_id, bs, creation_flags, base, NULL, speed, 0, 0,
-                     MIRROR_LEAVE_BACKING_CHAIN, false,
+                     MIRROR_SYNC_MODE_TOP, MIRROR_LEAVE_BACKING_CHAIN, false,
                      on_error, on_error, true, cb, opaque,
-                     &commit_active_job_driver, false, base, auto_complete,
+                     &commit_active_job_driver, base, auto_complete,
                      filter_node_name, false, MIRROR_COPY_MODE_BACKGROUND,
                      base_read_only, errp);
     if (!job) {

From d17a34bfb94bda3a89d7320ae67255ded1d8c939 Mon Sep 17 00:00:00 2001
From: Eric Blake <eblake@redhat.com>
Date: Fri, 9 May 2025 15:40:25 -0500
Subject: [PATCH 0951/2760] mirror: Allow QMP override to declare target
 already zero

QEMU has an optimization for a just-created drive-mirror destination
that is not possible for blockdev-mirror (which can't create the
destination) - any time we know the destination starts life as all
zeroes, we can skip a pre-zeroing pass on the destination.  Recent
patches have added an improved heuristic for detecting if a file
contains all zeroes, and we plan to use that heuristic in upcoming
patches.  But since a heuristic cannot quickly detect all scenarios,
and there may be cases where the caller is aware of information that
QEMU cannot learn quickly, it makes sense to have a way to tell QEMU
to assume facts about the destination that can make the mirror
operation faster.  Given our existing example of "qemu-img convert
--target-is-zero", it is time to expose this override in QMP for
blockdev-mirror as well.

This patch results in some slight redundancy between the older
s->zero_target (set any time mode==FULL and the destination image was
not just created - ie. clear if drive-mirror is asking to skip the
pre-zero pass) and the newly-introduced s->target_is_zero (in addition
to the QMP override, it is set when drive-mirror creates the
destination image); this will be cleaned up in the next patch.

There is also a subtlety that we must consider.  When drive-mirror is
passing target_is_zero on behalf of a just-created image, we know the
image is sparse (skipping the pre-zeroing keeps it that way), so it
doesn't matter whether the destination also has "discard":"unmap" and
"detect-zeroes":"unmap".  But now that we are letting the user set the
knob for target-is-zero, if the user passes a pre-existing file that
is fully allocated, it is fine to leave the file fully allocated under
"detect-zeroes":"on", but if the file is open with
"detect-zeroes":"unmap", we should really be trying harder to punch
holes in the destination for every region of zeroes copied from the
source.  The easiest way to do this is to still run the pre-zeroing
pass (turning the entire destination file sparse before populating
just the allocated portions of the source), even though that currently
results in double I/O to the portions of the file that are allocated.
A later patch will add further optimizations to reduce redundant
zeroing I/O during the mirror operation.

Since "target-is-zero":true is designed for optimizations, it is okay
to silently ignore the parameter rather than erroring if the user ever
sets the parameter in a scenario where the mirror job can't exploit it
(for example, when doing "sync":"top" instead of "sync":"full", we
can't pre-zero, so setting the parameter won't make a speed
difference).

Signed-off-by: Eric Blake <eblake@redhat.com>
Acked-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20250509204341.3553601-23-eblake@redhat.com>
Reviewed-by: Sunny Zhu <sunnyzhyy@qq.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 block/mirror.c                         | 27 ++++++++++++++++++++++----
 blockdev.c                             | 18 ++++++++++-------
 include/block/block_int-global-state.h |  3 ++-
 qapi/block-core.json                   |  8 +++++++-
 tests/unit/test-block-iothread.c       |  2 +-
 5 files changed, 44 insertions(+), 14 deletions(-)

diff --git a/block/mirror.c b/block/mirror.c
index 2599b75d09..4dcb50c81a 100644
--- a/block/mirror.c
+++ b/block/mirror.c
@@ -55,6 +55,8 @@ typedef struct MirrorBlockJob {
     BlockMirrorBackingMode backing_mode;
     /* Whether the target image requires explicit zero-initialization */
     bool zero_target;
+    /* Whether the target should be assumed to be already zero initialized */
+    bool target_is_zero;
     /*
      * To be accesssed with atomics. Written only under the BQL (required by the
      * current implementation of mirror_change()).
@@ -844,12 +846,26 @@ static int coroutine_fn GRAPH_UNLOCKED mirror_dirty_init(MirrorBlockJob *s)
     BlockDriverState *target_bs = blk_bs(s->target);
     int ret = -EIO;
     int64_t count;
+    bool punch_holes =
+        target_bs->detect_zeroes == BLOCKDEV_DETECT_ZEROES_OPTIONS_UNMAP &&
+        bdrv_can_write_zeroes_with_unmap(target_bs);
 
     bdrv_graph_co_rdlock();
     bs = s->mirror_top_bs->backing->bs;
     bdrv_graph_co_rdunlock();
 
-    if (s->zero_target) {
+    if (s->zero_target && (!s->target_is_zero || punch_holes)) {
+        /*
+         * Here, we are in FULL mode; our goal is to avoid writing
+         * zeroes if the destination already reads as zero, except
+         * when we are trying to punch holes.  This is possible if
+         * zeroing happened externally (s->target_is_zero) or if we
+         * have a fast way to pre-zero the image (the dirty bitmap
+         * will be populated later by the non-zero portions, the same
+         * as for TOP mode).  If pre-zeroing is not fast, or we need
+         * to punch holes, then our only recourse is to write the
+         * entire image.
+         */
         if (!bdrv_can_write_zeroes_with_unmap(target_bs)) {
             bdrv_set_dirty_bitmap(s->dirty_bitmap, 0, s->bdev_length);
             return 0;
@@ -1714,7 +1730,7 @@ static BlockJob *mirror_start_job(
                              uint32_t granularity, int64_t buf_size,
                              MirrorSyncMode sync_mode,
                              BlockMirrorBackingMode backing_mode,
-                             bool zero_target,
+                             bool zero_target, bool target_is_zero,
                              BlockdevOnError on_source_error,
                              BlockdevOnError on_target_error,
                              bool unmap,
@@ -1883,6 +1899,7 @@ static BlockJob *mirror_start_job(
     s->sync_mode = sync_mode;
     s->backing_mode = backing_mode;
     s->zero_target = zero_target;
+    s->target_is_zero = target_is_zero;
     qatomic_set(&s->copy_mode, copy_mode);
     s->base = base;
     s->base_overlay = bdrv_find_overlay(bs, base);
@@ -2011,7 +2028,7 @@ void mirror_start(const char *job_id, BlockDriverState *bs,
                   int creation_flags, int64_t speed,
                   uint32_t granularity, int64_t buf_size,
                   MirrorSyncMode mode, BlockMirrorBackingMode backing_mode,
-                  bool zero_target,
+                  bool zero_target, bool target_is_zero,
                   BlockdevOnError on_source_error,
                   BlockdevOnError on_target_error,
                   bool unmap, const char *filter_node_name,
@@ -2034,7 +2051,8 @@ void mirror_start(const char *job_id, BlockDriverState *bs,
 
     mirror_start_job(job_id, bs, creation_flags, target, replaces,
                      speed, granularity, buf_size, mode, backing_mode,
-                     zero_target, on_source_error, on_target_error, unmap,
+                     zero_target,
+                     target_is_zero, on_source_error, on_target_error, unmap,
                      NULL, NULL, &mirror_job_driver, base, false,
                      filter_node_name, true, copy_mode, false, errp);
 }
@@ -2062,6 +2080,7 @@ BlockJob *commit_active_start(const char *job_id, BlockDriverState *bs,
     job = mirror_start_job(
                      job_id, bs, creation_flags, base, NULL, speed, 0, 0,
                      MIRROR_SYNC_MODE_TOP, MIRROR_LEAVE_BACKING_CHAIN, false,
+                     false,
                      on_error, on_error, true, cb, opaque,
                      &commit_active_job_driver, base, auto_complete,
                      filter_node_name, false, MIRROR_COPY_MODE_BACKGROUND,
diff --git a/blockdev.c b/blockdev.c
index 818ec42511..97128feb27 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -2804,7 +2804,7 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
                                    const char *replaces,
                                    enum MirrorSyncMode sync,
                                    BlockMirrorBackingMode backing_mode,
-                                   bool zero_target,
+                                   bool zero_target, bool target_is_zero,
                                    bool has_speed, int64_t speed,
                                    bool has_granularity, uint32_t granularity,
                                    bool has_buf_size, int64_t buf_size,
@@ -2915,11 +2915,10 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
     /* pass the node name to replace to mirror start since it's loose coupling
      * and will allow to check whether the node still exist at mirror completion
      */
-    mirror_start(job_id, bs, target,
-                 replaces, job_flags,
+    mirror_start(job_id, bs, target, replaces, job_flags,
                  speed, granularity, buf_size, sync, backing_mode, zero_target,
-                 on_source_error, on_target_error, unmap, filter_node_name,
-                 copy_mode, errp);
+                 target_is_zero, on_source_error, on_target_error, unmap,
+                 filter_node_name, copy_mode, errp);
 }
 
 void qmp_drive_mirror(DriveMirror *arg, Error **errp)
@@ -2934,6 +2933,7 @@ void qmp_drive_mirror(DriveMirror *arg, Error **errp)
     int64_t size;
     const char *format = arg->format;
     bool zero_target;
+    bool target_is_zero;
     int ret;
 
     bs = qmp_get_root_bs(arg->device, errp);
@@ -3050,6 +3050,8 @@ void qmp_drive_mirror(DriveMirror *arg, Error **errp)
     zero_target = (arg->sync == MIRROR_SYNC_MODE_FULL &&
                    (arg->mode == NEW_IMAGE_MODE_EXISTING ||
                     !bdrv_has_zero_init(target_bs)));
+    target_is_zero = (arg->mode != NEW_IMAGE_MODE_EXISTING &&
+                      bdrv_has_zero_init(target_bs));
     bdrv_graph_rdunlock_main_loop();
 
 
@@ -3061,7 +3063,7 @@ void qmp_drive_mirror(DriveMirror *arg, Error **errp)
 
     blockdev_mirror_common(arg->job_id, bs, target_bs,
                            arg->replaces, arg->sync,
-                           backing_mode, zero_target,
+                           backing_mode, zero_target, target_is_zero,
                            arg->has_speed, arg->speed,
                            arg->has_granularity, arg->granularity,
                            arg->has_buf_size, arg->buf_size,
@@ -3091,6 +3093,7 @@ void qmp_blockdev_mirror(const char *job_id,
                          bool has_copy_mode, MirrorCopyMode copy_mode,
                          bool has_auto_finalize, bool auto_finalize,
                          bool has_auto_dismiss, bool auto_dismiss,
+                         bool has_target_is_zero, bool target_is_zero,
                          Error **errp)
 {
     BlockDriverState *bs;
@@ -3121,7 +3124,8 @@ void qmp_blockdev_mirror(const char *job_id,
 
     blockdev_mirror_common(job_id, bs, target_bs,
                            replaces, sync, backing_mode,
-                           zero_target, has_speed, speed,
+                           zero_target, has_target_is_zero && target_is_zero,
+                           has_speed, speed,
                            has_granularity, granularity,
                            has_buf_size, buf_size,
                            has_on_source_error, on_source_error,
diff --git a/include/block/block_int-global-state.h b/include/block/block_int-global-state.h
index 0d93783763..62a6c7e8e2 100644
--- a/include/block/block_int-global-state.h
+++ b/include/block/block_int-global-state.h
@@ -140,6 +140,7 @@ BlockJob *commit_active_start(const char *job_id, BlockDriverState *bs,
  * @mode: Whether to collapse all images in the chain to the target.
  * @backing_mode: How to establish the target's backing chain after completion.
  * @zero_target: Whether the target should be explicitly zero-initialized
+ * @target_is_zero: Whether the target already is zero-initialized.
  * @on_source_error: The action to take upon error reading from the source.
  * @on_target_error: The action to take upon error writing to the target.
  * @unmap: Whether to unmap target where source sectors only contain zeroes.
@@ -159,7 +160,7 @@ void mirror_start(const char *job_id, BlockDriverState *bs,
                   int creation_flags, int64_t speed,
                   uint32_t granularity, int64_t buf_size,
                   MirrorSyncMode mode, BlockMirrorBackingMode backing_mode,
-                  bool zero_target,
+                  bool zero_target, bool target_is_zero,
                   BlockdevOnError on_source_error,
                   BlockdevOnError on_target_error,
                   bool unmap, const char *filter_node_name,
diff --git a/qapi/block-core.json b/qapi/block-core.json
index 91c70e24a7..b4115113d4 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
@@ -2542,6 +2542,11 @@
 #     disappear from the query list without user intervention.
 #     Defaults to true.  (Since 3.1)
 #
+# @target-is-zero: Assume the destination reads as all zeroes before
+#     the mirror started.  Setting this to true can speed up the
+#     mirror.  Setting this to true when the destination is not
+#     actually all zero can corrupt the destination.  (Since 10.1)
+#
 # Since: 2.6
 #
 # .. qmp-example::
@@ -2561,7 +2566,8 @@
             '*on-target-error': 'BlockdevOnError',
             '*filter-node-name': 'str',
             '*copy-mode': 'MirrorCopyMode',
-            '*auto-finalize': 'bool', '*auto-dismiss': 'bool' },
+            '*auto-finalize': 'bool', '*auto-dismiss': 'bool',
+            '*target-is-zero': 'bool'},
   'allow-preconfig': true }
 
 ##
diff --git a/tests/unit/test-block-iothread.c b/tests/unit/test-block-iothread.c
index e26b3be593..54aed8252c 100644
--- a/tests/unit/test-block-iothread.c
+++ b/tests/unit/test-block-iothread.c
@@ -755,7 +755,7 @@ static void test_propagate_mirror(void)
 
     /* Start a mirror job */
     mirror_start("job0", src, target, NULL, JOB_DEFAULT, 0, 0, 0,
-                 MIRROR_SYNC_MODE_NONE, MIRROR_OPEN_BACKING_CHAIN, false,
+                 MIRROR_SYNC_MODE_NONE, MIRROR_OPEN_BACKING_CHAIN, false, false,
                  BLOCKDEV_ON_ERROR_REPORT, BLOCKDEV_ON_ERROR_REPORT,
                  false, "filter_node", MIRROR_COPY_MODE_BACKGROUND,
                  &error_abort);

From 253b43a29077de9266351e120c600a73b82e9c49 Mon Sep 17 00:00:00 2001
From: Eric Blake <eblake@redhat.com>
Date: Fri, 9 May 2025 15:40:26 -0500
Subject: [PATCH 0952/2760] mirror: Drop redundant zero_target parameter

The two callers to a mirror job (drive-mirror and blockdev-mirror) set
zero_target precisely when sync mode == FULL, with the one exception
that drive-mirror skips zeroing the target if it was newly created and
reads as zero.  But given the previous patch, that exception is
equally captured by target_is_zero.

Meanwhile, there is another slight wrinkle, fortunately caught by
iotest 185: if the caller uses "sync":"top" but the source has no
backing file, the code in blockdev.c was changing sync to be FULL, but
only after it had set zero_target=false.  In mirror.c, prior to recent
patches, this didn't matter: the only places that inspected sync were
setting is_none_mode (both TOP and FULL had set that to false), and
mirror_start() setting base = mode == MIRROR_SYNC_MODE_TOP ?
bdrv_backing_chain_next(bs) : NULL.  But now that we are passing sync
around, the slammed sync mode would result in a new pre-zeroing pass
even when the user had passed "sync":"top" in an effort to skip
pre-zeroing.  Fortunately, the assignment of base when bs has no
backing chain still works out to NULL if we don't slam things.  So
with the forced change of sync ripped out of blockdev.c, the sync mode
is passed through the full callstack unmolested, and we can now
reliably reconstruct the same settings as what used to be passed in by
zero_target=false, without the redundant parameter.

Signed-off-by: Eric Blake <eblake@redhat.com>
Message-ID: <20250509204341.3553601-24-eblake@redhat.com>
Reviewed-by: Sunny Zhu <sunnyzhyy@qq.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
[eblake: Fix regression in iotest 185]
Signed-off-by: Eric Blake <eblake@redhat.com>
---
 block/mirror.c                         | 13 +++++--------
 blockdev.c                             | 19 ++++---------------
 include/block/block_int-global-state.h |  3 +--
 tests/unit/test-block-iothread.c       |  2 +-
 4 files changed, 11 insertions(+), 26 deletions(-)

diff --git a/block/mirror.c b/block/mirror.c
index 4dcb50c81a..d04db85883 100644
--- a/block/mirror.c
+++ b/block/mirror.c
@@ -53,8 +53,6 @@ typedef struct MirrorBlockJob {
     Error *replace_blocker;
     MirrorSyncMode sync_mode;
     BlockMirrorBackingMode backing_mode;
-    /* Whether the target image requires explicit zero-initialization */
-    bool zero_target;
     /* Whether the target should be assumed to be already zero initialized */
     bool target_is_zero;
     /*
@@ -854,7 +852,9 @@ static int coroutine_fn GRAPH_UNLOCKED mirror_dirty_init(MirrorBlockJob *s)
     bs = s->mirror_top_bs->backing->bs;
     bdrv_graph_co_rdunlock();
 
-    if (s->zero_target && (!s->target_is_zero || punch_holes)) {
+    if (s->sync_mode == MIRROR_SYNC_MODE_TOP) {
+        /* In TOP mode, there is no benefit to a pre-zeroing pass.  */
+    } else if (!s->target_is_zero || punch_holes) {
         /*
          * Here, we are in FULL mode; our goal is to avoid writing
          * zeroes if the destination already reads as zero, except
@@ -1730,7 +1730,7 @@ static BlockJob *mirror_start_job(
                              uint32_t granularity, int64_t buf_size,
                              MirrorSyncMode sync_mode,
                              BlockMirrorBackingMode backing_mode,
-                             bool zero_target, bool target_is_zero,
+                             bool target_is_zero,
                              BlockdevOnError on_source_error,
                              BlockdevOnError on_target_error,
                              bool unmap,
@@ -1898,7 +1898,6 @@ static BlockJob *mirror_start_job(
     s->on_target_error = on_target_error;
     s->sync_mode = sync_mode;
     s->backing_mode = backing_mode;
-    s->zero_target = zero_target;
     s->target_is_zero = target_is_zero;
     qatomic_set(&s->copy_mode, copy_mode);
     s->base = base;
@@ -2028,7 +2027,7 @@ void mirror_start(const char *job_id, BlockDriverState *bs,
                   int creation_flags, int64_t speed,
                   uint32_t granularity, int64_t buf_size,
                   MirrorSyncMode mode, BlockMirrorBackingMode backing_mode,
-                  bool zero_target, bool target_is_zero,
+                  bool target_is_zero,
                   BlockdevOnError on_source_error,
                   BlockdevOnError on_target_error,
                   bool unmap, const char *filter_node_name,
@@ -2051,7 +2050,6 @@ void mirror_start(const char *job_id, BlockDriverState *bs,
 
     mirror_start_job(job_id, bs, creation_flags, target, replaces,
                      speed, granularity, buf_size, mode, backing_mode,
-                     zero_target,
                      target_is_zero, on_source_error, on_target_error, unmap,
                      NULL, NULL, &mirror_job_driver, base, false,
                      filter_node_name, true, copy_mode, false, errp);
@@ -2080,7 +2078,6 @@ BlockJob *commit_active_start(const char *job_id, BlockDriverState *bs,
     job = mirror_start_job(
                      job_id, bs, creation_flags, base, NULL, speed, 0, 0,
                      MIRROR_SYNC_MODE_TOP, MIRROR_LEAVE_BACKING_CHAIN, false,
-                     false,
                      on_error, on_error, true, cb, opaque,
                      &commit_active_job_driver, base, auto_complete,
                      filter_node_name, false, MIRROR_COPY_MODE_BACKGROUND,
diff --git a/blockdev.c b/blockdev.c
index 97128feb27..21443b4514 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -2804,7 +2804,7 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
                                    const char *replaces,
                                    enum MirrorSyncMode sync,
                                    BlockMirrorBackingMode backing_mode,
-                                   bool zero_target, bool target_is_zero,
+                                   bool target_is_zero,
                                    bool has_speed, int64_t speed,
                                    bool has_granularity, uint32_t granularity,
                                    bool has_buf_size, int64_t buf_size,
@@ -2871,10 +2871,6 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
         return;
     }
 
-    if (!bdrv_backing_chain_next(bs) && sync == MIRROR_SYNC_MODE_TOP) {
-        sync = MIRROR_SYNC_MODE_FULL;
-    }
-
     if (!replaces) {
         /* We want to mirror from @bs, but keep implicit filters on top */
         unfiltered_bs = bdrv_skip_implicit_filters(bs);
@@ -2916,7 +2912,7 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
      * and will allow to check whether the node still exist at mirror completion
      */
     mirror_start(job_id, bs, target, replaces, job_flags,
-                 speed, granularity, buf_size, sync, backing_mode, zero_target,
+                 speed, granularity, buf_size, sync, backing_mode,
                  target_is_zero, on_source_error, on_target_error, unmap,
                  filter_node_name, copy_mode, errp);
 }
@@ -2932,7 +2928,6 @@ void qmp_drive_mirror(DriveMirror *arg, Error **errp)
     int flags;
     int64_t size;
     const char *format = arg->format;
-    bool zero_target;
     bool target_is_zero;
     int ret;
 
@@ -3047,9 +3042,6 @@ void qmp_drive_mirror(DriveMirror *arg, Error **errp)
     }
 
     bdrv_graph_rdlock_main_loop();
-    zero_target = (arg->sync == MIRROR_SYNC_MODE_FULL &&
-                   (arg->mode == NEW_IMAGE_MODE_EXISTING ||
-                    !bdrv_has_zero_init(target_bs)));
     target_is_zero = (arg->mode != NEW_IMAGE_MODE_EXISTING &&
                       bdrv_has_zero_init(target_bs));
     bdrv_graph_rdunlock_main_loop();
@@ -3063,7 +3055,7 @@ void qmp_drive_mirror(DriveMirror *arg, Error **errp)
 
     blockdev_mirror_common(arg->job_id, bs, target_bs,
                            arg->replaces, arg->sync,
-                           backing_mode, zero_target, target_is_zero,
+                           backing_mode, target_is_zero,
                            arg->has_speed, arg->speed,
                            arg->has_granularity, arg->granularity,
                            arg->has_buf_size, arg->buf_size,
@@ -3100,7 +3092,6 @@ void qmp_blockdev_mirror(const char *job_id,
     BlockDriverState *target_bs;
     AioContext *aio_context;
     BlockMirrorBackingMode backing_mode = MIRROR_LEAVE_BACKING_CHAIN;
-    bool zero_target;
     int ret;
 
     bs = qmp_get_root_bs(device, errp);
@@ -3113,8 +3104,6 @@ void qmp_blockdev_mirror(const char *job_id,
         return;
     }
 
-    zero_target = (sync == MIRROR_SYNC_MODE_FULL);
-
     aio_context = bdrv_get_aio_context(bs);
 
     ret = bdrv_try_change_aio_context(target_bs, aio_context, NULL, errp);
@@ -3124,7 +3113,7 @@ void qmp_blockdev_mirror(const char *job_id,
 
     blockdev_mirror_common(job_id, bs, target_bs,
                            replaces, sync, backing_mode,
-                           zero_target, has_target_is_zero && target_is_zero,
+                           has_target_is_zero && target_is_zero,
                            has_speed, speed,
                            has_granularity, granularity,
                            has_buf_size, buf_size,
diff --git a/include/block/block_int-global-state.h b/include/block/block_int-global-state.h
index 62a6c7e8e2..e7c8f1a856 100644
--- a/include/block/block_int-global-state.h
+++ b/include/block/block_int-global-state.h
@@ -139,7 +139,6 @@ BlockJob *commit_active_start(const char *job_id, BlockDriverState *bs,
  * @buf_size: The amount of data that can be in flight at one time.
  * @mode: Whether to collapse all images in the chain to the target.
  * @backing_mode: How to establish the target's backing chain after completion.
- * @zero_target: Whether the target should be explicitly zero-initialized
  * @target_is_zero: Whether the target already is zero-initialized.
  * @on_source_error: The action to take upon error reading from the source.
  * @on_target_error: The action to take upon error writing to the target.
@@ -160,7 +159,7 @@ void mirror_start(const char *job_id, BlockDriverState *bs,
                   int creation_flags, int64_t speed,
                   uint32_t granularity, int64_t buf_size,
                   MirrorSyncMode mode, BlockMirrorBackingMode backing_mode,
-                  bool zero_target, bool target_is_zero,
+                  bool target_is_zero,
                   BlockdevOnError on_source_error,
                   BlockdevOnError on_target_error,
                   bool unmap, const char *filter_node_name,
diff --git a/tests/unit/test-block-iothread.c b/tests/unit/test-block-iothread.c
index 54aed8252c..e26b3be593 100644
--- a/tests/unit/test-block-iothread.c
+++ b/tests/unit/test-block-iothread.c
@@ -755,7 +755,7 @@ static void test_propagate_mirror(void)
 
     /* Start a mirror job */
     mirror_start("job0", src, target, NULL, JOB_DEFAULT, 0, 0, 0,
-                 MIRROR_SYNC_MODE_NONE, MIRROR_OPEN_BACKING_CHAIN, false, false,
+                 MIRROR_SYNC_MODE_NONE, MIRROR_OPEN_BACKING_CHAIN, false,
                  BLOCKDEV_ON_ERROR_REPORT, BLOCKDEV_ON_ERROR_REPORT,
                  false, "filter_node", MIRROR_COPY_MODE_BACKGROUND,
                  &error_abort);

From 181a63667adf16c35b57e446def3e41c70f1fea6 Mon Sep 17 00:00:00 2001
From: Eric Blake <eblake@redhat.com>
Date: Fri, 9 May 2025 15:40:27 -0500
Subject: [PATCH 0953/2760] mirror: Skip pre-zeroing destination if it is
 already zero

When doing a sync=full mirroring, we can skip pre-zeroing the
destination if it already reads as zeroes and we are not also trying
to punch holes due to detect-zeroes.  With this patch, there are fewer
scenarios that have to pass in an explicit target-is-zero, while still
resulting in a sparse destination remaining sparse.

A later patch will then further improve things to skip writing to the
destination for parts of the image where the source is zero; but even
with just this patch, it is possible to see a difference for any
source that does not report itself as fully allocated, coupled with a
destination BDS that can quickly report that it already reads as zero.
(For a source that reports as fully allocated, such as a file, the
rest of mirror_dirty_init() still sets the entire dirty bitmap to
true, so even though we avoided the pre-zeroing, we are not yet
avoiding all redundant I/O).

Iotest 194 detects the difference made by this patch: for a file
source (where block status reports the entire image as allocated, and
therefore we end up writing zeroes everywhere in the destination
anyways), the job length remains the same.  But for a qcow2 source and
a destination that reads as all zeroes, the dirty bitmap changes to
just tracking the allocated portions of the source, which results in
faster completion and smaller job statistics.  For the test to pass
with both ./check -file and -qcow2, a new python filter is needed to
mask out the now-varying job amounts (this matches the shell filters
_filter_block_job_{offset,len} in common.filter).  A later test will
also be added which further validates expected sparseness, so it does
not matter that 194 is no longer explicitly looking at how many bytes
were copied.

Signed-off-by: Eric Blake <eblake@redhat.com>
Message-ID: <20250509204341.3553601-25-eblake@redhat.com>
Reviewed-by: Sunny Zhu <sunnyzhyy@qq.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 block/mirror.c                | 24 ++++++++++++++++--------
 tests/qemu-iotests/194        |  6 ++++--
 tests/qemu-iotests/194.out    |  4 ++--
 tests/qemu-iotests/iotests.py | 12 +++++++++++-
 4 files changed, 33 insertions(+), 13 deletions(-)

diff --git a/block/mirror.c b/block/mirror.c
index d04db85883..bca99ec206 100644
--- a/block/mirror.c
+++ b/block/mirror.c
@@ -848,23 +848,31 @@ static int coroutine_fn GRAPH_UNLOCKED mirror_dirty_init(MirrorBlockJob *s)
         target_bs->detect_zeroes == BLOCKDEV_DETECT_ZEROES_OPTIONS_UNMAP &&
         bdrv_can_write_zeroes_with_unmap(target_bs);
 
+    /* Determine if the image is already zero, regardless of sync mode.  */
     bdrv_graph_co_rdlock();
     bs = s->mirror_top_bs->backing->bs;
+    if (s->target_is_zero) {
+        ret = 1;
+    } else {
+        ret = bdrv_co_is_all_zeroes(target_bs);
+    }
     bdrv_graph_co_rdunlock();
 
-    if (s->sync_mode == MIRROR_SYNC_MODE_TOP) {
+    /* Determine if a pre-zeroing pass is necessary.  */
+    if (ret < 0) {
+        return ret;
+    } else if (s->sync_mode == MIRROR_SYNC_MODE_TOP) {
         /* In TOP mode, there is no benefit to a pre-zeroing pass.  */
-    } else if (!s->target_is_zero || punch_holes) {
+    } else if (ret == 0 || punch_holes) {
         /*
          * Here, we are in FULL mode; our goal is to avoid writing
          * zeroes if the destination already reads as zero, except
          * when we are trying to punch holes.  This is possible if
-         * zeroing happened externally (s->target_is_zero) or if we
-         * have a fast way to pre-zero the image (the dirty bitmap
-         * will be populated later by the non-zero portions, the same
-         * as for TOP mode).  If pre-zeroing is not fast, or we need
-         * to punch holes, then our only recourse is to write the
-         * entire image.
+         * zeroing happened externally (ret > 0) or if we have a fast
+         * way to pre-zero the image (the dirty bitmap will be
+         * populated later by the non-zero portions, the same as for
+         * TOP mode).  If pre-zeroing is not fast, or we need to punch
+         * holes, then our only recourse is to write the entire image.
          */
         if (!bdrv_can_write_zeroes_with_unmap(target_bs)) {
             bdrv_set_dirty_bitmap(s->dirty_bitmap, 0, s->bdev_length);
diff --git a/tests/qemu-iotests/194 b/tests/qemu-iotests/194
index d0b9c084f5..e114c0b269 100755
--- a/tests/qemu-iotests/194
+++ b/tests/qemu-iotests/194
@@ -62,7 +62,8 @@ with iotests.FilePath('source.img') as source_img_path, \
 
     iotests.log('Waiting for `drive-mirror` to complete...')
     iotests.log(source_vm.event_wait('BLOCK_JOB_READY'),
-                filters=[iotests.filter_qmp_event])
+                filters=[iotests.filter_qmp_event,
+                         iotests.filter_block_job])
 
     iotests.log('Starting migration...')
     capabilities = [{'capability': 'events', 'state': True},
@@ -88,7 +89,8 @@ with iotests.FilePath('source.img') as source_img_path, \
 
     while True:
         event2 = source_vm.event_wait('BLOCK_JOB_COMPLETED')
-        iotests.log(event2, filters=[iotests.filter_qmp_event])
+        iotests.log(event2, filters=[iotests.filter_qmp_event,
+                                     iotests.filter_block_job])
         if event2['event'] == 'BLOCK_JOB_COMPLETED':
             iotests.log('Stopping the NBD server on destination...')
             iotests.log(dest_vm.qmp('nbd-server-stop'))
diff --git a/tests/qemu-iotests/194.out b/tests/qemu-iotests/194.out
index 6940e809cd..d02655a514 100644
--- a/tests/qemu-iotests/194.out
+++ b/tests/qemu-iotests/194.out
@@ -7,7 +7,7 @@ Launching NBD server on destination...
 Starting `drive-mirror` on source...
 {"return": {}}
 Waiting for `drive-mirror` to complete...
-{"data": {"device": "mirror-job0", "len": 1073741824, "offset": 1073741824, "speed": 0, "type": "mirror"}, "event": "BLOCK_JOB_READY", "timestamp": {"microseconds": "USECS", "seconds": "SECS"}}
+{"data": {"device": "mirror-job0", "len": "LEN", "offset": "OFFSET", "speed": 0, "type": "mirror"}, "event": "BLOCK_JOB_READY", "timestamp": {"microseconds": "USECS", "seconds": "SECS"}}
 Starting migration...
 {"return": {}}
 {"execute": "migrate-start-postcopy", "arguments": {}}
@@ -18,7 +18,7 @@ Starting migration...
 {"data": {"status": "completed"}, "event": "MIGRATION", "timestamp": {"microseconds": "USECS", "seconds": "SECS"}}
 Gracefully ending the `drive-mirror` job on source...
 {"return": {}}
-{"data": {"device": "mirror-job0", "len": 1073741824, "offset": 1073741824, "speed": 0, "type": "mirror"}, "event": "BLOCK_JOB_COMPLETED", "timestamp": {"microseconds": "USECS", "seconds": "SECS"}}
+{"data": {"device": "mirror-job0", "len": "LEN", "offset": "OFFSET", "speed": 0, "type": "mirror"}, "event": "BLOCK_JOB_COMPLETED", "timestamp": {"microseconds": "USECS", "seconds": "SECS"}}
 Stopping the NBD server on destination...
 {"return": {}}
 Wait for migration completion on target...
diff --git a/tests/qemu-iotests/iotests.py b/tests/qemu-iotests/iotests.py
index 7292c8b342..05274772ce 100644
--- a/tests/qemu-iotests/iotests.py
+++ b/tests/qemu-iotests/iotests.py
@@ -601,13 +601,23 @@ def filter_chown(msg):
     return chown_re.sub("chown UID:GID", msg)
 
 def filter_qmp_event(event):
-    '''Filter a QMP event dict'''
+    '''Filter the timestamp of a QMP event dict'''
     event = dict(event)
     if 'timestamp' in event:
         event['timestamp']['seconds'] = 'SECS'
         event['timestamp']['microseconds'] = 'USECS'
     return event
 
+def filter_block_job(event):
+    '''Filter the offset and length of a QMP block job event dict'''
+    event = dict(event)
+    if 'data' in event:
+        if 'offset' in event['data']:
+            event['data']['offset'] = 'OFFSET'
+        if 'len' in event['data']:
+            event['data']['len'] = 'LEN'
+    return event
+
 def filter_qmp(qmsg, filter_fn):
     '''Given a string filter, filter a QMP object's values.
     filter_fn takes a (key, value) pair.'''

From 7e277545b90874171128804e256a538fb0e8dd7e Mon Sep 17 00:00:00 2001
From: Eric Blake <eblake@redhat.com>
Date: Fri, 9 May 2025 15:40:28 -0500
Subject: [PATCH 0954/2760] mirror: Skip writing zeroes when target is already
 zero

When mirroring, the goal is to ensure that the destination reads the
same as the source; this goal is met whether the destination is sparse
or fully-allocated (except when explicitly punching holes, then merely
reading zero is not enough to know if it is sparse, so we still want
to punch the hole).  Avoiding a redundant write to zero (whether in
the background because the zero cluster was marked in the dirty
bitmap, or in the foreground because the guest is writing zeroes) when
the destination already reads as zero makes mirroring faster, and
avoids allocating the destination merely because the source reports as
allocated.

The effect is especially pronounced when the source is a raw file.
That's because when the source is a qcow2 file, the dirty bitmap only
visits the portions of the source that are allocated, which tend to be
non-zero.  But when the source is a raw file,
bdrv_co_is_allocated_above() reports the entire file as allocated so
mirror_dirty_init sets the entire dirty bitmap, and it is only later
during mirror_iteration that we change to consulting the more precise
bdrv_co_block_status_above() to learn where the source reads as zero.

Remember that since a mirror operation can write a cluster more than
once (every time the guest changes the source, the destination is also
changed to keep up), and the guest can change whether a given cluster
reads as zero, is discarded, or has non-zero data over the course of
the mirror operation, we can't take the shortcut of relying on
s->target_is_zero (which is static for the life of the job) in
mirror_co_zero() to see if the destination is already zero, because
that information may be stale.  Any solution we use must be dynamic in
the face of the guest writing or discarding a cluster while the mirror
has been ongoing.

We could just teach mirror_co_zero() to do a block_status() probe of
the destination, and skip the zeroes if the destination already reads
as zero, but we know from past experience that extra block_status()
calls are not always cheap (tmpfs, anyone?), especially when they are
random access rather than linear.  Use of block_status() of the source
by the background task in a linear fashion is not our bottleneck (it's
a background task, after all); but since mirroring can be done while
the source is actively being changed, we don't want a slow
block_status() of the destination to occur on the hot path of the
guest trying to do random-access writes to the source.

So this patch takes a slightly different approach: any time we have to
track dirty clusters, we can also track which clusters are known to
read as zero.  For sync=TOP or when we are punching holes from
"detect-zeroes":"unmap", the zero bitmap starts out empty, but
prevents a second write zero to a cluster that was already zero by an
earlier pass; for sync=FULL when we are not punching holes, the zero
bitmap starts out full if the destination reads as zero during
initialization.  Either way, I/O to the destination can now avoid
redundant write zero to a cluster that already reads as zero, all
without having to do a block_status() per write on the destination.

With this patch, if I create a raw sparse destination file, connect it
with QMP 'blockdev-add' while leaving it at the default "discard":
"ignore", then run QMP 'blockdev-mirror' with "sync": "full", the
destination remains sparse rather than fully allocated.  Meanwhile, a
destination image that is already fully allocated remains so unless it
was opened with "detect-zeroes": "unmap".  And any time writing zeroes
is skipped, the job counters are not incremented.

Signed-off-by: Eric Blake <eblake@redhat.com>
Message-ID: <20250509204341.3553601-26-eblake@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 block/mirror.c | 107 ++++++++++++++++++++++++++++++++++++++++++-------
 1 file changed, 93 insertions(+), 14 deletions(-)

diff --git a/block/mirror.c b/block/mirror.c
index bca99ec206..724318f037 100644
--- a/block/mirror.c
+++ b/block/mirror.c
@@ -73,6 +73,7 @@ typedef struct MirrorBlockJob {
     size_t buf_size;
     int64_t bdev_length;
     unsigned long *cow_bitmap;
+    unsigned long *zero_bitmap;
     BdrvDirtyBitmap *dirty_bitmap;
     BdrvDirtyBitmapIter *dbi;
     uint8_t *buf;
@@ -108,9 +109,12 @@ struct MirrorOp {
     int64_t offset;
     uint64_t bytes;
 
-    /* The pointee is set by mirror_co_read(), mirror_co_zero(), and
-     * mirror_co_discard() before yielding for the first time */
+    /*
+     * These pointers are set by mirror_co_read(), mirror_co_zero(), and
+     * mirror_co_discard() before yielding for the first time
+     */
     int64_t *bytes_handled;
+    bool *io_skipped;
 
     bool is_pseudo_op;
     bool is_active_write;
@@ -408,15 +412,34 @@ static void coroutine_fn mirror_co_read(void *opaque)
 static void coroutine_fn mirror_co_zero(void *opaque)
 {
     MirrorOp *op = opaque;
-    int ret;
+    bool write_needed = true;
+    int ret = 0;
 
     op->s->in_flight++;
     op->s->bytes_in_flight += op->bytes;
     *op->bytes_handled = op->bytes;
     op->is_in_flight = true;
 
-    ret = blk_co_pwrite_zeroes(op->s->target, op->offset, op->bytes,
-                               op->s->unmap ? BDRV_REQ_MAY_UNMAP : 0);
+    if (op->s->zero_bitmap) {
+        unsigned long end = DIV_ROUND_UP(op->offset + op->bytes,
+                                         op->s->granularity);
+        assert(QEMU_IS_ALIGNED(op->offset, op->s->granularity));
+        assert(QEMU_IS_ALIGNED(op->bytes, op->s->granularity) ||
+               op->offset + op->bytes == op->s->bdev_length);
+        if (find_next_zero_bit(op->s->zero_bitmap, end,
+                               op->offset / op->s->granularity) == end) {
+            write_needed = false;
+            *op->io_skipped = true;
+        }
+    }
+    if (write_needed) {
+        ret = blk_co_pwrite_zeroes(op->s->target, op->offset, op->bytes,
+                                   op->s->unmap ? BDRV_REQ_MAY_UNMAP : 0);
+    }
+    if (ret >= 0 && op->s->zero_bitmap) {
+        bitmap_set(op->s->zero_bitmap, op->offset / op->s->granularity,
+                   DIV_ROUND_UP(op->bytes, op->s->granularity));
+    }
     mirror_write_complete(op, ret);
 }
 
@@ -435,29 +458,43 @@ static void coroutine_fn mirror_co_discard(void *opaque)
 }
 
 static unsigned mirror_perform(MirrorBlockJob *s, int64_t offset,
-                               unsigned bytes, MirrorMethod mirror_method)
+                               unsigned bytes, MirrorMethod mirror_method,
+                               bool *io_skipped)
 {
     MirrorOp *op;
     Coroutine *co;
     int64_t bytes_handled = -1;
 
+    assert(QEMU_IS_ALIGNED(offset, s->granularity));
+    assert(QEMU_IS_ALIGNED(bytes, s->granularity) ||
+           offset + bytes == s->bdev_length);
     op = g_new(MirrorOp, 1);
     *op = (MirrorOp){
         .s              = s,
         .offset         = offset,
         .bytes          = bytes,
         .bytes_handled  = &bytes_handled,
+        .io_skipped     = io_skipped,
     };
     qemu_co_queue_init(&op->waiting_requests);
 
     switch (mirror_method) {
     case MIRROR_METHOD_COPY:
+        if (s->zero_bitmap) {
+            bitmap_clear(s->zero_bitmap, offset / s->granularity,
+                         DIV_ROUND_UP(bytes, s->granularity));
+        }
         co = qemu_coroutine_create(mirror_co_read, op);
         break;
     case MIRROR_METHOD_ZERO:
+        /* s->zero_bitmap handled in mirror_co_zero */
         co = qemu_coroutine_create(mirror_co_zero, op);
         break;
     case MIRROR_METHOD_DISCARD:
+        if (s->zero_bitmap) {
+            bitmap_clear(s->zero_bitmap, offset / s->granularity,
+                         DIV_ROUND_UP(bytes, s->granularity));
+        }
         co = qemu_coroutine_create(mirror_co_discard, op);
         break;
     default:
@@ -568,6 +605,7 @@ static void coroutine_fn GRAPH_UNLOCKED mirror_iteration(MirrorBlockJob *s)
         int ret = -1;
         int64_t io_bytes;
         int64_t io_bytes_acct;
+        bool io_skipped = false;
         MirrorMethod mirror_method = MIRROR_METHOD_COPY;
 
         assert(!(offset % s->granularity));
@@ -611,8 +649,10 @@ static void coroutine_fn GRAPH_UNLOCKED mirror_iteration(MirrorBlockJob *s)
         }
 
         io_bytes = mirror_clip_bytes(s, offset, io_bytes);
-        io_bytes = mirror_perform(s, offset, io_bytes, mirror_method);
-        if (mirror_method != MIRROR_METHOD_COPY && write_zeroes_ok) {
+        io_bytes = mirror_perform(s, offset, io_bytes, mirror_method,
+                                  &io_skipped);
+        if (io_skipped ||
+            (mirror_method != MIRROR_METHOD_COPY && write_zeroes_ok)) {
             io_bytes_acct = 0;
         } else {
             io_bytes_acct = io_bytes;
@@ -847,8 +887,10 @@ static int coroutine_fn GRAPH_UNLOCKED mirror_dirty_init(MirrorBlockJob *s)
     bool punch_holes =
         target_bs->detect_zeroes == BLOCKDEV_DETECT_ZEROES_OPTIONS_UNMAP &&
         bdrv_can_write_zeroes_with_unmap(target_bs);
+    int64_t bitmap_length = DIV_ROUND_UP(s->bdev_length, s->granularity);
 
     /* Determine if the image is already zero, regardless of sync mode.  */
+    s->zero_bitmap = bitmap_new(bitmap_length);
     bdrv_graph_co_rdlock();
     bs = s->mirror_top_bs->backing->bs;
     if (s->target_is_zero) {
@@ -862,7 +904,14 @@ static int coroutine_fn GRAPH_UNLOCKED mirror_dirty_init(MirrorBlockJob *s)
     if (ret < 0) {
         return ret;
     } else if (s->sync_mode == MIRROR_SYNC_MODE_TOP) {
-        /* In TOP mode, there is no benefit to a pre-zeroing pass.  */
+        /*
+         * In TOP mode, there is no benefit to a pre-zeroing pass, but
+         * the zero bitmap can be set if the destination already reads
+         * as zero and we are not punching holes.
+         */
+        if (ret > 0 && !punch_holes) {
+            bitmap_set(s->zero_bitmap, 0, bitmap_length);
+        }
     } else if (ret == 0 || punch_holes) {
         /*
          * Here, we are in FULL mode; our goal is to avoid writing
@@ -871,8 +920,9 @@ static int coroutine_fn GRAPH_UNLOCKED mirror_dirty_init(MirrorBlockJob *s)
          * zeroing happened externally (ret > 0) or if we have a fast
          * way to pre-zero the image (the dirty bitmap will be
          * populated later by the non-zero portions, the same as for
-         * TOP mode).  If pre-zeroing is not fast, or we need to punch
-         * holes, then our only recourse is to write the entire image.
+         * TOP mode).  If pre-zeroing is not fast, then our only
+         * recourse is to mark the entire image dirty.  The act of
+         * pre-zeroing will populate the zero bitmap.
          */
         if (!bdrv_can_write_zeroes_with_unmap(target_bs)) {
             bdrv_set_dirty_bitmap(s->dirty_bitmap, 0, s->bdev_length);
@@ -883,6 +933,7 @@ static int coroutine_fn GRAPH_UNLOCKED mirror_dirty_init(MirrorBlockJob *s)
         for (offset = 0; offset < s->bdev_length; ) {
             int bytes = MIN(s->bdev_length - offset,
                             QEMU_ALIGN_DOWN(INT_MAX, s->granularity));
+            bool ignored;
 
             mirror_throttle(s);
 
@@ -898,12 +949,15 @@ static int coroutine_fn GRAPH_UNLOCKED mirror_dirty_init(MirrorBlockJob *s)
                 continue;
             }
 
-            mirror_perform(s, offset, bytes, MIRROR_METHOD_ZERO);
+            mirror_perform(s, offset, bytes, MIRROR_METHOD_ZERO, &ignored);
             offset += bytes;
         }
 
         mirror_wait_for_all_io(s);
         s->initial_zeroing_ongoing = false;
+    } else {
+        /* In FULL mode, and image already reads as zero.  */
+        bitmap_set(s->zero_bitmap, 0, bitmap_length);
     }
 
     /* First part, loop on the sectors and initialize the dirty bitmap.  */
@@ -1188,6 +1242,7 @@ immediate_exit:
     assert(s->in_flight == 0);
     qemu_vfree(s->buf);
     g_free(s->cow_bitmap);
+    g_free(s->zero_bitmap);
     g_free(s->in_flight_bitmap);
     bdrv_dirty_iter_free(s->dbi);
 
@@ -1367,6 +1422,7 @@ do_sync_target_write(MirrorBlockJob *job, MirrorMethod method,
     int ret;
     size_t qiov_offset = 0;
     int64_t dirty_bitmap_offset, dirty_bitmap_end;
+    int64_t zero_bitmap_offset, zero_bitmap_end;
 
     if (!QEMU_IS_ALIGNED(offset, job->granularity) &&
         bdrv_dirty_bitmap_get(job->dirty_bitmap, offset))
@@ -1410,8 +1466,9 @@ do_sync_target_write(MirrorBlockJob *job, MirrorMethod method,
     }
 
     /*
-     * Tails are either clean or shrunk, so for bitmap resetting
-     * we safely align the range down.
+     * Tails are either clean or shrunk, so for dirty bitmap resetting
+     * we safely align the range narrower.  But for zero bitmap, round
+     * range wider for checking or clearing, and narrower for setting.
      */
     dirty_bitmap_offset = QEMU_ALIGN_UP(offset, job->granularity);
     dirty_bitmap_end = QEMU_ALIGN_DOWN(offset + bytes, job->granularity);
@@ -1419,22 +1476,44 @@ do_sync_target_write(MirrorBlockJob *job, MirrorMethod method,
         bdrv_reset_dirty_bitmap(job->dirty_bitmap, dirty_bitmap_offset,
                                 dirty_bitmap_end - dirty_bitmap_offset);
     }
+    zero_bitmap_offset = offset / job->granularity;
+    zero_bitmap_end = DIV_ROUND_UP(offset + bytes, job->granularity);
 
     job_progress_increase_remaining(&job->common.job, bytes);
     job->active_write_bytes_in_flight += bytes;
 
     switch (method) {
     case MIRROR_METHOD_COPY:
+        if (job->zero_bitmap) {
+            bitmap_clear(job->zero_bitmap, zero_bitmap_offset,
+                         zero_bitmap_end - zero_bitmap_offset);
+        }
         ret = blk_co_pwritev_part(job->target, offset, bytes,
                                   qiov, qiov_offset, flags);
         break;
 
     case MIRROR_METHOD_ZERO:
+        if (job->zero_bitmap) {
+            if (find_next_zero_bit(job->zero_bitmap, zero_bitmap_end,
+                                   zero_bitmap_offset) == zero_bitmap_end) {
+                ret = 0;
+                break;
+            }
+        }
         assert(!qiov);
         ret = blk_co_pwrite_zeroes(job->target, offset, bytes, flags);
+        if (job->zero_bitmap && ret >= 0) {
+            bitmap_set(job->zero_bitmap, dirty_bitmap_offset / job->granularity,
+                       (dirty_bitmap_end - dirty_bitmap_offset) /
+                       job->granularity);
+        }
         break;
 
     case MIRROR_METHOD_DISCARD:
+        if (job->zero_bitmap) {
+            bitmap_clear(job->zero_bitmap, zero_bitmap_offset,
+                         zero_bitmap_end - zero_bitmap_offset);
+        }
         assert(!qiov);
         ret = blk_co_pdiscard(job->target, offset, bytes);
         break;

From be9bac072ede6e6aa27079f59efcf17b56bd7b26 Mon Sep 17 00:00:00 2001
From: Andrey Drobyshev <andrey.drobyshev@virtuozzo.com>
Date: Fri, 9 May 2025 15:40:29 -0500
Subject: [PATCH 0955/2760] iotests/common.rc: add disk_usage function

Move the definition from iotests/250 to common.rc.  This is used to
detect real disk usage of sparse files.  In particular, we want to use
it for checking subclusters-based discards.

Signed-off-by: Andrey Drobyshev <andrey.drobyshev@virtuozzo.com>
Reviewed-by: Alexander Ivanov <alexander.ivanov@virtuozzo.com>
Reviewed-by: Alberto Garcia <berto@igalia.com>
Message-ID: <20240913163942.423050-6-andrey.drobyshev@virtuozzo.com>
Signed-off-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-ID: <20250509204341.3553601-27-eblake@redhat.com>
---
 tests/qemu-iotests/250       | 5 -----
 tests/qemu-iotests/common.rc | 6 ++++++
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/tests/qemu-iotests/250 b/tests/qemu-iotests/250
index af48f83aba..c0a0dbc0ff 100755
--- a/tests/qemu-iotests/250
+++ b/tests/qemu-iotests/250
@@ -52,11 +52,6 @@ _unsupported_imgopts data_file
 # bdrv_co_truncate(bs->file) call in qcow2_co_truncate(), which might succeed
 # anyway.
 
-disk_usage()
-{
-    du --block-size=1 $1 | awk '{print $1}'
-}
-
 size=2100M
 
 _make_test_img -o "cluster_size=1M,preallocation=metadata" $size
diff --git a/tests/qemu-iotests/common.rc b/tests/qemu-iotests/common.rc
index 95c12577dd..237f746af8 100644
--- a/tests/qemu-iotests/common.rc
+++ b/tests/qemu-iotests/common.rc
@@ -140,6 +140,12 @@ _optstr_add()
     fi
 }
 
+# report real disk usage for sparse files
+disk_usage()
+{
+    du --block-size=1 "$1" | awk '{print $1}'
+}
+
 # Set the variables to the empty string to turn Valgrind off
 # for specific processes, e.g.
 # $ VALGRIND_QEMU_IO= ./check -qcow2 -valgrind 015

From c0ddcb2cbc146e64f666eaae4edc7b5db7e5814d Mon Sep 17 00:00:00 2001
From: Eric Blake <eblake@redhat.com>
Date: Fri, 9 May 2025 15:40:30 -0500
Subject: [PATCH 0956/2760] tests: Add iotest mirror-sparse for recent patches

Prove that blockdev-mirror can now result in sparse raw destination
files, regardless of whether the source is raw or qcow2.  By making
this a separate test, it was possible to test effects of individual
patches for the various pieces that all have to work together for a
sparse mirror to be successful.

Note that ./check -file produces different job lengths than ./check
-qcow2 (the test uses a filter to normalize); that's because when
deciding how much of the image to be mirrored, the code looks at how
much of the source image was allocated (for qcow2, this is only the
written clusters; for raw, it is the entire file).  But the important
part is that the destination file ends up smaller than 3M, rather than
the 20M it used to be before this patch series.

Signed-off-by: Eric Blake <eblake@redhat.com>
Message-ID: <20250509204341.3553601-28-eblake@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 tests/qemu-iotests/tests/mirror-sparse     | 125 +++++++
 tests/qemu-iotests/tests/mirror-sparse.out | 365 +++++++++++++++++++++
 2 files changed, 490 insertions(+)
 create mode 100755 tests/qemu-iotests/tests/mirror-sparse
 create mode 100644 tests/qemu-iotests/tests/mirror-sparse.out

diff --git a/tests/qemu-iotests/tests/mirror-sparse b/tests/qemu-iotests/tests/mirror-sparse
new file mode 100755
index 0000000000..8c52a4e244
--- /dev/null
+++ b/tests/qemu-iotests/tests/mirror-sparse
@@ -0,0 +1,125 @@
+#!/usr/bin/env bash
+# group: rw auto quick
+#
+# Test blockdev-mirror with raw sparse destination
+#
+# Copyright (C) 2025 Red Hat, Inc.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+seq="$(basename $0)"
+echo "QA output created by $seq"
+
+status=1 # failure is the default!
+
+_cleanup()
+{
+    _cleanup_test_img
+    _cleanup_qemu
+}
+trap "_cleanup; exit \$status" 0 1 2 3 15
+
+# get standard environment, filters and checks
+cd ..
+. ./common.rc
+. ./common.filter
+. ./common.qemu
+
+_supported_fmt qcow2 raw  # Format of the source. dst is always raw file
+_supported_proto file
+_supported_os Linux
+
+echo
+echo "=== Initial image setup ==="
+echo
+
+TEST_IMG="$TEST_IMG.base" _make_test_img 20M
+$QEMU_IO -c 'w 8M 2M' -f $IMGFMT "$TEST_IMG.base" | _filter_qemu_io
+
+_launch_qemu \
+    -blockdev '{"driver":"file", "cache":{"direct":true, "no-flush":false},
+                "filename":"'"$TEST_IMG.base"'", "node-name":"src-file"}' \
+    -blockdev '{"driver":"'$IMGFMT'", "node-name":"src", "file":"src-file"}'
+h1=$QEMU_HANDLE
+_send_qemu_cmd $h1 '{"execute": "qmp_capabilities"}' 'return'
+
+# Check several combinations; most should result in a sparse destination;
+# the destination should only be fully allocated if pre-allocated
+# and not punching holes due to detect-zeroes
+# do_test creation discard zeroes result
+do_test() {
+    creation=$1
+    discard=$2
+    zeroes=$3
+    expected=$4
+
+echo
+echo "=== Testing creation=$creation discard=$discard zeroes=$zeroes ==="
+echo
+
+rm -f $TEST_IMG
+if test $creation = external; then
+    truncate --size=20M $TEST_IMG
+else
+    _send_qemu_cmd $h1 '{"execute": "blockdev-create", "arguments":
+          {"options": {"driver":"file", "filename":"'$TEST_IMG'",
+            "size":'$((20*1024*1024))', "preallocation":"'$creation'"},
+           "job-id":"job1"}}' 'concluded'
+    _send_qemu_cmd $h1 '{"execute": "job-dismiss", "arguments":
+          {"id": "job1"}}' 'return'
+fi
+_send_qemu_cmd $h1 '{"execute": "blockdev-add", "arguments":
+                     {"node-name": "dst", "driver":"file",
+                      "filename":"'$TEST_IMG'", "aio":"threads",
+                      "auto-read-only":true, "discard":"'$discard'",
+                      "detect-zeroes":"'$zeroes'"}}' 'return'
+_send_qemu_cmd $h1 '{"execute":"blockdev-mirror", "arguments":
+                     {"sync":"full", "device":"src", "target":"dst",
+                      "job-id":"job2"}}' 'return'
+_timed_wait_for $h1 '"ready"'
+_send_qemu_cmd $h1 '{"execute": "job-complete", "arguments":
+               {"id":"job2"}}' 'return' \
+                  | _filter_block_job_offset | _filter_block_job_len
+_send_qemu_cmd $h1 '{"execute": "blockdev-del", "arguments":
+                {"node-name": "dst"}}' 'return' \
+                  | _filter_block_job_offset | _filter_block_job_len
+$QEMU_IMG compare -U -f $IMGFMT -F raw $TEST_IMG.base $TEST_IMG
+result=$(disk_usage $TEST_IMG)
+if test $result -lt $((3*1024*1024)); then
+    actual=sparse
+elif test $result = $((20*1024*1024)); then
+    actual=full
+else
+    actual=unknown
+fi
+echo "Destination is $actual; expected $expected"
+}
+
+do_test external ignore off sparse
+do_test external unmap off sparse
+do_test external unmap unmap sparse
+do_test off ignore off sparse
+do_test off unmap off sparse
+do_test off unmap unmap sparse
+do_test full ignore off full
+do_test full unmap off sparse
+do_test full unmap unmap sparse
+
+_send_qemu_cmd $h1 '{"execute":"quit"}' ''
+
+# success, all done
+echo '*** done'
+rm -f $seq.full
+status=0
diff --git a/tests/qemu-iotests/tests/mirror-sparse.out b/tests/qemu-iotests/tests/mirror-sparse.out
new file mode 100644
index 0000000000..2103b891c3
--- /dev/null
+++ b/tests/qemu-iotests/tests/mirror-sparse.out
@@ -0,0 +1,365 @@
+QA output created by mirror-sparse
+
+=== Initial image setup ===
+
+Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=20971520
+wrote 2097152/2097152 bytes at offset 8388608
+2 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+{"execute": "qmp_capabilities"}
+{"return": {}}
+
+=== Testing creation=external discard=ignore zeroes=off ===
+
+{"execute": "blockdev-add", "arguments":
+                     {"node-name": "dst", "driver":"file",
+                      "filename":"TEST_DIR/t.IMGFMT", "aio":"threads",
+                      "auto-read-only":true, "discard":"ignore",
+                      "detect-zeroes":"off"}}
+{"return": {}}
+{"execute":"blockdev-mirror", "arguments":
+                     {"sync":"full", "device":"src", "target":"dst",
+                      "job-id":"job2"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "created", "id": "job2"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "job2"}}
+{"return": {}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "ready", "id": "job2"}}
+{"execute": "job-complete", "arguments":
+               {"id":"job2"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_READY", "data": {"device": "job2", "len": LEN, "offset": OFFSET, "speed": 0, "type": "mirror"}}
+{"return": {}}
+{"execute": "blockdev-del", "arguments":
+                {"node-name": "dst"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "waiting", "id": "job2"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "pending", "id": "job2"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_COMPLETED", "data": {"device": "job2", "len": LEN, "offset": OFFSET, "speed": 0, "type": "mirror"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "concluded", "id": "job2"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "null", "id": "job2"}}
+{"return": {}}
+Images are identical.
+Destination is sparse; expected sparse
+
+=== Testing creation=external discard=unmap zeroes=off ===
+
+{"execute": "blockdev-add", "arguments":
+                     {"node-name": "dst", "driver":"file",
+                      "filename":"TEST_DIR/t.IMGFMT", "aio":"threads",
+                      "auto-read-only":true, "discard":"unmap",
+                      "detect-zeroes":"off"}}
+{"return": {}}
+{"execute":"blockdev-mirror", "arguments":
+                     {"sync":"full", "device":"src", "target":"dst",
+                      "job-id":"job2"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "created", "id": "job2"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "job2"}}
+{"return": {}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "ready", "id": "job2"}}
+{"execute": "job-complete", "arguments":
+               {"id":"job2"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_READY", "data": {"device": "job2", "len": LEN, "offset": OFFSET, "speed": 0, "type": "mirror"}}
+{"return": {}}
+{"execute": "blockdev-del", "arguments":
+                {"node-name": "dst"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "waiting", "id": "job2"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "pending", "id": "job2"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_COMPLETED", "data": {"device": "job2", "len": LEN, "offset": OFFSET, "speed": 0, "type": "mirror"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "concluded", "id": "job2"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "null", "id": "job2"}}
+{"return": {}}
+Images are identical.
+Destination is sparse; expected sparse
+
+=== Testing creation=external discard=unmap zeroes=unmap ===
+
+{"execute": "blockdev-add", "arguments":
+                     {"node-name": "dst", "driver":"file",
+                      "filename":"TEST_DIR/t.IMGFMT", "aio":"threads",
+                      "auto-read-only":true, "discard":"unmap",
+                      "detect-zeroes":"unmap"}}
+{"return": {}}
+{"execute":"blockdev-mirror", "arguments":
+                     {"sync":"full", "device":"src", "target":"dst",
+                      "job-id":"job2"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "created", "id": "job2"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "job2"}}
+{"return": {}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "ready", "id": "job2"}}
+{"execute": "job-complete", "arguments":
+               {"id":"job2"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_READY", "data": {"device": "job2", "len": LEN, "offset": OFFSET, "speed": 0, "type": "mirror"}}
+{"return": {}}
+{"execute": "blockdev-del", "arguments":
+                {"node-name": "dst"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "waiting", "id": "job2"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "pending", "id": "job2"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_COMPLETED", "data": {"device": "job2", "len": LEN, "offset": OFFSET, "speed": 0, "type": "mirror"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "concluded", "id": "job2"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "null", "id": "job2"}}
+{"return": {}}
+Images are identical.
+Destination is sparse; expected sparse
+
+=== Testing creation=off discard=ignore zeroes=off ===
+
+{"execute": "blockdev-create", "arguments":
+          {"options": {"driver":"file", "filename":"TEST_DIR/t.IMGFMT",
+            "size":20971520, "preallocation":"off"},
+           "job-id":"job1"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "created", "id": "job1"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "job1"}}
+{"return": {}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "waiting", "id": "job1"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "pending", "id": "job1"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "concluded", "id": "job1"}}
+{"execute": "job-dismiss", "arguments":
+          {"id": "job1"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "null", "id": "job1"}}
+{"return": {}}
+{"execute": "blockdev-add", "arguments":
+                     {"node-name": "dst", "driver":"file",
+                      "filename":"TEST_DIR/t.IMGFMT", "aio":"threads",
+                      "auto-read-only":true, "discard":"ignore",
+                      "detect-zeroes":"off"}}
+{"return": {}}
+{"execute":"blockdev-mirror", "arguments":
+                     {"sync":"full", "device":"src", "target":"dst",
+                      "job-id":"job2"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "created", "id": "job2"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "job2"}}
+{"return": {}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "ready", "id": "job2"}}
+{"execute": "job-complete", "arguments":
+               {"id":"job2"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_READY", "data": {"device": "job2", "len": LEN, "offset": OFFSET, "speed": 0, "type": "mirror"}}
+{"return": {}}
+{"execute": "blockdev-del", "arguments":
+                {"node-name": "dst"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "waiting", "id": "job2"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "pending", "id": "job2"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_COMPLETED", "data": {"device": "job2", "len": LEN, "offset": OFFSET, "speed": 0, "type": "mirror"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "concluded", "id": "job2"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "null", "id": "job2"}}
+{"return": {}}
+Images are identical.
+Destination is sparse; expected sparse
+
+=== Testing creation=off discard=unmap zeroes=off ===
+
+{"execute": "blockdev-create", "arguments":
+          {"options": {"driver":"file", "filename":"TEST_DIR/t.IMGFMT",
+            "size":20971520, "preallocation":"off"},
+           "job-id":"job1"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "created", "id": "job1"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "job1"}}
+{"return": {}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "waiting", "id": "job1"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "pending", "id": "job1"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "concluded", "id": "job1"}}
+{"execute": "job-dismiss", "arguments":
+          {"id": "job1"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "null", "id": "job1"}}
+{"return": {}}
+{"execute": "blockdev-add", "arguments":
+                     {"node-name": "dst", "driver":"file",
+                      "filename":"TEST_DIR/t.IMGFMT", "aio":"threads",
+                      "auto-read-only":true, "discard":"unmap",
+                      "detect-zeroes":"off"}}
+{"return": {}}
+{"execute":"blockdev-mirror", "arguments":
+                     {"sync":"full", "device":"src", "target":"dst",
+                      "job-id":"job2"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "created", "id": "job2"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "job2"}}
+{"return": {}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "ready", "id": "job2"}}
+{"execute": "job-complete", "arguments":
+               {"id":"job2"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_READY", "data": {"device": "job2", "len": LEN, "offset": OFFSET, "speed": 0, "type": "mirror"}}
+{"return": {}}
+{"execute": "blockdev-del", "arguments":
+                {"node-name": "dst"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "waiting", "id": "job2"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "pending", "id": "job2"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_COMPLETED", "data": {"device": "job2", "len": LEN, "offset": OFFSET, "speed": 0, "type": "mirror"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "concluded", "id": "job2"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "null", "id": "job2"}}
+{"return": {}}
+Images are identical.
+Destination is sparse; expected sparse
+
+=== Testing creation=off discard=unmap zeroes=unmap ===
+
+{"execute": "blockdev-create", "arguments":
+          {"options": {"driver":"file", "filename":"TEST_DIR/t.IMGFMT",
+            "size":20971520, "preallocation":"off"},
+           "job-id":"job1"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "created", "id": "job1"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "job1"}}
+{"return": {}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "waiting", "id": "job1"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "pending", "id": "job1"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "concluded", "id": "job1"}}
+{"execute": "job-dismiss", "arguments":
+          {"id": "job1"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "null", "id": "job1"}}
+{"return": {}}
+{"execute": "blockdev-add", "arguments":
+                     {"node-name": "dst", "driver":"file",
+                      "filename":"TEST_DIR/t.IMGFMT", "aio":"threads",
+                      "auto-read-only":true, "discard":"unmap",
+                      "detect-zeroes":"unmap"}}
+{"return": {}}
+{"execute":"blockdev-mirror", "arguments":
+                     {"sync":"full", "device":"src", "target":"dst",
+                      "job-id":"job2"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "created", "id": "job2"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "job2"}}
+{"return": {}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "ready", "id": "job2"}}
+{"execute": "job-complete", "arguments":
+               {"id":"job2"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_READY", "data": {"device": "job2", "len": LEN, "offset": OFFSET, "speed": 0, "type": "mirror"}}
+{"return": {}}
+{"execute": "blockdev-del", "arguments":
+                {"node-name": "dst"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "waiting", "id": "job2"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "pending", "id": "job2"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_COMPLETED", "data": {"device": "job2", "len": LEN, "offset": OFFSET, "speed": 0, "type": "mirror"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "concluded", "id": "job2"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "null", "id": "job2"}}
+{"return": {}}
+Images are identical.
+Destination is sparse; expected sparse
+
+=== Testing creation=full discard=ignore zeroes=off ===
+
+{"execute": "blockdev-create", "arguments":
+          {"options": {"driver":"file", "filename":"TEST_DIR/t.IMGFMT",
+            "size":20971520, "preallocation":"full"},
+           "job-id":"job1"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "created", "id": "job1"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "job1"}}
+{"return": {}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "waiting", "id": "job1"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "pending", "id": "job1"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "concluded", "id": "job1"}}
+{"execute": "job-dismiss", "arguments":
+          {"id": "job1"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "null", "id": "job1"}}
+{"return": {}}
+{"execute": "blockdev-add", "arguments":
+                     {"node-name": "dst", "driver":"file",
+                      "filename":"TEST_DIR/t.IMGFMT", "aio":"threads",
+                      "auto-read-only":true, "discard":"ignore",
+                      "detect-zeroes":"off"}}
+{"return": {}}
+{"execute":"blockdev-mirror", "arguments":
+                     {"sync":"full", "device":"src", "target":"dst",
+                      "job-id":"job2"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "created", "id": "job2"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "job2"}}
+{"return": {}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "ready", "id": "job2"}}
+{"execute": "job-complete", "arguments":
+               {"id":"job2"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_READY", "data": {"device": "job2", "len": LEN, "offset": OFFSET, "speed": 0, "type": "mirror"}}
+{"return": {}}
+{"execute": "blockdev-del", "arguments":
+                {"node-name": "dst"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "waiting", "id": "job2"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "pending", "id": "job2"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_COMPLETED", "data": {"device": "job2", "len": LEN, "offset": OFFSET, "speed": 0, "type": "mirror"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "concluded", "id": "job2"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "null", "id": "job2"}}
+{"return": {}}
+Images are identical.
+Destination is full; expected full
+
+=== Testing creation=full discard=unmap zeroes=off ===
+
+{"execute": "blockdev-create", "arguments":
+          {"options": {"driver":"file", "filename":"TEST_DIR/t.IMGFMT",
+            "size":20971520, "preallocation":"full"},
+           "job-id":"job1"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "created", "id": "job1"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "job1"}}
+{"return": {}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "waiting", "id": "job1"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "pending", "id": "job1"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "concluded", "id": "job1"}}
+{"execute": "job-dismiss", "arguments":
+          {"id": "job1"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "null", "id": "job1"}}
+{"return": {}}
+{"execute": "blockdev-add", "arguments":
+                     {"node-name": "dst", "driver":"file",
+                      "filename":"TEST_DIR/t.IMGFMT", "aio":"threads",
+                      "auto-read-only":true, "discard":"unmap",
+                      "detect-zeroes":"off"}}
+{"return": {}}
+{"execute":"blockdev-mirror", "arguments":
+                     {"sync":"full", "device":"src", "target":"dst",
+                      "job-id":"job2"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "created", "id": "job2"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "job2"}}
+{"return": {}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "ready", "id": "job2"}}
+{"execute": "job-complete", "arguments":
+               {"id":"job2"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_READY", "data": {"device": "job2", "len": LEN, "offset": OFFSET, "speed": 0, "type": "mirror"}}
+{"return": {}}
+{"execute": "blockdev-del", "arguments":
+                {"node-name": "dst"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "waiting", "id": "job2"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "pending", "id": "job2"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_COMPLETED", "data": {"device": "job2", "len": LEN, "offset": OFFSET, "speed": 0, "type": "mirror"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "concluded", "id": "job2"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "null", "id": "job2"}}
+{"return": {}}
+Images are identical.
+Destination is sparse; expected sparse
+
+=== Testing creation=full discard=unmap zeroes=unmap ===
+
+{"execute": "blockdev-create", "arguments":
+          {"options": {"driver":"file", "filename":"TEST_DIR/t.IMGFMT",
+            "size":20971520, "preallocation":"full"},
+           "job-id":"job1"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "created", "id": "job1"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "job1"}}
+{"return": {}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "waiting", "id": "job1"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "pending", "id": "job1"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "concluded", "id": "job1"}}
+{"execute": "job-dismiss", "arguments":
+          {"id": "job1"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "null", "id": "job1"}}
+{"return": {}}
+{"execute": "blockdev-add", "arguments":
+                     {"node-name": "dst", "driver":"file",
+                      "filename":"TEST_DIR/t.IMGFMT", "aio":"threads",
+                      "auto-read-only":true, "discard":"unmap",
+                      "detect-zeroes":"unmap"}}
+{"return": {}}
+{"execute":"blockdev-mirror", "arguments":
+                     {"sync":"full", "device":"src", "target":"dst",
+                      "job-id":"job2"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "created", "id": "job2"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "job2"}}
+{"return": {}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "ready", "id": "job2"}}
+{"execute": "job-complete", "arguments":
+               {"id":"job2"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_READY", "data": {"device": "job2", "len": LEN, "offset": OFFSET, "speed": 0, "type": "mirror"}}
+{"return": {}}
+{"execute": "blockdev-del", "arguments":
+                {"node-name": "dst"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "waiting", "id": "job2"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "pending", "id": "job2"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_COMPLETED", "data": {"device": "job2", "len": LEN, "offset": OFFSET, "speed": 0, "type": "mirror"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "concluded", "id": "job2"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "null", "id": "job2"}}
+{"return": {}}
+Images are identical.
+Destination is sparse; expected sparse
+{"execute":"quit"}
+*** done

From aff46b4bf556430dd3c12fa39a457f0487bb0053 Mon Sep 17 00:00:00 2001
From: Eric Blake <eblake@redhat.com>
Date: Tue, 13 May 2025 17:00:45 -0500
Subject: [PATCH 0957/2760] mirror: Reduce I/O when destination is
 detect-zeroes:unmap

If we are going to punch holes in the mirror destination even for the
portions where the source image is unallocated, it is nicer to treat
the entire image as dirty and punch as we go, rather than pre-zeroing
the entire image just to re-do I/O to the allocated portions of the
image.

Signed-off-by: Eric Blake <eblake@redhat.com>
Message-ID: <20250513220142.535200-2-eblake@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 block/mirror.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/block/mirror.c b/block/mirror.c
index 724318f037..c2c5099c95 100644
--- a/block/mirror.c
+++ b/block/mirror.c
@@ -920,11 +920,16 @@ static int coroutine_fn GRAPH_UNLOCKED mirror_dirty_init(MirrorBlockJob *s)
          * zeroing happened externally (ret > 0) or if we have a fast
          * way to pre-zero the image (the dirty bitmap will be
          * populated later by the non-zero portions, the same as for
-         * TOP mode).  If pre-zeroing is not fast, then our only
-         * recourse is to mark the entire image dirty.  The act of
-         * pre-zeroing will populate the zero bitmap.
+         * TOP mode).  If pre-zeroing is not fast, or we need to visit
+         * the entire image in order to punch holes even in the
+         * non-allocated regions of the source, then just mark the
+         * entire image dirty and leave the zero bitmap clear at this
+         * point in time.  Otherwise, it can be faster to pre-zero the
+         * image now, even if we re-write the allocated portions of
+         * the disk later, and the pre-zero pass will populate the
+         * zero bitmap.
          */
-        if (!bdrv_can_write_zeroes_with_unmap(target_bs)) {
+        if (!bdrv_can_write_zeroes_with_unmap(target_bs) || punch_holes) {
             bdrv_set_dirty_bitmap(s->dirty_bitmap, 0, s->bdev_length);
             return 0;
         }

From 0b1c23a582f7bc721a9b858c289a8d165152a6a0 Mon Sep 17 00:00:00 2001
From: Klaus Jensen <k.jensen@samsung.com>
Date: Wed, 7 May 2025 09:30:55 +0200
Subject: [PATCH 0958/2760] hw/nvme: fix nvme hotplugging
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Commit cd59f50ab017 caused a regression on nvme hotplugging for devices
with an implicit nvm subsystem.

The nvme-subsys device was incorrectly left with being marked as
non-hotpluggable. Fix this.

Cc: qemu-stable@nongnu.org
Reported-by: Stéphane Graber <stgraber@stgraber.org>
Tested-by: Stéphane Graber <stgraber@stgraber.org>
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2950
Fixes: cd59f50ab017 ("hw/nvme: always initialize a subsystem")
Reviewed-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
---
 hw/nvme/subsys.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/hw/nvme/subsys.c b/hw/nvme/subsys.c
index 38271d78c8..777e1c620f 100644
--- a/hw/nvme/subsys.c
+++ b/hw/nvme/subsys.c
@@ -226,7 +226,6 @@ static void nvme_subsys_class_init(ObjectClass *oc, const void *data)
 
     dc->realize = nvme_subsys_realize;
     dc->desc = "Virtual NVMe subsystem";
-    dc->hotpluggable = false;
 
     device_class_set_props(dc, nvme_subsystem_props);
 }

From 923976dfe367b0bfed45ff660c369f3fe65604a7 Mon Sep 17 00:00:00 2001
From: Helge Deller <deller@gmx.de>
Date: Sat, 17 May 2025 13:12:07 +0200
Subject: [PATCH 0959/2760] target/hppa: Copy instruction code into fr1 on FPU
 assist fault

The hardware stores the instruction code in the lower bits of the FP
exception register #1 on FP assist traps.
This fixes the FP exception handler on Linux, as the Linux kernel uses
the value to decide on the correct signal which should be pushed into
userspace (see decode_fpu() in Linux kernel).

Signed-off-by: Helge Deller <deller@gmx.de>
---
 target/hppa/int_helper.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/target/hppa/int_helper.c b/target/hppa/int_helper.c
index 7d48643bb6..191ae19404 100644
--- a/target/hppa/int_helper.c
+++ b/target/hppa/int_helper.c
@@ -177,6 +177,10 @@ void hppa_cpu_do_interrupt(CPUState *cs)
                     }
                 }
                 env->cr[CR_IIR] = ldl_phys(cs->as, paddr);
+                if (i == EXCP_ASSIST) {
+                    /* stuff insn code into bits of FP exception register #1 */
+                    env->fr[0] |= (env->cr[CR_IIR] & 0x03ffffff);
+                }
             }
             break;
 

From b4b49cf39dba5f993ad925f204cb820aacfc8e45 Mon Sep 17 00:00:00 2001
From: Helge Deller <deller@gmx.de>
Date: Sat, 17 May 2025 13:20:17 +0200
Subject: [PATCH 0960/2760] linux-user/hppa: Send proper si_code on SIGFPE
 exception

Improve the linux-user emulation to send the correct si_code depending
on overflow (TARGET_FPE_FLTOVF), underflow (TARGET_FPE_FLTUND), ...
Note that the hardware stores the relevant flags in FP exception
register #1, which is actually the lower 32-bits of the 64-bit fr[0]
register in qemu.

Signed-off-by: Helge Deller <deller@gmx.de>
---
 linux-user/hppa/cpu_loop.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/linux-user/hppa/cpu_loop.c b/linux-user/hppa/cpu_loop.c
index 890e758cd1..9abaad5ef8 100644
--- a/linux-user/hppa/cpu_loop.c
+++ b/linux-user/hppa/cpu_loop.c
@@ -112,7 +112,7 @@ static abi_ulong hppa_lws(CPUHPPAState *env)
 void cpu_loop(CPUHPPAState *env)
 {
     CPUState *cs = env_cpu(env);
-    abi_ulong ret;
+    abi_ulong ret, si_code = 0;
     int trapnr;
 
     while (1) {
@@ -169,7 +169,15 @@ void cpu_loop(CPUHPPAState *env)
             force_sig_fault(TARGET_SIGFPE, TARGET_FPE_CONDTRAP, env->iaoq_f);
             break;
         case EXCP_ASSIST:
-            force_sig_fault(TARGET_SIGFPE, 0, env->iaoq_f);
+            #define set_si_code(mask, val) \
+                if (env->fr[0] & mask) { si_code = val; }
+            set_si_code(R_FPSR_FLG_I_MASK, TARGET_FPE_FLTRES);
+            set_si_code(R_FPSR_FLG_U_MASK, TARGET_FPE_FLTUND);
+            set_si_code(R_FPSR_FLG_O_MASK, TARGET_FPE_FLTOVF);
+            set_si_code(R_FPSR_FLG_Z_MASK, TARGET_FPE_FLTDIV);
+            set_si_code(R_FPSR_FLG_V_MASK, TARGET_FPE_FLTINV);
+            #undef set_si_code
+            force_sig_fault(TARGET_SIGFPE, si_code, env->iaoq_f);
             break;
         case EXCP_BREAK:
             force_sig_fault(TARGET_SIGTRAP, TARGET_TRAP_BRKPT, env->iaoq_f);

From ebd394948de4e868cb8fc5b265a8a18f0935dce1 Mon Sep 17 00:00:00 2001
From: Helge Deller <deller@gmx.de>
Date: Sat, 17 May 2025 13:27:48 +0200
Subject: [PATCH 0961/2760] target/hppa: Fix FPE exceptions

Implement FP exception register #1 (lower 32-bits of 64-bit fr[0]).
A proper implementation is necessary to allow the Linux kernel in
system mode and the qemu linux-user to send proper si_code values
on SIGFPE signal.

Always set the T-bit on taken exception, and merge over- and underflow
in system mode to just set overflow bit to mimic the behaviour I tested
on a physical machine.

The test program below can be used to verify correct behaviour. Note
that behaviour on SIGFPE may vary on different platforms. The program
should always detect the correct signal, but it may or may not be able
to sucessfully continue afterwards.

 #define _GNU_SOURCE
 #include <signal.h>
 #include <stdio.h>
 #include <fenv.h>
 #include <float.h>

 static void fpe_func(int sig, siginfo_t *i, void *v) {
    sigset_t set;
    sigemptyset(&set);
    sigaddset(&set, SIGFPE);
    sigprocmask(SIG_UNBLOCK, &set, NULL);
    printf("GOT signal %d with si_code %ld\n", sig, i->si_code);
 }

 int main(int argc, char *argv[]) {
    struct sigaction action = {
        .sa_sigaction = fpe_func,
        .sa_flags = SA_RESTART|SA_SIGINFO };
    sigaction(SIGFPE, &action, 0);
    feenableexcept(FE_OVERFLOW | FE_UNDERFLOW);
    double x = DBL_MIN;
    return printf("%lf\n", argc > 1
        ? 1.7976931348623158E308*1.7976931348623158E308
        : x / 10);
 }

Signed-off-by: Helge Deller <deller@gmx.de>
---
 target/hppa/fpu_helper.c | 20 +++++++++++++++++---
 1 file changed, 17 insertions(+), 3 deletions(-)

diff --git a/target/hppa/fpu_helper.c b/target/hppa/fpu_helper.c
index a62d9d3083..294ce0a970 100644
--- a/target/hppa/fpu_helper.c
+++ b/target/hppa/fpu_helper.c
@@ -95,7 +95,8 @@ static void update_fr0_op(CPUHPPAState *env, uintptr_t ra)
 {
     uint32_t soft_exp = get_float_exception_flags(&env->fp_status);
     uint32_t hard_exp = 0;
-    uint32_t shadow = env->fr0_shadow;
+    uint32_t shadow = env->fr0_shadow & 0x3ffffff;
+    uint32_t fr1 = 0;
 
     if (likely(soft_exp == 0)) {
         env->fr[0] = (uint64_t)shadow << 32;
@@ -108,9 +109,22 @@ static void update_fr0_op(CPUHPPAState *env, uintptr_t ra)
     hard_exp |= CONVERT_BIT(soft_exp, float_flag_overflow,  R_FPSR_ENA_O_MASK);
     hard_exp |= CONVERT_BIT(soft_exp, float_flag_divbyzero, R_FPSR_ENA_Z_MASK);
     hard_exp |= CONVERT_BIT(soft_exp, float_flag_invalid,   R_FPSR_ENA_V_MASK);
-    shadow |= hard_exp << (R_FPSR_FLAGS_SHIFT - R_FPSR_ENABLES_SHIFT);
+    if (hard_exp & shadow) {
+        shadow = FIELD_DP32(shadow, FPSR, T, 1);
+        /* fill exception register #1, which is lower 32-bits of fr[0] */
+#if !defined(CONFIG_USER_ONLY)
+        if (hard_exp & (R_FPSR_ENA_O_MASK | R_FPSR_ENA_U_MASK)) {
+            /* over- and underflow both set overflow flag only */
+            fr1 = FIELD_DP32(fr1, FPSR, C, 1);
+            fr1 = FIELD_DP32(fr1, FPSR, FLG_O, 1);
+        } else
+#endif
+        {
+            fr1 |= hard_exp << (R_FPSR_FLAGS_SHIFT - R_FPSR_ENABLES_SHIFT);
+        }
+    }
     env->fr0_shadow = shadow;
-    env->fr[0] = (uint64_t)shadow << 32;
+    env->fr[0] = (uint64_t)shadow << 32 | fr1;
 
     if (hard_exp & shadow) {
         hppa_dynamic_excp(env, EXCP_ASSIST, ra);

From d2a88aca766697e8490504313d23002c3315ee93 Mon Sep 17 00:00:00 2001
From: Sunil V L <sunilvl@ventanamicro.com>
Date: Sat, 22 Mar 2025 10:01:37 +0530
Subject: [PATCH 0962/2760] hw/riscv/virt: Add the BDF of IOMMU to
 RISCVVirtState structure

When the IOMMU is implemented as a PCI device, its BDF is created
locally in virt.c. However, the same BDF is also required in
virt-acpi-build.c to support ACPI. Therefore, make this information part
of the global RISCVVirtState structure so that it can be accessed
outside of virt.c as well.

Signed-off-by: Sunil V L <sunilvl@ventanamicro.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20250322043139.2003479-2-sunilvl@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c         | 1 +
 include/hw/riscv/virt.h | 1 +
 2 files changed, 2 insertions(+)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index be1bf0f646..5958ad1f7d 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -1117,6 +1117,7 @@ static void create_fdt_iommu(RISCVVirtState *s, uint16_t bdf)
     qemu_fdt_setprop_cells(fdt, pci_node, "iommu-map",
                            0, iommu_phandle, 0, bdf,
                            bdf + 1, iommu_phandle, bdf + 1, 0xffff - bdf);
+    s->pci_iommu_bdf = bdf;
 }
 
 static void finalize_fdt(RISCVVirtState *s)
diff --git a/include/hw/riscv/virt.h b/include/hw/riscv/virt.h
index 48a14bea2e..7b4c2c8b7d 100644
--- a/include/hw/riscv/virt.h
+++ b/include/hw/riscv/virt.h
@@ -63,6 +63,7 @@ struct RISCVVirtState {
     const MemMapEntry *memmap;
     struct GPEXHost *gpex_host;
     OnOffAuto iommu_sys;
+    uint16_t pci_iommu_bdf;
 };
 
 enum {

From cd18dbbf9d23f309f3e46c38b99213dbe3d48d17 Mon Sep 17 00:00:00 2001
From: Sunil V L <sunilvl@ventanamicro.com>
Date: Sat, 22 Mar 2025 10:01:38 +0530
Subject: [PATCH 0963/2760] hw/riscv/virt-acpi-build: Add support for RIMT

RISC-V IO Mapping Table (RIMT) is a new static ACPI table used to
communicate IOMMU information to the OS. Add support for creating this
table when the IOMMU is present. The specification is frozen and
available at [1].

[1] - https://github.com/riscv-non-isa/riscv-acpi-rimt/releases/download/v0.99/rimt-spec.pdf

Signed-off-by: Sunil V L <sunilvl@ventanamicro.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20250322043139.2003479-3-sunilvl@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt-acpi-build.c | 215 +++++++++++++++++++++++++++++++++++++
 1 file changed, 215 insertions(+)

diff --git a/hw/riscv/virt-acpi-build.c b/hw/riscv/virt-acpi-build.c
index 1ad6800508..1eef2fb4eb 100644
--- a/hw/riscv/virt-acpi-build.c
+++ b/hw/riscv/virt-acpi-build.c
@@ -198,6 +198,32 @@ acpi_dsdt_add_uart(Aml *scope, const MemMapEntry *uart_memmap,
     aml_append(scope, dev);
 }
 
+/*
+ * Add DSDT entry for the IOMMU platform device.
+ * ACPI ID for IOMMU is defined in the section 6.2 of RISC-V BRS spec.
+ * https://github.com/riscv-non-isa/riscv-brs/releases/download/v0.8/riscv-brs-spec.pdf
+ */
+static void acpi_dsdt_add_iommu_sys(Aml *scope, const MemMapEntry *iommu_memmap,
+                                    uint32_t iommu_irq)
+{
+    uint32_t i;
+
+    Aml *dev = aml_device("IMU0");
+    aml_append(dev, aml_name_decl("_HID", aml_string("RSCV0004")));
+    aml_append(dev, aml_name_decl("_UID", aml_int(0)));
+
+    Aml *crs = aml_resource_template();
+    aml_append(crs, aml_memory32_fixed(iommu_memmap->base,
+                                       iommu_memmap->size, AML_READ_WRITE));
+    for (i = iommu_irq; i < iommu_irq + 4; i++) {
+        aml_append(crs, aml_interrupt(AML_CONSUMER, AML_EDGE, AML_ACTIVE_LOW,
+                                      AML_EXCLUSIVE, &i, 1));
+    }
+
+    aml_append(dev, aml_name_decl("_CRS", crs));
+    aml_append(scope, dev);
+}
+
 /*
  * Serial Port Console Redirection Table (SPCR)
  * Rev: 1.10
@@ -450,6 +476,9 @@ static void build_dsdt(GArray *table_data,
     }
 
     acpi_dsdt_add_uart(scope, &memmap[VIRT_UART0], UART0_IRQ);
+    if (virt_is_iommu_sys_enabled(s)) {
+        acpi_dsdt_add_iommu_sys(scope, &memmap[VIRT_IOMMU_SYS], IOMMU_SYS_IRQ);
+    }
 
     if (socket_count == 1) {
         virtio_acpi_dsdt_add(scope, memmap[VIRT_VIRTIO].base,
@@ -602,6 +631,187 @@ static void build_madt(GArray *table_data,
     acpi_table_end(linker, &table);
 }
 
+#define ID_MAPPING_ENTRY_SIZE        20
+#define IOMMU_ENTRY_SIZE             40
+#define RISCV_INTERRUPT_WIRE_OFFSSET 40
+#define ROOT_COMPLEX_ENTRY_SIZE      20
+#define RIMT_NODE_OFFSET             48
+
+/*
+ * ID Mapping Structure
+ */
+static void build_rimt_id_mapping(GArray *table_data, uint32_t source_id_base,
+                                  uint32_t num_ids, uint32_t dest_id_base)
+{
+    /* Source ID Base */
+    build_append_int_noprefix(table_data, source_id_base, 4);
+    /* Number of IDs */
+    build_append_int_noprefix(table_data, num_ids, 4);
+    /* Destination Device ID Base */
+    build_append_int_noprefix(table_data, source_id_base, 4);
+    /* Destination IOMMU Offset */
+    build_append_int_noprefix(table_data, dest_id_base, 4);
+    /* Flags */
+    build_append_int_noprefix(table_data, 0, 4);
+}
+
+struct AcpiRimtIdMapping {
+    uint32_t source_id_base;
+    uint32_t num_ids;
+};
+typedef struct AcpiRimtIdMapping AcpiRimtIdMapping;
+
+/* Build the rimt ID mapping to IOMMU for a given PCI host bridge */
+static int rimt_host_bridges(Object *obj, void *opaque)
+{
+    GArray *idmap_blob = opaque;
+
+    if (object_dynamic_cast(obj, TYPE_PCI_HOST_BRIDGE)) {
+        PCIBus *bus = PCI_HOST_BRIDGE(obj)->bus;
+
+        if (bus && !pci_bus_bypass_iommu(bus)) {
+            int min_bus, max_bus;
+
+            pci_bus_range(bus, &min_bus, &max_bus);
+
+            AcpiRimtIdMapping idmap = {
+                .source_id_base = min_bus << 8,
+                .num_ids = (max_bus - min_bus + 1) << 8,
+            };
+            g_array_append_val(idmap_blob, idmap);
+        }
+    }
+
+    return 0;
+}
+
+static int rimt_idmap_compare(gconstpointer a, gconstpointer b)
+{
+    AcpiRimtIdMapping *idmap_a = (AcpiRimtIdMapping *)a;
+    AcpiRimtIdMapping *idmap_b = (AcpiRimtIdMapping *)b;
+
+    return idmap_a->source_id_base - idmap_b->source_id_base;
+}
+
+/*
+ * RISC-V IO Mapping Table (RIMT)
+ * https://github.com/riscv-non-isa/riscv-acpi-rimt/releases/download/v0.99/rimt-spec.pdf
+ */
+static void build_rimt(GArray *table_data, BIOSLinker *linker,
+                       RISCVVirtState *s)
+{
+    int i, nb_nodes, rc_mapping_count;
+    size_t node_size, iommu_offset = 0;
+    uint32_t id = 0;
+    g_autoptr(GArray) iommu_idmaps = g_array_new(false, true,
+                                                 sizeof(AcpiRimtIdMapping));
+
+    AcpiTable table = { .sig = "RIMT", .rev = 1, .oem_id = s->oem_id,
+                        .oem_table_id = s->oem_table_id };
+
+    acpi_table_begin(&table, table_data);
+
+    object_child_foreach_recursive(object_get_root(),
+                                   rimt_host_bridges, iommu_idmaps);
+
+    /* Sort the ID mapping  by Source ID Base*/
+    g_array_sort(iommu_idmaps, rimt_idmap_compare);
+
+    nb_nodes = 2; /* RC, IOMMU */
+    rc_mapping_count = iommu_idmaps->len;
+    /* Number of RIMT Nodes */
+    build_append_int_noprefix(table_data, nb_nodes, 4);
+
+    /* Offset to Array of RIMT Nodes */
+    build_append_int_noprefix(table_data, RIMT_NODE_OFFSET, 4);
+    build_append_int_noprefix(table_data, 0, 4); /* Reserved */
+
+    iommu_offset = table_data->len - table.table_offset;
+    /*  IOMMU Device Structure */
+    build_append_int_noprefix(table_data, 0, 1);         /* Type - IOMMU*/
+    build_append_int_noprefix(table_data, 1, 1);         /* Revision */
+    node_size =  IOMMU_ENTRY_SIZE;
+    build_append_int_noprefix(table_data, node_size, 2); /* Length */
+    build_append_int_noprefix(table_data, 0, 2);         /* Reserved */
+    build_append_int_noprefix(table_data, id++, 2);      /* ID */
+    if (virt_is_iommu_sys_enabled(s)) {
+        /* Hardware ID */
+        build_append_int_noprefix(table_data, 'R', 1);
+        build_append_int_noprefix(table_data, 'S', 1);
+        build_append_int_noprefix(table_data, 'C', 1);
+        build_append_int_noprefix(table_data, 'V', 1);
+        build_append_int_noprefix(table_data, '0', 1);
+        build_append_int_noprefix(table_data, '0', 1);
+        build_append_int_noprefix(table_data, '0', 1);
+        build_append_int_noprefix(table_data, '4', 1);
+        /* Base Address */
+        build_append_int_noprefix(table_data,
+                                  s->memmap[VIRT_IOMMU_SYS].base, 8);
+        build_append_int_noprefix(table_data, 0, 4);   /* Flags */
+    } else {
+        /* Hardware ID */
+        build_append_int_noprefix(table_data, '0', 1);
+        build_append_int_noprefix(table_data, '0', 1);
+        build_append_int_noprefix(table_data, '1', 1);
+        build_append_int_noprefix(table_data, '0', 1);
+        build_append_int_noprefix(table_data, '0', 1);
+        build_append_int_noprefix(table_data, '0', 1);
+        build_append_int_noprefix(table_data, '1', 1);
+        build_append_int_noprefix(table_data, '4', 1);
+
+        build_append_int_noprefix(table_data, 0, 8);   /* Base Address */
+        build_append_int_noprefix(table_data, 1, 4);   /* Flags */
+    }
+
+    build_append_int_noprefix(table_data, 0, 4);       /* Proximity Domain */
+    build_append_int_noprefix(table_data, 0, 2);       /* PCI Segment number */
+    /* PCIe B/D/F */
+    if (virt_is_iommu_sys_enabled(s)) {
+        build_append_int_noprefix(table_data, 0, 2);
+    } else {
+        build_append_int_noprefix(table_data, s->pci_iommu_bdf, 2);
+    }
+    /* Number of interrupt wires */
+    build_append_int_noprefix(table_data, 0, 2);
+    /* Interrupt wire array offset */
+    build_append_int_noprefix(table_data, RISCV_INTERRUPT_WIRE_OFFSSET, 2);
+
+    /*  PCIe Root Complex Node */
+    build_append_int_noprefix(table_data, 1, 1);           /* Type */
+    build_append_int_noprefix(table_data, 1, 1);           /* Revision */
+    node_size =  ROOT_COMPLEX_ENTRY_SIZE +
+                 ID_MAPPING_ENTRY_SIZE * rc_mapping_count;
+    build_append_int_noprefix(table_data, node_size, 2);   /* Length */
+    build_append_int_noprefix(table_data, 0, 2);           /* Reserved */
+    build_append_int_noprefix(table_data, id++, 2);        /* ID */
+    build_append_int_noprefix(table_data, 0, 4);           /* Flags */
+    build_append_int_noprefix(table_data, 0, 2);           /* Reserved */
+    /* PCI Segment number */
+    build_append_int_noprefix(table_data, 0, 2);
+    /* ID mapping array offset */
+    build_append_int_noprefix(table_data, ROOT_COMPLEX_ENTRY_SIZE, 2);
+    /* Number of ID mappings */
+    build_append_int_noprefix(table_data, rc_mapping_count, 2);
+
+    /* Output Reference */
+    AcpiRimtIdMapping *range;
+
+    /* ID mapping array */
+    for (i = 0; i < iommu_idmaps->len; i++) {
+        range = &g_array_index(iommu_idmaps, AcpiRimtIdMapping, i);
+        if (virt_is_iommu_sys_enabled(s)) {
+            range->source_id_base = 0;
+        } else {
+            range->source_id_base = s->pci_iommu_bdf + 1;
+        }
+        range->num_ids = 0xffff - s->pci_iommu_bdf;
+        build_rimt_id_mapping(table_data, range->source_id_base,
+                              range->num_ids, iommu_offset);
+    }
+
+    acpi_table_end(linker, &table);
+}
+
 /*
  * ACPI spec, Revision 6.5+
  * 5.2.16 System Resource Affinity Table (SRAT)
@@ -679,6 +889,11 @@ static void virt_acpi_build(RISCVVirtState *s, AcpiBuildTables *tables)
     acpi_add_table(table_offsets, tables_blob);
     build_rhct(tables_blob, tables->linker, s);
 
+    if (virt_is_iommu_sys_enabled(s) || s->pci_iommu_bdf) {
+        acpi_add_table(table_offsets, tables_blob);
+        build_rimt(tables_blob, tables->linker, s);
+    }
+
     acpi_add_table(table_offsets, tables_blob);
     spcr_setup(tables_blob, tables->linker, s);
 

From 4541d205f03cf1529439f68d2ec5056685189399 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lo=C3=AFc=20Lefort?= <loic@rivosinc.com>
Date: Thu, 13 Mar 2025 20:30:07 +0100
Subject: [PATCH 0964/2760] target/riscv: pmp: don't allow RLB to bypass rule
 privileges
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When Smepmp is supported, mseccfg.RLB allows bypassing locks when writing CSRs
but should not affect interpretation of actual PMP rules.

This is not the case with the current implementation where pmp_hart_has_privs
calls pmp_is_locked which implements mseccfg.RLB bypass.

This commit implements the correct behavior by removing mseccfg.RLB bypass from
pmp_is_locked.

RLB bypass when writing CSRs is implemented by adding a new pmp_is_readonly
function that calls pmp_is_locked and check mseccfg.RLB. pmp_write_cfg and
pmpaddr_csr_write are changed to use this new function.

Signed-off-by: Loïc Lefort <loic@rivosinc.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: LIU Zhiwei  <zhiwei_liu@linux.alibaba.com>
Message-ID: <20250313193011.720075-2-loic@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Cc: qemu-stable@nongnu.org
---
 target/riscv/pmp.c | 43 +++++++++++++++++++++++--------------------
 1 file changed, 23 insertions(+), 20 deletions(-)

diff --git a/target/riscv/pmp.c b/target/riscv/pmp.c
index c13a117e3f..d8e2949aaf 100644
--- a/target/riscv/pmp.c
+++ b/target/riscv/pmp.c
@@ -46,11 +46,6 @@ static inline uint8_t pmp_get_a_field(uint8_t cfg)
  */
 static inline int pmp_is_locked(CPURISCVState *env, uint32_t pmp_index)
 {
-    /* mseccfg.RLB is set */
-    if (MSECCFG_RLB_ISSET(env)) {
-        return 0;
-    }
-
     if (env->pmp_state.pmp[pmp_index].cfg_reg & PMP_LOCK) {
         return 1;
     }
@@ -63,6 +58,15 @@ static inline int pmp_is_locked(CPURISCVState *env, uint32_t pmp_index)
     return 0;
 }
 
+/*
+ * Check whether a PMP is locked for writing or not.
+ * (i.e. has LOCK flag and mseccfg.RLB is unset)
+ */
+static int pmp_is_readonly(CPURISCVState *env, uint32_t pmp_index)
+{
+    return pmp_is_locked(env, pmp_index) && !MSECCFG_RLB_ISSET(env);
+}
+
 /*
  * Count the number of active rules.
  */
@@ -91,39 +95,38 @@ static inline uint8_t pmp_read_cfg(CPURISCVState *env, uint32_t pmp_index)
 static bool pmp_write_cfg(CPURISCVState *env, uint32_t pmp_index, uint8_t val)
 {
     if (pmp_index < MAX_RISCV_PMPS) {
-        bool locked = true;
+        bool readonly = true;
 
         if (riscv_cpu_cfg(env)->ext_smepmp) {
             /* mseccfg.RLB is set */
             if (MSECCFG_RLB_ISSET(env)) {
-                locked = false;
+                readonly = false;
             }
 
             /* mseccfg.MML is not set */
-            if (!MSECCFG_MML_ISSET(env) && !pmp_is_locked(env, pmp_index)) {
-                locked = false;
+            if (!MSECCFG_MML_ISSET(env) && !pmp_is_readonly(env, pmp_index)) {
+                readonly = false;
             }
 
             /* mseccfg.MML is set */
             if (MSECCFG_MML_ISSET(env)) {
                 /* not adding execute bit */
                 if ((val & PMP_LOCK) != 0 && (val & PMP_EXEC) != PMP_EXEC) {
-                    locked = false;
+                    readonly = false;
                 }
                 /* shared region and not adding X bit */
                 if ((val & PMP_LOCK) != PMP_LOCK &&
                     (val & 0x7) != (PMP_WRITE | PMP_EXEC)) {
-                    locked = false;
+                    readonly = false;
                 }
             }
         } else {
-            if (!pmp_is_locked(env, pmp_index)) {
-                locked = false;
-            }
+            readonly = pmp_is_readonly(env, pmp_index);
         }
 
-        if (locked) {
-            qemu_log_mask(LOG_GUEST_ERROR, "ignoring pmpcfg write - locked\n");
+        if (readonly) {
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "ignoring pmpcfg write - read only\n");
         } else if (env->pmp_state.pmp[pmp_index].cfg_reg != val) {
             /* If !mseccfg.MML then ignore writes with encoding RW=01 */
             if ((val & PMP_WRITE) && !(val & PMP_READ) &&
@@ -525,14 +528,14 @@ void pmpaddr_csr_write(CPURISCVState *env, uint32_t addr_index,
             uint8_t pmp_cfg = env->pmp_state.pmp[addr_index + 1].cfg_reg;
             is_next_cfg_tor = PMP_AMATCH_TOR == pmp_get_a_field(pmp_cfg);
 
-            if (pmp_is_locked(env, addr_index + 1) && is_next_cfg_tor) {
+            if (pmp_is_readonly(env, addr_index + 1) && is_next_cfg_tor) {
                 qemu_log_mask(LOG_GUEST_ERROR,
-                              "ignoring pmpaddr write - pmpcfg + 1 locked\n");
+                              "ignoring pmpaddr write - pmpcfg+1 read only\n");
                 return;
             }
         }
 
-        if (!pmp_is_locked(env, addr_index)) {
+        if (!pmp_is_readonly(env, addr_index)) {
             if (env->pmp_state.pmp[addr_index].addr_reg != val) {
                 env->pmp_state.pmp[addr_index].addr_reg = val;
                 pmp_update_rule_addr(env, addr_index);
@@ -543,7 +546,7 @@ void pmpaddr_csr_write(CPURISCVState *env, uint32_t addr_index,
             }
         } else {
             qemu_log_mask(LOG_GUEST_ERROR,
-                          "ignoring pmpaddr write - locked\n");
+                          "ignoring pmpaddr write - read only\n");
         }
     } else {
         qemu_log_mask(LOG_GUEST_ERROR,

From 915b203745540e908943758f78f5da49e0a15e45 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lo=C3=AFc=20Lefort?= <loic@rivosinc.com>
Date: Thu, 13 Mar 2025 20:30:08 +0100
Subject: [PATCH 0965/2760] target/riscv: pmp: move Smepmp operation conversion
 into a function
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Loïc Lefort <loic@rivosinc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Message-ID: <20250313193011.720075-3-loic@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Cc: qemu-stable@nongnu.org
---
 target/riscv/pmp.c | 22 ++++++++++++----------
 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git a/target/riscv/pmp.c b/target/riscv/pmp.c
index d8e2949aaf..3afa16917e 100644
--- a/target/riscv/pmp.c
+++ b/target/riscv/pmp.c
@@ -32,6 +32,15 @@ static bool pmp_write_cfg(CPURISCVState *env, uint32_t addr_index,
                           uint8_t val);
 static uint8_t pmp_read_cfg(CPURISCVState *env, uint32_t addr_index);
 
+/*
+ * Convert the PMP permissions to match the truth table in the Smepmp spec.
+ */
+static inline uint8_t pmp_get_smepmp_operation(uint8_t cfg)
+{
+    return ((cfg & PMP_LOCK) >> 4) | ((cfg & PMP_READ) << 2) |
+           (cfg & PMP_WRITE) | ((cfg & PMP_EXEC) >> 2);
+}
+
 /*
  * Accessor method to extract address matching type 'a field' from cfg reg
  */
@@ -356,16 +365,6 @@ bool pmp_hart_has_privs(CPURISCVState *env, hwaddr addr,
         const uint8_t a_field =
             pmp_get_a_field(env->pmp_state.pmp[i].cfg_reg);
 
-        /*
-         * Convert the PMP permissions to match the truth table in the
-         * Smepmp spec.
-         */
-        const uint8_t smepmp_operation =
-            ((env->pmp_state.pmp[i].cfg_reg & PMP_LOCK) >> 4) |
-            ((env->pmp_state.pmp[i].cfg_reg & PMP_READ) << 2) |
-            (env->pmp_state.pmp[i].cfg_reg & PMP_WRITE) |
-            ((env->pmp_state.pmp[i].cfg_reg & PMP_EXEC) >> 2);
-
         if (((s + e) == 2) && (PMP_AMATCH_OFF != a_field)) {
             /*
              * If the PMP entry is not off and the address is in range,
@@ -384,6 +383,9 @@ bool pmp_hart_has_privs(CPURISCVState *env, hwaddr addr,
                 /*
                  * If mseccfg.MML Bit set, do the enhanced pmp priv check
                  */
+                const uint8_t smepmp_operation =
+                    pmp_get_smepmp_operation(env->pmp_state.pmp[i].cfg_reg);
+
                 if (mode == PRV_M) {
                     switch (smepmp_operation) {
                     case 0:

From 19cf1a7d9e59b71bf8d6571d4747e5c82667c3d1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lo=C3=AFc=20Lefort?= <loic@rivosinc.com>
Date: Thu, 13 Mar 2025 20:30:09 +0100
Subject: [PATCH 0966/2760] target/riscv: pmp: fix checks on writes to pmpcfg
 in Smepmp MML mode
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

With Machine Mode Lockdown (mseccfg.MML) set and RLB not set, checks on pmpcfg
writes would match the wrong cases of Smepmp truth table.

The existing code allows writes for the following cases:
- L=1, X=0: cases 8, 10, 12, 14
- L=0, RWX!=WX: cases 0-2, 4-6
This leaves cases 3, 7, 9, 11, 13, 15 for which writes are ignored.

From the Smepmp specification: "Adding a rule with executable privileges that
either is M-mode-only or a locked Shared-Region is not possible (...)" This
description matches cases 9-11, 13 of the truth table.

This commit implements an explicit check for these cases by using
pmp_get_epmp_operation to convert between PMP configuration and Smepmp truth
table cases.

Signed-off-by: Loïc Lefort <loic@rivosinc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Message-ID: <20250313193011.720075-4-loic@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Cc: qemu-stable@nongnu.org
---
 target/riscv/pmp.c | 79 +++++++++++++++++++++++++---------------------
 1 file changed, 43 insertions(+), 36 deletions(-)

diff --git a/target/riscv/pmp.c b/target/riscv/pmp.c
index 3afa16917e..8fc313990a 100644
--- a/target/riscv/pmp.c
+++ b/target/riscv/pmp.c
@@ -76,6 +76,44 @@ static int pmp_is_readonly(CPURISCVState *env, uint32_t pmp_index)
     return pmp_is_locked(env, pmp_index) && !MSECCFG_RLB_ISSET(env);
 }
 
+/*
+ * Check whether `val` is an invalid Smepmp config value
+ */
+static int pmp_is_invalid_smepmp_cfg(CPURISCVState *env, uint8_t val)
+{
+    /* No check if mseccfg.MML is not set or if mseccfg.RLB is set */
+    if (!MSECCFG_MML_ISSET(env) || MSECCFG_RLB_ISSET(env)) {
+        return 0;
+    }
+
+    /*
+     * Adding a rule with executable privileges that either is M-mode-only
+     * or a locked Shared-Region is not possible
+     */
+    switch (pmp_get_smepmp_operation(val)) {
+    case 0:
+    case 1:
+    case 2:
+    case 3:
+    case 4:
+    case 5:
+    case 6:
+    case 7:
+    case 8:
+    case 12:
+    case 14:
+    case 15:
+        return 0;
+    case 9:
+    case 10:
+    case 11:
+    case 13:
+        return 1;
+    default:
+        g_assert_not_reached();
+    }
+}
+
 /*
  * Count the number of active rules.
  */
@@ -104,44 +142,13 @@ static inline uint8_t pmp_read_cfg(CPURISCVState *env, uint32_t pmp_index)
 static bool pmp_write_cfg(CPURISCVState *env, uint32_t pmp_index, uint8_t val)
 {
     if (pmp_index < MAX_RISCV_PMPS) {
-        bool readonly = true;
-
-        if (riscv_cpu_cfg(env)->ext_smepmp) {
-            /* mseccfg.RLB is set */
-            if (MSECCFG_RLB_ISSET(env)) {
-                readonly = false;
-            }
-
-            /* mseccfg.MML is not set */
-            if (!MSECCFG_MML_ISSET(env) && !pmp_is_readonly(env, pmp_index)) {
-                readonly = false;
-            }
-
-            /* mseccfg.MML is set */
-            if (MSECCFG_MML_ISSET(env)) {
-                /* not adding execute bit */
-                if ((val & PMP_LOCK) != 0 && (val & PMP_EXEC) != PMP_EXEC) {
-                    readonly = false;
-                }
-                /* shared region and not adding X bit */
-                if ((val & PMP_LOCK) != PMP_LOCK &&
-                    (val & 0x7) != (PMP_WRITE | PMP_EXEC)) {
-                    readonly = false;
-                }
-            }
-        } else {
-            readonly = pmp_is_readonly(env, pmp_index);
-        }
-
-        if (readonly) {
+        if (pmp_is_readonly(env, pmp_index)) {
             qemu_log_mask(LOG_GUEST_ERROR,
                           "ignoring pmpcfg write - read only\n");
-        } else if (env->pmp_state.pmp[pmp_index].cfg_reg != val) {
-            /* If !mseccfg.MML then ignore writes with encoding RW=01 */
-            if ((val & PMP_WRITE) && !(val & PMP_READ) &&
-                !MSECCFG_MML_ISSET(env)) {
-                return false;
-            }
+        } else if (pmp_is_invalid_smepmp_cfg(env, val)) {
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "ignoring pmpcfg write - invalid\n");
+        } else {
             env->pmp_state.pmp[pmp_index].cfg_reg = val;
             pmp_update_rule_addr(env, pmp_index);
             return true;

From 0c60c531f53544117f96d508fd9918f78ecf0df5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lo=C3=AFc=20Lefort?= <loic@rivosinc.com>
Date: Thu, 13 Mar 2025 20:30:10 +0100
Subject: [PATCH 0967/2760] target/riscv: pmp: exit csr writes early if value
 was not changed
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Loïc Lefort <loic@rivosinc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Message-ID: <20250313193011.720075-5-loic@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/pmp.c | 22 +++++++++++++++-------
 1 file changed, 15 insertions(+), 7 deletions(-)

diff --git a/target/riscv/pmp.c b/target/riscv/pmp.c
index 8fc313990a..4070e21ea3 100644
--- a/target/riscv/pmp.c
+++ b/target/riscv/pmp.c
@@ -142,6 +142,11 @@ static inline uint8_t pmp_read_cfg(CPURISCVState *env, uint32_t pmp_index)
 static bool pmp_write_cfg(CPURISCVState *env, uint32_t pmp_index, uint8_t val)
 {
     if (pmp_index < MAX_RISCV_PMPS) {
+        if (env->pmp_state.pmp[pmp_index].cfg_reg == val) {
+            /* no change */
+            return false;
+        }
+
         if (pmp_is_readonly(env, pmp_index)) {
             qemu_log_mask(LOG_GUEST_ERROR,
                           "ignoring pmpcfg write - read only\n");
@@ -529,6 +534,11 @@ void pmpaddr_csr_write(CPURISCVState *env, uint32_t addr_index,
     bool is_next_cfg_tor = false;
 
     if (addr_index < MAX_RISCV_PMPS) {
+        if (env->pmp_state.pmp[addr_index].addr_reg == val) {
+            /* no change */
+            return;
+        }
+
         /*
          * In TOR mode, need to check the lock bit of the next pmp
          * (if there is a next).
@@ -545,14 +555,12 @@ void pmpaddr_csr_write(CPURISCVState *env, uint32_t addr_index,
         }
 
         if (!pmp_is_readonly(env, addr_index)) {
-            if (env->pmp_state.pmp[addr_index].addr_reg != val) {
-                env->pmp_state.pmp[addr_index].addr_reg = val;
-                pmp_update_rule_addr(env, addr_index);
-                if (is_next_cfg_tor) {
-                    pmp_update_rule_addr(env, addr_index + 1);
-                }
-                tlb_flush(env_cpu(env));
+            env->pmp_state.pmp[addr_index].addr_reg = val;
+            pmp_update_rule_addr(env, addr_index);
+            if (is_next_cfg_tor) {
+                pmp_update_rule_addr(env, addr_index + 1);
             }
+            tlb_flush(env_cpu(env));
         } else {
             qemu_log_mask(LOG_GUEST_ERROR,
                           "ignoring pmpaddr write - read only\n");

From 986222f0f994671190a94836a373fd64992cd271 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lo=C3=AFc=20Lefort?= <loic@rivosinc.com>
Date: Thu, 13 Mar 2025 20:30:11 +0100
Subject: [PATCH 0968/2760] target/riscv: pmp: remove redundant check in
 pmp_is_locked
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Remove useless check in pmp_is_locked, the function will return 0 in either
case.

Signed-off-by: Loïc Lefort <loic@rivosinc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Message-ID: <20250313193011.720075-6-loic@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/pmp.c | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/target/riscv/pmp.c b/target/riscv/pmp.c
index 4070e21ea3..5af295e410 100644
--- a/target/riscv/pmp.c
+++ b/target/riscv/pmp.c
@@ -59,11 +59,6 @@ static inline int pmp_is_locked(CPURISCVState *env, uint32_t pmp_index)
         return 1;
     }
 
-    /* Top PMP has no 'next' to check */
-    if ((pmp_index + 1u) >= MAX_RISCV_PMPS) {
-        return 0;
-    }
-
     return 0;
 }
 

From 28c12c1f2f50d7f7f1ebfc587c4777ecd50aac5b Mon Sep 17 00:00:00 2001
From: Paolo Savini <paolo.savini@embecosm.com>
Date: Wed, 12 Mar 2025 15:55:47 +0000
Subject: [PATCH 0969/2760] Generate strided vector loads/stores with tcg
 nodes.

This commit improves the performance of QEMU when emulating strided vector
loads and stores by substituting the call for the helper function with the
generation of equivalent TCG operations.

Signed-off-by: Paolo Savini <paolo.savini@embecosm.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20250312155547.289642-2-paolo.savini@embecosm.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvv.c.inc | 327 ++++++++++++++++++++----
 1 file changed, 275 insertions(+), 52 deletions(-)

diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
index b9883a5d32..7079f758ad 100644
--- a/target/riscv/insn_trans/trans_rvv.c.inc
+++ b/target/riscv/insn_trans/trans_rvv.c.inc
@@ -802,32 +802,286 @@ GEN_VEXT_TRANS(vlm_v, MO_8, vlm_v, ld_us_mask_op, ld_us_mask_check)
 GEN_VEXT_TRANS(vsm_v, MO_8, vsm_v, st_us_mask_op, st_us_mask_check)
 
 /*
- *** stride load and store
+ * MAXSZ returns the maximum vector size can be operated in bytes,
+ * which is used in GVEC IR when vl_eq_vlmax flag is set to true
+ * to accelerate vector operation.
  */
-typedef void gen_helper_ldst_stride(TCGv_ptr, TCGv_ptr, TCGv,
-                                    TCGv, TCGv_env, TCGv_i32);
-
-static bool ldst_stride_trans(uint32_t vd, uint32_t rs1, uint32_t rs2,
-                              uint32_t data, gen_helper_ldst_stride *fn,
-                              DisasContext *s)
+static inline uint32_t MAXSZ(DisasContext *s)
 {
-    TCGv_ptr dest, mask;
-    TCGv base, stride;
-    TCGv_i32 desc;
+    int max_sz = s->cfg_ptr->vlenb << 3;
+    return max_sz >> (3 - s->lmul);
+}
 
-    dest = tcg_temp_new_ptr();
-    mask = tcg_temp_new_ptr();
-    base = get_gpr(s, rs1, EXT_NONE);
-    stride = get_gpr(s, rs2, EXT_NONE);
-    desc = tcg_constant_i32(simd_desc(s->cfg_ptr->vlenb,
-                                      s->cfg_ptr->vlenb, data));
+static inline uint32_t get_log2(uint32_t a)
+{
+    uint32_t i = 0;
+    for (; a > 0;) {
+        a >>= 1;
+        i++;
+    }
+    return i;
+}
 
-    tcg_gen_addi_ptr(dest, tcg_env, vreg_ofs(s, vd));
-    tcg_gen_addi_ptr(mask, tcg_env, vreg_ofs(s, 0));
+typedef void gen_tl_ldst(TCGv, TCGv_ptr, tcg_target_long);
+
+/*
+ * Simulate the strided load/store main loop:
+ *
+ * for (i = env->vstart; i < env->vl; env->vstart = ++i) {
+ *     k = 0;
+ *     while (k < nf) {
+ *         if (!vm && !vext_elem_mask(v0, i)) {
+ *             vext_set_elems_1s(vd, vma, (i + k * max_elems) * esz,
+ *                               (i + k * max_elems + 1) * esz);
+ *             k++;
+ *             continue;
+ *         }
+ *         target_ulong addr = base + stride * i + (k << log2_esz);
+ *         ldst(env, adjust_addr(env, addr), i + k * max_elems, vd, ra);
+ *         k++;
+ *     }
+ * }
+ */
+static void gen_ldst_stride_main_loop(DisasContext *s, TCGv dest, uint32_t rs1,
+                                      uint32_t rs2, uint32_t vm, uint32_t nf,
+                                      gen_tl_ldst *ld_fn, gen_tl_ldst *st_fn,
+                                      bool is_load)
+{
+    TCGv addr = tcg_temp_new();
+    TCGv base = get_gpr(s, rs1, EXT_NONE);
+    TCGv stride = get_gpr(s, rs2, EXT_NONE);
+
+    TCGv i = tcg_temp_new();
+    TCGv i_esz = tcg_temp_new();
+    TCGv k = tcg_temp_new();
+    TCGv k_esz = tcg_temp_new();
+    TCGv k_max = tcg_temp_new();
+    TCGv mask = tcg_temp_new();
+    TCGv mask_offs = tcg_temp_new();
+    TCGv mask_offs_64 = tcg_temp_new();
+    TCGv mask_elem = tcg_temp_new();
+    TCGv mask_offs_rem = tcg_temp_new();
+    TCGv vreg = tcg_temp_new();
+    TCGv dest_offs = tcg_temp_new();
+    TCGv stride_offs = tcg_temp_new();
+
+    uint32_t max_elems = MAXSZ(s) >> s->sew;
+
+    TCGLabel *start = gen_new_label();
+    TCGLabel *end = gen_new_label();
+    TCGLabel *start_k = gen_new_label();
+    TCGLabel *inc_k = gen_new_label();
+    TCGLabel *end_k = gen_new_label();
+
+    MemOp atomicity = MO_ATOM_NONE;
+    if (s->sew == 0) {
+        atomicity = MO_ATOM_NONE;
+    } else {
+        atomicity = MO_ATOM_IFALIGN_PAIR;
+    }
 
     mark_vs_dirty(s);
 
-    fn(dest, mask, base, stride, tcg_env, desc);
+    tcg_gen_addi_tl(mask, (TCGv)tcg_env, vreg_ofs(s, 0));
+
+    /* Start of outer loop. */
+    tcg_gen_mov_tl(i, cpu_vstart);
+    gen_set_label(start);
+    tcg_gen_brcond_tl(TCG_COND_GE, i, cpu_vl, end);
+    tcg_gen_shli_tl(i_esz, i, s->sew);
+    /* Start of inner loop. */
+    tcg_gen_movi_tl(k, 0);
+    gen_set_label(start_k);
+    tcg_gen_brcond_tl(TCG_COND_GE, k, tcg_constant_tl(nf), end_k);
+    /*
+     * If we are in mask agnostic regime and the operation is not unmasked we
+     * set the inactive elements to 1.
+     */
+    if (!vm && s->vma) {
+        TCGLabel *active_element = gen_new_label();
+        /* (i + k * max_elems) * esz */
+        tcg_gen_shli_tl(mask_offs, k, get_log2(max_elems << s->sew));
+        tcg_gen_add_tl(mask_offs, mask_offs, i_esz);
+
+        /*
+         * Check whether the i bit of the mask is 0 or 1.
+         *
+         * static inline int vext_elem_mask(void *v0, int index)
+         * {
+         *     int idx = index / 64;
+         *     int pos = index  % 64;
+         *     return (((uint64_t *)v0)[idx] >> pos) & 1;
+         * }
+         */
+        tcg_gen_shri_tl(mask_offs_64, mask_offs, 3);
+        tcg_gen_add_tl(mask_offs_64, mask_offs_64, mask);
+        tcg_gen_ld_i64((TCGv_i64)mask_elem, (TCGv_ptr)mask_offs_64, 0);
+        tcg_gen_rem_tl(mask_offs_rem, mask_offs, tcg_constant_tl(8));
+        tcg_gen_shr_tl(mask_elem, mask_elem, mask_offs_rem);
+        tcg_gen_andi_tl(mask_elem, mask_elem, 1);
+        tcg_gen_brcond_tl(TCG_COND_NE, mask_elem, tcg_constant_tl(0),
+                          active_element);
+        /*
+         * Set masked-off elements in the destination vector register to 1s.
+         * Store instructions simply skip this bit as memory ops access memory
+         * only for active elements.
+         */
+        if (is_load) {
+            tcg_gen_shli_tl(mask_offs, mask_offs, s->sew);
+            tcg_gen_add_tl(mask_offs, mask_offs, dest);
+            st_fn(tcg_constant_tl(-1), (TCGv_ptr)mask_offs, 0);
+        }
+        tcg_gen_br(inc_k);
+        gen_set_label(active_element);
+    }
+    /*
+     * The element is active, calculate the address with stride:
+     * target_ulong addr = base + stride * i + (k << log2_esz);
+     */
+    tcg_gen_mul_tl(stride_offs, stride, i);
+    tcg_gen_shli_tl(k_esz, k, s->sew);
+    tcg_gen_add_tl(stride_offs, stride_offs, k_esz);
+    tcg_gen_add_tl(addr, base, stride_offs);
+    /* Calculate the offset in the dst/src vector register. */
+    tcg_gen_shli_tl(k_max, k, get_log2(max_elems));
+    tcg_gen_add_tl(dest_offs, i, k_max);
+    tcg_gen_shli_tl(dest_offs, dest_offs, s->sew);
+    tcg_gen_add_tl(dest_offs, dest_offs, dest);
+    if (is_load) {
+        tcg_gen_qemu_ld_tl(vreg, addr, s->mem_idx, MO_LE | s->sew | atomicity);
+        st_fn((TCGv)vreg, (TCGv_ptr)dest_offs, 0);
+    } else {
+        ld_fn((TCGv)vreg, (TCGv_ptr)dest_offs, 0);
+        tcg_gen_qemu_st_tl(vreg, addr, s->mem_idx, MO_LE | s->sew | atomicity);
+    }
+    /*
+     * We don't execute the load/store above if the element was inactive.
+     * We jump instead directly to incrementing k and continuing the loop.
+     */
+    if (!vm && s->vma) {
+        gen_set_label(inc_k);
+    }
+    tcg_gen_addi_tl(k, k, 1);
+    tcg_gen_br(start_k);
+    /* End of the inner loop. */
+    gen_set_label(end_k);
+
+    tcg_gen_addi_tl(i, i, 1);
+    tcg_gen_mov_tl(cpu_vstart, i);
+    tcg_gen_br(start);
+
+    /* End of the outer loop. */
+    gen_set_label(end);
+
+    return;
+}
+
+
+/*
+ * Set the tail bytes of the strided loads/stores to 1:
+ *
+ * for (k = 0; k < nf; ++k) {
+ *     cnt = (k * max_elems + vl) * esz;
+ *     tot = (k * max_elems + max_elems) * esz;
+ *     for (i = cnt; i < tot; i += esz) {
+ *         store_1s(-1, vd[vl+i]);
+ *     }
+ * }
+ */
+static void gen_ldst_stride_tail_loop(DisasContext *s, TCGv dest, uint32_t nf,
+                                      gen_tl_ldst *st_fn)
+{
+    TCGv i = tcg_temp_new();
+    TCGv k = tcg_temp_new();
+    TCGv tail_cnt = tcg_temp_new();
+    TCGv tail_tot = tcg_temp_new();
+    TCGv tail_addr = tcg_temp_new();
+
+    TCGLabel *start = gen_new_label();
+    TCGLabel *end = gen_new_label();
+    TCGLabel *start_i = gen_new_label();
+    TCGLabel *end_i = gen_new_label();
+
+    uint32_t max_elems_b = MAXSZ(s);
+    uint32_t esz = 1 << s->sew;
+
+    /* Start of the outer loop. */
+    tcg_gen_movi_tl(k, 0);
+    tcg_gen_shli_tl(tail_cnt, cpu_vl, s->sew);
+    tcg_gen_movi_tl(tail_tot, max_elems_b);
+    tcg_gen_add_tl(tail_addr, dest, tail_cnt);
+    gen_set_label(start);
+    tcg_gen_brcond_tl(TCG_COND_GE, k, tcg_constant_tl(nf), end);
+    /* Start of the inner loop. */
+    tcg_gen_mov_tl(i, tail_cnt);
+    gen_set_label(start_i);
+    tcg_gen_brcond_tl(TCG_COND_GE, i, tail_tot, end_i);
+    /* store_1s(-1, vd[vl+i]); */
+    st_fn(tcg_constant_tl(-1), (TCGv_ptr)tail_addr, 0);
+    tcg_gen_addi_tl(tail_addr, tail_addr, esz);
+    tcg_gen_addi_tl(i, i, esz);
+    tcg_gen_br(start_i);
+    /* End of the inner loop. */
+    gen_set_label(end_i);
+    /* Update the counts */
+    tcg_gen_addi_tl(tail_cnt, tail_cnt, max_elems_b);
+    tcg_gen_addi_tl(tail_tot, tail_cnt, max_elems_b);
+    tcg_gen_addi_tl(k, k, 1);
+    tcg_gen_br(start);
+    /* End of the outer loop. */
+    gen_set_label(end);
+
+    return;
+}
+
+static bool ldst_stride_trans(uint32_t vd, uint32_t rs1, uint32_t rs2,
+                              uint32_t data, DisasContext *s, bool is_load)
+{
+    if (!s->vstart_eq_zero) {
+        return false;
+    }
+
+    TCGv dest = tcg_temp_new();
+
+    uint32_t nf = FIELD_EX32(data, VDATA, NF);
+    uint32_t vm = FIELD_EX32(data, VDATA, VM);
+
+    /* Destination register and mask register */
+    tcg_gen_addi_tl(dest, (TCGv)tcg_env, vreg_ofs(s, vd));
+
+    /*
+     * Select the appropriate load/tore to retrieve data from the vector
+     * register given a specific sew.
+     */
+    static gen_tl_ldst * const ld_fns[4] = {
+        tcg_gen_ld8u_tl, tcg_gen_ld16u_tl,
+        tcg_gen_ld32u_tl, tcg_gen_ld_tl
+    };
+
+    static gen_tl_ldst * const st_fns[4] = {
+        tcg_gen_st8_tl, tcg_gen_st16_tl,
+        tcg_gen_st32_tl, tcg_gen_st_tl
+    };
+
+    gen_tl_ldst *ld_fn = ld_fns[s->sew];
+    gen_tl_ldst *st_fn = st_fns[s->sew];
+
+    if (ld_fn == NULL || st_fn == NULL) {
+        return false;
+    }
+
+    mark_vs_dirty(s);
+
+    gen_ldst_stride_main_loop(s, dest, rs1, rs2, vm, nf, ld_fn, st_fn, is_load);
+
+    tcg_gen_movi_tl(cpu_vstart, 0);
+
+    /*
+     * Set the tail bytes to 1 if tail agnostic:
+     */
+    if (s->vta != 0 && is_load) {
+        gen_ldst_stride_tail_loop(s, dest, nf, st_fn);
+    }
 
     finalize_rvv_inst(s);
     return true;
@@ -836,16 +1090,6 @@ static bool ldst_stride_trans(uint32_t vd, uint32_t rs1, uint32_t rs2,
 static bool ld_stride_op(DisasContext *s, arg_rnfvm *a, uint8_t eew)
 {
     uint32_t data = 0;
-    gen_helper_ldst_stride *fn;
-    static gen_helper_ldst_stride * const fns[4] = {
-        gen_helper_vlse8_v, gen_helper_vlse16_v,
-        gen_helper_vlse32_v, gen_helper_vlse64_v
-    };
-
-    fn = fns[eew];
-    if (fn == NULL) {
-        return false;
-    }
 
     uint8_t emul = vext_get_emul(s, eew);
     data = FIELD_DP32(data, VDATA, VM, a->vm);
@@ -853,7 +1097,7 @@ static bool ld_stride_op(DisasContext *s, arg_rnfvm *a, uint8_t eew)
     data = FIELD_DP32(data, VDATA, NF, a->nf);
     data = FIELD_DP32(data, VDATA, VTA, s->vta);
     data = FIELD_DP32(data, VDATA, VMA, s->vma);
-    return ldst_stride_trans(a->rd, a->rs1, a->rs2, data, fn, s);
+    return ldst_stride_trans(a->rd, a->rs1, a->rs2, data, s, true);
 }
 
 static bool ld_stride_check(DisasContext *s, arg_rnfvm* a, uint8_t eew)
@@ -871,23 +1115,13 @@ GEN_VEXT_TRANS(vlse64_v, MO_64, rnfvm, ld_stride_op, ld_stride_check)
 static bool st_stride_op(DisasContext *s, arg_rnfvm *a, uint8_t eew)
 {
     uint32_t data = 0;
-    gen_helper_ldst_stride *fn;
-    static gen_helper_ldst_stride * const fns[4] = {
-        /* masked stride store */
-        gen_helper_vsse8_v,  gen_helper_vsse16_v,
-        gen_helper_vsse32_v,  gen_helper_vsse64_v
-    };
 
     uint8_t emul = vext_get_emul(s, eew);
     data = FIELD_DP32(data, VDATA, VM, a->vm);
     data = FIELD_DP32(data, VDATA, LMUL, emul);
     data = FIELD_DP32(data, VDATA, NF, a->nf);
-    fn = fns[eew];
-    if (fn == NULL) {
-        return false;
-    }
 
-    return ldst_stride_trans(a->rd, a->rs1, a->rs2, data, fn, s);
+    return ldst_stride_trans(a->rd, a->rs1, a->rs2, data, s, false);
 }
 
 static bool st_stride_check(DisasContext *s, arg_rnfvm* a, uint8_t eew)
@@ -1169,17 +1403,6 @@ GEN_LDST_WHOLE_TRANS(vs8r_v, 8)
  *** Vector Integer Arithmetic Instructions
  */
 
-/*
- * MAXSZ returns the maximum vector size can be operated in bytes,
- * which is used in GVEC IR when vl_eq_vlmax flag is set to true
- * to accelerate vector operation.
- */
-static inline uint32_t MAXSZ(DisasContext *s)
-{
-    int max_sz = s->cfg_ptr->vlenb * 8;
-    return max_sz >> (3 - s->lmul);
-}
-
 static bool opivv_check(DisasContext *s, arg_rmrr *a)
 {
     return require_rvv(s) &&

From 4c1a39eebc6a9f1db816ff6c23e3d42ba52e2601 Mon Sep 17 00:00:00 2001
From: Sebastian Huber <sebastian.huber@embedded-brains.de>
Date: Wed, 19 Mar 2025 07:13:33 +0100
Subject: [PATCH 0970/2760] hw/misc: Add MPFS system reset support

Signed-off-by: Sebastian Huber <sebastian.huber@embedded-brains.de>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250319061342.26435-2-sebastian.huber@embedded-brains.de>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/misc/mchp_pfsoc_sysreg.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/hw/misc/mchp_pfsoc_sysreg.c b/hw/misc/mchp_pfsoc_sysreg.c
index bfa78d3d2f..f47c835f80 100644
--- a/hw/misc/mchp_pfsoc_sysreg.c
+++ b/hw/misc/mchp_pfsoc_sysreg.c
@@ -27,7 +27,9 @@
 #include "hw/irq.h"
 #include "hw/sysbus.h"
 #include "hw/misc/mchp_pfsoc_sysreg.h"
+#include "system/runstate.h"
 
+#define MSS_RESET_CR    0x18
 #define ENVM_CR         0xb8
 #define MESSAGE_INT     0x118c
 
@@ -56,6 +58,11 @@ static void mchp_pfsoc_sysreg_write(void *opaque, hwaddr offset,
 {
     MchpPfSoCSysregState *s = opaque;
     switch (offset) {
+    case MSS_RESET_CR:
+        if (value == 0xdead) {
+            qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
+        }
+        break;
     case MESSAGE_INT:
         qemu_irq_lower(s->irq);
         break;

From cae44a92ab23811deeefa0a44b1bdec6cfa8e4b9 Mon Sep 17 00:00:00 2001
From: Sebastian Huber <sebastian.huber@embedded-brains.de>
Date: Wed, 19 Mar 2025 07:13:34 +0100
Subject: [PATCH 0971/2760] hw/riscv: More flexible FDT placement for MPFS

If the kernel entry is in the high DRAM area, place the FDT into this
area.

Signed-off-by: Sebastian Huber <sebastian.huber@embedded-brains.de>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250319061342.26435-3-sebastian.huber@embedded-brains.de>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/microchip_pfsoc.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
index e39ee657cd..6bb44e3ac5 100644
--- a/hw/riscv/microchip_pfsoc.c
+++ b/hw/riscv/microchip_pfsoc.c
@@ -626,8 +626,15 @@ static void microchip_icicle_kit_machine_init(MachineState *machine)
         kernel_entry = boot_info.image_low_addr;
 
         /* Compute the fdt load address in dram */
-        fdt_load_addr = riscv_compute_fdt_addr(memmap[MICROCHIP_PFSOC_DRAM_LO].base,
-                                               memmap[MICROCHIP_PFSOC_DRAM_LO].size,
+        hwaddr kernel_ram_base = memmap[MICROCHIP_PFSOC_DRAM_LO].base;
+        hwaddr kernel_ram_size = memmap[MICROCHIP_PFSOC_DRAM_LO].size;
+
+        if (kernel_entry - kernel_ram_base >= kernel_ram_size) {
+            kernel_ram_base = memmap[MICROCHIP_PFSOC_DRAM_HI].base;
+            kernel_ram_size = mem_high_size;
+        }
+
+        fdt_load_addr = riscv_compute_fdt_addr(kernel_ram_base, kernel_ram_size,
                                                machine, &boot_info);
         riscv_load_fdt(fdt_load_addr, machine->fdt);
 

From 0c2ca9e4d139acc762325d994614a42dba31be6a Mon Sep 17 00:00:00 2001
From: Sebastian Huber <sebastian.huber@embedded-brains.de>
Date: Wed, 19 Mar 2025 07:13:35 +0100
Subject: [PATCH 0972/2760] hw/riscv: Make FDT optional for MPFS

Real-time kernels such as RTEMS or Zephyr may use a static device tree
built into the kernel image.  Do not require to use the -dtb option if
-kernel is used for the microchip-icicle-kit machine.  Issue a warning
if no device tree is provided by the user since the machine does not
generate one.

Signed-off-by: Sebastian Huber <sebastian.huber@embedded-brains.de>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250319061342.26435-4-sebastian.huber@embedded-brains.de>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/microchip_pfsoc.c | 54 +++++++++++++++++++-------------------
 1 file changed, 27 insertions(+), 27 deletions(-)

diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
index 6bb44e3ac5..b8a8d5251d 100644
--- a/hw/riscv/microchip_pfsoc.c
+++ b/hw/riscv/microchip_pfsoc.c
@@ -516,7 +516,6 @@ static void microchip_icicle_kit_machine_init(MachineState *machine)
     uint64_t mem_low_size, mem_high_size;
     hwaddr firmware_load_addr;
     const char *firmware_name;
-    bool kernel_as_payload = false;
     target_ulong firmware_end_addr, kernel_start_addr;
     uint64_t kernel_entry;
     uint64_t fdt_load_addr;
@@ -589,25 +588,12 @@ static void microchip_icicle_kit_machine_init(MachineState *machine)
      *
      * This ensures backwards compatibility with how we used to expose -bios
      * to users but allows them to run through direct kernel booting as well.
-     *
-     * When -kernel is used for direct boot, -dtb must be present to provide
-     * a valid device tree for the board, as we don't generate device tree.
      */
 
-    if (machine->kernel_filename && machine->dtb) {
-        int fdt_size;
-        machine->fdt = load_device_tree(machine->dtb, &fdt_size);
-        if (!machine->fdt) {
-            error_report("load_device_tree() failed");
-            exit(1);
-        }
-
+    if (machine->kernel_filename) {
         firmware_name = RISCV64_BIOS_BIN;
         firmware_load_addr = memmap[MICROCHIP_PFSOC_DRAM_LO].base;
-        kernel_as_payload = true;
-    }
-
-    if (!kernel_as_payload) {
+    } else {
         firmware_name = BIOS_FILENAME;
         firmware_load_addr = RESET_VECTOR;
     }
@@ -617,7 +603,7 @@ static void microchip_icicle_kit_machine_init(MachineState *machine)
                                                      &firmware_load_addr, NULL);
 
     riscv_boot_info_init(&boot_info, &s->soc.u_cpus);
-    if (kernel_as_payload) {
+    if (machine->kernel_filename) {
         kernel_start_addr = riscv_calc_kernel_start_addr(&boot_info,
                                                          firmware_end_addr);
 
@@ -625,19 +611,33 @@ static void microchip_icicle_kit_machine_init(MachineState *machine)
                           true, NULL);
         kernel_entry = boot_info.image_low_addr;
 
-        /* Compute the fdt load address in dram */
-        hwaddr kernel_ram_base = memmap[MICROCHIP_PFSOC_DRAM_LO].base;
-        hwaddr kernel_ram_size = memmap[MICROCHIP_PFSOC_DRAM_LO].size;
+        if (machine->dtb) {
+            int fdt_size;
+            machine->fdt = load_device_tree(machine->dtb, &fdt_size);
+            if (!machine->fdt) {
+                error_report("load_device_tree() failed");
+                exit(1);
+            }
 
-        if (kernel_entry - kernel_ram_base >= kernel_ram_size) {
-            kernel_ram_base = memmap[MICROCHIP_PFSOC_DRAM_HI].base;
-            kernel_ram_size = mem_high_size;
+            /* Compute the FDT load address in DRAM */
+            hwaddr kernel_ram_base = memmap[MICROCHIP_PFSOC_DRAM_LO].base;
+            hwaddr kernel_ram_size = memmap[MICROCHIP_PFSOC_DRAM_LO].size;
+
+            if (kernel_entry - kernel_ram_base >= kernel_ram_size) {
+                kernel_ram_base = memmap[MICROCHIP_PFSOC_DRAM_HI].base;
+                kernel_ram_size = mem_high_size;
+            }
+
+            fdt_load_addr = riscv_compute_fdt_addr(kernel_ram_base, kernel_ram_size,
+                                                   machine, &boot_info);
+            riscv_load_fdt(fdt_load_addr, machine->fdt);
+        } else {
+            warn_report_once("The QEMU microchip-icicle-kit machine does not "
+                             "generate a device tree, so no device tree is "
+                             "being provided to the guest.");
+            fdt_load_addr = 0;
         }
 
-        fdt_load_addr = riscv_compute_fdt_addr(kernel_ram_base, kernel_ram_size,
-                                               machine, &boot_info);
-        riscv_load_fdt(fdt_load_addr, machine->fdt);
-
         /* Load the reset vector */
         riscv_setup_rom_reset_vec(machine, &s->soc.u_cpus, firmware_load_addr,
                                   memmap[MICROCHIP_PFSOC_ENVM_DATA].base,

From 6dd6f11710c713bd21ac67ab93f6db33169c6b4d Mon Sep 17 00:00:00 2001
From: Sebastian Huber <sebastian.huber@embedded-brains.de>
Date: Wed, 19 Mar 2025 07:13:36 +0100
Subject: [PATCH 0973/2760] hw/riscv: Allow direct start of kernel for MPFS

Further customize the -bios and -kernel options behaviour for the
microchip-icicle-kit machine.  If "-bios none -kernel filename" is
specified, then do not load a firmware and instead only load and start
the kernel image.

For test runs, use an approach similar to
riscv_find_and_load_firmware().

Signed-off-by: Sebastian Huber <sebastian.huber@embedded-brains.de>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250319061342.26435-5-sebastian.huber@embedded-brains.de>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/microchip_pfsoc.c | 59 +++++++++++++++++++++++++++-----------
 1 file changed, 42 insertions(+), 17 deletions(-)

diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
index b8a8d5251d..6e5b17c05f 100644
--- a/hw/riscv/microchip_pfsoc.c
+++ b/hw/riscv/microchip_pfsoc.c
@@ -578,29 +578,47 @@ static void microchip_icicle_kit_machine_init(MachineState *machine)
     }
 
     /*
-     * We follow the following table to select which payload we execute.
+     * We follow the following table to select which firmware we use.
      *
-     *  -bios |    -kernel | payload
-     * -------+------------+--------
-     *      N |          N | HSS
-     *      Y | don't care | HSS
-     *      N |          Y | kernel
-     *
-     * This ensures backwards compatibility with how we used to expose -bios
-     * to users but allows them to run through direct kernel booting as well.
+     * -bios         | -kernel    | firmware
+     * --------------+------------+--------
+     * none          |          N | error
+     * none          |          Y | kernel
+     * NULL, default |          N | BIOS_FILENAME
+     * NULL, default |          Y | RISCV64_BIOS_BIN
+     * other         | don't care | other
      */
+    if (machine->firmware && !strcmp(machine->firmware, "none")) {
+        if (!machine->kernel_filename) {
+            error_report("for -bios none, a kernel is required");
+            exit(1);
+        }
 
-    if (machine->kernel_filename) {
-        firmware_name = RISCV64_BIOS_BIN;
-        firmware_load_addr = memmap[MICROCHIP_PFSOC_DRAM_LO].base;
+        firmware_name = NULL;
+        firmware_load_addr = RESET_VECTOR;
+    } else if (!machine->firmware || !strcmp(machine->firmware, "default")) {
+        if (machine->kernel_filename) {
+            firmware_name = RISCV64_BIOS_BIN;
+            firmware_load_addr = memmap[MICROCHIP_PFSOC_DRAM_LO].base;
+        } else {
+            firmware_name = BIOS_FILENAME;
+            firmware_load_addr = RESET_VECTOR;
+        }
     } else {
-        firmware_name = BIOS_FILENAME;
+        firmware_name = machine->firmware;
         firmware_load_addr = RESET_VECTOR;
     }
 
-    /* Load the firmware */
-    firmware_end_addr = riscv_find_and_load_firmware(machine, firmware_name,
-                                                     &firmware_load_addr, NULL);
+    /* Load the firmware if necessary */
+    firmware_end_addr = firmware_load_addr;
+    if (firmware_name) {
+        char *filename = riscv_find_firmware(firmware_name, NULL);
+        if (filename) {
+            firmware_end_addr = riscv_load_firmware(filename,
+                                                    &firmware_load_addr, NULL);
+            g_free(filename);
+        }
+    }
 
     riscv_boot_info_init(&boot_info, &s->soc.u_cpus);
     if (machine->kernel_filename) {
@@ -638,8 +656,15 @@ static void microchip_icicle_kit_machine_init(MachineState *machine)
             fdt_load_addr = 0;
         }
 
+        hwaddr start_addr;
+        if (firmware_name) {
+            start_addr = firmware_load_addr;
+        } else {
+            start_addr = kernel_entry;
+        }
+
         /* Load the reset vector */
-        riscv_setup_rom_reset_vec(machine, &s->soc.u_cpus, firmware_load_addr,
+        riscv_setup_rom_reset_vec(machine, &s->soc.u_cpus, start_addr,
                                   memmap[MICROCHIP_PFSOC_ENVM_DATA].base,
                                   memmap[MICROCHIP_PFSOC_ENVM_DATA].size,
                                   kernel_entry, fdt_load_addr);

From e40b75fe5c94c6656e8ffcb0b9559b09882fa01b Mon Sep 17 00:00:00 2001
From: Sebastian Huber <sebastian.huber@embedded-brains.de>
Date: Wed, 19 Mar 2025 07:13:37 +0100
Subject: [PATCH 0974/2760] hw/riscv: Configurable MPFS CLINT timebase freq
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This property enables the setting of the CLINT timebase frequency
through the command line, for example:

  -machine microchip-icicle-kit,clint-timebase-frequency=10000000

Signed-off-by: Sebastian Huber <sebastian.huber@embedded-brains.de>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250319061342.26435-6-sebastian.huber@embedded-brains.de>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/microchip_pfsoc.c         | 49 +++++++++++++++++++++++++++---
 include/hw/riscv/microchip_pfsoc.h |  1 +
 2 files changed, 46 insertions(+), 4 deletions(-)

diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
index 6e5b17c05f..2e74783fce 100644
--- a/hw/riscv/microchip_pfsoc.c
+++ b/hw/riscv/microchip_pfsoc.c
@@ -39,6 +39,7 @@
 #include "qemu/units.h"
 #include "qemu/cutils.h"
 #include "qapi/error.h"
+#include "qapi/visitor.h"
 #include "hw/boards.h"
 #include "hw/loader.h"
 #include "hw/sysbus.h"
@@ -61,9 +62,6 @@
 #define BIOS_FILENAME   "hss.bin"
 #define RESET_VECTOR    0x20220000
 
-/* CLINT timebase frequency */
-#define CLINT_TIMEBASE_FREQ 1000000
-
 /* GEM version */
 #define GEM_REVISION    0x0107010c
 
@@ -193,6 +191,7 @@ static void microchip_pfsoc_soc_instance_init(Object *obj)
 static void microchip_pfsoc_soc_realize(DeviceState *dev, Error **errp)
 {
     MachineState *ms = MACHINE(qdev_get_machine());
+    MicrochipIcicleKitState *iks = MICROCHIP_ICICLE_KIT_MACHINE(ms);
     MicrochipPFSoCState *s = MICROCHIP_PFSOC(dev);
     const MemMapEntry *memmap = microchip_pfsoc_memmap;
     MemoryRegion *system_memory = get_system_memory();
@@ -253,7 +252,7 @@ static void microchip_pfsoc_soc_realize(DeviceState *dev, Error **errp)
         memmap[MICROCHIP_PFSOC_CLINT].base + RISCV_ACLINT_SWI_SIZE,
         RISCV_ACLINT_DEFAULT_MTIMER_SIZE, 0, ms->smp.cpus,
         RISCV_ACLINT_DEFAULT_MTIMECMP, RISCV_ACLINT_DEFAULT_MTIME,
-        CLINT_TIMEBASE_FREQ, false);
+        iks->clint_timebase_freq, false);
 
     /* L2 cache controller */
     create_unimplemented_device("microchip.pfsoc.l2cc",
@@ -671,6 +670,40 @@ static void microchip_icicle_kit_machine_init(MachineState *machine)
     }
 }
 
+static void microchip_icicle_kit_set_clint_timebase_freq(Object *obj,
+                                                         Visitor *v,
+                                                         const char *name,
+                                                         void *opaque,
+                                                         Error **errp)
+{
+    MicrochipIcicleKitState *s = MICROCHIP_ICICLE_KIT_MACHINE(obj);
+    uint32_t value;
+
+    if (!visit_type_uint32(v, name, &value, errp)) {
+        return;
+    }
+
+    s->clint_timebase_freq = value;
+}
+
+static void microchip_icicle_kit_get_clint_timebase_freq(Object *obj,
+                                                         Visitor *v,
+                                                         const char *name,
+                                                         void *opaque,
+                                                         Error **errp)
+{
+    MicrochipIcicleKitState *s = MICROCHIP_ICICLE_KIT_MACHINE(obj);
+    uint32_t value = s->clint_timebase_freq;
+
+    visit_type_uint32(v, name, &value, errp);
+}
+
+static void microchip_icicle_kit_machine_instance_init(Object *obj)
+{
+    MicrochipIcicleKitState *m = MICROCHIP_ICICLE_KIT_MACHINE(obj);
+    m->clint_timebase_freq = 1000000;
+}
+
 static void microchip_icicle_kit_machine_class_init(ObjectClass *oc,
                                                     const void *data)
 {
@@ -693,12 +726,20 @@ static void microchip_icicle_kit_machine_class_init(ObjectClass *oc,
      * See memory_tests() in mss_ddr.c in the HSS source code.
      */
     mc->default_ram_size = 1537 * MiB;
+
+    object_class_property_add(oc, "clint-timebase-frequency", "uint32_t",
+                              microchip_icicle_kit_get_clint_timebase_freq,
+                              microchip_icicle_kit_set_clint_timebase_freq,
+                              NULL, NULL);
+    object_class_property_set_description(oc, "clint-timebase-frequency",
+                                  "Set CLINT timebase frequency in Hz.");
 }
 
 static const TypeInfo microchip_icicle_kit_machine_typeinfo = {
     .name       = MACHINE_TYPE_NAME("microchip-icicle-kit"),
     .parent     = TYPE_MACHINE,
     .class_init = microchip_icicle_kit_machine_class_init,
+    .instance_init = microchip_icicle_kit_machine_instance_init,
     .instance_size = sizeof(MicrochipIcicleKitState),
 };
 
diff --git a/include/hw/riscv/microchip_pfsoc.h b/include/hw/riscv/microchip_pfsoc.h
index daef086da6..7ca9b976c1 100644
--- a/include/hw/riscv/microchip_pfsoc.h
+++ b/include/hw/riscv/microchip_pfsoc.h
@@ -67,6 +67,7 @@ typedef struct MicrochipIcicleKitState {
     MachineState parent_obj;
 
     /*< public >*/
+    uint32_t clint_timebase_freq;
     MicrochipPFSoCState soc;
 } MicrochipIcicleKitState;
 

From dd07ab1121ffd7003ae2cffde3046acd3123bbbd Mon Sep 17 00:00:00 2001
From: Sebastian Huber <sebastian.huber@embedded-brains.de>
Date: Wed, 19 Mar 2025 07:13:38 +0100
Subject: [PATCH 0975/2760] hw/riscv: microchip_pfsoc: Rework documentation

Mention that running the HSS no longer works.  Document the changed boot
options.  Reorder documentation blocks.  Update URLs.

Signed-off-by: Sebastian Huber <sebastian.huber@embedded-brains.de>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250319061342.26435-7-sebastian.huber@embedded-brains.de>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 docs/system/riscv/microchip-icicle-kit.rst | 126 +++++++--------------
 1 file changed, 44 insertions(+), 82 deletions(-)

diff --git a/docs/system/riscv/microchip-icicle-kit.rst b/docs/system/riscv/microchip-icicle-kit.rst
index 40798b1aae..9809e94b84 100644
--- a/docs/system/riscv/microchip-icicle-kit.rst
+++ b/docs/system/riscv/microchip-icicle-kit.rst
@@ -5,10 +5,10 @@ Microchip PolarFire SoC Icicle Kit integrates a PolarFire SoC, with one
 SiFive's E51 plus four U54 cores and many on-chip peripherals and an FPGA.
 
 For more details about Microchip PolarFire SoC, please see:
-https://www.microsemi.com/product-directory/soc-fpgas/5498-polarfire-soc-fpga
+https://www.microchip.com/en-us/products/fpgas-and-plds/system-on-chip-fpgas/polarfire-soc-fpgas
 
 The Icicle Kit board information can be found here:
-https://www.microsemi.com/existing-parts/parts/152514
+https://www.microchip.com/en-us/development-tool/mpfs-icicle-kit-es
 
 Supported devices
 -----------------
@@ -26,95 +26,48 @@ The ``microchip-icicle-kit`` machine supports the following devices:
 * 2 GEM Ethernet controllers
 * 1 SDHC storage controller
 
+The memory is set to 1537 MiB by default.  A sanity check on RAM size is
+performed in the machine init routine to prompt user to increase the RAM size
+to > 1537 MiB when less than 1537 MiB RAM is detected.
+
 Boot options
 ------------
 
-The ``microchip-icicle-kit`` machine can start using the standard -bios
-functionality for loading its BIOS image, aka Hart Software Services (HSS_).
-HSS loads the second stage bootloader U-Boot from an SD card. Then a kernel
-can be loaded from U-Boot. It also supports direct kernel booting via the
--kernel option along with the device tree blob via -dtb. When direct kernel
-boot is used, the OpenSBI fw_dynamic BIOS image is used to boot a payload
-like U-Boot or OS kernel directly.
+The ``microchip-icicle-kit`` machine provides some options to run a firmware
+(BIOS) or a kernel image.  QEMU follows below truth table to select the
+firmware:
 
-The user provided DTB should have the following requirements:
-
-* The /cpus node should contain at least one subnode for E51 and the number
-  of subnodes should match QEMU's ``-smp`` option
-* The /memory reg size should match QEMU’s selected ram_size via ``-m``
-* Should contain a node for the CLINT device with a compatible string
-  "riscv,clint0"
-
-QEMU follows below truth table to select which payload to execute:
-
-===== ========== ========== =======
--bios    -kernel       -dtb payload
-===== ========== ========== =======
-    N          N don't care     HSS
-    Y don't care don't care     HSS
-    N          Y          Y  kernel
-===== ========== ========== =======
-
-The memory is set to 1537 MiB by default which is the minimum required high
-memory size by HSS. A sanity check on ram size is performed in the machine
-init routine to prompt user to increase the RAM size to > 1537 MiB when less
-than 1537 MiB ram is detected.
-
-Running HSS
------------
-
-HSS 2020.12 release is tested at the time of writing. To build an HSS image
-that can be booted by the ``microchip-icicle-kit`` machine, type the following
-in the HSS source tree:
-
-.. code-block:: bash
-
-  $ export CROSS_COMPILE=riscv64-linux-
-  $ cp boards/mpfs-icicle-kit-es/def_config .config
-  $ make BOARD=mpfs-icicle-kit-es
-
-Download the official SD card image released by Microchip and prepare it for
-QEMU usage:
-
-.. code-block:: bash
-
-  $ wget ftp://ftpsoc.microsemi.com/outgoing/core-image-minimal-dev-icicle-kit-es-sd-20201009141623.rootfs.wic.gz
-  $ gunzip core-image-minimal-dev-icicle-kit-es-sd-20201009141623.rootfs.wic.gz
-  $ qemu-img resize core-image-minimal-dev-icicle-kit-es-sd-20201009141623.rootfs.wic 4G
-
-Then we can boot the machine by:
-
-.. code-block:: bash
-
-  $ qemu-system-riscv64 -M microchip-icicle-kit -smp 5 \
-      -bios path/to/hss.bin -sd path/to/sdcard.img \
-      -nic user,model=cadence_gem \
-      -nic tap,ifname=tap,model=cadence_gem,script=no \
-      -display none -serial stdio \
-      -chardev socket,id=serial1,path=serial1.sock,server=on,wait=on \
-      -serial chardev:serial1
-
-With above command line, current terminal session will be used for the first
-serial port. Open another terminal window, and use ``minicom`` to connect the
-second serial port.
-
-.. code-block:: bash
-
-  $ minicom -D unix\#serial1.sock
-
-HSS output is on the first serial port (stdio) and U-Boot outputs on the
-second serial port. U-Boot will automatically load the Linux kernel from
-the SD card image.
+============= =========== ======================================
+-bios          -kernel    firmware
+============= =========== ======================================
+none                    N this is an error
+none                    Y the kernel image
+NULL, default           N hss.bin
+NULL, default           Y opensbi-riscv64-generic-fw_dynamic.bin
+other          don't care the BIOS image
+============= =========== ======================================
 
 Direct Kernel Boot
 ------------------
 
-Sometimes we just want to test booting a new kernel, and transforming the
-kernel image to the format required by the HSS bootflow is tedious. We can
-use '-kernel' for direct kernel booting just like other RISC-V machines do.
+Use the ``-kernel`` option to directly run a kernel image.  When a direct
+kernel boot is requested, a device tree blob may be specified via the ``-dtb``
+option.  Unlike other QEMU machines, this machine does not generate a device
+tree for the kernel.  It shall be provided by the user.  The user provided DTB
+should meet the following requirements:
 
-In this mode, the OpenSBI fw_dynamic BIOS image for 'generic' platform is
-used to boot an S-mode payload like U-Boot or OS kernel directly.
+* The ``/cpus`` node should contain at least one subnode for E51 and the number
+  of subnodes should match QEMU's ``-smp`` option.
+
+* The ``/memory`` reg size should match QEMU’s selected RAM size via the ``-m``
+  option.
+
+* It should contain a node for the CLINT device with a compatible string
+  "riscv,clint0".
+
+When ``-bios`` is not specified or set to ``default``, the OpenSBI
+``fw_dynamic`` BIOS image for the ``generic`` platform is used to boot an
+S-mode payload like U-Boot or OS kernel directly.
 
 For example, the following commands show building a U-Boot image from U-Boot
 mainline v2021.07 for the Microchip Icicle Kit board:
@@ -146,4 +99,13 @@ CAVEATS:
   ``u-boot.bin`` has to be used which does contain one. To use the ELF image,
   we need to change to CONFIG_OF_EMBED or CONFIG_OF_PRIOR_STAGE.
 
+Running HSS
+-----------
+
+The machine ``microchip-icicle-kit`` used to run the Hart Software Services
+(HSS_), however, the HSS development progressed and the QEMU machine
+implementation lacks behind.  Currently, running the HSS no longer works.
+There is missing support in the clock and memory controller devices.  In
+particular, reading from the SD card does not work.
+
 .. _HSS: https://github.com/polarfire-soc/hart-software-services

From 9425790aceffc09b730a072cc3fc174d1b084f62 Mon Sep 17 00:00:00 2001
From: Paolo Savini <paolo.savini@embecosm.com>
Date: Thu, 13 Mar 2025 15:23:30 +0000
Subject: [PATCH 0976/2760] target/riscv: use tcg ops generation to emulate
 whole reg rvv loads/stores.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This patch replaces the use of a helper function with direct tcg ops generation
in order to emulate whole register loads and stores. This is done in order to
improve the performance of QEMU.
We still use the helper function when vstart is not 0 at the beginning of the
emulation of the whole register load or store or when we would end up generating
partial loads or stores of vector elements (e.g. emulating 64 bits element loads
with pairs of 32 bits loads on hosts with 32 bits registers).
The latter condition ensures that we are not surprised by a trap in mid-element
and consecutively that we can update vstart correctly.
We also use the helper function when it performs better than tcg for specific
combinations of vector length, number of fields and element size.

Signed-off-by: Paolo Savini <paolo.savini@embecosm.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Richard Handerson <richard.henderson@linaro.org>
Reviewed-by: Max Chou <max.chou@sifive.com>
Reviewed-by: "Alex Bennée" <alex.bennee@linaro.org>
Message-ID: <20250313152330.398396-2-paolo.savini@embecosm.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvv.c.inc | 151 +++++++++++++++++-------
 1 file changed, 106 insertions(+), 45 deletions(-)

diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
index 7079f758ad..4ca7b15da1 100644
--- a/target/riscv/insn_trans/trans_rvv.c.inc
+++ b/target/riscv/insn_trans/trans_rvv.c.inc
@@ -1334,25 +1334,86 @@ GEN_VEXT_TRANS(vle64ff_v, MO_64, r2nfvm, ldff_op, ld_us_check)
 typedef void gen_helper_ldst_whole(TCGv_ptr, TCGv, TCGv_env, TCGv_i32);
 
 static bool ldst_whole_trans(uint32_t vd, uint32_t rs1, uint32_t nf,
-                             gen_helper_ldst_whole *fn,
-                             DisasContext *s)
+                             uint32_t log2_esz, gen_helper_ldst_whole *fn,
+                             DisasContext *s, bool is_load)
 {
-    TCGv_ptr dest;
-    TCGv base;
-    TCGv_i32 desc;
-
-    uint32_t data = FIELD_DP32(0, VDATA, NF, nf);
-    data = FIELD_DP32(data, VDATA, VM, 1);
-    dest = tcg_temp_new_ptr();
-    desc = tcg_constant_i32(simd_desc(s->cfg_ptr->vlenb,
-                                      s->cfg_ptr->vlenb, data));
-
-    base = get_gpr(s, rs1, EXT_NONE);
-    tcg_gen_addi_ptr(dest, tcg_env, vreg_ofs(s, vd));
-
     mark_vs_dirty(s);
 
-    fn(dest, base, tcg_env, desc);
+    /*
+     * Load/store multiple bytes per iteration.
+     * When possible do this atomically.
+     * Update vstart with the number of processed elements.
+     * Use the helper function if either:
+     * - vstart is not 0.
+     * - the target has 32 bit registers and we are loading/storing 64 bit long
+     *   elements. This is to ensure that we process every element with a single
+     *   memory instruction.
+     */
+
+    bool use_helper_fn = !(s->vstart_eq_zero) ||
+                          (TCG_TARGET_REG_BITS == 32 && log2_esz == 3);
+
+    if (!use_helper_fn) {
+        TCGv addr = tcg_temp_new();
+        uint32_t size = s->cfg_ptr->vlenb * nf;
+        TCGv_i64 t8 = tcg_temp_new_i64();
+        TCGv_i32 t4 = tcg_temp_new_i32();
+        MemOp atomicity = MO_ATOM_NONE;
+        if (log2_esz == 0) {
+            atomicity = MO_ATOM_NONE;
+        } else {
+            atomicity = MO_ATOM_IFALIGN_PAIR;
+        }
+        if (TCG_TARGET_REG_BITS == 64) {
+            for (int i = 0; i < size; i += 8) {
+                addr = get_address(s, rs1, i);
+                if (is_load) {
+                    tcg_gen_qemu_ld_i64(t8, addr, s->mem_idx,
+                            MO_LE | MO_64 | atomicity);
+                    tcg_gen_st_i64(t8, tcg_env, vreg_ofs(s, vd) + i);
+                } else {
+                    tcg_gen_ld_i64(t8, tcg_env, vreg_ofs(s, vd) + i);
+                    tcg_gen_qemu_st_i64(t8, addr, s->mem_idx,
+                            MO_LE | MO_64 | atomicity);
+                }
+                if (i == size - 8) {
+                    tcg_gen_movi_tl(cpu_vstart, 0);
+                } else {
+                    tcg_gen_addi_tl(cpu_vstart, cpu_vstart, 8 >> log2_esz);
+                }
+            }
+        } else {
+            for (int i = 0; i < size; i += 4) {
+                addr = get_address(s, rs1, i);
+                if (is_load) {
+                    tcg_gen_qemu_ld_i32(t4, addr, s->mem_idx,
+                            MO_LE | MO_32 | atomicity);
+                    tcg_gen_st_i32(t4, tcg_env, vreg_ofs(s, vd) + i);
+                } else {
+                    tcg_gen_ld_i32(t4, tcg_env, vreg_ofs(s, vd) + i);
+                    tcg_gen_qemu_st_i32(t4, addr, s->mem_idx,
+                            MO_LE | MO_32 | atomicity);
+                }
+                if (i == size - 4) {
+                    tcg_gen_movi_tl(cpu_vstart, 0);
+                } else {
+                    tcg_gen_addi_tl(cpu_vstart, cpu_vstart, 4 >> log2_esz);
+                }
+            }
+        }
+    } else {
+        TCGv_ptr dest;
+        TCGv base;
+        TCGv_i32 desc;
+        uint32_t data = FIELD_DP32(0, VDATA, NF, nf);
+        data = FIELD_DP32(data, VDATA, VM, 1);
+        dest = tcg_temp_new_ptr();
+        desc = tcg_constant_i32(simd_desc(s->cfg_ptr->vlenb,
+                        s->cfg_ptr->vlenb, data));
+        base = get_gpr(s, rs1, EXT_NONE);
+        tcg_gen_addi_ptr(dest, tcg_env, vreg_ofs(s, vd));
+        fn(dest, base, tcg_env, desc);
+    }
 
     finalize_rvv_inst(s);
     return true;
@@ -1362,42 +1423,42 @@ static bool ldst_whole_trans(uint32_t vd, uint32_t rs1, uint32_t nf,
  * load and store whole register instructions ignore vtype and vl setting.
  * Thus, we don't need to check vill bit. (Section 7.9)
  */
-#define GEN_LDST_WHOLE_TRANS(NAME, ARG_NF)                                \
-static bool trans_##NAME(DisasContext *s, arg_##NAME * a)                 \
-{                                                                         \
-    if (require_rvv(s) &&                                                 \
-        QEMU_IS_ALIGNED(a->rd, ARG_NF)) {                                 \
-        return ldst_whole_trans(a->rd, a->rs1, ARG_NF,                    \
-                                gen_helper_##NAME, s);                    \
-    }                                                                     \
-    return false;                                                         \
+#define GEN_LDST_WHOLE_TRANS(NAME, ETYPE, ARG_NF, IS_LOAD)                  \
+static bool trans_##NAME(DisasContext *s, arg_##NAME * a)                   \
+{                                                                           \
+    if (require_rvv(s) &&                                                   \
+        QEMU_IS_ALIGNED(a->rd, ARG_NF)) {                                   \
+        return ldst_whole_trans(a->rd, a->rs1, ARG_NF, ctzl(sizeof(ETYPE)), \
+                                gen_helper_##NAME, s, IS_LOAD);             \
+    }                                                                       \
+    return false;                                                           \
 }
 
-GEN_LDST_WHOLE_TRANS(vl1re8_v,  1)
-GEN_LDST_WHOLE_TRANS(vl1re16_v, 1)
-GEN_LDST_WHOLE_TRANS(vl1re32_v, 1)
-GEN_LDST_WHOLE_TRANS(vl1re64_v, 1)
-GEN_LDST_WHOLE_TRANS(vl2re8_v,  2)
-GEN_LDST_WHOLE_TRANS(vl2re16_v, 2)
-GEN_LDST_WHOLE_TRANS(vl2re32_v, 2)
-GEN_LDST_WHOLE_TRANS(vl2re64_v, 2)
-GEN_LDST_WHOLE_TRANS(vl4re8_v,  4)
-GEN_LDST_WHOLE_TRANS(vl4re16_v, 4)
-GEN_LDST_WHOLE_TRANS(vl4re32_v, 4)
-GEN_LDST_WHOLE_TRANS(vl4re64_v, 4)
-GEN_LDST_WHOLE_TRANS(vl8re8_v,  8)
-GEN_LDST_WHOLE_TRANS(vl8re16_v, 8)
-GEN_LDST_WHOLE_TRANS(vl8re32_v, 8)
-GEN_LDST_WHOLE_TRANS(vl8re64_v, 8)
+GEN_LDST_WHOLE_TRANS(vl1re8_v,  int8_t,  1, true)
+GEN_LDST_WHOLE_TRANS(vl1re16_v, int16_t, 1, true)
+GEN_LDST_WHOLE_TRANS(vl1re32_v, int32_t, 1, true)
+GEN_LDST_WHOLE_TRANS(vl1re64_v, int64_t, 1, true)
+GEN_LDST_WHOLE_TRANS(vl2re8_v,  int8_t,  2, true)
+GEN_LDST_WHOLE_TRANS(vl2re16_v, int16_t, 2, true)
+GEN_LDST_WHOLE_TRANS(vl2re32_v, int32_t, 2, true)
+GEN_LDST_WHOLE_TRANS(vl2re64_v, int64_t, 2, true)
+GEN_LDST_WHOLE_TRANS(vl4re8_v,  int8_t,  4, true)
+GEN_LDST_WHOLE_TRANS(vl4re16_v, int16_t, 4, true)
+GEN_LDST_WHOLE_TRANS(vl4re32_v, int32_t, 4, true)
+GEN_LDST_WHOLE_TRANS(vl4re64_v, int64_t, 4, true)
+GEN_LDST_WHOLE_TRANS(vl8re8_v,  int8_t,  8, true)
+GEN_LDST_WHOLE_TRANS(vl8re16_v, int16_t, 8, true)
+GEN_LDST_WHOLE_TRANS(vl8re32_v, int32_t, 8, true)
+GEN_LDST_WHOLE_TRANS(vl8re64_v, int64_t, 8, true)
 
 /*
  * The vector whole register store instructions are encoded similar to
  * unmasked unit-stride store of elements with EEW=8.
  */
-GEN_LDST_WHOLE_TRANS(vs1r_v, 1)
-GEN_LDST_WHOLE_TRANS(vs2r_v, 2)
-GEN_LDST_WHOLE_TRANS(vs4r_v, 4)
-GEN_LDST_WHOLE_TRANS(vs8r_v, 8)
+GEN_LDST_WHOLE_TRANS(vs1r_v, int8_t, 1, false)
+GEN_LDST_WHOLE_TRANS(vs2r_v, int8_t, 2, false)
+GEN_LDST_WHOLE_TRANS(vs4r_v, int8_t, 4, false)
+GEN_LDST_WHOLE_TRANS(vs8r_v, int8_t, 8, false)
 
 /*
  *** Vector Integer Arithmetic Instructions

From d887736225984fcb3926e3f32f3cdc332c03ba8f Mon Sep 17 00:00:00 2001
From: Paolo Savini <paolo.savini@embecosm.com>
Date: Thu, 13 Mar 2025 12:39:26 +0000
Subject: [PATCH 0977/2760] Expand the probe_pages helper function to handle
 probe flags.

This commit expands the probe_pages helper function in
target/riscv/vector_helper.c to handle also the cases in which we need access to
the flags raised while probing the memory and the host address.
This is done in order to provide a unified interface to probe_access and
probe_access_flags.
The new version of probe_pages can now act as a regular call to probe_access as
before and as a call to probe_access_flags. In the latter case the user need to
pass pointers to flags and host address and a boolean value for nonfault.
The flags and host address will be set and made available as for a direct call
to probe_access_flags.

Signed-off-by: Paolo Savini <paolo.savini@embecosm.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20250313123926.374878-2-paolo.savini@embecosm.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/vector_helper.c | 59 +++++++++++++++++++++++-------------
 1 file changed, 38 insertions(+), 21 deletions(-)

diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
index 8eea3e6df0..3aec9a7731 100644
--- a/target/riscv/vector_helper.c
+++ b/target/riscv/vector_helper.c
@@ -117,25 +117,42 @@ static inline uint32_t vext_max_elems(uint32_t desc, uint32_t log2_esz)
  * It will trigger an exception if there is no mapping in TLB
  * and page table walk can't fill the TLB entry. Then the guest
  * software can return here after process the exception or never return.
+ *
+ * This function can also be used when direct access to probe_access_flags is
+ * needed in order to access the flags. If a pointer to a flags operand is
+ * provided the function will call probe_access_flags instead, use nonfault
+ * and update host and flags.
  */
-static void probe_pages(CPURISCVState *env, target_ulong addr,
-                        target_ulong len, uintptr_t ra,
-                        MMUAccessType access_type)
+static void probe_pages(CPURISCVState *env, target_ulong addr, target_ulong len,
+                        uintptr_t ra, MMUAccessType access_type, int mmu_index,
+                        void **host, int *flags, bool nonfault)
 {
     target_ulong pagelen = -(addr | TARGET_PAGE_MASK);
     target_ulong curlen = MIN(pagelen, len);
-    int mmu_index = riscv_env_mmu_index(env, false);
 
-    probe_access(env, adjust_addr(env, addr), curlen, access_type,
-                 mmu_index, ra);
-    if (len > curlen) {
-        addr += curlen;
-        curlen = len - curlen;
+    if (flags != NULL) {
+        *flags = probe_access_flags(env, adjust_addr(env, addr), curlen,
+                                    access_type, mmu_index, nonfault, host, ra);
+    } else {
         probe_access(env, adjust_addr(env, addr), curlen, access_type,
                      mmu_index, ra);
     }
+
+    if (len > curlen) {
+        addr += curlen;
+        curlen = len - curlen;
+        if (flags != NULL) {
+            *flags = probe_access_flags(env, adjust_addr(env, addr), curlen,
+                                        access_type, mmu_index, nonfault,
+                                        host, ra);
+        } else {
+            probe_access(env, adjust_addr(env, addr), curlen, access_type,
+                         mmu_index, ra);
+        }
+    }
 }
 
+
 static inline void vext_set_elem_mask(void *v0, int index,
                                       uint8_t value)
 {
@@ -335,8 +352,8 @@ vext_page_ldst_us(CPURISCVState *env, void *vd, target_ulong addr,
     MMUAccessType access_type = is_load ? MMU_DATA_LOAD : MMU_DATA_STORE;
 
     /* Check page permission/pmp/watchpoint/etc. */
-    flags = probe_access_flags(env, adjust_addr(env, addr), size, access_type,
-                               mmu_index, true, &host, ra);
+    probe_pages(env, addr, size, ra, access_type, mmu_index, &host, &flags,
+                true);
 
     if (flags == 0) {
         if (nf == 1) {
@@ -635,7 +652,7 @@ vext_ldff(void *vd, void *v0, target_ulong base, CPURISCVState *env,
     uint32_t vma = vext_vma(desc);
     target_ulong addr, addr_probe, addr_i, offset, remain, page_split, elems;
     int mmu_index = riscv_env_mmu_index(env, false);
-    int flags;
+    int flags, probe_flags;
     void *host;
 
     VSTART_CHECK_EARLY_EXIT(env, env->vl);
@@ -649,15 +666,15 @@ vext_ldff(void *vd, void *v0, target_ulong base, CPURISCVState *env,
     }
 
     /* Check page permission/pmp/watchpoint/etc. */
-    flags = probe_access_flags(env, adjust_addr(env, addr), elems * msize,
-                               MMU_DATA_LOAD, mmu_index, true, &host, ra);
+    probe_pages(env, addr, elems * msize, ra, MMU_DATA_LOAD, mmu_index, &host,
+                &flags, true);
 
     /* If we are crossing a page check also the second page. */
     if (env->vl > elems) {
         addr_probe = addr + (elems << log2_esz);
-        flags |= probe_access_flags(env, adjust_addr(env, addr_probe),
-                                    elems * msize, MMU_DATA_LOAD, mmu_index,
-                                    true, &host, ra);
+        probe_pages(env, addr_probe, elems * msize, ra, MMU_DATA_LOAD,
+                    mmu_index, &host, &probe_flags, true);
+        flags |= probe_flags;
     }
 
     if (flags & ~TLB_WATCHPOINT) {
@@ -669,16 +686,16 @@ vext_ldff(void *vd, void *v0, target_ulong base, CPURISCVState *env,
             addr_i = adjust_addr(env, base + i * (nf << log2_esz));
             if (i == 0) {
                 /* Allow fault on first element. */
-                probe_pages(env, addr_i, nf << log2_esz, ra, MMU_DATA_LOAD);
+                probe_pages(env, addr_i, nf << log2_esz, ra, MMU_DATA_LOAD,
+                            mmu_index, &host, NULL, false);
             } else {
                 remain = nf << log2_esz;
                 while (remain > 0) {
                     offset = -(addr_i | TARGET_PAGE_MASK);
 
                     /* Probe nonfault on subsequent elements. */
-                    flags = probe_access_flags(env, addr_i, offset,
-                                               MMU_DATA_LOAD, mmu_index, true,
-                                               &host, 0);
+                    probe_pages(env, addr_i, offset, 0, MMU_DATA_LOAD,
+                                mmu_index, &host, &flags, true);
 
                     /*
                      * Stop if invalid (unmapped) or mmio (transaction may

From 56cde18d048e1e1f889e31f7553e1f39f03eeec5 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Thu, 10 Apr 2025 18:17:22 +0200
Subject: [PATCH 0978/2760] hw/riscv: Fix type conflict of GLib function
 pointers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

qtest_set_command_cb passed to g_once should match GThreadFunc,
which it does not.  But using g_once is actually unnecessary,
because the function is called by riscv_harts_realize() under
the Big QEMU Lock.

Reported-by: Kohei Tokunaga <ktokunaga.mail@gmail.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Kohei Tokunaga <ktokunaga.mail@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250410161722.595634-1-pbonzini@redhat.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Cc: qemu-stable@nongnu.org
---
 hw/riscv/riscv_hart.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/hw/riscv/riscv_hart.c b/hw/riscv/riscv_hart.c
index ac6539bd3e..333083a4f1 100644
--- a/hw/riscv/riscv_hart.c
+++ b/hw/riscv/riscv_hart.c
@@ -104,8 +104,11 @@ static bool csr_qtest_callback(CharBackend *chr, gchar **words)
 
 static void riscv_cpu_register_csr_qtest_callback(void)
 {
-    static GOnce once;
-    g_once(&once, (GThreadFunc)qtest_set_command_cb, csr_qtest_callback);
+    static bool first = true;
+    if (first) {
+        first = false;
+        qtest_set_command_cb(csr_qtest_callback);
+    }
 }
 #endif
 

From ad63158bdb33dab5704ea1cf740d2ea0387175df Mon Sep 17 00:00:00 2001
From: Ziqiao Kong <ziqiaokong@gmail.com>
Date: Tue, 15 Apr 2025 16:02:54 +0800
Subject: [PATCH 0979/2760] target/riscv: fix endless translation loop on big
 endian systems

On big endian systems, pte and updated_pte hold big endian host data
while pte_pa points to little endian target data. This means the branch
at cpu_helper.c:1669 will be always satisfied and restart translation,
causing an endless translation loop.

The correctness of this patch can be deduced by:

old_pte will hold value either from cpu_to_le32/64(pte) or
cpu_to_le32/64(updated_pte), both of wich is litte endian. After that,
an in-place conversion by le32/64_to_cpu(old_pte) ensures that old_pte
now is in native endian, same with pte. Therefore, the endianness of the
both side of if (old_pte != pte) is correct.

Signed-off-by: Ziqiao Kong <ziqiaokong@gmail.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250415080254.3667878-2-ziqiaokong@gmail.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Cc: qemu-stable@nongnu.org
---
 target/riscv/cpu_helper.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index d5039f69a9..2ed69d7c2d 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -1566,9 +1566,11 @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
             target_ulong *pte_pa = qemu_map_ram_ptr(mr->ram_block, addr1);
             target_ulong old_pte;
             if (riscv_cpu_sxl(env) == MXL_RV32) {
-                old_pte = qatomic_cmpxchg((uint32_t *)pte_pa, pte, updated_pte);
+                old_pte = qatomic_cmpxchg((uint32_t *)pte_pa, cpu_to_le32(pte), cpu_to_le32(updated_pte));
+                old_pte = le32_to_cpu(old_pte);
             } else {
-                old_pte = qatomic_cmpxchg(pte_pa, pte, updated_pte);
+                old_pte = qatomic_cmpxchg(pte_pa, cpu_to_le64(pte), cpu_to_le64(updated_pte));
+                old_pte = le64_to_cpu(old_pte);
             }
             if (old_pte != pte) {
                 goto restart;

From 22b448ccc6611a59d4aa54419f4d88c1f343cb35 Mon Sep 17 00:00:00 2001
From: Icenowy Zheng <uwu@icenowy.me>
Date: Thu, 17 Apr 2025 15:22:06 +0800
Subject: [PATCH 0980/2760] common-user/host/riscv: use tail pseudoinstruction
 for calling tail

The j pseudoinstruction maps to a JAL instruction, which can only handle
a jump to somewhere with a signed 20-bit destination. In case of static
linking and LTO'ing this easily leads to "relocation truncated to fit"
error.

Switch to use tail pseudoinstruction, which is the standard way to
tail-call a function in medium code model (emits AUIPC+JALR).

Signed-off-by: Icenowy Zheng <uwu@icenowy.me>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250417072206.364008-1-uwu@icenowy.me>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Cc: qemu-stable@nongnu.org
---
 common-user/host/riscv/safe-syscall.inc.S | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/common-user/host/riscv/safe-syscall.inc.S b/common-user/host/riscv/safe-syscall.inc.S
index dfe83c300e..c8b81e33d0 100644
--- a/common-user/host/riscv/safe-syscall.inc.S
+++ b/common-user/host/riscv/safe-syscall.inc.S
@@ -69,11 +69,11 @@ safe_syscall_end:
 
         /* code path setting errno */
 0:      neg     a0, a0
-        j       safe_syscall_set_errno_tail
+        tail    safe_syscall_set_errno_tail
 
         /* code path when we didn't execute the syscall */
 2:      li      a0, QEMU_ERESTARTSYS
-        j       safe_syscall_set_errno_tail
+        tail    safe_syscall_set_errno_tail
 
         .cfi_endproc
         .size   safe_syscall_base, .-safe_syscall_base

From 3e8d1e4a628bb234c0b5d1ccd510900047181dbd Mon Sep 17 00:00:00 2001
From: Anton Blanchard <antonb@tenstorrent.com>
Date: Tue, 8 Apr 2025 18:39:29 +0800
Subject: [PATCH 0981/2760] target/riscv: rvv: Source vector registers cannot
 overlap mask register

Add the relevant ISA paragraphs explaining why source (and destination)
registers cannot overlap the mask register.

Signed-off-by: Anton Blanchard <antonb@tenstorrent.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Max Chou <max.chou@sifive.com>
Signed-off-by: Max Chou <max.chou@sifive.com>
Message-ID: <20250408103938.3623486-2-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Cc: qemu-stable@nongnu.org
---
 target/riscv/insn_trans/trans_rvv.c.inc | 29 ++++++++++++++++++++++---
 1 file changed, 26 insertions(+), 3 deletions(-)

diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
index 4ca7b15da1..2110392d1c 100644
--- a/target/riscv/insn_trans/trans_rvv.c.inc
+++ b/target/riscv/insn_trans/trans_rvv.c.inc
@@ -100,10 +100,33 @@ static bool require_scale_rvfmin(DisasContext *s)
     }
 }
 
-/* Destination vector register group cannot overlap source mask register. */
-static bool require_vm(int vm, int vd)
+/*
+ * Source and destination vector register groups cannot overlap source mask
+ * register:
+ *
+ * A vector register cannot be used to provide source operands with more than
+ * one EEW for a single instruction. A mask register source is considered to
+ * have EEW=1 for this constraint. An encoding that would result in the same
+ * vector register being read with two or more different EEWs, including when
+ * the vector register appears at different positions within two or more vector
+ * register groups, is reserved.
+ * (Section 5.2)
+ *
+ * A destination vector register group can overlap a source vector
+ * register group only if one of the following holds:
+ *  1. The destination EEW equals the source EEW.
+ *  2. The destination EEW is smaller than the source EEW and the overlap
+ *     is in the lowest-numbered part of the source register group.
+ *  3. The destination EEW is greater than the source EEW, the source EMUL
+ *     is at least 1, and the overlap is in the highest-numbered part of
+ *     the destination register group.
+ * For the purpose of determining register group overlap constraints, mask
+ * elements have EEW=1.
+ * (Section 5.2)
+ */
+static bool require_vm(int vm, int v)
 {
-    return (vm != 0 || vd != 0);
+    return (vm != 0 || v != 0);
 }
 
 static bool require_nf(int vd, int nf, int lmul)

From b0450a101d6c88789d0e8df2bcbef61bc7cd159a Mon Sep 17 00:00:00 2001
From: Anton Blanchard <antonb@tenstorrent.com>
Date: Tue, 8 Apr 2025 18:39:30 +0800
Subject: [PATCH 0982/2760] target/riscv: rvv: Add CHECK arg to
 GEN_OPFVF_WIDEN_TRANS

Signed-off-by: Anton Blanchard <antonb@tenstorrent.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Max Chou <max.chou@sifive.com>
Signed-off-by: Max Chou <max.chou@sifive.com>
Message-ID: <20250408103938.3623486-3-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Cc: qemu-stable@nongnu.org
---
 target/riscv/insn_trans/trans_rvv.c.inc | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
index 2110392d1c..d8333d8311 100644
--- a/target/riscv/insn_trans/trans_rvv.c.inc
+++ b/target/riscv/insn_trans/trans_rvv.c.inc
@@ -2687,10 +2687,10 @@ static bool opfvf_widen_check(DisasContext *s, arg_rmrr *a)
 }
 
 /* OPFVF with WIDEN */
-#define GEN_OPFVF_WIDEN_TRANS(NAME)                              \
+#define GEN_OPFVF_WIDEN_TRANS(NAME, CHECK)                       \
 static bool trans_##NAME(DisasContext *s, arg_rmrr *a)           \
 {                                                                \
-    if (opfvf_widen_check(s, a)) {                               \
+    if (CHECK(s, a)) {                                           \
         uint32_t data = 0;                                       \
         static gen_helper_opfvf *const fns[2] = {                \
             gen_helper_##NAME##_h, gen_helper_##NAME##_w,        \
@@ -2706,8 +2706,8 @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)           \
     return false;                                                \
 }
 
-GEN_OPFVF_WIDEN_TRANS(vfwadd_vf)
-GEN_OPFVF_WIDEN_TRANS(vfwsub_vf)
+GEN_OPFVF_WIDEN_TRANS(vfwadd_vf, opfvf_widen_check)
+GEN_OPFVF_WIDEN_TRANS(vfwsub_vf, opfvf_widen_check)
 
 static bool opfwv_widen_check(DisasContext *s, arg_rmrr *a)
 {
@@ -2789,7 +2789,7 @@ GEN_OPFVF_TRANS(vfrdiv_vf,  opfvf_check)
 
 /* Vector Widening Floating-Point Multiply */
 GEN_OPFVV_WIDEN_TRANS(vfwmul_vv, opfvv_widen_check)
-GEN_OPFVF_WIDEN_TRANS(vfwmul_vf)
+GEN_OPFVF_WIDEN_TRANS(vfwmul_vf, opfvf_widen_check)
 
 /* Vector Single-Width Floating-Point Fused Multiply-Add Instructions */
 GEN_OPFVV_TRANS(vfmacc_vv, opfvv_check)
@@ -2814,10 +2814,10 @@ GEN_OPFVV_WIDEN_TRANS(vfwmacc_vv, opfvv_widen_check)
 GEN_OPFVV_WIDEN_TRANS(vfwnmacc_vv, opfvv_widen_check)
 GEN_OPFVV_WIDEN_TRANS(vfwmsac_vv, opfvv_widen_check)
 GEN_OPFVV_WIDEN_TRANS(vfwnmsac_vv, opfvv_widen_check)
-GEN_OPFVF_WIDEN_TRANS(vfwmacc_vf)
-GEN_OPFVF_WIDEN_TRANS(vfwnmacc_vf)
-GEN_OPFVF_WIDEN_TRANS(vfwmsac_vf)
-GEN_OPFVF_WIDEN_TRANS(vfwnmsac_vf)
+GEN_OPFVF_WIDEN_TRANS(vfwmacc_vf, opfvf_widen_check)
+GEN_OPFVF_WIDEN_TRANS(vfwnmacc_vf, opfvf_widen_check)
+GEN_OPFVF_WIDEN_TRANS(vfwmsac_vf, opfvf_widen_check)
+GEN_OPFVF_WIDEN_TRANS(vfwnmsac_vf, opfvf_widen_check)
 
 /* Vector Floating-Point Square-Root Instruction */
 

From 629c2a8dd7506e1cb9b6b7127604641632ac453f Mon Sep 17 00:00:00 2001
From: Max Chou <max.chou@sifive.com>
Date: Tue, 8 Apr 2025 18:39:31 +0800
Subject: [PATCH 0983/2760] target/riscv: rvv: Apply vext_check_input_eew to
 vrgather instructions to check mismatched input EEWs encoding constraint

According to the v spec, a vector register cannot be used to provide source
operands with more than one EEW for a single instruction.
The vs1 EEW of vrgatherei16.vv is 16.

Co-authored-by: Anton Blanchard <antonb@tenstorrent.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Signed-off-by: Max Chou <max.chou@sifive.com>
Message-ID: <20250408103938.3623486-4-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Cc: qemu-stable@nongnu.org
---
 target/riscv/insn_trans/trans_rvv.c.inc | 32 +++++++++++++++++++++++++
 1 file changed, 32 insertions(+)

diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
index d8333d8311..04367e1bec 100644
--- a/target/riscv/insn_trans/trans_rvv.c.inc
+++ b/target/riscv/insn_trans/trans_rvv.c.inc
@@ -379,6 +379,35 @@ static bool vext_check_ld_index(DisasContext *s, int vd, int vs2,
     return ret;
 }
 
+/*
+ * Check whether a vector register is used to provide source operands with
+ * more than one EEW for the vector instruction.
+ * Returns true if the instruction has valid encoding
+ * Returns false if encoding violates the mismatched input EEWs constraint
+ */
+static bool vext_check_input_eew(DisasContext *s, int vs1, uint8_t eew_vs1,
+                                 int vs2, uint8_t eew_vs2, int vm)
+{
+    bool is_valid = true;
+    int8_t emul_vs1 = eew_vs1 - s->sew + s->lmul;
+    int8_t emul_vs2 = eew_vs2 - s->sew + s->lmul;
+
+    /* When vm is 0, vs1 & vs2(EEW!=1) group can't overlap v0 (EEW=1) */
+    if ((vs1 != -1 && !require_vm(vm, vs1)) ||
+        (vs2 != -1 && !require_vm(vm, vs2))) {
+        is_valid = false;
+    }
+
+    /* When eew_vs1 != eew_vs2, check whether vs1 and vs2 are overlapped */
+    if ((vs1 != -1 && vs2 != -1) && (eew_vs1 != eew_vs2) &&
+        is_overlapped(vs1, 1 << MAX(emul_vs1, 0),
+                      vs2, 1 << MAX(emul_vs2, 0))) {
+        is_valid = false;
+    }
+
+    return is_valid;
+}
+
 static bool vext_check_ss(DisasContext *s, int vd, int vs, int vm)
 {
     return require_vm(vm, vd) &&
@@ -3733,6 +3762,7 @@ static bool vrgather_vv_check(DisasContext *s, arg_rmrr *a)
 {
     return require_rvv(s) &&
            vext_check_isa_ill(s) &&
+           vext_check_input_eew(s, a->rs1, s->sew, a->rs2, s->sew, a->vm) &&
            require_align(a->rd, s->lmul) &&
            require_align(a->rs1, s->lmul) &&
            require_align(a->rs2, s->lmul) &&
@@ -3745,6 +3775,7 @@ static bool vrgatherei16_vv_check(DisasContext *s, arg_rmrr *a)
     int8_t emul = MO_16 - s->sew + s->lmul;
     return require_rvv(s) &&
            vext_check_isa_ill(s) &&
+           vext_check_input_eew(s, a->rs1, MO_16, a->rs2, s->sew, a->vm) &&
            (emul >= -3 && emul <= 3) &&
            require_align(a->rd, s->lmul) &&
            require_align(a->rs1, emul) &&
@@ -3764,6 +3795,7 @@ static bool vrgather_vx_check(DisasContext *s, arg_rmrr *a)
 {
     return require_rvv(s) &&
            vext_check_isa_ill(s) &&
+           vext_check_input_eew(s, -1, MO_64, a->rs2, s->sew, a->vm) &&
            require_align(a->rd, s->lmul) &&
            require_align(a->rs2, s->lmul) &&
            (a->rd != a->rs2) &&

From fbeaf35838768086b435833cb4dc5182c73ec2bc Mon Sep 17 00:00:00 2001
From: Max Chou <max.chou@sifive.com>
Date: Tue, 8 Apr 2025 18:39:32 +0800
Subject: [PATCH 0984/2760] target/riscv: rvv: Apply vext_check_input_eew to
 OPIVI/OPIVX/OPFVF(vext_check_ss) instructions

Handle the overlap of source registers with different EEWs.

Co-authored-by: Anton Blanchard <antonb@tenstorrent.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Signed-off-by: Max Chou <max.chou@sifive.com>
Message-ID: <20250408103938.3623486-5-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Cc: qemu-stable@nongnu.org
---
 target/riscv/insn_trans/trans_rvv.c.inc | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
index 04367e1bec..b1e1db04a0 100644
--- a/target/riscv/insn_trans/trans_rvv.c.inc
+++ b/target/riscv/insn_trans/trans_rvv.c.inc
@@ -412,7 +412,8 @@ static bool vext_check_ss(DisasContext *s, int vd, int vs, int vm)
 {
     return require_vm(vm, vd) &&
            require_align(vd, s->lmul) &&
-           require_align(vs, s->lmul);
+           require_align(vs, s->lmul) &&
+           vext_check_input_eew(s, vs, s->sew, -1, s->sew, vm);
 }
 
 /*

From fda68acb7761af40df78db18e44ca1ff20195fe0 Mon Sep 17 00:00:00 2001
From: Max Chou <max.chou@sifive.com>
Date: Tue, 8 Apr 2025 18:39:33 +0800
Subject: [PATCH 0985/2760] target/riscv: rvv: Apply vext_check_input_eew to
 OPIVV/OPFVV(vext_check_sss) instructions

Handle the overlap of source registers with different EEWs.

Co-authored-by: Anton Blanchard <antonb@tenstorrent.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Signed-off-by: Max Chou <max.chou@sifive.com>
Message-ID: <20250408103938.3623486-6-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Cc: qemu-stable@nongnu.org
---
 target/riscv/insn_trans/trans_rvv.c.inc | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
index b1e1db04a0..5de50422c9 100644
--- a/target/riscv/insn_trans/trans_rvv.c.inc
+++ b/target/riscv/insn_trans/trans_rvv.c.inc
@@ -432,6 +432,7 @@ static bool vext_check_ss(DisasContext *s, int vd, int vs, int vm)
 static bool vext_check_sss(DisasContext *s, int vd, int vs1, int vs2, int vm)
 {
     return vext_check_ss(s, vd, vs2, vm) &&
+           vext_check_input_eew(s, vs1, s->sew, vs2, s->sew, vm) &&
            require_align(vs1, s->lmul);
 }
 

From b5480a693e3e657108746721ffe434b3bb6e7a72 Mon Sep 17 00:00:00 2001
From: Max Chou <max.chou@sifive.com>
Date: Tue, 8 Apr 2025 18:39:34 +0800
Subject: [PATCH 0986/2760] target/riscv: rvv: Apply vext_check_input_eew to
 vector slide instructions(OPIVI/OPIVX)

Handle the overlap of source registers with different EEWs.

Co-authored-by: Anton Blanchard <antonb@tenstorrent.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Signed-off-by: Max Chou <max.chou@sifive.com>
Message-ID: <20250408103938.3623486-7-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Cc: qemu-stable@nongnu.org
---
 target/riscv/insn_trans/trans_rvv.c.inc | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
index 5de50422c9..841692701c 100644
--- a/target/riscv/insn_trans/trans_rvv.c.inc
+++ b/target/riscv/insn_trans/trans_rvv.c.inc
@@ -638,7 +638,9 @@ static bool vext_check_slide(DisasContext *s, int vd, int vs2,
 {
     bool ret = require_align(vs2, s->lmul) &&
                require_align(vd, s->lmul) &&
-               require_vm(vm, vd);
+               require_vm(vm, vd) &&
+               vext_check_input_eew(s, -1, 0, vs2, s->sew, vm);
+
     if (is_over) {
         ret &= (vd != vs2);
     }

From 411eefd56a3921ddbfdbadca596e1a8593ce834c Mon Sep 17 00:00:00 2001
From: Max Chou <max.chou@sifive.com>
Date: Tue, 8 Apr 2025 18:39:35 +0800
Subject: [PATCH 0987/2760] target/riscv: rvv: Apply vext_check_input_eew to
 vector integer extension instructions(OPMVV)

Handle the overlap of source registers with different EEWs.

Co-authored-by: Anton Blanchard <antonb@tenstorrent.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Signed-off-by: Max Chou <max.chou@sifive.com>
Message-ID: <20250408103938.3623486-8-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Cc: qemu-stable@nongnu.org
---
 target/riscv/insn_trans/trans_rvv.c.inc | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
index 841692701c..954f03291b 100644
--- a/target/riscv/insn_trans/trans_rvv.c.inc
+++ b/target/riscv/insn_trans/trans_rvv.c.inc
@@ -3943,7 +3943,9 @@ static bool int_ext_check(DisasContext *s, arg_rmr *a, uint8_t div)
         require_align(a->rd, s->lmul) &&
         require_align(a->rs2, s->lmul - div) &&
         require_vm(a->vm, a->rd) &&
-        require_noover(a->rd, s->lmul, a->rs2, s->lmul - div);
+        require_noover(a->rd, s->lmul, a->rs2, s->lmul - div) &&
+        vext_check_input_eew(s, -1, 0, a->rs2, s->sew, a->vm);
+
     return ret;
 }
 

From 1f090a229f85e662394267680408bd31fd0a99c9 Mon Sep 17 00:00:00 2001
From: Max Chou <max.chou@sifive.com>
Date: Tue, 8 Apr 2025 18:39:36 +0800
Subject: [PATCH 0988/2760] target/riscv: rvv: Apply vext_check_input_eew to
 vector narrow/widen instructions

Handle the overlap of source registers with different EEWs.
The vd of vector widening mul-add instructions is one of the input
operands.

Co-authored-by: Anton Blanchard <antonb@tenstorrent.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Signed-off-by: Max Chou <max.chou@sifive.com>
Message-ID: <20250408103938.3623486-9-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Cc: qemu-stable@nongnu.org
---
 target/riscv/insn_trans/trans_rvbf16.c.inc |  9 ++-
 target/riscv/insn_trans/trans_rvv.c.inc    | 77 +++++++++++++++++-----
 2 files changed, 68 insertions(+), 18 deletions(-)

diff --git a/target/riscv/insn_trans/trans_rvbf16.c.inc b/target/riscv/insn_trans/trans_rvbf16.c.inc
index 0a9cd1ec31..066dc364c5 100644
--- a/target/riscv/insn_trans/trans_rvbf16.c.inc
+++ b/target/riscv/insn_trans/trans_rvbf16.c.inc
@@ -119,8 +119,11 @@ static bool trans_vfwmaccbf16_vv(DisasContext *ctx, arg_vfwmaccbf16_vv *a)
     REQUIRE_FPU;
     REQUIRE_ZVFBFWMA(ctx);
 
+    uint8_t sew = ctx->sew;
     if (require_rvv(ctx) && vext_check_isa_ill(ctx) && (ctx->sew == MO_16) &&
-        vext_check_dss(ctx, a->rd, a->rs1, a->rs2, a->vm)) {
+        vext_check_dss(ctx, a->rd, a->rs1, a->rs2, a->vm) &&
+        vext_check_input_eew(ctx, a->rd, sew + 1, a->rs1, sew, a->vm) &&
+        vext_check_input_eew(ctx, a->rd, sew + 1, a->rs2, sew, a->vm)) {
         uint32_t data = 0;
 
         gen_set_rm_chkfrm(ctx, RISCV_FRM_DYN);
@@ -146,8 +149,10 @@ static bool trans_vfwmaccbf16_vf(DisasContext *ctx, arg_vfwmaccbf16_vf *a)
     REQUIRE_FPU;
     REQUIRE_ZVFBFWMA(ctx);
 
+    uint8_t sew = ctx->sew;
     if (require_rvv(ctx) && (ctx->sew == MO_16) && vext_check_isa_ill(ctx) &&
-        vext_check_ds(ctx, a->rd, a->rs2, a->vm)) {
+        vext_check_ds(ctx, a->rd, a->rs2, a->vm) &&
+        vext_check_input_eew(ctx, a->rd, sew + 1, a->rs2, sew, a->vm)) {
         uint32_t data = 0;
 
         gen_set_rm(ctx, RISCV_FRM_DYN);
diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
index 954f03291b..1d2b46fc44 100644
--- a/target/riscv/insn_trans/trans_rvv.c.inc
+++ b/target/riscv/insn_trans/trans_rvv.c.inc
@@ -528,6 +528,7 @@ static bool vext_narrow_check_common(DisasContext *s, int vd, int vs2,
 static bool vext_check_ds(DisasContext *s, int vd, int vs, int vm)
 {
     return vext_wide_check_common(s, vd, vm) &&
+           vext_check_input_eew(s, vs, s->sew, -1, 0, vm) &&
            require_align(vs, s->lmul) &&
            require_noover(vd, s->lmul + 1, vs, s->lmul);
 }
@@ -535,6 +536,7 @@ static bool vext_check_ds(DisasContext *s, int vd, int vs, int vm)
 static bool vext_check_dd(DisasContext *s, int vd, int vs, int vm)
 {
     return vext_wide_check_common(s, vd, vm) &&
+           vext_check_input_eew(s, vs, s->sew + 1, -1, 0, vm) &&
            require_align(vs, s->lmul + 1);
 }
 
@@ -553,6 +555,7 @@ static bool vext_check_dd(DisasContext *s, int vd, int vs, int vm)
 static bool vext_check_dss(DisasContext *s, int vd, int vs1, int vs2, int vm)
 {
     return vext_check_ds(s, vd, vs2, vm) &&
+           vext_check_input_eew(s, vs1, s->sew, vs2, s->sew, vm) &&
            require_align(vs1, s->lmul) &&
            require_noover(vd, s->lmul + 1, vs1, s->lmul);
 }
@@ -575,12 +578,14 @@ static bool vext_check_dss(DisasContext *s, int vd, int vs1, int vs2, int vm)
 static bool vext_check_dds(DisasContext *s, int vd, int vs1, int vs2, int vm)
 {
     return vext_check_ds(s, vd, vs1, vm) &&
+           vext_check_input_eew(s, vs1, s->sew, vs2, s->sew + 1, vm) &&
            require_align(vs2, s->lmul + 1);
 }
 
 static bool vext_check_sd(DisasContext *s, int vd, int vs, int vm)
 {
-    bool ret = vext_narrow_check_common(s, vd, vs, vm);
+    bool ret = vext_narrow_check_common(s, vd, vs, vm) &&
+               vext_check_input_eew(s, vs, s->sew + 1, -1, 0, vm);
     if (vd != vs) {
         ret &= require_noover(vd, s->lmul, vs, s->lmul + 1);
     }
@@ -603,6 +608,7 @@ static bool vext_check_sd(DisasContext *s, int vd, int vs, int vm)
 static bool vext_check_sds(DisasContext *s, int vd, int vs1, int vs2, int vm)
 {
     return vext_check_sd(s, vd, vs2, vm) &&
+           vext_check_input_eew(s, vs1, s->sew, vs2, s->sew + 1, vm) &&
            require_align(vs1, s->lmul);
 }
 
@@ -1815,6 +1821,16 @@ static bool opivv_widen_check(DisasContext *s, arg_rmrr *a)
            vext_check_dss(s, a->rd, a->rs1, a->rs2, a->vm);
 }
 
+/* OPIVV with overwrite and WIDEN */
+static bool opivv_overwrite_widen_check(DisasContext *s, arg_rmrr *a)
+{
+    return require_rvv(s) &&
+           vext_check_isa_ill(s) &&
+           vext_check_dss(s, a->rd, a->rs1, a->rs2, a->vm) &&
+           vext_check_input_eew(s, a->rd, s->sew + 1, a->rs1, s->sew, a->vm) &&
+           vext_check_input_eew(s, a->rd, s->sew + 1, a->rs2, s->sew, a->vm);
+}
+
 static bool do_opivv_widen(DisasContext *s, arg_rmrr *a,
                            gen_helper_gvec_4_ptr *fn,
                            bool (*checkfn)(DisasContext *, arg_rmrr *))
@@ -1862,6 +1878,14 @@ static bool opivx_widen_check(DisasContext *s, arg_rmrr *a)
            vext_check_ds(s, a->rd, a->rs2, a->vm);
 }
 
+static bool opivx_overwrite_widen_check(DisasContext *s, arg_rmrr *a)
+{
+    return require_rvv(s) &&
+           vext_check_isa_ill(s) &&
+           vext_check_ds(s, a->rd, a->rs2, a->vm) &&
+           vext_check_input_eew(s, a->rd, s->sew + 1, a->rs2, s->sew, a->vm);
+}
+
 #define GEN_OPIVX_WIDEN_TRANS(NAME, CHECK) \
 static bool trans_##NAME(DisasContext *s, arg_rmrr *a)                    \
 {                                                                         \
@@ -2333,13 +2357,13 @@ GEN_OPIVX_TRANS(vmadd_vx, opivx_check)
 GEN_OPIVX_TRANS(vnmsub_vx, opivx_check)
 
 /* Vector Widening Integer Multiply-Add Instructions */
-GEN_OPIVV_WIDEN_TRANS(vwmaccu_vv, opivv_widen_check)
-GEN_OPIVV_WIDEN_TRANS(vwmacc_vv, opivv_widen_check)
-GEN_OPIVV_WIDEN_TRANS(vwmaccsu_vv, opivv_widen_check)
-GEN_OPIVX_WIDEN_TRANS(vwmaccu_vx, opivx_widen_check)
-GEN_OPIVX_WIDEN_TRANS(vwmacc_vx, opivx_widen_check)
-GEN_OPIVX_WIDEN_TRANS(vwmaccsu_vx, opivx_widen_check)
-GEN_OPIVX_WIDEN_TRANS(vwmaccus_vx, opivx_widen_check)
+GEN_OPIVV_WIDEN_TRANS(vwmaccu_vv, opivv_overwrite_widen_check)
+GEN_OPIVV_WIDEN_TRANS(vwmacc_vv, opivv_overwrite_widen_check)
+GEN_OPIVV_WIDEN_TRANS(vwmaccsu_vv, opivv_overwrite_widen_check)
+GEN_OPIVX_WIDEN_TRANS(vwmaccu_vx, opivx_overwrite_widen_check)
+GEN_OPIVX_WIDEN_TRANS(vwmacc_vx, opivx_overwrite_widen_check)
+GEN_OPIVX_WIDEN_TRANS(vwmaccsu_vx, opivx_overwrite_widen_check)
+GEN_OPIVX_WIDEN_TRANS(vwmaccus_vx, opivx_overwrite_widen_check)
 
 /* Vector Integer Merge and Move Instructions */
 static bool trans_vmv_v_v(DisasContext *s, arg_vmv_v_v *a)
@@ -2680,6 +2704,17 @@ static bool opfvv_widen_check(DisasContext *s, arg_rmrr *a)
            vext_check_dss(s, a->rd, a->rs1, a->rs2, a->vm);
 }
 
+static bool opfvv_overwrite_widen_check(DisasContext *s, arg_rmrr *a)
+{
+    return require_rvv(s) &&
+           require_rvf(s) &&
+           require_scale_rvf(s) &&
+           vext_check_isa_ill(s) &&
+           vext_check_dss(s, a->rd, a->rs1, a->rs2, a->vm) &&
+           vext_check_input_eew(s, a->rd, s->sew + 1, a->rs1, s->sew, a->vm) &&
+           vext_check_input_eew(s, a->rd, s->sew + 1, a->rs2, s->sew, a->vm);
+}
+
 /* OPFVV with WIDEN */
 #define GEN_OPFVV_WIDEN_TRANS(NAME, CHECK)                       \
 static bool trans_##NAME(DisasContext *s, arg_rmrr *a)           \
@@ -2719,6 +2754,16 @@ static bool opfvf_widen_check(DisasContext *s, arg_rmrr *a)
            vext_check_ds(s, a->rd, a->rs2, a->vm);
 }
 
+static bool opfvf_overwrite_widen_check(DisasContext *s, arg_rmrr *a)
+{
+    return require_rvv(s) &&
+           require_rvf(s) &&
+           require_scale_rvf(s) &&
+           vext_check_isa_ill(s) &&
+           vext_check_ds(s, a->rd, a->rs2, a->vm) &&
+           vext_check_input_eew(s, a->rd, s->sew + 1, a->rs2, s->sew, a->vm);
+}
+
 /* OPFVF with WIDEN */
 #define GEN_OPFVF_WIDEN_TRANS(NAME, CHECK)                       \
 static bool trans_##NAME(DisasContext *s, arg_rmrr *a)           \
@@ -2843,14 +2888,14 @@ GEN_OPFVF_TRANS(vfmsub_vf, opfvf_check)
 GEN_OPFVF_TRANS(vfnmsub_vf, opfvf_check)
 
 /* Vector Widening Floating-Point Fused Multiply-Add Instructions */
-GEN_OPFVV_WIDEN_TRANS(vfwmacc_vv, opfvv_widen_check)
-GEN_OPFVV_WIDEN_TRANS(vfwnmacc_vv, opfvv_widen_check)
-GEN_OPFVV_WIDEN_TRANS(vfwmsac_vv, opfvv_widen_check)
-GEN_OPFVV_WIDEN_TRANS(vfwnmsac_vv, opfvv_widen_check)
-GEN_OPFVF_WIDEN_TRANS(vfwmacc_vf, opfvf_widen_check)
-GEN_OPFVF_WIDEN_TRANS(vfwnmacc_vf, opfvf_widen_check)
-GEN_OPFVF_WIDEN_TRANS(vfwmsac_vf, opfvf_widen_check)
-GEN_OPFVF_WIDEN_TRANS(vfwnmsac_vf, opfvf_widen_check)
+GEN_OPFVV_WIDEN_TRANS(vfwmacc_vv, opfvv_overwrite_widen_check)
+GEN_OPFVV_WIDEN_TRANS(vfwnmacc_vv, opfvv_overwrite_widen_check)
+GEN_OPFVV_WIDEN_TRANS(vfwmsac_vv, opfvv_overwrite_widen_check)
+GEN_OPFVV_WIDEN_TRANS(vfwnmsac_vv, opfvv_overwrite_widen_check)
+GEN_OPFVF_WIDEN_TRANS(vfwmacc_vf, opfvf_overwrite_widen_check)
+GEN_OPFVF_WIDEN_TRANS(vfwnmacc_vf, opfvf_overwrite_widen_check)
+GEN_OPFVF_WIDEN_TRANS(vfwmsac_vf, opfvf_overwrite_widen_check)
+GEN_OPFVF_WIDEN_TRANS(vfwnmsac_vf, opfvf_overwrite_widen_check)
 
 /* Vector Floating-Point Square-Root Instruction */
 

From db21c3eb05504c4cedaad4f7b19e588361b02385 Mon Sep 17 00:00:00 2001
From: Max Chou <max.chou@sifive.com>
Date: Tue, 8 Apr 2025 18:39:37 +0800
Subject: [PATCH 0989/2760] target/riscv: rvv: Apply vext_check_input_eew to
 vector indexed load/store instructions

Handle the overlap of source registers with different EEWs.

Co-authored-by: Anton Blanchard <antonb@tenstorrent.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Signed-off-by: Max Chou <max.chou@sifive.com>
Message-ID: <20250408103938.3623486-10-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Cc: qemu-stable@nongnu.org
---
 target/riscv/insn_trans/trans_rvv.c.inc | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
index 1d2b46fc44..2b6077ac06 100644
--- a/target/riscv/insn_trans/trans_rvv.c.inc
+++ b/target/riscv/insn_trans/trans_rvv.c.inc
@@ -1277,7 +1277,8 @@ static bool ld_index_check(DisasContext *s, arg_rnfvm* a, uint8_t eew)
 {
     return require_rvv(s) &&
            vext_check_isa_ill(s) &&
-           vext_check_ld_index(s, a->rd, a->rs2, a->nf, a->vm, eew);
+           vext_check_ld_index(s, a->rd, a->rs2, a->nf, a->vm, eew) &&
+           vext_check_input_eew(s, -1, 0, a->rs2, eew, a->vm);
 }
 
 GEN_VEXT_TRANS(vlxei8_v,  MO_8,  rnfvm, ld_index_op, ld_index_check)
@@ -1329,7 +1330,8 @@ static bool st_index_check(DisasContext *s, arg_rnfvm* a, uint8_t eew)
 {
     return require_rvv(s) &&
            vext_check_isa_ill(s) &&
-           vext_check_st_index(s, a->rd, a->rs2, a->nf, eew);
+           vext_check_st_index(s, a->rd, a->rs2, a->nf, eew) &&
+           vext_check_input_eew(s, a->rd, s->sew, a->rs2, eew, a->vm);
 }
 
 GEN_VEXT_TRANS(vsxei8_v,  MO_8,  rnfvm, st_index_op, st_index_check)

From 8539a1244bf240d28917effb88a140eb58e45e88 Mon Sep 17 00:00:00 2001
From: Max Chou <max.chou@sifive.com>
Date: Tue, 8 Apr 2025 18:39:38 +0800
Subject: [PATCH 0990/2760] target/riscv: Fix the rvv reserved encoding of
 unmasked instructions

According to the v spec, the encodings of vcomoress.vm and vector
mask-register logical instructions with vm=0 are reserved.

Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Signed-off-by: Max Chou <max.chou@sifive.com>
Message-ID: <20250408103938.3623486-11-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Cc: qemu-stable@nongnu.org
---
 target/riscv/insn32.decode | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
index 6d1a13c826..cd23b1f3a9 100644
--- a/target/riscv/insn32.decode
+++ b/target/riscv/insn32.decode
@@ -703,14 +703,14 @@ vfredmax_vs     000111 . ..... ..... 001 ..... 1010111 @r_vm
 # Vector widening ordered and unordered float reduction sum
 vfwredusum_vs   110001 . ..... ..... 001 ..... 1010111 @r_vm
 vfwredosum_vs   110011 . ..... ..... 001 ..... 1010111 @r_vm
-vmand_mm        011001 - ..... ..... 010 ..... 1010111 @r
-vmnand_mm       011101 - ..... ..... 010 ..... 1010111 @r
-vmandn_mm       011000 - ..... ..... 010 ..... 1010111 @r
-vmxor_mm        011011 - ..... ..... 010 ..... 1010111 @r
-vmor_mm         011010 - ..... ..... 010 ..... 1010111 @r
-vmnor_mm        011110 - ..... ..... 010 ..... 1010111 @r
-vmorn_mm        011100 - ..... ..... 010 ..... 1010111 @r
-vmxnor_mm       011111 - ..... ..... 010 ..... 1010111 @r
+vmand_mm        011001 1 ..... ..... 010 ..... 1010111 @r
+vmnand_mm       011101 1 ..... ..... 010 ..... 1010111 @r
+vmandn_mm       011000 1 ..... ..... 010 ..... 1010111 @r
+vmxor_mm        011011 1 ..... ..... 010 ..... 1010111 @r
+vmor_mm         011010 1 ..... ..... 010 ..... 1010111 @r
+vmnor_mm        011110 1 ..... ..... 010 ..... 1010111 @r
+vmorn_mm        011100 1 ..... ..... 010 ..... 1010111 @r
+vmxnor_mm       011111 1 ..... ..... 010 ..... 1010111 @r
 vcpop_m         010000 . ..... 10000 010 ..... 1010111 @r2_vm
 vfirst_m        010000 . ..... 10001 010 ..... 1010111 @r2_vm
 vmsbf_m         010100 . ..... 00001 010 ..... 1010111 @r2_vm
@@ -732,7 +732,7 @@ vrgather_vv     001100 . ..... ..... 000 ..... 1010111 @r_vm
 vrgatherei16_vv 001110 . ..... ..... 000 ..... 1010111 @r_vm
 vrgather_vx     001100 . ..... ..... 100 ..... 1010111 @r_vm
 vrgather_vi     001100 . ..... ..... 011 ..... 1010111 @r_vm
-vcompress_vm    010111 - ..... ..... 010 ..... 1010111 @r
+vcompress_vm    010111 1 ..... ..... 010 ..... 1010111 @r
 vmv1r_v         100111 1 ..... 00000 011 ..... 1010111 @r2rd
 vmv2r_v         100111 1 ..... 00001 011 ..... 1010111 @r2rd
 vmv4r_v         100111 1 ..... 00011 011 ..... 1010111 @r2rd

From 2669b696e243b64f8ea1a6468dcee255de99f08d Mon Sep 17 00:00:00 2001
From: Anton Blanchard <antonb@tenstorrent.com>
Date: Mon, 14 Apr 2025 21:30:06 +0000
Subject: [PATCH 0991/2760] target/riscv: Fix vslidedown with rvv_ta_all_1s

vslidedown always zeroes elements past vl, where it should use the
tail policy.

Signed-off-by: Anton Blanchard <antonb@tenstorrent.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250414213006.3509058-1-antonb@tenstorrent.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Cc: qemu-stable@nongnu.org
---
 target/riscv/vector_helper.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
index 3aec9a7731..5dc1c10012 100644
--- a/target/riscv/vector_helper.c
+++ b/target/riscv/vector_helper.c
@@ -5133,9 +5133,11 @@ void HELPER(NAME)(void *vd, void *v0, target_ulong s1, void *vs2,         \
     }                                                                     \
                                                                           \
     for (i = i_max; i < vl; ++i) {                                        \
-        if (vm || vext_elem_mask(v0, i)) {                                \
-            *((ETYPE *)vd + H(i)) = 0;                                    \
+        if (!vm && !vext_elem_mask(v0, i)) {                              \
+            vext_set_elems_1s(vd, vma, i * esz, (i + 1) * esz);           \
+            continue;                                                     \
         }                                                                 \
+        *((ETYPE *)vd + H(i)) = 0;                                        \
     }                                                                     \
                                                                           \
     env->vstart = 0;                                                      \

From 355cdac7d86ca2bc1b3729a6dda0b98deb23a92b Mon Sep 17 00:00:00 2001
From: Alistair Francis <alistair23@gmail.com>
Date: Tue, 22 Apr 2025 12:47:52 +1000
Subject: [PATCH 0992/2760] MAINTAINERS: Add common-user/host/riscv to RISC-V
 section
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250422024752.2060289-1-alistair.francis@wdc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 MAINTAINERS | 1 +
 1 file changed, 1 insertion(+)

diff --git a/MAINTAINERS b/MAINTAINERS
index 57dddcc80d..7060cf49b9 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -328,6 +328,7 @@ F: include/hw/char/riscv_htif.h
 F: include/hw/riscv/
 F: linux-user/host/riscv32/
 F: linux-user/host/riscv64/
+F: common-user/host/riscv*
 F: tests/functional/test_riscv*
 F: tests/tcg/riscv64/
 

From 6c8954cb35b1898f94d0d1e60f1abc8d47ae9f02 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 25 Apr 2025 08:23:05 -0700
Subject: [PATCH 0993/2760] target/riscv: Pass ra to riscv_csr_write_fn
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250425152311.804338-2-richard.henderson@linaro.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h |   3 +-
 target/riscv/csr.c | 226 +++++++++++++++++++++++----------------------
 2 files changed, 118 insertions(+), 111 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index c66ac3bc27..4265ce06ee 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -838,7 +838,8 @@ typedef RISCVException (*riscv_csr_predicate_fn)(CPURISCVState *env,
 typedef RISCVException (*riscv_csr_read_fn)(CPURISCVState *env, int csrno,
                                             target_ulong *ret_value);
 typedef RISCVException (*riscv_csr_write_fn)(CPURISCVState *env, int csrno,
-                                             target_ulong new_value);
+                                             target_ulong new_value,
+                                             uintptr_t ra);
 typedef RISCVException (*riscv_csr_op_fn)(CPURISCVState *env, int csrno,
                                           target_ulong *ret_value,
                                           target_ulong new_value,
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index a32e1455c9..ba7620ef3d 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -830,13 +830,15 @@ static RISCVException seed(CPURISCVState *env, int csrno)
 }
 
 /* zicfiss CSR_SSP read and write */
-static int read_ssp(CPURISCVState *env, int csrno, target_ulong *val)
+static RISCVException read_ssp(CPURISCVState *env, int csrno,
+                               target_ulong *val)
 {
     *val = env->ssp;
     return RISCV_EXCP_NONE;
 }
 
-static int write_ssp(CPURISCVState *env, int csrno, target_ulong val)
+static RISCVException write_ssp(CPURISCVState *env, int csrno,
+                                target_ulong val, uintptr_t ra)
 {
     env->ssp = val;
     return RISCV_EXCP_NONE;
@@ -851,7 +853,7 @@ static RISCVException read_fflags(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_fflags(CPURISCVState *env, int csrno,
-                                   target_ulong val)
+                                   target_ulong val, uintptr_t ra)
 {
 #if !defined(CONFIG_USER_ONLY)
     if (riscv_has_ext(env, RVF)) {
@@ -870,7 +872,7 @@ static RISCVException read_frm(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_frm(CPURISCVState *env, int csrno,
-                                target_ulong val)
+                                target_ulong val, uintptr_t ra)
 {
 #if !defined(CONFIG_USER_ONLY)
     if (riscv_has_ext(env, RVF)) {
@@ -890,7 +892,7 @@ static RISCVException read_fcsr(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_fcsr(CPURISCVState *env, int csrno,
-                                 target_ulong val)
+                                 target_ulong val, uintptr_t ra)
 {
 #if !defined(CONFIG_USER_ONLY)
     if (riscv_has_ext(env, RVF)) {
@@ -942,7 +944,7 @@ static RISCVException read_vxrm(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_vxrm(CPURISCVState *env, int csrno,
-                                 target_ulong val)
+                                 target_ulong val, uintptr_t ra)
 {
 #if !defined(CONFIG_USER_ONLY)
     env->mstatus |= MSTATUS_VS;
@@ -959,7 +961,7 @@ static RISCVException read_vxsat(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_vxsat(CPURISCVState *env, int csrno,
-                                  target_ulong val)
+                                  target_ulong val, uintptr_t ra)
 {
 #if !defined(CONFIG_USER_ONLY)
     env->mstatus |= MSTATUS_VS;
@@ -976,7 +978,7 @@ static RISCVException read_vstart(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_vstart(CPURISCVState *env, int csrno,
-                                   target_ulong val)
+                                   target_ulong val, uintptr_t ra)
 {
 #if !defined(CONFIG_USER_ONLY)
     env->mstatus |= MSTATUS_VS;
@@ -997,7 +999,7 @@ static RISCVException read_vcsr(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_vcsr(CPURISCVState *env, int csrno,
-                                 target_ulong val)
+                                 target_ulong val, uintptr_t ra)
 {
 #if !defined(CONFIG_USER_ONLY)
     env->mstatus |= MSTATUS_VS;
@@ -1055,7 +1057,7 @@ static RISCVException read_mcyclecfg(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_mcyclecfg(CPURISCVState *env, int csrno,
-                                      target_ulong val)
+                                      target_ulong val, uintptr_t ra)
 {
     uint64_t inh_avail_mask;
 
@@ -1084,7 +1086,7 @@ static RISCVException read_mcyclecfgh(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_mcyclecfgh(CPURISCVState *env, int csrno,
-                                       target_ulong val)
+                                       target_ulong val, uintptr_t ra)
 {
     target_ulong inh_avail_mask = (target_ulong)(~MHPMEVENTH_FILTER_MASK |
                                                  MCYCLECFGH_BIT_MINH);
@@ -1109,7 +1111,7 @@ static RISCVException read_minstretcfg(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_minstretcfg(CPURISCVState *env, int csrno,
-                                        target_ulong val)
+                                        target_ulong val, uintptr_t ra)
 {
     uint64_t inh_avail_mask;
 
@@ -1136,7 +1138,7 @@ static RISCVException read_minstretcfgh(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_minstretcfgh(CPURISCVState *env, int csrno,
-                                         target_ulong val)
+                                         target_ulong val, uintptr_t ra)
 {
     target_ulong inh_avail_mask = (target_ulong)(~MHPMEVENTH_FILTER_MASK |
                                                  MINSTRETCFGH_BIT_MINH);
@@ -1163,7 +1165,7 @@ static RISCVException read_mhpmevent(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_mhpmevent(CPURISCVState *env, int csrno,
-                                      target_ulong val)
+                                      target_ulong val, uintptr_t ra)
 {
     int evt_index = csrno - CSR_MCOUNTINHIBIT;
     uint64_t mhpmevt_val = val;
@@ -1201,7 +1203,7 @@ static RISCVException read_mhpmeventh(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_mhpmeventh(CPURISCVState *env, int csrno,
-                                       target_ulong val)
+                                       target_ulong val, uintptr_t ra)
 {
     int evt_index = csrno - CSR_MHPMEVENT3H + 3;
     uint64_t mhpmevth_val;
@@ -1343,14 +1345,16 @@ static RISCVException riscv_pmu_write_ctrh(CPURISCVState *env, target_ulong val,
     return RISCV_EXCP_NONE;
 }
 
-static int write_mhpmcounter(CPURISCVState *env, int csrno, target_ulong val)
+static RISCVException write_mhpmcounter(CPURISCVState *env, int csrno,
+                                        target_ulong val, uintptr_t ra)
 {
     int ctr_idx = csrno - CSR_MCYCLE;
 
     return riscv_pmu_write_ctr(env, val, ctr_idx);
 }
 
-static int write_mhpmcounterh(CPURISCVState *env, int csrno, target_ulong val)
+static RISCVException write_mhpmcounterh(CPURISCVState *env, int csrno,
+                                         target_ulong val, uintptr_t ra)
 {
     int ctr_idx = csrno - CSR_MCYCLEH;
 
@@ -1661,7 +1665,7 @@ static RISCVException read_vstimecmph(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_vstimecmp(CPURISCVState *env, int csrno,
-                                      target_ulong val)
+                                      target_ulong val, uintptr_t ra)
 {
     if (riscv_cpu_mxl(env) == MXL_RV32) {
         env->vstimecmp = deposit64(env->vstimecmp, 0, 32, (uint64_t)val);
@@ -1676,7 +1680,7 @@ static RISCVException write_vstimecmp(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_vstimecmph(CPURISCVState *env, int csrno,
-                                       target_ulong val)
+                                       target_ulong val, uintptr_t ra)
 {
     env->vstimecmp = deposit64(env->vstimecmp, 32, 32, (uint64_t)val);
     riscv_timer_write_timecmp(env, env->vstimer, env->vstimecmp,
@@ -1710,13 +1714,13 @@ static RISCVException read_stimecmph(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_stimecmp(CPURISCVState *env, int csrno,
-                                     target_ulong val)
+                                     target_ulong val, uintptr_t ra)
 {
     if (env->virt_enabled) {
         if (env->hvictl & HVICTL_VTI) {
             return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
         }
-        return write_vstimecmp(env, csrno, val);
+        return write_vstimecmp(env, csrno, val, ra);
     }
 
     if (riscv_cpu_mxl(env) == MXL_RV32) {
@@ -1731,13 +1735,13 @@ static RISCVException write_stimecmp(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_stimecmph(CPURISCVState *env, int csrno,
-                                      target_ulong val)
+                                      target_ulong val, uintptr_t ra)
 {
     if (env->virt_enabled) {
         if (env->hvictl & HVICTL_VTI) {
             return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
         }
-        return write_vstimecmph(env, csrno, val);
+        return write_vstimecmph(env, csrno, val, ra);
     }
 
     env->stimecmp = deposit64(env->stimecmp, 32, 32, (uint64_t)val);
@@ -1842,7 +1846,7 @@ static RISCVException read_zero(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_ignore(CPURISCVState *env, int csrno,
-                                   target_ulong val)
+                                   target_ulong val, uintptr_t ra)
 {
     return RISCV_EXCP_NONE;
 }
@@ -1963,7 +1967,7 @@ static target_ulong legalize_mpp(CPURISCVState *env, target_ulong old_mpp,
 }
 
 static RISCVException write_mstatus(CPURISCVState *env, int csrno,
-                                    target_ulong val)
+                                    target_ulong val, uintptr_t ra)
 {
     uint64_t mstatus = env->mstatus;
     uint64_t mask = 0;
@@ -2042,7 +2046,7 @@ static RISCVException read_mstatush(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_mstatush(CPURISCVState *env, int csrno,
-                                     target_ulong val)
+                                     target_ulong val, uintptr_t ra)
 {
     uint64_t valh = (uint64_t)val << 32;
     uint64_t mask = riscv_has_ext(env, RVH) ? MSTATUS_MPV | MSTATUS_GVA : 0;
@@ -2096,7 +2100,7 @@ static RISCVException read_misa(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_misa(CPURISCVState *env, int csrno,
-                                 target_ulong val)
+                                 target_ulong val, uintptr_t ra)
 {
     RISCVCPU *cpu = env_archcpu(env);
     uint32_t orig_misa_ext = env->misa_ext;
@@ -2160,7 +2164,7 @@ static RISCVException read_medeleg(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_medeleg(CPURISCVState *env, int csrno,
-                                    target_ulong val)
+                                    target_ulong val, uintptr_t ra)
 {
     env->medeleg = (env->medeleg & ~DELEGABLE_EXCPS) | (val & DELEGABLE_EXCPS);
     return RISCV_EXCP_NONE;
@@ -2955,7 +2959,7 @@ static RISCVException read_mtvec(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_mtvec(CPURISCVState *env, int csrno,
-                                  target_ulong val)
+                                  target_ulong val, uintptr_t ra)
 {
     /* bits [1:0] encode mode; 0 = direct, 1 = vectored, 2 >= reserved */
     if ((val & 3) < 2) {
@@ -2974,7 +2978,7 @@ static RISCVException read_mcountinhibit(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_mcountinhibit(CPURISCVState *env, int csrno,
-                                          target_ulong val)
+                                          target_ulong val, uintptr_t ra)
 {
     int cidx;
     PMUCTRState *counter;
@@ -3049,10 +3053,9 @@ static RISCVException read_scountinhibit(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_scountinhibit(CPURISCVState *env, int csrno,
-                                          target_ulong val)
+                                          target_ulong val, uintptr_t ra)
 {
-    write_mcountinhibit(env, csrno, val & env->mcounteren);
-    return RISCV_EXCP_NONE;
+    return write_mcountinhibit(env, csrno, val & env->mcounteren, ra);
 }
 
 static RISCVException read_mcounteren(CPURISCVState *env, int csrno,
@@ -3063,7 +3066,7 @@ static RISCVException read_mcounteren(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_mcounteren(CPURISCVState *env, int csrno,
-                                       target_ulong val)
+                                       target_ulong val, uintptr_t ra)
 {
     RISCVCPU *cpu = env_archcpu(env);
 
@@ -3097,7 +3100,7 @@ static RISCVException read_mscratch(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_mscratch(CPURISCVState *env, int csrno,
-                                     target_ulong val)
+                                     target_ulong val, uintptr_t ra)
 {
     env->mscratch = val;
     return RISCV_EXCP_NONE;
@@ -3111,7 +3114,7 @@ static RISCVException read_mepc(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_mepc(CPURISCVState *env, int csrno,
-                                 target_ulong val)
+                                 target_ulong val, uintptr_t ra)
 {
     env->mepc = val;
     return RISCV_EXCP_NONE;
@@ -3125,7 +3128,7 @@ static RISCVException read_mcause(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_mcause(CPURISCVState *env, int csrno,
-                                   target_ulong val)
+                                   target_ulong val, uintptr_t ra)
 {
     env->mcause = val;
     return RISCV_EXCP_NONE;
@@ -3139,7 +3142,7 @@ static RISCVException read_mtval(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_mtval(CPURISCVState *env, int csrno,
-                                  target_ulong val)
+                                  target_ulong val, uintptr_t ra)
 {
     env->mtval = val;
     return RISCV_EXCP_NONE;
@@ -3154,9 +3157,9 @@ static RISCVException read_menvcfg(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_henvcfg(CPURISCVState *env, int csrno,
-                                    target_ulong val);
+                                    target_ulong val, uintptr_t ra);
 static RISCVException write_menvcfg(CPURISCVState *env, int csrno,
-                                    target_ulong val)
+                                    target_ulong val, uintptr_t ra)
 {
     const RISCVCPUConfig *cfg = riscv_cpu_cfg(env);
     uint64_t mask = MENVCFG_FIOM | MENVCFG_CBIE | MENVCFG_CBCFE |
@@ -3188,9 +3191,7 @@ static RISCVException write_menvcfg(CPURISCVState *env, int csrno,
         }
     }
     env->menvcfg = (env->menvcfg & ~mask) | (val & mask);
-    write_henvcfg(env, CSR_HENVCFG, env->henvcfg);
-
-    return RISCV_EXCP_NONE;
+    return write_henvcfg(env, CSR_HENVCFG, env->henvcfg, ra);
 }
 
 static RISCVException read_menvcfgh(CPURISCVState *env, int csrno,
@@ -3201,9 +3202,9 @@ static RISCVException read_menvcfgh(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_henvcfgh(CPURISCVState *env, int csrno,
-                                    target_ulong val);
+                                     target_ulong val, uintptr_t ra);
 static RISCVException write_menvcfgh(CPURISCVState *env, int csrno,
-                                     target_ulong val)
+                                     target_ulong val, uintptr_t ra)
 {
     const RISCVCPUConfig *cfg = riscv_cpu_cfg(env);
     uint64_t mask = (cfg->ext_svpbmt ? MENVCFG_PBMTE : 0) |
@@ -3218,9 +3219,7 @@ static RISCVException write_menvcfgh(CPURISCVState *env, int csrno,
     }
 
     env->menvcfg = (env->menvcfg & ~mask) | (valh & mask);
-    write_henvcfgh(env, CSR_HENVCFGH, env->henvcfg >> 32);
-
-    return RISCV_EXCP_NONE;
+    return write_henvcfgh(env, CSR_HENVCFGH, env->henvcfg >> 32, ra);
 }
 
 static RISCVException read_senvcfg(CPURISCVState *env, int csrno,
@@ -3238,7 +3237,7 @@ static RISCVException read_senvcfg(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_senvcfg(CPURISCVState *env, int csrno,
-                                    target_ulong val)
+                                    target_ulong val, uintptr_t ra)
 {
     uint64_t mask = SENVCFG_FIOM | SENVCFG_CBIE | SENVCFG_CBCFE | SENVCFG_CBZE;
     RISCVException ret;
@@ -3295,7 +3294,7 @@ static RISCVException read_henvcfg(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_henvcfg(CPURISCVState *env, int csrno,
-                                    target_ulong val)
+                                    target_ulong val, uintptr_t ra)
 {
     uint64_t mask = HENVCFG_FIOM | HENVCFG_CBIE | HENVCFG_CBCFE | HENVCFG_CBZE;
     RISCVException ret;
@@ -3350,7 +3349,7 @@ static RISCVException read_henvcfgh(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_henvcfgh(CPURISCVState *env, int csrno,
-                                     target_ulong val)
+                                     target_ulong val, uintptr_t ra)
 {
     uint64_t mask = env->menvcfg & (HENVCFG_PBMTE | HENVCFG_STCE |
                                     HENVCFG_ADUE | HENVCFG_DTE);
@@ -3388,7 +3387,7 @@ static RISCVException write_mstateen(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_mstateen0(CPURISCVState *env, int csrno,
-                                      target_ulong new_val)
+                                      target_ulong new_val, uintptr_t ra)
 {
     uint64_t wr_mask = SMSTATEEN_STATEEN | SMSTATEEN0_HSENVCFG;
     if (!riscv_has_ext(env, RVF)) {
@@ -3420,7 +3419,7 @@ static RISCVException write_mstateen0(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_mstateen_1_3(CPURISCVState *env, int csrno,
-                                         target_ulong new_val)
+                                         target_ulong new_val, uintptr_t ra)
 {
     return write_mstateen(env, csrno, SMSTATEEN_STATEEN, new_val);
 }
@@ -3447,7 +3446,7 @@ static RISCVException write_mstateenh(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_mstateen0h(CPURISCVState *env, int csrno,
-                                       target_ulong new_val)
+                                       target_ulong new_val, uintptr_t ra)
 {
     uint64_t wr_mask = SMSTATEEN_STATEEN | SMSTATEEN0_HSENVCFG;
 
@@ -3463,7 +3462,7 @@ static RISCVException write_mstateen0h(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_mstateenh_1_3(CPURISCVState *env, int csrno,
-                                          target_ulong new_val)
+                                          target_ulong new_val, uintptr_t ra)
 {
     return write_mstateenh(env, csrno, SMSTATEEN_STATEEN, new_val);
 }
@@ -3492,7 +3491,7 @@ static RISCVException write_hstateen(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_hstateen0(CPURISCVState *env, int csrno,
-                                      target_ulong new_val)
+                                      target_ulong new_val, uintptr_t ra)
 {
     uint64_t wr_mask = SMSTATEEN_STATEEN | SMSTATEEN0_HSENVCFG;
 
@@ -3521,7 +3520,7 @@ static RISCVException write_hstateen0(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_hstateen_1_3(CPURISCVState *env, int csrno,
-                                         target_ulong new_val)
+                                         target_ulong new_val, uintptr_t ra)
 {
     return write_hstateen(env, csrno, SMSTATEEN_STATEEN, new_val);
 }
@@ -3552,7 +3551,7 @@ static RISCVException write_hstateenh(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_hstateen0h(CPURISCVState *env, int csrno,
-                                       target_ulong new_val)
+                                       target_ulong new_val, uintptr_t ra)
 {
     uint64_t wr_mask = SMSTATEEN_STATEEN | SMSTATEEN0_HSENVCFG;
 
@@ -3564,7 +3563,7 @@ static RISCVException write_hstateen0h(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_hstateenh_1_3(CPURISCVState *env, int csrno,
-                                          target_ulong new_val)
+                                          target_ulong new_val, uintptr_t ra)
 {
     return write_hstateenh(env, csrno, SMSTATEEN_STATEEN, new_val);
 }
@@ -3603,7 +3602,7 @@ static RISCVException write_sstateen(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_sstateen0(CPURISCVState *env, int csrno,
-                                      target_ulong new_val)
+                                      target_ulong new_val, uintptr_t ra)
 {
     uint64_t wr_mask = SMSTATEEN_STATEEN | SMSTATEEN0_HSENVCFG;
 
@@ -3615,7 +3614,7 @@ static RISCVException write_sstateen0(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_sstateen_1_3(CPURISCVState *env, int csrno,
-                                      target_ulong new_val)
+                                         target_ulong new_val, uintptr_t ra)
 {
     return write_sstateen(env, csrno, SMSTATEEN_STATEEN, new_val);
 }
@@ -3866,7 +3865,7 @@ static RISCVException read_sstatus(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_sstatus(CPURISCVState *env, int csrno,
-                                    target_ulong val)
+                                    target_ulong val, uintptr_t ra)
 {
     target_ulong mask = (sstatus_v1_10_mask);
 
@@ -3883,7 +3882,7 @@ static RISCVException write_sstatus(CPURISCVState *env, int csrno,
         mask |= SSTATUS_SDT;
     }
     target_ulong newval = (env->mstatus & ~mask) | (val & mask);
-    return write_mstatus(env, CSR_MSTATUS, newval);
+    return write_mstatus(env, CSR_MSTATUS, newval, ra);
 }
 
 static RISCVException rmw_vsie64(CPURISCVState *env, int csrno,
@@ -4035,7 +4034,7 @@ static RISCVException read_stvec(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_stvec(CPURISCVState *env, int csrno,
-                                  target_ulong val)
+                                  target_ulong val, uintptr_t ra)
 {
     /* bits [1:0] encode mode; 0 = direct, 1 = vectored, 2 >= reserved */
     if ((val & 3) < 2) {
@@ -4054,7 +4053,7 @@ static RISCVException read_scounteren(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_scounteren(CPURISCVState *env, int csrno,
-                                       target_ulong val)
+                                       target_ulong val, uintptr_t ra)
 {
     RISCVCPU *cpu = env_archcpu(env);
 
@@ -4088,7 +4087,7 @@ static RISCVException read_sscratch(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_sscratch(CPURISCVState *env, int csrno,
-                                     target_ulong val)
+                                     target_ulong val, uintptr_t ra)
 {
     env->sscratch = val;
     return RISCV_EXCP_NONE;
@@ -4102,7 +4101,7 @@ static RISCVException read_sepc(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_sepc(CPURISCVState *env, int csrno,
-                                 target_ulong val)
+                                 target_ulong val, uintptr_t ra)
 {
     env->sepc = val;
     return RISCV_EXCP_NONE;
@@ -4116,7 +4115,7 @@ static RISCVException read_scause(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_scause(CPURISCVState *env, int csrno,
-                                   target_ulong val)
+                                   target_ulong val, uintptr_t ra)
 {
     env->scause = val;
     return RISCV_EXCP_NONE;
@@ -4130,7 +4129,7 @@ static RISCVException read_stval(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_stval(CPURISCVState *env, int csrno,
-                                  target_ulong val)
+                                  target_ulong val, uintptr_t ra)
 {
     env->stval = val;
     return RISCV_EXCP_NONE;
@@ -4270,7 +4269,7 @@ static RISCVException read_satp(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_satp(CPURISCVState *env, int csrno,
-                                 target_ulong val)
+                                 target_ulong val, uintptr_t ra)
 {
     if (!riscv_cpu_cfg(env)->mmu) {
         return RISCV_EXCP_NONE;
@@ -4492,7 +4491,7 @@ static RISCVException read_hstatus(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_hstatus(CPURISCVState *env, int csrno,
-                                    target_ulong val)
+                                    target_ulong val, uintptr_t ra)
 {
     uint64_t mask = (target_ulong)-1;
     if (!env_archcpu(env)->cfg.ext_svukte) {
@@ -4524,7 +4523,7 @@ static RISCVException read_hedeleg(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_hedeleg(CPURISCVState *env, int csrno,
-                                    target_ulong val)
+                                    target_ulong val, uintptr_t ra)
 {
     env->hedeleg = val & vs_delegable_excps;
     return RISCV_EXCP_NONE;
@@ -4545,7 +4544,7 @@ static RISCVException read_hedelegh(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_hedelegh(CPURISCVState *env, int csrno,
-                                    target_ulong val)
+                                     target_ulong val, uintptr_t ra)
 {
     RISCVException ret;
     ret = smstateen_acc_ok(env, 0, SMSTATEEN0_P1P13);
@@ -4808,7 +4807,7 @@ static RISCVException read_hcounteren(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_hcounteren(CPURISCVState *env, int csrno,
-                                       target_ulong val)
+                                       target_ulong val, uintptr_t ra)
 {
     RISCVCPU *cpu = env_archcpu(env);
 
@@ -4828,7 +4827,7 @@ static RISCVException read_hgeie(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_hgeie(CPURISCVState *env, int csrno,
-                                  target_ulong val)
+                                  target_ulong val, uintptr_t ra)
 {
     /* Only GEILEN:1 bits implemented and BIT0 is never implemented */
     val &= ((((target_ulong)1) << env->geilen) - 1) << 1;
@@ -4847,7 +4846,7 @@ static RISCVException read_htval(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_htval(CPURISCVState *env, int csrno,
-                                  target_ulong val)
+                                  target_ulong val, uintptr_t ra)
 {
     env->htval = val;
     return RISCV_EXCP_NONE;
@@ -4861,7 +4860,7 @@ static RISCVException read_htinst(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_htinst(CPURISCVState *env, int csrno,
-                                   target_ulong val)
+                                   target_ulong val, uintptr_t ra)
 {
     return RISCV_EXCP_NONE;
 }
@@ -4883,7 +4882,7 @@ static RISCVException read_hgatp(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_hgatp(CPURISCVState *env, int csrno,
-                                  target_ulong val)
+                                  target_ulong val, uintptr_t ra)
 {
     env->hgatp = legalize_xatp(env, env->hgatp, val);
     return RISCV_EXCP_NONE;
@@ -4901,7 +4900,7 @@ static RISCVException read_htimedelta(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_htimedelta(CPURISCVState *env, int csrno,
-                                       target_ulong val)
+                                       target_ulong val, uintptr_t ra)
 {
     if (!env->rdtime_fn) {
         return RISCV_EXCP_ILLEGAL_INST;
@@ -4933,7 +4932,7 @@ static RISCVException read_htimedeltah(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_htimedeltah(CPURISCVState *env, int csrno,
-                                        target_ulong val)
+                                        target_ulong val, uintptr_t ra)
 {
     if (!env->rdtime_fn) {
         return RISCV_EXCP_ILLEGAL_INST;
@@ -4957,7 +4956,7 @@ static RISCVException read_hvictl(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_hvictl(CPURISCVState *env, int csrno,
-                                   target_ulong val)
+                                   target_ulong val, uintptr_t ra)
 {
     env->hvictl = val & HVICTL_VALID_MASK;
     return RISCV_EXCP_NONE;
@@ -5022,7 +5021,7 @@ static RISCVException read_hviprio1(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_hviprio1(CPURISCVState *env, int csrno,
-                                     target_ulong val)
+                                     target_ulong val, uintptr_t ra)
 {
     return write_hvipriox(env, 0, env->hviprio, val);
 }
@@ -5034,7 +5033,7 @@ static RISCVException read_hviprio1h(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_hviprio1h(CPURISCVState *env, int csrno,
-                                      target_ulong val)
+                                      target_ulong val, uintptr_t ra)
 {
     return write_hvipriox(env, 4, env->hviprio, val);
 }
@@ -5046,7 +5045,7 @@ static RISCVException read_hviprio2(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_hviprio2(CPURISCVState *env, int csrno,
-                                     target_ulong val)
+                                     target_ulong val, uintptr_t ra)
 {
     return write_hvipriox(env, 8, env->hviprio, val);
 }
@@ -5058,7 +5057,7 @@ static RISCVException read_hviprio2h(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_hviprio2h(CPURISCVState *env, int csrno,
-                                      target_ulong val)
+                                      target_ulong val, uintptr_t ra)
 {
     return write_hvipriox(env, 12, env->hviprio, val);
 }
@@ -5072,7 +5071,7 @@ static RISCVException read_vsstatus(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_vsstatus(CPURISCVState *env, int csrno,
-                                     target_ulong val)
+                                     target_ulong val, uintptr_t ra)
 {
     uint64_t mask = (target_ulong)-1;
     if ((val & VSSTATUS64_UXL) == 0) {
@@ -5097,7 +5096,7 @@ static RISCVException read_vstvec(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_vstvec(CPURISCVState *env, int csrno,
-                                   target_ulong val)
+                                   target_ulong val, uintptr_t ra)
 {
     /* bits [1:0] encode mode; 0 = direct, 1 = vectored, 2 >= reserved */
     if ((val & 3) < 2) {
@@ -5116,7 +5115,7 @@ static RISCVException read_vsscratch(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_vsscratch(CPURISCVState *env, int csrno,
-                                      target_ulong val)
+                                      target_ulong val, uintptr_t ra)
 {
     env->vsscratch = val;
     return RISCV_EXCP_NONE;
@@ -5130,7 +5129,7 @@ static RISCVException read_vsepc(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_vsepc(CPURISCVState *env, int csrno,
-                                  target_ulong val)
+                                  target_ulong val, uintptr_t ra)
 {
     env->vsepc = val;
     return RISCV_EXCP_NONE;
@@ -5144,7 +5143,7 @@ static RISCVException read_vscause(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_vscause(CPURISCVState *env, int csrno,
-                                    target_ulong val)
+                                    target_ulong val, uintptr_t ra)
 {
     env->vscause = val;
     return RISCV_EXCP_NONE;
@@ -5158,7 +5157,7 @@ static RISCVException read_vstval(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_vstval(CPURISCVState *env, int csrno,
-                                   target_ulong val)
+                                   target_ulong val, uintptr_t ra)
 {
     env->vstval = val;
     return RISCV_EXCP_NONE;
@@ -5172,7 +5171,7 @@ static RISCVException read_vsatp(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_vsatp(CPURISCVState *env, int csrno,
-                                  target_ulong val)
+                                  target_ulong val, uintptr_t ra)
 {
     env->vsatp = legalize_xatp(env, env->vsatp, val);
     return RISCV_EXCP_NONE;
@@ -5186,7 +5185,7 @@ static RISCVException read_mtval2(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_mtval2(CPURISCVState *env, int csrno,
-                                   target_ulong val)
+                                   target_ulong val, uintptr_t ra)
 {
     env->mtval2 = val;
     return RISCV_EXCP_NONE;
@@ -5200,7 +5199,7 @@ static RISCVException read_mtinst(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_mtinst(CPURISCVState *env, int csrno,
-                                   target_ulong val)
+                                   target_ulong val, uintptr_t ra)
 {
     env->mtinst = val;
     return RISCV_EXCP_NONE;
@@ -5215,7 +5214,7 @@ static RISCVException read_mseccfg(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_mseccfg(CPURISCVState *env, int csrno,
-                                    target_ulong val)
+                                    target_ulong val, uintptr_t ra)
 {
     mseccfg_csr_write(env, val);
     return RISCV_EXCP_NONE;
@@ -5231,7 +5230,7 @@ static RISCVException read_pmpcfg(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_pmpcfg(CPURISCVState *env, int csrno,
-                                   target_ulong val)
+                                   target_ulong val, uintptr_t ra)
 {
     uint32_t reg_index = csrno - CSR_PMPCFG0;
 
@@ -5247,7 +5246,7 @@ static RISCVException read_pmpaddr(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_pmpaddr(CPURISCVState *env, int csrno,
-                                    target_ulong val)
+                                    target_ulong val, uintptr_t ra)
 {
     pmpaddr_csr_write(env, csrno - CSR_PMPADDR0, val);
     return RISCV_EXCP_NONE;
@@ -5261,7 +5260,7 @@ static RISCVException read_tselect(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_tselect(CPURISCVState *env, int csrno,
-                                    target_ulong val)
+                                    target_ulong val, uintptr_t ra)
 {
     tselect_csr_write(env, val);
     return RISCV_EXCP_NONE;
@@ -5285,7 +5284,7 @@ static RISCVException read_tdata(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_tdata(CPURISCVState *env, int csrno,
-                                  target_ulong val)
+                                  target_ulong val, uintptr_t ra)
 {
     if (!tdata_available(env, csrno - CSR_TDATA1)) {
         return RISCV_EXCP_ILLEGAL_INST;
@@ -5310,7 +5309,7 @@ static RISCVException read_mcontext(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_mcontext(CPURISCVState *env, int csrno,
-                                     target_ulong val)
+                                     target_ulong val, uintptr_t ra)
 {
     bool rv32 = riscv_cpu_mxl(env) == MXL_RV32 ? true : false;
     int32_t mask;
@@ -5334,43 +5333,50 @@ static RISCVException read_mnscratch(CPURISCVState *env, int csrno,
     return RISCV_EXCP_NONE;
 }
 
-static int write_mnscratch(CPURISCVState *env, int csrno, target_ulong val)
+static RISCVException write_mnscratch(CPURISCVState *env, int csrno,
+                                      target_ulong val, uintptr_t ra)
 {
     env->mnscratch = val;
     return RISCV_EXCP_NONE;
 }
 
-static int read_mnepc(CPURISCVState *env, int csrno, target_ulong *val)
+static RISCVException read_mnepc(CPURISCVState *env, int csrno,
+                                 target_ulong *val)
 {
     *val = env->mnepc;
     return RISCV_EXCP_NONE;
 }
 
-static int write_mnepc(CPURISCVState *env, int csrno, target_ulong val)
+static RISCVException write_mnepc(CPURISCVState *env, int csrno,
+                                  target_ulong val, uintptr_t ra)
 {
     env->mnepc = val;
     return RISCV_EXCP_NONE;
 }
 
-static int read_mncause(CPURISCVState *env, int csrno, target_ulong *val)
+static RISCVException read_mncause(CPURISCVState *env, int csrno,
+                                   target_ulong *val)
 {
     *val = env->mncause;
     return RISCV_EXCP_NONE;
 }
 
-static int write_mncause(CPURISCVState *env, int csrno, target_ulong val)
+static RISCVException write_mncause(CPURISCVState *env, int csrno,
+                                    target_ulong val, uintptr_t ra)
 {
     env->mncause = val;
     return RISCV_EXCP_NONE;
 }
 
-static int read_mnstatus(CPURISCVState *env, int csrno, target_ulong *val)
+static RISCVException read_mnstatus(CPURISCVState *env, int csrno,
+                                    target_ulong *val)
 {
     *val = env->mnstatus;
     return RISCV_EXCP_NONE;
 }
 
-static int write_mnstatus(CPURISCVState *env, int csrno, target_ulong val)
+static RISCVException write_mnstatus(CPURISCVState *env, int csrno,
+                                     target_ulong val, uintptr_t ra)
 {
     target_ulong mask = (MNSTATUS_NMIE | MNSTATUS_MNPP);
 
@@ -5540,7 +5546,7 @@ static RISCVException riscv_csrrw_do64(CPURISCVState *env, int csrno,
     if (write_mask) {
         new_value = (old_value & ~write_mask) | (new_value & write_mask);
         if (csr_ops[csrno].write) {
-            ret = csr_ops[csrno].write(env, csrno, new_value);
+            ret = csr_ops[csrno].write(env, csrno, new_value, 0);
             if (ret != RISCV_EXCP_NONE) {
                 return ret;
             }
@@ -5603,7 +5609,7 @@ static RISCVException riscv_csrrw_do128(CPURISCVState *env, int csrno,
             }
         } else if (csr_ops[csrno].write) {
             /* avoids having to write wrappers for all registers */
-            ret = csr_ops[csrno].write(env, csrno, int128_getlo(new_value));
+            ret = csr_ops[csrno].write(env, csrno, int128_getlo(new_value), 0);
             if (ret != RISCV_EXCP_NONE) {
                 return ret;
             }
@@ -5714,7 +5720,7 @@ static RISCVException read_jvt(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_jvt(CPURISCVState *env, int csrno,
-                                target_ulong val)
+                                target_ulong val, uintptr_t ra)
 {
     env->jvt = val;
     return RISCV_EXCP_NONE;

From bfc7936f42bac551bd859b8f32fb1f24dfcfc611 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 25 Apr 2025 08:23:06 -0700
Subject: [PATCH 0994/2760] target/riscv: Pass ra to riscv_csrrw_do64
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250425152311.804338-3-richard.henderson@linaro.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index ba7620ef3d..22149bd3fc 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -5516,7 +5516,8 @@ static inline RISCVException riscv_csrrw_check(CPURISCVState *env,
 static RISCVException riscv_csrrw_do64(CPURISCVState *env, int csrno,
                                        target_ulong *ret_value,
                                        target_ulong new_value,
-                                       target_ulong write_mask)
+                                       target_ulong write_mask,
+                                       uintptr_t ra)
 {
     RISCVException ret;
     target_ulong old_value = 0;
@@ -5546,7 +5547,7 @@ static RISCVException riscv_csrrw_do64(CPURISCVState *env, int csrno,
     if (write_mask) {
         new_value = (old_value & ~write_mask) | (new_value & write_mask);
         if (csr_ops[csrno].write) {
-            ret = csr_ops[csrno].write(env, csrno, new_value, 0);
+            ret = csr_ops[csrno].write(env, csrno, new_value, ra);
             if (ret != RISCV_EXCP_NONE) {
                 return ret;
             }
@@ -5569,7 +5570,7 @@ RISCVException riscv_csrr(CPURISCVState *env, int csrno,
         return ret;
     }
 
-    return riscv_csrrw_do64(env, csrno, ret_value, 0, 0);
+    return riscv_csrrw_do64(env, csrno, ret_value, 0, 0, 0);
 }
 
 RISCVException riscv_csrrw(CPURISCVState *env, int csrno,
@@ -5581,7 +5582,7 @@ RISCVException riscv_csrrw(CPURISCVState *env, int csrno,
         return ret;
     }
 
-    return riscv_csrrw_do64(env, csrno, ret_value, new_value, write_mask);
+    return riscv_csrrw_do64(env, csrno, ret_value, new_value, write_mask, 0);
 }
 
 static RISCVException riscv_csrrw_do128(CPURISCVState *env, int csrno,
@@ -5647,9 +5648,7 @@ RISCVException riscv_csrr_i128(CPURISCVState *env, int csrno,
      * accesses
      */
     target_ulong old_value;
-    ret = riscv_csrrw_do64(env, csrno, &old_value,
-                           (target_ulong)0,
-                           (target_ulong)0);
+    ret = riscv_csrrw_do64(env, csrno, &old_value, 0, 0, 0);
     if (ret == RISCV_EXCP_NONE && ret_value) {
         *ret_value = int128_make64(old_value);
     }
@@ -5681,7 +5680,7 @@ RISCVException riscv_csrrw_i128(CPURISCVState *env, int csrno,
     target_ulong old_value;
     ret = riscv_csrrw_do64(env, csrno, &old_value,
                            int128_getlo(new_value),
-                           int128_getlo(write_mask));
+                           int128_getlo(write_mask), 0);
     if (ret == RISCV_EXCP_NONE && ret_value) {
         *ret_value = int128_make64(old_value);
     }

From c26c4afd0ffde4f79216975ac34f419d0fcf6795 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 25 Apr 2025 08:23:07 -0700
Subject: [PATCH 0995/2760] target/riscv: Pass ra to riscv_csrrw_do128
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250425152311.804338-4-richard.henderson@linaro.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index 22149bd3fc..8af0304a36 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -5588,7 +5588,7 @@ RISCVException riscv_csrrw(CPURISCVState *env, int csrno,
 static RISCVException riscv_csrrw_do128(CPURISCVState *env, int csrno,
                                         Int128 *ret_value,
                                         Int128 new_value,
-                                        Int128 write_mask)
+                                        Int128 write_mask, uintptr_t ra)
 {
     RISCVException ret;
     Int128 old_value;
@@ -5610,7 +5610,7 @@ static RISCVException riscv_csrrw_do128(CPURISCVState *env, int csrno,
             }
         } else if (csr_ops[csrno].write) {
             /* avoids having to write wrappers for all registers */
-            ret = csr_ops[csrno].write(env, csrno, int128_getlo(new_value), 0);
+            ret = csr_ops[csrno].write(env, csrno, int128_getlo(new_value), ra);
             if (ret != RISCV_EXCP_NONE) {
                 return ret;
             }
@@ -5637,7 +5637,7 @@ RISCVException riscv_csrr_i128(CPURISCVState *env, int csrno,
 
     if (csr_ops[csrno].read128) {
         return riscv_csrrw_do128(env, csrno, ret_value,
-                                 int128_zero(), int128_zero());
+                                 int128_zero(), int128_zero(), 0);
     }
 
     /*
@@ -5667,7 +5667,8 @@ RISCVException riscv_csrrw_i128(CPURISCVState *env, int csrno,
     }
 
     if (csr_ops[csrno].read128) {
-        return riscv_csrrw_do128(env, csrno, ret_value, new_value, write_mask);
+        return riscv_csrrw_do128(env, csrno, ret_value,
+                                 new_value, write_mask, 0);
     }
 
     /*

From f1304836ea9399253c67b09513fca30f9f4b223e Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 25 Apr 2025 08:23:08 -0700
Subject: [PATCH 0996/2760] target/riscv: Pass ra to riscv_csrrw
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250425152311.804338-5-richard.henderson@linaro.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/riscv_hart.c    | 2 +-
 target/riscv/cpu.h       | 8 ++++----
 target/riscv/csr.c       | 8 ++++----
 target/riscv/op_helper.c | 4 ++--
 4 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/hw/riscv/riscv_hart.c b/hw/riscv/riscv_hart.c
index 333083a4f1..7f2676008c 100644
--- a/hw/riscv/riscv_hart.c
+++ b/hw/riscv/riscv_hart.c
@@ -72,7 +72,7 @@ static void csr_call(char *cmd, uint64_t cpu_num, int csrno, uint64_t *val)
         ret = riscv_csrr(env, csrno, (target_ulong *)val);
     } else if (strcmp(cmd, "set_csr") == 0) {
         ret = riscv_csrrw(env, csrno, NULL, *(target_ulong *)val,
-                MAKE_64BIT_MASK(0, TARGET_LONG_BITS));
+                          MAKE_64BIT_MASK(0, TARGET_LONG_BITS), 0);
     }
 
     g_assert(ret == RISCV_EXCP_NONE);
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index 4265ce06ee..f674e93a4f 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -813,8 +813,8 @@ RISCVException riscv_csrr(CPURISCVState *env, int csrno,
                           target_ulong *ret_value);
 
 RISCVException riscv_csrrw(CPURISCVState *env, int csrno,
-                           target_ulong *ret_value,
-                           target_ulong new_value, target_ulong write_mask);
+                           target_ulong *ret_value, target_ulong new_value,
+                           target_ulong write_mask, uintptr_t ra);
 RISCVException riscv_csrrw_debug(CPURISCVState *env, int csrno,
                                  target_ulong *ret_value,
                                  target_ulong new_value,
@@ -823,13 +823,13 @@ RISCVException riscv_csrrw_debug(CPURISCVState *env, int csrno,
 static inline void riscv_csr_write(CPURISCVState *env, int csrno,
                                    target_ulong val)
 {
-    riscv_csrrw(env, csrno, NULL, val, MAKE_64BIT_MASK(0, TARGET_LONG_BITS));
+    riscv_csrrw(env, csrno, NULL, val, MAKE_64BIT_MASK(0, TARGET_LONG_BITS), 0);
 }
 
 static inline target_ulong riscv_csr_read(CPURISCVState *env, int csrno)
 {
     target_ulong val = 0;
-    riscv_csrrw(env, csrno, &val, 0, 0);
+    riscv_csrrw(env, csrno, &val, 0, 0, 0);
     return val;
 }
 
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index 8af0304a36..807a891e7d 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -5574,15 +5574,15 @@ RISCVException riscv_csrr(CPURISCVState *env, int csrno,
 }
 
 RISCVException riscv_csrrw(CPURISCVState *env, int csrno,
-                           target_ulong *ret_value,
-                           target_ulong new_value, target_ulong write_mask)
+                           target_ulong *ret_value, target_ulong new_value,
+                           target_ulong write_mask, uintptr_t ra)
 {
     RISCVException ret = riscv_csrrw_check(env, csrno, true);
     if (ret != RISCV_EXCP_NONE) {
         return ret;
     }
 
-    return riscv_csrrw_do64(env, csrno, ret_value, new_value, write_mask, 0);
+    return riscv_csrrw_do64(env, csrno, ret_value, new_value, write_mask, ra);
 }
 
 static RISCVException riscv_csrrw_do128(CPURISCVState *env, int csrno,
@@ -5704,7 +5704,7 @@ RISCVException riscv_csrrw_debug(CPURISCVState *env, int csrno,
     if (!write_mask) {
         ret = riscv_csrr(env, csrno, ret_value);
     } else {
-        ret = riscv_csrrw(env, csrno, ret_value, new_value, write_mask);
+        ret = riscv_csrrw(env, csrno, ret_value, new_value, write_mask, 0);
     }
 #if !defined(CONFIG_USER_ONLY)
     env->debugger = false;
diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
index 05316f2088..0672101637 100644
--- a/target/riscv/op_helper.c
+++ b/target/riscv/op_helper.c
@@ -71,7 +71,7 @@ target_ulong helper_csrr(CPURISCVState *env, int csr)
 void helper_csrw(CPURISCVState *env, int csr, target_ulong src)
 {
     target_ulong mask = env->xl == MXL_RV32 ? UINT32_MAX : (target_ulong)-1;
-    RISCVException ret = riscv_csrrw(env, csr, NULL, src, mask);
+    RISCVException ret = riscv_csrrw(env, csr, NULL, src, mask, GETPC());
 
     if (ret != RISCV_EXCP_NONE) {
         riscv_raise_exception(env, ret, GETPC());
@@ -82,7 +82,7 @@ target_ulong helper_csrrw(CPURISCVState *env, int csr,
                           target_ulong src, target_ulong write_mask)
 {
     target_ulong val = 0;
-    RISCVException ret = riscv_csrrw(env, csr, &val, src, write_mask);
+    RISCVException ret = riscv_csrrw(env, csr, &val, src, write_mask, GETPC());
 
     if (ret != RISCV_EXCP_NONE) {
         riscv_raise_exception(env, ret, GETPC());

From 9ef792a78db6b89619c3ccc77ceb3e9d6271dd02 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 25 Apr 2025 08:23:09 -0700
Subject: [PATCH 0997/2760] target/riscv: Pass ra to riscv_csrrw_i128
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250425152311.804338-6-richard.henderson@linaro.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h       | 4 ++--
 target/riscv/csr.c       | 8 ++++----
 target/riscv/op_helper.c | 9 +++++----
 3 files changed, 11 insertions(+), 10 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index f674e93a4f..ff7ba2a0a1 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -848,8 +848,8 @@ typedef RISCVException (*riscv_csr_op_fn)(CPURISCVState *env, int csrno,
 RISCVException riscv_csrr_i128(CPURISCVState *env, int csrno,
                                Int128 *ret_value);
 RISCVException riscv_csrrw_i128(CPURISCVState *env, int csrno,
-                                Int128 *ret_value,
-                                Int128 new_value, Int128 write_mask);
+                                Int128 *ret_value, Int128 new_value,
+                                Int128 write_mask, uintptr_t ra);
 
 typedef RISCVException (*riscv_csr_read128_fn)(CPURISCVState *env, int csrno,
                                                Int128 *ret_value);
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index 807a891e7d..53458491da 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -5656,8 +5656,8 @@ RISCVException riscv_csrr_i128(CPURISCVState *env, int csrno,
 }
 
 RISCVException riscv_csrrw_i128(CPURISCVState *env, int csrno,
-                                Int128 *ret_value,
-                                Int128 new_value, Int128 write_mask)
+                                Int128 *ret_value, Int128 new_value,
+                                Int128 write_mask, uintptr_t ra)
 {
     RISCVException ret;
 
@@ -5668,7 +5668,7 @@ RISCVException riscv_csrrw_i128(CPURISCVState *env, int csrno,
 
     if (csr_ops[csrno].read128) {
         return riscv_csrrw_do128(env, csrno, ret_value,
-                                 new_value, write_mask, 0);
+                                 new_value, write_mask, ra);
     }
 
     /*
@@ -5681,7 +5681,7 @@ RISCVException riscv_csrrw_i128(CPURISCVState *env, int csrno,
     target_ulong old_value;
     ret = riscv_csrrw_do64(env, csrno, &old_value,
                            int128_getlo(new_value),
-                           int128_getlo(write_mask), 0);
+                           int128_getlo(write_mask), ra);
     if (ret == RISCV_EXCP_NONE && ret_value) {
         *ret_value = int128_make64(old_value);
     }
diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
index 0672101637..557807ba4b 100644
--- a/target/riscv/op_helper.c
+++ b/target/riscv/op_helper.c
@@ -108,7 +108,7 @@ void helper_csrw_i128(CPURISCVState *env, int csr,
 {
     RISCVException ret = riscv_csrrw_i128(env, csr, NULL,
                                           int128_make128(srcl, srch),
-                                          UINT128_MAX);
+                                          UINT128_MAX, GETPC());
 
     if (ret != RISCV_EXCP_NONE) {
         riscv_raise_exception(env, ret, GETPC());
@@ -116,13 +116,14 @@ void helper_csrw_i128(CPURISCVState *env, int csr,
 }
 
 target_ulong helper_csrrw_i128(CPURISCVState *env, int csr,
-                       target_ulong srcl, target_ulong srch,
-                       target_ulong maskl, target_ulong maskh)
+                               target_ulong srcl, target_ulong srch,
+                               target_ulong maskl, target_ulong maskh)
 {
     Int128 rv = int128_zero();
     RISCVException ret = riscv_csrrw_i128(env, csr, &rv,
                                           int128_make128(srcl, srch),
-                                          int128_make128(maskl, maskh));
+                                          int128_make128(maskl, maskh),
+                                          GETPC());
 
     if (ret != RISCV_EXCP_NONE) {
         riscv_raise_exception(env, ret, GETPC());

From dd9953a5541441d283d0e5c53dffaf3938d6e097 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 25 Apr 2025 08:23:10 -0700
Subject: [PATCH 0998/2760] target/riscv: Move insn_len to internals.h
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250425152311.804338-7-richard.henderson@linaro.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/internals.h | 5 +++++
 target/riscv/translate.c | 5 -----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/target/riscv/internals.h b/target/riscv/internals.h
index 213aff31d8..4570bd50be 100644
--- a/target/riscv/internals.h
+++ b/target/riscv/internals.h
@@ -201,4 +201,9 @@ static inline target_ulong adjust_addr_virt(CPURISCVState *env,
     return adjust_addr_body(env, addr, true);
 }
 
+static inline int insn_len(uint16_t first_word)
+{
+    return (first_word & 3) == 3 ? 4 : 2;
+}
+
 #endif
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index 85128f997b..0d4f7d601c 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -1209,11 +1209,6 @@ static uint32_t opcode_at(DisasContextBase *dcbase, target_ulong pc)
 /* The specification allows for longer insns, but not supported by qemu. */
 #define MAX_INSN_LEN  4
 
-static inline int insn_len(uint16_t first_word)
-{
-    return (first_word & 3) == 3 ? 4 : 2;
-}
-
 const RISCVDecoder decoder_table[] = {
     { always_true_p, decode_insn32 },
     { has_xthead_p, decode_xthead},

From 7b069906b6ac47dc905d187c72f07ef82b400501 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 25 Apr 2025 08:23:11 -0700
Subject: [PATCH 0999/2760] target/riscv: Fix write_misa vs aligned next_pc
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Do not examine a random host return address, but
properly compute the next pc for the guest cpu.

Fixes: f18637cd611 ("RISC-V: Add misa runtime write support")
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250425152311.804338-8-richard.henderson@linaro.org>
[ Changes by AF:
 - Change `& ~3` to `& 3`
]
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 22 +++++++++++++++++-----
 1 file changed, 17 insertions(+), 5 deletions(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index 53458491da..288edeedea 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -30,6 +30,8 @@
 #include "accel/tcg/getpc.h"
 #include "qemu/guest-random.h"
 #include "qapi/error.h"
+#include "tcg/insn-start-words.h"
+#include "internals.h"
 #include <stdbool.h>
 
 /* CSR function table public API */
@@ -2099,6 +2101,19 @@ static RISCVException read_misa(CPURISCVState *env, int csrno,
     return RISCV_EXCP_NONE;
 }
 
+static target_ulong get_next_pc(CPURISCVState *env, uintptr_t ra)
+{
+    uint64_t data[INSN_START_WORDS];
+
+    /* Outside of a running cpu, env contains the next pc. */
+    if (ra == 0 || !cpu_unwind_state_data(env_cpu(env), ra, data)) {
+        return env->pc;
+    }
+
+    /* Within unwind data, [0] is pc and [1] is the opcode. */
+    return data[0] + insn_len(data[1]);
+}
+
 static RISCVException write_misa(CPURISCVState *env, int csrno,
                                  target_ulong val, uintptr_t ra)
 {
@@ -2114,11 +2129,8 @@ static RISCVException write_misa(CPURISCVState *env, int csrno,
     /* Mask extensions that are not supported by this hart */
     val &= env->misa_ext_mask;
 
-    /*
-     * Suppress 'C' if next instruction is not aligned
-     * TODO: this should check next_pc
-     */
-    if ((val & RVC) && (GETPC() & ~3) != 0) {
+    /* Suppress 'C' if next instruction is not aligned. */
+    if ((val & RVC) && (get_next_pc(env, ra) & 3) != 0) {
         val &= ~RVC;
     }
 

From 73f81da0a3628180409a0ae90ece19534bcdf09b Mon Sep 17 00:00:00 2001
From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Date: Tue, 29 Apr 2025 09:44:13 -0300
Subject: [PATCH 1000/2760] target/riscv/kvm: minor fixes/tweaks

Remove an unused 'KVMScratchCPU' pointer argument in
kvm_riscv_check_sbi_dbcn_support().

Put kvm_riscv_reset_regs_csr() after kvm_riscv_put_regs_csr(). This will
make a future patch diff easier to read, when changes in
kvm_riscv_reset_regs_csr() and kvm_riscv_get_regs_csr() will be made.

Fixes: a6b53378f5 ("target/riscv/kvm: implement SBI debug console (DBCN) calls")
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250429124421.223883-2-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Cc: qemu-stable@nongnu.org
---
 target/riscv/kvm/kvm-cpu.c | 29 ++++++++++++++---------------
 1 file changed, 14 insertions(+), 15 deletions(-)

diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
index 75724b6af4..cad54b720a 100644
--- a/target/riscv/kvm/kvm-cpu.c
+++ b/target/riscv/kvm/kvm-cpu.c
@@ -613,19 +613,6 @@ static int kvm_riscv_put_regs_core(CPUState *cs)
     return ret;
 }
 
-static void kvm_riscv_reset_regs_csr(CPURISCVState *env)
-{
-    env->mstatus = 0;
-    env->mie = 0;
-    env->stvec = 0;
-    env->sscratch = 0;
-    env->sepc = 0;
-    env->scause = 0;
-    env->stval = 0;
-    env->mip = 0;
-    env->satp = 0;
-}
-
 static int kvm_riscv_get_regs_csr(CPUState *cs)
 {
     CPURISCVState *env = &RISCV_CPU(cs)->env;
@@ -660,6 +647,19 @@ static int kvm_riscv_put_regs_csr(CPUState *cs)
     return 0;
 }
 
+static void kvm_riscv_reset_regs_csr(CPURISCVState *env)
+{
+    env->mstatus = 0;
+    env->mie = 0;
+    env->stvec = 0;
+    env->sscratch = 0;
+    env->sepc = 0;
+    env->scause = 0;
+    env->stval = 0;
+    env->mip = 0;
+    env->satp = 0;
+}
+
 static int kvm_riscv_get_regs_fp(CPUState *cs)
 {
     int ret = 0;
@@ -1078,7 +1078,6 @@ static int uint64_cmp(const void *a, const void *b)
 }
 
 static void kvm_riscv_check_sbi_dbcn_support(RISCVCPU *cpu,
-                                             KVMScratchCPU *kvmcpu,
                                              struct kvm_reg_list *reglist)
 {
     struct kvm_reg_list *reg_search;
@@ -1197,7 +1196,7 @@ static void kvm_riscv_init_multiext_cfg(RISCVCPU *cpu, KVMScratchCPU *kvmcpu)
         kvm_riscv_read_vlenb(cpu, kvmcpu, reglist);
     }
 
-    kvm_riscv_check_sbi_dbcn_support(cpu, kvmcpu, reglist);
+    kvm_riscv_check_sbi_dbcn_support(cpu, reglist);
 }
 
 static void riscv_init_kvm_registers(Object *cpu_obj)

From 906af6de9462c5192547cca0beac2c134659a437 Mon Sep 17 00:00:00 2001
From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Date: Tue, 29 Apr 2025 09:44:14 -0300
Subject: [PATCH 1001/2760] target/riscv/kvm: fix leak in
 kvm_riscv_init_multiext_cfg()

'reglist' is being g-malloc'ed but never freed.

Reported-by: Andrew Jones <ajones@ventanamicro.com>
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250429124421.223883-3-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Cc: qemu-stable@nongnu.org
---
 target/riscv/kvm/kvm-cpu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
index cad54b720a..86eb3c2e3b 100644
--- a/target/riscv/kvm/kvm-cpu.c
+++ b/target/riscv/kvm/kvm-cpu.c
@@ -1119,10 +1119,10 @@ static void kvm_riscv_read_vlenb(RISCVCPU *cpu, KVMScratchCPU *kvmcpu,
 
 static void kvm_riscv_init_multiext_cfg(RISCVCPU *cpu, KVMScratchCPU *kvmcpu)
 {
+    g_autofree struct kvm_reg_list *reglist = NULL;
     KVMCPUConfig *multi_ext_cfg;
     struct kvm_one_reg reg;
     struct kvm_reg_list rl_struct;
-    struct kvm_reg_list *reglist;
     uint64_t val, reg_id, *reg_search;
     int i, ret;
 

From b6096103494506514d9bfa442f62fef36ffc8fba Mon Sep 17 00:00:00 2001
From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Date: Tue, 29 Apr 2025 09:44:15 -0300
Subject: [PATCH 1002/2760] target/riscv/kvm: turn u32/u64 reg functions into
 macros

This change is motivated by a future change w.r.t CSRs management. We
want to handle them the same way as KVM extensions, i.e. a static array
with KVMCPUConfig objs that will be read/write during init and so on.
But to do that properly we must be able to declare a static array that
hold KVM regs.

C does not allow to init static arrays and use functions as
initializers, e.g. we can't do:

.kvm_reg_id = kvm_riscv_reg_id_ulong(...)

When instantiating the array. We can do that with macros though, so our
goal is turn kvm_riscv_reg_ulong() in a macro. It is cleaner to turn
every other reg_id_*() function in macros, and ulong will end up using
the macros for u32 and u64, so we'll start with them.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250429124421.223883-4-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Cc: qemu-stable@nongnu.org
---
 target/riscv/kvm/kvm-cpu.c | 22 +++++++++-------------
 1 file changed, 9 insertions(+), 13 deletions(-)

diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
index 86eb3c2e3b..b037cb2781 100644
--- a/target/riscv/kvm/kvm-cpu.c
+++ b/target/riscv/kvm/kvm-cpu.c
@@ -58,6 +58,12 @@ void riscv_kvm_aplic_request(void *opaque, int irq, int level)
 
 static bool cap_has_mp_state;
 
+#define KVM_RISCV_REG_ID_U32(type, idx) (KVM_REG_RISCV | KVM_REG_SIZE_U32 | \
+                                         type | idx)
+
+#define KVM_RISCV_REG_ID_U64(type, idx) (KVM_REG_RISCV | KVM_REG_SIZE_U64 | \
+                                         type | idx)
+
 static uint64_t kvm_riscv_reg_id_ulong(CPURISCVState *env, uint64_t type,
                                  uint64_t idx)
 {
@@ -76,16 +82,6 @@ static uint64_t kvm_riscv_reg_id_ulong(CPURISCVState *env, uint64_t type,
     return id;
 }
 
-static uint64_t kvm_riscv_reg_id_u32(uint64_t type, uint64_t idx)
-{
-    return KVM_REG_RISCV | KVM_REG_SIZE_U32 | type | idx;
-}
-
-static uint64_t kvm_riscv_reg_id_u64(uint64_t type, uint64_t idx)
-{
-    return KVM_REG_RISCV | KVM_REG_SIZE_U64 | type | idx;
-}
-
 static uint64_t kvm_encode_reg_size_id(uint64_t id, size_t size_b)
 {
     uint64_t size_ctz = __builtin_ctz(size_b);
@@ -119,12 +115,12 @@ static uint64_t kvm_riscv_vector_reg_id(RISCVCPU *cpu,
     kvm_riscv_reg_id_ulong(env, KVM_REG_RISCV_CONFIG, \
                            KVM_REG_RISCV_CONFIG_REG(name))
 
-#define RISCV_TIMER_REG(name)  kvm_riscv_reg_id_u64(KVM_REG_RISCV_TIMER, \
+#define RISCV_TIMER_REG(name)  KVM_RISCV_REG_ID_U64(KVM_REG_RISCV_TIMER, \
                  KVM_REG_RISCV_TIMER_REG(name))
 
-#define RISCV_FP_F_REG(idx)  kvm_riscv_reg_id_u32(KVM_REG_RISCV_FP_F, idx)
+#define RISCV_FP_F_REG(idx)  KVM_RISCV_REG_ID_U32(KVM_REG_RISCV_FP_F, idx)
 
-#define RISCV_FP_D_REG(idx)  kvm_riscv_reg_id_u64(KVM_REG_RISCV_FP_D, idx)
+#define RISCV_FP_D_REG(idx)  KVM_RISCV_REG_ID_U64(KVM_REG_RISCV_FP_D, idx)
 
 #define RISCV_VECTOR_CSR_REG(env, name) \
     kvm_riscv_reg_id_ulong(env, KVM_REG_RISCV_VECTOR, \

From 11766e17616a5a4181d4a63f88adf67ac52c553b Mon Sep 17 00:00:00 2001
From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Date: Tue, 29 Apr 2025 09:44:16 -0300
Subject: [PATCH 1003/2760] target/riscv/kvm: turn kvm_riscv_reg_id_ulong()
 into a macro

We need the reg_id_ulong() helper to be a macro to be able to create a
static array of KVMCPUConfig that will hold CSR information.

Despite the amount of changes all of them are tedious/trivial:

- replace instances of "kvm_riscv_reg_id_ulong" with
  "KVM_RISCV_REG_ID_ULONG";

- RISCV_CORE_REG(), RISCV_CSR_REG(), RISCV_CONFIG_REG() and
  RISCV_VECTOR_CSR_REG() only receives one 'name' arg. Remove unneeded
  'env' variables when applicable.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250429124421.223883-5-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Cc: qemu-stable@nongnu.org
---
 target/riscv/kvm/kvm-cpu.c | 99 ++++++++++++++++----------------------
 1 file changed, 41 insertions(+), 58 deletions(-)

diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
index b037cb2781..509c875a19 100644
--- a/target/riscv/kvm/kvm-cpu.c
+++ b/target/riscv/kvm/kvm-cpu.c
@@ -64,23 +64,11 @@ static bool cap_has_mp_state;
 #define KVM_RISCV_REG_ID_U64(type, idx) (KVM_REG_RISCV | KVM_REG_SIZE_U64 | \
                                          type | idx)
 
-static uint64_t kvm_riscv_reg_id_ulong(CPURISCVState *env, uint64_t type,
-                                 uint64_t idx)
-{
-    uint64_t id = KVM_REG_RISCV | type | idx;
-
-    switch (riscv_cpu_mxl(env)) {
-    case MXL_RV32:
-        id |= KVM_REG_SIZE_U32;
-        break;
-    case MXL_RV64:
-        id |= KVM_REG_SIZE_U64;
-        break;
-    default:
-        g_assert_not_reached();
-    }
-    return id;
-}
+#if defined(TARGET_RISCV64)
+#define KVM_RISCV_REG_ID_ULONG(type, idx) KVM_RISCV_REG_ID_U64(type, idx)
+#else
+#define KVM_RISCV_REG_ID_ULONG(type, idx) KVM_RISCV_REG_ID_U32(type, idx)
+#endif
 
 static uint64_t kvm_encode_reg_size_id(uint64_t id, size_t size_b)
 {
@@ -103,16 +91,16 @@ static uint64_t kvm_riscv_vector_reg_id(RISCVCPU *cpu,
     return kvm_encode_reg_size_id(id, size_b);
 }
 
-#define RISCV_CORE_REG(env, name) \
-    kvm_riscv_reg_id_ulong(env, KVM_REG_RISCV_CORE, \
+#define RISCV_CORE_REG(name) \
+    KVM_RISCV_REG_ID_ULONG(KVM_REG_RISCV_CORE, \
                            KVM_REG_RISCV_CORE_REG(name))
 
-#define RISCV_CSR_REG(env, name) \
-    kvm_riscv_reg_id_ulong(env, KVM_REG_RISCV_CSR, \
+#define RISCV_CSR_REG(name) \
+    KVM_RISCV_REG_ID_ULONG(KVM_REG_RISCV_CSR, \
                            KVM_REG_RISCV_CSR_REG(name))
 
-#define RISCV_CONFIG_REG(env, name) \
-    kvm_riscv_reg_id_ulong(env, KVM_REG_RISCV_CONFIG, \
+#define RISCV_CONFIG_REG(name) \
+    KVM_RISCV_REG_ID_ULONG(KVM_REG_RISCV_CONFIG, \
                            KVM_REG_RISCV_CONFIG_REG(name))
 
 #define RISCV_TIMER_REG(name)  KVM_RISCV_REG_ID_U64(KVM_REG_RISCV_TIMER, \
@@ -122,13 +110,13 @@ static uint64_t kvm_riscv_vector_reg_id(RISCVCPU *cpu,
 
 #define RISCV_FP_D_REG(idx)  KVM_RISCV_REG_ID_U64(KVM_REG_RISCV_FP_D, idx)
 
-#define RISCV_VECTOR_CSR_REG(env, name) \
-    kvm_riscv_reg_id_ulong(env, KVM_REG_RISCV_VECTOR, \
+#define RISCV_VECTOR_CSR_REG(name) \
+    KVM_RISCV_REG_ID_ULONG(KVM_REG_RISCV_VECTOR, \
                            KVM_REG_RISCV_VECTOR_CSR_REG(name))
 
 #define KVM_RISCV_GET_CSR(cs, env, csr, reg) \
     do { \
-        int _ret = kvm_get_one_reg(cs, RISCV_CSR_REG(env, csr), &reg); \
+        int _ret = kvm_get_one_reg(cs, RISCV_CSR_REG(csr), &reg); \
         if (_ret) { \
             return _ret; \
         } \
@@ -136,7 +124,7 @@ static uint64_t kvm_riscv_vector_reg_id(RISCVCPU *cpu,
 
 #define KVM_RISCV_SET_CSR(cs, env, csr, reg) \
     do { \
-        int _ret = kvm_set_one_reg(cs, RISCV_CSR_REG(env, csr), &reg); \
+        int _ret = kvm_set_one_reg(cs, RISCV_CSR_REG(csr), &reg); \
         if (_ret) { \
             return _ret; \
         } \
@@ -244,7 +232,7 @@ static void kvm_riscv_update_cpu_misa_ext(RISCVCPU *cpu, CPUState *cs)
 
         /* If we're here we're going to disable the MISA bit */
         reg = 0;
-        id = kvm_riscv_reg_id_ulong(env, KVM_REG_RISCV_ISA_EXT,
+        id = KVM_RISCV_REG_ID_ULONG(KVM_REG_RISCV_ISA_EXT,
                                     misa_cfg->kvm_reg_id);
         ret = kvm_set_one_reg(cs, id, &reg);
         if (ret != 0) {
@@ -430,7 +418,6 @@ static KVMCPUConfig kvm_sbi_dbcn = {
 
 static void kvm_riscv_update_cpu_cfg_isa_ext(RISCVCPU *cpu, CPUState *cs)
 {
-    CPURISCVState *env = &cpu->env;
     uint64_t id, reg;
     int i, ret;
 
@@ -441,7 +428,7 @@ static void kvm_riscv_update_cpu_cfg_isa_ext(RISCVCPU *cpu, CPUState *cs)
             continue;
         }
 
-        id = kvm_riscv_reg_id_ulong(env, KVM_REG_RISCV_ISA_EXT,
+        id = KVM_RISCV_REG_ID_ULONG(KVM_REG_RISCV_ISA_EXT,
                                     multi_ext_cfg->kvm_reg_id);
         reg = kvm_cpu_cfg_get(cpu, multi_ext_cfg);
         ret = kvm_set_one_reg(cs, id, &reg);
@@ -566,14 +553,14 @@ static int kvm_riscv_get_regs_core(CPUState *cs)
     target_ulong reg;
     CPURISCVState *env = &RISCV_CPU(cs)->env;
 
-    ret = kvm_get_one_reg(cs, RISCV_CORE_REG(env, regs.pc), &reg);
+    ret = kvm_get_one_reg(cs, RISCV_CORE_REG(regs.pc), &reg);
     if (ret) {
         return ret;
     }
     env->pc = reg;
 
     for (i = 1; i < 32; i++) {
-        uint64_t id = kvm_riscv_reg_id_ulong(env, KVM_REG_RISCV_CORE, i);
+        uint64_t id = KVM_RISCV_REG_ID_ULONG(KVM_REG_RISCV_CORE, i);
         ret = kvm_get_one_reg(cs, id, &reg);
         if (ret) {
             return ret;
@@ -592,13 +579,13 @@ static int kvm_riscv_put_regs_core(CPUState *cs)
     CPURISCVState *env = &RISCV_CPU(cs)->env;
 
     reg = env->pc;
-    ret = kvm_set_one_reg(cs, RISCV_CORE_REG(env, regs.pc), &reg);
+    ret = kvm_set_one_reg(cs, RISCV_CORE_REG(regs.pc), &reg);
     if (ret) {
         return ret;
     }
 
     for (i = 1; i < 32; i++) {
-        uint64_t id = kvm_riscv_reg_id_ulong(env, KVM_REG_RISCV_CORE, i);
+        uint64_t id = KVM_RISCV_REG_ID_ULONG(KVM_REG_RISCV_CORE, i);
         reg = env->gpr[i];
         ret = kvm_set_one_reg(cs, id, &reg);
         if (ret) {
@@ -796,26 +783,26 @@ static int kvm_riscv_get_regs_vector(CPUState *cs)
         return 0;
     }
 
-    ret = kvm_get_one_reg(cs, RISCV_VECTOR_CSR_REG(env, vstart), &reg);
+    ret = kvm_get_one_reg(cs, RISCV_VECTOR_CSR_REG(vstart), &reg);
     if (ret) {
         return ret;
     }
     env->vstart = reg;
 
-    ret = kvm_get_one_reg(cs, RISCV_VECTOR_CSR_REG(env, vl), &reg);
+    ret = kvm_get_one_reg(cs, RISCV_VECTOR_CSR_REG(vl), &reg);
     if (ret) {
         return ret;
     }
     env->vl = reg;
 
-    ret = kvm_get_one_reg(cs, RISCV_VECTOR_CSR_REG(env, vtype), &reg);
+    ret = kvm_get_one_reg(cs, RISCV_VECTOR_CSR_REG(vtype), &reg);
     if (ret) {
         return ret;
     }
     env->vtype = reg;
 
     if (kvm_v_vlenb.supported) {
-        ret = kvm_get_one_reg(cs, RISCV_VECTOR_CSR_REG(env, vlenb), &reg);
+        ret = kvm_get_one_reg(cs, RISCV_VECTOR_CSR_REG(vlenb), &reg);
         if (ret) {
             return ret;
         }
@@ -853,26 +840,26 @@ static int kvm_riscv_put_regs_vector(CPUState *cs)
     }
 
     reg = env->vstart;
-    ret = kvm_set_one_reg(cs, RISCV_VECTOR_CSR_REG(env, vstart), &reg);
+    ret = kvm_set_one_reg(cs, RISCV_VECTOR_CSR_REG(vstart), &reg);
     if (ret) {
         return ret;
     }
 
     reg = env->vl;
-    ret = kvm_set_one_reg(cs, RISCV_VECTOR_CSR_REG(env, vl), &reg);
+    ret = kvm_set_one_reg(cs, RISCV_VECTOR_CSR_REG(vl), &reg);
     if (ret) {
         return ret;
     }
 
     reg = env->vtype;
-    ret = kvm_set_one_reg(cs, RISCV_VECTOR_CSR_REG(env, vtype), &reg);
+    ret = kvm_set_one_reg(cs, RISCV_VECTOR_CSR_REG(vtype), &reg);
     if (ret) {
         return ret;
     }
 
     if (kvm_v_vlenb.supported) {
         reg = cpu->cfg.vlenb;
-        ret = kvm_set_one_reg(cs, RISCV_VECTOR_CSR_REG(env, vlenb), &reg);
+        ret = kvm_set_one_reg(cs, RISCV_VECTOR_CSR_REG(vlenb), &reg);
 
         for (int i = 0; i < 32; i++) {
             /*
@@ -951,25 +938,24 @@ static void kvm_riscv_destroy_scratch_vcpu(KVMScratchCPU *scratch)
 
 static void kvm_riscv_init_machine_ids(RISCVCPU *cpu, KVMScratchCPU *kvmcpu)
 {
-    CPURISCVState *env = &cpu->env;
     struct kvm_one_reg reg;
     int ret;
 
-    reg.id = RISCV_CONFIG_REG(env, mvendorid);
+    reg.id = RISCV_CONFIG_REG(mvendorid);
     reg.addr = (uint64_t)&cpu->cfg.mvendorid;
     ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
     if (ret != 0) {
         error_report("Unable to retrieve mvendorid from host, error %d", ret);
     }
 
-    reg.id = RISCV_CONFIG_REG(env, marchid);
+    reg.id = RISCV_CONFIG_REG(marchid);
     reg.addr = (uint64_t)&cpu->cfg.marchid;
     ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
     if (ret != 0) {
         error_report("Unable to retrieve marchid from host, error %d", ret);
     }
 
-    reg.id = RISCV_CONFIG_REG(env, mimpid);
+    reg.id = RISCV_CONFIG_REG(mimpid);
     reg.addr = (uint64_t)&cpu->cfg.mimpid;
     ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
     if (ret != 0) {
@@ -984,7 +970,7 @@ static void kvm_riscv_init_misa_ext_mask(RISCVCPU *cpu,
     struct kvm_one_reg reg;
     int ret;
 
-    reg.id = RISCV_CONFIG_REG(env, isa);
+    reg.id = RISCV_CONFIG_REG(isa);
     reg.addr = (uint64_t)&env->misa_ext_mask;
     ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
 
@@ -1001,11 +987,10 @@ static void kvm_riscv_init_misa_ext_mask(RISCVCPU *cpu,
 static void kvm_riscv_read_cbomz_blksize(RISCVCPU *cpu, KVMScratchCPU *kvmcpu,
                                          KVMCPUConfig *cbomz_cfg)
 {
-    CPURISCVState *env = &cpu->env;
     struct kvm_one_reg reg;
     int ret;
 
-    reg.id = kvm_riscv_reg_id_ulong(env, KVM_REG_RISCV_CONFIG,
+    reg.id = KVM_RISCV_REG_ID_ULONG(KVM_REG_RISCV_CONFIG,
                                     cbomz_cfg->kvm_reg_id);
     reg.addr = (uint64_t)kvmconfig_get_cfg_addr(cpu, cbomz_cfg);
     ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
@@ -1019,7 +1004,6 @@ static void kvm_riscv_read_cbomz_blksize(RISCVCPU *cpu, KVMScratchCPU *kvmcpu,
 static void kvm_riscv_read_multiext_legacy(RISCVCPU *cpu,
                                            KVMScratchCPU *kvmcpu)
 {
-    CPURISCVState *env = &cpu->env;
     uint64_t val;
     int i, ret;
 
@@ -1027,7 +1011,7 @@ static void kvm_riscv_read_multiext_legacy(RISCVCPU *cpu,
         KVMCPUConfig *multi_ext_cfg = &kvm_multi_ext_cfgs[i];
         struct kvm_one_reg reg;
 
-        reg.id = kvm_riscv_reg_id_ulong(env, KVM_REG_RISCV_ISA_EXT,
+        reg.id = KVM_RISCV_REG_ID_ULONG(KVM_REG_RISCV_ISA_EXT,
                                         multi_ext_cfg->kvm_reg_id);
         reg.addr = (uint64_t)&val;
         ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
@@ -1159,7 +1143,7 @@ static void kvm_riscv_init_multiext_cfg(RISCVCPU *cpu, KVMScratchCPU *kvmcpu)
 
     for (i = 0; i < ARRAY_SIZE(kvm_multi_ext_cfgs); i++) {
         multi_ext_cfg = &kvm_multi_ext_cfgs[i];
-        reg_id = kvm_riscv_reg_id_ulong(&cpu->env, KVM_REG_RISCV_ISA_EXT,
+        reg_id = KVM_RISCV_REG_ID_ULONG(KVM_REG_RISCV_ISA_EXT,
                                         multi_ext_cfg->kvm_reg_id);
         reg_search = bsearch(&reg_id, reglist->reg, reglist->n,
                              sizeof(uint64_t), uint64_cmp);
@@ -1338,12 +1322,11 @@ void kvm_arch_init_irq_routing(KVMState *s)
 
 static int kvm_vcpu_set_machine_ids(RISCVCPU *cpu, CPUState *cs)
 {
-    CPURISCVState *env = &cpu->env;
     target_ulong reg;
     uint64_t id;
     int ret;
 
-    id = RISCV_CONFIG_REG(env, mvendorid);
+    id = RISCV_CONFIG_REG(mvendorid);
     /*
      * cfg.mvendorid is an uint32 but a target_ulong will
      * be written. Assign it to a target_ulong var to avoid
@@ -1355,13 +1338,13 @@ static int kvm_vcpu_set_machine_ids(RISCVCPU *cpu, CPUState *cs)
         return ret;
     }
 
-    id = RISCV_CONFIG_REG(env, marchid);
+    id = RISCV_CONFIG_REG(marchid);
     ret = kvm_set_one_reg(cs, id, &cpu->cfg.marchid);
     if (ret != 0) {
         return ret;
     }
 
-    id = RISCV_CONFIG_REG(env, mimpid);
+    id = RISCV_CONFIG_REG(mimpid);
     ret = kvm_set_one_reg(cs, id, &cpu->cfg.mimpid);
 
     return ret;
@@ -1911,7 +1894,7 @@ void riscv_kvm_cpu_finalize_features(RISCVCPU *cpu, Error **errp)
     if (cpu->cfg.ext_zicbom &&
         riscv_cpu_option_set(kvm_cbom_blocksize.name)) {
 
-        reg.id = kvm_riscv_reg_id_ulong(env, KVM_REG_RISCV_CONFIG,
+        reg.id = KVM_RISCV_REG_ID_ULONG(KVM_REG_RISCV_CONFIG,
                                         kvm_cbom_blocksize.kvm_reg_id);
         reg.addr = (uint64_t)&val;
         ret = ioctl(kvmcpu.cpufd, KVM_GET_ONE_REG, &reg);
@@ -1930,7 +1913,7 @@ void riscv_kvm_cpu_finalize_features(RISCVCPU *cpu, Error **errp)
     if (cpu->cfg.ext_zicboz &&
         riscv_cpu_option_set(kvm_cboz_blocksize.name)) {
 
-        reg.id = kvm_riscv_reg_id_ulong(env, KVM_REG_RISCV_CONFIG,
+        reg.id = KVM_RISCV_REG_ID_ULONG(KVM_REG_RISCV_CONFIG,
                                         kvm_cboz_blocksize.kvm_reg_id);
         reg.addr = (uint64_t)&val;
         ret = ioctl(kvmcpu.cpufd, KVM_GET_ONE_REG, &reg);

From d3b6f1742c36e3a3c1e74cb60646ee98a4e39ea3 Mon Sep 17 00:00:00 2001
From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Date: Tue, 29 Apr 2025 09:44:17 -0300
Subject: [PATCH 1004/2760] target/riscv/kvm: add kvm_csr_cfgs[]

At this moment we're not checking if the host has support for any
specific CSR before doing get/put regs. This will cause problems if the
host KVM doesn't support it (see [1] as an example).

We'll use the same approach done with the CPU extensions: read all known
KVM CSRs during init() to check for availability, then read/write them
if they are present. This will be made by either using get-reglist or by
directly reading the CSRs.

For now we'll just convert the CSRs to use a kvm_csr_cfg[] array,
reusing the same KVMCPUConfig abstraction we use for extensions, and use
the array in (get|put)_csr_regs() instead of manually listing them. A
lot of boilerplate will be added but at least we'll automate the get/put
procedure for CSRs, i.e. adding a new CSR in the future will be a matter
of adding it in kvm_csr_regs[] and everything else will be taken care
of.

Despite all the code changes no behavioral change is made.

[1] https://lore.kernel.org/qemu-riscv/CABJz62OfUDHYkQ0T3rGHStQprf1c7_E0qBLbLKhfv=+jb0SYAw@mail.gmail.com/

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250429124421.223883-6-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Cc: qemu-stable@nongnu.org
---
 target/riscv/cpu.h         |   1 +
 target/riscv/kvm/kvm-cpu.c | 121 ++++++++++++++++++++++++++-----------
 2 files changed, 86 insertions(+), 36 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index ff7ba2a0a1..b56d3afa69 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -75,6 +75,7 @@ const char *riscv_get_misa_ext_name(uint32_t bit);
 const char *riscv_get_misa_ext_description(uint32_t bit);
 
 #define CPU_CFG_OFFSET(_prop) offsetof(struct RISCVCPUConfig, _prop)
+#define ENV_CSR_OFFSET(_csr) offsetof(CPURISCVState, _csr)
 
 typedef struct riscv_cpu_profile {
     struct riscv_cpu_profile *u_parent;
diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
index 509c875a19..3740514bba 100644
--- a/target/riscv/kvm/kvm-cpu.c
+++ b/target/riscv/kvm/kvm-cpu.c
@@ -114,22 +114,6 @@ static uint64_t kvm_riscv_vector_reg_id(RISCVCPU *cpu,
     KVM_RISCV_REG_ID_ULONG(KVM_REG_RISCV_VECTOR, \
                            KVM_REG_RISCV_VECTOR_CSR_REG(name))
 
-#define KVM_RISCV_GET_CSR(cs, env, csr, reg) \
-    do { \
-        int _ret = kvm_get_one_reg(cs, RISCV_CSR_REG(csr), &reg); \
-        if (_ret) { \
-            return _ret; \
-        } \
-    } while (0)
-
-#define KVM_RISCV_SET_CSR(cs, env, csr, reg) \
-    do { \
-        int _ret = kvm_set_one_reg(cs, RISCV_CSR_REG(csr), &reg); \
-        if (_ret) { \
-            return _ret; \
-        } \
-    } while (0)
-
 #define KVM_RISCV_GET_TIMER(cs, name, reg) \
     do { \
         int ret = kvm_get_one_reg(cs, RISCV_TIMER_REG(name), &reg); \
@@ -251,6 +235,53 @@ static void kvm_riscv_update_cpu_misa_ext(RISCVCPU *cpu, CPUState *cs)
     }
 }
 
+#define KVM_CSR_CFG(_name, _env_prop, reg_id) \
+    {.name = _name, .offset = ENV_CSR_OFFSET(_env_prop), \
+     .kvm_reg_id = reg_id}
+
+static KVMCPUConfig kvm_csr_cfgs[] = {
+    KVM_CSR_CFG("sstatus",    mstatus,    RISCV_CSR_REG(sstatus)),
+    KVM_CSR_CFG("sie",        mie,        RISCV_CSR_REG(sie)),
+    KVM_CSR_CFG("stvec",      stvec,      RISCV_CSR_REG(stvec)),
+    KVM_CSR_CFG("sscratch",   sscratch,   RISCV_CSR_REG(sscratch)),
+    KVM_CSR_CFG("sepc",       sepc,       RISCV_CSR_REG(sepc)),
+    KVM_CSR_CFG("scause",     scause,     RISCV_CSR_REG(scause)),
+    KVM_CSR_CFG("stval",      stval,      RISCV_CSR_REG(stval)),
+    KVM_CSR_CFG("sip",        mip,        RISCV_CSR_REG(sip)),
+    KVM_CSR_CFG("satp",       satp,       RISCV_CSR_REG(satp)),
+};
+
+static void *kvmconfig_get_env_addr(RISCVCPU *cpu, KVMCPUConfig *csr_cfg)
+{
+    return (void *)&cpu->env + csr_cfg->offset;
+}
+
+static uint32_t kvm_cpu_csr_get_u32(RISCVCPU *cpu, KVMCPUConfig *csr_cfg)
+{
+    uint32_t *val32 = kvmconfig_get_env_addr(cpu, csr_cfg);
+    return *val32;
+}
+
+static uint64_t kvm_cpu_csr_get_u64(RISCVCPU *cpu, KVMCPUConfig *csr_cfg)
+{
+    uint64_t *val64 = kvmconfig_get_env_addr(cpu, csr_cfg);
+    return *val64;
+}
+
+static void kvm_cpu_csr_set_u32(RISCVCPU *cpu, KVMCPUConfig *csr_cfg,
+                                uint32_t val)
+{
+    uint32_t *val32 = kvmconfig_get_env_addr(cpu, csr_cfg);
+    *val32 = val;
+}
+
+static void kvm_cpu_csr_set_u64(RISCVCPU *cpu, KVMCPUConfig *csr_cfg,
+                                uint64_t val)
+{
+    uint64_t *val64 = kvmconfig_get_env_addr(cpu, csr_cfg);
+    *val64 = val;
+}
+
 #define KVM_EXT_CFG(_name, _prop, _reg_id) \
     {.name = _name, .offset = CPU_CFG_OFFSET(_prop), \
      .kvm_reg_id = _reg_id}
@@ -598,34 +629,52 @@ static int kvm_riscv_put_regs_core(CPUState *cs)
 
 static int kvm_riscv_get_regs_csr(CPUState *cs)
 {
-    CPURISCVState *env = &RISCV_CPU(cs)->env;
+    RISCVCPU *cpu = RISCV_CPU(cs);
+    uint64_t reg;
+    int i, ret;
 
-    KVM_RISCV_GET_CSR(cs, env, sstatus, env->mstatus);
-    KVM_RISCV_GET_CSR(cs, env, sie, env->mie);
-    KVM_RISCV_GET_CSR(cs, env, stvec, env->stvec);
-    KVM_RISCV_GET_CSR(cs, env, sscratch, env->sscratch);
-    KVM_RISCV_GET_CSR(cs, env, sepc, env->sepc);
-    KVM_RISCV_GET_CSR(cs, env, scause, env->scause);
-    KVM_RISCV_GET_CSR(cs, env, stval, env->stval);
-    KVM_RISCV_GET_CSR(cs, env, sip, env->mip);
-    KVM_RISCV_GET_CSR(cs, env, satp, env->satp);
+    for (i = 0; i < ARRAY_SIZE(kvm_csr_cfgs); i++) {
+        KVMCPUConfig *csr_cfg = &kvm_csr_cfgs[i];
+
+        ret = kvm_get_one_reg(cs, csr_cfg->kvm_reg_id, &reg);
+        if (ret) {
+            return ret;
+        }
+
+        if (KVM_REG_SIZE(csr_cfg->kvm_reg_id) == sizeof(uint32_t)) {
+            kvm_cpu_csr_set_u32(cpu, csr_cfg, reg);
+        } else if (KVM_REG_SIZE(csr_cfg->kvm_reg_id) == sizeof(uint64_t)) {
+            kvm_cpu_csr_set_u64(cpu, csr_cfg, reg);
+        } else {
+            g_assert_not_reached();
+        }
+    }
 
     return 0;
 }
 
 static int kvm_riscv_put_regs_csr(CPUState *cs)
 {
-    CPURISCVState *env = &RISCV_CPU(cs)->env;
+    RISCVCPU *cpu = RISCV_CPU(cs);
+    uint64_t reg;
+    int i, ret;
 
-    KVM_RISCV_SET_CSR(cs, env, sstatus, env->mstatus);
-    KVM_RISCV_SET_CSR(cs, env, sie, env->mie);
-    KVM_RISCV_SET_CSR(cs, env, stvec, env->stvec);
-    KVM_RISCV_SET_CSR(cs, env, sscratch, env->sscratch);
-    KVM_RISCV_SET_CSR(cs, env, sepc, env->sepc);
-    KVM_RISCV_SET_CSR(cs, env, scause, env->scause);
-    KVM_RISCV_SET_CSR(cs, env, stval, env->stval);
-    KVM_RISCV_SET_CSR(cs, env, sip, env->mip);
-    KVM_RISCV_SET_CSR(cs, env, satp, env->satp);
+    for (i = 0; i < ARRAY_SIZE(kvm_csr_cfgs); i++) {
+        KVMCPUConfig *csr_cfg = &kvm_csr_cfgs[i];
+
+        if (KVM_REG_SIZE(csr_cfg->kvm_reg_id) == sizeof(uint32_t)) {
+            reg = kvm_cpu_csr_get_u32(cpu, csr_cfg);
+        } else if (KVM_REG_SIZE(csr_cfg->kvm_reg_id) == sizeof(uint64_t)) {
+            reg = kvm_cpu_csr_get_u64(cpu, csr_cfg);
+        } else {
+            g_assert_not_reached();
+        }
+
+        ret = kvm_set_one_reg(cs, csr_cfg->kvm_reg_id, &reg);
+        if (ret) {
+            return ret;
+        }
+    }
 
     return 0;
 }

From f396c217a53d9b7960dd002fbb07cfe1d46b27aa Mon Sep 17 00:00:00 2001
From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Date: Tue, 29 Apr 2025 09:44:18 -0300
Subject: [PATCH 1005/2760] target/riscv/kvm: do not read unavailable CSRs

[1] reports that commit 4db19d5b21 broke a KVM guest running kernel 6.6.
This happens because the kernel does not know 'senvcfg', making it
unable to boot because QEMU is reading/wriiting it without any checks.

After converting the CSRs to do "automated" get/put reg procedures in
the previous patch we can now scan for availability. Two functions are
created:

- kvm_riscv_read_csr_cfg_legacy() will check if the CSR exists by brute
  forcing KVM_GET_ONE_REG in each one of them, interpreting an EINVAL
  return as indication that the CSR isn't available. This will be use in
  absence of KVM_GET_REG_LIST;

- kvm_riscv_read_csr_cfg() will use the existing result of get_reg_list
  to check if the CSRs ids are present.

kvm_riscv_init_multiext_cfg() is now kvm_riscv_init_cfg() to reflect that
the function is also dealing with CSRs.

[1] https://lore.kernel.org/qemu-riscv/CABJz62OfUDHYkQ0T3rGHStQprf1c7_E0qBLbLKhfv=+jb0SYAw@mail.gmail.com/

Fixes: 4db19d5b21 ("target/riscv/kvm: add missing KVM CSRs")
Reported-by: Andrea Bolognani <abologna@redhat.com>
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250429124421.223883-7-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Cc: qemu-stable@nongnu.org
---
 target/riscv/kvm/kvm-cpu.c | 62 ++++++++++++++++++++++++++++++++++++--
 1 file changed, 59 insertions(+), 3 deletions(-)

diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
index 3740514bba..344616c1cc 100644
--- a/target/riscv/kvm/kvm-cpu.c
+++ b/target/riscv/kvm/kvm-cpu.c
@@ -636,6 +636,10 @@ static int kvm_riscv_get_regs_csr(CPUState *cs)
     for (i = 0; i < ARRAY_SIZE(kvm_csr_cfgs); i++) {
         KVMCPUConfig *csr_cfg = &kvm_csr_cfgs[i];
 
+        if (!csr_cfg->supported) {
+            continue;
+        }
+
         ret = kvm_get_one_reg(cs, csr_cfg->kvm_reg_id, &reg);
         if (ret) {
             return ret;
@@ -662,6 +666,10 @@ static int kvm_riscv_put_regs_csr(CPUState *cs)
     for (i = 0; i < ARRAY_SIZE(kvm_csr_cfgs); i++) {
         KVMCPUConfig *csr_cfg = &kvm_csr_cfgs[i];
 
+        if (!csr_cfg->supported) {
+            continue;
+        }
+
         if (KVM_REG_SIZE(csr_cfg->kvm_reg_id) == sizeof(uint32_t)) {
             reg = kvm_cpu_csr_get_u32(cpu, csr_cfg);
         } else if (KVM_REG_SIZE(csr_cfg->kvm_reg_id) == sizeof(uint64_t)) {
@@ -1090,6 +1098,32 @@ static void kvm_riscv_read_multiext_legacy(RISCVCPU *cpu,
     }
 }
 
+static void kvm_riscv_read_csr_cfg_legacy(KVMScratchCPU *kvmcpu)
+{
+    uint64_t val;
+    int i, ret;
+
+    for (i = 0; i < ARRAY_SIZE(kvm_csr_cfgs); i++) {
+        KVMCPUConfig *csr_cfg = &kvm_csr_cfgs[i];
+        struct kvm_one_reg reg;
+
+        reg.id = csr_cfg->kvm_reg_id;
+        reg.addr = (uint64_t)&val;
+        ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
+        if (ret != 0) {
+            if (errno == EINVAL) {
+                csr_cfg->supported = false;
+            } else {
+                error_report("Unable to read KVM CSR %s: %s",
+                             csr_cfg->name, strerror(errno));
+                exit(EXIT_FAILURE);
+            }
+        } else {
+            csr_cfg->supported = true;
+        }
+    }
+}
+
 static int uint64_cmp(const void *a, const void *b)
 {
     uint64_t val1 = *(const uint64_t *)a;
@@ -1146,7 +1180,26 @@ static void kvm_riscv_read_vlenb(RISCVCPU *cpu, KVMScratchCPU *kvmcpu,
     }
 }
 
-static void kvm_riscv_init_multiext_cfg(RISCVCPU *cpu, KVMScratchCPU *kvmcpu)
+static void kvm_riscv_read_csr_cfg(struct kvm_reg_list *reglist)
+{
+    struct kvm_reg_list *reg_search;
+    uint64_t reg_id;
+
+    for (int i = 0; i < ARRAY_SIZE(kvm_csr_cfgs); i++) {
+        KVMCPUConfig *csr_cfg = &kvm_csr_cfgs[i];
+
+        reg_id = csr_cfg->kvm_reg_id;
+        reg_search = bsearch(&reg_id, reglist->reg, reglist->n,
+                             sizeof(uint64_t), uint64_cmp);
+        if (!reg_search) {
+            continue;
+        }
+
+        csr_cfg->supported = true;
+    }
+}
+
+static void kvm_riscv_init_cfg(RISCVCPU *cpu, KVMScratchCPU *kvmcpu)
 {
     g_autofree struct kvm_reg_list *reglist = NULL;
     KVMCPUConfig *multi_ext_cfg;
@@ -1163,7 +1216,9 @@ static void kvm_riscv_init_multiext_cfg(RISCVCPU *cpu, KVMScratchCPU *kvmcpu)
      * (EINVAL). Use read_legacy() in this case.
      */
     if (errno == EINVAL) {
-        return kvm_riscv_read_multiext_legacy(cpu, kvmcpu);
+        kvm_riscv_read_multiext_legacy(cpu, kvmcpu);
+        kvm_riscv_read_csr_cfg_legacy(kvmcpu);
+        return;
     } else if (errno != E2BIG) {
         /*
          * E2BIG is an expected error message for the API since we
@@ -1226,6 +1281,7 @@ static void kvm_riscv_init_multiext_cfg(RISCVCPU *cpu, KVMScratchCPU *kvmcpu)
     }
 
     kvm_riscv_check_sbi_dbcn_support(cpu, reglist);
+    kvm_riscv_read_csr_cfg(reglist);
 }
 
 static void riscv_init_kvm_registers(Object *cpu_obj)
@@ -1239,7 +1295,7 @@ static void riscv_init_kvm_registers(Object *cpu_obj)
 
     kvm_riscv_init_machine_ids(cpu, &kvmcpu);
     kvm_riscv_init_misa_ext_mask(cpu, &kvmcpu);
-    kvm_riscv_init_multiext_cfg(cpu, &kvmcpu);
+    kvm_riscv_init_cfg(cpu, &kvmcpu);
 
     kvm_riscv_destroy_scratch_vcpu(&kvmcpu);
 }

From 86b8c3821496898cd3bd8eaa1bac71f5c784a2db Mon Sep 17 00:00:00 2001
From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Date: Tue, 29 Apr 2025 09:44:19 -0300
Subject: [PATCH 1006/2760] target/riscv/kvm: add senvcfg CSR

We're missing the senvcfg CSRs which is already present in the
KVM UAPI.

Reported-by: Andrew Jones <ajones@ventanamicro.com>
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250429124421.223883-8-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm/kvm-cpu.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
index 344616c1cc..0e34382163 100644
--- a/target/riscv/kvm/kvm-cpu.c
+++ b/target/riscv/kvm/kvm-cpu.c
@@ -249,6 +249,7 @@ static KVMCPUConfig kvm_csr_cfgs[] = {
     KVM_CSR_CFG("stval",      stval,      RISCV_CSR_REG(stval)),
     KVM_CSR_CFG("sip",        mip,        RISCV_CSR_REG(sip)),
     KVM_CSR_CFG("satp",       satp,       RISCV_CSR_REG(satp)),
+    KVM_CSR_CFG("senvcfg",    senvcfg,    RISCV_CSR_REG(senvcfg)),
 };
 
 static void *kvmconfig_get_env_addr(RISCVCPU *cpu, KVMCPUConfig *csr_cfg)
@@ -698,6 +699,7 @@ static void kvm_riscv_reset_regs_csr(CPURISCVState *env)
     env->stval = 0;
     env->mip = 0;
     env->satp = 0;
+    env->senvcfg = 0;
 }
 
 static int kvm_riscv_get_regs_fp(CPUState *cs)

From 775ac57e0a54b9127bd2ad005675772870cd1932 Mon Sep 17 00:00:00 2001
From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Date: Tue, 29 Apr 2025 09:44:20 -0300
Subject: [PATCH 1007/2760] target/riscv/kvm: read/write KVM regs via env size

We're going to add support for scounteren in the next patch. KVM defines
as a target_ulong CSR, while QEMU defines env->scounteren as a 32 bit
field. This will cause the current code to read/write a 64 bit CSR in a
32 bit field when running in a 64 bit CPU.

To prevent that, change the current logic to honor the size of the QEMU
storage instead of the KVM CSR reg.

Suggested-by: Andrew Jones <ajones@ventanamicro.com>
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-ID: <20250429124421.223883-9-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm/kvm-cpu.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
index 0e34382163..ca171d5457 100644
--- a/target/riscv/kvm/kvm-cpu.c
+++ b/target/riscv/kvm/kvm-cpu.c
@@ -135,6 +135,7 @@ typedef struct KVMCPUConfig {
     const char *description;
     target_ulong offset;
     uint64_t kvm_reg_id;
+    uint32_t prop_size;
     bool user_set;
     bool supported;
 } KVMCPUConfig;
@@ -237,6 +238,7 @@ static void kvm_riscv_update_cpu_misa_ext(RISCVCPU *cpu, CPUState *cs)
 
 #define KVM_CSR_CFG(_name, _env_prop, reg_id) \
     {.name = _name, .offset = ENV_CSR_OFFSET(_env_prop), \
+     .prop_size = sizeof(((CPURISCVState *)0)->_env_prop), \
      .kvm_reg_id = reg_id}
 
 static KVMCPUConfig kvm_csr_cfgs[] = {
@@ -646,9 +648,9 @@ static int kvm_riscv_get_regs_csr(CPUState *cs)
             return ret;
         }
 
-        if (KVM_REG_SIZE(csr_cfg->kvm_reg_id) == sizeof(uint32_t)) {
-            kvm_cpu_csr_set_u32(cpu, csr_cfg, reg);
-        } else if (KVM_REG_SIZE(csr_cfg->kvm_reg_id) == sizeof(uint64_t)) {
+        if (csr_cfg->prop_size == sizeof(uint32_t)) {
+            kvm_cpu_csr_set_u32(cpu, csr_cfg, (uint32_t)reg);
+        } else if (csr_cfg->prop_size == sizeof(uint64_t)) {
             kvm_cpu_csr_set_u64(cpu, csr_cfg, reg);
         } else {
             g_assert_not_reached();
@@ -671,9 +673,9 @@ static int kvm_riscv_put_regs_csr(CPUState *cs)
             continue;
         }
 
-        if (KVM_REG_SIZE(csr_cfg->kvm_reg_id) == sizeof(uint32_t)) {
+        if (csr_cfg->prop_size == sizeof(uint32_t)) {
             reg = kvm_cpu_csr_get_u32(cpu, csr_cfg);
-        } else if (KVM_REG_SIZE(csr_cfg->kvm_reg_id) == sizeof(uint64_t)) {
+        } else if (csr_cfg->prop_size == sizeof(uint64_t)) {
             reg = kvm_cpu_csr_get_u64(cpu, csr_cfg);
         } else {
             g_assert_not_reached();

From 8ab99a05f34bab3f9fae49299ee407ead78f0470 Mon Sep 17 00:00:00 2001
From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Date: Tue, 29 Apr 2025 09:44:21 -0300
Subject: [PATCH 1008/2760] target/riscv/kvm: add scounteren CSR

Add support for the scounteren KVM CSR. Note that env->scounteren is a
32 bit and all KVM CSRs are target_ulong, so scounteren will be capped
to 32 bits read/writes.

Reported-by: Andrew Jones <ajones@ventanamicro.com>
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250429124421.223883-10-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm/kvm-cpu.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
index ca171d5457..82f9728636 100644
--- a/target/riscv/kvm/kvm-cpu.c
+++ b/target/riscv/kvm/kvm-cpu.c
@@ -251,6 +251,7 @@ static KVMCPUConfig kvm_csr_cfgs[] = {
     KVM_CSR_CFG("stval",      stval,      RISCV_CSR_REG(stval)),
     KVM_CSR_CFG("sip",        mip,        RISCV_CSR_REG(sip)),
     KVM_CSR_CFG("satp",       satp,       RISCV_CSR_REG(satp)),
+    KVM_CSR_CFG("scounteren", scounteren, RISCV_CSR_REG(scounteren)),
     KVM_CSR_CFG("senvcfg",    senvcfg,    RISCV_CSR_REG(senvcfg)),
 };
 
@@ -701,6 +702,7 @@ static void kvm_riscv_reset_regs_csr(CPURISCVState *env)
     env->stval = 0;
     env->mip = 0;
     env->satp = 0;
+    env->scounteren = 0;
     env->senvcfg = 0;
 }
 

From 221e96cb7ae4535bcef7d54d1620a44be88b655e Mon Sep 17 00:00:00 2001
From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Date: Tue, 29 Apr 2025 09:58:03 -0300
Subject: [PATCH 1009/2760] hw/riscv/virt.c: enforce s->memmap use in
 machine_init()

Throughout the code we're accessing the board memmap, most of the time,
by accessing it statically via 'virt_memmap'. This static map is also
assigned in the machine state in s->memmap.

We're also passing it as a variable to some fdt functions, which is
unorthodox since we can spare a function argument by accessing it
statically or via the machine state.

All the current forms are valid but not all of the are scalable. In the
future we will version this board, and then all this code will need
rework because it should point to the updated memmap. In this case,
we'll want to assign the adequate versioned memmap once during init,
in s->memmap like it is being done today, and the rest of the code
will access the updated map via s->memmap.

We're also enforcing the pattern of using s->memmap instead of assigning
it to a temp variable 'memmap'. Code is copy/pasted around all the time
and being consistent is important.

We'll start these rather mechanical changes with virt_machine_init().

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Message-ID: <20250429125811.224803-2-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 54 ++++++++++++++++++++++++-------------------------
 1 file changed, 27 insertions(+), 27 deletions(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index 5958ad1f7d..0200679240 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -1522,7 +1522,6 @@ static void virt_machine_done(Notifier *notifier, void *data)
 
 static void virt_machine_init(MachineState *machine)
 {
-    const MemMapEntry *memmap = virt_memmap;
     RISCVVirtState *s = RISCV_VIRT_MACHINE(machine);
     MemoryRegion *system_memory = get_system_memory();
     MemoryRegion *mask_rom = g_new(MemoryRegion, 1);
@@ -1530,6 +1529,8 @@ static void virt_machine_init(MachineState *machine)
     int i, base_hartid, hart_count;
     int socket_count = riscv_socket_count(machine);
 
+    s->memmap = virt_memmap;
+
     /* Check socket count limit */
     if (VIRT_SOCKETS_MAX < socket_count) {
         error_report("number of sockets/nodes should be less than %d",
@@ -1577,7 +1578,7 @@ static void virt_machine_init(MachineState *machine)
         if (virt_aclint_allowed() && s->have_aclint) {
             if (s->aia_type == VIRT_AIA_TYPE_APLIC_IMSIC) {
                 /* Per-socket ACLINT MTIMER */
-                riscv_aclint_mtimer_create(memmap[VIRT_CLINT].base +
+                riscv_aclint_mtimer_create(s->memmap[VIRT_CLINT].base +
                             i * RISCV_ACLINT_DEFAULT_MTIMER_SIZE,
                         RISCV_ACLINT_DEFAULT_MTIMER_SIZE,
                         base_hartid, hart_count,
@@ -1586,28 +1587,28 @@ static void virt_machine_init(MachineState *machine)
                         RISCV_ACLINT_DEFAULT_TIMEBASE_FREQ, true);
             } else {
                 /* Per-socket ACLINT MSWI, MTIMER, and SSWI */
-                riscv_aclint_swi_create(memmap[VIRT_CLINT].base +
-                            i * memmap[VIRT_CLINT].size,
+                riscv_aclint_swi_create(s->memmap[VIRT_CLINT].base +
+                            i * s->memmap[VIRT_CLINT].size,
                         base_hartid, hart_count, false);
-                riscv_aclint_mtimer_create(memmap[VIRT_CLINT].base +
-                            i * memmap[VIRT_CLINT].size +
+                riscv_aclint_mtimer_create(s->memmap[VIRT_CLINT].base +
+                            i * s->memmap[VIRT_CLINT].size +
                             RISCV_ACLINT_SWI_SIZE,
                         RISCV_ACLINT_DEFAULT_MTIMER_SIZE,
                         base_hartid, hart_count,
                         RISCV_ACLINT_DEFAULT_MTIMECMP,
                         RISCV_ACLINT_DEFAULT_MTIME,
                         RISCV_ACLINT_DEFAULT_TIMEBASE_FREQ, true);
-                riscv_aclint_swi_create(memmap[VIRT_ACLINT_SSWI].base +
-                            i * memmap[VIRT_ACLINT_SSWI].size,
+                riscv_aclint_swi_create(s->memmap[VIRT_ACLINT_SSWI].base +
+                            i * s->memmap[VIRT_ACLINT_SSWI].size,
                         base_hartid, hart_count, true);
             }
         } else if (tcg_enabled()) {
             /* Per-socket SiFive CLINT */
             riscv_aclint_swi_create(
-                    memmap[VIRT_CLINT].base + i * memmap[VIRT_CLINT].size,
+                    s->memmap[VIRT_CLINT].base + i * s->memmap[VIRT_CLINT].size,
                     base_hartid, hart_count, false);
-            riscv_aclint_mtimer_create(memmap[VIRT_CLINT].base +
-                        i * memmap[VIRT_CLINT].size + RISCV_ACLINT_SWI_SIZE,
+            riscv_aclint_mtimer_create(s->memmap[VIRT_CLINT].base +
+                    i * s->memmap[VIRT_CLINT].size + RISCV_ACLINT_SWI_SIZE,
                     RISCV_ACLINT_DEFAULT_MTIMER_SIZE, base_hartid, hart_count,
                     RISCV_ACLINT_DEFAULT_MTIMECMP, RISCV_ACLINT_DEFAULT_MTIME,
                     RISCV_ACLINT_DEFAULT_TIMEBASE_FREQ, true);
@@ -1615,11 +1616,11 @@ static void virt_machine_init(MachineState *machine)
 
         /* Per-socket interrupt controller */
         if (s->aia_type == VIRT_AIA_TYPE_NONE) {
-            s->irqchip[i] = virt_create_plic(memmap, i,
+            s->irqchip[i] = virt_create_plic(s->memmap, i,
                                              base_hartid, hart_count);
         } else {
             s->irqchip[i] = virt_create_aia(s->aia_type, s->aia_guests,
-                                            memmap, i, base_hartid,
+                                            s->memmap, i, base_hartid,
                                             hart_count);
         }
 
@@ -1641,8 +1642,8 @@ static void virt_machine_init(MachineState *machine)
     if (kvm_enabled() && virt_use_kvm_aia_aplic_imsic(s->aia_type)) {
         kvm_riscv_aia_create(machine, IMSIC_MMIO_GROUP_MIN_SHIFT,
                              VIRT_IRQCHIP_NUM_SOURCES, VIRT_IRQCHIP_NUM_MSIS,
-                             memmap[VIRT_APLIC_S].base,
-                             memmap[VIRT_IMSIC_S].base,
+                             s->memmap[VIRT_APLIC_S].base,
+                             s->memmap[VIRT_IMSIC_S].base,
                              s->aia_guests);
     }
 
@@ -1658,21 +1659,20 @@ static void virt_machine_init(MachineState *machine)
         virt_high_pcie_memmap.size = VIRT32_HIGH_PCIE_MMIO_SIZE;
     } else {
         virt_high_pcie_memmap.size = VIRT64_HIGH_PCIE_MMIO_SIZE;
-        virt_high_pcie_memmap.base = memmap[VIRT_DRAM].base + machine->ram_size;
+        virt_high_pcie_memmap.base = s->memmap[VIRT_DRAM].base +
+                                     machine->ram_size;
         virt_high_pcie_memmap.base =
             ROUND_UP(virt_high_pcie_memmap.base, virt_high_pcie_memmap.size);
     }
 
-    s->memmap = virt_memmap;
-
     /* register system main memory (actual RAM) */
-    memory_region_add_subregion(system_memory, memmap[VIRT_DRAM].base,
-        machine->ram);
+    memory_region_add_subregion(system_memory, s->memmap[VIRT_DRAM].base,
+                                machine->ram);
 
     /* boot rom */
     memory_region_init_rom(mask_rom, NULL, "riscv_virt_board.mrom",
-                           memmap[VIRT_MROM].size, &error_fatal);
-    memory_region_add_subregion(system_memory, memmap[VIRT_MROM].base,
+                           s->memmap[VIRT_MROM].size, &error_fatal);
+    memory_region_add_subregion(system_memory, s->memmap[VIRT_MROM].base,
                                 mask_rom);
 
     /*
@@ -1683,12 +1683,12 @@ static void virt_machine_init(MachineState *machine)
     rom_set_fw(s->fw_cfg);
 
     /* SiFive Test MMIO device */
-    sifive_test_create(memmap[VIRT_TEST].base);
+    sifive_test_create(s->memmap[VIRT_TEST].base);
 
     /* VirtIO MMIO devices */
     for (i = 0; i < VIRTIO_COUNT; i++) {
         sysbus_create_simple("virtio-mmio",
-            memmap[VIRT_VIRTIO].base + i * memmap[VIRT_VIRTIO].size,
+            s->memmap[VIRT_VIRTIO].base + i * s->memmap[VIRT_VIRTIO].size,
             qdev_get_gpio_in(virtio_irqchip, VIRTIO_IRQ + i));
     }
 
@@ -1696,11 +1696,11 @@ static void virt_machine_init(MachineState *machine)
 
     create_platform_bus(s, mmio_irqchip);
 
-    serial_mm_init(system_memory, memmap[VIRT_UART0].base,
+    serial_mm_init(system_memory, s->memmap[VIRT_UART0].base,
         0, qdev_get_gpio_in(mmio_irqchip, UART0_IRQ), 399193,
         serial_hd(0), DEVICE_LITTLE_ENDIAN);
 
-    sysbus_create_simple("goldfish_rtc", memmap[VIRT_RTC].base,
+    sysbus_create_simple("goldfish_rtc", s->memmap[VIRT_RTC].base,
         qdev_get_gpio_in(mmio_irqchip, RTC_IRQ));
 
     for (i = 0; i < ARRAY_SIZE(s->flash); i++) {
@@ -1718,7 +1718,7 @@ static void virt_machine_init(MachineState *machine)
             exit(1);
         }
     } else {
-        create_fdt(s, memmap);
+        create_fdt(s, s->memmap);
     }
 
     if (virt_is_iommu_sys_enabled(s)) {

From fb8cf3fd98d7640d2ea3feca65fb40fba09a0235 Mon Sep 17 00:00:00 2001
From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Date: Tue, 29 Apr 2025 09:58:04 -0300
Subject: [PATCH 1010/2760] hw/riscv/virt.c: remove trivial virt_memmap
 references

We should use s->memmap instead of virt_memmap to be able to use an
updated memmap when we start versioning the board.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250429125811.224803-3-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 29 ++++++++++++++---------------
 1 file changed, 14 insertions(+), 15 deletions(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index 0200679240..843665a5bd 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -166,8 +166,8 @@ static void virt_flash_map1(PFlashCFI01 *flash,
 static void virt_flash_map(RISCVVirtState *s,
                            MemoryRegion *sysmem)
 {
-    hwaddr flashsize = virt_memmap[VIRT_FLASH].size / 2;
-    hwaddr flashbase = virt_memmap[VIRT_FLASH].base;
+    hwaddr flashsize = s->memmap[VIRT_FLASH].size / 2;
+    hwaddr flashbase = s->memmap[VIRT_FLASH].base;
 
     virt_flash_map1(s->flash[0], flashbase, flashsize,
                     sysmem);
@@ -999,8 +999,8 @@ static void create_fdt_rtc(RISCVVirtState *s, const MemMapEntry *memmap,
 static void create_fdt_flash(RISCVVirtState *s, const MemMapEntry *memmap)
 {
     MachineState *ms = MACHINE(s);
-    hwaddr flashsize = virt_memmap[VIRT_FLASH].size / 2;
-    hwaddr flashbase = virt_memmap[VIRT_FLASH].base;
+    hwaddr flashsize = s->memmap[VIRT_FLASH].size / 2;
+    hwaddr flashbase = s->memmap[VIRT_FLASH].base;
     g_autofree char *name = g_strdup_printf("/flash@%" PRIx64, flashbase);
 
     qemu_fdt_add_subnode(ms->fdt, name);
@@ -1035,7 +1035,7 @@ static void create_fdt_virtio_iommu(RISCVVirtState *s, uint16_t bdf)
     g_autofree char *pci_node = NULL;
 
     pci_node = g_strdup_printf("/soc/pci@%lx",
-                               (long) virt_memmap[VIRT_PCIE_ECAM].base);
+                               (long) s->memmap[VIRT_PCIE_ECAM].base);
     iommu_node = g_strdup_printf("%s/virtio_iommu@%x,%x", pci_node,
                                  PCI_SLOT(bdf), PCI_FUNC(bdf));
     iommu_phandle = qemu_fdt_alloc_phandle(fdt);
@@ -1104,7 +1104,7 @@ static void create_fdt_iommu(RISCVVirtState *s, uint16_t bdf)
     g_autofree char *pci_node = NULL;
 
     pci_node = g_strdup_printf("/soc/pci@%lx",
-                               (long) virt_memmap[VIRT_PCIE_ECAM].base);
+                               (long) s->memmap[VIRT_PCIE_ECAM].base);
     iommu_node = g_strdup_printf("%s/iommu@%x", pci_node, bdf);
     iommu_phandle = qemu_fdt_alloc_phandle(fdt);
     qemu_fdt_add_subnode(fdt, iommu_node);
@@ -1126,24 +1126,24 @@ static void finalize_fdt(RISCVVirtState *s)
     uint32_t irq_pcie_phandle = 1, irq_virtio_phandle = 1;
     uint32_t iommu_sys_phandle = 1;
 
-    create_fdt_sockets(s, virt_memmap, &phandle, &irq_mmio_phandle,
+    create_fdt_sockets(s, s->memmap, &phandle, &irq_mmio_phandle,
                        &irq_pcie_phandle, &irq_virtio_phandle,
                        &msi_pcie_phandle);
 
-    create_fdt_virtio(s, virt_memmap, irq_virtio_phandle);
+    create_fdt_virtio(s, s->memmap, irq_virtio_phandle);
 
     if (virt_is_iommu_sys_enabled(s)) {
         create_fdt_iommu_sys(s, irq_mmio_phandle, msi_pcie_phandle,
                              &iommu_sys_phandle);
     }
-    create_fdt_pcie(s, virt_memmap, irq_pcie_phandle, msi_pcie_phandle,
+    create_fdt_pcie(s, s->memmap, irq_pcie_phandle, msi_pcie_phandle,
                     iommu_sys_phandle);
 
-    create_fdt_reset(s, virt_memmap, &phandle);
+    create_fdt_reset(s, s->memmap, &phandle);
 
-    create_fdt_uart(s, virt_memmap, irq_mmio_phandle);
+    create_fdt_uart(s, s->memmap, irq_mmio_phandle);
 
-    create_fdt_rtc(s, virt_memmap, irq_mmio_phandle);
+    create_fdt_rtc(s, s->memmap, irq_mmio_phandle);
 }
 
 static void create_fdt(RISCVVirtState *s, const MemMapEntry *memmap)
@@ -1361,14 +1361,13 @@ static void create_platform_bus(RISCVVirtState *s, DeviceState *irqchip)
 {
     DeviceState *dev;
     SysBusDevice *sysbus;
-    const MemMapEntry *memmap = virt_memmap;
     int i;
     MemoryRegion *sysmem = get_system_memory();
 
     dev = qdev_new(TYPE_PLATFORM_BUS_DEVICE);
     dev->id = g_strdup(TYPE_PLATFORM_BUS_DEVICE);
     qdev_prop_set_uint32(dev, "num_irqs", VIRT_PLATFORM_BUS_NUM_IRQS);
-    qdev_prop_set_uint32(dev, "mmio_size", memmap[VIRT_PLATFORM_BUS].size);
+    qdev_prop_set_uint32(dev, "mmio_size", s->memmap[VIRT_PLATFORM_BUS].size);
     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
     s->platform_bus_dev = dev;
 
@@ -1379,7 +1378,7 @@ static void create_platform_bus(RISCVVirtState *s, DeviceState *irqchip)
     }
 
     memory_region_add_subregion(sysmem,
-                                memmap[VIRT_PLATFORM_BUS].base,
+                                s->memmap[VIRT_PLATFORM_BUS].base,
                                 sysbus_mmio_get_region(sysbus, 0));
 }
 

From 47e51e5d12740ebdcd797e4771b467ba8c2aba82 Mon Sep 17 00:00:00 2001
From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Date: Tue, 29 Apr 2025 09:58:05 -0300
Subject: [PATCH 1011/2760] hw/riscv/virt.c: use s->memmap in
 virt_machine_done()

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250429125811.224803-4-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index 843665a5bd..b349b2b1cf 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -1425,9 +1425,8 @@ static void virt_machine_done(Notifier *notifier, void *data)
 {
     RISCVVirtState *s = container_of(notifier, RISCVVirtState,
                                      machine_done);
-    const MemMapEntry *memmap = virt_memmap;
     MachineState *machine = MACHINE(s);
-    hwaddr start_addr = memmap[VIRT_DRAM].base;
+    hwaddr start_addr = s->memmap[VIRT_DRAM].base;
     target_ulong firmware_end_addr, kernel_start_addr;
     const char *firmware_name = riscv_default_firmware_name(&s->soc[0]);
     uint64_t fdt_load_addr;
@@ -1471,14 +1470,14 @@ static void virt_machine_done(Notifier *notifier, void *data)
              * let's overwrite the address we jump to after reset to
              * the base of the flash.
              */
-            start_addr = virt_memmap[VIRT_FLASH].base;
+            start_addr = s->memmap[VIRT_FLASH].base;
         } else {
             /*
              * Pflash was supplied but either KVM guest or bios is not none.
              * In this case, base of the flash would contain S-mode payload.
              */
             riscv_setup_firmware_boot(machine);
-            kernel_entry = virt_memmap[VIRT_FLASH].base;
+            kernel_entry = s->memmap[VIRT_FLASH].base;
         }
     }
 
@@ -1492,15 +1491,15 @@ static void virt_machine_done(Notifier *notifier, void *data)
         kernel_entry = boot_info.image_low_addr;
     }
 
-    fdt_load_addr = riscv_compute_fdt_addr(memmap[VIRT_DRAM].base,
-                                           memmap[VIRT_DRAM].size,
+    fdt_load_addr = riscv_compute_fdt_addr(s->memmap[VIRT_DRAM].base,
+                                           s->memmap[VIRT_DRAM].size,
                                            machine, &boot_info);
     riscv_load_fdt(fdt_load_addr, machine->fdt);
 
     /* load the reset vector */
     riscv_setup_rom_reset_vec(machine, &s->soc[0], start_addr,
-                              virt_memmap[VIRT_MROM].base,
-                              virt_memmap[VIRT_MROM].size, kernel_entry,
+                              s->memmap[VIRT_MROM].base,
+                              s->memmap[VIRT_MROM].size, kernel_entry,
                               fdt_load_addr);
 
     /*

From 6418ff383d53e5872f2746d490885f0a551385a4 Mon Sep 17 00:00:00 2001
From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Date: Tue, 29 Apr 2025 09:58:06 -0300
Subject: [PATCH 1012/2760] hw/riscv/virt.c: add 'base' arg in create_fw_cfg()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The function can receive the value via s->memmap[VIRT_FW_CFG].base from
the caller, avoiding the use of virt_memmap.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250429125811.224803-5-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index b349b2b1cf..3d547f7c2b 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -1262,9 +1262,8 @@ static inline DeviceState *gpex_pcie_init(MemoryRegion *sys_mem,
     return dev;
 }
 
-static FWCfgState *create_fw_cfg(const MachineState *ms)
+static FWCfgState *create_fw_cfg(const MachineState *ms, hwaddr base)
 {
-    hwaddr base = virt_memmap[VIRT_FW_CFG].base;
     FWCfgState *fw_cfg;
 
     fw_cfg = fw_cfg_init_mem_wide(base + 8, base, 8, base + 16,
@@ -1677,7 +1676,7 @@ static void virt_machine_init(MachineState *machine)
      * Init fw_cfg. Must be done before riscv_load_fdt, otherwise the
      * device tree cannot be altered and we get FDT_ERR_NOSPACE.
      */
-    s->fw_cfg = create_fw_cfg(machine);
+    s->fw_cfg = create_fw_cfg(machine, s->memmap[VIRT_FW_CFG].base);
     rom_set_fw(s->fw_cfg);
 
     /* SiFive Test MMIO device */

From 658e501969d948735669fcf82206a0ef92755f97 Mon Sep 17 00:00:00 2001
From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Date: Tue, 29 Apr 2025 09:58:07 -0300
Subject: [PATCH 1013/2760] hw/riscv/virt.c: use s->memmap in create_fdt() path

create_fdt(), create_fdt_flash() and create_fdt_fw_cfg() can access the
memmap via their RISCVVirtState pointers.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250429125811.224803-6-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index 3d547f7c2b..8a703a0233 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -996,7 +996,7 @@ static void create_fdt_rtc(RISCVVirtState *s, const MemMapEntry *memmap,
     }
 }
 
-static void create_fdt_flash(RISCVVirtState *s, const MemMapEntry *memmap)
+static void create_fdt_flash(RISCVVirtState *s)
 {
     MachineState *ms = MACHINE(s);
     hwaddr flashsize = s->memmap[VIRT_FLASH].size / 2;
@@ -1011,11 +1011,11 @@ static void create_fdt_flash(RISCVVirtState *s, const MemMapEntry *memmap)
     qemu_fdt_setprop_cell(ms->fdt, name, "bank-width", 4);
 }
 
-static void create_fdt_fw_cfg(RISCVVirtState *s, const MemMapEntry *memmap)
+static void create_fdt_fw_cfg(RISCVVirtState *s)
 {
     MachineState *ms = MACHINE(s);
-    hwaddr base = memmap[VIRT_FW_CFG].base;
-    hwaddr size = memmap[VIRT_FW_CFG].size;
+    hwaddr base = s->memmap[VIRT_FW_CFG].base;
+    hwaddr size = s->memmap[VIRT_FW_CFG].size;
     g_autofree char *nodename = g_strdup_printf("/fw-cfg@%" PRIx64, base);
 
     qemu_fdt_add_subnode(ms->fdt, nodename);
@@ -1146,7 +1146,7 @@ static void finalize_fdt(RISCVVirtState *s)
     create_fdt_rtc(s, s->memmap, irq_mmio_phandle);
 }
 
-static void create_fdt(RISCVVirtState *s, const MemMapEntry *memmap)
+static void create_fdt(RISCVVirtState *s)
 {
     MachineState *ms = MACHINE(s);
     uint8_t rng_seed[32];
@@ -1173,7 +1173,8 @@ static void create_fdt(RISCVVirtState *s, const MemMapEntry *memmap)
      * The "/soc/pci@..." node is needed for PCIE hotplugs
      * that might happen before finalize_fdt().
      */
-    name = g_strdup_printf("/soc/pci@%lx", (long) memmap[VIRT_PCIE_ECAM].base);
+    name = g_strdup_printf("/soc/pci@%lx",
+                           (long) s->memmap[VIRT_PCIE_ECAM].base);
     qemu_fdt_add_subnode(ms->fdt, name);
 
     qemu_fdt_add_subnode(ms->fdt, "/chosen");
@@ -1185,8 +1186,8 @@ static void create_fdt(RISCVVirtState *s, const MemMapEntry *memmap)
 
     qemu_fdt_add_subnode(ms->fdt, "/aliases");
 
-    create_fdt_flash(s, memmap);
-    create_fdt_fw_cfg(s, memmap);
+    create_fdt_flash(s);
+    create_fdt_fw_cfg(s);
     create_fdt_pmu(s);
 }
 
@@ -1715,7 +1716,7 @@ static void virt_machine_init(MachineState *machine)
             exit(1);
         }
     } else {
-        create_fdt(s, s->memmap);
+        create_fdt(s);
     }
 
     if (virt_is_iommu_sys_enabled(s)) {

From 04c4f8d1ee373b9b8c413619f5600caa3e7b006c Mon Sep 17 00:00:00 2001
From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Date: Tue, 29 Apr 2025 09:58:08 -0300
Subject: [PATCH 1014/2760] hw/riscv/virt.c: use s->memmap in
 create_fdt_sockets() path

create_fdt_sockets() and all its fdt helpers (create_fdt_socket_aplic(),
create_fdt_imsic(), create_fdt_socket_plic(), create_fdt_socket_aclint()
and create_fdt_socket_memory()) can use s->memmap from their
RISCVVirtState pointer instead of having an extra memmap argument.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250429125811.224803-7-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 89 ++++++++++++++++++++++++++-----------------------
 1 file changed, 47 insertions(+), 42 deletions(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index 8a703a0233..e66a46f524 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -301,14 +301,13 @@ static void create_fdt_socket_cpus(RISCVVirtState *s, int socket,
     }
 }
 
-static void create_fdt_socket_memory(RISCVVirtState *s,
-                                     const MemMapEntry *memmap, int socket)
+static void create_fdt_socket_memory(RISCVVirtState *s, int socket)
 {
     g_autofree char *mem_name = NULL;
     uint64_t addr, size;
     MachineState *ms = MACHINE(s);
 
-    addr = memmap[VIRT_DRAM].base + riscv_socket_mem_offset(ms, socket);
+    addr = s->memmap[VIRT_DRAM].base + riscv_socket_mem_offset(ms, socket);
     size = riscv_socket_mem_size(ms, socket);
     mem_name = g_strdup_printf("/memory@%lx", (long)addr);
     qemu_fdt_add_subnode(ms->fdt, mem_name);
@@ -319,7 +318,7 @@ static void create_fdt_socket_memory(RISCVVirtState *s,
 }
 
 static void create_fdt_socket_clint(RISCVVirtState *s,
-                                    const MemMapEntry *memmap, int socket,
+                                    int socket,
                                     uint32_t *intc_phandles)
 {
     int cpu;
@@ -340,21 +339,22 @@ static void create_fdt_socket_clint(RISCVVirtState *s,
         clint_cells[cpu * 4 + 3] = cpu_to_be32(IRQ_M_TIMER);
     }
 
-    clint_addr = memmap[VIRT_CLINT].base + (memmap[VIRT_CLINT].size * socket);
+    clint_addr = s->memmap[VIRT_CLINT].base +
+                 (s->memmap[VIRT_CLINT].size * socket);
     clint_name = g_strdup_printf("/soc/clint@%lx", clint_addr);
     qemu_fdt_add_subnode(ms->fdt, clint_name);
     qemu_fdt_setprop_string_array(ms->fdt, clint_name, "compatible",
                                   (char **)&clint_compat,
                                   ARRAY_SIZE(clint_compat));
     qemu_fdt_setprop_cells(ms->fdt, clint_name, "reg",
-        0x0, clint_addr, 0x0, memmap[VIRT_CLINT].size);
+        0x0, clint_addr, 0x0, s->memmap[VIRT_CLINT].size);
     qemu_fdt_setprop(ms->fdt, clint_name, "interrupts-extended",
         clint_cells, s->soc[socket].num_harts * sizeof(uint32_t) * 4);
     riscv_socket_fdt_write_id(ms, clint_name, socket);
 }
 
 static void create_fdt_socket_aclint(RISCVVirtState *s,
-                                     const MemMapEntry *memmap, int socket,
+                                     int socket,
                                      uint32_t *intc_phandles)
 {
     int cpu;
@@ -381,8 +381,10 @@ static void create_fdt_socket_aclint(RISCVVirtState *s,
     aclint_cells_size = s->soc[socket].num_harts * sizeof(uint32_t) * 2;
 
     if (s->aia_type != VIRT_AIA_TYPE_APLIC_IMSIC) {
-        addr = memmap[VIRT_CLINT].base + (memmap[VIRT_CLINT].size * socket);
+        addr = s->memmap[VIRT_CLINT].base +
+               (s->memmap[VIRT_CLINT].size * socket);
         name = g_strdup_printf("/soc/mswi@%lx", addr);
+
         qemu_fdt_add_subnode(ms->fdt, name);
         qemu_fdt_setprop_string(ms->fdt, name, "compatible",
             "riscv,aclint-mswi");
@@ -397,13 +399,13 @@ static void create_fdt_socket_aclint(RISCVVirtState *s,
     }
 
     if (s->aia_type == VIRT_AIA_TYPE_APLIC_IMSIC) {
-        addr = memmap[VIRT_CLINT].base +
+        addr = s->memmap[VIRT_CLINT].base +
                (RISCV_ACLINT_DEFAULT_MTIMER_SIZE * socket);
         size = RISCV_ACLINT_DEFAULT_MTIMER_SIZE;
     } else {
-        addr = memmap[VIRT_CLINT].base + RISCV_ACLINT_SWI_SIZE +
-            (memmap[VIRT_CLINT].size * socket);
-        size = memmap[VIRT_CLINT].size - RISCV_ACLINT_SWI_SIZE;
+        addr = s->memmap[VIRT_CLINT].base + RISCV_ACLINT_SWI_SIZE +
+               (s->memmap[VIRT_CLINT].size * socket);
+        size = s->memmap[VIRT_CLINT].size - RISCV_ACLINT_SWI_SIZE;
     }
     name = g_strdup_printf("/soc/mtimer@%lx", addr);
     qemu_fdt_add_subnode(ms->fdt, name);
@@ -420,14 +422,15 @@ static void create_fdt_socket_aclint(RISCVVirtState *s,
     g_free(name);
 
     if (s->aia_type != VIRT_AIA_TYPE_APLIC_IMSIC) {
-        addr = memmap[VIRT_ACLINT_SSWI].base +
-            (memmap[VIRT_ACLINT_SSWI].size * socket);
+        addr = s->memmap[VIRT_ACLINT_SSWI].base +
+               (s->memmap[VIRT_ACLINT_SSWI].size * socket);
+
         name = g_strdup_printf("/soc/sswi@%lx", addr);
         qemu_fdt_add_subnode(ms->fdt, name);
         qemu_fdt_setprop_string(ms->fdt, name, "compatible",
             "riscv,aclint-sswi");
         qemu_fdt_setprop_cells(ms->fdt, name, "reg",
-            0x0, addr, 0x0, memmap[VIRT_ACLINT_SSWI].size);
+            0x0, addr, 0x0, s->memmap[VIRT_ACLINT_SSWI].size);
         qemu_fdt_setprop(ms->fdt, name, "interrupts-extended",
             aclint_sswi_cells, aclint_cells_size);
         qemu_fdt_setprop(ms->fdt, name, "interrupt-controller", NULL, 0);
@@ -438,7 +441,7 @@ static void create_fdt_socket_aclint(RISCVVirtState *s,
 }
 
 static void create_fdt_socket_plic(RISCVVirtState *s,
-                                   const MemMapEntry *memmap, int socket,
+                                   int socket,
                                    uint32_t *phandle, uint32_t *intc_phandles,
                                    uint32_t *plic_phandles)
 {
@@ -452,7 +455,8 @@ static void create_fdt_socket_plic(RISCVVirtState *s,
     };
 
     plic_phandles[socket] = (*phandle)++;
-    plic_addr = memmap[VIRT_PLIC].base + (memmap[VIRT_PLIC].size * socket);
+    plic_addr = s->memmap[VIRT_PLIC].base +
+                (s->memmap[VIRT_PLIC].size * socket);
     plic_name = g_strdup_printf("/soc/plic@%lx", plic_addr);
     qemu_fdt_add_subnode(ms->fdt, plic_name);
     qemu_fdt_setprop_cell(ms->fdt, plic_name,
@@ -491,7 +495,7 @@ static void create_fdt_socket_plic(RISCVVirtState *s,
     }
 
     qemu_fdt_setprop_cells(ms->fdt, plic_name, "reg",
-        0x0, plic_addr, 0x0, memmap[VIRT_PLIC].size);
+        0x0, plic_addr, 0x0, s->memmap[VIRT_PLIC].size);
     qemu_fdt_setprop_cell(ms->fdt, plic_name, "riscv,ndev",
                           VIRT_IRQCHIP_NUM_SOURCES - 1);
     riscv_socket_fdt_write_id(ms, plic_name, socket);
@@ -500,8 +504,8 @@ static void create_fdt_socket_plic(RISCVVirtState *s,
 
     if (!socket) {
         platform_bus_add_all_fdt_nodes(ms->fdt, plic_name,
-                                       memmap[VIRT_PLATFORM_BUS].base,
-                                       memmap[VIRT_PLATFORM_BUS].size,
+                                       s->memmap[VIRT_PLATFORM_BUS].base,
+                                       s->memmap[VIRT_PLATFORM_BUS].size,
                                        VIRT_PLATFORM_BUS_IRQ);
     }
 }
@@ -588,7 +592,7 @@ static void create_fdt_one_imsic(RISCVVirtState *s, hwaddr base_addr,
     qemu_fdt_setprop_cell(ms->fdt, imsic_name, "phandle", msi_phandle);
 }
 
-static void create_fdt_imsic(RISCVVirtState *s, const MemMapEntry *memmap,
+static void create_fdt_imsic(RISCVVirtState *s,
                              uint32_t *phandle, uint32_t *intc_phandles,
                              uint32_t *msi_m_phandle, uint32_t *msi_s_phandle)
 {
@@ -597,12 +601,12 @@ static void create_fdt_imsic(RISCVVirtState *s, const MemMapEntry *memmap,
 
     if (!kvm_enabled()) {
         /* M-level IMSIC node */
-        create_fdt_one_imsic(s, memmap[VIRT_IMSIC_M].base, intc_phandles,
+        create_fdt_one_imsic(s, s->memmap[VIRT_IMSIC_M].base, intc_phandles,
                              *msi_m_phandle, true, 0);
     }
 
     /* S-level IMSIC node */
-    create_fdt_one_imsic(s, memmap[VIRT_IMSIC_S].base, intc_phandles,
+    create_fdt_one_imsic(s, s->memmap[VIRT_IMSIC_S].base, intc_phandles,
                          *msi_s_phandle, false,
                          imsic_num_bits(s->aia_guests + 1));
 
@@ -679,7 +683,7 @@ static void create_fdt_one_aplic(RISCVVirtState *s, int socket,
 }
 
 static void create_fdt_socket_aplic(RISCVVirtState *s,
-                                    const MemMapEntry *memmap, int socket,
+                                    int socket,
                                     uint32_t msi_m_phandle,
                                     uint32_t msi_s_phandle,
                                     uint32_t *phandle,
@@ -696,18 +700,19 @@ static void create_fdt_socket_aplic(RISCVVirtState *s,
 
     if (!kvm_enabled()) {
         /* M-level APLIC node */
-        aplic_addr = memmap[VIRT_APLIC_M].base +
-                     (memmap[VIRT_APLIC_M].size * socket);
-        create_fdt_one_aplic(s, socket, aplic_addr, memmap[VIRT_APLIC_M].size,
+        aplic_addr = s->memmap[VIRT_APLIC_M].base +
+                     (s->memmap[VIRT_APLIC_M].size * socket);
+        create_fdt_one_aplic(s, socket, aplic_addr,
+                             s->memmap[VIRT_APLIC_M].size,
                              msi_m_phandle, intc_phandles,
                              aplic_m_phandle, aplic_s_phandle,
                              true, num_harts);
     }
 
     /* S-level APLIC node */
-    aplic_addr = memmap[VIRT_APLIC_S].base +
-                 (memmap[VIRT_APLIC_S].size * socket);
-    create_fdt_one_aplic(s, socket, aplic_addr, memmap[VIRT_APLIC_S].size,
+    aplic_addr = s->memmap[VIRT_APLIC_S].base +
+                 (s->memmap[VIRT_APLIC_S].size * socket);
+    create_fdt_one_aplic(s, socket, aplic_addr, s->memmap[VIRT_APLIC_S].size,
                          msi_s_phandle, intc_phandles,
                          aplic_s_phandle, 0,
                          false, num_harts);
@@ -715,8 +720,8 @@ static void create_fdt_socket_aplic(RISCVVirtState *s,
     if (!socket) {
         g_autofree char *aplic_name = fdt_get_aplic_nodename(aplic_addr);
         platform_bus_add_all_fdt_nodes(ms->fdt, aplic_name,
-                                       memmap[VIRT_PLATFORM_BUS].base,
-                                       memmap[VIRT_PLATFORM_BUS].size,
+                                       s->memmap[VIRT_PLATFORM_BUS].base,
+                                       s->memmap[VIRT_PLATFORM_BUS].size,
                                        VIRT_PLATFORM_BUS_IRQ);
     }
 
@@ -734,7 +739,7 @@ static void create_fdt_pmu(RISCVVirtState *s)
     riscv_pmu_generate_fdt_node(ms->fdt, hart.pmu_avail_ctrs, pmu_name);
 }
 
-static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
+static void create_fdt_sockets(RISCVVirtState *s,
                                uint32_t *phandle,
                                uint32_t *irq_mmio_phandle,
                                uint32_t *irq_pcie_phandle,
@@ -770,20 +775,20 @@ static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
         create_fdt_socket_cpus(s, socket, clust_name, phandle,
                                &intc_phandles[phandle_pos]);
 
-        create_fdt_socket_memory(s, memmap, socket);
+        create_fdt_socket_memory(s, socket);
 
         if (virt_aclint_allowed() && s->have_aclint) {
-            create_fdt_socket_aclint(s, memmap, socket,
+            create_fdt_socket_aclint(s, socket,
                                      &intc_phandles[phandle_pos]);
         } else if (tcg_enabled()) {
-            create_fdt_socket_clint(s, memmap, socket,
+            create_fdt_socket_clint(s, socket,
                                     &intc_phandles[phandle_pos]);
         }
     }
 
     if (s->aia_type == VIRT_AIA_TYPE_APLIC_IMSIC) {
-        create_fdt_imsic(s, memmap, phandle, intc_phandles,
-            &msi_m_phandle, &msi_s_phandle);
+        create_fdt_imsic(s, phandle, intc_phandles,
+                         &msi_m_phandle, &msi_s_phandle);
         *msi_pcie_phandle = msi_s_phandle;
     }
 
@@ -792,7 +797,7 @@ static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
      * mode, we'll use only one APLIC instance.
      */
     if (!virt_use_emulated_aplic(s->aia_type)) {
-        create_fdt_socket_aplic(s, memmap, 0,
+        create_fdt_socket_aplic(s, 0,
                                 msi_m_phandle, msi_s_phandle, phandle,
                                 &intc_phandles[0], xplic_phandles,
                                 ms->smp.cpus);
@@ -806,11 +811,11 @@ static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
             phandle_pos -= s->soc[socket].num_harts;
 
             if (s->aia_type == VIRT_AIA_TYPE_NONE) {
-                create_fdt_socket_plic(s, memmap, socket, phandle,
+                create_fdt_socket_plic(s, socket, phandle,
                                        &intc_phandles[phandle_pos],
                                        xplic_phandles);
             } else {
-                create_fdt_socket_aplic(s, memmap, socket,
+                create_fdt_socket_aplic(s, socket,
                                         msi_m_phandle, msi_s_phandle, phandle,
                                         &intc_phandles[phandle_pos],
                                         xplic_phandles,
@@ -1126,7 +1131,7 @@ static void finalize_fdt(RISCVVirtState *s)
     uint32_t irq_pcie_phandle = 1, irq_virtio_phandle = 1;
     uint32_t iommu_sys_phandle = 1;
 
-    create_fdt_sockets(s, s->memmap, &phandle, &irq_mmio_phandle,
+    create_fdt_sockets(s, &phandle, &irq_mmio_phandle,
                        &irq_pcie_phandle, &irq_virtio_phandle,
                        &msi_pcie_phandle);
 

From a51a88fd5d2784c8f6eaaa386dbb5d621949f3e5 Mon Sep 17 00:00:00 2001
From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Date: Tue, 29 Apr 2025 09:58:09 -0300
Subject: [PATCH 1015/2760] hw/riscv/virt.c: use s->memmap in
 create_fdt_virtio()

create_fdt_virtio() can use s->memmap instead of having an extra
argument for it.

While we're at it rewrite it a little bit to avoid the clunky line in
'name' and code repetition:

- declare 'virtio_base' out of the loop since it never changes;
- declare a 'size' variable. Use it to calculate the address of the
  virtio device in an 'addr' variable;
- use 'addr' in the 'name' g_strdup_printf();
- use 'addr' and 'size' when creating the 'reg' property.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250429125811.224803-8-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index e66a46f524..37bd720068 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -842,21 +842,24 @@ static void create_fdt_sockets(RISCVVirtState *s,
     riscv_socket_fdt_write_distance_matrix(ms);
 }
 
-static void create_fdt_virtio(RISCVVirtState *s, const MemMapEntry *memmap,
-                              uint32_t irq_virtio_phandle)
+static void create_fdt_virtio(RISCVVirtState *s, uint32_t irq_virtio_phandle)
 {
     int i;
     MachineState *ms = MACHINE(s);
+    hwaddr virtio_base = s->memmap[VIRT_VIRTIO].base;
 
     for (i = 0; i < VIRTIO_COUNT; i++) {
-        g_autofree char *name =  g_strdup_printf("/soc/virtio_mmio@%lx",
-            (long)(memmap[VIRT_VIRTIO].base + i * memmap[VIRT_VIRTIO].size));
+        g_autofree char *name = NULL;
+        uint64_t size = s->memmap[VIRT_VIRTIO].size;
+        hwaddr addr = virtio_base + i * size;
+
+        name = g_strdup_printf("/soc/virtio_mmio@%"HWADDR_PRIx, addr);
 
         qemu_fdt_add_subnode(ms->fdt, name);
         qemu_fdt_setprop_string(ms->fdt, name, "compatible", "virtio,mmio");
         qemu_fdt_setprop_cells(ms->fdt, name, "reg",
-            0x0, memmap[VIRT_VIRTIO].base + i * memmap[VIRT_VIRTIO].size,
-            0x0, memmap[VIRT_VIRTIO].size);
+                               0x0, addr,
+                               0x0, size);
         qemu_fdt_setprop_cell(ms->fdt, name, "interrupt-parent",
             irq_virtio_phandle);
         if (s->aia_type == VIRT_AIA_TYPE_NONE) {
@@ -1135,7 +1138,7 @@ static void finalize_fdt(RISCVVirtState *s)
                        &irq_pcie_phandle, &irq_virtio_phandle,
                        &msi_pcie_phandle);
 
-    create_fdt_virtio(s, s->memmap, irq_virtio_phandle);
+    create_fdt_virtio(s, irq_virtio_phandle);
 
     if (virt_is_iommu_sys_enabled(s)) {
         create_fdt_iommu_sys(s, irq_mmio_phandle, msi_pcie_phandle,

From 621e45271f53d09789155ea89e16cdee34988654 Mon Sep 17 00:00:00 2001
From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Date: Tue, 29 Apr 2025 09:58:10 -0300
Subject: [PATCH 1016/2760] hw/riscv/virt.c: use s->memmap in finalize_fdt()
 functions

Change create_fdt_pcie(), create_fdt_reset(), create_fdt_uart() and
create_fdt_rtc() to use s->memmap in their logic.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250429125811.224803-9-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 44 ++++++++++++++++++++++----------------------
 1 file changed, 22 insertions(+), 22 deletions(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index 37bd720068..edb6973100 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -872,7 +872,7 @@ static void create_fdt_virtio(RISCVVirtState *s, uint32_t irq_virtio_phandle)
     }
 }
 
-static void create_fdt_pcie(RISCVVirtState *s, const MemMapEntry *memmap,
+static void create_fdt_pcie(RISCVVirtState *s,
                             uint32_t irq_pcie_phandle,
                             uint32_t msi_pcie_phandle,
                             uint32_t iommu_sys_phandle)
@@ -881,7 +881,7 @@ static void create_fdt_pcie(RISCVVirtState *s, const MemMapEntry *memmap,
     MachineState *ms = MACHINE(s);
 
     name = g_strdup_printf("/soc/pci@%lx",
-        (long) memmap[VIRT_PCIE_ECAM].base);
+        (long) s->memmap[VIRT_PCIE_ECAM].base);
     qemu_fdt_setprop_cell(ms->fdt, name, "#address-cells",
         FDT_PCI_ADDR_CELLS);
     qemu_fdt_setprop_cell(ms->fdt, name, "#interrupt-cells",
@@ -892,19 +892,19 @@ static void create_fdt_pcie(RISCVVirtState *s, const MemMapEntry *memmap,
     qemu_fdt_setprop_string(ms->fdt, name, "device_type", "pci");
     qemu_fdt_setprop_cell(ms->fdt, name, "linux,pci-domain", 0);
     qemu_fdt_setprop_cells(ms->fdt, name, "bus-range", 0,
-        memmap[VIRT_PCIE_ECAM].size / PCIE_MMCFG_SIZE_MIN - 1);
+        s->memmap[VIRT_PCIE_ECAM].size / PCIE_MMCFG_SIZE_MIN - 1);
     qemu_fdt_setprop(ms->fdt, name, "dma-coherent", NULL, 0);
     if (s->aia_type == VIRT_AIA_TYPE_APLIC_IMSIC) {
         qemu_fdt_setprop_cell(ms->fdt, name, "msi-parent", msi_pcie_phandle);
     }
     qemu_fdt_setprop_cells(ms->fdt, name, "reg", 0,
-        memmap[VIRT_PCIE_ECAM].base, 0, memmap[VIRT_PCIE_ECAM].size);
+        s->memmap[VIRT_PCIE_ECAM].base, 0, s->memmap[VIRT_PCIE_ECAM].size);
     qemu_fdt_setprop_sized_cells(ms->fdt, name, "ranges",
         1, FDT_PCI_RANGE_IOPORT, 2, 0,
-        2, memmap[VIRT_PCIE_PIO].base, 2, memmap[VIRT_PCIE_PIO].size,
+        2, s->memmap[VIRT_PCIE_PIO].base, 2, s->memmap[VIRT_PCIE_PIO].size,
         1, FDT_PCI_RANGE_MMIO,
-        2, memmap[VIRT_PCIE_MMIO].base,
-        2, memmap[VIRT_PCIE_MMIO].base, 2, memmap[VIRT_PCIE_MMIO].size,
+        2, s->memmap[VIRT_PCIE_MMIO].base,
+        2, s->memmap[VIRT_PCIE_MMIO].base, 2, s->memmap[VIRT_PCIE_MMIO].size,
         1, FDT_PCI_RANGE_MMIO_64BIT,
         2, virt_high_pcie_memmap.base,
         2, virt_high_pcie_memmap.base, 2, virt_high_pcie_memmap.size);
@@ -918,8 +918,7 @@ static void create_fdt_pcie(RISCVVirtState *s, const MemMapEntry *memmap,
     create_pcie_irq_map(s, ms->fdt, name, irq_pcie_phandle);
 }
 
-static void create_fdt_reset(RISCVVirtState *s, const MemMapEntry *memmap,
-                             uint32_t *phandle)
+static void create_fdt_reset(RISCVVirtState *s, uint32_t *phandle)
 {
     char *name;
     uint32_t test_phandle;
@@ -927,7 +926,7 @@ static void create_fdt_reset(RISCVVirtState *s, const MemMapEntry *memmap,
 
     test_phandle = (*phandle)++;
     name = g_strdup_printf("/soc/test@%lx",
-        (long)memmap[VIRT_TEST].base);
+        (long)s->memmap[VIRT_TEST].base);
     qemu_fdt_add_subnode(ms->fdt, name);
     {
         static const char * const compat[3] = {
@@ -937,7 +936,7 @@ static void create_fdt_reset(RISCVVirtState *s, const MemMapEntry *memmap,
                                       (char **)&compat, ARRAY_SIZE(compat));
     }
     qemu_fdt_setprop_cells(ms->fdt, name, "reg",
-        0x0, memmap[VIRT_TEST].base, 0x0, memmap[VIRT_TEST].size);
+        0x0, s->memmap[VIRT_TEST].base, 0x0, s->memmap[VIRT_TEST].size);
     qemu_fdt_setprop_cell(ms->fdt, name, "phandle", test_phandle);
     test_phandle = qemu_fdt_get_phandle(ms->fdt, name);
     g_free(name);
@@ -959,18 +958,19 @@ static void create_fdt_reset(RISCVVirtState *s, const MemMapEntry *memmap,
     g_free(name);
 }
 
-static void create_fdt_uart(RISCVVirtState *s, const MemMapEntry *memmap,
+static void create_fdt_uart(RISCVVirtState *s,
                             uint32_t irq_mmio_phandle)
 {
     g_autofree char *name = NULL;
     MachineState *ms = MACHINE(s);
 
-    name = g_strdup_printf("/soc/serial@%lx", (long)memmap[VIRT_UART0].base);
+    name = g_strdup_printf("/soc/serial@%lx",
+                           (long)s->memmap[VIRT_UART0].base);
     qemu_fdt_add_subnode(ms->fdt, name);
     qemu_fdt_setprop_string(ms->fdt, name, "compatible", "ns16550a");
     qemu_fdt_setprop_cells(ms->fdt, name, "reg",
-        0x0, memmap[VIRT_UART0].base,
-        0x0, memmap[VIRT_UART0].size);
+        0x0, s->memmap[VIRT_UART0].base,
+        0x0, s->memmap[VIRT_UART0].size);
     qemu_fdt_setprop_cell(ms->fdt, name, "clock-frequency", 3686400);
     qemu_fdt_setprop_cell(ms->fdt, name, "interrupt-parent", irq_mmio_phandle);
     if (s->aia_type == VIRT_AIA_TYPE_NONE) {
@@ -983,18 +983,18 @@ static void create_fdt_uart(RISCVVirtState *s, const MemMapEntry *memmap,
     qemu_fdt_setprop_string(ms->fdt, "/aliases", "serial0", name);
 }
 
-static void create_fdt_rtc(RISCVVirtState *s, const MemMapEntry *memmap,
+static void create_fdt_rtc(RISCVVirtState *s,
                            uint32_t irq_mmio_phandle)
 {
     g_autofree char *name = NULL;
     MachineState *ms = MACHINE(s);
 
-    name = g_strdup_printf("/soc/rtc@%lx", (long)memmap[VIRT_RTC].base);
+    name = g_strdup_printf("/soc/rtc@%lx", (long)s->memmap[VIRT_RTC].base);
     qemu_fdt_add_subnode(ms->fdt, name);
     qemu_fdt_setprop_string(ms->fdt, name, "compatible",
         "google,goldfish-rtc");
     qemu_fdt_setprop_cells(ms->fdt, name, "reg",
-        0x0, memmap[VIRT_RTC].base, 0x0, memmap[VIRT_RTC].size);
+        0x0, s->memmap[VIRT_RTC].base, 0x0, s->memmap[VIRT_RTC].size);
     qemu_fdt_setprop_cell(ms->fdt, name, "interrupt-parent",
         irq_mmio_phandle);
     if (s->aia_type == VIRT_AIA_TYPE_NONE) {
@@ -1144,14 +1144,14 @@ static void finalize_fdt(RISCVVirtState *s)
         create_fdt_iommu_sys(s, irq_mmio_phandle, msi_pcie_phandle,
                              &iommu_sys_phandle);
     }
-    create_fdt_pcie(s, s->memmap, irq_pcie_phandle, msi_pcie_phandle,
+    create_fdt_pcie(s, irq_pcie_phandle, msi_pcie_phandle,
                     iommu_sys_phandle);
 
-    create_fdt_reset(s, s->memmap, &phandle);
+    create_fdt_reset(s, &phandle);
 
-    create_fdt_uart(s, s->memmap, irq_mmio_phandle);
+    create_fdt_uart(s, irq_mmio_phandle);
 
-    create_fdt_rtc(s, s->memmap, irq_mmio_phandle);
+    create_fdt_rtc(s, irq_mmio_phandle);
 }
 
 static void create_fdt(RISCVVirtState *s)

From e7cb99bfd1afc5cf2265a122bcfeab36eff7489a Mon Sep 17 00:00:00 2001
From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Date: Tue, 29 Apr 2025 09:58:11 -0300
Subject: [PATCH 1017/2760] hw/riscv/virt.c: remove 'long' casts in fmt strings
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We can avoid the 'long' casts by using PRIx64 and HWADDR_PRIx on the fmt
strings for uint64_t and hwaddr types.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250429125811.224803-10-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 32 +++++++++++++++++---------------
 1 file changed, 17 insertions(+), 15 deletions(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index edb6973100..0dcced1b49 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -304,12 +304,13 @@ static void create_fdt_socket_cpus(RISCVVirtState *s, int socket,
 static void create_fdt_socket_memory(RISCVVirtState *s, int socket)
 {
     g_autofree char *mem_name = NULL;
-    uint64_t addr, size;
+    hwaddr addr;
+    uint64_t size;
     MachineState *ms = MACHINE(s);
 
     addr = s->memmap[VIRT_DRAM].base + riscv_socket_mem_offset(ms, socket);
     size = riscv_socket_mem_size(ms, socket);
-    mem_name = g_strdup_printf("/memory@%lx", (long)addr);
+    mem_name = g_strdup_printf("/memory@%"HWADDR_PRIx, addr);
     qemu_fdt_add_subnode(ms->fdt, mem_name);
     qemu_fdt_setprop_cells(ms->fdt, mem_name, "reg",
         addr >> 32, addr, size >> 32, size);
@@ -880,8 +881,8 @@ static void create_fdt_pcie(RISCVVirtState *s,
     g_autofree char *name = NULL;
     MachineState *ms = MACHINE(s);
 
-    name = g_strdup_printf("/soc/pci@%lx",
-        (long) s->memmap[VIRT_PCIE_ECAM].base);
+    name = g_strdup_printf("/soc/pci@%"HWADDR_PRIx,
+                           s->memmap[VIRT_PCIE_ECAM].base);
     qemu_fdt_setprop_cell(ms->fdt, name, "#address-cells",
         FDT_PCI_ADDR_CELLS);
     qemu_fdt_setprop_cell(ms->fdt, name, "#interrupt-cells",
@@ -925,8 +926,8 @@ static void create_fdt_reset(RISCVVirtState *s, uint32_t *phandle)
     MachineState *ms = MACHINE(s);
 
     test_phandle = (*phandle)++;
-    name = g_strdup_printf("/soc/test@%lx",
-        (long)s->memmap[VIRT_TEST].base);
+    name = g_strdup_printf("/soc/test@%"HWADDR_PRIx,
+                           s->memmap[VIRT_TEST].base);
     qemu_fdt_add_subnode(ms->fdt, name);
     {
         static const char * const compat[3] = {
@@ -964,8 +965,8 @@ static void create_fdt_uart(RISCVVirtState *s,
     g_autofree char *name = NULL;
     MachineState *ms = MACHINE(s);
 
-    name = g_strdup_printf("/soc/serial@%lx",
-                           (long)s->memmap[VIRT_UART0].base);
+    name = g_strdup_printf("/soc/serial@%"HWADDR_PRIx,
+                           s->memmap[VIRT_UART0].base);
     qemu_fdt_add_subnode(ms->fdt, name);
     qemu_fdt_setprop_string(ms->fdt, name, "compatible", "ns16550a");
     qemu_fdt_setprop_cells(ms->fdt, name, "reg",
@@ -989,7 +990,8 @@ static void create_fdt_rtc(RISCVVirtState *s,
     g_autofree char *name = NULL;
     MachineState *ms = MACHINE(s);
 
-    name = g_strdup_printf("/soc/rtc@%lx", (long)s->memmap[VIRT_RTC].base);
+    name = g_strdup_printf("/soc/rtc@%"HWADDR_PRIx,
+                           s->memmap[VIRT_RTC].base);
     qemu_fdt_add_subnode(ms->fdt, name);
     qemu_fdt_setprop_string(ms->fdt, name, "compatible",
         "google,goldfish-rtc");
@@ -1042,8 +1044,8 @@ static void create_fdt_virtio_iommu(RISCVVirtState *s, uint16_t bdf)
     g_autofree char *iommu_node = NULL;
     g_autofree char *pci_node = NULL;
 
-    pci_node = g_strdup_printf("/soc/pci@%lx",
-                               (long) s->memmap[VIRT_PCIE_ECAM].base);
+    pci_node = g_strdup_printf("/soc/pci@%"HWADDR_PRIx,
+                               s->memmap[VIRT_PCIE_ECAM].base);
     iommu_node = g_strdup_printf("%s/virtio_iommu@%x,%x", pci_node,
                                  PCI_SLOT(bdf), PCI_FUNC(bdf));
     iommu_phandle = qemu_fdt_alloc_phandle(fdt);
@@ -1111,8 +1113,8 @@ static void create_fdt_iommu(RISCVVirtState *s, uint16_t bdf)
     g_autofree char *iommu_node = NULL;
     g_autofree char *pci_node = NULL;
 
-    pci_node = g_strdup_printf("/soc/pci@%lx",
-                               (long) s->memmap[VIRT_PCIE_ECAM].base);
+    pci_node = g_strdup_printf("/soc/pci@%"HWADDR_PRIx,
+                               s->memmap[VIRT_PCIE_ECAM].base);
     iommu_node = g_strdup_printf("%s/iommu@%x", pci_node, bdf);
     iommu_phandle = qemu_fdt_alloc_phandle(fdt);
     qemu_fdt_add_subnode(fdt, iommu_node);
@@ -1181,8 +1183,8 @@ static void create_fdt(RISCVVirtState *s)
      * The "/soc/pci@..." node is needed for PCIE hotplugs
      * that might happen before finalize_fdt().
      */
-    name = g_strdup_printf("/soc/pci@%lx",
-                           (long) s->memmap[VIRT_PCIE_ECAM].base);
+    name = g_strdup_printf("/soc/pci@%"HWADDR_PRIx,
+                           s->memmap[VIRT_PCIE_ECAM].base);
     qemu_fdt_add_subnode(ms->fdt, name);
 
     qemu_fdt_add_subnode(ms->fdt, "/chosen");

From 5979f50fa9fdbb3fb49e2b498f84faa7503c8ed1 Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Tue, 13 May 2025 23:16:51 -0400
Subject: [PATCH 1018/2760] i386/tcg: Make CPUID_HT and CPUID_EXT3_CMP_LEG
 supported

Since commit c6bd2dd63420 ("i386/cpu: Set up CPUID_HT in
x86_cpu_expand_features() instead of cpu_x86_cpuid()") and
commit 99a637a86f55 ("i386/cpu: Set and track CPUID_EXT3_CMP_LEG in
env->features[FEAT_8000_0001_ECX]"), it gets warnings when booting the
VM with vcpus >= 2 and with tcg:

  qemu-system-x86_64: warning: TCG doesn't support requested feature: CPUID.01H:EDX.ht [bit 28]
  qemu-system-x86_64: warning: TCG doesn't support requested feature: CPUID.80000001H:ECX.cmp-legacy [bit 1]

This is because, after the two commits, CPUID_HT and CPUID_EXT3_CMP_LEG
are set in env->features[] when vcpus >=2 (in x86_cpu_expand_features())
later in x86_cpu_filter_features() it will check against the TCG supported
bits. However, current TCG doesn't mark the two bits as supported, hence
the warnings.

Fix it by adding the two bits to the supported bits of TCG since multiple
vcpus are supported by TCG.

Fixes: c6bd2dd63420 ("i386/cpu: Set up CPUID_HT in x86_cpu_expand_features() instead of cpu_x86_cpuid()")
Fixes: 99a637a86f55 ("i386/cpu: Set and track CPUID_EXT3_CMP_LEG in env->features[FEAT_8000_0001_ECX]")
Reported-by: Ewan Hai <ewanhai-oc@zhaoxin.com>
Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Link: https://lore.kernel.org/r/20250514031652.838763-2-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index ec908d7d36..9689f6374e 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -776,11 +776,12 @@ void x86_cpu_vendor_words2str(char *dst, uint32_t vendor1,
           CPUID_PAE | CPUID_MCE | CPUID_CX8 | CPUID_APIC | CPUID_SEP | \
           CPUID_MTRR | CPUID_PGE | CPUID_MCA | CPUID_CMOV | CPUID_PAT | \
           CPUID_PSE36 | CPUID_CLFLUSH | CPUID_ACPI | CPUID_MMX | \
-          CPUID_FXSR | CPUID_SSE | CPUID_SSE2 | CPUID_SS | CPUID_DE)
+          CPUID_FXSR | CPUID_SSE | CPUID_SSE2 | CPUID_SS | CPUID_DE | \
+          CPUID_HT)
           /* partly implemented:
           CPUID_MTRR, CPUID_MCA, CPUID_CLFLUSH (needed for Win64) */
           /* missing:
-          CPUID_VME, CPUID_DTS, CPUID_SS, CPUID_HT, CPUID_TM, CPUID_PBE */
+          CPUID_VME, CPUID_DTS, CPUID_SS, CPUID_TM, CPUID_PBE */
 
 /*
  * Kernel-only features that can be shown to usermode programs even if
@@ -848,7 +849,8 @@ void x86_cpu_vendor_words2str(char *dst, uint32_t vendor1,
 
 #define TCG_EXT3_FEATURES (CPUID_EXT3_LAHF_LM | CPUID_EXT3_SVM | \
           CPUID_EXT3_CR8LEG | CPUID_EXT3_ABM | CPUID_EXT3_SSE4A | \
-          CPUID_EXT3_3DNOWPREFETCH | CPUID_EXT3_KERNEL_FEATURES)
+          CPUID_EXT3_3DNOWPREFETCH | CPUID_EXT3_KERNEL_FEATURES | \
+          CPUID_EXT3_CMP_LEG)
 
 #define TCG_EXT4_FEATURES 0
 

From 7a48612306768833f8cc87418a5a53e712f26ac1 Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Tue, 13 May 2025 23:16:52 -0400
Subject: [PATCH 1019/2760] i386/hvf: Make CPUID_HT supported

Since Commit c6bd2dd63420 ("i386/cpu: Set up CPUID_HT in
x86_cpu_expand_features() instead of cpu_x86_cpuid()"), CPUID_HT will be
set in env->features[] in x86_cpu_expand_features() when vcpus >= 2.

Later in x86_cpu_filter_features() it will check against the HVF
supported bits. It will trigger the warning like

    qemu-system-x86_64: warning: host doesn't support requested feature: CPUID.01H:EDX.ht [bit 28]

Add CPUID_HT to HVF supported CPUID bits to fix it.

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Link: https://lore.kernel.org/r/20250514031652.838763-3-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/hvf/x86_cpuid.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/i386/hvf/x86_cpuid.c b/target/i386/hvf/x86_cpuid.c
index fa131b18c6..0798a0cbaf 100644
--- a/target/i386/hvf/x86_cpuid.c
+++ b/target/i386/hvf/x86_cpuid.c
@@ -73,7 +73,7 @@ uint32_t hvf_get_supported_cpuid(uint32_t func, uint32_t idx,
              CPUID_MSR | CPUID_PAE | CPUID_MCE | CPUID_CX8 | CPUID_APIC |
              CPUID_SEP | CPUID_MTRR | CPUID_PGE | CPUID_MCA | CPUID_CMOV |
              CPUID_PAT | CPUID_PSE36 | CPUID_CLFLUSH | CPUID_MMX |
-             CPUID_FXSR | CPUID_SSE | CPUID_SSE2 | CPUID_SS;
+             CPUID_FXSR | CPUID_SSE | CPUID_SSE2 | CPUID_SS | CPUID_HT;
         ecx &= CPUID_EXT_SSE3 | CPUID_EXT_PCLMULQDQ | CPUID_EXT_SSSE3 |
              CPUID_EXT_FMA | CPUID_EXT_CX16 | CPUID_EXT_PCID |
              CPUID_EXT_SSE41 | CPUID_EXT_SSE42 | CPUID_EXT_MOVBE |

From e5894fd6f411c113e2b5f62811e96eeb5b084381 Mon Sep 17 00:00:00 2001
From: Rakesh Jeyasingh <rakeshjb010@gmail.com>
Date: Tue, 29 Apr 2025 22:33:53 +0530
Subject: [PATCH 1020/2760] hw/pci-host/gt64120: Fix endianness handling

The GT-64120 PCI controller requires special handling where:
1. Host bridge(bus 0 ,device 0) must never be byte-swapped
2. Other devices follow MByteSwap bit in GT_PCI0_CMD

The previous implementation incorrectly  swapped all accesses, breaking
host bridge detection (lspci -d 11ab:4620).

Changes made:
1. Removed gt64120_update_pci_cfgdata_mapping() and moved data_mem initialization
  to gt64120_realize() for cleaner setup
2. Implemented custom read/write handlers that:
   - Preserve host bridge accesses (extract32(config_reg,11,13)==0)
   - apply swapping only for non-bridge devices in big-endian mode

Fixes: 145e2198 ("hw/mips/gt64xxx_pci: Endian-swap using PCI_HOST_BRIDGE MemoryRegionOps")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2826

Signed-off-by: Rakesh Jeyasingh <rakeshjb010@gmail.com>
Tested-by: Thomas Huth <thuth@redhat.com>
Link: https://lore.kernel.org/r/20250429170354.150581-2-rakeshjb010@gmail.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/pci-host/gt64120.c | 82 +++++++++++++++++++++++++------------------
 1 file changed, 48 insertions(+), 34 deletions(-)

diff --git a/hw/pci-host/gt64120.c b/hw/pci-host/gt64120.c
index 56a6ef93b7..b12a25696c 100644
--- a/hw/pci-host/gt64120.c
+++ b/hw/pci-host/gt64120.c
@@ -320,38 +320,6 @@ static void gt64120_isd_mapping(GT64120State *s)
     memory_region_transaction_commit();
 }
 
-static void gt64120_update_pci_cfgdata_mapping(GT64120State *s)
-{
-    /* Indexed on MByteSwap bit, see Table 158: PCI_0 Command, Offset: 0xc00 */
-    static const MemoryRegionOps *pci_host_data_ops[] = {
-        &pci_host_data_be_ops, &pci_host_data_le_ops
-    };
-    PCIHostState *phb = PCI_HOST_BRIDGE(s);
-
-    memory_region_transaction_begin();
-
-    /*
-     * The setting of the MByteSwap bit and MWordSwap bit in the PCI Internal
-     * Command Register determines how data transactions from the CPU to/from
-     * PCI are handled along with the setting of the Endianness bit in the CPU
-     * Configuration Register. See:
-     * - Table 16: 32-bit PCI Transaction Endianness
-     * - Table 158: PCI_0 Command, Offset: 0xc00
-     */
-
-    if (memory_region_is_mapped(&phb->data_mem)) {
-        memory_region_del_subregion(&s->ISD_mem, &phb->data_mem);
-        object_unparent(OBJECT(&phb->data_mem));
-    }
-    memory_region_init_io(&phb->data_mem, OBJECT(phb),
-                          pci_host_data_ops[s->regs[GT_PCI0_CMD] & 1],
-                          s, "pci-conf-data", 4);
-    memory_region_add_subregion_overlap(&s->ISD_mem, GT_PCI0_CFGDATA << 2,
-                                        &phb->data_mem, 1);
-
-    memory_region_transaction_commit();
-}
-
 static void gt64120_pci_mapping(GT64120State *s)
 {
     memory_region_transaction_begin();
@@ -645,7 +613,6 @@ static void gt64120_writel(void *opaque, hwaddr addr,
     case GT_PCI0_CMD:
     case GT_PCI1_CMD:
         s->regs[saddr] = val & 0x0401fc0f;
-        gt64120_update_pci_cfgdata_mapping(s);
         break;
     case GT_PCI0_TOR:
     case GT_PCI0_BS_SCS10:
@@ -1024,6 +991,48 @@ static const MemoryRegionOps isd_mem_ops = {
     },
 };
 
+static bool bswap(const GT64120State *s) 
+{
+    PCIHostState *phb = PCI_HOST_BRIDGE(s);
+    /*check for bus == 0 && device == 0, Bits 11:15 = Device , Bits 16:23 = Bus*/
+    bool is_phb_dev0 = extract32(phb->config_reg, 11, 13) == 0;
+    bool le_mode = FIELD_EX32(s->regs[GT_PCI0_CMD], GT_PCI0_CMD, MByteSwap);
+    /* Only swap for non-bridge devices in big-endian mode */
+    return !le_mode && !is_phb_dev0;
+}
+
+static uint64_t gt64120_pci_data_read(void *opaque, hwaddr addr, unsigned size)
+{
+    GT64120State *s = opaque;
+    uint32_t val = pci_host_data_le_ops.read(opaque, addr, size);
+
+    if (bswap(s)) {
+        val = bswap32(val);
+    }
+    return val;
+}
+
+static void gt64120_pci_data_write(void *opaque, hwaddr addr, 
+    uint64_t val, unsigned size)
+{
+    GT64120State *s = opaque;
+
+    if (bswap(s)) {
+        val = bswap32(val); 
+    }
+    pci_host_data_le_ops.write(opaque, addr, val, size);  
+}
+
+static const MemoryRegionOps gt64120_pci_data_ops = {
+    .read = gt64120_pci_data_read,
+    .write = gt64120_pci_data_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+    .valid = {
+        .min_access_size = 4,
+        .max_access_size = 4,
+    },
+};
+
 static void gt64120_reset(DeviceState *dev)
 {
     GT64120State *s = GT64120_PCI_HOST_BRIDGE(dev);
@@ -1178,7 +1187,6 @@ static void gt64120_reset(DeviceState *dev)
 
     gt64120_isd_mapping(s);
     gt64120_pci_mapping(s);
-    gt64120_update_pci_cfgdata_mapping(s);
 }
 
 static void gt64120_realize(DeviceState *dev, Error **errp)
@@ -1202,6 +1210,12 @@ static void gt64120_realize(DeviceState *dev, Error **errp)
     memory_region_add_subregion_overlap(&s->ISD_mem, GT_PCI0_CFGADDR << 2,
                                         &phb->conf_mem, 1);
 
+    memory_region_init_io(&phb->data_mem, OBJECT(phb),
+                          &gt64120_pci_data_ops,
+                          s, "pci-conf-data", 4);
+    memory_region_add_subregion_overlap(&s->ISD_mem, GT_PCI0_CFGDATA << 2,
+                                        &phb->data_mem, 1);
+
 
     /*
      * The whole address space decoded by the GT-64120A doesn't generate

From 560375cff3ccedabf1fe5ca1bc7a31b13fdc68e5 Mon Sep 17 00:00:00 2001
From: Rakesh Jeyasingh <rakeshjb010@gmail.com>
Date: Tue, 29 Apr 2025 22:33:54 +0530
Subject: [PATCH 1021/2760] hw/pci-host: Remove unused pci_host_data_be_ops
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

pci_host_data_be_ops became unused after endianness fixes

Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Rakesh Jeyasingh <rakeshjb010@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Thomas Huth <thuth@redhat.com>
Link: https://lore.kernel.org/r/20250429170354.150581-3-rakeshjb010@gmail.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/pci/pci_host.c          | 6 ------
 include/hw/pci-host/dino.h | 4 ----
 include/hw/pci/pci_host.h  | 1 -
 3 files changed, 11 deletions(-)

diff --git a/hw/pci/pci_host.c b/hw/pci/pci_host.c
index abe83bbab8..7179d99178 100644
--- a/hw/pci/pci_host.c
+++ b/hw/pci/pci_host.c
@@ -217,12 +217,6 @@ const MemoryRegionOps pci_host_data_le_ops = {
     .endianness = DEVICE_LITTLE_ENDIAN,
 };
 
-const MemoryRegionOps pci_host_data_be_ops = {
-    .read = pci_host_data_read,
-    .write = pci_host_data_write,
-    .endianness = DEVICE_BIG_ENDIAN,
-};
-
 static bool pci_host_needed(void *opaque)
 {
     PCIHostState *s = opaque;
diff --git a/include/hw/pci-host/dino.h b/include/hw/pci-host/dino.h
index fd7975c798..5dc8cdf610 100644
--- a/include/hw/pci-host/dino.h
+++ b/include/hw/pci-host/dino.h
@@ -109,10 +109,6 @@ static const uint32_t reg800_keep_bits[DINO800_REGS] = {
 struct DinoState {
     PCIHostState parent_obj;
 
-    /*
-     * PCI_CONFIG_ADDR is parent_obj.config_reg, via pci_host_conf_be_ops,
-     * so that we can map PCI_CONFIG_DATA to pci_host_data_be_ops.
-     */
     uint32_t config_reg_dino; /* keep original copy, including 2 lowest bits */
 
     uint32_t iar0;
diff --git a/include/hw/pci/pci_host.h b/include/hw/pci/pci_host.h
index e52d8ec2cd..954dd446fa 100644
--- a/include/hw/pci/pci_host.h
+++ b/include/hw/pci/pci_host.h
@@ -68,6 +68,5 @@ uint32_t pci_data_read(PCIBus *s, uint32_t addr, unsigned len);
 extern const MemoryRegionOps pci_host_conf_le_ops;
 extern const MemoryRegionOps pci_host_conf_be_ops;
 extern const MemoryRegionOps pci_host_data_le_ops;
-extern const MemoryRegionOps pci_host_data_be_ops;
 
 #endif /* PCI_HOST_H */

From a1b3e82773c4b9f438c2d77f9101fca760b347e6 Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Fri, 16 May 2025 17:11:29 +0800
Subject: [PATCH 1022/2760] qapi/misc-target: Rename SGXEPCSection to
 SgxEpcSection

QAPI requires strict PascalCase naming style, i.e., only the first
letter of a single word is allowed to be uppercase, which could help
with readability.

Rename SGXEPCSection to SgxEpcSection.

Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250516091130.2374221-2-zhao1.liu@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/i386/sgx.c         | 18 +++++++++---------
 qapi/misc-target.json |  6 +++---
 2 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/hw/i386/sgx.c b/hw/i386/sgx.c
index 5685c4fb80..3c601689eb 100644
--- a/hw/i386/sgx.c
+++ b/hw/i386/sgx.c
@@ -84,10 +84,10 @@ static uint64_t sgx_calc_section_metric(uint64_t low, uint64_t high)
            ((high & MAKE_64BIT_MASK(0, 20)) << 32);
 }
 
-static SGXEPCSectionList *sgx_calc_host_epc_sections(void)
+static SgxEpcSectionList *sgx_calc_host_epc_sections(void)
 {
-    SGXEPCSectionList *head = NULL, **tail = &head;
-    SGXEPCSection *section;
+    SgxEpcSectionList *head = NULL, **tail = &head;
+    SgxEpcSection *section;
     uint32_t i, type;
     uint32_t eax, ebx, ecx, edx;
     uint32_t j = 0;
@@ -104,7 +104,7 @@ static SGXEPCSectionList *sgx_calc_host_epc_sections(void)
             break;
         }
 
-        section = g_new0(SGXEPCSection, 1);
+        section = g_new0(SgxEpcSection, 1);
         section->node = j++;
         section->size = sgx_calc_section_metric(ecx, edx);
         QAPI_LIST_APPEND(tail, section);
@@ -183,17 +183,17 @@ SGXInfo *qmp_query_sgx_capabilities(Error **errp)
     return info;
 }
 
-static SGXEPCSectionList *sgx_get_epc_sections_list(void)
+static SgxEpcSectionList *sgx_get_epc_sections_list(void)
 {
     GSList *device_list = sgx_epc_get_device_list();
-    SGXEPCSectionList *head = NULL, **tail = &head;
-    SGXEPCSection *section;
+    SgxEpcSectionList *head = NULL, **tail = &head;
+    SgxEpcSection *section;
 
     for (; device_list; device_list = device_list->next) {
         DeviceState *dev = device_list->data;
         Object *obj = OBJECT(dev);
 
-        section = g_new0(SGXEPCSection, 1);
+        section = g_new0(SgxEpcSection, 1);
         section->node = object_property_get_uint(obj, SGX_EPC_NUMA_NODE_PROP,
                                                  &error_abort);
         section->size = object_property_get_uint(obj, SGX_EPC_SIZE_PROP,
@@ -237,7 +237,7 @@ SGXInfo *qmp_query_sgx(Error **errp)
 void hmp_info_sgx(Monitor *mon, const QDict *qdict)
 {
     Error *err = NULL;
-    SGXEPCSectionList *section_list, *section;
+    SgxEpcSectionList *section_list, *section;
     g_autoptr(SGXInfo) info = qmp_query_sgx(&err);
     uint64_t size = 0;
 
diff --git a/qapi/misc-target.json b/qapi/misc-target.json
index 42e4a7417d..a1275d3873 100644
--- a/qapi/misc-target.json
+++ b/qapi/misc-target.json
@@ -319,7 +319,7 @@
   'if': 'TARGET_ARM' }
 
 ##
-# @SGXEPCSection:
+# @SgxEpcSection:
 #
 # Information about intel SGX EPC section info
 #
@@ -329,7 +329,7 @@
 #
 # Since: 7.0
 ##
-{ 'struct': 'SGXEPCSection',
+{ 'struct': 'SgxEpcSection',
   'data': { 'node': 'int',
             'size': 'uint64'}}
 
@@ -355,7 +355,7 @@
             'sgx1': 'bool',
             'sgx2': 'bool',
             'flc': 'bool',
-            'sections': ['SGXEPCSection']},
+            'sections': ['SgxEpcSection']},
    'if': 'TARGET_I386' }
 
 ##

From 88aea26d1880f105b00c352485d3bf1f21d55012 Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Fri, 16 May 2025 17:11:30 +0800
Subject: [PATCH 1023/2760] qapi/misc-target: Rename SGXInfo to SgxInfo

QAPI requires strict PascalCase naming style, i.e., only the first
letter of a single word is allowed to be uppercase, which could help
with readability.

Rename SGXInfo to SgxInfo.

Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250516091130.2374221-3-zhao1.liu@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/i386/sgx-stub.c    |  4 ++--
 hw/i386/sgx.c         | 14 +++++++-------
 qapi/misc-target.json | 12 ++++++------
 3 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/hw/i386/sgx-stub.c b/hw/i386/sgx-stub.c
index 38ff75e9f3..ccb21a975d 100644
--- a/hw/i386/sgx-stub.c
+++ b/hw/i386/sgx-stub.c
@@ -10,13 +10,13 @@ void sgx_epc_build_srat(GArray *table_data)
 {
 }
 
-SGXInfo *qmp_query_sgx(Error **errp)
+SgxInfo *qmp_query_sgx(Error **errp)
 {
     error_setg(errp, "SGX support is not compiled in");
     return NULL;
 }
 
-SGXInfo *qmp_query_sgx_capabilities(Error **errp)
+SgxInfo *qmp_query_sgx_capabilities(Error **errp)
 {
     error_setg(errp, "SGX support is not compiled in");
     return NULL;
diff --git a/hw/i386/sgx.c b/hw/i386/sgx.c
index 3c601689eb..c80203b438 100644
--- a/hw/i386/sgx.c
+++ b/hw/i386/sgx.c
@@ -153,9 +153,9 @@ static void sgx_epc_reset(void *opaque)
      }
 }
 
-SGXInfo *qmp_query_sgx_capabilities(Error **errp)
+SgxInfo *qmp_query_sgx_capabilities(Error **errp)
 {
-    SGXInfo *info = NULL;
+    SgxInfo *info = NULL;
     uint32_t eax, ebx, ecx, edx;
     Error *local_err = NULL;
 
@@ -166,7 +166,7 @@ SGXInfo *qmp_query_sgx_capabilities(Error **errp)
         return NULL;
     }
 
-    info = g_new0(SGXInfo, 1);
+    info = g_new0(SgxInfo, 1);
     host_cpuid(0x7, 0, &eax, &ebx, &ecx, &edx);
 
     info->sgx = ebx & (1U << 2) ? true : false;
@@ -205,9 +205,9 @@ static SgxEpcSectionList *sgx_get_epc_sections_list(void)
     return head;
 }
 
-SGXInfo *qmp_query_sgx(Error **errp)
+SgxInfo *qmp_query_sgx(Error **errp)
 {
-    SGXInfo *info = NULL;
+    SgxInfo *info = NULL;
     X86MachineState *x86ms;
     PCMachineState *pcms =
         (PCMachineState *)object_dynamic_cast(qdev_get_machine(),
@@ -223,7 +223,7 @@ SGXInfo *qmp_query_sgx(Error **errp)
         return NULL;
     }
 
-    info = g_new0(SGXInfo, 1);
+    info = g_new0(SgxInfo, 1);
 
     info->sgx = true;
     info->sgx1 = true;
@@ -238,7 +238,7 @@ void hmp_info_sgx(Monitor *mon, const QDict *qdict)
 {
     Error *err = NULL;
     SgxEpcSectionList *section_list, *section;
-    g_autoptr(SGXInfo) info = qmp_query_sgx(&err);
+    g_autoptr(SgxInfo) info = qmp_query_sgx(&err);
     uint64_t size = 0;
 
     if (err) {
diff --git a/qapi/misc-target.json b/qapi/misc-target.json
index a1275d3873..6b3c9d8bd5 100644
--- a/qapi/misc-target.json
+++ b/qapi/misc-target.json
@@ -334,7 +334,7 @@
             'size': 'uint64'}}
 
 ##
-# @SGXInfo:
+# @SgxInfo:
 #
 # Information about intel Safe Guard eXtension (SGX) support
 #
@@ -350,7 +350,7 @@
 #
 # Since: 6.2
 ##
-{ 'struct': 'SGXInfo',
+{ 'struct': 'SgxInfo',
   'data': { 'sgx': 'bool',
             'sgx1': 'bool',
             'sgx2': 'bool',
@@ -363,7 +363,7 @@
 #
 # Returns information about SGX
 #
-# Returns: @SGXInfo
+# Returns: @SgxInfo
 #
 # Since: 6.2
 #
@@ -375,14 +375,14 @@
 #                      "sections": [{"node": 0, "size": 67108864},
 #                      {"node": 1, "size": 29360128}]} }
 ##
-{ 'command': 'query-sgx', 'returns': 'SGXInfo', 'if': 'TARGET_I386' }
+{ 'command': 'query-sgx', 'returns': 'SgxInfo', 'if': 'TARGET_I386' }
 
 ##
 # @query-sgx-capabilities:
 #
 # Returns information from host SGX capabilities
 #
-# Returns: @SGXInfo
+# Returns: @SgxInfo
 #
 # Since: 6.2
 #
@@ -394,7 +394,7 @@
 #                      "section" : [{"node": 0, "size": 67108864},
 #                      {"node": 1, "size": 29360128}]} }
 ##
-{ 'command': 'query-sgx-capabilities', 'returns': 'SGXInfo', 'if': 'TARGET_I386' }
+{ 'command': 'query-sgx-capabilities', 'returns': 'SgxInfo', 'if': 'TARGET_I386' }
 
 
 ##

From c6b8fb0fb1599cffdfe6603f93bba937c1ecb0b1 Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Tue, 13 May 2025 22:31:30 +0800
Subject: [PATCH 1024/2760] qapi/misc-target: Fix the doc related SGXEPCSection

The "sections" field of SGXInfo is used to gather EPC section
information for both the guest and the host. Therefore, delete the "for
guest" limitation.

Additionally, avoid the abbreviation "info" and use "information"
instead. And for SGXEPCSection, delete the redundant word "info".

Reported-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Acked-by: Markus Armbruster <armbru@redhat.com>
Link: https://lore.kernel.org/r/20250513143131.2008078-2-zhao1.liu@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 qapi/misc-target.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/qapi/misc-target.json b/qapi/misc-target.json
index 6b3c9d8bd5..6814708972 100644
--- a/qapi/misc-target.json
+++ b/qapi/misc-target.json
@@ -321,7 +321,7 @@
 ##
 # @SgxEpcSection:
 #
-# Information about intel SGX EPC section info
+# Information about intel SGX EPC section
 #
 # @node: the numa node
 #
@@ -346,7 +346,7 @@
 #
 # @flc: true if FLC is supported
 #
-# @sections: The EPC sections info for guest (Since: 7.0)
+# @sections: The EPC sections information (Since: 7.0)
 #
 # Since: 6.2
 ##

From 7f2131c35c1781ca41c62dc26fd93282e1351323 Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Tue, 13 May 2025 22:31:31 +0800
Subject: [PATCH 1025/2760] qapi/misc-target: Fix the doc to distinguish
 query-sgx and query-sgx-capabilities

There're 2 QMP commands: query-sgx and query-sgx-capabilities, but
their outputs are very similar and the documentation lacks clear
differentiation.

From the codes, query-sgx is used to gather guest's SGX capabilities
(including SGX related CPUIDs and EPC sections' size, in SGXInfo), and
if guest doesn't have SGX, then QEMU will report the error message.

On the other hand, query-sgx-capabilities is used to gather host's SGX
capabilities (descripted by SGXInfo as well). And if host doesn't
support SGX, then QEMU will also report the error message.

Considering that SGXInfo is already documented and both these 2 commands
have enough error messages (for the exception case in their codes).

Therefore the QAPI documentation for these two commands only needs to
emphasize that one of them applies to the guest and the other to the
host.

Fix their documentation to reflect this difference.

Reported-by: Markus Armbruster <armbru@redhat.com>
Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Acked-by: Markus Armbruster <armbru@redhat.com>
Link: https://lore.kernel.org/r/20250513143131.2008078-3-zhao1.liu@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 qapi/misc-target.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/qapi/misc-target.json b/qapi/misc-target.json
index 6814708972..f7ec695caa 100644
--- a/qapi/misc-target.json
+++ b/qapi/misc-target.json
@@ -361,7 +361,7 @@
 ##
 # @query-sgx:
 #
-# Returns information about SGX
+# Returns information about configured SGX capabilities of guest
 #
 # Returns: @SgxInfo
 #
@@ -380,7 +380,7 @@
 ##
 # @query-sgx-capabilities:
 #
-# Returns information from host SGX capabilities
+# Returns information about SGX capabilities of host
 #
 # Returns: @SgxInfo
 #

From 82c81c07e83670befc61333e0bdf3d810e581219 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Tue, 18 Feb 2025 12:00:14 +0100
Subject: [PATCH 1026/2760] hw/riscv: acpi: only create RHCT MMU entry for
 supported types

Do not create the RHCT MMU type entry for RV32 CPUs, since it
only has definitions for SV39/SV48/SV57.  Likewise, check that
satp_mode_max_from_map() will actually return a valid value, skipping
the MMU type entry if all MMU types were disabled on the command line.

Acked-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/riscv/virt-acpi-build.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/hw/riscv/virt-acpi-build.c b/hw/riscv/virt-acpi-build.c
index 1eef2fb4eb..e693d529e1 100644
--- a/hw/riscv/virt-acpi-build.c
+++ b/hw/riscv/virt-acpi-build.c
@@ -288,6 +288,7 @@ static void build_rhct(GArray *table_data,
     RISCVCPU *cpu = &s->soc[0].harts[0];
     uint32_t mmu_offset = 0;
     uint8_t satp_mode_max;
+    bool rv32 = riscv_cpu_is_32bit(cpu);
     g_autofree char *isa = NULL;
 
     AcpiTable table = { .sig = "RHCT", .rev = 1, .oem_id = s->oem_id,
@@ -307,7 +308,8 @@ static void build_rhct(GArray *table_data,
         num_rhct_nodes++;
     }
 
-    if (cpu->cfg.satp_mode.supported != 0) {
+    if (!rv32 && cpu->cfg.satp_mode.supported != 0 &&
+        (cpu->cfg.satp_mode.map & ~(1 << VM_1_10_MBARE))) {
         num_rhct_nodes++;
     }
 
@@ -367,7 +369,8 @@ static void build_rhct(GArray *table_data,
     }
 
     /* MMU node structure */
-    if (cpu->cfg.satp_mode.supported != 0) {
+    if (!rv32 && cpu->cfg.satp_mode.supported != 0 &&
+        (cpu->cfg.satp_mode.map & ~(1 << VM_1_10_MBARE))) {
         satp_mode_max = satp_mode_max_from_map(cpu->cfg.satp_mode.map);
         mmu_offset = table_data->len - table.table_offset;
         build_append_int_noprefix(table_data, 2, 2);    /* Type */
@@ -382,7 +385,7 @@ static void build_rhct(GArray *table_data,
         } else if (satp_mode_max == VM_1_10_SV39) {
             build_append_int_noprefix(table_data, 0, 1);    /* Sv39 */
         } else {
-            assert(1);
+            g_assert_not_reached();
         }
     }
 

From b22cfa0f44e360d09595705cea8c97be692e2080 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Tue, 18 Feb 2025 13:04:22 +0100
Subject: [PATCH 1027/2760] target/riscv: assert argument to
 set_satp_mode_max_supported is valid

Check that the argument to set_satp_mode_max_supported is valid for
the MXL value of the CPU.  It would be a bug in the CPU definition
if it weren't.

In fact, there is such a bug in riscv_bare_cpu_init(): not just
SV64 is not a valid VM mode for 32-bit CPUs, SV64 is not a
valid VM mode at all, not yet at least.

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/riscv/cpu.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index d92874baa0..0f7ce5305b 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -444,6 +444,8 @@ static void set_satp_mode_max_supported(RISCVCPU *cpu,
             cpu->cfg.satp_mode.supported |= (1 << i);
         }
     }
+
+    assert(cpu->cfg.satp_mode.supported & (1 << satp_mode));
 }
 
 /* Set the satp mode to the max supported */
@@ -1497,7 +1499,9 @@ static void riscv_bare_cpu_init(Object *obj)
      * satp_mode manually (see set_satp_mode_default()).
      */
 #ifndef CONFIG_USER_ONLY
-    set_satp_mode_max_supported(cpu, VM_1_10_SV64);
+    set_satp_mode_max_supported(RISCV_CPU(obj),
+        riscv_cpu_mxl(&RISCV_CPU(obj)->env) == MXL_RV32 ?
+        VM_1_10_SV32 : VM_1_10_SV57);
 #endif
 }
 

From 357ce8171a9c7581ba02475874c8c28ed5220d9e Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Tue, 18 Feb 2025 10:52:09 +0100
Subject: [PATCH 1028/2760] target/riscv: cpu: store max SATP mode as a single
 integer

The maximum available SATP mode implies all the shorter virtual address sizes.
Store it in RISCVCPUConfig and avoid recomputing it via satp_mode_max_from_map.

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/riscv/cpu.c         | 11 +++++------
 target/riscv/cpu_cfg.h     |  1 +
 target/riscv/tcg/tcg-cpu.c |  3 ++-
 3 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 0f7ce5305b..32c283a662 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -446,6 +446,7 @@ static void set_satp_mode_max_supported(RISCVCPU *cpu,
     }
 
     assert(cpu->cfg.satp_mode.supported & (1 << satp_mode));
+    cpu->cfg.max_satp_mode = satp_mode;
 }
 
 /* Set the satp mode to the max supported */
@@ -1172,16 +1173,13 @@ static void riscv_cpu_disas_set_info(CPUState *s, disassemble_info *info)
 static void riscv_cpu_satp_mode_finalize(RISCVCPU *cpu, Error **errp)
 {
     bool rv32 = riscv_cpu_is_32bit(cpu);
-    uint8_t satp_mode_map_max, satp_mode_supported_max;
+    uint8_t satp_mode_map_max;
 
     /* The CPU wants the OS to decide which satp mode to use */
     if (cpu->cfg.satp_mode.supported == 0) {
         return;
     }
 
-    satp_mode_supported_max =
-                    satp_mode_max_from_map(cpu->cfg.satp_mode.supported);
-
     if (cpu->cfg.satp_mode.map == 0) {
         if (cpu->cfg.satp_mode.init == 0) {
             /* If unset by the user, we fallback to the default satp mode. */
@@ -1210,10 +1208,10 @@ static void riscv_cpu_satp_mode_finalize(RISCVCPU *cpu, Error **errp)
     satp_mode_map_max = satp_mode_max_from_map(cpu->cfg.satp_mode.map);
 
     /* Make sure the user asked for a supported configuration (HW and qemu) */
-    if (satp_mode_map_max > satp_mode_supported_max) {
+    if (satp_mode_map_max > cpu->cfg.max_satp_mode) {
         error_setg(errp, "satp_mode %s is higher than hw max capability %s",
                    satp_mode_str(satp_mode_map_max, rv32),
-                   satp_mode_str(satp_mode_supported_max, rv32));
+                   satp_mode_str(cpu->cfg.max_satp_mode, rv32));
         return;
     }
 
@@ -1473,6 +1471,7 @@ static void riscv_cpu_init(Object *obj)
     cpu->cfg.cbop_blocksize = 64;
     cpu->cfg.cboz_blocksize = 64;
     cpu->env.vext_ver = VEXT_VERSION_1_00_0;
+    cpu->cfg.max_satp_mode = -1;
 }
 
 static void riscv_bare_cpu_init(Object *obj)
diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
index cfe371b829..c8ea5cdc87 100644
--- a/target/riscv/cpu_cfg.h
+++ b/target/riscv/cpu_cfg.h
@@ -196,6 +196,7 @@ struct RISCVCPUConfig {
 
     bool short_isa_string;
 
+    int8_t max_satp_mode;
     RISCVSATPMap satp_mode;
 };
 
diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index 55e00972b7..ab8659f304 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -816,8 +816,9 @@ static bool riscv_cpu_validate_profile_satp(RISCVCPU *cpu,
                                             RISCVCPUProfile *profile,
                                             bool send_warn)
 {
-    int satp_max = satp_mode_max_from_map(cpu->cfg.satp_mode.supported);
+    int satp_max = cpu->cfg.max_satp_mode;
 
+    assert(satp_max >= 0);
     if (profile->satp_mode > satp_max) {
         if (send_warn) {
             bool is_32bit = riscv_cpu_is_32bit(cpu);

From 211c7f9bb817ca7bb7855535da4db5ca80a8aa1d Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Tue, 18 Feb 2025 11:09:15 +0100
Subject: [PATCH 1029/2760] target/riscv: update max_satp_mode based on QOM
 properties

Almost all users of cpu->cfg.satp_mode care about the "max" value
satp_mode_max_from_map(cpu->cfg.satp_mode.map).  Convert the QOM
properties back into it.  For TCG, deduce the bitmap of supported modes
from valid_vm[].

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/riscv/virt-acpi-build.c | 14 +++++---------
 hw/riscv/virt.c            |  5 ++---
 target/riscv/cpu.c         | 27 ++++++++++-----------------
 target/riscv/cpu.h         |  1 -
 target/riscv/csr.c         |  9 +++++++--
 5 files changed, 24 insertions(+), 32 deletions(-)

diff --git a/hw/riscv/virt-acpi-build.c b/hw/riscv/virt-acpi-build.c
index e693d529e1..8b5683dbde 100644
--- a/hw/riscv/virt-acpi-build.c
+++ b/hw/riscv/virt-acpi-build.c
@@ -287,7 +287,6 @@ static void build_rhct(GArray *table_data,
     uint32_t isa_offset, num_rhct_nodes, cmo_offset = 0;
     RISCVCPU *cpu = &s->soc[0].harts[0];
     uint32_t mmu_offset = 0;
-    uint8_t satp_mode_max;
     bool rv32 = riscv_cpu_is_32bit(cpu);
     g_autofree char *isa = NULL;
 
@@ -308,8 +307,7 @@ static void build_rhct(GArray *table_data,
         num_rhct_nodes++;
     }
 
-    if (!rv32 && cpu->cfg.satp_mode.supported != 0 &&
-        (cpu->cfg.satp_mode.map & ~(1 << VM_1_10_MBARE))) {
+    if (!rv32 && cpu->cfg.max_satp_mode >= VM_1_10_SV39) {
         num_rhct_nodes++;
     }
 
@@ -369,20 +367,18 @@ static void build_rhct(GArray *table_data,
     }
 
     /* MMU node structure */
-    if (!rv32 && cpu->cfg.satp_mode.supported != 0 &&
-        (cpu->cfg.satp_mode.map & ~(1 << VM_1_10_MBARE))) {
-        satp_mode_max = satp_mode_max_from_map(cpu->cfg.satp_mode.map);
+    if (!rv32 && cpu->cfg.max_satp_mode >= VM_1_10_SV39) {
         mmu_offset = table_data->len - table.table_offset;
         build_append_int_noprefix(table_data, 2, 2);    /* Type */
         build_append_int_noprefix(table_data, 8, 2);    /* Length */
         build_append_int_noprefix(table_data, 0x1, 2);  /* Revision */
         build_append_int_noprefix(table_data, 0, 1);    /* Reserved */
         /* MMU Type */
-        if (satp_mode_max == VM_1_10_SV57) {
+        if (cpu->cfg.max_satp_mode == VM_1_10_SV57) {
             build_append_int_noprefix(table_data, 2, 1);    /* Sv57 */
-        } else if (satp_mode_max == VM_1_10_SV48) {
+        } else if (cpu->cfg.max_satp_mode == VM_1_10_SV48) {
             build_append_int_noprefix(table_data, 1, 1);    /* Sv48 */
-        } else if (satp_mode_max == VM_1_10_SV39) {
+        } else if (cpu->cfg.max_satp_mode == VM_1_10_SV39) {
             build_append_int_noprefix(table_data, 0, 1);    /* Sv39 */
         } else {
             g_assert_not_reached();
diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index 0dcced1b49..cf280a92e5 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -237,10 +237,10 @@ static void create_fdt_socket_cpus(RISCVVirtState *s, int socket,
     uint32_t cpu_phandle;
     MachineState *ms = MACHINE(s);
     bool is_32_bit = riscv_is_32bit(&s->soc[0]);
-    uint8_t satp_mode_max;
 
     for (cpu = s->soc[socket].num_harts - 1; cpu >= 0; cpu--) {
         RISCVCPU *cpu_ptr = &s->soc[socket].harts[cpu];
+        int8_t satp_mode_max = cpu_ptr->cfg.max_satp_mode;
         g_autofree char *cpu_name = NULL;
         g_autofree char *core_name = NULL;
         g_autofree char *intc_name = NULL;
@@ -252,8 +252,7 @@ static void create_fdt_socket_cpus(RISCVVirtState *s, int socket,
             s->soc[socket].hartid_base + cpu);
         qemu_fdt_add_subnode(ms->fdt, cpu_name);
 
-        if (cpu_ptr->cfg.satp_mode.supported != 0) {
-            satp_mode_max = satp_mode_max_from_map(cpu_ptr->cfg.satp_mode.map);
+        if (satp_mode_max != -1) {
             sv_name = g_strdup_printf("riscv,%s",
                                       satp_mode_str(satp_mode_max, is_32_bit));
             qemu_fdt_setprop_string(ms->fdt, cpu_name, "mmu-type", sv_name);
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 32c283a662..48576bff92 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -389,7 +389,7 @@ static uint8_t satp_mode_from_str(const char *satp_mode_str)
     g_assert_not_reached();
 }
 
-uint8_t satp_mode_max_from_map(uint32_t map)
+static uint8_t satp_mode_max_from_map(uint32_t map)
 {
     /*
      * 'map = 0' will make us return (31 - 32), which C will
@@ -455,15 +455,13 @@ static void set_satp_mode_default_map(RISCVCPU *cpu)
     /*
      * Bare CPUs do not default to the max available.
      * Users must set a valid satp_mode in the command
-     * line.
+     * line.  Otherwise, leave the existing max_satp_mode
+     * in place.
      */
     if (object_dynamic_cast(OBJECT(cpu), TYPE_RISCV_BARE_CPU) != NULL) {
         warn_report("No satp mode set. Defaulting to 'bare'");
-        cpu->cfg.satp_mode.map = (1 << VM_1_10_MBARE);
-        return;
+        cpu->cfg.max_satp_mode = VM_1_10_MBARE;
     }
-
-    cpu->cfg.satp_mode.map = cpu->cfg.satp_mode.supported;
 }
 #endif
 
@@ -1175,8 +1173,8 @@ static void riscv_cpu_satp_mode_finalize(RISCVCPU *cpu, Error **errp)
     bool rv32 = riscv_cpu_is_32bit(cpu);
     uint8_t satp_mode_map_max;
 
-    /* The CPU wants the OS to decide which satp mode to use */
-    if (cpu->cfg.satp_mode.supported == 0) {
+    if (cpu->cfg.max_satp_mode == -1) {
+        /* The CPU wants the hypervisor to decide which satp mode to allow */
         return;
     }
 
@@ -1195,14 +1193,14 @@ static void riscv_cpu_satp_mode_finalize(RISCVCPU *cpu, Error **errp)
                     (cpu->cfg.satp_mode.supported & (1 << i))) {
                     for (int j = i - 1; j >= 0; --j) {
                         if (cpu->cfg.satp_mode.supported & (1 << j)) {
-                            cpu->cfg.satp_mode.map |= (1 << j);
-                            break;
+                            cpu->cfg.max_satp_mode = j;
+                            return;
                         }
                     }
-                    break;
                 }
             }
         }
+        return;
     }
 
     satp_mode_map_max = satp_mode_max_from_map(cpu->cfg.satp_mode.map);
@@ -1232,12 +1230,7 @@ static void riscv_cpu_satp_mode_finalize(RISCVCPU *cpu, Error **errp)
         }
     }
 
-    /* Finally expand the map so that all valid modes are set */
-    for (int i = satp_mode_map_max - 1; i >= 0; --i) {
-        if (cpu->cfg.satp_mode.supported & (1 << i)) {
-            cpu->cfg.satp_mode.map |= (1 << i);
-        }
-    }
+    cpu->cfg.max_satp_mode = satp_mode_map_max;
 }
 #endif
 
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index b56d3afa69..3d89a4a83b 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -930,7 +930,6 @@ void riscv_cpu_register_gdb_regs_for_features(CPUState *cs);
 target_ulong riscv_new_csr_seed(target_ulong new_value,
                                 target_ulong write_mask);
 
-uint8_t satp_mode_max_from_map(uint32_t map);
 const char *satp_mode_str(uint8_t satp_mode, bool is_32_bit);
 
 /* Implemented in th_csr.c */
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index 288edeedea..9843fd2191 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -1912,8 +1912,13 @@ static RISCVException read_mstatus(CPURISCVState *env, int csrno,
 
 static bool validate_vm(CPURISCVState *env, target_ulong vm)
 {
-    uint64_t mode_supported = riscv_cpu_cfg(env)->satp_mode.map;
-    return get_field(mode_supported, (1 << vm));
+    bool rv32 = riscv_cpu_mxl(env) == MXL_RV32;
+    RISCVCPU *cpu = env_archcpu(env);
+    int satp_mode_supported_max = cpu->cfg.max_satp_mode;
+    const bool *valid_vm = rv32 ? valid_vm_1_10_32 : valid_vm_1_10_64;
+
+    assert(satp_mode_supported_max >= 0);
+    return vm <= satp_mode_supported_max && valid_vm[vm];
 }
 
 static target_ulong legalize_xatp(CPURISCVState *env, target_ulong old_xatp,

From dabb54c160b84d648f375d8f7688fb1099ba32ab Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Tue, 18 Feb 2025 11:09:15 +0100
Subject: [PATCH 1030/2760] target/riscv: remove supported from RISCVSATPMap

"supported" can be computed on the fly based on the max_satp_mode.

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/riscv/cpu.c     | 34 ++++++++++++++++++++++++----------
 target/riscv/cpu_cfg.h |  4 +---
 2 files changed, 25 insertions(+), 13 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 48576bff92..0326cd8e56 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -439,14 +439,27 @@ static void set_satp_mode_max_supported(RISCVCPU *cpu,
     bool rv32 = riscv_cpu_mxl(&cpu->env) == MXL_RV32;
     const bool *valid_vm = rv32 ? valid_vm_1_10_32 : valid_vm_1_10_64;
 
-    for (int i = 0; i <= satp_mode; ++i) {
-        if (valid_vm[i]) {
-            cpu->cfg.satp_mode.supported |= (1 << i);
-        }
+    assert(valid_vm[satp_mode]);
+    cpu->cfg.max_satp_mode = satp_mode;
+}
+
+static bool get_satp_mode_supported(RISCVCPU *cpu, uint16_t *supported)
+{
+    bool rv32 = riscv_cpu_is_32bit(cpu);
+    const bool *valid_vm = rv32 ? valid_vm_1_10_32 : valid_vm_1_10_64;
+    int satp_mode = cpu->cfg.max_satp_mode;
+
+    if (satp_mode == -1) {
+        return false;
     }
 
-    assert(cpu->cfg.satp_mode.supported & (1 << satp_mode));
-    cpu->cfg.max_satp_mode = satp_mode;
+    *supported = 0;
+    for (int i = 0; i <= satp_mode; ++i) {
+        if (valid_vm[i]) {
+            *supported |= (1 << i);
+        }
+    }
+    return true;
 }
 
 /* Set the satp mode to the max supported */
@@ -1171,9 +1184,10 @@ static void riscv_cpu_disas_set_info(CPUState *s, disassemble_info *info)
 static void riscv_cpu_satp_mode_finalize(RISCVCPU *cpu, Error **errp)
 {
     bool rv32 = riscv_cpu_is_32bit(cpu);
+    uint16_t supported;
     uint8_t satp_mode_map_max;
 
-    if (cpu->cfg.max_satp_mode == -1) {
+    if (!get_satp_mode_supported(cpu, &supported)) {
         /* The CPU wants the hypervisor to decide which satp mode to allow */
         return;
     }
@@ -1190,9 +1204,9 @@ static void riscv_cpu_satp_mode_finalize(RISCVCPU *cpu, Error **errp)
              */
             for (int i = 1; i < 16; ++i) {
                 if ((cpu->cfg.satp_mode.init & (1 << i)) &&
-                    (cpu->cfg.satp_mode.supported & (1 << i))) {
+                    supported & (1 << i)) {
                     for (int j = i - 1; j >= 0; --j) {
-                        if (cpu->cfg.satp_mode.supported & (1 << j)) {
+                        if (supported & (1 << j)) {
                             cpu->cfg.max_satp_mode = j;
                             return;
                         }
@@ -1221,7 +1235,7 @@ static void riscv_cpu_satp_mode_finalize(RISCVCPU *cpu, Error **errp)
         for (int i = satp_mode_map_max - 1; i >= 0; --i) {
             if (!(cpu->cfg.satp_mode.map & (1 << i)) &&
                 (cpu->cfg.satp_mode.init & (1 << i)) &&
-                (cpu->cfg.satp_mode.supported & (1 << i))) {
+                (supported & (1 << i))) {
                 error_setg(errp, "cannot disable %s satp mode if %s "
                            "is enabled", satp_mode_str(i, false),
                            satp_mode_str(satp_mode_map_max, false));
diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
index c8ea5cdc87..8b80e03c9a 100644
--- a/target/riscv/cpu_cfg.h
+++ b/target/riscv/cpu_cfg.h
@@ -29,11 +29,9 @@
  *
  * init is a 16-bit bitmap used to make sure the user selected a correct
  * configuration as per the specification.
- *
- * supported is a 16-bit bitmap used to reflect the hw capabilities.
  */
 typedef struct {
-    uint16_t map, init, supported;
+    uint16_t map, init;
 } RISCVSATPMap;
 
 struct RISCVCPUConfig {

From 80b22be3820f1076d9de1b1f1646ae6b352d7675 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Tue, 18 Feb 2025 11:27:12 +0100
Subject: [PATCH 1031/2760] target/riscv: move satp_mode.{map,init} out of
 CPUConfig

They are used to provide the nice QOM properties for svNN,
but the canonical source of the CPU configuration is now
cpu->cfg.max_satp_mode.  Store them in the ArchCPU struct.

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/riscv/cpu.c     | 32 ++++++++++++++++----------------
 target/riscv/cpu.h     | 14 ++++++++++++++
 target/riscv/cpu_cfg.h | 14 --------------
 3 files changed, 30 insertions(+), 30 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 0326cd8e56..54a996c292 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -1192,8 +1192,8 @@ static void riscv_cpu_satp_mode_finalize(RISCVCPU *cpu, Error **errp)
         return;
     }
 
-    if (cpu->cfg.satp_mode.map == 0) {
-        if (cpu->cfg.satp_mode.init == 0) {
+    if (cpu->satp_modes.map == 0) {
+        if (cpu->satp_modes.init == 0) {
             /* If unset by the user, we fallback to the default satp mode. */
             set_satp_mode_default_map(cpu);
         } else {
@@ -1203,7 +1203,7 @@ static void riscv_cpu_satp_mode_finalize(RISCVCPU *cpu, Error **errp)
              * valid_vm_1_10_32/64.
              */
             for (int i = 1; i < 16; ++i) {
-                if ((cpu->cfg.satp_mode.init & (1 << i)) &&
+                if ((cpu->satp_modes.init & (1 << i)) &&
                     supported & (1 << i)) {
                     for (int j = i - 1; j >= 0; --j) {
                         if (supported & (1 << j)) {
@@ -1217,7 +1217,7 @@ static void riscv_cpu_satp_mode_finalize(RISCVCPU *cpu, Error **errp)
         return;
     }
 
-    satp_mode_map_max = satp_mode_max_from_map(cpu->cfg.satp_mode.map);
+    satp_mode_map_max = satp_mode_max_from_map(cpu->satp_modes.map);
 
     /* Make sure the user asked for a supported configuration (HW and qemu) */
     if (satp_mode_map_max > cpu->cfg.max_satp_mode) {
@@ -1233,8 +1233,8 @@ static void riscv_cpu_satp_mode_finalize(RISCVCPU *cpu, Error **errp)
      */
     if (!rv32) {
         for (int i = satp_mode_map_max - 1; i >= 0; --i) {
-            if (!(cpu->cfg.satp_mode.map & (1 << i)) &&
-                (cpu->cfg.satp_mode.init & (1 << i)) &&
+            if (!(cpu->satp_modes.map & (1 << i)) &&
+                (cpu->satp_modes.init & (1 << i)) &&
                 (supported & (1 << i))) {
                 error_setg(errp, "cannot disable %s satp mode if %s "
                            "is enabled", satp_mode_str(i, false),
@@ -1322,11 +1322,11 @@ bool riscv_cpu_accelerator_compatible(RISCVCPU *cpu)
 static void cpu_riscv_get_satp(Object *obj, Visitor *v, const char *name,
                                void *opaque, Error **errp)
 {
-    RISCVSATPMap *satp_map = opaque;
+    RISCVSATPModes *satp_modes = opaque;
     uint8_t satp = satp_mode_from_str(name);
     bool value;
 
-    value = satp_map->map & (1 << satp);
+    value = satp_modes->map & (1 << satp);
 
     visit_type_bool(v, name, &value, errp);
 }
@@ -1334,7 +1334,7 @@ static void cpu_riscv_get_satp(Object *obj, Visitor *v, const char *name,
 static void cpu_riscv_set_satp(Object *obj, Visitor *v, const char *name,
                                void *opaque, Error **errp)
 {
-    RISCVSATPMap *satp_map = opaque;
+    RISCVSATPModes *satp_modes = opaque;
     uint8_t satp = satp_mode_from_str(name);
     bool value;
 
@@ -1342,8 +1342,8 @@ static void cpu_riscv_set_satp(Object *obj, Visitor *v, const char *name,
         return;
     }
 
-    satp_map->map = deposit32(satp_map->map, satp, 1, value);
-    satp_map->init |= 1 << satp;
+    satp_modes->map = deposit32(satp_modes->map, satp, 1, value);
+    satp_modes->init |= 1 << satp;
 }
 
 void riscv_add_satp_mode_properties(Object *obj)
@@ -1352,16 +1352,16 @@ void riscv_add_satp_mode_properties(Object *obj)
 
     if (cpu->env.misa_mxl == MXL_RV32) {
         object_property_add(obj, "sv32", "bool", cpu_riscv_get_satp,
-                            cpu_riscv_set_satp, NULL, &cpu->cfg.satp_mode);
+                            cpu_riscv_set_satp, NULL, &cpu->satp_modes);
     } else {
         object_property_add(obj, "sv39", "bool", cpu_riscv_get_satp,
-                            cpu_riscv_set_satp, NULL, &cpu->cfg.satp_mode);
+                            cpu_riscv_set_satp, NULL, &cpu->satp_modes);
         object_property_add(obj, "sv48", "bool", cpu_riscv_get_satp,
-                            cpu_riscv_set_satp, NULL, &cpu->cfg.satp_mode);
+                            cpu_riscv_set_satp, NULL, &cpu->satp_modes);
         object_property_add(obj, "sv57", "bool", cpu_riscv_get_satp,
-                            cpu_riscv_set_satp, NULL, &cpu->cfg.satp_mode);
+                            cpu_riscv_set_satp, NULL, &cpu->satp_modes);
         object_property_add(obj, "sv64", "bool", cpu_riscv_get_satp,
-                            cpu_riscv_set_satp, NULL, &cpu->cfg.satp_mode);
+                            cpu_riscv_set_satp, NULL, &cpu->satp_modes);
     }
 }
 
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index 3d89a4a83b..731ea2540c 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -499,6 +499,19 @@ struct CPUArchState {
     uint64_t rnmi_excpvec;
 };
 
+/*
+ * map is a 16-bit bitmap: the most significant set bit in map is the maximum
+ * satp mode that is supported. It may be chosen by the user and must respect
+ * what qemu implements (valid_1_10_32/64) and what the hw is capable of
+ * (supported bitmap below).
+ *
+ * init is a 16-bit bitmap used to make sure the user selected a correct
+ * configuration as per the specification.
+ */
+typedef struct {
+    uint16_t map, init;
+} RISCVSATPModes;
+
 /*
  * RISCVCPU:
  * @env: #CPURISCVState
@@ -515,6 +528,7 @@ struct ArchCPU {
 
     /* Configuration Settings */
     RISCVCPUConfig cfg;
+    RISCVSATPModes satp_modes;
 
     QEMUTimer *pmu_timer;
     /* A bitmask of Available programmable counters */
diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
index 8b80e03c9a..8fa73c8a07 100644
--- a/target/riscv/cpu_cfg.h
+++ b/target/riscv/cpu_cfg.h
@@ -21,19 +21,6 @@
 #ifndef RISCV_CPU_CFG_H
 #define RISCV_CPU_CFG_H
 
-/*
- * map is a 16-bit bitmap: the most significant set bit in map is the maximum
- * satp mode that is supported. It may be chosen by the user and must respect
- * what qemu implements (valid_1_10_32/64) and what the hw is capable of
- * (supported bitmap below).
- *
- * init is a 16-bit bitmap used to make sure the user selected a correct
- * configuration as per the specification.
- */
-typedef struct {
-    uint16_t map, init;
-} RISCVSATPMap;
-
 struct RISCVCPUConfig {
     bool ext_zba;
     bool ext_zbb;
@@ -195,7 +182,6 @@ struct RISCVCPUConfig {
     bool short_isa_string;
 
     int8_t max_satp_mode;
-    RISCVSATPMap satp_mode;
 };
 
 typedef struct RISCVCPUConfig RISCVCPUConfig;

From 71fb3aa5ebba5ba822371f864a12dbcded08147d Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Thu, 6 Feb 2025 13:12:09 +0100
Subject: [PATCH 1032/2760] target/riscv: introduce RISCVCPUDef

Start putting all the CPU definitions in a struct.  Later this will replace
instance_init functions with declarative code, for now just remove the
ugly cast of class_data.

Reviewed-by: Alistair Francis <alistair23@gmail.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/riscv/cpu.c | 27 ++++++++++++++++++---------
 target/riscv/cpu.h |  4 ++++
 2 files changed, 22 insertions(+), 9 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 54a996c292..6e92fbb992 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -3073,8 +3073,9 @@ static void riscv_cpu_common_class_init(ObjectClass *c, const void *data)
 static void riscv_cpu_class_init(ObjectClass *c, const void *data)
 {
     RISCVCPUClass *mcc = RISCV_CPU_CLASS(c);
+    const RISCVCPUDef *def = data;
 
-    mcc->misa_mxl_max = (RISCVMXL)GPOINTER_TO_UINT(data);
+    mcc->misa_mxl_max = def->misa_mxl_max;
     riscv_cpu_validate_misa_mxl(mcc);
 }
 
@@ -3170,40 +3171,48 @@ void riscv_isa_write_fdt(RISCVCPU *cpu, void *fdt, char *nodename)
 }
 #endif
 
-#define DEFINE_DYNAMIC_CPU(type_name, misa_mxl_max, initfn) \
+#define DEFINE_DYNAMIC_CPU(type_name, misa_mxl_max_, initfn) \
     {                                                       \
         .name = (type_name),                                \
         .parent = TYPE_RISCV_DYNAMIC_CPU,                   \
         .instance_init = (initfn),                          \
         .class_init = riscv_cpu_class_init,                 \
-        .class_data = GUINT_TO_POINTER(misa_mxl_max)        \
+        .class_data = &(const RISCVCPUDef) {                \
+             .misa_mxl_max = (misa_mxl_max_),               \
+        },                                                  \
     }
 
-#define DEFINE_VENDOR_CPU(type_name, misa_mxl_max, initfn)  \
+#define DEFINE_VENDOR_CPU(type_name, misa_mxl_max_, initfn) \
     {                                                       \
         .name = (type_name),                                \
         .parent = TYPE_RISCV_VENDOR_CPU,                    \
         .instance_init = (initfn),                          \
         .class_init = riscv_cpu_class_init,                 \
-        .class_data = GUINT_TO_POINTER(misa_mxl_max)        \
+        .class_data = &(const RISCVCPUDef) {                \
+             .misa_mxl_max = (misa_mxl_max_),               \
+        },                                                  \
     }
 
-#define DEFINE_BARE_CPU(type_name, misa_mxl_max, initfn)    \
+#define DEFINE_BARE_CPU(type_name, misa_mxl_max_, initfn)   \
     {                                                       \
         .name = (type_name),                                \
         .parent = TYPE_RISCV_BARE_CPU,                      \
         .instance_init = (initfn),                          \
         .class_init = riscv_cpu_class_init,                 \
-        .class_data = GUINT_TO_POINTER(misa_mxl_max)        \
+        .class_data = &(const RISCVCPUDef) {                \
+             .misa_mxl_max = (misa_mxl_max_),               \
+        },                                                  \
     }
 
-#define DEFINE_PROFILE_CPU(type_name, misa_mxl_max, initfn) \
+#define DEFINE_PROFILE_CPU(type_name, misa_mxl_max_, initfn) \
     {                                                       \
         .name = (type_name),                                \
         .parent = TYPE_RISCV_BARE_CPU,                      \
         .instance_init = (initfn),                          \
         .class_init = riscv_cpu_class_init,                 \
-        .class_data = GUINT_TO_POINTER(misa_mxl_max)        \
+        .class_data = &(const RISCVCPUDef) {                \
+             .misa_mxl_max = (misa_mxl_max_),               \
+        },                                                  \
     }
 
 static const TypeInfo riscv_cpu_type_infos[] = {
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index 731ea2540c..9de3f716ea 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -538,6 +538,10 @@ struct ArchCPU {
     const GPtrArray *decoders;
 };
 
+typedef struct RISCVCPUDef {
+    RISCVMXL misa_mxl_max;  /* max mxl for this cpu */
+} RISCVCPUDef;
+
 /**
  * RISCVCPUClass:
  * @parent_realize: The parent class' realize handler.

From 5fd23f20e12a56e7ac2dabbe9570fb2f10d7c5b4 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Thu, 6 Feb 2025 13:13:23 +0100
Subject: [PATCH 1033/2760] target/riscv: store RISCVCPUDef struct directly in
 the class

Prepare for adding more fields to RISCVCPUDef and reading them in
riscv_cpu_init: instead of storing the misa_mxl_max field in
RISCVCPUClass, ensure that there's always a valid RISCVCPUDef struct
and go through it.

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/riscv/boot.c            |  2 +-
 target/riscv/cpu.c         | 23 ++++++++++++++++++-----
 target/riscv/cpu.h         |  2 +-
 target/riscv/gdbstub.c     |  6 +++---
 target/riscv/kvm/kvm-cpu.c | 21 +++++++++------------
 target/riscv/machine.c     |  2 +-
 target/riscv/tcg/tcg-cpu.c | 10 +++++-----
 target/riscv/translate.c   |  2 +-
 8 files changed, 39 insertions(+), 29 deletions(-)

diff --git a/hw/riscv/boot.c b/hw/riscv/boot.c
index 765b9e2b1a..828a867be3 100644
--- a/hw/riscv/boot.c
+++ b/hw/riscv/boot.c
@@ -37,7 +37,7 @@
 bool riscv_is_32bit(RISCVHartArrayState *harts)
 {
     RISCVCPUClass *mcc = RISCV_CPU_GET_CLASS(&harts->harts[0]);
-    return mcc->misa_mxl_max == MXL_RV32;
+    return mcc->def->misa_mxl_max == MXL_RV32;
 }
 
 /*
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 6e92fbb992..22e3a2211e 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -356,7 +356,7 @@ void riscv_cpu_set_misa_ext(CPURISCVState *env, uint32_t ext)
 
 int riscv_cpu_max_xlen(RISCVCPUClass *mcc)
 {
-    return 16 << mcc->misa_mxl_max;
+    return 16 << mcc->def->misa_mxl_max;
 }
 
 #ifndef CONFIG_USER_ONLY
@@ -1047,7 +1047,7 @@ static void riscv_cpu_reset_hold(Object *obj, ResetType type)
         mcc->parent_phases.hold(obj, type);
     }
 #ifndef CONFIG_USER_ONLY
-    env->misa_mxl = mcc->misa_mxl_max;
+    env->misa_mxl = mcc->def->misa_mxl_max;
     env->priv = PRV_M;
     env->mstatus &= ~(MSTATUS_MIE | MSTATUS_MPRV);
     if (env->misa_mxl > MXL_RV32) {
@@ -1449,7 +1449,7 @@ static void riscv_cpu_init(Object *obj)
     RISCVCPU *cpu = RISCV_CPU(obj);
     CPURISCVState *env = &cpu->env;
 
-    env->misa_mxl = mcc->misa_mxl_max;
+    env->misa_mxl = mcc->def->misa_mxl_max;
 
 #ifndef CONFIG_USER_ONLY
     qdev_init_gpio_in(DEVICE(obj), riscv_cpu_set_irq,
@@ -1543,7 +1543,7 @@ static void riscv_cpu_validate_misa_mxl(RISCVCPUClass *mcc)
     CPUClass *cc = CPU_CLASS(mcc);
 
     /* Validate that MISA_MXL is set properly. */
-    switch (mcc->misa_mxl_max) {
+    switch (mcc->def->misa_mxl_max) {
 #ifdef TARGET_RISCV64
     case MXL_RV64:
     case MXL_RV128:
@@ -3070,12 +3070,24 @@ static void riscv_cpu_common_class_init(ObjectClass *c, const void *data)
     device_class_set_props(dc, riscv_cpu_properties);
 }
 
+static void riscv_cpu_class_base_init(ObjectClass *c, const void *data)
+{
+    RISCVCPUClass *mcc = RISCV_CPU_CLASS(c);
+    RISCVCPUClass *pcc = RISCV_CPU_CLASS(object_class_get_parent(c));
+
+    if (pcc->def) {
+        mcc->def = g_memdup2(pcc->def, sizeof(*pcc->def));
+    } else {
+        mcc->def = g_new0(RISCVCPUDef, 1);
+    }
+}
+
 static void riscv_cpu_class_init(ObjectClass *c, const void *data)
 {
     RISCVCPUClass *mcc = RISCV_CPU_CLASS(c);
     const RISCVCPUDef *def = data;
 
-    mcc->misa_mxl_max = def->misa_mxl_max;
+    mcc->def->misa_mxl_max = def->misa_mxl_max;
     riscv_cpu_validate_misa_mxl(mcc);
 }
 
@@ -3226,6 +3238,7 @@ static const TypeInfo riscv_cpu_type_infos[] = {
         .abstract = true,
         .class_size = sizeof(RISCVCPUClass),
         .class_init = riscv_cpu_common_class_init,
+        .class_base_init = riscv_cpu_class_base_init,
     },
     {
         .name = TYPE_RISCV_DYNAMIC_CPU,
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index 9de3f716ea..d2d4db95c1 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -554,7 +554,7 @@ struct RISCVCPUClass {
 
     DeviceRealize parent_realize;
     ResettablePhases parent_phases;
-    RISCVMXL misa_mxl_max;  /* max mxl for this cpu */
+    RISCVCPUDef *def;
 };
 
 static inline int riscv_has_ext(CPURISCVState *env, target_ulong ext)
diff --git a/target/riscv/gdbstub.c b/target/riscv/gdbstub.c
index 18e88f416a..1934f919c0 100644
--- a/target/riscv/gdbstub.c
+++ b/target/riscv/gdbstub.c
@@ -62,7 +62,7 @@ int riscv_cpu_gdb_read_register(CPUState *cs, GByteArray *mem_buf, int n)
         return 0;
     }
 
-    switch (mcc->misa_mxl_max) {
+    switch (mcc->def->misa_mxl_max) {
     case MXL_RV32:
         return gdb_get_reg32(mem_buf, tmp);
     case MXL_RV64:
@@ -82,7 +82,7 @@ int riscv_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n)
     int length = 0;
     target_ulong tmp;
 
-    switch (mcc->misa_mxl_max) {
+    switch (mcc->def->misa_mxl_max) {
     case MXL_RV32:
         tmp = (int32_t)ldl_p(mem_buf);
         length = 4;
@@ -359,7 +359,7 @@ void riscv_cpu_register_gdb_regs_for_features(CPUState *cs)
                                  ricsv_gen_dynamic_vector_feature(cs, cs->gdb_num_regs),
                                  0);
     }
-    switch (mcc->misa_mxl_max) {
+    switch (mcc->def->misa_mxl_max) {
     case MXL_RV32:
         gdb_register_coprocessor(cs, riscv_gdb_get_virtual,
                                  riscv_gdb_set_virtual,
diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
index 82f9728636..e77f612af3 100644
--- a/target/riscv/kvm/kvm-cpu.c
+++ b/target/riscv/kvm/kvm-cpu.c
@@ -2086,22 +2086,19 @@ static void kvm_cpu_accel_register_types(void)
 }
 type_init(kvm_cpu_accel_register_types);
 
-static void riscv_host_cpu_class_init(ObjectClass *c, const void *data)
-{
-    RISCVCPUClass *mcc = RISCV_CPU_CLASS(c);
-
-#if defined(TARGET_RISCV32)
-    mcc->misa_mxl_max = MXL_RV32;
-#elif defined(TARGET_RISCV64)
-    mcc->misa_mxl_max = MXL_RV64;
-#endif
-}
-
 static const TypeInfo riscv_kvm_cpu_type_infos[] = {
     {
         .name = TYPE_RISCV_CPU_HOST,
         .parent = TYPE_RISCV_CPU,
-        .class_init = riscv_host_cpu_class_init,
+#if defined(TARGET_RISCV32)
+        .class_data = &(const RISCVCPUDef) {
+            .misa_mxl_max = MXL_RV32,
+        },
+#elif defined(TARGET_RISCV64)
+        .class_data = &(const RISCVCPUDef) {
+            .misa_mxl_max = MXL_RV64,
+        },
+#endif
     }
 };
 
diff --git a/target/riscv/machine.c b/target/riscv/machine.c
index a1f70cc955..c97e9ce9df 100644
--- a/target/riscv/machine.c
+++ b/target/riscv/machine.c
@@ -170,7 +170,7 @@ static bool rv128_needed(void *opaque)
 {
     RISCVCPUClass *mcc = RISCV_CPU_GET_CLASS(opaque);
 
-    return mcc->misa_mxl_max == MXL_RV128;
+    return mcc->def->misa_mxl_max == MXL_RV128;
 }
 
 static const VMStateDescription vmstate_rv128 = {
diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index ab8659f304..305912b8dd 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -691,7 +691,7 @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
         return;
     }
 
-    if (mcc->misa_mxl_max != MXL_RV32 && cpu->cfg.ext_zcf) {
+    if (mcc->def->misa_mxl_max != MXL_RV32 && cpu->cfg.ext_zcf) {
         error_setg(errp, "Zcf extension is only relevant to RV32");
         return;
     }
@@ -788,7 +788,7 @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
         return;
     }
 
-    if (mcc->misa_mxl_max == MXL_RV32 && cpu->cfg.ext_svukte) {
+    if (mcc->def->misa_mxl_max == MXL_RV32 && cpu->cfg.ext_svukte) {
         error_setg(errp, "svukte is not supported for RV32");
         return;
     }
@@ -1026,7 +1026,7 @@ static void cpu_enable_zc_implied_rules(RISCVCPU *cpu)
         cpu_cfg_ext_auto_update(cpu, CPU_CFG_OFFSET(ext_zcmp), true);
         cpu_cfg_ext_auto_update(cpu, CPU_CFG_OFFSET(ext_zcmt), true);
 
-        if (riscv_has_ext(env, RVF) && mcc->misa_mxl_max == MXL_RV32) {
+        if (riscv_has_ext(env, RVF) && mcc->def->misa_mxl_max == MXL_RV32) {
             cpu_cfg_ext_auto_update(cpu, CPU_CFG_OFFSET(ext_zcf), true);
         }
     }
@@ -1035,7 +1035,7 @@ static void cpu_enable_zc_implied_rules(RISCVCPU *cpu)
     if (riscv_has_ext(env, RVC) && env->priv_ver >= PRIV_VERSION_1_12_0) {
         cpu_cfg_ext_auto_update(cpu, CPU_CFG_OFFSET(ext_zca), true);
 
-        if (riscv_has_ext(env, RVF) && mcc->misa_mxl_max == MXL_RV32) {
+        if (riscv_has_ext(env, RVF) && mcc->def->misa_mxl_max == MXL_RV32) {
             cpu_cfg_ext_auto_update(cpu, CPU_CFG_OFFSET(ext_zcf), true);
         }
 
@@ -1161,7 +1161,7 @@ static bool riscv_tcg_cpu_realize(CPUState *cs, Error **errp)
 #ifndef CONFIG_USER_ONLY
     RISCVCPUClass *mcc = RISCV_CPU_GET_CLASS(cpu);
 
-    if (mcc->misa_mxl_max >= MXL_RV128 && qemu_tcg_mttcg_enabled()) {
+    if (mcc->def->misa_mxl_max >= MXL_RV128 && qemu_tcg_mttcg_enabled()) {
         /* Missing 128-bit aligned atomics */
         error_setg(errp,
                    "128-bit RISC-V currently does not work with Multi "
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index 0d4f7d601c..d7a6de02df 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -1276,7 +1276,7 @@ static void riscv_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
     ctx->cfg_vta_all_1s = cpu->cfg.rvv_ta_all_1s;
     ctx->vstart_eq_zero = FIELD_EX32(tb_flags, TB_FLAGS, VSTART_EQ_ZERO);
     ctx->vl_eq_vlmax = FIELD_EX32(tb_flags, TB_FLAGS, VL_EQ_VLMAX);
-    ctx->misa_mxl_max = mcc->misa_mxl_max;
+    ctx->misa_mxl_max = mcc->def->misa_mxl_max;
     ctx->xl = FIELD_EX32(tb_flags, TB_FLAGS, XL);
     ctx->address_xl = FIELD_EX32(tb_flags, TB_FLAGS, AXL);
     ctx->cs = cs;

From 7f9e15d82d21714a2c82aff8869b8ef9aa191c98 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Thu, 6 Feb 2025 13:41:49 +0100
Subject: [PATCH 1034/2760] target/riscv: merge riscv_cpu_class_init with the
 class_base function

Since all TYPE_RISCV_CPU subclasses support a class_data of type
RISCVCPUDef, process it even before calling the .class_init function
for the subclasses.

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/riscv/cpu.c | 21 ++++++++++-----------
 1 file changed, 10 insertions(+), 11 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 22e3a2211e..334791eebd 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -3080,15 +3080,18 @@ static void riscv_cpu_class_base_init(ObjectClass *c, const void *data)
     } else {
         mcc->def = g_new0(RISCVCPUDef, 1);
     }
-}
 
-static void riscv_cpu_class_init(ObjectClass *c, const void *data)
-{
-    RISCVCPUClass *mcc = RISCV_CPU_CLASS(c);
-    const RISCVCPUDef *def = data;
+    if (data) {
+        const RISCVCPUDef *def = data;
+        if (def->misa_mxl_max) {
+            assert(def->misa_mxl_max <= MXL_RV128);
+            mcc->def->misa_mxl_max = def->misa_mxl_max;
+        }
+    }
 
-    mcc->def->misa_mxl_max = def->misa_mxl_max;
-    riscv_cpu_validate_misa_mxl(mcc);
+    if (!object_class_is_abstract(c)) {
+        riscv_cpu_validate_misa_mxl(mcc);
+    }
 }
 
 static void riscv_isa_string_ext(RISCVCPU *cpu, char **isa_str,
@@ -3188,7 +3191,6 @@ void riscv_isa_write_fdt(RISCVCPU *cpu, void *fdt, char *nodename)
         .name = (type_name),                                \
         .parent = TYPE_RISCV_DYNAMIC_CPU,                   \
         .instance_init = (initfn),                          \
-        .class_init = riscv_cpu_class_init,                 \
         .class_data = &(const RISCVCPUDef) {                \
              .misa_mxl_max = (misa_mxl_max_),               \
         },                                                  \
@@ -3199,7 +3201,6 @@ void riscv_isa_write_fdt(RISCVCPU *cpu, void *fdt, char *nodename)
         .name = (type_name),                                \
         .parent = TYPE_RISCV_VENDOR_CPU,                    \
         .instance_init = (initfn),                          \
-        .class_init = riscv_cpu_class_init,                 \
         .class_data = &(const RISCVCPUDef) {                \
              .misa_mxl_max = (misa_mxl_max_),               \
         },                                                  \
@@ -3210,7 +3211,6 @@ void riscv_isa_write_fdt(RISCVCPU *cpu, void *fdt, char *nodename)
         .name = (type_name),                                \
         .parent = TYPE_RISCV_BARE_CPU,                      \
         .instance_init = (initfn),                          \
-        .class_init = riscv_cpu_class_init,                 \
         .class_data = &(const RISCVCPUDef) {                \
              .misa_mxl_max = (misa_mxl_max_),               \
         },                                                  \
@@ -3221,7 +3221,6 @@ void riscv_isa_write_fdt(RISCVCPU *cpu, void *fdt, char *nodename)
         .name = (type_name),                                \
         .parent = TYPE_RISCV_BARE_CPU,                      \
         .instance_init = (initfn),                          \
-        .class_init = riscv_cpu_class_init,                 \
         .class_data = &(const RISCVCPUDef) {                \
              .misa_mxl_max = (misa_mxl_max_),               \
         },                                                  \

From 12877e739b3afff2b6ff7b80d6a6b22e451671c2 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Tue, 18 Feb 2025 11:28:23 +0100
Subject: [PATCH 1035/2760] target/riscv: move RISCVCPUConfig fields to a
 header file

To support merging a subclass's RISCVCPUDef into the superclass, a list
of all the CPU features is needed.  Put them into a header file that
can be included multiple times, expanding the macros BOOL_FIELD and
TYPE_FIELD to different operations.

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/riscv/cpu_cfg.h            | 163 +---------------------------
 target/riscv/cpu_cfg_fields.h.inc | 170 ++++++++++++++++++++++++++++++
 2 files changed, 173 insertions(+), 160 deletions(-)
 create mode 100644 target/riscv/cpu_cfg_fields.h.inc

diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
index 8fa73c8a07..e9bf75730a 100644
--- a/target/riscv/cpu_cfg.h
+++ b/target/riscv/cpu_cfg.h
@@ -22,166 +22,9 @@
 #define RISCV_CPU_CFG_H
 
 struct RISCVCPUConfig {
-    bool ext_zba;
-    bool ext_zbb;
-    bool ext_zbc;
-    bool ext_zbkb;
-    bool ext_zbkc;
-    bool ext_zbkx;
-    bool ext_zbs;
-    bool ext_zca;
-    bool ext_zcb;
-    bool ext_zcd;
-    bool ext_zce;
-    bool ext_zcf;
-    bool ext_zcmp;
-    bool ext_zcmt;
-    bool ext_zk;
-    bool ext_zkn;
-    bool ext_zknd;
-    bool ext_zkne;
-    bool ext_zknh;
-    bool ext_zkr;
-    bool ext_zks;
-    bool ext_zksed;
-    bool ext_zksh;
-    bool ext_zkt;
-    bool ext_zifencei;
-    bool ext_zicntr;
-    bool ext_zicsr;
-    bool ext_zicbom;
-    bool ext_zicbop;
-    bool ext_zicboz;
-    bool ext_zicfilp;
-    bool ext_zicfiss;
-    bool ext_zicond;
-    bool ext_zihintntl;
-    bool ext_zihintpause;
-    bool ext_zihpm;
-    bool ext_zimop;
-    bool ext_zcmop;
-    bool ext_ztso;
-    bool ext_smstateen;
-    bool ext_sstc;
-    bool ext_smcdeleg;
-    bool ext_ssccfg;
-    bool ext_smcntrpmf;
-    bool ext_smcsrind;
-    bool ext_sscsrind;
-    bool ext_ssdbltrp;
-    bool ext_smdbltrp;
-    bool ext_svadu;
-    bool ext_svinval;
-    bool ext_svnapot;
-    bool ext_svpbmt;
-    bool ext_svvptc;
-    bool ext_svukte;
-    bool ext_zdinx;
-    bool ext_zaamo;
-    bool ext_zacas;
-    bool ext_zama16b;
-    bool ext_zabha;
-    bool ext_zalrsc;
-    bool ext_zawrs;
-    bool ext_zfa;
-    bool ext_zfbfmin;
-    bool ext_zfh;
-    bool ext_zfhmin;
-    bool ext_zfinx;
-    bool ext_zhinx;
-    bool ext_zhinxmin;
-    bool ext_zve32f;
-    bool ext_zve32x;
-    bool ext_zve64f;
-    bool ext_zve64d;
-    bool ext_zve64x;
-    bool ext_zvbb;
-    bool ext_zvbc;
-    bool ext_zvkb;
-    bool ext_zvkg;
-    bool ext_zvkned;
-    bool ext_zvknha;
-    bool ext_zvknhb;
-    bool ext_zvksed;
-    bool ext_zvksh;
-    bool ext_zvkt;
-    bool ext_zvkn;
-    bool ext_zvknc;
-    bool ext_zvkng;
-    bool ext_zvks;
-    bool ext_zvksc;
-    bool ext_zvksg;
-    bool ext_zmmul;
-    bool ext_zvfbfmin;
-    bool ext_zvfbfwma;
-    bool ext_zvfh;
-    bool ext_zvfhmin;
-    bool ext_smaia;
-    bool ext_ssaia;
-    bool ext_smctr;
-    bool ext_ssctr;
-    bool ext_sscofpmf;
-    bool ext_smepmp;
-    bool ext_smrnmi;
-    bool ext_ssnpm;
-    bool ext_smnpm;
-    bool ext_smmpm;
-    bool ext_sspm;
-    bool ext_supm;
-    bool rvv_ta_all_1s;
-    bool rvv_ma_all_1s;
-    bool rvv_vl_half_avl;
-
-    uint32_t mvendorid;
-    uint64_t marchid;
-    uint64_t mimpid;
-
-    /* Named features  */
-    bool ext_svade;
-    bool ext_zic64b;
-    bool ext_ssstateen;
-    bool ext_sha;
-
-    /*
-     * Always 'true' booleans for named features
-     * TCG always implement/can't be user disabled,
-     * based on spec version.
-     */
-    bool has_priv_1_13;
-    bool has_priv_1_12;
-    bool has_priv_1_11;
-
-    /* Always enabled for TCG if has_priv_1_11 */
-    bool ext_ziccrse;
-
-    /* Vendor-specific custom extensions */
-    bool ext_xtheadba;
-    bool ext_xtheadbb;
-    bool ext_xtheadbs;
-    bool ext_xtheadcmo;
-    bool ext_xtheadcondmov;
-    bool ext_xtheadfmemidx;
-    bool ext_xtheadfmv;
-    bool ext_xtheadmac;
-    bool ext_xtheadmemidx;
-    bool ext_xtheadmempair;
-    bool ext_xtheadsync;
-    bool ext_XVentanaCondOps;
-
-    uint32_t pmu_mask;
-    uint16_t vlenb;
-    uint16_t elen;
-    uint16_t cbom_blocksize;
-    uint16_t cbop_blocksize;
-    uint16_t cboz_blocksize;
-    bool mmu;
-    bool pmp;
-    bool debug;
-    bool misa_w;
-
-    bool short_isa_string;
-
-    int8_t max_satp_mode;
+#define BOOL_FIELD(x) bool x;
+#define TYPED_FIELD(type, x) type x;
+#include "cpu_cfg_fields.h.inc"
 };
 
 typedef struct RISCVCPUConfig RISCVCPUConfig;
diff --git a/target/riscv/cpu_cfg_fields.h.inc b/target/riscv/cpu_cfg_fields.h.inc
new file mode 100644
index 0000000000..cb86bfc5dc
--- /dev/null
+++ b/target/riscv/cpu_cfg_fields.h.inc
@@ -0,0 +1,170 @@
+/*
+ * Required definitions before including this file:
+ *
+ * #define BOOL_FIELD(x)
+ * #define TYPED_FIELD(type, x)
+ */
+
+BOOL_FIELD(ext_zba)
+BOOL_FIELD(ext_zbb)
+BOOL_FIELD(ext_zbc)
+BOOL_FIELD(ext_zbkb)
+BOOL_FIELD(ext_zbkc)
+BOOL_FIELD(ext_zbkx)
+BOOL_FIELD(ext_zbs)
+BOOL_FIELD(ext_zca)
+BOOL_FIELD(ext_zcb)
+BOOL_FIELD(ext_zcd)
+BOOL_FIELD(ext_zce)
+BOOL_FIELD(ext_zcf)
+BOOL_FIELD(ext_zcmp)
+BOOL_FIELD(ext_zcmt)
+BOOL_FIELD(ext_zk)
+BOOL_FIELD(ext_zkn)
+BOOL_FIELD(ext_zknd)
+BOOL_FIELD(ext_zkne)
+BOOL_FIELD(ext_zknh)
+BOOL_FIELD(ext_zkr)
+BOOL_FIELD(ext_zks)
+BOOL_FIELD(ext_zksed)
+BOOL_FIELD(ext_zksh)
+BOOL_FIELD(ext_zkt)
+BOOL_FIELD(ext_zifencei)
+BOOL_FIELD(ext_zicntr)
+BOOL_FIELD(ext_zicsr)
+BOOL_FIELD(ext_zicbom)
+BOOL_FIELD(ext_zicbop)
+BOOL_FIELD(ext_zicboz)
+BOOL_FIELD(ext_zicfilp)
+BOOL_FIELD(ext_zicfiss)
+BOOL_FIELD(ext_zicond)
+BOOL_FIELD(ext_zihintntl)
+BOOL_FIELD(ext_zihintpause)
+BOOL_FIELD(ext_zihpm)
+BOOL_FIELD(ext_zimop)
+BOOL_FIELD(ext_zcmop)
+BOOL_FIELD(ext_ztso)
+BOOL_FIELD(ext_smstateen)
+BOOL_FIELD(ext_sstc)
+BOOL_FIELD(ext_smcdeleg)
+BOOL_FIELD(ext_ssccfg)
+BOOL_FIELD(ext_smcntrpmf)
+BOOL_FIELD(ext_smcsrind)
+BOOL_FIELD(ext_sscsrind)
+BOOL_FIELD(ext_ssdbltrp)
+BOOL_FIELD(ext_smdbltrp)
+BOOL_FIELD(ext_svadu)
+BOOL_FIELD(ext_svinval)
+BOOL_FIELD(ext_svnapot)
+BOOL_FIELD(ext_svpbmt)
+BOOL_FIELD(ext_svvptc)
+BOOL_FIELD(ext_svukte)
+BOOL_FIELD(ext_zdinx)
+BOOL_FIELD(ext_zaamo)
+BOOL_FIELD(ext_zacas)
+BOOL_FIELD(ext_zama16b)
+BOOL_FIELD(ext_zabha)
+BOOL_FIELD(ext_zalrsc)
+BOOL_FIELD(ext_zawrs)
+BOOL_FIELD(ext_zfa)
+BOOL_FIELD(ext_zfbfmin)
+BOOL_FIELD(ext_zfh)
+BOOL_FIELD(ext_zfhmin)
+BOOL_FIELD(ext_zfinx)
+BOOL_FIELD(ext_zhinx)
+BOOL_FIELD(ext_zhinxmin)
+BOOL_FIELD(ext_zve32f)
+BOOL_FIELD(ext_zve32x)
+BOOL_FIELD(ext_zve64f)
+BOOL_FIELD(ext_zve64d)
+BOOL_FIELD(ext_zve64x)
+BOOL_FIELD(ext_zvbb)
+BOOL_FIELD(ext_zvbc)
+BOOL_FIELD(ext_zvkb)
+BOOL_FIELD(ext_zvkg)
+BOOL_FIELD(ext_zvkned)
+BOOL_FIELD(ext_zvknha)
+BOOL_FIELD(ext_zvknhb)
+BOOL_FIELD(ext_zvksed)
+BOOL_FIELD(ext_zvksh)
+BOOL_FIELD(ext_zvkt)
+BOOL_FIELD(ext_zvkn)
+BOOL_FIELD(ext_zvknc)
+BOOL_FIELD(ext_zvkng)
+BOOL_FIELD(ext_zvks)
+BOOL_FIELD(ext_zvksc)
+BOOL_FIELD(ext_zvksg)
+BOOL_FIELD(ext_zmmul)
+BOOL_FIELD(ext_zvfbfmin)
+BOOL_FIELD(ext_zvfbfwma)
+BOOL_FIELD(ext_zvfh)
+BOOL_FIELD(ext_zvfhmin)
+BOOL_FIELD(ext_smaia)
+BOOL_FIELD(ext_ssaia)
+BOOL_FIELD(ext_smctr)
+BOOL_FIELD(ext_ssctr)
+BOOL_FIELD(ext_sscofpmf)
+BOOL_FIELD(ext_smepmp)
+BOOL_FIELD(ext_smrnmi)
+BOOL_FIELD(ext_ssnpm)
+BOOL_FIELD(ext_smnpm)
+BOOL_FIELD(ext_smmpm)
+BOOL_FIELD(ext_sspm)
+BOOL_FIELD(ext_supm)
+BOOL_FIELD(rvv_ta_all_1s)
+BOOL_FIELD(rvv_ma_all_1s)
+BOOL_FIELD(rvv_vl_half_avl)
+/* Named features  */
+BOOL_FIELD(ext_svade)
+BOOL_FIELD(ext_zic64b)
+BOOL_FIELD(ext_ssstateen)
+BOOL_FIELD(ext_sha)
+
+/*
+ * Always 'true' booleans for named features
+ * TCG always implement/can't be user disabled,
+ * based on spec version.
+ */
+BOOL_FIELD(has_priv_1_13)
+BOOL_FIELD(has_priv_1_12)
+BOOL_FIELD(has_priv_1_11)
+
+/* Always enabled for TCG if has_priv_1_11 */
+BOOL_FIELD(ext_ziccrse)
+
+/* Vendor-specific custom extensions */
+BOOL_FIELD(ext_xtheadba)
+BOOL_FIELD(ext_xtheadbb)
+BOOL_FIELD(ext_xtheadbs)
+BOOL_FIELD(ext_xtheadcmo)
+BOOL_FIELD(ext_xtheadcondmov)
+BOOL_FIELD(ext_xtheadfmemidx)
+BOOL_FIELD(ext_xtheadfmv)
+BOOL_FIELD(ext_xtheadmac)
+BOOL_FIELD(ext_xtheadmemidx)
+BOOL_FIELD(ext_xtheadmempair)
+BOOL_FIELD(ext_xtheadsync)
+BOOL_FIELD(ext_XVentanaCondOps)
+
+BOOL_FIELD(mmu)
+BOOL_FIELD(pmp)
+BOOL_FIELD(debug)
+BOOL_FIELD(misa_w)
+
+BOOL_FIELD(short_isa_string)
+
+TYPED_FIELD(uint32_t, mvendorid)
+TYPED_FIELD(uint64_t, marchid)
+TYPED_FIELD(uint64_t, mimpid)
+
+TYPED_FIELD(uint32_t, pmu_mask)
+TYPED_FIELD(uint16_t, vlenb)
+TYPED_FIELD(uint16_t, elen)
+TYPED_FIELD(uint16_t, cbom_blocksize)
+TYPED_FIELD(uint16_t, cbop_blocksize)
+TYPED_FIELD(uint16_t, cboz_blocksize)
+
+TYPED_FIELD(int8_t, max_satp_mode)
+
+#undef BOOL_FIELD
+#undef TYPED_FIELD

From 407254031edd649e6acde736e3f7e95bb0fdf299 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Wed, 5 Mar 2025 13:22:48 +0100
Subject: [PATCH 1036/2760] target/riscv: include default value in
 cpu_cfg_fields.h.inc

In preparation for adding a function to merge two RISCVCPUConfigs
(pulling values from the parent if they are not overridden) annotate
cpu_cfg_fields.h.inc with the default value of the fields.

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/riscv/cpu_cfg.h            |  2 +-
 target/riscv/cpu_cfg_fields.h.inc | 22 +++++++++++-----------
 2 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
index e9bf75730a..aa28dc8d7e 100644
--- a/target/riscv/cpu_cfg.h
+++ b/target/riscv/cpu_cfg.h
@@ -23,7 +23,7 @@
 
 struct RISCVCPUConfig {
 #define BOOL_FIELD(x) bool x;
-#define TYPED_FIELD(type, x) type x;
+#define TYPED_FIELD(type, x, default) type x;
 #include "cpu_cfg_fields.h.inc"
 };
 
diff --git a/target/riscv/cpu_cfg_fields.h.inc b/target/riscv/cpu_cfg_fields.h.inc
index cb86bfc5dc..59f134a419 100644
--- a/target/riscv/cpu_cfg_fields.h.inc
+++ b/target/riscv/cpu_cfg_fields.h.inc
@@ -2,7 +2,7 @@
  * Required definitions before including this file:
  *
  * #define BOOL_FIELD(x)
- * #define TYPED_FIELD(type, x)
+ * #define TYPED_FIELD(type, x, default)
  */
 
 BOOL_FIELD(ext_zba)
@@ -153,18 +153,18 @@ BOOL_FIELD(misa_w)
 
 BOOL_FIELD(short_isa_string)
 
-TYPED_FIELD(uint32_t, mvendorid)
-TYPED_FIELD(uint64_t, marchid)
-TYPED_FIELD(uint64_t, mimpid)
+TYPED_FIELD(uint32_t, mvendorid, 0)
+TYPED_FIELD(uint64_t, marchid, 0)
+TYPED_FIELD(uint64_t, mimpid, 0)
 
-TYPED_FIELD(uint32_t, pmu_mask)
-TYPED_FIELD(uint16_t, vlenb)
-TYPED_FIELD(uint16_t, elen)
-TYPED_FIELD(uint16_t, cbom_blocksize)
-TYPED_FIELD(uint16_t, cbop_blocksize)
-TYPED_FIELD(uint16_t, cboz_blocksize)
+TYPED_FIELD(uint32_t, pmu_mask, 0)
+TYPED_FIELD(uint16_t, vlenb, 0)
+TYPED_FIELD(uint16_t, elen, 0)
+TYPED_FIELD(uint16_t, cbom_blocksize, 0)
+TYPED_FIELD(uint16_t, cbop_blocksize, 0)
+TYPED_FIELD(uint16_t, cboz_blocksize, 0)
 
-TYPED_FIELD(int8_t, max_satp_mode)
+TYPED_FIELD(int8_t, max_satp_mode, -1)
 
 #undef BOOL_FIELD
 #undef TYPED_FIELD

From a6ba81424a7e751fbcee40dc1f5826ba29fddd30 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Tue, 18 Feb 2025 11:31:30 +0100
Subject: [PATCH 1037/2760] target/riscv: add more RISCVCPUDef fields

Allow using RISCVCPUDef to replicate all the logic of custom .instance_init
functions.  To simulate inheritance, merge the child's RISCVCPUDef with
the parent and then finally move it to the CPUState at the end of
TYPE_RISCV_CPU's own instance_init function.

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/riscv/cpu.c         | 42 +++++++++++++++++++++++++++++++++++++-
 target/riscv/cpu.h         |  4 ++++
 target/riscv/kvm/kvm-cpu.c |  6 ++++++
 3 files changed, 51 insertions(+), 1 deletion(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 334791eebd..634216870e 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -73,6 +73,13 @@ bool riscv_cpu_option_set(const char *optname)
     return g_hash_table_contains(general_user_opts, optname);
 }
 
+static void riscv_cpu_cfg_merge(RISCVCPUConfig *dest, const RISCVCPUConfig *src)
+{
+#define BOOL_FIELD(x) dest->x |= src->x;
+#define TYPED_FIELD(type, x, default_) if (src->x != default_) dest->x = src->x;
+#include "cpu_cfg_fields.h.inc"
+}
+
 #define ISA_EXT_DATA_ENTRY(_name, _min_ver, _prop) \
     {#_name, _min_ver, CPU_CFG_OFFSET(_prop)}
 
@@ -434,7 +441,7 @@ const char *satp_mode_str(uint8_t satp_mode, bool is_32_bit)
 }
 
 static void set_satp_mode_max_supported(RISCVCPU *cpu,
-                                        uint8_t satp_mode)
+                                        int satp_mode)
 {
     bool rv32 = riscv_cpu_mxl(&cpu->env) == MXL_RV32;
     const bool *valid_vm = rv32 ? valid_vm_1_10_32 : valid_vm_1_10_64;
@@ -1479,6 +1486,16 @@ static void riscv_cpu_init(Object *obj)
     cpu->cfg.cboz_blocksize = 64;
     cpu->env.vext_ver = VEXT_VERSION_1_00_0;
     cpu->cfg.max_satp_mode = -1;
+
+    env->misa_ext_mask = env->misa_ext = mcc->def->misa_ext;
+    riscv_cpu_cfg_merge(&cpu->cfg, &mcc->def->cfg);
+
+    if (mcc->def->priv_spec != RISCV_PROFILE_ATTR_UNUSED) {
+        cpu->env.priv_ver = mcc->def->priv_spec;
+    }
+    if (mcc->def->vext_spec != RISCV_PROFILE_ATTR_UNUSED) {
+        cpu->env.vext_ver = mcc->def->vext_spec;
+    }
 }
 
 static void riscv_bare_cpu_init(Object *obj)
@@ -3087,6 +3104,17 @@ static void riscv_cpu_class_base_init(ObjectClass *c, const void *data)
             assert(def->misa_mxl_max <= MXL_RV128);
             mcc->def->misa_mxl_max = def->misa_mxl_max;
         }
+        if (def->priv_spec != RISCV_PROFILE_ATTR_UNUSED) {
+            assert(def->priv_spec <= PRIV_VERSION_LATEST);
+            mcc->def->priv_spec = def->priv_spec;
+        }
+        if (def->vext_spec != RISCV_PROFILE_ATTR_UNUSED) {
+            assert(def->vext_spec != 0);
+            mcc->def->vext_spec = def->vext_spec;
+        }
+        mcc->def->misa_ext |= def->misa_ext;
+
+        riscv_cpu_cfg_merge(&mcc->def->cfg, &def->cfg);
     }
 
     if (!object_class_is_abstract(c)) {
@@ -3193,6 +3221,9 @@ void riscv_isa_write_fdt(RISCVCPU *cpu, void *fdt, char *nodename)
         .instance_init = (initfn),                          \
         .class_data = &(const RISCVCPUDef) {                \
              .misa_mxl_max = (misa_mxl_max_),               \
+             .priv_spec = RISCV_PROFILE_ATTR_UNUSED,        \
+             .vext_spec = RISCV_PROFILE_ATTR_UNUSED,        \
+             .cfg.max_satp_mode = -1,                       \
         },                                                  \
     }
 
@@ -3203,6 +3234,9 @@ void riscv_isa_write_fdt(RISCVCPU *cpu, void *fdt, char *nodename)
         .instance_init = (initfn),                          \
         .class_data = &(const RISCVCPUDef) {                \
              .misa_mxl_max = (misa_mxl_max_),               \
+             .priv_spec = RISCV_PROFILE_ATTR_UNUSED,        \
+             .vext_spec = RISCV_PROFILE_ATTR_UNUSED,        \
+             .cfg.max_satp_mode = -1,                       \
         },                                                  \
     }
 
@@ -3213,6 +3247,9 @@ void riscv_isa_write_fdt(RISCVCPU *cpu, void *fdt, char *nodename)
         .instance_init = (initfn),                          \
         .class_data = &(const RISCVCPUDef) {                \
              .misa_mxl_max = (misa_mxl_max_),               \
+             .priv_spec = RISCV_PROFILE_ATTR_UNUSED,        \
+             .vext_spec = RISCV_PROFILE_ATTR_UNUSED,        \
+             .cfg.max_satp_mode = -1,                       \
         },                                                  \
     }
 
@@ -3223,6 +3260,9 @@ void riscv_isa_write_fdt(RISCVCPU *cpu, void *fdt, char *nodename)
         .instance_init = (initfn),                          \
         .class_data = &(const RISCVCPUDef) {                \
              .misa_mxl_max = (misa_mxl_max_),               \
+             .priv_spec = RISCV_PROFILE_ATTR_UNUSED,        \
+             .vext_spec = RISCV_PROFILE_ATTR_UNUSED,        \
+             .cfg.max_satp_mode = -1,                       \
         },                                                  \
     }
 
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index d2d4db95c1..29b01e9aa8 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -540,6 +540,10 @@ struct ArchCPU {
 
 typedef struct RISCVCPUDef {
     RISCVMXL misa_mxl_max;  /* max mxl for this cpu */
+    uint32_t misa_ext;
+    int priv_spec;
+    int32_t vext_spec;
+    RISCVCPUConfig cfg;
 } RISCVCPUDef;
 
 /**
diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
index e77f612af3..efb41fac53 100644
--- a/target/riscv/kvm/kvm-cpu.c
+++ b/target/riscv/kvm/kvm-cpu.c
@@ -2093,10 +2093,16 @@ static const TypeInfo riscv_kvm_cpu_type_infos[] = {
 #if defined(TARGET_RISCV32)
         .class_data = &(const RISCVCPUDef) {
             .misa_mxl_max = MXL_RV32,
+            .priv_spec = RISCV_PROFILE_ATTR_UNUSED,
+            .vext_spec = RISCV_PROFILE_ATTR_UNUSED,
+            .cfg.max_satp_mode = -1,
         },
 #elif defined(TARGET_RISCV64)
         .class_data = &(const RISCVCPUDef) {
             .misa_mxl_max = MXL_RV64,
+            .priv_spec = RISCV_PROFILE_ATTR_UNUSED,
+            .vext_spec = RISCV_PROFILE_ATTR_UNUSED,
+            .cfg.max_satp_mode = -1,
         },
 #endif
     }

From 4e012d36c8654e7fa12762002150334bf591628a Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Thu, 6 Feb 2025 17:03:01 +0100
Subject: [PATCH 1038/2760] target/riscv: convert abstract CPU classes to
 RISCVCPUDef

Start from the top of the hierarchy: dynamic and vendor CPUs are just
markers, whereas bare CPUs can have their instance_init function
replaced by RISCVCPUDef.

The only difference is that the maximum supported SATP mode has to
be specified separately for 32-bit and 64-bit modes.

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/riscv/cpu.c | 93 ++++++++++++++++++++++------------------------
 target/riscv/cpu.h |  1 +
 2 files changed, 46 insertions(+), 48 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 634216870e..7dcaf72fc1 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -1474,8 +1474,8 @@ static void riscv_cpu_init(Object *obj)
      * for all CPUs. Each accelerator will decide what to do when
      * users disable them.
      */
-    RISCV_CPU(obj)->cfg.ext_zicntr = true;
-    RISCV_CPU(obj)->cfg.ext_zihpm = true;
+    RISCV_CPU(obj)->cfg.ext_zicntr = !mcc->def->bare;
+    RISCV_CPU(obj)->cfg.ext_zihpm = !mcc->def->bare;
 
     /* Default values for non-bool cpu properties */
     cpu->cfg.pmu_mask = MAKE_64BIT_MASK(3, 16);
@@ -1498,36 +1498,6 @@ static void riscv_cpu_init(Object *obj)
     }
 }
 
-static void riscv_bare_cpu_init(Object *obj)
-{
-    RISCVCPU *cpu = RISCV_CPU(obj);
-
-    /*
-     * Bare CPUs do not inherit the timer and performance
-     * counters from the parent class (see riscv_cpu_init()
-     * for info on why the parent enables them).
-     *
-     * Users have to explicitly enable these counters for
-     * bare CPUs.
-     */
-    cpu->cfg.ext_zicntr = false;
-    cpu->cfg.ext_zihpm = false;
-
-    /* Set to QEMU's first supported priv version */
-    cpu->env.priv_ver = PRIV_VERSION_1_10_0;
-
-    /*
-     * Support all available satp_mode settings. The default
-     * value will be set to MBARE if the user doesn't set
-     * satp_mode manually (see set_satp_mode_default()).
-     */
-#ifndef CONFIG_USER_ONLY
-    set_satp_mode_max_supported(RISCV_CPU(obj),
-        riscv_cpu_mxl(&RISCV_CPU(obj)->env) == MXL_RV32 ?
-        VM_1_10_SV32 : VM_1_10_SV57);
-#endif
-}
-
 typedef struct misa_ext_info {
     const char *name;
     const char *description;
@@ -3100,6 +3070,7 @@ static void riscv_cpu_class_base_init(ObjectClass *c, const void *data)
 
     if (data) {
         const RISCVCPUDef *def = data;
+        mcc->def->bare |= def->bare;
         if (def->misa_mxl_max) {
             assert(def->misa_mxl_max <= MXL_RV128);
             mcc->def->misa_mxl_max = def->misa_mxl_max;
@@ -3253,6 +3224,19 @@ void riscv_isa_write_fdt(RISCVCPU *cpu, void *fdt, char *nodename)
         },                                                  \
     }
 
+#define DEFINE_ABSTRACT_RISCV_CPU(type_name, parent_type_name, ...) \
+    {                                                       \
+        .name = (type_name),                                \
+        .parent = (parent_type_name),                       \
+        .abstract = true,                                   \
+        .class_data = &(const RISCVCPUDef) {                \
+             .priv_spec = RISCV_PROFILE_ATTR_UNUSED,        \
+             .vext_spec = RISCV_PROFILE_ATTR_UNUSED,        \
+             .cfg.max_satp_mode = -1,                       \
+             __VA_ARGS__                                    \
+        },                                                  \
+    }
+
 #define DEFINE_PROFILE_CPU(type_name, misa_mxl_max_, initfn) \
     {                                                       \
         .name = (type_name),                                \
@@ -3279,22 +3263,35 @@ static const TypeInfo riscv_cpu_type_infos[] = {
         .class_init = riscv_cpu_common_class_init,
         .class_base_init = riscv_cpu_class_base_init,
     },
-    {
-        .name = TYPE_RISCV_DYNAMIC_CPU,
-        .parent = TYPE_RISCV_CPU,
-        .abstract = true,
-    },
-    {
-        .name = TYPE_RISCV_VENDOR_CPU,
-        .parent = TYPE_RISCV_CPU,
-        .abstract = true,
-    },
-    {
-        .name = TYPE_RISCV_BARE_CPU,
-        .parent = TYPE_RISCV_CPU,
-        .instance_init = riscv_bare_cpu_init,
-        .abstract = true,
-    },
+
+    DEFINE_ABSTRACT_RISCV_CPU(TYPE_RISCV_DYNAMIC_CPU, TYPE_RISCV_CPU),
+    DEFINE_ABSTRACT_RISCV_CPU(TYPE_RISCV_VENDOR_CPU, TYPE_RISCV_CPU),
+    DEFINE_ABSTRACT_RISCV_CPU(TYPE_RISCV_BARE_CPU, TYPE_RISCV_CPU,
+        /*
+         * Bare CPUs do not inherit the timer and performance
+         * counters from the parent class (see riscv_cpu_init()
+         * for info on why the parent enables them).
+         *
+         * Users have to explicitly enable these counters for
+         * bare CPUs.
+         */
+        .bare = true,
+
+        /* Set to QEMU's first supported priv version */
+        .priv_spec = PRIV_VERSION_1_10_0,
+
+        /*
+         * Support all available satp_mode settings. By default
+         * only MBARE will be available if the user doesn't enable
+         * a mode manually (see riscv_cpu_satp_mode_finalize()).
+         */
+#ifdef TARGET_RISCV32
+        .cfg.max_satp_mode = VM_1_10_SV32,
+#else
+        .cfg.max_satp_mode = VM_1_10_SV57,
+#endif
+    ),
+
 #if defined(TARGET_RISCV32)
     DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_MAX,       MXL_RV32,  riscv_max_cpu_init),
 #elif defined(TARGET_RISCV64)
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index 29b01e9aa8..f3d70afb86 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -544,6 +544,7 @@ typedef struct RISCVCPUDef {
     int priv_spec;
     int32_t vext_spec;
     RISCVCPUConfig cfg;
+    bool bare;
 } RISCVCPUDef;
 
 /**

From 198265df8a71e6743d42d5003c29a060fea7d019 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Thu, 27 Feb 2025 14:56:30 +0100
Subject: [PATCH 1039/2760] target/riscv: convert profile CPU models to
 RISCVCPUDef

Profile CPUs reuse the instance_init function for bare CPUs; make them
proper subclasses instead.  Enabling a profile is now done based on the
RISCVCPUDef struct: even though there is room for only one in RISCVCPUDef,
subclasses check that the parent class's profile is enabled through the
parent profile mechanism.

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/riscv/cpu.c | 85 +++++++++++++++++++++++++---------------------
 target/riscv/cpu.h |  1 +
 2 files changed, 48 insertions(+), 38 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 7dcaf72fc1..54fce76765 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -1487,6 +1487,10 @@ static void riscv_cpu_init(Object *obj)
     cpu->env.vext_ver = VEXT_VERSION_1_00_0;
     cpu->cfg.max_satp_mode = -1;
 
+    if (mcc->def->profile) {
+        mcc->def->profile->enabled = true;
+    }
+
     env->misa_ext_mask = env->misa_ext = mcc->def->misa_ext;
     riscv_cpu_cfg_merge(&cpu->cfg, &mcc->def->cfg);
 
@@ -2959,36 +2963,6 @@ static const Property riscv_cpu_properties[] = {
     DEFINE_PROP_BOOL("x-misa-w", RISCVCPU, cfg.misa_w, false),
 };
 
-#if defined(TARGET_RISCV64)
-static void rva22u64_profile_cpu_init(Object *obj)
-{
-    rv64i_bare_cpu_init(obj);
-
-    RVA22U64.enabled = true;
-}
-
-static void rva22s64_profile_cpu_init(Object *obj)
-{
-    rv64i_bare_cpu_init(obj);
-
-    RVA22S64.enabled = true;
-}
-
-static void rva23u64_profile_cpu_init(Object *obj)
-{
-    rv64i_bare_cpu_init(obj);
-
-    RVA23U64.enabled = true;
-}
-
-static void rva23s64_profile_cpu_init(Object *obj)
-{
-    rv64i_bare_cpu_init(obj);
-
-    RVA23S64.enabled = true;
-}
-#endif
-
 static const gchar *riscv_gdb_arch_name(CPUState *cs)
 {
     RISCVCPU *cpu = RISCV_CPU(cs);
@@ -3057,6 +3031,32 @@ static void riscv_cpu_common_class_init(ObjectClass *c, const void *data)
     device_class_set_props(dc, riscv_cpu_properties);
 }
 
+static bool profile_extends(RISCVCPUProfile *trial, RISCVCPUProfile *parent)
+{
+    RISCVCPUProfile *curr;
+    if (!parent) {
+        return true;
+    }
+
+    curr = trial;
+    while (curr) {
+        if (curr == parent) {
+            return true;
+        }
+        curr = curr->u_parent;
+    }
+
+    curr = trial;
+    while (curr) {
+        if (curr == parent) {
+            return true;
+        }
+        curr = curr->s_parent;
+    }
+
+    return false;
+}
+
 static void riscv_cpu_class_base_init(ObjectClass *c, const void *data)
 {
     RISCVCPUClass *mcc = RISCV_CPU_CLASS(c);
@@ -3071,6 +3071,11 @@ static void riscv_cpu_class_base_init(ObjectClass *c, const void *data)
     if (data) {
         const RISCVCPUDef *def = data;
         mcc->def->bare |= def->bare;
+        if (def->profile) {
+            assert(profile_extends(def->profile, mcc->def->profile));
+            assert(mcc->def->bare);
+            mcc->def->profile = def->profile;
+        }
         if (def->misa_mxl_max) {
             assert(def->misa_mxl_max <= MXL_RV128);
             mcc->def->misa_mxl_max = def->misa_mxl_max;
@@ -3237,19 +3242,22 @@ void riscv_isa_write_fdt(RISCVCPU *cpu, void *fdt, char *nodename)
         },                                                  \
     }
 
-#define DEFINE_PROFILE_CPU(type_name, misa_mxl_max_, initfn) \
+#define DEFINE_RISCV_CPU(type_name, parent_type_name, ...)  \
     {                                                       \
         .name = (type_name),                                \
-        .parent = TYPE_RISCV_BARE_CPU,                      \
-        .instance_init = (initfn),                          \
+        .parent = (parent_type_name),                       \
         .class_data = &(const RISCVCPUDef) {                \
-             .misa_mxl_max = (misa_mxl_max_),               \
              .priv_spec = RISCV_PROFILE_ATTR_UNUSED,        \
              .vext_spec = RISCV_PROFILE_ATTR_UNUSED,        \
              .cfg.max_satp_mode = -1,                       \
+             __VA_ARGS__                                    \
         },                                                  \
     }
 
+#define DEFINE_PROFILE_CPU(type_name, parent_type_name, profile_)    \
+    DEFINE_RISCV_CPU(type_name, parent_type_name,             \
+        .profile = &(profile_))
+
 static const TypeInfo riscv_cpu_type_infos[] = {
     {
         .name = TYPE_RISCV_CPU,
@@ -3328,10 +3336,11 @@ static const TypeInfo riscv_cpu_type_infos[] = {
 #endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
     DEFINE_BARE_CPU(TYPE_RISCV_CPU_RV64I,        MXL_RV64,  rv64i_bare_cpu_init),
     DEFINE_BARE_CPU(TYPE_RISCV_CPU_RV64E,        MXL_RV64,  rv64e_bare_cpu_init),
-    DEFINE_PROFILE_CPU(TYPE_RISCV_CPU_RVA22U64,  MXL_RV64,  rva22u64_profile_cpu_init),
-    DEFINE_PROFILE_CPU(TYPE_RISCV_CPU_RVA22S64,  MXL_RV64,  rva22s64_profile_cpu_init),
-    DEFINE_PROFILE_CPU(TYPE_RISCV_CPU_RVA23U64,  MXL_RV64,  rva23u64_profile_cpu_init),
-    DEFINE_PROFILE_CPU(TYPE_RISCV_CPU_RVA23S64,  MXL_RV64,  rva23s64_profile_cpu_init),
+
+    DEFINE_PROFILE_CPU(TYPE_RISCV_CPU_RVA22U64,  TYPE_RISCV_CPU_RV64I,  RVA22U64),
+    DEFINE_PROFILE_CPU(TYPE_RISCV_CPU_RVA22S64,  TYPE_RISCV_CPU_RV64I,  RVA22S64),
+    DEFINE_PROFILE_CPU(TYPE_RISCV_CPU_RVA23U64,  TYPE_RISCV_CPU_RV64I,  RVA23U64),
+    DEFINE_PROFILE_CPU(TYPE_RISCV_CPU_RVA23S64,  TYPE_RISCV_CPU_RV64I,  RVA23S64),
 #endif /* TARGET_RISCV64 */
 };
 
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index f3d70afb86..ed88adef45 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -540,6 +540,7 @@ struct ArchCPU {
 
 typedef struct RISCVCPUDef {
     RISCVMXL misa_mxl_max;  /* max mxl for this cpu */
+    RISCVCPUProfile *profile;
     uint32_t misa_ext;
     int priv_spec;
     int32_t vext_spec;

From 37815d80be11f98636a4ed76fe6b1ecc7aefcaf3 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Thu, 6 Feb 2025 17:10:46 +0100
Subject: [PATCH 1040/2760] target/riscv: convert bare CPU models to
 RISCVCPUDef

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/riscv/cpu.c | 58 ++++++++++++++--------------------------------
 1 file changed, 17 insertions(+), 41 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 54fce76765..8b82a1b7b3 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -732,18 +732,6 @@ static void rv128_base_cpu_init(Object *obj)
 }
 #endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
 
-static void rv64i_bare_cpu_init(Object *obj)
-{
-    CPURISCVState *env = &RISCV_CPU(obj)->env;
-    riscv_cpu_set_misa_ext(env, RVI);
-}
-
-static void rv64e_bare_cpu_init(Object *obj)
-{
-    CPURISCVState *env = &RISCV_CPU(obj)->env;
-    riscv_cpu_set_misa_ext(env, RVE);
-}
-
 #endif /* !TARGET_RISCV64 */
 
 #if defined(TARGET_RISCV32) || \
@@ -836,18 +824,6 @@ static void rv32_imafcu_nommu_cpu_init(Object *obj)
     cpu->cfg.ext_zicsr = true;
     cpu->cfg.pmp = true;
 }
-
-static void rv32i_bare_cpu_init(Object *obj)
-{
-    CPURISCVState *env = &RISCV_CPU(obj)->env;
-    riscv_cpu_set_misa_ext(env, RVI);
-}
-
-static void rv32e_bare_cpu_init(Object *obj)
-{
-    CPURISCVState *env = &RISCV_CPU(obj)->env;
-    riscv_cpu_set_misa_ext(env, RVE);
-}
 #endif
 
 static ObjectClass *riscv_cpu_class_by_name(const char *cpu_model)
@@ -3216,19 +3192,6 @@ void riscv_isa_write_fdt(RISCVCPU *cpu, void *fdt, char *nodename)
         },                                                  \
     }
 
-#define DEFINE_BARE_CPU(type_name, misa_mxl_max_, initfn)   \
-    {                                                       \
-        .name = (type_name),                                \
-        .parent = TYPE_RISCV_BARE_CPU,                      \
-        .instance_init = (initfn),                          \
-        .class_data = &(const RISCVCPUDef) {                \
-             .misa_mxl_max = (misa_mxl_max_),               \
-             .priv_spec = RISCV_PROFILE_ATTR_UNUSED,        \
-             .vext_spec = RISCV_PROFILE_ATTR_UNUSED,        \
-             .cfg.max_satp_mode = -1,                       \
-        },                                                  \
-    }
-
 #define DEFINE_ABSTRACT_RISCV_CPU(type_name, parent_type_name, ...) \
     {                                                       \
         .name = (type_name),                                \
@@ -3313,8 +3276,15 @@ static const TypeInfo riscv_cpu_type_infos[] = {
     DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_SIFIVE_E31, MXL_RV32,  rv32_sifive_e_cpu_init),
     DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_SIFIVE_E34, MXL_RV32,  rv32_imafcu_nommu_cpu_init),
     DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_SIFIVE_U34, MXL_RV32,  rv32_sifive_u_cpu_init),
-    DEFINE_BARE_CPU(TYPE_RISCV_CPU_RV32I,        MXL_RV32,  rv32i_bare_cpu_init),
-    DEFINE_BARE_CPU(TYPE_RISCV_CPU_RV32E,        MXL_RV32,  rv32e_bare_cpu_init),
+
+    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_RV32I, TYPE_RISCV_BARE_CPU,
+        .misa_mxl_max = MXL_RV32,
+        .misa_ext = RVI
+    ),
+    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_RV32E, TYPE_RISCV_BARE_CPU,
+        .misa_mxl_max = MXL_RV32,
+        .misa_ext = RVE
+    ),
 #endif
 
 #if (defined(TARGET_RISCV64) && !defined(CONFIG_USER_ONLY))
@@ -3334,8 +3304,14 @@ static const TypeInfo riscv_cpu_type_infos[] = {
 #if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
     DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_BASE128,   MXL_RV128, rv128_base_cpu_init),
 #endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
-    DEFINE_BARE_CPU(TYPE_RISCV_CPU_RV64I,        MXL_RV64,  rv64i_bare_cpu_init),
-    DEFINE_BARE_CPU(TYPE_RISCV_CPU_RV64E,        MXL_RV64,  rv64e_bare_cpu_init),
+    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_RV64I, TYPE_RISCV_BARE_CPU,
+        .misa_mxl_max = MXL_RV64,
+        .misa_ext = RVI
+    ),
+    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_RV64E, TYPE_RISCV_BARE_CPU,
+        .misa_mxl_max = MXL_RV64,
+        .misa_ext = RVE
+    ),
 
     DEFINE_PROFILE_CPU(TYPE_RISCV_CPU_RVA22U64,  TYPE_RISCV_CPU_RV64I,  RVA22U64),
     DEFINE_PROFILE_CPU(TYPE_RISCV_CPU_RVA22S64,  TYPE_RISCV_CPU_RV64I,  RVA22S64),

From 0edc2465ba76c0d2bbeb475b6d2491c92dccd27b Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Thu, 6 Feb 2025 14:59:05 +0100
Subject: [PATCH 1041/2760] target/riscv: convert dynamic CPU models to
 RISCVCPUDef

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/riscv/cpu.c | 113 +++++++++++++--------------------------------
 1 file changed, 31 insertions(+), 82 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 8b82a1b7b3..2b26f23bd0 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -485,38 +485,7 @@ static void set_satp_mode_default_map(RISCVCPU *cpu)
 }
 #endif
 
-static void riscv_max_cpu_init(Object *obj)
-{
-    RISCVCPU *cpu = RISCV_CPU(obj);
-    CPURISCVState *env = &cpu->env;
-
-    cpu->cfg.mmu = true;
-    cpu->cfg.pmp = true;
-
-    env->priv_ver = PRIV_VERSION_LATEST;
-#ifndef CONFIG_USER_ONLY
-    set_satp_mode_max_supported(RISCV_CPU(obj),
-        riscv_cpu_mxl(&RISCV_CPU(obj)->env) == MXL_RV32 ?
-        VM_1_10_SV32 : VM_1_10_SV57);
-#endif
-}
-
 #if defined(TARGET_RISCV64)
-static void rv64_base_cpu_init(Object *obj)
-{
-    RISCVCPU *cpu = RISCV_CPU(obj);
-    CPURISCVState *env = &cpu->env;
-
-    cpu->cfg.mmu = true;
-    cpu->cfg.pmp = true;
-
-    /* Set latest version of privileged specification */
-    env->priv_ver = PRIV_VERSION_LATEST;
-#ifndef CONFIG_USER_ONLY
-    set_satp_mode_max_supported(RISCV_CPU(obj), VM_1_10_SV57);
-#endif
-}
-
 static void rv64_sifive_u_cpu_init(Object *obj)
 {
     RISCVCPU *cpu = RISCV_CPU(obj);
@@ -717,41 +686,11 @@ static void rv64_xiangshan_nanhu_cpu_init(Object *obj)
 #endif
 }
 
-#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
-static void rv128_base_cpu_init(Object *obj)
-{
-    RISCVCPU *cpu = RISCV_CPU(obj);
-    CPURISCVState *env = &cpu->env;
-
-    cpu->cfg.mmu = true;
-    cpu->cfg.pmp = true;
-
-    /* Set latest version of privileged specification */
-    env->priv_ver = PRIV_VERSION_LATEST;
-    set_satp_mode_max_supported(RISCV_CPU(obj), VM_1_10_SV57);
-}
-#endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
-
 #endif /* !TARGET_RISCV64 */
 
 #if defined(TARGET_RISCV32) || \
     (defined(TARGET_RISCV64) && !defined(CONFIG_USER_ONLY))
 
-static void rv32_base_cpu_init(Object *obj)
-{
-    RISCVCPU *cpu = RISCV_CPU(obj);
-    CPURISCVState *env = &cpu->env;
-
-    cpu->cfg.mmu = true;
-    cpu->cfg.pmp = true;
-
-    /* Set latest version of privileged specification */
-    env->priv_ver = PRIV_VERSION_LATEST;
-#ifndef CONFIG_USER_ONLY
-    set_satp_mode_max_supported(RISCV_CPU(obj), VM_1_10_SV32);
-#endif
-}
-
 static void rv32_sifive_u_cpu_init(Object *obj)
 {
     RISCVCPU *cpu = RISCV_CPU(obj);
@@ -3166,19 +3105,6 @@ void riscv_isa_write_fdt(RISCVCPU *cpu, void *fdt, char *nodename)
 }
 #endif
 
-#define DEFINE_DYNAMIC_CPU(type_name, misa_mxl_max_, initfn) \
-    {                                                       \
-        .name = (type_name),                                \
-        .parent = TYPE_RISCV_DYNAMIC_CPU,                   \
-        .instance_init = (initfn),                          \
-        .class_data = &(const RISCVCPUDef) {                \
-             .misa_mxl_max = (misa_mxl_max_),               \
-             .priv_spec = RISCV_PROFILE_ATTR_UNUSED,        \
-             .vext_spec = RISCV_PROFILE_ATTR_UNUSED,        \
-             .cfg.max_satp_mode = -1,                       \
-        },                                                  \
-    }
-
 #define DEFINE_VENDOR_CPU(type_name, misa_mxl_max_, initfn) \
     {                                                       \
         .name = (type_name),                                \
@@ -3235,7 +3161,12 @@ static const TypeInfo riscv_cpu_type_infos[] = {
         .class_base_init = riscv_cpu_class_base_init,
     },
 
-    DEFINE_ABSTRACT_RISCV_CPU(TYPE_RISCV_DYNAMIC_CPU, TYPE_RISCV_CPU),
+    DEFINE_ABSTRACT_RISCV_CPU(TYPE_RISCV_DYNAMIC_CPU, TYPE_RISCV_CPU,
+        .cfg.mmu = true,
+        .cfg.pmp = true,
+        .priv_spec = PRIV_VERSION_LATEST,
+    ),
+
     DEFINE_ABSTRACT_RISCV_CPU(TYPE_RISCV_VENDOR_CPU, TYPE_RISCV_CPU),
     DEFINE_ABSTRACT_RISCV_CPU(TYPE_RISCV_BARE_CPU, TYPE_RISCV_CPU,
         /*
@@ -3263,15 +3194,23 @@ static const TypeInfo riscv_cpu_type_infos[] = {
 #endif
     ),
 
+    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_MAX, TYPE_RISCV_DYNAMIC_CPU,
 #if defined(TARGET_RISCV32)
-    DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_MAX,       MXL_RV32,  riscv_max_cpu_init),
+        .misa_mxl_max = MXL_RV32,
+        .cfg.max_satp_mode = VM_1_10_SV32,
 #elif defined(TARGET_RISCV64)
-    DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_MAX,       MXL_RV64,  riscv_max_cpu_init),
+        .misa_mxl_max = MXL_RV64,
+        .cfg.max_satp_mode = VM_1_10_SV57,
 #endif
+    ),
 
 #if defined(TARGET_RISCV32) || \
     (defined(TARGET_RISCV64) && !defined(CONFIG_USER_ONLY))
-    DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_BASE32,    MXL_RV32,  rv32_base_cpu_init),
+    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_BASE32, TYPE_RISCV_DYNAMIC_CPU,
+        .cfg.max_satp_mode = VM_1_10_SV32,
+        .misa_mxl_max = MXL_RV32,
+    ),
+
     DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_IBEX,       MXL_RV32,  rv32_ibex_cpu_init),
     DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_SIFIVE_E31, MXL_RV32,  rv32_sifive_e_cpu_init),
     DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_SIFIVE_E34, MXL_RV32,  rv32_imafcu_nommu_cpu_init),
@@ -3288,11 +3227,18 @@ static const TypeInfo riscv_cpu_type_infos[] = {
 #endif
 
 #if (defined(TARGET_RISCV64) && !defined(CONFIG_USER_ONLY))
-    DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_MAX32,     MXL_RV32,  riscv_max_cpu_init),
+    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_MAX32, TYPE_RISCV_DYNAMIC_CPU,
+        .cfg.max_satp_mode = VM_1_10_SV32,
+        .misa_mxl_max = MXL_RV32,
+    ),
 #endif
 
 #if defined(TARGET_RISCV64)
-    DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_BASE64,    MXL_RV64,  rv64_base_cpu_init),
+    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_BASE64, TYPE_RISCV_DYNAMIC_CPU,
+        .cfg.max_satp_mode = VM_1_10_SV57,
+        .misa_mxl_max = MXL_RV64,
+    ),
+
     DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_SIFIVE_E51, MXL_RV64,  rv64_sifive_e_cpu_init),
     DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_SIFIVE_U54, MXL_RV64,  rv64_sifive_u_cpu_init),
     DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_SHAKTI_C,   MXL_RV64,  rv64_sifive_u_cpu_init),
@@ -3302,8 +3248,11 @@ static const TypeInfo riscv_cpu_type_infos[] = {
     DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_XIANGSHAN_NANHU,
                                                  MXL_RV64, rv64_xiangshan_nanhu_cpu_init),
 #if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
-    DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_BASE128,   MXL_RV128, rv128_base_cpu_init),
-#endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
+    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_BASE128, TYPE_RISCV_DYNAMIC_CPU,
+        .cfg.max_satp_mode = VM_1_10_SV57,
+        .misa_mxl_max = MXL_RV128,
+    ),
+#endif /* CONFIG_TCG */
     DEFINE_RISCV_CPU(TYPE_RISCV_CPU_RV64I, TYPE_RISCV_BARE_CPU,
         .misa_mxl_max = MXL_RV64,
         .misa_ext = RVI

From e89d4931d0a15ff0481e9a6e7cbb9f7a28e91434 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Thu, 6 Feb 2025 15:32:52 +0100
Subject: [PATCH 1042/2760] target/riscv: convert SiFive E CPU models to
 RISCVCPUDef

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/riscv/cpu-qom.h |  1 +
 target/riscv/cpu.c     | 74 ++++++++++++------------------------------
 2 files changed, 21 insertions(+), 54 deletions(-)

diff --git a/target/riscv/cpu-qom.h b/target/riscv/cpu-qom.h
index 4cfdb74891..0f9be15e47 100644
--- a/target/riscv/cpu-qom.h
+++ b/target/riscv/cpu-qom.h
@@ -44,6 +44,7 @@
 #define TYPE_RISCV_CPU_RVA23S64         RISCV_CPU_TYPE_NAME("rva23s64")
 #define TYPE_RISCV_CPU_IBEX             RISCV_CPU_TYPE_NAME("lowrisc-ibex")
 #define TYPE_RISCV_CPU_SHAKTI_C         RISCV_CPU_TYPE_NAME("shakti-c")
+#define TYPE_RISCV_CPU_SIFIVE_E         RISCV_CPU_TYPE_NAME("sifive-e")
 #define TYPE_RISCV_CPU_SIFIVE_E31       RISCV_CPU_TYPE_NAME("sifive-e31")
 #define TYPE_RISCV_CPU_SIFIVE_E34       RISCV_CPU_TYPE_NAME("sifive-e34")
 #define TYPE_RISCV_CPU_SIFIVE_E51       RISCV_CPU_TYPE_NAME("sifive-e51")
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 2b26f23bd0..17ad8b2ca1 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -503,23 +503,6 @@ static void rv64_sifive_u_cpu_init(Object *obj)
     cpu->cfg.pmp = true;
 }
 
-static void rv64_sifive_e_cpu_init(Object *obj)
-{
-    CPURISCVState *env = &RISCV_CPU(obj)->env;
-    RISCVCPU *cpu = RISCV_CPU(obj);
-
-    riscv_cpu_set_misa_ext(env, RVI | RVM | RVA | RVC | RVU);
-    env->priv_ver = PRIV_VERSION_1_10_0;
-#ifndef CONFIG_USER_ONLY
-    set_satp_mode_max_supported(cpu, VM_1_10_MBARE);
-#endif
-
-    /* inherited from parent obj via riscv_cpu_init() */
-    cpu->cfg.ext_zifencei = true;
-    cpu->cfg.ext_zicsr = true;
-    cpu->cfg.pmp = true;
-}
-
 static void rv64_thead_c906_cpu_init(Object *obj)
 {
     CPURISCVState *env = &RISCV_CPU(obj)->env;
@@ -708,23 +691,6 @@ static void rv32_sifive_u_cpu_init(Object *obj)
     cpu->cfg.pmp = true;
 }
 
-static void rv32_sifive_e_cpu_init(Object *obj)
-{
-    CPURISCVState *env = &RISCV_CPU(obj)->env;
-    RISCVCPU *cpu = RISCV_CPU(obj);
-
-    riscv_cpu_set_misa_ext(env, RVI | RVM | RVA | RVC | RVU);
-    env->priv_ver = PRIV_VERSION_1_10_0;
-#ifndef CONFIG_USER_ONLY
-    set_satp_mode_max_supported(cpu, VM_1_10_MBARE);
-#endif
-
-    /* inherited from parent obj via riscv_cpu_init() */
-    cpu->cfg.ext_zifencei = true;
-    cpu->cfg.ext_zicsr = true;
-    cpu->cfg.pmp = true;
-}
-
 static void rv32_ibex_cpu_init(Object *obj)
 {
     CPURISCVState *env = &RISCV_CPU(obj)->env;
@@ -746,23 +712,6 @@ static void rv32_ibex_cpu_init(Object *obj)
     cpu->cfg.ext_zbc = true;
     cpu->cfg.ext_zbs = true;
 }
-
-static void rv32_imafcu_nommu_cpu_init(Object *obj)
-{
-    CPURISCVState *env = &RISCV_CPU(obj)->env;
-    RISCVCPU *cpu = RISCV_CPU(obj);
-
-    riscv_cpu_set_misa_ext(env, RVI | RVM | RVA | RVF | RVC | RVU);
-    env->priv_ver = PRIV_VERSION_1_10_0;
-#ifndef CONFIG_USER_ONLY
-    set_satp_mode_max_supported(cpu, VM_1_10_MBARE);
-#endif
-
-    /* inherited from parent obj via riscv_cpu_init() */
-    cpu->cfg.ext_zifencei = true;
-    cpu->cfg.ext_zicsr = true;
-    cpu->cfg.pmp = true;
-}
 #endif
 
 static ObjectClass *riscv_cpu_class_by_name(const char *cpu_model)
@@ -3204,6 +3153,15 @@ static const TypeInfo riscv_cpu_type_infos[] = {
 #endif
     ),
 
+    DEFINE_ABSTRACT_RISCV_CPU(TYPE_RISCV_CPU_SIFIVE_E, TYPE_RISCV_VENDOR_CPU,
+        .misa_ext = RVI | RVM | RVA | RVC | RVU,
+        .priv_spec = PRIV_VERSION_1_10_0,
+        .cfg.max_satp_mode = VM_1_10_MBARE,
+        .cfg.ext_zifencei = true,
+        .cfg.ext_zicsr = true,
+        .cfg.pmp = true
+    ),
+
 #if defined(TARGET_RISCV32) || \
     (defined(TARGET_RISCV64) && !defined(CONFIG_USER_ONLY))
     DEFINE_RISCV_CPU(TYPE_RISCV_CPU_BASE32, TYPE_RISCV_DYNAMIC_CPU,
@@ -3212,8 +3170,14 @@ static const TypeInfo riscv_cpu_type_infos[] = {
     ),
 
     DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_IBEX,       MXL_RV32,  rv32_ibex_cpu_init),
-    DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_SIFIVE_E31, MXL_RV32,  rv32_sifive_e_cpu_init),
-    DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_SIFIVE_E34, MXL_RV32,  rv32_imafcu_nommu_cpu_init),
+    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_SIFIVE_E31, TYPE_RISCV_CPU_SIFIVE_E,
+        .misa_mxl_max = MXL_RV32
+    ),
+    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_SIFIVE_E34, TYPE_RISCV_CPU_SIFIVE_E,
+        .misa_mxl_max = MXL_RV32,
+        .misa_ext = RVF,  /* IMAFCU */
+    ),
+
     DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_SIFIVE_U34, MXL_RV32,  rv32_sifive_u_cpu_init),
 
     DEFINE_RISCV_CPU(TYPE_RISCV_CPU_RV32I, TYPE_RISCV_BARE_CPU,
@@ -3239,7 +3203,9 @@ static const TypeInfo riscv_cpu_type_infos[] = {
         .misa_mxl_max = MXL_RV64,
     ),
 
-    DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_SIFIVE_E51, MXL_RV64,  rv64_sifive_e_cpu_init),
+    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_SIFIVE_E51, TYPE_RISCV_CPU_SIFIVE_E,
+        .misa_mxl_max = MXL_RV64
+    ),
     DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_SIFIVE_U54, MXL_RV64,  rv64_sifive_u_cpu_init),
     DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_SHAKTI_C,   MXL_RV64,  rv64_sifive_u_cpu_init),
     DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_THEAD_C906, MXL_RV64,  rv64_thead_c906_cpu_init),

From 5106b8ee9ac78505f872a956c931c1f965ad073e Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Thu, 6 Feb 2025 17:27:16 +0100
Subject: [PATCH 1043/2760] target/riscv: convert ibex CPU models to
 RISCVCPUDef

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/riscv/cpu.c | 39 ++++++++++++++++-----------------------
 1 file changed, 16 insertions(+), 23 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 17ad8b2ca1..689c33916e 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -690,28 +690,6 @@ static void rv32_sifive_u_cpu_init(Object *obj)
     cpu->cfg.mmu = true;
     cpu->cfg.pmp = true;
 }
-
-static void rv32_ibex_cpu_init(Object *obj)
-{
-    CPURISCVState *env = &RISCV_CPU(obj)->env;
-    RISCVCPU *cpu = RISCV_CPU(obj);
-
-    riscv_cpu_set_misa_ext(env, RVI | RVM | RVC | RVU);
-    env->priv_ver = PRIV_VERSION_1_12_0;
-#ifndef CONFIG_USER_ONLY
-    set_satp_mode_max_supported(cpu, VM_1_10_MBARE);
-#endif
-    /* inherited from parent obj via riscv_cpu_init() */
-    cpu->cfg.ext_zifencei = true;
-    cpu->cfg.ext_zicsr = true;
-    cpu->cfg.pmp = true;
-    cpu->cfg.ext_smepmp = true;
-
-    cpu->cfg.ext_zba = true;
-    cpu->cfg.ext_zbb = true;
-    cpu->cfg.ext_zbc = true;
-    cpu->cfg.ext_zbs = true;
-}
 #endif
 
 static ObjectClass *riscv_cpu_class_by_name(const char *cpu_model)
@@ -3169,7 +3147,22 @@ static const TypeInfo riscv_cpu_type_infos[] = {
         .misa_mxl_max = MXL_RV32,
     ),
 
-    DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_IBEX,       MXL_RV32,  rv32_ibex_cpu_init),
+    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_IBEX, TYPE_RISCV_VENDOR_CPU,
+        .misa_mxl_max = MXL_RV32,
+        .misa_ext = RVI | RVM | RVC | RVU,
+        .priv_spec = PRIV_VERSION_1_12_0,
+        .cfg.max_satp_mode = VM_1_10_MBARE,
+        .cfg.ext_zifencei = true,
+        .cfg.ext_zicsr = true,
+        .cfg.pmp = true,
+        .cfg.ext_smepmp = true,
+
+        .cfg.ext_zba = true,
+        .cfg.ext_zbb = true,
+        .cfg.ext_zbc = true,
+        .cfg.ext_zbs = true
+    ),
+
     DEFINE_RISCV_CPU(TYPE_RISCV_CPU_SIFIVE_E31, TYPE_RISCV_CPU_SIFIVE_E,
         .misa_mxl_max = MXL_RV32
     ),

From 5a62948c91a910de4f9c7332cf8803152c099eac Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Tue, 18 Feb 2025 13:05:25 +0100
Subject: [PATCH 1044/2760] target/riscv: convert SiFive U models to
 RISCVCPUDef

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/riscv/cpu-qom.h |  1 +
 target/riscv/cpu.c     | 79 +++++++++++++++++++-----------------------
 2 files changed, 37 insertions(+), 43 deletions(-)

diff --git a/target/riscv/cpu-qom.h b/target/riscv/cpu-qom.h
index 0f9be15e47..1ee05eb393 100644
--- a/target/riscv/cpu-qom.h
+++ b/target/riscv/cpu-qom.h
@@ -48,6 +48,7 @@
 #define TYPE_RISCV_CPU_SIFIVE_E31       RISCV_CPU_TYPE_NAME("sifive-e31")
 #define TYPE_RISCV_CPU_SIFIVE_E34       RISCV_CPU_TYPE_NAME("sifive-e34")
 #define TYPE_RISCV_CPU_SIFIVE_E51       RISCV_CPU_TYPE_NAME("sifive-e51")
+#define TYPE_RISCV_CPU_SIFIVE_U         RISCV_CPU_TYPE_NAME("sifive-u")
 #define TYPE_RISCV_CPU_SIFIVE_U34       RISCV_CPU_TYPE_NAME("sifive-u34")
 #define TYPE_RISCV_CPU_SIFIVE_U54       RISCV_CPU_TYPE_NAME("sifive-u54")
 #define TYPE_RISCV_CPU_THEAD_C906       RISCV_CPU_TYPE_NAME("thead-c906")
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 689c33916e..01b028653a 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -440,8 +440,8 @@ const char *satp_mode_str(uint8_t satp_mode, bool is_32_bit)
     g_assert_not_reached();
 }
 
-static void set_satp_mode_max_supported(RISCVCPU *cpu,
-                                        int satp_mode)
+static void __attribute__((unused))
+set_satp_mode_max_supported(RISCVCPU *cpu, int satp_mode)
 {
     bool rv32 = riscv_cpu_mxl(&cpu->env) == MXL_RV32;
     const bool *valid_vm = rv32 ? valid_vm_1_10_32 : valid_vm_1_10_64;
@@ -486,23 +486,6 @@ static void set_satp_mode_default_map(RISCVCPU *cpu)
 #endif
 
 #if defined(TARGET_RISCV64)
-static void rv64_sifive_u_cpu_init(Object *obj)
-{
-    RISCVCPU *cpu = RISCV_CPU(obj);
-    CPURISCVState *env = &cpu->env;
-    riscv_cpu_set_misa_ext(env, RVI | RVM | RVA | RVF | RVD | RVC | RVS | RVU);
-    env->priv_ver = PRIV_VERSION_1_10_0;
-#ifndef CONFIG_USER_ONLY
-    set_satp_mode_max_supported(RISCV_CPU(obj), VM_1_10_SV39);
-#endif
-
-    /* inherited from parent obj via riscv_cpu_init() */
-    cpu->cfg.ext_zifencei = true;
-    cpu->cfg.ext_zicsr = true;
-    cpu->cfg.mmu = true;
-    cpu->cfg.pmp = true;
-}
-
 static void rv64_thead_c906_cpu_init(Object *obj)
 {
     CPURISCVState *env = &RISCV_CPU(obj)->env;
@@ -671,27 +654,6 @@ static void rv64_xiangshan_nanhu_cpu_init(Object *obj)
 
 #endif /* !TARGET_RISCV64 */
 
-#if defined(TARGET_RISCV32) || \
-    (defined(TARGET_RISCV64) && !defined(CONFIG_USER_ONLY))
-
-static void rv32_sifive_u_cpu_init(Object *obj)
-{
-    RISCVCPU *cpu = RISCV_CPU(obj);
-    CPURISCVState *env = &cpu->env;
-    riscv_cpu_set_misa_ext(env, RVI | RVM | RVA | RVF | RVD | RVC | RVS | RVU);
-    env->priv_ver = PRIV_VERSION_1_10_0;
-#ifndef CONFIG_USER_ONLY
-    set_satp_mode_max_supported(RISCV_CPU(obj), VM_1_10_SV32);
-#endif
-
-    /* inherited from parent obj via riscv_cpu_init() */
-    cpu->cfg.ext_zifencei = true;
-    cpu->cfg.ext_zicsr = true;
-    cpu->cfg.mmu = true;
-    cpu->cfg.pmp = true;
-}
-#endif
-
 static ObjectClass *riscv_cpu_class_by_name(const char *cpu_model)
 {
     ObjectClass *oc;
@@ -2921,6 +2883,17 @@ static void riscv_cpu_class_base_init(ObjectClass *c, const void *data)
         if (def->misa_mxl_max) {
             assert(def->misa_mxl_max <= MXL_RV128);
             mcc->def->misa_mxl_max = def->misa_mxl_max;
+
+#ifndef CONFIG_USER_ONLY
+            /*
+             * Hack to simplify CPU class hierarchies that include both 32- and
+             * 64-bit models: reduce SV39/48/57/64 to SV32 for 32-bit models.
+             */
+            if (mcc->def->misa_mxl_max == MXL_RV32 &&
+                !valid_vm_1_10_32[mcc->def->cfg.max_satp_mode]) {
+                mcc->def->cfg.max_satp_mode = VM_1_10_SV32;
+            }
+#endif
         }
         if (def->priv_spec != RISCV_PROFILE_ATTR_UNUSED) {
             assert(def->priv_spec <= PRIV_VERSION_LATEST);
@@ -3140,6 +3113,17 @@ static const TypeInfo riscv_cpu_type_infos[] = {
         .cfg.pmp = true
     ),
 
+    DEFINE_ABSTRACT_RISCV_CPU(TYPE_RISCV_CPU_SIFIVE_U, TYPE_RISCV_VENDOR_CPU,
+        .misa_ext = RVI | RVM | RVA | RVF | RVD | RVC | RVS | RVU,
+        .priv_spec = PRIV_VERSION_1_10_0,
+
+        .cfg.max_satp_mode = VM_1_10_SV39,
+        .cfg.ext_zifencei = true,
+        .cfg.ext_zicsr = true,
+        .cfg.mmu = true,
+        .cfg.pmp = true
+    ),
+
 #if defined(TARGET_RISCV32) || \
     (defined(TARGET_RISCV64) && !defined(CONFIG_USER_ONLY))
     DEFINE_RISCV_CPU(TYPE_RISCV_CPU_BASE32, TYPE_RISCV_DYNAMIC_CPU,
@@ -3171,7 +3155,9 @@ static const TypeInfo riscv_cpu_type_infos[] = {
         .misa_ext = RVF,  /* IMAFCU */
     ),
 
-    DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_SIFIVE_U34, MXL_RV32,  rv32_sifive_u_cpu_init),
+    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_SIFIVE_U34, TYPE_RISCV_CPU_SIFIVE_U,
+        .misa_mxl_max = MXL_RV32,
+    ),
 
     DEFINE_RISCV_CPU(TYPE_RISCV_CPU_RV32I, TYPE_RISCV_BARE_CPU,
         .misa_mxl_max = MXL_RV32,
@@ -3199,8 +3185,15 @@ static const TypeInfo riscv_cpu_type_infos[] = {
     DEFINE_RISCV_CPU(TYPE_RISCV_CPU_SIFIVE_E51, TYPE_RISCV_CPU_SIFIVE_E,
         .misa_mxl_max = MXL_RV64
     ),
-    DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_SIFIVE_U54, MXL_RV64,  rv64_sifive_u_cpu_init),
-    DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_SHAKTI_C,   MXL_RV64,  rv64_sifive_u_cpu_init),
+
+    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_SIFIVE_U54, TYPE_RISCV_CPU_SIFIVE_U,
+        .misa_mxl_max = MXL_RV64,
+    ),
+
+    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_SHAKTI_C, TYPE_RISCV_CPU_SIFIVE_U,
+        .misa_mxl_max = MXL_RV64,
+    ),
+
     DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_THEAD_C906, MXL_RV64,  rv64_thead_c906_cpu_init),
     DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_TT_ASCALON, MXL_RV64,  rv64_tt_ascalon_cpu_init),
     DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_VEYRON_V1,  MXL_RV64,  rv64_veyron_v1_cpu_init),

From 1d84c2401c48617b8695d292602e2e777e0d1178 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Thu, 6 Feb 2025 17:39:49 +0100
Subject: [PATCH 1045/2760] target/riscv: th: make CSR insertion test a bit
 more intuitive

In preparation for generalizing the custom CSR functionality,
make the test return bool instead of int.  Make the insertion_test
optional, too.

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/riscv/th_csr.c | 13 ++++---------
 1 file changed, 4 insertions(+), 9 deletions(-)

diff --git a/target/riscv/th_csr.c b/target/riscv/th_csr.c
index 6c970d4e81..969a9fe3c8 100644
--- a/target/riscv/th_csr.c
+++ b/target/riscv/th_csr.c
@@ -29,7 +29,7 @@
 
 typedef struct {
     int csrno;
-    int (*insertion_test)(RISCVCPU *cpu);
+    bool (*insertion_test)(RISCVCPU *cpu);
     riscv_csr_operations csr_ops;
 } riscv_csr;
 
@@ -42,13 +42,9 @@ static RISCVException smode(CPURISCVState *env, int csrno)
     return RISCV_EXCP_ILLEGAL_INST;
 }
 
-static int test_thead_mvendorid(RISCVCPU *cpu)
+static bool test_thead_mvendorid(RISCVCPU *cpu)
 {
-    if (cpu->cfg.mvendorid != THEAD_VENDOR_ID) {
-        return -1;
-    }
-
-    return 0;
+    return cpu->cfg.mvendorid == THEAD_VENDOR_ID;
 }
 
 static RISCVException read_th_sxstatus(CPURISCVState *env, int csrno,
@@ -66,13 +62,12 @@ static riscv_csr th_csr_list[] = {
         .csr_ops = { "th.sxstatus", smode, read_th_sxstatus }
     }
 };
-
 void th_register_custom_csrs(RISCVCPU *cpu)
 {
     for (size_t i = 0; i < ARRAY_SIZE(th_csr_list); i++) {
         int csrno = th_csr_list[i].csrno;
         riscv_csr_operations *csr_ops = &th_csr_list[i].csr_ops;
-        if (!th_csr_list[i].insertion_test(cpu)) {
+        if (!th_csr_list[i].insertion_test || th_csr_list[i].insertion_test(cpu)) {
             riscv_set_csr_ops(csrno, csr_ops);
         }
     }

From 1016b0364f981e7aa9304866d7d756813e8dc6c2 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Thu, 27 Feb 2025 15:09:49 +0100
Subject: [PATCH 1046/2760] target/riscv: generalize custom CSR functionality

While at it, constify it so that the RISCVCSR array in RISCVCPUDef
can also be const.

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/riscv/cpu.c    | 25 ++++++++++++++++++++++++-
 target/riscv/cpu.h    | 15 ++++++++++++---
 target/riscv/csr.c    |  2 +-
 target/riscv/th_csr.c | 21 +++------------------
 4 files changed, 40 insertions(+), 23 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 01b028653a..12f4bc4151 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -485,6 +485,19 @@ static void set_satp_mode_default_map(RISCVCPU *cpu)
 }
 #endif
 
+#ifndef CONFIG_USER_ONLY
+static void riscv_register_custom_csrs(RISCVCPU *cpu, const RISCVCSR *csr_list)
+{
+    for (size_t i = 0; csr_list[i].csr_ops.name; i++) {
+        int csrno = csr_list[i].csrno;
+        const riscv_csr_operations *csr_ops = &csr_list[i].csr_ops;
+        if (!csr_list[i].insertion_test || csr_list[i].insertion_test(cpu)) {
+            riscv_set_csr_ops(csrno, csr_ops);
+        }
+    }
+}
+#endif
+
 #if defined(TARGET_RISCV64)
 static void rv64_thead_c906_cpu_init(Object *obj)
 {
@@ -511,7 +524,7 @@ static void rv64_thead_c906_cpu_init(Object *obj)
     cpu->cfg.mvendorid = THEAD_VENDOR_ID;
 #ifndef CONFIG_USER_ONLY
     set_satp_mode_max_supported(cpu, VM_1_10_SV39);
-    th_register_custom_csrs(cpu);
+    riscv_register_custom_csrs(cpu, th_csr_list);
 #endif
 
     /* inherited from parent obj via riscv_cpu_init() */
@@ -1304,6 +1317,11 @@ static void riscv_cpu_init(Object *obj)
     if (mcc->def->vext_spec != RISCV_PROFILE_ATTR_UNUSED) {
         cpu->env.vext_ver = mcc->def->vext_spec;
     }
+#ifndef CONFIG_USER_ONLY
+    if (mcc->def->custom_csrs) {
+        riscv_register_custom_csrs(cpu, mcc->def->custom_csrs);
+    }
+#endif
 }
 
 typedef struct misa_ext_info {
@@ -2906,6 +2924,11 @@ static void riscv_cpu_class_base_init(ObjectClass *c, const void *data)
         mcc->def->misa_ext |= def->misa_ext;
 
         riscv_cpu_cfg_merge(&mcc->def->cfg, &def->cfg);
+
+        if (def->custom_csrs) {
+            assert(!mcc->def->custom_csrs);
+            mcc->def->custom_csrs = def->custom_csrs;
+        }
     }
 
     if (!object_class_is_abstract(c)) {
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index ed88adef45..229ade9ed9 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -538,6 +538,8 @@ struct ArchCPU {
     const GPtrArray *decoders;
 };
 
+typedef struct RISCVCSR RISCVCSR;
+
 typedef struct RISCVCPUDef {
     RISCVMXL misa_mxl_max;  /* max mxl for this cpu */
     RISCVCPUProfile *profile;
@@ -546,6 +548,7 @@ typedef struct RISCVCPUDef {
     int32_t vext_spec;
     RISCVCPUConfig cfg;
     bool bare;
+    const RISCVCSR *custom_csrs;
 } RISCVCPUDef;
 
 /**
@@ -893,6 +896,12 @@ typedef struct {
     uint32_t min_priv_ver;
 } riscv_csr_operations;
 
+struct RISCVCSR {
+    int csrno;
+    bool (*insertion_test)(RISCVCPU *cpu);
+    riscv_csr_operations csr_ops;
+};
+
 /* CSR function table constants */
 enum {
     CSR_TABLE_SIZE = 0x1000
@@ -947,7 +956,7 @@ extern riscv_csr_operations csr_ops[CSR_TABLE_SIZE];
 extern const bool valid_vm_1_10_32[], valid_vm_1_10_64[];
 
 void riscv_get_csr_ops(int csrno, riscv_csr_operations *ops);
-void riscv_set_csr_ops(int csrno, riscv_csr_operations *ops);
+void riscv_set_csr_ops(int csrno, const riscv_csr_operations *ops);
 
 void riscv_cpu_register_gdb_regs_for_features(CPUState *cs);
 
@@ -956,8 +965,8 @@ target_ulong riscv_new_csr_seed(target_ulong new_value,
 
 const char *satp_mode_str(uint8_t satp_mode, bool is_32_bit);
 
-/* Implemented in th_csr.c */
-void th_register_custom_csrs(RISCVCPU *cpu);
+/* In th_csr.c */
+extern const RISCVCSR th_csr_list[];
 
 const char *priv_spec_to_str(int priv_version);
 #endif /* RISCV_CPU_H */
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index 9843fd2191..fb14972169 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -40,7 +40,7 @@ void riscv_get_csr_ops(int csrno, riscv_csr_operations *ops)
     *ops = csr_ops[csrno & (CSR_TABLE_SIZE - 1)];
 }
 
-void riscv_set_csr_ops(int csrno, riscv_csr_operations *ops)
+void riscv_set_csr_ops(int csrno, const riscv_csr_operations *ops)
 {
     csr_ops[csrno & (CSR_TABLE_SIZE - 1)] = *ops;
 }
diff --git a/target/riscv/th_csr.c b/target/riscv/th_csr.c
index 969a9fe3c8..49eb7bbab5 100644
--- a/target/riscv/th_csr.c
+++ b/target/riscv/th_csr.c
@@ -27,12 +27,6 @@
 #define TH_SXSTATUS_MAEE        BIT(21)
 #define TH_SXSTATUS_THEADISAEE  BIT(22)
 
-typedef struct {
-    int csrno;
-    bool (*insertion_test)(RISCVCPU *cpu);
-    riscv_csr_operations csr_ops;
-} riscv_csr;
-
 static RISCVException smode(CPURISCVState *env, int csrno)
 {
     if (riscv_has_ext(env, RVS)) {
@@ -55,20 +49,11 @@ static RISCVException read_th_sxstatus(CPURISCVState *env, int csrno,
     return RISCV_EXCP_NONE;
 }
 
-static riscv_csr th_csr_list[] = {
+const RISCVCSR th_csr_list[] = {
     {
         .csrno = CSR_TH_SXSTATUS,
         .insertion_test = test_thead_mvendorid,
         .csr_ops = { "th.sxstatus", smode, read_th_sxstatus }
-    }
+    },
+    { }
 };
-void th_register_custom_csrs(RISCVCPU *cpu)
-{
-    for (size_t i = 0; i < ARRAY_SIZE(th_csr_list); i++) {
-        int csrno = th_csr_list[i].csrno;
-        riscv_csr_operations *csr_ops = &th_csr_list[i].csr_ops;
-        if (!th_csr_list[i].insertion_test || th_csr_list[i].insertion_test(cpu)) {
-            riscv_set_csr_ops(csrno, csr_ops);
-        }
-    }
-}

From 5f687d77ff93ae3dd2fb48600e4e6ae32eb7350e Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Thu, 6 Feb 2025 15:48:47 +0100
Subject: [PATCH 1047/2760] target/riscv: convert THead C906 to RISCVCPUDef

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/riscv/cpu.c | 61 +++++++++++++++++++++-------------------------
 1 file changed, 28 insertions(+), 33 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 12f4bc4151..5d2ccf647d 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -499,38 +499,6 @@ static void riscv_register_custom_csrs(RISCVCPU *cpu, const RISCVCSR *csr_list)
 #endif
 
 #if defined(TARGET_RISCV64)
-static void rv64_thead_c906_cpu_init(Object *obj)
-{
-    CPURISCVState *env = &RISCV_CPU(obj)->env;
-    RISCVCPU *cpu = RISCV_CPU(obj);
-
-    riscv_cpu_set_misa_ext(env, RVG | RVC | RVS | RVU);
-    env->priv_ver = PRIV_VERSION_1_11_0;
-
-    cpu->cfg.ext_zfa = true;
-    cpu->cfg.ext_zfh = true;
-    cpu->cfg.mmu = true;
-    cpu->cfg.ext_xtheadba = true;
-    cpu->cfg.ext_xtheadbb = true;
-    cpu->cfg.ext_xtheadbs = true;
-    cpu->cfg.ext_xtheadcmo = true;
-    cpu->cfg.ext_xtheadcondmov = true;
-    cpu->cfg.ext_xtheadfmemidx = true;
-    cpu->cfg.ext_xtheadmac = true;
-    cpu->cfg.ext_xtheadmemidx = true;
-    cpu->cfg.ext_xtheadmempair = true;
-    cpu->cfg.ext_xtheadsync = true;
-
-    cpu->cfg.mvendorid = THEAD_VENDOR_ID;
-#ifndef CONFIG_USER_ONLY
-    set_satp_mode_max_supported(cpu, VM_1_10_SV39);
-    riscv_register_custom_csrs(cpu, th_csr_list);
-#endif
-
-    /* inherited from parent obj via riscv_cpu_init() */
-    cpu->cfg.pmp = true;
-}
-
 static void rv64_veyron_v1_cpu_init(Object *obj)
 {
     CPURISCVState *env = &RISCV_CPU(obj)->env;
@@ -3217,7 +3185,34 @@ static const TypeInfo riscv_cpu_type_infos[] = {
         .misa_mxl_max = MXL_RV64,
     ),
 
-    DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_THEAD_C906, MXL_RV64,  rv64_thead_c906_cpu_init),
+    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_THEAD_C906, TYPE_RISCV_VENDOR_CPU,
+        .misa_mxl_max = MXL_RV64,
+        .misa_ext = RVG | RVC | RVS | RVU,
+        .priv_spec = PRIV_VERSION_1_11_0,
+
+        .cfg.ext_zfa = true,
+        .cfg.ext_zfh = true,
+        .cfg.mmu = true,
+        .cfg.ext_xtheadba = true,
+        .cfg.ext_xtheadbb = true,
+        .cfg.ext_xtheadbs = true,
+        .cfg.ext_xtheadcmo = true,
+        .cfg.ext_xtheadcondmov = true,
+        .cfg.ext_xtheadfmemidx = true,
+        .cfg.ext_xtheadmac = true,
+        .cfg.ext_xtheadmemidx = true,
+        .cfg.ext_xtheadmempair = true,
+        .cfg.ext_xtheadsync = true,
+        .cfg.pmp = true,
+
+        .cfg.mvendorid = THEAD_VENDOR_ID,
+
+        .cfg.max_satp_mode = VM_1_10_SV39,
+#ifndef CONFIG_USER_ONLY
+        .custom_csrs = th_csr_list,
+#endif
+    ),
+
     DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_TT_ASCALON, MXL_RV64,  rv64_tt_ascalon_cpu_init),
     DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_VEYRON_V1,  MXL_RV64,  rv64_veyron_v1_cpu_init),
     DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_XIANGSHAN_NANHU,

From 09ef7d97454a64e00d8dc9fd3a188d6c06003cc1 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Thu, 6 Feb 2025 15:53:28 +0100
Subject: [PATCH 1048/2760] target/riscv: convert TT Ascalon to RISCVCPUDef

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/riscv/cpu.c | 127 +++++++++++++++++++++------------------------
 1 file changed, 60 insertions(+), 67 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 5d2ccf647d..48939adaaf 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -539,72 +539,6 @@ static void rv64_veyron_v1_cpu_init(Object *obj)
 #endif
 }
 
-/* Tenstorrent Ascalon */
-static void rv64_tt_ascalon_cpu_init(Object *obj)
-{
-    CPURISCVState *env = &RISCV_CPU(obj)->env;
-    RISCVCPU *cpu = RISCV_CPU(obj);
-
-    riscv_cpu_set_misa_ext(env, RVG | RVC | RVS | RVU | RVH | RVV);
-    env->priv_ver = PRIV_VERSION_1_13_0;
-
-    /* Enable ISA extensions */
-    cpu->cfg.mmu = true;
-    cpu->cfg.vlenb = 256 >> 3;
-    cpu->cfg.elen = 64;
-    cpu->env.vext_ver = VEXT_VERSION_1_00_0;
-    cpu->cfg.rvv_ma_all_1s = true;
-    cpu->cfg.rvv_ta_all_1s = true;
-    cpu->cfg.misa_w = true;
-    cpu->cfg.pmp = true;
-    cpu->cfg.cbom_blocksize = 64;
-    cpu->cfg.cbop_blocksize = 64;
-    cpu->cfg.cboz_blocksize = 64;
-    cpu->cfg.ext_zic64b = true;
-    cpu->cfg.ext_zicbom = true;
-    cpu->cfg.ext_zicbop = true;
-    cpu->cfg.ext_zicboz = true;
-    cpu->cfg.ext_zicntr = true;
-    cpu->cfg.ext_zicond = true;
-    cpu->cfg.ext_zicsr = true;
-    cpu->cfg.ext_zifencei = true;
-    cpu->cfg.ext_zihintntl = true;
-    cpu->cfg.ext_zihintpause = true;
-    cpu->cfg.ext_zihpm = true;
-    cpu->cfg.ext_zimop = true;
-    cpu->cfg.ext_zawrs = true;
-    cpu->cfg.ext_zfa = true;
-    cpu->cfg.ext_zfbfmin = true;
-    cpu->cfg.ext_zfh = true;
-    cpu->cfg.ext_zfhmin = true;
-    cpu->cfg.ext_zcb = true;
-    cpu->cfg.ext_zcmop = true;
-    cpu->cfg.ext_zba = true;
-    cpu->cfg.ext_zbb = true;
-    cpu->cfg.ext_zbs = true;
-    cpu->cfg.ext_zkt = true;
-    cpu->cfg.ext_zvbb = true;
-    cpu->cfg.ext_zvbc = true;
-    cpu->cfg.ext_zvfbfmin = true;
-    cpu->cfg.ext_zvfbfwma = true;
-    cpu->cfg.ext_zvfh = true;
-    cpu->cfg.ext_zvfhmin = true;
-    cpu->cfg.ext_zvkng = true;
-    cpu->cfg.ext_smaia = true;
-    cpu->cfg.ext_smstateen = true;
-    cpu->cfg.ext_ssaia = true;
-    cpu->cfg.ext_sscofpmf = true;
-    cpu->cfg.ext_sstc = true;
-    cpu->cfg.ext_svade = true;
-    cpu->cfg.ext_svinval = true;
-    cpu->cfg.ext_svnapot = true;
-    cpu->cfg.ext_svpbmt = true;
-
-#ifndef CONFIG_USER_ONLY
-    set_satp_mode_max_supported(cpu, VM_1_10_SV57);
-#endif
-}
-
 static void rv64_xiangshan_nanhu_cpu_init(Object *obj)
 {
     CPURISCVState *env = &RISCV_CPU(obj)->env;
@@ -3213,7 +3147,66 @@ static const TypeInfo riscv_cpu_type_infos[] = {
 #endif
     ),
 
-    DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_TT_ASCALON, MXL_RV64,  rv64_tt_ascalon_cpu_init),
+    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_TT_ASCALON, TYPE_RISCV_VENDOR_CPU,
+        .misa_mxl_max = MXL_RV64,
+        .misa_ext = RVG | RVC | RVS | RVU | RVH | RVV,
+        .priv_spec = PRIV_VERSION_1_13_0,
+        .vext_spec = VEXT_VERSION_1_00_0,
+
+        /* ISA extensions */
+        .cfg.mmu = true,
+        .cfg.vlenb = 256 >> 3,
+        .cfg.elen = 64,
+        .cfg.rvv_ma_all_1s = true,
+        .cfg.rvv_ta_all_1s = true,
+        .cfg.misa_w = true,
+        .cfg.pmp = true,
+        .cfg.cbom_blocksize = 64,
+        .cfg.cbop_blocksize = 64,
+        .cfg.cboz_blocksize = 64,
+        .cfg.ext_zic64b = true,
+        .cfg.ext_zicbom = true,
+        .cfg.ext_zicbop = true,
+        .cfg.ext_zicboz = true,
+        .cfg.ext_zicntr = true,
+        .cfg.ext_zicond = true,
+        .cfg.ext_zicsr = true,
+        .cfg.ext_zifencei = true,
+        .cfg.ext_zihintntl = true,
+        .cfg.ext_zihintpause = true,
+        .cfg.ext_zihpm = true,
+        .cfg.ext_zimop = true,
+        .cfg.ext_zawrs = true,
+        .cfg.ext_zfa = true,
+        .cfg.ext_zfbfmin = true,
+        .cfg.ext_zfh = true,
+        .cfg.ext_zfhmin = true,
+        .cfg.ext_zcb = true,
+        .cfg.ext_zcmop = true,
+        .cfg.ext_zba = true,
+        .cfg.ext_zbb = true,
+        .cfg.ext_zbs = true,
+        .cfg.ext_zkt = true,
+        .cfg.ext_zvbb = true,
+        .cfg.ext_zvbc = true,
+        .cfg.ext_zvfbfmin = true,
+        .cfg.ext_zvfbfwma = true,
+        .cfg.ext_zvfh = true,
+        .cfg.ext_zvfhmin = true,
+        .cfg.ext_zvkng = true,
+        .cfg.ext_smaia = true,
+        .cfg.ext_smstateen = true,
+        .cfg.ext_ssaia = true,
+        .cfg.ext_sscofpmf = true,
+        .cfg.ext_sstc = true,
+        .cfg.ext_svade = true,
+        .cfg.ext_svinval = true,
+        .cfg.ext_svnapot = true,
+        .cfg.ext_svpbmt = true,
+
+        .cfg.max_satp_mode = VM_1_10_SV57,
+    ),
+
     DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_VEYRON_V1,  MXL_RV64,  rv64_veyron_v1_cpu_init),
     DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_XIANGSHAN_NANHU,
                                                  MXL_RV64, rv64_xiangshan_nanhu_cpu_init),

From 0927f7d55cd5a214eb2ef9671ddd271a3fb2a15c Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Thu, 6 Feb 2025 15:53:28 +0100
Subject: [PATCH 1049/2760] target/riscv: convert Ventana V1 to RISCVCPUDef

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/riscv/cpu.c | 75 ++++++++++++++++++++++------------------------
 1 file changed, 35 insertions(+), 40 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 48939adaaf..000fcc6a1d 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -499,45 +499,6 @@ static void riscv_register_custom_csrs(RISCVCPU *cpu, const RISCVCSR *csr_list)
 #endif
 
 #if defined(TARGET_RISCV64)
-static void rv64_veyron_v1_cpu_init(Object *obj)
-{
-    CPURISCVState *env = &RISCV_CPU(obj)->env;
-    RISCVCPU *cpu = RISCV_CPU(obj);
-
-    riscv_cpu_set_misa_ext(env, RVG | RVC | RVS | RVU | RVH);
-    env->priv_ver = PRIV_VERSION_1_12_0;
-
-    /* Enable ISA extensions */
-    cpu->cfg.mmu = true;
-    cpu->cfg.ext_zifencei = true;
-    cpu->cfg.ext_zicsr = true;
-    cpu->cfg.pmp = true;
-    cpu->cfg.ext_zicbom = true;
-    cpu->cfg.cbom_blocksize = 64;
-    cpu->cfg.cboz_blocksize = 64;
-    cpu->cfg.ext_zicboz = true;
-    cpu->cfg.ext_smaia = true;
-    cpu->cfg.ext_ssaia = true;
-    cpu->cfg.ext_sscofpmf = true;
-    cpu->cfg.ext_sstc = true;
-    cpu->cfg.ext_svinval = true;
-    cpu->cfg.ext_svnapot = true;
-    cpu->cfg.ext_svpbmt = true;
-    cpu->cfg.ext_smstateen = true;
-    cpu->cfg.ext_zba = true;
-    cpu->cfg.ext_zbb = true;
-    cpu->cfg.ext_zbc = true;
-    cpu->cfg.ext_zbs = true;
-    cpu->cfg.ext_XVentanaCondOps = true;
-
-    cpu->cfg.mvendorid = VEYRON_V1_MVENDORID;
-    cpu->cfg.marchid = VEYRON_V1_MARCHID;
-    cpu->cfg.mimpid = VEYRON_V1_MIMPID;
-
-#ifndef CONFIG_USER_ONLY
-    set_satp_mode_max_supported(cpu, VM_1_10_SV48);
-#endif
-}
 
 static void rv64_xiangshan_nanhu_cpu_init(Object *obj)
 {
@@ -3207,7 +3168,41 @@ static const TypeInfo riscv_cpu_type_infos[] = {
         .cfg.max_satp_mode = VM_1_10_SV57,
     ),
 
-    DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_VEYRON_V1,  MXL_RV64,  rv64_veyron_v1_cpu_init),
+    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_VEYRON_V1, TYPE_RISCV_VENDOR_CPU,
+        .misa_mxl_max = MXL_RV64,
+        .misa_ext = RVG | RVC | RVS | RVU | RVH,
+        .priv_spec = PRIV_VERSION_1_12_0,
+
+        /* ISA extensions */
+        .cfg.mmu = true,
+        .cfg.ext_zifencei = true,
+        .cfg.ext_zicsr = true,
+        .cfg.pmp = true,
+        .cfg.ext_zicbom = true,
+        .cfg.cbom_blocksize = 64,
+        .cfg.cboz_blocksize = 64,
+        .cfg.ext_zicboz = true,
+        .cfg.ext_smaia = true,
+        .cfg.ext_ssaia = true,
+        .cfg.ext_sscofpmf = true,
+        .cfg.ext_sstc = true,
+        .cfg.ext_svinval = true,
+        .cfg.ext_svnapot = true,
+        .cfg.ext_svpbmt = true,
+        .cfg.ext_smstateen = true,
+        .cfg.ext_zba = true,
+        .cfg.ext_zbb = true,
+        .cfg.ext_zbc = true,
+        .cfg.ext_zbs = true,
+        .cfg.ext_XVentanaCondOps = true,
+
+        .cfg.mvendorid = VEYRON_V1_MVENDORID,
+        .cfg.marchid = VEYRON_V1_MARCHID,
+        .cfg.mimpid = VEYRON_V1_MIMPID,
+
+        .cfg.max_satp_mode = VM_1_10_SV48,
+    ),
+
     DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_XIANGSHAN_NANHU,
                                                  MXL_RV64, rv64_xiangshan_nanhu_cpu_init),
 #if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)

From 70f48d7fb19a88bca3cd4c388646d4cb9ee730f0 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Thu, 6 Feb 2025 17:36:06 +0100
Subject: [PATCH 1050/2760] target/riscv: convert Xiangshan Nanhu to
 RISCVCPUDef

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/riscv/cpu.c | 80 +++++++++++++---------------------------------
 1 file changed, 23 insertions(+), 57 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 000fcc6a1d..640aa958fd 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -440,16 +440,6 @@ const char *satp_mode_str(uint8_t satp_mode, bool is_32_bit)
     g_assert_not_reached();
 }
 
-static void __attribute__((unused))
-set_satp_mode_max_supported(RISCVCPU *cpu, int satp_mode)
-{
-    bool rv32 = riscv_cpu_mxl(&cpu->env) == MXL_RV32;
-    const bool *valid_vm = rv32 ? valid_vm_1_10_32 : valid_vm_1_10_64;
-
-    assert(valid_vm[satp_mode]);
-    cpu->cfg.max_satp_mode = satp_mode;
-}
-
 static bool get_satp_mode_supported(RISCVCPU *cpu, uint16_t *supported)
 {
     bool rv32 = riscv_cpu_is_32bit(cpu);
@@ -498,38 +488,6 @@ static void riscv_register_custom_csrs(RISCVCPU *cpu, const RISCVCSR *csr_list)
 }
 #endif
 
-#if defined(TARGET_RISCV64)
-
-static void rv64_xiangshan_nanhu_cpu_init(Object *obj)
-{
-    CPURISCVState *env = &RISCV_CPU(obj)->env;
-    RISCVCPU *cpu = RISCV_CPU(obj);
-
-    riscv_cpu_set_misa_ext(env, RVG | RVC | RVB | RVS | RVU);
-    env->priv_ver = PRIV_VERSION_1_12_0;
-
-    /* Enable ISA extensions */
-    cpu->cfg.ext_zbc = true;
-    cpu->cfg.ext_zbkb = true;
-    cpu->cfg.ext_zbkc = true;
-    cpu->cfg.ext_zbkx = true;
-    cpu->cfg.ext_zknd = true;
-    cpu->cfg.ext_zkne = true;
-    cpu->cfg.ext_zknh = true;
-    cpu->cfg.ext_zksed = true;
-    cpu->cfg.ext_zksh = true;
-    cpu->cfg.ext_svinval = true;
-
-    cpu->cfg.mmu = true;
-    cpu->cfg.pmp = true;
-
-#ifndef CONFIG_USER_ONLY
-    set_satp_mode_max_supported(cpu, VM_1_10_SV39);
-#endif
-}
-
-#endif /* !TARGET_RISCV64 */
-
 static ObjectClass *riscv_cpu_class_by_name(const char *cpu_model)
 {
     ObjectClass *oc;
@@ -2891,19 +2849,6 @@ void riscv_isa_write_fdt(RISCVCPU *cpu, void *fdt, char *nodename)
 }
 #endif
 
-#define DEFINE_VENDOR_CPU(type_name, misa_mxl_max_, initfn) \
-    {                                                       \
-        .name = (type_name),                                \
-        .parent = TYPE_RISCV_VENDOR_CPU,                    \
-        .instance_init = (initfn),                          \
-        .class_data = &(const RISCVCPUDef) {                \
-             .misa_mxl_max = (misa_mxl_max_),               \
-             .priv_spec = RISCV_PROFILE_ATTR_UNUSED,        \
-             .vext_spec = RISCV_PROFILE_ATTR_UNUSED,        \
-             .cfg.max_satp_mode = -1,                       \
-        },                                                  \
-    }
-
 #define DEFINE_ABSTRACT_RISCV_CPU(type_name, parent_type_name, ...) \
     {                                                       \
         .name = (type_name),                                \
@@ -3203,8 +3148,29 @@ static const TypeInfo riscv_cpu_type_infos[] = {
         .cfg.max_satp_mode = VM_1_10_SV48,
     ),
 
-    DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_XIANGSHAN_NANHU,
-                                                 MXL_RV64, rv64_xiangshan_nanhu_cpu_init),
+    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_XIANGSHAN_NANHU, TYPE_RISCV_VENDOR_CPU,
+        .misa_mxl_max = MXL_RV64,
+        .misa_ext = RVG | RVC | RVB | RVS | RVU,
+        .priv_spec = PRIV_VERSION_1_12_0,
+
+        /* ISA extensions */
+        .cfg.ext_zbc = true,
+        .cfg.ext_zbkb = true,
+        .cfg.ext_zbkc = true,
+        .cfg.ext_zbkx = true,
+        .cfg.ext_zknd = true,
+        .cfg.ext_zkne = true,
+        .cfg.ext_zknh = true,
+        .cfg.ext_zksed = true,
+        .cfg.ext_zksh = true,
+        .cfg.ext_svinval = true,
+
+        .cfg.mmu = true,
+        .cfg.pmp = true,
+
+        .cfg.max_satp_mode = VM_1_10_SV39,
+    ),
+
 #if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
     DEFINE_RISCV_CPU(TYPE_RISCV_CPU_BASE128, TYPE_RISCV_DYNAMIC_CPU,
         .cfg.max_satp_mode = VM_1_10_SV57,

From 42bc8af14033b9eeeb535449f243767c015f027e Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Thu, 6 Feb 2025 12:57:12 +0100
Subject: [PATCH 1051/2760] target/riscv: remove .instance_post_init

Unlike other uses of .instance_post_init, accel_cpu_instance_init()
*registers* properties, and therefore must be run before
device_post_init() which sets them to their values from -global.

In order to move all registration of properties to .instance_init,
call accel_cpu_instance_init() at the end of riscv_cpu_init().

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/riscv/cpu.c | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 640aa958fd..629ac37501 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -1083,11 +1083,6 @@ static bool riscv_cpu_is_dynamic(Object *cpu_obj)
     return object_dynamic_cast(cpu_obj, TYPE_RISCV_DYNAMIC_CPU) != NULL;
 }
 
-static void riscv_cpu_post_init(Object *obj)
-{
-    accel_cpu_instance_init(CPU(obj));
-}
-
 static void riscv_cpu_init(Object *obj)
 {
     RISCVCPUClass *mcc = RISCV_CPU_GET_CLASS(obj);
@@ -1143,6 +1138,8 @@ static void riscv_cpu_init(Object *obj)
         riscv_register_custom_csrs(cpu, mcc->def->custom_csrs);
     }
 #endif
+
+    accel_cpu_instance_init(CPU(obj));
 }
 
 typedef struct misa_ext_info {
@@ -2885,7 +2882,6 @@ static const TypeInfo riscv_cpu_type_infos[] = {
         .instance_size = sizeof(RISCVCPU),
         .instance_align = __alignof(RISCVCPU),
         .instance_init = riscv_cpu_init,
-        .instance_post_init = riscv_cpu_post_init,
         .abstract = true,
         .class_size = sizeof(RISCVCPUClass),
         .class_init = riscv_cpu_common_class_init,

From 220c739903cec99df032219ac94c45b5269a0ab5 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Mon, 3 Feb 2025 12:35:39 +0100
Subject: [PATCH 1052/2760] qom: reverse order of instance_post_init calls
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Currently, the instance_post_init calls are performed from the leaf
class and all the way up to Object.  This is incorrect because the
leaf class cannot observe property values applied by the superclasses;
for example, a compat property will be set on a device *after*
the class's post_init callback has run.

In particular this makes it impossible for implementations of
accel_cpu_instance_init() to operate based on the actual values of
the properties, though it seems that cxl_dsp_instance_post_init and
rp_instance_post_init might have similar issues.

Follow instead the same order as instance_init, starting with Object
and running the child class's instance_post_init after the parent.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 include/qom/object.h | 3 ++-
 qom/object.c         | 8 ++++----
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/include/qom/object.h b/include/qom/object.h
index 1d5b033724..26df6137b9 100644
--- a/include/qom/object.h
+++ b/include/qom/object.h
@@ -445,7 +445,8 @@ struct Object
  *   class will have already been initialized so the type is only responsible
  *   for initializing its own members.
  * @instance_post_init: This function is called to finish initialization of
- *   an object, after all @instance_init functions were called.
+ *   an object, after all @instance_init functions were called, as well as
+ *   @instance_post_init functions for the parent classes.
  * @instance_finalize: This function is called during object destruction.  This
  *   is called before the parent @instance_finalize function has been called.
  *   An object should only free the members that are unique to its type in this
diff --git a/qom/object.c b/qom/object.c
index 7b013f40a0..1856bb36c7 100644
--- a/qom/object.c
+++ b/qom/object.c
@@ -431,13 +431,13 @@ static void object_init_with_type(Object *obj, TypeImpl *ti)
 
 static void object_post_init_with_type(Object *obj, TypeImpl *ti)
 {
-    if (ti->instance_post_init) {
-        ti->instance_post_init(obj);
-    }
-
     if (type_has_parent(ti)) {
         object_post_init_with_type(obj, type_get_parent(ti));
     }
+
+    if (ti->instance_post_init) {
+        ti->instance_post_init(obj);
+    }
 }
 
 bool object_apply_global_props(Object *obj, const GPtrArray *props,

From c4f88b7136aa5aa5670a16c2f173ffb45da401b2 Mon Sep 17 00:00:00 2001
From: Peter Xu <peterx@redhat.com>
Date: Thu, 1 May 2025 11:12:35 -0400
Subject: [PATCH 1053/2760] scripts/vmstate-static-checker.py: Add new hpet
 entry for num_timers

The old "num_timers" got a rename.  See commit 1433e38cc8 ("hpet: do not
overwrite properties on post_load") for more details.  Teach the script to
accept the new name.

Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Thomas Huth <thuth@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Link: https://lore.kernel.org/r/20250501151235.636709-1-peterx@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 scripts/vmstate-static-checker.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/scripts/vmstate-static-checker.py b/scripts/vmstate-static-checker.py
index 25aca839a0..2335e25f94 100755
--- a/scripts/vmstate-static-checker.py
+++ b/scripts/vmstate-static-checker.py
@@ -91,6 +91,7 @@ def check_fields_match(name, s_field, d_field):
                       'mem_win_size', 'mig_mem_win_size',
                       'io_win_addr', 'mig_io_win_addr',
                       'io_win_size', 'mig_io_win_size'],
+        'hpet': ['num_timers', 'num_timers_save'],
     }
 
     if not name in changed_names:

From 7b2e4f788d60a8ec25efbf1e6bb6552ee0cef17c Mon Sep 17 00:00:00 2001
From: Li Zhijian <lizhijian@fujitsu.com>
Date: Fri, 9 May 2025 09:42:10 +0800
Subject: [PATCH 1054/2760] qtest/migration/rdma: Enforce RLIMIT_MEMLOCK >=
 128MB requirement

Ensure successful migration over RDMA by verifying that RLIMIT_MEMLOCK is
set to at least 128MB. This allocation is necessary due to the requirement
to pin significant portions of guest memory, typically exceeding 100MB
in this test, while the remainder is transmitted as compressed zero pages.

Otherwise, it will fail with:
stderr:
qemu-system-x86_64: cannot get rkey
qemu-system-x86_64: error while loading state section id 2(ram)
qemu-system-x86_64: load of migration failed: Operation not permitted
qemu-system-x86_64: rdma migration: recv polling control error!
qemu-system-x86_64: RDMA is in an error state waiting migration to abort!
qemu-system-x86_64: failed to save SaveStateEntry with id(name): 2(ram): -1
qemu-system-x86_64: Channel error: Operation not permitted

Reported-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Li Zhijian <lizhijian@fujitsu.com>
Link: https://lore.kernel.org/r/20250509014211.1272640-1-lizhijian@fujitsu.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 tests/qtest/migration/precopy-tests.c | 34 +++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)

diff --git a/tests/qtest/migration/precopy-tests.c b/tests/qtest/migration/precopy-tests.c
index 87b0a7e8ef..5be1cd5742 100644
--- a/tests/qtest/migration/precopy-tests.c
+++ b/tests/qtest/migration/precopy-tests.c
@@ -101,6 +101,35 @@ static void test_precopy_unix_dirty_ring(void)
 
 #ifdef CONFIG_RDMA
 
+#include <sys/resource.h>
+
+/*
+ * During migration over RDMA, it will try to pin portions of guest memory,
+ * typically exceeding 100MB in this test, while the remainder will be
+ * transmitted as compressed zero pages.
+ *
+ * REQUIRED_MEMLOCK_SZ indicates the minimal mlock size in the current context.
+ */
+#define REQUIRED_MEMLOCK_SZ (128 << 20) /* 128MB */
+
+/* check 'ulimit -l' */
+static bool mlock_check(void)
+{
+    uid_t uid;
+    struct rlimit rlim;
+
+    uid = getuid();
+    if (uid == 0) {
+        return true;
+    }
+
+    if (getrlimit(RLIMIT_MEMLOCK, &rlim) != 0) {
+        return false;
+    }
+
+    return rlim.rlim_cur >= REQUIRED_MEMLOCK_SZ;
+}
+
 #define RDMA_MIGRATION_HELPER "scripts/rdma-migration-helper.sh"
 static int new_rdma_link(char *buffer)
 {
@@ -136,6 +165,11 @@ static void test_precopy_rdma_plain(void)
 {
     char buffer[128] = {};
 
+    if (!mlock_check()) {
+        g_test_skip("'ulimit -l' is too small, require >=128M");
+        return;
+    }
+
     if (new_rdma_link(buffer)) {
         g_test_skip("No rdma link available\n"
                     "# To enable the test:\n"

From 6b84c46e8e0ef6f83f33657a29a8abb2b8362d02 Mon Sep 17 00:00:00 2001
From: Li Zhijian <lizhijian@fujitsu.com>
Date: Tue, 13 May 2025 09:22:07 +0800
Subject: [PATCH 1055/2760] qtest/migration/rdma: Add test for rdma migration
 with ipv6

Recently, we removed ipv6 restriction[0] from RDMA migration, add a
test for it.

[0] https://lore.kernel.org/qemu-devel/20250326095224.9918-1-jinpu.wang@ionos.com/

Cc: Jack Wang <jinpu.wang@ionos.com>
Cc: Michael R. Galaxy <mrgalaxy@nvidia.com>
Cc: Peter Xu <peterx@redhat.com>
Cc: Yu Zhang <yu.zhang@ionos.com>
Reviewed-by: Jack Wang <jinpu.wang@ionos.com>
Signed-off-by: Li Zhijian <lizhijian@fujitsu.com>
Link: https://lore.kernel.org/r/20250513012207.2867069-1-lizhijian@fujitsu.com
[peterx: Fix over long lines]
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 scripts/rdma-migration-helper.sh      | 57 ++++++++++++++++++++++-----
 tests/qtest/migration/precopy-tests.c | 21 ++++++++--
 2 files changed, 65 insertions(+), 13 deletions(-)

diff --git a/scripts/rdma-migration-helper.sh b/scripts/rdma-migration-helper.sh
index a39f2fb0e5..d784d1566a 100755
--- a/scripts/rdma-migration-helper.sh
+++ b/scripts/rdma-migration-helper.sh
@@ -8,23 +8,44 @@ get_ipv4_addr()
         head -1 | tr -d '\n'
 }
 
+get_ipv6_addr() {
+    ipv6=$(ip -6 -o addr show dev "$1" |
+        sed -n 's/.*[[:blank:]]inet6[[:blank:]]*\([^[:blank:]/]*\).*/\1/p' |
+        head -1 | tr -d '\n')
+
+    [ $? -eq 0 ] || return
+
+    if [[ "$ipv6" =~ ^fe80: ]]; then
+        echo -n "[$ipv6%$1]"
+    else
+        echo -n "[$ipv6]"
+    fi
+}
+
 # existing rdma interfaces
 rdma_interfaces()
 {
-    rdma link show | sed -nE 's/^link .* netdev ([^ ]+).*$/\1 /p'
+    rdma link show | sed -nE 's/^link .* netdev ([^ ]+).*$/\1 /p' |
+    grep -Ev '^(lo|tun|tap)'
 }
 
 # existing valid ipv4 interfaces
 ipv4_interfaces()
 {
-    ip -o addr show | awk '/inet / {print $2}' | grep -v -w lo
+    ip -o addr show | awk '/inet / {print $2}' | grep -Ev '^(lo|tun|tap)'
+}
+
+ipv6_interfaces()
+{
+    ip -o addr show | awk '/inet6 / {print $2}' | grep -Ev '^(lo|tun|tap)'
 }
 
 rdma_rxe_detect()
 {
+    family=$1
     for r in $(rdma_interfaces)
     do
-        ipv4_interfaces | grep -qw $r && get_ipv4_addr $r && return
+        "$family"_interfaces | grep -qw $r && get_"$family"_addr $r && return
     done
 
     return 1
@@ -32,16 +53,23 @@ rdma_rxe_detect()
 
 rdma_rxe_setup()
 {
-    for i in $(ipv4_interfaces)
+    family=$1
+    for i in $("$family"_interfaces)
     do
-        rdma_interfaces | grep -qw $i && continue
+        if rdma_interfaces | grep -qw $i; then
+            echo "$family: Reuse the existing rdma/rxe ${i}_rxe" \
+                 "for $i with $(get_"$family"_addr $i)"
+            return
+        fi
+
         rdma link add "${i}_rxe" type rxe netdev "$i" && {
-            echo "Setup new rdma/rxe ${i}_rxe for $i with $(get_ipv4_addr $i)"
+            echo "$family: Setup new rdma/rxe ${i}_rxe" \
+                 "for $i with $(get_"$family"_addr $i)"
             return
         }
     done
 
-    echo "Failed to setup any new rdma/rxe link" >&2
+    echo "$family: Failed to setup any new rdma/rxe link" >&2
     return 1
 }
 
@@ -50,6 +78,12 @@ rdma_rxe_clean()
     modprobe -r rdma_rxe
 }
 
+IP_FAMILY=${IP_FAMILY:-ipv4}
+if [ "$IP_FAMILY" != "ipv6" ] && [ "$IP_FAMILY" != "ipv4" ]; then
+    echo "Unknown ip family '$IP_FAMILY', only ipv4 or ipv6 is supported." >&2
+    exit 1
+fi
+
 operation=${1:-detect}
 
 command -v rdma >/dev/null || {
@@ -62,9 +96,14 @@ if [ "$operation" == "setup" ] || [ "$operation" == "clean" ]; then
         echo "Root privilege is required to setup/clean a rdma/rxe link" >&2
         exit 1
     }
-    rdma_rxe_"$operation"
+    if [ "$operation" == "setup" ]; then
+        rdma_rxe_setup ipv4
+        rdma_rxe_setup ipv6
+    else
+        rdma_rxe_clean
+    fi
 elif [ "$operation" == "detect" ]; then
-    rdma_rxe_detect
+    rdma_rxe_detect "$IP_FAMILY"
 else
     echo "Usage: $0 [setup | detect | clean]"
 fi
diff --git a/tests/qtest/migration/precopy-tests.c b/tests/qtest/migration/precopy-tests.c
index 5be1cd5742..a62d3c5378 100644
--- a/tests/qtest/migration/precopy-tests.c
+++ b/tests/qtest/migration/precopy-tests.c
@@ -131,12 +131,13 @@ static bool mlock_check(void)
 }
 
 #define RDMA_MIGRATION_HELPER "scripts/rdma-migration-helper.sh"
-static int new_rdma_link(char *buffer)
+static int new_rdma_link(char *buffer, bool ipv6)
 {
     char cmd[256];
     bool verbose = g_getenv("QTEST_LOG");
 
-    snprintf(cmd, sizeof(cmd), "%s detect %s", RDMA_MIGRATION_HELPER,
+    snprintf(cmd, sizeof(cmd), "IP_FAMILY=%s %s detect %s",
+             ipv6 ? "ipv6" : "ipv4", RDMA_MIGRATION_HELPER,
              verbose ? "" : "2>/dev/null");
 
     FILE *pipe = popen(cmd, "r");
@@ -161,7 +162,7 @@ static int new_rdma_link(char *buffer)
     return -1;
 }
 
-static void test_precopy_rdma_plain(void)
+static void __test_precopy_rdma_plain(bool ipv6)
 {
     char buffer[128] = {};
 
@@ -170,7 +171,7 @@ static void test_precopy_rdma_plain(void)
         return;
     }
 
-    if (new_rdma_link(buffer)) {
+    if (new_rdma_link(buffer, ipv6)) {
         g_test_skip("No rdma link available\n"
                     "# To enable the test:\n"
                     "# Run \'" RDMA_MIGRATION_HELPER " setup\' with root to "
@@ -193,6 +194,16 @@ static void test_precopy_rdma_plain(void)
 
     test_precopy_common(&args);
 }
+
+static void test_precopy_rdma_plain(void)
+{
+    __test_precopy_rdma_plain(false);
+}
+
+static void test_precopy_rdma_plain_ipv6(void)
+{
+    __test_precopy_rdma_plain(true);
+}
 #endif
 
 static void test_precopy_tcp_plain(void)
@@ -1226,6 +1237,8 @@ static void migration_test_add_precopy_smoke(MigrationTestEnv *env)
 #ifdef CONFIG_RDMA
     migration_test_add("/migration/precopy/rdma/plain",
                        test_precopy_rdma_plain);
+    migration_test_add("/migration/precopy/rdma/plain/ipv6",
+                       test_precopy_rdma_plain_ipv6);
 #endif
 }
 

From e74598a981afe39d6f4951cd5d23101f537957bb Mon Sep 17 00:00:00 2001
From: Fabiano Rosas <farosas@suse.de>
Date: Tue, 13 May 2025 10:33:51 -0300
Subject: [PATCH 1056/2760] ci: Re-enable python subtests in qtest migration
 suite

The migration compatibility tests have been running with the PYTHON
variable unset to avoid running a broken test. The faulty test has
since been removed, so we can enable the python tests once again.

Aside from the broken test, only one other test uses python and I have
been running it locally ever since, so this commit should not expose
any new bug.

Reviewed-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20250513133353.23022-2-farosas@suse.de
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 .gitlab-ci.d/buildtest.yml | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/.gitlab-ci.d/buildtest.yml b/.gitlab-ci.d/buildtest.yml
index 248aaed137..fbad34138c 100644
--- a/.gitlab-ci.d/buildtest.yml
+++ b/.gitlab-ci.d/buildtest.yml
@@ -227,14 +227,6 @@ build-previous-qemu:
     # testing an old QEMU against new features/tests that it is not
     # compatible with.
     - cd build-previous
-    # Don't allow python-based tests to run. The
-    # vmstate-checker-script test has a race that causes it to fail
-    # sometimes. It cannot be fixed it because this job runs the test
-    # from the old QEMU version. The test will be removed on master,
-    # but this job will only see the change in the next release.
-    #
-    # TODO: remove this line after 9.2 release
-    - unset PYTHON
     # old to new
     - QTEST_QEMU_BINARY_SRC=./qemu-system-${TARGET}
           QTEST_QEMU_BINARY=../build/qemu-system-${TARGET} ./tests/qtest/migration-test

From d5845228b41dbf44f85744e64c3c1744f76a368d Mon Sep 17 00:00:00 2001
From: Fabiano Rosas <farosas@suse.de>
Date: Tue, 13 May 2025 10:33:52 -0300
Subject: [PATCH 1057/2760] ci: Fix build-previous-qemu when the version tag is
 absent

Stefan reports that during QEMU release, pushing a series with the
VERSION bump commit, but not pushing the new git tag in the same
command will cause a failure of the build-previous-qemu job at the git
fetch step.

Since the job is intended to produce a build of the previous QEMU
version for consumption by the migration-compat-* jobs, there's no
reason to produce a build of the release commit because the migration
job would end up testing the release against itself.

Skip the job when VERSION contains the newly release version number.

I'm opting for 'exit 0' for both the build and the test jobs because
allow_failure would mask any real error in the jobs. It also avoids
having an orange ! on every release pipeline.

Reported-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20250513133353.23022-3-farosas@suse.de
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 .gitlab-ci.d/buildtest.yml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/.gitlab-ci.d/buildtest.yml b/.gitlab-ci.d/buildtest.yml
index fbad34138c..b4e39fd7c1 100644
--- a/.gitlab-ci.d/buildtest.yml
+++ b/.gitlab-ci.d/buildtest.yml
@@ -203,6 +203,11 @@ build-previous-qemu:
     GIT_FETCH_EXTRA_FLAGS: --prune --quiet
   before_script:
     - source scripts/ci/gitlab-ci-section
+    # Skip if this series contains the release bump commit. During the
+    # release process there might be a window of commits when the
+    # version tag is not yet present in the remote and git fetch would
+    # fail.
+    - if grep -q "\.0$" VERSION; then exit 0; fi
     - export QEMU_PREV_VERSION="$(sed 's/\([0-9.]*\)\.[0-9]*/v\1.0/' VERSION)"
     - git remote add upstream https://gitlab.com/qemu-project/qemu
     - git fetch upstream refs/tags/$QEMU_PREV_VERSION:refs/tags/$QEMU_PREV_VERSION
@@ -223,6 +228,9 @@ build-previous-qemu:
     IMAGE: opensuse-leap
     MAKE_CHECK_ARGS: check-build
   script:
+    # Skip for round release numbers, this job is only relevant for
+    # testing a development tree.
+    - if grep -q "\.0$" VERSION; then exit 0; fi
     # Use the migration-tests from the older QEMU tree. This avoids
     # testing an old QEMU against new features/tests that it is not
     # compatible with.

From 371650534d44c8b27249ca615d908a037f75b048 Mon Sep 17 00:00:00 2001
From: Fabiano Rosas <farosas@suse.de>
Date: Tue, 13 May 2025 10:33:53 -0300
Subject: [PATCH 1058/2760] ci: Reduce the size of artifacts for
 build-previous-qemu

The build-previous-qemu job is intented to produce a build of the
previous QEMU release for consumption by the migration-compat-*
jobs. Keep only the pieces of the build that are necessary.

Reviewed-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20250513133353.23022-4-farosas@suse.de
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 .gitlab-ci.d/buildtest.yml | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/.gitlab-ci.d/buildtest.yml b/.gitlab-ci.d/buildtest.yml
index b4e39fd7c1..ca1a9c6f70 100644
--- a/.gitlab-ci.d/buildtest.yml
+++ b/.gitlab-ci.d/buildtest.yml
@@ -188,12 +188,11 @@ build-previous-qemu:
     when: on_success
     expire_in: 2 days
     paths:
-      - build-previous
-    exclude:
-      - build-previous/**/*.p
-      - build-previous/**/*.a.p
-      - build-previous/**/*.c.o
-      - build-previous/**/*.c.o.d
+      - build-previous/qemu-bundle
+      - build-previous/qemu-system-aarch64
+      - build-previous/qemu-system-x86_64
+      - build-previous/tests/qtest/migration-test
+      - build-previous/scripts
   needs:
     job: amd64-opensuse-leap-container
   variables:

From 249543d0c02d7645b8bcda552dad138769e96831 Mon Sep 17 00:00:00 2001
From: Prasad Pandit <pjp@fedoraproject.org>
Date: Mon, 12 May 2025 18:21:22 +0530
Subject: [PATCH 1059/2760] migration: write zero pages when postcopy enabled

During multifd migration, zero pages are written if
they are migrated more than once.

This may result in a migration thread hang issue when
multifd and postcopy are enabled together.

When postcopy is enabled, always write zero pages as and
when they are migrated.

Signed-off-by: Prasad Pandit <pjp@fedoraproject.org>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20250512125124.147064-2-ppandit@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/multifd-zero-page.c | 22 ++++++++++++++++++++--
 1 file changed, 20 insertions(+), 2 deletions(-)

diff --git a/migration/multifd-zero-page.c b/migration/multifd-zero-page.c
index dbc1184921..4cde868159 100644
--- a/migration/multifd-zero-page.c
+++ b/migration/multifd-zero-page.c
@@ -85,9 +85,27 @@ void multifd_recv_zero_page_process(MultiFDRecvParams *p)
 {
     for (int i = 0; i < p->zero_num; i++) {
         void *page = p->host + p->zero[i];
-        if (ramblock_recv_bitmap_test_byte_offset(p->block, p->zero[i])) {
+        bool received =
+                ramblock_recv_bitmap_test_byte_offset(p->block, p->zero[i]);
+
+        /*
+         * During multifd migration zero page is written to the memory
+         * only if it is migrated more than once.
+         *
+         * It becomes a problem when both multifd & postcopy options are
+         * enabled. If the zero page which was skipped during multifd phase,
+         * is accessed during the postcopy phase of the migration, a page
+         * fault occurs. But this page fault is not served because the
+         * 'receivedmap' says the zero page is already received. Thus the
+         * thread accessing that page may hang.
+         *
+         * When postcopy is enabled, always write the zero page as and when
+         * it is migrated.
+         */
+        if (migrate_postcopy_ram() || received) {
             memset(page, 0, multifd_ram_page_size());
-        } else {
+        }
+        if (!received) {
             ramblock_recv_bitmap_set_offset(p->block, p->zero[i]);
         }
     }

From e27418861288285d20352448fef4491a68223d39 Mon Sep 17 00:00:00 2001
From: Prasad Pandit <pjp@fedoraproject.org>
Date: Mon, 12 May 2025 18:21:23 +0530
Subject: [PATCH 1060/2760] migration: enable multifd and postcopy together

Enable Multifd and Postcopy migration together.
The migration_ioc_process_incoming() routine checks
magic value sent on each channel and helps to properly
setup multifd and postcopy channels.

The Precopy and Multifd threads work during the initial
guest RAM transfer. When migration moves to the Postcopy
phase, the multifd threads cease to send data on multifd
channels and Postcopy threads on the destination
request/pull data from the source side.

Reviewed-by: Fabiano Rosas <farosas@suse.de>
Signed-off-by: Prasad Pandit <pjp@fedoraproject.org>
Link: https://lore.kernel.org/r/20250512125124.147064-3-ppandit@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/multifd-nocomp.c | 3 ++-
 migration/multifd.c        | 7 +++++++
 migration/options.c        | 5 -----
 migration/ram.c            | 5 ++---
 4 files changed, 11 insertions(+), 9 deletions(-)

diff --git a/migration/multifd-nocomp.c b/migration/multifd-nocomp.c
index 88fe0f99f2..b48eae3d86 100644
--- a/migration/multifd-nocomp.c
+++ b/migration/multifd-nocomp.c
@@ -17,6 +17,7 @@
 #include "migration-stats.h"
 #include "multifd.h"
 #include "options.h"
+#include "migration.h"
 #include "qapi/error.h"
 #include "qemu/cutils.h"
 #include "qemu/error-report.h"
@@ -398,7 +399,7 @@ int multifd_ram_flush_and_sync(QEMUFile *f)
     MultiFDSyncReq req;
     int ret;
 
-    if (!migrate_multifd()) {
+    if (!migrate_multifd() || migration_in_postcopy()) {
         return 0;
     }
 
diff --git a/migration/multifd.c b/migration/multifd.c
index ec108af624..f18b166bcf 100644
--- a/migration/multifd.c
+++ b/migration/multifd.c
@@ -1379,6 +1379,13 @@ static void *multifd_recv_thread(void *opaque)
         }
 
         if (has_data) {
+            /*
+             * multifd thread should not be active and receive data
+             * when migration is in the Postcopy phase. Two threads
+             * writing the same memory area could easily corrupt
+             * the guest state.
+             */
+            assert(!migration_in_postcopy());
             if (is_device_state) {
                 assert(use_packets);
                 ret = multifd_device_state_recv(p, &local_err);
diff --git a/migration/options.c b/migration/options.c
index b6ae95358d..3fcd577cd7 100644
--- a/migration/options.c
+++ b/migration/options.c
@@ -509,11 +509,6 @@ bool migrate_caps_check(bool *old_caps, bool *new_caps, Error **errp)
             error_setg(errp, "Postcopy is not compatible with ignore-shared");
             return false;
         }
-
-        if (new_caps[MIGRATION_CAPABILITY_MULTIFD]) {
-            error_setg(errp, "Postcopy is not yet compatible with multifd");
-            return false;
-        }
     }
 
     if (new_caps[MIGRATION_CAPABILITY_BACKGROUND_SNAPSHOT]) {
diff --git a/migration/ram.c b/migration/ram.c
index e12913b43e..d26dbd37c4 100644
--- a/migration/ram.c
+++ b/migration/ram.c
@@ -1993,9 +1993,8 @@ static int ram_save_target_page(RAMState *rs, PageSearchStatus *pss)
         }
     }
 
-    if (migrate_multifd()) {
-        RAMBlock *block = pss->block;
-        return ram_save_multifd_page(block, offset);
+    if (migrate_multifd() && !migration_in_postcopy()) {
+        return ram_save_multifd_page(pss->block, offset);
     }
 
     return ram_save_page(rs, pss);

From 766bbabac8f00bc5cf23ba90a8326678636280ed Mon Sep 17 00:00:00 2001
From: Prasad Pandit <pjp@fedoraproject.org>
Date: Mon, 12 May 2025 18:21:24 +0530
Subject: [PATCH 1061/2760] tests/qtest/migration: add postcopy tests with
 multifd

Add new qtests to run postcopy migration with multifd
channels enabled.

Signed-off-by: Prasad Pandit <pjp@fedoraproject.org>
Link: https://lore.kernel.org/r/20250512125124.147064-4-ppandit@redhat.com
[peterx: rename all new tests to be under /migration/multifd+postcopy/]
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 tests/qtest/migration/compression-tests.c | 18 ++++++++
 tests/qtest/migration/postcopy-tests.c    | 27 ++++++++++++
 tests/qtest/migration/precopy-tests.c     | 28 ++++++++++++-
 tests/qtest/migration/tls-tests.c         | 51 +++++++++++++++++++++++
 4 files changed, 122 insertions(+), 2 deletions(-)

diff --git a/tests/qtest/migration/compression-tests.c b/tests/qtest/migration/compression-tests.c
index 41e79f031b..b827665b8e 100644
--- a/tests/qtest/migration/compression-tests.c
+++ b/tests/qtest/migration/compression-tests.c
@@ -42,6 +42,20 @@ static void test_multifd_tcp_zstd(void)
     };
     test_precopy_common(&args);
 }
+
+static void test_multifd_postcopy_tcp_zstd(void)
+{
+    MigrateCommon args = {
+        .listen_uri = "defer",
+        .start = {
+            .caps[MIGRATION_CAPABILITY_MULTIFD] = true,
+            .caps[MIGRATION_CAPABILITY_POSTCOPY_RAM] = true,
+        },
+        .start_hook = migrate_hook_start_precopy_tcp_multifd_zstd,
+    };
+
+    test_precopy_common(&args);
+}
 #endif /* CONFIG_ZSTD */
 
 #ifdef CONFIG_QATZIP
@@ -184,6 +198,10 @@ void migration_test_add_compression(MigrationTestEnv *env)
 #ifdef CONFIG_ZSTD
     migration_test_add("/migration/multifd/tcp/plain/zstd",
                        test_multifd_tcp_zstd);
+    if (env->has_uffd) {
+        migration_test_add("/migration/multifd+postcopy/tcp/plain/zstd",
+                           test_multifd_postcopy_tcp_zstd);
+    }
 #endif
 
 #ifdef CONFIG_QATZIP
diff --git a/tests/qtest/migration/postcopy-tests.c b/tests/qtest/migration/postcopy-tests.c
index 483e3ff99f..3773525843 100644
--- a/tests/qtest/migration/postcopy-tests.c
+++ b/tests/qtest/migration/postcopy-tests.c
@@ -94,6 +94,29 @@ static void migration_test_add_postcopy_smoke(MigrationTestEnv *env)
     }
 }
 
+static void test_multifd_postcopy(void)
+{
+    MigrateCommon args = {
+        .start = {
+            .caps[MIGRATION_CAPABILITY_MULTIFD] = true,
+        },
+    };
+
+    test_postcopy_common(&args);
+}
+
+static void test_multifd_postcopy_preempt(void)
+{
+    MigrateCommon args = {
+        .start = {
+            .caps[MIGRATION_CAPABILITY_MULTIFD] = true,
+            .caps[MIGRATION_CAPABILITY_POSTCOPY_PREEMPT] = true,
+        },
+    };
+
+    test_postcopy_common(&args);
+}
+
 void migration_test_add_postcopy(MigrationTestEnv *env)
 {
     migration_test_add_postcopy_smoke(env);
@@ -114,6 +137,10 @@ void migration_test_add_postcopy(MigrationTestEnv *env)
             "/migration/postcopy/recovery/double-failures/reconnect",
             test_postcopy_recovery_fail_reconnect);
 
+        migration_test_add("/migration/multifd+postcopy/plain",
+                           test_multifd_postcopy);
+        migration_test_add("/migration/multifd+postcopy/preempt/plain",
+                           test_multifd_postcopy_preempt);
         if (env->is_x86) {
             migration_test_add("/migration/postcopy/suspend",
                                test_postcopy_suspend);
diff --git a/tests/qtest/migration/precopy-tests.c b/tests/qtest/migration/precopy-tests.c
index a62d3c5378..bb38292550 100644
--- a/tests/qtest/migration/precopy-tests.c
+++ b/tests/qtest/migration/precopy-tests.c
@@ -569,7 +569,7 @@ static void test_multifd_tcp_channels_none(void)
  *
  *  And see that it works
  */
-static void test_multifd_tcp_cancel(void)
+static void test_multifd_tcp_cancel(bool postcopy_ram)
 {
     MigrateStart args = {
         .hide_stderr = true,
@@ -583,6 +583,11 @@ static void test_multifd_tcp_cancel(void)
     migrate_ensure_non_converge(from);
     migrate_prepare_for_dirty_mem(from);
 
+    if (postcopy_ram) {
+        migrate_set_capability(from, "postcopy-ram", true);
+        migrate_set_capability(to, "postcopy-ram", true);
+    }
+
     migrate_set_parameter_int(from, "multifd-channels", 16);
     migrate_set_parameter_int(to, "multifd-channels", 16);
 
@@ -624,6 +629,10 @@ static void test_multifd_tcp_cancel(void)
         return;
     }
 
+    if (postcopy_ram) {
+        migrate_set_capability(to2, "postcopy-ram", true);
+    }
+
     migrate_set_parameter_int(to2, "multifd-channels", 16);
 
     migrate_set_capability(to2, "multifd", true);
@@ -647,6 +656,16 @@ static void test_multifd_tcp_cancel(void)
     migrate_end(from, to2, true);
 }
 
+static void test_multifd_precopy_tcp_cancel(void)
+{
+    test_multifd_tcp_cancel(false);
+}
+
+static void test_multifd_postcopy_tcp_cancel(void)
+{
+    test_multifd_tcp_cancel(true);
+}
+
 static void test_cancel_src_after_failed(QTestState *from, QTestState *to,
                                          const char *uri, const char *phase)
 {
@@ -1233,7 +1252,12 @@ static void migration_test_add_precopy_smoke(MigrationTestEnv *env)
     migration_test_add("/migration/multifd/tcp/uri/plain/none",
                        test_multifd_tcp_uri_none);
     migration_test_add("/migration/multifd/tcp/plain/cancel",
-                       test_multifd_tcp_cancel);
+                       test_multifd_precopy_tcp_cancel);
+    if (env->has_uffd) {
+        migration_test_add("/migration/multifd+postcopy/tcp/plain/cancel",
+                           test_multifd_postcopy_tcp_cancel);
+    }
+
 #ifdef CONFIG_RDMA
     migration_test_add("/migration/precopy/rdma/plain",
                        test_precopy_rdma_plain);
diff --git a/tests/qtest/migration/tls-tests.c b/tests/qtest/migration/tls-tests.c
index 72f44defbb..21e9fec87d 100644
--- a/tests/qtest/migration/tls-tests.c
+++ b/tests/qtest/migration/tls-tests.c
@@ -395,6 +395,19 @@ static void test_postcopy_recovery_tls_psk(void)
     test_postcopy_recovery_common(&args);
 }
 
+static void test_multifd_postcopy_recovery_tls_psk(void)
+{
+    MigrateCommon args = {
+        .start_hook = migrate_hook_start_tls_psk_match,
+        .end_hook = migrate_hook_end_tls_psk,
+        .start = {
+            .caps[MIGRATION_CAPABILITY_MULTIFD] = true,
+        },
+    };
+
+    test_postcopy_recovery_common(&args);
+}
+
 /* This contains preempt+recovery+tls test altogether */
 static void test_postcopy_preempt_all(void)
 {
@@ -409,6 +422,20 @@ static void test_postcopy_preempt_all(void)
     test_postcopy_recovery_common(&args);
 }
 
+static void test_multifd_postcopy_preempt_recovery_tls_psk(void)
+{
+    MigrateCommon args = {
+        .start_hook = migrate_hook_start_tls_psk_match,
+        .end_hook = migrate_hook_end_tls_psk,
+        .start = {
+            .caps[MIGRATION_CAPABILITY_MULTIFD] = true,
+            .caps[MIGRATION_CAPABILITY_POSTCOPY_PREEMPT] = true,
+        },
+    };
+
+    test_postcopy_recovery_common(&args);
+}
+
 static void test_precopy_unix_tls_psk(void)
 {
     g_autofree char *uri = g_strdup_printf("unix:%s/migsocket", tmpfs);
@@ -657,6 +684,21 @@ static void test_multifd_tcp_tls_psk_mismatch(void)
     test_precopy_common(&args);
 }
 
+static void test_multifd_postcopy_tcp_tls_psk_match(void)
+{
+    MigrateCommon args = {
+        .start = {
+            .caps[MIGRATION_CAPABILITY_MULTIFD] = true,
+            .caps[MIGRATION_CAPABILITY_POSTCOPY_RAM] = true,
+        },
+        .listen_uri = "defer",
+        .start_hook = migrate_hook_start_multifd_tcp_tls_psk_match,
+        .end_hook = migrate_hook_end_tls_psk,
+    };
+
+    test_precopy_common(&args);
+}
+
 #ifdef CONFIG_TASN1
 static void test_multifd_tcp_tls_x509_default_host(void)
 {
@@ -774,6 +816,11 @@ void migration_test_add_tls(MigrationTestEnv *env)
                            test_postcopy_preempt_tls_psk);
         migration_test_add("/migration/postcopy/preempt/recovery/tls/psk",
                            test_postcopy_preempt_all);
+        migration_test_add("/migration/multifd+postcopy/recovery/tls/psk",
+                           test_multifd_postcopy_recovery_tls_psk);
+        migration_test_add(
+            "/migration/multifd+postcopy/preempt/recovery/tls/psk",
+            test_multifd_postcopy_preempt_recovery_tls_psk);
     }
 #ifdef CONFIG_TASN1
     migration_test_add("/migration/precopy/unix/tls/x509/default-host",
@@ -805,6 +852,10 @@ void migration_test_add_tls(MigrationTestEnv *env)
                        test_multifd_tcp_tls_psk_match);
     migration_test_add("/migration/multifd/tcp/tls/psk/mismatch",
                        test_multifd_tcp_tls_psk_mismatch);
+    if (env->has_uffd) {
+        migration_test_add("/migration/multifd+postcopy/tcp/tls/psk/match",
+                           test_multifd_postcopy_tcp_tls_psk_match);
+    }
 #ifdef CONFIG_TASN1
     migration_test_add("/migration/multifd/tcp/tls/x509/default-host",
                        test_multifd_tcp_tls_x509_default_host);

From 6be7696129b302830a9cff7e30484e08c2d64b57 Mon Sep 17 00:00:00 2001
From: "Maciej S. Szmigiero" <maciej.szmigiero@oracle.com>
Date: Fri, 16 May 2025 15:53:03 +0200
Subject: [PATCH 1062/2760] migration/multifd: Don't send device state packets
 with zerocopy flag

If zerocopy is enabled for multifd then QIO_CHANNEL_WRITE_FLAG_ZERO_COPY
flag is forced into all multifd channel write calls via p->write_flags
that was setup in multifd_nocomp_send_setup().

However, device state packets aren't compatible with zerocopy - the data
buffer isn't getting kept pinned until multifd channel flush.

Make sure to mask that QIO_CHANNEL_WRITE_FLAG_ZERO_COPY flag in a multifd
send thread if the data being sent is device state.

Fixes: 0525b91a0b99 ("migration/multifd: Device state transfer support - send side")
Signed-off-by: Maciej S. Szmigiero <maciej.szmigiero@oracle.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/3bd5f48578e29f3a78f41b1e4fbea3d4b2d9b136.1747403393.git.maciej.szmigiero@oracle.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/multifd.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/migration/multifd.c b/migration/multifd.c
index f18b166bcf..b255778855 100644
--- a/migration/multifd.c
+++ b/migration/multifd.c
@@ -690,6 +690,7 @@ static void *multifd_send_thread(void *opaque)
         if (qatomic_load_acquire(&p->pending_job)) {
             bool is_device_state = multifd_payload_device_state(p->data);
             size_t total_size;
+            int write_flags_masked = 0;
 
             p->flags = 0;
             p->iovs_num = 0;
@@ -697,6 +698,9 @@ static void *multifd_send_thread(void *opaque)
 
             if (is_device_state) {
                 multifd_device_state_send_prepare(p);
+
+                /* Device state packets cannot be sent via zerocopy */
+                write_flags_masked |= QIO_CHANNEL_WRITE_FLAG_ZERO_COPY;
             } else {
                 ret = multifd_send_state->ops->send_prepare(p, &local_err);
                 if (ret != 0) {
@@ -718,7 +722,8 @@ static void *multifd_send_thread(void *opaque)
                                               &p->data->u.ram, &local_err);
             } else {
                 ret = qio_channel_writev_full_all(p->c, p->iov, p->iovs_num,
-                                                  NULL, 0, p->write_flags,
+                                                  NULL, 0,
+                                                  p->write_flags & ~write_flags_masked,
                                                   &local_err);
             }
 

From 17bec9235bb0775cf8dec4103c167757ee8898f3 Mon Sep 17 00:00:00 2001
From: Peter Xu <peterx@redhat.com>
Date: Tue, 13 May 2025 17:33:16 -0400
Subject: [PATCH 1063/2760] migration: Allow caps to be set when preempt or
 multifd cap enabled

With commit 82137e6c8c ("migration: enforce multifd and postcopy preempt to
be set before incoming"), and if postcopy preempt / multifd is enabled, one
cannot setup any capability because these checks would always fail.

(qemu) migrate_set_capability xbzrle off
Error: Postcopy preempt must be set before incoming starts

To fix it, check existing cap and only raise an error if the specific cap
changed.

Fixes: 82137e6c8c ("migration: enforce multifd and postcopy preempt to be set before incoming")
Reviewed-by: Dr. David Alan Gilbert <dave@treblig.org>
Reviewed-by: Juraj Marcin <jmarcin@redhat.com>
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/options.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/migration/options.c b/migration/options.c
index 3fcd577cd7..162c72cda4 100644
--- a/migration/options.c
+++ b/migration/options.c
@@ -568,7 +568,7 @@ bool migrate_caps_check(bool *old_caps, bool *new_caps, Error **errp)
             return false;
         }
 
-        if (migrate_incoming_started()) {
+        if (!migrate_postcopy_preempt() && migrate_incoming_started()) {
             error_setg(errp,
                        "Postcopy preempt must be set before incoming starts");
             return false;
@@ -576,7 +576,7 @@ bool migrate_caps_check(bool *old_caps, bool *new_caps, Error **errp)
     }
 
     if (new_caps[MIGRATION_CAPABILITY_MULTIFD]) {
-        if (migrate_incoming_started()) {
+        if (!migrate_multifd() && migrate_incoming_started()) {
             error_setg(errp, "Multifd must be set before incoming starts");
             return false;
         }

From e09c6d837593aa1e12d92d7031c65a881eb2eb27 Mon Sep 17 00:00:00 2001
From: Peter Xu <peterx@redhat.com>
Date: Tue, 13 May 2025 17:08:17 -0400
Subject: [PATCH 1064/2760] migration/hmp: Add "info migrate -a", reorg the
 dump

A new parameter "-a" is added to "info migrate" to dump all info, while
when not specified it only dumps the important ones.  When at it, reorg
everything to make it easier to read for human.

The general rule is:

  - Put important things at the top
  - Reuse a single line when things are very relevant, hence reducing lines
    needed to show the results
  - Remove almost useless ones (e.g. "normal_bytes", while we also have
    both "page size" and "normal" pages)
  - Regroup things, so that related fields will show together
  - etc.

Before this change, it looks like (one example of a completed case):

  globals:
  store-global-state: on
  only-migratable: off
  send-configuration: on
  send-section-footer: on
  send-switchover-start: on
  clear-bitmap-shift: 18
  Migration status: completed
  total time: 122952 ms
  downtime: 76 ms
  setup: 15 ms
  transferred ram: 130825923 kbytes
  throughput: 8717.68 mbps
  remaining ram: 0 kbytes
  total ram: 16777992 kbytes
  duplicate: 997263 pages
  normal: 32622225 pages
  normal bytes: 130488900 kbytes
  dirty sync count: 10
  page size: 4 kbytes
  multifd bytes: 117134260 kbytes
  pages-per-second: 169431
  postcopy request count: 5835
  precopy ram: 15 kbytes
  postcopy ram: 13691151 kbytes

After this change, sample output (default, no "-a" specified):

  Status: postcopy-active
  Time (ms): total=40504, setup=14, down=145
  RAM info:
    Bandwidth (mbps): 6102.65
    Sizes (KB): psize=4, total=16777992,
      transferred=37673019, remain=2136404,
      precopy=3, multifd=26108780, postcopy=11563855
    Pages: normal=9394288, zero=600672, rate_per_sec=185875
    Others: dirty_syncs=3, dirty_pages_rate=278378, postcopy_req=4078

Sample output when "-a" specified:

  Status: active
  Time (ms): total=3040, setup=4, exp_down=300
  RAM info:
    Throughput (mbps): 10.51
    Sizes (KB): psize=4, total=4211528,
      transferred=3979, remain=4206452,
      precopy=3978, multifd=0, postcopy=0
    Pages: normal=992, zero=277, rate_per_sec=320
    Others: dirty_syncs=1
  Globals:
    store-global-state: on
    only-migratable: off
    send-configuration: on
    send-section-footer: on
    send-switchover-start: on
    clear-bitmap-shift: 18
  XBZRLE: size=67108864, transferred=0, pages=0, miss=188451
    miss_rate=0.00, encode_rate=0.00, overflow=0
  CPU Throttle (%): 0
  Dirty-limit Throttle (us): 0
  Dirty-limit Ring Full (us): 0
  Postcopy Blocktime (ms): 0
  Postcopy vCPU Blocktime: ...

Reviewed-by: Dr. David Alan Gilbert <dave@treblig.org>
Tested-by: Mario Casquero <mcasquer@redhat.com>
[peterx: print "," too in 1st line of RAM info]
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 hmp-commands-info.hx           |   6 +-
 migration/migration-hmp-cmds.c | 186 +++++++++++++++++----------------
 2 files changed, 99 insertions(+), 93 deletions(-)

diff --git a/hmp-commands-info.hx b/hmp-commands-info.hx
index c59cd6637b..639a450ee5 100644
--- a/hmp-commands-info.hx
+++ b/hmp-commands-info.hx
@@ -475,9 +475,9 @@ ERST
 
     {
         .name       = "migrate",
-        .args_type  = "",
-        .params     = "",
-        .help       = "show migration status",
+        .args_type  = "all:-a",
+        .params     = "[-a]",
+        .help       = "show migration status (-a: all, dump all status)",
         .cmd        = hmp_info_migrate,
     },
 
diff --git a/migration/migration-hmp-cmds.c b/migration/migration-hmp-cmds.c
index 49c26daed3..e8a563c7d8 100644
--- a/migration/migration-hmp-cmds.c
+++ b/migration/migration-hmp-cmds.c
@@ -37,29 +37,28 @@ static void migration_global_dump(Monitor *mon)
 {
     MigrationState *ms = migrate_get_current();
 
-    monitor_printf(mon, "globals:\n");
-    monitor_printf(mon, "store-global-state: %s\n",
+    monitor_printf(mon, "Globals:\n");
+    monitor_printf(mon, "  store-global-state: %s\n",
                    ms->store_global_state ? "on" : "off");
-    monitor_printf(mon, "only-migratable: %s\n",
+    monitor_printf(mon, "  only-migratable: %s\n",
                    only_migratable ? "on" : "off");
-    monitor_printf(mon, "send-configuration: %s\n",
+    monitor_printf(mon, "  send-configuration: %s\n",
                    ms->send_configuration ? "on" : "off");
-    monitor_printf(mon, "send-section-footer: %s\n",
+    monitor_printf(mon, "  send-section-footer: %s\n",
                    ms->send_section_footer ? "on" : "off");
-    monitor_printf(mon, "send-switchover-start: %s\n",
+    monitor_printf(mon, "  send-switchover-start: %s\n",
                    ms->send_switchover_start ? "on" : "off");
-    monitor_printf(mon, "clear-bitmap-shift: %u\n",
+    monitor_printf(mon, "  clear-bitmap-shift: %u\n",
                    ms->clear_bitmap_shift);
 }
 
 void hmp_info_migrate(Monitor *mon, const QDict *qdict)
 {
+    bool show_all = qdict_get_try_bool(qdict, "all", false);
     MigrationInfo *info;
 
     info = qmp_query_migrate(NULL);
 
-    migration_global_dump(mon);
-
     if (info->blocked_reasons) {
         strList *reasons = info->blocked_reasons;
         monitor_printf(mon, "Outgoing migration blocked:\n");
@@ -70,7 +69,7 @@ void hmp_info_migrate(Monitor *mon, const QDict *qdict)
     }
 
     if (info->has_status) {
-        monitor_printf(mon, "Migration status: %s",
+        monitor_printf(mon, "Status: %s",
                        MigrationStatus_str(info->status));
         if (info->status == MIGRATION_STATUS_FAILED && info->error_desc) {
             monitor_printf(mon, " (%s)\n", info->error_desc);
@@ -78,107 +77,130 @@ void hmp_info_migrate(Monitor *mon, const QDict *qdict)
             monitor_printf(mon, "\n");
         }
 
-        monitor_printf(mon, "total time: %" PRIu64 " ms\n",
-                       info->total_time);
-        if (info->has_expected_downtime) {
-            monitor_printf(mon, "expected downtime: %" PRIu64 " ms\n",
-                           info->expected_downtime);
+        if (info->total_time) {
+            monitor_printf(mon, "Time (ms): total=%" PRIu64,
+                           info->total_time);
+            if (info->has_setup_time) {
+                monitor_printf(mon, ", setup=%" PRIu64,
+                               info->setup_time);
+            }
+            if (info->has_expected_downtime) {
+                monitor_printf(mon, ", exp_down=%" PRIu64,
+                               info->expected_downtime);
+            }
+            if (info->has_downtime) {
+                monitor_printf(mon, ", down=%" PRIu64,
+                               info->downtime);
+            }
+            monitor_printf(mon, "\n");
         }
-        if (info->has_downtime) {
-            monitor_printf(mon, "downtime: %" PRIu64 " ms\n",
-                           info->downtime);
-        }
-        if (info->has_setup_time) {
-            monitor_printf(mon, "setup: %" PRIu64 " ms\n",
-                           info->setup_time);
+    }
+
+    if (info->has_socket_address) {
+        SocketAddressList *addr;
+
+        monitor_printf(mon, "Sockets: [\n");
+
+        for (addr = info->socket_address; addr; addr = addr->next) {
+            char *s = socket_uri(addr->value);
+            monitor_printf(mon, "\t%s\n", s);
+            g_free(s);
         }
+        monitor_printf(mon, "]\n");
     }
 
     if (info->ram) {
-        monitor_printf(mon, "transferred ram: %" PRIu64 " kbytes\n",
-                       info->ram->transferred >> 10);
-        monitor_printf(mon, "throughput: %0.2f mbps\n",
+        monitor_printf(mon, "RAM info:\n");
+        monitor_printf(mon, "  Throughput (Mbps): %0.2f\n",
                        info->ram->mbps);
-        monitor_printf(mon, "remaining ram: %" PRIu64 " kbytes\n",
-                       info->ram->remaining >> 10);
-        monitor_printf(mon, "total ram: %" PRIu64 " kbytes\n",
+        monitor_printf(mon, "  Sizes (KiB): pagesize=%" PRIu64
+                       ", total=%" PRIu64 ",\n",
+                       info->ram->page_size >> 10,
                        info->ram->total >> 10);
-        monitor_printf(mon, "duplicate: %" PRIu64 " pages\n",
-                       info->ram->duplicate);
-        monitor_printf(mon, "normal: %" PRIu64 " pages\n",
-                       info->ram->normal);
-        monitor_printf(mon, "normal bytes: %" PRIu64 " kbytes\n",
-                       info->ram->normal_bytes >> 10);
-        monitor_printf(mon, "dirty sync count: %" PRIu64 "\n",
-                       info->ram->dirty_sync_count);
-        monitor_printf(mon, "page size: %" PRIu64 " kbytes\n",
-                       info->ram->page_size >> 10);
-        monitor_printf(mon, "multifd bytes: %" PRIu64 " kbytes\n",
-                       info->ram->multifd_bytes >> 10);
-        monitor_printf(mon, "pages-per-second: %" PRIu64 "\n",
+        monitor_printf(mon, "    transferred=%" PRIu64
+                       ", remain=%" PRIu64 ",\n",
+                       info->ram->transferred >> 10,
+                       info->ram->remaining >> 10);
+        monitor_printf(mon, "    precopy=%" PRIu64
+                       ", multifd=%" PRIu64
+                       ", postcopy=%" PRIu64,
+                       info->ram->precopy_bytes >> 10,
+                       info->ram->multifd_bytes >> 10,
+                       info->ram->postcopy_bytes >> 10);
+
+        if (info->vfio) {
+            monitor_printf(mon, ", vfio=%" PRIu64,
+                           info->vfio->transferred >> 10);
+        }
+        monitor_printf(mon, "\n");
+
+        monitor_printf(mon, "  Pages: normal=%" PRIu64 ", zero=%" PRIu64
+                       ", rate_per_sec=%" PRIu64 "\n",
+                       info->ram->normal,
+                       info->ram->duplicate,
                        info->ram->pages_per_second);
+        monitor_printf(mon, "  Others: dirty_syncs=%" PRIu64,
+                       info->ram->dirty_sync_count);
 
         if (info->ram->dirty_pages_rate) {
-            monitor_printf(mon, "dirty pages rate: %" PRIu64 " pages\n",
+            monitor_printf(mon, ", dirty_pages_rate=%" PRIu64,
                            info->ram->dirty_pages_rate);
         }
         if (info->ram->postcopy_requests) {
-            monitor_printf(mon, "postcopy request count: %" PRIu64 "\n",
+            monitor_printf(mon, ", postcopy_req=%" PRIu64,
                            info->ram->postcopy_requests);
         }
-        if (info->ram->precopy_bytes) {
-            monitor_printf(mon, "precopy ram: %" PRIu64 " kbytes\n",
-                           info->ram->precopy_bytes >> 10);
-        }
         if (info->ram->downtime_bytes) {
-            monitor_printf(mon, "downtime ram: %" PRIu64 " kbytes\n",
-                           info->ram->downtime_bytes >> 10);
-        }
-        if (info->ram->postcopy_bytes) {
-            monitor_printf(mon, "postcopy ram: %" PRIu64 " kbytes\n",
-                           info->ram->postcopy_bytes >> 10);
+            monitor_printf(mon, ", downtime_ram=%" PRIu64,
+                           info->ram->downtime_bytes);
         }
         if (info->ram->dirty_sync_missed_zero_copy) {
-            monitor_printf(mon,
-                           "Zero-copy-send fallbacks happened: %" PRIu64 " times\n",
+            monitor_printf(mon, ", zerocopy_fallbacks=%" PRIu64,
                            info->ram->dirty_sync_missed_zero_copy);
         }
+        monitor_printf(mon, "\n");
     }
 
+    if (!show_all) {
+        goto out;
+    }
+
+    migration_global_dump(mon);
+
     if (info->xbzrle_cache) {
-        monitor_printf(mon, "cache size: %" PRIu64 " bytes\n",
-                       info->xbzrle_cache->cache_size);
-        monitor_printf(mon, "xbzrle transferred: %" PRIu64 " kbytes\n",
-                       info->xbzrle_cache->bytes >> 10);
-        monitor_printf(mon, "xbzrle pages: %" PRIu64 " pages\n",
-                       info->xbzrle_cache->pages);
-        monitor_printf(mon, "xbzrle cache miss: %" PRIu64 " pages\n",
-                       info->xbzrle_cache->cache_miss);
-        monitor_printf(mon, "xbzrle cache miss rate: %0.2f\n",
-                       info->xbzrle_cache->cache_miss_rate);
-        monitor_printf(mon, "xbzrle encoding rate: %0.2f\n",
-                       info->xbzrle_cache->encoding_rate);
-        monitor_printf(mon, "xbzrle overflow: %" PRIu64 "\n",
+        monitor_printf(mon, "XBZRLE: size=%" PRIu64
+                       ", transferred=%" PRIu64
+                       ", pages=%" PRIu64
+                       ", miss=%" PRIu64 "\n"
+                       "  miss_rate=%0.2f"
+                       ", encode_rate=%0.2f"
+                       ", overflow=%" PRIu64 "\n",
+                       info->xbzrle_cache->cache_size,
+                       info->xbzrle_cache->bytes,
+                       info->xbzrle_cache->pages,
+                       info->xbzrle_cache->cache_miss,
+                       info->xbzrle_cache->cache_miss_rate,
+                       info->xbzrle_cache->encoding_rate,
                        info->xbzrle_cache->overflow);
     }
 
     if (info->has_cpu_throttle_percentage) {
-        monitor_printf(mon, "cpu throttle percentage: %" PRIu64 "\n",
+        monitor_printf(mon, "CPU Throttle (%%): %" PRIu64 "\n",
                        info->cpu_throttle_percentage);
     }
 
     if (info->has_dirty_limit_throttle_time_per_round) {
-        monitor_printf(mon, "dirty-limit throttle time: %" PRIu64 " us\n",
+        monitor_printf(mon, "Dirty-limit Throttle (us): %" PRIu64 "\n",
                        info->dirty_limit_throttle_time_per_round);
     }
 
     if (info->has_dirty_limit_ring_full_time) {
-        monitor_printf(mon, "dirty-limit ring full time: %" PRIu64 " us\n",
+        monitor_printf(mon, "Dirty-limit Ring Full (us): %" PRIu64 "\n",
                        info->dirty_limit_ring_full_time);
     }
 
     if (info->has_postcopy_blocktime) {
-        monitor_printf(mon, "postcopy blocktime: %u\n",
+        monitor_printf(mon, "Postcopy Blocktime (ms): %" PRIu32 "\n",
                        info->postcopy_blocktime);
     }
 
@@ -189,28 +211,12 @@ void hmp_info_migrate(Monitor *mon, const QDict *qdict)
         visit_type_uint32List(v, NULL, &info->postcopy_vcpu_blocktime,
                               &error_abort);
         visit_complete(v, &str);
-        monitor_printf(mon, "postcopy vcpu blocktime: %s\n", str);
+        monitor_printf(mon, "Postcopy vCPU Blocktime: %s\n", str);
         g_free(str);
         visit_free(v);
     }
-    if (info->has_socket_address) {
-        SocketAddressList *addr;
-
-        monitor_printf(mon, "socket address: [\n");
-
-        for (addr = info->socket_address; addr; addr = addr->next) {
-            char *s = socket_uri(addr->value);
-            monitor_printf(mon, "\t%s\n", s);
-            g_free(s);
-        }
-        monitor_printf(mon, "]\n");
-    }
-
-    if (info->vfio) {
-        monitor_printf(mon, "vfio device transferred: %" PRIu64 " kbytes\n",
-                       info->vfio->transferred >> 10);
-    }
 
+out:
     qapi_free_MigrationInfo(info);
 }
 

From e460991883d7209d52d0fdb534d9cd8cce0f9cce Mon Sep 17 00:00:00 2001
From: Alberto Faria <afaria@redhat.com>
Date: Fri, 2 May 2025 13:11:14 +0100
Subject: [PATCH 1065/2760] scsi-disk: Add native FUA write support

Simply propagate the FUA flag on write requests to the driver. The block
layer will emulate it if necessary.

Signed-off-by: Alberto Faria <afaria@redhat.com>
Message-ID: <20250502121115.3613717-2-afaria@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 hw/scsi/scsi-disk.c | 53 +++++++++++++--------------------------------
 1 file changed, 15 insertions(+), 38 deletions(-)

diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c
index cb4af1b715..738d8df8ec 100644
--- a/hw/scsi/scsi-disk.c
+++ b/hw/scsi/scsi-disk.c
@@ -74,7 +74,7 @@ struct SCSIDiskClass {
      */
     DMAIOFunc       *dma_readv;
     DMAIOFunc       *dma_writev;
-    bool            (*need_fua_emulation)(SCSICommand *cmd);
+    bool            (*need_fua)(SCSICommand *cmd);
     void            (*update_sense)(SCSIRequest *r);
 };
 
@@ -85,7 +85,7 @@ typedef struct SCSIDiskReq {
     uint32_t sector_count;
     uint32_t buflen;
     bool started;
-    bool need_fua_emulation;
+    bool need_fua;
     struct iovec iov;
     QEMUIOVector qiov;
     BlockAcctCookie acct;
@@ -389,24 +389,6 @@ static bool scsi_is_cmd_fua(SCSICommand *cmd)
     }
 }
 
-static void scsi_write_do_fua(SCSIDiskReq *r)
-{
-    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
-
-    assert(r->req.aiocb == NULL);
-    assert(!r->req.io_canceled);
-
-    if (r->need_fua_emulation) {
-        block_acct_start(blk_get_stats(s->qdev.conf.blk), &r->acct, 0,
-                         BLOCK_ACCT_FLUSH);
-        r->req.aiocb = blk_aio_flush(s->qdev.conf.blk, scsi_aio_complete, r);
-        return;
-    }
-
-    scsi_req_complete(&r->req, GOOD);
-    scsi_req_unref(&r->req);
-}
-
 static void scsi_dma_complete_noio(SCSIDiskReq *r, int ret)
 {
     assert(r->req.aiocb == NULL);
@@ -416,12 +398,7 @@ static void scsi_dma_complete_noio(SCSIDiskReq *r, int ret)
 
     r->sector += r->sector_count;
     r->sector_count = 0;
-    if (r->req.cmd.mode == SCSI_XFER_TO_DEV) {
-        scsi_write_do_fua(r);
-        return;
-    } else {
-        scsi_req_complete(&r->req, GOOD);
-    }
+    scsi_req_complete(&r->req, GOOD);
 
 done:
     scsi_req_unref(&r->req);
@@ -564,7 +541,7 @@ static void scsi_read_data(SCSIRequest *req)
 
     first = !r->started;
     r->started = true;
-    if (first && r->need_fua_emulation) {
+    if (first && r->need_fua) {
         block_acct_start(blk_get_stats(s->qdev.conf.blk), &r->acct, 0,
                          BLOCK_ACCT_FLUSH);
         r->req.aiocb = blk_aio_flush(s->qdev.conf.blk, scsi_do_read_cb, r);
@@ -589,8 +566,7 @@ static void scsi_write_complete_noio(SCSIDiskReq *r, int ret)
     r->sector += n;
     r->sector_count -= n;
     if (r->sector_count == 0) {
-        scsi_write_do_fua(r);
-        return;
+        scsi_req_complete(&r->req, GOOD);
     } else {
         scsi_init_iovec(r, SCSI_DMA_BUF_SIZE);
         trace_scsi_disk_write_complete_noio(r->req.tag, r->qiov.size);
@@ -623,6 +599,7 @@ static void scsi_write_data(SCSIRequest *req)
     SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
     SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
     SCSIDiskClass *sdc = (SCSIDiskClass *) object_get_class(OBJECT(s));
+    BlockCompletionFunc *cb;
 
     /* No data transfer may already be in progress */
     assert(r->req.aiocb == NULL);
@@ -648,11 +625,10 @@ static void scsi_write_data(SCSIRequest *req)
 
     if (r->req.cmd.buf[0] == VERIFY_10 || r->req.cmd.buf[0] == VERIFY_12 ||
         r->req.cmd.buf[0] == VERIFY_16) {
-        if (r->req.sg) {
-            scsi_dma_complete_noio(r, 0);
-        } else {
-            scsi_write_complete_noio(r, 0);
-        }
+        block_acct_start(blk_get_stats(s->qdev.conf.blk), &r->acct, 0,
+                         BLOCK_ACCT_FLUSH);
+        cb = r->req.sg ? scsi_dma_complete : scsi_write_complete;
+        r->req.aiocb = blk_aio_flush(s->qdev.conf.blk, cb, r);
         return;
     }
 
@@ -2391,7 +2367,7 @@ static int32_t scsi_disk_dma_command(SCSIRequest *req, uint8_t *buf)
         scsi_check_condition(r, SENSE_CODE(LBA_OUT_OF_RANGE));
         return 0;
     }
-    r->need_fua_emulation = sdc->need_fua_emulation(&r->req.cmd);
+    r->need_fua = sdc->need_fua(&r->req.cmd);
     if (r->sector_count == 0) {
         scsi_req_complete(&r->req, GOOD);
     }
@@ -3137,7 +3113,8 @@ BlockAIOCB *scsi_dma_writev(int64_t offset, QEMUIOVector *iov,
 {
     SCSIDiskReq *r = opaque;
     SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
-    return blk_aio_pwritev(s->qdev.conf.blk, offset, iov, 0, cb, cb_opaque);
+    int flags = r->need_fua ? BDRV_REQ_FUA : 0;
+    return blk_aio_pwritev(s->qdev.conf.blk, offset, iov, flags, cb, cb_opaque);
 }
 
 static char *scsi_property_get_loadparm(Object *obj, Error **errp)
@@ -3186,7 +3163,7 @@ static void scsi_disk_base_class_initfn(ObjectClass *klass, const void *data)
     device_class_set_legacy_reset(dc, scsi_disk_reset);
     sdc->dma_readv = scsi_dma_readv;
     sdc->dma_writev = scsi_dma_writev;
-    sdc->need_fua_emulation = scsi_is_cmd_fua;
+    sdc->need_fua  = scsi_is_cmd_fua;
 }
 
 static const TypeInfo scsi_disk_base_info = {
@@ -3338,7 +3315,7 @@ static void scsi_block_class_initfn(ObjectClass *klass, const void *data)
     sdc->dma_readv   = scsi_block_dma_readv;
     sdc->dma_writev  = scsi_block_dma_writev;
     sdc->update_sense = scsi_block_update_sense;
-    sdc->need_fua_emulation = scsi_block_no_fua;
+    sdc->need_fua    = scsi_block_no_fua;
     dc->desc = "SCSI block device passthrough";
     device_class_set_props(dc, scsi_block_properties);
     dc->vmsd  = &vmstate_scsi_disk_state;

From 5562e214e82ae4bcb0b642cc52b304bdc78a58c3 Mon Sep 17 00:00:00 2001
From: Alberto Faria <afaria@redhat.com>
Date: Fri, 2 May 2025 13:11:15 +0100
Subject: [PATCH 1066/2760] scsi-disk: Advertise FUA support by default

Allow the guest to submit FUA requests directly, instead of forcing it
to emulate them using a regular flush.

Signed-off-by: Alberto Faria <afaria@redhat.com>
Message-ID: <20250502121115.3613717-3-afaria@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 hw/core/machine.c   | 4 +++-
 hw/scsi/scsi-disk.c | 2 +-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/hw/core/machine.c b/hw/core/machine.c
index b8ae155dfa..c3f3a5020d 100644
--- a/hw/core/machine.c
+++ b/hw/core/machine.c
@@ -37,7 +37,9 @@
 #include "hw/virtio/virtio-iommu.h"
 #include "audio/audio.h"
 
-GlobalProperty hw_compat_10_0[] = {};
+GlobalProperty hw_compat_10_0[] = {
+    { "scsi-hd", "dpofua", "off" },
+};
 const size_t hw_compat_10_0_len = G_N_ELEMENTS(hw_compat_10_0);
 
 GlobalProperty hw_compat_9_2[] = {
diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c
index 738d8df8ec..b4782c6248 100644
--- a/hw/scsi/scsi-disk.c
+++ b/hw/scsi/scsi-disk.c
@@ -3192,7 +3192,7 @@ static const Property scsi_hd_properties[] = {
     DEFINE_PROP_BIT("removable", SCSIDiskState, features,
                     SCSI_DISK_F_REMOVABLE, false),
     DEFINE_PROP_BIT("dpofua", SCSIDiskState, features,
-                    SCSI_DISK_F_DPOFUA, false),
+                    SCSI_DISK_F_DPOFUA, true),
     DEFINE_PROP_UINT64("wwn", SCSIDiskState, qdev.wwn, 0),
     DEFINE_PROP_UINT64("port_wwn", SCSIDiskState, qdev.port_wwn, 0),
     DEFINE_PROP_UINT16("port_index", SCSIDiskState, port_index, 0),

From 7ed96710e82c385c6cfc3d064eec7dde20f0f3fd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Mon, 27 Jan 2025 18:45:47 +0000
Subject: [PATCH 1067/2760] ui/vnc.c: replace big endian flag with byte order
 value
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

It will make it easier to do certain comparisons in future if we
store G_BIG_ENDIAN/G_LITTLE_ENDIAN directly, instead of a boolean
flag, as we can then compare directly to the G_BYTE_ORDER constant.

Reviewed-by: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 ui/vnc-enc-tight.c | 2 +-
 ui/vnc-enc-zrle.c  | 2 +-
 ui/vnc-jobs.c      | 2 +-
 ui/vnc.c           | 6 +++---
 ui/vnc.h           | 2 +-
 5 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/ui/vnc-enc-tight.c b/ui/vnc-enc-tight.c
index 41f559eb83..f8aaa8f346 100644
--- a/ui/vnc-enc-tight.c
+++ b/ui/vnc-enc-tight.c
@@ -150,7 +150,7 @@ tight_detect_smooth_image24(VncState *vs, int w, int h)
      * If client is big-endian, color samples begin from the second
      * byte (offset 1) of a 32-bit pixel value.
      */
-    off = vs->client_be;
+    off = vs->client_endian == G_BIG_ENDIAN ? 1 : 0;
 
     memset(stats, 0, sizeof (stats));
 
diff --git a/ui/vnc-enc-zrle.c b/ui/vnc-enc-zrle.c
index bd33b89063..97ec6c7119 100644
--- a/ui/vnc-enc-zrle.c
+++ b/ui/vnc-enc-zrle.c
@@ -255,7 +255,7 @@ static void zrle_write_u8(VncState *vs, uint8_t value)
 static int zrle_send_framebuffer_update(VncState *vs, int x, int y,
                                         int w, int h)
 {
-    bool be = vs->client_be;
+    bool be = vs->client_endian == G_BIG_ENDIAN;
     size_t bytes;
     int zywrle_level;
 
diff --git a/ui/vnc-jobs.c b/ui/vnc-jobs.c
index fcca7ec632..d3486af9e2 100644
--- a/ui/vnc-jobs.c
+++ b/ui/vnc-jobs.c
@@ -188,7 +188,7 @@ static void vnc_async_encoding_start(VncState *orig, VncState *local)
     local->lossy_rect = orig->lossy_rect;
     local->write_pixels = orig->write_pixels;
     local->client_pf = orig->client_pf;
-    local->client_be = orig->client_be;
+    local->client_endian = orig->client_endian;
     local->tight = orig->tight;
     local->zlib = orig->zlib;
     local->hextile = orig->hextile;
diff --git a/ui/vnc.c b/ui/vnc.c
index 9e097dc4b4..ab18172c4d 100644
--- a/ui/vnc.c
+++ b/ui/vnc.c
@@ -891,7 +891,7 @@ void vnc_convert_pixel(VncState *vs, uint8_t *buf, uint32_t v)
         buf[0] = v;
         break;
     case 2:
-        if (vs->client_be) {
+        if (vs->client_endian == G_BIG_ENDIAN) {
             buf[0] = v >> 8;
             buf[1] = v;
         } else {
@@ -901,7 +901,7 @@ void vnc_convert_pixel(VncState *vs, uint8_t *buf, uint32_t v)
         break;
     default:
     case 4:
-        if (vs->client_be) {
+        if (vs->client_endian == G_BIG_ENDIAN) {
             buf[0] = v >> 24;
             buf[1] = v >> 16;
             buf[2] = v >> 8;
@@ -2312,7 +2312,7 @@ static void set_pixel_format(VncState *vs, int bits_per_pixel,
     vs->client_pf.bits_per_pixel = bits_per_pixel;
     vs->client_pf.bytes_per_pixel = bits_per_pixel / 8;
     vs->client_pf.depth = bits_per_pixel == 32 ? 24 : bits_per_pixel;
-    vs->client_be = big_endian_flag;
+    vs->client_endian = big_endian_flag ? G_BIG_ENDIAN : G_LITTLE_ENDIAN;
 
     if (!true_color_flag) {
         send_color_map(vs);
diff --git a/ui/vnc.h b/ui/vnc.h
index acc53a2cc1..02613aa63a 100644
--- a/ui/vnc.h
+++ b/ui/vnc.h
@@ -323,7 +323,7 @@ struct VncState
     VncWritePixels *write_pixels;
     PixelFormat client_pf;
     pixman_format_code_t client_format;
-    bool client_be;
+    int client_endian; /* G_LITTLE_ENDIAN or G_BIG_ENDIAN */
 
     CaptureVoiceOut *audio_cap;
     struct audsettings as;

From 70097442853c389a765c9f6502d861d182b092ae Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Mon, 27 Jan 2025 18:48:50 +0000
Subject: [PATCH 1068/2760] ui/vnc: take account of client byte order in pixman
 format
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The set_pixel_conversion() method is responsible for determining whether
the VNC client pixel format matches the server format, and thus whether
we can use the fast path "copy" impl for sending pixels, or must use
the generic impl with bit swizzling.

The VNC server format is set at build time to VNC_SERVER_FB_FORMAT,
which corresponds to PIXMAN_x8r8g8b8.

The qemu_pixman_get_format() method is then responsible for converting
the VNC pixel format into a pixman format.

The VNC client pixel shifts are relative to the associated endianness.

The pixman formats are always relative to the host native endianness.

The qemu_pixman_get_format() method does not take into account the
VNC client endianness, and is thus returning a pixman format that is
only valid with the host endianness matches that of the VNC client.

This has been broken since pixman was introduced to the VNC server:

  commit 9f64916da20eea67121d544698676295bbb105a7
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   Wed Oct 10 13:29:43 2012 +0200

    pixman/vnc: use pixman images in vnc.

The flaw can be demonstrated using the Tigervnc client by using

   vncviewer -AutoSelect=0 -PreferredEncoding=raw server:display

connecting from a LE client to a QEMU on a BE server, or the
reverse.

The bug was masked, however, because almost all VNC clients will
advertize support for the "tight" encoding and the QEMU VNC server
will prefer "tight" if advertized.

The tight_pack24 method is responsible for taking a set of pixels
which have already been converted into client endianness and then
repacking them into the TPIXEL format which the RFB spec defines
as

  "TPIXEL is only 3 bytes long, where the first byte is the
   red component, the second byte is the green component,
   and the third byte is the blue component of the pixel
   color value"

IOW, the TPIXEL format is fixed on the wire, regardless of what
the VNC client declare as its endianness.

Since the VNC pixel encoding code was failing to honour the endian
flag of the client, the tight_pack24 method was always operating
on data in native endianness. Its impl cancelled out the VNC pixel
encoding bug.

With the VNC pixel encoding code now fixed, the tight_pack24 method
needs to take into account that it is operating on data in client
endianness, not native endianness. It thus may need to invert the
pixel shifts.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 include/ui/qemu-pixman.h |  4 ++--
 ui/qemu-pixman.c         | 15 ++++++++-------
 ui/vnc-enc-tight.c       |  2 +-
 ui/vnc.c                 |  3 ++-
 4 files changed, 13 insertions(+), 11 deletions(-)

diff --git a/include/ui/qemu-pixman.h b/include/ui/qemu-pixman.h
index 193bc046d1..2ca0ed7029 100644
--- a/include/ui/qemu-pixman.h
+++ b/include/ui/qemu-pixman.h
@@ -75,12 +75,12 @@ PixelFormat qemu_pixelformat_from_pixman(pixman_format_code_t format);
 pixman_format_code_t qemu_default_pixman_format(int bpp, bool native_endian);
 pixman_format_code_t qemu_drm_format_to_pixman(uint32_t drm_format);
 uint32_t qemu_pixman_to_drm_format(pixman_format_code_t pixman);
-int qemu_pixman_get_type(int rshift, int gshift, int bshift);
+int qemu_pixman_get_type(int rshift, int gshift, int bshift, int endian);
 bool qemu_pixman_check_format(DisplayChangeListener *dcl,
                               pixman_format_code_t format);
 
 #ifdef CONFIG_PIXMAN
-pixman_format_code_t qemu_pixman_get_format(PixelFormat *pf);
+pixman_format_code_t qemu_pixman_get_format(PixelFormat *pf, int endian);
 pixman_image_t *qemu_pixman_linebuf_create(pixman_format_code_t format,
                                            int width);
 void qemu_pixman_linebuf_fill(pixman_image_t *linebuf, pixman_image_t *fb,
diff --git a/ui/qemu-pixman.c b/ui/qemu-pixman.c
index 6ef4376f4e..ef4e71da11 100644
--- a/ui/qemu-pixman.c
+++ b/ui/qemu-pixman.c
@@ -126,33 +126,34 @@ uint32_t qemu_pixman_to_drm_format(pixman_format_code_t pixman_format)
     return 0;
 }
 
-int qemu_pixman_get_type(int rshift, int gshift, int bshift)
+int qemu_pixman_get_type(int rshift, int gshift, int bshift, int endian)
 {
     int type = PIXMAN_TYPE_OTHER;
+    bool native_endian = (endian == G_BYTE_ORDER);
 
     if (rshift > gshift && gshift > bshift) {
         if (bshift == 0) {
-            type = PIXMAN_TYPE_ARGB;
+            type = native_endian ? PIXMAN_TYPE_ARGB : PIXMAN_TYPE_BGRA;
         } else {
-            type = PIXMAN_TYPE_RGBA;
+            type = native_endian ? PIXMAN_TYPE_RGBA : PIXMAN_TYPE_ABGR;
         }
     } else if (rshift < gshift && gshift < bshift) {
         if (rshift == 0) {
-            type = PIXMAN_TYPE_ABGR;
+            type = native_endian ? PIXMAN_TYPE_ABGR : PIXMAN_TYPE_RGBA;
         } else {
-            type = PIXMAN_TYPE_BGRA;
+            type = native_endian ? PIXMAN_TYPE_BGRA : PIXMAN_TYPE_ARGB;
         }
     }
     return type;
 }
 
 #ifdef CONFIG_PIXMAN
-pixman_format_code_t qemu_pixman_get_format(PixelFormat *pf)
+pixman_format_code_t qemu_pixman_get_format(PixelFormat *pf, int endian)
 {
     pixman_format_code_t format;
     int type;
 
-    type = qemu_pixman_get_type(pf->rshift, pf->gshift, pf->bshift);
+    type = qemu_pixman_get_type(pf->rshift, pf->gshift, pf->bshift, endian);
     format = PIXMAN_FORMAT(pf->bits_per_pixel, type,
                            pf->abits, pf->rbits, pf->gbits, pf->bbits);
     if (!pixman_format_supported_source(format)) {
diff --git a/ui/vnc-enc-tight.c b/ui/vnc-enc-tight.c
index f8aaa8f346..a5bdc19ebb 100644
--- a/ui/vnc-enc-tight.c
+++ b/ui/vnc-enc-tight.c
@@ -891,7 +891,7 @@ static void tight_pack24(VncState *vs, uint8_t *buf, size_t count, size_t *ret)
 
     buf8 = buf;
 
-    if (1 /* FIXME */) {
+    if (vs->client_endian == G_BYTE_ORDER) {
         rshift = vs->client_pf.rshift;
         gshift = vs->client_pf.gshift;
         bshift = vs->client_pf.bshift;
diff --git a/ui/vnc.c b/ui/vnc.c
index ab18172c4d..d095cd7da3 100644
--- a/ui/vnc.c
+++ b/ui/vnc.c
@@ -2240,7 +2240,8 @@ static void set_encodings(VncState *vs, int32_t *encodings, size_t n_encodings)
 
 static void set_pixel_conversion(VncState *vs)
 {
-    pixman_format_code_t fmt = qemu_pixman_get_format(&vs->client_pf);
+    pixman_format_code_t fmt = qemu_pixman_get_format(&vs->client_pf,
+                                                      vs->client_endian);
 
     if (fmt == VNC_SERVER_FB_FORMAT) {
         vs->write_pixels = vnc_write_pixels_copy;

From 63d320909220a90647c484263ae5e2f26eb54587 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 28 Jan 2025 13:27:25 +0000
Subject: [PATCH 1069/2760] ui/vnc: fix tight palette pixel encoding for
 8/16-bpp formats
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When sending a tight rectangle with the palette filter, if the client
format was 8/16bpp, the colours on big endian hosts are not set as
we're sending the wrong bytes. We must first cast the 32-bit colour
to a 16/8-bit value, and then send the result.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 ui/vnc-enc-tight.c | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/ui/vnc-enc-tight.c b/ui/vnc-enc-tight.c
index a5bdc19ebb..25c7b2c788 100644
--- a/ui/vnc-enc-tight.c
+++ b/ui/vnc-enc-tight.c
@@ -1001,16 +1001,24 @@ static int send_mono_rect(VncState *vs, int x, int y,
         break;
     }
     case 2:
-        vnc_write(vs, &bg, 2);
-        vnc_write(vs, &fg, 2);
+    {
+        uint16_t bg16 = bg;
+        uint16_t fg16 = fg;
+        vnc_write(vs, &bg16, 2);
+        vnc_write(vs, &fg16, 2);
         tight_encode_mono_rect16(vs->tight->tight.buffer, w, h, bg, fg);
         break;
+    }
     default:
-        vnc_write_u8(vs, bg);
-        vnc_write_u8(vs, fg);
+    {
+        uint8_t bg8 = bg;
+        uint8_t fg8 = fg;
+        vnc_write_u8(vs, bg8);
+        vnc_write_u8(vs, fg8);
         tight_encode_mono_rect8(vs->tight->tight.buffer, w, h, bg, fg);
         break;
     }
+    }
     vs->tight->tight.offset = bytes;
 
     bytes = tight_compress_data(vs, stream, bytes, level, Z_DEFAULT_STRATEGY);

From 212c217f7d540fdbf1df4b65653ad5592073bb8e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Wed, 7 May 2025 15:37:28 +0100
Subject: [PATCH 1070/2760] tests: skip encrypted secret tests if AES is not
 available
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This avoids test breakage when we drop support for using the
built-in AES impl as a fallback for missing crypto libraries.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 tests/unit/test-crypto-secret.c | 28 ++++++++++++++++------------
 1 file changed, 16 insertions(+), 12 deletions(-)

diff --git a/tests/unit/test-crypto-secret.c b/tests/unit/test-crypto-secret.c
index ffd13ff70e..fc32a01747 100644
--- a/tests/unit/test-crypto-secret.c
+++ b/tests/unit/test-crypto-secret.c
@@ -22,6 +22,7 @@
 
 #include "crypto/init.h"
 #include "crypto/secret.h"
+#include "crypto/cipher.h"
 #include "qapi/error.h"
 #include "qemu/module.h"
 #if defined(CONFIG_KEYUTILS) && defined(CONFIG_SECRET_KEYRING)
@@ -597,18 +598,21 @@ int main(int argc, char **argv)
     g_test_add_func("/crypto/secret/conv/utf8/base64",
                     test_secret_conv_utf8_base64);
 
-    g_test_add_func("/crypto/secret/crypt/raw",
-                    test_secret_crypt_raw);
-    g_test_add_func("/crypto/secret/crypt/base64",
-                    test_secret_crypt_base64);
-    g_test_add_func("/crypto/secret/crypt/shortkey",
-                    test_secret_crypt_short_key);
-    g_test_add_func("/crypto/secret/crypt/shortiv",
-                    test_secret_crypt_short_iv);
-    g_test_add_func("/crypto/secret/crypt/missingiv",
-                    test_secret_crypt_missing_iv);
-    g_test_add_func("/crypto/secret/crypt/badiv",
-                    test_secret_crypt_bad_iv);
+    if (qcrypto_cipher_supports(QCRYPTO_CIPHER_ALGO_AES_128,
+                                QCRYPTO_CIPHER_MODE_CBC)) {
+        g_test_add_func("/crypto/secret/crypt/raw",
+                        test_secret_crypt_raw);
+        g_test_add_func("/crypto/secret/crypt/base64",
+                        test_secret_crypt_base64);
+        g_test_add_func("/crypto/secret/crypt/shortkey",
+                        test_secret_crypt_short_key);
+        g_test_add_func("/crypto/secret/crypt/shortiv",
+                        test_secret_crypt_short_iv);
+        g_test_add_func("/crypto/secret/crypt/missingiv",
+                        test_secret_crypt_missing_iv);
+        g_test_add_func("/crypto/secret/crypt/badiv",
+                        test_secret_crypt_bad_iv);
+    }
 
     return g_test_run();
 }

From 75134a32851e2d9f240097cc7a3bc3426667e147 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Wed, 7 May 2025 15:47:18 +0100
Subject: [PATCH 1071/2760] tests: skip legacy qcow2 encryption test if AES is
 not available
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This avoids test breakage when we drop support for using the
built-in AES impl as a fallback for missing crypto libraries.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 tests/unit/test-crypto-block.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/tests/unit/test-crypto-block.c b/tests/unit/test-crypto-block.c
index 9217b9a2ef..3ac7f17b2a 100644
--- a/tests/unit/test-crypto-block.c
+++ b/tests/unit/test-crypto-block.c
@@ -574,6 +574,13 @@ int main(int argc, char **argv)
     for (i = 0; i < G_N_ELEMENTS(test_data); i++) {
         if (test_data[i].open_opts->format == QCRYPTO_BLOCK_FORMAT_LUKS &&
             !qcrypto_hash_supports(test_data[i].hash_alg)) {
+            g_printerr("# skip unsupported %s\n",
+                       QCryptoHashAlgo_str(test_data[i].hash_alg));
+            continue;
+        }
+        if (!qcrypto_cipher_supports(QCRYPTO_CIPHER_ALGO_AES_128,
+                                     QCRYPTO_CIPHER_MODE_CBC)) {
+            g_printerr("# skip unsupported aes-128:cbc\n");
             continue;
         }
         if (!test_data[i].slow ||

From 01ce649e5d260d4d1a466d10dfaeabeeb2b7478d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Wed, 7 May 2025 15:48:31 +0100
Subject: [PATCH 1072/2760] tests: fix skipping cipher tests when AES is not
 available
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This avoid tests breakage when we drop support for using the
built-in AES impl as a fallback for missing crypto libraries.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 tests/unit/test-crypto-cipher.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/tests/unit/test-crypto-cipher.c b/tests/unit/test-crypto-cipher.c
index b328b482e1..1331d558cf 100644
--- a/tests/unit/test-crypto-cipher.c
+++ b/tests/unit/test-crypto-cipher.c
@@ -828,11 +828,16 @@ int main(int argc, char **argv)
         }
     }
 
-    g_test_add_func("/crypto/cipher/null-iv",
-                    test_cipher_null_iv);
+    if (qcrypto_cipher_supports(QCRYPTO_CIPHER_ALGO_AES_256,
+                                QCRYPTO_CIPHER_MODE_CBC)) {
+        g_test_add_func("/crypto/cipher/null-iv",
+                        test_cipher_null_iv);
 
-    g_test_add_func("/crypto/cipher/short-plaintext",
-                    test_cipher_short_plaintext);
+        g_test_add_func("/crypto/cipher/short-plaintext",
+                        test_cipher_short_plaintext);
+    } else {
+        g_printerr("# skip unsupported aes-256:cbc\n");
+    }
 
     return g_test_run();
 }

From 5a56f60d7c2e241bf972b8eca31286cf7f3cd7c1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 6 May 2025 15:07:08 +0100
Subject: [PATCH 1073/2760] crypto: fully drop built-in cipher provider
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When originally creating the internal crypto cipher APIs, they were
wired up to use the built-in D3DES and AES implementations, as a way
to gracefully transition to the new APIs without introducing an
immediate hard dep on any external crypto libraries for the VNC
password auth (D3DES) or the qcow2 encryption (AES).

In the 6.1.0 release we dropped the built-in D3DES impl, and also
the XTS mode for the AES impl, leaving only AES with ECB/CBC modes.
The rational was that with the system emulators, it is expected that
3rd party crypto libraries will be available.

The qcow2 LUKS impl is preferred to the legacy raw AES impl, and by
default that requires AES in XTS mode, limiting the usefulness of
the built-in cipher provider.

The built-in AES impl has known timing attacks and is only suitable
for use cases where a security boundary is already not expected to
be provided (TCG).

Providing a built-in cipher impl thus potentially misleads users,
should they configure a QEMU without any crypto library, and try
to use it with the LUKS backend, even if that requires a non-default
configuration choice.

Complete what we started in 6.1.0 and purge the remaining AES
support.

Use of either gnutls, nettle, or libcrypt is now mandatory for any
cipher support, except for TCG impls.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 crypto/cipher-builtin.c.inc | 303 ------------------------------------
 crypto/cipher-stub.c.inc    |  30 ++++
 crypto/cipher.c             |   2 +-
 3 files changed, 31 insertions(+), 304 deletions(-)
 delete mode 100644 crypto/cipher-builtin.c.inc
 create mode 100644 crypto/cipher-stub.c.inc

diff --git a/crypto/cipher-builtin.c.inc b/crypto/cipher-builtin.c.inc
deleted file mode 100644
index da5fcbd9a3..0000000000
--- a/crypto/cipher-builtin.c.inc
+++ /dev/null
@@ -1,303 +0,0 @@
-/*
- * QEMU Crypto cipher built-in algorithms
- *
- * Copyright (c) 2015 Red Hat, Inc.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-#include "crypto/aes.h"
-
-typedef struct QCryptoCipherBuiltinAESContext QCryptoCipherBuiltinAESContext;
-struct QCryptoCipherBuiltinAESContext {
-    AES_KEY enc;
-    AES_KEY dec;
-};
-
-typedef struct QCryptoCipherBuiltinAES QCryptoCipherBuiltinAES;
-struct QCryptoCipherBuiltinAES {
-    QCryptoCipher base;
-    QCryptoCipherBuiltinAESContext key;
-    uint8_t iv[AES_BLOCK_SIZE];
-};
-
-
-static inline bool qcrypto_length_check(size_t len, size_t blocksize,
-                                        Error **errp)
-{
-    if (unlikely(len & (blocksize - 1))) {
-        error_setg(errp, "Length %zu must be a multiple of block size %zu",
-                   len, blocksize);
-        return false;
-    }
-    return true;
-}
-
-static void qcrypto_cipher_ctx_free(QCryptoCipher *cipher)
-{
-    g_free(cipher);
-}
-
-static int qcrypto_cipher_no_setiv(QCryptoCipher *cipher,
-                                   const uint8_t *iv, size_t niv,
-                                   Error **errp)
-{
-    error_setg(errp, "Setting IV is not supported");
-    return -1;
-}
-
-static void do_aes_encrypt_ecb(const void *vctx,
-                               size_t len,
-                               uint8_t *out,
-                               const uint8_t *in)
-{
-    const QCryptoCipherBuiltinAESContext *ctx = vctx;
-
-    /* We have already verified that len % AES_BLOCK_SIZE == 0. */
-    while (len) {
-        AES_encrypt(in, out, &ctx->enc);
-        in += AES_BLOCK_SIZE;
-        out += AES_BLOCK_SIZE;
-        len -= AES_BLOCK_SIZE;
-    }
-}
-
-static void do_aes_decrypt_ecb(const void *vctx,
-                               size_t len,
-                               uint8_t *out,
-                               const uint8_t *in)
-{
-    const QCryptoCipherBuiltinAESContext *ctx = vctx;
-
-    /* We have already verified that len % AES_BLOCK_SIZE == 0. */
-    while (len) {
-        AES_decrypt(in, out, &ctx->dec);
-        in += AES_BLOCK_SIZE;
-        out += AES_BLOCK_SIZE;
-        len -= AES_BLOCK_SIZE;
-    }
-}
-
-static void do_aes_encrypt_cbc(const AES_KEY *key,
-                               size_t len,
-                               uint8_t *out,
-                               const uint8_t *in,
-                               uint8_t *ivec)
-{
-    uint8_t tmp[AES_BLOCK_SIZE];
-    size_t n;
-
-    /* We have already verified that len % AES_BLOCK_SIZE == 0. */
-    while (len) {
-        for (n = 0; n < AES_BLOCK_SIZE; ++n) {
-            tmp[n] = in[n] ^ ivec[n];
-        }
-        AES_encrypt(tmp, out, key);
-        memcpy(ivec, out, AES_BLOCK_SIZE);
-        len -= AES_BLOCK_SIZE;
-        in += AES_BLOCK_SIZE;
-        out += AES_BLOCK_SIZE;
-    }
-}
-
-static void do_aes_decrypt_cbc(const AES_KEY *key,
-                               size_t len,
-                               uint8_t *out,
-                               const uint8_t *in,
-                               uint8_t *ivec)
-{
-    uint8_t tmp[AES_BLOCK_SIZE];
-    size_t n;
-
-    /* We have already verified that len % AES_BLOCK_SIZE == 0. */
-    while (len) {
-        memcpy(tmp, in, AES_BLOCK_SIZE);
-        AES_decrypt(in, out, key);
-        for (n = 0; n < AES_BLOCK_SIZE; ++n) {
-            out[n] ^= ivec[n];
-        }
-        memcpy(ivec, tmp, AES_BLOCK_SIZE);
-        len -= AES_BLOCK_SIZE;
-        in += AES_BLOCK_SIZE;
-        out += AES_BLOCK_SIZE;
-    }
-}
-
-static int qcrypto_cipher_aes_encrypt_ecb(QCryptoCipher *cipher,
-                                          const void *in, void *out,
-                                          size_t len, Error **errp)
-{
-    QCryptoCipherBuiltinAES *ctx
-        = container_of(cipher, QCryptoCipherBuiltinAES, base);
-
-    if (!qcrypto_length_check(len, AES_BLOCK_SIZE, errp)) {
-        return -1;
-    }
-    do_aes_encrypt_ecb(&ctx->key, len, out, in);
-    return 0;
-}
-
-static int qcrypto_cipher_aes_decrypt_ecb(QCryptoCipher *cipher,
-                                          const void *in, void *out,
-                                          size_t len, Error **errp)
-{
-    QCryptoCipherBuiltinAES *ctx
-        = container_of(cipher, QCryptoCipherBuiltinAES, base);
-
-    if (!qcrypto_length_check(len, AES_BLOCK_SIZE, errp)) {
-        return -1;
-    }
-    do_aes_decrypt_ecb(&ctx->key, len, out, in);
-    return 0;
-}
-
-static int qcrypto_cipher_aes_encrypt_cbc(QCryptoCipher *cipher,
-                                          const void *in, void *out,
-                                          size_t len, Error **errp)
-{
-    QCryptoCipherBuiltinAES *ctx
-        = container_of(cipher, QCryptoCipherBuiltinAES, base);
-
-    if (!qcrypto_length_check(len, AES_BLOCK_SIZE, errp)) {
-        return -1;
-    }
-    do_aes_encrypt_cbc(&ctx->key.enc, len, out, in, ctx->iv);
-    return 0;
-}
-
-static int qcrypto_cipher_aes_decrypt_cbc(QCryptoCipher *cipher,
-                                          const void *in, void *out,
-                                          size_t len, Error **errp)
-{
-    QCryptoCipherBuiltinAES *ctx
-        = container_of(cipher, QCryptoCipherBuiltinAES, base);
-
-    if (!qcrypto_length_check(len, AES_BLOCK_SIZE, errp)) {
-        return -1;
-    }
-    do_aes_decrypt_cbc(&ctx->key.dec, len, out, in, ctx->iv);
-    return 0;
-}
-
-static int qcrypto_cipher_aes_setiv(QCryptoCipher *cipher, const uint8_t *iv,
-                             size_t niv, Error **errp)
-{
-    QCryptoCipherBuiltinAES *ctx
-        = container_of(cipher, QCryptoCipherBuiltinAES, base);
-
-    if (niv != AES_BLOCK_SIZE) {
-        error_setg(errp, "IV must be %d bytes not %zu",
-                   AES_BLOCK_SIZE, niv);
-        return -1;
-    }
-
-    memcpy(ctx->iv, iv, AES_BLOCK_SIZE);
-    return 0;
-}
-
-static const struct QCryptoCipherDriver qcrypto_cipher_aes_driver_ecb = {
-    .cipher_encrypt = qcrypto_cipher_aes_encrypt_ecb,
-    .cipher_decrypt = qcrypto_cipher_aes_decrypt_ecb,
-    .cipher_setiv = qcrypto_cipher_no_setiv,
-    .cipher_free = qcrypto_cipher_ctx_free,
-};
-
-static const struct QCryptoCipherDriver qcrypto_cipher_aes_driver_cbc = {
-    .cipher_encrypt = qcrypto_cipher_aes_encrypt_cbc,
-    .cipher_decrypt = qcrypto_cipher_aes_decrypt_cbc,
-    .cipher_setiv = qcrypto_cipher_aes_setiv,
-    .cipher_free = qcrypto_cipher_ctx_free,
-};
-
-bool qcrypto_cipher_supports(QCryptoCipherAlgo alg,
-                             QCryptoCipherMode mode)
-{
-    switch (alg) {
-    case QCRYPTO_CIPHER_ALGO_AES_128:
-    case QCRYPTO_CIPHER_ALGO_AES_192:
-    case QCRYPTO_CIPHER_ALGO_AES_256:
-        switch (mode) {
-        case QCRYPTO_CIPHER_MODE_ECB:
-        case QCRYPTO_CIPHER_MODE_CBC:
-            return true;
-        default:
-            return false;
-        }
-        break;
-    default:
-        return false;
-    }
-}
-
-static QCryptoCipher *qcrypto_cipher_ctx_new(QCryptoCipherAlgo alg,
-                                             QCryptoCipherMode mode,
-                                             const uint8_t *key,
-                                             size_t nkey,
-                                             Error **errp)
-{
-    if (!qcrypto_cipher_validate_key_length(alg, mode, nkey, errp)) {
-        return NULL;
-    }
-
-    switch (alg) {
-    case QCRYPTO_CIPHER_ALGO_AES_128:
-    case QCRYPTO_CIPHER_ALGO_AES_192:
-    case QCRYPTO_CIPHER_ALGO_AES_256:
-        {
-            QCryptoCipherBuiltinAES *ctx;
-            const QCryptoCipherDriver *drv;
-
-            switch (mode) {
-            case QCRYPTO_CIPHER_MODE_ECB:
-                drv = &qcrypto_cipher_aes_driver_ecb;
-                break;
-            case QCRYPTO_CIPHER_MODE_CBC:
-                drv = &qcrypto_cipher_aes_driver_cbc;
-                break;
-            default:
-                goto bad_mode;
-            }
-
-            ctx = g_new0(QCryptoCipherBuiltinAES, 1);
-            ctx->base.driver = drv;
-
-            if (AES_set_encrypt_key(key, nkey * 8, &ctx->key.enc)) {
-                error_setg(errp, "Failed to set encryption key");
-                goto error;
-            }
-            if (AES_set_decrypt_key(key, nkey * 8, &ctx->key.dec)) {
-                error_setg(errp, "Failed to set decryption key");
-                goto error;
-            }
-
-            return &ctx->base;
-
-        error:
-            g_free(ctx);
-            return NULL;
-        }
-
-    default:
-        error_setg(errp,
-                   "Unsupported cipher algorithm %s",
-                   QCryptoCipherAlgo_str(alg));
-        return NULL;
-    }
-
- bad_mode:
-    error_setg(errp, "Unsupported cipher mode %s",
-               QCryptoCipherMode_str(mode));
-    return NULL;
-}
diff --git a/crypto/cipher-stub.c.inc b/crypto/cipher-stub.c.inc
new file mode 100644
index 0000000000..1b7ea81eac
--- /dev/null
+++ b/crypto/cipher-stub.c.inc
@@ -0,0 +1,30 @@
+/*
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ *
+ * QEMU Crypto cipher impl stub
+ *
+ * Copyright (c) 2025 Red Hat, Inc.
+ *
+ */
+
+bool qcrypto_cipher_supports(QCryptoCipherAlgo alg,
+                             QCryptoCipherMode mode)
+{
+    return false;
+}
+
+static QCryptoCipher *qcrypto_cipher_ctx_new(QCryptoCipherAlgo alg,
+                                             QCryptoCipherMode mode,
+                                             const uint8_t *key,
+                                             size_t nkey,
+                                             Error **errp)
+{
+    if (!qcrypto_cipher_validate_key_length(alg, mode, nkey, errp)) {
+        return NULL;
+    }
+
+    error_setg(errp,
+               "Unsupported cipher algorithm %s, no crypto library enabled in build",
+               QCryptoCipherAlgo_str(alg));
+    return NULL;
+}
diff --git a/crypto/cipher.c b/crypto/cipher.c
index c14a8b8a11..229710f76b 100644
--- a/crypto/cipher.c
+++ b/crypto/cipher.c
@@ -145,7 +145,7 @@ qcrypto_cipher_validate_key_length(QCryptoCipherAlgo alg,
 #elif defined CONFIG_GNUTLS_CRYPTO
 #include "cipher-gnutls.c.inc"
 #else
-#include "cipher-builtin.c.inc"
+#include "cipher-stub.c.inc"
 #endif
 
 QCryptoCipher *qcrypto_cipher_new(QCryptoCipherAlgo alg,

From 66411ab48b3676894903148406db12a446445adc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Thu, 8 May 2025 17:40:33 +0100
Subject: [PATCH 1074/2760] Revert "scripts: mandate that new files have
 SPDX-License-Identifier"
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This reverts commit fa4d79c64dae03ffa269e42e21822453856618b7.

The logic in this commit was flawed in two critical ways

 * It always failed to report SPDX validation on the last newly
   added file. IOW, it only worked if at least 2 new files were
   added in a commit

 * If an existing file change, followed a new file change, in
   the commit and the existing file context/changed lines
   included SPDX-License-Identifier, it would incorrectly
   associate this with the previous newly added file.

Simply reverting this commit will make it significantly easier to
understand the improved logic in the following commit.

Reported-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 scripts/checkpatch.pl | 30 ------------------------------
 1 file changed, 30 deletions(-)

diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index 365892de04..d355c0dad5 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -1442,8 +1442,6 @@ sub process {
 	my $in_imported_file = 0;
 	my $in_no_imported_file = 0;
 	my $non_utf8_charset = 0;
-	my $expect_spdx = 0;
-	my $expect_spdx_file;
 
 	our @report = ();
 	our $cnt_lines = 0;
@@ -1681,34 +1679,6 @@ sub process {
 			WARN("added, moved or deleted file(s), does MAINTAINERS need updating?\n" . $herecurr);
 		}
 
-# All new files should have a SPDX-License-Identifier tag
-		if ($line =~ /^new file mode\s*\d+\s*$/) {
-		    if ($expect_spdx) {
-			if ($expect_spdx_file =~
-			    /\.(c|h|py|pl|sh|json|inc|Makefile)$/) {
-			    # source code files MUST have SPDX license declared
-			    ERROR("New file '$expect_spdx_file' requires " .
-				  "'SPDX-License-Identifier'");
-			} else {
-			    # Other files MAY have SPDX license if appropriate
-			    WARN("Does new file '$expect_spdx_file' need " .
-				 "'SPDX-License-Identifier'?");
-			}
-		    }
-		    $expect_spdx = 1;
-		    $expect_spdx_file = undef;
-		} elsif ($expect_spdx) {
-		    $expect_spdx_file = $realfile unless
-			defined $expect_spdx_file;
-
-		    # SPDX tags may occurr in comments which were
-		    # stripped from '$line', so use '$rawline'
-		    if ($rawline =~ /SPDX-License-Identifier/) {
-			$expect_spdx = 0;
-			$expect_spdx_file = undef;
-		    }
-		}
-
 # Check SPDX-License-Identifier references a permitted license
 		if ($rawline =~ m,SPDX-License-Identifier: (.*?)(\*/)?\s*$,) {
 		    &checkspdx($realfile, $1);

From 619bf37594e362131f12b42888e6a35ddee488e0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Mon, 12 May 2025 18:11:58 +0100
Subject: [PATCH 1075/2760] scripts/checkpatch.pl: fix various indentation
 mistakes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Various checks in the code were under-indented relative to other
surrounding code. Some places used 4-space indents instead of
single tab, while other places simply used too few tabs.

Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 scripts/checkpatch.pl | 103 ++++++++++++++++++++++--------------------
 1 file changed, 53 insertions(+), 50 deletions(-)

diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index d355c0dad5..2c19f6f0f2 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -1681,19 +1681,20 @@ sub process {
 
 # Check SPDX-License-Identifier references a permitted license
 		if ($rawline =~ m,SPDX-License-Identifier: (.*?)(\*/)?\s*$,) {
-		    &checkspdx($realfile, $1);
+			&checkspdx($realfile, $1);
 		}
 
 		if ($rawline =~ m,(SPDX-[a-zA-Z0-9-_]+):,) {
-		    my $tag = $1;
-		    my @permitted = qw(
-			SPDX-License-Identifier
-		    );
+			my $tag = $1;
+			my @permitted = qw(
+				SPDX-License-Identifier
+			);
 
-		    unless (grep { /^$tag$/ } @permitted) {
-			ERROR("Tag $tag not permitted in QEMU code, valid " .
-			      "choices are: " . join(", ", @permitted));
-		    }
+			unless (grep { /^$tag$/ } @permitted) {
+			    ERROR("Tag $tag not permitted in QEMU code, " .
+				  "valid choices are: " .
+				  join(", ", @permitted));
+			}
 		}
 
 # Check for wrappage within a valid hunk of the file
@@ -2274,7 +2275,7 @@ sub process {
 
 # missing space after union, struct or enum definition
 		if ($line =~ /^.\s*(?:typedef\s+)?(enum|union|struct)(?:\s+$Ident)?(?:\s+$Ident)?[=\{]/) {
-		    ERROR("missing space after $1 definition\n" . $herecurr);
+			ERROR("missing space after $1 definition\n" . $herecurr);
 		}
 
 # check for spacing round square brackets; allowed:
@@ -2569,7 +2570,7 @@ sub process {
 
 		if ($line =~ /^.\s*(Q(?:S?LIST|SIMPLEQ|TAILQ)_HEAD)\s*\(\s*[^,]/ &&
 		    $line !~ /^.typedef/) {
-		    ERROR("named $1 should be typedefed separately\n" . $herecurr);
+			ERROR("named $1 should be typedefed separately\n" . $herecurr);
 		}
 
 # Need a space before open parenthesis after if, while etc
@@ -3118,48 +3119,50 @@ sub process {
 
 # Qemu error function tests
 
-	# Find newlines in error messages
-	my $qemu_error_funcs = qr{error_setg|
-				error_setg_errno|
-				error_setg_win32|
-				error_setg_file_open|
-				error_set|
-				error_prepend|
-				warn_reportf_err|
-				error_reportf_err|
-				error_vreport|
-				warn_vreport|
-				info_vreport|
-				error_report|
-				warn_report|
-				info_report|
-				g_test_message}x;
+		# Find newlines in error messages
+		my $qemu_error_funcs = qr{error_setg|
+					 error_setg_errno|
+					 error_setg_win32|
+					 error_setg_file_open|
+					 error_set|
+					 error_prepend|
+					 warn_reportf_err|
+					 error_reportf_err|
+					 error_vreport|
+					 warn_vreport|
+					 info_vreport|
+					 error_report|
+					 warn_report|
+					 info_report|
+					 g_test_message}x;
 
-	if ($rawline =~ /\b(?:$qemu_error_funcs)\s*\(.*\".*\\n/) {
-		ERROR("Error messages should not contain newlines\n" . $herecurr);
-	}
-
-	# Continue checking for error messages that contains newlines. This
-	# check handles cases where string literals are spread over multiple lines.
-	# Example:
-	# error_report("Error msg line #1"
-	#              "Error msg line #2\n");
-	my $quoted_newline_regex = qr{\+\s*\".*\\n.*\"};
-	my $continued_str_literal = qr{\+\s*\".*\"};
-
-	if ($rawline =~ /$quoted_newline_regex/) {
-		# Backtrack to first line that does not contain only a quoted literal
-		# and assume that it is the start of the statement.
-		my $i = $linenr - 2;
-
-		while (($i >= 0) & $rawlines[$i] =~ /$continued_str_literal/) {
-			$i--;
-		}
-
-		if ($rawlines[$i] =~ /\b(?:$qemu_error_funcs)\s*\(/) {
+		if ($rawline =~ /\b(?:$qemu_error_funcs)\s*\(.*\".*\\n/) {
 			ERROR("Error messages should not contain newlines\n" . $herecurr);
 		}
-	}
+
+		# Continue checking for error messages that contains newlines.
+		# This check handles cases where string literals are spread
+		# over multiple lines.
+		# Example:
+		# error_report("Error msg line #1"
+		#              "Error msg line #2\n");
+		my $quoted_newline_regex = qr{\+\s*\".*\\n.*\"};
+		my $continued_str_literal = qr{\+\s*\".*\"};
+
+		if ($rawline =~ /$quoted_newline_regex/) {
+			# Backtrack to first line that does not contain only
+			# a quoted literal and assume that it is the start
+			# of the statement.
+			my $i = $linenr - 2;
+
+			while (($i >= 0) & $rawlines[$i] =~ /$continued_str_literal/) {
+				$i--;
+			}
+
+			if ($rawlines[$i] =~ /\b(?:$qemu_error_funcs)\s*\(/) {
+				ERROR("Error messages should not contain newlines\n" . $herecurr);
+			}
+		}
 
 # check for non-portable libc calls that have portable alternatives in QEMU
 		if ($line =~ /\bffs\(/) {

From 25374ba59bce2d8c714283c7bb18b1dc2cc89ebe Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Mon, 12 May 2025 16:57:38 +0100
Subject: [PATCH 1076/2760] scripts/checkpatch: introduce tracking of file
 start/end
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Some checks want to be performed either at the start of a new file
within a patch, or at the end. This is complicated by the fact that
the information relevant to the check may be spread across multiple
lines. It is further complicated by a need to support both git and
non-git diffs, and special handling for renames where there might
not be any patch hunks.

To handle this more sanely, introduce explicit tracking of file
start/end, taking account of git metadata, and calling a hook
function at each transition.

Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 scripts/checkpatch.pl | 110 ++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 107 insertions(+), 3 deletions(-)

diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index 2c19f6f0f2..bb3830d693 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -1417,6 +1417,39 @@ sub checkspdx {
     }
 }
 
+# All three of the methods below take a 'file info' record
+# which is a hash ref containing
+#
+#  'isgit': 1 if an enhanced git diff or 0 for a plain diff
+#  'githeader': 1 if still parsing git patch header, 0 otherwise
+#  'linestart': line number of start of file diff
+#  'lineend': line number of end of file diff
+#  'filenew': the new filename
+#  'fileold': the old filename (same as 'new filename' except
+#             for renames in git diffs)
+#  'action': one of 'modified' (always) or 'new' or 'deleted' or
+#            'renamed' (git diffs only)
+#  'mode': file mode for new/deleted files (git diffs only)
+#  'similarity': file similarity when renamed (git diffs only)
+#  'facts': hash ref for storing any metadata related to checks
+#
+
+# Called at the end of each patch, with the list of
+# real filenames that were seen in the patch
+sub process_file_list {
+	my @fileinfos = @_;
+}
+
+# Called at the start of processing a diff hunk for a file
+sub process_start_of_file {
+	my $fileinfo = shift;
+}
+
+# Called at the end of processing a diff hunk for a file
+sub process_end_of_file {
+	my $fileinfo = shift;
+}
+
 sub process {
 	my $filename = shift;
 
@@ -1453,7 +1486,10 @@ sub process {
 	my $realfile = '';
 	my $realline = 0;
 	my $realcnt = 0;
+	my $fileinfo;
+	my @fileinfolist;
 	my $here = '';
+	my $oldhere = '';
 	my $in_comment = 0;
 	my $comment_edge = 0;
 	my $first_line = 0;
@@ -1591,17 +1627,56 @@ sub process {
 		$prefix = "$filename:$realline: " if ($emacs && $file);
 		$prefix = "$filename:$linenr: " if ($emacs && !$file);
 
+		$oldhere = $here;
 		$here = "#$linenr: " if (!$file);
 		$here = "#$realline: " if ($file);
 
 		# extract the filename as it passes
-		if ($line =~ /^diff --git.*?(\S+)$/) {
-			$realfile = $1;
-			$realfile =~ s@^([^/]*)/@@ if (!$file);
+		if ($line =~ /^diff --git\s+(\S+)\s+(\S+)$/) {
+			my $fileold = $1;
+			my $filenew = $2;
+
+			if (defined $fileinfo) {
+				$fileinfo->{lineend} = $oldhere;
+				process_end_of_file($fileinfo)
+		        }
+			$fileold =~ s@^([^/]*)/@@ if (!$file);
+			$filenew =~ s@^([^/]*)/@@ if (!$file);
+			$realfile = $filenew;
 	                checkfilename($realfile, \$acpi_testexpected, \$acpi_nontestexpected);
+
+			$fileinfo = {
+				"isgit" => 1,
+				"githeader" => 1,
+				"linestart" => $here,
+				"lineend" => 0,
+				"fileold" => $fileold,
+				"filenew" => $filenew,
+				"action" => "modified",
+				"mode" => 0,
+				"similarity" => 0,
+				"facts" => {},
+		        };
+			push @fileinfolist, $fileinfo;
+		} elsif (defined $fileinfo && $fileinfo->{githeader} &&
+			 $line =~ /^(new|deleted) (?:file )?mode\s+([0-7]+)$/) {
+			$fileinfo->{action} = $1;
+			$fileinfo->{mode} = oct($2);
+		} elsif (defined $fileinfo && $fileinfo->{githeader} &&
+			 $line =~ /^similarity index (\d+)%/) {
+			$fileinfo->{similarity} = int($1);
+		} elsif (defined $fileinfo && $fileinfo->{githeader} &&
+			 $line =~ /^rename (from|to) [\w\/\.\-]+\s*$/) {
+			$fileinfo->{action} = "renamed";
+			# For a no-change rename, we'll never have any "+++..."
+			# lines, so trigger actions now
+			if ($1 eq "to" && $fileinfo->{similarity} == 100)  {
+				process_start_of_file($fileinfo);
+			}
 		} elsif ($line =~ /^\+\+\+\s+(\S+)/) {
 			$realfile = $1;
 			$realfile =~ s@^([^/]*)/@@ if (!$file);
+
 	                checkfilename($realfile, \$acpi_testexpected, \$acpi_nontestexpected);
 
 			$p1_prefix = $1;
@@ -1610,6 +1685,30 @@ sub process {
 				WARN("patch prefix '$p1_prefix' exists, appears to be a -p0 patch\n");
 			}
 
+			if (defined $fileinfo && !$fileinfo->{isgit}) {
+				$fileinfo->{lineend} = $oldhere;
+				process_end_of_file($fileinfo);
+			}
+
+			if (!defined $fileinfo || !$fileinfo->{isgit}) {
+				$fileinfo = {
+					"isgit" => 0,
+					"githeader" => 0,
+					"linestart" => $here,
+					"lineend" => 0,
+					"fileold" => $realfile,
+					"filenew" => $realfile,
+					"action" => "modified",
+					"mode" => 0,
+					"similarity" => 0,
+					"facts" => {},
+			        };
+				push @fileinfolist, $fileinfo;
+			} else {
+				$fileinfo->{githeader} = 0;
+			}
+			process_start_of_file($fileinfo);
+
 			next;
 		}
 
@@ -3216,6 +3315,11 @@ sub process {
 		}
 	}
 
+	if (defined $fileinfo) {
+		process_end_of_file($fileinfo);
+	}
+	process_file_list(@fileinfolist);
+
 	if ($is_patch && $chk_signoff && $signoff == 0) {
 		ERROR("Missing Signed-off-by: line(s)\n");
 	}

From 9bec5f93e794271b2dc643cdc1c43082af958fac Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Mon, 12 May 2025 17:48:20 +0100
Subject: [PATCH 1077/2760] scripts/checkpatch: use new hook for ACPI test data
 check
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The ACPI test data check needs to analyse a list of all files in a
commit, so can use the new hook for processing the file list.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 scripts/checkpatch.pl | 61 ++++++++++++++++++++-----------------------
 1 file changed, 29 insertions(+), 32 deletions(-)

diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index bb3830d693..817df98231 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -1330,29 +1330,6 @@ sub WARN {
 	}
 }
 
-# According to tests/qtest/bios-tables-test.c: do not
-# change expected file in the same commit with adding test
-sub checkfilename {
-	my ($name, $acpi_testexpected, $acpi_nontestexpected) = @_;
-
-        # Note: shell script that rebuilds the expected files is in the same
-        # directory as files themselves.
-        # Note: allowed diff list can be changed both when changing expected
-        # files and when changing tests.
-	if ($name =~ m#^tests/data/acpi/# and not $name =~ m#^\.sh$#) {
-		$$acpi_testexpected = $name;
-	} elsif ($name !~ m#^tests/qtest/bios-tables-test-allowed-diff.h$#) {
-		$$acpi_nontestexpected = $name;
-	}
-	if (defined $$acpi_testexpected and defined $$acpi_nontestexpected) {
-		ERROR("Do not add expected files together with tests, " .
-		      "follow instructions in " .
-		      "tests/qtest/bios-tables-test.c: both " .
-		      $$acpi_testexpected . " and " .
-		      $$acpi_nontestexpected . " found\n");
-	}
-}
-
 sub checkspdx {
     my ($file, $expr) = @_;
 
@@ -1438,6 +1415,34 @@ sub checkspdx {
 # real filenames that were seen in the patch
 sub process_file_list {
 	my @fileinfos = @_;
+
+	# According to tests/qtest/bios-tables-test.c: do not
+	# change expected file in the same commit with adding test
+	my @acpi_testexpected;
+	my @acpi_nontestexpected;
+
+	foreach my $fileinfo (@fileinfos) {
+		# Note: shell script that rebuilds the expected files is in
+		# the same directory as files themselves.
+		# Note: allowed diff list can be changed both when changing
+		#  expected files and when changing tests.
+		if ($fileinfo->{filenew} =~ m#^tests/data/acpi/# &&
+		    $fileinfo->{filenew} !~ m#^\.sh$#) {
+			push @acpi_testexpected, $fileinfo->{filenew};
+		} elsif ($fileinfo->{filenew} !~
+			 m#^tests/qtest/bios-tables-test-allowed-diff.h$#) {
+			push @acpi_nontestexpected, $fileinfo->{filenew};
+		}
+	}
+	if (int(@acpi_testexpected) > 0 and int(@acpi_nontestexpected) > 0) {
+		ERROR("Do not add expected files together with tests, " .
+		      "follow instructions in " .
+		      "tests/qtest/bios-tables-test.c. Files\n\n  " .
+		      join("\n  ", @acpi_testexpected) .
+		      "\n\nand\n\n  " .
+		      join("\n  ", @acpi_nontestexpected) .
+		      "\n\nfound in the same patch\n");
+	}
 }
 
 # Called at the start of processing a diff hunk for a file
@@ -1502,9 +1507,6 @@ sub process {
 	my %suppress_whiletrailers;
 	my %suppress_export;
 
-        my $acpi_testexpected;
-        my $acpi_nontestexpected;
-
 	# Pre-scan the patch sanitizing the lines.
 
 	sanitise_line_reset();
@@ -1643,7 +1645,6 @@ sub process {
 			$fileold =~ s@^([^/]*)/@@ if (!$file);
 			$filenew =~ s@^([^/]*)/@@ if (!$file);
 			$realfile = $filenew;
-	                checkfilename($realfile, \$acpi_testexpected, \$acpi_nontestexpected);
 
 			$fileinfo = {
 				"isgit" => 1,
@@ -1677,8 +1678,6 @@ sub process {
 			$realfile = $1;
 			$realfile =~ s@^([^/]*)/@@ if (!$file);
 
-	                checkfilename($realfile, \$acpi_testexpected, \$acpi_nontestexpected);
-
 			$p1_prefix = $1;
 			if (!$file && $tree && $p1_prefix ne '' &&
 			    -e "$root/$p1_prefix") {
@@ -1771,9 +1770,7 @@ sub process {
 		     $line =~ /^rename (?:from|to) [\w\/\.\-]+\s*$/ ||
 		     ($line =~ /\{\s*([\w\/\.\-]*)\s*\=\>\s*([\w\/\.\-]*)\s*\}/ &&
 		      (defined($1) || defined($2)))) &&
-                      !(($realfile ne '') &&
-                        defined($acpi_testexpected) &&
-                        ($realfile eq $acpi_testexpected))) {
+		    $realfile !~ m#^tests/data/acpi/#) {
 			$reported_maintainer_file = 1;
 			WARN("added, moved or deleted file(s), does MAINTAINERS need updating?\n" . $herecurr);
 		}

From f48f16ec3d8cee0a3d843915451c5649fe3a8aaf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Mon, 12 May 2025 17:11:55 +0100
Subject: [PATCH 1078/2760] scripts/checkpatch: use new hook for file
 permissions check
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The file permissions check is the kind of check intended to be performed
in the new start of file hook.

Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 scripts/checkpatch.pl | 19 +++++++++++--------
 1 file changed, 11 insertions(+), 8 deletions(-)

diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index 817df98231..881dcac29b 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -1448,6 +1448,17 @@ sub process_file_list {
 # Called at the start of processing a diff hunk for a file
 sub process_start_of_file {
 	my $fileinfo = shift;
+
+	# Check for incorrect file permissions
+	if ($fileinfo->{action} eq "new" && ($fileinfo->{mode} & 0111)) {
+		my $permhere = $fileinfo->{linestart} . "FILE: " .
+			$fileinfo->{filenew} . "\n";
+		if ($fileinfo->{filenew} =~
+		    /(\bMakefile(?:\.objs)?|\.(c|cc|cpp|h|mak|s|S))$/) {
+			ERROR("do not set execute permissions for source " .
+			      "files\n" . $permhere);
+		}
+	}
 }
 
 # Called at the end of processing a diff hunk for a file
@@ -1719,14 +1730,6 @@ sub process {
 
 		$cnt_lines++ if ($realcnt != 0);
 
-# Check for incorrect file permissions
-		if ($line =~ /^new (file )?mode.*[7531]\d{0,2}$/) {
-			my $permhere = $here . "FILE: $realfile\n";
-			if ($realfile =~ /(\bMakefile(?:\.objs)?|\.c|\.cc|\.cpp|\.h|\.mak|\.[sS])$/) {
-				ERROR("do not set execute permissions for source files\n" . $permhere);
-			}
-		}
-
 # Only allow Python 3 interpreter
 		if ($realline == 1 &&
 			$line =~ /^\+#!\ *\/usr\/bin\/(?:env )?python$/) {

From 45abbf209f007db90d0a596139f653783cd1cb0f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Thu, 15 May 2025 13:57:45 +0100
Subject: [PATCH 1079/2760] scripts/checkpatch: expand pattern for matching
 makefiles
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The current regex matches Makefile & Makefile.objs, but the latter is
no longer used, anjd we're missing coverage of Makefile.include and
Makefile.target. Expand the pattern to match any suffix.

Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 scripts/checkpatch.pl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index 881dcac29b..82ec71e05d 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -1454,7 +1454,7 @@ sub process_start_of_file {
 		my $permhere = $fileinfo->{linestart} . "FILE: " .
 			$fileinfo->{filenew} . "\n";
 		if ($fileinfo->{filenew} =~
-		    /(\bMakefile(?:\.objs)?|\.(c|cc|cpp|h|mak|s|S))$/) {
+		    /(\bMakefile.*|\.(c|cc|cpp|h|mak|s|S))$/) {
 			ERROR("do not set execute permissions for source " .
 			      "files\n" . $permhere);
 		}

From 1d745e6d96353af20f116672b87ae28b0d07eca9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Mon, 12 May 2025 18:01:00 +0100
Subject: [PATCH 1080/2760] scripts/checkpatch: use new hook for MAINTAINERS
 update check
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When seeing a new/deleted/renamed file we check to see if MAINTAINERS
is updated, but we don't give the user a list of files affected, as
we don't want to repeat the same warning many times over.

Using the new file list hook, we can give a single warning at the
end with a list of filenames included.

Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 scripts/checkpatch.pl | 37 +++++++++++++++++++------------------
 1 file changed, 19 insertions(+), 18 deletions(-)

diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index 82ec71e05d..c05559a108 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -1443,6 +1443,25 @@ sub process_file_list {
 		      join("\n  ", @acpi_nontestexpected) .
 		      "\n\nfound in the same patch\n");
 	}
+
+	my $sawmaintainers = 0;
+	my @maybemaintainers;
+	foreach my $fileinfo (@fileinfos) {
+		if ($fileinfo->{action} ne "modified" &&
+		    $fileinfo->{filenew} !~ m#^tests/data/acpi/#) {
+			push @maybemaintainers, $fileinfo->{filenew};
+		}
+		if ($fileinfo->{filenew} eq "MAINTAINERS") {
+			$sawmaintainers = 1;
+		}
+	}
+
+	# If we don't see a MAINTAINERS update, prod the user to check
+	if (int(@maybemaintainers) > 0 && !$sawmaintainers) {
+		WARN("added, moved or deleted file(s):\n\n  " .
+		     join("\n  ", @maybemaintainers) .
+		     "\n\nDoes MAINTAINERS need updating?\n");
+	}
 }
 
 # Called at the start of processing a diff hunk for a file
@@ -1486,7 +1505,6 @@ sub process {
 
 	my $in_header_lines = $file ? 0 : 1;
 	my $in_commit_log = 0;		#Scanning lines before patch
-	my $reported_maintainer_file = 0;
 	my $reported_mixing_imported_file = 0;
 	my $in_imported_file = 0;
 	my $in_no_imported_file = 0;
@@ -1761,23 +1779,6 @@ sub process {
 			}
 		}
 
-# Check if MAINTAINERS is being updated.  If so, there's probably no need to
-# emit the "does MAINTAINERS need updating?" message on file add/move/delete
-		if ($line =~ /^\s*MAINTAINERS\s*\|/) {
-			$reported_maintainer_file = 1;
-		}
-
-# Check for added, moved or deleted files
-		if (!$reported_maintainer_file && !$in_commit_log &&
-		    ($line =~ /^(?:new|deleted) file mode\s*\d+\s*$/ ||
-		     $line =~ /^rename (?:from|to) [\w\/\.\-]+\s*$/ ||
-		     ($line =~ /\{\s*([\w\/\.\-]*)\s*\=\>\s*([\w\/\.\-]*)\s*\}/ &&
-		      (defined($1) || defined($2)))) &&
-		    $realfile !~ m#^tests/data/acpi/#) {
-			$reported_maintainer_file = 1;
-			WARN("added, moved or deleted file(s), does MAINTAINERS need updating?\n" . $herecurr);
-		}
-
 # Check SPDX-License-Identifier references a permitted license
 		if ($rawline =~ m,SPDX-License-Identifier: (.*?)(\*/)?\s*$,) {
 			&checkspdx($realfile, $1);

From b36934063c5550a3fcb1b36027fd1a509142e4f9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Thu, 8 May 2025 17:43:40 +0100
Subject: [PATCH 1081/2760] scripts/checkpatch: reimplement mandate for
 SPDX-License-Identifier
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Going forward we want all newly created source files to have an
SPDX-License-Identifier tag present.

Initially mandate this for C, Python, Perl, Shell source files,
as well as JSON (QAPI) and Makefiles, while encouraging users
to consider it for other file types.

The new attempt at detecting missing SPDX-License-Identifier relies
on the hooks for relying triggering logic at the end of scanning a
new file in the diff.

Tested-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 scripts/checkpatch.pl | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index c05559a108..da13102eda 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -1483,6 +1483,20 @@ sub process_start_of_file {
 # Called at the end of processing a diff hunk for a file
 sub process_end_of_file {
 	my $fileinfo = shift;
+
+	if ($fileinfo->{action} eq "new" &&
+	    !exists $fileinfo->{facts}->{sawspdx}) {
+		if ($fileinfo->{filenew} =~
+		    /(\.(c|h|py|pl|sh|json|inc)|Makefile.*)$/) {
+			# source code files MUST have SPDX license declared
+			ERROR("New file '" . $fileinfo->{filenew} .
+			      "' requires 'SPDX-License-Identifier'");
+		} else {
+			# Other files MAY have SPDX license if appropriate
+			WARN("Does new file '" . $fileinfo->{filenew} .
+			     "' need 'SPDX-License-Identifier'?");
+		}
+	}
 }
 
 sub process {
@@ -1781,6 +1795,7 @@ sub process {
 
 # Check SPDX-License-Identifier references a permitted license
 		if ($rawline =~ m,SPDX-License-Identifier: (.*?)(\*/)?\s*$,) {
+			$fileinfo->{facts}->{sawspdx} = 1;
 			&checkspdx($realfile, $1);
 		}
 

From 1f59381d6c0126cf0348977caa73ab8f7cfa1269 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Thu, 15 May 2025 14:13:13 +0100
Subject: [PATCH 1082/2760] scripts/checkpatch: reject license boilerplate on
 new files
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The previous commit mandates use of SPDX-License-Identifier on common
source files, and encourages it on all other files.

Some contributors are none the less still also including the license
boilerplate text. This is redundant and will potentially cause
trouble if inconsistent with the SPDX declaration.

Match common boilerplate text blurbs and report them as invalid,
for newly added files.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 scripts/checkpatch.pl | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index da13102eda..9291bc9209 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -365,6 +365,18 @@ our @typeList = (
 	qr{guintptr},
 );
 
+# Match text found in common license boilerplate comments:
+# for new files the SPDX-License-Identifier line is sufficient.
+our @LICENSE_BOILERPLATE = (
+	"licensed under the terms of the GNU GPL",
+	"under the terms of the GNU General Public License",
+	"under the terms of the GNU Lesser General Public",
+	"Permission is hereby granted, free of charge",
+	"GNU GPL, version 2 or later",
+	"See the COPYING file"
+);
+our $LICENSE_BOILERPLATE_RE = join("|", @LICENSE_BOILERPLATE);
+
 # Load common spelling mistakes and build regular expression list.
 my $misspellings;
 my %spelling_fix;
@@ -1497,6 +1509,13 @@ sub process_end_of_file {
 			     "' need 'SPDX-License-Identifier'?");
 		}
 	}
+	if ($fileinfo->{action} eq "new" &&
+	    exists $fileinfo->{facts}->{sawboilerplate}) {
+		ERROR("New file '" . $fileinfo->{filenew} . "' must " .
+		      "not have license boilerplate header text, only " .
+		      "the SPDX-License-Identifier, unless this file was " .
+		      "copied from existing code already having such text.");
+	}
 }
 
 sub process {
@@ -1799,6 +1818,10 @@ sub process {
 			&checkspdx($realfile, $1);
 		}
 
+		if ($rawline =~ /$LICENSE_BOILERPLATE_RE/) {
+			$fileinfo->{facts}->{sawboilerplate} = 1;
+		}
+
 		if ($rawline =~ m,(SPDX-[a-zA-Z0-9-_]+):,) {
 			my $tag = $1;
 			my @permitted = qw(

From 0dc051aa85e1bd68d5c5110fa8af69204e6dbd3d Mon Sep 17 00:00:00 2001
From: Juraj Marcin <jmarcin@redhat.com>
Date: Wed, 21 May 2025 15:52:30 +0200
Subject: [PATCH 1083/2760] io: Fix partial struct copy in
 qio_dns_resolver_lookup_sync_inet()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Commit aec21d3175 (qapi: Add InetSocketAddress member keep-alive)
introduces the keep-alive flag, but this flag is not copied together
with other options in qio_dns_resolver_lookup_sync_inet().

This patch fixes this issue and also prevents future ones by copying the
entire structure first and only then overriding a few attributes that
need to be different.

Fixes: aec21d31756c (qapi: Add InetSocketAddress member keep-alive)
Signed-off-by: Juraj Marcin <jmarcin@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 io/dns-resolver.c | 21 +++++----------------
 1 file changed, 5 insertions(+), 16 deletions(-)

diff --git a/io/dns-resolver.c b/io/dns-resolver.c
index 53b0e8407a..3712438f82 100644
--- a/io/dns-resolver.c
+++ b/io/dns-resolver.c
@@ -111,22 +111,11 @@ static int qio_dns_resolver_lookup_sync_inet(QIODNSResolver *resolver,
                     uaddr, INET6_ADDRSTRLEN, uport, 32,
                     NI_NUMERICHOST | NI_NUMERICSERV);
 
-        newaddr->u.inet = (InetSocketAddress){
-            .host = g_strdup(uaddr),
-            .port = g_strdup(uport),
-            .has_numeric = true,
-            .numeric = true,
-            .has_to = iaddr->has_to,
-            .to = iaddr->to,
-            .has_ipv4 = iaddr->has_ipv4,
-            .ipv4 = iaddr->ipv4,
-            .has_ipv6 = iaddr->has_ipv6,
-            .ipv6 = iaddr->ipv6,
-#ifdef HAVE_IPPROTO_MPTCP
-            .has_mptcp = iaddr->has_mptcp,
-            .mptcp = iaddr->mptcp,
-#endif
-        };
+        newaddr->u.inet = *iaddr;
+        newaddr->u.inet.host = g_strdup(uaddr),
+        newaddr->u.inet.port = g_strdup(uport),
+        newaddr->u.inet.has_numeric = true,
+        newaddr->u.inet.numeric = true,
 
         (*addrs)[i] = newaddr;
     }

From b8b5278aca78be4a1c2e7cbb11c6be176f63706d Mon Sep 17 00:00:00 2001
From: Juraj Marcin <jmarcin@redhat.com>
Date: Wed, 21 May 2025 15:52:31 +0200
Subject: [PATCH 1084/2760] util/qemu-sockets: Refactor setting client sockopts
 into a separate function
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This is done in preparation for enabling the SO_KEEPALIVE support for
server sockets and adding settings for more TCP keep-alive socket
options.

Signed-off-by: Juraj Marcin <jmarcin@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 util/qemu-sockets.c | 29 +++++++++++++++++++----------
 1 file changed, 19 insertions(+), 10 deletions(-)

diff --git a/util/qemu-sockets.c b/util/qemu-sockets.c
index 77477c1cd5..4a878e0527 100644
--- a/util/qemu-sockets.c
+++ b/util/qemu-sockets.c
@@ -205,6 +205,22 @@ static int try_bind(int socket, InetSocketAddress *saddr, struct addrinfo *e)
 #endif
 }
 
+static int inet_set_sockopts(int sock, InetSocketAddress *saddr, Error **errp)
+{
+    if (saddr->keep_alive) {
+        int keep_alive = 1;
+        int ret = setsockopt(sock, SOL_SOCKET, SO_KEEPALIVE,
+                             &keep_alive, sizeof(keep_alive));
+
+        if (ret < 0) {
+            error_setg_errno(errp, errno,
+                             "Unable to set keep-alive option on socket");
+            return -1;
+        }
+    }
+    return 0;
+}
+
 static int inet_listen_saddr(InetSocketAddress *saddr,
                              int port_offset,
                              int num,
@@ -475,16 +491,9 @@ int inet_connect_saddr(InetSocketAddress *saddr, Error **errp)
         return sock;
     }
 
-    if (saddr->keep_alive) {
-        int val = 1;
-        int ret = setsockopt(sock, SOL_SOCKET, SO_KEEPALIVE,
-                             &val, sizeof(val));
-
-        if (ret < 0) {
-            error_setg_errno(errp, errno, "Unable to set KEEPALIVE");
-            close(sock);
-            return -1;
-        }
+    if (inet_set_sockopts(sock, saddr, errp) < 0) {
+        close(sock);
+        return -1;
     }
 
     return sock;

From 911e0f2c6e2d00c985affa75ec188c8edcf480f2 Mon Sep 17 00:00:00 2001
From: Juraj Marcin <jmarcin@redhat.com>
Date: Wed, 21 May 2025 15:52:32 +0200
Subject: [PATCH 1085/2760] util/qemu-sockets: Refactor success and failure
 paths in inet_listen_saddr()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

To get a listening socket, we need to first create a socket, try binding
it to a certain port, and lastly starting listening to it. Each of these
operations can fail due to various reasons, one of them being that the
requested address/port is already in use. In such case, the function
tries the same process with a new port number.

This patch refactors the port number loop, so the success path is no
longer buried inside the 'if' statements in the middle of the loop. Now,
the success path is not nested and ends at the end of the iteration
after successful socket creation, binding, and listening. In case any of
the operations fails, it either continues to the next iteration (and the
next port) or jumps out of the loop to handle the error and exits the
function.

Signed-off-by: Juraj Marcin <jmarcin@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 util/qemu-sockets.c | 53 ++++++++++++++++++++++++---------------------
 1 file changed, 28 insertions(+), 25 deletions(-)

diff --git a/util/qemu-sockets.c b/util/qemu-sockets.c
index 4a878e0527..329fdbfd97 100644
--- a/util/qemu-sockets.c
+++ b/util/qemu-sockets.c
@@ -303,11 +303,20 @@ static int inet_listen_saddr(InetSocketAddress *saddr,
         port_min = inet_getport(e);
         port_max = saddr->has_to ? saddr->to + port_offset : port_min;
         for (p = port_min; p <= port_max; p++) {
+            if (slisten >= 0) {
+                /*
+                 * We have a socket we tried with the previous port. It cannot
+                 * be rebound, we need to close it and create a new one.
+                 */
+                close(slisten);
+                slisten = -1;
+            }
             inet_setport(e, p);
 
             slisten = create_fast_reuse_socket(e);
             if (slisten < 0) {
-                /* First time we expect we might fail to create the socket
+                /*
+                 * First time we expect we might fail to create the socket
                  * eg if 'e' has AF_INET6 but ipv6 kmod is not loaded.
                  * Later iterations should always succeed if first iteration
                  * worked though, so treat that as fatal.
@@ -317,40 +326,38 @@ static int inet_listen_saddr(InetSocketAddress *saddr,
                 } else {
                     error_setg_errno(errp, errno,
                                      "Failed to recreate failed listening socket");
-                    goto listen_failed;
+                    goto fail;
                 }
             }
             socket_created = true;
 
             rc = try_bind(slisten, saddr, e);
             if (rc < 0) {
-                if (errno != EADDRINUSE) {
-                    error_setg_errno(errp, errno, "Failed to bind socket");
-                    goto listen_failed;
-                }
-            } else {
-                if (!listen(slisten, num)) {
-                    goto listen_ok;
-                }
-                if (errno != EADDRINUSE) {
-                    error_setg_errno(errp, errno, "Failed to listen on socket");
-                    goto listen_failed;
+                if (errno == EADDRINUSE) {
+                    /* This port is already used, try the next one */
+                    continue;
                 }
+                error_setg_errno(errp, errno, "Failed to bind socket");
+                goto fail;
             }
-            /* Someone else managed to bind to the same port and beat us
-             * to listen on it! Socket semantics does not allow us to
-             * recover from this situation, so we need to recreate the
-             * socket to allow bind attempts for subsequent ports:
-             */
-            close(slisten);
-            slisten = -1;
+            if (listen(slisten, num)) {
+                if (errno == EADDRINUSE) {
+                    /* This port is already used, try the next one */
+                    continue;
+                }
+                error_setg_errno(errp, errno, "Failed to listen on socket");
+                goto fail;
+            }
+            /* We have a listening socket */
+            freeaddrinfo(res);
+            return slisten;
         }
     }
     error_setg_errno(errp, errno,
                      socket_created ?
                      "Failed to find an available port" :
                      "Failed to create a socket");
-listen_failed:
+fail:
     saved_errno = errno;
     if (slisten >= 0) {
         close(slisten);
@@ -358,10 +365,6 @@ listen_failed:
     freeaddrinfo(res);
     errno = saved_errno;
     return -1;
-
-listen_ok:
-    freeaddrinfo(res);
-    return slisten;
 }
 
 #ifdef _WIN32

From 00064705ed1f3943d3634be25da434466c87e7d5 Mon Sep 17 00:00:00 2001
From: Juraj Marcin <jmarcin@redhat.com>
Date: Wed, 21 May 2025 15:52:33 +0200
Subject: [PATCH 1086/2760] util/qemu-sockets: Add support for keep-alive flag
 to passive sockets
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Commit aec21d3175 (qapi: Add InetSocketAddress member keep-alive)
introduces the keep-alive flag, which enables the SO_KEEPALIVE socket
option, but only on client-side sockets. However, this option is also
useful for server-side sockets, so they can check if a client is still
reachable or drop the connection otherwise.

This patch enables the SO_KEEPALIVE socket option on passive server-side
sockets if the keep-alive flag is enabled. This socket option is then
inherited by active server-side sockets communicating with connected
clients.

Signed-off-by: Juraj Marcin <jmarcin@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 qapi/sockets.json   | 4 ++--
 util/qemu-sockets.c | 9 +++------
 2 files changed, 5 insertions(+), 8 deletions(-)

diff --git a/qapi/sockets.json b/qapi/sockets.json
index 6a95023315..62797cd027 100644
--- a/qapi/sockets.json
+++ b/qapi/sockets.json
@@ -56,8 +56,8 @@
 # @ipv6: whether to accept IPv6 addresses, default try both IPv4 and
 #     IPv6
 #
-# @keep-alive: enable keep-alive when connecting to this socket.  Not
-#     supported for passive sockets.  (Since 4.2)
+# @keep-alive: enable keep-alive when connecting to/listening on this socket.
+#     (Since 4.2, not supported for listening sockets until 10.1)
 #
 # @mptcp: enable multi-path TCP.  (Since 6.1)
 #
diff --git a/util/qemu-sockets.c b/util/qemu-sockets.c
index 329fdbfd97..4fbf1ed5bf 100644
--- a/util/qemu-sockets.c
+++ b/util/qemu-sockets.c
@@ -236,12 +236,6 @@ static int inet_listen_saddr(InetSocketAddress *saddr,
     int saved_errno = 0;
     bool socket_created = false;
 
-    if (saddr->keep_alive) {
-        error_setg(errp, "keep-alive option is not supported for passive "
-                   "sockets");
-        return -1;
-    }
-
     memset(&ai,0, sizeof(ai));
     ai.ai_flags = AI_PASSIVE;
     if (saddr->has_numeric && saddr->numeric) {
@@ -349,6 +343,9 @@ static int inet_listen_saddr(InetSocketAddress *saddr,
                 goto fail;
             }
             /* We have a listening socket */
+            if (inet_set_sockopts(slisten, saddr, errp) < 0) {
+                goto fail;
+            }
             freeaddrinfo(res);
             return slisten;
         }

From 316e8ee8d614f049bfae697570a5e62af450491c Mon Sep 17 00:00:00 2001
From: Juraj Marcin <jmarcin@redhat.com>
Date: Wed, 21 May 2025 15:52:34 +0200
Subject: [PATCH 1087/2760] util/qemu-sockets: Refactor inet_parse() to use
 QemuOpts
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Currently, the inet address parser cannot handle multiple options where
one is prefixed with the name of the other. For example, with the
'keep-alive-idle' option added, the current parser cannot parse
'127.0.0.1:5000,keep-alive-idle=60,keep-alive' correctly. Instead, it
fails with "error parsing 'keep-alive' flag '-idle=60,keep-alive'".

To resolve these issues, this patch rewrites the inet address parsing
using the QemuOpts parser, which the inet_parse_flag() function tries to
mimic. This new parser supports all previously supported options and on
top of that the 'numeric' flag is now also supported. The only
difference is, the new parser produces an error if an unknown option is
passed, instead of silently ignoring it.

Signed-off-by: Juraj Marcin <jmarcin@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 tests/unit/test-util-sockets.c | 196 +++++++++++++++++++++++++++++++++
 util/qemu-sockets.c            | 170 ++++++++++++++--------------
 2 files changed, 276 insertions(+), 90 deletions(-)

diff --git a/tests/unit/test-util-sockets.c b/tests/unit/test-util-sockets.c
index 4c9dd0b271..9e39b92e7c 100644
--- a/tests/unit/test-util-sockets.c
+++ b/tests/unit/test-util-sockets.c
@@ -332,6 +332,177 @@ static void test_socket_unix_abstract(void)
 
 #endif  /* CONFIG_LINUX */
 
+static void inet_parse_test_helper(const char *str,
+                                   InetSocketAddress *exp_addr, bool success)
+{
+    InetSocketAddress addr;
+    Error *error = NULL;
+
+    int rc = inet_parse(&addr, str, &error);
+
+    if (success) {
+        g_assert_cmpint(rc, ==, 0);
+    } else {
+        g_assert_cmpint(rc, <, 0);
+    }
+    if (exp_addr != NULL) {
+        g_assert_cmpstr(addr.host, ==, exp_addr->host);
+        g_assert_cmpstr(addr.port, ==, exp_addr->port);
+        /* Own members: */
+        g_assert_cmpint(addr.has_numeric, ==, exp_addr->has_numeric);
+        g_assert_cmpint(addr.numeric, ==, exp_addr->numeric);
+        g_assert_cmpint(addr.has_to, ==, exp_addr->has_to);
+        g_assert_cmpint(addr.to, ==, exp_addr->to);
+        g_assert_cmpint(addr.has_ipv4, ==, exp_addr->has_ipv4);
+        g_assert_cmpint(addr.ipv4, ==, exp_addr->ipv4);
+        g_assert_cmpint(addr.has_ipv6, ==, exp_addr->has_ipv6);
+        g_assert_cmpint(addr.ipv6, ==, exp_addr->ipv6);
+        g_assert_cmpint(addr.has_keep_alive, ==, exp_addr->has_keep_alive);
+        g_assert_cmpint(addr.keep_alive, ==, exp_addr->keep_alive);
+#ifdef HAVE_IPPROTO_MPTCP
+        g_assert_cmpint(addr.has_mptcp, ==, exp_addr->has_mptcp);
+        g_assert_cmpint(addr.mptcp, ==, exp_addr->mptcp);
+#endif
+    }
+
+    g_free(addr.host);
+    g_free(addr.port);
+}
+
+static void test_inet_parse_nohost_good(void)
+{
+    char host[] = "";
+    char port[] = "5000";
+    InetSocketAddress exp_addr = {
+        .host = host,
+        .port = port,
+    };
+    inet_parse_test_helper(":5000", &exp_addr, true);
+}
+
+static void test_inet_parse_empty_bad(void)
+{
+    inet_parse_test_helper("", NULL, false);
+}
+
+static void test_inet_parse_only_colon_bad(void)
+{
+    inet_parse_test_helper(":", NULL, false);
+}
+
+static void test_inet_parse_ipv4_good(void)
+{
+    char host[] = "127.0.0.1";
+    char port[] = "5000";
+    InetSocketAddress exp_addr = {
+        .host = host,
+        .port = port,
+    };
+    inet_parse_test_helper("127.0.0.1:5000", &exp_addr, true);
+}
+
+static void test_inet_parse_ipv4_noport_bad(void)
+{
+    inet_parse_test_helper("127.0.0.1", NULL, false);
+}
+
+static void test_inet_parse_ipv6_good(void)
+{
+    char host[] = "::1";
+    char port[] = "5000";
+    InetSocketAddress exp_addr = {
+        .host = host,
+        .port = port,
+    };
+    inet_parse_test_helper("[::1]:5000", &exp_addr, true);
+}
+
+static void test_inet_parse_ipv6_noend_bad(void)
+{
+    inet_parse_test_helper("[::1", NULL, false);
+}
+
+static void test_inet_parse_ipv6_noport_bad(void)
+{
+    inet_parse_test_helper("[::1]:", NULL, false);
+}
+
+static void test_inet_parse_ipv6_empty_bad(void)
+{
+    inet_parse_test_helper("[]:5000", NULL, false);
+}
+
+static void test_inet_parse_hostname_good(void)
+{
+    char host[] = "localhost";
+    char port[] = "5000";
+    InetSocketAddress exp_addr = {
+        .host = host,
+        .port = port,
+    };
+    inet_parse_test_helper("localhost:5000", &exp_addr, true);
+}
+
+static void test_inet_parse_all_options_good(void)
+{
+    char host[] = "::1";
+    char port[] = "5000";
+    InetSocketAddress exp_addr = {
+        .host = host,
+        .port = port,
+        .has_numeric = true,
+        .numeric =  true,
+        .has_to = true,
+        .to = 5006,
+        .has_ipv4 = true,
+        .ipv4 = false,
+        .has_ipv6 = true,
+        .ipv6 = true,
+        .has_keep_alive = true,
+        .keep_alive = true,
+#ifdef HAVE_IPPROTO_MPTCP
+        .has_mptcp = true,
+        .mptcp = false,
+#endif
+    };
+    inet_parse_test_helper(
+        "[::1]:5000,numeric=on,to=5006,ipv4=off,ipv6=on,keep-alive=on"
+#ifdef HAVE_IPPROTO_MPTCP
+        ",mptcp=off"
+#endif
+        , &exp_addr, true);
+}
+
+static void test_inet_parse_all_implicit_bool_good(void)
+{
+    char host[] = "::1";
+    char port[] = "5000";
+    InetSocketAddress exp_addr = {
+        .host = host,
+        .port = port,
+        .has_numeric = true,
+        .numeric =  true,
+        .has_to = true,
+        .to = 5006,
+        .has_ipv4 = true,
+        .ipv4 = true,
+        .has_ipv6 = true,
+        .ipv6 = true,
+        .has_keep_alive = true,
+        .keep_alive = true,
+#ifdef HAVE_IPPROTO_MPTCP
+        .has_mptcp = true,
+        .mptcp = true,
+#endif
+    };
+    inet_parse_test_helper(
+        "[::1]:5000,numeric,to=5006,ipv4,ipv6,keep-alive"
+#ifdef HAVE_IPPROTO_MPTCP
+        ",mptcp"
+#endif
+        , &exp_addr, true);
+}
+
 int main(int argc, char **argv)
 {
     bool has_ipv4, has_ipv6;
@@ -377,6 +548,31 @@ int main(int argc, char **argv)
                     test_socket_unix_abstract);
 #endif
 
+    g_test_add_func("/util/socket/inet-parse/nohost-good",
+                    test_inet_parse_nohost_good);
+    g_test_add_func("/util/socket/inet-parse/empty-bad",
+                    test_inet_parse_empty_bad);
+    g_test_add_func("/util/socket/inet-parse/only-colon-bad",
+                    test_inet_parse_only_colon_bad);
+    g_test_add_func("/util/socket/inet-parse/ipv4-good",
+                    test_inet_parse_ipv4_good);
+    g_test_add_func("/util/socket/inet-parse/ipv4-noport-bad",
+                    test_inet_parse_ipv4_noport_bad);
+    g_test_add_func("/util/socket/inet-parse/ipv6-good",
+                    test_inet_parse_ipv6_good);
+    g_test_add_func("/util/socket/inet-parse/ipv6-noend-bad",
+                    test_inet_parse_ipv6_noend_bad);
+    g_test_add_func("/util/socket/inet-parse/ipv6-noport-bad",
+                    test_inet_parse_ipv6_noport_bad);
+    g_test_add_func("/util/socket/inet-parse/ipv6-empty-bad",
+                    test_inet_parse_ipv6_empty_bad);
+    g_test_add_func("/util/socket/inet-parse/hostname-good",
+                    test_inet_parse_hostname_good);
+    g_test_add_func("/util/socket/inet-parse/all-options-good",
+                    test_inet_parse_all_options_good);
+    g_test_add_func("/util/socket/inet-parse/all-bare-bool-good",
+                    test_inet_parse_all_implicit_bool_good);
+
 end:
     return g_test_run();
 }
diff --git a/util/qemu-sockets.c b/util/qemu-sockets.c
index 4fbf1ed5bf..403dc26b36 100644
--- a/util/qemu-sockets.c
+++ b/util/qemu-sockets.c
@@ -30,6 +30,7 @@
 #include "qapi/qobject-input-visitor.h"
 #include "qapi/qobject-output-visitor.h"
 #include "qemu/cutils.h"
+#include "qemu/option.h"
 #include "trace.h"
 
 #ifndef AI_ADDRCONFIG
@@ -600,115 +601,104 @@ err:
     return -1;
 }
 
-/* compatibility wrapper */
-static int inet_parse_flag(const char *flagname, const char *optstr, bool *val,
-                           Error **errp)
-{
-    char *end;
-    size_t len;
-
-    end = strstr(optstr, ",");
-    if (end) {
-        if (end[1] == ',') { /* Reject 'ipv6=on,,foo' */
-            error_setg(errp, "error parsing '%s' flag '%s'", flagname, optstr);
-            return -1;
-        }
-        len = end - optstr;
-    } else {
-        len = strlen(optstr);
-    }
-    if (len == 0 || (len == 3 && strncmp(optstr, "=on", len) == 0)) {
-        *val = true;
-    } else if (len == 4 && strncmp(optstr, "=off", len) == 0) {
-        *val = false;
-    } else {
-        error_setg(errp, "error parsing '%s' flag '%s'", flagname, optstr);
-        return -1;
-    }
-    return 0;
-}
+static QemuOptsList inet_opts = {
+    .name = "InetSocketAddress",
+    .head = QTAILQ_HEAD_INITIALIZER(inet_opts.head),
+    .implied_opt_name = "addr",
+    .desc = {
+        {
+            .name = "addr",
+            .type = QEMU_OPT_STRING,
+        },
+        {
+            .name = "numeric",
+            .type = QEMU_OPT_BOOL,
+        },
+        {
+            .name = "to",
+            .type = QEMU_OPT_NUMBER,
+        },
+        {
+            .name = "ipv4",
+            .type = QEMU_OPT_BOOL,
+        },
+        {
+            .name = "ipv6",
+            .type = QEMU_OPT_BOOL,
+        },
+        {
+            .name = "keep-alive",
+            .type = QEMU_OPT_BOOL,
+        },
+#ifdef HAVE_IPPROTO_MPTCP
+        {
+            .name = "mptcp",
+            .type = QEMU_OPT_BOOL,
+        },
+#endif
+        { /* end of list */ }
+    },
+};
 
 int inet_parse(InetSocketAddress *addr, const char *str, Error **errp)
 {
-    const char *optstr, *h;
-    char host[65];
-    char port[33];
-    int to;
-    int pos;
-    char *begin;
-
+    QemuOpts *opts = qemu_opts_parse(&inet_opts, str, true, errp);
+    if (!opts) {
+        return -1;
+    }
     memset(addr, 0, sizeof(*addr));
 
     /* parse address */
-    if (str[0] == ':') {
-        /* no host given */
-        host[0] = '\0';
-        if (sscanf(str, ":%32[^,]%n", port, &pos) != 1) {
-            error_setg(errp, "error parsing port in address '%s'", str);
-            return -1;
-        }
-    } else if (str[0] == '[') {
-        /* IPv6 addr */
-        if (sscanf(str, "[%64[^]]]:%32[^,]%n", host, port, &pos) != 2) {
-            error_setg(errp, "error parsing IPv6 address '%s'", str);
-            return -1;
-        }
-    } else {
-        /* hostname or IPv4 addr */
-        if (sscanf(str, "%64[^:]:%32[^,]%n", host, port, &pos) != 2) {
-            error_setg(errp, "error parsing address '%s'", str);
-            return -1;
-        }
+    const char *addr_str = qemu_opt_get(opts, "addr");
+    if (!addr_str) {
+        error_setg(errp, "error parsing address ''");
+        return -1;
+    }
+    if (str[0] == '[') {
+        /* IPv6 addr */
+        const char *ip_end = strstr(addr_str, "]:");
+        if (!ip_end || ip_end - addr_str < 2 || strlen(ip_end) < 3) {
+            error_setg(errp, "error parsing IPv6 address '%s'", addr_str);
+            return -1;
+        }
+        addr->host = g_strndup(addr_str + 1, ip_end - addr_str - 1);
+        addr->port = g_strdup(ip_end + 2);
+    } else {
+        /* no host, hostname or IPv4 addr */
+        const char *port = strchr(addr_str, ':');
+        if (!port || strlen(port) < 2) {
+            error_setg(errp, "error parsing address '%s'", addr_str);
+            return -1;
+        }
+        addr->host = g_strndup(addr_str, port - addr_str);
+        addr->port = g_strdup(port + 1);
     }
-
-    addr->host = g_strdup(host);
-    addr->port = g_strdup(port);
 
     /* parse options */
-    optstr = str + pos;
-    h = strstr(optstr, ",to=");
-    if (h) {
-        h += 4;
-        if (sscanf(h, "%d%n", &to, &pos) != 1 ||
-            (h[pos] != '\0' && h[pos] != ',')) {
-            error_setg(errp, "error parsing to= argument");
-            return -1;
-        }
+    if (qemu_opt_find(opts, "numeric")) {
+        addr->has_numeric = true,
+        addr->numeric = qemu_opt_get_bool(opts, "numeric", false);
+    }
+    if (qemu_opt_find(opts, "to")) {
         addr->has_to = true;
-        addr->to = to;
+        addr->to = qemu_opt_get_number(opts, "to", 0);
     }
-    begin = strstr(optstr, ",ipv4");
-    if (begin) {
-        if (inet_parse_flag("ipv4", begin + 5, &addr->ipv4, errp) < 0) {
-            return -1;
-        }
+    if (qemu_opt_find(opts, "ipv4")) {
         addr->has_ipv4 = true;
+        addr->ipv4 = qemu_opt_get_bool(opts, "ipv4", false);
     }
-    begin = strstr(optstr, ",ipv6");
-    if (begin) {
-        if (inet_parse_flag("ipv6", begin + 5, &addr->ipv6, errp) < 0) {
-            return -1;
-        }
+    if (qemu_opt_find(opts, "ipv6")) {
         addr->has_ipv6 = true;
+        addr->ipv6 = qemu_opt_get_bool(opts, "ipv6", false);
     }
-    begin = strstr(optstr, ",keep-alive");
-    if (begin) {
-        if (inet_parse_flag("keep-alive", begin + strlen(",keep-alive"),
-                            &addr->keep_alive, errp) < 0)
-        {
-            return -1;
-        }
+    if (qemu_opt_find(opts, "keep-alive")) {
         addr->has_keep_alive = true;
+        addr->keep_alive = qemu_opt_get_bool(opts, "keep-alive", false);
     }
 #ifdef HAVE_IPPROTO_MPTCP
-    begin = strstr(optstr, ",mptcp");
-    if (begin) {
-        if (inet_parse_flag("mptcp", begin + strlen(",mptcp"),
-                            &addr->mptcp, errp) < 0)
-        {
-            return -1;
-        }
+    if (qemu_opt_find(opts, "mptcp")) {
         addr->has_mptcp = true;
+        addr->mptcp = qemu_opt_get_bool(opts, "mptcp", 0);
     }
 #endif
     return 0;

From 1bd4237cb1095d71c16afad3ce93b4a1e453173e Mon Sep 17 00:00:00 2001
From: Juraj Marcin <jmarcin@redhat.com>
Date: Wed, 21 May 2025 15:52:35 +0200
Subject: [PATCH 1088/2760] util/qemu-sockets: Introduce inet socket options
 controlling TCP keep-alive
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

With the default TCP stack configuration, it could be even 2 hours
before the connection times out due to the other side not being
reachable. However, in some cases, the application needs to be aware of
a connection issue much sooner.

This is the case, for example, for postcopy live migration. If there is
no traffic from the migration destination guest (server-side) to the
migration source guest (client-side), the destination keeps waiting for
pages indefinitely and does not switch to the postcopy-paused state.
This can happen, for example, if the destination QEMU instance is
started with the '-S' command line option and the machine is not started
yet, or if the machine is idle and produces no new page faults for
not-yet-migrated pages.

This patch introduces new inet socket parameters that control count,
idle period, and interval of TCP keep-alive packets before the
connection is considered broken. These parameters are available on
systems where the respective TCP socket options are defined, that
includes Linux, Windows, macOS, but not OpenBSD. Additionally, macOS
defines TCP_KEEPIDLE as TCP_KEEPALIVE instead, so the patch supplies its
own definition.

The default value for all is 0, which means the system configuration is
used.

Signed-off-by: Juraj Marcin <jmarcin@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 meson.build                    | 30 +++++++++++++
 qapi/sockets.json              | 19 ++++++++
 tests/unit/test-util-sockets.c | 39 +++++++++++++++++
 util/qemu-sockets.c            | 80 ++++++++++++++++++++++++++++++++++
 4 files changed, 168 insertions(+)

diff --git a/meson.build b/meson.build
index ad2053f968..fdad3fb528 100644
--- a/meson.build
+++ b/meson.build
@@ -2760,6 +2760,36 @@ if linux_io_uring.found()
   config_host_data.set('HAVE_IO_URING_PREP_WRITEV2',
                        cc.has_header_symbol('liburing.h', 'io_uring_prep_writev2'))
 endif
+config_host_data.set('HAVE_TCP_KEEPCNT',
+                     cc.has_header_symbol('netinet/tcp.h', 'TCP_KEEPCNT') or
+                     cc.compiles('''
+                     #include <ws2tcpip.h>
+                     #ifndef TCP_KEEPCNT
+                     #error
+                     #endif
+                     int main(void) { return 0; }''',
+                     name: 'Win32 TCP_KEEPCNT'))
+# On Darwin TCP_KEEPIDLE is available under different name, TCP_KEEPALIVE.
+# https://github.com/apple/darwin-xnu/blob/xnu-4570.1.46/bsd/man/man4/tcp.4#L172
+config_host_data.set('HAVE_TCP_KEEPIDLE',
+                     cc.has_header_symbol('netinet/tcp.h', 'TCP_KEEPIDLE') or
+                     cc.has_header_symbol('netinet/tcp.h', 'TCP_KEEPALIVE') or
+                     cc.compiles('''
+                     #include <ws2tcpip.h>
+                     #ifndef TCP_KEEPIDLE
+                     #error
+                     #endif
+                     int main(void) { return 0; }''',
+                     name: 'Win32 TCP_KEEPIDLE'))
+config_host_data.set('HAVE_TCP_KEEPINTVL',
+                     cc.has_header_symbol('netinet/tcp.h', 'TCP_KEEPINTVL') or
+                     cc.compiles('''
+                     #include <ws2tcpip.h>
+                     #ifndef TCP_KEEPINTVL
+                     #error
+                     #endif
+                     int main(void) { return 0; }''',
+                     name: 'Win32 TCP_KEEPINTVL'))
 
 # has_member
 config_host_data.set('HAVE_SIGEV_NOTIFY_THREAD_ID',
diff --git a/qapi/sockets.json b/qapi/sockets.json
index 62797cd027..f9f559daba 100644
--- a/qapi/sockets.json
+++ b/qapi/sockets.json
@@ -59,6 +59,22 @@
 # @keep-alive: enable keep-alive when connecting to/listening on this socket.
 #     (Since 4.2, not supported for listening sockets until 10.1)
 #
+# @keep-alive-count: number of keep-alive packets sent before the connection is
+#     closed.  Only supported for TCP sockets on systems where TCP_KEEPCNT
+#     socket option is defined (this includes Linux, Windows, macOS, FreeBSD,
+#     but not OpenBSD).  When set to 0, system setting is used.  (Since 10.1)
+#
+# @keep-alive-idle: time in seconds the connection needs to be idle before
+#     sending a keepalive packet.  Only supported for TCP sockets on systems
+#     where TCP_KEEPIDLE socket option is defined (this includes Linux,
+#     Windows, macOS, FreeBSD, but not OpenBSD).  When set to 0, system setting
+#     is used.  (Since 10.1)
+#
+# @keep-alive-interval: time in seconds between keep-alive packets.  Only
+#     supported for TCP sockets on systems where TCP_KEEPINTVL is defined (this
+#     includes Linux, Windows, macOS, FreeBSD, but not OpenBSD).  When set to
+#     0, system setting is used.  (Since 10.1)
+#
 # @mptcp: enable multi-path TCP.  (Since 6.1)
 #
 # Since: 1.3
@@ -71,6 +87,9 @@
     '*ipv4': 'bool',
     '*ipv6': 'bool',
     '*keep-alive': 'bool',
+    '*keep-alive-count': { 'type': 'uint32', 'if': 'HAVE_TCP_KEEPCNT' },
+    '*keep-alive-idle': { 'type': 'uint32', 'if': 'HAVE_TCP_KEEPIDLE' },
+    '*keep-alive-interval': { 'type': 'uint32', 'if': 'HAVE_TCP_KEEPINTVL' },
     '*mptcp': { 'type': 'bool', 'if': 'HAVE_IPPROTO_MPTCP' } } }
 
 ##
diff --git a/tests/unit/test-util-sockets.c b/tests/unit/test-util-sockets.c
index 9e39b92e7c..8492f4d68f 100644
--- a/tests/unit/test-util-sockets.c
+++ b/tests/unit/test-util-sockets.c
@@ -359,6 +359,24 @@ static void inet_parse_test_helper(const char *str,
         g_assert_cmpint(addr.ipv6, ==, exp_addr->ipv6);
         g_assert_cmpint(addr.has_keep_alive, ==, exp_addr->has_keep_alive);
         g_assert_cmpint(addr.keep_alive, ==, exp_addr->keep_alive);
+#ifdef HAVE_TCP_KEEPCNT
+        g_assert_cmpint(addr.has_keep_alive_count, ==,
+                        exp_addr->has_keep_alive_count);
+        g_assert_cmpint(addr.keep_alive_count, ==,
+                        exp_addr->keep_alive_count);
+#endif
+#ifdef HAVE_TCP_KEEPIDLE
+        g_assert_cmpint(addr.has_keep_alive_idle, ==,
+                        exp_addr->has_keep_alive_idle);
+        g_assert_cmpint(addr.keep_alive_idle, ==,
+                        exp_addr->keep_alive_idle);
+#endif
+#ifdef HAVE_TCP_KEEPINTVL
+        g_assert_cmpint(addr.has_keep_alive_interval, ==,
+                        exp_addr->has_keep_alive_interval);
+        g_assert_cmpint(addr.keep_alive_interval, ==,
+                        exp_addr->keep_alive_interval);
+#endif
 #ifdef HAVE_IPPROTO_MPTCP
         g_assert_cmpint(addr.has_mptcp, ==, exp_addr->has_mptcp);
         g_assert_cmpint(addr.mptcp, ==, exp_addr->mptcp);
@@ -460,6 +478,18 @@ static void test_inet_parse_all_options_good(void)
         .ipv6 = true,
         .has_keep_alive = true,
         .keep_alive = true,
+#ifdef HAVE_TCP_KEEPCNT
+        .has_keep_alive_count = true,
+        .keep_alive_count = 10,
+#endif
+#ifdef HAVE_TCP_KEEPIDLE
+        .has_keep_alive_idle = true,
+        .keep_alive_idle = 60,
+#endif
+#ifdef HAVE_TCP_KEEPINTVL
+        .has_keep_alive_interval = true,
+        .keep_alive_interval = 30,
+#endif
 #ifdef HAVE_IPPROTO_MPTCP
         .has_mptcp = true,
         .mptcp = false,
@@ -467,6 +497,15 @@ static void test_inet_parse_all_options_good(void)
     };
     inet_parse_test_helper(
         "[::1]:5000,numeric=on,to=5006,ipv4=off,ipv6=on,keep-alive=on"
+#ifdef HAVE_TCP_KEEPCNT
+        ",keep-alive-count=10"
+#endif
+#ifdef HAVE_TCP_KEEPIDLE
+        ",keep-alive-idle=60"
+#endif
+#ifdef HAVE_TCP_KEEPINTVL
+        ",keep-alive-interval=30"
+#endif
 #ifdef HAVE_IPPROTO_MPTCP
         ",mptcp=off"
 #endif
diff --git a/util/qemu-sockets.c b/util/qemu-sockets.c
index 403dc26b36..4773755fd5 100644
--- a/util/qemu-sockets.c
+++ b/util/qemu-sockets.c
@@ -45,6 +45,14 @@
 # define AI_NUMERICSERV 0
 #endif
 
+/*
+ * On macOS TCP_KEEPIDLE is available under a different name, TCP_KEEPALIVE.
+ * https://github.com/apple/darwin-xnu/blob/xnu-4570.1.46/bsd/man/man4/tcp.4#L172
+ */
+#if defined(TCP_KEEPALIVE) && !defined(TCP_KEEPIDLE)
+# define TCP_KEEPIDLE TCP_KEEPALIVE
+#endif
+
 
 static int inet_getport(struct addrinfo *e)
 {
@@ -218,6 +226,42 @@ static int inet_set_sockopts(int sock, InetSocketAddress *saddr, Error **errp)
                              "Unable to set keep-alive option on socket");
             return -1;
         }
+#ifdef HAVE_TCP_KEEPCNT
+        if (saddr->has_keep_alive_count && saddr->keep_alive_count) {
+            int keep_count = saddr->keep_alive_count;
+            ret = setsockopt(sock, IPPROTO_TCP, TCP_KEEPCNT, &keep_count,
+                             sizeof(keep_count));
+            if (ret < 0) {
+                error_setg_errno(errp, errno,
+                                 "Unable to set TCP keep-alive count option on socket");
+                return -1;
+            }
+        }
+#endif
+#ifdef HAVE_TCP_KEEPIDLE
+        if (saddr->has_keep_alive_idle && saddr->keep_alive_idle) {
+            int keep_idle = saddr->keep_alive_idle;
+            ret = setsockopt(sock, IPPROTO_TCP, TCP_KEEPIDLE, &keep_idle,
+                             sizeof(keep_idle));
+            if (ret < 0) {
+                error_setg_errno(errp, errno,
+                                 "Unable to set TCP keep-alive idle option on socket");
+                return -1;
+            }
+        }
+#endif
+#ifdef HAVE_TCP_KEEPINTVL
+        if (saddr->has_keep_alive_interval && saddr->keep_alive_interval) {
+            int keep_interval = saddr->keep_alive_interval;
+            ret = setsockopt(sock, IPPROTO_TCP, TCP_KEEPINTVL, &keep_interval,
+                             sizeof(keep_interval));
+            if (ret < 0) {
+                error_setg_errno(errp, errno,
+                                 "Unable to set TCP keep-alive interval option on socket");
+                return -1;
+            }
+        }
+#endif
     }
     return 0;
 }
@@ -630,6 +674,24 @@ static QemuOptsList inet_opts = {
             .name = "keep-alive",
             .type = QEMU_OPT_BOOL,
         },
+#ifdef HAVE_TCP_KEEPCNT
+        {
+            .name = "keep-alive-count",
+            .type = QEMU_OPT_NUMBER,
+        },
+#endif
+#ifdef HAVE_TCP_KEEPIDLE
+        {
+            .name = "keep-alive-idle",
+            .type = QEMU_OPT_NUMBER,
+        },
+#endif
+#ifdef HAVE_TCP_KEEPINTVL
+        {
+            .name = "keep-alive-interval",
+            .type = QEMU_OPT_NUMBER,
+        },
+#endif
 #ifdef HAVE_IPPROTO_MPTCP
         {
             .name = "mptcp",
@@ -695,6 +757,24 @@ int inet_parse(InetSocketAddress *addr, const char *str, Error **errp)
         addr->has_keep_alive = true;
         addr->keep_alive = qemu_opt_get_bool(opts, "keep-alive", false);
     }
+#ifdef HAVE_TCP_KEEPCNT
+    if (qemu_opt_find(opts, "keep-alive-count")) {
+        addr->has_keep_alive_count = true;
+        addr->keep_alive_count = qemu_opt_get_number(opts, "keep-alive-count", 0);
+    }
+#endif
+#ifdef HAVE_TCP_KEEPIDLE
+    if (qemu_opt_find(opts, "keep-alive-idle")) {
+        addr->has_keep_alive_idle = true;
+        addr->keep_alive_idle = qemu_opt_get_number(opts, "keep-alive-idle", 0);
+    }
+#endif
+#ifdef HAVE_TCP_KEEPINTVL
+    if (qemu_opt_find(opts, "keep-alive-interval")) {
+        addr->has_keep_alive_interval = true;
+        addr->keep_alive_interval = qemu_opt_get_number(opts, "keep-alive-interval", 0);
+    }
+#endif
 #ifdef HAVE_IPPROTO_MPTCP
     if (qemu_opt_find(opts, "mptcp")) {
         addr->has_mptcp = true;

From 81941aa896b718c194f08cebb4303561b64c60b4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Wed, 21 May 2025 09:47:00 +0100
Subject: [PATCH 1089/2760] scripts/checkpatch.pl: mandate SPDX tag for Rust
 src files
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 scripts/checkpatch.pl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index 9291bc9209..833f20f555 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -1499,7 +1499,7 @@ sub process_end_of_file {
 	if ($fileinfo->{action} eq "new" &&
 	    !exists $fileinfo->{facts}->{sawspdx}) {
 		if ($fileinfo->{filenew} =~
-		    /(\.(c|h|py|pl|sh|json|inc)|Makefile.*)$/) {
+		    /(\.(c|h|py|pl|sh|json|inc|rs)|Makefile.*)$/) {
 			# source code files MUST have SPDX license declared
 			ERROR("New file '" . $fileinfo->{filenew} .
 			      "' requires 'SPDX-License-Identifier'");

From ff2ab634e4bb3bddcf5f5ee29e0b46f71e3f4b54 Mon Sep 17 00:00:00 2001
From: Denis Rastyogin <gerben@altlinux.org>
Date: Tue, 6 May 2025 17:13:37 +0300
Subject: [PATCH 1090/2760] qemu-img: fix offset calculation in bench

This error was discovered by fuzzing qemu-img.

The current offset calculation leads to an EIO error
in block/block-backend.c: blk_check_byte_request():

 if (offset > len || len - offset < bytes) {
     return -EIO;
 }

This triggers the error message:
"qemu-img: Failed request: Input/output error".

Example of the issue:
 offset: 260076
 len: 260096
 bytes: 4096

This fix ensures that offset remains within a valid range.

Signed-off-by: Denis Rastyogin <gerben@altlinux.org>
Message-ID: <20250506141410.100119-1-gerben@altlinux.org>
[kwolf: Fixed up integer overflow]
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 qemu-img.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/qemu-img.c b/qemu-img.c
index 76ac5d3028..139eeb5039 100644
--- a/qemu-img.c
+++ b/qemu-img.c
@@ -4488,10 +4488,10 @@ static void bench_cb(void *opaque, int ret)
          */
         b->in_flight++;
         b->offset += b->step;
-        if (b->image_size == 0) {
+        if (b->image_size <= b->bufsize) {
             b->offset = 0;
         } else {
-            b->offset %= b->image_size;
+            b->offset %= b->image_size - b->bufsize;
         }
         if (b->write) {
             acb = blk_aio_pwritev(b->blk, offset, b->qiov, 0, bench_cb, b);

From 5634622bcb339f213469eceeff005640492fc902 Mon Sep 17 00:00:00 2001
From: Stefan Hajnoczi <stefanha@redhat.com>
Date: Thu, 17 Apr 2025 17:10:53 -0400
Subject: [PATCH 1091/2760] file-posix: allow BLKZEROOUT with -t writeback

The Linux BLKZEROOUT ioctl is only invoked when BDRV_O_NOCACHE is set
because old kernels did not invalidate the page cache. In that case
mixing BLKZEROOUT with buffered I/O could lead to corruption.

However, Linux 4.9 commit 22dd6d356628 ("block: invalidate the page
cache when issuing BLKZEROOUT") made BLKZEROOUT coherent with the page
cache.

I have checked that Linux 4.9+ kernels are shipped at least as far back
as Debian 10 (buster), openSUSE Leap 15.2, and RHEL/CentOS 8.

Use BLKZEROOUT with buffered I/O, mostly so `qemu-img ... -t
writeback` can offload write zeroes.

Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Christoph Hellwig <hch@lst.de>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-ID: <20250417211053.98700-1-stefanha@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/file-posix.c | 11 -----------
 1 file changed, 11 deletions(-)

diff --git a/block/file-posix.c b/block/file-posix.c
index ec95b74869..5a3532e40b 100644
--- a/block/file-posix.c
+++ b/block/file-posix.c
@@ -785,17 +785,6 @@ static int raw_open_common(BlockDriverState *bs, QDict *options,
     }
 #endif
 
-    if (S_ISBLK(st.st_mode)) {
-#ifdef __linux__
-        /* On Linux 3.10, BLKDISCARD leaves stale data in the page cache.  Do
-         * not rely on the contents of discarded blocks unless using O_DIRECT.
-         * Same for BLKZEROOUT.
-         */
-        if (!(bs->open_flags & BDRV_O_NOCACHE)) {
-            s->has_write_zeroes = false;
-        }
-#endif
-    }
 #ifdef __FreeBSD__
     if (S_ISCHR(st.st_mode)) {
         /*

From bf627788ef17721955bfcfba84209a07ae5f54ea Mon Sep 17 00:00:00 2001
From: Kevin Wolf <kwolf@redhat.com>
Date: Thu, 22 May 2025 15:08:03 +0200
Subject: [PATCH 1092/2760] file-posix: Probe paths and retry SG_IO on
 potential path errors

When scsi-block is used on a host multipath device, it runs into the
problem that the kernel dm-mpath doesn't know anything about SCSI or
SG_IO and therefore can't decide if a SG_IO request returned an error
and needs to be retried on a different path. Instead of getting working
failover, an error is returned to scsi-block and handled according to
the configured error policy. Obviously, this is not what users want,
they want working failover.

QEMU can parse the SG_IO result and determine whether this could have
been a path error, but just retrying the same request could just send it
to the same failing path again and result in the same error.

With a kernel that supports the DM_MPATH_PROBE_PATHS ioctl on dm-mpath
block devices (queued in the device mapper tree for Linux 6.16), we can
tell the kernel to probe all paths and tell us if any usable paths
remained. If so, we can now retry the SG_IO ioctl and expect it to be
sent to a working path.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20250522130803.34738-1-kwolf@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Hanna Czenczek <hreitz@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/file-posix.c | 115 ++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 114 insertions(+), 1 deletion(-)

diff --git a/block/file-posix.c b/block/file-posix.c
index 5a3532e40b..9b5f08ccb2 100644
--- a/block/file-posix.c
+++ b/block/file-posix.c
@@ -41,6 +41,7 @@
 
 #include "scsi/pr-manager.h"
 #include "scsi/constants.h"
+#include "scsi/utils.h"
 
 #if defined(__APPLE__) && (__MACH__)
 #include <sys/ioctl.h>
@@ -72,6 +73,7 @@
 #include <linux/blkzoned.h>
 #endif
 #include <linux/cdrom.h>
+#include <linux/dm-ioctl.h>
 #include <linux/fd.h>
 #include <linux/fs.h>
 #include <linux/hdreg.h>
@@ -138,6 +140,22 @@
 #define RAW_LOCK_PERM_BASE             100
 #define RAW_LOCK_SHARED_BASE           200
 
+/*
+ * Multiple retries are mostly meant for two separate scenarios:
+ *
+ * - DM_MPATH_PROBE_PATHS returns success, but before SG_IO completes, another
+ *   path goes down.
+ *
+ * - DM_MPATH_PROBE_PATHS failed all paths in the current path group, so we have
+ *   to send another SG_IO to switch to another path group to probe the paths in
+ *   it.
+ *
+ * Even if each path is in a separate path group (path_grouping_policy set to
+ * failover), it's rare to have more than eight path groups - and even then
+ * pretty unlikely that only bad path groups would be chosen in eight retries.
+ */
+#define SG_IO_MAX_RETRIES 8
+
 typedef struct BDRVRawState {
     int fd;
     bool use_lock;
@@ -165,6 +183,7 @@ typedef struct BDRVRawState {
     bool use_linux_aio:1;
     bool has_laio_fdsync:1;
     bool use_linux_io_uring:1;
+    bool use_mpath:1;
     int page_cache_inconsistent; /* errno from fdatasync failure */
     bool has_fallocate;
     bool needs_alignment;
@@ -4253,15 +4272,105 @@ hdev_open_Mac_error:
     /* Since this does ioctl the device must be already opened */
     bs->sg = hdev_is_sg(bs);
 
+    /* sg devices aren't even block devices and can't use dm-mpath */
+    s->use_mpath = !bs->sg;
+
     return ret;
 }
 
 #if defined(__linux__)
+#if defined(DM_MPATH_PROBE_PATHS)
+static bool coroutine_fn sgio_path_error(int ret, sg_io_hdr_t *io_hdr)
+{
+    if (ret < 0) {
+        switch (ret) {
+        case -ENODEV:
+            return true;
+        case -EAGAIN:
+            /*
+             * The device is probably suspended. This happens while the dm table
+             * is reloaded, e.g. because a path is added or removed. This is an
+             * operation that should complete within 1ms, so just wait a bit and
+             * retry.
+             *
+             * If the device was suspended for another reason, we'll wait and
+             * retry SG_IO_MAX_RETRIES times. This is a tolerable delay before
+             * we return an error and potentially stop the VM.
+             */
+            qemu_co_sleep_ns(QEMU_CLOCK_REALTIME, 1000000);
+            return true;
+        default:
+            return false;
+        }
+    }
+
+    if (io_hdr->host_status != SCSI_HOST_OK) {
+        return true;
+    }
+
+    switch (io_hdr->status) {
+    case GOOD:
+    case CONDITION_GOOD:
+    case INTERMEDIATE_GOOD:
+    case INTERMEDIATE_C_GOOD:
+    case RESERVATION_CONFLICT:
+    case COMMAND_TERMINATED:
+        return false;
+    case CHECK_CONDITION:
+        return !scsi_sense_buf_is_guest_recoverable(io_hdr->sbp,
+                                                    io_hdr->mx_sb_len);
+    default:
+        return true;
+    }
+}
+
+static bool coroutine_fn hdev_co_ioctl_sgio_retry(RawPosixAIOData *acb, int ret)
+{
+    BDRVRawState *s = acb->bs->opaque;
+    RawPosixAIOData probe_acb;
+
+    if (!s->use_mpath) {
+        return false;
+    }
+
+    if (!sgio_path_error(ret, acb->ioctl.buf)) {
+        return false;
+    }
+
+    probe_acb = (RawPosixAIOData) {
+        .bs         = acb->bs,
+        .aio_type   = QEMU_AIO_IOCTL,
+        .aio_fildes = s->fd,
+        .aio_offset = 0,
+        .ioctl      = {
+            .buf        = NULL,
+            .cmd        = DM_MPATH_PROBE_PATHS,
+        },
+    };
+
+    ret = raw_thread_pool_submit(handle_aiocb_ioctl, &probe_acb);
+    if (ret == -ENOTTY) {
+        s->use_mpath = false;
+    } else if (ret == -EAGAIN) {
+        /* The device might be suspended for a table reload, worth retrying */
+        return true;
+    }
+
+    return ret == 0;
+}
+#else
+static bool coroutine_fn hdev_co_ioctl_sgio_retry(RawPosixAIOData *acb, int ret)
+{
+    return false;
+}
+#endif /* DM_MPATH_PROBE_PATHS */
+
 static int coroutine_fn
 hdev_co_ioctl(BlockDriverState *bs, unsigned long int req, void *buf)
 {
     BDRVRawState *s = bs->opaque;
     RawPosixAIOData acb;
+    int retries = SG_IO_MAX_RETRIES;
     int ret;
 
     ret = fd_open(bs);
@@ -4289,7 +4398,11 @@ hdev_co_ioctl(BlockDriverState *bs, unsigned long int req, void *buf)
         },
     };
 
-    return raw_thread_pool_submit(handle_aiocb_ioctl, &acb);
+    do {
+        ret = raw_thread_pool_submit(handle_aiocb_ioctl, &acb);
+    } while (req == SG_IO && retries-- && hdev_co_ioctl_sgio_retry(&acb, ret));
+
+    return ret;
 }
 #endif /* linux */
 

From bf53e2023271cfea80d7cae1d92143181fa547b5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Tue, 11 Mar 2025 17:51:10 +0400
Subject: [PATCH 1093/2760] ui/gtk: warn if setting the clipboard failed
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Just in case.
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 ui/gtk-clipboard.c | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/ui/gtk-clipboard.c b/ui/gtk-clipboard.c
index 8d8a636fd1..65d89ec601 100644
--- a/ui/gtk-clipboard.c
+++ b/ui/gtk-clipboard.c
@@ -19,6 +19,7 @@
  */
 
 #include "qemu/osdep.h"
+#include "qemu/error-report.h"
 #include "qemu/main-loop.h"
 
 #include "ui/gtk.h"
@@ -95,11 +96,13 @@ static void gd_clipboard_update_info(GtkDisplayState *gd,
             gtk_clipboard_clear(gd->gtkcb[s]);
             if (targets) {
                 gd->cbowner[s] = true;
-                gtk_clipboard_set_with_data(gd->gtkcb[s],
-                                            targets, n_targets,
-                                            gd_clipboard_get_data,
-                                            gd_clipboard_clear,
-                                            gd);
+                if (!gtk_clipboard_set_with_data(gd->gtkcb[s],
+                                                 targets, n_targets,
+                                                 gd_clipboard_get_data,
+                                                 gd_clipboard_clear,
+                                                 gd)) {
+                    warn_report("Failed to set GTK clipboard");
+                }
 
                 gtk_target_table_free(targets, n_targets);
             }

From acc6a94a812cd1337785413b27580f8a8f4ac170 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Tue, 11 Mar 2025 17:52:14 +0400
Subject: [PATCH 1094/2760] ui/clipboard: use int for selection field
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This allows to use a VMSTATE_INT32 field for migration purposes.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
---
 include/ui/clipboard.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/ui/clipboard.h b/include/ui/clipboard.h
index ab6acdbd8a..14b6099e73 100644
--- a/include/ui/clipboard.h
+++ b/include/ui/clipboard.h
@@ -112,7 +112,7 @@ struct QemuClipboardNotify {
 struct QemuClipboardInfo {
     uint32_t refcount;
     QemuClipboardPeer *owner;
-    QemuClipboardSelection selection;
+    int selection; /* QemuClipboardSelection */
     bool has_serial;
     uint32_t serial;
     struct {

From a3f59c70d6c943e3a4d9c44ed138fa15c5ded70b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Tue, 11 Mar 2025 17:53:06 +0400
Subject: [PATCH 1095/2760] ui/clipboard: split out QemuClipboardContent
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Allows to use VMSTATE STRUCT in following migration support patch.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
---
 include/ui/clipboard.h | 26 ++++++++++++++++++++------
 1 file changed, 20 insertions(+), 6 deletions(-)

diff --git a/include/ui/clipboard.h b/include/ui/clipboard.h
index 14b6099e73..88cfff91ef 100644
--- a/include/ui/clipboard.h
+++ b/include/ui/clipboard.h
@@ -25,6 +25,7 @@ typedef enum QemuClipboardSelection QemuClipboardSelection;
 typedef struct QemuClipboardPeer QemuClipboardPeer;
 typedef struct QemuClipboardNotify QemuClipboardNotify;
 typedef struct QemuClipboardInfo QemuClipboardInfo;
+typedef struct QemuClipboardContent QemuClipboardContent;
 
 /**
  * enum QemuClipboardType
@@ -97,6 +98,24 @@ struct QemuClipboardNotify {
     };
 };
 
+
+/**
+ * struct QemuClipboardContent
+ *
+ * @available: whether the data is available
+ * @requested: whether the data was requested
+ * @size: the size of the @data
+ * @data: the clipboard data
+ *
+ * Clipboard content.
+ */
+struct QemuClipboardContent {
+    bool available;
+    bool requested;
+    uint32_t size;
+    void *data;
+};
+
 /**
  * struct QemuClipboardInfo
  *
@@ -115,12 +134,7 @@ struct QemuClipboardInfo {
     int selection; /* QemuClipboardSelection */
     bool has_serial;
     uint32_t serial;
-    struct {
-        bool available;
-        bool requested;
-        size_t size;
-        void *data;
-    } types[QEMU_CLIPBOARD_TYPE__COUNT];
+    QemuClipboardContent types[QEMU_CLIPBOARD_TYPE__COUNT];
 };
 
 /**

From d0de94cbc053c4475fbf705cafa1ab488eae3a19 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Tue, 11 Mar 2025 17:55:21 +0400
Subject: [PATCH 1096/2760] ui/clipboard: add vmstate_cbinfo
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add a VMStateDescriptor for QemuClipboardInfo.

Each clipboard owner will have to save its QemuClipboardInfo and
reregister its owned clipboard after loading. (the global cbinfo has
only pointers to owners, so it can't restore the relation with its owner
if it was to handle migration)

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
---
 include/ui/clipboard.h |  3 +++
 ui/clipboard.c         | 26 ++++++++++++++++++++++++++
 2 files changed, 29 insertions(+)

diff --git a/include/ui/clipboard.h b/include/ui/clipboard.h
index 88cfff91ef..62a96ce9ff 100644
--- a/include/ui/clipboard.h
+++ b/include/ui/clipboard.h
@@ -2,6 +2,7 @@
 #define QEMU_CLIPBOARD_H
 
 #include "qemu/notify.h"
+#include "migration/vmstate.h"
 
 /**
  * DOC: Introduction
@@ -27,6 +28,8 @@ typedef struct QemuClipboardNotify QemuClipboardNotify;
 typedef struct QemuClipboardInfo QemuClipboardInfo;
 typedef struct QemuClipboardContent QemuClipboardContent;
 
+extern const VMStateDescription vmstate_cbinfo;
+
 /**
  * enum QemuClipboardType
  *
diff --git a/ui/clipboard.c b/ui/clipboard.c
index 132086eb13..f5db60c63d 100644
--- a/ui/clipboard.c
+++ b/ui/clipboard.c
@@ -7,6 +7,32 @@ static NotifierList clipboard_notifiers =
 
 static QemuClipboardInfo *cbinfo[QEMU_CLIPBOARD_SELECTION__COUNT];
 
+static const VMStateDescription vmstate_cbcontent = {
+    .name = "clipboard/content",
+    .version_id = 0,
+    .minimum_version_id = 0,
+    .fields = (const VMStateField[]) {
+        VMSTATE_BOOL(available, QemuClipboardContent),
+        VMSTATE_BOOL(requested, QemuClipboardContent),
+        VMSTATE_UINT32(size, QemuClipboardContent),
+        VMSTATE_VBUFFER_ALLOC_UINT32(data, QemuClipboardContent, 0, 0, size),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+const VMStateDescription vmstate_cbinfo = {
+    .name = "clipboard",
+    .version_id = 0,
+    .minimum_version_id = 0,
+    .fields = (const VMStateField[]) {
+        VMSTATE_INT32(selection, QemuClipboardInfo),
+        VMSTATE_BOOL(has_serial, QemuClipboardInfo),
+        VMSTATE_UINT32(serial, QemuClipboardInfo),
+        VMSTATE_STRUCT_ARRAY(types, QemuClipboardInfo, QEMU_CLIPBOARD_TYPE__COUNT, 0, vmstate_cbcontent, QemuClipboardContent),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
 void qemu_clipboard_peer_register(QemuClipboardPeer *peer)
 {
     notifier_list_add(&clipboard_notifiers, &peer->notifier);

From c967ff606b99f5f4ecc16817b9d9604a9c943dd2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Tue, 11 Mar 2025 18:51:08 +0400
Subject: [PATCH 1097/2760] ui/clipboard: delay clipboard update when not
 running
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When VM is paused, we shouldn't notify of clipboard changes, similar to
how input are being treated.

On unsuspend, notify of the current state.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
---
 ui/clipboard.c | 40 ++++++++++++++++++++++++++++++++++++++--
 1 file changed, 38 insertions(+), 2 deletions(-)

diff --git a/ui/clipboard.c b/ui/clipboard.c
index f5db60c63d..ec00a0b8ec 100644
--- a/ui/clipboard.c
+++ b/ui/clipboard.c
@@ -1,4 +1,5 @@
 #include "qemu/osdep.h"
+#include "system/runstate.h"
 #include "ui/clipboard.h"
 #include "trace.h"
 
@@ -7,6 +8,10 @@ static NotifierList clipboard_notifiers =
 
 static QemuClipboardInfo *cbinfo[QEMU_CLIPBOARD_SELECTION__COUNT];
 
+static VMChangeStateEntry *cb_change_state_entry = NULL;
+
+static bool cb_reset_serial_on_resume = false;
+
 static const VMStateDescription vmstate_cbcontent = {
     .name = "clipboard/content",
     .version_id = 0,
@@ -33,8 +38,32 @@ const VMStateDescription vmstate_cbinfo = {
     }
 };
 
+static void qemu_clipboard_change_state(void *opaque, bool running, RunState state)
+{
+    int i;
+
+    if (!running) {
+        return;
+    }
+
+    if (cb_reset_serial_on_resume) {
+        qemu_clipboard_reset_serial();
+    }
+
+    for (i = 0; i < QEMU_CLIPBOARD_SELECTION__COUNT; i++) {
+        if (cbinfo[i]) {
+            qemu_clipboard_update(cbinfo[i]);
+        }
+    }
+
+}
+
 void qemu_clipboard_peer_register(QemuClipboardPeer *peer)
 {
+    if (cb_change_state_entry == NULL) {
+        cb_change_state_entry = qemu_add_vm_change_state_handler(qemu_clipboard_change_state, NULL);
+    }
+
     notifier_list_add(&clipboard_notifiers, &peer->notifier);
 }
 
@@ -109,7 +138,9 @@ void qemu_clipboard_update(QemuClipboardInfo *info)
         }
     }
 
-    notifier_list_notify(&clipboard_notifiers, &notify);
+    if (runstate_is_running() || runstate_check(RUN_STATE_SUSPENDED)) {
+        notifier_list_notify(&clipboard_notifiers, &notify);
+    }
 
     if (cbinfo[info->selection] != info) {
         qemu_clipboard_info_unref(cbinfo[info->selection]);
@@ -189,7 +220,12 @@ void qemu_clipboard_reset_serial(void)
             info->serial = 0;
         }
     }
-    notifier_list_notify(&clipboard_notifiers, &notify);
+
+    if (runstate_is_running() || runstate_check(RUN_STATE_SUSPENDED)) {
+        notifier_list_notify(&clipboard_notifiers, &notify);
+    } else {
+        cb_reset_serial_on_resume = true;
+    }
 }
 
 void qemu_clipboard_set_data(QemuClipboardPeer *peer,

From ac5e2bc910d350cd0653b8d049518d642ee14a49 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Mon, 10 Mar 2025 15:26:25 +0400
Subject: [PATCH 1098/2760] ui/vdagent: replace Buffer with GByteArray
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Buffer is slightly more advanced than GByteArray, since it has a
cursor/position. But vdagent code doesn't need it. This simplify a bit
the code, and migration state.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
---
 ui/vdagent.c | 25 ++++++++++++-------------
 1 file changed, 12 insertions(+), 13 deletions(-)

diff --git a/ui/vdagent.c b/ui/vdagent.c
index 04513ded29..4027126b7d 100644
--- a/ui/vdagent.c
+++ b/ui/vdagent.c
@@ -47,7 +47,7 @@ struct VDAgentChardev {
     uint32_t msgsize;
     uint8_t *xbuf;
     uint32_t xoff, xsize;
-    Buffer outbuf;
+    GByteArray *outbuf;
 
     /* mouse */
     DeviceState mouse_dev;
@@ -142,16 +142,16 @@ static void vdagent_send_buf(VDAgentChardev *vd)
 {
     uint32_t len;
 
-    while (!buffer_empty(&vd->outbuf)) {
+    while (vd->outbuf->len) {
         len = qemu_chr_be_can_write(CHARDEV(vd));
         if (len == 0) {
             return;
         }
-        if (len > vd->outbuf.offset) {
-            len = vd->outbuf.offset;
+        if (len > vd->outbuf->len) {
+            len = vd->outbuf->len;
         }
-        qemu_chr_be_write(CHARDEV(vd), vd->outbuf.buffer, len);
-        buffer_advance(&vd->outbuf, len);
+        qemu_chr_be_write(CHARDEV(vd), vd->outbuf->data, len);
+        g_byte_array_remove_range(vd->outbuf, 0, len);
     }
 }
 
@@ -166,7 +166,7 @@ static void vdagent_send_msg(VDAgentChardev *vd, VDAgentMessage *msg)
 
     msg->protocol = VD_AGENT_PROTOCOL;
 
-    if (vd->outbuf.offset + msgsize > VDAGENT_BUFFER_LIMIT) {
+    if (vd->outbuf->len + msgsize > VDAGENT_BUFFER_LIMIT) {
         error_report("buffer full, dropping message");
         return;
     }
@@ -177,9 +177,8 @@ static void vdagent_send_msg(VDAgentChardev *vd, VDAgentMessage *msg)
         if (chunk.size > 1024) {
             chunk.size = 1024;
         }
-        buffer_reserve(&vd->outbuf, sizeof(chunk) + chunk.size);
-        buffer_append(&vd->outbuf, &chunk, sizeof(chunk));
-        buffer_append(&vd->outbuf, msgbuf + msgoff, chunk.size);
+        g_byte_array_append(vd->outbuf, (void *)&chunk, sizeof(chunk));
+        g_byte_array_append(vd->outbuf, msgbuf + msgoff, chunk.size);
         msgoff += chunk.size;
     }
     vdagent_send_buf(vd);
@@ -859,7 +858,7 @@ static void vdagent_disconnect(VDAgentChardev *vd)
 {
     trace_vdagent_disconnect();
 
-    buffer_reset(&vd->outbuf);
+    g_byte_array_set_size(vd->outbuf, 0);
     vdagent_reset_bufs(vd);
     vd->caps = 0;
     if (vd->mouse_hs) {
@@ -920,7 +919,7 @@ static void vdagent_chr_init(Object *obj)
 {
     VDAgentChardev *vd = QEMU_VDAGENT_CHARDEV(obj);
 
-    buffer_init(&vd->outbuf, "vdagent-outbuf");
+    vd->outbuf = g_byte_array_new();
     error_setg(&vd->migration_blocker,
                "The vdagent chardev doesn't yet support migration");
 }
@@ -934,7 +933,7 @@ static void vdagent_chr_fini(Object *obj)
     if (vd->mouse_hs) {
         qemu_input_handler_unregister(vd->mouse_hs);
     }
-    buffer_free(&vd->outbuf);
+    g_clear_pointer(&vd->outbuf, g_byte_array_unref);
 }
 
 static const TypeInfo vdagent_chr_type_info = {

From 688ff4cbdf4993c60ee250afc48e15c0880f28de Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Tue, 11 Mar 2025 18:00:14 +0400
Subject: [PATCH 1099/2760] ui/vdagent: keep "connected" state
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

During post-load of migration, virtio will notify of fe_open state.
However vdagent code will handle this as a reconnection. This will
trigger a connection reset/caps with the agent.

Check if the state actually changed before resetting the connection.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
---
 ui/vdagent.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/ui/vdagent.c b/ui/vdagent.c
index 4027126b7d..210b8c14ca 100644
--- a/ui/vdagent.c
+++ b/ui/vdagent.c
@@ -40,6 +40,7 @@ struct VDAgentChardev {
     bool clipboard;
 
     /* guest vdagent */
+    bool connected;
     uint32_t caps;
     VDIChunkHeader chunk;
     uint32_t chunksize;
@@ -858,6 +859,7 @@ static void vdagent_disconnect(VDAgentChardev *vd)
 {
     trace_vdagent_disconnect();
 
+    vd->connected = false;
     g_byte_array_set_size(vd->outbuf, 0);
     vdagent_reset_bufs(vd);
     vd->caps = 0;
@@ -876,6 +878,10 @@ static void vdagent_chr_set_fe_open(struct Chardev *chr, int fe_open)
 
     trace_vdagent_fe_open(fe_open);
 
+    if (vd->connected == fe_open) {
+        return;
+    }
+
     if (!fe_open) {
         trace_vdagent_close();
         vdagent_disconnect(vd);
@@ -885,6 +891,7 @@ static void vdagent_chr_set_fe_open(struct Chardev *chr, int fe_open)
         return;
     }
 
+    vd->connected = true;
     vdagent_send_caps(vd, true);
 }
 

From f626116f9897b95f68e5514a08098d590349c22e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Tue, 11 Mar 2025 18:03:47 +0400
Subject: [PATCH 1100/2760] ui/vdagent: factor out clipboard peer registration
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This allows common code reuse during migration.

Note that resetting the serial is now done regardless if the clipboard
peer was registered or not. This should still be correct.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
---
 ui/vdagent.c | 20 ++++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/ui/vdagent.c b/ui/vdagent.c
index 210b8c14ca..fcbd7b167b 100644
--- a/ui/vdagent.c
+++ b/ui/vdagent.c
@@ -694,6 +694,18 @@ static void vdagent_chr_open(Chardev *chr,
     *be_opened = true;
 }
 
+static void vdagent_clipboard_peer_register(VDAgentChardev *vd)
+{
+    if (vd->cbpeer.notifier.notify != NULL) {
+        return;
+    }
+
+    vd->cbpeer.name = "vdagent";
+    vd->cbpeer.notifier.notify = vdagent_clipboard_notify;
+    vd->cbpeer.request = vdagent_clipboard_request;
+    qemu_clipboard_peer_register(&vd->cbpeer);
+}
+
 static void vdagent_chr_recv_caps(VDAgentChardev *vd, VDAgentMessage *msg)
 {
     VDAgentAnnounceCapabilities *caps = (void *)msg->data;
@@ -720,13 +732,9 @@ static void vdagent_chr_recv_caps(VDAgentChardev *vd, VDAgentMessage *msg)
 
     memset(vd->last_serial, 0, sizeof(vd->last_serial));
 
-    if (have_clipboard(vd) && vd->cbpeer.notifier.notify == NULL) {
+    if (have_clipboard(vd)) {
         qemu_clipboard_reset_serial();
-
-        vd->cbpeer.name = "vdagent";
-        vd->cbpeer.notifier.notify = vdagent_clipboard_notify;
-        vd->cbpeer.request = vdagent_clipboard_request;
-        qemu_clipboard_peer_register(&vd->cbpeer);
+        vdagent_clipboard_peer_register(vd);
     }
 }
 

From 5d56bff11e3d7fdbbf7fda6c9a8ebd0d6b7a7bac Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Tue, 11 Mar 2025 18:32:10 +0400
Subject: [PATCH 1101/2760] ui/vdagent: add migration support
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
---
 ui/vdagent.c | 142 +++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 142 insertions(+)

diff --git a/ui/vdagent.c b/ui/vdagent.c
index fcbd7b167b..adc8755bd9 100644
--- a/ui/vdagent.c
+++ b/ui/vdagent.c
@@ -10,6 +10,7 @@
 #include "ui/clipboard.h"
 #include "ui/console.h"
 #include "ui/input.h"
+#include "migration/vmstate.h"
 #include "trace.h"
 
 #include "qapi/qapi-types-char.h"
@@ -930,6 +931,146 @@ static void vdagent_chr_class_init(ObjectClass *oc, const void *data)
     cc->chr_accept_input = vdagent_chr_accept_input;
 }
 
+static int post_load(void *opaque, int version_id)
+{
+    VDAgentChardev *vd = QEMU_VDAGENT_CHARDEV(opaque);
+
+    if (have_mouse(vd) && vd->mouse_hs) {
+        qemu_input_handler_activate(vd->mouse_hs);
+    }
+
+    if (have_clipboard(vd)) {
+        vdagent_clipboard_peer_register(vd);
+    }
+
+    return 0;
+}
+
+static const VMStateDescription vmstate_chunk = {
+    .name = "vdagent/chunk",
+    .version_id = 0,
+    .minimum_version_id = 0,
+    .fields = (const VMStateField[]) {
+        VMSTATE_UINT32(port, VDIChunkHeader),
+        VMSTATE_UINT32(size, VDIChunkHeader),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static const VMStateDescription vmstate_vdba = {
+    .name = "vdagent/bytearray",
+    .version_id = 0,
+    .minimum_version_id = 0,
+    .fields = (const VMStateField[]) {
+        VMSTATE_UINT32(len, GByteArray),
+        VMSTATE_VBUFFER_ALLOC_UINT32(data, GByteArray, 0, 0, len),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+struct CBInfoArray {
+    uint32_t n;
+    QemuClipboardInfo cbinfo[QEMU_CLIPBOARD_SELECTION__COUNT];
+};
+
+static const VMStateDescription vmstate_cbinfo_array = {
+    .name = "cbinfoarray",
+    .fields = (const VMStateField[]) {
+        VMSTATE_UINT32(n, struct CBInfoArray),
+        VMSTATE_STRUCT_VARRAY_UINT32(cbinfo, struct CBInfoArray, n,
+                                     0, vmstate_cbinfo, QemuClipboardInfo),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static int put_cbinfo(QEMUFile *f, void *pv, size_t size,
+                      const VMStateField *field, JSONWriter *vmdesc)
+{
+    VDAgentChardev *vd = QEMU_VDAGENT_CHARDEV(pv);
+    struct CBInfoArray cbinfo = {};
+    int i;
+
+    if (!have_clipboard(vd)) {
+        return 0;
+    }
+
+    for (i = 0; i < QEMU_CLIPBOARD_SELECTION__COUNT; i++) {
+        if (qemu_clipboard_peer_owns(&vd->cbpeer, i)) {
+            cbinfo.cbinfo[cbinfo.n++] = *qemu_clipboard_info(i);
+        }
+    }
+
+    return vmstate_save_state(f, &vmstate_cbinfo_array, &cbinfo, vmdesc);
+}
+
+static int get_cbinfo(QEMUFile *f, void *pv, size_t size,
+                      const VMStateField *field)
+{
+    VDAgentChardev *vd = QEMU_VDAGENT_CHARDEV(pv);
+    struct CBInfoArray cbinfo = {};
+    int i, ret;
+
+    if (!have_clipboard(vd)) {
+        return 0;
+    }
+
+    vdagent_clipboard_peer_register(vd);
+
+    ret = vmstate_load_state(f, &vmstate_cbinfo_array, &cbinfo, 0);
+    if (ret) {
+        return ret;
+    }
+
+    for (i = 0; i < cbinfo.n; i++) {
+        g_autoptr(QemuClipboardInfo) info =
+            qemu_clipboard_info_new(&vd->cbpeer, cbinfo.cbinfo[i].selection);
+        /* this will steal clipboard data pointer from cbinfo.types */
+        memcpy(info->types, cbinfo.cbinfo[i].types, sizeof(cbinfo.cbinfo[i].types));
+        qemu_clipboard_update(info);
+    }
+
+    return 0;
+}
+
+static const VMStateInfo vmstate_cbinfos = {
+    .name = "vdagent/cbinfos",
+    .get  = get_cbinfo,
+    .put  = put_cbinfo,
+};
+
+static const VMStateDescription vmstate_vdagent = {
+    .name = "vdagent",
+    .version_id = 0,
+    .minimum_version_id = 0,
+    .post_load = post_load,
+    .fields = (const VMStateField[]) {
+        VMSTATE_BOOL(connected, VDAgentChardev),
+        VMSTATE_UINT32(caps, VDAgentChardev),
+        VMSTATE_STRUCT(chunk, VDAgentChardev, 0, vmstate_chunk, VDIChunkHeader),
+        VMSTATE_UINT32(chunksize, VDAgentChardev),
+        VMSTATE_UINT32(msgsize, VDAgentChardev),
+        VMSTATE_VBUFFER_ALLOC_UINT32(msgbuf, VDAgentChardev, 0, 0, msgsize),
+        VMSTATE_UINT32(xsize, VDAgentChardev),
+        VMSTATE_UINT32(xoff, VDAgentChardev),
+        VMSTATE_VBUFFER_ALLOC_UINT32(xbuf, VDAgentChardev, 0, 0, xsize),
+        VMSTATE_STRUCT_POINTER(outbuf, VDAgentChardev, vmstate_vdba, GByteArray),
+        VMSTATE_UINT32(mouse_x, VDAgentChardev),
+        VMSTATE_UINT32(mouse_y, VDAgentChardev),
+        VMSTATE_UINT32(mouse_btn, VDAgentChardev),
+        VMSTATE_UINT32(mouse_display, VDAgentChardev),
+        VMSTATE_UINT32_ARRAY(last_serial, VDAgentChardev,
+                             QEMU_CLIPBOARD_SELECTION__COUNT),
+        VMSTATE_UINT32_ARRAY(cbpending, VDAgentChardev,
+                             QEMU_CLIPBOARD_SELECTION__COUNT),
+        {
+            .name         = "cbinfos",
+            .info         = &vmstate_cbinfos,
+            .flags        = VMS_SINGLE,
+        },
+        VMSTATE_END_OF_LIST()
+    }
+};
+
 static void vdagent_chr_init(Object *obj)
 {
     VDAgentChardev *vd = QEMU_VDAGENT_CHARDEV(obj);
@@ -937,6 +1078,7 @@ static void vdagent_chr_init(Object *obj)
     vd->outbuf = g_byte_array_new();
     error_setg(&vd->migration_blocker,
                "The vdagent chardev doesn't yet support migration");
+    vmstate_register_any(NULL, &vmstate_vdagent, vd);
 }
 
 static void vdagent_chr_fini(Object *obj)

From 42000e0013709f21b54f71b63525c22cb6b92d5d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Mon, 10 Mar 2025 11:46:13 +0400
Subject: [PATCH 1102/2760] ui/vdagent: remove migration blocker
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fixes: https://issues.redhat.com/browse/RHEL-81894
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
---
 ui/vdagent.c | 11 -----------
 1 file changed, 11 deletions(-)

diff --git a/ui/vdagent.c b/ui/vdagent.c
index adc8755bd9..c0746fe5b1 100644
--- a/ui/vdagent.c
+++ b/ui/vdagent.c
@@ -6,7 +6,6 @@
 #include "qemu/option.h"
 #include "qemu/units.h"
 #include "hw/qdev-core.h"
-#include "migration/blocker.h"
 #include "ui/clipboard.h"
 #include "ui/console.h"
 #include "ui/input.h"
@@ -33,9 +32,6 @@
 struct VDAgentChardev {
     Chardev parent;
 
-    /* TODO: migration isn't yet supported */
-    Error *migration_blocker;
-
     /* config */
     bool mouse;
     bool clipboard;
@@ -673,10 +669,6 @@ static void vdagent_chr_open(Chardev *chr,
     return;
 #endif
 
-    if (migrate_add_blocker(&vd->migration_blocker, errp) != 0) {
-        return;
-    }
-
     vd->mouse = VDAGENT_MOUSE_DEFAULT;
     if (cfg->has_mouse) {
         vd->mouse = cfg->mouse;
@@ -1076,8 +1068,6 @@ static void vdagent_chr_init(Object *obj)
     VDAgentChardev *vd = QEMU_VDAGENT_CHARDEV(obj);
 
     vd->outbuf = g_byte_array_new();
-    error_setg(&vd->migration_blocker,
-               "The vdagent chardev doesn't yet support migration");
     vmstate_register_any(NULL, &vmstate_vdagent, vd);
 }
 
@@ -1085,7 +1075,6 @@ static void vdagent_chr_fini(Object *obj)
 {
     VDAgentChardev *vd = QEMU_VDAGENT_CHARDEV(obj);
 
-    migrate_del_blocker(&vd->migration_blocker);
     vdagent_disconnect(vd);
     if (vd->mouse_hs) {
         qemu_input_handler_unregister(vd->mouse_hs);

From 9498e2f7e1a247557cfa0f830a86c398a23c6809 Mon Sep 17 00:00:00 2001
From: Weifeng Liu <weifeng.liu.z@gmail.com>
Date: Sun, 11 May 2025 15:33:11 +0800
Subject: [PATCH 1103/2760] ui/gtk: Document scale and coordinate handling
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The existence of multiple scaling factors forces us to deal with various
coordinate systems and this would be confusing. It would be beneficial
to define the concepts clearly and use consistent representation for
variables in different coordinates.

Signed-off-by: Weifeng Liu <weifeng.liu.z@gmail.com>
Message-ID: <20250511073337.876650-2-weifeng.liu.z@gmail.com>
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
Acked-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 ui/gtk.c | 65 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 65 insertions(+)

diff --git a/ui/gtk.c b/ui/gtk.c
index 982037b2c0..9f3171abc5 100644
--- a/ui/gtk.c
+++ b/ui/gtk.c
@@ -800,6 +800,71 @@ void gd_update_monitor_refresh_rate(VirtualConsole *vc, GtkWidget *widget)
 #endif
 }
 
+/**
+ * DOC: Coordinate handling.
+ *
+ * We are coping with sizes and positions in various coordinates and the
+ * handling of these coordinates is somewhat confusing. It would benefit us
+ * all if we define these coordinates explicitly and clearly. Besides, it's
+ * also helpful to follow the same naming convention for variables
+ * representing values in different coordinates.
+ *
+ * I. Definitions
+ *
+ * - (guest) buffer coordinate: this is the coordinates that the guest will
+ *   see. The x/y offsets and width/height specified in commands sent by
+ *   guest is basically in buffer coordinate.
+ *
+ * - (host) pixel coordinate: this is the coordinate in pixel level on the
+ *   host destop. A window/widget of width 300 in pixel coordinate means it
+ *   occupies 300 pixels horizontally.
+ *
+ * - (host) logical window coordinate: the existence of global scaling
+ *   factor in desktop level makes this kind of coordinate play a role. It
+ *   always holds that (logical window size) * (global scale factor) =
+ *   (pixel size).
+ *
+ * - global scale factor: this is specified in desktop level and is
+ *   typically invariant during the life cycle of the process. Users with
+ *   high-DPI monitors might set this scale, for example, to 2, in order to
+ *   make the UI look larger.
+ *
+ * - zooming scale: this can be freely controlled by the QEMU user to zoom
+ *   in/out the guest content.
+ *
+ * II. Representation
+ *
+ * We'd like to use consistent representation for variables in different
+ * coordinates:
+ * - buffer coordinate: prefix fb
+ * - pixel coordinate: prefix p
+ * - logical window coordinate: prefix w
+ *
+ * For scales:
+ * - global scale factor: prefix gs
+ * - zooming scale: prefix scale/s
+ *
+ * Example: fbw, pw, ww for width in different coordinates
+ *
+ * III. Equation
+ *
+ * - fbw * gs * scale_x = pw
+ * - pw = gs * ww
+ *
+ * Consequently we have
+ *
+ * - fbw * scale_x = ww
+ *
+ * Example: assuming we are running QEMU on a 3840x2160 screen and have set
+ * global scaling factor to 2, if the guest buffer size is 1920x1080 and the
+ * zooming scale is 0.5, then we have:
+ * - fbw = 1920, fbh = 1080
+ * - pw  = 1920, ph  = 1080
+ * - ww  = 960,  wh  = 540
+ * A bonus of this configuration is that we can achieve pixel to pixel
+ * presentation of the guest content.
+ */
+
 static gboolean gd_draw_event(GtkWidget *widget, cairo_t *cr, void *opaque)
 {
     VirtualConsole *vc = opaque;

From 3a6b314409b42fe7c46c2bd80cfc2a6744d414fe Mon Sep 17 00:00:00 2001
From: Weifeng Liu <weifeng.liu.z@gmail.com>
Date: Sun, 11 May 2025 15:33:12 +0800
Subject: [PATCH 1104/2760] ui/gtk: Use consistent naming for variables in
 different coordinates
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Now that we've documented definitions and presentation of various
coordinates, let's enforce the rules.

Signed-off-by: Weifeng Liu <weifeng.liu.z@gmail.com>
Message-ID: <20250511073337.876650-3-weifeng.liu.z@gmail.com>
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
Acked-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 ui/gtk-egl.c     |  12 +++--
 ui/gtk-gl-area.c |  14 ++---
 ui/gtk.c         | 133 ++++++++++++++++++++++++-----------------------
 3 files changed, 82 insertions(+), 77 deletions(-)

diff --git a/ui/gtk-egl.c b/ui/gtk-egl.c
index f7a428c86a..947c99334b 100644
--- a/ui/gtk-egl.c
+++ b/ui/gtk-egl.c
@@ -70,16 +70,18 @@ void gd_egl_draw(VirtualConsole *vc)
     QemuDmaBuf *dmabuf = vc->gfx.guest_fb.dmabuf;
     int fence_fd;
 #endif
-    int ww, wh, ws;
+    int ww, wh, pw, ph, gs;
 
     if (!vc->gfx.gls) {
         return;
     }
 
     window = gtk_widget_get_window(vc->gfx.drawing_area);
-    ws = gdk_window_get_scale_factor(window);
-    ww = gdk_window_get_width(window) * ws;
-    wh = gdk_window_get_height(window) * ws;
+    gs = gdk_window_get_scale_factor(window);
+    ww = gdk_window_get_width(window);
+    wh = gdk_window_get_height(window);
+    pw = ww * gs;
+    ph = wh * gs;
 
     if (vc->gfx.scanout_mode) {
 #ifdef CONFIG_GBM
@@ -115,7 +117,7 @@ void gd_egl_draw(VirtualConsole *vc)
         eglMakeCurrent(qemu_egl_display, vc->gfx.esurface,
                        vc->gfx.esurface, vc->gfx.ectx);
 
-        surface_gl_setup_viewport(vc->gfx.gls, vc->gfx.ds, ww, wh);
+        surface_gl_setup_viewport(vc->gfx.gls, vc->gfx.ds, pw, ph);
         surface_gl_render_texture(vc->gfx.gls, vc->gfx.ds);
 
         eglSwapBuffers(qemu_egl_display, vc->gfx.esurface);
diff --git a/ui/gtk-gl-area.c b/ui/gtk-gl-area.c
index 2c9a0db425..ba9fbec432 100644
--- a/ui/gtk-gl-area.c
+++ b/ui/gtk-gl-area.c
@@ -42,16 +42,16 @@ void gd_gl_area_draw(VirtualConsole *vc)
 #ifdef CONFIG_GBM
     QemuDmaBuf *dmabuf = vc->gfx.guest_fb.dmabuf;
 #endif
-    int ww, wh, ws, y1, y2;
+    int pw, ph, gs, y1, y2;
 
     if (!vc->gfx.gls) {
         return;
     }
 
     gtk_gl_area_make_current(GTK_GL_AREA(vc->gfx.drawing_area));
-    ws = gdk_window_get_scale_factor(gtk_widget_get_window(vc->gfx.drawing_area));
-    ww = gtk_widget_get_allocated_width(vc->gfx.drawing_area) * ws;
-    wh = gtk_widget_get_allocated_height(vc->gfx.drawing_area) * ws;
+    gs = gdk_window_get_scale_factor(gtk_widget_get_window(vc->gfx.drawing_area));
+    pw = gtk_widget_get_allocated_width(vc->gfx.drawing_area) * gs;
+    ph = gtk_widget_get_allocated_height(vc->gfx.drawing_area) * gs;
 
     if (vc->gfx.scanout_mode) {
         if (!vc->gfx.guest_fb.framebuffer) {
@@ -71,11 +71,11 @@ void gd_gl_area_draw(VirtualConsole *vc)
         glBindFramebuffer(GL_READ_FRAMEBUFFER, vc->gfx.guest_fb.framebuffer);
         /* GtkGLArea sets GL_DRAW_FRAMEBUFFER for us */
 
-        glViewport(0, 0, ww, wh);
+        glViewport(0, 0, pw, ph);
         y1 = vc->gfx.y0_top ? 0 : vc->gfx.h;
         y2 = vc->gfx.y0_top ? vc->gfx.h : 0;
         glBlitFramebuffer(0, y1, vc->gfx.w, y2,
-                          0, 0, ww, wh,
+                          0, 0, pw, ph,
                           GL_COLOR_BUFFER_BIT, GL_NEAREST);
 #ifdef CONFIG_GBM
         if (dmabuf) {
@@ -101,7 +101,7 @@ void gd_gl_area_draw(VirtualConsole *vc)
         }
         gtk_gl_area_make_current(GTK_GL_AREA(vc->gfx.drawing_area));
 
-        surface_gl_setup_viewport(vc->gfx.gls, vc->gfx.ds, ww, wh);
+        surface_gl_setup_viewport(vc->gfx.gls, vc->gfx.ds, pw, ph);
         surface_gl_render_texture(vc->gfx.gls, vc->gfx.ds);
     }
 }
diff --git a/ui/gtk.c b/ui/gtk.c
index 9f3171abc5..8f5bb4b62e 100644
--- a/ui/gtk.c
+++ b/ui/gtk.c
@@ -387,16 +387,16 @@ static void *gd_win32_get_hwnd(VirtualConsole *vc)
 /** DisplayState Callbacks **/
 
 static void gd_update(DisplayChangeListener *dcl,
-                      int x, int y, int w, int h)
+                      int fbx, int fby, int fbw, int fbh)
 {
     VirtualConsole *vc = container_of(dcl, VirtualConsole, gfx.dcl);
     GdkWindow *win;
-    int x1, x2, y1, y2;
-    int mx, my;
-    int fbw, fbh;
-    int ww, wh;
+    int wx1, wx2, wy1, wy2;
+    int wx_offset, wy_offset;
+    int ww_surface, wh_surface;
+    int ww_widget, wh_widget;
 
-    trace_gd_update(vc->label, x, y, w, h);
+    trace_gd_update(vc->label, fbx, fby, fbw, fbh);
 
     if (!gtk_widget_get_realized(vc->gfx.drawing_area)) {
         return;
@@ -405,35 +405,36 @@ static void gd_update(DisplayChangeListener *dcl,
     if (vc->gfx.convert) {
         pixman_image_composite(PIXMAN_OP_SRC, vc->gfx.ds->image,
                                NULL, vc->gfx.convert,
-                               x, y, 0, 0, x, y, w, h);
+                               fbx, fby, 0, 0, fbx, fby, fbw, fbh);
     }
 
-    x1 = floor(x * vc->gfx.scale_x);
-    y1 = floor(y * vc->gfx.scale_y);
+    wx1 = floor(fbx * vc->gfx.scale_x);
+    wy1 = floor(fby * vc->gfx.scale_y);
 
-    x2 = ceil(x * vc->gfx.scale_x + w * vc->gfx.scale_x);
-    y2 = ceil(y * vc->gfx.scale_y + h * vc->gfx.scale_y);
+    wx2 = ceil(fbx * vc->gfx.scale_x + fbw * vc->gfx.scale_x);
+    wy2 = ceil(fby * vc->gfx.scale_y + fbh * vc->gfx.scale_y);
 
-    fbw = surface_width(vc->gfx.ds) * vc->gfx.scale_x;
-    fbh = surface_height(vc->gfx.ds) * vc->gfx.scale_y;
+    ww_surface = surface_width(vc->gfx.ds) * vc->gfx.scale_x;
+    wh_surface = surface_height(vc->gfx.ds) * vc->gfx.scale_y;
 
     win = gtk_widget_get_window(vc->gfx.drawing_area);
     if (!win) {
         return;
     }
-    ww = gdk_window_get_width(win);
-    wh = gdk_window_get_height(win);
+    ww_widget = gdk_window_get_width(win);
+    wh_widget = gdk_window_get_height(win);
 
-    mx = my = 0;
-    if (ww > fbw) {
-        mx = (ww - fbw) / 2;
+    wx_offset = wy_offset = 0;
+    if (ww_widget > ww_surface) {
+        wx_offset = (ww_widget - ww_surface) / 2;
     }
-    if (wh > fbh) {
-        my = (wh - fbh) / 2;
+    if (wh_widget > wh_surface) {
+        wy_offset = (wh_widget - wh_surface) / 2;
     }
 
     gtk_widget_queue_draw_area(vc->gfx.drawing_area,
-                               mx + x1, my + y1, (x2 - x1), (y2 - y1));
+                               wx_offset + wx1, wy_offset + wy1,
+                               (wx2 - wx1), (wy2 - wy1));
 }
 
 static void gd_refresh(DisplayChangeListener *dcl)
@@ -869,8 +870,8 @@ static gboolean gd_draw_event(GtkWidget *widget, cairo_t *cr, void *opaque)
 {
     VirtualConsole *vc = opaque;
     GtkDisplayState *s = vc->s;
-    int mx, my;
-    int ww, wh;
+    int wx_offset, wy_offset;
+    int ww_widget, wh_widget, ww_surface, wh_surface;
     int fbw, fbh;
 
 #if defined(CONFIG_OPENGL)
@@ -904,46 +905,47 @@ static gboolean gd_draw_event(GtkWidget *widget, cairo_t *cr, void *opaque)
     fbw = surface_width(vc->gfx.ds);
     fbh = surface_height(vc->gfx.ds);
 
-    ww = gdk_window_get_width(gtk_widget_get_window(widget));
-    wh = gdk_window_get_height(gtk_widget_get_window(widget));
+    ww_widget = gdk_window_get_width(gtk_widget_get_window(widget));
+    wh_widget = gdk_window_get_height(gtk_widget_get_window(widget));
 
     if (s->full_screen) {
-        vc->gfx.scale_x = (double)ww / fbw;
-        vc->gfx.scale_y = (double)wh / fbh;
+        vc->gfx.scale_x = (double)ww_widget / fbw;
+        vc->gfx.scale_y = (double)wh_widget / fbh;
     } else if (s->free_scale) {
         double sx, sy;
 
-        sx = (double)ww / fbw;
-        sy = (double)wh / fbh;
+        sx = (double)ww_widget / fbw;
+        sy = (double)wh_widget / fbh;
 
         vc->gfx.scale_x = vc->gfx.scale_y = MIN(sx, sy);
     }
 
-    fbw *= vc->gfx.scale_x;
-    fbh *= vc->gfx.scale_y;
+    ww_surface = fbw * vc->gfx.scale_x;
+    wh_surface = fbh * vc->gfx.scale_y;
 
-    mx = my = 0;
-    if (ww > fbw) {
-        mx = (ww - fbw) / 2;
+    wx_offset = wy_offset = 0;
+    if (ww_widget > ww_surface) {
+        wx_offset = (ww_widget - ww_surface) / 2;
     }
-    if (wh > fbh) {
-        my = (wh - fbh) / 2;
+    if (wh_widget > wh_surface) {
+        wy_offset = (wh_widget - wh_surface) / 2;
     }
 
-    cairo_rectangle(cr, 0, 0, ww, wh);
+    cairo_rectangle(cr, 0, 0, ww_widget, wh_widget);
 
     /* Optionally cut out the inner area where the pixmap
        will be drawn. This avoids 'flashing' since we're
        not double-buffering. Note we're using the undocumented
        behaviour of drawing the rectangle from right to left
        to cut out the whole */
-    cairo_rectangle(cr, mx + fbw, my,
-                    -1 * fbw, fbh);
+    cairo_rectangle(cr, wx_offset + ww_surface, wy_offset,
+                    -1 * ww_surface, wh_surface);
     cairo_fill(cr);
 
     cairo_scale(cr, vc->gfx.scale_x, vc->gfx.scale_y);
     cairo_set_source_surface(cr, vc->gfx.surface,
-                             mx / vc->gfx.scale_x, my / vc->gfx.scale_y);
+                             wx_offset / vc->gfx.scale_x,
+                             wy_offset / vc->gfx.scale_y);
     cairo_paint(cr);
 
     return TRUE;
@@ -954,19 +956,19 @@ static gboolean gd_motion_event(GtkWidget *widget, GdkEventMotion *motion,
 {
     VirtualConsole *vc = opaque;
     GtkDisplayState *s = vc->s;
-    int x, y;
-    int mx, my;
-    int fbh, fbw;
-    int ww, wh;
+    int fbx, fby;
+    int wx_offset, wy_offset;
+    int wh_surface, ww_surface;
+    int ww_widget, wh_widget;
 
     if (!vc->gfx.ds) {
         return TRUE;
     }
 
-    fbw = surface_width(vc->gfx.ds) * vc->gfx.scale_x;
-    fbh = surface_height(vc->gfx.ds) * vc->gfx.scale_y;
-    ww = gtk_widget_get_allocated_width(widget);
-    wh = gtk_widget_get_allocated_height(widget);
+    ww_surface = surface_width(vc->gfx.ds) * vc->gfx.scale_x;
+    wh_surface = surface_height(vc->gfx.ds) * vc->gfx.scale_y;
+    ww_widget = gtk_widget_get_allocated_width(widget);
+    wh_widget = gtk_widget_get_allocated_height(widget);
 
     /*
      * `widget` may not have the same size with the frame buffer.
@@ -974,41 +976,42 @@ static gboolean gd_motion_event(GtkWidget *widget, GdkEventMotion *motion,
      * To achieve that, `vc` will be displayed at (mx, my)
      * so that it is displayed at the center of the widget.
      */
-    mx = my = 0;
-    if (ww > fbw) {
-        mx = (ww - fbw) / 2;
+    wx_offset = wy_offset = 0;
+    if (ww_widget > ww_surface) {
+        wx_offset = (ww_widget - ww_surface) / 2;
     }
-    if (wh > fbh) {
-        my = (wh - fbh) / 2;
+    if (wh_widget > wh_surface) {
+        wy_offset = (wh_widget - wh_surface) / 2;
     }
 
     /*
      * `motion` is reported in `widget` coordinates
      * so translating it to the coordinates in `vc`.
      */
-    x = (motion->x - mx) / vc->gfx.scale_x;
-    y = (motion->y - my) / vc->gfx.scale_y;
+    fbx = (motion->x - wx_offset) / vc->gfx.scale_x;
+    fby = (motion->y - wy_offset) / vc->gfx.scale_y;
 
-    trace_gd_motion_event(ww, wh, gtk_widget_get_scale_factor(widget), x, y);
+    trace_gd_motion_event(ww_widget, wh_widget,
+                          gtk_widget_get_scale_factor(widget), fbx, fby);
 
     if (qemu_input_is_absolute(vc->gfx.dcl.con)) {
-        if (x < 0 || y < 0 ||
-            x >= surface_width(vc->gfx.ds) ||
-            y >= surface_height(vc->gfx.ds)) {
+        if (fbx < 0 || fby < 0 ||
+            fbx >= surface_width(vc->gfx.ds) ||
+            fby >= surface_height(vc->gfx.ds)) {
             return TRUE;
         }
-        qemu_input_queue_abs(vc->gfx.dcl.con, INPUT_AXIS_X, x,
+        qemu_input_queue_abs(vc->gfx.dcl.con, INPUT_AXIS_X, fbx,
                              0, surface_width(vc->gfx.ds));
-        qemu_input_queue_abs(vc->gfx.dcl.con, INPUT_AXIS_Y, y,
+        qemu_input_queue_abs(vc->gfx.dcl.con, INPUT_AXIS_Y, fby,
                              0, surface_height(vc->gfx.ds));
         qemu_input_event_sync();
     } else if (s->last_set && s->ptr_owner == vc) {
-        qemu_input_queue_rel(vc->gfx.dcl.con, INPUT_AXIS_X, x - s->last_x);
-        qemu_input_queue_rel(vc->gfx.dcl.con, INPUT_AXIS_Y, y - s->last_y);
+        qemu_input_queue_rel(vc->gfx.dcl.con, INPUT_AXIS_X, fbx - s->last_x);
+        qemu_input_queue_rel(vc->gfx.dcl.con, INPUT_AXIS_Y, fby - s->last_y);
         qemu_input_event_sync();
     }
-    s->last_x = x;
-    s->last_y = y;
+    s->last_x = fbx;
+    s->last_y = fby;
     s->last_set = TRUE;
 
     if (!qemu_input_is_absolute(vc->gfx.dcl.con) && s->ptr_owner == vc) {

From a19665448156f17b52b7f33e7960d57efcfca067 Mon Sep 17 00:00:00 2001
From: Weifeng Liu <weifeng.liu.z@gmail.com>
Date: Sun, 11 May 2025 15:33:13 +0800
Subject: [PATCH 1105/2760] gtk/ui: Introduce helper gd_update_scale
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The code snippet updating scale_x/scale_y is general and will be used in
next patch. Make it a function.

Signed-off-by: Weifeng Liu <weifeng.liu.z@gmail.com>
Message-ID: <20250511073337.876650-4-weifeng.liu.z@gmail.com>
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
Acked-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 include/ui/gtk.h |  2 ++
 ui/gtk.c         | 30 +++++++++++++++++++-----------
 2 files changed, 21 insertions(+), 11 deletions(-)

diff --git a/include/ui/gtk.h b/include/ui/gtk.h
index aa3d637029..d3944046db 100644
--- a/include/ui/gtk.h
+++ b/include/ui/gtk.h
@@ -224,4 +224,6 @@ int gd_gl_area_make_current(DisplayGLCtx *dgc,
 /* gtk-clipboard.c */
 void gd_clipboard_init(GtkDisplayState *gd);
 
+void gd_update_scale(VirtualConsole *vc, int ww, int wh, int fbw, int fbh);
+
 #endif /* UI_GTK_H */
diff --git a/ui/gtk.c b/ui/gtk.c
index 8f5bb4b62e..47af49e387 100644
--- a/ui/gtk.c
+++ b/ui/gtk.c
@@ -801,6 +801,24 @@ void gd_update_monitor_refresh_rate(VirtualConsole *vc, GtkWidget *widget)
 #endif
 }
 
+void gd_update_scale(VirtualConsole *vc, int ww, int wh, int fbw, int fbh)
+{
+    if (!vc) {
+        return;
+    }
+
+    if (vc->s->full_screen) {
+        vc->gfx.scale_x = (double)ww / fbw;
+        vc->gfx.scale_y = (double)wh / fbh;
+    } else if (vc->s->free_scale) {
+        double sx, sy;
+
+        sx = (double)ww / fbw;
+        sy = (double)wh / fbh;
+
+        vc->gfx.scale_x = vc->gfx.scale_y = MIN(sx, sy);
+    }
+}
 /**
  * DOC: Coordinate handling.
  *
@@ -908,17 +926,7 @@ static gboolean gd_draw_event(GtkWidget *widget, cairo_t *cr, void *opaque)
     ww_widget = gdk_window_get_width(gtk_widget_get_window(widget));
     wh_widget = gdk_window_get_height(gtk_widget_get_window(widget));
 
-    if (s->full_screen) {
-        vc->gfx.scale_x = (double)ww_widget / fbw;
-        vc->gfx.scale_y = (double)wh_widget / fbh;
-    } else if (s->free_scale) {
-        double sx, sy;
-
-        sx = (double)ww_widget / fbw;
-        sy = (double)wh_widget / fbh;
-
-        vc->gfx.scale_x = vc->gfx.scale_y = MIN(sx, sy);
-    }
+    gd_update_scale(vc, ww_widget, wh_widget, fbw, fbh);
 
     ww_surface = fbw * vc->gfx.scale_x;
     wh_surface = fbh * vc->gfx.scale_y;

From 8fb072472c38cb1778c5b0bebf535a8b13533857 Mon Sep 17 00:00:00 2001
From: Weifeng Liu <weifeng.liu.z@gmail.com>
Date: Sun, 11 May 2025 15:33:14 +0800
Subject: [PATCH 1106/2760] ui/gtk: Update scales in fixed-scale mode when
 rendering GL area
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When gl=on, scale_x and scale_y were set to 1 on startup that didn't
reflect the real situation of the scan-out in free scale mode, resulting
in incorrect cursor coordinates to be sent when moving the mouse
pointer. Simply updating the scales before rendering the image fixes
this issue.

Signed-off-by: Weifeng Liu <weifeng.liu.z@gmail.com>
Message-ID: <20250511073337.876650-5-weifeng.liu.z@gmail.com>
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
Acked-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 ui/gtk-gl-area.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/ui/gtk-gl-area.c b/ui/gtk-gl-area.c
index ba9fbec432..db93cd6204 100644
--- a/ui/gtk-gl-area.c
+++ b/ui/gtk-gl-area.c
@@ -43,6 +43,8 @@ void gd_gl_area_draw(VirtualConsole *vc)
     QemuDmaBuf *dmabuf = vc->gfx.guest_fb.dmabuf;
 #endif
     int pw, ph, gs, y1, y2;
+    int ww, wh;
+    int fbw, fbh;
 
     if (!vc->gfx.gls) {
         return;
@@ -50,8 +52,14 @@ void gd_gl_area_draw(VirtualConsole *vc)
 
     gtk_gl_area_make_current(GTK_GL_AREA(vc->gfx.drawing_area));
     gs = gdk_window_get_scale_factor(gtk_widget_get_window(vc->gfx.drawing_area));
-    pw = gtk_widget_get_allocated_width(vc->gfx.drawing_area) * gs;
-    ph = gtk_widget_get_allocated_height(vc->gfx.drawing_area) * gs;
+    fbw = surface_width(vc->gfx.ds);
+    fbh = surface_height(vc->gfx.ds);
+    ww = gtk_widget_get_allocated_width(vc->gfx.drawing_area);
+    wh = gtk_widget_get_allocated_height(vc->gfx.drawing_area);
+    pw = ww * gs;
+    ph = wh * gs;
+
+    gd_update_scale(vc, ww, wh, fbw, fbh);
 
     if (vc->gfx.scanout_mode) {
         if (!vc->gfx.guest_fb.framebuffer) {

From 30aa105640b0a2a541744b6584d57c9a4b86debd Mon Sep 17 00:00:00 2001
From: Weifeng Liu <weifeng.liu@intel.com>
Date: Sun, 11 May 2025 15:33:15 +0800
Subject: [PATCH 1107/2760] ui/sdl: Consider scaling in mouse event handling
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When using sdl display backend, if the window is scaled, incorrect mouse
positions will be reported since scaling is not properly handled. Fix it
by transforming the positions from window coordinate to guest buffer
coordinate.

Signed-off-by: Weifeng Liu <weifeng.liu@intel.com>
Message-ID: <20250511073337.876650-6-weifeng.liu.z@gmail.com>
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
Acked-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 ui/sdl2.c | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/ui/sdl2.c b/ui/sdl2.c
index cda4293a53..b00e421f7f 100644
--- a/ui/sdl2.c
+++ b/ui/sdl2.c
@@ -488,14 +488,14 @@ static void handle_mousemotion(SDL_Event *ev)
 {
     int max_x, max_y;
     struct sdl2_console *scon = get_scon_from_window(ev->motion.windowID);
+    int scr_w, scr_h, surf_w, surf_h, x, y, dx, dy;
 
     if (!scon || !qemu_console_is_graphic(scon->dcl.con)) {
         return;
     }
 
+    SDL_GetWindowSize(scon->real_window, &scr_w, &scr_h);
     if (qemu_input_is_absolute(scon->dcl.con) || absolute_enabled) {
-        int scr_w, scr_h;
-        SDL_GetWindowSize(scon->real_window, &scr_w, &scr_h);
         max_x = scr_w - 1;
         max_y = scr_h - 1;
         if (gui_grab && !gui_fullscreen
@@ -509,9 +509,14 @@ static void handle_mousemotion(SDL_Event *ev)
             sdl_grab_start(scon);
         }
     }
+    surf_w = surface_width(scon->surface);
+    surf_h = surface_height(scon->surface);
+    x = (int64_t)ev->motion.x * surf_w / scr_w;
+    y = (int64_t)ev->motion.y * surf_h / scr_h;
+    dx = (int64_t)ev->motion.xrel * surf_w / scr_w;
+    dy = (int64_t)ev->motion.yrel * surf_h / scr_h;
     if (gui_grab || qemu_input_is_absolute(scon->dcl.con) || absolute_enabled) {
-        sdl_send_mouse_event(scon, ev->motion.xrel, ev->motion.yrel,
-                             ev->motion.x, ev->motion.y, ev->motion.state);
+        sdl_send_mouse_event(scon, dx, dy, x, y, ev->motion.state);
     }
 }
 
@@ -520,12 +525,17 @@ static void handle_mousebutton(SDL_Event *ev)
     int buttonstate = SDL_GetMouseState(NULL, NULL);
     SDL_MouseButtonEvent *bev;
     struct sdl2_console *scon = get_scon_from_window(ev->button.windowID);
+    int scr_w, scr_h, x, y;
 
     if (!scon || !qemu_console_is_graphic(scon->dcl.con)) {
         return;
     }
 
     bev = &ev->button;
+    SDL_GetWindowSize(scon->real_window, &scr_w, &scr_h);
+    x = (int64_t)bev->x * surface_width(scon->surface) / scr_w;
+    y = (int64_t)bev->y * surface_height(scon->surface) / scr_h;
+
     if (!gui_grab && !qemu_input_is_absolute(scon->dcl.con)) {
         if (ev->type == SDL_MOUSEBUTTONUP && bev->button == SDL_BUTTON_LEFT) {
             /* start grabbing all events */
@@ -537,7 +547,7 @@ static void handle_mousebutton(SDL_Event *ev)
         } else {
             buttonstate &= ~SDL_BUTTON(bev->button);
         }
-        sdl_send_mouse_event(scon, 0, 0, bev->x, bev->y, buttonstate);
+        sdl_send_mouse_event(scon, 0, 0, x, y, buttonstate);
     }
 }
 

From 02f25490879096b679ab3d7cb7f0facfef7c6484 Mon Sep 17 00:00:00 2001
From: Weifeng Liu <weifeng.liu.z@gmail.com>
Date: Sun, 11 May 2025 15:33:16 +0800
Subject: [PATCH 1108/2760] ui/gtk: Don't update scale in fixed scale mode in
 gtk-egl.c
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Scale shouldn't be changed until user explicitly requests it in fixed
scale mode (full-screen=false and free-scale=false). Use function
gd_update_scale to complete scale updating instead.

Signed-off-by: Weifeng Liu <weifeng.liu.z@gmail.com>
Message-ID: <20250511073337.876650-7-weifeng.liu.z@gmail.com>
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
Acked-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 ui/gtk-egl.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/ui/gtk-egl.c b/ui/gtk-egl.c
index 947c99334b..f8e4f4bc70 100644
--- a/ui/gtk-egl.c
+++ b/ui/gtk-egl.c
@@ -95,8 +95,9 @@ void gd_egl_draw(VirtualConsole *vc)
 #endif
         gd_egl_scanout_flush(&vc->gfx.dcl, 0, 0, vc->gfx.w, vc->gfx.h);
 
-        vc->gfx.scale_x = (double)ww / surface_width(vc->gfx.ds);
-        vc->gfx.scale_y = (double)wh / surface_height(vc->gfx.ds);
+        gd_update_scale(vc, ww, wh,
+                        surface_width(vc->gfx.ds),
+                        surface_height(vc->gfx.ds));
 
         glFlush();
 #ifdef CONFIG_GBM
@@ -122,8 +123,9 @@ void gd_egl_draw(VirtualConsole *vc)
 
         eglSwapBuffers(qemu_egl_display, vc->gfx.esurface);
 
-        vc->gfx.scale_x = (double)ww / surface_width(vc->gfx.ds);
-        vc->gfx.scale_y = (double)wh / surface_height(vc->gfx.ds);
+        gd_update_scale(vc, ww, wh,
+                        surface_width(vc->gfx.ds),
+                        surface_height(vc->gfx.ds));
 
         glFlush();
     }

From a1b28f71f7ff0fcafbe0672b788e8e57ee4fe8f6 Mon Sep 17 00:00:00 2001
From: Weifeng Liu <weifeng.liu.z@gmail.com>
Date: Sun, 11 May 2025 15:33:17 +0800
Subject: [PATCH 1109/2760] ui/gtk: Consider scaling when propagating ui info
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The ui width and height sent to guest is supposed to be in buffer
coordinate. Hence conversion is required.

If scaling (global window scale and zooming scale) is not respected in
non-free-scale mode, window size could keep changing because of the
existence of the iteration of the following steps:

1. In resize event or configure event, a size larger (or smaller) than
   the currently used one might be calculated due to not considering
   scaling.
2. On reception of the display size change event in guest, the guest
   might decide to do a mode setting and use the larger (or smaller)
   mode.
3. When the new guest scan-out command arrives, QEMU would request the
   window size to change to fit the new buffer size. This will trigger a
   resize event or a configure event, making us go back to step 1.

Signed-off-by: Weifeng Liu <weifeng.liu.z@gmail.com>
Message-ID: <20250511073337.876650-8-weifeng.liu.z@gmail.com>
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
Acked-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 ui/gtk.c | 25 +++++++++++++++++++++++--
 1 file changed, 23 insertions(+), 2 deletions(-)

diff --git a/ui/gtk.c b/ui/gtk.c
index 47af49e387..8c4a94c8f6 100644
--- a/ui/gtk.c
+++ b/ui/gtk.c
@@ -772,8 +772,21 @@ static void gd_resize_event(GtkGLArea *area,
                             gint width, gint height, gpointer *opaque)
 {
     VirtualConsole *vc = (void *)opaque;
+    double pw = width, ph = height;
+    double sx = vc->gfx.scale_x, sy = vc->gfx.scale_y;
+    GdkWindow *window = gtk_widget_get_window(GTK_WIDGET(area));
+    const int gs = gdk_window_get_scale_factor(window);
 
-    gd_set_ui_size(vc, width, height);
+    if (!vc->s->free_scale && !vc->s->full_screen) {
+        pw /= sx;
+        ph /= sy;
+    }
+
+    /**
+     * width and height here are in pixel coordinate, so we must divide it
+     * by global window scale (gs)
+     */
+    gd_set_ui_size(vc, pw / gs, ph / gs);
 }
 
 #endif
@@ -1836,8 +1849,16 @@ static gboolean gd_configure(GtkWidget *widget,
                              GdkEventConfigure *cfg, gpointer opaque)
 {
     VirtualConsole *vc = opaque;
+    const double sx = vc->gfx.scale_x, sy = vc->gfx.scale_y;
+    double width = cfg->width, height = cfg->height;
+
+    if (!vc->s->free_scale && !vc->s->full_screen) {
+        width /= sx;
+        height /= sy;
+    }
+
+    gd_set_ui_size(vc, width, height);
 
-    gd_set_ui_size(vc, cfg->width, cfg->height);
     return FALSE;
 }
 

From fdc09b028fde9d2ec70418735f354b51c8295d0f Mon Sep 17 00:00:00 2001
From: Weifeng Liu <weifeng.liu.z@gmail.com>
Date: Sun, 11 May 2025 15:33:18 +0800
Subject: [PATCH 1110/2760] ui/gtk-gl-area: Render guest content with padding
 in fixed-scale mode
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In fixed-scale mode (zoom-to-fit=false), we expect that scale should not
change, meaning that if window size is larger than guest surface,
padding is supposed to be added to preserve the scale. However, in
OpenGL mode (gl=on), guest surface is always painted to the whole canvas
without any padding. This change tries to fix this bug by adding
appropriate padding when drawing surfaces.

Signed-off-by: Weifeng Liu <weifeng.liu.z@gmail.com>
Message-ID: <20250511073337.876650-9-weifeng.liu.z@gmail.com>
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
Acked-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 ui/gtk-gl-area.c | 33 ++++++++++++++++++++++++++++++++-
 1 file changed, 32 insertions(+), 1 deletion(-)

diff --git a/ui/gtk-gl-area.c b/ui/gtk-gl-area.c
index db93cd6204..8151cc413c 100644
--- a/ui/gtk-gl-area.c
+++ b/ui/gtk-gl-area.c
@@ -44,7 +44,9 @@ void gd_gl_area_draw(VirtualConsole *vc)
 #endif
     int pw, ph, gs, y1, y2;
     int ww, wh;
+    int ww_surface, wh_surface;
     int fbw, fbh;
+    int wx_offset, wy_offset;
 
     if (!vc->gfx.gls) {
         return;
@@ -61,6 +63,17 @@ void gd_gl_area_draw(VirtualConsole *vc)
 
     gd_update_scale(vc, ww, wh, fbw, fbh);
 
+    ww_surface = fbw * vc->gfx.scale_x;
+    wh_surface = fbh * vc->gfx.scale_y;
+
+    wx_offset = wy_offset = 0;
+    if (ww > ww_surface) {
+        wx_offset = (ww - ww_surface) / 2;
+    }
+    if (wh > wh_surface) {
+        wy_offset = (wh - wh_surface) / 2;
+    }
+
     if (vc->gfx.scanout_mode) {
         if (!vc->gfx.guest_fb.framebuffer) {
             return;
@@ -79,11 +92,29 @@ void gd_gl_area_draw(VirtualConsole *vc)
         glBindFramebuffer(GL_READ_FRAMEBUFFER, vc->gfx.guest_fb.framebuffer);
         /* GtkGLArea sets GL_DRAW_FRAMEBUFFER for us */
 
+        if (wx_offset > 0) {
+            glEnable(GL_SCISSOR_TEST);
+            glScissor(0, 0, wx_offset * gs, wh * gs);
+            glClear(GL_COLOR_BUFFER_BIT);
+            glScissor((ww - wx_offset) * gs, 0, wx_offset * gs, wh * gs);
+            glClear(GL_COLOR_BUFFER_BIT);
+            glDisable(GL_SCISSOR_TEST);
+        }
+        if (wy_offset > 0) {
+            glEnable(GL_SCISSOR_TEST);
+            glScissor(0, 0, ww * gs, wy_offset * gs);
+            glClear(GL_COLOR_BUFFER_BIT);
+            glScissor(0, (wh - wy_offset) * gs, ww * gs, wy_offset * gs);
+            glClear(GL_COLOR_BUFFER_BIT);
+            glDisable(GL_SCISSOR_TEST);
+        }
+
         glViewport(0, 0, pw, ph);
         y1 = vc->gfx.y0_top ? 0 : vc->gfx.h;
         y2 = vc->gfx.y0_top ? vc->gfx.h : 0;
         glBlitFramebuffer(0, y1, vc->gfx.w, y2,
-                          0, 0, pw, ph,
+                          wx_offset * gs, wy_offset * gs,
+                          (ww - wx_offset) * gs, (wh - wy_offset) * gs,
                           GL_COLOR_BUFFER_BIT, GL_NEAREST);
 #ifdef CONFIG_GBM
         if (dmabuf) {

From f05e1a93f48729b568fdf86a12d56ee142cee5e1 Mon Sep 17 00:00:00 2001
From: Weifeng Liu <weifeng.liu.z@gmail.com>
Date: Sun, 11 May 2025 15:33:19 +0800
Subject: [PATCH 1111/2760] ui/gtk-egl: Render guest content with padding in
 fixed-scale mode
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Scaling was not respected when rendering frames in gtk-egl.c (used if
gl=on and X11 mode). To fix this, add fields x and y to struct egl_fb
for x offset and y offset so we can add padding to window.

Signed-off-by: Weifeng Liu <weifeng.liu.z@gmail.com>
Message-ID: <20250511073337.876650-10-weifeng.liu.z@gmail.com>
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
Acked-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 include/ui/egl-helpers.h |  4 +++-
 ui/egl-helpers.c         | 10 ++++++++--
 ui/gtk-egl.c             | 36 +++++++++++++++++++++++++++++++-----
 ui/sdl2-gl.c             |  2 +-
 4 files changed, 43 insertions(+), 9 deletions(-)

diff --git a/include/ui/egl-helpers.h b/include/ui/egl-helpers.h
index fb80e15142..acf993fcf5 100644
--- a/include/ui/egl-helpers.h
+++ b/include/ui/egl-helpers.h
@@ -17,6 +17,8 @@ extern bool qemu_egl_angle_d3d;
 typedef struct egl_fb {
     int width;
     int height;
+    int x;
+    int y;
     GLuint texture;
     GLuint framebuffer;
     bool delete_texture;
@@ -26,7 +28,7 @@ typedef struct egl_fb {
 #define EGL_FB_INIT { 0, }
 
 void egl_fb_destroy(egl_fb *fb);
-void egl_fb_setup_default(egl_fb *fb, int width, int height);
+void egl_fb_setup_default(egl_fb *fb, int width, int height, int x, int y);
 void egl_fb_setup_for_tex(egl_fb *fb, int width, int height,
                           GLuint texture, bool delete);
 void egl_fb_setup_new_tex(egl_fb *fb, int width, int height);
diff --git a/ui/egl-helpers.c b/ui/egl-helpers.c
index 9cda2bbbee..5503a795e4 100644
--- a/ui/egl-helpers.c
+++ b/ui/egl-helpers.c
@@ -93,14 +93,18 @@ void egl_fb_destroy(egl_fb *fb)
 
     fb->width = 0;
     fb->height = 0;
+    fb->x = 0;
+    fb->y = 0;
     fb->texture = 0;
     fb->framebuffer = 0;
 }
 
-void egl_fb_setup_default(egl_fb *fb, int width, int height)
+void egl_fb_setup_default(egl_fb *fb, int width, int height, int x, int y)
 {
     fb->width = width;
     fb->height = height;
+    fb->x = x;
+    fb->y = y;
     fb->framebuffer = 0; /* default framebuffer */
 }
 
@@ -145,6 +149,7 @@ void egl_fb_blit(egl_fb *dst, egl_fb *src, bool flip)
     glBindFramebuffer(GL_READ_FRAMEBUFFER, src->framebuffer);
     glBindFramebuffer(GL_DRAW_FRAMEBUFFER, dst->framebuffer);
     glViewport(0, 0, dst->width, dst->height);
+    glClear(GL_COLOR_BUFFER_BIT);
 
     if (src->dmabuf) {
         x1 = qemu_dmabuf_get_x(src->dmabuf);
@@ -161,7 +166,8 @@ void egl_fb_blit(egl_fb *dst, egl_fb *src, bool flip)
     x2 = x1 + w;
 
     glBlitFramebuffer(x1, y1, x2, y2,
-                      0, 0, dst->width, dst->height,
+                      dst->x, dst->y,
+                      dst->x + dst->width, dst->y + dst->height,
                       GL_COLOR_BUFFER_BIT, GL_LINEAR);
 }
 
diff --git a/ui/gtk-egl.c b/ui/gtk-egl.c
index f8e4f4bc70..0b787bea25 100644
--- a/ui/gtk-egl.c
+++ b/ui/gtk-egl.c
@@ -340,7 +340,11 @@ void gd_egl_scanout_flush(DisplayChangeListener *dcl,
 {
     VirtualConsole *vc = container_of(dcl, VirtualConsole, gfx.dcl);
     GdkWindow *window;
-    int ww, wh, ws;
+    int px_offset, py_offset;
+    int gs;
+    int pw_widget, ph_widget, pw_surface, ph_surface;
+    int ww_widget, wh_widget, ww_surface, wh_surface;
+    int fbw, fbh;
 
     if (!vc->gfx.scanout_mode) {
         return;
@@ -353,10 +357,32 @@ void gd_egl_scanout_flush(DisplayChangeListener *dcl,
                    vc->gfx.esurface, vc->gfx.ectx);
 
     window = gtk_widget_get_window(vc->gfx.drawing_area);
-    ws = gdk_window_get_scale_factor(window);
-    ww = gdk_window_get_width(window) * ws;
-    wh = gdk_window_get_height(window) * ws;
-    egl_fb_setup_default(&vc->gfx.win_fb, ww, wh);
+    gs = gdk_window_get_scale_factor(window);
+    ww_widget = gdk_window_get_width(window);
+    wh_widget = gdk_window_get_height(window);
+    fbw = surface_width(vc->gfx.ds);
+    fbh = surface_height(vc->gfx.ds);
+
+    gd_update_scale(vc, ww_widget, wh_widget, fbw, fbh);
+
+    ww_surface = fbw * vc->gfx.scale_x;
+    wh_surface = fbh * vc->gfx.scale_y;
+    pw_widget = ww_widget * gs;
+    ph_widget = wh_widget * gs;
+    pw_surface = ww_surface * gs;
+    ph_surface = wh_surface * gs;
+
+    px_offset = 0;
+    py_offset = 0;
+    if (pw_widget > pw_surface) {
+        px_offset = (pw_widget - pw_surface) / 2;
+    }
+    if (ph_widget > ph_surface) {
+        py_offset = (ph_widget - ph_surface) / 2;
+    }
+
+    egl_fb_setup_default(&vc->gfx.win_fb, pw_surface, ph_surface,
+                         px_offset, py_offset);
     if (vc->gfx.cursor_fb.texture) {
         egl_texture_blit(vc->gfx.gls, &vc->gfx.win_fb, &vc->gfx.guest_fb,
                          vc->gfx.y0_top);
diff --git a/ui/sdl2-gl.c b/ui/sdl2-gl.c
index e01d9ab0c7..3be17d1079 100644
--- a/ui/sdl2-gl.c
+++ b/ui/sdl2-gl.c
@@ -241,7 +241,7 @@ void sdl2_gl_scanout_flush(DisplayChangeListener *dcl,
     SDL_GL_MakeCurrent(scon->real_window, scon->winctx);
 
     SDL_GetWindowSize(scon->real_window, &ww, &wh);
-    egl_fb_setup_default(&scon->win_fb, ww, wh);
+    egl_fb_setup_default(&scon->win_fb, ww, wh, 0, 0);
     egl_fb_blit(&scon->win_fb, &scon->guest_fb, !scon->y0_top);
 
     SDL_GL_SwapWindow(scon->real_window);

From 9e9542a1771f5b44d198fbfa31b4b3fb947e46ce Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Volker=20R=C3=BCmelin?= <vr_qemu@t-online.de>
Date: Thu, 15 May 2025 07:44:23 +0200
Subject: [PATCH 1112/2760] tests/functional: use 'none' audio driver for q800
 tests
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since commit ac13a6b3fd ("audio: add Apple Sound Chip (ASC)
emulation") the Quadra 800 machine has an audio device. It is
not guaranteed that the default audio driver of the audio
subsystem will work correctly on all host systems. Therefore,
the 'none' audio driver should be used in all q800 tests.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2812
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Volker Rümelin <vr_qemu@t-online.de>
Message-Id: <20250515054429.7385-1-vr_qemu@t-online.de>
---
 tests/functional/test_m68k_q800.py   | 3 ++-
 tests/functional/test_m68k_replay.py | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/tests/functional/test_m68k_q800.py b/tests/functional/test_m68k_q800.py
index 400b7aeb5d..b3e655346c 100755
--- a/tests/functional/test_m68k_q800.py
+++ b/tests/functional/test_m68k_q800.py
@@ -25,7 +25,8 @@ class Q800MachineTest(LinuxKernelTest):
         kernel_command_line = (self.KERNEL_COMMON_COMMAND_LINE +
                                'console=ttyS0 vga=off')
         self.vm.add_args('-kernel', kernel_path,
-                         '-append', kernel_command_line)
+                         '-append', kernel_command_line,
+                         '-audio', 'none')
         self.vm.launch()
         console_pattern = 'Kernel command line: %s' % kernel_command_line
         self.wait_for_console_pattern(console_pattern)
diff --git a/tests/functional/test_m68k_replay.py b/tests/functional/test_m68k_replay.py
index 18c1db539c..213d6ae07e 100755
--- a/tests/functional/test_m68k_replay.py
+++ b/tests/functional/test_m68k_replay.py
@@ -24,7 +24,8 @@ class M68kReplay(ReplayKernelBase):
         kernel_command_line = (self.KERNEL_COMMON_COMMAND_LINE +
                                'console=ttyS0 vga=off')
         console_pattern = 'No filesystem could mount root'
-        self.run_rr(kernel_path, kernel_command_line, console_pattern)
+        self.run_rr(kernel_path, kernel_command_line, console_pattern,
+                    args=('-audio', 'none'))
 
     ASSET_MCF5208 = Asset(
        'https://qemu-advcal.gitlab.io/qac-best-of-multiarch/download/day07.tar.xz',

From 5ddd6c8dc849b4af44bd06840c9133d64e62c27c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Volker=20R=C3=BCmelin?= <vr_qemu@t-online.de>
Date: Thu, 15 May 2025 07:44:24 +0200
Subject: [PATCH 1113/2760] audio: fix SIGSEGV in AUD_get_buffer_size_out()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

As far as the emulated audio devices are concerned the pointer
returned by AUD_open_out() is an opaque handle. This includes
the NULL pointer. In this case, AUD_get_buffer_size_out() should
return a sensible buffer size instead of triggering a segmentation
fault. All other public AUD_*_out() and audio_*_out() functions
handle this case.

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Volker Rümelin <vr_qemu@t-online.de>
Message-Id: <20250515054429.7385-2-vr_qemu@t-online.de>
---
 audio/audio.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/audio/audio.c b/audio/audio.c
index 41ee11aaad..70ef22b1a4 100644
--- a/audio/audio.c
+++ b/audio/audio.c
@@ -905,6 +905,10 @@ size_t AUD_read(SWVoiceIn *sw, void *buf, size_t size)
 
 int AUD_get_buffer_size_out(SWVoiceOut *sw)
 {
+    if (!sw) {
+        return 0;
+    }
+
     return sw->hw->samples * sw->hw->info.bytes_per_frame;
 }
 

From ccb4fec0e5f233cb61a83b3af59ae11716ea06c0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Volker=20R=C3=BCmelin?= <vr_qemu@t-online.de>
Date: Thu, 15 May 2025 07:44:25 +0200
Subject: [PATCH 1114/2760] audio: fix size calculation in
 AUD_get_buffer_size_out()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The buffer size calculated by AUD_get_buffer_size_out() is often
incorrect. sw->hw->samples * sw->hw->info.bytes_per_frame is the
size of the mixing engine buffer in audio frames multiplied by
the size of one frame of the audio backend. Due to resampling or
format conversion, the size of the frontend buffer can differ
significantly.

Return the correct buffer size when the mixing engine is used.

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Volker Rümelin <vr_qemu@t-online.de>
Message-Id: <20250515054429.7385-3-vr_qemu@t-online.de>
---
 audio/audio.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/audio/audio.c b/audio/audio.c
index 70ef22b1a4..3f5baf0cc6 100644
--- a/audio/audio.c
+++ b/audio/audio.c
@@ -909,6 +909,10 @@ int AUD_get_buffer_size_out(SWVoiceOut *sw)
         return 0;
     }
 
+    if (audio_get_pdo_out(sw->s->dev)->mixing_engine) {
+        return sw->resample_buf.size * sw->info.bytes_per_frame;
+    }
+
     return sw->hw->samples * sw->hw->info.bytes_per_frame;
 }
 

From d009f26a54f573468be721590a19350c224bc730 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Volker=20R=C3=BCmelin?= <vr_qemu@t-online.de>
Date: Thu, 15 May 2025 07:44:26 +0200
Subject: [PATCH 1115/2760] hw/audio/asc: fix SIGSEGV in asc_realize()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

AUD_open_out() may fail and return NULL. This may then lead to
a segmentation fault in memset() below. The memset() behaviour
is undefined if the pointer to the destination object is a null
pointer.

Add the missing error handling code.

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Volker Rümelin <vr_qemu@t-online.de>
Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Message-Id: <20250515054429.7385-4-vr_qemu@t-online.de>
---
 hw/audio/asc.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/hw/audio/asc.c b/hw/audio/asc.c
index 18382ccf6a..6721c0d9fb 100644
--- a/hw/audio/asc.c
+++ b/hw/audio/asc.c
@@ -12,6 +12,7 @@
 
 #include "qemu/osdep.h"
 #include "qemu/timer.h"
+#include "qapi/error.h"
 #include "hw/sysbus.h"
 #include "hw/irq.h"
 #include "audio/audio.h"
@@ -653,6 +654,12 @@ static void asc_realize(DeviceState *dev, Error **errp)
 
     s->voice = AUD_open_out(&s->card, s->voice, "asc.out", s, asc_out_cb,
                             &as);
+    if (!s->voice) {
+        AUD_remove_card(&s->card);
+        error_setg(errp, "Initializing audio stream failed");
+        return;
+    }
+
     s->shift = 1;
     s->samples = AUD_get_buffer_size_out(s->voice) >> s->shift;
     s->mixbuf = g_malloc0(s->samples << s->shift);

From f4b1c3db11317c4bce18fa3bbb025df7c22ea54c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Volker=20R=C3=BCmelin?= <vr_qemu@t-online.de>
Date: Thu, 15 May 2025 07:44:27 +0200
Subject: [PATCH 1116/2760] hw/audio/asc: replace g_malloc0() with g_malloc()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

There is no need to allocate initialized memory with g_malloc0()
if it's directly followed by a memset() function call. g_malloc()
is sufficient.

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Signed-off-by: Volker Rümelin <vr_qemu@t-online.de>
Message-Id: <20250515054429.7385-5-vr_qemu@t-online.de>
---
 hw/audio/asc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/audio/asc.c b/hw/audio/asc.c
index 6721c0d9fb..edd42d6d91 100644
--- a/hw/audio/asc.c
+++ b/hw/audio/asc.c
@@ -664,7 +664,7 @@ static void asc_realize(DeviceState *dev, Error **errp)
     s->samples = AUD_get_buffer_size_out(s->voice) >> s->shift;
     s->mixbuf = g_malloc0(s->samples << s->shift);
 
-    s->silentbuf = g_malloc0(s->samples << s->shift);
+    s->silentbuf = g_malloc(s->samples << s->shift);
     memset(s->silentbuf, 0x80, s->samples << s->shift);
 
     /* Add easc registers if required */

From 9ddb7c85c965636f7abf91382dc40175ce121aa3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Volker=20R=C3=BCmelin?= <vr_qemu@t-online.de>
Date: Thu, 15 May 2025 07:44:28 +0200
Subject: [PATCH 1117/2760] audio/mixeng: remove unnecessary pointer type casts
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A simple assignment automatically converts a void pointer type
to any other pointer type.

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Volker Rümelin <vr_qemu@t-online.de>
Message-Id: <20250515054429.7385-6-vr_qemu@t-online.de>
---
 audio/mixeng.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/audio/mixeng.c b/audio/mixeng.c
index 69f6549224..13e1ff9b08 100644
--- a/audio/mixeng.c
+++ b/audio/mixeng.c
@@ -286,7 +286,7 @@ static const float float_scale_reciprocal = 1.f / ((int64_t)INT32_MAX + 1);
 static void conv_natural_float_to_mono(struct st_sample *dst, const void *src,
                                        int samples)
 {
-    float *in = (float *)src;
+    const float *in = src;
 
     while (samples--) {
         dst->r = dst->l = CONV_NATURAL_FLOAT(*in++);
@@ -297,7 +297,7 @@ static void conv_natural_float_to_mono(struct st_sample *dst, const void *src,
 static void conv_natural_float_to_stereo(struct st_sample *dst, const void *src,
                                          int samples)
 {
-    float *in = (float *)src;
+    const float *in = src;
 
     while (samples--) {
         dst->l = CONV_NATURAL_FLOAT(*in++);
@@ -314,7 +314,7 @@ t_sample *mixeng_conv_float[2] = {
 static void clip_natural_float_from_mono(void *dst, const struct st_sample *src,
                                          int samples)
 {
-    float *out = (float *)dst;
+    float *out = dst;
 
     while (samples--) {
         *out++ = CLIP_NATURAL_FLOAT(src->l + src->r);
@@ -325,7 +325,7 @@ static void clip_natural_float_from_mono(void *dst, const struct st_sample *src,
 static void clip_natural_float_from_stereo(
     void *dst, const struct st_sample *src, int samples)
 {
-    float *out = (float *)dst;
+    float *out = dst;
 
     while (samples--) {
         *out++ = CLIP_NATURAL_FLOAT(src->l);

From 5d978c5da7f7d85d3a74b7d4dbe9ba5c5584d560 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Volker=20R=C3=BCmelin?= <vr_qemu@t-online.de>
Date: Thu, 15 May 2025 07:44:29 +0200
Subject: [PATCH 1118/2760] audio: add float sample endianness converters
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Commit ed2a4a7941 ("audio: proper support for float samples in
mixeng") added support for float audio samples. As there were no
audio frontend devices with float support at that time, the code
was limited to native endian float samples.

When nobody was paying attention, an audio device that supports
floating point samples crept in with commit eb9ad377bb
("virtio-sound: handle control messages and streams").

Add code for the audio subsystem to convert float samples to the
correct endianness.

The type punning code was taken from the PipeWire project.

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Volker Rümelin <vr_qemu@t-online.de>
Message-Id: <20250515054429.7385-7-vr_qemu@t-online.de>
---
 audio/audio.c          |  3 +-
 audio/audio_template.h | 12 ++++---
 audio/mixeng.c         | 75 ++++++++++++++++++++++++++++++++++++++----
 audio/mixeng.h         |  6 ++--
 4 files changed, 82 insertions(+), 14 deletions(-)

diff --git a/audio/audio.c b/audio/audio.c
index 3f5baf0cc6..b58ad74433 100644
--- a/audio/audio.c
+++ b/audio/audio.c
@@ -1892,7 +1892,8 @@ CaptureVoiceOut *AUD_add_capture(
         cap->buf = g_malloc0_n(hw->mix_buf.size, hw->info.bytes_per_frame);
 
         if (hw->info.is_float) {
-            hw->clip = mixeng_clip_float[hw->info.nchannels == 2];
+            hw->clip = mixeng_clip_float[hw->info.nchannels == 2]
+                [hw->info.swap_endianness];
         } else {
             hw->clip = mixeng_clip
                 [hw->info.nchannels == 2]
diff --git a/audio/audio_template.h b/audio/audio_template.h
index 7ccfec0116..c29d79c443 100644
--- a/audio/audio_template.h
+++ b/audio/audio_template.h
@@ -174,9 +174,11 @@ static int glue (audio_pcm_sw_init_, TYPE) (
 
     if (sw->info.is_float) {
 #ifdef DAC
-        sw->conv = mixeng_conv_float[sw->info.nchannels == 2];
+        sw->conv = mixeng_conv_float[sw->info.nchannels == 2]
+            [sw->info.swap_endianness];
 #else
-        sw->clip = mixeng_clip_float[sw->info.nchannels == 2];
+        sw->clip = mixeng_clip_float[sw->info.nchannels == 2]
+            [sw->info.swap_endianness];
 #endif
     } else {
 #ifdef DAC
@@ -303,9 +305,11 @@ static HW *glue(audio_pcm_hw_add_new_, TYPE)(AudioState *s,
 
     if (hw->info.is_float) {
 #ifdef DAC
-        hw->clip = mixeng_clip_float[hw->info.nchannels == 2];
+        hw->clip = mixeng_clip_float[hw->info.nchannels == 2]
+            [hw->info.swap_endianness];
 #else
-        hw->conv = mixeng_conv_float[hw->info.nchannels == 2];
+        hw->conv = mixeng_conv_float[hw->info.nchannels == 2]
+            [hw->info.swap_endianness];
 #endif
     } else {
 #ifdef DAC
diff --git a/audio/mixeng.c b/audio/mixeng.c
index 13e1ff9b08..703ee5448f 100644
--- a/audio/mixeng.c
+++ b/audio/mixeng.c
@@ -283,6 +283,11 @@ static const float float_scale_reciprocal = 1.f / ((int64_t)INT32_MAX + 1);
 #endif
 #endif
 
+#define F32_TO_F32S(v) \
+    bswap32((union { uint32_t i; float f; }){ .f = (v) }.i)
+#define F32S_TO_F32(v) \
+    ((union { uint32_t i; float f; }){ .i = bswap32(v) }.f)
+
 static void conv_natural_float_to_mono(struct st_sample *dst, const void *src,
                                        int samples)
 {
@@ -294,6 +299,17 @@ static void conv_natural_float_to_mono(struct st_sample *dst, const void *src,
     }
 }
 
+static void conv_swap_float_to_mono(struct st_sample *dst, const void *src,
+                                    int samples)
+{
+    const uint32_t *in_f32s = src;
+
+    while (samples--) {
+        dst->r = dst->l = CONV_NATURAL_FLOAT(F32S_TO_F32(*in_f32s++));
+        dst++;
+    }
+}
+
 static void conv_natural_float_to_stereo(struct st_sample *dst, const void *src,
                                          int samples)
 {
@@ -306,9 +322,27 @@ static void conv_natural_float_to_stereo(struct st_sample *dst, const void *src,
     }
 }
 
-t_sample *mixeng_conv_float[2] = {
-    conv_natural_float_to_mono,
-    conv_natural_float_to_stereo,
+static void conv_swap_float_to_stereo(struct st_sample *dst, const void *src,
+                                      int samples)
+{
+    const uint32_t *in_f32s = src;
+
+    while (samples--) {
+        dst->l = CONV_NATURAL_FLOAT(F32S_TO_F32(*in_f32s++));
+        dst->r = CONV_NATURAL_FLOAT(F32S_TO_F32(*in_f32s++));
+        dst++;
+    }
+}
+
+t_sample *mixeng_conv_float[2][2] = {
+    {
+        conv_natural_float_to_mono,
+        conv_swap_float_to_mono,
+    },
+    {
+        conv_natural_float_to_stereo,
+        conv_swap_float_to_stereo,
+    }
 };
 
 static void clip_natural_float_from_mono(void *dst, const struct st_sample *src,
@@ -322,6 +356,17 @@ static void clip_natural_float_from_mono(void *dst, const struct st_sample *src,
     }
 }
 
+static void clip_swap_float_from_mono(void *dst, const struct st_sample *src,
+                                      int samples)
+{
+    uint32_t *out_f32s = dst;
+
+    while (samples--) {
+        *out_f32s++ = F32_TO_F32S(CLIP_NATURAL_FLOAT(src->l + src->r));
+        src++;
+    }
+}
+
 static void clip_natural_float_from_stereo(
     void *dst, const struct st_sample *src, int samples)
 {
@@ -334,9 +379,27 @@ static void clip_natural_float_from_stereo(
     }
 }
 
-f_sample *mixeng_clip_float[2] = {
-    clip_natural_float_from_mono,
-    clip_natural_float_from_stereo,
+static void clip_swap_float_from_stereo(
+    void *dst, const struct st_sample *src, int samples)
+{
+    uint32_t *out_f32s = dst;
+
+    while (samples--) {
+        *out_f32s++ = F32_TO_F32S(CLIP_NATURAL_FLOAT(src->l));
+        *out_f32s++ = F32_TO_F32S(CLIP_NATURAL_FLOAT(src->r));
+        src++;
+    }
+}
+
+f_sample *mixeng_clip_float[2][2] = {
+    {
+        clip_natural_float_from_mono,
+        clip_swap_float_from_mono,
+    },
+    {
+        clip_natural_float_from_stereo,
+        clip_swap_float_from_stereo,
+    }
 };
 
 void audio_sample_to_uint64(const void *samples, int pos,
diff --git a/audio/mixeng.h b/audio/mixeng.h
index a5f56d2c26..ead93ac2f7 100644
--- a/audio/mixeng.h
+++ b/audio/mixeng.h
@@ -42,9 +42,9 @@ typedef void (f_sample) (void *dst, const struct st_sample *src, int samples);
 extern t_sample *mixeng_conv[2][2][2][3];
 extern f_sample *mixeng_clip[2][2][2][3];
 
-/* indices: [stereo] */
-extern t_sample *mixeng_conv_float[2];
-extern f_sample *mixeng_clip_float[2];
+/* indices: [stereo][swap endianness] */
+extern t_sample *mixeng_conv_float[2][2];
+extern f_sample *mixeng_clip_float[2][2];
 
 void *st_rate_start (int inrate, int outrate);
 void st_rate_flow(void *opaque, st_sample *ibuf, st_sample *obuf,

From f6ccfd5d166acf495f5d6d320da503fae8dc14a4 Mon Sep 17 00:00:00 2001
From: BALATON Zoltan <balaton@eik.bme.hu>
Date: Sun, 16 Mar 2025 01:20:46 +0100
Subject: [PATCH 1119/2760] alsaaudio: Set try-poll to false by default
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Quoting Volker Rümelin: "try-poll=on tells the ALSA backend to try to
use an event loop instead of the audio timer. This works most of the
time. But the poll event handler in the ALSA backend has a bug. For
example, if the guest can't provide enough audio frames in time, the
ALSA buffer is only partly full and the event handler will be called
again and again on every iteration of the main loop. This increases
the processor load and the guest has less processor time to provide
new audio frames in time. I have two examples where a guest can't
recover from this situation and the guest seems to hang."

One reproducer I've found is booting MorphOS demo iso on
qemu-system-ppc -machine pegasos2 -audio alsa which should play a
startup sound but instead it freezes. Even when it does not hang it
plays choppy sound. Volker suggested using command line to set
try-poll=off saying: "The try-poll=off arguments are typically
necessary, because the alsa backend has a design issue with
try-poll=on. If the guest can't provide enough audio frames, it's
really unhelpful to ask for new audio frames on every main loop
iteration until the guest can provide enough audio frames. Timer based
playback doesn't have that problem."

But users cannot easily find this option and having a non-working
default is really unhelpful so to make life easier just set it to
false by default which works until the issue with the alsa backend can
be fixed.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Acked-by: Marc-André Lureau <marcandre.lureau@redhat.com>
[ Marc-André - Updated QAPI and CLI doc ]
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20250316002046.D066A4E6004@zero.eik.bme.hu>
---
 audio/alsaaudio.c | 2 +-
 qapi/audio.json   | 2 +-
 qemu-options.hx   | 4 ++--
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/audio/alsaaudio.c b/audio/alsaaudio.c
index cacae1ea59..9b6c01c0ef 100644
--- a/audio/alsaaudio.c
+++ b/audio/alsaaudio.c
@@ -899,7 +899,7 @@ static void alsa_enable_in(HWVoiceIn *hw, bool enable)
 static void alsa_init_per_direction(AudiodevAlsaPerDirectionOptions *apdo)
 {
     if (!apdo->has_try_poll) {
-        apdo->try_poll = true;
+        apdo->try_poll = false;
         apdo->has_try_poll = true;
     }
 }
diff --git a/qapi/audio.json b/qapi/audio.json
index dd5a58d13e..49633cf317 100644
--- a/qapi/audio.json
+++ b/qapi/audio.json
@@ -96,7 +96,7 @@
 # @period-length: the period length in microseconds
 #
 # @try-poll: attempt to use poll mode, falling back to non-polling
-#     access on failure (default true)
+#     access on failure (default false)
 #
 # Since: 4.0
 ##
diff --git a/qemu-options.hx b/qemu-options.hx
index aab53bcfe8..7eb8e02b4b 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -965,7 +965,7 @@ SRST
         Sets the period length in microseconds.
 
     ``in|out.try-poll=on|off``
-        Attempt to use poll mode with the device. Default is on.
+        Attempt to use poll mode with the device. Default is off.
 
     ``threshold=threshold``
         Threshold (in microseconds) when playback starts. Default is 0.
@@ -1002,7 +1002,7 @@ SRST
     ``in|out.buffer-count=count``
         Sets the count of the buffers.
 
-    ``in|out.try-poll=on|of``
+    ``in|out.try-poll=on|off``
         Attempt to use poll mode with the device. Default is on.
 
     ``try-mmap=on|off``

From 2bccabe6df5e91145c1313bb79b98200aa13b5ff Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <akihiko.odaki@daynix.com>
Date: Mon, 17 Mar 2025 17:05:29 +0900
Subject: [PATCH 1120/2760] audio: Reset rate control when adding bytes

Commit 90320051ea99 ("spiceaudio: add a pcm_ops buffer_get_free
function") caused to emit messages saying "Resetting rate control"
frequently when the guest generates no frames.

audio_rate_peek_bytes() resets the rate control when frames < 0 ||
frames > 65536 where frames is the rate-limited number of frames.
Resetting when frames < 0 is sensible as the number simply doesn't make
sense.

There is a problem when frames > 65536. It implies the guest stopped
generating frames for a while so it makes sense to reset the rate
control when the guest resumed generating frames. However, the
commit mentioned earlier broke this assumption by letting spiceaudio
call audio_rate_peek_bytes() whether the guest is generating frames or
not.

Reset the rate control in audio_rate_add_bytes(), which is called only
when actually adding frames, according to the previous call to
audio_rate_peek_bytes() to avoid frequent rate control resets even when
the guest generates no frame.

Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Message-Id: <20250317-rate-v1-1-da9df062747c@daynix.com>
---
 audio/audio.c     | 14 ++++++++------
 audio/audio_int.h |  1 +
 2 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/audio/audio.c b/audio/audio.c
index b58ad74433..89f091bc88 100644
--- a/audio/audio.c
+++ b/audio/audio.c
@@ -2283,17 +2283,19 @@ size_t audio_rate_peek_bytes(RateCtl *rate, struct audio_pcm_info *info)
     ticks = now - rate->start_ticks;
     bytes = muldiv64(ticks, info->bytes_per_second, NANOSECONDS_PER_SECOND);
     frames = (bytes - rate->bytes_sent) / info->bytes_per_frame;
-    if (frames < 0 || frames > 65536) {
-        AUD_log(NULL, "Resetting rate control (%" PRId64 " frames)\n", frames);
-        audio_rate_start(rate);
-        frames = 0;
-    }
+    rate->peeked_frames = frames;
 
-    return frames * info->bytes_per_frame;
+    return frames < 0 ? 0 : frames * info->bytes_per_frame;
 }
 
 void audio_rate_add_bytes(RateCtl *rate, size_t bytes_used)
 {
+    if (rate->peeked_frames < 0 || rate->peeked_frames > 65536) {
+        AUD_log(NULL, "Resetting rate control (%" PRId64 " frames)\n",
+                rate->peeked_frames);
+        audio_rate_start(rate);
+    }
+
     rate->bytes_sent += bytes_used;
 }
 
diff --git a/audio/audio_int.h b/audio/audio_int.h
index 2d079d00a2..f78ca05f92 100644
--- a/audio/audio_int.h
+++ b/audio/audio_int.h
@@ -255,6 +255,7 @@ const char *audio_application_name(void);
 typedef struct RateCtl {
     int64_t start_ticks;
     int64_t bytes_sent;
+    int64_t peeked_frames;
 } RateCtl;
 
 void audio_rate_start(RateCtl *rate);

From d75cdf6883fac728540798e42a8104d016ec762c Mon Sep 17 00:00:00 2001
From: Fabiano Rosas <farosas@suse.de>
Date: Fri, 9 May 2025 14:50:47 -0300
Subject: [PATCH 1121/2760] tests/qtest/ast2700-smc-test: Fix leak
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

ASAN spotted a leak of the memory used to hold the tmp_path:

Direct leak of 35 byte(s) in 1 object(s) allocated from:
    #0 0x55e29aa96da9 in malloc ../projects/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3
    #1 0x7fe0cfb26518 in g_malloc ../glib/gmem.c:106
    #2 0x7fe0cfb4146e in g_strconcat ../glib/gstrfuncs.c:629
    #3 0x7fe0cfb0a78f in g_get_tmp_name ../glib/gfileutils.c:1742
    #4 0x7fe0cfb0b00b in g_file_open_tmp ../glib/gfileutils.c:1802
    #5 0x55e29ab53961 in test_ast2700_evb ../tests/qtest/ast2700-smc-test.c:20:10
    #6 0x55e29ab53803 in main ../tests/qtest/ast2700-smc-test.c:65:5
    #7 0x7fe0cf7bd24c in __libc_start_main ../csu/libc-start.c:308
    #8 0x55e29a9f7759 in _start ../sysdeps/x86_64/start.S:120

Signed-off-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Jamin Lin <jamin_lin@aspeedtech.com>
Message-ID: <20250509175047.26066-1-farosas@suse.de>
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 tests/qtest/ast2700-smc-test.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tests/qtest/ast2700-smc-test.c b/tests/qtest/ast2700-smc-test.c
index d1c4856307..62d538d8a3 100644
--- a/tests/qtest/ast2700-smc-test.c
+++ b/tests/qtest/ast2700-smc-test.c
@@ -67,5 +67,6 @@ int main(int argc, char **argv)
 
     qtest_quit(ast2700_evb_data.s);
     unlink(ast2700_evb_data.tmp_path);
+    g_free(ast2700_evb_data.tmp_path);
     return ret;
 }

From d09c0939c97061fca0faa842184171f2f94b3339 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Tue, 13 May 2025 16:08:06 +0800
Subject: [PATCH 1122/2760] tests/qtest/aspeed_smc-test: Fix memory leaks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Link: https://patchwork.kernel.org/project/qemu-devel/patch/20250509175047.26066-1-farosas@suse.de/

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Laurent Vivier <lvivier@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250513080806.1005996-1-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 tests/qtest/aspeed_smc-test.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/tests/qtest/aspeed_smc-test.c b/tests/qtest/aspeed_smc-test.c
index 4e1389385d..52a00e6f0a 100644
--- a/tests/qtest/aspeed_smc-test.c
+++ b/tests/qtest/aspeed_smc-test.c
@@ -228,5 +228,10 @@ int main(int argc, char **argv)
     unlink(ast2500_evb_data.tmp_path);
     unlink(ast2600_evb_data.tmp_path);
     unlink(ast1030_evb_data.tmp_path);
+    g_free(palmetto_data.tmp_path);
+    g_free(ast2500_evb_data.tmp_path);
+    g_free(ast2600_evb_data.tmp_path);
+    g_free(ast1030_evb_data.tmp_path);
+
     return ret;
 }

From f05cc69c6ce0242e2eeae3cd1513454006b8f040 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Thu, 15 May 2025 16:09:33 +0800
Subject: [PATCH 1123/2760] hw/misc/aspeed_hace: Remove unused code for better
 readability
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In the previous design of the hash framework, accumulative hashing was not
supported. To work around this limitation, commit 5cd7d85 introduced an
iov_cache array to store all the hash data from firmware.
Once the ASPEED HACE model collected all the data, it passed the iov_cache to
the hash API to calculate the final digest.

However, with commit e3c0752, the hash framework now supports accumulative
hashing. This allows us to refactor the ASPEED HACE model, removing redundant
logic and simplifying the implementation for better readability and
maintainability.

As a result, the iov_count variable is no longer needed—it was previously used
to track how many cached entries were used for hashing.
To maintain VMSTATE compatibility after removing this field, the VMSTATE_VERSION
is bumped to 2

This cleanup follows significant changes in commit 4c1d0af4a28d, making the
model more readable.

- Deleted "iov_cache" and "iov_count" from "AspeedHACEState".
- Removed "reconstruct_iov" function and related logic.
- Simplified "do_hash_operation" by eliminating redundant checks.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250515081008.583578-2-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/misc/aspeed_hace.c         | 39 ++---------------------------------
 include/hw/misc/aspeed_hace.h |  2 --
 2 files changed, 2 insertions(+), 39 deletions(-)

diff --git a/hw/misc/aspeed_hace.c b/hw/misc/aspeed_hace.c
index f4bff32a00..9263739ea6 100644
--- a/hw/misc/aspeed_hace.c
+++ b/hw/misc/aspeed_hace.c
@@ -142,25 +142,6 @@ static bool has_padding(AspeedHACEState *s, struct iovec *iov,
     return false;
 }
 
-static int reconstruct_iov(AspeedHACEState *s, struct iovec *iov, int id,
-                           uint32_t *pad_offset)
-{
-    int i, iov_count;
-    if (*pad_offset != 0) {
-        s->iov_cache[s->iov_count].iov_base = iov[id].iov_base;
-        s->iov_cache[s->iov_count].iov_len = *pad_offset;
-        ++s->iov_count;
-    }
-    for (i = 0; i < s->iov_count; i++) {
-        iov[i].iov_base = s->iov_cache[i].iov_base;
-        iov[i].iov_len = s->iov_cache[i].iov_len;
-    }
-    iov_count = s->iov_count;
-    s->iov_count = 0;
-    s->total_req_len = 0;
-    return iov_count;
-}
-
 static void do_hash_operation(AspeedHACEState *s, int algo, bool sg_mode,
                               bool acc_mode)
 {
@@ -242,19 +223,6 @@ static void do_hash_operation(AspeedHACEState *s, int algo, bool sg_mode,
         iov[0].iov_base = haddr;
         iov[0].iov_len = len;
         i = 1;
-
-        if (s->iov_count) {
-            /*
-             * In aspeed sdk kernel driver, sg_mode is disabled in hash_final().
-             * Thus if we received a request with sg_mode disabled, it is
-             * required to check whether cache is empty. If no, we should
-             * combine cached iov and the current iov.
-             */
-            s->total_req_len += len;
-            if (has_padding(s, iov, len, &total_msg_len, &pad_offset)) {
-                i = reconstruct_iov(s, iov, 0, &pad_offset);
-            }
-        }
     }
 
     if (acc_mode) {
@@ -278,7 +246,6 @@ static void do_hash_operation(AspeedHACEState *s, int algo, bool sg_mode,
             qcrypto_hash_free(s->hash_ctx);
 
             s->hash_ctx = NULL;
-            s->iov_count = 0;
             s->total_req_len = 0;
         }
     } else if (qcrypto_hash_bytesv(algo, iov, i, &digest_buf,
@@ -437,7 +404,6 @@ static void aspeed_hace_reset(DeviceState *dev)
     }
 
     memset(s->regs, 0, sizeof(s->regs));
-    s->iov_count = 0;
     s->total_req_len = 0;
 }
 
@@ -469,12 +435,11 @@ static const Property aspeed_hace_properties[] = {
 
 static const VMStateDescription vmstate_aspeed_hace = {
     .name = TYPE_ASPEED_HACE,
-    .version_id = 1,
-    .minimum_version_id = 1,
+    .version_id = 2,
+    .minimum_version_id = 2,
     .fields = (const VMStateField[]) {
         VMSTATE_UINT32_ARRAY(regs, AspeedHACEState, ASPEED_HACE_NR_REGS),
         VMSTATE_UINT32(total_req_len, AspeedHACEState),
-        VMSTATE_UINT32(iov_count, AspeedHACEState),
         VMSTATE_END_OF_LIST(),
     }
 };
diff --git a/include/hw/misc/aspeed_hace.h b/include/hw/misc/aspeed_hace.h
index 5d4aa19cfe..b69a038d35 100644
--- a/include/hw/misc/aspeed_hace.h
+++ b/include/hw/misc/aspeed_hace.h
@@ -31,10 +31,8 @@ struct AspeedHACEState {
     MemoryRegion iomem;
     qemu_irq irq;
 
-    struct iovec iov_cache[ASPEED_HACE_MAX_SG];
     uint32_t regs[ASPEED_HACE_NR_REGS];
     uint32_t total_req_len;
-    uint32_t iov_count;
 
     MemoryRegion *dram_mr;
     AddressSpace dram_as;

From c869da4edd7ad91975fd9887ec924ba621b3c7f8 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Thu, 15 May 2025 16:09:34 +0800
Subject: [PATCH 1124/2760] hw/misc/aspeed_hace: Improve readability and
 consistency in variable naming
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Currently, users define multiple local variables within different if-statements.
To improve readability and maintain consistency in variable naming, rename the
variables accordingly.
Introduced "sg_addr" to clearly indicate the scatter-gather mode buffer address.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250515081008.583578-3-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/misc/aspeed_hace.c | 71 +++++++++++++++++++++----------------------
 1 file changed, 35 insertions(+), 36 deletions(-)

diff --git a/hw/misc/aspeed_hace.c b/hw/misc/aspeed_hace.c
index 9263739ea6..6be94963bc 100644
--- a/hw/misc/aspeed_hace.c
+++ b/hw/misc/aspeed_hace.c
@@ -145,15 +145,19 @@ static bool has_padding(AspeedHACEState *s, struct iovec *iov,
 static void do_hash_operation(AspeedHACEState *s, int algo, bool sg_mode,
                               bool acc_mode)
 {
-    struct iovec iov[ASPEED_HACE_MAX_SG];
-    uint32_t total_msg_len;
-    uint32_t pad_offset;
     g_autofree uint8_t *digest_buf = NULL;
-    size_t digest_len = 0;
-    bool sg_acc_mode_final_request = false;
-    int i;
-    void *haddr;
+    struct iovec iov[ASPEED_HACE_MAX_SG];
+    bool acc_final_request = false;
     Error *local_err = NULL;
+    uint32_t total_msg_len;
+    size_t digest_len = 0;
+    uint32_t sg_addr = 0;
+    uint32_t pad_offset;
+    int iov_idx = 0;
+    uint32_t len = 0;
+    uint32_t src = 0;
+    void *haddr;
+    hwaddr plen;
 
     if (acc_mode && s->hash_ctx == NULL) {
         s->hash_ctx = qcrypto_hash_new(algo, &local_err);
@@ -166,74 +170,69 @@ static void do_hash_operation(AspeedHACEState *s, int algo, bool sg_mode,
     }
 
     if (sg_mode) {
-        uint32_t len = 0;
-
-        for (i = 0; !(len & SG_LIST_LEN_LAST); i++) {
-            uint32_t addr, src;
-            hwaddr plen;
-
-            if (i == ASPEED_HACE_MAX_SG) {
+        for (iov_idx = 0; !(len & SG_LIST_LEN_LAST); iov_idx++) {
+            if (iov_idx == ASPEED_HACE_MAX_SG) {
                 qemu_log_mask(LOG_GUEST_ERROR,
                         "aspeed_hace: guest failed to set end of sg list marker\n");
                 break;
             }
 
-            src = s->regs[R_HASH_SRC] + (i * SG_LIST_ENTRY_SIZE);
+            src = s->regs[R_HASH_SRC] + (iov_idx * SG_LIST_ENTRY_SIZE);
 
             len = address_space_ldl_le(&s->dram_as, src,
                                        MEMTXATTRS_UNSPECIFIED, NULL);
 
-            addr = address_space_ldl_le(&s->dram_as, src + SG_LIST_LEN_SIZE,
-                                        MEMTXATTRS_UNSPECIFIED, NULL);
-            addr &= SG_LIST_ADDR_MASK;
+            sg_addr = address_space_ldl_le(&s->dram_as, src + SG_LIST_LEN_SIZE,
+                                           MEMTXATTRS_UNSPECIFIED, NULL);
+            sg_addr &= SG_LIST_ADDR_MASK;
 
             plen = len & SG_LIST_LEN_MASK;
-            haddr = address_space_map(&s->dram_as, addr, &plen, false,
+            haddr = address_space_map(&s->dram_as, sg_addr, &plen, false,
                                       MEMTXATTRS_UNSPECIFIED);
             if (haddr == NULL) {
                 qemu_log_mask(LOG_GUEST_ERROR,
                               "%s: qcrypto failed\n", __func__);
                 return;
             }
-            iov[i].iov_base = haddr;
+            iov[iov_idx].iov_base = haddr;
             if (acc_mode) {
                 s->total_req_len += plen;
 
-                if (has_padding(s, &iov[i], plen, &total_msg_len,
+                if (has_padding(s, &iov[iov_idx], plen, &total_msg_len,
                                 &pad_offset)) {
                     /* Padding being present indicates the final request */
-                    sg_acc_mode_final_request = true;
-                    iov[i].iov_len = pad_offset;
+                    acc_final_request = true;
+                    iov[iov_idx].iov_len = pad_offset;
                 } else {
-                    iov[i].iov_len = plen;
+                    iov[iov_idx].iov_len = plen;
                 }
             } else {
-                iov[i].iov_len = plen;
+                iov[iov_idx].iov_len = plen;
             }
         }
     } else {
-        hwaddr len = s->regs[R_HASH_SRC_LEN];
+        plen = s->regs[R_HASH_SRC_LEN];
 
         haddr = address_space_map(&s->dram_as, s->regs[R_HASH_SRC],
-                                  &len, false, MEMTXATTRS_UNSPECIFIED);
+                                  &plen, false, MEMTXATTRS_UNSPECIFIED);
         if (haddr == NULL) {
             qemu_log_mask(LOG_GUEST_ERROR, "%s: qcrypto failed\n", __func__);
             return;
         }
         iov[0].iov_base = haddr;
-        iov[0].iov_len = len;
-        i = 1;
+        iov[0].iov_len = plen;
+        iov_idx = 1;
     }
 
     if (acc_mode) {
-        if (qcrypto_hash_updatev(s->hash_ctx, iov, i, &local_err) < 0) {
+        if (qcrypto_hash_updatev(s->hash_ctx, iov, iov_idx, &local_err) < 0) {
             qemu_log_mask(LOG_GUEST_ERROR, "qcrypto hash update failed : %s",
                           error_get_pretty(local_err));
             error_free(local_err);
             return;
         }
 
-        if (sg_acc_mode_final_request) {
+        if (acc_final_request) {
             if (qcrypto_hash_finalize_bytes(s->hash_ctx, &digest_buf,
                                             &digest_len, &local_err)) {
                 qemu_log_mask(LOG_GUEST_ERROR,
@@ -248,7 +247,7 @@ static void do_hash_operation(AspeedHACEState *s, int algo, bool sg_mode,
             s->hash_ctx = NULL;
             s->total_req_len = 0;
         }
-    } else if (qcrypto_hash_bytesv(algo, iov, i, &digest_buf,
+    } else if (qcrypto_hash_bytesv(algo, iov, iov_idx, &digest_buf,
                                    &digest_len, &local_err) < 0) {
         qemu_log_mask(LOG_GUEST_ERROR, "qcrypto hash bytesv failed : %s",
                       error_get_pretty(local_err));
@@ -263,10 +262,10 @@ static void do_hash_operation(AspeedHACEState *s, int algo, bool sg_mode,
                       "aspeed_hace: address space write failed\n");
     }
 
-    for (; i > 0; i--) {
-        address_space_unmap(&s->dram_as, iov[i - 1].iov_base,
-                            iov[i - 1].iov_len, false,
-                            iov[i - 1].iov_len);
+    for (; iov_idx > 0; iov_idx--) {
+        address_space_unmap(&s->dram_as, iov[iov_idx - 1].iov_base,
+                            iov[iov_idx - 1].iov_len, false,
+                            iov[iov_idx - 1].iov_len);
     }
 
     /*

From fb8e59abbe46957cd599bb9aa9221fad1e4e989e Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Thu, 15 May 2025 16:09:35 +0800
Subject: [PATCH 1125/2760] hw/misc/aspeed_hace: Ensure HASH_IRQ is always set
 to prevent firmware hang
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Currently, if the program encounters an unsupported algorithm, it does not set
the HASH_IRQ bit in the status register and send an interrupt to indicate
command completion. As a result, the FW gets stuck waiting for a completion
signal from the HACE module.

Additionally, in do_hash_operation, if an error occurs within the conditional
statement, the HASH_IRQ bit is not set in the status register. This causes the
firmware to continuously send HASH commands, as it is unaware that the HACE
model has completed processing the command.

To fix this, the HASH_IRQ bit in the status register must always be set to
ensure that the firmware receives an interrupt from the HACE module, preventing
it from getting stuck or repeatedly sending HASH commands.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Fixes: c5475b3 ("hw: Model ASPEED's Hash and Crypto Engine")
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250515081008.583578-4-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/misc/aspeed_hace.c | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/hw/misc/aspeed_hace.c b/hw/misc/aspeed_hace.c
index 6be94963bc..1256926d22 100644
--- a/hw/misc/aspeed_hace.c
+++ b/hw/misc/aspeed_hace.c
@@ -267,12 +267,6 @@ static void do_hash_operation(AspeedHACEState *s, int algo, bool sg_mode,
                             iov[iov_idx - 1].iov_len, false,
                             iov[iov_idx - 1].iov_len);
     }
-
-    /*
-     * Set status bits to indicate completion. Testing shows hardware sets
-     * these irrespective of HASH_IRQ_EN.
-     */
-    s->regs[R_STATUS] |= HASH_IRQ;
 }
 
 static uint64_t aspeed_hace_read(void *opaque, hwaddr addr, unsigned int size)
@@ -356,10 +350,16 @@ static void aspeed_hace_write(void *opaque, hwaddr addr, uint64_t data,
                 qemu_log_mask(LOG_GUEST_ERROR,
                         "%s: Invalid hash algorithm selection 0x%"PRIx64"\n",
                         __func__, data & ahc->hash_mask);
-                break;
+        } else {
+            do_hash_operation(s, algo, data & HASH_SG_EN,
+                    ((data & HASH_HMAC_MASK) == HASH_DIGEST_ACCUM));
         }
-        do_hash_operation(s, algo, data & HASH_SG_EN,
-                ((data & HASH_HMAC_MASK) == HASH_DIGEST_ACCUM));
+
+        /*
+         * Set status bits to indicate completion. Testing shows hardware sets
+         * these irrespective of HASH_IRQ_EN.
+         */
+        s->regs[R_STATUS] |= HASH_IRQ;
 
         if (data & HASH_IRQ_EN) {
             qemu_irq_raise(s->irq);

From 7328c48b57c97e13863fdc3a76d6d9c8fe07d6ae Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Thu, 15 May 2025 16:09:36 +0800
Subject: [PATCH 1126/2760] hw/misc/aspeed_hace: Extract direct mode hash
 buffer setup into helper function
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

To improve code readability and maintainability of do_hash_operation(), this
commit introduces a new helper function: hash_prepare_direct_iov().
This function encapsulates the logic for setting up the I/O vector (iov)
in direct mode (non-scatter-gather).

No functional changes are introduced.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250515081008.583578-5-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/misc/aspeed_hace.c | 42 ++++++++++++++++++++++++++++++++----------
 1 file changed, 32 insertions(+), 10 deletions(-)

diff --git a/hw/misc/aspeed_hace.c b/hw/misc/aspeed_hace.c
index 1256926d22..42c6f29f82 100644
--- a/hw/misc/aspeed_hace.c
+++ b/hw/misc/aspeed_hace.c
@@ -142,6 +142,31 @@ static bool has_padding(AspeedHACEState *s, struct iovec *iov,
     return false;
 }
 
+static int hash_prepare_direct_iov(AspeedHACEState *s, struct iovec *iov)
+{
+    uint32_t src;
+    void *haddr;
+    hwaddr plen;
+    int iov_idx;
+
+    plen = s->regs[R_HASH_SRC_LEN];
+    src = s->regs[R_HASH_SRC];
+    haddr = address_space_map(&s->dram_as, src, &plen, false,
+                              MEMTXATTRS_UNSPECIFIED);
+    if (haddr == NULL) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: Unable to map address, addr=0x%x, "
+                      "plen=0x%" HWADDR_PRIx "\n",
+                      __func__, src, plen);
+        return -1;
+    }
+
+    iov[0].iov_base = haddr;
+    iov[0].iov_len = plen;
+    iov_idx = 1;
+
+    return iov_idx;
+}
 static void do_hash_operation(AspeedHACEState *s, int algo, bool sg_mode,
                               bool acc_mode)
 {
@@ -169,6 +194,7 @@ static void do_hash_operation(AspeedHACEState *s, int algo, bool sg_mode,
         }
     }
 
+    /* Prepares the iov for hashing operations based on the selected mode */
     if (sg_mode) {
         for (iov_idx = 0; !(len & SG_LIST_LEN_LAST); iov_idx++) {
             if (iov_idx == ASPEED_HACE_MAX_SG) {
@@ -211,17 +237,13 @@ static void do_hash_operation(AspeedHACEState *s, int algo, bool sg_mode,
             }
         }
     } else {
-        plen = s->regs[R_HASH_SRC_LEN];
+        iov_idx = hash_prepare_direct_iov(s, iov);
+    }
 
-        haddr = address_space_map(&s->dram_as, s->regs[R_HASH_SRC],
-                                  &plen, false, MEMTXATTRS_UNSPECIFIED);
-        if (haddr == NULL) {
-            qemu_log_mask(LOG_GUEST_ERROR, "%s: qcrypto failed\n", __func__);
-            return;
-        }
-        iov[0].iov_base = haddr;
-        iov[0].iov_len = plen;
-        iov_idx = 1;
+    if (iov_idx <= 0) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: Failed to prepare iov\n", __func__);
+         return;
     }
 
     if (acc_mode) {

From 0b7dd5f9910c41d9a3faa51001b018a06f0c3ac7 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Thu, 15 May 2025 16:09:37 +0800
Subject: [PATCH 1127/2760] hw/misc/aspeed_hace: Extract SG-mode hash buffer
 setup into helper function
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

To improve code readability and maintainability of do_hash_operation(), this
commit introduces a new helper function: hash_prepare_sg_iov().

This function handles scatter-gather (SG) mode setup, including SG list
parsing, address mapping, and optional accumulation mode support with
padding detection.

No functional changes are introduced.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250515081008.583578-6-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/misc/aspeed_hace.c | 111 ++++++++++++++++++++++++------------------
 1 file changed, 63 insertions(+), 48 deletions(-)

diff --git a/hw/misc/aspeed_hace.c b/hw/misc/aspeed_hace.c
index 42c6f29f82..22eea62693 100644
--- a/hw/misc/aspeed_hace.c
+++ b/hw/misc/aspeed_hace.c
@@ -167,6 +167,67 @@ static int hash_prepare_direct_iov(AspeedHACEState *s, struct iovec *iov)
 
     return iov_idx;
 }
+
+static int hash_prepare_sg_iov(AspeedHACEState *s, struct iovec *iov,
+                               bool acc_mode, bool *acc_final_request)
+{
+    uint32_t total_msg_len;
+    uint32_t pad_offset;
+    uint32_t len = 0;
+    uint32_t sg_addr;
+    uint32_t src;
+    int iov_idx;
+    hwaddr plen;
+    void *haddr;
+
+    for (iov_idx = 0; !(len & SG_LIST_LEN_LAST); iov_idx++) {
+        if (iov_idx == ASPEED_HACE_MAX_SG) {
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "%s: Failed to set end of sg list marker\n",
+                          __func__);
+            return -1;
+        }
+
+        src = s->regs[R_HASH_SRC] + (iov_idx * SG_LIST_ENTRY_SIZE);
+
+        len = address_space_ldl_le(&s->dram_as, src,
+                                   MEMTXATTRS_UNSPECIFIED, NULL);
+        sg_addr = address_space_ldl_le(&s->dram_as, src + SG_LIST_LEN_SIZE,
+                                       MEMTXATTRS_UNSPECIFIED, NULL);
+        sg_addr &= SG_LIST_ADDR_MASK;
+
+        plen = len & SG_LIST_LEN_MASK;
+        haddr = address_space_map(&s->dram_as, sg_addr, &plen, false,
+                                  MEMTXATTRS_UNSPECIFIED);
+
+        if (haddr == NULL) {
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "%s: Unable to map address, sg_addr=0x%x, "
+                          "plen=0x%" HWADDR_PRIx "\n",
+                          __func__, sg_addr, plen);
+            return -1;
+        }
+
+        iov[iov_idx].iov_base = haddr;
+        if (acc_mode) {
+            s->total_req_len += plen;
+
+            if (has_padding(s, &iov[iov_idx], plen, &total_msg_len,
+                            &pad_offset)) {
+                /* Padding being present indicates the final request */
+                *acc_final_request = true;
+                iov[iov_idx].iov_len = pad_offset;
+            } else {
+                iov[iov_idx].iov_len = plen;
+            }
+        } else {
+            iov[iov_idx].iov_len = plen;
+        }
+    }
+
+    return iov_idx;
+}
+
 static void do_hash_operation(AspeedHACEState *s, int algo, bool sg_mode,
                               bool acc_mode)
 {
@@ -174,15 +235,8 @@ static void do_hash_operation(AspeedHACEState *s, int algo, bool sg_mode,
     struct iovec iov[ASPEED_HACE_MAX_SG];
     bool acc_final_request = false;
     Error *local_err = NULL;
-    uint32_t total_msg_len;
     size_t digest_len = 0;
-    uint32_t sg_addr = 0;
-    uint32_t pad_offset;
-    int iov_idx = 0;
-    uint32_t len = 0;
-    uint32_t src = 0;
-    void *haddr;
-    hwaddr plen;
+    int iov_idx = -1;
 
     if (acc_mode && s->hash_ctx == NULL) {
         s->hash_ctx = qcrypto_hash_new(algo, &local_err);
@@ -196,46 +250,7 @@ static void do_hash_operation(AspeedHACEState *s, int algo, bool sg_mode,
 
     /* Prepares the iov for hashing operations based on the selected mode */
     if (sg_mode) {
-        for (iov_idx = 0; !(len & SG_LIST_LEN_LAST); iov_idx++) {
-            if (iov_idx == ASPEED_HACE_MAX_SG) {
-                qemu_log_mask(LOG_GUEST_ERROR,
-                        "aspeed_hace: guest failed to set end of sg list marker\n");
-                break;
-            }
-
-            src = s->regs[R_HASH_SRC] + (iov_idx * SG_LIST_ENTRY_SIZE);
-
-            len = address_space_ldl_le(&s->dram_as, src,
-                                       MEMTXATTRS_UNSPECIFIED, NULL);
-
-            sg_addr = address_space_ldl_le(&s->dram_as, src + SG_LIST_LEN_SIZE,
-                                           MEMTXATTRS_UNSPECIFIED, NULL);
-            sg_addr &= SG_LIST_ADDR_MASK;
-
-            plen = len & SG_LIST_LEN_MASK;
-            haddr = address_space_map(&s->dram_as, sg_addr, &plen, false,
-                                      MEMTXATTRS_UNSPECIFIED);
-            if (haddr == NULL) {
-                qemu_log_mask(LOG_GUEST_ERROR,
-                              "%s: qcrypto failed\n", __func__);
-                return;
-            }
-            iov[iov_idx].iov_base = haddr;
-            if (acc_mode) {
-                s->total_req_len += plen;
-
-                if (has_padding(s, &iov[iov_idx], plen, &total_msg_len,
-                                &pad_offset)) {
-                    /* Padding being present indicates the final request */
-                    acc_final_request = true;
-                    iov[iov_idx].iov_len = pad_offset;
-                } else {
-                    iov[iov_idx].iov_len = plen;
-                }
-            } else {
-                iov[iov_idx].iov_len = plen;
-            }
-        }
+        iov_idx = hash_prepare_sg_iov(s, iov, acc_mode, &acc_final_request);
     } else {
         iov_idx = hash_prepare_direct_iov(s, iov);
     }

From 047941978508e68215d01cc0e3e5408c430e9e9f Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Thu, 15 May 2025 16:09:38 +0800
Subject: [PATCH 1128/2760] hw/misc/aspeed_hace: Extract digest write and iov
 unmap into helper function
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

To improve code readability and maintainability of do_hash_operation(), this
commit introduces a new helper function: hash_write_digest_and_unmap_iov().

The helper consolidates the final digest writeback and subsequent unmapping of
the I/O vectors into a single routine.

No functional changes are introduced.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250515081008.583578-7-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/misc/aspeed_hace.c | 33 +++++++++++++++++++++------------
 1 file changed, 21 insertions(+), 12 deletions(-)

diff --git a/hw/misc/aspeed_hace.c b/hw/misc/aspeed_hace.c
index 22eea62693..7da781f864 100644
--- a/hw/misc/aspeed_hace.c
+++ b/hw/misc/aspeed_hace.c
@@ -228,6 +228,26 @@ static int hash_prepare_sg_iov(AspeedHACEState *s, struct iovec *iov,
     return iov_idx;
 }
 
+static void hash_write_digest_and_unmap_iov(AspeedHACEState *s,
+                                            struct iovec *iov,
+                                            int iov_idx,
+                                            uint8_t *digest_buf,
+                                            size_t digest_len)
+{
+    if (address_space_write(&s->dram_as, s->regs[R_HASH_DEST],
+                            MEMTXATTRS_UNSPECIFIED, digest_buf, digest_len)) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: Failed to write digest to 0x%x\n",
+                      __func__, s->regs[R_HASH_DEST]);
+    }
+
+    for (; iov_idx > 0; iov_idx--) {
+        address_space_unmap(&s->dram_as, iov[iov_idx - 1].iov_base,
+                            iov[iov_idx - 1].iov_len, false,
+                            iov[iov_idx - 1].iov_len);
+    }
+}
+
 static void do_hash_operation(AspeedHACEState *s, int algo, bool sg_mode,
                               bool acc_mode)
 {
@@ -292,18 +312,7 @@ static void do_hash_operation(AspeedHACEState *s, int algo, bool sg_mode,
         return;
     }
 
-    if (address_space_write(&s->dram_as, s->regs[R_HASH_DEST],
-                            MEMTXATTRS_UNSPECIFIED,
-                            digest_buf, digest_len)) {
-        qemu_log_mask(LOG_GUEST_ERROR,
-                      "aspeed_hace: address space write failed\n");
-    }
-
-    for (; iov_idx > 0; iov_idx--) {
-        address_space_unmap(&s->dram_as, iov[iov_idx - 1].iov_base,
-                            iov[iov_idx - 1].iov_len, false,
-                            iov[iov_idx - 1].iov_len);
-    }
+    hash_write_digest_and_unmap_iov(s, iov, iov_idx, digest_buf, digest_len);
 }
 
 static uint64_t aspeed_hace_read(void *opaque, hwaddr addr, unsigned int size)

From 02c4c448460e1370f767c56749a1756a5c4dcc3a Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Thu, 15 May 2025 16:09:39 +0800
Subject: [PATCH 1129/2760] hw/misc/aspeed_hace: Extract non-accumulation hash
 execution into helper function
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

To improve code readability and maintainability of do_hash_operation(), this
commit introduces a new helper function: hash_execute_non_acc_mode().

The helper encapsulate the hashing logic for non-accumulation mode.

No functional changes are introduced.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250515081008.583578-8-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/misc/aspeed_hace.c | 32 ++++++++++++++++++++++++--------
 1 file changed, 24 insertions(+), 8 deletions(-)

diff --git a/hw/misc/aspeed_hace.c b/hw/misc/aspeed_hace.c
index 7da781f864..c50e228cdf 100644
--- a/hw/misc/aspeed_hace.c
+++ b/hw/misc/aspeed_hace.c
@@ -248,6 +248,25 @@ static void hash_write_digest_and_unmap_iov(AspeedHACEState *s,
     }
 }
 
+static void hash_execute_non_acc_mode(AspeedHACEState *s, int algo,
+                                      struct iovec *iov, int iov_idx)
+{
+    g_autofree uint8_t *digest_buf = NULL;
+    Error *local_err = NULL;
+    size_t digest_len = 0;
+
+    if (qcrypto_hash_bytesv(algo, iov, iov_idx, &digest_buf,
+                            &digest_len, &local_err) < 0) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: qcrypto hash bytesv failed : %s",
+                      __func__, error_get_pretty(local_err));
+        error_free(local_err);
+        return;
+    }
+
+    hash_write_digest_and_unmap_iov(s, iov, iov_idx, digest_buf, digest_len);
+}
+
 static void do_hash_operation(AspeedHACEState *s, int algo, bool sg_mode,
                               bool acc_mode)
 {
@@ -304,15 +323,12 @@ static void do_hash_operation(AspeedHACEState *s, int algo, bool sg_mode,
             s->hash_ctx = NULL;
             s->total_req_len = 0;
         }
-    } else if (qcrypto_hash_bytesv(algo, iov, iov_idx, &digest_buf,
-                                   &digest_len, &local_err) < 0) {
-        qemu_log_mask(LOG_GUEST_ERROR, "qcrypto hash bytesv failed : %s",
-                      error_get_pretty(local_err));
-        error_free(local_err);
-        return;
-    }
 
-    hash_write_digest_and_unmap_iov(s, iov, iov_idx, digest_buf, digest_len);
+        hash_write_digest_and_unmap_iov(s, iov, iov_idx, digest_buf,
+                                        digest_len);
+    } else {
+        hash_execute_non_acc_mode(s, algo, iov, iov_idx);
+    }
 }
 
 static uint64_t aspeed_hace_read(void *opaque, hwaddr addr, unsigned int size)

From b9ccbe212e2443294dd636cb17b4e436db8774a7 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Thu, 15 May 2025 16:09:40 +0800
Subject: [PATCH 1130/2760] hw/misc/aspeed_hace: Extract accumulation-mode hash
 execution into helper function
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

To improve code readability and maintainability of do_hash_operation(), this
commit introduces a new helper function: hash_execute_acc_mode().

This function encapsulates the full flow for accumulation mode, including
context initialization, update, conditional finalization, and digest writeback
with I/O vector unmapping.

No functional changes are introduced.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250515081008.583578-9-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/misc/aspeed_hace.c | 74 ++++++++++++++++++++++++-------------------
 1 file changed, 41 insertions(+), 33 deletions(-)

diff --git a/hw/misc/aspeed_hace.c b/hw/misc/aspeed_hace.c
index c50e228cdf..33e13974fe 100644
--- a/hw/misc/aspeed_hace.c
+++ b/hw/misc/aspeed_hace.c
@@ -267,26 +267,57 @@ static void hash_execute_non_acc_mode(AspeedHACEState *s, int algo,
     hash_write_digest_and_unmap_iov(s, iov, iov_idx, digest_buf, digest_len);
 }
 
-static void do_hash_operation(AspeedHACEState *s, int algo, bool sg_mode,
-                              bool acc_mode)
+static void hash_execute_acc_mode(AspeedHACEState *s, int algo,
+                                  struct iovec *iov, int iov_idx,
+                                  bool final_request)
 {
     g_autofree uint8_t *digest_buf = NULL;
-    struct iovec iov[ASPEED_HACE_MAX_SG];
-    bool acc_final_request = false;
     Error *local_err = NULL;
     size_t digest_len = 0;
-    int iov_idx = -1;
 
-    if (acc_mode && s->hash_ctx == NULL) {
+    if (s->hash_ctx == NULL) {
         s->hash_ctx = qcrypto_hash_new(algo, &local_err);
         if (s->hash_ctx == NULL) {
-            qemu_log_mask(LOG_GUEST_ERROR, "qcrypto hash failed : %s",
-                          error_get_pretty(local_err));
+            qemu_log_mask(LOG_GUEST_ERROR, "%s: qcrypto hash new failed : %s",
+                          __func__, error_get_pretty(local_err));
             error_free(local_err);
             return;
         }
     }
 
+    if (qcrypto_hash_updatev(s->hash_ctx, iov, iov_idx, &local_err) < 0) {
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: qcrypto hash updatev failed : %s",
+                      __func__, error_get_pretty(local_err));
+        error_free(local_err);
+        return;
+    }
+
+    if (final_request) {
+        if (qcrypto_hash_finalize_bytes(s->hash_ctx, &digest_buf,
+                                        &digest_len, &local_err)) {
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "%s: qcrypto hash finalize bytes failed : %s",
+                          __func__, error_get_pretty(local_err));
+            error_free(local_err);
+            local_err = NULL;
+        }
+
+        qcrypto_hash_free(s->hash_ctx);
+
+        s->hash_ctx = NULL;
+        s->total_req_len = 0;
+    }
+
+    hash_write_digest_and_unmap_iov(s, iov, iov_idx, digest_buf, digest_len);
+}
+
+static void do_hash_operation(AspeedHACEState *s, int algo, bool sg_mode,
+                              bool acc_mode)
+{
+    struct iovec iov[ASPEED_HACE_MAX_SG];
+    bool acc_final_request = false;
+    int iov_idx = -1;
+
     /* Prepares the iov for hashing operations based on the selected mode */
     if (sg_mode) {
         iov_idx = hash_prepare_sg_iov(s, iov, acc_mode, &acc_final_request);
@@ -300,32 +331,9 @@ static void do_hash_operation(AspeedHACEState *s, int algo, bool sg_mode,
          return;
     }
 
+    /* Executes the hash operation */
     if (acc_mode) {
-        if (qcrypto_hash_updatev(s->hash_ctx, iov, iov_idx, &local_err) < 0) {
-            qemu_log_mask(LOG_GUEST_ERROR, "qcrypto hash update failed : %s",
-                          error_get_pretty(local_err));
-            error_free(local_err);
-            return;
-        }
-
-        if (acc_final_request) {
-            if (qcrypto_hash_finalize_bytes(s->hash_ctx, &digest_buf,
-                                            &digest_len, &local_err)) {
-                qemu_log_mask(LOG_GUEST_ERROR,
-                              "qcrypto hash finalize failed : %s",
-                              error_get_pretty(local_err));
-                error_free(local_err);
-                local_err = NULL;
-            }
-
-            qcrypto_hash_free(s->hash_ctx);
-
-            s->hash_ctx = NULL;
-            s->total_req_len = 0;
-        }
-
-        hash_write_digest_and_unmap_iov(s, iov, iov_idx, digest_buf,
-                                        digest_len);
+        hash_execute_acc_mode(s, algo, iov, iov_idx, acc_final_request);
     } else {
         hash_execute_non_acc_mode(s, algo, iov, iov_idx);
     }

From c6c5fc5ab04533a22be11f377aa67d46e47056bf Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Thu, 15 May 2025 16:09:41 +0800
Subject: [PATCH 1131/2760] hw/misc/aspeed_hace: Introduce 64-bit hash source
 address helper function
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The AST2700 CPU, based on the Cortex-A35, is a 64-bit processor, and its DRAM
address space is also 64-bit. To support future AST2700 updates, the source
hash buffer address data type is being updated to 64-bit.

Introduces the "hash_get_source_addr()" helper function to extract the source hash
buffer address.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250515081008.583578-10-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/misc/aspeed_hace.c | 24 +++++++++++++++++-------
 1 file changed, 17 insertions(+), 7 deletions(-)

diff --git a/hw/misc/aspeed_hace.c b/hw/misc/aspeed_hace.c
index 33e13974fe..b3c3af51fa 100644
--- a/hw/misc/aspeed_hace.c
+++ b/hw/misc/aspeed_hace.c
@@ -142,21 +142,30 @@ static bool has_padding(AspeedHACEState *s, struct iovec *iov,
     return false;
 }
 
+static uint64_t hash_get_source_addr(AspeedHACEState *s)
+{
+    uint64_t src_addr = 0;
+
+    src_addr = deposit64(src_addr, 0, 32, s->regs[R_HASH_SRC]);
+
+    return src_addr;
+}
+
 static int hash_prepare_direct_iov(AspeedHACEState *s, struct iovec *iov)
 {
-    uint32_t src;
+    uint64_t src;
     void *haddr;
     hwaddr plen;
     int iov_idx;
 
     plen = s->regs[R_HASH_SRC_LEN];
-    src = s->regs[R_HASH_SRC];
+    src = hash_get_source_addr(s);
     haddr = address_space_map(&s->dram_as, src, &plen, false,
                               MEMTXATTRS_UNSPECIFIED);
     if (haddr == NULL) {
         qemu_log_mask(LOG_GUEST_ERROR,
-                      "%s: Unable to map address, addr=0x%x, "
-                      "plen=0x%" HWADDR_PRIx "\n",
+                      "%s: Unable to map address, addr=0x%" HWADDR_PRIx
+                      " ,plen=0x%" HWADDR_PRIx "\n",
                       __func__, src, plen);
         return -1;
     }
@@ -175,11 +184,12 @@ static int hash_prepare_sg_iov(AspeedHACEState *s, struct iovec *iov,
     uint32_t pad_offset;
     uint32_t len = 0;
     uint32_t sg_addr;
-    uint32_t src;
+    uint64_t src;
     int iov_idx;
     hwaddr plen;
     void *haddr;
 
+    src = hash_get_source_addr(s);
     for (iov_idx = 0; !(len & SG_LIST_LEN_LAST); iov_idx++) {
         if (iov_idx == ASPEED_HACE_MAX_SG) {
             qemu_log_mask(LOG_GUEST_ERROR,
@@ -188,8 +198,6 @@ static int hash_prepare_sg_iov(AspeedHACEState *s, struct iovec *iov,
             return -1;
         }
 
-        src = s->regs[R_HASH_SRC] + (iov_idx * SG_LIST_ENTRY_SIZE);
-
         len = address_space_ldl_le(&s->dram_as, src,
                                    MEMTXATTRS_UNSPECIFIED, NULL);
         sg_addr = address_space_ldl_le(&s->dram_as, src + SG_LIST_LEN_SIZE,
@@ -208,6 +216,8 @@ static int hash_prepare_sg_iov(AspeedHACEState *s, struct iovec *iov,
             return -1;
         }
 
+        src += SG_LIST_ENTRY_SIZE;
+
         iov[iov_idx].iov_base = haddr;
         if (acc_mode) {
             s->total_req_len += plen;

From 973fab3b3099aa5f6a4510c4da03056d6baf09a7 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Thu, 15 May 2025 16:09:42 +0800
Subject: [PATCH 1132/2760] hw/misc/aspeed_hace: Rename R_HASH_DEST to
 R_HASH_DIGEST and introduce 64-bit hash digest address helper
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Renaming R_HASH_DEST to R_HASH_DIGEST for better semantic clarity.

The AST2700 CPU, based on the Cortex-A35, features a 64-bit DRAM address space.
To prepare for future AST2700 support, this change introduces a new helper
function hash_get_digest_addr() to encapsulate digest address extraction logic
and improve code readability.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250515081008.583578-11-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/misc/aspeed_hace.c | 25 +++++++++++++++++++------
 1 file changed, 19 insertions(+), 6 deletions(-)

diff --git a/hw/misc/aspeed_hace.c b/hw/misc/aspeed_hace.c
index b3c3af51fa..62649b5b27 100644
--- a/hw/misc/aspeed_hace.c
+++ b/hw/misc/aspeed_hace.c
@@ -27,7 +27,7 @@
 #define TAG_IRQ         BIT(15)
 
 #define R_HASH_SRC      (0x20 / 4)
-#define R_HASH_DEST     (0x24 / 4)
+#define R_HASH_DIGEST   (0x24 / 4)
 #define R_HASH_KEY_BUFF (0x28 / 4)
 #define R_HASH_SRC_LEN  (0x2c / 4)
 
@@ -238,17 +238,30 @@ static int hash_prepare_sg_iov(AspeedHACEState *s, struct iovec *iov,
     return iov_idx;
 }
 
+static uint64_t hash_get_digest_addr(AspeedHACEState *s)
+{
+    uint64_t digest_addr = 0;
+
+    digest_addr = deposit64(digest_addr, 0, 32, s->regs[R_HASH_DIGEST]);
+
+    return digest_addr;
+}
+
 static void hash_write_digest_and_unmap_iov(AspeedHACEState *s,
                                             struct iovec *iov,
                                             int iov_idx,
                                             uint8_t *digest_buf,
                                             size_t digest_len)
 {
-    if (address_space_write(&s->dram_as, s->regs[R_HASH_DEST],
-                            MEMTXATTRS_UNSPECIFIED, digest_buf, digest_len)) {
+    uint64_t digest_addr = 0;
+
+    digest_addr = hash_get_digest_addr(s);
+    if (address_space_write(&s->dram_as, digest_addr,
+                            MEMTXATTRS_UNSPECIFIED,
+                            digest_buf, digest_len)) {
         qemu_log_mask(LOG_GUEST_ERROR,
-                      "%s: Failed to write digest to 0x%x\n",
-                      __func__, s->regs[R_HASH_DEST]);
+                      "%s: Failed to write digest to 0x%" HWADDR_PRIx "\n",
+                      __func__, digest_addr);
     }
 
     for (; iov_idx > 0; iov_idx--) {
@@ -402,7 +415,7 @@ static void aspeed_hace_write(void *opaque, hwaddr addr, uint64_t data,
     case R_HASH_SRC:
         data &= ahc->src_mask;
         break;
-    case R_HASH_DEST:
+    case R_HASH_DIGEST:
         data &= ahc->dest_mask;
         break;
     case R_HASH_KEY_BUFF:

From 7b4e588000699701f5906746d1b5b845391705e6 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Thu, 15 May 2025 16:09:43 +0800
Subject: [PATCH 1133/2760] hw/misc/aspeed_hace: Support accumulative mode for
 direct access mode
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Enable accumulative mode for direct access mode operations. In direct access
mode, only a single source buffer is used, so the "iovec" count is set to 1.
If "acc_mode" is enabled:
1. Accumulate "total_req_len" with the current request length ("plen").
2. Check for padding and determine whether this is the final request.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250515081008.583578-12-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/misc/aspeed_hace.c | 24 +++++++++++++++++++++---
 1 file changed, 21 insertions(+), 3 deletions(-)

diff --git a/hw/misc/aspeed_hace.c b/hw/misc/aspeed_hace.c
index 62649b5b27..049f732f99 100644
--- a/hw/misc/aspeed_hace.c
+++ b/hw/misc/aspeed_hace.c
@@ -151,8 +151,11 @@ static uint64_t hash_get_source_addr(AspeedHACEState *s)
     return src_addr;
 }
 
-static int hash_prepare_direct_iov(AspeedHACEState *s, struct iovec *iov)
+static int hash_prepare_direct_iov(AspeedHACEState *s, struct iovec *iov,
+                                   bool acc_mode, bool *acc_final_request)
 {
+    uint32_t total_msg_len;
+    uint32_t pad_offset;
     uint64_t src;
     void *haddr;
     hwaddr plen;
@@ -171,9 +174,23 @@ static int hash_prepare_direct_iov(AspeedHACEState *s, struct iovec *iov)
     }
 
     iov[0].iov_base = haddr;
-    iov[0].iov_len = plen;
     iov_idx = 1;
 
+    if (acc_mode) {
+        s->total_req_len += plen;
+
+        if (has_padding(s, &iov[0], plen, &total_msg_len,
+                        &pad_offset)) {
+            /* Padding being present indicates the final request */
+            *acc_final_request = true;
+            iov[0].iov_len = pad_offset;
+        } else {
+            iov[0].iov_len = plen;
+        }
+    } else {
+        iov[0].iov_len = plen;
+    }
+
     return iov_idx;
 }
 
@@ -345,7 +362,8 @@ static void do_hash_operation(AspeedHACEState *s, int algo, bool sg_mode,
     if (sg_mode) {
         iov_idx = hash_prepare_sg_iov(s, iov, acc_mode, &acc_final_request);
     } else {
-        iov_idx = hash_prepare_direct_iov(s, iov);
+        iov_idx = hash_prepare_direct_iov(s, iov, acc_mode,
+                                          &acc_final_request);
     }
 
     if (iov_idx <= 0) {

From 89d2a9f3f7564c9421d61153bbf7e24af95d34ee Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Thu, 15 May 2025 16:09:44 +0800
Subject: [PATCH 1134/2760] hw/misc/aspeed_hace: Move register size to instance
 class and dynamically allocate regs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Dynamically allocate the register array by removing the hardcoded
ASPEED_HACE_NR_REGS macro.

To support different register sizes across SoC variants, introduce a new
"nr_regs" class attribute and replace the static "regs" array with dynamically
allocated memory.

Add a new "aspeed_hace_unrealize" function to properly free the allocated "regs"
memory during device cleanup.

Remove the bounds checking in the MMIO read/write handlers since the
MemoryRegion size now matches the (register array size << 2).

This commit updates the VMState fields accordingly. The VMState version was
already bumped in a previous patch of this series, so no further version change
is needed.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250515081008.583578-13-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/misc/aspeed_hace.c         | 36 ++++++++++++++++++-----------------
 include/hw/misc/aspeed_hace.h |  5 +++--
 2 files changed, 22 insertions(+), 19 deletions(-)

diff --git a/hw/misc/aspeed_hace.c b/hw/misc/aspeed_hace.c
index 049f732f99..fef63eb488 100644
--- a/hw/misc/aspeed_hace.c
+++ b/hw/misc/aspeed_hace.c
@@ -386,13 +386,6 @@ static uint64_t aspeed_hace_read(void *opaque, hwaddr addr, unsigned int size)
 
     addr >>= 2;
 
-    if (addr >= ASPEED_HACE_NR_REGS) {
-        qemu_log_mask(LOG_GUEST_ERROR,
-                      "%s: Out-of-bounds read at offset 0x%" HWADDR_PRIx "\n",
-                      __func__, addr << 2);
-        return 0;
-    }
-
     return s->regs[addr];
 }
 
@@ -404,13 +397,6 @@ static void aspeed_hace_write(void *opaque, hwaddr addr, uint64_t data,
 
     addr >>= 2;
 
-    if (addr >= ASPEED_HACE_NR_REGS) {
-        qemu_log_mask(LOG_GUEST_ERROR,
-                      "%s: Out-of-bounds write at offset 0x%" HWADDR_PRIx "\n",
-                      __func__, addr << 2);
-        return;
-    }
-
     switch (addr) {
     case R_STATUS:
         if (data & HASH_IRQ) {
@@ -507,13 +493,14 @@ static const MemoryRegionOps aspeed_hace_ops = {
 static void aspeed_hace_reset(DeviceState *dev)
 {
     struct AspeedHACEState *s = ASPEED_HACE(dev);
+    AspeedHACEClass *ahc = ASPEED_HACE_GET_CLASS(s);
 
     if (s->hash_ctx != NULL) {
         qcrypto_hash_free(s->hash_ctx);
         s->hash_ctx = NULL;
     }
 
-    memset(s->regs, 0, sizeof(s->regs));
+    memset(s->regs, 0, ahc->nr_regs << 2);
     s->total_req_len = 0;
 }
 
@@ -521,11 +508,13 @@ static void aspeed_hace_realize(DeviceState *dev, Error **errp)
 {
     AspeedHACEState *s = ASPEED_HACE(dev);
     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
+    AspeedHACEClass *ahc = ASPEED_HACE_GET_CLASS(s);
 
     sysbus_init_irq(sbd, &s->irq);
 
+    s->regs = g_new(uint32_t, ahc->nr_regs);
     memory_region_init_io(&s->iomem, OBJECT(s), &aspeed_hace_ops, s,
-            TYPE_ASPEED_HACE, 0x1000);
+                          TYPE_ASPEED_HACE, ahc->nr_regs << 2);
 
     if (!s->dram_mr) {
         error_setg(errp, TYPE_ASPEED_HACE ": 'dram' link not set");
@@ -548,17 +537,25 @@ static const VMStateDescription vmstate_aspeed_hace = {
     .version_id = 2,
     .minimum_version_id = 2,
     .fields = (const VMStateField[]) {
-        VMSTATE_UINT32_ARRAY(regs, AspeedHACEState, ASPEED_HACE_NR_REGS),
         VMSTATE_UINT32(total_req_len, AspeedHACEState),
         VMSTATE_END_OF_LIST(),
     }
 };
 
+static void aspeed_hace_unrealize(DeviceState *dev)
+{
+    AspeedHACEState *s = ASPEED_HACE(dev);
+
+    g_free(s->regs);
+    s->regs = NULL;
+}
+
 static void aspeed_hace_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
     dc->realize = aspeed_hace_realize;
+    dc->unrealize = aspeed_hace_unrealize;
     device_class_set_legacy_reset(dc, aspeed_hace_reset);
     device_class_set_props(dc, aspeed_hace_properties);
     dc->vmsd = &vmstate_aspeed_hace;
@@ -579,6 +576,7 @@ static void aspeed_ast2400_hace_class_init(ObjectClass *klass, const void *data)
 
     dc->desc = "AST2400 Hash and Crypto Engine";
 
+    ahc->nr_regs = 0x64 >> 2;
     ahc->src_mask = 0x0FFFFFFF;
     ahc->dest_mask = 0x0FFFFFF8;
     ahc->key_mask = 0x0FFFFFC0;
@@ -598,6 +596,7 @@ static void aspeed_ast2500_hace_class_init(ObjectClass *klass, const void *data)
 
     dc->desc = "AST2500 Hash and Crypto Engine";
 
+    ahc->nr_regs = 0x64 >> 2;
     ahc->src_mask = 0x3fffffff;
     ahc->dest_mask = 0x3ffffff8;
     ahc->key_mask = 0x3FFFFFC0;
@@ -617,6 +616,7 @@ static void aspeed_ast2600_hace_class_init(ObjectClass *klass, const void *data)
 
     dc->desc = "AST2600 Hash and Crypto Engine";
 
+    ahc->nr_regs = 0x64 >> 2;
     ahc->src_mask = 0x7FFFFFFF;
     ahc->dest_mask = 0x7FFFFFF8;
     ahc->key_mask = 0x7FFFFFF8;
@@ -636,6 +636,7 @@ static void aspeed_ast1030_hace_class_init(ObjectClass *klass, const void *data)
 
     dc->desc = "AST1030 Hash and Crypto Engine";
 
+    ahc->nr_regs = 0x64 >> 2;
     ahc->src_mask = 0x7FFFFFFF;
     ahc->dest_mask = 0x7FFFFFF8;
     ahc->key_mask = 0x7FFFFFF8;
@@ -655,6 +656,7 @@ static void aspeed_ast2700_hace_class_init(ObjectClass *klass, const void *data)
 
     dc->desc = "AST2700 Hash and Crypto Engine";
 
+    ahc->nr_regs = 0x64 >> 2;
     ahc->src_mask = 0x7FFFFFFF;
     ahc->dest_mask = 0x7FFFFFF8;
     ahc->key_mask = 0x7FFFFFF8;
diff --git a/include/hw/misc/aspeed_hace.h b/include/hw/misc/aspeed_hace.h
index b69a038d35..f30d606559 100644
--- a/include/hw/misc/aspeed_hace.h
+++ b/include/hw/misc/aspeed_hace.h
@@ -22,7 +22,6 @@
 
 OBJECT_DECLARE_TYPE(AspeedHACEState, AspeedHACEClass, ASPEED_HACE)
 
-#define ASPEED_HACE_NR_REGS (0x64 >> 2)
 #define ASPEED_HACE_MAX_SG  256 /* max number of entries */
 
 struct AspeedHACEState {
@@ -31,7 +30,7 @@ struct AspeedHACEState {
     MemoryRegion iomem;
     qemu_irq irq;
 
-    uint32_t regs[ASPEED_HACE_NR_REGS];
+    uint32_t *regs;
     uint32_t total_req_len;
 
     MemoryRegion *dram_mr;
@@ -44,10 +43,12 @@ struct AspeedHACEState {
 struct AspeedHACEClass {
     SysBusDeviceClass parent_class;
 
+    const MemoryRegionOps *reg_ops;
     uint32_t src_mask;
     uint32_t dest_mask;
     uint32_t key_mask;
     uint32_t hash_mask;
+    uint64_t nr_regs;
     bool raise_crypt_interrupt_workaround;
 };
 

From 6262c8addc8ed586dfa5f11606f1598fca45b3eb Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Thu, 15 May 2025 16:09:45 +0800
Subject: [PATCH 1135/2760] hw/misc/aspeed_hace: Add support for source,
 digest, key buffer 64 bit addresses
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

According to the AST2700 design, the data source address is 64-bit, with
R_HASH_SRC_HI storing bits [63:32] and R_HASH_SRC storing bits [31:0].
Similarly, the digest address is 64-bit, with R_HASH_DIGEST_HI storing bits
[63:32] and R_HASH_DIGEST storing bits [31:0]. The HMAC key buffer address is also
64-bit, with R_HASH_KEY_BUFF_HI storing bits [63:32] and R_HASH_KEY_BUFF storing
bits [31:0].

The AST2700 supports a maximum DRAM size of 8 GB, with a DRAM addressable range
from 0x0_0000_0000 to 0x1_FFFF_FFFF. Since this range fits within 34 bits, only
bits [33:0] are needed to store the DRAM offset. To optimize address storage,
the high physical address bits [1:0] of the source, digest and key buffer
addresses are stored as dram_offset bits [33:32].

To achieve this, a src_hi_mask with a mask value of 0x3 is introduced, ensuring
that src_addr_hi consists of bits [1:0]. The final src_addr is computed as
(src_addr_hi[1:0] << 32) | src_addr[31:0], representing the DRAM offset within
bits [33:0].

Similarly, a dest_hi_mask with a mask value of 0x3 is introduced to ensure that
dest_addr_hi consists of bits [1:0]. The final dest_addr is calculated as
(dest_addr_hi[1:0] << 32) | dest_addr[31:0], representing the DRAM offset within
bits [33:0].

Additionally, a key_hi_mask with a mask value of 0x3 is introduced to ensure
that key_buf_addr_hi consists of bits [1:0]. The final key_buf_addr is
determined as (key_buf_addr_hi[1:0] << 32) | key_buf_addr[31:0], representing
the DRAM offset within bits [33:0].

This approach eliminates the need to reduce the high part of the DRAM physical
address for DMA operations. Previously, this was calculated as
(high physical address bits [7:0] - 4), since the DRAM start address is
0x4_00000000, making the high part address [7:0] - 4.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250515081008.583578-14-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/misc/aspeed_hace.c         | 31 ++++++++++++++++++++++++++++++-
 include/hw/misc/aspeed_hace.h |  3 +++
 2 files changed, 33 insertions(+), 1 deletion(-)

diff --git a/hw/misc/aspeed_hace.c b/hw/misc/aspeed_hace.c
index fef63eb488..d58645cabd 100644
--- a/hw/misc/aspeed_hace.c
+++ b/hw/misc/aspeed_hace.c
@@ -30,6 +30,9 @@
 #define R_HASH_DIGEST   (0x24 / 4)
 #define R_HASH_KEY_BUFF (0x28 / 4)
 #define R_HASH_SRC_LEN  (0x2c / 4)
+#define R_HASH_SRC_HI       (0x90 / 4)
+#define R_HASH_DIGEST_HI    (0x94 / 4)
+#define R_HASH_KEY_BUFF_HI  (0x98 / 4)
 
 #define R_HASH_CMD      (0x30 / 4)
 /* Hash algorithm selection */
@@ -473,6 +476,15 @@ static void aspeed_hace_write(void *opaque, hwaddr addr, uint64_t data,
             }
         }
         break;
+    case R_HASH_SRC_HI:
+        data &= ahc->src_hi_mask;
+        break;
+    case R_HASH_DIGEST_HI:
+        data &= ahc->dest_hi_mask;
+        break;
+    case R_HASH_KEY_BUFF_HI:
+        data &= ahc->key_hi_mask;
+        break;
     default:
         break;
     }
@@ -656,12 +668,29 @@ static void aspeed_ast2700_hace_class_init(ObjectClass *klass, const void *data)
 
     dc->desc = "AST2700 Hash and Crypto Engine";
 
-    ahc->nr_regs = 0x64 >> 2;
+    ahc->nr_regs = 0x9C >> 2;
     ahc->src_mask = 0x7FFFFFFF;
     ahc->dest_mask = 0x7FFFFFF8;
     ahc->key_mask = 0x7FFFFFF8;
     ahc->hash_mask = 0x00147FFF;
 
+    /*
+     * The AST2700 supports a maximum DRAM size of 8 GB, with a DRAM
+     * addressable range from 0x0_0000_0000 to 0x1_FFFF_FFFF. Since this range
+     * fits within 34 bits, only bits [33:0] are needed to store the DRAM
+     * offset. To optimize address storage, the high physical address bits
+     * [1:0] of the source, digest and key buffer addresses are stored as
+     * dram_offset bits [33:32].
+     *
+     * This approach eliminates the need to reduce the high part of the DRAM
+     * physical address for DMA operations. Previously, this was calculated as
+     * (high physical address bits [7:0] - 4), since the DRAM start address is
+     * 0x4_00000000, making the high part address [7:0] - 4.
+     */
+    ahc->src_hi_mask = 0x00000003;
+    ahc->dest_hi_mask = 0x00000003;
+    ahc->key_hi_mask = 0x00000003;
+
     /*
      * Currently, it does not support the CRYPT command. Instead, it only
      * sends an interrupt to notify the firmware that the crypt command
diff --git a/include/hw/misc/aspeed_hace.h b/include/hw/misc/aspeed_hace.h
index f30d606559..9945b61863 100644
--- a/include/hw/misc/aspeed_hace.h
+++ b/include/hw/misc/aspeed_hace.h
@@ -50,6 +50,9 @@ struct AspeedHACEClass {
     uint32_t hash_mask;
     uint64_t nr_regs;
     bool raise_crypt_interrupt_workaround;
+    uint32_t src_hi_mask;
+    uint32_t dest_hi_mask;
+    uint32_t key_hi_mask;
 };
 
 #endif /* ASPEED_HACE_H */

From 7e65aa39b37cb189c4d0bc923d4d778bdd626f4b Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Thu, 15 May 2025 16:09:46 +0800
Subject: [PATCH 1136/2760] hw/misc/aspeed_hace: Support DMA 64 bits dram
 address
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

According to the AST2700 design, the data source address is 64-bit, with
R_HASH_SRC_HI storing bits [63:32] and R_HASH_SRC storing bits [31:0].

Similarly, the digest address is 64-bit, with R_HASH_DEST_HI storing bits
[63:32] and R_HASH_DEST storing bits [31:0].

To maintain compatibility with older SoCs such as the AST2600, the AST2700 HW
automatically set bit 34 of the 64-bit sg_addr. As a result, the firmware
only needs to provide a 32-bit sg_addr containing bits [31:0]. This is
sufficient for the AST2700, as it uses a DRAM offset rather than a DRAM
address.

Introduce a has_dma64 class attribute and set it to true for the AST2700.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250515081008.583578-15-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/misc/aspeed_hace.c         | 17 ++++++++++++++++-
 include/hw/misc/aspeed_hace.h |  1 +
 2 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/hw/misc/aspeed_hace.c b/hw/misc/aspeed_hace.c
index d58645cabd..764408716e 100644
--- a/hw/misc/aspeed_hace.c
+++ b/hw/misc/aspeed_hace.c
@@ -147,9 +147,13 @@ static bool has_padding(AspeedHACEState *s, struct iovec *iov,
 
 static uint64_t hash_get_source_addr(AspeedHACEState *s)
 {
+    AspeedHACEClass *ahc = ASPEED_HACE_GET_CLASS(s);
     uint64_t src_addr = 0;
 
     src_addr = deposit64(src_addr, 0, 32, s->regs[R_HASH_SRC]);
+    if (ahc->has_dma64) {
+        src_addr = deposit64(src_addr, 32, 32, s->regs[R_HASH_SRC_HI]);
+    }
 
     return src_addr;
 }
@@ -223,7 +227,13 @@ static int hash_prepare_sg_iov(AspeedHACEState *s, struct iovec *iov,
         sg_addr = address_space_ldl_le(&s->dram_as, src + SG_LIST_LEN_SIZE,
                                        MEMTXATTRS_UNSPECIFIED, NULL);
         sg_addr &= SG_LIST_ADDR_MASK;
-
+        /*
+         * To maintain compatibility with older SoCs such as the AST2600,
+         * the AST2700 HW automatically set bit 34 of the 64-bit sg_addr.
+         * As a result, the firmware only needs to provide a 32-bit sg_addr
+         * containing bits [31:0]. This is sufficient for the AST2700, as
+         * it uses a DRAM offset rather than a DRAM address.
+         */
         plen = len & SG_LIST_LEN_MASK;
         haddr = address_space_map(&s->dram_as, sg_addr, &plen, false,
                                   MEMTXATTRS_UNSPECIFIED);
@@ -260,9 +270,13 @@ static int hash_prepare_sg_iov(AspeedHACEState *s, struct iovec *iov,
 
 static uint64_t hash_get_digest_addr(AspeedHACEState *s)
 {
+    AspeedHACEClass *ahc = ASPEED_HACE_GET_CLASS(s);
     uint64_t digest_addr = 0;
 
     digest_addr = deposit64(digest_addr, 0, 32, s->regs[R_HASH_DIGEST]);
+    if (ahc->has_dma64) {
+        digest_addr = deposit64(digest_addr, 32, 32, s->regs[R_HASH_DIGEST_HI]);
+    }
 
     return digest_addr;
 }
@@ -697,6 +711,7 @@ static void aspeed_ast2700_hace_class_init(ObjectClass *klass, const void *data)
      * has completed. It is a temporary workaround.
      */
     ahc->raise_crypt_interrupt_workaround = true;
+    ahc->has_dma64 = true;
 }
 
 static const TypeInfo aspeed_ast2700_hace_info = {
diff --git a/include/hw/misc/aspeed_hace.h b/include/hw/misc/aspeed_hace.h
index 9945b61863..d5d07c6c02 100644
--- a/include/hw/misc/aspeed_hace.h
+++ b/include/hw/misc/aspeed_hace.h
@@ -53,6 +53,7 @@ struct AspeedHACEClass {
     uint32_t src_hi_mask;
     uint32_t dest_hi_mask;
     uint32_t key_hi_mask;
+    bool has_dma64;
 };
 
 #endif /* ASPEED_HACE_H */

From 555167a8fde2bf6c27d0df035324743ed5bfbb0d Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Thu, 15 May 2025 16:09:47 +0800
Subject: [PATCH 1137/2760] hw/misc/aspeed_hace: Add trace-events for better
 debugging
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Introduced "trace_aspeed_hace_hash_addr", "trace_aspeed_hace_hash_sg",
"trace_aspeed_hace_read", "trace_aspeed_hace_hash_execute_acc_mode",
and "trace_aspeed_hace_write" trace events.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250515081008.583578-16-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/misc/aspeed_hace.c | 10 ++++++++++
 hw/misc/trace-events  |  7 +++++++
 2 files changed, 17 insertions(+)

diff --git a/hw/misc/aspeed_hace.c b/hw/misc/aspeed_hace.c
index 764408716e..ee1d9ab58f 100644
--- a/hw/misc/aspeed_hace.c
+++ b/hw/misc/aspeed_hace.c
@@ -18,6 +18,7 @@
 #include "crypto/hash.h"
 #include "hw/qdev-properties.h"
 #include "hw/irq.h"
+#include "trace.h"
 
 #define R_CRYPT_CMD     (0x10 / 4)
 
@@ -170,6 +171,7 @@ static int hash_prepare_direct_iov(AspeedHACEState *s, struct iovec *iov,
 
     plen = s->regs[R_HASH_SRC_LEN];
     src = hash_get_source_addr(s);
+    trace_aspeed_hace_hash_addr("src", src);
     haddr = address_space_map(&s->dram_as, src, &plen, false,
                               MEMTXATTRS_UNSPECIFIED);
     if (haddr == NULL) {
@@ -227,6 +229,7 @@ static int hash_prepare_sg_iov(AspeedHACEState *s, struct iovec *iov,
         sg_addr = address_space_ldl_le(&s->dram_as, src + SG_LIST_LEN_SIZE,
                                        MEMTXATTRS_UNSPECIFIED, NULL);
         sg_addr &= SG_LIST_ADDR_MASK;
+        trace_aspeed_hace_hash_sg(iov_idx, src, sg_addr, len);
         /*
          * To maintain compatibility with older SoCs such as the AST2600,
          * the AST2700 HW automatically set bit 34 of the 64-bit sg_addr.
@@ -290,6 +293,7 @@ static void hash_write_digest_and_unmap_iov(AspeedHACEState *s,
     uint64_t digest_addr = 0;
 
     digest_addr = hash_get_digest_addr(s);
+    trace_aspeed_hace_hash_addr("digest", digest_addr);
     if (address_space_write(&s->dram_as, digest_addr,
                             MEMTXATTRS_UNSPECIFIED,
                             digest_buf, digest_len)) {
@@ -332,6 +336,8 @@ static void hash_execute_acc_mode(AspeedHACEState *s, int algo,
     Error *local_err = NULL;
     size_t digest_len = 0;
 
+    trace_aspeed_hace_hash_execute_acc_mode(final_request);
+
     if (s->hash_ctx == NULL) {
         s->hash_ctx = qcrypto_hash_new(algo, &local_err);
         if (s->hash_ctx == NULL) {
@@ -403,6 +409,8 @@ static uint64_t aspeed_hace_read(void *opaque, hwaddr addr, unsigned int size)
 
     addr >>= 2;
 
+    trace_aspeed_hace_read(addr << 2, s->regs[addr]);
+
     return s->regs[addr];
 }
 
@@ -414,6 +422,8 @@ static void aspeed_hace_write(void *opaque, hwaddr addr, uint64_t data,
 
     addr >>= 2;
 
+    trace_aspeed_hace_write(addr << 2, data);
+
     switch (addr) {
     case R_STATUS:
         if (data & HASH_IRQ) {
diff --git a/hw/misc/trace-events b/hw/misc/trace-events
index 4383808d7a..b980d7fdd3 100644
--- a/hw/misc/trace-events
+++ b/hw/misc/trace-events
@@ -302,6 +302,13 @@ aspeed_peci_read(uint64_t offset, uint64_t data) "offset 0x%" PRIx64 " data 0x%"
 aspeed_peci_write(uint64_t offset, uint64_t data) "offset 0x%" PRIx64 " data 0x%" PRIx64
 aspeed_peci_raise_interrupt(uint32_t ctrl, uint32_t status) "ctrl 0x%" PRIx32 " status 0x%" PRIx32
 
+# aspeed_hace.c
+aspeed_hace_read(uint64_t offset, uint64_t data) "offset 0x%" PRIx64 " data 0x%" PRIx64
+aspeed_hace_write(uint64_t offset, uint64_t data) "offset 0x%" PRIx64 " data 0x%" PRIx64
+aspeed_hace_hash_sg(int index, uint64_t list_addr, uint64_t buf_addr, uint32_t len) "%d: list_addr 0x%" PRIx64 " buf_addr 0x%" PRIx64 " len 0x%" PRIx32
+aspeed_hace_hash_addr(const char *s, uint64_t addr) "%s: 0x%" PRIx64
+aspeed_hace_hash_execute_acc_mode(bool final_request) "final request: %d"
+
 # bcm2835_property.c
 bcm2835_mbox_property(uint32_t tag, uint32_t bufsize, size_t resplen) "mbox property tag:0x%08x in_sz:%u out_sz:%zu"
 

From 22370d29e83753e4072457541ab59189edcd3947 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Thu, 15 May 2025 16:09:48 +0800
Subject: [PATCH 1138/2760] hw/misc/aspeed_hace: Support to dump plaintext and
 digest for better debugging
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

1. Added "hace_hexdump()" to dump a contiguous buffer using qemu_hexdump.
2. Added "hace_iov_hexdump()" to flatten and dump scatter-gather source vectors.
3. Introduced a new trace event: "aspeed_hace_hexdump".

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250515081008.583578-17-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/misc/aspeed_hace.c | 46 +++++++++++++++++++++++++++++++++++++++++++
 hw/misc/trace-events  |  1 +
 2 files changed, 47 insertions(+)

diff --git a/hw/misc/aspeed_hace.c b/hw/misc/aspeed_hace.c
index ee1d9ab58f..8924a30eff 100644
--- a/hw/misc/aspeed_hace.c
+++ b/hw/misc/aspeed_hace.c
@@ -10,8 +10,10 @@
  */
 
 #include "qemu/osdep.h"
+#include "qemu/cutils.h"
 #include "qemu/log.h"
 #include "qemu/error-report.h"
+#include "qemu/iov.h"
 #include "hw/misc/aspeed_hace.h"
 #include "qapi/error.h"
 #include "migration/vmstate.h"
@@ -88,6 +90,42 @@ static const struct {
       QCRYPTO_HASH_ALGO_SHA256 },
 };
 
+static void hace_hexdump(const char *desc, const char *buf, size_t size)
+{
+    g_autoptr(GString) str = g_string_sized_new(64);
+    size_t len;
+    size_t i;
+
+    for (i = 0; i < size; i += len) {
+        len = MIN(16, size - i);
+        g_string_truncate(str, 0);
+        qemu_hexdump_line(str, buf + i, len, 1, 4);
+        trace_aspeed_hace_hexdump(desc, i, str->str);
+    }
+}
+
+static void hace_iov_hexdump(const char *desc, const struct iovec *iov,
+                             const unsigned int iov_cnt)
+{
+    size_t size = 0;
+    char *buf;
+    int i;
+
+    for (i = 0; i < iov_cnt; i++) {
+        size += iov[i].iov_len;
+    }
+
+    buf = g_malloc(size);
+
+    if (!buf) {
+        return;
+    }
+
+    iov_to_buf(iov, iov_cnt, 0, buf, size);
+    hace_hexdump(desc, buf, size);
+    g_free(buf);
+}
+
 static int hash_algo_lookup(uint32_t reg)
 {
     int i;
@@ -302,6 +340,10 @@ static void hash_write_digest_and_unmap_iov(AspeedHACEState *s,
                       __func__, digest_addr);
     }
 
+    if (trace_event_get_state_backends(TRACE_ASPEED_HACE_HEXDUMP)) {
+        hace_hexdump("digest", (char *)digest_buf, digest_len);
+    }
+
     for (; iov_idx > 0; iov_idx--) {
         address_space_unmap(&s->dram_as, iov[iov_idx - 1].iov_base,
                             iov[iov_idx - 1].iov_len, false,
@@ -395,6 +437,10 @@ static void do_hash_operation(AspeedHACEState *s, int algo, bool sg_mode,
          return;
     }
 
+    if (trace_event_get_state_backends(TRACE_ASPEED_HACE_HEXDUMP)) {
+        hace_iov_hexdump("plaintext", iov, iov_idx);
+    }
+
     /* Executes the hash operation */
     if (acc_mode) {
         hash_execute_acc_mode(s, algo, iov, iov_idx, acc_final_request);
diff --git a/hw/misc/trace-events b/hw/misc/trace-events
index b980d7fdd3..e3f64c0ff6 100644
--- a/hw/misc/trace-events
+++ b/hw/misc/trace-events
@@ -308,6 +308,7 @@ aspeed_hace_write(uint64_t offset, uint64_t data) "offset 0x%" PRIx64 " data 0x%
 aspeed_hace_hash_sg(int index, uint64_t list_addr, uint64_t buf_addr, uint32_t len) "%d: list_addr 0x%" PRIx64 " buf_addr 0x%" PRIx64 " len 0x%" PRIx32
 aspeed_hace_hash_addr(const char *s, uint64_t addr) "%s: 0x%" PRIx64
 aspeed_hace_hash_execute_acc_mode(bool final_request) "final request: %d"
+aspeed_hace_hexdump(const char *desc, uint32_t offset, char *s) "%s: 0x%08x: %s"
 
 # bcm2835_property.c
 bcm2835_mbox_property(uint32_t tag, uint32_t bufsize, size_t resplen) "mbox property tag:0x%08x in_sz:%u out_sz:%zu"

From 408326af1f05776eae0f4fc91dcf643b54f9240c Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Thu, 15 May 2025 16:09:49 +0800
Subject: [PATCH 1139/2760] tests/qtest: Reorder aspeed test list
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reordered the aspeed test list to keep the alphabetical order.
No functional changes in test behavior.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Acked-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/qemu-devel/20250515081008.583578-18-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 tests/qtest/meson.build | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
index 7daf619845..c3a24a3eb4 100644
--- a/tests/qtest/meson.build
+++ b/tests/qtest/meson.build
@@ -212,9 +212,9 @@ qtests_npcm7xx = \
    'npcm_gmac-test'] + \
    (slirp.found() ? ['npcm7xx_emc-test'] : [])
 qtests_aspeed = \
-  ['aspeed_hace-test',
-   'aspeed_smc-test',
-   'aspeed_gpio-test']
+  ['aspeed_gpio-test',
+   'aspeed_hace-test',
+   'aspeed_smc-test']
 qtests_aspeed64 = \
   ['ast2700-gpio-test',
    'ast2700-smc-test']
@@ -361,6 +361,8 @@ if gnutls.found()
 endif
 
 qtests = {
+  'aspeed_smc-test': files('aspeed-smc-utils.c', 'aspeed_smc-test.c'),
+  'ast2700-smc-test': files('aspeed-smc-utils.c', 'ast2700-smc-test.c'),
   'bios-tables-test': [io, 'boot-sector.c', 'acpi-utils.c', 'tpm-emu.c'],
   'cdrom-test': files('boot-sector.c'),
   'dbus-vmstate-test': files('migration/migration-qmp.c',
@@ -382,8 +384,6 @@ qtests = {
   'virtio-net-failover': migration_files,
   'vmgenid-test': files('boot-sector.c', 'acpi-utils.c'),
   'netdev-socket': files('netdev-socket.c', '../unit/socket-helpers.c'),
-  'aspeed_smc-test': files('aspeed-smc-utils.c', 'aspeed_smc-test.c'),
-  'ast2700-smc-test': files('aspeed-smc-utils.c', 'ast2700-smc-test.c'),
 }
 
 if vnc.found()

From 70985b0ea776e0cd7d7ab2a173d9d35d31e8c21f Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Thu, 15 May 2025 16:09:50 +0800
Subject: [PATCH 1140/2760] test/qtest: Introduce a new aspeed-hace-utils.c to
 place common testcases
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The test cases for the ASPEED HACE model were originally placed in
aspeed_hace-test.c. However, this test file only supports ARM32. To enable
compatibility with all ASPEED SoCs, including the AST2700, which uses the
AArch64 architecture, this update introduces a new source file,
aspeed-hace-utils.c.

All common APIs and test cases have been moved from aspeed_hace-test.c to
aspeed-hace-utils.c to facilitate reuse across different ASPEED SoCs.
As a result, these test cases can now be reused for AST2700 and future ASPEED
SoC testing.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Acked-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/qemu-devel/20250515081008.583578-19-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 tests/qtest/aspeed-hace-utils.c | 455 ++++++++++++++++++++++++++++
 tests/qtest/aspeed-hace-utils.h |  71 +++++
 tests/qtest/aspeed_hace-test.c  | 515 ++------------------------------
 tests/qtest/meson.build         |   1 +
 4 files changed, 547 insertions(+), 495 deletions(-)
 create mode 100644 tests/qtest/aspeed-hace-utils.c
 create mode 100644 tests/qtest/aspeed-hace-utils.h

diff --git a/tests/qtest/aspeed-hace-utils.c b/tests/qtest/aspeed-hace-utils.c
new file mode 100644
index 0000000000..8582847945
--- /dev/null
+++ b/tests/qtest/aspeed-hace-utils.c
@@ -0,0 +1,455 @@
+/*
+ * QTest testcase for the ASPEED Hash and Crypto Engine
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ * Copyright 2021 IBM Corp.
+ */
+
+#include "qemu/osdep.h"
+#include "libqtest.h"
+#include "qemu/bitops.h"
+#include "aspeed-hace-utils.h"
+
+/*
+ * Test vector is the ascii "abc"
+ *
+ * Expected results were generated using command line utitiles:
+ *
+ *  echo -n -e 'abc' | dd of=/tmp/test
+ *  for hash in sha512sum sha256sum md5sum; do $hash /tmp/test; done
+ *
+ */
+static const uint8_t test_vector[] = {0x61, 0x62, 0x63};
+
+static const uint8_t test_result_sha512[] = {
+    0xdd, 0xaf, 0x35, 0xa1, 0x93, 0x61, 0x7a, 0xba, 0xcc, 0x41, 0x73, 0x49,
+    0xae, 0x20, 0x41, 0x31, 0x12, 0xe6, 0xfa, 0x4e, 0x89, 0xa9, 0x7e, 0xa2,
+    0x0a, 0x9e, 0xee, 0xe6, 0x4b, 0x55, 0xd3, 0x9a, 0x21, 0x92, 0x99, 0x2a,
+    0x27, 0x4f, 0xc1, 0xa8, 0x36, 0xba, 0x3c, 0x23, 0xa3, 0xfe, 0xeb, 0xbd,
+    0x45, 0x4d, 0x44, 0x23, 0x64, 0x3c, 0xe8, 0x0e, 0x2a, 0x9a, 0xc9, 0x4f,
+    0xa5, 0x4c, 0xa4, 0x9f};
+
+static const uint8_t test_result_sha256[] = {
+    0xba, 0x78, 0x16, 0xbf, 0x8f, 0x01, 0xcf, 0xea, 0x41, 0x41, 0x40, 0xde,
+    0x5d, 0xae, 0x22, 0x23, 0xb0, 0x03, 0x61, 0xa3, 0x96, 0x17, 0x7a, 0x9c,
+    0xb4, 0x10, 0xff, 0x61, 0xf2, 0x00, 0x15, 0xad};
+
+static const uint8_t test_result_md5[] = {
+    0x90, 0x01, 0x50, 0x98, 0x3c, 0xd2, 0x4f, 0xb0, 0xd6, 0x96, 0x3f, 0x7d,
+    0x28, 0xe1, 0x7f, 0x72};
+
+/*
+ * The Scatter-Gather Test vector is the ascii "abc" "def" "ghi", broken
+ * into blocks of 3 characters as shown
+ *
+ * Expected results were generated using command line utitiles:
+ *
+ *  echo -n -e 'abcdefghijkl' | dd of=/tmp/test
+ *  for hash in sha512sum sha256sum; do $hash /tmp/test; done
+ *
+ */
+static const uint8_t test_vector_sg1[] = {0x61, 0x62, 0x63, 0x64, 0x65, 0x66};
+static const uint8_t test_vector_sg2[] = {0x67, 0x68, 0x69};
+static const uint8_t test_vector_sg3[] = {0x6a, 0x6b, 0x6c};
+
+static const uint8_t test_result_sg_sha512[] = {
+    0x17, 0x80, 0x7c, 0x72, 0x8e, 0xe3, 0xba, 0x35, 0xe7, 0xcf, 0x7a, 0xf8,
+    0x23, 0x11, 0x6d, 0x26, 0xe4, 0x1e, 0x5d, 0x4d, 0x6c, 0x2f, 0xf1, 0xf3,
+    0x72, 0x0d, 0x3d, 0x96, 0xaa, 0xcb, 0x6f, 0x69, 0xde, 0x64, 0x2e, 0x63,
+    0xd5, 0xb7, 0x3f, 0xc3, 0x96, 0xc1, 0x2b, 0xe3, 0x8b, 0x2b, 0xd5, 0xd8,
+    0x84, 0x25, 0x7c, 0x32, 0xc8, 0xf6, 0xd0, 0x85, 0x4a, 0xe6, 0xb5, 0x40,
+    0xf8, 0x6d, 0xda, 0x2e};
+
+static const uint8_t test_result_sg_sha256[] = {
+    0xd6, 0x82, 0xed, 0x4c, 0xa4, 0xd9, 0x89, 0xc1, 0x34, 0xec, 0x94, 0xf1,
+    0x55, 0x1e, 0x1e, 0xc5, 0x80, 0xdd, 0x6d, 0x5a, 0x6e, 0xcd, 0xe9, 0xf3,
+    0xd3, 0x5e, 0x6e, 0x4a, 0x71, 0x7f, 0xbd, 0xe4};
+
+/*
+ * The accumulative mode requires firmware to provide internal initial state
+ * and message padding (including length L at the end of padding).
+ *
+ * This test vector is a ascii text "abc" with padding message.
+ *
+ * Expected results were generated using command line utitiles:
+ *
+ *  echo -n -e 'abc' | dd of=/tmp/test
+ *  for hash in sha512sum sha256sum; do $hash /tmp/test; done
+ */
+static const uint8_t test_vector_accum_512[] = {
+    0x61, 0x62, 0x63, 0x80, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x18};
+
+static const uint8_t test_vector_accum_256[] = {
+    0x61, 0x62, 0x63, 0x80, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x18};
+
+static const uint8_t test_result_accum_sha512[] = {
+    0xdd, 0xaf, 0x35, 0xa1, 0x93, 0x61, 0x7a, 0xba, 0xcc, 0x41, 0x73, 0x49,
+    0xae, 0x20, 0x41, 0x31, 0x12, 0xe6, 0xfa, 0x4e, 0x89, 0xa9, 0x7e, 0xa2,
+    0x0a, 0x9e, 0xee, 0xe6, 0x4b, 0x55, 0xd3, 0x9a, 0x21, 0x92, 0x99, 0x2a,
+    0x27, 0x4f, 0xc1, 0xa8, 0x36, 0xba, 0x3c, 0x23, 0xa3, 0xfe, 0xeb, 0xbd,
+    0x45, 0x4d, 0x44, 0x23, 0x64, 0x3c, 0xe8, 0x0e, 0x2a, 0x9a, 0xc9, 0x4f,
+    0xa5, 0x4c, 0xa4, 0x9f};
+
+static const uint8_t test_result_accum_sha256[] = {
+    0xba, 0x78, 0x16, 0xbf, 0x8f, 0x01, 0xcf, 0xea, 0x41, 0x41, 0x40, 0xde,
+    0x5d, 0xae, 0x22, 0x23, 0xb0, 0x03, 0x61, 0xa3, 0x96, 0x17, 0x7a, 0x9c,
+    0xb4, 0x10, 0xff, 0x61, 0xf2, 0x00, 0x15, 0xad};
+
+static void write_regs(QTestState *s, uint32_t base, uint32_t src,
+                       uint32_t length, uint32_t out, uint32_t method)
+{
+        qtest_writel(s, base + HACE_HASH_SRC, src);
+        qtest_writel(s, base + HACE_HASH_DIGEST, out);
+        qtest_writel(s, base + HACE_HASH_DATA_LEN, length);
+        qtest_writel(s, base + HACE_HASH_CMD, HACE_SHA_BE_EN | method);
+}
+
+void aspeed_test_md5(const char *machine, const uint32_t base,
+                     const uint32_t src_addr)
+
+{
+    QTestState *s = qtest_init(machine);
+
+    uint32_t digest_addr = src_addr + 0x01000000;
+    uint8_t digest[16] = {0};
+
+    /* Check engine is idle, no busy or irq bits set */
+    g_assert_cmphex(qtest_readl(s, base + HACE_STS), ==, 0);
+
+    /* Write test vector into memory */
+    qtest_memwrite(s, src_addr, test_vector, sizeof(test_vector));
+
+    write_regs(s, base, src_addr, sizeof(test_vector),
+               digest_addr, HACE_ALGO_MD5);
+
+    /* Check hash IRQ status is asserted */
+    g_assert_cmphex(qtest_readl(s, base + HACE_STS), ==, 0x00000200);
+
+    /* Clear IRQ status and check status is deasserted */
+    qtest_writel(s, base + HACE_STS, 0x00000200);
+    g_assert_cmphex(qtest_readl(s, base + HACE_STS), ==, 0);
+
+    /* Read computed digest from memory */
+    qtest_memread(s, digest_addr, digest, sizeof(digest));
+
+    /* Check result of computation */
+    g_assert_cmpmem(digest, sizeof(digest),
+                    test_result_md5, sizeof(digest));
+
+    qtest_quit(s);
+}
+
+void aspeed_test_sha256(const char *machine, const uint32_t base,
+                        const uint32_t src_addr)
+{
+    QTestState *s = qtest_init(machine);
+
+    const uint32_t digest_addr = src_addr + 0x1000000;
+    uint8_t digest[32] = {0};
+
+    /* Check engine is idle, no busy or irq bits set */
+    g_assert_cmphex(qtest_readl(s, base + HACE_STS), ==, 0);
+
+    /* Write test vector into memory */
+    qtest_memwrite(s, src_addr, test_vector, sizeof(test_vector));
+
+    write_regs(s, base, src_addr, sizeof(test_vector), digest_addr,
+               HACE_ALGO_SHA256);
+
+    /* Check hash IRQ status is asserted */
+    g_assert_cmphex(qtest_readl(s, base + HACE_STS), ==, 0x00000200);
+
+    /* Clear IRQ status and check status is deasserted */
+    qtest_writel(s, base + HACE_STS, 0x00000200);
+    g_assert_cmphex(qtest_readl(s, base + HACE_STS), ==, 0);
+
+    /* Read computed digest from memory */
+    qtest_memread(s, digest_addr, digest, sizeof(digest));
+
+    /* Check result of computation */
+    g_assert_cmpmem(digest, sizeof(digest),
+                    test_result_sha256, sizeof(digest));
+
+    qtest_quit(s);
+}
+
+void aspeed_test_sha512(const char *machine, const uint32_t base,
+                        const uint32_t src_addr)
+{
+    QTestState *s = qtest_init(machine);
+
+    const uint32_t digest_addr = src_addr + 0x1000000;
+    uint8_t digest[64] = {0};
+
+    /* Check engine is idle, no busy or irq bits set */
+    g_assert_cmphex(qtest_readl(s, base + HACE_STS), ==, 0);
+
+    /* Write test vector into memory */
+    qtest_memwrite(s, src_addr, test_vector, sizeof(test_vector));
+
+    write_regs(s, base, src_addr, sizeof(test_vector), digest_addr,
+               HACE_ALGO_SHA512);
+
+    /* Check hash IRQ status is asserted */
+    g_assert_cmphex(qtest_readl(s, base + HACE_STS), ==, 0x00000200);
+
+    /* Clear IRQ status and check status is deasserted */
+    qtest_writel(s, base + HACE_STS, 0x00000200);
+    g_assert_cmphex(qtest_readl(s, base + HACE_STS), ==, 0);
+
+    /* Read computed digest from memory */
+    qtest_memread(s, digest_addr, digest, sizeof(digest));
+
+    /* Check result of computation */
+    g_assert_cmpmem(digest, sizeof(digest),
+                    test_result_sha512, sizeof(digest));
+
+    qtest_quit(s);
+}
+
+void aspeed_test_sha256_sg(const char *machine, const uint32_t base,
+                           const uint32_t src_addr)
+{
+    QTestState *s = qtest_init(machine);
+
+    const uint32_t src_addr_1 = src_addr + 0x1000000;
+    const uint32_t src_addr_2 = src_addr + 0x2000000;
+    const uint32_t src_addr_3 = src_addr + 0x3000000;
+    const uint32_t digest_addr = src_addr + 0x4000000;
+    uint8_t digest[32] = {0};
+    struct AspeedSgList array[] = {
+        {  cpu_to_le32(sizeof(test_vector_sg1)),
+           cpu_to_le32(src_addr_1) },
+        {  cpu_to_le32(sizeof(test_vector_sg2)),
+           cpu_to_le32(src_addr_2) },
+        {  cpu_to_le32(sizeof(test_vector_sg3) | SG_LIST_LEN_LAST),
+           cpu_to_le32(src_addr_3) },
+    };
+
+    /* Check engine is idle, no busy or irq bits set */
+    g_assert_cmphex(qtest_readl(s, base + HACE_STS), ==, 0);
+
+    /* Write test vector into memory */
+    qtest_memwrite(s, src_addr_1, test_vector_sg1, sizeof(test_vector_sg1));
+    qtest_memwrite(s, src_addr_2, test_vector_sg2, sizeof(test_vector_sg2));
+    qtest_memwrite(s, src_addr_3, test_vector_sg3, sizeof(test_vector_sg3));
+    qtest_memwrite(s, src_addr, array, sizeof(array));
+
+    write_regs(s, base, src_addr,
+               (sizeof(test_vector_sg1)
+                + sizeof(test_vector_sg2)
+                + sizeof(test_vector_sg3)),
+               digest_addr, HACE_ALGO_SHA256 | HACE_SG_EN);
+
+    /* Check hash IRQ status is asserted */
+    g_assert_cmphex(qtest_readl(s, base + HACE_STS), ==, 0x00000200);
+
+    /* Clear IRQ status and check status is deasserted */
+    qtest_writel(s, base + HACE_STS, 0x00000200);
+    g_assert_cmphex(qtest_readl(s, base + HACE_STS), ==, 0);
+
+    /* Read computed digest from memory */
+    qtest_memread(s, digest_addr, digest, sizeof(digest));
+
+    /* Check result of computation */
+    g_assert_cmpmem(digest, sizeof(digest),
+                    test_result_sg_sha256, sizeof(digest));
+
+    qtest_quit(s);
+}
+
+void aspeed_test_sha512_sg(const char *machine, const uint32_t base,
+                           const uint32_t src_addr)
+{
+    QTestState *s = qtest_init(machine);
+
+    const uint32_t src_addr_1 = src_addr + 0x1000000;
+    const uint32_t src_addr_2 = src_addr + 0x2000000;
+    const uint32_t src_addr_3 = src_addr + 0x3000000;
+    const uint32_t digest_addr = src_addr + 0x4000000;
+    uint8_t digest[64] = {0};
+    struct AspeedSgList array[] = {
+        {  cpu_to_le32(sizeof(test_vector_sg1)),
+           cpu_to_le32(src_addr_1) },
+        {  cpu_to_le32(sizeof(test_vector_sg2)),
+           cpu_to_le32(src_addr_2) },
+        {  cpu_to_le32(sizeof(test_vector_sg3) | SG_LIST_LEN_LAST),
+           cpu_to_le32(src_addr_3) },
+    };
+
+    /* Check engine is idle, no busy or irq bits set */
+    g_assert_cmphex(qtest_readl(s, base + HACE_STS), ==, 0);
+
+    /* Write test vector into memory */
+    qtest_memwrite(s, src_addr_1, test_vector_sg1, sizeof(test_vector_sg1));
+    qtest_memwrite(s, src_addr_2, test_vector_sg2, sizeof(test_vector_sg2));
+    qtest_memwrite(s, src_addr_3, test_vector_sg3, sizeof(test_vector_sg3));
+    qtest_memwrite(s, src_addr, array, sizeof(array));
+
+    write_regs(s, base, src_addr,
+               (sizeof(test_vector_sg1)
+                + sizeof(test_vector_sg2)
+                + sizeof(test_vector_sg3)),
+               digest_addr, HACE_ALGO_SHA512 | HACE_SG_EN);
+
+    /* Check hash IRQ status is asserted */
+    g_assert_cmphex(qtest_readl(s, base + HACE_STS), ==, 0x00000200);
+
+    /* Clear IRQ status and check status is deasserted */
+    qtest_writel(s, base + HACE_STS, 0x00000200);
+    g_assert_cmphex(qtest_readl(s, base + HACE_STS), ==, 0);
+
+    /* Read computed digest from memory */
+    qtest_memread(s, digest_addr, digest, sizeof(digest));
+
+    /* Check result of computation */
+    g_assert_cmpmem(digest, sizeof(digest),
+                    test_result_sg_sha512, sizeof(digest));
+
+    qtest_quit(s);
+}
+
+void aspeed_test_sha256_accum(const char *machine, const uint32_t base,
+                              const uint32_t src_addr)
+{
+    QTestState *s = qtest_init(machine);
+
+    const uint32_t buffer_addr = src_addr + 0x1000000;
+    const uint32_t digest_addr = src_addr + 0x4000000;
+    uint8_t digest[32] = {0};
+    struct AspeedSgList array[] = {
+        {  cpu_to_le32(sizeof(test_vector_accum_256) | SG_LIST_LEN_LAST),
+           cpu_to_le32(buffer_addr) },
+    };
+
+    /* Check engine is idle, no busy or irq bits set */
+    g_assert_cmphex(qtest_readl(s, base + HACE_STS), ==, 0);
+
+    /* Write test vector into memory */
+    qtest_memwrite(s, buffer_addr, test_vector_accum_256,
+                   sizeof(test_vector_accum_256));
+    qtest_memwrite(s, src_addr, array, sizeof(array));
+
+    write_regs(s, base, src_addr, sizeof(test_vector_accum_256),
+               digest_addr, HACE_ALGO_SHA256 | HACE_SG_EN | HACE_ACCUM_EN);
+
+    /* Check hash IRQ status is asserted */
+    g_assert_cmphex(qtest_readl(s, base + HACE_STS), ==, 0x00000200);
+
+    /* Clear IRQ status and check status is deasserted */
+    qtest_writel(s, base + HACE_STS, 0x00000200);
+    g_assert_cmphex(qtest_readl(s, base + HACE_STS), ==, 0);
+
+    /* Read computed digest from memory */
+    qtest_memread(s, digest_addr, digest, sizeof(digest));
+
+    /* Check result of computation */
+    g_assert_cmpmem(digest, sizeof(digest),
+                    test_result_accum_sha256, sizeof(digest));
+
+    qtest_quit(s);
+}
+
+void aspeed_test_sha512_accum(const char *machine, const uint32_t base,
+                              const uint32_t src_addr)
+{
+    QTestState *s = qtest_init(machine);
+
+    const uint32_t buffer_addr = src_addr + 0x1000000;
+    const uint32_t digest_addr = src_addr + 0x4000000;
+    uint8_t digest[64] = {0};
+    struct AspeedSgList array[] = {
+        {  cpu_to_le32(sizeof(test_vector_accum_512) | SG_LIST_LEN_LAST),
+           cpu_to_le32(buffer_addr) },
+    };
+
+    /* Check engine is idle, no busy or irq bits set */
+    g_assert_cmphex(qtest_readl(s, base + HACE_STS), ==, 0);
+
+    /* Write test vector into memory */
+    qtest_memwrite(s, buffer_addr, test_vector_accum_512,
+                   sizeof(test_vector_accum_512));
+    qtest_memwrite(s, src_addr, array, sizeof(array));
+
+    write_regs(s, base, src_addr, sizeof(test_vector_accum_512),
+               digest_addr, HACE_ALGO_SHA512 | HACE_SG_EN | HACE_ACCUM_EN);
+
+    /* Check hash IRQ status is asserted */
+    g_assert_cmphex(qtest_readl(s, base + HACE_STS), ==, 0x00000200);
+
+    /* Clear IRQ status and check status is deasserted */
+    qtest_writel(s, base + HACE_STS, 0x00000200);
+    g_assert_cmphex(qtest_readl(s, base + HACE_STS), ==, 0);
+
+    /* Read computed digest from memory */
+    qtest_memread(s, digest_addr, digest, sizeof(digest));
+
+    /* Check result of computation */
+    g_assert_cmpmem(digest, sizeof(digest),
+                    test_result_accum_sha512, sizeof(digest));
+
+    qtest_quit(s);
+}
+
+void aspeed_test_addresses(const char *machine, const uint32_t base,
+                           const struct AspeedMasks *expected)
+{
+    QTestState *s = qtest_init(machine);
+
+    /*
+     * Check command mode is zero, meaning engine is in direct access mode,
+     * as this affects the masking behavior of the HASH_SRC register.
+     */
+    g_assert_cmphex(qtest_readl(s, base + HACE_CMD), ==, 0);
+    g_assert_cmphex(qtest_readl(s, base + HACE_HASH_SRC), ==, 0);
+    g_assert_cmphex(qtest_readl(s, base + HACE_HASH_DIGEST), ==, 0);
+    g_assert_cmphex(qtest_readl(s, base + HACE_HASH_DATA_LEN), ==, 0);
+
+
+    /* Check that the address masking is correct */
+    qtest_writel(s, base + HACE_HASH_SRC, 0xffffffff);
+    g_assert_cmphex(qtest_readl(s, base + HACE_HASH_SRC), ==, expected->src);
+
+    qtest_writel(s, base + HACE_HASH_DIGEST, 0xffffffff);
+    g_assert_cmphex(qtest_readl(s, base + HACE_HASH_DIGEST), ==,
+                    expected->dest);
+
+    qtest_writel(s, base + HACE_HASH_DATA_LEN, 0xffffffff);
+    g_assert_cmphex(qtest_readl(s, base + HACE_HASH_DATA_LEN), ==,
+                    expected->len);
+
+    /* Reset to zero */
+    qtest_writel(s, base + HACE_HASH_SRC, 0);
+    qtest_writel(s, base + HACE_HASH_DIGEST, 0);
+    qtest_writel(s, base + HACE_HASH_DATA_LEN, 0);
+
+    /* Check that all bits are now zero */
+    g_assert_cmphex(qtest_readl(s, base + HACE_HASH_SRC), ==, 0);
+    g_assert_cmphex(qtest_readl(s, base + HACE_HASH_DIGEST), ==, 0);
+    g_assert_cmphex(qtest_readl(s, base + HACE_HASH_DATA_LEN), ==, 0);
+
+    qtest_quit(s);
+}
+
diff --git a/tests/qtest/aspeed-hace-utils.h b/tests/qtest/aspeed-hace-utils.h
new file mode 100644
index 0000000000..598577c69b
--- /dev/null
+++ b/tests/qtest/aspeed-hace-utils.h
@@ -0,0 +1,71 @@
+/*
+ * QTest testcase for the ASPEED Hash and Crypto Engine
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ * Copyright 2021 IBM Corp.
+ */
+
+#ifndef TESTS_ASPEED_HACE_UTILS_H
+#define TESTS_ASPEED_HACE_UTILS_H
+
+#include "qemu/osdep.h"
+#include "libqtest.h"
+#include "qemu/bitops.h"
+
+#define HACE_CMD                 0x10
+#define  HACE_SHA_BE_EN          BIT(3)
+#define  HACE_MD5_LE_EN          BIT(2)
+#define  HACE_ALGO_MD5           0
+#define  HACE_ALGO_SHA1          BIT(5)
+#define  HACE_ALGO_SHA224        BIT(6)
+#define  HACE_ALGO_SHA256        (BIT(4) | BIT(6))
+#define  HACE_ALGO_SHA512        (BIT(5) | BIT(6))
+#define  HACE_ALGO_SHA384        (BIT(5) | BIT(6) | BIT(10))
+#define  HACE_SG_EN              BIT(18)
+#define  HACE_ACCUM_EN           BIT(8)
+
+#define HACE_STS                 0x1c
+#define  HACE_RSA_ISR            BIT(13)
+#define  HACE_CRYPTO_ISR         BIT(12)
+#define  HACE_HASH_ISR           BIT(9)
+#define  HACE_RSA_BUSY           BIT(2)
+#define  HACE_CRYPTO_BUSY        BIT(1)
+#define  HACE_HASH_BUSY          BIT(0)
+#define HACE_HASH_SRC            0x20
+#define HACE_HASH_DIGEST         0x24
+#define HACE_HASH_KEY_BUFF       0x28
+#define HACE_HASH_DATA_LEN       0x2c
+#define HACE_HASH_CMD            0x30
+
+/* Scatter-Gather Hash */
+#define SG_LIST_LEN_LAST         BIT(31)
+struct AspeedSgList {
+        uint32_t len;
+        uint32_t addr;
+} __attribute__ ((__packed__));
+
+struct AspeedMasks {
+    uint32_t src;
+    uint32_t dest;
+    uint32_t len;
+};
+
+void aspeed_test_md5(const char *machine, const uint32_t base,
+                     const uint32_t src_addr);
+void aspeed_test_sha256(const char *machine, const uint32_t base,
+                        const uint32_t src_addr);
+void aspeed_test_sha512(const char *machine, const uint32_t base,
+                        const uint32_t src_addr);
+void aspeed_test_sha256_sg(const char *machine, const uint32_t base,
+                           const uint32_t src_addr);
+void aspeed_test_sha512_sg(const char *machine, const uint32_t base,
+                           const uint32_t src_addr);
+void aspeed_test_sha256_accum(const char *machine, const uint32_t base,
+                              const uint32_t src_addr);
+void aspeed_test_sha512_accum(const char *machine, const uint32_t base,
+                              const uint32_t src_addr);
+void aspeed_test_addresses(const char *machine, const uint32_t base,
+                           const struct AspeedMasks *expected);
+
+#endif /* TESTS_ASPEED_HACE_UTILS_H */
+
diff --git a/tests/qtest/aspeed_hace-test.c b/tests/qtest/aspeed_hace-test.c
index ce86a44672..42a306af2a 100644
--- a/tests/qtest/aspeed_hace-test.c
+++ b/tests/qtest/aspeed_hace-test.c
@@ -6,584 +6,109 @@
  */
 
 #include "qemu/osdep.h"
-
 #include "libqtest.h"
 #include "qemu/bitops.h"
+#include "aspeed-hace-utils.h"
 
-#define HACE_CMD                 0x10
-#define  HACE_SHA_BE_EN          BIT(3)
-#define  HACE_MD5_LE_EN          BIT(2)
-#define  HACE_ALGO_MD5           0
-#define  HACE_ALGO_SHA1          BIT(5)
-#define  HACE_ALGO_SHA224        BIT(6)
-#define  HACE_ALGO_SHA256        (BIT(4) | BIT(6))
-#define  HACE_ALGO_SHA512        (BIT(5) | BIT(6))
-#define  HACE_ALGO_SHA384        (BIT(5) | BIT(6) | BIT(10))
-#define  HACE_SG_EN              BIT(18)
-#define  HACE_ACCUM_EN           BIT(8)
-
-#define HACE_STS                 0x1c
-#define  HACE_RSA_ISR            BIT(13)
-#define  HACE_CRYPTO_ISR         BIT(12)
-#define  HACE_HASH_ISR           BIT(9)
-#define  HACE_RSA_BUSY           BIT(2)
-#define  HACE_CRYPTO_BUSY        BIT(1)
-#define  HACE_HASH_BUSY          BIT(0)
-#define HACE_HASH_SRC            0x20
-#define HACE_HASH_DIGEST         0x24
-#define HACE_HASH_KEY_BUFF       0x28
-#define HACE_HASH_DATA_LEN       0x2c
-#define HACE_HASH_CMD            0x30
-/* Scatter-Gather Hash */
-#define SG_LIST_LEN_LAST         BIT(31)
-struct AspeedSgList {
-        uint32_t len;
-        uint32_t addr;
-} __attribute__ ((__packed__));
-
-/*
- * Test vector is the ascii "abc"
- *
- * Expected results were generated using command line utitiles:
- *
- *  echo -n -e 'abc' | dd of=/tmp/test
- *  for hash in sha512sum sha256sum md5sum; do $hash /tmp/test; done
- *
- */
-static const uint8_t test_vector[] = {0x61, 0x62, 0x63};
-
-static const uint8_t test_result_sha512[] = {
-    0xdd, 0xaf, 0x35, 0xa1, 0x93, 0x61, 0x7a, 0xba, 0xcc, 0x41, 0x73, 0x49,
-    0xae, 0x20, 0x41, 0x31, 0x12, 0xe6, 0xfa, 0x4e, 0x89, 0xa9, 0x7e, 0xa2,
-    0x0a, 0x9e, 0xee, 0xe6, 0x4b, 0x55, 0xd3, 0x9a, 0x21, 0x92, 0x99, 0x2a,
-    0x27, 0x4f, 0xc1, 0xa8, 0x36, 0xba, 0x3c, 0x23, 0xa3, 0xfe, 0xeb, 0xbd,
-    0x45, 0x4d, 0x44, 0x23, 0x64, 0x3c, 0xe8, 0x0e, 0x2a, 0x9a, 0xc9, 0x4f,
-    0xa5, 0x4c, 0xa4, 0x9f};
-
-static const uint8_t test_result_sha256[] = {
-    0xba, 0x78, 0x16, 0xbf, 0x8f, 0x01, 0xcf, 0xea, 0x41, 0x41, 0x40, 0xde,
-    0x5d, 0xae, 0x22, 0x23, 0xb0, 0x03, 0x61, 0xa3, 0x96, 0x17, 0x7a, 0x9c,
-    0xb4, 0x10, 0xff, 0x61, 0xf2, 0x00, 0x15, 0xad};
-
-static const uint8_t test_result_md5[] = {
-    0x90, 0x01, 0x50, 0x98, 0x3c, 0xd2, 0x4f, 0xb0, 0xd6, 0x96, 0x3f, 0x7d,
-    0x28, 0xe1, 0x7f, 0x72};
-
-/*
- * The Scatter-Gather Test vector is the ascii "abc" "def" "ghi", broken
- * into blocks of 3 characters as shown
- *
- * Expected results were generated using command line utitiles:
- *
- *  echo -n -e 'abcdefghijkl' | dd of=/tmp/test
- *  for hash in sha512sum sha256sum; do $hash /tmp/test; done
- *
- */
-static const uint8_t test_vector_sg1[] = {0x61, 0x62, 0x63, 0x64, 0x65, 0x66};
-static const uint8_t test_vector_sg2[] = {0x67, 0x68, 0x69};
-static const uint8_t test_vector_sg3[] = {0x6a, 0x6b, 0x6c};
-
-static const uint8_t test_result_sg_sha512[] = {
-    0x17, 0x80, 0x7c, 0x72, 0x8e, 0xe3, 0xba, 0x35, 0xe7, 0xcf, 0x7a, 0xf8,
-    0x23, 0x11, 0x6d, 0x26, 0xe4, 0x1e, 0x5d, 0x4d, 0x6c, 0x2f, 0xf1, 0xf3,
-    0x72, 0x0d, 0x3d, 0x96, 0xaa, 0xcb, 0x6f, 0x69, 0xde, 0x64, 0x2e, 0x63,
-    0xd5, 0xb7, 0x3f, 0xc3, 0x96, 0xc1, 0x2b, 0xe3, 0x8b, 0x2b, 0xd5, 0xd8,
-    0x84, 0x25, 0x7c, 0x32, 0xc8, 0xf6, 0xd0, 0x85, 0x4a, 0xe6, 0xb5, 0x40,
-    0xf8, 0x6d, 0xda, 0x2e};
-
-static const uint8_t test_result_sg_sha256[] = {
-    0xd6, 0x82, 0xed, 0x4c, 0xa4, 0xd9, 0x89, 0xc1, 0x34, 0xec, 0x94, 0xf1,
-    0x55, 0x1e, 0x1e, 0xc5, 0x80, 0xdd, 0x6d, 0x5a, 0x6e, 0xcd, 0xe9, 0xf3,
-    0xd3, 0x5e, 0x6e, 0x4a, 0x71, 0x7f, 0xbd, 0xe4};
-
-/*
- * The accumulative mode requires firmware to provide internal initial state
- * and message padding (including length L at the end of padding).
- *
- * This test vector is a ascii text "abc" with padding message.
- *
- * Expected results were generated using command line utitiles:
- *
- *  echo -n -e 'abc' | dd of=/tmp/test
- *  for hash in sha512sum sha256sum; do $hash /tmp/test; done
- */
-static const uint8_t test_vector_accum_512[] = {
-    0x61, 0x62, 0x63, 0x80, 0x00, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x18};
-
-static const uint8_t test_vector_accum_256[] = {
-    0x61, 0x62, 0x63, 0x80, 0x00, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x18};
-
-static const uint8_t test_result_accum_sha512[] = {
-    0xdd, 0xaf, 0x35, 0xa1, 0x93, 0x61, 0x7a, 0xba, 0xcc, 0x41, 0x73, 0x49,
-    0xae, 0x20, 0x41, 0x31, 0x12, 0xe6, 0xfa, 0x4e, 0x89, 0xa9, 0x7e, 0xa2,
-    0x0a, 0x9e, 0xee, 0xe6, 0x4b, 0x55, 0xd3, 0x9a, 0x21, 0x92, 0x99, 0x2a,
-    0x27, 0x4f, 0xc1, 0xa8, 0x36, 0xba, 0x3c, 0x23, 0xa3, 0xfe, 0xeb, 0xbd,
-    0x45, 0x4d, 0x44, 0x23, 0x64, 0x3c, 0xe8, 0x0e, 0x2a, 0x9a, 0xc9, 0x4f,
-    0xa5, 0x4c, 0xa4, 0x9f};
-
-static const uint8_t test_result_accum_sha256[] = {
-    0xba, 0x78, 0x16, 0xbf, 0x8f, 0x01, 0xcf, 0xea, 0x41, 0x41, 0x40, 0xde,
-    0x5d, 0xae, 0x22, 0x23, 0xb0, 0x03, 0x61, 0xa3, 0x96, 0x17, 0x7a, 0x9c,
-    0xb4, 0x10, 0xff, 0x61, 0xf2, 0x00, 0x15, 0xad};
-
-static void write_regs(QTestState *s, uint32_t base, uint32_t src,
-                       uint32_t length, uint32_t out, uint32_t method)
-{
-        qtest_writel(s, base + HACE_HASH_SRC, src);
-        qtest_writel(s, base + HACE_HASH_DIGEST, out);
-        qtest_writel(s, base + HACE_HASH_DATA_LEN, length);
-        qtest_writel(s, base + HACE_HASH_CMD, HACE_SHA_BE_EN | method);
-}
-
-static void test_md5(const char *machine, const uint32_t base,
-                     const uint32_t src_addr)
-
-{
-    QTestState *s = qtest_init(machine);
-
-    uint32_t digest_addr = src_addr + 0x01000000;
-    uint8_t digest[16] = {0};
-
-    /* Check engine is idle, no busy or irq bits set */
-    g_assert_cmphex(qtest_readl(s, base + HACE_STS), ==, 0);
-
-    /* Write test vector into memory */
-    qtest_memwrite(s, src_addr, test_vector, sizeof(test_vector));
-
-    write_regs(s, base, src_addr, sizeof(test_vector), digest_addr, HACE_ALGO_MD5);
-
-    /* Check hash IRQ status is asserted */
-    g_assert_cmphex(qtest_readl(s, base + HACE_STS), ==, 0x00000200);
-
-    /* Clear IRQ status and check status is deasserted */
-    qtest_writel(s, base + HACE_STS, 0x00000200);
-    g_assert_cmphex(qtest_readl(s, base + HACE_STS), ==, 0);
-
-    /* Read computed digest from memory */
-    qtest_memread(s, digest_addr, digest, sizeof(digest));
-
-    /* Check result of computation */
-    g_assert_cmpmem(digest, sizeof(digest),
-                    test_result_md5, sizeof(digest));
-
-    qtest_quit(s);
-}
-
-static void test_sha256(const char *machine, const uint32_t base,
-                        const uint32_t src_addr)
-{
-    QTestState *s = qtest_init(machine);
-
-    const uint32_t digest_addr = src_addr + 0x1000000;
-    uint8_t digest[32] = {0};
-
-    /* Check engine is idle, no busy or irq bits set */
-    g_assert_cmphex(qtest_readl(s, base + HACE_STS), ==, 0);
-
-    /* Write test vector into memory */
-    qtest_memwrite(s, src_addr, test_vector, sizeof(test_vector));
-
-    write_regs(s, base, src_addr, sizeof(test_vector), digest_addr, HACE_ALGO_SHA256);
-
-    /* Check hash IRQ status is asserted */
-    g_assert_cmphex(qtest_readl(s, base + HACE_STS), ==, 0x00000200);
-
-    /* Clear IRQ status and check status is deasserted */
-    qtest_writel(s, base + HACE_STS, 0x00000200);
-    g_assert_cmphex(qtest_readl(s, base + HACE_STS), ==, 0);
-
-    /* Read computed digest from memory */
-    qtest_memread(s, digest_addr, digest, sizeof(digest));
-
-    /* Check result of computation */
-    g_assert_cmpmem(digest, sizeof(digest),
-                    test_result_sha256, sizeof(digest));
-
-    qtest_quit(s);
-}
-
-static void test_sha512(const char *machine, const uint32_t base,
-                        const uint32_t src_addr)
-{
-    QTestState *s = qtest_init(machine);
-
-    const uint32_t digest_addr = src_addr + 0x1000000;
-    uint8_t digest[64] = {0};
-
-    /* Check engine is idle, no busy or irq bits set */
-    g_assert_cmphex(qtest_readl(s, base + HACE_STS), ==, 0);
-
-    /* Write test vector into memory */
-    qtest_memwrite(s, src_addr, test_vector, sizeof(test_vector));
-
-    write_regs(s, base, src_addr, sizeof(test_vector), digest_addr, HACE_ALGO_SHA512);
-
-    /* Check hash IRQ status is asserted */
-    g_assert_cmphex(qtest_readl(s, base + HACE_STS), ==, 0x00000200);
-
-    /* Clear IRQ status and check status is deasserted */
-    qtest_writel(s, base + HACE_STS, 0x00000200);
-    g_assert_cmphex(qtest_readl(s, base + HACE_STS), ==, 0);
-
-    /* Read computed digest from memory */
-    qtest_memread(s, digest_addr, digest, sizeof(digest));
-
-    /* Check result of computation */
-    g_assert_cmpmem(digest, sizeof(digest),
-                    test_result_sha512, sizeof(digest));
-
-    qtest_quit(s);
-}
-
-static void test_sha256_sg(const char *machine, const uint32_t base,
-                        const uint32_t src_addr)
-{
-    QTestState *s = qtest_init(machine);
-
-    const uint32_t src_addr_1 = src_addr + 0x1000000;
-    const uint32_t src_addr_2 = src_addr + 0x2000000;
-    const uint32_t src_addr_3 = src_addr + 0x3000000;
-    const uint32_t digest_addr = src_addr + 0x4000000;
-    uint8_t digest[32] = {0};
-    struct AspeedSgList array[] = {
-        {  cpu_to_le32(sizeof(test_vector_sg1)),
-           cpu_to_le32(src_addr_1) },
-        {  cpu_to_le32(sizeof(test_vector_sg2)),
-           cpu_to_le32(src_addr_2) },
-        {  cpu_to_le32(sizeof(test_vector_sg3) | SG_LIST_LEN_LAST),
-           cpu_to_le32(src_addr_3) },
-    };
-
-    /* Check engine is idle, no busy or irq bits set */
-    g_assert_cmphex(qtest_readl(s, base + HACE_STS), ==, 0);
-
-    /* Write test vector into memory */
-    qtest_memwrite(s, src_addr_1, test_vector_sg1, sizeof(test_vector_sg1));
-    qtest_memwrite(s, src_addr_2, test_vector_sg2, sizeof(test_vector_sg2));
-    qtest_memwrite(s, src_addr_3, test_vector_sg3, sizeof(test_vector_sg3));
-    qtest_memwrite(s, src_addr, array, sizeof(array));
-
-    write_regs(s, base, src_addr,
-               (sizeof(test_vector_sg1)
-                + sizeof(test_vector_sg2)
-                + sizeof(test_vector_sg3)),
-               digest_addr, HACE_ALGO_SHA256 | HACE_SG_EN);
-
-    /* Check hash IRQ status is asserted */
-    g_assert_cmphex(qtest_readl(s, base + HACE_STS), ==, 0x00000200);
-
-    /* Clear IRQ status and check status is deasserted */
-    qtest_writel(s, base + HACE_STS, 0x00000200);
-    g_assert_cmphex(qtest_readl(s, base + HACE_STS), ==, 0);
-
-    /* Read computed digest from memory */
-    qtest_memread(s, digest_addr, digest, sizeof(digest));
-
-    /* Check result of computation */
-    g_assert_cmpmem(digest, sizeof(digest),
-                    test_result_sg_sha256, sizeof(digest));
-
-    qtest_quit(s);
-}
-
-static void test_sha512_sg(const char *machine, const uint32_t base,
-                        const uint32_t src_addr)
-{
-    QTestState *s = qtest_init(machine);
-
-    const uint32_t src_addr_1 = src_addr + 0x1000000;
-    const uint32_t src_addr_2 = src_addr + 0x2000000;
-    const uint32_t src_addr_3 = src_addr + 0x3000000;
-    const uint32_t digest_addr = src_addr + 0x4000000;
-    uint8_t digest[64] = {0};
-    struct AspeedSgList array[] = {
-        {  cpu_to_le32(sizeof(test_vector_sg1)),
-           cpu_to_le32(src_addr_1) },
-        {  cpu_to_le32(sizeof(test_vector_sg2)),
-           cpu_to_le32(src_addr_2) },
-        {  cpu_to_le32(sizeof(test_vector_sg3) | SG_LIST_LEN_LAST),
-           cpu_to_le32(src_addr_3) },
-    };
-
-    /* Check engine is idle, no busy or irq bits set */
-    g_assert_cmphex(qtest_readl(s, base + HACE_STS), ==, 0);
-
-    /* Write test vector into memory */
-    qtest_memwrite(s, src_addr_1, test_vector_sg1, sizeof(test_vector_sg1));
-    qtest_memwrite(s, src_addr_2, test_vector_sg2, sizeof(test_vector_sg2));
-    qtest_memwrite(s, src_addr_3, test_vector_sg3, sizeof(test_vector_sg3));
-    qtest_memwrite(s, src_addr, array, sizeof(array));
-
-    write_regs(s, base, src_addr,
-               (sizeof(test_vector_sg1)
-                + sizeof(test_vector_sg2)
-                + sizeof(test_vector_sg3)),
-               digest_addr, HACE_ALGO_SHA512 | HACE_SG_EN);
-
-    /* Check hash IRQ status is asserted */
-    g_assert_cmphex(qtest_readl(s, base + HACE_STS), ==, 0x00000200);
-
-    /* Clear IRQ status and check status is deasserted */
-    qtest_writel(s, base + HACE_STS, 0x00000200);
-    g_assert_cmphex(qtest_readl(s, base + HACE_STS), ==, 0);
-
-    /* Read computed digest from memory */
-    qtest_memread(s, digest_addr, digest, sizeof(digest));
-
-    /* Check result of computation */
-    g_assert_cmpmem(digest, sizeof(digest),
-                    test_result_sg_sha512, sizeof(digest));
-
-    qtest_quit(s);
-}
-
-static void test_sha256_accum(const char *machine, const uint32_t base,
-                        const uint32_t src_addr)
-{
-    QTestState *s = qtest_init(machine);
-
-    const uint32_t buffer_addr = src_addr + 0x1000000;
-    const uint32_t digest_addr = src_addr + 0x4000000;
-    uint8_t digest[32] = {0};
-    struct AspeedSgList array[] = {
-        {  cpu_to_le32(sizeof(test_vector_accum_256) | SG_LIST_LEN_LAST),
-           cpu_to_le32(buffer_addr) },
-    };
-
-    /* Check engine is idle, no busy or irq bits set */
-    g_assert_cmphex(qtest_readl(s, base + HACE_STS), ==, 0);
-
-    /* Write test vector into memory */
-    qtest_memwrite(s, buffer_addr, test_vector_accum_256,
-                   sizeof(test_vector_accum_256));
-    qtest_memwrite(s, src_addr, array, sizeof(array));
-
-    write_regs(s, base, src_addr, sizeof(test_vector_accum_256),
-               digest_addr, HACE_ALGO_SHA256 | HACE_SG_EN | HACE_ACCUM_EN);
-
-    /* Check hash IRQ status is asserted */
-    g_assert_cmphex(qtest_readl(s, base + HACE_STS), ==, 0x00000200);
-
-    /* Clear IRQ status and check status is deasserted */
-    qtest_writel(s, base + HACE_STS, 0x00000200);
-    g_assert_cmphex(qtest_readl(s, base + HACE_STS), ==, 0);
-
-    /* Read computed digest from memory */
-    qtest_memread(s, digest_addr, digest, sizeof(digest));
-
-    /* Check result of computation */
-    g_assert_cmpmem(digest, sizeof(digest),
-                    test_result_accum_sha256, sizeof(digest));
-
-    qtest_quit(s);
-}
-
-static void test_sha512_accum(const char *machine, const uint32_t base,
-                        const uint32_t src_addr)
-{
-    QTestState *s = qtest_init(machine);
-
-    const uint32_t buffer_addr = src_addr + 0x1000000;
-    const uint32_t digest_addr = src_addr + 0x4000000;
-    uint8_t digest[64] = {0};
-    struct AspeedSgList array[] = {
-        {  cpu_to_le32(sizeof(test_vector_accum_512) | SG_LIST_LEN_LAST),
-           cpu_to_le32(buffer_addr) },
-    };
-
-    /* Check engine is idle, no busy or irq bits set */
-    g_assert_cmphex(qtest_readl(s, base + HACE_STS), ==, 0);
-
-    /* Write test vector into memory */
-    qtest_memwrite(s, buffer_addr, test_vector_accum_512,
-                   sizeof(test_vector_accum_512));
-    qtest_memwrite(s, src_addr, array, sizeof(array));
-
-    write_regs(s, base, src_addr, sizeof(test_vector_accum_512),
-               digest_addr, HACE_ALGO_SHA512 | HACE_SG_EN | HACE_ACCUM_EN);
-
-    /* Check hash IRQ status is asserted */
-    g_assert_cmphex(qtest_readl(s, base + HACE_STS), ==, 0x00000200);
-
-    /* Clear IRQ status and check status is deasserted */
-    qtest_writel(s, base + HACE_STS, 0x00000200);
-    g_assert_cmphex(qtest_readl(s, base + HACE_STS), ==, 0);
-
-    /* Read computed digest from memory */
-    qtest_memread(s, digest_addr, digest, sizeof(digest));
-
-    /* Check result of computation */
-    g_assert_cmpmem(digest, sizeof(digest),
-                    test_result_accum_sha512, sizeof(digest));
-
-    qtest_quit(s);
-}
-
-struct masks {
-    uint32_t src;
-    uint32_t dest;
-    uint32_t len;
-};
-
-static const struct masks ast2600_masks = {
+static const struct AspeedMasks ast2600_masks = {
     .src  = 0x7fffffff,
     .dest = 0x7ffffff8,
     .len  = 0x0fffffff,
 };
 
-static const struct masks ast2500_masks = {
+static const struct AspeedMasks ast2500_masks = {
     .src  = 0x3fffffff,
     .dest = 0x3ffffff8,
     .len  = 0x0fffffff,
 };
 
-static const struct masks ast2400_masks = {
+static const struct AspeedMasks ast2400_masks = {
     .src  = 0x0fffffff,
     .dest = 0x0ffffff8,
     .len  = 0x0fffffff,
 };
 
-static void test_addresses(const char *machine, const uint32_t base,
-                           const struct masks *expected)
-{
-    QTestState *s = qtest_init(machine);
-
-    /*
-     * Check command mode is zero, meaning engine is in direct access mode,
-     * as this affects the masking behavior of the HASH_SRC register.
-     */
-    g_assert_cmphex(qtest_readl(s, base + HACE_CMD), ==, 0);
-    g_assert_cmphex(qtest_readl(s, base + HACE_HASH_SRC), ==, 0);
-    g_assert_cmphex(qtest_readl(s, base + HACE_HASH_DIGEST), ==, 0);
-    g_assert_cmphex(qtest_readl(s, base + HACE_HASH_DATA_LEN), ==, 0);
-
-
-    /* Check that the address masking is correct */
-    qtest_writel(s, base + HACE_HASH_SRC, 0xffffffff);
-    g_assert_cmphex(qtest_readl(s, base + HACE_HASH_SRC), ==, expected->src);
-
-    qtest_writel(s, base + HACE_HASH_DIGEST, 0xffffffff);
-    g_assert_cmphex(qtest_readl(s, base + HACE_HASH_DIGEST), ==, expected->dest);
-
-    qtest_writel(s, base + HACE_HASH_DATA_LEN, 0xffffffff);
-    g_assert_cmphex(qtest_readl(s, base + HACE_HASH_DATA_LEN), ==, expected->len);
-
-    /* Reset to zero */
-    qtest_writel(s, base + HACE_HASH_SRC, 0);
-    qtest_writel(s, base + HACE_HASH_DIGEST, 0);
-    qtest_writel(s, base + HACE_HASH_DATA_LEN, 0);
-
-    /* Check that all bits are now zero */
-    g_assert_cmphex(qtest_readl(s, base + HACE_HASH_SRC), ==, 0);
-    g_assert_cmphex(qtest_readl(s, base + HACE_HASH_DIGEST), ==, 0);
-    g_assert_cmphex(qtest_readl(s, base + HACE_HASH_DATA_LEN), ==, 0);
-
-    qtest_quit(s);
-}
-
 /* ast2600 */
 static void test_md5_ast2600(void)
 {
-    test_md5("-machine ast2600-evb", 0x1e6d0000, 0x80000000);
+    aspeed_test_md5("-machine ast2600-evb", 0x1e6d0000, 0x80000000);
 }
 
 static void test_sha256_ast2600(void)
 {
-    test_sha256("-machine ast2600-evb", 0x1e6d0000, 0x80000000);
+    aspeed_test_sha256("-machine ast2600-evb", 0x1e6d0000, 0x80000000);
 }
 
 static void test_sha256_sg_ast2600(void)
 {
-    test_sha256_sg("-machine ast2600-evb", 0x1e6d0000, 0x80000000);
+    aspeed_test_sha256_sg("-machine ast2600-evb", 0x1e6d0000, 0x80000000);
 }
 
 static void test_sha512_ast2600(void)
 {
-    test_sha512("-machine ast2600-evb", 0x1e6d0000, 0x80000000);
+    aspeed_test_sha512("-machine ast2600-evb", 0x1e6d0000, 0x80000000);
 }
 
 static void test_sha512_sg_ast2600(void)
 {
-    test_sha512_sg("-machine ast2600-evb", 0x1e6d0000, 0x80000000);
+    aspeed_test_sha512_sg("-machine ast2600-evb", 0x1e6d0000, 0x80000000);
 }
 
 static void test_sha256_accum_ast2600(void)
 {
-    test_sha256_accum("-machine ast2600-evb", 0x1e6d0000, 0x80000000);
+    aspeed_test_sha256_accum("-machine ast2600-evb", 0x1e6d0000, 0x80000000);
 }
 
 static void test_sha512_accum_ast2600(void)
 {
-    test_sha512_accum("-machine ast2600-evb", 0x1e6d0000, 0x80000000);
+    aspeed_test_sha512_accum("-machine ast2600-evb", 0x1e6d0000, 0x80000000);
 }
 
 static void test_addresses_ast2600(void)
 {
-    test_addresses("-machine ast2600-evb", 0x1e6d0000, &ast2600_masks);
+    aspeed_test_addresses("-machine ast2600-evb", 0x1e6d0000, &ast2600_masks);
 }
 
 /* ast2500 */
 static void test_md5_ast2500(void)
 {
-    test_md5("-machine ast2500-evb", 0x1e6e3000, 0x80000000);
+    aspeed_test_md5("-machine ast2500-evb", 0x1e6e3000, 0x80000000);
 }
 
 static void test_sha256_ast2500(void)
 {
-    test_sha256("-machine ast2500-evb", 0x1e6e3000, 0x80000000);
+    aspeed_test_sha256("-machine ast2500-evb", 0x1e6e3000, 0x80000000);
 }
 
 static void test_sha512_ast2500(void)
 {
-    test_sha512("-machine ast2500-evb", 0x1e6e3000, 0x80000000);
+    aspeed_test_sha512("-machine ast2500-evb", 0x1e6e3000, 0x80000000);
 }
 
 static void test_addresses_ast2500(void)
 {
-    test_addresses("-machine ast2500-evb", 0x1e6e3000, &ast2500_masks);
+    aspeed_test_addresses("-machine ast2500-evb", 0x1e6e3000, &ast2500_masks);
 }
 
 /* ast2400 */
 static void test_md5_ast2400(void)
 {
-    test_md5("-machine palmetto-bmc", 0x1e6e3000, 0x40000000);
+    aspeed_test_md5("-machine palmetto-bmc", 0x1e6e3000, 0x40000000);
 }
 
 static void test_sha256_ast2400(void)
 {
-    test_sha256("-machine palmetto-bmc", 0x1e6e3000, 0x40000000);
+    aspeed_test_sha256("-machine palmetto-bmc", 0x1e6e3000, 0x40000000);
 }
 
 static void test_sha512_ast2400(void)
 {
-    test_sha512("-machine palmetto-bmc", 0x1e6e3000, 0x40000000);
+    aspeed_test_sha512("-machine palmetto-bmc", 0x1e6e3000, 0x40000000);
 }
 
 static void test_addresses_ast2400(void)
 {
-    test_addresses("-machine palmetto-bmc", 0x1e6e3000, &ast2400_masks);
+    aspeed_test_addresses("-machine palmetto-bmc", 0x1e6e3000, &ast2400_masks);
 }
 
 int main(int argc, char **argv)
diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
index c3a24a3eb4..26d83cd9dd 100644
--- a/tests/qtest/meson.build
+++ b/tests/qtest/meson.build
@@ -361,6 +361,7 @@ if gnutls.found()
 endif
 
 qtests = {
+  'aspeed_hace-test': files('aspeed-hace-utils.c', 'aspeed_hace-test.c'),
   'aspeed_smc-test': files('aspeed-smc-utils.c', 'aspeed_smc-test.c'),
   'ast2700-smc-test': files('aspeed-smc-utils.c', 'ast2700-smc-test.c'),
   'bios-tables-test': [io, 'boot-sector.c', 'acpi-utils.c', 'tpm-emu.c'],

From 33627ab237168fa624435eb8ae87f82a2ba9d7f5 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Thu, 15 May 2025 16:09:51 +0800
Subject: [PATCH 1141/2760] test/qtest/hace: Specify explicit array sizes for
 test vectors and hash results
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

To enhance code readability and prevent potential buffer overflows or unintended
size assumptions, this commit updates all fixed-size array declarations to use
explicit array sizes.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Acked-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/qemu-devel/20250515081008.583578-20-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 tests/qtest/aspeed-hace-utils.c | 26 +++++++++++++-------------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/tests/qtest/aspeed-hace-utils.c b/tests/qtest/aspeed-hace-utils.c
index 8582847945..777fa5b986 100644
--- a/tests/qtest/aspeed-hace-utils.c
+++ b/tests/qtest/aspeed-hace-utils.c
@@ -19,9 +19,9 @@
  *  for hash in sha512sum sha256sum md5sum; do $hash /tmp/test; done
  *
  */
-static const uint8_t test_vector[] = {0x61, 0x62, 0x63};
+static const uint8_t test_vector[3] = {0x61, 0x62, 0x63};
 
-static const uint8_t test_result_sha512[] = {
+static const uint8_t test_result_sha512[64] = {
     0xdd, 0xaf, 0x35, 0xa1, 0x93, 0x61, 0x7a, 0xba, 0xcc, 0x41, 0x73, 0x49,
     0xae, 0x20, 0x41, 0x31, 0x12, 0xe6, 0xfa, 0x4e, 0x89, 0xa9, 0x7e, 0xa2,
     0x0a, 0x9e, 0xee, 0xe6, 0x4b, 0x55, 0xd3, 0x9a, 0x21, 0x92, 0x99, 0x2a,
@@ -29,12 +29,12 @@ static const uint8_t test_result_sha512[] = {
     0x45, 0x4d, 0x44, 0x23, 0x64, 0x3c, 0xe8, 0x0e, 0x2a, 0x9a, 0xc9, 0x4f,
     0xa5, 0x4c, 0xa4, 0x9f};
 
-static const uint8_t test_result_sha256[] = {
+static const uint8_t test_result_sha256[32] = {
     0xba, 0x78, 0x16, 0xbf, 0x8f, 0x01, 0xcf, 0xea, 0x41, 0x41, 0x40, 0xde,
     0x5d, 0xae, 0x22, 0x23, 0xb0, 0x03, 0x61, 0xa3, 0x96, 0x17, 0x7a, 0x9c,
     0xb4, 0x10, 0xff, 0x61, 0xf2, 0x00, 0x15, 0xad};
 
-static const uint8_t test_result_md5[] = {
+static const uint8_t test_result_md5[16] = {
     0x90, 0x01, 0x50, 0x98, 0x3c, 0xd2, 0x4f, 0xb0, 0xd6, 0x96, 0x3f, 0x7d,
     0x28, 0xe1, 0x7f, 0x72};
 
@@ -48,11 +48,11 @@ static const uint8_t test_result_md5[] = {
  *  for hash in sha512sum sha256sum; do $hash /tmp/test; done
  *
  */
-static const uint8_t test_vector_sg1[] = {0x61, 0x62, 0x63, 0x64, 0x65, 0x66};
-static const uint8_t test_vector_sg2[] = {0x67, 0x68, 0x69};
-static const uint8_t test_vector_sg3[] = {0x6a, 0x6b, 0x6c};
+static const uint8_t test_vector_sg1[6] = {0x61, 0x62, 0x63, 0x64, 0x65, 0x66};
+static const uint8_t test_vector_sg2[3] = {0x67, 0x68, 0x69};
+static const uint8_t test_vector_sg3[3] = {0x6a, 0x6b, 0x6c};
 
-static const uint8_t test_result_sg_sha512[] = {
+static const uint8_t test_result_sg_sha512[64] = {
     0x17, 0x80, 0x7c, 0x72, 0x8e, 0xe3, 0xba, 0x35, 0xe7, 0xcf, 0x7a, 0xf8,
     0x23, 0x11, 0x6d, 0x26, 0xe4, 0x1e, 0x5d, 0x4d, 0x6c, 0x2f, 0xf1, 0xf3,
     0x72, 0x0d, 0x3d, 0x96, 0xaa, 0xcb, 0x6f, 0x69, 0xde, 0x64, 0x2e, 0x63,
@@ -60,7 +60,7 @@ static const uint8_t test_result_sg_sha512[] = {
     0x84, 0x25, 0x7c, 0x32, 0xc8, 0xf6, 0xd0, 0x85, 0x4a, 0xe6, 0xb5, 0x40,
     0xf8, 0x6d, 0xda, 0x2e};
 
-static const uint8_t test_result_sg_sha256[] = {
+static const uint8_t test_result_sg_sha256[32] = {
     0xd6, 0x82, 0xed, 0x4c, 0xa4, 0xd9, 0x89, 0xc1, 0x34, 0xec, 0x94, 0xf1,
     0x55, 0x1e, 0x1e, 0xc5, 0x80, 0xdd, 0x6d, 0x5a, 0x6e, 0xcd, 0xe9, 0xf3,
     0xd3, 0x5e, 0x6e, 0x4a, 0x71, 0x7f, 0xbd, 0xe4};
@@ -76,7 +76,7 @@ static const uint8_t test_result_sg_sha256[] = {
  *  echo -n -e 'abc' | dd of=/tmp/test
  *  for hash in sha512sum sha256sum; do $hash /tmp/test; done
  */
-static const uint8_t test_vector_accum_512[] = {
+static const uint8_t test_vector_accum_512[128] = {
     0x61, 0x62, 0x63, 0x80, 0x00, 0x00, 0x00, 0x00,
     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
@@ -94,7 +94,7 @@ static const uint8_t test_vector_accum_512[] = {
     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x18};
 
-static const uint8_t test_vector_accum_256[] = {
+static const uint8_t test_vector_accum_256[64] = {
     0x61, 0x62, 0x63, 0x80, 0x00, 0x00, 0x00, 0x00,
     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
@@ -104,7 +104,7 @@ static const uint8_t test_vector_accum_256[] = {
     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x18};
 
-static const uint8_t test_result_accum_sha512[] = {
+static const uint8_t test_result_accum_sha512[64] = {
     0xdd, 0xaf, 0x35, 0xa1, 0x93, 0x61, 0x7a, 0xba, 0xcc, 0x41, 0x73, 0x49,
     0xae, 0x20, 0x41, 0x31, 0x12, 0xe6, 0xfa, 0x4e, 0x89, 0xa9, 0x7e, 0xa2,
     0x0a, 0x9e, 0xee, 0xe6, 0x4b, 0x55, 0xd3, 0x9a, 0x21, 0x92, 0x99, 0x2a,
@@ -112,7 +112,7 @@ static const uint8_t test_result_accum_sha512[] = {
     0x45, 0x4d, 0x44, 0x23, 0x64, 0x3c, 0xe8, 0x0e, 0x2a, 0x9a, 0xc9, 0x4f,
     0xa5, 0x4c, 0xa4, 0x9f};
 
-static const uint8_t test_result_accum_sha256[] = {
+static const uint8_t test_result_accum_sha256[32] = {
     0xba, 0x78, 0x16, 0xbf, 0x8f, 0x01, 0xcf, 0xea, 0x41, 0x41, 0x40, 0xde,
     0x5d, 0xae, 0x22, 0x23, 0xb0, 0x03, 0x61, 0xa3, 0x96, 0x17, 0x7a, 0x9c,
     0xb4, 0x10, 0xff, 0x61, 0xf2, 0x00, 0x15, 0xad};

From a3e7f6d05d8bf38b0337fabc438d32c46948ccff Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Thu, 15 May 2025 16:09:52 +0800
Subject: [PATCH 1142/2760] test/qtest/hace: Adjust test address range for
 AST1030 due to SRAM limitations
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The digest_addr is set to "src_addr + 0x1000000", where src_addr is the DRAM
base address. However, the value 0x1000000 (16MB) is too large because the
AST1030 does not support DRAM, and its SRAM size is only 768KB.

A range size of 0x10000 (64KB) is sufficient for HACE test cases, as the test
vector size does not exceed 64KB.

Updates:
1. Direct Access Mode
Update digest_addr to "src_addr + 0x10000" in the following functions:
aspeed_test_md5
aspeed_test_sha256
aspeed_test_sha512

2. Scatter-Gather (SG) Mode
Update source address for different SG buffer addresses in the following
functions:
src_addr1 = src_addr + 0x10000
src_addr2 = src_addr + 0x20000
src_addr3 = src_addr + 0x30000
digest_addr = src_addr + 0x40000

aspeed_test_sha256_sg
aspeed_test_sha512_sg

3. ACC Mode Update
Update the SG List start address: src_addr + 0x10000
Update the SG List buffer size to 0x30000 (192KB).

buffer_addr = src_addr + 0x10000
digest_addr = src_addr + 0x40000

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Acked-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/qemu-devel/20250515081008.583578-21-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 tests/qtest/aspeed-hace-utils.c | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/tests/qtest/aspeed-hace-utils.c b/tests/qtest/aspeed-hace-utils.c
index 777fa5b986..539d06e4f8 100644
--- a/tests/qtest/aspeed-hace-utils.c
+++ b/tests/qtest/aspeed-hace-utils.c
@@ -132,7 +132,7 @@ void aspeed_test_md5(const char *machine, const uint32_t base,
 {
     QTestState *s = qtest_init(machine);
 
-    uint32_t digest_addr = src_addr + 0x01000000;
+    uint32_t digest_addr = src_addr + 0x010000;
     uint8_t digest[16] = {0};
 
     /* Check engine is idle, no busy or irq bits set */
@@ -166,7 +166,7 @@ void aspeed_test_sha256(const char *machine, const uint32_t base,
 {
     QTestState *s = qtest_init(machine);
 
-    const uint32_t digest_addr = src_addr + 0x1000000;
+    const uint32_t digest_addr = src_addr + 0x10000;
     uint8_t digest[32] = {0};
 
     /* Check engine is idle, no busy or irq bits set */
@@ -200,7 +200,7 @@ void aspeed_test_sha512(const char *machine, const uint32_t base,
 {
     QTestState *s = qtest_init(machine);
 
-    const uint32_t digest_addr = src_addr + 0x1000000;
+    const uint32_t digest_addr = src_addr + 0x10000;
     uint8_t digest[64] = {0};
 
     /* Check engine is idle, no busy or irq bits set */
@@ -234,10 +234,10 @@ void aspeed_test_sha256_sg(const char *machine, const uint32_t base,
 {
     QTestState *s = qtest_init(machine);
 
-    const uint32_t src_addr_1 = src_addr + 0x1000000;
-    const uint32_t src_addr_2 = src_addr + 0x2000000;
-    const uint32_t src_addr_3 = src_addr + 0x3000000;
-    const uint32_t digest_addr = src_addr + 0x4000000;
+    const uint32_t src_addr_1 = src_addr + 0x10000;
+    const uint32_t src_addr_2 = src_addr + 0x20000;
+    const uint32_t src_addr_3 = src_addr + 0x30000;
+    const uint32_t digest_addr = src_addr + 0x40000;
     uint8_t digest[32] = {0};
     struct AspeedSgList array[] = {
         {  cpu_to_le32(sizeof(test_vector_sg1)),
@@ -285,10 +285,10 @@ void aspeed_test_sha512_sg(const char *machine, const uint32_t base,
 {
     QTestState *s = qtest_init(machine);
 
-    const uint32_t src_addr_1 = src_addr + 0x1000000;
-    const uint32_t src_addr_2 = src_addr + 0x2000000;
-    const uint32_t src_addr_3 = src_addr + 0x3000000;
-    const uint32_t digest_addr = src_addr + 0x4000000;
+    const uint32_t src_addr_1 = src_addr + 0x10000;
+    const uint32_t src_addr_2 = src_addr + 0x20000;
+    const uint32_t src_addr_3 = src_addr + 0x30000;
+    const uint32_t digest_addr = src_addr + 0x40000;
     uint8_t digest[64] = {0};
     struct AspeedSgList array[] = {
         {  cpu_to_le32(sizeof(test_vector_sg1)),
@@ -336,8 +336,8 @@ void aspeed_test_sha256_accum(const char *machine, const uint32_t base,
 {
     QTestState *s = qtest_init(machine);
 
-    const uint32_t buffer_addr = src_addr + 0x1000000;
-    const uint32_t digest_addr = src_addr + 0x4000000;
+    const uint32_t buffer_addr = src_addr + 0x10000;
+    const uint32_t digest_addr = src_addr + 0x40000;
     uint8_t digest[32] = {0};
     struct AspeedSgList array[] = {
         {  cpu_to_le32(sizeof(test_vector_accum_256) | SG_LIST_LEN_LAST),
@@ -377,8 +377,8 @@ void aspeed_test_sha512_accum(const char *machine, const uint32_t base,
 {
     QTestState *s = qtest_init(machine);
 
-    const uint32_t buffer_addr = src_addr + 0x1000000;
-    const uint32_t digest_addr = src_addr + 0x4000000;
+    const uint32_t buffer_addr = src_addr + 0x10000;
+    const uint32_t digest_addr = src_addr + 0x40000;
     uint8_t digest[64] = {0};
     struct AspeedSgList array[] = {
         {  cpu_to_le32(sizeof(test_vector_accum_512) | SG_LIST_LEN_LAST),

From 3c13be86ba181faea21a1b4f66f54df5328574f7 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Thu, 15 May 2025 16:09:53 +0800
Subject: [PATCH 1143/2760] test/qtest/hace: Add SHA-384 test cases for ASPEED
 HACE model
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Introduced SHA-384 test functions to verify hashing operations.
Extended support for scatter-gather ("_sg") and accumulation ("_accum") tests.
Updated test result vectors for SHA-384 validation.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Acked-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/qemu-devel/20250515081008.583578-22-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 tests/qtest/aspeed-hace-utils.c | 168 +++++++++++++++++++++++++++++++-
 tests/qtest/aspeed-hace-utils.h |   6 ++
 2 files changed, 171 insertions(+), 3 deletions(-)

diff --git a/tests/qtest/aspeed-hace-utils.c b/tests/qtest/aspeed-hace-utils.c
index 539d06e4f8..dad90ee81c 100644
--- a/tests/qtest/aspeed-hace-utils.c
+++ b/tests/qtest/aspeed-hace-utils.c
@@ -16,7 +16,7 @@
  * Expected results were generated using command line utitiles:
  *
  *  echo -n -e 'abc' | dd of=/tmp/test
- *  for hash in sha512sum sha256sum md5sum; do $hash /tmp/test; done
+ *  for hash in sha512sum sha384sum sha256sum md5sum; do $hash /tmp/test; done
  *
  */
 static const uint8_t test_vector[3] = {0x61, 0x62, 0x63};
@@ -29,6 +29,12 @@ static const uint8_t test_result_sha512[64] = {
     0x45, 0x4d, 0x44, 0x23, 0x64, 0x3c, 0xe8, 0x0e, 0x2a, 0x9a, 0xc9, 0x4f,
     0xa5, 0x4c, 0xa4, 0x9f};
 
+static const uint8_t test_result_sha384[48] = {
+    0xcb, 0x00, 0x75, 0x3f, 0x45, 0xa3, 0x5e, 0x8b, 0xb5, 0xa0, 0x3d, 0x69,
+    0x9a, 0xc6, 0x50, 0x07, 0x27, 0x2c, 0x32, 0xab, 0x0e, 0xde, 0xd1, 0x63,
+    0x1a, 0x8b, 0x60, 0x5a, 0x43, 0xff, 0x5b, 0xed, 0x80, 0x86, 0x07, 0x2b,
+    0xa1, 0xe7, 0xcc, 0x23, 0x58, 0xba, 0xec, 0xa1, 0x34, 0xc8, 0x25, 0xa7};
+
 static const uint8_t test_result_sha256[32] = {
     0xba, 0x78, 0x16, 0xbf, 0x8f, 0x01, 0xcf, 0xea, 0x41, 0x41, 0x40, 0xde,
     0x5d, 0xae, 0x22, 0x23, 0xb0, 0x03, 0x61, 0xa3, 0x96, 0x17, 0x7a, 0x9c,
@@ -45,7 +51,7 @@ static const uint8_t test_result_md5[16] = {
  * Expected results were generated using command line utitiles:
  *
  *  echo -n -e 'abcdefghijkl' | dd of=/tmp/test
- *  for hash in sha512sum sha256sum; do $hash /tmp/test; done
+ *  for hash in sha512sum sha384sum sha256sum; do $hash /tmp/test; done
  *
  */
 static const uint8_t test_vector_sg1[6] = {0x61, 0x62, 0x63, 0x64, 0x65, 0x66};
@@ -60,6 +66,12 @@ static const uint8_t test_result_sg_sha512[64] = {
     0x84, 0x25, 0x7c, 0x32, 0xc8, 0xf6, 0xd0, 0x85, 0x4a, 0xe6, 0xb5, 0x40,
     0xf8, 0x6d, 0xda, 0x2e};
 
+static const uint8_t test_result_sg_sha384[48] = {
+    0x10, 0x3c, 0xa9, 0x6c, 0x06, 0xa1, 0xce, 0x79, 0x8f, 0x08, 0xf8, 0xef,
+    0xf0, 0xdf, 0xb0, 0xcc, 0xdb, 0x56, 0x7d, 0x48, 0xb2, 0x85, 0xb2, 0x3d,
+    0x0c, 0xd7, 0x73, 0x45, 0x46, 0x67, 0xa3, 0xc2, 0xfa, 0x5f, 0x1b, 0x58,
+    0xd9, 0xcd, 0xf2, 0x32, 0x9b, 0xd9, 0x97, 0x97, 0x30, 0xbf, 0xaa, 0xff};
+
 static const uint8_t test_result_sg_sha256[32] = {
     0xd6, 0x82, 0xed, 0x4c, 0xa4, 0xd9, 0x89, 0xc1, 0x34, 0xec, 0x94, 0xf1,
     0x55, 0x1e, 0x1e, 0xc5, 0x80, 0xdd, 0x6d, 0x5a, 0x6e, 0xcd, 0xe9, 0xf3,
@@ -74,7 +86,7 @@ static const uint8_t test_result_sg_sha256[32] = {
  * Expected results were generated using command line utitiles:
  *
  *  echo -n -e 'abc' | dd of=/tmp/test
- *  for hash in sha512sum sha256sum; do $hash /tmp/test; done
+ *  for hash in sha512sum sha384sum sha256sum; do $hash /tmp/test; done
  */
 static const uint8_t test_vector_accum_512[128] = {
     0x61, 0x62, 0x63, 0x80, 0x00, 0x00, 0x00, 0x00,
@@ -94,6 +106,24 @@ static const uint8_t test_vector_accum_512[128] = {
     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x18};
 
+static const uint8_t test_vector_accum_384[128] = {
+    0x61, 0x62, 0x63, 0x80, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x18};
+
 static const uint8_t test_vector_accum_256[64] = {
     0x61, 0x62, 0x63, 0x80, 0x00, 0x00, 0x00, 0x00,
     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
@@ -112,6 +142,12 @@ static const uint8_t test_result_accum_sha512[64] = {
     0x45, 0x4d, 0x44, 0x23, 0x64, 0x3c, 0xe8, 0x0e, 0x2a, 0x9a, 0xc9, 0x4f,
     0xa5, 0x4c, 0xa4, 0x9f};
 
+static const uint8_t test_result_accum_sha384[48] = {
+    0xcb, 0x00, 0x75, 0x3f, 0x45, 0xa3, 0x5e, 0x8b, 0xb5, 0xa0, 0x3d, 0x69,
+    0x9a, 0xc6, 0x50, 0x07, 0x27, 0x2c, 0x32, 0xab, 0x0e, 0xde, 0xd1, 0x63,
+    0x1a, 0x8b, 0x60, 0x5a, 0x43, 0xff, 0x5b, 0xed, 0x80, 0x86, 0x07, 0x2b,
+    0xa1, 0xe7, 0xcc, 0x23, 0x58, 0xba, 0xec, 0xa1, 0x34, 0xc8, 0x25, 0xa7};
+
 static const uint8_t test_result_accum_sha256[32] = {
     0xba, 0x78, 0x16, 0xbf, 0x8f, 0x01, 0xcf, 0xea, 0x41, 0x41, 0x40, 0xde,
     0x5d, 0xae, 0x22, 0x23, 0xb0, 0x03, 0x61, 0xa3, 0x96, 0x17, 0x7a, 0x9c,
@@ -195,6 +231,40 @@ void aspeed_test_sha256(const char *machine, const uint32_t base,
     qtest_quit(s);
 }
 
+void aspeed_test_sha384(const char *machine, const uint32_t base,
+                        const uint32_t src_addr)
+{
+    QTestState *s = qtest_init(machine);
+
+    const uint32_t digest_addr = src_addr + 0x10000;
+    uint8_t digest[48] = {0};
+
+    /* Check engine is idle, no busy or irq bits set */
+    g_assert_cmphex(qtest_readl(s, base + HACE_STS), ==, 0);
+
+    /* Write test vector into memory */
+    qtest_memwrite(s, src_addr, test_vector, sizeof(test_vector));
+
+    write_regs(s, base, src_addr, sizeof(test_vector), digest_addr,
+               HACE_ALGO_SHA384);
+
+    /* Check hash IRQ status is asserted */
+    g_assert_cmphex(qtest_readl(s, base + HACE_STS), ==, 0x00000200);
+
+    /* Clear IRQ status and check status is deasserted */
+    qtest_writel(s, base + HACE_STS, 0x00000200);
+    g_assert_cmphex(qtest_readl(s, base + HACE_STS), ==, 0);
+
+    /* Read computed digest from memory */
+    qtest_memread(s, digest_addr, digest, sizeof(digest));
+
+    /* Check result of computation */
+    g_assert_cmpmem(digest, sizeof(digest),
+                    test_result_sha384, sizeof(digest));
+
+    qtest_quit(s);
+}
+
 void aspeed_test_sha512(const char *machine, const uint32_t base,
                         const uint32_t src_addr)
 {
@@ -280,6 +350,57 @@ void aspeed_test_sha256_sg(const char *machine, const uint32_t base,
     qtest_quit(s);
 }
 
+void aspeed_test_sha384_sg(const char *machine, const uint32_t base,
+                           const uint32_t src_addr)
+{
+    QTestState *s = qtest_init(machine);
+
+    const uint32_t src_addr_1 = src_addr + 0x10000;
+    const uint32_t src_addr_2 = src_addr + 0x20000;
+    const uint32_t src_addr_3 = src_addr + 0x30000;
+    const uint32_t digest_addr = src_addr + 0x40000;
+    uint8_t digest[48] = {0};
+    struct AspeedSgList array[] = {
+        {  cpu_to_le32(sizeof(test_vector_sg1)),
+           cpu_to_le32(src_addr_1) },
+        {  cpu_to_le32(sizeof(test_vector_sg2)),
+           cpu_to_le32(src_addr_2) },
+        {  cpu_to_le32(sizeof(test_vector_sg3) | SG_LIST_LEN_LAST),
+           cpu_to_le32(src_addr_3) },
+    };
+
+    /* Check engine is idle, no busy or irq bits set */
+    g_assert_cmphex(qtest_readl(s, base + HACE_STS), ==, 0);
+
+    /* Write test vector into memory */
+    qtest_memwrite(s, src_addr_1, test_vector_sg1, sizeof(test_vector_sg1));
+    qtest_memwrite(s, src_addr_2, test_vector_sg2, sizeof(test_vector_sg2));
+    qtest_memwrite(s, src_addr_3, test_vector_sg3, sizeof(test_vector_sg3));
+    qtest_memwrite(s, src_addr, array, sizeof(array));
+
+    write_regs(s, base, src_addr,
+               (sizeof(test_vector_sg1)
+                + sizeof(test_vector_sg2)
+                + sizeof(test_vector_sg3)),
+               digest_addr, HACE_ALGO_SHA384 | HACE_SG_EN);
+
+    /* Check hash IRQ status is asserted */
+    g_assert_cmphex(qtest_readl(s, base + HACE_STS), ==, 0x00000200);
+
+    /* Clear IRQ status and check status is deasserted */
+    qtest_writel(s, base + HACE_STS, 0x00000200);
+    g_assert_cmphex(qtest_readl(s, base + HACE_STS), ==, 0);
+
+    /* Read computed digest from memory */
+    qtest_memread(s, digest_addr, digest, sizeof(digest));
+
+    /* Check result of computation */
+    g_assert_cmpmem(digest, sizeof(digest),
+                    test_result_sg_sha384, sizeof(digest));
+
+    qtest_quit(s);
+}
+
 void aspeed_test_sha512_sg(const char *machine, const uint32_t base,
                            const uint32_t src_addr)
 {
@@ -372,6 +493,47 @@ void aspeed_test_sha256_accum(const char *machine, const uint32_t base,
     qtest_quit(s);
 }
 
+void aspeed_test_sha384_accum(const char *machine, const uint32_t base,
+                              const uint32_t src_addr)
+{
+    QTestState *s = qtest_init(machine);
+
+    const uint32_t buffer_addr = src_addr + 0x10000;
+    const uint32_t digest_addr = src_addr + 0x40000;
+    uint8_t digest[48] = {0};
+    struct AspeedSgList array[] = {
+        {  cpu_to_le32(sizeof(test_vector_accum_384) | SG_LIST_LEN_LAST),
+           cpu_to_le32(buffer_addr) },
+    };
+
+    /* Check engine is idle, no busy or irq bits set */
+    g_assert_cmphex(qtest_readl(s, base + HACE_STS), ==, 0);
+
+    /* Write test vector into memory */
+    qtest_memwrite(s, buffer_addr, test_vector_accum_384,
+                   sizeof(test_vector_accum_384));
+    qtest_memwrite(s, src_addr, array, sizeof(array));
+
+    write_regs(s, base, src_addr, sizeof(test_vector_accum_384),
+               digest_addr, HACE_ALGO_SHA384 | HACE_SG_EN | HACE_ACCUM_EN);
+
+    /* Check hash IRQ status is asserted */
+    g_assert_cmphex(qtest_readl(s, base + HACE_STS), ==, 0x00000200);
+
+    /* Clear IRQ status and check status is deasserted */
+    qtest_writel(s, base + HACE_STS, 0x00000200);
+    g_assert_cmphex(qtest_readl(s, base + HACE_STS), ==, 0);
+
+    /* Read computed digest from memory */
+    qtest_memread(s, digest_addr, digest, sizeof(digest));
+
+    /* Check result of computation */
+    g_assert_cmpmem(digest, sizeof(digest),
+                    test_result_accum_sha384, sizeof(digest));
+
+    qtest_quit(s);
+}
+
 void aspeed_test_sha512_accum(const char *machine, const uint32_t base,
                               const uint32_t src_addr)
 {
diff --git a/tests/qtest/aspeed-hace-utils.h b/tests/qtest/aspeed-hace-utils.h
index 598577c69b..f4440561de 100644
--- a/tests/qtest/aspeed-hace-utils.h
+++ b/tests/qtest/aspeed-hace-utils.h
@@ -54,14 +54,20 @@ void aspeed_test_md5(const char *machine, const uint32_t base,
                      const uint32_t src_addr);
 void aspeed_test_sha256(const char *machine, const uint32_t base,
                         const uint32_t src_addr);
+void aspeed_test_sha384(const char *machine, const uint32_t base,
+                        const uint32_t src_addr);
 void aspeed_test_sha512(const char *machine, const uint32_t base,
                         const uint32_t src_addr);
 void aspeed_test_sha256_sg(const char *machine, const uint32_t base,
                            const uint32_t src_addr);
+void aspeed_test_sha384_sg(const char *machine, const uint32_t base,
+                           const uint32_t src_addr);
 void aspeed_test_sha512_sg(const char *machine, const uint32_t base,
                            const uint32_t src_addr);
 void aspeed_test_sha256_accum(const char *machine, const uint32_t base,
                               const uint32_t src_addr);
+void aspeed_test_sha384_accum(const char *machine, const uint32_t base,
+                              const uint32_t src_addr);
 void aspeed_test_sha512_accum(const char *machine, const uint32_t base,
                               const uint32_t src_addr);
 void aspeed_test_addresses(const char *machine, const uint32_t base,

From adf2fb3951625dfba7ff95433c82a449e464a578 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Thu, 15 May 2025 16:09:54 +0800
Subject: [PATCH 1144/2760] test/qtest/hace: Add SHA-384 tests for AST2600
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Introduced "test_sha384_ast2600" to validate SHA-384 hashing.
Added "test_sha384_sg_ast2600" for scatter-gather SHA-384 verification.
Implemented "test_sha384_accum_ast2600" to test SHA-384 accumulation.
Registered new test cases in "main" to ensure execution.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Acked-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/qemu-devel/20250515081008.583578-23-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 tests/qtest/aspeed_hace-test.c | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/tests/qtest/aspeed_hace-test.c b/tests/qtest/aspeed_hace-test.c
index 42a306af2a..ab0c98330e 100644
--- a/tests/qtest/aspeed_hace-test.c
+++ b/tests/qtest/aspeed_hace-test.c
@@ -44,6 +44,16 @@ static void test_sha256_sg_ast2600(void)
     aspeed_test_sha256_sg("-machine ast2600-evb", 0x1e6d0000, 0x80000000);
 }
 
+static void test_sha384_ast2600(void)
+{
+    aspeed_test_sha384("-machine ast2600-evb", 0x1e6d0000, 0x80000000);
+}
+
+static void test_sha384_sg_ast2600(void)
+{
+    aspeed_test_sha384_sg("-machine ast2600-evb", 0x1e6d0000, 0x80000000);
+}
+
 static void test_sha512_ast2600(void)
 {
     aspeed_test_sha512("-machine ast2600-evb", 0x1e6d0000, 0x80000000);
@@ -59,6 +69,11 @@ static void test_sha256_accum_ast2600(void)
     aspeed_test_sha256_accum("-machine ast2600-evb", 0x1e6d0000, 0x80000000);
 }
 
+static void test_sha384_accum_ast2600(void)
+{
+    aspeed_test_sha384_accum("-machine ast2600-evb", 0x1e6d0000, 0x80000000);
+}
+
 static void test_sha512_accum_ast2600(void)
 {
     aspeed_test_sha512_accum("-machine ast2600-evb", 0x1e6d0000, 0x80000000);
@@ -117,13 +132,16 @@ int main(int argc, char **argv)
 
     qtest_add_func("ast2600/hace/addresses", test_addresses_ast2600);
     qtest_add_func("ast2600/hace/sha512", test_sha512_ast2600);
+    qtest_add_func("ast2600/hace/sha384", test_sha384_ast2600);
     qtest_add_func("ast2600/hace/sha256", test_sha256_ast2600);
     qtest_add_func("ast2600/hace/md5", test_md5_ast2600);
 
     qtest_add_func("ast2600/hace/sha512_sg", test_sha512_sg_ast2600);
+    qtest_add_func("ast2600/hace/sha384_sg", test_sha384_sg_ast2600);
     qtest_add_func("ast2600/hace/sha256_sg", test_sha256_sg_ast2600);
 
     qtest_add_func("ast2600/hace/sha512_accum", test_sha512_accum_ast2600);
+    qtest_add_func("ast2600/hace/sha384_accum", test_sha384_accum_ast2600);
     qtest_add_func("ast2600/hace/sha256_accum", test_sha256_accum_ast2600);
 
     qtest_add_func("ast2500/hace/addresses", test_addresses_ast2500);

From 4f4e25507de719605936c955df3a5a5c560c9986 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Thu, 15 May 2025 16:09:55 +0800
Subject: [PATCH 1145/2760] test/qtest/hace: Add tests for AST1030
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The HACE model in AST2600 and AST1030 is identical. Referencing the AST2600
test cases, new tests have been created for AST1030.

Implemented test functions for SHA-256, SHA-384, SHA-512, and MD5.
Added scatter-gather and accumulation test variants.
For AST1030, the HACE controller base address starts at "0x7e6d0000", and the
SDRAM start address is "0x0".

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Acked-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/qemu-devel/20250515081008.583578-24-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 tests/qtest/aspeed_hace-test.c | 76 ++++++++++++++++++++++++++++++++++
 1 file changed, 76 insertions(+)

diff --git a/tests/qtest/aspeed_hace-test.c b/tests/qtest/aspeed_hace-test.c
index ab0c98330e..31890d574e 100644
--- a/tests/qtest/aspeed_hace-test.c
+++ b/tests/qtest/aspeed_hace-test.c
@@ -10,6 +10,12 @@
 #include "qemu/bitops.h"
 #include "aspeed-hace-utils.h"
 
+static const struct AspeedMasks ast1030_masks = {
+    .src  = 0x7fffffff,
+    .dest = 0x7ffffff8,
+    .len  = 0x0fffffff,
+};
+
 static const struct AspeedMasks ast2600_masks = {
     .src  = 0x7fffffff,
     .dest = 0x7ffffff8,
@@ -28,6 +34,62 @@ static const struct AspeedMasks ast2400_masks = {
     .len  = 0x0fffffff,
 };
 
+/* ast1030 */
+static void test_md5_ast1030(void)
+{
+    aspeed_test_md5("-machine ast1030-evb", 0x7e6d0000, 0x00000000);
+}
+
+static void test_sha256_ast1030(void)
+{
+    aspeed_test_sha256("-machine ast1030-evb", 0x7e6d0000, 0x00000000);
+}
+
+static void test_sha256_sg_ast1030(void)
+{
+    aspeed_test_sha256_sg("-machine ast1030-evb", 0x7e6d0000, 0x00000000);
+}
+
+static void test_sha384_ast1030(void)
+{
+    aspeed_test_sha384("-machine ast1030-evb", 0x7e6d0000, 0x00000000);
+}
+
+static void test_sha384_sg_ast1030(void)
+{
+    aspeed_test_sha384_sg("-machine ast1030-evb", 0x7e6d0000, 0x00000000);
+}
+
+static void test_sha512_ast1030(void)
+{
+    aspeed_test_sha512("-machine ast1030-evb", 0x7e6d0000, 0x00000000);
+}
+
+static void test_sha512_sg_ast1030(void)
+{
+    aspeed_test_sha512_sg("-machine ast1030-evb", 0x7e6d0000, 0x00000000);
+}
+
+static void test_sha256_accum_ast1030(void)
+{
+    aspeed_test_sha256_accum("-machine ast1030-evb", 0x7e6d0000, 0x00000000);
+}
+
+static void test_sha384_accum_ast1030(void)
+{
+    aspeed_test_sha384_accum("-machine ast1030-evb", 0x7e6d0000, 0x00000000);
+}
+
+static void test_sha512_accum_ast1030(void)
+{
+    aspeed_test_sha512_accum("-machine ast1030-evb", 0x7e6d0000, 0x00000000);
+}
+
+static void test_addresses_ast1030(void)
+{
+    aspeed_test_addresses("-machine ast1030-evb", 0x7e6d0000, &ast1030_masks);
+}
+
 /* ast2600 */
 static void test_md5_ast2600(void)
 {
@@ -130,6 +192,20 @@ int main(int argc, char **argv)
 {
     g_test_init(&argc, &argv, NULL);
 
+    qtest_add_func("ast1030/hace/addresses", test_addresses_ast1030);
+    qtest_add_func("ast1030/hace/sha512", test_sha512_ast1030);
+    qtest_add_func("ast1030/hace/sha384", test_sha384_ast1030);
+    qtest_add_func("ast1030/hace/sha256", test_sha256_ast1030);
+    qtest_add_func("ast1030/hace/md5", test_md5_ast1030);
+
+    qtest_add_func("ast1030/hace/sha512_sg", test_sha512_sg_ast1030);
+    qtest_add_func("ast1030/hace/sha384_sg", test_sha384_sg_ast1030);
+    qtest_add_func("ast1030/hace/sha256_sg", test_sha256_sg_ast1030);
+
+    qtest_add_func("ast1030/hace/sha512_accum", test_sha512_accum_ast1030);
+    qtest_add_func("ast1030/hace/sha384_accum", test_sha384_accum_ast1030);
+    qtest_add_func("ast1030/hace/sha256_accum", test_sha256_accum_ast1030);
+
     qtest_add_func("ast2600/hace/addresses", test_addresses_ast2600);
     qtest_add_func("ast2600/hace/sha512", test_sha512_ast2600);
     qtest_add_func("ast2600/hace/sha384", test_sha384_ast2600);

From dcdbbd45a86ad47327282aa3301622cbe65e9fdb Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Thu, 15 May 2025 16:09:56 +0800
Subject: [PATCH 1146/2760] test/qtest/hace: Update source data and digest data
 type to 64-bit
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Currently, the hash data source and digest result buffer addresses are set to
32-bit. However, the AST2700 CPU is a 64-bit Cortex-A35 architecture, and its
DRAM base address is also 64-bit.

To support AST2700, update the hash data source address and digest result buffer
address to use 64-bit addressing.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Acked-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/qemu-devel/20250515081008.583578-25-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 tests/qtest/aspeed-hace-utils.c | 72 ++++++++++++++++-----------------
 tests/qtest/aspeed-hace-utils.h | 20 ++++-----
 2 files changed, 46 insertions(+), 46 deletions(-)

diff --git a/tests/qtest/aspeed-hace-utils.c b/tests/qtest/aspeed-hace-utils.c
index dad90ee81c..1b54870dd4 100644
--- a/tests/qtest/aspeed-hace-utils.c
+++ b/tests/qtest/aspeed-hace-utils.c
@@ -153,22 +153,22 @@ static const uint8_t test_result_accum_sha256[32] = {
     0x5d, 0xae, 0x22, 0x23, 0xb0, 0x03, 0x61, 0xa3, 0x96, 0x17, 0x7a, 0x9c,
     0xb4, 0x10, 0xff, 0x61, 0xf2, 0x00, 0x15, 0xad};
 
-static void write_regs(QTestState *s, uint32_t base, uint32_t src,
-                       uint32_t length, uint32_t out, uint32_t method)
+static void write_regs(QTestState *s, uint32_t base, uint64_t src,
+                       uint32_t length, uint64_t out, uint32_t method)
 {
-        qtest_writel(s, base + HACE_HASH_SRC, src);
-        qtest_writel(s, base + HACE_HASH_DIGEST, out);
+        qtest_writel(s, base + HACE_HASH_SRC, extract64(src, 0, 32));
+        qtest_writel(s, base + HACE_HASH_DIGEST, extract64(out, 0, 32));
         qtest_writel(s, base + HACE_HASH_DATA_LEN, length);
         qtest_writel(s, base + HACE_HASH_CMD, HACE_SHA_BE_EN | method);
 }
 
 void aspeed_test_md5(const char *machine, const uint32_t base,
-                     const uint32_t src_addr)
+                     const uint64_t src_addr)
 
 {
     QTestState *s = qtest_init(machine);
 
-    uint32_t digest_addr = src_addr + 0x010000;
+    uint64_t digest_addr = src_addr + 0x010000;
     uint8_t digest[16] = {0};
 
     /* Check engine is idle, no busy or irq bits set */
@@ -198,11 +198,11 @@ void aspeed_test_md5(const char *machine, const uint32_t base,
 }
 
 void aspeed_test_sha256(const char *machine, const uint32_t base,
-                        const uint32_t src_addr)
+                        const uint64_t src_addr)
 {
     QTestState *s = qtest_init(machine);
 
-    const uint32_t digest_addr = src_addr + 0x10000;
+    const uint64_t digest_addr = src_addr + 0x10000;
     uint8_t digest[32] = {0};
 
     /* Check engine is idle, no busy or irq bits set */
@@ -232,11 +232,11 @@ void aspeed_test_sha256(const char *machine, const uint32_t base,
 }
 
 void aspeed_test_sha384(const char *machine, const uint32_t base,
-                        const uint32_t src_addr)
+                        const uint64_t src_addr)
 {
     QTestState *s = qtest_init(machine);
 
-    const uint32_t digest_addr = src_addr + 0x10000;
+    const uint64_t digest_addr = src_addr + 0x10000;
     uint8_t digest[48] = {0};
 
     /* Check engine is idle, no busy or irq bits set */
@@ -266,11 +266,11 @@ void aspeed_test_sha384(const char *machine, const uint32_t base,
 }
 
 void aspeed_test_sha512(const char *machine, const uint32_t base,
-                        const uint32_t src_addr)
+                        const uint64_t src_addr)
 {
     QTestState *s = qtest_init(machine);
 
-    const uint32_t digest_addr = src_addr + 0x10000;
+    const uint64_t digest_addr = src_addr + 0x10000;
     uint8_t digest[64] = {0};
 
     /* Check engine is idle, no busy or irq bits set */
@@ -300,14 +300,14 @@ void aspeed_test_sha512(const char *machine, const uint32_t base,
 }
 
 void aspeed_test_sha256_sg(const char *machine, const uint32_t base,
-                           const uint32_t src_addr)
+                           const uint64_t src_addr)
 {
     QTestState *s = qtest_init(machine);
 
-    const uint32_t src_addr_1 = src_addr + 0x10000;
-    const uint32_t src_addr_2 = src_addr + 0x20000;
-    const uint32_t src_addr_3 = src_addr + 0x30000;
-    const uint32_t digest_addr = src_addr + 0x40000;
+    const uint64_t src_addr_1 = src_addr + 0x10000;
+    const uint64_t src_addr_2 = src_addr + 0x20000;
+    const uint64_t src_addr_3 = src_addr + 0x30000;
+    const uint64_t digest_addr = src_addr + 0x40000;
     uint8_t digest[32] = {0};
     struct AspeedSgList array[] = {
         {  cpu_to_le32(sizeof(test_vector_sg1)),
@@ -351,14 +351,14 @@ void aspeed_test_sha256_sg(const char *machine, const uint32_t base,
 }
 
 void aspeed_test_sha384_sg(const char *machine, const uint32_t base,
-                           const uint32_t src_addr)
+                           const uint64_t src_addr)
 {
     QTestState *s = qtest_init(machine);
 
-    const uint32_t src_addr_1 = src_addr + 0x10000;
-    const uint32_t src_addr_2 = src_addr + 0x20000;
-    const uint32_t src_addr_3 = src_addr + 0x30000;
-    const uint32_t digest_addr = src_addr + 0x40000;
+    const uint64_t src_addr_1 = src_addr + 0x10000;
+    const uint64_t src_addr_2 = src_addr + 0x20000;
+    const uint64_t src_addr_3 = src_addr + 0x30000;
+    const uint64_t digest_addr = src_addr + 0x40000;
     uint8_t digest[48] = {0};
     struct AspeedSgList array[] = {
         {  cpu_to_le32(sizeof(test_vector_sg1)),
@@ -402,14 +402,14 @@ void aspeed_test_sha384_sg(const char *machine, const uint32_t base,
 }
 
 void aspeed_test_sha512_sg(const char *machine, const uint32_t base,
-                           const uint32_t src_addr)
+                           const uint64_t src_addr)
 {
     QTestState *s = qtest_init(machine);
 
-    const uint32_t src_addr_1 = src_addr + 0x10000;
-    const uint32_t src_addr_2 = src_addr + 0x20000;
-    const uint32_t src_addr_3 = src_addr + 0x30000;
-    const uint32_t digest_addr = src_addr + 0x40000;
+    const uint64_t src_addr_1 = src_addr + 0x10000;
+    const uint64_t src_addr_2 = src_addr + 0x20000;
+    const uint64_t src_addr_3 = src_addr + 0x30000;
+    const uint64_t digest_addr = src_addr + 0x40000;
     uint8_t digest[64] = {0};
     struct AspeedSgList array[] = {
         {  cpu_to_le32(sizeof(test_vector_sg1)),
@@ -453,12 +453,12 @@ void aspeed_test_sha512_sg(const char *machine, const uint32_t base,
 }
 
 void aspeed_test_sha256_accum(const char *machine, const uint32_t base,
-                              const uint32_t src_addr)
+                              const uint64_t src_addr)
 {
     QTestState *s = qtest_init(machine);
 
-    const uint32_t buffer_addr = src_addr + 0x10000;
-    const uint32_t digest_addr = src_addr + 0x40000;
+    const uint64_t buffer_addr = src_addr + 0x10000;
+    const uint64_t digest_addr = src_addr + 0x40000;
     uint8_t digest[32] = {0};
     struct AspeedSgList array[] = {
         {  cpu_to_le32(sizeof(test_vector_accum_256) | SG_LIST_LEN_LAST),
@@ -494,12 +494,12 @@ void aspeed_test_sha256_accum(const char *machine, const uint32_t base,
 }
 
 void aspeed_test_sha384_accum(const char *machine, const uint32_t base,
-                              const uint32_t src_addr)
+                              const uint64_t src_addr)
 {
     QTestState *s = qtest_init(machine);
 
-    const uint32_t buffer_addr = src_addr + 0x10000;
-    const uint32_t digest_addr = src_addr + 0x40000;
+    const uint64_t buffer_addr = src_addr + 0x10000;
+    const uint64_t digest_addr = src_addr + 0x40000;
     uint8_t digest[48] = {0};
     struct AspeedSgList array[] = {
         {  cpu_to_le32(sizeof(test_vector_accum_384) | SG_LIST_LEN_LAST),
@@ -535,12 +535,12 @@ void aspeed_test_sha384_accum(const char *machine, const uint32_t base,
 }
 
 void aspeed_test_sha512_accum(const char *machine, const uint32_t base,
-                              const uint32_t src_addr)
+                              const uint64_t src_addr)
 {
     QTestState *s = qtest_init(machine);
 
-    const uint32_t buffer_addr = src_addr + 0x10000;
-    const uint32_t digest_addr = src_addr + 0x40000;
+    const uint64_t buffer_addr = src_addr + 0x10000;
+    const uint64_t digest_addr = src_addr + 0x40000;
     uint8_t digest[64] = {0};
     struct AspeedSgList array[] = {
         {  cpu_to_le32(sizeof(test_vector_accum_512) | SG_LIST_LEN_LAST),
diff --git a/tests/qtest/aspeed-hace-utils.h b/tests/qtest/aspeed-hace-utils.h
index f4440561de..0382570fa2 100644
--- a/tests/qtest/aspeed-hace-utils.h
+++ b/tests/qtest/aspeed-hace-utils.h
@@ -51,25 +51,25 @@ struct AspeedMasks {
 };
 
 void aspeed_test_md5(const char *machine, const uint32_t base,
-                     const uint32_t src_addr);
+                     const uint64_t src_addr);
 void aspeed_test_sha256(const char *machine, const uint32_t base,
-                        const uint32_t src_addr);
+                        const uint64_t src_addr);
 void aspeed_test_sha384(const char *machine, const uint32_t base,
-                        const uint32_t src_addr);
+                        const uint64_t src_addr);
 void aspeed_test_sha512(const char *machine, const uint32_t base,
-                        const uint32_t src_addr);
+                        const uint64_t src_addr);
 void aspeed_test_sha256_sg(const char *machine, const uint32_t base,
-                           const uint32_t src_addr);
+                           const uint64_t src_addr);
 void aspeed_test_sha384_sg(const char *machine, const uint32_t base,
-                           const uint32_t src_addr);
+                           const uint64_t src_addr);
 void aspeed_test_sha512_sg(const char *machine, const uint32_t base,
-                           const uint32_t src_addr);
+                           const uint64_t src_addr);
 void aspeed_test_sha256_accum(const char *machine, const uint32_t base,
-                              const uint32_t src_addr);
+                              const uint64_t src_addr);
 void aspeed_test_sha384_accum(const char *machine, const uint32_t base,
-                              const uint32_t src_addr);
+                              const uint64_t src_addr);
 void aspeed_test_sha512_accum(const char *machine, const uint32_t base,
-                              const uint32_t src_addr);
+                              const uint64_t src_addr);
 void aspeed_test_addresses(const char *machine, const uint32_t base,
                            const struct AspeedMasks *expected);
 

From 5ced818e42ddb9516137e68556eb03c16a486758 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Thu, 15 May 2025 16:09:57 +0800
Subject: [PATCH 1147/2760] test/qtest/hace: Support 64-bit source and digest
 addresses for AST2700
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Added "HACE_HASH_SRC_HI" and "HACE_HASH_DIGEST_HI", "HACE_HASH_KEY_BUFF_HI"
registers to store upper 32 bits.
Updated "write_regs" to handle 64-bit source and digest addresses.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Acked-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/qemu-devel/20250515081008.583578-26-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 tests/qtest/aspeed-hace-utils.c | 2 ++
 tests/qtest/aspeed-hace-utils.h | 3 +++
 2 files changed, 5 insertions(+)

diff --git a/tests/qtest/aspeed-hace-utils.c b/tests/qtest/aspeed-hace-utils.c
index 1b54870dd4..842bf5630d 100644
--- a/tests/qtest/aspeed-hace-utils.c
+++ b/tests/qtest/aspeed-hace-utils.c
@@ -157,7 +157,9 @@ static void write_regs(QTestState *s, uint32_t base, uint64_t src,
                        uint32_t length, uint64_t out, uint32_t method)
 {
         qtest_writel(s, base + HACE_HASH_SRC, extract64(src, 0, 32));
+        qtest_writel(s, base + HACE_HASH_SRC_HI, extract64(src, 32, 32));
         qtest_writel(s, base + HACE_HASH_DIGEST, extract64(out, 0, 32));
+        qtest_writel(s, base + HACE_HASH_DIGEST_HI, extract64(out, 32, 32));
         qtest_writel(s, base + HACE_HASH_DATA_LEN, length);
         qtest_writel(s, base + HACE_HASH_CMD, HACE_SHA_BE_EN | method);
 }
diff --git a/tests/qtest/aspeed-hace-utils.h b/tests/qtest/aspeed-hace-utils.h
index 0382570fa2..d8684d3f83 100644
--- a/tests/qtest/aspeed-hace-utils.h
+++ b/tests/qtest/aspeed-hace-utils.h
@@ -36,6 +36,9 @@
 #define HACE_HASH_KEY_BUFF       0x28
 #define HACE_HASH_DATA_LEN       0x2c
 #define HACE_HASH_CMD            0x30
+#define HACE_HASH_SRC_HI         0x90
+#define HACE_HASH_DIGEST_HI      0x94
+#define HACE_HASH_KEY_BUFF_HI    0x98
 
 /* Scatter-Gather Hash */
 #define SG_LIST_LEN_LAST         BIT(31)

From 88d8515fb76ca7b3de8a4cc89264e8494655567e Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Thu, 15 May 2025 16:09:58 +0800
Subject: [PATCH 1148/2760] test/qtest/hace: Support to test upper 32 bits of
 digest and source addresses
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Added "src_hi" and "dest_hi" fields to "AspeedMasks" for 64-bit addresses test.
Updated "aspeed_test_addresses" to validate "HACE_HASH_SRC_HI" and
"HACE_HASH_DIGEST_HI".
Ensured correct masking of 64-bit addresses by checking both lower and upper
32-bit registers.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Acked-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/qemu-devel/20250515081008.583578-27-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 tests/qtest/aspeed-hace-utils.c | 15 ++++++++++++++-
 tests/qtest/aspeed-hace-utils.h |  2 ++
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/tests/qtest/aspeed-hace-utils.c b/tests/qtest/aspeed-hace-utils.c
index 842bf5630d..cb78f18117 100644
--- a/tests/qtest/aspeed-hace-utils.c
+++ b/tests/qtest/aspeed-hace-utils.c
@@ -588,30 +588,43 @@ void aspeed_test_addresses(const char *machine, const uint32_t base,
      */
     g_assert_cmphex(qtest_readl(s, base + HACE_CMD), ==, 0);
     g_assert_cmphex(qtest_readl(s, base + HACE_HASH_SRC), ==, 0);
+    g_assert_cmphex(qtest_readl(s, base + HACE_HASH_SRC_HI), ==, 0);
     g_assert_cmphex(qtest_readl(s, base + HACE_HASH_DIGEST), ==, 0);
+    g_assert_cmphex(qtest_readl(s, base + HACE_HASH_DIGEST_HI), ==, 0);
     g_assert_cmphex(qtest_readl(s, base + HACE_HASH_DATA_LEN), ==, 0);
 
-
     /* Check that the address masking is correct */
     qtest_writel(s, base + HACE_HASH_SRC, 0xffffffff);
     g_assert_cmphex(qtest_readl(s, base + HACE_HASH_SRC), ==, expected->src);
 
+    qtest_writel(s, base + HACE_HASH_SRC_HI, 0xffffffff);
+    g_assert_cmphex(qtest_readl(s, base + HACE_HASH_SRC_HI),
+                    ==, expected->src_hi);
+
     qtest_writel(s, base + HACE_HASH_DIGEST, 0xffffffff);
     g_assert_cmphex(qtest_readl(s, base + HACE_HASH_DIGEST), ==,
                     expected->dest);
 
+    qtest_writel(s, base + HACE_HASH_DIGEST_HI, 0xffffffff);
+    g_assert_cmphex(qtest_readl(s, base + HACE_HASH_DIGEST_HI), ==,
+                    expected->dest_hi);
+
     qtest_writel(s, base + HACE_HASH_DATA_LEN, 0xffffffff);
     g_assert_cmphex(qtest_readl(s, base + HACE_HASH_DATA_LEN), ==,
                     expected->len);
 
     /* Reset to zero */
     qtest_writel(s, base + HACE_HASH_SRC, 0);
+    qtest_writel(s, base + HACE_HASH_SRC_HI, 0);
     qtest_writel(s, base + HACE_HASH_DIGEST, 0);
+    qtest_writel(s, base + HACE_HASH_DIGEST_HI, 0);
     qtest_writel(s, base + HACE_HASH_DATA_LEN, 0);
 
     /* Check that all bits are now zero */
     g_assert_cmphex(qtest_readl(s, base + HACE_HASH_SRC), ==, 0);
+    g_assert_cmphex(qtest_readl(s, base + HACE_HASH_SRC_HI), ==, 0);
     g_assert_cmphex(qtest_readl(s, base + HACE_HASH_DIGEST), ==, 0);
+    g_assert_cmphex(qtest_readl(s, base + HACE_HASH_DIGEST_HI), ==, 0);
     g_assert_cmphex(qtest_readl(s, base + HACE_HASH_DATA_LEN), ==, 0);
 
     qtest_quit(s);
diff --git a/tests/qtest/aspeed-hace-utils.h b/tests/qtest/aspeed-hace-utils.h
index d8684d3f83..de8055a1db 100644
--- a/tests/qtest/aspeed-hace-utils.h
+++ b/tests/qtest/aspeed-hace-utils.h
@@ -51,6 +51,8 @@ struct AspeedMasks {
     uint32_t src;
     uint32_t dest;
     uint32_t len;
+    uint32_t src_hi;
+    uint32_t dest_hi;
 };
 
 void aspeed_test_md5(const char *machine, const uint32_t base,

From 823288fc136f8d4b165d2eb573306893e43bcdff Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Thu, 15 May 2025 16:09:59 +0800
Subject: [PATCH 1149/2760] test/qtest/hace: Support to validate 64-bit hmac
 key buffer addresses
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Added "key" and "key_hi" fields to "AspeedMasks" for 64-bit addresses test.
Updated "aspeed_test_addresses" to validate "HACE_HASH_KEY_BUFF" and
"HACE_HASH_KEY_BUFF_HI".
Ensured correct masking of 64-bit addresses by checking both lower and upper
32-bit registers.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Acked-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/qemu-devel/20250515081008.583578-28-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 tests/qtest/aspeed-hace-utils.c | 14 ++++++++++++++
 tests/qtest/aspeed-hace-utils.h |  2 ++
 tests/qtest/aspeed_hace-test.c  |  4 ++++
 3 files changed, 20 insertions(+)

diff --git a/tests/qtest/aspeed-hace-utils.c b/tests/qtest/aspeed-hace-utils.c
index cb78f18117..0f7f911e5e 100644
--- a/tests/qtest/aspeed-hace-utils.c
+++ b/tests/qtest/aspeed-hace-utils.c
@@ -591,6 +591,8 @@ void aspeed_test_addresses(const char *machine, const uint32_t base,
     g_assert_cmphex(qtest_readl(s, base + HACE_HASH_SRC_HI), ==, 0);
     g_assert_cmphex(qtest_readl(s, base + HACE_HASH_DIGEST), ==, 0);
     g_assert_cmphex(qtest_readl(s, base + HACE_HASH_DIGEST_HI), ==, 0);
+    g_assert_cmphex(qtest_readl(s, base + HACE_HASH_KEY_BUFF), ==, 0);
+    g_assert_cmphex(qtest_readl(s, base + HACE_HASH_KEY_BUFF_HI), ==, 0);
     g_assert_cmphex(qtest_readl(s, base + HACE_HASH_DATA_LEN), ==, 0);
 
     /* Check that the address masking is correct */
@@ -609,6 +611,14 @@ void aspeed_test_addresses(const char *machine, const uint32_t base,
     g_assert_cmphex(qtest_readl(s, base + HACE_HASH_DIGEST_HI), ==,
                     expected->dest_hi);
 
+    qtest_writel(s, base + HACE_HASH_KEY_BUFF, 0xffffffff);
+    g_assert_cmphex(qtest_readl(s, base + HACE_HASH_KEY_BUFF), ==,
+                    expected->key);
+
+    qtest_writel(s, base + HACE_HASH_KEY_BUFF_HI, 0xffffffff);
+    g_assert_cmphex(qtest_readl(s, base + HACE_HASH_KEY_BUFF_HI), ==,
+                    expected->key_hi);
+
     qtest_writel(s, base + HACE_HASH_DATA_LEN, 0xffffffff);
     g_assert_cmphex(qtest_readl(s, base + HACE_HASH_DATA_LEN), ==,
                     expected->len);
@@ -618,6 +628,8 @@ void aspeed_test_addresses(const char *machine, const uint32_t base,
     qtest_writel(s, base + HACE_HASH_SRC_HI, 0);
     qtest_writel(s, base + HACE_HASH_DIGEST, 0);
     qtest_writel(s, base + HACE_HASH_DIGEST_HI, 0);
+    qtest_writel(s, base + HACE_HASH_KEY_BUFF, 0);
+    qtest_writel(s, base + HACE_HASH_KEY_BUFF_HI, 0);
     qtest_writel(s, base + HACE_HASH_DATA_LEN, 0);
 
     /* Check that all bits are now zero */
@@ -625,6 +637,8 @@ void aspeed_test_addresses(const char *machine, const uint32_t base,
     g_assert_cmphex(qtest_readl(s, base + HACE_HASH_SRC_HI), ==, 0);
     g_assert_cmphex(qtest_readl(s, base + HACE_HASH_DIGEST), ==, 0);
     g_assert_cmphex(qtest_readl(s, base + HACE_HASH_DIGEST_HI), ==, 0);
+    g_assert_cmphex(qtest_readl(s, base + HACE_HASH_KEY_BUFF), ==, 0);
+    g_assert_cmphex(qtest_readl(s, base + HACE_HASH_KEY_BUFF_HI), ==, 0);
     g_assert_cmphex(qtest_readl(s, base + HACE_HASH_DATA_LEN), ==, 0);
 
     qtest_quit(s);
diff --git a/tests/qtest/aspeed-hace-utils.h b/tests/qtest/aspeed-hace-utils.h
index de8055a1db..c8b2ec45af 100644
--- a/tests/qtest/aspeed-hace-utils.h
+++ b/tests/qtest/aspeed-hace-utils.h
@@ -50,9 +50,11 @@ struct AspeedSgList {
 struct AspeedMasks {
     uint32_t src;
     uint32_t dest;
+    uint32_t key;
     uint32_t len;
     uint32_t src_hi;
     uint32_t dest_hi;
+    uint32_t key_hi;
 };
 
 void aspeed_test_md5(const char *machine, const uint32_t base,
diff --git a/tests/qtest/aspeed_hace-test.c b/tests/qtest/aspeed_hace-test.c
index 31890d574e..38777020ca 100644
--- a/tests/qtest/aspeed_hace-test.c
+++ b/tests/qtest/aspeed_hace-test.c
@@ -13,24 +13,28 @@
 static const struct AspeedMasks ast1030_masks = {
     .src  = 0x7fffffff,
     .dest = 0x7ffffff8,
+    .key = 0x7ffffff8,
     .len  = 0x0fffffff,
 };
 
 static const struct AspeedMasks ast2600_masks = {
     .src  = 0x7fffffff,
     .dest = 0x7ffffff8,
+    .key = 0x7ffffff8,
     .len  = 0x0fffffff,
 };
 
 static const struct AspeedMasks ast2500_masks = {
     .src  = 0x3fffffff,
     .dest = 0x3ffffff8,
+    .key = 0x3fffffc0,
     .len  = 0x0fffffff,
 };
 
 static const struct AspeedMasks ast2400_masks = {
     .src  = 0x0fffffff,
     .dest = 0x0ffffff8,
+    .key = 0x0fffffc0,
     .len  = 0x0fffffff,
 };
 

From 5071c229106dc6fc46fd1b7667ffa12e0bc47b1d Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Thu, 15 May 2025 16:10:00 +0800
Subject: [PATCH 1150/2760] test/qtest/hace: Add tests for AST2700
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The HACE models in AST2600 and AST2700 are nearly identical. Based on the
AST2600 test cases, new tests have been added for AST2700.

Implemented test functions for SHA-256, SHA-384, SHA-512, and MD5.
Added scatter-gather and accumulation test variants.
For AST2700, the HACE controller base address starts at "0x12070000", and
the DRAM start address is "0x4_00000000".

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Acked-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/qemu-devel/20250515081008.583578-29-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 tests/qtest/ast2700-hace-test.c | 98 +++++++++++++++++++++++++++++++++
 tests/qtest/meson.build         |  2 +
 2 files changed, 100 insertions(+)
 create mode 100644 tests/qtest/ast2700-hace-test.c

diff --git a/tests/qtest/ast2700-hace-test.c b/tests/qtest/ast2700-hace-test.c
new file mode 100644
index 0000000000..a400e2962b
--- /dev/null
+++ b/tests/qtest/ast2700-hace-test.c
@@ -0,0 +1,98 @@
+/*
+ * QTest testcase for the ASPEED Hash and Crypto Engine
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ * Copyright (C) 2025 ASPEED Technology Inc.
+ */
+
+#include "qemu/osdep.h"
+#include "libqtest.h"
+#include "qemu/bitops.h"
+#include "aspeed-hace-utils.h"
+
+static const struct AspeedMasks as2700_masks = {
+    .src  = 0x7fffffff,
+    .dest = 0x7ffffff8,
+    .key = 0x7ffffff8,
+    .len  = 0x0fffffff,
+    .src_hi  = 0x00000003,
+    .dest_hi = 0x00000003,
+    .key_hi = 0x00000003,
+};
+
+/* ast2700 */
+static void test_md5_ast2700(void)
+{
+    aspeed_test_md5("-machine ast2700a1-evb", 0x12070000, 0x400000000);
+}
+
+static void test_sha256_ast2700(void)
+{
+    aspeed_test_sha256("-machine ast2700a1-evb", 0x12070000, 0x400000000);
+}
+
+static void test_sha256_sg_ast2700(void)
+{
+    aspeed_test_sha256_sg("-machine ast2700a1-evb", 0x12070000, 0x400000000);
+}
+
+static void test_sha384_ast2700(void)
+{
+    aspeed_test_sha384("-machine ast2700a1-evb", 0x12070000, 0x400000000);
+}
+
+static void test_sha384_sg_ast2700(void)
+{
+    aspeed_test_sha384_sg("-machine ast2700a1-evb", 0x12070000, 0x400000000);
+}
+
+static void test_sha512_ast2700(void)
+{
+    aspeed_test_sha512("-machine ast2700a1-evb", 0x12070000, 0x400000000);
+}
+
+static void test_sha512_sg_ast2700(void)
+{
+    aspeed_test_sha512_sg("-machine ast2700a1-evb", 0x12070000, 0x400000000);
+}
+
+static void test_sha256_accum_ast2700(void)
+{
+    aspeed_test_sha256_accum("-machine ast2700a1-evb", 0x12070000, 0x400000000);
+}
+
+static void test_sha384_accum_ast2700(void)
+{
+    aspeed_test_sha384_accum("-machine ast2700a1-evb", 0x12070000, 0x400000000);
+}
+
+static void test_sha512_accum_ast2700(void)
+{
+    aspeed_test_sha512_accum("-machine ast2700a1-evb", 0x12070000, 0x400000000);
+}
+
+static void test_addresses_ast2700(void)
+{
+    aspeed_test_addresses("-machine ast2700a1-evb", 0x12070000, &as2700_masks);
+}
+
+int main(int argc, char **argv)
+{
+    g_test_init(&argc, &argv, NULL);
+
+    qtest_add_func("ast2700/hace/addresses", test_addresses_ast2700);
+    qtest_add_func("ast2700/hace/sha512", test_sha512_ast2700);
+    qtest_add_func("ast2700/hace/sha384", test_sha384_ast2700);
+    qtest_add_func("ast2700/hace/sha256", test_sha256_ast2700);
+    qtest_add_func("ast2700/hace/md5", test_md5_ast2700);
+
+    qtest_add_func("ast2700/hace/sha512_sg", test_sha512_sg_ast2700);
+    qtest_add_func("ast2700/hace/sha384_sg", test_sha384_sg_ast2700);
+    qtest_add_func("ast2700/hace/sha256_sg", test_sha256_sg_ast2700);
+
+    qtest_add_func("ast2700/hace/sha512_accum", test_sha512_accum_ast2700);
+    qtest_add_func("ast2700/hace/sha384_accum", test_sha384_accum_ast2700);
+    qtest_add_func("ast2700/hace/sha256_accum", test_sha256_accum_ast2700);
+
+    return g_test_run();
+}
diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
index 26d83cd9dd..43e5a86699 100644
--- a/tests/qtest/meson.build
+++ b/tests/qtest/meson.build
@@ -217,6 +217,7 @@ qtests_aspeed = \
    'aspeed_smc-test']
 qtests_aspeed64 = \
   ['ast2700-gpio-test',
+   'ast2700-hace-test',
    'ast2700-smc-test']
 
 qtests_stm32l4x5 = \
@@ -363,6 +364,7 @@ endif
 qtests = {
   'aspeed_hace-test': files('aspeed-hace-utils.c', 'aspeed_hace-test.c'),
   'aspeed_smc-test': files('aspeed-smc-utils.c', 'aspeed_smc-test.c'),
+  'ast2700-hace-test': files('aspeed-hace-utils.c', 'ast2700-hace-test.c'),
   'ast2700-smc-test': files('aspeed-smc-utils.c', 'ast2700-smc-test.c'),
   'bios-tables-test': [io, 'boot-sector.c', 'acpi-utils.c', 'tpm-emu.c'],
   'cdrom-test': files('boot-sector.c'),

From 5c14d7cbd42326bf35d18cb765015edfc9883272 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Thu, 22 May 2025 10:33:02 +0800
Subject: [PATCH 1151/2760] hw/intc/aspeed: Set impl.min_access_size to 4
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This patch explicitly sets ".impl.min_access_size = 4" to match the
declared ".valid.min_access_size = 4", enforcing stricter access size
checking and preventing inconsistent partial accesses to the interrupt
controller registers.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250522023305.2486536-2-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/intc/aspeed_intc.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/hw/intc/aspeed_intc.c b/hw/intc/aspeed_intc.c
index 33fcbe729c..19f88853d8 100644
--- a/hw/intc/aspeed_intc.c
+++ b/hw/intc/aspeed_intc.c
@@ -737,6 +737,7 @@ static const MemoryRegionOps aspeed_intc_ops = {
     .read = aspeed_intc_read,
     .write = aspeed_intc_write,
     .endianness = DEVICE_LITTLE_ENDIAN,
+    .impl.min_access_size = 4,
     .valid = {
         .min_access_size = 4,
         .max_access_size = 4,
@@ -747,6 +748,7 @@ static const MemoryRegionOps aspeed_intcio_ops = {
     .read = aspeed_intcio_read,
     .write = aspeed_intcio_write,
     .endianness = DEVICE_LITTLE_ENDIAN,
+    .impl.min_access_size = 4,
     .valid = {
         .min_access_size = 4,
         .max_access_size = 4,
@@ -757,6 +759,7 @@ static const MemoryRegionOps aspeed_ssp_intc_ops = {
     .read = aspeed_intc_read,
     .write = aspeed_ssp_intc_write,
     .endianness = DEVICE_LITTLE_ENDIAN,
+    .impl.min_access_size = 4,
     .valid = {
         .min_access_size = 4,
         .max_access_size = 4,
@@ -767,6 +770,7 @@ static const MemoryRegionOps aspeed_ssp_intcio_ops = {
     .read = aspeed_intcio_read,
     .write = aspeed_ssp_intcio_write,
     .endianness = DEVICE_LITTLE_ENDIAN,
+    .impl.min_access_size = 4,
     .valid = {
         .min_access_size = 4,
         .max_access_size = 4,
@@ -777,6 +781,7 @@ static const MemoryRegionOps aspeed_tsp_intc_ops = {
     .read = aspeed_intc_read,
     .write = aspeed_tsp_intc_write,
     .endianness = DEVICE_LITTLE_ENDIAN,
+    .impl.min_access_size = 4,
     .valid = {
         .min_access_size = 4,
         .max_access_size = 4,
@@ -787,6 +792,7 @@ static const MemoryRegionOps aspeed_tsp_intcio_ops = {
     .read = aspeed_intcio_read,
     .write = aspeed_tsp_intcio_write,
     .endianness = DEVICE_LITTLE_ENDIAN,
+    .impl.min_access_size = 4,
     .valid = {
         .min_access_size = 4,
         .max_access_size = 4,

From 567accba673326a37b7c9210f613c86afe2965ff Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Thu, 22 May 2025 10:33:03 +0800
Subject: [PATCH 1152/2760] hw/intc/aspeed Fix coding style
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fix coding style issues from checkpatch.pl.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250522023305.2486536-3-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/intc/aspeed_intc.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/hw/intc/aspeed_intc.c b/hw/intc/aspeed_intc.c
index 19f88853d8..5cd786dee6 100644
--- a/hw/intc/aspeed_intc.c
+++ b/hw/intc/aspeed_intc.c
@@ -1001,7 +1001,8 @@ static AspeedINTCIRQ aspeed_2700ssp_intcio_irqs[ASPEED_INTC_MAX_INPINS] = {
     {5, 5, 1, R_SSPINT165_EN, R_SSPINT165_STATUS},
 };
 
-static void aspeed_2700ssp_intcio_class_init(ObjectClass *klass, const void *data)
+static void aspeed_2700ssp_intcio_class_init(ObjectClass *klass,
+                                             const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     AspeedINTCClass *aic = ASPEED_INTC_CLASS(klass);
@@ -1069,7 +1070,8 @@ static AspeedINTCIRQ aspeed_2700tsp_intcio_irqs[ASPEED_INTC_MAX_INPINS] = {
     {5, 5, 1, R_TSPINT165_EN, R_TSPINT165_STATUS},
 };
 
-static void aspeed_2700tsp_intcio_class_init(ObjectClass *klass, const void *data)
+static void aspeed_2700tsp_intcio_class_init(ObjectClass *klass,
+                                             const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     AspeedINTCClass *aic = ASPEED_INTC_CLASS(klass);

From e6941ac106190490d8b455eedc5b368e6d94d4cc Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Thu, 22 May 2025 10:33:04 +0800
Subject: [PATCH 1153/2760] hw/arm/aspeed_ast27x0: Fix RAM size detection
 failure on BE hosts
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

On big-endian hosts, the aspeed_ram_capacity_write() function previously passed
the address of a 64-bit "data" variable directly to address_space_write(),
assuming host and guest endianness matched.

However, the data is expected to be written in little-endian format to DRAM.
On big-endian hosts, this led to incorrect data being written into DRAM,
which caused the guest firmware to misdetect the DRAM size.

As a result, U-Boot fails to boot and hangs.

- Replaces the "address_space_write()" call with "address_space_stl_le()",
  which performs an explicit 32-bit little-endian write.
- Updating the MemoryRegionOps to restrict access to exactly 4 bytes
  using .valid.{min,max}_access_size = 4 and .impl.min_access_size = 4.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Fixes: 7436db1 ("aspeed/soc: fix incorrect dram size for AST2700")
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250522023305.2486536-4-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed_ast27x0.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/hw/arm/aspeed_ast27x0.c b/hw/arm/aspeed_ast27x0.c
index 1974a25766..82a5ecff04 100644
--- a/hw/arm/aspeed_ast27x0.c
+++ b/hw/arm/aspeed_ast27x0.c
@@ -346,8 +346,9 @@ static void aspeed_ram_capacity_write(void *opaque, hwaddr addr, uint64_t data,
      * If writes the data to the address which is beyond the ram size,
      * it would write the data to the "address % ram_size".
      */
-    result = address_space_write(&s->dram_as, addr % ram_size,
-                                 MEMTXATTRS_UNSPECIFIED, &data, 4);
+    address_space_stl_le(&s->dram_as, addr % ram_size, data,
+                         MEMTXATTRS_UNSPECIFIED, &result);
+
     if (result != MEMTX_OK) {
         qemu_log_mask(LOG_GUEST_ERROR,
                       "%s: DRAM write failed, addr:0x%" HWADDR_PRIx
@@ -360,9 +361,10 @@ static const MemoryRegionOps aspeed_ram_capacity_ops = {
     .read = aspeed_ram_capacity_read,
     .write = aspeed_ram_capacity_write,
     .endianness = DEVICE_LITTLE_ENDIAN,
+    .impl.min_access_size = 4,
     .valid = {
-        .min_access_size = 1,
-        .max_access_size = 8,
+        .min_access_size = 4,
+        .max_access_size = 4,
     },
 };
 

From 453b928ab93415ebf5519d946a77e905a2f1ec12 Mon Sep 17 00:00:00 2001
From: Steven Lee <steven_lee@aspeedtech.com>
Date: Fri, 23 May 2025 17:31:38 +0800
Subject: [PATCH 1154/2760] hw/arm/aspeed_ast2700-fc: Add network support
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This patch adds network support to the ast2700fc machine by initializing
the NIC device in the ca35.

Signed-off-by: Steven Lee <steven_lee@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250523093144.991408-2-steven_lee@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed_ast27x0-fc.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/hw/arm/aspeed_ast27x0-fc.c b/hw/arm/aspeed_ast27x0-fc.c
index 125a3ade40..7bf4f2a52d 100644
--- a/hw/arm/aspeed_ast27x0-fc.c
+++ b/hw/arm/aspeed_ast27x0-fc.c
@@ -86,6 +86,13 @@ static void ast2700fc_ca35_init(MachineState *machine)
                                  AST2700FC_BMC_RAM_SIZE, &error_abort)) {
         return;
     }
+
+    for (int i = 0; i < sc->macs_num; i++) {
+        if (!qemu_configure_nic_device(DEVICE(&soc->ftgmac100[i]),
+                                       true, NULL)) {
+            break;
+        }
+    }
     if (!object_property_set_int(OBJECT(&s->ca35), "hw-strap1",
                                  AST2700FC_HW_STRAP1, &error_abort)) {
         return;

From 61162c6f89d1e07788c5bd8a9b7f778102f8a1eb Mon Sep 17 00:00:00 2001
From: Steven Lee <steven_lee@aspeedtech.com>
Date: Fri, 23 May 2025 17:31:39 +0800
Subject: [PATCH 1155/2760] hw/arm/aspeed_ast2700-fc: Reduce ca35 ram size to
 align with ast2700a1
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reduce ca35 ram size from 2GiB to 1GiB to align with ast2700a1-evb,
where the ram-container is defined as 1GiB in its class.

Signed-off-by: Steven Lee <steven_lee@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250523093144.991408-3-steven_lee@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed_ast27x0-fc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/arm/aspeed_ast27x0-fc.c b/hw/arm/aspeed_ast27x0-fc.c
index 7bf4f2a52d..f8cb632bca 100644
--- a/hw/arm/aspeed_ast27x0-fc.c
+++ b/hw/arm/aspeed_ast27x0-fc.c
@@ -48,7 +48,7 @@ struct Ast2700FCState {
     bool mmio_exec;
 };
 
-#define AST2700FC_BMC_RAM_SIZE (2 * GiB)
+#define AST2700FC_BMC_RAM_SIZE (1 * GiB)
 #define AST2700FC_CM4_DRAM_SIZE (32 * MiB)
 
 #define AST2700FC_HW_STRAP1 0x000000C0

From 221d22d830eb1a96f780eec28e6a45286b85fe85 Mon Sep 17 00:00:00 2001
From: Steven Lee <steven_lee@aspeedtech.com>
Date: Fri, 23 May 2025 17:31:40 +0800
Subject: [PATCH 1156/2760] hw/arm/aspeed_ast27x0: Fix unimplemented region
 overlap with vbootrom
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The unimplemented memory region overlaps with the VBootROM address
range, causing incorrect memory layout.

This patch adjusts the size and start address of the unimplemented
region to avoid collision. The IO memory region (ASPEED_DEV_IOMEM) is
now moved to 0x20000 to reserve space for VBootROM at 0x0.

Although the memory range 0x20000 - 0x10000000 is undefined in the
datasheet and should not be required, further testing shows OP-TEE
or U-Boot may access 0x400000 during early boot.
Removing the unimplemented region causes firmware hangs.

To prevent unexpected accesses, retain the region as a safeguard.

Signed-off-by: Steven Lee <steven_lee@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250523093144.991408-4-steven_lee@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed_ast27x0.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/arm/aspeed_ast27x0.c b/hw/arm/aspeed_ast27x0.c
index 82a5ecff04..6aa3841b69 100644
--- a/hw/arm/aspeed_ast27x0.c
+++ b/hw/arm/aspeed_ast27x0.c
@@ -23,14 +23,14 @@
 #include "qobject/qlist.h"
 #include "qemu/log.h"
 
-#define AST2700_SOC_IO_SIZE          0x01000000
+#define AST2700_SOC_IO_SIZE          0x00FE0000
 #define AST2700_SOC_IOMEM_SIZE       0x01000000
 #define AST2700_SOC_DPMCU_SIZE       0x00040000
 #define AST2700_SOC_LTPI_SIZE        0x01000000
 
 static const hwaddr aspeed_soc_ast2700_memmap[] = {
-    [ASPEED_DEV_IOMEM]     =  0x00000000,
     [ASPEED_DEV_VBOOTROM]  =  0x00000000,
+    [ASPEED_DEV_IOMEM]     =  0x00020000,
     [ASPEED_DEV_SRAM]      =  0x10000000,
     [ASPEED_DEV_DPMCU]     =  0x11000000,
     [ASPEED_DEV_IOMEM0]    =  0x12000000,

From bb1747a39b162bdfbf33d53846ed4e7a99f2e75f Mon Sep 17 00:00:00 2001
From: Steven Lee <steven_lee@aspeedtech.com>
Date: Fri, 23 May 2025 17:31:41 +0800
Subject: [PATCH 1157/2760] hw/arm/aspeed_ast27x0-fc: Map ca35 memory into
 system memory
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Map the CA35 memory region as a subregion of system_memory to ensure
a valid FlatView. This prevents failures in APIs that rely on the
global memory view, such as rom_check_and_register_reset().

Signed-off-by: Steven Lee <steven_lee@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250523093144.991408-5-steven_lee@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed_ast27x0-fc.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/arm/aspeed_ast27x0-fc.c b/hw/arm/aspeed_ast27x0-fc.c
index f8cb632bca..7087be4288 100644
--- a/hw/arm/aspeed_ast27x0-fc.c
+++ b/hw/arm/aspeed_ast27x0-fc.c
@@ -68,6 +68,7 @@ static void ast2700fc_ca35_init(MachineState *machine)
 
     memory_region_init(&s->ca35_memory, OBJECT(&s->ca35), "ca35-memory",
                        UINT64_MAX);
+    memory_region_add_subregion(get_system_memory(), 0, &s->ca35_memory);
 
     if (!memory_region_init_ram(&s->ca35_dram, OBJECT(&s->ca35), "ca35-dram",
                                 AST2700FC_BMC_RAM_SIZE, &error_abort)) {

From b21d68c34ec25391f6c1a588bdb5c88bd24bb87f Mon Sep 17 00:00:00 2001
From: Steven Lee <steven_lee@aspeedtech.com>
Date: Fri, 23 May 2025 17:31:42 +0800
Subject: [PATCH 1158/2760] hw/arm/fby35: Map BMC memory into system memory
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add the BMC memory region as a subregion of system_memory so that
modules relying on system memory can operate correctly.

Signed-off-by: Steven Lee <steven_lee@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250523093144.991408-6-steven_lee@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/fby35.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/arm/fby35.c b/hw/arm/fby35.c
index e123fa69e1..c14fc2efe9 100644
--- a/hw/arm/fby35.c
+++ b/hw/arm/fby35.c
@@ -77,6 +77,7 @@ static void fby35_bmc_init(Fby35State *s)
 
     memory_region_init(&s->bmc_memory, OBJECT(&s->bmc), "bmc-memory",
                        UINT64_MAX);
+    memory_region_add_subregion(get_system_memory(), 0, &s->bmc_memory);
     memory_region_init_ram(&s->bmc_dram, OBJECT(&s->bmc), "bmc-dram",
                            FBY35_BMC_RAM_SIZE, &error_abort);
 

From 8eaea4012c215a610b2bd6dcc7812e805e14dd0c Mon Sep 17 00:00:00 2001
From: Steven Lee <steven_lee@aspeedtech.com>
Date: Fri, 23 May 2025 17:31:43 +0800
Subject: [PATCH 1159/2760] docs: Remove ast2700fc from Aspeed family boards
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The ast2700fc machine is now covered in the dedicated ast2700-evb
section. Listing it in the general Aspeed board family list is
redundant.

Signed-off-by: Steven Lee <steven_lee@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250523093144.991408-7-steven_lee@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 docs/system/arm/aspeed.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/system/arm/aspeed.rst b/docs/system/arm/aspeed.rst
index 58a8020eec..43d27d83cb 100644
--- a/docs/system/arm/aspeed.rst
+++ b/docs/system/arm/aspeed.rst
@@ -1,4 +1,4 @@
-Aspeed family boards (``ast2500-evb``, ``ast2600-evb``, ``ast2700-evb``, ``ast2700fc``, ``bletchley-bmc``, ``fuji-bmc``, ``fby35-bmc``, ``fp5280g2-bmc``, ``g220a-bmc``, ``palmetto-bmc``, ``qcom-dc-scm-v1-bmc``, ``qcom-firework-bmc``, ``quanta-q71l-bmc``, ``rainier-bmc``, ``romulus-bmc``, ``sonorapass-bmc``, ``supermicrox11-bmc``, ``supermicrox11spi-bmc``, ``tiogapass-bmc``, ``witherspoon-bmc``, ``yosemitev2-bmc``)
+Aspeed family boards (``ast2500-evb``, ``ast2600-evb``, ``ast2700-evb``, ``bletchley-bmc``, ``fuji-bmc``, ``fby35-bmc``, ``fp5280g2-bmc``, ``g220a-bmc``, ``palmetto-bmc``, ``qcom-dc-scm-v1-bmc``, ``qcom-firework-bmc``, ``quanta-q71l-bmc``, ``rainier-bmc``, ``romulus-bmc``, ``sonorapass-bmc``, ``supermicrox11-bmc``, ``supermicrox11spi-bmc``, ``tiogapass-bmc``, ``witherspoon-bmc``, ``yosemitev2-bmc``)
 =================================================================================================================================================================================================================================================================================================================================================================================================================================
 
 The QEMU Aspeed machines model BMCs of various OpenPOWER systems and

From 4fb54de823e9d5b88b7f708516a2a9bf997d15c2 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Wed, 21 May 2025 15:34:08 -0700
Subject: [PATCH 1160/2760] meson: build target libraries with common
 dependencies
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

As mentioned in [1], dependencies
were missing when compiling per target libraries, thus breaking
compilation on certain host systems.

We now explicitly add common dependencies to those libraries, so it
solves the problem.

[1] https://lore.kernel.org/qemu-devel/20250513115637.184940-1-thuth@redhat.com/

Tested-by: Thomas Huth <thuth@redhat.com>
Fixes: 6f4e8a92bbd ("hw/arm: make most of the compilation units common")
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/r/20250521223414.248276-2-pierrick.bouvier@linaro.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 meson.build | 75 ++++++++++++++++++++++++++++-------------------------
 1 file changed, 40 insertions(+), 35 deletions(-)

diff --git a/meson.build b/meson.build
index ad2053f968..cbb22f60d1 100644
--- a/meson.build
+++ b/meson.build
@@ -3242,6 +3242,7 @@ config_devices_mak_list = []
 config_devices_h = {}
 config_target_h = {}
 config_target_mak = {}
+config_base_arch_mak = {}
 
 disassemblers = {
   'alpha' : ['CONFIG_ALPHA_DIS'],
@@ -3433,6 +3434,11 @@ foreach target : target_dirs
     config_all_devices += config_devices
   endif
   config_target_mak += {target: config_target}
+
+  # build a merged config for all targets with the same TARGET_BASE_ARCH
+  target_base_arch = config_target['TARGET_BASE_ARCH']
+  config_base_arch = config_base_arch_mak.get(target_base_arch, {}) + config_target
+  config_base_arch_mak += {target_base_arch: config_base_arch}
 endforeach
 target_dirs = actual_target_dirs
 
@@ -4111,57 +4117,56 @@ common_all = static_library('common',
 hw_common_arch_libs = {}
 target_common_arch_libs = {}
 target_common_system_arch_libs = {}
-foreach target : target_dirs
+foreach target_base_arch, config_base_arch : config_base_arch_mak
   config_target = config_target_mak[target]
-  target_base_arch = config_target['TARGET_BASE_ARCH']
   target_inc = [include_directories('target' / target_base_arch)]
   inc = [common_user_inc + target_inc]
 
+  target_common = common_ss.apply(config_target, strict: false)
+  common_deps = []
+  foreach dep: target_common.dependencies()
+    common_deps += dep.partial_dependency(compile_args: true, includes: true)
+  endforeach
+
   # prevent common code to access cpu compile time definition,
   # but still allow access to cpu.h
   target_c_args = ['-DCPU_DEFS_H']
   target_system_c_args = target_c_args + ['-DCOMPILING_SYSTEM_VS_USER', '-DCONFIG_SOFTMMU']
 
   if target_base_arch in hw_common_arch
-    if target_base_arch not in hw_common_arch_libs
-      src = hw_common_arch[target_base_arch]
-      lib = static_library(
-        'hw_' + target_base_arch,
-        build_by_default: false,
-        sources: src.all_sources() + genh,
-        include_directories: inc,
-        c_args: target_system_c_args,
-        dependencies: src.all_dependencies())
-      hw_common_arch_libs += {target_base_arch: lib}
-    endif
+    src = hw_common_arch[target_base_arch]
+    lib = static_library(
+      'hw_' + target_base_arch,
+      build_by_default: false,
+      sources: src.all_sources() + genh,
+      include_directories: inc,
+      c_args: target_system_c_args,
+      dependencies: src.all_dependencies() + common_deps)
+    hw_common_arch_libs += {target_base_arch: lib}
   endif
 
   if target_base_arch in target_common_arch
-    if target_base_arch not in target_common_arch_libs
-      src = target_common_arch[target_base_arch]
-      lib = static_library(
-        'target_' + target_base_arch,
-        build_by_default: false,
-        sources: src.all_sources() + genh,
-        include_directories: inc,
-        c_args: target_c_args,
-        dependencies: src.all_dependencies())
-      target_common_arch_libs += {target_base_arch: lib}
-    endif
+    src = target_common_arch[target_base_arch]
+    lib = static_library(
+      'target_' + target_base_arch,
+      build_by_default: false,
+      sources: src.all_sources() + genh,
+      include_directories: inc,
+      c_args: target_c_args,
+      dependencies: src.all_dependencies() + common_deps)
+    target_common_arch_libs += {target_base_arch: lib}
   endif
 
   if target_base_arch in target_common_system_arch
-    if target_base_arch not in target_common_system_arch_libs
-      src = target_common_system_arch[target_base_arch]
-      lib = static_library(
-        'target_system_' + target_base_arch,
-        build_by_default: false,
-        sources: src.all_sources() + genh,
-        include_directories: inc,
-        c_args: target_system_c_args,
-        dependencies: src.all_dependencies())
-      target_common_system_arch_libs += {target_base_arch: lib}
-    endif
+    src = target_common_system_arch[target_base_arch]
+    lib = static_library(
+      'target_system_' + target_base_arch,
+      build_by_default: false,
+      sources: src.all_sources() + genh,
+      include_directories: inc,
+      c_args: target_system_c_args,
+      dependencies: src.all_dependencies() + common_deps)
+    target_common_system_arch_libs += {target_base_arch: lib}
   endif
 endforeach
 

From 0ca26a51791f2601238129c6c2724cc4c604392c Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Wed, 21 May 2025 15:34:09 -0700
Subject: [PATCH 1161/2760] hw/arm: remove explicit dependencies listed
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/r/20250521223414.248276-3-pierrick.bouvier@linaro.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/arm/meson.build | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/arm/meson.build b/hw/arm/meson.build
index 5098795f61..d90be8f4c9 100644
--- a/hw/arm/meson.build
+++ b/hw/arm/meson.build
@@ -8,7 +8,7 @@ arm_common_ss.add(when: 'CONFIG_HIGHBANK', if_true: files('highbank.c'))
 arm_common_ss.add(when: 'CONFIG_INTEGRATOR', if_true: files('integratorcp.c'))
 arm_common_ss.add(when: 'CONFIG_MICROBIT', if_true: files('microbit.c'))
 arm_common_ss.add(when: 'CONFIG_MPS3R', if_true: files('mps3r.c'))
-arm_common_ss.add(when: 'CONFIG_MUSICPAL', if_true: [pixman, files('musicpal.c')])
+arm_common_ss.add(when: 'CONFIG_MUSICPAL', if_true: [files('musicpal.c')])
 arm_common_ss.add(when: 'CONFIG_NETDUINOPLUS2', if_true: files('netduinoplus2.c'))
 arm_common_ss.add(when: 'CONFIG_OLIMEX_STM32_H405', if_true: files('olimex-stm32-h405.c'))
 arm_common_ss.add(when: 'CONFIG_NPCM7XX', if_true: files('npcm7xx.c', 'npcm7xx_boards.c'))
@@ -79,7 +79,7 @@ arm_common_ss.add(when: 'CONFIG_SX1', if_true: files('omap_sx1.c'))
 arm_common_ss.add(when: 'CONFIG_VERSATILE', if_true: files('versatilepb.c'))
 arm_common_ss.add(when: 'CONFIG_VEXPRESS', if_true: files('vexpress.c'))
 
-arm_common_ss.add(fdt, files('boot.c'))
+arm_common_ss.add(files('boot.c'))
 
 hw_arch += {'arm': arm_ss}
 hw_common_arch += {'arm': arm_common_ss}

From 598a0ba8e6df8c113c77e69ee18c3872fda7b6e9 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Wed, 21 May 2025 15:34:10 -0700
Subject: [PATCH 1162/2760] target/arm: remove explicit dependencies listed
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/r/20250521223414.248276-4-pierrick.bouvier@linaro.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/arm/meson.build | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/meson.build b/target/arm/meson.build
index b404fa5486..2ff7ed6e98 100644
--- a/target/arm/meson.build
+++ b/target/arm/meson.build
@@ -28,7 +28,7 @@ arm_user_ss.add(files(
   'vfp_fpscr.c',
 ))
 
-arm_common_system_ss.add(files('cpu.c'), capstone)
+arm_common_system_ss.add(files('cpu.c'))
 arm_common_system_ss.add(when: 'TARGET_AARCH64', if_false: files(
   'cpu32-stubs.c'))
 arm_common_system_ss.add(when: 'CONFIG_KVM', if_false: files('kvm-stub.c'))

From b17b51d325130bc9d0f1189461a9a681fbd554e5 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Wed, 21 May 2025 15:34:11 -0700
Subject: [PATCH 1163/2760] meson: apply target config for picking files from
 lib{system, user}
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

semihosting code needs to be included only if CONFIG_SEMIHOSTING is set.
However, this is a target configuration, so we need to apply it to the
lib{system, user}_ss.

As well, this prepares merging lib{system, user}_ss with
{system, user}_ss.

Acked-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/r/20250521223414.248276-5-pierrick.bouvier@linaro.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 meson.build | 26 ++++++++++++++------------
 1 file changed, 14 insertions(+), 12 deletions(-)

diff --git a/meson.build b/meson.build
index cbb22f60d1..79d123c50e 100644
--- a/meson.build
+++ b/meson.build
@@ -4081,27 +4081,19 @@ common_ss.add(qom, qemuutil)
 common_ss.add_all(when: 'CONFIG_SYSTEM_ONLY', if_true: [system_ss])
 common_ss.add_all(when: 'CONFIG_USER_ONLY', if_true: user_ss)
 
-libuser_ss = libuser_ss.apply({})
 libuser = static_library('user',
-                         libuser_ss.sources() + genh,
+                         libuser_ss.all_sources() + genh,
                          c_args: ['-DCONFIG_USER_ONLY',
                                   '-DCOMPILING_SYSTEM_VS_USER'],
-                         dependencies: libuser_ss.dependencies(),
+                         dependencies: libuser_ss.all_dependencies(),
                          build_by_default: false)
-libuser = declare_dependency(objects: libuser.extract_all_objects(recursive: false),
-                             dependencies: libuser_ss.dependencies())
-common_ss.add(when: 'CONFIG_USER_ONLY', if_true: libuser)
 
-libsystem_ss = libsystem_ss.apply({})
 libsystem = static_library('system',
-                           libsystem_ss.sources() + genh,
+                           libsystem_ss.all_sources() + genh,
                            c_args: ['-DCONFIG_SOFTMMU',
                                     '-DCOMPILING_SYSTEM_VS_USER'],
-                           dependencies: libsystem_ss.dependencies(),
+                           dependencies: libsystem_ss.all_dependencies(),
                            build_by_default: false)
-libsystem = declare_dependency(objects: libsystem.extract_all_objects(recursive: false),
-                               dependencies: libsystem_ss.dependencies())
-common_ss.add(when: 'CONFIG_SYSTEM_ONLY', if_true: libsystem)
 
 # Note that this library is never used directly (only through extract_objects)
 # and is not built by default; therefore, source files not used by the build
@@ -4343,6 +4335,16 @@ foreach target : target_dirs
     objects += lib.extract_objects(src.sources())
     arch_deps += src.dependencies()
   endif
+  if target_type == 'system'
+    src = libsystem_ss.apply(config_target, strict: false)
+    objects += libsystem.extract_objects(src.sources())
+    arch_deps += src.dependencies()
+  endif
+  if target_type == 'user'
+    src = libuser_ss.apply(config_target, strict: false)
+    objects += libuser.extract_objects(src.sources())
+    arch_deps += src.dependencies()
+  endif
   if target_type == 'system' and target_base_arch in hw_common_arch_libs
     src = hw_common_arch[target_base_arch].apply(config_target, strict: false)
     lib = hw_common_arch_libs[target_base_arch]

From 7ca433244c6dde497bb36184f70b442b399fda3e Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Wed, 21 May 2025 15:34:12 -0700
Subject: [PATCH 1164/2760] meson: merge lib{system, user}_ss with {system,
 user}_ss
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Now that target configuration can be applied to lib{system, user}_ss,
there is no reason to keep that separate from the existing {system,
user}_ss.
The only difference is that we'll now compile those files with
-DCOMPILING_SYSTEM_VS_USER, which removes poison for
CONFIG_USER_ONLY and CONFIG_SOFTMMU, without any other side effect.

We extract existing system/user code common common libraries to
lib{system, user}.

To not break existing meson files, we alias libsystem_ss to system_ss
and libuser_ss to user_ss, so we can do the cleanup in next commit.

Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/r/20250521223414.248276-6-pierrick.bouvier@linaro.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 meson.build | 38 +++++++++++++++++++++++---------------
 1 file changed, 23 insertions(+), 15 deletions(-)

diff --git a/meson.build b/meson.build
index 79d123c50e..ea54d15f4a 100644
--- a/meson.build
+++ b/meson.build
@@ -3694,14 +3694,14 @@ io_ss = ss.source_set()
 qmp_ss = ss.source_set()
 qom_ss = ss.source_set()
 system_ss = ss.source_set()
-libsystem_ss = ss.source_set()
+libsystem_ss = system_ss
 specific_fuzz_ss = ss.source_set()
 specific_ss = ss.source_set()
 rust_devices_ss = ss.source_set()
 stub_ss = ss.source_set()
 trace_ss = ss.source_set()
 user_ss = ss.source_set()
-libuser_ss = ss.source_set()
+libuser_ss = user_ss
 util_ss = ss.source_set()
 
 # accel modules
@@ -4078,21 +4078,19 @@ common_ss.add(hwcore)
 system_ss.add(authz, blockdev, chardev, crypto, io, qmp)
 common_ss.add(qom, qemuutil)
 
-common_ss.add_all(when: 'CONFIG_SYSTEM_ONLY', if_true: [system_ss])
-common_ss.add_all(when: 'CONFIG_USER_ONLY', if_true: user_ss)
-
 libuser = static_library('user',
-                         libuser_ss.all_sources() + genh,
+                         user_ss.all_sources() + genh,
                          c_args: ['-DCONFIG_USER_ONLY',
                                   '-DCOMPILING_SYSTEM_VS_USER'],
-                         dependencies: libuser_ss.all_dependencies(),
+                         include_directories: common_user_inc,
+                         dependencies: user_ss.all_dependencies(),
                          build_by_default: false)
 
 libsystem = static_library('system',
-                           libsystem_ss.all_sources() + genh,
+                           system_ss.all_sources() + genh,
                            c_args: ['-DCONFIG_SOFTMMU',
                                     '-DCOMPILING_SYSTEM_VS_USER'],
-                           dependencies: libsystem_ss.all_dependencies(),
+                           dependencies: system_ss.all_dependencies(),
                            build_by_default: false)
 
 # Note that this library is never used directly (only through extract_objects)
@@ -4101,7 +4099,6 @@ libsystem = static_library('system',
 common_all = static_library('common',
                             build_by_default: false,
                             sources: common_ss.all_sources() + genh,
-                            include_directories: common_user_inc,
                             implicit_include_directories: false,
                             dependencies: common_ss.all_dependencies())
 
@@ -4115,10 +4112,20 @@ foreach target_base_arch, config_base_arch : config_base_arch_mak
   inc = [common_user_inc + target_inc]
 
   target_common = common_ss.apply(config_target, strict: false)
+  target_system = system_ss.apply(config_target, strict: false)
+  target_user = user_ss.apply(config_target, strict: false)
   common_deps = []
+  system_deps = []
+  user_deps = []
   foreach dep: target_common.dependencies()
     common_deps += dep.partial_dependency(compile_args: true, includes: true)
   endforeach
+  foreach dep: target_system.dependencies()
+    system_deps += dep.partial_dependency(compile_args: true, includes: true)
+  endforeach
+  foreach dep: target_user.dependencies()
+    user_deps += dep.partial_dependency(compile_args: true, includes: true)
+  endforeach
 
   # prevent common code to access cpu compile time definition,
   # but still allow access to cpu.h
@@ -4133,7 +4140,7 @@ foreach target_base_arch, config_base_arch : config_base_arch_mak
       sources: src.all_sources() + genh,
       include_directories: inc,
       c_args: target_system_c_args,
-      dependencies: src.all_dependencies() + common_deps)
+      dependencies: src.all_dependencies() + common_deps + system_deps)
     hw_common_arch_libs += {target_base_arch: lib}
   endif
 
@@ -4145,7 +4152,8 @@ foreach target_base_arch, config_base_arch : config_base_arch_mak
       sources: src.all_sources() + genh,
       include_directories: inc,
       c_args: target_c_args,
-      dependencies: src.all_dependencies() + common_deps)
+      dependencies: src.all_dependencies() + common_deps +
+                    system_deps + user_deps)
     target_common_arch_libs += {target_base_arch: lib}
   endif
 
@@ -4157,7 +4165,7 @@ foreach target_base_arch, config_base_arch : config_base_arch_mak
       sources: src.all_sources() + genh,
       include_directories: inc,
       c_args: target_system_c_args,
-      dependencies: src.all_dependencies() + common_deps)
+      dependencies: src.all_dependencies() + common_deps + system_deps)
     target_common_system_arch_libs += {target_base_arch: lib}
   endif
 endforeach
@@ -4336,12 +4344,12 @@ foreach target : target_dirs
     arch_deps += src.dependencies()
   endif
   if target_type == 'system'
-    src = libsystem_ss.apply(config_target, strict: false)
+    src = system_ss.apply(config_target, strict: false)
     objects += libsystem.extract_objects(src.sources())
     arch_deps += src.dependencies()
   endif
   if target_type == 'user'
-    src = libuser_ss.apply(config_target, strict: false)
+    src = user_ss.apply(config_target, strict: false)
     objects += libuser.extract_objects(src.sources())
     arch_deps += src.dependencies()
   endif

From d33717d7fca6a599aa991f771e3ea34b15978cee Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Wed, 21 May 2025 15:34:13 -0700
Subject: [PATCH 1165/2760] meson: remove lib{system, user}_ss aliases
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/r/20250521223414.248276-7-pierrick.bouvier@linaro.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 accel/tcg/meson.build | 8 ++++----
 gdbstub/meson.build   | 4 ++--
 hw/core/meson.build   | 4 ++--
 meson.build           | 2 --
 plugins/meson.build   | 4 ++--
 system/meson.build    | 2 +-
 tcg/meson.build       | 4 ++--
 7 files changed, 13 insertions(+), 15 deletions(-)

diff --git a/accel/tcg/meson.build b/accel/tcg/meson.build
index 97d5e5a711..575e92bb9e 100644
--- a/accel/tcg/meson.build
+++ b/accel/tcg/meson.build
@@ -18,15 +18,15 @@ if get_option('plugins')
   tcg_ss.add(files('plugin-gen.c'))
 endif
 
-libuser_ss.add_all(tcg_ss)
-libsystem_ss.add_all(tcg_ss)
+user_ss.add_all(tcg_ss)
+system_ss.add_all(tcg_ss)
 
-libuser_ss.add(files(
+user_ss.add(files(
   'user-exec.c',
   'user-exec-stub.c',
 ))
 
-libsystem_ss.add(files(
+system_ss.add(files(
   'cputlb.c',
   'icount-common.c',
   'monitor.c',
diff --git a/gdbstub/meson.build b/gdbstub/meson.build
index b25db86767..15c666f575 100644
--- a/gdbstub/meson.build
+++ b/gdbstub/meson.build
@@ -5,13 +5,13 @@
 #
 
 # We build two versions of gdbstub, one for each mode
-libuser_ss.add(files(
+user_ss.add(files(
   'gdbstub.c',
   'syscalls.c',
   'user.c'
 ))
 
-libsystem_ss.add(files(
+system_ss.add(files(
   'gdbstub.c',
   'syscalls.c',
   'system.c'
diff --git a/hw/core/meson.build b/hw/core/meson.build
index 547de6527c..b5a545a0ed 100644
--- a/hw/core/meson.build
+++ b/hw/core/meson.build
@@ -26,7 +26,7 @@ system_ss.add(when: 'CONFIG_XILINX_AXI', if_true: files('stream.c'))
 system_ss.add(when: 'CONFIG_PLATFORM_BUS', if_true: files('sysbus-fdt.c'))
 system_ss.add(when: 'CONFIG_EIF', if_true: [files('eif.c'), zlib, libcbor, gnutls])
 
-libsystem_ss.add(files(
+system_ss.add(files(
   'cpu-system.c',
   'fw-path-provider.c',
   'gpio.c',
@@ -46,7 +46,7 @@ libsystem_ss.add(files(
   'vm-change-state-handler.c',
   'clock-vmstate.c',
 ))
-libuser_ss.add(files(
+user_ss.add(files(
   'cpu-user.c',
   'qdev-user.c',
 ))
diff --git a/meson.build b/meson.build
index ea54d15f4a..1c9f1aa91e 100644
--- a/meson.build
+++ b/meson.build
@@ -3694,14 +3694,12 @@ io_ss = ss.source_set()
 qmp_ss = ss.source_set()
 qom_ss = ss.source_set()
 system_ss = ss.source_set()
-libsystem_ss = system_ss
 specific_fuzz_ss = ss.source_set()
 specific_ss = ss.source_set()
 rust_devices_ss = ss.source_set()
 stub_ss = ss.source_set()
 trace_ss = ss.source_set()
 user_ss = ss.source_set()
-libuser_ss = user_ss
 util_ss = ss.source_set()
 
 # accel modules
diff --git a/plugins/meson.build b/plugins/meson.build
index 5383c7b88b..b20edfbabc 100644
--- a/plugins/meson.build
+++ b/plugins/meson.build
@@ -61,8 +61,8 @@ endif
 user_ss.add(files('user.c', 'api-user.c'))
 system_ss.add(files('system.c', 'api-system.c'))
 
-libuser_ss.add(files('api.c', 'core.c'))
-libsystem_ss.add(files('api.c', 'core.c'))
+user_ss.add(files('api.c', 'core.c'))
+system_ss.add(files('api.c', 'core.c'))
 
 common_ss.add(files('loader.c'))
 
diff --git a/system/meson.build b/system/meson.build
index c2f0082766..7514bf3455 100644
--- a/system/meson.build
+++ b/system/meson.build
@@ -7,7 +7,7 @@ system_ss.add(files(
   'vl.c',
 ), sdl, libpmem, libdaxctl)
 
-libsystem_ss.add(files(
+system_ss.add(files(
   'balloon.c',
   'bootdevice.c',
   'cpus.c',
diff --git a/tcg/meson.build b/tcg/meson.build
index bd2821e4b5..706a6eb260 100644
--- a/tcg/meson.build
+++ b/tcg/meson.build
@@ -27,5 +27,5 @@ if host_os == 'linux'
   tcg_ss.add(files('perf.c'))
 endif
 
-libuser_ss.add_all(tcg_ss)
-libsystem_ss.add_all(tcg_ss)
+user_ss.add_all(tcg_ss)
+system_ss.add_all(tcg_ss)

From ddc25eb40444f4bbcfea276d22beee6494c3f18e Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Wed, 21 May 2025 15:34:14 -0700
Subject: [PATCH 1166/2760] meson: merge hw_common_arch in
 target_common_system_arch
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

No need to keep two different libraries, as both are compiled with exact
same flags. As well, rename target common libraries to common_{arch} and
system_{arch}, to follow what exists for common and system libraries.

Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/r/20250521223414.248276-8-pierrick.bouvier@linaro.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 meson.build | 33 ++++++++++++---------------------
 1 file changed, 12 insertions(+), 21 deletions(-)

diff --git a/meson.build b/meson.build
index 1c9f1aa91e..f614d11219 100644
--- a/meson.build
+++ b/meson.build
@@ -4101,7 +4101,6 @@ common_all = static_library('common',
                             dependencies: common_ss.all_dependencies())
 
 # construct common libraries per base architecture
-hw_common_arch_libs = {}
 target_common_arch_libs = {}
 target_common_system_arch_libs = {}
 foreach target_base_arch, config_base_arch : config_base_arch_mak
@@ -4130,22 +4129,10 @@ foreach target_base_arch, config_base_arch : config_base_arch_mak
   target_c_args = ['-DCPU_DEFS_H']
   target_system_c_args = target_c_args + ['-DCOMPILING_SYSTEM_VS_USER', '-DCONFIG_SOFTMMU']
 
-  if target_base_arch in hw_common_arch
-    src = hw_common_arch[target_base_arch]
-    lib = static_library(
-      'hw_' + target_base_arch,
-      build_by_default: false,
-      sources: src.all_sources() + genh,
-      include_directories: inc,
-      c_args: target_system_c_args,
-      dependencies: src.all_dependencies() + common_deps + system_deps)
-    hw_common_arch_libs += {target_base_arch: lib}
-  endif
-
   if target_base_arch in target_common_arch
     src = target_common_arch[target_base_arch]
     lib = static_library(
-      'target_' + target_base_arch,
+      'common_' + target_base_arch,
       build_by_default: false,
       sources: src.all_sources() + genh,
       include_directories: inc,
@@ -4155,10 +4142,20 @@ foreach target_base_arch, config_base_arch : config_base_arch_mak
     target_common_arch_libs += {target_base_arch: lib}
   endif
 
+  # merge hw_common_arch in target_common_system_arch
+  if target_base_arch in hw_common_arch
+    hw_src = hw_common_arch[target_base_arch]
+    if target_base_arch in target_common_system_arch
+      target_common_system_arch[target_base_arch].add_all(hw_src)
+    else
+      target_common_system_arch += {target_base_arch: hw_src}
+    endif
+  endif
+
   if target_base_arch in target_common_system_arch
     src = target_common_system_arch[target_base_arch]
     lib = static_library(
-      'target_system_' + target_base_arch,
+      'system_' + target_base_arch,
       build_by_default: false,
       sources: src.all_sources() + genh,
       include_directories: inc,
@@ -4351,12 +4348,6 @@ foreach target : target_dirs
     objects += libuser.extract_objects(src.sources())
     arch_deps += src.dependencies()
   endif
-  if target_type == 'system' and target_base_arch in hw_common_arch_libs
-    src = hw_common_arch[target_base_arch].apply(config_target, strict: false)
-    lib = hw_common_arch_libs[target_base_arch]
-    objects += lib.extract_objects(src.sources())
-    arch_deps += src.dependencies()
-  endif
   if target_type == 'system' and target_base_arch in target_common_system_arch_libs
     src = target_common_system_arch[target_base_arch].apply(config_target, strict: false)
     lib = target_common_system_arch_libs[target_base_arch]

From d74169e09e1d424aaca138966f460520a0d4dd0d Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Tue, 20 May 2025 23:27:46 +0800
Subject: [PATCH 1167/2760] hw/timer/hpet: Reorganize register decoding

For Rust HPET, since the commit 519088b7cf6d ("rust: hpet: decode HPET
registers into enums"), it decodes register address by checking if the
register belongs to global register space. And for C HPET, it checks
timer register space first.

While both approaches are fine, it's best to be as consistent as
possible.

Synchronize changes from the rust side to C side.

Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250520152750.2542612-2-zhao1.liu@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/timer/hpet.c | 166 ++++++++++++++++++++++++------------------------
 1 file changed, 84 insertions(+), 82 deletions(-)

diff --git a/hw/timer/hpet.c b/hw/timer/hpet.c
index d1b7bc52b7..0fd1337a15 100644
--- a/hw/timer/hpet.c
+++ b/hw/timer/hpet.c
@@ -426,30 +426,11 @@ static uint64_t hpet_ram_read(void *opaque, hwaddr addr,
     uint64_t cur_tick;
 
     trace_hpet_ram_read(addr);
+    addr &= ~4;
 
-    /*address range of all TN regs*/
-    if (addr >= 0x100 && addr <= 0x3ff) {
-        uint8_t timer_id = (addr - 0x100) / 0x20;
-        HPETTimer *timer = &s->timer[timer_id];
-
-        if (timer_id > s->num_timers) {
-            trace_hpet_timer_id_out_of_range(timer_id);
-            return 0;
-        }
-
-        switch (addr & 0x18) {
-        case HPET_TN_CFG: // including interrupt capabilities
-            return timer->config >> shift;
-        case HPET_TN_CMP: // comparator register
-            return timer->cmp >> shift;
-        case HPET_TN_ROUTE:
-            return timer->fsb >> shift;
-        default:
-            trace_hpet_ram_read_invalid();
-            break;
-        }
-    } else {
-        switch (addr & ~4) {
+    /*address range of all global regs*/
+    if (addr <= 0xff) {
+        switch (addr) {
         case HPET_ID: // including HPET_PERIOD
             return s->capability >> shift;
         case HPET_CFG:
@@ -468,6 +449,26 @@ static uint64_t hpet_ram_read(void *opaque, hwaddr addr,
             trace_hpet_ram_read_invalid();
             break;
         }
+    } else {
+        uint8_t timer_id = (addr - 0x100) / 0x20;
+        HPETTimer *timer = &s->timer[timer_id];
+
+        if (timer_id > s->num_timers) {
+            trace_hpet_timer_id_out_of_range(timer_id);
+            return 0;
+        }
+
+        switch (addr & 0x1f) {
+        case HPET_TN_CFG: // including interrupt capabilities
+            return timer->config >> shift;
+        case HPET_TN_CMP: // comparator register
+            return timer->cmp >> shift;
+        case HPET_TN_ROUTE:
+            return timer->fsb >> shift;
+        default:
+            trace_hpet_ram_read_invalid();
+            break;
+        }
     }
     return 0;
 }
@@ -482,9 +483,67 @@ static void hpet_ram_write(void *opaque, hwaddr addr,
     uint64_t old_val, new_val, cleared;
 
     trace_hpet_ram_write(addr, value);
+    addr &= ~4;
 
-    /*address range of all TN regs*/
-    if (addr >= 0x100 && addr <= 0x3ff) {
+    /*address range of all global regs*/
+    if (addr <= 0xff) {
+        switch (addr) {
+        case HPET_ID:
+            return;
+        case HPET_CFG:
+            old_val = s->config;
+            new_val = deposit64(old_val, shift, len, value);
+            new_val = hpet_fixup_reg(new_val, old_val, HPET_CFG_WRITE_MASK);
+            s->config = new_val;
+            if (activating_bit(old_val, new_val, HPET_CFG_ENABLE)) {
+                /* Enable main counter and interrupt generation. */
+                s->hpet_offset =
+                    ticks_to_ns(s->hpet_counter) - qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
+                for (i = 0; i < s->num_timers; i++) {
+                    if (timer_enabled(&s->timer[i]) && (s->isr & (1 << i))) {
+                        update_irq(&s->timer[i], 1);
+                    }
+                    hpet_set_timer(&s->timer[i]);
+                }
+            } else if (deactivating_bit(old_val, new_val, HPET_CFG_ENABLE)) {
+                /* Halt main counter and disable interrupt generation. */
+                s->hpet_counter = hpet_get_ticks(s);
+                for (i = 0; i < s->num_timers; i++) {
+                    hpet_del_timer(&s->timer[i]);
+                }
+            }
+            /* i8254 and RTC output pins are disabled
+             * when HPET is in legacy mode */
+            if (activating_bit(old_val, new_val, HPET_CFG_LEGACY)) {
+                qemu_set_irq(s->pit_enabled, 0);
+                qemu_irq_lower(s->irqs[0]);
+                qemu_irq_lower(s->irqs[RTC_ISA_IRQ]);
+            } else if (deactivating_bit(old_val, new_val, HPET_CFG_LEGACY)) {
+                qemu_irq_lower(s->irqs[0]);
+                qemu_set_irq(s->pit_enabled, 1);
+                qemu_set_irq(s->irqs[RTC_ISA_IRQ], s->rtc_irq_level);
+            }
+            break;
+        case HPET_STATUS:
+            new_val = value << shift;
+            cleared = new_val & s->isr;
+            for (i = 0; i < s->num_timers; i++) {
+                if (cleared & (1 << i)) {
+                    update_irq(&s->timer[i], 0);
+                }
+            }
+            break;
+        case HPET_COUNTER:
+            if (hpet_enabled(s)) {
+                trace_hpet_ram_write_counter_write_while_enabled();
+            }
+            s->hpet_counter = deposit64(s->hpet_counter, shift, len, value);
+            break;
+        default:
+            trace_hpet_ram_write_invalid();
+            break;
+        }
+    } else {
         uint8_t timer_id = (addr - 0x100) / 0x20;
         HPETTimer *timer = &s->timer[timer_id];
 
@@ -550,63 +609,6 @@ static void hpet_ram_write(void *opaque, hwaddr addr,
             break;
         }
         return;
-    } else {
-        switch (addr & ~4) {
-        case HPET_ID:
-            return;
-        case HPET_CFG:
-            old_val = s->config;
-            new_val = deposit64(old_val, shift, len, value);
-            new_val = hpet_fixup_reg(new_val, old_val, HPET_CFG_WRITE_MASK);
-            s->config = new_val;
-            if (activating_bit(old_val, new_val, HPET_CFG_ENABLE)) {
-                /* Enable main counter and interrupt generation. */
-                s->hpet_offset =
-                    ticks_to_ns(s->hpet_counter) - qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
-                for (i = 0; i < s->num_timers; i++) {
-                    if (timer_enabled(&s->timer[i]) && (s->isr & (1 << i))) {
-                        update_irq(&s->timer[i], 1);
-                    }
-                    hpet_set_timer(&s->timer[i]);
-                }
-            } else if (deactivating_bit(old_val, new_val, HPET_CFG_ENABLE)) {
-                /* Halt main counter and disable interrupt generation. */
-                s->hpet_counter = hpet_get_ticks(s);
-                for (i = 0; i < s->num_timers; i++) {
-                    hpet_del_timer(&s->timer[i]);
-                }
-            }
-            /* i8254 and RTC output pins are disabled
-             * when HPET is in legacy mode */
-            if (activating_bit(old_val, new_val, HPET_CFG_LEGACY)) {
-                qemu_set_irq(s->pit_enabled, 0);
-                qemu_irq_lower(s->irqs[0]);
-                qemu_irq_lower(s->irqs[RTC_ISA_IRQ]);
-            } else if (deactivating_bit(old_val, new_val, HPET_CFG_LEGACY)) {
-                qemu_irq_lower(s->irqs[0]);
-                qemu_set_irq(s->pit_enabled, 1);
-                qemu_set_irq(s->irqs[RTC_ISA_IRQ], s->rtc_irq_level);
-            }
-            break;
-        case HPET_STATUS:
-            new_val = value << shift;
-            cleared = new_val & s->isr;
-            for (i = 0; i < s->num_timers; i++) {
-                if (cleared & (1 << i)) {
-                    update_irq(&s->timer[i], 0);
-                }
-            }
-            break;
-        case HPET_COUNTER:
-            if (hpet_enabled(s)) {
-                trace_hpet_ram_write_counter_write_while_enabled();
-            }
-            s->hpet_counter = deposit64(s->hpet_counter, shift, len, value);
-            break;
-        default:
-            trace_hpet_ram_write_invalid();
-            break;
-        }
     }
 }
 

From 86c54a3a418e462e67444ac4db25b2757fd62079 Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Tue, 20 May 2025 23:27:49 +0800
Subject: [PATCH 1168/2760] rust: Fix Zhao's email address

No one could find Zhao Liu via zhai1.liu@intel.com.

Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250520152750.2542612-5-zhao1.liu@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/hw/timer/hpet/src/fw_cfg.rs     | 2 +-
 rust/hw/timer/hpet/src/hpet.rs       | 2 +-
 rust/hw/timer/hpet/src/lib.rs        | 2 +-
 rust/qemu-api/src/bitops.rs          | 2 +-
 rust/qemu-api/src/timer.rs           | 2 +-
 rust/qemu-api/tests/vmstate_tests.rs | 2 +-
 6 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/rust/hw/timer/hpet/src/fw_cfg.rs b/rust/hw/timer/hpet/src/fw_cfg.rs
index aa08d28351..6c10316104 100644
--- a/rust/hw/timer/hpet/src/fw_cfg.rs
+++ b/rust/hw/timer/hpet/src/fw_cfg.rs
@@ -1,5 +1,5 @@
 // Copyright (C) 2024 Intel Corporation.
-// Author(s): Zhao Liu <zhai1.liu@intel.com>
+// Author(s): Zhao Liu <zhao1.liu@intel.com>
 // SPDX-License-Identifier: GPL-2.0-or-later
 
 use std::ptr::addr_of_mut;
diff --git a/rust/hw/timer/hpet/src/hpet.rs b/rust/hw/timer/hpet/src/hpet.rs
index 779681d650..e3ba62b287 100644
--- a/rust/hw/timer/hpet/src/hpet.rs
+++ b/rust/hw/timer/hpet/src/hpet.rs
@@ -1,5 +1,5 @@
 // Copyright (C) 2024 Intel Corporation.
-// Author(s): Zhao Liu <zhai1.liu@intel.com>
+// Author(s): Zhao Liu <zhao1.liu@intel.com>
 // SPDX-License-Identifier: GPL-2.0-or-later
 
 use std::{
diff --git a/rust/hw/timer/hpet/src/lib.rs b/rust/hw/timer/hpet/src/lib.rs
index 1954584a87..141aae229d 100644
--- a/rust/hw/timer/hpet/src/lib.rs
+++ b/rust/hw/timer/hpet/src/lib.rs
@@ -1,5 +1,5 @@
 // Copyright (C) 2024 Intel Corporation.
-// Author(s): Zhao Liu <zhai1.liu@intel.com>
+// Author(s): Zhao Liu <zhao1.liu@intel.com>
 // SPDX-License-Identifier: GPL-2.0-or-later
 
 //! # HPET QEMU Device Model
diff --git a/rust/qemu-api/src/bitops.rs b/rust/qemu-api/src/bitops.rs
index 023ec1a998..b1e3a530ab 100644
--- a/rust/qemu-api/src/bitops.rs
+++ b/rust/qemu-api/src/bitops.rs
@@ -1,5 +1,5 @@
 // Copyright (C) 2024 Intel Corporation.
-// Author(s): Zhao Liu <zhai1.liu@intel.com>
+// Author(s): Zhao Liu <zhao1.liu@intel.com>
 // SPDX-License-Identifier: GPL-2.0-or-later
 
 //! This module provides bit operation extensions to integer types.
diff --git a/rust/qemu-api/src/timer.rs b/rust/qemu-api/src/timer.rs
index 868bd88575..0a2d111d49 100644
--- a/rust/qemu-api/src/timer.rs
+++ b/rust/qemu-api/src/timer.rs
@@ -1,5 +1,5 @@
 // Copyright (C) 2024 Intel Corporation.
-// Author(s): Zhao Liu <zhai1.liu@intel.com>
+// Author(s): Zhao Liu <zhao1.liu@intel.com>
 // SPDX-License-Identifier: GPL-2.0-or-later
 
 use std::{
diff --git a/rust/qemu-api/tests/vmstate_tests.rs b/rust/qemu-api/tests/vmstate_tests.rs
index ad0fc5cd5d..bded836eb6 100644
--- a/rust/qemu-api/tests/vmstate_tests.rs
+++ b/rust/qemu-api/tests/vmstate_tests.rs
@@ -1,5 +1,5 @@
 // Copyright (C) 2025 Intel Corporation.
-// Author(s): Zhao Liu <zhai1.liu@intel.com>
+// Author(s): Zhao Liu <zhao1.liu@intel.com>
 // SPDX-License-Identifier: GPL-2.0-or-later
 
 use std::{

From aef5ac8624c7b826ae2adde48bc6997286ee1303 Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Tue, 20 May 2025 23:27:50 +0800
Subject: [PATCH 1169/2760] rust: Fix the typos in doc

These typos are found by "cargo spellcheck". Though it outputs a lot of
noise and false positives, there still are some real typos.

Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250520152750.2542612-6-zhao1.liu@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/hw/char/pl011/src/device.rs | 4 ++--
 rust/qemu-api/src/qom.rs         | 4 ++--
 rust/qemu-api/src/vmstate.rs     | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/rust/hw/char/pl011/src/device.rs b/rust/hw/char/pl011/src/device.rs
index bde3be65c5..bd5cee0464 100644
--- a/rust/hw/char/pl011/src/device.rs
+++ b/rust/hw/char/pl011/src/device.rs
@@ -480,13 +480,13 @@ impl PL011Registers {
 }
 
 impl PL011State {
-    /// Initializes a pre-allocated, unitialized instance of `PL011State`.
+    /// Initializes a pre-allocated, uninitialized instance of `PL011State`.
     ///
     /// # Safety
     ///
     /// `self` must point to a correctly sized and aligned location for the
     /// `PL011State` type. It must not be called more than once on the same
-    /// location/instance. All its fields are expected to hold unitialized
+    /// location/instance. All its fields are expected to hold uninitialized
     /// values with the sole exception of `parent_obj`.
     unsafe fn init(&mut self) {
         static PL011_OPS: MemoryRegionOps<PL011State> = MemoryRegionOpsBuilder::<PL011State>::new()
diff --git a/rust/qemu-api/src/qom.rs b/rust/qemu-api/src/qom.rs
index 41e5a5e29a..14f98fee60 100644
--- a/rust/qemu-api/src/qom.rs
+++ b/rust/qemu-api/src/qom.rs
@@ -291,7 +291,7 @@ pub unsafe trait ObjectType: Sized {
     }
 
     /// Return the receiver as a const raw pointer to Object.
-    /// This is preferrable to `as_object_mut_ptr()` if a C
+    /// This is preferable to `as_object_mut_ptr()` if a C
     /// function only needs a `const Object *`.
     fn as_object_ptr(&self) -> *const bindings::Object {
         self.as_object().as_ptr()
@@ -485,7 +485,7 @@ pub trait ObjectImpl: ObjectType + IsA<Object> {
     /// `INSTANCE_INIT` functions have been called.
     const INSTANCE_POST_INIT: Option<fn(&Self)> = None;
 
-    /// Called on descendent classes after all parent class initialization
+    /// Called on descendant classes after all parent class initialization
     /// has occurred, but before the class itself is initialized.  This
     /// is only useful if a class is not a leaf, and can be used to undo
     /// the effects of copying the contents of the parent's class struct
diff --git a/rust/qemu-api/src/vmstate.rs b/rust/qemu-api/src/vmstate.rs
index 9c8b2398e9..812f390d78 100644
--- a/rust/qemu-api/src/vmstate.rs
+++ b/rust/qemu-api/src/vmstate.rs
@@ -9,7 +9,7 @@
 //! * [`vmstate_unused!`](crate::vmstate_unused) and
 //!   [`vmstate_of!`](crate::vmstate_of), which are used to express the
 //!   migration format for a struct.  This is based on the [`VMState`] trait,
-//!   which is defined by all migrateable types.
+//!   which is defined by all migratable types.
 //!
 //! * [`impl_vmstate_forward`](crate::impl_vmstate_forward) and
 //!   [`impl_vmstate_bitsized`](crate::impl_vmstate_bitsized), which help with

From 734a1e9eeed2c791c8906d0ee08ad5c9b1f41fa0 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Tue, 13 May 2025 12:18:12 +0200
Subject: [PATCH 1170/2760] rust: hpet: rename hpet module to "device"

Follow a similar convention as pl011.

Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/hw/timer/hpet/src/{hpet.rs => device.rs} | 0
 rust/hw/timer/hpet/src/lib.rs                 | 2 +-
 2 files changed, 1 insertion(+), 1 deletion(-)
 rename rust/hw/timer/hpet/src/{hpet.rs => device.rs} (100%)

diff --git a/rust/hw/timer/hpet/src/hpet.rs b/rust/hw/timer/hpet/src/device.rs
similarity index 100%
rename from rust/hw/timer/hpet/src/hpet.rs
rename to rust/hw/timer/hpet/src/device.rs
diff --git a/rust/hw/timer/hpet/src/lib.rs b/rust/hw/timer/hpet/src/lib.rs
index 141aae229d..a95cf14ac9 100644
--- a/rust/hw/timer/hpet/src/lib.rs
+++ b/rust/hw/timer/hpet/src/lib.rs
@@ -7,7 +7,7 @@
 //! This library implements a device model for the IA-PC HPET (High
 //! Precision Event Timers) device in QEMU.
 
+pub mod device;
 pub mod fw_cfg;
-pub mod hpet;
 
 pub const TYPE_HPET: &::std::ffi::CStr = c"hpet";

From 341ed3eae4179273788d2f74579862a10e18cf81 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Tue, 20 May 2025 14:53:29 +0200
Subject: [PATCH 1171/2760] target/i386/emulate: more lflags cleanups

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/emulate/x86_flags.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/target/i386/emulate/x86_flags.c b/target/i386/emulate/x86_flags.c
index 47bc19778c..cc138c7749 100644
--- a/target/i386/emulate/x86_flags.c
+++ b/target/i386/emulate/x86_flags.c
@@ -255,19 +255,19 @@ void lflags_to_rflags(CPUX86State *env)
 
 void rflags_to_lflags(CPUX86State *env)
 {
-    target_ulong cf_xor_of;
+    target_ulong cf_af, cf_xor_of;
 
+    /* Leave the low byte zero so that parity is always even...  */
+    env->cc_dst = !(env->eflags & CC_Z) << 8;
+
+    /* ... and therefore cc_src always uses opposite polarity.  */
     env->cc_src = CC_P;
     env->cc_src ^= env->eflags & (CC_S | CC_P);
 
     /* rotate right by one to move CF and AF into the carry-out positions */
-    env->cc_src |= (
-        (env->eflags >> 1) |
-        (env->eflags << (TARGET_LONG_BITS - 1))) & (CC_C | CC_A);
+    cf_af = env->eflags & (CC_C | CC_A);
+    env->cc_src |= ((cf_af >> 1) | (cf_af << (TARGET_LONG_BITS - 1)));
 
-    cf_xor_of = (env->eflags & (CC_C | CC_O)) + (CC_O - CC_C);
+    cf_xor_of = ((env->eflags & (CC_C | CC_O)) + (CC_O - CC_C)) & CC_O;
     env->cc_src |= -cf_xor_of & LF_MASK_PO;
-
-    /* Leave the low byte zero so that parity is not affected.  */
-    env->cc_dst = !(env->eflags & CC_Z) << 8;
 }

From 4ec799dd17dcbb0fa4e90e685d5d6fcf8f72338a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cl=C3=A9ment=20Chigot?= <chigot@adacore.com>
Date: Fri, 25 Apr 2025 11:35:13 +0200
Subject: [PATCH 1172/2760] target/sparc: don't set FSR_NVA when comparing
 unordered floats
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

FSR_NVA should be set when one of the operands is a signaling NaN or
when using FCMPEx instructions. But those cases are already handled
within check_ieee_exception or floatxx_compare functions.
Otherwise, it should be left untouched.

FTR, this was detected by inf-compare-[5678] tests within gcc
testsuites.

Signed-off-by: Clément Chigot <chigot@adacore.com>
Message-Id: <20250425093513.863289-1-chigot@adacore.com>
Acked-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
---
 target/sparc/fop_helper.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/target/sparc/fop_helper.c b/target/sparc/fop_helper.c
index a49334150d..29fd166438 100644
--- a/target/sparc/fop_helper.c
+++ b/target/sparc/fop_helper.c
@@ -445,7 +445,6 @@ static uint32_t finish_fcmp(CPUSPARCState *env, FloatRelation r, uintptr_t ra)
     case float_relation_greater:
         return 2;
     case float_relation_unordered:
-        env->fsr |= FSR_NVA;
         return 3;
     }
     g_assert_not_reached();

From 428d1789df911bc863e55eed2d8f33ce991cbd09 Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Wed, 21 May 2025 08:37:08 +0200
Subject: [PATCH 1173/2760] docs/about: Belatedly document tightening of QMP
 device_add checking

Commit 4d8b0f0a9536 (v6.2.0) deprecated incorrectly typed device_add
arguments.  Commit be93fd53723c (qdev-monitor: avoid QemuOpts in QMP
device_add) fixed them for v9.2.0, but neglected to update
documentation.  Do that now.

Cc: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20250521063711.29840-2-armbru@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
[Commit message typo corrected]
---
 docs/about/deprecated.rst       | 14 --------------
 docs/about/removed-features.rst |  9 +++++++++
 2 files changed, 9 insertions(+), 14 deletions(-)

diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst
index 44d3427e98..9665bc6fcf 100644
--- a/docs/about/deprecated.rst
+++ b/docs/about/deprecated.rst
@@ -187,20 +187,6 @@ threads (for example, it only reports source side of multifd threads,
 without reporting any destination threads, or non-multifd source threads).
 For debugging purpose, please use ``-name $VM,debug-threads=on`` instead.
 
-Incorrectly typed ``device_add`` arguments (since 6.2)
-''''''''''''''''''''''''''''''''''''''''''''''''''''''
-
-Due to shortcomings in the internal implementation of ``device_add``, QEMU
-incorrectly accepts certain invalid arguments: Any object or list arguments are
-silently ignored. Other argument types are not checked, but an implicit
-conversion happens, so that e.g. string values can be assigned to integer
-device properties or vice versa.
-
-This is a bug in QEMU that will be fixed in the future so that previously
-accepted incorrect commands will return an error. Users should make sure that
-all arguments passed to ``device_add`` are consistent with the documented
-property types.
-
 Host Architectures
 ------------------
 
diff --git a/docs/about/removed-features.rst b/docs/about/removed-features.rst
index 063284d4f8..92b5ba6218 100644
--- a/docs/about/removed-features.rst
+++ b/docs/about/removed-features.rst
@@ -722,6 +722,15 @@ Use ``multifd-channels`` instead.
 
 Use ``multifd-compression`` instead.
 
+Incorrectly typed ``device_add`` arguments (since 9.2)
+''''''''''''''''''''''''''''''''''''''''''''''''''''''
+
+Due to shortcomings in the internal implementation of ``device_add``,
+QEMU used to incorrectly accept certain invalid arguments. Any object
+or list arguments were silently ignored. Other argument types were not
+checked, but an implicit conversion happened, so that e.g. string
+values could be assigned to integer device properties or vice versa.
+
 QEMU Machine Protocol (QMP) events
 ----------------------------------
 

From c2fb6eaeb9d479a80b104914f459a0c6c32e5a88 Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Wed, 21 May 2025 08:37:09 +0200
Subject: [PATCH 1174/2760] qapi/migration: Deprecate migrate argument @detach

Argument @detach has always been ignored.  Start the clock to get rid
of it.

Cc: Peter Xu <peterx@redhat.com>
Cc: Fabiano Rosas <farosas@suse.de>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20250521063711.29840-3-armbru@redhat.com>
ACKed-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Peter Xu <peterx@redhat.com>
---
 docs/about/deprecated.rst |  5 +++++
 qapi/migration.json       | 18 +++++++++---------
 2 files changed, 14 insertions(+), 9 deletions(-)

diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst
index 9665bc6fcf..ef4ea84e69 100644
--- a/docs/about/deprecated.rst
+++ b/docs/about/deprecated.rst
@@ -179,6 +179,11 @@ Use ``job-dismiss`` instead.
 
 Use ``job-finalize`` instead.
 
+``migrate`` argument ``detach`` (since 10.1)
+''''''''''''''''''''''''''''''''''''''''''''
+
+This argument has always been ignored.
+
 ``query-migrationthreads`` (since 9.2)
 ''''''''''''''''''''''''''''''''''''''
 
diff --git a/qapi/migration.json b/qapi/migration.json
index 8b9c53595c..ecd266f98e 100644
--- a/qapi/migration.json
+++ b/qapi/migration.json
@@ -1660,6 +1660,10 @@
 #
 # @resume: resume one paused migration, default "off".  (since 3.0)
 #
+# Features:
+#
+# @deprecated: Argument @detach is deprecated.
+#
 # Since: 0.14
 #
 # .. admonition:: Notes
@@ -1668,19 +1672,14 @@
 #        migration's progress and final result (this information is
 #        provided by the 'status' member).
 #
-#     2. All boolean arguments default to false.
-#
-#     3. The user Monitor's "detach" argument is invalid in QMP and
-#        should not be used.
-#
-#     4. The uri argument should have the Uniform Resource Identifier
+#     2. The uri argument should have the Uniform Resource Identifier
 #        of default destination VM.  This connection will be bound to
 #        default network.
 #
-#     5. For now, number of migration streams is restricted to one,
+#     3. For now, number of migration streams is restricted to one,
 #        i.e. number of items in 'channels' list is just 1.
 #
-#     6. The 'uri' and 'channels' arguments are mutually exclusive;
+#     4. The 'uri' and 'channels' arguments are mutually exclusive;
 #        exactly one of the two should be present.
 #
 # .. qmp-example::
@@ -1724,7 +1723,8 @@
 { 'command': 'migrate',
   'data': {'*uri': 'str',
            '*channels': [ 'MigrationChannel' ],
-           '*detach': 'bool', '*resume': 'bool' } }
+           '*detach': { 'type': 'bool', 'features': [ 'deprecated' ] },
+           '*resume': 'bool' } }
 
 ##
 # @migrate-incoming:

From 977dfcd552d0bef725f89bcabcedeb51593000ab Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Wed, 21 May 2025 08:37:10 +0200
Subject: [PATCH 1175/2760] docs/about/deprecated: Move deprecation notes to
 tidy up order

The deprecation notes within a section are mostly in version order.
Move the few that aren't so they are.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20250521063711.29840-4-armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
---
 docs/about/deprecated.rst | 32 ++++++++++++++++----------------
 1 file changed, 16 insertions(+), 16 deletions(-)

diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst
index ef4ea84e69..4715d1ede5 100644
--- a/docs/about/deprecated.rst
+++ b/docs/about/deprecated.rst
@@ -148,6 +148,14 @@ options are removed in favor of using explicit ``blockdev-create`` and
 ``blockdev-add`` calls. See :doc:`/interop/live-block-operations` for
 details.
 
+``query-migrationthreads`` (since 9.2)
+''''''''''''''''''''''''''''''''''''''
+
+To be removed with no replacement, as it reports only a limited set of
+threads (for example, it only reports source side of multifd threads,
+without reporting any destination threads, or non-multifd source threads).
+For debugging purpose, please use ``-name $VM,debug-threads=on`` instead.
+
 ``block-job-pause`` (since 10.1)
 ''''''''''''''''''''''''''''''''
 
@@ -184,14 +192,6 @@ Use ``job-finalize`` instead.
 
 This argument has always been ignored.
 
-``query-migrationthreads`` (since 9.2)
-''''''''''''''''''''''''''''''''''''''
-
-To be removed with no replacement, as it reports only a limited set of
-threads (for example, it only reports source side of multifd threads,
-without reporting any destination threads, or non-multifd source threads).
-For debugging purpose, please use ``-name $VM,debug-threads=on`` instead.
-
 Host Architectures
 ------------------
 
@@ -522,14 +522,6 @@ PCIe passthrough shall be the mainline solution.
 CPU device properties
 '''''''''''''''''''''
 
-``pcommit`` on x86 (since 9.1)
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
-
-The PCOMMIT instruction was never included in any physical processor.
-It was implemented as a no-op instruction in TCG up to QEMU 9.0, but
-only with ``-cpu max`` (which does not guarantee migration compatibility
-across versions).
-
 ``pmu-num=n`` on RISC-V CPUs (since 8.2)
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
@@ -539,6 +531,14 @@ be calculated with ``((2 ^ n) - 1) << 3``. The least significant three bits
 must be left clear.
 
 
+``pcommit`` on x86 (since 9.1)
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+The PCOMMIT instruction was never included in any physical processor.
+It was implemented as a no-op instruction in TCG up to QEMU 9.0, but
+only with ``-cpu max`` (which does not guarantee migration compatibility
+across versions).
+
 Backwards compatibility
 -----------------------
 

From 662b85aae131e7cb8dd8b03c9e44a95bc87573ca Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Wed, 21 May 2025 08:37:11 +0200
Subject: [PATCH 1176/2760] docs/about/removed-features: Move removal notes to
 tidy up order

The removal notes within a section are mostly in version order.  Move
the few that aren't so they are.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20250521063711.29840-5-armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
---
 docs/about/removed-features.rst | 60 ++++++++++++++++-----------------
 1 file changed, 30 insertions(+), 30 deletions(-)

diff --git a/docs/about/removed-features.rst b/docs/about/removed-features.rst
index 92b5ba6218..4819cb4665 100644
--- a/docs/about/removed-features.rst
+++ b/docs/about/removed-features.rst
@@ -162,6 +162,12 @@ specified with ``-mem-path`` can actually provide the guest RAM configured with
 The ``name`` parameter of the ``-net`` option was a synonym
 for the ``id`` parameter, which should now be used instead.
 
+RISC-V firmware not booted by default (removed in 5.1)
+''''''''''''''''''''''''''''''''''''''''''''''''''''''
+
+QEMU 5.1 changes the default behaviour from ``-bios none`` to ``-bios default``
+for the RISC-V ``virt`` machine and ``sifive_u`` machine.
+
 ``-numa node,mem=...`` (removed in 5.1)
 '''''''''''''''''''''''''''''''''''''''
 
@@ -324,12 +330,6 @@ devices.  Drives the board doesn't pick up can no longer be used with
 This option was undocumented and not used in the field.
 Use ``-device usb-ccid`` instead.
 
-RISC-V firmware not booted by default (removed in 5.1)
-''''''''''''''''''''''''''''''''''''''''''''''''''''''
-
-QEMU 5.1 changes the default behaviour from ``-bios none`` to ``-bios default``
-for the RISC-V ``virt`` machine and ``sifive_u`` machine.
-
 ``-no-quit`` (removed in 7.0)
 '''''''''''''''''''''''''''''
 
@@ -911,14 +911,6 @@ The RISC-V no MMU cpus have been removed. The two CPUs: ``rv32imacu-nommu`` and
 ``rv64imacu-nommu`` can no longer be used. Instead the MMU status can be specified
 via the CPU ``mmu`` option when using the ``rv32`` or ``rv64`` CPUs.
 
-RISC-V 'any' CPU type ``-cpu any`` (removed in 9.2)
-'''''''''''''''''''''''''''''''''''''''''''''''''''
-
-The 'any' CPU type was introduced back in 2018 and was around since the
-initial RISC-V QEMU port. Its usage was always been unclear: users don't know
-what to expect from a CPU called 'any', and in fact the CPU does not do anything
-special that isn't already done by the default CPUs rv32/rv64.
-
 ``compat`` property of server class POWER CPUs (removed in 6.0)
 '''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
 
@@ -965,6 +957,14 @@ The CRIS architecture was pulled from Linux in 4.17 and the compiler
 was no longer packaged in any distro making it harder to run the
 ``check-tcg`` tests.
 
+RISC-V 'any' CPU type ``-cpu any`` (removed in 9.2)
+'''''''''''''''''''''''''''''''''''''''''''''''''''
+
+The 'any' CPU type was introduced back in 2018 and was around since the
+initial RISC-V QEMU port. Its usage was always been unclear: users don't know
+what to expect from a CPU called 'any', and in fact the CPU does not do anything
+special that isn't already done by the default CPUs rv32/rv64.
+
 System accelerators
 -------------------
 
@@ -975,18 +975,18 @@ Userspace local APIC with KVM (x86, removed in 8.0)
 a local APIC.  The ``split`` setting is supported, as is using ``-M
 kernel-irqchip=off`` when the CPU does not have a local APIC.
 
-HAXM (``-accel hax``) (removed in 8.2)
-''''''''''''''''''''''''''''''''''''''
-
-The HAXM project has been retired (see https://github.com/intel/haxm#status).
-Use "whpx" (on Windows) or "hvf" (on macOS) instead.
-
 MIPS "Trap-and-Emulate" KVM support (removed in 8.0)
 ''''''''''''''''''''''''''''''''''''''''''''''''''''
 
 The MIPS "Trap-and-Emulate" KVM host and guest support was removed
 from Linux in 2021, and is not supported anymore by QEMU either.
 
+HAXM (``-accel hax``) (removed in 8.2)
+''''''''''''''''''''''''''''''''''''''
+
+The HAXM project has been retired (see https://github.com/intel/haxm#status).
+Use "whpx" (on Windows) or "hvf" (on macOS) instead.
+
 System emulator machines
 ------------------------
 
@@ -1044,16 +1044,6 @@ Aspeed ``swift-bmc`` machine (removed in 7.0)
 This machine was removed because it was unused. Alternative AST2500 based
 OpenPOWER machines are ``witherspoon-bmc`` and ``romulus-bmc``.
 
-Aspeed ``tacoma-bmc`` machine (removed in 10.0)
-'''''''''''''''''''''''''''''''''''''''''''''''
-
-The ``tacoma-bmc`` machine was removed because it didn't bring much
-compared to the ``rainier-bmc`` machine. Also, the ``tacoma-bmc`` was
-a board used for bring up of the AST2600 SoC that never left the
-labs. It can be easily replaced by the ``rainier-bmc`` machine, which
-was the actual final product, or by the ``ast2600-evb`` with some
-tweaks.
-
 ppc ``taihu`` machine (removed in 7.2)
 '''''''''''''''''''''''''''''''''''''''''''''
 
@@ -1084,6 +1074,16 @@ for all machine types using the PXA2xx and OMAP2 SoCs. We are also
 dropping the ``cheetah`` OMAP1 board, because we don't have any
 test images for it and don't know of anybody who does.
 
+Aspeed ``tacoma-bmc`` machine (removed in 10.0)
+'''''''''''''''''''''''''''''''''''''''''''''''
+
+The ``tacoma-bmc`` machine was removed because it didn't bring much
+compared to the ``rainier-bmc`` machine. Also, the ``tacoma-bmc`` was
+a board used for bring up of the AST2600 SoC that never left the
+labs. It can be easily replaced by the ``rainier-bmc`` machine, which
+was the actual final product, or by the ``ast2600-evb`` with some
+tweaks.
+
 ppc ``ref405ep`` machine (removed in 10.0)
 ''''''''''''''''''''''''''''''''''''''''''
 

From 319b0c8d077401f51bf6314039b82db20d5267ee Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 24 May 2025 15:40:12 +0100
Subject: [PATCH 1177/2760] accel/tcg: Fix atomic_mmu_lookup vs TLB_FORCE_SLOW
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When we moved TLB_MMIO and TLB_DISCARD_WRITE to TLB_SLOW_FLAGS_MASK,
we failed to update atomic_mmu_lookup to properly reconstruct flags.

Fixes: 24b5e0fdb543 ("include/exec: Move TLB_MMIO, TLB_DISCARD_WRITE to slow flags")
Reported-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Tested-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index 5f6d7c601c..86d0deb08c 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -1871,8 +1871,12 @@ static void *atomic_mmu_lookup(CPUState *cpu, vaddr addr, MemOpIdx oi,
         goto stop_the_world;
     }
 
-    /* Collect tlb flags for read. */
+    /* Finish collecting tlb flags for both read and write. */
+    full = &cpu->neg.tlb.d[mmu_idx].fulltlb[index];
     tlb_addr |= tlbe->addr_read;
+    tlb_addr &= TLB_FLAGS_MASK & ~TLB_FORCE_SLOW;
+    tlb_addr |= full->slow_flags[MMU_DATA_STORE];
+    tlb_addr |= full->slow_flags[MMU_DATA_LOAD];
 
     /* Notice an IO access or a needs-MMU-lookup access */
     if (unlikely(tlb_addr & (TLB_MMIO | TLB_DISCARD_WRITE))) {
@@ -1882,13 +1886,12 @@ static void *atomic_mmu_lookup(CPUState *cpu, vaddr addr, MemOpIdx oi,
     }
 
     hostaddr = (void *)((uintptr_t)addr + tlbe->addend);
-    full = &cpu->neg.tlb.d[mmu_idx].fulltlb[index];
 
     if (unlikely(tlb_addr & TLB_NOTDIRTY)) {
         notdirty_write(cpu, addr, size, full, retaddr);
     }
 
-    if (unlikely(tlb_addr & TLB_FORCE_SLOW)) {
+    if (unlikely(tlb_addr & TLB_WATCHPOINT)) {
         int wp_flags = 0;
 
         if (full->slow_flags[MMU_DATA_STORE] & TLB_WATCHPOINT) {
@@ -1897,10 +1900,8 @@ static void *atomic_mmu_lookup(CPUState *cpu, vaddr addr, MemOpIdx oi,
         if (full->slow_flags[MMU_DATA_LOAD] & TLB_WATCHPOINT) {
             wp_flags |= BP_MEM_READ;
         }
-        if (wp_flags) {
-            cpu_check_watchpoint(cpu, addr, size,
-                                 full->attrs, wp_flags, retaddr);
-        }
+        cpu_check_watchpoint(cpu, addr, size,
+                             full->attrs, wp_flags, retaddr);
     }
 
     return hostaddr;

From 556d05d1e2ac687463ce2877cb4acd1b0589deed Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Thu, 15 May 2025 10:46:41 -0700
Subject: [PATCH 1178/2760] system/main: comment lock rationale

Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250515174641.4000309-1-pierrick.bouvier@linaro.org>
---
 system/main.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/system/main.c b/system/main.c
index 1c02206734..b8f7157cc3 100644
--- a/system/main.c
+++ b/system/main.c
@@ -69,8 +69,21 @@ int (*qemu_main)(void) = os_darwin_cfrunloop_main;
 int main(int argc, char **argv)
 {
     qemu_init(argc, argv);
+
+    /*
+     * qemu_init acquires the BQL and replay mutex lock. BQL is acquired when
+     * initializing cpus, to block associated threads until initialization is
+     * complete. Replay_mutex lock is acquired on initialization, because it
+     * must be held when configuring icount_mode.
+     *
+     * On MacOS, qemu main event loop runs in a background thread, as main
+     * thread must be reserved for UI. Thus, we need to transfer lock ownership,
+     * and the simplest way to do that is to release them, and reacquire them
+     * from qemu_default_main.
+     */
     bql_unlock();
     replay_mutex_unlock();
+
     if (qemu_main) {
         QemuThread main_loop_thread;
         qemu_thread_create(&main_loop_thread, "qemu_main",

From 19f036726a416c9248c19befe544a2d30b099a25 Mon Sep 17 00:00:00 2001
From: Andreas Schwab <schwab@suse.de>
Date: Tue, 20 May 2025 16:07:37 +0200
Subject: [PATCH 1179/2760] linux-user: implement pgid field of /proc/self/stat

Signed-off-by: Andreas Schwab <schwab@suse.de>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <mvmfrgzcr4m.fsf@suse.de>
---
 linux-user/syscall.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 23b901b713..fc37028597 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -8235,6 +8235,9 @@ static int open_self_stat(CPUArchState *cpu_env, int fd)
         } else if (i == 3) {
             /* ppid */
             g_string_printf(buf, FMT_pid " ", getppid());
+        } else if (i == 4) {
+            /* pgid */
+            g_string_printf(buf, FMT_pid " ", getpgrp());
         } else if (i == 19) {
             /* num_threads */
             int cpus = 0;

From 67f2d507ca444cfff993c1a05df3aaa4346a372c Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 12 Feb 2025 12:30:21 -0800
Subject: [PATCH 1180/2760] target/microblaze: Split out
 mb_unaligned_access_internal

Use an explicit 64-bit type for the address to store in EAR.

Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/microblaze/helper.c | 64 +++++++++++++++++++++-----------------
 1 file changed, 36 insertions(+), 28 deletions(-)

diff --git a/target/microblaze/helper.c b/target/microblaze/helper.c
index 9203192483..5fe81e4b16 100644
--- a/target/microblaze/helper.c
+++ b/target/microblaze/helper.c
@@ -27,6 +27,42 @@
 #include "qemu/host-utils.h"
 #include "exec/log.h"
 
+
+G_NORETURN
+static void mb_unaligned_access_internal(CPUState *cs, uint64_t addr,
+                                         uintptr_t retaddr)
+{
+    CPUMBState *env = cpu_env(cs);
+    uint32_t esr, iflags;
+
+    /* Recover the pc and iflags from the corresponding insn_start.  */
+    cpu_restore_state(cs, retaddr);
+    iflags = env->iflags;
+
+    qemu_log_mask(CPU_LOG_INT,
+                  "Unaligned access addr=0x%" PRIx64 " pc=%x iflags=%x\n",
+                  addr, env->pc, iflags);
+
+    esr = ESR_EC_UNALIGNED_DATA;
+    if (likely(iflags & ESR_ESS_FLAG)) {
+        esr |= iflags & ESR_ESS_MASK;
+    } else {
+        qemu_log_mask(LOG_UNIMP, "Unaligned access without ESR_ESS_FLAG\n");
+    }
+
+    env->ear = addr;
+    env->esr = esr;
+    cs->exception_index = EXCP_HW_EXCP;
+    cpu_loop_exit(cs);
+}
+
+void mb_cpu_do_unaligned_access(CPUState *cs, vaddr addr,
+                                MMUAccessType access_type,
+                                int mmu_idx, uintptr_t retaddr)
+{
+    mb_unaligned_access_internal(cs, addr, retaddr);
+}
+
 #ifndef CONFIG_USER_ONLY
 static bool mb_cpu_access_is_secure(MicroBlazeCPU *cpu,
                                     MMUAccessType access_type)
@@ -269,31 +305,3 @@ bool mb_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
 }
 
 #endif /* !CONFIG_USER_ONLY */
-
-void mb_cpu_do_unaligned_access(CPUState *cs, vaddr addr,
-                                MMUAccessType access_type,
-                                int mmu_idx, uintptr_t retaddr)
-{
-    MicroBlazeCPU *cpu = MICROBLAZE_CPU(cs);
-    uint32_t esr, iflags;
-
-    /* Recover the pc and iflags from the corresponding insn_start.  */
-    cpu_restore_state(cs, retaddr);
-    iflags = cpu->env.iflags;
-
-    qemu_log_mask(CPU_LOG_INT,
-                  "Unaligned access addr=" TARGET_FMT_lx " pc=%x iflags=%x\n",
-                  (target_ulong)addr, cpu->env.pc, iflags);
-
-    esr = ESR_EC_UNALIGNED_DATA;
-    if (likely(iflags & ESR_ESS_FLAG)) {
-        esr |= iflags & ESR_ESS_MASK;
-    } else {
-        qemu_log_mask(LOG_UNIMP, "Unaligned access without ESR_ESS_FLAG\n");
-    }
-
-    cpu->env.ear = addr;
-    cpu->env.esr = esr;
-    cs->exception_index = EXCP_HW_EXCP;
-    cpu_loop_exit(cs);
-}

From 3f8d6b432dbdd63eecfb454d59d36b08f76c0c95 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sun, 25 May 2025 16:10:03 +0100
Subject: [PATCH 1181/2760] target/microblaze: Introduce
 helper_unaligned_access

Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/microblaze/helper.c |  7 +++++++
 target/microblaze/helper.h | 12 ++++++------
 2 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/target/microblaze/helper.c b/target/microblaze/helper.c
index 5fe81e4b16..ef0e2f973f 100644
--- a/target/microblaze/helper.c
+++ b/target/microblaze/helper.c
@@ -26,6 +26,7 @@
 #include "exec/target_page.h"
 #include "qemu/host-utils.h"
 #include "exec/log.h"
+#include "exec/helper-proto.h"
 
 
 G_NORETURN
@@ -64,6 +65,12 @@ void mb_cpu_do_unaligned_access(CPUState *cs, vaddr addr,
 }
 
 #ifndef CONFIG_USER_ONLY
+
+void HELPER(unaligned_access)(CPUMBState *env, uint64_t addr)
+{
+    mb_unaligned_access_internal(env_cpu(env), addr, GETPC());
+}
+
 static bool mb_cpu_access_is_secure(MicroBlazeCPU *cpu,
                                     MMUAccessType access_type)
 {
diff --git a/target/microblaze/helper.h b/target/microblaze/helper.h
index f740835fcb..41f56a5601 100644
--- a/target/microblaze/helper.h
+++ b/target/microblaze/helper.h
@@ -20,12 +20,12 @@ DEF_HELPER_FLAGS_3(fcmp_ne, TCG_CALL_NO_WG, i32, env, i32, i32)
 DEF_HELPER_FLAGS_3(fcmp_ge, TCG_CALL_NO_WG, i32, env, i32, i32)
 
 DEF_HELPER_FLAGS_2(pcmpbf, TCG_CALL_NO_RWG_SE, i32, i32, i32)
-#if !defined(CONFIG_USER_ONLY)
-DEF_HELPER_FLAGS_3(mmu_read, TCG_CALL_NO_RWG, i32, env, i32, i32)
-DEF_HELPER_FLAGS_4(mmu_write, TCG_CALL_NO_RWG, void, env, i32, i32, i32)
-#endif
-
 DEF_HELPER_FLAGS_2(stackprot, TCG_CALL_NO_WG, void, env, tl)
-
 DEF_HELPER_FLAGS_2(get, TCG_CALL_NO_RWG, i32, i32, i32)
 DEF_HELPER_FLAGS_3(put, TCG_CALL_NO_RWG, void, i32, i32, i32)
+
+#ifndef CONFIG_USER_ONLY
+DEF_HELPER_FLAGS_3(mmu_read, TCG_CALL_NO_RWG, i32, env, i32, i32)
+DEF_HELPER_FLAGS_4(mmu_write, TCG_CALL_NO_RWG, void, env, i32, i32, i32)
+DEF_HELPER_FLAGS_2(unaligned_access, TCG_CALL_NO_WG, noreturn, env, i64)
+#endif

From 526b0d364af081792e469adabbc67aeaca8a4343 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 12 Feb 2025 12:46:17 -0800
Subject: [PATCH 1182/2760] target/microblaze: Split out
 mb_transaction_failed_internal

Use an explicit 64-bit type for the address to store in EAR.

Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/microblaze/op_helper.c | 70 +++++++++++++++++++++--------------
 1 file changed, 42 insertions(+), 28 deletions(-)

diff --git a/target/microblaze/op_helper.c b/target/microblaze/op_helper.c
index 9e838dfa15..4c39207a55 100644
--- a/target/microblaze/op_helper.c
+++ b/target/microblaze/op_helper.c
@@ -393,38 +393,52 @@ void helper_mmu_write(CPUMBState *env, uint32_t ext, uint32_t rn, uint32_t v)
     mmu_write(env, ext, rn, v);
 }
 
+static void mb_transaction_failed_internal(CPUState *cs, hwaddr physaddr,
+                                           uint64_t addr, unsigned size,
+                                           MMUAccessType access_type,
+                                           uintptr_t retaddr)
+{
+    CPUMBState *env = cpu_env(cs);
+    MicroBlazeCPU *cpu = env_archcpu(env);
+    const char *access_name = "INVALID";
+    bool take = env->msr & MSR_EE;
+    uint32_t esr = ESR_EC_DATA_BUS;
+
+    switch (access_type) {
+    case MMU_INST_FETCH:
+        access_name = "INST_FETCH";
+        esr = ESR_EC_INSN_BUS;
+        take &= cpu->cfg.iopb_bus_exception;
+        break;
+    case MMU_DATA_LOAD:
+        access_name = "DATA_LOAD";
+        take &= cpu->cfg.dopb_bus_exception;
+        break;
+    case MMU_DATA_STORE:
+        access_name = "DATA_STORE";
+        take &= cpu->cfg.dopb_bus_exception;
+        break;
+    }
+
+    qemu_log_mask(CPU_LOG_INT, "Transaction failed: addr 0x%" PRIx64
+                  "physaddr 0x" HWADDR_FMT_plx " size %d access-type %s (%s)\n",
+                  addr, physaddr, size, access_name,
+                  take ? "TAKEN" : "DROPPED");
+
+    if (take) {
+        env->esr = esr;
+        env->ear = addr;
+        cs->exception_index = EXCP_HW_EXCP;
+        cpu_loop_exit_restore(cs, retaddr);
+    }
+}
+
 void mb_cpu_transaction_failed(CPUState *cs, hwaddr physaddr, vaddr addr,
                                unsigned size, MMUAccessType access_type,
                                int mmu_idx, MemTxAttrs attrs,
                                MemTxResult response, uintptr_t retaddr)
 {
-    MicroBlazeCPU *cpu = MICROBLAZE_CPU(cs);
-    CPUMBState *env = &cpu->env;
-
-    qemu_log_mask(CPU_LOG_INT, "Transaction failed: vaddr 0x%" VADDR_PRIx
-                  " physaddr 0x" HWADDR_FMT_plx " size %d access type %s\n",
-                  addr, physaddr, size,
-                  access_type == MMU_INST_FETCH ? "INST_FETCH" :
-                  (access_type == MMU_DATA_LOAD ? "DATA_LOAD" : "DATA_STORE"));
-
-    if (!(env->msr & MSR_EE)) {
-        return;
-    }
-
-    if (access_type == MMU_INST_FETCH) {
-        if (!cpu->cfg.iopb_bus_exception) {
-            return;
-        }
-        env->esr = ESR_EC_INSN_BUS;
-    } else {
-        if (!cpu->cfg.dopb_bus_exception) {
-            return;
-        }
-        env->esr = ESR_EC_DATA_BUS;
-    }
-
-    env->ear = addr;
-    cs->exception_index = EXCP_HW_EXCP;
-    cpu_loop_exit_restore(cs, retaddr);
+    mb_transaction_failed_internal(cs, physaddr, addr, size,
+                                   access_type, retaddr);
 }
 #endif

From beea772666fb1bb86136042fd8ee7140a01bb36f Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 12 Feb 2025 13:20:58 -0800
Subject: [PATCH 1183/2760] target/microblaze: Implement extended address
 load/store out of line

Use helpers and address_space_ld/st instead of inline
loads and stores.  This allows us to perform operations
on physical addresses wider than virtual addresses.

Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/microblaze/helper.h    | 10 +++++++
 target/microblaze/op_helper.c | 40 +++++++++++++++++++++++++++
 target/microblaze/translate.c | 52 +++++++++++++++++++++++++++--------
 3 files changed, 90 insertions(+), 12 deletions(-)

diff --git a/target/microblaze/helper.h b/target/microblaze/helper.h
index 41f56a5601..ef4fad9b91 100644
--- a/target/microblaze/helper.h
+++ b/target/microblaze/helper.h
@@ -28,4 +28,14 @@ DEF_HELPER_FLAGS_3(put, TCG_CALL_NO_RWG, void, i32, i32, i32)
 DEF_HELPER_FLAGS_3(mmu_read, TCG_CALL_NO_RWG, i32, env, i32, i32)
 DEF_HELPER_FLAGS_4(mmu_write, TCG_CALL_NO_RWG, void, env, i32, i32, i32)
 DEF_HELPER_FLAGS_2(unaligned_access, TCG_CALL_NO_WG, noreturn, env, i64)
+DEF_HELPER_FLAGS_2(lbuea, TCG_CALL_NO_WG, i32, env, i64)
+DEF_HELPER_FLAGS_2(lhuea_be, TCG_CALL_NO_WG, i32, env, i64)
+DEF_HELPER_FLAGS_2(lhuea_le, TCG_CALL_NO_WG, i32, env, i64)
+DEF_HELPER_FLAGS_2(lwea_be, TCG_CALL_NO_WG, i32, env, i64)
+DEF_HELPER_FLAGS_2(lwea_le, TCG_CALL_NO_WG, i32, env, i64)
+DEF_HELPER_FLAGS_3(sbea, TCG_CALL_NO_WG, void, env, i32, i64)
+DEF_HELPER_FLAGS_3(shea_be, TCG_CALL_NO_WG, void, env, i32, i64)
+DEF_HELPER_FLAGS_3(shea_le, TCG_CALL_NO_WG, void, env, i32, i64)
+DEF_HELPER_FLAGS_3(swea_be, TCG_CALL_NO_WG, void, env, i32, i64)
+DEF_HELPER_FLAGS_3(swea_le, TCG_CALL_NO_WG, void, env, i32, i64)
 #endif
diff --git a/target/microblaze/op_helper.c b/target/microblaze/op_helper.c
index 4c39207a55..b8365b3b1d 100644
--- a/target/microblaze/op_helper.c
+++ b/target/microblaze/op_helper.c
@@ -382,6 +382,8 @@ void helper_stackprot(CPUMBState *env, target_ulong addr)
 }
 
 #if !defined(CONFIG_USER_ONLY)
+#include "system/memory.h"
+
 /* Writes/reads to the MMU's special regs end up here.  */
 uint32_t helper_mmu_read(CPUMBState *env, uint32_t ext, uint32_t rn)
 {
@@ -441,4 +443,42 @@ void mb_cpu_transaction_failed(CPUState *cs, hwaddr physaddr, vaddr addr,
     mb_transaction_failed_internal(cs, physaddr, addr, size,
                                    access_type, retaddr);
 }
+
+#define LD_EA(NAME, TYPE, FUNC) \
+uint32_t HELPER(NAME)(CPUMBState *env, uint64_t ea)                     \
+{                                                                       \
+    CPUState *cs = env_cpu(env);                                        \
+    MemTxResult txres;                                                  \
+    TYPE ret = FUNC(cs->as, ea, MEMTXATTRS_UNSPECIFIED, &txres);        \
+    if (unlikely(txres != MEMTX_OK)) {                                  \
+        mb_transaction_failed_internal(cs, ea, ea, sizeof(TYPE),        \
+                                       MMU_DATA_LOAD, GETPC());         \
+    }                                                                   \
+    return ret;                                                         \
+}
+
+LD_EA(lbuea, uint8_t, address_space_ldub)
+LD_EA(lhuea_be, uint16_t, address_space_lduw_be)
+LD_EA(lhuea_le, uint16_t, address_space_lduw_le)
+LD_EA(lwea_be, uint32_t, address_space_ldl_be)
+LD_EA(lwea_le, uint32_t, address_space_ldl_le)
+
+#define ST_EA(NAME, TYPE, FUNC) \
+void HELPER(NAME)(CPUMBState *env, uint32_t data, uint64_t ea)          \
+{                                                                       \
+    CPUState *cs = env_cpu(env);                                        \
+    MemTxResult txres;                                                  \
+    FUNC(cs->as, ea, data, MEMTXATTRS_UNSPECIFIED, &txres);             \
+    if (unlikely(txres != MEMTX_OK)) {                                  \
+        mb_transaction_failed_internal(cs, ea, ea, sizeof(TYPE),        \
+                                       MMU_DATA_STORE, GETPC());        \
+    }                                                                   \
+}
+
+ST_EA(sbea, uint8_t, address_space_stb)
+ST_EA(shea_be, uint16_t, address_space_stw_be)
+ST_EA(shea_le, uint16_t, address_space_stw_le)
+ST_EA(swea_be, uint32_t, address_space_stl_be)
+ST_EA(swea_le, uint32_t, address_space_stl_le)
+
 #endif
diff --git a/target/microblaze/translate.c b/target/microblaze/translate.c
index 671b1ae4db..3d9756391e 100644
--- a/target/microblaze/translate.c
+++ b/target/microblaze/translate.c
@@ -700,6 +700,20 @@ static void record_unaligned_ess(DisasContext *dc, int rd,
 
     tcg_set_insn_start_param(dc->base.insn_start, 1, iflags);
 }
+
+static void gen_alignment_check_ea(DisasContext *dc, TCGv_i64 ea, int rb,
+                                   int rd, MemOp size, bool store)
+{
+    if (rb && (dc->tb_flags & MSR_EE) && dc->cfg->unaligned_exceptions) {
+        TCGLabel *over = gen_new_label();
+
+        record_unaligned_ess(dc, rd, size, store);
+
+        tcg_gen_brcondi_i64(TCG_COND_TSTEQ, ea, (1 << size) - 1, over);
+        gen_helper_unaligned_access(tcg_env, ea);
+        gen_set_label(over);
+    }
+}
 #endif
 
 static inline MemOp mo_endian(DisasContext *dc)
@@ -765,10 +779,11 @@ static bool trans_lbuea(DisasContext *dc, arg_typea *arg)
         return true;
     }
 #ifdef CONFIG_USER_ONLY
-    return true;
+    g_assert_not_reached();
 #else
     TCGv addr = compute_ldst_addr_ea(dc, arg->ra, arg->rb);
-    return do_load(dc, arg->rd, addr, MO_UB, MMU_NOMMU_IDX, false);
+    gen_helper_lbuea(reg_for_write(dc, arg->rd), tcg_env, addr);
+    return true;
 #endif
 }
 
@@ -796,10 +811,13 @@ static bool trans_lhuea(DisasContext *dc, arg_typea *arg)
         return true;
     }
 #ifdef CONFIG_USER_ONLY
-    return true;
+    g_assert_not_reached();
 #else
     TCGv addr = compute_ldst_addr_ea(dc, arg->ra, arg->rb);
-    return do_load(dc, arg->rd, addr, MO_UW, MMU_NOMMU_IDX, false);
+    gen_alignment_check_ea(dc, addr, arg->rb, arg->rd, MO_16, false);
+    (mo_endian(dc) == MO_BE ? gen_helper_lhuea_be : gen_helper_lhuea_le)
+        (reg_for_write(dc, arg->rd), tcg_env, addr);
+    return true;
 #endif
 }
 
@@ -827,10 +845,13 @@ static bool trans_lwea(DisasContext *dc, arg_typea *arg)
         return true;
     }
 #ifdef CONFIG_USER_ONLY
-    return true;
+    g_assert_not_reached();
 #else
     TCGv addr = compute_ldst_addr_ea(dc, arg->ra, arg->rb);
-    return do_load(dc, arg->rd, addr, MO_UL, MMU_NOMMU_IDX, false);
+    gen_alignment_check_ea(dc, addr, arg->rb, arg->rd, MO_32, false);
+    (mo_endian(dc) == MO_BE ? gen_helper_lwea_be : gen_helper_lwea_le)
+        (reg_for_write(dc, arg->rd), tcg_env, addr);
+    return true;
 #endif
 }
 
@@ -918,10 +939,11 @@ static bool trans_sbea(DisasContext *dc, arg_typea *arg)
         return true;
     }
 #ifdef CONFIG_USER_ONLY
-    return true;
+    g_assert_not_reached();
 #else
     TCGv addr = compute_ldst_addr_ea(dc, arg->ra, arg->rb);
-    return do_store(dc, arg->rd, addr, MO_UB, MMU_NOMMU_IDX, false);
+    gen_helper_sbea(tcg_env, reg_for_read(dc, arg->rd), addr);
+    return true;
 #endif
 }
 
@@ -949,10 +971,13 @@ static bool trans_shea(DisasContext *dc, arg_typea *arg)
         return true;
     }
 #ifdef CONFIG_USER_ONLY
-    return true;
+    g_assert_not_reached();
 #else
     TCGv addr = compute_ldst_addr_ea(dc, arg->ra, arg->rb);
-    return do_store(dc, arg->rd, addr, MO_UW, MMU_NOMMU_IDX, false);
+    gen_alignment_check_ea(dc, addr, arg->rb, arg->rd, MO_16, true);
+    (mo_endian(dc) == MO_BE ? gen_helper_shea_be : gen_helper_shea_le)
+        (tcg_env, reg_for_read(dc, arg->rd), addr);
+    return true;
 #endif
 }
 
@@ -980,10 +1005,13 @@ static bool trans_swea(DisasContext *dc, arg_typea *arg)
         return true;
     }
 #ifdef CONFIG_USER_ONLY
-    return true;
+    g_assert_not_reached();
 #else
     TCGv addr = compute_ldst_addr_ea(dc, arg->ra, arg->rb);
-    return do_store(dc, arg->rd, addr, MO_UL, MMU_NOMMU_IDX, false);
+    gen_alignment_check_ea(dc, addr, arg->rb, arg->rd, MO_32, true);
+    (mo_endian(dc) == MO_BE ? gen_helper_swea_be : gen_helper_swea_le)
+        (tcg_env, reg_for_read(dc, arg->rd), addr);
+    return true;
 #endif
 }
 

From 8cea8bd4d3909b7828310a0f76d5194d1bf0095a Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 12 Feb 2025 13:24:08 -0800
Subject: [PATCH 1184/2760] target/microblaze: Use uint64_t for CPUMBState.ear

Use an explicit 64-bit type for EAR.

Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/microblaze/cpu.h       | 2 +-
 target/microblaze/translate.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/microblaze/cpu.h b/target/microblaze/cpu.h
index 6ad8643f2e..3ce28b302f 100644
--- a/target/microblaze/cpu.h
+++ b/target/microblaze/cpu.h
@@ -248,7 +248,7 @@ struct CPUArchState {
     uint32_t pc;
     uint32_t msr;    /* All bits of MSR except MSR[C] and MSR[CC] */
     uint32_t msr_c;  /* MSR[C], in low bit; other bits must be 0 */
-    target_ulong ear;
+    uint64_t ear;
     uint32_t esr;
     uint32_t fsr;
     uint32_t btr;
diff --git a/target/microblaze/translate.c b/target/microblaze/translate.c
index 3d9756391e..b1fc9e5624 100644
--- a/target/microblaze/translate.c
+++ b/target/microblaze/translate.c
@@ -1857,7 +1857,7 @@ void mb_cpu_dump_state(CPUState *cs, FILE *f, int flags)
     }
 
     qemu_fprintf(f, "\nesr=0x%04x fsr=0x%02x btr=0x%08x edr=0x%x\n"
-                 "ear=0x" TARGET_FMT_lx " slr=0x%x shr=0x%x\n",
+                 "ear=0x%" PRIx64 " slr=0x%x shr=0x%x\n",
                  env->esr, env->fsr, env->btr, env->edr,
                  env->ear, env->slr, env->shr);
 

From 14c1d81354c425d98423c41f60db5907f70cf216 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 12 Feb 2025 13:28:18 -0800
Subject: [PATCH 1185/2760] target/microblaze: Use TCGv_i64 for
 compute_ldst_addr_ea

Use an explicit 64-bit type for extended addresses.

Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/microblaze/translate.c | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/target/microblaze/translate.c b/target/microblaze/translate.c
index b1fc9e5624..dc597b36e6 100644
--- a/target/microblaze/translate.c
+++ b/target/microblaze/translate.c
@@ -660,23 +660,23 @@ static TCGv compute_ldst_addr_typeb(DisasContext *dc, int ra, int imm)
 }
 
 #ifndef CONFIG_USER_ONLY
-static TCGv compute_ldst_addr_ea(DisasContext *dc, int ra, int rb)
+static TCGv_i64 compute_ldst_addr_ea(DisasContext *dc, int ra, int rb)
 {
     int addr_size = dc->cfg->addr_size;
-    TCGv ret = tcg_temp_new();
+    TCGv_i64 ret = tcg_temp_new_i64();
 
     if (addr_size == 32 || ra == 0) {
         if (rb) {
-            tcg_gen_extu_i32_tl(ret, cpu_R[rb]);
+            tcg_gen_extu_i32_i64(ret, cpu_R[rb]);
         } else {
-            tcg_gen_movi_tl(ret, 0);
+            return tcg_constant_i64(0);
         }
     } else {
         if (rb) {
             tcg_gen_concat_i32_i64(ret, cpu_R[rb], cpu_R[ra]);
         } else {
-            tcg_gen_extu_i32_tl(ret, cpu_R[ra]);
-            tcg_gen_shli_tl(ret, ret, 32);
+            tcg_gen_extu_i32_i64(ret, cpu_R[ra]);
+            tcg_gen_shli_i64(ret, ret, 32);
         }
         if (addr_size < 64) {
             /* Mask off out of range bits.  */
@@ -781,7 +781,7 @@ static bool trans_lbuea(DisasContext *dc, arg_typea *arg)
 #ifdef CONFIG_USER_ONLY
     g_assert_not_reached();
 #else
-    TCGv addr = compute_ldst_addr_ea(dc, arg->ra, arg->rb);
+    TCGv_i64 addr = compute_ldst_addr_ea(dc, arg->ra, arg->rb);
     gen_helper_lbuea(reg_for_write(dc, arg->rd), tcg_env, addr);
     return true;
 #endif
@@ -813,7 +813,7 @@ static bool trans_lhuea(DisasContext *dc, arg_typea *arg)
 #ifdef CONFIG_USER_ONLY
     g_assert_not_reached();
 #else
-    TCGv addr = compute_ldst_addr_ea(dc, arg->ra, arg->rb);
+    TCGv_i64 addr = compute_ldst_addr_ea(dc, arg->ra, arg->rb);
     gen_alignment_check_ea(dc, addr, arg->rb, arg->rd, MO_16, false);
     (mo_endian(dc) == MO_BE ? gen_helper_lhuea_be : gen_helper_lhuea_le)
         (reg_for_write(dc, arg->rd), tcg_env, addr);
@@ -847,7 +847,7 @@ static bool trans_lwea(DisasContext *dc, arg_typea *arg)
 #ifdef CONFIG_USER_ONLY
     g_assert_not_reached();
 #else
-    TCGv addr = compute_ldst_addr_ea(dc, arg->ra, arg->rb);
+    TCGv_i64 addr = compute_ldst_addr_ea(dc, arg->ra, arg->rb);
     gen_alignment_check_ea(dc, addr, arg->rb, arg->rd, MO_32, false);
     (mo_endian(dc) == MO_BE ? gen_helper_lwea_be : gen_helper_lwea_le)
         (reg_for_write(dc, arg->rd), tcg_env, addr);
@@ -941,7 +941,7 @@ static bool trans_sbea(DisasContext *dc, arg_typea *arg)
 #ifdef CONFIG_USER_ONLY
     g_assert_not_reached();
 #else
-    TCGv addr = compute_ldst_addr_ea(dc, arg->ra, arg->rb);
+    TCGv_i64 addr = compute_ldst_addr_ea(dc, arg->ra, arg->rb);
     gen_helper_sbea(tcg_env, reg_for_read(dc, arg->rd), addr);
     return true;
 #endif
@@ -973,7 +973,7 @@ static bool trans_shea(DisasContext *dc, arg_typea *arg)
 #ifdef CONFIG_USER_ONLY
     g_assert_not_reached();
 #else
-    TCGv addr = compute_ldst_addr_ea(dc, arg->ra, arg->rb);
+    TCGv_i64 addr = compute_ldst_addr_ea(dc, arg->ra, arg->rb);
     gen_alignment_check_ea(dc, addr, arg->rb, arg->rd, MO_16, true);
     (mo_endian(dc) == MO_BE ? gen_helper_shea_be : gen_helper_shea_le)
         (tcg_env, reg_for_read(dc, arg->rd), addr);
@@ -1007,7 +1007,7 @@ static bool trans_swea(DisasContext *dc, arg_typea *arg)
 #ifdef CONFIG_USER_ONLY
     g_assert_not_reached();
 #else
-    TCGv addr = compute_ldst_addr_ea(dc, arg->ra, arg->rb);
+    TCGv_i64 addr = compute_ldst_addr_ea(dc, arg->ra, arg->rb);
     gen_alignment_check_ea(dc, addr, arg->rb, arg->rd, MO_32, true);
     (mo_endian(dc) == MO_BE ? gen_helper_swea_be : gen_helper_swea_le)
         (tcg_env, reg_for_read(dc, arg->rd), addr);

From 17ac97a9581fa9dd9c433d7562506a514f7292b3 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 12 Feb 2025 13:34:52 -0800
Subject: [PATCH 1186/2760] target/microblaze: Fix printf format in
 mmu_translate

Use TARGET_FMT_lx to match the target_ulong type of vaddr.

Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/microblaze/mmu.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/target/microblaze/mmu.c b/target/microblaze/mmu.c
index 95a12e16f8..8703ff5c65 100644
--- a/target/microblaze/mmu.c
+++ b/target/microblaze/mmu.c
@@ -172,7 +172,8 @@ unsigned int mmu_translate(MicroBlazeCPU *cpu, MicroBlazeMMULookup *lu,
     }
 done:
     qemu_log_mask(CPU_LOG_MMU,
-                  "MMU vaddr=%" PRIx64 " rw=%d tlb_wr=%d tlb_ex=%d hit=%d\n",
+                  "MMU vaddr=0x" TARGET_FMT_lx
+                  " rw=%d tlb_wr=%d tlb_ex=%d hit=%d\n",
                   vaddr, rw, tlb_wr, tlb_ex, hit);
     return hit;
 }

From b52ee0c1a4205c8d698c37557401d2f55e071fba Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 12 Feb 2025 13:37:39 -0800
Subject: [PATCH 1187/2760] target/microblaze: Use TARGET_LONG_BITS == 32 for
 system mode

Now that the extended address instructions are handled separately
from virtual addresses, we can narrow the emulation to 32-bit.

Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 configs/targets/microblaze-softmmu.mak   | 4 +---
 configs/targets/microblazeel-softmmu.mak | 4 +---
 2 files changed, 2 insertions(+), 6 deletions(-)

diff --git a/configs/targets/microblaze-softmmu.mak b/configs/targets/microblaze-softmmu.mak
index 23457d0ae6..bab7b498c2 100644
--- a/configs/targets/microblaze-softmmu.mak
+++ b/configs/targets/microblaze-softmmu.mak
@@ -3,6 +3,4 @@ TARGET_BIG_ENDIAN=y
 # needed by boot.c
 TARGET_NEED_FDT=y
 TARGET_XML_FILES=gdb-xml/microblaze-core.xml gdb-xml/microblaze-stack-protect.xml
-# System mode can address up to 64 bits via lea/sea instructions.
-# TODO: These bypass the mmu, so we could emulate these differently.
-TARGET_LONG_BITS=64
+TARGET_LONG_BITS=32
diff --git a/configs/targets/microblazeel-softmmu.mak b/configs/targets/microblazeel-softmmu.mak
index c82c509623..8aee7ebc5c 100644
--- a/configs/targets/microblazeel-softmmu.mak
+++ b/configs/targets/microblazeel-softmmu.mak
@@ -2,6 +2,4 @@ TARGET_ARCH=microblaze
 # needed by boot.c
 TARGET_NEED_FDT=y
 TARGET_XML_FILES=gdb-xml/microblaze-core.xml gdb-xml/microblaze-stack-protect.xml
-# System mode can address up to 64 bits via lea/sea instructions.
-# TODO: These bypass the mmu, so we could emulate these differently.
-TARGET_LONG_BITS=64
+TARGET_LONG_BITS=32

From bd07403fc146a9bfc5312404a63f24cc48701c97 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 12 Feb 2025 13:54:18 -0800
Subject: [PATCH 1188/2760] target/microblaze: Drop DisasContext.r0

Return a constant 0 from reg_for_read, and a new
temporary from reg_for_write.

Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/microblaze/translate.c | 24 ++----------------------
 1 file changed, 2 insertions(+), 22 deletions(-)

diff --git a/target/microblaze/translate.c b/target/microblaze/translate.c
index dc597b36e6..047d97e2c5 100644
--- a/target/microblaze/translate.c
+++ b/target/microblaze/translate.c
@@ -63,9 +63,6 @@ typedef struct DisasContext {
     DisasContextBase base;
     const MicroBlazeCPUConfig *cfg;
 
-    TCGv_i32 r0;
-    bool r0_set;
-
     /* Decoder.  */
     uint32_t ext_imm;
     unsigned int tb_flags;
@@ -179,14 +176,7 @@ static TCGv_i32 reg_for_read(DisasContext *dc, int reg)
     if (likely(reg != 0)) {
         return cpu_R[reg];
     }
-    if (!dc->r0_set) {
-        if (dc->r0 == NULL) {
-            dc->r0 = tcg_temp_new_i32();
-        }
-        tcg_gen_movi_i32(dc->r0, 0);
-        dc->r0_set = true;
-    }
-    return dc->r0;
+    return tcg_constant_i32(0);
 }
 
 static TCGv_i32 reg_for_write(DisasContext *dc, int reg)
@@ -194,10 +184,7 @@ static TCGv_i32 reg_for_write(DisasContext *dc, int reg)
     if (likely(reg != 0)) {
         return cpu_R[reg];
     }
-    if (dc->r0 == NULL) {
-        dc->r0 = tcg_temp_new_i32();
-    }
-    return dc->r0;
+    return tcg_temp_new_i32();
 }
 
 static bool do_typea(DisasContext *dc, arg_typea *arg, bool side_effects,
@@ -1635,8 +1622,6 @@ static void mb_tr_init_disas_context(DisasContextBase *dcb, CPUState *cs)
     dc->cfg = &cpu->cfg;
     dc->tb_flags = dc->base.tb->flags;
     dc->ext_imm = dc->base.tb->cs_base;
-    dc->r0 = NULL;
-    dc->r0_set = false;
     dc->mem_index = cpu_mmu_index(cs, false);
     dc->jmp_cond = dc->tb_flags & D_FLAG ? TCG_COND_ALWAYS : TCG_COND_NEVER;
     dc->jmp_dest = -1;
@@ -1675,11 +1660,6 @@ static void mb_tr_translate_insn(DisasContextBase *dcb, CPUState *cs)
         trap_illegal(dc, true);
     }
 
-    if (dc->r0) {
-        dc->r0 = NULL;
-        dc->r0_set = false;
-    }
-
     /* Discard the imm global when its contents cannot be used. */
     if ((dc->tb_flags & ~dc->tb_flags_to_set) & IMM_FLAG) {
         tcg_gen_discard_i32(cpu_imm);

From 36a9529e60e09b0d0b6b5ebad614255c97bf9322 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 12 Feb 2025 13:56:32 -0800
Subject: [PATCH 1189/2760] target/microblaze: Simplify
 compute_ldst_addr_type{a,b}

Require TCGv_i32 and TCGv be identical, so drop
the extensions.  Return constants when possible
instead of a mov into a temporary.  Return register
inputs unchanged when possible.

Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/microblaze/translate.c | 26 +++++++++++++-------------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/target/microblaze/translate.c b/target/microblaze/translate.c
index 047d97e2c5..5098a1db4d 100644
--- a/target/microblaze/translate.c
+++ b/target/microblaze/translate.c
@@ -606,19 +606,18 @@ DO_TYPEBI(xori, false, tcg_gen_xori_i32)
 
 static TCGv compute_ldst_addr_typea(DisasContext *dc, int ra, int rb)
 {
-    TCGv ret = tcg_temp_new();
+    TCGv ret;
 
     /* If any of the regs is r0, set t to the value of the other reg.  */
     if (ra && rb) {
-        TCGv_i32 tmp = tcg_temp_new_i32();
-        tcg_gen_add_i32(tmp, cpu_R[ra], cpu_R[rb]);
-        tcg_gen_extu_i32_tl(ret, tmp);
+        ret = tcg_temp_new_i32();
+        tcg_gen_add_i32(ret, cpu_R[ra], cpu_R[rb]);
     } else if (ra) {
-        tcg_gen_extu_i32_tl(ret, cpu_R[ra]);
+        ret = cpu_R[ra];
     } else if (rb) {
-        tcg_gen_extu_i32_tl(ret, cpu_R[rb]);
+        ret = cpu_R[rb];
     } else {
-        tcg_gen_movi_tl(ret, 0);
+        ret = tcg_constant_i32(0);
     }
 
     if ((ra == 1 || rb == 1) && dc->cfg->stackprot) {
@@ -629,15 +628,16 @@ static TCGv compute_ldst_addr_typea(DisasContext *dc, int ra, int rb)
 
 static TCGv compute_ldst_addr_typeb(DisasContext *dc, int ra, int imm)
 {
-    TCGv ret = tcg_temp_new();
+    TCGv ret;
 
     /* If any of the regs is r0, set t to the value of the other reg.  */
-    if (ra) {
-        TCGv_i32 tmp = tcg_temp_new_i32();
-        tcg_gen_addi_i32(tmp, cpu_R[ra], imm);
-        tcg_gen_extu_i32_tl(ret, tmp);
+    if (ra && imm) {
+        ret = tcg_temp_new_i32();
+        tcg_gen_addi_i32(ret, cpu_R[ra], imm);
+    } else if (ra) {
+        ret = cpu_R[ra];
     } else {
-        tcg_gen_movi_tl(ret, (uint32_t)imm);
+        ret = tcg_constant_i32(imm);
     }
 
     if (ra == 1 && dc->cfg->stackprot) {

From 9cfcf8c3b7b7a95e754a9fce565a88c6c76ce128 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 1 May 2025 11:16:31 -0700
Subject: [PATCH 1190/2760] tcg: Drop TCGContext.tlb_dyn_max_bits

This was an extremely minor optimization for aarch64
and x86_64, to use a 32-bit AND instruction when the
guest softmmu tlb maximum was sufficiently small.
Both hosts can simply use a 64-bit AND insn instead.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/translate-all.c    | 2 --
 include/tcg/tcg.h            | 1 -
 tcg/aarch64/tcg-target.c.inc | 6 +-----
 tcg/i386/tcg-target.c.inc    | 6 ++----
 4 files changed, 3 insertions(+), 12 deletions(-)

diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index 451b383aa8..6735a40ade 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -24,7 +24,6 @@
 #include "tcg/tcg.h"
 #include "exec/mmap-lock.h"
 #include "tb-internal.h"
-#include "tlb-bounds.h"
 #include "exec/tb-flush.h"
 #include "qemu/cacheinfo.h"
 #include "qemu/target-info.h"
@@ -316,7 +315,6 @@ TranslationBlock *tb_gen_code(CPUState *cpu, TCGTBCPUState s)
 #ifdef CONFIG_SOFTMMU
     tcg_ctx->page_bits = TARGET_PAGE_BITS;
     tcg_ctx->page_mask = TARGET_PAGE_MASK;
-    tcg_ctx->tlb_dyn_max_bits = CPU_TLB_DYN_MAX_BITS;
 #endif
     tcg_ctx->guest_mo = cpu->cc->tcg_ops->guest_default_memory_order;
 
diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
index 3fa5a7aed2..e440c889c8 100644
--- a/include/tcg/tcg.h
+++ b/include/tcg/tcg.h
@@ -368,7 +368,6 @@ struct TCGContext {
 
     int page_mask;
     uint8_t page_bits;
-    uint8_t tlb_dyn_max_bits;
     TCGBar guest_mo;
 
     TCGRegSet reserved_regs;
diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index 4cb647cb34..6356a81c2a 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -1661,7 +1661,6 @@ static TCGLabelQemuLdst *prepare_host_addr(TCGContext *s, HostAddress *h,
         unsigned s_mask = (1u << s_bits) - 1;
         unsigned mem_index = get_mmuidx(oi);
         TCGReg addr_adj;
-        TCGType mask_type;
         uint64_t compare_mask;
 
         ldst = new_ldst_label(s);
@@ -1669,9 +1668,6 @@ static TCGLabelQemuLdst *prepare_host_addr(TCGContext *s, HostAddress *h,
         ldst->oi = oi;
         ldst->addr_reg = addr_reg;
 
-        mask_type = (s->page_bits + s->tlb_dyn_max_bits > 32
-                     ? TCG_TYPE_I64 : TCG_TYPE_I32);
-
         /* Load cpu->neg.tlb.f[mmu_idx].{mask,table} into {tmp0,tmp1}. */
         QEMU_BUILD_BUG_ON(offsetof(CPUTLBDescFast, mask) != 0);
         QEMU_BUILD_BUG_ON(offsetof(CPUTLBDescFast, table) != 8);
@@ -1679,7 +1675,7 @@ static TCGLabelQemuLdst *prepare_host_addr(TCGContext *s, HostAddress *h,
                      tlb_mask_table_ofs(s, mem_index), 1, 0);
 
         /* Extract the TLB index from the address into X0.  */
-        tcg_out_insn(s, 3502S, AND_LSR, mask_type == TCG_TYPE_I64,
+        tcg_out_insn(s, 3502S, AND_LSR, TCG_TYPE_I64,
                      TCG_REG_TMP0, TCG_REG_TMP0, addr_reg,
                      s->page_bits - CPU_TLB_ENTRY_BITS);
 
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index 09fce27b06..2990912080 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -2199,10 +2199,8 @@ static TCGLabelQemuLdst *prepare_host_addr(TCGContext *s, HostAddress *h,
             trexw = (ttype == TCG_TYPE_I32 ? 0 : P_REXW);
             if (TCG_TYPE_PTR == TCG_TYPE_I64) {
                 hrexw = P_REXW;
-                if (s->page_bits + s->tlb_dyn_max_bits > 32) {
-                    tlbtype = TCG_TYPE_I64;
-                    tlbrexw = P_REXW;
-                }
+                tlbtype = TCG_TYPE_I64;
+                tlbrexw = P_REXW;
             }
         }
 

From 11efde54f248c2da9e164910b8b1945e78a7168e Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 1 May 2025 11:38:03 -0700
Subject: [PATCH 1191/2760] tcg: Drop TCGContext.page_{mask,bits}

Use exec/target_page.h instead of independent variables.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/translate-all.c        |  4 ----
 include/tcg/tcg.h                |  3 ---
 tcg/aarch64/tcg-target.c.inc     |  4 ++--
 tcg/arm/tcg-target.c.inc         | 10 +++++-----
 tcg/i386/tcg-target.c.inc        |  4 ++--
 tcg/loongarch64/tcg-target.c.inc |  4 ++--
 tcg/mips/tcg-target.c.inc        |  6 +++---
 tcg/perf.c                       |  2 +-
 tcg/ppc/tcg-target.c.inc         | 14 +++++++-------
 tcg/riscv/tcg-target.c.inc       |  4 ++--
 tcg/s390x/tcg-target.c.inc       |  4 ++--
 tcg/sparc64/tcg-target.c.inc     |  4 ++--
 tcg/tcg-op-ldst.c                |  3 ++-
 tcg/tcg.c                        |  1 +
 14 files changed, 31 insertions(+), 36 deletions(-)

diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index 6735a40ade..d468667b0d 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -312,10 +312,6 @@ TranslationBlock *tb_gen_code(CPUState *cpu, TCGTBCPUState s)
 
     tcg_ctx->gen_tb = tb;
     tcg_ctx->addr_type = target_long_bits() == 32 ? TCG_TYPE_I32 : TCG_TYPE_I64;
-#ifdef CONFIG_SOFTMMU
-    tcg_ctx->page_bits = TARGET_PAGE_BITS;
-    tcg_ctx->page_mask = TARGET_PAGE_MASK;
-#endif
     tcg_ctx->guest_mo = cpu->cc->tcg_ops->guest_default_memory_order;
 
  restart_translate:
diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
index e440c889c8..125323f153 100644
--- a/include/tcg/tcg.h
+++ b/include/tcg/tcg.h
@@ -365,9 +365,6 @@ struct TCGContext {
     int nb_indirects;
     int nb_ops;
     TCGType addr_type;            /* TCG_TYPE_I32 or TCG_TYPE_I64 */
-
-    int page_mask;
-    uint8_t page_bits;
     TCGBar guest_mo;
 
     TCGRegSet reserved_regs;
diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index 6356a81c2a..3b088b7bd9 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -1677,7 +1677,7 @@ static TCGLabelQemuLdst *prepare_host_addr(TCGContext *s, HostAddress *h,
         /* Extract the TLB index from the address into X0.  */
         tcg_out_insn(s, 3502S, AND_LSR, TCG_TYPE_I64,
                      TCG_REG_TMP0, TCG_REG_TMP0, addr_reg,
-                     s->page_bits - CPU_TLB_ENTRY_BITS);
+                     TARGET_PAGE_BITS - CPU_TLB_ENTRY_BITS);
 
         /* Add the tlb_table pointer, forming the CPUTLBEntry address. */
         tcg_out_insn(s, 3502, ADD, 1, TCG_REG_TMP1, TCG_REG_TMP1, TCG_REG_TMP0);
@@ -1703,7 +1703,7 @@ static TCGLabelQemuLdst *prepare_host_addr(TCGContext *s, HostAddress *h,
             tcg_out_insn(s, 3401, ADDI, addr_type,
                          addr_adj, addr_reg, s_mask - a_mask);
         }
-        compare_mask = (uint64_t)s->page_mask | a_mask;
+        compare_mask = (uint64_t)TARGET_PAGE_MASK | a_mask;
 
         /* Store the page mask part of the address into TMP2.  */
         tcg_out_logicali(s, I3404_ANDI, addr_type, TCG_REG_TMP2,
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index 447e43583e..836894b16a 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -1427,7 +1427,7 @@ static TCGLabelQemuLdst *prepare_host_addr(TCGContext *s, HostAddress *h,
 
         /* Extract the tlb index from the address into R0.  */
         tcg_out_dat_reg(s, COND_AL, ARITH_AND, TCG_REG_R0, TCG_REG_R0, addr,
-                        SHIFT_IMM_LSR(s->page_bits - CPU_TLB_ENTRY_BITS));
+                        SHIFT_IMM_LSR(TARGET_PAGE_BITS - CPU_TLB_ENTRY_BITS));
 
         /*
          * Add the tlb_table pointer, creating the CPUTLBEntry address in R1.
@@ -1463,8 +1463,8 @@ static TCGLabelQemuLdst *prepare_host_addr(TCGContext *s, HostAddress *h,
             tcg_out_dat_imm(s, COND_AL, ARITH_ADD, t_addr,
                             addr, s_mask - a_mask);
         }
-        if (use_armv7_instructions && s->page_bits <= 16) {
-            tcg_out_movi32(s, COND_AL, TCG_REG_TMP, ~(s->page_mask | a_mask));
+        if (use_armv7_instructions && TARGET_PAGE_BITS <= 16) {
+            tcg_out_movi32(s, COND_AL, TCG_REG_TMP, ~(TARGET_PAGE_MASK | a_mask));
             tcg_out_dat_reg(s, COND_AL, ARITH_BIC, TCG_REG_TMP,
                             t_addr, TCG_REG_TMP, 0);
             tcg_out_dat_reg(s, COND_AL, ARITH_CMP, 0,
@@ -1475,10 +1475,10 @@ static TCGLabelQemuLdst *prepare_host_addr(TCGContext *s, HostAddress *h,
                 tcg_out_dat_imm(s, COND_AL, ARITH_TST, 0, addr, a_mask);
             }
             tcg_out_dat_reg(s, COND_AL, ARITH_MOV, TCG_REG_TMP, 0, t_addr,
-                            SHIFT_IMM_LSR(s->page_bits));
+                            SHIFT_IMM_LSR(TARGET_PAGE_BITS));
             tcg_out_dat_reg(s, (a_mask ? COND_EQ : COND_AL), ARITH_CMP,
                             0, TCG_REG_R2, TCG_REG_TMP,
-                            SHIFT_IMM_LSL(s->page_bits));
+                            SHIFT_IMM_LSL(TARGET_PAGE_BITS));
         }
     } else if (a_mask) {
         ldst = new_ldst_label(s);
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index 2990912080..088c6c9264 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -2206,7 +2206,7 @@ static TCGLabelQemuLdst *prepare_host_addr(TCGContext *s, HostAddress *h,
 
         tcg_out_mov(s, tlbtype, TCG_REG_L0, addr);
         tcg_out_shifti(s, SHIFT_SHR + tlbrexw, TCG_REG_L0,
-                       s->page_bits - CPU_TLB_ENTRY_BITS);
+                       TARGET_PAGE_BITS - CPU_TLB_ENTRY_BITS);
 
         tcg_out_modrm_offset(s, OPC_AND_GvEv + trexw, TCG_REG_L0, TCG_AREG0,
                              fast_ofs + offsetof(CPUTLBDescFast, mask));
@@ -2225,7 +2225,7 @@ static TCGLabelQemuLdst *prepare_host_addr(TCGContext *s, HostAddress *h,
             tcg_out_modrm_offset(s, OPC_LEA + trexw, TCG_REG_L1,
                                  addr, s_mask - a_mask);
         }
-        tlb_mask = s->page_mask | a_mask;
+        tlb_mask = TARGET_PAGE_MASK | a_mask;
         tgen_arithi(s, ARITH_AND + trexw, TCG_REG_L1, tlb_mask, 0);
 
         /* cmp 0(TCG_REG_L0), TCG_REG_L1 */
diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.c.inc
index e5580d69a8..10c69211ac 100644
--- a/tcg/loongarch64/tcg-target.c.inc
+++ b/tcg/loongarch64/tcg-target.c.inc
@@ -1065,7 +1065,7 @@ static TCGLabelQemuLdst *prepare_host_addr(TCGContext *s, HostAddress *h,
         tcg_out_ld(s, TCG_TYPE_PTR, TCG_REG_TMP1, TCG_AREG0, table_ofs);
 
         tcg_out_opc_srli_d(s, TCG_REG_TMP2, addr_reg,
-                           s->page_bits - CPU_TLB_ENTRY_BITS);
+                           TARGET_PAGE_BITS - CPU_TLB_ENTRY_BITS);
         tcg_out_opc_and(s, TCG_REG_TMP2, TCG_REG_TMP2, TCG_REG_TMP0);
         tcg_out_opc_add_d(s, TCG_REG_TMP2, TCG_REG_TMP2, TCG_REG_TMP1);
 
@@ -1091,7 +1091,7 @@ static TCGLabelQemuLdst *prepare_host_addr(TCGContext *s, HostAddress *h,
             tcg_out_mov(s, addr_type, TCG_REG_TMP1, addr_reg);
         }
         tcg_out_opc_bstrins_d(s, TCG_REG_TMP1, TCG_REG_ZERO,
-                              a_bits, s->page_bits - 1);
+                              a_bits, TARGET_PAGE_BITS - 1);
 
         /* Compare masked address with the TLB entry.  */
         ldst->label_ptr[0] = s->code_ptr;
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index 2c0457e588..400eafbab4 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -1199,9 +1199,9 @@ static TCGLabelQemuLdst *prepare_host_addr(TCGContext *s, HostAddress *h,
         /* Extract the TLB index from the address into TMP3.  */
         if (TCG_TARGET_REG_BITS == 32 || addr_type == TCG_TYPE_I32) {
             tcg_out_opc_sa(s, OPC_SRL, TCG_TMP3, addr,
-                           s->page_bits - CPU_TLB_ENTRY_BITS);
+                           TARGET_PAGE_BITS - CPU_TLB_ENTRY_BITS);
         } else {
-            tcg_out_dsrl(s, TCG_TMP3, addr, s->page_bits - CPU_TLB_ENTRY_BITS);
+            tcg_out_dsrl(s, TCG_TMP3, addr, TARGET_PAGE_BITS - CPU_TLB_ENTRY_BITS);
         }
         tcg_out_opc_reg(s, OPC_AND, TCG_TMP3, TCG_TMP3, TCG_TMP0);
 
@@ -1224,7 +1224,7 @@ static TCGLabelQemuLdst *prepare_host_addr(TCGContext *s, HostAddress *h,
          * For unaligned accesses, compare against the end of the access to
          * verify that it does not cross a page boundary.
          */
-        tcg_out_movi(s, addr_type, TCG_TMP1, s->page_mask | a_mask);
+        tcg_out_movi(s, addr_type, TCG_TMP1, TARGET_PAGE_MASK | a_mask);
         if (a_mask < s_mask) {
             tcg_out_opc_imm(s, (TCG_TARGET_REG_BITS == 32
                                 || addr_type == TCG_TYPE_I32
diff --git a/tcg/perf.c b/tcg/perf.c
index 4e8d2c1bee..8fa5fa9991 100644
--- a/tcg/perf.c
+++ b/tcg/perf.c
@@ -334,7 +334,7 @@ void perf_report_code(uint64_t guest_pc, TranslationBlock *tb,
         /* FIXME: This replicates the restore_state_to_opc() logic. */
         q[insn].address = gen_insn_data[insn * INSN_START_WORDS + 0];
         if (tb_cflags(tb) & CF_PCREL) {
-            q[insn].address |= (guest_pc & qemu_target_page_mask());
+            q[insn].address |= guest_pc & TARGET_PAGE_MASK;
         }
         q[insn].flags = DEBUGINFO_SYMBOL | (jitdump ? DEBUGINFO_LINE : 0);
     }
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index 2e94778104..b8b23d44d5 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -2440,10 +2440,10 @@ static TCGLabelQemuLdst *prepare_host_addr(TCGContext *s, HostAddress *h,
         /* Extract the page index, shifted into place for tlb index.  */
         if (TCG_TARGET_REG_BITS == 32) {
             tcg_out_shri32(s, TCG_REG_R0, addr,
-                           s->page_bits - CPU_TLB_ENTRY_BITS);
+                           TARGET_PAGE_BITS - CPU_TLB_ENTRY_BITS);
         } else {
             tcg_out_shri64(s, TCG_REG_R0, addr,
-                           s->page_bits - CPU_TLB_ENTRY_BITS);
+                           TARGET_PAGE_BITS - CPU_TLB_ENTRY_BITS);
         }
         tcg_out32(s, AND | SAB(TCG_REG_TMP1, TCG_REG_TMP1, TCG_REG_R0));
 
@@ -2480,7 +2480,7 @@ static TCGLabelQemuLdst *prepare_host_addr(TCGContext *s, HostAddress *h,
                 a_bits = s_bits;
             }
             tcg_out_rlw(s, RLWINM, TCG_REG_R0, addr, 0,
-                        (32 - a_bits) & 31, 31 - s->page_bits);
+                        (32 - a_bits) & 31, 31 - TARGET_PAGE_BITS);
         } else {
             TCGReg t = addr;
 
@@ -2501,13 +2501,13 @@ static TCGLabelQemuLdst *prepare_host_addr(TCGContext *s, HostAddress *h,
             /* Mask the address for the requested alignment.  */
             if (addr_type == TCG_TYPE_I32) {
                 tcg_out_rlw(s, RLWINM, TCG_REG_R0, t, 0,
-                            (32 - a_bits) & 31, 31 - s->page_bits);
+                            (32 - a_bits) & 31, 31 - TARGET_PAGE_BITS);
             } else if (a_bits == 0) {
-                tcg_out_rld(s, RLDICR, TCG_REG_R0, t, 0, 63 - s->page_bits);
+                tcg_out_rld(s, RLDICR, TCG_REG_R0, t, 0, 63 - TARGET_PAGE_BITS);
             } else {
                 tcg_out_rld(s, RLDICL, TCG_REG_R0, t,
-                            64 - s->page_bits, s->page_bits - a_bits);
-                tcg_out_rld(s, RLDICL, TCG_REG_R0, TCG_REG_R0, s->page_bits, 0);
+                            64 - TARGET_PAGE_BITS, TARGET_PAGE_BITS - a_bits);
+                tcg_out_rld(s, RLDICL, TCG_REG_R0, TCG_REG_R0, TARGET_PAGE_BITS, 0);
             }
         }
 
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index f9417d15f7..1800fd5077 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -1706,7 +1706,7 @@ static TCGLabelQemuLdst *prepare_host_addr(TCGContext *s, TCGReg *pbase,
         tcg_out_ld(s, TCG_TYPE_PTR, TCG_REG_TMP1, TCG_AREG0, table_ofs);
 
         tcg_out_opc_imm(s, OPC_SRLI, TCG_REG_TMP2, addr_reg,
-                        s->page_bits - CPU_TLB_ENTRY_BITS);
+                        TARGET_PAGE_BITS - CPU_TLB_ENTRY_BITS);
         tcg_out_opc_reg(s, OPC_AND, TCG_REG_TMP2, TCG_REG_TMP2, TCG_REG_TMP0);
         tcg_out_opc_reg(s, OPC_ADD, TCG_REG_TMP2, TCG_REG_TMP2, TCG_REG_TMP1);
 
@@ -1722,7 +1722,7 @@ static TCGLabelQemuLdst *prepare_host_addr(TCGContext *s, TCGReg *pbase,
             tcg_out_opc_imm(s, addr_type == TCG_TYPE_I32 ? OPC_ADDIW : OPC_ADDI,
                             addr_adj, addr_reg, s_mask - a_mask);
         }
-        compare_mask = s->page_mask | a_mask;
+        compare_mask = TARGET_PAGE_MASK | a_mask;
         if (compare_mask == sextreg(compare_mask, 0, 12)) {
             tcg_out_opc_imm(s, OPC_ANDI, TCG_REG_TMP1, addr_adj, compare_mask);
         } else {
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index 7ca0071f24..84a9e73a46 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -2004,7 +2004,7 @@ static TCGLabelQemuLdst *prepare_host_addr(TCGContext *s, HostAddress *h,
         ldst->addr_reg = addr_reg;
 
         tcg_out_sh64(s, RSY_SRLG, TCG_TMP0, addr_reg, TCG_REG_NONE,
-                     s->page_bits - CPU_TLB_ENTRY_BITS);
+                     TARGET_PAGE_BITS - CPU_TLB_ENTRY_BITS);
 
         tcg_out_insn(s, RXY, NG, TCG_TMP0, TCG_AREG0, TCG_REG_NONE, mask_off);
         tcg_out_insn(s, RXY, AG, TCG_TMP0, TCG_AREG0, TCG_REG_NONE, table_off);
@@ -2016,7 +2016,7 @@ static TCGLabelQemuLdst *prepare_host_addr(TCGContext *s, HostAddress *h,
          * byte of the access.
          */
         a_off = (a_mask >= s_mask ? 0 : s_mask - a_mask);
-        tlb_mask = (uint64_t)s->page_mask | a_mask;
+        tlb_mask = (uint64_t)TARGET_PAGE_MASK | a_mask;
         if (a_off == 0) {
             tgen_andi_risbg(s, TCG_REG_R0, addr_reg, tlb_mask);
         } else {
diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index 9e004fb511..5e5c3f1cda 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -1120,7 +1120,7 @@ static TCGLabelQemuLdst *prepare_host_addr(TCGContext *s, HostAddress *h,
 
     /* Extract the page index, shifted into place for tlb index.  */
     tcg_out_arithi(s, TCG_REG_T1, addr_reg,
-                   s->page_bits - CPU_TLB_ENTRY_BITS, SHIFT_SRL);
+                   TARGET_PAGE_BITS - CPU_TLB_ENTRY_BITS, SHIFT_SRL);
     tcg_out_arith(s, TCG_REG_T1, TCG_REG_T1, TCG_REG_T2, ARITH_AND);
 
     /* Add the tlb_table pointer, creating the CPUTLBEntry address into R2.  */
@@ -1136,7 +1136,7 @@ static TCGLabelQemuLdst *prepare_host_addr(TCGContext *s, HostAddress *h,
     h->base = TCG_REG_T1;
 
     /* Mask out the page offset, except for the required alignment. */
-    compare_mask = s->page_mask | a_mask;
+    compare_mask = TARGET_PAGE_MASK | a_mask;
     if (check_fit_tl(compare_mask, 13)) {
         tcg_out_arithi(s, TCG_REG_T3, addr_reg, compare_mask, ARITH_AND);
     } else {
diff --git a/tcg/tcg-op-ldst.c b/tcg/tcg-op-ldst.c
index fa9e52277b..548496002d 100644
--- a/tcg/tcg-op-ldst.c
+++ b/tcg/tcg-op-ldst.c
@@ -27,6 +27,7 @@
 #include "tcg/tcg-temp-internal.h"
 #include "tcg/tcg-op-common.h"
 #include "tcg/tcg-mo.h"
+#include "exec/target_page.h"
 #include "exec/translation-block.h"
 #include "exec/plugin-gen.h"
 #include "tcg-internal.h"
@@ -40,7 +41,7 @@ static void check_max_alignment(unsigned a_bits)
      * FIXME: Must keep the count up-to-date with "exec/tlb-flags.h".
      */
     if (tcg_use_softmmu) {
-        tcg_debug_assert(a_bits + 5 <= tcg_ctx->page_bits);
+        tcg_debug_assert(a_bits + 5 <= TARGET_PAGE_BITS);
     }
 }
 
diff --git a/tcg/tcg.c b/tcg/tcg.c
index ae27a2607d..d714ae2889 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -34,6 +34,7 @@
 #include "qemu/cacheflush.h"
 #include "qemu/cacheinfo.h"
 #include "qemu/timer.h"
+#include "exec/target_page.h"
 #include "exec/translation-block.h"
 #include "exec/tlb-common.h"
 #include "tcg/startup.h"

From eb978e50e42f3439e7a7a104e76aafc81bc4a028 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 3 May 2025 13:40:26 -0700
Subject: [PATCH 1192/2760] target/sh4: Use MO_ALIGN for system UNALIGN()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This should have been done before removing TARGET_ALIGNED_ONLY,
as we did for hppa and alpha.

Cc: Yoshinori Sato <ysato@users.sourceforge.jp>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Fixes: 8244189419f9 ("target/sh4: Remove TARGET_ALIGNED_ONLY")
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/sh4/translate.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/sh4/translate.c b/target/sh4/translate.c
index bf8828fce8..70fd13aa3f 100644
--- a/target/sh4/translate.c
+++ b/target/sh4/translate.c
@@ -54,7 +54,7 @@ typedef struct DisasContext {
 #define UNALIGN(C)   (ctx->tbflags & TB_FLAG_UNALIGN ? MO_UNALN : MO_ALIGN)
 #else
 #define IS_USER(ctx) (!(ctx->tbflags & (1u << SR_MD)))
-#define UNALIGN(C)   0
+#define UNALIGN(C)   MO_ALIGN
 #endif
 
 /* Target-specific values for ctx->base.is_jmp.  */

From bdf26b5d16dd2264553308aa6bbf24b4749fcc07 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 3 May 2025 13:17:17 -0700
Subject: [PATCH 1193/2760] accel/tcg: Add TCGCPUOps.pointer_wrap
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c          | 6 ++++++
 include/accel/tcg/cpu-ops.h | 7 +++++++
 2 files changed, 13 insertions(+)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index 86d0deb08c..81ff725cbc 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -1773,6 +1773,12 @@ static bool mmu_lookup(CPUState *cpu, vaddr addr, MemOpIdx oi,
         l->page[1].size = l->page[0].size - size0;
         l->page[0].size = size0;
 
+        if (cpu->cc->tcg_ops->pointer_wrap) {
+            l->page[1].addr = cpu->cc->tcg_ops->pointer_wrap(cpu, l->mmu_idx,
+                                                             l->page[1].addr,
+                                                             addr);
+        }
+
         /*
          * Lookup both pages, recognizing exceptions from either.  If the
          * second lookup potentially resized, refresh first CPUTLBEntryFull.
diff --git a/include/accel/tcg/cpu-ops.h b/include/accel/tcg/cpu-ops.h
index cd22e5d5b9..83b2c2c864 100644
--- a/include/accel/tcg/cpu-ops.h
+++ b/include/accel/tcg/cpu-ops.h
@@ -222,6 +222,13 @@ struct TCGCPUOps {
     bool (*tlb_fill)(CPUState *cpu, vaddr address, int size,
                      MMUAccessType access_type, int mmu_idx,
                      bool probe, uintptr_t retaddr);
+    /**
+     * @pointer_wrap:
+     *
+     * We have incremented @base to @result, resulting in a page change.
+     * For the current cpu state, adjust @result for possible overflow.
+     */
+    vaddr (*pointer_wrap)(CPUState *cpu, int mmu_idx, vaddr result, vaddr base);
     /**
      * @do_transaction_failed: Callback for handling failed memory transactions
      * (ie bus faults or external aborts; not MMU faults)

From a4027ed7d4becb4cb67c912c75ecd4846b148829 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 3 May 2025 13:45:26 -0700
Subject: [PATCH 1194/2760] target: Use cpu_pointer_wrap_notreached for strict
 align targets
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Alpha, HPPA, and SH4 always use aligned addresses,
and therefore never produce accesses that cross pages.

Cc: Helge Deller <deller@gmx.de>
Cc: Yoshinori Sato <ysato@users.sourceforge.jp>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c          | 13 +++++++++++++
 include/accel/tcg/cpu-ops.h |  5 +++++
 target/alpha/cpu.c          |  1 +
 target/hppa/cpu.c           |  1 +
 target/sh4/cpu.c            |  1 +
 5 files changed, 21 insertions(+)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index 81ff725cbc..49ec3ee5dc 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -2933,3 +2933,16 @@ uint64_t cpu_ldq_code_mmu(CPUArchState *env, vaddr addr,
 {
     return do_ld8_mmu(env_cpu(env), addr, oi, retaddr, MMU_INST_FETCH);
 }
+
+/*
+ * Common pointer_wrap implementations.
+ */
+
+/*
+ * To be used for strict alignment targets.
+ * Because no accesses are unaligned, no accesses wrap either.
+ */
+vaddr cpu_pointer_wrap_notreached(CPUState *cs, int idx, vaddr res, vaddr base)
+{
+    g_assert_not_reached();
+}
diff --git a/include/accel/tcg/cpu-ops.h b/include/accel/tcg/cpu-ops.h
index 83b2c2c864..4f3b4fd3bc 100644
--- a/include/accel/tcg/cpu-ops.h
+++ b/include/accel/tcg/cpu-ops.h
@@ -322,6 +322,11 @@ void cpu_check_watchpoint(CPUState *cpu, vaddr addr, vaddr len,
  */
 int cpu_watchpoint_address_matches(CPUState *cpu, vaddr addr, vaddr len);
 
+/*
+ * Common pointer_wrap implementations.
+ */
+vaddr cpu_pointer_wrap_notreached(CPUState *, int, vaddr, vaddr);
+
 #endif
 
 #endif /* TCG_CPU_OPS_H */
diff --git a/target/alpha/cpu.c b/target/alpha/cpu.c
index 890b84c032..2082db45ea 100644
--- a/target/alpha/cpu.c
+++ b/target/alpha/cpu.c
@@ -261,6 +261,7 @@ static const TCGCPUOps alpha_tcg_ops = {
     .record_sigbus = alpha_cpu_record_sigbus,
 #else
     .tlb_fill = alpha_cpu_tlb_fill,
+    .pointer_wrap = cpu_pointer_wrap_notreached,
     .cpu_exec_interrupt = alpha_cpu_exec_interrupt,
     .cpu_exec_halt = alpha_cpu_has_work,
     .cpu_exec_reset = cpu_reset,
diff --git a/target/hppa/cpu.c b/target/hppa/cpu.c
index 6465181543..24777727e6 100644
--- a/target/hppa/cpu.c
+++ b/target/hppa/cpu.c
@@ -269,6 +269,7 @@ static const TCGCPUOps hppa_tcg_ops = {
 
 #ifndef CONFIG_USER_ONLY
     .tlb_fill_align = hppa_cpu_tlb_fill_align,
+    .pointer_wrap = cpu_pointer_wrap_notreached,
     .cpu_exec_interrupt = hppa_cpu_exec_interrupt,
     .cpu_exec_halt = hppa_cpu_has_work,
     .cpu_exec_reset = cpu_reset,
diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
index b35f18e250..4f561e8c91 100644
--- a/target/sh4/cpu.c
+++ b/target/sh4/cpu.c
@@ -296,6 +296,7 @@ static const TCGCPUOps superh_tcg_ops = {
 
 #ifndef CONFIG_USER_ONLY
     .tlb_fill = superh_cpu_tlb_fill,
+    .pointer_wrap = cpu_pointer_wrap_notreached,
     .cpu_exec_interrupt = superh_cpu_exec_interrupt,
     .cpu_exec_halt = superh_cpu_has_work,
     .cpu_exec_reset = cpu_reset,

From 981f2beb161b9bcaeedc1f91ad22bff255856cb2 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 3 May 2025 14:23:41 -0700
Subject: [PATCH 1195/2760] target: Use cpu_pointer_wrap_uint32 for 32-bit
 targets
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

M68K, MicroBlaze, OpenRISC, RX, TriCore and Xtensa are
all 32-bit targets.  AVR is more complicated, but using
a 32-bit wrap preserves current behaviour.

Cc: Michael Rolnik <mrolnik@gmail.com>
Cc: Laurent Vivier <laurent@vivier.eu>
Cc: Stafford Horne <shorne@gmail.com>
Cc: Yoshinori Sato <ysato@users.sourceforge.jp>
Cc: Max Filippov <jcmvbkbc@gmail.com>
Tested-by Bastian Koppelmann <kbastian@mail.uni-paderborn.de> (tricore)
Reviewed-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c          | 6 ++++++
 include/accel/tcg/cpu-ops.h | 1 +
 target/avr/cpu.c            | 6 ++++++
 target/m68k/cpu.c           | 1 +
 target/microblaze/cpu.c     | 1 +
 target/openrisc/cpu.c       | 1 +
 target/rx/cpu.c             | 1 +
 target/tricore/cpu.c        | 1 +
 target/xtensa/cpu.c         | 1 +
 9 files changed, 19 insertions(+)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index 49ec3ee5dc..a734859396 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -2946,3 +2946,9 @@ vaddr cpu_pointer_wrap_notreached(CPUState *cs, int idx, vaddr res, vaddr base)
 {
     g_assert_not_reached();
 }
+
+/* To be used for strict 32-bit targets. */
+vaddr cpu_pointer_wrap_uint32(CPUState *cs, int idx, vaddr res, vaddr base)
+{
+    return (uint32_t)res;
+}
diff --git a/include/accel/tcg/cpu-ops.h b/include/accel/tcg/cpu-ops.h
index 4f3b4fd3bc..dd8ea30016 100644
--- a/include/accel/tcg/cpu-ops.h
+++ b/include/accel/tcg/cpu-ops.h
@@ -326,6 +326,7 @@ int cpu_watchpoint_address_matches(CPUState *cpu, vaddr addr, vaddr len);
  * Common pointer_wrap implementations.
  */
 vaddr cpu_pointer_wrap_notreached(CPUState *, int, vaddr, vaddr);
+vaddr cpu_pointer_wrap_uint32(CPUState *, int, vaddr, vaddr);
 
 #endif
 
diff --git a/target/avr/cpu.c b/target/avr/cpu.c
index 250241541b..6995de6a12 100644
--- a/target/avr/cpu.c
+++ b/target/avr/cpu.c
@@ -250,6 +250,12 @@ static const TCGCPUOps avr_tcg_ops = {
     .cpu_exec_reset = cpu_reset,
     .tlb_fill = avr_cpu_tlb_fill,
     .do_interrupt = avr_cpu_do_interrupt,
+    /*
+     * TODO: code and data wrapping are different, but for the most part
+     * AVR only references bytes or aligned code fetches.  But we use
+     * non-aligned MO_16 accesses for stack push/pop.
+     */
+    .pointer_wrap = cpu_pointer_wrap_uint32,
 };
 
 static void avr_cpu_class_init(ObjectClass *oc, const void *data)
diff --git a/target/m68k/cpu.c b/target/m68k/cpu.c
index c5196a612e..6a09db3a6f 100644
--- a/target/m68k/cpu.c
+++ b/target/m68k/cpu.c
@@ -619,6 +619,7 @@ static const TCGCPUOps m68k_tcg_ops = {
 
 #ifndef CONFIG_USER_ONLY
     .tlb_fill = m68k_cpu_tlb_fill,
+    .pointer_wrap = cpu_pointer_wrap_uint32,
     .cpu_exec_interrupt = m68k_cpu_exec_interrupt,
     .cpu_exec_halt = m68k_cpu_has_work,
     .cpu_exec_reset = cpu_reset,
diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
index 615a959200..ee0a869a94 100644
--- a/target/microblaze/cpu.c
+++ b/target/microblaze/cpu.c
@@ -447,6 +447,7 @@ static const TCGCPUOps mb_tcg_ops = {
 
 #ifndef CONFIG_USER_ONLY
     .tlb_fill = mb_cpu_tlb_fill,
+    .pointer_wrap = cpu_pointer_wrap_uint32,
     .cpu_exec_interrupt = mb_cpu_exec_interrupt,
     .cpu_exec_halt = mb_cpu_has_work,
     .cpu_exec_reset = cpu_reset,
diff --git a/target/openrisc/cpu.c b/target/openrisc/cpu.c
index 054ad33360..dfbb2df643 100644
--- a/target/openrisc/cpu.c
+++ b/target/openrisc/cpu.c
@@ -265,6 +265,7 @@ static const TCGCPUOps openrisc_tcg_ops = {
 
 #ifndef CONFIG_USER_ONLY
     .tlb_fill = openrisc_cpu_tlb_fill,
+    .pointer_wrap = cpu_pointer_wrap_uint32,
     .cpu_exec_interrupt = openrisc_cpu_exec_interrupt,
     .cpu_exec_halt = openrisc_cpu_has_work,
     .cpu_exec_reset = cpu_reset,
diff --git a/target/rx/cpu.c b/target/rx/cpu.c
index 36eba75545..c6dd5d6f83 100644
--- a/target/rx/cpu.c
+++ b/target/rx/cpu.c
@@ -225,6 +225,7 @@ static const TCGCPUOps rx_tcg_ops = {
     .restore_state_to_opc = rx_restore_state_to_opc,
     .mmu_index = rx_cpu_mmu_index,
     .tlb_fill = rx_cpu_tlb_fill,
+    .pointer_wrap = cpu_pointer_wrap_uint32,
 
     .cpu_exec_interrupt = rx_cpu_exec_interrupt,
     .cpu_exec_halt = rx_cpu_has_work,
diff --git a/target/tricore/cpu.c b/target/tricore/cpu.c
index e56f90fde9..4f035b6f76 100644
--- a/target/tricore/cpu.c
+++ b/target/tricore/cpu.c
@@ -190,6 +190,7 @@ static const TCGCPUOps tricore_tcg_ops = {
     .restore_state_to_opc = tricore_restore_state_to_opc,
     .mmu_index = tricore_cpu_mmu_index,
     .tlb_fill = tricore_cpu_tlb_fill,
+    .pointer_wrap = cpu_pointer_wrap_uint32,
     .cpu_exec_interrupt = tricore_cpu_exec_interrupt,
     .cpu_exec_halt = tricore_cpu_has_work,
     .cpu_exec_reset = cpu_reset,
diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
index 91b71b6caa..ea9b6df3aa 100644
--- a/target/xtensa/cpu.c
+++ b/target/xtensa/cpu.c
@@ -318,6 +318,7 @@ static const TCGCPUOps xtensa_tcg_ops = {
 
 #ifndef CONFIG_USER_ONLY
     .tlb_fill = xtensa_cpu_tlb_fill,
+    .pointer_wrap = cpu_pointer_wrap_uint32,
     .cpu_exec_interrupt = xtensa_cpu_exec_interrupt,
     .cpu_exec_halt = xtensa_cpu_has_work,
     .cpu_exec_reset = cpu_reset,

From d21144a48c1a9d1998c594d976d5e906276eca4c Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sun, 4 May 2025 09:27:42 -0700
Subject: [PATCH 1196/2760] target/arm: Fill in TCGCPUOps.pointer_wrap

For a-profile, check A32 vs A64 state.
For m-profile, use cpu_pointer_wrap_uint32.

Cc: qemu-arm@nongnu.org
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/cpu.c         | 24 ++++++++++++++++++++++++
 target/arm/tcg/cpu-v7m.c |  1 +
 2 files changed, 25 insertions(+)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index ca5ed7892e..e025e241ed 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -2703,6 +2703,29 @@ static const struct SysemuCPUOps arm_sysemu_ops = {
 #endif
 
 #ifdef CONFIG_TCG
+#ifndef CONFIG_USER_ONLY
+static vaddr aprofile_pointer_wrap(CPUState *cs, int mmu_idx,
+                                   vaddr result, vaddr base)
+{
+    /*
+     * The Stage2 and Phys indexes are only used for ptw on arm32,
+     * and all pte's are aligned, so we never produce a wrap for these.
+     * Double check that we're not truncating a 40-bit physical address.
+     */
+    assert((unsigned)mmu_idx < (ARMMMUIdx_Stage2_S & ARM_MMU_IDX_COREIDX_MASK));
+
+    if (!is_a64(cpu_env(cs))) {
+        return (uint32_t)result;
+    }
+
+    /*
+     * TODO: For FEAT_CPA2, decide how to we want to resolve
+     * Unpredictable_CPACHECK in AddressIncrement.
+     */
+    return result;
+}
+#endif /* !CONFIG_USER_ONLY */
+
 static const TCGCPUOps arm_tcg_ops = {
     .mttcg_supported = true,
     /* ARM processors have a weak memory model */
@@ -2722,6 +2745,7 @@ static const TCGCPUOps arm_tcg_ops = {
     .untagged_addr = aarch64_untagged_addr,
 #else
     .tlb_fill_align = arm_cpu_tlb_fill_align,
+    .pointer_wrap = aprofile_pointer_wrap,
     .cpu_exec_interrupt = arm_cpu_exec_interrupt,
     .cpu_exec_halt = arm_cpu_exec_halt,
     .cpu_exec_reset = cpu_reset,
diff --git a/target/arm/tcg/cpu-v7m.c b/target/arm/tcg/cpu-v7m.c
index 95b23d9b55..8e1a083b91 100644
--- a/target/arm/tcg/cpu-v7m.c
+++ b/target/arm/tcg/cpu-v7m.c
@@ -249,6 +249,7 @@ static const TCGCPUOps arm_v7m_tcg_ops = {
     .record_sigbus = arm_cpu_record_sigbus,
 #else
     .tlb_fill_align = arm_cpu_tlb_fill_align,
+    .pointer_wrap = cpu_pointer_wrap_uint32,
     .cpu_exec_interrupt = arm_v7m_cpu_exec_interrupt,
     .cpu_exec_halt = arm_cpu_exec_halt,
     .cpu_exec_reset = cpu_reset,

From 7174cd2eec67d9b7bf969cdc87e656b4c4c93465 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sun, 4 May 2025 09:46:28 -0700
Subject: [PATCH 1197/2760] target/i386: Fill in TCGCPUOps.pointer_wrap
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Check 32 vs 64-bit state.

Cc: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/i386/tcg/tcg-cpu.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/target/i386/tcg/tcg-cpu.c b/target/i386/tcg/tcg-cpu.c
index 179dfdf064..6f5dc06b3b 100644
--- a/target/i386/tcg/tcg-cpu.c
+++ b/target/i386/tcg/tcg-cpu.c
@@ -149,6 +149,12 @@ static void x86_cpu_exec_reset(CPUState *cs)
     do_cpu_init(env_archcpu(env));
     cs->exception_index = EXCP_HALTED;
 }
+
+static vaddr x86_pointer_wrap(CPUState *cs, int mmu_idx,
+                              vaddr result, vaddr base)
+{
+    return cpu_env(cs)->hflags & HF_CS64_MASK ? result : (uint32_t)result;
+}
 #endif
 
 const TCGCPUOps x86_tcg_ops = {
@@ -172,6 +178,7 @@ const TCGCPUOps x86_tcg_ops = {
     .record_sigbus = x86_cpu_record_sigbus,
 #else
     .tlb_fill = x86_cpu_tlb_fill,
+    .pointer_wrap = x86_pointer_wrap,
     .do_interrupt = x86_cpu_do_interrupt,
     .cpu_exec_halt = x86_cpu_exec_halt,
     .cpu_exec_interrupt = x86_cpu_exec_interrupt,

From 353f703cf1959228affc23b5bba8a18738736cf4 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sun, 4 May 2025 09:50:08 -0700
Subject: [PATCH 1198/2760] target/loongarch: Fill in TCGCPUOps.pointer_wrap
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Check va32 state.

Reviewed-by: Song Gao <gaosong@loongson.cn>
Reviewed-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/loongarch/cpu.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/target/loongarch/cpu.c b/target/loongarch/cpu.c
index f7535d1be7..abad84c054 100644
--- a/target/loongarch/cpu.c
+++ b/target/loongarch/cpu.c
@@ -334,6 +334,12 @@ static bool loongarch_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
     }
     return false;
 }
+
+static vaddr loongarch_pointer_wrap(CPUState *cs, int mmu_idx,
+                                    vaddr result, vaddr base)
+{
+    return is_va32(cpu_env(cs)) ? (uint32_t)result : result;
+}
 #endif
 
 static TCGTBCPUState loongarch_get_tb_cpu_state(CPUState *cs)
@@ -889,6 +895,7 @@ static const TCGCPUOps loongarch_tcg_ops = {
 
 #ifndef CONFIG_USER_ONLY
     .tlb_fill = loongarch_cpu_tlb_fill,
+    .pointer_wrap = loongarch_pointer_wrap,
     .cpu_exec_interrupt = loongarch_cpu_exec_interrupt,
     .cpu_exec_halt = loongarch_cpu_has_work,
     .cpu_exec_reset = cpu_reset,

From 396c12d00e3944e79159c9f3cb934f26f32ef861 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sun, 4 May 2025 09:59:29 -0700
Subject: [PATCH 1199/2760] target/mips: Fill in TCGCPUOps.pointer_wrap
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Check 32 vs 64-bit addressing state.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/mips/cpu.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/target/mips/cpu.c b/target/mips/cpu.c
index 4cbfb9435a..1f6c41fd34 100644
--- a/target/mips/cpu.c
+++ b/target/mips/cpu.c
@@ -560,6 +560,14 @@ static TCGTBCPUState mips_get_tb_cpu_state(CPUState *cs)
     };
 }
 
+#ifndef CONFIG_USER_ONLY
+static vaddr mips_pointer_wrap(CPUState *cs, int mmu_idx,
+                               vaddr result, vaddr base)
+{
+    return cpu_env(cs)->hflags & MIPS_HFLAG_AWRAP ? (int32_t)result : result;
+}
+#endif
+
 static const TCGCPUOps mips_tcg_ops = {
     .mttcg_supported = TARGET_LONG_BITS == 32,
     .guest_default_memory_order = 0,
@@ -573,6 +581,7 @@ static const TCGCPUOps mips_tcg_ops = {
 
 #if !defined(CONFIG_USER_ONLY)
     .tlb_fill = mips_cpu_tlb_fill,
+    .pointer_wrap = mips_pointer_wrap,
     .cpu_exec_interrupt = mips_cpu_exec_interrupt,
     .cpu_exec_halt = mips_cpu_has_work,
     .cpu_exec_reset = cpu_reset,

From 4031eb4facfd8793defeb83c05712643c161e32e Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sun, 4 May 2025 10:20:02 -0700
Subject: [PATCH 1200/2760] target/ppc: Fill in TCGCPUOps.pointer_wrap
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Check 32 vs 64-bit state.

Cc: qemu-ppc@nongnu.org
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/ppc/cpu_init.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
index 9642812a71..a0e77f2673 100644
--- a/target/ppc/cpu_init.c
+++ b/target/ppc/cpu_init.c
@@ -7386,6 +7386,12 @@ static void ppc_cpu_exec_exit(CPUState *cs)
         cpu->vhyp_class->cpu_exec_exit(cpu->vhyp, cpu);
     }
 }
+
+static vaddr ppc_pointer_wrap(CPUState *cs, int mmu_idx,
+                              vaddr result, vaddr base)
+{
+    return (cpu_env(cs)->hflags >> HFLAGS_64) & 1 ? result : (uint32_t)result;
+}
 #endif /* CONFIG_TCG */
 
 #endif /* !CONFIG_USER_ONLY */
@@ -7490,6 +7496,7 @@ static const TCGCPUOps ppc_tcg_ops = {
   .record_sigsegv = ppc_cpu_record_sigsegv,
 #else
   .tlb_fill = ppc_cpu_tlb_fill,
+  .pointer_wrap = ppc_pointer_wrap,
   .cpu_exec_interrupt = ppc_cpu_exec_interrupt,
   .cpu_exec_halt = ppc_cpu_has_work,
   .cpu_exec_reset = cpu_reset,

From 8024f004155ea5a3f492c35a792ea7863176e1a9 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sun, 4 May 2025 10:59:39 -0700
Subject: [PATCH 1201/2760] target/riscv: Fill in TCGCPUOps.pointer_wrap
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Check 32 vs 64-bit and pointer masking state.

Cc: qemu-riscv@nongnu.org
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/riscv/tcg/tcg-cpu.c | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index 305912b8dd..55fd9e5584 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -237,6 +237,31 @@ static void riscv_restore_state_to_opc(CPUState *cs,
     env->excp_uw2 = data[2];
 }
 
+#ifndef CONFIG_USER_ONLY
+static vaddr riscv_pointer_wrap(CPUState *cs, int mmu_idx,
+                                vaddr result, vaddr base)
+{
+    CPURISCVState *env = cpu_env(cs);
+    uint32_t pm_len;
+    bool pm_signext;
+
+    if (cpu_address_xl(env) == MXL_RV32) {
+        return (uint32_t)result;
+    }
+
+    pm_len = riscv_pm_get_pmlen(riscv_pm_get_pmm(env));
+    if (pm_len == 0) {
+        return result;
+    }
+
+    pm_signext = riscv_cpu_virt_mem_enabled(env);
+    if (pm_signext) {
+        return sextract64(result, 0, 64 - pm_len);
+    }
+    return extract64(result, 0, 64 - pm_len);
+}
+#endif
+
 const TCGCPUOps riscv_tcg_ops = {
     .mttcg_supported = true,
     .guest_default_memory_order = 0,
@@ -250,6 +275,7 @@ const TCGCPUOps riscv_tcg_ops = {
 
 #ifndef CONFIG_USER_ONLY
     .tlb_fill = riscv_cpu_tlb_fill,
+    .pointer_wrap = riscv_pointer_wrap,
     .cpu_exec_interrupt = riscv_cpu_exec_interrupt,
     .cpu_exec_halt = riscv_cpu_has_work,
     .cpu_exec_reset = cpu_reset,

From c2a0439f1ee99cb29883311f75ba08d9cca759c9 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sun, 4 May 2025 11:04:55 -0700
Subject: [PATCH 1202/2760] target/s390x: Fill in TCGCPUOps.pointer_wrap
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Use the existing wrap_address function.

Cc: qemu-s390x@nongnu.org
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/s390x/cpu.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
index 9c1158ebcc..f05ce317da 100644
--- a/target/s390x/cpu.c
+++ b/target/s390x/cpu.c
@@ -347,6 +347,14 @@ static TCGTBCPUState s390x_get_tb_cpu_state(CPUState *cs)
     };
 }
 
+#ifndef CONFIG_USER_ONLY
+static vaddr s390_pointer_wrap(CPUState *cs, int mmu_idx,
+                               vaddr result, vaddr base)
+{
+    return wrap_address(cpu_env(cs), result);
+}
+#endif
+
 static const TCGCPUOps s390_tcg_ops = {
     .mttcg_supported = true,
     .precise_smc = true,
@@ -367,6 +375,7 @@ static const TCGCPUOps s390_tcg_ops = {
     .record_sigbus = s390_cpu_record_sigbus,
 #else
     .tlb_fill = s390_cpu_tlb_fill,
+    .pointer_wrap = s390_pointer_wrap,
     .cpu_exec_interrupt = s390_cpu_exec_interrupt,
     .cpu_exec_halt = s390_cpu_has_work,
     .cpu_exec_reset = cpu_reset,

From 90f80e4b0fedfc78163c1c112bb74ccbfcae2365 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sun, 4 May 2025 11:14:01 -0700
Subject: [PATCH 1203/2760] target/sparc: Fill in TCGCPUOps.pointer_wrap
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Check address masking state for sparc64.

Cc: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/sparc/cpu.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
index 2a3e408923..ed7701b02f 100644
--- a/target/sparc/cpu.c
+++ b/target/sparc/cpu.c
@@ -1002,6 +1002,18 @@ static const struct SysemuCPUOps sparc_sysemu_ops = {
 #ifdef CONFIG_TCG
 #include "accel/tcg/cpu-ops.h"
 
+#ifndef CONFIG_USER_ONLY
+static vaddr sparc_pointer_wrap(CPUState *cs, int mmu_idx,
+                                vaddr result, vaddr base)
+{
+#ifdef TARGET_SPARC64
+    return cpu_env(cs)->pstate & PS_AM ? (uint32_t)result : result;
+#else
+    return (uint32_t)result;
+#endif
+}
+#endif
+
 static const TCGCPUOps sparc_tcg_ops = {
     /*
      * From Oracle SPARC Architecture 2015:
@@ -1036,6 +1048,7 @@ static const TCGCPUOps sparc_tcg_ops = {
 
 #ifndef CONFIG_USER_ONLY
     .tlb_fill = sparc_cpu_tlb_fill,
+    .pointer_wrap = sparc_pointer_wrap,
     .cpu_exec_interrupt = sparc_cpu_exec_interrupt,
     .cpu_exec_halt = sparc_cpu_has_work,
     .cpu_exec_reset = cpu_reset,

From 5c2891601ccdaa41427187ef95bc25c828b355e4 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sun, 4 May 2025 11:19:17 -0700
Subject: [PATCH 1204/2760] accel/tcg: Assert TCGCPUOps.pointer_wrap is set
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

All targets now provide the function, so we can
make the call unconditional.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cpu-exec.c | 1 +
 accel/tcg/cputlb.c   | 7 ++-----
 2 files changed, 3 insertions(+), 5 deletions(-)

diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index cc5f362305..713bdb2056 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -1039,6 +1039,7 @@ bool tcg_exec_realizefn(CPUState *cpu, Error **errp)
         assert(tcg_ops->cpu_exec_halt);
         assert(tcg_ops->cpu_exec_interrupt);
         assert(tcg_ops->cpu_exec_reset);
+        assert(tcg_ops->pointer_wrap);
 #endif /* !CONFIG_USER_ONLY */
         assert(tcg_ops->translate_code);
         assert(tcg_ops->get_tb_cpu_state);
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index a734859396..87e14bde4f 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -1773,11 +1773,8 @@ static bool mmu_lookup(CPUState *cpu, vaddr addr, MemOpIdx oi,
         l->page[1].size = l->page[0].size - size0;
         l->page[0].size = size0;
 
-        if (cpu->cc->tcg_ops->pointer_wrap) {
-            l->page[1].addr = cpu->cc->tcg_ops->pointer_wrap(cpu, l->mmu_idx,
-                                                             l->page[1].addr,
-                                                             addr);
-        }
+        l->page[1].addr = cpu->cc->tcg_ops->pointer_wrap(cpu, l->mmu_idx,
+                                                         l->page[1].addr, addr);
 
         /*
          * Lookup both pages, recognizing exceptions from either.  If the

From a78a91feeea66270badd87c65a7236e90baa5984 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Thu, 22 May 2025 12:05:28 -0700
Subject: [PATCH 1205/2760] qapi: expose rtc-reset-reinjection command
 unconditionally
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This removes the TARGET_I386 condition from the rtc-reset-reinjection
command. This requires providing a QMP command stub for non-i386 target.
This in turn requires moving the command out of misc-target.json, since
that will trigger symbol poisoning errors when built from target
independent code.

Rather than putting the command into misc.json, it is proposed to create
misc-$TARGET.json files to hold commands whose impl is conceptually
only applicable to a single target. This gives an obvious docs hint to
consumers that the command is only useful in relation a specific target,
while misc.json is for commands applicable to 2 or more targets.

The current impl of qmp_rtc_reset_reinject() is a no-op if the i386
RTC is disabled in Kconfig, or if the running machine type lack any
RTC device.

The stub impl for non-i386 targets retains this no-op behaviour.
However, it is now reporting an Error mentioning this command is not
available for current target.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20250522190542.588267-2-pierrick.bouvier@linaro.org>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
---
 hw/i386/monitor.c        |  2 +-
 qapi/meson.build         |  1 +
 qapi/misc-i386.json      | 24 ++++++++++++++++++++++++
 qapi/misc-target.json    | 17 -----------------
 qapi/qapi-schema.json    |  1 +
 stubs/meson.build        |  1 +
 stubs/monitor-i386-rtc.c | 12 ++++++++++++
 7 files changed, 40 insertions(+), 18 deletions(-)
 create mode 100644 qapi/misc-i386.json
 create mode 100644 stubs/monitor-i386-rtc.c

diff --git a/hw/i386/monitor.c b/hw/i386/monitor.c
index 1921e4d52e..79df96562f 100644
--- a/hw/i386/monitor.c
+++ b/hw/i386/monitor.c
@@ -26,7 +26,7 @@
 #include "monitor/monitor.h"
 #include "qobject/qdict.h"
 #include "qapi/error.h"
-#include "qapi/qapi-commands-misc-target.h"
+#include "qapi/qapi-commands-misc-i386.h"
 #include "hw/i386/x86.h"
 #include "hw/rtc/mc146818rtc.h"
 
diff --git a/qapi/meson.build b/qapi/meson.build
index eadde4db30..3a9bd06104 100644
--- a/qapi/meson.build
+++ b/qapi/meson.build
@@ -64,6 +64,7 @@ if have_system
     'qdev',
     'pci',
     'rocker',
+    'misc-i386',
     'tpm',
     'uefi',
   ]
diff --git a/qapi/misc-i386.json b/qapi/misc-i386.json
new file mode 100644
index 0000000000..d5bfd91405
--- /dev/null
+++ b/qapi/misc-i386.json
@@ -0,0 +1,24 @@
+# -*- Mode: Python -*-
+# vim: filetype=python
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+##
+# @rtc-reset-reinjection:
+#
+# This command will reset the RTC interrupt reinjection backlog.  Can
+# be used if another mechanism to synchronize guest time is in effect,
+# for example QEMU guest agent's guest-set-time command.
+#
+# Use of this command is only applicable for x86 machines with an RTC,
+# and on other machines will silently return without performing any
+# action.
+#
+# Since: 2.1
+#
+# .. qmp-example::
+#
+#     -> { "execute": "rtc-reset-reinjection" }
+#     <- { "return": {} }
+##
+{ 'command': 'rtc-reset-reinjection' }
diff --git a/qapi/misc-target.json b/qapi/misc-target.json
index f7ec695caa..c5f9f6be7e 100644
--- a/qapi/misc-target.json
+++ b/qapi/misc-target.json
@@ -2,23 +2,6 @@
 # vim: filetype=python
 #
 
-##
-# @rtc-reset-reinjection:
-#
-# This command will reset the RTC interrupt reinjection backlog.  Can
-# be used if another mechanism to synchronize guest time is in effect,
-# for example QEMU guest agent's guest-set-time command.
-#
-# Since: 2.1
-#
-# .. qmp-example::
-#
-#     -> { "execute": "rtc-reset-reinjection" }
-#     <- { "return": {} }
-##
-{ 'command': 'rtc-reset-reinjection',
-  'if': 'TARGET_I386' }
-
 ##
 # @SevState:
 #
diff --git a/qapi/qapi-schema.json b/qapi/qapi-schema.json
index 7bc600bb76..96f6aa4413 100644
--- a/qapi/qapi-schema.json
+++ b/qapi/qapi-schema.json
@@ -61,6 +61,7 @@
 { 'include': 'replay.json' }
 { 'include': 'yank.json' }
 { 'include': 'misc.json' }
+{ 'include': 'misc-i386.json' }
 { 'include': 'misc-target.json' }
 { 'include': 'audio.json' }
 { 'include': 'acpi.json' }
diff --git a/stubs/meson.build b/stubs/meson.build
index 63392f5e78..9907b54c1e 100644
--- a/stubs/meson.build
+++ b/stubs/meson.build
@@ -77,6 +77,7 @@ if have_system
   stub_ss.add(files('target-monitor-defs.c'))
   stub_ss.add(files('win32-kbd-hook.c'))
   stub_ss.add(files('xen-hw-stub.c'))
+  stub_ss.add(files('monitor-i386-rtc.c'))
 endif
 
 if have_system or have_user
diff --git a/stubs/monitor-i386-rtc.c b/stubs/monitor-i386-rtc.c
new file mode 100644
index 0000000000..8420d7c93c
--- /dev/null
+++ b/stubs/monitor-i386-rtc.c
@@ -0,0 +1,12 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "qapi/qapi-commands-misc-i386.h"
+
+void qmp_rtc_reset_reinjection(Error **errp)
+{
+    error_setg(errp,
+               "RTC interrupt reinjection backlog reset is not available for"
+               "this machine");
+}

From 9215d072d2da3054b74080227a6a3e0a2daf44d2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Thu, 22 May 2025 12:05:29 -0700
Subject: [PATCH 1206/2760] qapi: expand docs for SEV commands
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This gives some more context about the behaviour of the commands in
unsupported guest configuration or platform scenarios.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20250522190542.588267-3-pierrick.bouvier@linaro.org>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
[Tweak query-sev doc, turn error descriptions into Errors sections,
delate a stray #, normalize whitespace, wrap lines]
---
 qapi/misc-target.json | 50 +++++++++++++++++++++++++++++++++++++------
 1 file changed, 43 insertions(+), 7 deletions(-)

diff --git a/qapi/misc-target.json b/qapi/misc-target.json
index c5f9f6be7e..e19a12e88a 100644
--- a/qapi/misc-target.json
+++ b/qapi/misc-target.json
@@ -110,7 +110,11 @@
 ##
 # @query-sev:
 #
-# Returns information about SEV
+# Returns information about SEV/SEV-ES/SEV-SNP.
+#
+# If unavailable due to an incompatible configuration the returned
+# @enabled field is set to 'false' and the state of all other fields
+# is unspecified.
 #
 # Returns: @SevInfo
 #
@@ -141,10 +145,19 @@
 ##
 # @query-sev-launch-measure:
 #
-# Query the SEV guest launch information.
+# Query the SEV/SEV-ES guest launch information.
+#
+# This is only valid on x86 machines configured with KVM and the
+# 'sev-guest' confidential virtualization object.  The launch
+# measurement for SEV-SNP guests is only available within the guest.
 #
 # Returns: The @SevLaunchMeasureInfo for the guest
 #
+# Errors:
+#     - If the launch measurement is unavailable, either due to an
+#       invalid guest configuration or if the guest has not reached
+#       the required SEV state, GenericError
+#
 # Since: 2.12
 #
 # .. qmp-example::
@@ -185,11 +198,15 @@
 ##
 # @query-sev-capabilities:
 #
-# This command is used to get the SEV capabilities, and is supported
-# on AMD X86 platforms only.
+# Get SEV capabilities.
+#
+# This is only supported on AMD X86 platforms with KVM enabled.
 #
 # Returns: SevCapability objects.
 #
+# Errors:
+#     - If SEV is not available on the platform, GenericError
+#
 # Since: 2.12
 #
 # .. qmp-example::
@@ -205,7 +222,12 @@
 ##
 # @sev-inject-launch-secret:
 #
-# This command injects a secret blob into memory of SEV guest.
+# This command injects a secret blob into memory of a SEV/SEV-ES
+# guest.
+#
+# This is only valid on x86 machines configured with KVM and the
+# 'sev-guest' confidential virtualization object.  SEV-SNP guests do
+# not support launch secret injection.
 #
 # @packet-header: the launch secret packet header encoded in base64
 #
@@ -213,6 +235,11 @@
 #
 # @gpa: the guest physical address where secret will be injected.
 #
+# Errors:
+#     - If launch secret injection is not possible, either due to
+#       an invalid guest configuration, or if the guest has not
+#       reached the required SEV state, GenericError
+#
 # Since: 6.0
 ##
 { 'command': 'sev-inject-launch-secret',
@@ -236,14 +263,23 @@
 ##
 # @query-sev-attestation-report:
 #
-# This command is used to get the SEV attestation report, and is
-# supported on AMD X86 platforms only.
+# This command is used to get the SEV attestation report.
+#
+# This is only valid on x86 machines configured with KVM and the
+# 'sev-guest' confidential virtualization object.  The attestation
+# report for SEV-SNP guests is only available within the guest.
 #
 # @mnonce: a random 16 bytes value encoded in base64 (it will be
 #     included in report)
 #
 # Returns: SevAttestationReport objects.
 #
+# Errors:
+#     - This will return an error if the attestation report is
+#       unavailable, either due to an invalid guest configuration
+#       or if the guest has not reached the required SEV state,
+#       GenericError
+#
 # Since: 6.1
 #
 # .. qmp-example::

From 7373759583650fff6f724c6c21d4234bf31b2af0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Thu, 22 May 2025 12:05:30 -0700
Subject: [PATCH 1207/2760] qapi: make SEV commands unconditionally available
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This removes the TARGET_I386 condition from the SEV confidential
virtualization commands, moving them to the recently introduced
misc-i386.json QAPI file, given they are inherantly i386 specific
commands.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20250522190542.588267-4-pierrick.bouvier@linaro.org>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
---
 qapi/misc-i386.json           | 278 ++++++++++++++++++++++++++++++++
 qapi/misc-target.json         | 291 ----------------------------------
 stubs/meson.build             |   1 +
 stubs/monitor-i386-sev.c      |  36 +++++
 target/i386/sev-system-stub.c |  32 ----
 target/i386/sev.c             |   2 +-
 6 files changed, 316 insertions(+), 324 deletions(-)
 create mode 100644 stubs/monitor-i386-sev.c

diff --git a/qapi/misc-i386.json b/qapi/misc-i386.json
index d5bfd91405..360adadfe0 100644
--- a/qapi/misc-i386.json
+++ b/qapi/misc-i386.json
@@ -22,3 +22,281 @@
 #     <- { "return": {} }
 ##
 { 'command': 'rtc-reset-reinjection' }
+
+##
+# @SevState:
+#
+# An enumeration of SEV state information used during @query-sev.
+#
+# @uninit: The guest is uninitialized.
+#
+# @launch-update: The guest is currently being launched; plaintext
+#     data and register state is being imported.
+#
+# @launch-secret: The guest is currently being launched; ciphertext
+#     data is being imported.
+#
+# @running: The guest is fully launched or migrated in.
+#
+# @send-update: The guest is currently being migrated out to another
+#     machine.
+#
+# @receive-update: The guest is currently being migrated from another
+#     machine.
+#
+# Since: 2.12
+##
+{ 'enum': 'SevState',
+  'data': ['uninit', 'launch-update', 'launch-secret', 'running',
+           'send-update', 'receive-update' ] }
+
+##
+# @SevGuestType:
+#
+# An enumeration indicating the type of SEV guest being run.
+#
+# @sev: The guest is a legacy SEV or SEV-ES guest.
+#
+# @sev-snp: The guest is an SEV-SNP guest.
+#
+# Since: 6.2
+##
+{ 'enum': 'SevGuestType',
+  'data': [ 'sev', 'sev-snp' ] }
+
+##
+# @SevGuestInfo:
+#
+# Information specific to legacy SEV/SEV-ES guests.
+#
+# @policy: SEV policy value
+#
+# @handle: SEV firmware handle
+#
+# Since: 2.12
+##
+{ 'struct': 'SevGuestInfo',
+  'data': { 'policy': 'uint32',
+            'handle': 'uint32' } }
+
+##
+# @SevSnpGuestInfo:
+#
+# Information specific to SEV-SNP guests.
+#
+# @snp-policy: SEV-SNP policy value
+#
+# Since: 9.1
+##
+{ 'struct': 'SevSnpGuestInfo',
+  'data': { 'snp-policy': 'uint64' } }
+
+##
+# @SevInfo:
+#
+# Information about Secure Encrypted Virtualization (SEV) support
+#
+# @enabled: true if SEV is active
+#
+# @api-major: SEV API major version
+#
+# @api-minor: SEV API minor version
+#
+# @build-id: SEV FW build id
+#
+# @state: SEV guest state
+#
+# @sev-type: Type of SEV guest being run
+#
+# Since: 2.12
+##
+{ 'union': 'SevInfo',
+  'base': { 'enabled': 'bool',
+            'api-major': 'uint8',
+            'api-minor' : 'uint8',
+            'build-id' : 'uint8',
+            'state' : 'SevState',
+            'sev-type' : 'SevGuestType' },
+  'discriminator': 'sev-type',
+  'data': {
+      'sev': 'SevGuestInfo',
+      'sev-snp': 'SevSnpGuestInfo' } }
+
+
+##
+# @query-sev:
+#
+# Returns information about SEV/SEV-ES/SEV-SNP.
+#
+# If unavailable due to an incompatible configuration the returned
+# @enabled field is set to 'false' and the state of all other fields
+# is unspecified.
+#
+# Returns: @SevInfo
+#
+# Since: 2.12
+#
+# .. qmp-example::
+#
+#     -> { "execute": "query-sev" }
+#     <- { "return": { "enabled": true, "api-major" : 0, "api-minor" : 0,
+#                      "build-id" : 0, "policy" : 0, "state" : "running",
+#                      "handle" : 1 } }
+##
+{ 'command': 'query-sev', 'returns': 'SevInfo' }
+
+##
+# @SevLaunchMeasureInfo:
+#
+# SEV Guest Launch measurement information
+#
+# @data: the measurement value encoded in base64
+#
+# Since: 2.12
+##
+{ 'struct': 'SevLaunchMeasureInfo', 'data': {'data': 'str'} }
+
+##
+# @query-sev-launch-measure:
+#
+# Query the SEV/SEV-ES guest launch information.
+#
+# This is only valid on x86 machines configured with KVM and the
+# 'sev-guest' confidential virtualization object.  The launch
+# measurement for SEV-SNP guests is only available within the guest.
+#
+# Returns: The @SevLaunchMeasureInfo for the guest
+#
+# Errors:
+#     - If the launch measurement is unavailable, either due to an
+#       invalid guest configuration or if the guest has not reached
+#       the required SEV state, GenericError
+#
+# Since: 2.12
+#
+# .. qmp-example::
+#
+#     -> { "execute": "query-sev-launch-measure" }
+#     <- { "return": { "data": "4l8LXeNlSPUDlXPJG5966/8%YZ" } }
+##
+{ 'command': 'query-sev-launch-measure', 'returns': 'SevLaunchMeasureInfo' }
+
+##
+# @SevCapability:
+#
+# The struct describes capability for a Secure Encrypted
+# Virtualization feature.
+#
+# @pdh: Platform Diffie-Hellman key (base64 encoded)
+#
+# @cert-chain: PDH certificate chain (base64 encoded)
+#
+# @cpu0-id: Unique ID of CPU0 (base64 encoded) (since 7.1)
+#
+# @cbitpos: C-bit location in page table entry
+#
+# @reduced-phys-bits: Number of physical Address bit reduction when
+#     SEV is enabled
+#
+# Since: 2.12
+##
+{ 'struct': 'SevCapability',
+  'data': { 'pdh': 'str',
+            'cert-chain': 'str',
+            'cpu0-id': 'str',
+            'cbitpos': 'int',
+            'reduced-phys-bits': 'int'} }
+
+##
+# @query-sev-capabilities:
+#
+# Get SEV capabilities.
+#
+# This is only supported on AMD X86 platforms with KVM enabled.
+#
+# Returns: SevCapability objects.
+#
+# Errors:
+#     - If SEV is not available on the platform, GenericError
+#
+# Since: 2.12
+#
+# .. qmp-example::
+#
+#     -> { "execute": "query-sev-capabilities" }
+#     <- { "return": { "pdh": "8CCDD8DDD", "cert-chain": "888CCCDDDEE",
+#                      "cpu0-id": "2lvmGwo+...61iEinw==",
+#                      "cbitpos": 47, "reduced-phys-bits": 1}}
+##
+{ 'command': 'query-sev-capabilities', 'returns': 'SevCapability' }
+
+##
+# @sev-inject-launch-secret:
+#
+# This command injects a secret blob into memory of a SEV/SEV-ES
+# guest.
+#
+# This is only valid on x86 machines configured with KVM and the
+# 'sev-guest' confidential virtualization object.  SEV-SNP guests do
+# not support launch secret injection.
+#
+# @packet-header: the launch secret packet header encoded in base64
+#
+# @secret: the launch secret data to be injected encoded in base64
+#
+# @gpa: the guest physical address where secret will be injected.
+#
+# Errors:
+#     - If launch secret injection is not possible, either due to
+#       an invalid guest configuration, or if the guest has not
+#       reached the required SEV state, GenericError
+#
+# Since: 6.0
+##
+{ 'command': 'sev-inject-launch-secret',
+  'data': { 'packet-header': 'str', 'secret': 'str', '*gpa': 'uint64' } }
+
+##
+# @SevAttestationReport:
+#
+# The struct describes attestation report for a Secure Encrypted
+# Virtualization feature.
+#
+# @data: guest attestation report (base64 encoded)
+#
+# Since: 6.1
+##
+{ 'struct': 'SevAttestationReport',
+  'data': { 'data': 'str'} }
+
+##
+# @query-sev-attestation-report:
+#
+# This command is used to get the SEV attestation report.
+#
+# This is only valid on x86 machines configured with KVM and the
+# 'sev-guest' confidential virtualization object.  The attestation
+# report for SEV-SNP guests is only available within the guest.
+#
+# @mnonce: a random 16 bytes value encoded in base64 (it will be
+#     included in report)
+#
+# Returns: SevAttestationReport objects.
+#
+# Errors:
+#     - This will return an error if the attestation report is
+#       unavailable, either due to an invalid guest configuration
+#       or if the guest has not reached the required SEV state,
+#       GenericError
+#
+# Since: 6.1
+#
+# .. qmp-example::
+#
+#     -> { "execute" : "query-sev-attestation-report",
+#                      "arguments": { "mnonce": "aaaaaaa" } }
+#     <- { "return" : { "data": "aaaaaaaabbbddddd"} }
+##
+{ 'command': 'query-sev-attestation-report',
+  'data': { 'mnonce': 'str' },
+  'returns': 'SevAttestationReport' }
diff --git a/qapi/misc-target.json b/qapi/misc-target.json
index e19a12e88a..c0d7b311f3 100644
--- a/qapi/misc-target.json
+++ b/qapi/misc-target.json
@@ -2,297 +2,6 @@
 # vim: filetype=python
 #
 
-##
-# @SevState:
-#
-# An enumeration of SEV state information used during @query-sev.
-#
-# @uninit: The guest is uninitialized.
-#
-# @launch-update: The guest is currently being launched; plaintext
-#     data and register state is being imported.
-#
-# @launch-secret: The guest is currently being launched; ciphertext
-#     data is being imported.
-#
-# @running: The guest is fully launched or migrated in.
-#
-# @send-update: The guest is currently being migrated out to another
-#     machine.
-#
-# @receive-update: The guest is currently being migrated from another
-#     machine.
-#
-# Since: 2.12
-##
-{ 'enum': 'SevState',
-  'data': ['uninit', 'launch-update', 'launch-secret', 'running',
-           'send-update', 'receive-update' ],
-  'if': 'TARGET_I386' }
-
-##
-# @SevGuestType:
-#
-# An enumeration indicating the type of SEV guest being run.
-#
-# @sev: The guest is a legacy SEV or SEV-ES guest.
-#
-# @sev-snp: The guest is an SEV-SNP guest.
-#
-# Since: 6.2
-##
-{ 'enum': 'SevGuestType',
-  'data': [ 'sev', 'sev-snp' ],
-  'if': 'TARGET_I386' }
-
-##
-# @SevGuestInfo:
-#
-# Information specific to legacy SEV/SEV-ES guests.
-#
-# @policy: SEV policy value
-#
-# @handle: SEV firmware handle
-#
-# Since: 2.12
-##
-{ 'struct': 'SevGuestInfo',
-  'data': { 'policy': 'uint32',
-            'handle': 'uint32' },
-  'if': 'TARGET_I386' }
-
-##
-# @SevSnpGuestInfo:
-#
-# Information specific to SEV-SNP guests.
-#
-# @snp-policy: SEV-SNP policy value
-#
-# Since: 9.1
-##
-{ 'struct': 'SevSnpGuestInfo',
-  'data': { 'snp-policy': 'uint64' },
-  'if': 'TARGET_I386' }
-
-##
-# @SevInfo:
-#
-# Information about Secure Encrypted Virtualization (SEV) support
-#
-# @enabled: true if SEV is active
-#
-# @api-major: SEV API major version
-#
-# @api-minor: SEV API minor version
-#
-# @build-id: SEV FW build id
-#
-# @state: SEV guest state
-#
-# @sev-type: Type of SEV guest being run
-#
-# Since: 2.12
-##
-{ 'union': 'SevInfo',
-  'base': { 'enabled': 'bool',
-            'api-major': 'uint8',
-            'api-minor' : 'uint8',
-            'build-id' : 'uint8',
-            'state' : 'SevState',
-            'sev-type' : 'SevGuestType' },
-  'discriminator': 'sev-type',
-  'data': {
-      'sev': 'SevGuestInfo',
-      'sev-snp': 'SevSnpGuestInfo' },
-  'if': 'TARGET_I386' }
-
-
-##
-# @query-sev:
-#
-# Returns information about SEV/SEV-ES/SEV-SNP.
-#
-# If unavailable due to an incompatible configuration the returned
-# @enabled field is set to 'false' and the state of all other fields
-# is unspecified.
-#
-# Returns: @SevInfo
-#
-# Since: 2.12
-#
-# .. qmp-example::
-#
-#     -> { "execute": "query-sev" }
-#     <- { "return": { "enabled": true, "api-major" : 0, "api-minor" : 0,
-#                      "build-id" : 0, "policy" : 0, "state" : "running",
-#                      "handle" : 1 } }
-##
-{ 'command': 'query-sev', 'returns': 'SevInfo',
-  'if': 'TARGET_I386' }
-
-##
-# @SevLaunchMeasureInfo:
-#
-# SEV Guest Launch measurement information
-#
-# @data: the measurement value encoded in base64
-#
-# Since: 2.12
-##
-{ 'struct': 'SevLaunchMeasureInfo', 'data': {'data': 'str'},
-  'if': 'TARGET_I386' }
-
-##
-# @query-sev-launch-measure:
-#
-# Query the SEV/SEV-ES guest launch information.
-#
-# This is only valid on x86 machines configured with KVM and the
-# 'sev-guest' confidential virtualization object.  The launch
-# measurement for SEV-SNP guests is only available within the guest.
-#
-# Returns: The @SevLaunchMeasureInfo for the guest
-#
-# Errors:
-#     - If the launch measurement is unavailable, either due to an
-#       invalid guest configuration or if the guest has not reached
-#       the required SEV state, GenericError
-#
-# Since: 2.12
-#
-# .. qmp-example::
-#
-#     -> { "execute": "query-sev-launch-measure" }
-#     <- { "return": { "data": "4l8LXeNlSPUDlXPJG5966/8%YZ" } }
-##
-{ 'command': 'query-sev-launch-measure', 'returns': 'SevLaunchMeasureInfo',
-  'if': 'TARGET_I386' }
-
-##
-# @SevCapability:
-#
-# The struct describes capability for a Secure Encrypted
-# Virtualization feature.
-#
-# @pdh: Platform Diffie-Hellman key (base64 encoded)
-#
-# @cert-chain: PDH certificate chain (base64 encoded)
-#
-# @cpu0-id: Unique ID of CPU0 (base64 encoded) (since 7.1)
-#
-# @cbitpos: C-bit location in page table entry
-#
-# @reduced-phys-bits: Number of physical Address bit reduction when
-#     SEV is enabled
-#
-# Since: 2.12
-##
-{ 'struct': 'SevCapability',
-  'data': { 'pdh': 'str',
-            'cert-chain': 'str',
-            'cpu0-id': 'str',
-            'cbitpos': 'int',
-            'reduced-phys-bits': 'int'},
-  'if': 'TARGET_I386' }
-
-##
-# @query-sev-capabilities:
-#
-# Get SEV capabilities.
-#
-# This is only supported on AMD X86 platforms with KVM enabled.
-#
-# Returns: SevCapability objects.
-#
-# Errors:
-#     - If SEV is not available on the platform, GenericError
-#
-# Since: 2.12
-#
-# .. qmp-example::
-#
-#     -> { "execute": "query-sev-capabilities" }
-#     <- { "return": { "pdh": "8CCDD8DDD", "cert-chain": "888CCCDDDEE",
-#                      "cpu0-id": "2lvmGwo+...61iEinw==",
-#                      "cbitpos": 47, "reduced-phys-bits": 1}}
-##
-{ 'command': 'query-sev-capabilities', 'returns': 'SevCapability',
-  'if': 'TARGET_I386' }
-
-##
-# @sev-inject-launch-secret:
-#
-# This command injects a secret blob into memory of a SEV/SEV-ES
-# guest.
-#
-# This is only valid on x86 machines configured with KVM and the
-# 'sev-guest' confidential virtualization object.  SEV-SNP guests do
-# not support launch secret injection.
-#
-# @packet-header: the launch secret packet header encoded in base64
-#
-# @secret: the launch secret data to be injected encoded in base64
-#
-# @gpa: the guest physical address where secret will be injected.
-#
-# Errors:
-#     - If launch secret injection is not possible, either due to
-#       an invalid guest configuration, or if the guest has not
-#       reached the required SEV state, GenericError
-#
-# Since: 6.0
-##
-{ 'command': 'sev-inject-launch-secret',
-  'data': { 'packet-header': 'str', 'secret': 'str', '*gpa': 'uint64' },
-  'if': 'TARGET_I386' }
-
-##
-# @SevAttestationReport:
-#
-# The struct describes attestation report for a Secure Encrypted
-# Virtualization feature.
-#
-# @data: guest attestation report (base64 encoded)
-#
-# Since: 6.1
-##
-{ 'struct': 'SevAttestationReport',
-  'data': { 'data': 'str'},
-  'if': 'TARGET_I386' }
-
-##
-# @query-sev-attestation-report:
-#
-# This command is used to get the SEV attestation report.
-#
-# This is only valid on x86 machines configured with KVM and the
-# 'sev-guest' confidential virtualization object.  The attestation
-# report for SEV-SNP guests is only available within the guest.
-#
-# @mnonce: a random 16 bytes value encoded in base64 (it will be
-#     included in report)
-#
-# Returns: SevAttestationReport objects.
-#
-# Errors:
-#     - This will return an error if the attestation report is
-#       unavailable, either due to an invalid guest configuration
-#       or if the guest has not reached the required SEV state,
-#       GenericError
-#
-# Since: 6.1
-#
-# .. qmp-example::
-#
-#     -> { "execute" : "query-sev-attestation-report",
-#                      "arguments": { "mnonce": "aaaaaaa" } }
-#     <- { "return" : { "data": "aaaaaaaabbbddddd"} }
-##
-{ 'command': 'query-sev-attestation-report',
-  'data': { 'mnonce': 'str' },
-  'returns': 'SevAttestationReport',
-  'if': 'TARGET_I386' }
-
 ##
 # @GICCapability:
 #
diff --git a/stubs/meson.build b/stubs/meson.build
index 9907b54c1e..9922ec7b88 100644
--- a/stubs/meson.build
+++ b/stubs/meson.build
@@ -78,6 +78,7 @@ if have_system
   stub_ss.add(files('win32-kbd-hook.c'))
   stub_ss.add(files('xen-hw-stub.c'))
   stub_ss.add(files('monitor-i386-rtc.c'))
+  stub_ss.add(files('monitor-i386-sev.c'))
 endif
 
 if have_system or have_user
diff --git a/stubs/monitor-i386-sev.c b/stubs/monitor-i386-sev.c
new file mode 100644
index 0000000000..d4f024128c
--- /dev/null
+++ b/stubs/monitor-i386-sev.c
@@ -0,0 +1,36 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "qapi/qapi-commands-misc-i386.h"
+
+SevInfo *qmp_query_sev(Error **errp)
+{
+    error_setg(errp, "SEV is not available in this QEMU");
+    return NULL;
+}
+
+SevLaunchMeasureInfo *qmp_query_sev_launch_measure(Error **errp)
+{
+    error_setg(errp, "SEV is not available in this QEMU");
+    return NULL;
+}
+
+SevCapability *qmp_query_sev_capabilities(Error **errp)
+{
+    error_setg(errp, "SEV is not available in this QEMU");
+    return NULL;
+}
+
+void qmp_sev_inject_launch_secret(const char *packet_header, const char *secret,
+                                  bool has_gpa, uint64_t gpa, Error **errp)
+{
+    error_setg(errp, "SEV is not available in this QEMU");
+}
+
+SevAttestationReport *qmp_query_sev_attestation_report(const char *mnonce,
+                                                       Error **errp)
+{
+    error_setg(errp, "SEV is not available in this QEMU");
+    return NULL;
+}
diff --git a/target/i386/sev-system-stub.c b/target/i386/sev-system-stub.c
index d5bf886e79..7c5c02a565 100644
--- a/target/i386/sev-system-stub.c
+++ b/target/i386/sev-system-stub.c
@@ -14,34 +14,9 @@
 #include "qemu/osdep.h"
 #include "monitor/monitor.h"
 #include "monitor/hmp-target.h"
-#include "qapi/qapi-commands-misc-target.h"
 #include "qapi/error.h"
 #include "sev.h"
 
-SevInfo *qmp_query_sev(Error **errp)
-{
-    error_setg(errp, "SEV is not available in this QEMU");
-    return NULL;
-}
-
-SevLaunchMeasureInfo *qmp_query_sev_launch_measure(Error **errp)
-{
-    error_setg(errp, "SEV is not available in this QEMU");
-    return NULL;
-}
-
-SevCapability *qmp_query_sev_capabilities(Error **errp)
-{
-    error_setg(errp, "SEV is not available in this QEMU");
-    return NULL;
-}
-
-void qmp_sev_inject_launch_secret(const char *packet_header, const char *secret,
-                                  bool has_gpa, uint64_t gpa, Error **errp)
-{
-    error_setg(errp, "SEV is not available in this QEMU");
-}
-
 int sev_encrypt_flash(hwaddr gpa, uint8_t *ptr, uint64_t len, Error **errp)
 {
     g_assert_not_reached();
@@ -56,13 +31,6 @@ int sev_es_save_reset_vector(void *flash_ptr, uint64_t flash_size)
     g_assert_not_reached();
 }
 
-SevAttestationReport *qmp_query_sev_attestation_report(const char *mnonce,
-                                                       Error **errp)
-{
-    error_setg(errp, "SEV is not available in this QEMU");
-    return NULL;
-}
-
 void hmp_info_sev(Monitor *mon, const QDict *qdict)
 {
     monitor_printf(mon, "SEV is not available in this QEMU\n");
diff --git a/target/i386/sev.c b/target/i386/sev.c
index 7ee700d6a3..56dd64e659 100644
--- a/target/i386/sev.c
+++ b/target/i386/sev.c
@@ -37,7 +37,7 @@
 #include "qom/object.h"
 #include "monitor/monitor.h"
 #include "monitor/hmp-target.h"
-#include "qapi/qapi-commands-misc-target.h"
+#include "qapi/qapi-commands-misc-i386.h"
 #include "confidential-guest.h"
 #include "hw/i386/pc.h"
 #include "system/address-spaces.h"

From 30fbb258717d81c32f11a0e4b7218442a43c4856 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Thu, 22 May 2025 12:05:31 -0700
Subject: [PATCH 1208/2760] qapi: expose query-gic-capability command
 unconditionally
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This removes the TARGET_ARM condition from the query-gic-capability
command. This requires providing a QMP command stub for non-ARM targets.
This in turn requires moving the command out of misc-target.json, since
that will trigger symbol poisoning errors when built from target
independent code.

Following the earlier precedent, this creates a misc-arm.json file to
hold this ARM specific command.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20250522190542.588267-5-pierrick.bouvier@linaro.org>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
---
 qapi/meson.build          |  1 +
 qapi/misc-arm.json        | 49 +++++++++++++++++++++++++++++++++++++++
 qapi/misc-target.json     | 44 -----------------------------------
 qapi/qapi-schema.json     |  1 +
 stubs/meson.build         |  1 +
 stubs/monitor-arm-gic.c   | 12 ++++++++++
 target/arm/arm-qmp-cmds.c |  2 +-
 7 files changed, 65 insertions(+), 45 deletions(-)
 create mode 100644 qapi/misc-arm.json
 create mode 100644 stubs/monitor-arm-gic.c

diff --git a/qapi/meson.build b/qapi/meson.build
index 3a9bd06104..5e93e6b8cf 100644
--- a/qapi/meson.build
+++ b/qapi/meson.build
@@ -64,6 +64,7 @@ if have_system
     'qdev',
     'pci',
     'rocker',
+    'misc-arm',
     'misc-i386',
     'tpm',
     'uefi',
diff --git a/qapi/misc-arm.json b/qapi/misc-arm.json
new file mode 100644
index 0000000000..f5341372f5
--- /dev/null
+++ b/qapi/misc-arm.json
@@ -0,0 +1,49 @@
+# -*- Mode: Python -*-
+# vim: filetype=python
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+##
+# @GICCapability:
+#
+# The struct describes capability for a specific GIC (Generic
+# Interrupt Controller) version.  These bits are not only decided by
+# QEMU/KVM software version, but also decided by the hardware that the
+# program is running upon.
+#
+# @version: version of GIC to be described.  Currently, only 2 and 3
+#     are supported.
+#
+# @emulated: whether current QEMU/hardware supports emulated GIC
+#     device in user space.
+#
+# @kernel: whether current QEMU/hardware supports hardware accelerated
+#     GIC device in kernel.
+#
+# Since: 2.6
+##
+{ 'struct': 'GICCapability',
+  'data': { 'version': 'int',
+            'emulated': 'bool',
+            'kernel': 'bool' } }
+
+##
+# @query-gic-capabilities:
+#
+# It will return a list of GICCapability objects that describe its
+# capability bits.
+#
+# On non-ARM targets this command will report an error as the GIC
+# technology is not applicable.
+#
+# Returns: a list of GICCapability objects.
+#
+# Since: 2.6
+#
+# .. qmp-example::
+#
+#     -> { "execute": "query-gic-capabilities" }
+#     <- { "return": [{ "version": 2, "emulated": true, "kernel": false },
+#                     { "version": 3, "emulated": false, "kernel": true } ] }
+##
+{ 'command': 'query-gic-capabilities', 'returns': ['GICCapability'] }
diff --git a/qapi/misc-target.json b/qapi/misc-target.json
index c0d7b311f3..cc472ce91c 100644
--- a/qapi/misc-target.json
+++ b/qapi/misc-target.json
@@ -2,50 +2,6 @@
 # vim: filetype=python
 #
 
-##
-# @GICCapability:
-#
-# The struct describes capability for a specific GIC (Generic
-# Interrupt Controller) version.  These bits are not only decided by
-# QEMU/KVM software version, but also decided by the hardware that the
-# program is running upon.
-#
-# @version: version of GIC to be described.  Currently, only 2 and 3
-#     are supported.
-#
-# @emulated: whether current QEMU/hardware supports emulated GIC
-#     device in user space.
-#
-# @kernel: whether current QEMU/hardware supports hardware accelerated
-#     GIC device in kernel.
-#
-# Since: 2.6
-##
-{ 'struct': 'GICCapability',
-  'data': { 'version': 'int',
-            'emulated': 'bool',
-            'kernel': 'bool' },
-  'if': 'TARGET_ARM' }
-
-##
-# @query-gic-capabilities:
-#
-# This command is ARM-only.  It will return a list of GICCapability
-# objects that describe its capability bits.
-#
-# Returns: a list of GICCapability objects.
-#
-# Since: 2.6
-#
-# .. qmp-example::
-#
-#     -> { "execute": "query-gic-capabilities" }
-#     <- { "return": [{ "version": 2, "emulated": true, "kernel": false },
-#                     { "version": 3, "emulated": false, "kernel": true } ] }
-##
-{ 'command': 'query-gic-capabilities', 'returns': ['GICCapability'],
-  'if': 'TARGET_ARM' }
-
 ##
 # @SgxEpcSection:
 #
diff --git a/qapi/qapi-schema.json b/qapi/qapi-schema.json
index 96f6aa4413..e96bff8d38 100644
--- a/qapi/qapi-schema.json
+++ b/qapi/qapi-schema.json
@@ -61,6 +61,7 @@
 { 'include': 'replay.json' }
 { 'include': 'yank.json' }
 { 'include': 'misc.json' }
+{ 'include': 'misc-arm.json' }
 { 'include': 'misc-i386.json' }
 { 'include': 'misc-target.json' }
 { 'include': 'audio.json' }
diff --git a/stubs/meson.build b/stubs/meson.build
index 9922ec7b88..07e9d3799a 100644
--- a/stubs/meson.build
+++ b/stubs/meson.build
@@ -77,6 +77,7 @@ if have_system
   stub_ss.add(files('target-monitor-defs.c'))
   stub_ss.add(files('win32-kbd-hook.c'))
   stub_ss.add(files('xen-hw-stub.c'))
+  stub_ss.add(files('monitor-arm-gic.c'))
   stub_ss.add(files('monitor-i386-rtc.c'))
   stub_ss.add(files('monitor-i386-sev.c'))
 endif
diff --git a/stubs/monitor-arm-gic.c b/stubs/monitor-arm-gic.c
new file mode 100644
index 0000000000..b3429243ef
--- /dev/null
+++ b/stubs/monitor-arm-gic.c
@@ -0,0 +1,12 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "qapi/qapi-commands-misc-arm.h"
+
+
+GICCapabilityList *qmp_query_gic_capabilities(Error **errp)
+{
+    error_setg(errp, "GIC hardware is not available on this target");
+    return NULL;
+}
diff --git a/target/arm/arm-qmp-cmds.c b/target/arm/arm-qmp-cmds.c
index a1a944adb4..ef18c867ca 100644
--- a/target/arm/arm-qmp-cmds.c
+++ b/target/arm/arm-qmp-cmds.c
@@ -27,7 +27,7 @@
 #include "qapi/visitor.h"
 #include "qapi/qobject-input-visitor.h"
 #include "qapi/qapi-commands-machine-target.h"
-#include "qapi/qapi-commands-misc-target.h"
+#include "qapi/qapi-commands-misc-arm.h"
 #include "qobject/qdict.h"
 #include "qom/qom-qobject.h"
 

From 28a6a99834cd126f80f426ac3fe00625f165ebea Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Thu, 22 May 2025 12:05:32 -0700
Subject: [PATCH 1209/2760] qapi: make SGX commands unconditionally available
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This removes the TARGET_I386 condition from the SGX confidential
virtualization commands, moving them to the recently introduced
misc-i386.json QAPI file, given they are inherantly i386 specific
commands.

Observe a pre-existing bug that the "SGXEPCSection" struct lacked
a TARGET_I386 condition, despite its only usage being behind a
TARGET_I386 condition.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20250522190542.588267-6-pierrick.bouvier@linaro.org>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
---
 hw/i386/sgx-stub.c       |  2 +-
 hw/i386/sgx.c            |  2 +-
 qapi/misc-i386.json      | 77 +++++++++++++++++++++++++++++++++++++++
 qapi/misc-target.json    | 79 ----------------------------------------
 stubs/meson.build        |  1 +
 stubs/monitor-i386-sgx.c | 17 +++++++++
 6 files changed, 97 insertions(+), 81 deletions(-)
 create mode 100644 stubs/monitor-i386-sgx.c

diff --git a/hw/i386/sgx-stub.c b/hw/i386/sgx-stub.c
index ccb21a975d..d295e54d23 100644
--- a/hw/i386/sgx-stub.c
+++ b/hw/i386/sgx-stub.c
@@ -3,8 +3,8 @@
 #include "monitor/hmp-target.h"
 #include "hw/i386/pc.h"
 #include "hw/i386/sgx-epc.h"
+#include "qapi/qapi-commands-misc-i386.h"
 #include "qapi/error.h"
-#include "qapi/qapi-commands-misc-target.h"
 
 void sgx_epc_build_srat(GArray *table_data)
 {
diff --git a/hw/i386/sgx.c b/hw/i386/sgx.c
index c80203b438..e2801546ad 100644
--- a/hw/i386/sgx.c
+++ b/hw/i386/sgx.c
@@ -19,7 +19,7 @@
 #include "monitor/hmp-target.h"
 #include "qapi/error.h"
 #include "qemu/error-report.h"
-#include "qapi/qapi-commands-misc-target.h"
+#include "qapi/qapi-commands-misc-i386.h"
 #include "system/address-spaces.h"
 #include "system/hw_accel.h"
 #include "system/reset.h"
diff --git a/qapi/misc-i386.json b/qapi/misc-i386.json
index 360adadfe0..d5d1af55a4 100644
--- a/qapi/misc-i386.json
+++ b/qapi/misc-i386.json
@@ -300,3 +300,80 @@
 { 'command': 'query-sev-attestation-report',
   'data': { 'mnonce': 'str' },
   'returns': 'SevAttestationReport' }
+
+##
+# @SgxEpcSection:
+#
+# Information about intel SGX EPC section
+#
+# @node: the numa node
+#
+# @size: the size of EPC section
+#
+# Since: 7.0
+##
+{ 'struct': 'SgxEpcSection',
+  'data': { 'node': 'int',
+            'size': 'uint64'}}
+
+##
+# @SgxInfo:
+#
+# Information about intel Safe Guard eXtension (SGX) support
+#
+# @sgx: true if SGX is supported
+#
+# @sgx1: true if SGX1 is supported
+#
+# @sgx2: true if SGX2 is supported
+#
+# @flc: true if FLC is supported
+#
+# @sections: The EPC sections information (Since: 7.0)
+#
+# Since: 6.2
+##
+{ 'struct': 'SgxInfo',
+  'data': { 'sgx': 'bool',
+            'sgx1': 'bool',
+            'sgx2': 'bool',
+            'flc': 'bool',
+            'sections': ['SgxEpcSection']} }
+
+##
+# @query-sgx:
+#
+# Returns information about configured SGX capabilities of guest
+#
+# Returns: @SgxInfo
+#
+# Since: 6.2
+#
+# .. qmp-example::
+#
+#     -> { "execute": "query-sgx" }
+#     <- { "return": { "sgx": true, "sgx1" : true, "sgx2" : true,
+#                      "flc": true,
+#                      "sections": [{"node": 0, "size": 67108864},
+#                      {"node": 1, "size": 29360128}]} }
+##
+{ 'command': 'query-sgx', 'returns': 'SgxInfo' }
+
+##
+# @query-sgx-capabilities:
+#
+# Returns information about SGX capabilities of host
+#
+# Returns: @SgxInfo
+#
+# Since: 6.2
+#
+# .. qmp-example::
+#
+#     -> { "execute": "query-sgx-capabilities" }
+#     <- { "return": { "sgx": true, "sgx1" : true, "sgx2" : true,
+#                      "flc": true,
+#                      "section" : [{"node": 0, "size": 67108864},
+#                      {"node": 1, "size": 29360128}]} }
+##
+{ 'command': 'query-sgx-capabilities', 'returns': 'SgxInfo' }
diff --git a/qapi/misc-target.json b/qapi/misc-target.json
index cc472ce91c..d62db37d7c 100644
--- a/qapi/misc-target.json
+++ b/qapi/misc-target.json
@@ -2,85 +2,6 @@
 # vim: filetype=python
 #
 
-##
-# @SgxEpcSection:
-#
-# Information about intel SGX EPC section
-#
-# @node: the numa node
-#
-# @size: the size of EPC section
-#
-# Since: 7.0
-##
-{ 'struct': 'SgxEpcSection',
-  'data': { 'node': 'int',
-            'size': 'uint64'}}
-
-##
-# @SgxInfo:
-#
-# Information about intel Safe Guard eXtension (SGX) support
-#
-# @sgx: true if SGX is supported
-#
-# @sgx1: true if SGX1 is supported
-#
-# @sgx2: true if SGX2 is supported
-#
-# @flc: true if FLC is supported
-#
-# @sections: The EPC sections information (Since: 7.0)
-#
-# Since: 6.2
-##
-{ 'struct': 'SgxInfo',
-  'data': { 'sgx': 'bool',
-            'sgx1': 'bool',
-            'sgx2': 'bool',
-            'flc': 'bool',
-            'sections': ['SgxEpcSection']},
-   'if': 'TARGET_I386' }
-
-##
-# @query-sgx:
-#
-# Returns information about configured SGX capabilities of guest
-#
-# Returns: @SgxInfo
-#
-# Since: 6.2
-#
-# .. qmp-example::
-#
-#     -> { "execute": "query-sgx" }
-#     <- { "return": { "sgx": true, "sgx1" : true, "sgx2" : true,
-#                      "flc": true,
-#                      "sections": [{"node": 0, "size": 67108864},
-#                      {"node": 1, "size": 29360128}]} }
-##
-{ 'command': 'query-sgx', 'returns': 'SgxInfo', 'if': 'TARGET_I386' }
-
-##
-# @query-sgx-capabilities:
-#
-# Returns information about SGX capabilities of host
-#
-# Returns: @SgxInfo
-#
-# Since: 6.2
-#
-# .. qmp-example::
-#
-#     -> { "execute": "query-sgx-capabilities" }
-#     <- { "return": { "sgx": true, "sgx1" : true, "sgx2" : true,
-#                      "flc": true,
-#                      "section" : [{"node": 0, "size": 67108864},
-#                      {"node": 1, "size": 29360128}]} }
-##
-{ 'command': 'query-sgx-capabilities', 'returns': 'SgxInfo', 'if': 'TARGET_I386' }
-
-
 ##
 # @EvtchnPortType:
 #
diff --git a/stubs/meson.build b/stubs/meson.build
index 07e9d3799a..f2eb488018 100644
--- a/stubs/meson.build
+++ b/stubs/meson.build
@@ -80,6 +80,7 @@ if have_system
   stub_ss.add(files('monitor-arm-gic.c'))
   stub_ss.add(files('monitor-i386-rtc.c'))
   stub_ss.add(files('monitor-i386-sev.c'))
+  stub_ss.add(files('monitor-i386-sgx.c'))
 endif
 
 if have_system or have_user
diff --git a/stubs/monitor-i386-sgx.c b/stubs/monitor-i386-sgx.c
new file mode 100644
index 0000000000..00e081d52d
--- /dev/null
+++ b/stubs/monitor-i386-sgx.c
@@ -0,0 +1,17 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "qapi/qapi-commands-misc-i386.h"
+
+SgxInfo *qmp_query_sgx(Error **errp)
+{
+    error_setg(errp, "SGX support is not compiled in");
+    return NULL;
+}
+
+SgxInfo *qmp_query_sgx_capabilities(Error **errp)
+{
+    error_setg(errp, "SGX support is not compiled in");
+    return NULL;
+}

From 4b679a94c69db2526ddf77d4a0bd6b041b9fa133 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Thu, 22 May 2025 12:05:33 -0700
Subject: [PATCH 1210/2760] qapi: make Xen event commands unconditionally
 available
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This removes the TARGET_I386 condition from the Xen event channel
commands, moving them to the recently introduced misc-i386.json
QAPI file, given they are inherantly i386 specific commands.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Acked-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20250522190542.588267-7-pierrick.bouvier@linaro.org>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
---
 hw/i386/kvm/xen-stubs.c  |  13 -----
 hw/i386/kvm/xen_evtchn.c |   2 +-
 qapi/misc-i386.json      | 107 +++++++++++++++++++++++++++++++++++++
 qapi/misc-target.json    | 111 ---------------------------------------
 stubs/meson.build        |   1 +
 stubs/monitor-i386-xen.c |  16 ++++++
 6 files changed, 125 insertions(+), 125 deletions(-)
 create mode 100644 stubs/monitor-i386-xen.c

diff --git a/hw/i386/kvm/xen-stubs.c b/hw/i386/kvm/xen-stubs.c
index d03131e686..ce73119ee7 100644
--- a/hw/i386/kvm/xen-stubs.c
+++ b/hw/i386/kvm/xen-stubs.c
@@ -12,7 +12,6 @@
 #include "qemu/osdep.h"
 
 #include "qapi/error.h"
-#include "qapi/qapi-commands-misc-target.h"
 
 #include "xen_evtchn.h"
 #include "xen_primary_console.h"
@@ -38,15 +37,3 @@ void xen_primary_console_create(void)
 void xen_primary_console_set_be_port(uint16_t port)
 {
 }
-#ifdef TARGET_I386
-EvtchnInfoList *qmp_xen_event_list(Error **errp)
-{
-    error_setg(errp, "Xen event channel emulation not enabled");
-    return NULL;
-}
-
-void qmp_xen_event_inject(uint32_t port, Error **errp)
-{
-    error_setg(errp, "Xen event channel emulation not enabled");
-}
-#endif
diff --git a/hw/i386/kvm/xen_evtchn.c b/hw/i386/kvm/xen_evtchn.c
index b5190549a8..dd566c4967 100644
--- a/hw/i386/kvm/xen_evtchn.c
+++ b/hw/i386/kvm/xen_evtchn.c
@@ -19,7 +19,7 @@
 #include "monitor/monitor.h"
 #include "monitor/hmp.h"
 #include "qapi/error.h"
-#include "qapi/qapi-commands-misc-target.h"
+#include "qapi/qapi-commands-misc-i386.h"
 #include "qobject/qdict.h"
 #include "qom/object.h"
 #include "exec/target_page.h"
diff --git a/qapi/misc-i386.json b/qapi/misc-i386.json
index d5d1af55a4..3f88a5b28e 100644
--- a/qapi/misc-i386.json
+++ b/qapi/misc-i386.json
@@ -377,3 +377,110 @@
 #                      {"node": 1, "size": 29360128}]} }
 ##
 { 'command': 'query-sgx-capabilities', 'returns': 'SgxInfo' }
+
+##
+# @EvtchnPortType:
+#
+# An enumeration of Xen event channel port types.
+#
+# @closed: The port is unused.
+#
+# @unbound: The port is allocated and ready to be bound.
+#
+# @interdomain: The port is connected as an interdomain interrupt.
+#
+# @pirq: The port is bound to a physical IRQ (PIRQ).
+#
+# @virq: The port is bound to a virtual IRQ (VIRQ).
+#
+# @ipi: The post is an inter-processor interrupt (IPI).
+#
+# Since: 8.0
+##
+{ 'enum': 'EvtchnPortType',
+  'data': ['closed', 'unbound', 'interdomain', 'pirq', 'virq', 'ipi'] }
+
+##
+# @EvtchnInfo:
+#
+# Information about a Xen event channel port
+#
+# @port: the port number
+#
+# @vcpu: target vCPU for this port
+#
+# @type: the port type
+#
+# @remote-domain: remote domain for interdomain ports
+#
+# @target: remote port ID, or virq/pirq number
+#
+# @pending: port is currently active pending delivery
+#
+# @masked: port is masked
+#
+# Since: 8.0
+##
+{ 'struct': 'EvtchnInfo',
+  'data': {'port': 'uint16',
+           'vcpu': 'uint32',
+           'type': 'EvtchnPortType',
+           'remote-domain': 'str',
+           'target': 'uint16',
+           'pending': 'bool',
+           'masked': 'bool'} }
+
+
+##
+# @xen-event-list:
+#
+# Query the Xen event channels opened by the guest.
+#
+# Returns: list of open event channel ports.
+#
+# Since: 8.0
+#
+# .. qmp-example::
+#
+#     -> { "execute": "xen-event-list" }
+#     <- { "return": [
+#             {
+#                 "pending": false,
+#                 "port": 1,
+#                 "vcpu": 1,
+#                 "remote-domain": "qemu",
+#                 "masked": false,
+#                 "type": "interdomain",
+#                 "target": 1
+#             },
+#             {
+#                 "pending": false,
+#                 "port": 2,
+#                 "vcpu": 0,
+#                 "remote-domain": "",
+#                 "masked": false,
+#                 "type": "virq",
+#                 "target": 0
+#             }
+#          ]
+#        }
+##
+{ 'command': 'xen-event-list',
+  'returns': ['EvtchnInfo'] }
+
+##
+# @xen-event-inject:
+#
+# Inject a Xen event channel port (interrupt) to the guest.
+#
+# @port: The port number
+#
+# Since: 8.0
+#
+# .. qmp-example::
+#
+#     -> { "execute": "xen-event-inject", "arguments": { "port": 1 } }
+#     <- { "return": { } }
+##
+{ 'command': 'xen-event-inject',
+  'data': { 'port': 'uint32' } }
diff --git a/qapi/misc-target.json b/qapi/misc-target.json
index d62db37d7c..c9ea1ab23e 100644
--- a/qapi/misc-target.json
+++ b/qapi/misc-target.json
@@ -1,114 +1,3 @@
 # -*- Mode: Python -*-
 # vim: filetype=python
 #
-
-##
-# @EvtchnPortType:
-#
-# An enumeration of Xen event channel port types.
-#
-# @closed: The port is unused.
-#
-# @unbound: The port is allocated and ready to be bound.
-#
-# @interdomain: The port is connected as an interdomain interrupt.
-#
-# @pirq: The port is bound to a physical IRQ (PIRQ).
-#
-# @virq: The port is bound to a virtual IRQ (VIRQ).
-#
-# @ipi: The post is an inter-processor interrupt (IPI).
-#
-# Since: 8.0
-##
-{ 'enum': 'EvtchnPortType',
-  'data': ['closed', 'unbound', 'interdomain', 'pirq', 'virq', 'ipi'],
-  'if': 'TARGET_I386' }
-
-##
-# @EvtchnInfo:
-#
-# Information about a Xen event channel port
-#
-# @port: the port number
-#
-# @vcpu: target vCPU for this port
-#
-# @type: the port type
-#
-# @remote-domain: remote domain for interdomain ports
-#
-# @target: remote port ID, or virq/pirq number
-#
-# @pending: port is currently active pending delivery
-#
-# @masked: port is masked
-#
-# Since: 8.0
-##
-{ 'struct': 'EvtchnInfo',
-  'data': {'port': 'uint16',
-           'vcpu': 'uint32',
-           'type': 'EvtchnPortType',
-           'remote-domain': 'str',
-           'target': 'uint16',
-           'pending': 'bool',
-           'masked': 'bool'},
-  'if': 'TARGET_I386' }
-
-
-##
-# @xen-event-list:
-#
-# Query the Xen event channels opened by the guest.
-#
-# Returns: list of open event channel ports.
-#
-# Since: 8.0
-#
-# .. qmp-example::
-#
-#     -> { "execute": "xen-event-list" }
-#     <- { "return": [
-#             {
-#                 "pending": false,
-#                 "port": 1,
-#                 "vcpu": 1,
-#                 "remote-domain": "qemu",
-#                 "masked": false,
-#                 "type": "interdomain",
-#                 "target": 1
-#             },
-#             {
-#                 "pending": false,
-#                 "port": 2,
-#                 "vcpu": 0,
-#                 "remote-domain": "",
-#                 "masked": false,
-#                 "type": "virq",
-#                 "target": 0
-#             }
-#          ]
-#        }
-##
-{ 'command': 'xen-event-list',
-  'returns': ['EvtchnInfo'],
-  'if': 'TARGET_I386' }
-
-##
-# @xen-event-inject:
-#
-# Inject a Xen event channel port (interrupt) to the guest.
-#
-# @port: The port number
-#
-# Since: 8.0
-#
-# .. qmp-example::
-#
-#     -> { "execute": "xen-event-inject", "arguments": { "port": 1 } }
-#     <- { "return": { } }
-##
-{ 'command': 'xen-event-inject',
-  'data': { 'port': 'uint32' },
-  'if': 'TARGET_I386' }
diff --git a/stubs/meson.build b/stubs/meson.build
index f2eb488018..0ef11976a2 100644
--- a/stubs/meson.build
+++ b/stubs/meson.build
@@ -81,6 +81,7 @@ if have_system
   stub_ss.add(files('monitor-i386-rtc.c'))
   stub_ss.add(files('monitor-i386-sev.c'))
   stub_ss.add(files('monitor-i386-sgx.c'))
+  stub_ss.add(files('monitor-i386-xen.c'))
 endif
 
 if have_system or have_user
diff --git a/stubs/monitor-i386-xen.c b/stubs/monitor-i386-xen.c
new file mode 100644
index 0000000000..95b826f979
--- /dev/null
+++ b/stubs/monitor-i386-xen.c
@@ -0,0 +1,16 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "qapi/qapi-commands-misc-i386.h"
+
+EvtchnInfoList *qmp_xen_event_list(Error **errp)
+{
+    error_setg(errp, "Xen event channel emulation not enabled");
+    return NULL;
+}
+
+void qmp_xen_event_inject(uint32_t port, Error **errp)
+{
+    error_setg(errp, "Xen event channel emulation not enabled");
+}

From 0a1f83c3fb63229a77e2d0c5f1fe5d7e09dbf3b7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Thu, 22 May 2025 12:05:34 -0700
Subject: [PATCH 1211/2760] qapi: remove the misc-target.json file
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This file is now empty and can thus be removed.

Observe the pre-existing bug with s390-skeys.c and target/i386/monitor.c
both including qapi-commands-misc-target.h despite not requiring it.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20250522190542.588267-8-pierrick.bouvier@linaro.org>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
---
 hw/s390x/s390-skeys.c | 1 -
 qapi/meson.build      | 1 -
 qapi/misc-target.json | 3 ---
 qapi/qapi-schema.json | 1 -
 target/i386/monitor.c | 1 -
 5 files changed, 7 deletions(-)
 delete mode 100644 qapi/misc-target.json

diff --git a/hw/s390x/s390-skeys.c b/hw/s390x/s390-skeys.c
index aedb62b2d3..8eeecfd58f 100644
--- a/hw/s390x/s390-skeys.c
+++ b/hw/s390x/s390-skeys.c
@@ -17,7 +17,6 @@
 #include "hw/s390x/storage-keys.h"
 #include "qapi/error.h"
 #include "qapi/qapi-commands-machine.h"
-#include "qapi/qapi-commands-misc-target.h"
 #include "qobject/qdict.h"
 #include "qemu/error-report.h"
 #include "system/memory_mapping.h"
diff --git a/qapi/meson.build b/qapi/meson.build
index 5e93e6b8cf..ffe44f9e0b 100644
--- a/qapi/meson.build
+++ b/qapi/meson.build
@@ -42,7 +42,6 @@ qapi_all_modules = [
   'machine-target',
   'migration',
   'misc',
-  'misc-target',
   'net',
   'pragma',
   'qom',
diff --git a/qapi/misc-target.json b/qapi/misc-target.json
deleted file mode 100644
index c9ea1ab23e..0000000000
--- a/qapi/misc-target.json
+++ /dev/null
@@ -1,3 +0,0 @@
-# -*- Mode: Python -*-
-# vim: filetype=python
-#
diff --git a/qapi/qapi-schema.json b/qapi/qapi-schema.json
index e96bff8d38..d8eb79cfda 100644
--- a/qapi/qapi-schema.json
+++ b/qapi/qapi-schema.json
@@ -63,7 +63,6 @@
 { 'include': 'misc.json' }
 { 'include': 'misc-arm.json' }
 { 'include': 'misc-i386.json' }
-{ 'include': 'misc-target.json' }
 { 'include': 'audio.json' }
 { 'include': 'acpi.json' }
 { 'include': 'pci.json' }
diff --git a/target/i386/monitor.c b/target/i386/monitor.c
index 3ea92b066e..3c9b6ca62f 100644
--- a/target/i386/monitor.c
+++ b/target/i386/monitor.c
@@ -29,7 +29,6 @@
 #include "monitor/hmp.h"
 #include "qobject/qdict.h"
 #include "qapi/error.h"
-#include "qapi/qapi-commands-misc-target.h"
 #include "qapi/qapi-commands-misc.h"
 
 /* Perform linear address sign extension */

From 448553bb7c2a2fe518d7dc41c58a25d6d31831da Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 22 May 2025 12:05:35 -0700
Subject: [PATCH 1212/2760] qapi: Make CpuModelExpansionInfo::deprecated-props
 optional and generic
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We'd like to have some unified QAPI schema. Having a structure field
conditional to a target being built in is not very practical.

While @deprecated-props is only used by s390x target, it is generic
enough and could be used by other targets (assuming we expand
CpuModelExpansionType enum values).

Let's always include this field, regardless of the target, but make it
optional. This is not a compatibility break only because the field
remains present always on S390x.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20250522190542.588267-9-pierrick.bouvier@linaro.org>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
---
 qapi/machine-target.json | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/qapi/machine-target.json b/qapi/machine-target.json
index 426ce4ee82..d8dbda4b50 100644
--- a/qapi/machine-target.json
+++ b/qapi/machine-target.json
@@ -244,19 +244,18 @@
 #
 # @model: the expanded CpuModelInfo.
 #
-# @deprecated-props: a list of properties that are flagged as
+# @deprecated-props: an optional list of properties that are flagged as
 #     deprecated by the CPU vendor.  The list depends on the
 #     CpuModelExpansionType: "static" properties are a subset of the
 #     enabled-properties for the expanded model; "full" properties are
 #     a set of properties that are deprecated across all models for
-#     the architecture.  (since: 9.1).
+#     the architecture.  (since: 10.1 -- since 9.1 on s390x --).
 #
 # Since: 2.8
 ##
 { 'struct': 'CpuModelExpansionInfo',
   'data': { 'model': 'CpuModelInfo',
-            'deprecated-props' : { 'type': ['str'],
-                                   'if': 'TARGET_S390X' } },
+            '*deprecated-props' : ['str'] },
   'if': { 'any': [ 'TARGET_S390X',
                    'TARGET_I386',
                    'TARGET_ARM',

From d6758495d888e0ef8175824dadcdeb85274c14f1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Thu, 22 May 2025 12:05:36 -0700
Subject: [PATCH 1213/2760] qapi: make most CPU commands unconditionally
 available
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This removes the TARGET_* conditions from all the CPU commands
that are conceptually target independent. Top level stubs are
provided to cope with targets which do not currently implement
all of the commands. Adjust the doc comments accordingly.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20250522190542.588267-10-pierrick.bouvier@linaro.org>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
---
 MAINTAINERS                           |   1 -
 qapi/machine-target.json              | 397 --------------------------
 qapi/machine.json                     | 363 +++++++++++++++++++++++
 stubs/meson.build                     |   2 +
 stubs/monitor-cpu-s390x.c             |  23 ++
 stubs/monitor-cpu.c                   |  21 ++
 target/arm/arm-qmp-cmds.c             |   2 +-
 target/i386/cpu-system.c              |   2 +-
 target/i386/cpu.c                     |   2 +-
 target/loongarch/loongarch-qmp-cmds.c |   2 +-
 target/mips/system/mips-qmp-cmds.c    |  12 +-
 target/ppc/ppc-qmp-cmds.c             |  12 +-
 target/riscv/riscv-qmp-cmds.c         |   2 +-
 target/s390x/cpu_models_system.c      |   2 +-
 14 files changed, 437 insertions(+), 406 deletions(-)
 create mode 100644 stubs/monitor-cpu-s390x.c
 create mode 100644 stubs/monitor-cpu.c

diff --git a/MAINTAINERS b/MAINTAINERS
index 7060cf49b9..e27d1458c5 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1938,7 +1938,6 @@ F: hw/core/numa.c
 F: hw/cpu/cluster.c
 F: qapi/machine.json
 F: qapi/machine-common.json
-F: qapi/machine-target.json
 F: include/hw/boards.h
 F: include/hw/core/cpu.h
 F: include/hw/cpu/cluster.h
diff --git a/qapi/machine-target.json b/qapi/machine-target.json
index d8dbda4b50..f19e34adaf 100644
--- a/qapi/machine-target.json
+++ b/qapi/machine-target.json
@@ -6,403 +6,6 @@
 
 { 'include': 'machine-common.json' }
 
-##
-# @CpuModelInfo:
-#
-# Virtual CPU model.
-#
-# A CPU model consists of the name of a CPU definition, to which delta
-# changes are applied (e.g. features added/removed).  Most magic
-# values that an architecture might require should be hidden behind
-# the name.  However, if required, architectures can expose relevant
-# properties.
-#
-# @name: the name of the CPU definition the model is based on
-#
-# @props: a dictionary of QOM properties to be applied
-#
-# Since: 2.8
-##
-{ 'struct': 'CpuModelInfo',
-  'data': { 'name': 'str',
-            '*props': 'any' } }
-
-##
-# @CpuModelExpansionType:
-#
-# An enumeration of CPU model expansion types.
-#
-# @static: Expand to a static CPU model, a combination of a static
-#     base model name and property delta changes.  As the static base
-#     model will never change, the expanded CPU model will be the
-#     same, independent of QEMU version, machine type, machine
-#     options, and accelerator options.  Therefore, the resulting
-#     model can be used by tooling without having to specify a
-#     compatibility machine - e.g. when displaying the "host" model.
-#     The @static CPU models are migration-safe.
-#
-# @full: Expand all properties.  The produced model is not guaranteed
-#     to be migration-safe, but allows tooling to get an insight and
-#     work with model details.
-#
-# .. note:: When a non-migration-safe CPU model is expanded in static
-#    mode, some features enabled by the CPU model may be omitted,
-#    because they can't be implemented by a static CPU model
-#    definition (e.g. cache info passthrough and PMU passthrough in
-#    x86).  If you need an accurate representation of the features
-#    enabled by a non-migration-safe CPU model, use @full.  If you
-#    need a static representation that will keep ABI compatibility
-#    even when changing QEMU version or machine-type, use @static (but
-#    keep in mind that some features may be omitted).
-#
-# Since: 2.8
-##
-{ 'enum': 'CpuModelExpansionType',
-  'data': [ 'static', 'full' ] }
-
-##
-# @CpuModelCompareResult:
-#
-# An enumeration of CPU model comparison results.  The result is
-# usually calculated using e.g. CPU features or CPU generations.
-#
-# @incompatible: If model A is incompatible to model B, model A is not
-#     guaranteed to run where model B runs and the other way around.
-#
-# @identical: If model A is identical to model B, model A is
-#     guaranteed to run where model B runs and the other way around.
-#
-# @superset: If model A is a superset of model B, model B is
-#     guaranteed to run where model A runs.  There are no guarantees
-#     about the other way.
-#
-# @subset: If model A is a subset of model B, model A is guaranteed to
-#     run where model B runs.  There are no guarantees about the other
-#     way.
-#
-# Since: 2.8
-##
-{ 'enum': 'CpuModelCompareResult',
-  'data': [ 'incompatible', 'identical', 'superset', 'subset' ] }
-
-##
-# @CpuModelBaselineInfo:
-#
-# The result of a CPU model baseline.
-#
-# @model: the baselined CpuModelInfo.
-#
-# Since: 2.8
-##
-{ 'struct': 'CpuModelBaselineInfo',
-  'data': { 'model': 'CpuModelInfo' },
-  'if': 'TARGET_S390X' }
-
-##
-# @CpuModelCompareInfo:
-#
-# The result of a CPU model comparison.
-#
-# @result: The result of the compare operation.
-#
-# @responsible-properties: List of properties that led to the
-#     comparison result not being identical.
-#
-# @responsible-properties is a list of QOM property names that led to
-# both CPUs not being detected as identical.  For identical models,
-# this list is empty.  If a QOM property is read-only, that means
-# there's no known way to make the CPU models identical.  If the
-# special property name "type" is included, the models are by
-# definition not identical and cannot be made identical.
-#
-# Since: 2.8
-##
-{ 'struct': 'CpuModelCompareInfo',
-  'data': { 'result': 'CpuModelCompareResult',
-            'responsible-properties': ['str'] },
-  'if': 'TARGET_S390X' }
-
-##
-# @query-cpu-model-comparison:
-#
-# Compares two CPU models, @modela and @modelb, returning how they
-# compare in a specific configuration.  The results indicates how
-# both models compare regarding runnability.  This result can be
-# used by tooling to make decisions if a certain CPU model will
-# run in a certain configuration or if a compatible CPU model has
-# to be created by baselining.
-#
-# Usually, a CPU model is compared against the maximum possible CPU
-# model of a certain configuration (e.g. the "host" model for KVM).
-# If that CPU model is identical or a subset, it will run in that
-# configuration.
-#
-# The result returned by this command may be affected by:
-#
-# * QEMU version: CPU models may look different depending on the QEMU
-#   version.  (Except for CPU models reported as "static" in
-#   query-cpu-definitions.)
-# * machine-type: CPU model may look different depending on the
-#   machine-type.  (Except for CPU models reported as "static" in
-#   query-cpu-definitions.)
-# * machine options (including accelerator): in some architectures,
-#   CPU models may look different depending on machine and accelerator
-#   options.  (Except for CPU models reported as "static" in
-#   query-cpu-definitions.)
-# * "-cpu" arguments and global properties: arguments to the -cpu
-#   option and global properties may affect expansion of CPU models.
-#   Using query-cpu-model-expansion while using these is not advised.
-#
-# Some architectures may not support comparing CPU models.  s390x
-# supports comparing CPU models.
-#
-# @modela: description of the first CPU model to compare, referred to
-#     as "model A" in CpuModelCompareResult
-#
-# @modelb: description of the second CPU model to compare, referred to
-#     as "model B" in CpuModelCompareResult
-#
-# Returns: a CpuModelCompareInfo describing how both CPU models
-#     compare
-#
-# Errors:
-#     - if comparing CPU models is not supported
-#     - if a model cannot be used
-#     - if a model contains an unknown cpu definition name, unknown
-#       properties or properties with wrong types.
-#
-# .. note:: This command isn't specific to s390x, but is only
-#    implemented on this architecture currently.
-#
-# Since: 2.8
-##
-{ 'command': 'query-cpu-model-comparison',
-  'data': { 'modela': 'CpuModelInfo', 'modelb': 'CpuModelInfo' },
-  'returns': 'CpuModelCompareInfo',
-  'if': 'TARGET_S390X' }
-
-##
-# @query-cpu-model-baseline:
-#
-# Baseline two CPU models, @modela and @modelb, creating a compatible
-# third model.  The created model will always be a static,
-# migration-safe CPU model (see "static" CPU model expansion for
-# details).
-#
-# This interface can be used by tooling to create a compatible CPU
-# model out two CPU models.  The created CPU model will be identical
-# to or a subset of both CPU models when comparing them.  Therefore,
-# the created CPU model is guaranteed to run where the given CPU
-# models run.
-#
-# The result returned by this command may be affected by:
-#
-# * QEMU version: CPU models may look different depending on the QEMU
-#   version.  (Except for CPU models reported as "static" in
-#   query-cpu-definitions.)
-# * machine-type: CPU model may look different depending on the
-#   machine-type.  (Except for CPU models reported as "static" in
-#   query-cpu-definitions.)
-# * machine options (including accelerator): in some architectures,
-#   CPU models may look different depending on machine and accelerator
-#   options.  (Except for CPU models reported as "static" in
-#   query-cpu-definitions.)
-# * "-cpu" arguments and global properties: arguments to the -cpu
-#   option and global properties may affect expansion of CPU models.
-#   Using query-cpu-model-expansion while using these is not advised.
-#
-# Some architectures may not support baselining CPU models.  s390x
-# supports baselining CPU models.
-#
-# @modela: description of the first CPU model to baseline
-#
-# @modelb: description of the second CPU model to baseline
-#
-# Returns: a CpuModelBaselineInfo describing the baselined CPU model
-#
-# Errors:
-#     - if baselining CPU models is not supported
-#     - if a model cannot be used
-#     - if a model contains an unknown cpu definition name, unknown
-#       properties or properties with wrong types.
-#
-# .. note:: This command isn't specific to s390x, but is only
-#    implemented on this architecture currently.
-#
-# Since: 2.8
-##
-{ 'command': 'query-cpu-model-baseline',
-  'data': { 'modela': 'CpuModelInfo',
-            'modelb': 'CpuModelInfo' },
-  'returns': 'CpuModelBaselineInfo',
-  'if': 'TARGET_S390X' }
-
-##
-# @CpuModelExpansionInfo:
-#
-# The result of a cpu model expansion.
-#
-# @model: the expanded CpuModelInfo.
-#
-# @deprecated-props: an optional list of properties that are flagged as
-#     deprecated by the CPU vendor.  The list depends on the
-#     CpuModelExpansionType: "static" properties are a subset of the
-#     enabled-properties for the expanded model; "full" properties are
-#     a set of properties that are deprecated across all models for
-#     the architecture.  (since: 10.1 -- since 9.1 on s390x --).
-#
-# Since: 2.8
-##
-{ 'struct': 'CpuModelExpansionInfo',
-  'data': { 'model': 'CpuModelInfo',
-            '*deprecated-props' : ['str'] },
-  'if': { 'any': [ 'TARGET_S390X',
-                   'TARGET_I386',
-                   'TARGET_ARM',
-                   'TARGET_LOONGARCH64',
-                   'TARGET_RISCV' ] } }
-
-##
-# @query-cpu-model-expansion:
-#
-# Expands a given CPU model, @model, (or a combination of CPU model +
-# additional options) to different granularities, specified by @type,
-# allowing tooling to get an understanding what a specific CPU model
-# looks like in QEMU under a certain configuration.
-#
-# This interface can be used to query the "host" CPU model.
-#
-# The data returned by this command may be affected by:
-#
-# * QEMU version: CPU models may look different depending on the QEMU
-#   version.  (Except for CPU models reported as "static" in
-#   query-cpu-definitions.)
-# * machine-type: CPU model may look different depending on the
-#   machine-type.  (Except for CPU models reported as "static" in
-#   query-cpu-definitions.)
-# * machine options (including accelerator): in some architectures,
-#   CPU models may look different depending on machine and accelerator
-#   options.  (Except for CPU models reported as "static" in
-#   query-cpu-definitions.)
-# * "-cpu" arguments and global properties: arguments to the -cpu
-#   option and global properties may affect expansion of CPU models.
-#   Using query-cpu-model-expansion while using these is not advised.
-#
-# Some architectures may not support all expansion types.  s390x
-# supports "full" and "static".  Arm only supports "full".
-#
-# @model: description of the CPU model to expand
-#
-# @type: expansion type, specifying how to expand the CPU model
-#
-# Returns: a CpuModelExpansionInfo describing the expanded CPU model
-#
-# Errors:
-#     - if expanding CPU models is not supported
-#     - if the model cannot be expanded
-#     - if the model contains an unknown CPU definition name, unknown
-#       properties or properties with a wrong type
-#     - if an expansion type is not supported
-#
-# Since: 2.8
-##
-{ 'command': 'query-cpu-model-expansion',
-  'data': { 'type': 'CpuModelExpansionType',
-            'model': 'CpuModelInfo' },
-  'returns': 'CpuModelExpansionInfo',
-  'if': { 'any': [ 'TARGET_S390X',
-                   'TARGET_I386',
-                   'TARGET_ARM',
-                   'TARGET_LOONGARCH64',
-                   'TARGET_RISCV' ] } }
-
-##
-# @CpuDefinitionInfo:
-#
-# Virtual CPU definition.
-#
-# @name: the name of the CPU definition
-#
-# @migration-safe: whether a CPU definition can be safely used for
-#     migration in combination with a QEMU compatibility machine when
-#     migrating between different QEMU versions and between hosts with
-#     different sets of (hardware or software) capabilities.  If not
-#     provided, information is not available and callers should not
-#     assume the CPU definition to be migration-safe.  (since 2.8)
-#
-# @static: whether a CPU definition is static and will not change
-#     depending on QEMU version, machine type, machine options and
-#     accelerator options.  A static model is always migration-safe.
-#     (since 2.8)
-#
-# @unavailable-features: List of properties that prevent the CPU model
-#     from running in the current host.  (since 2.8)
-#
-# @typename: Type name that can be used as argument to
-#     @device-list-properties, to introspect properties configurable
-#     using -cpu or -global.  (since 2.9)
-#
-# @alias-of: Name of CPU model this model is an alias for.  The target
-#     of the CPU model alias may change depending on the machine type.
-#     Management software is supposed to translate CPU model aliases
-#     in the VM configuration, because aliases may stop being
-#     migration-safe in the future (since 4.1)
-#
-# @deprecated: If true, this CPU model is deprecated and may be
-#     removed in some future version of QEMU according to the QEMU
-#     deprecation policy.  (since 5.2)
-#
-# @unavailable-features is a list of QOM property names that represent
-# CPU model attributes that prevent the CPU from running.  If the QOM
-# property is read-only, that means there's no known way to make the
-# CPU model run in the current host.  Implementations that choose not
-# to provide specific information return the property name "type".  If
-# the property is read-write, it means that it MAY be possible to run
-# the CPU model in the current host if that property is changed.
-# Management software can use it as hints to suggest or choose an
-# alternative for the user, or just to generate meaningful error
-# messages explaining why the CPU model can't be used.  If
-# @unavailable-features is an empty list, the CPU model is runnable
-# using the current host and machine-type.  If @unavailable-features
-# is not present, runnability information for the CPU is not
-# available.
-#
-# Since: 1.2
-##
-{ 'struct': 'CpuDefinitionInfo',
-  'data': { 'name': 'str',
-            '*migration-safe': 'bool',
-            'static': 'bool',
-            '*unavailable-features': [ 'str' ],
-            'typename': 'str',
-            '*alias-of' : 'str',
-            'deprecated' : 'bool' },
-  'if': { 'any': [ 'TARGET_PPC',
-                   'TARGET_ARM',
-                   'TARGET_I386',
-                   'TARGET_S390X',
-                   'TARGET_MIPS',
-                   'TARGET_LOONGARCH64',
-                   'TARGET_RISCV' ] } }
-
-##
-# @query-cpu-definitions:
-#
-# Return a list of supported virtual CPU definitions
-#
-# Returns: a list of CpuDefinitionInfo
-#
-# Since: 1.2
-##
-{ 'command': 'query-cpu-definitions', 'returns': ['CpuDefinitionInfo'],
-  'if': { 'any': [ 'TARGET_PPC',
-                   'TARGET_ARM',
-                   'TARGET_I386',
-                   'TARGET_S390X',
-                   'TARGET_MIPS',
-                   'TARGET_LOONGARCH64',
-                   'TARGET_RISCV' ] } }
-
 ##
 # @S390CpuPolarization:
 #
diff --git a/qapi/machine.json b/qapi/machine.json
index c8feb9fe17..e6b4b2dfef 100644
--- a/qapi/machine.json
+++ b/qapi/machine.json
@@ -1916,3 +1916,366 @@
 ##
 { 'command': 'dump-skeys',
   'data': { 'filename': 'str' } }
+
+##
+# @CpuModelInfo:
+#
+# Virtual CPU model.
+#
+# A CPU model consists of the name of a CPU definition, to which delta
+# changes are applied (e.g. features added/removed).  Most magic
+# values that an architecture might require should be hidden behind
+# the name.  However, if required, architectures can expose relevant
+# properties.
+#
+# @name: the name of the CPU definition the model is based on
+#
+# @props: a dictionary of QOM properties to be applied
+#
+# Since: 2.8
+##
+{ 'struct': 'CpuModelInfo',
+  'data': { 'name': 'str',
+            '*props': 'any' } }
+
+##
+# @CpuModelExpansionType:
+#
+# An enumeration of CPU model expansion types.
+#
+# @static: Expand to a static CPU model, a combination of a static
+#     base model name and property delta changes.  As the static base
+#     model will never change, the expanded CPU model will be the
+#     same, independent of QEMU version, machine type, machine
+#     options, and accelerator options.  Therefore, the resulting
+#     model can be used by tooling without having to specify a
+#     compatibility machine - e.g. when displaying the "host" model.
+#     The @static CPU models are migration-safe.
+#
+# @full: Expand all properties.  The produced model is not guaranteed
+#     to be migration-safe, but allows tooling to get an insight and
+#     work with model details.
+#
+# .. note:: When a non-migration-safe CPU model is expanded in static
+#    mode, some features enabled by the CPU model may be omitted,
+#    because they can't be implemented by a static CPU model
+#    definition (e.g. cache info passthrough and PMU passthrough in
+#    x86).  If you need an accurate representation of the features
+#    enabled by a non-migration-safe CPU model, use @full.  If you
+#    need a static representation that will keep ABI compatibility
+#    even when changing QEMU version or machine-type, use @static (but
+#    keep in mind that some features may be omitted).
+#
+# Since: 2.8
+##
+{ 'enum': 'CpuModelExpansionType',
+  'data': [ 'static', 'full' ] }
+
+##
+# @CpuModelCompareResult:
+#
+# An enumeration of CPU model comparison results.  The result is
+# usually calculated using e.g. CPU features or CPU generations.
+#
+# @incompatible: If model A is incompatible to model B, model A is not
+#     guaranteed to run where model B runs and the other way around.
+#
+# @identical: If model A is identical to model B, model A is
+#     guaranteed to run where model B runs and the other way around.
+#
+# @superset: If model A is a superset of model B, model B is
+#     guaranteed to run where model A runs.  There are no guarantees
+#     about the other way.
+#
+# @subset: If model A is a subset of model B, model A is guaranteed to
+#     run where model B runs.  There are no guarantees about the other
+#     way.
+#
+# Since: 2.8
+##
+{ 'enum': 'CpuModelCompareResult',
+  'data': [ 'incompatible', 'identical', 'superset', 'subset' ] }
+
+##
+# @CpuModelBaselineInfo:
+#
+# The result of a CPU model baseline.
+#
+# @model: the baselined CpuModelInfo.
+#
+# Since: 2.8
+##
+{ 'struct': 'CpuModelBaselineInfo',
+  'data': { 'model': 'CpuModelInfo' } }
+
+##
+# @CpuModelCompareInfo:
+#
+# The result of a CPU model comparison.
+#
+# @result: The result of the compare operation.
+#
+# @responsible-properties: List of properties that led to the
+#     comparison result not being identical.
+#
+# @responsible-properties is a list of QOM property names that led to
+# both CPUs not being detected as identical.  For identical models,
+# this list is empty.  If a QOM property is read-only, that means
+# there's no known way to make the CPU models identical.  If the
+# special property name "type" is included, the models are by
+# definition not identical and cannot be made identical.
+#
+# Since: 2.8
+##
+{ 'struct': 'CpuModelCompareInfo',
+  'data': { 'result': 'CpuModelCompareResult',
+            'responsible-properties': ['str'] } }
+
+##
+# @query-cpu-model-comparison:
+#
+# Compares two CPU models, @modela and @modelb, returning how they
+# compare in a specific configuration.  The results indicates how
+# both models compare regarding runnability.  This result can be
+# used by tooling to make decisions if a certain CPU model will
+# run in a certain configuration or if a compatible CPU model has
+# to be created by baselining.
+#
+# Usually, a CPU model is compared against the maximum possible CPU
+# model of a certain configuration (e.g. the "host" model for KVM).
+# If that CPU model is identical or a subset, it will run in that
+# configuration.
+#
+# The result returned by this command may be affected by:
+#
+# * QEMU version: CPU models may look different depending on the QEMU
+#   version.  (Except for CPU models reported as "static" in
+#   query-cpu-definitions.)
+# * machine-type: CPU model may look different depending on the
+#   machine-type.  (Except for CPU models reported as "static" in
+#   query-cpu-definitions.)
+# * machine options (including accelerator): in some architectures,
+#   CPU models may look different depending on machine and accelerator
+#   options.  (Except for CPU models reported as "static" in
+#   query-cpu-definitions.)
+# * "-cpu" arguments and global properties: arguments to the -cpu
+#   option and global properties may affect expansion of CPU models.
+#   Using query-cpu-model-expansion while using these is not advised.
+#
+# Some architectures may not support comparing CPU models.  s390x
+# supports comparing CPU models.
+#
+# @modela: description of the first CPU model to compare, referred to
+#     as "model A" in CpuModelCompareResult
+#
+# @modelb: description of the second CPU model to compare, referred to
+#     as "model B" in CpuModelCompareResult
+#
+# Returns: a CpuModelCompareInfo describing how both CPU models
+#     compare
+#
+# Errors:
+#     - if comparing CPU models is not supported by the target
+#     - if a model cannot be used
+#     - if a model contains an unknown cpu definition name, unknown
+#       properties or properties with wrong types.
+#
+# Since: 2.8
+##
+{ 'command': 'query-cpu-model-comparison',
+  'data': { 'modela': 'CpuModelInfo', 'modelb': 'CpuModelInfo' },
+  'returns': 'CpuModelCompareInfo' }
+
+##
+# @query-cpu-model-baseline:
+#
+# Baseline two CPU models, @modela and @modelb, creating a compatible
+# third model.  The created model will always be a static,
+# migration-safe CPU model (see "static" CPU model expansion for
+# details).
+#
+# This interface can be used by tooling to create a compatible CPU
+# model out two CPU models.  The created CPU model will be identical
+# to or a subset of both CPU models when comparing them.  Therefore,
+# the created CPU model is guaranteed to run where the given CPU
+# models run.
+#
+# The result returned by this command may be affected by:
+#
+# * QEMU version: CPU models may look different depending on the QEMU
+#   version.  (Except for CPU models reported as "static" in
+#   query-cpu-definitions.)
+# * machine-type: CPU model may look different depending on the
+#   machine-type.  (Except for CPU models reported as "static" in
+#   query-cpu-definitions.)
+# * machine options (including accelerator): in some architectures,
+#   CPU models may look different depending on machine and accelerator
+#   options.  (Except for CPU models reported as "static" in
+#   query-cpu-definitions.)
+# * "-cpu" arguments and global properties: arguments to the -cpu
+#   option and global properties may affect expansion of CPU models.
+#   Using query-cpu-model-expansion while using these is not advised.
+#
+# Some architectures may not support baselining CPU models.  s390x
+# supports baselining CPU models.
+#
+# @modela: description of the first CPU model to baseline
+#
+# @modelb: description of the second CPU model to baseline
+#
+# Returns: a CpuModelBaselineInfo describing the baselined CPU model
+#
+# Errors:
+#     - if baselining CPU models is not supported by the target
+#     - if a model cannot be used
+#     - if a model contains an unknown cpu definition name, unknown
+#       properties or properties with wrong types.
+#
+# Since: 2.8
+##
+{ 'command': 'query-cpu-model-baseline',
+  'data': { 'modela': 'CpuModelInfo',
+            'modelb': 'CpuModelInfo' },
+  'returns': 'CpuModelBaselineInfo' }
+
+##
+# @CpuModelExpansionInfo:
+#
+# The result of a cpu model expansion.
+#
+# @model: the expanded CpuModelInfo.
+#
+# @deprecated-props: an optional list of properties that are flagged as
+#     deprecated by the CPU vendor.  The list depends on the
+#     CpuModelExpansionType: "static" properties are a subset of the
+#     enabled-properties for the expanded model; "full" properties are
+#     a set of properties that are deprecated across all models for
+#     the architecture.  (since: 10.1 -- since 9.1 on s390x --).
+#
+# Since: 2.8
+##
+{ 'struct': 'CpuModelExpansionInfo',
+  'data': { 'model': 'CpuModelInfo',
+            '*deprecated-props' : ['str'] } }
+
+##
+# @query-cpu-model-expansion:
+#
+# Expands a given CPU model, @model, (or a combination of CPU model +
+# additional options) to different granularities, specified by @type,
+# allowing tooling to get an understanding what a specific CPU model
+# looks like in QEMU under a certain configuration.
+#
+# This interface can be used to query the "host" CPU model.
+#
+# The data returned by this command may be affected by:
+#
+# * QEMU version: CPU models may look different depending on the QEMU
+#   version.  (Except for CPU models reported as "static" in
+#   query-cpu-definitions.)
+# * machine-type: CPU model may look different depending on the
+#   machine-type.  (Except for CPU models reported as "static" in
+#   query-cpu-definitions.)
+# * machine options (including accelerator): in some architectures,
+#   CPU models may look different depending on machine and accelerator
+#   options.  (Except for CPU models reported as "static" in
+#   query-cpu-definitions.)
+# * "-cpu" arguments and global properties: arguments to the -cpu
+#   option and global properties may affect expansion of CPU models.
+#   Using query-cpu-model-expansion while using these is not advised.
+#
+# Some architectures may not support all expansion types.  s390x
+# supports "full" and "static".  Arm only supports "full".
+#
+# @model: description of the CPU model to expand
+#
+# @type: expansion type, specifying how to expand the CPU model
+#
+# Returns: a CpuModelExpansionInfo describing the expanded CPU model
+#
+# Errors:
+#     - if expanding CPU models is not supported
+#     - if the model cannot be expanded
+#     - if the model contains an unknown CPU definition name, unknown
+#       properties or properties with a wrong type
+#     - if an expansion type is not supported
+#
+# Since: 2.8
+##
+{ 'command': 'query-cpu-model-expansion',
+  'data': { 'type': 'CpuModelExpansionType',
+            'model': 'CpuModelInfo' },
+  'returns': 'CpuModelExpansionInfo' }
+
+##
+# @CpuDefinitionInfo:
+#
+# Virtual CPU definition.
+#
+# @name: the name of the CPU definition
+#
+# @migration-safe: whether a CPU definition can be safely used for
+#     migration in combination with a QEMU compatibility machine when
+#     migrating between different QEMU versions and between hosts with
+#     different sets of (hardware or software) capabilities.  If not
+#     provided, information is not available and callers should not
+#     assume the CPU definition to be migration-safe.  (since 2.8)
+#
+# @static: whether a CPU definition is static and will not change
+#     depending on QEMU version, machine type, machine options and
+#     accelerator options.  A static model is always migration-safe.
+#     (since 2.8)
+#
+# @unavailable-features: List of properties that prevent the CPU model
+#     from running in the current host.  (since 2.8)
+#
+# @typename: Type name that can be used as argument to
+#     @device-list-properties, to introspect properties configurable
+#     using -cpu or -global.  (since 2.9)
+#
+# @alias-of: Name of CPU model this model is an alias for.  The target
+#     of the CPU model alias may change depending on the machine type.
+#     Management software is supposed to translate CPU model aliases
+#     in the VM configuration, because aliases may stop being
+#     migration-safe in the future (since 4.1)
+#
+# @deprecated: If true, this CPU model is deprecated and may be
+#     removed in some future version of QEMU according to the QEMU
+#     deprecation policy.  (since 5.2)
+#
+# @unavailable-features is a list of QOM property names that represent
+# CPU model attributes that prevent the CPU from running.  If the QOM
+# property is read-only, that means there's no known way to make the
+# CPU model run in the current host.  Implementations that choose not
+# to provide specific information return the property name "type".  If
+# the property is read-write, it means that it MAY be possible to run
+# the CPU model in the current host if that property is changed.
+# Management software can use it as hints to suggest or choose an
+# alternative for the user, or just to generate meaningful error
+# messages explaining why the CPU model can't be used.  If
+# @unavailable-features is an empty list, the CPU model is runnable
+# using the current host and machine-type.  If @unavailable-features
+# is not present, runnability information for the CPU is not
+# available.
+#
+# Since: 1.2
+##
+{ 'struct': 'CpuDefinitionInfo',
+  'data': { 'name': 'str',
+            '*migration-safe': 'bool',
+            'static': 'bool',
+            '*unavailable-features': [ 'str' ],
+            'typename': 'str',
+            '*alias-of' : 'str',
+            'deprecated' : 'bool' } }
+
+##
+# @query-cpu-definitions:
+#
+# Return a list of supported virtual CPU definitions
+#
+# Returns: a list of CpuDefinitionInfo
+#
+# Since: 1.2
+##
+{ 'command': 'query-cpu-definitions', 'returns': ['CpuDefinitionInfo'] }
diff --git a/stubs/meson.build b/stubs/meson.build
index 0ef11976a2..3b2fad0824 100644
--- a/stubs/meson.build
+++ b/stubs/meson.build
@@ -82,6 +82,8 @@ if have_system
   stub_ss.add(files('monitor-i386-sev.c'))
   stub_ss.add(files('monitor-i386-sgx.c'))
   stub_ss.add(files('monitor-i386-xen.c'))
+  stub_ss.add(files('monitor-cpu.c'))
+  stub_ss.add(files('monitor-cpu-s390x.c'))
 endif
 
 if have_system or have_user
diff --git a/stubs/monitor-cpu-s390x.c b/stubs/monitor-cpu-s390x.c
new file mode 100644
index 0000000000..71e794482b
--- /dev/null
+++ b/stubs/monitor-cpu-s390x.c
@@ -0,0 +1,23 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "qapi/qapi-commands-machine.h"
+
+CpuModelCompareInfo *
+qmp_query_cpu_model_comparison(CpuModelInfo *infoa,
+                               CpuModelInfo *infob,
+                               Error **errp)
+{
+    error_setg(errp, "CPU model comparison is not supported on this target");
+    return NULL;
+}
+
+CpuModelBaselineInfo *
+qmp_query_cpu_model_baseline(CpuModelInfo *infoa,
+                             CpuModelInfo *infob,
+                             Error **errp)
+{
+    error_setg(errp, "CPU model baseline is not supported on this target");
+    return NULL;
+}
diff --git a/stubs/monitor-cpu.c b/stubs/monitor-cpu.c
new file mode 100644
index 0000000000..a8c7ee89b9
--- /dev/null
+++ b/stubs/monitor-cpu.c
@@ -0,0 +1,21 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "qapi/qapi-commands-machine.h"
+
+CpuModelExpansionInfo *
+qmp_query_cpu_model_expansion(CpuModelExpansionType type,
+                              CpuModelInfo *model,
+                              Error **errp)
+{
+    error_setg(errp, "CPU model expansion is not supported on this target");
+    return NULL;
+}
+
+CpuDefinitionInfoList *
+qmp_query_cpu_definitions(Error **errp)
+{
+    error_setg(errp, "CPU model definitions are not supported on this target");
+    return NULL;
+}
diff --git a/target/arm/arm-qmp-cmds.c b/target/arm/arm-qmp-cmds.c
index ef18c867ca..cca6b9722b 100644
--- a/target/arm/arm-qmp-cmds.c
+++ b/target/arm/arm-qmp-cmds.c
@@ -26,7 +26,7 @@
 #include "qapi/error.h"
 #include "qapi/visitor.h"
 #include "qapi/qobject-input-visitor.h"
-#include "qapi/qapi-commands-machine-target.h"
+#include "qapi/qapi-commands-machine.h"
 #include "qapi/qapi-commands-misc-arm.h"
 #include "qobject/qdict.h"
 #include "qom/qom-qobject.h"
diff --git a/target/i386/cpu-system.c b/target/i386/cpu-system.c
index 55f192e819..b1494aa674 100644
--- a/target/i386/cpu-system.c
+++ b/target/i386/cpu-system.c
@@ -24,7 +24,7 @@
 #include "qobject/qdict.h"
 #include "qapi/qobject-input-visitor.h"
 #include "qom/qom-qobject.h"
-#include "qapi/qapi-commands-machine-target.h"
+#include "qapi/qapi-commands-machine.h"
 
 #include "cpu-internal.h"
 
diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 9689f6374e..33afc3ec60 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -38,7 +38,7 @@
 #include "exec/watchpoint.h"
 #ifndef CONFIG_USER_ONLY
 #include "system/reset.h"
-#include "qapi/qapi-commands-machine-target.h"
+#include "qapi/qapi-commands-machine.h"
 #include "system/address-spaces.h"
 #include "hw/boards.h"
 #include "hw/i386/sgx-epc.h"
diff --git a/target/loongarch/loongarch-qmp-cmds.c b/target/loongarch/loongarch-qmp-cmds.c
index 6f732d80f3..f5f1cd0009 100644
--- a/target/loongarch/loongarch-qmp-cmds.c
+++ b/target/loongarch/loongarch-qmp-cmds.c
@@ -8,7 +8,7 @@
 
 #include "qemu/osdep.h"
 #include "qapi/error.h"
-#include "qapi/qapi-commands-machine-target.h"
+#include "qapi/qapi-commands-machine.h"
 #include "cpu.h"
 #include "qobject/qdict.h"
 #include "qapi/qobject-input-visitor.h"
diff --git a/target/mips/system/mips-qmp-cmds.c b/target/mips/system/mips-qmp-cmds.c
index 7340ac70ba..d98d6623f2 100644
--- a/target/mips/system/mips-qmp-cmds.c
+++ b/target/mips/system/mips-qmp-cmds.c
@@ -7,9 +7,19 @@
  */
 
 #include "qemu/osdep.h"
-#include "qapi/qapi-commands-machine-target.h"
+#include "qapi/error.h"
+#include "qapi/qapi-commands-machine.h"
 #include "cpu.h"
 
+CpuModelExpansionInfo *
+qmp_query_cpu_model_expansion(CpuModelExpansionType type,
+                              CpuModelInfo *model,
+                              Error **errp)
+{
+    error_setg(errp, "CPU model expansion is not supported on this target");
+    return NULL;
+}
+
 static void mips_cpu_add_definition(gpointer data, gpointer user_data)
 {
     ObjectClass *oc = data;
diff --git a/target/ppc/ppc-qmp-cmds.c b/target/ppc/ppc-qmp-cmds.c
index a25d86a8d1..7022564604 100644
--- a/target/ppc/ppc-qmp-cmds.c
+++ b/target/ppc/ppc-qmp-cmds.c
@@ -28,7 +28,8 @@
 #include "qemu/ctype.h"
 #include "monitor/hmp-target.h"
 #include "monitor/hmp.h"
-#include "qapi/qapi-commands-machine-target.h"
+#include "qapi/error.h"
+#include "qapi/qapi-commands-machine.h"
 #include "cpu-models.h"
 #include "cpu-qom.h"
 
@@ -175,6 +176,15 @@ int target_get_monitor_def(CPUState *cs, const char *name, uint64_t *pval)
     return -EINVAL;
 }
 
+CpuModelExpansionInfo *
+qmp_query_cpu_model_expansion(CpuModelExpansionType type,
+                              CpuModelInfo *model,
+                              Error **errp)
+{
+    error_setg(errp, "CPU model expansion is not supported on this target");
+    return NULL;
+}
+
 static void ppc_cpu_defs_entry(gpointer data, gpointer user_data)
 {
     ObjectClass *oc = data;
diff --git a/target/riscv/riscv-qmp-cmds.c b/target/riscv/riscv-qmp-cmds.c
index d0a324364d..8ba8aa0d5f 100644
--- a/target/riscv/riscv-qmp-cmds.c
+++ b/target/riscv/riscv-qmp-cmds.c
@@ -25,7 +25,7 @@
 #include "qemu/osdep.h"
 
 #include "qapi/error.h"
-#include "qapi/qapi-commands-machine-target.h"
+#include "qapi/qapi-commands-machine.h"
 #include "qobject/qbool.h"
 #include "qobject/qdict.h"
 #include "qapi/qobject-input-visitor.h"
diff --git a/target/s390x/cpu_models_system.c b/target/s390x/cpu_models_system.c
index 4351182f72..9d84faa3c9 100644
--- a/target/s390x/cpu_models_system.c
+++ b/target/s390x/cpu_models_system.c
@@ -19,7 +19,7 @@
 #include "qapi/visitor.h"
 #include "qapi/qobject-input-visitor.h"
 #include "qobject/qdict.h"
-#include "qapi/qapi-commands-machine-target.h"
+#include "qapi/qapi-commands-machine.h"
 
 static void list_add_feat(const char *name, void *opaque);
 

From f8d41d0511114edcde8c589ffc76887b3a2dc39b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Thu, 22 May 2025 12:05:37 -0700
Subject: [PATCH 1214/2760] qapi: make s390x specific CPU commands
 unconditionally available
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This removes the TARGET_S390X and CONFIG_KVM conditions from the
CPU commands that are conceptually specific to s390x. Top level
stubs are provided to cope with non-s390x targets, or builds
without KVM.

The removal of CONFIG_KVM is justified by the fact there is no
conceptual difference between running 'qemu-system-s390x -accel tcg'
on a build with and without KVM built-in, so apps only using TCG
can't rely on the CONFIG_KVM in the schema.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20250522190542.588267-11-pierrick.bouvier@linaro.org>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
---
 hw/s390x/cpu-topology.c                       |  4 ++--
 include/hw/s390x/cpu-topology.h               |  2 +-
 ...machine-target.json => machine-s390x.json} | 16 +++++---------
 qapi/meson.build                              |  2 +-
 qapi/qapi-schema.json                         |  2 +-
 stubs/meson.build                             |  1 +
 stubs/monitor-cpu-s390x-kvm.c                 | 22 +++++++++++++++++++
 tests/qtest/qmp-cmd-test.c                    |  1 +
 8 files changed, 35 insertions(+), 15 deletions(-)
 rename qapi/{machine-target.json => machine-s390x.json} (85%)
 create mode 100644 stubs/monitor-cpu-s390x-kvm.c

diff --git a/hw/s390x/cpu-topology.c b/hw/s390x/cpu-topology.c
index 7d4e1f5472..b513f8936e 100644
--- a/hw/s390x/cpu-topology.c
+++ b/hw/s390x/cpu-topology.c
@@ -23,8 +23,8 @@
 #include "target/s390x/cpu.h"
 #include "hw/s390x/s390-virtio-ccw.h"
 #include "hw/s390x/cpu-topology.h"
-#include "qapi/qapi-commands-machine-target.h"
-#include "qapi/qapi-events-machine-target.h"
+#include "qapi/qapi-commands-machine-s390x.h"
+#include "qapi/qapi-events-machine-s390x.h"
 
 /*
  * s390_topology is used to keep the topology information.
diff --git a/include/hw/s390x/cpu-topology.h b/include/hw/s390x/cpu-topology.h
index 9283c948e3..d5e9aa43f8 100644
--- a/include/hw/s390x/cpu-topology.h
+++ b/include/hw/s390x/cpu-topology.h
@@ -13,7 +13,7 @@
 
 #include "qemu/queue.h"
 #include "hw/boards.h"
-#include "qapi/qapi-types-machine-target.h"
+#include "qapi/qapi-types-machine-s390x.h"
 
 #define S390_TOPOLOGY_CPU_IFL   0x03
 
diff --git a/qapi/machine-target.json b/qapi/machine-s390x.json
similarity index 85%
rename from qapi/machine-target.json
rename to qapi/machine-s390x.json
index f19e34adaf..966dbd61d2 100644
--- a/qapi/machine-target.json
+++ b/qapi/machine-s390x.json
@@ -1,6 +1,7 @@
 # -*- Mode: Python -*-
 # vim: filetype=python
 #
+# SPDX-License-Identifier: GPL-2.0-or-later
 # This work is licensed under the terms of the GNU GPL, version 2 or later.
 # See the COPYING file in the top-level directory.
 
@@ -15,8 +16,7 @@
 # Since: 8.2
 ##
 { 'enum': 'S390CpuPolarization',
-  'data': [ 'horizontal', 'vertical' ],
-  'if': 'TARGET_S390X'
+  'data': [ 'horizontal', 'vertical' ]
 }
 
 ##
@@ -54,8 +54,7 @@
       '*entitlement': 'S390CpuEntitlement',
       '*dedicated': 'bool'
   },
-  'features': [ 'unstable' ],
-  'if': { 'all': [ 'TARGET_S390X' , 'CONFIG_KVM' ] }
+  'features': [ 'unstable' ]
 }
 
 ##
@@ -90,8 +89,7 @@
 ##
 { 'event': 'CPU_POLARIZATION_CHANGE',
   'data': { 'polarization': 'S390CpuPolarization' },
-  'features': [ 'unstable' ],
-  'if': { 'all': [ 'TARGET_S390X', 'CONFIG_KVM' ] }
+  'features': [ 'unstable' ]
 }
 
 ##
@@ -104,8 +102,7 @@
 # Since: 8.2
 ##
 { 'struct': 'CpuPolarizationInfo',
-  'data': { 'polarization': 'S390CpuPolarization' },
-  'if': { 'all': [ 'TARGET_S390X', 'CONFIG_KVM' ] }
+  'data': { 'polarization': 'S390CpuPolarization' }
 }
 
 ##
@@ -120,6 +117,5 @@
 # Since: 8.2
 ##
 { 'command': 'query-s390x-cpu-polarization', 'returns': 'CpuPolarizationInfo',
-  'features': [ 'unstable' ],
-  'if': { 'all': [ 'TARGET_S390X', 'CONFIG_KVM' ] }
+  'features': [ 'unstable' ]
 }
diff --git a/qapi/meson.build b/qapi/meson.build
index ffe44f9e0b..e038b636c9 100644
--- a/qapi/meson.build
+++ b/qapi/meson.build
@@ -39,7 +39,7 @@ qapi_all_modules = [
   'job',
   'machine-common',
   'machine',
-  'machine-target',
+  'machine-s390x',
   'migration',
   'misc',
   'net',
diff --git a/qapi/qapi-schema.json b/qapi/qapi-schema.json
index d8eb79cfda..a8f66163cb 100644
--- a/qapi/qapi-schema.json
+++ b/qapi/qapi-schema.json
@@ -57,7 +57,7 @@
 { 'include': 'qdev.json' }
 { 'include': 'machine-common.json' }
 { 'include': 'machine.json' }
-{ 'include': 'machine-target.json' }
+{ 'include': 'machine-s390x.json' }
 { 'include': 'replay.json' }
 { 'include': 'yank.json' }
 { 'include': 'misc.json' }
diff --git a/stubs/meson.build b/stubs/meson.build
index 3b2fad0824..cef046e685 100644
--- a/stubs/meson.build
+++ b/stubs/meson.build
@@ -84,6 +84,7 @@ if have_system
   stub_ss.add(files('monitor-i386-xen.c'))
   stub_ss.add(files('monitor-cpu.c'))
   stub_ss.add(files('monitor-cpu-s390x.c'))
+  stub_ss.add(files('monitor-cpu-s390x-kvm.c'))
 endif
 
 if have_system or have_user
diff --git a/stubs/monitor-cpu-s390x-kvm.c b/stubs/monitor-cpu-s390x-kvm.c
new file mode 100644
index 0000000000..8683dd2d4c
--- /dev/null
+++ b/stubs/monitor-cpu-s390x-kvm.c
@@ -0,0 +1,22 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "qapi/qapi-commands-machine-s390x.h"
+
+void qmp_set_cpu_topology(uint16_t core,
+                          bool has_socket, uint16_t socket,
+                          bool has_book, uint16_t book,
+                          bool has_drawer, uint16_t drawer,
+                          bool has_entitlement, S390CpuEntitlement entitlement,
+                          bool has_dedicated, bool dedicated,
+                          Error **errp)
+{
+    error_setg(errp, "CPU topology change is not supported on this target");
+}
+
+CpuPolarizationInfo *qmp_query_s390x_cpu_polarization(Error **errp)
+{
+    error_setg(errp, "CPU polarization is not supported on this target");
+    return NULL;
+}
diff --git a/tests/qtest/qmp-cmd-test.c b/tests/qtest/qmp-cmd-test.c
index 15c88248b7..040d042810 100644
--- a/tests/qtest/qmp-cmd-test.c
+++ b/tests/qtest/qmp-cmd-test.c
@@ -100,6 +100,7 @@ static bool query_is_ignored(const char *cmd)
         /* Success depends on target arch: */
         "query-cpu-definitions",  /* arm, i386, ppc, s390x */
         "query-gic-capabilities", /* arm */
+        "query-s390x-cpu-polarization", /* s390x */
         /* Success depends on target-specific build configuration: */
         "query-pci",              /* CONFIG_PCI */
         "x-query-virtio",         /* CONFIG_VIRTIO */

From d9cbcbff811bafc0e0081a07ce47c9e8f3051e0c Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Thu, 22 May 2025 12:05:38 -0700
Subject: [PATCH 1215/2760] qapi: remove qapi_specific_outputs from meson.build
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

There is no more QAPI files that need to be compiled per target, so we
can remove this. qapi_specific_outputs is now empty, so we can remove
the associated logic in meson.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20250522190542.588267-12-pierrick.bouvier@linaro.org>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
---
 qapi/meson.build | 11 +++--------
 1 file changed, 3 insertions(+), 8 deletions(-)

diff --git a/qapi/meson.build b/qapi/meson.build
index e038b636c9..7582c2b5bc 100644
--- a/qapi/meson.build
+++ b/qapi/meson.build
@@ -92,7 +92,6 @@ qapi_util_outputs = [
 ]
 
 qapi_inputs = []
-qapi_specific_outputs = []
 foreach module : qapi_all_modules
   qapi_inputs += [ files(module + '.json') ]
   qapi_module_outputs = [
@@ -110,15 +109,11 @@ foreach module : qapi_all_modules
       'qapi-commands-@0@.trace-events'.format(module),
     ]
   endif
-  if module.endswith('-target')
-    qapi_specific_outputs += qapi_module_outputs
-  else
-    qapi_util_outputs += qapi_module_outputs
-  endif
+  qapi_util_outputs += qapi_module_outputs
 endforeach
 
 qapi_files = custom_target('shared QAPI source files',
-  output: qapi_util_outputs + qapi_specific_outputs + qapi_nonmodule_outputs,
+  output: qapi_util_outputs + qapi_nonmodule_outputs,
   input: [ files('qapi-schema.json') ],
   command: [ qapi_gen, '-o', 'qapi', '-b', '@INPUT0@' ],
   depend_files: [ qapi_inputs, qapi_gen_depends ])
@@ -138,7 +133,7 @@ foreach output : qapi_util_outputs
   i = i + 1
 endforeach
 
-foreach output : qapi_specific_outputs + qapi_nonmodule_outputs
+foreach output : qapi_nonmodule_outputs
   if output.endswith('.h')
     genh += qapi_files[i]
   endif

From fdbb616f4dd55b4f3efd6cb56bf675046fb6e4f3 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Thu, 22 May 2025 12:05:39 -0700
Subject: [PATCH 1216/2760] qapi: make all generated files common

Monolithic files (qapi_nonmodule_outputs) can now be compiled just
once, so we can remove qapi_util_outputs logic.
This removes the need for any specific_ss file.

Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20250522190542.588267-13-pierrick.bouvier@linaro.org>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
---
 qapi/meson.build | 23 ++++-------------------
 1 file changed, 4 insertions(+), 19 deletions(-)

diff --git a/qapi/meson.build b/qapi/meson.build
index 7582c2b5bc..3b035aea33 100644
--- a/qapi/meson.build
+++ b/qapi/meson.build
@@ -85,8 +85,7 @@ qapi_nonmodule_outputs = [
   'qapi-emit-events.c', 'qapi-emit-events.h',
 ]
 
-# First build all sources
-qapi_util_outputs = [
+qapi_outputs = qapi_nonmodule_outputs + [
   'qapi-builtin-types.c', 'qapi-builtin-visit.c',
   'qapi-builtin-types.h', 'qapi-builtin-visit.h',
 ]
@@ -109,20 +108,17 @@ foreach module : qapi_all_modules
       'qapi-commands-@0@.trace-events'.format(module),
     ]
   endif
-  qapi_util_outputs += qapi_module_outputs
+  qapi_outputs += qapi_module_outputs
 endforeach
 
 qapi_files = custom_target('shared QAPI source files',
-  output: qapi_util_outputs + qapi_nonmodule_outputs,
+  output: qapi_outputs,
   input: [ files('qapi-schema.json') ],
   command: [ qapi_gen, '-o', 'qapi', '-b', '@INPUT0@' ],
   depend_files: [ qapi_inputs, qapi_gen_depends ])
 
-# Now go through all the outputs and add them to the right sourceset.
-# These loops must be synchronized with the output of the above custom target.
-
 i = 0
-foreach output : qapi_util_outputs
+foreach output : qapi_outputs
   if output.endswith('.h')
     genh += qapi_files[i]
   endif
@@ -132,14 +128,3 @@ foreach output : qapi_util_outputs
   util_ss.add(qapi_files[i])
   i = i + 1
 endforeach
-
-foreach output : qapi_nonmodule_outputs
-  if output.endswith('.h')
-    genh += qapi_files[i]
-  endif
-  if output.endswith('.trace-events')
-    qapi_trace_events += qapi_files[i]
-  endif
-  specific_ss.add(when: 'CONFIG_SYSTEM_ONLY', if_true: qapi_files[i])
-  i = i + 1
-endforeach

From e1a80c3241631ee0e7a687a54f71407b6d3828b7 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Thu, 22 May 2025 12:05:40 -0700
Subject: [PATCH 1217/2760] qapi: use imperative style in documentation

As requested by Markus:
> We prefer imperative mood "Return" over "Returns".

Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20250522190542.588267-14-pierrick.bouvier@linaro.org>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
[Change several more]
---
 qapi/audio.json     |  2 +-
 qapi/block.json     |  2 +-
 qapi/char.json      |  4 ++--
 qapi/control.json   |  2 +-
 qapi/cryptodev.json |  2 +-
 qapi/dump.json      |  2 +-
 qapi/machine.json   |  8 ++++----
 qapi/migration.json | 10 +++++-----
 qapi/misc-i386.json |  6 +++---
 qapi/misc.json      |  2 +-
 qapi/ui.json        | 10 +++++-----
 qapi/virtio.json    |  2 +-
 12 files changed, 26 insertions(+), 26 deletions(-)

diff --git a/qapi/audio.json b/qapi/audio.json
index 49633cf317..8de4430578 100644
--- a/qapi/audio.json
+++ b/qapi/audio.json
@@ -533,7 +533,7 @@
 ##
 # @query-audiodevs:
 #
-# Returns information about audiodev configuration
+# Return information about audiodev configuration
 #
 # Returns: array of @Audiodev
 #
diff --git a/qapi/block.json b/qapi/block.json
index e66666f5c6..f5374bd86c 100644
--- a/qapi/block.json
+++ b/qapi/block.json
@@ -83,7 +83,7 @@
 ##
 # @query-pr-managers:
 #
-# Returns a list of information about each persistent reservation
+# Return a list of information about each persistent reservation
 # manager.
 #
 # Returns: a list of @PRManagerInfo for each persistent reservation
diff --git a/qapi/char.json b/qapi/char.json
index dde2f9538f..447c10b91a 100644
--- a/qapi/char.json
+++ b/qapi/char.json
@@ -34,7 +34,7 @@
 ##
 # @query-chardev:
 #
-# Returns information about current character devices.
+# Return information about current character devices.
 #
 # Returns: a list of @ChardevInfo
 #
@@ -80,7 +80,7 @@
 ##
 # @query-chardev-backends:
 #
-# Returns information about character device backends.
+# Return information about character device backends.
 #
 # Returns: a list of @ChardevBackendInfo
 #
diff --git a/qapi/control.json b/qapi/control.json
index 336386f79e..34b733f63b 100644
--- a/qapi/control.json
+++ b/qapi/control.json
@@ -91,7 +91,7 @@
 ##
 # @query-version:
 #
-# Returns the current version of QEMU.
+# Return the current version of QEMU.
 #
 # Returns: A @VersionInfo object describing the current version of
 #     QEMU.
diff --git a/qapi/cryptodev.json b/qapi/cryptodev.json
index 04d0e21d20..28b97eb3da 100644
--- a/qapi/cryptodev.json
+++ b/qapi/cryptodev.json
@@ -94,7 +94,7 @@
 ##
 # @query-cryptodev:
 #
-# Returns information about current crypto devices.
+# Return information about current crypto devices.
 #
 # Returns: a list of @QCryptodevInfo
 #
diff --git a/qapi/dump.json b/qapi/dump.json
index d7826c0e32..f2835c0b47 100644
--- a/qapi/dump.json
+++ b/qapi/dump.json
@@ -195,7 +195,7 @@
 ##
 # @query-dump-guest-memory-capability:
 #
-# Returns the available formats for dump-guest-memory
+# Return the available formats for dump-guest-memory
 #
 # Returns: A @DumpGuestMemoryCapability object listing available
 #     formats for dump-guest-memory
diff --git a/qapi/machine.json b/qapi/machine.json
index e6b4b2dfef..5373e1368c 100644
--- a/qapi/machine.json
+++ b/qapi/machine.json
@@ -99,7 +99,7 @@
 ##
 # @query-cpus-fast:
 #
-# Returns information about all virtual CPUs.
+# Return information about all virtual CPUs.
 #
 # Returns: list of @CpuInfoFast
 #
@@ -467,7 +467,7 @@
 ##
 # @query-kvm:
 #
-# Returns information about KVM acceleration
+# Return information about KVM acceleration
 #
 # Returns: @KvmInfo
 #
@@ -930,7 +930,7 @@
 ##
 # @query-memdev:
 #
-# Returns information for all memory backends.
+# Return information for all memory backends.
 #
 # Returns: a list of @Memdev.
 #
@@ -1235,7 +1235,7 @@
 ##
 # @query-hv-balloon-status-report:
 #
-# Returns the hv-balloon driver data contained in the last received
+# Return the hv-balloon driver data contained in the last received
 # "STATUS" message from the guest.
 #
 # Returns:
diff --git a/qapi/migration.json b/qapi/migration.json
index 8b9c53595c..ce8d1663d8 100644
--- a/qapi/migration.json
+++ b/qapi/migration.json
@@ -282,7 +282,7 @@
 ##
 # @query-migrate:
 #
-# Returns information about current migration process.  If migration
+# Return information about current migration process.  If migration
 # is active there will be another json-object with RAM migration
 # status.
 #
@@ -535,7 +535,7 @@
 ##
 # @query-migrate-capabilities:
 #
-# Returns information about the current migration capabilities status
+# Return information about the current migration capabilities status
 #
 # Returns: @MigrationCapabilityStatus
 #
@@ -1320,7 +1320,7 @@
 ##
 # @query-migrate-parameters:
 #
-# Returns information about the current migration parameters
+# Return information about the current migration parameters
 #
 # Returns: @MigrationParameters
 #
@@ -2294,7 +2294,7 @@
 ##
 # @query-vcpu-dirty-limit:
 #
-# Returns information about virtual CPU dirty page rate limits, if
+# Return information about virtual CPU dirty page rate limits, if
 # any.
 #
 # Since: 7.1
@@ -2327,7 +2327,7 @@
 ##
 # @query-migrationthreads:
 #
-# Returns information of migration threads
+# Return information of migration threads
 #
 # Features:
 #
diff --git a/qapi/misc-i386.json b/qapi/misc-i386.json
index 3f88a5b28e..3b5346425a 100644
--- a/qapi/misc-i386.json
+++ b/qapi/misc-i386.json
@@ -126,7 +126,7 @@
 ##
 # @query-sev:
 #
-# Returns information about SEV/SEV-ES/SEV-SNP.
+# Return information about SEV/SEV-ES/SEV-SNP.
 #
 # If unavailable due to an incompatible configuration the returned
 # @enabled field is set to 'false' and the state of all other fields
@@ -343,7 +343,7 @@
 ##
 # @query-sgx:
 #
-# Returns information about configured SGX capabilities of guest
+# Return information about configured SGX capabilities of guest
 #
 # Returns: @SgxInfo
 #
@@ -362,7 +362,7 @@
 ##
 # @query-sgx-capabilities:
 #
-# Returns information about SGX capabilities of host
+# Return information about SGX capabilities of host
 #
 # Returns: @SgxInfo
 #
diff --git a/qapi/misc.json b/qapi/misc.json
index 559b66f201..dcf9f7df5b 100644
--- a/qapi/misc.json
+++ b/qapi/misc.json
@@ -101,7 +101,7 @@
 ##
 # @query-iothreads:
 #
-# Returns a list of information about each iothread.
+# Return a list of information about each iothread.
 #
 # .. note:: This list excludes the QEMU main loop thread, which is not
 #    declared using the ``-object iothread`` command-line option.  It
diff --git a/qapi/ui.json b/qapi/ui.json
index c536d4e524..3d0c853c9a 100644
--- a/qapi/ui.json
+++ b/qapi/ui.json
@@ -323,7 +323,7 @@
 ##
 # @query-spice:
 #
-# Returns information about the current SPICE server
+# Return information about the current SPICE server
 #
 # Returns: @SpiceInfo
 #
@@ -654,7 +654,7 @@
 ##
 # @query-vnc:
 #
-# Returns information about the current VNC server
+# Return information about the current VNC server
 #
 # Returns: @VncInfo
 #
@@ -685,7 +685,7 @@
 ##
 # @query-vnc-servers:
 #
-# Returns a list of vnc servers.  The list can be empty.
+# Return a list of vnc servers.  The list can be empty.
 #
 # Returns: a list of @VncInfo2
 #
@@ -820,7 +820,7 @@
 ##
 # @query-mice:
 #
-# Returns information about each active mouse device
+# Return information about each active mouse device
 #
 # Returns: a list of @MouseInfo for each device
 #
@@ -1562,7 +1562,7 @@
 ##
 # @query-display-options:
 #
-# Returns information about display configuration
+# Return information about display configuration
 #
 # Returns: @DisplayOptions
 #
diff --git a/qapi/virtio.json b/qapi/virtio.json
index d351d2166e..73df718a26 100644
--- a/qapi/virtio.json
+++ b/qapi/virtio.json
@@ -24,7 +24,7 @@
 ##
 # @x-query-virtio:
 #
-# Returns a list of all realized VirtIODevices
+# Return a list of all realized VirtIODevices
 #
 # Features:
 #

From 5150004ccf5fe72c35b3263fbed6f4d06ed3cc6a Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Wed, 28 May 2025 11:20:13 +0200
Subject: [PATCH 1218/2760] rocker: do not pollute the namespace

Do not leave the __le* macros defined, in fact do not use them at all.  Fixes a
build failure on Alpine with the TDX patches:

In file included from ../hw/net/rocker/rocker_of_dpa.c:25:
../hw/net/rocker/rocker_hw.h:14:16: error: conflicting types for 'uint64_t'; have '__u64' {aka 'long long unsigned int'}
   14 | #define __le64 uint64_t
      |                ^~~~~~~~
In file included from /usr/include/stdint.h:20,
                 from ../include/qemu/osdep.h:111,
                 from ../hw/net/rocker/rocker_of_dpa.c:17:
/usr/include/bits/alltypes.h:136:25: note: previous declaration of 'uint64_t' with type 'uint64_t' {aka 'long unsigned int'}
  136 | typedef unsigned _Int64 uint64_t;
      |                         ^~~~~~~~

because the Linux headers include a typedef of __leNN.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/net/rocker/rocker.h        | 14 +++---------
 hw/net/rocker/rocker_hw.h     | 20 +++++++-----------
 hw/net/rocker/rocker_of_dpa.c | 40 +++++++++++++++++------------------
 3 files changed, 31 insertions(+), 43 deletions(-)

diff --git a/hw/net/rocker/rocker.h b/hw/net/rocker/rocker.h
index 6e0962f47a..ae06c1c72a 100644
--- a/hw/net/rocker/rocker.h
+++ b/hw/net/rocker/rocker.h
@@ -36,15 +36,7 @@ static inline G_GNUC_PRINTF(1, 2) int DPRINTF(const char *fmt, ...)
 }
 #endif
 
-#define __le16 uint16_t
-#define __le32 uint32_t
-#define __le64 uint64_t
-
-#define __be16 uint16_t
-#define __be32 uint32_t
-#define __be64 uint64_t
-
-static inline bool ipv4_addr_is_multicast(__be32 addr)
+static inline bool ipv4_addr_is_multicast(uint32_t addr)
 {
     return (addr & htonl(0xf0000000)) == htonl(0xe0000000);
 }
@@ -52,8 +44,8 @@ static inline bool ipv4_addr_is_multicast(__be32 addr)
 typedef struct ipv6_addr {
     union {
         uint8_t addr8[16];
-        __be16 addr16[8];
-        __be32 addr32[4];
+        uint16_t addr16[8];
+        uint32_t addr32[4];
     };
 } Ipv6Addr;
 
diff --git a/hw/net/rocker/rocker_hw.h b/hw/net/rocker/rocker_hw.h
index 1786323fa4..7ec6bfbcb9 100644
--- a/hw/net/rocker/rocker_hw.h
+++ b/hw/net/rocker/rocker_hw.h
@@ -9,10 +9,6 @@
 #ifndef ROCKER_HW_H
 #define ROCKER_HW_H
 
-#define __le16 uint16_t
-#define __le32 uint32_t
-#define __le64 uint64_t
-
 /*
  * Return codes
  */
@@ -124,12 +120,12 @@ enum {
  */
 
 typedef struct rocker_desc {
-    __le64 buf_addr;
+    uint64_t buf_addr;
     uint64_t cookie;
-    __le16 buf_size;
-    __le16 tlv_size;
-    __le16 rsvd[5];   /* pad to 32 bytes */
-    __le16 comp_err;
+    uint16_t buf_size;
+    uint16_t tlv_size;
+    uint16_t rsvd[5];   /* pad to 32 bytes */
+    uint16_t comp_err;
 } __attribute__((packed, aligned(8))) RockerDesc;
 
 /*
@@ -137,9 +133,9 @@ typedef struct rocker_desc {
  */
 
 typedef struct rocker_tlv {
-    __le32 type;
-    __le16 len;
-    __le16 rsvd;
+    uint32_t type;
+    uint16_t len;
+    uint16_t rsvd;
 } __attribute__((packed, aligned(8))) RockerTlv;
 
 /* cmd msg */
diff --git a/hw/net/rocker/rocker_of_dpa.c b/hw/net/rocker/rocker_of_dpa.c
index 3378f63110..4aed178756 100644
--- a/hw/net/rocker/rocker_of_dpa.c
+++ b/hw/net/rocker/rocker_of_dpa.c
@@ -52,10 +52,10 @@ typedef struct of_dpa_flow_key {
     uint32_t tunnel_id;              /* overlay tunnel id */
     uint32_t tbl_id;                 /* table id */
     struct {
-        __be16 vlan_id;              /* 0 if no VLAN */
+        uint16_t vlan_id;              /* 0 if no VLAN */
         MACAddr src;                 /* ethernet source address */
         MACAddr dst;                 /* ethernet destination address */
-        __be16 type;                 /* ethernet frame type */
+        uint16_t type;                 /* ethernet frame type */
     } eth;
     struct {
         uint8_t proto;               /* IP protocol or ARP opcode */
@@ -66,14 +66,14 @@ typedef struct of_dpa_flow_key {
     union {
         struct {
             struct {
-                __be32 src;          /* IP source address */
-                __be32 dst;          /* IP destination address */
+                uint32_t src;          /* IP source address */
+                uint32_t dst;          /* IP destination address */
             } addr;
             union {
                 struct {
-                    __be16 src;      /* TCP/UDP/SCTP source port */
-                    __be16 dst;      /* TCP/UDP/SCTP destination port */
-                    __be16 flags;    /* TCP flags */
+                    uint16_t src;      /* TCP/UDP/SCTP source port */
+                    uint16_t dst;      /* TCP/UDP/SCTP destination port */
+                    uint16_t flags;    /* TCP flags */
                 } tp;
                 struct {
                     MACAddr sha;     /* ARP source hardware address */
@@ -86,11 +86,11 @@ typedef struct of_dpa_flow_key {
                 Ipv6Addr src;       /* IPv6 source address */
                 Ipv6Addr dst;       /* IPv6 destination address */
             } addr;
-            __be32 label;            /* IPv6 flow label */
+            uint32_t label;            /* IPv6 flow label */
             struct {
-                __be16 src;          /* TCP/UDP/SCTP source port */
-                __be16 dst;          /* TCP/UDP/SCTP destination port */
-                __be16 flags;        /* TCP flags */
+                uint16_t src;          /* TCP/UDP/SCTP source port */
+                uint16_t dst;          /* TCP/UDP/SCTP destination port */
+                uint16_t flags;        /* TCP flags */
             } tp;
             struct {
                 Ipv6Addr target;    /* ND target address */
@@ -112,13 +112,13 @@ typedef struct of_dpa_flow_action {
     struct {
         uint32_t group_id;
         uint32_t tun_log_lport;
-        __be16 vlan_id;
+        uint16_t vlan_id;
     } write;
     struct {
-        __be16 new_vlan_id;
+        uint16_t new_vlan_id;
         uint32_t out_pport;
         uint8_t copy_to_cpu;
-        __be16 vlan_id;
+        uint16_t vlan_id;
     } apply;
 } OfDpaFlowAction;
 
@@ -143,7 +143,7 @@ typedef struct of_dpa_flow {
 typedef struct of_dpa_flow_pkt_fields {
     uint32_t tunnel_id;
     struct eth_header *ethhdr;
-    __be16 *h_proto;
+    uint16_t *h_proto;
     struct vlan_header *vlanhdr;
     struct ip_header *ipv4hdr;
     struct ip6_header *ipv6hdr;
@@ -180,7 +180,7 @@ typedef struct of_dpa_group {
             uint32_t group_id;
             MACAddr src_mac;
             MACAddr dst_mac;
-            __be16 vlan_id;
+            uint16_t vlan_id;
         } l2_rewrite;
         struct {
             uint16_t group_count;
@@ -190,13 +190,13 @@ typedef struct of_dpa_group {
             uint32_t group_id;
             MACAddr src_mac;
             MACAddr dst_mac;
-            __be16 vlan_id;
+            uint16_t vlan_id;
             uint8_t ttl_check;
         } l3_unicast;
     };
 } OfDpaGroup;
 
-static int of_dpa_mask2prefix(__be32 mask)
+static int of_dpa_mask2prefix(uint32_t mask)
 {
     int i;
     int count = 32;
@@ -451,7 +451,7 @@ static void of_dpa_flow_pkt_parse(OfDpaFlowContext *fc,
     fc->iovcnt = iovcnt + 2;
 }
 
-static void of_dpa_flow_pkt_insert_vlan(OfDpaFlowContext *fc, __be16 vlan_id)
+static void of_dpa_flow_pkt_insert_vlan(OfDpaFlowContext *fc, uint16_t vlan_id)
 {
     OfDpaFlowPktFields *fields = &fc->fields;
     uint16_t h_proto = fields->ethhdr->h_proto;
@@ -486,7 +486,7 @@ static void of_dpa_flow_pkt_strip_vlan(OfDpaFlowContext *fc)
 
 static void of_dpa_flow_pkt_hdr_rewrite(OfDpaFlowContext *fc,
                                         uint8_t *src_mac, uint8_t *dst_mac,
-                                        __be16 vlan_id)
+                                        uint16_t vlan_id)
 {
     OfDpaFlowPktFields *fields = &fc->fields;
 

From 756e12e791771034ac105a5d2c9887bbbb6b7c73 Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Thu, 8 May 2025 10:59:08 -0400
Subject: [PATCH 1219/2760] i386: Introduce tdx-guest object
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Introduce tdx-guest object which inherits X86_CONFIDENTIAL_GUEST,
and will be used to create TDX VMs (TDs) by

  qemu -machine ...,confidential-guest-support=tdx0	\
       -object tdx-guest,id=tdx0

It has one QAPI member 'attributes' defined, which allows user to set
TD's attributes directly.

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
Acked-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250508150002.689633-3-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 configs/devices/i386-softmmu/default.mak |  1 +
 hw/i386/Kconfig                          |  5 +++
 qapi/qom.json                            | 15 +++++++++
 target/i386/kvm/meson.build              |  2 ++
 target/i386/kvm/tdx.c                    | 43 ++++++++++++++++++++++++
 target/i386/kvm/tdx.h                    | 21 ++++++++++++
 6 files changed, 87 insertions(+)
 create mode 100644 target/i386/kvm/tdx.c
 create mode 100644 target/i386/kvm/tdx.h

diff --git a/configs/devices/i386-softmmu/default.mak b/configs/devices/i386-softmmu/default.mak
index 4faf2f0315..bc0479a7e0 100644
--- a/configs/devices/i386-softmmu/default.mak
+++ b/configs/devices/i386-softmmu/default.mak
@@ -18,6 +18,7 @@
 #CONFIG_QXL=n
 #CONFIG_SEV=n
 #CONFIG_SGA=n
+#CONFIG_TDX=n
 #CONFIG_TEST_DEVICES=n
 #CONFIG_TPM_CRB=n
 #CONFIG_TPM_TIS_ISA=n
diff --git a/hw/i386/Kconfig b/hw/i386/Kconfig
index d34ce07b21..cce9521ba9 100644
--- a/hw/i386/Kconfig
+++ b/hw/i386/Kconfig
@@ -10,6 +10,10 @@ config SGX
     bool
     depends on KVM
 
+config TDX
+    bool
+    depends on KVM
+
 config PC
     bool
     imply APPLESMC
@@ -26,6 +30,7 @@ config PC
     imply QXL
     imply SEV
     imply SGX
+    imply TDX
     imply TEST_DEVICES
     imply TPM_CRB
     imply TPM_TIS_ISA
diff --git a/qapi/qom.json b/qapi/qom.json
index 04c118e4d6..3d7e11efc3 100644
--- a/qapi/qom.json
+++ b/qapi/qom.json
@@ -1047,6 +1047,19 @@
             '*host-data': 'str',
             '*vcek-disabled': 'bool' } }
 
+##
+# @TdxGuestProperties:
+#
+# Properties for tdx-guest objects.
+#
+# @attributes: The 'attributes' of a TD guest that is passed to
+#     KVM_TDX_INIT_VM
+#
+# Since: 10.1
+##
+{ 'struct': 'TdxGuestProperties',
+  'data': { '*attributes': 'uint64' } }
+
 ##
 # @ThreadContextProperties:
 #
@@ -1132,6 +1145,7 @@
     'sev-snp-guest',
     'thread-context',
     's390-pv-guest',
+    'tdx-guest',
     'throttle-group',
     'tls-creds-anon',
     'tls-creds-psk',
@@ -1204,6 +1218,7 @@
                                       'if': 'CONFIG_SECRET_KEYRING' },
       'sev-guest':                  'SevGuestProperties',
       'sev-snp-guest':              'SevSnpGuestProperties',
+      'tdx-guest':                  'TdxGuestProperties',
       'thread-context':             'ThreadContextProperties',
       'throttle-group':             'ThrottleGroupProperties',
       'tls-creds-anon':             'TlsCredsAnonProperties',
diff --git a/target/i386/kvm/meson.build b/target/i386/kvm/meson.build
index 3996cafaf2..466bccb9cb 100644
--- a/target/i386/kvm/meson.build
+++ b/target/i386/kvm/meson.build
@@ -8,6 +8,8 @@ i386_kvm_ss.add(files(
 
 i386_kvm_ss.add(when: 'CONFIG_XEN_EMU', if_true: files('xen-emu.c'))
 
+i386_kvm_ss.add(when: 'CONFIG_TDX', if_true: files('tdx.c'))
+
 i386_system_ss.add(when: 'CONFIG_HYPERV', if_true: files('hyperv.c'), if_false: files('hyperv-stub.c'))
 
 i386_system_ss.add_all(when: 'CONFIG_KVM', if_true: i386_kvm_ss)
diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
new file mode 100644
index 0000000000..ab70566c7d
--- /dev/null
+++ b/target/i386/kvm/tdx.c
@@ -0,0 +1,43 @@
+/*
+ * QEMU TDX support
+ *
+ * Copyright (c) 2025 Intel Corporation
+ *
+ * Author:
+ *      Xiaoyao Li <xiaoyao.li@intel.com>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "qom/object_interfaces.h"
+
+#include "tdx.h"
+
+/* tdx guest */
+OBJECT_DEFINE_TYPE_WITH_INTERFACES(TdxGuest,
+                                   tdx_guest,
+                                   TDX_GUEST,
+                                   X86_CONFIDENTIAL_GUEST,
+                                   { TYPE_USER_CREATABLE },
+                                   { NULL })
+
+static void tdx_guest_init(Object *obj)
+{
+    ConfidentialGuestSupport *cgs = CONFIDENTIAL_GUEST_SUPPORT(obj);
+    TdxGuest *tdx = TDX_GUEST(obj);
+
+    cgs->require_guest_memfd = true;
+    tdx->attributes = 0;
+
+    object_property_add_uint64_ptr(obj, "attributes", &tdx->attributes,
+                                   OBJ_PROP_FLAG_READWRITE);
+}
+
+static void tdx_guest_finalize(Object *obj)
+{
+}
+
+static void tdx_guest_class_init(ObjectClass *oc, const void *data)
+{
+}
diff --git a/target/i386/kvm/tdx.h b/target/i386/kvm/tdx.h
new file mode 100644
index 0000000000..f3b7253361
--- /dev/null
+++ b/target/i386/kvm/tdx.h
@@ -0,0 +1,21 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#ifndef QEMU_I386_TDX_H
+#define QEMU_I386_TDX_H
+
+#include "confidential-guest.h"
+
+#define TYPE_TDX_GUEST "tdx-guest"
+#define TDX_GUEST(obj)  OBJECT_CHECK(TdxGuest, (obj), TYPE_TDX_GUEST)
+
+typedef struct TdxGuestClass {
+    X86ConfidentialGuestClass parent_class;
+} TdxGuestClass;
+
+typedef struct TdxGuest {
+    X86ConfidentialGuest parent_obj;
+
+    uint64_t attributes;    /* TD attributes */
+} TdxGuest;
+
+#endif /* QEMU_I386_TDX_H */

From b455880e5515a9fc2b923bfc6c60bb54519b51d3 Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Thu, 8 May 2025 10:59:09 -0400
Subject: [PATCH 1220/2760] i386/tdx: Implement tdx_kvm_type() for TDX
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

TDX VM requires VM type to be KVM_X86_TDX_VM. Implement tdx_kvm_type()
as X86ConfidentialGuestClass->kvm_type.

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250508150002.689633-4-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/kvm/kvm.c |  1 +
 target/i386/kvm/tdx.c | 12 ++++++++++++
 2 files changed, 13 insertions(+)

diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
index c9a3c02e3e..653a8f46c2 100644
--- a/target/i386/kvm/kvm.c
+++ b/target/i386/kvm/kvm.c
@@ -192,6 +192,7 @@ static const char *vm_type_name[] = {
     [KVM_X86_SEV_VM] = "SEV",
     [KVM_X86_SEV_ES_VM] = "SEV-ES",
     [KVM_X86_SNP_VM] = "SEV-SNP",
+    [KVM_X86_TDX_VM] = "TDX",
 };
 
 bool kvm_is_vm_type_supported(int type)
diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
index ab70566c7d..21a4f87756 100644
--- a/target/i386/kvm/tdx.c
+++ b/target/i386/kvm/tdx.c
@@ -12,8 +12,17 @@
 #include "qemu/osdep.h"
 #include "qom/object_interfaces.h"
 
+#include "kvm_i386.h"
 #include "tdx.h"
 
+static int tdx_kvm_type(X86ConfidentialGuest *cg)
+{
+    /* Do the object check */
+    TDX_GUEST(cg);
+
+    return KVM_X86_TDX_VM;
+}
+
 /* tdx guest */
 OBJECT_DEFINE_TYPE_WITH_INTERFACES(TdxGuest,
                                    tdx_guest,
@@ -40,4 +49,7 @@ static void tdx_guest_finalize(Object *obj)
 
 static void tdx_guest_class_init(ObjectClass *oc, const void *data)
 {
+    X86ConfidentialGuestClass *x86_klass = X86_CONFIDENTIAL_GUEST_CLASS(oc);
+
+    x86_klass->kvm_type = tdx_kvm_type;
 }

From 631a2ac5a4beab740b342367550562cd659b4c4a Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Thu, 8 May 2025 10:59:10 -0400
Subject: [PATCH 1221/2760] i386/tdx: Implement tdx_kvm_init() to initialize
 TDX VM context
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Implement TDX specific ConfidentialGuestSupportClass::kvm_init()
callback, tdx_kvm_init().

Mark guest state is proctected for TDX VM.  More TDX specific
initialization will be added later.

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250508150002.689633-5-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/kvm/kvm.c | 11 +----------
 target/i386/kvm/tdx.c | 10 ++++++++++
 2 files changed, 11 insertions(+), 10 deletions(-)

diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
index 653a8f46c2..d29376c599 100644
--- a/target/i386/kvm/kvm.c
+++ b/target/i386/kvm/kvm.c
@@ -3207,16 +3207,7 @@ int kvm_arch_init(MachineState *ms, KVMState *s)
     Error *local_err = NULL;
 
     /*
-     * Initialize SEV context, if required
-     *
-     * If no memory encryption is requested (ms->cgs == NULL) this is
-     * a no-op.
-     *
-     * It's also a no-op if a non-SEV confidential guest support
-     * mechanism is selected.  SEV is the only mechanism available to
-     * select on x86 at present, so this doesn't arise, but if new
-     * mechanisms are supported in future (e.g. TDX), they'll need
-     * their own initialization either here or elsewhere.
+     * Initialize confidential guest (SEV/TDX) context, if required
      */
     if (ms->cgs) {
         ret = confidential_guest_kvm_init(ms->cgs, &local_err);
diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
index 21a4f87756..2b060fb52b 100644
--- a/target/i386/kvm/tdx.c
+++ b/target/i386/kvm/tdx.c
@@ -12,9 +12,17 @@
 #include "qemu/osdep.h"
 #include "qom/object_interfaces.h"
 
+#include "hw/i386/x86.h"
 #include "kvm_i386.h"
 #include "tdx.h"
 
+static int tdx_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
+{
+    kvm_mark_guest_state_protected();
+
+    return 0;
+}
+
 static int tdx_kvm_type(X86ConfidentialGuest *cg)
 {
     /* Do the object check */
@@ -49,7 +57,9 @@ static void tdx_guest_finalize(Object *obj)
 
 static void tdx_guest_class_init(ObjectClass *oc, const void *data)
 {
+    ConfidentialGuestSupportClass *klass = CONFIDENTIAL_GUEST_SUPPORT_CLASS(oc);
     X86ConfidentialGuestClass *x86_klass = X86_CONFIDENTIAL_GUEST_CLASS(oc);
 
+    klass->kvm_init = tdx_kvm_init;
     x86_klass->kvm_type = tdx_kvm_type;
 }

From 8eddedc3701d2190db976a05155a8263c8ec175b Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Thu, 8 May 2025 10:59:11 -0400
Subject: [PATCH 1222/2760] i386/tdx: Get tdx_capabilities via
 KVM_TDX_CAPABILITIES

KVM provides TDX capabilities via sub command KVM_TDX_CAPABILITIES of
IOCTL(KVM_MEMORY_ENCRYPT_OP). Get the capabilities when initializing
TDX context. It will be used to validate user's setting later.

Since there is no interface reporting how many cpuid configs contains in
KVM_TDX_CAPABILITIES, QEMU chooses to try starting with a known number
and abort when it exceeds KVM_MAX_CPUID_ENTRIES.

Besides, introduce the interfaces to invoke TDX "ioctls" at VCPU scope
in preparation.

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Link: https://lore.kernel.org/r/20250508150002.689633-6-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/kvm/kvm.c      |   2 -
 target/i386/kvm/kvm_i386.h |   2 +
 target/i386/kvm/tdx.c      | 109 ++++++++++++++++++++++++++++++++++++-
 3 files changed, 109 insertions(+), 4 deletions(-)

diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
index d29376c599..6d88495d47 100644
--- a/target/i386/kvm/kvm.c
+++ b/target/i386/kvm/kvm.c
@@ -1780,8 +1780,6 @@ static int hyperv_init_vcpu(X86CPU *cpu)
 
 static Error *invtsc_mig_blocker;
 
-#define KVM_MAX_CPUID_ENTRIES  100
-
 static void kvm_init_xsave(CPUX86State *env)
 {
     if (has_xsave2) {
diff --git a/target/i386/kvm/kvm_i386.h b/target/i386/kvm/kvm_i386.h
index 88565e8dba..ed1e61fb8b 100644
--- a/target/i386/kvm/kvm_i386.h
+++ b/target/i386/kvm/kvm_i386.h
@@ -13,6 +13,8 @@
 
 #include "system/kvm.h"
 
+#define KVM_MAX_CPUID_ENTRIES  100
+
 /* always false if !CONFIG_KVM */
 #define kvm_pit_in_kernel() \
     (kvm_irqchip_in_kernel() && !kvm_irqchip_is_split())
diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
index 2b060fb52b..f8ec4fa217 100644
--- a/target/i386/kvm/tdx.c
+++ b/target/i386/kvm/tdx.c
@@ -10,19 +10,124 @@
  */
 
 #include "qemu/osdep.h"
+#include "qemu/error-report.h"
+#include "qapi/error.h"
 #include "qom/object_interfaces.h"
 
 #include "hw/i386/x86.h"
 #include "kvm_i386.h"
 #include "tdx.h"
 
-static int tdx_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
+static struct kvm_tdx_capabilities *tdx_caps;
+
+enum tdx_ioctl_level {
+    TDX_VM_IOCTL,
+    TDX_VCPU_IOCTL,
+};
+
+static int tdx_ioctl_internal(enum tdx_ioctl_level level, void *state,
+                              int cmd_id, __u32 flags, void *data,
+                              Error **errp)
 {
-    kvm_mark_guest_state_protected();
+    struct kvm_tdx_cmd tdx_cmd = {};
+    int r;
+
+    const char *tdx_ioctl_name[] = {
+        [KVM_TDX_CAPABILITIES] = "KVM_TDX_CAPABILITIES",
+        [KVM_TDX_INIT_VM] = "KVM_TDX_INIT_VM",
+        [KVM_TDX_INIT_VCPU] = "KVM_TDX_INIT_VCPU",
+        [KVM_TDX_INIT_MEM_REGION] = "KVM_TDX_INIT_MEM_REGION",
+        [KVM_TDX_FINALIZE_VM] = "KVM_TDX_FINALIZE_VM",
+        [KVM_TDX_GET_CPUID] = "KVM_TDX_GET_CPUID",
+    };
+
+    tdx_cmd.id = cmd_id;
+    tdx_cmd.flags = flags;
+    tdx_cmd.data = (__u64)(unsigned long)data;
+
+    switch (level) {
+    case TDX_VM_IOCTL:
+        r = kvm_vm_ioctl(kvm_state, KVM_MEMORY_ENCRYPT_OP, &tdx_cmd);
+        break;
+    case TDX_VCPU_IOCTL:
+        r = kvm_vcpu_ioctl(state, KVM_MEMORY_ENCRYPT_OP, &tdx_cmd);
+        break;
+    default:
+        error_setg(errp, "Invalid tdx_ioctl_level %d", level);
+        return -EINVAL;
+    }
+
+    if (r < 0) {
+        error_setg_errno(errp, -r, "TDX ioctl %s failed, hw_errors: 0x%llx",
+                         tdx_ioctl_name[cmd_id], tdx_cmd.hw_error);
+    }
+    return r;
+}
+
+static inline int tdx_vm_ioctl(int cmd_id, __u32 flags, void *data,
+                               Error **errp)
+{
+    return tdx_ioctl_internal(TDX_VM_IOCTL, NULL, cmd_id, flags, data, errp);
+}
+
+static inline int tdx_vcpu_ioctl(CPUState *cpu, int cmd_id, __u32 flags,
+                                 void *data, Error **errp)
+{
+    return  tdx_ioctl_internal(TDX_VCPU_IOCTL, cpu, cmd_id, flags, data, errp);
+}
+
+static int get_tdx_capabilities(Error **errp)
+{
+    struct kvm_tdx_capabilities *caps;
+    /* 1st generation of TDX reports 6 cpuid configs */
+    int nr_cpuid_configs = 6;
+    size_t size;
+    int r;
+
+    do {
+        Error *local_err = NULL;
+        size = sizeof(struct kvm_tdx_capabilities) +
+                      nr_cpuid_configs * sizeof(struct kvm_cpuid_entry2);
+        caps = g_malloc0(size);
+        caps->cpuid.nent = nr_cpuid_configs;
+
+        r = tdx_vm_ioctl(KVM_TDX_CAPABILITIES, 0, caps, &local_err);
+        if (r == -E2BIG) {
+            g_free(caps);
+            nr_cpuid_configs *= 2;
+            if (nr_cpuid_configs > KVM_MAX_CPUID_ENTRIES) {
+                error_report("KVM TDX seems broken that number of CPUID entries"
+                             " in kvm_tdx_capabilities exceeds limit: %d",
+                             KVM_MAX_CPUID_ENTRIES);
+                error_propagate(errp, local_err);
+                return r;
+            }
+            error_free(local_err);
+        } else if (r < 0) {
+            g_free(caps);
+            error_propagate(errp, local_err);
+            return r;
+        }
+    } while (r == -E2BIG);
+
+    tdx_caps = caps;
 
     return 0;
 }
 
+static int tdx_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
+{
+    int r = 0;
+
+    kvm_mark_guest_state_protected();
+
+    if (!tdx_caps) {
+        r = get_tdx_capabilities(errp);
+    }
+
+    return r;
+}
+
 static int tdx_kvm_type(X86ConfidentialGuest *cg)
 {
     /* Do the object check */

From 1619d0e45be0d1e48a46d80963b4e77dc1b000a2 Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Thu, 8 May 2025 10:59:12 -0400
Subject: [PATCH 1223/2760] i386/tdx: Introduce is_tdx_vm() helper and cache
 tdx_guest object

It will need special handling for TDX VMs all around the QEMU.
Introduce is_tdx_vm() helper to query if it's a TDX VM.

Cache tdx_guest object thus no need to cast from ms->cgs every time.

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Isaku Yamahata <isaku.yamahata@intel.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250508150002.689633-7-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/kvm/tdx.c | 15 ++++++++++++++-
 target/i386/kvm/tdx.h | 10 ++++++++++
 2 files changed, 24 insertions(+), 1 deletion(-)

diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
index f8ec4fa217..3750889453 100644
--- a/target/i386/kvm/tdx.c
+++ b/target/i386/kvm/tdx.c
@@ -18,8 +18,16 @@
 #include "kvm_i386.h"
 #include "tdx.h"
 
+static TdxGuest *tdx_guest;
+
 static struct kvm_tdx_capabilities *tdx_caps;
 
+/* Valid after kvm_arch_init()->confidential_guest_kvm_init()->tdx_kvm_init() */
+bool is_tdx_vm(void)
+{
+    return !!tdx_guest;
+}
+
 enum tdx_ioctl_level {
     TDX_VM_IOCTL,
     TDX_VCPU_IOCTL,
@@ -117,15 +125,20 @@ static int get_tdx_capabilities(Error **errp)
 
 static int tdx_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
 {
+    TdxGuest *tdx = TDX_GUEST(cgs);
     int r = 0;
 
     kvm_mark_guest_state_protected();
 
     if (!tdx_caps) {
         r = get_tdx_capabilities(errp);
+        if (r) {
+            return r;
+        }
     }
 
-    return r;
+    tdx_guest = tdx;
+    return 0;
 }
 
 static int tdx_kvm_type(X86ConfidentialGuest *cg)
diff --git a/target/i386/kvm/tdx.h b/target/i386/kvm/tdx.h
index f3b7253361..de8ae91961 100644
--- a/target/i386/kvm/tdx.h
+++ b/target/i386/kvm/tdx.h
@@ -3,6 +3,10 @@
 #ifndef QEMU_I386_TDX_H
 #define QEMU_I386_TDX_H
 
+#ifndef CONFIG_USER_ONLY
+#include CONFIG_DEVICES /* CONFIG_TDX */
+#endif
+
 #include "confidential-guest.h"
 
 #define TYPE_TDX_GUEST "tdx-guest"
@@ -18,4 +22,10 @@ typedef struct TdxGuest {
     uint64_t attributes;    /* TD attributes */
 } TdxGuest;
 
+#ifdef CONFIG_TDX
+bool is_tdx_vm(void);
+#else
+#define is_tdx_vm() 0
+#endif /* CONFIG_TDX */
+
 #endif /* QEMU_I386_TDX_H */

From a668268dc08f7f4d30cecd513054bb38ce48c0d6 Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Thu, 8 May 2025 10:59:13 -0400
Subject: [PATCH 1224/2760] kvm: Introduce kvm_arch_pre_create_vcpu()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Introduce kvm_arch_pre_create_vcpu(), to perform arch-dependent
work prior to create any vcpu. This is for i386 TDX because it needs
call TDX_INIT_VM before creating any vcpu.

The specific implementation for i386 will be added in the future patch.

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250508150002.689633-8-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 accel/kvm/kvm-all.c        | 5 +++++
 include/system/kvm.h       | 1 +
 target/arm/kvm.c           | 5 +++++
 target/i386/kvm/kvm.c      | 5 +++++
 target/loongarch/kvm/kvm.c | 4 ++++
 target/mips/kvm.c          | 5 +++++
 target/ppc/kvm.c           | 5 +++++
 target/riscv/kvm/kvm-cpu.c | 5 +++++
 target/s390x/kvm/kvm.c     | 5 +++++
 9 files changed, 40 insertions(+)

diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index 278a50690c..42d239cf8f 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -545,6 +545,11 @@ int kvm_init_vcpu(CPUState *cpu, Error **errp)
 
     trace_kvm_init_vcpu(cpu->cpu_index, kvm_arch_vcpu_id(cpu));
 
+    ret = kvm_arch_pre_create_vcpu(cpu, errp);
+    if (ret < 0) {
+        goto err;
+    }
+
     ret = kvm_create_vcpu(cpu);
     if (ret < 0) {
         error_setg_errno(errp, -ret,
diff --git a/include/system/kvm.h b/include/system/kvm.h
index b690dda137..62ec131d4d 100644
--- a/include/system/kvm.h
+++ b/include/system/kvm.h
@@ -376,6 +376,7 @@ int kvm_arch_get_default_type(MachineState *ms);
 
 int kvm_arch_init(MachineState *ms, KVMState *s);
 
+int kvm_arch_pre_create_vcpu(CPUState *cpu, Error **errp);
 int kvm_arch_init_vcpu(CPUState *cpu);
 int kvm_arch_destroy_vcpu(CPUState *cpu);
 
diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index a2791aa866..74fda8b809 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -1846,6 +1846,11 @@ static int kvm_arm_sve_set_vls(ARMCPU *cpu)
 
 #define ARM_CPU_ID_MPIDR       3, 0, 0, 0, 5
 
+int kvm_arch_pre_create_vcpu(CPUState *cpu, Error **errp)
+{
+    return 0;
+}
+
 int kvm_arch_init_vcpu(CPUState *cs)
 {
     int ret;
diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
index 6d88495d47..446f0600d4 100644
--- a/target/i386/kvm/kvm.c
+++ b/target/i386/kvm/kvm.c
@@ -2051,6 +2051,11 @@ full:
     abort();
 }
 
+int kvm_arch_pre_create_vcpu(CPUState *cpu, Error **errp)
+{
+    return 0;
+}
+
 int kvm_arch_init_vcpu(CPUState *cs)
 {
     struct {
diff --git a/target/loongarch/kvm/kvm.c b/target/loongarch/kvm/kvm.c
index 1bda570482..c66bdd5302 100644
--- a/target/loongarch/kvm/kvm.c
+++ b/target/loongarch/kvm/kvm.c
@@ -1071,7 +1071,11 @@ static int kvm_cpu_check_pv_features(CPUState *cs, Error **errp)
             env->pv_features |= BIT(KVM_FEATURE_VIRT_EXTIOI);
         }
     }
+    return 0;
+}
 
+int kvm_arch_pre_create_vcpu(CPUState *cpu, Error **errp)
+{
     return 0;
 }
 
diff --git a/target/mips/kvm.c b/target/mips/kvm.c
index d67b7c1a8e..ec53acb51a 100644
--- a/target/mips/kvm.c
+++ b/target/mips/kvm.c
@@ -61,6 +61,11 @@ int kvm_arch_irqchip_create(KVMState *s)
     return 0;
 }
 
+int kvm_arch_pre_create_vcpu(CPUState *cpu, Error **errp)
+{
+    return 0;
+}
+
 int kvm_arch_init_vcpu(CPUState *cs)
 {
     CPUMIPSState *env = cpu_env(cs);
diff --git a/target/ppc/kvm.c b/target/ppc/kvm.c
index 8a957c3c7d..015658049e 100644
--- a/target/ppc/kvm.c
+++ b/target/ppc/kvm.c
@@ -479,6 +479,11 @@ static void kvmppc_hw_debug_points_init(CPUPPCState *cenv)
     }
 }
 
+int kvm_arch_pre_create_vcpu(CPUState *cpu, Error **errp)
+{
+    return 0;
+}
+
 int kvm_arch_init_vcpu(CPUState *cs)
 {
     PowerPCCPU *cpu = POWERPC_CPU(cs);
diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
index efb41fac53..e1a04be20f 100644
--- a/target/riscv/kvm/kvm-cpu.c
+++ b/target/riscv/kvm/kvm-cpu.c
@@ -1472,6 +1472,11 @@ static int kvm_vcpu_enable_sbi_dbcn(RISCVCPU *cpu, CPUState *cs)
     return kvm_set_one_reg(cs, kvm_sbi_dbcn.kvm_reg_id, &reg);
 }
 
+int kvm_arch_pre_create_vcpu(CPUState *cpu, Error **errp)
+{
+    return 0;
+}
+
 int kvm_arch_init_vcpu(CPUState *cs)
 {
     int ret = 0;
diff --git a/target/s390x/kvm/kvm.c b/target/s390x/kvm/kvm.c
index 6cd2ebc5f1..67d9a1977c 100644
--- a/target/s390x/kvm/kvm.c
+++ b/target/s390x/kvm/kvm.c
@@ -398,6 +398,11 @@ unsigned long kvm_arch_vcpu_id(CPUState *cpu)
     return cpu->cpu_index;
 }
 
+int kvm_arch_pre_create_vcpu(CPUState *cpu, Error **errp)
+{
+    return 0;
+}
+
 int kvm_arch_init_vcpu(CPUState *cs)
 {
     unsigned int max_cpus = MACHINE(qdev_get_machine())->smp.max_cpus;

From f15898b0f50609d66465326221aa54b6699da674 Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Thu, 8 May 2025 10:59:14 -0400
Subject: [PATCH 1225/2760] i386/tdx: Initialize TDX before creating TD vcpus

Invoke KVM_TDX_INIT_VM in kvm_arch_pre_create_vcpu() that
KVM_TDX_INIT_VM configures global TD configurations, e.g. the canonical
CPUID config, and must be executed prior to creating vCPUs.

Use kvm_x86_arch_cpuid() to setup the CPUID settings for TDX VM.

Note, this doesn't address the fact that QEMU may change the CPUID
configuration when creating vCPUs, i.e. punts on refactoring QEMU to
provide a stable CPUID config prior to kvm_arch_init().

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
Acked-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250508150002.689633-9-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/kvm/kvm.c       |  16 +++---
 target/i386/kvm/kvm_i386.h  |   5 ++
 target/i386/kvm/meson.build |   2 +-
 target/i386/kvm/tdx-stub.c  |  10 ++++
 target/i386/kvm/tdx.c       | 105 ++++++++++++++++++++++++++++++++++++
 target/i386/kvm/tdx.h       |   6 +++
 6 files changed, 137 insertions(+), 7 deletions(-)
 create mode 100644 target/i386/kvm/tdx-stub.c

diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
index 446f0600d4..e98f1ee26a 100644
--- a/target/i386/kvm/kvm.c
+++ b/target/i386/kvm/kvm.c
@@ -38,6 +38,7 @@
 #include "kvm_i386.h"
 #include "../confidential-guest.h"
 #include "sev.h"
+#include "tdx.h"
 #include "xen-emu.h"
 #include "hyperv.h"
 #include "hyperv-proto.h"
@@ -415,9 +416,9 @@ static uint32_t cpuid_entry_get_reg(struct kvm_cpuid_entry2 *entry, int reg)
 
 /* Find matching entry for function/index on kvm_cpuid2 struct
  */
-static struct kvm_cpuid_entry2 *cpuid_find_entry(struct kvm_cpuid2 *cpuid,
-                                                 uint32_t function,
-                                                 uint32_t index)
+struct kvm_cpuid_entry2 *cpuid_find_entry(struct kvm_cpuid2 *cpuid,
+                                          uint32_t function,
+                                          uint32_t index)
 {
     int i;
     for (i = 0; i < cpuid->nent; ++i) {
@@ -1822,9 +1823,8 @@ static void kvm_init_nested_state(CPUX86State *env)
     }
 }
 
-static uint32_t kvm_x86_build_cpuid(CPUX86State *env,
-                                    struct kvm_cpuid_entry2 *entries,
-                                    uint32_t cpuid_i)
+uint32_t kvm_x86_build_cpuid(CPUX86State *env, struct kvm_cpuid_entry2 *entries,
+                             uint32_t cpuid_i)
 {
     uint32_t limit, i, j;
     uint32_t unused;
@@ -2053,6 +2053,10 @@ full:
 
 int kvm_arch_pre_create_vcpu(CPUState *cpu, Error **errp)
 {
+    if (is_tdx_vm()) {
+        return tdx_pre_create_vcpu(cpu, errp);
+    }
+
     return 0;
 }
 
diff --git a/target/i386/kvm/kvm_i386.h b/target/i386/kvm/kvm_i386.h
index ed1e61fb8b..dc696cb723 100644
--- a/target/i386/kvm/kvm_i386.h
+++ b/target/i386/kvm/kvm_i386.h
@@ -59,6 +59,11 @@ uint64_t kvm_swizzle_msi_ext_dest_id(uint64_t address);
 void kvm_update_msi_routes_all(void *private, bool global,
                                uint32_t index, uint32_t mask);
 
+struct kvm_cpuid_entry2 *cpuid_find_entry(struct kvm_cpuid2 *cpuid,
+                                          uint32_t function,
+                                          uint32_t index);
+uint32_t kvm_x86_build_cpuid(CPUX86State *env, struct kvm_cpuid_entry2 *entries,
+                             uint32_t cpuid_i);
 #endif /* CONFIG_KVM */
 
 void kvm_pc_setup_irq_routing(bool pci_enabled);
diff --git a/target/i386/kvm/meson.build b/target/i386/kvm/meson.build
index 466bccb9cb..3f44cdedb7 100644
--- a/target/i386/kvm/meson.build
+++ b/target/i386/kvm/meson.build
@@ -8,7 +8,7 @@ i386_kvm_ss.add(files(
 
 i386_kvm_ss.add(when: 'CONFIG_XEN_EMU', if_true: files('xen-emu.c'))
 
-i386_kvm_ss.add(when: 'CONFIG_TDX', if_true: files('tdx.c'))
+i386_kvm_ss.add(when: 'CONFIG_TDX', if_true: files('tdx.c'), if_false: files('tdx-stub.c'))
 
 i386_system_ss.add(when: 'CONFIG_HYPERV', if_true: files('hyperv.c'), if_false: files('hyperv-stub.c'))
 
diff --git a/target/i386/kvm/tdx-stub.c b/target/i386/kvm/tdx-stub.c
new file mode 100644
index 0000000000..2344433594
--- /dev/null
+++ b/target/i386/kvm/tdx-stub.c
@@ -0,0 +1,10 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#include "qemu/osdep.h"
+
+#include "tdx.h"
+
+int tdx_pre_create_vcpu(CPUState *cpu, Error **errp)
+{
+    return -EINVAL;
+}
diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
index 3750889453..2d2d48c083 100644
--- a/target/i386/kvm/tdx.c
+++ b/target/i386/kvm/tdx.c
@@ -149,6 +149,109 @@ static int tdx_kvm_type(X86ConfidentialGuest *cg)
     return KVM_X86_TDX_VM;
 }
 
+static int setup_td_xfam(X86CPU *x86cpu, Error **errp)
+{
+    CPUX86State *env = &x86cpu->env;
+    uint64_t xfam;
+
+    xfam = env->features[FEAT_XSAVE_XCR0_LO] |
+           env->features[FEAT_XSAVE_XCR0_HI] |
+           env->features[FEAT_XSAVE_XSS_LO] |
+           env->features[FEAT_XSAVE_XSS_HI];
+
+    if (xfam & ~tdx_caps->supported_xfam) {
+        error_setg(errp, "Invalid XFAM 0x%lx for TDX VM (supported: 0x%llx))",
+                   xfam, tdx_caps->supported_xfam);
+        return -1;
+    }
+
+    tdx_guest->xfam = xfam;
+    return 0;
+}
+
+static void tdx_filter_cpuid(struct kvm_cpuid2 *cpuids)
+{
+    int i, dest_cnt = 0;
+    struct kvm_cpuid_entry2 *src, *dest, *conf;
+
+    for (i = 0; i < cpuids->nent; i++) {
+        src = cpuids->entries + i;
+        conf = cpuid_find_entry(&tdx_caps->cpuid, src->function, src->index);
+        if (!conf) {
+            continue;
+        }
+        dest = cpuids->entries + dest_cnt;
+
+        dest->function = src->function;
+        dest->index = src->index;
+        dest->flags = src->flags;
+        dest->eax = src->eax & conf->eax;
+        dest->ebx = src->ebx & conf->ebx;
+        dest->ecx = src->ecx & conf->ecx;
+        dest->edx = src->edx & conf->edx;
+
+        dest_cnt++;
+    }
+    cpuids->nent = dest_cnt++;
+}
+
+int tdx_pre_create_vcpu(CPUState *cpu, Error **errp)
+{
+    X86CPU *x86cpu = X86_CPU(cpu);
+    CPUX86State *env = &x86cpu->env;
+    g_autofree struct kvm_tdx_init_vm *init_vm = NULL;
+    Error *local_err = NULL;
+    int retry = 10000;
+    int r = 0;
+
+    QEMU_LOCK_GUARD(&tdx_guest->lock);
+    if (tdx_guest->initialized) {
+        return r;
+    }
+
+    init_vm = g_malloc0(sizeof(struct kvm_tdx_init_vm) +
+                        sizeof(struct kvm_cpuid_entry2) * KVM_MAX_CPUID_ENTRIES);
+
+    r = setup_td_xfam(x86cpu, errp);
+    if (r) {
+        return r;
+    }
+
+    init_vm->cpuid.nent = kvm_x86_build_cpuid(env, init_vm->cpuid.entries, 0);
+    tdx_filter_cpuid(&init_vm->cpuid);
+
+    init_vm->attributes = tdx_guest->attributes;
+    init_vm->xfam = tdx_guest->xfam;
+
+    /*
+     * KVM_TDX_INIT_VM gets -EAGAIN when KVM side SEAMCALL(TDH_MNG_CREATE)
+     * gets TDX_RND_NO_ENTROPY due to Random number generation (e.g., RDRAND or
+     * RDSEED) is busy.
+     *
+     * Retry for the case.
+     */
+    do {
+        error_free(local_err);
+        local_err = NULL;
+        r = tdx_vm_ioctl(KVM_TDX_INIT_VM, 0, init_vm, &local_err);
+    } while (r == -EAGAIN && --retry);
+
+    if (r < 0) {
+        if (!retry) {
+            error_append_hint(&local_err, "Hardware RNG (Random Number "
+            "Generator) is busy occupied by someone (via RDRAND/RDSEED) "
+            "maliciously, which leads to KVM_TDX_INIT_VM keeping failure "
+            "due to lack of entropy.\n");
+        }
+        error_propagate(errp, local_err);
+        return r;
+    }
+
+    tdx_guest->initialized = true;
+
+    return 0;
+}
+
 /* tdx guest */
 OBJECT_DEFINE_TYPE_WITH_INTERFACES(TdxGuest,
                                    tdx_guest,
@@ -162,6 +265,8 @@ static void tdx_guest_init(Object *obj)
     ConfidentialGuestSupport *cgs = CONFIDENTIAL_GUEST_SUPPORT(obj);
     TdxGuest *tdx = TDX_GUEST(obj);
 
+    qemu_mutex_init(&tdx->lock);
+
     cgs->require_guest_memfd = true;
     tdx->attributes = 0;
 
diff --git a/target/i386/kvm/tdx.h b/target/i386/kvm/tdx.h
index de8ae91961..4e2b5c61ff 100644
--- a/target/i386/kvm/tdx.h
+++ b/target/i386/kvm/tdx.h
@@ -19,7 +19,11 @@ typedef struct TdxGuestClass {
 typedef struct TdxGuest {
     X86ConfidentialGuest parent_obj;
 
+    QemuMutex lock;
+
+    bool initialized;
     uint64_t attributes;    /* TD attributes */
+    uint64_t xfam;
 } TdxGuest;
 
 #ifdef CONFIG_TDX
@@ -28,4 +32,6 @@ bool is_tdx_vm(void);
 #define is_tdx_vm() 0
 #endif /* CONFIG_TDX */
 
+int tdx_pre_create_vcpu(CPUState *cpu, Error **errp);
+
 #endif /* QEMU_I386_TDX_H */

From 6016e2972d94c90307b6caf55a8e3aee5424c09b Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Thu, 8 May 2025 10:59:15 -0400
Subject: [PATCH 1226/2760] i386/tdx: Add property sept-ve-disable for
 tdx-guest object
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bit 28 of TD attribute, named SEPT_VE_DISABLE. When set to 1, it disables
EPT violation conversion to #VE on guest TD access of PENDING pages.

Some guest OS (e.g., Linux TD guest) may require this bit as 1.
Otherwise refuse to boot.

Add sept-ve-disable property for tdx-guest object, for user to configure
this bit.

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
Acked-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250508150002.689633-10-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 qapi/qom.json         |  8 +++++++-
 target/i386/kvm/tdx.c | 23 +++++++++++++++++++++++
 2 files changed, 30 insertions(+), 1 deletion(-)

diff --git a/qapi/qom.json b/qapi/qom.json
index 3d7e11efc3..5a88d36423 100644
--- a/qapi/qom.json
+++ b/qapi/qom.json
@@ -1055,10 +1055,16 @@
 # @attributes: The 'attributes' of a TD guest that is passed to
 #     KVM_TDX_INIT_VM
 #
+# @sept-ve-disable: toggle bit 28 of TD attributes to control disabling
+#     of EPT violation conversion to #VE on guest TD access of PENDING
+#     pages.  Some guest OS (e.g., Linux TD guest) may require this to
+#     be set, otherwise they refuse to boot.
+#
 # Since: 10.1
 ##
 { 'struct': 'TdxGuestProperties',
-  'data': { '*attributes': 'uint64' } }
+  'data': { '*attributes': 'uint64',
+            '*sept-ve-disable': 'bool' } }
 
 ##
 # @ThreadContextProperties:
diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
index 2d2d48c083..32ba3982ff 100644
--- a/target/i386/kvm/tdx.c
+++ b/target/i386/kvm/tdx.c
@@ -18,6 +18,8 @@
 #include "kvm_i386.h"
 #include "tdx.h"
 
+#define TDX_TD_ATTRIBUTES_SEPT_VE_DISABLE   BIT_ULL(28)
+
 static TdxGuest *tdx_guest;
 
 static struct kvm_tdx_capabilities *tdx_caps;
@@ -252,6 +254,24 @@ int tdx_pre_create_vcpu(CPUState *cpu, Error **errp)
     return 0;
 }
 
+static bool tdx_guest_get_sept_ve_disable(Object *obj, Error **errp)
+{
+    TdxGuest *tdx = TDX_GUEST(obj);
+
+    return !!(tdx->attributes & TDX_TD_ATTRIBUTES_SEPT_VE_DISABLE);
+}
+
+static void tdx_guest_set_sept_ve_disable(Object *obj, bool value, Error **errp)
+{
+    TdxGuest *tdx = TDX_GUEST(obj);
+
+    if (value) {
+        tdx->attributes |= TDX_TD_ATTRIBUTES_SEPT_VE_DISABLE;
+    } else {
+        tdx->attributes &= ~TDX_TD_ATTRIBUTES_SEPT_VE_DISABLE;
+    }
+}
+
 /* tdx guest */
 OBJECT_DEFINE_TYPE_WITH_INTERFACES(TdxGuest,
                                    tdx_guest,
@@ -272,6 +292,9 @@ static void tdx_guest_init(Object *obj)
 
     object_property_add_uint64_ptr(obj, "attributes", &tdx->attributes,
                                    OBJ_PROP_FLAG_READWRITE);
+    object_property_add_bool(obj, "sept-ve-disable",
+                             tdx_guest_get_sept_ve_disable,
+                             tdx_guest_set_sept_ve_disable);
 }
 
 static void tdx_guest_finalize(Object *obj)

From 714af52276e74a1829674d180ef26ecb6261834c Mon Sep 17 00:00:00 2001
From: Isaku Yamahata <isaku.yamahata@intel.com>
Date: Thu, 8 May 2025 10:59:16 -0400
Subject: [PATCH 1227/2760] i386/tdx: Make sept_ve_disable set by default
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

For TDX KVM use case, Linux guest is the most major one.  It requires
sept_ve_disable set.  Make it default for the main use case.  For other use
case, it can be enabled/disabled via qemu command line.

Signed-off-by: Isaku Yamahata <isaku.yamahata@intel.com>
Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250508150002.689633-11-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/kvm/tdx.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
index 32ba3982ff..a30731b1a3 100644
--- a/target/i386/kvm/tdx.c
+++ b/target/i386/kvm/tdx.c
@@ -288,7 +288,7 @@ static void tdx_guest_init(Object *obj)
     qemu_mutex_init(&tdx->lock);
 
     cgs->require_guest_memfd = true;
-    tdx->attributes = 0;
+    tdx->attributes = TDX_TD_ATTRIBUTES_SEPT_VE_DISABLE;
 
     object_property_add_uint64_ptr(obj, "attributes", &tdx->attributes,
                                    OBJ_PROP_FLAG_READWRITE);

From bb3be394cf80d68251e5b89e823dddc679b6e644 Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Thu, 8 May 2025 10:59:17 -0400
Subject: [PATCH 1228/2760] i386/tdx: Wire CPU features up with attributes of
 TD guest
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

For QEMU VMs,
  - PKS is configured via CPUID_7_0_ECX_PKS, e.g., -cpu xxx,+pks  and
  - PMU is configured by x86cpu->enable_pmu, e.g., -cpu xxx,pmu=on

While the bit 30 (PKS) and bit 63 (PERFMON) of TD's attributes are also
used to configure the PKS and PERFMON/PMU of TD, reuse the existing
configuration interfaces of 'cpu' for TD's attributes.

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250508150002.689633-12-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/kvm/tdx.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
index a30731b1a3..22d66bdb14 100644
--- a/target/i386/kvm/tdx.c
+++ b/target/i386/kvm/tdx.c
@@ -19,6 +19,8 @@
 #include "tdx.h"
 
 #define TDX_TD_ATTRIBUTES_SEPT_VE_DISABLE   BIT_ULL(28)
+#define TDX_TD_ATTRIBUTES_PKS               BIT_ULL(30)
+#define TDX_TD_ATTRIBUTES_PERFMON           BIT_ULL(63)
 
 static TdxGuest *tdx_guest;
 
@@ -151,6 +153,15 @@ static int tdx_kvm_type(X86ConfidentialGuest *cg)
     return KVM_X86_TDX_VM;
 }
 
+static void setup_td_guest_attributes(X86CPU *x86cpu)
+{
+    CPUX86State *env = &x86cpu->env;
+
+    tdx_guest->attributes |= (env->features[FEAT_7_0_ECX] & CPUID_7_0_ECX_PKS) ?
+                             TDX_TD_ATTRIBUTES_PKS : 0;
+    tdx_guest->attributes |= x86cpu->enable_pmu ? TDX_TD_ATTRIBUTES_PERFMON : 0;
+}
+
 static int setup_td_xfam(X86CPU *x86cpu, Error **errp)
 {
     CPUX86State *env = &x86cpu->env;
@@ -214,6 +225,8 @@ int tdx_pre_create_vcpu(CPUState *cpu, Error **errp)
     init_vm = g_malloc0(sizeof(struct kvm_tdx_init_vm) +
                         sizeof(struct kvm_cpuid_entry2) * KVM_MAX_CPUID_ENTRIES);
 
+    setup_td_guest_attributes(x86cpu);
+
     r = setup_td_xfam(x86cpu, errp);
     if (r) {
         return r;

From 53b6f406b4f1a215fb3ec60e56ddba2e019a45ef Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Thu, 8 May 2025 10:59:18 -0400
Subject: [PATCH 1229/2760] i386/tdx: Validate TD attributes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Validate TD attributes with tdx_caps that only supported bits are
allowed by KVM.

Besides, sanity check the attribute bits that have not been supported by
QEMU yet. e.g., debug bit, it will be allowed in the future when debug
TD support lands in QEMU.

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Link: https://lore.kernel.org/r/20250508150002.689633-13-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/kvm/tdx.c | 33 +++++++++++++++++++++++++++++++--
 1 file changed, 31 insertions(+), 2 deletions(-)

diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
index 22d66bdb14..c78a0e8b5e 100644
--- a/target/i386/kvm/tdx.c
+++ b/target/i386/kvm/tdx.c
@@ -18,10 +18,15 @@
 #include "kvm_i386.h"
 #include "tdx.h"
 
+#define TDX_TD_ATTRIBUTES_DEBUG             BIT_ULL(0)
 #define TDX_TD_ATTRIBUTES_SEPT_VE_DISABLE   BIT_ULL(28)
 #define TDX_TD_ATTRIBUTES_PKS               BIT_ULL(30)
 #define TDX_TD_ATTRIBUTES_PERFMON           BIT_ULL(63)
 
+#define TDX_SUPPORTED_TD_ATTRS  (TDX_TD_ATTRIBUTES_SEPT_VE_DISABLE |\
+                                 TDX_TD_ATTRIBUTES_PKS | \
+                                 TDX_TD_ATTRIBUTES_PERFMON)
+
 static TdxGuest *tdx_guest;
 
 static struct kvm_tdx_capabilities *tdx_caps;
@@ -153,13 +158,34 @@ static int tdx_kvm_type(X86ConfidentialGuest *cg)
     return KVM_X86_TDX_VM;
 }
 
-static void setup_td_guest_attributes(X86CPU *x86cpu)
+static int tdx_validate_attributes(TdxGuest *tdx, Error **errp)
+{
+    if ((tdx->attributes & ~tdx_caps->supported_attrs)) {
+        error_setg(errp, "Invalid attributes 0x%lx for TDX VM "
+                   "(KVM supported: 0x%llx)", tdx->attributes,
+                   tdx_caps->supported_attrs);
+        return -1;
+    }
+
+    if (tdx->attributes & ~TDX_SUPPORTED_TD_ATTRS) {
+        error_setg(errp, "Some QEMU unsupported TD attribute bits being "
+                    "requested: 0x%lx (QEMU supported: 0x%llx)",
+                    tdx->attributes, TDX_SUPPORTED_TD_ATTRS);
+        return -1;
+    }
+
+    return 0;
+}
+
+static int setup_td_guest_attributes(X86CPU *x86cpu, Error **errp)
 {
     CPUX86State *env = &x86cpu->env;
 
     tdx_guest->attributes |= (env->features[FEAT_7_0_ECX] & CPUID_7_0_ECX_PKS) ?
                              TDX_TD_ATTRIBUTES_PKS : 0;
     tdx_guest->attributes |= x86cpu->enable_pmu ? TDX_TD_ATTRIBUTES_PERFMON : 0;
+
+    return tdx_validate_attributes(tdx_guest, errp);
 }
 
 static int setup_td_xfam(X86CPU *x86cpu, Error **errp)
@@ -225,7 +251,10 @@ int tdx_pre_create_vcpu(CPUState *cpu, Error **errp)
     init_vm = g_malloc0(sizeof(struct kvm_tdx_init_vm) +
                         sizeof(struct kvm_cpuid_entry2) * KVM_MAX_CPUID_ENTRIES);
 
-    setup_td_guest_attributes(x86cpu);
+    r = setup_td_guest_attributes(x86cpu, errp);
+    if (r) {
+        return r;
+    }
 
     r = setup_td_xfam(x86cpu, errp);
     if (r) {

From d05a0858cf876f79b57a622716fbad07f5b2ea08 Mon Sep 17 00:00:00 2001
From: Isaku Yamahata <isaku.yamahata@intel.com>
Date: Thu, 8 May 2025 10:59:19 -0400
Subject: [PATCH 1230/2760] i386/tdx: Support user configurable
 mrconfigid/mrowner/mrownerconfig

Three sha384 hash values, mrconfigid, mrowner and mrownerconfig, of a TD
can be provided for TDX attestation. Detailed meaning of them can be
found: https://lore.kernel.org/qemu-devel/31d6dbc1-f453-4cef-ab08-4813f4e0ff92@intel.com/

Allow user to specify those values via property mrconfigid, mrowner and
mrownerconfig. They are all in base64 format.

example
-object tdx-guest, \
  mrconfigid=ASNFZ4mrze8BI0VniavN7wEjRWeJq83vASNFZ4mrze8BI0VniavN7wEjRWeJq83v,\
  mrowner=ASNFZ4mrze8BI0VniavN7wEjRWeJq83vASNFZ4mrze8BI0VniavN7wEjRWeJq83v,\
  mrownerconfig=ASNFZ4mrze8BI0VniavN7wEjRWeJq83vASNFZ4mrze8BI0VniavN7wEjRWeJq83v

Signed-off-by: Isaku Yamahata <isaku.yamahata@intel.com>
Co-developed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Acked-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250508150002.689633-14-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 qapi/qom.json         | 16 +++++++-
 target/i386/kvm/tdx.c | 95 +++++++++++++++++++++++++++++++++++++++++++
 target/i386/kvm/tdx.h |  3 ++
 3 files changed, 113 insertions(+), 1 deletion(-)

diff --git a/qapi/qom.json b/qapi/qom.json
index 5a88d36423..45cd47508b 100644
--- a/qapi/qom.json
+++ b/qapi/qom.json
@@ -1060,11 +1060,25 @@
 #     pages.  Some guest OS (e.g., Linux TD guest) may require this to
 #     be set, otherwise they refuse to boot.
 #
+# @mrconfigid: ID for non-owner-defined configuration of the guest TD,
+#     e.g., run-time or OS configuration (base64 encoded SHA384 digest).
+#     Defaults to all zeros.
+#
+# @mrowner: ID for the guest TD’s owner (base64 encoded SHA384 digest).
+#     Defaults to all zeros.
+#
+# @mrownerconfig: ID for owner-defined configuration of the guest TD,
+#     e.g., specific to the workload rather than the run-time or OS
+#     (base64 encoded SHA384 digest).  Defaults to all zeros.
+#
 # Since: 10.1
 ##
 { 'struct': 'TdxGuestProperties',
   'data': { '*attributes': 'uint64',
-            '*sept-ve-disable': 'bool' } }
+            '*sept-ve-disable': 'bool',
+            '*mrconfigid': 'str',
+            '*mrowner': 'str',
+            '*mrownerconfig': 'str' } }
 
 ##
 # @ThreadContextProperties:
diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
index c78a0e8b5e..671f23d910 100644
--- a/target/i386/kvm/tdx.c
+++ b/target/i386/kvm/tdx.c
@@ -11,8 +11,10 @@
 
 #include "qemu/osdep.h"
 #include "qemu/error-report.h"
+#include "qemu/base64.h"
 #include "qapi/error.h"
 #include "qom/object_interfaces.h"
+#include "crypto/hash.h"
 
 #include "hw/i386/x86.h"
 #include "kvm_i386.h"
@@ -240,6 +242,7 @@ int tdx_pre_create_vcpu(CPUState *cpu, Error **errp)
     CPUX86State *env = &x86cpu->env;
     g_autofree struct kvm_tdx_init_vm *init_vm = NULL;
     Error *local_err = NULL;
+    size_t data_len;
     int retry = 10000;
     int r = 0;
 
@@ -251,6 +254,45 @@ int tdx_pre_create_vcpu(CPUState *cpu, Error **errp)
     init_vm = g_malloc0(sizeof(struct kvm_tdx_init_vm) +
                         sizeof(struct kvm_cpuid_entry2) * KVM_MAX_CPUID_ENTRIES);
 
+    if (tdx_guest->mrconfigid) {
+        g_autofree uint8_t *data = qbase64_decode(tdx_guest->mrconfigid,
+                              strlen(tdx_guest->mrconfigid), &data_len, errp);
+        if (!data) {
+            return -1;
+        }
+        if (data_len != QCRYPTO_HASH_DIGEST_LEN_SHA384) {
+            error_setg(errp, "TDX: failed to decode mrconfigid");
+            return -1;
+        }
+        memcpy(init_vm->mrconfigid, data, data_len);
+    }
+
+    if (tdx_guest->mrowner) {
+        g_autofree uint8_t *data = qbase64_decode(tdx_guest->mrowner,
+                              strlen(tdx_guest->mrowner), &data_len, errp);
+        if (!data) {
+            return -1;
+        }
+        if (data_len != QCRYPTO_HASH_DIGEST_LEN_SHA384) {
+            error_setg(errp, "TDX: failed to decode mrowner");
+            return -1;
+        }
+        memcpy(init_vm->mrowner, data, data_len);
+    }
+
+    if (tdx_guest->mrownerconfig) {
+        g_autofree uint8_t *data = qbase64_decode(tdx_guest->mrownerconfig,
+                            strlen(tdx_guest->mrownerconfig), &data_len, errp);
+        if (!data) {
+            return -1;
+        }
+        if (data_len != QCRYPTO_HASH_DIGEST_LEN_SHA384) {
+            error_setg(errp, "TDX: failed to decode mrownerconfig");
+            return -1;
+        }
+        memcpy(init_vm->mrownerconfig, data, data_len);
+    }
+
     r = setup_td_guest_attributes(x86cpu, errp);
     if (r) {
         return r;
@@ -314,6 +356,51 @@ static void tdx_guest_set_sept_ve_disable(Object *obj, bool value, Error **errp)
     }
 }
 
+static char *tdx_guest_get_mrconfigid(Object *obj, Error **errp)
+{
+    TdxGuest *tdx = TDX_GUEST(obj);
+
+    return g_strdup(tdx->mrconfigid);
+}
+
+static void tdx_guest_set_mrconfigid(Object *obj, const char *value, Error **errp)
+{
+    TdxGuest *tdx = TDX_GUEST(obj);
+
+    g_free(tdx->mrconfigid);
+    tdx->mrconfigid = g_strdup(value);
+}
+
+static char *tdx_guest_get_mrowner(Object *obj, Error **errp)
+{
+    TdxGuest *tdx = TDX_GUEST(obj);
+
+    return g_strdup(tdx->mrowner);
+}
+
+static void tdx_guest_set_mrowner(Object *obj, const char *value, Error **errp)
+{
+    TdxGuest *tdx = TDX_GUEST(obj);
+
+    g_free(tdx->mrowner);
+    tdx->mrowner = g_strdup(value);
+}
+
+static char *tdx_guest_get_mrownerconfig(Object *obj, Error **errp)
+{
+    TdxGuest *tdx = TDX_GUEST(obj);
+
+    return g_strdup(tdx->mrownerconfig);
+}
+
+static void tdx_guest_set_mrownerconfig(Object *obj, const char *value, Error **errp)
+{
+    TdxGuest *tdx = TDX_GUEST(obj);
+
+    g_free(tdx->mrownerconfig);
+    tdx->mrownerconfig = g_strdup(value);
+}
+
 /* tdx guest */
 OBJECT_DEFINE_TYPE_WITH_INTERFACES(TdxGuest,
                                    tdx_guest,
@@ -337,6 +424,14 @@ static void tdx_guest_init(Object *obj)
     object_property_add_bool(obj, "sept-ve-disable",
                              tdx_guest_get_sept_ve_disable,
                              tdx_guest_set_sept_ve_disable);
+    object_property_add_str(obj, "mrconfigid",
+                            tdx_guest_get_mrconfigid,
+                            tdx_guest_set_mrconfigid);
+    object_property_add_str(obj, "mrowner",
+                            tdx_guest_get_mrowner, tdx_guest_set_mrowner);
+    object_property_add_str(obj, "mrownerconfig",
+                            tdx_guest_get_mrownerconfig,
+                            tdx_guest_set_mrownerconfig);
 }
 
 static void tdx_guest_finalize(Object *obj)
diff --git a/target/i386/kvm/tdx.h b/target/i386/kvm/tdx.h
index 4e2b5c61ff..e472b11fb0 100644
--- a/target/i386/kvm/tdx.h
+++ b/target/i386/kvm/tdx.h
@@ -24,6 +24,9 @@ typedef struct TdxGuest {
     bool initialized;
     uint64_t attributes;    /* TD attributes */
     uint64_t xfam;
+    char *mrconfigid;       /* base64 encoded sha348 digest */
+    char *mrowner;          /* base64 encoded sha348 digest */
+    char *mrownerconfig;    /* base64 encoded sha348 digest */
 } TdxGuest;
 
 #ifdef CONFIG_TDX

From d529a2ac5ef4620173439942f78ec668f9165fc1 Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Thu, 8 May 2025 10:59:20 -0400
Subject: [PATCH 1231/2760] i386/tdx: Set APIC bus rate to match with what TDX
 module enforces
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

TDX advertises core crystal clock with cpuid[0x15] as 25MHz for TD
guests and it's unchangeable from VMM. As a result, TDX guest reads
the APIC timer at the same frequency, 25MHz.

While KVM's default emulated frequency for APIC bus is 1GHz, set the
APIC bus rate to match with TDX explicitly to ensure KVM provide correct
emulated APIC timer for TD guest.

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250508150002.689633-15-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/kvm/tdx.c | 13 +++++++++++++
 target/i386/kvm/tdx.h |  3 +++
 2 files changed, 16 insertions(+)

diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
index 671f23d910..58983edd80 100644
--- a/target/i386/kvm/tdx.c
+++ b/target/i386/kvm/tdx.c
@@ -254,6 +254,19 @@ int tdx_pre_create_vcpu(CPUState *cpu, Error **errp)
     init_vm = g_malloc0(sizeof(struct kvm_tdx_init_vm) +
                         sizeof(struct kvm_cpuid_entry2) * KVM_MAX_CPUID_ENTRIES);
 
+    if (!kvm_check_extension(kvm_state, KVM_CAP_X86_APIC_BUS_CYCLES_NS)) {
+        error_setg(errp, "KVM doesn't support KVM_CAP_X86_APIC_BUS_CYCLES_NS");
+        return -EOPNOTSUPP;
+    }
+
+    r = kvm_vm_enable_cap(kvm_state, KVM_CAP_X86_APIC_BUS_CYCLES_NS,
+                          0, TDX_APIC_BUS_CYCLES_NS);
+    if (r < 0) {
+        error_setg_errno(errp, -r,
+                         "Unable to set core crystal clock frequency to 25MHz");
+        return r;
+    }
+
     if (tdx_guest->mrconfigid) {
         g_autofree uint8_t *data = qbase64_decode(tdx_guest->mrconfigid,
                               strlen(tdx_guest->mrconfigid), &data_len, errp);
diff --git a/target/i386/kvm/tdx.h b/target/i386/kvm/tdx.h
index e472b11fb0..d39e733d9f 100644
--- a/target/i386/kvm/tdx.h
+++ b/target/i386/kvm/tdx.h
@@ -16,6 +16,9 @@ typedef struct TdxGuestClass {
     X86ConfidentialGuestClass parent_class;
 } TdxGuestClass;
 
+/* TDX requires bus frequency 25MHz */
+#define TDX_APIC_BUS_CYCLES_NS 40
+
 typedef struct TdxGuest {
     X86ConfidentialGuest parent_obj;
 

From 0e73b843616e52882940ab89e1b0e86e22be2162 Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Thu, 8 May 2025 10:59:21 -0400
Subject: [PATCH 1232/2760] i386/tdx: Implement user specified tsc frequency
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reuse "-cpu,tsc-frequency=" to get user wanted tsc frequency and call VM
scope VM_SET_TSC_KHZ to set the tsc frequency of TD before KVM_TDX_INIT_VM.

Besides, sanity check the tsc frequency to be in the legal range and
legal granularity (required by TDX module).

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250508150002.689633-16-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/kvm/kvm.c |  9 +++++++++
 target/i386/kvm/tdx.c | 25 +++++++++++++++++++++++++
 2 files changed, 34 insertions(+)

diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
index e98f1ee26a..fd1817fc5e 100644
--- a/target/i386/kvm/kvm.c
+++ b/target/i386/kvm/kvm.c
@@ -870,6 +870,15 @@ static int kvm_arch_set_tsc_khz(CPUState *cs)
     int r, cur_freq;
     bool set_ioctl = false;
 
+    /*
+     * TSC of TD vcpu is immutable, it cannot be set/changed via vcpu scope
+     * VM_SET_TSC_KHZ, but only be initialized via VM scope VM_SET_TSC_KHZ
+     * before ioctl KVM_TDX_INIT_VM in tdx_pre_create_vcpu()
+     */
+    if (is_tdx_vm()) {
+        return 0;
+    }
+
     if (!env->tsc_khz) {
         return 0;
     }
diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
index 58983edd80..93a16a1aaa 100644
--- a/target/i386/kvm/tdx.c
+++ b/target/i386/kvm/tdx.c
@@ -20,6 +20,9 @@
 #include "kvm_i386.h"
 #include "tdx.h"
 
+#define TDX_MIN_TSC_FREQUENCY_KHZ   (100 * 1000)
+#define TDX_MAX_TSC_FREQUENCY_KHZ   (10 * 1000 * 1000)
+
 #define TDX_TD_ATTRIBUTES_DEBUG             BIT_ULL(0)
 #define TDX_TD_ATTRIBUTES_SEPT_VE_DISABLE   BIT_ULL(28)
 #define TDX_TD_ATTRIBUTES_PKS               BIT_ULL(30)
@@ -267,6 +270,28 @@ int tdx_pre_create_vcpu(CPUState *cpu, Error **errp)
         return r;
     }
 
+    if (env->tsc_khz && (env->tsc_khz < TDX_MIN_TSC_FREQUENCY_KHZ ||
+                         env->tsc_khz > TDX_MAX_TSC_FREQUENCY_KHZ)) {
+        error_setg(errp, "Invalid TSC %ld KHz, must specify cpu_frequency "
+                         "between [%d, %d] kHz", env->tsc_khz,
+                         TDX_MIN_TSC_FREQUENCY_KHZ, TDX_MAX_TSC_FREQUENCY_KHZ);
+       return -EINVAL;
+    }
+
+    if (env->tsc_khz % (25 * 1000)) {
+        error_setg(errp, "Invalid TSC %ld KHz, it must be multiple of 25MHz",
+                   env->tsc_khz);
+        return -EINVAL;
+    }
+
+    /* it's safe even env->tsc_khz is 0. KVM uses host's tsc_khz in this case */
+    r = kvm_vm_ioctl(kvm_state, KVM_SET_TSC_KHZ, env->tsc_khz);
+    if (r < 0) {
+        error_setg_errno(errp, -r, "Unable to set TSC frequency to %ld kHz",
+                         env->tsc_khz);
+        return r;
+    }
+
     if (tdx_guest->mrconfigid) {
         g_autofree uint8_t *data = qbase64_decode(tdx_guest->mrconfigid,
                               strlen(tdx_guest->mrconfigid), &data_len, errp);

From 0dd5fe5ebeabefc7b3d7f043991b1edfe6b8eda9 Mon Sep 17 00:00:00 2001
From: Chao Peng <chao.p.peng@linux.intel.com>
Date: Thu, 8 May 2025 10:59:22 -0400
Subject: [PATCH 1233/2760] i386/tdx: load TDVF for TD guest

TDVF(OVMF) needs to run at private memory for TD guest. TDX cannot
support pflash device since it doesn't support read-only private memory.
Thus load TDVF(OVMF) with -bios option for TDs.

Use memory_region_init_ram_guest_memfd() to allocate the MemoryRegion
for TDVF because it needs to be located at private memory.

Also store the MemoryRegion pointer of TDVF since the shared ramblock of
it can be discared after it gets copied to private ramblock.

Signed-off-by: Chao Peng <chao.p.peng@linux.intel.com>
Co-developed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250508150002.689633-17-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/i386/x86-common.c  | 6 +++++-
 target/i386/kvm/tdx.c | 6 ++++++
 target/i386/kvm/tdx.h | 3 +++
 3 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/hw/i386/x86-common.c b/hw/i386/x86-common.c
index 1b0671c523..b1b5f11e73 100644
--- a/hw/i386/x86-common.c
+++ b/hw/i386/x86-common.c
@@ -44,6 +44,7 @@
 #include "standard-headers/asm-x86/bootparam.h"
 #include CONFIG_DEVICES
 #include "kvm/kvm_i386.h"
+#include "kvm/tdx.h"
 
 #ifdef CONFIG_XEN_EMU
 #include "hw/xen/xen.h"
@@ -1035,11 +1036,14 @@ void x86_bios_rom_init(X86MachineState *x86ms, const char *default_firmware,
     if (machine_require_guest_memfd(MACHINE(x86ms))) {
         memory_region_init_ram_guest_memfd(&x86ms->bios, NULL, "pc.bios",
                                            bios_size, &error_fatal);
+        if (is_tdx_vm()) {
+            tdx_set_tdvf_region(&x86ms->bios);
+        }
     } else {
         memory_region_init_ram(&x86ms->bios, NULL, "pc.bios",
                                bios_size, &error_fatal);
     }
-    if (sev_enabled()) {
+    if (sev_enabled() || is_tdx_vm()) {
         /*
          * The concept of a "reset" simply doesn't exist for
          * confidential computing guests, we have to destroy and
diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
index 93a16a1aaa..0f5acbf980 100644
--- a/target/i386/kvm/tdx.c
+++ b/target/i386/kvm/tdx.c
@@ -137,6 +137,12 @@ static int get_tdx_capabilities(Error **errp)
     return 0;
 }
 
+void tdx_set_tdvf_region(MemoryRegion *tdvf_mr)
+{
+    assert(!tdx_guest->tdvf_mr);
+    tdx_guest->tdvf_mr = tdvf_mr;
+}
+
 static int tdx_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
 {
     TdxGuest *tdx = TDX_GUEST(cgs);
diff --git a/target/i386/kvm/tdx.h b/target/i386/kvm/tdx.h
index d39e733d9f..b73461b8d8 100644
--- a/target/i386/kvm/tdx.h
+++ b/target/i386/kvm/tdx.h
@@ -30,6 +30,8 @@ typedef struct TdxGuest {
     char *mrconfigid;       /* base64 encoded sha348 digest */
     char *mrowner;          /* base64 encoded sha348 digest */
     char *mrownerconfig;    /* base64 encoded sha348 digest */
+
+    MemoryRegion *tdvf_mr;
 } TdxGuest;
 
 #ifdef CONFIG_TDX
@@ -39,5 +41,6 @@ bool is_tdx_vm(void);
 #endif /* CONFIG_TDX */
 
 int tdx_pre_create_vcpu(CPUState *cpu, Error **errp);
+void tdx_set_tdvf_region(MemoryRegion *tdvf_mr);
 
 #endif /* QEMU_I386_TDX_H */

From b65a6011d16c4f7cb2eb227ab1bc735850475288 Mon Sep 17 00:00:00 2001
From: Isaku Yamahata <isaku.yamahata@intel.com>
Date: Thu, 8 May 2025 10:59:23 -0400
Subject: [PATCH 1234/2760] i386/tdvf: Introduce function to parse TDVF
 metadata

TDX VM needs to boot with its specialized firmware, Trusted Domain
Virtual Firmware (TDVF). QEMU needs to parse TDVF and map it in TD
guest memory prior to running the TDX VM.

A TDVF Metadata in TDVF image describes the structure of firmware.
QEMU refers to it to setup memory for TDVF. Introduce function
tdvf_parse_metadata() to parse the metadata from TDVF image and store
the info of each TDVF section.

TDX metadata is located by a TDX metadata offset block, which is a
GUID-ed structure. The data portion of the GUID structure contains
only an 4-byte field that is the offset of TDX metadata to the end
of firmware file.

Select X86_FW_OVMF when TDX is enable to leverage existing functions
to parse and search OVMF's GUID-ed structures.

Signed-off-by: Isaku Yamahata <isaku.yamahata@intel.com>
Co-developed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250508150002.689633-18-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/i386/Kconfig        |   1 +
 hw/i386/meson.build    |   1 +
 hw/i386/tdvf.c         | 188 +++++++++++++++++++++++++++++++++++++++++
 include/hw/i386/tdvf.h |  38 +++++++++
 4 files changed, 228 insertions(+)
 create mode 100644 hw/i386/tdvf.c
 create mode 100644 include/hw/i386/tdvf.h

diff --git a/hw/i386/Kconfig b/hw/i386/Kconfig
index cce9521ba9..eb65bda6e0 100644
--- a/hw/i386/Kconfig
+++ b/hw/i386/Kconfig
@@ -12,6 +12,7 @@ config SGX
 
 config TDX
     bool
+    select X86_FW_OVMF
     depends on KVM
 
 config PC
diff --git a/hw/i386/meson.build b/hw/i386/meson.build
index 10bdfde27c..3bc1da2b6e 100644
--- a/hw/i386/meson.build
+++ b/hw/i386/meson.build
@@ -32,6 +32,7 @@ i386_ss.add(when: 'CONFIG_PC', if_true: files(
   'port92.c'))
 i386_ss.add(when: 'CONFIG_X86_FW_OVMF', if_true: files('pc_sysfw_ovmf.c'),
                                         if_false: files('pc_sysfw_ovmf-stubs.c'))
+i386_ss.add(when: 'CONFIG_TDX', if_true: files('tdvf.c'))
 
 subdir('kvm')
 subdir('xen')
diff --git a/hw/i386/tdvf.c b/hw/i386/tdvf.c
new file mode 100644
index 0000000000..e2d486946a
--- /dev/null
+++ b/hw/i386/tdvf.c
@@ -0,0 +1,188 @@
+/*
+ * Copyright (c) 2025 Intel Corporation
+ * Author: Isaku Yamahata <isaku.yamahata at gmail.com>
+ *                        <isaku.yamahata at intel.com>
+ *         Xiaoyao Li <xiaoyao.li@intel.com>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/error-report.h"
+
+#include "hw/i386/pc.h"
+#include "hw/i386/tdvf.h"
+#include "system/kvm.h"
+
+#define TDX_METADATA_OFFSET_GUID    "e47a6535-984a-4798-865e-4685a7bf8ec2"
+#define TDX_METADATA_VERSION        1
+#define TDVF_SIGNATURE              0x46564454 /* TDVF as little endian */
+#define TDVF_ALIGNMENT              4096
+
+/*
+ * the raw structs read from TDVF keeps the name convention in
+ * TDVF Design Guide spec.
+ */
+typedef struct {
+    uint32_t DataOffset;
+    uint32_t RawDataSize;
+    uint64_t MemoryAddress;
+    uint64_t MemoryDataSize;
+    uint32_t Type;
+    uint32_t Attributes;
+} TdvfSectionEntry;
+
+typedef struct {
+    uint32_t Signature;
+    uint32_t Length;
+    uint32_t Version;
+    uint32_t NumberOfSectionEntries;
+    TdvfSectionEntry SectionEntries[];
+} TdvfMetadata;
+
+struct tdx_metadata_offset {
+    uint32_t offset;
+};
+
+static TdvfMetadata *tdvf_get_metadata(void *flash_ptr, int size)
+{
+    TdvfMetadata *metadata;
+    uint32_t offset = 0;
+    uint8_t *data;
+
+    if ((uint32_t) size != size) {
+        return NULL;
+    }
+
+    if (pc_system_ovmf_table_find(TDX_METADATA_OFFSET_GUID, &data, NULL)) {
+        offset = size - le32_to_cpu(((struct tdx_metadata_offset *)data)->offset);
+
+        if (offset + sizeof(*metadata) > size) {
+            return NULL;
+        }
+    } else {
+        error_report("Cannot find TDX_METADATA_OFFSET_GUID");
+        return NULL;
+    }
+
+    metadata = flash_ptr + offset;
+
+    /* Finally, verify the signature to determine if this is a TDVF image. */
+    metadata->Signature = le32_to_cpu(metadata->Signature);
+    if (metadata->Signature != TDVF_SIGNATURE) {
+        error_report("Invalid TDVF signature in metadata!");
+        return NULL;
+    }
+
+    /* Sanity check that the TDVF doesn't overlap its own metadata. */
+    metadata->Length = le32_to_cpu(metadata->Length);
+    if (offset + metadata->Length > size) {
+        return NULL;
+    }
+
+    /* Only version 1 is supported/defined. */
+    metadata->Version = le32_to_cpu(metadata->Version);
+    if (metadata->Version != TDX_METADATA_VERSION) {
+        return NULL;
+    }
+
+    return metadata;
+}
+
+static int tdvf_parse_and_check_section_entry(const TdvfSectionEntry *src,
+                                              TdxFirmwareEntry *entry)
+{
+    entry->data_offset = le32_to_cpu(src->DataOffset);
+    entry->data_len = le32_to_cpu(src->RawDataSize);
+    entry->address = le64_to_cpu(src->MemoryAddress);
+    entry->size = le64_to_cpu(src->MemoryDataSize);
+    entry->type = le32_to_cpu(src->Type);
+    entry->attributes = le32_to_cpu(src->Attributes);
+
+    /* sanity check */
+    if (entry->size < entry->data_len) {
+        error_report("Broken metadata RawDataSize 0x%x MemoryDataSize 0x%lx",
+                     entry->data_len, entry->size);
+        return -1;
+    }
+    if (!QEMU_IS_ALIGNED(entry->address, TDVF_ALIGNMENT)) {
+        error_report("MemoryAddress 0x%lx not page aligned", entry->address);
+        return -1;
+    }
+    if (!QEMU_IS_ALIGNED(entry->size, TDVF_ALIGNMENT)) {
+        error_report("MemoryDataSize 0x%lx not page aligned", entry->size);
+        return -1;
+    }
+
+    switch (entry->type) {
+    case TDVF_SECTION_TYPE_BFV:
+    case TDVF_SECTION_TYPE_CFV:
+        /* The sections that must be copied from firmware image to TD memory */
+        if (entry->data_len == 0) {
+            error_report("%d section with RawDataSize == 0", entry->type);
+            return -1;
+        }
+        break;
+    case TDVF_SECTION_TYPE_TD_HOB:
+    case TDVF_SECTION_TYPE_TEMP_MEM:
+        /* The sections that no need to be copied from firmware image */
+        if (entry->data_len != 0) {
+            error_report("%d section with RawDataSize 0x%x != 0",
+                         entry->type, entry->data_len);
+            return -1;
+        }
+        break;
+    default:
+        error_report("TDVF contains unsupported section type %d", entry->type);
+        return -1;
+    }
+
+    return 0;
+}
+
+int tdvf_parse_metadata(TdxFirmware *fw, void *flash_ptr, int size)
+{
+    g_autofree TdvfSectionEntry *sections = NULL;
+    TdvfMetadata *metadata;
+    ssize_t entries_size;
+    int i;
+
+    metadata = tdvf_get_metadata(flash_ptr, size);
+    if (!metadata) {
+        return -EINVAL;
+    }
+
+    /* load and parse metadata entries */
+    fw->nr_entries = le32_to_cpu(metadata->NumberOfSectionEntries);
+    if (fw->nr_entries < 2) {
+        error_report("Invalid number of fw entries (%u) in TDVF Metadata",
+                     fw->nr_entries);
+        return -EINVAL;
+    }
+
+    entries_size = fw->nr_entries * sizeof(TdvfSectionEntry);
+    if (metadata->Length != sizeof(*metadata) + entries_size) {
+        error_report("TDVF metadata len (0x%x) mismatch, expected (0x%x)",
+                     metadata->Length,
+                     (uint32_t)(sizeof(*metadata) + entries_size));
+        return -EINVAL;
+    }
+
+    fw->entries = g_new(TdxFirmwareEntry, fw->nr_entries);
+    sections = g_new(TdvfSectionEntry, fw->nr_entries);
+
+    memcpy(sections, (void *)metadata + sizeof(*metadata), entries_size);
+
+    for (i = 0; i < fw->nr_entries; i++) {
+        if (tdvf_parse_and_check_section_entry(&sections[i], &fw->entries[i])) {
+            goto err;
+        }
+    }
+
+    return 0;
+
+err:
+    fw->entries = 0;
+    g_free(fw->entries);
+    return -EINVAL;
+}
diff --git a/include/hw/i386/tdvf.h b/include/hw/i386/tdvf.h
new file mode 100644
index 0000000000..7ebcac42a3
--- /dev/null
+++ b/include/hw/i386/tdvf.h
@@ -0,0 +1,38 @@
+/*
+ * Copyright (c) 2025 Intel Corporation
+ * Author: Isaku Yamahata <isaku.yamahata at gmail.com>
+ *                        <isaku.yamahata at intel.com>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef HW_I386_TDVF_H
+#define HW_I386_TDVF_H
+
+#include "qemu/osdep.h"
+
+#define TDVF_SECTION_TYPE_BFV               0
+#define TDVF_SECTION_TYPE_CFV               1
+#define TDVF_SECTION_TYPE_TD_HOB            2
+#define TDVF_SECTION_TYPE_TEMP_MEM          3
+
+#define TDVF_SECTION_ATTRIBUTES_MR_EXTEND   (1U << 0)
+#define TDVF_SECTION_ATTRIBUTES_PAGE_AUG    (1U << 1)
+
+typedef struct TdxFirmwareEntry {
+    uint32_t data_offset;
+    uint32_t data_len;
+    uint64_t address;
+    uint64_t size;
+    uint32_t type;
+    uint32_t attributes;
+} TdxFirmwareEntry;
+
+typedef struct TdxFirmware {
+    uint32_t nr_entries;
+    TdxFirmwareEntry *entries;
+} TdxFirmware;
+
+int tdvf_parse_metadata(TdxFirmware *fw, void *flash_ptr, int size);
+
+#endif /* HW_I386_TDVF_H */

From cb5d65a854e58abeb705a2ce14cc3eb28973c606 Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Thu, 8 May 2025 10:59:24 -0400
Subject: [PATCH 1235/2760] i386/tdx: Parse TDVF metadata for TDX VM
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

After TDVF is loaded to bios MemoryRegion, it needs parse TDVF metadata.

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250508150002.689633-19-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/i386/pc_sysfw.c         | 7 +++++++
 target/i386/kvm/tdx-stub.c | 5 +++++
 target/i386/kvm/tdx.c      | 5 +++++
 target/i386/kvm/tdx.h      | 3 +++
 4 files changed, 20 insertions(+)

diff --git a/hw/i386/pc_sysfw.c b/hw/i386/pc_sysfw.c
index 1eeb58ab37..821396c16e 100644
--- a/hw/i386/pc_sysfw.c
+++ b/hw/i386/pc_sysfw.c
@@ -37,6 +37,7 @@
 #include "hw/block/flash.h"
 #include "system/kvm.h"
 #include "target/i386/sev.h"
+#include "kvm/tdx.h"
 
 #define FLASH_SECTOR_SIZE 4096
 
@@ -280,5 +281,11 @@ void x86_firmware_configure(hwaddr gpa, void *ptr, int size)
         }
 
         sev_encrypt_flash(gpa, ptr, size, &error_fatal);
+    } else if (is_tdx_vm()) {
+        ret = tdx_parse_tdvf(ptr, size);
+        if (ret) {
+            error_report("failed to parse TDVF for TDX VM");
+            exit(1);
+        }
     }
 }
diff --git a/target/i386/kvm/tdx-stub.c b/target/i386/kvm/tdx-stub.c
index 2344433594..7748b6d0a4 100644
--- a/target/i386/kvm/tdx-stub.c
+++ b/target/i386/kvm/tdx-stub.c
@@ -8,3 +8,8 @@ int tdx_pre_create_vcpu(CPUState *cpu, Error **errp)
 {
     return -EINVAL;
 }
+
+int tdx_parse_tdvf(void *flash_ptr, int size)
+{
+    return -EINVAL;
+}
diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
index 0f5acbf980..18beba2f5c 100644
--- a/target/i386/kvm/tdx.c
+++ b/target/i386/kvm/tdx.c
@@ -382,6 +382,11 @@ int tdx_pre_create_vcpu(CPUState *cpu, Error **errp)
     return 0;
 }
 
+int tdx_parse_tdvf(void *flash_ptr, int size)
+{
+    return tdvf_parse_metadata(&tdx_guest->tdvf, flash_ptr, size);
+}
+
 static bool tdx_guest_get_sept_ve_disable(Object *obj, Error **errp)
 {
     TdxGuest *tdx = TDX_GUEST(obj);
diff --git a/target/i386/kvm/tdx.h b/target/i386/kvm/tdx.h
index b73461b8d8..28a03c2a7b 100644
--- a/target/i386/kvm/tdx.h
+++ b/target/i386/kvm/tdx.h
@@ -8,6 +8,7 @@
 #endif
 
 #include "confidential-guest.h"
+#include "hw/i386/tdvf.h"
 
 #define TYPE_TDX_GUEST "tdx-guest"
 #define TDX_GUEST(obj)  OBJECT_CHECK(TdxGuest, (obj), TYPE_TDX_GUEST)
@@ -32,6 +33,7 @@ typedef struct TdxGuest {
     char *mrownerconfig;    /* base64 encoded sha348 digest */
 
     MemoryRegion *tdvf_mr;
+    TdxFirmware tdvf;
 } TdxGuest;
 
 #ifdef CONFIG_TDX
@@ -42,5 +44,6 @@ bool is_tdx_vm(void);
 
 int tdx_pre_create_vcpu(CPUState *cpu, Error **errp);
 void tdx_set_tdvf_region(MemoryRegion *tdvf_mr);
+int tdx_parse_tdvf(void *flash_ptr, int size);
 
 #endif /* QEMU_I386_TDX_H */

From 49b1f0f812372129736c1df0421c8f67d86d362b Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Thu, 8 May 2025 10:59:25 -0400
Subject: [PATCH 1236/2760] i386/tdx: Don't initialize pc.rom for TDX VMs

For TDX, the address below 1MB are entirely general RAM. No need to
initialize pc.rom memory region for TDs.

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250508150002.689633-20-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/i386/pc.c | 29 ++++++++++++++++-------------
 1 file changed, 16 insertions(+), 13 deletions(-)

diff --git a/hw/i386/pc.c b/hw/i386/pc.c
index 70656157ca..a403987a64 100644
--- a/hw/i386/pc.c
+++ b/hw/i386/pc.c
@@ -44,6 +44,7 @@
 #include "system/xen.h"
 #include "system/reset.h"
 #include "kvm/kvm_i386.h"
+#include "kvm/tdx.h"
 #include "hw/xen/xen.h"
 #include "qobject/qlist.h"
 #include "qemu/error-report.h"
@@ -976,21 +977,23 @@ void pc_memory_init(PCMachineState *pcms,
     /* Initialize PC system firmware */
     pc_system_firmware_init(pcms, rom_memory);
 
-    option_rom_mr = g_malloc(sizeof(*option_rom_mr));
-    if (machine_require_guest_memfd(machine)) {
-        memory_region_init_ram_guest_memfd(option_rom_mr, NULL, "pc.rom",
-                                           PC_ROM_SIZE, &error_fatal);
-    } else {
-        memory_region_init_ram(option_rom_mr, NULL, "pc.rom", PC_ROM_SIZE,
-                               &error_fatal);
-        if (pcmc->pci_enabled) {
-            memory_region_set_readonly(option_rom_mr, true);
+    if (!is_tdx_vm()) {
+        option_rom_mr = g_malloc(sizeof(*option_rom_mr));
+        if (machine_require_guest_memfd(machine)) {
+            memory_region_init_ram_guest_memfd(option_rom_mr, NULL, "pc.rom",
+                                            PC_ROM_SIZE, &error_fatal);
+        } else {
+            memory_region_init_ram(option_rom_mr, NULL, "pc.rom", PC_ROM_SIZE,
+                                &error_fatal);
+            if (pcmc->pci_enabled) {
+                memory_region_set_readonly(option_rom_mr, true);
+            }
         }
+        memory_region_add_subregion_overlap(rom_memory,
+                                            PC_ROM_MIN_VGA,
+                                            option_rom_mr,
+                                            1);
     }
-    memory_region_add_subregion_overlap(rom_memory,
-                                        PC_ROM_MIN_VGA,
-                                        option_rom_mr,
-                                        1);
 
     fw_cfg = fw_cfg_arch_create(machine,
                                 x86ms->boot_cpus, x86ms->apic_id_limit);

From 4420ba0ebbf014acc68f78669e0767e288313ed6 Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Thu, 8 May 2025 10:59:26 -0400
Subject: [PATCH 1237/2760] i386/tdx: Track mem_ptr for each firmware entry of
 TDVF

For each TDVF sections, QEMU needs to copy the content to guest
private memory via KVM API (KVM_TDX_INIT_MEM_REGION).

Introduce a field @mem_ptr for TdxFirmwareEntry to track the memory
pointer of each TDVF sections. So that QEMU can add/copy them to guest
private memory later.

TDVF sections can be classified into two groups:
 - Firmware itself, e.g., TDVF BFV and CFV, that located separately from
   guest RAM. Its memory pointer is the bios pointer.

 - Sections located at guest RAM, e.g., TEMP_MEM and TD_HOB.
   mmap a new memory range for them.

Register a machine_init_done callback to do the stuff.

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250508150002.689633-21-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/i386/tdvf.c         |  1 +
 include/hw/i386/tdvf.h |  7 +++++++
 target/i386/kvm/tdx.c  | 37 +++++++++++++++++++++++++++++++++++++
 3 files changed, 45 insertions(+)

diff --git a/hw/i386/tdvf.c b/hw/i386/tdvf.c
index e2d486946a..bd993ea2f0 100644
--- a/hw/i386/tdvf.c
+++ b/hw/i386/tdvf.c
@@ -179,6 +179,7 @@ int tdvf_parse_metadata(TdxFirmware *fw, void *flash_ptr, int size)
         }
     }
 
+    fw->mem_ptr = flash_ptr;
     return 0;
 
 err:
diff --git a/include/hw/i386/tdvf.h b/include/hw/i386/tdvf.h
index 7ebcac42a3..e75c8d1acc 100644
--- a/include/hw/i386/tdvf.h
+++ b/include/hw/i386/tdvf.h
@@ -26,13 +26,20 @@ typedef struct TdxFirmwareEntry {
     uint64_t size;
     uint32_t type;
     uint32_t attributes;
+
+    void *mem_ptr;
 } TdxFirmwareEntry;
 
 typedef struct TdxFirmware {
+    void *mem_ptr;
+
     uint32_t nr_entries;
     TdxFirmwareEntry *entries;
 } TdxFirmware;
 
+#define for_each_tdx_fw_entry(fw, e)    \
+    for (e = (fw)->entries; e != (fw)->entries + (fw)->nr_entries; e++)
+
 int tdvf_parse_metadata(TdxFirmware *fw, void *flash_ptr, int size);
 
 #endif /* HW_I386_TDVF_H */
diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
index 18beba2f5c..bfdae4f1c0 100644
--- a/target/i386/kvm/tdx.c
+++ b/target/i386/kvm/tdx.c
@@ -12,10 +12,13 @@
 #include "qemu/osdep.h"
 #include "qemu/error-report.h"
 #include "qemu/base64.h"
+#include "qemu/mmap-alloc.h"
 #include "qapi/error.h"
 #include "qom/object_interfaces.h"
 #include "crypto/hash.h"
+#include "system/system.h"
 
+#include "hw/i386/tdvf.h"
 #include "hw/i386/x86.h"
 #include "kvm_i386.h"
 #include "tdx.h"
@@ -143,6 +146,38 @@ void tdx_set_tdvf_region(MemoryRegion *tdvf_mr)
     tdx_guest->tdvf_mr = tdvf_mr;
 }
 
+static void tdx_finalize_vm(Notifier *notifier, void *unused)
+{
+    TdxFirmware *tdvf = &tdx_guest->tdvf;
+    TdxFirmwareEntry *entry;
+
+    for_each_tdx_fw_entry(tdvf, entry) {
+        switch (entry->type) {
+        case TDVF_SECTION_TYPE_BFV:
+        case TDVF_SECTION_TYPE_CFV:
+            entry->mem_ptr = tdvf->mem_ptr + entry->data_offset;
+            break;
+        case TDVF_SECTION_TYPE_TD_HOB:
+        case TDVF_SECTION_TYPE_TEMP_MEM:
+            entry->mem_ptr = qemu_ram_mmap(-1, entry->size,
+                                           qemu_real_host_page_size(), 0, 0);
+            if (entry->mem_ptr == MAP_FAILED) {
+                error_report("Failed to mmap memory for TDVF section %d",
+                             entry->type);
+                exit(1);
+            }
+            break;
+        default:
+            error_report("Unsupported TDVF section %d", entry->type);
+            exit(1);
+        }
+    }
+}
+
+static Notifier tdx_machine_done_notify = {
+    .notify = tdx_finalize_vm,
+};
+
 static int tdx_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
 {
     TdxGuest *tdx = TDX_GUEST(cgs);
@@ -157,6 +192,8 @@ static int tdx_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
         }
     }
 
+    qemu_add_machine_init_done_notifier(&tdx_machine_done_notify);
+
     tdx_guest = tdx;
     return 0;
 }

From f18672e4cf91feed4b91ef85a264a500935a2865 Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Thu, 8 May 2025 10:59:27 -0400
Subject: [PATCH 1238/2760] i386/tdx: Track RAM entries for TDX VM

The RAM of TDX VM can be classified into two types:

 - TDX_RAM_UNACCEPTED: default type of TDX memory, which needs to be
   accepted by TDX guest before it can be used and will be all-zeros
   after being accepted.

 - TDX_RAM_ADDED: the RAM that is ADD'ed to TD guest before running, and
   can be used directly. E.g., TD HOB and TEMP MEM that needed by TDVF.

Maintain TdxRamEntries[] which grabs the initial RAM info from e820 table
and mark each RAM range as default type TDX_RAM_UNACCEPTED.

Then turn the range of TD HOB and TEMP MEM to TDX_RAM_ADDED since these
ranges will be ADD'ed before TD runs and no need to be accepted runtime.

The TdxRamEntries[] are later used to setup the memory TD resource HOB
that passes memory info from QEMU to TDVF.

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250508150002.689633-22-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/kvm/tdx.c | 109 ++++++++++++++++++++++++++++++++++++++++++
 target/i386/kvm/tdx.h |  14 ++++++
 2 files changed, 123 insertions(+)

diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
index bfdae4f1c0..e06f5d0bd4 100644
--- a/target/i386/kvm/tdx.c
+++ b/target/i386/kvm/tdx.c
@@ -18,6 +18,7 @@
 #include "crypto/hash.h"
 #include "system/system.h"
 
+#include "hw/i386/e820_memory_layout.h"
 #include "hw/i386/tdvf.h"
 #include "hw/i386/x86.h"
 #include "kvm_i386.h"
@@ -146,11 +147,110 @@ void tdx_set_tdvf_region(MemoryRegion *tdvf_mr)
     tdx_guest->tdvf_mr = tdvf_mr;
 }
 
+static void tdx_add_ram_entry(uint64_t address, uint64_t length,
+                              enum TdxRamType type)
+{
+    uint32_t nr_entries = tdx_guest->nr_ram_entries;
+    tdx_guest->ram_entries = g_renew(TdxRamEntry, tdx_guest->ram_entries,
+                                     nr_entries + 1);
+
+    tdx_guest->ram_entries[nr_entries].address = address;
+    tdx_guest->ram_entries[nr_entries].length = length;
+    tdx_guest->ram_entries[nr_entries].type = type;
+    tdx_guest->nr_ram_entries++;
+}
+
+static int tdx_accept_ram_range(uint64_t address, uint64_t length)
+{
+    uint64_t head_start, tail_start, head_length, tail_length;
+    uint64_t tmp_address, tmp_length;
+    TdxRamEntry *e;
+    int i = 0;
+
+    do {
+        if (i == tdx_guest->nr_ram_entries) {
+            return -1;
+        }
+
+        e = &tdx_guest->ram_entries[i++];
+    } while (address + length <= e->address || address >= e->address + e->length);
+
+    /*
+     * The to-be-accepted ram range must be fully contained by one
+     * RAM entry.
+     */
+    if (e->address > address ||
+        e->address + e->length < address + length) {
+        return -1;
+    }
+
+    if (e->type == TDX_RAM_ADDED) {
+        return 0;
+    }
+
+    tmp_address = e->address;
+    tmp_length = e->length;
+
+    e->address = address;
+    e->length = length;
+    e->type = TDX_RAM_ADDED;
+
+    head_length = address - tmp_address;
+    if (head_length > 0) {
+        head_start = tmp_address;
+        tdx_add_ram_entry(head_start, head_length, TDX_RAM_UNACCEPTED);
+    }
+
+    tail_start = address + length;
+    if (tail_start < tmp_address + tmp_length) {
+        tail_length = tmp_address + tmp_length - tail_start;
+        tdx_add_ram_entry(tail_start, tail_length, TDX_RAM_UNACCEPTED);
+    }
+
+    return 0;
+}
+
+static int tdx_ram_entry_compare(const void *lhs_, const void* rhs_)
+{
+    const TdxRamEntry *lhs = lhs_;
+    const TdxRamEntry *rhs = rhs_;
+
+    if (lhs->address == rhs->address) {
+        return 0;
+    }
+    if (le64_to_cpu(lhs->address) > le64_to_cpu(rhs->address)) {
+        return 1;
+    }
+    return -1;
+}
+
+static void tdx_init_ram_entries(void)
+{
+    unsigned i, j, nr_e820_entries;
+
+    nr_e820_entries = e820_get_table(NULL);
+    tdx_guest->ram_entries = g_new(TdxRamEntry, nr_e820_entries);
+
+    for (i = 0, j = 0; i < nr_e820_entries; i++) {
+        uint64_t addr, len;
+
+        if (e820_get_entry(i, E820_RAM, &addr, &len)) {
+            tdx_guest->ram_entries[j].address = addr;
+            tdx_guest->ram_entries[j].length = len;
+            tdx_guest->ram_entries[j].type = TDX_RAM_UNACCEPTED;
+            j++;
+        }
+    }
+    tdx_guest->nr_ram_entries = j;
+}
+
 static void tdx_finalize_vm(Notifier *notifier, void *unused)
 {
     TdxFirmware *tdvf = &tdx_guest->tdvf;
     TdxFirmwareEntry *entry;
 
+    tdx_init_ram_entries();
+
     for_each_tdx_fw_entry(tdvf, entry) {
         switch (entry->type) {
         case TDVF_SECTION_TYPE_BFV:
@@ -166,12 +266,21 @@ static void tdx_finalize_vm(Notifier *notifier, void *unused)
                              entry->type);
                 exit(1);
             }
+            if (tdx_accept_ram_range(entry->address, entry->size)) {
+                error_report("Failed to accept memory for TDVF section %d",
+                             entry->type);
+                qemu_ram_munmap(-1, entry->mem_ptr, entry->size);
+                exit(1);
+            }
             break;
         default:
             error_report("Unsupported TDVF section %d", entry->type);
             exit(1);
         }
     }
+
+    qsort(tdx_guest->ram_entries, tdx_guest->nr_ram_entries,
+          sizeof(TdxRamEntry), &tdx_ram_entry_compare);
 }
 
 static Notifier tdx_machine_done_notify = {
diff --git a/target/i386/kvm/tdx.h b/target/i386/kvm/tdx.h
index 28a03c2a7b..36a7400e74 100644
--- a/target/i386/kvm/tdx.h
+++ b/target/i386/kvm/tdx.h
@@ -20,6 +20,17 @@ typedef struct TdxGuestClass {
 /* TDX requires bus frequency 25MHz */
 #define TDX_APIC_BUS_CYCLES_NS 40
 
+enum TdxRamType {
+    TDX_RAM_UNACCEPTED,
+    TDX_RAM_ADDED,
+};
+
+typedef struct TdxRamEntry {
+    uint64_t address;
+    uint64_t length;
+    enum TdxRamType type;
+} TdxRamEntry;
+
 typedef struct TdxGuest {
     X86ConfidentialGuest parent_obj;
 
@@ -34,6 +45,9 @@ typedef struct TdxGuest {
 
     MemoryRegion *tdvf_mr;
     TdxFirmware tdvf;
+
+    uint32_t nr_ram_entries;
+    TdxRamEntry *ram_entries;
 } TdxGuest;
 
 #ifdef CONFIG_TDX

From 88aa6576e4ab40b538f543852128cb17fce37f87 Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Thu, 8 May 2025 10:59:28 -0400
Subject: [PATCH 1239/2760] headers: Add definitions from UEFI spec for
 volumes, resources, etc...

Add UEFI definitions for literals, enums, structs, GUIDs, etc... that
will be used by TDX to build the UEFI Hand-Off Block (HOB) that is passed
to the Trusted Domain Virtual Firmware (TDVF).

All values come from the UEFI specification [1], PI spec [2] and TDVF
design guide[3].

[1] UEFI Specification v2.1.0 https://uefi.org/sites/default/files/resources/UEFI_Spec_2_10_Aug29.pdf
[2] UEFI PI spec v1.8 https://uefi.org/sites/default/files/resources/UEFI_PI_Spec_1_8_March3.pdf
[3] https://software.intel.com/content/dam/develop/external/us/en/documents/tdx-virtual-firmware-design-guide-rev-1.pdf

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250508150002.689633-23-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 include/standard-headers/uefi/uefi.h | 187 +++++++++++++++++++++++++++
 1 file changed, 187 insertions(+)
 create mode 100644 include/standard-headers/uefi/uefi.h

diff --git a/include/standard-headers/uefi/uefi.h b/include/standard-headers/uefi/uefi.h
new file mode 100644
index 0000000000..5256349ec0
--- /dev/null
+++ b/include/standard-headers/uefi/uefi.h
@@ -0,0 +1,187 @@
+/*
+ * Copyright (C) 2025 Intel Corporation
+ *
+ * Author: Isaku Yamahata <isaku.yamahata at gmail.com>
+ *                        <isaku.yamahata at intel.com>
+ *         Xiaoyao Li <xiaoyao.li@intel.com>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef HW_I386_UEFI_H
+#define HW_I386_UEFI_H
+
+/***************************************************************************/
+/*
+ * basic EFI definitions
+ * supplemented with UEFI Specification Version 2.8 (Errata A)
+ * released February 2020
+ */
+/* UEFI integer is little endian */
+
+typedef struct {
+    uint32_t Data1;
+    uint16_t Data2;
+    uint16_t Data3;
+    uint8_t Data4[8];
+} EFI_GUID;
+
+typedef enum {
+    EfiReservedMemoryType,
+    EfiLoaderCode,
+    EfiLoaderData,
+    EfiBootServicesCode,
+    EfiBootServicesData,
+    EfiRuntimeServicesCode,
+    EfiRuntimeServicesData,
+    EfiConventionalMemory,
+    EfiUnusableMemory,
+    EfiACPIReclaimMemory,
+    EfiACPIMemoryNVS,
+    EfiMemoryMappedIO,
+    EfiMemoryMappedIOPortSpace,
+    EfiPalCode,
+    EfiPersistentMemory,
+    EfiUnacceptedMemoryType,
+    EfiMaxMemoryType
+} EFI_MEMORY_TYPE;
+
+#define EFI_HOB_HANDOFF_TABLE_VERSION 0x0009
+
+#define EFI_HOB_TYPE_HANDOFF              0x0001
+#define EFI_HOB_TYPE_MEMORY_ALLOCATION    0x0002
+#define EFI_HOB_TYPE_RESOURCE_DESCRIPTOR  0x0003
+#define EFI_HOB_TYPE_GUID_EXTENSION       0x0004
+#define EFI_HOB_TYPE_FV                   0x0005
+#define EFI_HOB_TYPE_CPU                  0x0006
+#define EFI_HOB_TYPE_MEMORY_POOL          0x0007
+#define EFI_HOB_TYPE_FV2                  0x0009
+#define EFI_HOB_TYPE_LOAD_PEIM_UNUSED     0x000A
+#define EFI_HOB_TYPE_UEFI_CAPSULE         0x000B
+#define EFI_HOB_TYPE_FV3                  0x000C
+#define EFI_HOB_TYPE_UNUSED               0xFFFE
+#define EFI_HOB_TYPE_END_OF_HOB_LIST      0xFFFF
+
+typedef struct {
+    uint16_t HobType;
+    uint16_t HobLength;
+    uint32_t Reserved;
+} EFI_HOB_GENERIC_HEADER;
+
+typedef uint64_t EFI_PHYSICAL_ADDRESS;
+typedef uint32_t EFI_BOOT_MODE;
+
+typedef struct {
+    EFI_HOB_GENERIC_HEADER Header;
+    uint32_t Version;
+    EFI_BOOT_MODE BootMode;
+    EFI_PHYSICAL_ADDRESS EfiMemoryTop;
+    EFI_PHYSICAL_ADDRESS EfiMemoryBottom;
+    EFI_PHYSICAL_ADDRESS EfiFreeMemoryTop;
+    EFI_PHYSICAL_ADDRESS EfiFreeMemoryBottom;
+    EFI_PHYSICAL_ADDRESS EfiEndOfHobList;
+} EFI_HOB_HANDOFF_INFO_TABLE;
+
+#define EFI_RESOURCE_SYSTEM_MEMORY          0x00000000
+#define EFI_RESOURCE_MEMORY_MAPPED_IO       0x00000001
+#define EFI_RESOURCE_IO                     0x00000002
+#define EFI_RESOURCE_FIRMWARE_DEVICE        0x00000003
+#define EFI_RESOURCE_MEMORY_MAPPED_IO_PORT  0x00000004
+#define EFI_RESOURCE_MEMORY_RESERVED        0x00000005
+#define EFI_RESOURCE_IO_RESERVED            0x00000006
+#define EFI_RESOURCE_MEMORY_UNACCEPTED      0x00000007
+#define EFI_RESOURCE_MAX_MEMORY_TYPE        0x00000008
+
+#define EFI_RESOURCE_ATTRIBUTE_PRESENT                  0x00000001
+#define EFI_RESOURCE_ATTRIBUTE_INITIALIZED              0x00000002
+#define EFI_RESOURCE_ATTRIBUTE_TESTED                   0x00000004
+#define EFI_RESOURCE_ATTRIBUTE_SINGLE_BIT_ECC           0x00000008
+#define EFI_RESOURCE_ATTRIBUTE_MULTIPLE_BIT_ECC         0x00000010
+#define EFI_RESOURCE_ATTRIBUTE_ECC_RESERVED_1           0x00000020
+#define EFI_RESOURCE_ATTRIBUTE_ECC_RESERVED_2           0x00000040
+#define EFI_RESOURCE_ATTRIBUTE_READ_PROTECTED           0x00000080
+#define EFI_RESOURCE_ATTRIBUTE_WRITE_PROTECTED          0x00000100
+#define EFI_RESOURCE_ATTRIBUTE_EXECUTION_PROTECTED      0x00000200
+#define EFI_RESOURCE_ATTRIBUTE_UNCACHEABLE              0x00000400
+#define EFI_RESOURCE_ATTRIBUTE_WRITE_COMBINEABLE        0x00000800
+#define EFI_RESOURCE_ATTRIBUTE_WRITE_THROUGH_CACHEABLE  0x00001000
+#define EFI_RESOURCE_ATTRIBUTE_WRITE_BACK_CACHEABLE     0x00002000
+#define EFI_RESOURCE_ATTRIBUTE_16_BIT_IO                0x00004000
+#define EFI_RESOURCE_ATTRIBUTE_32_BIT_IO                0x00008000
+#define EFI_RESOURCE_ATTRIBUTE_64_BIT_IO                0x00010000
+#define EFI_RESOURCE_ATTRIBUTE_UNCACHED_EXPORTED        0x00020000
+#define EFI_RESOURCE_ATTRIBUTE_READ_ONLY_PROTECTED      0x00040000
+#define EFI_RESOURCE_ATTRIBUTE_READ_ONLY_PROTECTABLE    0x00080000
+#define EFI_RESOURCE_ATTRIBUTE_READ_PROTECTABLE         0x00100000
+#define EFI_RESOURCE_ATTRIBUTE_WRITE_PROTECTABLE        0x00200000
+#define EFI_RESOURCE_ATTRIBUTE_EXECUTION_PROTECTABLE    0x00400000
+#define EFI_RESOURCE_ATTRIBUTE_PERSISTENT               0x00800000
+#define EFI_RESOURCE_ATTRIBUTE_PERSISTABLE              0x01000000
+#define EFI_RESOURCE_ATTRIBUTE_MORE_RELIABLE            0x02000000
+
+typedef uint32_t EFI_RESOURCE_TYPE;
+typedef uint32_t EFI_RESOURCE_ATTRIBUTE_TYPE;
+
+typedef struct {
+    EFI_HOB_GENERIC_HEADER Header;
+    EFI_GUID Owner;
+    EFI_RESOURCE_TYPE ResourceType;
+    EFI_RESOURCE_ATTRIBUTE_TYPE ResourceAttribute;
+    EFI_PHYSICAL_ADDRESS PhysicalStart;
+    uint64_t ResourceLength;
+} EFI_HOB_RESOURCE_DESCRIPTOR;
+
+typedef struct {
+    EFI_HOB_GENERIC_HEADER Header;
+    EFI_GUID Name;
+
+    /* guid specific data follows */
+} EFI_HOB_GUID_TYPE;
+
+typedef struct {
+    EFI_HOB_GENERIC_HEADER Header;
+    EFI_PHYSICAL_ADDRESS BaseAddress;
+    uint64_t Length;
+} EFI_HOB_FIRMWARE_VOLUME;
+
+typedef struct {
+    EFI_HOB_GENERIC_HEADER Header;
+    EFI_PHYSICAL_ADDRESS BaseAddress;
+    uint64_t Length;
+    EFI_GUID FvName;
+    EFI_GUID FileName;
+} EFI_HOB_FIRMWARE_VOLUME2;
+
+typedef struct {
+    EFI_HOB_GENERIC_HEADER Header;
+    EFI_PHYSICAL_ADDRESS BaseAddress;
+    uint64_t Length;
+    uint32_t AuthenticationStatus;
+    bool ExtractedFv;
+    EFI_GUID FvName;
+    EFI_GUID FileName;
+} EFI_HOB_FIRMWARE_VOLUME3;
+
+typedef struct {
+    EFI_HOB_GENERIC_HEADER Header;
+    uint8_t SizeOfMemorySpace;
+    uint8_t SizeOfIoSpace;
+    uint8_t Reserved[6];
+} EFI_HOB_CPU;
+
+typedef struct {
+    EFI_HOB_GENERIC_HEADER Header;
+} EFI_HOB_MEMORY_POOL;
+
+typedef struct {
+    EFI_HOB_GENERIC_HEADER Header;
+
+    EFI_PHYSICAL_ADDRESS BaseAddress;
+    uint64_t Length;
+} EFI_HOB_UEFI_CAPSULE;
+
+#define EFI_HOB_OWNER_ZERO                                      \
+    ((EFI_GUID){ 0x00000000, 0x0000, 0x0000,                    \
+        { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 } })
+
+#endif

From a731425980a4d3f8bb96fc41893b6437672875ee Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Thu, 8 May 2025 10:59:29 -0400
Subject: [PATCH 1240/2760] i386/tdx: Setup the TD HOB list

The TD HOB list is used to pass the information from VMM to TDVF. The TD
HOB must include PHIT HOB and Resource Descriptor HOB. More details can
be found in TDVF specification and PI specification.

Build the TD HOB in TDX's machine_init_done callback.

Co-developed-by: Isaku Yamahata <isaku.yamahata@intel.com>
Signed-off-by: Isaku Yamahata <isaku.yamahata@intel.com>
Co-developed-by: Sean Christopherson <sean.j.christopherson@intel.com>
Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250508150002.689633-24-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/i386/meson.build   |   2 +-
 hw/i386/tdvf-hob.c    | 130 ++++++++++++++++++++++++++++++++++++++++++
 hw/i386/tdvf-hob.h    |  26 +++++++++
 target/i386/kvm/tdx.c |  16 ++++++
 4 files changed, 173 insertions(+), 1 deletion(-)
 create mode 100644 hw/i386/tdvf-hob.c
 create mode 100644 hw/i386/tdvf-hob.h

diff --git a/hw/i386/meson.build b/hw/i386/meson.build
index 3bc1da2b6e..7896f348cf 100644
--- a/hw/i386/meson.build
+++ b/hw/i386/meson.build
@@ -32,7 +32,7 @@ i386_ss.add(when: 'CONFIG_PC', if_true: files(
   'port92.c'))
 i386_ss.add(when: 'CONFIG_X86_FW_OVMF', if_true: files('pc_sysfw_ovmf.c'),
                                         if_false: files('pc_sysfw_ovmf-stubs.c'))
-i386_ss.add(when: 'CONFIG_TDX', if_true: files('tdvf.c'))
+i386_ss.add(when: 'CONFIG_TDX', if_true: files('tdvf.c', 'tdvf-hob.c'))
 
 subdir('kvm')
 subdir('xen')
diff --git a/hw/i386/tdvf-hob.c b/hw/i386/tdvf-hob.c
new file mode 100644
index 0000000000..782b3d1578
--- /dev/null
+++ b/hw/i386/tdvf-hob.c
@@ -0,0 +1,130 @@
+/*
+ * Copyright (c) 2025 Intel Corporation
+ * Author: Isaku Yamahata <isaku.yamahata at gmail.com>
+ *                        <isaku.yamahata at intel.com>
+ *         Xiaoyao Li <xiaoyao.li@intel.com>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/error-report.h"
+#include "standard-headers/uefi/uefi.h"
+#include "hw/pci/pcie_host.h"
+#include "tdvf-hob.h"
+
+typedef struct TdvfHob {
+    hwaddr hob_addr;
+    void *ptr;
+    int size;
+
+    /* working area */
+    void *current;
+    void *end;
+} TdvfHob;
+
+static uint64_t tdvf_current_guest_addr(const TdvfHob *hob)
+{
+    return hob->hob_addr + (hob->current - hob->ptr);
+}
+
+static void tdvf_align(TdvfHob *hob, size_t align)
+{
+    hob->current = QEMU_ALIGN_PTR_UP(hob->current, align);
+}
+
+static void *tdvf_get_area(TdvfHob *hob, uint64_t size)
+{
+    void *ret;
+
+    if (hob->current + size > hob->end) {
+        error_report("TD_HOB overrun, size = 0x%" PRIx64, size);
+        exit(1);
+    }
+
+    ret = hob->current;
+    hob->current += size;
+    tdvf_align(hob, 8);
+    return ret;
+}
+
+static void tdvf_hob_add_memory_resources(TdxGuest *tdx, TdvfHob *hob)
+{
+    EFI_HOB_RESOURCE_DESCRIPTOR *region;
+    EFI_RESOURCE_ATTRIBUTE_TYPE attr;
+    EFI_RESOURCE_TYPE resource_type;
+
+    TdxRamEntry *e;
+    int i;
+
+    for (i = 0; i < tdx->nr_ram_entries; i++) {
+        e = &tdx->ram_entries[i];
+
+        if (e->type == TDX_RAM_UNACCEPTED) {
+            resource_type = EFI_RESOURCE_MEMORY_UNACCEPTED;
+            attr = EFI_RESOURCE_ATTRIBUTE_TDVF_UNACCEPTED;
+        } else if (e->type == TDX_RAM_ADDED) {
+            resource_type = EFI_RESOURCE_SYSTEM_MEMORY;
+            attr = EFI_RESOURCE_ATTRIBUTE_TDVF_PRIVATE;
+        } else {
+            error_report("unknown TDX_RAM_ENTRY type %d", e->type);
+            exit(1);
+        }
+
+        region = tdvf_get_area(hob, sizeof(*region));
+        *region = (EFI_HOB_RESOURCE_DESCRIPTOR) {
+            .Header = {
+                .HobType = EFI_HOB_TYPE_RESOURCE_DESCRIPTOR,
+                .HobLength = cpu_to_le16(sizeof(*region)),
+                .Reserved = cpu_to_le32(0),
+            },
+            .Owner = EFI_HOB_OWNER_ZERO,
+            .ResourceType = cpu_to_le32(resource_type),
+            .ResourceAttribute = cpu_to_le32(attr),
+            .PhysicalStart = cpu_to_le64(e->address),
+            .ResourceLength = cpu_to_le64(e->length),
+        };
+    }
+}
+
+void tdvf_hob_create(TdxGuest *tdx, TdxFirmwareEntry *td_hob)
+{
+    TdvfHob hob = {
+        .hob_addr = td_hob->address,
+        .size = td_hob->size,
+        .ptr = td_hob->mem_ptr,
+
+        .current = td_hob->mem_ptr,
+        .end = td_hob->mem_ptr + td_hob->size,
+    };
+
+    EFI_HOB_GENERIC_HEADER *last_hob;
+    EFI_HOB_HANDOFF_INFO_TABLE *hit;
+
+    /* Note, Efi{Free}Memory{Bottom,Top} are ignored, leave 'em zeroed. */
+    hit = tdvf_get_area(&hob, sizeof(*hit));
+    *hit = (EFI_HOB_HANDOFF_INFO_TABLE) {
+        .Header = {
+            .HobType = EFI_HOB_TYPE_HANDOFF,
+            .HobLength = cpu_to_le16(sizeof(*hit)),
+            .Reserved = cpu_to_le32(0),
+        },
+        .Version = cpu_to_le32(EFI_HOB_HANDOFF_TABLE_VERSION),
+        .BootMode = cpu_to_le32(0),
+        .EfiMemoryTop = cpu_to_le64(0),
+        .EfiMemoryBottom = cpu_to_le64(0),
+        .EfiFreeMemoryTop = cpu_to_le64(0),
+        .EfiFreeMemoryBottom = cpu_to_le64(0),
+        .EfiEndOfHobList = cpu_to_le64(0), /* initialized later */
+    };
+
+    tdvf_hob_add_memory_resources(tdx, &hob);
+
+    last_hob = tdvf_get_area(&hob, sizeof(*last_hob));
+    *last_hob =  (EFI_HOB_GENERIC_HEADER) {
+        .HobType = EFI_HOB_TYPE_END_OF_HOB_LIST,
+        .HobLength = cpu_to_le16(sizeof(*last_hob)),
+        .Reserved = cpu_to_le32(0),
+    };
+    hit->EfiEndOfHobList = tdvf_current_guest_addr(&hob);
+}
diff --git a/hw/i386/tdvf-hob.h b/hw/i386/tdvf-hob.h
new file mode 100644
index 0000000000..4fc6a3740a
--- /dev/null
+++ b/hw/i386/tdvf-hob.h
@@ -0,0 +1,26 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#ifndef HW_I386_TD_HOB_H
+#define HW_I386_TD_HOB_H
+
+#include "hw/i386/tdvf.h"
+#include "target/i386/kvm/tdx.h"
+
+void tdvf_hob_create(TdxGuest *tdx, TdxFirmwareEntry *td_hob);
+
+#define EFI_RESOURCE_ATTRIBUTE_TDVF_PRIVATE     \
+    (EFI_RESOURCE_ATTRIBUTE_PRESENT |           \
+     EFI_RESOURCE_ATTRIBUTE_INITIALIZED |       \
+     EFI_RESOURCE_ATTRIBUTE_TESTED)
+
+#define EFI_RESOURCE_ATTRIBUTE_TDVF_UNACCEPTED  \
+    (EFI_RESOURCE_ATTRIBUTE_PRESENT |           \
+     EFI_RESOURCE_ATTRIBUTE_INITIALIZED |       \
+     EFI_RESOURCE_ATTRIBUTE_TESTED)
+
+#define EFI_RESOURCE_ATTRIBUTE_TDVF_MMIO        \
+    (EFI_RESOURCE_ATTRIBUTE_PRESENT     |       \
+     EFI_RESOURCE_ATTRIBUTE_INITIALIZED |       \
+     EFI_RESOURCE_ATTRIBUTE_UNCACHEABLE)
+
+#endif
diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
index e06f5d0bd4..e20ffee955 100644
--- a/target/i386/kvm/tdx.c
+++ b/target/i386/kvm/tdx.c
@@ -21,6 +21,7 @@
 #include "hw/i386/e820_memory_layout.h"
 #include "hw/i386/tdvf.h"
 #include "hw/i386/x86.h"
+#include "hw/i386/tdvf-hob.h"
 #include "kvm_i386.h"
 #include "tdx.h"
 
@@ -147,6 +148,19 @@ void tdx_set_tdvf_region(MemoryRegion *tdvf_mr)
     tdx_guest->tdvf_mr = tdvf_mr;
 }
 
+static TdxFirmwareEntry *tdx_get_hob_entry(TdxGuest *tdx)
+{
+    TdxFirmwareEntry *entry;
+
+    for_each_tdx_fw_entry(&tdx->tdvf, entry) {
+        if (entry->type == TDVF_SECTION_TYPE_TD_HOB) {
+            return entry;
+        }
+    }
+    error_report("TDVF metadata doesn't specify TD_HOB location.");
+    exit(1);
+}
+
 static void tdx_add_ram_entry(uint64_t address, uint64_t length,
                               enum TdxRamType type)
 {
@@ -281,6 +295,8 @@ static void tdx_finalize_vm(Notifier *notifier, void *unused)
 
     qsort(tdx_guest->ram_entries, tdx_guest->nr_ram_entries,
           sizeof(TdxRamEntry), &tdx_ram_entry_compare);
+
+    tdvf_hob_create(tdx_guest, tdx_get_hob_entry(tdx_guest));
 }
 
 static Notifier tdx_machine_done_notify = {

From ebc2d2b497c59414ac3c91de32bc546d27940e74 Mon Sep 17 00:00:00 2001
From: Isaku Yamahata <isaku.yamahata@intel.com>
Date: Thu, 8 May 2025 10:59:30 -0400
Subject: [PATCH 1241/2760] i386/tdx: Add TDVF memory via
 KVM_TDX_INIT_MEM_REGION

TDVF firmware (CODE and VARS) needs to be copied to TD's private
memory via KVM_TDX_INIT_MEM_REGION, as well as TD HOB and TEMP memory.

If the TDVF section has TDVF_SECTION_ATTRIBUTES_MR_EXTEND set in the
flag, calling KVM_TDX_EXTEND_MEMORY to extend the measurement.

After populating the TDVF memory, the original image located in shared
ramblock can be discarded.

Signed-off-by: Isaku Yamahata <isaku.yamahata@intel.com>
Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250508150002.689633-25-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/kvm/tdx.c | 42 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 42 insertions(+)

diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
index e20ffee955..43529a9e0e 100644
--- a/target/i386/kvm/tdx.c
+++ b/target/i386/kvm/tdx.c
@@ -17,6 +17,7 @@
 #include "qom/object_interfaces.h"
 #include "crypto/hash.h"
 #include "system/system.h"
+#include "system/ramblock.h"
 
 #include "hw/i386/e820_memory_layout.h"
 #include "hw/i386/tdvf.h"
@@ -262,6 +263,9 @@ static void tdx_finalize_vm(Notifier *notifier, void *unused)
 {
     TdxFirmware *tdvf = &tdx_guest->tdvf;
     TdxFirmwareEntry *entry;
+    RAMBlock *ram_block;
+    Error *local_err = NULL;
+    int r;
 
     tdx_init_ram_entries();
 
@@ -297,6 +301,44 @@ static void tdx_finalize_vm(Notifier *notifier, void *unused)
           sizeof(TdxRamEntry), &tdx_ram_entry_compare);
 
     tdvf_hob_create(tdx_guest, tdx_get_hob_entry(tdx_guest));
+
+    for_each_tdx_fw_entry(tdvf, entry) {
+        struct kvm_tdx_init_mem_region region;
+        uint32_t flags;
+
+        region = (struct kvm_tdx_init_mem_region) {
+            .source_addr = (uint64_t)entry->mem_ptr,
+            .gpa = entry->address,
+            .nr_pages = entry->size >> 12,
+        };
+
+        flags = entry->attributes & TDVF_SECTION_ATTRIBUTES_MR_EXTEND ?
+                KVM_TDX_MEASURE_MEMORY_REGION : 0;
+
+        do {
+            error_free(local_err);
+            local_err = NULL;
+            r = tdx_vcpu_ioctl(first_cpu, KVM_TDX_INIT_MEM_REGION, flags,
+                               &region, &local_err);
+        } while (r == -EAGAIN || r == -EINTR);
+        if (r < 0) {
+            error_report_err(local_err);
+            exit(1);
+        }
+
+        if (entry->type == TDVF_SECTION_TYPE_TD_HOB ||
+            entry->type == TDVF_SECTION_TYPE_TEMP_MEM) {
+            qemu_ram_munmap(-1, entry->mem_ptr, entry->size);
+            entry->mem_ptr = NULL;
+        }
+    }
+
+    /*
+     * TDVF image has been copied into private region above via
+     * KVM_MEMORY_MAPPING. It becomes useless.
+     */
+    ram_block = tdx_guest->tdvf_mr->ram_block;
+    ram_block_discard_range(ram_block, 0, ram_block->max_length);
 }
 
 static Notifier tdx_machine_done_notify = {

From 41f7fd22073561a23229c0479d9d708dee9d3a1e Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Thu, 8 May 2025 10:59:31 -0400
Subject: [PATCH 1242/2760] i386/tdx: Call KVM_TDX_INIT_VCPU to initialize TDX
 vcpu

TDX vcpu needs to be initialized by SEAMCALL(TDH.VP.INIT) and KVM
provides vcpu level IOCTL KVM_TDX_INIT_VCPU for it.

KVM_TDX_INIT_VCPU needs the address of the HOB as input. Invoke it for
each vcpu after HOB list is created.

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250508150002.689633-26-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/kvm/tdx.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
index 43529a9e0e..99d13bd844 100644
--- a/target/i386/kvm/tdx.c
+++ b/target/i386/kvm/tdx.c
@@ -259,6 +259,18 @@ static void tdx_init_ram_entries(void)
     tdx_guest->nr_ram_entries = j;
 }
 
+static void tdx_post_init_vcpus(void)
+{
+    TdxFirmwareEntry *hob;
+    CPUState *cpu;
+
+    hob = tdx_get_hob_entry(tdx_guest);
+    CPU_FOREACH(cpu) {
+        tdx_vcpu_ioctl(cpu, KVM_TDX_INIT_VCPU, 0, (void *)hob->address,
+                       &error_fatal);
+    }
+}
+
 static void tdx_finalize_vm(Notifier *notifier, void *unused)
 {
     TdxFirmware *tdvf = &tdx_guest->tdvf;
@@ -302,6 +314,8 @@ static void tdx_finalize_vm(Notifier *notifier, void *unused)
 
     tdvf_hob_create(tdx_guest, tdx_get_hob_entry(tdx_guest));
 
+    tdx_post_init_vcpus();
+
     for_each_tdx_fw_entry(tdvf, entry) {
         struct kvm_tdx_init_mem_region region;
         uint32_t flags;

From ae60ff4e9f9e5790f79abf866ec67270c28ca477 Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Thu, 8 May 2025 10:59:32 -0400
Subject: [PATCH 1243/2760] i386/tdx: Finalize TDX VM

Invoke KVM_TDX_FINALIZE_VM to finalize the TD's measurement and make
the TD vCPUs runnable once machine initialization is complete.

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250508150002.689633-27-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/kvm/tdx.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
index 99d13bd844..287bf7147e 100644
--- a/target/i386/kvm/tdx.c
+++ b/target/i386/kvm/tdx.c
@@ -353,6 +353,9 @@ static void tdx_finalize_vm(Notifier *notifier, void *unused)
      */
     ram_block = tdx_guest->tdvf_mr->ram_block;
     ram_block_discard_range(ram_block, 0, ram_block->max_length);
+
+    tdx_vm_ioctl(KVM_TDX_FINALIZE_VM, 0, NULL, &error_fatal);
+    CONFIDENTIAL_GUEST_SUPPORT(tdx_guest)->ready = true;
 }
 
 static Notifier tdx_machine_done_notify = {

From 1ff5048d74e661943260c33e864c4118acb37ab4 Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Thu, 8 May 2025 10:59:33 -0400
Subject: [PATCH 1244/2760] i386/tdx: Enable user exit on KVM_HC_MAP_GPA_RANGE

KVM translates TDG.VP.VMCALL<MapGPA> to KVM_HC_MAP_GPA_RANGE, and QEMU
needs to enable user exit on KVM_HC_MAP_GPA_RANGE in order to handle the
memory conversion requested by TD guest.

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250508150002.689633-28-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/kvm/tdx.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
index 287bf7147e..971f4becfa 100644
--- a/target/i386/kvm/tdx.c
+++ b/target/i386/kvm/tdx.c
@@ -19,6 +19,8 @@
 #include "system/system.h"
 #include "system/ramblock.h"
 
+#include <linux/kvm_para.h>
+
 #include "hw/i386/e820_memory_layout.h"
 #include "hw/i386/tdvf.h"
 #include "hw/i386/x86.h"
@@ -376,6 +378,11 @@ static int tdx_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
         }
     }
 
+    /* TDX relies on KVM_HC_MAP_GPA_RANGE to handle TDG.VP.VMCALL<MapGPA> */
+    if (!kvm_enable_hypercall(BIT_ULL(KVM_HC_MAP_GPA_RANGE))) {
+        return -EOPNOTSUPP;
+    }
+
     qemu_add_machine_init_done_notifier(&tdx_machine_done_notify);
 
     tdx_guest = tdx;

From 98dbfd6849f117de02ac6f513f2a1f95563e60ae Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Thu, 8 May 2025 10:59:34 -0400
Subject: [PATCH 1245/2760] i386/tdx: Handle KVM_SYSTEM_EVENT_TDX_FATAL

TD guest can use TDG.VP.VMCALL<REPORT_FATAL_ERROR> to request
termination. KVM translates such request into KVM_EXIT_SYSTEM_EVENT with
type of KVM_SYSTEM_EVENT_TDX_FATAL.

Add hanlder for such exit. Parse and print the error message, and
terminate the TD guest in the handler.

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250508150002.689633-29-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/kvm/kvm.c      | 10 +++++++++
 target/i386/kvm/tdx-stub.c |  5 +++++
 target/i386/kvm/tdx.c      | 46 ++++++++++++++++++++++++++++++++++++++
 target/i386/kvm/tdx.h      |  2 ++
 4 files changed, 63 insertions(+)

diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
index fd1817fc5e..c5c692a034 100644
--- a/target/i386/kvm/kvm.c
+++ b/target/i386/kvm/kvm.c
@@ -6129,6 +6129,16 @@ int kvm_arch_handle_exit(CPUState *cs, struct kvm_run *run)
     case KVM_EXIT_HYPERCALL:
         ret = kvm_handle_hypercall(run);
         break;
+    case KVM_EXIT_SYSTEM_EVENT:
+        switch (run->system_event.type) {
+        case KVM_SYSTEM_EVENT_TDX_FATAL:
+            ret = tdx_handle_report_fatal_error(cpu, run);
+            break;
+        default:
+            ret = -1;
+            break;
+        }
+        break;
     default:
         fprintf(stderr, "KVM: unknown exit reason %d\n", run->exit_reason);
         ret = -1;
diff --git a/target/i386/kvm/tdx-stub.c b/target/i386/kvm/tdx-stub.c
index 7748b6d0a4..720a4ff046 100644
--- a/target/i386/kvm/tdx-stub.c
+++ b/target/i386/kvm/tdx-stub.c
@@ -13,3 +13,8 @@ int tdx_parse_tdvf(void *flash_ptr, int size)
 {
     return -EINVAL;
 }
+
+int tdx_handle_report_fatal_error(X86CPU *cpu, struct kvm_run *run)
+{
+    return -EINVAL;
+}
diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
index 971f4becfa..16ad1af3c5 100644
--- a/target/i386/kvm/tdx.c
+++ b/target/i386/kvm/tdx.c
@@ -615,6 +615,52 @@ int tdx_parse_tdvf(void *flash_ptr, int size)
     return tdvf_parse_metadata(&tdx_guest->tdvf, flash_ptr, size);
 }
 
+/*
+ * Only 8 registers can contain valid ASCII byte stream to form the fatal
+ * message, and their sequence is: R14, R15, RBX, RDI, RSI, R8, R9, RDX
+ */
+#define TDX_FATAL_MESSAGE_MAX        64
+
+int tdx_handle_report_fatal_error(X86CPU *cpu, struct kvm_run *run)
+{
+    uint64_t error_code = run->system_event.data[R_R12];
+    uint64_t reg_mask = run->system_event.data[R_ECX];
+    char *message = NULL;
+    uint64_t *tmp;
+
+    if (error_code & 0xffff) {
+        error_report("TDX: REPORT_FATAL_ERROR: invalid error code: 0x%lx",
+                     error_code);
+        return -1;
+    }
+
+    if (reg_mask) {
+        message = g_malloc0(TDX_FATAL_MESSAGE_MAX + 1);
+        tmp = (uint64_t *)message;
+
+#define COPY_REG(REG)                               \
+    do {                                            \
+        if (reg_mask & BIT_ULL(REG)) {              \
+            *(tmp++) = run->system_event.data[REG]; \
+        }                                           \
+    } while (0)
+
+        COPY_REG(R_R14);
+        COPY_REG(R_R15);
+        COPY_REG(R_EBX);
+        COPY_REG(R_EDI);
+        COPY_REG(R_ESI);
+        COPY_REG(R_R8);
+        COPY_REG(R_R9);
+        COPY_REG(R_EDX);
+        *((char *)tmp) = '\0';
+    }
+#undef COPY_REG
+
+    error_report("TD guest reports fatal error. %s", message ? : "");
+    return -1;
+}
+
 static bool tdx_guest_get_sept_ve_disable(Object *obj, Error **errp)
 {
     TdxGuest *tdx = TDX_GUEST(obj);
diff --git a/target/i386/kvm/tdx.h b/target/i386/kvm/tdx.h
index 36a7400e74..04b5afe199 100644
--- a/target/i386/kvm/tdx.h
+++ b/target/i386/kvm/tdx.h
@@ -8,6 +8,7 @@
 #endif
 
 #include "confidential-guest.h"
+#include "cpu.h"
 #include "hw/i386/tdvf.h"
 
 #define TYPE_TDX_GUEST "tdx-guest"
@@ -59,5 +60,6 @@ bool is_tdx_vm(void);
 int tdx_pre_create_vcpu(CPUState *cpu, Error **errp);
 void tdx_set_tdvf_region(MemoryRegion *tdvf_mr);
 int tdx_parse_tdvf(void *flash_ptr, int size);
+int tdx_handle_report_fatal_error(X86CPU *cpu, struct kvm_run *run);
 
 #endif /* QEMU_I386_TDX_H */

From 6e250463b08b4028123f201343ee72099ef81e68 Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Thu, 8 May 2025 10:59:35 -0400
Subject: [PATCH 1246/2760] i386/tdx: Wire TDX_REPORT_FATAL_ERROR with
 GuestPanic facility

Integrate TDX's TDX_REPORT_FATAL_ERROR into QEMU GuestPanic facility

Originated-from: Isaku Yamahata <isaku.yamahata@intel.com>
Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Acked-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250508150002.689633-30-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 qapi/run-state.json   | 31 +++++++++++++++++++--
 system/runstate.c     | 65 +++++++++++++++++++++++++++++++++++++++++++
 target/i386/kvm/tdx.c | 25 ++++++++++++++++-
 3 files changed, 118 insertions(+), 3 deletions(-)

diff --git a/qapi/run-state.json b/qapi/run-state.json
index ce95cfa46b..ee11adc508 100644
--- a/qapi/run-state.json
+++ b/qapi/run-state.json
@@ -501,10 +501,12 @@
 #
 # @s390: s390 guest panic information type (Since: 2.12)
 #
+# @tdx: tdx guest panic information type (Since: 10.1)
+#
 # Since: 2.9
 ##
 { 'enum': 'GuestPanicInformationType',
-  'data': [ 'hyper-v', 's390' ] }
+  'data': [ 'hyper-v', 's390', 'tdx' ] }
 
 ##
 # @GuestPanicInformation:
@@ -519,7 +521,8 @@
  'base': {'type': 'GuestPanicInformationType'},
  'discriminator': 'type',
  'data': {'hyper-v': 'GuestPanicInformationHyperV',
-          's390': 'GuestPanicInformationS390'}}
+          's390': 'GuestPanicInformationS390',
+          'tdx' : 'GuestPanicInformationTdx'}}
 
 ##
 # @GuestPanicInformationHyperV:
@@ -598,6 +601,30 @@
           'psw-addr': 'uint64',
           'reason': 'S390CrashReason'}}
 
+##
+# @GuestPanicInformationTdx:
+#
+# TDX Guest panic information specific to TDX, as specified in the
+# "Guest-Hypervisor Communication Interface (GHCI) Specification",
+# section TDG.VP.VMCALL<ReportFatalError>.
+#
+# @error-code: TD-specific error code
+#
+# @message: Human-readable error message provided by the guest. Not
+#     to be trusted.
+#
+# @gpa: guest-physical address of a page that contains more verbose
+#     error information, as zero-terminated string.  Present when the
+#     "GPA valid" bit (bit 63) is set in @error-code.
+#
+#
+# Since: 10.1
+##
+{'struct': 'GuestPanicInformationTdx',
+ 'data': {'error-code': 'uint32',
+          'message': 'str',
+          '*gpa': 'uint64'}}
+
 ##
 # @MEMORY_FAILURE:
 #
diff --git a/system/runstate.c b/system/runstate.c
index de74d962bc..38900c935a 100644
--- a/system/runstate.c
+++ b/system/runstate.c
@@ -590,6 +590,58 @@ static void qemu_system_wakeup(void)
     }
 }
 
+static char *tdx_parse_panic_message(char *message)
+{
+    bool printable = false;
+    char *buf = NULL;
+    int len = 0, i;
+
+    /*
+     * Although message is defined as a json string, we shouldn't
+     * unconditionally treat it as is because the guest generated it and
+     * it's not necessarily trustable.
+     */
+    if (message) {
+        /* The caller guarantees the NULL-terminated string. */
+        len = strlen(message);
+
+        printable = len > 0;
+        for (i = 0; i < len; i++) {
+            if (!(0x20 <= message[i] && message[i] <= 0x7e)) {
+                printable = false;
+                break;
+            }
+        }
+    }
+
+    if (len == 0) {
+        buf = g_malloc(1);
+        buf[0] = '\0';
+    } else {
+        if (!printable) {
+            /* 3 = length of "%02x " */
+            buf = g_malloc(len * 3);
+            for (i = 0; i < len; i++) {
+                if (message[i] == '\0') {
+                    break;
+                } else {
+                    sprintf(buf + 3 * i, "%02x ", message[i]);
+                }
+            }
+            if (i > 0) {
+                /* replace the last ' '(space) to NULL */
+                buf[i * 3 - 1] = '\0';
+            } else {
+                buf[0] = '\0';
+            }
+        } else {
+            buf = g_strdup(message);
+        }
+    }
+
+    return buf;
+}
+
 void qemu_system_guest_panicked(GuestPanicInformation *info)
 {
     qemu_log_mask(LOG_GUEST_ERROR, "Guest crashed");
@@ -631,7 +683,20 @@ void qemu_system_guest_panicked(GuestPanicInformation *info)
                           S390CrashReason_str(info->u.s390.reason),
                           info->u.s390.psw_mask,
                           info->u.s390.psw_addr);
+        } else if (info->type == GUEST_PANIC_INFORMATION_TYPE_TDX) {
+            char *message = tdx_parse_panic_message(info->u.tdx.message);
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "\nTDX guest reports fatal error."
+                          " error code: 0x%" PRIx32 " error message:\"%s\"\n",
+                          info->u.tdx.error_code, message);
+            g_free(message);
+            if (info->u.tdx.gpa != -1ull) {
+                qemu_log_mask(LOG_GUEST_ERROR, "Additional error information "
+                              "can be found at gpa page: 0x%" PRIx64 "\n",
+                              info->u.tdx.gpa);
+            }
         }
+
         qapi_free_GuestPanicInformation(info);
     }
 }
diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
index 16ad1af3c5..ae3740a230 100644
--- a/target/i386/kvm/tdx.c
+++ b/target/i386/kvm/tdx.c
@@ -16,6 +16,7 @@
 #include "qapi/error.h"
 #include "qom/object_interfaces.h"
 #include "crypto/hash.h"
+#include "system/runstate.h"
 #include "system/system.h"
 #include "system/ramblock.h"
 
@@ -615,18 +616,35 @@ int tdx_parse_tdvf(void *flash_ptr, int size)
     return tdvf_parse_metadata(&tdx_guest->tdvf, flash_ptr, size);
 }
 
+static void tdx_panicked_on_fatal_error(X86CPU *cpu, uint64_t error_code,
+                                        char *message, uint64_t gpa)
+{
+    GuestPanicInformation *panic_info;
+
+    panic_info = g_new0(GuestPanicInformation, 1);
+    panic_info->type = GUEST_PANIC_INFORMATION_TYPE_TDX;
+    panic_info->u.tdx.error_code = (uint32_t) error_code;
+    panic_info->u.tdx.message = message;
+    panic_info->u.tdx.gpa = gpa;
+
+    qemu_system_guest_panicked(panic_info);
+}
+
 /*
  * Only 8 registers can contain valid ASCII byte stream to form the fatal
  * message, and their sequence is: R14, R15, RBX, RDI, RSI, R8, R9, RDX
  */
 #define TDX_FATAL_MESSAGE_MAX        64
 
+#define TDX_REPORT_FATAL_ERROR_GPA_VALID    BIT_ULL(63)
+
 int tdx_handle_report_fatal_error(X86CPU *cpu, struct kvm_run *run)
 {
     uint64_t error_code = run->system_event.data[R_R12];
     uint64_t reg_mask = run->system_event.data[R_ECX];
     char *message = NULL;
     uint64_t *tmp;
+    uint64_t gpa = -1ull;
 
     if (error_code & 0xffff) {
         error_report("TDX: REPORT_FATAL_ERROR: invalid error code: 0x%lx",
@@ -657,7 +675,12 @@ int tdx_handle_report_fatal_error(X86CPU *cpu, struct kvm_run *run)
     }
 #undef COPY_REG
 
-    error_report("TD guest reports fatal error. %s", message ? : "");
+    if (error_code & TDX_REPORT_FATAL_ERROR_GPA_VALID) {
+        gpa = run->system_event.data[R_R13];
+    }
+
+    tdx_panicked_on_fatal_error(cpu, error_code, message, gpa);
+
     return -1;
 }
 

From 77b5403a0298a5460554f768a2098fd21588e555 Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Thu, 8 May 2025 10:59:36 -0400
Subject: [PATCH 1247/2760] kvm: Check KVM_CAP_MAX_VCPUS at vm level

KVM with TDX support starts to report different KVM_CAP_MAX_VCPUS per
different VM types. So switch to check the KVM_CAP_MAX_VCPUS at vm level.

KVM still returns the global KVM_CAP_MAX_VCPUS when the KVM is old that
doesn't report different value at vm level.

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250508150002.689633-31-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 accel/kvm/kvm-all.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index 42d239cf8f..71e6060458 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -2431,7 +2431,7 @@ static int kvm_recommended_vcpus(KVMState *s)
 
 static int kvm_max_vcpus(KVMState *s)
 {
-    int ret = kvm_check_extension(s, KVM_CAP_MAX_VCPUS);
+    int ret = kvm_vm_check_extension(s, KVM_CAP_MAX_VCPUS);
     return (ret) ? ret : kvm_recommended_vcpus(s);
 }
 

From 8583c53e2b619b1b9569d3f2d3f3cb2904a573ad Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Thu, 8 May 2025 10:59:37 -0400
Subject: [PATCH 1248/2760] i386/cpu: introduce
 x86_confidential_guest_cpu_instance_init()

To allow execute confidential guest specific cpu init operations.

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250508150002.689633-32-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/confidential-guest.h | 11 +++++++++++
 target/i386/cpu.c                |  8 ++++++++
 2 files changed, 19 insertions(+)

diff --git a/target/i386/confidential-guest.h b/target/i386/confidential-guest.h
index 164be7633a..a86c42a475 100644
--- a/target/i386/confidential-guest.h
+++ b/target/i386/confidential-guest.h
@@ -39,6 +39,7 @@ struct X86ConfidentialGuestClass {
 
     /* <public> */
     int (*kvm_type)(X86ConfidentialGuest *cg);
+    void (*cpu_instance_init)(X86ConfidentialGuest *cg, CPUState *cpu);
     uint32_t (*mask_cpuid_features)(X86ConfidentialGuest *cg, uint32_t feature, uint32_t index,
                                     int reg, uint32_t value);
 };
@@ -59,6 +60,16 @@ static inline int x86_confidential_guest_kvm_type(X86ConfidentialGuest *cg)
     }
 }
 
+static inline void x86_confidential_guest_cpu_instance_init(X86ConfidentialGuest *cg,
+                                                            CPUState *cpu)
+{
+    X86ConfidentialGuestClass *klass = X86_CONFIDENTIAL_GUEST_GET_CLASS(cg);
+
+    if (klass->cpu_instance_init) {
+        klass->cpu_instance_init(cg, cpu);
+    }
+}
+
 /**
  * x86_confidential_guest_mask_cpuid_features:
  *
diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 9689f6374e..4a7c319bb9 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -37,6 +37,7 @@
 #include "hw/i386/topology.h"
 #include "exec/watchpoint.h"
 #ifndef CONFIG_USER_ONLY
+#include "confidential-guest.h"
 #include "system/reset.h"
 #include "qapi/qapi-commands-machine-target.h"
 #include "system/address-spaces.h"
@@ -8543,6 +8544,13 @@ static void x86_cpu_post_initfn(Object *obj)
     }
 
     accel_cpu_instance_init(CPU(obj));
+
+#ifndef CONFIG_USER_ONLY
+    if (current_machine && current_machine->cgs) {
+        x86_confidential_guest_cpu_instance_init(
+            X86_CONFIDENTIAL_GUEST(current_machine->cgs), (CPU(obj)));
+    }
+#endif
 }
 
 static void x86_cpu_init_default_topo(X86CPU *cpu)

From 7c615242671dbe65e198c20889dcaa9b4b9a1624 Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Thu, 8 May 2025 10:59:38 -0400
Subject: [PATCH 1249/2760] i386/tdx: implement tdx_cpu_instance_init()

Currently, pmu is not supported for TDX by KVM.

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250508150002.689633-33-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/kvm/tdx.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
index ae3740a230..7c5e59c559 100644
--- a/target/i386/kvm/tdx.c
+++ b/target/i386/kvm/tdx.c
@@ -398,6 +398,11 @@ static int tdx_kvm_type(X86ConfidentialGuest *cg)
     return KVM_X86_TDX_VM;
 }
 
+static void tdx_cpu_instance_init(X86ConfidentialGuest *cg, CPUState *cpu)
+{
+    object_property_set_bool(OBJECT(cpu), "pmu", false, &error_abort);
+}
+
 static int tdx_validate_attributes(TdxGuest *tdx, Error **errp)
 {
     if ((tdx->attributes & ~tdx_caps->supported_attrs)) {
@@ -791,4 +796,5 @@ static void tdx_guest_class_init(ObjectClass *oc, const void *data)
 
     klass->kvm_init = tdx_kvm_init;
     x86_klass->kvm_type = tdx_kvm_type;
+    x86_klass->cpu_instance_init = tdx_cpu_instance_init;
 }

From ab8bd85adf75900edc2764d0ebe8b53867cc54aa Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Thu, 8 May 2025 10:59:39 -0400
Subject: [PATCH 1250/2760] i386/cpu: Introduce enable_cpuid_0x1f to force
 exposing CPUID 0x1f

Currently, QEMU exposes CPUID 0x1f to guest only when necessary, i.e.,
when topology level that cannot be enumerated by leaf 0xB, e.g., die or
module level, are configured for the guest, e.g., -smp xx,dies=2.

However, TDX architecture forces to require CPUID 0x1f to configure CPU
topology.

Introduce a bool flag, enable_cpuid_0x1f, in CPU for the case that
requires CPUID leaf 0x1f to be exposed to guest.

Introduce a new function x86_has_cpuid_0x1f(), which is the wrapper of
cpu->enable_cpuid_0x1f and x86_has_extended_topo() to check if it needs
to enable cpuid leaf 0x1f for the guest.

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250508150002.689633-34-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c     | 4 ++--
 target/i386/cpu.h     | 9 +++++++++
 target/i386/kvm/kvm.c | 2 +-
 3 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 4a7c319bb9..6a97d7549e 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -7045,7 +7045,7 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
         break;
     case 0x1F:
         /* V2 Extended Topology Enumeration Leaf */
-        if (!x86_has_extended_topo(env->avail_cpu_topo)) {
+        if (!x86_has_cpuid_0x1f(cpu)) {
             *eax = *ebx = *ecx = *edx = 0;
             break;
         }
@@ -7909,7 +7909,7 @@ void x86_cpu_expand_features(X86CPU *cpu, Error **errp)
          * cpu->vendor_cpuid_only has been unset for compatibility with older
          * machine types.
          */
-        if (x86_has_extended_topo(env->avail_cpu_topo) &&
+        if (x86_has_cpuid_0x1f(cpu) &&
             (IS_INTEL_CPU(env) || !cpu->vendor_cpuid_only)) {
             x86_cpu_adjust_level(cpu, &env->cpuid_min_level, 0x1F);
         }
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index c51e0a43d0..ad0e3d8cdd 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -2239,6 +2239,9 @@ struct ArchCPU {
     /* Compatibility bits for old machine types: */
     bool enable_cpuid_0xb;
 
+    /* Force to enable cpuid 0x1f */
+    bool enable_cpuid_0x1f;
+
     /* Enable auto level-increase for all CPUID leaves */
     bool full_cpuid_auto_level;
 
@@ -2500,6 +2503,12 @@ void host_cpuid(uint32_t function, uint32_t count,
                 uint32_t *eax, uint32_t *ebx, uint32_t *ecx, uint32_t *edx);
 bool cpu_has_x2apic_feature(CPUX86State *env);
 
+static inline bool x86_has_cpuid_0x1f(X86CPU *cpu)
+{
+    return cpu->enable_cpuid_0x1f ||
+           x86_has_extended_topo(cpu->env.avail_cpu_topo);
+}
+
 /* helper.c */
 void x86_cpu_set_a20(X86CPU *cpu, int a20_state);
 void cpu_sync_avx_hflag(CPUX86State *env);
diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
index c5c692a034..ee33797fdd 100644
--- a/target/i386/kvm/kvm.c
+++ b/target/i386/kvm/kvm.c
@@ -1872,7 +1872,7 @@ uint32_t kvm_x86_build_cpuid(CPUX86State *env, struct kvm_cpuid_entry2 *entries,
             break;
         }
         case 0x1f:
-            if (!x86_has_extended_topo(env->avail_cpu_topo)) {
+            if (!x86_has_cpuid_0x1f(env_archcpu(env))) {
                 cpuid_i--;
                 break;
             }

From 9002494f80b751a7655045c5f46bf90bc1d3bbd0 Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Thu, 8 May 2025 10:59:40 -0400
Subject: [PATCH 1251/2760] i386/tdx: Force exposing CPUID 0x1f

TDX uses CPUID 0x1f to configure TD guest's CPU topology. So set
enable_cpuid_0x1f for TDs.

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250508150002.689633-35-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/kvm/tdx.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
index 7c5e59c559..accaefb401 100644
--- a/target/i386/kvm/tdx.c
+++ b/target/i386/kvm/tdx.c
@@ -400,7 +400,11 @@ static int tdx_kvm_type(X86ConfidentialGuest *cg)
 
 static void tdx_cpu_instance_init(X86ConfidentialGuest *cg, CPUState *cpu)
 {
+    X86CPU *x86cpu = X86_CPU(cpu);
+
     object_property_set_bool(OBJECT(cpu), "pmu", false, &error_abort);
+
+    x86cpu->enable_cpuid_0x1f = true;
 }
 
 static int tdx_validate_attributes(TdxGuest *tdx, Error **errp)

From da6728658bf63d6a3989f1587a33566b3e54bed8 Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Thu, 8 May 2025 10:59:41 -0400
Subject: [PATCH 1252/2760] i386/tdx: Set kvm_readonly_mem_enabled to false for
 TDX VM

TDX only supports readonly for shared memory but not for private memory.

In the view of QEMU, it has no idea whether a memslot is used as shared
memory of private. Thus just mark kvm_readonly_mem_enabled to false to
TDX VM for simplicity.

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250508150002.689633-36-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/kvm/tdx.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
index accaefb401..344e560b4b 100644
--- a/target/i386/kvm/tdx.c
+++ b/target/i386/kvm/tdx.c
@@ -384,6 +384,15 @@ static int tdx_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
         return -EOPNOTSUPP;
     }
 
+    /*
+     * Set kvm_readonly_mem_allowed to false, because TDX only supports readonly
+     * memory for shared memory but not for private memory. Besides, whether a
+     * memslot is private or shared is not determined by QEMU.
+     *
+     * Thus, just mark readonly memory not supported for simplicity.
+     */
+    kvm_readonly_mem_allowed = false;
+
     qemu_add_machine_init_done_notifier(&tdx_machine_done_notify);
 
     tdx_guest = tdx;

From 810d4e83d07ca0d072205453a42c324a51d5a5fa Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Thu, 8 May 2025 10:59:42 -0400
Subject: [PATCH 1253/2760] i386/tdx: Disable SMM for TDX VMs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

TDX doesn't support SMM and VMM cannot emulate SMM for TDX VMs because
VMM cannot manipulate TDX VM's memory.

Disable SMM for TDX VMs and error out if user requests to enable SMM.

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250508150002.689633-37-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/kvm/tdx.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
index 344e560b4b..87c5bf0496 100644
--- a/target/i386/kvm/tdx.c
+++ b/target/i386/kvm/tdx.c
@@ -367,11 +367,20 @@ static Notifier tdx_machine_done_notify = {
 
 static int tdx_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
 {
+    MachineState *ms = MACHINE(qdev_get_machine());
+    X86MachineState *x86ms = X86_MACHINE(ms);
     TdxGuest *tdx = TDX_GUEST(cgs);
     int r = 0;
 
     kvm_mark_guest_state_protected();
 
+    if (x86ms->smm == ON_OFF_AUTO_AUTO) {
+        x86ms->smm = ON_OFF_AUTO_OFF;
+    } else if (x86ms->smm == ON_OFF_AUTO_ON) {
+        error_setg(errp, "TDX VM doesn't support SMM");
+        return -EINVAL;
+    }
+
     if (!tdx_caps) {
         r = get_tdx_capabilities(errp);
         if (r) {

From e7ef60892c80a9ce5b8504ceb13a81f4e0d4b3f7 Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Thu, 8 May 2025 10:59:43 -0400
Subject: [PATCH 1254/2760] i386/tdx: Disable PIC for TDX VMs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Legacy PIC (8259) cannot be supported for TDX VMs since TDX module
doesn't allow directly interrupt injection.  Using posted interrupts
for the PIC is not a viable option as the guest BIOS/kernel will not
do EOI for PIC IRQs, i.e. will leave the vIRR bit set.

Hence disable PIC for TDX VMs and error out if user wants PIC.

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250508150002.689633-38-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/kvm/tdx.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
index 87c5bf0496..32c3f3795d 100644
--- a/target/i386/kvm/tdx.c
+++ b/target/i386/kvm/tdx.c
@@ -381,6 +381,13 @@ static int tdx_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
         return -EINVAL;
     }
 
+    if (x86ms->pic == ON_OFF_AUTO_AUTO) {
+        x86ms->pic = ON_OFF_AUTO_OFF;
+    } else if (x86ms->pic == ON_OFF_AUTO_ON) {
+        error_setg(errp, "TDX VM doesn't support PIC");
+        return -EINVAL;
+    }
+
     if (!tdx_caps) {
         r = get_tdx_capabilities(errp);
         if (r) {

From bb45580d842530d78b58179eaf80b6331b15324e Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Thu, 8 May 2025 10:59:44 -0400
Subject: [PATCH 1255/2760] i386/tdx: Set and check kernel_irqchip mode for TDX
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

KVM mandates kernel_irqchip to be split mode.

Set it to split mode automatically when users don't provide an explicit
value, otherwise check it to be the split mode.

Suggested-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250508150002.689633-39-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/kvm/tdx.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
index 32c3f3795d..68ed3b9f98 100644
--- a/target/i386/kvm/tdx.c
+++ b/target/i386/kvm/tdx.c
@@ -16,6 +16,7 @@
 #include "qapi/error.h"
 #include "qom/object_interfaces.h"
 #include "crypto/hash.h"
+#include "system/kvm_int.h"
 #include "system/runstate.h"
 #include "system/system.h"
 #include "system/ramblock.h"
@@ -388,6 +389,13 @@ static int tdx_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
         return -EINVAL;
     }
 
+    if (kvm_state->kernel_irqchip_split == ON_OFF_AUTO_AUTO) {
+        kvm_state->kernel_irqchip_split = ON_OFF_AUTO_ON;
+    } else if (kvm_state->kernel_irqchip_split != ON_OFF_AUTO_ON) {
+        error_setg(errp, "TDX VM requires kernel_irqchip to be split");
+        return -EINVAL;
+    }
+
     if (!tdx_caps) {
         r = get_tdx_capabilities(errp);
         if (r) {

From 0ed55865b49b703af93e160d48935812a7114e07 Mon Sep 17 00:00:00 2001
From: Isaku Yamahata <isaku.yamahata@intel.com>
Date: Thu, 8 May 2025 10:59:45 -0400
Subject: [PATCH 1256/2760] i386/tdx: Don't synchronize guest tsc for TDs

TSC of TDs is not accessible and KVM doesn't allow access of
MSR_IA32_TSC for TDs. To avoid the assert() in kvm_get_tsc, make
kvm_synchronize_all_tsc() noop for TDs,

Signed-off-by: Isaku Yamahata <isaku.yamahata@intel.com>
Reviewed-by: Connor Kuehl <ckuehl@redhat.com>
Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250508150002.689633-40-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/kvm/kvm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
index ee33797fdd..4fc37cc370 100644
--- a/target/i386/kvm/kvm.c
+++ b/target/i386/kvm/kvm.c
@@ -328,7 +328,7 @@ void kvm_synchronize_all_tsc(void)
 {
     CPUState *cpu;
 
-    if (kvm_enabled()) {
+    if (kvm_enabled() && !is_tdx_vm()) {
         CPU_FOREACH(cpu) {
             run_on_cpu(cpu, do_kvm_synchronize_tsc, RUN_ON_CPU_NULL);
         }

From f9aaad3362a5886d78e7d4d50d563ac16c6acdde Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Thu, 8 May 2025 10:59:46 -0400
Subject: [PATCH 1257/2760] i386/tdx: Only configure MSR_IA32_UCODE_REV in
 kvm_init_msrs() for TDs

For TDs, only MSR_IA32_UCODE_REV in kvm_init_msrs() can be configured
by VMM, while the features enumerated/controlled by other MSRs except
MSR_IA32_UCODE_REV in kvm_init_msrs() are not under control of VMM.

Only configure MSR_IA32_UCODE_REV for TDs.

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250508150002.689633-41-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/kvm/kvm.c | 40 +++++++++++++++++++++-------------------
 1 file changed, 21 insertions(+), 19 deletions(-)

diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
index 4fc37cc370..90a0dac4a1 100644
--- a/target/i386/kvm/kvm.c
+++ b/target/i386/kvm/kvm.c
@@ -3864,32 +3864,34 @@ static void kvm_init_msrs(X86CPU *cpu)
     CPUX86State *env = &cpu->env;
 
     kvm_msr_buf_reset(cpu);
-    if (has_msr_arch_capabs) {
-        kvm_msr_entry_add(cpu, MSR_IA32_ARCH_CAPABILITIES,
-                          env->features[FEAT_ARCH_CAPABILITIES]);
-    }
 
-    if (has_msr_core_capabs) {
-        kvm_msr_entry_add(cpu, MSR_IA32_CORE_CAPABILITY,
-                          env->features[FEAT_CORE_CAPABILITY]);
-    }
+    if (!is_tdx_vm()) {
+        if (has_msr_arch_capabs) {
+            kvm_msr_entry_add(cpu, MSR_IA32_ARCH_CAPABILITIES,
+                                env->features[FEAT_ARCH_CAPABILITIES]);
+        }
 
-    if (has_msr_perf_capabs && cpu->enable_pmu) {
-        kvm_msr_entry_add_perf(cpu, env->features);
+        if (has_msr_core_capabs) {
+            kvm_msr_entry_add(cpu, MSR_IA32_CORE_CAPABILITY,
+                                env->features[FEAT_CORE_CAPABILITY]);
+        }
+
+        if (has_msr_perf_capabs && cpu->enable_pmu) {
+            kvm_msr_entry_add_perf(cpu, env->features);
+        }
+
+        /*
+         * Older kernels do not include VMX MSRs in KVM_GET_MSR_INDEX_LIST, but
+         * all kernels with MSR features should have them.
+         */
+        if (kvm_feature_msrs && cpu_has_vmx(env)) {
+            kvm_msr_entry_add_vmx(cpu, env->features);
+        }
     }
 
     if (has_msr_ucode_rev) {
         kvm_msr_entry_add(cpu, MSR_IA32_UCODE_REV, cpu->ucode_rev);
     }
-
-    /*
-     * Older kernels do not include VMX MSRs in KVM_GET_MSR_INDEX_LIST, but
-     * all kernels with MSR features should have them.
-     */
-    if (kvm_feature_msrs && cpu_has_vmx(env)) {
-        kvm_msr_entry_add_vmx(cpu, env->features);
-    }
-
     assert(kvm_buf_set_msrs(cpu) == 0);
 }
 

From 62a1a8b89d90cd3fbee0e6d38e6a4c0d833e978a Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Thu, 8 May 2025 10:59:47 -0400
Subject: [PATCH 1258/2760] i386/apic: Skip kvm_apic_put() for TDX

KVM neithers allow writing to MSR_IA32_APICBASE for TDs, nor allow for
KVM_SET_LAPIC[*].

Note, KVM_GET_LAPIC is also disallowed for TDX. It is called in the path

  do_kvm_cpu_synchronize_state()
  -> kvm_arch_get_registers()
     -> kvm_get_apic()

and it's already disllowed for confidential guest through
guest_state_protected.

[*] https://lore.kernel.org/all/Z3w4Ku4Jq0CrtXne@google.com/

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250508150002.689633-42-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/i386/kvm/apic.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/hw/i386/kvm/apic.c b/hw/i386/kvm/apic.c
index 39035db042..1be9bfe36e 100644
--- a/hw/i386/kvm/apic.c
+++ b/hw/i386/kvm/apic.c
@@ -17,6 +17,7 @@
 #include "system/hw_accel.h"
 #include "system/kvm.h"
 #include "kvm/kvm_i386.h"
+#include "kvm/tdx.h"
 
 static inline void kvm_apic_set_reg(struct kvm_lapic_state *kapic,
                                     int reg_id, uint32_t val)
@@ -141,6 +142,10 @@ static void kvm_apic_put(CPUState *cs, run_on_cpu_data data)
     struct kvm_lapic_state kapic;
     int ret;
 
+    if (is_tdx_vm()) {
+        return;
+    }
+
     kvm_put_apicbase(s->cpu, s->apicbase);
     kvm_put_apic_state(s, &kapic);
 

From b4b7fb5a773e1d2215c2aaa99789eca51914b78f Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Thu, 8 May 2025 10:59:48 -0400
Subject: [PATCH 1259/2760] cpu: Don't set vcpu_dirty when
 guest_state_protected

QEMU calls kvm_arch_put_registers() when vcpu_dirty is true in
kvm_vcpu_exec(). However, for confidential guest, like TDX, putting
registers is disallowed due to guest state is protected.

Only set vcpu_dirty to true with guest state is not protected when
creating the vcpu.

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250508150002.689633-43-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 accel/kvm/kvm-all.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index 71e6060458..51526d301b 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -471,7 +471,9 @@ int kvm_create_vcpu(CPUState *cpu)
 
     cpu->kvm_fd = kvm_fd;
     cpu->kvm_state = s;
-    cpu->vcpu_dirty = true;
+    if (!s->guest_state_protected) {
+        cpu->vcpu_dirty = true;
+    }
     cpu->dirty_pages = 0;
     cpu->throttle_us_per_full = 0;
 

From 695bfaee7153153708228946aa26c6d879599c04 Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Thu, 8 May 2025 10:59:49 -0400
Subject: [PATCH 1260/2760] i386/cgs: Rename *mask_cpuid_features() to
 *adjust_cpuid_features()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Because for TDX case, there are also fixed-1 bits that enforced by TDX
module.

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250508150002.689633-44-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/confidential-guest.h | 20 ++++++++++----------
 target/i386/kvm/kvm.c            |  2 +-
 target/i386/sev.c                |  4 ++--
 3 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/target/i386/confidential-guest.h b/target/i386/confidential-guest.h
index a86c42a475..777d43cc96 100644
--- a/target/i386/confidential-guest.h
+++ b/target/i386/confidential-guest.h
@@ -40,8 +40,8 @@ struct X86ConfidentialGuestClass {
     /* <public> */
     int (*kvm_type)(X86ConfidentialGuest *cg);
     void (*cpu_instance_init)(X86ConfidentialGuest *cg, CPUState *cpu);
-    uint32_t (*mask_cpuid_features)(X86ConfidentialGuest *cg, uint32_t feature, uint32_t index,
-                                    int reg, uint32_t value);
+    uint32_t (*adjust_cpuid_features)(X86ConfidentialGuest *cg, uint32_t feature,
+                                      uint32_t index, int reg, uint32_t value);
 };
 
 /**
@@ -71,21 +71,21 @@ static inline void x86_confidential_guest_cpu_instance_init(X86ConfidentialGuest
 }
 
 /**
- * x86_confidential_guest_mask_cpuid_features:
+ * x86_confidential_guest_adjust_cpuid_features:
  *
- * Removes unsupported features from a confidential guest's CPUID values, returns
- * the value with the bits removed.  The bits removed should be those that KVM
- * provides independent of host-supported CPUID features, but are not supported by
- * the confidential computing firmware.
+ * Adjust the supported features from a confidential guest's CPUID values,
+ * returns the adjusted value.  There are bits being removed that are not
+ * supported by the confidential computing firmware or bits being added that
+ * are forcibly exposed to guest by the confidential computing firmware.
  */
-static inline int x86_confidential_guest_mask_cpuid_features(X86ConfidentialGuest *cg,
+static inline int x86_confidential_guest_adjust_cpuid_features(X86ConfidentialGuest *cg,
                                                              uint32_t feature, uint32_t index,
                                                              int reg, uint32_t value)
 {
     X86ConfidentialGuestClass *klass = X86_CONFIDENTIAL_GUEST_GET_CLASS(cg);
 
-    if (klass->mask_cpuid_features) {
-        return klass->mask_cpuid_features(cg, feature, index, reg, value);
+    if (klass->adjust_cpuid_features) {
+        return klass->adjust_cpuid_features(cg, feature, index, reg, value);
     } else {
         return value;
     }
diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
index 90a0dac4a1..0d47463431 100644
--- a/target/i386/kvm/kvm.c
+++ b/target/i386/kvm/kvm.c
@@ -574,7 +574,7 @@ uint32_t kvm_arch_get_supported_cpuid(KVMState *s, uint32_t function,
     }
 
     if (current_machine->cgs) {
-        ret = x86_confidential_guest_mask_cpuid_features(
+        ret = x86_confidential_guest_adjust_cpuid_features(
             X86_CONFIDENTIAL_GUEST(current_machine->cgs),
             function, index, reg, ret);
     }
diff --git a/target/i386/sev.c b/target/i386/sev.c
index 7ee700d6a3..8b87b7cdec 100644
--- a/target/i386/sev.c
+++ b/target/i386/sev.c
@@ -947,7 +947,7 @@ out:
 }
 
 static uint32_t
-sev_snp_mask_cpuid_features(X86ConfidentialGuest *cg, uint32_t feature, uint32_t index,
+sev_snp_adjust_cpuid_features(X86ConfidentialGuest *cg, uint32_t feature, uint32_t index,
                             int reg, uint32_t value)
 {
     switch (feature) {
@@ -2405,7 +2405,7 @@ sev_snp_guest_class_init(ObjectClass *oc, const void *data)
     klass->launch_finish = sev_snp_launch_finish;
     klass->launch_update_data = sev_snp_launch_update_data;
     klass->kvm_init = sev_snp_kvm_init;
-    x86_klass->mask_cpuid_features = sev_snp_mask_cpuid_features;
+    x86_klass->adjust_cpuid_features = sev_snp_adjust_cpuid_features;
     x86_klass->kvm_type = sev_snp_kvm_type;
 
     object_class_property_add(oc, "policy", "uint64",

From 75ec6189f5c65cab210dd9f16cf4eef368038d45 Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Thu, 8 May 2025 10:59:50 -0400
Subject: [PATCH 1261/2760] i386/tdx: Implement adjust_cpuid_features() for TDX

Maintain a TDX specific supported CPUID set, and use it to mask the
common supported CPUID value of KVM. It can avoid newly added supported
features (reported via KVM_GET_SUPPORTED_CPUID) for common VMs being
falsely reported as supported for TDX.

As the first step, initialize the TDX supported CPUID set with all the
configurable CPUID bits. It's not complete because there are other CPUID
bits are supported for TDX but not reported as directly configurable.
E.g. the XFAM related bits, attribute related bits and fixed-1 bits.
They will be handled in the future.

Also, what matters are the CPUID bits related to QEMU's feature word.
Only mask the CPUID leafs which are feature word leaf.

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250508150002.689633-45-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c          | 16 ++++++++++++++++
 target/i386/cpu.h          |  1 +
 target/i386/kvm/kvm.c      |  2 +-
 target/i386/kvm/kvm_i386.h |  1 +
 target/i386/kvm/tdx.c      | 34 ++++++++++++++++++++++++++++++++++
 5 files changed, 53 insertions(+), 1 deletion(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 6a97d7549e..5aacb62f08 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -1678,6 +1678,22 @@ FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
     },
 };
 
+bool is_feature_word_cpuid(uint32_t feature, uint32_t index, int reg)
+{
+    FeatureWordInfo *wi;
+    FeatureWord w;
+
+    for (w = 0; w < FEATURE_WORDS; w++) {
+        wi = &feature_word_info[w];
+        if (wi->type == CPUID_FEATURE_WORD && wi->cpuid.eax == feature &&
+            (!wi->cpuid.needs_ecx || wi->cpuid.ecx == index) &&
+            wi->cpuid.reg == reg) {
+            return true;
+        }
+    }
+    return false;
+}
+
 typedef struct FeatureMask {
     FeatureWord index;
     uint64_t mask;
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index ad0e3d8cdd..7ffcf91b01 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -2502,6 +2502,7 @@ void cpu_set_apic_feature(CPUX86State *env);
 void host_cpuid(uint32_t function, uint32_t count,
                 uint32_t *eax, uint32_t *ebx, uint32_t *ecx, uint32_t *edx);
 bool cpu_has_x2apic_feature(CPUX86State *env);
+bool is_feature_word_cpuid(uint32_t feature, uint32_t index, int reg);
 
 static inline bool x86_has_cpuid_0x1f(X86CPU *cpu)
 {
diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
index 0d47463431..cd87f5502a 100644
--- a/target/i386/kvm/kvm.c
+++ b/target/i386/kvm/kvm.c
@@ -394,7 +394,7 @@ static bool host_tsx_broken(void)
 
 /* Returns the value for a specific register on the cpuid entry
  */
-static uint32_t cpuid_entry_get_reg(struct kvm_cpuid_entry2 *entry, int reg)
+uint32_t cpuid_entry_get_reg(struct kvm_cpuid_entry2 *entry, int reg)
 {
     uint32_t ret = 0;
     switch (reg) {
diff --git a/target/i386/kvm/kvm_i386.h b/target/i386/kvm/kvm_i386.h
index dc696cb723..484a1de84d 100644
--- a/target/i386/kvm/kvm_i386.h
+++ b/target/i386/kvm/kvm_i386.h
@@ -62,6 +62,7 @@ void kvm_update_msi_routes_all(void *private, bool global,
 struct kvm_cpuid_entry2 *cpuid_find_entry(struct kvm_cpuid2 *cpuid,
                                           uint32_t function,
                                           uint32_t index);
+uint32_t cpuid_entry_get_reg(struct kvm_cpuid_entry2 *entry, int reg);
 uint32_t kvm_x86_build_cpuid(CPUX86State *env, struct kvm_cpuid_entry2 *entries,
                              uint32_t cpuid_i);
 #endif /* CONFIG_KVM */
diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
index 68ed3b9f98..e3b7ad6d14 100644
--- a/target/i386/kvm/tdx.c
+++ b/target/i386/kvm/tdx.c
@@ -45,6 +45,7 @@
 static TdxGuest *tdx_guest;
 
 static struct kvm_tdx_capabilities *tdx_caps;
+static struct kvm_cpuid2 *tdx_supported_cpuid;
 
 /* Valid after kvm_arch_init()->confidential_guest_kvm_init()->tdx_kvm_init() */
 bool is_tdx_vm(void)
@@ -366,6 +367,20 @@ static Notifier tdx_machine_done_notify = {
     .notify = tdx_finalize_vm,
 };
 
+static void tdx_setup_supported_cpuid(void)
+{
+    if (tdx_supported_cpuid) {
+        return;
+    }
+
+    tdx_supported_cpuid = g_malloc0(sizeof(*tdx_supported_cpuid) +
+                    KVM_MAX_CPUID_ENTRIES * sizeof(struct kvm_cpuid_entry2));
+
+    memcpy(tdx_supported_cpuid->entries, tdx_caps->cpuid.entries,
+           tdx_caps->cpuid.nent * sizeof(struct kvm_cpuid_entry2));
+    tdx_supported_cpuid->nent = tdx_caps->cpuid.nent;
+}
+
 static int tdx_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
 {
     MachineState *ms = MACHINE(qdev_get_machine());
@@ -403,6 +418,8 @@ static int tdx_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
         }
     }
 
+    tdx_setup_supported_cpuid();
+
     /* TDX relies on KVM_HC_MAP_GPA_RANGE to handle TDG.VP.VMCALL<MapGPA> */
     if (!kvm_enable_hypercall(BIT_ULL(KVM_HC_MAP_GPA_RANGE))) {
         return -EOPNOTSUPP;
@@ -440,6 +457,22 @@ static void tdx_cpu_instance_init(X86ConfidentialGuest *cg, CPUState *cpu)
     x86cpu->enable_cpuid_0x1f = true;
 }
 
+static uint32_t tdx_adjust_cpuid_features(X86ConfidentialGuest *cg,
+                                          uint32_t feature, uint32_t index,
+                                          int reg, uint32_t value)
+{
+    struct kvm_cpuid_entry2 *e;
+
+    if (is_feature_word_cpuid(feature, index, reg)) {
+        e = cpuid_find_entry(tdx_supported_cpuid, feature, index);
+        if (e) {
+            value &= cpuid_entry_get_reg(e, reg);
+        }
+    }
+
+    return value;
+}
+
 static int tdx_validate_attributes(TdxGuest *tdx, Error **errp)
 {
     if ((tdx->attributes & ~tdx_caps->supported_attrs)) {
@@ -834,4 +867,5 @@ static void tdx_guest_class_init(ObjectClass *oc, const void *data)
     klass->kvm_init = tdx_kvm_init;
     x86_klass->kvm_type = tdx_kvm_type;
     x86_klass->cpu_instance_init = tdx_cpu_instance_init;
+    x86_klass->adjust_cpuid_features = tdx_adjust_cpuid_features;
 }

From 0ba06e46d09b84a2cb97a268da5576aaca3a24ca Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Thu, 8 May 2025 10:59:51 -0400
Subject: [PATCH 1262/2760] i386/tdx: Add TDX fixed1 bits to supported CPUIDs

TDX architecture forcibly sets some CPUID bits for TD guest that VMM
cannot disable it. They are fixed1 bits.

Fixed1 bits are not covered by tdx_caps.cpuid (which only contains the
directly configurable bits), while fixed1 bits are supported for TD guest
obviously.

Add fixed1 bits to tdx_supported_cpuid. Besides, set all the fixed1
bits to the initial set of KVM's support since KVM might not report them
as supported.

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250508150002.689633-46-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.h          |   2 +
 target/i386/kvm/kvm_i386.h |   7 ++
 target/i386/kvm/tdx.c      | 134 +++++++++++++++++++++++++++++++++++++
 target/i386/sev.c          |   8 ---
 4 files changed, 143 insertions(+), 8 deletions(-)

diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index 7ffcf91b01..342e4f2a57 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -920,6 +920,8 @@ uint64_t x86_cpu_get_supported_feature_word(X86CPU *cpu, FeatureWord w);
 #define CPUID_7_0_EDX_FSRM              (1U << 4)
 /* AVX512 Vector Pair Intersection to a Pair of Mask Registers */
 #define CPUID_7_0_EDX_AVX512_VP2INTERSECT (1U << 8)
+ /* "md_clear" VERW clears CPU buffers */
+#define CPUID_7_0_EDX_MD_CLEAR          (1U << 10)
 /* SERIALIZE instruction */
 #define CPUID_7_0_EDX_SERIALIZE         (1U << 14)
 /* TSX Suspend Load Address Tracking instruction */
diff --git a/target/i386/kvm/kvm_i386.h b/target/i386/kvm/kvm_i386.h
index 484a1de84d..5f83e8850a 100644
--- a/target/i386/kvm/kvm_i386.h
+++ b/target/i386/kvm/kvm_i386.h
@@ -44,6 +44,13 @@ void kvm_request_xsave_components(X86CPU *cpu, uint64_t mask);
 
 #ifdef CONFIG_KVM
 
+#include <linux/kvm.h>
+
+typedef struct KvmCpuidInfo {
+    struct kvm_cpuid2 cpuid;
+    struct kvm_cpuid_entry2 entries[KVM_MAX_CPUID_ENTRIES];
+} KvmCpuidInfo;
+
 bool kvm_is_vm_type_supported(int type);
 bool kvm_has_adjust_clock_stable(void);
 bool kvm_has_exception_payload(void);
diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
index e3b7ad6d14..9d92ff1484 100644
--- a/target/i386/kvm/tdx.c
+++ b/target/i386/kvm/tdx.c
@@ -367,6 +367,133 @@ static Notifier tdx_machine_done_notify = {
     .notify = tdx_finalize_vm,
 };
 
+/*
+ * Some CPUID bits change from fixed1 to configurable bits when TDX module
+ * supports TDX_FEATURES0.VE_REDUCTION. e.g., MCA/MCE/MTRR/CORE_CAPABILITY.
+ *
+ * To make QEMU work with all the versions of TDX module, keep the fixed1 bits
+ * here if they are ever fixed1 bits in any of the version though not fixed1 in
+ * the latest version. Otherwise, with the older version of TDX module, QEMU may
+ * treat the fixed1 bit as unsupported.
+ *
+ * For newer TDX module, it does no harm to keep them in tdx_fixed1_bits even
+ * though they changed to configurable bits. Because tdx_fixed1_bits is used to
+ * setup the supported bits.
+ */
+KvmCpuidInfo tdx_fixed1_bits = {
+    .cpuid.nent = 8,
+    .entries[0] = {
+        .function = 0x1,
+        .index = 0,
+        .ecx = CPUID_EXT_SSE3 | CPUID_EXT_PCLMULQDQ | CPUID_EXT_DTES64 |
+               CPUID_EXT_DSCPL | CPUID_EXT_SSSE3 | CPUID_EXT_CX16 |
+               CPUID_EXT_PDCM | CPUID_EXT_PCID | CPUID_EXT_SSE41 |
+               CPUID_EXT_SSE42 | CPUID_EXT_X2APIC | CPUID_EXT_MOVBE |
+               CPUID_EXT_POPCNT | CPUID_EXT_AES | CPUID_EXT_XSAVE |
+               CPUID_EXT_RDRAND | CPUID_EXT_HYPERVISOR,
+        .edx = CPUID_FP87 | CPUID_VME | CPUID_DE | CPUID_PSE | CPUID_TSC |
+               CPUID_MSR | CPUID_PAE | CPUID_MCE | CPUID_CX8 | CPUID_APIC |
+               CPUID_SEP | CPUID_MTRR | CPUID_PGE | CPUID_MCA | CPUID_CMOV |
+               CPUID_PAT | CPUID_CLFLUSH | CPUID_DTS | CPUID_MMX | CPUID_FXSR |
+               CPUID_SSE | CPUID_SSE2,
+    },
+    .entries[1] = {
+        .function = 0x6,
+        .index = 0,
+        .eax = CPUID_6_EAX_ARAT,
+    },
+    .entries[2] = {
+        .function = 0x7,
+        .index = 0,
+        .flags = KVM_CPUID_FLAG_SIGNIFCANT_INDEX,
+        .ebx = CPUID_7_0_EBX_FSGSBASE | CPUID_7_0_EBX_FDP_EXCPTN_ONLY |
+               CPUID_7_0_EBX_SMEP | CPUID_7_0_EBX_INVPCID |
+               CPUID_7_0_EBX_ZERO_FCS_FDS | CPUID_7_0_EBX_RDSEED |
+               CPUID_7_0_EBX_SMAP | CPUID_7_0_EBX_CLFLUSHOPT |
+               CPUID_7_0_EBX_CLWB | CPUID_7_0_EBX_SHA_NI,
+        .ecx = CPUID_7_0_ECX_BUS_LOCK_DETECT | CPUID_7_0_ECX_MOVDIRI |
+               CPUID_7_0_ECX_MOVDIR64B,
+        .edx = CPUID_7_0_EDX_MD_CLEAR | CPUID_7_0_EDX_SPEC_CTRL |
+               CPUID_7_0_EDX_STIBP | CPUID_7_0_EDX_FLUSH_L1D |
+               CPUID_7_0_EDX_ARCH_CAPABILITIES | CPUID_7_0_EDX_CORE_CAPABILITY |
+               CPUID_7_0_EDX_SPEC_CTRL_SSBD,
+    },
+    .entries[3] = {
+        .function = 0x7,
+        .index = 2,
+        .flags = KVM_CPUID_FLAG_SIGNIFCANT_INDEX,
+        .edx = CPUID_7_2_EDX_PSFD | CPUID_7_2_EDX_IPRED_CTRL |
+               CPUID_7_2_EDX_RRSBA_CTRL | CPUID_7_2_EDX_BHI_CTRL,
+    },
+    .entries[4] = {
+        .function = 0xD,
+        .index = 0,
+        .flags = KVM_CPUID_FLAG_SIGNIFCANT_INDEX,
+        .eax = XSTATE_FP_MASK | XSTATE_SSE_MASK,
+    },
+    .entries[5] = {
+        .function = 0xD,
+        .index = 1,
+        .flags = KVM_CPUID_FLAG_SIGNIFCANT_INDEX,
+        .eax = CPUID_XSAVE_XSAVEOPT | CPUID_XSAVE_XSAVEC|
+               CPUID_XSAVE_XGETBV1 | CPUID_XSAVE_XSAVES,
+    },
+    .entries[6] = {
+        .function = 0x80000001,
+        .index = 0,
+        .ecx = CPUID_EXT3_LAHF_LM | CPUID_EXT3_ABM | CPUID_EXT3_3DNOWPREFETCH,
+        /*
+         * Strictly speaking, SYSCALL is not fixed1 bit since it depends on
+         * the CPU to be in 64-bit mode. But here fixed1 is used to serve the
+         * purpose of supported bits for TDX. In this sense, SYACALL is always
+         * supported.
+         */
+        .edx = CPUID_EXT2_SYSCALL | CPUID_EXT2_NX | CPUID_EXT2_PDPE1GB |
+               CPUID_EXT2_RDTSCP | CPUID_EXT2_LM,
+    },
+    .entries[7] = {
+        .function = 0x80000007,
+        .index = 0,
+        .edx = CPUID_APM_INVTSC,
+    },
+};
+
+static struct kvm_cpuid_entry2 *find_in_supported_entry(uint32_t function,
+                                                        uint32_t index)
+{
+    struct kvm_cpuid_entry2 *e;
+
+    e = cpuid_find_entry(tdx_supported_cpuid, function, index);
+    if (!e) {
+        if (tdx_supported_cpuid->nent >= KVM_MAX_CPUID_ENTRIES) {
+            error_report("tdx_supported_cpuid requries more space than %d entries",
+                          KVM_MAX_CPUID_ENTRIES);
+            exit(1);
+        }
+        e = &tdx_supported_cpuid->entries[tdx_supported_cpuid->nent++];
+        e->function = function;
+        e->index = index;
+    }
+
+    return e;
+}
+
+static void tdx_add_supported_cpuid_by_fixed1_bits(void)
+{
+    struct kvm_cpuid_entry2 *e, *e1;
+    int i;
+
+    for (i = 0; i < tdx_fixed1_bits.cpuid.nent; i++) {
+        e = &tdx_fixed1_bits.entries[i];
+
+        e1 = find_in_supported_entry(e->function, e->index);
+        e1->eax |= e->eax;
+        e1->ebx |= e->ebx;
+        e1->ecx |= e->ecx;
+        e1->edx |= e->edx;
+    }
+}
+
 static void tdx_setup_supported_cpuid(void)
 {
     if (tdx_supported_cpuid) {
@@ -379,6 +506,8 @@ static void tdx_setup_supported_cpuid(void)
     memcpy(tdx_supported_cpuid->entries, tdx_caps->cpuid.entries,
            tdx_caps->cpuid.nent * sizeof(struct kvm_cpuid_entry2));
     tdx_supported_cpuid->nent = tdx_caps->cpuid.nent;
+
+    tdx_add_supported_cpuid_by_fixed1_bits();
 }
 
 static int tdx_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
@@ -463,6 +592,11 @@ static uint32_t tdx_adjust_cpuid_features(X86ConfidentialGuest *cg,
 {
     struct kvm_cpuid_entry2 *e;
 
+    e = cpuid_find_entry(&tdx_fixed1_bits.cpuid, feature, index);
+    if (e) {
+        value |= cpuid_entry_get_reg(e, reg);
+    }
+
     if (is_feature_word_cpuid(feature, index, reg)) {
         e = cpuid_find_entry(tdx_supported_cpuid, feature, index);
         if (e) {
diff --git a/target/i386/sev.c b/target/i386/sev.c
index 8b87b7cdec..adf787797e 100644
--- a/target/i386/sev.c
+++ b/target/i386/sev.c
@@ -212,14 +212,6 @@ static const char *const sev_fw_errlist[] = {
 
 #define SEV_FW_MAX_ERROR      ARRAY_SIZE(sev_fw_errlist)
 
-/* <linux/kvm.h> doesn't expose this, so re-use the max from kvm.c */
-#define KVM_MAX_CPUID_ENTRIES 100
-
-typedef struct KvmCpuidInfo {
-    struct kvm_cpuid2 cpuid;
-    struct kvm_cpuid_entry2 entries[KVM_MAX_CPUID_ENTRIES];
-} KvmCpuidInfo;
-
 #define SNP_CPUID_FUNCTION_MAXCOUNT 64
 #define SNP_CPUID_FUNCTION_UNKNOWN 0xFFFFFFFF
 

From 31df29c532a9ef473c6efd497950a620099bf1da Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Thu, 8 May 2025 10:59:52 -0400
Subject: [PATCH 1263/2760] i386/tdx: Add supported CPUID bits related to TD
 Attributes

For TDX, some CPUID feature bit is configured via TD attributes. They
are not covered by tdx_caps.cpuid (which only contians the directly
configurable CPUID bits), but they are actually supported when the
related attributre bit is supported.

Note, LASS and KeyLocker are not supported by KVM for TDX, nor does
QEMU support it (see TDX_SUPPORTED_TD_ATTRS). They are defined in
tdx_attrs_maps[] for the completeness of the existing TD Attribute
bits that are related with CPUID features.

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Link: https://lore.kernel.org/r/20250508150002.689633-47-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.h     |  4 +++
 target/i386/kvm/tdx.c | 60 +++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 64 insertions(+)

diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index 342e4f2a57..e50c57264d 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -899,6 +899,8 @@ uint64_t x86_cpu_get_supported_feature_word(X86CPU *cpu, FeatureWord w);
 #define CPUID_7_0_ECX_LA57              (1U << 16)
 /* Read Processor ID */
 #define CPUID_7_0_ECX_RDPID             (1U << 22)
+/* KeyLocker */
+#define CPUID_7_0_ECX_KeyLocker         (1U << 23)
 /* Bus Lock Debug Exception */
 #define CPUID_7_0_ECX_BUS_LOCK_DETECT   (1U << 24)
 /* Cache Line Demote Instruction */
@@ -959,6 +961,8 @@ uint64_t x86_cpu_get_supported_feature_word(X86CPU *cpu, FeatureWord w);
 #define CPUID_7_1_EAX_AVX_VNNI          (1U << 4)
 /* AVX512 BFloat16 Instruction */
 #define CPUID_7_1_EAX_AVX512_BF16       (1U << 5)
+/* Linear address space separation */
+#define CPUID_7_1_EAX_LASS              (1U << 6)
 /* CMPCCXADD Instructions */
 #define CPUID_7_1_EAX_CMPCCXADD         (1U << 7)
 /* Fast Zero REP MOVS */
diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
index 9d92ff1484..fa161661fa 100644
--- a/target/i386/kvm/tdx.c
+++ b/target/i386/kvm/tdx.c
@@ -458,6 +458,34 @@ KvmCpuidInfo tdx_fixed1_bits = {
     },
 };
 
+typedef struct TdxAttrsMap {
+    uint32_t attr_index;
+    uint32_t cpuid_leaf;
+    uint32_t cpuid_subleaf;
+    int cpuid_reg;
+    uint32_t feat_mask;
+} TdxAttrsMap;
+
+static TdxAttrsMap tdx_attrs_maps[] = {
+    {.attr_index = 27,
+     .cpuid_leaf = 7,
+     .cpuid_subleaf = 1,
+     .cpuid_reg = R_EAX,
+     .feat_mask = CPUID_7_1_EAX_LASS,},
+
+    {.attr_index = 30,
+     .cpuid_leaf = 7,
+     .cpuid_subleaf = 0,
+     .cpuid_reg = R_ECX,
+     .feat_mask = CPUID_7_0_ECX_PKS,},
+
+    {.attr_index = 31,
+     .cpuid_leaf = 7,
+     .cpuid_subleaf = 0,
+     .cpuid_reg = R_ECX,
+     .feat_mask = CPUID_7_0_ECX_KeyLocker,},
+};
+
 static struct kvm_cpuid_entry2 *find_in_supported_entry(uint32_t function,
                                                         uint32_t index)
 {
@@ -494,6 +522,37 @@ static void tdx_add_supported_cpuid_by_fixed1_bits(void)
     }
 }
 
+static void tdx_add_supported_cpuid_by_attrs(void)
+{
+    struct kvm_cpuid_entry2 *e;
+    TdxAttrsMap *map;
+    int i;
+
+    for (i = 0; i < ARRAY_SIZE(tdx_attrs_maps); i++) {
+        map = &tdx_attrs_maps[i];
+        if (!((1ULL << map->attr_index) & tdx_caps->supported_attrs)) {
+            continue;
+        }
+
+        e = find_in_supported_entry(map->cpuid_leaf, map->cpuid_subleaf);
+
+        switch(map->cpuid_reg) {
+        case R_EAX:
+            e->eax |= map->feat_mask;
+            break;
+        case R_EBX:
+            e->ebx |= map->feat_mask;
+            break;
+        case R_ECX:
+            e->ecx |= map->feat_mask;
+            break;
+        case R_EDX:
+            e->edx |= map->feat_mask;
+            break;
+        }
+    }
+}
+
 static void tdx_setup_supported_cpuid(void)
 {
     if (tdx_supported_cpuid) {
@@ -508,6 +567,7 @@ static void tdx_setup_supported_cpuid(void)
     tdx_supported_cpuid->nent = tdx_caps->cpuid.nent;
 
     tdx_add_supported_cpuid_by_fixed1_bits();
+    tdx_add_supported_cpuid_by_attrs();
 }
 
 static int tdx_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)

From 8c94c84cb9e0140b48acc9c9d404525ca7ef7457 Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Thu, 8 May 2025 10:59:53 -0400
Subject: [PATCH 1264/2760] i386/tdx: Add supported CPUID bits relates to XFAM

Some CPUID bits are controlled by XFAM. They are not covered by
tdx_caps.cpuid (which only contians the directly configurable bits), but
they are actually supported when the related XFAM bit is supported.

Add these XFAM controlled bits to TDX supported CPUID bits based on the
supported_xfam.

Besides, incorporate the supported_xfam into the supported CPUID leaf of
0xD.

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Link: https://lore.kernel.org/r/20250508150002.689633-48-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c     | 12 -------
 target/i386/cpu.h     | 16 ++++++++++
 target/i386/kvm/tdx.c | 73 +++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 89 insertions(+), 12 deletions(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 5aacb62f08..383c0b35d4 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -1694,15 +1694,6 @@ bool is_feature_word_cpuid(uint32_t feature, uint32_t index, int reg)
     return false;
 }
 
-typedef struct FeatureMask {
-    FeatureWord index;
-    uint64_t mask;
-} FeatureMask;
-
-typedef struct FeatureDep {
-    FeatureMask from, to;
-} FeatureDep;
-
 static FeatureDep feature_dependencies[] = {
     {
         .from = { FEAT_7_0_EDX,             CPUID_7_0_EDX_ARCH_CAPABILITIES },
@@ -1871,9 +1862,6 @@ static const X86RegisterInfo32 x86_reg_info_32[CPU_NB_REGS32] = {
 };
 #undef REGISTER
 
-/* CPUID feature bits available in XSS */
-#define CPUID_XSTATE_XSS_MASK    (XSTATE_ARCH_LBR_MASK)
-
 ExtSaveArea x86_ext_save_areas[XSAVE_STATE_AREA_COUNT] = {
     [XSTATE_FP_BIT] = {
         /* x87 FP state component is always enabled if XSAVE is supported */
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index e50c57264d..b38e691f1a 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -584,6 +584,7 @@ typedef enum X86Seg {
 #define XSTATE_OPMASK_BIT               5
 #define XSTATE_ZMM_Hi256_BIT            6
 #define XSTATE_Hi16_ZMM_BIT             7
+#define XSTATE_PT_BIT                   8
 #define XSTATE_PKRU_BIT                 9
 #define XSTATE_ARCH_LBR_BIT             15
 #define XSTATE_XTILE_CFG_BIT            17
@@ -597,6 +598,7 @@ typedef enum X86Seg {
 #define XSTATE_OPMASK_MASK              (1ULL << XSTATE_OPMASK_BIT)
 #define XSTATE_ZMM_Hi256_MASK           (1ULL << XSTATE_ZMM_Hi256_BIT)
 #define XSTATE_Hi16_ZMM_MASK            (1ULL << XSTATE_Hi16_ZMM_BIT)
+#define XSTATE_PT_MASK                  (1ULL << XSTATE_PT_BIT)
 #define XSTATE_PKRU_MASK                (1ULL << XSTATE_PKRU_BIT)
 #define XSTATE_ARCH_LBR_MASK            (1ULL << XSTATE_ARCH_LBR_BIT)
 #define XSTATE_XTILE_CFG_MASK           (1ULL << XSTATE_XTILE_CFG_BIT)
@@ -619,6 +621,11 @@ typedef enum X86Seg {
                                  XSTATE_Hi16_ZMM_MASK | XSTATE_PKRU_MASK | \
                                  XSTATE_XTILE_CFG_MASK | XSTATE_XTILE_DATA_MASK)
 
+/* CPUID feature bits available in XSS */
+#define CPUID_XSTATE_XSS_MASK    (XSTATE_ARCH_LBR_MASK)
+
+#define CPUID_XSTATE_MASK       (CPUID_XSTATE_XCR0_MASK | CPUID_XSTATE_XSS_MASK)
+
 /* CPUID feature words */
 typedef enum FeatureWord {
     FEAT_1_EDX,         /* CPUID[1].EDX */
@@ -667,6 +674,15 @@ typedef enum FeatureWord {
     FEATURE_WORDS,
 } FeatureWord;
 
+typedef struct FeatureMask {
+    FeatureWord index;
+    uint64_t mask;
+} FeatureMask;
+
+typedef struct FeatureDep {
+    FeatureMask from, to;
+} FeatureDep;
+
 typedef uint64_t FeatureWordArray[FEATURE_WORDS];
 uint64_t x86_cpu_get_supported_feature_word(X86CPU *cpu, FeatureWord w);
 
diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
index fa161661fa..188c2242d5 100644
--- a/target/i386/kvm/tdx.c
+++ b/target/i386/kvm/tdx.c
@@ -23,6 +23,8 @@
 
 #include <linux/kvm_para.h>
 
+#include "cpu.h"
+#include "cpu-internal.h"
 #include "hw/i386/e820_memory_layout.h"
 #include "hw/i386/tdvf.h"
 #include "hw/i386/x86.h"
@@ -486,6 +488,32 @@ static TdxAttrsMap tdx_attrs_maps[] = {
      .feat_mask = CPUID_7_0_ECX_KeyLocker,},
 };
 
+typedef struct TdxXFAMDep {
+    int xfam_bit;
+    FeatureMask feat_mask;
+} TdxXFAMDep;
+
+/*
+ * Note, only the CPUID bits whose virtualization type are "XFAM & Native" are
+ * defiend here.
+ *
+ * For those whose virtualization type are "XFAM & Configured & Native", they
+ * are reported as configurable bits. And they are not supported if not in the
+ * configureable bits list from KVM even if the corresponding XFAM bit is
+ * supported.
+ */
+TdxXFAMDep tdx_xfam_deps[] = {
+    { XSTATE_YMM_BIT,       { FEAT_1_ECX, CPUID_EXT_FMA }},
+    { XSTATE_YMM_BIT,       { FEAT_7_0_EBX, CPUID_7_0_EBX_AVX2 }},
+    { XSTATE_OPMASK_BIT,    { FEAT_7_0_ECX, CPUID_7_0_ECX_AVX512_VBMI}},
+    { XSTATE_OPMASK_BIT,    { FEAT_7_0_EDX, CPUID_7_0_EDX_AVX512_FP16}},
+    { XSTATE_PT_BIT,        { FEAT_7_0_EBX, CPUID_7_0_EBX_INTEL_PT}},
+    { XSTATE_PKRU_BIT,      { FEAT_7_0_ECX, CPUID_7_0_ECX_PKU}},
+    { XSTATE_XTILE_CFG_BIT, { FEAT_7_0_EDX, CPUID_7_0_EDX_AMX_BF16 }},
+    { XSTATE_XTILE_CFG_BIT, { FEAT_7_0_EDX, CPUID_7_0_EDX_AMX_TILE }},
+    { XSTATE_XTILE_CFG_BIT, { FEAT_7_0_EDX, CPUID_7_0_EDX_AMX_INT8 }},
+};
+
 static struct kvm_cpuid_entry2 *find_in_supported_entry(uint32_t function,
                                                         uint32_t index)
 {
@@ -553,6 +581,50 @@ static void tdx_add_supported_cpuid_by_attrs(void)
     }
 }
 
+static void tdx_add_supported_cpuid_by_xfam(void)
+{
+    struct kvm_cpuid_entry2 *e;
+    int i;
+
+    const TdxXFAMDep *xfam_dep;
+    const FeatureWordInfo *f;
+    for (i = 0; i < ARRAY_SIZE(tdx_xfam_deps); i++) {
+        xfam_dep = &tdx_xfam_deps[i];
+        if (!((1ULL << xfam_dep->xfam_bit) & tdx_caps->supported_xfam)) {
+            continue;
+        }
+
+        f = &feature_word_info[xfam_dep->feat_mask.index];
+        if (f->type != CPUID_FEATURE_WORD) {
+            continue;
+        }
+
+        e = find_in_supported_entry(f->cpuid.eax, f->cpuid.ecx);
+        switch(f->cpuid.reg) {
+        case R_EAX:
+            e->eax |= xfam_dep->feat_mask.mask;
+            break;
+        case R_EBX:
+            e->ebx |= xfam_dep->feat_mask.mask;
+            break;
+        case R_ECX:
+            e->ecx |= xfam_dep->feat_mask.mask;
+            break;
+        case R_EDX:
+            e->edx |= xfam_dep->feat_mask.mask;
+            break;
+        }
+    }
+
+    e = find_in_supported_entry(0xd, 0);
+    e->eax |= (tdx_caps->supported_xfam & CPUID_XSTATE_XCR0_MASK);
+    e->edx |= (tdx_caps->supported_xfam & CPUID_XSTATE_XCR0_MASK) >> 32;
+
+    e = find_in_supported_entry(0xd, 1);
+    e->ecx |= (tdx_caps->supported_xfam & CPUID_XSTATE_XSS_MASK);
+    e->edx |= (tdx_caps->supported_xfam & CPUID_XSTATE_XSS_MASK) >> 32;
+}
+
 static void tdx_setup_supported_cpuid(void)
 {
     if (tdx_supported_cpuid) {
@@ -568,6 +640,7 @@ static void tdx_setup_supported_cpuid(void)
 
     tdx_add_supported_cpuid_by_fixed1_bits();
     tdx_add_supported_cpuid_by_attrs();
+    tdx_add_supported_cpuid_by_xfam();
 }
 
 static int tdx_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)

From 9f5771c57dbe92d46361afd992a5851c846d0322 Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Thu, 8 May 2025 10:59:54 -0400
Subject: [PATCH 1265/2760] i386/tdx: Add XFD to supported bit of TDX

Just mark XFD as always supported for TDX. This simple solution relies
on the fact KVM will report XFD as 0 when it's not supported by the
hardware.

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250508150002.689633-49-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.h     | 1 +
 target/i386/kvm/tdx.c | 6 ++++++
 2 files changed, 7 insertions(+)

diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index b38e691f1a..8a4b4217d0 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -1122,6 +1122,7 @@ uint64_t x86_cpu_get_supported_feature_word(X86CPU *cpu, FeatureWord w);
 #define CPUID_XSAVE_XSAVEC     (1U << 1)
 #define CPUID_XSAVE_XGETBV1    (1U << 2)
 #define CPUID_XSAVE_XSAVES     (1U << 3)
+#define CPUID_XSAVE_XFD        (1U << 4)
 
 #define CPUID_6_EAX_ARAT       (1U << 2)
 
diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
index 188c2242d5..0f7f47c6da 100644
--- a/target/i386/kvm/tdx.c
+++ b/target/i386/kvm/tdx.c
@@ -621,6 +621,12 @@ static void tdx_add_supported_cpuid_by_xfam(void)
     e->edx |= (tdx_caps->supported_xfam & CPUID_XSTATE_XCR0_MASK) >> 32;
 
     e = find_in_supported_entry(0xd, 1);
+    /*
+     * Mark XFD always support for TDX, it will be cleared finally in
+     * tdx_adjust_cpuid_features() if XFD is unavailable on the hardware
+     * because in this case the original data has it as 0.
+     */
+    e->eax |= CPUID_XSAVE_XFD;
     e->ecx |= (tdx_caps->supported_xfam & CPUID_XSTATE_XSS_MASK);
     e->edx |= (tdx_caps->supported_xfam & CPUID_XSTATE_XSS_MASK) >> 32;
 }

From 4d6e288a350a977b0fb0613db952087928ccd93e Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Thu, 8 May 2025 10:59:55 -0400
Subject: [PATCH 1266/2760] i386/tdx: Define supported KVM features for TDX

For TDX, only limited KVM PV features are supported.

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250508150002.689633-50-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/kvm/tdx.c | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
index 0f7f47c6da..e35983ad9b 100644
--- a/target/i386/kvm/tdx.c
+++ b/target/i386/kvm/tdx.c
@@ -32,6 +32,8 @@
 #include "kvm_i386.h"
 #include "tdx.h"
 
+#include "standard-headers/asm-x86/kvm_para.h"
+
 #define TDX_MIN_TSC_FREQUENCY_KHZ   (100 * 1000)
 #define TDX_MAX_TSC_FREQUENCY_KHZ   (10 * 1000 * 1000)
 
@@ -44,6 +46,14 @@
                                  TDX_TD_ATTRIBUTES_PKS | \
                                  TDX_TD_ATTRIBUTES_PERFMON)
 
+#define TDX_SUPPORTED_KVM_FEATURES  ((1U << KVM_FEATURE_NOP_IO_DELAY) | \
+                                     (1U << KVM_FEATURE_PV_UNHALT) | \
+                                     (1U << KVM_FEATURE_PV_TLB_FLUSH) | \
+                                     (1U << KVM_FEATURE_PV_SEND_IPI) | \
+                                     (1U << KVM_FEATURE_POLL_CONTROL) | \
+                                     (1U << KVM_FEATURE_PV_SCHED_YIELD) | \
+                                     (1U << KVM_FEATURE_MSI_EXT_DEST_ID))
+
 static TdxGuest *tdx_guest;
 
 static struct kvm_tdx_capabilities *tdx_caps;
@@ -631,6 +641,14 @@ static void tdx_add_supported_cpuid_by_xfam(void)
     e->edx |= (tdx_caps->supported_xfam & CPUID_XSTATE_XSS_MASK) >> 32;
 }
 
+static void tdx_add_supported_kvm_features(void)
+{
+    struct kvm_cpuid_entry2 *e;
+
+    e = find_in_supported_entry(0x40000001, 0);
+    e->eax = TDX_SUPPORTED_KVM_FEATURES;
+}
+
 static void tdx_setup_supported_cpuid(void)
 {
     if (tdx_supported_cpuid) {
@@ -647,6 +665,8 @@ static void tdx_setup_supported_cpuid(void)
     tdx_add_supported_cpuid_by_fixed1_bits();
     tdx_add_supported_cpuid_by_attrs();
     tdx_add_supported_cpuid_by_xfam();
+
+    tdx_add_supported_kvm_features();
 }
 
 static int tdx_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)

From dc0b08b303ad34983b43936a4c978672e0f9a9d8 Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Thu, 8 May 2025 10:59:56 -0400
Subject: [PATCH 1267/2760] i386/cgs: Introduce
 x86_confidential_guest_check_features()

To do cgs specific feature checking. Note the feature checking in
x86_cpu_filter_features() is valid for non-cgs VMs. For cgs VMs like
TDX, what features can be supported has more restrictions.

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250508150002.689633-51-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/confidential-guest.h | 13 +++++++++++++
 target/i386/kvm/kvm.c            |  8 ++++++++
 2 files changed, 21 insertions(+)

diff --git a/target/i386/confidential-guest.h b/target/i386/confidential-guest.h
index 777d43cc96..48b88dbd31 100644
--- a/target/i386/confidential-guest.h
+++ b/target/i386/confidential-guest.h
@@ -42,6 +42,7 @@ struct X86ConfidentialGuestClass {
     void (*cpu_instance_init)(X86ConfidentialGuest *cg, CPUState *cpu);
     uint32_t (*adjust_cpuid_features)(X86ConfidentialGuest *cg, uint32_t feature,
                                       uint32_t index, int reg, uint32_t value);
+    int (*check_features)(X86ConfidentialGuest *cg, CPUState *cs);
 };
 
 /**
@@ -91,4 +92,16 @@ static inline int x86_confidential_guest_adjust_cpuid_features(X86ConfidentialGu
     }
 }
 
+static inline int x86_confidential_guest_check_features(X86ConfidentialGuest *cg,
+                                                        CPUState *cs)
+{
+    X86ConfidentialGuestClass *klass = X86_CONFIDENTIAL_GUEST_GET_CLASS(cg);
+
+    if (klass->check_features) {
+        return klass->check_features(cg, cs);
+    }
+
+    return 0;
+}
+
 #endif
diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
index cd87f5502a..a6bc089d02 100644
--- a/target/i386/kvm/kvm.c
+++ b/target/i386/kvm/kvm.c
@@ -2093,6 +2093,14 @@ int kvm_arch_init_vcpu(CPUState *cs)
     int r;
     Error *local_err = NULL;
 
+    if (current_machine->cgs) {
+        r = x86_confidential_guest_check_features(
+                X86_CONFIDENTIAL_GUEST(current_machine->cgs), cs);
+        if (r < 0) {
+            return r;
+        }
+    }
+
     memset(&cpuid_data, 0, sizeof(cpuid_data));
 
     cpuid_i = 0;

From 4a2fb19669bb41eee5b2fb8e5b5ba30e1daaeaf5 Mon Sep 17 00:00:00 2001
From: Lei Wang <lei4.wang@intel.com>
Date: Tue, 17 Dec 2024 07:39:31 -0500
Subject: [PATCH 1268/2760] i386: Remove unused parameter "uint32_t bit" in
 feature_word_description()

Parameter "uint32_t bit" is not used in function feature_word_description(),
so remove it.

Signed-off-by: Lei Wang <lei4.wang@intel.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20241217123932.948789-2-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 383c0b35d4..6258027ab1 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -5771,7 +5771,7 @@ static const TypeInfo max_x86_cpu_type_info = {
     .class_init = max_x86_cpu_class_init,
 };
 
-static char *feature_word_description(FeatureWordInfo *f, uint32_t bit)
+static char *feature_word_description(FeatureWordInfo *f)
 {
     assert(f->type == CPUID_FEATURE_WORD || f->type == MSR_FEATURE_WORD);
 
@@ -5810,6 +5810,7 @@ static void mark_unavailable_features(X86CPU *cpu, FeatureWord w, uint64_t mask,
     CPUX86State *env = &cpu->env;
     FeatureWordInfo *f = &feature_word_info[w];
     int i;
+    g_autofree char *feat_word_str = feature_word_description(f);
 
     if (!cpu->force_features) {
         env->features[w] &= ~mask;
@@ -5822,7 +5823,6 @@ static void mark_unavailable_features(X86CPU *cpu, FeatureWord w, uint64_t mask,
 
     for (i = 0; i < 64; ++i) {
         if ((1ULL << i) & mask) {
-            g_autofree char *feat_word_str = feature_word_description(f, i);
             warn_report("%s: %s%s%s [bit %d]",
                         verbose_prefix,
                         feat_word_str,

From adf25ad70f2f989e63c2cd3e9de4e38152d05e84 Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Tue, 17 Dec 2024 07:39:32 -0500
Subject: [PATCH 1269/2760] target/i386: Print CPUID subleaf info for
 unsupported feature

Some CPUID leaves have meaningful subleaf index. Print the subleaf info
in feature_word_description for CPUID features.

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20241217123932.948789-3-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 6258027ab1..be3812973f 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -5780,11 +5780,15 @@ static char *feature_word_description(FeatureWordInfo *f)
         {
             const char *reg = get_register_name_32(f->cpuid.reg);
             assert(reg);
-            return g_strdup_printf("CPUID.%02XH:%s",
-                                   f->cpuid.eax, reg);
+            if (!f->cpuid.needs_ecx) {
+                return g_strdup_printf("CPUID[eax=%02Xh].%s", f->cpuid.eax, reg);
+            } else {
+                return g_strdup_printf("CPUID[eax=%02Xh,ecx=%02Xh].%s",
+                                       f->cpuid.eax, f->cpuid.ecx, reg);
+            }
         }
     case MSR_FEATURE_WORD:
-        return g_strdup_printf("MSR(%02XH)",
+        return g_strdup_printf("MSR(%02Xh)",
                                f->msr.index);
     }
 

From e3d1a4a6d1d61cf5fbd0e4b389cfb3976093739f Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Thu, 8 May 2025 10:59:57 -0400
Subject: [PATCH 1270/2760] i386/tdx: Fetch and validate CPUID of TD guest

Use KVM_TDX_GET_CPUID to get the CPUIDs that are managed and enfored
by TDX module for TD guest. Check QEMU's configuration against the
fetched data.

Print wanring  message when 1. a feature is not supported but requested
by QEMU or 2. QEMU doesn't want to expose a feature while it is enforced
enabled.

- If cpu->enforced_cpuid is not set, prints the warning message of both
1) and 2) and tweak QEMU's configuration.

- If cpu->enforced_cpuid is set, quit if any case of 1) or 2).

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Link: https://lore.kernel.org/r/20250508150002.689633-52-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c     |  33 +++++++++++++-
 target/i386/cpu.h     |   7 +++
 target/i386/kvm/tdx.c | 101 ++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 139 insertions(+), 2 deletions(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index be3812973f..34364cf96a 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -5808,8 +5808,8 @@ static bool x86_cpu_have_filtered_features(X86CPU *cpu)
     return false;
 }
 
-static void mark_unavailable_features(X86CPU *cpu, FeatureWord w, uint64_t mask,
-                                      const char *verbose_prefix)
+void mark_unavailable_features(X86CPU *cpu, FeatureWord w, uint64_t mask,
+                               const char *verbose_prefix)
 {
     CPUX86State *env = &cpu->env;
     FeatureWordInfo *f = &feature_word_info[w];
@@ -5836,6 +5836,35 @@ static void mark_unavailable_features(X86CPU *cpu, FeatureWord w, uint64_t mask,
     }
 }
 
+void mark_forced_on_features(X86CPU *cpu, FeatureWord w, uint64_t mask,
+                             const char *verbose_prefix)
+{
+    CPUX86State *env = &cpu->env;
+    FeatureWordInfo *f = &feature_word_info[w];
+    int i;
+
+    if (!cpu->force_features) {
+        env->features[w] |= mask;
+    }
+
+    cpu->forced_on_features[w] |= mask;
+
+    if (!verbose_prefix) {
+        return;
+    }
+
+    for (i = 0; i < 64; ++i) {
+        if ((1ULL << i) & mask) {
+            g_autofree char *feat_word_str = feature_word_description(f);
+            warn_report("%s: %s%s%s [bit %d]",
+                        verbose_prefix,
+                        feat_word_str,
+                        f->feat_names[i] ? "." : "",
+                        f->feat_names[i] ? f->feat_names[i] : "", i);
+        }
+    }
+}
+
 static void x86_cpuid_version_get_family(Object *obj, Visitor *v,
                                          const char *name, void *opaque,
                                          Error **errp)
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index 8a4b4217d0..22e82444ae 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -2215,6 +2215,9 @@ struct ArchCPU {
     /* Features that were filtered out because of missing host capabilities */
     FeatureWordArray filtered_features;
 
+    /* Features that are forced enabled by underlying hypervisor, e.g., TDX */
+    FeatureWordArray forced_on_features;
+
     /* Enable PMU CPUID bits. This can't be enabled by default yet because
      * it doesn't have ABI stability guarantees, as it passes all PMU CPUID
      * bits returned by GET_SUPPORTED_CPUID (that depend on host CPU and kernel
@@ -2526,6 +2529,10 @@ void host_cpuid(uint32_t function, uint32_t count,
                 uint32_t *eax, uint32_t *ebx, uint32_t *ecx, uint32_t *edx);
 bool cpu_has_x2apic_feature(CPUX86State *env);
 bool is_feature_word_cpuid(uint32_t feature, uint32_t index, int reg);
+void mark_unavailable_features(X86CPU *cpu, FeatureWord w, uint64_t mask,
+                               const char *verbose_prefix);
+void mark_forced_on_features(X86CPU *cpu, FeatureWord w, uint64_t mask,
+                             const char *verbose_prefix);
 
 static inline bool x86_has_cpuid_0x1f(X86CPU *cpu)
 {
diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
index e35983ad9b..e474abf3a6 100644
--- a/target/i386/kvm/tdx.c
+++ b/target/i386/kvm/tdx.c
@@ -766,6 +766,106 @@ static uint32_t tdx_adjust_cpuid_features(X86ConfidentialGuest *cg,
     return value;
 }
 
+static struct kvm_cpuid2 *tdx_fetch_cpuid(CPUState *cpu, int *ret)
+{
+    struct kvm_cpuid2 *fetch_cpuid;
+    int size = KVM_MAX_CPUID_ENTRIES;
+    Error *local_err = NULL;
+    int r;
+
+    do {
+        error_free(local_err);
+        local_err = NULL;
+
+        fetch_cpuid = g_malloc0(sizeof(*fetch_cpuid) +
+                                sizeof(struct kvm_cpuid_entry2) * size);
+        fetch_cpuid->nent = size;
+        r = tdx_vcpu_ioctl(cpu, KVM_TDX_GET_CPUID, 0, fetch_cpuid, &local_err);
+        if (r == -E2BIG) {
+            g_free(fetch_cpuid);
+            size = fetch_cpuid->nent;
+        }
+    } while (r == -E2BIG);
+
+    if (r < 0) {
+        error_report_err(local_err);
+        *ret = r;
+        return NULL;
+    }
+
+    return fetch_cpuid;
+}
+
+static int tdx_check_features(X86ConfidentialGuest *cg, CPUState *cs)
+{
+    uint64_t actual, requested, unavailable, forced_on;
+    g_autofree struct kvm_cpuid2 *fetch_cpuid;
+    const char *forced_on_prefix = NULL;
+    const char *unav_prefix = NULL;
+    struct kvm_cpuid_entry2 *entry;
+    X86CPU *cpu = X86_CPU(cs);
+    CPUX86State *env = &cpu->env;
+    FeatureWordInfo *wi;
+    FeatureWord w;
+    bool mismatch = false;
+    int r;
+
+    fetch_cpuid = tdx_fetch_cpuid(cs, &r);
+    if (!fetch_cpuid) {
+        return r;
+    }
+
+    if (cpu->check_cpuid || cpu->enforce_cpuid) {
+        unav_prefix = "TDX doesn't support requested feature";
+        forced_on_prefix = "TDX forcibly sets the feature";
+    }
+
+    for (w = 0; w < FEATURE_WORDS; w++) {
+        wi = &feature_word_info[w];
+        actual = 0;
+
+        switch (wi->type) {
+        case CPUID_FEATURE_WORD:
+            entry = cpuid_find_entry(fetch_cpuid, wi->cpuid.eax, wi->cpuid.ecx);
+            if (!entry) {
+                /*
+                 * If KVM doesn't report it means it's totally configurable
+                 * by QEMU
+                 */
+                continue;
+            }
+
+            actual = cpuid_entry_get_reg(entry, wi->cpuid.reg);
+            break;
+        case MSR_FEATURE_WORD:
+            /*
+             * TODO:
+             * validate MSR features when KVM has interface report them.
+             */
+            continue;
+        }
+
+        requested = env->features[w];
+        unavailable = requested & ~actual;
+        mark_unavailable_features(cpu, w, unavailable, unav_prefix);
+        if (unavailable) {
+            mismatch = true;
+        }
+
+        forced_on = actual & ~requested;
+        mark_forced_on_features(cpu, w, forced_on, forced_on_prefix);
+        if (forced_on) {
+            mismatch = true;
+        }
+    }
+
+    if (cpu->enforce_cpuid && mismatch) {
+        return -EINVAL;
+    }
+
+    return 0;
+}
+
 static int tdx_validate_attributes(TdxGuest *tdx, Error **errp)
 {
     if ((tdx->attributes & ~tdx_caps->supported_attrs)) {
@@ -1161,4 +1261,5 @@ static void tdx_guest_class_init(ObjectClass *oc, const void *data)
     x86_klass->kvm_type = tdx_kvm_type;
     x86_klass->cpu_instance_init = tdx_cpu_instance_init;
     x86_klass->adjust_cpuid_features = tdx_adjust_cpuid_features;
+    x86_klass->check_features = tdx_check_features;
 }

From deb9db6fb789cfe80527b75983e86137589227a4 Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Thu, 8 May 2025 10:59:58 -0400
Subject: [PATCH 1271/2760] i386/tdx: Don't treat SYSCALL as unavailable

On Intel CPU, the value of CPUID_EXT2_SYSCALL depends on the mode of
the vcpu. It's 0 outside 64-bit mode and 1 in 64-bit mode.

The initial state of TDX vcpu is 32-bit protected mode. At the time of
calling KVM_TDX_GET_CPUID, vcpu hasn't started running so the value read
is 0.

In reality, 64-bit mode should always be supported. So mark
CPUID_EXT2_SYSCALL always supported to avoid false warning.

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250508150002.689633-53-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/kvm/tdx.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
index e474abf3a6..7629302991 100644
--- a/target/i386/kvm/tdx.c
+++ b/target/i386/kvm/tdx.c
@@ -845,6 +845,19 @@ static int tdx_check_features(X86ConfidentialGuest *cg, CPUState *cs)
             continue;
         }
 
+        /* Fixup for special cases */
+        switch (w) {
+        case FEAT_8000_0001_EDX:
+            /*
+             * Intel enumerates SYSCALL bit as 1 only when processor in 64-bit
+             * mode and before vcpu running it's not in 64-bit mode.
+             */
+            actual |= CPUID_EXT2_SYSCALL;
+            break;
+        default:
+            break;
+        }
+
         requested = env->features[w];
         unavailable = requested & ~actual;
         mark_unavailable_features(cpu, w, unavailable, unav_prefix);

From ea4867b911fc2f6d4c8bd50ec62f0dc0fa190fab Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Thu, 8 May 2025 10:59:59 -0400
Subject: [PATCH 1272/2760] i386/tdx: Make invtsc default on

Because it's fixed1 bit that enforced by TDX module.

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250508150002.689633-54-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/kvm/tdx.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
index 7629302991..a55ab436ad 100644
--- a/target/i386/kvm/tdx.c
+++ b/target/i386/kvm/tdx.c
@@ -742,6 +742,9 @@ static void tdx_cpu_instance_init(X86ConfidentialGuest *cg, CPUState *cpu)
 
     object_property_set_bool(OBJECT(cpu), "pmu", false, &error_abort);
 
+    /* invtsc is fixed1 for TD guest */
+    object_property_set_bool(OBJECT(cpu), "invtsc", true, &error_abort);
+
     x86cpu->enable_cpuid_0x1f = true;
 }
 

From 907ee7b67e50a7eea2768c66e3ad67c9aa4ffd3c Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Thu, 8 May 2025 11:00:00 -0400
Subject: [PATCH 1273/2760] i386/tdx: Validate phys_bits against host value
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

For TDX guest, the phys_bits is not configurable and can only be
host/native value.

Validate phys_bits inside tdx_check_features().

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250508150002.689633-55-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/host-cpu.c | 2 +-
 target/i386/host-cpu.h | 1 +
 target/i386/kvm/tdx.c  | 8 ++++++++
 3 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/target/i386/host-cpu.c b/target/i386/host-cpu.c
index a2d3830f5b..7512567298 100644
--- a/target/i386/host-cpu.c
+++ b/target/i386/host-cpu.c
@@ -15,7 +15,7 @@
 #include "system/system.h"
 
 /* Note: Only safe for use on x86(-64) hosts */
-static uint32_t host_cpu_phys_bits(void)
+uint32_t host_cpu_phys_bits(void)
 {
     uint32_t eax;
     uint32_t host_phys_bits;
diff --git a/target/i386/host-cpu.h b/target/i386/host-cpu.h
index 6a9bc918ba..b97ec01c9b 100644
--- a/target/i386/host-cpu.h
+++ b/target/i386/host-cpu.h
@@ -10,6 +10,7 @@
 #ifndef HOST_CPU_H
 #define HOST_CPU_H
 
+uint32_t host_cpu_phys_bits(void);
 void host_cpu_instance_init(X86CPU *cpu);
 void host_cpu_max_instance_init(X86CPU *cpu);
 bool host_cpu_realizefn(CPUState *cs, Error **errp);
diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
index a55ab436ad..0a21ae555c 100644
--- a/target/i386/kvm/tdx.c
+++ b/target/i386/kvm/tdx.c
@@ -25,6 +25,7 @@
 
 #include "cpu.h"
 #include "cpu-internal.h"
+#include "host-cpu.h"
 #include "hw/i386/e820_memory_layout.h"
 #include "hw/i386/tdvf.h"
 #include "hw/i386/x86.h"
@@ -879,6 +880,13 @@ static int tdx_check_features(X86ConfidentialGuest *cg, CPUState *cs)
         return -EINVAL;
     }
 
+    if (cpu->phys_bits != host_cpu_phys_bits()) {
+        error_report("TDX requires guest CPU physical bits (%u) "
+                     "to match host CPU physical bits (%u)",
+                     cpu->phys_bits, host_cpu_phys_bits());
+        return -EINVAL;
+    }
+
     return 0;
 }
 

From dc1424319311f86449c6825ceec2364ee645a363 Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Thu, 8 May 2025 11:00:01 -0400
Subject: [PATCH 1274/2760] docs: Add TDX documentation

Add docs/system/i386/tdx.rst for TDX support, and add tdx in
confidential-guest-support.rst

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Link: https://lore.kernel.org/r/20250508150002.689633-56-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 docs/system/confidential-guest-support.rst |   1 +
 docs/system/i386/tdx.rst                   | 161 +++++++++++++++++++++
 docs/system/target-i386.rst                |   1 +
 3 files changed, 163 insertions(+)
 create mode 100644 docs/system/i386/tdx.rst

diff --git a/docs/system/confidential-guest-support.rst b/docs/system/confidential-guest-support.rst
index 0c490dbda2..66129fbab6 100644
--- a/docs/system/confidential-guest-support.rst
+++ b/docs/system/confidential-guest-support.rst
@@ -38,6 +38,7 @@ Supported mechanisms
 Currently supported confidential guest mechanisms are:
 
 * AMD Secure Encrypted Virtualization (SEV) (see :doc:`i386/amd-memory-encryption`)
+* Intel Trust Domain Extension (TDX) (see :doc:`i386/tdx`)
 * POWER Protected Execution Facility (PEF) (see :ref:`power-papr-protected-execution-facility-pef`)
 * s390x Protected Virtualization (PV) (see :doc:`s390x/protvirt`)
 
diff --git a/docs/system/i386/tdx.rst b/docs/system/i386/tdx.rst
new file mode 100644
index 0000000000..8131750b64
--- /dev/null
+++ b/docs/system/i386/tdx.rst
@@ -0,0 +1,161 @@
+Intel Trusted Domain eXtension (TDX)
+====================================
+
+Intel Trusted Domain eXtensions (TDX) refers to an Intel technology that extends
+Virtual Machine Extensions (VMX) and Multi-Key Total Memory Encryption (MKTME)
+with a new kind of virtual machine guest called a Trust Domain (TD). A TD runs
+in a CPU mode that is designed to protect the confidentiality of its memory
+contents and its CPU state from any other software, including the hosting
+Virtual Machine Monitor (VMM), unless explicitly shared by the TD itself.
+
+Prerequisites
+-------------
+
+To run TD, the physical machine needs to have TDX module loaded and initialized
+while KVM hypervisor has TDX support and has TDX enabled. If those requirements
+are met, the ``KVM_CAP_VM_TYPES`` will report the support of ``KVM_X86_TDX_VM``.
+
+Trust Domain Virtual Firmware (TDVF)
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Trust Domain Virtual Firmware (TDVF) is required to provide TD services to boot
+TD Guest OS. TDVF needs to be copied to guest private memory and measured before
+the TD boots.
+
+KVM vcpu ioctl ``KVM_TDX_INIT_MEM_REGION`` can be used to populate the TDVF
+content into its private memory.
+
+Since TDX doesn't support readonly memslot, TDVF cannot be mapped as pflash
+device and it actually works as RAM. "-bios" option is chosen to load TDVF.
+
+OVMF is the opensource firmware that implements the TDVF support. Thus the
+command line to specify and load TDVF is ``-bios OVMF.fd``
+
+Feature Configuration
+---------------------
+
+Unlike non-TDX VM, the CPU features (enumerated by CPU or MSR) of a TD are not
+under full control of VMM. VMM can only configure part of features of a TD on
+``KVM_TDX_INIT_VM`` command of VM scope ``MEMORY_ENCRYPT_OP`` ioctl.
+
+The configurable features have three types:
+
+- Attributes:
+  - PKS (bit 30) controls whether Supervisor Protection Keys is exposed to TD,
+  which determines related CPUID bit and CR4 bit;
+  - PERFMON (bit 63) controls whether PMU is exposed to TD.
+
+- XSAVE related features (XFAM):
+  XFAM is a 64b mask, which has the same format as XCR0 or IA32_XSS MSR. It
+  determines the set of extended features available for use by the guest TD.
+
+- CPUID features:
+  Only some bits of some CPUID leaves are directly configurable by VMM.
+
+What features can be configured is reported via TDX capabilities.
+
+TDX capabilities
+~~~~~~~~~~~~~~~~
+
+The VM scope ``MEMORY_ENCRYPT_OP`` ioctl provides command ``KVM_TDX_CAPABILITIES``
+to get the TDX capabilities from KVM. It returns a data structure of
+``struct kvm_tdx_capabilities``, which tells the supported configuration of
+attributes, XFAM and CPUIDs.
+
+TD attributes
+~~~~~~~~~~~~~
+
+QEMU supports configuring raw 64-bit TD attributes directly via "attributes"
+property of "tdx-guest" object. Note, it's users' responsibility to provide a
+valid value because some bits may not supported by current QEMU or KVM yet.
+
+QEMU also supports the configuration of individual attribute bits that are
+supported by it, via properties of "tdx-guest" object.
+E.g., "sept-ve-disable" (bit 28).
+
+MSR based features
+~~~~~~~~~~~~~~~~~~
+
+Current KVM doesn't support MSR based feature (e.g., MSR_IA32_ARCH_CAPABILITIES)
+configuration for TDX, and it's a future work to enable it in QEMU when KVM adds
+support of it.
+
+Feature check
+~~~~~~~~~~~~~
+
+QEMU checks if the final (CPU) features, determined by given cpu model and
+explicit feature adjustment of "+featureA/-featureB", can be supported or not.
+It can produce feature not supported warning like
+
+  "warning: host doesn't support requested feature: CPUID.07H:EBX.intel-pt [bit 25]"
+
+It can also produce warning like
+
+  "warning: TDX forcibly sets the feature: CPUID.80000007H:EDX.invtsc [bit 8]"
+
+if the fixed-1 feature is requested to be disabled explicitly. This is newly
+added to QEMU for TDX because TDX has fixed-1 features that are forcibly enabled
+by TDX module and VMM cannot disable them.
+
+Launching a TD (TDX VM)
+-----------------------
+
+To launch a TD, the necessary command line options are tdx-guest object and
+split kernel-irqchip, as below:
+
+.. parsed-literal::
+
+    |qemu_system_x86| \\
+        -accel kvm \\
+        -cpu host \\
+        -object tdx-guest,id=tdx0 \\
+        -machine ...,confidential-guest-support=tdx0 \\
+        -bios OVMF.fd \\
+
+Restrictions
+------------
+
+ - kernel-irqchip must be split;
+
+   This is set by default for TDX guest if kernel-irqchip is left on its default
+   'auto' setting.
+
+ - No readonly support for private memory;
+
+ - No SMM support: SMM support requires manipulating the guest register states
+   which is not allowed;
+
+Debugging
+---------
+
+Bit 0 of TD attributes, is DEBUG bit, which decides if the TD runs in off-TD
+debug mode. When in off-TD debug mode, TD's VCPU state and private memory are
+accessible via given SEAMCALLs. This requires KVM to expose APIs to invoke those
+SEAMCALLs and corresonponding QEMU change.
+
+It's targeted as future work.
+
+TD attestation
+--------------
+
+In TD guest, the attestation process is used to verify the TDX guest
+trustworthiness to other entities before provisioning secrets to the guest.
+
+TD attestation is initiated first by calling TDG.MR.REPORT inside TD to get the
+REPORT. Then the REPORT data needs to be converted into a remotely verifiable
+Quote by SGX Quoting Enclave (QE).
+
+It's a future work in QEMU to add support of TD attestation since it lacks
+support in current KVM.
+
+Live Migration
+--------------
+
+Future work.
+
+References
+----------
+
+- `TDX Homepage <https://www.intel.com/content/www/us/en/developer/articles/technical/intel-trust-domain-extensions.html>`__
+
+- `SGX QE <https://github.com/intel/SGXDataCenterAttestationPrimitives/tree/master/QuoteGeneration>`__
diff --git a/docs/system/target-i386.rst b/docs/system/target-i386.rst
index ab7af1a75d..43b09c79d6 100644
--- a/docs/system/target-i386.rst
+++ b/docs/system/target-i386.rst
@@ -31,6 +31,7 @@ Architectural features
    i386/kvm-pv
    i386/sgx
    i386/amd-memory-encryption
+   i386/tdx
 
 OS requirements
 ~~~~~~~~~~~~~~~

From 1297b285cc3ffbd06dc3208fbecdb2d582c535dc Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Mon, 26 May 2025 09:22:20 +0200
Subject: [PATCH 1275/2760] rust: make declaration of dependent crates more
 consistent

Crates like "bilge" and "libc" can be shared by more than one directory,
so declare them directly in rust/meson.build.  While at it, make their
variable names end with "_rs" and always add a subproject() statement
(as that pinpoints the error better if the subproject is missing and
cannot be downloaded).

Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/hw/char/pl011/meson.build   | 12 +++---------
 rust/meson.build                 | 16 ++++++++++++++++
 rust/qemu-api-macros/meson.build | 14 +++-----------
 rust/qemu-api/meson.build        |  4 +---
 4 files changed, 23 insertions(+), 23 deletions(-)

diff --git a/rust/hw/char/pl011/meson.build b/rust/hw/char/pl011/meson.build
index 547cca5a96..494b6c123c 100644
--- a/rust/hw/char/pl011/meson.build
+++ b/rust/hw/char/pl011/meson.build
@@ -1,17 +1,11 @@
-subproject('bilge-0.2-rs', required: true)
-subproject('bilge-impl-0.2-rs', required: true)
-
-bilge_dep = dependency('bilge-0.2-rs')
-bilge_impl_dep = dependency('bilge-impl-0.2-rs')
-
 _libpl011_rs = static_library(
   'pl011',
   files('src/lib.rs'),
   override_options: ['rust_std=2021', 'build.rust_std=2021'],
   rust_abi: 'rust',
   dependencies: [
-    bilge_dep,
-    bilge_impl_dep,
+    bilge_rs,
+    bilge_impl_rs,
     qemu_api,
     qemu_api_macros,
   ],
@@ -21,6 +15,6 @@ rust_devices_ss.add(when: 'CONFIG_X_PL011_RUST', if_true: [declare_dependency(
   link_whole: [_libpl011_rs],
   # Putting proc macro crates in `dependencies` is necessary for Meson to find
   # them when compiling the root per-target static rust lib.
-  dependencies: [bilge_impl_dep, qemu_api_macros],
+  dependencies: [bilge_impl_rs, qemu_api_macros],
   variables: {'crate': 'pl011'},
 )])
diff --git a/rust/meson.build b/rust/meson.build
index 91e52b8fb8..1f0dcce7d0 100644
--- a/rust/meson.build
+++ b/rust/meson.build
@@ -1,3 +1,19 @@
+subproject('bilge-0.2-rs', required: true)
+subproject('bilge-impl-0.2-rs', required: true)
+subproject('libc-0.2-rs', required: true)
+
+bilge_rs = dependency('bilge-0.2-rs')
+bilge_impl_rs = dependency('bilge-impl-0.2-rs')
+libc_rs = dependency('libc-0.2-rs')
+
+subproject('proc-macro2-1-rs', required: true)
+subproject('quote-1-rs', required: true)
+subproject('syn-2-rs', required: true)
+
+quote_rs_native = dependency('quote-1-rs', native: true)
+syn_rs_native = dependency('syn-2-rs', native: true)
+proc_macro2_rs_native = dependency('proc-macro2-1-rs', native: true)
+
 subdir('qemu-api-macros')
 subdir('qemu-api')
 
diff --git a/rust/qemu-api-macros/meson.build b/rust/qemu-api-macros/meson.build
index 6f94a4bb3c..8610ce1c84 100644
--- a/rust/qemu-api-macros/meson.build
+++ b/rust/qemu-api-macros/meson.build
@@ -1,11 +1,3 @@
-subproject('proc-macro2-1-rs', required: true)
-subproject('quote-1-rs', required: true)
-subproject('syn-2-rs', required: true)
-
-quote_dep = dependency('quote-1-rs', native: true)
-syn_dep = dependency('syn-2-rs', native: true)
-proc_macro2_dep = dependency('proc-macro2-1-rs', native: true)
-
 _qemu_api_macros_rs = rust.proc_macro(
   'qemu_api_macros',
   files('src/lib.rs'),
@@ -16,9 +8,9 @@ _qemu_api_macros_rs = rust.proc_macro(
     '--cfg', 'feature="proc-macro"',
   ],
   dependencies: [
-    proc_macro2_dep,
-    quote_dep,
-    syn_dep,
+    proc_macro2_rs_native,
+    quote_rs_native,
+    syn_rs_native,
   ],
 )
 
diff --git a/rust/qemu-api/meson.build b/rust/qemu-api/meson.build
index 1696df705b..1ea86b8bbf 100644
--- a/rust/qemu-api/meson.build
+++ b/rust/qemu-api/meson.build
@@ -2,8 +2,6 @@ _qemu_api_cfg = run_command(rustc_args,
   '--config-headers', config_host_h, '--features', files('Cargo.toml'),
   capture: true, check: true).stdout().strip().splitlines()
 
-libc_dep = dependency('libc-0.2-rs')
-
 # _qemu_api_cfg += ['--cfg', 'feature="allocator"']
 if get_option('debug_mutex')
   _qemu_api_cfg += ['--cfg', 'feature="debug_cell"']
@@ -37,7 +35,7 @@ _qemu_api_rs = static_library(
   override_options: ['rust_std=2021', 'build.rust_std=2021'],
   rust_abi: 'rust',
   rust_args: _qemu_api_cfg,
-  dependencies: [libc_dep, qemu_api_macros],
+  dependencies: [libc_rs, qemu_api_macros],
 )
 
 rust.test('rust-qemu-api-tests', _qemu_api_rs,

From 397db937e85d7b9f5a6f0b30764786cef09d1ff3 Mon Sep 17 00:00:00 2001
From: Babu Moger <babu.moger@amd.com>
Date: Thu, 8 May 2025 14:57:59 -0500
Subject: [PATCH 1276/2760] target/i386: Update EPYC CPU model for Cache
 property, RAS, SVM feature bits

Found that some of the cache properties are not set correctly for EPYC models.

l1d_cache.no_invd_sharing should not be true.
l1i_cache.no_invd_sharing should not be true.

L2.self_init should be true.
L2.inclusive should be true.

L3.inclusive should not be true.
L3.no_invd_sharing should be true.

Fix the cache properties.

Also add the missing RAS and SVM features bits on AMD
EPYC CPU models. The SVM feature bits are used in nested guests.

succor		: Software uncorrectable error containment and recovery capability.
overflow-recov	: MCA overflow recovery support.
lbrv		: LBR virtualization
tsc-scale	: MSR based TSC rate control
vmcb-clean	: VMCB clean bits
flushbyasid	: Flush by ASID
pause-filter	: Pause intercept filter
pfthreshold	: PAUSE filter threshold
v-vmsave-vmload	: Virtualized VMLOAD and VMSAVE
vgif		: Virtualized GIF

Signed-off-by: Babu Moger <babu.moger@amd.com>
Reviewed-by: Maksim Davydov <davydov-max@yandex-team.ru>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/515941861700d7066186c9600bc5d96a1741ef0c.1746734284.git.babu.moger@amd.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 73 +++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 73 insertions(+)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 34364cf96a..b6c63b892e 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -2211,6 +2211,60 @@ static CPUCaches epyc_v4_cache_info = {
     },
 };
 
+static CPUCaches epyc_v5_cache_info = {
+    .l1d_cache = &(CPUCacheInfo) {
+        .type = DATA_CACHE,
+        .level = 1,
+        .size = 32 * KiB,
+        .line_size = 64,
+        .associativity = 8,
+        .partitions = 1,
+        .sets = 64,
+        .lines_per_tag = 1,
+        .self_init = true,
+        .share_level = CPU_TOPOLOGY_LEVEL_CORE,
+    },
+    .l1i_cache = &(CPUCacheInfo) {
+        .type = INSTRUCTION_CACHE,
+        .level = 1,
+        .size = 64 * KiB,
+        .line_size = 64,
+        .associativity = 4,
+        .partitions = 1,
+        .sets = 256,
+        .lines_per_tag = 1,
+        .self_init = true,
+        .share_level = CPU_TOPOLOGY_LEVEL_CORE,
+    },
+    .l2_cache = &(CPUCacheInfo) {
+        .type = UNIFIED_CACHE,
+        .level = 2,
+        .size = 512 * KiB,
+        .line_size = 64,
+        .associativity = 8,
+        .partitions = 1,
+        .sets = 1024,
+        .lines_per_tag = 1,
+        .self_init = true,
+        .inclusive = true,
+        .share_level = CPU_TOPOLOGY_LEVEL_CORE,
+    },
+    .l3_cache = &(CPUCacheInfo) {
+        .type = UNIFIED_CACHE,
+        .level = 3,
+        .size = 8 * MiB,
+        .line_size = 64,
+        .associativity = 16,
+        .partitions = 1,
+        .sets = 8192,
+        .lines_per_tag = 1,
+        .self_init = true,
+        .no_invd_sharing = true,
+        .complex_indexing = false,
+        .share_level = CPU_TOPOLOGY_LEVEL_DIE,
+    },
+};
+
 static const CPUCaches epyc_rome_cache_info = {
     .l1d_cache = &(CPUCacheInfo) {
         .type = DATA_CACHE,
@@ -5238,6 +5292,25 @@ static const X86CPUDefinition builtin_x86_defs[] = {
                 },
                 .cache_info = &epyc_v4_cache_info
             },
+            {
+                .version = 5,
+                .props = (PropValue[]) {
+                    { "overflow-recov", "on" },
+                    { "succor", "on" },
+                    { "lbrv", "on" },
+                    { "tsc-scale", "on" },
+                    { "vmcb-clean", "on" },
+                    { "flushbyasid", "on" },
+                    { "pause-filter", "on" },
+                    { "pfthreshold", "on" },
+                    { "v-vmsave-vmload", "on" },
+                    { "vgif", "on" },
+                    { "model-id",
+                      "AMD EPYC-v5 Processor" },
+                    { /* end of list */ }
+                },
+                .cache_info = &epyc_v5_cache_info
+            },
             { /* end of list */ }
         }
     },

From 83d940e9700527ff080416ce2fa52ee1f4771d72 Mon Sep 17 00:00:00 2001
From: Babu Moger <babu.moger@amd.com>
Date: Thu, 8 May 2025 14:58:00 -0500
Subject: [PATCH 1277/2760] target/i386: Update EPYC-Rome CPU model for Cache
 property, RAS, SVM feature bits

Found that some of the cache properties are not set correctly for EPYC models.

l1d_cache.no_invd_sharing should not be true.
l1i_cache.no_invd_sharing should not be true.

L2.self_init should be true.
L2.inclusive should be true.

L3.inclusive should not be true.
L3.no_invd_sharing should be true.

Fix these cache properties.

Also add the missing RAS and SVM features bits on AMD EPYC-Rome. The SVM
feature bits are used in nested guests.

succor		: Software uncorrectable error containment and recovery capability.
overflow-recov	: MCA overflow recovery support.
lbrv		: LBR virtualization
tsc-scale	: MSR based TSC rate control
vmcb-clean	: VMCB clean bits
flushbyasid	: Flush by ASID
pause-filter	: Pause intercept filter
pfthreshold	: PAUSE filter threshold
v-vmsave-vmload	: Virtualized VMLOAD and VMSAVE
vgif		: Virtualized GIF

Signed-off-by: Babu Moger <babu.moger@amd.com>
Reviewed-by: Maksim Davydov <davydov-max@yandex-team.ru>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/8265af72057b84c99ac3a02a5487e32759cc69b1.1746734284.git.babu.moger@amd.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 73 +++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 73 insertions(+)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index b6c63b892e..5b5324a35c 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -2373,6 +2373,60 @@ static const CPUCaches epyc_rome_v3_cache_info = {
     },
 };
 
+static const CPUCaches epyc_rome_v5_cache_info = {
+    .l1d_cache = &(CPUCacheInfo) {
+        .type = DATA_CACHE,
+        .level = 1,
+        .size = 32 * KiB,
+        .line_size = 64,
+        .associativity = 8,
+        .partitions = 1,
+        .sets = 64,
+        .lines_per_tag = 1,
+        .self_init = true,
+        .share_level = CPU_TOPOLOGY_LEVEL_CORE,
+    },
+    .l1i_cache = &(CPUCacheInfo) {
+        .type = INSTRUCTION_CACHE,
+        .level = 1,
+        .size = 32 * KiB,
+        .line_size = 64,
+        .associativity = 8,
+        .partitions = 1,
+        .sets = 64,
+        .lines_per_tag = 1,
+        .self_init = true,
+        .share_level = CPU_TOPOLOGY_LEVEL_CORE,
+    },
+    .l2_cache = &(CPUCacheInfo) {
+        .type = UNIFIED_CACHE,
+        .level = 2,
+        .size = 512 * KiB,
+        .line_size = 64,
+        .associativity = 8,
+        .partitions = 1,
+        .sets = 1024,
+        .lines_per_tag = 1,
+        .self_init = true,
+        .inclusive = true,
+        .share_level = CPU_TOPOLOGY_LEVEL_CORE,
+    },
+    .l3_cache = &(CPUCacheInfo) {
+        .type = UNIFIED_CACHE,
+        .level = 3,
+        .size = 16 * MiB,
+        .line_size = 64,
+        .associativity = 16,
+        .partitions = 1,
+        .sets = 16384,
+        .lines_per_tag = 1,
+        .self_init = true,
+        .no_invd_sharing = true,
+        .complex_indexing = false,
+        .share_level = CPU_TOPOLOGY_LEVEL_DIE,
+    },
+};
+
 static const CPUCaches epyc_milan_cache_info = {
     .l1d_cache = &(CPUCacheInfo) {
         .type = DATA_CACHE,
@@ -5449,6 +5503,25 @@ static const X86CPUDefinition builtin_x86_defs[] = {
                     { /* end of list */ }
                 },
             },
+            {
+                .version = 5,
+                .props = (PropValue[]) {
+                    { "overflow-recov", "on" },
+                    { "succor", "on" },
+                    { "lbrv", "on" },
+                    { "tsc-scale", "on" },
+                    { "vmcb-clean", "on" },
+                    { "flushbyasid", "on" },
+                    { "pause-filter", "on" },
+                    { "pfthreshold", "on" },
+                    { "v-vmsave-vmload", "on" },
+                    { "vgif", "on" },
+                    { "model-id",
+                      "AMD EPYC-Rome-v5 Processor" },
+                    { /* end of list */ }
+                },
+                .cache_info = &epyc_rome_v5_cache_info
+            },
             { /* end of list */ }
         }
     },

From fc014d9ba5b26b27401e0e88a4e1ef827c68fe64 Mon Sep 17 00:00:00 2001
From: Babu Moger <babu.moger@amd.com>
Date: Thu, 8 May 2025 14:58:01 -0500
Subject: [PATCH 1278/2760] target/i386: Update EPYC-Milan CPU model for Cache
 property, RAS, SVM feature bits

Found that some of the cache properties are not set correctly for EPYC models.
l1d_cache.no_invd_sharing should not be true.
l1i_cache.no_invd_sharing should not be true.

L2.self_init should be true.
L2.inclusive should be true.

L3.inclusive should not be true.
L3.no_invd_sharing should be true.

Fix these cache properties.

Also add the missing RAS and SVM features bits on AMD EPYC-Milan model.
The SVM feature bits are used in nested guests.

succor          : Software uncorrectable error containment and recovery capability.
overflow-recov  : MCA overflow recovery support.
lbrv            : LBR virtualization
tsc-scale       : MSR based TSC rate control
vmcb-clean      : VMCB clean bits
flushbyasid     : Flush by ASID
pause-filter    : Pause intercept filter
pfthreshold     : PAUSE filter threshold
v-vmsave-vmload : Virtualized VMLOAD and VMSAVE
vgif            : Virtualized GIF

Signed-off-by: Babu Moger <babu.moger@amd.com>
Reviewed-by: Maksim Davydov <davydov-max@yandex-team.ru>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/c619c0e09a9d5d496819ed48d69181d65f416891.1746734284.git.babu.moger@amd.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 73 +++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 73 insertions(+)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 5b5324a35c..d01a808e3a 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -2535,6 +2535,60 @@ static const CPUCaches epyc_milan_v2_cache_info = {
     },
 };
 
+static const CPUCaches epyc_milan_v3_cache_info = {
+    .l1d_cache = &(CPUCacheInfo) {
+        .type = DATA_CACHE,
+        .level = 1,
+        .size = 32 * KiB,
+        .line_size = 64,
+        .associativity = 8,
+        .partitions = 1,
+        .sets = 64,
+        .lines_per_tag = 1,
+        .self_init = true,
+        .share_level = CPU_TOPOLOGY_LEVEL_CORE,
+    },
+    .l1i_cache = &(CPUCacheInfo) {
+        .type = INSTRUCTION_CACHE,
+        .level = 1,
+        .size = 32 * KiB,
+        .line_size = 64,
+        .associativity = 8,
+        .partitions = 1,
+        .sets = 64,
+        .lines_per_tag = 1,
+        .self_init = true,
+        .share_level = CPU_TOPOLOGY_LEVEL_CORE,
+    },
+    .l2_cache = &(CPUCacheInfo) {
+        .type = UNIFIED_CACHE,
+        .level = 2,
+        .size = 512 * KiB,
+        .line_size = 64,
+        .associativity = 8,
+        .partitions = 1,
+        .sets = 1024,
+        .lines_per_tag = 1,
+        .self_init = true,
+        .inclusive = true,
+        .share_level = CPU_TOPOLOGY_LEVEL_CORE,
+    },
+    .l3_cache = &(CPUCacheInfo) {
+        .type = UNIFIED_CACHE,
+        .level = 3,
+        .size = 32 * MiB,
+        .line_size = 64,
+        .associativity = 16,
+        .partitions = 1,
+        .sets = 32768,
+        .lines_per_tag = 1,
+        .self_init = true,
+        .no_invd_sharing = true,
+        .complex_indexing = false,
+        .share_level = CPU_TOPOLOGY_LEVEL_DIE,
+    },
+};
+
 static const CPUCaches epyc_genoa_cache_info = {
     .l1d_cache = &(CPUCacheInfo) {
         .type = DATA_CACHE,
@@ -5597,6 +5651,25 @@ static const X86CPUDefinition builtin_x86_defs[] = {
                 },
                 .cache_info = &epyc_milan_v2_cache_info
             },
+            {
+                .version = 3,
+                .props = (PropValue[]) {
+                    { "overflow-recov", "on" },
+                    { "succor", "on" },
+                    { "lbrv", "on" },
+                    { "tsc-scale", "on" },
+                    { "vmcb-clean", "on" },
+                    { "flushbyasid", "on" },
+                    { "pause-filter", "on" },
+                    { "pfthreshold", "on" },
+                    { "v-vmsave-vmload", "on" },
+                    { "vgif", "on" },
+                    { "model-id",
+                      "AMD EPYC-Milan-v3 Processor" },
+                    { /* end of list */ }
+                },
+                .cache_info = &epyc_milan_v3_cache_info
+            },
             { /* end of list */ }
         }
     },

From dfd5b456108a75588ab094358ba5754787146d3d Mon Sep 17 00:00:00 2001
From: Babu Moger <babu.moger@amd.com>
Date: Thu, 8 May 2025 14:58:02 -0500
Subject: [PATCH 1279/2760] target/i386: Add couple of feature bits in
 CPUID_Fn80000021_EAX

Add CPUID bit indicates that a WRMSR to MSR_FS_BASE, MSR_GS_BASE, or
MSR_KERNEL_GS_BASE is non-serializing amd PREFETCHI that the indicates
support for IC prefetch.

CPUID_Fn80000021_EAX
Bit    Feature description
20     Indicates support for IC prefetch.
1      FsGsKernelGsBaseNonSerializing.
       WRMSR to FS_BASE, GS_BASE and KernelGSbase are non-serializing.

Link: https://www.amd.com/content/dam/amd/en/documents/epyc-technical-docs/programmer-references/57238.zip
Signed-off-by: Babu Moger <babu.moger@amd.com>
Reviewed-by: Maksim Davydov <davydov-max@yandex-team.ru>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/a5f6283a59579b09ac345b3f21ecb3b3b2d92451.1746734284.git.babu.moger@amd.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 4 ++--
 target/i386/cpu.h | 4 ++++
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index d01a808e3a..0d1b907778 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -1253,12 +1253,12 @@ FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
     [FEAT_8000_0021_EAX] = {
         .type = CPUID_FEATURE_WORD,
         .feat_names = {
-            "no-nested-data-bp", NULL, "lfence-always-serializing", NULL,
+            "no-nested-data-bp", "fs-gs-base-ns", "lfence-always-serializing", NULL,
             NULL, NULL, "null-sel-clr-base", NULL,
             "auto-ibrs", NULL, NULL, NULL,
             NULL, NULL, NULL, NULL,
             NULL, NULL, NULL, NULL,
-            NULL, NULL, NULL, NULL,
+            "prefetchi", NULL, NULL, NULL,
             "eraps", NULL, NULL, "sbpb",
             "ibpb-brtype", "srso-no", "srso-user-kernel-no", NULL,
         },
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index 22e82444ae..1146465c8c 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -1092,12 +1092,16 @@ uint64_t x86_cpu_get_supported_feature_word(X86CPU *cpu, FeatureWord w);
 
 /* Processor ignores nested data breakpoints */
 #define CPUID_8000_0021_EAX_NO_NESTED_DATA_BP            (1U << 0)
+/* WRMSR to FS_BASE, GS_BASE, or KERNEL_GS_BASE is non-serializing */
+#define CPUID_8000_0021_EAX_FS_GS_BASE_NS                (1U << 1)
 /* LFENCE is always serializing */
 #define CPUID_8000_0021_EAX_LFENCE_ALWAYS_SERIALIZING    (1U << 2)
 /* Null Selector Clears Base */
 #define CPUID_8000_0021_EAX_NULL_SEL_CLR_BASE            (1U << 6)
 /* Automatic IBRS */
 #define CPUID_8000_0021_EAX_AUTO_IBRS                    (1U << 8)
+/* Indicates support for IC prefetch */
+#define CPUID_8000_0021_EAX_PREFETCHI                    (1U << 20)
 /* Enhanced Return Address Predictor Scurity */
 #define CPUID_8000_0021_EAX_ERAPS                        (1U << 24)
 /* Selective Branch Predictor Barrier */

From abc92cc8488b5dbcc403b5be24d8092180605101 Mon Sep 17 00:00:00 2001
From: Babu Moger <babu.moger@amd.com>
Date: Thu, 8 May 2025 14:58:03 -0500
Subject: [PATCH 1280/2760] target/i386: Update EPYC-Genoa for Cache property,
 perfmon-v2, RAS and SVM feature bits

Found that some of the cache properties are not set correctly for EPYC models.
l1d_cache.no_invd_sharing should not be true.
l1i_cache.no_invd_sharing should not be true.

L2.self_init should be true.
L2.inclusive should be true.

L3.inclusive should not be true.
L3.no_invd_sharing should be true.

Fix these cache properties.

Also add the missing RAS and SVM features bits on AMD EPYC-Genoa model.
The SVM feature bits are used in nested guests.

perfmon-v2     : Allow guests to make use of the PerfMonV2 features.
succor         : Software uncorrectable error containment and recovery capability.
overflow-recov : MCA overflow recovery support.
lbrv           : LBR virtualization
tsc-scale      : MSR based TSC rate control
vmcb-clean     : VMCB clean bits
flushbyasid    : Flush by ASID
pause-filter   : Pause intercept filter
pfthreshold    : PAUSE filter threshold
v-vmsave-vmload: Virtualized VMLOAD and VMSAVE
vgif           : Virtualized GIF
fs-gs-base-ns  : WRMSR to {FS,GS,KERNEL_GS}_BASE is non-serializing

The feature details are available in APM listed below [1].
[1] AMD64 Architecture Programmer's Manual Volume 2: System Programming
Publication # 24593 Revision 3.41.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=206537
Signed-off-by: Babu Moger <babu.moger@amd.com>
Reviewed-by: Maksim Davydov <davydov-max@yandex-team.ru>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/afe3f05d4116124fd5795f28fc23d7b396140313.1746734284.git.babu.moger@amd.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 78 +++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 78 insertions(+)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 0d1b907778..a656b3c664 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -2643,6 +2643,59 @@ static const CPUCaches epyc_genoa_cache_info = {
     },
 };
 
+static const CPUCaches epyc_genoa_v2_cache_info = {
+    .l1d_cache = &(CPUCacheInfo) {
+        .type = DATA_CACHE,
+        .level = 1,
+        .size = 32 * KiB,
+        .line_size = 64,
+        .associativity = 8,
+        .partitions = 1,
+        .sets = 64,
+        .lines_per_tag = 1,
+        .self_init = true,
+        .share_level = CPU_TOPOLOGY_LEVEL_CORE,
+    },
+    .l1i_cache = &(CPUCacheInfo) {
+        .type = INSTRUCTION_CACHE,
+        .level = 1,
+        .size = 32 * KiB,
+        .line_size = 64,
+        .associativity = 8,
+        .partitions = 1,
+        .sets = 64,
+        .lines_per_tag = 1,
+        .self_init = true,
+        .share_level = CPU_TOPOLOGY_LEVEL_CORE,
+    },
+    .l2_cache = &(CPUCacheInfo) {
+        .type = UNIFIED_CACHE,
+        .level = 2,
+        .size = 1 * MiB,
+        .line_size = 64,
+        .associativity = 8,
+        .partitions = 1,
+        .sets = 2048,
+        .lines_per_tag = 1,
+        .self_init = true,
+        .inclusive = true,
+        .share_level = CPU_TOPOLOGY_LEVEL_CORE,
+    },
+    .l3_cache = &(CPUCacheInfo) {
+        .type = UNIFIED_CACHE,
+        .level = 3,
+        .size = 32 * MiB,
+        .line_size = 64,
+        .associativity = 16,
+        .partitions = 1,
+        .sets = 32768,
+        .lines_per_tag = 1,
+        .self_init = true,
+        .no_invd_sharing = true,
+        .complex_indexing = false,
+        .share_level = CPU_TOPOLOGY_LEVEL_DIE,
+    },
+};
 /* The following VMX features are not supported by KVM and are left out in the
  * CPU definitions:
  *
@@ -5744,6 +5797,31 @@ static const X86CPUDefinition builtin_x86_defs[] = {
         .xlevel = 0x80000022,
         .model_id = "AMD EPYC-Genoa Processor",
         .cache_info = &epyc_genoa_cache_info,
+        .versions = (X86CPUVersionDefinition[]) {
+            { .version = 1 },
+            {
+                .version = 2,
+                .props = (PropValue[]) {
+                    { "overflow-recov", "on" },
+                    { "succor", "on" },
+                    { "lbrv", "on" },
+                    { "tsc-scale", "on" },
+                    { "vmcb-clean", "on" },
+                    { "flushbyasid", "on" },
+                    { "pause-filter", "on" },
+                    { "pfthreshold", "on" },
+                    { "v-vmsave-vmload", "on" },
+                    { "vgif", "on" },
+                    { "fs-gs-base-ns", "on" },
+                    { "perfmon-v2", "on" },
+                    { "model-id",
+                      "AMD EPYC-Genoa-v2 Processor" },
+                    { /* end of list */ }
+                },
+                .cache_info = &epyc_genoa_v2_cache_info
+            },
+            { /* end of list */ }
+        }
     },
     {
         .name = "YongFeng",

From 3771a4daa273ba17cb27309984413790d1df5651 Mon Sep 17 00:00:00 2001
From: Babu Moger <babu.moger@amd.com>
Date: Thu, 8 May 2025 14:58:04 -0500
Subject: [PATCH 1281/2760] target/i386: Add support for EPYC-Turin model

Add the support for AMD EPYC zen 5 processors (EPYC-Turin).

Add the following new feature bits on top of the feature bits from
the previous generation EPYC models.

movdiri             : Move Doubleword as Direct Store Instruction
movdir64b           : Move 64 Bytes as Direct Store Instruction
avx512-vp2intersect : AVX512 Vector Pair Intersection to a Pair
                      of Mask Register
avx-vnni            : AVX VNNI Instruction
prefetchi           : Indicates support for IC prefetch
sbpb                : Selective Branch Predictor Barrier
ibpb-brtype         : IBPB includes branch type prediction flushing
srso-user-kernel-no : Not vulnerable to SRSO at the user-kernel boundary

Link: https://www.amd.com/content/dam/amd/en/documents/epyc-technical-docs/programmer-references/57238.zip
Link: https://www.amd.com/content/dam/amd/en/documents/corporate/cr/speculative-return-stack-overflow-whitepaper.pdf
Signed-off-by: Babu Moger <babu.moger@amd.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/b4fa7708a0e1453d2e9b8ec3dc881feb92eeca0b.1746734284.git.babu.moger@amd.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 138 ++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 138 insertions(+)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index a656b3c664..15439fdfa8 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -2696,6 +2696,61 @@ static const CPUCaches epyc_genoa_v2_cache_info = {
         .share_level = CPU_TOPOLOGY_LEVEL_DIE,
     },
 };
+
+static const CPUCaches epyc_turin_cache_info = {
+    .l1d_cache = &(CPUCacheInfo) {
+        .type = DATA_CACHE,
+        .level = 1,
+        .size = 48 * KiB,
+        .line_size = 64,
+        .associativity = 12,
+        .partitions = 1,
+        .sets = 64,
+        .lines_per_tag = 1,
+        .self_init = true,
+        .share_level = CPU_TOPOLOGY_LEVEL_CORE,
+    },
+    .l1i_cache = &(CPUCacheInfo) {
+        .type = INSTRUCTION_CACHE,
+        .level = 1,
+        .size = 32 * KiB,
+        .line_size = 64,
+        .associativity = 8,
+        .partitions = 1,
+        .sets = 64,
+        .lines_per_tag = 1,
+        .self_init = true,
+        .share_level = CPU_TOPOLOGY_LEVEL_CORE,
+    },
+    .l2_cache = &(CPUCacheInfo) {
+        .type = UNIFIED_CACHE,
+        .level = 2,
+        .size = 1 * MiB,
+        .line_size = 64,
+        .associativity = 16,
+        .partitions = 1,
+        .sets = 1024,
+        .lines_per_tag = 1,
+        .self_init = true,
+        .inclusive = true,
+        .share_level = CPU_TOPOLOGY_LEVEL_CORE,
+    },
+    .l3_cache = &(CPUCacheInfo) {
+        .type = UNIFIED_CACHE,
+        .level = 3,
+        .size = 32 * MiB,
+        .line_size = 64,
+        .associativity = 16,
+        .partitions = 1,
+        .sets = 32768,
+        .lines_per_tag = 1,
+        .self_init = true,
+        .no_invd_sharing = true,
+        .complex_indexing = false,
+        .share_level = CPU_TOPOLOGY_LEVEL_DIE,
+    },
+};
+
 /* The following VMX features are not supported by KVM and are left out in the
  * CPU definitions:
  *
@@ -5959,6 +6014,89 @@ static const X86CPUDefinition builtin_x86_defs[] = {
             { /* end of list */ }
         }
     },
+    {
+        .name = "EPYC-Turin",
+        .level = 0xd,
+        .vendor = CPUID_VENDOR_AMD,
+        .family = 26,
+        .model = 0,
+        .stepping = 0,
+        .features[FEAT_1_ECX] =
+            CPUID_EXT_RDRAND | CPUID_EXT_F16C | CPUID_EXT_AVX |
+            CPUID_EXT_XSAVE | CPUID_EXT_AES |  CPUID_EXT_POPCNT |
+            CPUID_EXT_MOVBE | CPUID_EXT_SSE42 | CPUID_EXT_SSE41 |
+            CPUID_EXT_PCID | CPUID_EXT_CX16 | CPUID_EXT_FMA |
+            CPUID_EXT_SSSE3 | CPUID_EXT_MONITOR | CPUID_EXT_PCLMULQDQ |
+            CPUID_EXT_SSE3,
+        .features[FEAT_1_EDX] =
+            CPUID_SSE2 | CPUID_SSE | CPUID_FXSR | CPUID_MMX | CPUID_CLFLUSH |
+            CPUID_PSE36 | CPUID_PAT | CPUID_CMOV | CPUID_MCA | CPUID_PGE |
+            CPUID_MTRR | CPUID_SEP | CPUID_APIC | CPUID_CX8 | CPUID_MCE |
+            CPUID_PAE | CPUID_MSR | CPUID_TSC | CPUID_PSE | CPUID_DE |
+            CPUID_VME | CPUID_FP87,
+        .features[FEAT_6_EAX] =
+            CPUID_6_EAX_ARAT,
+        .features[FEAT_7_0_EBX] =
+            CPUID_7_0_EBX_FSGSBASE | CPUID_7_0_EBX_BMI1 | CPUID_7_0_EBX_AVX2 |
+            CPUID_7_0_EBX_SMEP | CPUID_7_0_EBX_BMI2 | CPUID_7_0_EBX_ERMS |
+            CPUID_7_0_EBX_INVPCID | CPUID_7_0_EBX_AVX512F |
+            CPUID_7_0_EBX_AVX512DQ | CPUID_7_0_EBX_RDSEED | CPUID_7_0_EBX_ADX |
+            CPUID_7_0_EBX_SMAP | CPUID_7_0_EBX_AVX512IFMA |
+            CPUID_7_0_EBX_CLFLUSHOPT | CPUID_7_0_EBX_CLWB |
+            CPUID_7_0_EBX_AVX512CD | CPUID_7_0_EBX_SHA_NI |
+            CPUID_7_0_EBX_AVX512BW | CPUID_7_0_EBX_AVX512VL,
+        .features[FEAT_7_0_ECX] =
+            CPUID_7_0_ECX_AVX512_VBMI | CPUID_7_0_ECX_UMIP | CPUID_7_0_ECX_PKU |
+            CPUID_7_0_ECX_AVX512_VBMI2 | CPUID_7_0_ECX_GFNI |
+            CPUID_7_0_ECX_VAES | CPUID_7_0_ECX_VPCLMULQDQ |
+            CPUID_7_0_ECX_AVX512VNNI | CPUID_7_0_ECX_AVX512BITALG |
+            CPUID_7_0_ECX_AVX512_VPOPCNTDQ | CPUID_7_0_ECX_LA57 |
+            CPUID_7_0_ECX_RDPID | CPUID_7_0_ECX_MOVDIRI |
+            CPUID_7_0_ECX_MOVDIR64B,
+        .features[FEAT_7_0_EDX] =
+            CPUID_7_0_EDX_FSRM | CPUID_7_0_EDX_AVX512_VP2INTERSECT,
+        .features[FEAT_7_1_EAX] =
+            CPUID_7_1_EAX_AVX_VNNI | CPUID_7_1_EAX_AVX512_BF16,
+        .features[FEAT_8000_0001_ECX] =
+            CPUID_EXT3_OSVW | CPUID_EXT3_3DNOWPREFETCH |
+            CPUID_EXT3_MISALIGNSSE | CPUID_EXT3_SSE4A | CPUID_EXT3_ABM |
+            CPUID_EXT3_CR8LEG | CPUID_EXT3_SVM | CPUID_EXT3_LAHF_LM |
+            CPUID_EXT3_TOPOEXT | CPUID_EXT3_PERFCORE,
+        .features[FEAT_8000_0001_EDX] =
+            CPUID_EXT2_LM | CPUID_EXT2_RDTSCP | CPUID_EXT2_PDPE1GB |
+            CPUID_EXT2_FFXSR | CPUID_EXT2_MMXEXT | CPUID_EXT2_NX |
+            CPUID_EXT2_SYSCALL,
+        .features[FEAT_8000_0007_EBX] =
+            CPUID_8000_0007_EBX_OVERFLOW_RECOV | CPUID_8000_0007_EBX_SUCCOR,
+        .features[FEAT_8000_0008_EBX] =
+            CPUID_8000_0008_EBX_CLZERO | CPUID_8000_0008_EBX_XSAVEERPTR |
+            CPUID_8000_0008_EBX_WBNOINVD | CPUID_8000_0008_EBX_IBPB |
+            CPUID_8000_0008_EBX_IBRS | CPUID_8000_0008_EBX_STIBP |
+            CPUID_8000_0008_EBX_STIBP_ALWAYS_ON |
+            CPUID_8000_0008_EBX_AMD_SSBD | CPUID_8000_0008_EBX_AMD_PSFD,
+        .features[FEAT_8000_0021_EAX] =
+            CPUID_8000_0021_EAX_NO_NESTED_DATA_BP |
+            CPUID_8000_0021_EAX_FS_GS_BASE_NS |
+            CPUID_8000_0021_EAX_LFENCE_ALWAYS_SERIALIZING |
+            CPUID_8000_0021_EAX_NULL_SEL_CLR_BASE |
+            CPUID_8000_0021_EAX_AUTO_IBRS | CPUID_8000_0021_EAX_PREFETCHI |
+            CPUID_8000_0021_EAX_SBPB | CPUID_8000_0021_EAX_IBPB_BRTYPE |
+            CPUID_8000_0021_EAX_SRSO_USER_KERNEL_NO,
+        .features[FEAT_8000_0022_EAX] =
+            CPUID_8000_0022_EAX_PERFMON_V2,
+        .features[FEAT_XSAVE] =
+            CPUID_XSAVE_XSAVEOPT | CPUID_XSAVE_XSAVEC |
+            CPUID_XSAVE_XGETBV1 | CPUID_XSAVE_XSAVES,
+        .features[FEAT_SVM] =
+            CPUID_SVM_NPT | CPUID_SVM_LBRV | CPUID_SVM_NRIPSAVE |
+            CPUID_SVM_TSCSCALE | CPUID_SVM_VMCBCLEAN | CPUID_SVM_FLUSHASID |
+            CPUID_SVM_PAUSEFILTER | CPUID_SVM_PFTHRESHOLD |
+            CPUID_SVM_V_VMSAVE_VMLOAD | CPUID_SVM_VGIF |
+            CPUID_SVM_VNMI | CPUID_SVM_SVME_ADDR_CHK,
+        .xlevel = 0x80000022,
+        .model_id = "AMD EPYC-Turin Processor",
+        .cache_info = &epyc_turin_cache_info,
+    },
 };
 
 /*

From 9bd24d8d2756a0771b6677b02c7f9b603ef6afe9 Mon Sep 17 00:00:00 2001
From: Fiona Ebner <f.ebner@proxmox.com>
Date: Mon, 26 May 2025 13:44:47 +0200
Subject: [PATCH 1282/2760] target/i386/tcg/helper-tcg: fix file references in
 comments
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Commit 32cad1ffb8 ("include: Rename sysemu/ -> system/") renamed
target/i386/tcg/sysemu => target/i386/tcg/system.

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/r/20250526114447.1243840-1-f.ebner@proxmox.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/tcg/helper-tcg.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/i386/tcg/helper-tcg.h b/target/i386/tcg/helper-tcg.h
index 6b3f19855f..be011b06b7 100644
--- a/target/i386/tcg/helper-tcg.h
+++ b/target/i386/tcg/helper-tcg.h
@@ -97,7 +97,7 @@ static inline unsigned int compute_pf(uint8_t x)
 /* misc_helper.c */
 void cpu_load_eflags(CPUX86State *env, int eflags, int update_mask);
 
-/* sysemu/svm_helper.c */
+/* system/svm_helper.c */
 #ifndef CONFIG_USER_ONLY
 G_NORETURN void cpu_vmexit(CPUX86State *nenv, uint32_t exit_code,
                            uint64_t exit_info_1, uintptr_t retaddr);
@@ -115,7 +115,7 @@ int exception_has_error_code(int intno);
 /* smm_helper.c */
 void do_smm_enter(X86CPU *cpu);
 
-/* sysemu/bpt_helper.c */
+/* system/bpt_helper.c */
 bool check_hw_breakpoints(CPUX86State *env, bool force_dr6_update);
 
 /*

From 638422f5bcdf2c7bdb401b987b134322c5d6bd4d Mon Sep 17 00:00:00 2001
From: Hao Wu <wuhaotsh@google.com>
Date: Thu, 29 May 2025 17:45:09 +0100
Subject: [PATCH 1283/2760] hw/arm: Add GMAC devices to NPCM8XX SoC

The GMAC was originally created for the 8xx machine. During upstreaming
both the GMAC and the 8XX we removed it so they would not depend on each
other for the process, that connection should be added back in.

Signed-off-by: Hao Wu <wuhaotsh@google.com>
Signed-off-by: Nabih Estefan <nabihestefan@google.com>
Message-id: 20250508220718.735415-2-nabihestefan@google.com
Reviewed-by: Tyrone Ting <kfting@nuvoton.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/npcm8xx.c         | 54 ++++++++++++++++++++++++++++++++++++----
 include/hw/arm/npcm8xx.h |  5 +++-
 2 files changed, 53 insertions(+), 6 deletions(-)

diff --git a/hw/arm/npcm8xx.c b/hw/arm/npcm8xx.c
index d7ee306de7..d14bf55cd7 100644
--- a/hw/arm/npcm8xx.c
+++ b/hw/arm/npcm8xx.c
@@ -67,6 +67,9 @@
 /* SDHCI Modules */
 #define NPCM8XX_MMC_BA          0xf0842000
 
+/* PCS Module */
+#define NPCM8XX_PCS_BA          0xf0780000
+
 /* PSPI Modules */
 #define NPCM8XX_PSPI_BA         0xf0201000
 
@@ -85,6 +88,10 @@ enum NPCM8xxInterrupt {
     NPCM8XX_ADC_IRQ             = 0,
     NPCM8XX_PECI_IRQ            = 6,
     NPCM8XX_KCS_HIB_IRQ         = 9,
+    NPCM8XX_GMAC1_IRQ           = 14,
+    NPCM8XX_GMAC2_IRQ,
+    NPCM8XX_GMAC3_IRQ,
+    NPCM8XX_GMAC4_IRQ,
     NPCM8XX_MMC_IRQ             = 26,
     NPCM8XX_PSPI_IRQ            = 28,
     NPCM8XX_TIMER0_IRQ          = 32,   /* Timer Module 0 */
@@ -260,6 +267,14 @@ static const hwaddr npcm8xx_smbus_addr[] = {
     0xfff0a000,
 };
 
+/* Register base address for each GMAC Module */
+static const hwaddr npcm8xx_gmac_addr[] = {
+    0xf0802000,
+    0xf0804000,
+    0xf0806000,
+    0xf0808000,
+};
+
 /* Register base address for each USB host EHCI registers */
 static const hwaddr npcm8xx_ehci_addr[] = {
     0xf0828100,
@@ -444,6 +459,11 @@ static void npcm8xx_init(Object *obj)
         object_initialize_child(obj, "mft[*]", &s->mft[i], TYPE_NPCM7XX_MFT);
     }
 
+    for (i = 0; i < ARRAY_SIZE(s->gmac); i++) {
+        object_initialize_child(obj, "gmac[*]", &s->gmac[i], TYPE_NPCM_GMAC);
+    }
+    object_initialize_child(obj, "pcs", &s->pcs, TYPE_NPCM_PCS);
+
     object_initialize_child(obj, "mmc", &s->mmc, TYPE_NPCM7XX_SDHCI);
     object_initialize_child(obj, "pspi", &s->pspi, TYPE_NPCM_PSPI);
 }
@@ -668,6 +688,35 @@ static void npcm8xx_realize(DeviceState *dev, Error **errp)
         sysbus_connect_irq(sbd, 0, npcm8xx_irq(s, NPCM8XX_MFT0_IRQ + i));
     }
 
+    /*
+     * GMAC Modules. Cannot fail.
+     */
+    QEMU_BUILD_BUG_ON(ARRAY_SIZE(npcm8xx_gmac_addr) != ARRAY_SIZE(s->gmac));
+    for (i = 0; i < ARRAY_SIZE(s->gmac); i++) {
+        SysBusDevice *sbd = SYS_BUS_DEVICE(&s->gmac[i]);
+
+        /* This is used to make sure that the NIC can create the device */
+        qemu_configure_nic_device(DEVICE(sbd), false, NULL);
+
+        /*
+         * The device exists regardless of whether it's connected to a QEMU
+         * netdev backend. So always instantiate it even if there is no
+         * backend.
+         */
+        sysbus_realize(sbd, &error_abort);
+        sysbus_mmio_map(sbd, 0, npcm8xx_gmac_addr[i]);
+        /*
+         * N.B. The values for the second argument sysbus_connect_irq are
+         * chosen to match the registration order in npcm7xx_emc_realize.
+         */
+        sysbus_connect_irq(sbd, 0, npcm8xx_irq(s, NPCM8XX_GMAC1_IRQ + i));
+    }
+    /*
+     * GMAC Physical Coding Sublayer(PCS) Module. Cannot fail.
+     */
+    sysbus_realize(SYS_BUS_DEVICE(&s->pcs), &error_abort);
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->pcs), 0, NPCM8XX_PCS_BA);
+
     /*
      * Flash Interface Unit (FIU). Can fail if incorrect number of chip selects
      * specified, but this is a programming error.
@@ -741,12 +790,7 @@ static void npcm8xx_realize(DeviceState *dev, Error **errp)
     create_unimplemented_device("npcm8xx.ahbpci",       0xf0400000,   1 * MiB);
     create_unimplemented_device("npcm8xx.dap",          0xf0500000, 960 * KiB);
     create_unimplemented_device("npcm8xx.mcphy",        0xf05f0000,  64 * KiB);
-    create_unimplemented_device("npcm8xx.pcs",          0xf0780000, 256 * KiB);
     create_unimplemented_device("npcm8xx.tsgen",        0xf07fc000,   8 * KiB);
-    create_unimplemented_device("npcm8xx.gmac1",        0xf0802000,   8 * KiB);
-    create_unimplemented_device("npcm8xx.gmac2",        0xf0804000,   8 * KiB);
-    create_unimplemented_device("npcm8xx.gmac3",        0xf0806000,   8 * KiB);
-    create_unimplemented_device("npcm8xx.gmac4",        0xf0808000,   8 * KiB);
     create_unimplemented_device("npcm8xx.copctl",       0xf080c000,   4 * KiB);
     create_unimplemented_device("npcm8xx.tipctl",       0xf080d000,   4 * KiB);
     create_unimplemented_device("npcm8xx.rst",          0xf080e000,   4 * KiB);
diff --git a/include/hw/arm/npcm8xx.h b/include/hw/arm/npcm8xx.h
index 3436abff99..a8377db490 100644
--- a/include/hw/arm/npcm8xx.h
+++ b/include/hw/arm/npcm8xx.h
@@ -28,7 +28,8 @@
 #include "hw/misc/npcm7xx_mft.h"
 #include "hw/misc/npcm7xx_pwm.h"
 #include "hw/misc/npcm7xx_rng.h"
-#include "hw/net/npcm7xx_emc.h"
+#include "hw/net/npcm_gmac.h"
+#include "hw/net/npcm_pcs.h"
 #include "hw/nvram/npcm7xx_otp.h"
 #include "hw/sd/npcm7xx_sdhci.h"
 #include "hw/timer/npcm7xx_timer.h"
@@ -99,6 +100,8 @@ struct NPCM8xxState {
     EHCISysBusState     ehci[2];
     OHCISysBusState     ohci[2];
     NPCM7xxFIUState     fiu[3];
+    NPCMGMACState       gmac[4];
+    NPCMPCSState        pcs;
     NPCM7xxSDHCIState   mmc;
     NPCMPSPIState       pspi;
 };

From e7083b02f5628f0ec63d29f2208ca5d3e963e9a8 Mon Sep 17 00:00:00 2001
From: Nabih Estefan <nabihestefan@google.com>
Date: Thu, 29 May 2025 17:45:09 +0100
Subject: [PATCH 1284/2760] tests/qtest: Migrate GMAC test from 7xx to 8xx

For upstreaming we migrated this test to 7xx (since that was already
upstream) move it back to 8xx where it can check the 4 GMACs since that
is the board this test was originally created for.

Signed-off-by: Nabih Estefan <nabihestefan@google.com>
Message-id: 20250508220718.735415-3-nabihestefan@google.com
Reviewed-by: Tyrone Ting <kfting@nuvoton.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/qtest/meson.build      |  6 ++-
 tests/qtest/npcm_gmac-test.c | 85 ++++++++++++++++++++++++++++++++++--
 2 files changed, 86 insertions(+), 5 deletions(-)

diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
index 43e5a86699..8ad849054f 100644
--- a/tests/qtest/meson.build
+++ b/tests/qtest/meson.build
@@ -208,9 +208,10 @@ qtests_npcm7xx = \
    'npcm7xx_sdhci-test',
    'npcm7xx_smbus-test',
    'npcm7xx_timer-test',
-   'npcm7xx_watchdog_timer-test',
-   'npcm_gmac-test'] + \
+   'npcm7xx_watchdog_timer-test'] + \
    (slirp.found() ? ['npcm7xx_emc-test'] : [])
+qtests_npcm8xx = \
+  ['npcm_gmac-test']
 qtests_aspeed = \
   ['aspeed_gpio-test',
    'aspeed_hace-test',
@@ -259,6 +260,7 @@ qtests_aarch64 = \
   (config_all_accel.has_key('CONFIG_TCG') and                                            \
    config_all_devices.has_key('CONFIG_TPM_TIS_I2C') ? ['tpm-tis-i2c-test'] : []) + \
   (config_all_devices.has_key('CONFIG_ASPEED_SOC') ? qtests_aspeed64 : []) + \
+  (config_all_devices.has_key('CONFIG_NPCM8XX') ? qtests_npcm8xx : []) + \
   ['arm-cpu-features',
    'numa-test',
    'boot-serial-test',
diff --git a/tests/qtest/npcm_gmac-test.c b/tests/qtest/npcm_gmac-test.c
index c28b471ab2..1317da2cd7 100644
--- a/tests/qtest/npcm_gmac-test.c
+++ b/tests/qtest/npcm_gmac-test.c
@@ -36,7 +36,7 @@ typedef struct TestData {
     const GMACModule *module;
 } TestData;
 
-/* Values extracted from hw/arm/npcm7xx.c */
+/* Values extracted from hw/arm/npcm8xx.c */
 static const GMACModule gmac_module_list[] = {
     {
         .irq        = 14,
@@ -46,6 +46,14 @@ static const GMACModule gmac_module_list[] = {
         .irq        = 15,
         .base_addr  = 0xf0804000
     },
+    {
+        .irq        = 16,
+        .base_addr  = 0xf0806000
+    },
+    {
+        .irq        = 17,
+        .base_addr  = 0xf0808000
+    }
 };
 
 /* Returns the index of the GMAC module. */
@@ -174,18 +182,32 @@ static uint32_t gmac_read(QTestState *qts, const GMACModule *mod,
     return qtest_readl(qts, mod->base_addr + regno);
 }
 
+static uint16_t pcs_read(QTestState *qts, const GMACModule *mod,
+                          NPCMRegister regno)
+{
+    uint32_t write_value = (regno & 0x3ffe00) >> 9;
+    qtest_writel(qts, PCS_BASE_ADDRESS + NPCM_PCS_IND_AC_BA, write_value);
+    uint32_t read_offset = regno & 0x1ff;
+    return qtest_readl(qts, PCS_BASE_ADDRESS + read_offset);
+}
+
 /* Check that GMAC registers are reset to default value */
 static void test_init(gconstpointer test_data)
 {
     const TestData *td = test_data;
     const GMACModule *mod = td->module;
-    QTestState *qts = qtest_init("-machine npcm750-evb");
+    QTestState *qts = qtest_init("-machine npcm845-evb");
 
 #define CHECK_REG32(regno, value) \
     do { \
         g_assert_cmphex(gmac_read(qts, mod, (regno)), ==, (value)); \
     } while (0)
 
+#define CHECK_REG_PCS(regno, value) \
+    do { \
+        g_assert_cmphex(pcs_read(qts, mod, (regno)), ==, (value)); \
+    } while (0)
+
     CHECK_REG32(NPCM_DMA_BUS_MODE, 0x00020100);
     CHECK_REG32(NPCM_DMA_XMT_POLL_DEMAND, 0);
     CHECK_REG32(NPCM_DMA_RCV_POLL_DEMAND, 0);
@@ -235,6 +257,63 @@ static void test_init(gconstpointer test_data)
     CHECK_REG32(NPCM_GMAC_PTP_TAR, 0);
     CHECK_REG32(NPCM_GMAC_PTP_TTSR, 0);
 
+    if (mod->base_addr == 0xf0802000) {
+        CHECK_REG_PCS(NPCM_PCS_SR_CTL_ID1, 0x699e);
+        CHECK_REG_PCS(NPCM_PCS_SR_CTL_ID2, 0);
+        CHECK_REG_PCS(NPCM_PCS_SR_CTL_STS, 0x8000);
+
+        CHECK_REG_PCS(NPCM_PCS_SR_MII_CTRL, 0x1140);
+        CHECK_REG_PCS(NPCM_PCS_SR_MII_STS, 0x0109);
+        CHECK_REG_PCS(NPCM_PCS_SR_MII_DEV_ID1, 0x699e);
+        CHECK_REG_PCS(NPCM_PCS_SR_MII_DEV_ID2, 0x0ced0);
+        CHECK_REG_PCS(NPCM_PCS_SR_MII_AN_ADV, 0x0020);
+        CHECK_REG_PCS(NPCM_PCS_SR_MII_LP_BABL, 0);
+        CHECK_REG_PCS(NPCM_PCS_SR_MII_AN_EXPN, 0);
+        CHECK_REG_PCS(NPCM_PCS_SR_MII_EXT_STS, 0xc000);
+
+        CHECK_REG_PCS(NPCM_PCS_SR_TIM_SYNC_ABL, 0x0003);
+        CHECK_REG_PCS(NPCM_PCS_SR_TIM_SYNC_TX_MAX_DLY_LWR, 0x0038);
+        CHECK_REG_PCS(NPCM_PCS_SR_TIM_SYNC_TX_MAX_DLY_UPR, 0);
+        CHECK_REG_PCS(NPCM_PCS_SR_TIM_SYNC_TX_MIN_DLY_LWR, 0x0038);
+        CHECK_REG_PCS(NPCM_PCS_SR_TIM_SYNC_TX_MIN_DLY_UPR, 0);
+        CHECK_REG_PCS(NPCM_PCS_SR_TIM_SYNC_RX_MAX_DLY_LWR, 0x0058);
+        CHECK_REG_PCS(NPCM_PCS_SR_TIM_SYNC_RX_MAX_DLY_UPR, 0);
+        CHECK_REG_PCS(NPCM_PCS_SR_TIM_SYNC_RX_MIN_DLY_LWR, 0x0048);
+        CHECK_REG_PCS(NPCM_PCS_SR_TIM_SYNC_RX_MIN_DLY_UPR, 0);
+
+        CHECK_REG_PCS(NPCM_PCS_VR_MII_MMD_DIG_CTRL1, 0x2400);
+        CHECK_REG_PCS(NPCM_PCS_VR_MII_AN_CTRL, 0);
+        CHECK_REG_PCS(NPCM_PCS_VR_MII_AN_INTR_STS, 0x000a);
+        CHECK_REG_PCS(NPCM_PCS_VR_MII_TC, 0);
+        CHECK_REG_PCS(NPCM_PCS_VR_MII_DBG_CTRL, 0);
+        CHECK_REG_PCS(NPCM_PCS_VR_MII_EEE_MCTRL0, 0x899c);
+        CHECK_REG_PCS(NPCM_PCS_VR_MII_EEE_TXTIMER, 0);
+        CHECK_REG_PCS(NPCM_PCS_VR_MII_EEE_RXTIMER, 0);
+        CHECK_REG_PCS(NPCM_PCS_VR_MII_LINK_TIMER_CTRL, 0);
+        CHECK_REG_PCS(NPCM_PCS_VR_MII_EEE_MCTRL1, 0);
+        CHECK_REG_PCS(NPCM_PCS_VR_MII_DIG_STS, 0x0010);
+        CHECK_REG_PCS(NPCM_PCS_VR_MII_ICG_ERRCNT1, 0);
+        CHECK_REG_PCS(NPCM_PCS_VR_MII_MISC_STS, 0);
+        CHECK_REG_PCS(NPCM_PCS_VR_MII_RX_LSTS, 0);
+        CHECK_REG_PCS(NPCM_PCS_VR_MII_MP_TX_BSTCTRL0, 0x00a);
+        CHECK_REG_PCS(NPCM_PCS_VR_MII_MP_TX_LVLCTRL0, 0x007f);
+        CHECK_REG_PCS(NPCM_PCS_VR_MII_MP_TX_GENCTRL0, 0x0001);
+        CHECK_REG_PCS(NPCM_PCS_VR_MII_MP_TX_GENCTRL1, 0);
+        CHECK_REG_PCS(NPCM_PCS_VR_MII_MP_TX_STS, 0);
+        CHECK_REG_PCS(NPCM_PCS_VR_MII_MP_RX_GENCTRL0, 0x0100);
+        CHECK_REG_PCS(NPCM_PCS_VR_MII_MP_RX_GENCTRL1, 0x1100);
+        CHECK_REG_PCS(NPCM_PCS_VR_MII_MP_RX_LOS_CTRL0, 0x000e);
+        CHECK_REG_PCS(NPCM_PCS_VR_MII_MP_MPLL_CTRL0, 0x0100);
+        CHECK_REG_PCS(NPCM_PCS_VR_MII_MP_MPLL_CTRL1, 0x0032);
+        CHECK_REG_PCS(NPCM_PCS_VR_MII_MP_MPLL_STS, 0x0001);
+        CHECK_REG_PCS(NPCM_PCS_VR_MII_MP_MISC_CTRL2, 0);
+        CHECK_REG_PCS(NPCM_PCS_VR_MII_MP_LVL_CTRL, 0x0019);
+        CHECK_REG_PCS(NPCM_PCS_VR_MII_MP_MISC_CTRL0, 0);
+        CHECK_REG_PCS(NPCM_PCS_VR_MII_MP_MISC_CTRL1, 0);
+        CHECK_REG_PCS(NPCM_PCS_VR_MII_DIG_CTRL2, 0);
+        CHECK_REG_PCS(NPCM_PCS_VR_MII_DIG_ERRCNT_SEL, 0);
+    }
+
     qtest_quit(qts);
 }
 
@@ -242,7 +321,7 @@ static void gmac_add_test(const char *name, const TestData* td,
                           GTestDataFunc fn)
 {
     g_autofree char *full_name = g_strdup_printf(
-            "npcm7xx_gmac/gmac[%d]/%s", gmac_module_index(td->module), name);
+            "npcm8xx_gmac/gmac[%d]/%s", gmac_module_index(td->module), name);
     qtest_add_data_func(full_name, td, fn);
 }
 

From e6bc01777e5a4b6ecf3414b21a2d7b4846bf4817 Mon Sep 17 00:00:00 2001
From: Guenter Roeck <linux@roeck-us.net>
Date: Thu, 29 May 2025 17:45:10 +0100
Subject: [PATCH 1285/2760] hw/arm: Add missing psci_conduit to NPCM8XX SoC
 boot info

Without psci_conduit, the Linux kernel crashes almost immediately.

    psci: probing for conduit method from DT.
    Internal error: Oops - Undefined instruction: 0000000002000000 [#1] PREEMPT SMP

Fixes: ae0c4d1a1290 ("hw/arm: Add NPCM8XX SoC")
Cc: qemu-stable@nongnu.org
Cc: Hao Wu <wuhaotsh@google.com>
Cc: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Message-id: 20250315142050.3642741-1-linux@roeck-us.net
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/npcm8xx.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/arm/npcm8xx.c b/hw/arm/npcm8xx.c
index d14bf55cd7..a276fea698 100644
--- a/hw/arm/npcm8xx.c
+++ b/hw/arm/npcm8xx.c
@@ -365,6 +365,7 @@ static struct arm_boot_info npcm8xx_binfo = {
     .secure_boot            = false,
     .board_id               = -1,
     .board_setup_addr       = NPCM8XX_BOARD_SETUP_ADDR,
+    .psci_conduit           = QEMU_PSCI_CONDUIT_SMC,
 };
 
 void npcm8xx_load_kernel(MachineState *machine, NPCM8xxState *soc)

From 0a233da8a02a6126140b9dbd3af29e6763a390b1 Mon Sep 17 00:00:00 2001
From: Souleymane Conte <conte.souleymane@gmail.com>
Date: Thu, 29 May 2025 17:45:10 +0100
Subject: [PATCH 1286/2760] docs/interop: convert text files to
 restructuredText

buglink: https://gitlab.com/qemu-project/qemu/-/issues/527

Signed-off-by: Souleymane Conte <conte.souleymane@gmail.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-id: 20250522092622.40869-1-conte.souleymane@gmail.com
[PMM: switched a few more bits of formatting to monospaced;
 updated references to qcow2.txt in MAINTAINERS, qcow2-cache.txt
 and bitmaps.rst]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 MAINTAINERS                           |   2 +-
 docs/interop/bitmaps.rst              |   2 +-
 docs/interop/index.rst                |   1 +
 docs/interop/{qcow2.txt => qcow2.rst} | 187 +++++++++++++++-----------
 docs/qcow2-cache.txt                  |   2 +-
 5 files changed, 113 insertions(+), 81 deletions(-)
 rename docs/interop/{qcow2.txt => qcow2.rst} (89%)

diff --git a/MAINTAINERS b/MAINTAINERS
index e27d1458c5..8e68333623 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -4130,7 +4130,7 @@ M: Hanna Reitz <hreitz@redhat.com>
 L: qemu-block@nongnu.org
 S: Supported
 F: block/qcow2*
-F: docs/interop/qcow2.txt
+F: docs/interop/qcow2.rst
 
 qcow
 M: Kevin Wolf <kwolf@redhat.com>
diff --git a/docs/interop/bitmaps.rst b/docs/interop/bitmaps.rst
index ddf8947d54..7536f0ba5c 100644
--- a/docs/interop/bitmaps.rst
+++ b/docs/interop/bitmaps.rst
@@ -97,7 +97,7 @@ time.
 
 - Persistent storage formats may impose their own requirements on bitmap names
   and namespaces. Presently, only qcow2 supports persistent bitmaps. See
-  docs/interop/qcow2.txt for more details on restrictions. Notably:
+  :doc:`qcow2` for more details on restrictions. Notably:
 
    - qcow2 bitmap names are limited to between 1 and 1023 bytes long.
 
diff --git a/docs/interop/index.rst b/docs/interop/index.rst
index 999e44eae1..4b951ae416 100644
--- a/docs/interop/index.rst
+++ b/docs/interop/index.rst
@@ -17,6 +17,7 @@ are useful for making QEMU interoperate with other software.
    nbd
    parallels
    prl-xml
+   qcow2
    pr-helper
    qmp-spec
    qemu-ga
diff --git a/docs/interop/qcow2.txt b/docs/interop/qcow2.rst
similarity index 89%
rename from docs/interop/qcow2.txt
rename to docs/interop/qcow2.rst
index 2c4618375a..5948591107 100644
--- a/docs/interop/qcow2.txt
+++ b/docs/interop/qcow2.rst
@@ -1,6 +1,8 @@
-== General ==
+=======================
+Qcow2 Image File Format
+=======================
 
-A qcow2 image file is organized in units of constant size, which are called
+A ``qcow2`` image file is organized in units of constant size, which are called
 (host) clusters. A cluster is the unit in which all allocations are done,
 both for actual guest data and for image metadata.
 
@@ -9,10 +11,10 @@ clusters of the same size.
 
 All numbers in qcow2 are stored in Big Endian byte order.
 
+Header
+------
 
-== Header ==
-
-The first cluster of a qcow2 image contains the file header:
+The first cluster of a qcow2 image contains the file header::
 
     Byte  0 -  3:   magic
                     QCOW magic string ("QFI\xfb")
@@ -38,7 +40,7 @@ The first cluster of a qcow2 image contains the file header:
                     within a cluster (1 << cluster_bits is the cluster size).
                     Must not be less than 9 (i.e. 512 byte clusters).
 
-                    Note: qemu as of today has an implementation limit of 2 MB
+                    Note: QEMU as of today has an implementation limit of 2 MB
                     as the maximum cluster size and won't be able to open images
                     with larger cluster sizes.
 
@@ -48,7 +50,7 @@ The first cluster of a qcow2 image contains the file header:
          24 - 31:   size
                     Virtual disk size in bytes.
 
-                    Note: qemu has an implementation limit of 32 MB as
+                    Note: QEMU has an implementation limit of 32 MB as
                     the maximum L1 table size.  With a 2 MB cluster
                     size, it is unable to populate a virtual cluster
                     beyond 2 EB (61 bits); with a 512 byte cluster
@@ -87,7 +89,8 @@ The first cluster of a qcow2 image contains the file header:
 
 For version 2, the header is exactly 72 bytes in length, and finishes here.
 For version 3 or higher, the header length is at least 104 bytes, including
-the next fields through header_length.
+the next fields through ``header_length``.
+::
 
          72 -  79:  incompatible_features
                     Bitmask of incompatible features. An implementation must
@@ -185,7 +188,8 @@ the next fields through header_length.
                     of 8.
 
 
-=== Additional fields (version 3 and higher) ===
+Additional fields (version 3 and higher)
+----------------------------------------
 
 In general, these fields are optional and may be safely ignored by the software,
 as well as filled by zeros (which is equal to field absence), if software needs
@@ -193,21 +197,25 @@ to set field B, but does not care about field A which precedes B. More
 formally, additional fields have the following compatibility rules:
 
 1. If the value of the additional field must not be ignored for correct
-handling of the file, it will be accompanied by a corresponding incompatible
-feature bit.
+   handling of the file, it will be accompanied by a corresponding incompatible
+   feature bit.
 
 2. If there are no unrecognized incompatible feature bits set, an unknown
-additional field may be safely ignored other than preserving its value when
-rewriting the image header.
+   additional field may be safely ignored other than preserving its value when
+   rewriting the image header.
+
+.. _ref_rules_3:
 
 3. An explicit value of 0 will have the same behavior as when the field is not
-present*, if not altered by a specific incompatible bit.
+   present*, if not altered by a specific incompatible bit.
 
-*. A field is considered not present when header_length is less than or equal
+(*) A field is considered not present when ``header_length`` is less than or equal
 to the field's offset. Also, all additional fields are not present for
 version 2.
 
-              104:  compression_type
+::
+
+        104:        compression_type
 
                     Defines the compression method used for compressed clusters.
                     All compressed clusters in an image use the same compression
@@ -219,8 +227,8 @@ version 2.
                     or must be zero (which means deflate).
 
                     Available compression type values:
-                        0: deflate <https://www.ietf.org/rfc/rfc1951.txt>
-                        1: zstd <http://github.com/facebook/zstd>
+                       - 0: deflate <https://www.ietf.org/rfc/rfc1951.txt>
+                       - 1: zstd <http://github.com/facebook/zstd>
 
                     The deflate compression type is called "zlib"
                     <https://www.zlib.net/> in QEMU. However, clusters with the
@@ -228,19 +236,21 @@ version 2.
 
         105 - 111:  Padding, contents defined below.
 
-=== Header padding ===
+Header padding
+--------------
 
-@header_length must be a multiple of 8, which means that if the end of the last
+``header_length`` must be a multiple of 8, which means that if the end of the last
 additional field is not aligned, some padding is needed. This padding must be
 zeroed, so that if some existing (or future) additional field will fall into
-the padding, it will be interpreted accordingly to point [3.] of the previous
+the padding, it will be interpreted accordingly to point `[3.] <#ref_rules_3>`_ of the previous
 paragraph, i.e.  in the same manner as when this field is not present.
 
 
-=== Header extensions ===
+Header extensions
+-----------------
 
 Directly after the image header, optional sections called header extensions can
-be stored. Each extension has a structure like the following:
+be stored. Each extension has a structure like the following::
 
     Byte  0 -  3:   Header extension type:
                         0x00000000 - End of the header extension area
@@ -270,17 +280,19 @@ data of compatible features that it doesn't support. Compatible features that
 need space for additional data can use a header extension.
 
 
-== String header extensions ==
+String header extensions
+------------------------
 
 Some header extensions (such as the backing file format name and the external
 data file name) are just a single string. In this case, the header extension
-length is the string length and the string is not '\0' terminated. (The header
-extension padding can make it look like a string is '\0' terminated, but
+length is the string length and the string is not ``\0`` terminated. (The header
+extension padding can make it look like a string is ``\0`` terminated, but
 neither is padding always necessary nor is there a guarantee that zero bytes
 are used for padding.)
 
 
-== Feature name table ==
+Feature name table
+------------------
 
 The feature name table is an optional header extension that contains the name
 for features used by the image. It can be used by applications that don't know
@@ -288,7 +300,7 @@ the respective feature (e.g. because the feature was introduced only later) to
 display a useful error message.
 
 The number of entries in the feature name table is determined by the length of
-the header extension data. Each entry look like this:
+the header extension data. Each entry looks like this::
 
     Byte       0:   Type of feature (select feature bitmap)
                         0: Incompatible feature
@@ -302,7 +314,8 @@ the header extension data. Each entry look like this:
                     terminated if it has full length)
 
 
-== Bitmaps extension ==
+Bitmaps extension
+-----------------
 
 The bitmaps extension is an optional header extension. It provides the ability
 to store bitmaps related to a virtual disk. For now, there is only one bitmap
@@ -310,9 +323,9 @@ type: the dirty tracking bitmap, which tracks virtual disk changes from some
 point in time.
 
 The data of the extension should be considered consistent only if the
-corresponding auto-clear feature bit is set, see autoclear_features above.
+corresponding auto-clear feature bit is set, see ``autoclear_features`` above.
 
-The fields of the bitmaps extension are:
+The fields of the bitmaps extension are::
 
     Byte  0 -  3:  nb_bitmaps
                    The number of bitmaps contained in the image. Must be
@@ -331,15 +344,17 @@ The fields of the bitmaps extension are:
                    Offset into the image file at which the bitmap directory
                    starts. Must be aligned to a cluster boundary.
 
-== Full disk encryption header pointer ==
+Full disk encryption header pointer
+-----------------------------------
 
 The full disk encryption header must be present if, and only if, the
-'crypt_method' header requires metadata. Currently this is only true
-of the 'LUKS' crypt method. The header extension must be absent for
+``crypt_method`` header requires metadata. Currently this is only true
+of the ``LUKS`` crypt method. The header extension must be absent for
 other methods.
 
 This header provides the offset at which the crypt method can store
 its additional data, as well as the length of such data.
+::
 
     Byte  0 -  7:   Offset into the image file at which the encryption
                     header starts in bytes. Must be aligned to a cluster
@@ -357,10 +372,10 @@ The first 592 bytes of the header clusters will contain the LUKS
 partition header. This is then followed by the key material data areas.
 The size of the key material data areas is determined by the number of
 stripes in the key slot and key size. Refer to the LUKS format
-specification ('docs/on-disk-format.pdf' in the cryptsetup source
+specification (``docs/on-disk-format.pdf`` in the cryptsetup source
 package) for details of the LUKS partition header format.
 
-In the LUKS partition header, the "payload-offset" field will be
+In the LUKS partition header, the ``payload-offset`` field will be
 calculated as normal for the LUKS spec. ie the size of the LUKS
 header, plus key material regions, plus padding, relative to the
 start of the LUKS header. This offset value is not required to be
@@ -369,11 +384,12 @@ context of qcow2, since the qcow2 file format itself defines where
 the real payload offset is, but none the less a valid payload offset
 should always be present.
 
-In the LUKS key slots header, the "key-material-offset" is relative
+In the LUKS key slots header, the ``key-material-offset`` is relative
 to the start of the LUKS header clusters in the qcow2 container,
 not the start of the qcow2 file.
 
 Logically the layout looks like
+::
 
   +-----------------------------+
   | QCow2 header                |
@@ -405,7 +421,8 @@ Logically the layout looks like
   |                             |
   +-----------------------------+
 
-== Data encryption ==
+Data encryption
+---------------
 
 When an encryption method is requested in the header, the image payload
 data must be encrypted/decrypted on every write/read. The image headers
@@ -413,7 +430,7 @@ and metadata are never encrypted.
 
 The algorithms used for encryption vary depending on the method
 
- - AES:
+ - ``AES``:
 
    The AES cipher, in CBC mode, with 256 bit keys.
 
@@ -425,7 +442,7 @@ The algorithms used for encryption vary depending on the method
    supported in the command line tools for the sake of back compatibility
    and data liberation.
 
- - LUKS:
+ - ``LUKS``:
 
    The algorithms are specified in the LUKS header.
 
@@ -433,7 +450,8 @@ The algorithms used for encryption vary depending on the method
    in the LUKS header, with the physical disk sector as the
    input tweak.
 
-== Host cluster management ==
+Host cluster management
+-----------------------
 
 qcow2 manages the allocation of host clusters by maintaining a reference count
 for each host cluster. A refcount of 0 means that the cluster is free, 1 means
@@ -453,14 +471,15 @@ Although a large enough refcount table can reserve clusters past 64 PB
 large), note that some qcow2 metadata such as L1/L2 tables must point
 to clusters prior to that point.
 
-Note: qemu has an implementation limit of 8 MB as the maximum refcount
-table size.  With a 2 MB cluster size and a default refcount_order of
-4, it is unable to reference host resources beyond 2 EB (61 bits); in
-the worst case, with a 512 cluster size and refcount_order of 6, it is
-unable to access beyond 32 GB (35 bits).
+.. note::
+    QEMU has an implementation limit of 8 MB as the maximum refcount
+    table size.  With a 2 MB cluster size and a default refcount_order of
+    4, it is unable to reference host resources beyond 2 EB (61 bits); in
+    the worst case, with a 512 cluster size and refcount_order of 6, it is
+    unable to access beyond 32 GB (35 bits).
 
 Given an offset into the image file, the refcount of its cluster can be
-obtained as follows:
+obtained as follows::
 
     refcount_block_entries = (cluster_size * 8 / refcount_bits)
 
@@ -470,7 +489,7 @@ obtained as follows:
     refcount_block = load_cluster(refcount_table[refcount_table_index]);
     return refcount_block[refcount_block_index];
 
-Refcount table entry:
+Refcount table entry::
 
     Bit  0 -  8:    Reserved (set to 0)
 
@@ -482,14 +501,15 @@ Refcount table entry:
                     been allocated. All refcounts managed by this refcount block
                     are 0.
 
-Refcount block entry (x = refcount_bits - 1):
+Refcount block entry ``(x = refcount_bits - 1)``::
 
     Bit  0 -  x:    Reference count of the cluster. If refcount_bits implies a
                     sub-byte width, note that bit 0 means the least significant
                     bit in this context.
 
 
-== Cluster mapping ==
+Cluster mapping
+---------------
 
 Just as for refcounts, qcow2 uses a two-level structure for the mapping of
 guest clusters to host clusters. They are called L1 and L2 table.
@@ -509,7 +529,7 @@ compressed clusters to reside below 512 TB (49 bits), and this limit
 cannot be relaxed without an incompatible layout change).
 
 Given an offset into the virtual disk, the offset into the image file can be
-obtained as follows:
+obtained as follows::
 
     l2_entries = (cluster_size / sizeof(uint64_t))        [*]
 
@@ -523,7 +543,7 @@ obtained as follows:
 
     [*] this changes if Extended L2 Entries are enabled, see next section
 
-L1 table entry:
+L1 table entry::
 
     Bit  0 -  8:    Reserved (set to 0)
 
@@ -538,7 +558,7 @@ L1 table entry:
                     refcount is exactly one. This information is only accurate
                     in the active L1 table.
 
-L2 table entry:
+L2 table entry::
 
     Bit  0 -  61:   Cluster descriptor
 
@@ -555,7 +575,7 @@ L2 table entry:
                     mapping for guest cluster offsets), so this bit should be 1
                     for all allocated clusters.
 
-Standard Cluster Descriptor:
+Standard Cluster Descriptor::
 
     Bit       0:    If set to 1, the cluster reads as all zeros. The host
                     cluster offset can be used to describe a preallocation,
@@ -577,7 +597,7 @@ Standard Cluster Descriptor:
         56 - 61:    Reserved (set to 0)
 
 
-Compressed Clusters Descriptor (x = 62 - (cluster_bits - 8)):
+Compressed Clusters Descriptor ``(x = 62 - (cluster_bits - 8))``::
 
     Bit  0 - x-1:   Host cluster offset. This is usually _not_ aligned to a
                     cluster or sector boundary!  If cluster_bits is
@@ -601,7 +621,8 @@ file (except if bit 0 in the Standard Cluster Descriptor is set). If there is
 no backing file or the backing file is smaller than the image, they shall read
 zeros for all parts that are not covered by the backing file.
 
-== Extended L2 Entries ==
+Extended L2 Entries
+-------------------
 
 An image uses Extended L2 Entries if bit 4 is set on the incompatible_features
 field of the header.
@@ -615,6 +636,8 @@ subclusters so they are treated the same as in images without this feature.
 The size of an extended L2 entry is 128 bits so the number of entries per table
 is calculated using this formula:
 
+.. code::
+
     l2_entries = (cluster_size / (2 * sizeof(uint64_t)))
 
 The first 64 bits have the same format as the standard L2 table entry described
@@ -623,7 +646,7 @@ descriptor.
 
 The last 64 bits contain a subcluster allocation bitmap with this format:
 
-Subcluster Allocation Bitmap (for standard clusters):
+Subcluster Allocation Bitmap (for standard clusters)::
 
     Bit  0 - 31:    Allocation status (one bit per subcluster)
 
@@ -647,13 +670,14 @@ Subcluster Allocation Bitmap (for standard clusters):
                     Bits are assigned starting from the least significant
                     one (i.e. bit x is used for subcluster x - 32).
 
-Subcluster Allocation Bitmap (for compressed clusters):
+Subcluster Allocation Bitmap (for compressed clusters)::
 
     Bit  0 - 63:    Reserved (set to 0)
                     Compressed clusters don't have subclusters,
                     so this field is not used.
 
-== Snapshots ==
+Snapshots
+---------
 
 qcow2 supports internal snapshots. Their basic principle of operation is to
 switch the active L1 table, so that a different set of host clusters are
@@ -672,7 +696,7 @@ in the image file, whose starting offset and length are given by the header
 fields snapshots_offset and nb_snapshots. The entries of the snapshot table
 have variable length, depending on the length of ID, name and extra data.
 
-Snapshot table entry:
+Snapshot table entry::
 
     Byte 0 -  7:    Offset into the image file at which the L1 table for the
                     snapshot starts. Must be aligned to a cluster boundary.
@@ -728,7 +752,8 @@ Snapshot table entry:
                     next multiple of 8.
 
 
-== Bitmaps ==
+Bitmaps
+-------
 
 As mentioned above, the bitmaps extension provides the ability to store bitmaps
 related to a virtual disk. This section describes how these bitmaps are stored.
@@ -739,20 +764,23 @@ each bitmap size is equal to the virtual disk size.
 Each bit of the bitmap is responsible for strictly defined range of the virtual
 disk. For bit number bit_nr the corresponding range (in bytes) will be:
 
+.. code::
+
     [bit_nr * bitmap_granularity .. (bit_nr + 1) * bitmap_granularity - 1]
 
 Granularity is a property of the concrete bitmap, see below.
 
 
-=== Bitmap directory ===
+Bitmap directory
+----------------
 
 Each bitmap saved in the image is described in a bitmap directory entry. The
 bitmap directory is a contiguous area in the image file, whose starting offset
-and length are given by the header extension fields bitmap_directory_offset and
-bitmap_directory_size. The entries of the bitmap directory have variable
+and length are given by the header extension fields ``bitmap_directory_offset`` and
+``bitmap_directory_size``. The entries of the bitmap directory have variable
 length, depending on the lengths of the bitmap name and extra data.
 
-Structure of a bitmap directory entry:
+Structure of a bitmap directory entry::
 
     Byte 0 -  7:    bitmap_table_offset
                     Offset into the image file at which the bitmap table
@@ -833,7 +861,8 @@ Structure of a bitmap directory entry:
                     next multiple of 8. All bytes of the padding must be zero.
 
 
-=== Bitmap table ===
+Bitmap table
+------------
 
 Each bitmap is stored using a one-level structure (as opposed to two-level
 structures like for refcounts and guest clusters mapping) for the mapping of
@@ -843,7 +872,7 @@ Each bitmap table has a variable size (stored in the bitmap directory entry)
 and may use multiple clusters, however, it must be contiguous in the image
 file.
 
-Structure of a bitmap table entry:
+Structure of a bitmap table entry::
 
     Bit       0:    Reserved and must be zero if bits 9 - 55 are non-zero.
                     If bits 9 - 55 are zero:
@@ -860,11 +889,12 @@ Structure of a bitmap table entry:
         56 - 63:    Reserved and must be zero.
 
 
-=== Bitmap data ===
+Bitmap data
+-----------
 
 As noted above, bitmap data is stored in separate clusters, described by the
 bitmap table. Given an offset (in bytes) into the bitmap data, the offset into
-the image file can be obtained as follows:
+the image file can be obtained as follows::
 
     image_offset(bitmap_data_offset) =
         bitmap_table[bitmap_data_offset / cluster_size] +
@@ -875,7 +905,7 @@ above).
 
 Given an offset byte_nr into the virtual disk and the bitmap's granularity, the
 bit offset into the image file to the corresponding bit of the bitmap can be
-calculated like this:
+calculated like this::
 
     bit_offset(byte_nr) =
         image_offset(byte_nr / granularity / 8) * 8 +
@@ -886,21 +916,22 @@ last cluster of the bitmap data contains some unused tail bits. These bits must
 be zero.
 
 
-=== Dirty tracking bitmaps ===
+Dirty tracking bitmaps
+----------------------
 
-Bitmaps with 'type' field equal to one are dirty tracking bitmaps.
+Bitmaps with ``type`` field equal to one are dirty tracking bitmaps.
 
-When the virtual disk is in use dirty tracking bitmap may be 'enabled' or
-'disabled'. While the bitmap is 'enabled', all writes to the virtual disk
+When the virtual disk is in use dirty tracking bitmap may be ``enabled`` or
+``disabled``. While the bitmap is ``enabled``, all writes to the virtual disk
 should be reflected in the bitmap. A set bit in the bitmap means that the
 corresponding range of the virtual disk (see above) was written to while the
-bitmap was 'enabled'. An unset bit means that this range was not written to.
+bitmap was ``enabled``. An unset bit means that this range was not written to.
 
 The software doesn't have to sync the bitmap in the image file with its
-representation in RAM after each write or metadata change. Flag 'in_use'
+representation in RAM after each write or metadata change. Flag ``in_use``
 should be set while the bitmap is not synced.
 
-In the image file the 'enabled' state is reflected by the 'auto' flag. If this
-flag is set, the software must consider the bitmap as 'enabled' and start
+In the image file the ``enabled`` state is reflected by the ``auto`` flag. If this
+flag is set, the software must consider the bitmap as ``enabled`` and start
 tracking virtual disk changes to this bitmap from the first write to the
 virtual disk. If this flag is not set then the bitmap is disabled.
diff --git a/docs/qcow2-cache.txt b/docs/qcow2-cache.txt
index 5f763aa6bb..204a5741ad 100644
--- a/docs/qcow2-cache.txt
+++ b/docs/qcow2-cache.txt
@@ -15,7 +15,7 @@ not a straightforward operation.
 This document attempts to give an overview of the L2 and refcount
 caches, and how to configure them.
 
-Please refer to the docs/interop/qcow2.txt file for an in-depth
+Please refer to the docs/interop/qcow2.rst file for an in-depth
 technical description of the qcow2 file format.
 
 

From 4f8599f20c4a54cefc626b50dc7392dd82b422f9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 29 May 2025 17:45:10 +0100
Subject: [PATCH 1287/2760] target/arm/tcg-stubs: compile file once (system)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250513173928.77376-2-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/meson.build | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/meson.build b/target/arm/meson.build
index b404fa5486..e568dfb706 100644
--- a/target/arm/meson.build
+++ b/target/arm/meson.build
@@ -48,7 +48,7 @@ subdir('hvf')
 if 'CONFIG_TCG' in config_all_accel
    subdir('tcg')
 else
-    arm_ss.add(files('tcg-stubs.c'))
+    arm_common_system_ss.add(files('tcg-stubs.c'))
 endif
 
 target_arch += {'arm': arm_ss}

From f1bcfa81d84c2a7401f6dcbf8fc1c7b26ec18213 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 29 May 2025 17:45:10 +0100
Subject: [PATCH 1288/2760] target/arm/hvf_arm: Avoid using poisoned CONFIG_HVF
 definition
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In order to allow non-target specific code to include
"hvf_arm.h", define the stubs in hvf-stub.c.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250513173928.77376-3-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 MAINTAINERS            |  1 +
 target/arm/hvf-stub.c  | 20 ++++++++++++++++++++
 target/arm/hvf_arm.h   | 16 ----------------
 target/arm/meson.build |  1 +
 4 files changed, 22 insertions(+), 16 deletions(-)
 create mode 100644 target/arm/hvf-stub.c

diff --git a/MAINTAINERS b/MAINTAINERS
index 8e68333623..973254fae7 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -510,6 +510,7 @@ Apple Silicon HVF CPUs
 M: Alexander Graf <agraf@csgraf.de>
 S: Maintained
 F: target/arm/hvf/
+F: target/arm/hvf-stub.c
 
 X86 HVF CPUs
 M: Cameron Esfahani <dirty@apple.com>
diff --git a/target/arm/hvf-stub.c b/target/arm/hvf-stub.c
new file mode 100644
index 0000000000..ff137267a0
--- /dev/null
+++ b/target/arm/hvf-stub.c
@@ -0,0 +1,20 @@
+/*
+ * QEMU Hypervisor.framework (HVF) stubs for ARM
+ *
+ *  Copyright (c) Linaro
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "hvf_arm.h"
+
+uint32_t hvf_arm_get_default_ipa_bit_size(void)
+{
+    g_assert_not_reached();
+}
+
+uint32_t hvf_arm_get_max_ipa_bit_size(void)
+{
+    g_assert_not_reached();
+}
diff --git a/target/arm/hvf_arm.h b/target/arm/hvf_arm.h
index 26c717b382..7a44e09262 100644
--- a/target/arm/hvf_arm.h
+++ b/target/arm/hvf_arm.h
@@ -22,23 +22,7 @@ void hvf_arm_init_debug(void);
 
 void hvf_arm_set_cpu_features_from_host(ARMCPU *cpu);
 
-#ifdef CONFIG_HVF
-
 uint32_t hvf_arm_get_default_ipa_bit_size(void);
 uint32_t hvf_arm_get_max_ipa_bit_size(void);
 
-#else
-
-static inline uint32_t hvf_arm_get_default_ipa_bit_size(void)
-{
-    return 0;
-}
-
-static inline uint32_t hvf_arm_get_max_ipa_bit_size(void)
-{
-    return 0;
-}
-
-#endif
-
 #endif
diff --git a/target/arm/meson.build b/target/arm/meson.build
index e568dfb706..2747f4b404 100644
--- a/target/arm/meson.build
+++ b/target/arm/meson.build
@@ -32,6 +32,7 @@ arm_common_system_ss.add(files('cpu.c'), capstone)
 arm_common_system_ss.add(when: 'TARGET_AARCH64', if_false: files(
   'cpu32-stubs.c'))
 arm_common_system_ss.add(when: 'CONFIG_KVM', if_false: files('kvm-stub.c'))
+arm_common_system_ss.add(when: 'CONFIG_HVF', if_false: files('hvf-stub.c'))
 arm_common_system_ss.add(files(
   'arch_dump.c',
   'arm-powerctl.c',

From 54d1046f939c2c508a6b73531af83345306ecaa9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 29 May 2025 17:45:11 +0100
Subject: [PATCH 1289/2760] target/arm: Only link with zlib when TCG is enabled
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since commit 538b764d341 ("target/arm: Move minor arithmetic
helpers out of helper.c") we only use the zlib helpers under
TCG.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-id: 20250513173928.77376-4-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/meson.build     | 1 -
 target/arm/tcg/meson.build | 2 ++
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/target/arm/meson.build b/target/arm/meson.build
index 2747f4b404..dcba4ef379 100644
--- a/target/arm/meson.build
+++ b/target/arm/meson.build
@@ -3,7 +3,6 @@ arm_common_ss = ss.source_set()
 arm_ss.add(files(
   'gdbstub.c',
 ))
-arm_ss.add(zlib)
 
 arm_ss.add(when: 'TARGET_AARCH64', if_true: files(
   'cpu64.c',
diff --git a/target/arm/tcg/meson.build b/target/arm/tcg/meson.build
index 2d1502ba88..c59f0f03a1 100644
--- a/target/arm/tcg/meson.build
+++ b/target/arm/tcg/meson.build
@@ -56,6 +56,8 @@ arm_system_ss.add(files(
 arm_system_ss.add(when: 'CONFIG_ARM_V7M', if_true: files('cpu-v7m.c'))
 arm_user_ss.add(when: 'TARGET_AARCH64', if_false: files('cpu-v7m.c'))
 
+arm_common_ss.add(zlib)
+
 arm_common_ss.add(files(
   'arith_helper.c',
   'crypto_helper.c',

From 982a42c773efc7767e33d618f0fe4fcaef716a57 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 29 May 2025 17:45:11 +0100
Subject: [PATCH 1290/2760] target/arm/cpregs: Include missing
 'target/arm/cpu.h' header
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

CPReadFn type definitions use the CPUARMState type, itself
declared in "cpu.h". Include this file in order to avoid when
refactoring headers:

  ../target/arm/cpregs.h:241:27: error: unknown type name 'CPUARMState'
  typedef uint64_t CPReadFn(CPUARMState *env, const ARMCPRegInfo *opaque);
                            ^

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250513173928.77376-5-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpregs.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target/arm/cpregs.h b/target/arm/cpregs.h
index 2183de8eda..c1a7ae3735 100644
--- a/target/arm/cpregs.h
+++ b/target/arm/cpregs.h
@@ -23,6 +23,7 @@
 
 #include "hw/registerfields.h"
 #include "target/arm/kvm-consts.h"
+#include "cpu.h"
 
 /*
  * ARMCPRegInfo type field bits:

From c28900fbcdc36175a1fc81015e952133007ae864 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 29 May 2025 17:45:11 +0100
Subject: [PATCH 1291/2760] hw/arm/boot: Include missing 'system/memory.h'
 header
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

default_reset_secondary() uses address_space_stl_notdirty(),
itself declared in "system/memory.h". Include this header in
order to avoid when refactoring headers:

  ../hw/arm/boot.c:281:5: error: implicit declaration of function 'address_space_stl_notdirty' is invalid in C99 [-Werror,-Wimplicit-function-declaration]
    address_space_stl_notdirty(as, info->smp_bootreg_addr,
    ^

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250513173928.77376-6-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/boot.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index f94b940bc3..79afb51b8a 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -19,6 +19,7 @@
 #include "system/kvm.h"
 #include "system/tcg.h"
 #include "system/system.h"
+#include "system/memory.h"
 #include "system/numa.h"
 #include "hw/boards.h"
 #include "system/reset.h"

From fe5aa1cfe22c71c80e544cf97741036cba0556d7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 29 May 2025 17:45:11 +0100
Subject: [PATCH 1292/2760] target/arm/cpu-features: Include missing 'cpu.h'
 header
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

"target/arm/cpu-features.h" dereferences the ARMISARegisters
structure, which is defined in "cpu.h". Include the latter to
avoid when refactoring unrelated headers:

  In file included from target/arm/internals.h:33:
  target/arm/cpu-features.h:45:54: error: unknown type name 'ARMISARegisters'
     45 | static inline bool isar_feature_aa32_thumb_div(const ARMISARegisters *id)
        |                                                      ^
  target/arm/cpu-features.h:47:12: error: use of undeclared identifier 'R_ID_ISAR0_DIVIDE_SHIFT'
     47 |     return FIELD_EX32(id->id_isar0, ID_ISAR0, DIVIDE) != 0;
        |            ^

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-id: 20250513173928.77376-7-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu-features.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target/arm/cpu-features.h b/target/arm/cpu-features.h
index 525e4cee12..4452e7c21e 100644
--- a/target/arm/cpu-features.h
+++ b/target/arm/cpu-features.h
@@ -22,6 +22,7 @@
 
 #include "hw/registerfields.h"
 #include "qemu/host-utils.h"
+#include "cpu.h"
 
 /*
  * Naming convention for isar_feature functions:

From e0f224ec077d90c10288a4f73d01a264b0364e46 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 29 May 2025 17:45:12 +0100
Subject: [PATCH 1293/2760] target/arm/qmp: Include missing 'cpu.h' header
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

arm-qmp-cmds.c uses ARM_MAX_VQ, which is defined in "cpu.h".
Include the latter to avoid when refactoring unrelated headers:

  target/arm/arm-qmp-cmds.c:83:19: error: use of undeclared identifier 'ARM_MAX_VQ'
     83 | QEMU_BUILD_BUG_ON(ARM_MAX_VQ > 16);
        |                   ^

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-id: 20250513173928.77376-8-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/arm-qmp-cmds.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target/arm/arm-qmp-cmds.c b/target/arm/arm-qmp-cmds.c
index cca6b9722b..cefd235263 100644
--- a/target/arm/arm-qmp-cmds.c
+++ b/target/arm/arm-qmp-cmds.c
@@ -30,6 +30,7 @@
 #include "qapi/qapi-commands-misc-arm.h"
 #include "qobject/qdict.h"
 #include "qom/qom-qobject.h"
+#include "cpu.h"
 
 static GICCapability *gic_cap_new(int version)
 {

From 3d28b2ce00e8b5e74e1f5cbba13cf306b8360762 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 29 May 2025 17:45:12 +0100
Subject: [PATCH 1294/2760] target/arm/kvm: Include missing 'cpu-qom.h' header
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

ARMCPU typedef is declared in "cpu-qom.h". Include it in
order to avoid when refactoring unrelated headers:

  target/arm/kvm_arm.h:54:29: error: unknown type name 'ARMCPU'
     54 | bool write_list_to_kvmstate(ARMCPU *cpu, int level);
        |                             ^

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-id: 20250513173928.77376-9-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/kvm_arm.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target/arm/kvm_arm.h b/target/arm/kvm_arm.h
index c4178d1327..7dc83caed5 100644
--- a/target/arm/kvm_arm.h
+++ b/target/arm/kvm_arm.h
@@ -12,6 +12,7 @@
 #define QEMU_KVM_ARM_H
 
 #include "system/kvm.h"
+#include "target/arm/cpu-qom.h"
 
 #define KVM_ARM_VGIC_V2   (1 << 0)
 #define KVM_ARM_VGIC_V3   (1 << 1)

From c42300ef71ba103a9bf67ca64cb94d5d9b633175 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 29 May 2025 17:45:12 +0100
Subject: [PATCH 1295/2760] target/arm/hvf: Include missing 'cpu-qom.h' header
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

ARMCPU typedef is declared in "cpu-qom.h". Include it in
order to avoid when refactoring unrelated headers:

  target/arm/hvf_arm.h:23:41: error: unknown type name 'ARMCPU'
     23 | void hvf_arm_set_cpu_features_from_host(ARMCPU *cpu);
        |                                         ^

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-id: 20250513173928.77376-10-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/hvf_arm.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/hvf_arm.h b/target/arm/hvf_arm.h
index 7a44e09262..ea82f2691d 100644
--- a/target/arm/hvf_arm.h
+++ b/target/arm/hvf_arm.h
@@ -11,7 +11,7 @@
 #ifndef QEMU_HVF_ARM_H
 #define QEMU_HVF_ARM_H
 
-#include "cpu.h"
+#include "target/arm/cpu-qom.h"
 
 /**
  * hvf_arm_init_debug() - initialize guest debug capabilities

From 96778e69a2e391e5dc99d2318e7830695c607795 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Thu, 29 May 2025 17:45:12 +0100
Subject: [PATCH 1296/2760] tests/functional: Add a test for the Stellaris arm
 machines

The 2023 edition of the QEMU advent calendar featured an image
that we can use to test whether the lm3s6965evb machine is basically
still working.

And for the lm3s811evb there is a small test kernel on github
which can be used to check its UART.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-id: 20250519170242.520805-1-thuth@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 MAINTAINERS                            |  1 +
 tests/functional/meson.build           |  1 +
 tests/functional/test_arm_stellaris.py | 48 ++++++++++++++++++++++++++
 3 files changed, 50 insertions(+)
 create mode 100755 tests/functional/test_arm_stellaris.py

diff --git a/MAINTAINERS b/MAINTAINERS
index 973254fae7..16af37986a 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1004,6 +1004,7 @@ F: hw/display/ssd03*
 F: include/hw/input/gamepad.h
 F: include/hw/timer/stellaris-gptm.h
 F: docs/system/arm/stellaris.rst
+F: tests/functional/test_arm_stellaris.py
 
 STM32L4x5 SoC Family
 M: Samuel Tardieu <sam@rfc1149.net>
diff --git a/tests/functional/meson.build b/tests/functional/meson.build
index 52b4706cfe..557d59ddf4 100644
--- a/tests/functional/meson.build
+++ b/tests/functional/meson.build
@@ -137,6 +137,7 @@ tests_arm_system_thorough = [
   'arm_raspi2',
   'arm_replay',
   'arm_smdkc210',
+  'arm_stellaris',
   'arm_sx1',
   'arm_vexpress',
   'arm_virt',
diff --git a/tests/functional/test_arm_stellaris.py b/tests/functional/test_arm_stellaris.py
new file mode 100755
index 0000000000..cbd21cb1a0
--- /dev/null
+++ b/tests/functional/test_arm_stellaris.py
@@ -0,0 +1,48 @@
+#!/usr/bin/env python3
+#
+# Functional test that checks the serial console of the stellaris machines
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+from qemu_test import QemuSystemTest, Asset, exec_command_and_wait_for_pattern
+from qemu_test import wait_for_console_pattern
+
+
+class StellarisMachine(QemuSystemTest):
+
+    ASSET_DAY22 = Asset(
+        'https://www.qemu-advent-calendar.org/2023/download/day22.tar.gz',
+        'ae3a63ef4b7a22c21bfc7fc0d85e402fe95e223308ed23ac854405016431ff51')
+
+    def test_lm3s6965evb(self):
+        self.set_machine('lm3s6965evb')
+        kernel_path = self.archive_extract(self.ASSET_DAY22,
+                                           member='day22/day22.bin')
+        self.vm.set_console()
+        self.vm.add_args('-kernel', kernel_path)
+        self.vm.launch()
+
+        wait_for_console_pattern(self, 'In a one horse open')
+
+    ASSET_NOTMAIN = Asset(
+        'https://github.com/Ahelion/QemuArmM4FDemoSw/raw/master/build/notmain.bin',
+        '6ceda031aa081a420fca2fca9e137fa681d6e3820d820ad1917736cb265e611a')
+
+    def test_lm3s811evb(self):
+        self.set_machine('lm3s811evb')
+        kernel_path = self.ASSET_NOTMAIN.fetch()
+
+        self.vm.set_console()
+        self.vm.add_args('-cpu', 'cortex-m4')
+        self.vm.add_args('-kernel', kernel_path)
+        self.vm.launch()
+
+        # The test kernel emits an initial '!' and then waits for input.
+        # For each character that we send it responds with a certain
+        # other ASCII character.
+        wait_for_console_pattern(self, '!')
+        exec_command_and_wait_for_pattern(self, '789', 'cdf')
+
+
+if __name__ == '__main__':
+    QemuSystemTest.main()

From e86c1f967a323165d13bcadfad4b92d0d34cdb08 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Thu, 29 May 2025 17:45:13 +0100
Subject: [PATCH 1297/2760] hw/block: Drop unused nand.c
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The nand.c device (TYPE_NAND) is an emulation of a NAND flash memory
chip which was used by the old OMAP boards.  No current QEMU board
uses it, and although techically "-device nand,chip-id=0x6b" doesn't
error out, it's not possible to usefully use it from the command
line because the only interface it has is via calling C functions
like nand_setpins() and nand_setio().

The "config OMAP" stanza (used only by the SX1 board) is the only
thing that does "select NAND" to compile in this code, but the SX1
board doesn't actually use the NAND device.

Remove the NAND device code entirely; this is effectively leftover
cleanup from when we dropped the PXA boards and the OMAP boards
other than the sx1.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250522142859.3122389-1-peter.maydell@linaro.org
---
 hw/arm/Kconfig           |   1 -
 hw/block/Kconfig         |   3 -
 hw/block/meson.build     |   1 -
 hw/block/nand.c          | 835 ---------------------------------------
 include/hw/block/flash.h |  18 -
 5 files changed, 858 deletions(-)
 delete mode 100644 hw/block/nand.c

diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
index a55b44d7bd..f543d944c3 100644
--- a/hw/arm/Kconfig
+++ b/hw/arm/Kconfig
@@ -147,7 +147,6 @@ config OMAP
     bool
     select FRAMEBUFFER
     select I2C
-    select NAND
     select PFLASH_CFI01
     select SD
     select SERIAL_MM
diff --git a/hw/block/Kconfig b/hw/block/Kconfig
index a898e04f03..737dbcdb3e 100644
--- a/hw/block/Kconfig
+++ b/hw/block/Kconfig
@@ -13,9 +13,6 @@ config FDC_SYSBUS
 config SSI_M25P80
     bool
 
-config NAND
-    bool
-
 config PFLASH_CFI01
     bool
 
diff --git a/hw/block/meson.build b/hw/block/meson.build
index 16a51bf8e2..655704471a 100644
--- a/hw/block/meson.build
+++ b/hw/block/meson.build
@@ -6,7 +6,6 @@ system_ss.add(files(
 system_ss.add(when: 'CONFIG_FDC', if_true: files('fdc.c'))
 system_ss.add(when: 'CONFIG_FDC_ISA', if_true: files('fdc-isa.c'))
 system_ss.add(when: 'CONFIG_FDC_SYSBUS', if_true: files('fdc-sysbus.c'))
-system_ss.add(when: 'CONFIG_NAND', if_true: files('nand.c'))
 system_ss.add(when: 'CONFIG_PFLASH_CFI01', if_true: files('pflash_cfi01.c'))
 system_ss.add(when: 'CONFIG_PFLASH_CFI02', if_true: files('pflash_cfi02.c'))
 system_ss.add(when: 'CONFIG_SSI_M25P80', if_true: files('m25p80.c'))
diff --git a/hw/block/nand.c b/hw/block/nand.c
deleted file mode 100644
index c80bf78fe5..0000000000
--- a/hw/block/nand.c
+++ /dev/null
@@ -1,835 +0,0 @@
-/*
- * Flash NAND memory emulation.  Based on "16M x 8 Bit NAND Flash
- * Memory" datasheet for the KM29U128AT / K9F2808U0A chips from
- * Samsung Electronic.
- *
- * Copyright (c) 2006 Openedhand Ltd.
- * Written by Andrzej Zaborowski <balrog@zabor.org>
- *
- * Support for additional features based on "MT29F2G16ABCWP 2Gx16"
- * datasheet from Micron Technology and "NAND02G-B2C" datasheet
- * from ST Microelectronics.
- *
- * This code is licensed under the GNU GPL v2.
- *
- * Contributions after 2012-01-13 are licensed under the terms of the
- * GNU GPL, version 2 or (at your option) any later version.
- */
-
-#ifndef NAND_IO
-
-#include "qemu/osdep.h"
-#include "hw/hw.h"
-#include "hw/qdev-properties.h"
-#include "hw/qdev-properties-system.h"
-#include "hw/block/flash.h"
-#include "system/block-backend.h"
-#include "migration/vmstate.h"
-#include "qapi/error.h"
-#include "qemu/error-report.h"
-#include "qemu/module.h"
-#include "qom/object.h"
-
-# define NAND_CMD_READ0         0x00
-# define NAND_CMD_READ1         0x01
-# define NAND_CMD_READ2         0x50
-# define NAND_CMD_LPREAD2       0x30
-# define NAND_CMD_NOSERIALREAD2 0x35
-# define NAND_CMD_RANDOMREAD1   0x05
-# define NAND_CMD_RANDOMREAD2   0xe0
-# define NAND_CMD_READID        0x90
-# define NAND_CMD_RESET         0xff
-# define NAND_CMD_PAGEPROGRAM1  0x80
-# define NAND_CMD_PAGEPROGRAM2  0x10
-# define NAND_CMD_CACHEPROGRAM2 0x15
-# define NAND_CMD_BLOCKERASE1   0x60
-# define NAND_CMD_BLOCKERASE2   0xd0
-# define NAND_CMD_READSTATUS    0x70
-# define NAND_CMD_COPYBACKPRG1  0x85
-
-# define NAND_IOSTATUS_ERROR    (1 << 0)
-# define NAND_IOSTATUS_PLANE0   (1 << 1)
-# define NAND_IOSTATUS_PLANE1   (1 << 2)
-# define NAND_IOSTATUS_PLANE2   (1 << 3)
-# define NAND_IOSTATUS_PLANE3   (1 << 4)
-# define NAND_IOSTATUS_READY    (1 << 6)
-# define NAND_IOSTATUS_UNPROTCT (1 << 7)
-
-# define MAX_PAGE       0x800
-# define MAX_OOB        0x40
-
-typedef struct NANDFlashState NANDFlashState;
-struct NANDFlashState {
-    DeviceState parent_obj;
-
-    uint8_t manf_id, chip_id;
-    uint8_t buswidth; /* in BYTES */
-    int size, pages;
-    int page_shift, oob_shift, erase_shift, addr_shift;
-    uint8_t *storage;
-    BlockBackend *blk;
-    int mem_oob;
-
-    uint8_t cle, ale, ce, wp, gnd;
-
-    uint8_t io[MAX_PAGE + MAX_OOB + 0x400];
-    uint8_t *ioaddr;
-    int iolen;
-
-    uint32_t cmd;
-    uint64_t addr;
-    int addrlen;
-    int status;
-    int offset;
-
-    void (*blk_write)(NANDFlashState *s);
-    void (*blk_erase)(NANDFlashState *s);
-    /*
-     * Returns %true when block containing (@addr + @offset) is
-     * successfully loaded, otherwise %false.
-     */
-    bool (*blk_load)(NANDFlashState *s, uint64_t addr, unsigned offset);
-
-    uint32_t ioaddr_vmstate;
-};
-
-#define TYPE_NAND "nand"
-
-OBJECT_DECLARE_SIMPLE_TYPE(NANDFlashState, NAND)
-
-static void mem_and(uint8_t *dest, const uint8_t *src, size_t n)
-{
-    /* Like memcpy() but we logical-AND the data into the destination */
-    int i;
-    for (i = 0; i < n; i++) {
-        dest[i] &= src[i];
-    }
-}
-
-# define NAND_NO_AUTOINCR   0x00000001
-# define NAND_BUSWIDTH_16   0x00000002
-# define NAND_NO_PADDING    0x00000004
-# define NAND_CACHEPRG      0x00000008
-# define NAND_COPYBACK      0x00000010
-# define NAND_IS_AND        0x00000020
-# define NAND_4PAGE_ARRAY   0x00000040
-# define NAND_NO_READRDY    0x00000100
-# define NAND_SAMSUNG_LP    (NAND_NO_PADDING | NAND_COPYBACK)
-
-# define NAND_IO
-
-# define PAGE(addr)          ((addr) >> ADDR_SHIFT)
-# define PAGE_START(page)    (PAGE(page) * (NAND_PAGE_SIZE + OOB_SIZE))
-# define PAGE_MASK           ((1 << ADDR_SHIFT) - 1)
-# define OOB_SHIFT           (PAGE_SHIFT - 5)
-# define OOB_SIZE            (1 << OOB_SHIFT)
-# define SECTOR(addr)        ((addr) >> (9 + ADDR_SHIFT - PAGE_SHIFT))
-# define SECTOR_OFFSET(addr) ((addr) & ((511 >> PAGE_SHIFT) << 8))
-
-# define NAND_PAGE_SIZE     256
-# define PAGE_SHIFT         8
-# define PAGE_SECTORS       1
-# define ADDR_SHIFT         8
-# include "nand.c"
-# define NAND_PAGE_SIZE     512
-# define PAGE_SHIFT         9
-# define PAGE_SECTORS       1
-# define ADDR_SHIFT         8
-# include "nand.c"
-# define NAND_PAGE_SIZE     2048
-# define PAGE_SHIFT         11
-# define PAGE_SECTORS       4
-# define ADDR_SHIFT         16
-# include "nand.c"
-
-/* Information based on Linux drivers/mtd/nand/raw/nand_ids.c */
-static const struct {
-    int size;
-    int width;
-    int page_shift;
-    int erase_shift;
-    uint32_t options;
-} nand_flash_ids[0x100] = {
-    [0 ... 0xff] = { 0 },
-
-    [0x6b] = { 4,   8,  9, 4, 0 },
-    [0xe3] = { 4,   8,  9, 4, 0 },
-    [0xe5] = { 4,   8,  9, 4, 0 },
-    [0xd6] = { 8,   8,  9, 4, 0 },
-    [0xe6] = { 8,   8,  9, 4, 0 },
-
-    [0x33] = { 16,  8,  9, 5, 0 },
-    [0x73] = { 16,  8,  9, 5, 0 },
-    [0x43] = { 16,  16, 9, 5, NAND_BUSWIDTH_16 },
-    [0x53] = { 16,  16, 9, 5, NAND_BUSWIDTH_16 },
-
-    [0x35] = { 32,  8,  9, 5, 0 },
-    [0x75] = { 32,  8,  9, 5, 0 },
-    [0x45] = { 32,  16, 9, 5, NAND_BUSWIDTH_16 },
-    [0x55] = { 32,  16, 9, 5, NAND_BUSWIDTH_16 },
-
-    [0x36] = { 64,  8,  9, 5, 0 },
-    [0x76] = { 64,  8,  9, 5, 0 },
-    [0x46] = { 64,  16, 9, 5, NAND_BUSWIDTH_16 },
-    [0x56] = { 64,  16, 9, 5, NAND_BUSWIDTH_16 },
-
-    [0x78] = { 128, 8,  9, 5, 0 },
-    [0x39] = { 128, 8,  9, 5, 0 },
-    [0x79] = { 128, 8,  9, 5, 0 },
-    [0x72] = { 128, 16, 9, 5, NAND_BUSWIDTH_16 },
-    [0x49] = { 128, 16, 9, 5, NAND_BUSWIDTH_16 },
-    [0x74] = { 128, 16, 9, 5, NAND_BUSWIDTH_16 },
-    [0x59] = { 128, 16, 9, 5, NAND_BUSWIDTH_16 },
-
-    [0x71] = { 256, 8,  9, 5, 0 },
-
-    /*
-     * These are the new chips with large page size. The pagesize and the
-     * erasesize is determined from the extended id bytes
-     */
-# define LP_OPTIONS (NAND_SAMSUNG_LP | NAND_NO_READRDY | NAND_NO_AUTOINCR)
-# define LP_OPTIONS16 (LP_OPTIONS | NAND_BUSWIDTH_16)
-
-    /* 512 Megabit */
-    [0xa2] = { 64,   8,  0, 0, LP_OPTIONS },
-    [0xf2] = { 64,   8,  0, 0, LP_OPTIONS },
-    [0xb2] = { 64,   16, 0, 0, LP_OPTIONS16 },
-    [0xc2] = { 64,   16, 0, 0, LP_OPTIONS16 },
-
-    /* 1 Gigabit */
-    [0xa1] = { 128,  8,  0, 0, LP_OPTIONS },
-    [0xf1] = { 128,  8,  0, 0, LP_OPTIONS },
-    [0xb1] = { 128,  16, 0, 0, LP_OPTIONS16 },
-    [0xc1] = { 128,  16, 0, 0, LP_OPTIONS16 },
-
-    /* 2 Gigabit */
-    [0xaa] = { 256,  8,  0, 0, LP_OPTIONS },
-    [0xda] = { 256,  8,  0, 0, LP_OPTIONS },
-    [0xba] = { 256,  16, 0, 0, LP_OPTIONS16 },
-    [0xca] = { 256,  16, 0, 0, LP_OPTIONS16 },
-
-    /* 4 Gigabit */
-    [0xac] = { 512,  8,  0, 0, LP_OPTIONS },
-    [0xdc] = { 512,  8,  0, 0, LP_OPTIONS },
-    [0xbc] = { 512,  16, 0, 0, LP_OPTIONS16 },
-    [0xcc] = { 512,  16, 0, 0, LP_OPTIONS16 },
-
-    /* 8 Gigabit */
-    [0xa3] = { 1024, 8,  0, 0, LP_OPTIONS },
-    [0xd3] = { 1024, 8,  0, 0, LP_OPTIONS },
-    [0xb3] = { 1024, 16, 0, 0, LP_OPTIONS16 },
-    [0xc3] = { 1024, 16, 0, 0, LP_OPTIONS16 },
-
-    /* 16 Gigabit */
-    [0xa5] = { 2048, 8,  0, 0, LP_OPTIONS },
-    [0xd5] = { 2048, 8,  0, 0, LP_OPTIONS },
-    [0xb5] = { 2048, 16, 0, 0, LP_OPTIONS16 },
-    [0xc5] = { 2048, 16, 0, 0, LP_OPTIONS16 },
-};
-
-static void nand_reset(DeviceState *dev)
-{
-    NANDFlashState *s = NAND(dev);
-    s->cmd = NAND_CMD_READ0;
-    s->addr = 0;
-    s->addrlen = 0;
-    s->iolen = 0;
-    s->offset = 0;
-    s->status &= NAND_IOSTATUS_UNPROTCT;
-    s->status |= NAND_IOSTATUS_READY;
-}
-
-static inline void nand_pushio_byte(NANDFlashState *s, uint8_t value)
-{
-    s->ioaddr[s->iolen++] = value;
-    for (value = s->buswidth; --value;) {
-        s->ioaddr[s->iolen++] = 0;
-    }
-}
-
-/*
- * nand_load_block: Load block containing (s->addr + @offset).
- * Returns length of data available at @offset in this block.
- */
-static unsigned nand_load_block(NANDFlashState *s, unsigned offset)
-{
-    unsigned iolen;
-
-    if (!s->blk_load(s, s->addr, offset)) {
-        return 0;
-    }
-
-    iolen = (1 << s->page_shift);
-    if (s->gnd) {
-        iolen += 1 << s->oob_shift;
-    }
-    assert(offset <= iolen);
-    iolen -= offset;
-
-    return iolen;
-}
-
-static void nand_command(NANDFlashState *s)
-{
-    switch (s->cmd) {
-    case NAND_CMD_READ0:
-        s->iolen = 0;
-        break;
-
-    case NAND_CMD_READID:
-        s->ioaddr = s->io;
-        s->iolen = 0;
-        nand_pushio_byte(s, s->manf_id);
-        nand_pushio_byte(s, s->chip_id);
-        nand_pushio_byte(s, 'Q'); /* Don't-care byte (often 0xa5) */
-        if (nand_flash_ids[s->chip_id].options & NAND_SAMSUNG_LP) {
-            /* Page Size, Block Size, Spare Size; bit 6 indicates
-             * 8 vs 16 bit width NAND.
-             */
-            nand_pushio_byte(s, (s->buswidth == 2) ? 0x55 : 0x15);
-        } else {
-            nand_pushio_byte(s, 0xc0); /* Multi-plane */
-        }
-        break;
-
-    case NAND_CMD_RANDOMREAD2:
-    case NAND_CMD_NOSERIALREAD2:
-        if (!(nand_flash_ids[s->chip_id].options & NAND_SAMSUNG_LP))
-            break;
-        s->iolen = nand_load_block(s, s->addr & ((1 << s->addr_shift) - 1));
-        break;
-
-    case NAND_CMD_RESET:
-        nand_reset(DEVICE(s));
-        break;
-
-    case NAND_CMD_PAGEPROGRAM1:
-        s->ioaddr = s->io;
-        s->iolen = 0;
-        break;
-
-    case NAND_CMD_PAGEPROGRAM2:
-        if (s->wp) {
-            s->blk_write(s);
-        }
-        break;
-
-    case NAND_CMD_BLOCKERASE1:
-        break;
-
-    case NAND_CMD_BLOCKERASE2:
-        s->addr &= (1ull << s->addrlen * 8) - 1;
-        s->addr <<= nand_flash_ids[s->chip_id].options & NAND_SAMSUNG_LP ?
-                                                                    16 : 8;
-
-        if (s->wp) {
-            s->blk_erase(s);
-        }
-        break;
-
-    case NAND_CMD_READSTATUS:
-        s->ioaddr = s->io;
-        s->iolen = 0;
-        nand_pushio_byte(s, s->status);
-        break;
-
-    default:
-        printf("%s: Unknown NAND command 0x%02x\n", __func__, s->cmd);
-    }
-}
-
-static int nand_pre_save(void *opaque)
-{
-    NANDFlashState *s = NAND(opaque);
-
-    s->ioaddr_vmstate = s->ioaddr - s->io;
-
-    return 0;
-}
-
-static int nand_post_load(void *opaque, int version_id)
-{
-    NANDFlashState *s = NAND(opaque);
-
-    if (s->ioaddr_vmstate > sizeof(s->io)) {
-        return -EINVAL;
-    }
-    s->ioaddr = s->io + s->ioaddr_vmstate;
-
-    return 0;
-}
-
-static const VMStateDescription vmstate_nand = {
-    .name = "nand",
-    .version_id = 1,
-    .minimum_version_id = 1,
-    .pre_save = nand_pre_save,
-    .post_load = nand_post_load,
-    .fields = (const VMStateField[]) {
-        VMSTATE_UINT8(cle, NANDFlashState),
-        VMSTATE_UINT8(ale, NANDFlashState),
-        VMSTATE_UINT8(ce, NANDFlashState),
-        VMSTATE_UINT8(wp, NANDFlashState),
-        VMSTATE_UINT8(gnd, NANDFlashState),
-        VMSTATE_BUFFER(io, NANDFlashState),
-        VMSTATE_UINT32(ioaddr_vmstate, NANDFlashState),
-        VMSTATE_INT32(iolen, NANDFlashState),
-        VMSTATE_UINT32(cmd, NANDFlashState),
-        VMSTATE_UINT64(addr, NANDFlashState),
-        VMSTATE_INT32(addrlen, NANDFlashState),
-        VMSTATE_INT32(status, NANDFlashState),
-        VMSTATE_INT32(offset, NANDFlashState),
-        /* XXX: do we want to save s->storage too? */
-        VMSTATE_END_OF_LIST()
-    }
-};
-
-static void nand_realize(DeviceState *dev, Error **errp)
-{
-    int pagesize;
-    NANDFlashState *s = NAND(dev);
-    int ret;
-
-
-    s->buswidth = nand_flash_ids[s->chip_id].width >> 3;
-    s->size = nand_flash_ids[s->chip_id].size << 20;
-    if (nand_flash_ids[s->chip_id].options & NAND_SAMSUNG_LP) {
-        s->page_shift = 11;
-        s->erase_shift = 6;
-    } else {
-        s->page_shift = nand_flash_ids[s->chip_id].page_shift;
-        s->erase_shift = nand_flash_ids[s->chip_id].erase_shift;
-    }
-
-    switch (1 << s->page_shift) {
-    case 256:
-        nand_init_256(s);
-        break;
-    case 512:
-        nand_init_512(s);
-        break;
-    case 2048:
-        nand_init_2048(s);
-        break;
-    default:
-        error_setg(errp, "Unsupported NAND block size %#x",
-                   1 << s->page_shift);
-        return;
-    }
-
-    pagesize = 1 << s->oob_shift;
-    s->mem_oob = 1;
-    if (s->blk) {
-        if (!blk_supports_write_perm(s->blk)) {
-            error_setg(errp, "Can't use a read-only drive");
-            return;
-        }
-        ret = blk_set_perm(s->blk, BLK_PERM_CONSISTENT_READ | BLK_PERM_WRITE,
-                           BLK_PERM_ALL, errp);
-        if (ret < 0) {
-            return;
-        }
-        if (blk_getlength(s->blk) >=
-                (s->pages << s->page_shift) + (s->pages << s->oob_shift)) {
-            pagesize = 0;
-            s->mem_oob = 0;
-        }
-    } else {
-        pagesize += 1 << s->page_shift;
-    }
-    if (pagesize) {
-        s->storage = (uint8_t *) memset(g_malloc(s->pages * pagesize),
-                        0xff, s->pages * pagesize);
-    }
-    /* Give s->ioaddr a sane value in case we save state before it is used. */
-    s->ioaddr = s->io;
-}
-
-static const Property nand_properties[] = {
-    DEFINE_PROP_UINT8("manufacturer_id", NANDFlashState, manf_id, 0),
-    DEFINE_PROP_UINT8("chip_id", NANDFlashState, chip_id, 0),
-    DEFINE_PROP_DRIVE("drive", NANDFlashState, blk),
-};
-
-static void nand_class_init(ObjectClass *klass, const void *data)
-{
-    DeviceClass *dc = DEVICE_CLASS(klass);
-
-    dc->realize = nand_realize;
-    device_class_set_legacy_reset(dc, nand_reset);
-    dc->vmsd = &vmstate_nand;
-    device_class_set_props(dc, nand_properties);
-    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
-}
-
-static const TypeInfo nand_info = {
-    .name          = TYPE_NAND,
-    .parent        = TYPE_DEVICE,
-    .instance_size = sizeof(NANDFlashState),
-    .class_init    = nand_class_init,
-};
-
-static void nand_register_types(void)
-{
-    type_register_static(&nand_info);
-}
-
-/*
- * Chip inputs are CLE, ALE, CE, WP, GND and eight I/O pins.  Chip
- * outputs are R/B and eight I/O pins.
- *
- * CE, WP and R/B are active low.
- */
-void nand_setpins(DeviceState *dev, uint8_t cle, uint8_t ale,
-                  uint8_t ce, uint8_t wp, uint8_t gnd)
-{
-    NANDFlashState *s = NAND(dev);
-
-    s->cle = cle;
-    s->ale = ale;
-    s->ce = ce;
-    s->wp = wp;
-    s->gnd = gnd;
-    if (wp) {
-        s->status |= NAND_IOSTATUS_UNPROTCT;
-    } else {
-        s->status &= ~NAND_IOSTATUS_UNPROTCT;
-    }
-}
-
-void nand_getpins(DeviceState *dev, int *rb)
-{
-    *rb = 1;
-}
-
-void nand_setio(DeviceState *dev, uint32_t value)
-{
-    int i;
-    NANDFlashState *s = NAND(dev);
-
-    if (!s->ce && s->cle) {
-        if (nand_flash_ids[s->chip_id].options & NAND_SAMSUNG_LP) {
-            if (s->cmd == NAND_CMD_READ0 && value == NAND_CMD_LPREAD2)
-                return;
-            if (value == NAND_CMD_RANDOMREAD1) {
-                s->addr &= ~((1 << s->addr_shift) - 1);
-                s->addrlen = 0;
-                return;
-            }
-        }
-        if (value == NAND_CMD_READ0) {
-            s->offset = 0;
-        } else if (value == NAND_CMD_READ1) {
-            s->offset = 0x100;
-            value = NAND_CMD_READ0;
-        } else if (value == NAND_CMD_READ2) {
-            s->offset = 1 << s->page_shift;
-            value = NAND_CMD_READ0;
-        }
-
-        s->cmd = value;
-
-        if (s->cmd == NAND_CMD_READSTATUS ||
-                s->cmd == NAND_CMD_PAGEPROGRAM2 ||
-                s->cmd == NAND_CMD_BLOCKERASE1 ||
-                s->cmd == NAND_CMD_BLOCKERASE2 ||
-                s->cmd == NAND_CMD_NOSERIALREAD2 ||
-                s->cmd == NAND_CMD_RANDOMREAD2 ||
-                s->cmd == NAND_CMD_RESET) {
-            nand_command(s);
-        }
-
-        if (s->cmd != NAND_CMD_RANDOMREAD2) {
-            s->addrlen = 0;
-        }
-    }
-
-    if (s->ale) {
-        unsigned int shift = s->addrlen * 8;
-        uint64_t mask = ~(0xffull << shift);
-        uint64_t v = (uint64_t)value << shift;
-
-        s->addr = (s->addr & mask) | v;
-        s->addrlen ++;
-
-        switch (s->addrlen) {
-        case 1:
-            if (s->cmd == NAND_CMD_READID) {
-                nand_command(s);
-            }
-            break;
-        case 2: /* fix cache address as a byte address */
-            s->addr <<= (s->buswidth - 1);
-            break;
-        case 3:
-            if (!(nand_flash_ids[s->chip_id].options & NAND_SAMSUNG_LP) &&
-                    (s->cmd == NAND_CMD_READ0 ||
-                     s->cmd == NAND_CMD_PAGEPROGRAM1)) {
-                nand_command(s);
-            }
-            break;
-        case 4:
-            if ((nand_flash_ids[s->chip_id].options & NAND_SAMSUNG_LP) &&
-                    nand_flash_ids[s->chip_id].size < 256 && /* 1Gb or less */
-                    (s->cmd == NAND_CMD_READ0 ||
-                     s->cmd == NAND_CMD_PAGEPROGRAM1)) {
-                nand_command(s);
-            }
-            break;
-        case 5:
-            if ((nand_flash_ids[s->chip_id].options & NAND_SAMSUNG_LP) &&
-                    nand_flash_ids[s->chip_id].size >= 256 && /* 2Gb or more */
-                    (s->cmd == NAND_CMD_READ0 ||
-                     s->cmd == NAND_CMD_PAGEPROGRAM1)) {
-                nand_command(s);
-            }
-            break;
-        default:
-            break;
-        }
-    }
-
-    if (!s->cle && !s->ale && s->cmd == NAND_CMD_PAGEPROGRAM1) {
-        if (s->iolen < (1 << s->page_shift) + (1 << s->oob_shift)) {
-            for (i = s->buswidth; i--; value >>= 8) {
-                s->io[s->iolen ++] = (uint8_t) (value & 0xff);
-            }
-        }
-    } else if (!s->cle && !s->ale && s->cmd == NAND_CMD_COPYBACKPRG1) {
-        if ((s->addr & ((1 << s->addr_shift) - 1)) <
-                (1 << s->page_shift) + (1 << s->oob_shift)) {
-            for (i = s->buswidth; i--; s->addr++, value >>= 8) {
-                s->io[s->iolen + (s->addr & ((1 << s->addr_shift) - 1))] =
-                    (uint8_t) (value & 0xff);
-            }
-        }
-    }
-}
-
-uint32_t nand_getio(DeviceState *dev)
-{
-    int offset;
-    uint32_t x = 0;
-    NANDFlashState *s = NAND(dev);
-
-    /* Allow sequential reading */
-    if (!s->iolen && s->cmd == NAND_CMD_READ0) {
-        offset = (int) (s->addr & ((1 << s->addr_shift) - 1)) + s->offset;
-        s->offset = 0;
-        s->iolen = nand_load_block(s, offset);
-    }
-
-    if (s->ce || s->iolen <= 0) {
-        return 0;
-    }
-
-    for (offset = s->buswidth; offset--;) {
-        x |= s->ioaddr[offset] << (offset << 3);
-    }
-    /* after receiving READ STATUS command all subsequent reads will
-     * return the status register value until another command is issued
-     */
-    if (s->cmd != NAND_CMD_READSTATUS) {
-        s->addr   += s->buswidth;
-        s->ioaddr += s->buswidth;
-        s->iolen  -= s->buswidth;
-    }
-    return x;
-}
-
-uint32_t nand_getbuswidth(DeviceState *dev)
-{
-    NANDFlashState *s = (NANDFlashState *) dev;
-    return s->buswidth << 3;
-}
-
-DeviceState *nand_init(BlockBackend *blk, int manf_id, int chip_id)
-{
-    DeviceState *dev;
-
-    if (nand_flash_ids[chip_id].size == 0) {
-        hw_error("%s: Unsupported NAND chip ID.\n", __func__);
-    }
-    dev = qdev_new(TYPE_NAND);
-    qdev_prop_set_uint8(dev, "manufacturer_id", manf_id);
-    qdev_prop_set_uint8(dev, "chip_id", chip_id);
-    if (blk) {
-        qdev_prop_set_drive_err(dev, "drive", blk, &error_fatal);
-    }
-
-    qdev_realize(dev, NULL, &error_fatal);
-    return dev;
-}
-
-type_init(nand_register_types)
-
-#else
-
-/* Program a single page */
-static void glue(nand_blk_write_, NAND_PAGE_SIZE)(NANDFlashState *s)
-{
-    uint64_t off, page, sector, soff;
-    uint8_t iobuf[(PAGE_SECTORS + 2) * 0x200];
-    if (PAGE(s->addr) >= s->pages)
-        return;
-
-    if (!s->blk) {
-        mem_and(s->storage + PAGE_START(s->addr) + (s->addr & PAGE_MASK) +
-                        s->offset, s->io, s->iolen);
-    } else if (s->mem_oob) {
-        sector = SECTOR(s->addr);
-        off = (s->addr & PAGE_MASK) + s->offset;
-        soff = SECTOR_OFFSET(s->addr);
-        if (blk_pread(s->blk, sector << BDRV_SECTOR_BITS,
-                      PAGE_SECTORS << BDRV_SECTOR_BITS, iobuf, 0) < 0) {
-            printf("%s: read error in sector %" PRIu64 "\n", __func__, sector);
-            return;
-        }
-
-        mem_and(iobuf + (soff | off), s->io, MIN(s->iolen, NAND_PAGE_SIZE - off));
-        if (off + s->iolen > NAND_PAGE_SIZE) {
-            page = PAGE(s->addr);
-            mem_and(s->storage + (page << OOB_SHIFT), s->io + NAND_PAGE_SIZE - off,
-                            MIN(OOB_SIZE, off + s->iolen - NAND_PAGE_SIZE));
-        }
-
-        if (blk_pwrite(s->blk, sector << BDRV_SECTOR_BITS,
-                       PAGE_SECTORS << BDRV_SECTOR_BITS, iobuf, 0) < 0) {
-            printf("%s: write error in sector %" PRIu64 "\n", __func__, sector);
-        }
-    } else {
-        off = PAGE_START(s->addr) + (s->addr & PAGE_MASK) + s->offset;
-        sector = off >> 9;
-        soff = off & 0x1ff;
-        if (blk_pread(s->blk, sector << BDRV_SECTOR_BITS,
-                      (PAGE_SECTORS + 2) << BDRV_SECTOR_BITS, iobuf, 0) < 0) {
-            printf("%s: read error in sector %" PRIu64 "\n", __func__, sector);
-            return;
-        }
-
-        mem_and(iobuf + soff, s->io, s->iolen);
-
-        if (blk_pwrite(s->blk, sector << BDRV_SECTOR_BITS,
-                       (PAGE_SECTORS + 2) << BDRV_SECTOR_BITS, iobuf, 0) < 0) {
-            printf("%s: write error in sector %" PRIu64 "\n", __func__, sector);
-        }
-    }
-    s->offset = 0;
-}
-
-/* Erase a single block */
-static void glue(nand_blk_erase_, NAND_PAGE_SIZE)(NANDFlashState *s)
-{
-    uint64_t i, page, addr;
-    uint8_t iobuf[0x200] = { [0 ... 0x1ff] = 0xff, };
-    addr = s->addr & ~((1 << (ADDR_SHIFT + s->erase_shift)) - 1);
-
-    if (PAGE(addr) >= s->pages) {
-        return;
-    }
-
-    if (!s->blk) {
-        memset(s->storage + PAGE_START(addr),
-                        0xff, (NAND_PAGE_SIZE + OOB_SIZE) << s->erase_shift);
-    } else if (s->mem_oob) {
-        memset(s->storage + (PAGE(addr) << OOB_SHIFT),
-                        0xff, OOB_SIZE << s->erase_shift);
-        i = SECTOR(addr);
-        page = SECTOR(addr + (1 << (ADDR_SHIFT + s->erase_shift)));
-        for (; i < page; i ++)
-            if (blk_pwrite(s->blk, i << BDRV_SECTOR_BITS,
-                           BDRV_SECTOR_SIZE, iobuf, 0) < 0) {
-                printf("%s: write error in sector %" PRIu64 "\n", __func__, i);
-            }
-    } else {
-        addr = PAGE_START(addr);
-        page = addr >> 9;
-        if (blk_pread(s->blk, page << BDRV_SECTOR_BITS,
-                      BDRV_SECTOR_SIZE, iobuf, 0) < 0) {
-            printf("%s: read error in sector %" PRIu64 "\n", __func__, page);
-        }
-        memset(iobuf + (addr & 0x1ff), 0xff, (~addr & 0x1ff) + 1);
-        if (blk_pwrite(s->blk, page << BDRV_SECTOR_BITS,
-                       BDRV_SECTOR_SIZE, iobuf, 0) < 0) {
-            printf("%s: write error in sector %" PRIu64 "\n", __func__, page);
-        }
-
-        memset(iobuf, 0xff, 0x200);
-        i = (addr & ~0x1ff) + 0x200;
-        for (addr += ((NAND_PAGE_SIZE + OOB_SIZE) << s->erase_shift) - 0x200;
-                        i < addr; i += 0x200) {
-            if (blk_pwrite(s->blk, i, BDRV_SECTOR_SIZE, iobuf, 0) < 0) {
-                printf("%s: write error in sector %" PRIu64 "\n",
-                       __func__, i >> 9);
-            }
-        }
-
-        page = i >> 9;
-        if (blk_pread(s->blk, page << BDRV_SECTOR_BITS,
-                      BDRV_SECTOR_SIZE, iobuf, 0) < 0) {
-            printf("%s: read error in sector %" PRIu64 "\n", __func__, page);
-        }
-        memset(iobuf, 0xff, ((addr - 1) & 0x1ff) + 1);
-        if (blk_pwrite(s->blk, page << BDRV_SECTOR_BITS,
-                       BDRV_SECTOR_SIZE, iobuf, 0) < 0) {
-            printf("%s: write error in sector %" PRIu64 "\n", __func__, page);
-        }
-    }
-}
-
-static bool glue(nand_blk_load_, NAND_PAGE_SIZE)(NANDFlashState *s,
-                                                 uint64_t addr, unsigned offset)
-{
-    if (PAGE(addr) >= s->pages) {
-        return false;
-    }
-
-    if (offset > NAND_PAGE_SIZE + OOB_SIZE) {
-        return false;
-    }
-
-    if (s->blk) {
-        if (s->mem_oob) {
-            if (blk_pread(s->blk, SECTOR(addr) << BDRV_SECTOR_BITS,
-                          PAGE_SECTORS << BDRV_SECTOR_BITS, s->io, 0) < 0) {
-                printf("%s: read error in sector %" PRIu64 "\n",
-                                __func__, SECTOR(addr));
-            }
-            memcpy(s->io + SECTOR_OFFSET(s->addr) + NAND_PAGE_SIZE,
-                            s->storage + (PAGE(s->addr) << OOB_SHIFT),
-                            OOB_SIZE);
-            s->ioaddr = s->io + SECTOR_OFFSET(s->addr) + offset;
-        } else {
-            if (blk_pread(s->blk, PAGE_START(addr),
-                          (PAGE_SECTORS + 2) << BDRV_SECTOR_BITS, s->io, 0)
-                < 0) {
-                printf("%s: read error in sector %" PRIu64 "\n",
-                                __func__, PAGE_START(addr) >> 9);
-            }
-            s->ioaddr = s->io + (PAGE_START(addr) & 0x1ff) + offset;
-        }
-    } else {
-        memcpy(s->io, s->storage + PAGE_START(s->addr) +
-                        offset, NAND_PAGE_SIZE + OOB_SIZE - offset);
-        s->ioaddr = s->io;
-    }
-
-    return true;
-}
-
-static void glue(nand_init_, NAND_PAGE_SIZE)(NANDFlashState *s)
-{
-    s->oob_shift = PAGE_SHIFT - 5;
-    s->pages = s->size >> PAGE_SHIFT;
-    s->addr_shift = ADDR_SHIFT;
-
-    s->blk_erase = glue(nand_blk_erase_, NAND_PAGE_SIZE);
-    s->blk_write = glue(nand_blk_write_, NAND_PAGE_SIZE);
-    s->blk_load = glue(nand_blk_load_, NAND_PAGE_SIZE);
-}
-
-# undef NAND_PAGE_SIZE
-# undef PAGE_SHIFT
-# undef PAGE_SECTORS
-# undef ADDR_SHIFT
-#endif /* NAND_IO */
diff --git a/include/hw/block/flash.h b/include/hw/block/flash.h
index 5fd67f5bb7..3671f0174d 100644
--- a/include/hw/block/flash.h
+++ b/include/hw/block/flash.h
@@ -44,24 +44,6 @@ PFlashCFI02 *pflash_cfi02_register(hwaddr base,
                                    uint16_t unlock_addr1,
                                    int be);
 
-/* nand.c */
-DeviceState *nand_init(BlockBackend *blk, int manf_id, int chip_id);
-void nand_setpins(DeviceState *dev, uint8_t cle, uint8_t ale,
-                  uint8_t ce, uint8_t wp, uint8_t gnd);
-void nand_getpins(DeviceState *dev, int *rb);
-void nand_setio(DeviceState *dev, uint32_t value);
-uint32_t nand_getio(DeviceState *dev);
-uint32_t nand_getbuswidth(DeviceState *dev);
-
-#define NAND_MFR_TOSHIBA    0x98
-#define NAND_MFR_SAMSUNG    0xec
-#define NAND_MFR_FUJITSU    0x04
-#define NAND_MFR_NATIONAL   0x8f
-#define NAND_MFR_RENESAS    0x07
-#define NAND_MFR_STMICRO    0x20
-#define NAND_MFR_HYNIX      0xad
-#define NAND_MFR_MICRON     0x2c
-
 /* m25p80.c */
 
 #define TYPE_M25P80 "m25p80-generic"

From e2e360db7a55afd62e77577a965f6aa224132cef Mon Sep 17 00:00:00 2001
From: Nir Soffer <nirsof@gmail.com>
Date: Sat, 17 May 2025 23:11:52 +0300
Subject: [PATCH 1298/2760] io: Add helper for setting socket send buffer size
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Testing reading and writing from qemu-nbd using a unix domain socket
shows that the platform default send buffer size is too low, leading to
poor performance and hight cpu usage.

Add a helper for setting socket send buffer size to be used in NBD code.
It can also be used in other contexts.

We don't need a helper for receive buffer size since it is not used with
unix domain sockets. This is documented for Linux, and not documented
for macOS.

Failing to set the socket buffer size is not a fatal error, but the
caller may want to warn about the failure.

Signed-off-by: Nir Soffer <nirsof@gmail.com>
Message-ID: <20250517201154.88456-2-nirsof@gmail.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Eric Blake <eblake@redhat.com>
---
 include/io/channel-socket.h | 13 +++++++++++++
 io/channel-socket.c         | 11 +++++++++++
 2 files changed, 24 insertions(+)

diff --git a/include/io/channel-socket.h b/include/io/channel-socket.h
index ab15577d38..a88cf8b3a9 100644
--- a/include/io/channel-socket.h
+++ b/include/io/channel-socket.h
@@ -261,5 +261,18 @@ QIOChannelSocket *
 qio_channel_socket_accept(QIOChannelSocket *ioc,
                           Error **errp);
 
+/**
+ * qio_channel_socket_set_send_buffer:
+ * @ioc: the socket channel object
+ * @size: buffer size
+ * @errp: pointer to a NULL-initialized error object
+ *
+ * Set the underlying socket send buffer size.
+ *
+ * Retruns: 0 on success, or -1 on error.
+ */
+int qio_channel_socket_set_send_buffer(QIOChannelSocket *ioc,
+                                       size_t size,
+                                       Error **errp);
 
 #endif /* QIO_CHANNEL_SOCKET_H */
diff --git a/io/channel-socket.c b/io/channel-socket.c
index 088b49ffdb..3b7ca924ff 100644
--- a/io/channel-socket.c
+++ b/io/channel-socket.c
@@ -78,6 +78,17 @@ qio_channel_socket_new(void)
     return sioc;
 }
 
+int qio_channel_socket_set_send_buffer(QIOChannelSocket *ioc,
+                                       size_t size,
+                                       Error **errp)
+{
+    if (setsockopt(ioc->fd, SOL_SOCKET, SO_SNDBUF, &size, sizeof(size)) < 0) {
+        error_setg_errno(errp, errno, "Unable to set socket send buffer size");
+        return -1;
+    }
+
+    return 0;
+}
 
 static int
 qio_channel_socket_set_fd(QIOChannelSocket *sioc,

From e9f4550b74a8a9774979a51caa4b1aaff9e1d055 Mon Sep 17 00:00:00 2001
From: Nir Soffer <nirsof@gmail.com>
Date: Sat, 17 May 2025 23:11:53 +0300
Subject: [PATCH 1299/2760] nbd: Set unix socket send buffer on macOS
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

On macOS we need to increase unix socket buffers size on the client and
server to get good performance. We set socket buffers on macOS after
connecting or accepting a client connection.

Testing shows that setting socket receive buffer size (SO_RCVBUF) has no
effect on performance, so we set only the send buffer size (SO_SNDBUF).
It seems to work like Linux but not documented.

Testing shows that optimal buffer size is 512k to 4 MiB, depending on
the test case. The difference is very small, so I chose 2 MiB.

I tested reading from qemu-nbd and writing to qemu-nbd with qemu-img and
computing a blkhash with nbdcopy and blksum.

To focus on NBD communication and get less noisy results, I tested
reading and writing to null-co driver. I added a read-pattern option to
the null-co driver to return data full of 0xff:

    NULL="json:{'driver': 'raw', 'file': {'driver': 'null-co', 'size': '10g', 'read-pattern': 255}}"

For testing buffer size I added an environment variable for setting the
socket buffer size.

Read from qemu-nbd via qemu-img convert. In this test buffer size of 2m
is optimal (12.6 times faster).

    qemu-nbd -r -t -e 0 -f raw -k /tmp/nbd.sock "$NULL" &
    qemu-img convert -f raw -O raw -W -n "nbd+unix:///?socket=/tmp/nbd.sock" "$NULL"

| buffer size | time    | user    | system  |
|-------------|---------|---------|---------|
|     default |  13.361 |   2.653 |   5.702 |
|       65536 |   2.283 |   0.204 |   1.318 |
|      131072 |   1.673 |   0.062 |   1.008 |
|      262144 |   1.592 |   0.053 |   0.952 |
|      524288 |   1.496 |   0.049 |   0.887 |
|     1048576 |   1.234 |   0.047 |   0.738 |
|     2097152 |   1.060 |   0.080 |   0.602 |
|     4194304 |   1.061 |   0.076 |   0.604 |

Write to qemu-nbd with qemu-img convert. In this test buffer size of 2m
is optimal (9.2 times faster).

    qemu-nbd -t -e 0 -f raw -k /tmp/nbd.sock "$NULL" &
    qemu-img convert -f raw -O raw -W -n "$NULL" "nbd+unix:///?socket=/tmp/nbd.sock"

| buffer size | time    | user    | system  |
|-------------|---------|---------|---------|
|     default |   8.063 |   2.522 |   4.184 |
|       65536 |   1.472 |   0.430 |   0.867 |
|      131072 |   1.071 |   0.297 |   0.654 |
|      262144 |   1.012 |   0.239 |   0.587 |
|      524288 |   0.970 |   0.201 |   0.514 |
|     1048576 |   0.895 |   0.184 |   0.454 |
|     2097152 |   0.877 |   0.174 |   0.440 |
|     4194304 |   0.944 |   0.231 |   0.535 |

Compute a blkhash with nbdcopy, using 4 NBD connections and 256k request
size. In this test buffer size of 4m is optimal (5.1 times faster).

    qemu-nbd -r -t -e 0 -f raw -k /tmp/nbd.sock "$NULL" &
    nbdcopy --blkhash "nbd+unix:///?socket=/tmp/nbd.sock" null:

| buffer size | time    | user    | system  |
|-------------|---------|---------|---------|
|     default |   8.624 |   5.727 |   6.507 |
|       65536 |   2.563 |   4.760 |   2.498 |
|      131072 |   1.903 |   4.559 |   2.093 |
|      262144 |   1.759 |   4.513 |   1.935 |
|      524288 |   1.729 |   4.489 |   1.924 |
|     1048576 |   1.696 |   4.479 |   1.884 |
|     2097152 |   1.710 |   4.480 |   1.763 |
|     4194304 |   1.687 |   4.479 |   1.712 |

Compute a blkhash with blksum, using 1 NBD connection and 256k read
size. In this test buffer size of 512k is optimal (10.3 times faster).

    qemu-nbd -r -t -e 0 -f raw -k /tmp/nbd.sock "$NULL" &
    blksum "nbd+unix:///?socket=/tmp/nbd.sock"

| buffer size | time    | user    | system  |
|-------------|---------|---------|---------|
|     default |  13.085 |   5.664 |   6.461 |
|       65536 |   3.299 |   5.106 |   2.515 |
|      131072 |   2.396 |   4.989 |   2.069 |
|      262144 |   1.607 |   4.724 |   1.555 |
|      524288 |   1.271 |   4.528 |   1.224 |
|     1048576 |   1.294 |   4.565 |   1.333 |
|     2097152 |   1.299 |   4.569 |   1.344 |
|     4194304 |   1.291 |   4.559 |   1.327 |

Signed-off-by: Nir Soffer <nirsof@gmail.com>
Message-ID: <20250517201154.88456-3-nirsof@gmail.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Eric Blake <eblake@redhat.com>
---
 nbd/client-connection.c |  3 +++
 nbd/common.c            | 25 +++++++++++++++++++++++++
 nbd/nbd-internal.h      |  5 +++++
 nbd/server.c            |  2 ++
 4 files changed, 35 insertions(+)

diff --git a/nbd/client-connection.c b/nbd/client-connection.c
index b11e266807..79ea97e4cc 100644
--- a/nbd/client-connection.c
+++ b/nbd/client-connection.c
@@ -31,6 +31,8 @@
 #include "qapi/clone-visitor.h"
 #include "qemu/coroutine.h"
 
+#include "nbd/nbd-internal.h"
+
 struct NBDClientConnection {
     /* Initialization constants, never change */
     SocketAddress *saddr; /* address to connect to */
@@ -140,6 +142,7 @@ static int nbd_connect(QIOChannelSocket *sioc, SocketAddress *addr,
         return ret;
     }
 
+    nbd_set_socket_send_buffer(sioc);
     qio_channel_set_delay(QIO_CHANNEL(sioc), false);
 
     if (!info) {
diff --git a/nbd/common.c b/nbd/common.c
index 589a748cfe..9436e9d1d1 100644
--- a/nbd/common.c
+++ b/nbd/common.c
@@ -18,6 +18,9 @@
 
 #include "qemu/osdep.h"
 #include "trace.h"
+#include "io/channel-socket.h"
+#include "qapi/error.h"
+#include "qemu/units.h"
 #include "nbd-internal.h"
 
 /* Discard length bytes from channel.  Return -errno on failure and 0 on
@@ -264,3 +267,25 @@ const char *nbd_mode_lookup(NBDMode mode)
         return "<unknown>";
     }
 }
+
+/*
+ * Testing shows that 2m send buffer is optimal. Changing the receive buffer
+ * size has no effect on performance.
+ */
+#if defined(__APPLE__)
+#define UNIX_STREAM_SOCKET_SEND_BUFFER_SIZE (2 * MiB)
+#endif
+
+void nbd_set_socket_send_buffer(QIOChannelSocket *sioc)
+{
+#ifdef UNIX_STREAM_SOCKET_SEND_BUFFER_SIZE
+    if (sioc->localAddr.ss_family == AF_UNIX) {
+        size_t size = UNIX_STREAM_SOCKET_SEND_BUFFER_SIZE;
+        Error *errp = NULL;
+
+        if (qio_channel_socket_set_send_buffer(sioc, size, &errp) < 0) {
+            warn_report_err(errp);
+        }
+    }
+#endif /* UNIX_STREAM_SOCKET_SEND_BUFFER_SIZE */
+}
diff --git a/nbd/nbd-internal.h b/nbd/nbd-internal.h
index 715d92d6ef..6bafeef5dd 100644
--- a/nbd/nbd-internal.h
+++ b/nbd/nbd-internal.h
@@ -74,4 +74,9 @@ static inline int nbd_write(QIOChannel *ioc, const void *buffer, size_t size,
 
 int nbd_drop(QIOChannel *ioc, size_t size, Error **errp);
 
+/* nbd_set_socket_send_buffer
+ * Set the socket send buffer size for optimal performance.
+ */
+void nbd_set_socket_send_buffer(QIOChannelSocket *sioc);
+
 #endif
diff --git a/nbd/server.c b/nbd/server.c
index 2076fb2666..d242be9811 100644
--- a/nbd/server.c
+++ b/nbd/server.c
@@ -3291,6 +3291,8 @@ void nbd_client_new(QIOChannelSocket *sioc,
     client->close_fn = close_fn;
     client->owner = owner;
 
+    nbd_set_socket_send_buffer(sioc);
+
     co = qemu_coroutine_create(nbd_co_client_start, client);
     qemu_coroutine_enter(co);
 }

From 479ec8106185d0e88d65539df5e940c781a82c53 Mon Sep 17 00:00:00 2001
From: Nir Soffer <nirsof@gmail.com>
Date: Sat, 17 May 2025 23:11:54 +0300
Subject: [PATCH 1300/2760] nbd: Set unix socket send buffer on Linux
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Like macOS we have similar issue on Linux. For TCP socket the send
buffer size is 2626560 bytes (~2.5 MiB) and we get good performance.
However for unix socket the default and maximum buffer size is 212992
bytes (208 KiB) and we see poor performance when using one NBD
connection, up to 4 times slower than macOS on the same machine.

Tracing shows that for every 2 MiB payload (qemu uses 2 MiB io size), we
do 1 recvmsg call with TCP socket, and 10 recvmsg calls with unix
socket.

Fixing this issue requires changing the maximum send buffer size (the
receive buffer size is ignored). This can be done using:

    $ cat /etc/sysctl.d/net-mem-max.conf
    net.core.wmem_max = 2097152

    $ sudo sysctl -p /etc/sysctl.d/net-mem-max.conf

With this we can set the socket buffer size to 2 MiB. With the defaults
the value requested by qemu is clipped to the maximum size and has no
effect.

I tested on 2 machines:
- Fedora 42 VM on MacBook Pro M2 Max
- Dell PowerEdge R640 (Intel(R) Xeon(R) Gold 6230 CPU @ 2.10GHz)

On the older Dell machine we see very little improvement, up to 1.03
higher throughput. On the M2 machine we see up to 2.67 times higher
throughput. The following results are from the M2 machine.

Reading from qemu-nbd with qemu-img convert. In this test buffer size of
4m is optimal (2.28 times faster).

| buffer size | time    | user    | system  |
|-------------|---------|---------|---------|
|     default |   4.292 |   0.243 |   1.604 |
|      524288 |   2.167 |   0.058 |   1.288 |
|     1048576 |   2.041 |   0.060 |   1.238 |
|     2097152 |   1.884 |   0.060 |   1.191 |
|     4194304 |   1.881 |   0.054 |   1.196 |

Writing to qemu-nbd with qemu-img convert. In this test buffer size of
1m is optimal (2.67 times faster).

| buffer size | time    | user    | system  |
|-------------|---------|---------|---------|
|     default |   3.113 |   0.334 |   1.094 |
|      524288 |   1.173 |   0.179 |   0.654 |
|     1048576 |   1.164 |   0.164 |   0.670 |
|     2097152 |   1.227 |   0.197 |   0.663 |
|     4194304 |   1.227 |   0.198 |   0.666 |

Computing a blkhash with nbdcopy. In this test buffer size of 512k is
optimal (1.19 times faster).

| buffer size | time    | user    | system  |
|-------------|---------|---------|---------|
|     default |   2.140 |   4.483 |   2.681 |
|      524288 |   1.794 |   4.467 |   2.572 |
|     1048576 |   1.807 |   4.447 |   2.644 |
|     2097152 |   1.822 |   4.461 |   2.698 |
|     4194304 |   1.827 |   4.465 |   2.700 |

Computing a blkhash with blksum. In this test buffer size of 4m is
optimal (2.65 times faster).

| buffer size | time    | user    | system  |
|-------------|---------|---------|---------|
|     default |   3.582 |   4.595 |   2.392 |
|      524288 |   1.499 |   4.384 |   1.482 |
|     1048576 |   1.377 |   4.381 |   1.345 |
|     2097152 |   1.388 |   4.389 |   1.354 |
|     4194304 |   1.352 |   4.395 |   1.302 |

Signed-off-by: Nir Soffer <nirsof@gmail.com>
Message-ID: <20250517201154.88456-4-nirsof@gmail.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Eric Blake <eblake@redhat.com>
---
 nbd/common.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/nbd/common.c b/nbd/common.c
index 9436e9d1d1..2a133a66c3 100644
--- a/nbd/common.c
+++ b/nbd/common.c
@@ -271,8 +271,9 @@ const char *nbd_mode_lookup(NBDMode mode)
 /*
  * Testing shows that 2m send buffer is optimal. Changing the receive buffer
  * size has no effect on performance.
+ * On Linux we need to increase net.core.wmem_max to make this effective.
  */
-#if defined(__APPLE__)
+#if defined(__APPLE__) || defined(__linux__)
 #define UNIX_STREAM_SOCKET_SEND_BUFFER_SIZE (2 * MiB)
 #endif
 

From d2b3e32bf7395c710ba44585520d837f6330fa70 Mon Sep 17 00:00:00 2001
From: Eric Blake <eblake@redhat.com>
Date: Fri, 23 May 2025 11:27:21 -0500
Subject: [PATCH 1301/2760] iotests: Use disk_usage in more places

Commit be9bac07 added a utility disk_usage function, but there are
a couple of other tests that could also use it.

Signed-off-by: Eric Blake <eblake@redhat.com>
Message-ID: <20250523163041.2548675-6-eblake@redhat.com>
Reviewed-by: Fiona Ebner <f.ebner@proxmox.com>
Tested-by: Fiona Ebner <f.ebner@proxmox.com>
---
 tests/qemu-iotests/125 | 2 +-
 tests/qemu-iotests/308 | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/tests/qemu-iotests/125 b/tests/qemu-iotests/125
index 46279d6b38..708e7c5ba2 100755
--- a/tests/qemu-iotests/125
+++ b/tests/qemu-iotests/125
@@ -35,7 +35,7 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 get_image_size_on_host()
 {
-    echo $(($(stat -c '%b * %B' "$TEST_IMG_FILE")))
+    disk_usage "$TEST_IMG_FILE"
 }
 
 # get standard environment and filters
diff --git a/tests/qemu-iotests/308 b/tests/qemu-iotests/308
index ea81dc496a..437a9014da 100755
--- a/tests/qemu-iotests/308
+++ b/tests/qemu-iotests/308
@@ -290,7 +290,7 @@ echo '--- Try growing non-growable export ---'
 
 # Get the current size so we can write beyond the EOF
 orig_len=$(get_proto_len "$EXT_MP" "$TEST_IMG")
-orig_disk_usage=$(stat -c '%b' "$TEST_IMG")
+orig_disk_usage=$(disk_usage "$TEST_IMG")
 
 # Should fail (exports are non-growable by default)
 # (Note that qemu-io can never write beyond the EOF, so we have to use
@@ -312,7 +312,7 @@ else
     echo 'OK: Post-truncate image size is as expected'
 fi
 
-new_disk_usage=$(stat -c '%b' "$TEST_IMG")
+new_disk_usage=$(disk_usage "$TEST_IMG")
 if [ "$new_disk_usage" -gt "$orig_disk_usage" ]; then
     echo 'OK: Disk usage grew with fallocate'
 else

From ed1c336119c084159575ae9d4fd9171bd500f7e4 Mon Sep 17 00:00:00 2001
From: Eric Blake <eblake@redhat.com>
Date: Fri, 23 May 2025 11:27:22 -0500
Subject: [PATCH 1302/2760] iotests: Improve mirror-sparse on ext4 and xfs

Fiona reported that an ext4 filesystem on top of LVM can sometimes
report over-allocation to du (based on the heuristics the filesystem
is making while observing the contents being mirrored); even though
the contents and actual size matched, about 50% of the time the size
reported by disk_usage was too large by 4k, failing the test.  In
auditing other iotests, this is a common problem we've had to deal
with.

Meanwhile, Markus reported that an xfs filesystem reports disk usage
at a default granularity of 1M (so the sparse file occupies 3M, since
it has just over 2M data).

Reported-by: Fiona Ebner <f.ebner@proxmox.com>
Reported-by: Markus Armbruster <armbru@redhat.com>
Fixes: c0ddcb2c ("tests: Add iotest mirror-sparse for recent patches")
Signed-off-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Fiona Ebner <f.ebner@proxmox.com>
Tested-by: Fiona Ebner <f.ebner@proxmox.com>
Message-ID: <20250523163041.2548675-7-eblake@redhat.com>
[eblake: Also fix xfs issue]
Signed-off-by: Eric Blake <eblake@redhat.com>
---
 tests/qemu-iotests/tests/mirror-sparse | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/tests/qemu-iotests/tests/mirror-sparse b/tests/qemu-iotests/tests/mirror-sparse
index 8c52a4e244..11418c0871 100755
--- a/tests/qemu-iotests/tests/mirror-sparse
+++ b/tests/qemu-iotests/tests/mirror-sparse
@@ -96,13 +96,15 @@ _send_qemu_cmd $h1 '{"execute": "blockdev-del", "arguments":
                 {"node-name": "dst"}}' 'return' \
                   | _filter_block_job_offset | _filter_block_job_len
 $QEMU_IMG compare -U -f $IMGFMT -F raw $TEST_IMG.base $TEST_IMG
+# Some filesystems can fudge allocations for various reasons; rather
+# than expecting precise 2M and 20M images, it is better to allow for slop.
 result=$(disk_usage $TEST_IMG)
-if test $result -lt $((3*1024*1024)); then
+if test $result -lt $((4*1024*1024)); then
     actual=sparse
-elif test $result = $((20*1024*1024)); then
+elif test $result -gt $((19*1024*1024)); then
     actual=full
 else
-    actual=unknown
+    actual="unexpected size ($result)"
 fi
 echo "Destination is $actual; expected $expected"
 }

From c49dda7254d43d9e1d4da59c55f02055ba7c4c1b Mon Sep 17 00:00:00 2001
From: Eric Blake <eblake@redhat.com>
Date: Fri, 23 May 2025 11:27:23 -0500
Subject: [PATCH 1303/2760] iotests: Filter out ZFS in several tests

Fiona reported that ZFS makes sparse file testing awkward, since:
- it has asynchronous allocation (not even 'fsync $file' makes du see
  the desired size; it takes the slower 'fsync -f $file' which is not
  appropriate for the tests)
- for tests of fully allocated files, ZFS with compression enabled
  still reports smaller disk usage

Add a new _require_disk_usage that quickly probes whether an attempt
to create a sparse 5M file shows as less than 1M usage, while the same
file with -o preallocation=full shows as more than 4M usage without
sync, which should filter out ZFS behavior.  Then use it in various
affected tests.

This does not add the new filter on all tests that Fiona is seeing ZFS
failures on, but only those where I could quickly spot that there is
at least one place where the test depends on the output of 'du -b' or
'stat -c %b'.

Reported-by: Fiona Ebner <f.ebner@proxmox.com>
Signed-off-by: Eric Blake <eblake@redhat.com>
Message-ID: <20250523163041.2548675-8-eblake@redhat.com>
Reviewed-by: Fiona Ebner <f.ebner@proxmox.com>
Tested-by: Fiona Ebner <f.ebner@proxmox.com>
---
 tests/qemu-iotests/106                      |  1 +
 tests/qemu-iotests/175                      |  1 +
 tests/qemu-iotests/221                      |  1 +
 tests/qemu-iotests/253                      |  1 +
 tests/qemu-iotests/308                      |  1 +
 tests/qemu-iotests/common.rc                | 30 +++++++++++++++++++++
 tests/qemu-iotests/tests/mirror-sparse      |  1 +
 tests/qemu-iotests/tests/write-zeroes-unmap |  1 +
 8 files changed, 37 insertions(+)

diff --git a/tests/qemu-iotests/106 b/tests/qemu-iotests/106
index ae0fc46691..55548439aa 100755
--- a/tests/qemu-iotests/106
+++ b/tests/qemu-iotests/106
@@ -40,6 +40,7 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 _supported_fmt raw
 _supported_proto file fuse
 _supported_os Linux
+_require_disk_usage
 
 # in kB
 CREATION_SIZE=128
diff --git a/tests/qemu-iotests/175 b/tests/qemu-iotests/175
index f74f053b71..bbbf550a5a 100755
--- a/tests/qemu-iotests/175
+++ b/tests/qemu-iotests/175
@@ -77,6 +77,7 @@ _supported_os Linux
 
 _default_cache_mode none
 _supported_cache_modes none directsync
+_require_disk_usage
 
 size=$((1 * 1024 * 1024))
 
diff --git a/tests/qemu-iotests/221 b/tests/qemu-iotests/221
index c463fd4b11..eba00b80ad 100755
--- a/tests/qemu-iotests/221
+++ b/tests/qemu-iotests/221
@@ -41,6 +41,7 @@ _supported_os Linux
 
 _default_cache_mode writeback
 _supported_cache_modes writeback writethrough unsafe
+_require_disk_usage
 
 echo
 echo "=== Check mapping of unaligned raw image ==="
diff --git a/tests/qemu-iotests/253 b/tests/qemu-iotests/253
index 35039d20a8..6da85e6a11 100755
--- a/tests/qemu-iotests/253
+++ b/tests/qemu-iotests/253
@@ -41,6 +41,7 @@ _supported_os Linux
 
 _default_cache_mode none
 _supported_cache_modes none directsync
+_require_disk_usage
 
 echo
 echo "=== Check mapping of unaligned raw image ==="
diff --git a/tests/qemu-iotests/308 b/tests/qemu-iotests/308
index 437a9014da..6eced3aefb 100755
--- a/tests/qemu-iotests/308
+++ b/tests/qemu-iotests/308
@@ -51,6 +51,7 @@ _unsupported_fmt vpc
 
 _supported_proto file # We create the FUSE export manually
 _supported_os Linux # We need /dev/urandom
+_require_disk_usage
 
 # $1: Export ID
 # $2: Options (beyond the node-name and ID)
diff --git a/tests/qemu-iotests/common.rc b/tests/qemu-iotests/common.rc
index 237f746af8..e977cb4eb6 100644
--- a/tests/qemu-iotests/common.rc
+++ b/tests/qemu-iotests/common.rc
@@ -996,6 +996,36 @@ _require_large_file()
     rm "$FILENAME"
 }
 
+# Check whether disk_usage can be reliably used.
+_require_disk_usage()
+{
+    local unusable=false
+    # ZFS triggers known failures on this front; it does not immediately
+    # allocate files, and then aggressively compresses writes even when full
+    # allocation was requested.
+    if [ -z "$TEST_IMG_FILE" ]; then
+        FILENAME="$TEST_IMG"
+    else
+        FILENAME="$TEST_IMG_FILE"
+    fi
+    if [ -e "FILENAME" ]; then
+        echo "unwilling to overwrite existing file"
+        exit 1
+    fi
+    $QEMU_IMG create -f raw "$FILENAME" 5M > /dev/null
+    if [ $(disk_usage "$FILENAME") -gt $((1024*1024)) ]; then
+        unusable=true
+    fi
+    $QEMU_IMG create -f raw -o preallocation=full "$FILENAME" 5M > /dev/null
+    if [ $(disk_usage "$FILENAME") -lt $((4*1024*1024)) ]; then
+        unusable=true
+    fi
+    rm -f "$FILENAME"
+    if $unusable; then
+        _notrun "file system on $TEST_DIR does not handle sparse files nicely"
+    fi
+}
+
 # Check that a set of devices is available in the QEMU binary
 #
 _require_devices()
diff --git a/tests/qemu-iotests/tests/mirror-sparse b/tests/qemu-iotests/tests/mirror-sparse
index 11418c0871..cfcaa600ab 100755
--- a/tests/qemu-iotests/tests/mirror-sparse
+++ b/tests/qemu-iotests/tests/mirror-sparse
@@ -40,6 +40,7 @@ cd ..
 _supported_fmt qcow2 raw  # Format of the source. dst is always raw file
 _supported_proto file
 _supported_os Linux
+_require_disk_usage
 
 echo
 echo "=== Initial image setup ==="
diff --git a/tests/qemu-iotests/tests/write-zeroes-unmap b/tests/qemu-iotests/tests/write-zeroes-unmap
index 7cfeeaf839..f90fb8e8d2 100755
--- a/tests/qemu-iotests/tests/write-zeroes-unmap
+++ b/tests/qemu-iotests/tests/write-zeroes-unmap
@@ -32,6 +32,7 @@ cd ..
 _supported_fmt raw
 _supported_proto file
 _supported_os Linux
+_require_disk_usage
 
 create_test_image() {
     _make_test_img -f $IMGFMT 1m

From e1c9c801023d556d317256a414562634b1fe8b13 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Wed, 21 May 2025 16:51:12 +0200
Subject: [PATCH 1304/2760] tests/functional/test_sparc64_tuxrun: Explicitly
 set the 'sun4u' machine
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Use self.set_machine() to set the machine instead of relying on the
default machine of the binary. This way the test can be skipped in
case the machine has not been compiled into the QEMU binary.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250521145112.142222-1-thuth@redhat.com>
---
 tests/functional/test_sparc64_tuxrun.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tests/functional/test_sparc64_tuxrun.py b/tests/functional/test_sparc64_tuxrun.py
index 3be08d6102..0d7b43dd74 100755
--- a/tests/functional/test_sparc64_tuxrun.py
+++ b/tests/functional/test_sparc64_tuxrun.py
@@ -24,6 +24,7 @@ class TuxRunSparc64Test(TuxRunBaselineTest):
         '479c3dc104c82b68be55e2c0c5c38cd473d0b37ad4badccde4775bb88ce34611')
 
     def test_sparc64(self):
+        self.set_machine('sun4u')
         self.root='sda'
         self.wait_for_shutdown=False
         self.common_tuxrun(kernel_asset=self.ASSET_SPARC64_KERNEL,

From 644ded5c814055feb4d3a546628ccd28102f7acb Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Thu, 22 May 2025 10:02:08 +0200
Subject: [PATCH 1305/2760] tests/functional/test_mips_malta: Re-enable the
 check for the PCI host bridge
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The problem with the PCI bridge has been fixed in commit e5894fd6f411c1
("hw/pci-host/gt64120: Fix endianness handling"), so we can enable the
corresponding test again.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250522080208.205489-1-thuth@redhat.com>
---
 tests/functional/test_mips_malta.py | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/tests/functional/test_mips_malta.py b/tests/functional/test_mips_malta.py
index 89b9556f30..30279f0ff2 100755
--- a/tests/functional/test_mips_malta.py
+++ b/tests/functional/test_mips_malta.py
@@ -80,10 +80,8 @@ def mips_check_wheezy(test, kernel_path, image_path, kernel_command_line,
     exec_command_and_wait_for_pattern(test, 'cat /proc/devices', 'usb')
     exec_command_and_wait_for_pattern(test, 'cat /proc/ioports',
                                       ' : piix4_smbus')
-    # lspci for the host bridge does not work on big endian targets:
-    # https://gitlab.com/qemu-project/qemu/-/issues/2826
-    # exec_command_and_wait_for_pattern(test, 'lspci -d 11ab:4620',
-    #                                   'GT-64120')
+    exec_command_and_wait_for_pattern(test, 'lspci -d 11ab:4620',
+                                      'GT-64120')
     exec_command_and_wait_for_pattern(test,
                                       'cat /sys/bus/i2c/devices/i2c-0/name',
                                       'SMBus PIIX4 adapter')

From 9f7cf938efc6016f7ce323b064c2f3f46360c751 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Wed, 21 May 2025 16:37:32 +0200
Subject: [PATCH 1306/2760] tests/functional/test_mem_addr_space: Use
 set_machine() to select the machine
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

By using self.set_machine() the tests get properly skipped in case
the machine has not been compiled into the QEMU binary, e.g. when
"configure" has been run with "--without-default-devices".

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250521143732.140711-1-thuth@redhat.com>
---
 tests/functional/test_mem_addr_space.py | 63 +++++++++++++------------
 1 file changed, 32 insertions(+), 31 deletions(-)

diff --git a/tests/functional/test_mem_addr_space.py b/tests/functional/test_mem_addr_space.py
index 2d9d31efb5..61b4a190b4 100755
--- a/tests/functional/test_mem_addr_space.py
+++ b/tests/functional/test_mem_addr_space.py
@@ -58,8 +58,8 @@ class MemAddrCheck(QemuSystemTest):
         should start fine.
         """
         self.ensure_64bit_binary()
-        self.vm.add_args('-S', '-machine', 'q35', '-m',
-                         '512,slots=1,maxmem=59.6G',
+        self.set_machine('q35')
+        self.vm.add_args('-S', '-m', '512,slots=1,maxmem=59.6G',
                          '-cpu', 'pentium,pse36=on', '-display', 'none',
                          '-object', 'memory-backend-ram,id=mem1,size=1G',
                          '-device', 'pc-dimm,id=vm0,memdev=mem1')
@@ -76,8 +76,8 @@ class MemAddrCheck(QemuSystemTest):
         with pse36 above.
         """
         self.ensure_64bit_binary()
-        self.vm.add_args('-S', '-machine', 'q35', '-m',
-                         '512,slots=1,maxmem=59.6G',
+        self.set_machine('q35')
+        self.vm.add_args('-S', '-m', '512,slots=1,maxmem=59.6G',
                          '-cpu', 'pentium,pae=on', '-display', 'none',
                          '-object', 'memory-backend-ram,id=mem1,size=1G',
                          '-device', 'pc-dimm,id=vm0,memdev=mem1')
@@ -93,8 +93,8 @@ class MemAddrCheck(QemuSystemTest):
         same options as the failing case above with pse36 cpu feature.
         """
         self.ensure_64bit_binary()
-        self.vm.add_args('-machine', 'q35', '-m',
-                         '512,slots=1,maxmem=59.5G',
+        self.set_machine('q35')
+        self.vm.add_args('-m', '512,slots=1,maxmem=59.5G',
                          '-cpu', 'pentium,pse36=on', '-display', 'none',
                          '-object', 'memory-backend-ram,id=mem1,size=1G',
                          '-device', 'pc-dimm,id=vm0,memdev=mem1')
@@ -111,8 +111,8 @@ class MemAddrCheck(QemuSystemTest):
         with the same options as the case above.
         """
         self.ensure_64bit_binary()
-        self.vm.add_args('-machine', 'q35', '-m',
-                         '512,slots=1,maxmem=59.5G',
+        self.set_machine('q35')
+        self.vm.add_args('-m', '512,slots=1,maxmem=59.5G',
                          '-cpu', 'pentium,pae=on', '-display', 'none',
                          '-object', 'memory-backend-ram,id=mem1,size=1G',
                          '-device', 'pc-dimm,id=vm0,memdev=mem1')
@@ -128,8 +128,8 @@ class MemAddrCheck(QemuSystemTest):
         with pse36 ON.
         """
         self.ensure_64bit_binary()
-        self.vm.add_args('-machine', 'q35', '-m',
-                         '512,slots=1,maxmem=59.5G',
+        self.set_machine('q35')
+        self.vm.add_args('-m', '512,slots=1,maxmem=59.5G',
                          '-cpu', 'pentium2', '-display', 'none',
                          '-object', 'memory-backend-ram,id=mem1,size=1G',
                          '-device', 'pc-dimm,id=vm0,memdev=mem1')
@@ -148,8 +148,8 @@ class MemAddrCheck(QemuSystemTest):
         above 4 GiB due to the PCI hole and simplicity.
         """
         self.ensure_64bit_binary()
-        self.vm.add_args('-S', '-machine', 'q35', '-m',
-                         '512,slots=1,maxmem=4G',
+        self.set_machine('q35')
+        self.vm.add_args('-S', '-m', '512,slots=1,maxmem=4G',
                          '-cpu', 'pentium', '-display', 'none',
                          '-object', 'memory-backend-ram,id=mem1,size=1G',
                          '-device', 'pc-dimm,id=vm0,memdev=mem1')
@@ -176,8 +176,8 @@ class MemAddrCheck(QemuSystemTest):
         make QEMU fail with the error message.
         """
         self.ensure_64bit_binary()
-        self.vm.add_args('-S', '-machine', 'pc-q35-7.0', '-m',
-                         '512,slots=1,maxmem=988G',
+        self.set_machine('pc-q35-7.0')
+        self.vm.add_args('-S', '-m', '512,slots=1,maxmem=988G',
                          '-display', 'none',
                          '-object', 'memory-backend-ram,id=mem1,size=1G',
                          '-device', 'pc-dimm,id=vm0,memdev=mem1')
@@ -197,8 +197,8 @@ class MemAddrCheck(QemuSystemTest):
         than 988 GiB).
         """
         self.ensure_64bit_binary()
-        self.vm.add_args('-S', '-machine', 'pc-q35-7.1', '-m',
-                         '512,slots=1,maxmem=976G',
+        self.set_machine('pc-q35-7.1')
+        self.vm.add_args('-S', '-m', '512,slots=1,maxmem=976G',
                          '-display', 'none',
                          '-object', 'memory-backend-ram,id=mem1,size=1G',
                          '-device', 'pc-dimm,id=vm0,memdev=mem1')
@@ -214,8 +214,8 @@ class MemAddrCheck(QemuSystemTest):
         successfully start when maxmem is < 988G.
         """
         self.ensure_64bit_binary()
-        self.vm.add_args('-S', '-machine', 'pc-q35-7.0', '-m',
-                         '512,slots=1,maxmem=987.5G',
+        self.set_machine('pc-q35-7.0')
+        self.vm.add_args('-S', '-m', '512,slots=1,maxmem=987.5G',
                          '-display', 'none',
                          '-object', 'memory-backend-ram,id=mem1,size=1G',
                          '-device', 'pc-dimm,id=vm0,memdev=mem1')
@@ -231,8 +231,8 @@ class MemAddrCheck(QemuSystemTest):
         successfully start when maxmem is < 976G.
         """
         self.ensure_64bit_binary()
-        self.vm.add_args('-S', '-machine', 'pc-q35-7.1', '-m',
-                         '512,slots=1,maxmem=975.5G',
+        self.set_machine('pc-q35-7.1')
+        self.vm.add_args('-S', '-m', '512,slots=1,maxmem=975.5G',
                          '-display', 'none',
                          '-object', 'memory-backend-ram,id=mem1,size=1G',
                          '-device', 'pc-dimm,id=vm0,memdev=mem1')
@@ -249,9 +249,9 @@ class MemAddrCheck(QemuSystemTest):
         "above_4G" memory starts at 4G.
         """
         self.ensure_64bit_binary()
+        self.set_machine('pc-q35-7.1')
         self.vm.add_args('-S', '-cpu', 'Skylake-Server',
-                         '-machine', 'pc-q35-7.1', '-m',
-                         '512,slots=1,maxmem=976G',
+                         '-m', '512,slots=1,maxmem=976G',
                          '-display', 'none',
                          '-object', 'memory-backend-ram,id=mem1,size=1G',
                          '-device', 'pc-dimm,id=vm0,memdev=mem1')
@@ -274,9 +274,9 @@ class MemAddrCheck(QemuSystemTest):
         fail to start.
         """
         self.ensure_64bit_binary()
+        self.set_machine('pc-q35-7.1')
         self.vm.add_args('-S', '-cpu', 'EPYC-v4,phys-bits=41',
-                         '-machine', 'pc-q35-7.1', '-m',
-                         '512,slots=1,maxmem=992G',
+                         '-m', '512,slots=1,maxmem=992G',
                          '-display', 'none',
                          '-object', 'memory-backend-ram,id=mem1,size=1G',
                          '-device', 'pc-dimm,id=vm0,memdev=mem1')
@@ -293,9 +293,9 @@ class MemAddrCheck(QemuSystemTest):
         QEMU should start fine.
         """
         self.ensure_64bit_binary()
+        self.set_machine('pc-q35-7.1')
         self.vm.add_args('-S', '-cpu', 'EPYC-v4,phys-bits=41',
-                         '-machine', 'pc-q35-7.1', '-m',
-                         '512,slots=1,maxmem=990G',
+                         '-m', '512,slots=1,maxmem=990G',
                          '-display', 'none',
                          '-object', 'memory-backend-ram,id=mem1,size=1G',
                          '-device', 'pc-dimm,id=vm0,memdev=mem1')
@@ -314,12 +314,12 @@ class MemAddrCheck(QemuSystemTest):
         alignment constraints with 40 bits (1 TiB) of processor physical bits.
         """
         self.ensure_64bit_binary()
+        self.set_machine('q35')
         self.vm.add_args('-S', '-cpu', 'Skylake-Server,phys-bits=40',
-                         '-machine', 'q35,cxl=on', '-m',
-                         '512,slots=1,maxmem=987G',
+                         '-m', '512,slots=1,maxmem=987G',
                          '-display', 'none',
                          '-device', 'pxb-cxl,bus_nr=12,bus=pcie.0,id=cxl.1',
-                         '-M', 'cxl-fmw.0.targets.0=cxl.1,cxl-fmw.0.size=1G')
+                         '-M', 'cxl=on,cxl-fmw.0.targets.0=cxl.1,cxl-fmw.0.size=1G')
         self.vm.set_qmp_monitor(enabled=False)
         self.vm.launch()
         self.vm.wait()
@@ -333,9 +333,10 @@ class MemAddrCheck(QemuSystemTest):
         with cxl enabled.
         """
         self.ensure_64bit_binary()
+        self.set_machine('q35')
         self.vm.add_args('-S', '-cpu', 'Skylake-Server,phys-bits=40',
-                         '-machine', 'q35,cxl=on', '-m',
-                         '512,slots=1,maxmem=987G',
+                         '-machine', 'cxl=on',
+                         '-m', '512,slots=1,maxmem=987G',
                          '-display', 'none',
                          '-device', 'pxb-cxl,bus_nr=12,bus=pcie.0,id=cxl.1')
         self.vm.set_qmp_monitor(enabled=False)

From 141ec228deb7f94fb713c4d7ce0276e088e59f15 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Thu, 15 May 2025 15:20:16 +0200
Subject: [PATCH 1307/2760] hw/microblaze: Add endianness property to the
 petalogix_s3adsp1800 machine
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since the microblaze target can now handle both endianness, big and
little, we should provide a config knob for the user to select the
desired endianness.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250515132019.569365-2-thuth@redhat.com>
---
 hw/microblaze/petalogix_s3adsp1800_mmu.c | 42 +++++++++++++++++++++---
 1 file changed, 37 insertions(+), 5 deletions(-)

diff --git a/hw/microblaze/petalogix_s3adsp1800_mmu.c b/hw/microblaze/petalogix_s3adsp1800_mmu.c
index 032f6f70ea..e8d0ddfdf8 100644
--- a/hw/microblaze/petalogix_s3adsp1800_mmu.c
+++ b/hw/microblaze/petalogix_s3adsp1800_mmu.c
@@ -58,9 +58,20 @@
 #define TYPE_PETALOGIX_S3ADSP1800_MACHINE \
             MACHINE_TYPE_NAME("petalogix-s3adsp1800")
 
+struct S3Adsp1800MachineState {
+    MachineState parent_class;
+
+    EndianMode endianness;
+};
+
+OBJECT_DECLARE_TYPE(S3Adsp1800MachineState, MachineClass,
+                    PETALOGIX_S3ADSP1800_MACHINE)
+
+
 static void
 petalogix_s3adsp1800_init(MachineState *machine)
 {
+    S3Adsp1800MachineState *psms = PETALOGIX_S3ADSP1800_MACHINE(machine);
     ram_addr_t ram_size = machine->ram_size;
     DeviceState *dev;
     MicroBlazeCPU *cpu;
@@ -71,13 +82,12 @@ petalogix_s3adsp1800_init(MachineState *machine)
     MemoryRegion *phys_ram = g_new(MemoryRegion, 1);
     qemu_irq irq[32];
     MemoryRegion *sysmem = get_system_memory();
-    EndianMode endianness = TARGET_BIG_ENDIAN ? ENDIAN_MODE_BIG
-                                              : ENDIAN_MODE_LITTLE;
+    EndianMode endianness = psms->endianness;
 
     cpu = MICROBLAZE_CPU(object_new(TYPE_MICROBLAZE_CPU));
     object_property_set_str(OBJECT(cpu), "version", "7.10.d", &error_abort);
     object_property_set_bool(OBJECT(cpu), "little-endian",
-                             !TARGET_BIG_ENDIAN, &error_abort);
+                             endianness == ENDIAN_MODE_LITTLE, &error_abort);
     qdev_realize(DEVICE(cpu), NULL, &error_abort);
 
     /* Attach emulated BRAM through the LMB.  */
@@ -135,20 +145,41 @@ petalogix_s3adsp1800_init(MachineState *machine)
 
     create_unimplemented_device("xps_gpio", GPIO_BASEADDR, 0x10000);
 
-    microblaze_load_kernel(cpu, !TARGET_BIG_ENDIAN, ddr_base, ram_size,
-                           machine->initrd_filename,
+    microblaze_load_kernel(cpu, endianness == ENDIAN_MODE_LITTLE, ddr_base,
+                           ram_size, machine->initrd_filename,
                            BINARY_DEVICE_TREE_FILE,
                            NULL);
 }
 
+static int machine_get_endianness(Object *obj, Error **errp G_GNUC_UNUSED)
+{
+    S3Adsp1800MachineState *ms = PETALOGIX_S3ADSP1800_MACHINE(obj);
+    return ms->endianness;
+}
+
+static void machine_set_endianness(Object *obj, int endianness, Error **errp)
+{
+    S3Adsp1800MachineState *ms = PETALOGIX_S3ADSP1800_MACHINE(obj);
+    ms->endianness = endianness;
+}
+
 static void petalogix_s3adsp1800_machine_class_init(ObjectClass *oc,
                                                     const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
+    ObjectProperty *prop;
 
     mc->desc = "PetaLogix linux refdesign for xilinx Spartan 3ADSP1800";
     mc->init = petalogix_s3adsp1800_init;
     mc->is_default = true;
+
+    prop = object_class_property_add_enum(oc, "endianness", "EndianMode",
+                                          &EndianMode_lookup,
+                                          machine_get_endianness,
+                                          machine_set_endianness);
+    object_property_set_default_str(prop, TARGET_BIG_ENDIAN ? "big" : "little");
+    object_class_property_set_description(oc, "endianness",
+            "Defines whether the machine runs in big or little endian mode");
 }
 
 static const TypeInfo petalogix_s3adsp1800_machine_types[] = {
@@ -156,6 +187,7 @@ static const TypeInfo petalogix_s3adsp1800_machine_types[] = {
         .name           = TYPE_PETALOGIX_S3ADSP1800_MACHINE,
         .parent         = TYPE_MACHINE,
         .class_init     = petalogix_s3adsp1800_machine_class_init,
+        .instance_size  = sizeof(S3Adsp1800MachineState),
     },
 };
 

From 6c5477558490cf76dc6d521fe906a2bfbc96ee27 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Thu, 15 May 2025 15:20:17 +0200
Subject: [PATCH 1308/2760] tests/functional: Test both microblaze s3adsp1800
 endianness variants
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Now that the endianness of the petalogix-s3adsp1800 can be configured,
we should test that the cross-endianness also works as expected, thus
test the big endian variant on the little endian target and vice versa.
(based on an original idea from Philippe Mathieu-Daudé)

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250515132019.569365-3-thuth@redhat.com>
---
 tests/functional/test_microblaze_s3adsp1800.py | 18 +++++++++++++-----
 .../functional/test_microblazeel_s3adsp1800.py |  6 +++++-
 2 files changed, 18 insertions(+), 6 deletions(-)

diff --git a/tests/functional/test_microblaze_s3adsp1800.py b/tests/functional/test_microblaze_s3adsp1800.py
index c93fa14232..f093b162c0 100755
--- a/tests/functional/test_microblaze_s3adsp1800.py
+++ b/tests/functional/test_microblaze_s3adsp1800.py
@@ -25,12 +25,14 @@ class MicroblazeMachine(QemuSystemTest):
         ('http://www.qemu-advent-calendar.org/2023/download/day13.tar.gz'),
         'b9b3d43c5dd79db88ada495cc6e0d1f591153fe41355e925d791fbf44de50c22')
 
-    def do_ballerina_be_test(self, machine):
-        self.set_machine(machine)
+    def do_ballerina_be_test(self, force_endianness=False):
+        self.set_machine('petalogix-s3adsp1800')
         self.archive_extract(self.ASSET_IMAGE_BE)
         self.vm.set_console()
         self.vm.add_args('-kernel',
                          self.scratch_file('day17', 'ballerina.bin'))
+        if force_endianness:
+            self.vm.add_args('-M', 'endianness=big')
         self.vm.launch()
         wait_for_console_pattern(self, 'This architecture does not have '
                                        'kernel memory protection')
@@ -39,12 +41,14 @@ class MicroblazeMachine(QemuSystemTest):
         # message, that's why we don't test for a later string here. This
         # needs some investigation by a microblaze wizard one day...
 
-    def do_xmaton_le_test(self, machine):
+    def do_xmaton_le_test(self, force_endianness=False):
         self.require_netdev('user')
-        self.set_machine(machine)
+        self.set_machine('petalogix-s3adsp1800')
         self.archive_extract(self.ASSET_IMAGE_LE)
         self.vm.set_console()
         self.vm.add_args('-kernel', self.scratch_file('day13', 'xmaton.bin'))
+        if force_endianness:
+            self.vm.add_args('-M', 'endianness=little')
         tftproot = self.scratch_file('day13')
         self.vm.add_args('-nic', f'user,tftp={tftproot}')
         self.vm.launch()
@@ -59,9 +63,13 @@ class MicroblazeMachine(QemuSystemTest):
 class MicroblazeBigEndianMachine(MicroblazeMachine):
 
     ASSET_IMAGE_BE = MicroblazeMachine.ASSET_IMAGE_BE
+    ASSET_IMAGE_LE = MicroblazeMachine.ASSET_IMAGE_LE
 
     def test_microblaze_s3adsp1800_legacy_be(self):
-        self.do_ballerina_be_test('petalogix-s3adsp1800')
+        self.do_ballerina_be_test()
+
+    def test_microblaze_s3adsp1800_legacy_le(self):
+        self.do_xmaton_le_test(force_endianness=True)
 
 
 if __name__ == '__main__':
diff --git a/tests/functional/test_microblazeel_s3adsp1800.py b/tests/functional/test_microblazeel_s3adsp1800.py
index ab59941d57..915902d48b 100755
--- a/tests/functional/test_microblazeel_s3adsp1800.py
+++ b/tests/functional/test_microblazeel_s3adsp1800.py
@@ -13,9 +13,13 @@ from test_microblaze_s3adsp1800 import MicroblazeMachine
 class MicroblazeLittleEndianMachine(MicroblazeMachine):
 
     ASSET_IMAGE_LE = MicroblazeMachine.ASSET_IMAGE_LE
+    ASSET_IMAGE_BE = MicroblazeMachine.ASSET_IMAGE_BE
 
     def test_microblaze_s3adsp1800_legacy_le(self):
-        self.do_xmaton_le_test('petalogix-s3adsp1800')
+        self.do_xmaton_le_test()
+
+    def test_microblaze_s3adsp1800_legacy_be(self):
+        self.do_ballerina_be_test(force_endianness=True)
 
 
 if __name__ == '__main__':

From 0e259fa5a13a3d0ff65aa4199b1e03832e51e1b2 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Thu, 15 May 2025 15:20:18 +0200
Subject: [PATCH 1309/2760] hw/microblaze: Remove the big-endian variants of
 ml605 and xlnx-zynqmp-pmu
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Both machines were added with little-endian in mind only (the
"endianness" CPU property was hard-wired to "true", see commits
133d23b3ad1 and a88bbb006a52), so the variants that showed up
on the big endian target likely never worked. We deprecated these
non-working machine variants two releases ago, and so far nobody
complained, so it should be fine now to disable them. Hard-wire
the machines to little endian now.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250515132019.569365-4-thuth@redhat.com>
---
 docs/about/deprecated.rst           |  6 ------
 docs/about/removed-features.rst     |  9 +++++++++
 hw/microblaze/petalogix_ml605_mmu.c | 15 ++++-----------
 hw/microblaze/xlnx-zynqmp-pmu.c     |  7 +------
 4 files changed, 14 insertions(+), 23 deletions(-)

diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst
index 4715d1ede5..863779ae78 100644
--- a/docs/about/deprecated.rst
+++ b/docs/about/deprecated.rst
@@ -315,12 +315,6 @@ deprecated; use the new name ``dtb-randomness`` instead. The new name
 better reflects the way this property affects all random data within
 the device tree blob, not just the ``kaslr-seed`` node.
 
-Big-Endian variants of MicroBlaze ``petalogix-ml605`` and ``xlnx-zynqmp-pmu`` machines (since 9.2)
-''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
-
-Both ``petalogix-ml605`` and ``xlnx-zynqmp-pmu`` were added for little endian
-CPUs. Big endian support is not tested.
-
 Mips ``mipssim`` machine (since 10.0)
 '''''''''''''''''''''''''''''''''''''
 
diff --git a/docs/about/removed-features.rst b/docs/about/removed-features.rst
index 4819cb4665..d7c2113fc3 100644
--- a/docs/about/removed-features.rst
+++ b/docs/about/removed-features.rst
@@ -1091,6 +1091,15 @@ This machine was removed because PPC 405 CPU have no known users,
 firmware images are not available, OpenWRT dropped support in 2019,
 U-Boot in 2017, and Linux in 2024.
 
+Big-Endian variants of ``petalogix-ml605`` and ``xlnx-zynqmp-pmu`` machines (removed in 10.1)
+'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
+
+Both the MicroBlaze ``petalogix-ml605`` and ``xlnx-zynqmp-pmu`` machines
+were added for little endian CPUs. Big endian support was never tested
+and likely never worked. Starting with QEMU v10.1, the machines are now
+only available as little-endian machines.
+
+
 linux-user mode CPUs
 --------------------
 
diff --git a/hw/microblaze/petalogix_ml605_mmu.c b/hw/microblaze/petalogix_ml605_mmu.c
index bea6b689fd..6e923c49cf 100644
--- a/hw/microblaze/petalogix_ml605_mmu.c
+++ b/hw/microblaze/petalogix_ml605_mmu.c
@@ -80,8 +80,6 @@ petalogix_ml605_init(MachineState *machine)
     MemoryRegion *phys_lmb_bram = g_new(MemoryRegion, 1);
     MemoryRegion *phys_ram = g_new(MemoryRegion, 1);
     qemu_irq irq[32];
-    EndianMode endianness = TARGET_BIG_ENDIAN ? ENDIAN_MODE_BIG
-                                              : ENDIAN_MODE_LITTLE;
 
     /* init CPUs */
     cpu = MICROBLAZE_CPU(object_new(TYPE_MICROBLAZE_CPU));
@@ -113,7 +111,7 @@ petalogix_ml605_init(MachineState *machine)
 
 
     dev = qdev_new("xlnx.xps-intc");
-    qdev_prop_set_enum(dev, "endianness", endianness);
+    qdev_prop_set_enum(dev, "endianness", ENDIAN_MODE_LITTLE);
     qdev_prop_set_uint32(dev, "kind-of-intr", 1 << TIMER_IRQ);
     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, INTC_BASEADDR);
@@ -129,7 +127,7 @@ petalogix_ml605_init(MachineState *machine)
 
     /* 2 timers at irq 2 @ 100 Mhz.  */
     dev = qdev_new("xlnx.xps-timer");
-    qdev_prop_set_enum(dev, "endianness", endianness);
+    qdev_prop_set_enum(dev, "endianness", ENDIAN_MODE_LITTLE);
     qdev_prop_set_uint32(dev, "one-timer-only", 0);
     qdev_prop_set_uint32(dev, "clock-frequency", 100 * 1000000);
     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
@@ -177,7 +175,7 @@ petalogix_ml605_init(MachineState *machine)
         SSIBus *spi;
 
         dev = qdev_new("xlnx.xps-spi");
-        qdev_prop_set_enum(dev, "endianness", endianness);
+        qdev_prop_set_enum(dev, "endianness", ENDIAN_MODE_LITTLE);
         qdev_prop_set_uint8(dev, "num-ss-bits", NUM_SPI_FLASHES);
         busdev = SYS_BUS_DEVICE(dev);
         sysbus_realize_and_unref(busdev, &error_fatal);
@@ -218,12 +216,7 @@ petalogix_ml605_init(MachineState *machine)
 
 static void petalogix_ml605_machine_init(MachineClass *mc)
 {
-    if (TARGET_BIG_ENDIAN) {
-        mc->desc = "PetaLogix linux refdesign for xilinx ml605 (big endian)";
-        mc->deprecation_reason = "big endian support is not tested";
-    } else {
-        mc->desc = "PetaLogix linux refdesign for xilinx ml605 (little endian)";
-    }
+    mc->desc = "PetaLogix linux refdesign for xilinx ml605 (little endian)";
     mc->init = petalogix_ml605_init;
 }
 
diff --git a/hw/microblaze/xlnx-zynqmp-pmu.c b/hw/microblaze/xlnx-zynqmp-pmu.c
index ed40b5f2e0..e909802bb7 100644
--- a/hw/microblaze/xlnx-zynqmp-pmu.c
+++ b/hw/microblaze/xlnx-zynqmp-pmu.c
@@ -181,12 +181,7 @@ static void xlnx_zynqmp_pmu_init(MachineState *machine)
 
 static void xlnx_zynqmp_pmu_machine_init(MachineClass *mc)
 {
-    if (TARGET_BIG_ENDIAN) {
-        mc->desc = "Xilinx ZynqMP PMU machine (big endian)";
-        mc->deprecation_reason = "big endian support is not tested";
-    } else {
-        mc->desc = "Xilinx ZynqMP PMU machine (little endian)";
-    }
+    mc->desc = "Xilinx ZynqMP PMU machine (little endian)";
     mc->init = xlnx_zynqmp_pmu_init;
 }
 

From 225e9e230efd5ae509b12fd191a8de6287f934ef Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Thu, 15 May 2025 15:20:19 +0200
Subject: [PATCH 1310/2760] docs: Deprecate the qemu-system-microblazeel binary
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The (former big-endian only) binary qemu-system-microblaze can
handle both endiannesses nowadays, so we don't need the separate
qemu-system-microblazeel binary for little endian anymore. Let's
deprecate it to avoid unnecessary compilation and test time in
the future.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250515132019.569365-5-thuth@redhat.com>
---
 docs/about/deprecated.rst | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst
index 863779ae78..42037131de 100644
--- a/docs/about/deprecated.rst
+++ b/docs/about/deprecated.rst
@@ -345,6 +345,19 @@ machine must ensure that they're setting the ``spike`` machine in the
 command line (``-M spike``).
 
 
+System emulator binaries
+------------------------
+
+``qemu-system-microblazeel`` (since 10.1)
+'''''''''''''''''''''''''''''''''''''''''
+
+The ``qemu-system-microblaze`` binary can emulate little-endian machines
+now, too, so the separate binary ``qemu-system-microblazeel`` (with the
+``el`` suffix) for little-endian targets is not required anymore. The
+``petalogix-s3adsp1800`` machine can now be switched to little endian by
+setting its ``endianness`` property to ``little``.
+
+
 Backend options
 ---------------
 

From 07a2adeebbe522b6e1c5706db2bdba0b05d0b2ae Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 12 May 2025 10:39:30 +0200
Subject: [PATCH 1311/2760] hw/i386/pc: Remove deprecated pc-q35-2.4 and
 pc-i440fx-2.4 machines
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

These machines has been supported for a period of more than 6 years.
According to our versioned machine support policy (see commit
ce80c4fa6ff "docs: document special exception for machine type
deprecation & removal") they can now be removed.

Remove the qtest in test-x86-cpuid-compat.c file.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Message-ID: <20250512083948.39294-2-philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 hw/i386/pc_piix.c                   | 13 -------------
 hw/i386/pc_q35.c                    | 13 -------------
 tests/qtest/test-x86-cpuid-compat.c | 14 --------------
 3 files changed, 40 deletions(-)

diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
index 0dce512f18..04213b45b4 100644
--- a/hw/i386/pc_piix.c
+++ b/hw/i386/pc_piix.c
@@ -791,19 +791,6 @@ static void pc_i440fx_machine_2_5_options(MachineClass *m)
 
 DEFINE_I440FX_MACHINE(2, 5);
 
-static void pc_i440fx_machine_2_4_options(MachineClass *m)
-{
-    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
-
-    pc_i440fx_machine_2_5_options(m);
-    m->hw_version = "2.4.0";
-    pcmc->broken_reserved_end = true;
-    compat_props_add(m->compat_props, hw_compat_2_4, hw_compat_2_4_len);
-    compat_props_add(m->compat_props, pc_compat_2_4, pc_compat_2_4_len);
-}
-
-DEFINE_I440FX_MACHINE(2, 4);
-
 #ifdef CONFIG_ISAPC
 static void isapc_machine_options(MachineClass *m)
 {
diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
index c538b3d05b..47e1260241 100644
--- a/hw/i386/pc_q35.c
+++ b/hw/i386/pc_q35.c
@@ -685,16 +685,3 @@ static void pc_q35_machine_2_5_options(MachineClass *m)
 }
 
 DEFINE_Q35_MACHINE(2, 5);
-
-static void pc_q35_machine_2_4_options(MachineClass *m)
-{
-    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
-
-    pc_q35_machine_2_5_options(m);
-    m->hw_version = "2.4.0";
-    pcmc->broken_reserved_end = true;
-    compat_props_add(m->compat_props, hw_compat_2_4, hw_compat_2_4_len);
-    compat_props_add(m->compat_props, pc_compat_2_4, pc_compat_2_4_len);
-}
-
-DEFINE_Q35_MACHINE(2, 4);
diff --git a/tests/qtest/test-x86-cpuid-compat.c b/tests/qtest/test-x86-cpuid-compat.c
index c9de47bb26..456e2af665 100644
--- a/tests/qtest/test-x86-cpuid-compat.c
+++ b/tests/qtest/test-x86-cpuid-compat.c
@@ -365,20 +365,6 @@ int main(int argc, char **argv)
                        "level", 10);
     }
 
-    /*
-     * xlevel doesn't have any feature that triggers auto-level
-     * code on old machine-types.  Just check that the compat code
-     * is working correctly:
-     */
-    if (qtest_has_machine("pc-i440fx-2.4")) {
-        add_cpuid_test("x86/cpuid/xlevel-compat/pc-i440fx-2.4/npt-off",
-                       "SandyBridge", NULL, "pc-i440fx-2.4",
-                       "xlevel", 0x80000008);
-        add_cpuid_test("x86/cpuid/xlevel-compat/pc-i440fx-2.4/npt-on",
-                       "SandyBridge", "svm=on,npt=on", "pc-i440fx-2.4",
-                       "xlevel", 0x80000008);
-    }
-
     /* Test feature parsing */
     add_feature_test("x86/cpuid/features/plus",
                      "486", "+arat",

From 8b1c560937467d0d96c1d0948e99f86ce188c0bc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 12 May 2025 10:39:31 +0200
Subject: [PATCH 1312/2760] hw/i386/pc: Remove
 PCMachineClass::broken_reserved_end field
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The PCMachineClass::broken_reserved_end field was only used
by the pc-q35-2.4 and pc-i440fx-2.4 machines, which got removed.
Remove it and simplify pc_memory_init().

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Message-ID: <20250512083948.39294-3-philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 hw/i386/pc.c         | 13 +++++--------
 include/hw/i386/pc.h |  1 -
 2 files changed, 5 insertions(+), 9 deletions(-)

diff --git a/hw/i386/pc.c b/hw/i386/pc.c
index 70656157ca..c8bb4a3ee4 100644
--- a/hw/i386/pc.c
+++ b/hw/i386/pc.c
@@ -999,14 +999,13 @@ void pc_memory_init(PCMachineState *pcms,
 
     if (machine->device_memory) {
         uint64_t *val = g_malloc(sizeof(*val));
-        uint64_t res_mem_end = machine->device_memory->base;
-
-        if (!pcmc->broken_reserved_end) {
-            res_mem_end += memory_region_size(&machine->device_memory->mr);
-        }
+        uint64_t res_mem_end;
 
         if (pcms->cxl_devices_state.is_enabled) {
             res_mem_end = cxl_resv_end;
+        } else {
+            res_mem_end = machine->device_memory->base
+                          + memory_region_size(&machine->device_memory->mr);
         }
         *val = cpu_to_le64(ROUND_UP(res_mem_end, 1 * GiB));
         fw_cfg_add_file(fw_cfg, "etc/reserved-memory-end", val, sizeof(*val));
@@ -1044,9 +1043,7 @@ uint64_t pc_pci_hole64_start(void)
         hole64_start = pc_get_cxl_range_end(pcms);
     } else if (pcmc->has_reserved_memory && (ms->ram_size < ms->maxram_size)) {
         pc_get_device_memory_range(pcms, &hole64_start, &size);
-        if (!pcmc->broken_reserved_end) {
-            hole64_start += size;
-        }
+        hole64_start += size;
     } else {
         hole64_start = pc_above_4g_end(pcms);
     }
diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
index 9563674e2d..f4a874b17f 100644
--- a/include/hw/i386/pc.h
+++ b/include/hw/i386/pc.h
@@ -107,7 +107,6 @@ struct PCMachineClass {
     /* RAM / address space compat: */
     bool gigabyte_align;
     bool has_reserved_memory;
-    bool broken_reserved_end;
     bool enforce_amd_1tb_hole;
     bool isa_bios_alias;
 

From 4c82e7b34b1bf35d97e026196f5bf10ea916512c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 12 May 2025 10:39:32 +0200
Subject: [PATCH 1313/2760] hw/i386/pc: Remove pc_compat_2_4[] array
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The pc_compat_2_4[] array was only used by the pc-q35-2.4
and pc-i440fx-2.4 machines, which got removed. Remove it.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Message-ID: <20250512083948.39294-4-philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 hw/i386/pc.c         | 19 -------------------
 include/hw/i386/pc.h |  3 ---
 2 files changed, 22 deletions(-)

diff --git a/hw/i386/pc.c b/hw/i386/pc.c
index c8bb4a3ee4..2b46714a5a 100644
--- a/hw/i386/pc.c
+++ b/hw/i386/pc.c
@@ -262,25 +262,6 @@ const size_t pc_compat_2_6_len = G_N_ELEMENTS(pc_compat_2_6);
 GlobalProperty pc_compat_2_5[] = {};
 const size_t pc_compat_2_5_len = G_N_ELEMENTS(pc_compat_2_5);
 
-GlobalProperty pc_compat_2_4[] = {
-    PC_CPU_MODEL_IDS("2.4.0")
-    { "Haswell-" TYPE_X86_CPU, "abm", "off" },
-    { "Haswell-noTSX-" TYPE_X86_CPU, "abm", "off" },
-    { "Broadwell-" TYPE_X86_CPU, "abm", "off" },
-    { "Broadwell-noTSX-" TYPE_X86_CPU, "abm", "off" },
-    { "host" "-" TYPE_X86_CPU, "host-cache-info", "on" },
-    { TYPE_X86_CPU, "check", "off" },
-    { "qemu64" "-" TYPE_X86_CPU, "sse4a", "on" },
-    { "qemu64" "-" TYPE_X86_CPU, "abm", "on" },
-    { "qemu64" "-" TYPE_X86_CPU, "popcnt", "on" },
-    { "qemu32" "-" TYPE_X86_CPU, "popcnt", "on" },
-    { "Opteron_G2" "-" TYPE_X86_CPU, "rdtscp", "on" },
-    { "Opteron_G3" "-" TYPE_X86_CPU, "rdtscp", "on" },
-    { "Opteron_G4" "-" TYPE_X86_CPU, "rdtscp", "on" },
-    { "Opteron_G5" "-" TYPE_X86_CPU, "rdtscp", "on", }
-};
-const size_t pc_compat_2_4_len = G_N_ELEMENTS(pc_compat_2_4);
-
 /*
  * @PC_FW_DATA:
  * Size of the chunk of memory at the top of RAM for the BIOS ACPI tables
diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
index f4a874b17f..b34aa25fdc 100644
--- a/include/hw/i386/pc.h
+++ b/include/hw/i386/pc.h
@@ -301,9 +301,6 @@ extern const size_t pc_compat_2_6_len;
 extern GlobalProperty pc_compat_2_5[];
 extern const size_t pc_compat_2_5_len;
 
-extern GlobalProperty pc_compat_2_4[];
-extern const size_t pc_compat_2_4_len;
-
 #define DEFINE_PC_MACHINE(suffix, namestr, initfn, optsfn) \
     static void pc_machine_##suffix##_class_init(ObjectClass *oc, \
                                                  const void *data) \

From 60ce3f67bea0a782a58cf4f71840e8d20ef8ddfc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 12 May 2025 10:39:34 +0200
Subject: [PATCH 1314/2760] hw/core/machine: Remove hw_compat_2_4[] array
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The hw_compat_2_4[] array was only used by the pc-q35-2.4 and
pc-i440fx-2.4 machines, which got removed. Remove it.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Message-ID: <20250512083948.39294-6-philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 hw/core/machine.c   | 9 ---------
 include/hw/boards.h | 3 ---
 2 files changed, 12 deletions(-)

diff --git a/hw/core/machine.c b/hw/core/machine.c
index c3f3a5020d..15cd2bc3c4 100644
--- a/hw/core/machine.c
+++ b/hw/core/machine.c
@@ -294,15 +294,6 @@ GlobalProperty hw_compat_2_5[] = {
 };
 const size_t hw_compat_2_5_len = G_N_ELEMENTS(hw_compat_2_5);
 
-GlobalProperty hw_compat_2_4[] = {
-    { "e1000", "extra_mac_registers", "off" },
-    { "virtio-pci", "x-disable-pcie", "on" },
-    { "virtio-pci", "migrate-extra", "off" },
-    { "fw_cfg_mem", "dma_enabled", "off" },
-    { "fw_cfg_io", "dma_enabled", "off" }
-};
-const size_t hw_compat_2_4_len = G_N_ELEMENTS(hw_compat_2_4);
-
 MachineState *current_machine;
 
 static char *machine_get_kernel(Object *obj, Error **errp)
diff --git a/include/hw/boards.h b/include/hw/boards.h
index a7b1fcffae..03e7cbeae8 100644
--- a/include/hw/boards.h
+++ b/include/hw/boards.h
@@ -866,7 +866,4 @@ extern const size_t hw_compat_2_6_len;
 extern GlobalProperty hw_compat_2_5[];
 extern const size_t hw_compat_2_5_len;
 
-extern GlobalProperty hw_compat_2_4[];
-extern const size_t hw_compat_2_4_len;
-
 #endif

From 0bf8727696267a79658998d844a96e35e0353602 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 12 May 2025 10:39:35 +0200
Subject: [PATCH 1315/2760] hw/net/e1000: Remove unused E1000_FLAG_MAC flag
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

E1000_FLAG_MAC was only used by the hw_compat_2_4[] array,
via the 'extra_mac_registers=off' property. We removed all
machines using that array, lets remove all the code around
E1000_FLAG_MAC, including the MAC_ACCESS_FLAG_NEEDED enum,
similarly to commit fa4ec9ffda7 ("e1000: remove old
compatibility code").

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Message-ID: <20250512083948.39294-7-philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 hw/net/e1000.c | 93 ++++++++++++++++++++++----------------------------
 1 file changed, 40 insertions(+), 53 deletions(-)

diff --git a/hw/net/e1000.c b/hw/net/e1000.c
index cba4999e6d..a80a7b0cdb 100644
--- a/hw/net/e1000.c
+++ b/hw/net/e1000.c
@@ -127,10 +127,8 @@ struct E1000State_st {
     QEMUTimer *flush_queue_timer;
 
 /* Compatibility flags for migration to/from qemu 1.3.0 and older */
-#define E1000_FLAG_MAC_BIT 2
 #define E1000_FLAG_TSO_BIT 3
 #define E1000_FLAG_VET_BIT 4
-#define E1000_FLAG_MAC (1 << E1000_FLAG_MAC_BIT)
 #define E1000_FLAG_TSO (1 << E1000_FLAG_TSO_BIT)
 #define E1000_FLAG_VET (1 << E1000_FLAG_VET_BIT)
 
@@ -1212,52 +1210,51 @@ enum { NWRITEOPS = ARRAY_SIZE(macreg_writeops) };
 
 enum { MAC_ACCESS_PARTIAL = 1, MAC_ACCESS_FLAG_NEEDED = 2 };
 
-#define markflag(x)    ((E1000_FLAG_##x << 2) | MAC_ACCESS_FLAG_NEEDED)
 /* In the array below the meaning of the bits is: [f|f|f|f|f|f|n|p]
  * f - flag bits (up to 6 possible flags)
  * n - flag needed
- * p - partially implenented */
+ * p - partially implemented */
 static const uint8_t mac_reg_access[0x8000] = {
-    [IPAV]    = markflag(MAC),    [WUC]     = markflag(MAC),
-    [IP6AT]   = markflag(MAC),    [IP4AT]   = markflag(MAC),
-    [FFVT]    = markflag(MAC),    [WUPM]    = markflag(MAC),
-    [ECOL]    = markflag(MAC),    [MCC]     = markflag(MAC),
-    [DC]      = markflag(MAC),    [TNCRS]   = markflag(MAC),
-    [RLEC]    = markflag(MAC),    [XONRXC]  = markflag(MAC),
-    [XOFFTXC] = markflag(MAC),    [RFC]     = markflag(MAC),
-    [TSCTFC]  = markflag(MAC),    [MGTPRC]  = markflag(MAC),
-    [WUS]     = markflag(MAC),    [AIT]     = markflag(MAC),
-    [FFLT]    = markflag(MAC),    [FFMT]    = markflag(MAC),
-    [SCC]     = markflag(MAC),    [FCRUC]   = markflag(MAC),
-    [LATECOL] = markflag(MAC),    [COLC]    = markflag(MAC),
-    [SEQEC]   = markflag(MAC),    [CEXTERR] = markflag(MAC),
-    [XONTXC]  = markflag(MAC),    [XOFFRXC] = markflag(MAC),
-    [RJC]     = markflag(MAC),    [RNBC]    = markflag(MAC),
-    [MGTPDC]  = markflag(MAC),    [MGTPTC]  = markflag(MAC),
-    [RUC]     = markflag(MAC),    [ROC]     = markflag(MAC),
-    [GORCL]   = markflag(MAC),    [GORCH]   = markflag(MAC),
-    [GOTCL]   = markflag(MAC),    [GOTCH]   = markflag(MAC),
-    [BPRC]    = markflag(MAC),    [MPRC]    = markflag(MAC),
-    [TSCTC]   = markflag(MAC),    [PRC64]   = markflag(MAC),
-    [PRC127]  = markflag(MAC),    [PRC255]  = markflag(MAC),
-    [PRC511]  = markflag(MAC),    [PRC1023] = markflag(MAC),
-    [PRC1522] = markflag(MAC),    [PTC64]   = markflag(MAC),
-    [PTC127]  = markflag(MAC),    [PTC255]  = markflag(MAC),
-    [PTC511]  = markflag(MAC),    [PTC1023] = markflag(MAC),
-    [PTC1522] = markflag(MAC),    [MPTC]    = markflag(MAC),
-    [BPTC]    = markflag(MAC),
+    [IPAV]    = MAC_ACCESS_FLAG_NEEDED,    [WUC]     = MAC_ACCESS_FLAG_NEEDED,
+    [IP6AT]   = MAC_ACCESS_FLAG_NEEDED,    [IP4AT]   = MAC_ACCESS_FLAG_NEEDED,
+    [FFVT]    = MAC_ACCESS_FLAG_NEEDED,    [WUPM]    = MAC_ACCESS_FLAG_NEEDED,
+    [ECOL]    = MAC_ACCESS_FLAG_NEEDED,    [MCC]     = MAC_ACCESS_FLAG_NEEDED,
+    [DC]      = MAC_ACCESS_FLAG_NEEDED,    [TNCRS]   = MAC_ACCESS_FLAG_NEEDED,
+    [RLEC]    = MAC_ACCESS_FLAG_NEEDED,    [XONRXC]  = MAC_ACCESS_FLAG_NEEDED,
+    [XOFFTXC] = MAC_ACCESS_FLAG_NEEDED,    [RFC]     = MAC_ACCESS_FLAG_NEEDED,
+    [TSCTFC]  = MAC_ACCESS_FLAG_NEEDED,    [MGTPRC]  = MAC_ACCESS_FLAG_NEEDED,
+    [WUS]     = MAC_ACCESS_FLAG_NEEDED,    [AIT]     = MAC_ACCESS_FLAG_NEEDED,
+    [FFLT]    = MAC_ACCESS_FLAG_NEEDED,    [FFMT]    = MAC_ACCESS_FLAG_NEEDED,
+    [SCC]     = MAC_ACCESS_FLAG_NEEDED,    [FCRUC]   = MAC_ACCESS_FLAG_NEEDED,
+    [LATECOL] = MAC_ACCESS_FLAG_NEEDED,    [COLC]    = MAC_ACCESS_FLAG_NEEDED,
+    [SEQEC]   = MAC_ACCESS_FLAG_NEEDED,    [CEXTERR] = MAC_ACCESS_FLAG_NEEDED,
+    [XONTXC]  = MAC_ACCESS_FLAG_NEEDED,    [XOFFRXC] = MAC_ACCESS_FLAG_NEEDED,
+    [RJC]     = MAC_ACCESS_FLAG_NEEDED,    [RNBC]    = MAC_ACCESS_FLAG_NEEDED,
+    [MGTPDC]  = MAC_ACCESS_FLAG_NEEDED,    [MGTPTC]  = MAC_ACCESS_FLAG_NEEDED,
+    [RUC]     = MAC_ACCESS_FLAG_NEEDED,    [ROC]     = MAC_ACCESS_FLAG_NEEDED,
+    [GORCL]   = MAC_ACCESS_FLAG_NEEDED,    [GORCH]   = MAC_ACCESS_FLAG_NEEDED,
+    [GOTCL]   = MAC_ACCESS_FLAG_NEEDED,    [GOTCH]   = MAC_ACCESS_FLAG_NEEDED,
+    [BPRC]    = MAC_ACCESS_FLAG_NEEDED,    [MPRC]    = MAC_ACCESS_FLAG_NEEDED,
+    [TSCTC]   = MAC_ACCESS_FLAG_NEEDED,    [PRC64]   = MAC_ACCESS_FLAG_NEEDED,
+    [PRC127]  = MAC_ACCESS_FLAG_NEEDED,    [PRC255]  = MAC_ACCESS_FLAG_NEEDED,
+    [PRC511]  = MAC_ACCESS_FLAG_NEEDED,    [PRC1023] = MAC_ACCESS_FLAG_NEEDED,
+    [PRC1522] = MAC_ACCESS_FLAG_NEEDED,    [PTC64]   = MAC_ACCESS_FLAG_NEEDED,
+    [PTC127]  = MAC_ACCESS_FLAG_NEEDED,    [PTC255]  = MAC_ACCESS_FLAG_NEEDED,
+    [PTC511]  = MAC_ACCESS_FLAG_NEEDED,    [PTC1023] = MAC_ACCESS_FLAG_NEEDED,
+    [PTC1522] = MAC_ACCESS_FLAG_NEEDED,    [MPTC]    = MAC_ACCESS_FLAG_NEEDED,
+    [BPTC]    = MAC_ACCESS_FLAG_NEEDED,
 
-    [TDFH]  = markflag(MAC) | MAC_ACCESS_PARTIAL,
-    [TDFT]  = markflag(MAC) | MAC_ACCESS_PARTIAL,
-    [TDFHS] = markflag(MAC) | MAC_ACCESS_PARTIAL,
-    [TDFTS] = markflag(MAC) | MAC_ACCESS_PARTIAL,
-    [TDFPC] = markflag(MAC) | MAC_ACCESS_PARTIAL,
-    [RDFH]  = markflag(MAC) | MAC_ACCESS_PARTIAL,
-    [RDFT]  = markflag(MAC) | MAC_ACCESS_PARTIAL,
-    [RDFHS] = markflag(MAC) | MAC_ACCESS_PARTIAL,
-    [RDFTS] = markflag(MAC) | MAC_ACCESS_PARTIAL,
-    [RDFPC] = markflag(MAC) | MAC_ACCESS_PARTIAL,
-    [PBM]   = markflag(MAC) | MAC_ACCESS_PARTIAL,
+    [TDFH]    = MAC_ACCESS_FLAG_NEEDED | MAC_ACCESS_PARTIAL,
+    [TDFT]    = MAC_ACCESS_FLAG_NEEDED | MAC_ACCESS_PARTIAL,
+    [TDFHS]   = MAC_ACCESS_FLAG_NEEDED | MAC_ACCESS_PARTIAL,
+    [TDFTS]   = MAC_ACCESS_FLAG_NEEDED | MAC_ACCESS_PARTIAL,
+    [TDFPC]   = MAC_ACCESS_FLAG_NEEDED | MAC_ACCESS_PARTIAL,
+    [RDFH]    = MAC_ACCESS_FLAG_NEEDED | MAC_ACCESS_PARTIAL,
+    [RDFT]    = MAC_ACCESS_FLAG_NEEDED | MAC_ACCESS_PARTIAL,
+    [RDFHS]   = MAC_ACCESS_FLAG_NEEDED | MAC_ACCESS_PARTIAL,
+    [RDFTS]   = MAC_ACCESS_FLAG_NEEDED | MAC_ACCESS_PARTIAL,
+    [RDFPC]   = MAC_ACCESS_FLAG_NEEDED | MAC_ACCESS_PARTIAL,
+    [PBM]     = MAC_ACCESS_FLAG_NEEDED | MAC_ACCESS_PARTIAL,
 };
 
 static void
@@ -1419,13 +1416,6 @@ static int e1000_tx_tso_post_load(void *opaque, int version_id)
     return 0;
 }
 
-static bool e1000_full_mac_needed(void *opaque)
-{
-    E1000State *s = opaque;
-
-    return chkflag(MAC);
-}
-
 static bool e1000_tso_state_needed(void *opaque)
 {
     E1000State *s = opaque;
@@ -1451,7 +1441,6 @@ static const VMStateDescription vmstate_e1000_full_mac_state = {
     .name = "e1000/full_mac_state",
     .version_id = 1,
     .minimum_version_id = 1,
-    .needed = e1000_full_mac_needed,
     .fields = (const VMStateField[]) {
         VMSTATE_UINT32_ARRAY(mac_reg, E1000State, 0x8000),
         VMSTATE_END_OF_LIST()
@@ -1679,8 +1668,6 @@ static void pci_e1000_realize(PCIDevice *pci_dev, Error **errp)
 
 static const Property e1000_properties[] = {
     DEFINE_NIC_PROPERTIES(E1000State, conf),
-    DEFINE_PROP_BIT("extra_mac_registers", E1000State,
-                    compat_flags, E1000_FLAG_MAC_BIT, true),
     DEFINE_PROP_BIT("migrate_tso_props", E1000State,
                     compat_flags, E1000_FLAG_TSO_BIT, true),
     DEFINE_PROP_BIT("init-vet", E1000State,

From fce42ccb51f115156d41eb3c8bd04bddf4a0ca8b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 12 May 2025 10:39:36 +0200
Subject: [PATCH 1316/2760] hw/virtio/virtio-pci: Remove
 VIRTIO_PCI_FLAG_MIGRATE_EXTRA definition
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

VIRTIO_PCI_FLAG_MIGRATE_EXTRA was only used by the
hw_compat_2_4[] array, via the 'migrate-extra=true'
property. We removed all machines using that array,
lets remove all the code around VIRTIO_PCI_FLAG_MIGRATE_EXTRA.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Message-ID: <20250512083948.39294-8-philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 hw/virtio/virtio-pci.c         | 6 +-----
 include/hw/virtio/virtio-pci.h | 4 ----
 2 files changed, 1 insertion(+), 9 deletions(-)

diff --git a/hw/virtio/virtio-pci.c b/hw/virtio/virtio-pci.c
index 9b48aa8c3e..f52fac663c 100644
--- a/hw/virtio/virtio-pci.c
+++ b/hw/virtio/virtio-pci.c
@@ -146,9 +146,7 @@ static const VMStateDescription vmstate_virtio_pci = {
 
 static bool virtio_pci_has_extra_state(DeviceState *d)
 {
-    VirtIOPCIProxy *proxy = to_virtio_pci_proxy(d);
-
-    return proxy->flags & VIRTIO_PCI_FLAG_MIGRATE_EXTRA;
+    return true;
 }
 
 static void virtio_pci_save_extra_state(DeviceState *d, QEMUFile *f)
@@ -2363,8 +2361,6 @@ static void virtio_pci_bus_reset_hold(Object *obj, ResetType type)
 static const Property virtio_pci_properties[] = {
     DEFINE_PROP_BIT("virtio-pci-bus-master-bug-migration", VirtIOPCIProxy, flags,
                     VIRTIO_PCI_FLAG_BUS_MASTER_BUG_MIGRATION_BIT, false),
-    DEFINE_PROP_BIT("migrate-extra", VirtIOPCIProxy, flags,
-                    VIRTIO_PCI_FLAG_MIGRATE_EXTRA_BIT, true),
     DEFINE_PROP_BIT("modern-pio-notify", VirtIOPCIProxy, flags,
                     VIRTIO_PCI_FLAG_MODERN_PIO_NOTIFY_BIT, false),
     DEFINE_PROP_BIT("x-disable-pcie", VirtIOPCIProxy, flags,
diff --git a/include/hw/virtio/virtio-pci.h b/include/hw/virtio/virtio-pci.h
index 1dbc3851b0..eb22ed0a1d 100644
--- a/include/hw/virtio/virtio-pci.h
+++ b/include/hw/virtio/virtio-pci.h
@@ -32,7 +32,6 @@ DECLARE_OBJ_CHECKERS(VirtioPCIBusState, VirtioPCIBusClass,
 enum {
     VIRTIO_PCI_FLAG_BUS_MASTER_BUG_MIGRATION_BIT,
     VIRTIO_PCI_FLAG_USE_IOEVENTFD_BIT,
-    VIRTIO_PCI_FLAG_MIGRATE_EXTRA_BIT,
     VIRTIO_PCI_FLAG_MODERN_PIO_NOTIFY_BIT,
     VIRTIO_PCI_FLAG_DISABLE_PCIE_BIT,
     VIRTIO_PCI_FLAG_PAGE_PER_VQ_BIT,
@@ -57,9 +56,6 @@ enum {
 /* virtio version flags */
 #define VIRTIO_PCI_FLAG_DISABLE_PCIE (1 << VIRTIO_PCI_FLAG_DISABLE_PCIE_BIT)
 
-/* migrate extra state */
-#define VIRTIO_PCI_FLAG_MIGRATE_EXTRA (1 << VIRTIO_PCI_FLAG_MIGRATE_EXTRA_BIT)
-
 /* have pio notification for modern device ? */
 #define VIRTIO_PCI_FLAG_MODERN_PIO_NOTIFY \
     (1 << VIRTIO_PCI_FLAG_MODERN_PIO_NOTIFY_BIT)

From 47d9e81f0ab44b59e99f4e87fe5409851e670de6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 12 May 2025 10:39:37 +0200
Subject: [PATCH 1317/2760] hw/virtio/virtio-pci: Remove
 VIRTIO_PCI_FLAG_DISABLE_PCIE definition
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

VIRTIO_PCI_FLAG_DISABLE_PCIE was only used by the hw_compat_2_4[]
array, via the 'x-disable-pcie=false' property. We removed all
machines using that array, lets remove all the code around
VIRTIO_PCI_FLAG_DISABLE_PCIE (see commit 9a4c0e220d8 for similar
VIRTIO_PCI_FLAG_* enum removal).

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Message-ID: <20250512083948.39294-9-philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 hw/virtio/virtio-pci.c         | 5 +----
 include/hw/virtio/virtio-pci.h | 4 ----
 2 files changed, 1 insertion(+), 8 deletions(-)

diff --git a/hw/virtio/virtio-pci.c b/hw/virtio/virtio-pci.c
index f52fac663c..e62ae1e5e0 100644
--- a/hw/virtio/virtio-pci.c
+++ b/hw/virtio/virtio-pci.c
@@ -2363,8 +2363,6 @@ static const Property virtio_pci_properties[] = {
                     VIRTIO_PCI_FLAG_BUS_MASTER_BUG_MIGRATION_BIT, false),
     DEFINE_PROP_BIT("modern-pio-notify", VirtIOPCIProxy, flags,
                     VIRTIO_PCI_FLAG_MODERN_PIO_NOTIFY_BIT, false),
-    DEFINE_PROP_BIT("x-disable-pcie", VirtIOPCIProxy, flags,
-                    VIRTIO_PCI_FLAG_DISABLE_PCIE_BIT, false),
     DEFINE_PROP_BIT("page-per-vq", VirtIOPCIProxy, flags,
                     VIRTIO_PCI_FLAG_PAGE_PER_VQ_BIT, false),
     DEFINE_PROP_BOOL("x-ignore-backend-features", VirtIOPCIProxy,
@@ -2393,8 +2391,7 @@ static void virtio_pci_dc_realize(DeviceState *qdev, Error **errp)
     VirtIOPCIProxy *proxy = VIRTIO_PCI(qdev);
     PCIDevice *pci_dev = &proxy->pci_dev;
 
-    if (!(proxy->flags & VIRTIO_PCI_FLAG_DISABLE_PCIE) &&
-        virtio_pci_modern(proxy)) {
+    if (virtio_pci_modern(proxy)) {
         pci_dev->cap_present |= QEMU_PCI_CAP_EXPRESS;
     }
 
diff --git a/include/hw/virtio/virtio-pci.h b/include/hw/virtio/virtio-pci.h
index eb22ed0a1d..eab5394898 100644
--- a/include/hw/virtio/virtio-pci.h
+++ b/include/hw/virtio/virtio-pci.h
@@ -33,7 +33,6 @@ enum {
     VIRTIO_PCI_FLAG_BUS_MASTER_BUG_MIGRATION_BIT,
     VIRTIO_PCI_FLAG_USE_IOEVENTFD_BIT,
     VIRTIO_PCI_FLAG_MODERN_PIO_NOTIFY_BIT,
-    VIRTIO_PCI_FLAG_DISABLE_PCIE_BIT,
     VIRTIO_PCI_FLAG_PAGE_PER_VQ_BIT,
     VIRTIO_PCI_FLAG_ATS_BIT,
     VIRTIO_PCI_FLAG_INIT_DEVERR_BIT,
@@ -53,9 +52,6 @@ enum {
  * vcpu thread using ioeventfd for some devices. */
 #define VIRTIO_PCI_FLAG_USE_IOEVENTFD   (1 << VIRTIO_PCI_FLAG_USE_IOEVENTFD_BIT)
 
-/* virtio version flags */
-#define VIRTIO_PCI_FLAG_DISABLE_PCIE (1 << VIRTIO_PCI_FLAG_DISABLE_PCIE_BIT)
-
 /* have pio notification for modern device ? */
 #define VIRTIO_PCI_FLAG_MODERN_PIO_NOTIFY \
     (1 << VIRTIO_PCI_FLAG_MODERN_PIO_NOTIFY_BIT)

From ff63280a81144500726f1899b0ae374e692e1f39 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 12 May 2025 10:39:38 +0200
Subject: [PATCH 1318/2760] hw/i386/pc: Remove deprecated pc-q35-2.5 and
 pc-i440fx-2.5 machines
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

These machines has been supported for a period of more than 6 years.
According to our versioned machine support policy (see commit
ce80c4fa6ff "docs: document special exception for machine type
deprecation & removal") they can now be removed.

Remove the now unused empty pc_compat_2_5[] array.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Message-ID: <20250512083948.39294-10-philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 hw/i386/pc.c         |  3 ---
 hw/i386/pc_piix.c    | 13 -------------
 hw/i386/pc_q35.c     | 13 -------------
 include/hw/i386/pc.h |  3 ---
 4 files changed, 32 deletions(-)

diff --git a/hw/i386/pc.c b/hw/i386/pc.c
index 2b46714a5a..cb375aabdc 100644
--- a/hw/i386/pc.c
+++ b/hw/i386/pc.c
@@ -259,9 +259,6 @@ GlobalProperty pc_compat_2_6[] = {
 };
 const size_t pc_compat_2_6_len = G_N_ELEMENTS(pc_compat_2_6);
 
-GlobalProperty pc_compat_2_5[] = {};
-const size_t pc_compat_2_5_len = G_N_ELEMENTS(pc_compat_2_5);
-
 /*
  * @PC_FW_DATA:
  * Size of the chunk of memory at the top of RAM for the BIOS ACPI tables
diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
index 04213b45b4..7a62bb0650 100644
--- a/hw/i386/pc_piix.c
+++ b/hw/i386/pc_piix.c
@@ -778,19 +778,6 @@ static void pc_i440fx_machine_2_6_options(MachineClass *m)
 
 DEFINE_I440FX_MACHINE(2, 6);
 
-static void pc_i440fx_machine_2_5_options(MachineClass *m)
-{
-    X86MachineClass *x86mc = X86_MACHINE_CLASS(m);
-
-    pc_i440fx_machine_2_6_options(m);
-    x86mc->save_tsc_khz = false;
-    m->legacy_fw_cfg_order = 1;
-    compat_props_add(m->compat_props, hw_compat_2_5, hw_compat_2_5_len);
-    compat_props_add(m->compat_props, pc_compat_2_5, pc_compat_2_5_len);
-}
-
-DEFINE_I440FX_MACHINE(2, 5);
-
 #ifdef CONFIG_ISAPC
 static void isapc_machine_options(MachineClass *m)
 {
diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
index 47e1260241..33211b1876 100644
--- a/hw/i386/pc_q35.c
+++ b/hw/i386/pc_q35.c
@@ -672,16 +672,3 @@ static void pc_q35_machine_2_6_options(MachineClass *m)
 }
 
 DEFINE_Q35_MACHINE(2, 6);
-
-static void pc_q35_machine_2_5_options(MachineClass *m)
-{
-    X86MachineClass *x86mc = X86_MACHINE_CLASS(m);
-
-    pc_q35_machine_2_6_options(m);
-    x86mc->save_tsc_khz = false;
-    m->legacy_fw_cfg_order = 1;
-    compat_props_add(m->compat_props, hw_compat_2_5, hw_compat_2_5_len);
-    compat_props_add(m->compat_props, pc_compat_2_5, pc_compat_2_5_len);
-}
-
-DEFINE_Q35_MACHINE(2, 5);
diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
index b34aa25fdc..79b72c54dd 100644
--- a/include/hw/i386/pc.h
+++ b/include/hw/i386/pc.h
@@ -298,9 +298,6 @@ extern const size_t pc_compat_2_7_len;
 extern GlobalProperty pc_compat_2_6[];
 extern const size_t pc_compat_2_6_len;
 
-extern GlobalProperty pc_compat_2_5[];
-extern const size_t pc_compat_2_5_len;
-
 #define DEFINE_PC_MACHINE(suffix, namestr, initfn, optsfn) \
     static void pc_machine_##suffix##_class_init(ObjectClass *oc, \
                                                  const void *data) \

From 42cbccfcb0635257721aa6a0e55cb80e85756ecf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 12 May 2025 10:39:39 +0200
Subject: [PATCH 1319/2760] hw/i386/x86: Remove X86MachineClass::save_tsc_khz
 field
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The X86MachineClass::save_tsc_khz boolean was only used
by the pc-q35-2.5 and pc-i440fx-2.5 machines, which got
removed. Remove it and simplify tsc_khz_needed().

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Message-ID: <20250512083948.39294-11-philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 hw/i386/x86.c         | 1 -
 include/hw/i386/x86.h | 5 -----
 target/i386/machine.c | 5 ++---
 3 files changed, 2 insertions(+), 9 deletions(-)

diff --git a/hw/i386/x86.c b/hw/i386/x86.c
index e2d0409299..f80533df1c 100644
--- a/hw/i386/x86.c
+++ b/hw/i386/x86.c
@@ -382,7 +382,6 @@ static void x86_machine_class_init(ObjectClass *oc, const void *data)
     mc->get_default_cpu_node_id = x86_get_default_cpu_node_id;
     mc->possible_cpu_arch_ids = x86_possible_cpu_arch_ids;
     mc->kvm_type = x86_kvm_type;
-    x86mc->save_tsc_khz = true;
     x86mc->fwcfg_dma_enabled = true;
     nc->nmi_monitor_handler = x86_nmi;
 
diff --git a/include/hw/i386/x86.h b/include/hw/i386/x86.h
index 258b1343a1..fc460b82f8 100644
--- a/include/hw/i386/x86.h
+++ b/include/hw/i386/x86.h
@@ -27,13 +27,8 @@
 #include "qom/object.h"
 
 struct X86MachineClass {
-    /*< private >*/
     MachineClass parent;
 
-    /*< public >*/
-
-    /* TSC rate migration: */
-    bool save_tsc_khz;
     /* use DMA capable linuxboot option rom */
     bool fwcfg_dma_enabled;
     /* CPU and apic information: */
diff --git a/target/i386/machine.c b/target/i386/machine.c
index 6cb561c632..dd2dac1d44 100644
--- a/target/i386/machine.c
+++ b/target/i386/machine.c
@@ -1060,9 +1060,8 @@ static bool tsc_khz_needed(void *opaque)
 {
     X86CPU *cpu = opaque;
     CPUX86State *env = &cpu->env;
-    MachineClass *mc = MACHINE_GET_CLASS(qdev_get_machine());
-    X86MachineClass *x86mc = X86_MACHINE_CLASS(mc);
-    return env->tsc_khz && x86mc->save_tsc_khz;
+
+    return env->tsc_khz;
 }
 
 static const VMStateDescription vmstate_tsc_khz = {

From 6160ce208419e6e218db644433528aaa5d4f5024 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 12 May 2025 10:39:40 +0200
Subject: [PATCH 1320/2760] hw/nvram/fw_cfg: Remove legacy
 FW_CFG_ORDER_OVERRIDE
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The MachineClass::legacy_fw_cfg_order boolean was only used
by the pc-q35-2.5 and pc-i440fx-2.5 machines, which got
removed. Remove it along with:

- FW_CFG_ORDER_OVERRIDE_* definitions
- fw_cfg_set_order_override()
- fw_cfg_reset_order_override()
- fw_cfg_order[]
- rom_set_order_override()
- rom_reset_order_override()

Simplify CLI and pc_vga_init() / pc_nic_init().

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Message-ID: <20250512083948.39294-12-philmd@linaro.org>
[thuth: Fix error from check_patch.pl wrt to an empty "for" loop]
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 hw/core/loader.c          |  14 -----
 hw/i386/pc.c              |   7 +--
 hw/nvram/fw_cfg.c         | 110 +++-----------------------------------
 include/hw/boards.h       |   3 +-
 include/hw/loader.h       |   2 -
 include/hw/nvram/fw_cfg.h |  10 ----
 system/vl.c               |   5 --
 7 files changed, 10 insertions(+), 141 deletions(-)

diff --git a/hw/core/loader.c b/hw/core/loader.c
index b792a54bb0..e7056ba4bd 100644
--- a/hw/core/loader.c
+++ b/hw/core/loader.c
@@ -1333,20 +1333,6 @@ void rom_set_fw(FWCfgState *f)
     fw_cfg = f;
 }
 
-void rom_set_order_override(int order)
-{
-    if (!fw_cfg)
-        return;
-    fw_cfg_set_order_override(fw_cfg, order);
-}
-
-void rom_reset_order_override(void)
-{
-    if (!fw_cfg)
-        return;
-    fw_cfg_reset_order_override(fw_cfg);
-}
-
 void rom_transaction_begin(void)
 {
     Rom *rom;
diff --git a/hw/i386/pc.c b/hw/i386/pc.c
index cb375aabdc..49632b69d2 100644
--- a/hw/i386/pc.c
+++ b/hw/i386/pc.c
@@ -1033,7 +1033,6 @@ DeviceState *pc_vga_init(ISABus *isa_bus, PCIBus *pci_bus)
 {
     DeviceState *dev = NULL;
 
-    rom_set_order_override(FW_CFG_ORDER_OVERRIDE_VGA);
     if (pci_bus) {
         PCIDevice *pcidev = pci_vga_init(pci_bus);
         dev = pcidev ? &pcidev->qdev : NULL;
@@ -1041,7 +1040,7 @@ DeviceState *pc_vga_init(ISABus *isa_bus, PCIBus *pci_bus)
         ISADevice *isadev = isa_vga_init(isa_bus);
         dev = isadev ? DEVICE(isadev) : NULL;
     }
-    rom_reset_order_override();
+
     return dev;
 }
 
@@ -1231,8 +1230,6 @@ void pc_nic_init(PCMachineClass *pcmc, ISABus *isa_bus, PCIBus *pci_bus)
     bool default_is_ne2k = g_str_equal(mc->default_nic, TYPE_ISA_NE2000);
     NICInfo *nd;
 
-    rom_set_order_override(FW_CFG_ORDER_OVERRIDE_NIC);
-
     while ((nd = qemu_find_nic_info(TYPE_ISA_NE2000, default_is_ne2k, NULL))) {
         pc_init_ne2k_isa(isa_bus, nd, &error_fatal);
     }
@@ -1241,8 +1238,6 @@ void pc_nic_init(PCMachineClass *pcmc, ISABus *isa_bus, PCIBus *pci_bus)
     if (pci_bus) {
         pci_init_nic_devices(pci_bus, mc->default_nic);
     }
-
-    rom_reset_order_override();
 }
 
 void pc_i8259_create(ISABus *isa_bus, qemu_irq *i8259_irqs)
diff --git a/hw/nvram/fw_cfg.c b/hw/nvram/fw_cfg.c
index 237b9f7d1f..aa24050493 100644
--- a/hw/nvram/fw_cfg.c
+++ b/hw/nvram/fw_cfg.c
@@ -817,62 +817,6 @@ void fw_cfg_modify_i64(FWCfgState *s, uint16_t key, uint64_t value)
     g_free(old);
 }
 
-void fw_cfg_set_order_override(FWCfgState *s, int order)
-{
-    assert(s->fw_cfg_order_override == 0);
-    s->fw_cfg_order_override = order;
-}
-
-void fw_cfg_reset_order_override(FWCfgState *s)
-{
-    assert(s->fw_cfg_order_override != 0);
-    s->fw_cfg_order_override = 0;
-}
-
-/*
- * This is the legacy order list.  For legacy systems, files are in
- * the fw_cfg in the order defined below, by the "order" value.  Note
- * that some entries (VGA ROMs, NIC option ROMS, etc.) go into a
- * specific area, but there may be more than one and they occur in the
- * order that the user specifies them on the command line.  Those are
- * handled in a special manner, using the order override above.
- *
- * For non-legacy, the files are sorted by filename to avoid this kind
- * of complexity in the future.
- *
- * This is only for x86, other arches don't implement versioning so
- * they won't set legacy mode.
- */
-static struct {
-    const char *name;
-    int order;
-} fw_cfg_order[] = {
-    { "etc/boot-menu-wait", 10 },
-    { "bootsplash.jpg", 11 },
-    { "bootsplash.bmp", 12 },
-    { "etc/boot-fail-wait", 15 },
-    { "etc/smbios/smbios-tables", 20 },
-    { "etc/smbios/smbios-anchor", 30 },
-    { "etc/e820", 40 },
-    { "etc/reserved-memory-end", 50 },
-    { "genroms/kvmvapic.bin", 55 },
-    { "genroms/linuxboot.bin", 60 },
-    { }, /* VGA ROMs from pc_vga_init come here, 70. */
-    { }, /* NIC option ROMs from pc_nic_init come here, 80. */
-    { "etc/system-states", 90 },
-    { }, /* User ROMs come here, 100. */
-    { }, /* Device FW comes here, 110. */
-    { "etc/extra-pci-roots", 120 },
-    { "etc/acpi/tables", 130 },
-    { "etc/table-loader", 140 },
-    { "etc/tpm/log", 150 },
-    { "etc/acpi/rsdp", 160 },
-    { "bootorder", 170 },
-    { "etc/msr_feature_control", 180 },
-
-#define FW_CFG_ORDER_OVERRIDE_LAST 200
-};
-
 /*
  * Any sub-page size update to these table MRs will be lost during migration,
  * as we use aligned size in ram_load_precopy() -> qemu_ram_resize() path.
@@ -890,29 +834,6 @@ static void fw_cfg_acpi_mr_save(FWCfgState *s, const char *filename, size_t len)
     }
 }
 
-static int get_fw_cfg_order(FWCfgState *s, const char *name)
-{
-    int i;
-
-    if (s->fw_cfg_order_override > 0) {
-        return s->fw_cfg_order_override;
-    }
-
-    for (i = 0; i < ARRAY_SIZE(fw_cfg_order); i++) {
-        if (fw_cfg_order[i].name == NULL) {
-            continue;
-        }
-
-        if (strcmp(name, fw_cfg_order[i].name) == 0) {
-            return fw_cfg_order[i].order;
-        }
-    }
-
-    /* Stick unknown stuff at the end. */
-    warn_report("Unknown firmware file in legacy mode: %s", name);
-    return FW_CFG_ORDER_OVERRIDE_LAST;
-}
-
 void fw_cfg_add_file_callback(FWCfgState *s,  const char *filename,
                               FWCfgCallback select_cb,
                               FWCfgWriteCallback write_cb,
@@ -921,7 +842,6 @@ void fw_cfg_add_file_callback(FWCfgState *s,  const char *filename,
 {
     int i, index, count;
     size_t dsize;
-    MachineClass *mc = MACHINE_GET_CLASS(qdev_get_machine());
     int order = 0;
 
     if (!s->files) {
@@ -933,22 +853,11 @@ void fw_cfg_add_file_callback(FWCfgState *s,  const char *filename,
     count = be32_to_cpu(s->files->count);
     assert(count < fw_cfg_file_slots(s));
 
-    /* Find the insertion point. */
-    if (mc->legacy_fw_cfg_order) {
-        /*
-         * Sort by order. For files with the same order, we keep them
-         * in the sequence in which they were added.
-         */
-        order = get_fw_cfg_order(s, filename);
-        for (index = count;
-             index > 0 && order < s->entry_order[index - 1];
-             index--);
-    } else {
-        /* Sort by file name. */
-        for (index = count;
-             index > 0 && strcmp(filename, s->files->f[index - 1].name) < 0;
-             index--);
-    }
+    /* Find the insertion point, sorting by file name. */
+    for (index = count;
+         index > 0 && strcmp(filename, s->files->f[index - 1].name) < 0;
+         index--)
+        ;
 
     /*
      * Move all the entries from the index point and after down one
@@ -1058,7 +967,6 @@ bool fw_cfg_add_file_from_generator(FWCfgState *s,
 
 static void fw_cfg_machine_reset(void *opaque)
 {
-    MachineClass *mc = MACHINE_GET_CLASS(qdev_get_machine());
     FWCfgState *s = opaque;
     void *ptr;
     size_t len;
@@ -1068,11 +976,9 @@ static void fw_cfg_machine_reset(void *opaque)
     ptr = fw_cfg_modify_file(s, "bootorder", (uint8_t *)buf, len);
     g_free(ptr);
 
-    if (!mc->legacy_fw_cfg_order) {
-        buf = get_boot_devices_lchs_list(&len);
-        ptr = fw_cfg_modify_file(s, "bios-geometry", (uint8_t *)buf, len);
-        g_free(ptr);
-    }
+    buf = get_boot_devices_lchs_list(&len);
+    ptr = fw_cfg_modify_file(s, "bios-geometry", (uint8_t *)buf, len);
+    g_free(ptr);
 }
 
 static void fw_cfg_machine_ready(struct Notifier *n, void *data)
diff --git a/include/hw/boards.h b/include/hw/boards.h
index 03e7cbeae8..ab900dacab 100644
--- a/include/hw/boards.h
+++ b/include/hw/boards.h
@@ -286,8 +286,7 @@ struct MachineClass {
         no_parallel:1,
         no_floppy:1,
         no_cdrom:1,
-        pci_allow_0_address:1,
-        legacy_fw_cfg_order:1;
+        pci_allow_0_address:1;
     bool auto_create_sdcard;
     bool is_default;
     const char *default_machine_opts;
diff --git a/include/hw/loader.h b/include/hw/loader.h
index d280dc33e9..c96b5e141c 100644
--- a/include/hw/loader.h
+++ b/include/hw/loader.h
@@ -270,8 +270,6 @@ int rom_add_elf_program(const char *name, GMappedFile *mapped_file, void *data,
                         AddressSpace *as);
 int rom_check_and_register_reset(void);
 void rom_set_fw(FWCfgState *f);
-void rom_set_order_override(int order);
-void rom_reset_order_override(void);
 
 /**
  * rom_transaction_begin:
diff --git a/include/hw/nvram/fw_cfg.h b/include/hw/nvram/fw_cfg.h
index 47578ccc7f..d41b9328fd 100644
--- a/include/hw/nvram/fw_cfg.h
+++ b/include/hw/nvram/fw_cfg.h
@@ -42,14 +42,6 @@ struct FWCfgDataGeneratorClass {
 
 typedef struct fw_cfg_file FWCfgFile;
 
-#define FW_CFG_ORDER_OVERRIDE_VGA    70
-#define FW_CFG_ORDER_OVERRIDE_NIC    80
-#define FW_CFG_ORDER_OVERRIDE_USER   100
-#define FW_CFG_ORDER_OVERRIDE_DEVICE 110
-
-void fw_cfg_set_order_override(FWCfgState *fw_cfg, int order);
-void fw_cfg_reset_order_override(FWCfgState *fw_cfg);
-
 typedef struct FWCfgFiles {
     uint32_t  count;
     FWCfgFile f[];
@@ -75,8 +67,6 @@ struct FWCfgState {
     uint32_t cur_offset;
     Notifier machine_ready;
 
-    int fw_cfg_order_override;
-
     bool dma_enabled;
     dma_addr_t dma_addr;
     AddressSpace *dma_as;
diff --git a/system/vl.c b/system/vl.c
index fd402b8ff8..3b7057e6c6 100644
--- a/system/vl.c
+++ b/system/vl.c
@@ -1192,10 +1192,7 @@ static int parse_fw_cfg(void *opaque, QemuOpts *opts, Error **errp)
             return -1;
         }
     }
-    /* For legacy, keep user files in a specific global order. */
-    fw_cfg_set_order_override(fw_cfg, FW_CFG_ORDER_OVERRIDE_USER);
     fw_cfg_add_file(fw_cfg, name, buf, size);
-    fw_cfg_reset_order_override(fw_cfg);
     return 0;
 }
 
@@ -2745,7 +2742,6 @@ static void qemu_create_cli_devices(void)
     }
 
     /* init generic devices */
-    rom_set_order_override(FW_CFG_ORDER_OVERRIDE_DEVICE);
     qemu_opts_foreach(qemu_find_opts("device"),
                       device_init_func, NULL, &error_fatal);
     QTAILQ_FOREACH(opt, &device_opts, next) {
@@ -2756,7 +2752,6 @@ static void qemu_create_cli_devices(void)
         assert(ret_data == NULL); /* error_fatal aborts */
         loc_pop(&opt->loc);
     }
-    rom_reset_order_override();
 }
 
 static bool qemu_machine_creation_done(Error **errp)

From 667e170d2cf033033dfd6656f871c41871107ee0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 12 May 2025 10:39:41 +0200
Subject: [PATCH 1321/2760] hw/core/machine: Remove hw_compat_2_5[] array
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The hw_compat_2_5[] array was only used by the pc-q35-2.5 and
pc-i440fx-2.5 machines, which got removed. Remove it.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Message-ID: <20250512083948.39294-13-philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 hw/core/machine.c   | 9 ---------
 include/hw/boards.h | 3 ---
 2 files changed, 12 deletions(-)

diff --git a/hw/core/machine.c b/hw/core/machine.c
index 15cd2bc3c4..e869821b22 100644
--- a/hw/core/machine.c
+++ b/hw/core/machine.c
@@ -285,15 +285,6 @@ GlobalProperty hw_compat_2_6[] = {
 };
 const size_t hw_compat_2_6_len = G_N_ELEMENTS(hw_compat_2_6);
 
-GlobalProperty hw_compat_2_5[] = {
-    { "isa-fdc", "fallback", "144" },
-    { "pvscsi", "x-old-pci-configuration", "on" },
-    { "pvscsi", "x-disable-pcie", "on" },
-    { "vmxnet3", "x-old-msi-offsets", "on" },
-    { "vmxnet3", "x-disable-pcie", "on" },
-};
-const size_t hw_compat_2_5_len = G_N_ELEMENTS(hw_compat_2_5);
-
 MachineState *current_machine;
 
 static char *machine_get_kernel(Object *obj, Error **errp)
diff --git a/include/hw/boards.h b/include/hw/boards.h
index ab900dacab..f424b2b505 100644
--- a/include/hw/boards.h
+++ b/include/hw/boards.h
@@ -862,7 +862,4 @@ extern const size_t hw_compat_2_7_len;
 extern GlobalProperty hw_compat_2_6[];
 extern const size_t hw_compat_2_6_len;
 
-extern GlobalProperty hw_compat_2_5[];
-extern const size_t hw_compat_2_5_len;
-
 #endif

From 16c04166ae71c78ec36a9e2914c46c2289a58503 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 12 May 2025 10:39:43 +0200
Subject: [PATCH 1322/2760] hw/scsi/vmw_pvscsi: Remove
 PVSCSI_COMPAT_OLD_PCI_CONFIGURATION definition
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

PVSCSI_COMPAT_OLD_PCI_CONFIGURATION was only used by the
hw_compat_2_5[] array, via the 'x-old-pci-configuration=on'
property. We removed all machines using that array, lets remove
all the code around PVSCSI_COMPAT_OLD_PCI_CONFIGURATION.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Message-ID: <20250512083948.39294-15-philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 hw/scsi/vmw_pvscsi.c | 26 +++++++-------------------
 1 file changed, 7 insertions(+), 19 deletions(-)

diff --git a/hw/scsi/vmw_pvscsi.c b/hw/scsi/vmw_pvscsi.c
index d5825b6786..34de59a7cf 100644
--- a/hw/scsi/vmw_pvscsi.c
+++ b/hw/scsi/vmw_pvscsi.c
@@ -69,17 +69,11 @@ OBJECT_DECLARE_TYPE(PVSCSIState, PVSCSIClass, PVSCSI)
 
 
 /* Compatibility flags for migration */
-#define PVSCSI_COMPAT_OLD_PCI_CONFIGURATION_BIT 0
-#define PVSCSI_COMPAT_OLD_PCI_CONFIGURATION \
-    (1 << PVSCSI_COMPAT_OLD_PCI_CONFIGURATION_BIT)
 #define PVSCSI_COMPAT_DISABLE_PCIE_BIT 1
 #define PVSCSI_COMPAT_DISABLE_PCIE \
     (1 << PVSCSI_COMPAT_DISABLE_PCIE_BIT)
 
-#define PVSCSI_USE_OLD_PCI_CONFIGURATION(s) \
-    ((s)->compat_flags & PVSCSI_COMPAT_OLD_PCI_CONFIGURATION)
-#define PVSCSI_MSI_OFFSET(s) \
-    (PVSCSI_USE_OLD_PCI_CONFIGURATION(s) ? 0x50 : 0x7c)
+#define PVSCSI_MSI_OFFSET    (0x7c)
 #define PVSCSI_EXP_EP_OFFSET (0x40)
 
 typedef struct PVSCSIRingInfo {
@@ -1110,7 +1104,7 @@ pvscsi_init_msi(PVSCSIState *s)
     int res;
     PCIDevice *d = PCI_DEVICE(s);
 
-    res = msi_init(d, PVSCSI_MSI_OFFSET(s), PVSCSI_MSIX_NUM_VECTORS,
+    res = msi_init(d, PVSCSI_MSI_OFFSET, PVSCSI_MSIX_NUM_VECTORS,
                    PVSCSI_USE_64BIT, PVSCSI_PER_VECTOR_MASK, NULL);
     if (res < 0) {
         trace_pvscsi_init_msi_fail(res);
@@ -1158,15 +1152,11 @@ pvscsi_realizefn(PCIDevice *pci_dev, Error **errp)
     trace_pvscsi_state("init");
 
     /* PCI subsystem ID, subsystem vendor ID, revision */
-    if (PVSCSI_USE_OLD_PCI_CONFIGURATION(s)) {
-        pci_set_word(pci_dev->config + PCI_SUBSYSTEM_ID, 0x1000);
-    } else {
-        pci_set_word(pci_dev->config + PCI_SUBSYSTEM_VENDOR_ID,
-                     PCI_VENDOR_ID_VMWARE);
-        pci_set_word(pci_dev->config + PCI_SUBSYSTEM_ID,
-                     PCI_DEVICE_ID_VMWARE_PVSCSI);
-        pci_config_set_revision(pci_dev->config, 0x2);
-    }
+    pci_set_word(pci_dev->config + PCI_SUBSYSTEM_VENDOR_ID,
+                 PCI_VENDOR_ID_VMWARE);
+    pci_set_word(pci_dev->config + PCI_SUBSYSTEM_ID,
+                 PCI_DEVICE_ID_VMWARE_PVSCSI);
+    pci_config_set_revision(pci_dev->config, 0x2);
 
     /* PCI latency timer = 255 */
     pci_dev->config[PCI_LATENCY_TIMER] = 0xff;
@@ -1298,8 +1288,6 @@ static const VMStateDescription vmstate_pvscsi = {
 
 static const Property pvscsi_properties[] = {
     DEFINE_PROP_UINT8("use_msg", PVSCSIState, use_msg, 1),
-    DEFINE_PROP_BIT("x-old-pci-configuration", PVSCSIState, compat_flags,
-                    PVSCSI_COMPAT_OLD_PCI_CONFIGURATION_BIT, false),
     DEFINE_PROP_BIT("x-disable-pcie", PVSCSIState, compat_flags,
                     PVSCSI_COMPAT_DISABLE_PCIE_BIT, false),
 };

From 404b27b739aa6f2c53fbed58101719564f614aac Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 12 May 2025 10:39:44 +0200
Subject: [PATCH 1323/2760] hw/scsi/vmw_pvscsi: Remove
 PVSCSI_COMPAT_DISABLE_PCIE_BIT definition
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

PVSCSI_COMPAT_DISABLE_PCIE_BIT was only used by the
hw_compat_2_5[] array, via the 'x-disable-pcie=on' property.
We removed all machines using that array, lets remove all the
code around PVSCSI_COMPAT_DISABLE_PCIE_BIT, including the now
unused PVSCSIState::compat_flags field.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Message-ID: <20250512083948.39294-16-philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 hw/scsi/vmw_pvscsi.c | 30 +-----------------------------
 1 file changed, 1 insertion(+), 29 deletions(-)

diff --git a/hw/scsi/vmw_pvscsi.c b/hw/scsi/vmw_pvscsi.c
index 34de59a7cf..e163023d14 100644
--- a/hw/scsi/vmw_pvscsi.c
+++ b/hw/scsi/vmw_pvscsi.c
@@ -68,11 +68,6 @@ struct PVSCSIClass {
 OBJECT_DECLARE_TYPE(PVSCSIState, PVSCSIClass, PVSCSI)
 
 
-/* Compatibility flags for migration */
-#define PVSCSI_COMPAT_DISABLE_PCIE_BIT 1
-#define PVSCSI_COMPAT_DISABLE_PCIE \
-    (1 << PVSCSI_COMPAT_DISABLE_PCIE_BIT)
-
 #define PVSCSI_MSI_OFFSET    (0x7c)
 #define PVSCSI_EXP_EP_OFFSET (0x40)
 
@@ -123,8 +118,6 @@ struct PVSCSIState {
     uint8_t msi_used;                    /* For migration compatibility      */
     PVSCSIRingInfo rings;                /* Data transfer rings manager      */
     uint32_t resetting;                  /* Reset in progress                */
-
-    uint32_t compat_flags;
 };
 
 typedef struct PVSCSIRequest {
@@ -1224,21 +1217,8 @@ pvscsi_post_load(void *opaque, int version_id)
     return 0;
 }
 
-static bool pvscsi_vmstate_need_pcie_device(void *opaque)
-{
-    PVSCSIState *s = PVSCSI(opaque);
-
-    return !(s->compat_flags & PVSCSI_COMPAT_DISABLE_PCIE);
-}
-
-static bool pvscsi_vmstate_test_pci_device(void *opaque, int version_id)
-{
-    return !pvscsi_vmstate_need_pcie_device(opaque);
-}
-
 static const VMStateDescription vmstate_pvscsi_pcie_device = {
     .name = "pvscsi/pcie",
-    .needed = pvscsi_vmstate_need_pcie_device,
     .fields = (const VMStateField[]) {
         VMSTATE_PCI_DEVICE(parent_obj, PVSCSIState),
         VMSTATE_END_OF_LIST()
@@ -1252,9 +1232,6 @@ static const VMStateDescription vmstate_pvscsi = {
     .pre_save = pvscsi_pre_save,
     .post_load = pvscsi_post_load,
     .fields = (const VMStateField[]) {
-        VMSTATE_STRUCT_TEST(parent_obj, PVSCSIState,
-                            pvscsi_vmstate_test_pci_device, 0,
-                            vmstate_pci_device, PCIDevice),
         VMSTATE_UINT8(msi_used, PVSCSIState),
         VMSTATE_UINT32(resetting, PVSCSIState),
         VMSTATE_UINT64(reg_interrupt_status, PVSCSIState),
@@ -1288,19 +1265,14 @@ static const VMStateDescription vmstate_pvscsi = {
 
 static const Property pvscsi_properties[] = {
     DEFINE_PROP_UINT8("use_msg", PVSCSIState, use_msg, 1),
-    DEFINE_PROP_BIT("x-disable-pcie", PVSCSIState, compat_flags,
-                    PVSCSI_COMPAT_DISABLE_PCIE_BIT, false),
 };
 
 static void pvscsi_realize(DeviceState *qdev, Error **errp)
 {
     PVSCSIClass *pvs_c = PVSCSI_GET_CLASS(qdev);
     PCIDevice *pci_dev = PCI_DEVICE(qdev);
-    PVSCSIState *s = PVSCSI(qdev);
 
-    if (!(s->compat_flags & PVSCSI_COMPAT_DISABLE_PCIE)) {
-        pci_dev->cap_present |= QEMU_PCI_CAP_EXPRESS;
-    }
+    pci_dev->cap_present |= QEMU_PCI_CAP_EXPRESS;
 
     pvs_c->parent_dc_realize(qdev, errp);
 }

From 3763d16370f1505faada6909bd92ebe3a242b1bd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 12 May 2025 10:39:45 +0200
Subject: [PATCH 1324/2760] hw/scsi/vmw_pvscsi: Convert DeviceRealize ->
 InstanceInit
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Simplify replacing pvscsi_realize() by pvscsi_instance_init(),
removing the need for device_class_set_parent_realize().

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Message-ID: <20250512083948.39294-17-philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 hw/scsi/vmw_pvscsi.c | 13 +++----------
 1 file changed, 3 insertions(+), 10 deletions(-)

diff --git a/hw/scsi/vmw_pvscsi.c b/hw/scsi/vmw_pvscsi.c
index e163023d14..7c98b1b8ea 100644
--- a/hw/scsi/vmw_pvscsi.c
+++ b/hw/scsi/vmw_pvscsi.c
@@ -1267,21 +1267,15 @@ static const Property pvscsi_properties[] = {
     DEFINE_PROP_UINT8("use_msg", PVSCSIState, use_msg, 1),
 };
 
-static void pvscsi_realize(DeviceState *qdev, Error **errp)
+static void pvscsi_instance_init(Object *obj)
 {
-    PVSCSIClass *pvs_c = PVSCSI_GET_CLASS(qdev);
-    PCIDevice *pci_dev = PCI_DEVICE(qdev);
-
-    pci_dev->cap_present |= QEMU_PCI_CAP_EXPRESS;
-
-    pvs_c->parent_dc_realize(qdev, errp);
+    PCI_DEVICE(obj)->cap_present |= QEMU_PCI_CAP_EXPRESS;
 }
 
 static void pvscsi_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
-    PVSCSIClass *pvs_k = PVSCSI_CLASS(klass);
     HotplugHandlerClass *hc = HOTPLUG_HANDLER_CLASS(klass);
 
     k->realize = pvscsi_realizefn;
@@ -1290,8 +1284,6 @@ static void pvscsi_class_init(ObjectClass *klass, const void *data)
     k->device_id = PCI_DEVICE_ID_VMWARE_PVSCSI;
     k->class_id = PCI_CLASS_STORAGE_SCSI;
     k->subsystem_id = 0x1000;
-    device_class_set_parent_realize(dc, pvscsi_realize,
-                                    &pvs_k->parent_dc_realize);
     device_class_set_legacy_reset(dc, pvscsi_reset);
     dc->vmsd = &vmstate_pvscsi;
     device_class_set_props(dc, pvscsi_properties);
@@ -1306,6 +1298,7 @@ static const TypeInfo pvscsi_info = {
     .class_size    = sizeof(PVSCSIClass),
     .instance_size = sizeof(PVSCSIState),
     .class_init    = pvscsi_class_init,
+    .instance_init = pvscsi_instance_init,
     .interfaces = (const InterfaceInfo[]) {
         { TYPE_HOTPLUG_HANDLER },
         { INTERFACE_PCIE_DEVICE },

From 2531dfde0ac447b0d70a83c8a02f72e584b9c534 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 12 May 2025 10:39:46 +0200
Subject: [PATCH 1325/2760] hw/net/vmxnet3: Remove
 VMXNET3_COMPAT_FLAG_OLD_MSI_OFFSETS definition
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

VMXNET3_COMPAT_FLAG_OLD_MSI_OFFSETS was only used by the
hw_compat_2_5[] array, via the 'x-old-msi-offsets=on' property.
We removed all machines using that array, lets remove all the
code around VMXNET3_COMPAT_FLAG_OLD_MSI_OFFSETS.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Message-ID: <20250512083948.39294-18-philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 hw/net/vmxnet3.c | 20 ++++++--------------
 1 file changed, 6 insertions(+), 14 deletions(-)

diff --git a/hw/net/vmxnet3.c b/hw/net/vmxnet3.c
index 83d942af17..3cf5d71f47 100644
--- a/hw/net/vmxnet3.c
+++ b/hw/net/vmxnet3.c
@@ -42,18 +42,13 @@
 #define VMXNET3_MSIX_BAR_SIZE 0x2000
 
 /* Compatibility flags for migration */
-#define VMXNET3_COMPAT_FLAG_OLD_MSI_OFFSETS_BIT 0
-#define VMXNET3_COMPAT_FLAG_OLD_MSI_OFFSETS \
-    (1 << VMXNET3_COMPAT_FLAG_OLD_MSI_OFFSETS_BIT)
 #define VMXNET3_COMPAT_FLAG_DISABLE_PCIE_BIT 1
 #define VMXNET3_COMPAT_FLAG_DISABLE_PCIE \
     (1 << VMXNET3_COMPAT_FLAG_DISABLE_PCIE_BIT)
 
 #define VMXNET3_EXP_EP_OFFSET (0x48)
-#define VMXNET3_MSI_OFFSET(s) \
-    ((s)->compat_flags & VMXNET3_COMPAT_FLAG_OLD_MSI_OFFSETS ? 0x50 : 0x84)
-#define VMXNET3_MSIX_OFFSET(s) \
-    ((s)->compat_flags & VMXNET3_COMPAT_FLAG_OLD_MSI_OFFSETS ? 0 : 0x9c)
+#define VMXNET3_MSI_OFFSET    (0x84)
+#define VMXNET3_MSIX_OFFSET   (0x9c)
 #define VMXNET3_DSN_OFFSET     (0x100)
 
 #define VMXNET3_BAR0_IDX      (0)
@@ -61,8 +56,7 @@
 #define VMXNET3_MSIX_BAR_IDX  (2)
 
 #define VMXNET3_OFF_MSIX_TABLE (0x000)
-#define VMXNET3_OFF_MSIX_PBA(s) \
-    ((s)->compat_flags & VMXNET3_COMPAT_FLAG_OLD_MSI_OFFSETS ? 0x800 : 0x1000)
+#define VMXNET3_OFF_MSIX_PBA   (0x1000)
 
 /* Link speed in Mbps should be shifted by 16 */
 #define VMXNET3_LINK_SPEED      (1000 << 16)
@@ -2122,8 +2116,8 @@ vmxnet3_init_msix(VMXNET3State *s)
                         &s->msix_bar,
                         VMXNET3_MSIX_BAR_IDX, VMXNET3_OFF_MSIX_TABLE,
                         &s->msix_bar,
-                        VMXNET3_MSIX_BAR_IDX, VMXNET3_OFF_MSIX_PBA(s),
-                        VMXNET3_MSIX_OFFSET(s), NULL);
+                        VMXNET3_MSIX_BAR_IDX, VMXNET3_OFF_MSIX_PBA,
+                        VMXNET3_MSIX_OFFSET, NULL);
 
     if (0 > res) {
         VMW_WRPRN("Failed to initialize MSI-X, error %d", res);
@@ -2221,7 +2215,7 @@ static void vmxnet3_pci_realize(PCIDevice *pci_dev, Error **errp)
     /* Interrupt pin A */
     pci_dev->config[PCI_INTERRUPT_PIN] = 0x01;
 
-    ret = msi_init(pci_dev, VMXNET3_MSI_OFFSET(s), VMXNET3_MAX_NMSIX_INTRS,
+    ret = msi_init(pci_dev, VMXNET3_MSI_OFFSET, VMXNET3_MAX_NMSIX_INTRS,
                    VMXNET3_USE_64BIT, VMXNET3_PER_VECTOR_MASK, NULL);
     /* Any error other than -ENOTSUP(board's MSI support is broken)
      * is a programming error. Fall back to INTx silently on -ENOTSUP */
@@ -2472,8 +2466,6 @@ static const VMStateDescription vmstate_vmxnet3 = {
 
 static const Property vmxnet3_properties[] = {
     DEFINE_NIC_PROPERTIES(VMXNET3State, conf),
-    DEFINE_PROP_BIT("x-old-msi-offsets", VMXNET3State, compat_flags,
-                    VMXNET3_COMPAT_FLAG_OLD_MSI_OFFSETS_BIT, false),
     DEFINE_PROP_BIT("x-disable-pcie", VMXNET3State, compat_flags,
                     VMXNET3_COMPAT_FLAG_DISABLE_PCIE_BIT, false),
 };

From 2db72323f2370ca69ba331f17c9a6bbd1f3bb118 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 12 May 2025 10:39:47 +0200
Subject: [PATCH 1326/2760] hw/net/vmxnet3: Remove
 VMXNET3_COMPAT_FLAG_DISABLE_PCIE definition
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

VMXNET3_COMPAT_FLAG_DISABLE_PCIE was only used by the
hw_compat_2_5[] array, via the 'x-disable-pcie=on' property.
We removed all machines using that array, lets remove all the
code around VMXNET3_COMPAT_FLAG_DISABLE_PCIE.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Message-ID: <20250512083948.39294-19-philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 hw/net/vmxnet3.c | 11 +----------
 1 file changed, 1 insertion(+), 10 deletions(-)

diff --git a/hw/net/vmxnet3.c b/hw/net/vmxnet3.c
index 3cf5d71f47..d080fe9b38 100644
--- a/hw/net/vmxnet3.c
+++ b/hw/net/vmxnet3.c
@@ -41,11 +41,6 @@
 #define PCI_DEVICE_ID_VMWARE_VMXNET3_REVISION 0x1
 #define VMXNET3_MSIX_BAR_SIZE 0x2000
 
-/* Compatibility flags for migration */
-#define VMXNET3_COMPAT_FLAG_DISABLE_PCIE_BIT 1
-#define VMXNET3_COMPAT_FLAG_DISABLE_PCIE \
-    (1 << VMXNET3_COMPAT_FLAG_DISABLE_PCIE_BIT)
-
 #define VMXNET3_EXP_EP_OFFSET (0x48)
 #define VMXNET3_MSI_OFFSET    (0x84)
 #define VMXNET3_MSIX_OFFSET   (0x9c)
@@ -2466,8 +2461,6 @@ static const VMStateDescription vmstate_vmxnet3 = {
 
 static const Property vmxnet3_properties[] = {
     DEFINE_NIC_PROPERTIES(VMXNET3State, conf),
-    DEFINE_PROP_BIT("x-disable-pcie", VMXNET3State, compat_flags,
-                    VMXNET3_COMPAT_FLAG_DISABLE_PCIE_BIT, false),
 };
 
 static void vmxnet3_realize(DeviceState *qdev, Error **errp)
@@ -2476,9 +2469,7 @@ static void vmxnet3_realize(DeviceState *qdev, Error **errp)
     PCIDevice *pci_dev = PCI_DEVICE(qdev);
     VMXNET3State *s = VMXNET3(qdev);
 
-    if (!(s->compat_flags & VMXNET3_COMPAT_FLAG_DISABLE_PCIE)) {
-        pci_dev->cap_present |= QEMU_PCI_CAP_EXPRESS;
-    }
+    pci_dev->cap_present |= QEMU_PCI_CAP_EXPRESS;
 
     vc->parent_dc_realize(qdev, errp);
 }

From c4eb3f10a3573392c297f2124a81af9041300ddd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 12 May 2025 10:39:48 +0200
Subject: [PATCH 1327/2760] hw/net/vmxnet3: Merge DeviceRealize in InstanceInit
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Simplify merging vmxnet3_realize() within vmxnet3_instance_init(),
removing the need for device_class_set_parent_realize().

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Message-ID: <20250512083948.39294-20-philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 hw/net/vmxnet3.c | 15 +--------------
 1 file changed, 1 insertion(+), 14 deletions(-)

diff --git a/hw/net/vmxnet3.c b/hw/net/vmxnet3.c
index d080fe9b38..7c0ca56b7c 100644
--- a/hw/net/vmxnet3.c
+++ b/hw/net/vmxnet3.c
@@ -2238,6 +2238,7 @@ static void vmxnet3_instance_init(Object *obj)
     device_add_bootindex_property(obj, &s->conf.bootindex,
                                   "bootindex", "/ethernet-phy@0",
                                   DEVICE(obj));
+    PCI_DEVICE(obj)->cap_present |= QEMU_PCI_CAP_EXPRESS;
 }
 
 static void vmxnet3_pci_uninit(PCIDevice *pci_dev)
@@ -2463,22 +2464,10 @@ static const Property vmxnet3_properties[] = {
     DEFINE_NIC_PROPERTIES(VMXNET3State, conf),
 };
 
-static void vmxnet3_realize(DeviceState *qdev, Error **errp)
-{
-    VMXNET3Class *vc = VMXNET3_DEVICE_GET_CLASS(qdev);
-    PCIDevice *pci_dev = PCI_DEVICE(qdev);
-    VMXNET3State *s = VMXNET3(qdev);
-
-    pci_dev->cap_present |= QEMU_PCI_CAP_EXPRESS;
-
-    vc->parent_dc_realize(qdev, errp);
-}
-
 static void vmxnet3_class_init(ObjectClass *class, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(class);
     PCIDeviceClass *c = PCI_DEVICE_CLASS(class);
-    VMXNET3Class *vc = VMXNET3_DEVICE_CLASS(class);
 
     c->realize = vmxnet3_pci_realize;
     c->exit = vmxnet3_pci_uninit;
@@ -2489,8 +2478,6 @@ static void vmxnet3_class_init(ObjectClass *class, const void *data)
     c->class_id = PCI_CLASS_NETWORK_ETHERNET;
     c->subsystem_vendor_id = PCI_VENDOR_ID_VMWARE;
     c->subsystem_id = PCI_DEVICE_ID_VMWARE_VMXNET3;
-    device_class_set_parent_realize(dc, vmxnet3_realize,
-                                    &vc->parent_dc_realize);
     dc->desc = "VMWare Paravirtualized Ethernet v3";
     device_class_set_legacy_reset(dc, vmxnet3_qdev_reset);
     dc->vmsd = &vmstate_vmxnet3;

From 5c54a367265ec19ed94a535cd15d178c16b8cae0 Mon Sep 17 00:00:00 2001
From: Matheus Tavares Bernardino <matheus.bernardino@oss.qualcomm.com>
Date: Mon, 26 May 2025 10:20:55 -0700
Subject: [PATCH 1328/2760] tests/unit/test-util-sockets: fix mem-leak on error
 object

The test fails with --enable-asan as the error struct is never freed.
In the case where the test expects a success but it fails, let's also
report the error for debugging (it will be freed internally).

Fixes 316e8ee8d6 ("util/qemu-sockets: Refactor inet_parse() to use QemuOpts")

Signed-off-by: Matheus Tavares Bernardino <matheus.bernardino@oss.qualcomm.com>
Reviewed-by: Juraj Marcin <jmarcin@redhat.com>
Message-ID: <518d94c7db20060b2a086cf55ee9bffab992a907.1748280011.git.matheus.bernardino@oss.qualcomm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/unit/test-util-sockets.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/tests/unit/test-util-sockets.c b/tests/unit/test-util-sockets.c
index 8492f4d68f..ee66d727c3 100644
--- a/tests/unit/test-util-sockets.c
+++ b/tests/unit/test-util-sockets.c
@@ -341,8 +341,12 @@ static void inet_parse_test_helper(const char *str,
     int rc = inet_parse(&addr, str, &error);
 
     if (success) {
+        if (error) {
+            error_report_err(error);
+        }
         g_assert_cmpint(rc, ==, 0);
     } else {
+        error_free(error);
         g_assert_cmpint(rc, <, 0);
     }
     if (exp_addr != NULL) {

From ac8fc4ccacd8a77d8d56dc3990bfb221c1f48fcd Mon Sep 17 00:00:00 2001
From: Yuri Benditovich <yuri.benditovich@daynix.com>
Date: Thu, 15 May 2025 09:32:37 +0300
Subject: [PATCH 1329/2760] virtio: check for validity of indirect descriptors

virtio processes indirect descriptors even if the respected
feature VIRTIO_RING_F_INDIRECT_DESC was not negotiated.
If qemu is used with reduced set of features to emulate the
hardware device that does not support indirect descriptors,
the will probably trigger problematic flows on the hardware
setup but do not reveal the  mistake on qemu.
Add LOG_GUEST_ERROR for such case. This will issue logs with
'-d guest_errors' in the command line

Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com>
Message-Id: <20250515063237.808293-1-yuri.benditovich@daynix.com>
Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com>
---
 hw/virtio/virtio.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
index 2e98cecf64..5534251e01 100644
--- a/hw/virtio/virtio.c
+++ b/hw/virtio/virtio.c
@@ -205,6 +205,15 @@ static const char *virtio_id_to_name(uint16_t device_id)
     return name;
 }
 
+static void virtio_check_indirect_feature(VirtIODevice *vdev)
+{
+    if (!virtio_vdev_has_feature(vdev, VIRTIO_RING_F_INDIRECT_DESC)) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "Device %s: indirect_desc was not negotiated!\n",
+                      vdev->name);
+    }
+}
+
 /* Called within call_rcu().  */
 static void virtio_free_region_cache(VRingMemoryRegionCaches *caches)
 {
@@ -1733,6 +1742,7 @@ static void *virtqueue_split_pop(VirtQueue *vq, size_t sz)
             virtio_error(vdev, "Invalid size for indirect buffer table");
             goto done;
         }
+        virtio_check_indirect_feature(vdev);
 
         /* loop over the indirect descriptor table */
         len = address_space_cache_init(&indirect_desc_cache, vdev->dma_as,
@@ -1870,6 +1880,7 @@ static void *virtqueue_packed_pop(VirtQueue *vq, size_t sz)
             virtio_error(vdev, "Invalid size for indirect buffer table");
             goto done;
         }
+        virtio_check_indirect_feature(vdev);
 
         /* loop over the indirect descriptor table */
         len = address_space_cache_init(&indirect_desc_cache, vdev->dma_as,

From 31753d5a336fbb4e9246397f4b90b6f611f27f22 Mon Sep 17 00:00:00 2001
From: Sairaj Kodilkar <sarunkod@amd.com>
Date: Fri, 16 May 2025 15:35:34 +0530
Subject: [PATCH 1330/2760] hw/i386/amd_iommu: Fix device setup failure when PT
 is on.

Commit c1f46999ef506 ("amd_iommu: Add support for pass though mode")
introduces the support for "pt" flag by enabling nodma memory when
"pt=off". This allowed VFIO devices to successfully register notifiers
by using nodma region.

But, This also broke things when guest is booted with the iommu=nopt
because, devices bypass the IOMMU and use untranslated addresses (IOVA) to
perform DMA reads/writes to the nodma memory region, ultimately resulting in
a failure to setup the devices in the guest.

Fix the above issue by always enabling the amdvi_dev_as->iommu memory region.
But this will once again cause VFIO devices to fail while registering the
notifiers with AMD IOMMU memory region.

Fixes: c1f46999ef506 ("amd_iommu: Add support for pass though mode")
Signed-off-by: Sairaj Kodilkar <sarunkod@amd.com>
Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
Message-Id: <20250516100535.4980-2-sarunkod@amd.com>
Fixes: c1f46999ef506 ("amd_iommu: Add support for pass though mode")
Signed-off-by: Sairaj Kodilkar <sarunkod@amd.com>
Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
---
 hw/i386/amd_iommu.c | 12 ++----------
 1 file changed, 2 insertions(+), 10 deletions(-)

diff --git a/hw/i386/amd_iommu.c b/hw/i386/amd_iommu.c
index 0775c8f3bb..17379db52a 100644
--- a/hw/i386/amd_iommu.c
+++ b/hw/i386/amd_iommu.c
@@ -1426,7 +1426,6 @@ static AddressSpace *amdvi_host_dma_iommu(PCIBus *bus, void *opaque, int devfn)
     AMDVIState *s = opaque;
     AMDVIAddressSpace **iommu_as, *amdvi_dev_as;
     int bus_num = pci_bus_num(bus);
-    X86IOMMUState *x86_iommu = X86_IOMMU_DEVICE(s);
 
     iommu_as = s->address_spaces[bus_num];
 
@@ -1486,15 +1485,8 @@ static AddressSpace *amdvi_host_dma_iommu(PCIBus *bus, void *opaque, int devfn)
                                             AMDVI_INT_ADDR_FIRST,
                                             &amdvi_dev_as->iommu_ir, 1);
 
-        if (!x86_iommu->pt_supported) {
-            memory_region_set_enabled(&amdvi_dev_as->iommu_nodma, false);
-            memory_region_set_enabled(MEMORY_REGION(&amdvi_dev_as->iommu),
-                                      true);
-        } else {
-            memory_region_set_enabled(MEMORY_REGION(&amdvi_dev_as->iommu),
-                                      false);
-            memory_region_set_enabled(&amdvi_dev_as->iommu_nodma, true);
-        }
+        memory_region_set_enabled(&amdvi_dev_as->iommu_nodma, false);
+        memory_region_set_enabled(MEMORY_REGION(&amdvi_dev_as->iommu), true);
     }
     return &iommu_as[devfn]->as;
 }

From 0f178860df3489a9d3c19a5f7f024e6aa6c26515 Mon Sep 17 00:00:00 2001
From: Vasant Hegde <vasant.hegde@amd.com>
Date: Fri, 16 May 2025 15:35:35 +0530
Subject: [PATCH 1331/2760] hw/i386/amd_iommu: Fix xtsup when vcpus < 255
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

If vCPUs > 255 then x86 common code (x86_cpus_init()) call kvm_enable_x2apic().
But if vCPUs <= 255 then the common code won't calls kvm_enable_x2apic().

This is because commit 8c6619f3e692 ("hw/i386/amd_iommu: Simplify non-KVM
checks on XTSup feature") removed the call to kvm_enable_x2apic when xtsup
is "on", which break things when guest is booted with x2apic mode and
there are <= 255 vCPUs.

Fix this by adding back kvm_enable_x2apic() call when xtsup=on.

Fixes: 8c6619f3e692 ("hw/i386/amd_iommu: Simplify non-KVM checks on XTSup feature")
Reported-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Tested-by: Tested-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Cc: Philippe Mathieu-Daudé <philmd@linaro.org>
Cc: Joao Martins <joao.m.martins@oracle.com>
Signed-off-by: Vasant Hegde <vasant.hegde@amd.com>
Signed-off-by: Sairaj Kodilkar <sarunkod@amd.com>
Message-Id: <20250516100535.4980-3-sarunkod@amd.com>
Fixes: 8c6619f3e692 ("hw/i386/amd_iommu: Simplify non-KVM checks on XTSup feature")
Reported-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Tested-by: Tested-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Cc: Philippe Mathieu-Daudé <philmd@linaro.org>
Cc: Joao Martins <joao.m.martins@oracle.com>
Signed-off-by: Vasant Hegde <vasant.hegde@amd.com>
Signed-off-by: Sairaj Kodilkar <sarunkod@amd.com>
---
 hw/i386/amd_iommu.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/hw/i386/amd_iommu.c b/hw/i386/amd_iommu.c
index 17379db52a..963aa2450c 100644
--- a/hw/i386/amd_iommu.c
+++ b/hw/i386/amd_iommu.c
@@ -1715,6 +1715,14 @@ static void amdvi_sysbus_realize(DeviceState *dev, Error **errp)
         exit(EXIT_FAILURE);
     }
 
+    if (s->xtsup) {
+        if (kvm_irqchip_is_split() && !kvm_enable_x2apic()) {
+            error_report("AMD IOMMU xtsup=on requires x2APIC support on "
+                          "the KVM side");
+            exit(EXIT_FAILURE);
+        }
+    }
+
     pci_setup_iommu(bus, &amdvi_iommu_ops, s);
     amdvi_init(s);
 }

From a8d178e1492a1a803898501a84829ac517ae2fb0 Mon Sep 17 00:00:00 2001
From: CLEMENT MATHIEU--DRIF <clement.mathieu--drif@eviden.com>
Date: Tue, 20 May 2025 07:18:51 +0000
Subject: [PATCH 1332/2760] pcie: Add helper to declare PASID capability for a
 pcie device

Signed-off-by: Clement Mathieu--Drif <clement.mathieu--drif@eviden.com>
Message-Id: <20250520071823.764266-2-clement.mathieu--drif@eviden.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/pci/pcie.c              | 25 +++++++++++++++++++++++++
 include/hw/pci/pcie.h      |  6 +++++-
 include/hw/pci/pcie_regs.h |  5 +++++
 3 files changed, 35 insertions(+), 1 deletion(-)

diff --git a/hw/pci/pcie.c b/hw/pci/pcie.c
index 1b12db6fa2..4f935ff420 100644
--- a/hw/pci/pcie.c
+++ b/hw/pci/pcie.c
@@ -1214,3 +1214,28 @@ void pcie_acs_reset(PCIDevice *dev)
         pci_set_word(dev->config + dev->exp.acs_cap + PCI_ACS_CTRL, 0);
     }
 }
+
+/* PASID */
+void pcie_pasid_init(PCIDevice *dev, uint16_t offset, uint8_t pasid_width,
+                     bool exec_perm, bool priv_mod)
+{
+    static const uint16_t control_reg_rw_mask = 0x07;
+    uint16_t capability_reg;
+
+    assert(pasid_width <= PCI_EXT_CAP_PASID_MAX_WIDTH);
+
+    pcie_add_capability(dev, PCI_EXT_CAP_ID_PASID, PCI_PASID_VER, offset,
+                        PCI_EXT_CAP_PASID_SIZEOF);
+
+    capability_reg = ((uint16_t)pasid_width) << PCI_PASID_CAP_WIDTH_SHIFT;
+    capability_reg |= exec_perm ? PCI_PASID_CAP_EXEC : 0;
+    capability_reg |= priv_mod  ? PCI_PASID_CAP_PRIV : 0;
+    pci_set_word(dev->config + offset + PCI_PASID_CAP, capability_reg);
+
+    /* Everything is disabled by default */
+    pci_set_word(dev->config + offset + PCI_PASID_CTRL, 0);
+
+    pci_set_word(dev->wmask + offset + PCI_PASID_CTRL, control_reg_rw_mask);
+
+    dev->exp.pasid_cap = offset;
+}
diff --git a/include/hw/pci/pcie.h b/include/hw/pci/pcie.h
index 70a5de09de..fe82e0a915 100644
--- a/include/hw/pci/pcie.h
+++ b/include/hw/pci/pcie.h
@@ -70,8 +70,9 @@ struct PCIExpressDevice {
     uint16_t aer_cap;
     PCIEAERLog aer_log;
 
-    /* Offset of ATS capability in config space */
+    /* Offset of ATS and PASID capabilities in config space */
     uint16_t ats_cap;
+    uint16_t pasid_cap;
 
     /* ACS */
     uint16_t acs_cap;
@@ -150,4 +151,7 @@ void pcie_cap_slot_unplug_cb(HotplugHandler *hotplug_dev, DeviceState *dev,
                              Error **errp);
 void pcie_cap_slot_unplug_request_cb(HotplugHandler *hotplug_dev,
                                      DeviceState *dev, Error **errp);
+
+void pcie_pasid_init(PCIDevice *dev, uint16_t offset, uint8_t pasid_width,
+                     bool exec_perm, bool priv_mod);
 #endif /* QEMU_PCIE_H */
diff --git a/include/hw/pci/pcie_regs.h b/include/hw/pci/pcie_regs.h
index 9d3b6868dc..4d9cf4a29c 100644
--- a/include/hw/pci/pcie_regs.h
+++ b/include/hw/pci/pcie_regs.h
@@ -86,6 +86,11 @@ typedef enum PCIExpLinkWidth {
 #define PCI_ARI_VER                     1
 #define PCI_ARI_SIZEOF                  8
 
+/* PASID */
+#define PCI_PASID_VER                   1
+#define PCI_EXT_CAP_PASID_MAX_WIDTH     20
+#define PCI_PASID_CAP_WIDTH_SHIFT       8
+
 /* AER */
 #define PCI_ERR_VER                     2
 #define PCI_ERR_SIZEOF                  0x48

From 1e82e8a828cf18a8abfeca7295322db91879de04 Mon Sep 17 00:00:00 2001
From: CLEMENT MATHIEU--DRIF <clement.mathieu--drif@eviden.com>
Date: Tue, 20 May 2025 07:18:51 +0000
Subject: [PATCH 1333/2760] pcie: Helper functions to check if PASID is enabled

pasid_enabled checks whether the capability is
present or not. If so, we read the configuration space to get
the status of the feature (enabled or not).

Signed-off-by: Clement Mathieu--Drif <clement.mathieu--drif@eviden.com>
Message-Id: <20250520071823.764266-3-clement.mathieu--drif@eviden.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/pci/pcie.c         | 9 +++++++++
 include/hw/pci/pcie.h | 2 ++
 2 files changed, 11 insertions(+)

diff --git a/hw/pci/pcie.c b/hw/pci/pcie.c
index 4f935ff420..db9756d861 100644
--- a/hw/pci/pcie.c
+++ b/hw/pci/pcie.c
@@ -1239,3 +1239,12 @@ void pcie_pasid_init(PCIDevice *dev, uint16_t offset, uint8_t pasid_width,
 
     dev->exp.pasid_cap = offset;
 }
+
+bool pcie_pasid_enabled(const PCIDevice *dev)
+{
+    if (!pci_is_express(dev) || !dev->exp.pasid_cap) {
+        return false;
+    }
+    return (pci_get_word(dev->config + dev->exp.pasid_cap + PCI_PASID_CTRL) &
+                PCI_PASID_CTRL_ENABLE) != 0;
+}
diff --git a/include/hw/pci/pcie.h b/include/hw/pci/pcie.h
index fe82e0a915..dff98ff2c6 100644
--- a/include/hw/pci/pcie.h
+++ b/include/hw/pci/pcie.h
@@ -154,4 +154,6 @@ void pcie_cap_slot_unplug_request_cb(HotplugHandler *hotplug_dev,
 
 void pcie_pasid_init(PCIDevice *dev, uint16_t offset, uint8_t pasid_width,
                      bool exec_perm, bool priv_mod);
+
+bool pcie_pasid_enabled(const PCIDevice *dev);
 #endif /* QEMU_PCIE_H */

From 6a3ae6a2440dead9dd8e3f84152dc53a5214c48d Mon Sep 17 00:00:00 2001
From: CLEMENT MATHIEU--DRIF <clement.mathieu--drif@eviden.com>
Date: Tue, 20 May 2025 07:18:52 +0000
Subject: [PATCH 1334/2760] pcie: Helper function to check if ATS is enabled

ats_enabled checks whether the capability is
present or not. If so, we read the configuration space to get
the status of the feature (enabled or not).

Signed-off-by: Clement Mathieu--Drif <clement.mathieu--drif@eviden.com>
Message-Id: <20250520071823.764266-4-clement.mathieu--drif@eviden.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/pci/pcie.c         | 9 +++++++++
 include/hw/pci/pcie.h | 1 +
 2 files changed, 10 insertions(+)

diff --git a/hw/pci/pcie.c b/hw/pci/pcie.c
index db9756d861..36de709801 100644
--- a/hw/pci/pcie.c
+++ b/hw/pci/pcie.c
@@ -1248,3 +1248,12 @@ bool pcie_pasid_enabled(const PCIDevice *dev)
     return (pci_get_word(dev->config + dev->exp.pasid_cap + PCI_PASID_CTRL) &
                 PCI_PASID_CTRL_ENABLE) != 0;
 }
+
+bool pcie_ats_enabled(const PCIDevice *dev)
+{
+    if (!pci_is_express(dev) || !dev->exp.ats_cap) {
+        return false;
+    }
+    return (pci_get_word(dev->config + dev->exp.ats_cap + PCI_ATS_CTRL) &
+                PCI_ATS_CTRL_ENABLE) != 0;
+}
diff --git a/include/hw/pci/pcie.h b/include/hw/pci/pcie.h
index dff98ff2c6..497d0bc2d2 100644
--- a/include/hw/pci/pcie.h
+++ b/include/hw/pci/pcie.h
@@ -156,4 +156,5 @@ void pcie_pasid_init(PCIDevice *dev, uint16_t offset, uint8_t pasid_width,
                      bool exec_perm, bool priv_mod);
 
 bool pcie_pasid_enabled(const PCIDevice *dev);
+bool pcie_ats_enabled(const PCIDevice *dev);
 #endif /* QEMU_PCIE_H */

From dcad6cb2abf4ffc4f911041d0547c4b54c2f92e2 Mon Sep 17 00:00:00 2001
From: CLEMENT MATHIEU--DRIF <clement.mathieu--drif@eviden.com>
Date: Tue, 20 May 2025 07:18:54 +0000
Subject: [PATCH 1335/2760] pcie: Add a helper to declare the PRI capability
 for a pcie device

Signed-off-by: Clement Mathieu--Drif <clement.mathieu--drif@eviden.com>
Message-Id: <20250520071823.764266-5-clement.mathieu--drif@eviden.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/pci/pcie.c              | 26 ++++++++++++++++++++++++++
 include/hw/pci/pcie.h      |  5 ++++-
 include/hw/pci/pcie_regs.h |  3 +++
 3 files changed, 33 insertions(+), 1 deletion(-)

diff --git a/hw/pci/pcie.c b/hw/pci/pcie.c
index 36de709801..542172b3fa 100644
--- a/hw/pci/pcie.c
+++ b/hw/pci/pcie.c
@@ -1240,6 +1240,32 @@ void pcie_pasid_init(PCIDevice *dev, uint16_t offset, uint8_t pasid_width,
     dev->exp.pasid_cap = offset;
 }
 
+/* PRI */
+void pcie_pri_init(PCIDevice *dev, uint16_t offset, uint32_t outstanding_pr_cap,
+                   bool prg_response_pasid_req)
+{
+    static const uint16_t control_reg_rw_mask = 0x3;
+    static const uint16_t status_reg_rw1_mask = 0x3;
+    static const uint32_t pr_alloc_reg_rw_mask = 0xffffffff;
+    uint16_t status_reg;
+
+    status_reg = prg_response_pasid_req ? PCI_PRI_STATUS_PASID : 0;
+    status_reg |= PCI_PRI_STATUS_STOPPED; /* Stopped by default */
+
+    pcie_add_capability(dev, PCI_EXT_CAP_ID_PRI, PCI_PRI_VER, offset,
+                        PCI_EXT_CAP_PRI_SIZEOF);
+    /* Disabled by default */
+
+    pci_set_word(dev->config + offset + PCI_PRI_STATUS, status_reg);
+    pci_set_long(dev->config + offset + PCI_PRI_MAX_REQ, outstanding_pr_cap);
+
+    pci_set_word(dev->wmask + offset + PCI_PRI_CTRL, control_reg_rw_mask);
+    pci_set_word(dev->w1cmask + offset + PCI_PRI_STATUS, status_reg_rw1_mask);
+    pci_set_long(dev->wmask + offset + PCI_PRI_ALLOC_REQ, pr_alloc_reg_rw_mask);
+
+    dev->exp.pri_cap = offset;
+}
+
 bool pcie_pasid_enabled(const PCIDevice *dev)
 {
     if (!pci_is_express(dev) || !dev->exp.pasid_cap) {
diff --git a/include/hw/pci/pcie.h b/include/hw/pci/pcie.h
index 497d0bc2d2..17f06cd5d6 100644
--- a/include/hw/pci/pcie.h
+++ b/include/hw/pci/pcie.h
@@ -70,9 +70,10 @@ struct PCIExpressDevice {
     uint16_t aer_cap;
     PCIEAERLog aer_log;
 
-    /* Offset of ATS and PASID capabilities in config space */
+    /* Offset of ATS, PRI and PASID capabilities in config space */
     uint16_t ats_cap;
     uint16_t pasid_cap;
+    uint16_t pri_cap;
 
     /* ACS */
     uint16_t acs_cap;
@@ -154,6 +155,8 @@ void pcie_cap_slot_unplug_request_cb(HotplugHandler *hotplug_dev,
 
 void pcie_pasid_init(PCIDevice *dev, uint16_t offset, uint8_t pasid_width,
                      bool exec_perm, bool priv_mod);
+void pcie_pri_init(PCIDevice *dev, uint16_t offset, uint32_t outstanding_pr_cap,
+                   bool prg_response_pasid_req);
 
 bool pcie_pasid_enabled(const PCIDevice *dev);
 bool pcie_ats_enabled(const PCIDevice *dev);
diff --git a/include/hw/pci/pcie_regs.h b/include/hw/pci/pcie_regs.h
index 4d9cf4a29c..33a22229fe 100644
--- a/include/hw/pci/pcie_regs.h
+++ b/include/hw/pci/pcie_regs.h
@@ -91,6 +91,9 @@ typedef enum PCIExpLinkWidth {
 #define PCI_EXT_CAP_PASID_MAX_WIDTH     20
 #define PCI_PASID_CAP_WIDTH_SHIFT       8
 
+/* PRI */
+#define PCI_PRI_VER                     1
+
 /* AER */
 #define PCI_ERR_VER                     2
 #define PCI_ERR_SIZEOF                  0x48

From 5be8cf79188a2a1c73d16f3a8b458d909ac976f4 Mon Sep 17 00:00:00 2001
From: CLEMENT MATHIEU--DRIF <clement.mathieu--drif@eviden.com>
Date: Tue, 20 May 2025 07:18:57 +0000
Subject: [PATCH 1336/2760] pcie: Helper functions to check to check if PRI is
 enabled

pri_enabled can be used to check whether the capability is present and
enabled on a PCIe device

Signed-off-by: Clement Mathieu--Drif <clement.mathieu--drif@eviden.com>
Message-Id: <20250520071823.764266-6-clement.mathieu--drif@eviden.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/pci/pcie.c         | 9 +++++++++
 include/hw/pci/pcie.h | 1 +
 2 files changed, 10 insertions(+)

diff --git a/hw/pci/pcie.c b/hw/pci/pcie.c
index 542172b3fa..eaeb68894e 100644
--- a/hw/pci/pcie.c
+++ b/hw/pci/pcie.c
@@ -1266,6 +1266,15 @@ void pcie_pri_init(PCIDevice *dev, uint16_t offset, uint32_t outstanding_pr_cap,
     dev->exp.pri_cap = offset;
 }
 
+bool pcie_pri_enabled(const PCIDevice *dev)
+{
+    if (!pci_is_express(dev) || !dev->exp.pri_cap) {
+        return false;
+    }
+    return (pci_get_word(dev->config + dev->exp.pri_cap + PCI_PRI_CTRL) &
+                PCI_PRI_CTRL_ENABLE) != 0;
+}
+
 bool pcie_pasid_enabled(const PCIDevice *dev)
 {
     if (!pci_is_express(dev) || !dev->exp.pasid_cap) {
diff --git a/include/hw/pci/pcie.h b/include/hw/pci/pcie.h
index 17f06cd5d6..ff6ce08e13 100644
--- a/include/hw/pci/pcie.h
+++ b/include/hw/pci/pcie.h
@@ -158,6 +158,7 @@ void pcie_pasid_init(PCIDevice *dev, uint16_t offset, uint8_t pasid_width,
 void pcie_pri_init(PCIDevice *dev, uint16_t offset, uint32_t outstanding_pr_cap,
                    bool prg_response_pasid_req);
 
+bool pcie_pri_enabled(const PCIDevice *dev);
 bool pcie_pasid_enabled(const PCIDevice *dev);
 bool pcie_ats_enabled(const PCIDevice *dev);
 #endif /* QEMU_PCIE_H */

From 8ff9e1def0ef3388333b6cc639c9f958f97ebe05 Mon Sep 17 00:00:00 2001
From: CLEMENT MATHIEU--DRIF <clement.mathieu--drif@eviden.com>
Date: Tue, 20 May 2025 07:18:58 +0000
Subject: [PATCH 1337/2760] pci: Cache the bus mastering status in the device

The cached is_master value is necessary to know if a device is
allowed to issue ATS/PRI requests or not as these operations do not go
through the master_enable memory region.

Signed-off-by: Clement Mathieu--Drif <clement.mathieu--drif@eviden.com>
Message-Id: <20250520071823.764266-7-clement.mathieu--drif@eviden.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/pci/pci.c                | 23 +++++++++++++----------
 include/hw/pci/pci_device.h |  1 +
 2 files changed, 14 insertions(+), 10 deletions(-)

diff --git a/hw/pci/pci.c b/hw/pci/pci.c
index f5ab510697..1114ba8529 100644
--- a/hw/pci/pci.c
+++ b/hw/pci/pci.c
@@ -128,6 +128,12 @@ static GSequence *pci_acpi_index_list(void)
     return used_acpi_index_list;
 }
 
+static void pci_set_master(PCIDevice *d, bool enable)
+{
+    memory_region_set_enabled(&d->bus_master_enable_region, enable);
+    d->is_master = enable; /* cache the status */
+}
+
 static void pci_init_bus_master(PCIDevice *pci_dev)
 {
     AddressSpace *dma_as = pci_device_iommu_address_space(pci_dev);
@@ -135,7 +141,7 @@ static void pci_init_bus_master(PCIDevice *pci_dev)
     memory_region_init_alias(&pci_dev->bus_master_enable_region,
                              OBJECT(pci_dev), "bus master",
                              dma_as->root, 0, memory_region_size(dma_as->root));
-    memory_region_set_enabled(&pci_dev->bus_master_enable_region, false);
+    pci_set_master(pci_dev, false);
     memory_region_add_subregion(&pci_dev->bus_master_container_region, 0,
                                 &pci_dev->bus_master_enable_region);
 }
@@ -804,9 +810,8 @@ static int get_pci_config_device(QEMUFile *f, void *pv, size_t size,
         pci_bridge_update_mappings(PCI_BRIDGE(s));
     }
 
-    memory_region_set_enabled(&s->bus_master_enable_region,
-                              pci_get_word(s->config + PCI_COMMAND)
-                              & PCI_COMMAND_MASTER);
+    pci_set_master(s, pci_get_word(s->config + PCI_COMMAND)
+                      & PCI_COMMAND_MASTER);
 
     g_free(config);
     return 0;
@@ -1787,9 +1792,8 @@ void pci_default_write_config(PCIDevice *d, uint32_t addr, uint32_t val_in, int
 
     if (ranges_overlap(addr, l, PCI_COMMAND, 2)) {
         pci_update_irq_disabled(d, was_irq_disabled);
-        memory_region_set_enabled(&d->bus_master_enable_region,
-                                  (pci_get_word(d->config + PCI_COMMAND)
-                                   & PCI_COMMAND_MASTER) && d->enabled);
+        pci_set_master(d, (pci_get_word(d->config + PCI_COMMAND) &
+                          PCI_COMMAND_MASTER) && d->enabled);
     }
 
     msi_write_config(d, addr, val_in, l);
@@ -3100,9 +3104,8 @@ void pci_set_enabled(PCIDevice *d, bool state)
 
     d->enabled = state;
     pci_update_mappings(d);
-    memory_region_set_enabled(&d->bus_master_enable_region,
-                              (pci_get_word(d->config + PCI_COMMAND)
-                               & PCI_COMMAND_MASTER) && d->enabled);
+    pci_set_master(d, (pci_get_word(d->config + PCI_COMMAND)
+                      & PCI_COMMAND_MASTER) && d->enabled);
     if (qdev_is_realized(&d->qdev)) {
         pci_device_reset(d);
     }
diff --git a/include/hw/pci/pci_device.h b/include/hw/pci/pci_device.h
index e41d95b0b0..eee0338568 100644
--- a/include/hw/pci/pci_device.h
+++ b/include/hw/pci/pci_device.h
@@ -90,6 +90,7 @@ struct PCIDevice {
     char name[64];
     PCIIORegion io_regions[PCI_NUM_REGIONS];
     AddressSpace bus_master_as;
+    bool is_master;
     MemoryRegion bus_master_container_region;
     MemoryRegion bus_master_enable_region;
 

From 042cbc9aec7caca639dcb1a8a996406a7c572706 Mon Sep 17 00:00:00 2001
From: CLEMENT MATHIEU--DRIF <clement.mathieu--drif@eviden.com>
Date: Tue, 20 May 2025 07:18:59 +0000
Subject: [PATCH 1338/2760] pci: Add an API to get IOMMU's min page size and
 virtual address width

This kind of information is needed by devices implementing ATS in order
to initialize their translation cache.

Signed-off-by: Clement Mathieu--Drif <clement.mathieu--drif@eviden.com>
Message-Id: <20250520071823.764266-8-clement.mathieu--drif@eviden.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/pci/pci.c         | 17 +++++++++++++++++
 include/hw/pci/pci.h | 26 ++++++++++++++++++++++++++
 2 files changed, 43 insertions(+)

diff --git a/hw/pci/pci.c b/hw/pci/pci.c
index 1114ba8529..fc4954ac81 100644
--- a/hw/pci/pci.c
+++ b/hw/pci/pci.c
@@ -2970,6 +2970,23 @@ void pci_device_unset_iommu_device(PCIDevice *dev)
     }
 }
 
+int pci_iommu_get_iotlb_info(PCIDevice *dev, uint8_t *addr_width,
+                             uint32_t *min_page_size)
+{
+    PCIBus *bus;
+    PCIBus *iommu_bus;
+    int devfn;
+
+    pci_device_get_iommu_bus_devfn(dev, &bus, &iommu_bus, &devfn);
+    if (iommu_bus && iommu_bus->iommu_ops->get_iotlb_info) {
+        iommu_bus->iommu_ops->get_iotlb_info(iommu_bus->iommu_opaque,
+                                             addr_width, min_page_size);
+        return 0;
+    }
+
+    return -ENODEV;
+}
+
 void pci_setup_iommu(PCIBus *bus, const PCIIOMMUOps *ops, void *opaque)
 {
     /*
diff --git a/include/hw/pci/pci.h b/include/hw/pci/pci.h
index c2fe6caa2c..d67ffe12db 100644
--- a/include/hw/pci/pci.h
+++ b/include/hw/pci/pci.h
@@ -429,6 +429,19 @@ typedef struct PCIIOMMUOps {
      * @devfn: device and function number of the PCI device.
      */
     void (*unset_iommu_device)(PCIBus *bus, void *opaque, int devfn);
+    /**
+     * @get_iotlb_info: get properties required to initialize a device IOTLB.
+     *
+     * Callback required if devices are allowed to cache translations.
+     *
+     * @opaque: the data passed to pci_setup_iommu().
+     *
+     * @addr_width: the address width of the IOMMU (output parameter).
+     *
+     * @min_page_size: the page size of the IOMMU (output parameter).
+     */
+    void (*get_iotlb_info)(void *opaque, uint8_t *addr_width,
+                           uint32_t *min_page_size);
 } PCIIOMMUOps;
 
 AddressSpace *pci_device_iommu_address_space(PCIDevice *dev);
@@ -436,6 +449,19 @@ bool pci_device_set_iommu_device(PCIDevice *dev, HostIOMMUDevice *hiod,
                                  Error **errp);
 void pci_device_unset_iommu_device(PCIDevice *dev);
 
+/**
+ * pci_iommu_get_iotlb_info: get properties required to initialize a
+ * device IOTLB.
+ *
+ * Returns 0 on success, or a negative errno otherwise.
+ *
+ * @dev: the device that wants to get the information.
+ * @addr_width: the address width of the IOMMU (output parameter).
+ * @min_page_size: the page size of the IOMMU (output parameter).
+ */
+int pci_iommu_get_iotlb_info(PCIDevice *dev, uint8_t *addr_width,
+                             uint32_t *min_page_size);
+
 /**
  * pci_setup_iommu: Initialize specific IOMMU handlers for a PCIBus
  *

From 7e94e45296d68982d448ae57e195efcf8f66649e Mon Sep 17 00:00:00 2001
From: CLEMENT MATHIEU--DRIF <clement.mathieu--drif@eviden.com>
Date: Tue, 20 May 2025 07:19:00 +0000
Subject: [PATCH 1339/2760] memory: Store user data pointer in the IOMMU
 notifiers

This will help developers of ATS-capable devices to track a state.

Signed-off-by: Clement Mathieu--Drif <clement.mathieu--drif@eviden.com>
Message-Id: <20250520071823.764266-9-clement.mathieu--drif@eviden.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 include/system/memory.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/include/system/memory.h b/include/system/memory.h
index fbbf4cf911..fc35a0dcad 100644
--- a/include/system/memory.h
+++ b/include/system/memory.h
@@ -183,6 +183,7 @@ struct IOMMUNotifier {
     hwaddr start;
     hwaddr end;
     int iommu_idx;
+    void *opaque;
     QLIST_ENTRY(IOMMUNotifier) node;
 };
 typedef struct IOMMUNotifier IOMMUNotifier;

From a849ff5d6fa9d263beaecd6421fff8e21d2591c8 Mon Sep 17 00:00:00 2001
From: CLEMENT MATHIEU--DRIF <clement.mathieu--drif@eviden.com>
Date: Tue, 20 May 2025 07:19:01 +0000
Subject: [PATCH 1340/2760] pci: Add a pci-level initialization function for
 IOMMU notifiers

This is meant to be used by ATS-capable devices.

Signed-off-by: Clement Mathieu--Drif <clement.mathieu--drif@eviden.com>
Message-Id: <20250520071823.764266-10-clement.mathieu--drif@eviden.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/pci/pci.c         | 17 +++++++++++++++++
 include/hw/pci/pci.h | 33 +++++++++++++++++++++++++++++++++
 2 files changed, 50 insertions(+)

diff --git a/hw/pci/pci.c b/hw/pci/pci.c
index fc4954ac81..dfa5a0259e 100644
--- a/hw/pci/pci.c
+++ b/hw/pci/pci.c
@@ -2939,6 +2939,23 @@ AddressSpace *pci_device_iommu_address_space(PCIDevice *dev)
     return &address_space_memory;
 }
 
+int pci_iommu_init_iotlb_notifier(PCIDevice *dev, IOMMUNotifier *n,
+                                  IOMMUNotify fn, void *opaque)
+{
+    PCIBus *bus;
+    PCIBus *iommu_bus;
+    int devfn;
+
+    pci_device_get_iommu_bus_devfn(dev, &bus, &iommu_bus, &devfn);
+    if (iommu_bus && iommu_bus->iommu_ops->init_iotlb_notifier) {
+        iommu_bus->iommu_ops->init_iotlb_notifier(bus, iommu_bus->iommu_opaque,
+                                                  devfn, n, fn, opaque);
+        return 0;
+    }
+
+    return -ENODEV;
+}
+
 bool pci_device_set_iommu_device(PCIDevice *dev, HostIOMMUDevice *hiod,
                                  Error **errp)
 {
diff --git a/include/hw/pci/pci.h b/include/hw/pci/pci.h
index d67ffe12db..f3016fd76f 100644
--- a/include/hw/pci/pci.h
+++ b/include/hw/pci/pci.h
@@ -442,6 +442,26 @@ typedef struct PCIIOMMUOps {
      */
     void (*get_iotlb_info)(void *opaque, uint8_t *addr_width,
                            uint32_t *min_page_size);
+    /**
+     * @init_iotlb_notifier: initialize an IOMMU notifier.
+     *
+     * Optional callback.
+     *
+     * @bus: the #PCIBus of the PCI device.
+     *
+     * @opaque: the data passed to pci_setup_iommu().
+     *
+     * @devfn: device and function number of the PCI device.
+     *
+     * @n: the notifier to be initialized.
+     *
+     * @fn: the callback to be installed.
+     *
+     * @user_opaque: a user pointer that can be used to track a state.
+     */
+    void (*init_iotlb_notifier)(PCIBus *bus, void *opaque, int devfn,
+                                IOMMUNotifier *n, IOMMUNotify fn,
+                                void *user_opaque);
 } PCIIOMMUOps;
 
 AddressSpace *pci_device_iommu_address_space(PCIDevice *dev);
@@ -462,6 +482,19 @@ void pci_device_unset_iommu_device(PCIDevice *dev);
 int pci_iommu_get_iotlb_info(PCIDevice *dev, uint8_t *addr_width,
                              uint32_t *min_page_size);
 
+/**
+ * pci_iommu_init_iotlb_notifier: initialize an IOMMU notifier.
+ *
+ * This function is used by devices before registering an IOTLB notifier.
+ *
+ * @dev: the device.
+ * @n: the notifier to be initialized.
+ * @fn: the callback to be installed.
+ * @opaque: a user pointer that can be used to track a state.
+ */
+int pci_iommu_init_iotlb_notifier(PCIDevice *dev, IOMMUNotifier *n,
+                                  IOMMUNotify fn, void *opaque);
+
 /**
  * pci_setup_iommu: Initialize specific IOMMU handlers for a PCIBus
  *

From e9b457500adb023229a08ece3a8d7f5866dd360e Mon Sep 17 00:00:00 2001
From: CLEMENT MATHIEU--DRIF <clement.mathieu--drif@eviden.com>
Date: Tue, 20 May 2025 07:19:03 +0000
Subject: [PATCH 1341/2760] pci: Add a pci-level API for ATS

Devices implementing ATS can send translation requests using
pci_ats_request_translation. The invalidation events are sent
back to the device using the iommu notifier managed with
pci_iommu_register_iotlb_notifier / pci_iommu_unregister_iotlb_notifier.

Signed-off-by: Clement Mathieu--Drif <clement.mathieu--drif@eviden.com>
Co-authored-by: Ethan Milon <ethan.milon@eviden.com>
Message-Id: <20250520071823.764266-11-clement.mathieu--drif@eviden.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/pci/pci.c         |  81 ++++++++++++++++++++++++++++
 include/hw/pci/pci.h | 126 +++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 207 insertions(+)

diff --git a/hw/pci/pci.c b/hw/pci/pci.c
index dfa5a0259e..0c63cb4bbe 100644
--- a/hw/pci/pci.c
+++ b/hw/pci/pci.c
@@ -2987,6 +2987,87 @@ void pci_device_unset_iommu_device(PCIDevice *dev)
     }
 }
 
+ssize_t pci_ats_request_translation(PCIDevice *dev, uint32_t pasid,
+                                    bool priv_req, bool exec_req,
+                                    hwaddr addr, size_t length,
+                                    bool no_write, IOMMUTLBEntry *result,
+                                    size_t result_length,
+                                    uint32_t *err_count)
+{
+    PCIBus *bus;
+    PCIBus *iommu_bus;
+    int devfn;
+
+    if (!dev->is_master ||
+            ((pasid != PCI_NO_PASID) && !pcie_pasid_enabled(dev))) {
+        return -EPERM;
+    }
+
+    if (result_length == 0) {
+        return -ENOSPC;
+    }
+
+    if (!pcie_ats_enabled(dev)) {
+        return -EPERM;
+    }
+
+    pci_device_get_iommu_bus_devfn(dev, &bus, &iommu_bus, &devfn);
+    if (iommu_bus && iommu_bus->iommu_ops->ats_request_translation) {
+        return iommu_bus->iommu_ops->ats_request_translation(bus,
+                                                     iommu_bus->iommu_opaque,
+                                                     devfn, pasid, priv_req,
+                                                     exec_req, addr, length,
+                                                     no_write, result,
+                                                     result_length, err_count);
+    }
+
+    return -ENODEV;
+}
+
+int pci_iommu_register_iotlb_notifier(PCIDevice *dev, uint32_t pasid,
+                                      IOMMUNotifier *n)
+{
+    PCIBus *bus;
+    PCIBus *iommu_bus;
+    int devfn;
+
+    if ((pasid != PCI_NO_PASID) && !pcie_pasid_enabled(dev)) {
+        return -EPERM;
+    }
+
+    pci_device_get_iommu_bus_devfn(dev, &bus, &iommu_bus, &devfn);
+    if (iommu_bus && iommu_bus->iommu_ops->register_iotlb_notifier) {
+        iommu_bus->iommu_ops->register_iotlb_notifier(bus,
+                                           iommu_bus->iommu_opaque, devfn,
+                                           pasid, n);
+        return 0;
+    }
+
+    return -ENODEV;
+}
+
+int pci_iommu_unregister_iotlb_notifier(PCIDevice *dev, uint32_t pasid,
+                                        IOMMUNotifier *n)
+{
+    PCIBus *bus;
+    PCIBus *iommu_bus;
+    int devfn;
+
+    if ((pasid != PCI_NO_PASID) && !pcie_pasid_enabled(dev)) {
+        return -EPERM;
+    }
+
+    pci_device_get_iommu_bus_devfn(dev, &bus, &iommu_bus, &devfn);
+    if (iommu_bus && iommu_bus->iommu_ops->unregister_iotlb_notifier) {
+        iommu_bus->iommu_ops->unregister_iotlb_notifier(bus,
+                                                        iommu_bus->iommu_opaque,
+                                                        devfn, pasid, n);
+        return 0;
+    }
+
+    return -ENODEV;
+}
+
 int pci_iommu_get_iotlb_info(PCIDevice *dev, uint8_t *addr_width,
                              uint32_t *min_page_size)
 {
diff --git a/include/hw/pci/pci.h b/include/hw/pci/pci.h
index f3016fd76f..5d72607ed5 100644
--- a/include/hw/pci/pci.h
+++ b/include/hw/pci/pci.h
@@ -462,6 +462,80 @@ typedef struct PCIIOMMUOps {
     void (*init_iotlb_notifier)(PCIBus *bus, void *opaque, int devfn,
                                 IOMMUNotifier *n, IOMMUNotify fn,
                                 void *user_opaque);
+    /**
+     * @register_iotlb_notifier: setup an IOTLB invalidation notifier.
+     *
+     * Callback required if devices are allowed to cache translations.
+     *
+     * @bus: the #PCIBus of the PCI device.
+     *
+     * @opaque: the data passed to pci_setup_iommu().
+     *
+     * @devfn: device and function number of the PCI device.
+     *
+     * @pasid: the pasid of the address space to watch.
+     *
+     * @n: the notifier to register.
+     */
+    void (*register_iotlb_notifier)(PCIBus *bus, void *opaque, int devfn,
+                                    uint32_t pasid, IOMMUNotifier *n);
+    /**
+     * @unregister_iotlb_notifier: remove an IOTLB invalidation notifier.
+     *
+     * Callback required if devices are allowed to cache translations.
+     *
+     * @bus: the #PCIBus of the PCI device.
+     *
+     * @opaque: the data passed to pci_setup_iommu().
+     *
+     * @devfn: device and function number of the PCI device.
+     *
+     * @pasid: the pasid of the address space to stop watching.
+     *
+     * @n: the notifier to unregister.
+     */
+    void (*unregister_iotlb_notifier)(PCIBus *bus, void *opaque, int devfn,
+                                      uint32_t pasid, IOMMUNotifier *n);
+    /**
+     * @ats_request_translation: issue an ATS request.
+     *
+     * Callback required if devices are allowed to use the address
+     * translation service.
+     *
+     * @bus: the #PCIBus of the PCI device.
+     *
+     * @opaque: the data passed to pci_setup_iommu().
+     *
+     * @devfn: device and function number of the PCI device.
+     *
+     * @pasid: the pasid of the address space to use for the request.
+     *
+     * @priv_req: privileged mode bit (PASID TLP).
+     *
+     * @exec_req: execute request bit (PASID TLP).
+     *
+     * @addr: start address of the memory range to be translated.
+     *
+     * @length: length of the memory range in bytes.
+     *
+     * @no_write: request a read-only translation (if supported).
+     *
+     * @result: buffer in which the TLB entries will be stored.
+     *
+     * @result_length: result buffer length.
+     *
+     * @err_count: number of untranslated subregions.
+     *
+     * Returns: the number of translations stored in the result buffer, or
+     * -ENOMEM if the buffer is not large enough.
+     */
+    ssize_t (*ats_request_translation)(PCIBus *bus, void *opaque, int devfn,
+                                       uint32_t pasid, bool priv_req,
+                                       bool exec_req, hwaddr addr,
+                                       size_t length, bool no_write,
+                                       IOMMUTLBEntry *result,
+                                       size_t result_length,
+                                       uint32_t *err_count);
 } PCIIOMMUOps;
 
 AddressSpace *pci_device_iommu_address_space(PCIDevice *dev);
@@ -495,6 +569,58 @@ int pci_iommu_get_iotlb_info(PCIDevice *dev, uint8_t *addr_width,
 int pci_iommu_init_iotlb_notifier(PCIDevice *dev, IOMMUNotifier *n,
                                   IOMMUNotify fn, void *opaque);
 
+/**
+ * pci_ats_request_translation: perform an ATS request.
+ *
+ * Returns the number of translations stored in @result in case of success,
+ * a negative error code otherwise.
+ * -ENOMEM is returned when the result buffer is not large enough to store
+ * all the translations.
+ *
+ * @dev: the ATS-capable PCI device.
+ * @pasid: the pasid of the address space in which the translation will be done.
+ * @priv_req: privileged mode bit (PASID TLP).
+ * @exec_req: execute request bit (PASID TLP).
+ * @addr: start address of the memory range to be translated.
+ * @length: length of the memory range in bytes.
+ * @no_write: request a read-only translation (if supported).
+ * @result: buffer in which the TLB entries will be stored.
+ * @result_length: result buffer length.
+ * @err_count: number of untranslated subregions.
+ */
+ssize_t pci_ats_request_translation(PCIDevice *dev, uint32_t pasid,
+                                    bool priv_req, bool exec_req,
+                                    hwaddr addr, size_t length,
+                                    bool no_write, IOMMUTLBEntry *result,
+                                    size_t result_length,
+                                    uint32_t *err_count);
+
+/**
+ * pci_iommu_register_iotlb_notifier: register a notifier for changes to
+ * IOMMU translation entries in a specific address space.
+ *
+ * Returns 0 on success, or a negative errno otherwise.
+ *
+ * @dev: the device that wants to get notified.
+ * @pasid: the pasid of the address space to track.
+ * @n: the notifier to register.
+ */
+int pci_iommu_register_iotlb_notifier(PCIDevice *dev, uint32_t pasid,
+                                      IOMMUNotifier *n);
+
+/**
+ * pci_iommu_unregister_iotlb_notifier: unregister a notifier that has been
+ * registerd with pci_iommu_register_iotlb_notifier.
+ *
+ * Returns 0 on success, or a negative errno otherwise.
+ *
+ * @dev: the device that wants to stop notifications.
+ * @pasid: the pasid of the address space to stop tracking.
+ * @n: the notifier to unregister.
+ */
+int pci_iommu_unregister_iotlb_notifier(PCIDevice *dev, uint32_t pasid,
+                                        IOMMUNotifier *n);
+
 /**
  * pci_setup_iommu: Initialize specific IOMMU handlers for a PCIBus
  *

From f0f37daf8e67c7208641aec5e238197279ca7331 Mon Sep 17 00:00:00 2001
From: CLEMENT MATHIEU--DRIF <clement.mathieu--drif@eviden.com>
Date: Tue, 20 May 2025 07:19:04 +0000
Subject: [PATCH 1342/2760] pci: Add a PCI-level API for PRI

A device can send a PRI request to the IOMMU using pci_pri_request_page.
The PRI response is sent back using the notifier managed with
pci_pri_register_notifier and pci_pri_unregister_notifier.

Signed-off-by: Clement Mathieu--Drif <clement.mathieu--drif@eviden.com>
Co-authored-by: Ethan Milon <ethan.milon@eviden.com>
Message-Id: <20250520071823.764266-12-clement.mathieu--drif@eviden.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/pci/pci.c         |  66 ++++++++++++++++++++++
 include/hw/pci/pci.h | 130 +++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 196 insertions(+)

diff --git a/hw/pci/pci.c b/hw/pci/pci.c
index 0c63cb4bbe..c6b5768f3a 100644
--- a/hw/pci/pci.c
+++ b/hw/pci/pci.c
@@ -2987,6 +2987,72 @@ void pci_device_unset_iommu_device(PCIDevice *dev)
     }
 }
 
+int pci_pri_request_page(PCIDevice *dev, uint32_t pasid, bool priv_req,
+                         bool exec_req, hwaddr addr, bool lpig,
+                         uint16_t prgi, bool is_read, bool is_write)
+{
+    PCIBus *bus;
+    PCIBus *iommu_bus;
+    int devfn;
+
+    if (!dev->is_master ||
+            ((pasid != PCI_NO_PASID) && !pcie_pasid_enabled(dev))) {
+        return -EPERM;
+    }
+
+    if (!pcie_pri_enabled(dev)) {
+        return -EPERM;
+    }
+
+    pci_device_get_iommu_bus_devfn(dev, &bus, &iommu_bus, &devfn);
+    if (iommu_bus && iommu_bus->iommu_ops->pri_request_page) {
+        return iommu_bus->iommu_ops->pri_request_page(bus,
+                                                     iommu_bus->iommu_opaque,
+                                                     devfn, pasid, priv_req,
+                                                     exec_req, addr, lpig, prgi,
+                                                     is_read, is_write);
+    }
+
+    return -ENODEV;
+}
+
+int pci_pri_register_notifier(PCIDevice *dev, uint32_t pasid,
+                              IOMMUPRINotifier *notifier)
+{
+    PCIBus *bus;
+    PCIBus *iommu_bus;
+    int devfn;
+
+    if (!dev->is_master ||
+            ((pasid != PCI_NO_PASID) && !pcie_pasid_enabled(dev))) {
+        return -EPERM;
+    }
+
+    pci_device_get_iommu_bus_devfn(dev, &bus, &iommu_bus, &devfn);
+    if (iommu_bus && iommu_bus->iommu_ops->pri_register_notifier) {
+        iommu_bus->iommu_ops->pri_register_notifier(bus,
+                                                    iommu_bus->iommu_opaque,
+                                                    devfn, pasid, notifier);
+        return 0;
+    }
+
+    return -ENODEV;
+}
+
+void pci_pri_unregister_notifier(PCIDevice *dev, uint32_t pasid)
+{
+    PCIBus *bus;
+    PCIBus *iommu_bus;
+    int devfn;
+
+    pci_device_get_iommu_bus_devfn(dev, &bus, &iommu_bus, &devfn);
+    if (iommu_bus && iommu_bus->iommu_ops->pri_unregister_notifier) {
+        iommu_bus->iommu_ops->pri_unregister_notifier(bus,
+                                                      iommu_bus->iommu_opaque,
+                                                      devfn, pasid);
+    }
+}
+
 ssize_t pci_ats_request_translation(PCIDevice *dev, uint32_t pasid,
                                     bool priv_req, bool exec_req,
                                     hwaddr addr, size_t length,
diff --git a/include/hw/pci/pci.h b/include/hw/pci/pci.h
index 5d72607ed5..a6854dad2b 100644
--- a/include/hw/pci/pci.h
+++ b/include/hw/pci/pci.h
@@ -375,6 +375,28 @@ void pci_bus_get_w64_range(PCIBus *bus, Range *range);
 
 void pci_device_deassert_intx(PCIDevice *dev);
 
+/* Page Request Interface */
+typedef enum {
+    IOMMU_PRI_RESP_SUCCESS,
+    IOMMU_PRI_RESP_INVALID_REQUEST,
+    IOMMU_PRI_RESP_FAILURE,
+} IOMMUPRIResponseCode;
+
+typedef struct IOMMUPRIResponse {
+    IOMMUPRIResponseCode response_code;
+    uint16_t prgi;
+} IOMMUPRIResponse;
+
+struct IOMMUPRINotifier;
+
+typedef void (*IOMMUPRINotify)(struct IOMMUPRINotifier *notifier,
+                               IOMMUPRIResponse *response);
+
+typedef struct IOMMUPRINotifier {
+    IOMMUPRINotify notify;
+} IOMMUPRINotifier;
+
+#define PCI_PRI_PRGI_MASK 0x1ffU
 
 /**
  * struct PCIIOMMUOps: callbacks structure for specific IOMMU handlers
@@ -536,6 +558,72 @@ typedef struct PCIIOMMUOps {
                                        IOMMUTLBEntry *result,
                                        size_t result_length,
                                        uint32_t *err_count);
+    /**
+     * @pri_register_notifier: setup the PRI completion callback.
+     *
+     * Callback required if devices are allowed to use the page request
+     * interface.
+     *
+     * @bus: the #PCIBus of the PCI device.
+     *
+     * @opaque: the data passed to pci_setup_iommu().
+     *
+     * @devfn: device and function number of the PCI device.
+     *
+     * @pasid: the pasid of the address space to track.
+     *
+     * @notifier: the notifier to register.
+     */
+    void (*pri_register_notifier)(PCIBus *bus, void *opaque, int devfn,
+                                  uint32_t pasid, IOMMUPRINotifier *notifier);
+    /**
+     * @pri_unregister_notifier: remove the PRI completion callback.
+     *
+     * Callback required if devices are allowed to use the page request
+     * interface.
+     *
+     * @bus: the #PCIBus of the PCI device.
+     *
+     * @opaque: the data passed to pci_setup_iommu().
+     *
+     * @devfn: device and function number of the PCI device.
+     *
+     * @pasid: the pasid of the address space to stop tracking.
+     */
+    void (*pri_unregister_notifier)(PCIBus *bus, void *opaque, int devfn,
+                                    uint32_t pasid);
+    /**
+     * @pri_request_page: issue a PRI request.
+     *
+     * Callback required if devices are allowed to use the page request
+     * interface.
+     *
+     * @bus: the #PCIBus of the PCI device.
+     *
+     * @opaque: the data passed to pci_setup_iommu().
+     *
+     * @devfn: device and function number of the PCI device.
+     *
+     * @pasid: the pasid of the address space to use for the request.
+     *
+     * @priv_req: privileged mode bit (PASID TLP).
+     *
+     * @exec_req: execute request bit (PASID TLP).
+     *
+     * @addr: untranslated address of the requested page.
+     *
+     * @lpig: last page in group.
+     *
+     * @prgi: page request group index.
+     *
+     * @is_read: request read access.
+     *
+     * @is_write: request write access.
+     */
+    int (*pri_request_page)(PCIBus *bus, void *opaque, int devfn,
+                            uint32_t pasid, bool priv_req, bool exec_req,
+                            hwaddr addr, bool lpig, uint16_t prgi, bool is_read,
+                            bool is_write);
 } PCIIOMMUOps;
 
 AddressSpace *pci_device_iommu_address_space(PCIDevice *dev);
@@ -595,6 +683,48 @@ ssize_t pci_ats_request_translation(PCIDevice *dev, uint32_t pasid,
                                     size_t result_length,
                                     uint32_t *err_count);
 
+/**
+ * pci_pri_request_page: perform a PRI request.
+ *
+ * Returns 0 if the PRI request has been sent to the guest OS,
+ * an error code otherwise.
+ *
+ * @dev: the PRI-capable PCI device.
+ * @pasid: the pasid of the address space in which the translation will be done.
+ * @priv_req: privileged mode bit (PASID TLP).
+ * @exec_req: execute request bit (PASID TLP).
+ * @addr: untranslated address of the requested page.
+ * @lpig: last page in group.
+ * @prgi: page request group index.
+ * @is_read: request read access.
+ * @is_write: request write access.
+ */
+int pci_pri_request_page(PCIDevice *dev, uint32_t pasid, bool priv_req,
+                         bool exec_req, hwaddr addr, bool lpig,
+                         uint16_t prgi, bool is_read, bool is_write);
+
+/**
+ * pci_pri_register_notifier: register the PRI callback for a given address
+ * space.
+ *
+ * Returns 0 on success, an error code otherwise.
+ *
+ * @dev: the PRI-capable PCI device.
+ * @pasid: the pasid of the address space to track.
+ * @notifier: the notifier to register.
+ */
+int pci_pri_register_notifier(PCIDevice *dev, uint32_t pasid,
+                              IOMMUPRINotifier *notifier);
+
+/**
+ * pci_pri_unregister_notifier: remove the PRI callback from a given address
+ * space.
+ *
+ * @dev: the PRI-capable PCI device.
+ * @pasid: the pasid of the address space to stop tracking.
+ */
+void pci_pri_unregister_notifier(PCIDevice *dev, uint32_t pasid);
+
 /**
  * pci_iommu_register_iotlb_notifier: register a notifier for changes to
  * IOMMU translation entries in a specific address space.

From 75d4680c55498d6cf4f89b31e52d97f90d7fc46e Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Tue, 20 May 2025 21:01:51 +0800
Subject: [PATCH 1343/2760] uefi-test-tools:: Add LoongArch64 support

Add support to build bios-tables-test iso image for LoongArch system.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Acked-by: Gerd Hoffmann <kraxel@redhat.com>

Message-Id: <20250520130158.767083-2-maobibo@loongson.cn>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 tests/uefi-test-tools/Makefile                         |  5 +++--
 .../UefiTestToolsPkg/UefiTestToolsPkg.dsc              |  6 +++++-
 tests/uefi-test-tools/uefi-test-build.config           | 10 ++++++++++
 3 files changed, 18 insertions(+), 3 deletions(-)

diff --git a/tests/uefi-test-tools/Makefile b/tests/uefi-test-tools/Makefile
index f4eaebd8ff..8ee6fb3571 100644
--- a/tests/uefi-test-tools/Makefile
+++ b/tests/uefi-test-tools/Makefile
@@ -12,7 +12,7 @@
 
 edk2_dir              := ../../roms/edk2
 images_dir            := ../data/uefi-boot-images
-emulation_targets     := arm aarch64 i386 x86_64 riscv64
+emulation_targets     := arm aarch64 i386 x86_64 riscv64 loongarch64
 uefi_binaries         := bios-tables-test
 intermediate_suffixes := .efi .fat .iso.raw
 
@@ -56,7 +56,8 @@ Build/%.iso.raw: Build/%.fat
 # stripped from, the argument.
 map_arm_to_uefi     = $(subst arm,ARM,$(1))
 map_aarch64_to_uefi = $(subst aarch64,AA64,$(call map_arm_to_uefi,$(1)))
-map_riscv64_to_uefi = $(subst riscv64,RISCV64,$(call map_aarch64_to_uefi,$(1)))
+map_loongarch64_to_uefi = $(subst loongarch64,LOONGARCH64,$(call map_aarch64_to_uefi,$(1)))
+map_riscv64_to_uefi = $(subst riscv64,RISCV64,$(call map_loongarch64_to_uefi,$(1)))
 map_i386_to_uefi    = $(subst i386,IA32,$(call map_riscv64_to_uefi,$(1)))
 map_x86_64_to_uefi  = $(subst x86_64,X64,$(call map_i386_to_uefi,$(1)))
 map_to_uefi         = $(subst .,,$(call map_x86_64_to_uefi,$(1)))
diff --git a/tests/uefi-test-tools/UefiTestToolsPkg/UefiTestToolsPkg.dsc b/tests/uefi-test-tools/UefiTestToolsPkg/UefiTestToolsPkg.dsc
index 0902fd3c73..facf8df1fa 100644
--- a/tests/uefi-test-tools/UefiTestToolsPkg/UefiTestToolsPkg.dsc
+++ b/tests/uefi-test-tools/UefiTestToolsPkg/UefiTestToolsPkg.dsc
@@ -19,7 +19,7 @@
   PLATFORM_VERSION        = 0.1
   PLATFORM_NAME           = UefiTestTools
   SKUID_IDENTIFIER        = DEFAULT
-  SUPPORTED_ARCHITECTURES = ARM|AARCH64|IA32|X64|RISCV64
+  SUPPORTED_ARCHITECTURES = ARM|AARCH64|IA32|X64|RISCV64|LOONGARCH64
   BUILD_TARGETS           = DEBUG
 
 [BuildOptions.IA32]
@@ -65,6 +65,10 @@
 [LibraryClasses.RISCV64]
   BaseMemoryLib|MdePkg/Library/BaseMemoryLib/BaseMemoryLib.inf
 
+[LibraryClasses.LOONGARCH64]
+  BaseMemoryLib|MdePkg/Library/BaseMemoryLib/BaseMemoryLib.inf
+  StackCheckLib|MdePkg/Library/StackCheckLibNull/StackCheckLibNull.inf
+
 [PcdsFixedAtBuild]
   gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8040004F
   gEfiMdePkgTokenSpaceGuid.PcdDebugPropertyMask|0x2F
diff --git a/tests/uefi-test-tools/uefi-test-build.config b/tests/uefi-test-tools/uefi-test-build.config
index a4c61fc97a..8bf4826634 100644
--- a/tests/uefi-test-tools/uefi-test-build.config
+++ b/tests/uefi-test-tools/uefi-test-build.config
@@ -21,6 +21,16 @@ dest = ./Build
 arch = AARCH64
 cpy1 = AARCH64/BiosTablesTest.efi  bios-tables-test.aarch64.efi
 
+####################################################################################
+# loongarch64
+
+[build.loongarch64]
+conf = UefiTestToolsPkg/UefiTestToolsPkg.dsc
+plat = UefiTestTools
+dest = ./Build
+arch = LOONGARCH64
+cpy1 = LOONGARCH64/BiosTablesTest.efi  bios-tables-test.loongarch64.efi
+
 ####################################################################################
 # riscv64
 

From 0265723eba8a612d8a94d190cef988cf8d616862 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Tue, 20 May 2025 21:01:52 +0800
Subject: [PATCH 1344/2760] tests/data/uefi-boot-images: Add ISO image for
 LoongArch system

To test ACPI tables, edk2 needs to be booted with a disk image having
EFI partition. This image is created using UefiTestToolsPkg.

The image is generated with the following command:
  make -f tests/uefi-test-tools/Makefile

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
Message-Id: <20250520130158.767083-3-maobibo@loongson.cn>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 .../bios-tables-test.loongarch64.iso.qcow2      | Bin 0 -> 12800 bytes
 1 file changed, 0 insertions(+), 0 deletions(-)
 create mode 100644 tests/data/uefi-boot-images/bios-tables-test.loongarch64.iso.qcow2

diff --git a/tests/data/uefi-boot-images/bios-tables-test.loongarch64.iso.qcow2 b/tests/data/uefi-boot-images/bios-tables-test.loongarch64.iso.qcow2
new file mode 100644
index 0000000000000000000000000000000000000000..18daee0c52fcc703a0645dbcdc598aa1f101d96b
GIT binary patch
literal 12800
zcmWG^^Zd=gz`)Fa3OK=Bwgxc8z`(!@VX#3c1||^A2qK8UEDQ_`1w^PDRWe{90E(gk
zvwYOzfeZmg1{maGU}s=tU}9imV8$RJqAU!|7$wC(x_#7cs)Ycgq~~CO(0o)gchsQ4
z9Rdzu=W#JWX>TZf3oOjQ026--<D=6M_1ygE;>7Zy`elh#kFE}?UmIPVSUyz01upea
z`CeS|31A8CB@lHy;ZQmkN;iY02QiUcQf6pikdpG@;}`DUfCId9Vw?Wdemr69aFA7m
z%RGTaNg(aPgM<f79EF_<OO86U2sN{`s2@DQxX41{j)Y{R4y)RXIvYMIRu@Kwy?v*-
znhgY8-_Ad?DK_Nz6qijrg*_W9r>N-t`7ggxY}d*QuB~zs67OugxeHjF4?fG-YsB)J
zIfx_YnBw6C*{7=FpB4zO6cV2El{HE;-{Gs!^MtCWFJ#NY+cXkZ$u9}&TR8L88u!<8
zc%MDZ`TDG6!S9motX!J)8Nc)mQe-R-i~X$X_|0IyqU_kpU%%hv+b{+PNU)Z$@icQX
zFeDd%Jz4TKkmDo&C!UYt9DD_(-%380l<|E0@;zBW%tL5xkqD0#1H<q4Z;}!cPMk2{
za#LeqNKToMkdTm&BEhOG4B{~`ak9C!1sW(ZG6W}0NMK;*WaAS!dNAO$)}hoROAj15
zaDc<5hsUcW#6Zfx!!g9e(M2LbOG2T>PTl|igC7F!>bB;`1+tylWZ67Bsyt1E7rxp#
z=g(i~FLMrNxijW6G9=fWZxCMN#T|Q<G0oJ#<6)Q?SDOI?Lv^mPqPg|j2z}j+EsdS6
z6B|1lS2jLmS8isQz{<?aGixbN)b~k7pSw%FgSx#%MDEBq^Yn^{i2Qi+-SzsKK&ya5
zvfEno&8-hdHtx7C-!pHHsI~UbU-2GpX&adYo<5zfp`xYo^!aoZwWmw8mZXTKzt+@X
zd9p-JY`Ip-GtuQ@3r{S6`b1nLL`&t_(ho(VB1^@@nP*Pry18;Hm+DV0Rab|ZUyhuy
zVYRijWsTEo3v}S*h-GE?{ZXDJLRjL4w1kDY!Jp^p60FLc3^+u+Po2@frt7Jz7Z~s$
zA)$cxw$N5pE+^xL#?`ZzGl_64IAv_u)3lJE;c{>TGb0<@^$og#(TfyJgqb;BynHx`
z-P_pW=kNA}>FH?_tj+Qa=*o;C%F>xmThBC{VerCmhtUqh55{M{vUL4vXX5C-*m+Q%
z!&#!n;giBL`DW{8WoLnarN+(d&6D@ncl6iKT?lf;s-HSMoN7Fa8;&tBeC|zBkT#jH
zUX+h1Mp7bZ(u}|(b_OpD3ycj7R3r=xGz^@M$jnfXU=vv&A*(V&;Yy+4OEyNKJJknf
zG$t}m_?LL(fP!<Aos+|Qm92|f7$2pxtFiR*h%_9k((F|2<e5+qnb5LeVk7f~nN_YU
zEq|UA*na2^&!UT0EQ#%I4UWPFTK=uZ<r=8`CH(TdMi6xZ43KhGP!K{3RY1f=WFUOe
zY6va%3qnh5fXGV;K={%<5L%WILd&g&$SXuZ_=;~KwDNoit(pg+)t*3TjWUROEnWy;
zTNT3BfzrBAcj$hDi0j2b)akoJ_y#Hv+7LqF^7H_RFFm){@34Ug>x1Oy$K4DJ5>mGD
zEL36UZ#W{*$zgclS!1K(3fD)x8nac6HZco1yR+TUx@gG!YVw8NMs^1+^UNzd)<o=@
z^nUAKS?2%I%hP@C8y~5)er_H)m2a`uUY%86#BNl#9I~Dodg7kSqq&Vw+2fw<efPNP
zm}reZW4poWza6vHckO>;YM!F{MD2;1;n@>!zvdoQ?kY2Wy~pZ%<30Zs1$xrl(wA<?
zM3%HLnq|&c_{`|K_3oFdi{DSoYxObzJkcQdV9AH#<DX5JeUzEiaL)c^yu`M55hd?j
z*6b>MzhigZ>v<f)Y)?*2nm(oVPT}#_+}{rscH8G|d=<Cx+F!o2hU(?3pUBJYjCXv#
zZ_B#(J2n;9GsaG^^=5VyXuBW%JxL)U^~ou1r#r0w8_$X+i9Ts@)fG<CIdaR}<Q1Ec
zXW`NXOIsPcMW#)wo?v9J)Ec!^B;?AGn>8F!ci)|P^V_CaCc?2QFq5B=ebdiY9V_LE
zJJ<4qUKR12|2n(Jy02Y3+;*c*%q+(Epz90r&6j?WYdXmH?W04w;n|scwttU&$Gx}u
z-<+pxnxR@!f~;;KwaQrzb)UN}vVE`pZVSKG=D6eGf63_YjZQavB3af<t5McXel$@z
z%tJ2viQ>P?j{S0Tx6eGjc(sPJ%e4P~f6PAGcgPF;pV$6*-ri`vR~)Bj-DsTnL~XJ1
zacQF`kB@Nd?Ojm)qC%Jbr}e2r28(mvA29DJJ{x6{{M+!W^%QY)p^F6p3hNimU44Pi
zcUEU-=IhUQ>&vexKl>H2Eplm+Qh&3HTb<HskCfbmC!L0$zFa%8%j{FnopUEY9{M-G
zEGo0Lw=VV7wQAMvb#A@akMFiwev{vK;(l)#N0H<Ejh_n&@CxN6+WJQvc1z=9<z{`$
zCYn@uw6S|x=enH@nN6{OCazfBadqC*2mNZZ)S6^GRhLvp-*~3aA)&~b>7x{;_R%bV
z5{H=lvs!!O{EEYC4xaXD?W{@@GJUO@#n(COzeiT1hwXjkuS!Z=B_>4~EtzH;G*x4w
zTtJsRx4GDhJ59}HY3cTXw>=ke#qj%-CoZ_uYqsw5nIMfjlRY2G`EqP8IelWe&z<KA
zaWmbP94$Drv+S~E(htV(DaJ2qCKVRU|EVPV!~Q|iX2T8tOm~+qdpIZdio_oomA|hA
zU*2E6WPRMkwuz3{ogap={t?rkRLFkPxU;(F{+-#)Yga!%eRQ+6o3ZQbEN$ZrJF8CG
zowut$T%7l8d(M~2zxVs20!~l*bB*z=NdEWdALc#Z_VaC~)y#P@z2+Zoe%WC6>*l!=
z3N8Ys2e<G}bmDxP{PTYQpU<qXs{_yVaeiO_KJoqGEz$7~JHIZnE3T;x=R0`1xkTf9
zbzW=AuVr>ohAZdXQnr<zIFH-&y!0h*xtHZO?SGYPTsNFuo&Vcj;l|Tnmt!Z@Gt~B-
z_hJeZIktbN-_j>eSuL673vSAOWQ@A!(RHZxflY(aHRdfJ{bvWZ#P|dVZs9Bn7I|WQ
zXTebcHd{xpNa@>KiY#SC6(>Z=oO?Lu{hxjO`Wy5FTy4}O<q}1sCcSRfXiE?I-1L&W
zX=N<0s{5y+xKCXZ_GEeFd7tD_NcNsTwP9<M;#ooV>1Trcr+skU|86ClI@iaW?RMd1
z5g(bYHg&m1-Ah;UtmlmWb8ustrFs65i?4M4`OSGSrTNGHIUjV=_q)%DoBMU8bJ8i#
zKhGRo#VjJ^&!1ZoznELHt>Ap}3x?Iax^11$CzO_n?oFt8HnHi5@XvdJrYpC_o#gfn
zlS%E=iJB|xTJHIHjf2S)_IEBF?*FPw)@z<vGVS>HCm-85wrFVQIZrwNc-x0#JMYZm
zh^hTOyP$cR{fFYYZ#(aCD!!HfwR57H>0MjpyL}o}v(ut^Ztm5JIQj8R(LH1BL&mG8
zd}q%M1eY{(@9q|0=2EiU({MEOWZsqy!B>(*xw}g^W0EHp7}jlVlE2EeJYvp*wPu<}
zPB{r|y!&=t$JE|1uBHd}8w_8+X>3aRc%$-n+PyOdYx7P`zO6K;k-fY_{Rq2LmBK0i
z2hX>Cd&#=**`1aRAsH$kcs^DOK9S+zNZk0S;)9#*iGzZ<$+A9TQsLZ3{5htia=Q4K
zOg^kI$zh}DmG7KaqV7(~Jw4^EN$@u9pl#wybb>T_8M1!vuRGn^w$t#dk8_^ZGP#v@
zZ#|9*Zn+v#vvu{4SwS^_T|e?(s4>2<M_40I&ZonwyXD-TY~~~VoFU2K7Sq0ex*ya0
zRJhW5`<i3RT?_o(HtoMB^RYd~v!Aozv~p?&_uk2okK_eb#CV>)X0UCu>gQRq-+VRI
zRZ8zF&wATcy?ceLQ>rn~xfI*elNvW{wXciX{Qpz#oUc>c^0<$d8(e?)$HKR!TK{@u
zm!$bZ8D_&53)ZuDPq*E3d+U<7)q8HgPPedi{S!F*`JZ#I7yM)Oov<-GI8da$e&_m)
z&61NQEcY+0XwH4#ykLdJi$_z{N?s~h#AwJy1--cB$Ca78@cOnAE{zfc*M(pC3k*Hl
z^`1LwW?6Rz9C2!PxwKGEPj=Sy*E?T6D%kN{hVOp)Ip2D-N6#3Uc29nB`Dw(p_sg4l
z+7+vBTz$qS^1S(&duD(7C12&T{h!{fcJcR{utsZAvEoU)A1fq;6b+&lu3Mqh_iUEP
zSz*`7i86a{EXp_-u*JeLaBli`%esOa>2Ej|c3tbb^`7a*;%nb-7H`oBo13n2@ocn)
zrCqT~u__1}s~W2sr@9`sEf>_-vv)3+Sz53$|JzC7d%}->oosVVDzZmDJ#p{4f1l0!
z`7=Kmt^d5Dc2@ykU1ItMrKsvRIVE3s?%T*tiuhb}<=$kU&#%iWW*%BmnWr6G^ZDl8
z<15P7aNLTF$$l!Zh5N*s=Nk%__e5=aGWYMPLuZ_AU#LH<VD1y0T+&ni?pxL(U(QoJ
z$*1%R^cMbNnE%*oJ)d6I_QMC<S@!;W>Jp#zVV!^2k*qVjzm=DmF3DIkw|Up8|3@}|
zOaK0IajEsAU*~QM*`4~o^S;IRO85M_?T63im;I8@ow(8aaDc$E_j}DQ96WgN#bvRc
zMK539e~>VNgU_{vCqLKo!ohcMXDIox$;im;iV%<$iFHv|l)ZBB;L+ISes|~itbV?9
z<x<gh_V@4h{l542o#MAC`Ukz3Uz98}>~j^`zLW2DxWccWhvylscg)yoTUW);#J`KH
z|H8^82ksa;$z?aEX>6Usmw92~xdkusYj&F|PubCZPV(uumrK-Z`|{)aUMuTQKXmAb
zk}xB4@oXEWYm@%&<Ec<p)(MEMy7K;)qB%p?;eYBScLXX$72?%m)9pTTh)w#JeCZ)i
zVNT=MeVlS>{|(ZPOHMz}-Xk9CS~scYtoy0V^^Du|9e0GC*eGbZf2&2`bIG|6H(i-@
zRYq8ruQI1(>U`$zcgxl{-&Ny(d*%5(*|%pq+wzZ8|2n_gX!eI0#XcEJIBzs>Sw2Hz
z)7lC9eRHypY`Z0!-u?LEe{0DNdtFZDT#}h-6~Akt<ve@QI+s`MQz!2BXL1xc_Iz6V
ztc1mjO5&If<-N7vpyncN<-4tQj@&*W?-~&u#@r<z0tI}1HcXr`Ln6NO>An36Tg6uJ
z&OKVFvVkuqF)`Kf=$*4Q_w)BnRr_#liQsCf2~z?++T|6+x~6!1U`*QeuyfAJjL9ww
z876Gmp`_+;?9r^8bkW<UqPLkn<~oZMl^*2^+9<p3hVi%c5x=%5H@PQIkbJbH%7$^p
zdH!_)_jM+pvVEmr;gnx`MB`uogP5-;=Wo1dJw;>kQ|mdM)k>e4HqK(?G}r0$zITB4
zyyJY&`tqZazfPDeDP5)fgymKIBR%)O(Rco4b!*P=Rnm7g>pCMcb8_?SC5xtg%Kvr1
zPQK%ijabg4rBd$>ntbqxxhVNZ?1+}+gp~{e-&16SZoEzkf6*4VC8b~F!#kO@OZTG>
z>f|hq_!qk|wBW|9mm5moZRlNdxa6XA$|bJ<X`d<^&m0!Lw8!n)&22j*Ki)sQPW#gH
zJLWQ3$=7~uP`}W;NPO#($NP`g?_sXrThCBC(a?k0P^9ht({<r3PMQ@3&4)RcK0D&u
zvg@ehs|N}p7Vb*}rdvhN4YHZLZe5p#Zp4v=C2Nzpj-EX0cr@^MS%HSGQm=k_n0fpB
z7M1_s@BL1WYmnXjwX=|UTMqx;_8DpHQYl@fj`uoQk88_Dm9%J2PR>t{zEG={(OBNW
zydkfFHA}a^^TVB^)!$EEcq7;7!)aUHw;=2OmW0>mwVm{B4lk>j{IhfW8<&5@Dcb@s
zNmtgeMJSys$z!zMdCbmT^pW|7^G`0kp5606mUEg8ht}=|RWJKhA8tONwspeK==E97
zC(T(ndqh2SmTlh3KXdYWqxET1`i<lzdbR`{EIP7UY5iB#&PSg_431jN?UOh=W%63y
z6u-Hqbw(Ew?P3^b{F{GecB|fveQYlctlK^p&yi2JKOn;w%2)bup5k}DuT8%~Dxb6^
z%Gny9di*cw?`^@Cafxz84;HqsdntBi;RMHtuE`%m13pg;m5aHc`D8|bBC8??%dNIm
ze|bR-(da;t<NGZQH5-MR&K}m_%U|`rqxr$33lI6cG)n}ujx20#Q8)d^U~L+>IxaAS
zTg<U#+hoZ<;w^fuzbkG=?Fzf7nD9bmgSVDeMfEy8KKXYA=WXwQ-no1g?{%-X=~Eu2
z-Y?jh_rutxM!2t4`{2JH;aC0!yxroJ#sBKOxJXd`wiRDRS$E&m)GG;?P=2tTMb6&4
zN<v^sxPoo-mFB`NCz?}OLUWr;%rs2eJ{TAZ&XS%r(Wdc~k@HcBdAU;aoR562J7R3q
zZ@XLbRII?Nj+zHQciQ)T4tEH9cB(Y<*Ou$O^Y`ApVRyzk-QZc)J?1&56S9_b?+HEs
zF#Oa6+l~58sVl3_U$3;f&ulrH#qJW<@pO$na%NM6*nQH~#oN9<aJ_ZmLWljWX|w)L
zt9=zSxBqi--nrA3JKqRQ)0$+cUHf!N&*=$!EDL9gZ||~DY(E*Te#f%)*Q`}_&Dj|r
zf{dS~3V*hi{hX!wY`Vj~n5+-cS07BRI+LyStknKlrs&7=mw%&oi2M?gb8Ef4zw%0U
zz%KSvcCSRfZu@gm>6k$a=j<u5D>Vvs`@BEJH@{}d|I&$u86u7%ZU5)`dMK!~?Rm`i
zq~xe}+F`{TH`0zA)%Fp*@koaye9>LCa1J%YoheO=WadPi=$w$WSU`8tf~~EV>4J`v
z)Ld6h5IFcsYr8<tyVIu&kDN-9c=q>xwf+Cu8SPrz=Pz)OpRC1ZD3=?sl;83WS5l?_
z(V|<OPkE9occ(x3TdMp#tY^-3w`<JG;!`Ge_e~VG65}%vvt8`v9<yyLcm5k$uG3;(
zj!gQOm$Q0F)bH(a`rq3oad#<~t*ZU!ZO7Lb8n1Ab*mAe;!;bqwPq)t7#=AaQ@%EqJ
zC;8@XtDa>UyZOqgSnt+Vy3AW*V_P1@?etO!yDwfClE1A@a8p^+Ui}*qCkvLHoV+7W
zt|4b%$c;TSn9ooCd?rut<8NoN^cgdY>~_C?uJiu-Qr<Hx-pbX#owep!@OuT#_X(Q2
zxqRW~fbjXnVs{0;W``(G{`FP6raoEi*YPXuE51E7EY_E5QcB~yB(>M`FYC3;SvwhZ
zcja)t>YMA_$*;P9b)nqD#bV!Ub358+{eSl6{Hu-oj#eEi&RbUZGc@15^4|UV?2C5G
zpYy(7Ew}vN<B9e!s{TCSX^)+--`gor=IHs|+ow2H{i>SAH?if)X2l+<EDoKHX>IKJ
zCk`H5aLBQ17VkPoR{_N<m#*}$-MD0>Vtk80i_%|4UB|_)hZig5-*<PqQt+cd|9kbh
zpZBgUm)*9ZZ^E9cxzSG?T|6)SoUvQ?l<3c&sj>2=X-{rXpV}ttt^Q_)j@cTW9Ov4L
z0UB8!s=fB)y`Hf3*cqJ#@3m&f$cmoXc|maf??BtnYFC*LuKMh;itXdo*`Ky@Tsvs6
zLaAeo*LOLIuaj9e3Ep1e!xDH>J;3t%Mwy+RJL9gJEjgsqVODkDJ4?NE;+>zj%$zhT
z&NBWh{x-Rs-|&OVjA^^m=6<xfT->x(hvS-*XwDp~oj;vrn&+j}?H70ZxnrjMzq9hU
z9MbYRXI|nH%A3wmD!K6It%Z{=#q>`-5z%0C?L_j_G6}ofDxd#%6&<Rt>rH*~|KIb<
zS9wL7=S<JhUX^lcpXZ(T%3DOg^-gWL`Dtz+`}|2o%UIlH(q`@XWAfdvD5CNI_vqd`
z1`V_Mte?HBKarPdDR*$GbB_A8PN|PGZ@AY?xn>?a(a=LCP@wJqTy<%Yy~Ty${vIbL
zN?5w`xp1F<H8+RL@k`O{0wJD_LPwoDJh^nA+zk~oi;C8m*0o5CQ88umg3t&9*GqZg
zP7lmlSXSRT{U&yL(u_*u&-L#={*yY({h#rU^evGWO}~8>{C`<H|BL(EyAQ2Iujg-R
zSGmJ9|Eu}i(qli{zbRd7Tf1hh*2I=(h4n9gn4L0x_gsnlU&`d)*9#WJfBJV@@yQ~;
zE!#D^ikuB1CyPqxs2kp{=bpLRwzKG0t=fy!Fjpmutqc9Pd^f(<pOLTnH}L?M_7u~v
zn@o>aGIw7KX<hgK!W)j_wLObozyJDN>~lD0Gv~AY3E#RpeKy=r5kD>~vRde<vGnRQ
zo83jXe!3UiXV#b3_wc%h?LLEN*G?S#zuA5LghT5BIljG4(R97}^;gk_iO0W*1>OAk
z&G7z#kVWrhuj=L0oYfZmf0j4YwO8$k{<EKacaFS&R>Qu*-ruO$sp|_<%#;VySbjbF
zKR<KwqTe2YHyF#UCLW*OC34SJGi`>kJ+Gu)W6vvo!yK<Jz1$f=fq%{wa0<=uajKba
zcO{Phvy|LCb6cIG_he0e@$&y?6b*FD5Ox%){hhw~hQO?wZ}Q$OH4~U{WHAS8tI?sR
zrPGhZE>sBmzJPsW$n6-LFB`6PvoFo${GuY#GVh4fSCy@IUmOifKDzlzlc*-g!c0ZE
zTWjk1<^P?je}A^R{?Yf3TNN!Ddb7&PChy^ucCPZ6l%4OjJ9y_G(du&3>)!2;-tY^%
zX)gJ5dx9K`{0no-8`ouQV)CY?A4;>V`<XxIx6t>ctk-;eEj$WNuUq!)x^KkH34Bqm
zBEJ^ATl=BXwtcazw4>as7ba@6pPR1lDDzf&)t<FnX_A}E;Wy{z2Pe(>dg+a}1^d&>
zD?BRZ336DbCBEIvYWZw|bLhmxo>H|X$ELMPozI%roXoqe?o*4@Uf+ukb|3W@n`ih>
zDcgV3|8v`Vz5h%*xTlt@B}(MfucSqXe{Q;Md4iXFsv!4FLH5aWzOFaa%2T<sB63=V
z*Z1b*;(hyXudu(K|8dWjPsfgI4{yHlS0nJgk)R*v)GAvJQ{9m4sh`ijeD`jW%Z_E*
zHkVd^UUPMyR2SF#`o`ZW=iBwGw(tHT{4wafeTsbTp36Gnf0jQlU#VBX`mVI`vw63m
zXi>p$|FD(6&mH^1!p3Le{4k_g_3`BYzQs?4->sjQZ<O9(`O)vqfA-P<UvH*B5!-zW
z`FV9*Q#%f5teDv@A;uzlq+#<0rp0NBR~E4_XBtNRZCu#u(!IiW>*lb3EGK;zuf8R5
zagl5Nf~YO4!+z}wR%W^QsKDa=-Rko@zn^Um*j%cc$n~qMW#iVs*+;V#XGA&wO*uYE
zJkf>I&Z%X?V$&HK+j|+Vp2}NWA;LCq!TMc)>#MFQ=I3mmY{k7e;ri7_uCaHwzFPI7
z{;Ys@s&}*8mYFN|)w~XVb&=gOyzYzQ-}~>fJ<d1l_cqvjC(hWmc3Jwt>TL?;!Fwwm
ztEBe4zLT``ESs_JrO6Kh&6{_6TJhy&9hp-xqoPMbLj1J6<f$bAW=CH?ySGqs(JiB<
zck_~(%I^HGKVIEjrn7a@OO78(mwz<P-^6w>*zSXu*rvyipS*dZeSx>@9IxCxV_E-8
zTzj?e-z(m~=lqFkzN%ASkMR`M`AeUjme9!DeYAhcpTD6zAES8GT~Bo0Vwf{?(fZsk
zWodUf58J0~oV{ks`@KB}9T&0u<Tj2`Iq>2Cum1^h)7aGZ*06Hdu?4ot)U|QcnX&bL
z=a!Wy65-35vspCN;`)mN1$m1(oaY@<^sVb<TlTrtevxHk*3-rr+#N?7B$k9<nC<Aq
zkTFeX!r%RW{6Ca0<2-ZYil~-M(y#j8^&f)R*m~!%vYY-8eI+?fuOJ~JU-{Grxs2=8
z3u1%MG2XrQ>$qjdTZZ8O_SL;%YJqL+O+0#;K|F?UeR!h&8~?Llm-#i{w*Gwm^Zy^~
zn_3&c{p0^Hd}qO#2Zwg~O*`l~;o{SKC5#*PvVW40dAC+PA;BYo!z0yV#l=H9rzRZK
zICbFOg##fU9xQnF|LXk1ja!b%EQs20Z#7TC-p~F2%iY4yvy~kG|LXk1;ste93M_`Z
z9a}E8a=&0R>|<M|;Mpc)yFi-1!)Vu(kA_EHY-GGSr$^6{oiFRd#u9_CGmVZsF_F0v
zu`P1K!#h%uZPmLQe@&H$k$NI2bK&jp^ZXl6f7;8yY%y<!<d%ewOV0P%&ifZ#&&xK`
z{^1gZBlbIa_`a+EEwke;QopeG_cn&ZPum2T8A2!cYaC9LI4-~buc7AQx;Jh@`{jf9
z-mOnl*?KkZYupvJ`l!e^1`of<J!=W*YF_llFEH=d+0>^APoHh_xXm}kEd1@qKWFYA
zzJ2+3-Tw2>f9~V=68YG^rLgp2+hX%CuF9FUe3z;=g*EeBK9Cs9v;FiWn_r3<1yfw_
zZ<kwp@j#~5GX;6QDNC0=*6g}tw=qx4?#_x1`C~_>{|gb^8En3SQ6jMRK()mCUfKWW
zw#+zc?7wyS+FQmIuiF~#rtmvHV7uDJcJx<!qSgbWncZJ@D|Y-%{dc<D?PteUkNP7%
zo_ckEAGewCgtP1udpd2h@ohh26@8lpHV2+dAIxsIo%V`Jf1XH6PetjG;-LG#7XLP$
zef0R$Nj-(LO7F3p^iWUOrgN<3LFt6^bqj9fJej2{yS#VDqMPScGgEVy2m3F-ddv0n
z?iqn6!gge?DVuRj%Hh1~UVnF=#|^LcKIIf!I`!?*gEyb)J-w_Uzr5y%f8fzuO)C5E
z`Br|~lATl{?7#iu+!?=mj55Dh2HNYi*qcax>+fs-yD-4u%EIm=B}qS-a|67yTMPug
z?b)C7O+m$0q`X>_TWm_6e1f;(#}KbhE3Xw&hJ`o(e(w$KKK(An=*;&SHH#0jZ(ppP
zzRFZl<=$tNy8mf54>%XMNG4YKYTEpGAp3srXRk#aQLz`KzxJHXHT&5Tl&N=#%hWwr
z=D4VJhV>OGm*OUQo5sKf_snHyndL&Jo@zO`U{Y%H&vuPKVXoE*qR+VR?cDx;o51Tm
zcPomw%kE;Ge|2SOjybd4xAOlz8}zx}B)nx-WLGWTvGBo72T$c=@jjhQ$G#c1`-j&w
zYIn@OJhwLd+~ikTiF#lAXM9Ulx%^Y%X?E`8JsoQ6KTOK~o~Y=&l;`j}1!I}dx?g+Z
zCtIeTSa<G!pSi-l74?UsN|(Pp6lA*jtA6Q3-|WK%JZ+zYx126ulYUorGEs7ibnBrP
zPIfnL=1vWHVDVr@YWv3f`)=e-d*>~_@OoXG=e8NySw7uu4~33|#2nV?Q}lIovnvX*
z3g-Rxfx(X5GV7C&UXZ|}8yET3B~93PU3-nDy~Hvx?k(=OlHynO9!tM<C&&M}|BEj^
zAL~LEulTFx=X!KWXXcCl;oBdWGt5*ye9o&QYpdS%kDE5HE!ut3Tr#O_U)Yx$GxuHo
zak}&gx17xE|396sO1x`fJ;KqX5fNFpQoMbao3+id?-H5zFSdNM6nEoWX1`HCFI8e~
zVAYfO%;VKN+IK&Bvi-`cm+U{BEoAP^^?r1D?HA37@0#ry=LR11I$|L3Hu6Tjg#M&8
z(?cAqGPq+GYG`zHzu7oN?JS>(=9W$o&AQ#2b8p77@>@+${B&>6Omj~Mmi7dle6PEQ
zMLQf_WG1n&v=_D%D+qBr{OMhvef40fQ_puX)isukHW5h&xBpnEpyszQUMup6g~rUC
zy~o|ezI=$`%h+@B7gynHt1Z7gBj0}ef2DGB#MYqN;3m^ASMFRp@J@cy^$&fAO<UCe
zF5c_!cFtL1IkV48H=oWJ`CQ@u{_R$0Z!RpU?s#bS$i8;zlk7JB*%uG>Z+kT*@Y+X(
zZTm78%$HeuWqZ_@F!ADfh3#%j)3<)pcs}cCZo1d^*Y>rHmkYFfy}fn0&aLqZ-LNtA
zLWe)UhhJy;=`|j{g*t^=XU}+cvUB}V3rl%6?OEHiRJG^Jm#|G2Nqx5T_mXEzr>A6O
z88tMr1sL#ah^$$#@Zp<>5-AzW7A$=^Eq==Eh(*qAE4glQwauDh;c<AQg{86ZLybps
zm@d0)ayBq^I_!G&z#^ycs|Q&8Btjbu<}~(6N+kU13Hq|I#j~r4sUwqB>A@#4L4{kY
zn{_r@?DufI7<Q216u+tQN&_=4ud}{q&Ukz3Uh-z^JZ)@XXklPv@Q0nLR^k5qg9{HH
z?3~ZYP+agRouQF`QbJc^uSjVIo5o+Jtatnxe;K^u9XFq6^QsQ$^qbIj!CFOg@%Iyp
zK1n`NxWX&*tolUY@p}R$pTkc${|xy4!r`Z+#hr;vqTf&Y`vex~YMs(ga$q>WXVZ~6
zXGB^XjwmstPH@aStRUcOc`D|pXO?F7mcX|=vY8%>a2jVcc%6L7yzc3vFZ%Zx@_!T^
z>d-0D(^GlhshqVjP2Kd(B?~3zbh#Y|;x7n0ntNua|L_yE3w*VEMbQEI#RB(cbcX*p
zs-`q&rqZg=ZxfX+%!uch5|KFLp@W$(M|F~)o!)iv8_Qhx+<4e>>qL}Z8q=%jUAOPg
zKQ&KRb@}Vby{Aqwu$L^ei@f&n2~(cS<S+MjM3?S0uT=C3yrQ{C;OVyW$BJHNSZA!$
zUprmq`|{7;g^^dj{ZGuCBy#iYgBK#cac;$1IhczKp18DYJ^l3FKw?wnw2Q)9C!EeZ
zWFX-BS97zDHCOFM7WIW5Yg;_Du7%lnx?7mZ-VXUw+dN^?g*7|7BkvgJD?agaI`t-k
zXG#?Bx+ecCORS39<$ktE$)$ClyfMdL{r@RrqZ{Av+?Z^%<e~FTt5v_emSp$6k@}R|
z?$Y{t!&$LuQN~sLmu{X4kZh^Y?|NHt(PmoeY<0I=+S^jHe{5oZU8lR|?9U&zESyq2
z95a=KCD{|smpm>{5M9kB$@N?ze~O{(iDsi4>+grh$T9r9$)1yU@M-qKUi*m>rQFN<
zH~+l+`Sk1CNjoQb&g$jg)&GwnIYEK<$J^B@X}jZI?>YGAE#Kd_uHHPQ&-cB%uvf>z
zyC<<}*I&nY@r(QCFY~$nan{Q3CEqJsj|X$br<Byx6h#*F3ppPyoZaWfZ1S~kqNw8X
z_s6ZjTF#C5zj*axuDkm<M1^EM*b<l?i8|;c@f@u4Yhyd{>6h!zpQ^u(x}N;ix^m~z
zU#csQsviBdbY<quT?)(cJnQQGHtq|~O!Moi(+DtO(U4#gD=sYMD(x>XFEhLP{p0uV
z#pOIj-wcc$Lq#UcUH5*<%y^keGp0<A;t_It-sI~je8v0Z$wmvm#>Rz=9))WJBa}C~
zCH5YZYBm+imbq53hBHEVqgtZxu~|)~qS;c{O4iKWkalbqYj)V0n;X)O&tlH@TeEY+
zvtzT^vl-qVT`1(>z~FjO+%@oyMxKakAQY9WB);#_=vwqb*d_3Z`5B9+bN+qWF3zYZ
q*e2oa<mKk)=;`X~?CpNOAvq~6F*W(Q!=$NaW=ntly?~vrt3UwT8c56l

literal 0
HcmV?d00001


From 82acc8c83f93814bb01669412a0a226c39fa8d77 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Tue, 20 May 2025 21:01:53 +0800
Subject: [PATCH 1345/2760] tests/qtest/bios-tables-test: Use MiB macro rather
 hardcode value

Replace 1024 * 1024 with MiB macro.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Message-Id: <20250520130158.767083-4-maobibo@loongson.cn>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 tests/qtest/bios-tables-test.c | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/tests/qtest/bios-tables-test.c b/tests/qtest/bios-tables-test.c
index 0a333ec435..0b2bdf9d0d 100644
--- a/tests/qtest/bios-tables-test.c
+++ b/tests/qtest/bios-tables-test.c
@@ -1622,7 +1622,7 @@ static void test_acpi_aarch64_virt_tcg_memhp(void)
         .uefi_fl2 = "pc-bios/edk2-arm-vars.fd",
         .cd = "tests/data/uefi-boot-images/bios-tables-test.aarch64.iso.qcow2",
         .ram_start = 0x40000000ULL,
-        .scan_len = 256ULL * 1024 * 1024,
+        .scan_len = 256ULL * MiB,
     };
 
     data.variant = ".memhp";
@@ -1717,7 +1717,7 @@ static void test_acpi_riscv64_virt_tcg_numamem(void)
         .uefi_fl2 = "pc-bios/edk2-riscv-vars.fd",
         .cd = "tests/data/uefi-boot-images/bios-tables-test.riscv64.iso.qcow2",
         .ram_start = 0x80000000ULL,
-        .scan_len = 128ULL * 1024 * 1024,
+        .scan_len = 128ULL * MiB,
     };
 
     data.variant = ".numamem";
@@ -1743,7 +1743,7 @@ static void test_acpi_aarch64_virt_tcg_numamem(void)
         .uefi_fl2 = "pc-bios/edk2-arm-vars.fd",
         .cd = "tests/data/uefi-boot-images/bios-tables-test.aarch64.iso.qcow2",
         .ram_start = 0x40000000ULL,
-        .scan_len = 128ULL * 1024 * 1024,
+        .scan_len = 128ULL * MiB,
     };
 
     data.variant = ".numamem";
@@ -1765,7 +1765,7 @@ static void test_acpi_aarch64_virt_tcg_pxb(void)
         .uefi_fl1 = "pc-bios/edk2-aarch64-code.fd",
         .uefi_fl2 = "pc-bios/edk2-arm-vars.fd",
         .ram_start = 0x40000000ULL,
-        .scan_len = 128ULL * 1024 * 1024,
+        .scan_len = 128ULL * MiB,
     };
     /*
      * While using -cdrom, the cdrom would auto plugged into pxb-pcie,
@@ -1841,7 +1841,7 @@ static void test_acpi_aarch64_virt_tcg_acpi_hmat(void)
         .uefi_fl2 = "pc-bios/edk2-arm-vars.fd",
         .cd = "tests/data/uefi-boot-images/bios-tables-test.aarch64.iso.qcow2",
         .ram_start = 0x40000000ULL,
-        .scan_len = 128ULL * 1024 * 1024,
+        .scan_len = 128ULL * MiB,
     };
 
     data.variant = ".acpihmatvirt";
@@ -2095,7 +2095,7 @@ static void test_acpi_riscv64_virt_tcg(void)
         .uefi_fl2 = "pc-bios/edk2-riscv-vars.fd",
         .cd = "tests/data/uefi-boot-images/bios-tables-test.riscv64.iso.qcow2",
         .ram_start = 0x80000000ULL,
-        .scan_len = 128ULL * 1024 * 1024,
+        .scan_len = 128ULL * MiB,
     };
 
     /*
@@ -2117,7 +2117,7 @@ static void test_acpi_aarch64_virt_tcg(void)
         .uefi_fl2 = "pc-bios/edk2-arm-vars.fd",
         .cd = "tests/data/uefi-boot-images/bios-tables-test.aarch64.iso.qcow2",
         .ram_start = 0x40000000ULL,
-        .scan_len = 128ULL * 1024 * 1024,
+        .scan_len = 128ULL * MiB,
     };
 
     data.smbios_cpu_max_speed = 2900;
@@ -2138,7 +2138,7 @@ static void test_acpi_aarch64_virt_tcg_topology(void)
         .uefi_fl2 = "pc-bios/edk2-arm-vars.fd",
         .cd = "tests/data/uefi-boot-images/bios-tables-test.aarch64.iso.qcow2",
         .ram_start = 0x40000000ULL,
-        .scan_len = 128ULL * 1024 * 1024,
+        .scan_len = 128ULL * MiB,
     };
 
     test_acpi_one("-cpu cortex-a57 "
@@ -2223,7 +2223,7 @@ static void test_acpi_aarch64_virt_viot(void)
         .uefi_fl2 = "pc-bios/edk2-arm-vars.fd",
         .cd = "tests/data/uefi-boot-images/bios-tables-test.aarch64.iso.qcow2",
         .ram_start = 0x40000000ULL,
-        .scan_len = 128ULL * 1024 * 1024,
+        .scan_len = 128ULL * MiB,
     };
 
     test_acpi_one("-cpu cortex-a57 "
@@ -2407,7 +2407,7 @@ static void test_acpi_aarch64_virt_oem_fields(void)
         .uefi_fl2 = "pc-bios/edk2-arm-vars.fd",
         .cd = "tests/data/uefi-boot-images/bios-tables-test.aarch64.iso.qcow2",
         .ram_start = 0x40000000ULL,
-        .scan_len = 128ULL * 1024 * 1024,
+        .scan_len = 128ULL * MiB,
     };
     char *args;
 

From a9403bfcd93025df7b1924d0cf34fbc408955b33 Mon Sep 17 00:00:00 2001
From: Huaitong Han <hanht2@chinatelecom.cn>
Date: Thu, 22 May 2025 18:05:48 +0800
Subject: [PATCH 1346/2760] vhost: Don't set vring call if guest notifier is
 unused

The vring call fd is set even when the guest does not use MSI-X (e.g., in the
case of virtio PMD), leading to unnecessary CPU overhead for processing
interrupts.

The commit 96a3d98d2c("vhost: don't set vring call if no vector") optimized the
case where MSI-X is enabled but the queue vector is unset. However, there's an
additional case where the guest uses INTx and the INTx_DISABLED bit in the PCI
config is set, meaning that no interrupt notifier will actually be used.

In such cases, the vring call fd should also be cleared to avoid redundant
interrupt handling.

Fixes: 96a3d98d2c("vhost: don't set vring call if no vector")

Reported-by: Zhiyuan Yuan <yuanzhiyuan@chinatelecom.cn>
Signed-off-by: Jidong Xia <xiajd@chinatelecom.cn>
Signed-off-by: Huaitong Han <hanht2@chinatelecom.cn>
Message-Id: <20250522100548.212740-1-hanht2@chinatelecom.cn>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/pci/pci.c           | 2 +-
 hw/virtio/virtio-pci.c | 7 ++++++-
 include/hw/pci/pci.h   | 1 +
 3 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/hw/pci/pci.c b/hw/pci/pci.c
index c6b5768f3a..9b4bf48439 100644
--- a/hw/pci/pci.c
+++ b/hw/pci/pci.c
@@ -1730,7 +1730,7 @@ static void pci_update_mappings(PCIDevice *d)
     pci_update_vga(d);
 }
 
-static inline int pci_irq_disabled(PCIDevice *d)
+int pci_irq_disabled(PCIDevice *d)
 {
     return pci_get_word(d->config + PCI_COMMAND) & PCI_COMMAND_INTX_DISABLE;
 }
diff --git a/hw/virtio/virtio-pci.c b/hw/virtio/virtio-pci.c
index 9b48aa8c3e..7e309d1d49 100644
--- a/hw/virtio/virtio-pci.c
+++ b/hw/virtio/virtio-pci.c
@@ -1215,7 +1215,12 @@ static int virtio_pci_set_guest_notifier(DeviceState *d, int n, bool assign,
 static bool virtio_pci_query_guest_notifiers(DeviceState *d)
 {
     VirtIOPCIProxy *proxy = to_virtio_pci_proxy(d);
-    return msix_enabled(&proxy->pci_dev);
+
+    if (msix_enabled(&proxy->pci_dev)) {
+        return true;
+    } else {
+        return pci_irq_disabled(&proxy->pci_dev);
+    }
 }
 
 static int virtio_pci_set_guest_notifiers(DeviceState *d, int nvqs, bool assign)
diff --git a/include/hw/pci/pci.h b/include/hw/pci/pci.h
index a6854dad2b..35d59d7672 100644
--- a/include/hw/pci/pci.h
+++ b/include/hw/pci/pci.h
@@ -983,6 +983,7 @@ void lsi53c8xx_handle_legacy_cmdline(DeviceState *lsi_dev);
 
 qemu_irq pci_allocate_irq(PCIDevice *pci_dev);
 void pci_set_irq(PCIDevice *pci_dev, int level);
+int pci_irq_disabled(PCIDevice *d);
 
 static inline void pci_irq_assert(PCIDevice *pci_dev)
 {

From 55cf1d4f10160e37440d9e727a160ac1141bbb53 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Eugenio=20P=C3=A9rez?= <eperezma@redhat.com>
Date: Thu, 22 May 2025 10:58:33 -0400
Subject: [PATCH 1347/2760] vdpa: check for iova tree initialized at
 net_client_start
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

To map the guest memory while it is migrating we need to create the
iova_tree, as long as the destination uses x-svq=on. Checking to not
override it.

The function vhost_vdpa_net_client_stop clear it if the device is
stopped. If the guest starts the device again, the iova tree is
recreated by vhost_vdpa_net_data_start_first or vhost_vdpa_net_cvq_start
if needed, so old behavior is kept.

Tested-by: Lei Yang <leiyang@redhat.com>
Reviewed-by: Si-Wei Liu <si-wei.liu@oracle.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
Signed-off-by: Jonah Palmer <jonah.palmer@oracle.com>
Message-Id: <20250522145839.59974-2-jonah.palmer@oracle.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 net/vhost-vdpa.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c
index 7ca8b46eee..decb826868 100644
--- a/net/vhost-vdpa.c
+++ b/net/vhost-vdpa.c
@@ -366,7 +366,9 @@ static void vhost_vdpa_net_data_start_first(VhostVDPAState *s)
 
     migration_add_notifier(&s->migration_state,
                            vdpa_net_migration_state_notifier);
-    if (v->shadow_vqs_enabled) {
+
+    /* iova_tree may be initialized by vhost_vdpa_net_load_setup */
+    if (v->shadow_vqs_enabled && !v->shared->iova_tree) {
         v->shared->iova_tree = vhost_iova_tree_new(v->shared->iova_range.first,
                                                    v->shared->iova_range.last);
     }

From 3312e6c8c9aa8f32019f14c74d209db17b9306eb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Eugenio=20P=C3=A9rez?= <eperezma@redhat.com>
Date: Thu, 22 May 2025 10:58:34 -0400
Subject: [PATCH 1348/2760] vdpa: reorder vhost_vdpa_set_backend_cap
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

It will be used directly by vhost_vdpa_init.

Tested-by: Lei Yang <leiyang@redhat.com>
Reviewed-by: Si-Wei Liu <si-wei.liu@oracle.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
Signed-off-by: Jonah Palmer <jonah.palmer@oracle.com>
Message-Id: <20250522145839.59974-3-jonah.palmer@oracle.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/virtio/vhost-vdpa.c | 60 +++++++++++++++++++++---------------------
 1 file changed, 30 insertions(+), 30 deletions(-)

diff --git a/hw/virtio/vhost-vdpa.c b/hw/virtio/vhost-vdpa.c
index 1ab2c11fa8..6b242ca56a 100644
--- a/hw/virtio/vhost-vdpa.c
+++ b/hw/virtio/vhost-vdpa.c
@@ -594,6 +594,36 @@ static void vhost_vdpa_init_svq(struct vhost_dev *hdev, struct vhost_vdpa *v)
     v->shadow_vqs = g_steal_pointer(&shadow_vqs);
 }
 
+static int vhost_vdpa_set_backend_cap(struct vhost_dev *dev)
+{
+    struct vhost_vdpa *v = dev->opaque;
+
+    uint64_t features;
+    uint64_t f = 0x1ULL << VHOST_BACKEND_F_IOTLB_MSG_V2 |
+        0x1ULL << VHOST_BACKEND_F_IOTLB_BATCH |
+        0x1ULL << VHOST_BACKEND_F_IOTLB_ASID |
+        0x1ULL << VHOST_BACKEND_F_SUSPEND;
+    int r;
+
+    if (vhost_vdpa_call(dev, VHOST_GET_BACKEND_FEATURES, &features)) {
+        return -EFAULT;
+    }
+
+    features &= f;
+
+    if (vhost_vdpa_first_dev(dev)) {
+        r = vhost_vdpa_call(dev, VHOST_SET_BACKEND_FEATURES, &features);
+        if (r) {
+            return -EFAULT;
+        }
+    }
+
+    dev->backend_cap = features;
+    v->shared->backend_cap = features;
+
+    return 0;
+}
+
 static int vhost_vdpa_init(struct vhost_dev *dev, void *opaque, Error **errp)
 {
     struct vhost_vdpa *v = opaque;
@@ -841,36 +871,6 @@ static int vhost_vdpa_set_features(struct vhost_dev *dev,
     return vhost_vdpa_add_status(dev, VIRTIO_CONFIG_S_FEATURES_OK);
 }
 
-static int vhost_vdpa_set_backend_cap(struct vhost_dev *dev)
-{
-    struct vhost_vdpa *v = dev->opaque;
-
-    uint64_t features;
-    uint64_t f = 0x1ULL << VHOST_BACKEND_F_IOTLB_MSG_V2 |
-        0x1ULL << VHOST_BACKEND_F_IOTLB_BATCH |
-        0x1ULL << VHOST_BACKEND_F_IOTLB_ASID |
-        0x1ULL << VHOST_BACKEND_F_SUSPEND;
-    int r;
-
-    if (vhost_vdpa_call(dev, VHOST_GET_BACKEND_FEATURES, &features)) {
-        return -EFAULT;
-    }
-
-    features &= f;
-
-    if (vhost_vdpa_first_dev(dev)) {
-        r = vhost_vdpa_call(dev, VHOST_SET_BACKEND_FEATURES, &features);
-        if (r) {
-            return -EFAULT;
-        }
-    }
-
-    dev->backend_cap = features;
-    v->shared->backend_cap = features;
-
-    return 0;
-}
-
 static int vhost_vdpa_get_device_id(struct vhost_dev *dev,
                                     uint32_t *device_id)
 {

From 32f0c7ce4c948b2e275dca3cf7fa2a00677b9c1d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Eugenio=20P=C3=A9rez?= <eperezma@redhat.com>
Date: Thu, 22 May 2025 10:58:35 -0400
Subject: [PATCH 1349/2760] vdpa: set backend capabilities at vhost_vdpa_init
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The backend does not reset them until the vdpa file descriptor is closed
so there is no harm in doing it only once.

This allows the destination of a live migration to premap memory in
batches, using VHOST_BACKEND_F_IOTLB_BATCH.

Tested-by: Lei Yang <leiyang@redhat.com>
Reviewed-by: Si-Wei Liu <si-wei.liu@oracle.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
Signed-off-by: Jonah Palmer <jonah.palmer@oracle.com>
Message-Id: <20250522145839.59974-4-jonah.palmer@oracle.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/virtio/vhost-vdpa.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/hw/virtio/vhost-vdpa.c b/hw/virtio/vhost-vdpa.c
index 6b242ca56a..e9826ede2c 100644
--- a/hw/virtio/vhost-vdpa.c
+++ b/hw/virtio/vhost-vdpa.c
@@ -634,6 +634,12 @@ static int vhost_vdpa_init(struct vhost_dev *dev, void *opaque, Error **errp)
     v->dev = dev;
     dev->opaque =  opaque ;
     v->shared->listener = vhost_vdpa_memory_listener;
+
+    ret = vhost_vdpa_set_backend_cap(dev);
+    if (unlikely(ret != 0)) {
+        return ret;
+    }
+
     vhost_vdpa_init_svq(dev, v);
 
     error_propagate(&dev->migration_blocker, v->migration_blocker);
@@ -1563,7 +1569,6 @@ const VhostOps vdpa_ops = {
         .vhost_set_vring_kick = vhost_vdpa_set_vring_kick,
         .vhost_set_vring_call = vhost_vdpa_set_vring_call,
         .vhost_get_features = vhost_vdpa_get_features,
-        .vhost_set_backend_cap = vhost_vdpa_set_backend_cap,
         .vhost_set_owner = vhost_vdpa_set_owner,
         .vhost_set_vring_endian = NULL,
         .vhost_backend_memslots_limit = vhost_vdpa_memslots_limit,

From be2e5fbefa7c1f8243bf6db2486b950b1ab19b72 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Eugenio=20P=C3=A9rez?= <eperezma@redhat.com>
Date: Thu, 22 May 2025 10:58:36 -0400
Subject: [PATCH 1350/2760] vdpa: add listener_registered
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Check if the listener has been registered or not, so it needs to be
registered again at start.

Tested-by: Lei Yang <leiyang@redhat.com>
Reviewed-by: Si-Wei Liu <si-wei.liu@oracle.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
Signed-off-by: Jonah Palmer <jonah.palmer@oracle.com>
Message-Id: <20250522145839.59974-5-jonah.palmer@oracle.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/virtio/vhost-vdpa.c         | 7 ++++++-
 include/hw/virtio/vhost-vdpa.h | 6 ++++++
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/hw/virtio/vhost-vdpa.c b/hw/virtio/vhost-vdpa.c
index e9826ede2c..450f68f117 100644
--- a/hw/virtio/vhost-vdpa.c
+++ b/hw/virtio/vhost-vdpa.c
@@ -1379,7 +1379,10 @@ static int vhost_vdpa_dev_start(struct vhost_dev *dev, bool started)
                          "IOMMU and try again");
             return -1;
         }
-        memory_listener_register(&v->shared->listener, dev->vdev->dma_as);
+        if (!v->shared->listener_registered) {
+            memory_listener_register(&v->shared->listener, dev->vdev->dma_as);
+            v->shared->listener_registered = true;
+        }
 
         return vhost_vdpa_add_status(dev, VIRTIO_CONFIG_S_DRIVER_OK);
     }
@@ -1399,6 +1402,8 @@ static void vhost_vdpa_reset_status(struct vhost_dev *dev)
     vhost_vdpa_add_status(dev, VIRTIO_CONFIG_S_ACKNOWLEDGE |
                                VIRTIO_CONFIG_S_DRIVER);
     memory_listener_unregister(&v->shared->listener);
+    v->shared->listener_registered = false;
+
 }
 
 static int vhost_vdpa_set_log_base(struct vhost_dev *dev, uint64_t base,
diff --git a/include/hw/virtio/vhost-vdpa.h b/include/hw/virtio/vhost-vdpa.h
index 0a9575b469..221840987e 100644
--- a/include/hw/virtio/vhost-vdpa.h
+++ b/include/hw/virtio/vhost-vdpa.h
@@ -51,6 +51,12 @@ typedef struct vhost_vdpa_shared {
 
     bool iotlb_batch_begin_sent;
 
+    /*
+     * The memory listener has been registered, so DMA maps have been sent to
+     * the device.
+     */
+    bool listener_registered;
+
     /* Vdpa must send shadow addresses as IOTLB key for data queues, not GPA */
     bool shadow_data;
 

From 9344dcbd004f951155c020d01c1bdc881e0451c1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Eugenio=20P=C3=A9rez?= <eperezma@redhat.com>
Date: Thu, 22 May 2025 10:58:37 -0400
Subject: [PATCH 1351/2760] vdpa: reorder listener assignment
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since commit f6fe3e333f ("vdpa: move memory listener to
vhost_vdpa_shared") this piece of code repeatedly assign
shared->listener members.  This was not a problem as it was not used
until device start.

However next patches move the listener registration to this
vhost_vdpa_init function.  When the listener is registered it is added
to an embedded linked list, so setting its members again will cause
memory corruption to the linked list node.

Do the right thing and only set it in the first vdpa device.

Tested-by: Lei Yang <leiyang@redhat.com>
Reviewed-by: Si-Wei Liu <si-wei.liu@oracle.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
Signed-off-by: Jonah Palmer <jonah.palmer@oracle.com>
Message-Id: <20250522145839.59974-6-jonah.palmer@oracle.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/virtio/vhost-vdpa.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/virtio/vhost-vdpa.c b/hw/virtio/vhost-vdpa.c
index 450f68f117..de834f2ebd 100644
--- a/hw/virtio/vhost-vdpa.c
+++ b/hw/virtio/vhost-vdpa.c
@@ -633,7 +633,6 @@ static int vhost_vdpa_init(struct vhost_dev *dev, void *opaque, Error **errp)
 
     v->dev = dev;
     dev->opaque =  opaque ;
-    v->shared->listener = vhost_vdpa_memory_listener;
 
     ret = vhost_vdpa_set_backend_cap(dev);
     if (unlikely(ret != 0)) {
@@ -675,6 +674,7 @@ static int vhost_vdpa_init(struct vhost_dev *dev, void *opaque, Error **errp)
     vhost_vdpa_add_status(dev, VIRTIO_CONFIG_S_ACKNOWLEDGE |
                                VIRTIO_CONFIG_S_DRIVER);
 
+    v->shared->listener = vhost_vdpa_memory_listener;
     return 0;
 }
 

From a400720365ea86602044b78dd8654911d0fe3977 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Eugenio=20P=C3=A9rez?= <eperezma@redhat.com>
Date: Thu, 22 May 2025 10:58:38 -0400
Subject: [PATCH 1352/2760] vdpa: move iova_tree allocation to
 net_vhost_vdpa_init
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

As we are moving to keep the mapping through all the vdpa device life
instead of resetting it at VirtIO reset, we need to move all its
dependencies to the initialization too.  In particular devices with
x-svq=on need a valid iova_tree from the beginning.

Simplify the code also consolidating the two creation points: the first
data vq in case of SVQ active and CVQ start in case only CVQ uses it.

Tested-by: Lei Yang <leiyang@redhat.com>
Reviewed-by: Si-Wei Liu <si-wei.liu@oracle.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Suggested-by: Si-Wei Liu <si-wei.liu@oracle.com>
Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
Signed-off-by: Jonah Palmer <jonah.palmer@oracle.com>
Message-Id: <20250522145839.59974-7-jonah.palmer@oracle.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 include/hw/virtio/vhost-vdpa.h | 16 ++++++++++++++-
 net/vhost-vdpa.c               | 36 +++-------------------------------
 2 files changed, 18 insertions(+), 34 deletions(-)

diff --git a/include/hw/virtio/vhost-vdpa.h b/include/hw/virtio/vhost-vdpa.h
index 221840987e..449bf5c840 100644
--- a/include/hw/virtio/vhost-vdpa.h
+++ b/include/hw/virtio/vhost-vdpa.h
@@ -43,7 +43,21 @@ typedef struct vhost_vdpa_shared {
     struct vhost_vdpa_iova_range iova_range;
     QLIST_HEAD(, vdpa_iommu) iommu_list;
 
-    /* IOVA mapping used by the Shadow Virtqueue */
+    /*
+     * IOVA mapping used by the Shadow Virtqueue
+     *
+     * It is shared among all ASID for simplicity, whether CVQ shares ASID with
+     * guest or not:
+     * - Memory listener need access to guest's memory addresses allocated in
+     *   the IOVA tree.
+     * - There should be plenty of IOVA address space for both ASID not to
+     *   worry about collisions between them.  Guest's translations are still
+     *   validated with virtio virtqueue_pop so there is no risk for the guest
+     *   to access memory that it shouldn't.
+     *
+     * To allocate a iova tree per ASID is doable but it complicates the code
+     * and it is not worth it for the moment.
+     */
     VhostIOVATree *iova_tree;
 
     /* Copy of backend features */
diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c
index decb826868..58d738945d 100644
--- a/net/vhost-vdpa.c
+++ b/net/vhost-vdpa.c
@@ -235,6 +235,7 @@ static void vhost_vdpa_cleanup(NetClientState *nc)
         return;
     }
     qemu_close(s->vhost_vdpa.shared->device_fd);
+    g_clear_pointer(&s->vhost_vdpa.shared->iova_tree, vhost_iova_tree_delete);
     g_free(s->vhost_vdpa.shared);
 }
 
@@ -362,16 +363,8 @@ static int vdpa_net_migration_state_notifier(NotifierWithReturn *notifier,
 
 static void vhost_vdpa_net_data_start_first(VhostVDPAState *s)
 {
-    struct vhost_vdpa *v = &s->vhost_vdpa;
-
     migration_add_notifier(&s->migration_state,
                            vdpa_net_migration_state_notifier);
-
-    /* iova_tree may be initialized by vhost_vdpa_net_load_setup */
-    if (v->shadow_vqs_enabled && !v->shared->iova_tree) {
-        v->shared->iova_tree = vhost_iova_tree_new(v->shared->iova_range.first,
-                                                   v->shared->iova_range.last);
-    }
 }
 
 static int vhost_vdpa_net_data_start(NetClientState *nc)
@@ -418,19 +411,12 @@ static int vhost_vdpa_net_data_load(NetClientState *nc)
 static void vhost_vdpa_net_client_stop(NetClientState *nc)
 {
     VhostVDPAState *s = DO_UPCAST(VhostVDPAState, nc, nc);
-    struct vhost_dev *dev;
 
     assert(nc->info->type == NET_CLIENT_DRIVER_VHOST_VDPA);
 
     if (s->vhost_vdpa.index == 0) {
         migration_remove_notifier(&s->migration_state);
     }
-
-    dev = s->vhost_vdpa.dev;
-    if (dev->vq_index + dev->nvqs == dev->vq_index_end) {
-        g_clear_pointer(&s->vhost_vdpa.shared->iova_tree,
-                        vhost_iova_tree_delete);
-    }
 }
 
 static NetClientInfo net_vhost_vdpa_info = {
@@ -602,24 +588,6 @@ out:
         return 0;
     }
 
-    /*
-     * If other vhost_vdpa already have an iova_tree, reuse it for simplicity,
-     * whether CVQ shares ASID with guest or not, because:
-     * - Memory listener need access to guest's memory addresses allocated in
-     *   the IOVA tree.
-     * - There should be plenty of IOVA address space for both ASID not to
-     *   worry about collisions between them.  Guest's translations are still
-     *   validated with virtio virtqueue_pop so there is no risk for the guest
-     *   to access memory that it shouldn't.
-     *
-     * To allocate a iova tree per ASID is doable but it complicates the code
-     * and it is not worth it for the moment.
-     */
-    if (!v->shared->iova_tree) {
-        v->shared->iova_tree = vhost_iova_tree_new(v->shared->iova_range.first,
-                                                   v->shared->iova_range.last);
-    }
-
     r = vhost_vdpa_cvq_map_buf(&s->vhost_vdpa, s->cvq_cmd_out_buffer,
                                vhost_vdpa_net_cvq_cmd_page_len(), false);
     if (unlikely(r < 0)) {
@@ -1728,6 +1696,8 @@ static NetClientState *net_vhost_vdpa_init(NetClientState *peer,
         s->vhost_vdpa.shared->device_fd = vdpa_device_fd;
         s->vhost_vdpa.shared->iova_range = iova_range;
         s->vhost_vdpa.shared->shadow_data = svq;
+        s->vhost_vdpa.shared->iova_tree = vhost_iova_tree_new(iova_range.first,
+                                                              iova_range.last);
     } else if (!is_datapath) {
         s->cvq_cmd_out_buffer = mmap(NULL, vhost_vdpa_net_cvq_cmd_page_len(),
                                      PROT_READ | PROT_WRITE,

From 494c50dcc0995ae6eb526d2848c33cbf910ab218 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Eugenio=20P=C3=A9rez?= <eperezma@redhat.com>
Date: Thu, 22 May 2025 10:58:39 -0400
Subject: [PATCH 1353/2760] vdpa: move memory listener register to
 vhost_vdpa_init
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Current memory operations like pinning may take a lot of time at the
destination.  Currently they are done after the source of the migration is
stopped, and before the workload is resumed at the destination.  This is a
period where neigher traffic can flow, nor the VM workload can continue
(downtime).

We can do better as we know the memory layout of the guest RAM at the
destination from the moment that all devices are initializaed.  So
moving that operation allows QEMU to communicate the kernel the maps
while the workload is still running in the source, so Linux can start
mapping them.

As a small drawback, there is a time in the initialization where QEMU
cannot respond to QMP etc.  By some testing, this time is about
0.2seconds.  This may be further reduced (or increased) depending on the
vdpa driver and the platform hardware, and it is dominated by the cost
of memory pinning.

This matches the time that we move out of the called downtime window.
The downtime is measured as the elapsed trace time between the last
vhost_vdpa_suspend on the source and the last vhost_vdpa_set_vring_enable_one
on the destination. In other words, from "guest CPUs freeze" to the
instant the final Rx/Tx queue-pair is able to start moving data.

Using ConnectX-6 Dx (MLX5) NICs in vhost-vDPA mode with 8 queue-pairs,
the series reduces guest-visible downtime during back-to-back live
migrations by more than half:
- 39G VM:   4.72s -> 2.09s (-2.63s, ~56% improvement)
- 128G VM:  14.72s -> 5.83s (-8.89s, ~60% improvement)

Tested-by: Lei Yang <leiyang@redhat.com>
Reviewed-by: Si-Wei Liu <si-wei.liu@oracle.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
Signed-off-by: Jonah Palmer <jonah.palmer@oracle.com>
Message-Id: <20250522145839.59974-8-jonah.palmer@oracle.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/virtio/vhost-vdpa.c | 35 ++++++++++++++++++++++++++++-------
 1 file changed, 28 insertions(+), 7 deletions(-)

diff --git a/hw/virtio/vhost-vdpa.c b/hw/virtio/vhost-vdpa.c
index de834f2ebd..e20da95f30 100644
--- a/hw/virtio/vhost-vdpa.c
+++ b/hw/virtio/vhost-vdpa.c
@@ -894,8 +894,14 @@ static int vhost_vdpa_reset_device(struct vhost_dev *dev)
 
     ret = vhost_vdpa_call(dev, VHOST_VDPA_SET_STATUS, &status);
     trace_vhost_vdpa_reset_device(dev);
+    if (ret) {
+        return ret;
+    }
+
+    memory_listener_unregister(&v->shared->listener);
+    v->shared->listener_registered = false;
     v->suspended = false;
-    return ret;
+    return 0;
 }
 
 static int vhost_vdpa_get_vq_index(struct vhost_dev *dev, int idx)
@@ -1379,6 +1385,11 @@ static int vhost_vdpa_dev_start(struct vhost_dev *dev, bool started)
                          "IOMMU and try again");
             return -1;
         }
+        if (v->shared->listener_registered &&
+            dev->vdev->dma_as != v->shared->listener.address_space) {
+            memory_listener_unregister(&v->shared->listener);
+            v->shared->listener_registered = false;
+        }
         if (!v->shared->listener_registered) {
             memory_listener_register(&v->shared->listener, dev->vdev->dma_as);
             v->shared->listener_registered = true;
@@ -1392,8 +1403,6 @@ static int vhost_vdpa_dev_start(struct vhost_dev *dev, bool started)
 
 static void vhost_vdpa_reset_status(struct vhost_dev *dev)
 {
-    struct vhost_vdpa *v = dev->opaque;
-
     if (!vhost_vdpa_last_dev(dev)) {
         return;
     }
@@ -1401,9 +1410,6 @@ static void vhost_vdpa_reset_status(struct vhost_dev *dev)
     vhost_vdpa_reset_device(dev);
     vhost_vdpa_add_status(dev, VIRTIO_CONFIG_S_ACKNOWLEDGE |
                                VIRTIO_CONFIG_S_DRIVER);
-    memory_listener_unregister(&v->shared->listener);
-    v->shared->listener_registered = false;
-
 }
 
 static int vhost_vdpa_set_log_base(struct vhost_dev *dev, uint64_t base,
@@ -1537,12 +1543,27 @@ static int vhost_vdpa_get_features(struct vhost_dev *dev,
 
 static int vhost_vdpa_set_owner(struct vhost_dev *dev)
 {
+    int r;
+    struct vhost_vdpa *v;
+
     if (!vhost_vdpa_first_dev(dev)) {
         return 0;
     }
 
     trace_vhost_vdpa_set_owner(dev);
-    return vhost_vdpa_call(dev, VHOST_SET_OWNER, NULL);
+    r = vhost_vdpa_call(dev, VHOST_SET_OWNER, NULL);
+    if (unlikely(r < 0)) {
+        return r;
+    }
+
+    /*
+     * Being optimistic and listening address space memory. If the device
+     * uses vIOMMU, it is changed at vhost_vdpa_dev_start.
+     */
+    v = dev->opaque;
+    memory_listener_register(&v->shared->listener, &address_space_memory);
+    v->shared->listener_registered = true;
+    return 0;
 }
 
 static int vhost_vdpa_vq_get_addr(struct vhost_dev *dev,

From 0b006153b7ec66505cb2d231235aa19ca5d2ce37 Mon Sep 17 00:00:00 2001
From: Bernhard Beschow <shentey@gmail.com>
Date: Mon, 26 May 2025 22:38:20 +0200
Subject: [PATCH 1354/2760] hw/i386/pc_piix: Fix RTC ISA IRQ wiring of isapc
 machine

Commit 56b1f50e3c10 ("hw/i386/pc: Wire RTC ISA IRQs in south bridges")
attempted to refactor RTC IRQ wiring which was previously done in
pc_basic_device_init() but forgot about the isapc machine. Fix this by
wiring in the code section dedicated exclusively to the isapc machine.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2961
Fixes: 56b1f50e3c10 ("hw/i386/pc: Wire RTC ISA IRQs in south bridges")
cc: qemu-stable
Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Reviewed-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Message-Id: <20250526203820.1853-1-shentey@gmail.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/pc_piix.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
index 0dce512f18..6b6359ef65 100644
--- a/hw/i386/pc_piix.c
+++ b/hw/i386/pc_piix.c
@@ -285,6 +285,8 @@ static void pc_init1(MachineState *machine, const char *pci_type)
         pcms->idebus[0] = qdev_get_child_bus(dev, "ide.0");
         pcms->idebus[1] = qdev_get_child_bus(dev, "ide.1");
     } else {
+        uint32_t irq;
+
         isa_bus = isa_bus_new(NULL, system_memory, system_io,
                               &error_abort);
         isa_bus_register_input_irqs(isa_bus, x86ms->gsi);
@@ -292,6 +294,9 @@ static void pc_init1(MachineState *machine, const char *pci_type)
         x86ms->rtc = isa_new(TYPE_MC146818_RTC);
         qdev_prop_set_int32(DEVICE(x86ms->rtc), "base_year", 2000);
         isa_realize_and_unref(x86ms->rtc, isa_bus, &error_fatal);
+        irq = object_property_get_uint(OBJECT(x86ms->rtc), "irq",
+                                       &error_fatal);
+        isa_connect_gpio_out(ISA_DEVICE(x86ms->rtc), 0, irq);
 
         i8257_dma_init(OBJECT(machine), isa_bus, 0);
         pcms->hpet_enabled = false;

From ffcfb0faaa95fc6ca007f7dd989e390dacf936ca Mon Sep 17 00:00:00 2001
From: Tanish Desai <tanishdesai37@gmail.com>
Date: Wed, 28 May 2025 19:25:28 +0000
Subject: [PATCH 1355/2760] trace/simple: seperate hot paths of tracing
 fucntions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This change improves performance by moving the hot path of the trace_vhost_commit()(or any other trace function) logic to the header file.
Previously, even when the trace event was disabled, the function call chain:-
	trace_vhost_commit()(Or any other trace function) →  _nocheck__trace_vhost_commit() →  _simple_trace_vhost_commit()
	incurred a significant function prologue overhead before checking the trace state.

Disassembly of _simple_trace_vhost_commit() (from the .c file) showed that 11 out of the first 14 instructions were prologue-related, including:
0x10	stp x29, x30, [sp, #-64]!	Prologue: allocates 64-byte frame and saves old FP (x29) & LR (x30)
0x14	adrp x3, trace_events_enabled_count	Prologue: computes page-base of the trace-enable counter
0x18	adrp x2, __stack_chk_guard	Important (maybe prolog don't know?)(stack-protector): starts up the stack-canary load
0x1c	mov x29, sp	Prologue: sets new frame pointer
0x20	ldr x3, [x3]	Prologue: loads the actual trace-enabled count
0x24	stp x19, x20, [sp, #16]	Prologue: spills callee-saved regs used by this function (x19, x20)
0x28	and w20, w0, #0xff	Tracepoint setup: extracts the low-8 bits of arg0 as the “event boolean”
0x2c	ldr x2, [x2]	Prologue (cont’d): completes loading of the stack-canary value
0x30	and w19, w1, #0xff	Tracepoint setup: extracts low-8 bits of arg1
0x34	ldr w0, [x3]	Important: loads the current trace-enabled flag from memory
0x38	ldr x1, [x2]	Prologue (cont’d): reads the canary
0x3c	str x1, [sp, #56]	Prologue (cont’d): writes the canary into the new frame
0x40	mov x1, #0	Prologue (cont’d): zeroes out x1 for the upcoming branch test
0x44	cbnz w0, 0x88	Important: if tracing is disabled (w0==0) skip the heavy path entirely

The trace-enabled check happens after the prologue. This is wasteful when tracing is disabled, which is often the case in production.
To optimize this:
_nocheck__trace_vhost_commit() is now fully inlined in the .h file with
the hot path.It checks trace_event_get_state() before calling into _simple_trace_vhost_commit(), which remains in .c.
This avoids calling into the .c function altogether when the tracepoint is disabled, thereby skipping unnecessary prologue instructions.

This results in better performance by removing redundant instructions in the tracing fast path.

Signed-off-by: Tanish Desai <tanishdesai37@gmail.com>
Message-id: 20250528192528.3968-1-tanishdesai37@gmail.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 scripts/tracetool/backend/simple.py | 23 ++++++++++-------------
 1 file changed, 10 insertions(+), 13 deletions(-)

diff --git a/scripts/tracetool/backend/simple.py b/scripts/tracetool/backend/simple.py
index a74d61fcd6..2688d4b64b 100644
--- a/scripts/tracetool/backend/simple.py
+++ b/scripts/tracetool/backend/simple.py
@@ -36,8 +36,17 @@ def generate_h_begin(events, group):
 
 
 def generate_h(event, group):
-    out('    _simple_%(api)s(%(args)s);',
+    event_id = 'TRACE_' + event.name.upper()
+    if "vcpu" in event.properties:
+        # already checked on the generic format code
+        cond = "true"
+    else:
+        cond = "trace_event_get_state(%s)" % event_id
+    out('    if (%(cond)s) {',
+        '        _simple_%(api)s(%(args)s);',
+        '    }',
         api=event.api(),
+        cond=cond,
         args=", ".join(event.args.names()))
 
 
@@ -72,22 +81,10 @@ def generate_c(event, group):
     if len(event.args) == 0:
         sizestr = '0'
 
-    event_id = 'TRACE_' + event.name.upper()
-    if "vcpu" in event.properties:
-        # already checked on the generic format code
-        cond = "true"
-    else:
-        cond = "trace_event_get_state(%s)" % event_id
-
     out('',
-        '    if (!%(cond)s) {',
-        '        return;',
-        '    }',
-        '',
         '    if (trace_record_start(&rec, %(event_obj)s.id, %(size_str)s)) {',
         '        return; /* Trace Buffer Full, Event Dropped ! */',
         '    }',
-        cond=cond,
         event_obj=event.api(event.QEMU_EVENT),
         size_str=sizestr)
 

From 5e203f73c22786c73214d48a6d1abcb4ae9a3be3 Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Tue, 27 May 2025 09:39:04 +0200
Subject: [PATCH 1356/2760] qapi: Tidy up run-together sentences in doc
 comments

Fixes: a937b6aa739f (qapi: Reformat doc comments to conform to current conventions)
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20250527073916.1243024-2-armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
---
 qapi/acpi.json       |  2 +-
 qapi/block-core.json | 14 +++++++-------
 qapi/crypto.json     | 18 +++++++++---------
 qapi/machine.json    |  4 ++--
 qapi/migration.json  | 18 +++++++++---------
 5 files changed, 28 insertions(+), 28 deletions(-)

diff --git a/qapi/acpi.json b/qapi/acpi.json
index 045dab6228..2d53b82365 100644
--- a/qapi/acpi.json
+++ b/qapi/acpi.json
@@ -80,7 +80,7 @@
 ##
 # @ACPIOSTInfo:
 #
-# OSPM Status Indication for a device For description of possible
+# OSPM Status Indication for a device.  For description of possible
 # values of @source and @status fields see "_OST (OSPM Status
 # Indication)" chapter of ACPI5.0 spec.
 #
diff --git a/qapi/block-core.json b/qapi/block-core.json
index b4115113d4..29d7c1c2c9 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
@@ -2667,7 +2667,7 @@
 # @iops-total-max: I/O operations burst
 #
 # @iops-total-max-length: length of the iops-total-max burst period,
-#     in seconds It must only be set if @iops-total-max is set as
+#     in seconds.  It must only be set if @iops-total-max is set as
 #     well.
 #
 # @iops-read: limit read operations per second
@@ -2675,14 +2675,14 @@
 # @iops-read-max: I/O operations read burst
 #
 # @iops-read-max-length: length of the iops-read-max burst period, in
-#     seconds It must only be set if @iops-read-max is set as well.
+#     seconds.  It must only be set if @iops-read-max is set as well.
 #
 # @iops-write: limit write operations per second
 #
 # @iops-write-max: I/O operations write burst
 #
 # @iops-write-max-length: length of the iops-write-max burst period,
-#     in seconds It must only be set if @iops-write-max is set as
+#     in seconds.  It must only be set if @iops-write-max is set as
 #     well.
 #
 # @bps-total: limit total bytes per second
@@ -2697,14 +2697,14 @@
 # @bps-read-max: total bytes read burst
 #
 # @bps-read-max-length: length of the bps-read-max burst period, in
-#     seconds It must only be set if @bps-read-max is set as well.
+#     seconds.  It must only be set if @bps-read-max is set as well.
 #
 # @bps-write: limit write bytes per second
 #
 # @bps-write-max: total bytes write burst
 #
 # @bps-write-max-length: length of the bps-write-max burst period, in
-#     seconds It must only be set if @bps-write-max is set as well.
+#     seconds.  It must only be set if @bps-write-max is set as well.
 #
 # @iops-size: when limiting by iops max size of an I/O in bytes
 #
@@ -5580,7 +5580,7 @@
 # @x-blockdev-amend:
 #
 # Starts a job to amend format specific options of an existing open
-# block device The job is automatically finalized, but a manual
+# block device.  The job is automatically finalized, but a manual
 # job-dismiss is required.
 #
 # @job-id: Identifier for the newly created job.
@@ -5589,7 +5589,7 @@
 #
 # @options: Options (driver specific)
 #
-# @force: Allow unsafe operations, format specific For luks that
+# @force: Allow unsafe operations, format specific.  For luks that
 #     allows erase of the last active keyslot (permanent loss of
 #     data), and replacement of an active keyslot (possible loss of
 #     data if IO error happens)
diff --git a/qapi/crypto.json b/qapi/crypto.json
index c9d967d782..fc7e294966 100644
--- a/qapi/crypto.json
+++ b/qapi/crypto.json
@@ -202,19 +202,19 @@
 #
 # The options that apply to LUKS encryption format initialization
 #
-# @cipher-alg: the cipher algorithm for data encryption Currently
+# @cipher-alg: the cipher algorithm for data encryption.  Currently
 #     defaults to 'aes-256'.
 #
-# @cipher-mode: the cipher mode for data encryption Currently defaults
-#     to 'xts'
+# @cipher-mode: the cipher mode for data encryption.  Currently
+#     defaults to 'xts'
 #
-# @ivgen-alg: the initialization vector generator Currently defaults
+# @ivgen-alg: the initialization vector generator.  Currently defaults
 #     to 'plain64'
 #
-# @ivgen-hash-alg: the initialization vector generator hash Currently
-#     defaults to 'sha256'
+# @ivgen-hash-alg: the initialization vector generator hash.
+#     Currently defaults to 'sha256'
 #
-# @hash-alg: the master key hash algorithm Currently defaults to
+# @hash-alg: the master key hash algorithm.  Currently defaults to
 #     'sha256'
 #
 # @iter-time: number of milliseconds to spend in PBKDF passphrase
@@ -370,11 +370,11 @@
 # @new-secret: The ID of a QCryptoSecret object providing the password
 #     to be written into added active keyslots
 #
-# @old-secret: Optional (for deactivation only) If given will
+# @old-secret: Optional (for deactivation only).  If given will
 #     deactivate all keyslots that match password located in
 #     QCryptoSecret with this ID
 #
-# @iter-time: Optional (for activation only) Number of milliseconds to
+# @iter-time: Optional (for activation only).  Number of milliseconds to
 #     spend in PBKDF passphrase processing for the newly activated
 #     keyslot.  Currently defaults to 2000.
 #
diff --git a/qapi/machine.json b/qapi/machine.json
index 5373e1368c..0af2e1e0bb 100644
--- a/qapi/machine.json
+++ b/qapi/machine.json
@@ -1160,7 +1160,7 @@
 #
 # Information about the guest balloon device.
 #
-# @actual: the logical size of the VM in bytes Formula used:
+# @actual: the logical size of the VM in bytes.  Formula used:
 #     logical_vm_size = vm_ram_size - balloon_size
 #
 # Since: 0.14
@@ -1199,7 +1199,7 @@
 # is equivalent to the @actual field return by the 'query-balloon'
 # command
 #
-# @actual: the logical size of the VM in bytes Formula used:
+# @actual: the logical size of the VM in bytes.  Formula used:
 #     logical_vm_size = vm_ram_size - balloon_size
 #
 # .. note:: This event is rate-limited.
diff --git a/qapi/migration.json b/qapi/migration.json
index 41826bde45..f5a6b35de4 100644
--- a/qapi/migration.json
+++ b/qapi/migration.json
@@ -760,9 +760,9 @@
 #     auto-converge detects that migration is not making progress.
 #     The default value is 10.  (Since 2.7)
 #
-# @cpu-throttle-tailslow: Make CPU throttling slower at tail stage At
-#     the tail stage of throttling, the Guest is very sensitive to CPU
-#     percentage while the @cpu-throttle -increment is excessive
+# @cpu-throttle-tailslow: Make CPU throttling slower at tail stage.
+#     At the tail stage of throttling, the Guest is very sensitive to
+#     CPU percentage while the @cpu-throttle -increment is excessive
 #     usually at tail stage.  If this parameter is true, we will
 #     compute the ideal CPU percentage used by the Guest, which may
 #     exactly make the dirty rate match the dirty rate threshold.
@@ -941,9 +941,9 @@
 #     auto-converge detects that migration is not making progress.
 #     The default value is 10.  (Since 2.7)
 #
-# @cpu-throttle-tailslow: Make CPU throttling slower at tail stage At
-#     the tail stage of throttling, the Guest is very sensitive to CPU
-#     percentage while the @cpu-throttle -increment is excessive
+# @cpu-throttle-tailslow: Make CPU throttling slower at tail stage.
+#     At the tail stage of throttling, the Guest is very sensitive to
+#     CPU percentage while the @cpu-throttle -increment is excessive
 #     usually at tail stage.  If this parameter is true, we will
 #     compute the ideal CPU percentage used by the Guest, which may
 #     exactly make the dirty rate match the dirty rate threshold.
@@ -1155,9 +1155,9 @@
 #     auto-converge detects that migration is not making progress.
 #     (Since 2.7)
 #
-# @cpu-throttle-tailslow: Make CPU throttling slower at tail stage At
-#     the tail stage of throttling, the Guest is very sensitive to CPU
-#     percentage while the @cpu-throttle -increment is excessive
+# @cpu-throttle-tailslow: Make CPU throttling slower at tail stage.
+#     At the tail stage of throttling, the Guest is very sensitive to
+#     CPU percentage while the @cpu-throttle -increment is excessive
 #     usually at tail stage.  If this parameter is true, we will
 #     compute the ideal CPU percentage used by the Guest, which may
 #     exactly make the dirty rate match the dirty rate threshold.

From 69d68fb34e1d96f60addfd50c9c654eb8c0584e0 Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Tue, 27 May 2025 09:39:05 +0200
Subject: [PATCH 1357/2760] qapi: Tidy up whitespace in doc comments

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20250527073916.1243024-3-armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
---
 qapi/block-core.json   | 16 ++++++++--------
 qapi/block-export.json |  4 ++--
 qapi/char.json         |  2 +-
 qapi/crypto.json       |  3 ++-
 qapi/job.json          |  8 ++++----
 qapi/machine.json      |  2 +-
 qapi/migration.json    | 12 ++++++------
 qapi/qom.json          |  2 +-
 8 files changed, 25 insertions(+), 24 deletions(-)

diff --git a/qapi/block-core.json b/qapi/block-core.json
index 29d7c1c2c9..13223df9b4 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
@@ -488,7 +488,7 @@
 #
 # @active: true if the backend is active; typical cases for inactive backends
 #     are on the migration source instance after migration completes and on the
-#     destination before it completes. (since: 10.0)
+#     destination before it completes.  (since: 10.0)
 #
 # @encrypted: true if the backing device is encrypted
 #
@@ -3030,10 +3030,10 @@
 # state.  Completing the job in any other state is an error.
 #
 # This is supported only for drive mirroring, where it also switches
-# the device to write to the target path only. Note that drive
+# the device to write to the target path only.  Note that drive
 # mirroring includes drive-mirror, blockdev-mirror and block-commit
 # job (only in case of "active commit", when the node being commited
-# is used by the guest). The ability to complete is signaled with a
+# is used by the guest).  The ability to complete is signaled with a
 # BLOCK_JOB_READY event.
 #
 # This command completes an active background block operation
@@ -3068,10 +3068,10 @@
 #
 # Deletes a job that is in the CONCLUDED state.  This command only
 # needs to be run explicitly for jobs that don't have automatic
-# dismiss enabled. In turn, automatic dismiss may be enabled only
+# dismiss enabled.  In turn, automatic dismiss may be enabled only
 # for jobs that have @auto-dismiss option, which are drive-backup,
 # blockdev-backup, drive-mirror, blockdev-mirror, block-commit and
-# block-stream. @auto-dismiss is enabled by default for these
+# block-stream.  @auto-dismiss is enabled by default for these
 # jobs.
 #
 # This command will refuse to operate on any job that has not yet
@@ -4737,7 +4737,7 @@
 # @active: whether the block node should be activated (default: true).
 #     Having inactive block nodes is useful primarily for migration because it
 #     allows opening an image on the destination while the source is still
-#     holding locks for it. (Since 10.0)
+#     holding locks for it.  (Since 10.0)
 #
 # @read-only: whether the block device should be read-only (default:
 #     false).  Note that some block drivers support only read-only
@@ -4999,14 +4999,14 @@
 ##
 # @blockdev-set-active:
 #
-# Activate or inactivate a block device. Use this to manage the handover of
+# Activate or inactivate a block device.  Use this to manage the handover of
 # block devices on migration with qemu-storage-daemon.
 #
 # Activating a node automatically activates all of its child nodes first.
 # Inactivating a node automatically inactivates any of its child nodes that are
 # not in use by a still active node.
 #
-# @node-name: Name of the graph node to activate or inactivate. By default, all
+# @node-name: Name of the graph node to activate or inactivate.  By default, all
 #     nodes are affected by the operation.
 #
 # @active: true if the nodes should be active when the command returns success,
diff --git a/qapi/block-export.json b/qapi/block-export.json
index c783e01a53..04190b503c 100644
--- a/qapi/block-export.json
+++ b/qapi/block-export.json
@@ -373,9 +373,9 @@
 #     (since: 5.2)
 #
 # @allow-inactive: If true, the export allows the exported node to be inactive.
-#     If it is created for an inactive block node, the node remains inactive. If
+#     If it is created for an inactive block node, the node remains inactive.  If
 #     the export type doesn't support running on an inactive node, an error is
-#     returned. If false, inactive block nodes are automatically activated before
+#     returned.  If false, inactive block nodes are automatically activated before
 #     creating the export and trying to inactivate them later fails.
 #     (since: 10.0; default: false)
 #
diff --git a/qapi/char.json b/qapi/char.json
index 447c10b91a..f79216e4d2 100644
--- a/qapi/char.json
+++ b/qapi/char.json
@@ -274,7 +274,7 @@
 # @reconnect: For a client socket, if a socket is disconnected, then
 #     attempt a reconnect after the given number of seconds.  Setting
 #     this to zero disables this function.  The use of this member is
-#     deprecated, use @reconnect-ms instead. (default: 0) (Since: 2.2)
+#     deprecated, use @reconnect-ms instead.  (default: 0) (Since: 2.2)
 #
 # @reconnect-ms: For a client socket, if a socket is disconnected,
 #     then attempt a reconnect after the given number of milliseconds.
diff --git a/qapi/crypto.json b/qapi/crypto.json
index fc7e294966..9ec6301e18 100644
--- a/qapi/crypto.json
+++ b/qapi/crypto.json
@@ -55,7 +55,8 @@
 # @sha512: SHA-512.  (since 2.7)
 #
 # @ripemd160: RIPEMD-160.  (since 2.7)
-# @sm3: SM3. (since 9.2.0)
+#
+# @sm3: SM3.  (since 9.2.0)
 #
 # Since: 2.6
 ##
diff --git a/qapi/job.json b/qapi/job.json
index b03f80bc84..c53c96cce8 100644
--- a/qapi/job.json
+++ b/qapi/job.json
@@ -191,10 +191,10 @@
 # state.  Completing the job in any other state is an error.
 #
 # This is supported only for drive mirroring, where it also switches
-# the device to write to the target path only. Note that drive
+# the device to write to the target path only.  Note that drive
 # mirroring includes drive-mirror, blockdev-mirror and block-commit
 # job (only in case of "active commit", when the node being commited
-# is used by the guest). The ability to complete is signaled with a
+# is used by the guest).  The ability to complete is signaled with a
 # BLOCK_JOB_READY event.
 #
 # This command completes an active background block operation
@@ -216,10 +216,10 @@
 #
 # Deletes a job that is in the CONCLUDED state.  This command only
 # needs to be run explicitly for jobs that don't have automatic
-# dismiss enabled. In turn, automatic dismiss may be enabled only
+# dismiss enabled.  In turn, automatic dismiss may be enabled only
 # for jobs that have @auto-dismiss option, which are drive-backup,
 # blockdev-backup, drive-mirror, blockdev-mirror, block-commit and
-# block-stream. @auto-dismiss is enabled by default for these
+# block-stream.  @auto-dismiss is enabled by default for these
 # jobs.
 #
 # This command will refuse to operate on any job that has not yet
diff --git a/qapi/machine.json b/qapi/machine.json
index 0af2e1e0bb..069e87d16a 100644
--- a/qapi/machine.json
+++ b/qapi/machine.json
@@ -694,7 +694,7 @@
 # Structure of HMAT (Heterogeneous Memory Attribute Table)
 #
 # For more information about @HmatLBDataType, see chapter 5.2.27.4:
-# Table 5-146:  Field "Data Type" of ACPI 6.3 spec.
+# Table 5-146: Field "Data Type" of ACPI 6.3 spec.
 #
 # @access-latency: access latency (nanoseconds)
 #
diff --git a/qapi/migration.json b/qapi/migration.json
index f5a6b35de4..7c7b09c341 100644
--- a/qapi/migration.json
+++ b/qapi/migration.json
@@ -842,9 +842,9 @@
 #     more CPU.  Defaults to 1.  (Since 5.0)
 #
 # @multifd-qatzip-level: Set the compression level to be used in live
-#     migration. The level is an integer between 1 and 9, where 1 means
+#     migration.  The level is an integer between 1 and 9, where 1 means
 #     the best compression speed, and 9 means the best compression
-#     ratio which will consume more CPU. Defaults to 1.  (Since 9.2)
+#     ratio which will consume more CPU.  Defaults to 1.  (Since 9.2)
 #
 # @multifd-zstd-level: Set the compression level to be used in live
 #     migration, the compression level is an integer between 0 and 20,
@@ -1023,9 +1023,9 @@
 #     more CPU.  Defaults to 1.  (Since 5.0)
 #
 # @multifd-qatzip-level: Set the compression level to be used in live
-#     migration. The level is an integer between 1 and 9, where 1 means
+#     migration.  The level is an integer between 1 and 9, where 1 means
 #     the best compression speed, and 9 means the best compression
-#     ratio which will consume more CPU. Defaults to 1.  (Since 9.2)
+#     ratio which will consume more CPU.  Defaults to 1.  (Since 9.2)
 #
 # @multifd-zstd-level: Set the compression level to be used in live
 #     migration, the compression level is an integer between 0 and 20,
@@ -1233,9 +1233,9 @@
 #     more CPU.  Defaults to 1.  (Since 5.0)
 #
 # @multifd-qatzip-level: Set the compression level to be used in live
-#     migration. The level is an integer between 1 and 9, where 1 means
+#     migration.  The level is an integer between 1 and 9, where 1 means
 #     the best compression speed, and 9 means the best compression
-#     ratio which will consume more CPU. Defaults to 1.  (Since 9.2)
+#     ratio which will consume more CPU.  Defaults to 1.  (Since 9.2)
 #
 # @multifd-zstd-level: Set the compression level to be used in live
 #     migration, the compression level is an integer between 0 and 20,
diff --git a/qapi/qom.json b/qapi/qom.json
index 45cd47508b..3e8debf78c 100644
--- a/qapi/qom.json
+++ b/qapi/qom.json
@@ -870,7 +870,7 @@
 #     information read from devices and switches in conjunction with
 #     link characteristics read from PCIe Configuration space.
 #     To get the full path latency from CPU to CXL attached DRAM
-#     CXL device:  Add the latency from CPU to Generic Port (from
+#     CXL device: Add the latency from CPU to Generic Port (from
 #     HMAT indexed via the node ID in this SRAT structure) to
 #     that for CXL bus links, the latency across intermediate switches
 #     and from the EP port to the actual memory.  Bandwidth is more

From 73aaba61a07c4bb4cd683a450a47504274ea1274 Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Tue, 27 May 2025 09:39:06 +0200
Subject: [PATCH 1358/2760] qapi: Move (since X.Y) to end of description

By convention, we put (since X.Y) at the end of the description.  Move
the ones that somehow ended up in the middle of the description to the
end.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20250527073916.1243024-4-armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
---
 qapi/block-core.json | 18 +++++++++---------
 qapi/net.json        |  6 +++---
 2 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/qapi/block-core.json b/qapi/block-core.json
index 13223df9b4..0700bd3d46 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
@@ -1322,8 +1322,8 @@
 # @incremental: only copy data described by the dirty bitmap.
 #     (since: 2.4)
 #
-# @bitmap: only copy data described by the dirty bitmap.  (since: 4.2)
-#     Behavior on completion is determined by the BitmapSyncMode.
+# @bitmap: only copy data described by the dirty bitmap.  Behavior on
+#     completion is determined by the BitmapSyncMode.  (since: 4.2)
 #
 # Since: 1.3
 ##
@@ -3415,8 +3415,8 @@
 # Driver specific block device options for LUKS.
 #
 # @key-secret: the ID of a QCryptoSecret object providing the
-#     decryption key (since 2.6).  Mandatory except when doing a
-#     metadata-only probe of the image.
+#     decryption key.  Mandatory except when doing a metadata-only
+#     probe of the image.  (since 2.6)
 #
 # @header: block device holding a detached LUKS header.  (since 9.0)
 #
@@ -4724,11 +4724,11 @@
 #
 # @driver: block driver name
 #
-# @node-name: the node name of the new node (Since 2.0).  This option
-#     is required on the top level of blockdev-add.  Valid node names
-#     start with an alphabetic character and may contain only
-#     alphanumeric characters, '-', '.' and '_'.  Their maximum length
-#     is 31 characters.
+# @node-name: the node name of the new node.  This option is required
+#     on the top level of blockdev-add.  Valid node names start with
+#     an alphabetic character and may contain only alphanumeric
+#     characters, '-', '.' and '_'.  Their maximum length is 31
+#     characters.  (Since 2.0)
 #
 # @discard: discard-related options (default: ignore)
 #
diff --git a/qapi/net.json b/qapi/net.json
index 310cc4fd19..e670efd6b0 100644
--- a/qapi/net.json
+++ b/qapi/net.json
@@ -150,9 +150,9 @@
 # @domainname: guest-visible domain name of the virtual nameserver
 #     (since 3.0)
 #
-# @ipv6-prefix: IPv6 network prefix (default is fec0::) (since 2.6).
-#     The network prefix is given in the usual hexadecimal IPv6
-#     address notation.
+# @ipv6-prefix: IPv6 network prefix (default is fec0::).  The network
+#     prefix is given in the usual hexadecimal IPv6 address notation.
+#     (since 2.6)
 #
 # @ipv6-prefixlen: IPv6 network prefix length (default is 64) (since
 #     2.6)

From c1a6aa1d443e17e1902417ee2e531394eaf4c2d4 Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Tue, 27 May 2025 09:39:07 +0200
Subject: [PATCH 1359/2760] qapi: Avoid breaking lines within (since X.Y)

Easier on the eyes and for grep.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20250527073916.1243024-5-armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
---
 qapi/block-core.json | 56 ++++++++++++++++++++++----------------------
 qapi/introspect.json |  4 ++--
 qapi/job.json        | 12 +++++-----
 qapi/machine.json    |  4 ++--
 qapi/migration.json  | 36 ++++++++++++++--------------
 qapi/net.json        | 12 +++++-----
 qapi/run-state.json  |  4 ++--
 qapi/ui.json         |  4 ++--
 8 files changed, 66 insertions(+), 66 deletions(-)

diff --git a/qapi/block-core.json b/qapi/block-core.json
index 0700bd3d46..cc48fc7122 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
@@ -31,8 +31,8 @@
 # @icount: Current instruction count.  Appears when execution
 #     record/replay is enabled.  Used for "time-traveling" to match
 #     the moment in the recorded execution with the snapshots.  This
-#     counter may be obtained through @query-replay command (since
-#     5.2)
+#     counter may be obtained through @query-replay command
+#     (since 5.2)
 #
 # Since: 1.3
 ##
@@ -510,11 +510,11 @@
 #
 # @bps_max: total throughput limit during bursts, in bytes (Since 1.7)
 #
-# @bps_rd_max: read throughput limit during bursts, in bytes (Since
-#     1.7)
+# @bps_rd_max: read throughput limit during bursts, in bytes
+#     (Since 1.7)
 #
-# @bps_wr_max: write throughput limit during bursts, in bytes (Since
-#     1.7)
+# @bps_wr_max: write throughput limit during bursts, in bytes
+#     (Since 1.7)
 #
 # @iops_max: total I/O operations per second during bursts, in bytes
 #     (Since 1.7)
@@ -951,11 +951,11 @@
 # @unmap_operations: The number of unmap operations performed by the
 #     device (Since 4.2)
 #
-# @rd_total_time_ns: Total time spent on reads in nanoseconds (since
-#     0.15).
+# @rd_total_time_ns: Total time spent on reads in nanoseconds
+#     (since 0.15)
 #
-# @wr_total_time_ns: Total time spent on writes in nanoseconds (since
-#     0.15).
+# @wr_total_time_ns: Total time spent on writes in nanoseconds
+#     (since 0.15)
 #
 # @zone_append_total_time_ns: Total time spent on zone append writes
 #     in nanoseconds (since 8.1)
@@ -1502,15 +1502,15 @@
 #
 # @device: the name of the device to take a snapshot of.
 #
-# @node-name: graph node name to generate the snapshot from (Since
-#     2.0)
+# @node-name: graph node name to generate the snapshot from
+#     (Since 2.0)
 #
 # @snapshot-file: the target of the new overlay image.  If the file
 #     exists, or if it is a device, the overlay will be created in the
 #     existing file/device.  Otherwise, a new file will be created.
 #
-# @snapshot-node-name: the graph node name of the new image (Since
-#     2.0)
+# @snapshot-node-name: the graph node name of the new image
+#     (Since 2.0)
 #
 # @format: the format of the overlay image, default is 'qcow2'.
 #
@@ -1785,8 +1785,8 @@
 # If top == base, that is an error.  If top has no overlays on top of
 # it, or if it is in use by a writer, the job will not be completed by
 # itself.  The user needs to complete the job with the
-# block-job-complete command after getting the ready event.  (Since
-# 2.0)
+# block-job-complete command after getting the ready event.
+# (Since 2.0)
 #
 # If the base image is smaller than top, then the base image will be
 # resized to be the same size as top.  If top is smaller than the base
@@ -2169,8 +2169,8 @@
 # @format: the format of the new destination, default is to probe if
 #     @mode is 'existing', else the format of the source
 #
-# @node-name: the new block driver state node name in the graph (Since
-#     2.1)
+# @node-name: the new block driver state node name in the graph
+#     (Since 2.1)
 #
 # @replaces: with sync=full graph node name to be replaced by the new
 #     image when a whole image copy is done.  This can be used to
@@ -2593,11 +2593,11 @@
 #
 # @bps_max: total throughput limit during bursts, in bytes (Since 1.7)
 #
-# @bps_rd_max: read throughput limit during bursts, in bytes (Since
-#     1.7)
+# @bps_rd_max: read throughput limit during bursts, in bytes
+#     (Since 1.7)
 #
-# @bps_wr_max: write throughput limit during bursts, in bytes (Since
-#     1.7)
+# @bps_wr_max: write throughput limit during bursts, in bytes
+#     (Since 1.7)
 #
 # @iops_max: total I/O operations per second during bursts, in bytes
 #     (Since 1.7)
@@ -3655,8 +3655,8 @@
 #     this feature.  (since 2.5)
 #
 # @encrypt: Image decryption options.  Mandatory for encrypted images,
-#     except when doing a metadata-only probe of the image.  (since
-#     2.10)
+#     except when doing a metadata-only probe of the image.
+#     (since 2.10)
 #
 # @data-file: reference to or definition of the external data file.
 #     This may only be specified for images that require an external
@@ -4326,8 +4326,8 @@
 # @user: Ceph id name.
 #
 # @auth-client-required: Acceptable authentication modes.  This maps
-#     to Ceph configuration option "auth_client_required".  (Since
-#     3.0)
+#     to Ceph configuration option "auth_client_required".
+#     (Since 3.0)
 #
 # @key-secret: ID of a QCryptoSecret object providing a key for cephx
 #     authentication.  This maps to Ceph configuration option "key".
@@ -4581,8 +4581,8 @@
 #     error.  During the first @reconnect-delay seconds, all requests
 #     are paused and will be rerun on a successful reconnect.  After
 #     that time, any delayed requests and all future requests before a
-#     successful reconnect will immediately fail.  Default 0 (Since
-#     4.2)
+#     successful reconnect will immediately fail.  Default 0
+#     (Since 4.2)
 #
 # @open-timeout: In seconds.  If zero, the nbd driver tries the
 #     connection only once, and fails to open if the connection fails.
diff --git a/qapi/introspect.json b/qapi/introspect.json
index 01bb242947..95724ee2d2 100644
--- a/qapi/introspect.json
+++ b/qapi/introspect.json
@@ -154,8 +154,8 @@
 #
 # Additional SchemaInfo members for meta-type 'enum'.
 #
-# @members: the enum type's members, in no particular order (since
-#     6.2).
+# @members: the enum type's members, in no particular order.
+#     (since 6.2)
 #
 # @values: the enumeration type's member names, in no particular
 #     order.  Redundant with @members.  Just for backward
diff --git a/qapi/job.json b/qapi/job.json
index c53c96cce8..9ddba537db 100644
--- a/qapi/job.json
+++ b/qapi/job.json
@@ -20,14 +20,14 @@
 #
 # @create: image creation job type, see "blockdev-create" (since 3.0)
 #
-# @amend: image options amend job type, see "x-blockdev-amend" (since
-#     5.1)
+# @amend: image options amend job type, see "x-blockdev-amend"
+#     (since 5.1)
 #
-# @snapshot-load: snapshot load job type, see "snapshot-load" (since
-#     6.0)
+# @snapshot-load: snapshot load job type, see "snapshot-load"
+#     (since 6.0)
 #
-# @snapshot-save: snapshot save job type, see "snapshot-save" (since
-#     6.0)
+# @snapshot-save: snapshot save job type, see "snapshot-save"
+#     (since 6.0)
 #
 # @snapshot-delete: snapshot delete job type, see "snapshot-delete"
 #     (since 6.0)
diff --git a/qapi/machine.json b/qapi/machine.json
index 069e87d16a..5eb67fc4e9 100644
--- a/qapi/machine.json
+++ b/qapi/machine.json
@@ -182,8 +182,8 @@
 # @default-cpu-type: default CPU model typename if none is requested
 #     via the -cpu argument.  (since 4.2)
 #
-# @default-ram-id: the default ID of initial RAM memory backend (since
-#     5.2)
+# @default-ram-id: the default ID of initial RAM memory backend
+#     (since 5.2)
 #
 # @acpi: machine type supports ACPI (since 8.0)
 #
diff --git a/qapi/migration.json b/qapi/migration.json
index 7c7b09c341..7d1ec06605 100644
--- a/qapi/migration.json
+++ b/qapi/migration.json
@@ -57,8 +57,8 @@
 #
 # @dirty-sync-missed-zero-copy: Number of times dirty RAM
 #     synchronization could not avoid copying dirty pages.  This is
-#     between 0 and @dirty-sync-count * @multifd-channels.  (since
-#     7.1)
+#     between 0 and @dirty-sync-count * @multifd-channels.
+#     (since 7.1)
 #
 # Since: 0.14
 ##
@@ -137,16 +137,16 @@
 #
 # @active: in the process of doing migration.
 #
-# @postcopy-active: like active, but now in postcopy mode.  (since
-#     2.5)
+# @postcopy-active: like active, but now in postcopy mode.
+#     (since 2.5)
 #
 # @postcopy-paused: during postcopy but paused.  (since 3.0)
 #
 # @postcopy-recover-setup: setup phase for a postcopy recovery
 #     process, preparing for a recovery phase to start.  (since 9.1)
 #
-# @postcopy-recover: trying to recover from a paused postcopy.  (since
-#     3.0)
+# @postcopy-recover: trying to recover from a paused postcopy.
+#     (since 3.0)
 #
 # @completed: migration is finished.
 #
@@ -422,8 +422,8 @@
 #     for precopy.  (since 2.10)
 #
 # @pause-before-switchover: Pause outgoing migration before
-#     serialising device state and before disabling block IO (since
-#     2.11)
+#     serialising device state and before disabling block IO
+#     (since 2.11)
 #
 # @multifd: Use more than one fd for migration (since 4.0)
 #
@@ -697,8 +697,8 @@
 # @alias: An alias name for migration (for example the bitmap name on
 #     the opposite site).
 #
-# @transform: Allows the modification of the migrated bitmap.  (since
-#     6.0)
+# @transform: Allows the modification of the migrated bitmap.
+#     (since 6.0)
 #
 # Since: 5.2
 ##
@@ -770,8 +770,8 @@
 #     specified by @cpu-throttle-increment and the one generated by
 #     ideal CPU percentage.  Therefore, it is compatible to
 #     traditional throttling, meanwhile the throttle increment won't
-#     be excessive at tail stage.  The default value is false.  (Since
-#     5.1)
+#     be excessive at tail stage.  The default value is false.
+#     (Since 5.1)
 #
 # @tls-creds: ID of the 'tls-creds' object that provides credentials
 #     for establishing a TLS connection over the migration data
@@ -951,8 +951,8 @@
 #     specified by @cpu-throttle-increment and the one generated by
 #     ideal CPU percentage.  Therefore, it is compatible to
 #     traditional throttling, meanwhile the throttle increment won't
-#     be excessive at tail stage.  The default value is false.  (Since
-#     5.1)
+#     be excessive at tail stage.  The default value is false.
+#     (Since 5.1)
 #
 # @tls-creds: ID of the 'tls-creds' object that provides credentials
 #     for establishing a TLS connection over the migration data
@@ -1148,8 +1148,8 @@
 #     percentage.  The default value is 50.  (Since 5.0)
 #
 # @cpu-throttle-initial: Initial percentage of time guest cpus are
-#     throttled when migration auto-converge is activated.  (Since
-#     2.7)
+#     throttled when migration auto-converge is activated.
+#     (Since 2.7)
 #
 # @cpu-throttle-increment: throttle percentage increase each time
 #     auto-converge detects that migration is not making progress.
@@ -1165,8 +1165,8 @@
 #     specified by @cpu-throttle-increment and the one generated by
 #     ideal CPU percentage.  Therefore, it is compatible to
 #     traditional throttling, meanwhile the throttle increment won't
-#     be excessive at tail stage.  The default value is false.  (Since
-#     5.1)
+#     be excessive at tail stage.  The default value is false.
+#     (Since 5.1)
 #
 # @tls-creds: ID of the 'tls-creds' object that provides credentials
 #     for establishing a TLS connection over the migration data
diff --git a/qapi/net.json b/qapi/net.json
index e670efd6b0..97ea183981 100644
--- a/qapi/net.json
+++ b/qapi/net.json
@@ -154,8 +154,8 @@
 #     prefix is given in the usual hexadecimal IPv6 address notation.
 #     (since 2.6)
 #
-# @ipv6-prefixlen: IPv6 network prefix length (default is 64) (since
-#     2.6)
+# @ipv6-prefixlen: IPv6 network prefix length (default is 64)
+#     (since 2.6)
 #
 # @ipv6-host: guest-visible IPv6 address of the host (since 2.6)
 #
@@ -387,8 +387,8 @@
 #
 # @hubid: hub identifier number
 #
-# @netdev: used to connect hub to a netdev instead of a device (since
-#     2.12)
+# @netdev: used to connect hub to a netdev instead of a device
+#     (since 2.12)
 #
 # Since: 1.2
 ##
@@ -510,8 +510,8 @@
 # @queues: number of queues to be created for multiqueue vhost-vdpa
 #     (default: 1)
 #
-# @x-svq: Start device with (experimental) shadow virtqueue.  (Since
-#     7.1) (default: false)
+# @x-svq: Start device with (experimental) shadow virtqueue.
+#     (Since 7.1) (default: false)
 #
 # Features:
 #
diff --git a/qapi/run-state.json b/qapi/run-state.json
index ee11adc508..ebfeb669ab 100644
--- a/qapi/run-state.json
+++ b/qapi/run-state.json
@@ -365,8 +365,8 @@
 # @shutdown: Shutdown the VM and exit, according to the shutdown
 #     action
 #
-# @exit-failure: Shutdown the VM and exit with nonzero status (since
-#     7.1)
+# @exit-failure: Shutdown the VM and exit with nonzero status
+#     (since 7.1)
 #
 # Since: 6.0
 ##
diff --git a/qapi/ui.json b/qapi/ui.json
index 3d0c853c9a..7cfedb3914 100644
--- a/qapi/ui.json
+++ b/qapi/ui.json
@@ -175,8 +175,8 @@
 # @filename: the path of a new file to store the image
 #
 # @device: ID of the display device that should be dumped.  If this
-#     parameter is missing, the primary display will be used.  (Since
-#     2.12)
+#     parameter is missing, the primary display will be used.
+#     (Since 2.12)
 #
 # @head: head to use in case the device supports multiple heads.  If
 #     this parameter is missing, head #0 will be used.  Also note that

From 2e2309b6be074a2087afc3aedabcee722fcd512f Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Tue, 27 May 2025 09:39:08 +0200
Subject: [PATCH 1360/2760] qapi: Drop a problematic (Since: 2.11) from
 query-hotpluggable-cpus

There is a (Since: 2.11) in a query-hotpluggable-cpus example.
Versioning information ought to be in the command description, not
examples.  The command description is basically empty (there is a TODO
about it).

What exactly didn't work before 2.11 is not quite clear from the
documentation.  The example was added in commit 4dc3b151882 (s390x:
implement query-hotpluggable-cpus), which suggests the command failed
for the s390x target until then.  This was almost eight years ago, and
I doubt anyone still cares about this detail.  Simply delete
the problematic (Since: 2.11).

Cc: David Hildenbrand <david@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20250527073916.1243024-6-armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
---
 qapi/machine.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/qapi/machine.json b/qapi/machine.json
index 5eb67fc4e9..230b9b20dd 100644
--- a/qapi/machine.json
+++ b/qapi/machine.json
@@ -1089,7 +1089,7 @@
 #    :annotated:
 #
 #    For s390x-virtio-ccw machine type started with
-#    ``-smp 1,maxcpus=2 -cpu qemu`` (Since: 2.11)::
+#    ``-smp 1,maxcpus=2 -cpu qemu``::
 #
 #     -> { "execute": "query-hotpluggable-cpus" }
 #     <- {"return": [

From 6263225492bad6d0f3a4feea13cd949b977fb3c3 Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Tue, 27 May 2025 09:39:09 +0200
Subject: [PATCH 1361/2760] qapi: Correct spelling of QEMU in doc comments

Improve awkward phrasing in migrate-incoming While there.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20250527073916.1243024-7-armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
---
 qapi/audio.json        |  8 ++++----
 qapi/block-core.json   | 10 +++++-----
 qapi/block-export.json |  2 +-
 qapi/char.json         |  6 +++---
 qapi/introspect.json   |  4 ++--
 qapi/migration.json    |  8 ++++----
 qapi/run-state.json    |  6 +++---
 qapi/transaction.json  |  2 +-
 qapi/uefi.json         |  2 +-
 qapi/ui.json           |  4 ++--
 10 files changed, 26 insertions(+), 26 deletions(-)

diff --git a/qapi/audio.json b/qapi/audio.json
index 8de4430578..16de231f6d 100644
--- a/qapi/audio.json
+++ b/qapi/audio.json
@@ -309,9 +309,9 @@
 #
 # @name: name of the sink/source to use
 #
-# @stream-name: name of the PulseAudio stream created by qemu.  Can be
+# @stream-name: name of the PulseAudio stream created by QEMU.  Can be
 #     used to identify the stream in PulseAudio when you create
-#     multiple PulseAudio devices or run multiple qemu instances
+#     multiple PulseAudio devices or run multiple QEMU instances
 #     (default: audiodev's id, since 4.2)
 #
 # @latency: latency you want PulseAudio to achieve in microseconds
@@ -353,9 +353,9 @@
 #
 # @name: name of the sink/source to use
 #
-# @stream-name: name of the PipeWire stream created by qemu.  Can be
+# @stream-name: name of the PipeWire stream created by QEMU.  Can be
 #     used to identify the stream in PipeWire when you create multiple
-#     PipeWire devices or run multiple qemu instances (default:
+#     PipeWire devices or run multiple QEMU instances (default:
 #     audiodev's id)
 #
 # @latency: latency you want PipeWire to achieve in microseconds
diff --git a/qapi/block-core.json b/qapi/block-core.json
index cc48fc7122..b6447e847e 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
@@ -2030,7 +2030,7 @@
 #
 # @id: Block graph node identifier.  This @id is generated only for
 #     x-debug-query-block-graph and does not relate to any other
-#     identifiers in Qemu.
+#     identifiers in QEMU.
 #
 # @type: Type of graph node.  Can be one of block-backend, block-job
 #     or block-driver-state.
@@ -2794,7 +2794,7 @@
 # The node that receives the data is called the top image, can be
 # located in any part of the chain (but always above the base image;
 # see below) and can be specified using its device or node name.
-# Earlier qemu versions only allowed 'device' to name the top level
+# Earlier QEMU versions only allowed 'device' to name the top level
 # node; presence of the 'base-node' parameter during introspection can
 # be used as a witness of the enhanced semantics of 'device'.
 #
@@ -3196,7 +3196,7 @@
 #
 # Selects the AIO backend to handle I/O requests
 #
-# @threads: Use qemu's thread pool
+# @threads: Use QEMU's thread pool
 #
 # @native: Use native AIO backend (only Linux and Windows)
 #
@@ -5157,10 +5157,10 @@
 ##
 # @BlockdevQcow2Version:
 #
-# @v2: The original QCOW2 format as introduced in qemu 0.10 (version
+# @v2: The original QCOW2 format as introduced in QEMU 0.10 (version
 #     2)
 #
-# @v3: The extended QCOW2 format as introduced in qemu 1.1 (version 3)
+# @v3: The extended QCOW2 format as introduced in QEMU 1.1 (version 3)
 #
 # Since: 2.12
 ##
diff --git a/qapi/block-export.json b/qapi/block-export.json
index 04190b503c..ed4deb54db 100644
--- a/qapi/block-export.json
+++ b/qapi/block-export.json
@@ -169,7 +169,7 @@
 # @growable: Whether writes beyond the EOF should grow the block node
 #     accordingly.  (default: false)
 #
-# @allow-other: If this is off, only qemu's user is allowed access to
+# @allow-other: If this is off, only QEMU's user is allowed access to
 #     this export.  That cannot be changed even with chmod or chown.
 #     Enabling this option will allow other users access to the export
 #     with the FUSE mount option "allow_other".  Note that using
diff --git a/qapi/char.json b/qapi/char.json
index f79216e4d2..df6e325e2e 100644
--- a/qapi/char.json
+++ b/qapi/char.json
@@ -351,7 +351,7 @@
 # Configuration info for stdio chardevs.
 #
 # @signal: Allow signals (such as SIGINT triggered by ^C) be delivered
-#     to qemu.  Default: true.
+#     to QEMU.  Default: true.
 #
 # Since: 1.5
 ##
@@ -443,7 +443,7 @@
 ##
 # @ChardevQemuVDAgent:
 #
-# Configuration info for qemu vdagent implementation.
+# Configuration info for QEMU vdagent implementation.
 #
 # @mouse: enable/disable mouse, default is enabled.
 #
@@ -656,7 +656,7 @@
 ##
 # @ChardevQemuVDAgentWrapper:
 #
-# @data: Configuration info for qemu vdagent implementation
+# @data: Configuration info for QEMU vdagent implementation
 #
 # Since: 6.1
 ##
diff --git a/qapi/introspect.json b/qapi/introspect.json
index 95724ee2d2..e9e0297282 100644
--- a/qapi/introspect.json
+++ b/qapi/introspect.json
@@ -26,9 +26,9 @@
 # the QAPI schema.
 #
 # Furthermore, while we strive to keep the QMP wire format
-# backwards-compatible across qemu versions, the introspection output
+# backwards-compatible across QEMU versions, the introspection output
 # is not guaranteed to have the same stability.  For example, one
-# version of qemu may list an object member as an optional
+# version of QEMU may list an object member as an optional
 # non-variant, while another lists the same member only through the
 # object's variants; or the type of a member may change from a generic
 # string into a specific enum or from one specific type into an
diff --git a/qapi/migration.json b/qapi/migration.json
index 7d1ec06605..84edcf81e4 100644
--- a/qapi/migration.json
+++ b/qapi/migration.json
@@ -415,7 +415,7 @@
 #     on secondary side, this process is called COarse-Grain LOck
 #     Stepping (COLO) for Non-stop Service.  (since 2.8)
 #
-# @release-ram: if enabled, qemu will free the migrated ram pages on
+# @release-ram: if enabled, QEMU will free the migrated ram pages on
 #     the source during postcopy-ram migration.  (since 2.9)
 #
 # @return-path: If enabled, migration will use the return path even
@@ -1500,7 +1500,7 @@
 ##
 # @x-colo-lost-heartbeat:
 #
-# Tell qemu that heartbeat is lost, request it to do takeover
+# Tell QEMU that heartbeat is lost, request it to do takeover
 # procedures.  If this command is sent to the PVM, the Primary side
 # will exit COLO mode.  If sent to the Secondary, the Secondary side
 # will run failover work, then takes over server operation to become
@@ -1729,8 +1729,8 @@
 ##
 # @migrate-incoming:
 #
-# Start an incoming migration, the qemu must have been started with
-# -incoming defer
+# Start an incoming migration.  QEMU must have been started with
+# -incoming defer.
 #
 # @uri: The Uniform Resource Identifier identifying the source or
 #     address to listen on
diff --git a/qapi/run-state.json b/qapi/run-state.json
index ebfeb669ab..fcc00c805b 100644
--- a/qapi/run-state.json
+++ b/qapi/run-state.json
@@ -135,19 +135,19 @@
 ##
 # @SHUTDOWN:
 #
-# Emitted when the virtual machine has shut down, indicating that qemu
+# Emitted when the virtual machine has shut down, indicating that QEMU
 # is about to exit.
 #
 # @guest: If true, the shutdown was triggered by a guest request (such
 #     as a guest-initiated ACPI shutdown request or other
 #     hardware-specific action) rather than a host request (such as
-#     sending qemu a SIGINT).  (since 2.10)
+#     sending QEMU a SIGINT).  (since 2.10)
 #
 # @reason: The @ShutdownCause which resulted in the SHUTDOWN.
 #     (since 4.0)
 #
 # .. note:: If the command-line option ``-no-shutdown`` has been
-#    specified, qemu will not exit, and a STOP event will eventually
+#    specified, QEMU will not exit, and a STOP event will eventually
 #    follow the SHUTDOWN event.
 #
 # Since: 0.12
diff --git a/qapi/transaction.json b/qapi/transaction.json
index 021e383496..5c3394919e 100644
--- a/qapi/transaction.json
+++ b/qapi/transaction.json
@@ -223,7 +223,7 @@
 # exists, the request will be rejected.  Only some image formats
 # support it, for example, qcow2, and rbd,
 #
-# On failure, qemu will try delete the newly created internal snapshot
+# On failure, QEMU will try delete the newly created internal snapshot
 # in the transaction.  When an I/O error occurs during deletion, the
 # user needs to fix it later with qemu-img or other command.
 #
diff --git a/qapi/uefi.json b/qapi/uefi.json
index bdfcabe1df..6592183d6c 100644
--- a/qapi/uefi.json
+++ b/qapi/uefi.json
@@ -5,7 +5,7 @@
 ##
 # = UEFI Variable Store
 #
-# The qemu efi variable store implementation (hw/uefi/) uses this to
+# The QEMU efi variable store implementation (hw/uefi/) uses this to
 # store non-volatile variables in json format on disk.
 #
 # This is an existing format already supported by (at least) two other
diff --git a/qapi/ui.json b/qapi/ui.json
index 7cfedb3914..514fa159b1 100644
--- a/qapi/ui.json
+++ b/qapi/ui.json
@@ -1526,12 +1526,12 @@
 #
 # Display (user interface) options.
 #
-# @type: Which DisplayType qemu should use.
+# @type: Which DisplayType QEMU should use.
 #
 # @full-screen: Start user interface in fullscreen mode
 #     (default: off).
 #
-# @window-close: Allow to quit qemu with window close button
+# @window-close: Allow to quit QEMU with window close button
 #     (default: on).
 #
 # @show-cursor: Force showing the mouse cursor (default: off).

From 83691fa0698d658781a9ce81d4b8775d34ba6a8e Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Tue, 27 May 2025 09:39:10 +0200
Subject: [PATCH 1362/2760] qapi: Fix capitalization in doc comments

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20250527073916.1243024-8-armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
---
 qapi/block-core.json  | 6 +++---
 qapi/block.json       | 2 +-
 qapi/cryptodev.json   | 2 +-
 qapi/cxl.json         | 2 +-
 qapi/machine.json     | 2 +-
 qapi/misc-i386.json   | 2 +-
 qapi/run-state.json   | 2 +-
 qapi/transaction.json | 2 +-
 8 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/qapi/block-core.json b/qapi/block-core.json
index b6447e847e..f0faca1054 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
@@ -1337,7 +1337,7 @@
 # bitmap when used for data copy operations.
 #
 # @on-success: The bitmap is only synced when the operation is
-#     successful.  This is the behavior always used for 'INCREMENTAL'
+#     successful.  This is the behavior always used for incremental
 #     backups.
 #
 # @never: The bitmap is never synchronized with the operation, and is
@@ -1589,7 +1589,7 @@
 #
 # @bitmap-mode: Specifies the type of data the bitmap should contain
 #     after the operation concludes.  Must be present if a bitmap was
-#     provided, Must NOT be present otherwise.  (Since 4.2)
+#     provided, must NOT be present otherwise.  (Since 4.2)
 #
 # @compress: true to compress data, if the target format supports it.
 #     (default: false) (since 2.8)
@@ -1840,7 +1840,7 @@
 # @speed: the maximum speed, in bytes per second
 #
 # @on-error: the action to take on an error.  'ignore' means that the
-#     request should be retried.  (default: report; Since: 5.0)
+#     request should be retried.  (default: report; since: 5.0)
 #
 # @filter-node-name: the node name that should be assigned to the
 #     filter driver that the commit job inserts into the graph above
diff --git a/qapi/block.json b/qapi/block.json
index f5374bd86c..1490a1a17f 100644
--- a/qapi/block.json
+++ b/qapi/block.json
@@ -48,7 +48,7 @@
 ##
 # @FloppyDriveType:
 #
-# Type of Floppy drive to be emulated by the Floppy Disk Controller.
+# Type of floppy drive to be emulated by the Floppy Disk Controller.
 #
 # @144: 1.44MB 3.5" drive
 #
diff --git a/qapi/cryptodev.json b/qapi/cryptodev.json
index 28b97eb3da..b13db26403 100644
--- a/qapi/cryptodev.json
+++ b/qapi/cryptodev.json
@@ -15,7 +15,7 @@
 #
 # @sym: symmetric encryption
 #
-# @asym: asymmetric Encryption
+# @asym: asymmetric encryption
 #
 # Since: 8.0
 ##
diff --git a/qapi/cxl.json b/qapi/cxl.json
index dd947d3bbc..8f2e9237b1 100644
--- a/qapi/cxl.json
+++ b/qapi/cxl.json
@@ -117,7 +117,7 @@
 # @nibble-mask: Identifies one or more nibbles that the error affects
 #
 # @bank-group: Bank group of the memory event location, incorporating
-#     a number of Banks.
+#     a number of banks.
 #
 # @bank: Bank of the memory event location.  A single bank is accessed
 #     per read or write of the memory.
diff --git a/qapi/machine.json b/qapi/machine.json
index 230b9b20dd..0650b8de71 100644
--- a/qapi/machine.json
+++ b/qapi/machine.json
@@ -811,7 +811,7 @@
 #
 # @policy: the write policy, none/write-back/write-through.
 #
-# @line: the cache Line size in bytes.
+# @line: the cache line size in bytes.
 #
 # Since: 5.0
 ##
diff --git a/qapi/misc-i386.json b/qapi/misc-i386.json
index 3b5346425a..5fefa0a484 100644
--- a/qapi/misc-i386.json
+++ b/qapi/misc-i386.json
@@ -195,7 +195,7 @@
 #
 # @cbitpos: C-bit location in page table entry
 #
-# @reduced-phys-bits: Number of physical Address bit reduction when
+# @reduced-phys-bits: Number of physical address bit reduction when
 #     SEV is enabled
 #
 # Since: 2.12
diff --git a/qapi/run-state.json b/qapi/run-state.json
index fcc00c805b..fd09beb35c 100644
--- a/qapi/run-state.json
+++ b/qapi/run-state.json
@@ -62,7 +62,7 @@
 ##
 # @ShutdownCause:
 #
-# An enumeration of reasons for a Shutdown.
+# An enumeration of reasons for a shutdown.
 #
 # @none: No shutdown request pending
 #
diff --git a/qapi/transaction.json b/qapi/transaction.json
index 5c3394919e..9d9e7af26c 100644
--- a/qapi/transaction.json
+++ b/qapi/transaction.json
@@ -21,7 +21,7 @@
 ##
 # @ActionCompletionMode:
 #
-# An enumeration of Transactional completion modes.
+# An enumeration of transactional completion modes.
 #
 # @individual: Do not attempt to cancel any other Actions if any
 #     Actions fail after the Transaction request succeeds.  All

From 188b31ad425c4122363a3af47343e0d3228687f8 Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Tue, 27 May 2025 09:39:11 +0200
Subject: [PATCH 1363/2760] qapi: Use proper markup instead of CAPS for
 emphasis in doc comments

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20250527073916.1243024-9-armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
---
 qapi/block-core.json |  2 +-
 qapi/dump.json       |  6 +++---
 qapi/migration.json  | 26 +++++++++++++-------------
 qapi/misc.json       |  4 ++--
 4 files changed, 19 insertions(+), 19 deletions(-)

diff --git a/qapi/block-core.json b/qapi/block-core.json
index f0faca1054..7b0548dc2e 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
@@ -1589,7 +1589,7 @@
 #
 # @bitmap-mode: Specifies the type of data the bitmap should contain
 #     after the operation concludes.  Must be present if a bitmap was
-#     provided, must NOT be present otherwise.  (Since 4.2)
+#     provided, must **not** be present otherwise.  (Since 4.2)
 #
 # @compress: true to compress data, if the target format supports it.
 #     (default: false) (since 2.8)
diff --git a/qapi/dump.json b/qapi/dump.json
index f2835c0b47..d0ba1f0596 100644
--- a/qapi/dump.json
+++ b/qapi/dump.json
@@ -54,9 +54,9 @@
 # @paging: if true, do paging to get guest's memory mapping.  This
 #     allows using gdb to process the core file.
 #
-#     IMPORTANT: this option can make QEMU allocate several gigabytes
-#     of RAM.  This can happen for a large guest, or a malicious guest
-#     pretending to be large.
+#     **Important**: this option can make QEMU allocate several
+#     gigabytes of RAM.  This can happen for a large guest, or a
+#     malicious guest pretending to be large.
 #
 #     Also, paging=true has the following limitations:
 #
diff --git a/qapi/migration.json b/qapi/migration.json
index 84edcf81e4..4963f6ca12 100644
--- a/qapi/migration.json
+++ b/qapi/migration.json
@@ -407,7 +407,7 @@
 # @postcopy-ram: Start executing on the migration target before all of
 #     RAM has been migrated, pulling the remaining pages along as
 #     needed.  The capacity must have the same setting on both source
-#     and target or migration will not even start.  NOTE: If the
+#     and target or migration will not even start.  **Note:** if the
 #     migration fails during postcopy the VM will fail.  (since 2.6)
 #
 # @x-colo: If enabled, migration will never end, and the state of the
@@ -801,10 +801,10 @@
 #     (Since 2.8)
 #
 # @avail-switchover-bandwidth: to set the available bandwidth that
-#     migration can use during switchover phase.  NOTE!  This does not
-#     limit the bandwidth during switchover, but only for calculations
-#     when making decisions to switchover.  By default, this value is
-#     zero, which means QEMU will estimate the bandwidth
+#     migration can use during switchover phase.  **Note:** this does
+#     not limit the bandwidth during switchover, but only for
+#     calculations when making decisions to switchover.  By default,
+#     this value is zero, which means QEMU will estimate the bandwidth
 #     automatically.  This can be set when the estimated value is not
 #     accurate, while the user is able to guarantee such bandwidth is
 #     available when switching over.  When specified correctly, this
@@ -982,10 +982,10 @@
 #     (Since 2.8)
 #
 # @avail-switchover-bandwidth: to set the available bandwidth that
-#     migration can use during switchover phase.  NOTE!  This does not
-#     limit the bandwidth during switchover, but only for calculations
-#     when making decisions to switchover.  By default, this value is
-#     zero, which means QEMU will estimate the bandwidth
+#     migration can use during switchover phase.  **Note:** this does
+#     not limit the bandwidth during switchover, but only for
+#     calculations when making decisions to switchover.  By default,
+#     this value is zero, which means QEMU will estimate the bandwidth
 #     automatically.  This can be set when the estimated value is not
 #     accurate, while the user is able to guarantee such bandwidth is
 #     available when switching over.  When specified correctly, this
@@ -1192,10 +1192,10 @@
 #     (Since 2.8)
 #
 # @avail-switchover-bandwidth: to set the available bandwidth that
-#     migration can use during switchover phase.  NOTE!  This does not
-#     limit the bandwidth during switchover, but only for calculations
-#     when making decisions to switchover.  By default, this value is
-#     zero, which means QEMU will estimate the bandwidth
+#     migration can use during switchover phase.  **Note:** this does
+#     not limit the bandwidth during switchover, but only for
+#     calculations when making decisions to switchover.  By default,
+#     this value is zero, which means QEMU will estimate the bandwidth
 #     automatically.  This can be set when the estimated value is not
 #     accurate, while the user is able to guarantee such bandwidth is
 #     available when switching over.  When specified correctly, this
diff --git a/qapi/misc.json b/qapi/misc.json
index dcf9f7df5b..4b9e601cfa 100644
--- a/qapi/misc.json
+++ b/qapi/misc.json
@@ -222,8 +222,8 @@
 # .. note:: This command only exists as a stop-gap.  Its use is highly
 #    discouraged.  The semantics of this command are not guaranteed:
 #    this means that command names, arguments and responses can change
-#    or be removed at ANY time.  Applications that rely on long term
-#    stability guarantees should NOT use this command.
+#    or be removed at **any** time.  Applications that rely on long
+#    term stability guarantees should **not** use this command.
 #
 #    Known limitations:
 #

From 51acba6fad54099dad5ba6d0ab2392d9b93ae284 Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Tue, 27 May 2025 09:39:12 +0200
Subject: [PATCH 1364/2760] qapi: Spell JSON null correctly in blockdev-reopen
 documentation

The doc comment misspells JSON null as NULL.  Fix that.

Cc: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20250527073916.1243024-10-armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
---
 qapi/block-core.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/qapi/block-core.json b/qapi/block-core.json
index 7b0548dc2e..f8f89ee2d7 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
@@ -4947,7 +4947,7 @@
 #  3) A reference to a different node: the current child is replaced
 #     with the specified one.
 #
-#  4) NULL: the current child (if any) is detached.
+#  4) null: the current child (if any) is detached.
 #
 # Options (1) and (2) are supported in all cases.  Option (3) is
 # supported for @file and @backing, and option (4) for @backing only.

From 5ca6400cadecc2556ad0852780896eb94bdf4018 Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Tue, 27 May 2025 09:39:13 +0200
Subject: [PATCH 1365/2760] qapi: Refer to job-FOO instead of deprecated
 block-job-FOO in docs

We deprecated several block-job-FOO commands in commit
b836bf2ab68 (qapi/block-core: deprecate some block-job- APIs).  Update
the doc comments to refer to their replacements instead.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20250527073916.1243024-11-armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
---
 qapi/block-core.json | 57 ++++++++++++++++++++++----------------------
 1 file changed, 28 insertions(+), 29 deletions(-)

diff --git a/qapi/block-core.json b/qapi/block-core.json
index f8f89ee2d7..6e5b90d5df 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
@@ -1606,16 +1606,16 @@
 #     copy-before-write jobs; defaults to break-guest-write.  (Since 10.1)
 #
 # @auto-finalize: When false, this job will wait in a PENDING state
-#     after it has finished its work, waiting for @block-job-finalize
-#     before making any block graph changes.  When true, this job will
+#     after it has finished its work, waiting for @job-finalize before
+#     making any block graph changes.  When true, this job will
 #     automatically perform its abort or commit actions.  Defaults to
 #     true.  (Since 2.12)
 #
 # @auto-dismiss: When false, this job will wait in a CONCLUDED state
 #     after it has completely ceased all work, and awaits
-#     @block-job-dismiss.  When true, this job will automatically
-#     disappear from the query list without user intervention.
-#     Defaults to true.  (Since 2.12)
+#     @job-dismiss.  When true, this job will automatically disappear
+#     from the query list without user intervention.  Defaults to
+#     true.  (Since 2.12)
 #
 # @filter-node-name: the node name that should be assigned to the
 #     filter driver that the backup job inserts into the graph above
@@ -1785,8 +1785,7 @@
 # If top == base, that is an error.  If top has no overlays on top of
 # it, or if it is in use by a writer, the job will not be completed by
 # itself.  The user needs to complete the job with the
-# block-job-complete command after getting the ready event.
-# (Since 2.0)
+# job-complete command after getting the ready event.  (Since 2.0)
 #
 # If the base image is smaller than top, then the base image will be
 # resized to be the same size as top.  If top is smaller than the base
@@ -1848,16 +1847,16 @@
 #     autogenerated.  (Since: 2.9)
 #
 # @auto-finalize: When false, this job will wait in a PENDING state
-#     after it has finished its work, waiting for @block-job-finalize
-#     before making any block graph changes.  When true, this job will
+#     after it has finished its work, waiting for @job-finalize before
+#     making any block graph changes.  When true, this job will
 #     automatically perform its abort or commit actions.  Defaults to
 #     true.  (Since 3.1)
 #
 # @auto-dismiss: When false, this job will wait in a CONCLUDED state
 #     after it has completely ceased all work, and awaits
-#     @block-job-dismiss.  When true, this job will automatically
-#     disappear from the query list without user intervention.
-#     Defaults to true.  (Since 3.1)
+#     @job-dismiss.  When true, this job will automatically disappear
+#     from the query list without user intervention.  Defaults to
+#     true.  (Since 3.1)
 #
 # Features:
 #
@@ -2212,16 +2211,16 @@
 #     'background' (Since: 3.0)
 #
 # @auto-finalize: When false, this job will wait in a PENDING state
-#     after it has finished its work, waiting for @block-job-finalize
-#     before making any block graph changes.  When true, this job will
+#     after it has finished its work, waiting for @job-finalize before
+#     making any block graph changes.  When true, this job will
 #     automatically perform its abort or commit actions.  Defaults to
 #     true.  (Since 3.1)
 #
 # @auto-dismiss: When false, this job will wait in a CONCLUDED state
 #     after it has completely ceased all work, and awaits
-#     @block-job-dismiss.  When true, this job will automatically
-#     disappear from the query list without user intervention.
-#     Defaults to true.  (Since 3.1)
+#     @job-dismiss.  When true, this job will automatically disappear
+#     from the query list without user intervention.  Defaults to
+#     true.  (Since 3.1)
 #
 # Since: 1.3
 ##
@@ -2531,16 +2530,16 @@
 #     'background' (Since: 3.0)
 #
 # @auto-finalize: When false, this job will wait in a PENDING state
-#     after it has finished its work, waiting for @block-job-finalize
-#     before making any block graph changes.  When true, this job will
+#     after it has finished its work, waiting for @job-finalize before
+#     making any block graph changes.  When true, this job will
 #     automatically perform its abort or commit actions.  Defaults to
 #     true.  (Since 3.1)
 #
 # @auto-dismiss: When false, this job will wait in a CONCLUDED state
 #     after it has completely ceased all work, and awaits
-#     @block-job-dismiss.  When true, this job will automatically
-#     disappear from the query list without user intervention.
-#     Defaults to true.  (Since 3.1)
+#     @job-dismiss.  When true, this job will automatically disappear
+#     from the query list without user intervention.  Defaults to
+#     true.  (Since 3.1)
 #
 # @target-is-zero: Assume the destination reads as all zeroes before
 #     the mirror started.  Setting this to true can speed up the
@@ -2859,16 +2858,16 @@
 #     autogenerated.  (Since: 6.0)
 #
 # @auto-finalize: When false, this job will wait in a PENDING state
-#     after it has finished its work, waiting for @block-job-finalize
-#     before making any block graph changes.  When true, this job will
+#     after it has finished its work, waiting for @job-finalize before
+#     making any block graph changes.  When true, this job will
 #     automatically perform its abort or commit actions.  Defaults to
 #     true.  (Since 3.1)
 #
 # @auto-dismiss: When false, this job will wait in a CONCLUDED state
 #     after it has completely ceased all work, and awaits
-#     @block-job-dismiss.  When true, this job will automatically
-#     disappear from the query list without user intervention.
-#     Defaults to true.  (Since 3.1)
+#     @job-dismiss.  When true, this job will automatically disappear
+#     from the query list without user intervention.  Defaults to
+#     true.  (Since 3.1)
 #
 # Errors:
 #     - If @device does not exist, DeviceNotFound.
@@ -3077,7 +3076,7 @@
 # This command will refuse to operate on any job that has not yet
 # reached its terminal state, JOB_STATUS_CONCLUDED.  For jobs that
 # make use of the BLOCK_JOB_READY event, block-job-cancel or
-# block-job-complete will still need to be used as appropriate.
+# job-complete will still need to be used as appropriate.
 #
 # @id: The job identifier.
 #
@@ -5866,7 +5865,7 @@
 # @BLOCK_JOB_PENDING:
 #
 # Emitted when a block job is awaiting explicit authorization to
-# finalize graph changes via @block-job-finalize.  If this job is part
+# finalize graph changes via @job-finalize.  If this job is part
 # of a transaction, it will not emit this event until the transaction
 # has converged first.
 #

From 901eb8b2d8a14a0378d1c59fe37733366d4da16c Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Tue, 27 May 2025 09:39:14 +0200
Subject: [PATCH 1366/2760] qapi: Mention both job-cancel and block-job-cancel
 in doc comments

Several doc comments mention block-job-cancel where the more generic
job-cancel would also work.  Adjust them to mention both.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20250527073916.1243024-12-armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
---
 qapi/block-core.json | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/qapi/block-core.json b/qapi/block-core.json
index 6e5b90d5df..ad6de151c8 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
@@ -1894,7 +1894,7 @@
 # The status of ongoing drive-backup operations can be checked with
 # query-block-jobs where the BlockJobInfo.type field has the value
 # 'backup'.  The operation can be stopped before it has completed
-# using the block-job-cancel command.
+# using the job-cancel or block-job-cancel command.
 #
 # Features:
 #
@@ -1925,7 +1925,7 @@
 # The status of ongoing blockdev-backup operations can be checked with
 # query-block-jobs where the BlockJobInfo.type field has the value
 # 'backup'.  The operation can be stopped before it has completed
-# using the block-job-cancel command.
+# using the job-cancel or block-job-cancel command.
 #
 # Errors:
 #     - If @device is not a valid block device, DeviceNotFound
@@ -2788,7 +2788,7 @@
 # immediately once streaming has started.  The status of ongoing block
 # streaming operations can be checked with query-block-jobs.  The
 # operation can be stopped before it has completed using the
-# block-job-cancel command.
+# job-cancel or block-job-cancel command.
 #
 # The node that receives the data is called the top image, can be
 # located in any part of the chain (but always above the base image;
@@ -3075,8 +3075,8 @@
 #
 # This command will refuse to operate on any job that has not yet
 # reached its terminal state, JOB_STATUS_CONCLUDED.  For jobs that
-# make use of the BLOCK_JOB_READY event, block-job-cancel or
-# job-complete will still need to be used as appropriate.
+# make use of the BLOCK_JOB_READY event, job-cancel, block-job-cancel
+# or job-complete will still need to be used as appropriate.
 #
 # @id: The job identifier.
 #

From feeb08c260171e8a15236d20f2978c68aae4f569 Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Tue, 27 May 2025 09:39:15 +0200
Subject: [PATCH 1367/2760] qapi: Tidy up references to job state CONCLUDED

When talking about the job state machine, we refer to the states like
READY, ABORTING, CONCLUDED, and so forth.  Except in two places, where
we use JOB_STATUS_CONCLUDED.  Replace by CONCLUDED for consistency.

We should arguably use the JobStatus enum values instead.  Left for
another day.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20250527073916.1243024-13-armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
---
 qapi/block-core.json | 6 +++---
 qapi/job.json        | 6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/qapi/block-core.json b/qapi/block-core.json
index ad6de151c8..da390f85ac 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
@@ -3074,9 +3074,9 @@
 # jobs.
 #
 # This command will refuse to operate on any job that has not yet
-# reached its terminal state, JOB_STATUS_CONCLUDED.  For jobs that
-# make use of the BLOCK_JOB_READY event, job-cancel, block-job-cancel
-# or job-complete will still need to be used as appropriate.
+# reached its terminal state, CONCLUDED.  For jobs that make use of
+# the BLOCK_JOB_READY event, job-cancel, block-job-cancel or
+# job-complete will still need to be used as appropriate.
 #
 # @id: The job identifier.
 #
diff --git a/qapi/job.json b/qapi/job.json
index 9ddba537db..441cd7772b 100644
--- a/qapi/job.json
+++ b/qapi/job.json
@@ -223,9 +223,9 @@
 # jobs.
 #
 # This command will refuse to operate on any job that has not yet
-# reached its terminal state, JOB_STATUS_CONCLUDED.  For jobs that
-# make use of JOB_READY event, job-cancel or job-complete will still
-# need to be used as appropriate.
+# reached its terminal state, CONCLUDED.  For jobs that make use of
+# the JOB_READY event, job-cancel or job-complete will still need to
+# be used as appropriate.
 #
 # @id: The job identifier.
 #

From 8fa2020647041e9f01bc308589bb7fa00355ac9b Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Tue, 27 May 2025 09:39:16 +0200
Subject: [PATCH 1368/2760] qapi: Improve documentation around job state
 @concluded

We use "the query list" in a few places.  It's not entirely obvious
what that means.  It's actually the output of query-jobs or
query-block-jobs.

Documentation of @auto-dismiss talks about the job disappearing from
the query list when it reaches state @concluded.  This is less than
precise.  The job doesn't merely disappear from the query list, it
disappears, period.

Documentation of JobStatus @concluded explains "the job will remain in
the query list until it is dismissed".  Again less than precise.  It
remains in state @concluded until dismissed.

Rephrase without use of "the query list" for clarity and precision.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20250527073916.1243024-14-armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
---
 qapi/block-core.json | 19 +++++++------------
 qapi/job.json        |  2 +-
 2 files changed, 8 insertions(+), 13 deletions(-)

diff --git a/qapi/block-core.json b/qapi/block-core.json
index da390f85ac..1df6644f0d 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
@@ -1417,8 +1417,8 @@
 # @auto-finalize: Job will finalize itself when PENDING, moving to the
 #     CONCLUDED state.  (since 2.12)
 #
-# @auto-dismiss: Job will dismiss itself when CONCLUDED, moving to the
-#     NULL state and disappearing from the query list.  (since 2.12)
+# @auto-dismiss: Job will dismiss itself when CONCLUDED, and
+#     disappear.  (since 2.12)
 #
 # @error: Error information if the job did not complete successfully.
 #     Not set if the job completed successfully.  (since 2.12.1)
@@ -1614,8 +1614,7 @@
 # @auto-dismiss: When false, this job will wait in a CONCLUDED state
 #     after it has completely ceased all work, and awaits
 #     @job-dismiss.  When true, this job will automatically disappear
-#     from the query list without user intervention.  Defaults to
-#     true.  (Since 2.12)
+#     without user intervention.  Defaults to true.  (Since 2.12)
 #
 # @filter-node-name: the node name that should be assigned to the
 #     filter driver that the backup job inserts into the graph above
@@ -1855,8 +1854,7 @@
 # @auto-dismiss: When false, this job will wait in a CONCLUDED state
 #     after it has completely ceased all work, and awaits
 #     @job-dismiss.  When true, this job will automatically disappear
-#     from the query list without user intervention.  Defaults to
-#     true.  (Since 3.1)
+#     without user intervention.  Defaults to true.  (Since 3.1)
 #
 # Features:
 #
@@ -2219,8 +2217,7 @@
 # @auto-dismiss: When false, this job will wait in a CONCLUDED state
 #     after it has completely ceased all work, and awaits
 #     @job-dismiss.  When true, this job will automatically disappear
-#     from the query list without user intervention.  Defaults to
-#     true.  (Since 3.1)
+#     without user intervention.  Defaults to true.  (Since 3.1)
 #
 # Since: 1.3
 ##
@@ -2538,8 +2535,7 @@
 # @auto-dismiss: When false, this job will wait in a CONCLUDED state
 #     after it has completely ceased all work, and awaits
 #     @job-dismiss.  When true, this job will automatically disappear
-#     from the query list without user intervention.  Defaults to
-#     true.  (Since 3.1)
+#     without user intervention.  Defaults to true.  (Since 3.1)
 #
 # @target-is-zero: Assume the destination reads as all zeroes before
 #     the mirror started.  Setting this to true can speed up the
@@ -2866,8 +2862,7 @@
 # @auto-dismiss: When false, this job will wait in a CONCLUDED state
 #     after it has completely ceased all work, and awaits
 #     @job-dismiss.  When true, this job will automatically disappear
-#     from the query list without user intervention.  Defaults to
-#     true.  (Since 3.1)
+#     without user intervention.  Defaults to true.  (Since 3.1)
 #
 # Errors:
 #     - If @device does not exist, DeviceNotFound.
diff --git a/qapi/job.json b/qapi/job.json
index 441cd7772b..126fa5ce60 100644
--- a/qapi/job.json
+++ b/qapi/job.json
@@ -74,7 +74,7 @@
 #     process.
 #
 # @concluded: The job has finished all work.  If auto-dismiss was set
-#     to false, the job will remain in the query list until it is
+#     to false, the job will remain in this state until it is
 #     dismissed via @job-dismiss.
 #
 # @null: The job is in the process of being dismantled.  This state

From b652d512855997ec89c78aa540aceadd5af13724 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Wed, 11 Dec 2024 18:14:19 +0100
Subject: [PATCH 1369/2760] rust: bindings: allow ptr_offset_with_cast

This is produced by recent versions of bindgen:

warning: use of `offset` with a `usize` casted to an `isize`
  --> /builds/bonzini/qemu/rust/target/debug/build/qemu_api-35cb647f4db404b8/out/bindings.inc.rs:39:21
   |
39 |         let byte = *(core::ptr::addr_of!((*this).storage) as *const u8).offset(byte_index as isize);
   |                     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ help: try: `(core::ptr::addr_of!((*this).storage) as *const u8).add(byte_index)`
   |
   = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#ptr_offset_with_cast
   = note: `#[warn(clippy::ptr_offset_with_cast)]` on by default
warning: use of `offset` with a `usize` casted to an `isize`
  --> /builds/bonzini/qemu/rust/target/debug/build/qemu_api-35cb647f4db404b8/out/bindings.inc.rs:68:13
   |
68 |             (core::ptr::addr_of_mut!((*this).storage) as *mut u8).offset(byte_index as isize);
   |             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ help: try: `(core::ptr::addr_of_mut!((*this).storage) as *mut u8).add(byte_index)`
   |
   = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#ptr_offset_with_cast

This seems to be new in bindgen 0.71.0, possibly related to bindgen
commit 33006185b7878 ("Add raw_ref_macros feature", 2024-11-22).

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/qemu-api/src/bindings.rs | 1 +
 1 file changed, 1 insertion(+)

diff --git a/rust/qemu-api/src/bindings.rs b/rust/qemu-api/src/bindings.rs
index 3c1d297581..057de4b646 100644
--- a/rust/qemu-api/src/bindings.rs
+++ b/rust/qemu-api/src/bindings.rs
@@ -11,6 +11,7 @@
     clippy::restriction,
     clippy::style,
     clippy::missing_const_for_fn,
+    clippy::ptr_offset_with_cast,
     clippy::useless_transmute,
     clippy::missing_safety_doc
 )]

From 0074a471477d56723bd6fd044b78c30ff5958f56 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Tue, 29 Apr 2025 10:43:16 +0200
Subject: [PATCH 1370/2760] meson: update to version 1.8.1

This adds several improvements to Rust support, including
native clippy and rustdoc targets, the "objects" keyword,
and running doctests.

Require it only when Rust support is requested, to avoid
putting a strict requirement on all build platforms for the
sake of an experimental feature.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 configure                                  |   8 ++++++++
 python/scripts/vendor.py                   |   4 ++--
 python/wheels/meson-1.5.0-py3-none-any.whl | Bin 959846 -> 0 bytes
 python/wheels/meson-1.8.1-py3-none-any.whl | Bin 0 -> 1013001 bytes
 pythondeps.toml                            |   2 +-
 tests/lcitool/mappings.yml                 |   6 +++++-
 6 files changed, 16 insertions(+), 4 deletions(-)
 delete mode 100644 python/wheels/meson-1.5.0-py3-none-any.whl
 create mode 100644 python/wheels/meson-1.8.1-py3-none-any.whl

diff --git a/configure b/configure
index 2ce8d29fac..74b3865e51 100755
--- a/configure
+++ b/configure
@@ -1178,6 +1178,14 @@ fi
 ##########################################
 # detect rust triple
 
+meson_version=$($meson --version)
+if test "$rust" != disabled && ! version_ge "$meson_version" 1.8.1; then
+  if test "$rust" = enabled; then
+    error_exit "Rust support needs Meson 1.8.1 or newer"
+  fi
+  echo "Rust needs Meson 1.8.1, disabling" 2>&1
+  rust=disabled
+fi
 if test "$rust" != disabled && has "$rustc" && $rustc -vV > "${TMPDIR1}/${TMPB}.out"; then
   rust_host_triple=$(sed -n 's/^host: //p' "${TMPDIR1}/${TMPB}.out")
 else
diff --git a/python/scripts/vendor.py b/python/scripts/vendor.py
index 0405e910b4..b47db00743 100755
--- a/python/scripts/vendor.py
+++ b/python/scripts/vendor.py
@@ -41,8 +41,8 @@ def main() -> int:
     parser.parse_args()
 
     packages = {
-        "meson==1.5.0":
-        "52b34f4903b882df52ad0d533146d4b992c018ea77399f825579737672ae7b20",
+        "meson==1.8.1":
+        "374bbf71247e629475fc10b0bd2ef66fc418c2d8f4890572f74de0f97d0d42da",
     }
 
     vendor_dir = Path(__file__, "..", "..", "wheels").resolve()
diff --git a/python/wheels/meson-1.5.0-py3-none-any.whl b/python/wheels/meson-1.5.0-py3-none-any.whl
deleted file mode 100644
index c7edeb37ade47cb8b6275cc7dfe6681d957a1dee..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 959846
zcmWIWW@Zs#U|`^25MKE;!eM%2^-%!^hC7A~3_1)947sVr`FXmAdZu~?dMSw|iTYro
zI3uwrRX;Z|4}=Z%!HV<@&st^YKQ`NT|EqS#&m!RiVUrVf@8)=?_dsRd%H_tM0@jzs
zCOb}>mN8p6GRRe{FZ#~^y7SFbG;YpZcK7D-=|_alH`}}~UQzLFZiW54xY(}n<Li&C
z-d?&*RNY;@zUh8;YFCWR@%zWzKa^yLsGjTo8ue^trRdSi?~gov@z)}0#li_mOQ&lG
zhPg(mhuLTC7X2KRzS1B%`RXhKy<?X@&p!Dzr>IoY^*v{>v;!}r>#Cl(XIi4$1Y9$}
zM*Uwj;oYW5ueYvRG{IFzEzD!D8OI#4L+cvu)pS4Tx4QZ>NMf&^v8jM-Zu`-sjPNWA
z{dr2k(^CT@H)?2Y)C&rIdPszO_r$49yf&-WXk6FY?y&7dLVG2bimHL{6iJR?b!|o8
zkmphgQ#O9k)07KUo$eLF#d&x(zfp9Ul|TC<n~5jA1Vta{8~t7INMqK)^INa%OmJMG
zKJ`l2Ipe2g>v?pZM?Wz0pL6Hq6r)Dl1JgF?I3;ykwdacNJQE-z*eR(go%%Y+;)upB
zQ;i<CCpx0HE-pH;DJeN4or8~|ESTr?R1>aL-#cBb9w%?~E%MQcd(9P>*BuqI)xKSK
z(UKG5Rgujai7S(q1mCzdGa>uo-rAl=oSHjM@UE+UWPV2J>Qt|sz}#k0<|9H^qq`QJ
zKBRSH@0OAlxm^+0cjO+4(g|tRiVZnB%VB2Rl>^7#v1BqXI?t`WXQF`bl=<g)U#L3p
znKf^kBKCwyohcx{f5TcI&*fGZib6$2S7dJ4@W5Zlmy>nR3gd@M)dH26RAMHj2p@Rl
z%$oE3HiybQVdX7rj$AV;PVjra;btvU=Si!etrJSq7Vq?t6FJaSCw+Uzm7nRB0<)*G
zX{*2E%CHsVe=sRy*OQcjmfc4q`xZQUeD{&t9bL7sFz?i#58nv?>0dPe0fQ@_p=$V>
z3mNJ=w4XiO9`&TtinUK`xw8I=HB#DLQQC)!k2JNqZ*u)`enpc14rS)`7kk<ACvIhR
z->$$maZSoT7S-2tbgy_`4eP316y!a%*}6HgasI(Nqf{juCiz97>_3jDE4<jV^Kr3;
z*X=GTo!E_8ifOtB_UyS7_2I-6t&7}i6;ihRZgWU}Wx7*nNB@!;Ez4AA%DxhQ(x9!D
z<<gYZoXU86qP5<}i)E}2C%j!LtS0rf?cT4ge@y229o2S!E@E`zjg;?;ybAM{6PXWm
zqkK38FLQl&dh)f3PtcwrcIBF!hkM=_&DC!7&i#{}93ad*TX^fVt1eNRW<}kTaz8E!
zZn|73ZSJ(L&}5_A6*lF1;c)-&AAjktv^@Dh&Oy^JEkU#PE#vg0wTc%Sre4T<)paO}
zeUTX#GXsm@%wsNWJnN=Ra6HJUWs&E)O8(7cPD$C*;xFw_tqGG*xFB3%d@w9hZl|V^
zSLT*-w?-b0-3kr6AG(Hz3TR|`txvSMschuH5_h~_x#{@3k1g{4QL)Q!-LTC%c70-b
zN=V^S1rh0#`D?x`?yBCfd)mJ}7uT^VnYeG(GK;BsAicy>tdTv;|CXEXqn$q<G8smd
zF1)yKlfed!74B0C7TR+0#wSgaW14nX=@*AQtB96myYCvS9<?e3JML6g3CBJo#o&*E
z`tL5Vq-AqH`~B<Hv%eW;uDe1WHVRz~(_yWdz^ygkRqf5TkR?Bs1ThG38$MOZJaSoo
z0>dI^@%Mb}NuBy^DlPFPH&fSsR#_cfYTokdnB@$|f5LU|lRcOOrEjta$b1hMGBXY@
zC^9P5c|7aI{ijpJ%bizUobbohv2*U(8Ltc@1n;>mIMH0AF?Y_K!iC}sU%tOJJ-YKw
z{pHgfwL8RTT(7^d?^9BQ<|J<g_3y_X?`&qs3O_RA;rq6nq?Wo?O?mD|zDpI`gZ`!L
zO?;raY0BmDcZb|p2DZ*}@^JX}JSy1oVfkT0&Kx<u)(bv`%Dwkzyjm&8w42p3;kM!K
z8Fv&`u4Lk7N<MftROIK~MFBq-uj`UIEEMtepomUL=i(o?_aAX@k6k4yBj(Z}b*i%Z
z)RX_ou}<xicfaL1aPH5#%}JbJKZ&oH#U5L>$FXKko&C;z^Y6`zy&tnzcK-Qg^O+(m
zW+z<?%8JVBVPkBaa6kU{pEWU3hSGayZn|!0s&#cokMWD7h<Gu}N`<U0ONBItU+3Me
z-8W8ETRrztf14buHt#;4{F^U4t3$G!Z+X1tTDyt!zv5)!v`ashtmRrWt!cyiSJ%s0
zt-R-#9a>hTtN7C4`LkIH70nr0o?qp}+yfbxuif!IdzY=@P6_FC^A=WUWuFdW)N?$@
z&iXVuW7+O|_uss56+LkM?4R@Ev3|O_hOKM~-9ooSGwP++%5JIEJfU>?vsai@z1D1*
zcbA%%G>P2|;+-Y7?dm*T#UPJ1zO%f~_|{%~aPqTff56^tsrzRu$V_;WTxFhMdc=?I
z-N$>j$G)9>H}6P#_q6QWFaIx03Q_*GkA-RBY+=n?S?kQ~YQHqhTYWHcgNWs03m?r8
zo(mxhR&L$%Yq!P1tfc#^=Uke3a79<@y86P6GkdC!KlzufwPen*z%$0}M$_dYEo1gQ
zKK-DDg?ZbK_b&662|boS{(Sr9i#M&^EhR2(@jjs%@xqYnC;OIQ51Z@3%Vw>*bU|4*
zdg_IVt8EnZl^08zeT{HX5Z<rWyhMk+Q&Oc=i~S{oOS1M%e!J7|mKx9I3;$wP5G^^u
zykgeV|BQz@BGV?U&JH;suPD@YRhX-HdFGabCC`MIh4@UEyt(@f(*-B2cUz~o_}e|v
zR0+ZIN6czpH{U+Fn|u1z=-`7+6Ee4YaHlbPcRFSK5}cx*z?#t1cFZj2<rG61-@EH)
zZDbMKzl}@2AmC2fktT;m52nuvja%yWU1sa%e?0r;lUGJ6&!;hUxqmE_j$hGrw^#p%
z)gqG)yXQtyohu~e6c?@B`t-n^D{`gQdOeF15?o@97}|ccsmZp^7A#GZo11v%<-Uo6
z56aox?(SuOTe(#D%*hD#1h$16b>_9~FpKW|EpkC@;qi-{qG{{qJ@v8;x2T*P8vXId
zPZ8O!TUw`<MF<J7`5tSTJ@e?r+{hmn?>N2U(VFJiZ@u->)J>&RFMoL7d5K}W$#M1j
zi!vO`_!`94G`TUY)L|@H$Ezj(P2^$71IOue_nf~gE3~q=+0}8wJAwPW?}Kz6E?Cvn
zvYL_q$%X9QyZ1CPb8s9hIZ*wfO<z>_LY<SCGw(L0DS36dU!yJt8{gwHoc?l8ci8hA
zvIkxZaNQ1ISzIPES(rtA?nL{yDNlV>y$#A(%GErl@(R{pF<N0KqjJUKqtUUItY=?0
zM?IJmmGmmx;_sFnxhGyOQ#t<P!1=kW7b$eV6)kQrT%P2{|E8;P*>;P-Lrd%IZy#8`
z&c9l5map&3OzDJ6##5dseC|3V_vgsX1!ZgvwchG~oRXr}rha`;etVC>zE>*$-)OVG
zNO<6^^QYh7%Ar6hwu6sWaNLztE)t&c>&)jW+Y)o37_lT@N3*t<g1_wNMDI-XH~I21
zZo^#hWy&r`Z+%oMxWsU9ONEM+<~4ykCLVoGS)0pm8An+sedh6zxzbkc6ud?>gRRf)
zTzO52i-mkyFW;9I=g22d*fV;c?`Y_Ko%_YzIB)TP{tqsNc07N!Uahb{a@W7F@;-lN
zbC&X>6OB9z1&?TnX)Z5*5N`WwiLt)&y#L*%E7Ezq>+hRCI-t#<@h@vb-MowKvcmoh
zx7H=6m++K13I9r1)8u#}-ep_h3vR(f>8AWyB7U1!Xe^D-y)`?3r%!Rix|7d54#{rH
zd9_nbyTFFy<13@7Z|475z5MVpH;n~VO0C<fOFQ@7J-8@i)pOYu%VyqMcvt4CSM=;Q
zCu4QR$M^itr-~aydet4YQQQ&3b4+A+s(Z&H>q`edG%+5nTk?F@+yj^PJxdXLsbc-@
z%Bv64N;_`xn|m6I7d7X3a;JKIVi0TyX8(W8TVln^gID+ru0NWwRCeZ)qiW~5JexNc
z<`uk?{dBPNCR5ZE(QSY0+72lzh~(<HNtR4_8CGF6A^!Idj(vJTMuIYl3%HANA50An
z%kqeMk+iefe_GIsEr|(tmMoLKvYpjvnbXO0rpso9vpP%MFw|o^&izhRS}2wGs)W#v
zz-*06o*y)xD~6wA+_Yv*oX0kw_S2tlr{#T^m)pm-`Jj;K|Cx8TiN$KZV=Y^IbFGVC
z-CRw5v0XRjCuhoa%FeM*IT63G*(|B5m~XA%<6@tq(>m`ft<CN{xcWxt_Qd6%8!tAy
zSe~oha=<)~M=W7S*);c=C6|4@W+Xj4)t}g_@ccq%k?{RuNB@bhiwYB_f19wSQ|m^P
z<Iar}+pBLJ*vzRQccm;iB-8qL#@t@($qV-%I`q10LYe>0ch9DY-l*7N{Jc43u3VX}
zY<vBIt&j9h%4_bK8Z$lO+ne2!mrT{j2>2GGTJa~HC);dSrSZJIHDWC7i6S;f*Su}|
zA?5l(dgG)$^8bQbcBSmHu<Eso>rcCX_x!qdGf$b%|MB1UTwK!k>Z;$rzCJnLzx-X{
zx65CDTz;4ENju{2U4xTTmURBH{CDH`*TeR<>A!UD#m%*J{vUIO*LKp64NI5&&I+-e
zai95*5=VHG+=Dl>^-qUXdBihr`M$cquEV>ed4BifgxBv5tN#;8;8aabmzvmF9=^Ey
z_r>;)XJ7Qr4ovKj^ZITYwBt?r%VkSA)NN$GnN3~IZ+ch$+jr@L+B=;*!K;o0Cf$8-
zVRzTze?Rj&&S~kXPtSM%o*=BUXQH{!Dc4IE{?`lqu|L9Ck~wpkrcj*r)3Z&lkMQq~
zk?T$VnD|Tj%k{RDJ^hClSN8o8{`Ru(aR2jg@yGWQoIafYwD78)cKyoUo&O5&Z#C0R
z_<U6){#f{>cb82!?D=4o&Hl4oWm)<ncYQIl@Z*)Ar}m%w{@zW-#8_uf>B9A|6i!PQ
zynpi{zF1kRkE{0C>-fVZY8(&t%+RmjvFqo(r5Aha7g+DO-zRZU^Y4)&g&$_GE$;0!
z^nP8cX%}~A-~NABV&;EZ>a?_OU1RjEsR_@ccn*DGKC3g=Ni}|wi|V{D2R_@}JAS#A
zQK8Osbz_y2zr2mq7LQq}`<@*wV>5fw`z_O|xm9-F8u8zoqc@9Plv%ZDnej<3{`UJP
zJC|tj+`as4(wf8ZeD5#({vNaHaYvos+DAu!<dhWuo6Em6^XG;q`N{=%dY4+~+^_e$
z&?|jf#qev=!udyLe=hdx5-}+#ODqja-z3Cvx#stihK)DAH=ml2ptvqCeZBhoSu5V@
zsg|$5=sAt!>$0EA&YqmUn)Bbi0`Y#=`_3i5ei$wDHn=>0+2)VcMG`ubXCG-U?w`y1
zMdM1b|C4Vy)BQI8VhWnjRy?)y{c-c@kINYazyD(unY2ml`StCLdiyFR9~CHGm)axw
z;eCAnJ^y=uuc#k>t-pZnr(^Tv|5n#eJ1$#$_J+5tZrs_A$#>H;E!|7~_P<`bN8soA
zrX~4jZ_l1x!T#%X_~d7)TQiK;WlZ>xVtwcA=6${EZ2#Qtv;8BvaYf?u{D>Dy{=09U
zGyEmDy<1u;-f{Pv*%@<0N>i>)xZ)A?JXLM>X|*Yn_B+a6a^j9tv`CpOHD})3UilLz
z6f+&#9|bkM%n?maK771$fA9OlNA6Y`ms_PifBmRn>daGHzB3w~HFw%EZI@Hig+M2+
zl9GvStL5h_iyAYn-?BxcFZTYq2}`&W|1f#78S<XGXnM`>Y`NwuPA&FTiwey66ZAxT
z>*t&~QermiuHQ`V8TSKCa`$cS`+NHFi)m+?tS&QhU8$ent2onb;fKlj?>;F0Sg~MX
zp^)!}Hpl9+__FFp>i56BYZBVD@WW~??_&1p_wUMz2rp>%Ii74-Wxls-(bTO^Uz*<+
zFnq?p?>Fy$^9=`*Z|&Is??38rNYq-n`Fj}|7#f%v7`zA!hZN-JWM`J>8tNw|mt^MW
z73(MG=jwrnMv_W1b5is&^NLFnb8_?w@^dniE9VAz_s=#E*!NjG=KkTFE8d}kVRuus
z*Isd7lE!bVc$~*Tdc(@xgrDC{4Lv>j_g2c?Pd+x;W}ms~>x&VWvJPMW$eg}n$vMxd
z(*LS{?D};?{<6l;4ZnBV{<&wrIqbTM`^r#9)!X~+YO8M=?PJp5N$UIdq=b8e^_ykK
zge|w(f8YF8@`B{UJ$#>y7|z>Q9MOJ$>pa6@gCpE+5wnHX=-pA^aY|@f`YB8Hx!&`8
zH;iVx2_}2?Yh72f4LPxI@z*SW*{hbnO{3a<nTmg2n_0TdPhI|+wC2gsyN1(tHKsAi
ztLIe2EqMNK^P~ySGd1oP@OR`l%$QQTXkGGUO*_w@Y4)>BuK0C)QJpgLvz+&*Eo)4F
z@h(la?R;R>sHzZ9!Km%!v%f@ch0MtfzMIZGnBT|q>`bOxcv1X}O5q&|%)&ogQ@u=P
zY-8g#`FHx_x;J|kMSo4&D-ioOhhzD{*HQd41Cm#jFl~Ra&o3(~puc-r_AB{i6GZCP
z`8?rW`KIMY+)VKanY!M_odI6f4=2nmxKmJXUS2M;?r^++&wGu>VLQ5(Ux;LO54zB|
z?$WEp*JpbEYY(2WDPG^>d30pZFORnT9-$rfH}<0@5(Wka1||@}z`!5|OC;bp*N>0S
z%*!l^kJl@xWM)9sHGA>C6>iK73{~uyx(X6YGIBDL^a?8HhU9i%ap3uPFJADAbN>0g
z>(+JcTA;A+z``PSF0P_4%W`+g=BlU0<*o1dfA@?}`Q3MOxxRVdp83S{la1%QL&rZ~
zkN3NGT4?IQ$(OmNPTlIVw`uxb4QZRmwC|I5f9U$<c)Bz>v9kUrgPkdd{DlckT<bS1
z-Ir{?L1UMS=VcSdIy=)#4(?O41$nkIKiFz=twHt1gnxWalY>P$UbN;$MW)PRysh1G
zXl-N20gb?DMbVmRs}}V#8cTG~jZ}TOZR0lc)kl+bb02rDS(110=MpaU+gf#cOAPtW
zK05j7=HpI&cEd>f8*L$ORkCm8>?(d`NN)7kozWH(eemPPM^axu8j5h7OJJRPCE`}u
zi3cHtc8g{;Z#i(4D}AMK*tA8t?F_<i%z3qTOo{csmA88Dmv8^fx?L*YZ<;8xvMGtd
z@1DojHs0xC4SGAj=xoZ|w@lfi>YxFa(^A>bQ;yz=51YDW(v<T_eA_txD1Y($o+7Z~
z+2;GVPRyRfGR31WJlSWWNcV~TTlXA$V4TLdHF#<Nan%jwH@T8;IArix%wf&lv5L(!
z?L*kROGzi9em(23G2Sg@{fT9Q*2UkAuY0fVTfK~vwctZ#h+<00|2K2}PbvMLczIro
z?4>=Q&q|&S$kx@m<GgEfYusAX(h1MEZuU!_cX-9*fUY$hsj4SKcE8o1dDm4t$9L9l
z`}3ChZk2rT&MUsm2|RyOfA0IglP6wpZ%^*`?|b~+by7~CM7g!z?Zqig6&V|B{rQ|^
zZoIv#V)HINE^D8@^tGh$xgY1AIr6)Y%Q<SApE3K_b4uOJRVJtRJo}aL?Dl8(U7asp
zo)2BoeZ4c_z?XMwoo6Lxrt&1c5&B#y7Qr>mh~;c?>uei&#})3nI+^z`{MM5RRqlTI
zTd<CW?OAfIJ+q4FeTytH^Pcx%9C>9gK4x&4%s$%lH#m{^ahH|RjcdgZ?oC-5>*#pJ
zXnwwHb^)8ZzT3mP-E4-(x9<2~Gw;p8m;Zhre|Nk7UpoK2XaA?qt%x}J<iM-MQf3n`
zhGSp%@o$nXZruF*qv`C5hozl+TQ~RTZ&CZ}eq;ep;i5n1M9k;@=jb|<#<_{*;^z$~
zkM8iupF8F56qeAuxsy(|RBV2`<o@lxst3;swj6$V_ToN|I!4r-Cw}bt^Ak)A3@+>p
z45DcHwWP8jGcO&S@os0`b`Yq&zg}Vz`)!5p3Evh<L`mIhmkN^V$lzA&*jkpNyQXaF
z-Knx)`+rIQ-E?l9%JFloJ%1Bo)6UH_Hg>P(+io6Te|~*x<E@7^ngP|3UR$_#WK{${
z{A08?;rWN7CUd90K6Uu%(Wk5_qKC>$+?o&YYF)n4!rZ^d?!@2k=F85%d~d6>)!o(c
zw#4bZCbKqf-n@C<QPYTkn@ly=J@&S7g*IPX+EZ)nwd3&h0F8GtyI5kPLk?*A6iq9=
zTeUB!BDvSRH8449#i59K#Y;cQ*d3B({^fgYi{~Z#_aClb`WZXnuCZEn&>ME%9;rXA
z0R_CSN54v~+@Zpnc4f!ffWu-3A31C5I$i$RWmPl1E@7$Z*9p@eFJ9hxSwx2CPqOc^
z2sfkOdrV$S{W<xzWRh>1NT=<=wcACc883fK+t#s`Lr3xa-0hWir7KQJp0Q`N)l=}j
zEZh30`4R8DCy|XQBEpW&Q`;ikHif5eU%dPDJ5FK8EnV6f$5^-Wv3f|UEH`aEcyWh?
z#v=x)m9F=rdX*YOUmpxz7Rt2c<Ay^gM7^p+GSAOx)fM>c#`S1XY_sNK{j4QFC%3+s
zcvx4LwY1T*;H;Qt_d3>}rB>eU*(tBHcRTtz-AXB#6_ob+*P$&t8>ZF?ZDJDHAr>;R
z-Td+?lZb6zrMB}QtMWP3XMAGW9w)Z;k=eI<(H?z%53Ih$&k|VbA8?>;wb`%ON#8C8
zUUIdQGdGMcE$&wJHAvAgN;`c$q)5W*wsG5+iU&Q3+r6vK?%lX$?LiI3Pn8|Bc%xEx
z+;|+hSbbI10<VmTO!DF-A19i<j`UM5?BZKeTY4~}{Zv&=;+E$@yVaSJq8-FGYA0Xe
zZduBFdeX-}IY<8B72gG~Jna_IJL1=-`1&Gy`HFut+CDtw?bE(%oBfJ&$w!t6R-8}#
z8P@tU$?E5~Yx%7HtL;{?bM1@Gi;W(y{BTE;{q}Eu)TBS}h_L)peg=lgh8Rgdu_!$!
zv$#aBpmJ-}|DxN+1pm$VFWhS7Y^0`mGSj*<ZA#e0CsTr5y>fT@9lvIvP@xjoXu-lh
zBkht+K>T9=Yx&>bH868roOZe3m=Wilw{PE`&;S0;Vb7m;kA8m)l{p!5`eTaTWu>?y
zM)rc~krHd4{D>^LVlD7o>-MvcMWG$(?#Is`JKr}?w)6H>k^5e2gAAv?Pg%6dRIS^o
z?e(#i|Nq=C6wLa(bH<WZpASaoL*&FZdR6arU3V?XDt3zN%+oJJj%4rAcA2qk)dR&_
zeUVc#Lo}vln5&#To$2E9?M<_XYG=<Gncp7Ep5Cerzj}Gkte~9D7O`Cc-M8cP<2r6X
z_%{E3tl#<nRh9p?pZsdBZrjMOFRxNqrC<E^UwO<P6}`pUbuW7Ru2^*o=ik{`d!f1H
zNwwtBmrk7#-2pomDs`qaJ^J(Osq6czU!VN0_dB1z?{8jF>CYsqo%{CI6xNoR?wwWh
zH)u|m`QOrdm0yB?Pj-ds9k#5UtNz7Y|Hb;~#r4-;e_f<<B`W4b<xE}=m4mAPc>Jr*
ze3-26AGiLH)1BilV^*+U=}h#L+4#j(WLc8h(U_${BCFEO&P=y5V9EPe`18@xCyyR|
zit0J~da6#?7rUj3s?x1XFNVKQnRmQ6A~OEWwi{JKVr?S*+%u$V=dG4;;<_HG<epUX
z@y|217~Mx9S&sLe4Xo;1@1MF-Eq7p_%f_aF#Q~=SU2~OZGRx|vY-;^<{Q>jiB`1o0
z>V+*8)9N~9Gd)vfW|_rt`-!J`uP8Ea`qDLx@A{-GVNaHdaBq-Y9vF1aQClZ$R=RU<
z<&6BdlYL{>9H~gE*k=^oQuhDfE1^SHo2}VxFEuE!m9QN>$o~9@$(#n2_S~k)6ECE0
zQA+-sDDzh#B(Cu5VT*3#pUw*F4i?XOrNpA@d+LbU))Fp-r>dJ2G++F-IQ`_#hvHh}
zy*u_)e4V>|-wuJ-8#GQdnE%k-I4fc$uiUcez$4j<=4}#i6yblK{KHjunZWMz55-f3
zuKiNo>G)(;2=Bs8^MZEsoDRyrZag)_#UMmgH9C>!>&C@`@>QbGE}gWTCRG#|c2Z^i
zPMO0EwI81ZJuP0tSa!W}^Ut{A*UKNBxPEq}Mc(aiD=WfwPWqgt5x}3<oPSzrj_RkS
ze>SQpS1s=Tlb6xtzW@I7|Lc=t9o)VrOxE0RNO4DjrY46<h3~IVe^1YFQ;1s^GV{z$
zzAbZ%x1Qx{Hjr3#&b!6t$cDQ!)kO9-_nbJkRjXLSRpH!Ci5WeoR2~_moDAbqJgOO~
zXPCU?)IF2%go!G%y?9&&K3F=wIlnze$xLdFYUlAoyRPIMH1L{v+3N}Wu7D*D8eeCB
z{=89d+l|u+b9AOOZTEjxXeYF(qs^!9*yNcB>)-RVI&HkW)PVid<6Je*0->1;rZFz^
zUg@dT`t|ODfMDZf1Ci_-JCd9xC@;$m&6GInVVoGXbHdjJv(}leI%a%r`CXfz@p~(e
z2p-p$w0>QykX&XktwP`s=jERX7DA0R@i*2Rd|bY~?E42BXVybpN7e2~9d_L1wrfim
zOI37Y@@nxbS=_I-CavQA6JPsPG$Y7NGT!mq6w_lTb<RvQdUf6Z?C+e=z5h>E&wpAN
z#p85%jr}^$3$rtGmIz%`Q!Dl~k)HZ7=GL1-Ij2<Rzu##oP|ptaP;Qvn<0PSysm)?J
z>D!6vl{sgoD}_c%Y*yS{RCe}?g~3xZ!x;sRPqf?)2AvV?sZf}klypI4l`z*6gTmYM
zH`p8v{v7b{iQFvx^$U%kKDleT$TK6|Z|fcBDR)otmc4p<>&W*FH#*YTmpDzjsZ{s=
z%!W-47V`HdBu-|Zq|Z2igNgC)3!Zc8{A8yJJH<Q5$=E#<a4cYdEW=YBt6en9?Zei>
zD{eDS1*A=R-l!4$=z*kgLd54chgVl7m+t)WV&joB`P-N$ck}7Yd_DX2Y2j@dEgNH|
zo(@$ww~A-dLEVN&hgrVOTP`x6p>0d?(pIKv4SqT+LjzNOJ^4`3nGtf1W2@Xc&dcXd
zS<IZhzCCiLN_+i}$J6J_U)VmUNM>8Rg0lJJ$NB*Re_p=$te+JqWAAk2_|%S<uJSjk
z+}y;^2)k`+414zc+Fp*|&ZmEFPjrm%Na*Rl)F6=U7Texxb%ZCv{2rV8!NP)+^t($A
z*s-iDcW7DAdvxcM9fBRwT$iHOICY6OMa<#uyC7Ad@}Ydf>7_ON-zGBTdPzL_dvNyl
z_Wb+z{{DV@Q$U+#{$5t)=IsY(Fa9{a+`qm4-M?SI>zqxhbx-B6SCnf8pL-a*%6r0X
zvpEJcuG_Q<CR8#zg}z*H(c{bqS>}^3be5h!#B$QL{@I1e2YdB41R1=0E;hTZu5SBD
zi<PhEGZ$7D7ZxXJW;DlciaFabVcVgE{G~o+k4=~FiNB}!E$l)byN7sfi{7dZ4v9<u
zJsN(mQhJ@D!5-jyEHlPuIkWEMqbt0wsGJVhyz+h7`v=lDr^Fxl`u^3bg};tWP+4d_
ztA4Ve4DV#~?FWz8rEPGJ+R5g!eL=t7mWoieM_Yg2k}+Uir|IO7p4RW6bop?_r{|5)
z)fu1qe?I&qsjHE~q`7}*c2Fz3&`$18q3-8b_cdGY-4GVyAGGVoipa3D=O+iPkN7PW
z=VWD;IrYVi43?aPGmG!3?$2;B4(8C95+BIOymGbwIqe$>Q5)*pxV3}>J}y6&;NvP$
zEPn8qtIIxN=l<EOF%}H_ykzx*nU9!h?f<@~u}hJ=DYIR9)!HALf0I76a;^y1nIt0N
z>DabV(O|b$)2SC?D!g2^!ME&Z-wWv3pQL)#t#Q_-wdwxlCbutKoD}*oDD3cuBf%1D
z6Wi>(&VSv)9=_t3TtM^k8ydm98w_>`+-W&!+j4R%tNY!U!28EFs>IyBD;I@E7p&Zs
z_h6T_N5AZ@i^(gdEiqTTUUjZR`d-GBx>qvCC7YV(Pu;J#q9Qz{PPg;j53?%|6)L(r
zR8yw)<i1x~vHD<alr<NRKzr?`tM7_d%?z;T)!Huo?^myx>F&d^fA8g4OzeL2f6L2b
zm-4P}l{J0D^tjfkYqre8Ga>yQiI+_HIXM&W-Y6Bzxv(Nr^VI!`r+oH4eyDEb@AH|7
z_o;=pOj&Hy+?`8)byXPIA1HE_tIp4u;Qmf9=W^WMfP1P}*+Wtb9=PAquHBV8?UF;W
zP48yY)b72B>yv%XPF=qHn#&B8v^Ps;DR`yKC|^4HRqy=Sg2!_6o-t$^XD%$_b6LxB
zi)-~)DK?p6zdLv3`+uFzb#R-cAtEpTL&o8seVh8DpW?@l%dPfSX>wYpts=O*_~*Zt
zOH##rW&T#rF11T>_CI^{|G+FapQ&MMVtrTgf8ITP4|BkT11Hv$ri&Y&mt0b|{?CI;
z@=KphYrAh?U%ub(5Wh#5{faLW9sX%C8g7_xwf+Ayu@4b`k@}+Rbr<~N*!NxUQX=QQ
zNxaz^Oi%fZHr$un#mm^(d0lPN6@ivr(^j5JjqP2~B>dO2EAZo;H;wGyEdM-WU0B>8
z=yd(doMHhLMx!Y+e>Lq^;62EoZg<RemPNsTHOH#;N2S?>X8tM^;hwkUE}L^%lk(Ki
zcZS#U{;BB%txue_P5veO{AC9YtUGu`H?g1D>+4ss-*vb5{y*X4m}R<zt@l#Smcv5&
zRwa=w(H+Z@bL2vv_cfRPh&yh7GI-setg}}dbiGzAJ28Fh3W=brbL=ZWJz?E^{J72?
z3AGKE>?}9Chp)2~xguFLDQM^U&<RH$NbT#tRVONRY&GBFS6z3neYoOQ>Jk^M|7-T^
zaHW}_V`2~8@_w(O{pHuzk~v?kBzuqV;`sbX;6~z}BQMr0VlxXkJ#}Z_{g0l)0uEa~
zoh#R>3I7`RCNm&rzR``ttiNU~<`nC-Zu)xkIiqi(Tf56k8=n;h>rzgv-8yB$vdj&k
zU!U%Im0ys4T{(qMbSLL_#S+eFM~@jroK{COl6G8ao3@fSx%San`S=f(s{elfdei#7
z=J44GxjG-O&tZP!mvt`SUx(i;W7kiSHx~0WH(Q>$n$)#(qHj{WBimcI3}(})bi)((
zW&7T$A5oCGRr^}_(BTGNm&yOwWMA`HKR+<1ENzF}!vg-*r4u*x-+X-Bu=-C%+UvGw
z?|2weA9MdJcqdoXb7Q-8vBu553|-aQtQ|(WyH@5NFF&$oX3$B$td|oacQ1T@^y9BD
zXTLt#^p;cD?Ny!JqKb_cn_l(&cvrG-(nZ^s!W&P{bqtzZtj<<ArSs99Io9WA$|?l3
zNZe0M**I~NRlv8tiJaU5t#?1T`n_{C=%3XYCZc)k%d0~sr?2k5(HFG2{v^j#jiCO#
zs`A~+vA^H{`y)2nWM}Z-oor2>>A$sIt+xr6?RJrzlKE$zY(~`T$yz7op6WKq^SbiV
zX4$@ZSE~-Mnzi7dtj@*fJ<DgEODdII#Pxh#wY#|Bn}c?l?X$h^?3(sodFEADTk)61
z`#c}yWs01-zDsA(#NK&R@_d7D*>|t}n$R!5d&a*7eIha}tJycQnK#F_r!%eFaQwC{
zS2nX)eb`cl;Opk154LZT*Wk7?FF(2Em2&CzjVpsH*Dhb>`S#^W<JIh6uP#+D{(QuK
z!dlj>^>-sm63bTJc&pQM;^5=m2D)~R(MP!6PACiSe506Z$$7aY_T%m3)HfBgbS4$7
zw09KN+&X8nrhmR!&*Z-J8qJr9=U&PjES-HuuZ%BIgNHB4e%Iwf9`!BPF0cMqu;cbp
zqZrH8J+p0(#b)Q_Z%kG)&XNxOcj26%pJJ!%qp3a~QlWdF^<6Jp`ad)E*kQrx_iSvR
zvfgH#b}O?k|IKy78yt&H^k3Qgz5Q0Uvui~@-!si#H^B*Yr4{Gry^O71ablwHjGJ3s
z?Mp(HmSo#MTO^gTWaWx?DH|iwFCU*5a<JxR#n#=6oCE#)rHT(lhH$R!U3EyJ;J?_?
z2dbi9nqB8R?R%@WJVZocz2`-Noe~$i{Ogvr)>RrUd2?|>{p!Q{3hLVHH-2fHp<~r;
zJw44WY26B;jp8k7-&QTE?_Rm=YH4ZUM^Vx0#)<2<?y~NwS>92W82{$d<3`by3qF23
z_?W}qJM!t4b9_7ncfWpbe#Is5NjEnBu2RCR;$>#Pug2;KxUOZpv84RO)qwqXH?A{%
zBqe9v|Kdh*yHah3*PLma_PTF&<2HM*R`M%CIDgL0ElaP-3ci-B5?5Oh^<M3XVdCyE
z+ZC0cm_F)?YR`WkwKjF1%9fMn1?feOcQ;KaW_x4gd8@JO;zIG2pYGdDvAeTj;n%W5
z+2VD%t>HhDj~bba_~}UHf7!57<L8TDj_SoMOu^EP0j;}sJ7_GdVqLa}=VV3h=S6}Y
zXKfSDGMu`1?W^+~@p~1YRv7Ny9h7s|+`{zqHUA%vQh(bV@16B--qw>#CJR2Q;%AmU
za@%WX*wGffGZViv$86VX<DbrD(y(4N=}fG2LG1;l-I;}X-_Ay-^*U==y{e4aU3k&p
z@4@rDU;pU+PgSYQ<K*FQ|9kI0(qJ;r%C8ZpGXvOSOBoo<c$gT3QHQjWz>^OJm2dZE
zmrEa?s_`p!|03UeTcsqLCp?*%l2*}XIZf5_VNc4-S$>Z!O~mi8NTozGNHw#0eEjfX
z|NOtJR>k(`F)W&s@{Tt=Y2w|hyW@73z5Q-?=G?vgzdpY3HPsXMtt_$96n~u+HFfpl
zH%B)~#7}pR=bdkBc_!}K>D{5FrF+lqtNQk5wepYi_UZO9({JA1v{L-$l0BN~UyJzU
z(_e3zVP9z!d-ZdU$*jC<vqLSVQm@uTuD=$!G2+VWq}Z$7ZL@n`-&`YenfY>BkYD%N
z9NU%0UORrvGt~@#`b6~4L3y99Qp0(ozQMcr&n$LiQ=ae3cJt+;sQ)V?K8jyHo3v-$
z>zTRs(YbEPb8ZV8uR6W)=hs~s>(Z|-{kb`6y7sTK3A)`|>w?XnZBI4*XRvug*thMa
zKMQMjYfbz1es}8D9jCg~emh=E&u}wYm)K{}{ov!0m}%TMCKiU89bEl$%|0$U-SDqh
zSIw9`t@w_l#D>bd)sqgMmw$D0$&NWw-|N+D7S^6WRk(M?o`Zi6hd<47IJ<9c+S3N}
z?_ZA>?mWWVv_J9UD%YQ%cCnR6ro2Br)n?=Gk}#$-kyjb`?i#8@w1gVQ^>?MUoM+#`
zlbSp$<!lvechdhQxh?nIq;DMD9T=P+_IOjGNBGk!lh#6At{Jy7V$V(AoW#4|aFNMu
z?}m-{)||fRYk2#B`;O_#ceVxw>q#E5o^_&rN_o|X^%D0BLU)Mz{+@ky>a3rykNR$1
zCEoF%AzXBu>y!m^<<GuKGOD;Vy;T1CXVspft3SBoO&7o3bb$3(e0F5rkEzc)g4c`5
zyKPP?WSt=Wqrk<VEz)rI#mBydsneM3es5TjFTOa<cy5?HdxK_ngL&46oL=`Iu{$>@
zuM%rGdRo*ZGFHqt^Vrwi$OjMqtlJ|y<9__q3pqTittvk)nU!YGQ~%@q_x0}j|3CbC
zT0f`m`|spevlEQ;`V)#9b6y<&&F1f8D4k+|!0hwJ()h>_-MdArwkumIUV2etcmKk=
zJ&bQE_OH5bD!_g9&nAibhR2EjwmSc4`yZyeShrG>KSX+~$FK6wM<w50+I_ZaXQa7D
zLQeNvgNn_$&+Vt2wfZ~p-rUV+RnJJ;hvZf!OMhOU>wWuQTlw9se3}Pd_dlHx{$&k|
zOq+AKLD}QX`e=Wze{b);>fu}37UFMa>|SvH()=6QE2VY2Lm!8|k)Cm;oMFoM|KFc7
zeP9yc{<!F*AH(*4I~vZN|2%zmTI~6Hjj)1!pB<n5t>wD%UfFKTd}X~S;w+zhOC=et
zck6}Scu^F(=G_P9%_iRtetReJ%Y1g0*~8<3`mgTVDa?G<cA<gkkok@eKi+1mO@G=V
zZGP{`%U}k#3mqY8>z_O^v#oyc>-Zgp`UyQuy)p9X)3?gV{h2vs`s~%o5=?r}cbW@1
z9Pj47J>k2M$D36f&-#l$zL^%ZuPJ@qL*50-mm2jJ_)mNM`eJ)@g!r8QwRUm`nddyH
z*tsNLex8k^lX;Was=Frpk1yx{vE$_C%)O^R<TJdQe60P&<NwU@mpMM4^f;>`KchXZ
z@{aJaFB50>RXcjK)gO|0Sf}~L=0(2RI}7PwpH~&_zb|r{>)AG@Ef?lryq|n0LZxQQ
z?=L6r{VHEvxv_=+c<=W}&FxBSV-BxoTD;3;NsRENmCtNys?2xok><=#U3T<*c!lS!
znOgG>+bp)8^Dgf9i>%<@uBVs&c$Qz!eR|+S^J}S%QML;YzGA;Kx0Y?U$?9WQt3nJX
zJ*+!uxFS5uWbXP0Y;(>w+5hF7)h>KT@xNeBoupl~c=$6xBRS;-R|+0i_5Tnm>%Vrj
zmo<2HvQ9ly(poKv8sDDQ+Pv){VdWboP0K%@t}@%Ta@MO&vlz{vtet(Z>hp(fPH7J|
z?aXd4OfpI3Yus*eg!`GNkjCfw7p^4}UaYj*_s2n=rEXE-ocR$?-p&@BD(`JR;hW<>
z`2(d+?cOe5J}JxJw~qLj)#E=+RCea<V{;-8<l1l?l2BZ~FWbE6mS9ZqYI~*|A5wzW
z6fBjkoM0Rs6SgY*N5=DYi}jK!UfV9)H05aI)DAVziv1$11!mn6VlmQB=quT;&=B7>
zJL$;^z63EI)8^)Y!}HI2$WEE}OIDvLZF~34oqL7f2=5Tn)6--7_OGK(Z1&F;X=Se^
z-uKs)ec8Q+mCtzD;sxJRg45<Nm+V+LGcTWg(ZU12=G2GlpXz=i|D_^g-AqOi0k<!6
ze&0Ol`E8Hrw13*H8#K#*PB|aRIsM<E?5|HwPF}w@<@RiG`Pr}Pr>k51vCEZE>UwZ`
zkHmEa^Sg?1k{li<t2T4$8m|%QXOVxT^dw%GvzF_H!EBzHESJ{bIIvFhPi{YdhsKs;
zH}=mKHIqNIl~HB?bpFq8yx-6MH+csyuhIM0p3i@Nn7%9O%LYXO(Pzzm;toBlPIh0t
z%C@v?+4IxuYUK_K%{pWh+3L9d&-%&v+z~(aHB_d)zgO<GvU=YUorVXutiB!jyzuv=
zbjI+Lh0~<fEW{&c<eNV`Hi11R_td$Me;Rjmso8Q^P87R7v3<(f3BIk;jO#4lYdq3S
zIOG%a$|JVjdh6`ZM|w^i5N@uUrn5#y`O}7gfb(fzb>osfI;Hq6{QfgN>%VdE%&Ww2
zhj)j+@7sJ^Xq)7(ou}0tny=qnq@y0WamVRbncMd1Ioi#d{`z$llhKW*X}$gL8kA2l
zs5*Yx(YWn()Pq`$)2ZJc{mo=%NH5n2X9{!rU0D{r-tNHt!|I!+US6YlUAg{jm9ORO
zNnwp*Y-+CRhuzb2jKAz}_WY>N_ajtlhk!}`LD`IhUtRd^5)Lx*UVP{zHK*p$;m(bT
z=N*qRSXn!m6xmvo+~WK(=g6sb#h<rDys1vBd;8g7_3@)?dJ_MY-*1cEF!AW^+#ff#
zE?oco^jF!AIWJ?6o<6zu%f0B!$F@B%iq^Vnx+|FNf|cF8M;?K~clFKktIe~jJ;cBD
z73<kgI?_`7J8|=zsRu;oPR*WmPoa3faou9Kvdq@i)=Motf_{oBwD|P5t;*jPd%bM`
z>qWnRwM~xq4Sal1h^tuamB^-rhv(H-uX)Pqy|b(K39GU$+r_T#CqXxYH>`8t&+vGm
zKf|jOiH7CEfy_HP{EzKDE*Z`FbVh&ApO>4@@ANrnGRgjOugfg^bLY~ZpVx0IaGiAH
zR8GSDsX8kXFHZO&eRNB+#)l^YVSOR{3R0&VtlRz7^ksqcp1p7V4k|TH(An+s%6Q(#
zg9i_CUrbrMzPq%HcR72#u5n0ezSN#?iI*dT&PIGPU*-AYQu4tD-x&uyo4+|T-+p_V
zV@23jx!xyn;ao40{~iy}{Pp{wYre&8;p}yW{eQ}uB$N~9dAc`zo*~YwHRWmPyniQ3
zll<Fq7a!w%?<`xz(RIb1|DX1=|BQQ!En?4YdX~IAES_(R+?Pj6>@!~Nj<aW-_s00R
zQ}`ZcmmPgFL7elMy4iRO61`SWS9><!T&RFyhh}2sp15^sUsDa0LoaPKdOYX1y05I>
zi;JeO@7nVu#QyS}5$68&Cd2HrH`ul=ZQr}=M(UUT7wn=-`;4At96RxG_h;_?cU5JM
zzpmW)YlC-k*z8@?ls+t(b*{TLmo3EZ>Jk?{M+@_;^c!s<$u<YKJ=Ff8eAVN=`;`wp
z@>{lD7qiHh-!f4xBG2YkbB}AO{H(ocLCbIMmEHJcBD>2`F23X)m%iTH8qqY#ddr&G
zUw6d$$g`(1#oO>TJ*wTJd&nT}q~GbM8G3&jK6uN@czoKN{Qiu_zeh@26<?oRvn!{}
z##>pTd3NgK?+xrvdFC&FuzP)v()}2tk1ETqCK(yMdbUA0`9#s{`TT4CANcUqeaG^I
z)_b3szaG<YeR9^dNbppW={`Mm<<D0)CK-x;bbl|n<@aOWhVY%4dOZ$>%-icCmDmq`
zn4m6cb^2OjnU!m<Bjct2OVo~c<?LD2I58oPF>d0!gxcuzB|_P3D;Dq4E&krfbWDEk
z90vAF3+&l$wR4JhO72{9{W_Cs_PW=+Cb3K%rW>lyta+fPlYVrEjN6Ko9Lp^Iq*prE
zpC~MB;L6ziDNKS(=!*@Xf3b0>@gmd2(!%xqGiDrcE4d$e$70dUf-(=Glx<wqdrZtf
zw>Yg`C3f*bVc5OXVego31|Iq1xNV!y${J&qcg6R<h<N;IoV!kHkwkal&CfSyEXXwJ
zDh|pz6d@C@>a+8@j%N7wGneXrYx@O%&g-oF^*Cexiu>ozmc;14pOdlpN5!8;<Df^n
zF8$St$6uZQbXZ~c#$cI=+~+g4oR-OFi|qf~apdjtFLRIl>WsX6AV>eXe8DMm=ULwO
z?XBi<?fd+>;OL5p(JLxBwbeJV?X`NA>Zu|4wdhCe((8w#jf|yk8=lB~QSf}Dq7mO?
z*5aJI@j{DNF5|R&cBjUw<=~>P44fBPSN-^yoOC^xTV<E;h59VE-6aK+zGQa=oc3M&
zUf%0r-=WJZruw(-wL1T~A?N3vP;s99OZkr~b1X^z?Q&B4Zs{a3!Nqc~AIxCSZ)~2=
zl5%^~$KQ=b_kVt9x!m8#dHOz^|Gv+SjMZYyOxM=%a%}m|sPI|d*<sy2UY4Kfza*44
zIr6x3a;}Z?|9OKwlVyg)l8Gs|9?aC={f4h|q7~aN-VM)o*FNwP==bo+%iuAX_R8ll
z_xVnf>&+jx-V%N!T3h))W^#MMmdT1dtI{<&`z};?Dm*W)o4Abc_VM+mwf*yYmkW5D
zclY^hBcFNyx`-6-YL(~JDWTII+C)j@?0SBy<=2G$2mamKS2xx7Uas2ybAH>;oT*E^
zpMSSx`NPbcKMQugVYk+aUS4~6*Po+oe2a5b=SK)gFU&VOu6N_&{3p9zr+v7^)R|=_
z9cB8qVl!8dY_k8g?W?LvW~te$r_Q#xqPO$K&$$!r8LE6YIdm#L3uP_xTjr)PU+nSM
zHqjgM3zfwl-gw??`7c9aL!e0J1>>Y2TNIK{a&B5yySDV$R)Mvf-$yylZn2tOzq_8H
z^Uce@hu?oH_}(EqOZ?0MhV$;T8EYPP9Qk)KBjHTZjsj-qb(vRxEv(q|DNnRsVqRzd
z)EzFzPM%(TI?1+geRqND_XhF0S2v?AS{fE{_gtO#CXj6=o6h#ivOg*P4W0V0Sv&4#
z_kNJv{bAvX_=r~4?>9ASk9^z|AzFObRLi34^s;%m*OuCB-%&1J_q^>z?XfJ*-=ZAC
zLK70=Q?`pHm<h1=E5$JNoMb83@3fsW;mX7M*{mGi>*C|$54;wCxMq`FRnfKCTbE9%
zXw9k7<m+GiQ+A)T0H<q1W}}l|>*BRFJe(}dZOMD;U!`@l#eVy?ky~29*6Ho{a<=4a
zJEgl0+Ol2Aoxvxw?K0bgn2^o&3csfvQr=d3`PZGe@W<If>N6V}El)7-n7Z`k;pU@z
z?5!j<%S);*uQ_(FZo<PN?z4y9uRGQHJ@!fEK4u<?-R#Nk=HI(x6Ao+MSR<wIXyeRE
z%YEDUGwV$R-9)!-`(Juu@17MaEEaPtX?b9^Pw%+AiXG>9_L!m#xA*Q{`OjG4_xb%1
zwleA8<7=(nPXD;+S_doly&B2$*LAEmU!J1BS0bMGxnObFzw2yEwom$N>LcS(XXtPy
z!9_xKc6)`;&pL~UJXyZY+gGS=OlP>tu}%K-m5UOYrIQR7KDV!3D^$a~*<DJw|N3o@
zoI4)YKbn3hemu%ERn+E^{qzHC65c3Tp1GvxI*Tb?Or>(!2B(LeGKXhwRqm*b;Xhf*
zD=D;iiJFF}^uCKH=G{D?wWlnAbJHy5^BwPnFX%*z@11;7+ACuR(?6bXtd*)uJ}V_(
z785C%tJ9Zam-3l^;^#eu-Wg_XUrILJxiI<CvKtHRCb>-QzM$~3FSX$5<cobG+OyXB
zCoghxZM55@<XK}U)ZF>5yW~rfzkG;vm)R2y*C+dY-*>fa5tu3VsI|IsE2GGvy-TFy
z?@G4SFVto)IMaCg!>snxFZyrvGP#vMG5G!2)Zp~Iy)4m8z4HpX85g}5m2wFC`m8Ho
zPd{Pu!ii-Cp@$AJHn26@>YBT(@H?2S%Hb+<=%gGYmq_7zE*TkTo48GV!p7}sk$s6d
z$>kCgCLa1Y`&?k~N$-UVcAhggGBw?jSQaKcFPQl>_gx{~6Q{aD_VJ0WwUC{kb@#@@
z#a{Be%F>H%;+aln@~qk_$JcBq_Wz4>cQ+sV+qV9)caH128XbSN?y~s6{=Dz9TnY<6
zU-cEw)#v2S*4$VyzxJS+{m+Jwz2cloyR}v=<8kV%{wb;4^T0q**}2m+dCF74Jx~1k
ziWN%IMe^Ei)?bspb*{?sll;NOzIQ|yCErM?Fg(`qBa-=`)U&@^q!l-OT_N;M(pw>T
zwqe^h-*YMFqg3CEUl8@UUEsWChMx4KJtuNXWV{c~cGIvrdH!Z8Ys40*`1_p-pO0;u
z7b<`1P4yG|kAL><Vg8or*mvcTD{sU53AYX;K8+0LuC6vLVB#pUIAQ+H=eFp<1M`aV
zLRc!oKC+n_AN#sK-!Un($9j9Hroar*I}8d!zF$HrY#N_W-(`9vPwMA>iGNd+@740w
zh@7xIvB%*G_tC9ZfBjGF6Z?GHvvAF2sR^vB-xu~Mtc`qbVkqIt;V{L%O6qRXvpcg-
z+Z&V|{ib%=AUE&P^yl(=ZAYf~RGDAgE53NuUd5{-6RofN82*#({QYCY^7i!(K8^`b
zL>Qt<KXknP?DGHq^z4HPFOJ4AH(g!5D^5Fb{_#_bs<Mk&t#TPAw4VLk{W-lWdXfw0
z#Ih%a9a6d`UlT7!H-s=hN%pw6=gGOu9lYH#ZLt?KPH(fjukq%+me0S?w>5@YM>%gC
z*6S8qVKpVIwWC>$GqNx^d~!})f&{zNQtfB<H}gXtn5{W$JVnz&^@iXk3(<?2B`<cU
zsm-*wm9_VwjOwBL;uB+%7M|RiXqENKGHB;fk)MVqizhj;*tAT`Q@d^{7P0Kcw7ZiR
zuRdu$$^T}!W#LJ$+nQWEc071pBHXGTcIcXYrgP=(@J~KRKIx@$B^T)X1TkIGt}h6R
z>1)^DSNT&+ZpQEP-<$dGzSz3B>|K%8ho^FFuG+PmmjC`9@_&u&y@T};Q*NZ#a+e6N
z`<zr3eP`m{nlLq~l_y^B-D;V*=Ho`s?&5c@X_tCe2rZ7d9wt8LtEpaf;Z1>JmeV^~
zRuw)E*`QD}@peVj-GheZf-@YH8y!?8RB6xI5|lon@?PHUv>DeJEd}JtuA8sevh%-z
zPX4Q#yl&w_PIERapX)r;?$8f|C0|%7+&1waKNafow_^H+mzQG>oLi`8mu@uaz;nN{
zh~3LR*UYvLeVY5kz;Mgj2hKYz!@|l_{JGaXI~Dt-{bs-YzY3kMzSj+LN;lUwwP<Xb
zXT{3T-@M4|ujRrYzYJ%KUFA7xxl1W!|4(<7z1;6UY+~6rQN%@ZO^ECZO9SCcAGSs4
zK6pIu<W7@0Q)Zl8Wq$VapXC|MGtQ*2e=l?4XHPNKidfCutlLm^eaSkv#J;4UWP?Q!
z?ukoo>KHogWm&l+YO;f&-h`X?bWZgv%zAXTQFuu;r)5^4@WUfYJ6L;CO&{)z+BZum
zlQ+@o8IxVeMNyT@mpf+vU)gseNA}YcofRs2S;9hZ^#p$<O;D{p*|MlUe7!%fvi_;e
zuh+7IR(Y<U|97^*>}QR3r#64e&zPew%e?oObkv3WrM;i?GaT!$?_2PsL-~8S_X*|C
zdjdsH9%$QSdB3v%q-tuD{h8|(^S*Iz?|Cae>F%pJdM~>DUu;;aE<APnUU${)zdCu@
zwyYQ57c}8<M$R0?nU6)=b7!f2OPElVvFGetw&iB$W2F@OtEYWF*O|GYGdFOZz`+WW
zKQ8Oo4;D&tUyS=HyF~Abuj(^_Z9-E0KDiaed)0Im)*2PQyCF7pMvAVR>8^(7+gH3O
z)IH=a5U%ukqhvvxm`2@{o4Jl&{C`fYu(%mCvGZ4IoX$HYkEBxv96J{IsD=Ce`e!P(
zev8?vt$LPH<%x^CzE)jb%@)a*!(w+{wWIay-Xpg^DD7I?VL9uGfDHSaw54T&Va<Q;
zZb{Kx-6tf`s=)Pf_t9d`vs>OqhjF@^tAG6bt<!n`n_2rK@)$VP6Wet?r+l)@_-H)s
z<iT5N3^6(PCvFq&e(7xx+*z_fWY4k6nejYH8=8-NW64|Odim(z*V>G;UG28*-nn#1
zkbKTWYn$(3nYU7fWk3EkImENT)^kdb@0`;e>~nOQ<}7r&6e=Lq7hZnav~8o#LjmXO
zkI!<Io?YQ0u`2)kvkxaPF4^T2CjR@e%u<iJC+BR8T<}Y@A*t-jsU^WXS7j$~iDzUN
z9$1(7ST+6ShMju*ex1!1UAadtZ`uo{r^}dw4oEovdns?BqW&|@*7ldU#f~GnX6ipz
zEwPxkXZ_6jM<xF8lGo(l>Th`K-XM~(^vHokzI{)x&xmK{|380KTJV`oo4=+7UA?6e
z!neNdgqnBtqxsiYs4csB{uERDw5RSr4ep$M{jl`sMDcak?d|_P?_MV>+x*A*mcpH|
zpj^fB`@vdGjhE$kws73q^!km$5rd<DnZjFpJb0!u7BOfyoR)}Lae9|tx_8Lc*}m=W
zpOb>pPM>|s^C69Il5UQjP~fN2a#?35-sbtl$7mHfc{~5_-5Wi7mHRYp<G#IHb8$s^
zR`}d~DXvk>%(FI5V^!fdS+V9uPhkALkgv-E?=x>R-@tNM=f9Qtccl}S!dJdrziir(
z^TFHh)ZA1H=a$C@;_?-^4=L_Bs58xcOR56bdIq(X-!Aan%6WEg`u%zTetauctI+zk
zf0^TYT_MTYl5!d^=Dk$v5p=or`qidObF`KhIZv@peCT)JYtflPmg3jD)$RYP^uM`&
zN%q`b;Q~>%oyR^~JJ`Q$+x;hK@vO8U7USB#*0#pUsmp3!T-3^YxZ6SYR*%Jnde@D`
z4XW8&z6UEEUfooDYUzyXyN{<Ed|YqnFML+XruWZ<^a6F=ClQ<bT)M9A;nhAU)a|#b
z{bJvSUu#sph_^A+RZc3D)7+`LNA&9-smogq#AlUX<}rF2xVSVp>Tj;mg2HDeyEs$1
z{;2Tms@b?BJJ9+lr<7nLtC!8O4W`cu7jJuRxS%1wW653>2Qjs%-YtQf)~<+ty(>&W
zB_VC*ekI`ygBf3@OlbME<V5MsrDZ-!%mJ)NJ|y+b_gT}={LtcPt=oszvYAt2Hcx0@
zcEIS$1B+{N9#du6GVffs{IHPwN{D}(^;@CmzdwECjqUfyDHL3^M{|l_xa|~^E-uFC
z{ibz`IvE}~@ZXwt)yt&Inft(XtEyk87pxAO&Jfmf%wy`i4>h~DUF|<|c)m&c-D{2l
z*5#?wgMX?m7g?357HsEx&^Tq`9_w>OyP0<`e{9fMB-~`P+|5{G`<mHpcgh2fJ*oM%
z^cA<O&*R^D8=60aGk%%Ur6GG(bF2NlaK=4a&o>0*Y|)?K%_?R#=PSQ+&DGP<X%qPW
zv>sQy<WRMN@2}tgBPOr5U%G6Pwfe*rRo1&%MMCOHr5ly^xGi5)tER^~twZS&cgm^;
z_E~p6N~pUm|G~KCR;X{{$`#EKnf+QjH1o7dj_=#Ec=!D!>{pirWIvcTBe^E1H~LC`
z-oxO}=U#sKofPMMZEZ>Q|CHCv_g_5uW6PFxOR)OIO#MZl=gogIDcyK=`F^i^HyLMG
zv();$x@u$1u*Xu7$Ld6FS-ZzY&oF-J1<y7ZsBd69->mjj_E_xfm77=2R=@GvV9Ap3
zy$AaLv^{Eh8oGgh$Aae!#*#c|*2^lcuwd)>RI~BMhNIj{9}=#;TWQVe`$C{5?Rzi7
z{^;Xc{*z~<*yb9j_uid1aT>c|%9Y#exVA_tu6GSpyXX6aMd6(LG5?h(EHq~L=>5n(
z_H+7EJNq*}8qC$tebZS37?Q-!WHN`nPqR5!_4w?P7uE*)`~Mg<1n35|_9dOXnDgi9
zbpQUevsFy{6=rHL)je_N_18_7b-%uF?YkATX#exzQ-}ReAKq`bc2-)jng4wI-)HUZ
z7xTO4$ItnD{KeVs_jUDc-e2CX`gi~7BGcMSQ{oo;-`%;$&~~#1bEHuFCfhR`{9YbP
z?5mvb`jPv5l0w^+j_!|pr_bFoXF}j5{WV|jO5Xo#_IBDghOh@(bE;J(KPgP#P|Ex<
zrhRRl#is}^yXhP}w`Y3YmEUsbsPKXRhjuai{ywufg0Jeujz1!ow?!r`_<P~qk`ww$
zXEP4#87+(}SUjEYtQMpHt{v|c8ad?h!&4p~@x7S8EKTm{f!R0XOO{K#zBMDoYMB7<
zk0@@rU-DBY{b!qedH1}iO@EgKi{6ZIZ(XmoOlRhU6Q^IxZP2be_r30s^Xyx`yNs_I
zMpZ9*^5<fDn?ZG{@wQ#FW4ENlH<@M?#(DC2b}_2N1sh1eZ9l2-WPkX|pMj|YkpeNw
z%fmg)jYQitisOBwKEwpxls{q7ASH6DXvYHu*_7R$pWS2@XRw_-k}q@o&{9SY<*QSt
z@7Fxndt_bG8KyO@y(PB1o9)e>mN@^Eni$>cU2MEB>_L~>?_fi1l|yHER-SB&nAv1;
z<DscR6mMbdDgSb%ST@hzo=VPbC!;qR6iT$EY)zfxZLx8~`pHX6b^q;pmi@lu#K8%l
zgfzpW=W8vQ#Gt<6T-D!Fw<E5eFRW^|EiyKm<@I-3a`-7#YtGB{MIR?7=U>{U!pWuQ
zILSZujmn=>+AWiQT)Sq*Vc+AmSjBD|Yv`f=*rlR79ZSRl<#SgR{z}nXZB)hRo*LR?
zpR#HKXG~glmtKCB@T!L`H!XiXI-NRg?dr-4tc(kmO0In^Sf6%jdhETmGiRxt=)cHf
zl(dxj3g6Oy{>q9vQ3vYn&fHt?RiwPs<>{ph!qN{T@;2-d(%kcL{rt1BKaAIJZTf!o
z!ky*9+&#AWoMQ7T#H}2kbtfHsIeW&UCF#c}WRx*&NtLX4-FxU%zA^i=>4&!Ja@Rkq
z&zadWPrc9GTsC^nrRy^%OQe-FD_T7;5w+1T*70x^G4M6#>1Y(ODLJlWAAR9;YvA`o
zU3aJc=#beX;<8xTK|kFyL)_29=j;=PXFAs}UFZ#ETzYon)zTN<=CN$gBgGQsc6%tC
zKAZFH%g@jCf6v;>PcmTYo$%AT>fi14|GuuS|8;!*yuaPeuXKNTMqKbOt6Y%H@U_<|
zuKv~G&)c)LL$p+$G=EjtV(fDG;~Jf?hmF08TeiQ>ELdAmWq2auYOKz?s^`DBq*%mz
z1808xD7A(6+Kz0uo}66^x+XkI-TUULa?uib#_Y$ZJPcj=nm5@TKc(qDQ~KVsd2`fG
zrWXa?Hn_ZQ#>zQMen$Ucxa_j|aLQr!2SG}88k-8{`mXA<j61?`@bGF!^_-9UwjA8<
zvr|1p=}d-YxN44p^Ad&46S~b5r$_CasFoPEJF7&?)1xT%(X)q4S-U5GjLGYMe&+L>
znys;JA<N2g_@;hP|1?$gz37>pNjqHCTR-l)lw<N>+R7O_9Q2?1%;s=SJajw2(q(x`
z&HN*u&aUqF()sLk$h`Z9>%PwhEB{Okb!H2C!S~pkmy0>~V)=<*f0Q!1rcQo5Q$p@R
zk@2C8EoFixE0Z%h-n`@3{QbP&1m>pAO>2)=PR{I}G3EB!(`sHn3p+SV!W@pI7Zoz@
zkDm}$#pKbF_4oU7ec?2%XWMP&>tDH>l)K(0&ba)w+LT!<ZR*`3eq8e4UKMpuq1Zn_
zWM_x{_0$OhE`CefR*H!K6`E--dt~*6DRO-$+m62W|Mk-UibYPLlAL4qBlfj1t;-uc
zH=JXi^uzIzoy)?+WiRt?%J+D`Jup3XuOj1yD;+DguYAs=FE&%-z+sic8JA^?XH@Nt
z$(Hvstch%`?oVmnZF6qZB0Kh((j3N78>;>VPvx*K*LX2+k#hRF?MjO-9%Pd63CuFE
zDW3PQ@W)ws|NDD_B=k4hcuslkwR`vOkB{3!kA^Rr7|2!pc#`=9-pQMt<9=lJw>KuL
z<nn*bE1S$T;hpfi?%y8YG#2hExtQeOT*Oi)KB;_F*~AywnkORaBDNn?b8O+Cvgpw5
zJ5&CaaV~oP)vNe{{Hfiyt4uSQYF)EL8pQifE(!bfcADme<5g13=T$CUcW;hk(bC;C
zZ+m6Mf`xMm?p@DPne?-%Cs@}hJoZmip0(|=AH~Kd&gbkZri=aRo+T!c{b5bB`I-MG
zc+dX2ofByLL&W#&A!DVp)e_I-GLubBFBP9VpYq$s@|Ff;$Q~INp3-LF>pHnUrhB$@
z_ayIFcE$9=q3($jCoQgB#Nn%)+3vmeZw8x!>ntt9W)0mCE&YvYUqid5ZHPRSuFg3B
zgvj>EC%?>^#&F@wm1sAIQoiQOcj7g3W>sx?vej7Kyv|6@yxMs6uKI~_O57V&jZA%u
zmisL|u63uH_2r+NN1F?${Wy80=&$DU;_R3Xu4Z|~k6WvADj!`l^$UD?jj=xX#u7bK
zcfYjnKjIm(C0q2v_<y~)xtZ;JyIu9HV{G*nft5cL)r%w<qq&)_f?vkGyZqr>?8&}U
z3m*FatNGD?IK5Kj&<q8IDEshbpZHtdj<yt(6%-V-#j$CfW~-`;P*EytT%#VQS60Qa
z(acTjfCJ--V*Qz+lhd;^+NQ8s7ySMa`s%k^@2gMe+Lji}s@uPjTUfQJ@k_%p<~18%
zw9E^A*$_74g$(PYtlra}PTn&;d_VU)TNlooWUd$gwc|{DA_s?26KBOO`B}Qoaa9`2
z^USxZ`7K}P)9iWGp-HsB<iM?ll2F}?Rl$KLm|w}RGWDPSY1<KTC!^I7E*jBIA10=n
zly9;BqjD)*arfg{9b(MAY4ws>_q?7&Eby>?F3!DJQq*<#RmUa8pWWQAo_{v=OJ<^O
zK!yoN`Nuy$lx}&<cJt~ru3R|l=(BS{(vRCFp6XJ_PmW4;eRq+^*&-^$wLs)vcigUn
zZ`a>A==id+OS7uBdvl-m>Yzo+qPgJ$a~hU#GISp9xumXmJ@+q5E|;9efkWSRDrdf1
z#VDyXvCV?FZ11Pn&yrl2JcUL2H^gm}zsshU^6;+LG`^FvEbm{o6s7KX-K2HabL9-l
z_Neaudj_6{E4IZtUb`(e*+uL1;>h;moYcjlw#V7)miCIRIH|I@w{Q}(<gtiP(t;b-
zNPe&XB~_G{yhUvu^MTf>R<-jPy(|}0ajbe85TBE><FwX2k(f2wTc)hhl{M2XxhBSW
zI^aW%xz4HgA?8arZ5NT)XEA%H?T2GICjTo$qGN>i_%7J`sGvqa)mNYC<|-5a;H3R^
zr_7ROEUNpFoMJdz%V@gK#G_7JN@CMZuWRQC&18vrC_Y`0dtLfeU4xgwYnM6Jv0Qap
z%*V;{qk{cuI{UuaN`}uoZ`JQ-eWy4<d;aXknR?x#sh^B~tBTtzN<O=|a8`fC_g^=E
zNz8MYDfLs7AuRlA(u}{>t<Jt`T1zJPHA(N_?|3ou^Xs`O*S~IhvV79P#(mEgT|TtI
zO(XL~NAx$9NtI8IEtZrG|0k!S&iYu$;{m%b<G#g5mS$awy~ez8j(J9C<5P`e$qPO#
z`?O3a;ccLC%puO4GRK!+Z-fYHB~9s`@$F-lNB6zYw<V_BcNRKv;%vCly3`rR<ZWd$
zChRr!Q22X6@JM8m(4nTyx66Lt$y$8sch$~=udQahcX(&u`Ei!PwFmnYYPU_;A}pBt
zc5+P592M0QMlY}ZJinCXo3EPUk7%D%*Ns)v%LA(dHi?_gn6`eF)%mX{W#`mQU^;UA
zn#!W5OKP`W{XWMtX6e>x(xzwZG(1|97thmpcg%=W?B40+`uqP}3Ur!fsj48OcHL&*
zzT2NC*q`E)o;^cJdis&0t;#{m)fAUm&UuqonENi-w4nWh-!dys$)b}C5_gYqs^9E5
zw9_cI@U^bzX&#P~Cu=TORc1D(m|pAJvh8=++G(QZVUM>2T$#7#Otcw)->nVer@Hn1
zyzfpb`!(_9vbkQX%IutvJdL_;BhsP56uaokvm5?QGi*I#e7Zm7&P&o_Rxi>&k+$M#
zQS(pEitS4S|1aJsyLWwua{0H6T~+-W%`5z7b&G0F{=k#DM^vgYCjE@EYu5p@uW7qi
z^!zs1_~Xs)pUcd1jB-TJT3^|p8*zJP-|Y+!rl_|?YLD7nQ*O_W&V7Du*#^GgzbYap
zt)-+2(p66v%=I&j+5P8`M3m?{eI|weP{t`%?CUx9f83|=KXmc6CeEJLP-P#Ne6_{r
z54FX%GkC`?TGJ%CnpbVJd)JCu35#$sUxryzSnnQCITK}nbGpdWc`i{o#wB@o)sv#$
zPgCB;e5-jS{|-<7zK3u2?pAF5B$If$a@Whh2RL5uu+`|aW|TE=3tI3|I3lz@m5=$v
za*3N7oHuUR&rXb)wpl9D+iTh3JNvkc4z4)rd${cYL)=4SewNcUH*6=BtEHZ4NY;JL
zUy~)G|I|Mx!FFoEx%@+oYYg1CKB*UWR~O!C>1cg3b*oyWwa*Uy$_%Cgw*M<NI_s{k
zoo=FAz*)m-ET*xIYnHY4u`A{(|K4b}KJxFDm?HAx3xBuW!^>rM4c_7#c3ye1;LQxd
zO3C>b>}QlcwN({8_=WZFKY`1RS9sO9GXB=|DaKfyIQo4dJJa>2s~UgwU+ACjW4ZTV
z^VV<G5w-n)>o-<qeDC(IGCBLZF^nU>a8J~hYGI*^jn4!;mMtjR?~)R~Yhg@YiCwM5
zvF$FKUn;M12#L97zH~Y3t1r5zj$2n|v#wx_-^y{~$FbLQTsvL9*Reb9S;1{|f;}?Y
z;a7vf-y<c0E|Y`!8gDqWH7}fBq1(7_+lw1_w{S$Ap7L|<`tQsCo=;GkGDYv9kWiOS
zo2Ozz;i(l7M>c*ceiAIP``&``Mtj9Ch820T+_tryhxykQHukz+zxrqTqh%+YEzi90
zn;Y-AAiBXd|4_mGu<F;|&lhWW`DtI9^mhG*r8C~GeB5rc(DwqP-@cE5y>~M|yZSF^
zTIBS+D<I#WZSAsMQ6EB!d9y9GeLeM`c|V-*6vQ-3rYQJgp;g2qzTTZY57+HFtlayr
ztzrf1v#EyXzW!?B^GZngck(8any?_xv&h6lrN+j~qffbn=o;*1u+;k$>b3UeE+3EW
zucLW*x7sY2+ZCX`E5$I}K%ZInam#A$LoaGYck?Lcs(s+*OJu0o^z6dpvyFbSxyLqd
zR%c6Fd5byW)3O7Bo+dVD52@bxUUTcoQti2E&fdQ}6PfgnOV&PM(8@Hgzw+gK!6c7!
zCiRQYPu?1I(}wwBr04xLmXa%eUP(C?(9qIZa{Yw;w69k_HyLl_Epj>YlD})q%oE=6
zFPRr}IG?+5Me<bcam7bo9m&CYp%SgSQ;*&?YunhLaAaSW7Ek?Qw+|oJT`cl4PZ3-E
znj!Z(kE)%=e1WKCqDN;cZt@lslV2PBYDt+`kWI=y?fk9TJZmQ%HCe~=SeZHR!{&$i
z^Onj+2nioal>T=jw`BV1-~$YPb0@FVEKl~)RBF8AEYGi*uIAVj)*J1zFypk``}hl+
zcI@ZhTJ)Ct&+X^CbvJC-t-j+-P_|}k=*HLyx$8d^ou2ozy)Q5Mo$A+rpWm(0m0dci
z>|6AANw!NH&%a$_AtioU-B_z<%00KriL<1B7rf`X=DO#0g2c7`Zx^m-*Yn8?>Aqam
z*_UxUC64n_56>3=d6&1UZJ%)OUE!O=f)^s)JJlucF?h$%yKv)Ai=l;T@mek6YcFf|
zIUZYg<S^TrXS?LCZ!Vtts&zBllHi!YTUSFBE$u}s9=|e<&UGk}jZeO`uHX0T{?o!<
z9B+7aI3E~3Ha^+=Lu#qp%1@ia7JT@m%JNORrL|G*szKagj{Apf>{a&7ex@LzH~od&
z+1ck$a+a_@+WzO>)3TfSXLW1Z{@jqQxKptAPtZ2kImUU@eJ3=gqzT_jU$fsTr8n11
zKYYrp#M;$Gg`ujm6CN7<3z+7eyh@|{>Kdo_b6C|ryB>a)H1|OJ#j1TR7d_r5+Uo9~
zdveEV|Dd%Dld|u%23qGXjg;|R`sU`Uc#oB$Upjp9XGlEsWlo=F|2gSS`Q4p24g~NT
z=}-315@|c;bgpa9{YfHLQ_k(2sk6Rcvg}h~LEx*7e_pEWC3}lhEj~I_dL8J#^Z7mh
z&-G!Q2UZ`xH)*T&3%<vErS)e1LWUdiALi~`%HDEen&ej9NA0l&LY^U$1Gm3<9(*R`
zp5fG#GiHZ1>UIcL|CE><wcT}U|3+WArG}gC2klz(ZT)ob&wH<BsT!?bRLh%}wd=yK
z6W3p?k$CEU?#MwuG2NNIhi9Br_}W>O{3F`0XZF*>uN$_0Zq^NM_)y8xCb!LT*Q!a%
zO~;o>IBc*lNlRtk-TY7U&C1Cfs?E!jxTZ{FyzTVi-VMfWpH?1Dh}bOKHdX#_rJ2Pd
z7Ud<?^Cq54@Tfd5ZKC$AsB*SMc6#sPluqS8mFF4X3$J53c<-I$bB~Fuc0RhEtfsZ@
zebJJYsX_+JZiRA&t0YY6`fzZ2L(fJ<k@}b?3gUKMT(UPKYWa$%b^Mi(2zNB9uS_`-
zyxC21%M;e+>plwIxm;S7;+^Bcw!VkU=tj)3l=DBHeck?kU;W$d97Wv$hB{wXFK!97
z{kKj@Jjy*o<tm3)&Q|Uko#&@QHYqIixb7G@^Vo_N-cOGnyS=Z(Y16!htC#ByXR>ex
z-q375WA{XR#)}i(OK+P6@Y<R>Me#N+c5h?TD*82dbL0N39L4O5w=_gQ?1(#9yMK-N
zn&Ne$GOx?R7w$Os@6?l*oDDbG6*Q(i;=j1wujx@n@|HuLCY3jIrpm2+-EJB^rEK^7
zchc)`G+cWXKJA{G{jncE4Hjl|32iw%QMh<9+or>B#ddMOs9A9Auza>`n)hSnlk2v+
zPX60-_wSlHDiecRSwi~1Wd-*(NT2_$R&<8H%fLQY<=&rJoHF4Izk>GUW$BdWF1yxZ
zH7UVlyXdT5{hb0I7axD(cso5s>wUy^&ycf0+gG29d&X<mw`Q%2u(W3G*6vU#iGM1!
zu?&vfA=|E;6?iX}x`(?mD}92)zFnKTZf99MmEkzJqQINy$|^-=_R?+E*$YZ?UhHkO
zlfE`J_|oYhmK0IVtA~yn%-Xu@>6S}-y$+S1ZcO(}bg<-avTWP=cdviYnE+|Gd9V0$
zJC<FTkmzy5)cHYw<ldXPM_x789{b%Z<#;^fVcUjjd#^bsNwd1Q+z|O)B>jHpt?A$Y
z#3@)$c0BGPR~%y#eEgMuP1u=Vso(1ijCj5B`~Su!_qgd!{kFOL-Kw-zA#MLGyp$K0
z1#X?J!sK~+a@MwRhFx;(Z+@@Zv6)Bxx`p!bKdV{q+}Ngb(=XC4spd=Cr98>osSDQa
zbC)uFTX!opJbrofG0T|4OI$8q+r0VOwYB2&4<)>Q`gm>h`M2Bh_J;J`s&`E-sc&3s
zZv6Ae+Ubq&HhulKXu|dE?&GiZY*$$&P7i5r40qr4{uGb+|0fE8cdkmWTYci<YoUNu
zul_ljD|`)k!LVKa!^)2nW0~5$UAZras{a1@=h5>u#}_ZFeYag!yn9vFKiT6)Pp8Sq
zP49?)A9PeM?LX)0Ly2r!i4vb?zdyH0UQ>D5C)vGGS7xmIma%I^|Druf?O#%_O7zKZ
zRz7^_k7UaFUt+9}ZuYEh3Jp2ik~FP9z#v)DkmqM|xV-Q*tJOPgWPVvse6(+t-_hC=
z@t1dg?7JMku;P{J^M&u@T-ct?IF=c-ra}Jw#8-WCcRtAk@on;X_b4ap$K}B3ZTlC*
zySK?VrhoW<>7%muCH`mAmHU<+xBopiT6TqOb#%eOw0=Y9t__D7OSmR}U%tLDKVC;|
zbyO((WW%=`zwOw>>ija|X3_hpy5*5KCxwgEbKWfE43bveBCnWy@1n``IlpgPe&v%m
z*%h;PPWAO2i%-P}a+htr(KBoJ&s1CKy9Xq8c7++-Pnmu9#_uP~e;fST|NmXTB=d<Y
zKX$ECZSH+JvsUoFpLb7jOtFFNGnpq*SxX9%ugd+ai}h`YdYFGYbg!CveV&oC&h+gs
zSz2E<cJOz+ttmgKxL0LH)boFhJAbmK*&Stxsr$Ef+S!7>&1D9)xo;2LnWDV<@^0tT
zISmS(VhmsYE#$Tpy1(SK!q$^ApENA@H2*$wxxG2L)nZ*)aD&Z@$ud1(+YGNA^-x=I
zd&i0WKYm0WJkQ=}dwzDrC9ijhk5-;ilbjTod(%5qLsEgyt2XpodAS~I-KJ@W->A0r
zJkFZ^<I7^r4T8)+*sG*3#IHYjSx7!$Q?udJ&l?p2A|3tT9L?9}Drh(`z4Q3#Q~~({
zlcQCWK9qS(l(6+meD2`<f7QvfojtQkQclg5`x7W}_K%!h{f3|GZ{##(Wj+z#`Ri@S
ztTWw5+q`(zXWLJ_?wFzY{82(&??L`J0p|S1_FJ#c9MYGabcI(_%IBrwojrHn{IUGw
z?)qb*^aJ+gEFn4#YnQbjJ@UZG>)Xb^+Ogh#-=#M(@%V>cp5)n{zH`Rg;{ASeH%;57
zaZ93F<!M{5?Nx?F`4h}nMwe@(<<4sJ<K4By<I;@xzZ){*%b&d6nek!D>e&g2!oe4p
z6jW{v<z)<2b6Lt_xRODjwqRjwn;{?fq=2vm%N^}cCccdP{khsD*Q8ACfqsoapB_i7
zaiQET-Yo6}*XW#%r*iLXZuvZ0w)jqomCQqfoSL($myT2lIV*YjJ<-ZMp<288Lu*XH
z+0}Xr7Ob>lHVfrueGyRCdGpM638rTrr*?!$GQVDDu{+sw(~MX~>s|Zi1*dv0v3eYN
zcgmE6yfBX)OE@{^CnRica?9**6%_8wNU3IJRI)Y=+mqpw_KIs3=f>w&5;2MEK5Y&;
z%DGfXF6831lAXb|_hQ^CF7bTVQ0|U&f1W<|o6dJ*#oXfChvcv6yl$2H=yv>H{@iyF
zo$q^v-+c>}i@3eTu~V(==GXPc>(myBh_v>rmz%AaK7pTe`r4}-IR)aCg~XzD3^ZrC
znxEQ|V6}PM)1H~0l6mum-WW7#W*j?sU_pAs23Mm48S%{R>$iRDo%gvtYvu=o4`F<B
z^%kdFJ>6Y7%jx;sdyR8BZcRI1adyrtiN8zSr@R%p+WF!`p^5&n)m8mhPJFy$@KNl|
z(OdIx+bvIjKY8=lD=G%Ninm%{T2>nsfA6En;fWQgY#ZnNdi7XrW&dJ<fcM6RAAgwd
zDw>o3weg9B$`A7|+t1(rqv(5yXT82?(L(ptRlSd9+_Kra^s2g8{MBbs?2n|JPaVG=
zz3*sykXcQQ?3)EYe@&K<`Z1%0d3wdeKS~YnE5%*2pHH>TnZ23$fkX6m1v%?~s{%Z-
z7^ULHs$R<qRUA6``0x|GIiGJVwcoIm)%u0U@y>RA_ByZA!IqxuJW`BKp63_w-sAG$
z{@JFBwRh(ny7BUCadB{G&%)Oh+s^;?u$D`>H2dfhchRYvSL#g2Yur4$O7O?4RB!f)
z-I9lVv<yGCx=C`qdAYs8wDV-@nIE|!<!62$Sp9p+zD?H)ub0=EYJ4@_|Dxd_hwEn}
z$z0El7v7tKpRYdGfB8%Zx6=$A*Uaf&72R(iD&!n=(Alr}v+w)KwR8Vi?yt~k`BGG?
zw<2q${o#<s|L@zs*nhdw?##hL&SgEP``<+TxtaKl%Tvnp!RcjB|73@Iw%C7qDfh3%
zafV^-t0mq}vdl~urfFpVu6g*qPc>^{`mEB7#eDO3iFh^qP$?G^;pUobHg~VI;d9&T
z7aq#6`_+2&EpwgF{6F!><)rk@MSW?J5zD;2jwwtlC@EWe&FrHF=lf${tJK*Woo5>}
zEek4~8~MQGn0(s|#~_<yCtdVX?`PT1&1G8PTX4GkMp5fYrMU`BMk3*Is+sAAiQ&b&
z%?<a>{`KA_*~`*)^$DF=J%j3Sqnp!CT02<Jjh}v?`s37zpH@AO+h_at<J;HCp^CSE
z#x#1EO<py(enq;lwQTUS!l2FWpPtGtJ?2r?(B8S?b3kv}?+d9qF2~$rKG-h*eI&ok
zl=;YvpKHH;-u&T1lx~yA42}<#@@J09%U267{Gu52JSC_vUBzm0)Dfl6`|j?Q2>v9}
z(7?*SWR;+HcX*3Ug{HS{Yr#5A`)O~b9&~w>HKwlVGIX;oZqg5*!pylq?=)j^mG-NL
zcRL*-1GC;GCH`dGTVXr9l{Kw5Q>-<5XR=tz_dFS&9-kE}4@VpnDA~bZaqG#%>%G2H
z6YC5XoWJTi?eJr{AHAKuPt7~5_Qp(A|8`1Y`Fg9bEAQtXH+?QO_q4uvSFDU`9J?^j
z5xyX;3#O7;i|^)2b%y3%eG$F&65q7fZm(^29raFiI>@iN*r+=-k@2U8{qzg_BV~{E
z1umH}qjvq2HxvDiMX$TQN$T#Yvnf{1bCcJ9c;0HY)@-GnK**=Z-`~A6*gm<%X^Yb`
zCvD%IyEfjcU3|}NU&{)!PS&j|f5n~5&z!jut!V9WtW9<2l$fS)|BDiRdumVkT#Vi4
z5*?P-V;VLsdt0I0kuSWvEHj=zu0NO<v@Y`8*`uC$i3hg%ZChq`vt+Zx@0+W?_RB}4
z)kWzy{x+Q&Y4oN^<wi%d>zcMg?}KO7o#VR~U{>`^b>s7AisrG>8xA+?T}@eifBH4+
zLa#}=w=NuhbN>2Mrig_#p~p@YYv#YbAU*ehIH$t0?&S?k=1&)CO`R{lOku_Iud^g{
z)fa3(;kt_N^Uq(0>Z~n4%C0}-zq-yMO83(9>eW}5zS){rlKo|&_mM&~iB?nF3eP_V
zOP!q0SA3bqbL~T2Ztuw{$>)r9?y$1%-PD}oA3rbU+<k^vwxg`gce=J-?TO(&;?w=R
zm2a-$39&OR^MnrS#h3{ew`>Yp#<qo(Pc3BL@hoXU>C&%yTX$ODv*cr3quG(X+Ww(l
zRZZgrTTO@KQU1jzt<zGxd>eE`J$@&z&zvhQoY!}y?EF1LK_&LZnwLLB@O!*m>+^TR
z)gQZdbvnQBFzH|abL~l`GL@tMGQG<7osRtfJMi9LjrXq$`s}OkD0k!>ubEshQz>r_
zL#Dn!=z)&cheVdW;7KbhOV!WX(tbAYl-bhTFN&Hg^=ti`tzE*MQ-f~p2`)-8zOJ<~
z@!+34@9E*wv;S3z-DmO1{&`nt6`y$fR^JUXlS+E{vo_7y_)~D*q|*YqpSNeEp4&Bz
z{~zz)MQ_zPTWbpR-#qcXZ1>DIHe2rTTg7Du`!3dWT|QElu)8{-<ZhSsjW4xn6D3a^
zw_KcaaL2W;x6Yf%_3u3!w*R-s8@a6tdq3zOH#>VFIYPX6g5#{Fi3e<D&OI>rEjO=k
z=dBlRpBR51NoqLxmY30JCUft@-1E(uQEk^>`{f9${(U{`6#vB^Ei%7!I7CYorf$4=
z=~OtQ#U9UAOUaaayIOzIPOm-eD|bx{$zYvwOX2)}j(z*$)=xkC@$&NUg5!C5h8w>G
zcd0I(J-xoRYn_w-|F5f`{}*C&PgG>RGviI_w@0&sFZFxNrO1Tt-8Feu%9_(hxKBL^
z+n2)oTT82=fk#|yBg4)}txaZUkBJBy-tNA<(ylF$b+>QZL)+SaZ|3j+^{R0G|HqH*
z{;R()?)g|Gxl1%UYvZ9cTc6ITP18xTVk*;FcxTChilEehocOIXLd>tGFnjA;6>nP{
z{r7OA=CLAyOz#gI`mdL*6w0YKEuEt9jB}!LOQ-j;Ij@`MUUo@(cBnKeXIqr`egB)q
zUd~UVu2glh<*tf-F+;dBUrOt?ps{|9+0`uLf4Q@!v|KvYSGKdPT8^oWjW_tGO{wZn
zv$$)Qo=%WcKcUwhxMQ!&O1Gn`&n|s>IoHgn%j@VQvp)_W*>`m<QmX$Fx@fhm?Unij
z&jy3W5AvG6PD&G90yK729CumlsWich^}Xc6?6<Z@E`C2VlPA2}qxQv>@2&5zh+n7|
z+&*V#mhS(guzyVHORDNO7{8T05hKs{D{Woi&0con*UYJlZBHD&EYYgU@SZ_Acb4G9
zRkl+qRW7FP+<Nelm88*u$_*TPrweyWmh3eU=HGYa)hZ3oNQUe4xF`SAd#L8dnYP#G
z=?k4{Y3><Hmu?*oew0$n$Jp)Q@z`!xiCw-SvqzQnWwF;5?-oi_{Qtz?cjun9gjeK&
z4|_wbR(`CV8o>M3#LQgyTjqwf^Or}JpJ`Kbj<XRlI;&N6B~|QdQ@3Jqm&2z^@#&v;
zJv?ClZksE&5MS15ktWXnrOO-ajf8lvlr(Sh;J&=`#={>qQomMcZSgpy<gGSs#WWqQ
z$yu(2mRVCLKH9q1PcQrWB%|{WKZ#sR^4^~Me)*FF0=$7itM_Y7S2z_Q=`uG_R`K<w
zkl35Az87pgb$_AI#uGcVH$N50dveG2g4eZLwR&;6ld*;C3}npy{MtAx|Jjbo@gGGF
z-|2gzJab9rMyBFhbKk3PP_5c=b!KwVSFx0*FVFqH9JM)lR#5QvC;7{T*uGz8U&Z8{
zyuigS&_Z*~#hvT4)U%)6H=MZIfVE?i+W$3w*7Hg=F!d+OSb98gSf-(Pt5D(so9)C$
z>V@*YA*!MLX>(-uEXXczFIjX{A$Y+zizUnT;#GDYzBjX~V2(`CyG5<%v^C#ex~Dl+
zdrA<?pP5m5EHdpyzkEC1CuJAi<9oq<S0_T1Rf~aF-ZN@X!G|5}S*q3YHx)}ZPvQxc
z@11X;UM9CA?u_*}?`J8Alm5>9_DT7tfbT4Bd3)1Wfo<PC1=ty+!%R5e|2GgeS>D`d
zt9wqr$>&1^H`mJ-DJ7NDzdg#(SE&s<f4Y?Q(t7W(<QtWfqBc5hy82`Bg!3m`q_1f1
zvFH8E{w#H4f$GwRYv*oe?fa4Nj-%!J8ucYpME6>6O?20-$WE+ueGw9|@Q$%aNGoHL
z_ZdgWa{(c<zI>YgG5F8<>G6D<ifqfaw|*5^a^=mV^ab4A#hk~5mfYrYW_#$cKreXe
zek<+9;Jfa<A8z0OlU#IhXG3+2?Jcta$5#@EqKX@`A3SN)s#tZuYWJZdoZQoQgsfQX
zURk2y)V_G_j~TZ=%|BUu_V#46-0Jx5vTaKfY;D8-?f$m=-?Y{Z>yq*mGaf0$P1Nux
zoEz0#y5qK$rtFvJd~-vd#5(>kiOw(j>3i4e-p<x}-r<@)E9dMy+~>OcS((m~pes5Z
z{7&biRJc36YV!ow2E6#{7g{qpl;g2}ty|2o$D;GMp4@WvXaBa-skh%n>`viz{j+hh
zZ+}&pVC~keWlCq&j@oQ3I&%5X(z6+D9I-1BPud4hPO)A&>7`ed+1dT<VXK_(pIjiY
z?&z}S-!~682C9o+d%RONElxt-DBQ#Rsov@8EcM3|^v_1`3U%1N_Nt7jd!FiwQ!CA1
z+kBXqVj|ezCRpFrxx}qzYNfbd{G$u1`W$MhMJ4;5iv26jG(LQBX>*I8c>S5Wu#R8G
zJ6mp7{xIL*;~6tw@Gv){&h753kjXzUO`EFLd$q<mI^27z(!r@4mpuBC=a3`OE*sln
zJZHMm?6-;{xA}y!4UEzk|LCh(C!oFJ*|rp~30&7hO7E>c+AD5u$l1MH=SE31`z#6G
zaP8<Mo)ufZNBsG>W#PO%b67oXE;+~s?_*eeZko-#!%yB#<dvH);ccv({;Df$SBBds
zd67L|9se#}asR;jH@Z8lo!q6b1qFxA^w{;e`*?7d&3WU=xn5J!=a+o+3(9AEQ)9U;
z&4~46;^f}i=`0^QGx>}kPdU`c(Ub8t<ly6&`ejYpdGn$Z`NPs5O;1SNyQg;5X7jQS
zPm-%Er}JHPH_r`Lx;E>%@S9!RkG$7@P%h$l)Js)Z*e5}Abz)F|N1V;Cq|;~0%T83s
zlzyA{`}U4UEk5<nxcwY|UtMo*Inyn9;Zl}vw-$$0iT*FL&p6MXf0#$t*W*-Pm*{o7
z#@C$ex$jnm6kMrZpzzvSZ^6c6GFI|i)3=^7-ty37_M4-<W{-B?KGEcJTl<e<sr`lG
ztIHo)`>D8ZJt#X(Y2y4VJ$IP*6|L(OHdU46Hd*KGq`>N1Hm`>3BU4S`w`(yv&UOVB
z(=|QbR7}+IoF(Jlz3Fd(YQKl|N544}&O5F*-LqDm&)moGeaW}D0IoWVvM;{xC%WsT
zEK@oonmnQWZ>c)p4;z+P=i-zq*)SgYybI0Cu6rJs+PCTN8@62sPM%p(>^(WN;{Vak
z{W>}C=A3D|`l>o{%i`_&=l&&sd3LmXzrA;rlU2U!qvd;+Uh(mNbo<Mfr%mElbY*H&
z_RnOIIj&rC(N6g76Zu&u-z5Dv7W}!(HHCfS<(Wr!FP@_DGDYtGB2JH#mivmb?imx8
zw=aAtWwqzLdbvS?$%Hje;#1Gmakw#Lw3$k5_jR9DdalDiZ|e@Jv$JOxO1qpDi$2TC
zdi;k7GspMao9*|i?CblXKK+~dhi9c+HZfx7%cH(TJ?{Esa(_|#dIi%%Wv<gsJZQeV
zx+00iZRI_q$*<N1&azv>#u8o<d7$=!LVETlkK!A`o!&Rvb&KuSmV5|(8sRYO{gGNj
z122y)2NGNq4Ee6G^S2va^^~*WKAKjeII(S=;U@!6-L>l5Cq$krPbjlyaL;I+xanH9
z_m%7=@v6>?qXa{CPK^m?boFvwH*a&;v=+6~TYo*8b71=-$sCJkG0u99!VS~kRhL~=
zYf+9AxLN)9lk;k3XV0fxR~}@vKg#~Idf~+DPqqndE;!7cJ@<jnIR<yx^=2Q+Z>Bi%
zd=rxBa4Qx_6WX)=bCFs0rqI&TyIS^E-#zb`*d!S2-#s&MadoNYu2{p|`<`vhoYQx=
zB`I&sv_9cB>-L>h3>UR-Z@=p9GTE~8mEW1o?QS=oq-}NyX3Du6+v)BwX)kwXUYp{~
zO~Hqq)3;w$dDQSRAt-;@#2*Zvk8{i{jrP~CIg|gj$alY8%fG14RhwoOu8j&_xb6O;
z4VnoKQ_mhgCU5pcex<*S@{Pi4n+>!6zWK1a{^#5LNe;rVp1;kznCq3gY)XD+g5C+2
z?3RVrXSRnbfArRBRbIEsdgHE>iT^8??6R2M`r>Q1w$1A7`j?xlZH@iv9`3fi>2f<H
z<H7NkE3R$-ZJ*~%KH08VZFR-nY@x1U%aX0^CgO?44qA(prkFN<O7A|sm}NPO@9SxH
zdb)9O(=J!325v0k_f0eH2-v&t^OFTk<u4d~#SB8OHr{AW-<A2A;oT|E!)k{skIrmW
z^|uI(^|^I6<>Nd(HTj;CZ&s(Dj}GP0+~b@2>iJ%u%KH!aEjRcc;ceY|xZlk*G;m$i
ziCetoKH(GoZ~5^5-rLQY>sH51(z+b7eMxu6tLRH-cRqPFr^Ug9f9jS-llvD-V!Ecs
zS8^?HYv6j?DtL3p*J%qSk1b2`{kCe!EScm(f6pwNXXL*0>c$_R&nWooX$Ah9@4NP_
zAp3<zgNlE_b(XU(O8766$od#u_pvzIO7`<+-j8p2({@aqeJm#VgUD&w{IhfCm2Ldu
z^|s1jCr?n0sMvk)-#yu<D`$#aJbv7~K<&(2@l_2$7dB6Kj19cKO(^e_A)ohIlPeq6
zerUfhe(dmpjCPM4$Byh*H`$ID6tyWS?3=c9uZ0JDNa1Xy8M}Xn{M_4aXs|~pM9+|C
z{{jJz$=~)C7_oXfbV|(0coH}FUdi#_vo<vcde(-X5>gdB@#iDo;^Nm{PP1-nt-oQt
zUfy<-<(c2H|NiUNg<VWzU-617$J0&r<92D43~xPF*~m{4Eyc^DSPpLP2{SJ0^%hl6
ztEn`amngugcj;wQ;-2_W^9}#kYhC1$laZ;3pY&RE7w4%NIVGG^t<TJVWbc3dYj9b4
z;vthLBNdlx%R@wrx4#hC?(j%3voAZ$Kqcz-?5#3MoO<`%Usmjx(q}Mp_tKWdf>sHA
zZcaZk9F8*<CZzdsyu5P$iyhO#G}Za}Cnubj-?g+h`c7=wTK$Pm2fDuIaz>o5OzkW_
zb6I+Fx$l~&1B_)X(=xNA&beBY{+c$)K;I|o@A{>CzRi7`zbknm1CtR?SYhZnx7V}o
zKJ#(9->7*lx_{Qyh&}%v+m@e-Uw_)-!|dw3*(DJvjqYzMHyx|xU!-|-mGgClIZNiv
z>#H)j&i+kDn^E^nNNQx=-kHLjzw0(TxZ8)ld|n^3W<%Ya2rISJ7%L}VV+s4-JG{I8
zzgVoC*`F9Q;~(GgBPTzk$Z_7$x1YxMxp=wF8PD9}ty<6Y{$8rCo8YCEwRe$iXze1!
zc%R!*vT4`9z75YPUr>3J_n+cN!3&v7w&e01@6<nbRA^_leV#e5WIh9b(S-X^NBa++
zU9$eQ&5zmobGp0x3L~Am*X=9w|2*N_fqQ|TcP`cIygpEQV^5Imnn}+*4`=_>{dMci
z*NMVgEb~rk)X7zRcM9%g+PLGfxk1-?;e(R@*WR&s*t)r?di&!W2fX91HrMa2|5h;P
zu6_NF*pR(POg^8=>ve1CTs-kCkHv=B0#6%1uiE*hbjz(x2U))cUzp0+y<)<yyLXem
z)#YvduA9!fJy^9vP$D+q&#{a8pPjbmPTR~Cyy~mYf`30ZbHC><68X;|B0Gy=;@SQG
zo*ljU`hDD<+P|hgcN*TT{{H^{9*e){ObQC-X76xo?=EOuae9SaYvi2TYsWO!p84r{
zI_>tRA|-#%pB0vE=~LI5Ez{`lJ+AOyX6oFDyM#NVPp{wqDevdis*Fqh_qQEzo$vqi
zzCf4M{r~6t7aD~J+jgvV{ajQV>;Gm}2ye{ah~HBz8UEe<kRP#O_u5-gPXr9tJugmZ
zyu0ToW25K}rXcUsH%C6Gi-_LnWn^_<`HAa7PUf|oO@~whH23uzd$aLxyd7C;S;PPR
zWVH-af7>C0#pO1;>edu3tk6@=eek}5doEL}%cjbC0S#{o_<4=Od6+ix>Mh%L!2FKk
zS>Cz3ww&N-+j>4DSod?7gxaIFZ{o&(wy`;Ebu3_A8T5zk=f1q=4Ld&C)xO=LSU+ja
zu3qsr(KQpCO#+qYq{K1Dr!9Z`Y5oHtNz?A{YH_mv_s;&^`CF88^S{$qcPr~UPq{0%
zte)xr^79|&Z>Y_(tlAZ(R_X9?W17qx1Cgoo#flG{&Wh0WS~a=ASUL4fWsr0*+o~Cv
z_gn2gSqCSsm1n!`Cj4QWnXKm=hgW=;LrN^=VkE_`X@vE~X3T2N+?*_Ctn<V|ajEh$
z?TCPHC0CX_S@(r|(k+`a^M7h~OMBPuJ+6~(HP7UZw|}zd@ui`uEBS-N+?YLHdhaxU
zo9XR;cFMAs7pBIROSas&D6-Xdp~ddQHeaHpIc9|2cx@v6aI55GLAg-(w9RJ6bQ@<c
z@qD^rTZ(_giSB|+{STMf2<!<|6PU7BdEEo8qq|F|Zu0eUeSB-tN2ZvZ!v#F&Ras`8
zdgV5YU2x7ko1eG3F75ra-_OE!>UtxAQ*tYLdk*o+2G0qyjM}pB>iV1E$Ni)o^(#_4
z_AlIDzC&~6+<N(2-V^S>ExMffvmnwudo6?KjGQeMnt9S`n=}J&bDW;B;_P~>QpLCl
ziM^j#^JYz-zc~3nbGf@Rm#ae3d5_B_aXM=^u3D^Yzl+V`u6@fbwma;~7n8$REdTlO
zxP1TSaD^KQcN~MK70)(bG3U?uD@naN$?41G*m9%ZGrqs%@9J9JyX%p|RA(n~9hc=I
ze2iO6u0QxHaMkyE$7Q`Q$CsITf4AXq_R8JneobnB2n&PlqbC_=e?r|_ZXRDhXWGf<
zH!eg?wBjhy6*BF+B=;so)8<T0Q52Wrr>qS+dk%4?&B!^p!}sUqptZuM1k}TY_+wbN
zZCSLa^S~REpthOiK1StgalVzU+IdT3!ko+G%q$N#?kmw3T(Vk5=J|x2rMy>})IHO<
zC;hVj?HV`XadiV{QWW>eefzehc`az&pJ8Eh!*Sc!;=SULb5^lF_&L)l>rvYqKbAv!
z&v&QX`H&;KOZvu%%s0Za&;D;QH&s5dXwO|n=WlMUM@*l+lQI^5d7Jm9kG<WKjf(>9
z_|96k?Z``3IK0lvZ_<}1=RA)*YB5(#>oDjIE`PAIVb6&WYyWUpo7g#@7QQaZGk!eN
zv9@j1^|=c!=*PbFj@W(8@WI^bqpZdP%{r1|j(2RP^eXXQth*e!zxsaDUB{<Eq3^d`
zPD(p9kBj+@$mhK~E=fG?lG-TDTXp%u{DR*nmE{<#D!32NnC^FW{s!~>z&R0bGZy$4
z&ME%lw8*}1^X9Wpe}}}WKh3C|v-fFyT-^1m76I~}BGbJO6ua@?GhEclr7v+Rt>>6>
zbo156htI#sZo9-Xe>ThPWyWIWD)aMJoH6`<X5+u)6+aCBb5Bn`P<*kd@QEY;p2=O#
zKLhS1W@XGeT|cFK@1LSAYrO22C-wRJY?!cseV6=$?JG<?Tm!D2HeLGD%CDr}k71%&
zX`PqJOc~p%3zL=FW~c6am3URl(d5Vy$FwbMTF<8+Yj3>y#WBgA{aXG0&?VQBWp|XC
z>lHDs-Pc+z!<Hn>pSj=Sz3g<~)5pIu&6pHa{k>R$hh3v+p~knx{H&sX^<JE;=M-Pb
zaX2f#nI(vG26NCk^|{PRYJU#=H=7uIO+$c-DO#-if-I-8Z20tpK0gxomA<%>H{q+m
zjwjBGtkReK<Gnh0excZo?l-HKvQ^I5Yy4H?f^yd#wN)!KqIZ>rdKKR2_Y0c6cGu5+
zbEbdx7PfX0T$iE0Uo}2FocnG1s(orgZtMRWZ;46V=p^FM^E|WRIBS|<I)}uL<%|;Y
zP3r&D_qoq@*X;e%J^Nw(m3Qq~ebYD3mssnz+Ryn#bM}j}BPtEPEcM%VzggY-?{QLF
z<oeW&4h_o7g?6$?Z!6Wyk~k#dJdaVm;c4^z4O>Jd7iYzOx_4ud#$wT`Gka}ner=1p
zBIm)?K5bG1i^w-I{d+bxT+6;F6?<5g%c!j~U8Bv^#9bpT@Xm;(XvGZ<rGRTIwiyL;
zEKP~@a(NS-cjoB-E1y5!6=iKQu+0%lY}MVjX_KD%!A%eNSFZ7u_bF(1&<lIbc3s+|
z@FEB6H|fBv9Yyzg!mk#^>U~;k`~Q-P)w`#UkLbiKSk|>c>bdxwz&xgo)$S2%o+bCR
zEecfATVAs#=G`4mle@QkXV2d}JNskdFKyp4o4DFPQ`Jw!zA-p?IzHRozHk2jvgv{c
z;^*hH$UNA#E?|aS{ns})jekAe{^RuF=W*}X?c3%r{bb{L+qXa8R`7829X=3$`f1Uh
z?6X!kuYU8?Kb5gQ+L`%Hcw0)R^tF!o7O4v58?&_g=bZ52UVP?(zi@c#-(TJmPYurR
zyYg1~EHjt?^Yb}}1V3*)ccF2a=*lf`gj{y1)QHSXc{5KizT-^)tp4L}1{qy#`<%XU
zDKEOXm^XI$$)_2|^EjNYbiaCLa`pgk4%hO8s*|kW_w$xKI&!#g%J%-vmufh73*0Tz
zbdP`7e3|XmG`SximDj!dR&har-=X{Erqub%f7Tj2YFG4P7VP=<V{h0A26eW$CwYf0
z18SaJV9Ktls9hp<BHQ7m`6V6RPTn6b=|u+T54nC`D3^Bl=@TR4d(~<S=JxPRx!PdN
zJmZ5uk5Su8#?xk<Y~mjeg^8(um3F^tC3}$3(JtWe$0wUIjyk=&*uQxF4iEOJR*^mi
zi2_}EQ;slutETVGir_Q6?czJ*zC6o?Yf}y~Ci^CsX2eV1xnRxnYqg=PZY`I7vGl?B
z4dK2Fyv14pyp<Ut>pw;a*G&FCL)fga{@TmJ%_|HnOK!FtNKlj#c(Yl~ec=HMgH`j6
zUHb04JW6xR8cm&$CVhE>)80F8z1%MGQ}?6XR>Ax~p22qBg#`yTGD~}>#Vts%S8V;c
z*0%6mnd~y1kFEb7tX<)wx7t<i;?<Cwd^tO2-_iHq#Bge(=y!gGYmF~b)^vzHt!=6A
zKFgEpuN7zf$z<!XBZALz_etE)negPD+jl>u{^F9blSPfGbtf#f_CLQbf2GaWODx65
zPRZW-puAbJ!2ji|SH<|GmG9bkS|R7^9<QV;k3ZU8E<DR)F7!oRUbcqUfS;+m#eeSC
zuF5(gK8an4Gw#<LuwPR7&0E=%lzVvI%;3VC_G`?}CqDgd;<s(Cx6!PrS0-^fdNcfU
zF>*{c+Z?&k?U}M=!1=OA{+36SYGvd%%CK|@9pR8)GVPFm^QPNQGnnR0sh!9eQ0KdU
z{@TgkpFf{k%YXX9vWXf?HMxa0Tq{2CwsX_nIp?1DoLtdazkk*BuRETVp4r>l5^jFg
zWzt+G;mXLf2HVXuGnx9?=DwQ!DJIG5%f?G9TIEyPLbG{n+`YD~n^kbru`5MbLF{(Z
zw>jR6Ztv)5zPcq_E&ifI+1(9~Ki2M+w^!&(5O1C~{cC3U?6A#lb?eWrdOAJk_wLl!
z`&Xu(USXxV_dO?rr1*i@=N-L24?NaiGI4AFpR==P+4bwm=vG_5h`c>x>E;a^*3X}t
z>2>Ns;v%bPchR$(H~B2BIe5%{#k?i=a~8HdKmYIL_VZ4DmS_Fvc|5XScW29v*S&AI
z=t}$dpZlzwvfB91d4v0_r-_HISnRiViGfMO?<*TZE=ql3IzKDbQDRfFl3>F9g!0w1
zlKIqKi_d26x9s0?*)C<W?@7<Hw5xk2aV<I^@u1*X?8=<O_x3$kP<)ec?updrNo%A;
z#Ai49Et8tgo^@ATZTk*O&HX#`{p)Lf|B{$C`{(4Q%~|@d7N_~9IxJBVUaJ^-@z{|^
z>*{itl%Cyf<?mhjY}<k;^C!XP_tso^UsWc)e9O|UMnX~5Stg&2H-20&=T2pX)=~Ai
z$m9Ft@`TSbY?>R-v*<=&Y<-2i_=X<yT}$%CTVMW|II-gY{`w2`>OuV7>$_I-Cvlf#
zWWO*!p)x5)B;3sPo>ak9t@Dcy#3h&|e3`lB+ERmqFBG4*erD!1oT<?9?X1+=Eg!TG
zB#0*LUG$_eurraBFH|LYmD#DCoSc77zpr1gW=2{}#_YUzVy_=9*7Q7et4T85`_hM1
zrW0r1-(PbwYG!0?{evlo0|QImnHkHz2x)9Db8WjR|0?=SUB)HHM{6$LzFPC_let)g
z%e}Nzoi8hrUUGcSd?fScRPx6i{9?B@tueGU(zY%1{W9t7gFglT()!;-=pK4os>;c!
zS%2mc->u!3OIJ83zCFI@?EQT|>N9(v%_ztTTG!1Lo)&80zv!J=_?+ugFD-n{q`<TO
z`sbSu-+sL-xahdx-eyLbv+w(!9J6!!Roc?ERr%S<{)*tfH_K!`E|dAVN#vK@?~v-%
z%eUS+{$$tJcUO9&^7n6xDS8%giC1jS>6UFLX3sHBS`$^WX};GV;aHL1(Vkz-J)1k;
zoSWV_?Qh^VzUUP1pjRdbr1Yk%SwC^u!&H*<A-eAU6~~D?s{enue$8m->eQ62z8~2C
z=&j#!DN|fkpr-Ug_Dj*wkB>d3bM%)!oAh@||F1u7U57rLS$0|}c)4!OR#~%qG7nFD
zXquJ3M9uSOp$+q_n#o#c=UQdGbiTHz&Q~VQ>cq)Am(-SSu|C6ZT`ppC^I^sIPxtjZ
zzowO0Gn{6<8o6`!uKNG&mp?p8;hQkuZo_5E53g#}yld6NF05@k#&WBx@Z6uKHJ|>i
z(zoxFuSv_AoqO`;+a#Wu84<c&eiQa?7JIrYxckse{aW2q3(wy9`{;|io`;DW@6ETR
zCyzEdctkex)Fun5+{)%KV_`c#$2qW;C9^6es?C!3|GH&A^OrBn3<&RH+qvxzW8LSQ
zRo9;>C^IbP3;!(2u{xet<!YIw_Q~$eTp<&b8M{~cPLN&kVdaUIXH)G3{Ni%%wOaBt
ztv0uvuA!WGX!XPW3lF!vX3aL}tW5m*kZW3LRIF#v9R|)lQ&xn`J-BPet+xO2;V1rX
z6-miZmo4t?*uVP3za*_q=M{pg+H>VQFHN76w5uf2<iP9M$+l7YhEaz5>(yfI59Ghm
zVcu^rquoY@Cn)EF(?-K1^CRty7#F<zH*vQ^YpFMTT%f5={H2g3X5H?Gk^?q28;87F
zS+m$7=2e<Y`!TM>b0MqEmx}SGZryPBgL(2Q)*$=SYw9QGUyD$vn$X+i#T~`*#XfS%
zb}gGJ$yS+Z%*?z?B2JdSs@Du$IQuD!U-El7wZfhYa=$Llnq~IKRYWms*59j7!>bP-
z`J}z~(_FQrH@q_nb7$u$o(Y`z{Arq5^)LVP|07pjSWxCYeZtRaKPKM}3Vrp2OR;G8
zy3>|b;!`5eU$%Pi@lE&YOKa^;yqT!6Q%6VS|KokH<Rh7Gv#&}yEyR6bvsi!5-zCQ$
zM?IOjI#1PqO0n4S^^1?ZIw&B=w2<NY^WvW?IF6=P2J4#1UtO?IQ`$&e+1V%|yeH;W
z#r7Z3X?sQ3MS9mwdZa78a%zUjS>Br;v-Ngn-nA@gExN=Zp0#i~>)ot0fko$!>ht~i
zD0?7ub5gGMYZuk2yZP>`A6={e|4ZE7%FF({*_Rx$ob&6nt#_pn+nvyk;I<=2rZ+0*
z|C2f$&dC4c?r!-w`Q*&$yr~ukKH8ZY8XfaK^zl}NAN%&yShH)BeuRiu+MkJ&6Po>~
zb=I4V^FF%M_oqz0sZ%jEVtVZQL))f)=L$H`!WMC?Zo=HVVZjd!H|k8P@=i=)vzGiW
zbB^`LdanE09QTvV3f8n8DKeYhTA3BFn{&IMsY-e8{@(dPFOOIqk$b=Ensw$be%IuM
zYuz9Ha8(yQE5Ts-YhCVp$!9C~PneoMjj`bH1?ySIW*_-4QpV8|a(<q=zW6Jl<7;ef
zDsLOSy?Af$zi0X7PycDZIrq5i+5WfdWRfoWPFQ#0SVc;RWZ_M#dk3Z%mEI2P^xROr
zJ!;ze(!(+r5@Vhf?*A+z(X!~}f^^Hf%iIpS928peQ}A~6q#qWwAyNH%YfIcK#3eM|
znmf0%z7~Ez+kfGump^*>l=kxGG9+;2@@<y$aB_G5@Mnc)V14zGV5>%cpH}vX+)ZbE
z#BMG~wV3u-(09Tar>jO=y*?;C+*apyR^skujo05ls^%tWKl=Ay<m08I_pLO#51rio
zLiLlUMDOQ!IS;&jlPA}BXPI5PUHOswgUiCG^5bVW_(|IHWh(SXo%Fw}Yu$02|6y^?
zvb9;?Id|W@@-S@HuQK7udHuHB&4(h>{vW#iuCSP2{P*N#31Sx{wQrekV05vP|M&do
zhx*u<l)Vq@Clwg~i9Zr@B`F}|<E~rTlYXq0^>0c3{lK>GhcWMohyU|D{>QE@t9`)s
zC6eEvhI`ABz%4rt?ss8`xz;AeAl4kzr?zl&*Suc6n-5k>3x5w>bpM9UlplI`*=P1$
z5MQ_>dHrs09Um9I=w%aJ4QKAyAhbrI*-Lke%ENZ%Siw&dJU^e(Jl8ulZ)4oupQkTA
zEMNR=zbb=a?$$1&SHG={-h8^w*LwM+fxK^-vY2k^<)18Gl_%NLt{zB?yY;-$<dJay
z+=Vywohk%vjh3HaUAt?ew%yv+oR^^iOa~e+ToM;r5vHZ}UueR=7@>7x$yfGH@P65S
zc30eW4VFn8yZYFs{?N12sPSuv%F)Q|FF3dCv-fLN>D`L%-fz}3CFkqQKZ}#(c;{=e
z_|;v>{&#G3isuw_S)MnY)V-E(J?#L~ynA16h{!E)U|7m4c<7u`$p?d_+_DB8^@>aH
z39@dG*xt|la%una+n=rFSeOHk|2Fs?e02fSmz=#bL$=;H(9glEz3SUb_H!q{ZVFCP
z`SWx4@!N}S?g=ru?mjJTE*G)bGBW%1N5MH8L;r4n|4%F;cFJ#Q-{%PvWIr6aA$-pF
z?d6z<J?W0C<>#!~yEpv59RHv16$!TGTlk~7YrFkb3f;wzW$!+_N4`p-<Drq)NvXKV
zqWq=d->>XGAbQ@_JI>TAqspx2-<z8sZXUQ5z&%&_vwVs7j;J@fP0HO3OYBZp&2E)F
z{{O<U1p;k<f1RoLenHcRr)_4-Tn2mY62YpeDaVdSPrKoNuXe`X0`AncTQ8sOnVVg3
zOhx;%gs!Xfq4W={W@$MbE9m+8vnFlf_6tg>^ABaKwVcb?ZN^-FCqm(NXEuA$rV2p=
z!`I!XvzB}4uF#fUvGLzcpL4C7HeOm4wLp<S&1QXrO!_pzgI5*1EwZ<ZXcRBf_}%$<
z`hJVRKkss1@~x}#d3=e{T*}(oaFUkE`cpevFMbkB-gD)wV`lVC;cKgx{P=rhvA&;`
z`0TXBYj4e4kj=dyvf|05cPYaB({h)%dfax5$~rc`v@mtEZs&b&8>fdt!L!!vxRE8t
ze>?Tv`=hb!6Msa=d|!3nKmT^{{{?wB`+ju!``PGrCU5g`7gCN1GFjbfu+z-uTA9)1
zy=x|aS{B0AQ{WhFBeTa>Mnz3-U2(yTx2BteRnBbfYq@F6$B>coLhn#z*Q}g4vF@#_
zf)0fg8?8=!B@tYH)-qZATJi${4i1y>%n1yvZE-Ug)E~dEG-SS8$fU3{r&~DT;WAyH
zhClX~8yQOqKh`{ZDzPlc^h}0pAd^<)+xv%E{_Sq%Tu|JvcvO$KQY-ji^q0+#OLk{C
zoj-5V<jJVLYr5yJ{hvehSxiqvE_l~){{F_@*^Af7zkVg>*(Y1^sOCYrU$I}8K~n#O
zm<V2};yv75SIkd#N7_Bel9<xlY$0jS^k71Vh^fePl|5G<l)QNqqWSOL|6l(9e}yiv
zTfcEqcaPR0hWb$bki};W`&Rtf{=WNE$oJV*wSSLoXxwYu<x|-lE_F>`+qdqx%g$o9
zk~i+<yedE5-teD$IV`00&Gn~Vv+w9!<omO?)nLBI{)66qJFF+(Yo0DP{jBaeg)7~*
zui`FW^8Z}_`P$nEE4!V?*H>rx{B8fQsQm5T#mWB;zyD;i??Yu_a)4p6+{LU|m+f7i
z6CHS+3X^X$Tx!|H@T+_Mi)-eywcU3ut8~|A|E{Yq&vzqvhtj%74ea$3bYpa$GA=!p
zyr%Bt&Yk--Cmf!lnx{Q;SzNJIZ!Ooh_z%y2MIBpJQx?8_bJAWt@wiO}3u-=ditjpn
zrtfiz?Y(V6>CC-6HMK=&7tP;O%bB)-q1^9St{#tIANRD=jklMu*RO2y7k&0{f@MvR
z`96`n<a&XW6;+`-(~qxJbv)a^bKTZ&hxo6Cf(f}ZCkLyZJ+`s&k8su9jd^o@WY>Q#
ztX^sLr!r@!Rm2x&$Ft2YuD+U)=6S0F)S2(D^pgEobIz-jC;xj^>5t31_C{-6Yb|(l
zE%{S$oNV!d?T;MJTTA{**s?75d(q#Tu$G=|o#W0ww&_fm`+MCU*+t2E8$=sI_U^E=
zn4cWS7JZuKs?7Pe{YQ1)9!$OSsBqGp*AsSb)0IBx6X{TJ_uQ&Q=N~V4@!5i-+iR!#
zZ*Ft%@QQnO^D_Lu86BQ+fAep{*|B#%9(^5n#-MVE*@nlP#FyN%-KV;-bl!8xe^U#U
zyLtn7J$1$2TE~~!FVKB-skS?=&`p=2B;#bH<i`{F&pumw3Hc>nGLsOR%EXd+()60q
z6~TlIRW`qS3pR^=@E210viVle*7ECL>doF=-XQR3n`>03A@A)C|DBCv<!TPC5-CjM
z(`|H>$q(yY>6oF!a(`_@Jln_ZG4tKSzZ`f{v2CYF!|4MmTtcfSCQLAV9T*YnAC#~&
zMDx(LXt#~oJc8n{rP|B7ug$Yde6=>XTX5s_MO_{J%x5pm3_2Bc{_yVEr<O^sj(O4k
zRj;vB`{KG#!Q^{c+w?Cc)u*!kJ+aWws5A58?1=RRADbtA(G9A$UhVm(uqbj4TgLp4
zu4@+dd@>bNk~yq#zm)Ct@5!06<wZvx-FYhB**p8M^CL;|)Tb#a6-pcKt(X%#>1VY4
z&OOFLbKA3ito6J;;nwe@&hKxp*)3Uh`&!w;CyQm$-`sn6Y)|yuz|M``eH$yMuD;z+
zd8uJ}@SYb<ya79>Wm~;=`&E#;KJwnbpIco19-Veo`0CkpZ{1vU_mp<3E-@E<pdF^;
z93eipJL$l=*PfE0*45nn<v+?|W0tl*(Jj8Nv1ie-vt@7ekI8#2i`&-yN4joCc~Zk!
zKL0Nwn!n%2dc6P39RIX+=b2WoXPg1Gxjerf-d$ZD62Q7cI5dafvfHxiVx`rmhw}I4
z{+&>$Ht}rNr8;SkY7O7YOrZ(2vKhOjLe26gEU<Irm0NgJY3=tX=XdPUuROO%`Ge|-
zFWGl|wd!yFP~*z<sO#3Vs7*PvP1@nZ$6eyRvwvj1t2{E5%U$SdUde$bk-rt^o{RrY
z*rNEeCDFaVLA8H=>q8SY;i>Gg96DUv{zQM6^-^o!v-^Lp&zdvK^!q%<%WF2za0~KX
zVtVmTU%B<McU;?yo``64xZmtFzkau6a?;K<zFH6K9|wBdEd29qKby<B6{ocPEM2P)
zX9eDSn|SS9{fsD^C6_Nq{r?!RF)Mq)OLxtPS@RYJ@A_qYcS7%e<;R*U<-T8e&wPgI
z>Sc9Zm(19&ETz^z^cQA4sFHivuzGsoqL+)y{`}c|I=}6eoWJlPCz)eu+(mjluSMUP
zcX%A!QtQ>9$9}JQ|ANZHdvh+Id+k4MhN{rU2M_MQn{S)){k(kN=HKh(>clIXXD++N
zz|S(bW#UDSI%V#^84EVe_X%)a;2)@<>v>G9_J@#M{2nPeYmuF`3;82m<bvk^C}|8*
z3cjfrW>EcP+5LNGtgF2CXMfrFtLo;W8FyVLE-^M=9%{8DgH!AMyX9tIe|20@_+fU#
z`uWl0+dFUj<O>IGxqDLPLFoRC`|JIajK3J|X13ZU7q5NYEzontt6lTfDQ#X-xX`%g
z#Kh@ByX~bLKR$Q-wmI?q!}1#^=bvT!=TkRJ=K%ZFl^)96dwAz@`h`sjn*M-)W#y`4
zJ5EmApTAS>+nc}L^8Xfmp7X$Z&5Q2$Yi_?<ZJsZ(C7+R%y~8Kss*6#M{`+g!8Co@E
z^-rzQQ=2j6(b5~GPcygvXt<?l&K)K6hH>I|zRR}U_GUhLr<PjgS?BA;&bL}A<@BM*
zPSvBaeuJ8Y*{dCo9eiu%hV?v~-t$~opLLh5qn(QX(K~EjMLNDt*RTBuIAZ5H{o}^2
z%*0zYZw+<Cn3mr)zkX`kn#I4i@o{~*aO8I0^0!Hm>ERsfHe07?PO7`IQ}FI5U0Z?R
zN2Q86PA0u6Ug>8eek3HBzn?PEI>pCEz$s*xxJe@C7OgpEXZ_p5)NP$4JMC>I`v{#q
z?wfSb#&;4E&;5(+$6vPTmYueJ=gA-U$Yd7dmivjzTyMABE?bs+s!BK5TYT#LXeFtr
zFOFxoi3-<F*Ya=kXj_qI8h`4qyFko554(&a+e@(zre_+&d+@|PC|Y_<nkDIcSC$}4
z&a6#yZNG}ju+4w5DrkA&g5|7IN6)a92pqJwf4F{sW#PA9yT$Y4>*w<8{MlFa|KHi}
z%kO=duXnyxG}BqQeI`@3;Po|PR-3anBsSk|UU#mitMNup>)rmjX6q05`#9}15Yyh6
zmU%pES#;CFKkeQ>UffsCIIxV(`N^ymJ!SgxVpAGKiYGtVFVt$9BL8Qh#Y6Vz;k(by
zN{{o{U9sWiyzr+Jil=@F`{{pS#rMk}mY<ydxBf?ck?|W@tBL82%u%!F=NGXmeH8tB
zcfR`WZ<}|io_g9Uy+BXU)u*G@*tE-#Y5n45v!@n>UP?&&f93m3-@SeHmW)5Ap8a^s
z<Y|^{NV_SsT+03hd9AUt*Q$BeEYVq$Jnx<1TKnMge2ysx_$&01T=PGc{8+tIIc(P1
zEv7~>Yj6C#__;e{t9h`ncu{`9RHMiLpK`fK+(>f${%*E-!Jm&|?)$7b*WCTIBUtBJ
zYx|Sin=bz@l3<@P^KEpuMevCtp~tM@{qf6GbnR-|f`vWL9@}nopmE{6Wl<X^?NpC4
z{kZY%vlE{t+&^{uhSu4<RdVH=<_tph3rfuxxB{y4Y~8izyfkcMD!6$jL-Z5J3qNkx
z0@F^(-dQ2nn|nm=SG_2iSR20Hzc<>+vT|?KRc+qvpmRwPznL5bm9ND=JQ{KH_q7>X
zwkEq)pNc&6^H9&x*`^DYeoJU=?GrOO6!X-w)9+@|g#M)g#Y}Yp;yY687xDLI&hRm1
zxRa)|bk5b+zq&Lm=dZZD^|@M*iN{Qr%Ten+svQ?;RCcoKNzeN_fA_uHf9_{p`JX-G
z&-d<Q3*_%vZ#%oC_n5^^`Pp-QO*gSw8(!LaSTeBYkeKqWkEM;NEv2i%Z@nly^*-+4
z)QP`LGBrNd9E$1P{q6ns9Up$NO@HAN`(n*!GY>}Ly4m&}R!MGud<#Rr{W`vF>S>O=
z!&Bbvb$qt)td_ms%)nyiIoG6b?O1nqc5=SAT+@5u=n3-6&D4JQ>6_Lp_+O%XSLgeN
zj$52BDkfDh>!u`|r&u#wW4mKoafDk!WOn!eOEo@bcAQS%rCv;K^_lg{`09p_qRdh9
z4Qr<JdMCAd%(07md5CFtQi`DR+N|xD8hxdXrX<byu=2m9$B(n8H1*aTkWcA#FO!lk
zES|6EaiZyIPD_A4kKx5%0n398ymmA;v|i09WVtHLG1p?D@hbP5ljDBJ%6QGL<CYM;
zSDhHPk1d2XC+>dcvm)k<yIM1sJk_%;nD^?-jK61v=M}_iu{$KiFS{RqK0x~EmSYdj
zuSmU+eqhC#S6k|t<XS#!D%IUxwriIj_nI`pjT@e{J=1*Y6Kp?8IqdvF#Y<T{yQFMN
zf;U`9o&MlUfR)69?b{?O@2VGU%`pCRSfDeVYenMfefM>o<d5g|AG?}%@znW}P5QCx
zn&<jeRPVgp`n}{z=<&C|wjVCGz0`Q-#(vJ8Z_mEY>0fvHm`Y7Uq>ov0w9&$dwW~Ef
zl23&{o+#&b|If!SXSLridsE<Y@{iV`m2KC~s_waKcXGZ;k)DSL#|A&uhXrqfE^l}n
zU)}QVuWKz!P3rY?{}_LNT=`q#>bEUITYmJ+f1kn5<x%$N_1>PE&KtLEdm;)?&A-c&
zx$o<-Ca>0oFHIb;oR~ZPg39U#DvLZ86<QlCbeb>9cfUA_|B}g<qU!T9+S`>yEg}Qv
zi<ot~Zn_wlpV9lvwQT3kQ}(^nn|{AK5K}fK#C@H$^@1y^?l*PHc0RlHe)b)S=iBdS
zT~yt4dG5p$n<XctiTK!PYI?4*ZMx&MahK=S=Zk{EE`EN0H0yfQoc$uJuklEK$Xm|)
z=3aMfaM%YwmRUmgkJ^N`p8xLB7Zkc=s&?lb*0+0(-m}zrvD|d#>-!O`PM6P}YMCpR
zZ#2guIm+(O(jA(IxC&cN<R<1d%r;v3W?!Yju^CFv4ijT17(Kk{IPs&yooSPlKRX{^
zu)LP-Tbq#2hF72K-u9lkvX^ts**!sqZfY8pIUc3=Be!Z@-Loq9*r!Q<I{(RDKl&r<
z>DyTX<*EtW60LT{1us4O!H#!^{hhXn0US>~I{eQS-+J?)*^;BrXGT-bf_JR9HXNE5
zY`?l_dx<e)%KzJQzIrgaKdXBGDX?hmH{<35pX7f0y;=JD)j2b-n(XJ3OLV%fFImja
zeX7*?M!VqzIsav;GsQR0JXGT5mf5pu(&ouO4|dOwsGK!tRl(iB7>{+gD>7X>i`R2J
z)ZzFrx0P|<oFoHJQ$3T4w25;LEoFQ-zsexCy8Uk5gfza-i$4mz{gt~w$<^sZ?*FHs
zPd>Pszxl)g`4865`hH4fbACLj`Tupxj?Z;U3nu%96q=|%o9394puFTE4?iDYT*1FZ
zNz<;LX0ou^xjUs}&erZXc_A7XUVGn&_}B2jadn#Sbx~Etg8{QlpDoJ1a4BSg!M~5^
zreupQRlQUBx#?_Z)1x!D1#Ldg{jRiVb!lI2*j3(VDX~|J-yL0I;ou?BqcmM|xl3w)
z=(!9R_kxUN?>C2ge29BA>)*<VnI0DQmr8Zl)LBhBV*J!FPt#xG?3SBV2cxR|p1cmU
zX;=JP^m3(n?yW0t58X1^f8AhZ-Jzd*cg>X3`xLt)ooU+t=$1}}cl8^YI{3x+pSE3B
zsjIzg*Q@%j11~%q|9EQX8++c;+k8qY!|0ob`Z<Lo)tl}s1eD#lAFAB)sQ&ZoE3bXa
z?!+~kTekRr%F29wndx=@excoW=df06pMUj!?V4{NH~tFwzv^%8mDJBo{Izp_e65{1
zX@T5EpNm3)3X8mb?^xZAzgX@WW_8uM;9mV)0Y+D5Az6)Z=}tqpe}6>{LiTp(8zu98
z(F(b=aE2#CzQCQklUg0KRe9`RoL%emaDI_6&mn<7Q_dc1pWagZ(Aq}Y+iUth<p~UT
zS>%l?UR*!lSN8v*#cs|kyUm+(dJBHbOzW(_oZuPs!{ETT?u3W!FZkIkz8=VX`b(6V
z)A!GdXHVSEzn@)s;i<rrI-A@@A`7y0<^{|)+n?U(k-J9WNPua;ACG=5P8RuXJf~xF
zy`(jcXP?jYnQ!{;{hTc#5llk=<N_9~kvi1=>D*%7<rN**zpi>LHJx{v{_i;~KZVw<
zNsV2fHm9=w&>XwK*gI1<InL#kK4~n{ukxrYHvMr`CA-2BlkFFp5~mAX_2YGVy4*YQ
zMd|_vHv0;TO|ReYeRxJlPouM%^ONMKPZA4{6z!Y2>ge5Rxk@?hlb^lPoAl`5zM0oH
zN7h<ry?b_~e9JSRo54kfUKVoo?rXP94V*l8`>v!Vck}hESRWbB^Zz|fO7omfN!9#4
zxxR1D>q&pe)OJ7p$@P%)(S5wV5p#b9Z|0r!dh(Gy%yz!UpXUj61Twj3uJX+MyF{yU
zZ&q7mjEKd@$;l_QpD{JOzjkQz!u^^Pi*~P@VzDKey<S85$uINM$rrV!EWRyTwR_E;
z%MSYM)u#JAtju0r$;opiW8ciR+6k*aa4#t2VcW|VB*%V<bN4G#=^ZIG{ioIanO?u1
z)+4>|@w@FI7R%1$)M{<xxOVwX_Um2Vmf}ZErze`fF~77SSnsvl40Q)N`On-6J|D9U
zek{DSMsiQsK9+Mc1XdkkuFgDl@6>~%k5^nw^uKugEvLA!*;fN6{j0i9zj4bvvHrz>
z^P1U&WBGYOhrXJu7kkPf5s?xzTUXfUiP6{T>R*(zjaBz6Jmg)$COvuiPkHea29sCX
z%Wi!?E54dN@apNQo_7tSlGc><&yC?dTBO;t^Ri2<%cbU9>l>~wzjE7s5|=<Lca>#}
zv6k)n@bWya=?q-mYZ`5Q{_a-dvi#~j-A~WY-*H-@Wya()Q#_utH2D@bPdBYUcj<70
zTKlBc7Zw&hJF@b0%FfavgQ=%p|2uUg@XE6r(@&e`zAXRxEBeeWui1iak}NMDEdN<<
z8pBnPrT?}j@^*yD&ApL)H_Vkvw*(p-+{7+y{mhc@&9)u3#oG@mCK&2Yj$V4YC?;Xo
z#M?pB?!`+i;9R|F#s{X}RNV!;pBQb-+w^p4n&6(;<tYIXvmM`m*A+Y7=;_~l!%yl_
z!KRt|g_jI&?|blwX)4#c!s8klV*da11H748L>L$tI2d?VevP<0>163@Ed~a!`3wwV
z3=9mpsm1wuNuYaJ^^^09Qd1I367>oy-`2h@dTh4s!T&n0WB(jqx+UFy=d&$3be`1q
zw|+66+jsA>-C2CPuuy|@l0@*5wk1!#Rn%t3C(9?sC(EbKPdU%dz@(sYdhVUO(b2D0
zmE;InFz}r-=i~d{d|v+iKeIoUb36739qwLv;&sWit|E~+YbKp^;^|-1EdKjo=Ehz6
zmwzte>*M2#=k4d~+sD05OsPVDl@kB5B;`#>TU*XK>P}jE^<n)#{ujk6zhj<kJ@FuQ
zr`D+@e%*hLc1K3)G+WGD`?^%~k%h<f59|0Q+306w1?{a+obSu9;*G${veRp3@HZtL
z)qQ$6)N1Eh7Mpc!2dn1#UH$xO-=lY#x~Fz&Z1QTHsWZvsdHL!kaVak&_WtC!{EMUi
z$I~Szj0_hZ3~4@Hq~&F3>#hD(!Q+^4o`vtLlu4?gswK{UJ=P|6-Y{-^wU^^Td%>?V
zTl@b;f?L)&e%?_jwx|8AXK~>!jfBr^2i*ftso&Z2^S95LNu^=xkA3#-QsJ=g{N4EH
z>#I6efmOSFK37f)b71^_XVOQBbXTL=i`O@&ZP;ugob_n=>6hm}ypXl|HDk(Djjz*G
zL)X^pKG&{U`A_U;)k^cUiJkhd`hV523OBAhD0*NfYxu>h`)h6b{p)S)|Gs>5m|uC8
z)Y;bPV~@OfpJcx~d3@6f?i<?MS60<eVpe=vK5NFZB-Nq^jh<RskH0R7SeKBQdiBq;
za6NgREBW(XSWn2Y%)hqtSLi;=*p8ELe<x}2oOsso!JT)>Qib@xLi0PX9-VnH>dEXa
zIz^9+Z@$`7nPO7H$!-2@(;pw{oORhV?{uxu6IRf=Wwv+K_YaRme*U*vf4X|HHy2OL
zI<Fa-mVR2k4D+uiJN(Qys9n4^#p~*`^#%-=r5DeOQ2epSqoLC8{``-tS1sSR&i+x_
zkImb+fA>7FLR4pRic`Ru2GQxKRpzrv2Fw#;urcyp>UHJyRfbtlH<$4F*j#w9;kw8R
zn=Cg8Mkb*LwQ(&iW=fLbYUPYYuFq$DE>SKLzm#IxyD@Z4V&!k4d&?OYY;DLiU1NFa
z!w2>V;|R6YQ*YUIPEPyv_ToAv5s&L^>zOA=-(9%%!i)5XM_aF^1&M`<D$oCY|M><{
z>4%vK9+Godx~4yni27sNu715J?Lv`2OA%9`v&;v%9iP?qG;W`yR_A#%_Qd0T@skyr
zSvyyzvoy)Pa&5ouuFw&?pkmW5>+L^c#FujHH4dKCaAQsdyMpkN)nB!QufO`g<()=X
zUWPlHSUw+<zjk=dhl1Y@{=pM&DTGFbG#+><HLGE(!s*&u?iV#ywa&OS-(ceDPj72=
zwL+@c)K=V=h+h!b`{C{Rm%0acZ=4^X%)+0>aE`;{`}RdW<_czl=^stzo^`qTnqA?x
z<NIgDB4<A7{);-uG)<{$BR_-PvegSj{zoi7@W*kl$EydIGg-UE9BREA&y;9CsN_<S
zk#lLk=osS1=ltSF8E+TMj`E->7fM5)1hf2g=JKChIf2`dwZhdvY?FNH<jD=8?d=!m
zFKQOJ-e9D_F3Nnnb;<HHsXMwXf0Q$fG$kDcxA;2V3q2?`Q!3KxbeHwf91Dd5lTUMc
zcw}eP+u8LTxR$iyHJ5rd$LFfgYFzg^S#lTiKhoQw{b>W=yGfJU*)#5#aHieiQ1y)T
zxh^cE<;bnp?Z)|&b-hO3G~IgVwb}cb?;5Xtcd6<k_rmlW=|5ApcTV2qGvVEwbyu~#
zvtNjRv$l@q=g${--SF|9n!7p6?l%Xes$+eB9o&9!VZH*3eCx%0*ICup&9$GCw9*d7
zT=^(tqI*G8+V5k<+_d17NfK8XF1-D4eu+TG7xzh>b<yD&_C41R9Qk4|B6Ir7{3I)d
z+Tbpq1&8K{rcMwq-*kP(3K5QFQ6jH%x~3Slt-Pxot98`XC0zehl5IRo=tdDnf#jJU
zqD&VyE6opo8NzZ{(N|^z@117mhIw(!D>WpSi92n!mtowMaB)q0r$Jp}%O3yLsX_i?
zw{E?;d2IQezXm+_m0T_?Red$-liY;q+y-wNe@qBd*}9U~;o6CdO-y?mvlppNHvOP}
z!+4Y60hJp&gbU|9%alF7*DJ+X!0=|s+Z!FO%ip}VQGIjdbe3QJ<8AF*Qsuj1OtQ8{
ztq)*xt(p*-ZOFaB;W$%7`s-D4J(adiX&Xege>LWQFZMF!;c@1ZTGHYNn>Qagp27Vk
ze|GEl*`Z9&l#-hocpvNUo@p#$QaUdq$}%|YwXLRf$V}TU&lVT|aKD*5J=}g?J(B|a
zo4!9^oNKCnKD>LB|HF$3qR)O$o`3G)dgZ+T;!S%+zAl=PCFD@7=hpSscN3RnHfzy6
zqgk_ee$Z>5ce3^Dw)gDnp&M9K&qe9aXui#U+TZKObf#;OO!5mCG2T`@?cwX8JJDzP
zhu=&#w!GXeDn6=8CmU{QSg=J!-#s_8(D`=D<TV_pJEUTA*j=AhnoAtI&wZZz(4O?o
z2RziLoZ$VmL890G)7$*|6k+b<_ZB;r>6w2!Z87hH#VLi)5~g!!cNqP9cyW#*M~Xm(
zx9!R34Slz-@#NQuUzymgUOewQ!^dMX8*gPEaopg!X=_E7g6zh}ecfK-2WLEHX1wY!
z{i>d~oVe??DA_IiLDds^YoyjGonU#WwTmI2Z|j-T@9T106I2|(?N(`7Vo?z3_tI3d
zNc7gFgww1n%zL%7OWrxLi5_l=pQdzBAXw00b_(k~Q;yV0b2g_08DFtJ7_*z@>|CZ@
z0^%tZg5R!B?p(3zrWLd3Y|*1{t60@^v+nv@rCP6I$``F-ytp@}u}H06e1UiCs=0dn
zpBI#^4K7*c)bG#e$GqZS1e?EG*^gsS^_m-(9R56S@BVC2QHhElQkf??+`j(O3ov!g
zSYB5;yWxk^r`bohKXJ_PUnRcE{H4t?4#_p{>z>|-2+#JIl$e|FN5bY;<gZk1i^<xP
za-6K?!e1LY)I_BjmRiSLULf_jFv_j+7r)Q)X-_7pcG=qUT(sNtIMX(rTgk+@Gq+0a
z%=h2T>g`G&|Gx?RQuoG)MRQVMLG5Le+MFg0QHv|4i|7B5KcIHv>-mHQO-G!Q=8GR$
z{ralN%_-)(0lQCJlrm@&esJBINqCphvSV{!D<-T=)2TWju`b0fxUVr}C!gr-5>7o4
zE?Z`)4ZAe6X8*IkDYLC(ePd9~jhq}whHC~~E9#DT$6Z->qAbZl?(D^BjC*e-I3D{^
zc=>ALf?a3VN&Pb2elRd$7w@u$MSo^Ysy^T|FU9($kic^L4k?d@j1ac0ivntEFSTsf
zOZy?Q_coV+s%YDR3o3T!Gno(cuyyn5nBGe_>|GNu^WNM`oof$XQ0v-ayWk%8rz!)V
zlDKKEFHMgZ{7Kv9adpc~hFQF->FV=0>fh6pRz56{wS0|Qbb7D7woUtsm}6qrjX$#6
z_qyu%#7w$2t;u%b?~sP)N7;4S3>T(3-T4(`=l=1+=3{Bg%pWY8_?&&smNrd}B}Ome
ze)n$v6}>?qn&W}t+^_kwIC9uao*d4u?v^(CEO_&}fYiT)C+)ixpP2c~%VT-Qac0f-
zz$4eczfoVeKWl^S$pdGzHr&k>cfYe~quNW0N5#Ct_PI|MU7w*+%)5lYobyT{Z(CE=
z@ntHKNiDAqWJUSknALJk^@Us!hq%(rMY*RKj(@)rc=Vz01dCYbyh%o`r`J}UDym_U
zzU4GAFy{03V^$OMCbKq_?q&CQG3R~7oOQaVu6AmbpGg;Qo3iJFPT!w?iK)6GE3a)*
znZJJW&IuP)_V&KBGg&NkhUd=WU-rR^SLf~P&Dq-dr046CCrSU9=AGeMv#ENo$<?Dy
zuhJ8b>G7t72JPJLs&?#?aF1>O<(gB9r)6eL*=o8`(LImhJ_D<O4acgKS$Ey_AI1Mr
zVRE^mf8c83AMYE_H|+ZMX3Bo=KP}JXK7SE%UZve*`|zRkhec(t7F5s5@9H#BZnV`@
z6K54S-DJ}0wYmCPYR|GO+;#zNbw@-_?VIq3)#bS4FQ&QcWaZYsTx|6Hh)|f7reTbf
z|K*?{-lN}=D<7rH_U&9Jmlt3Yzx?v5rwJ`a46;o#zy5mra`xrV+t;_Rzh75wWMgAv
zEwRte+D1lBW{%99eU>fT@5{DsbCvhox9f4%*R8RRr!LjR&z&Q;=cioN9GQ7?yyyA*
z{o32t-#ajWef-{EmtQv@E>Bm_zq`-sQx`)Y-~W<=f3L2te)zgPefi<{eSUGg_iMh#
z?~|6Bx2Nj!^7rTW{r>mnPw9)#-WE2jmlf8W5@z;c>ijVOeZ#EAYK?E%<(fxho}7Qf
zY!c0U)^783SD6cEf8CCB54u#@vWP!@=G$iJ*QOJ6Ub^=D+SYG)H`Da^-q2*DgjelF
zzh8!)f56)P$#Jbf%LUfeL27PpeqE&;YyA8?J56(|!gP`o+Rc9T?%XS1llHX#&Ar1f
zUNSg;@3uR|TC=Q}Ip_@MqQ^EOT&Lm%G=GV)?XbNk(7NfD_g?XawMY9y!w$!#eA&?V
z_kdf3(y<#W99X0_b6DiEnZ`zZe7XGP$`!ebi-Qhr53}~|I(ndFv(Da(SxjnmEUNkq
zE3eIQS=11#BF$*DokjThJb$ZzS4%zHj)yr;OpXgY>utQ?<Y#YD33aa7tBmy`)>^4e
zT)w`Enc1^-;ZDtY@lqS!rP%N<{T<6WYv)a!0~K56>70pl*ZcnR<T1C^6Bj=0nDBa@
ztL}S-Pm36)7M)4lkXd}`nDgNy+Ao`5HSgSb;ntCvtP*d`GOhRR_r2m~6sB^tdVQ|Q
zlF&1EJU+k9<-htxC$3!R@S^SYdw=|V^PS<x$4{T9p3D;qJ}zwYpgiZyh1pz<k-}kp
zAwOL9Y>Iha_aSc?v(vSgVR9>u-Sd{7%k=15lTY-`8$QRs7N|`5EVeY{^+eNuseNgl
zf@{1Aq?=m&K56RmvNnmZSG<V0uW0_sadF~Hmv?$5ML)G&&7ObQVHACgKXkc;_wfrh
zVN#DyS6#i<lDYP9-(G_dHchLzmq#qGRwwoCo*7|WQuVSt^Xk7G`IE+n>`w^W@Q5z#
zIFzgAckBoIo<j!%r5oN_uItL-70TdwrpQrrZq^E3r<?o|muGxX{JibLOg+a94-*wV
zFP~&eyYX6DNp{<`WvAS$mMG?$FPM2~V`hfbuN|GPsZ(#P-8^yj*F$r-tW<aPn@=mP
zO?KOK?Wc&(Ltc-_+dW$k3!dI`=*=WuU5Dc-(Q%8n_$T^bOguC>#VYUp%TB9@lO&}~
zLR+4*P5iN`skZg6R`oaK5524It;uIsV_^2xp24*(<G4jnSZ3?w58HxH2W=F%%F4m{
z|Grf8-v!$zKg+&YrD>F%pt59L;o9EHb1b(+megHXnv`pQ&_;B@%ie^=4x6}^&bzbd
zH~Y3DT1P(%dY$;jocwnFb*1&%W=AGPN!ibM-Lc-1k;~;F+j;h?Nk{*B+&2GYw5n<0
z!XrLKd_Vavc1+Za)SNeEZ_BlywX-89e{);&j@Rqa8HHf0bBEY3&#CW`>zFJbc&qha
z<)o*~b`|%Sw+ou&G#>9d{&3ek-uU*~ElsCp%KtCRpCjGzeD?<CQ+LHQSTe;X+FsSZ
zxY={rUcMv~PKo0tTc-B@o4m%UxNNGbkw@Cn%}uj69g|7f^x0z%Q*DXEB}>0KXWVKy
zj-_45nX!NQG`8!SUj2TzK7SH#Gku@9*fF7bO(fg>27`UxpTpf3>YK#rYivKrEqB88
zS>ofDQTl&w-{k*z^W;^}KaZdO{#@`t*yrK?{XIq(9^O37B^v!=-rk4jeLv)yzu4UE
zKmX#X%AM;@O=nvoXgk3nbl%+)&a*V)3&T!4-eP0_^}*^LdP!HN@g+aVH(-8rGaxJe
z$Nc%LZZTbHxTARK!|^3<o88mf4ZrNDZJRK;%d7XH&;9%B?;a0X;q`Urm9*98%r2~%
z!R&jc`k{4>#ECYI3(GW*eLKONB_JC#&GgS-eX)e<f4mohi=rZKK7TRiE<0Zh|BtQ*
zr&(`KIIXg_rI>Z8Ik*4IX?*>GYmcz3=ksOORAu(#sh?ph#iH5EbLWNHt!>RaZwhMM
z=f8K4{ZhY^zy5=D86V#sTwlFLkYhs6nc${Eu61h}nP;p$_FQAfHwT|9Nh=%PEsUO@
zQhw6*L`=dNOD`=h=cH3J7@a+*aj7a~s5L~sZ1z1B)b?}FpHIJj|M>mB&7k}1^oKU_
z(P@jMTQ{zBi!6I_AvU(AL*G6wHm2@JO>Ro)hewD1^%m(G{uGpJ<6X6yW$v^3Rd={0
z??17ZN|yR}pXZ$ZUp4XloB1|RRFHbc9_?Z(_0}n{$iVG3^Z&2DKTm8-@Hu>1+Ij9L
zw>2Ag?wz>$kI)v?F1znP*Y9sTS98If`=2Ps&K;{ugaj+In8bD^&J91jW@gi-B~cGL
zmen6fuux<^$+lL`<j>*D7uPQ=(|)ji!ugG_uVpEPcQqUfe&PK8q3BP8KM$mgmnGJ_
z$ML4gy!*68Po%74!9><)lDo7$XZmFA*}p`*ORy$I;E!tQK?Si>Ov~1t-FQN9;oC_0
zcLt98UtC?HKHWx2?%s|?E%B8aGOirPy%U*|FYel9Zeg_k$jK#kyOfn|y??BoIr~(=
zvH9G_2Ru4l%jYH?s_|WE7!|tBY+L%PWzVFhxUw6~3JWyS3d&h^&GN!dLoPpN#_v<B
zrYk9b*Pqa~P38XsA?CT|2g;kDmGm45O??s-pd<VwR>5r1p5sTjOg1fdHDEp_A5dkp
ze(6MWle?u`{S4OfNo7P>SeR%DJ2*6R6<1}28c3|`EV`2zv_gK<u|1O=Em9;meKQU*
zel2>#^Iq=9rxj}qxz@ca`u4(6*(zll%e=r+^~xJJ+=SaN2rTr?>X^o+e1$Q&GAqCO
z&!2GNT}xyuBVKS-8vJ?0KV9B_?*83BW>5O@?a7{#ioXwrR_Z@K-;tHTF8QS(wWm{d
z-uhdz8}>#$x_jWN{*4{V+f(cp>~;=1q1nJZf&1(KU-|#{a^<x~NG^F^me0w4pj5(j
zq0h=j%XO1BeVef%ZtkP+s)w}Cwtt%P;QEKgjsH0g?RuC|;dAzb=Dlkl(jT<zEk14S
zrSbS9m%wYG%5$6si#h)NHvP^#yHz3lUAO6Lg_D<$?pkIoSG27yD@5mt;bzhM){a*%
z2bsUsI~(_&Juv9#>P1Z23;m<jY^`gIRJz;l{N#Gy_egN>9_J=y$=O*({frkZK5bWO
z*I7I}qb_;!j<)-nCpdbp75ev<6)l|l^YBWSuqiLaQf*AW70ymEsPE&8Og~v7b^F>X
zX&d$*6K{yzWc$(^ceL<x_I$VZ(ZxnaafMM+HeHx1|EH()i2Ql`qwoFw>i7I8co%<J
zeurNDzjZNhrbTQ>PmvK(NVt{yz4Uy5nu6J^>S!AlhrU^>7vxvkynE&S@X4GrCln5c
zi4=yqPkDOf)883Zp510aDf2`ht0=$hH%e4JmB_qD_jpJ89x0!P$4<OCI+H1RVQ89L
z<t?$PO^%s$Y-th-c`U!}vgAcN3k&YocuXj{%K9`{WB#K1`5ViPcCzxWl(Cs=pg(^R
z)7wYI4qI>b=-jh8Tkq|}U#^w)b&YCBz_gR%do*jKThIRam}L;QY{qKoL%B;IzP_LL
z#qQ@Mz3ZnH;`NU&a*6EqWwlaZjk6IbdA=p)`HLwsCw4c;9ps&M)o87)@)tg~mIaOl
z7q)-9buidPGv|`h&5(7QHydwDQH#;hyn0YFKB`VARafEdvQH5qcc(1XmWw~aA}V@f
zdwkFq-RAROt7eJqd$-WDu&p&qMJwA<F}JEzJXYT0#OoWHY=$3$dJB85Y*W9QIs4ec
zqkVpFT(TUl-}>_W*`$x3LzRyol_<Qf%Kw3VMapK^oRu@(wypf#^RuktYk2A@F##X5
zi09iY3#VJpvaUGrM$+Y8az;+t)>`AO8nc$Bh8{l~__E`hz=W@QjFvBUYO=CL*RH>}
zyUBj-6u%<VWjPmOzAI0BUU+cohNWkV7VGu>cJ#RSj-fno_ACc$msj&0PHTo;OIE)A
zJNg7aZ(l6OhNn@bOU~On>Rl~9;hM*<wMJ8nd*+4S*noZEPj5NuvU-Io%Y6=N3f<j3
z&GbvILTld+U+qs{K6k#j>CE?{XvguC+aA%nLEB3u?%w<Ces^2rZNZE8ay5+>Z2M_@
zdREiRr)R_>L*%%=n$4T~<k7heF+3S12R43OHvhHVrTQ(rP51YgS;l)^sS0R5xVul-
zR#PPOu;0SWy$086?><PE7QM0a@2X;p38LI02kw@0zg-#D5iGrgt-WB)%7dOv9`PMU
zOh+!iJ;fp%TC?oczDGwpy(VrtU~rr-*r;sU(UQ5GvaG@44`nOLyQ_QlE?U3J)#m=}
zM=P`zF_v%j4>UV>rrbfIt}9E1^}m+K6qAkSGrsJYV43B5%;G?HM#(;l0*9uyX#J-@
z8P;SwG5J0h+nmnLRv+Z;@<6X!pYyJ=?Cyt&B|S&n7G+q49_M?r@{_2<oC!yAlHP_)
ztbTOXBDXcH_=(B%@ReFzQVYHbd*=O6$=WPav88m?td1OCzfz%shhl32CPY^jOnMZl
zY1Q-2tY}?RRr&SD8Mofeczz>WJ@ehBeKk)D>}Iq54_$fg7}LX-<+o(o<R*2_6_TDB
zcAbxZHIv08?v1)~*TiS2E~_~@Ep_v5Hr8d#jKTp~EC)+Um+vjxn`f!+y*4VWUr*(c
zgq_*5Bq!NZleCuQUb|bhZlPkU#@F&Zp2DDe*Jc~dXp&6yTE5TnN}X@=@B6<eN&eNH
zJLSl;MU!S3-g2s(xLx~r!c4W#Tx>gKd&QHUe<)H~AH0cEGNMZDo2mGjDw)4^6Uv;X
zrP}^_bFPg=r)b*W3r6QAnef*>TU_&0Lg?|=J*j<@`?4K^l<iM2+gq6Y-R5*TwCYbn
z|2+OMv0on#SAP{<&2}~TAkSZh)pONe>=OI*uFUvY3a|8@Es3T-8+P4Z!e(!C?-k1z
zr_M_)&DnYBriahH+jCMZQ1Wq|v(Q!B`Ho@%KPAtxu({>;x&3nZyk?(e8cQDgd10A|
z*wnMj_o-iGw3Zg{-j%BKd;6y!fv$(QS+4y*|NX!CXV&TcxmQ<7E`RmF`uUWHFYk4&
zn%TEKGp%06e(j^F7aHr8r<}hSYyBrJ*wp%MN|0J;PnAqI^ShEY4{cX$HCw3J=*Ik@
z)cW$qEurROlaB7*)4S_l*w)tfU3N2@_U(y(xc1>3VY^9h{>_i6;aXeND|UBZs21z;
zN9+3zJ(hoLue-BYwDDp5cc)}OhLq?to9;Jq^(6dHKh!?&{QtxyAEri&9x3ZHnzP)0
zZp_T*v(N6;>#tnx|0~5srQH3~{MRQ<bR<triLGg`kKMT`&sC^(Uf*Nq*BS@sC7$Qe
zu}iKveA{{Nol+6^-M4=@q}|LhpK!xsf6aEE=K2lo)hYUa4pw~feeuM#xjXL)?@dDy
zEphi#^BBKO)i9c~Xn8=)OcpIe=}P8P8sV8UGMxTIDk|;VTl2tr=M+odRo#28I`KVh
zP%<{X>by5N&Opso#WdjIs@e%V`*$qQ;TO#aOwn%Nc|B8T&b(E(4>8DPTw1>>BVdp9
zRX@3x4%0R&&b{)&cj-a-W0B1jomcq`j2`9weiF?z;}f5Ro37DJlPjxVe9{tnw)jXu
zL#W-#H7pM}KX2EXx+UsGN&CHKN8bLwCyGO^{hFy-I!X4kW@o8)&{N*vP|pvV*F~oX
zE#9PDv1{#(_Q&m~n~GJYuX~eqQXn!!L1J5q<o*wGJ7y&HxRtmZ`B)~H=--fj`b?&j
z!LzyE(_YW8JHx->oXwgOft3o3HrrMAs`+t?oV!^ZemVQnjkZ-a9huYe&K21IC@x5F
z3Fx|N%fD*!>XWZEj@HaoP31XtjKlj)k&~KlL`vlQ(9r7N`%m>~mrYoGTdB-0uyfkd
zT|UwxdaobF9N(^R+AKHgZP13tw>_S}3GvTY`KOb&@zcHB<frfSn#8PS{^;fXRhN*m
ze%#wQ>F6^~#%r<GT=iRC)hV@IZ}FeH)<sgiv~k{s^**-Z>G@9^0%h;pf10y>a#Qrb
zd9!ryt==!oD!qEg<d1O^xlZa#wkXixZ?utmB)0y=>BDhRi~PiwTQSby(BPG<oFE;*
z<5>UQg)!=E-rQBa?>-u&ojjj6cc!)buWJi8SC{3M>}K;YKmWwVRC#JgZn=3$o3`0J
zzt*XzjdQM_Q+;O>JC*tA-m1pd^-6JVGgcKnyyL2OE@0&+ncIJym@5^lHrs?JZ5N1)
z_FiPy$b0kR3H8q(%GjCre>P!Je{Ri^*}tgrq4fG=$+dp2XEv}Zw`9k}?fYNx@$=8+
z-`2?Fta@>0t?LWDQ}H>C0^X9w93j0w7Oi2u!C2aPO=2fchwk#(lM|SoxEszK>b_HC
zz!T0C;~bgnyZ5L;pn#R3!vBqYOjUnY`*d7r+4B8C<mt!rCW~)eyl3<FYW3d_PZrCl
zNR_H2y=Hp8a`}U`3nf#gO<ODeq3#Xagsd8l<I^v`tU2LcJDF{N;$k-QwfDb!KF+%Q
zmtExlsWa2wezdrzVSQ-cgpUUp+67)PtYhZ6b+%zb?@Wum@--pmMO-@RhKGDxw!S+5
zDxtFKu>_m&tC!QRu)NPy-+XITX0khb>RwJQm-p`+jhpA1wO%bvSLF}x+R2>D9V_vt
zQD9!;EAJQAw}(XCj_p}BCr#m!$4Y|@tG(4CpE_GSw>iie5)-mKKve5Osqf3WgtGjf
zZbpSC85SSAur6e?T=D<<u&GZtxYUDJWls}UemM8E#KpJndhU(oa+cc<G%V9TD7fR)
zj!!EbzTb(dDt*c4IC+lwfrZKZM($}v8Uit#%x|XEb@%K#y=jI?QcmN1yOf5e*Se~W
zGaLMlwraQ>JT}qOxo@tD=GjHs*PM2@&)t(%dcRoRXZgB^93LE16N=tOnSJQ#R?^OX
zRo0SxU-C^${<5T<#%^5oPg&I)=4C8sUZkKs?ZsK^=r;|Un+<*DDJ7_`b?kjQz4VKb
zg_)&p3%B0#>ZTdSi@a|wSn~LE+^RiX?G3X84fU6o@^9Meo7T2W<;7dR#p=sdOq5RS
zo8=yDlxqF$-{;(2N^^}alsd4Beb35VD88@Z`pgHHMBn8VR85#)sCq<f*%DdS=syn(
zmz>f6=bG>DS8w&d;M<R$4FyZIZbl^7%|9J`G4r^^zLn9njc$jHQxwCvE}gV`IN4~r
zP01}wXZJ6!%ln>2ef?rq5|dikdn;MQTlS^hE1~XlN*i_OcqZR2k>`|9SC8h8*w+5}
zgn-eT1+nh}J#R)oX!G5coi<e{sVn2mqdmE<JIX!o>+G7mh{s`@>Vxu!^SFK-dh}~a
z$<ynxv$*yKx#VlwUTRufYt!;;QM6a3(u5Z?elH0K54&wPC476y+Pm{7?7GeNW(TKr
z!j50D8uz-MojS1jk+If{tU2ydbD9tLrL4WVj4QU{@=^2KeMaS<w7z}&=C>@kbhmf-
zztF1%DKlL!t&%w?*)4hPambHK&Gqabr`t0IPmEl(?{NA>exB?%U0z~ZnO)3kUw$sy
ztuV3e;Hn3+b&b}jX#e=2XZck2V|Jxz?aZ!y=MO|_95wRmz1}I6)4O!hrZZ;7|MT*f
znQZ@E|KEC&@(eTM2n{QzlV^07y!e*6Z<m*90O#?j9ZKse59>C1{!W{B>r{7m?4_Nq
zHfO)b?Dv`#6+b!G>{Q%}@aPB48F?>O*q!fF7u%U_lAg?=G;wj8VtVay4q^7&89jNe
zf0yJecK)TlexKDs#rv((*+R0J_CNQzweMb7U<Y5a^hJ?9W`B+@Fcan#dGvY8xuDM*
zZKtJcYFKhF{#|-?-IDjWBShb<idufUC%k{}pLYMR{WDh9&)c0_SiMd5d-&Vfx<lRz
zD!<t(o|$X*yFB;H^}O5H^CZ6td+(Za`$Dx2|Kip2cJ{W}+`ZJS`bt>nME%k078@jv
zKi+c8|8`q#+-}BmQF}_u<o4yxX?<{=?Zo<!EO(~Nb#p8B?f1C1G32=Kq^6rbnc=Iv
z=7gB|1Z_-eFVqNZdZp^O@r_`Q_`}Mnm3!{l{_T%hvQX%Oz_qWdr1sW$PQ8|Lt!iV9
z=KD4LSMP{@HM)IV+A1P$NyPP!C$pw@{?J`-z3!U!B}e03)y&@*W=MF>3SDdYGJoDH
ze~;k3W_>?bWvwm?)R-ESKCS)o+tA(}3)j5vU@T>o^3H58^4K$FL+Keu;rf!(2d!L|
za4|RCyRk{Yt$wwG==ASX1bF)0?;Tve|7H>EhqdqToc2&Rf8f+DHSO1)PmzuHcN~tI
zeCo%f4<)rCt7cEW@OPJo@ciGN`J8KidMvF>?bz4I&b-;P^}C;(iGO5xPTuc#jB5UF
z^)IaU1m2UE_xGD>dCgS+n8WqxKQ$uCPIa@Co(63#y6|k_pRR4U<XPAKWU17ibbAkT
zgJ-Mws}ISFkva^<d)bVx2jxU5yT;vb`MWRQ;q&Zg(`x6MO}yrE{l_Eiu!wKDB5z{b
zMHC%Ah+0`+o?vgW-90lnP378*<-0`YUh|C&`MR-EZmH}9bM>94FZDh<d#jUkrOS)|
zta^7&1@LX{IkTZK_}RVcM+>@*erhgftjfJ~xc6f%%kmeS7%zBBs<{ZCRXY);`AqD%
z;_gdR*VsLbxhrDoSHE{ps`0A+r7MbN{hAyl`8D%tUG8e5Y>}B$mHN6*om2UHV$O~K
zDJ)lXC+@uw&h)N4*YUqS!)}dmA!b3pFPoSbM)^A1uR6<Z7jI!xU13vK!K2)E^YPL{
zkLGPZGdp&NPw#JC9vkj<=PctRX2&DAr)bMXF3wcY{SmjUnEip<Z8w7hcV?*htl;~-
zezmLGK9~Oy&5l=pAM*I=bZg@AT@#}>`P4DH$JFI4?fO};c)MkYe7Du7yLWEN9J`Y5
zuz#uLvVRBH2WoPETjZ-|AGzQ1l5hX4W$ycyRe1cBW@CJ6o=~C3+`}z4r_4lDdZOs+
zr9V9jZT2i|dE9EFy4g--eVSM2p&~7g4dVMMou6KpyTUb#)2?W(^;V;s!u8WF4oCgh
zT^O+TdGQ~&enGJ-D`P6^n*(mt%s4rb|Ga_iQ+5xfAMR<6D|bzN`9zE-ZPwg_YnN|w
zwzzP(I=%b;kw-<7r8o2*+uz&s>~_y{`z+DbK{-jxGyZ*zUXWRHl2diY^t%^d-FH5k
zTeqssbtOL!ugKpSY@765RcqS!wJzJ18l}5&j#VA|vY6n>8aW|bgFE-<ww!i|+8S{^
z^V*JeU(}y2i@5gtfLoXLB;Sw)5pvs?7)*9CiPaC^QMG!{SDjg@ud@=Dm>u|%ezn%_
z<w0$h=oMMkADph%Y&gCpUF~InZOy_zi!2kIr|i<0#i#cD#cW}R;14Zzy?#%$uhp!x
zI{GNcq5Hg6iTN@Euh=75JeNc)Gq~hx8n#X=W8J^^-yJ?@*1h))m=l-T-B`Tpl;q1E
z*?^vs`+N<5p31W;nX63TdTV=OZp}^M^Nh}X85eDLuCn7x-Qspr$ZFxsAHUe_nZng)
zFR{7z_<Hr-<K^5F*Y+JgU)I?bS)81@z^=qWe#WW|M%ughUQXifN~~-9cW>t{o~If9
z8tJa>*%wac=y2@*H&y*{SlpAM$tAO`W6%CAzU)&ztE#v3PU|6s`MO`XoynHgun1lG
z`>~tsqw~T`J*_9bs#tf>dEslH&*dAR*q!(_Eyl#@Px9Q9(14}Ix+gvy_u94fZ?5r&
zovJ<m=3I7k+iCOkntQ{!)?}+c4n=vl`ztEGEivuut+}_Sf6j`vXSu9?eT<v(xooQ6
zl88xX4lneY5_nJF)zPGJ#ph1fNmi=QcBM$gD@j^>N#<xtzv~kae?aDq(YEEv-;IyV
z3puiisl9GpU)8~{o>>*07P2gB%nQP8LdC4km!}Guq{;j&yEys%!LYnLAq5Yg&MY-j
zR!v+vRb=O0x4E__Gvi*GbJriZqOO_K%--_7BWvcV&keVg<QqDFCY<|Z$Ys~G%`Mox
z=+yR#>udJSxMycHKdCZ_`=P_`ddKYUeSBK`1+`{AnI3ZI>!gn=lV(mRN<M60!)c}&
z_UNSa%2+|&!}<~bX4#k8`x|~e$@zJ6=b}ed6Ps38ym<BLP0^93&);hvp0KZFUACU?
z<dqKu*8gA%Dx7r9h*M`_)isR*O*f5&Yu~+Q_4yR~MT)n&&0~7)XD@fjZlk%&D~oSg
zUHU4tcc=ElD}p~Gq$mB~bL`0lY02BhU%NlDI<HhH2@UGyTzxh4iLc$$%$rlC@8&aU
zKlmk}+}C*eg2F}limy{TLVPah9OL2GxBJKK-=8P``|vntuD|e-1g@vAZUuOnvBzBF
z=D84*Sz++zfLm*Q@8WwAwT`>4n{T$?m?k>icKyz2=C#jU<?bAw_W1b>v7@n<Q(r6U
zq&ifVob)qq<zD=t-C1f5<CC3FyJ{H>J1UAiw_iKW%HUq~&Z>3IRS&mBan22Y_Z%p(
zSQFGAzmkRTQGS{CspoGOt#7JYz@Q~wB6{_iMfyLtRMYo|W=AU?%aEPFEwQpDMLu_z
z&9zLKO$MRcH|{w*@5X{_qBj;luaU^%E|{{)-Pg%c`j~KSzD>yHR-dv3huiAra7n!S
zt<_tyQC&;^c-cc`UnSiSxlP*@bI#W-ZoP2PMAkdn*i>p}d7tiwwU^i~+*o&igP~oe
z<E68crXFitQ!0=h@OQ1rJ=s}huMH#ithZO5clJk-$m(d@jjtqyjrSe-xMjkB=kUb*
zy}6bWRxJH7OPC7n!|ty+WE)_z&;9+Rg8MA<I`6dbp3ZZ;biLlT;a+TARdr!m*+0d7
zRzJTS{u%n`;gi2V(|H)C9<_J8%53_1`!Q#o#A&CyAN@IA5cHUH%HJHjlic4=nq2f3
zh&~y!qn<x|gH9Cxex1$NjBU<^@rNfYxU<^c?q9{vhxf0@FNnRm{>#F`pT8rXOg?I)
znSYh}C$HGo=T_x%A2wQD7o6U&^<hK%ml#{arrK8*uN>h1=ePC2gM-QckN#&1fG=+q
zUimdbJn{1C=S&O?ew+*pqNvMTQ&J1kGILV(3M!X|MQ7hO5UIPq{=y3dGhd(U+gXhy
zv{PFz^_ucGt4N%+%VS-aqf@zf%D?Y(l~0SSdKu5SSE6^nJkRQz<o^G4UyBR1jRT~_
z%q=yPxjD~Hs$b{&jidYYlcu>J^+W&OInnNZSYO|+=83(+^Z3@8pQWd&_K5m^J#u+V
zhVN~MSw%lX!h0V&tvtn{ti4pS*ywYN_tyih&$5q2@UgCUU970Jlxgpi*H4Z)DA!Hh
zaB<nqqctBnQ@01rK5G@Z-SpJmsaJ~acD^a|KK9Wh_om|C#p3ZF&z`H2x@glNS?g(^
zRlK5q<q|K??xyU(tPPu1nO4j{`)271DL=_Ys_%`qCcTa>STkv=+Jd6L?z4_(Yzy67
zv1MWM-SdKiq0LMsYFQ5Rc6%LEP~Em>`KQ1MYd?QHI<IT}gr|RbZckS}V_j`&^1j$+
z`!C^)+qwMPUm0;cP8Ic=pY_n;WydCF*BuP`j}lY1S?G&gozqlr+mm*{b_q|DljWfz
zr=v2=8!}v02Ke?*VbHx}()zW;V|K@`V}+dpdVEq$e2)q_%wOd%su12I{<zcamidil
z_r9Dw=KjMEt!97pZJlJdj(6{YmzAqCr<^pJaN_^f433PuENoU1{pL@39~gzks!E>r
zT3DERt7B1Vk@`G^?cKcFTei=Aw=mjo&G(&6zoMq)iDcYgwld_>lFTIwb)Nk>@ksV`
zqVfS7wd$%h%$LMk`u>F*ZN5@0uJ-o$^zeMmx4ula)AORMQx#61o51sHY0V9}BjsN@
z*_u~&ZZqjy#IK~ZNOaX=3xkRyEo?5ue~!*vQk`Gvm!QlsRlkt2XW@p0=T6M)+O)**
zz(>ZZo)^|V<GQ{5$+oclOQ*3FX+79J%WmqTJ3X;?cAho+%QvaUGPmJ+dC7*G@9N{L
z<n&$Dd445ygiK#BfA-mv(Isiyyq-vHc6=JO^Ap#!fPAaNdmXGl2iI&<&7I55yzcQf
z?~Uep>$VE-<+o<tc#t)^ZTdpr$&y8enSWL?T1$HT6GzP%mB9`cHi8TcQq~L%;;1<z
zHLol=KQApaU9X_>s&#Dn?HwE6{}WyD*+Fya)Eu+3cV7p;Uz@BQx%J<!X_L=hyWY+{
zaYBo!>n0Y>$gdyk_Zu@av1p!}R<(`)>d8V6hR?PVXBZx6o9(jtTUMaPET~;*z~egS
zbf?HoMQguG17Y^}zw*DwZJewUn_6Ub`sVKK_xD;i*vsEI>$9PF;iMU@Ns5b9<}w?c
zW}W~3t?#Ckb2arrPh8b%=AW#bm16n0aLyB(>7Hv&87iKy6ewKUV$_^-Iqv3yuEJTW
zjVq!)g=#(4eB5<6!$e8%8CxC0dDU<GGG{B#pC~i^?6a**ktcLI0~-!HD+E2+aJ<fI
z(S&~GLd$=?ES18^Q+!H;Pko-*{F*E7`!|R51@fvh1ob=~%{d)mDCerfes$pt9o<D9
zEj=F&bac)UlYH6ko5B(>SK^)+(}s^0DUQ=LTy1qUHu3D}4ZAB>`q4vm0l#YKx*I{y
zj2BJhlv}jOMOA)5)CZqMF{}1}=ZfohoNv4`Lhm`#LZgFAx@@<IIcrQ%NLe_?XMs8&
zi*$F5rpubf31v+VKB}&4W=t(7TQoOpN|?Au{LOWRlPp}nv**|96iqvFAUwz?Jtyjf
zK<36u!813CjuqET+{nzt+aTatIaj1I>dAUR>wVX^hW<LPSn8W{M!DdWgVq<5W9pV4
zrgI1Q&VQp6%70_Q##!Gby9}Ajt8|kU7R7x(x!bh&l8DTgNuPW=Hyl64`f6grbfF%b
z=^N)XCx+{suUMnzX(paH|E~?R=~+jy11A2;9}lP*WSnWP-jH)wZQ+T7#~beI3G*i$
zkt^D+v}hqi;{i{XB}XQmVeawkn$gyLGa&!K%2S(_96}zXSh72>3<{kp{OzFr`^PDg
zza67~2-{7c*pleJX7lj}&kN_VZsvc#H}0p@Qscb%O$(~#+&=D_Cf8h^e}CUrefc}$
zrTdM}FZ5dKs&en{?BkyQ{#t+5sXXdDMdjm`bJzYH<`>J+OZ4ke{^uXKb;+sPvIil*
z{#BnAnGvLQn$zIxIX<7u2P)SHC>&UnG&yeWy%+oIHk{{w=2`pye*WF(tCG_cLtkl3
zkJDO{^)g)Fd)+h9+M3nB<m!Gru*q7W*S0Y6+%!)?#|eT;m+o;mva0d5ENo%5k~z5N
z_Wuv}{#)$%=)Z2?kNJJ)+tUvp%(%a!YS*cBgXAT#@(K$A4UW&`bL>~*J95|X%bT4N
zHNB!WZ@#6<SD*Y~TD)%dv5Qf@m-REYEOWkF-ri;Xd?nu*!T#l}^SfsKSYVybw%f3@
z;N#W*RW)zt$IOf8J<oRi-_MU%6?ea6wu{-Cm$>MgL+(vkji(bi9{;lPS3K45=}XT?
zzM17kN$LT!f(~!bzdB`6TcBwRk4x|VJAX<l6Q4_)&ApW<Fw?*(@v-{t89nvNP1EK7
zM`d3Q*|=3{j;Pl0Yp?YeOIueQRPO7I??2y{o6NK7=&|m{7cI9;ZJKxT$3CIU{Z6_o
z>&sqoWY5}PTYT&Armt6IV@?H^)fVjzXxb#}n(-w<DavNKxT?-?50ATFLq2yXwV#-|
zK0(P*ZDXtUotU_JxsTc8Q+rlS?c99g$j7a7wNt)4o;X+ONXpU5HD7Dro#L#VJ@M10
zSK`anb)FsDvpoLX`ZZr<J}U|R`|&8}$Hi^VYKn_EOL_YI+0*C0shK2Dv#`?S&+h}<
zo=SFjyy?qZ*DgNaJ<mVumhRQ1J%@cR{FvV^zWjP~;8VltTb!PICS4Ia^V2ra#?t=Z
zY}KFqmw)Zg%dWDwy|CJ%EcWkP<1?qa{STivTQbE#?@ZJ3BCVvi7s3ypXSSZXD8sP)
z!rZyFw(CDMwo4Sp$Hv#W6)#SW-=EjbZX32$`niI*wP>aqlgGS6W%HAY3*;voCNT+j
zFMaFkzhnv9BHJaAr6m)>_rCrA(ss$`<;|;KA3XW-?1L-ray;A5Tc?};H}l_rcJqs!
zH_J;?mrFd=eDg$RjnS^@D?7W)C+sRUSo>a1sPFOS`Tg~hjM*D%bbfkOUa2ztVYTDf
zF^N+XeYQ8Q`1kbaP5m1(U02%I)IXK93Xh!BrPD6rvAETRJ4?*tY0>@bk`sSw7W|D{
ztGYJ9F?V{1;fELBmep%D$E;p|?T>1k`dvG=@OO=tMKVQfJLSyoKjh!BhhcZ7*U~j@
zHTxHF9G){>CAr_fI*j2&Qti}sgHG!sTVwa~U7QzN_CeV&K=C|_3UlGs6MrXGsxtA{
zE_1wn=2RflQKl!;gC|a3T>WK^s^_}-SG+DtKi%LRVP)(Sn(Xtja)S5_-RV0N3Pq=6
z1V}Mf+Rb(}o1<#L=^CW5!nP^u<%yJcnr$cDXEAC?251E<byrSP^`664yn1ri$zH3K
zkta;MlUWZjoXTJEWSehkxtNciL(1gI<vr^ryh}X0*vt9_<2Lrs-*oa13ov%aTJxnT
zO-|8&wQg~oyOJrpuewI(b&+;6m90~&Hu?3wD!jwtyLZ`ayMz}NH=chzv3<AiNe;dm
zChLpSW!1LoZ~fS5TdLQ)J@??s(lfkwX8rS(iT+Wx&i6YT@ASQ;?-FNz`nu~;^FQaA
zTe~j4oAy%8^4f%ToGj~RN@+&TH7vbxd_(d#-(N3kiZ;DkqANFJX2q_}zf;xrN$kB4
z^!~84{-T&rua)iw0*6=kf6=g7<GwyjF<;@2$&;LOAJl&BPJgDJaKW%H`lG>C&a{|g
zc6laSqU63$d3TFt-QjmCW>R|}P0%;*zN_$Q&4-$s2D#E)3avs9U(7OA`kwpvchJw8
zHIr7Ha9u8GW|?<jOYVbGwY7gXpHse2`)bi+Wyj_l(VN4iOJ*~QF43wBc&26d&N$R9
z=WOaNot=Ft>e<^ay`23e-P(Hlh7GgVe$LryTU`2@dy~}fQ;VH=5?Ie~+g6k-^KZ}J
z<I8KaV?FwmB_G{)3h23|l0Cn-OQgKO)iNsor>$LOw#cs?2agx8ZH&ISeggNF@YOrY
z@8->ZFXHv%k>iikJfDBPc`9(7;fJ~FF14xmH6Q#vCVpqW<EtIMQ!Yo@HVHDamw%Mv
zwpx?6_Vm1^4@<90EL!1Qv3o_3FXQ*nQj;|wt=eXZ7zNlL_;T*~&5)fwx2IOjy}#9U
z)6}!3Us!i-Wm=i{ephy&;HIa2i$Ar_t9Vkxy=C9D%-5EiJFR9r-#m7VX<4t{L&NQj
zb7YIM_Fek@YuASO%Q>kkt0e_oH;2Bw`u(W=f^C;PEpq3}Z)))izg2rraHiY$4^Nht
z%;SAoyg9_`Qpp{mWsF4=pE%!{>(1M8LBzs*`ts>p*7{BLR(p1m>FYwF<vB+bm`!&!
zWyNsxaP}=oNSWEabLzLaHFvU-w_hq)8<p)BeW31pbzz?0DxKFF#}#k4T|E0#^-;yL
zIXTaFy7R63F~@I{$lRv~_7`pvco&kJvE%qDo3{n&w$oXE>_6&e^0v|awA`8Q{WmtB
z^Apsz6SSN1ezS7V<-0|bAI)Jmmh4Wn@wEENe6oni!PW5_quz_Va&OmU<zDUXa6b9?
z)!(?3jU9ZmStq;2_3-{n+y2-vb5YUe{G{ZRy(<(_9i+ZLv}Fm~z>{@R$6oaKma290
z<#uc_nwX|1`5@Kzv+(=#eYf~-Do?!FWHU8i^rHF+4&Tec-`)L#e{-*_*ZUMH6!mGx
zYqp~ydPZ`kO&*D&e)=osWj$yA>U^e>Pde_Xnyk2(nDD!el@2mY%fdId=HCkWv1I1=
zd3Ro{IIz%5B=*~LwQKdZjk6@S9h8~O;@oPRo7S)TZTbIh+i%Ce-r+7U{NNI<)#~{C
z<I49lb5?48b@XMJEO#|lA|#k^M`>vA?bt%M={qm{l1z`4tSGx5|4D~UY@yc=Az_9p
zIc-5(t9KWZH&_(38hXUrEhv6J=j<n&(DwX$KB;!v$7(&)?q9fMua_e7>bUs=HV>8i
zN0MGze#+duYtz)Wbtgmnv{GMH7+AD_;+~VJvplX`d!m<2|F8e*(>dP;>IpCH5A}I*
zB7pbe%<jC{+ddl>F0#B=7BOL~lXj4-?ULsao5PLwmS5Li`f_T`SFK5YU5tio{=$=<
z9(&vL_iyd*99da?Ux6$CxAYY|@0$3@V}3M4Pq?!Dnq?REDVOqY5iaBnS}uEXN5zea
zCI{cR%v5;Q;ymxI-WN^AjeUD$_MQ~~@Vw~AzS8Y!tPb+Fz7pxJJ_gm_KC%A!ACla6
zJaO8I0{3@)rdRxCX=+|AHGceQ-;Ies{5duYXD$j-m+7uqQzrV`>507ia_foLN?vVI
zeA`*BUdI`*J4j#C^pD}=%PR9+RzI&Sn0wJd;jiwAD6Y~&GXnB`KMV8Rn-tTz-Oop~
z@Kem3Vvmy=TF*FT#d{}l=<m;Qp2}geXXlBst*@SU>*v=oZJ2w;s#p5nnWyU}@+y?g
z-n&WgYRWeq-}WmXs(!p>ZT<FgRnH;gb$#tK&Sw4Ts%5Qy;2A!vv$ICvSJYfBwO_4e
z*S<bI<k4p=(QU1lb<9}MN>^2HPn9}zxr&l7zmmqMPf<>uAt@F1e3wnGgi0`()i$hg
zsod=N%Dbo{nfF@UntgmpiU|q(w}m!YyUx1JTWP7fdKZI1cd@wbMU!dXY1N+Z8GmK*
z^Oa}cYOnnIS9<UI4c75*PcYs#vr*v_{&nGK{|_zA1vW}Tv*(=rI&J!tl)m-$r)H$D
zmfrGmVYFgyd4sLni|768&F6INEAV@(RJJjcW5d0bqDEp%jw$Z4-Id6n?|<%M=Rw)C
z7wqyh)<mv8;;vb|wKSyZdxZL;*;99LUuN<sTVQnZ-Ghr?pQUT5o?d0%^VQDyoxkJP
z1)Bd9t1s<7R5;JkxA9Pda7W<XC#BmiMP04v4k*vP-K9Fw$|g@_`S;78CUxB{%)GvV
zIbq$_E88ZUJ3s9A>f5j<!D)Bb?`favG>uuNZP?Z16qxHaUGR8_pQ}y7vyWYG!*$*`
z3z<K(?C-NHoRR+eRb==??E`afhOYQJ>zrwdl9AzpQk&n-(q`VT;|rDE$7pG^H%oft
zX->@2I&<x;FU!2?+Prhyw(dAn<zloy{7v$t^I77ZZ@(7Yid<}aYu>sn)mVT3X-an*
zxc5qiGp{gl-gSj%n*8P19sk%m{14|pZ+8B+*<c#`^IoNhmnn0Mk5@-T?pfr_lrOzu
zX=GF2+=E_RhH+Ex%m1l3vhQ{M{rc!QCBd9y;u~628;V=KrLG;47P#~_b5F?KbM;;G
z6-}g_S9H!VG~8ReWctHn|0eEx`j(xsF6!dVnkgH~CWO^8U1UG;;NJ1--Le`zoWj#=
z+1a`G&P!gn=99p+Im+y>vMNj$lub-M`)zCRj&n~t&ONBoyDQu`Un}ON`K!Emt^D`1
zR?kW;mcF~<zQ5%wdl&00_OCaTPfy?SrK{H@YR;A48zZ`M<j*sxyglC-Ena-)`-Q*3
z6PHZX$nQ+%(lU}^OWb*9<+^8W$10vYll!~u;hm{-XGMuR+WN+BS+F%?Yu>H0)R(Jy
z=8MVf)%5OfpKUxNDBGO1<L$jwH%mUB*0>wn`qgtrWOrxM^}v4$VXSrE7mB*gFL|+M
z-Z?XtnTbvHhg}{VH#1#2^-13SdoO$C-pZAlTG`zEcwhFK_>KcJxVLOt=KuO?Ah+k&
z-Irp@d%u1?b;#2AiRkWYbqo8$J~GR8JS(y3>^jcud3uug86nQe=d*uJk-VtwX~9`F
z>5h2jON(DToRin`9xuu5V`RNAsd$n5+o@$``CrPTe?{w>?Ed*-d12(9__wWDfm40U
zGN&F(PPh52RCv&D@{$8C*LwbnUj7h&dP?~+ZOiTn$G*kJ#kQ+S^*(9)mL16YdV7({
zfz#rhCuYlV6ll!Sdf9epRUP-qC?3b`>y7(oabM64FWvg`jp)mCtyzyNLhYZdmJbTu
zzNUXpdhNk$J&LVYGi<}3SR6YcA^R^ge3^3f=a~-KnwvkGIaV%v*S9tN{fhkAlRUQF
zb=aC#@yzS0-Q5d`_ZHWDD)=|Ca25B9d&(S~wrW>d=2hrcE<M_Ad&zL$n{T!9ch7#G
zpE2nLxAlP=b+P+)oqM@qwhqgjE7^6{$M&wem^c61t=mdBe%B)gTtGYR^Gn2Ls_HN>
zxGiR2ki-~p$t=px%T3KI(JQEYTANucZ8_~h`CqOrHiDjIfiG8|3SAp{w#REy?5j<>
ztxK(}Ou9-Yv7FRVHNIKtkyQP+`CI-Q{oCaa&NN%SnLFcNYKyKArws!?KmYqfr_~?5
z`SRiW-0de_(w5$_oOf!CS6Zh|+0lPm^K_n^>;7=_nsDKS_19dD;zJ%C-TYj?EY7C-
zqt6`uB^BzYZG?j>buZU!Z8^4R(#K2LANKzj-%|N8NG5%%&%!+sPhDeFE4OVm)&8`!
zV^L)6)z%)Ri8>D>RUhe`)?O8qm%DP)l1Z*ppJ%S*{#2wAmKk&QQ<9}nt4wDRuj|uA
z>n4SSue!EcWp?)tk>|TICM{n%N8^D>L%<C8);Y&Q?`Xt5lDV96M~Cf;%FH>cEAQO0
zitxLCsQ>zh$0mASksY?%oo-aE`+e<z>6L@i8u%A}eNm<qZgF8^#qkAvVwO5rJmx&p
zp6QxubNKzH0Dt!@SN_>e*}TJVb;X>bt)E>LQ?G9>nyMBmB3^vp{{7c`CjF>Y@mukE
z{?l2E(~b1hx?e<zsrGXo|B-BKe)x`*nc<XY#i3iYK2-|pd;fj$LhPDx_vK){>o+Fc
z{Hk(3?c^Qz<Ncmu;;)P4*3LRuXm&a=igm%F6+)cO`%itEtut%Qs|+#y$x}}8-8&lo
z>G}?j4Y`(CyoHnW!#Ak8t~_-%zn;NU@@T5&^v5BJ%v@qd^G+T5(_*TVFyUKy)!rVV
z-!}698B@~hrd7rs2s+fT<9Xy<-;RBy$1?-nh3_=}ne!qgM*U?-xWSGlTO;A;4}aeG
z>tED7zmKoZuI_)@^j{07#bh20S$Rt?VCFKH;H|cQnL{63*{S(R^zZW5H4O`wUYDAX
z7bvGTnXBwzWk<Z;sZ|m))2ByAN1IINFn1TzR}JCG=u(`@9+0S&t~BekR#T_j^+Lmj
zxpFIQx8A-Z*l^Kv;`FEMB$$QVnO?bbl!rSUci#9p-+*t~bBm)JV~m=%ZQuU#Jv*n2
zhPErKj_<u=!iV&j7~@QqUV3e@HuZ(+tOJ`_ezfW&ekr?cc=W+@&W$HR8Fe0n`LV8_
zcgube(;=OQiIc=Vx5^z1PAD=iRCbN=n8^5h_cT70ILVZ>fMl`dD<zIk)^2QA&~IhD
zSLf5FOLJQc8kUqSaM=B4S;&P-2ZNU}DF+U4|B%0Rc>U}>8rPKMo*SsN$o=_o`s3}x
zFU~hIYo1S$oOQpMySLzDFUO+m>heli!ZDBLe0jt%b6U`hRnreoWG=AZ+j)KIkHvbc
zeS<e`-dM0AqvGKOc5z3>wTY7~v$tk5T$ps|(o@w>bC)pGFz)1CaP-2J#*4*USvE`y
ze`I^+w$p+0J0^S-o%-O-8)KX4k5)B3WX|k&5%@Pz{pN!tv6?2ne<3w|yV}b$f4hB?
z^n1Ev9)B8Rna-z~KT;mlsW~;qGJT$_B%l;Gk7M2uWvLG-g6YL7vnyxyKMpx_sUohe
z@$FKDOUpZRw^sdKdSqGFkv;$C${q0y(v`5^9l`nU(GiJlP2Nkh%>7eYbqr?te|nwd
z@ZbH@wCx&7on8!~r&TU5@2UJ|RKw|?kg@0B!WX4HFXW8&txn1n+%LtL_L}Eo-uaUU
zTVL{DOG<Y?$gkHfe!eW;V5f)Gi6adBFTYoQm1>j`b&b35a;J}1jw9>g*!BYc;>a|{
zf}YzfCq%A2EcyROoiTg%iX_XGFBiOZ`guYrj{lZ@I(x_&4c4TX);krG{2NQYA2Ch}
zi0a@7UCgnQHGti`jr0HQI0os<j%$pW8@ejKcFgKv_{Yn1s7c|;+Zv`xtB)){?|8yx
z#X;$ri3cu)S8VoB<KBJ9`G<-6dmVPio3Gq@yv;RDBp=kvT}?PBKB=wk=YNINfVu5!
zO_Lrk^j>RtW9ucc-QVLfMCKN3JYB`6ejxAj8@7-H>DJfkk1E>ste@bhnKX@wb-PQ<
z;UDS;<b$nr(_bC*xKbb#+P&k_i(p=>n|o?`DtMXXYeg@|G&J9Hj56{6`}x31YvZZq
zc7_kmH{PCk^IXH$j*jIrF(E3~D_CAJhg%%2l0AM=xUk7$muJGg&rydG*ZB2h#>C|A
zWOm79JE|AOs<Xg(o6HT#TdK#Dd(@^D9A9d`#QprzY`b@ku2-6T*0E(RX*7~!k7~Vb
zdMbuPYPn5|ep?Kmm{11elQ}_NGD@D(Dl*eg=zTcS+<sZc;lPhaJC|ghV)@9<Qq~Ys
z`r)j(!tSRUmp1EUuspZDy;*b5hb31hxF|o<nS532(p9A?lY=bQO`P+<(P2^}W6$lI
zPD{9^CmN~FT9W4DJXx-y+~IZ0SC+3^n2tV-4AR)ilfF(`>D!~%7M>G3TX*nJ?lODG
zSlWGCmwn;~EyrsMr*${HxXYHq{p66#W``elI|aODs^qsBE_96xN@Hj2un<45H+xUV
z?EIA{8%xerKRD1J-B}^0yl8^k1R)_)bz{LfqW=Di1%4<@>X|uh=BZ}&PdhUAgfGbq
zKdN((Bh&Qs-BSG-b4*3c^L3veVHMSh4mrK$`;*Y~wSj%7nYKQEBj|8{3)hzGm78V@
z^GX(~|1PL{^Hj-CwlpSZXYgCOiRO~WSUj#@_Aq8jYJcjcc6imZ%DrAsT_4|&GCjX>
zec%F-NcTC9*6Ye_zG9oA^Flam;quCNd5_jO^FGSs`Nf^Xk@;e+%l#AX-(My^IeTRB
zU7eHvI@o<}A65Qv{;?=H=1FTcx5%>_>|EBYP3_iIoWJc3)kpDdW<K|P-n-xf*Ib?S
zB0lEkuD5o)SAApFy)z%&5BV{@RlgD%eVzB7{Qm#1>kb&*xS(-Xa-OL8GFjh4PKmm9
z3*=Yayfj^Q+wBAAjpD8yT&i3mZaL3^xBEWBhtNeIm*2A1&w818XUE5lp&m?+7br^m
zeBzPF%WX~bKeAlT`e;qliV3`@F1Yru@t3IX*>nEPkB3I}&*yyk@iLzyd*&K8F?at0
ziSCNfMTRS4o|IaNeiZrFIlJPlljIz?$reX1Go(mP>0Ft?mR`!Men4mn3;Qhw!*j8l
z9MnIRywW`>{&H^a++fGtmr6eZpE)eJ5*nj>s4!+yYrzEG=+KE_4+JNC+2Rs?MB&E4
ze-VaR&SeW8%SU{k`#i~=K~O99)u#3ALOn57_c>y6dwUOLOwVa+3hlDUJe--8Gv99e
zS5uZn+YYYSEdGn-m|m*r?%Rri7j%Wz?@rf?y~}6cb-Gg8yVNqp?)p-<2jSPXZa>(u
zV7W-}g{Kb5hk2(&a|U|aZaQ*kdwzZG^Bgs!Bqn)|qmiQGIWvMDOsI47_#+u6FmumD
zhUq=aMK4<Zli9<wUwPw733bs~AKR6~<_kZFcquhoyWq*IP2a9w4q>W!60yc_lh@N7
zhfncrd#R)zR-kd*b53KLqBkq=_q$5_rfn!*Zg5wHIdHay)DMo+_6n5^3|^O+Pb6FV
zZ_-J;Da9?|$rUzt>5^*)pQx;9b5Y!&^5%foMT47h*%x-G>z%1$JFrtS`~**k?Cv`U
z&wZ9Z^!&u#pX<LfbZxw&|977E{_o!Lg)g=Df3ep4drtrFH1GXiz2l2sdhh?jI(^><
z@A<`<$$QT4_%bv6m$;6|!T3Ly<ac~w-~Xjr@9#bRT2ZA352nWdlAT`ne0tsKrT2d=
z)pwS0{qRY@_mcdIFYRtGzlZ#)UHnCK>b|Tgb?!@f|9qPA@kCI{O~<W%wN*YLpLR|7
zbbRySe{5&mGIzh<Wi6w5F6!A<z8R8TTi#5#)%KB#@4aRr&x2QbzFOCuui8vpHRs41
zRq2w=)8D?${b+W6eFaOv%%3|YCbtXT)%+7(JuNb%w)fWijxDi;WgGs_6RCKsq;y^B
z%_E_2b5*8Q&h=3(I8=G4x;*qm=bTeHhiq7WIehPZw~!}P-e7^MmDQQ%iPjDYel-s2
zZ<Z=;WID=rA*^uuXBM7E%ad-K-Qzpz|C4uDh1;6rO6xTz74}xKyx69l(3bIxfsL=8
zYeIEJtK{|I6~V10`?4k~8~c8)VZGnIXP*9o?6WIm>t~p*TX5TH=Ylm$8`97CZI4X}
zK5#K;Cv!|!hbOa2XRF%XxRp-FE}MQc-qv)6t9HwigGw9yIel)$vM*<4dbiL+A}e9q
zv>es2kZmO^6Bg)R`*DVS+oM+IM?ots_eth0ZajPL(?2z{P5U2J#1!jX`+Pp@i%!tl
zIQwb#d%0KLoz{Ni_EN)Tfv<e|qgEGPFKS$}KxNkwm-YJmll&qp1pL(sDtK=gaO|(|
z_p5uiEq~I-50{=YZD`WtR&ef~)b#Ek%Zguo*Y`K`%6w9cSyU6I8<OBT`J=+mg%=O7
zuQBOziR6C0h{1{dAX6&i)8)#Gm%Kk@{O0LH>t)$d{P&HePhNeiwBb}T|Hem`@|OjN
z7;gyD?|k+3Sk!Ed2W%JS-=88_<;`~N%huQJY66)IzCRin+F2ZLe`YG1!p@|q`h#Vv
z`hm~+cbet0cowA=%{{Vm#iLJJBKr;N)J0CPoWHSr?Gk5xv8nUcHEvAf;L%*6q@!iF
z-hF`|-xLOQ!(V#WDtkY;2BtrH+AS*(%_=ipb<(@l`7f8tCHvalx$jq3{Z;p!S<{wD
zKe<%1EO=J2xVl=nXxU5^(J);kX5iYs|Det#qvMPXe%zOyMzJfI2)3rGr#pOK>XW|W
z<6%t?woucaB(~Cpm2DwYlq6SuRXX;-U(Z)fMx<@-%bN%JeA0YYbMIuUy}{yN;p<d*
zX4*?HG1g4sPhwU6A3~1BasT{oweahMrONdT^O8&%BAu<d5^i{Il6?0rWS8<=NyX&8
zk4rbGpA#=EGhOYtRADO1D#n5<H)RWsM0$N&`+wFH(*;l0tXj^gp*@qk_eCo28>VF`
z9A%Ml{u$4G#S|o1>TDS1GkBPGF*XEEP!LvHG(C9huH#ly60Cy$=sC-BdZbRA{6}!H
zj?+YyJ(cs?Pc6T6beGq%!Y$U*Hysk3y|h_0ZPOJU<Mq8qJnLq*s8#+xtQ}w!$sMDd
zzR=Bi((wk4t?K;kQ?Iw~Pkr!sl1jFNzSC2qEo#NhMmG+!7Ff@pP${rDEqqnGpWZ>+
zy*z7g`<k;KYLVKoijCiIvu?li(=&$+rUgVtndDzqb9pt(a<1W=*=f~E4TaWeY)AD&
zS(jSKC0_|__`P-KU3a<c#6uS?W(&2x60Kfj#$mt2mtj}MIYD2J>RHCU#~j*49ycFp
zIB{XND7#Gd-iUH;6UIx$suy+V#(1)F-(Y%qpy1rWOM<2?k2G9GvX?Ksc-{QLtm&WF
zzJAT@wR=>-bE_<a&*-&(p-j3W>y|0Z_6<(<*X&I0v@!DDpJTsJNr&NEXIN@WmulV5
zJGw6dmio^9@YC9p`TWe~zccm!IVYS~pUf5!P@rTrZ<5ZV1&bX8Tu+{sk8=$yxXvS0
z;@)05XYJZ%o`u>gYT3Ve9JPvkEGTuT{B6<Qt$w=JhUa!?$NgD;U$vJl+g(-R<hh&x
z`;zUMa(43$d#cOU%UpagrPsFNMuJ0XwZ}qswp26mwNE%dq$bF+?5<nzC)ridV&y{x
z=AA+_Efd803Y7U4|J~ttbw!`HDc^+F$v1t(&iobpeN4nx$(TpWWR;##>5YfpT!Q5<
zS+}`<;`+BpRqE;FP4je|bn7O6<Eqg(|6qyl<a&d}AJZNjlTleZjkVUw!8131^A?Mc
zQ_;+KcuXD_c3xu*xjvVD<{GQhfh*qCeE9xmTdaio_E_bs6~_&-u1x-vWWe+A&(xz1
z{g;D{W}giSNm(o?w=u$4=VIC_o)?}6tR(F>wv|Rq>}$L!>o+6lXn@_c)t(<3eid%4
z`I;NvEHRx`&Qz*0`C93o2iiR~SKY6<hbl{*?(cuID1vQE)LZvS^GbPTPnjQ(VbPB1
zx%xyj%BoqkR<exok^6VXr3{P`#$k2^4NPIL46hy8&FLBT^r_O1J9iVar*io0ne!<l
z|EK?_!`druu`-ESW%18iIHmMkuJ1ahA4PX>?uj|L=*~v9(<z~B|14!3gp-zPoJeeT
z`!kiz-&dDApFL}*=<j6{*ThYd6#rLu-IDWeM5mJa%!=75U)M@Zc&`)3occ^dcA9fv
z{N*QH>dFSkqSrd_t@$XDk}{?J#P4Y-TyjR&v?EiDWHtBsmM3WKG%32B68NNnSNley
z##fIMSwcZMR<Go_q%sO~PKLbV_{k$|^fdBzi(u!Eh#<iS_x!@R-|L>9>u#H{(SO>G
z*`+Jq{_c=VY|ndf;mv*Zq<SvyHg@x@&hVuRt~zz++diK#%jwZcUacuVB2S4*ZoPi9
zWvWHBn)b2ZEMk%pg*Qy47yMo_r{Z$syYu%oxfGk51D-T^Wt|F~*J^S1{?CG%vWC}D
zhi7Qay2p5s`G~T3+uu*DTh*m2Ho0syU3o2$U4FsAlBC+FAIl{keSE(vSeaL2o=MOb
z=f}tOWRL!ET>bUcZTbH5=4+-OR-4~Zetda)gW8p_<7?I}He~cp{IsP%;-iD_o-?{-
z$z3z%TO3^I&(fuk=Detg+o?TF{Km!jvUN*u{hvFFY4!dTn_btRh_2bU)7bfQ`Qk^-
zZ?gl%*eWOGKVrJ7$@BfZMb)<lU&IeSTKvOh!@rQ4W4FtmybhV-a?A3>y4>$3wN0*}
zYfs%>?*DuP>np=w?elM0`~3Nu88l5n)$Z&Q-uEI#iC+#d`xb{zp7=T0SMJl?AIc9u
zJZ5qGD5AP}xq;`F3pG4{1e9kv1>5agp77_qlHb4So_%(`wT&SgeqO0iI_HtDa7}P}
z*5--x(o1HquRF5gQDgbUptH#fw+HQfq1`C$5Lo9`$l%bs;)KT0wI^A2wO+~7oW%Oz
z;s0EgJD-na2ea{W?%uwsgnvSH$7TMBGdt~`bZhrpe27w?f8s^#(FJ8sBKNQwz7b@v
zn$p*OOKa`h&u`^sKi(hp;m<4eBW?F~yI;t<p!o0KcQJ;2O=p%lY+0-6eBI-PyuQ7B
zZAJYTv#Ra&RaJlfot6AG^ZrroJ@x0N$4}k=GkC#_x((WAuJbBJ_4+UHW5`*%-)@2F
zeC-<%wbc&MrJDjDzf$CF?CZ8!7#AGUAa`k+w9T@oDYor`_BC5B?+AFCxA~VNZ+FGK
z^vxx`xo`W~9U_jL4DDU}^Yq{7x^GLQ!?@VjaNjFrma5eV>0d1LT1WqHu!Vmhr@;Nz
z^Yb~y_AJvn5;|KuFzfb7R-@x5n;t)#WU_X8rDjL=sg=zA>w8u`C}H>|v-EutV}aVM
zZH667PPWt*vDj%;axk`YX>MnAp55RO)g^uFR*82s<27csw8tx=vi9u_T>Z>uLFJ*y
z1&^LJ{QT2z+j2eq`8DO7S@S<Qm7e4)|F}i3d--FP>Qf$9>h4sAy)QV~a;V~X(C?(c
z!zXO6Br5dv=_lRqJd(^E`&;ANB6+(&JEuQu++GAocdjVBYxtqPN$9qpT+FxQzyD?W
z+hqIL98<n-UdrEe-SB7YlyzJ0&iLrJ?`_N02X{Z&{)w00u~s3yB*js+bVVJPi0{O^
z9uI$SwqMm|_PMRkPa&%0>!SML*r&&oJGOHiP3qiiWo_BKH@LydqO_>X!8mK_y6ZWs
z8FQ3Fb5|?od_MZuvSjOD&bHr`)^7q6K5Sll$hFXLL9*XGC$9-t>k~9y?<u<*6UW8$
zc+JwxH5VVAEau#9y}0<SYS3~Y>$g|VA3NwO&b&po^F3>YVA<Ch@^)?eGw$7z5xk}T
z`O;_6Lhb$8@3t>p;8>XvBm6`%c+LK+y;TpsC7bPS%QKZ-{#w<hcHx~hdy7ru^#1o9
z-MxAL+`005yZOG^%lr{3c^HxzDfliaT)(vHV@OCbvsnA1C(efZWcZR5R|Rg6UKf03
zUvp`HdhhPUSMOT668B8B>S#UFs9>vmQC8VPn$hsho{;HNgjY`TJaWC@Mt6mgr@?H2
zqyGM?Zbe1MnJRKyg`}HU>I|o+bgL*lx#;_nD@{P-$sbFOk~fXt9E{6b)+KaL`pC5_
z;9M!w;_8AOi{7hTQn|TAr(9BY&#ftPS@AROOaIArj-OG!Xx5w31$qwstqr>q_N+^Z
zo3X`&FTr0;Vw;?Kx#_)6P0nwgd|=^t;kD`9>T{lfcb`03+&r&e;nj5sR+qwMTDm?x
zdCpu(Ob+t5D}H^c{Be<G?_s9D)>cBHSA<!6^}>s06?m<jv!+lnSF(J)i-UmRgf9nl
z@05n;Wo$c=&+VBr$8(mS23NOt&uk&9>$6>5jaORO#;$pk%$L;jU};3`+7CA@RGBZ|
zy0dj*;C)j!X&XkTW9JN;drIy#-iq%^Op&Sa=8ONtWl{IIX7%iUZEId+{ABuk@`FNt
zlH1aqJS9cP78f`vS)`xn<qI`_R%gCp`J~LQz|`FBt2c9W&0h54!i^-|WoPbX>#XRC
za+@Q5!tX?0(EN%!Yk$pWTjtKWkUMp~w9U-qIp3P+IYvl}{&qJnby?T-kXa%7>fgK*
zIaL)58QEpKgw1ZIB;5B8QrWJ&`^laZ?Fs#lyxcA?F}OLaEJShs3Wd6#{tF#sUu}ur
zn;x;Kr1aDm7H6+j8d5799KHHmbv^b;e6%a9^PhHEWBK8YCF>r}(@kLa<-aHUX=mgm
z#+U4ql>S_3IzA!f^WpU=yIQQC?N;tzt!-7YnqzKCD~rpDzdWLiNySMl<`rL098%JI
z=T@Q-yD-4f!~4_6hir$Z1ZH1bXQ35yR(wLFXywjDaxsNFFM5V^=$@|&I<jEZ%9SrS
z<m_TkbLfd-;+VTte%r&FrTh7HLU%LwIjekUT(bK2gaxYeA_C(0W^I<;xLxhkda3Dt
z*3zpQ?bb|`yK*dSt%pi;6L0wGyJv(l<@|Tr_na~NA<2{Y{L1H@Eq#p)nkS_TzS{27
zx^q`KwXET6`P||+tM)~{nayc=Vr8lPwtTTI;){Ilxm2BCPCv}IJ7M<DiD6%~S3i3{
zsi?C%eTt8WqczX8EdGaPrwnDAQ?~N-Yt6pbyl>5irmlz!SCx(%EVTcY^_1PRU24Wk
zp_ag2uVVsF4+f=dm7b8Auh5?RXO?E-gW47jkBQ$ey=9+&xZ=;6^o4TGA@R=dUFBRG
z4w(q(NL^V!d5>CQ|2wbcDuRXj%F6bhUR@45UNlH_7fy^n`9@QRJ*g&Z;>A^W_emwa
zQYy_qbbG_|Y3tKDcf1d3+c3rWh3VVd`o2t^j5~My3t>~1({Or`_w(wChlL`JAr~{>
z9`|4Fm@ZcHNU~P!c}eXNN9FrkH<oRdNv?b?Iw#2dq*vbVlTUZmc+?+#5nmd0Yy-ol
z7>PRtK}uYAvI-XTHEVO+GJWULX<IhGVULmG+mfD*&qbml(j5f;PnhYi>Ze@THv5Pc
z*NJ!D>eK$87gdY=yLquk#Ucx9A=v`0i0iECQ+}WNu$J+5r-l1tm1FOG^Nz&@ES&5<
z!P~*_l|NJU!xui&=bYQL{8_?_h02T{4fTHfb25G_Xq;%YT%%r7S6^G)YQ|AUwx~KC
zfg>FgJ-_$NQ%Wuf^37t+-fn&QZR=$1Z<kJ=zG=;Fk)kHk(K?NPs$bZ`h+`7J7GAZ#
zdo1j=bn98~>hq2Pi=v)OHSM%ZeB~2xq2bXzyT38pzrPj_oA6Dqd+jWq<uSWU*ndPf
zS-LM>a9f+H^(%{Vf#%jI))mQZ38EodywNTvV$Nxm&U<<KFvrJEskgrsuK1T<5VAE@
zR?c1ad6y^0>rTU?$>sSE0!xEcLR%ME#61t(&Zl8s+`Z+Dgltq1&*ieOzOK9P{F9j?
zm9%zuc#*D#sD9cTm*~i}%R0&1vcmNX9_%sy$$Da!vIcWTpwzWV=Up6<9R&_{Yz_;w
zxV&c4x^qGb$}y`BWcGdF*SMM9;M^?BeO4f{waCySuK3Y<x2IP8_X}UKzJ0vq=Awr;
z^(AZ4w=XaL{pr)Bl!(do)*&n9E-bmZz{?^=bNR~6e#|_R&%Aw6GwE&OjSShcr>`cw
zzPK{_+iFiO&aLwg&%Sn6K*v$y3$whbsqcS_dmh<5?Q4(kQd;wB`FY-pNye(X0&>pk
zS+s4HFtF4A=n(i+Ps8LsN2oBr=dU-i6;pMmxv$OK@^_x>&(BuV#PStZPF4NA;{L1U
zlQ)0PQ+oX5NUVw5%yxO7q%xWK_EkE2tUFFQs`UPu_#`1Cn6Z*4Gip+hgPe1qL`3sh
z)2a|Y=bW2j$!9qiTa~EH5;$5Tu)R_I*vePG4z<_Zd^eMIRr}Yq`tf(~Rx?*E{;w`G
z*(vEl*W<6^eNxA&x{GW3JUX3rbw){T_;GBNm&LltfdW&5wYa9$ie$vwC&$06TCzDI
zz2s`mgL$lpP0L<8PS?72OUhI7U=Gh#;}*t}3yY8M{2Sx2HQ;W~EWWmiX$3_u!<u<*
zRy02?@c0wECrR45^q=B(*4Crem->&3TKr1f&0<&|{rrt$an_Ef^B2!b&@t9<R=w>q
zC7$QYwT1VORET|h!?t&Er}DXXJA?Nvo_TY3Ma=BlJ9$sK*2`{V3ZHPIQTFp~jtMsN
ztwN&9xFi&%vtsV*nrIcb8>ycQtO;|zQdc*1UCi<++CRUgR<kteSI^=!NtwqX<yQ4=
z)%%WbCJgzH&aGZ^{bk+Ow@f>~#tPc#ZAv>7CARyba=QNgiM!b+uRqmQQhLkKT0?4=
z(#9y2X<A>sChl|obHMB9iE}+A<^@lDtY^NwvHq~qQsK87Kh3WWS|R?)aG7b5XQQn6
z1?SB+?(?qd$mVfya@r*%tx>(FmbPW(iN3kc#_BA)ieK>g*D$l1%-^7ICTp)1`p@Dy
zi&)0l^UGcoKAyrpWzGWT)3X!jdG6FMQP|r%Z+XHm`JYWM`tHfj5c=F1n;E-Lv*V0$
zS>)`qYkNL?mD8^3?A_GzJp60d$x7amNYU4hvlIJV9&GtK{VMCOo0bpD@1Kx5>8{zM
zY;-(8{PjCo&)afWFD~~L%hr0K>vc!q@?(vePdDwp^(rebWp6h_-P;f6(`w%sYh8IA
zyr-bwVSk9~jxTO5>o)y++$*?fiHP8i^_84%`)(epEcE;C9copRe*5-q730nM7Kc|K
zJd%-gcakdau5Iy`Q<bNt#N<aB8MePLF0+{Ed9+zB@Ac!Lm0to96q$`~HZtT3+hr66
zZ=QH;Yhz)P)~Rpo%kzxRM|8TL%;1f(m~9|+jX|_<!S9j-xtDd{$ojAyJ$&ohUv0BJ
z$7V=X_}t!iC2Q?gkqZ;Px2RVo&)jdhVnuWQ%ag$cvZu<X{9LwYOS6V7%gsMR;%5`B
zbvJEl5-rKya)dMB46|Z?k=>-dzMQ4Dd~&*zB&VH|7Iyy8a6XRLxw7}l>bqyFU+Ht_
zzPq)5`t}UPD?4YD>~U=7+NS$7FPbahr=v{9lqtuKc5uygeyqLD*7m&`!{#e*l`oZe
z3QGP`wQOB-r-vuD^Kqy1d_%Q#-(YW^vY3gx1<xNg&YU#yVCUNojt-$yCht_u7&>ha
zU9y^IE_&vi-k}OBSpkU}Q~oraY@L6$QH>!bS94xn?8$vzGxy2ruL(DNy&S%U-`FIr
zeYeiC-2P0HfB1aU+L$#m#jDjyr`Be?ELz5%KjWF(PcQ2QoJCrf^JL;;V)H5`%)cx(
z(veuYMf~hRJ$Jw2!+pH5{a0u6xUrR2r~T97|C`6me|Me=_o}z^6k`J%?<Z$3?f%#o
zvqP`(W6tlLLUk9mz4DmZ%lb0sk;?wSB`LX%ZPhQj7s^NenDz9h`|~dkFPMCs*7JaY
z>qbu!ujkcorCL4`_5L>%_Xg}=@y2SahWHw*W!0>^zAY?#mc^i}+?4)H>nyAP9npEM
zG4rLmp1w++vfNY5q>R~)+wiyMoTb7y1;0G-kylU8Tw3pRH}RR)JGQHq?GNU7e$7w6
z_etFE{@Ycy?o0k{@e#^e96h7@UEi+i|Cje_m1moz9SQr@D{}eiW&7L*s(MqpgMN#}
z-d5ZB)$*FaVHWEH7dyrM|9(DaY+w8F-&?uOU2$)uzFvRC^xr;kiFVUOqm37LG%m3I
z!muLU`1h;r{4>1sZZzk=*)I{(&ocLhSI38p!(C?IZXbNT{dfMkFLPOZ&8I(-me1ps
zZ+`IQx%tI|Cx2f*p09LfqPM31x@QxM&MqjB=DBV4QNf~O`~S~@CBGiN`1<kvGS$pV
z!TlWt&bPO>o5bWy^n1x$ZCg8M-mI?4S66Lb7AhD!*JgL0$)%~<)9<Z%X?b_e{Iw6$
zf=^q!noGYr>m0vCVnJ<wOEiP*J7=GVc|Kd_{Pf&gCH{0$Ca*(*2Jhb88<&TB*ctTf
z6R*&6Z>uw2V)m-9<xAZD4*8G?9Jh{L+3GKn9(62xu2`f`_PG-s>C(^bVix(|l#5lK
zlx&r7)Gzu*mvv#_k?hnU!BcZoKK$#~v3@*LMDM4OS9ja4o84y9va2_Iw>v%W4)fcI
z@*hfhg>D;6Vp(dh9=oheBH2uTZPMet>Jv|$`YK{>KQS)g*XkusqFX~xg_<Y7;x~V^
z(N4kj$anpJpWfbW)?OkNDfs5!`FhuGcDomHceH|5_MM!R@{UDox(SCLGuv&!v##pf
zb|3L&yKMV%cl8^`yypVH0<x<LjY7UJI2f`wV7-NMXdm~*wDOfT?ix22E$RLyxicp8
zgZ*>aGA5TV?val|^S(@S<?G2<B;Ik;;POPXlw{v3&y`$L-!)`7N51Th5nZOt_GxKI
z)#Y#hs+AgA_gmj`&5hkF!}@J^OyAGeRCAHE;-@hyjr*8tzU$_^<Li(KSa`hi^GZwO
z6*B|Om0$2|e0%r5p6|=%CH2gvDsvqZww7p@SJ{Yv{kb=R>AC*C>L$JA$DD2p6@0t4
zap{#n_2Vv|FXztPaR1)B{q>(u|C_yd^NZ=m7KfEfJ-(eke(t1TQpSlN@!$2X$=5n8
z`co`<D%wZVDk13IV_#phwdWtRE67yu72mgCN@y#~$NOyEvn~F(1;%(v`&xH4@Bg<^
zsrXX9-@fRIoOGtQzgArDC=#ihQ_42I*M}#4>V3u@ox3ND8yb(Zo)D~XHC#RE%KnI{
zQ_2r4JpJH;-%Vrh)hjOAu9GfZeRgYfIkQphq+jdwn>D#5vi=<1qc+d4Gp}Lt9Y+4o
zZM!9tb|x$+5#6#caMt}Dmqgz&=C24?qH9$3%Bpn3j}_|=*6m@AvU5vS-*TPFV*mFk
z#kEIkmhv6A$N22=xrZ%fKkm5~t6%t968vvvePY$_Y!4Un1s#F6>L0I`_15tJq_m}A
zOXE|%ijO6yre)Oe2b8JS>Tk14_<HC*YhF-b+WUyZN;?I<Ff}uq8VKm`ejCMhP1g3|
z#u!DF+`6;fDSi4;N^OFlMFXlt1#jJRv(hfHKOmj?!t&$--$(aru6=+0zLTR?&aUV1
zt<4MO=jNuY@4NqyB~>j=Vczt(`{(<D>n1xN{%Tv~@Z?$Q{teTY#d$1G7u>$0)U?R<
z0`IcwsnZT}bKT9++<z;jGQ-{L%M7_~+qXLgnN5`Y#<hN%hh@!e&Rqwm9R6e$w{Ajb
zbo-ipfqm0vzg7{uR^gEE7b+EW`OcApVf!OjUEX=->xwJOO5z1Xb{T)*(QFW1of!P#
zJA;(g;(re>zHDFI{P*+X!!KU^U4QXq`(*QqbuU|Y8awy2ww$fM`~L#dMH99U-H$zZ
z|3BZtVsX9m3U_kk-<tx7%T}HU-|0I=RA+ruWb0h+riz~eTi*o!m5|-I^fYhvx4>|o
z!2f=m92w5-R@^dKq;pqs_)eBTE)i9d8&6g8YcKr1DCo>1KQ-<9v&=ajFs}5Syk*`a
zUhfH;^qb`U{mz|R{P;V2e!ZoQmCZi^29~}A$x<`+HxGaR`SUElzy8mL{}1!OXY{=+
zp4%qx=XdU6h5P;&?E5B)$I704R)6Gr;g%Dcd(XLkxc)c(`{Mb2_hd`ImfzgX?A>~4
z{bpg$qv1)$@hUGjaMWx)+cp1pZbazhv|IX%&6%YB>OT457d?B$`4yiyTA!UhcH!>g
z&u+R^D{GIln)SV^ypmf!VcR$RJ?y#};WCr1Ih@;@lPmNk*k@VsZ@>G8kBdK>F!v~9
z=m}Z#PgC`_n#`5enxk}Z`=tx3tsN$)?Cxc5-#hV1<dGNU6)*0!sV`f8zw6E(PXBTN
z&AAJXeE%+b^3<N|%T_F`&dO=1Jb3)w-^|+ORSE01Zd>0a{meV@*1H94d>_BuUAU~=
zWkzUjjznC*ma;;|1O=w3ES7|u8b#(>H|syL)|DJulD1^)?c~+^&lzT3J3ZAur>;$P
zIX|<U@|?ffTwJZazhC&7f8jIS7qow;@b^!9@9(iaajh%Qjl20b{{`*UDTh2;_wa>q
z@oqg+YPQbPfA+oSu@8UD)LH)Sbd{CH@sOie?7SDf?-QRJssFhD>zzWAedo7!eShCK
z@8I4;|Fs?+dwcj?qki>Tjley12N(WtOKm9l_-513UAYY0vn&d>9V|X05^gP<y(+@b
zHYmQKOo`j|sWHpm)tl-Rf($wjcow>)Em$yrj;>6T!I!EB+y?RYnwu_PWZoy1Z|QeE
z{$6|Im5bbagY|!Mt+>=+^(!Ix#Psro4|dr8agVxkk)=Z9*84nf3(;?Hx}SU%iDdZv
z`~91JbEQsX-kTE<?y>3BA-Pk$ZB{~es@)G+U9Y}%)@fI2xhc=P{e~`g{+{bB;$Qas
zN?wDZ_`Y|{N1ttenUMFrIq~z|3I&U;;(DjpEN&lvmD*I{8-F~vz<c4eV4g4HR(DQv
z%}WXQV7Wc_@xsH(l9y**a^U536x=`Yh2r8zZLdPz`dV2RubvnkrV+Rx^wUJ;DwauC
zCWz$a?Dv-Kcz?IBxYg$Ay`$R&(s%xF$Y+1H-TJ}TnyRA*AKu=+w6GyvqCEQPqZi*7
zU-IvJRXI!Zw9QGODHa<uIkO%y3u~$zT~O+9r*VV*qa@*F+oE^;di{@mTini7D_&)9
z`+Ksa-QDi%_n(@tl5h8xDrr6leC?up`*q3wmqi)}Y|R!<XLG$fwRn#|k9x+*h&wOE
zo6{{~A3R+<r)I65$eJ+ot||L=aJOA%%3sSBf3G!pVMbZ=q+8ctG(FsMAp6(9q#s-X
ztC=THp1b+`%e_JODzAL&K4Eq4enkK6O6Nby+iuq`H%hL0@ARhN?x9zwqaVyWAMGFU
zzRdfC>Kmq`(-poo*A%j!Sa-+#NncQ+OD9)fK<1Xn<E?r(SGIlT3{6t|_WfeCr}T$=
zGBOI?b_(K~K7Lr)x?Dt3WL={i+x_&%dn_Wwzb@%kYnfo#5&w#}{gC-1r2}W`Bew>7
zozdUXZ1Qmi&n4S@Ul|s5k!_Cp$NDaN_MUVpxfJ#;C}4W*&n2Npe$}TP{LplbYl+D@
zU0H*}%d*9*4{p%j7W>%swcC%lq(4Rxg=dr|>V7HOSvg;0+K2O7!{zoW|I>WAFEHsu
zO!TF_swFp++RnP1YdvT^ef#a6WWytd9@VpZyGu%Yl*;bx^EJv$UwYN`ul2o!@9xhD
zZ#}2VY`-_JJ|^k$o{UFJSEiY+E4Esa_b$WPUst5Odv5H?v$L;TzWwlFt<v1Xug#b3
zyzVq{#jMtcJi>}hg@5D`Yl}h09C-QM<?~}>U@#KFSX-Q%n4FQBmztKD13KzpZA7&H
zV>gky^Xq3EYECwdnDT9*lh@Xqgy<~}7lf{aDR!xSGn^S)tu{;Y@Uo8o_ll2AztI=D
zDWkW*XnXO#;@@d%zu!Fj^<{oDw_uY=L4jQ37A3I-{Wni`wR>AwaPd|D&RG(ct^02J
zG+EhypI#rl`0!%>4fVBR-Dk9NXM~>7YxMo_U#MqN&eE&t9J%Y&FHOBP?dDgn6V=Cf
zXHSV;IBDaK_`+O=>9wc6RBa5?<c_#FSxmU=-IOKjNr8OUx#{uF5s?d3R(0Q0nenH(
z)=d6ysoAfJy06a*`yWnT&lkE&h*RM~($5tyGR|BSC_H^y(>$#I>+h|s#b@7cdY(4z
z^qG|$y3&ihei@mD@vqt#x&Au0a2}8J(u=JVJ}_3VpKJJc*UN(^Og{<QyGuKsc~-30
zI`{l<wn;bA+3PoGt18MbPoMvnS10Jw<~I|)Pwz?Yzw?{*+727Rl^Yr|MA}^KxtM((
z*i2OwjLvuvf8()Gitn_820;xz+ccbxPbprR*!hDgC*QbW4nL24#iWCAs)tjwx18bE
zx+BVEJg3Sz-z>o?DSN5VyK9pz>(*})4|F|ujj{V;@TBAw{TDZH7gG1%n<lY`v2V^|
zlYJfu*#&L89NM&;x;>8EV0^~On$h;~laaLipLdqa{hGKFV_u|5-_P1GbJ|o-z9`l#
z<=t&|-%nnTc)7)3QNjG9QHQ2qcI};Y-aqz((>xUuA(dAXw-~OG<5`s1yz)tCWof7A
ztuw2qUt0e3(y2#`##)yZT^6-%nwhr6=7h1R?e@8+>Wb4m1Po>8&hrhNl33E)8r13C
z<|uo*N9pqu-x4-Cy<`21pY1*z3AkKqXC5kf#`Tj&^yTub(yaN_Q*(F}yHAE%Y=5>b
zYmVIN>u33@<XU5srZ{}N`^k3}&+3}Pzk0TdUuv$~?6I#y_1xvN`993Y3wX{tPAuU1
zVs}|;;UbS4Vk<4D)=ZZ9y|MhH@Tq`~h*{73j3?My9<YCzE>@i5?($skiHhy%Qn}6Q
z72p2EIbUTf{m8p<y^x&K{p#<}kN)_3^5~zmn%|ivX8%p({O?t6t@&IoR#Nrv<*O&3
zdcw4uS7uCST&I3y=i=J`UvFI5bYo|E-^Sx7zHsL@+dP_UmtXLe|MSmj*57ApYnZLo
z%4ieby77h4t?26>B9n9*QrTP+v#iq6Qw2kc3YgbO?|zaNcjjgF)Qt1_hw`W8O;}sN
z%yL}j;2q9aQy!Xk9}`%$>zz>a{-wPNn-nj7aJ#n6T+_%YZA0&75o^<sU9k$jy)$k*
z_wk->d%JJ8e$<r=C!L={$B(t%*qv9fIQYL?P)*(s$<Lwd+0W$e&z=6bY_`;v`qK~P
z{ymJ@K5e1E`*UX2-}dZ%*0T5P59y-6joFUX#>GCro*WT4xZp&UBum`pXCDHTQ<li_
zF19jv6fkKkp56ZQd7IL^cN3&P^v<^~U^G8sd~~Og#x_HB!B&w69J8N4kIM}#d>F7&
z$CFEFPVO$ty_Y@X@|eYpJr7j1m84$3w~dc?nOFV-*N90T(Leky&i?E5{Y$~MlhM9=
z^PjHKIxQvbCVE$E!-@16>uW#EzpbeIpr+-k^oh@5NxX}1bxd8_s>QtS{mD0dHLo15
z9SffF=t^&J<-*0*9&M*~Rr^(1oOya>#xi9u%ex-i>!(S6pC`TJ(7dL)xaSRzt#)!N
z&rvpb@A;<TtM^XxJn!O3(O=^gmi=tx&M@tA|H3y>H0TI(jMYSYw@0DV^c?;>G)C-u
z@my8nqr8j$>DrAwbDR`aukfkdzgDrxG`>9JR{G?RFC`@FGz-*CN)BFX_;uJv`XfUL
z^RcdT>k}&YOI^1<F^VdGICo#n_h0wQZ!^>>3Z7%o;;2eBIeMmS%acE*?N41dbe>$-
z<ZmL^8oWX2O~8bj?yGawu_WDI6Z!X*)c4me#S@h?Wt^n9>@M78%-+AK?=suDx7W`c
z)GB$-%;SI8Yi{}PE%x_H1M9rqnpE$o9{KuPKSyfkf8lS&mwn}Ycky-|ao+A|efzVo
z!qbVrHw#UAa^=;M>iXSND{_~``%T!wxz4-B>ZOqTv-XWm8=oJ!v26e2t0wM|cU`vY
z@88N@^?F+1j7wJ2%I+@CUvufhBh{!y*X6lxFpFiS`rJHWdd@TTb;At(S1vKrpI_Q~
z(d=E1<MzTH+q*nzyru`QU9`7v5?bY#Yr1F2nu~WLum49>LZA&UDhgumjRFh|Vdf0z
zS4rk3=jRqcYM`^x)y0pu3I4x7pXuvTXRWC#c4sd?xgu2P_)hP<qV<;6xmMfS7kLCc
zlJzuT(Tx83V|RHu;{*lQo1auNtBpH7ZN$3o9?h3;nYUr{_xpcsD(AM?Ot1N*^{8^{
z5l;Q|H%mAUna;QQK2OdzarvSf(@ti^ZhY=P-#+zu_PKinnnhwCdHr1{9<&Mjs9<f?
z<vr2xe*f!LdOP25R?&8e+^BHgRWzjY#M6rxKYsk!y+><%t4G2-p3_TKMCf>J<2mGS
z(;u<nRO^~a6IzwDCrzm~c>Ka+vd|@)S{AW0#V5~BzGKGxWY@Y$SN4S7RyrB3GvQ6l
zM#(Odr;3KDKYA);u4Ia;CN4cD;<(js^3s>}{OhYG&&xa=wDFbs!jgnpd1mXE&2IVr
zNbL!$o?V)J#RR3NlLPkFvmE^4xN}nSG&O~e3hw;W4PVV2qdpr>-m{9kUb%8#p!Nl(
z(^j6!{I@0rJy|j-Em$<?^7+Ysk}t^TAG^SP!XoYYy`TH<?f>9kUs3q$@#^jO&-Y3E
zG0xHncMb5WD`9C$>Qc`r?p!Z9In**~^7@7&*$Kay;?`gJA|#>rdEwa=E0tXZ=1taE
zvBUq4i|5N(?UJ7JI`)fNUiUf5v!=_m`NkB>Et@?9)ub0ZPVm<7;&Wl<|M$FSkIOH^
z8B?r-OgeTeOx&|v#JtS!^(Gfhrc{CX8ryXyZb?}1WO>T9vhz0{UE5H!{excd^2o#w
z^FP}?Wz^B(mTL-W(0RLG_4EUeme&gLg<%IL?iPEhZt`H-e6I~ltP&Q6i*Axz612g|
zW2R2<5{VF(ZQHrac-d2q7RNO)D3{F*$+p<*v*hC8*BTphDl{FN<Szf#-l@obXOl{M
zXya^wT{iC8^LkFPn`p3lE&ddk=zPll`@ZJIozqOs!rIcmdfk?M#PZKp)UqJ(;5^B`
zL?#{86F-&+3Cr{~aZA{Ktx_pYozy-@DzWOM=i}0Of11Lw);FGb5bjiX_F2w#uE{oH
zDNQCRK?gk_PW>XVP3Crk^%R>rW|`B>Z;A_V&+X8;uN!bVlF92_czweCufFCYm2=iG
z%u?R=^y>A#TSA&Uy?sP%$}8o%I5^JE-PNTYZ>7v~en+ZLQ}+p`8`gOzy<G)%8fJue
zvYSXvluQ4;l`UBJNU5N_i2DoPDSIv?T(Nq)OY9@J>8nEr?^-*2^e<j^dtJ_pjmu<Y
zTQe0@B}C2UUcRy2Ao^neYm=`NB|bdUFx5R6Qtf-!{DaOlX|7GRlS^gP&0o!xx^S;{
zLQ&AqecF{${a^h=>!L2T+MQ2x=gt1zEpl#h<~OgZ^0_mO)6Tn{)!496B*b&B@;A|H
zv)3|7Q7)hTllA7sma=6?FD<ldP*0rFZ+s{1UB)(Mp5F$hC-h~nymYI1<aW3_`fI`V
z83#RoPw9Srr$n*z$knu!yIU9Qo)K$&^yg)$a?8udtqZQEdA#Mj5OrgskiV+@g6ooe
zU&>~hEtXoh_jqyc?Pqn@q?K)^{B+!8@<zI|FlNTbEZs%d7VMt3@JiaD#-#$8yN?N%
zO-h^~-Wl-dp`B=?*prE0j6RrU&oh=&75!ydB+S8i_KJe<QPc2jj|XqI9o}&`zak=>
zvBEt4&f7qn-vUij9e3V+8Owamo&QUk(yDUK_N{ANuH~~jvTV8^ajkOy%jAG4-*Vjt
z+GiFea|*r6iMI5ykltsdWXD#*wPosclY~p{+YMj;x@`FR=WRQ``A=@IW?bHV*7wiS
zjqN(DiA+1*2DUy>G&&r$T1xJBfk&Bq&6bExheg(f3nQ*nrX)Cfdi_q?uuzU${94}?
z&B{yn(^YnyY3#N*7@~T=Y3?&^hQbe<<PXY(1hh8t_ig)Ilm4=7J$um=j`v>G9ydaq
z&+NDw8@jN6?}ha3ES1ZoH!M*-rkQ)<(M!JTCp<o`7FRQN(T&PwnYP!A)#&X$E16lf
zGs~r}vdVw?`EABAhcee?U!26wxvX{Z+qLiw+kJ(;W3dHtA6L9SuhYf$@Qs<UXNh5;
zb6I(UkmcIrKbLjijq3USaJ%o0!i2V43_F=U-`#$)p#1*TLy0N#-m!45yKOH1`!9d(
z%|vale(_9!qU(tp;*XcRDSK3vRTRE`d|lbK=C1YXjaT*9XRvC8DtoGnyPP~YarYsI
z16yA97Vw$AQ|3~VI`}Q9z($&{aO-W$8s!B|C!c00lr%}m{)s<pEqnKHi{rYzA3~qs
zDO>pP`_Yh8hg&+<+~3axUt29YJtSx5O;#pW|F>q0%pV@SzsdY|ljXMW^RNDY&HO9d
z@9AFmjS0sL<nwzctk!xY+Z8qAw_i^9kG0eGE@+SuGIB~kwC81Rq51B$@76rL79h{V
zXuRa~osS#7J&meeeE&jSa}MXp^(#~@x!*SyxxLviS!0v2;E^`X2o0qJZ;bZ8&3$<8
zh=f($>l+5F7qm)(j|xcdU!ryH@2nfV!Y>{^iax&loIIcG?W1MWG9Nc9nj9~#&Tfhq
z{ctbx!{U}r(g~%ycX^oq#coRe@IGYY>s#;hUNEg=zId4Dy*vN6%pF<H8L{FAl2%`9
z)G+a|Tz2c_Lar3Xu=ig?7pm69iEHlPpwfTwy0wzXlDP|btbMm~v9K(2FrBc?;dNh6
zN2$4rWA4e~_m&5e9d`6MY6^bpF>RX=an{uIwy%lOlnu74I-QuZek#v+{&6<f`46qe
zmRrBQW4)x`;*)ph;?%e&oYkVi4_v>-q(l|1+WdE}?cr}ShthavZQR;BbNzMC9c%~I
z$gEr`@H+Ux3bvIko<|aW99onfO1|6L#h^V+$l%*cyLt9jDh1c&`enYKNO*XP->g6@
z{EuBxX8#=9^@1&~;#JcQZOc_z9(ZwPPR`#3XY<V-OequGHZ5vURd7y|Tqf>)t}Cb|
zrs?h`g>?s9zFb-P%erx=>9zl<^B3B#WM7*3nZ0X+E?;miU;p*EO|}>BwpY|HDPDb%
z@1Mqtn}N|YJ}JnH>6L!HAo1&X$)s<GH|(FdpOd9|;-9z+(havxXGzqR2HkB>_))!0
ztaR0+t&`Xbo?P2=WS7(z{TZBEy`^gpUSqItUV5Y8_>BkAfoTrk?x)nqH?B0>U3=)9
zOKh7%er#y#9N*;;w?1xCVfp78Q@QZOGMo8VigtOX$S&EmYO#xtvFGf$>yDaEyZ<tE
zkzJe0!j;qfC)F@9#7{n@ep)wx@yU!AJB8~OSG;(pq1v8O@^ad7@#*z@{=E4#`}F?U
zs_E~Zp4e%%Y(}chgcH46)-Ktn$6}|qOa6nq)rzbKcP5z4bQaI8juboKW1N^(-j_3b
z+pYFkDTy!j=jWd^Ic_8GUAERHY-Pl*bI;{UtbXxiOE0sKT-I}==G?r-q<bBc_IWdI
zdNN0HZ7}PZh`ZPOA~{=GCePlr<WrG&-!`7-S?qoF(qE#R-!~^;mdpB(mdF0{o#oT^
z#dm8BL-h@1+>%#&@fp1+x~sqBhQ)zH41Y}?IP~(d#abO>e`9sy(RF!7-c)AE1#^$O
z>78k>Uhn?B=Ir(_yu3cfCojf&GI(~1-a3&HGD~AYWVq`mlZwW)%`XD4)+D*@XM5kh
zvC-7K_JmJoBy*^zp0?bZ4d1;^-EvwR8npJc>cY_GSY8iRi!i_cpN@*3@3%@RIdpyc
zzk*lhGQ0MkZj3dl+`E~_Wv|KoR^fH0AIYk&ytE<2O6b?*RTrJ~)vfPvzMYYtAKp<_
z{buXz=B7Kfp-D9ouDVmUJbyg#O3JcxZ|833%>QurW6~Fwsk`|Pp0$?^4U}sX)=k*=
z{&l-8Z%%%}G`V!wwqFr<@0q@N%dIab`2LOUt?*@UE_LgEH>z`ZvSsu1V6KI0KG>!I
z(%EoSg*(r$`<KY4+gS_u$vtm+TDpxT=S0H1l;c{<6B7fy3wCiR|MJ$KmD_&k&CN#}
z4(!v_xUo6^t!Mc;xtm)Gx0_zS*?aTtjD4yN;Wc|+FKC%j`qV0ai_8aShNB@Y&Wwk5
z3Qu<T5b*8@e556=>hpO{Ug6&ZDvec>v#d`~vT5YV@xQcT;@qBx%;yy<l39<aXY{Yq
zIro`YuTOG@$g6+u*KT*ti&J^1UiSHEd^A&wL$7<@EXS$;eLmUSha0i~Ixx{Bd;)`K
z_gcU7g(tOL9$LMRpFd}R&G(1Bi<3S!3dri4@*XoXU)b^EzmjcvMyhDo4Xu#tr)`Sj
z*Gc`ou(sE4*1bux&9}R5gk5>Es>vkPe!kQF>*rSV?w{%T`ocra*ID^*FK7tV?l=}5
z+`;Jk<kCu}7!5PUNi!PWBq;V7?rl=8^f*&e@X0+P<pPUHuq}u4cir2Ht2XU+4!AS(
zfS9Qv&-`D;^EZ@BoR3+&EGl=yDxU{731=IZGbFz?)%=nvQGUd6(ka;&rE2z`|E9&)
zcRQcoCQzL6dAj=g^Km>J-ws}4{qlZgoJ`!l7l)>8J?O4@ox$r}!!_aPnv&~0pUz~Q
zu3ITQVZNN5+D+dDyb333Ty?$nuy8qUapktZeqAX4rf0$m(Gtd)hZX)@e8k20yI_$~
zosEO&k*bztN0E!J0l{jL%nL61n(k5*cM<uTwxT}7=AI*~c0*}H*RC~Q-^J{zKR<eN
z_x5J~<-sM_gLgj5w8~^Zy>gebq+r#`)|f-9FCAMaeAm6u@#U913psiDWX`DgW>dk$
z8=Ky3-F~rPU%LMFG*!Q1mZ-}QLN{=p+F4xp>EUnj=VAVRNpq~{NBiC?K0k5eHc_*f
z12uEG5=8vO17>C&oYMS6oO{o{2Bz?Z7kgs&*jxTTXkY()_15L#uh#$n_T((Lzy18b
zUp_ruJzqcVm+1N>aWfBm`?uFm?bVd+J!~aw%iei7cyXLKb!*?Tg=LNx&s`|>_&YJ-
z|DjbzQiYLc=f38U`<k`adT+J8>58w`<yOwWLOLUTdn65=ww3b8->|)A<H*Kk-{xwt
z;O6pN;bmgQ5%umDfAq$-Rwykyz2bw50oxj;{xe4(EYkb1$e`cto}Z&d>*F<-ey2}c
zqG%RBmC;3lvtqC4lZa1_6Qg(gUd_w>^GkGhU*ow4`&1h(52_d&bbeUyWh$$J-jDVA
zjqY!f7k^vW_^EJP^)|8VI?mn~FMpKw2n_F!tarK^u}0>0n6p!6Ugi5!?;ou?-`!|z
z#MP4hXSc#5?q^OBv(=_-2s(7T<i(M%fkLx$p1eQ0uCJ?IVq2GN|Kn*kSKc2jcwOCI
zvFsk>wv+Y;5AL;JqSnvyZLQ3uOQ&A-e%{+Rg@Y~cz4_G5cW?A1HQG*mQ1D_;z`g`W
zV{xfx;t}S%ws3_RopdO1Jm;!=c`f7Fr90m)$<zEE$zLj1komvnknw(*1&S3@J^nsn
zIySdDQGxOI$28?RF|*z!?pwsM`x(2u)yW?d^JCkeSuOr%-S$<RZ~IcaSFQOU=6mz6
zo>V;H(CY2__s`A|Jm4A-u5`G%SKx6Tr-oTc>i@Gh?fraD1Q=yIhrQeJoQsWT-rd<!
z2LnU{CI);xU;3<_(}DkeXrr*FroUWKIRApBS7tD)EO^Bu5ofYr?$Cjo5xWJ;4r|AK
zb-Yq&HSv2y`ugv6LUNn0EqHmZTXP5F|J2sR&r(<K{BGOTUlKj*zWekUOD|VTY@W-q
z(>uiO%ikTs^N*a{KCAiY+GnnRH!uXZ>0aaSnVfuDH##Fax`OAE{Oj$?%l>q++TRpQ
z^EJIT<1w=r+h@M)KNpf#T7;Chl|E@Szc+in&rSt}+{B|ZYTq@_kxH)V-=Fm%RiJqK
z5slRxF;8Xo>|QRnH&yodoF3apshL#|Hoj!Mc>d#zGA{Af<#GXx?*AE42Q4hRcPKm&
zVqmCoW?&FTJ(VLjIX^E=ub}d*_1mJyJ0|}BDzc++mB-slUykQ&6AIlEzWH0q;}pA?
zjppT=u1A-8cs$~B)nLi&H+sr`D*MUFOLrMO1eT=qmIsyJlJ#bi?scm#XSPb(ZXW)>
z`j47-h2qbTrKh^JqEq(F*$_V4BJ$(o&mT%kj_4gti%vTodi0$C`F)mc_V+jK7ERCJ
zDZ=Xg)Asz)G~UUPM<17_AKL$qv-n*6p*f%PZ<Gdpl#!bz9e6BMt?Ob&V3%q4BG=ff
zs{KmS);^3p`e>1WXyb{C9{s7J`r3*`nQUPjW1il;Q!{n-u2V&yeN7TX|3}zP`MB)o
zzPl+$Cmo%1cjiKuCzk$Sid=#+G-h6poM)BXsZl8vzR_66jLW%vium_PO|F#w&ndlc
z4)a<Zjtrc7NcPOpApWD9j25p?DXsm=tZ%U)cnYJ@4w0h8+nVm^nX9(%uUZy)!Ka?v
z=p0wwPN4;ijMe^M{&(h^TD)6+G*L}cL;9yi^oHFZ-mN!ZzxcHMo_&8Vf88ywrp%`A
zwD^W>qkzN73HEFkeKoZh=af6nJ}Y|rTi}YB*>e9hDpzVKN-Q>eS|mJuQh$cQ$z;u&
zPj73pYSb!k|4=4+c=<Qa3j)UTR_y$tbaA<4MDv<cX(lHtW7INah0Vlg)zsuZQjOy4
zz4$=T+oS*HoXxxUyW}4!l009W@MVsAp{}L2OQ8&NaL_!CNefa|CTvjR5V-D=rn1Q6
zQP+pPmH!XVeqFx)CTqd(<4iB+G5I*G65PjR63%uuhsErNUx>rQ!(HM!ZLtfEO+PJl
zRbbohMqdWTLOoWy)T>?0zghPk?#iz4S!0`Iq`BFbHAnx(`g{BK)&76??fi806NiO&
zKB}y{!*qIb;3@GA-7K+Bo>B)y&U>iUES-P%f^hzszWvNW-0Mu1O$<0WeJ0D(t^ke&
zZMJhBPkdxq$M@E?_WX&n+!2h6KOOp=|AXVm(bBlsiiO+L-+e69j-MeiSv9soXve9=
ztJdsnefj->ot(+1^7sSu&$gC#zL0q6?YOM)=*;tnQ%{I3(hEAU^&#tzyDE>1_RQbl
zBs00|>xn1@S(oW8Z!>48pV%eDV=BC3?H1oFSC_2|U`<+j!h!o_@XEw(H-3FDv|~KW
zyjf-8L1tCs4gY-7Sl_JmuyA5cVSeoC%(SC(mrenjom~6QiU&*Ao1OmL_|x*ly;=H>
zPZR6oer!I$wSTFGG_&|Y!-Zu^N#zGy&Ht*%r^oFUa5$JW?NH=}d5x3*rnh~$n6YGU
zmxkDSd$l=#+Vf?yJp?yOUXQ+Upyiy4Y0sVBMQcv1()gr$UcB*>#l%8OGxi6CH*8qT
zI3)8PWr-du?tH)RXWS=?<&A6=cQ&y~JP=&THMPBF_N<x31stw>p4FAFEqtJ3H@hSx
zTRrtdF2~&i(-MTZmi$hUt?v=y@-aH4=;3OqKkX`4!hYMgPLH$%cjSefGhbj4{8l}k
z!Fq0KqGQ|Fg9p-nG9NtnXVRyD2Nvg*BhQ;J{ULeA|Iw7_xP{K{87H+3_@ndMR?lQn
zGrJV_?LuO~0@s>7nwzUXnBA+`<DIZUU~jYSv6p_9ro~HEoNme1+<sx<)CVozajv>^
z>>G|&{J3i|>&+_jaO-;=OEi=XcIqxrG`D%>Ag_4ZVA{$xjk=rWB=6#wD1In$FXI;*
z-UB-dpHGOen*2WOfpW>4xTCJKq+KTc@jb)!??BYcgI<QIi=PB-zvJrO?IaVQ;_Xp%
zdBbN3L8es=42#rGYwo&Z^wPh@dZOZzL)kB_o375fbaZis)90o+R=HO?>RJ9CX<5-a
zciuTRfk)ms9rfa880A^&P8{%HWigHSWv<nEF7T|;x;ybp7N^g%M9#UF+lxf!|Ku)7
zUuiGbuKmyO>@<P<GE<Abt-JVVy7Q}>Ip0rhsbbUq{wYfS$fjyjQ+*au264r&Y2Ta6
zRab2>xMY=*@s)A8f#=J~EN?DO)bw!+ztrLQaasR*>GxK*jf>vzo_+0D?|#G8)rUoz
z3jzdX|6Y!{y<B|0W7EULh}tz}lRw^6v2nJvb2i+!CdlUeuZ}1B361eivLClbtMWg)
zvE02qc*?)6fg+tZ<lWv*SkhL=rzV}}V%y~Oi@E)&*E%OgkrV^jOCf&qVjNVo3|F^X
zdFh1Q<Zq38=qTGSwe^9)M3r{M*Zl!0FH81p=3)$38{WZjZ`uSF{?>-NHFZYeB~JD6
z8aE~~xa_{g&CJ&MvTCBJ{qYYE<t|lg<tg&MD%1J%F{fgqf!?E<-~9hv*c=zkpRIq#
zQ8ayJ>*}o3IgY7!&b}AFCpy)0(Vb2Hyo=>D_k8L(BK<mV#;G-z*!C=FIhexL<^DE#
zjqB{B2CefQUapT;1WSJ}y+1GEVdI;P8<|7HU*yk7jZ5`3&9$;+ye4TJ#gV<O?(XHt
z^KNVIzfFDodv1xmVQ9g+4g8L_ol!xnk6+WUzJFKM-aX7E_4cex4$~zjTXu(@xuNv7
ze#f?B?LtD@Moy}(UAD_2g~g+%Ihb+S37k&R&a_D~lrYHH(jqk9Y<URdmgf2=p1eEN
z6m@^NpAg+_TCrc}iDF}v$GwF+A1v9VcWBz$3CG1lMV{Z>^x&o5zkL-SA9<DLKU%VC
z;fbY@2Oe(l?a^Glw9s>ccWSG{9KC-BLyvygAElX)ar>&6@Rd@I+o^@yrtun0We;D}
zv{i1C$l`NNb8D-+bhH}T;=FXy8<$7UGk$WPxx%fEe_B&EbCUPf4dv|fHhof24pgpx
zeqh1wsVk<x5H&uPa=moZp`#q^0bLy%vL_r%y_N90*Oy6%_5Ev}J)9SsB@HG7Y`LsB
zkv%8<`Etgsd%Zet9M}>jsC`vL*kS)F`$n!0U%MJ-<!*@TN|4ahE!)qw`N*-Ny?P?T
zVGE`lFuw9FXQFCXZkI-tUAyUm3#m6&-@B2@#IgOSk4(SFas86hvsdYDKI@V8z)U<K
z{@mjyhg<oLIB&eH$a(%cV#%Q#jg7U^_fK;EE<JG0Kl=8G<Ve>le(||m`)B^2RO>p!
zLH4G%x8bWzb00lE-f*)%cTU2KZ`a@7khDx`ExQtEmc*O!!hTclea+v@%Qx{?9j$(F
z<+<O5D=Rf`Z13;pX$k4t_2K+?wo6_sOb%Rl6~|h&e5+ZSb^uRYQaJafmic+NcNHog
zd9wV#O!j*(o<}u3Ji?kOAGzj~c0j1ZH6IZz=>o3sCu%tiD!voGEnAj8dEu*dH)qT%
zfAQ{u{=!*q726&?p5OV>kKJp%`iom9120O2{g$>?uJt<ggVB`7p!LV`Osz*30v1=V
zxxy;XzeKQNPU~FfAN&^%aw#rg_HW+vdGE^Q>96<A|9eSIB6HG*?2h^x2O){WtzUvZ
z?Z3XkW68B$0r|CRlLCZowkw9GDV<ui%B-lUXcJ4-E6bKuUr(lSpIc@TnQwl3vX56s
zm3sRAzu&GiOSIqMO6*zPByaLYPDZtRL#~+Xs?!d&mwRhpJ<2$*C?kLFwCUj&8BFG{
zs{OcmE*;2}pFN+|>shDA&Z}ok|HucNxV!bBqKU*2XQQgA%O)&Yy?B!7vL^{O8Mz{c
zULPA6T{g|%#bx-fbIx}Lt5arAxtyf+nS{E!6dHPxGY-i4-RB9p)mrQDCa>Q2)Nj$x
zy_Z=<4DLO@a^|a@#kxaYty?{LOgVGBS2lE6avoXTHE+Q)j>|9I{}vWJyyADJmE-U<
z$qlT|Tey}_b(+k;am29Tk_Kl1BNNM;N5OKvGaTY#b=DMgl}%mY)p23f1qIEci#lye
zFT70FF1@!VSNO=$XVEpU%WfNFG&F75=WV_3Kwq@2d&hFNy`JgkmKdi`;&S*~`TX3T
z;&i#TmH*aEKeuN3IUTNvD+JDJR&qFXc$6e??RejC@ut@z|LVfI48eEiI6Y@QvaPXB
z$xLcv-s$Bxdzg6kX>a$Om3f)PUuv(8Vc@s@lHX^y_@4RMHQ_ev5w-KPn3QjQxb$km
z?$)04K8N7t^D_C{map%6n<KU*l+ot-%Br@|3wO&7r@vwdn(kUM=auP){MTHzuMe2y
zr-ge7WlcG0T)+@-Z(BBL4*v${R}wGWt|iPDU-CgQ$8z&x<_9tc4>A|!`@de*e~U$|
zV%M`*2iP2*SNvk+6uY+XWa!G7YXy{Twz*8bD&%~2^Cad=rmuJVU0x&Tb$Ql%=B<9_
z0h(v)i~<yAoYK+T@=R!YNa5DL)2ao3UyEh=*E{T<@Ykcwe}&VRtFB%q*6fMCzp@fC
z4lr&iieg^YE^|Qbs%e5r!b~YHPt8bopCx;u7`{Yycl*`qCT?ARAok*lS8o?pXXNBN
zC%<Um$zOO?dD7cWPXvB-6h_^Op7;EbqyB>9&pzxtxV-$)n_Z_?-Fcx_8|J?D?_P&Y
zkMkP?obH@7)2orn)LhDH#c)qFJY20|YuLsFiOY;C&dK!$-S6$2*Zyt$^wP*Ax7BJq
zAFmv$Q(iEM_4wiiZ`bWP9Q*2u>Ho4O$-IoI86^u7Kk0oro}o5ln*@)-^s);c>t!>S
zUhi9}D&y#N)#TEmEBDJdH|H-GfAd9rlgsy{)21Rvqa;m5XKeS~^HENRPxE=+?&Y`l
zWq+Nb^gx`y-uAzjyXlS#`|_maHVP&FJ(iuF(Rc8OX-al(Q{E$)pug1~?yo0lGwoea
zKf_^q?279P=PaEOob*8PT*kt*=0)4PZwiJc$<0f;zNvGSUyH)A<TZUg8@nz@7Vo;a
zR6xSdu4QA-hs~cQ&PyN4Jyu-$lPf6Cdf6q0L<y_cOZR?LuAcAqzC4ogs8?IA%`T1Y
zeT?(t9$TMRJ;60+(aB}M-pH>${K#OkU{U#t84LZnoa_#6bhGq%(`dwA$*@c*<U-Iq
z<ARHiKdbp!Y-@7gdn;g#cE#bYwG37!6D5O_6&5Z3cC@=p@VKu1kyOX$`hP>E=CB<*
zyn0jK<M|6^D(1|3blldgq9G`_oU2mGDtEcwukR8{0`1EJD>F(%8QY~>v$a<|yWzO`
z>4v=Db$(woO=LF*)_(~SFl3taN2|H#(5(dSBR6snn?4q}<-Ba;>kWLjTYCRhA1-<J
z^*no&>Itv4>jj_52i-q!c<l4v{_FYg*4=jvzh2*W@BW?G{q^OyCxtnFeCqe_%8u;&
zk5e_h7O?%f_D;I`%O<sxT1$gYO55`Vc0PPK;n(8mx`-)u{EX**xN=-mT3gJ0bTgOM
zYqjkcS$QVf{d?)!_WSO>^75Ch#W7P~>~{B-Syiy>eZz%JlZCG`J>;kB&boWT>FEA{
zUzE%C>Rh-d;!r%5Q_Xfk?n*yHGnJJO7cIQBYm2{ARLV0Y;k)Pfs~L{X)@Wb0Xr5bS
z#6iE<-$DFr+j`b7`})T2h1RJn59Ysp$jf3>JF!Az+Ratj6HFYm9oa>6TXyc;wmtUa
z%fl>JPG2*YZoQ}%dV2j;(;6F{7k5tZ|Nrps+q;cdqn^(Bm+#@IU!Hn#(aufxQY`iB
z6)k`3PLO1rb@k82z}4rU-2U&M6noCfJo4Y>6e*VEZibyg{1YF|bUqxA+r`d(_`AhK
zZq+FZxu(wzGtFGE^5LHCVb`)`t`wY2(Ndo3BynLu{<7fnvrCIw{_SJa5>FS@m)NjN
z@7co4`^QhR_eqvG-`lKe624-WkW@_2C;iRyp7`sPt=zi%{Qq^miCf)#{(Q0cH))ea
zis&6{mNtg}H@;`>zL;!rj$dd02fKr3+|@g(WWW5LnYK>AabLInwG82wzn9-B{7PoL
zxh~^5^Y7>PEW|{2+)Fioy~b;+?)-ME(|<)y&Z=S*U1cs(!0uFiUpvD6sod{bZ?odc
zr?X^L?@Ms+|5I%1wfoc?PA)bl)3(OtSN<_vtrxRwK31s_%xC;H-QalV@%RqM^J=FJ
zdk>4%T{_gpxglWY?AWjxn<VpJm)O&H?Mu7LJWtJQ;iQrpCdukfp4Fd4^w*!YJbZ|w
z-}(B?Dc_z>Xx9ESS3Gu}#^3gDp&f?~OwQ2KxG1&n>nw}vh2=3-&AICyYb~^H75A$-
zZ1zyW?~mhx`>$mqR($(rBh9w=M|5NE+|~p8@?X!ZwKV&_=Tc6icy;%wJDJAEpRY1<
zO7c1WEdOZt!+-A2r@r`SZ+zKC{YGHP?X45pblEn&e3?^J_l-mTT-xN#!G8+;<j<`C
zcWPJ1rmt$|v3;DI>veAbOw{3Ib6HXUdf6H0yIZd2rf`{@jM{qE`q@3kjJk5q4x!)S
ziJ_UAT6PCt@7$-jSov&<fwyV*)+fBNzwUlCw!2@g9?%h>xjWbDmtcBAoi@u#hix~^
ztUvK7@I2Ypy-a1xui0$sTQ%-(j<)Ks-MU7=^uiy5Q%Z@`b>=*AKkL`F?)SH4R^@VY
zqJQ$5#BMkLlqGfkvE!p#_rtB<yof88Q`lL&**e&KQmjge>5a^=OS&n}#p=I)be1+-
zNNN>zwZ8Zt=a;<X_mPRea=93Vq)lcu_?9|6Sdwv9`+3FH6J@2n!2#jjx7Bzw1oVXh
z4s*@nHH(q>Dx%)^>1!S5vXvW-tDnEgynWHEO-gzBuYLzP{4AQB`y*TFbYJ0$Q*Yjv
zwr$LA+<Bcju1-|+xOVu{X?oq;dDVW2>aM-?V)wTYXTMdir%LTzGC$0HozQRDT9d4*
z6Z+~sm(12><V=21b@5tppZkBLTeCnbc}}>UQCH(*V3?(Wacfp?N@`hZUK!}tEUE1L
z+b2Hmt~(mWnYYqy(c3K+B3dP`eqnm=RJTd*JSi*ExZuRpqsH-1Crx7w{rh(A%-BiZ
zL7UdEXi&KJ?#-UEd#g*QxtuAy<{FoBs4zlcspm9f^S;S<&Niz|+dD7L`^kipNmJ80
z)tBgm-+g0OYOHzc{mza{r2=91pDsJmyy1`76Q$FWRo3)9-)++Iex~-#*!A1p(t^zI
zw;Wvc<cZk6RlK`nqC_2E@JEUqF)BYC@ZQZyZDZkuSx5UFryZHt@mW7lY{%+=2A25(
zIp3aiiY%4h<Y0AM;oD?gFZEAKrE*I<<lEo0G1Q6ePVATcf2UjKJePZ3gTg1?7qR)w
z-j{uaDw0kZ2|oI@K-E!1?YnKjn^|{nmhZoJZqCd0n_r%<em(z~i#Ox?nD>rH>VEFm
z;g8qcsDJm)+pl@~`_9>&w?AW7SCY2>%(I+B-)!!l>eZdcB5yQLEqda~UJmCd%P&>y
zZ<J2zHoTqZawg`!`q%XDtgkprCbS)z+O%__Pr>x3(t;ap4*s7x-DN{>7NgFk(@iGq
z>yp0xx|~y2Z2RBF_H*M(V<q!djZY)bi)SBs7Sf_)G%F|OX8&Km{JWQqHT2doxFs(%
zS+pQmxb>)e@PrHEM)M1dIPFg)FzR^u<h?X%SQXu}A@}p-=_eX)mK^%X(B;`7ksuT|
zFU8ufqU}${>=gbk4f)*u$!>yii)tf-oY`#TO}ctIN+)qn6D{m9Pswaa4(qZ?`K<7b
zW%q{jZ$BUW-1EzI3RAt|nv<OWrT@G<xb?~8-D@f)?w)ONXQK)8vIDdJhcc|U6W*F_
z=)JKpul~Q-kAyjUEjuUJ{W(`FAf&|Oed6$)35k0Y_UliKy&=Bedzs)1jiTbbn5`8~
z>Xpy-*%tX)Mi%TmI9r?F;Gf3cBjPnbC%N4d4h-|SaKwyZov88t`IYfDRTJZ5J)Sbn
zPoIA;Ha7m8opXWk&fhQ6g!%GBc5eK?h|ynEW|qJWo+{M<!Nf^jYbs->Djw|ZI`j3@
zgFu6#$R{&xLfOrDy7=BkJn1X{*1K<G>zU0<KlyO&K9#K|vPSoWTEYB2;|-2l3Z4mC
zQ4Af7^~ZMbDarh2n`+_tY{@0Rr>x<P1}8<bHT<=&^lG<0xtVw8Lf<vXfanXEU(Q=J
z9%=2FxZO$T3)d7?-$Ms(KfIMSeOJ(>b!^Ovx<?-*+&nO!lT(W2OR3eCy}cjg<}5jJ
zS!ufobMrOL6B{?$<@{#qJu7v?LDgfeR7gNx(zM2Eu7`0yw!gZqb6Tk2-)zgjh8bRc
zN?&-AB<ilrZMrQsZ$VA#ytGE&o`-Jw%=*V~t7J}JyCRyYc?m;ab7aJy*H^#3`F8g%
zd+z-ShZY2_P{_^`VHTCz5pzXcl=)kkaD{aD<6qzFpE0{_zjN=U5QB{SN9O$QS?g6V
zyi7~WUTCP(F1mS}&tV3aU)u5-Q8T9H{zxxeC3K*<h~vzYr-n;hHmu+k(F#!AFiEP|
zR{x|ydz<y;>IT*9rO8|WE?yOG;AZh!Lw>ugr}gz%#-BwO_f1lKbB0w{XY1+C<u=6=
zSv;!NoVa)_r17SZeqYg+V$0t~yZ<pA+xtMg<|ogCx6fzqKfkQ}+}GXy#w_tS6MFYI
zTFtr9%Q7b<Z|~&DNei^s<S3s~&|#TpBT#g4MaLU{^Uu3gqb4!C%i3gzeqS@Omp44a
z;9LLA<@Hwb`i)y}{$3qFL9=$z6StKq^$saZx6R~OIL9;P<h-}4Fa0iGSvcW<TF?G_
z^W`fZ>$uFVHTIPevHPU$!e}V<Rq^5uS55A=wG8~>PxV^Z%{$gk?RAt~eY#fl_Q8Tg
zRfmM>YAy@drk74x@#5d^mgVcGT{|L}zrIYvK;W5B=ce0Jwaxuvw+4z#m({-Jy1jYo
zy%~jzC7#~uvu86h7i!T;tDWe?tDVH}bI4Er-NJtn?B7Et{x7g!+Im_j=Xy5Ft)oHl
z5nYkXxN{4i+*@J!@RXETrB&^!^Yf-3<(1$3J>aj?$8)L~3g;3VU#VyaESTbUN8vmF
z<n7;%TH1#k<6d*~^^%U-(>u<a2)}-?^0BOd5zDLocfO&HVOR4aV&-Z!3)LyC;(jwv
zB~!kO$NOMFhXg}<M&U)hyB}Y1JZjhaSif{_zpZ}^^Io63h2bwGAJmHE*Lxpe_c~|l
z;d?woLgev^peLUK+09mOlGf_xN!al=>pWvL+vfQZTMe8i&p-Gf^5(3L`GOlcU%asK
z6b&d|y{ygSnus`$`lgeUrJiv<E8(%e=Fm}>JN@~}?N?H#$&~xVOqa^*%40enqMhZ!
z$a-P*t<BZ-Pj|S^vq*gOOYC23y}(Sv;9lOQgrl8%rBzp&wh3&#ttB6~QS(UDsdu|I
zcpkB5Db?@#Gf|Ue)kV)Pp4;8-=HjLISxx5(+<Kb2?##l2d?GzAH`W-Mu8>U(PRm@o
zLXJI%(?wOia>05p_TEi`A#wgpYr;a8b_<`9+4^UdgU(Ou)oWywCOTZ>xzLzcG{b(@
zi-!xsF8pubyGG`|^Nm>x_oS{}@pJxR!&}*+eIX{3cyo+TM5M5;dbjn<Q3md(f9-|;
zFWeNw`!O*4LTk+C3(P?^1zT1`uk>CoX^_9mi1mt_v_LiI0c)oPf=(ZwNnQ@V-O=`@
zU)xuEdUyB6bra0qEe`4qvN&dPN-%WW_xKN4J_4`)6-;XORo=3p;X+%7)7SSOV}s7W
z%zf#)Cw0~O8+X+v@TyPNDXMkM+2ynB5cjo4_U{jp)aBV$pE+A*@w>>FKk3Y_);w*G
zDvi_tmy&Bm42k9njDoXLS4JHDa6nD|Y{^1fCgGhDI_GBJ6)~Dt{$;vzxK1Cd>E~ZX
zvzrbqU}pKH)~Y#8O|?8WCq?qS`@V(O{!O_0ar0lxBn62KufzHI*J}<W39#=JPHHzy
z%;r0DWt#P+zaLld_59v;Qf}YTJ<WdFnM>~;y!P7kfz=5Gxo3=bBXUpwc)8`W$zub<
z+W~iui=DrBpw{W@)P(=W4_)`k{bfBP8nvV}{NjSvwlxym56)dLQ;U%gw+h^zbamN=
zl$po-?>jlK@cRGb;zGg2_e&@3KW^2#C}DDvvzsV)@rujRQ~Evb{I0cWV0(4;a?8eA
z)1M78b6ffkWlg#`ahuJ;{qq>kx!mZes?y4xS<=QkrCF_Ma&Mt*y2{t%341q0iG7b~
zy?ilL=$F{D&66e{^kgdMbbfuTqIsI!&dLXl0XH_r25r#TasP>q7}N8Z<T@^P>5b+4
z?kn6Y)G60>TQa%U`L@<cnI8{a4j+hi`uKlN=(($tPHw1RHvN5g$-<ZG&YC}&k$2}u
zoWc4NFE-e5UYZ}WcA2q-Dx)W(;`RxPmM*-=F;jNx<;}I79~&kG);9ERTpD%b-G>$L
z)Q=xKvuIBBg)>`>e@Pgb8fNF*xmo_8G~C?c<iTGHLp>7qE!e^LaPgvyEinP1O$OC5
z_CCL=kG^YKCf07((Np`@WuokibD1AHH5b465zTDY8<%V3y0kZh_fFT1puba1;w;xq
zynW^Clz;~B{rOj}c7F@3y`s1IEyH6AUVnF~2-f0T%NeV7vjyc^s|4p=ix=I)`&I8>
ze%swMyh}1{CpK>Q%6xR+*=zEfm_G|EhUThYiN5INuymo4>ucMi*X(v5dgAgYaNk>w
z)z8{)-B4e1M?d@k(=GQaCCtvvRR<2g$gW=3vMG70N@BI#hah<$iwenQJ?)OG)eH~t
z9Y6Z8B+l;oi-WvcjQ>))gbji^BMY?;1(<3*tywwkjEUV2&ElP=g<9$!$DXX5WpT~<
zSe9O5Qr4BlSJ`acOxFHcA^XByymrIB(hClo*2=9Cdhu~n5mWx>gMpJe*j@$s^!pxi
zYgnn8<J~$xPuw+>OH@s5rsC`T-|DMGWUH(aKe4Kvnh|Qec=yZCaVx(pTRHJ)hx)@D
z<D8?$mme$1*zD_`SvBE+Ci~@p1&5hp*lSkK@{xS%)4Im^fnu^j=S=g2oGtTwGVIPT
z3|XSs%jnMWwKnSQmb3Q~&RV5aThy=kxjHCf$@0Fm%>I6dU)GiTlk<YKvX5;P5>uYJ
z?7z?aTW<nZuX6j`_&#^p^@(q1KNMs<lQPLgbIJRnp6$=NYl{WyBCZ8pj-EX4v@~;i
zjoHh~yF>S1yQf{o?eXwe+-1IJMjSIg$3M@{<m=wtBa#xbkoE7Y)l$AQrbk{rToTL2
zk#R|JZPw<{&}?3vRezU04A%E?{Ggau^rmz}?DrLJ^4t7E%%cmm1WrAAAA7>#OGc+^
zs#s$B0@c)CFY|cIJM9}69RGM?`Fz6?j(vYTDnjaN-t6|XQ~S;tUVm=hg1+c7K22){
z<_PhP?jPUV`Gn<JT#No~oBX%-a2(&8vU9)Q@K)FU{wnnE_5TCE*bjS3$u!FA{>X^3
z`<B(^>$l7ByvT~&!ppP$Ki|G7(iDGfe&7Duy}S19`DyiEt=vfb;{1Dcmv_D4-}UI4
z%v{@q+{50A(VzD2tNkk+Zznw2|KqYfi4iw-zBH^-emURqV2zsj-^PPtck<=uF7l6K
z(hz@s`rDPq$|=#a^!yZK+)gfDkZ<`!@|WQxPM+?W>@idKhb)?PX20+ck%wv4Zv@wB
zd_3BcAKm7rUTS_yJV!+$<o^lD2hp3}?@KP*%MklBaC^pTC;QW}XYc?0QTXi6IsG}a
z^*5iNzg{o>ukzmwCmlmu4lVRN{w?ls*8amTrj2$VZ(Qz~r*D+de0Dv5tPxk1tXR=y
zF20J|rw+U9rBdaD-py|dobgK0|MIaoM^4B6vo6-IpXtWknHapZP)~B-wQI@$r|L*Q
zI%X3jJ$=>}pDU4H-}w5UcD~vtah{z^uKlvA+nh}+uf~<1TEoryIh}bywvu&9+zgM0
zYicb6-}^7WZT^+<o=LZUQ&n_*kgAi_>Sv1Q{~crSR=M~v_QoszKVO?VU(LLDs&n0<
zKS#N$Soh9xlw26fE}Q;-Kk90W^HXQ5#|kqr+_A%4ZIO~$47&Z~sC9P!>m3{Kf7ZT{
z$9Qu0wxS}vUAjy=-eyjE_pIzZv!~x~@s)}vgmQ})U+)UaQ9r@|>i!G;*Jmb(tZbj0
zP^~wMf1})!f_ug?efyHG&p%f`=dVK2Ja4<*J{57@Qy*N_tPXek*mnLNTYlfZq;%Jv
z>yK0gZ{D8oS9d(mY|h^2n@&U?dS4keMe<CtY5%5kH|qZix9$HcUpDi)P3!Z}$dEwY
zu0Jm_LPaIH4~GVui}E|G8C8UD);QlitL?<%#mb)xB)3n$x~oU)<k`Q!9H%_nHQ|}p
zySGo(o?2I5zM_=-epYIvsNwXt53E*&Ddjd^x6!`)+n43SkxjLG^<DR+O-wPLHBV*L
zVvF7-Pc8{uu?teZmbuYn{f8)9-NjOjv&H8>2-|yN!tv8?OFR#Jt_~EnG>q!sy`g`Z
zLdUG*r8Bz!EYC2QsW(@&M(EyAy=SVQs!pw|nDS`T`=rwS&q_TeAKGzZlZOAYH_zP;
z9NxNOx%-=?``4bBoTTmiAb%s*>NV>u<{O=Sy^QC*>I9=y`OK&LKmASV(B;huRq}Ka
zsBTX2da|ubcH628^Y^V?RAv<Soqa}mWYn7FJ#xO0F(ERkOWD|s*11G_AKfwG{f?O-
zrX}3Fb|#r0Jo~?P7svU1`z?OIe%k)tuTwv(ZpBpR^SjP$TGlsB^S|SXU%{bQTw|7;
z`>?M@ugoS)cwMFHq7aW<vp~`OBewjHeHqoXZ_c?}b(;M`bpEM5TX)`=$-RLuKQaAd
zEN>cLL&Ckq^U6={VW?|<dN}%hLyBpFanav`f(Pr23(6}Ll-dq|`2Lb(&aw7I&z9%x
zerU-x=gp}THK$HZai6qVV=C*u)UR#nYxF*dvrIpj{peh{Pj_$UoWIZh9{qZp|9W`(
zagA%qJ0E6RZEk-0G4N1$?9)%4^ACKLyvlX&W%&FTM_bPRW9WDm;~CY<7bCFG-1_qc
zu~ggd+c;y~QUX5DtCiiNaA4D%>dqAhrgdlayBu4v!SavZPp%RXQGuMAx4!cZCW<Z1
z+&GtUMpb^{2bG2=iLs`CCd5SX+*4#=+h-eYw6Y@7!%^d?Yn;2%^ff0hns@Aa#@THi
zxbK-!g`BQ}LU)#@Oq8oHm(QhDznHAjU$h*kXSl;Low=Ezp8rvBSMNHB9>$rWg%ScA
zUN3WTp49WeIDWl3WA$<N2M@0BSD3L`{b0JM)PGs+p|Pl89n;Md@yD)tvv!<Zv@+>R
z><%^~nH>u*3%W@uWSwmM*vnGXn7`!psr|P7*>PvG0`|vuJg7XVz_7Zt!;*u0k>feh
z$BODZy0<LoKhY#|+_|UspH{!ohNQ^vzO45jS%0uLX{%-4rf+`n_We5T*=H6TO76KL
z7`FeD=)%YgQxXo}(f69S+VsHIQ15)91GhTu0}pRobk9I4DXcj#I)Rzp*0ta0`>ZO{
z-+RpuDr~aKwfrbreOyK0Smy%{nF(tSzCL9=!9k{xVTw<Silm0D8>^V5LCVhb`?WuO
z9x@kmzjRQ|Fl>u3&AWNx@1`4?+nAR4@9|Pp?QCFPu*+3yOL4fsVHSZmwssrW%g_He
zvAQwp+W98l`>IST0lycVY2`5}=a}|DZer5WxhGj#C!Z{RF(YGzugH!!v60zrPml9N
zPTV7!x#|n!qxnIxC2lRXO==uwTUg>BYlb$g^gQKUWStnuw5`bZ7Q?EJe=d71Q@s_o
zEmsimy{o9JZs5j#dxg{V_6Ji|RBBb`^Q>RB=#b!wr~?Lne)24O{ln>tK+@dB(yl@#
zF+v=vO)^LK-*>CdP5QyUGvz?}qHq3cU0#ZYoS#xf+b7(;5_Wf@PV3a?np5p=fB502
zR4DR*IW=rXkkJFZMGXQy<{RSVL)S8S2Ujt#*1Wo7jpKQ#28Kr+GRqs+HQZ5jYRUEy
zJgYt9jm7%~&2g-iAyaQ3Ik*37kfrmN3)Kz!ip$Q;k}=W0_dvOwC!djX?z4kWzMWl^
zdM@p+PX3ogZpE!En`(={2P=LmGg~8`qi|uN(f^arE`FImxB1sk$?N>jH@I@#`}^~a
zt<8)Tr2+PbugPCr%op_~Wv1F*brav^g3Bj7OgvOptson%vEo|g<CbE<>)V%n{@~xM
zp>cJpU))E=4@%REmx!^RYgOb}$>*x~%HWHtf4Hsi!mSSq7X;)?OE?+3@1eKzM8Ru3
z?z>;*C@|c1XOwsmoNid8#dXzQarxq<E`QfF{-3Rs>3Lxx!*YQ&D?86mn|wle(dnJr
zpG?)bFDA3>);bG5L)P!nTmBkLvA+1JH+Nc9lIPKryP3Y8W79ey%dffZ=Eonx9~8IG
zlY6ThrLduP;h&j8XFmM-^h<5euOA=TK1G&abX;=v@p}8ZeO9|)oXHUVcVLQr{k}gB
z_ZTmp`sqi{>hAsVvG-yU+IY>Dq;&s&@ZdSyrJQ>6g*{2_>+U=~k;3rqWShzihkf@0
zg>qHrdOmnP=|G|Hi)d?pgE<lg>t6B*37;``z4zf9_l$)i+wJ9_KHtsV$Y_zZ{%P52
z%U>^FJ^mjz=dQ(}Xc-f>DNEzNyH>0#IIbA={F~Q=z7NM0qq^mrS8QGv#y?5noJQi5
zyM?K&vw7;D#;$zJ+AV!T%2@R2)CD({5B&=LdL=nK_HFy2)kzT{@2CD{Dc<n=WP-p8
zuAbjl=j@eaQb?SA;q_eWjDUcq6A>n*@drZAC&;hYFE}BvY~e?J!Im8?lNk?uFjXm=
zaL~qqec^i--$IW6GdD2zaXV>xx>!3-@XSzFe8+V6&gUMlxEar#*D0A#SapT<P2l@V
zF3rlLw`D|_EpPBH;d=8XXrfZ&p7{KSidikQD}z3Ty*p_6Tqo><_J+@2<jUOY^;hj)
zp(W+zq<FD`WpUrTfG1YP2mW@11<jr~P4vlb>j^7o>xBHNbNlF%%H6U@s^cW%B-_>+
zp`ZmndEeNoZCCGR*rDKczeqfUVPo*-T|$>TnLeF%kC-fHv@q$?oTU>!UDo(oBc$OZ
z!z$lk<eX={Ani>`;$i-G2TSy{KefEi`LXdN&p$^q*Gjp(DT<7X=SrR66_fB?;}~<m
zc5>6iw5_El8g_^to3M$gx=_MMOq<L0{==2B7kdO2JKAeYGFU3S?A`uCp#R^c$S0{E
zIwRJ~JTRVQ6<1gP@!cMF8B6c%GdDY*#>Gsjo~k~Xmm%j2quuif94p^&$Vi@g%wBlh
zGxEg6S9h5-rX4U6y}Ri9qEz>9>!R`*HfgE5X{L%8um-a{7UbV6e^T{;WstA0vHNrV
zF3v3Ow(F~QrEQ4Wacd1PD-ZYAUEDGH0v$5KV*lSxS<A3ymSKI!e*fcf$E`{ZREx<?
z{VF8zGUu7(ELq8m$8KEN)GXbndThn5|E%x+{EPds!S0Y#!r9v?e2b3UF=PC19bfua
z<%PiW@_)1A8W{RsovK=}?L$GRPJPqO2dneGww-x%N&N0k51D1NI+%9tteky$>#AiF
zU30lhKWvXmzx;dMq}~&9JA2Cv4E}gdw@<!(XXD&$X4-TAvY-36O*v8cqT&t@k0RdM
zyQasvUj0+pd$d<hFh@v5y7P?R+1Q=3avmJj8lu+gcH2Cd;krRqbgIlcFRSL&k+bt{
zPbL(Uzg~CMcWKF!dC@FQUCTF|W(vI0dOzvb<uz+~-o_n^Ie4y~Eq~9s3yO>9o}8Sx
z&fru*`6<VLGBQ`526|t*qI!77dzp|c*MG){a}{Q$uo?AuIV{fJKTqb+r5Pd(=em}7
z?v$DQ@&MD_hu7ZjKlbg)mI+?Ue^tc)_O`EDlUUvSWubZ``;8Qx<rYugMt^y^tnZcE
zb;l$dPG6sv-q~JB0TDZH1iMz*eVO|}_4KlLmFLyke@^YWWbpiU$di~=Jem_ywX&)n
zJn`7^H7jtj?d+&^>259Sog8`h+S<Of3f|f2XOJW5^L4}I%dJs2+G7t*nd`%Lk)fjd
zrHv2Is&gKze(zX(u|3O0A?N&_g^8tFRod@&slEwZ&+>9RXZaDQsjn`(1wG#s@y|<W
z>cQDTPdtv<?P`3o(p50x=Zo6rq`z-$c@1TM{B*uiH&g0W@xw=w_C{Modv7i=wVJ)^
z%v7!yQx5Z#Y})pJOVj0#a(^4%<kh*KHeT^^NscmW(*rv%=`G!kUpRPgh@0K%y7uqM
z^sK}q`yXCOv?*-pJu*2kRb<<&Hxmqvej7y3tqh(%@7}ozfl^Mbt<Dp)0&OZ-4V+Q}
zW^8^xb@$>XMOi<6t4+ND8`ip&e!ii^ympGvCH2@%FG95TCpH_uxxM23-43aq!wco^
zOinUcT2<}waclJJBg|9o6^DK)2`}j6UbN}RlHKjwXP5T7+$r2@u3E@m6P@&<&NeLZ
z$N$^2^RB(SCL;U(;exW)2QzrO!j+>vZl*}SF>*8O_V!;}bLx-9(?GkAK7j%c>Kx<0
z#GiT|uQ8$Q(fsEk^Hn-oEfudm+}b7lzLJ%*y(8$FoUQf81HLxZTE2OjIwc>M&SiY)
zCVk^|_WzQY?%8qNY2Oztl&G*s`JND({_{gw3QO6{EzZ}H4X*L^um}D#irKjK$fH%e
zyhAMJ{q49bvWICgYu{|!wp9x@x+Tf>?DCq`)s=XA(V<&2m{-{@ojqyI3xV@;%d@UW
zuDBI-&134?hU?L%lybASPKy42`%0;%e}DgUe#bNy+sTDuB3FM&cxOG_6v_TE>QA7`
z=luJ1zpbsWHwxuk+kWv);z!eEepieYiXuO294wOC^GB+9sr5PUJr~~@dNo(E-^epp
zy0<~+mh}gQ%!W-_L37wSU&;!u3KpGQ9(mQ|Cu?P;-i6Z^2R3QsCkP~j6lHlP7<eUQ
z3eB$iwD(nW!4ah_S-mvlGn23KurCmq>9P3KG<E)|7pBw~t+q&BmsRGwJ|{DMi`3gc
zm7C>%Cj`9hi`G04z4mhV^&@T{q;?5DD`>bfH}R#j*w?bM3HlF%L!$%BI_L6xUwyHG
z`M77kiPNr9rueI?(~Fs6mwn7`*bu!}hU@Aj+4vRJXX2J{-8nQtqhdwIrFBOXvwpgE
zMD1(R*jqMz)mQEi!CyCKt@;rEJ@wNE*9-L(tiN8*^EuFOW_fFK<SuWCUuO@e)LLpE
zE?stPuYR1GbAOFy>Z^HD*Y`}RTi&^Kvc&_lJxkQMy{dA*&h%@1t7{ds;IiEUv1ltN
zX*Hz>M{c!Et2?>3nQN}@`801A1^;I(m!%h_Y-Id#cd}9GtgCW2R+hbSnwuV)baTSu
ztAC?%T;1dDH8iTXPuS|RYFDe{V+OJG32fb0T+ZwFG8uAPU;GgBQuKzzJd>R(RyO-8
zCD$pY-Hem{(fsm-T+Sw!%X79ZH@^M3`}OS4r?ssXZRPsxb?QrtU13R<)pAz83zaL?
z{;}s=H_tE8mya|}y;D_n+rc>1)>|q!^IDs$Y4u%uyA6{wx4&jvE%<0(uvAX(37H%B
z8aO7N2xO9%4LN&ot<mC%xqIWf`*x(*20#9ya`?OWvlZ{uO^<f{YV~wGk|lN3^1}IF
zx{Iz|i0wCi`6jK3wf&Q6I!o&D@98_HR6fgixaafFhOk`OGLf#g({4TdcIDH}RO<@;
zSBlIlesnr-cX}%DruOa2Tif0}IM{qgucOl{^v!{5^8^=^A5YSqq_gRD+Qxm}@;nvn
zaj$FB=BP$gsMh^(b5?&G{Oeb3N{*+wtxT8w`Jd(CZ}NI(N~kwI_-|0cq<vM!aoOtM
zWx2`^#f-Y#H#Zsf<r!v#WLFj0TCDqe_&k5HNR`O%=ee_NDqbIY(^<Uye?>^mwWT~<
zEUT)eo|G=Qet*aJciYu|aWk&nda5Yz!1Ct9U(SfD9Q?{=_UYu!-^HcRdeS*|h0m@N
z>Dtb{_V-(puR^<vI|O3WKCI>2qP+3-O}-_?*0)(wjz12)&@Mj3_2u^a_kPUtbJ)}Q
zcKRimFxli)ckb)0J$HaVVWo7+#i=1Ph1$H75AWje<=^?=$Nb5T6<T_;w`{Xk`!cWT
zl<O>&zmbiWM`l#TZrAjwT>1T@kN!^6zqZ=%^CL3T_ScE{?+-ifZCUzqx`*i1(;=F(
zY`-zsvCcK<j+o67wk55{&u>C}vCqvit6GgJdD92;B=?`l{{1hS+2Kd-x!+3Bw-<Ps
zt>(Y=!r<bD!r4AIHfBm6{lR+a(}&JqZy27umsGly&+;N5-eYMC-|f{N9)CL%eovK@
z-2Ks~zbw?o$&+hcUyVxm{BHr>n@?p{`<?y3_&Z)SEmKfcPgHAH;fGCM*3L{`93jhE
z9J4F_GV9u+WbPGAkE1vaeo(s=GdKT6&F+@E^z(|lv{$gbzmU>$EQ0-U$p4j+ZAu*O
zLEVns>nBdNJdx?0$PpjTd;8W6p6JJKlVjs8FUdLITz!r`&Max~qThc{&9Pmz?qc19
zEo?n2d!|jZ6XbTcc6@u-(Co(Ar$#UOWMt+p`l!!eKKoXM<#K*DPr+O5b>bGXJv{v$
zrVpZb$Zg5|_Hp(t(YePu<aYNw|B&{)BY1`==ltiaEZ1ee-sQ0N)7-s}F}|>S;g+Wb
z?~PfHn<a83tf&?*byN7Y_IIp!)r8V2Wusr6Q^Yo{T)OOcT;c3hD!IHH%NuUrTpF?F
zYT*eFsl|eUI|FtnOgwDA=AqYCDS_Ut?%N9@#fox@m*@t3)j3~Sx__(o?TD1`Mk`wL
zF4n*LlyfSoTJic4?S@~a59XCfWM6*d8t=Wh^-ZZy$@an<dB2Z+J$LNDC#5C41<RjK
zDRO<p+pr}xr0LNc#>`ZY)$Vre$NKw!Nxe2Y{6lZ{-eY?wv@i3t<II^X_G&J>)%>Zv
z{*QdFHnJrqx5*|QO0M~mAK=Z*BErDHz`+1IHSA3t*Ln{o28LHG3=HCEd!JH^^Yc;?
zOA_@8DocY8=G`{n+520Y<4J<F$DMW7IUE-lU1#SWy`^-Z=!OALQ_^L_z-S|tUEcrd
zrU<K-PJfxeE%MW4-*=P7_osKuZ)QJrv0~0$@r)T>PUh{i!=8(tTes<S2GjO!cP(#)
z@Ptnff1ePlXtQWL8&}Q2TibfCFfPtpw4!7i<I+=o*6m)5rfW-iZb_V;by7;+^`hdA
z|5vx1o3o%)&wc;;eA93txvuF<Ter;H=H2P9Si{b7Z)=L#0^2n#+gd`m{n{C`;`aLP
z+xg%9<DUthcx7m8qW@&g%WB&YeZPeor?TJL-pRZ+f90{-)W)Se&TSDZk0i(X{l53?
z!Of)xzghgR$pjtdl8p3dcwKnelVjOM!O#85ZmGU~%2y^-v4uSo`u1xM&-N!b)nC5c
za(v3Vr{|1YPWg#<6`tnwc_5zKQ_7K16wOh%ztQ5Gg4d>uEEVo7qZi9RyfCUzc*uHg
zjY?kApVxh_l-jy4-}zMNlr}4K{Vju<NnXskYf~@$P@3m7=jh8XI?p%{zhFE6oF_N_
zxa{=J{e@PiUUh#z^X)TR(6aQbdn*ovZS9LQ;g9MFd?v8}liQtap(B<X&*hm<OGx-*
zZ#3nRru`$`THiYyUSHJwk8S2-lQj5ttX}!gzqHEiXEzRfl-X{%jmP{<-!<9Chb&(o
zdn&9^8r%KjT-j`{8&10)d%gK!_nTp7?h@0e>l(M2?iakRE$O+@7b;<J!)`~c#F?6R
zCeNp8ooMxZyx`akZO7;J3VeL0W~FQTRBhM(U9-1HcG=_dZ?AZHk1p?FRzK|cMI1Hp
zRrEz$sxUGzs4`)m76eLsIhjd%1(mt|wt0sQcv{QnHhHu$xaL}%6H{=$!1pp>frE94
zXpWVd*5sxYH_lG1>YcZyDC)`jiw7L<SNHb^SJYP4oR<kb(It8H#6+n>8(Ow*5ABYe
zDW1l~|LA+;w%nFYGp0vIPARU)7MvH@y6~9X+#h-~6&JnL<GCMiaLWBW(>#ks-Ubz%
zW|KB}M(r;@Qpows(JuSMLc_@?Q<~2uH>4fEsu8jw#`)<Qt*m)F46iJm!m;R>iKEqt
z@`-bvO=W4ZFDrMfa((CjqUr67DxR#nlJgI-1z#)Zaqh}}HHEDr@R!Vg*}ii5zKg$^
zr8=@DzsUPk3LQ8kCdnLnU{dG)Ajzytj+VFi61O(pOgx*Dsj&C+uH#?#hhB{RX>reB
zX;Sy6J4-5*Z{ED&@xpHx+EIW@HCTLt1sNF5m|)M;xrv#1dIgnRrL&7~n|<0{&w6a1
zWRPWN*&LI%6@GgQWtM)8eN&;6eyQ(uqJq$*3m-~ZGF`8~tlxi^)uCz1niX^BEnn-w
z5To;LZ}(fl+4uJR%>3f#rWBl1BH6uWQnBVK<FdF98Jcd(51u?IxcfwRsiyepuDSDU
z>}BW9n`4(=?tO4w%PC{AZuf~#T)E^odwuxwAR+FVCimgW*sDu9oYgKX>1!X`th2sC
z^|OyG!<GKZpEExit=~LjrH$yC2Um?I8k?;a*WzGeR^KqcJ?-CtJ*&4`HPkno^uKml
zQGNbQHGj?>y|&(W(}Fhc^kHd^pJ(W>C1$hI^o9>M`jY-aVox(qZI0lbd1ld)zSM0A
zT3V@rD;r`jO-Q&J#9$FR)o4|OmhsGMn%dW{3av=kpwQ5&@sRz2Ytz&w=7}K*8_$I{
zthjky>7nSlt?z#ww^Y>^XVss&;r-QJ4tI7Wl}~dhRTUO>snpb2*<m<Yf1<{OTh4#~
z?TRyTw!O5>bDxDp$I&^Ro6ek84NwwXs()?<^N|TJcsLCb7Qb%{x_Xnb*}gmKq_W}T
zi|Mu&>_w-2LOs~xd8$2lzbyaJzMK7!-;bmVXAZD@%w2PRMQZHPpIV=9i*D$SWjVw8
zGwFJzTGS2RnjhEg|EOB0f0nwzo3FzZID<1mf=gjNUwhR<9si{J2V_djn67oc37l3b
zrsMLoI(+iW->*Ns{e8RJ^T)40kM5Ume=aVZf8p+)CqbNQvo;1b1f{&O<n3^=+|lI4
zk+5c!qj<xm>?fukA$Iwi+>a8j@&!y0e0fUXAGgh!(5DSd3s<IusPFN)rtn2!iH6w$
z=Rb<?noX3sT_YL%7Nr!%KDwjMDj_zXiT#?$*2xSS7rt3?)Ts(&X&S9B`Y69qI&fK#
z=7Yy9s+}f!ksnR}Y*=(Az0)Hx_}1>Q4J#Ejr26^hY&zGIbaZFH2Hw6GldByjg|fMK
zI<7eIO<~KPIGvd+Ujz9>jwP*hxOrg0(VT5*m9a`9|JSEy9iG2{K`Km<!}!gkyyPkE
zy~odFpL_OoLDof!TsGHD3tiqXce#F0j5FVKMWE6D56;V`T5c;l#lW#8w55K6b`9Gb
zm!}Wib~vnQd$VD)`}_9-seC3JGh(^7O}aX1?Zg9{qtrH@zV_h4MWyF6lo+BXKRuV|
zDBh60w)fSX0Nn#z71GBu`QDaJW4?P})$ap=aiOY0ef%elcw&qfuC+h)cyIfwcf2#F
zpYTbsv~#Uw;^(&w5?<ACs?GB&qw9p@42%!gv$goMWH7ip*V-i)O>A8Gj^XXC#`Sr|
zH;&dEuQ6j{jeBjiKH>dUp)0M&pWHjJ`N|1}4f3u`aa=k6i;CvBer5SRVe+h|Cx=W7
zpPbm`qH^=TNAR-k;>Qiw|JWGSr6Ret`|3x>DGi3r4;oee%T9RACL6huzw4YD&&4S%
z3)j0CsZYOTde2?wyo15o>PW5whVILE2_=YaQQiJe@TrARLggmc&$Z`Ix>lO8EAzW8
zl$!MWn*D+pPbdFS&Ocr!{~gR%Er`_&Q=PF}Nd1*$&ZpHK6H+pJ<(q7|FMd?wY}?@+
zCGb0#r)!gY#R7)~uNGdJ5SYxS?H@d4_PtG^C%JdC&0lTfAGJ7X(E`<7|F2zB&}2Sf
z&KqvTwp3=eXvSS9ndy@LPOAU4|1f%`%}rbNd*d+)+e0%{ZRQ?L*(sjRyRuo{HE7S)
z)irZknm_3)b~p%%?VO~+ki1~|{o~JO%;jtAnRk5ePRI8=W=ht{<p-rXcDz%3BeBh5
zj`Yi`My-nX^Y@oC>ZI~8=Ds*o$-c(jV#l9<3wO^s@Mz}z8%^gdzXcUJI$sOWR56q<
z_cVWT$nB(}0@u%r@5CB5wZ2^ve^N^@`TUBWrracfLmSi2J>V^me6svM0|%!}(b3&=
zn*V115sYvS?ciAaPeN8>h3a}?0pAOCK`gtCK2)VUT{%1F{l%d3TKs1%pB?RKx_`Tn
zK}gOZui{URp7;c-34aZ>wio|CQTLE{>#Y0)hvsT!2EVk6Z_X4gk|{_Q=gJ7RNscuu
zTYj*%{J&$$q9>xu_>SpJzZhiKb@#Wl^|P&Nxy;<w`}CEjSN**gqrlvCDWvk+oV<gK
z?%$6eaJnPRn7M7*Y?}oK_o^~nGJC*~J~QI&R#PkP^A^3mYcmV(ugzCHca;CixxW`=
z57b@L{<1yi*!R0%m3K+~N&3F6kNe9mxx(P*b9dHm-0?_~{b+Id&DP$JXB#@d23sA-
zm{TUM8Sl?uotJmP>gQj<v&ok6yJsZ|EAzOP&(`7+++!AXBWd-QANx-1SvH|MUia$6
z&g(}sW*_t7|1Vg%)lTfOQ!wAFXJyugS%>5uR#m=ReAVv{qxmNd1*fi8n~vO?(#%(7
zeokqF?gZ~?I*&zfglh@DbqVS2x$aUby~Ox%ha$^mp`Pth&RG+~?j4TPc)g%2u;-x2
zlHiMMVeW5am`Y5%c`yFdsbBIZ#?Z&=Ljk9SjO<ZncY%GedmoqVI3vAHxMf<g)vSia
zFF8Noj61&T;F5^N6P=UVe&s4lslT#LvJX0PO(tjhGjq)?%>~9gL|>PE<6m&^NYiD0
zbMx(!UzSX-xY3i4V$75uJ!^xa$!zU!Q$FaPFkLydTO!GdMbV%2>btfz&5jo9H*+*U
z=Kk=t<M`jd!H(Pf7S0z)UGkAH;QEHWS`{qwldp3A%RZkt@zSqL{Fh5F?VBhy>#D@M
z+3FXP)tA^O<?Gk)nl)!5_bRK+s_dc{B^k4s^2{&CgoQ3V*Vn)D#~N1E6Q_?FUN!gg
z-(UT6ZuGg0JCbeFn|bg0?7N}AG(qmS^~a3=R~Ah?6t_(H!y<tL<t^9N-CJWQVkVhs
zEFk3f_f2-nhb76?cdo6PdH?UkyHhOpXQX#C1hrgHlixRW>BicO@T8M&K_}ThRx>P$
zJa}_Sx9W+#E}mMuZf!goCE>d<@Q85CZKYm6v-HNF_cWOPKA(7QR|xAV*|1dISxfwE
zoRs)ZXEyNJ)tzqiY+m0W+ZcYBX*Kg+SwsKi>h%dOmL`w?J<z^Tx=7;NoOA1z8Z>N7
zXxqQmbJyIMx$$xPXWp?g%UmsLW@2tR&H2l*gp&7C9XqoHt`vQ&`2UATGJ7AdOpBFh
zoN?~UyP_f=U0v$<nWp|L*XYySdm(aH(DrNFtr?d@2~_=1cdouKd}NbL<K11M>+QM{
zPNqI=zilTWq$zmk2KV79r*(Mt_HMfG8Gdi~yFcqizb>;&JaXW-x{cfE7`Fs11F?_R
zza(nJvRN11n9OUw?uT*G!w<Lag}&Xuxpyi5vXXv}AG>F~pO(L^Zj)!-o{|gC9bc8$
z+?f`<#8pW-vNgnH;}?#Dos6cAw@$iQ^t~?PQ%qX<V%Y_;?UujiytEdQeR(5Vbyrd3
zN1yBEAKX|sv)ww;n4xWVR)8`44)-+H`6-$=9#`jYIr8gghKu0S=F{>{d>IY*r0U=M
z%VqGqsVtw&+j`q`vh{}5bNMs+4Hqop4t}C`LB~cm=M@Lz2}SQ+aYj!a*39IPOTH78
zoI8_ao5v?fe~A~Z)n?Ul7N@WMN@hR!%<e?pwXbKkiQN>9)LwPF&nw}8+`CWTWmo)q
z%ef@rd34g(S1%;iJ>V_nXSSB>&}S`LzSVTcf~)+CD_%_O6?@1(Gk0^*?W2+&-=3Y#
z>n`x09qYD#-Q}hmX*CKhCKbW+8hMU6^m)ZsCQOX(IU*j}*feEkn(31yZO8I;M<)sY
z{(Nii@{m$Tm4gdZ{NF4MX|Rf%`Py{e6b1WTAq?IJKHpyNl4B_KDCgOMrTri4teR7H
z9f{8Bk&%!SUGE&2`oV15)qtMw2?{3rOvMUjbVTV!ss2pWe%Zjc-}Gtpa;rq`DBr}7
z<+tQ)=Nz<}a?>XLf5N|R#oyNwqe9nhzn2{)c5}wLDzoD^E~$o9Gk3)DC26n8o9%RY
z_Jfwrin9~H2pqh9C3afMXRf|?*LrMzM7%n&hWCZYalwoJRz2J6o<5wMZM}#0#9aIH
zHESAoDL6D-ni+GYa;?d4-gH-)2dXS7-JbSYChC7zdDs+2*}kl{e{Slz&#c<~*RHRw
zAG+2~Gm275oBaJfliAu07a77Xh<<qN`QepG!-n+ljkdL?_e}C+lKJben>atMJ%6Q&
za@e9frHAUAPc-%_`OLX;MDW+ulXY_q3fr~qlEU{GWNYd>J1?AF^F{lWO~RU%ZNl4p
z6_3_2Hzj=Yw0su1zfvHhD&0rDT5(^F_hRYX>@c&^zqzZE4L*IX(cAx^s=`rjM&sJo
z;#Z$r^cQTbb7JpJxwoxsW_a4#x?5YfiEvLm*!9AA-SX`d;vO>BYA@Gx&v9VCGNEmj
zo{XI7n~Nv4Yi}EBw6Q+k7OZu_f8o53rgvBH9=x}iZAP@UM24r)wP#(&)_;DbYsU0)
z-PCn=f4*Y<{aLqSmge4U2f+mG@>mwD+Q8`VZcF~`OpnSskYw%hYi{N_i9>TOI}g}(
z1YZtcwjt1;adx(Y!6E*Th;*UqoIi0w49i&OHpIy=+%CTB%W#ZSd8ckM;}2_t%ghq&
z(F+4SYTqBedwb&Tu*Ws*WvA{v|5;Mvp}}y_D8AvYu+}5iC(HJhbydIlED^{X=g{DC
z{LrMPFr{oBgU~}PtKKGNpD#VKtSM{RvOihAyZe|f1fA7r=*xYPqyO=w?z1x{Yu<EB
zoyG7n^GKBSv*$}=F2w$ATX^X7w||zm;`S_$nzhV+-+zgHGw<B-(>wQG?|!_0>?`?=
zp>cI)XJ=&GESq*XZck0=uS>oWD;yoGPnvyIW8SH^BJA_BuXgfZcPY+Zx4El6Gwy!S
z_KeR}i|<~4*3KWhKXv=jeY3r$e7pMHqsV}lbz$U_r&T;VczW&nWR)MjI6Zm8mYzh*
zaE+tlNi`BS*>BFT5ZM*7zA3%^Sc;_TOBb*E{hA?Fbw&ykZ=PFvoB#Ut>DTRBreA+}
z_U-R_U%hvScAxz6?*F+pe@|K%M%^vQQupl7S$wVg!OvozEgJ<l2q$>Y`ki*-f>KTU
z1((Hn%k-XoQ@XWnt7Xc@7{?V&3z_a!aOtOY?&EkEdf*=8@>{OyR!g=?CtqjI*(kTm
zMD&g1vSa6c77PB=KQ)<A&~AP=N3&kp<SSi|O54)3T3OWDCLfrX@l5LFpJ$s6uaXjC
zj(@dHd(#JoOG-f<dl>TFawE_E^qzRgbC$L3n^`ge<<ppN9P_oZd;GU9W%e6~51vch
zc}kwNIlTR+{lTnZdPi*ELgpS#%bAH4%FmC_@P1SqBKSu#_9FZ4L(Q31T4FZLGuhA1
zYp&?LVbyhb`Oz~ku1<XE-?CoOkxAc?O>%2*4Er-5f#!q3jQa9hn57@tY|G1L@RTcj
zC3bA;*-7!)u9-3^UTh-ITAy&vT;sDnCDdynkHieI%()5E8&0hFE22?ryfg9s9velz
z<Z|mvxvejkExR55XN~Qm(C4fcr>fdC-xjWp{uQ`-n^oP%SF^>}9o(22|H`=cTKCj5
zd){74`}O%tUQsKj+>fB(rk%?ZrK)d8HC4E<=_cwQ*xz+U%Y$pTy!6H9dVzDAzcq|I
z&iU4Vy7feO1?L;DH2a#GM@={GzIQ7>FhfB?dWxKCK1axh7sehlxC*`p8&w)d)b-e&
zTYd4>)zcGqs@%CI)S17m=wjj4@9F&01cTr7JmOsJGI`Vgo$qF}ZOwhiafDMk=;X&_
z{tXNM_cE~L@p>|H%w(L#DQl&(VeKZB&djb^(^@-ElyI`lJ*sJVE^O+Ag^MTNz56=E
zw)Cz0`h^c>|7zb;clXoF1&3p=b0_RN>iFmOiTAR*w#|+EXS?9FOOY?{yMJHaEZqHA
zE_458SNpH#N4sNHqdz~L_U1xB-iw5?4g4E<j`ZFO<0$(0W?4_`LYcbf--AyV-xca_
zbY8T&&v!?sX+4kn`qXdQ%cTTbwp^LjK5yO*>nnd9oz+&Y5R`pe$LyoCl8N&e!+Nu<
zT~TH4d`07YOtuRJeVqAeclX@?f19q)xEgqJ!{#Rmlh2)t;+Ao^%<EPhTm0$5LOE5}
zbD`%pFfwhKd_%71r?14M81wHkRo=b*YifM&A3XS<0d;)qvIKjepbP`U)Crh-=+g3w
zauY#|9q-!yoqYRP-v0aX2XDNcu&H#DzOVIq^T0VrHvTp$mGOVG=X&3}LkpK&?KE}O
zQYlTp`t^St!|%V2U7zND{%9gM-{oD>Mg}qNgpIquFTTEh-|zL8#eX(U<+c7>ck+~3
z{L?jd{rhgFb(>oMt@-rhN!^z%x8A+}lXcf^zWu*H-7n70a<$*EOlz^~?ljk}cOCYw
zNWJ;&NlIw=Yz^P=-DTmMO?p3_-L~qshW6=IXK(G%nmt+g=bC-D(n=3Mc^_4q{r&cy
zJzbmBstz;itty)O`O;RFpHt@TU6lU#Mf;x21?RH29dP@1YLn{f`BzI>*Kgq1vnXEZ
zPMQ8e9m(5|^8cmH+<J4-iCJx?s~T!d`Wj4*2K{NAAG!IAxbFHLXK$5GJfFHW{6nxn
zveNuqi+_(^vT<fyQE0NO-kuQsra@zh>D!cO)3@8!iLD9LsJ*=9!tc~R)p!N&GmlE+
zw$1XgPc>ivLwNC-(tA&Gm!7h@FUs2RN4j3?)W%O%>sL>T&^~pxymF&Yc;&%UIfoni
zSHC#><ZS)^s%dtAUvFOi|L5P+|1Io0A2>5u@CSce$9mIgpSOm7k%OAHpPygHs*B}0
zQ{Q%7OG!`qCoy-vz!lZ##)PM-_m*W|+K^=0=I*-BvEZy_(x%&DIoGxv_;fO*NYZz)
z%DiKbHSGG`mHQ;?X5AHwlJFJL;Z0q&zfW1|);2AVtmXQvC-s^rnQ}zzdNPAMMJ4uJ
z=g-A2zO3fZe%aO-W55xzle2oddG2J16%Uu6`_yK6X~LQ$zlpKFHw1cK>}~ndczA8u
zQzJRegxtN`6;Jmmzw2CM-50TQ#k2#fGWTSMFRwRLFv!|poniT)k&DHeRm`E%q3YW_
zIWDWEyzL(zep=MCxP6vD$VygEPn#H?N%0%S7`T(T1D*?R{H=StJAd^Wjb}F>>7F{=
z@3MQ1!$gNn1u>=QIpMpcuSaf7UbyNCuY-c%+n~w2wyykRWHj^a!bp=v?hO6^{3iI_
zR@o=sf8=`gM_b;7X$zdZ<3!lFCnZeY+FjbUO6}q$x4&)a3Tx-cT{&JED!S*bMPK%|
z8;yK>(k_Mup0$*iFx@K2TjpcTZm(Hp0gYPEo=)1!oFadDebIK$*K779nOuu&cyaE@
zgyxA(ho1_0n(n@$(;U{lCGECS^oEpTzSvoR8ghl(8dj?Laqij>mBO0;<%mjhO`&09
zz2TlNv(1~mXD^aD*?#%OnW~r&^T!#y!D0z5Q`OFHJ8|3PkW^%A>2<Z6Wv5T2PIAZ>
zYA{?>r^=CGvPqls+nPsDPOjExJXC$?$>H$j{%QUG|Nnk^sB!J_iVPV`fvNX>#1`}k
zKT=54%oObp%>O%oQvJcW1*%`%|6FKQkBBHgt;M5~U-o$ko5}t^ZyqI;d}QHH=8eq}
zas9qn{lw&xj0~H*ySv$^FYabPIr+SvT#rDA(eI}hRclKb>>L^%y=B-V7h|JPFj+x|
zFUN@E(i>xqA1U8XA7xFb;yjS$^6AkVBZi7^l6;H2TkL+f?&HgNu($0$qr<GAccvfy
z9qycvd~(~ev#+-8JeeqPyg$kLcXaQu{R_IT^v7&*c=WiwYiCIg%OsuE;;&uAFBM<%
zP}<n}>DbI^Ejo7R9lR`UuJBm$nM;Xqa&Bu}ZoaXhi;1UTK~CE08OIJC-pv1TscpiM
zFU#3)>+GLnyRT=TN@+*^oA7rY-wQ$ycl!s|JG)BGnEvPA$&2BWlm13YRvc2Obn}|%
zzvIw12canjjaz>onkV04XxuHmVY(z&!R)iiK`kk&YDw>ue>1XKW*g_^{jzJj$+GI$
zbH(56%V+T`uYUTc{%u>}-Fy248<cJ_Zn-?W=H@#4Ozj2Hm$RmdRo-+wmegtzbLCI{
zkJ9!fF>5}0-o9uc5%yHl?6fZb&!;7Exlj5x*UvWoyEmb{Q|8S7*;`m2uXkAeGmW=m
zqDSP7M@#D1eU&7pP4znTppZMwcFTlmZ;mCOQ_n1&yjR)K!_hI;GU$8Sr((|gCdI2n
zIhxE2^ZY*^SWzE$Rr=DLYX|o0-|^Y<UFw7M!S?LWmJ;_@>|cDA&t|Lh-i^m5T=Eh7
z_UdI}bJm-e?i;?bB&_%`{rEzrZE-W-J3o6D`?!nE&wicZ-**S6vpLVYTDtAM;JMw-
zkshxZw`2yrJoxLaZ&<vkrq7CoKWwj_u)BrtVAg17(7G$KKR!I6DB<NItqU)IUB0k?
zO;AZJ_mP^-Cof%HCsOx#{vvKC*4oWa7RqgyBo-yjJ3HWKh}QDZf7@AP%W}`g?SB~{
zewIJLkB5yfUG`7TKZ9AT!u_90e=rHJ7Gz;OC!jpbe!`K3cW-<DS^TEaUg8_`n;Z9w
z`2Hz%XxR#X3KCq){Y`z+gw?xl<tFOw^ZMIxQ$Bp=qxrFigXBJY?Ns|a`GKGRel=&&
zTe0EZqDhktU$|Zj2svw<JU7nd!v628Ir(MRscjNBZaty8^S^e<|DRUujsG6BaX(1>
z^q`R?t0l8My5YFXj4+{_2Up2ouKxb+uS>5<&BA3-fqz0B;)*Ws&bq!v?8Cw)K9x<<
z2curBh`FtpQ)0qo?eQ^MuCI08r>S#V!ex9N()0Hm*wgbOiG`I}vP{Ia?!dtozpI_c
zl5@5^buBM7^mTj_pXHXuYIxTDdDxUkd@nMY%wOJg^)`0OzBYHp!burcy)G$7`fqiu
zU~AyJc0ByRa{V<`Wix-yJLI?P5A%$<XE(fdykihiT(_e2$0AuK5oMEhhth9TlJ9wj
z9N({U=b|Q`*$YuI!9NDS*1fjkQDXc3>%bR|j?7JMQpWdoix|g!JrRGPhV%1L{TG{0
z=wH6M$;{U2?8@zV(yxwoE>Gq?`r+%gb=w+F$F1aS<dg5;dpgQe{)1WS@<Z|*Y~GK%
ze=X|aXL_;DZh=vST5RrdJ=K8gt5_e)FOmQ2Tf5cy`~&N2n^*-*Hi~bm7VF#nOf`9`
zL}1t{|AIqRGtF-;ZdY=vk(5r^Q8j1U)gZstA75jhG5G8|EA>riUWu--{!N$T46`+~
zrw7)|pLXC*`Q!se$sG1_Z>Onx@H5Ojwe0LER&Rk<5sBYt)rj}WoB8I>`p}ojx6+Z5
zedUwur}b9NV6D>lym7{iOE-9%yXV9^^IR|RaG%_{-(F02r<uHhh?A`5!}{Rov-fAe
zt1p^Zp0dy9x$D-7)ip(`Kk_#Elq}r1O#b7vXSU2PGP@Tk1+y6>6u)5*y5-hu@8|II
znza2*rs@4Yo1a~KyuCOf^IYK51rH)G-K+X>tMr}w`BQ1(n>%7RSNXRtE@k6Vz7+am
zW$5Y4`j`25gn$0<{W@)`=bG0?<|qlzb^jFc&-=sq44#<MX=iLN>8A(@NAO<f5f@z9
z@%cu=DQkh={)Z>U9{=Gwvusz|F(Ged;fhyTliM8o7H@l1A)4Vk<?B|HU(+^CJaD`H
zuIbkILaX#AMOO)ObXRVRS*EmQA5-K16+2H&zj$HJ6;Hv`A6_-5k{FC0cbI&zRNdvF
z`(>qp$yv!+mMe1?e%{@%_@MH%p9}wG1Vr<@Cbw1h?+OZVa*0mq>YwVMyf^snD$7hw
z`6G^pPr1*UJO5C`yA|axXQe3Vdn$Pq>MZ?YpH{YCe(%qZyXDU>Hp&*9A-Uthg@e6*
z3tIUOZdswIk@O;Qg~XP8t74u7hnAen3#$Gh$+~XIa{o&b!8>Pcxz}lXQ)89S25HWc
zWUb%EMbG!9&(7WbeoOzA+l$lpp1V2w%mlxcTc#XyjOgP$Q~kt8V_}}<=0*3-O=e12
zT6f&BJo9|fbBBO7&*-xvzaRO0$>Nay=fUu~V0wsX*9nQE>4(JBgZUPFesQ(Q&~u!4
zzC*0)LV(xVh^fh{9xlCwMynorDEd5Dz_L)b=H&{()e8(%S4x~$_!5+N#CmQ~$^B5*
zMG9I*{Y-V9?VI?Q2YSTc;5L^Nuvc8iz9m`jS5}DV_C3WHbsfD!uDWFRXhy!7^OXO*
z-bYQL1DoTRw`{t-<r!Pn=L-sx<IWuLTr^+eTtfBU`)5`!DqisNx*}`RP6alV=*bZ;
z7VF&iPJ918^S`=5W04l`+#K6@hwRq{%X!jE7lgg}^wvuJeay;FcLLrmOpY^_cW3Lh
zQqhpGdoj^;;opeOC${Mr{(7)r%cC8|E&J@a<Rh<MdNQl))DN?c6+6Ea&%F9ue*226
zt9DI}j9b~<^x`n@nVfm9>vx|v{BWT*vb0_C$nNOHX}9K0)i683@m5dg&C}?zf46G{
zHvdUt_Y`W7Ntph+RNxS6^j7Cno{xBh7;kO8;@FyRFmr{vnCd;bH=EmxBaB{G&egqV
zByC)*Ain5;LgB%NV1qqRoR&6O872SJw-czz&2(30J<XrrTB)_mP%1)h;)fq!V)wm}
zTm9*&qn@V5;h8O+ckjv^+P*!x|ML0e0Y9QmWUZ{Tr&`=%pD-god-djp0Z$dB-M*e}
z6fKjedT6!t&b(BKtY^Z<R_Aobo}H7j%sS1Xzg%RFw(iT155IaSO`SJ)UaVK9jl;Ts
zJNi4@#T#e4_3v%0ukiHk%@EzKS=!_FBejjW%`C@#gMO7jiN?3EimA*2YUvF#93O@(
zGht8I7*&<Vw)edMU0seRK3^S6+`fF@QM{<wWc7CT(&=r*yCvO{zcHsyELpTHUjE40
z1``>}jAhXq51qEYy8689rS$atvrM+9{dR~=ywv9U_IkjxX|wM<un@I6e0uYqm2-rx
ziq)N%b=saY3IF5>wB+`AzHqC?p98^`e{wuFAD<rgaGu4iZ4(dO+hfpRI7Q4TW6AZq
zU*p=UDpHj1u++V~Y`0u(=EH6ANecgY?cL{24SC-v)WJ~qHmZNK$_sw2r}s^K>q5Wj
zua9!&yS>%y$ilKerD4mf&PUeYT%7aMuK!tO=;oY_bx|q1mswwUG1bb0S^iys(VB|0
zB?>1eB$*t&otZUd+q!3}zeJ6sV^)L|c$}Vc;XT`$lWyGSi`{*1I?p(DYUzRy_VoSn
zvI(mqAAIoH^(sA8ebUcU(x*}s*PS>MEORP6Zo`V=t?$LyChXm3<7hl##<I}Qn-_7e
zHN1WFeb;fd?NvWaCOEtE8ZUUSAjb8H#ntDM)}CiUJR-WRsT(4`KK#;lRl@V7%jt@G
z0b}870lT#R@oWBh-Det6Hu-9P`;`2|e~Zq^FI>cSp?K=cLIIUmb5#_!wojU1=DJHn
zGSeWuJbkq!v(^N4#Xn}uGq!I_-t*eg-SLgT!>3PWYm7zto~f4}wsf^{6e@FB<P?^@
zKRSC_$>r@`Ycj2a%tIt&RD!DWe@?N!ddzHo>B$pjyak!n_E-EZpM@Pc%Kmo86d~KU
z{K?rFoDy;Swn#ZIQG6fjI8j(o|K!wN(@*uudv#va-BHNGum4tAA&b3j@haJE^~}y5
zOD$%-7L}j7;o(}vy{EDc)SflCx$E}ZuU@rBx+dA4Xxg@K`Z>umwl|Xd?Vn!sT=_a;
z+Fk25xvkPNo^$L|PriD`5M=J>_Ew;p!*t@!OW`IGjwQwHz6lGJWEZAu2OJeFIQwAN
zWGm;nb`v*iUR~<7_fM|y)YQCK3*N~qE=)Xja|Q3_FuUcGpMO+8r})^!;`m#h<4MPw
z#piP0yZGR1o_6@X8`_U<Bp%|c*ErSF#_m-(`M*F+h=g&%_4`R{b1uwk5r4{|Vd=>5
zeZ}%V#n=@L8t<=!94=TpHO_E*$Faq!ic<?}-2HTaXC2`B?Y_SGZ=B47*XjQ?p6m}j
zv1dAKOJ(re0(VE#|MCVe-mjY69O=6G+VP@O=N13NN|xTP`2XH4?%%{2A9gRT?V96m
z&ZB-^W_Ma>^F8+TFxN!O_Rn9P(%&9A%{_PST=qVb!@_*MIYBQucUR6%x+Xu#^yQko
zHtyCU)!NMgx*M%dc1>Ap!8bXx#30>hPej%02R_FSypS}#_;*EG_o_HI%Nv}<+YVeX
zsOdMmDc8@fy*{F3bDHXLf#AntulGbWO}4NxNNVlYoR-@1`Qh~q1^Z-|mWN67F0QoU
ztU3M7&u2lh=%w7?^yQD;FY?^FdC|ejNJNNdqXZ+r(AIzxM>B6;PPC2FNcO%uW%@p*
zuY3JYhF)2)g=NXD9EYX++{;R2ZJ(&;WoZ<Bkmr(m=)Uds^KZL64MK`M{++&Ycf-<K
zlDmSnV}5SGpXqkzVv|aLY3a11ADlOCZ75jPvE-3odzi3p&g$Hvs%JVk9}8-J)7-^&
z-#4+)Kjh=ALkoLWe=E{>oiS(rQYCw?75To_D|l|GJF^@tE!wHJzFcI^ytZv38cG|>
zr`&yTT+p;s&Mm#}o}+|4=eqpOMXRN3rK0=u=G`;6aEbMIk?;k-&IOSg;;U<&1bvu!
zIX2t#&z`@}Rj^A)TPW_=r+)cKdA`r}ZFz6^R<uuiWopysv~1N+!yh@itPhrF_ePrw
zOv{(IUUj|KC%kP|=3}>KKfXFY`rCC#iT}YH)|%>j-38CxGiD@OGKn!VRWi9pew%MK
zW!;Hf_e+_@M`Kyei0_sP^q%`;dHSC+w)v^N_a9r?&9mcp9PoHyoQ&wcZ##6FuKKS&
zTXubuc*9X{t5Z+ErStSCOC{Kxsfu|rOCW&#TzB%FwCM|z>RO`xOf_HB*Qqi%a{d%f
z+;Hd8MqlYF*D%Mk>modN|Je1-u5MQ_&xf{2vv^$V`Cn;x%x%Auk{>m-xJ4`7<DSts
z_dK3w(Gp+fQXX`;S@tC>+TNM|R5#fpIq=PgD0Z8<{HwyEOOG?uZL_dko!j$h&cACf
z+G@WDEOH7x@NnDYrQ24>|Ij{v^;mG3NQcTsjbt-}u75W-ow@STMw#aa`~8TwGj=eY
z>`mKQyya^jgK?IGx%vX<MPD5&m@6!zj7$O^9aZ0RQ*XoHEy;0$%%Qh#nw37)zg2Jf
z=yDFf$oVk7_hO|fxAUF^yDVmTpSw@O`K9^YQ?&_wbvtjLiTr*{@9(e2QQJeg=I1^M
z`}tU4@9({H+y0#T(QxCs1W(?nz8#ucdnd9kf4BdK{_iI#0xIz@cC*}5wCCAzzTfyo
z!lb;<Mb~Xj&M=iL8hmtOC|SOWxuY(6^P1}7DOJ_#8s`LWCH(QYy==y7&NjyAx|F<`
zPoAAP*UpuHO87@z>RHdd?LQ0EZ4xBUZrNF^`H@3J`sA@4i7i52994|E6EEGLKk3=D
z7oWCTzgg>FxG!SC`69PsmS-z+EW$0AT<5syhQGh8f2jDrYu<qu-{N<PPuaous`Y{=
z*S_nl%Bo+)R5JoYB&>T`9Bc}=u3eQe^{V^JZvV{*=T^Gzwzr=ba`$SzuoY+g`>%QX
z&b)rUCU#A~mzU5!^(&&&@9qqnq?fQ`)rZqBRZZ95wPtx5r}*vV_JTs4KejP!@@s8E
z&41pz?P&U8j^e$%=XN^kO9YkXq~^^wsaI(z&s=k$Zkh0RsVUBJ`*w6qDBBjfJVRLg
z_`=28KCW0-xW%c^TlD?Mh1&LEf;J{+|Ky5)oz?j0-sZju%=6Ez%9$Az>-C4P@6e}Q
zXRdiOGWc1S_&)0U%DA{;!j@es?;W2+D$n73b<guRoA%9He_xm;U)+_u{p`=h?$;!@
zgw}rbm>Rs-=%C6uFSVby++I)CW&I<gekrG=i}8wXN4kyS{UiS_WdB_y`#qJb=j6OC
z$&0&nw}@Fxy1VDY<UEd2v3{}Jouzx1w|5FRPyMc@bpA-W(!@V}Eld+Og%~ZmQd>KD
zvFDLBp4%5(y05BSdi3du^I9AD(#t<P@*15IJ|z|{Q7XKz?3n(+H@1iFEYa}d4WAm>
z=yH=eN_YPQQGM4G)7-5#9}_+(e=K|<<$k8S_|xB|a_v!*LK3f}Tw-l^n;X2n=v3UQ
zZp)ur*D4wu?km1-Beq0@(f8(rm%pSZG~WMpr{3Y>UZzr+qotu+7glgt%I$S`)NW14
zUi<LW&i^|qO#jRk>U<i_eoNBqM^0WvIp?Qc-x%IpKK?^coMF~?o5y!AGM1IatovO&
z^WogMT+xe1a?AVTw^hI2+kdpZ`nmYi>Tim29|aHo**eqF`Rk5@LKFT^XyBFMI^2G6
zqjSS~oqdu5W|>Z(ckFdunXIzL!)xjn{inS<9?raIrD|m0_}lna<IMY#DwFuXC2)Q>
z5V-f!KxfVJ$shg-OrFrYp!%`fFZQh|cb+aZTcv3bd0FbFOj3#dk40GpUedlRavDsw
zd1g#*m0PC$Zm~o2w)2lRT@WkS^E$>VQf!WcfM4|NvcR8*UhQak6?<f!M9DG+>sGHT
zp{xGC>ZxO%QoW(PL4NVMdq1sx4qeR^jeYPcEMc#HK)BAsQYD5Bd){`g@O!XRdXJ^W
z)05I~mLGfiwe5n$+OA3WCUsTtZT4VJ4vd-Cn|=S+6kfe;&n4Oxt=BSB(VM%y_Qakg
zw`+q>{cw<;#%<el=glqI6*p?RHV14x?7gj0vvFf+anhp&`Vw9K^+(T4xEwrT`_bE%
zSLu8^CYmg%`6cttmWpL+d2>zU)<tfdd+f#i&)G5OCVVLQ<ysQ_wky>n{o=ByX9lbX
zzt?U#xYGZHPhOdPbK1F!BCY+0CvMj)IDI;p?~ud61(_?}&f30qoss>z(zssNqABX8
zze}e#*SM%%E$s9!)n9eOMuIb<c|r__-K=F!Irk+?=U%-$<A#A?&V~24|4#EQT=(hX
z`DyDyo5b2#(=BH8EIz5u-S{@3>eTHGb6&5qn3r&Fq3G4tyaTVLTk?;7TwA8QVwK{T
zN2)uYPP?#h-hr2;WxWTDzVZEP-?MC~zlNDqALslVQp~MF%;uMW928jd<H2Kt9}W|A
zCpWDsPd${n&hX16ZyO1g<t){EW!rXYSPRab%DLs!#sj4ywPwBNwp`+!b)aj9mb%%i
zg|jX)Z*)pZSj@KKT+gKSR}QQS&6KLv?Av=WQH1w`khf`1q@Q?`<l^mRZDx%V+l#p$
zRXB>bR|xO=*fs6nN)My^PmdafUSAb|>Rz&a=zO1p_T}t-GXhS24`)+n{j+0l=S9K#
zi0(8d1FJ(yjwy>WIhd|Sd!9bHC3CXEl#NVzk+YNISy(paU$fv-J-JmjN<YQNW0JJE
zo!sqj3pHA@T^H=Un>Wkg$#wUMXH|0}EAFYyTJ0A4u58<z*x4I|?lnH}KU(|X*v#rX
zxBvV*uIK)F!DP=@6Ga|X-z+-OK1C;TQMyK?(h?`BTZ?wN8ujz?on%?NaJq!ewFyV>
zWV|;nIJRzbi14R-C;0+J)^3|}mY3_!(iai;5=^gZSo~|(FmO^bU(L6@#B}G%gE?Wc
zk!;P(ci%`IG0I}v-(s<BmKIM_=GioJ_4Sqwl4`rszV2yiYkik{?JDo9D1+-^-z=X$
z@o!#Hw@fur@&)Vmy7PxPKDxCTU07FIp0md4M#SHVH(o4@n_$1t&{;`m`Kv|jj^B=}
zt54c)diXG-Qk$jSBpcrQo?93vYh_)Jl-%1h>HNzUtH|uhu}`}_=0rOjTp?AX_d`pH
zZPDsY3<;dEkAzzvgnn_^`%JsVmG#h(+iZ93moJ{FT=^twF;}{4U901DspY@3T6ea7
zX!ywd?5)$QJC&`*--72JV_5sbY@*ElMipZL)-#RI*k1eXlz;x=pUJN>{pBiAMp=u#
zE$ec*X0qSSp-KL;F2`wA4VQb#pEfj3({=pC=y?ChgDZKT$}e7?A7`_i>jV3||F-(m
zulgQdtGB@FYQ^5$d8=o=$c|gmYrQ{feZ%A^L$mCj=ILtvUsI1rFmC9HXF9)l(}~Q=
z4>c-&3DeonTOTdhd@Ho`yKB<<iZzqE8O~OSSc_leTJvK|Q=&)M?L+>jpFG-;?Glyt
zxX^ih)w87*0fKG?XI~hJJ#Y-mxqfrb)}Ksw<Jp7XX?%ZI<*>mmt~=-L6ZFezdbQ3p
z>ToeIcqm{Vmy(&637SFND;b%8`^3+=`;$(IC`{eD<6f<1SOb^EwmGHOC-QnnE-7VB
zbm3D~6LFs*dFtY_fA9b9v#fZz;hM%P_U<{4cjxa@ocw#W|KHm>X{{-LXSaxIc^j*-
zJxTI?tor)D%-rhy6RPp~uG=ECK7Ib_U$1;wRat(<6IRa~ZBJ|VHdVVA?)qeN|GR$W
zp^m5^*QA3hk|v$V*?LZLVi#BFx|2~K^mW3FnhwvK&b3czb7a)2pba;B4n*pSEOb36
z8Y-#3#CG$tteNS><qzcI&a!Erni?&8aC7?nR7>^{!^xYXBByDcUcEhc>%rCP2YD{I
zp3@Hb@#fprvbmz%PO3Abc7<tlRnC0cX}v!F+!?k29)HXD5`K3>ah-)-yP~g`^S{qq
zx6bYH%`cB0{>`wGj<1pMEnBxSX)<SA#?0HZIfE6>M@|%te{rtzsKbvHZ65kz>)&k(
zyyTOA?#onV1r=A{WhP-UIkGI9EuuFxadJt|o4zzf%J+Yz{jAu3R=fVZP5V>#K=4QL
zF41mN(Mgq6fyu^6b2sL5`3O#pTNzn!G<n|qiMM?i|J;e`D%MinDbOv%s_0z4#@yid
z4|Uf$X_k|j6`q+*ekJJpta$6+DLe;MT))O$5Y1k{Azw#Nbnf%HUt89uR;w;Qx@ZZv
zMf%Dbo<|RQSUy&*tzYslUQMK4_|J5v;wG^lKU(v??9y0zDBkYB(C+x+dgo%PD^s%9
z@|>9SdC%TyDT{o?6FMWGt90!0Oh2oV#8fOAk|TY>%x8fUPt18{?YVX_J?WGCuU|Kx
z?<Q=da=%&Q=x)J;%lofCdpo`OGu!_2_ud};QTu#Sno-x={)Z+;i@F{K{m%$=)&6|{
z4@dC<PTfnJD%Jig#-5Tn^}G6pL~Q1q|HVsfs_$KW@$1p!w<Tr&3%>VXd@Az6BsD7c
zzg^XgJ9l~uf7|@h{LsU?JGNw+XUE0W=`pEaGOx6@oZfE!zToD{lb`dBT`xE85T4xq
z{g;z~&lc-l8rgrXJ5NjzmR_oGYAS0>21lvQ`JcjUTV|{e+v1_}qyJltlH{?h^sq8P
zzqJRKdi>vXk8w(ZIHz~4hT%trC)u)l*|$#r=JEf1${Fsoh$G!Ue)oAz6KMF?;@Q0G
z@&}ffh6xFuI|V)5KZcuRIGyZTRpGg5(I;zOb_p%1<8v4;+*6#ZGR-DvgZk`!JPR+)
z?THGx8pwO(7H?tS&Uu{Knj7CwbTgCL_Vt%UgIV+Wj8#jY?(J3FG->r#S*a5`^^#^Y
zj%aRJdorXU_3@SkGgF={Z27W3Nm;Ss;Dcnw?~hc4n6vyN67<%&hOO9;S!%nuCQ2($
zc%o`WKkJ;xLp~l%2jhYjo;1Y%Idy=+;j?LqI#)7Vk|L)F=Q+0nGAinv`b@6VN|;SK
zwx>-Ljpv;ESx6|&{iH%{%LA1)!49fZpJ`3#x~cremB~l_enXQIXXQq#97RsC%*Q;<
z?zjFwUi5$c&Gg>|_x?Zq9Ni)9yTUeidYFpniYVpDx{oAkPlwE4OIB%ao<7wn;S>A)
zWHtWZ_h&oIubm`$a7s`%f0k(0#1Owm_Qmz$j@&QL#T!I!w(#Cwu)lJmO=_0suUg(C
zw_J0jGd~0-x!hc+rNdWv!C5ML3G3e4UzsXTWOc7rFIcViO#I~Pe5HxLMkcX+uh^JU
zoim%y*rqf%zFYrtSKo84qaN)`FK(Zanc(nhMccBIH=IAmA2EI<eP&W8?+(UYZJhZB
zbcI>Z9^{K~i3=!Q`<Z>(v?!+osbMJ*U5E9LOxIbdlzO)Odd2-0-xyW|Y8Z2z<o$kj
zf=2SJlD+3P-{8D_EY#)JwqVJti<)Xwx@yA$uU6`Z)Fp`bm&P_1c?G&BM%hQpAHT)X
zWBf*OmC30mJO^9%#@+V(x=iP?$?vx5(W>VX-0$?Q;HXG<6<W48@57DMCEF&tX>c5q
zSt9t^b>iQJsv4D?sd5*~8>esb@GHpe_;&0=&!on>3&tY9vTk?iERddUx?6C`%kQzS
z35T}y%Rc|Sev4wmOtVZmf%$(NnAW_i2x|$*XbaF@5VWN4l~`DQzRwD;_pxW?%qFb+
zrm#B6cGv1HdSW^oAH`lg=jajNfAiS)u!X;Cl$0!fsRv5BJy|*D#Px&v{;mB-zh)b#
zs4IEIE$qshUm&G+U20F8bm1zylFc8bcvcGwzR-IX%JGk<EqvD6yq$iB7xnLBYtOso
zcX(m{zJ|v~BU<XM8Sm_060yYWRaE)M9*2(BvJQ{v3da<)qhWGC?>epKTlVz_BXj0-
zDUA#F9V*u*{N{{S;mVcn+wf}99i`T&Igj<0y%jxH=X3wYr>8uMOd^uqIcrNo{%MOC
zl|Mdt_-Vhzkzav&k@LR4KK#l3vZ%_*HBKV0R`yFwIN;l$bY1e!>$wk>`Y~i&PPK2V
zuuXE|TDV70rR~krS*|HXuKTmpHr~B#;N!bx`&Hu<SKlb-`>MS1?3G+^e0gdoZz+%r
z<6e^TVt=dqn=@?@)^h{}4&RbBxv8t9z!CK<i-GCf>NCAdXZcN2I6b%N#;Yp%M92R^
zpFEgYuNhPvTFH8~_38#KC3%Un6Q^<Stt;EWb72bG+nD}X5wYz&EN2S50vZIG4<GsQ
zm+8iLU+o9h@1m#Hoc(+7(|?Zbb@L@zN)JXaOnm!jN8?J*1Az}Z8T**`a_Q`Gs65tX
zk^DfaO7GHio_CKWo@#8l<4|13p8s)Dy5VGJ&YR7uiPcJ1U!OW1n-k?Ds(c{sSzf>;
zll6;5&honMiu|Y@%&For_v{pn!e{9j28$JEIX#V@`go58*Pi!o4*zB<S4h0r%9WKH
z`(k5TPqIR=^Ln}HYhQku?wvaAi{K%19~(}M>%PrwOYN-oe$>ucD_a+kT5@IiuNQ|L
z&$_3t2+uaMF)%1S<@5L1os|nuzL%YFK5Xu{ABC^p2$b<RmaW;*eD~fB_lCWn-rPRP
zyW{7=L|K>SzY}lF;<(JX!#eP`d}{8xE4tIX1N}YqFJ(<mT)cf!bWXv>%R9H<iD(v|
zWBy!@<J=Z&i`|DD`%8*_jCn6jfAzWI?pNIyw~s>Ad)PGNCj0$)A<UNF%of}39+S7u
zbWT(6yDz23Pcu(G)2zK%{dR@9Rg#z9>JuB*|GsobCO`NaU)pzGCjR0ZNnWoFE=Z~y
z@!elNJLPSK@3yn<9pY8D*bF=-JLGRN<>USNS$WP@N5<4(%i3VB-Sao{oy$1;e6nm^
z)a?YxS*pgY4t;$E$)-R2gyUyN&*m+O)#-Iue6#Q0nf8+&Yo;XROc%<RS8EV))fHSL
zbfG$wU1!FoM;q)Id;U1cG27nA=TVZKR%N0z<B-_CUo}#REetPor5l_l&OG^`<j0Px
z*ZD=o3^{J;mdj5H`f(qdbkl8960`ZTKp)i)z0S!CYVQ5vh^lqJ$|K#7sM=!v_n-9b
zwnjFwFIA>|dyNjOY)<q&naL^nB+=Ks`}eb}X77Kj6`v8^@+*<?m(C%E=TDi>2r^dP
z;F7U!iz-+xe248d*Qdl!znA{rqvX-Nf5G!olRJOzWS6eWKJ<UNlWvHG&$+$-nGg%q
zK!?27+H$D4s53BF&&1q-nVDByl9-bNy8N&<vHY<`--GXexXM!RpITQoWy$ZdUFPL8
zXXdDGojmuISFEb(<=>YorH(EVF3mZqe6ny;W$FIE3<66$x;D*yb?VKlvn7^7oJ|TG
zObQNp-Jki7+rQs)`uL_5PtRqlb*s&PvdK!o{c}l;cKN>U@7uN=on7=V;;H%e-XD4S
z|9{K=IR9Tre0$IzmDigDX6~7OxyY{h)S`(mbF#C8rW#LFne4iGMara(8Z-UXZcAJP
z%`zuXcRib$x9sWGe_i{xmz;c+HZN@JmHN}Gw7mYhN4}2VI_FejaM;`K+be4_{zsVn
zyz*!3j(OovBd+B>bpO1$a?bOky&l<x3*$p47511mUGJ`$)!U-;?(-_04ZC9=SjpZ$
zsdV}OwOxlY1I=HSRLwEdoIXeK;If@BKR0Mpd@`6;ta93;M&tP=k5?s1?vEDxESJCZ
z>|4f~eNRg_o#|c^b8WG%VBG?bS@t~*24|Dz-MQZI+T+aUk9R}VE*qWY@Q8HoG|u{P
z{!`(J6;~f?%{OQJ?sHE4XY(4j53BPw?eVJ9{d`Dw^{&Y$*jHwUa{nq`y;6>!!~I!H
z<ScPrd4}{S!B4msnAaY(->wqqI45Z4<W*YQtVz*-H0LshW^LRvmDMcpLqy<bL$m#R
z&K}=>!90+m`mXoKaM$HC7-Q}nQvV@;;a{Lm*33@N$j+a#A+ph>r`a^ZyV|_{KRIb}
zuz410+?&o?;AST%{_$viorUMUKQEu0o$r7D|L&{z<Ju%F9;a<QzJIAHkHvnAnP+Do
zf4oPk)oZ@}xn-4w?Ni+zF+J<d$uT=T$(dVt{=<7t>UCPi8E;%RevB-g)4%Y(x<i-i
z<T(GQJJ)<FnRVSHa688|Nk8Tp>O9VW1E%^~>MajxJN|J+=Bhtc7d^5y_P#ox#oMEO
zidkN$PfBDGyV8D5uQ}Zj<u<;rqhvzOx#!f1f2duc&2w8UZf{lT!55+i=Zs%*^j0t%
zt={ubG=<G4e}XS-!J)5<Cz=^vF$w50TB+julesXq=>7*sHLqjaGYggf`YR+%@ZPh%
zKK{w3kN0#JX59^WmOn4$-sx9{jAh?fT`T`-6L^WII%s$4tS`r^nfHITJbdHUD$)Nc
zr?)K1EYVn`@hkQ9`d8<fWwL7SPD$c%ieJ*C&G7b;+Zji;hMtD?D-X;&mX*~j9?Hth
zG?`oL>85*5PM2#KU!@gI(pz>Q=>SjCO#kJNqPUjH_Xs#GDs{SZnyb=rif~+n1ZR_*
z#ghXsjm{=1o=as`wwgQbbc>+Mnps(jAMaPHW=A$EB%E1r^7a=yeaAUduU=D`d+kz5
zpmTqtfP*~eesTVjN%NNWvINB)dH-qGP8O{=#*KRGw<Xxt#G4tMQ0cp*qnvrfCbD_Q
zT(22tnQm!()IKy{Fz>>-9diz*&x*Kx$m5RFpUeL0&(q(Zx8HZOHSF@;UtxaBt#cn%
zm2<D?xFB@-LPLa@#j%3*^Tg#}91eK%XI{(HSrV&Ca+)Pvtn-yr@AEHCWwQ^C%H-SI
zx;%fQV8hct229(Qy8f7`(dEqbKhAqbeh~NTj2%qvvhz%>9e#OsyM!?N%zV%xrLr?+
z3!AF*#Lxcnb~QGZ_VG7s0^fabSzgu=$$wv|yQMJFx$m)%xX?ibQ^g|H#f@Sgvyv8+
z+<bWRW9SFV!=~$7c5Yqs$?fc^DBouyAGDUwblEvW?96<FT4U3#;g3C?-ewEs#4$eR
z2vBXD=usljcY4dUEt79bO^IlW@=*M}K3h(OQ-e)(;)+v@Z5DQx`z`GLW@uM!l$i7U
zXhhfEAMte^-`lbUR?3w(d}f@OvHZou7h7E>mVWfUl5m%`<X>R0V`rf2n#{^zdw$~>
z>#{XlnI~vJsIHax%UIXvc<F#nb#9=+t&$%Sw$JpJ-f30~<5+DfeO><gqb}{6#>Xd_
zDlUC)x<uwG6RW*P#)>{|?xLMeJP)HK{^sS|el1Y_yXm9N@l|Z9oo}1DJQ-X)S6OVd
z3KA+QpQx*KM3OCK()|OsG9Le&d#Ko3(|LjVzbW@T!!{I5^_aBh#B3GG1vavsFIlc{
z;11a8ciwHm$$OqNl(($g%NVrqP`Tvsj~&yxw7t6z-TGL<lzp${(Y`BR_m*DNWL_W~
z%a=AokF8dk=k6q_#VjTVG(|4f=g;JOX?|y+<r<$Q4;wVUF=(hfoqH*7fsv<T{!?Xx
z%FrdoA@@&PxiJ`OOf~*vc;G+J;S<WtJUd=pXbatK%f`+0WNO~y+1mu`QWIn>VwiXq
zyl&vSFlpOiuiFd$aEoarvE8yREZqGrO+lxlv_sD8Jk#tIF$aDz-_d7gI6jr-E1Ot$
z$jMpJjhofj&#|0yf9f>lg45PB*=7xIo=dH|_fz)ZwbJ#R-Mf}wp4DV{vxM<eTl?wd
zPq^e33FcNl4)`yTH`8lD^}{QrCpfaS`IrUUwp`G1em#9f^HY)3s8!JiDtec*ei0L|
z<xbPNr}egsM`c|gli{Z3g+XnNMPeGJdJEYY#iExlShvjJOp(^fr<26j96Gdn&$fh_
zlQe#Ls9!$ZmsQ=hv^D68_VNJL^bHbeAC56iYuMNpbaW<LVe9Ks-M^N;!B1{GKRlPr
z5NNU~>7>hMlS_}Zvv#^frm>t@`8$Erbfv9Yr;(83frI;}ADdWYD)jwjiDP_U*Kt7!
zwwDo$EYIaL868THdm$>-f3quc)eOtbQ!Lk>Fn0Sz>~47OQS5%-`;d1^lh(h4rW~K7
zo`8)x6|6H?Cj86`5xt<fX4AzJ>nuZhpPK$kxG_sU;?X7J8B9UK@hiR^l&C7!K3@K$
z)G<-v(xX8A1?%PFI<rN@S2#VYI%*R!y*um7H2G7SMl09cQ~1H?lX+mr!^~F?OJ4l7
zZP~=xxu;&N`su%a`<AWnE-ateJWDL|c3@keqH0A0>y-zaUK|oPtja3b#lI-N>x5AB
zGO4}SC#YR^t+l@Jf<bW7$K0JdIaT^6>~?q9iyoLX{R`I>v$(9AQ=e$_nTPJ2VZU8y
z*K;+=Ye9K?OR6|aeO}&c+|O|J=;DiJyM2>i^$G<hUs{><dDTwcKz7!z%|7uzPJH6}
zA*@z$w&9Y};px71aXy#1OpN$>XH4DREj4|W*SX~e_JyWdDppNF)7IbKW7Q}#J2pLY
zci2u|t(`N<VwpPrO%uDcR<CzOa|83<5<N!4w`we#<3xT&XvzMLGV9&e>vPsiNjqV?
ztdTC)7nAIb+(o7TI9!<8;_qnqKVtsXl{Y&rPX5iiL(vh}R=C83neVQQ)qnD@|97>0
zUgokj@~>z7RphMNc;r3*(FeaL-uQnn=}c}0+pn8449r(7Zt{z_*339uq_}ym_0JtG
zra9~(e$};#@-`W)u586u@>5d+_Aol>uX|i*c{?<>p|te8z39HL@Aki||DUXFt6TKp
zirY7N%{Dp1Zn;(U*ZixWda`UxS<n5_L^Ip;?364A``f9q>WgeSzp5<y>1?do<n`ia
z#q|50mpmOC;_S_KY_XdE;%;b(XwYkMOCHt6J%;<^`oqpRzAI)3xxeSj%8RjUK2&~v
zbyZS&t=HthX_G#dF5L1?h;zRGi}^}TT_+bQWV?lEdR88NSGBLvso`7q4BK;#KlBgq
z**R?&yH>)GrIF=2qu~<cv&sEyK5sXkH7oH`PsgvCyv)1vw=I{FSKh`anr$H;ZoGEu
zpXaRS{>7c}OP?dkI8CqG^}y7g$h6)w-*!Be6uP6xsJL=sz}xzVF(Gk(8Bd%DF7aOU
zO4In$+x{arE&p58w@jRWQGVK-Pj8y{xa~OgfonpE>bA7Kz6Xz;{qL=&a3Ecwf5P`U
zOUtKSE5DoiW!2_ev2$eS%dRMGP5t)$WB&{OS9yUt7wy~3rpB%FxRe~)_SJlSsL8}c
zr2{A2ZYlCAwSM?<yW{)ZDO1aOe+fx(rncVN7stvm&%#C|w>I8?nSG(<>VWy`qMId7
zGhSV?tWDvT$edr(ZYe$IF!|wicuiblec~<W%u42676)~nOzP;~_Ac({VSalBr`W5T
zPTQ^VUG$-?Yya=N?`;bH*J%8cSG@8xto&ThEw9?OH`e?-SitmAK2IQuX|hdPv*(wV
z3Hw*t$#?j(mNB`?WNi?W?^M66Ct5RUK}(oWW1ZZ}zZzd2AA8Z4^W4fPyL?sjX6sAU
z`6rllR!`>rDdOSpW$@v4bx}&_3Rd2<XRJ~h#vzCGJ>RQ6nH-fU*c>paC(vio+f#u`
z|B@M>&7T**r`Ypx_4H|FcQSVTQd@X^e_}^^;N3@8t2k^{ZqIRFVs?&0^=8I;*{=!H
z3$|bVR^~2~kg(VBcKp4IreCtE^XoTqT#U4enY*ulns#Jy^0zxJuA$rKMVTz%`5N{0
z)ykupy0@!#?A1QK`{<q9D|i>TxHz|SRmnARI9@;WW6hC<@Cgi|2`dho9R9&C((*;w
z&a(FZ^u^_|$1i1-bRYEz`}t$_0^b$ZuU000G+D1&{KJ1%?_1BWR&x(5`XF_GvSQ-L
zve#vYBbUE5oMBwKjr)H?){--Mn@;7a{Cf8+i+lExW%I(*#nss#o$=B97@-&NQQgNO
z^kmu9Fagfa|GuB4!<e?pFDbii9Q`6AG0A`S*3HLak39bB^k?-s5%(FlYj0#E?RdOv
z=Y-&F#z{ikS--e_+R+mFb)h5Y(~gq2Qa@Lm(hk4#^Q83}l^sHzrCS#>E&AJk@7|V6
zRsQOa=6~rE?GY%E7YMF4+Ht&pu}7chtvQ~bHQA58cy{;e^&=jQa%#uRIj>2@xZT;H
zqLhAd>T01!yV$ZG-YyEvXchQpV|8s_P`u}tW92F4zuU}y*{#@LV_PI`%^ejHCKl*C
zFZbY#hhIu3<}llQbHDQ5RaMtP;^E?m*w*w6b%wJETRm=a^Gb6q*~F_Pmn5+y!?Y~d
zvH9@k=x>h%?>y^yEPl=7neYr93Hy{83m*1X%KR6bUohK(OL@y@H;oL(kJ*PWHgK=W
zdwlL$^so0R?f-5%FHIBpyGi`0gu2-bjccjXSKe)2_#-S~=fc7RiK{m{CHHupGha~f
zt1J48*a>!(Y_GeW=VCO~-}-G-V)M(qKcVZKqvN?tT8Hz_iJx^`Vs$6F=LyTSCV7bn
zbNi4yhgokFnuTTM-FJJI$?*65OtNCtt)686fqSw1B!h<f-m2?T?k`K<-ge^(Em4iw
zSg}i&)l_Adk11~qZ?EI2btmPbLR(#DPGU5ez&WAR%zf6cy6nrW6V#tS<uRA(n(bP}
zJcpw@L&xqBmq&5q#D$FurB2@#x@O6;d=J}+HRY^QS28cZtLajk|4~ik=i;e0!HiX2
z>lW%SzVLZ&xN({P1m!4p-po#Rh84oo_M5LeozY>m<g?;zKjrI_uD;9G@_P4D>gqG+
z_RNoxF~I@xduK4LY`>;)<#T4A%xQ%fcP`&Y&RlJ(3>ML4aqb`ZnLkZkys|~{Xq5BE
z>W%l83-4vBJ7#;zJwqsDL1taA-L<mZz=K)`d^c81Ui9bDN|F6iWeSU~3zR3b{a!tR
zv595F!@xyG)2qYJY+0!2S?$IW@PEFMQecdr+5Suqfv^8Fl^5MtG~HIRgfZVFaRs9&
z*Ab}|9&NuIT*`XVp0FwYFl39om)Cn$!6~6EI7UgcJugsc&Y3MtGbiNmiKm7XOt`B5
zz1U!bqqU2X=zJTtR<@<j=e4izI+dgN+Wgw38cEmiB(-1%2IoA7Z8!C7|NOh9+c44g
zT=|90Z;b^TS}dQ2q;PwkyK(eXKi5%?R-0uE!WV1`4bM$nZE~uv(3F+!qJ~t}L>URS
z&1@2`mm(N4f}-wE(f45W%RU!4`^*{h^@eOG-(1~SSG#>n9Lt{jYx7dt7C-iQ!p2d;
zU3??yfX|mEjTd6S3O_hS$1!nUcCi<eVEY{;ks)qvwo$72{Xa&Hn(b`tL4|R0yjf|c
zYFifVwNbm`W3RTsPfb*Fn|@1|pK<5yX<=s~9#5#&JT!ytnquR>UU63@>4-*`6Ph1`
zeze?*@|FM8x?iD^qt2ddubxEfq};{1ZH$r<KZ3$b4PJf!u|*@Y?aQ(f#@bB7`Ci%I
zrOemNcU)<yk&>`&S6WSbR-S*zg^8)X+7k1&JG^N;+h10nA{e{0ZYG1Sflzf(*N5!j
zrJXwO=JHPJmI$7x=NtYtP9u={u*{ov{D1aM-pX*cE%RVSw#vi*Vq*XPv1HWfT3=o^
zGc3TAJ+iu{j_cYilXao~@lG@5e%@-hLGDp}WnrApIi0+zj$0=`+H-MYzO1fr2H&cj
z_umr>L}E&17svK2>hw+jF}eBFZGUNpN7Hwx-{V`rcS5=|vUc;yIoD^c_PWjWV=m*l
z4TlwOm3d_BW-Ra1jb%FgP<X1O+nu{p-o`)t_#)wP%G|Z;N4Htb(z|^8)|=4ufXRoZ
z-T3}a^1`=cdk&UmJc)~TvTXF}<PBJO=*7`Mw(Uk&c^SIiA6~!AM&P*i*(Y36uC}ep
zeDq)D)vvc4si}`%maRUfY;*X{j!N$YP0q7Uccw)qYRuK(<CfUep!_jro`(324?pa<
zouzVjM!&gioz@um_1InM&^s4}@|Jx{5Q+`iS#;vnmHulL`5`46y%Geww)nICF~6FA
zI(<{FNd8vah2}aT>spE)E)Bl3tt!Out`<+!%yJRKh^P%gDjPh@7kzN?VcT>5bgQRI
z*VgBAW<RLaZGGXP^EPsekKxL_OQr~l8cn_ECR{1^=z_|l7v;7FbI+bRaG~Y&I)%R*
zT?7|Dx-x%<SuUG($)dtCtLvqqnk)APwahFu{;blF;m`0z<(8PdNW`sIbF|Lyas0Kp
zbH&#Ab?Ilew<qmC-~7}|mYMzI%oj5<T^6MtId8GaKP#>F+lK|a-Z)>lYsR|EdjI~V
zEBAb5ZYi?26a8FLqb?<4I`@14=j*V=VGc7`X6dak*V^51=<`I;rDrPEo3m^#mDRWr
z=EvGPH+M_RnkV)1v}>1&UOK*^$an2hZ87;o-_yr$2%q6wvs+WkMCwV=h8f}INoUne
z>>kdo{Ss9D@u*DQW!>)n_z2h6TOHH0Ox=$ui2SHvPO(&VUiv`gtwPDt?uwUpY>Pd2
z+U*jqJbYunfoGUgnUK?)xAt?tU)H>?>}d70$xBY><2q~q&a$|BA8r4?d3Rn_azn}Q
zF0lzMZ(@AfkGooIkXnAd^w8?#ircU5|MRGAp4Q`!+nJYcc3&=ddG5yJN;dsb6>p{9
ze_Ou)=ZABPSU0Y(kH7Zqm{qG??E(>=cJT?@Y@_FtT~A!IH&0M)AE!u6<BH8p$yZBH
z>zAh-)pF)w$!&PB?YP?O{$+Bqw+|e*vN62+!n|(lOYx3pj(;1LPg}L}+2m)ZRMrbm
z7B0VWNyPY$&b${aKiBZ6@bTYRw&j3({zgMapRoC!Q)8xGm2Hz<mD8Jf>w%}@#tP9X
zTb=e;v7atmcR6-PVUHBo+hc2Qty0?g)F8s6`lVo-UiTMIrzs~r>b`|0c+D)35h*p@
zrZP|Yzti1z!P$Cy60TkQa`EO~W$nw~wPsi>R4-lRlzh7);y_|qg3(OomtL#SsFeS`
zI{VL$JqtH`{D^5@6j-@dSUdk)zYj-g%2D~50)?}EKZsraXT>@H#~Z&>Mb}?HE{*!R
zp6BDPC^3cxu6x;59G?FZc~w(0+;3=9-7RCh99w$nU~tRYS8j{WJNtbs*=oP)fhp_P
z-8a~FUuf1&&b}uXx^MEar^XZ5o|ZHgwrjeHPA@x_Fyq9%Q!=aOM;2M|94UCuF!}t&
zhfc?nFY5pB%rf0{w1IoluE72hTQ3&*Z#(X$SnV^d+%ZQwQoGwIG$X8NmEV#>CtO_n
zEKaO(T-%t<^7iBYggR|c?+HI=P1MYjGQK+_Ou3NRVg8TJ+k?t(CpWFn@8|xu_4xd~
z-)1a&Xc3gX!bzFIc;5dv>lst$S-t$rpSAxNV{ND3%kz#7cdn%sY$)Jfwp#J`jmq8~
z?TQLtR_TPM2^>51%0a*(b*A6@su_*J_IC<hEaF7E{Sw?BOlJ>g<dzf5&Ny`4MRMso
zt@a;@Wy?buXUxqwy5NE`8!Mmbql0RVp?}nR@2#Hw;@TZH=?Q=A4IXEm%=}m}Vfqn|
znZNg(lNJ>}d*tv0qc4A0a;@$P=BFHXlU47Sd`xTsm)(vV4JR*~UX!(s)b_Y=yW!SO
zO&Ras@7R|dUfNsc`#f&z>j%Q&|9vXgp9)=aL~=qeUs8c-w7o!_eQlzL%l63Eeiv?h
zlV1Jgn`zFLT{Q*ulU8edRlnBNKE1c8pEG#r&u?ck4J#*RUOYV6mgCXo)0**ihv%JK
zohX*=Yudd#YTxfuI?MRZc*L0Rw6j<;z1@miv1}Xb)ywg-=dL}JI7fCJpCa2D1DVdy
zf^A1{U!GrYb<p{Fz?9fzrhV7?{|n3$|F*5&e(Jo3KME6Ooh@fRe(mMq&1cPg_vD6X
z^uE}sc=X;$TZ!e@Eo~34v)m$lAiJ!|syhA8t!u6&Cl@fUXJu|ay1e0N!cjgYzbyq{
zrDFH&Uh8Bv^_Nx5#THY;WUk*KlY_6Dh;DB^`TZHQIfG@u{$nqj#2jb1{_=60x}t0S
z=eEO(|L<$)WZ$n_(B~!l{et?M)mx|RGzr<6_1B|O@#6l1(>tzK-_H0Frye4<n(3Ou
z<-V<l(`T3poSJlW`E0q@p<$hy>i)l&9Dl{>k>thIvirGG!?L=!n|_#kxu@;LJ+{*p
zHln_ZyR#=b%`mk$_DOy&$5X0y%XI!%V<Q{pGmWzuO3KpM+IZw`TYj4`Y+sr3;E($9
zQoD;ep|4jn-f6lpef7n7-h^pl@o_VQQUe~;8?vbO?c1_VZ2S543(_T5CQ9XPb-lPr
z`y^LZ)#S9f6^jL~w}*Q@p4oG6`X1|?JG&Q#?lTu@J`(Z&+JpChGydx_$(PuE{1U0d
zRm-M3d-m2TKjP*K_bgd(XO#xWRhx}gNfj5mZ?33*CUgG#jA`rF<zMlh@Y=$8?v`|u
zHxZi_arAs(UGF6E>9P%9Kzb8XMGgDfnNJfe-srNv_Kw!tB5S@Zg=K>1_mY4}Pq)>_
zWcojcKIaIj@KBP-=w?#cT{>x51@GY>QEy8FU1C?7y*%5r*h2YDd-+|V3-2nXv4&+@
z`I!H#C@Y(|=jY3arxSNb)_hgcc7DIvXszwMC&7pK_fC3MTCN_Ryj1w}O92(uLw+8|
zuU~AppZ}-kliJUcDw&rB%eQGauI0F#$Xbx?di$a4>|cvNy}Y4#COvuelU+Wt^LU&a
zB#j=+w4XLw<+M5Ur{NEge?KBrkIehr?YO{(W1aMw<LgWgKRtS)so>M}$=}6K9-qAU
zal`J0OO_hF2mZHA7TY0l)G}z}p-$T$(@nRX5)5z9dmQ!S$dko$C(ahp)j#^AA|RxW
zUu4(BukuHpKF%vtHIUzM;zLD<BYR_|^`m<S9Nbs7H^2X0Rd6VMwqLH#$x_DVq!-F@
z$sex2zE{<yx2&S4OhhijOybzoQ#U)B62*SBl<$i5YR!Ih*_P|lE0aa6C+uDOUu@P}
zbpG$#mWN*+FI%|&QSo0E^AC#_FN*ULYkbwgDRuorl?w~o&0i9&vk!W5e=f9=H{kAV
z`MHoMOt#B1YrT*}=k*`FUzYzq{kQo;Tj$pmn|Cc#olx*N)$BlW?3~T3_j<$$P2cu%
zsfD9t+!yPe=eVCsT%VXR*;+FuX=-d*uEnLB+qRe=+kMiX<@xMa#c!m%UcKvVG-ut`
zsP=es@j^en)xLd;tXAxQ=B&w?YV)SS<oR6o6<;Qt7u$TJxioOq<m*>2?#k+J@Jn3$
z_-xs^=;@`?PM%p`tCw2sbGv9~PvOr+!519P-kG`Fyhyxi!|wgw5ALoNvQCql9{p?m
zm2E3z8P=`T-zPf#;yFvz0DG6VC*i9X>FrxHRWBt*?^n>ej}KEH@!p)cWP+gM%ajj&
zCKrXi&e_t_9N(qxvR3*|>QrXi=F_ZA2XgfLA12;^V7TzcxqHiYPu^i9YklCV+E(4q
zZ&&}5&D3|Y;rIBlpgwQu&l@+@wkbOqNN-jDc;}r;#MWiv?=+7u`<Zuy;cJ-9(<K{M
zDKPHNv@bjRt$C-Tw(Z8G-1E2Z`tF&g_U!Ny8Hvg>=lpkTzsa1ncG`@6_1gW1+mGFx
z<GSq*_vX+vzly)J_OxhZ)Jqh!FIx8ce1u6@<Nb4Xb1PEbp5G$H<v#mXou~BsiM`3y
zK|dcd@Friqv*GpjH+|Xt`%@mzd}d`OJIBiB#_QK_B!1{04cnTeEv&s!GrRT0mD5q@
z#caNEol|TO5&o=`w&w8x%ZKqwwK{ethRqxKa*HN@wo%soVO5rNdtb+Mt36Hg)=W>D
zJTpl+BPp40rfs)#h=P04$r(4V3p#DC?-2O(@xF`1-X%+B+D2cJ2!H0iaYBgBlG`_D
z^g9LK{U6IUvBx~Lg=^=Q@)O}N9nOVio(_DNAXT$#_EI%H`y2Q2Z%liCTmNs--m@Q8
zhrhkav)cB*{?YZlkHYiPlFNAC7UVA~HjOPb|ERa|z~y8Qo13B4D!0=9+*u>mCsuXN
zY_Vr+g`#e5um0lIbIt#I=&rjtBb0f!s_mU$KL3u?-gf?YWZtXKoBieQ&zW%8%E}?t
zZ>?*jLivpBKev}(E<c{zT6WnY=HHjUM~`p*%&(rmp+e<H&o=K}x~BhrFUnaWe1F=?
zY-LA}(9~YPnXBJT*jAW7D>>}RS*LP+$<LR+KNoj@e^2%Q_scI&vc8pY{~gF4X3%cU
z@bt&ydNq0bz2*gBQlGN2|GbunpQ|f*m*?E|NUQj_vs;*ojV|Bu%FA!Q=fCc!h~~dV
z7sKuERvgQ;^jqF_`oVrJ@hk})!PQ6R9GvWa>&0#BA12eUCR99N*Ub1>yne<rzB<LV
zf;%nppRAGNvA17u%BNTmeb<L=o!g;<O{oiKGFIBmyC@o8>dx^@Yr5_H44#mzsuzFQ
zYjVn0oD-4If3<AR)|EO(>eF7|wcQ+Sv+=aahPL{dn_Pa@aWUu3w3$D3Np;v~HpT#V
z>B%CETOa3XuZoucdGBt)`l<`>kJvtNzF3lGF4doW!oAILkBiOok_UCZuijpKxqI?s
zX8G0eN{3#5))!<y@?grIW!aj}r!H;#QBYR*Yx9EF=Gk-OH~zoNUvpJG?!Kk7SwVyE
zhdY-=yRMhpmzZ-NXY7Cd`Pbp-vM0R9%UFIE&R_NM`P8fgQ@)HOtB%L5riOXPzW<vq
z_UOfz^fSA~GEMiLeYwWt&J5p=Jt3ufa<NNP|8*_iU@|@PQm@Ml>Dl)t<T3?(&}Q3m
z!}H-P(OC9!mJ;ItciBV!g}=+H-IgxPKDS;~ZK`l%=Bj{?C2D`~Ht+YEe3?@<LGrmm
z-oD0yTPn}GqF=;k{yX%#L{halDOEjc=DBLu8TWGYd4*Vy#mfp!5B|jH-fnmyV$RIu
zrNw@J9bbDb@0{=ZvAFxl-?dWzBs~5zv-XvEZr#}XJX1*MRc^)g9{WpQB`dC-P}tS8
zUhnd1#y_9i4?ewjZhu^@wamU}_Lt}WUu0jnS>;&u`W;ng*ke{W+gv@Kn11MQT55gi
zdgnr+{FfH9M1t?Q{VK~od?w?V;o(NUT{Auju24<4Z0)#r<k#z22GcoJ!#dU7_=JT8
zOND}!ty~N4#hu(8`26F``#o<@PI#kmQFN9ZpNx^S`Gq0|*$aX3ohOxcY@PV=UZ$4J
zmYq)N*IzySl`AGLZD}_lv@Gm8L&!w?xbKNME1%|tthoQHO=0HktJh>_t*CjJq1qt!
zc*_HQwGF4{@O7@=>v<&G^(e<Sw~(tFtG|jL;rJT$Wc#g^k83!uEq$%WXB(Z{ta;O1
zF}&#IGaIj!*Y|B-zT9*A{M}(&4VQ=ilyF{jKr*Z}DQNfY-DVm}B{$x!&lFwT;ZvCO
zqe5FQ++;<X(cAfU?p7k}`pthcdsZFo%e?Di5K)`T-nKB&V(OyH*LSU7efv?$G85gE
z{)g5bU2nSnkw=DZ)AD|Wu4$RJ!P1XxFC-j1_CRRQjqh$^n+`=N2^;!1-mF*|prOkt
z&vHKR<-f&U`rp^RP)O2|;R|`A#vR!Z-eWoS)f|PqS=UwK`x)%Amo>FsJds!N^p10U
z`THx}p2_Mv=1pbq>%aB2l&xl8Tfp(--?px^^mMgvlr4&nSutDoukT0SbB2M7J}BRd
zv@n*OJD;oco0aB*ij`WK@7#>aV((p>@GmT0*3QxUVndccyXoKjq$<aiRWmf!7kzSj
z=VZDm>}qe{Ic~iGWyV>*N+VBSh%|IbPhIxuZ90Ee+V}2wZ9&IlT2t6R^LrdxA>MfS
z^jr4#>v`&8WY1miU3fHo_ulneec5(|b)KoH{orw-)zs_F`&Z1-tRISnt!6KKT=8`6
zXH&iK(!Axf7Oa@5Z)|4x@lxD`dkZ&zYMAn8>Y>jcCgf^6<wx%}Sz*s%(f2o7KPqlZ
zLZU?JMDhL0#0>b_tqwol{&Kcv@4wkcWv*7&+O}HloSUcd^s(^IrWbd*c5Yq!<(wnm
zs#a&~Jgajl%nO8m9a(2{t>MMg{#V+i88#d0mvQx26y1Kners)QRckR{YoTCDsHOj{
z57!%ujaHWG9PT{yWz8XFo0mEquUBvsU;Oh_^nP;nRomlRil<NSDxK18BhAD7xzTsk
z&r4VTPd$IRizEGddcyH@os#zdOKPUoSlR!S;0<3LkUI6gN`<$|?y%=i@2tEVtayIc
zQ~&;h33p$wEEHbx@qMjn)zas>Ct_3YF)ZA${IjZ%h^5P8Q<-C*Q<I+ONJeRG{FeUn
z#^buf>Cu097r#9C;Lwcg`#V?qymyS=HEsKeD$~1#1^jOMva{PCd%X!?+_K~hW9{4m
zukidfU7w?~vW~t!QlGu`fbSJ+YpegC9&X9X_sdc!xV6M=spBVJo<H|OlXWW%H6QNp
z-=jORLorl;V)BFcp>uAF?co$D`7!DAPn{c!_m*tn^~qJgJZ;N1)fE8~qgbcp$X_a4
zbVGB(_j5HImBk^OQkx~Gc-4Gr4LuPfT7B%Kcz1DQ%}lRbi~el6#6It~^sP@yZbxMG
z4tw7<s<-<6vgMRPVyuD2$?2kUT2p>rpK!DPo1HxKrIh<yJ61pDF8!UM^?BAZYk!xw
z_a-iHclmrY>a_@af8MU_)GNHFR>ZC7KD)3?b-uTn9FM{akIAQN-gh5)$0K`nUbs;6
zzsa0&!j~eQx9_l;<@EMyy2HuFs2`d-GKc?8zbX1`<{kMe2maghonNoXTPvdQ;(}_F
zu=bqj)r|h9-xP<7ZrsA)Zh7-j>_^8=>y`IR_1{_EE$cFSxAWq(PkfUY&pe2I`=~AG
zRMr!I+nc}h_L)zcKg~QYa@I33i7%|jcdv@nSo?X`p*-d5hnmkF)i9Wo_O?3vOIcT+
z#G*-SXN$hy`)KjeFViO0F6Os32(&vc7j~nl@feS2Ui6-}KCPFnCqGCXF1r&@=>INz
z>ED<m$ro<33uc|FI9QqUdSddPDn3=cU)EFYlNXejMs%<V9_+}8=k=Sjv&lANcIJL*
z(K}nXXZ<RkovPq>*hl!bmVxr&r?!!~$5Pu5&wb&PX|h1JY2t!oKAhz@W-e{WpJ6>Q
z_tCS3od!44JT>DD&N|$Zb?Z*s^f}o@^48_frKiPe+=T)T-<j^x`&iZ^_xhdBcMGoT
z-V%F%r~A(iE7@e{y3-lHf0Oqbw%pqiBA@w)N$R%sp{>*BJG(Fyy0DwIPkH;1{j1>a
zvrn7OeHRU$wEC@t*TVRXlhvG31C;t^w>w^$wzY3U!85fU-h1a+gSdqkXXwwYd&$&3
z@9}=^v)8vLdLQ1q_CJ3B{MHT7y1SEgzL!kp7#Kp!85lr!apZz-J4h<c%t_JD&CDw)
z%GWEXJZqbs|JZHP{lD5$GnqY-QjblJ*5Nx=$^Y5w+V+!Y6dvDUj&fYMblO=%*DTLd
z+sYpNulxGKeD)-po42i%Pk8)Yu?_^nx5st(%isTZ{bm1Cr)zU<_Qssrr60aD=ls#t
zz8iN;U4H**y1M?6*=d`zPtU#`S5yA&)A!{c_S<)?j@GQ36dT;VbkFqA&5_RO7f&bE
z7H!I!y>-U<@Y{8_PyLLU^4j<Ew?!*nFVp|EY31(8lk@leeD-SF8<s!e9nq1wDcZYS
zqw}gZW<?eL{5F?O=eC~s^b31e&1(01Gi&XO*}^|>Y(Kh4JeBwCb(YYQ+eg=GSOrdv
z)t@!>MfW$iZ+BhRobozk-<`I%(SL13=uuyD%a^Iw4}bU?RMMOADrV0rt&2Io&u(+y
zb1Lf3@8$gOIp^~|3-H{id28L8{7;i7o8R8nDj9D5g5!U6#;x6bQQsV9d{6zmQ{ej1
zM}F5%$J8`z+9rJ4uS+`e^tKmIKc!qYo3HBAP@t?b&3EpXMbnBn9WwrePG+7f;wbKW
z_wbt4pQ41fOg+7cRpRryc&1zGt12#rh)xlj8+vimi*DD@lDQ_X^Aq2GdA{tiqM2*`
z>jVEe;?*B1>nPP->fJrJ@#1?k2VRw*Q=N>i*RJ25x^+&6=_ZbbIUQ-v5)ZW)?lth2
zML%G_y1BtMc&`5IeYv}M{h9WiD7)<S<G;(Ee@{Oh-~M@Zxc&bR@3Q{=)qj6KCbq8P
zf2LAg>EGGQ;-=kr=>9}nYgf&0=F7V?e^&SE_?>wa{=lj}$6LlTak1EWpZ5J)R!_Zm
zPUOfAJalWNT7KzGJ%!da?@w=AS=hW{)+N7}yBO95@Y=^HyZ>3aavB@2ul?ng6+hBf
z9*<CVXL4Wt>iu@pi*IT-PchiIO}FgV<FjId5Ax?%&3MgQXJ@Gy{zz;8ulN1$pXLAi
z^6u<>{rmq5>XaV%=imC)*0#V%Dp+^ds`}9PIic&sBE$bNtuQ>M?x&po?OfAqrR9kR
zJFh!v9jnv~-!S=?Wng;W@07mV8cY2*sGoDazI~>}U*&(NFEie_y^YQ9{KS)=&-+Hs
zekMFoU`g<;!X1W_ax6LyPx@Sa<NSwwDOu&pne(5fpRD6p`{%Wo+51cErBnZNY|7>m
zNS8a2`RO=!!z_kn|GA7TXU?5-q3qe*Ps<|LJ2n*X%argnPyJgnuWVD4?}{70qfg~I
znsi-R+t7NBQ7~@%qFHfI^Bum3U7tF~FI{-W&!uf$FE_<}5f<9I`KC`y$9G>{<p;0Q
z>h{XCns2+v-{ZXH5dZTuhdG&jpPSUaoPX~!Nxjb0k9XBa`Tb23TBLrJ|KG*<{j}ay
zqcgK5I5+>{4cXhuU!7s}Lpjm1!F}n^>_7iEH*8$-$x-v;)cw!+<rF8c{<A!(dA5{f
z{-cjqbOJ9WEPZ$>FjdfuBewa;?pX1+vM0ZB7yr_Y;(UHr=KL+ooM)RFma1^hky5Y}
zy8Y$-B^~2{jkm*@mR!Eu8hS03e~vi&a;@hPvv<|5S+lA3ltawPRg)i2DR}l^af9}O
zrjM-^?Nw)-x~w^+Tz9*uvQFXj|D_fAK<52V_8iUW`HB5Yf}0&?9f+LugL|f0{`S|r
znd<B9Vkefd$afz0WNmzQ<gd7QhFSZ+NV7tQTUR9yxOTRln)%_@1GU{Ny1srDnjuxb
ze)j>n)=dd2F)pQjZzQ>+IdAJ2&0#+N=DN@Mq6;Z~?&tPoZ`;5j*y8Z=<<nVyGX>W~
z^uNyUj$6}ht+~x7$8E~){>Lwyw&&Os-qcr^d@a>|17mEl<{h)cjlOG__Sv_resaW}
zu{30xLcGg`5(^2F4Uc`kxP6+=e7i^AdAr7|pK(*{9Jz0q&MR}9!Vr3IL-jfDM}~g|
zAFp1kJ^isy=ByoFwwW({t=%LptCyxYi^*2)TiNw%wYxZfYJGQz#zcqOz_4n;MF+n<
z*uwUE!y4t)1urF1j+)L;eYEZ61D0?$#-yWVGYcGeE?$^gX3oN)@tZSrn{q+G+Q-R>
zs)q`XeUfm#-f!H#$>eeOWpnAkg}zETn-zstoxA_H?U!=2Tj{N43Av`nHk(;Z17Da4
z&UwLc_4)M32FZ-$`VYRmdb+b>$5e;MPba-`NKI*&$bQU7%FLB@n&}m#`;AX8T+nkl
z80@);D^6qf{GPY<zh27DNSt3+_gS~^TW-1b>Q`6H-tAL8%Cq3?SqIH%j_1!7oY}hY
z^F%Es*NGvPVGketxV!$*M!tqeEPYQpcjy<i?-ckX<YKmEGrRpRQHH#ts#y)cIPZQ6
zJ7gAh!er*+S9P-@jy4INzk74Z4f!&T#KMUs8}c2`W^UJ5=CJgwK8N4}$Bk=$b-!=i
zmT+p}>nBVTl<%4+=PI#DPY9A>xgfUPcjtt=uIy=|9&)8DS+m8b+XXwTZJR7-vGU^X
zi9M?qwFEWsDXld+bZGHs=iTlMqR*d*%6%<%UHn6aOX;!ZhP+Mv0i5O^JWCnkjs9l_
zi+op*xoB57*ZcQJEy?wh{&4>eG|rvZdUy9M0jJOf_Yc~ykkC14yH$RpsIuFxr<u<G
zT7$n8ygfe2>deJ&ReH<TuWC;^eoimub(EcizEr@ZiUi&RUM0&J`$|lfD#-qPVYit1
z(bDt68ioM{r8oEO-1I;v+UCl_ExSGboqc-CX6BALo>mQZa^<(~T|brI^>}{&uZ2_A
z_GOvR_6h&Fx@x&kS)7cCc+K%ilQcLaYhx=nMx5}Szv|h{)sI#i3CPPnIJcrVoBR1O
z>#6ZYnz!aN%fv2c>e{dGe`{0m+DV(5KQHC)$-cEi=bz8%n7Ovk<?I<=WIjmVXxs7P
zO~K30p|NXH+uB~lv&oopF`n43CBM<yz>x8h@5TN$fnZ+C&l~ie-_$-1T^uK5;POg=
zD>ctVHKROXOLSzzLa~Kc!}%p<S{}ACDZJtFe@Er(Wp}?xg}r`nSzrG^PiDvMwW~Mn
z<955Uq^QmK%Il(}*^F(w4hCA39h7=`?%q4L6^C_gFKq9>bM^83-p}mjc7HTqvK*dM
zugW4K)n@1R+_s$SdtO}m@8I~Y!OjdUvi%D;En6(^7VtLl^7)OYKkzW+<mFiZP-@VA
zB)6GmM&L~5ZSA_<<u#x7O|(f-R?`#leXY*+`HA-A8zp{$S})#B5IN1bJisq9<iML%
z&1?aWu4p?7ZwXxLw>u%3?QL_^yh8!^YZdEm<(4JgJi(_NUNFtfy!5BJrd^<Yd#>TN
zU=D`kaj(-<=Xia2UA=oI|Ds!yUdpsN&6VD;XQgBKOtISg^A3qIaTi*Cp4Rp&A^Hn*
zHd7H}@crz!@2>5f#3RS*(|SMGwQg58_w)x1i;Ijiirf!Om)&a6b-ckkS>kBflw1Kz
z&Iq-Si4S@kxUQeOeQetIJ-p^JsX3=Lx7k-6-dJI`<L<E+wh4C*7JMoU%$;7eu4&&d
z?QPdquRc}qMkHD4a-<nc^O9L=dEZ%76+R`unkM(=l;2^;crCtb>`OmiDbOi9C{&WZ
zd|3(8tmtj)uV2xzXHrP<vw15t>$U>Bx6YhS;j15<C4~=O>1(-~kXoW&v}?2P^jQX}
zvqFyY9VwfXx}_%J(YJH6UUo>f-`@~>Wd1rSL%wq-B@63hmTwR4IcxvQ;#$dF6H(1m
z!neD!m6k6KPdrps@Qita<o}N{Rbq+%4-_WeT&^Q_d)dORtwKEyg=>qJU6pw)@?X*S
zHJi(UJ^2~u%QfrfR?m3-<MkO;Wv972v#-vr4iyvq<NUIZec6T!wtjBAb1mlaJ8z7=
zIZ<Op;>FjU;y=!{88JS5^*8+a4_$M+B@h3xzA$Cw_WbnpyX#ih_yZoF4i=c$Chf~K
zdpVOoK8*Q}?~FQ`j{?sRE9CC@&v1pqA!g}$i^QltiOM+_?RLLpnYb}y58s)u_g)_j
zQC%jl$MA3A#9!7C6-m)oZD#YP=9)UNJ0AP^A<^o>4W)Ur?tWUUv7D1zM&Qo<F84(z
zl`pZ(;`?R0Xz9I>??z|cq@%9JPu_8b@909!v({6towz@>L+rZhxtXpf13rgt*}3Ym
z@rkm;-;tG$bB!B5Y;2Tj=Q$VXD%7j-Qd@}go%j{GWq&fC&41;&^NH6F^EHPicWb{4
zj#yh_yJ6aniJxtAx`IP1eyrnoYgADp#_6!pnx{jUDXIEtm3g?Gid<!Y)eKJIVExOL
z9x7QZ?jO!>+u^7(Ikz_4oWJzQ;;cnA9I0X}?~CZ3*^<s`a_f*I^EcO5=VC*TR?Rdq
zEtmTDtXfJ>(CuzgM}>`qqf2P}UYo5GOI!jr+Rt>_pb_PHZdKmyn-kQnAD9VmOkQRj
z|JG$*+PpNE8rv%dLF)F0Jx_gLGAS&sP1<aDNQ5U|eB-;r0nrDfsu`rDr8W!t>}sBz
zcx<Q0uBo3a%icapkY6fNp#JKsQ%%2RW$5KQi3YP}E~sp;sFR6X>>AqVd+p3lTXXZc
zV=Kxt6uy1?neO#e*PvJVapgIwB;&bzEFJ}3Qabn}^UBPECH|Z@CZ3*jj>UAlNL2Pg
zmOGu<D}9}u^pCH(Irl~0#KMhR4(}8?AK6j6_-Et`#+5$xY=;YPmp$FPrc8M9M=mYd
zO~QXB&wt6U|M~r=db_SI3tw~du>JpI<MJw^Hbq1&u%P38>s)bZ5v`X8m&%mxNqwi;
z$yd%8c5?T&+^G64=?j5xF3y?eZMIhQ)Q%p<vWY^xH!tWmy-I$ZX?-W+=z-7LZITww
z-J2#qdY*fCdba0}r6MZ=a*i&Pc6oeV(5CL{x@w=dj^)SKzsuPF?2&SNO5x!yrhuIn
zB^fXHKWdmEck$rN7Qv;>RZcMzB90#Xb#=kk!%@u7o3BZRunWb{O5L>L-v*gq%3FRt
zU^qBQL%@IPg_tPww^H^?<{ew`B+X!U=j@BC_soiVdE(GTx2=N5rKN&>=FHS!RXy7m
z5D>C`!?Oupi-d1)xWeBSY!|aZ`rG_>?vuV;4EP-Ap2N1eT;Y8vUth_iUy{BJuO_j`
z|CT9?U}&1>x;b8W?gN*dj+~ZV-&WX$R-P4!(Xwt3+OC|?Y@*hZ6)Lp*`@7vgcSYuD
zcb;BhBv#{4$IamCId`23SAxso>L1trof9-}{8ide^x?|>>BaXV*bX>HE_UwQd?Tr%
ziZ?0am%z8gm(5NpdnXBtuads8rPIB#{C3XjrG0yr+)Utc4`ulg{?@GI|FsqIE`EBS
zt{f~halMk>zU}jg4Q?|oya?WAo7iNP&~P|fb>8Xp6;=z1*G^wkP!ZMo-oM*#Qqu2z
zjm!D(-|LQRwfYnx^fbTZ=tc2w-HZz7ucpdm&rRljP?fRTc*D9-X`$3$_ksl{pP$Q_
zVJ0PU*zbBy3)An~6}!qO@aLyLTbBCY?Gb|$``^Cb4<l9|R^RfQm%}#HOyoq-(|@WT
z9dr}TUp!GNnHL+oZ~p$he=7eyRIWTXW4*>i>lZ(c7Aj263o<p2oy4mf`uTaui(jeR
zSDvyvInU`#!za%5r~RXEZMfj5w^M)8bFQl#*;_4E*lt$ebnyDuB?=E+?kNA3x^CsL
zNM-JdO_lB&H#PkFS5~fJuvhuuyAy1@NgD(jPZV?rvQL^Wo7*OL?x(|wU0*n?S7$Cb
zvj2Sf(lrJ%3tk*BHk-M7;v$}h{L@ZX7oEMCCmwrDLgK!8n$X>ovF&%dUO$bqn<;f|
zmWBANWf{}Yt7T1hpH{+lJmz@P`D4CqnWiHAZGkrx7hnG9Q<Ui7w!&%3gy=2zdX@<?
zoD7h5kk{1OIy-K6xNs|z*%SZ8)gH^gI0gH}hTMN~V%046o9DzAOj|wqe)sPKtMV5_
zm0nO(IMT@{H&NuPUM1J`+lKuM+IPy&Q0~0B@XVK<9YvadH@Pon`DV4vXOG%K?+S*0
zrXDttSB@Xp|7_WLnFqd`_vN`AT<tnXO^bK(x%e34ueI`a+%126az0$yd$DGB{VrAW
z+Gh+R2Q1iX8hIx>ax=X5vER3RzU!8S`<m+og@4bEzwv$5GUpw2laFqj^UeElt=znT
zJ)+AVCb=2Ev+P|IELK+ZRfpAC^1hqO&PzE>G8eq2vSrSy*=gO*{CLG=X9>r%YVosd
z83X1%{axO8+mm;TbVAlMdzQ6J?!Vv=7V*}ykDc=3lI`qF&D8ema>XtOdD8yAh!InG
zI;SsVj-}_q{WGOr9Z77;NnGFJa5q?V)`ROuE^il|ykXx?t=CUK91~y-+M1fnKl@;6
z(CbwWvfL$K_dneG-|p`u3-M&3TIsO(XQr%DXZO^<5uV!g!6~L|>J-r|iNAia+Z?6`
z>BSvZ-z9xN^hcS)*3*&u8z0&p75TV%mD(in!v(^I;orYayx=?CUgYZBd5dQkuRpMG
zeS_J=BD02-RwZ@@4@5UiVl!D4pd_dL_*?R#k9+M)`<Bhw|8VV8H#HN!N7r|=9b`$C
zncFSseRAE?&9T4qHkN4Ik-XF^ePXJUsdUL~Dg8C2Pf{uwd+wDyT`c|Y%G@+|4wF4?
zVzd0*pWAG@TeME3fc4vs6!&+pvLAYFdysO8Mc?qD-vir61`8xJR^74=Fj0|xTRd+;
z!5t^JE{OnP+p;6OW#o%jwSSmw(#xQ7e&xHgIUy5I%&%F($`!r(QHFSrcf&vPOPAO8
zGC8c9QGWaCsv4F3b6&m=b+OWVzbs3r@6B~L_ps^j@6KDL(e`ZHs%I1B@_t%WwrMA5
zIbE4|M>qM}t((RVeUI*+zW(SNxqTG{bKW2LEb?QX`1SLdmJ;V}-w1Ltv+N7~>){l!
zPFzuAAFJgStyNrGXKu(_7|*V$wfxlSCk>Lteup2-(cfDv>s`R-KQBZ2&ead=_VC?x
zbZ2YhPp@+o%k{a}%akxN^~^&{uJ8M1F3#<gFO;7*``<6$Nq?#}{w?S+mAzB7nbkF;
z_9^S01xL#o^BHyR3y&yXlenK&c}3Lz#UEyuA~Ac$kLS&OOjd0aQTRKdEzj7R<M8Zf
zj2V@McTKNun=Vr4Q)+Qk?m*h!T(O!miPn-i%Z^Xf`y&4$#H)AP^M1RIb0@O;E~GuJ
z$l;keW!<dEzo#CXnyYrNG2P7Z<=U0kZ_iqDJ(~1yYRt9ouA!f5)B7sx4*r+!*{m*n
zN@ZP`zwHM*&&1a^)vG@=rFScxC_bxo^-AH%W9w@yFZZ#VTV4?9kJKyvBjCBI%ul`V
z%*^FUY@2%fIQDQ~pLs0r;R1F!+q&XlBc5H?)UMyWlVUG^c~YwF($K~K1CR3M#%+m8
zvE$vK@H~_)@t{w^6FpAmdNak74>v4b{GqJ+Mt1#+B8Ceq?d38gQm2@m(vUQ1So-*(
z`4ORm2@Rop^181b6JXBB*}@n<{Y9zTimsFCB9c$ezgb)yylq~N+>uM0iv*v_h$ep1
zYpZ*ax-V<ni$IB(&rNTaC9T~t_fYMOn;%8|gbTg<6DIyOttnPDFYfwvSoY@81hspo
zqZq4xyyG`Nov->qCOzuS$1tX+Yww)+F|+l@8Q$0*uiCE(KH^)qx~5UwU-<c)=G3p9
z=CW&E>Ri63?7HhjZp#YeH!G$Z1{r?7^d#eZk@R8CbIp-YE-f(o^^{?;hg9ryt}MHq
z{ol{@1yvu?2tCtLy^O0`#3TOT+tMvZ_Pg9NU-<6pnZ%mI7oS^|M(QoQwI(F)ddSv|
z=`RXimPTK_a<F!m&NUgXXJ-4G%>ta#4{7*q+E*^JwEWut5Aw5|4?nQ#VV--Vzw2(~
znQPxyR<BeQTF>{pa>ne0%K7|ht@_4AQs!Z+^W(Tn*dJdN&Re*zQg@f`3CU3Z`Fo>E
zK8xzMUDCdKO!H$@-YubX=j)cwdb!?l_Og62-sVHhY_|&opP621XFVKre~(yARiN4q
zwK=++I`YDA@(=A^wJ-FsJ?E$T%^Nv4?^yEj(WisW!T;9_m`UuE;FsU~v8IJxCNcTg
zp0=tbsTsLd*Tuy?H~E&R&3w&&InH=Ct4Mi3)*6Spl*H$GyXLLjUG?f}&;}U;vq@R|
zBi69LJ!1c-t}gad+%-X;V5#>i@>}~)zFxW~?pU?R`!lx=Mbxi1`)W3=?a`WlA0!t!
zueRUvyx)RvKJS73-*S6}cCWKKoc4fa^FxEFCSq@&&9?Jv<C9{D<KKU3Z?x<arkjVO
zeitM;DE)f;sAj`N_u#PiZg02#ZcM75!6U2Me>ZiV(mMN{8rqI~Ps}Ohy)^5O%G|x5
zY`$%~`Z?adl1=%OfXptAeC1gg%tx1hJG#qc!kO1bXKZVEl!Wf;l>N{0Z<|qX*?5uf
zUGig@ntfZu7sxC>W%6m#g2@lk16_1q8?wu;erxS>(eLVszTzW37T3guGu?g(H=LOA
zc*f3h>u&*>>#nZm(2Th!&5&re<apkclNVo>7(RDh|9wW+7EQ6BXy=j%wUg@a9um}Q
zytr=LY_DH)PV^tED$hupvG#Dkex;q9#2o*c9|`YFlsT^^q&x_W+uK!lYxzW-{0lOd
zp42X$uO+l2|AX$=rJtWoUv$`8Yr&c>uWP3!yn0dh<@92=YQ?%k;%dL$?s%R&?{n(7
z(E9iHUpzlO_xd!hM*nHyL5(~G$FBDk*L+)Xxx?pt+U4nOVd8)KyI6j8Sstrm-?;9Q
z)GkLYc9Z!@7v@E<wn-dki8^*XT*PMcF||{A)$)vo?^pjR|8~pj`=L1^zdsc(3XebB
z^<44xzQZ+j_x{{b_*^;vRL!2Zi?3Sc*$bAZekghWLgrZ97BlwbH~AkfY<*THGd<RE
zbxR(@oVtUH)ZbgaS*1BGzTfh#^Rc;k^Gpi*mIg){Y~az4(vdpDw#Q@J-&bGaC-LZ8
zuQg*{ul<oPY5F=duIpvd?}gR=O>@tD@{xJNlUhcz_yf9n$7hCrzH%siR_&oK3+bDR
zf4x^ZKJUz15zl}4F2mfq_kByeGJn1ZOjPR?oaV(Nr>imdO#JgLexFpV_Hz50PIWj`
z(Q<a#^X2+i=hfdc?wPgbpM*k6Tlg6^ZzIVChSD7u^Srlz<l6JHB6;4D!%Kw!++?fC
zUbkF4`^Vape-qh?+}5d-Tv@;BlXAIE?OBcx$v<AsT*q}}&UxQ#tCRT~^{ADX^HZ+I
zuR~n3?0rQIzARX=``fec+&b@n+MS&h^yyfM&FaL)iPIzY+x%Ye?)17h(pCPcul}E5
zT9(=S=R(t}PxZ?b&o(U&|50fpAisP6$tyeCzpZJv5Iw%+ouik&^{T_6(aY4{cPU&J
z?a(<qr|gugo>rYi-3yze^B-xveh}7iP28YmPF9E{lV<14@An#NpX-Oz_RLz`@8HV%
zJ}fQTCPBzQM6P=MbmoZ{bQ+IcXw~UCayyOFR{gN3+M2v>gYArO{}})BWM0bh!PbkX
zdtd&q_ZL6Q#;gcQ@47cXwf$4jX+z)m{b7&g?wm^5>-G0WSFM@n=F){_sUPMf|C?Sl
zBbBRt{w}7IyKeGT75};L#qEmNcGud&*NZPkc34f76$@Fn>HOr{d0wrXwr{j>`uVhT
z-YKOcp7GMopC{GTwcR^+*CaOlk#Ckzz~2u~y*@IiFWR~8ywGxno1wby4aNtr1kH|K
zxb})cLQ_qqWWa%*_ckXZXZFZnea9NT_<j&4U!&uuqibXCyq);@aQvYUx+eVR8jkmT
zj{Lf8NBYH0yr=i@|JFDc_D@QaVTVuG?lZfYc6Lk>djCA@jqi6MzdQQ=8^6u!(@Wz#
zxuoTMUH&q?#P%b#iuY#9I~1uu{3j#yw}VU0d)hp!`Kj|in1ma?nC@UB!&c;<|0Ovk
zXQk>J#u?4GpU+ER)hJxqzWR;Fjl)h^Qv}`2UjM6gIQ%|(<MXaRZ__;a3x3RQ_4(xS
zN@wLB{#?)fDUIFUeJ;O0Zl7`HVg9QK+i85M2P%^0y(xApIqPz$`i131`~AY^mORdD
z%-Mgb-(c}QzG3xNV-tZrJ+ovIBOc7(=n=f{|MpuFtG`&+uMD4E6PmmGwu$f;11s&R
zPrd$52zTHA>ggW;OC`@T3%X}4o6Nemoqdb+1RmAguuUxeCi1>k_vW{zh2Q#<aeZG+
z^4$}aFMmXs#+UCcs8e?8FMep#x&FeQ4<YgM&+b2WW8<HiHIr68Rne$C?%~y(yg(u8
zzRBf%J8h#YjGQX>@`{KXoL>?0?(p`Y@45Nx>E^M;AEb33Z%>%&Vv|;M(BuW%@-WVj
zTLG)~?FyGUcDVS~L!afVyyCBC@jLoYzOz5;p^K%*dt33t4aau<xU=PpL)v_)6PJxo
zt#Hhrr+NB_{87o-htg+qFIc0@5O<7mPY(kF<BlD&3_tYv9$51_w0g}cR{HaCi=m+7
z_k8Prt{t7#vPtWXT()fG`6~N~k^keSJ}$ny2eyT6s=Lp>$2R^z%cMgmEB@ZU*mK6?
zvXPMEqWJli+u7q+`t4Q7TcXjky7$IgOa3_vCOVf-yTKQ~`j4XUimp84X@aXRq}tlE
z8q5%?=Gk-N+CFa0joW>`m6geDl}gcACv{7}OMb(a4{<hSYwt0BWA`Zf(9V!-q3Js3
z`zo=Lz$Z$(y)GZpzpCi}RwQ`#<zm0p47{Pd@*6m!C#<;8sA0eV`NYk=5iLA&xr-;J
zPu$=j!d@5ebW`ttCsT*KlN%rF>Z-`HKeKD%SH7v;yC{9CO|yAc)w$oF+_o=XwBl8o
zN=Vr!d&D%e@XD_d9~!RpMvE{o{PSU85Mp3pK%QpK$xqiSsC;XaUHo{*#QQ(BH+*6b
zvNkgAUwdWh`YB!4AJ5!jl>9sA{hPQ-Q85=MAtRBKPY-W1`dIH@&aA>XX_9U7`&c`d
zt=7vvWSIQA>kwT1=F^|I`oHB<G$uK{neU>c`P8ZFPlIflO-$$C>;Jsd`(>BjRGWS}
z^km%rny+c{|9&>cu4VbH(Pff2afe{xthI?o+N|-`=Q2!oMV)LqSbxt-_f&;(+8j|;
ze<iu)oe8f^RwW%=<>a!)=Vq>+_rXUcJExqyH1VX;+3S0zFw8!GdDWHIPeOx!yfKR9
zX6u#Qq8}Xi;E&RoRu475#@Y|D&Pfx`NUk}#Vy~Qy|LLjx5?1Gw{IBb9h=oQzRpOWt
zlb#uOs7FON^XH+$lGz@sO8?Fg`#Ra@_41_4Cew;^Up?1(rkb}*a$DEY*w0I6rB_OI
zEy~!vI_Mbh0^hdT4_J2xt!T>(>e_8I?Xy(q-A&Ip<GW&dyDCl|o*~Yf6V9JKOO0oT
zw0l;<vC~r-U(4(}R44xC)c#-hKR<r(LjSmXy{%<!{R4v^7kKP1SiIDnp2~Os+~+Mm
zhfU^f@czj!c(b?9uzK#tJpz@szun_HE}IBtow&OE0rQ65^NxDU8V>t&8a&vg@tL!j
zf3nj)(ZpGwjn3ZnOurjh{*OI!3JbIRy57E-k6n@&lO*q)Qt`^?&Oh_*Ka0@BV_DNr
ztZ!K_*gUJ$Zo@W_?EE*!U#>l|*O2!N>j|Hvp7}=MhfA(1eHCJ4f3o}a8^brf$<x$6
zwsl$`*xZo5?75Fa(#@*LxeFNCbX`wgv&qtwWRi}0rxhS<cK^u+y#vSYF{@4YoYnnK
zMcyrX^ZkD{Wgo*fKG=LhSn%*YQJ47I`p>hhx{aJd=e!F1R~;BP?P9#c-lT_b_g5`_
z!PM1zM0vri5QV@6{>Qc`2dps>lTTc+d_mS7+c~y!+Cq{cb;ln&W$cojFZb`qLyI3J
zMTK84KWu;S>c^wUCpB&6#LtnHjgM>Eqof~q@9%=+^K~LPr)fQLa1W@PIH93-S5nm1
zfLY=(#}Zav$zrXxoVOvGac!Z^^M~m(mL)DtU`{=hY$mQ<r+oR22y4o^<>r-^dpz&V
zt3UkMYeT(KS8@Z#wIkvud(T`x!fsdn?%~U)CokSyX)UL1$;8-R`d_gr!0}C2&;{87
zhq(t>7>=Jd`tH#1SBiDJwbYiEB05EfSIJqJJUU@7bM>)L{uZGnM)$WkFI`)ZdtBjL
zgL#09Si{d_2kyk5h)`K+E;rfny+$~5P{RV7(@e4J7R+H>d1pn``MZX{^H#}c>K2N3
ztw}llg?&v}_rVLVyk<@H+j^Rx=Z*in7vD@bmCLuds42~wdC1~`_>`qgRmRa1qPD$T
z$oOlgnZum|{~X_a^GjAJ-%6h2!nN#r;DiU!N{50f%X2L!tZ9ka6=5)?NUdu^`k@Oh
z^JOQ_OL}uaeCY{Oiw}P|cRC4cUV6r4W3HvmI88O_@bnn9I^FY!7o~G*)F}ztJB9N&
z2J6_jSQf=iePnU|@*TFBjr&XIIH);lG|ql^vGa6FlE<{i7Eh)`7H|rRv^YrfALjWl
z@sBZv^Tx}YS5ICv^jR(!H+AK-Z}a)}{Z8KaTGgkocTSJ()_uA8@iOwVadYR)EvuSq
zZ_en{D_G^j!7M5y;KwT9CEMU`tIYV^(CV3FgX71{;|!i*>|5_&Rn~a$!Qoeh==6h4
z?GFx_UzTv|nccafTC9Y_QDKdx<!jx>gQ7<!zSe1||9olImX6@KZ)rLS*@XqCi>EAD
zba8)KJZn|Ug2Mc=?GF3I7<az(yC39oK~Ct=0@04*sYjh!b@shKzwN!;mkoDodZj!f
zSue)$ZH_aWD|xK+n%><o)<2(3ggbBNME-2%Pk-NBzPw$&zwnmerq9CXv-5Uj^DO<&
zxF!DH)OE8yJ@=DXDZ+HOY=Ls-dV!BkZ;no_XR=6=DeKKX7d7*^;y(q?^`E?Q!uRsJ
zF8R8h)#}C$;}q+R!!z=3v$7N}{4uNdi9%vREaR_frScn}h6T;5KQCp!{H9_@@P}yC
zgZ`$wH}5TFJ}s91sGF7b%mo|WBjJY(X9O_6dZEcU$6)Q|B`bCxC{I&X|FC`|i;7pm
zW#P$lr)6$B)X%1OYv#iWHv1X;GkuO<v~&A@O(U@SXT$Ra8v+?BQ}4|+JL4I3&%oc>
z@mFHc9EoV<*ISr_O}TA6T$c5;8ansq<uXs?(_Gn}m$<p_#_x&G4>B0}3ODi`DrJe@
zGjHaBJD(4KKQ1o&{`%5d>zR{M_Mb?Kta|$+n>Tfv_N{J1gBh=EZtagfS@3k{jTg5{
zu2?U5C^0>UKj7o$DXIJ#TS^nMc3imFzF?cjqt?uA?9IpQQVuI=cE1ic{>J_+%=O))
z`#XK^9Q=9vyP4vR;0e|I^2he>eYC<ZNbGRIi8b1cXFKNhypP;&+aomdH{&P6>6zay
zzP!MDUiH={PUgeAnYL<%%P?)LiA*$Kvc!|!ulWGWVOs-Z0pGBhR<aA%tZR6|&%pUB
z>fysfUE*60lr}WRI%#yJ*;(gIJIeRKwOn{{x1e>#HRaqFeLq;;T~-E7kN7a>L%{LC
zjtHhD?LLA|;W_7}_NO#dxOdk~i?n7r>3@#LW7`B5@dLYCbENy9xGgm)-6yo{=CRkE
z4bRw=xUx8se}7`=y`ClE$|b&k&+8z8n^w2@-CqPp);J&h8}{kKqWN;0pQvwrP?xd(
z`VC*#DVnd{?B*%TJ&;W`GIgIbN8X=JH1jw6;dafcqnrt1%NPnROIH_d{2#Bk?T*jG
z|8aa5mef`RT^C*?eCo=Kq8Y+rs!NU~1Q;9*6k088akP5B`{DLp^|~*d(r)F)X3ELV
zG2{5A_B2Lpk@1P>9q%nHwC3(w`1`8k3vm;Jq#FLR^B>fD@85jqljC-4$M+ugx;LD5
zAFst93ElYVmsxqihY6pr{IS|C<8keSGv{r-6We8EE>&#rxV0}#ZPOGRHu+V|3KCwO
zB2PKW(k{u|4lvoOZFMO4?Mk+*@2@(ty=3R$v10lEex;9%Y2qTcZIOp0gziRf*Z=UC
z@xtAZQ+XNR*OnSYeEw5B_2u5?nff8?zC^QjbG}X}J7mW_QB%rCqGeCy8S`A38v^W8
zgO6AHPP#d%<9Vg|-z~}$*9tBZ6bW*;aQwg{Yn_%2cVFwX|C@dE@0qVxr?$2~{#(km
z;gU;R#gR>=XA8R}X9X+pzp@Bina#Xny#z<($L4uXYExhMO=|V|a7tA~?u<M4O#UNg
z8-(YlE9eOJz0&ZpVK`>hT`!<8Zysw#nC+AIJGl2t?=NLoaL{p0m7;D>=2BnPib%e=
zpzd4Wy{>tj7Fw{gBkQDAz=^hg!?wAs3pVB+Vm@~6-0d>A03+57457>R?Yd=QY0T4m
zOY&`}nL+FSz<A{XcforvjwE>rY>8dQ`a}0%b65(atd+EauFcCU$NG*HH-6b}lps^O
zmw)3c?q~ld?-WrI%Ixetv$eLIM{ezgtNivN<_l&p*I6AZulK#fXy}yMe{jZgBk2u4
zS@unvBz0SyL#pYn)Iz^kE+Pl7Zn1O`U_1IPq9MHdDc1@41>1CkyKV>Vs#BEfSn>6o
z?f#|fRhBpZTk)P%bkg3CfR9oIp*&@=XX9D-idX+(aZ~F(Qt0&m+g+(+OC+LvIv=Dw
zYJL7mX^N2l=Eed;{#NU6%86yY>;;z=WbNsZP!Rf@m6<&+@z#E?=VckU7w>6W+k48Z
ze9pum<)Tf@3hkj!8jG8w?2FIpWXHv)Zf_ANxf8%{$y@mGK^A+iV&T#Ym-^(aQcQgp
zEW38S;HkaOOP6^?FT(OP93<{6Rr>$V_t88y{@VxY%yiyIT|36PDpq@)|JC^mdAA$6
zN%c%>+c{;L*_mHc+1D~}S6g$dE@ercb=fbgmbSjchkg6*-0hF~#93bY!r0mQk9}yA
zlZ4oDpTIZoLmf3$mi;aZS>@CJTlT5#hEL`7KZ?%pyJP-PVriS+Wi|PQy~mFoTPUr@
zcquW)wX|oQp7Mpcd7THXpA<!NBm}Q7{B<Vc@ylPU^(5E)bDa9l<Ad_m>gi?C%=@D*
zJF0Pf-Ipf#cEkF<tSlp+*X`^_%N?4RS(mJm&ob-y^Uh+%q6^#dMZ4G!oqET6W5L~^
z>Q_4iT|cV-68dFxaiNVydAxr1;)@(+i})lq^5h=%4vlse6YP(g_Q_3!=YXg{o#C0!
z0v4wgM3i4MvOQDdUHRs8{$eMsWM^r8<%y3Y3l$@mY?9|#t+7V$MvZfO@h@qcyc@aa
zjLWo7Ppyod(ye-4*{H(e-l-)sbUG`a_039uk}#8P2H)MUsjRcAB^OWJdN<emZ;4*%
z_Ud=eKjV0h9@oh~@WJ@duB$FQ6TSCneErh*BjV})t=t=A6mR~GS~XkxdhEZY);FF9
zKAAfAa?k(hz5G)8arc{F{{Gke?Uj6p(fij=0=%rA@V!t-Yd60zKZ1M5(uz{ad*^I^
zSepF%xNh0A`s)h0f&Y%rsr7U4OWI{_Y-G14@v3O=&L3+h?F<lSDp`Es;eQq1Z<l}e
z`m8>bF2BNyfA+x;4QFG+hKH?f5f2jA^G)STFPRcDUGY`dvBR9d3(YQH@OFEe5iwOu
z;+Tfgrrv!*d_2X{o*zSfJ)S@6KJQv%5WrGt>z~{a_(kTrMaiPeb03P96rMaF#8IgH
z$YSr;J5^Vd8-rp`iA~taAak|B-N|@WWZ6NJ_L&pDOJvTrYE>^b34D_fG4m2{nCKbt
zE6<;{WnZmX^);*7DyV-&fBIH~s?yzB_K&k2lyyHGQQOnI=UibVv$L$&!;?}g-4n_Z
zdYiZ2STghZ<B9H*ZaI9H=v+GKwd=Xb=O38-e7mSiU1jg~rnNtKJ6}xYXRKH`#aX^P
zp*M?N=1T~t)#*uG`z{DB-t2s7p)zYo!hF+>T>AtLSNFV@ii^2iY~9q`xNYa_nR{2x
z$`#une&x=mvjvP9LCb%fSN5qtA1krw0!!xJS@Xn$zn$6`TKywHwsYB<%I9CQ9xO}y
z!pFWTZJkygtISUs9tD$L9`%%8^BZ5RPp;p8_GHcE`pQ+=KX(b=veL-BB;Y!|Z{{VH
zO)AaX?3dO@&z*IRpFhsjE^fn#(_4Ekzo|8Oz0cO^$FUC&UT!>Syg9&nS-rZNo6_ml
zs3+PIKSk2)8W)~FeC2-Q#y0c+<w<%wYIbUGey8`RSLd%;p54re=g&BccK+MH$^Y&K
z>2(`FuIOq#Afuema5VOWbvH|x-=5!A0cYj*?Y&wn!7KGJUw@W?-@LVpZ>TLc*tjsI
z{@VVZ&kEmM)o)=~yR+`?;axxSE`7)rS9af{7^Jv(b=Sj(iPtO{ZzRiqG+nA8>iTFJ
z17k4rnuCX0Ls&Guw;xzLP2doBT#kX$o{6rls_QpIOzhn7=D?M}#Z}D$W^BtgFDYM?
z*D8JdmraD|wG)@t&A1p^CL!}Y;<A3ei^D{-t9LoOHXj!bZB2K(_4uIpa-Ut-ulI6)
z=Vsbt|3j(7#kb#Oe)WU<VGg|}CF{ASJquO)a{G^&{^6rHI?O&+cye~eKC-!2s%DXM
zbX!=%WTVWj2fnoM9s4ME^=hcZd)K6pK>vu}?-MdD?kQcDcB(kG^TOn;C7gNF(w<$F
zJk_vndS>_JHHVEZN4%WKd|9xJ+d(arpJ7Sfyx!A`U)*x}+rQGQ-Q?b$n0ILs{U;n>
zedn6z^Oo^M!(3lWTQ}aDzI)$R7kMnpWc=&K_2K%yEeG{XPi(iA*|pSg*UR0>EJ<PU
zmtRdNlBoT1H?yYY=4Fv<lH2p$_FsGzaVe!|<1Ja|l=fo{72h&$OQwId%w?QqxF)w`
z!O<5D_I;&C6TWYK+qdpd#_rJO%M)MUYuFaHrgr-gnJXq%TFW;5+Hi2=`jFnb-G?*p
zbsDsp<eodA%{8}hZrt$->qW*v+pWG@bEa+2E9zNPy?J+T=`AO(Y=^rqG7d@3-L<r?
z^Gp}htnD*D+J)_%Wc};w)7j?N^{*>Gj<IqG<Y3CZe=*>tcKn>h^7V&L-&hem_lDtH
z3*r8+XQdflUC4eczuVcdRqt!UZN63F!4?bq7t6l*bz&dy^=$Ks8Sl2uU0cVtz-?u4
zQ<j55OT5JHszl*y`I)z@&t9A&)zmxv?vD!lqTSc}3(O*z_PG>4Ni1(JK3mOZ!)2_V
zUs}dH^>-;xa`1u=x_g>)KP@trEq}1Ke!I5fFPC+;jn!Y$y0hLsY<qt!cc}yOr)=~0
zue=ya)lGRO+?%pAxY${dZ7V~#WPtVFX;+;$s6}zcuXQ&)vhvsB`(LL`_;un#dGz<Q
z+e$rG+)mw}+BlJ|b>*4K44Pbjze_7jV%vG7Ty7rwi`Q%`_8qAZTahodqF85hjo1u(
z6NAIN^~>)5-`F@aq0&djhJQ0pSmuuNM-7|fr9N%mcs5}c+h3nO#um#N?S+|nzvb@#
z6}duX?eD`nTK={U%-Ofy_G&%ZVj^sG(`sqy?WJ#Aq?*JsY!-+}DYa@H-+tptcvCMw
z*N+U7Dt)iNal$Tpe+UWtUbFXDwCq|dU-g^XQwmF@ufF9`ijchQU+D4Sp3I?+uTt@w
zJ)NqUx3#)|u9OJ!-S>V~Gr!3@$*bSg-$Wf|S-y1stL^W5cveprez}=tYuo*Rg+8_|
z)<4qJ=4#jQuUJw3sfu;?{0(j?xBFSI#22XRXK3#b_m%nOD&%?H`l!}g1?eNj(kg0k
zCuW|xVp90+hV`nZ%hPAA`Vn>fPUO^d&3{e;`Y)!>Ec*4eRd|h6%ifPcA_lVBAD&I!
zxBu{J`^c`XR%H%hADm=AnB2Yc*lF@>>s<!&)0W>h_g9NtD))P7ORq`LMe~ThvVzaM
zRSbU%SKs~qyrrS+)%6OWrE<{>*V%usPkYR19JRplzWAlTMLqTspBY~0IlVm+zPIz3
zmwtLx$whm`(%9wy8mD`(tSDV}|M+`f9XbA0dN0mes?M3?rv0jUQbWvi9p*LOvHRE6
z&0}uR2()rwTVJ}R{ziz)L5JAGhn}tKag4qFimBAr`(f$Q>WEbruCwxN(b#K|=6CT&
zyr#~o(nFK7Y{i%CGifeddVsylsAI|`nU<w4!s1RPQ*4hco%-VC+iPE5%rNQNQSW<V
z$;11C(i`84+I_Dto?Fit0N?Qf8j7?~`hCM!o`K=ld<F(lw4um?#G>NVBE5pjx3<~E
zx7{Y)|Eit#)NA4v&3R8OIv02CNw@wqFF*OD`01T{7fXn^@TtymY+!Tnj&l9~ch~d3
zEDPJ`K6w?f&4a<%*7hz48TYb3xqDmw|HiMuW=matx5u5&xR~;}Cv5kVpGI@%U0i#7
z@!MYZC#gI4tl4yVbDPb*dzG75>-Q<Ur%&0lurzXl<X@N1MLQc#Em`<7DLFZAD)%In
z&!L-FWlWlovr%Vt+Y(pMA=6V`&vu`=q&D|iX6)stX@T3@SOiX{OFyb}eY!r=a`EM;
zxT&wgi+7&s3Z8WBiARD#ltNu)nNp*1&3FA}C7m7}PM;ns>HC|TZL+kKlKp%A_TMK@
z_rKl$=lAR8{crOGer(vZr?Vx_#6kZ}+nV3O*Dh$CH7~gs7-jzH<>y^LRab9bwx*&{
zJkytdfw+4Lzx3{yOYxUh-4EVg?OYVJuIuK!U00=Z7^M5o8D(r#<DIZ?(ef`%XHIv;
zUR|xa%_Y6%+T{{X^B2cOb(c9@FY*i0*?a18*A-t@S%v^h_X-YsyMRmH{>zSw-@d)K
z_iwrWeCPZ3-~K=T`)~8~56m1NF4ukfY_}ll;>9g7I-BQwTOGIl_^wOp$B(~1etvu0
z(&*1`*S=Q|_h0|;9rLG>>}hk;crBS#EWJ#%|4UDapZRqDhfn@dr{ZTkmH+&yKl)Vv
z_U-#-$Gqj)e{9j4&kZtuvrWEx$;rg`*6*EXV`b*GPv2;Yfsw8E>JqMyRVPoXYF=W!
z$}1z!eDs;?)tXr+vfekWv%DL$b<H+5hjogV-v2%LdV0J4J7$p`KT`ic7jJ+6t#PZd
zReNB|S+(vhGv|H1c|TU5&-_O+PtI(f6W5HN$crEEI&?wnNQA`4U3;#**rFAF`ro$%
zmOsaLH!HqeTd`cIPsB@DI{8U%)YTB)j(xUvY`bG(9484*buKeLdt9IKQum%Ybq*)z
zG$hDOVSVblQQ32nXyjy-zq6iwR?KMOUcuL~c#Y_lACXgbt7y+s{GuejKT=&#=Dn)=
z+tr(z<~=;HER>arfAKCqe@%@Jqw}YW1*#GR`j}X}&TW3y6T9(H*}^G4!3$(Ey@KXX
zeZEU#(S|4y<*Qme8c|=_m9I)(;Zt^V&RN>O_t9Q~7yN9y^uAOdvF14P(Ed&P8aA8c
z`;)|bmhd^hIel=Qe+ui3oP-y5uf}|k%Us7I@2OYGZ+iVtdg<ga-%Cu9;t|Zs*SrFP
zW;D%N#%j56g_L7ffNC0R<~i@8d2!cLx*bHByyPP5n?#<!J#dF*m+-&l8VA93A&F<W
z#U5Xta%R)dIbjxO8Fd(+1YNtpztPL~RzQWLqb6^4+3~e<whHT?n>%n$kuM4RZnQSG
z;P<nP!g+h6>`S7uT8>R@tn~Jsan)h5-)XOmW3vyjSM{vv+IC9H@>KfgSHE^V_;2n$
zC+ymVx3RJRx&BvuitPV#!a4ZU0*|KcziLk8%{>1gE8W0=&F*Y=mGL|)r_aY9XGK`I
zz2fR|aM8cWV{PADx3kGHJ=Z|w*iv(w+q0i#ct>kQ<@T<q36&TBWbb3iFx@%pT*4>8
z7s5Y&Ud{P&)ko~EO1xn7qJ69C-#+x!^Qy^{h&o)C!9Any$b=uI!Pm`B@xC)UDD!uc
z%vAY|#${=_(sQpV8wA~GIkW7=<V|M|2K)$5o%sFb@x9@iCw@4biCB~LKjVve)CH~C
zeYz3ChS8=sd(JZ6F=2Zw=&M=FzR^Fze&(d`?=6?ouUGLUOjn=IyLNhJqua@gSu-yi
zI!pcYx$)UQb6=B~PL9v#mbwrheaD0YH#PnLwfpV-*tqweX{foxJJtv6+e+q7O}ip_
zV{uSKa?h6w@mD^tS+h{GX@W$ZY~sVCZNV=V<izPWFubU`IMYO>ZjtyFt{Gf=PG=l`
zV^z!W<iod)j|<&eFN#ll+I`sk<nP7d{!2S=Mw@<KyL@kBv&r;(?VQ4vEL&LE7vHzm
zb66zyl6Ci;+mbhAeK*hAC6@92sMhJku7pWWV%i0Z67-%=)0useapv0POU_S`>aciV
z{^I1u<4@D_qi3X4-)`nDk7!6dAGk%nX2JC5siucF7GBL>CCWNuujMJLe<z;(nBJxR
zB=x*`_?6}Czvf<NNbQeLZLL4}HPs>U74!L7j9O{0R<XvkxxDf9E;!5GcY`zJ*M;5N
zb}P)uU9BGDb7xZI#5Dm*2_mKeYrd!bzx&Yf)92sK%mv>jU1vXedp`gF+W$`ji?;lK
z_ac^mW!$v~zBQ+`3TE-n{J7wzQ(|D*mZ&DBg|!O$B6F5CO*`rn8)wb6?%=_RSG=vx
zKD#-km6zf6Mq^=_fC=0)Had7^y<>cyTG(a#_;N(+hqsjr?pxcRp20OU=-sr;?PWfF
zvrj5dc)u_>b>peoJ({a6%NNa^HM{u3$6t%@_jMmUy#LU7-)}#9`8A^U+W*^HUSsof
zZGDZ66p!3Dv%kA;o>_NITK(lU`}z5Qzo*P;DA%d8=UEWHMofK6QT1+HyGldJ{P#X`
zf4AA{@vEOHK6YRH|AG4q1$^tw@BPf(!+h`iM;(^g(<+-Dy>w!Cmt6UC!~cXY1s}pM
zupV3$w>H4i_piZMt4nfP3s#lPX8FUE`^?)wn~Q&M-GU5JJu41J+m)AIvcD3}mT8jK
zw&8S~w@z#RtZ>B*2Pa)`oV0oJpU10m_9SkS)R2DY!@kjN+mbxt!w$lyYeEn6OrQH}
zOWhW6r~O|%&ASeKRcvEe_H|}-fwo8Y73rMgii**fvZN-QSkL78yi_jZZ#<J~;x}zu
zuD5M%_m79Z;ye`BG0Anqi+Cs3!#rG5&)Dw#r5JHW`8<DP&~mvA>52&;vN1?L+#vfv
z%Vv+&{BrXDvqEQNT>do0OvmB~ukP_pTOXJIFx0g*@jT|nTUu;#zH8=&C0{-_Ud-~-
zcj=y1diIv^w#r*muFjC0?JQ>euwGqClvi@ujojB}pOwqLtS!nCWjxD%sy_6FXzM*L
z8^^1{yJDYRGd*)5;eTSXy#ssqzD4cH6`Llg`~0eIsZ_gW{E(eN_rj@{k>@W&zG-&t
z-D4}epi_9W<(qF2vsJm<=J!>s30r99Qo|lsXfQ==DZi@_vuxb?PHvH)Hy6bpKI)m&
zJxTg=tw3|BsR?iYfls_*j^*CU0e;P`J2D(jCtUqnYo%c!@xQ});yqcBm#@>>S7k{U
zJT}drdwl=lqXucmYqc!*wo5k4>)z}?!<bMvBU+s?>@H(oDbos{Rtt~nIi*KFFH5ja
zI^EM{;gkHJ{K#hO19=i!$!dJYZzlhXSm);;z44SO_uWS0<=5}HJ+Td0b(3j=h6z*d
z*)L6Vgm|v%{tbDywC!lfLf)#EUeaNw%6IgAXVBWT@xb%mvyYRC9sX@{-&Xc0^uy*A
z{)Go}<t`L2oA|{_Y{7)CQs)_YQe5Va+3OY@PsnWMvt7O7@=wN_Il107W`XS5hvQ5F
zg?lDmC^2I?W9^t|`2Vxc`Gc%2p0k*?HT?E*(Ubgk$5d?fRnfDWJ7zCFYw%Lkv0(3W
zo3&gHr(*vwCT-m)e)H5bCbRlCCr$6{J6L8L&i^RGWA3qi$NPPss<Jk=&N+GR-L-Q|
zniW|0tZ0b8trTPC=I_%}V<EGBefjo%e2?4Y#lB8s=v@&wM`Onfrf&?ZEfmh5klHCG
z#*-nl_*$4t^o*%ja@3z2&v94nFuYKG_Jr#!jpG)5i;wB|O|t#%zRdT}hO$n{yDwTE
zPj}*vx*Ghzc$05J%`M~J9hn(rJ1(DlaQlnp?5!n{S^=rTr#QmIZ6eNQSk~8O<UaNb
zS-;n;PG_&_{VUN`9`Cyv_r0^cwP}&*TD!)->QWm^mR*_lME7@Fc1V;;w%cr7!_ya@
z=l%L1^qr}bl|60S=}*qL?ZT!rt=Xd1K4)Fx1D$zUwv2WUMD%r%=f6s{Ry=;7`uoiL
z5m6JP8CWtanzN@l>g4mM^yf~0HGk>XnK4Tb1})fqCiUC3qFs#{hPLOjvi(ogulijS
z+!1fTO-b-3_oE-184Hbnr#)!mc1#LCb>U6;4vz%ogTB|VuW=X3bYuE=S#QC{Hl<^%
zC+1X!8gsfF`Qakv<Xr0K@Mu4)LgB+hoC|UcuHHJ^JfHnZCG+Q>C%Js%cOLoG`95v6
zY}Z3Ohtu8Z+b{3(+%f6hP8XdtNh6hurc-;C1j~duIk{BtUb1}qrLRmqv$+p_k7#}J
zDoXc_`E+l&=?8UfBeXoX=rJ@k&RKTh{JxCL6ONV#+kUQc;1_o*Td`)f!?MhI%O9A3
z*?8-~b;XL=i&MT-?R2>&$un{Hih$2=yI7s~KQ1yn_C%%No}S3V?Y1Sq*DT#;%d6KR
z=pGfeC9Eghb?&*$Lt7Zw#GjnnczM~C>Z0Q_`|cdsK2?(C;qS*iA7AI)OKNow`uRzF
z<F9l2SKcIhuh>!^d$P1Dr&zx$!R6uyw*yBWttb#)#4Y&!=b`+lSR<ul*B-X3IK@>r
z%E)h7v*y0X;^<obcU(Voa*Q}LL=BR>_Vnyo`0d_Q)f?ulix>M|GtA?d5TReVN-Q+)
zywg%%&nK<cA3ip$J=?lK@uBMFRbOm2D$UxS(rz5KBxlF%#Jtnot!dKsDU2`T?`yC;
zlS*hl{VjIq^~PQAXPDnQw0hl@)T(WMQx@+&{jKZ7?L)6c&8>@*G`?|uu2N#zUDmVX
zx0KJ8j+Z@~k5>Dc6#wp6qcTA)%|$Uz@mN%`n9%L>g|nr*C+@t#x=e_3QnbmMy89DS
z3)_9CY*d}{V%^uky;d)0Td!{S3%}y`VtP`&t3v=&^MBSVp1WQ9cE`+_^0W43*Ym3{
zxe{5HpAE4|S@zRE@@`LR=Z0U$ta9FlhF`d`E%fB+M`@vU4enK^R{fdbYZ_IR^~?FZ
ze%HDk|5K9eAAjMtbI@XyD~NjVPbNK{@5j9@UKMwO)}`M)##g?jk&(l5=b9CXOB<4J
z87#bWHO%SG9-Xl6mc{qwe=MBopuUDx^<jwg?FS*Roj2`|FncD@W$X|-Yl8c^#~qsA
z(qBJOUOjzRuxYME+M@V7=Fi$r1Voj-we{&fU3cH%U6RHt{vGGoI)W76PvrhreBjAj
zC-x%}g?CybwBKF%y}Lv8q~FA|+PuH3gm*JvvV8op-oV6jvhI&fon69(*EMdro#*+(
z{K@KpJlA*T7mgVceS)hyyYBp4;@4#~bKb?5?A_0z8rLqbYQGlnWX6G&k$gJJ`O|`5
zKky1-GviR)dbfc?FN-76P<M5g-|Uvo?QF^Uou=iw5|0mDxq6{3;A)`B6%XOZZzkG*
zvpUxvS|vG$=jp4L>kOGsM+&7W6)QazOIT53k|L^M!{Z>wc5vI-K%q^umR;dB3{F&5
zmi>E0aq-?$Yga9D_$9czX3OJus^a~Iw^Zw@j1^wR{VB?EiVgnv=7_lo^P!x>KXTLO
zRkkkXDfV{T@l-53RaER+O;Y&lnJJ-07E4zDeseJWg!G?xrz8T~YrUgG&f2Tp+~}45
z`?G6U!_TT6PpZ2P$t)>OUX;4sEAZZ9ZR?O6k-kmmn=E;lWOiMMs$^#{ef`0ypzm+r
zjm955HyPslo~m7FZ2z?UFmG8!Re!R^&O(hB&nKEZaJA7-i{&bR@ZfaOMxWI@&yHC*
z<ULD1Q!;&zP0i<TKhLkfFDtjFd((0KUo#_?9qd@e*Dj$XG5z@aK4Fh*b96H%`(B^$
zn9<Ve&&Pu4Z)-fBHs+^E7EUqRXdV~4^|=1qr2WD>MTEQxHj2ld_*S=8s-v&+c+#%k
z$>PfW**&#v@da-Kwtw?D@vu7J)6H|r(FrT|*H0E*z03KdU-MmyRc|+P#2kF0$6e)f
z`*B@I-^Vul4(s<N(R!6PSH<P{NczXj|MacfcuvT^$IG`(>0#2XIBh62>vs2#qW=5$
zqji5;B;0YGz<24#t{E4*7pSEDVVRd~=HmN<htaY%KV^UQ+oL{J%a_i+{dtk9>atH!
z9IN*9bgZiASy=S%bz7OW^L*A@4}aI`d^g`>sh#eqckSt_S(j8!oQ{0C`C?CeL0fa`
zrJLW%Pamt0J(%@k(UW7rF)2!N&B3dD#UfZ-xR`be1Rbbrzst%X|4Hma*^S5zySfug
zKi|^hVrgLdaDAVy*u}qdxjh6$On<z3)%ro|$5qcAacjFY{Tv)W9%B9c<n)Q2>sOu&
zuwU&++OSWV#rb}Rcl*9?DlV~AL5mn3yXe-}XXe?btG6yXEjj<vsr2u2&w7c!vb`}$
zXvw3+yA*G%Shtw_#?+LyKb7)f&u`a+TAOUs&(HGP_vrZ4_-8Ly@x8wzz&=ZO^0dI)
zg1@?AuRc?Le&VlwSm_})o!PE$&qV1kA6b{{wwe9cn{QD!0%e62t{QkvPV|1>UZ>xl
zSKfATACIzZW@t21{@Sficvo(DQtEQ+Y4MV2KVI^(yD{6z-0(ksc6xW-pZ4Dd>3q7s
z%g!h+;hg3CBiH`XPP=awQ{TAHa;cd;cgKrumtTIh$@y?j*uQz@--6f{11Zg9pP7-_
zA{Qj~r=D_OuysSv7B)$jY^y11`6miy?dg-;Q7ppTxZt#Vqr&5*Kkgpel2^S<sf&BA
z+<aAYrM>Kro_$GqDr)$1>H?Mh9TO&+_Fn3|U%vF>>&ot?^UvC{W^I2Rcf>8=LB^MT
z4BvV~S*lh<7*6Ceon6lTv|8xjOjVOD9qV_ooi7RbYt~!(@Py#n+0!rF6x(;gM5_F<
zR+F$}!o?T93qJ5(Ic;z)K{{Nt#5J?leL~dz4ui05ox5iqId83{P=3uI%3z&U(H^ZQ
z$NZ*WHSC+!e$CeKz!I~jKVhopiyoxKtZIK3)opd+m4wk@0X0WvwU)!rr*-n_m|L?g
zJ>%`ZFU3Caz?1jqmUX?eT@_w>@$8F=ZuN<?jib{4FL@Zy`}*v$wT~7Z;E60-vDW+P
zieKOUWGwHTZFzC0q{7M22p5OF>lb)k5l>sYfg#%QuBrWH>Aq*8X4lRv*bosWl`Pb!
zc<_(Zhwtp)+W*!Z`@d;PNb3nLR(rJvA6KUCO_``y`Rayhnzr2Lr>cu3=d52Jaa-yC
zalOQ|AER4$eHSm)&;Rg?z0~vO(yE$Ma`wT~-+VOwD)Hg=(-&Q01=S+Ek581(i%Bke
zJpW}$=+&F*Tu#Bsej+wH5y@%>1=Tm>=Ea@e&ij#Z*7Bn-wQQFvulUWqR<H1Vftl({
zA%3M#IcL*F+|F%zDEa4{rlmLIFC|^Q!l%hz=`$20ixnTgoILA_>a`UstRC<_+Gu5~
zY%@13*l5qHH!Z2AF%wMAZ+!WeiQn_{7q1=v%O5k|xudx9)8>bt3>nM+GX9j>9&zxy
z@S>Tl)9*Vp7x4<|?N?>Beac<Pf1+H+g4vh%WYf{un=6GXK1|VhD#8Bz1>?_oI-f)G
z?rz=myX*wZ^EAFff2W5V%|!hEq;)>LGa;Fo@1j%Q!_=c6^X-?VgohqAd%TfV_>RNz
zzOP?1PHtLu@PF>l_5Jb8^VS`SKl*dZ)YVaD+6&lbd!5^Q@s!kT32*CFA2f4cop!yy
z^?%orhm$w%pI*fEH&5ep?2~T>KW2WoS}-pqP`6XIarVD}cTKf%F^8@?@6{E{+b~r*
zH0tw$2U1~<?~FBe?K&pzeyVb=fn>n$uRKC4nuKyP4tg?i81o*uac#qm^Pv%JO$(OX
zVida}u)VL=w^TBsS!n45nJ-QA`GhZ}=X4(DKQEtrO>$-O2b-5OCi0xIv6Zp-`|eA9
z${XFO+nXcf_guSuKKl3afc$H@r}!34D)-%4bN9qq)?Ae@ZF5^UR4%(#ec;oyS>`_z
z54(T!t@KOYV|?(;&V%l^h0CYR4q9?ab8EW)Bdy~)@-Nyd15Vq-M7%EXjQez6fZN%7
z$Glet23xkVcUSkxJ^Z1v!!rCw$jvp^+BeMTlIwL7p3n8?#?J0#H(3?G@jN;!z^@|n
z_G?eGq`0@$TOSwCPX*h8XS*#teD(7^yKMgc)iGDEKM_%Tp}qb7^|*Ue9n&A09%+ue
z<+-5#Q1jHty<eLC+kUm2!t`%*d5wgWvzz@{#T3B<eZig8db%?Om$z?t`YU^rhr4@)
ztMR)x5=oNt_*lAUa7pjzy0A>Sy0(G0X;XR0j&r*owQ2u8^na3Uu=JPG=WibWb_?x$
z(^tACbNSkNH!@GWwl#b4pkvxh!HW}(l23L7U)>Pu^ZxX#-dx*+`DbnwZfU8%)R=E6
z{G4-_ns3GGssr%~%xb*3A<yoM@XU<#*r6<Kkt_1?tkKl=MK(DdT-qiEwnaZ*XYBDT
zuAVzN&guQ-iF1Ax7r*=&#mAZ}_5O49rjO@zwrp~;T4H=jk-L1Mb|ycA#xnykzqTXp
z>Qdg7>wf=UzLE9aV<o|P$8uROmQUYP)0F0;qqBZm-1APKw@h#D#RhI&l&#yrGRMAq
zp`fSnqU}LvSSouzJiqXwOY*JEj?L`1^Vg~O9iOY-x4u_Tl5e6&`k94=?{A$rSA71r
zob|V3za(UY*K<qsB<x5s(%AOwW2I=1r|IVNHSPP>Yl>7}|M=?lxjj{v&T0Fo{&!Co
zlT-L(yHoX?$B`RfQ*3w7D@nU<UTgiPiQ|LC=A3Cqvo3tzq`bL?-^t#nnxo7+gHh}b
z^Yz|;)e3JeEBfUpP5FCl$r|g-N7eju>gMbYl<!&PbNcDh#Z3!WaiqPy`8RX1tlKQ+
z5@+9iVj^{aGNu=&_qc1EKe%%CgM|~i^iKI-In&MR7Fg_;dGPr=roH*=1t&Bvopboh
zr;SGf^Tno_Uzz15bo-{By$)MP((_}#_bh8ZXn$N|!;S>CM=yStM{2kyW*n)jQ7KKG
z`^Rlz>N`X6e$yKTO?%fhJ8iB0&8R4@yNjoF!=#_fHXr`sYc)HOiTiTyl<!dqQ@le=
zvZlJ%RZROGdx@E&ukKmp+lPV<W^%FaCHIr2p5Nquuch_cJZsmJUT!U`56%diuiSZ3
z)KQXePv**)I<u?dbM4klPH=WSR=9JH%S>I)L~|j(&l&CI%8L{k?zQcF<jQp5i0jLb
z)A#l#Ojm6yl<&OGb-+2J()RQIzxCVdtLu6GZ|l7(n|7&sfv?ZUPUY;fBNx<<mFE`Q
z2W!XkrPda`bBl<!`flxgyYBi;g_^7$Ze=;C=zB$)s+%tEUVrsbG)L6S6q9EzzCX-r
z@9~^pkzkkheXYm#x?W$Aw5yB@%jzH7H3fc}!V%4Ly>Z1;qw_ybFZdBv@od$>7tg(2
zmL~l=Zu3dWl<(8r`T7rMCz>p|Y~<;`vDmMmb#>CuD{4yukMk#1IA04l%6;2bb-Y|l
z<%EozkUv|_$?5BrcO<WV(-FPm;)Z9nx6C&Emtc-y-SH*p@O%3fR@1+-X)$RlwKvp>
zm>w&5Z17k-xZ>B}sKTmJm)BySr+URL_Mg8hP=8%C=gGJU4}$`q{M{kTc~I|h<wp_4
zuXFjHh`bl=zPyRMXuHCaGiu74Ht_V;b<EMrT|Rs5&;Qlg|Nigu^)9)_`=)gg-+Zak
zl+%}UHpWSLdbKa<jE?=Yck0D&yV^JIHk(no@uY-H<&$-+Gb(};-5adRv$zAE)qi1r
zAGq;e{l#y7Jl|`V8<v!83gniZxh%-F%4cKbeiQxolI?6uTBHsKd#<Wfx_YDZs@d!%
ziRVw)+{{W!a_QXh@ZqvO-R%=&%eqzN>fiahvbk384ppD~(7OJm#*_=WF9cO~^n0rs
zUA1`pn~T{(dXHbT?4iq9<?jM++~t{ls@=7&(`nOb_y0y`j~r6sznT7n>r-ZP^<BqH
z;b#Q)mVVfGZIaBU>CvnKfxe#G=AL@zuXb7R=MHnh2M1I{!fop28;YH%x%ud(;j;Go
z+ol>C9x)9Uh<STYbG_fbi%T{yc=WvO(5aQlDtG?aFV#+3Bz*K`Tk`cU3>%|NIN7Cd
zTP^N5Hf8y;9ldi;+!kB@a;xw24<{xB#VRVT`=+(>>g0tJ_smTX=w&eLDh<8MJ#BwU
z*ri)FcV%WiPrcQ_%>H$4=+>K@wnA%mHwFs2P5Ipalsj<oS2aNi{+)TpCN6xr*P}<R
z)<Ev?QKt&sOU2g<_uj5Pp{tjXzW?^^puEKBoj1CQ6&X)d#aOOMU76o@WXk!9BP*R7
zPHbsAyYPH{byw4UGvV{APMobuU0CEHS$Jc2<%>O)OK;pVnR}K~^!NqYJ<@7{>pj2S
ze7u-X+G4MPGDp`1r9#I0(W`y5^;fnpTQhOxL$kjdPqg|ao$lD`z{0+EqG*y#sZOrX
z7ei5F-|CPp&Bb4BeUB7I-I*q*=DX-c>&r*`?3K3N_nYUx_v!|roo0)gGvCh3*M5IY
z_e)xiMJ3bv;At=ZXdB({y0KLK)5?w;(`K3-J+r{JylvV{&x0}7cc1>|`njWM%C;Km
zuobMrs*fE?QZ78oTq<4Q^XA{FXSz(5;<}p`X_<F6b}jgLz?D-c(la6MX7==|*;Y?^
z<=v;{Kk_R&$|!lziP_Pv|D(|EX%Z~w4zq6iy^#O8meQW`Xx}p{Ze&_2o~b<c*X-Q=
z3BSKiC~yC3CCQVcWwqGjDc{MZH?-VqHc5v*GZA2!ni-Vmd&pEI%G{3UWngE9gkR9J
z{SHS0mMtvke6v)-km;^f|Izfz5#@o_Wvh4}w_2Oe7OxR{@kDK3-KI~|B))9z*SVLO
z8z_5~XP)%la>34Cm3UE3)8*6Ro+~=0_rGCPT2>M*-cd21<-iXv_W4z@TOMp{ou2x>
z%+c>qZ2!WXRY#{ic|ZBpt_g|z>b1;1?#SIB>lP~=uzpPx`&@aJGhHdICz%2cMJ621
ziafRV_72y&=*uMw_cQID$7uHTtl#WguDxDs&8}Q{QzCNl(S)g6HGEvI2o?GIzxMxb
zATa;q#x?RhyDlo$alg!4{!^E4$MRo$gC6Cc(%R0<eeuW9KPzTc@fP2%Wa_m#-Kcw(
zEztZzpTc_Ei<?h6`Llg5`4xQk&=r+#lf%>bB5&`xxw?JBb@c;Y{}yF1{hc4A-OCX<
z<xO?k6N5d1-T4P@l}(FceqN6>{|-8Fl3)Cp-Zn7?238-;6DNyPOG*p$3M!Ar{4aWJ
zHtAoye`D|Zt}8B!)X!bJI&XbR_{pBhXY$e>b<KUUPED_El0#>5SBl`0)VovUU&KA0
z_hw%n!yn(s$*10}nzYe}sh917{k}Yt8nwK2@&B*?`JJIEtol6vnvv!rgGoP^{?OtM
zi?-bVA<pmIk<}*FPcEiKcXUsW|MObr{~y;oc}pv_LuYktt(j0b>+OX|5u+Pht^VBq
zzv%qY=`V^urhin^OzD|kIqjLF;L?*RLeF0M{iur&OVz85cd_21?J_|n^PumQl%)Aj
zXX~7pI;XQV;Dpkxhqu-IrW=1`%sJz-Dov@oS;^<~U7r=XkuHXHavyd~*sar(RI(s%
z+JjeC{x4T@OgZr-{H(v2$Zd<LsI+w-SHBIG*`#qZpg;QXp7hzer#0fvAJICiD#4TH
zq{bgOPi>2Vv0&o6%4yzztc9(kEP5L9E9Nc#A-P=I`TV{uC6!ax%Y_?V_7-b>bZz(F
z_pi18Uo8(`|L@zgyW6J=H}ZeK_UGrPjR&S(`V>0(#AT(}rG<B|Y@TyV&HOe4f85^M
zzs_l4^KPws<e(X7U%LBjn&{h?OW!%kZ(cAxY33})$^;(q-@g_74=jDP=gd<r-$NP9
zo-g*?bdUUgQEQsxJ|)GsdmiLQxKBt7eR4H;>a?F;-{jH{wk?^<>0=i7(0w+`>PMR+
zbXp!;q)+(b!CBWZ-!XED^h}Qv>tni~I==5yzt{3;!nCBVypwuGGWphaY`m_tXs!Mc
zJ6{=(jwP1QCjF|KEG|4@zR$MV^-mVOnjmuUv8wjDCr7)B53`hfi;YUq{2o2CgW<Ki
z)4Y5yp}1?>k{TLbYl5n@yVka>S^7noY5(EuX=jZWhE+}xov_R0&*|H%XUpHa`{&22
zIW2Eua#Ll_zdrV=X45pqz|X52W5Nn@I<A(!*Z%x!R=m&AKlTSQl(rs;X8cyPvs1+6
z^zyU%i<Y<-T3y`jdw=h<3G0mKs~ec`7x}Gzdq(Txi@F0j0mqI$`g^xxc7m&Mw1wle
zlPR?=64#WXE$(0V=k%;wL8(^YW%HTO8M+%k-|#srrk^jeSvMz2<h-TT^3Zu&U(e4H
zN@FmLxHM%(|9$gz_H;D^;WeC+Mt_nbSI+DCloX|-#c0Uir#EwBM6v4Q4TiI{Jj}cI
z9PzqzrmHnM%5J;FRDt_{N^1W;zIyiT#fLXd&fWZRer==8Ik($0>~@>xH&<VJaAQaA
zZU5U(9$&h$;f%75t?{>B9hX&iS!;gp%6xUREy30PMCilL`BQjKN6cR6@~&0cPG0q_
z{P9V5*#f35z4DAZ?NWrg^Gx@p_j}KDw=3v9<$RJ@$LN~i{keM0HRCAvx>w(IFX+Em
z89TjUGSlJAx)*ChR(dRDP?B4;C1vfcz{wU~OJZZ+w`iJP-(mfPt+@5tlT@~HL*@C0
z&K8~I&HPatlH*!%$l!+E%;->&%oTy>i_2CQy?(rDeeX5%0=G{)Q)^wHuw0Hl{P8e5
zS9p~)Kijq=r`D=Un$BFKv~t<J9i5Y=io{pMSLyd}%2Z_A;rSs%ch3JD1Gj%KJ)U!Q
z%DlF{xT4$i>uR0L@A~d6eSbJqWZ(NqQ)k_b-JkPdb6@`w{;glv%+twP{>t?7CzE(P
ziP<mtY`lNfcG>-5u@V;iwygcs+%T2~kF`GxgR*l^&AiaYo-|d~gGa*nP0tOZBaN%x
zt>{%!y#F|tLACGuLB~>!r;}V6RhkYhP*&)85|HC*H2t7dSi>KYD-WbQ*46NE<Sqzo
z?+ev@JMoZ0muT;7k6d$xnN3Tdbw5*X;+5HQeNm!iWXJdNwc=~!%<g^2Q+0f;V83UZ
z)H6TLiir4cEYoA`zIryzRr&E{Us0TN<c|o0`C>hei*DbXZ~f7d*{c6vVer#HhR3xY
zi<ey9Bs#ewy!U;iob8Oct=DTGI-Z*Ia?5$u+O9tae->>tn0JhO-Rj2%{bu*KUT)sv
zpMEuE`DMqXNy>7L4NMolNME|X+Q$F$$A#xz+#M8M4(xr+EUDO)eLbpR)zgM8E0nJ=
z1wByWN=jDU==g!{#>Gbuddp5P*gpB*ZMGoZYwqToFTKp1f9l1d`JLB$zViN4=e?aD
zJn2D9(pLK^s}j!VZ|QGKwYPE7@p)`|#>`XER9$J_561Y<wM#r~A4gO(y<l^_edm<a
zQNdZiIUcWX3fic7f_bZKjz^Th<pUEQNz9OA*?q}QkHJuKd-5fD{%)z-6KylsO<WZC
zSo3#$(Z8?UXMW%7?cd-aFMZ&!gxc$p^)(3-Oul@U)m>8E!p_<M&DxWHBJW}rYf~ko
zJtj|P%7v|xY*_WKs6X$rkd}{is!83PLLK>;<<~rSPx;YWa-TPm<B77_E&uo8+dq7G
zygFIuBwyep?__CK#q}Jv-%O8BbvxT4*~DB|)+O@vdQ4kRhBZ_2uPtv=d}p2wRgMpw
zQW+%pAXCHqO0U*Et=TSS4${lI_Ur2%UAz2mnZSPb`Q?9pEc!m<=l-vG-aCw|3>JId
zy*jy5NbcDEmAo!aZ5Nf(#H`+@xI|@dlINZAeIncc;D0P1&s9rIh>Lr$^m56ED~)I3
zr6aHC>$k<vVq4;>6FzrtQN!klvu*K@-foEa*ud?mTlN0<Rt^3WHCsPtuKPS~&Eiu}
zw73{|ayzc%dr@;KM*mhYH>b2s&BCYbd{tZHw=-V+F-hWH`!7{fU$K=5D_^89HT@uG
zXuqKBa@qcF;oq@7(KTjoXHQIcwkZFvRKC8|ZKE9<7JlBSKg~bt_U!DNpR;_c5ANxi
z)xqYrBk7%lqQHSk%MCrQ%x~%Z*i>~`aq1l9smqHiKbAlJ^vFa{I?l&2C9?O75Z~L|
zGaW=k^_#ESwx9mAQKPX;BU<=L&sxS^4l0aAO^Rof&-qN1z2guSy**k$j{VK&4MKsF
zx{f;SxgzD~f9+G_e4m@m28R?Bm!3G&A^Y^>>-&mpF0b3T&^4pq^Q6&QOK#h<`+o7S
z{@1&$`$*hvj!Qn}DdHI$mb!&(Sun5S=**BqZI;_6InC(%nbT#qL)Iv#YMHIJ)wM0V
zv)x^uz81OYUM!@xo1@Njwv0)w%=bM1Snc#VF~J>vGvm%XT}jb1nW?XK{!HqHsz2*~
zhU}{ld4J~Bf(6I8b1$E5jO|*mOg6#v!qUgNi<~BxDI7m{Pf=#0muBv!f>TO!{vUn#
z!he3xmbIMi-M?+LmfW^%pHU~oefzBZ0mt7yNgQWFES_1WJX%$=w9<N#e}=R2>{TCf
zJPfl_4fbd?UkWm@T3Rff?BMZZqGbK6iN4-krISwn-NoIhb;y6pT!XMiW*4h(E-_cz
zBhntIr=Pfg>qeT+8p-zO$|vq<MAUDURxi59?7mm_%xw|*xpihI8`vH%c^D<R^_K3g
z6$@N1_OUdDKIpEWlR0}q=elZ@(m$!4Tf){Kc0b<|W^wtHmvL<tqwi`*`^401T}7qq
zUx%zYsS<MK+P(EB*L%v>zUu!RUL;pJ^8({s*BfT>tBogkPO0HAIc3CI*)^d!lmC~8
zukg-EUaSRL?rpyW7uOt<Zl5WdsuuOLs_4y!t=iR5{qe62`_4b~&FIY$II6JJ#qDHF
z=$VSNxrUjF_Lrad>NlxzEv(ykOHR^Nee2rhwf>wU%Yz==wPehFo_zb0Kx}+!%Yv=@
zL)RT$=GFfA<~7fMeQwr5j(2226w413wVw91)oJhFS9rR{R5xz^dAX(2c@IdKC-_Bs
zuZqZwsdM*<(ml=QQKZz(xh{C6{MCC~tx_&jeapVIp}|j|MQ(%DohLqbJTkR7_OYE>
zBJ83nqg}_h*dd79=nTisgy_vpp{Dn5G%HCtOwxUJnBh|EDd|Y7W398#{j!k%<}zQP
zgI(19Npjcmun1q4_ZPZ^-`(omdjINbu8PJs<&~G8Z+f2lJXBvcv?gHIR5SBm@-Lfg
z(yKns*tPR=-}UVI-@Y0y%T4Fjk1{&g>=<0Ts-AJzy;Qq@XSt`>eJ|5Av-e#z)mnD>
zZH*ln6V>)<YoG6}$$MH>;5~I$(tWPXKX$Qq<<Gy3e7VT1ZtG2n4YyuDduNu=b$=pH
z$xfNu`}^+5OrM_4^3<nByL8#skV&TueQJ_;ou;gLG|B(snwgJVN@`0ot4ui7Z9SWv
zp^{Lz>yo<o1-V?it(xn4>gLW<v#W8wy1u_5Z*S;=2M=B)D_iAletz|RLPx0BnkBy<
z9d*9on0mJ3P4J~#&T~wP?&vJc-qF{aeL<XCBaHvRLcO1#R_S~0DqntpOEYzWpq}6I
z<}LRo*+#piSm?>>u`{PkT)k<5@Vtk5RTZ1{uB@E3OzzbCUn1oNd54dz=RZ1akD7Fy
zQl9rUo4+f}`TxBCG(A;neeCjeyD#%OelKdPvb2A_`T8}HsHp;PpP7rcES38@Lzdax
zB7}7Y`!2qnjuGNUG7~@TbaJUSFSknAD)pqBxhA%I-{RNaJIafBe_0+7&Y0OWTW+JO
zh}&b{cV28O6nBIiXlLvFW%u6q?_8s+&X+bygtbS#&-ZH3jcB`StJ7>}zA-rAc*N-`
zX7aB!cvRVyxgI(>u=$>q`r`A~`5bHNYNO@LJ~GC|ziDPZXck<gS(+<;m4QL;2>XWl
z4dxXZb&jfxysJJr8ZCLUA@EPx>%C1MmCsiF|HoQf@q6?C+Fds<EZ!~o`_}IJtNvwd
zIH=XaFnOzI)}<Gd3~rk`eDP>xt-X`=){UiKb=k%hy>Hj=+_GtNbN%8o=e4vOd&>iB
zGQ5R&6K>5=xaJ%jZ*DvFlcoxL=*Qh63y-UB+~L}v$aj3@JcqoLW!pa(e-gIT*>V2!
z>Kn^zg)XvfjhpvfrN(vsLFT3F#7zXvB$WEIwNF0tecf2jT-clGxsYu_=j#bK7slUN
zx%l(~#xhRhV+YuN&Gv27J@jp(Xl>hhkE~gD@05yq@T9CQ<=lKu=BJIVz1N|T#SAm{
zfB&>@@~Q<4OU)LnF1=y>-e||3yv2%A25jL%UaOV|E-t96F}}W3@63z5$*lL)Vzx5G
zg#UVR$5p-XU$@BbEj=rHp2l5M+pucoF{`6$UFQ?hl~$<-#>8(~?xZ(2=-HFbCGDBp
zU6!ukYH*Y;kg8*t)UmHru|Smlb=j(zz-<aTkAEa&&(yJ&eI(Vc^upOAAi%=#wSe)>
z{8)L{#>gewFIKElKEXP@tn$(B5`K1um2uNIovzbrkda(}&zq%Squ!xI4!icXFFNZh
z`Gk?>{*})xCmT<Hwk%#AC^R+NhV4n)hYiL}Rw~-Txz46sS0<iJkQV(Y>Aq`5`-x9e
zYzlYlnlh`f^@^_hzRI}mt|eEF=40`olm5w5)AnfWV)OK{yXqNUur4cXdeU}pSA{oL
zQ@(Vt-+$MCd*!!;%?F=<FW6&uLxbb?@7pGO!<PgvDcajS@$wlFX%45a4-QLp2S$s9
ziM>*mZePmx$kuP|`M3Eg8~<?>TO_P_aoM!?0)zaEwpAA5i;jkge&cOzXD*vG?ct7v
zPi&=)?8?4&9Qn=WeJ*yr{nCvucAZp^EOuGb-Mxs#k^jpz*&OS~Dkn7CYI+`D7GJH~
zcZ+A0LwH<-@-1Npq1Ohdem*&WY(?#}b1P0ve}5z3rH7RL3v1q~Pq!3^XZiY{JQl|I
ziNTP|w)7vLp;7p2N7e6@UZ<u{_{Tl@+_Tzu;(1#q%k*&ewr8Z9tup^RX`>jYtSisu
z2R~|BJg$0KUwVA-OM%zR4u^<Gsmu6d>>8_%tJOt6T`v6b*;moiAzn{~cTJnLEH*Or
z+>2M*>M1ENC;Beg{Ce?~qv6-{|7lj7Hkdn)YX{GnjZu%cKZ|XgyR7YR<B2!rJpVE!
zcnhcKMZI|Q%{1oxoG06M-8_7tK~GdMi`$7I%+0Rm`r#~tsrP~`t_t#MZO(lie_Ae3
zXz!<zv@Pr6mt4AQv8?Lft6xqVd>+m|?J`wT_5IUbR=Js1eyplr|08bl)~h|jA&b_C
zzcqDKzwo+;ZTA(PXD>r0>V*qRCH!dkUnU}9>mv1#we?u(Tp`Y6X>Hw>oYz{Bhvw7>
zA1pm%WD&e7sX#9LWt0_jlf%NEnY&j<b6(yodt>@Zy$*}n{-u8;7e;xyo->STDq-{e
z9{BCigN9PGJFN}g=Z(zk*Z$U7VQP5&j<V6Eh_9+iKbj++X{tTwG~crJMxdDJD$B|<
zDRLi=1_el1I~vKSi(la7{n)*($0W$1U0qRNiBhHSj#btBRi#7K-sC9yWFK44BD#M6
zuD^Xx++4FWpQL?zvq6RXNGYdf;Iq1WtIef!)!DU@j{iw1Sbrke@#75kPx+ZAjHE6f
zWSg5+XmU!`us6nU=aS^Y_mO(*zOve$-s8#rf7|N37i#?bIcFL6tUtco==P!$SDya-
z$#!g4Ow#A_=XYjZ_pP@*zd+&n|FVzI_2<jlKe^q`x_Zauz+3eluFrD{XPzy8xl3h(
ze|Z!88ml;MJ$sE9FV@@FzJFS9r!m+{?(~<R9rJ4vT<te{|B)yz{`j<5E9J`!cGr97
zOJ8k0GJCmQipI5RqG24<>t|nQ{#KcInafP(OYh>P#hvTh>YrZ{dZJw3p)~Kn@g2`z
zemS`=di!+AJyKgQ@2~rKWxjK4pU|sCH$PTQF8Fa{s#zzqV)*?TeC%EKR*QtZ-gEPg
z^3>Pom&N>(TdBiW^5?|yXw$j--PxFT`!&w7^pIUw<*T^C>ek|Vd+|PZb&FcttSN79
zMseLOUh>6s=^{2CvB0KGi^YP!J{iTaa|@*&TKZ;h-`qPrmW|Rq>aQMe+vspLBrMi!
z^K+@CF?~-@vvaMVHg8+}H!n~1j)#k!_T;U~clO@7HMIC!>Z<ZH6V~k&d;U(S$U|7!
zgXv7_Bc*9J-+yX{r+;v~(DQT8t5crr3_QPnbA?ReZ+EQMQGB|2Pc>(bkhtL8kfI76
z_XYih4j;PaeK~R`K<t>Br0EBn^}8w-dOxZ0i?5H$o^^@u_jbFT(Rw%U&-mszCrq6A
zW!sLETAW{aHNstPF4eGHK2>3fi|Mje8rKD*mKCm?8uXZP*Q%ATek_a<Px~xWGjH}p
z>koaw_HELem&xR$Ea?2ue@OKByosAwE-#r=7Rwh?G3}MKKIh!eM`h!-CYxN<eO_{D
z?hNU!noXzIO`TH}`S66XuaCU;-<slm!Do%Fd0XEex|aI;?kn@WuudVD9T%5X3vpVW
zyYp&EZ1?l~Pa2EWcI~&lVfA?bgNwVIb~Q7uef8kwtF5g|(soEXF26eMwCjs)6ZdU)
zueWLu;g$Z>=(M!MduG>K$)lMo8l6R!?0dZY{rAwW1@Bo4eMKHeHeGOg@xGS3Ks+fU
zOSE8~L~&I4f@+s!?WM7GkGWheZhfnD{pk0H^TYI;C4MV*6|R#rez3cPVP|Ay?TmcM
zE6f><|F_;-5-<BYdKK4(=K>P7GSi=~jdBqdnX&Yk(E8;vyS7AlGAz3l>nC|qDLnN(
z^Y)$B(|q20+~%LV>DX1F>rzg~x1L(Q%Cl(2+1V3q*5t1{|0^^(FWYE#X<YY*%ahAu
z7ViCdXi4{+mZioa^Rrh^o+I`5#>Knp|C1*_n9Tff|DvG%t70$b$i?<JT5jJm_vKvM
ziDu5BEQudJoQjh!tCn0;rFzf&x3F!=+odeh;*#g?Ev=3-zI;sVk>#2j&24v{o!ENy
z!6&!L*Mrr%{TNp=-##HOqG-I~fHBt#d7pXjj-=KHoO?2P`sPHz%wN9D)|Gjh?AKR?
z=WWY)8q7Oy#mB>IzYEV@vp@fz>fGq})hA@-8(&5#ADHf)eO>D3!&Qqqj%-Oh@};-<
z*4c;l3odzl<^TI|YG%06aj(`hXUqN_OxO@5@4M(yz}-dR2ABQx=5=nD%8WSAv^~nm
z@6snG=`>pb_uG@aosasJuku<M<lK{OboQdpK@;2Bm~;>0r@2dlP3N>fYgX=A+H&^Y
znw1+Dio0)8jr-%?oKySo$h&jKM&CU5z2JB!vuWk|%v$f5v$LdA{uh1vkGjunUe)g>
znhFdIcN-ZPq|o-66_+Lz6y;~7CYKcJ6;xie{ab$9Y|{SU>k}ruUOdI4Wb@wJZ-4n!
zpM9D<dwb?A@#VYApZ}8ZYEdy0S^4R3-|Of9|2|`8U=)~=qJH=7tF3)5Ld^%yBpAdq
zOb^}3`KaQiS+43MixXzIH)S;~(Kw}+xoOji{=R8Hd}f)PRPuinb>)>}ZKlv3olVcy
zdzPxapHi?g@A>UjF&(?Y!Y5~K^<5S9;{MmrjVHXmZjKCB^4y%XR8QyB+o`|e*56h;
zEjiUSQs>qxAy;9;d!<KmMU&pYxITN+nfdi1-P<&^^LF^oDxG)sYI6RA<?sGvaoaL`
z9kj01TsbXr-NwJFw=em#iE1j$-V<}u+w<;<)%xAbv|g``P~d#nzGB<dhW(#T_O3X6
z=)jZbX2QOEPR;WC@O(|>ze2@rHwuLIXl`HB@j69Q?O^$h6FbUhie^?u9(Q<JBpE(?
znUK?={c9%a{tcAvx##rwk5kCx2l)jz8$La`y86f6|9dLytSq_M?2c@a=-3`{Ja?*p
zQyKRfal<kJWnZ;}To=~6=m`n*f4msDjpv>#hiTofx1X2SSN{BUUY%v`hUB2*kCK(U
zq*Q%AFV>n}6!^^j?&iM}_jroQPnuexHcj$`jLGxm{<nWhyKG+7JX36o#ydTG#jrUq
zqy1Nf?q(Exbo)6^>k`X=?XM;t%BWe?89Y6At3YPhT$a+{m#1BKcP`!0{Y&LU*RpI!
z;fLxISa*EXtD1WCtfYzUb$$lN4ZWP_GMI}uM<g6x?m18WbIhE%bN!nvIm+1?-%Xib
z7<NVB?Np0}yPtK`DYTV7zI4B*F*J$q&g9(P-CHx-9xPO`{k{Hfz;xAs)$CJPS=qnp
zL<^XzefaBHnELVI%P1YYDY=_>x9?=GjZ<ai$eNhLa`{Tbk3}p;H$=Q=+o54Tdx=MG
zTf-fTJH`k0Wv;#|_p0e!RNB>J2TirbDra|9FnUzpP)n6v9<f)tX4Bng;d~#gc3v>}
zs?+a(e{btcj>#%>SQ5Vk&lFXz6;8|3n#QPg-eRTL>o-mp{;YFfVd?LY*z`hm4eyiI
zLW94;0?$HB(tmuOGm(k6q2Hx+cTAdmv*Z`?MmApSDf*k!)=tU#vj65c)<52V8R9}M
z+(LQEMdj3|m2H~PyfG$wPSazB?hi(v<d^E7XgH;|L_>R8DqoIFZ$8J06WI?JsD{?J
z+?rmXRPtbzn|g)7oYd7!Pc#LNE;^F>`j45$trwCLB-JByZmrtTC?mTuWRF(3cA(+0
z6YDJ8d?k)Aj(T$1^TL5cbC3H5)hF1x{Hcr;J0|h*poYG<JcIt;S8nSc9LmVCPhmKm
zzB~R~vO(%L%Qg8c>%MsZZd|3y74l0+S4@14+XsydiS4(mVz*UFb#rA-OK)|k<n8}5
zVR~is`piA^E;hdS*?7Zf%i0DD<^Pj~6SAzh>sc(f+>&XLVLWy;f%VpAxkEu_F>U!z
zn$-_(?Vo0@pm$wQKhKFbeR55Y<E@E(DN3$8M4FdwJjqqD>s+1SV#5PxZu9DFxy&FZ
zn|S^14wY=3-V4uf-cZqJnpl4P;Nl0XANX_e&ORcW@$>B)mxb26b@hC{hc&vKrmKB9
zudLu}uxlD`{;|8kyCsj;XK$R_y0E|Zu+E>4k01ZM8PDT(%|KV$a`lO87qh$C=Pxn;
za>VLocdzR?4bRIH+g=J9xpy3s4bv=n?aFm5Zr!8#(HFV)1~rOaYciR;aH`ba-`PF8
zm~%Pyteke|^X{Iu^aZ^ZtBhmR)ep9N{}DHhZVx)YM`g}~{}-L}zI;$L{~U05S*)tr
z)7BfFcHxS)vsnB26+c}xzqL}bbAGzMP=xfcp!fS&Ri@lK8_Dh+dq(TGOQmD_sT<Ek
z89&;5ys`F*N6zURMrz)hPCH7sRLwPaG3wi%diMsGywqww+c`A?dn$h3zi(^LId7_?
zlU}HSc=wXEt$D00OZ68QPPnS^wKrm0<p#mCyL=KGJ*1d#HN`kLFy8+Zvm|GE{;fSH
z8y*!|u2inxC%8IAU-XQri}E4+#aVkEpXAVR=6=d!bE@MFXOO?>4AJ5p;?2)5`|N7_
zVKd`QYUx&Ct)0S~-}&XQ?5ccGw>Wz1l%B4bVB4<bkb`Gr+54^i0$zN2vqzX|j`5ja
z?K#tS_3qwTa!8>qm!Z?2g-zwfsf!&v%ClOt#QJ&fGH-c#&3K8Myqr(_ir_hC#HuHm
zU7fnwr$g$9`^Bw`_b-fNv0T%~-D5WM!wa<~{1cZ5z0|0Q3r#H*I#iL+)qAAk&HLHQ
zc9ok%JuGXUY4OB3EZFRhgpTk#={bQnn~tYMa4MPoc~N5bDsA8Oy<E0FAx0}~v?SVJ
zc4|+U_*PzuXRG0j!?!LPsZ8gY{zYciRo?>^YzC_@OkOVf;Fj7|-gO_6#giSr#BT9$
zxW>k2y-{uE5ea+#8@evWOCp<hJ-WfL)|BUP!MbUxS$yqo84A3o)Er#jw)wKNX!A^P
zxFKr0Q|GqQ(Q`9f7HY?;@V;LaHbc2W?S=!h?5RQ>*8>kN4?ReB&2X;1SmE@0Uo+e8
zBO8J`x_!*H&+mVgJCAXS=7qn7`PcrMo{T<t`2>@8=TeR{>+14nZr5a&EeZa-TczDi
zI>KenLtW#E%O^94uY5V>LDPH1R#T6z)u*3mm8flU%&XQaXK}FJvY6qVO8JtooHKH#
zm|13@PZV_zF=%VKydbi>fhqYQe}4SK-ja^36Pe%2a_Vnb)wusE`z)(0*@dR&5zYVk
zlG)a(PU2m?Z$aL63D(VxUt3u1tzxcE7p>KPGx>tDmfw&3CHrr#{XY3a!OVl_`F2)z
zU9&zYsq+18E4zI&)0K(GlwF>k(bMnV;}f)0KGIruYm?9Br$YP6<oIpVe6p|Dq%Zsv
z+x|Q~zAUlTDdt$0{g1l`4z~%1{`=W;<hnsqwXvy+fGzjEy?H%m`6UTQr>xv`D(p$l
zs@-;~3*UXM%ssHBXU{t3%ZHe_^O@!)=1)AhzRzNJ;H!zRPHvHSxjkI$OM1tf>RG&N
z_dYW|x9U?=OxYwQRnH~rUf-TCXmdAP&TF~taD?0o|00vK>zM*{gRE31*vjtM=DU5C
zq!^1}#eq7BsL$=;)y@^Wo=PiU>=UY0yKs{EDs!0js^r}Nhi&{B<6VzvRNP!Jk>OnM
z+_NWr8MPW>)*0SSIUKWQauTcer9G`LwIjI2QyHR|ubyaMw5O*j|FrHdkDsD$@17la
zC?ylm$d)$kxt;~j+hyAheM`+tIpg}P`SD+_dyj8u*yo+tW$Ezd$nj-fVh=2;udz-3
z|EzTWv+p;a{hjB#RIm3lv-sD28y<IQ_3Ys^Sf_SY`KP6$Zu@CdpTwC*92G5(rHYH2
zu+Mm=-QIQK{?#Q5J9Nw1qE-uAPFTrw_E-0soNV?v*EtGq6jVvy>A(3(qs1e8iZ}QE
zO9%Az#itzaty$=E)3WAXLQAsM(nz)EGP8|M4zfL;djDQ(T&C#8Q?qvD%+6iil-cc@
z^)$#M{lIkL@T)KOyx^GSp}KGxM}wn#Lfaz?yXu;}@9Zq|r*FM+b>V&aXD5>v@Z|c6
zOT2GzHkYY$b7XnSbbh7JBq`rmCVPpjf}LVVR4zzK6l-3zR%zbE!%>xT;P>nU3*@D`
zI3+Azak96Bq}|OGeX1B*-szOnu;fH|K>ls6R?{8-cd0m@TzX`pN8-O1bt$hN^~t6y
zT5Z+MdRJg|chSVD>XD81{_kXq>#A@09@ErX{8H-p)ta0`#qCp1?Bn<`DcAk+ysqUF
z^Ed0Rx-POp{6fdo7Y@$Gp$_*Rmb-Rv%WOTNWh)i(i0{r$hF1>-g0CCZ$C^D-sj#1W
z=udtB64o6GH77jgOfGO<_I6orqw%|DkNf^7G#hs6_Z-o0_D;B(`JjmHis%a$Mb-Q7
z6)*lyX#Ol6;4f3)P&>1niI?G6{`rjznK!p=*rA^372<hv{?Yj}XI)+66~-CPpb<2!
zlIu(Gvh;vSYd-&)ejsbdCk_4LWfMKFWQ#QBp8hYy$v=hjjBU&FcP`P>r#pY<Q5Uyi
zN_d^JR5vL35tGw}IUf~HPCdl6dE?Gm3m?xkQIB7<Ut^!g!~eg!AHC^bV&N_mBL3i~
zNyfH0SG}xG`YujrzPq<*K|Ra$-+R^vuetipYk{kU(u0J1{k^Ue*4rM-{`0l``LfJo
z*Y{bKe-&K*F4Q6-@|{&+Vsx@?@*@B3FPS`#1}t8Zdn)+Jn>CESx9=Xv*Ppk)`d99s
zx1ZI|`)u;8KCmW5lI!Z-wb2t+TUH!Qn_pYRK6m<xXd_L>3$oeV3DaDIqx?0j`q<yp
z98gj)soEA~&!MR#_oU)}bDZ{xY{tsoLb0|elk%yp?2H%h#PO&F-N@$o$L`6ute}^T
z{rEl&l}U*wia8fMxW3Rj&~4;>@#C^4Lk8YcnRTK$35I@l9gJ%ad9P`YnRettM5NL+
z&#8RfOY-uh&xDvAT-ZC;?Q=r#m*=USN9I1cufNu2h3p|Kl~wyyEn`l+lAW*7<kF~r
z>%=D!(c14E8WQm<>YZ78D$jC1*y8dyz3ZZJ$%0oKg7<7Vbc$~cBZJA*7aYse)`;z{
zWcizMU9Q^j!QbNZ!dnvTrx!@|d{}u(K}EU1qolt3lVo#Zx%SeZ3%D8drsU695g-+L
zyR&CYK+K|L9!xVPUJ!S)z0j|DF>mW)R{k58m|pkPZb-SwQT9t@k(=Mv*o1`(Ge5t$
zxvVnLkL~7xhlTQ7lNa(kSsL6)QkTt7?ELeq#U<rm;1m_7JAG3&l?diMia7dLRr9vi
zajw9NZ!S!{aD7VB*HbRD9*YK;|Jl9o)`6ZgV!=EyzJ<MqU*C^eJui=^mfgc|*OkLL
z%jNHR&kN0)bIw}dHu3@Q56=rTUxnYia(qR=r2a42-zsw4jx05*j$HC+vAW~aw>y-@
zzqOl0bf$IPoX~mX;6mp3DJ!QO)>ydtz^bL+<P#Vj;=Vmv&hha&$NZp8u5DK<#d?1Q
ze$!hbwCF=y@^S9_vTaAtKU{bt?(%Im=e>s(+szjcxq8;R@5q#2_h)LoVs-vl+}*I^
z-Pbb5K<4JUO{?T(-hOWi<O|sL;-T`)*F2F=+djWZo3HL-(Xn&l*;f&zjVsgrZnnQ-
zWL_})o{9YS&$A^ay-0OFd;DYL%DZl_jXNcloqS+!^F*pyU%Hsp+tt~zeo@}tbLOeH
zp2fV?wo{9kvCWw8&#o=IjvO(1r*d-IObM<XQ9(Cm%gk9|?Ec;&u+~+gNV;I*lxM$8
zm_NBrN?bd`-0@uOMT`3EV~_KWn$MXgxgh`UV*Rymp8u6>dipsisr*IH-@87`wZxWN
zhZM|><4=C=cg^c;fqL1!uBF=(UMpm~@|hgdEX+^ynZT$R_bH&zN6XeDwf}nT>FTSz
zmmbX8|L#=xif+5*LdIqeU%#)gT%yP`?e?xcb57m-G_NN?C*N1<R7%iNz4p9~6Qey^
z<YRX{5S}G#wwPzp7n26o;5x>nvQ*YPlddVQ>DfQG<E~TjihcFfQHPV;Q%q-yWYiuv
zs+c3W&RBQ0{kN3sK07VWFfF+GNy{XwRF3uG|5)QU(*Bd4o-U3*6|#Mw$P_;p{_MD>
z09B(ojx$un53sM%?QIG!+I2}t+?ic&D|?tOtD1UXTWTKT<iuSCGkDjSa2+UEFJ16K
z%|Lw9QFeBTuHvu&yXA_LH*vpZwNGqgUi{%fitm$chqeYhlyIt6NLb`Lzu?IhXLl##
zuDhET?fLc3@k0|^v{(f1gN4sqUW;h%3N}tHFmRYEQ|mS@G0<J^#N6sRB2yloHF&hN
zHl<<CnhP!yYEEr9$H?q&d2wmjNkjQ_vYM8aJ+q?I+JXX`b*Im|v)})w&r1pR{|i6-
zx?Ibj(GsK;k{#gx;>`40h8D+UwjGi$NKfvJQeB-a|5`#vydcNmqwCSXH<?m9Ccl%s
zCLTKD^Q}DBAYTpU8EIb^t?jItqVjcP-d&U1zn=V%XxpCmd`I?!8J9vno1G5+SGA{=
zv-(fF{hxQM*=3LH_;r2#{(rwdzL&56d)#hawoXHP<^DSXGb?{^?7Mcn<m-=zoPQr|
z-DUUe>Ej=XH<+1@yf}QIn~SCXz4;x*7a6;i9e(6J%D8W6Www^>Jj=oJbJw=%EjqEw
zN&5SI#dR5_-?MKCEjt#@t@Mty`0AVcEK}J}rgDE_$<TYN(olY3^^Dt(bKiGFNnSit
z_omb0SvlW#CmD|PiIP`)@5Y<0&`c0JSFl*4Lg}qr*#eDe?OdFp>ET(;zs~SZ|9mfL
zQ+l&$>(`xMT-he^Z2xxo<nKt0UCkYTvzGNGc{+CTtu<Mibybvq&P$KflgvBrcF7;G
zVAo*t-Z{_nnA^uAi~)!4Iw`M>_AJwiKl&xiU{}e@{;36<SmMPN?I@EBGi)pi`)FfU
zIA!WZ@A?-{T}7=t8Gp8)=S@Aw>zc9tr4P%~u)96%GTU~a+i>>;Z-ZQmnZ%)cvOlG|
zqIT=DWtrM6mDJK{;udy(sCw$$m(U24=ydTzKF`Wd>g({oe4iG%zRhW+L;s>T;zz2L
zyl+mDZ%cg`6tdV*^V_jo2m0o-KbgNp^r`d#6}M!^u;hhJUQ(f7j0<PITqHf`^mNIZ
z-CEIGK0E1T?H8!rsd}AH<KpG&86RDQHz}-*6sbAYk^KJE<#44t%h^TZ*Y7Y<KY!6Q
zB4*j<MuqJ73mzGNKJb(Y?%lKCqWYgp=AqUzIMnv(E^BAB;&2VWwAc0A*P{=<Z9lB4
zJuiVNTj<D#lJY&=ex2N_<{y@2FiLK&tH0L48@@k-`Q)KHGsJ`b9^(=ZE;CThyFbtH
z+`XPoQU5P~tR@QoE1x&1Y`tQ=eJ-E#qcmq%v9S3%#q4iRF3u6Sl<@uB?!2ilT(!@r
z1cotZ^;PaQc4+QoSu>%;`SPh$<!|D#FCVK)o2@-0bvHD*z5TRRt4WjL=9p*e1a3>c
zUD3e)dcu}PoWi?&wut!_OCPS#xAB=I%f$EC?DxXPSyn6(I@!My7xKt4@r2&Y%Q#?F
zE%^PzKh5JMPwr_g{xNUSq#fB#k`wlGKD@En@tBmaMIlF1V=1rcm&lNm`}d0E1S^g{
zVDa&|rEfIlzl_o0HBqaZgHG(-JhiR-&NtV`^X4#VDVP12QTw{PFk$k>*z0?;BK|&0
z?b4S|ITiTeqJ{V>{qFe__I>U>8F0Sq(!s5b2YIU^c7NUavMl4DltKvaU7yLv)Z^P`
z?%_}W|BQF)aoYsNOS9#_^SwFO-FxfswYPn{y`8@Fg);H!z4#!pSANEq{i&P&f0(sR
zb$)Ky4z2=zXX$GUZ2dnSTtm)g6?coJ96dPu-<{toj~6{IEl{1s{6kl}=E|N49ghl~
ztNhcpzPi@B_P)aNU-Q&jw`QhA)GU8LulE1p-E*JGsO2lW<peG}^!P7>Px9kKf0s|1
z^6;y#hP#S^MU+pyplIv4*$v-svs^d7__yP`Ue7!B?>jr#xoy<L=3BE~7qMcVypTsi
zu$?dH*6!Qc_15cO<bC|J=P>JayS)7Cfr7URRTsP5lHT&3<*@RUS%R&1Vva87VvT&v
zwSMmp-u3DKST_sBNGf0Y*T^RlIs2k!RokPNZ<ouJvwz`XJ$&V3lkN40QsJ$x^F-xk
zIDT=c1>B1`<{a0O)%5wtiObV#GZwPupKh1AIQQNGtJKrgNr|U;c+SK}ER;NHdwfz=
z*!<&twgvOcy|aSueV-Op;h21A+Fi!_D{lo}y+3mIywKev5#grUdkXF(H6P|nx}kQe
z!Dh;<ns<jCL*C2TcD%Uzc)!raUOv0d7qWBCyOwM{C}=g++H~U*<~?#N`z~1C%9*`-
z-99}ozeF~!uvrT(%M{#Ra;SLcr#IsFwnUstVVv84CQR?Dd-2V<uARY=skH|dDg`O4
z9ld%&q(LLwrB!=(w8bjBe^UM%%6&AF^<6(k1Z-f6dmzW<-<dyu6@Sz9`}-e%KF7u9
z%W{k{eFo>hazCe1Zs+jbJ3QCj;9RlZOheu6iwk#Sh~|Y8L4~!}4;rl!dryo0SR=u6
z(DzAe(7VH-k^F0T7bXXPFMGXL&afnT%W-D@OPaE5^K_a|3z@5}TIgQm!uw}CgX58=
zhM!Z<oUO^pV0!FWC@sY|cj|_HMhd5b`nTjf|0$Xf$eFFaQC@e(pH0Q(|KyF{|25eA
zx%R%z`&;}WMLQXTHVL;Kb1{C*uzR8TQ@*GN?aQW#&sCIuA67EK`19}JS^aYI?Ps{U
zUM5s*@_2EiH)z$C$qVHkxcRUB<$Ff%D_dX0;l)BXx4k(RR@~$M|L4YMg069=vJao!
z+PPbL{nNIZGfkJ$idPn@S9HZqSR-U(!gDy~^2#?%nJ%}v7GLnl%I$Stke{ghyRYw_
z<l~F`1d|Rd)DiXZzVmr{W!?WfX%b(VZD;GQ$O)8PC#Pd6m~gwTBq!S=sgSAp-LIK`
z*|$>S9-jNU%=bf#=!A`XmL9qP_EgDFg*S?d_1Zh4pKz~zT4QDWYP*cd|9_8P`~0-H
zv3%<Uiwo;ZkM3cAohKd1e&xEs@`uZ8^nLUvEwoWuAMSBqe(ORGr!|R-l`NCCX<n^a
zFzfE|#?U=nuE)>(|DzGqnJ6@8;^&U(=kl8uSskC<_y68|ao?(n`Cr{$h$KC&NZYLz
zzvtwuS^jZuu7*Vi3)ft^&o+hS{jsgqFLIXLb>pwoIra5V^e!6%uW+7o$G7dgBfH4X
z*kF<J%Ds=53lyeXZEk#$+Us<!_{ZLpwvT`OX8e`m5s`kWbnmItKQ(H8eE5-QQO1_4
zvEuTRL(@+#K2<b%mE2a9{{Pd&8h&p0D>FACP<KXGM8`7)yRDu^FIY4re#e+a+&QrB
z!<$K~T-HUbOgv~Babn^7Wp6UB&(FxbyJFe2HL}?Ynti8C-1D;`Yj*vWl8y^4*&&aE
z=4oEJ{?I4UX8VkO>&X%RCLbCt#P^0OdIqoht;a2(|5dO3t>^bmLce=e`Vu!C6+T>g
zSTKxzh4{n+Ev!F0XPX<ZN&RM+sQc-y&XG!w=Z`<U3}3hDZMmbqn&H9s4f}XByDZnT
zRxNlD`6%#EMOV+m3_*v2gr6ebYnTpm@A%aG@%g^RkJKbi_W2v|TgW+mR$n(w<JQ@b
z{f$Q*q%tiQ_N65>yiqv6{lV{?g5P_K7Bchp@l9ayHA=ev`}B+Z|0HTH``9?$)BpKi
zomtOjv?TJN?sBcx$Oz`2j@Mo`Oiny9Z$k941&zB_d=PoN?$$!J>cEpTDx(%1dwH%X
z&7nC_M8aZzD}Q<7?^VaY?K<z#tE<~!^xyNv#>a==zhNxiTiwV%`xW!z2`9YI&yc?0
zp>k%OM)SlcvRh)SqVzs|vPeGr?0!9Kj@%QYtMlu$ig|sW>|CFznI%~vCM~p=RZb>N
zLBsG<_LO(?;)SkcBvf{(KKpv2MugvR{>Q}c6ARnYtiEqMQoQD@*xur`JEvZ0zr9$w
z^nh4s@1vC=GoFRN@Nd$cdx@ursjk)LP}brywG+XA3+pd8FNh1dxozR*8ULQ{e!l$v
ze!JS=UnKm`S*&Z^^m9w~4!diQ(k^s9eRd%8qUTgAf$d!)oj-rAI5{ikjML21iM%1r
z=cc?=KWXf2qs_=Cax65hO}#o>uuMxO!pCZ-oJd@)+N4QwaZLH@d-8X7{ooQ4shy^i
z$8~QJlY>efPj+mK3~S<t41*|XJ7EPYZoBJ>lTXg_-l^DXz@lF@_rb%iP>~)3^ZsSO
zKD-Gz{-Wm6n=2=)%MG6Fcr?>_Q`KA*lgumk7TYz|Z$D{uPus)Iafz{4?XP2Xzs}ju
z+!C^vA+~JmJ?2_TSN^+FU*_*l*njNPgd)#Ni_Zyb?&kU&BzjhwdvcmiQSiLye!(x^
zpKxe>P$#zPMq}E;&x_P<AGp9G;lJ>#sm0<CDTm&bRGXxg`5#{xc}xGmi?5xrIj5$4
zUwwb2Fqh3~+x&<q4gT;spTZQwAAkJjVq@*87|Na*UD)fi@l2RR&A;D<fr=aFcWz2r
z{8;g77{|_!LD#|_2;Yl2I^pZeYqL4`9Z=orp|zKV^@Yj1Srb1Q-dcNn#T%!D1@&|0
zRn2;J_3PWu@8|8Q`TOSQ?T7!qZeDJ`r}Fc+pD$n5P2=61QdU-{z0Nc4O}f<4$)>08
zozju*NC^*12-03TD`)0{uYW9AF2p{*;<!Y_g6pr;jjNZ$9?hAo#6Qb_)iHy2sx$nX
zPp|3;y}xSna;<&7x04q>Rw<Wpp6<h5)H~y$xwqlBeA`u%8QDMF=+MjvtDi37q1v1j
z_TfkPL;cp$eAid%BBAArSC{Q8p0Hiw+n&(;<^L>RI+V9>yuuYDyK+0<&$w<^Gpiq8
zF1eV0UaVyi&p1n>_D!Aor>3ro)f!zq<=>iqi@e;}?{i7kw`syR4)-nbH>}J~@@U&%
zmb!fF;4Rgs41G_(oV2~!S@p7Ac)g)={iXGfrq2$v>a5Z@C2>EFC3}J7H0CJ9!nQcS
zoPM6gTCK5<I^HVB+<tL1+OYSo?o9Kd>N8wfD(BVu-|k*)I4dcv=iqsknz9M(W@qGt
zHC`5}iv`SWiLAZ1+<N~rq4t$=%eFC_{ybziL&@Q@QmEYYuXP-;XS3tk0wjLq_ncTV
zbDQBkgEfXvIu7*&i-~-Fx+<|w)l=|8^@Xf8cW+#&FuG~<AnElX_UY$cisPngRWB%S
z(=3oVDSz_ik&m_xi#GZN<eiDL(9qzop55}exHyBS;n0utp60ys>wV2GNAw!ymug%*
zxl4V=&J%T=5~(W+^|K$cX*Iuo7FTK<`2NmK@wHP9Excc#761O*6Qh$-Rn0PcZT<G0
z_O<o&>;0Sb@Ll5`ox+Ke)_eAUxT{=pprXh8$&_I8!0l4zANlPSo=9IXJawU3cUM^R
zwb!e+)>w+X^PVzEb>HNT=k>Sud$4^B2$|9mA27|N_nlPvuamP4%nctc+8ut~n&-;Y
ziRTiG=YFuwWtesUn8l&%lZD)ZII3rqG3*xSDVmgZ{*Gy!frP5*zHY<c8Sf@7Rppt=
zSSx9mG}&R>ycO@%8e8`ZvCZ*1U|z)>7j~qpSov$JlJx=hH`BIST@$Onu|49@m0ES(
zGwWBbKHGPD(a9GLQdRZOJWgKMI%u`&qH~?(8qf0Ap$l%k`D7e*_ibU+U4w|VdN=n>
zo64%v_DlBEr=@m9;(YtxRbJt(TXf9womc6Li^W&>H)ZL_R=heU-RC+fx^MB?j|bj!
zZ<;vOd+U?Ookl;)*e~nvjY)rCDXCf>!aAv2b$$%9S>Zh09UG)Yx<0za+jLo6dH*PM
zM`_Md);C5gKTKV*xK}jZ_2PS}KS+0K@vQtBq400+qn2<6hDGs=48mv&3`$aqOF%0N
z_Ey(FHru4}W4}FX^7}s;OH<2s8_!hP7x>H~ul&*EyxZBk)px%B7OKIyY34K!UeBL}
zHGl8s+cF5~du_UW^X}rATU3QKM7SJ67Y3}j)pgGA-k)uM^`txZ2;FW^o_PJHity9C
zE$062*OPvie#%PLzNP={dumx}to!=-w||nQ|NT_6+AnsoI#9IIM9e%X>P&io<tkUJ
z+YM6Hfw3aNKh(9vEp67m(mM4iW7@Ot7cFM{xO6Vfzx-S4=8P#vb)<OIx~l@a4l0~V
z`@Cq)Vw3aTR%<satvB0o#%AsM<u?OFEgI+lNeb~<p5)?s_4LLc-<?)$uhe~)wK#3-
zjPu@sp|Ae_*|$>d*^k-xeLh7-^{>0?{j=CvF(U5l<xN7r%1h_>Z*ux8vwZ7{%`@wC
zKOOa{{m=Yj*}n5)m#t<`KguC+>XY`@9V@PEuQdB*ay8-E<t_6>ma>H|`?({d?qyME
z+0^C1f3ppz_`XoT9$dJ*{?6;?9;<E}&3%2}P5jkw%LESD-g8$MyUy$F+SqVz*{h3p
zb7pny5>c|8!8J$p`3G6;&M3Z=MH*HyDVH~X_IY9+8TlmQVx{qHvG7k9S7@yC{o0lG
zXunJ3L79sAp(cLp<;sS~Jufy_es>S#%llDl`atpqlh-t-maE#K!PjOaCLb$#74X`v
z`1qIa;)VS2rwz}1{Wx<)^~IGQ%Plg$XRP{Ww&=riuPe>Bb;O%rNiBH1<h^UXNTgi@
zXZY7eS$1c$zQ$hZ{`p`T)2vd_qR6=Etxmj&sXv!Uq^Ii75_>tLj#uqwh+ZGdvZJ9h
z&wV*$xns2}r}6Wa`KN;pmwfSjlKeG%x?THJUe(u3(-QjY=5`u+FOPK9E>BjT?ehHO
z&;K@-5^w(3Z1{ir;YI)5SMsY$_LUcDY0dZ_DDPE!V&O4Y9)ACV$f=x7-O(qH$S?lk
z7%BEt_|)l_pIW5UFMrWIYX4;Zr$=V>?8!e{qU@L5+!Ar+<5M=HOY{5eTwX5Hn=n_2
zyY(RBHP$;Oty}qcjQb0Ix*k>e^=x*>F)yR&2#@llEe-JpS{X0+EIH7zJ~-m&ft?!#
zHZ&v|%DOuXhR)ygGp1)UZ$@6hx6=<#KKSzB&*7IB|9zazEHOKOU!|1R{o3y#A!-*g
z4f`A>J!#<oU|!dE=b0EcQ_mWueX$_{d{4OcrPc8J`S<(hw(S4SCuq0haMt7(t26fN
zEx-NSZ~<3?x1rEYUWc7$Uu6q;x$?0HD5xHje*e8r`px|L`);#K#4C1~CowH%kMVnQ
zVP}bj=!tuaE|x|uQ&w;gW!|A(D9(851MiH_9EELlXE|)@PJ1z!=r<;W$a^)uVSIN?
z`^n*pj7fXHKi=JZF#r91UOO4tcmHduwsCVmiVeFezM)F&^U56!uWVI*Jym^B=D2y~
z=U4Bpu8w2*Uw8ZM#r5(pukZU)+OWUu-lz5X_a3d!|9|i8%3b&WG0(42zrVlsb6djR
z+TsQC_SAX{Ja~Wmo$8l|D^@JFX$>vYmNdU0rs8ho{eFo=N8O9$$?G2+KD}pYIVXo?
zg7RGMy;@csD{~6kqf}(#R;RE3IWzK~_Sbi-m;Jeab@Tq;Pxptt-<Nmlzq9S{_V|C&
zU*FAM_GkO6o7?MtzQ3~j{j5*buWrtZ|L6Yo-SK6A_El|rKfQkOy}g;I<X5D#*Zti7
zjN#NL>-8oR<3H{w+bhYzY+`ZO`q#?`Jn6TV^vJtiPfd@yQzpOt<!jRwO?QvacxGew
z-t`NM=$>gG_wkq(v1N-zX|Q%YxG8h3Uj1Fnk&E3LeZo`9=awDW74d45ba|tD-%*wd
zX0J1ah0&$EE`H;`C=emy?+`NmQ;FIF#if?22I<*`uS<jv#7>#3CptxEjpqISBu?XN
zy*=;NKbU#DZB3WA<5tJ3J58>zY5l4C@$Ap@gVhf{DKIh4Z2ytFM|$r&*N^8vl(YZ)
zr&TY%^wYtKe|ERm%X6|uq;0>sW8b@w-GQOgTi8Faw6=*XUH?M8?;OYRCAY3_ek68J
zN-A3E5?4s4miK4I!?LBNk(}>b?Taq%-?7)^_gU7NZpn;3g>9!!=LXgZJxvJF`Lrup
zxoYyXB9BMk+0&1^H-B#4{Q2{IfBtXx<{S-SlIYfI;o0T2B<RMMC3^46btiJ&+M2VO
z>A;1s<txh+8)MD(3NKmf`rm6gw_{f`Z|{xLbRqd?<_pgBFiLB*@38R*=-->s_^N6P
zv(7$|mlmD7y+7PsSe_KssTzBu>t2(@lHQ<DhwJ%{B|W~i5~>P0?heMa%54T2ez{Y0
zj#e0+3OFOs?l*10lQ-6rF4in`JH2#LSnl+RHOJ=&A6v~kO(scP#nR(@iOn)wm&&aR
z^u8vXJZRFwduWT+2VHLeDIXTdD5THe5}FbnXsWf@GGFDt{w$01<-hd{<@T>xceG^J
zU6FNhmvUG#nC}L(n`Lj<8v1)%ivPZ(qutM52x>4-D%@a}*7V}Y?b`~k1HwD24X&zd
zPT0U7B>c^FQ9skJ(38x6p8friVJO`tWUA8Q*u|9T5%k!zeL;}-SH-UA#G^|L5AL(-
zv=ZvP%dt@-Av<<r-$KQMc5JhodP~F4ou5{B@Qz?+Zb>%#{;*Q}Yx(o;dEc=PyTzeU
zx>qZ*&ohp}$fTM#=iZ?=0(&)<&JDI-m$l&f0zL85BH72D`3gQ|&FkS@qGYNtCHvQU
zhZk8kUknp(eOR5IP^z_7=|FE{y#(W&s~$Oz!!8_93G49mVf$0(dU^+A=xS~)*TXy^
zyQ-7b4jz72lwy=28n8%~;oD!gEf<e#UFwSHsN<Wfb!{1M#fRE`E8-9NasFGQAeZC*
z+Dzo>?(`nTRnG&fm``_KyJHp1$*Wx)D78c3aNr7){LGb-(tkx~oaoxNvzOzV;K|UY
zpm$s>w<;|8Z(N`Jvg}SkitpmqBPnwZzT@(!=-<(E%p#$6^RsEeE22`iTF%weo4wOy
zmfo=>2UV@)6C2)JCfNv^^0?pZKW`^9PkxQe{>L>{`4_S^mbuos`Z%uZ<0)T!<xbYL
zt9|AtE}ZY){wQNU_vb1f<FgL`WR~rBir>3g`~=JN3%h0raa;&*ygW5<R{uxsHPKTZ
zA7Ng8^y;cs=U+FrIk@tA*Ylm+@bmRnhNO$D6hCYW=#yM~c4-E$tKF`7OP?-3-y~pU
z%`13S=Ekxm$wEtxL{EFn^n&m5sX5I{G!8tT%KN|Lmw4vw9hnVMf>IpQw|{5nW(@eU
zZK;svnZ(T79BbCQ{fW8rsgiNae81&MQZLI2PKaIY+F5&;<6cKmL<l42*Ypz3wBjte
z)0(`Si#478r?vdsd&0#*%9eSq@TG6ACajBGbT~xW6CN$U{8VL?q;kmR1;5PRb1aKg
zZc@9fv{p88YnNM&q4#1osk2&9FE=ffvlT4YeD(UYN$fqNh*MHUyf1v`_KIEJa^&#b
z!ei?87vBHQa62AS`pZ*?*;<)dS)uvMq+^~JmhErfyLqLXcS-n)b15zPf-gVa<(l=k
zYVN^peYu+=64(CR+xv8Tpl!jCbHY>Ew{kBEHT7TZb#`Hvo?C^Kh1wabQ1d3o=BXM#
z9|zq@n9ULup0}|@)+Ed*^1)Y!y>Zj!_xQixbTg?f+I#0-1&)r~Qr<mHI_EN576o)q
zRk32;>gZy9^7_fuOP@?BIrA~!{$J77PY%BymPjr9w<5yiW5Cvjo{M~I+WO6=rY&2!
zyyvjy^_RNQEVFAWzO#$n+3IjgP>M0)T1t;tr%c+_vtOk-A6PF-<^8?9S~_D<Zh?w3
zd#IJ*veH#I1De-0i_MqlwZ3}v+d0*nC+waX&UAetJ$3ULrJVMaRS~=S|9|B0+I)n4
zTZ-(HFY9xUICit#s{bI`lV^IW;JOnROOL)>a_HqPyV54_?bv-XVutH(Z-WK*E;Y*d
z9`N(p`_}dFvg;qp!zDKbBrV}hy5wMF63@T)`pQfn&x^M@TdEkZ-Z;ay!uj;n9Lf4q
z>lY_+`7=IMkehm4Agp)ak}T=2yuudW&>O4f7^TRh++MiF-l$P6GIHV3jm=*d=jvVW
zjoa4~mz}YRRgWt{ce19<g!iHxddnRO%XgaeonN5G7CQG@_bO)okDd!QpSt&Db%$G~
z-1QUQi|==9{rvjj?ahb&?$z)4?v>ognrX6N_x{NW?&re0GNZaTvY16axwM^Oiz}nl
zEe+R(BTAg2o$~AZo-L8}Uz67T$E#=Ziw)Bb?9iAu^XVh4rM+vm==yOiT2(ze?Benq
ztJDQ6ZO-+dni6^~JM+)&q?*gO1+@0xUnaRCX21Hydt0=sE<R*oT)2|wz{PzF_lYXR
zzx;8Ffqm5prdv%1*Dbx_W_MI{q5tJKlV^NlTYtiFZ_~@QUwBo5P2xCM*JKzhpPMl2
z@U5kL85Fs5il2Yoez9iPiWzfardZZ2Qd=kU;>GV5Q#bBgsKL=(w?#L8`|MCot(mhW
z>x$g!6MhQx<Td4AH{~%ukTk<fa&~)id8qHBv^Ocs<#ud!|JNk;q~h@FMEREw*Ix9@
z5qj%5E$pkQs>qaFmPeZ}eLcCMg~fZ<`iXB@Ho87tI924X#M&dzkLUM!8vmJkKGtm2
z>x28nw@f)dxpso<iYc)%2dvn2+5fYeEPI(_;kS7A-4}VzMwXuqIt;@LHoSlFZPEq(
zXSz!JC9hN*I<;o$n*+=_?*(*yZ_Kl5Q2o}mHtyCPw{Ow1QL#C8Hs9ps7N2D~-*{=)
z=atKEzrRzm`-)>lS#y`pmeS5o#U`$Mx&O*;S$Vfm>!sG}l2FH={~gj7v509{Sr$I6
zO$ay|Qp0d{nR7mWK|r~APbn|gMNtF(2b~j>5|r1uw%(Kd|K;*Q&AIZDQ&Tu&esp)G
zo6O=3T-?6>!-^$`+TEYCFR%Xny#2q`g3S%80uB6krbX&L`SwyZf9{GyH-FB4%>SI>
zLFtak9*W;2KK`yKD)`cN{#w${sn4IjY+tPWGp6q8^W*y;EPfpS<ND8sznSx_ro}&A
z7QbBH??vywgYPc{Hia?$d8(fOo$vlb;XkMS`Rc4KZ`j*cEWS5m|IQ=r%3t54yyxkU
zN&em0((K2_!m$6u(*N>1PHej9bLBd#xAvTi3u63T-_6-6X<YjJy@gT4k-QbV7djpg
z(y}YnGMsDSK9^0R##=q<>;jeJ`@i%UdYw6E7j>ci<qydRf_+yTWVBw-lv`3JdQT&F
z@_}P=nz@U4tqRzR3Uu#uir)Njx-xUC((@%3`8xhFcK4flUWuHpbc~~UTj-RV^_*Eu
z79opwFPa{^X?plg=?fi>_YH2^uX-0?H&OY<*3`!lp$9Izwgh>}a@i+oY44VJ{3>&<
z>FTH*>~ojw_$uvr=3o@-lT|FbCmIsvF0pCzEa!g6*QVF9YonU+uloz#m#S=D^h=L-
zg|54VSP;We0lm@*bFb?CW6u8i(J+jORqo5m{v{UQl=KetU%B<Z?U~mi_Pv?QXJ?39
zjb{HFXgIqu$;M%^$_X)BRoNpur_SOw(LHMa=Yz9IIj`b!nY%lT>|KuUI#*f5vg^Q%
zC2I{+DyH~U2VDB{HTlYgnLWKlhvIV11sAeM+l2WBu3Oz}y;4w`jqlR?b-cVcZiK&_
zx}Y>E>~QC9mamHQEM`|+W}Dq`qj_JpPNVvRb#7S=&6W~dc=`=pCjV%3>nL=V?WvpS
zG|ORW&b^nj{wlM6Sm|PDBY%C>Dt1w=C#=F}7}RY|Z##Itk6C={!QXoiCw}vkc(a$4
z%_B~2Nz{eS|95`>CtLmV;`z(X2m24?N3a^iOgbg;oHZ(Z|Br~;o1XhZjybIP`0T?M
zhm|&AbI;kAFZ^;`cTG`YSZv&%PcJ_`GT6PxVrG1u&F@e3@pG<E7e9XV>CxGSf8W;0
zc)hq=FZIFy-dow73(D=(<R_myy87*Vz4(&C`FV<y&RmxITP`iJ>AG1}gM8QWclO=>
zu{l5H@8(ka^XlK`;*a~c>FtkU|Fxgb?>t|>txDp=Z2PR<>|pLpdkgFP)?W>ON9=u(
zm!Gd5zw4-D$*$IgIzr6<!V?R(d5Ca72t6Uwk?A11Y5nEhik36^E~Mn!9aBwPtM|lh
z$99L?SKW+tx28{h=JD%ft<`M4D^E-n7Vclh*>URNJr;fY1-d=u>I;rMyw;-jw#{&1
zA=Cc68HP7?*>k#8GlOc9!mc~_WPJNB_3cvkj|ob<1?679&`s4jVrLh%=dsOC&nHbs
zZo95tyzPBAFYiV}ng4rDekkQDe(X=PWSqwC+7rJ@MN2VFag$sY*JF0B7yBNsV_sgB
z+<qk{Sp22={mHCyOQc`y_`uM;WsSDU{j!LU<y*KT8IP&0sJoY*WR;fbGl|)4ox1OV
zd44HhHc7J_)45yaDmCGv>7DZjwpo4K7|Ac3UhZU@JZXDIj`jt<MQ^lX_^Nc8)Ha%!
zOWeI(bK$<cxhQwU{^AX+Jmne}1etupYkH1)?0=f2l5C*2%(lkk8FP$YmFrIZH_`&f
zUOjMop(5sg$ssoFf>`GZhPP}#J=CUJALHmQ`!N5&mXt*SYkRjoc(ADO!3=|(b1Ek%
zh~BDtR8n7h{;VDI9EZats|4S?J0``t(q7Mbsrgxfwwn*FZlnu$)<_>$ELoycxp0c`
z*M+NUe@&h;O>UW8wBSpf!<mM^j+jeweM#_i&rlM2tTC6NE2VpF*7W+o%Rv{u{G7f}
zl+{uq-*Ab_FUAXhwa#3;@Z|)9?#X!<WOdSW=BTA5cFYR%GBT=Y*}G?tVq2*0zpZYj
zx>M6P$m@uGKIbQq`-f#l1ot_WOSNpWQhaaXeml&ln&5fMfc3UPrBnKo9J8l$z1K`T
z7R|sWQDr<o^XLj^mKmpIv&8m^oca62?5M<p<9ToRFGMLbSaaEI;plC2SIG=g6HzJN
zWYVy9!jI`J8|Fo?X1N~o`WMG~Zd3jMrHzL>e@$Jm$-DnW3%|Uz*9R}(mgCBCPZT~n
z%sM4pe=>l>#!O_v_GLTQmo4Uxtf-OtdNaA{$HT)s%T<J2*PXr|`((q3*vOp6A9FsR
zJ1*ER;86GQP|S3#9kCh?-Uqtpe3~+U+quvNxx|~!TGfZcJT$d0r1ET?6s9KpLqj6I
zwEEZY`@Qeu*>}lD2=P9y|8?c4?#uZzcD)vwD_gQIc;8(2$@7*)G(1cEDro=A?(7^@
zYepl%l{e~ItS2v9cIy#q)zve*$}H1FgLijtH525U!nRcYO!0+n{r*8qZ7;8MUF@{@
z+}4!R-&;8Ka=vED_gw8*+Z%kC<LMEV&kNN8;_F`vetuOhlg7mI#xC{l$$j6S#%CvA
z$iJ2%5xIDO#LJi3ezTU&+wr0&ZE9li%`eNFrq!xgoY9^*_1gk<rQNO<ReTl;7F4+J
zOyy_%#^<<WZI0Wk`UCIFuRS$e75XyDEZRZZIb{7@v*>4!jY>BdK3((3Vcn^}wX2Wq
z-NbzM=sOXC<KA@)uRYgX&Tx{9PnE6}K6&l$-pz%P8*D9_=H|}5$NH_5<;oT*<(<{f
z8l=RO_+RT5=^f4vy&1COb8c<y@AVe~oNq1JeM6^o-OsBAI!kv?*tOlIF>r5gR^9%%
zqtouq7k4!g+<u8wK$gim%DIMvq3(@q_=WxK(wz&I?Ynlx_@hGjhw}{`4?REh{ZTC2
zYMWpb8*=?DXV>1w^z+=IQ`q98c-LJv5)a)feU#%%`ajY2?1xOAw>|u_;_|15FO}kX
zE23g}R~`NEa>7+Z16j>k&jVkZ>|CT-dSYvwxs<iE{G)%CUj55jP5iftnWi0$j+ky^
zY;{)UrP<~bhTZqqOmok*O|opeIM>$aC41D5t@SJK8@!*LlB=<L-!Ik&sfOZ}?o(g5
ze$=(vyy$k)wD_-&U2Sjv+g6zW)c&q1=Ykn*PW(4kzfj{~e$jS+6>}f&ZQ+%@ZPn?&
z+uNHrPd>a@`IFhMj>#<i{ADlir<gxG{nV}TY`=Wm-m0y}KeN))H;bF@kBi>FZ&Tgh
z+RK+e%$gn_?fO6Q@2_LOzP?>%lg_&2{JB2=i}vZCA3yqPzCO-%_LoP`%iG=AKfTm$
z@ZtAA@6Z2q^ZNQf>{D`P+ujn~SD4IuMkto+Z1Ahyu`c%}2B<&vy|Ivc@1qYYt19z)
z)QkgqzB8Zh)MZ;Hc!eoJc8i7R<yVtK1KEyv-3v-tUy%E%Z^jkor%8WK)x}>uddF(*
zVgB7*?^boU#;aPdcL-*lTj=6=IN+n?)TSdPX0tmB+2WUfw|%-R`@qRpFU)59r51iV
zwRh^b51D~ya%03k8(PY)sFRJDR^m3@WPPJXaAss)-_H_B6@&P8uF~mKxSm&Rth7D<
zDP~Ga{qD_izvI?l;$=2-WKL0-TJq&VwPQ2aT;nn(ZL8+SHSh28Hk5GM+HvnZvTE9b
zOWW5^b9myorTWPAX>3>WU+VPrz5U^(Yq^r`lGAI+wYl!=cRME3Ty|*cdi?cu^Oca<
zk}(GzZ>?sUWWQE|VRQ8>Gp1vliPw+2Y%JKKTV>9FZO79MO+6pC-@nYee#h3^+Me6P
zQkO;l**}+CO>tA?o&Aa3-l6(ykL>Q&7TK&EGiiPPkwT82A0}O0@o}%%(Wh%BEB&8z
zI?LwDv9x>r$(>h^8<nXiaV+mIw?5n*&vVABr;uY$%g-R`uRPbLh8+2B%3yeU&%Cv3
zlQTEZ)3lh9X|}}Ug1~L&2k*o_USJfFjbAkJ;+31{wZ&H1%+k5{^T(%yiQD?mKKWuU
z&lUFP!;ZfUrPBGk8KUpyxqfopvUy$N$@bgDN1HcRy9jo^h_$habK~!y=+@8mZOziM
zhuvM?<#m=tON1-9YG1n5XYbOwFXd6_5ug%f%C5S-sz>fvcaix2jkaQMPdcRjt~mL^
z`}3LDoqD%eSRyJcH#CPE3jbmMJBwMk-?NjohT(;*=JHY|`;&R*2}ciaNMLzhthBzt
zYF){dkKz|TPv>8CpeydNyV%?9=8yg7ZM~RZuxeJPotUYs$gB2UZND0HE^IuZAiwRa
zW!H<k89J$F0-ptQg%<yf;5E<NAd``Bv}vQM%iCvJHqoq%-rqjXm;1iR|9{o5^+%uG
zEcyBT+wZe_V%r*BGadLv)LgiO%BI$JGB1(f*;h0pUGJU9d-qTS&J}TeEgN3nk9+*g
zS9(dn<!`!1n)ehpr*On;aYtLHPP`bhWSy{R-L?;2_jLBU?@!w26P~*H=a+lCf|qw3
z`TWxAXm!@1?d$SfkM?SORPxj<N@#F3d3O8fOOeA|?iIU?cKI#pI8<}MT7$8xwo<;~
z$VK_;6|FC`D<rbq<~1wvotkNrQha!0;GUQ5`z-am{hsG;e3{dGrr-8VTC_gX^5s7k
z8dYdkFuXp$;vTmz*Krrk-69d&GG^q&W-xwZx<5s`r~Yo@%==Cgj1*PAUfKG6o#TnL
z!s_*RZmIW3&wZ-f9vgkp)9jbZ-rNiED~~+({88S)__|>F-a7W$C6g@Ie9MeF`9i?E
z@8FxPmlZM+I}Zp1D@OmFoTHoaWa6x7kEJFzM049?H#cp)8M<g;Wrp~)*&Ywx{StFr
z`g3izR)t{g*Hzgo`<~?m|8!n)YA1uK_dS<le*SN6JqmKxd2vf#ek=G<WU{NLuYa*G
zS5R`1YT8q~i8jv1!WZ0|@M+0A7l|&}b$9b?C8lW}U9jeaHc#(4!AsWj3<{rKd2Xnc
zE^}F7B4fypA`?4_v&a5DTOE4z`P~VNMK(w|lxI%STflZal%aXP{d!@Spv5n><F4Lm
z&U9RTo454Ls&_F{4+ffPK9g;|<Zbs&ZiDNA=WfUHF5P+Zz2dZw)D+(7GG~5l;9Br_
z&w92O?MyL?cz1DT&9puB>3U|O{h5MkBC{Ir9NWE3;{WvLjvW_UuTD>!mz+^Dk$+zG
zhlIO*6TeInWIXdTuV_NknORdqL`pSQJy4ZSwLie$7W_*4frYog^XI;``!uZ&O#Zl!
zC8Kx!(xbQUaxUup_(k{YUM1egS_@wo%G^EF)cL1JuKeoBq~rs6*$%d!%<mpsYPc^f
z+~@dQ&ZAc!-<T?q%J5$IG2^%9yLT2Jx!&`u$-wRqLwV{Ro_!O1pXzOs&C%bzuJ!rn
zIf<;#CnaYm<X!OL`g!0fABXyh?2m`J!`U}xJhk7%QZ#+*oR8OAS4Yk=K0o!R*Lpus
zA6MIIE79<^YBrN^vP$T)&thayT=piyWcU2vIahYB+uru!h{sKB2~I;9&x+Fh+kRi?
zym?;P`T5crDdn}Pta0uo>5o5#e3{;|^pgC}$b5_EMIUpzkC>VrezxWZkGH+TYp=#j
z>x5_gI?Hv~chW}3phk`Yvl5w!AuZ;j-uBvQcQ2>iXnChH`OZP^#WGI3u@P3)Pqf$E
z^D4f!_)cW_H1(d8T)iX_aencxgZ2{{3w4@GKjwI>zOiQGnt5xoUUmf68K!S6<gU-!
zSsH7r_eAmYbklp=<ZfT_nSFz8{^oW)0ks2Chuywy<Ko)AG+Kj=TW3T5_tMDq`VIGV
zbFYOT%zAKlTlTHh(zSMtVVchp)4rwuO*^Ap{`yb(PScC#a~EqjTvb2ZmoatIjiy=G
zjOL5Ku}=9=B-STytF?B@N{77d9WtGH9-nXgnK572;kxGgi?cth&8hjGyf3p~+i!`_
z*$}=bn`b=yYj831y|ezUOxYL9bziJAlz#I|H2J<EvtGl6n(&x~%g^;oFvb3QVv^_A
zmVbHknLB5?FZy;I`n7<Kf0e?8{>z6aPV7z+ocvhMrZQmVMWMf{`gzu|5qzyG4&Of}
z|GW6*|G7`uj29Y}??2d@V4e{?`L$wWTiR4f#>2<oPiW-S-gzkROM=OwTmR2kIq}}s
zI+#AqYl2={zrK9U=^M#+ZZTHc_;08RywkpI|Ie`8s$0KhH+!wNE8J|Yz;CjCmsP;z
zhaMSo9=vW@bAERH@5=A_@5}#}ZM*r{Jlwcy-FN9%CV8B8Z`L*}EmO5Co2_lV#P4uf
zY5Sx7s_WH5W&Zkh*F>h68kp9|l?Hr1G9gXt!vg<I|Cbq`7f<#*`S;4Y>r*a8-ja5>
zd$eucqm3KGglE@;Y_#D!a5m8_ax<qz)(>HyUs8G7&#VtP`=IRdp*q&wDX%+wmj8M4
zEH*f3LFbKF>$6S&Hy4$x)QR?M2owAg&ZQ{cDOPyIY}Zt8O_iRI$gTYqyJz^FOi}Rv
zV4!uUneE8K3@OQP^A$X<O--EN9{7LZ_Mazb=Y$l0+5b63f4{r^G4}2z!$s2XXWhAS
zZQ0dZcTB@K2DjWdaSgD2!r-r`aZ<@Q<I}|8kdOP8Evb66b#2pvS#MXT`y~qW`D*@n
zxM$j)wVF&eYc)UZ5DT7gWPd=+gH0Q!KAe25vpq9(VgKgJs}mJwom{nCsLj+=ed0U^
zma^jF;C)NJex2_t5W*Ir8q*h_GKXXHDvhT?ZYk@$C!SO4Dx7!q$-=1<e??tSHCrOm
zp>j8Mnmkje_*TBERn33DFG@T5Xs_{)W-Wu=WviW6Zqk^rHh5C#v*@2QBpg>A?hNMZ
z$mlnA|GFre>!!rgIdWXhj((v>-W$o*E}GRNa!qcj$V|D0zDt_NqTR(KBeu`j&=j=H
zi#=wE-8YV^p15A0h1-o@?CvSmJ$#Vc_4tbB!j!3h#opIlJju8)B1va!p|gTj?Xej<
z*SM`Z(p91Hojvb`<^-OVeqVI0+~XgJC?8Hd;d$4Z$!*I-o6SNqq8VzNg~ely>>l3@
zj@+`?D1V{ahPBM+y!NkWOJ|A?;Nb47%TD$=bjxY>x_z3<pCmo{ditIFRh7?2g@hh2
zlXvky=5v-m(j@Tm?yKT=cb)w3hMW6}TE>g5r~YOCcAO}*DtO_C+Ot2V3eJ+=zj|f=
zejD-FHCdaVF4KK<w%<SSR`~p8rjrHs&5b>uwP!wW4|8ieVsb-LvgUt4jiL+_OC^^-
z=gdDX+6<AO4S7n`{o?jr5#hSab+2hFPf=)rPuh&~$4tsGj|~OR@lW_4p7Ckd@iWW9
zpCnIK>11!c$z;5gTP%M1o4+$I{7=5zHs^%omC5Q|OGMigSpM*ATQvXN%s9(0GnTE{
z_3rkDBMauTY5Evuu27tA_v70m`-<GSZFlF%b!+lZaSA?l<8->Y2j|&WC1&yaePf^c
zn{;dE{uSH!Wqt;axx#C6x9drNkC|wDSey=QkBWKsXSb;AvsY5?tvC4-FW%#Lnxy=B
z3Tvuo(t#hMS<5U{oh~M^1hb3pN%HwNKXg;a!)sep4TAFvPd}4km8)JBk@P2FokWCJ
z)k&LM(R!jSF5%N2Ch@9?8^skG?R&xQ#bXtBU|(K~)6APk+xn;5O;qj>-?j6!s*aRB
z?`*!5Lk<kJyr=5V$H<;Fs))-8S|@E_?0w8X&!{^xy**en``?NytXIT^_g;@I<x6tA
zo6E%X`(mv#N9N1Vm4RK;+Ku9bIwIsaStnlI$T_cRb?Jkaj|xr`CKd`td<&Xr&AxoW
z;ZKo!c&GZu{9bhMeAt&{#_pL@Wv&<oiaw2>vUGOH^FpE8fRkbwPQ{GzX(u8cFFEHW
zxOAG$vID<0SKnWHxMSV@@QIJgR`gD<P-BrwD3B6XU$nGno5ZTCP90w=dV4IMis^Go
zH7~r9Tv|SBsnEVJ=S^?1tDou2og$*uFm;aLLF?<QXDxR9c;s8gU%S<&G0grsKI_h=
zo2IYdP;i*zzV!R8x5Bpy+bmgT@Tuui^{eVv6&EFzZJytpZu)Fivn~J2ZGv2jduF<8
zoKM@i;Dq$y>aI`!b&jY$|5eZYw(!`ysGJSK)|Ue(`ft*f*tl_5t>BCHi`>R~uY{+|
zs*2usGxiTp6l>V^(8T9`?P9$;3qJ1|UuUds)zad5^7k|28Rsoe6P&sa-p#R+XiN$$
zEqQG9DB*_d#qAdaG*1<Y*7<tbEPr(QgD~TtKaUGr*WQx;Efsp;gJi%YABELlRQ}A^
zCB)5Cf1M@zrfl`(+g59@9^1Y=)%tIS;PKZ#c-Fjm()Cxdw85<7M%}Wuo3;MpLNcun
zP8w~wnY8ZO@(-6iBHLfQo^blY>+6$tpP#VPY-z~OvZz-=lV*K;u}%4o($4v3VsdjT
z_USo>i&iLYOFa3XXJvNs;%VoFT4pOTPMLqMKbqyh|M?M{`X9v~m}-A|<;`c$p6%Oa
zyg77EZ*GQRy10O!Op9{kExQLx&awJL&q+-&o*_4Xd5B~DCedwOYhU=V9Z+7(s2cO+
zblT-dVLekF>w-I*vMz5rJ$uGOpCg~T@>d=8xIgRV%_5KE6`xX$*<bVF7due-ZY^_N
zvcc<JB8MiGKL4<w@kT)N+Q-GE+BbSUjawX#t}Zfr#SvK<*V1(D!4WC$2anGzn!0`R
z%#WFhQw@0{EiHb1h;!d(VQFh;f6u<o+`?Y&&3@;#aguEt?|DXEIm+?)@qG2?--{Dn
zj0$;=HaqI&u{WRN(3jchD{*=rc=^uJ_Oy%BXULXJ?`M2?efs>oUUsb$<#|UM1LWRu
z^Zi~CH8Dd)?pKtK@V#aIyOLMuyH50TOySym%*oI3e{Eyd5#6BcGw!}&we_i9Vq~zo
zg!$Ckxtnk7klRqweIVhR(d&t^U1DYT`$B#7*`}OM@Z@8Sy>vq9!GUM{Jm!o3c&6yV
z#+kvgUMl8BCC`Sn-QL^Vthi(OjcXOMMVF_XddStQe7fpspaYB2X@y`u8^7aolq~0N
zN{?A^BExLkt!YaZmXtg4+~D^<YsSvo7pM5WTt{z~ds*btHQ#mb);{3Znmakd;?^Fm
zo@IuWhAhdSPwOq)WBfZS>-PGs^D|N|v_9{QTd?f)oF&WjZoSfZrzcuzy)D&DQ(b4@
zzt_A9d)n$#(<~HJKFs+Q_n7_ks!oBVrLC70j~V(D8Pv5u3ZM1As&Te7L+$!4$9Y3<
znuX|^zcnpdP#L~$&%*6-5#h_;#Dq^W-I5X*)WQ{Ivb|(h(Iq=K<&2{{_0EYYY~ns+
zRqk1Qo%!!=PxBp@rMit~+*VhU`E+fC?2bg=kG0nsrumvU)waCRmhnBNq4#42kJQvP
znX`iq&GzR%ahg3Nhg0J@*IX&7%gp*VHk*<RA~zg9HdiEFi|g2_#PV&1L7TS5GJavq
zFcezlm}--L_(6;L^HnQV67rU;%;;xLDO)Q4$VTz(jntsy`(HSH647p+%JSox@>0V^
z*S&%dmy4LIw)B;Iec4*fZ1q!xS(5Rv#;?fiD7OzkrY}92Q*$KnL)4v?Z&@3%CtTcf
z@w!HX;??Sl`J3igJG8QgtYHnQaL}ziG)+RQpifLAmnUM^LbJ^$JUbu7mS3@Q$%u;%
znrXsTvTowMI}#JUG(~Qe&K6iZ-Ky04#ysU6tn%CKzAbIEn6%xg)a#!0^v_P_Yiwrj
zS;UqxBT_0UTi5XJ1_q6<moK(67QH_B^5D<*%ZvX$HfPuV!mRUl#p$Y(>=WX;@;5Bo
zHDBkegm&!Gt_RnR-z(l;U-N9GY3QuCzP52?Rk<zKS-dVyV0!Jh`P8)x(K!o5*}eBq
zsI+nao_TNLxtY5QHAI({$mcXCEzC2CeboDS?p^PmJ3U_yr*jH*Tz3#~eevU$h8Ks$
z<)8bC-G#S`tGzTjY$bd{R;^S!y)xdp_Da*Ptk5uD(cD(H440`Tmx|XG{EeErL0jZZ
zr%}k(B~LynaW)IpFf6K(Z?-#i|J2!%xuIEJYxTppv$OU|y2QV9=#)>ee0?Ig`@K%H
zZ`uoWrsY=N%i?#4sa|1oDe$X!HCO!#?_5{OWS?)>^ClR+^;jS!GcS3)-t5>usf6+e
zC*Q7pEMm0hN;vPnm+6w`3wdr%)z~@Px7M`j-hHvB>No5y<Jx%*CanCtW#2TX3u~`g
zG)66RRNs`D%w)2reyQ}tTO1y_EeF57ZLaFLSvo0a!k!xSIGvD^ANE?Wwo7Dd3UHNn
z+ty#a`C(ShPOUlOk+aoAxcL7b`XCjxvc2K$(W5>V8@wilWdtePrxq=DJ#|v0^sshW
z(aH<IC;b%XFuf2p$-|#hTIQ(aKDIu~)Qn44Zcmn*6Fw(F`0rhZ$r80r{izdmA|Lt)
zW=!Y_cj5iyU*@^!!cQKK2`)lL8vomEruw}%iMrUlZ^uSy+YbFz?w`+npC3_TzfksI
zMB$cAcb=B*D^J=Gk@N99r|7Ofzj*xC{!}!06TZ!_U)-wa%De2h$vM|noc6Syzf|Ms
z!W+Abnhh8~de1U!-{_V8<S3tYebmW4mwPzgvM-nKzgzKA;?d{*L9dKl*T}Y{_hi4>
z?#3i|yytcLm0W}6)gc;}O%+}&nR$P*^1X_4Y{%A_zc!s3dT2@m``U>-Zm9u<IvU;w
zPMO#ptSQ!B&RaJ{f2BOLs&|T6-Y#iTi(|QmIdA9e_FGm{{B&WISV`S!9_<^G0vH`%
z{$Ij3=|^+pyd$UVKPm=WUU)q3*kjIGbG2xOY*X*(UHe6hK7KOWRCTQ8%DRugdQx(9
zipyVyt(3c7y1eJ)#X|=LL)7Ni32%ED_dqd2{a?YC(-%Lkci&i?wD!@%l@S#ZclCoK
zXMMR9ymn{cwUQHU-y(RYb;ez+UbL<B;^DP9Io}%tDqVi6?EdJnUUi~e@_C0<m*=w;
z8?s9GJ>9cF+qdRsSlcS4{IZ@@snqaF$8~GfXUy@OpvRh2t`x-cVfmw~<_z9k+vfQa
zk5^oZ<mmb)*=qFkhRv7RlC@o&{2q$C)WxHXWSFPTnX1`&{gW!!*GPZX7a{7)R;ny6
zc<Z+I$%4%VB3cq>1yUwX{HGnc|NfE>2md>6;B}PWxqNkQ_$wPZ@n8QVE<KN%;PLHf
z_8!HJN35s+3anoCZ9&qkr;A@E=~zsaj4yhivBS+b$LY+ot+LC__9%1b9-p6if9csD
zv!o<1oWF4V!SvO=bM<EJJ)a(S{GV6q;**@QkKUGhoxEhsf6}{BJ>qWvX4Zwv6;4<x
zU#{II*Lx$ts?s2^QvcDDt7)}DN^Z)N*8W*J&EoT)SK9&@<oEmx_WdZzv47=PMS<m!
z#{&h*wRx9M%;{J+Z`zF4{d+Z2T==r@J4q#<V7oGJrtJianKrdbcmAH@b=<+QU4B=U
zX~10h7r+1ctt#mIc%gG~L;CcG8WT^<tx&&rcWH@t<0FpS5p1hoPH1YGKVg%&#<g{G
z41ZXyX#6N~p|Ci^|HJ(j|JB>KbX@wgkJo?J`E12qmpZoXQ8b!oyIMAA&wu+#*30E}
zoEf}k_V%vL_#f3{=i0VDsim&#CC3h1S&c>07sPzZS-(v5LdPH8T~<@3%FJ$JaFBH1
z*`oRF=5)nB(|@>#rIsD7oce0hME+kYDcZYk+`M~l=aR=&MLZ9(qa@@6O26HIeBXCT
zr!g=0z1h=ywoSNreft&F!k8bH?cq~*Ec|6YW7+117Ovk8#9z2oFjZ;ZQ@yXNlWiux
z^w=Hi=Fg=3?f1hM47xk2?e|$r{Q36pZo>cPmp31L$>>)3=EvKGhi(QiNND^l<TzLE
zVkj8ERez#!miUgM>Wd%bA`UF|RkPZ%kb!HSbXV=FyqPMq4K@WBPwe&j?(|HpOl_&T
z(gaUU9+lNyZ}a#6{k8k8?BN+Flf;&`%zU6I%b%kANAHxH?+wX=HcOZ19^w-D*ZNjh
zZ1t=E=KFRP_$BB+o?tIun=)m?!Ja!;Q;hcUE4b%IJ^tpQK6Uamq3$)lRUGdECS79=
z^tq$^E3AY`%S3IiE2B%ILfdzv(}JpReNVnJiR)RQD#6fG=-7R+>Cw#@ADbQ6O#BVR
ztXL;ZUhzP_XOZDsp1%tminfUU<tt9za7Zy@^W>_xoF<G{BducDe#e@fe)U*-kM`8{
zyf<HW?(qJ|mgKHtQPw?EqFVYQn}dW!!_>{|H6;bER-Ku;;M?Izr`gU%wyeH5!~NvV
zpR=!d$I9G4?z3~NO`Vd-(PDd!UQbt6p&3SeyJo4MxXg3cI{WJCjknyLxo5>4*51#1
zie=`lD>LRM_Qd)`u1!6;@dUd@dc(BJi!*O1n$3FKS2RV*bnVB#9!KUHm>l;DW86>^
zb0<l`Xv@5i=8JztZIsMwHia#=S;DYIV)4>op8p0pOV=I$u=LCOjLOwNjbfK&y$R(I
z*&aUa=XxLGfT<d<=5J}-cV6ohOPzyrW8{*@@0Y%O+Ai^zJ7G7I1>c&IOB#}lc3pXg
z?k?HW?{@xsQ(5VZ^Uc#550*wPWVSV5KPi8A)$ixIWz+rzPI={PDv>VyU}r~zkqY}O
zd)fI<Kb*<zQg%Kiu93K4&4V}Y*Z5D%TO^e&eq+7on~$fbcglpud6$2F&)ed4N^^Nt
z{_k_O$&#&ej?PfsIwMo>cYetXgE<BN<|bUYcu*p2x$OQaS*&y8+Yc<Vf2lrau9Wxe
zxtH9P<}6w~@$Z~pS2mjF<mLVAI^jFZ*~7%hYwtU*73?_;THkJjbWD*o{Jn^CUH<Nf
zq{-E1MCTu3xS4<O{TYVx5S~5>j*IeF;>_1)zh<*3S?-|Om=cx9U;cFGUbCqNEK|K#
zuIdfp+IhJ1(D9ygmnWZQ`n>LR+}vVK&2yS-w&vv=ej&NEb<*@*iwklyI%?*w=rvrq
zoi${NgmyxT__BomlRhM$d|NEZ=o%)THPb2H&{g-Q>055T3lHi$H+ifv@Ymr_S^SzO
z<ABLF(YZo%rDQt9Z`qwQ@?1D~wRn4e)1Da9H>=D_GOZtqN(SUfEEDaS@$6ejxa`VG
z*;VV!w&lrnch0`lzuYlF#Qe#&*H8BCYx~*0F~w-lzt&_EJr`9~Cf8LvJso+Tn)(KD
zc8RG*Pb=oslx@=5dcZnQ^5~|9K(CVzC#k=#ihK|vyR)L_<boR#)(3BJ9zOH)(3xO9
z?&Gt|6&JKR*!@zhN}W*dlkI*r^v<<6#qR69r+(XDdi>!ee(%`_-)=qeyK0);ym@o^
z`RZ=lTUgrL*k!R@oA)C5^ahVi-pdXJ*Pd;fu<XS)PZPO+52QBbubdkgvQ2Q-!mpQ#
z^K#Eh9}IYT=_KcW-V3g>iIwG>me?=&eu&*rf0a~wvcbaBuD=ghXP%6Y+4M5hIR3hI
zNK*SYhu^%)s<KRXcZc>!>~GPpJNr%N;qwnoIn27|eFBd@XG@nH&@<itCTWJr`3Do0
zi2lwzbN6@Rzjw7eqlz<c>i_&EaOu*At1%0I-0+pY(<JpJpI0I(JoxN4iFvw3Txv&)
zO?P<Q^t<=Og;OjluinD{+{M`6hk`i273gF{302NJqB!Tg(GIq^KDq5qPcG#yJ{Kix
zVt3x~>l#muc)_dThjpc!a!X%HZeEnW^+M_0xH;##|I5u4_qIN-73;ly`=Os-l>ROC
z4V83HmtDFuP&k(D>C8_CvbDPw<@5*fPF|R1@kaS!+6$LwM+N;}FHc!*Hp{#1mXz_N
z-xdvTCHnT5$5)#jp7tO{YX*aC%dJm5Qg7K_NzVz|%@|R@yuB{MLPB<HN5lJlFWOa7
zPCU5cC3?|Kv|&GA=#h9AQN@*yX3o)F^;O2^PH=vae9YsdzH8xIySS$8IGOPG#DmVv
zUPZg9|5;bPbc@Yl5qFf*G-Y7t`W_n@+h{b!_qghrKdTOC^zPs`c(tfmx5q6+=hTWF
zxn>C$V|MDSa=e&t^IG51-L!07gS3~iWkP0|UeXfLq~7*f`u8vGfBxnD$%nIN=p873
zcG5<=T>ozI+X>T8hn1*pIDDY&ROGRVvmM^<KV_)mx-jXBP~r=g)=GEPS6b5SpXK@+
zoF5*`lm0%@D5R*%-R@^cY=*1n;fc?_3#R#>6EC(`hz(S|arCEX`BHU5uXB9$R`wRP
z@;v*0+5K&q_}NSGZ{nVJOBPo-KGYE?NiEZ5=(W1t&7~1~?@=4)vkhFQX1X;T*KdD+
z?`Oy6*_vmz2z{Q~W)`ViSO0HY5<^PUyJDeNY55<uep+Qj&zo(xbFEBR?HTTD|Altn
zZY}(`dDot@^1nMwUzcy$Iyw5HTpOSM@|hZ$W(g~VY#yn3vojruX8QEvlbD*#vdh!r
zK6Ns`lu2Xt$!=;2JXk#Q=)|%;MY}$j=JV*<m9CceTVvYxHvID!v-V@6pI>hD7q{Fx
zJ!x7~iJzyIwcTfvjJ#)`|BE#XSDah;P9)N;qH|gUuj`S#r*0+InSUqmK3(qmG1HL$
z-b@Sav?(piyR1aCCa?IcJ#S0Fi<o_0fvSRSTKcX&KjK$!e$IAo?Sk3jj~899csz6Q
z48K6%-R*_#i7XdC9&cL2o3@p?{g2QBIjwNhXy*yeNxO2BHtS_SX`I<Ebh-V+OW7AE
z9E-NC*mq*%J@3_%=hvRQxq4fZAfJT$x#090Sr1-3Wn{fMea+h4QA?+`OqF(ZIm~%|
z@>!p}(;jckl5W%l<W9HWbK7QNtN4Xq&T{A7tPHPp>}s?Y2)X?^VWOet?FpHiCp}K@
zZu%;`eqpBNVM(85`?>B`eSclFYw!F&Pi-$ebhtkI@-j{h8`)l=v{~ghcNHezOiF2Z
zr=7}Rz4*qDqONBfv}>xKEGoF5bolQj@ta0kW;u?hwLe98_bo8-=$e>*KC9PUCGo*k
zi+^eRpY71H@tML^Zf54WB%|l(m$<eUYVTed$v)^cJpP3D@173-Z|CZlX_S7li&K5}
zZmJEl!xyDp9hOOR18)mv?o5c$e<NN}lN6W7e<$?8t}fG_rdd;VSy=dJ?|RC5REOV<
z<&v1`yb1rlet6+fF74TA$~Hwyg0Ve0Tk6Hu*&=$6{-=wtw?4CSbMf8C={?hZ?5%`y
zE;RZ&t+}iI-+hk?`}Xo!qX;9J4b%Judvk?WSiJv!Z?E+|`8hIk=G9yLEnHy2e8X+R
zf4jL}mnxeV6ns;NKKam~=n_+|>s%c{&-FWBu3*WSe8=zJ$HNX=ZfdOlxk{<w{iC|g
zW)6W|;t`&gr6-6=_|(U25ZiFVaPsPu<QW+)f3B|+yBzY&*RX--sK!wf;~u-dh8c-P
zLKS9_7x=hlE|c8)-)F<?3C@%LJzMP?_HoLdnT!4fd_3#y;(c$X#~IO^ow5cSyI8vo
z)l=FcXHCxAdHUEzC)YdjT{R`Wo$Hxb-&n1;{^%5jB{Niiu<uPQtGf7l{r-1R%T{a_
znUVA@{>58%kz;I);mcmE>{PaGaXqMc;pS_fWm`_Bd{eNQq{EXSlWdjh)|Rg7khx~x
z-!zLADb806LzXO`qsgMItpB2@drLOs%(J;RHh1lP3KFjP&3hi(+8)hconGy}m*4)-
z{{H4<t2WEYlH#v&iu|1~ceimDr(N`1v8TVAap~7}Ojh$2ruFm9JZF()%vJYVA*xkx
zcVpou?}QB<uS>cTog!qumzQ-udd566WsdQTujNV7`mcU^9eESvcxH~$c}L&B*UHOm
zbMCKie)D_kj(z{L1HPuLjH(oAv5{S9-r2{J^lI`m&87c8{jU46>g|&AxA;vS@`N1T
z^uQtNRDre37oJRps<ZaIzk~})*M@o*bnJ_{y1}tp+fUB1@bU7<4WEwsyftl5{v+`A
zM)_Q3=M}TFlHL}oL@FC^3JrhylGk}z&cki1!t{ztq%Z$_c!{q^^VJnu=1QjAvT*m!
zJQ<~pc`PzFb;D2Yd#dR<>({-1KOgSrV=`_MjGH#KMzqGPM}MZ=YKA@5|6VR{4t9=w
z{=-OAdzYf|W=Y9SncS-zW(D4h7M@rmsUH`+O~_22ZRvuLlD=;|YxzHT8SGglJy9q0
z!kR+?%(8dWE?neQcYJ)qtn>WTq9yAN*uVG{Kc&BSX3QPO?~^#TH9q;Z=R|6sY2_*B
z6Q|zPZa%V4a|Pq9ceCr4EPXC{BCNCfNB<YKr6S8CIJO42mwcOZG221+d|+gVT5pc~
z<*-jHu5G;XDr~QzVEG}*H4IvA2ZVM#W1q^lT{X|()CaZDSFd)3%y|4Lo%^_&5j*=;
z6{m(RM{>OO1to1+u=u`1?b3PIN>;XS$%|wRmJIs5k9YT3qw8Kv1fE@5r&*k$)jI#=
zwUZa_@;{DoFSgsY(k<0&J+rjXt__pSZ{9y)y>#R3yPdf=doQ@1o9D)Max&*E|J&;x
zoL{A#a&t@HnZlr3v#%&s$`sVP@$Xodw{+6>FLwDpy02efxFb6`;KP0IFUO=8zgE?n
zwWFB(ZtUWTTx;qN#4X*z{e5oIy&oUW7+bC9yU8r!T(qw0mer=p=+{Qs_UyqqQf*Hk
z@Ue&#JQseJ%bBzKsKMFw23qryo|t*_xlL8i@P2!F*A?#h=ik4HYm?|*wdtWv`O4JO
z3zm1!Z_HkGG3m_b`(gP_Jr|=MzS7GoUOmGt_FO}s=9v?F{k~3R_)$KOcW?6C9ovE&
z4GxQKXV`aAgH`vaZ=9UmRhBy!?zU@`E`6Y|VExUY176%^J+~@CcE34fwq3cW<9*SE
zExo!LqFYkszN@$g8EB~4CpoVBv0GVPV|9X>mb&(Y(n!(X80Ome&@#h<Z~DLU+<Rig
z!q3mxuw{viTEoVtSDn`$e#~-MeC^p{nJliPpXpU8vz7<0KTxWY7*O-NASSBq$xj`H
zhG$3O{1`>8;@3Zq`=VNDmiE)CulL$>V+*gS`C`#uUR>*&wC*uS%OCrXn??5umzJ2y
zt=bX&KimG$X>BFh#geIkm6L0pPD_sKn!P3>q?zk|^fhKSAHC@{a<#2-96#1xmI*j)
zcjRokV;`eNa(adGk$@Q~C6hW<d+H~?VM^PVV4o6gJ?U(Vlqvs7_I7(&$!Z<0Z2??4
z)B9u(<;7=DZnZAudK};p&)&IzQU9gB7k?t=dtR&iaZdN8K-(-f_eqN<o_^&Zb=S1|
z-?O*7zwYs?3zd>xY7qKQWkvKu290TL_dVBMliZZ6ap`pPqmZPs%ae51Wie$<eY|T&
z?<>JAM*Fp%J8l=9nP;<C)2Q@<PoAUEhuI;EN}C<0i@p_2=HFZS<V)l+x$s*|1+o_l
z<-UE^;!SxPW0j`cefmJ{JImdhv-=O;4=9x`)d)XfY!lhZ`0eHW=U0y<hreY0vF4Y-
zv)Y%s-@p7iVDUSnpt8#M!P?p%?<Gy8^)BV_Gn>xZ`+8D|;vqhZB#jDQ=J#i+`Bdk-
zNhBA2_dWhu)S~ssvP;dklkcpVnB$Zk;H~#nYMGY%?n5hINGUz-Zs-i!_b{44yJtFA
z$$_Vz&mP?0XSb(XJkOw{^U;SV3O&xN?N<s*#R#3+Y;x)30^w7EtInsfEM_o~x@8t4
zz3BquQtPg7j_bD8hrDbI@!_`)TIQSB6{Piezl7P$E1YG!tXkG^=Y+~c?l%11wC_!!
z@S5D}*$w;_CJz7e%<k4+I9s^qwt{e;NQm?Pl+>v0o6Ni``Ciw`9j=v|?fNY1-2UYT
zQ7P;18L;}?Te$MA#sU#3k6*E~ODz<p-%~jw{5q&RIVMrV+ji~jwrRPGbR4z?FMb)4
z`=j){@b_)qZye7*pX7Ub+Vq)QbB!`@BnTJH%DNX-!vA~DNzQd~R;IV43uBIV3N*gW
zJic$Q+EdThSGTI~xV7ffip22RgD>sZ%nmDhEx#+NHI=>OhwREH`M>6RZQQfQXL5(+
z`ZwFAF4|-39e22I-`lxXvDwwW(-wZPep1*RS!F(>>rOrQEv8$>cdEC3;Vb(bzGw^Q
zkG^@W87tJxu4nl*?QnDFv^lhdv*Dpx+TH98j#i=*I(bq$4gPJI`A50*>AcMysh2Z?
z<Q9CMxShHDD^K}-hN&Cxof7t{Hhj2%$Fg|s`ujU9SXmckF-^Ipu`KqR*%imBx-Ih_
z+rKMQs;GGM;N{K?!IrS<rRl8S&aX;*ziozo?q&UT&S!Gp<$YUp_TaMn#-aO<%3fTg
z)3*Jt+k3sxm7Iy<4{zQ)z-8=ruO~o()zHbkG>>Uo=EOdB<G|%2(nr^LS?aAx5G-pj
zv0~d|xa`2kl1~RE-I)Kbyzq1LV?EV#?p}s}E^vffN=Cd1y*eWyIs2g0LGe_%Wd|nl
z%z8OTX;<#-qFpyXq#d$9%scb4ITN?sVr|oPnI|Qd2rm0`IDFsQdk=*BWO-s&n|%*9
zneJm0b30;1yV-1seD+TpjaFLEUia~J!J(z84;7y=L<HnmoYN|Cmpiw?^H$|wUw*cV
zo?T3Lxt=_hW0yIqsK8*NyzXepE$72GUr5O|r-!nvUa!ND%(K3~z3<X|?yDP4wNCAA
zDOvyfFV_W$G|_vL7z969Tb=*3cg>nY;qGl8e-!b>urFW5%)=&iAueDl=lt?XzwN%?
zGkknEoU?2XbFJC4#d{N?p0Pwuaa@?9#u6-X<?J~j`63OIU2UKA7MDaE4f~=zf0we5
zNMz5kFRJr@DLL)UNQ)`(veY%0`bpF9<hqb3o!VRdN?e|nM^^i2F&~QH>)*0bluu)3
zl#><9iB2<#?#kBf4pS!j#q~@+K0`IO^x#!FQDJtu-{K2O9vQSSa6Vbh&>Io*W~F(v
z?ZoYgpIstvJ1r4BVD_Ws$WE(t9q%tj_s&gRDI`)SwfL^}+{JF|%F;znY8S5iFFk`d
zS@U}0qK6{K{d&4xcF)U9*>L{w4zKj?*wW=Kr>k5Kr(as-{(b7c=vSxemRKyGwQK#Y
zfMfh?{!HCcxFRX%uLW<>!@MG%SqwGiwk|vTTYN4wr^d&B51btNG&@7=g7{L=ebYKx
zRG-MSiZbtgQukoiD~Z)ttp&g7DkkP0&|mzeX<6vC`j<}~takB5trgIY$uFI~r{Gsx
z!g6)lux)I+thUc)kbB*35zn~$WgoLyh4A9U@=5-?{!C5$?AIM4Z|!lX>q8C;SBFoW
z_}>>SdtWX+#A)=L%_8a!>#~)MyOqMO9$m{;8MgLmz}L1r*SbF0nQ%(;bu$GN-I%ht
z-&4;n?5nRm->&Lq9~a6v7fPPf?h`!m;n{ZCw|wh69eror5w?$4Xx9ziBG1FJ>VMJX
z(^}IqV|eEkMqhp3qq}K`H1Dh5J1=k^`pEdx=e7EiFI|i*XXZR?yi>C{GjL*6Tgrx@
z8ms)MCma2O)7}c{e)8QZsNcU~xBHgIQ!@5*&HDXqs@!4E!?RbsdErpg9v?M_<yqn$
z>Fk>6A7(#bbLH$Vn<soqYT=c+Czp8zIz+KL_sIWAlS>YtXj1yBV7Iv4jI`i)o9CZQ
zvXb@SUcKq-tC|}M%?aL5t5^hlrn~XZvG<(yIaI~4G`=Tl&8N!a{Br-!FPi_Zb7EGt
z+9_?t)=ro7ty5QheKzyShHsJe&QmTjm28i(j<Dut*k2Vb=DKM0#|w#(XStum@JQCr
z6bQR!_V*F<#EUZjGq-nKJhZFso%bp8y&M(Olke&-_uW&LV7lq)wnLSPq7i?#ite@j
z^Y*W!{-Z4i&%RBX#j#2$e~r`Mm{&os#EfR;#r*A2?cP}Um+9QjX;BV466gCQroAn)
z$ZtNp;N9vw(weU#OvRP=SWlj0+*an&Yb%*Hq3yEkbMv%ScLELfzc1O%I4}0n)ia^r
z4UD_YSmQPSv##a)U$)%oq)pVJvS$s+we||X+csNBZT=9^VVRgYb8!?e52N9NB6jDM
z0>&C4GhC#Z=ifJy>906@O!VZj)*HVsD_A}gzh}Up+WpgF>R!1B{f|O^vlo}#aJMST
z<>8unMDvMlh~J)r+&171{mu9J*!ItRH+PQAoJ+cLUP9gHxaL0PTNjotYG6|+BlGB_
zVI21*@dsaIm@>CM_Dv|a`YCSuWsZSQ@SEs^!ZV$%KDmT>Myl-DaMUYJ^0RQm>Dvz&
z+nsJN_<!gObCQZPXTy;x{EF;HpM7}1d7!VJvvE_O<}~Nii`kiFp2rx<6>v>`@b=Sj
zhttOdPYYWmE(_sj;GJ{dhH=N-*R~9H6<;2kJg8L55Y^bW#d)SLbFjk&TOY$~mB|98
z*`IS2?@oHK?x~B<+>JXl1Fv0rJ^RnyRaT-LDG5<$G&E=5a%R~5z05`{dv<Zh)m+w7
z&m)BQ+_P<~eG&9v{Z&!ZV=Oa{zHYejXm{F-W!|bik!PfCihL^UlizTH*}1l+#&eg(
z!@m+oU&%4-e=GggUjLoKmA8lM&#zu1_<A=>9!KJx=np&Q&R%@?@F6)qC22Xss;4s!
zq!c;mXW9RfZ#|Q1S@k*k?6Jq0uRZ66?>Vz>U3BB`#X8JC+P+#!8r%rG)~l&9UBzbO
zyX5zYd!FW&vfo}NbzqI9(X>0Fmv1_oIDgI$)mIZv<u<!(xP6I6^8d(BIS;avFM0UZ
z&Jz`l`n;@LQo~KF>!Qi-Q>}u>PB<>>=ePRiT)8B}eoLevzvqm!PqFbIwSRx(`gzeo
zaC5EjLh;7n9D&~#%eI^_e#Ugi;d)IA!y0xQJKpt^Js$p)|MTAa)mOjsuE!s4_qb9Z
z|5KE~x$LimZIAd<y?@OzN|m;iYfO?qh#7^vke)Lq{c7ypKyUp5XKseoTFI3!1ay{I
zPS8pX_@G_A*+$G%b;GsAEfpu)>m-zZDhVWZy>JNW)$m-Q^YT-`Oo@-I`YXh%EF>BP
zcTUqU*WX{#^u%eYkz}`FPOQ~N;pfkOTwd3m{$<1OzxU<W2C)bAxaTuIyt^&v*lE=b
zb{R_*tUNESHi~$~Q?kwS)Q_bb&V|nTy>w|3k8#pH$IV-I#Ld>aQY^Y&^rNTKEx+?u
z9jX~cuTQWj4O||)wCBU^r%iV*^G?r<Yuq+_*>Trv*QVVP-{kCb!lky$vN3JWt(Av2
zURq);B~@p6Bj#MAMw>`W5|6#xp*zX9^~|R|Jz^ykuxKgQeZ69_c`BE+w`ZLGIkzly
zBcJ%}%Noa<S!8`y1nQe!UhibO_w%pU9qV^Ln{&}meoByBh2b})9}9aH-Kaa^@0m06
z_@nsCktI*(2AVVZ&C-<Fuw(9-tkjc@fh#IH150+gx=wV|>Qi=q&Maf9_G@nb$^`xT
z@BS&Nzbh&l_zvxuJI%e*ZCAC;#2ajj@`~4Ya)|!2ULq38rn;Uv?Cs{Ca(S;ae_mh5
z-1Yc;Ym>M4PSt6X^sMJRSQDx~|J)uP_xJ{}nCZ%^4+xtCU-`B((Y(S%^O=%qnbQ3C
zNABw!6<c*|{@JY}7IC>hE=n#rZL(izuD~Tm#S?E63N+rHdN%9i4ULJqvZ7xP2KdhS
zvEiwYxz5ANv=zK!RhtV=Th*~|`F*!M&*@F6oyhFY1i{1|n-dM9FG|b$c^2fbq)d0P
z{G$6%Af#fkk2|N=``f!;So}$3^17+|{TZXtb_bcR^A}DwC>}4_>r%wd>EwEG;+&nk
z!qe_H$9_Gv>#59y<yp+JiFcM=^kH}{W$q<<&obej!2_Fq*)jv;z81^Ax(7!NS@?dQ
zd+CRn^ZfXgE7E6hUF(d}vOSeimb6gM@BMYfg>LKh;}$xz)ZUIPJFxUs!t1>rsVg~!
z8;|Lpp2-us{A$A4_kXPozU|HWbmq{cSq6PQZM-MsnNPL1vOLX?mGpJH`!`Qo+&<lw
zA=|=jcDaICXYbmJJO{bmDwgf;ljl3n?~&Ey@^p@iK~v))6IPCO&ub5|a@nV`TsQLn
zR5raSV^Py$mNwRgO*5zH$u7tP9Z;c~x`os7&cU8dypo%0CQaQ@=q9L_eBY4uSMB0*
z$1Fi<=j*$_#Ide1P2MAsQP^b~-khjm@apioBfEp<)m>k?r!wl{!V^M5nos@xjQD0a
zWp4c{!gE?sUwW6fMq}4qUDoo)0kxv)d!J9)yv>e9OL)qpW#0sr=Iq+m`#($Sv}8kW
z)aC_6u@84_D}AD?Y^txkbeZHu!McUTSGk<L_McF&DUaCq;<dX!OB&zw&povdbHm#2
zx_IvS)1Y_Y7DMLbYL*|%HYW;{Pq`m8jpI1GkwHky#=p;e1>Ws@>~8ah#mquzj`!?G
zJY`%yQ)W%fn%8&yn4#72ACn?17Z{xQVY{1+>+`<`&j;$I_m0(gURi%&=i;Y#w_OoU
z_*>{GziBD+B|8l{`+(w=QVWdP=D#xCoY`x#z<wilPT()skTOxPO;-{!W)*!~cKK15
zY>Ke7Yg#||_O4|&)dh3SZd=TdJIeR(bJb?`%c~zh_Uk$CDDOGxh{Wu@njWH4S0Bn@
zkd(B{z4T4aIUp;~@1MqvHEl^|`q^*u++<IwdxUP<b4Wz;ldNkB-&IEu^Vxg(%)S0@
zWK>!3_)y8|3(s5~gM;6+aZYrcX&uFKRl(&?|F$bf_=5T3o8Hfk3qN(;#`utD!sMGB
zmqT}i+~?uDC$sqP^vb2o@fBKW{Xh8L9h8&0EVlHg&U%~Yx?Jxcu6Y_fvuf_)8;jzN
z&n%T;)o1-A-+!s-O=ws0r_;ZSzMsBP+iVh;|8jS9LU}5ul)s*1{9HGwSgBvaAErEV
ze4%O2p^@_H%7*=m<MX^2IA>}<%=C`f;IZK2^tul^PeSi(V^Mgjx6;KzMxva%faCqu
z5MTb1Zs#?Zy;rzCj9$}}^(&@i&7-^CwVzMVGCG@gOZNTt4`EA`%ci~jc(u>%xw56t
z%(R`h%Z*M6mi%1$M=QlwO5G@3`>0jm)|IKZ7af*n*}Pohne6-LE7r08F#2`tDa+Pm
z>)l_a)S4_zTYsodRI_<?n&YKq^~(M?Ngw74S4sVT+3@aRiR1)ZkzZ>BJPb~+6)*MC
zTEEIkL#SQupsSyOs>6d9afx$Q{ml@v_h^wTm%kBuL3?M;B@<s~=}Q@oUykjWRwNgA
zWKWO4ac%pS8M{_bd^Y9cGS+1-@lG=4TKn#tdT??6edBf2T5mN>q=Pf|e0ls_V#?n;
z#hmt=GYhAlXtQ?6RQQ>!JVSF;zl8oLL$^7OAGDI>gI1^>lB;{O<-{xDGzA~-saISl
z3BTQFA>?&)-}A<-l`&B*R}weAZLs9{SH4Y9`}!`226;A*<@zNI4G%W`VH25~wyJG=
zyf0hsWx;z(SCrLmuNGsE`81`>ZLed0o_hGFhZ{?|_8qfjFh8((bI^}#F*P9`f1TX&
zeUkQ-U%1}EB3r7j_x6cEM)kfG&fitmb_kt4x9r`v<4s>h*{-t0Pr9;!_wKZ_8@KV@
zFJig;B_{Fna?b=73llw2pM>4Te=BXia87yow_jW-tjTP7LusMa1^NH;wpJefZ7*IK
z_P^t}>Z^AfYE8|%Cfje|IQ~4MF7}Uo;?+HmZ)qzy9Sl8i?r7{@u?@f0^*#Nx>Q~{`
z2L13%T^CcY=SuJNOb^WxUp~Fn-XLsQZpYD6r<-?e`Bjx1s*@|SKt@bLr($+ey!B6e
zo`jlLjgC8O{d@}IzkFOYf5+k3bx)i0{+x_wxXHRlbneML<x>Ki9$jM;6f+LGlUSa(
zYrVB^&SRzCW?Q~rzN=UHDV866m^^!WRD0&?v+DcI1K0IE$^5^TdDeEx{L{0qirrqO
z7q`WHal+*_Yz(vY%`9UMXbBg8PkMf7N6tFN-zS$dO>353^5WUMw2s*iPjfW;<hkiD
z_LV$vrSN~|=7;94Ujs~zt6z%Dy;>O8P+h6s9^^5j=lpK9nz}#FD#E3@ZU%c-7ERQh
zcUZH2YR&75ulISCX!+dnxSRGfd_D7RL)oL8bN3tSOD;{4KhvFQw(I)IEp<;<#HpuF
zd~|jjv(68`Q*#S8u4~@DYT5c(e1ASK7iAC7&g%}`a{lN99_@FV6y6`~3f6X&X?3-}
zY8Rf+db>Go1*^EBHP6cC+r@z#PQ1s%es2!mDzv$zuD7q=mt(Q<*PN4$dkmNPuKH;H
z=svgL2~)dc&(oap`3_oMV6)wH^~Tp5G0C?xUt9~=Ib-qh$<p1aA=58kY$#$dTj8_J
zHOgG#%q8oRu<HHaZzuf!^W|<`v*1#vY>kFL5sIDb&s@!FWqRiL$g%w7T_K@KuRkwr
zP%0@1&igj)+wOhQ4QZeHJ_nr+^Lpj|@39xVvU1-FvCaF77nM1Em+%s_n8RMB?3dRe
z`qSb{dZ_Y+<uBUzeU-W^aeMBiuUi&`RLpqjzuW3%(XT5^+u|1)XKrfv%#*|a((^lO
z>aD{oIkwq)swB=y4xM>$gUIGbY`3=DuPSQZIOi7kv!tZ%#F>BIix<j!d~cVx@!49f
zyOOE)F=tP7cG<qXms@;{?_HOjAzoavD(B_AuFm5nB`4k2wl1Hx`6Gvq=4By)$6EL9
z^;`VvlK4K$w3%&FyZc-I*8&qPCqJGlq+l|gyX4}@%9j_e&d5zHdgf}U>n3tHY<=Nu
zFR|sHebU}c$lV;+AM#E?cz=n&x=q?VHLIJB=y4`zCtNAp^4R<9(!-hjPghEGzG2&?
zZS45{L@0lp<+s_P+_(CwZeLR@()L-t{blXaO`8^_*VM5pY*&rFx@7rc?x`=bJ3NiP
zo+?j}^ZRkbS)MOA&Ue)zW7A`nUY5zLcg?Ub^s=et;hDK&nu?ck(K#-b(+6~00$cB-
zZdvo>^t`jTyK^r*-@aCTz24&Y&eGe?Z`yQt^TJfO8S8&OyLx#Vmuq|Bf-P+~f4r^|
zd%$!)KxL`M_MWh3^B#6jvt?F4v**x-TQ_%n?poGdGl4Z#?yRnj=<|*%RlL6(kFMQu
zW%bEDb_tVb-kcDAIAPsot|P+d9G~x9pr$VTcY*N2iR{X2Hn0Q<d#`+To?mzB;e+m5
z>rUme&oQ_@;rb6wFV{Us4%Qk8mv1p~oZ@bp-LUeKVU>q_cHG0_qv?~^Y!zR(v1})o
zY~Cr$_D|9L{1MrCk4vv9)@6L#bZJM4;E%m=tJVB!@Bhzdt<JQv_g&B&S-RGO_ibMy
zyVg&`dpC{GIQM<;-!$R+^<%9pxd+~vH*S<TxXsvPTd%jmw&Y!Neq4ICIQMnW@>1J_
z{ZDUp8^p8S6u(wvpZUx6SHi^m95+razA5}!g3<cek-a}Q7dCIzsr+$@qdBrmQ&lW&
z_sW-9=kDwjDxPJoKi5+EpofG^_N4Cb8#X+D)Xh4z*3tT`km-d9KfEMuCwL2Ro@?30
zX8uuaXZhRri49(^&1tv&x0nVinO4_HWo!98zaf#Tby}U3z2Z>evG^Cecv@b%&fipX
zr(d<gIDYQccdY;Sc5E*6$&J0C6<l#d?cb{z7gVMk&?uAol@=4HH+SieIiGt}yJqS6
zFSveix{&?-K>ulB7p3QLb8dS4YOQbY$E8<znhrkhnNjuI@SMHZ*6=9{CX}eO<X!LJ
z+^+b$;lP^@1$%7HG8DX;cj55c9~b9OXxrWTRB>65!CI>`7q+kCsou-CtnJy9r3Z^|
z>#cl~v%?^?Wmd@Ug{St+%e$UD^<%z<MIYDHMO9L6xpPi8yUBLURuX*Bkmzi^-0^ng
z87af^FxjjVdV7w~<(_-`q=o*Ki6%zPl?gEmQe`(<El%HhalVAY5xKe3`6dgioml(2
z^kmLC&6aeTRdvBSGyM6K?^I;Iw%R4MYSICblog(nuNX}aw+LUjKj1|53K!<IR%ynW
zzl+VQF8CH6Iik?|^5q52887a{EYj9D7d_r#>F=hw%V3d0v#Pz%8H4SM7m0}6<C>}8
z{PIKKfBi@MgoS$|?tXh%VfJOsWs{3npO_x@X?;|;Xj(^m>EGpwimPWHUoUY!n6a6Y
zEjst%iPO5qW$Kepef+|Cr=UbkFxMp1T4Rdksk8!B*~P+^#o?jM&t{bHrJ9!;|61>N
zca@KD-m|cG&3o9c8ZUnNXy4H{;=hUt{2kwy{As=Q+vDhov|Np%ETzDd!?!-@eBb7E
zEXif>hO6c`f~1;_rM^h+ipzHSl=xZw(Nfze0Y&}i5}P+1>%GF!uxM{#nf)`q(8%*a
z8>a?{Pe^ROCpZ6{JWt)7+y9^bDarqTz;}YT#pKPsv$IXN98P_6=$({x)T_d@m`_q4
zjn3Z;>UT*xd2f!6-1jGy-#PcbR1kl8yf=958`HeYUrt)2ub)s=F8r%&e$lEPHc9W}
zW-2A+kN-0uZUqJ%+WX<q+Btcw3=G`@3=9frhxV4{6_+F?<)p?Z=NF}>B$g!V6;y5w
z&+WhECh+gvdI{C3IUxmc`$RcIMPIrGR+R_p%WJt#+?>w8;b>g+?re^(Pxq}i-!nB!
zFY2A8B(SFZ+05_a^A6qJ9bSL-{{%^`=FjGqTH4ozzB1LVcHMUL=jkUupJ=XG^=rk`
zwCsmZKa1}_@LTtg=`1hDzG|ISyHxBpXq-BkvUau5rINch+>&QC>Ad!e7VruUi-^=T
z{^;Vl<Fr=q&J9d0jXm{0eot~0`DAw?cCuU0!>s6u`;2$2m3*fwr!MRtFms7mnRH+2
z+NGNwrhMFNn-S=LV&3dikC^zPLli#6tm5U^n|XuFxOtaDqJT@H);`wVM}=~Z-d~dC
zd0l6EfX}kjTwV`W``G_=<<-UCpTClP{r^nPMvZ6cNuP5jJ)U*(l3zd!cW!{cxbTAT
zYL8zcg(ma67j>j57_mjV9h<Z~Xtnf`c1x+<JyA?d;=YN~!<U$xlX-BXd&{cn7w>Mf
zYWQs4$|BWlc}HF`d&@J8d)+zhTK<b(KG~G?y;tW%{wx>ms;p@j*W2nYYT;X}b56va
z$E8>DWqnG*^WHt0ucy?ia9>e-S6A7;Mw_=aV76q7bXke}RFCeZowge<PgyMM&LH^b
zjm1mts0lmRS^iW_)|W|S@JXp_EDD{vG+>@hlg7{8lU4<rA3Pu7k-S_zZ>QbDb+Z?F
zd|#r^T42a=#^IRgL`MbbS6AI7rhl~fqrK%x4cC_)9ejJmXZR`?3qRkRpb;2!^{wkg
z1$U)-6(*l|N)P<{bU7~cc4>$2RlG5$Z;IlEmJ^|W=PdYkD9PmGv8qohDRLf<FMVGY
zR1x%m<#Dv5^y=bgkqUFzD%!YoE?w}I(U6PS{;BnnYDs|W93$Jt@?2p<)3hRA6_)ji
zR;$lw+zy(x=(SF}*ZUoUa}!oR^_czTQ@HZi5LW$LhnAf3uiYqRcH_23f9=C<ulC)a
zRP{wnZ%x43xhA`u*19nE8im~vzjAZO-OpP;*E2QtE6;yiyZPpZvMc@lj;i_(LRrnX
zzrSr~s9f;K(&JQG{_O0hb_Z`P`4IeRw(*2ErqlKvizS)b`L6V~r&`NSS|s$ddB(Oi
z_Y{3z?VQAWYl~{%?oLP9HL5)|H#beS_R0%8ePPQ1n|BPCOs3EDy*%Ol-YE;t+%!Br
zz2Uj4WLCqM6AvEv%!<1Ck8kPq{mcDotm<XMJ_o<M{Nd!$HlN_^oeMwyI%yg5s4+RK
zAmaa_8SfZNSNH{=6kLAiAyfLsY0o^$FYIu<I`5o`LWAS6iH8rZP_W58>v$_y=B;K&
zH#_r+-WThx^DTS6OLyfL&i2Jmqx`?vcfP+GT=DhS-5qf@KL1vS?X_<IX}P+nr*6+W
zJ=cmgpU(XH=-0EZmdol-S@nV~S=RSw1xdwlEiBu8@8+31{_dgc%BB5Yid?PJFEOz?
z{!idolVjA4dwXm5?%KPv>a$cw+$*o0PbW((eVv?lp+@^;4YQQ^<tXzRlOAi#T-W1y
z^TEV9H{!qC>$>@%>&Cyi*|&oJ*IAlB`Da@<U15LtT+fHcJmzo7DbMfwn!vk1NAvt-
znSC{_2X1vnxNtg7J9KRE>@5E|+4o#a7aW^WX#R9=lhlXSO%`t_{pPow(7%}NdBptN
zr&f1fwp)67hTTiP{yo>OO+UTxZmG@N_UH2UdwzI4SLd$y6masO*R!cl?d6v7PCOR1
zIV63{{%3P<_e9w+XfL@H>-1>%X@e*I4jHT5(k&uh=y847qWs8e%JC98k(&&M?pt&m
zpENOTQy;se<)VGkcQo@~Zjt!$(avXL-nM?r7f1f-o?qj9YO>^&z`#_Y+h1RvUMzW6
z^rXje{<iO*FIHUMzcQ@<;@j6p%4TlZ{5bL5_f^LqL|m7V4SO5<<MLdOZymk2_doG`
z`?}tK>D*?ojz9nSQOoMT9Y+@b;bvgit;@h5gIZSS7nEe?m82FG6s4A=7J<s?sObDV
zJ4EZguYaHx;c@vy)85&!TbO+UkCz20cM9jIxo&S>>EJCBz13|_(4@DKhyU+={y}Nd
zq-T>%PBt%Ic%t}cMV`%-;!iIh-?Zny|5Q_3yR2g3#!ctMErpYdHZ6L|YyC&l&Z@%C
z?`M|or`NM*{V6H=^I7pvrROs9o;~TJ`ku$$MH~$Gj_}EHo6gS8eQ>&pr<m_uj%g|?
z@#}W1;MDbwyKMD5wX|TtaTa6$uT@j0UvCLZS*3X-E%6lV=?q`%!!=7YelGSFS#@Il
zuEW||T57u%v+lp<Tp4M+QHbYX+{Lb$lIta1b@gu6rp!Ap;p3fob`!_aw8%}5LY<D5
zrq<oRw>p0Lo;8_qMux2qyNeDge-ev-m^?qXr(3wecCV|-7KZ72Qg+xVRn81q<M%FO
zBC}KsLkG7}@ACciHvWG9>*{`ed-Un-kA?&L*GirISsvo@%Jbx|>YK}-y;}U>e`03t
z^HsLqH=KFdTB<L8a*#OpX-nUU-7*{(A33b^I(N?gUs+w1k*&SAUtRU*P9KNH^Qt;?
zV+-S4maGa~Co%op6XQQKAD`I0XOi;gor}Kg(!9)niNVjIW=V2HTjPJdjuVSxn*K8#
zv5@e#D>FzA)hgP#=zHGW%}ULIn)7A-@-24wvg$9}_{g<;ruH&p@v=3J%l>dZERNIp
zd`X?*#%}KEUlL#cUbEF@#<io@&Q(ikp1IT%Ci*jk`-X{&T8^P~@9mR85u8oCUx;R$
z&)AtQ+Vn)v`sr!yef-+SOA=*wTfY<9!|-@dT9UZuft9jM6RIU{P5-j+e-VR@<MrJY
zRb>luqM|pOcKy89^(ta>_sVbUA`f^~g*M2#B#2gCwY$9R*+IQ^>|INR{{K--{iJ9z
z(PUcTKH2L|YZ5qhS`}h0sd}^IoMzs!Fro0&^woP35)FQv+x~g{<U_oBd%Y*$^Mfl6
zzdXby<!Y47?IB$`^SY-{*qVrj-{#@kqNT@FHYjRHOgy~*)P)SegRC3RaT?rI>HSd~
ztSpm%b5?4Xp;PA!Hih?(C;J~TYMK7+xWIIl<jy0P+E!=Qcy%-VJp0I^&!?};-uYeN
zndik%Ze5yO7vrgY_=2+Qg#AKOHz?IVoBGMwIP|~FyxEIB&z$+`_=i0)Kc~!GS<iQV
z=?hL-$EP<wd}-a3wAtbRo3pi68Q<kUuraUw@-2ITc!HmiA5TuT?zQCpm$h;C4>*Oj
zoqN@>!RV=Ehc)M{s=^=X8x%B5#r_4oRI*9l;M^TyFspU(H`~eI{10p_JSKT~|8u8;
z#*!KS?iXZ)p0oYu6hBxUrL!YqlaIDXfXk;BCw@0qC~<S~ORlt>SfM!Itx$fl`!|su
zvt$Qtlla)rN93Q@E3W&ZAbYgPDgGqyq{S?!`&N02c|TOwd+2Cz%W*~20s)oEsnbJ!
zPfux8$h+cI&6TuItD>r!lV5qh^rx3?D<3pBC-MnN6(qAO?zGTbAf|13fuZe}`;EDq
zr<;}WL`>WwIH53V(Nz87{NfMuKb>^rSTSpI&`g;>GV_ib+;E=e&#-P*;zHR&clsV!
zm-l^LS|GsK^y~P6HB-djs{FJuNN3M;zF}GPep1P9_pi&mUt|ex3UrwgCcHYqWeMNp
zu-P8B&K>#6BRxT(+eFiWe<5?xEH3W=!~V|cPkKM@YwD7GTc)QRnvnH2;Z4;3?4OUK
zuI-SuZeMbvL+EEt^z$F)H;(YG{$w9v_P})3tSzeXvI@)}<@hxGI5gNSTHB_sYS&9u
z$t(@?JR!d)XIi+AN21v)vC~Rv*6Ggv(-LNv&gRu%|IMx9cFgr*WR>QJqr&|EGA~SD
z^|MYWVUoOn!sl*|KkYpE%0<sN20vdT@oH<TXx}ffd;MM8r)_VoO<3CE_{&}2WYL+3
zNnNHpQ?omIc~#o9Jyczu<`wWo+LtLUy^>wF`WyS}sf;D>-JE|<c-#K;`S;43A<efV
zc{gXDJ(_;oomZn_uah8iTx>y9`PqE#sNlNO3CG14I4jG3@J!|uTE1k;u{(?>%h-}s
zlP@{w@p_f{zW&qq(p6Ndu_wB7CF|>UDeupVe@vhL(a@&!)j7u)e#f<c7wmoF9QLcX
z;Aqun?T;))e2b>c@cPE>(E3Ke%W82xvsTw8^L6S>uTH71{#?RvFUfcZYjnxZ{CPUN
zbDFIc<DEmbMffIjUU?KLCJ>dj?!>BAqgQ;Z-A;+`IMlu=Vz$J@PeRo^OCRZ+&h{{S
za<e<#g_GqWpPAS>+dp!CbE|V-D7@62{mZ*%%kyPoPgn)dO$%$@TIv5#crx#Tx)|ZU
zSI%=nl9FDp4LipF)mY@ujBbv22A(}h5ou+sTg|rLXkz5+x;EuXbf!myy3gax%}vUS
z*NQ8}TCZ3mcxLY}M^zz<^A0~}T;mj%4EY}0et$t)V1n9?cGH%qslHJY*6n%}x=u>6
ztSj1ETQ>E&uui4M=WUtSpWQiFldW<0-fzzkwSaAT(_h``)LgUrxx=lL?AKexoxffX
ztGQRULGi|&4T;`2oxdkIesoEEI;WB4b6=*E?Z>;<ws^(PS?XwA;LfL-UCex(Ikj}D
zjaHfW<woNY`6HLKpKVy!^@B%s8t=!$mXo*gO<h&C!}3ehn;Wkk{mU6*8P>ZjvYW_t
z<gLT<7?y=^@5n3272Q2>*V|5$zhw>A`RiG!9ErgO!pA#AMYevhQE1s4AX~Tf@#1rF
zQQxOaozSdf_w-tKv#fLF+`qG{rzZGYxOv~U$;=n|lRV*7$?v}s>o>3Ud9&Y_&&hw;
zqQrlzzs*X#w6~l?-uJN9Cf=1NzD-oRT-D{XUt`nU1?t>KGCbJVi?4srd>|kr_{wAj
ziI_*L-+nn#+v@bZZDF~gaN4I$Op~8nxUIDQ%k7E&S317Ua$5AVfmd*ruR`VDs+N<h
z|LaZs7UL_|_)cQ;o%QyIk1Wq%cX;J=Xo<3NgXhfj=j;9L_Rm(^A3tZm_3j-t!jYD7
zNkXL=Ue5lrK5cvQeQ7eI^7Vgbu7=%^n%A<B*KVES?w#kBn3UEpUL!H(P0U%IBT5TW
z@5HlRUcB@5$GF{=>m)>9`esb)@mcUq)64n3)Utv?)`tteJPtXSb)x;jjAc{Ww@kVC
z>KH%Uj1_9zOc#1M$#s70(g~cG<l1vnR{vc@#_Aa-kF9cRPxX<kociK=wOW<C@u%e0
z0}e}1ACcX5^hCezDXSY24+_saO3pnV!m;tk>YRk6xwl#7&pcYT>G5$s*Xz5VcPtk?
za_ZxpIh^|@sV-X^@Gi2TeWB#+O-0RG6^Z<_m-bDLaJ$p@@X1@bgMTM~fACRq!oE<=
z4J!RsMU(tAJ}GtY6tAiJ#K7{8Yf0H*WpNIR8Bz*YK3y|S)B9?9L}Bs7blzQRpYp8!
z<mDV(pX}`Ub=Foz8>z;5Q6e{)T};nUi9NKbE0A~ZTTajEpQ1la+Q)EL<ZQ0N$2>b9
zL1v@=v!}#7Z66(%5*6J2eSzPPjp6f+K77$n*O|5JN73>XSF@5VHf&E*pStb9H~;D-
z#dGbqAAJ7Yy!UC_m2HZ)x!&(tW8+e%*z}~{c=JV4{>x1H*sqS&?Gvgcbqt=e`hV)U
zdevE8Gf%@}ZRO%ku@^)yMC_f<d-#Ec-L&+53l6U4cUJwx^)cbf`Dxc?{W-nyeS+V)
zr9ZCUm>l=7m)C1rTy<r#Myc8T={;?$c|XrRd~KD+rL8Q{>t1bL)#^4eKIU85@x2rN
z@Ks-~tK3kWzNO7?l9AQz6g9=-v=_34$(v^}Rc?!~DGA^H<?f@j0}f00W}kJQ+$r++
z?;7XpFaD?RnD};rey7>*U6$V(mNZ2FiFqff|9(b5`{b(dgFW##XH5IRmwlW+&&+r0
zve)+~)U!V>-B)xobDy>E<~7+*xPoszViqj);=fY0?(B-|bp@5#JI!V<N!&Ky@YN~D
z?U%oGM%?yGvl6Q9t}xpadMan%O0Pou>K}buyZ(K8QQc-38CBN)#?vdc!uKq1rQh5I
z&H?|`F1s9)Q0v-t=v|@2nWo0RnD?(w83agVY!u)2`PQ^2#|`CXx*L9*vfZrxcWpxE
zqv-sp&GjDpB-6RLZ?2!@=+(uzJn~Z#|MH2^J8q_m6g4lO)L367uBP_w{cb-w^AE4Z
zYnR=tUf6pl>*dFq_TblU=fmf)KiQsj@!PS<^NfG&yd7*G^jlu0mR-Np?(*+hLIL{!
zKM8%PN9{F;J>)tpCCR{$nasc-irH((&nwm|sJv^FU3|xE(*3X66F!C(s>$`r&tCgx
zW!TDK9m~MExjS`E?hcO<ZB{gta+4{V#_zdV>+kp1c{Usq9@xm-kJVe{bw;t#ZSn4l
z`X(QG=GNQ%`~7dXicqBHH~-{`p(k|&k1|?Eeag`L7VjVT&Ney!)6-QRdCx?v|9-kU
z|6Bb2n!mDpPOnm$c`Y<<%9>M=rs8jy{#EOrvPnLz^gq<)>b-kwPKfKAx-3$sS{b$}
zW#gIduDPNcHC$@uI4EaL4q3F~lZ~nFB1`{GwqKjY&AsEMI5E!ADVSn1^VPA#wrutG
z&oj>~UuiM>(Sziw@@+>7{|B#maz5fr#oVxmn*=sLIan+Hx$C&+!+k!RG}b0Rth7IE
zt<R`@-}<A%qIbV-9%YKZYf7J6{?z2-o|vhD^Uj{BR{C?&StaApr`TCj4qOO5(cQHE
zkoCN4NqfvMxm-CCz2xWFdCN++MycK8eXP2B!r3d_Uw>{9>i$%$^zQq&KL2}ivHNy&
z{D1xB$=#1H+vnd<tUew5M9_ohd{dX=Ed>eBlST)*g(hk|O+6{LXx4MX4|Aq6J?M=*
z`MAXNCbvGriK9=Fwu;QJG~_wd&9Gtarx#%<hJI{z@vM=P{+?<!<bLP%vwp&<>Cawn
zt^75)^4I3dU-xYO?yjrywUt|BBlcs$)0rIWzUR4=g)dW>nig^OTUCCPdL~awrk!r^
zgwQuK-I=w?azzP8m3~g|_~@$`bkJKWX<~}%o@2*X=&i0{bol;FB~#Bk&|{`-oKKz5
zOpQq|wD#<f+rFf_WWmzLR)ro<(YC`uOEw#x{^2CEVUyOe4_kY>S{AG{zi88bHBOFU
z>QfDyy}M?_q<tuH<<(PrpAcs8=<8MyrRVumJ51OrEfRtw*34tu*sxUeqt_9OHWnY>
znN0oOaeS=*cbhRk>d)47$}0L1e$6|O$6eU?WZ-AcW!498I+_1D{&ztd*ZnJ#f8SK%
zHQ87<GwozgYUR;MLOVh~>Iga8{xtNx=Opx>Yu=PaTe;c~rpFZP%-`7f&L)BTf#qzj
zW1Kw?ZmMMXdTnPt^Celj+BelH?tg)_Xw&fps^Mo3T@hORrAbKQ68DL<i*rnqe%ohE
zyU_hQZCdM!S4zp@SN`p4+@>>Wjnl~~Qf&*gET$zmN_%cEWWN7h^2s_$p)i&ith3oo
zj8~q#v4L0OxvA7v!Mt4_a~y5Yx|VSN>Ih#lWl~P$V}%2P8PkqTQsOb$$i}!f<ho;v
zjPS>Xr>xQ`d%WHqX}H_DsAZ+kjpzz(xgSY0xtRVgezM`!9Pi5RPgbl)Pvoac&tUyj
z6(DNbu*q$2gSfDBniKDioWPrhcYipPB+>a~xzw6pPIE+D`Lw=Dh@6t`=yhwI;>T0$
z7I{8V&Q+-UT7<@Yw%(u+KDL=V-YYcT$+*C<SCzBsM4rph)vE$xnX7oSJ}|$yb4}=i
z?HB&)S5+rW=cL`2nN|4x+o99bVt4Wcq`cCx%lV@FYR|;Q?dLlUy`-ag1H)?<{@dzl
znwJ@TU}J9Ze|-_1NADNt{k)uDy{#alaIGNU(FL+g#V6QAEN-~Et3B+t#{I|!zL#^a
z9q@X@-hV95hPU7%zud}`mlMvsd+up+yxc-Bocr>%b6)4BM3_!mG_5i`#AESav&e~O
z{{C0e3SY71*rwNC^QX)-aLEzfXw$XSeSf}wo}R^o?d#V3)Y+@c67L^zzUGtW(r{0W
z?uxeNhW8BX>|bPU`7cl{>3(R^l@zt#ewY5p%{<1(AK4(L_Q8*B=eB+Cc`RSO*V)^B
z-_CaHhbt*J1TMN7dpq}^;4<}oXR`W8@5iZYRoVX?kaxFsUa{bj*|rD#zXFdp-16A9
z$b-d9_TlErJkyH|8$0XFd>1iGoAVT}%Vo@bpuKKkZ^2UKSs$JXF>O!$a5(Y6yvHr=
z%Wj_#yvjCJcfsGSjmvgNUXa=^|9JJu^_7!&7hm+V@@c#gSZ(QZ^X8|<D|r`OVqG8o
z@DTOca!Kn7)06977s{;Hez_U7@V<zD4%_RE=O<0NdPcx(-I>nSy-`7#A7{qI{rt9m
zZJPDs9dZXl8a^>>w|D;NEB4h%TcP}ly8bIW!L0%R7hZj%y?EaV?u7x*`D3qqUE%-t
zUe`2tO^s<1Ugqr~3E?8Elb&Av>2@RKeOiFy<zy4%F3U27mcAA_-4h0XeT|m)BpMxE
zpq<~jz(_JZ@M!P`$-{1+=5OSm;rT0Y*>p95*)66sCI;|{etNVl<-;PCP-CYPSqp@W
z!&Ax^*EDikbJ#eFeNwCc(BpIEY18!Wm$X(swVcGz$(X_XFRA%z0PioZE0yQou^x%M
zbc2~;n)?NbFcX#^FK!-FN-Adj#JGt|_wk$+Mdvqr8A|+ayu87|HlUL!L{ei@XQ~pT
z<n6OXcM6UcNEEMNO@9)Rls)TkU#eWRq^|j+>oPn4J&t&t+jIKE(;0iu?En9-+O+Xv
zSlY6US>cQ(jFavK{`;W%=k0!$jDu#JGs`Mc-ESr6^CrCS+J5KFHSvh~+;NsGXFhmZ
zUb$hj;Fr_w&7Zd2Fq?n-hLrDuomUU}T8qpUT_%55|JuS8e7~-0EPJxuSZn#rGfBFi
zBEGyn=l=1D)s_5DM@{~(I?1PfGiRD__RYLg2LJ1>f1Ku*be(zg_03+9c}K$@^%v$>
z|IFHST5@r&{B6Ypew-b17YE-txci5i-SuK`o0%R*ol>rf{WxVBP*(IX-g>EuD971C
zX4!3CY!Bi)W;;q0yfC<vsTiccM)B#|^vrXsFIvrr+&iOd5$`6E>|Gu~yJA(|dOuCP
zdGO*@9SIw?sS!53Oqz-x?x>ynnz6Y<OFi!cM~rM!w9|_R>nEQ6d#uozUrPGXu>~^e
zLM7qlzx5O3KW|dW_g~M(ckcXz>0TXf>~92R9(Hc>o~`(3eiFA};hi_Sy|JfC%f+pB
z9#D=cjkV2MJ?H+b4<+AUbF6VUo_1Pf!D8*~FPfUx{=xH>{j8O^e!A?ke$dH(y>9NW
zgTj86FFjLub+)_qsl#87t=s04F4dKsl2^B*S1QVR@w4OGX1zcC?ftJi0{&AQPFn6T
zezik=9ovn2u7Xc4HuQa*$r7>m(d<u|)!#R!Ti)1mK%6(NirMqIpNVa*)#Ld_ZMo9|
zkEk0tEYAA2$Zf~dmi)8Q(}lVxU3pi?du59Cb}cjSDGRS{VK|uGlFfAMoxB{YSWH6X
z(b`GN608-uj^2G@sh^al(d|_l#@y`cy*z1W`%MS8GKMrc@q=$(*QS1V$Xm5iQ~Nu^
zkM-@$$MX4p)J7Xy&G{JhS@U@Br`7CDe-ixpf7|}J)A;(^9>!zSCQoVm@X_<uu5E9d
zzh_wpX$r6`*8cdrYO^Ry2UnNm0_V=3;X&4{sShqLy>VEg>dnLa%MsT09ZTNGis`&R
z)|k7g&u#88*~zOaFR!Wp7|^M6ulDQi%qIsE3Y;1;3O&BvSHC)^=Bb6>l9@r(@)vGg
z6Ss}NxV9$SJ3sp4*J74OdHVZBWu`BGsuiI)BPw9SiB&3GZ$HGRNZbnc4V*LO+05&q
zdFqV+e#{i{%xQN>etRr8afPa@&Ucr$#S@OEpTBYR=Es|izg5y~R-F-A79zDKdPb|y
ziLNCRj=Hyf@RZaN%iWvr`IF~tIQyh$AMzIT#8_+ya4KtdHhLQ7awPkxDaVqvnSbI6
z8eOKGnbaXPH!<>PirwO;ljezrs$XILZoY9J%NOgZ*Pa?PmDLscgb8Jvxhfubu|ejv
zJEy=^fuzz*P2ISlDMsrUI1hEX2CTm<+Wm^jDvX71%~K;!SHp=%4tB|ISbD(E;IyVd
zQ?uUjNiHU<cIBQt;C0VcdGRL3(_LpIe!o1d8oYUuw%D!o&|OK!jmKstFAO|)FJU&P
z@@ikVH}?!b$*1nk(afGC@`@#IR&(7U!-7rk&)e_cSfKSh#G^$-c=GH{mG=*Q!}eF1
z_QmZD63#icCL&hp(p#ZTtsT#7yic*F^;dS4CTo9CdzbRf<N7BhoxL0fo<Eq;(e`ah
zTAO6hCBYYk=ev8j+|u8?xNH6PNkYT59t*b=4uvgN_SN-|^34iUPA$F?wC<bku@e$=
z_Rh}vbc5mL`@*iqkMetu-~D)=bJiO3rCk9R9{gIH`MYQDbMG0OUA;wE7q~I)(K%xD
zRM65w_@qJ-?<1Exg>E?xGctE*2?tcx7}YiiF4U^!xe_%=ZB|;F{(O7>C7ttF`+t1v
zy!Aypg10coN?^mR`w4k$OZfMC@BGj3%q`ee{LD7)BPq5qD|5I0x_OF)$@11hwLM(9
z(Mk1R3xcn*GbOiqRJ=VT`EB8!Rs2%z^N#%b?0or9nWmuY@mq>b99A(5&l^=YGu*Q|
zG<$V8`*r_=jJ(e!znyGUQoL>ac1Fnj5T947zvP^yIj_(El-_pBc<XQfyrZjR>ZV4V
z_S{;!=q!i!Z9#)|tM1MCTyK5kO2Df(VpEFTW*WZTwrkFo562@Gcg<bl*gZ#hg2saA
zht(?uJ{+^nS|5I}dX|Z#fp?*uRfmQ3!Cg;6XSpBfN!OlSnf<Iapde^oSCYP>)y9Q;
zIrcV62s-?f3e9=Qu5EMm*rvq+s)u$zU^-{E&EkvxV(G@;>p!mO-S_HhbaPYv+z&UU
z|D0*!4=V~be7W)9x6X{WKQwN9xHx0^@?-u#-NiOMw_W^)=Nfm&nHg2lA<n&DTwH?I
z@mr}lJi1h&(qFX6Kl^~SCmYYCnv<=jcm1EfnaaE{J$l{e%wwC_q_Y`caWHKz;{D-x
z`o3gFe6WT+S9=4e$Nr5DTGzLn^vhFY|L=3jCAh_}a6%^EF2^k4S+|OAZ=PoQet*OJ
z1&>Y|ME^;z71{7)!CL+*V~yTL0k0>2$~krP|3<%{f^6I8{>OCo9NA*}ka6Kh>8$?6
z1!hzCeyNz@V7^X0O!Y#~$=T1AruAMk*=)tCXYwVYGi%ZD7rm($Lk|Y>h4_9KeejGs
zJJdC-K0!M>bbsvpeQoQkBF}!A*flNrQjxxC-G^BFZFBefw)=+|ADTbw!sPp<FD)N#
z`Y6y@YUg4f^-)PErs&E^1(s(Hu?dx|VO{dY=aSXVUpF;%eYkXTTO~7dnA5afCu|n2
zx-hL|^En5VsgpYmr7Je9+x_dN=PNG}ho{<)R*E#$+|?;4sDGz8$HmBwZC1dG<2OxA
z(na~6NcfvM{k`UQcpul5=MSQiuct+>v(Hcx*p<b-O4meT^Zl$FXMKuhFXn5%omiKr
zt6RIp=*h&yZKvi~&zzW+c78_Cn<Ls*W{b`2j(gqj4$_$RC|_dXG9CRF9e@8u&I>-+
z!K$}#P1l)vg~K-upXvvcJrDU3xoF;$jj#V1GFZ$xnc;Z-b@YY|J;RE)845pG&2`mI
z{abP4tN5gK7UGvqoZt9@>#WSY|Iwea>^4T;zPBxW(Ux^OHVe)Kcr3k^yKC{0UmojQ
z4lc9RS)8}BFH)iN`He<#>E$x}3)fz@>+tit#J%zIs;Nz%mreO%{_BVQre+(KtQCnJ
zjY{%imO<$mo2LD{tSG|Je0*IIUn1AOfLp=*TlV*_P2uhqcw4YCv(NR|7Pe3sdmg7V
zo8R5unCE`{%PKE##iSm=oa1Q;3ECIU-ihsxuTD=mon0TWOzM9{<*#>-zBpIZ{L=hW
z@a^N}leaJLZ%>!k_d9PlC;nm1y7f<3bR;J|lst1T_~}lT_Xo5&q!zZlEnG9h_s;vY
z)h|m66P_d&ExB^i{g**n@kG7Do90=5JGPZ~`}ZvSYgT1;TfY5NT5GV|dsE>0%X!L6
zjb@vDR(tfqHo&UXvo*HqxVo9iy;F}buh5K};m>vFbrc`-2e0GVI<vQKyfih-vthM^
zl22Gh)??9$L0=M<Ti^PoeJi^@wBkbe;pLxC_bYfje?ITp(wtjQ&USKkOPtOqjq+yO
zT<f)P=9($}oTnz5nK(;N5t(q<a!s0d(21sdr)_g>Hq?1`ihlE+<NmapRX;DeV{^Pl
zeMNlwN^!%8{>avuuPlGO%ILpvz%=rr$$s_(_sp5bGgl@4TGr&b;`)vD#oyJR3zz9V
zdFijC==L~b;`$!BuYYS)eS?}TkJMlDY+QLE{f)A$Li(MiK0_z1lzDTX^a?%w&&GV<
z(BCi5SmQE3ENZD-{@eHRr=#=s-n(jKF6r)`%j)Oh5VQIE1<{R(8C5*YnzJ=lJv-m4
zb&Fj)u_t)T#!Rn=TY{!I7N2n4C(-AY_4$&VZ(PrY+ZpQoN~>1dOmmDc;o+L4d4Q`X
zc}2G38%MLgLY~?iI+?r|cV!&1U;6A2r}3j>59`?M`CB%XA7D$nKci&kQNLiDR=W*9
z@_xCgbo_hx#8h&3;oDdv-HMH$_|zVL?RA|#`;CiVsiN1*Q|;jvvu@j#G3qZ@`qOk{
zuf>w|v|mgU+a}CzUuMU{dcl5K+s-tPFZX68ZkL|)tE9bk!Kx3FLhm(gn%%PJdF0v4
zbrYu;{1w*T-IemV;`wSJZdLPwK*x8IW#=3xTd~}=coQh-c!ue51M@!q4Xkoq&disV
z>aD2JFP*(Qd7JpH;+xCkOQaSQt*e+8H+!ae`h35Ao8}%|`?5go@q|tOB6BTL&#<Lm
z`^)wzz#{MI>D;_!jl3m>t=Au%IPCPA^=RRB=F)vDZdx0Q-_Th8>cXxE$Kt&<fAeSm
z*)H+wXMtJxO_p7Mj=S!Z+|*n1S=EAFz3!ygftM`rw;7Z_c;j8q<&-z;>b_asISDMP
z2QTrg=FxR1pS)Q+i?w&%Ve6g)o4eF!-U<6ZXUdLQ=T}?#740!t!RV`M%_c0e>&Y^`
z9a`rPyh(DI`A%i>_aNOjOsd6C{XctcKDhIfyX6c!!3)9h%gdvc9F8oQux=t#Y50YA
zJmyKs_nn`7jmcn%?yNE>E#i0~chZFCYwA<3WfM<z9hb2UX={^Z7LHk(d`-P*8n1J3
zyG72TiyOVlR_VFus!YBz@mki-tT<Mq$qx6V7l{ART44V7rO5q-K2NLEoOjD*)&;Li
zuITP*-hY<$;^`2#1?&4AB<`*<ea!iEyH-bQz~e81MibW+Mm(0>ZD*P;dtft%XKaRb
z?oOX@p4jX_ok^3nEe`yyd1FJ##lj`Kw-lsS@Y=^eE!}!h?sv+)2(D!g7rusj1hg-H
z7HZIJps?fH!-l|XN<XKI*mj;&lR39W&u3X(!K8B+p1srC<<z71zN+>A;^>1fxHewu
z@4pkqHI?JrhGlzq>1<rlps~qVPJXXz=8P`Mu&JIuujMmO-S;`_lh(3VIo-yy3oVYz
z?J(!~vtTN3zry1!>)9W91no-84Yo=OU)yx=$fQt#0`88$&pzDucb&W%8MM}n_leOT
zq1_(0o9CQPH*UYaWb>8V3)U>xGQM*-LCSu~>|4L?F1eN%-pg2VYP(PDC$pNh`4@hk
zd(FD*=4m;{qUS%|-tx}M(tedKIX(Q`p7^RIQrmmOugb8VvAS_#J?nc<-n;<D+->m>
z?E2j{EqTP-5|p(q-?ZT1bj5k8ckbQ$$GhvoNB7M1)S^>r9-sA26zyf#sZV^Qe%A6N
z|C(bSJLWs4h*|CkitAkXZQ(nCb1Hjx-H38;VR#Y!=IR@lWUdvno~z~wn+sW`h2K+r
z@AV<7EVkD@aO#~zmuFRx44RsscrFL>He0<@UHGA=cF*34>%@h2`MI)hc1qacF;UQA
zaxY)=(s$P$_x!rBG&jTLddV~~?x!bZk8(_O6H<|x;>+K5IaKwE-tJz-uaV7h)hDB^
zVjYu(j85J!_<waqBU{DI$(0ko$<Ext%%xknJlEjn$uuQVrBjR#1fO14xjt*D!@|D5
zoQDr{%}x6-RZw^TM`q)-mn^Io+&wo*@_B<+)q&6Vu3tTryyn=73s+6ntDINgyK;sq
zOaA}O8mX1r_8Uiix)Z=v$1zR*W9laEvg|wTP1^a*6K=2Zx_1BM#2Xin2cPb^eQ^iZ
zk!VG;yW6e5sI;k9$Ze5Xr1ZJv^RL${tQ~%Qd=mWQ-;1;7m&^O@3oHBiO>K&l!jZkV
za<{y;j`Ylv|8QX4rV7>vZ?$`wRCHPO7gerb)hqTVY(>eJe5ts+`yM<TE7A*6ZWx#K
zIi>A-6Ma%H^MFdvk#qB-6}R)WaR(-yQa;Hbw|u8@!Jikg>$tZFSpBNcueY22^ykkc
z#tp9~-S0SgZ`WPN!x7Fa-evNyid8H6rm~RF<Bxo^cxfaHyH17TDvb)M?Yp;J>Sy;8
z_fhrI_IMu`ko?#6@2jSq^ap%V3h@nYj*f4cJ@4;MxW3B$&coN=B9`w>=~pkF&Rc4I
z+^TtA^O3h*OLnCHwR}E#W0875=`*n#At|vde!W-`uzYt?c5qCJs*l<p(O(T(Hl|At
zPn$DCsP^-^_grhDuil9-x;R1bR;l0QgS*+bOV^rdpLr?uG}rJ;z^VEQwS9}~b)*#h
zuFLUklbdzywd6Wud6~7fl1lG-y%xU<D_JW&t7|vIv&Q^aV$uw4_txZ|-Kp9b{^4EJ
zy-@aq*e6q_|F%A|uJ-oZswGB+>-GL$iuo+F^%j$Q_yPgb*8vM9Q<m(F2{``V|5(xa
zh`F4zxEMB_c<*Av$Q;OVhjY2emxi)+tXHSE{L~TQkLcvTxO|HIu4@wArkX}6nNH;*
zpI3QLcq=|(Nq5e>^c&)WCsSjLT@KrLHnKT;8zgm1(`DGUFF5nXr75#_*=|pl-*)Bb
zhmE#Qiql-zdmZhMo$J+Z@<%o$`o3XbRL+aVw<7i~F;9PW;Y{iO*>BzMOPsRLX$we?
zP|4kYRETG_#A5!gS6A}h>4a=&dtG+sQ(Qq<cGmM1&*iR6kUP8Qw?guNzG?q?5tAvx
zE5AlW-{c9+5@uky>A=7s#=yXkn_8TomsFaWlcHZxl%HOdm<yUsxoVwVe8-~b{`2sJ
zwYw$+&s(UQZ>Qq5Wvg9u_UcFBkwtmiMMU|XlhP_43D`7U$?*GF?_bWWz-X7Uw%Aiu
zEBX<0hRLtHz0U-9|M>Fj`qSMyf~`WQKZl5vZae2vdMIw1&CRZ--7kK=>DW8z>B3WH
zw`c9GsQdHy)6vi3=Wjj@+wk4#WYf||VNW*QIhYd0y>Ir}Yg6xRw1_h=4eqo^ySZ*k
z=-G<E6SJ<*)VY%L?a9f>=NGMMY0CU1xyL_J&ph(bwM|Ls<y%*9&Aa^g^PxL6tDY=-
zWG#B|&&@LoaptZ;-ZQm-J8TQjx_u?`-o1lCZ@(^-4dJW~l|QxShQYcUOYga!e4RUQ
z?He(>gKKZbr_6slfy-doe~E2LayJFPU9Db_8`cpX%{e80Lw~52*2K6Dsj@9;(=R^F
zpMUOAc>ejgzqfz3o2whM*-K5($lL5C=90zydQJ5co--5T9Abauvd=5;Pum<hsd#CW
zl=P}Lv5PO(o(bM}>ge&S@h(B<{nJ>aGyYAQTBWmkyUc`u1FP92Sc(FgT^IthH(ow-
zQ1bU0kEd}*AFT^}Go`h0hw#BBR_mz`=DWQ6aK7t$$#(DNo%dSSJesQ}bmr3u(Z3&0
z|J;3Ds!HpcLR#d+tA#RJ6W5Ecd0<`0RI^Tur{TRrnP0;KdG9F(^WtOO-W!F+AN>6~
zyWx+cSd!y{J@QkZI-C>U#x%1jaQ}xG#@SOIgl_7+yylaG(wfYG4IjIX-wpYyTk=d@
zSKv-yi*!@?kK^@?lPp_1?2Q~l{T@dLYD)avVVPENW;O2~{%PKy6*Afzmq>9f7HLQm
zo+8}OQdMdEYRlCr8tt*^ubngE&hGVO*daS(<&BO23wy}`aTc}(ySig+_sjJ(>8|*<
z;ql~$78{DAC*IlcH>^P;JZhfz#09QCnYuUB)w>U5afWNH+_Wif!y1Xkt@qPTPE(EH
z+$O$8fPqOZH6i`t8HNmZSLL#OZd`g1v9bv_ICii-NJ((IY7~6&fvv+v>z=D&YbrK&
zW=k@kQ~WcZ{}^*;;;9J>lx>_Z_;<E7Uu3%SD9~UXL+5L|DGzhzJzux%!I5|0cIhiS
zpOq@w$Nu5v%Ytd<oPYT??0j)vrs>_=3lrw0wX9gpZRS@d<)K#Wv*2TTC}*AVY}>4J
zg3QY=dOh))kkFXQewZh1hv`L|mC`pZGNzRAF6(XG;N0oATtD00=WdGX<fUaN417+?
zW-$LcVzXQDjg|)gSFtk;GhU}Q?-xu6k!#8pdbIb&LGKE|hGsTdHv2k<?!cz08d+N%
zUZ0)4$L&n?mfPQb*1gnxrz`b=W37-vIOi5GCEnP)o(ZBE9>!M2u8yrCDJ}<3JWz9z
zFgiHt+C8S_iC36&is$#NZs$I2?0NcecK_>+RfR6Lv(jceh0VHN9VdEX&QuSJSsV{C
z%et>|-QC^rSE;puvy$&{;{R*W-xQSkQ+Fw>x^mmC(V9K;AZyQ!nS!&l8Qk0X3miWj
zT&eD>dud-+Ra5utC$p=LuRC?v_()P`#>%BxVJx{B6AYWW9@I<B_`&j|civhBD@EPe
ziy4&u2>;Fs<_v5(n4d0wu;z&D?fD9SnrE@U;nzuU{31S6bRWlA`GY6kALLuK$Kb~Y
z!v@w{3~r_y(n>q>EAMeQC7+vS-#GbSP=iohpoa70crmSNU7^U2QDN8BnImUz5lT2T
zd)13XgV%d=pI+i!tJQJAH^bF~(Ma|M7jtv{-v6iG)vwt1DEiOu;0x?Aj6qlXuFpDD
z=yRqod54qK(T|I|i^b--S(tdWe%tCWfitB^q2l%dosN3rz$FTM&&g!_@FYmwb}x$I
zv0^b>wC&?$P7~ShZ(Tzgh11z{1I!OxPmR*I`&@ba`$pks3UX}L0jHL~Q23jW`#>$$
z#{Ci7mrZ#pL8h&-3T;Oe`OlWMbK5S7yKMj6@sPI<H}it1t39n}`hRc=^<4Q^t)MWS
zi6M8%%O`>V&#mT}EZ<?dzfQd1NY;zLPn$ToR)j2h6=EjvZf161XupBQ(?d-e6aT4r
z2OjBK@0!7qYVtxuS@&6|59{xTQ*7nSiw$hq6idY&<~ro9&iwHs_#@98f9vj7OzGvF
z7o>Lc#m#hhc~7U2E&1%hol7SuHfbN(BeUn+-tHIIH9m+lcTMFzwo@pBZI&$GCAKRX
zwplw4mTi-m%gd&9Q>a`?_-LqO#n+mj=db^GZNKRC@?wKWQYT*QVo7j0yw7u{nm=bl
z-^3Y#hG8bVMb+N79+k<tu{V)v!g}}Fg4RtrE^`j3o?6D!e_VH;y}R_D`6pen`|n3N
ztkFKAJ%R1a-9swv416XpT3GuYF|^J(^LI)7^NiwRqjtyjKLkpSSRZ;N<YF-;e_>7v
z=kLwTKhKM>ST%O=)?YZm-1opwHp1rq=jNn@n^Say*UaKs5%+A5+kKIZANKHx-1h2l
zc<US!V>VUpl|#1r*_-l>+7j}~K?_$0FEe9W@I&{=j5Tam1!a9c<WIU#_TZpVHP2;5
z&nHuTE%+raD{}6-u>G`Y!yAF}6SJ4~e2q(1s4eA?Wy*{?ADjR9$*aRQcRh}<Px19R
z+wHsG$Yg@tgoch3C;fGIx4*ZjzqY2B<>m8jLE=wCg(rV#wXR#fX@6&M(UjN^iQevA
z&TBZ{C-e9@#eUsj^knB1<+899ZA{6&{!=>i#nb28*Z%u)`sZ%ro>1;H@3?&q8ymE~
z*RR_hapAo<_qSIY8dV)vy;dpW6t_@dx)gH7Gc~(#amx~mQ<KxasqdXTJ$0qTk||6l
z7<Sru{?Jl>`%J^`L79Wxc|&2XEWQe>1dnU~)U<ZGR4vtM+A&+mDs>gFN~ym>#^VX1
z8-;Sp*Ur=FkmH*n8(QS*=Gr%h*?pV94`tshjuVV}`loHYS7>mntv3?BaCJu%>+CxT
zqRk?w-t@&@nKILZt=v_w(koxKK{m5LhRO4Q>>{(Z2X|#Si8TZ{oU*v9!8$`a<j_q1
zUA~zDJl-4P+*~g(#&M^ppJ)|gxiRy-QG1c`X5F`3F9fZ!FFbBJW$<FloR<gur~D6)
z4OvpG$Rq#kZd@Y+m*IgVrVN9yiHH4K*4YT|p0_z&han{H^DOp?zkW{3T*BXPUNXsR
zUG}cx4eywuj!gAZk5%b77Syon;W~|np$Gb`OkS=RO4W~N&=PF3NbmdD)cwyRrpZA`
zg1K<}yvy8a0i7{1E7v`k_)6L#cafdr^Tym)Wy_kYcFi>LT3h~F=jMi{H!8__7r#Z%
z<6$mvofWEbXqvS+Pwk5dFDAU+E*e-?b*j%@Yu;LM3C)TonZ=(TXmY=hzZ$)TVR2SU
z9M=+F{zVHX*Inoe5o^p=%Q<=Jg~PS0$r(ile|Vjgx%4lt_t`?-#ilP;=`kqC=-=`=
z;IR3>fbY69PruIaeOGOAK6!3gcEHJ}SNI=poDp<&vV~>H?h98gee`sH=cdU2r^~2q
z;n8R9`#ya8D0BP`W8}N=hEl0JmS;OZxA$$Rs7hX6>Uqateph?6U*OER<`(t~m!G=6
zEjQA7xpp(}uOyDR=!m_m%=?(cWgDx{teD1P{#tE&cjlJdi|c~Fi^)uw@usrjw8+|(
z{9E;XmR>NP&Gbq8NmSOvu)fr??_9Uudy79+d-2^V`jz;MSq#_xnwQ1t|JR)HIPhVW
z#^l#L(^>*%o?Cxy!qpEV`G<anyt?GuAh>6h=sH<8cY79Pq531|y8GC<wGPRaOf6Hr
zw$02#!SUXSbj>Lb)7-Uena)q?Tf2iP{lHS8V%Zxtv9pr}<-c&)Bq^LZX}IdH$*-J<
zrUr)%eqZC_ZXZ=DQ@r@^jT95-yiAsPJ05%T3aL4MZ#yo}CbVmBUthSs-@4xA+<i@!
z5?<cbpG6+~?Xj?x^PMGM$+q<4=0n%LWLuNs?dJT?k}+cWH}%HJ=tZCN_N-#a$;irW
zf1AKPy`jhNl~eW7?Ke2jZ#KO7@-mNF={=X`3ntAsLnhCQxKbFFb*?Vyyl0fnisj2r
zeDalvVL9gaOf6&0w#dvyhvg0BA_V?AOv&Tg`F@Y6+-}~~SLL~fbw2G_yQOJy`pqJ#
z>R%t!H2sQN^G<J`ofh@v-lNy^4%lXgEM3WPE;cA^q3-n1dVBE?jE|nAPYASQUUqXy
zWP;TSrEgL^WkJ$=kA9FbZ&5qcySTRCSlwjax6yUEo|~#xoNCjpW!tgi?_ZWv9$ZiF
zw;fG5Cw6SPh3C=#{6A+}_1Y%Q_kERQe$&WxKF_xE*~^6-6;GFcJg$E5<9{B`IG+tu
zuVmbs^LPEm!_z!<6xLjw>{jB;dX+IUn(s)&qT^0hn>~-Ny4mtzkCXZJ!nn1~`mT!&
zEH*`zumAt6_0YOg%5$9O@$4?nDM(%Qw{9xy?Swh&rljpX_ih7EHdCe2h8?Rl&nhXo
z@4VBkHK)4epleyo-3NheEo(2j*8F=tz5Dzd``x$A=iBexF0X%oSL9J;8KZfYSznBT
z@0UnVICjpyLrEg2ykZf9=bF>Sn^kx8lt)<oZ!Z&G94fD6zx^h!%Id1B`Twr?Juz7D
z+F0V7f$fFjEB#Lm4}S7z-F@=@s$ZqM+c`R)^A(?6ID^$BC}NB9*3}%G2RNc%d^kUS
z>&AtAap7O?U0<Vopsas+VZ`Di%KL&s_O!`7vbA5M@%4gf@><p@>u0ES$Vu3#m#Ic4
z<ZuNRwu?>MQ`H<^oGs$$+3WH$Xr09jKK6*1@UIFUTaQ1yD6!Rjc8Q6qjNqHupN=12
z9P(!8YWbB6x~D(dww*s{d$+Fl-NS>|6G{%TToydS%((n`s7&==-oq(N)~#hue#B#J
z_$PqB<acSN-qUTiYYR<|*s|5BE4oaY;hPqE%WYPD?xt7A7Tzj6Vz+lsO}4j^$E*1(
z?fvr|ZYJqeh1&>gh-|$WU@D|O?{C#h*MAZ#0+%0c2v*6N>m%gRnK(C`{VmHI*A#<`
zTW?L35Xo4Py7t49Ig3)6cZeU~dSmvR8vRCr+?zJq_x^A`-7m7~jO*>$ZHnpbm-+>-
z?%i#&Z*`5u?o9DR!e8Sq%d~CL3);}U?MlMxAXdR`(O=~cig;A_9r~<#z{xxDwc)m$
z#Ij3QB^L#5eBsnt$A9klwg($7Jm*@L_3%{tG%lSLn@cA@U)HlneC^2>2jB4N8})4B
zPEkH~V{PKWO%ie;3!gqx_)}W;+RO7w^LOqr51)glaw9x$FKO7ddy}jw*UPN=kwJG7
zkJ>f6RvUP3tJVCn%6USXhk{M3@v@T1N&7=1Jq@n@Ja~MfmBW^&k}ksAj4DcPUSw{#
zY_M;`#$(F7_XMkzH(p-3_``u5|6hwQzIr6+!hd7)N^9=Pj``{3Vu>l|XTLo%^YPu;
z!n~Wx?k)Meh51;_1yQM}?Kx}asz35DOIfmKwRBwX5y^w)3^oa&Y|B{wIqL1y-P9sd
z8GkZqb3wwxKeE@>^_F@X*5><HeEe|qhEh{r&c(1NJHwm4tv(~N<;Rv^wRM|T8#cGQ
zWK8BOdLgs?w@~ano|e<w4U=zqiyGHndLt2}_Aw!U{>#S&-xco2@UHO*myeeH^08`S
zQ9)JT(@m<DHZBRAYnX)A+_$*!g;7@QU6t8PDU-cl=3AF-PhbDHE`BZZWA*)aD<#Vu
zTNw`>WV@1($6a-Bzr{(uq=#$=SZBX^E~}L&KJoT8liv^CFX-GS_U-Z9_a_<a+!qvI
z{N?-KfGP8e)yZ!wg&P|-RNPm%pg1Y7_Tr@{)lV)S-QRy<vdcWB4}xV%*JIf|%kSLV
zCaxc_O|U#?iNu39FE-c~sc<{Z{<e7!=WC<X%y{qcr)nN)yPDNm_GM2tSkb4()}poa
zqg-6x<B!a;VxR3!7x2}3iUxM1?PzuO|NF7uJLFHyi-i{ZuZLd>6zWl)c76JlX?fB)
z2Lh@x&aHIaIpJ*D>hnvuwohf>y~vs~{B65@n|#HAl*6*;CHYKtZoRwK=(XLQZJ}4!
zFR1t%{?>5a?RoFa=iO@aUv9p`c3ZW?tCL&#J0;#UeAGE+p|M|8qVa|DkB`$5(v>2)
ze=oerJlA#a@3_T3^nxW01h4<GX_|MA%yq7-|3z}=Gg@<B?&tHi{rSy2>BfN=hMl}=
zY%vbMKb=<PukU&~$Kf~Ed$Zr)H{Jeky!UFqU}*3rqceXvOx7vX&U&)o^VS8N%uD7u
zE$^6?`%C+v<U@uo$=iCnZtUUTzkC0Oh0E@mG$%C5CmlaHi$Cy%VD0?tS=XH#92B0~
zZ7UYke{(kQZFqBu-}<X>dNo)|-^TMsxo)w&zQ31^DYEY3{nI>B+y{joRqlDKx`4Ix
zUg)#lMSc9gLwkR=sc&MxvvkeJ*KrE^xxxZ(?5ufhxy~Fv=5AvuZ+hXj^0z)Kfs0{T
zIvf1Y)NJ&e&vMbAN2A8!O7oNEcT3h*FO0q?fA!@H=g&41`SU+%yRM&9_nzxS_+?)&
z>7C`%{=Q=IobsS_O~efo&-*>oFHA6FOj9_jyZfnV*uVF-Ilp=Lwfj8D+;4s)_rRBv
z8$Nu0cX-ic{anrK3P-i?l~y=(h3f8Jo2htdO0u-qoU0GIH%3i6=64};=EU8C_4d^&
z8+*@|b8;{FwBpqSzTegd>N>7`>y}@*^U`jnJKF^^bT`ho*}7`s3jPV(XC;Ll4G;{K
zvgCTuD8wdpltGI3?)lYX%f2r$`?+S_@g2@-ZcOSuEN|J>c24SP_@h7fe%+oOS8OE~
zunYKHyfQ;-(%sHt^&Ou?&uugM#g-TKO@DRswhPltZ2xV!<a9s#_iG!c80Y$99_y#Z
z|0pZqj=SB@TI#-4b=P47--rb1j)V1#sH1bY;x;ULsLa6dc_qf^Tv2LyQ6^+-<XhY9
z;>T`9_rGcj<gQ|<(tNkheu+@%i;BIw_XVHp*Ii#TUF2|+qR^BLOpH<tUpu`1+y0&L
zoyWoJ+OId=k>9#l(yDe<SAlTaJXiU9`~R+AoZsadxAo`6lSb=zC51jYTll4Fvaa5z
z#pl)a`RBRjzdD;6JSV>7;&c7@zuqNP6W#AW%Z+tC{YOjx^;xM`uCeph@-O)C()FTS
zZ0vNwKX<qN6smK1y++IIw$bZP8mkxmS(dSTk(GGBxoxgHSt3?1(%Q9Xof`XjhI4^a
zbf*W3t?e>$7l^!)dbaZ3#no!@*TXIMW-ks6UjO#`mr3>87u5tRmi{kvXuVvr_3bv_
zdCLMf-n-(<9uZnPJ@NHh#_2Ota@Ft83yBThKD(xo^@01noLMseWZmQcR(v{p`^%TF
z{Pk7kv+DjnF3<P#-}nFBVT-D}W%;kNJipX5$1HMJ&;LIqymE4B>EZpHnpxNCKJL@p
zAbKpNH%3X#_eFN(9M2;ijqmfsezGO@EH-<;ZT6Q{XIE=Gw(9KEd;PhP<$U+DbsG-<
z_?s22yJ2%w<hxxb&DO5ieJ{m#w)v;4nYA;WrPt3^+x>T4+_N8FYq~caS-(y9oc7<}
z&g>y`K7U`opx0*gkK?<Ijt505ADE-_^ZoS>o(qbr?yo!lN@%}42aDY{kL0_33+)@P
z-45ILBF|jIFH(B0oQ%lo7bQi%?!UjkH2>e9cW2}M_Wi#6(UC=7Z1S@?9g|Evx$X%s
zef;8l<<6hG@~%a;zX`t@6IL^It7T%@293?zdh1TCpUsrDVx7mEd6I@)(i+{#Pj>G*
z-M{#C_Z}xj^((A$4!7APSUJ*Cqc01*(EDV{$M8d1_m$}$w+@D-u_i~CHP2hUsQ%x#
zyX+Ho%ir4*krw-H(cTlMKY57f#mgM{;FPg4OCzzX&sJ=W%Fp8mj+;kDrlqIa&E6Vo
zT>isY-qk&x!7x<sq%()`=9wyXS&s`v<Yl*h-4^-e^rFW37vg`4F!U8(Nx!{m_A%j#
zJ?D16(aK(CDDdgq6ZQ(GlAL89f3Ml?z-Q3Gk#N9c&FtHrHc}bi*WY;;dT-9vTt0gv
zp>>&eobKAZouz9xg`<Y|&$-m*_gYIVg+dos-Ok;1Hz8S`W#aUs&ouI9?aJgV<DT+x
zGyB$mj9M-{EWfs~9^KWG^<uB_1e*z>jqbZ`lS6K0WGOA3uYSkQNV+nvB-O5W>5@en
zjbU+IHl9;B>;oP4x$k>!{xj+J(+dV$d93Dz>i&CiZg)se@5)Bug@^7>o?&YEX@QQz
zmfJ6N+Oj^z2>r?3s}r`}tMzyr&oYyJ%U*pyk-5eH#<p~wOs{<<<tM_MZho2klyhg#
z;x(t%vuXu0z4|70aiMto4XOQ>BC=Lp<qJzxtQ@|uO%di76E{7x=j|53*hz8Ew!if$
z%GTRo`0?kP&pRFY$~nC<ZI*reZRhh;vthy&&Qn&`^!CqjxSDzAO8HHxSy_uFZ!c@!
zec+1poc{|Pn~gV1oJ#07%l;FteEfWm{12`DFK6kf&UV;SK2PN8Dz=rko8#AamPCJJ
z-<W>2Wo^iZ4Repp&*Xd@-t<uaM#;tGm-_Y0j~_Ds-LdDM<rKa3f;De?WCZ5C-WB;O
zGUdBKQ107{ynPK^G7b)<i9+WUkMVup%0GMR1`eJSuMM)ot%716k_$PLruVp2FHq#=
zoz-!|PSx(6!?Fmiec2D=Gy{aZrsy0vX6x+zecSE>CuQBQKU}ubzG;@F%-amtuN%}o
z-fw1_V!LJaF6k?uL&NfTGpkN>DXlWkIsGU&K+5{5m&P>Z!1I@`emHmes>iMc9$HI1
zuHRLxmRi`(JwHQdYOk#iS9!-nhNMX*>%;#|y5F}`JV8uMcFT&@p@sWW*RaHw$p2NJ
zk@aNP9)V&V+xRupt*bq!Y_DQ}_3~cj@h1mDyn0hIRv9~GZMuKaT#C1yHKRs*5oeY6
zH``ZLFBeO;HErpxzjx@(E*7<|$0r?qP`7aT^kts2r>{2bD%R#n`SZY8>huBjKg9`G
zq8lt%y;|Gj6+h|zq&04@IKvLK&#swSqqa}MG9j^kS>5LZ;|CAe1<oHlrvF*X@OAGZ
z{bd)Qhj}K5DP)Sx+B+*+wctfO7pJ3hte`pL%(&)VR^N_@mIyJle%d^}c+1uTHq&MK
zLZ<5{$u!4&oVrFseshhS?8J?IeU-{q$Cy>x<}!S-WcsDeaXV<QL4!i!gWG0np4kMj
zX0GCp$zCE;@$|A*m!}D%+O%tOt}mDy(iqD5G`gw|F0zcc^4DS38ivF7%5N7~xVM*o
zZ|^w0i=kgkMP|eL^Bz|fkCuP`xS)%(R?X&=kWlMY6<_TQlP;B*a2fVWTwC;XerUJN
z#4nR>i%gjASmd`#`<1PxqsJ{5UT>98@9eB@m#sLnzDw0+*STBllQSl=`)V@Xyc(?1
zQx>3?nzLM{LoutUb9JBc7XF$Cn;12%gEV$tQ-0!NG|he5gExg=_OVS=ye~L^`+~;L
z3hf)e=!+=3ZhW-Pw`_9x?PXnI)?4o%Yz%hYW4~a5<E<bWHO8jCz^9YXuTM5UV-*-^
z@23$lWx?&%|NE!>SN)Oh@~U7-T4(-6+k+Fl-irh#dS86`r23JahMHu9qi#b|QV+M3
zqjyliK8A_^mR=A3XuIF<WBH<)&$Ib9i~Y0w5I146T0vlbV6=$W>+QFBkM%XYk2o0o
zw_%&&Ij#>DT1?6JvbR6*`!h*m*SX!@RVyo2dc;gwYY@7O@BBR1`^|Fc$M+xDkry1(
zxJ1ZASN3l*W1aK*f(wr#Ogj!cebw!>J$L_S&@3m%oLDo)OZ;wAmKK^_U&cJ+iRSF*
zN1~V)X}l@8a=}50!|L&o6S4{=ye11f9y;~C{Ox@5;Dxs=ZCR|vfkOKi25jZ%(|)V$
z#1$ga_P|JSuXjb(T<?Vw^_6%$axEq-5lCJCMfjoCqObn_d6VZqH=oZJ%hW$rzI)xm
zdv+zhi;f+7;VB~9BT~R6z|6>`&Ck2mR)jG_@!gUI-=2gA2fSSO=5@sWD}Ua|?)W92
z*jFg!xnsXue>iK=l-J9ie`^UkyymNQ!p;SUBNSiGwwYO(ZhHQh|6$w3k+W;n^XvJ~
zRIl0dY0_nb#q&eFb~?^JdOtzqwS3!2<F`MbEq#A1z%X&%Z3dR^1%ExeZampzb0VUU
zeZ{AY4NlR|4m~bVKlbs&I@>_Upd*%dG7K+mlU6h+{~fH`q;|=!FWu0GF(+wt`sa#(
zl0VZ*)oYAipUDoHnW@pwXxwXXcD0!J8O=o^CQX0j%yS}+>Mei0`>UJeqh+zallHW)
z%$qv<$6f9Zt%5&NyI;TI-p(v0{_~NM?ky3UM{9f}qMzCSvRsiZpI&pR>z<tN<lc!*
z!R+?Y7wv2>pSw0$!7ye2w_S3zciBV@tgapZ8E7)sZGFx9qgyA>&DuQuo<XtCE7@Py
zMP4m0kg03j6+UOS`+3jJUlT2F-H)v3@C)_285n=$!hwWq&Zoj^Z0j~yUzz9Z&11E|
zo7Y@Nw9VRWV&W{L7c%Z9Oqq_y7qr%x8wRXUJGiE1qRSThZwqv1ESL7^D*Uohf66i2
zidz<eVf7w=t7;Ez(GO<HI=`i?L-B&?y#uZ#wS8?(JYlPE9Byqcj(9ois@#(VBl#Ro
z!8=dFw{4OuW9OB%y2B*8C3-{2rsu~pSHG3Mdwl=4tJ{`8{Sb2Rrm)YvZz{o-l1Yh^
zC$RYN%wD<q)5n$1ZytYe`-yOtBiGbp^(n4X*fJ{q@N7RVZ&&%-ddeO5Uzzhg;v{F=
zr+ht`5?XomnwGuCO<B>eVZZy2a#yXq{<nW|%O=i9xwOL5o{ruQ3r|1ZIZ;R`+vDV>
zh?2)I-pzacF{k>xYpPh=)p=fS8)q**<;H!q$i1=l<FhSlUa61fD1Pl#by;pQ^MdHJ
z<}aORG`sD-zL|K!ygTGUcf4h)_mT~f_AZLbmfBxBR{!{N(nmW(PM0U6@?Em#q(3TM
zD@^Vvr4`N9N?&%B(KEfYoU!ao<YZIU<r5-VAN5PB2_1`hG)-gw38_uBchp~3?R@HG
z^C?u&^UmLcdkuMd_NWz`<P@Eeh`)17HazX>Pcv(Gt0fbY1WqxV{8`5ovM$87hjo_z
zYrWX3x49;qzr9U-pO5N`#zRlO?O~a|CN<J%t+sGwQuJ$)8=9x4=+2*acbQY;7nAcx
zXZc=>ZOIIl(Kq3<>6dCfx7~GCu9<D_6xY(3apJpJ*VolGOBu)B3%j{%dhpRIW}(a9
zg+l8i`S$x(y0EO6!pbJGQBy~Aqm{#x#+$Yevfu5KJLdB9ia1Mm>lVkQ@@&hz4Tb)?
z{L+1qn6Ccu`z=?k*169f7MAFJ&$*D_V;t`K)v(#IuiHU$d4c@p7+(F%XC-q5S%sQo
zKJAWOa^bh{f`I#BQ(Ug5m6osjJ~^f__rldF>UNvW7pg42m#gt;>fTOO$+PZ!|7Ha&
zarnQf`{Jc+#bmW@+}^CaZk4!KdnGh1dB1heoUOZL1YB1!3Ne57m~FNG?H@<mxlyG*
zRtAS?Dy`PAzv}w_?!DNnFN?ej1FE-LGN1nat^V^Awhrk{i<f%*u<wiyHuMQz)HJ2L
zJV!U|+FKU(Z%>kAJ7&yP)IQd?fOEAoOM~~U#TQqE3#c<$D!VN->@skFW83d8EzI8|
zwKZ~jV&3u_?F~r`5=YX!x|#p4x0xgQ=V)%&+a~?c12s=v?rso1B60kW`xee40>|ec
z4f^Ataa?d#Xj#a)mnZ%m5#GG{{X1WQO_4Kaq=?HinNALUZgyc`kg;0lrRNQDXFGV`
zSzcaKVbPg$C7UJhw&!hKM_C__^=dO5tq#7*O=^~Q-(#KsYv)Zv1MLY~FApEPvQd%U
zy_<F2>Bo<FY<HeLy=k9cQu5ro{ap!<R5otpbXTmJ7<$_1f9i=_>%?@Q-mpF)w9$~A
z-D+9mrG)2#(rY&zid+}T=-m2Du;{G)orW2F>w}_f`K;b1&+{vob@kl-?uyf#%Z=?H
zZ#8g<;CI`oXe=@N=(LTOVhy`1Uo;1txiEd!{qILJSJtZQWp0?l{UTs(hMa+!#<O<i
z&HI}&x<vUu<{f8h*GOHL{y=@sM6XRpHwn*=d*bV7*_`dL_r{bg@oblUR_$+kOhk^|
z^DhsXd*O8P_ROGFd)9Yb9nNwu<x<<ZKv#P1o>K0Fa8?7u+ZE@nrFTCwJ9W<ZK%c`x
zll;|>p69-MFDd0df1-qDtUyL1S48p!{p3EQub(2nu(3AYI(_9{XztFE=W}OYTz*7Z
z;{lt%?1#^^()?Q`56|5l^!#Y)8Q)Ef3-+F<Q>pGy3lyAuXyaGTJ>eCPEKb@Uo;vg9
zVa6D-3o->?4MR#zW|y_JmR;umcCFywr@)BpnR*HPUoq7#U_1F>SJ1`Pe|e{vZ<}=K
zN@N$;>91*C+$RFk>KoH%ELypIdI9h6$)1)a&7!KD-&o3L^uJzpq}D)msi%5YZuXN^
zAMfQUExtK9?kaQqtl5c^VsFp7(zay9asP|oR&71?xAbB{fX@?yB>(0*v70YeN$l3w
z%#SbJqpEyrrA_tmiwilPKkRmXzEM)DglVd+-PO6rZ!~N+i#}Rz{{8aFbi>|D(i>-{
zEOXjfyz%q-cWSwu)@B>u9#)+tu3WriPS@F=S<V{{J8hhK;7*O$UttgVwu0ug!iJw^
zZ#CPio1cD}=ItMFgDH5cSjLt1CDnn=FBTru_vYf5$5Qj{rtG>EF@1fDweRgWY12PZ
zvc|44YfEcvUcxT<|NGb1uD|*I?e|4nCmfj=&UonjD#LHyotF-?J?_7n8X6yd?3#D(
zWX3fYgKzqG?_xTiob40zgVFh%J3r@qua=DXQ!QnuQs&0|J-%0dTcVF&-{TJtGUcq#
zJeB`BgUv>=DaUns+0$)_`=2fLKhs-#T)RqV!6k;HzhBCJcw}eR_C8K3t3Yj{?{DD_
z2Ju<uB?V7y#h2xtex{e%z1L;&ER8MU4%SPy{;rXbPx>Y-=JuXp-{Hv@Ph4IoHA&>(
z1*;BS?uCI5l-@Ahzxp@rTx35>$2x~~e$5`|=9oQyHs@1mpzd4W$0=qj=RRJwV#6|>
z>&y$5FMQ6Zwn%hI(<iac^NUKWZ@Z;ORx`>y)$Q5Co2S$tf28J!&{59Cllg2mZ#oh@
z`&?qpQT-pLQ;HfMZZiuBJ!_P|;Ycc<*+sGGT}pOMYS!ytiT!EaXmO6sS^uKHe%v3H
z#kU(%KeEakEZgmH-=JBH#p-%#ap&2EhZ8R-ng?VDe31K~$aAZ6b<+EW9>a?z_L{d+
zFD6B7@qRaD#y$2ozQ;Y?|2&x}Iqkwq+mEkvZ$Fe|NKk#q_VTd!2l3S324!w8H9MwH
z-rb%f)pS{!{p+M0-jzXO>$My*?<hW;G%>H*?844HX+Jy#t&6G`6*JFfWBtH)NAri=
z?_=K|7rZOwj@iTe{8RX`*p%mizs@#nnmqZQ)(XF#ie>w~%^t+?PMLP%7JF?kPjA_+
zl+f<kL7e>C;-=MHJGtx#2mkY#Tjz<*ezEnf_qV$-t50jLJfj!9@RDJslcu|bpPb40
zKrW5>2Ml*>@SF|XENFk+zu)wFbJPj{sT-d5m3o&-pSZ=j<egxq?aEbhB`d5r=kq%p
zK9svee{Xc1K#9WhD^Dk!5tBP(vvs24qhB`!)4VsT2mf*FlAHG<Wl^TutJafWE!Mrd
zwM`*Yc<ZJm=Sw=@zng#e?(rh|?dc0LT8*#evaS`ea_RG%esF^k-;UH=KHkT3#PVXL
z#c!AHYOs7_<Np5t)3|lrCR*P=#cY{qVl%Pp?X*W%=Bzb%wBp<PHz&Sia!>4dI{Bl{
zFGu!>2_;sl1_$04w9Bv>3Cz9DJul%k`wk&--H1@%dAj+^$I2vsheS_#pYdGRsZd<X
zC7Ew(<1_~L=~hx&+xCZlGrZG3&m-?}$)+3g@ACP|e_GeSWL@9eR>z6HR$Lqr9R@Z_
z+)i5W-kmjn()$-|;SFmJo+|X2zHj-2<#KPDwIZHmo7k1UdvaXezlC|r+$LkgZ}-2y
z$lZSW$)}tJ=g)m|-FDR2=H-zY>((9JIm7&3VB9-(n?E~+<MPc^zc)@g6;Po3G(=ug
zP4QIoqTY>r_iEJpsyA5$X-aKV4g09#vnFZZy$F#bJL)aE_FUe3L9NxI!-DIpbKv%E
zy*6Ccf=zV-yf0Rq5{|jkdR={Kclnx_m1lLHJ&*iiers*nv`$s&jSJpRdo6i=mFCvh
z=Q9s)VLtGoGIg!+)vKab%ue^WF?B|z95~+0_Seqx_jG0bGq<uooL=@#Bj@|4r%R5k
zF*WJ=Is0j*<db^Ay-N;%Ibm#UT<~VkRtKrR$v4{AQjSW#jd0P8c$I3fmofO=<_SMV
zrxYj7U-;(DU+4ObZ!aaSoG^92b9O1O+}W$o+-@HfJ!JdpY|pYiy0fa@78&Sh`kQ_|
zJSl9}DY-<?sZtM)D2H-CK4Ik%a9lZ7H<2f3<Es1O`!{S9msK)mv=Hz5rLsdMWy#+6
zeTnZJ?=D_EV_Eft*k_+?Qh9zo>?}}KZC<^2*>>ONf5OWztzNa~E?<fKRo`1_3x(Sr
ztT%R9p{K{*A#&u+nxp#<Yj*m)@=^P^J5u#PW#rxrMukTLclLVJOmJmP&ywWoXN_Bz
ztCk}c+3dISKBH`0kO<4-+9}7Ij+<ZFdGCk!yztoPxuWGYZ}tkWdQx}8%(C6;WrVNI
z+g%^5kG$+)l#0z$=A89n14sL24v#NS`naRAOn&`Kd!ln<Ra4lN-^bT!bicc1r70?X
zHlu%y&kw=Ur-}c<7EHQi;`lK6rwDgP?16VXdu{%oVcX1IwoHseW6z@Zc{%*Ib}o#W
z{b4V|-ZsmUh`pY1Y$}(I)oLUu3zQe$<GsZ3me-k=K}0CSS~GTT(uV_QuHKWJF?n};
zQ>N;?{zWd=1$O<bSQA~e|A@`<GKB@&O3OknSR44%&2v>+Znyoa*6X%Qp`0h$3r?Ip
z`BHjG%-c48p4k_|@(%_(8`<%_QQ&#hz3lw)&KtMvjxhQxOSmATv#t4~Y2MP4tDgoW
zX|gYivb5B;V^Q9q9q9RB=lsu}0#8+H?mbC3Ar`lVbq&h~*{4<$0+yZ=OjvmATknw#
z${H%F4L;A*p8Yt`vUyY2dy81FCExDLe||5dvEtQliwA2<GWI&F@A!RG*J55|d<(-#
zIaf}@vPHq%%Kl+-#fgS5_x>x8>a3iYzhI%ogw@}gxflQ7Tslqlo2hct(zdPf|BHC*
zY+7IGPk+-QbxCuTM~3z~&ck*s&W5+2zS<sn*iVJ=Y}89Rz1XsqZLQKNuZzA}m+5N$
z6uBJ`Adq5xFXgX-Jdb_#kHl5WtCr78d%JeZ|C#67H;CQ(G&|?w$>Q}hCx2MRa4+BJ
z$}2IJr++pc7dKIsUvxS3XZx$tgV)_(lm&iX?6=OPxPF60UCOf87Qb$!o4?+Bls!>4
zU;A6YnJ-&*ZvEA^%UN|w_sglfPaR*hZuiCtP4`9bRy7DQ>m|(nuuuHwM*hhvqVIIB
zeOvWu(Wm@V1@_Jxy^~Fw%HBj7t!g?M6#65Ky{_%ciU*B~&Sws_zX)2+%ktoL@Sh!4
zQ)k~=7|eX3mh1bKwLe~V^L#5)bZ7iNub=m!@$%Hq9}m2FlU*+u=)=QsaK@uLVa7T+
zW66T>w=;M?Y<}OOAh7V@_X(bi_O-&yOt-U>3j8$+KDnLS9rA0-aj~<9;|@zzHS||H
zeLiKIrZpq@<qoB1Tg~<vA3ix{$MWybWas`6pU}iVyC!f=Uf_ayqXmDDaD`Mn6PYOB
z`EkmniR;ZD9G@>9e&y#MV+Na!v?J}NDc!6umitAVjWqxGie2(R%gcKQw(1+qdk|Q3
zvM^D|f3f=w?rnK(g(f$aTAgoI`FZJvQ$mtl*s)FSRZ(*+PyBMy-SyHrJm1esu`F@d
z)6(dRu5G_gJz>^A*SnZ?hsuN4ud2ZuDZkIHsgbqwxx8rY^+)~b6~~rVKS|~2j*Gkb
zn)TG>8=GrauXp=A!B^M*+KI=_IZj6nb|h^1o3OWezTMqqrf;oEHbql(Un}gq|Iww5
zf#==1g)fg-&U{x`!7AIb@Wj-qu{+&M?#nQqS~gK~`kFm;nL$tO6lI*8?>N4S3|Yo>
z!+2hD;rI8Fmp>N#?>$}?Q}ey+<DTHX-=#Z0KXK;xEBJch`EwO#?yKs2`cZLw^NSQ!
zCGKTjhb6h@PX4oNkLcvzMKZeCF|LO^d5q&3B4sNI%0xVF>dsO2a>@E*DyM(pq3zl0
zU$@1$&GFs5X8ViPM(kpe_m8~UaBzmB{GPbJ`SCKV3;j5L`yR<DdyyOYynl!9m+Icz
zJgc7Fk9f1pe%&SUOA<@o^=~+49}}_ITt2nGh2iQ`t9I*2*9G5Bo{_vH@04fPXPtRh
z67;9Nl$>YMRQ*Nm?KhpwM>hjaj)!asdB^=FxM~ISOmo&-D}+uJub6uO$;PPN+uo&$
zU7lnW(fs*ivW?*3dwR!Lon_bEx^!*8(Hn+E=^Ei}UsrqdNZRZ@ZCbi-(c&h9MAaS7
zaxx|a*f`v5`P;X{dVyrt;)QLC`O_XdC$i{lKQ+t0LFI;@&??I#!q$3@)zQoiPkYNY
z@;FMks7!L`-0?9_<VpB#EvB_T2iTPsr<`?4Uv)uHq}}Sw=J~nab@^fUd)O{D|FXK4
zcWsKo`SOIyXA55(O`RV%%k{xCPL`wLiu=yYFyT4LGqqZ2X5gyx(<LYWU|@2b`Eknk
z<dzfHt~9RRTb<Otm!Y>Y@nF%B(=y$Ya~c=kTJn9tnSXkf38DYzoPJ&;!qJe-{l_`2
z`g~-NdR~<0`n*M(_Vzu@Zw_^+(#_dCw=s0$1I+~@hEvba37sOBe9g@1#)PkHCj86j
zN<O#hm~V2Jy@}6F+bX3E-@nYXNa;6|IU(Y4df|s7pT5tRNt^cLIPc_Hs=N2Ry&{&(
zFDEZuw#J=(e*KH-m)+-kA7kU1`Nr~F!Io3^e=7&Pj|^q@Toii2_H&nr_S`?r7Pc~+
z;rylhzqX$eOPYPsL~HZcn?}qp%<mSqJU4t`9<}kXeo4UL%8RPX8*huwKPYhauI{|Z
zos9bvc8hVhFlqg<=u2C)G38*{$)@v?Gq=nZVmN;C&C`qf&(7~p+SPy0(wpmTzEV@!
zk(mLLCEtCUd0|nS(Ebkhi~ARs)*EjN@LXc(l7B+!)I-suXIJiXc*MFc!E)N}JL24%
zN*D94Iy58auj+JZ?<QGS?JZ{%_OKtGR9Ic-U^9oy?yk)2Ki+vqRE5vQBuVm5diH!1
z>*py^w>X6E=rMI1PYL{b&+>k?=e^lgd)<!5ui3chhm6t+XXOQp@7RC)?Xy32uHD}B
z;-c-xolH(&-&8-LJpIJ;lKLMX?_J**efyN8_r4CTjT1#)KfK3ye$|094F>*S4mwZi
z=)bLU^xVp8w(r8yZcIsKnsa8?I>(=#mGgQk7v8PexZ?DKV$0jd+V}-Ksw>*VYj(BC
zURJrW$u>*q=|`)Di`_3=;lFA2vwX`H@0JS>Bqm3=m5M6fuW$~I&ATqT+Uu6swkMbC
zLVRtexU2uVzcI61Mp56mv~R(U$<_8AKWtb&SK0?`$cSy=t99(~3V)ftZkJcyl1?oh
zn+rEzaeAK1(D`Y2lxN;W=D_0@q8Z9lzeoR0Z`rNDUw2IPTHE%+!8SKIryf4PF#C~7
z-8r}JKT%Q|8`tI(n9cCKb8~{|-A;Dto$C+np7S!JaF+E!;i~iYOzp-ZT_+Fa3w`}F
z>Cw@Y;AT^$<t+PWI8I%2aCV0JiLJfCi|;!uzVTyY<NQzh%x+Qb;sGb7F|)R~Xe2Z$
zc?I!&<BQDObUyIOhEVUieJeMos_=1b*ENaC-NLu`;_DAgOT-n}dOD<wbzBAhyyMfW
zS)UPq`^t?q)28nJ&a~>8Om(8D*tPVF(tfRzUS_r^J-mC-&Suuuzr7U?*VeZb9bjB=
zRqMk$ExpF&_m4_+$6nbn!M=C<-B&N-AIqIjOpddVYI(+Z=xa~tgFTujTduP0+$rM`
ztymkkK1^3mm2cYf$a^<D)&%P`U2<@^sj$?&bM1o<ha1)$PX5q*H29{+g?{DzJ|<5m
zCtr0BeD?m|sm=`ft_L&U$jff>)JXR#c=k|HcipbUX}{Ocej|1N8&6`R$`pgbGPf0m
zEKfhGPI=(OJ*WHD&HEN5lFOg1^uF!0@R3a8{8)Bx<;XHmK}($`M@b>+iCG7Y6H7$)
z7RBrcnzmr(#Xuj)%5tWYl7|*>7rwrvb==Z1<kn^Ld*9~9Z9X+!qfI+nUFBimDo@9h
zE6K<1OFG>Tf2v!~H?Ql;tKV-u7C0}@2tNEU*Kyj~W5<?TH&zwyGLTn$lys%Npqb^c
zz-H^@xMWVr(=WUIas`B^-kg(M*DAjIySUw-nD_;4ZRN%<nC}_bzqMTJtRl9T>znbu
z13UszVk+L858h<;`W@|`aO3~V7x&k_|5J7K+k$n1E{_f=n-uy8^%}9MPT2S(bW3f{
znTyqDcX@enq$f7@?v!`>ec88EXu{dOZ?@Ten&<D^HKBajw#Uid8uJ@<cx<eXEV^ow
z+SAq2|NeqvT<O=&Vvg?m3tjVk82|Nb{j(>(>D}CL^GC;|njBRQ%P2Fw)LJ!r-R9m|
z(K8yWq&M%7;&tD=k1uel&(+YtYjZm`_5HuKF1P*1pKcM+IgL$HO6^OJ-ZzYEZ~H9h
z>UU86;O)Lii;^}@2|wg;{`^r<!~BPTd-B{5wV&}WHSO7;!)?{dpIgV+@%zlFFX71x
z3YPqj+`_;=Lnz7M?*127zAlN}!WMB;^~KWHHpi4jHhI5Qy<75%!-0pv+F+y4#go#P
zHm%+j@oJUjQkA>|r<2Y%@y%NGqT!C&|4QznmSa<x1)bgI<ZnIMb<DDSnx&EUv!d%x
ziWLTXcpDzOSH#}6_S-J-=kOKN4|W%pu6n!fk;#khH(kCDR_}3=ekqd^C3vDp@A$!W
zV&O-hemWvt7_zmJU7#s!?&<LDv&7p!$<ESB$=NfpNhiVY&g~0pyqTSpbJVg|EpI!V
z;&LR_P_ohF)QQ~=p@LNxszp~geVrrU`P%Y1-{vEkxBAnj*$4;iH_VHhU~$6z-PcW@
zYB#<~TzY)#1>TL<B&M7Gc)OxK>qn#e%>PWg?lNDLcWl@vt>n?@vbMeDXw^>U>c=gT
z4>`RqRJ6`C^nQ8sn9hdhKFSp?+ZRoJu(<iRdP!5MOl$NR$7c^1Cf_%U%K9jhH8FtK
z_>Wjx<i2peFGmk9((zdGcBMCOkh|cC-=XJ!-`5N*YHO{~{q@VEe1^Kmt|teg1^LXq
z9rRC4&;H*!<H)SFuVzks6;<?wb^E$c&(@gj^u5Mf!Ts|5ZKjZg1-ffza^1@_e;GPE
zJlu`JQ?8sfXX?j)N3MB_oHuyaID6Ig4`<j-HomXla{lecD(f9z^3-0|hOcgIn`ZV;
z^q%HIr&Bzi!*m^el!J59(k>StjpepZH}!IQw3Xw#Sy6e{WNpK&Nz32bEN<AU^RVjL
zrptAPeXopd{@IlDU0(N0JMjAB=`U0zYjoDku1^t<%2sW(GkX{FWu0P8rW8l*^(2FT
zGF}m)3WiT}9cHx7aF+hhj=Csl70<6}u8a%}hnW}{q!<{Gx9lYrm*~gGXXa&=#K-Fu
zRF(!F%sS*Cu=jm9PsN9%BURZ8*;lV!5;0ZEd*PG~zQ@uOXGWHVAKd?5?U<V8OF6M`
zXJ>y;yT_NXJ$4Vf_Ed#Po<kxhS2jBpvm5J9=4pOep~Pm8UTgNsy4YauojXob6!$Dh
zZ4&XHv01N1-eOAYhbJ1rVv}N`>WwW|o@n|k8-HmP3!l5!oTN!Ri_#U2hy)k#Jo8X^
z$<rkxm3!fSTz4<~?T81VtJuyRcRI51%x8<X>K_6R&KIQJoue7L^zf=VxfZ{4TY9~u
zV|6B8@Hj3z<&;K>=H>9Zd%4%5gL|(!-JcQ~dr!V^{(%iwBUmpOpF3<9qx&f1+pe0P
zN6Y_K$+gb@dM@0))j~oq;f@zm$ikZzFY>N^kXo+&+5WfS7wPL!%TGt??ytJIYu!z&
zTnoql4|$jW=2d>-R$KYKrRM4$mg|>RFJ2=R{jpmfHSl-rIU8ET$H36$#=szp8ThDY
z*58$h?Z0jD&UU|3yPe9xWp3s2?-Cp246Ntw)!p`1WbT&o_B#gxa#9!dDW|JeFLPY~
z|F1{wjY(@$jQq+AcQE88M=tT`TB0%OrE$^Ue^>42?|&#M++|xo*EsN_X!@s~Ir*8}
z($3d=#r4da*j==H@}IKUiSy(B{0KLSH~utjWzd8<cQ-G(lgH2((v#<AP`U3}R|;$B
zhjLA=Q>{v(4mv9zNk(2(T3w-;ad5S)V9!$>^-#|gT@F#}L#{`kgc<#iE|@CB_IKm+
z23O`Ou0~NOi<~c&gobZT$@Kb>7JZ6K!6h;<#--P-Y)#0!*|$vNSKpo19qlAKv!7>^
zN}-2Yw3g^(<4ulk-22}6B|MsUI!NI)?*?~`OD~uCxv|(qC9S_L8Gib_&g!&ZbIt!4
zGweE8Jt3%0FF!lRb>_wSs*B6zZ@f1R7W=`p<c#atri0-z7gHH|UM!!pHX}A<C5u#7
z^|X5%@8+2FUX;C56YDwQ!ur&S);{*lPb5YE2?*7nUSeOOr+W7%^ZJUgozKf+wVxFD
z9)G{vD4kDw{Wa;Zk7wkYMfbQb{jrwgV8Eoems1aZFr6xQ<!M@UW&irm-+o7jt@VEY
zGxlX-UHlcTZI9-73hEfN|J}i0q{kIyozzgfPw8{YzxCgzzdX8ry7>ORb>F`m+urSX
zI!`-pYH!H7(61+ZDvFb$pJ`s4H*;T5-1XDnH(k;4FwuPUuJKfK>il<^4Jx~WqdpuG
zo^;V|&S}T%hd;)91>DJb>wRc%)!weYt~s@w?dwv0{Q0Q+VsF-Qhb_lG?qQm|W5Faz
z>Dfno^Rrs^u`;lK-*)Dm-u?}1)?KKW$5!5Jr(S({x=_f2&IQ>EOyyas0#~oPb0+cm
z4dI`E0=gd`JQu&$YyEn=x*a=I^iOtQY(Kp{e7@f8iSq7?OZfgbg}vYQMtJJvLMwTH
z_m|7hJy4e@acM}Z?)I~?yP(HEk2}Uje2>@V&ZMJRZXuDUdzNm}S#7*X>%+xWanEA5
z@kcMdk={5ddUH^^!-cEY<~Vj&erj8tb@A4Xv%CR+)`{fR{#jAQ{l$0kw7zLf+js1L
zx22V(X|Aod!<`yd{tI>CEPOh9H4<4PUOZBBVaPCE_TY~9bW{CLqWUwQJ(?BDogk?h
zwxM@!YUbkwUsApt;MP@mE-v`)^>zt?i293+v(%p_i8oIWU~0(rxc#&*p0}BC>XqAb
z!g4;9<{UM*%f7#?a%NM(wF0iKY4SgNv_EWVW|;1i@|t&QdGi9r9V;^emt?y=%n4S1
zcq5=t$i`#hyp{tQpE5PdW;b<TPC5A@M9zz&WsY`Tw72YkUhz)n!$DiNIckK(Jkeb7
zW$lvLjh{|*S*2@sFs)fMWe)FU{aMdn<_79zP7D(Fp4Y`;{?j^Pv)F%G!>2i?6$%7y
zYF;Wjv5$FrL2ba7vKef5jSf0YJe@f0z!Dh_&hm{W+U5`XKP4))Z1&>&eC(~F6~~^N
zfA2aphG(vHZgzYy-&^mJ?%HdILyqna<ohgcWhT#3HGk!nMcbQsmo0d-jm=d4Sj9O7
z1(xvYNAF(l$e8hD_JsNwmtLKa-_zQ6zkT5a^M=U*bC^~?_PW5ZhmXfv|EuW}5uO(%
zehmFb^vn$GdDz7G!(;6#-sk(f26Ru(e882&GWne(SN)}5>bn1C@-<g42s*GNcuj8b
zv#$=*{4G?c8Jv{*rD@0&R}mC2x2n2n?|~9SABHUtLguDz5J=!D2^Z>{y>MOBHOXb&
zpRdF`YM&Qzx@y9!+Sz@#wz%nDvr_F+T(;>X@1H8SOFw&Nl*rWlH&H$Rzb$e~RrChd
zeO~r=x7_69v{GO-+-c4HWNl*DgVl47>d$mrAGqwZoLI$OrgDkR5-c&#&fj{nYUvHN
zpqO_bmMyhEp|s<A)!)=eF<Y)@o6>YST|JBErhAsk#oa$<A}htX%;#6;EDfL8GLeZ{
zQws#u($6);Zr(XTYhmQEZC6|Tt%D4oeZH$IWYn^`G>?7ingyXpTLMM@tWND{o-xCq
z`H8;%$^HnlgFQkU+QPFY8vZT%$du9Gx?DD{Tq{siqti!DW&Mp5(|;Nl<|jwC-MzeM
znds)obtl7JzT|d2;=Ww|#BxG??eXmqK|i-k_&1xLxz{(#uwmzRqY|E3>iNcRPY0<=
z1gT5J_}f@0r#)C1+o>1IaxCF}`kSa7YOB>=w0%ABHY=`V-i(5ijw~!LfnPK@!oGYe
zQ>$i5)S36fPJPlvru{xV{j#@AHTQ-(rx@3Y>$WP^$*kyaKXTL6<atFz{;}enhpVJk
z@oKUC{MBo-rgEEF_9_nDhV~lwX+4~if2UN2X9{gN%e!{YHowJQA~!O6&am_y_dI>6
z<jLl)vWG{GOfBOryFM>TY{qTFAmym6_-5X}Wm61y9OtQNGiDMAJl(lCXZ^mAB5|SK
z9n)NA-eq)(-sE}jb-mimLf>iEUG{(3qx8F}Z{5l=wOwijE7=t<9F%(5)|#Cgk#zN(
z67S3<F@`gYxxTO7`t!n_{=!qd#q+}XCRnFWH8WN}yZxn{l}-PpT|avD{w<Z%?OM@o
z|Lsc_N0er)2k(TPe+^BqvFV=q;>R%8^P}v}3%4a2-v%`a3&+^I@gIGq85dpZdu7tp
ztDBatTDgAKgTwQJZ0puudscevmdi~R1Jz#^Ov-)h-o4rxD0HZ3ecb%+S2^e7wrdnz
zZCbnQ>2zD;QhR6rEPbUX*QD1Nxq0StPw-a`et$Z!JABy^nT)>hv_4nf>XKvaRZ~3H
z+D2*?^*yV9Qq!?^@v&|B|GLCZF@CW;ujuxQ%XW)Q&mt$$t)_3nBswl;SIubQV5;Wh
z;kPe{l1Z*m47kIjoPRvCs?OHme&6r6cdy#tTl(?_|L>f`?Y$DWFE30^uVR({v3c(6
zcN6q&`<BP<J;1!-;04WpHxqr1gl2zYzE*mdrR2g5QzsMW7b|&lIc0jKO=rpp&27t0
zxjX&3ohs*v{=gr1mR~sa_4W1+z1;4onM|n*JpS7Csow}@+0j_(rgyC;EM=#1<;v=w
zhCSPyZY8eLy`s0~+zAo>ki|9;7P+CEh4GiGml>{`k>ViWrg9@ORqeqYgGYrMDi(WI
z%I$phrF%!W+>FJ_ZhQ13-YfrGz`tSMhW)8Bx9xYOr(G7lRKC4dKC0U~(C)zB^V{aU
z{5<EW*us6s6c_HwRoL`?*~f#5uW!bMbpI}|FMgcue>E?E^8b&y68W9t4*G6$x?Qg)
z&g_=qGQV~6s_UHVx0}*6LSvl7+nV$^y19SyH#VPf{_phqcZ|NWVATGP{&vr0#S1<}
z$&~RvIR4$`Mf(<Ut0z6TOvU!KY^`?u)3E&Y9v-8KQ-!?OXKEIo(Q&ca+gG%^w`%go
z%0Pu)euf)X(VJF^?qD&vD|)YQ+tNpF|K3hfsS3R@nK5I}!dYgW^6VY8D(S};GqD8j
zpJ{qFrctuZHg00Zj|C^?#TUO^`BCAmc#m{a;nEY28JE5ctY(^fUwO(Mchx)DNiMVQ
zZTl}MrRdQil(}1BzDKIft-IU5oigEK<GP+L*Yo4`z0`{Pa|5!&)cv+zzwf7=+u<+I
zA<M8|+T6&xXwBL~%(<l#mOqPHllg3Q#4Mvjitjh23(L=yP)pSNH*f3O4R=jWC@PwL
z@HFrGemZGdVg*nCZTG(SW@4NwW)^X`#aHuo9Q-HmY>@Ekl4^CdpWWk$tiPrQ-Vcl2
z(D<Ob=)t<mldOr)I^5?oKFPS;Zdn;M<*8WHPp|UqZ@-NU4Kk&Se03iA9_%~vVb%BQ
zvzx8U5BazFU$`93^kr{!Z#(O6Gv~9#^7WUz_s_np^f9zJZTC6lgRU+U&&JKvsmr(1
zin<hYzD8+-+yslOYi60uzOQ)e@H5HOcINlK8t?b1M)J-nb$Mj}*I`zsqW78?omy`m
z+82E8i`o5Ka3a6JlMd&-J@1Rt{WhFc;O98G*68b|^R~ygJWtE<<SsOs{^QQimU;6H
z5AQfB`}<bAtj>R4ALTTu&jxKa{}_C#wC`*Qu~jbK$$iRoExTs;uZ6FLs)IUaIVzv*
zOU!0}$GY3Fg?;K$$2-20-yMIRG~c#kjqrDw<Zi2Xe7pGyst)+iNKL!d==ODA;_^-W
z{TnZ<Rq%VN?MYXO+<DhmZt9=L-EsWCg$3DXKAcy6&EvGL@!kCq+(*MYKgMm|eyd)!
zOE&WG+l2{7R9<n~2+UPEet*NkvyrSCU4MV~3jUn%cG~a2R~P=4h-#hLxG?gwsdkt!
z-?mi@^16o43>O(PB_2Al<GIP1cSmd2=4&04-C{AxcEJ*Uo&Kq3m2X}B_hhv+^J$$|
zO)<XPW9r_WtlPZ3LVn|F#o4<nlWrZkwk4-FO8DZjj)Q0JxvpC8tuV1ROZd%}|GyoX
zP5c$6tWir|Uz%WZIcS!j@cwttE?OI3nqxWd_d@@2=dVH4HK`5>ABvCJ&vn|tXzP~n
z;qfW^xd)h>9v|2EQuq4j^2_a}i;lm@uCMy#KCyg9S>1;(ACp&jFU;y(D7?1hM2cm@
zhvHE20;kC9lZ6WuQ-ZyOLt1+sCQeAquh?l`P&mQA*y}EDQG}9}$_;0&$R+Np>SMEv
z6xi-2_jStam_+XD6-l1+S#jQt#Y-ID{avQ-*QU<KvqpLOELYPhi+)Jni7Y#q|Hv!x
z`Ic8Vzp<NbT$<PR*)z{tBG^;DpxmCzpdqa~{g-+7{_8UgGQa<M#_uE6a;x;2<n8FH
zcHi6t7k(a(Hv6N@cQq5b#3Y{DI4oHi8vfQ$|9D!+!M6|JKa=q|eS0Ri`PJQ_kvBKl
z^qPxEC4a2=l@Q`)&Hrb;c*(_uCRcmvybN`we3!Jz@v85Uv_0AK>-)=VX?!v<vaiJ7
zRokDuc%Nm9r1}4ZO-w2V7X>A?Hrl;NZ&<bDYDw4487mHbzxICp+uN(Ro+t>qZ*;aX
zHTQGEnTj6SsNG!-^IgAe%Z&e!bTRMeyB}su3=-=mNm(4b-|2NDRm{65W2Sp%r`oIP
zSDqft@i*RNdT$TD^V%XvbXm2vuKV5pC!DgIe#g6=sJBwubb9Ca$=}Lr^<)3Xeop@R
zp9#@z1>K5yQr7HOxBvr#o+|@`Jl1Y&QGRhjYH~?teje!d1eu$CcaD9m-M{E@tpaC1
z$ITPY1}7{oY}|DH8tZ#24+9B-7{Bv;TV*CaGF-iJ0spD|C#Qq1em{D1YRb_<wsT!?
z)~$QDYTfSHma5|G=l^?r@bjhxrT+4B)@RyInLVkj_|uBB-MY0Oa({hzGQ}qImUDPq
zKKrM)hx7kA>205~XF+Z7WYfEsS7nwP^zoS7kKFM8pLj$4@ARTL{w+=4*5&T1(U|><
z<$&JyRR1om_Yd=f`70y8r!edZuZ$N<F}}v?^eog;#>4mJtaT?ZOvqc~87J?-sj++8
z;t%2lrm`lpa`_p!r7wi2tIu9{bE3}ep2IgT>L@?uyJmQxW0&NOqF=%nLk?VeTD&-_
z-8uT&b(QxgmpV*a=F)p(YpUz+I=76y`n#98g`GLUw=;NZxbdYe%^MB=^#xaTSnWF3
zF0)+ogCkQ+Z|c@*0qO5E4EcVBx~4xlF0&yvr&!|qo;|NVy;F#fH+e0ns5fDcQ;Ani
z)={D7QrALxX6BqX^HopmZB=%D+VQ!H|M#Z4E3y3^x)<sU<MzIrW!~V<H<f2Xa$JMS
zRMXl`xenLTo`^m^<R7A&ef?RizcuGSiDlI{*D!tx4ClKo%j)!`db<3N$C0jubqam^
z=db^{|9s1b58JyJHorZbZaCd>>YR6h_H(3#N`vxFq*nbre?9%?WchRR{*?Ut^!q1g
zV|<3c+~d=!_hK&}Y?=8$)_K=?Yvz*pZ%;4G$o^@aZ<$#2>D9~CmYVEEw|fj;imI9x
z2$V7&nV$36wmPmqH&pB=gZ_eW_5OOx`hO<7YrcH`o<9BN=J+_foi_DfKQ-x`m~>V;
zP}Tink4ye1zW*zCEO?N7{)xut=rW%zizMAI8#5XoTsJFG`=0kLclFhih1WekaBtnq
z=u>9T*rT>4Buh*R-lSc=;NyY=2b|Sdmz;B~Iq)xlZR0ZOfcu;D+I70CqjJ-hFvQeu
zW2~He*sU<})aq3GlGQDXkIElfCM9z6dcHQ(?3|J&Q>V6lIayvAtlbgoa$HO=>{_06
z>3ORC22R1X%u#P9l$)My*`)mE@+OICUT@M}cxwM2l)F`AYQ$zGEUB|FU(~tbZN`?_
z+A?z{u-~7ky`grNs6u;kICJUYpX;7xIbT1x*YJzNwyR1LrPH<;-b`j|k<8ziQ^aj`
zyC)%;Gkj|4O~t^3R*N=qUw*N&!^cDx%slb8E<-D-c&@<|byHDe9lkEFudios)XunO
zde*?*uifF8cEr_?_n~ojE>ziG)eYIUeTje0)NA)e^CY=K7!C_^&XZ%w7W-sq?xT0$
z^>mA_NsE<@JxzJKON!-L-5R|&ho$e>@x{mfw5aqdbx9W6SAt)B?d30T6YO!Gv!rVB
z*SvE__MPSFO5=L#WT&FeHCyDQ>j{>lRnn7`)13EfC@8S)Xe?3SE$%MoX*{TXz~G?e
zY?E!Tiw;)Vo|ymJCqX#jy@kUKUcRkHzalDj1b@h$`KDi1kJGd<@zKe5Y@uh5XPx*W
zw<lc8pzp{8jhWFW4zU>?emPavb#2RY_pgd6&g{>6wtoD=-rDnR);0s{wcG_U@|Gd%
zHnIhqg>US>&?PJ_rhMB@HhMw(vG;3pdq0`}=-snV?sIm*ykc90%~d(Ry;lzLUlX|d
z=799M`z_bc^4YYpt10ZU7BFHkSm-jFS<@ob(aUt3;#`3vG7EMeN_LqbByp(vPGFfx
zGH-C~ISKW1hR09n**<b!w0E25#t(P5T{&aGW5g10q<gjG&Ye?j+k8&tJ^P#+%%XN`
zx?gvXp8mlvyB^la#0Gerytd@TYA)G5F?m9&my7r>_5Gi*x!JnE@FeF??Vr!;jGY^p
zmaUOozx@Q;y)0ctReeRtH=cG3zxF&&Y=4njm@FlEOy1fkr}gSXuW9_@W%uV9$sdjE
zUZ&T#fzwCCZL{)=^K6fHY<0AdZd-N3J9+2IPl*dk+cYHhp3Z-^`bY{(#ZoDkm3kR#
z(n>E+Kaw_Kr`6XvOuOB>kG^m@e8bVEZ-I%&Y_shdQ3rQ@aSh+5^Uc+-X^r+erf!w(
z&!qmcpZ>`ue(Ou-Z2sF{e1oqUmIq7=7uW0F`K?2>f8__Mz(+zlg%`^gDAwwz6|VR@
zXXVnvUhU=0wtxRF(<=<qelKn~MKZ=Z&Z;orfuG2h>%|d&1-4y2cfV?%=8mrpTq>VZ
z$}{*UnqK<!{Sd!rv&zf9#Hx=SdFvT$nHMie@(JKIjZVst_7F+p&~96q<QK#6W7=vL
z;T6*!ALrk+X2Lg})$0?)Pn}hqX6%1MU7lZiqr(LEiB%VQ5(Oh>tUQ^X7xDDW(*|$;
z`W)H36Po5rm&;|y%sL!>=}h;%p1Xpl4lA6pyS(@j%cS>PXYwR8NH_|q#rEks=zigv
zed_o0cNeCb9x!Xj+7UUkP((xLVU~({bIiHDg~A8d+kUh2;cU6HtS~0(<YZydO@h0k
zbso)YI}uU&$S7!$M)ix{xtdHdF46&y{0=#UO#9u-<(Ibp-Z4YvRHH_B!~DB5-k2I)
zyR=1do7x7JfG4cmv^tI*DKRxVzGLQO+r@v_f}B<Eoz7e`X&Uq0uL}Pi-tfNLe?UrI
zepy({u9a(20(##@*k1d{G~*KA(Q8_*%k1~;+VRJRXU&cDmKkP?D|<AT+}Dw2QF4p^
zvFXn$ey_E&Ww|un6g}SwBwu@{_;pz*_ci7AcLwEOSC?$AI=x>htf2Yg887{_j~*WK
z{CalPA*Y#|)s@{0wQGLtFQ`nuq8c$>&u>S{lFGT^?eUp1FE-`!bsxBJqvLAroZeqj
zJyY64qIG|*TkzH)>1oPM$@7xgtk2G!IG=1g#k%TRX|H%p)84X8GSOZ8bJiVxc=tf_
z_O1)gpSLZ}KQ8p;Cg-2j;v-jm4*y=~(R9wEr!*{di)TIKiFARG9@(dY@j`t^a^|nN
z==-?vle%wHjmvM>>@)YTZxr3^wx`JU<%P=ahj|Rs+~z$Eea|vqQMpw)-9=c)An?r1
zPdg({zMmocB|Gkf^N;v#j~7pvk(w}RLS^jFc`xl$BsNQ4Gu5~jTX$Nw#ABN3G0TUW
zk{-;xy_%O}Tklo-e1~lzr;bMoZjYLxY`yJG=)#b|vvZ#5hE05QY8pdSrAHrIv6-G+
zv!vgAK}Ln1zGc!5O|AQPFKlnM+UT=UUwhT2eTB~wn#JGD-;$NLvF6RBGY%2EVyyLI
zAI3{r3r~<d&wNr|$zk#v`6X5VijG}NJlRn4%KfwBv68%b>T8NCGM5YRPKXZJVY}9I
zV)>LO;S~nKS?f7-4jMZvrT)qfez;)L<C7Nsp`}fG_u1X%Vc8$l|1Ti&kP)9<lSj{k
z_s#+huFX5X?y%O$nCN(C;)c@x&ZNt7L4SmAJ2l@_vnW1QU|4zX$HVBF$v>ji>&-J#
zgLmbxvNb&<XTEHPn?l&$J&wj3_?vFNcFA6<a)~ph`OpjRHQOz2pM7ohS^V2aMgH|!
zd9zaGMY%fuoG<VCb0Eaj_lm%FOP0RM(8Qe1P}83|KW_Q=S-GU<ZnD}LQ<)+m7J1;H
z81r>m$?G$wKPpU3;$l;C@1D9a<H@?9rEa}(g;I*$_RIXUB79!UEbcH;?Y{R`?&zDH
z-#(kQtV{ReyY=^3AM=EtuN;y%_da1?zC+?c)T&vVxZe9te1F0@U7(3GqqZhN=GW%O
zUwY&VYA5YV6%h4Vai^zX&zm5ILosquyG+(?FIc+8Z_nP#8~ek;otZz%O;=WRdgx@>
zwd+#A<=t1dyzknsEPInzAZ7Z@Pdu^nR-T*M=jnGcJFX#BoyX?r+mnwsr?0QGQ*M%b
zXT37vZI66N0LR^rL40xTFHXG{k~sQpg}G-Ri__tN4Rbd>&e{29eea>=I+d>+y<2lq
zr~g*+lTF)pT-|7A!Sxt5zv6w>Gh$s7*3OAEX*;3ip1b&s!pi>BvvgfKH%`gbtS?)v
zExOnKoc_7Hc{k_E8%})g-o5d#R_hD@+sk_8fB8vfOmdH(CbFtdKi_4K@zT|HZnu9G
zWqdZf?Xn?BhvoQ^Y4-zX$Fy!({kmkoZC0IZKGS>669*gbzF<jQ-Lh|ved^SVdFmU)
z%uF2~8sF~zpw!%B7o~PgUc$E0V#UMdi{e>zKC{o*vL{V3$X?coZ+F<H^Rio}NQ6&b
zoV(5|##l&tx`Oj`x&Et3lJ}xs{t8O^8g8g+@T~UC%10Xw8IyBe%>_I+xtE#Wn9utx
zXp`8UQ04l`C!1vM74sjM7hKwPrnw?s;J`U^-O1~HZ+>MCILjm(!=EjZbJX<Y?VLNl
ztJd{jPf~l@BdODL?YWRf%){NYk8j;P-zYGoHMh(3bh(anReN#fw42#=>_*4-?3#F0
zz0uZq+s}CsZ+Guxv@Cm~ZSwk<vi6y|el6`MUQT_i8u5mK!ENsR@QtdoW#+5YZVX)H
z<i2BOlX*;55}T<0C+QBgV|>2SOYRCdh*+j9jlGwDP&08-U-~4Y4G%sYV=_8^F->4s
zA8Yr7zn}Rg8q8QOeIuu({H5>RJ6_+<9GU32r~gJ;sOav~r<2aEZno*Zl3Q6iTmILJ
z!|m2$s;##sHSL}5^PwoAgQYWIQqlF6?+${ert(Z*lWx%6+wBk<INxUDp8I=@)!r?Y
zG-SWK^{}JN6q$CG>J~pIjsp?g|96BbYOtj$m?ZO`7t#J0yl7)j!s1oW#8ixe1(kf-
z7-!gpJ=~U)$mOnc&h|{V;62aHp(Yzn1dB^r#xs5QI(y$`@58=Vcg`#{E##QAT|MOO
z;`3TIedZ+_mu;W9$Zn1!S4_mCgVuj;NLg>sUR;#RJT03)rNQPD+o5R+W`&yS+J?+i
z+fzy}zx|;2Z^mq$XNt1dqk3-soXY#1Nk&>pe<LT0Sw}jzh-F^?X}LWA6$h8rb;lc}
zEIOX-Xw3K4;)~f~m&NQlPpk4~=D$C**e~+gw7X>tJAD{?JYJ|37eCIMUmT$GZl2Np
z#i~B5w|}tNb^7evqozmh@0nJ1e@pB=L&4V*8dqO(kG1aY-M#1B3XP3IHT=(=?p^I^
zvb42dZ|W_(by3~2O}VdctABoxk>yr4^Yi936Z;jrj`viEe&G(t2(x<=wPxSp-@8wq
zcNbi-KfQSMsbA0D$~OzSo5&<xX?<$XVYuzi%_Ap%pZ(9iBx3ua{~ljH=-b2=)#YD*
zD6ACzB>2&~zrOeW@~{1Ug6+?Y@_BAGd4d17D=@v@Tf?cdtLI5%`HN%jD@yWuuDbh0
zgl^d27n^OK@XkVe({sane}t8}OA_mMe0u43^^2tt<L3wOO5TZU#H$5;Oe@{z_S5KM
zm-Xu3wx{dcul*LPJkujHx1n~|mzP@%V)-?DFV+7(XOJ}a-;Zma3s25ZXq@P#`kp~c
z<=kB#nOM`Gvs9}k|NAi(OMRcc$8Np1$FXi*-8`c`JKx839rs^zRo%lc-Td0d#Cs9z
zLU?A@-VM~h__HW<y;;|y^dF^s%T`D17w?#}d&-=PD|b4+`7g%w@AiR=KYJ=>Uq6`o
znA2~gYUNdPmVD0Xm7)Ju**TaQZW3l?IedO*)uTt5S$kxd8F$A;Wlef07t&?)Z^9$?
zd*3&#F4``B&f{~<r;sc2w97WGRo}DE?T;;2{l~+v4Bh)WolYmUZn`bWxVSscDd^mq
zeX(|13V*umcDTxX^{Fdq5<L+e$Qz@x$DjAlr?;BUPS<#!%5yz_?j`HDLoNQHyzT$+
z@+tQdFInp?m(*cOIL<qB&u^sL-$6$Y2deKsAjHhTFqIGMRC+;vaY;c@esXFt=mg@k
zVY%724FvwZi!YqO@0*c)t1fy$vtDgvL^K<3@?w#Nx1PJr)|K?s<4*oxtA4w3WAg4;
zkL}NzJN?W1=T-adD(26#pI<8**U7N-;6oLcOjnhF{s$&c5Aw7h|F`gZ^G2`dQ8wpv
zWaQ=cHoxR~DAhYj;F0h#Enf{joli%UpTG2x;7H1Qv2w{%C#el09}o0$D4a@3Xq{vu
zR>mh}ctl_g(_GI7MSM<CS5~@J2~E3{60@C`Q<Xnpqj=_2hUCCB<KCV|kD#TxtRAU5
zZy&B`?f<XRv!NxlYL3+Jr5j`pxQZQLUB3RyhR-1<+#j$lo2RZc<JaZ<`R8x`c>MFn
z<tNXIo-qF9%BgRhwIoJ5>8<Ea;TJAej>THjH3ExoE!=-AC*VMfM4*@x*XfA+2{OD1
zKjiYJ97($Sch1fJxi<=!+V2_Z`S)D3pLcYcWo~f`^8~FU7n>&iZ*<wM=*?WjpV!It
zOq9!LZLDf{Z_AlpzRZ_z<EGh!EqT@AxAj@^_C)2`PqU&I@kUy<I8K)NtzHna^!V4s
zA1ehCvbZg0A8ONEbL^K7%eJXsl0Nnp?sKyaPSk#V_0zRI#dU6}Ru0SL_9Z9GSKW2^
zkKU=Wi?bf?IxM~VEbCqEtVNG!q#ym7?YH3FSF1>lZclHipTC^fG|5LVwd|aCvfysw
z>nBRr_r>~aZR$M3b>OdyacS1wo%YArKJ%;&%<a+*jXY+0c)!P7zSy|+cT6gsAHF-<
z=e2KEX8LZ4)W%bHeB>`Cl=gl-7a?`j<k|boHGh8XJ^fRyvWdluS(f{6&9OPX8&4?~
z#(lZ@fG?u;LE6gGQ?12|=KDYHT5%^r&1uu~3BNa7zr9%f>Gk_Pawc6tO7Fu<<@LF$
zp02vIzHZx}y?<0CvVSadaBn)fE%^4*(x*>0o+@`b`{&f&BHi}3OfgY|H9z0%_WOLK
zG;Y7^e$D&YzRS04JItcx`9nyhezoJ1ZGF~KD|US5E8p_<m{)#T*YjNtvWYty8;o>B
z-!>eaAM$i-)0<VkW#LgSx~_GelmCb_?Q@y^dB<Zf9kK0~kDuKx*7`5{TRj6}fDe?J
zW<)43mvJ&MOtN8Mki;C|D<}f5OwlW-JRAK#|Mo7y|99(Ir<*%`dnA$D_}75B+WFRY
zCfT^lNoU&_`xG^drhW)rW-=*Dn&s#Ha+R;GlRRoSPT8}wA-S{s_-~p1<I4SiIctCZ
zIbE+;r>eM2CcefZLCeF%;P#@^CLHfS9-V!5^-=#9v6Ji!ipupb%no1wziHij!(Sbh
zP8S*L4;N07YvkvYkr8*Osr9$udfafh+{x8J!=1?@kJ-;jB-KPjWuc?b5#~h_@*fyG
zSvK}8YOqsqVolRL{DF6q5S#wla&ZM$LzRz8Nhbw=)=lZ`Nxbj=WQLj#1GBG-!tV#%
zzMF4~<Q_LkkWqPk{XT~})2<WJ`a6GYuiNbQezV28dE(u3S{^={Ug5#H*O}4%diPPM
z!>n!ReKdEksR+N#+H{`LeS!8ummmKoJ+_Eq*2#Rowx#`F*S$4?2j10m?LXd<WPip*
z$kp}n{OcOt{EY|d4z#Z4$T+n9h1eU0v+tW{Jl>=HbK)m+p3ged&ddwXzwp<o`Cnju
z&TEF2x6@0PO}Me^AuGR0+-9EZvy)q0e({^^&pL5h;&bu2>m4p;A2^uPN~Q+v(cqn<
z<}hKC%8@zR%Ihy2J>PXKRl3dGW_PU7`?mS_1M+)qzUB(7)%xf-E2-*)JHH6mwhrzB
zu~{-7wtZN8Hu}Q_?TW{*cC*E7%Ddw1$x<NwZ8eJt<DBN35AV;vut|u;|Cqu0H3u5~
zU)?uMIJI=vg}){i2WsXfG&04kb9dl>_W9kTuW~7zAAGhjCsbK{EB&)6dP(8@=zu59
zOIDnlD5SL2xXqB=@`&S-TF2&veX$Ex{}FducqI7!!AH+8Tzu{2EIQ-Qc7vUT4og*w
zyUowUY~7vk<k$z6jF+BYr_8S5e#G<o=VRBRIo{HuXKu}QFr3A3tZkiuVehwP*W~&9
zT1zLphI7o5NYeTctj8qvD0S)csHz*MxK69g^8LU1O-1)iVdtxNl8Z0g3Meq`Zky5W
z81;g+=<1u`sss1Ecq258-BcNW6iTrt_`iSVc2@02#p+LQXO?esOE<rFb5&-mK9krc
z>*b=Wo?UjkJjZaA;Ioh;Qv*($XzsDd`nmF8UCU1|nTtl^1<xw)NwTme3(Zmfx=Azq
zT(6#GP*>ID{tm+nUMb!WSlVmYJw+BumhrWDUJ&OvG^gyG<o{_8AFQ_a5?x!n>aN!z
z%dfjqbSes7g>H-bB6WGC=;?EP%%3#&aUK#_?zG;n>|Jg3*-IUDiVF*vw4~-UpMR`k
z<F98k|4!kz$=b)Bb^57PS?g^Q)lZy!XVtOA+Z?~Ho1N!=S3BXJ8NZIlyf~rjyImG3
zY<T;+!$s|+j)tf^$8Oyiw(7rM*geiFY*o5)+E{X~`Mwt(#!Bz{BPMK6J~cz-bEJx=
zA$LN#rR`tI&YxO^?hE$h{$mK)Wz(~<wqdGd)t&DR_m6qLh+CN@V%*sA<YUvFb5nZv
z%nKLzy<<9?hMBgmjeJ7&_rr6u#MkP{sO<d9+s?PXdfiw5JkNTcNCx|)!udN6XJ56s
z{9$Fe&B=(4zk1DAx7@FA?elC-o|;j0+Ozw`snp5ee|FBgtfh9)ScQF6tlaCL`b^&^
z6&JZb?ObgA;+n@i?oZnrOa)E{cM31Q{M_O(^MtJ@;{@*heEH#?`h+{}-`_t{c>J!{
zr~8#;_#}_-SD8{4xAuO1w!P(os>IO^ojq@V&Ne#q{QRD+_qU(CYqe;}f#d5mgLFAf
zw?*$P;hhor;VR4hn5aeb8jU#9q!v$k*zsqDyz+H%f1$$X)Akr->ap&bx`m(n)!hd-
zR&TWsOPX4;jo&!s)JmRxdcB{%Cu@Ca+w_=&`L^F}E4OVX={Fy45Hx#W&h|ZCKJowg
zxz5q1_K%<JwlM9h>9DFPdRJ=ibD*#2;ha=Gvk5WD93p3GZ4$TaH(7Qp;qO_yh)*7s
zGn~I2wJv43o4?V!Y<j8wZ?=OzX2Iz}`+OoBQYDjj=@dy^6`sDl_UY~Q_f;QewbqqQ
zy(BYnt%&+kK|P<ss-O=~R|$sRD(qZyaZ``0;WVaV_NeG>th|M~8_w=>yPDCN_crnY
zgGJu^;3Jz$t>3@6xXOL=`X7#S=TGN)wk=Hi{iZ}I1-T{Z?Xyq!+w}gIeejJpcDK+j
zH}fz3-@GyozO<0relloMlxS$I{{Qq3dsj@q{`#!})6*yGMbB2h-Z{b6<Ph5*t_5eO
zTZ{Z=EcM?j=FM7ra`PH~uej$s_$w4XCGjVOe!f~fEp~P5x{IgzFI;`Gq;Zjt-Wq{b
zSCVzw6l>21w7+?GUt`-hQ7v~(yPZ?aLvokuaPRy5n7zzv;o9iqj!R7sf0>w`{8npq
z=$VOY7TJa+e^cqsVm{oOR=?)<hm#5NNyj3)QkwT}S+l5jw)^E*Da~6iw{DTUx=P#o
z|Bp{Evwmz{`i^6d>-AN9TZ6YdtuvqgC6Pby=f{<PI-m7wSx-JNb=tSlZ{5>h*59Ui
z3dx@lIlt%068*J3S2mTMc1brmH)s1JCfzl@)(%_rmzX*J)?(bE_&n&X{*V2VZ8`bZ
zw;Zb5BbnkK^lbfy^6T3=LJGHUPcPZ#vxq5ABB;*l(jF(?m)os_Pt|n=E_FG)!Dz)5
zn^W)HvzO=h7{ATg7p(Lk;zV}8da8bFrOnA_p4=y2&Fo{6j+g!Tb6>M-ew)bT;`Df-
zcF&wktK8XF`b?X>X?3}*Pp{pn@XgO_T8~N>{^1MWzi;cN<;kX#?oGTXncR75lC#B?
znYy-{A8aZsJ#}|opsdfi8*ODKmT#qQU3@t`AjI7D!KWwRbnlC;5;~RD(mtmuH^q+E
zZ|94^_p#GXbl-dWermH{=mu`5uLf@CFTczCBRA_@q4eXKU)D`y*?C36yQxOTSi(4F
zeMMe}XVk;h_fJYNe%WFzDy#K+cE{p9nXjI51WV67yz0xs9*I|pJzmT2=dX}<oBo#D
z^iwwfy2fyE5wED925wI^w+ru@vM$!4VC6mGd8=&%jP{*MUtRQ!V@`0s%$bE1j}IN3
zvBBstYm*hz+ykX&Y?ZHG4lOmloxJ?ujL*jo{AZl=Gmpb0ZHvt%{q!w01-=TQjanL4
zo!N6jpM-BHKdjIC=6K8gPSXl+8@0gHjuV+|i=ARc=N@-CsLA@w^7@wGtfOE5oleSJ
z==}3hiu|i96;ZwwtKPkOQF~Y8-L8(a|IJcF3f!OG5`Mi?jNf0_?@PU&so0b~LD8RH
zM$Nxp`0J__=VqDKUR}jsKJpJr=UboR=aBVV)0;4-Ky&Y>e>$dalSQne#P?qH<P}~y
zd8a$SO4V(rb?b@_7N7f*V!!rwWmF&6<hB!f@;}iQ5q~z(x0%7pz;HziYh$e}vpBOP
zzX;S=i;B*_Z6;FpeZ9ghadwZMb@|#C7(Hj@9lW;1;d1Oe7B{P|odHYSf^zS~?{|*X
zIVq-jGi1W6gBwcUwLfwH)EqzQ{QP@=YrnB~J7!qy_H&S!W)zTrqSEiN>72cBd!zQK
zOgFl(QMTXg$=B8M>(sVqE66)|I|}{aig_k^OOV+ldcmi+voeK>SA7iTa-MnN$bzG?
zS9R1f6_XAxSukfNuOI`b$`Ox6T#hSl2&nO_h+(W-q`&e*>i4^nRhqmi@k_kYRJtx5
z65(3Zu|a40sRfM_+HOfyZCr7Grti5UwhL$72}|Rtja1*Y@z=Re9o~ifw-$tY<%Mtm
zU$d)AuYUKgKYxEcyKc_i<e#}K%G4~<Z|X4{@zAZ$Z~ZxGVjL8Di*v~gIpH%d7lWAn
z{ZHJ~f8xfq;>ov@7YjCC{g-uC`HvfSp3?1Am)=d`n0a8f+Pzmy)dkJ@YQJ_LuxjMW
zHhi;gDu2ZmvDJ-7*7Q%l8*shT*h`g*w;(vBe8C*YsKSf|=iMIm6tZO<UD&8s*lQ5j
zU>p*zXmX>K>DPmK9K9wxDrdj(D=PoI?a>8?`n83M*)3Y-zkg{hWIR80k#zc+wO<|>
z^iKP`b<wN1^%*kGd0KaFoP8wQ-D}+G_Tz|UOzO_U@+58E+#l}Wlm1uSae6=Xq@w9x
zqv}URmp^ZN7_&oh{WRO+w&|Ci9WL1Y&A})9=}zlaGa}OyBHl!%$4*T@_uXyR^(0;H
z(;u{-vi9&4GKt3=%gcD5DKpov>$zdu@r}EReH!v&Z?sol-Xq3ovx}dj*JMq!&%M9g
z8}mJ8@;>qX!aQSZ$@<q}GSgN~Ywc2$@{PE_WAi9*MP2;-opV`BMGtvxdcXKW&H1fq
z-w(xU-Ql<p%o!V>rStTo>W@zGDyMtDv+Nz-y;qg{^XRMU^42o>CEvC*C9nu@ugpKV
z<lo+A^{>(QlguV$_WwE8G*5o&rHO}ja~V6Td;dLfQ=4%|+ef2)H3z(#%ET^q&95@v
z<!3vW$6sNZQli+JCbqv_)ognN+f=RQ9npR8ChVPaiTl4Vw#KU@W~JKBo#HpE>-npF
z9~PIpCoU6p&7OYw+SIMJ4QDl(c<%42_!0KbM|F{o|F61$${UkwFLc)DFW@qcZce*@
zuy)mr%Um|>oQ;0JGed2z{%-m_ZFSVP_}8=I_f!P#Q<(Dk(sa9{a!2=g=(LB$-s2SI
z%v^s>D)-i^gP%$#7KmES+}Gs3=Cg#k&f2OEYkfD^&)FUH{zL1B!lw<Tzb?wJ@Y=Pu
z=mXQAqfQ5o%ZMBmEIRyq-L-=|r|3@H+J3lCxP40TLA9%!*O$dODsSJ-`IRq*fq$j>
z1Ous+@BA+QV5|{+C%^6Y)k<3*O@oeZDNTJn5&jitbM2OHaCnxPu!!G(LI6`{)`FRp
z3r>DL>;2q^SNhDUH;>mXUcEU$|6J>ZoYb97C-%>Mo3Vr6uHC?*U1x?v)$xAT$6L;^
z7|0~l{pt|xX*+mk;(qR6$;B>gA3S9y^E$*X|2pO0S*OsS)fTObs?Ld>Iac@cwn3w1
z)vwDBgg2&H>$Ruf+Oy>Pi8-t9xa0+_o4GDn=(Nsav4z(EJtEAM!-7(lpIs^^`t_Xc
zRqq)$*}qS=YH~AATR!EPW~j|!Iq!F>!hH!(tBM3X?`~>%o52@%-g3?7&y~A*6JCDY
zdftW2&xTp{?2q1@pDUC1UJ3r7A@^Z|9^1s0f4APqd<Yev@ssDwBK!ZEcmJ<<c;Pg)
zN9%sbd?%Z}hrQi1Y?h>N-Z1Uly3h>SoB!ud-2U|b`Dw8t@n0HP&x<D?QQKG6yeCka
zeOYo2V}IIB&*v!-m*2|Dt!=0=Gum$^CSB0;{qWY1xS8vY@kt$W)Va-gRsG4^+uvf3
z?*FD(c5}lP^|ExA*;VOpqD*?;YQEfM*RcQV8NJ_cF7CE3Tdh8K_p{U`?in)w6RR3l
zygSKn<NF_NAd7*4fq@A`FfcI4q4vF#5|gu2^HPvE<uEfKdhVd5IX3S7<z+Dp3^_fF
zxO78J0gr?2eOq?>#72!@_x&4hr0WJGb8S*rH@7|&_N^l4yi0a<PJFbVTJ+-6jGh69
zW~f*&XheSe8udK$T=QM^onNos=M|V@Yu&E>F(6^_E(oxbQ^}9F|NZfUtEKie-@*zj
z{cE{9HM)OURBk$%9)9%U^_z>U`6n&E`fQt?{`y-_Uc2}2w`-~YxBkhSRUUO3v$E!%
z>3*FQnH%<@=#tpaSNHb1#;%=oGG$}#_EN){Do?Y5ujWo#e?4^e_SCI;OU|x|((9JA
z4eX7(`gxJwv-77SPv<_XoPB;;<z<mwy>%vje%DifZ{PE5S@+wjYhhP|%ww+IKFPy=
zX#e!wK<oYI*L^BFyFd5Sx2#CNtNQC7p08dd$`fC!f9>|vU;ns!;%e7Rea#I%cTb=D
zYxvszrs1a_HUCV$J<a=Tc=c}0>(f2&sieQU7<x~^%4xYyaE0&or$z7V=ZMcv;+<@+
z-F@tTZgBYY(tTX>))&0n!2bW|rd=WD)2?O(>vcz6etmTE^!xj(KmGl@eR6ree|(*N
z<;OR>#r^lyTeI=pa`KIsrg`Jl){A>t?CvwJDE!3i<GxdGUR>yb(&V&-&*jsOvh7S*
zv+RHF#lDwIpUZdM+;(>P=|{PN(|>NtDa!Ns9IuzB9{r%<wr6ne>qthPk6jFZ(+jKL
zKe)HIXyTmI^#2uqYd(Ehe}4Wy^#wIP0j%dc1>!E)#ID`3T0HggzICg&G5y<e`}tQ@
zg$t{``M28mzdC&^Pi%s(=@x0x*RMCNyS623$<5-=C-NfKHRhU|2JE;tW0w2lCu=h1
zd^=tASI#Q@f9U%?N0*vcJMzDM_Alk3$=`spiFqGxul|)A&D{HLX84SZ$&Z}5gAT{-
zO5ZLWx#LR3rzc0dPu>oHf6s=s?x3fKUxL|$ZO_wh?l#?1c}~aCX0GjBv)rv#%u<K%
zxX+u*)LtK8UlYHk+bX}?vT65@2Yj8XLRWXKU7dFL&{N41-4l<!doW}6<Mf&9^|${_
zEu3SLyLSF6PMfeFhx)~TUH9dC&FOjnNWFMi&;N>*0`pyF-(}AH?NpF8>6;e&%gO5}
zhyGODsd;<#lgyy2Coi}2H}Y(Fv$~XPQOa(`SC_34KAD`%y~wmA)A00mU&ey2B|Brc
zTRLb8)ofxgILDnjSz)Wguk(|(dCilvt*Q8u^^5zTIkShq!=H7_PTx*pEXfp57kJ7r
zzv00&L-v<;{?}L)ICHuz_E&t|E<fqA`JZF9Q)Keh{patonZ2jFvg#ZEgVsPR|Kpxq
zE4GyGJGTD%Pb2@tn{|s>|E&1&^~vs<n<DJrE6VPRI2^qEb<v~NGcI$^oW6BNq4z{B
z3)7?vA3Ah-f@fT{bNV^Yw!L0ty3PNOU*5c2oql3Z|BHh+Ctv^Y*Rb~gzc)W`8~=En
z{p<Bv>tBz*|9NE2A}jH9)huoy?kET07d0l)O>43;G6iR`pL`fU>57}G?KL0fq@LMo
z>gt|RH5#`ibplp1);UP!yf)QoQVX_teZPAt_oB1rck>T3SjX?lVLbdUyi;zj{`K4Y
z$|qL++HR#k`_OF}x9*bNb^F)lUE@q@wAs`2_2b0qA1ytLPuMt0`Kv8n7NOU%>BI7u
z5>?HaOom|v%<bnsFo-w%9@99LCbj2d6hnv1$L%vG++D9^`Y2yW^!-o&Lbvx{*Uede
zS}A`1Rn|33Ro1?er#5e5(~P{jz*^<%w!1me6Z}qoF`GH@gKyNN<w`y4KD}mo%Dm=J
z=)QZ;yahOoSz-+OwL6)!6yKQK=0AD<b<tn%bGdbG$1l{y={Q!Id2YPb@Mq@icgF1N
zPZ;HKR+saB@A*-3cT0n!*Z;jsSaa5Ne`@|IZRY;GJY~n(l&E#ig8vmPtG~XvS{Sr$
z@>$(Ae@Z|7esez{ZSt3Cb3gCAX?a_F&ikz0EM4NqnI5HYwN)y)k^bpvC6|S%Yi;Zj
z@nnX3aer+5^46WY8Cs;QufBSf-lQ6{+mF5-TB0+PVe(t8{Cmoqc*HiODqQLK_CF|p
z`okIP5|=k$ulRFK=yr&&wWj00+uUzcx9aiSfArW#!h<<Xdds{y+!4Lc#ou{{yV`9p
zk68V4du8yEIL5X+%Plv`pI!a?TyYIwx6(JhPq*x9O}1-aIn<Q6=jrp<=J3zg&NN)q
zIaR80c(1~?6T8`tME|l@sk?8*rRFo`h3N{%w9tk(1!0{3Z6CT7`7rmT{gsK3`uY0M
zn&ppEqB^&&EjS*ozPhHlyUpzbbA3A7wLg)MFY<;L7-z2bj9s(pHB<Cq$wxI++>@Ri
zYV<nGJ1gzzr}NqZFAHoIhkoVuIG_@L@5y%FbsJ({AM-T*%X;40ET%?q_f=+}(AObt
zJLeusd?Ox}Jj>(K40rxu$CmWO>G4(%3ie!J5SPf_{j(}5&~N|k%}&SPEvY!5{94>h
z^)>IE*>~>mtz?r~rRMxAZGXtqsws6TfxkGXSU>X0tA4Oa%cf^vE~DJ*_+=X|ec<d>
zR~EB*ab03>>e&;!Z65e7oVop6=IhzB8?A-9dhB9$&G)-g`rUP+`aQ-sA5vtBI__o#
z>Q29U_Q<q?UAmth+kM$^<l)8z9YV(!$jEQ>UbLIXbh+W0Q_B=>@5H+EUom7Cm9lMP
zIcMH_t@xd|eA?-^dv^3^GfSAQOgOrL)0s`8<MzbkOzg+6Rh3R#C3n|C=EII=#bf7A
z`TV+(Jcr|z$AZmo(<0|=KH(zOEByJd64RB%Uw8Chczl;f^kt$(wQR(xV`aft7B~A`
z7R-Dcq~)}Iqw~UzrY2HTTmRm0KQ%eo$=|_e-`CfVE3Or9`}mk+HMiEiN%`9rh_!Xy
za_TJoUU<_dZNVK=;gHhk?D@KOB9muJeGA!ElJQGxa$;Lo7O#KYXJ)qTdR>*qh4)OY
z%Z(jhpD2pdS-X7m)fy&lt0Y0qYuAt85}FzLP5*+Z*OlTM>yF+2m@;v?*^O;6q8pyb
zT-h2{9enk@>&{{eKel_<EH^r^EbpDOzhCxn!=I2tj!XBt<}SSItnGa2RI<XPuM^g8
znJ6dA8ZGCu+HLRd`KNTBpExs1VT!ND@k4v1*S;#{-hWvt;(SW<)_bz*v3D4Dzq38U
z#qu>}*7<vfZ>Xi*Tktk=UPr|O=V`m!PWF7){g=(sn)<TDRP*$`nXjhyCvTUoJsrDD
z+{R6zMZxhHyH$JCHTG?FT9;M-YMuSNdF$WkZ$kek%yTp0V9yofESa_4dVii(^}f7)
zbzgo2x?exnAGt4A+iZ*fy4jrtXYD)`Ht08=xc_3kbpYe~{$GMWcJVi^mu1<vPnv1}
zd-n(5YdQYhbA0f<-1!0jUyeTu`5WymIQ~4$<M^{tzR~`h;s<y3M*DlbjrL!aKP<On
z`S(QO!*XlI52g0Pb$5@q#9RCP`1;T1$HC2acm2J*UiR+o{i*hLt@hvE)$lfLj^;Sj
zA8T~s&y<B9?q1!v=NLP~Uf-BQb@z1~%LAp4b<C6a`Za!QV1~)R*^wzdw*C{8D$K+3
zyE(qfsidc<s4OiETYGzt%3(zrr%%h~d|YbY%d@`tgje@(+l<VdW30J88y%X%E$@pS
z6><xiAS<4$>hSYzQlpypo<kFzeQrJ~{gS(tHFuGRSnBM~TUyN%ZwtN_yF8b}d%E!F
zcA1Zt>+8RNvX9^Q>-XvXOSYvwmZ|-<GvURTX!mCJll(t_GqJNug#<SxbvCmnF<s70
zH@K3rFLrI7aD7ngw-5FfZ_d8Fwq}dI*vU2BBBv$ObI<PE`ql8CW|mE2>FHfu+xV92
zrSDAVWvf(r$8gU7Tj|G6-&NJNbB$`b-!ny-v&j~OHLSCkA8{<E)S>12>_xJ&E(R{E
zW&XY?n=$d+3aKCYQrflGS1)tjbA8(^ldnAYuDN&bideME{uZZRk;vQMZ=`10Z>efK
zvGS&L+dS5H-U;dbVe8JwsVwJC*c`vT-~prAe!b5sbDv6oxhJ@DN?$AQ$9L1~W~`3>
z#L{1Oa#_H$kY^K8LQ<yB%=3A^zxdzFM+ahZ{JG;IPtRGRsJG#f^S)a;N7X(sTz|Rj
zR?bGod(+k|T%X#REh$mW>7M>2hUsU>1=Vl2?yNtoF)MeU%R@7LZAP`@FV!TUZdn!B
zb*_k^pg435qwt=UKK%S&?WW3oa6QFbX+QOC_O&{XlaHFeM>2fb<&xO#u;igH<6{TK
zgXT6_+-;?s?#giXY1jv_EKXTuy_xl%P3-im+YUyXE}X+q(y>?l+n&Ehu`Y+WO0GXK
z^*i%HW@pv3h4)>q*J<sSI(TgQ_WW(xHVf_7zg{J$8`Roh)icfF<cTQ`7BjZ@KeIBM
zz2Ry7qnMXUuZ{lue9(%&-EiD9J8xS=&)W}*jl54*7Zy#v{`zFr?wr${_p7p^F4)P$
zNKNPdJwv9o?!l?D3gs6q+aeCs9m$?3Z?-{T^8L9g{r$~Pd+$X^IyLTORr)k_%>~Ac
zX^N6{;q^}ChWi*=rfy~1rt?JWd%5Q=eIv1#){ms0EOm`E*WEWq)ju(tW!}2h)pgU>
z+0C`z^~2JeUuH&@)d#=3vZ7nA>3WLZb#<I2-{0eW(A+v#dYAVl<&<*`^}lvszLVyr
z`)g)#wBx30NkLQAbHwhwcmCAmnp+xWVz<B7*~l8@s86c>?fr<~xqse&yAFQlKGoZ&
z6Jk#}IL)eNVwuX(T%K}o&c^D=?(uIzPx)`+h>}a*x&Kj3`F_d36Kp>Foi4SOT{yg@
z@7eyz7X;V+%vUq>`gD+GJNx(4omXC)pIhzrvGFpS<O@&jo2~~oKINOC<$rF<HvxtE
zt#=N!ofJ3z7N?bRy)Ewa?~LfpS=kqR^Iy96sZZj*qxfXgiRWJCW{Y1XYX4@9cD>en
z>nhvsjq4JwhwfFHdu65+i^()a85X8M!LDOZE<`-&Z?$-L<i*Or)6aR^pZvO}b<V1b
z^2e8L$=}MK#Cp(oYpZaH)GJP@pjoW@67Oz4lz&wH==}u_rt=@H71vUlzc;Y-)MECN
zt4lA1DD;^x__(-TK4bUlXH{zH`C>sDT^{j~Vz(YF<a;5u;-_vx+&Lk~=*)Rfc)Nw{
z(?xHY%)VAxJ9~<*ueR)8-Ha>JQb`}GxbMc6PGH<`u6CDC<o|3LW<{-6W+(M8##|Pf
zHPhP1<V?sDz17F9j(vY=TOnT<Y_Tymv2ym!H@7sm-j91~y36hI?s)=kFN90Jm+k0l
zPx8$B61lnV{SD5C4|e#?oAb{?EmhoKee>#1yF47UK8pA*R2S0GE?F9=JUOjEPRZq~
zMyHf{Ma6`N%rc9rpRH%BEz+Cq8CS<pGx0~0fek~V{lvIKN0TNl&@+lCSp3Cix5asV
zw-59GOU$*m`g8f{;pXP`PtO1OF#n5sl}5VdpVjx;ldaFl1lY6MJiXq$V%3Kz`FFcR
zSXe(RoR;46?66_!>vQjNx|8d3wy}SgpZj|61j)A#kJSsvP1W&bdM0wR@%#R!)$2Vk
zTzI5+DBaX*@$b{;Kc@P=tDiFOg->z(&Y-TEfZE^B=lpkzGP>EbJKjUjRjd52+lmtQ
zCCrHeN9TV0zTITCfB5;uH>;dpsrgLV#8vbAUG)uzIhxJ?PkniC(9FvCl-`HlzV}jV
zKk@tiJpZVLM<np9B-`&){)pP(?`gaHZn4O1u+0b#|NM5%fxwfFwP&`eq;}-3KKoGU
z@v9R#@8qISMa{gV{O@t!J)6}IyPoBqJDwJ&Xl0i*MelR;3mF%&OwrXs&yQTz^+~VQ
z@;bpLHc4d_|3>9_!-;MmoB1-DOBsJFc@zYM^{zZVckQWK0l%PG%kGP3%%8rrKWb8w
zcl5<s+Y|m-=Jv4KZ#|Jcp)0H5_uSAE1_>SRf9oA@gszybz2elFoT&b_?;dk4NY(4p
zd=gtypU@(5agRuS{e?;ERu`Sqvv|GeRudoFro_%)HwELjSejULoOkTk;Lc@ya@YP1
zOTK*Hv1_jxJr6Gq>8Y5#YtOmc5?^B;K9<S;cEkO<;qMaZQl(=7g`wVZO+lMq8XS&l
zzMZ-6*L#TvaoR`cNnVfHaDG|RqMrhO1)IMgUHS0de~0%6D(pU-?^s-NP&h|))-#`j
ze}8}f`hD{s+c(LTk9su2zw;J!B`{9v$&vX`@~|ZLZq7ob`O)7kKJ9xHSu9eaEFM%M
za_3ND7oXJCCOMY(x1Hwusg<yYhlfhbUTZ#bFr450sK?HP01eOM-?C*_F`d8tJoAim
z?u0wydJI3VOU-ru`|jaMqmTL9Q#Xj&2!1V*IxZgj<5f-Ey6=;MC%S4e7m6*GW%S$h
zcDtbKZoT-~Z=G6udnbP_Gj%;3vh&&5K>3J^jJNNpoj);u&k@xvE2Df4Owhk*oVZaZ
zUDtAUzvhkYDO&43ekwj$Cnq+grnY;!UGR;w!VzjOEMFh{{%F-9??rRoN+cbL2)U|g
zdOB@(Z)BwC{dxL9&*vP`wf}U&E>*sA&wQq>=OnY-^cFsm&t8`HTqgXVim~xYpJ0vm
zd7l?-Xw^M><iqoXjOfG5&#LqYmn~lXYSB$S-zjsrPvv&CnZJ;0_I-SlE9HP%qC?qS
z{p}zA95{4uO;ja|^`zDP?X&h~W=g9#CGXF4_cLXe>6^PI&wTqz&Pm5L75>YJ>gpS3
ze%?KEX6N}|={F@as+X^iVO(}RJ-hg!SC|x6x!B9&wiBAZ9J-&N#JJ|2QZdi&_&b~|
z_J?I1V@%ZFW;IvsKPVllSMlQB?W}WWE@)TV%Fh)4rBJ<`%d(*Nj$7kO$^KifraodW
zs5Is}=%!=zfzQe~K_%`DYySU3sY~316U*|BRI_aP$iTGtUINGIs<5*UUldF_w7&iS
zGLg_fHXi$&(}gZPE}7K6QA|ZiTK8&`>XMQZ)2<)mh=>u{;gR`W(O!7#w#}P#!+P`Q
zD|JjRvYnaxdY0{)HAjC3Y+_&Gf8es!^#(~Ec1^2?hdi6@MCQ~q9_lXMq8Xpma_DMT
z`6J(08MDy4W^yJ*jhlH6rJky`eaI&L`%TvFy89a5+fK)BsdTBiGQnZTv_>P3sT0f_
z)-o;nb99;4kFGs#wa4nOYNT#Xz53%=ru@qej>C~tx=*|E{jo?iOn#ETd_my+f_HNB
zDlV_i6fruwxPbR!L0$r1_eG^zh3lsO{|T=6^-|w{?PY;(hMWcmbHUh0mT&$w$~b*(
zd$A|$=h}&kH9>j_t@>iD-|U$*|2leaeDL55cYI$I@62_3Wh8HT1+J`kWGKmYCEmKf
zg{wij+pEpA&z;pn!G_~sUgUn}u7tFBGyMlk7-!vSX>L*1@GQ&Lelg3<J@cu&#lg*-
zyf;k09<|GwKh?l)?XI4wvxG`IZWheq_WsV8!WsM}?1o8J@Vq0(7JW;JW?eYnv#^t2
z<pFb(3A^lclOx}c>b{X|I&_dxIZ>l4Q2*<y81WgU9M-|F=6|VPqx&p(?)e8-K6cH2
zua^D2c7x)HCDWyvoR+O9(&N|L$D^sE{&M$+Q2X-iPYcc8uaCar*Ilgc&2qGR*<-#>
zZpqGX{rSJ{S2+DG<Mj!*<JJnh@)x{eKA`beq_ie6OY_2o79+tUTNLllkyby(5WD%Z
z(aVU(nT9R5o0TSo$^4a`bE096vu{eqj)gw;CrchA*WCV_^muyWf|%>?wYpb1PjBX9
zT`-@;r|pL8wdwM19iI$(lozk(V>^>lbGOVtGqyqOqD%f+R{aSpKgWIwIPLU@?|-`C
zE^jF}PKU^69SpvERM!<;&ANB^-=&t1eQ(rV*71orZ@9AB)bih5W`B<_MJ8prbN5X?
z5>^rIK67QypM`G~xkWY055EgukucZH{HfE-7`MOsnqKIZzUgqb`p|JCF!FWHOpf9W
z^UN!FB$r-^l-j*1{mjLKx8!@L?>^!qkj&@2gh!uwudMRzo$1>-w{yw7yd<SrneyTL
zvF&?rrC*n87K`oHIsDrqnmx?zj8ptKe<^Eihc{t~+h)0Mf3q&&ZHIaKoi8VUN+?Il
z?>h8yF{g~hp1M`v;<N)4_VLCaIru`NRk2pDE6Gm4`iy0Q=^I~r0rrd2-yX_*!Sd;~
z0eAV^f^VEpriJe7Y>Azb<L<}cc55P!mhHA&1^a(L9&bFie}YGuTMzFPmAuoh*e<Vq
z6hFs}|48-IEi+<8H-8uUy=~pK_DSdYALLF9x-id(`G5O65sAt<HKEVVh3~%STy&vO
z(&?;qF^^1jPpCq`sSSY_W;HYa(Q0?C5ZK~ee^m7Otf}9w2{*qnYVy?x-F3m@{jSKR
zQ~BTW>Fu*gvQ<<snY&<J!7A5D)qVaFMXEjw!K>$RO|II#%$k{B?5xGS&o_<=t^aDF
zELj)*Irr9<n90xMdTSG>2|mrU`rhE_%oW;nP$ev{>yMTG^c(io0ZH8Z-ZtFZoKTaR
zoYZd7;kBo^i$C15XWE8G+`?0$_Eg6HOm;rj7;adz>SW#Ko28Rv)9>%IuKl>CzU{Y3
zKDXhMSu4zPq8IeK{x<&j<*J1E#N7wX!c{h2F?hJor_D8b$(Ok&)0&@h)?N5zx7br{
zcHoLvt=rY4?LM*UiWYep-}s{a;u%}T@qKUZ|2_8WRch$}1d)R&*C(ETpTAA~KW|`9
zvz$)zl84I{i2qz^`Q75Yfxs^A&&D<z?@f7KS$cUx`{u7TW!06<|J>|WzxHulRlIl>
z*NV=o9pM|7G9>Ch7q4AclqddN{Cm!k=7*2Y<*3I?RUYoMzQ&fYu1LK#_{{#Yt1*jO
z-<-U4PB?YB7=vW><jpT)LvDYy@s88y=5c48DyGh@zvS|h<$cYCUDGwTBu=Q5Q?*|y
zC3E%EZ7Vz5Lu*s*+za`*PQF%8uRrS)o$)1rm6_uzlWAYyiK2Ej+sSMtqM8-|UL3Oe
zm9qay>6<6XooBv?-*|r^`j5cvI2Hb@{SSqD%NhNHzm>aR>dy(Un7(tZyh!=)^ZB!$
zYN*BK)FjSdv+H9?M%JTiAC%kKD%S0Lm{^pd$6%>lx?-nt>qBQ<iw{;Gsy<v@JNdEK
zhue=+_okKVe4TMlVUmfT$p4MY??qpWiD)np6qe+WF`s&$YbkH>nGJm<ay7GFpLx73
zdCs?GGUnX%i8W=4Tdu#{oV>~Iw}sTC%=w=)KS<Uk@W!t#h!@p9XkYC=UD43){}<_+
zMayH(?~{M7JiC^y!1K|pk{tfG+q<MHxbt!}m)Jh~$aa2Bjc49YwNERL+9|pwcJDm8
zGUnrK9p>}38K&X81m>B}d7gAOMEmNkRa@p=$_{A~@4d1)+(Y49z_L}6b`$^Ka<XC<
z`m*x<j^2rlVd*hnaxz&QcuicLS!6;A=WpL@DIzktq)1%k%!<UV-y1YLjabApUpt<-
zzJ2kR<)vQd6rN3Big@MuvVC3939VT7<z-Rg<~t-!{{6Uqeap+k^_ySMk*RFEC=^#9
zn{4xQV$O#S<MiqN7v6_BX(qg{xhpaK-2S~+D}5Ylw>&u8E&0^`;GDom8Lpf@C7)s(
za#kL@nPRp4Qmx<G+WMS>K_QxkV$AoCpJFU6YWBD@<+SQqH={`lczwzi&V3%Co~6Zo
z%U97gXxS$x))niYugF((IJ_z2<kYKXY#PUBX3a|8J9#HF->+>=7Hi}E1Y-rNLxT=V
ztvvm6PlRyrlMOw21$oa?wI%;se)aWw8Z04g{V>F{(>y?rGhRVIg8f;IE#ohr3DSNY
z;&0TwG{2<Xu=BPyt{1XloD$g8-!eT$EX4Yr-n!tO%{K&6V`CSH3%sk|&5)qHfMx%i
zqz8Oq_l`0wE1rE{e}?#qQ(<m~DT}9EYb^g36(8)V?w-WCaME{$?-`!V6Fq0FTkkG!
zFMGsxpH4=WLid-)zx~za*V`X`%yB;0?aRVrj~43MK4@qVTw3x}Vs6g~8~5{dSw<%L
zEW!zjPn910RQPr~^H+t--oAaF&tE=VXyWxXPq?8oIrH!VG0pcu*Jj?7I;~N$_xYQJ
zyeAE~Ip%&^cJN-$<OX)VIqL7`);+7-+#&i!bf)d^^m4sg;|D7~t1S-~-aXmWGxf^$
zcRNcb)owBVrRn``OVm52{WqoxrLr@mr&oIwO+96H;-CME$<lx4pH%9J?$~jm`3LLS
z3!bx0HaklhY+_|LI_<s2Oy!|$#S@cu-^EUuYdNP&eoC2O-|*<3lvZU#(MR!31rO$J
zTqGgI;(tSnTX@apA~)$S)@6D=zc#oXN@gwLvoBh3?2Fk#m!p2H29_yN8xr{PrRVY=
ze3KJVGvVClpjLzIb)Sysl?h!r_CVvIS8!F^wxz2Dn=L*#q}@I%GkHQ_WS`)*gPXoC
z?XZ8Zz+l8#ULCLYE>Hil%lG}7cZwG|#E8oOm^gQ50o!HE-LpF8zfv-7YwYj3YVT|J
zse1kfj$Y9p+`T6<6FlCmc;#{QNaSCsoEKAE^saN6Sw;I_e8RG8q4ndK*G9AR!)FVM
z#mBHbo4xPCo>(LC+?4j)rsYno+!FIUb}CHSHf^Qr`+i}aT~}wEdHJehRer?T7aN|=
z<<u7TFwl4^e>Sq`$S&#bV?WYgtn>amDc<0)>i^WMR~qIq>Bp`8^y}|)rF@33{RiF_
z%uk$QZhdUgo{zk}cg`ifQ;PXg#FS&288xB&vg6Jcn`Bn`k8hVat&FubHudW&(Usrs
zF(=7w%9d$2EO#0E->^NN(vunbL7esf;)5~U5A^l8)Gaky9MCo+e!FX}cTx1a(!ki#
z;F~+v->#@l(-M4qaGK#dry|dHnel1NGj;wJbb9-o?~p!dqMR;$&~DCQH52aL7k=%T
zuNJe9_qCzPcHS57lvmH2?WrUxHpA$1y<yt!nUk+tJkmMZknFkThqy7<Ch;>N3Z2rw
zMKeA!iAjI<UHXB)+J!M~{?n|ZWlGcb2nTy-KbREg*|1h&*WK$oC0ZH}ztm8F)3<DG
zzOwt;8?1ek-#PJjMs&A0oLHFbq`K$i*OEJW;_;?2xyx=J-#8^s#5(R_e8@xDutn=P
zDQ&-2dHKiZRcq_Q98J3RnTRArC!SBb`FEG`*10|g(`OaWwOnMVY@TBkv&Yw~GV0kH
z_LC3qPk-$E>#NGID=!#&^j{s7w^%$`XJz2rS<jxUKkmNx^S|-Fii!zs5hhoS)^B9V
ztKO~BEwiVoy*cj5Jr;hQIX~{ot+_X+-*9J$y4&{Enqpe-U;Po_w`{+pwP3>M)d#)g
zz9c-|Be7gEa%)!9{)Osn=Z|)^6(pVaaXUYuxv9YU_1p;;H<}C9h3$T`Y2CKj7aupT
zxv6uyY>M1*z1WY<Ju{wu{;AR9Fh%pyiCe+f+SmP!vp-aJ`k}^V;ps^XN~ZHfQ&&!@
z;d}a?cdq~6DWByIP5I5)-Y>py$&*s|%cYaOKlUk2KkRM$r0Cvj)#;au<cs#M>(1t>
zxo!4S)zx5Ej?cN?klVkeW&Tj*xH_@+O$qPr3QsjAsae~Fge{I-oxi8D`$ySh6P`0}
zPRdy)SW|ejtXEqI%YHZ``OPI+qrK&<_eY~fk+h?J{^8pDf)C|7Ts^L&nXlSE=~2}B
z4PtSI+qW@(K4Qmsee=%)CI9<mW{FFmPL9t1S#tHYv69W13!CR<`v!4+D*a?A8p~Ds
z=j?B9pFII_kK~O_PA!?QROfYdm+tl32LD2rTCr@nG5wyIvw+O(Ig>THCSO@-=kuM(
z@>XW*s~Ig*7JI3C#9Xjd-gS7-L208Z<7Inp2;NC`j(gD)!|v{Wyk)+_;!wpWTybm4
zr#Iga@=p|(owb86{nD-v76~oqj{X;V%{(Q0mahWOyv<AE7sYS8Um>q@{>8qI)hA9p
z5_%a}w5%#H$oW9uvb@-XZL3P9Ki`#YxPAZTUiF#buFVl<w|P?))*cmZjoGwgMnm=F
z>tTW!N4r*Qolsc5eZ``!9u7~|p5VSIV=?VD-<6upeD3c~&wf&5*1a`v)fUe%OUbCn
z^P!Eef_Cw|IP!|OhJ9!ASEYsq`Mm#}>(lx-uit#X{9{?ht>gWV0&f{Ea6h}`dB1+e
z#>X5dLRj`+s8`K@{zpu{rpx(gOW~%2S2MqTP_M}R68!D|zy4;EplM;Hl6pO{mu3G*
z+5Y&TT@m~8X|@@^dsXDdh~5WE>^=J*c1{j5lzaSE%_`1Ve}T-Z0_jOJ-lfD%zaAl9
zx3;3dJSkI(Z)J={t{=<c9|lJcP6=-LFyY+BlBOQ6%NjEAF84*I-woiBnlNLgy=lFi
zy8K!BJ&xTHee7|Ya~xeW!}%;%pRV<5U&egDq+xz+Qr4+!it8*Q*QBq@JF(&FlSAjU
z%HA@vd!#2@7x1&HMry1pTHvhGlJ(|D=-rr5tDURgYdn<Oclz!}i8P;Y4&Oq1yyCxd
zKHjFWZ{mShhb*6*Zg5(6^tRGRqXQcrb>wckyyH`=P)MoP>MxwS_adjcGCi@GdUl)i
zKQ>OcMCRkW>q^RR+__{sH@(DVNzB%Zo1{10+;C%s(f7YEuO%ON6q%WDGqTcqZufe}
zr9z87HqAdg$I5jfZ#YNd+AskV9ifo)=Mh)9PqX!1xhnGdY>AEP7ConG>!K4K^>0nZ
z&K4cmJLluou5+3@FFgHo$VGPcp1g}+yw!F0{XF|(W}f5qlw$M8tXg3T-&a0#{51Uu
z|GdTx3q-tLPQ1eqxcl>AdzttjPQrKlqSmOzY(FKrV&@~1x}&Kl{hFp)#{X~EpC-V4
zOlrddExQY*c`pBrgLb+1AKB@$^!i^*%MI&U4NFg{+$j~);@2;EIcws}BZf^6o7FyF
z_WzMz5EiCi{9Y^f=bNmaSXLf|8TL<}9ShP4ythn+;T>;{#qHWPPs)NC|AhXXc8DYR
zt5<({{t4HKtB$hVDR+_Bl5_OL{fz~cjus2gzc^ld?tX8<6}~sI={I(?{|-`hP%dB=
zlG%}0BYIEr$)x>Wp&YZ5Wh{RM96WFA*In;=F5^RbSntvNj`*`$v)!8dJ542)Ug-*X
za$4=Ht-G8`K6i+bg~kNYs>!SQ@6XX#@}r6C+Wk$tbkZHI>Lu&Toj85`1u}{}Cgfe6
zsHuJ5qwq@cg{9WBuKx*f`gHn$%_g%m>qK7G`Tt^B==N;lFHYm{iHA<Mb6HEPUl2V~
z8W=DB*<L;T>aqhRE4CY4Zm(Esv6}lp!16kkK!@WS(z^F47bNMt-q}!^&elEItIuTa
ziQ7x|_%?QR?K$3Fzhl81e`9;~%KK;D8Llp$aq)j}=C{-eZK=s7Q)cl`Dt{#MBx1IY
zi$T;}4gc+u`%ZaE$^D(9=)IizTEpk4{C9e`XOmg$?u+y??@@U3r~jgpUE4S3LxRfJ
zAAYl2eXsX*K%2>&Ch41QN3~{^L|aAA)jjgHZq=bhhZk+$cxCr5Q>`zOCnFM<uI^as
zA2`ul_Ydpr8k_e%w`TXh=G$pq!fpJ@z<kf%9tp>}>yF;?t=D)k(XXrH_Okg-w{{hr
z%@5%UH}Y+`rPk1Bs+l`|@xnsBv?A4KVILYkg|VtVi7E@Y)0#Oibmie6jpjxX=E^&b
z?-VW)@^?>~zR>j5+2m_KKdj!W@smp}@BP+{h3gIm{*-!Hd(eXE+kvweIjfmgJc@Ao
zx$4BjkY#(6rq9Va<aHrak6VScH;FxbanBBE6RoN}#+AMMyDmEER^_&QxmO@vfB1dF
ziEcBli>EavzdR)#RDU$_%J%x|ETNgttb8vxy^LHx|KC+Hjzi4SceYPajhm5ryTOXv
zzT&jf6YnpR8n&Kx=Ur}i=<T<TaJE{nlEnQ>b^ku+u)1>OMnJ}?X)8;V3xeXdTVAVH
z>UJu&?G|x9%>P9-U2d<_2GhPWrTx8MRy>-y^p2<GBxaqBOIDOTIwvdaXtcxYK>v@r
zjV&Vje;ppJuy`lI>^_OBFu&ft_2@Y!yKA3%7biVXd7SgJsYSNGIM|@>)vARF6aC)h
zZ14zd4OkI8k9SMk!Hd_}E{43Bs9O<q)A;ZvU$Mlnhe8o1E&HtR-Ob!;U2*o*I$hnp
z+IhN{_HJNP|G16YChter^ZUon#}*enPQR~n#3|UTX!WOiTH9A|pS;{ZZl3SGy*9SL
z-D_AivusqfYo{OF|9G9(?dI$k+a-FB<lSFjl^polpt5FyjBI4T6<^72;nv;Jck6B~
zG@W;@=0IwUM@4mGxySO9Nm}|vId7|yR-Hfe=<U;~Q`wDn$Tzgz`x>zRM$jg$EbgnG
z?<)TDn;tfpF3EM%L-Tya-gDMZif%tl;<#I$;XYA#>O{Mq4PFsfBTa%Ayk0ePSNQd%
zqT55+JE9u5^-6_3KbFcN`tZq~t}jPcm~a1o_UGaY71{kw%G2(w<TP`fC*|TNll1WT
zh2!V-Yuvs?+^{H=u9JyqJ#o-UD<^0czm3oAb$7q`ZkX=homx7%@{arAz>NYQZas8&
z`6Rq<;({kG1)sU!o|lhLXf3d^zi53d?{5Ejzu;xwYdE#n$%^IQXf-@F`SrOIPYUWP
zy%k<3E%Vs2QL{PI(b2SfZRMBT%?|_AG=CWSZ<AIr`=@p?+jq;ly@wBZsGky(nKbSH
z<XhaCNw-xNKV<oPIy>iA$y}NHhZDIE3pMJ@p7l=iZk5%BlZ-oOgh@PTmTJ%4yRl(m
z+7Zk2XEUE`?mu*=#OPt$8K+Ou0q68zDonL>o@O!Up4Wc6%r#YcWuh$Sv)vqz&rsA^
zW3ckx{0YfZMIUfSYpJ)Jzq~*Bw>-1)!iRgB{l8yks9&kQuw6K0s)3-)H|^L`QKgOc
zLdOh+T6AA~<d;=ky?w*cbV9OS?b%mf&+9q=xe{ys_rOLc%hTzbW%@p8Zu7hQ<ym8!
z`O$sBw>4DkM3sNcjL|xFa<W+8lFPZL^~65zW<4!wUw1OhWOGfhN8idg{WmAvel~2$
zox*%pNWWC7%<u5hLw<6fv#ew9$rY&=XX~umE<5kf+`a=d6c_G0A~11R=ycBZ^B>e6
zzKATC*dX6h;`IK-s$DfRzY5pv;mB&97vz89^Ofg{m(Sc~z8>nI6ChO(Aay;aO1ty*
z+uLHF{a)}K-FjqAOQ2cd6~<%oDa?=M*T|+y6nm*RKF~;iWw-2K57+BAEUW(2Fck#N
zemHN_nxi^85$^++*Lqll8_raipgCppJgb}LA)W`BT7F7yuvxM)_|S6SJ-d(FTYM3f
zyIWM4>A5GM;H>y9=eN!p-#Y&WcAi|lXP*2c(Kj}NzVfzjr_bP>Iw!qC{88wAk0?$H
z_Vj5}rUgdMn&lnsz9hdOe~sN8wTZiYdxb?m%H~MxUO&h7u(0>&fmNl6JKK{A<19WW
z<;@ODpRMsIQghy!=O-WTN=mc5bYIR+rJ8AJ;qT2ST@#JMTMpM`yu5VpQ>Ja4<p+U`
z^#*HoSYy@Q_2c(eeEqBaWu^6<DYGA)Ke_GZGw*X^MjYJNwOoEW{|Wuja4OPix$wFL
z-uJG}*)}a!<zt4fY?k-7=zz7G-L<B8{#|*NiQ)Y%ZJCmS^B+7*etc&t=g?c!ci%56
zfJ>n8OuAyv`%fzW0(N%#%4=-lpFX8-eb}D0624Ex4kjx^De<d_a!XfqZTooO>8Z*o
zla4;xD$!LV$?Fg;Gx4;7u4BsCq|j};&v=@SI{l1Z^<B*5<he%AB(apwYlWvTV((L3
zF@KTE(ggXJ^USj3jktv3V*@Ww?DWx@yk5Za!p4WE^Buq5%{jJSEAwoHv}RJLSk4Zu
z|0gR8%0*f?-~Kkeb#rvlo7u@zq+0e>&7Zh^e#DFO-7mitiQl`jLOwCeNX<0gKjfwF
z)7u>Jvc<Uv<Tj)qWZRgV@p#sGb))6CY;udk6|5`kpB7K5TYJ%sN!Ml8+YqT2?qyBq
zYd`Fc3A<b)>Ds@jXV#&d*|QhfO{qJ(%qGQT+2j)mRtEJ_Nxss?Tvl9LYrXuwx%=1u
znYi!3#3geBvx-ioG*&w6W`rE&;=dKKfhXGJ+_M$BSF_eX&t>TEedpySw8H16Skp&V
zYlA;mZYkeAae3}B#XU=ocP=shcd`DjpnLt7_~lFbWd4TF^oY{)xjXT|E3Gw~KJDCD
zDOi}R$>Fi0()I9h4<T-&3_GVqJcqAaa(>_9pt7T8wT*$L>x2EKS4DO0a;809bEKPP
zoqgBZw|;`jA(m1%{crdep4%<G^vEO6<n7Hjg|_iK&J~{QIGO3(gadOHr`K0~`6@pt
z*>wL671j@$^D`g5Uio^H<)iqUaekkVuRP?Yob~!2!;%BX>r3Rzb4(=ro2(1M)H2n!
z#LMW#&9{46?eXcA&zA7zy~*Vsc6&wmPrjd$HQUHSdco#t%{_Cw7$$5~lV5#Ctk-yX
z@fVGa!c%$AD;?0wD2j|Y_s)*V{_BKSB_c1chU^RE6yUdU={ndU!u*BpWM@xa`O{ge
zZeM<7F89OXp-$z(#d|;93f$tsaHuhDC3m>+{a{J23fBpnr(ZrDo_@Z+Q1$Z7bmetE
z8-*wJcHiIFC!sL+EnB$iv1cN?nAFx>VSVPV72PVLXO*5AU0Cty+nutDWlf)&Vh$Ir
z?@VN!;%rsdDbqcnQ*P78pcyt|i^UW3SQNII3f9XS{u1;}HZDsKO?^?dtXcPwxocCy
zyWc|7?tvDiPx&EKKWW1X&)7e=N~+)AkpCp9Sr@9<Zr1Q_I*Vk+lUeEiikhBHn>=|%
z<+1-aUb7Z||Ii~JSCk-n!0!LAA4%>mOf}0&C+_dx_Q|?orPuLUO^PY;Rwe!+G1HFy
zI(n~U1|uiqvvrOy-|RN^JF32}j{kh^{PX{JPu0ELkvsX~)%7pEmc}_Kn1nxxb!c={
z=s&Z11#9Wvd+O(OC2!gLxays`{3N6K-wuOcrf0Y3Zat-cI#Mh2*S@t{0v0<Y_StJo
z1vt)2$TM+X7kDd<arc?oUk<G2VmecJg4@!uUej!TK(fxU&h)EdSGPXdb!PJX`Ii<y
zp8wvGW2<S~4e|YX-V>JQSY7#UTJyd^u;84asb0Mp&*{k;Ph2n8E#%Pr^C0$g%J##z
zje-)^PBy(;?e|h)#|slR&!(iD-bX9Xd8{y1X7Ar8{lH_Q+sPxf&$Sa|p9t}?F4tw>
z>n-4Us_%@)@iKY7FZG*a7kBx#{kf=QyW0ES+sx`|doI1$u#9QzQ<1{|%JLJxtUY^h
z`R|$Pb~irUjoi<Cp63Slo4s|l){>li3=F*PeqUv@obS<{$`tXGHyV~6r^HXqd&8Yj
z^l4d<o`d1`m%nWDi!$zR=aPJ~aSC6FP2kt%24{OOg?yIc^OI=l%3pl=!NdML*EzSv
z#Gg-Fc>OqYac6~hVAZMTtMsN_)p;)R@bjZxa~9Trmf@c$!*ct<No}S+z8F5cRmIPk
zdWG-W`Q>La)O}TCV|^aG$6|K(tYasq<!?}#{vuwqGG^m{u}h0q7)C{1=w%SmTi9$c
z^NWb+bFGb=1AmJeKAmRD)O+j+`z-F2OVs5yowQU_@4PW5ZmaH^!;2SJnr0hW7@t2a
z^Y*Fx=C?M>>-j{5WrJ1})^_}rpDJ;EM(ozrPn$nnSz_m>r;>K+M%$S=GLJ(|Qa5Yc
zyT<>tk-KBOQhtha^ox|n#E*WFGpwiU-qG)8Ti*9@lUA@oT;@853zyZOZP>R``@x!R
zJ-gQwTNvzlWi@m1`EAZi`WiC6>3cCw|8l^6^V(Iaxovi<&gL5b<SDuOTJO}WmkL`#
zA4|NtFTU36;rxQSJh7h@56`>l7@1q9EvdQ@x!=0w%9HNbC0Ta_g>_dxW+@hKeWP-d
zqqJ3mNBwUMf6uxVFF!1*PM<b=nM0@PO#SJ?Czl_;)hcW8fQ5h8J+Di*cK0m{5op(M
z`rMc0x9{&CQGerSe|82cu6dQ-e!0N^-h#4)N!fpP3hvr*w1{arOVRxk4w7r9U1v?3
zt((5qqI-qfqoRg?@AX%Iv$k<4Hfz6oSJ7E_!hAD{25(1$(^*zt`xl8wIxdj^dHE$5
z>xCtqrHz_}qBiCSO)ob8G2u^I{3Lvh>$mGk(ZRnSKX$ppIBET~%FA_ALpI->wn;2u
zNnTaUbKk#mYeEbEEWYX4U+}T(b@DXx$-Y+?^qkK+sabktd1#7dO~I!h2fQ;4JR__o
zro2#`U|N?cTcs@VtKK>9^zRM(D`K<%wJ*N9X{UG5vESd{*SE82O^)VBxw=_ge+z4O
zwph#|u{AEe>y_?w1ZwSfiOYEDwCkAG(aUY?zn5NQ)yX{Ln6|lWw*FjO-=mSq_h&A=
znrviK+$6atNae~CrYSskkFoXyl|3%@d3H!HImW_?`S&fRW77{jE!kBfdotkoyv<Y6
zOWnRkY-6-hm}k0@x03fqC2x7!(odqF{`Lg%7r0!GwsCnRwBg)dj~u%ne%@XR(^3<=
zl<s8+7l-Vh7G$q{_oe5l-WM^)#Aj|fJZDMf4r_*gcXny>Oz&{{t-ZZ__OVA|c3-#U
z*l}}-N(I^~^~4-dolyDvki|!#DKZm2>}plt;B%y-*68f>c9Gtwb+L^<^v@<d;uUun
z*Zcix!D;5(L5{z*MXY51i&c8;(w1Qrog85C^;#d_DK}oHw~LM!Fm(TzdM+uYh56W>
zoRjlA-ud|+a`m>*%-&rnwNNClV#1Q{I)O|T+a*bUooOn{<`c6co&?<$I;T?*y5_<s
zzvsa^=d5*~EX(yZ6m+vbaO7!Zzsf7$ZCsxlr`2srSlPy?c-|n}_s6@tUqW}gAH8^O
zDTCCBS(B9Rgm8(gmvh(2shod1ySpQ!z-U!VwrjhOb#{%`rJHG6@~(Imu}+Jet`=-$
z%I_5<vhY+$=c8B?#*6#=E;j3QA2B><Vm){9vbY$&Q*8OFt2mS|om^z`UG0?DtiykI
zOkdx;gI(O!VO_@4Akl=gk~h2D1g0IIIJ+!<cmD^!KWF4x?%aMZscy^1bvMJWT5P?Q
zu$|7{{FOZ4UTO;kynEU=|Ka_$H=bF>zUb4KbN0!(?;i}8GSyj!>{#I>!_B$%1%pxA
z&NQXUi|^)J9g?1J(P}R%T~K@HuAT|UcA2)&?G?_Qvi+04AANh$DBkyZ<s~x(7k+v5
z_=nqbf~Sl2+~2Qy=+sm7&UK>JuO@T<4%v46{DM>8VwX-X+%kXXj?!<8YgQEtgrsm~
ziMVcibnc>C+vzngr*JK=a(H&KVd7!6#!Tgv&lYnW&wkM4dXlfr*V9t(;p|N}5{}N#
z%3b9kR{YveCuGLTB>{)(maR&du*v@Us<zr6Q7JilQ!ngXEghus;Ec+*^i<nTfhxRC
zGs1a}&q)mKsatXF*Y@OTj<P1XC2nhudTP0M8;f0aUcLQSug>o9){q;QP1PLcKD29?
zr7-iZ-;Wy|?elcv7TKmOs<|;wQ~#M+vVxwT?f+k|-bQ|3`t{t)1J|wZKeNs%w=@x6
z=6b|wW!>YWW}kk4Q<i)eF-gjvdG(^>#S=JU-^WPK-B>=Qbh*PT2UlC3ZDL1i3WYUO
z#O4?5{;|vNT;LC_X~p4^!S=iw+os-G`Ky|v=z<fc=Z51+fqQdGPI%g%vkc3;`S4?-
zn9Wq9-J7Rme^2R{I(L15nRA)R^iR*@8tr#Gl=_=GmC1havpG~zbS~34b4#)E_WOMS
z-UlX#y$N}J^!#&=<M(!Mt3I3jGS#|)E&ZF~hr??u=dSoJ$`Ud^@#spKURC)Cit7&_
zQc1b~y`s6}YV6mic^};JmcCxM^TyTXBE1j)1a8RO{<Un`R*NMQ;%=;6*Sp>S-NTIB
z<}bHv)_p3Q5;Mj7x9T!E|1ClD#EN$vV$wGI!Fo+<n%1Z5l3r6^s4aOl)vavNjr`Ah
z-rZO_t$5$VqdF@ymX<wjd>k)5%l^voG7ZIrMh+S0zl-1Ue&y6Od)hX|gyjv}tm60z
z<@#!Cf(n^lo#<+xY2sZxf6nxY^OTlpyX#rh_D)_pd+ON<XWi}eR=nw3{6*o}SrxU~
zDf=qSDhq$Tovoh#&v4<QC&^)&ItJ`>3a>^p?Z{_sza%K!7TZ`*xynO;@6YiY{1(Oi
z!dmCoiJWvi>7%1-s55WE!e8&TCN(!qGTMDIJK<=OrJqk~!lH`~0&n^)BA+}Ja_`6s
zDX7|%a{0i=%vOgNZmI4+tmUt=AAD(X^qt7bawfSS{(MbE{~G6hywJ=w^LMjqnbJ~y
z<@xU}h<p@~vnah#6=gclX!7-~x4zy|Gw3_GK2Z8f!sGJ^(o<urr))pu7cE?RC2_&4
zd-klJ|D#gaSI4|qbimQ+@jGwM<hb4)OhIP6xA|h$SQfLz8b7ehna%!0tdU3b)O23q
zHRcl+=$+ptpBS<4!qblrR$7<1mj`VB=OBJxXYcma>))*nERtUobv`Kg_Hv!uAuEow
z=>1l6NxATK>T)eflPGi5#iA{l2E9+NJc)hXymi{ry_2KvFDktAHvZVtw2IJMvEmQE
zU0Gi}@eRXTp>1^+YVNbUJbnG}`9u>|h38@2oM-PAt?apW{G_IR1sk`864wt^>*vDf
zb;H;gShvP3@K_M@Ozh~|>5F=F4R^@?I=k)^`%|7UO|{0Ga~aN+ToKOJ_L#lxqVkG`
zO~#+g_%%&W*JT=TR2=Y}lYT~N&YDAi{qsN0TfLV-%lzy{(<ts~Pj226o-%*wai-b?
z{ZF1eWxpme)_PeN+|qh@<L9jf|H8R_-jqzL@wphSVyjl<mEy8!hK%g3l<wnV{hQr0
zQ&#)CzRp>2_W1YXCrjDV)8~i<THNcOoUI?<xpz{?ri1>=;wE{jE&2JFZ)S@C>#g&%
z1$(dU{8Q8Q)zRX3X6)L8_;p8abL>7gW%9|g-Z;bQVG|zNELPRJ)urmZ@9gYDZd*6)
z%bRL;Zk}3ZPt!&J*@rcrPkG!J+RJ(F3g_n9SC!M&{^F1+f2qPR+N@!y%n+HXl#|ii
zBjaNoJ|jwxN886rn&DLh)1gPs2WuK5B`uU+ZT^(>s{G94t=d~d?icwkSz0_l)Y@**
z@uitv{uhN=Vx4yw96l>r_2s!Y-@-N59=+0!Q<`++@U7EgPj@XT%iFPK--c6fvhF24
z+qUPR;8MY#_HD;DKGB$||47W}=Y+Y*3ukV2na(^RWNpQnZU=p_GdT;ocKThj)^oP$
zb9)l2-gkrVG{cJh&DGWWy!3J}mamnv7t$|X5?`Es_w&O?t7hz-e`cEKpWA!%^W4@|
z-Y?^Q5bt!g&5|?wo}?bvml?<G7%KLpm$Ta|sAT+Q+dp4x#ox-e<!ffot^U#XJ$BZc
ztsBiZOZ~NM`^wDi8{A;VlfCUsSju~s%P)>4%PX25DBQH+eEYvWo4vd$Uu(2mb2J6V
z+zei~s#I`hSkbL1UP4=5O_w;@!M$5=hVynMNrTBwekWztOn0<fXJ+O5L`;I$n05Oc
zhD~cvpFX{4nRLNU26Km8jnk`cS#&B~%)I`Rb8o5t3qi?Do8@7XIMZ&d^Rvzs`~A9k
zo<dZ@axsyN{Yo|hzZ%uer|HJYf6#94*!lT)^O2&Dv!|b}mJ$^f67E{db#i)RtMguS
z&6_QYjCb977V)&`_L*%GulKLomVJgHDj*_!-?zBBDYjK#B&G@a9N2SmQt)lTU(a5d
zt*AcC{F8hCb<t`G5y`r)J2Mo_Cuu8*MV!#!Q25!g<yXqai3aE0U%jySJ-^$(_q6A&
zGI^GQL(>kj?YG)5x^Dir-yLO@^<O0HZ2WgIrZFCP?)__*&+X>AVy05_T<e;mq%i%d
z-!6IGJn@8koz6-nW^X}H>mPe>J=y5%-{p8gP-Xj>bu7JiUrL_5`DgZX`+0jSjVeDq
z`@Q|X%b&Bp_7XZeH&*T8%PMj1o5&XM<dl!<@2j~^Nm`q|)m7InNI!Y@^!f}<TZPzX
zyLQ}k3|dv@7n&Esa&3j*{>rcK-hAD?`J(^lcJ}*A*4;R>TPS562iG;fbop-^Dy*I}
zM}AFjTEOASz}l3v<&x`VXVL!8%k@Rp$-ms|f4`;l*(U{lbycbFpE|OmtW)gNSBOu1
zSKc3%abG+`(>LbtoasNmge}hzpI);#d1?C06~{rlu$St8{}Qw@tgUGKKcRr$M|}o!
zEc|+mmfTr8rJj#}mvL3N&zhndh4L?&@`_Q~&Haa))-e0-WnM1WHltEM%AR4dwbA^2
zv5nl%r%Yo`U231Zk>_K^wqrdL&gC#pI<-1<`rPMtn1vpEpZSGP{p07vGQWkhmMg^0
zdb`tGC9Hn(6P{%qbF=4i=K7XQR1cX_y-K!R!T4t3M^WR>+q3i27o6HzwCYgxD(<p-
zJZD6e{+8|7J0W@EQ;op*I=-qOFV}c0?pR#0x$ykn3HjDt+OPL~e1C$^MC7a9lMsgn
zC%%90qJylP**%LDQ+%2xyxKKKe9Ic&gBr^xE&u<+;#q_HrLQGhADvdZV-$aSuTJjV
zX;(t(#BFDtI<!u1<*v7@o31A2Pk8a<qS7-iCp+GWO?Dft&E>_dHo5fux%}+2`k|0t
ze|tLCbn9CyPMh)2reDrBN%)cOQ;k`*n){kgZmOO8E#*nZi(^-U<zp(c5;m6bGCnVl
zWcd1h`M18cpCeAQ=5D<px$fxdu2XIQBaKAOldUdFdUqIqXKj04w6RcHSKH|gFYk_v
zTYH|y?Dm>c875m2d2m4qx0RMzHy``!?{5-jUP_*s=T`Vw`Eg&_s;t5%8`7gq-yT`H
zWa6~A4^8ho%?%WS%kNiK$XvKsXMVo=qC!f1;L*T}sS0b&*pCVBC{casz+`#+;@^$k
zPZkTwU(#=!6Cb;Y-TpjpRQOt*zl*akT$TH1?Ijy9ljr!!TCeqI`2r^0i&4$rfB)~U
zU6aDv_nrHlkk0nQc7Dml#XBlfw_E257${`>PG9xDfaU$e9$7cX)3+qjel0$f&cAfR
zPW`(peP&jlx$y7rhRzdHUGKB)c23_dp?+^i^6@Dr);)0Xcq2B~Y@fBtb3OlTlP_;(
zXtgc~>hUTsvi~2Y_~*@|=Dl~O#@_k<RiOXyUgn$cB9d<8M3u{azPCGhfmonTVSiN0
zTkYD_>C@9=)>w(DHU0Xi8F$}%tJbQjhRn>*sncu%PhDQLs&84PFXzcM+XG$V!d9I6
z)88)=^!?43v&)sQN=&YK9CgrSLT>8bH1lciL3{3F_GhZ!s@=8L(ERKtvBRGY<{NAI
zh9!CIoUhtl6}rCbmR{}3KUa1>2=Cs$!r+na)5^yaY|aTaoK&0n<k6;#gA2U5&K=K{
zez$U$XxPO~1&je1rd}E*RR=0WOON#&-!db#LU&W_dhQFiX5G2QGPS4IQvFt;VzZxP
z_5zWgnV(l53VpRiQg_L-(5heow<5FG$?<cSukv5|-plXjRlk?dIJy>EH+3)c+S57X
z-O8l*Hd7bsPMj68^+s0W$pBkfOU4sI!n(Z`vy{EP?T_Z{J2GX}_AWuu=Y=!G?((Rt
zH~6?9ebtjs<>9SUAN4*AHP6ym_Aa`>{h6%h{suqU^Sv)E?;ndOnSM%^H&1i%xvERD
zyG~TS-|^<k*GKcRLM1CY7pXNaP+7IUUEcXu>9(u4H(Z|UC2{-bt-hnLpDiu@dQgA!
zs`p!37*{)XZ*4C2(Ap|DZC+F5qd!mQFS@>2R<q{xx;uM+tWvBhoU3p9<cja}c}K3j
zI2EbqbZWlLg!G#?%QheRVs|Yx?z+5RqV?)q?PcE2)<!5E^b9!3IZu00LU6Fy<tEpa
zo9j>HFV|v_kB&2sQf1sRgUe^OU&yyDuk3pYTS~31bC<4deOdM=VAjpm^2Z){F7R_)
z{4F|Llf9)}UC(8mzj^7sQh|HgXT19}{3DOPx0KrwSYMXc&Xrq|+%rS?)K-R93pU<z
ztYxzIn77z_*(yb??&dO^%?sB*tA2Bb=@Iu5-otm~`D6RKf8@KY3U@C*=$Cw&k6BMc
za(Vuwv}w(+A~vTBt=hfXx4XOjaWL0KBh4l3Q$KTvtl_(6a(n8kisPc`2HOQw%d@qn
zb~77`1Z4-bFErlXvHDj5Z^-#wCI2)g<uBO0DR+J2S<RSRj{D}ammDhizS6YJrT12n
z!KY>MGGF?4#rJar{ha^r$Km3jn>XuxBc%;bK9Wh%ziz6j?>K#tl5Jp3F#jSgeU|6a
z>n^(A3x3)(dCAqIixwD9|8e<XLj6JSg3yQg*GrD*p1q*+_u1Rk<@xjM=I^Qe`s$7J
zs(-;{lh>MrdfokgY}<xjzo=ilvIoAsKVFxcbMk3l+`N6&pP&6ay}5G%d;9*qRo#2v
z?QD!t{<?-oFq-Y*mp4COzxRu`dGDT*IP>6+m|`89<Nwyo@-E6N)Q_>_k}whdw=QkH
zMQ>vWgLjDh%H=a!=6|UztPZ|fEbBhK^;*Q&POEo}(+aP@u3X-{?@fW8t<|a16`z-T
z+M0c^PJ8-w_T~MymbcF;&7S*I&ERR_hU#1LyDh%89eZ~5U>{#Ee-N|o`NJFE9=)=B
zx$_c3M|lxDQEmB;E*2U;BkG*qtrI(0)|-^)>m*_!{;yT`*<|sBtiN~KC0b71yY2Ea
z-P>zlsFxm8<S5zEZd=jW)g7b#YP-cT7Pgh<8o#qv&s-rcz2M3k*^RH3?AfcMpMTDF
zS)+;6)J~U;0Xo+8<;DkIuNItjS2OC!kykF=lf70y+{U=uW@*AE-g=e4ACAAjzwN_q
zuFJKV)9?4J>58`acl~s96N6UkTkhDPm3v-piYPSgd~!Y4_2}9+UN_n1eO+eMQ{a@e
zr|syT8>zO@mwMlYZj32<|3Pm0-x95>v(GHBQMw;=XrYqZ{ut|Pew!9YXiN(Hu<cgT
zy8=DiZ;q0mg!%-w_0D^8a@|%flO;xX1qBrzNA79)AQ>wdueL?qe9!Yuvm9RrIW9TZ
zS05FU((JnMb+}Odfiks>mbH&+_eATjxWHN<Jv%aU!5NW)iqlK48A_>7e(QE>?V7ni
z*G!vos(16G1XahP1O>6xA(qxlL@tQF{vwg_?M~1WhI`vD&YZ;8|5Ml3Y<Z0F_ousl
z9R2P)`&RIk13#-KA1qtCC3eEH3;A>Zd|(Tm$~!$MBy*Fe|Gp)Qc8KxJIF=;0e2UiM
zLeAR!<spvEVRDK`<NM7P@XP=G_`Uv1*o(@S;$ik)Ynz2lxE7V{HTCCIhzaIBv-XM1
zRWatbWs;lkE$dv8oWE|`(RQBcv4)!#_f?w&ysepQ<8v<fa&gr|_nh48UN@MRtavE?
zWaHBl3tO)jU;cPs#c<o!g9U!lH(NjOFJAc|{>k3!+^5d2T5Voh7JYQp@^^Kc_MI~j
z_xg4C^Y-;|emc6sYVT{FEB<@5fPdCSRqMvcs(Sl1+u!eN^%Z<*VU_USd%6DkdwZ&W
z|N0qxxt`tr=3H)ZMvc>sGHKPprn<-WB!~p=+*n&5yLaNM;*^<NPGxK|(Cy-CcZ}F3
zt$hB+@e@2U@3$>t`Oc>J(t5!c*BI6()_zqh#TkA)S>~K)vpr${6g~g0Nm<i2mc996
zB&@gkG|xZ&U3@yGT8~ySsPkC-)X3Vo{LzHjyUrY5aq!1OgH(|%Kks^e$|%@#CVTzs
z`9ZJ#T=vgwip=EVRATepvQ#VJ<ngL+Cpmj2UQwDfEuqP=sqOe0jxg<Jy%o{3IhQ@^
zk2pIm^lP2>{v=7!ilF;_hgzm6EaL2nK68zsPp<nL|Dh|NRiBo*zYO-u^^D#dCcGo)
zg>JdN*_@3(7Jjl*^O7;WAyT~mOl0`KYn#K*$6b_t7aE(Zzy8Ea*>itC3pra$pV{_h
zUqbly4WB0aJ}KsF4f?djQv6Zu9Q$1xF0to@SAPD-$0>W|%H`jGkDge0(n4~gb!De$
zp$xy=U$u9q#NOBR%|CjV+5C5~@|*8cZ>o1!1q)xh+p@BJ`ouDAj_QWb#;TQx2V^U~
zp2eR1l6t+bEZo)Z_^Qg?w+=Ftn>%fOt$Tm=+YHZ(@2#Uvw`+U3Y~Q?4!ux7eV&QG(
z>0eqTBA!maq}`}nzwShw{FXh=5=D!q?G+cyTe|y0^~R=N&05Fu0~_aVK6NvKPvvvt
z+G~d%?!376)}NqO#m9DOhwdhME>F1er2b;Ga<_QRb=H0%_Gd!gQztGoVg6IB@>)jM
zH!Ev-V}hpPi&WKsHM|A3(!Vy{X{lmRJ8diUD<k*bxi`UQKP{bqL;ViRiuv<u?4)|^
z#i}lz3%#&KYkB`=zng3?6+a$ijI`2R=CSVH3y(*8wicXi*j2~Be8%K;OJt@m|GiQ<
z=Ik~dW06gpPOo{#<{Wr_mFwnMh5HAi<u}S`1ZdqpbICt8vO~!8wxHBcYX>vYgGahz
zZ5<vf3x!GhN${Jib<cbDu;A43|J%MD(69_S!>_5J!+W5V@$oacEzh=Pc8AW+Z#!(b
z{>6OH%sJwhbyxJ<-zeAXrXUjP^($$es7+cxp2|zr37?i3%$lrs__h`MGA83vxm`}O
zk586P>5W{vI^-^2sr)0+>pf@pF<VPV1|9F*uIsgG&l#!MC*S@!elk0LX?^>ty!1OV
z7phYBzIb)?_1mmP6DQgm@K-HdCu|_7^zZ52N$vZ**(MYT{rVBn+@qu3^U?SGlXtGM
zJ8J$+$%q%Iu~56MCwcwB^554C-YpJK>7BOwZPmQLTi)%OxbweM_N!&wUo<>3_ig>n
ze#<O&@}@X*mn~b?ZvS)6|MhR#2f>fEmE1X5TY^hoC`j@ZgzS8yG~Mx|x5AlY`%f8u
z-mxSusjBbqm!{-urbm`fD#UcxHfZUc&VE<oC4Fl0(u(uR-hXr-IF?Fw&klD|%d+tZ
z?$p|~vLQJk_U?q<xts6rIJ1M{&h5@ZmWLOAn13kKo|>Q);r3%v`<<0SM#nlQo-}{u
z``k|9WJ{C&r3}ky$+~=3^xb>EJ(T*gD>}*WliLch1uwTASa@13Ea=Jm2&;9CwFjG`
zbQhJbn;dhWtz)lki}*`Nzo;GBi?7<se-XOt74p9OtHjpp@8kD*OEWq@uin+KIca^u
z^ws(My&eP@tkrm5q&LIe;Z(#0T@kkK>t#DyqE@=^U3aa(>voVM+k-8u|Lk%J{>iKR
zAajj|=^oET&Tj3qUkko<X!4u9b2_I{{=_TG&H7qXA0F8C?(*#?UsrEmZhxsIsMUhu
zWbXwZkEuy5cJ}gd|703Z{z^8|GS1L!DgI#NkOi8)ywUqXNr3HJ%H~KhmQQcb3$A-<
zFjq$1|0PG`k3B~>$_dK+i`ueTXQx(UbD~^C!rE0<ZV~@<PL&o`a293rhP-%uR$#xR
zjL*z#>T?|z<a2hMa+8ZHu6Q0Az~eHjjc<2P#0jU2g<g4w<tHa6m9O$$)+J;xdsocI
zttwWU-NIizn0ottzTI6MU$p09p7K2_{z>Vg>l&FZXI{3QF0^*)jW2zlQfHdG7Q3Xf
zGczb0mdVs&OnMS=bK(h`{VI|9xdI9<AEmNXc4bXZC{gd~7mV`mi=V!}=#l7T_3-8E
z=AZCiTzPEygm=Hoo^F48^T?Xp)v{HciY;cg-#Q(+zRj+UE8FS8E4@8`mU+;L3+dhA
zf9)om^||`yZQA=Yb7bPw4ezk$)KxP5m!HjAx@dptkHsEK`;Qfwb(pE}a_pRTxlrkF
z;4zjtnh&4tJH&eBi1}%Y$)|jG35%H>Yxy;;H{^)v6zM4+iw<tBQ#xU2{l_m%HT2G_
zLZ`$-9hyGDYGEl1_6HA1xpEop2$iZ^@$7c0PG${1tLDW>?nyme*Ua2sY;63s^u-~K
zI0t7_(OD}4Y)xJ;b{uwIXdkqwEC1|?`;8y26hzo3{$0(kaBszdq`ii&C%!zKut#x~
zmgGT3+td9UCVY0>u{FYEs<UwK@l)*kHk-LsFx`&je%vV1e{9yeH!Z9Bgq~bnz_jg5
zW5V}EH3__XKP-1W{y1Q6_PWY@A<hY#%-MH&#f5S0Op89e&edI#X{#__LNlxG9p_bh
ztEv=B+_m1lQO?`*So7GmhZikW4rZ!H{`dL%v0%B1yYaryDRyxeo47-r*dOmLQ(g60
zjhmx<h3%3O^Uh=Qx5uyK*W^mJDCysMh&R=&Z2Jsrhf>xo)oV{DuLw%?+-W`W*s0sM
z&+|8b*Z<S;@OYqI?;%gG-wB?{QRTlT-%gy&{<tshSG)LgPv*z(x+ebmQ^r$1UG$^t
z7KN`Db-Jwo{`g#RDnI#&Kstl#O1*C~oINUsIlC6@e|p+x<>}MfB~JS|zuTPu_ieh$
zBv}#rV}DZfSl(0yTivuj-JAcxy1u5y@S2+BFJ+Tm7m~koF!ooOPAV^W*JS*D{q04H
z({1iN$>%au)H3Y#Ti@bwf0v2++<C!$ze<+<xwJ%Tmzw0pyt0n<`(2N-w48pRCwXT7
z9i<769p+EEeg0)#z|jjb{!9EPer4l7w2g0p(!Yy8jHdmNe<qzFxOrX2-sxw8`X)}F
zGJn(A8@na`iC-?2pTPgtH}3pw=bpJOo8N7TnWiiK;mXE6IhuRq0uJB#wM~0%<K+18
zr!v7)#B|eh*jJsI@;F_2+itGI{N2u9yks-3tqf3qWcBWJ^xljcA6ny9-;x*3{;gs^
zS@qBJ6`28tw(zdJsVf%S^Lkf?nZlA22M&w%zSLbVEZd@b)aQ~%{+cglD;_<z(J44t
zoWOTH+jDD~YW|~bwqBD1*64pMt6kXk^Z(!V|Mz;^%$uXqZ+X4xPI<|x(|^}${MfiO
zXS>5!mZyBNj%$oR=w~fa>1y(>ySlu$=)c+5qb)LmtGzGmY=3p%Bl^J=_x%%_PL<cz
z<z3#LwRG<%5qsw??eCPYr00Bke6RcD!au+2-!0pBUhCG@x__ozhvw;gk6ttReo5~g
z&-)yE86T}nb$;EP`mQ=IEbhJg@#zbmG_8r7Tyf7^;zVkD{#yfc&cEj6#XaY=PhH(*
zvhJGUuL`~vW=`f;UhygW-#RV5|8SmCXYW(?-9~Z2=c{^bF3w@rVyT*+!|bt3dya<V
z!MQB&e?{Ikh(D@#&^dXs@}@_LE8ZMm;g}USQE02-Ti3Xky*XDaPV0O%2}<^|pQZU*
z<X%Q;zTw9h-b)`NF1+P<Sz_>^YtGFV5(e+y?)Um$es#K$i2ctkg8n;N=P&B}k+Wu|
zx>ND>o3p%pIrsGWnx2w>qta+!7B(d+q-61eJTAX=M(;h>C`~iSThFnjww`@me#O%K
z+QspWhZlZOh`IjZLUeY>9v(UQ<LX6Qvy~iumwV=z6}*vJ8d+6P_rv1MsRh@sX59!{
zS}C_}+k%@~$<O!X@w$9}Z)iH1S2F4#gC#Hj<tK`Ky8C>7=|0)L`_)^A)Y~yBc}Zt(
z6s%k{p=|zy*Rq=;-Qr6RcsH8!DaS0i>CQUUpl8N~gv3Ky-D_{$<rFGc>*To}c-f8H
z&-0n{*8;BY`8;di@JhEHj^K6>w#+<lyMArrqPCX?VkeSWD`e7hRa2EpUr*ppVq%&1
zovU9#Enxvm;QN<%%!+I~`{z#$+HhA;{1vZ%TEJQ--m{X7+8<kMC0+(T?>_TY>8r;&
zgUMyd+<MaIx#q9XTT!`e!keYbg)I$3c+alPn(D6q?dSjS6+XqYChrv9-ZnoXmO1sw
z;)RxLx4xJq?e+V5tI$iu?#sCroJaWXUc73&^UMtIw{fM1TDPZWJ1$R(n6;&&JtW=0
z;O-KejbH5(83m>)b1i<+9lL9SYm*(v9<gW6;>`(G5gZqPlxzAYyEbgJU69DWf9L)?
z&kj~4=Zgea2uHoJZ!3MYI)Wjwp)WODws&2o{khBso0jp}{>-Rc?BcTI(52{p@3KX%
z8P?Yx2gR?NRcF)r;?72W>u|N$X!nY{I~(HC6gL|!)?@#)^3^e6*~0I0Q<q&*T6JCK
zwdkYG&MoCTU+%d4wr&1f!GsHElm*$|ZPbrin=)_Vrc}<49`{OeHoRwRnBN!k-ugi4
z(|68+f`J~QI~-4ov}xbydLZ*-QqlJLdRJ$&NBU~L<|q!^5q#HWb@qM3Ri<6XRV@5p
z$*x?!to;7(GhE-e{@(5U-twURa^_c=OnGCkhbjRV)|Lf#Irj<#%DI0@d)T+*nT%?0
zm7Rn{w|Mph>zqC3-dHa=c<A%(tFNw=3mudFq`PtY<6DPs^a$HlHSc1b{@tu1phkh2
zz4m)8H~WW~`zJ5#cyarrj<-tp%pYxO&zm$>Z}p5=Ahgiu)XtXPU7dl4KAElDloI`6
zLQtmrMd{EAwdDl@pYqfcCnQK|a%Me9d1>LZr}jyM#LBSFO4-n9K9>*fbZ+TqOnk5Z
z`Rh}&{W|aD)xZD$3py6`|I<2;f4{YY^|n~;KfjavUH|0YSDF4Fm0!AP>6GYw@|-gJ
z`~4<ruTi-qAd>U)&;q_=Wrrms0uz-D5{f?BXNj!RtXtghTqDd;>;p%_T{W&NjXypA
zr?TFi^D_Hw>Q1eXQXI-LAM|W3AMNR3y;rxGJ-X3p`lF>5($l<_XdjHcS{itLhD`Un
zo(7Nbt2S}PCyGr4wm!%^`Y^@VX_3#XKgXVY5}Z_OT4ucS5qsoU@gT;S2^Wt{68pFR
zjUW4~?|%iX{;Q^08+IMI;rFj=lF61OKkcOVm#7}<DV2Y>rtJQHp4aa_zxw&s&9h(5
zAj#Ep&HD|H3+gmWdZ*sE(&DWwmYXJJu_5T$jBRl-vpg;C&E&Os(sOO$2|oW>Wm{*i
zh~p9Wo)fWxNh@t@{Oc`U@6NCNHe<iQ?nmkR(|8LdcuGuGY>AsMyzlPD<MHJiSlor(
z<|VFqTI<LC^R%OxVrz=g&ysk{4JNmFt86E8haCSmKa#0t*Iu8!*%F+`?D);Ehvcq%
zSvbjS-l-1t^i?ky&X!pH-Z1s1*uuM&Df-^7GRbM$n@=dcZL;lW*!6qHR<o-N`Z2DY
z>vL7S@BBOYplw<8<D{E&%s;m1ztjE9Xt}EV&#BWXM^7$HT5j=krDeIWN8mI==bqK8
zGT$>iUBCX`JV}KYcT9ICa)`v|K5mO#mS++F>_x+zjc@Gc#?RgSWp2~g>$`4!j%j-N
zcSCJ(m3q%+`~OyJvf2`F&T=S_;eOe$oc~+-Mr-*Qau4!met68M(VR4U?T>{sw4Y7>
zIcIXkRISTaZ3pARM1IBn^qZ>Y$?@mguah_9l?7&Z36~^`nC-Njopogwhp-&mia+L-
zvWK<=2XSg$6lnBVskyE@bt~h|tjn5L%+Gu}_33Ag$oJ2TUZtB<{MP+{{N|fb-TO~J
zmtWAXj4zt1Tz-Ysa);VhtzD7%*E>4}a)0dVeYS#mjopg$h{sLY&qHQ-$#OOwNjE>4
zb?hgH)|&f)SGJ2RJMwP&M*%JOb1AoZpM^_TwhE@&2zM_y5%j#y^ShsXg8II-lRuYi
zz0J60x$tQh+k$wT*?TPhemgta{QnGv%#{AcGxo80`mbbfJ^NtE9-Wz4yx}aJ3@R-x
zA&RoGQf+J6+{9H?{%ZN8xvpZ_6)yC`PkRkh*}|Ky2fu#5JpFv8ja<*+C+mN1U9vnP
zvo68@Y399{i^q2BbQp@MF5~=Y=GXJ(7~hJb8H>)>o)KiQsfyow*fqF7pnbz9@zvKl
z>u+~XITR<b+dsPPeml47sX1ceRw`vu?du{wavtD+rf~O4NKD}rEuG7Tky>tiAwv5^
z{zqI@e>uN7rY+uY+Ko-#$KEDw+WovTuAFf@`=2-R_p&<sYdRutHttprk!Ub|X7GG%
zTQ>9N$c6UuYl3VI*?tF!+C47v*ywX$+dcaudNTUzN4e~$AGGkilpnX(y818QX%iks
z&CI{PrmmY#KU{m5mC<<SpLPdjFH^P|!9JdhvNBChnhVbE@Qc5+!6Pv2a6QwK-q}p&
zcia;?HCsMCtn;|rRXZJvSgx?pmRuk8mkIKV=Ny{g`$~v&`_!td(Ps`8rm;q?aqQJU
z$#C?W%DIoc{@FTwizZyXpy9W~u(t0f8{f3}-t`B~0@vJZ5S5*!S5wsX(lLX*`SAC(
zSDv`#d8;hB^WgmR;?;j9+;MJvpqKtD<=mQA*IA3F^(RT(e{<l$->!rhA2AJQ)k~6l
ziaPnUyh@xVo-)67`{VR2r?U9|<oRxTH_`QAM(q#1fH{IE<b`_{Cn}U#GKF|MoVS@`
z<8*08notCD*}B3{pL^oGA557kXZQQv)zx1frC++ZL@OhCx<o|tJZ~AlG=ENREvYn7
ztF`8DIM(DYTyk{l5~;-(&hC17$nu-3=jIcN*Rua!k=$o>#QJEdp*APGyRgT{hwAl3
zH$NxZHaO%(&Nu)1D01nh2R#+7hc6vm#a_DD?RLP_>ag0CLRZ+1I<DigTQpJmj+E5y
zKc(igi*IYpJ?B}#D)}~avh3}n&)<n$^i4W$opjj3Pt8AW&xDxA`RWnNO0Un}WU?}W
zJ^t03ibhqZ$4j`T<{r|0vHP&bwb+;6lU}GfTYE0KR#W3#*?lp;N_b|tM2Xro{jIhd
zm&|2%H@98g?p;u;8Ea;`kM)FU;G<5-+UgYZ7Pr{eC+?pP{Z!VzXnS&|@Kx5fJ7syw
zw!i$gPq@O%*yUXNp!P+{84jB(b5j{=e7EwqhyAwOzVnmQdlU7S=Ii5aENg#$I>~>2
z|H)^}%!gVN{h#b_WLnYAd@8xsG$kY};i<aY6r)3H>^N8&LQU7l^KkS>h%epy#yfm#
z51Sin>Smb=W!`HQR^Rj%8+3kcxOR(8>cW!QmL~Btx|u_(uPE$}Z&PeaKEES&bJy}W
z|Jeh)nOQ^_7#KJhcvgOm@IK1h^>aM~!~O?M3`z_P47sVr`FTmDnK>!?(38sb^D^_Y
z5}_Qug32p<UsgSKo22n;|2!t$pVAY=Tz8%-+rC!vrta!f+jeD3dtN;q`f`J#(3A&C
zj8Y8VN!ca$p6@$WyGh#n-Ao3@snzFX>dHD<jFh*ZIMHz;qHOW!?dSh*`)@RRN#)dc
z^ZhRGIhPh0CFgehbV||WclOeCA5+Y&G^f2b+P!b(;`Df%+HL&*|0wR-;kh_GGxW(t
zlfN_0bw6d&axa~wvxe*c{r}vh^J+Ou=hceNeO7AKKK<z?jmcKppVa-+Qa5(EExx%b
zZtBYnkyP%AaCgsn;-;c2U1oY3&R;HErNq5gb9v@WzxnBtXPx$$Y&G-D<W*jwl3zQ#
zm;B69jNjYvzByxR`u=r6b=J{OC-2gDw(8rSm|ist!9R5~ub6+%(Ye2`Rd0W*do#!X
zr%I(&;rFMV4B9&X(Goks{hO?GS2F&5AU?z4=iUJS={KJowwb!$>+9O6-s!1^p4y?C
z;`BHFvGQ8=!s*QAfNeH@YVwzAwAk!I&Wj%{G4<bjJoBHScDGD;p@42dV&am#g&(zM
z``b2resrtWOjGQ1&b(=>W-i$?FFjQE{``*b$DeN1TJ&m1Yf59~w0eU$`RV$b`Coch
zS#+E`cmE$p>-p=IbMKs#Dw5gc_1=?3UdOy6F70vmSD}4-npn?$`toF1L#;u=l7ES%
ze;?&d(i6OYMEUV{hdrM~mc7c2;$mQC`nOGIop;1Sd7&3q)~{aV=Wg&#{qHip*yUe6
z`f5zHPX&gq@p^OIH>g+Op<C##7PXZx?U!dWy02R|Yjx$UC*rBA#HU^J+V@ZMZ19bu
zmtRzM4l$TLI-WAmH}PBejt3i#Z;C82-1Fo2ZSlpE=f}_a^YhDB|8^4@x2!{(1Q(cH
z;4Eg}=hEW$%)jK~!vd9pAQ8)0ov>1)dCPAY`S`^i@H0Cd{kNtteELb2Uq93SaKHKH
zr5l_YcCw*w%4wt4`cUIv6C;Bb^mJRDzh1fNgql$KxrtXg;?r_lCm!yc_rhyo>IM}Z
zMIOcJN9&)=U&R;N6yL3K{AGRcyz8kYEXDnoiz^LlrXT(jcWnLUKhs^ryV(Onr-z4!
z{C;!y=g}8OKVR;?Y`*^d!gUcXrzKu|x*j0(zwU7TeB0jj^K2?VJ)XU}d-LP#i!WbS
z*S~LDZ&+1b!}#^o-2Y$q{i^x?TW9{6@XI3m;*Y&AUsv@$|NA}uhx6_J-U-|qzqj(=
zyQQ%||IS!>^7qHzS^V1H9wxs3efa)cUi<g;|7NbM{`Zc3#k(u4Max##|J&Ejz_(vr
zgN1#6roj7iZ?}bqTK$+e`*e2=i$!2s!`#XHDk>^Y+?O~tIn%0Jt@~xiwiNztPZa$!
z?Qi|(`){=Ay<6xkIXCmty=(aR`Ia4BBE>XoifibZteD5mCimk**|$g9>E^9&&Wx&E
z(f!nM(;2>1vrFub>;KG&ue(400~gb`rKOCyb$jmWUUm(tTQRSLtx!I^!0xU~rm5#N
z%{eu%HTE*69I!Rf4ckyWqbFohTc|^5yD<NT`bmB-Egnb(1}$ScGDXXozu?y;#WOYQ
zd#c~xufKPn(PyT5_eYaXvG%|}|7vAw<-R`4ycf;0{&dpTH@0uTKfJg(L%-@)dwtRx
z#tFaN>KPctBj=r2`|nJn)%~<ksi&D%PwO0>OId%4yx#X^?z83BOe8;~e>`VfQ+=be
za$BR-no~0Ic8qdQpFc7?RXF=#&a%m(J_Rb%v=4n<wJ6hUw&Gcd<zI7WJrm41Yn}CO
z{hmJzi`joHy3pG2R@hQn?CDp=hA7p~4}JH}IK1k-n`*)@50i`TP1^lUiDA7gUSEIp
zbk-Co*fTv2$nak8lJ9;ZRVP?QZo1)=1HAPHo$Cwy!Yp(6;yx7_GVd~Gx--M^{l+&Y
zbAxY6{*Au4fB&QX-}!&M-~U&7LQhHD(#F0QkJl_z4(H9C#?7+VzIfI`-%8t=J*ToX
z&C;&!(anBf(do?0b#e~JyA^Tvr-~vr7Mii$%Q`FSvh|nR<<lNhcI~=(yzE8IsfV>p
zYnE+fxA%Xx{p7A+F*(P$Zi{S4J5VpSJ)*E^@&!p&cJ_jO4lf&D`CMMnRGzh-Px7&r
zM6IdL<)=0?m)IV8$(UsJ=WVpc%JiM#Uyp8Kh;O(Ybf3YzF!;=J+gTzC#WtFSGV?iW
z*!Hk~+xv&3{l;;TU2*B$7Oxg3xdo?PP<Zj!K3L{Qh3-pFBfSOZ-ujyDWOTT2MJUmA
zM}tA+QLescg;I)Eyvh%zT>HVDH6_)I^_W;%YyZJatGL*BVb`d`SyxRCvw2I_`kdm~
z+3@0O_h<9<?g!TP>ebm*7ykP^d;0ly1F?C1-+T{pe_YoTYZ~t!Z};1P!GvMmj))}=
zf4Gt)7O{59UP!!S=6v8{W1x7szOI!)xWS#uZ6~tkEYG*&3DvBt5UKtA<#u|{^DJY7
z3FekEJAb~)Q#ir?n1_R1rF=)QAFpAagu$_!rjN|e1;x6sKh|kyPEq(Z-R(g869vt{
za0!*QGG9y#8#sErS;W7;-{HF`{CK^z?EJqbR{Jfge?Ho3zG`{A-QP$2=UM#zPl#Ia
z`H0SmdVan|>1vCZetqrA(g-W#@VM2@tlhOl=JogA9+|rpU)cGIU-<p{S6jCI#t-tp
zL~aOk%%AR<6v28U=D;WB_T51iJ<IhT{MA}Mmu*MSBkk!A;vN{bCNRulyQ1wStn-#x
zhes)eFJ*a`i85Dv0Ne9?-VRP{ho)Cc55HFAy_CaUc6yT8j9Vg-N}NW&4@_Iuv(RS6
z?Hs%IbLzniZ7e(<ezuZ_I3q+AeB8Q4J3<sRAFoqcrY!WhI!JB1GE1At3%k01kKXn#
zKd^gm_22pL@5Ssn@U=1hx%!WC&QBWuSkuyi(p1tOoR_+wwRYk1FL`qxZ*N!kkDI^m
z-{p@T3wr7*%6|oYELr)avHIz`r|B0T{{EA-JYV$x>5q}liF)2C{cXDEn5Ha!X(4fd
zrMKfzzkny-V#6<z5B|(JaBa(Zt_2EZkz1K(9Ak1X5n*K)yz!bh^oYX|wO@vfrU$k<
zCvogx4>8nNDm@i);NOBH^QL6qbc`|JtcqCbX}NRZMyV9P9P=8j?4$2L&*0OYBN{58
z@o`a7ntIww#vO_gr8$eEbUoQlUXFg2vB1noQFO6=&M7I+&$&Uec9li_1&NLKn-n-B
z_|nB*ihp2fH7iJo>~&|6kx{spET|B(HHeAvXMaEm^C{OSF}x~{d>6zPRNr~IubxS(
z@5AQr*Z+S!THa7)qOWl1PoQ?ui~BE{K76j+#iD6(R{iy7&q>Wa)w9lbIotV^m6d%6
z->G0Lbou$pH>L}UkD7kqh*6Y2AffN~?y#!NCvJ-{qXkhfIn2H*`p&8lI2h-dWno--
zUHs{+FnL9912z${m-9tcF3Y(czsO{vc7$&M`=37kn0p%*wa4sI%382&@(aeCZ=4rc
zRIGI7F}reYVP7L6R~Wi>_R5gcE=OIwKdbDIQ@yUK%x=eOwR~2~e2ZW=ZG(+Ap4Z+S
z5KEbNT<*<Lfv?5Ww{!=#nVt%1k9xN^Lif4m^q@~~Qaq2idtCW=RrJ)RdJ!(`V@>~`
z<X&@*op;0TG1G@H8o!$A4wzY}@8VFOUvpsh6Azgj1?xxu{(b6fc;Rucy=m`ES7iai
z%~d8$^Xl!IH*%a(G5fXf4c7so`)xOb7x}H{o-B~~SFy0|+v0dphL3MMFPd#powe=d
z+>Nagdf~s4UA1~$qwb3Yv$9QGXdb?~?=&NGK&<+SM{|vN!{f5^I^)<D{My28^ytKT
zrrBXvJyoTx1?@R%L)`OE^Q1D)%D6FShvkOr;to81_gR*SM9)oLZNkp<Y(vyJ;|Kl?
zc~VnE?U|lTnB7^vc*p%ub@#qaT40}9ozC}{$1FnG?cqCN57mf8&f&o>lk%V1Z?lpx
ztSOzvJ>!6d;`&7SdCW>J7Teb(wB)u&G_uD{T<*BTd#BVvDFx9(X?K|vO1hW0+A*xE
z>OG*Fs&{2;9e=%*<x6fU{pCWpc4+XV%t_#nnEvd6X0YP1g%`r6%O|NgY*{^7#%24-
z1G;Y)Oxb9x=D)^#_l1Kg=Z>qd)0T0qs0q918@24niMxxYsr3hH{q#7VRmDET`eeh*
z5{1re!6c`JJLAI(e))*5XS|fLbD!&mcODKE_DVBvzyGo>L1v=s`qQHGEY27wx65qX
zlzBu?v*G3>lK`Oy`>rol^vR73x6t4F!??Wr5&MnDs>R*hHrb8375{Jk{{6oCeZKws
z{q;ZO&b4{oU){32CbIZ$&rbz69~<{YN2_-BIrCmrYdp4LUXXbu>%#j14Gl{As+BqW
zU)yY6myqPEv;RqF=%o0tO-n8?2s~}E>|%cXt@PzCv&vWf7t<Qwe(QDPWDS(lN?Xe$
z(WT*g`7yU%Apet8ft&_2L2;wdOH=M&T-W@Bd4K-<Q_H&C46VF96s(nQ<?Iho+4b;%
z%iihkQ-9RVQTWvHYsq?HsUKY{b_X1LvSaq**G#Erm_m(x)ZhAj$lTz{FZ9l_$@ajh
zD|;?#eViV*nAxRfX;8>o>2#hgseg*Pb+xPb>pP_MI#0QO{F)-<eqnY+VC|eEajHq3
z{ZBfR_b&@(i@Oy6d#c6rf{RDY=RBM#=i72;O+c1q=;fPBBA#wdlJ{M(R{ySYPjvbG
ztUFErZX9O$^k?RTOR`G2Q*SpHMRnyr{<`Dtrt<O^N|qloja_C<PO&@wbEinp0*mEa
z^)5X(S$MmAmcQ*LjgyHP^>=wqC(k}Nd-Z2I-liX=*O)c_<|VvX!`Wmg$}P6%Ky`*t
z+uhx-zyI!k?)miB<#$$>eqYsIpuQ(F)Mg83qRbp#v)Nx>{n1xH7gC{HwVj)H@An;l
ze{9x~=RC@EpZ%oh%gbra_eGOSryVa@c3~-x;QUEb-luVgAA7ZHx&MaC*OoS(<+^0b
z-8I2h@%)@c7M5u*Kb=bcw5Ip{{OZ>_bNv@v@P%IvS-4S6%Psk?^Bjg1YN3XU7Uw=X
zsdKF9;$Evhxp#~QnpMj?{1g-B6lYz2KT&z^ir4EFzxb#4>v8%ADR-8J_BE!BN*_N=
zS2|ri{mKp{&6<uokxb(AQg_6gnQC=@2uv}#vGbOP*4ho{Wvi?>7W7}N=4QWpuU&HC
zHqV+rS6r)SIaJ6R@^v$;ewpO0a_)9@sCtL?vyGQ{S43>9-n@+8D&X=Hp?9(87Va$8
z@vMs7oLZ}OMdzjY+9-y{f091ywLaoCR+z%@qbbCoWWV90a)n1WCyUl7hI%nI{E&RZ
zTz9E*S4O}>Nv?UTwSV6eus_lAaq8ZE%`1AgFZrr_;Y8=UIW1RXC!W6^xG84ZQQ5D1
z9~m37?Mw@r5H#^idx6A^4a<(U<SlQQ>i_ESx#>?ig64bFSU87wPCTPl+RwKB`Q1B8
z%WkA6H?uWge{fnWO)fI*%lXL8ud#|riP9Q&JGpuu8?_Zr^y=EmFU}P5AV^4k-8_ln
z+4poOmSr6DJ}tUx$}<1?E|b16>gK=i6PR9oYM$dhb<Nos*;aE>e@@}EF!}i7&A-2I
z?;Wmh<fz|${r|sD^|fVRE7zFB*1nI4+fc`_<im?{_ly66>*H6?dn51o(qw+p&Dzb6
z<^}wkHUH#Ut^Wdvy=I#8y<+Y5E_(dMu3*}%1v@@$KKyric%8cR(#+l8E<5jEr?XJ7
zNiXK*M}=K2y}iri96}T1{cROxdh0J8-4ti;e@AZpLMNW4JMZl|g}72>oJG#0&R6yE
zzWb9o@4fhj;HkUJ7kp!>D`&Z}H|DC#nRCG_XNYO|ONm|Udlc@ebM$e}!Bs{qfwB+T
zOanSUT-RBsb!bhLX&}$uE#LMp{Il7*>6s=Y=h?=(%zt^w`OZ_%&R?}5AV>1=rQoL8
zqLiSIelPSsWFLO9=4Fn=oItn9Yx0~oua?^1<i(U5dApd+<@m*8K_xmF-YQ@3I2cuA
z|0$AM*si?m!;z*-daM`CX8O5b*mof6$Fk5f_hw29u)p=3zsOfV?s!X@w7X@D?(!4z
z2fqJXrn&6X1zWwG(ui}j-j)6jj1Ahn-*<n>(t_s?G9o(q6x}%9xo<Q*xKlP_+2eyV
z@AdZGRANtQ?cb65V$zr8lPA}TO<B5^$4rZ-AYi&?o#)cUTmB?<Ob(4q63u*W-D0+i
zDL?lj+s>$PQ_0o|QvE%QT65mK<nrY45ucrF;$y>mLvH$J7NONI-*3=!vy8m-<=0z*
zzh~EMW3S!G^=7W(txpF7ZzUf(loNJ8D8?|-vg?sp?NoklU3cH#!rVr(+-qdz4>I+%
z#2ouR_t~jqr)Mk0AI~vxE;8IS;j7&(SCK<+j=fmr%+;UrcR^c+-jO#G7YVkqD2jH^
zeHG>6ZydL5k|y&Oz3`QVsjn`b)_$M#F;HOb<P#BIpKr}zdvQwb*~tqUtrhaGx4en-
zUF>WBt8dHlTW7qLIbTNIm?XA@#e#+5uC}=Ep4R`dhYy`@QoO>=F-c5Iqx8eQiHB3$
zBJCD$3f=6xUqWJXsgvaj38SqawIyAY|G(YvIe25x*OQM<ZF?Kradr2ml}kA9A7oqq
z@_*C+?{A*3YHQRE+AZy(yt(jk>*kVK(VGp+{j~(nUV2ers?vS?o{pVi&b3S{k7dUu
zzqvR2Is1~?pOyB@IfUN`Jh16U@9n-X%j{M;U12tHN$#IlJ!f5eb@n$ozQxs%?-h5k
zv($8)<#ft)*=XXxzDWO#U4U?PRpy}^h3QG`r?<LBE)Qnj(krqm^5{mETV|3My!Xi!
zu%w4RTD9_W|EsO<rd-Ts{ZhLwy}*2z!&%>BYKNDsXLQrBa^1wK-So&pZgTe%=Tlbm
zZZG=7@N|NrS%c1V&)%#vUIiu{nune{dN!71TKAkgnKRGtaVA?&Ko?uaRs*i|42HN6
zIfuurkv1wB1qx?hM25sN`t@vn9lCMV2csGRU9O5#aUq^@=dUl5{k~<v=Ew*K4`z;%
zXDlbT8@*9qlr_`u!ctL&PrS=BC#*bkT~bR@Ib8VclbtJi>tnM2HQ#Vr%KPl~oeMjS
z&aBB~?MQU-E_~X_;Lh-6naX#`ADfnG8m;Z+m6bj`B_{W1_!*lP<}cNgv%@wPYQ3-7
zBlBtFl?B`HF<zVfdZE0GhI<=h73)K}O>Zn0ILyzlW%3GHdT{AakzLW@s<%@@T1#{4
zwoF_#tL8xR`ZFIszh3ikmQKyJVAkJVt9CMpUfVAGEi`bI=v@`DNK;)o*`v&}`JW%|
z=r!$|kzLLk?j&K*y|{YW`3Bx?n~eAJp18hgbqNo9m1bB|MdoJj5Z76%j7<M~jvfAL
zwX1Re7yk+6Q)(w{YCS5-vTpvYulczX>gFnL*k^BBeT;7+gH+ed7D;<W6Tbb$>v+`6
zUp{HR624=P-nkmNlvR87F6f@AwcTLxD=nwAkE^flIXA8N)0Ua*)Sd*g=599By=~)e
z{r%_Ra|S_bPg;s!Cxvz~UA-_*XuI(e^%K7t4`19I+PdxDp;!Ky+)Kn&=P;j)k@UNK
zwDoDhNB%YSO?(&rFObUE!z<9R;8iBuMyb6YxAv~h+<E5OnSG*f_L|O<ZQ5O|@#V#j
z!_ykdHa!1i`!??DuZ4+MuDo`(ys%%1^|)YSxN@a=V@B}upABnwwjMPPT{GpVg|YCO
zn<tj&uiR$3*wZ*&g?ZPUHSSfbGOxG>_TNYkxA$2tIeTVQ-^rx7>A%{%)+h$|oqTg^
zlk>9ng0!TX=8H-*r?5(|I@RcXY#EbDbE%tO=X$A2M<og;idn5*A}=9*Wn#!VGxnx~
zH$@FaPHc(W)|qZ_;@jksBNtpw{|GBjH;FyG(NFHD@3pn_8@$^W3RT2rE$-i`CDeN+
zoo}1uX;p9O{yB$|BvTzfUe;tez3f7D+1ou^rumC)ma`HSuw8KHX^Dn<&(8ZR7lj=0
zjh^jNH?@6tud!IoLc`@r2V1xBx|DMq-_rYxSC+?m-LB_F>Kxh6y|~;CUY~c1^`Ff~
zeQ%3J&i-y?5?$<<u2>e7IyFse?X6kp^<6KVxj9j1ZIIiB7VXcwQntDzPg$7Nx*#$^
zrgZlN_T+sWW%n*tYV|AY9G%NORa8$-Idj*Cg#CFtlooM*U&mk|;Lw<3&sWx>V#*Ns
z<9yGv&;8wjVUyfAyIv;9*(S=J*GnsVD#UTKV?}l9`)Jqo>zRDD9A~(&tV}7;*9xc%
z=)G}&-K4NzZ9S9f=QK1F1=o0dbdt-IlPYqWZa+)?pWdJO^(xQm*@O++=f5y%a8h_w
zy-{U*>I{E7r=$ayA_I9QKQzi~XN)~!AlW1I;)B0TQ{Zzp)1s7%^FmW<PQIJ8S!3Rs
zWt^IMjPeFbjwQDG$6lP|4oaCd>F9dK^!P}wm}ZBKQo&zXXIUOn`d76f=InF!`*mNx
zPLIBRW>wbIuz>IU_upMAe`vDl|J&>Fbzje3kFWXK+TL{ZEywa|mF2e&P4~7jT31z}
z$7y+QaY&o>7T@I)o+Lh*&f4tsDE;UX&QF(%?27p<cy{;*zAp`#<jwpibcU?i6fc%r
z(aRbmg1*TaU+DW)|KGr&J|&|1$OYy`3*n*&2CrHEoT6u<YT6CswI^#X?q_t{m#ezw
z;Y#1dk{P$&C|_depCLT;d*bS&NxEBGFZsK@SboHR-O{h~tn3^Qi<;N@@SoV<#USw}
zjJ;ys#P94oxsAfl@a=!IL+{O`K*<F$+@cy!<vV1&gT%BS6bc<|n#`<rNb+!oeaJ=o
z8*&Nz`_v?)UdTtyRE*TjV&5$|U9&2E`Q?bOE20u@8nn7D-W5)*-4#9Sd~&VW@#Gt?
z%q7mKEPJh+w(~@ReB->epSTZxS*;bFb7uMe|F2d*C}DaPy*h2BEXR?3Dt?P6X7e4>
z`jq^L`$0)X<B`?o-L4iYGX%dh=`=|k=Ck=8c6-0Je3G-cqj)j*w1s!)-4NwntKK!?
zg#E4)SBm}Z*rVA$c_k~{F7?yglen~V>1&7o_m+EiGi}POefW;uIlwh~qNnYzh=-PX
zhw3|e!<Kh1U6uHD^8PuW&$92T4bd>*sE_*;(DCf3%FN}j3S|w~UeNeD=hhPe&L^I-
zog0+*+|`LsnV@vfrhakF+EXw8Et#?GqHkiw3W-yjHz^m&Dm5r}1~JCoKYwU>_A2Wv
zo=NSGt$OArU0Lx$Axh;clYiwxk0ZX_Qd(VW4sX=Ia6P)RPnO|*m3FOX%*%L9)2Z9_
zd)~!aUT3mO%>LM1Z?)iL?zHta%Z)e%%lKl~#-$rxY~ZsBkXv3dGj83f)WD@)9g_p&
z*e>3l?{`&VGN;>0?Xc_SCXD;IE<5BsDX3Drbnu7Jl3+_6%Q*?|hHn=A&96BfY^u>?
zs#v;eao3e*g}DzbPDUS<=eu}U%=W%sr=*2jNXLtW@)b9aF63#*?$S&Mp2wHF>gx@|
z#Dj*blKLhz_)D<1SFkReD1I?9WNq4p^al!GH#~Xusau<S-hu*GQ<sfxriu5|4xSX2
z`}9KQ-s}8*9MfvA?p1H{ZZ>19k(M%;7h>GLTxgd`-~JoSMj!6EJ8TU9w|Ld^NW(op
z&pqGV@JQh5-}2X@4x86LF)(5f_O-HoW+r>tkmJKIU!OIBv)8?saWe1e`&>HZ%8q*t
zzqXpBEu0~=g30jJ{@CjdQ(SE%GZcN79Z@|qDQBP7WyMVj%3lskKRn9G?y3}G5WBUk
zHEBi?bK-;(Q+~N_*0|%l`syAtZ%OsvLUWBuDo#C&jxx_SURtjCbN=_mdwEY3ND8Z3
zi%#)z*(RkSvh!Ap@8sJrFD`$qlEAv=<wVO>m$&O*Sd+#T)c-r?ac;l%siqY(<NZ#o
zDw{glG~oOp*@!u}Ro4GZ;&b*ovYtE4@6>MdG(XE9?3zD{gsY{x{Q2+ikFr01>buq+
zd1cEp%4c+~#H9=@+{EUs?`ap6*ZB33N&n0`&$%9f4p*duO=1^*>M?UL)c=&l5yaD%
zzBR<r+^grmvxrLDzoX8@Qa|#vRPXY)-C4~t(d&oGf?}ppvsZl+*U9p7Y&e_uFreRJ
zinz#5&yN+JMcPNiH!OFOIrxF+zg+6!D{tDe*c#+7u*h|A+6V||l+K#7D=}Jap`W{m
zWbZc>AFj(4ocB#8x^FzdG3U6twV%l`)rF$%vc3-)uKszbyUNosK<!fP@d>ggM7yst
zIVGLHb3nFKBD93l$)~G1x$T|g`#<aNefa!6bbtBGH~&9Z{QtkxYERAoe-B>me-QuU
zvV5H$L+!TYggpl}xx@t9ZhlvNv{RtfyV5nH@A3Di-``IR|CqfZZc(QB_pplI+vd8T
zn!~sLu+rgqz4*9o{_&byJu?~kt{>~yQ1Dx5Xvn+d-lfEkA7qx<X?T}Z7<~Kd`Q-WJ
z2<ekwv`tO*|5zULYyRwY<il#0Bdb2ghfBVhIyoum%hQ9;WHO)4(_~q>*-SRr(fQSa
z$B$1$R_k3oe%s+atB`;2yJP{!-_~`hCoB}BHB6>W)G|2C*tUePxFV_bhmCC4M|rpJ
zcb2mMV&a!S<Gm|eFd_Ve_2iUJ#<h17q~*08o|KrZe6Lfh^IG7kY10mag8Nb164(^l
zPySiWqqfnnHDW@6iOmycO$(M!GlREGRH$^B(Y(gww{3w!SVm6cC!w9CJ_5-n%QWV9
zX$1b@ZvJrfOU+c{j2@@7wNv7RjCU33FO$2x=!D(f6E8TN#QXNjEWcRV_E7BNamLoK
z-#5-{`M$C7-Oi5p$#VagwnwPzzEO1hVLzu?;^Gc-{dN6jtKM$;(0<0{;NS3xGpjEs
zYVfRCxK~Z3WpU{l!K0k~#iwO9_WTg4ethkzm5NnkOGic2^~kRHO>=k?7F4h1JUKh#
zmg)0`>LV-Mmv3f}*s^}*Djw0TTRuO0<EhRm>#^zjj&lbBCeBIv&@I*WOlZkOfw{q=
zZYzIJ(B*94n8QBlZq2#BAD^n*`hI#Hz?T>zZaZhUV#$%Y3#J%o{^CA$f60Z9%ekHF
zBl#m)*T*iNa-{1KPi6DBE6OpltM}Yyyfo*~|GjO;KgJvJL`u%Reqg?6Scs328xv=%
z!JZh-r95jy_iD8URju0EE|cRM@cQtMg-0W6^1uFYJXL-1pJ$1F`uBs|Vjkr(pZyh=
z=a}_MAo#}iH64F`l>9jRK~kv1WP(QWWW#IUoff4te_rSD=IFkX${<nR&24^*mT#QN
zw(zvZUDeMrTV?Yv_`R>sz8k3QenDe`*V;{{lh>86$=!IoZE}gK@#4R}->+Qci!S=~
zRkF{2&x^0}WoDK0-*Lrwg_SCv*LZn<fz$WI)o%_P+~Ik@bHUYM0q5h{Ny`>qTUND)
z!6;>7Ocu}Swi`;Xq8S|KNa$)x9uDMIWK)V^bf0}`&jh}8;@!c?TRh$wusvx%75+Kn
z!MwTY88ef*CUxq(WMB2I#YbA>+?~BlUq3wI)MA@=!$Nu8M&?<8-s-nH3`64A$=nSN
zvrS)SQq~g`_LR+MOOC~oqoo|v)|$$7a&Md`xp}Sl<U<iGTqf%bbZR;3%9Ky;KXZMO
zbWlh~lUKrtjCHmNb@q<oQYuBZQ~Z<`%xX&FD(P=D+3OU?y7kp(%Lyu5qNn+pZ@7K(
zIon)C?S0)7&VF=^{o1Z4=Am~syz*1`$}?vi+z)Y7>F6`Bc^&)n;^&1X$E(hFb-wy4
zZF1CYJCDDdrQ@-^cK27ATzPltr?=ojq3WpzGnes*i<A}2Fxp=i>SwUK`OUP=PfTiL
zc1~nkyuDD2O+?{=hM1(*i?YB+A<c!eUM=5odiCMs4_2IeAhKri(M{Wx*DVs6ZFjel
z<z0Nji(sd}JLFfa+s*oP6<gkcS0dAXZ_%6kX=}{%xK8Oke19i7L{~3+;ODt=yWopr
z6YuP%ABwSyqnAHha@-)!LV42bE6eZN>fEg|RpxI!QPT3=?ZQ`^#%D3p<m|6sI4rbv
z7W2o@IhoBFeD*(CYlF`xev!EEu*d1NaNq^OunT_iz4b0Xn`-RbzumYl8u3o?{fS$@
z<4V6NzPcNIx3)pHLcjWtL&@iRZ*Dj55Sp#@lTWWRLhLHbraD{Bi40QA`3s`wPWbDx
zMgG_~gR)hbPbP0pz1U;e&e*=;*1I6(y2s0P*WK%1USIw7QGi6ion_0InH5xCy09Bf
zv3&XdxW&etn$NY&K6@q~;8DA%FQKx>>zdM;oqHaYJ9EB2Amx=<a9sTS6`nh4seOv&
zkFRH3b=cgY-N#+0ASSg`)KYXw-JBJfO0A8jCzMA0E#9>_YkA>ntJ&oX_q^W_<Nk|n
zjtZaokz&DW4Fm68Z%n5yS}1vRP0@jEDr;oBpN1<OI3l{;;Oe3kc|yg)3a1XFysnn!
znVZicc5;p1&ugMbHgn{w7>XaV@IAX)LFDpvA!8Fg5v%E~x~!5#li%_B+U)Z6*);LN
zr85CswJVQVSYCap++#Oqsd35wl$Ami_NNYq@jAPyxEV<PJJ*)zU;qE?b+!Y-W^Pd%
z<#-<FKkYbiW*K+)?!$QxmQFmiJ>K5fHDjr<KuD{_iX}eP`zCNtdR*@A-|oL(qOS3g
zl7Oe?wV=HDtFG%k)#4O?z;VFf_6AFiDW9UZt>Kj2=@cLDJ3;qDYVm{y{l~SN{%ICI
zzVh*^Le17?RhR2)gj1H9_)dOlwzeYYb&*xsTSwlTD}xqo-e9)vOlR|@hMt$Z8<&3*
zJ=pkcis_EEi8pWF{OKupnq&1_bp`Xa|7UKR$zX7F#r(zMO!oq2{^vK8*loyhI5k#!
zC7YW_Ku*re@Xoz_M-OUWJs19sBgrC`vG&`7JM8_7=VrxDw6#8=YTYjV#fi7fdb&x^
zkFNFYl5yh2toc(myyX`V`PcgI!guB$foe~GDcBfaN^Hq_px(#($7SP=V_sS-H49k(
zJ+NPNA}PbS;7e${Rggk0^CvS$>lQ^LTah|$$<}83x%(??7p>Qye>mr1sWt1<PamV-
zm>rkz{Hfsm`#@TF`^A}+%CoiQ+GWEmB+RbQJF&$%Bj$wop)wP`P1nR^?B>O~9G$#J
zZ2IvlhM_gquWz~EsE@q1T=$YKe;)s{v~A9D7x=%=C`xWmc6u~nfo<Q}r9w_jegPYp
zZ49Pby58p(P331eAhbq;Q~PIs{LfIin{%H&d1n4zX#I>G0g7)rzrTO9`nc@M`(EcS
zdz&wjGFRRz+siIEwdvaTJ9TeA&e2?PtoNu|(Mr*C?@IadD&I{hjFOV8x83}{#^_Yp
z+soS;C!9W%lrr<2W4PxcUX?1DB`3C2G~IksC&kG0<Cg1P_8X?To{slL47@WXJ$+PX
zI&#aGm{<tei8m$uog!qsW@qUF(UT%C&1ZVd{26?sW!BoY7vDPE@OZPxLp67U;~9rn
zhy9w4E!CgBqJu}>h;epSvC6F}&(^Ht<1-Mw@nXq3@1>i%I}_*rGO$^kGVyi$)*|1n
zA)^0uV^ejkesACZ_pQON*Jq>dFdSY{xFtlWt(@t($HoNT8FQQ$?Y<wqMJVc-&)!wu
z-+Vgm=<2m@{yL56ghJ9E=~=nnxyydO5ea*!w<MKQYJQUW!=9shU2Q*{!gicsJJ6z6
zyxHqaE`NgQ3)P;J)9Ma2t(>yUCpoQP`RS|S!VMeNR&SH=<0!i`L3^FABkTKnD;Vk=
zHN`LLAAYHSNMx~NHggJ(;VaRJ3#yhRY0mt6ZSPy}7CEVeoJT@4+7lv0ZmX@{l(d(h
zb<T%xYg=<Osu+V83MDhY^=`=O{CA<XJ0N0(-=)L1XD8{29?09V#v#VIvCZhBeqm}+
z(E0oaHZ!~06=h7y@65Y2wS7gisOVbX$@)#TtffDn#RQ*vnyJ4-Fm*9oRqg`C1}V0J
zvzrYWjp8FiE;yHXGWjG`NbFdg;5;q7XXE-CVtuwx1)SIG2zt~$Uo%Z6u*E0DFo0b)
zZ;oW4uBF}OJH0vFM#|m}{*m?_+t)A!+L_i)&7LTG)bxb>%TpaT1-+6{i~4=yPCJR-
z6S!T*^GqV)^5pD<#}`TkoVUC+{K4$l$Xa^4jX^k2L`85_{-O>8dku3}HoJVKi~yMz
zGuPidaxsppBAoG)^7KXOrz$pn7jzJKT377ydrRxeIi{Hrop(>Xn0;zb+c#sS&=pBp
zoYytht@k<j>dCvCy_b5Hs3rc^-XS|Bh+S}Tm%=)w{Q-8T*M+BACB@D!{<~58;D<B^
z4ZVjYee=7PtG3vu2tQJr^#1Il<Of%u%(z<O`u*zrQ|#x$Ez`U=e>K{wekhPDIYQ)$
z`MJPX6JpjB&hO~gO$l0Iu~_=7?!+7u&rcV%&cE8)n#*iB?bwEyf2=HglQ#Apnf~xh
z?;)uq&ldMh4c=`Nr#*LC!DqEg|Jdi!^RHJM*4>^w!`6-`TWZtB*2iv#cGOh0I(D{y
zeq^RQx3*yyvzM|??A3U={r_Iplob8>mGtG^*Oy1{@BKU@tK)^S-tEhGAA6KoF+3KM
z-XRs#BLDJ?(4xx5nF9P5f1EFt+-i8_lMeqSm6H#W_Ve+oOH1A^76@!|+hV&`B`vi1
z#NxNnFXwY)y1RL~9xj^lC_7?zkI*s3v%7<yElb>f_3_IsMxK1fr3}*#e9C#a#_7~{
zp2Nr7mt~3AFTa#|hpo9wX3gOPcV3)z%&*I?dh}nw<k^>><sTCr!hgt1&iNuC^MCh+
zXeLGLx)bq_KQMW4?rKTXd&#cFbIJNlgOKuWdGj61j#S-Tsg*P7f6e!%P47>MOFMS3
z9{c6%YGae7ku!VUi+FxVpA{GPpSSsTA;V?w(z&%RJN)#Y`pmNGe;u_+@?TLLQ$=vw
zU%^ziApS!s1!5niBpgCcZ+xdPQ9OLsB&O!>b+Yb({L%6slD>bLBQ0YzYeUcTqb!eC
zIq%n4uxo|=gSQES8KG7g;yb11b_g8awN}jY$erK17wbMQ?q2kL!mq?5|K^IE-kQAe
zP3RKWgY{t<pO)V1nGi0a`gqlh&)vV4ZL&(2*)(rfr~b4;&Wyx6m&1M6?Z0?Mjd{(I
z(ofzJzr7Wwe3Is#vVGfBL#F*HzuR8yDNgFX!Nzqnn%m$_P=feJm7=<we2KkIUw!-c
zZf{b#eg1f>`~+(yqi$mk(}LMarMeqg?9IG3saFbjA6Hk7HIBS-C}xI*sOR<@ZHAZf
zT@9oxCsZ;$x_@0_`>YbrJhjJ@gUeS=`{d<y{Mw($K+Bye3E$({!fK3d*7wQYy=v8d
zSo-lL#|39|qn`fumEn5j;!yVf+`<A@*|gYVjUe}?_v?MyjvkosO*xUf%Kp5)$E~-5
zxvM95Z%#eRaPivFW|!al+ts$4oD5z+o7?25s}`T-FGq_DU8Z4QF02yWrpI;YBEy<b
z&ve>5%o!anoi&j6?yY6goGzrf<dw?<r@LKugf1PhKa?kyA+XDS;l~Zj6-+nHew?^+
z>e3^#db;@c9S+#M@BD?*_D|X`qC>S-=tQ^9&7H0ma$suMkEdGsOnQ9xS895#_)+7x
zV%0a9_uDGBd{~>YNX%$)!=4<`=?NG37v9Y^jpqn|=rC!T=_S1m`N+AdpWn>Sv2I^k
z7~|REA8<!@_L2$SE$?_l-mhwrZ8w{6e6{xHS)JArZ}wk0bNW$a)X!ztzEy>pOC<WS
zhz3bqT=aT-&3XUyAp7Pvr)3Q83tL=%sBt}Q5%+M?&3f}9cAH+vu{xQH%&W8<-l%nC
zUz_s(klSN>)q^}HSqJv3qzW^!Ur?UREHg<}WLD6QTe})2UI_c}*i&@R+0467uTIMi
z*?x1)y<L*4t}awfwp`oI=_#ajD5>ZC;wdvXtdf}CdUyYY+Xd4Wru45!vYN*Iep%xN
zMh`LXC+5N>u_7Mv5{cV3d)*AzwD0Z<*LWszZ`#U9a;$SEH&5Pcd$qbuUG?dg{g-u_
zUujRtUL+gioE6jinq{qR=yVR(nX#8yB(}3x#cVU%9s2)|ii7VmkJgo%uer9Dnq0bh
ziD9`DbBWZ&t*`qF6DGR$i@vj2HC@SW?JK)U+(jX7%2zlR3x<~P72cbtQdRd)h^4yc
z$LHxO^S)@BZ)H5M8WpL^WV3+t;+`F{D-zPwSGY3RTzI|c7T3JWX{8CDx2_ex8_Sau
z^yF&R!Fy#9l}_OdbBs9VC4CE?vQ%4erTo-+p3|%k=p2#NV9L?>*Z7aSetGCWMg6>~
zH<+tGU)%P0+ed>X<vo8iEdQxg{&Ol3)j906qonPV>2cw%z{`pM{)N^);p+)G>0lqr
zck7+kgJnMV{<nCnzW)B&>}_Tq2M_Knbk^RpZ$e^-<-Ya1{uVc~{S@iGVezMPmdnSb
z8txuEEl+nJU&!)s^%fNw?+nHj=L(s5ma^XUTd1$2-KT0J(LS@{$P9-}?{~a{-#AMz
z&eODr_n33-&Wf5vT_#c2IV|Vo`RqNuYKQ06TrTzX`#Ss%Pmf$Eqhu+3+WOVZ7vUT1
z-)>{SXCyHF=;6;zE-I;Vs>wb2lb^QrZrruq`KztJs64M#&T3s_wVfV$dOx`j?-5)7
zDmK1yRYQ304x=y09)?2N3pZu#3H-F@fXR}E8{Y4QxFVEycl;_1GkrPh@58K}Tk^Ko
zaEN@A-*?0)uqV*=mtNJWZEX@a%)TwqS(VMjR=NIw?S@9P=l>Imua;NM(&oA4$QiWb
z81sRzowD_58>4jgUEV9s-SC_7eH82S#dm62O2ilb<K0`te0S<c<`>*^0{704nS8-T
zpzYC{4^sYdh11yIewKKj`djJT!MDC@leYQhmh&e+K0fRGo7n2zoc_C(9(?F|b;j|s
zRVTjR2vy#aGA(S=d5iqK*@s{3D0|a;@)q;mb~c&&C9{~8yNkc8`<`*((v1r<%J14v
zf7S1@Dg9ujhcQd@i3zUjHeBaesdzN3xY_IuSJBnGa?JL;-!I*nvP#HgWAK-$Ml7uS
z-j8R+Zu)#y;p1Y?H6}K~%-q&5RUdoxRC$-TJ&3t6*I~8PMfQtl%;M@Ersm6vZ1h`r
zG{I~`s^OEL%MY}>UFV3~p}QjLgt@VQ;KS^LaXXe;9f@5iW~-_HAo}-=om{?u^w@s0
zs>$pXu(T1p81Khry6^!@XYJwMC;_zuXVKZtM~-kh#4lrg=5p~D|F)-&mkMU5N%Z(h
zD7)BNyijY-u-N_5xOc%8zpuQmN$SscFjT0$oe^<5VRFs=GYzH7W+^xKEZlszSXH-B
z$Lg5Ml6F1K$>N@>k%H3f|MiZpdhq6h#twmerNeB2x3mIFC$3?=`ZVC{OQ(Ydy~3vJ
zQv(Y`dNvd~OO*b8b}8!F+6hrXEQ?EjR4lBR@yJNB@$`?Ir(A<rFDB%M9Sgg}W?&hS
z8TOAqnem_EuS0rMc0GPHg>4zP%H7I9op!Oxe1*4<a$YzsnEEhah5|$M!;>yXzZ-RT
zZ9H4lepa-l^WU>K$q$;I?D)a#COd1ja`L@5Y_YLhjP{kC+3REbCAIZ<TB2yd%Y=vX
zON|(B8oY~tXTNunoJ*vFRh~^R^Tp4xF=n?eB{@x9^t@+|ZlTH~KOwpHFMl?%y-b$K
z&ll2rtD|4_gkx{Rb}6YJ2bKsu?ED^nlP&jMK*aAPt=Y5B8V2O*bzN#<S2bGr$1Pwh
zpEy%NfbVIkD8)nHc-ob=wmn*PWlp%}$E-O{4^DjO2;rF@{Vn&NY`>Vo@4x#ls@}b+
zy<S)0`jdY*i|ik*n0s}BO?NE!0?7^@_Bm&-?ez{{vnxb#_s#S`89A9PXAYm8X1!J}
zE>$tvy>WiaW#0;}L!0)#Jfa*v&12?+mbV4LL7jn8&#$jz3~QO{6fNIV+QuWkJ7&8K
z1G7!1#;Qif6*Cy8dE`bd2`X^ET4i{w!C&O6gex;oe^2g71IN>w7!nKi@qK@<{w;2c
zs_gG2XO_NDK3W~zp0!-qd|6+J3Ugsr!6}h%L9;|urB+)vb-(6*x!curwfRqzkEz_5
zx$jmxZ=b5MXY%1I?H(!%J(_Y-a*g?STw0>8`0!k#^0ScHDq(HETJG%C=*?hV6jrjP
zN#@L^OU)|cf5gI9xFr@fZ9C)F5FBQ|xZbPbwUE*>j+2g_Hk;>Mp7qF8#x44Y!QD??
zDF=Gw?oG8!5Ieya@P4J`+>~v4EKZk1Di^Na_AM>zvEbRFhl}?yPL)#Jni$%#yi!HG
zurgIP+mFTS|C@ZZ<dv?6mgFfcNWb8-aPd-;_MDaN(lJfG>3^TKE-{%on{}D{$Ch5<
z`!n@(W@c^g5cw;&P$A>p-{hr#+2%%lXb$?Hrr%OO_g=#5wTel+=8>G`KO>^j<0Ec!
ze~9hRKa<)l*PHa?rG~``|A2-YYaGqL?GkS25Szm>CrYH1CHCm1vnA(ul-{_#A)-He
z`hj0nuT%PR7BgvWh>6w-T|H-e<kBtDbCVU4CfYn?W;?#$&s0&pRNz^^>+~f_&xFeU
zSg1)}YFWQ(c}iVy-0IMf#-mI3%DK%nJC&PyIrZo2Z@!TNerhf67pTrs=;_(5?=JDg
zY87wf24AKx4yV?;$$BL`oud$DT~lvf(7=1eL@H^S>2mjD-<Peho0TnnQFcY@TcZyX
zauOa-s^4!TG^uqzv)PmDK_|*)xgTF%FFoP6t@;XPJHgl<<!dw2n(SRlro28^<-Ynx
zm4fUK;h6{LsxUK7`jN1D&%4HeSAjesYo8}&dTDImC7FD4-Nj#5%+7}i{#-I?(kfA2
z*14BA?Phqb%yrm%M)}MW=a=_Kr??yI#IRcM1uAXeKOA#lQ%~Hyeg8gpZ<aXc{_&BP
zL!Q%X@1++MLQ@RgS$jLyv@+G5u=yJB%*K=_AbHcH<69V}y?s?y==aarjqmk?m+jZY
zgHku#{B!6_o3WzLw9`9gGsh>Ze@lPFm$-kM&a+F_FQngo^v-&gRoq{;cyef`;&a1W
zvac4fZvJQJov$nzEv2zjwo=w}@1Dx5KlpvKsu`TmI>j2YGw@IOn)PLOfzpNt4;C)!
zE6<&A@E0db!#&2duDiug@>eiszVBa=Ulzi-n0KSsUI}Hb;%~=J-kbODW8nW+9rhf7
ziZ5Ey<(ebAZ%#3H`X`#gyvHr&xTe|0Ker!l&VR7~zWrb4<?GmDEzReONY|X+{n>x*
zx65}A=4@E|jxXb|?dGRRTUa9&KG_<y`?zEM(jQs^Z_kNT-_~52{-}TcgrD1I8{bqC
z{n3-Nc+<{Q$Ckz$SGjYpC7+pg^9l1FA<i#6uep494d$qoz7Z46{jn)yGMky89IIP!
zt!R>Q-T!$(^N+?&cj&saNb+{&!t7wJW8&<pOFd0Cl|4R_nQe0E$LC3h5-kH)@lWbo
zm~sBD^t5bo5rtOiH8Nj6?Yy<(c}C;BY0E!cyOvu%E42Nx@$VeBm&-j?y5F1l{K(@g
z!S556^zB~SolxQ;7?dq3@atJc@u8*dpOt2Qn`XwZw7Z4%;ev_6DV)nfmIeFg&8}AZ
z<=`lus@<S;>`l((dDm`aGWXgu7njd)>o_jbd3uks=z^3JVxo&zPZB%Jai8N%0)ue)
zs~N6Wcy=fr+7{up>-9SEwHDtNUOF+!|KwIbPv<kK`~NRl_$ABoXh{Iu);kLJ8UKv-
zwEmcrWt(Dlu|QD$sfbF*o{SxPB;poamX+7jH)IPoN<Wsqpz_#i?Pf*g$t|ffeH?Ur
zGZPK>%FohRoby3BT#&1HN}+-7lntC5D*HrUI%q|O8?nFb<hb(sh5yOpEuWuxMX%=Z
zbTpZ%9(q*w%i6EUuLJ}O{@{K8dhYMieJd|c-_2VtBeA?7Ie;g8Mx&6CpWExNh8w3$
z>}cy)nc~k>nQ}eSYPz{MbJ`x+HFp-dZtal1JyF$EZd;|Qsl~&Ux1F0$Z+*qe;&?Wg
z``FfQaf!M)OSqdd4PsM#<E;*tS)M+rvn!P+ZNYqnSr&!~OZMbQ2Il+3D<&O@ytMe$
z1i52c$7}qLY*<ljb|L?MilqCb+>KI7e0#f0`d=6FPH}q0W5D~?{_>^;f2Js1jj!7N
zWXt>F_g$xEEXZ-taXOJD5L<Ib=I|XsE9o=RJC(wx8-1EG;pQUdS5`7RJ)%1fJ~caf
zXww?ATRXH;^f&!;IAGSXe}c`O8<~#F&rLXR@qzrQi{ZB~-bju9xQX4?bx9_3&3v6@
zwW3SDBpYqFUh-+y&Iv4Tfu`b|&8gpOxNGB_yp{7#u4OX)sn>cqx!2%#$KhKuv_<y+
z{dxBF{^N=U0X|V5SvSpC8!~VGk0*D39-SS&c(VEWINAMm>p0h}XUJV=TJ`VI+Q`ku
zi&OM^S^Qu9J@rs+f@_1~*PM5aht#Tm3D3(oFZt5^uE%9x>65R%9-C`oT0ZI8G@WG`
zy|Y7>=smo-+J$Z37e2GgNnM(;y!Fg3aSDnp&ns;5>z^JBwotpQ(HwE<YN^|uc{|<&
zd&JtRdF<#=s$U|=uq$`L`ZJSV^;kO&+%`A#zWh?q)p4`J<H!Dtv!BU7J#ygs+t>9z
zrwu<mbI-c?Y1NF|`#$e^V&<3ljbqnTNByo9$1C|y&g=M~xa+wW|KDx0IShu2q*y!I
z=2h4|oWR;Qr@2JM<iwE!{FV>(*RFb<VlD5xdj*@$!%&l~=0mR^tGdsr^AS5z5Z!mR
zMNrVu?7GCK2KAUXl@F$f@0I9y)W2NcaNAU=@{S;G9uAHeDUr0Rk2~&!TwCxXBSw3w
z@RZ=tPg$!CORoo9`!cbrA*6A;fL-a+wkL)M)Kh~s&jg31Em_mcE>(Huup+y`>y_sc
z?b17IWcB-_4oOPvm>$R%bTs{g)9Vv_I<w4<pS&<x)!1i|*=<4BFVS;1R*BuOE|vfH
z<M_6-;!MeJoFtPp_I>BFo5APHU)ZqLC@Hd~VpV_xPjb_fheGrAGOTub)_HB=W4UdY
z;u(Zx5?t7pt~!x*YSU!#Pip;gfiGAJ^LDQ+EpNS|V|d`Ux@;wHvX4YA-(|Z;cdv);
zPd)1*yFh)}p(`^KD}=v<$nt)$clhaUF#E?wzMucg)DHZ6A)NnZh4A@*CqAE7pMSUC
zqSk|JzH_+#g7*(y3pAqgqUY)v9!zY=oigD;lgg#2mTOjK2j?73S9&OPt1wu`qjGKT
z+b`9Y%KU}eU!Gll7_YZ|i^22#wx!>LZ=TdW;=(_BLd}-q=Szw|MJ77_oICTwx$3tQ
z&zw@4&b!klRCdqBi61V;+}O3$`HG;J@wStD&MDkD(Y10{^%Rv9`PD~`S?E@TbsasY
zu<@E*vngXtq#wK6yz2|<ykx}d{5V#w;8r!yJyV*Xwxm#hRkYB#6ywlf?VAB_Jx<mq
zP0e!<b^2;QE5~Q@C$rCYM5V;8?=m;EPgZb}H`^SeyJxjaNx~AT7y5b;YKKl48474>
zt(RKuv2wd$$_8hv8;RWyw$D_5&vNXS#q4tllQ}$$r?^WWWYbP!a$R-JW@DAIsmP0m
zS&ZLa=$5J4&K0riJY)NoWx``WgP+;Tg<)Oi{S_KBZ|_`Hs8_P4>XeqcR;Tyn*1+8p
zmz&I)VUlZ;o~oAmsXxPK_se;~($*IK>nESAI&HE_H#_6t@A=!N{GRdYjd`^HfvTqO
zv)8^pFTOr*SNH8*+YSa_vt--tdnWdJ<x4yBa@pm}K7aYMwzSOb%muOHM)T(VUsD9m
z+%GW`c(mNtefH65oBuw3-?vZ7j@!^&_W71WHTwJ49g|)8vTX9|#`3uj&uy;Jb1Xlw
zZ<^-zjHPF8^ri0gR-ES=*y0q#m3UMvI4V8%$~&{G(=G@nZ*}v%`C0tAI){_WB=?#9
zzD%=L=bYw0R3)|d{{8dae~p#~eGE-jKC6_x+qG?9il262;hS~tQ>V#9hfFa%v`XsL
zglmBl^BUaLbWPtT?%bupzr@S8@@`6u*EgPxvmbL+YqZE`_=|3qy0gvD%a_k5`RcV>
zn^^AE#*6QL)wipttH#z%r=aQMc1g)ynzgE0-gjB=&V9(W{lTZ?3q1C_FB-DPpIKZu
z%RkTH@5+TgZ_7<wQ)#}z%klYqgYOx9FI4t+gleAAIeTMA)En=wuBBhLu)3PBn}4<S
z|2x-^UiYh9UVn~xzkIPmwf=QbkHfN<uX7ev1mz^|w>4UGc&S^f{>ldbBm5Hcd$t{C
zyLoC|Rz_5}^|`d1Buy(RiTLH;rl^;BdtY*XeL2d>yq{NDX}M;RBiHt&x`(b;ZpzTz
zwJ<v0!`<KX?7uf%GmKnruIf1S=Io-<jgKsrJK0y-&YYm?8+YQg9oOHo({>-&3|58Q
z7jrXly|&Vub(N#anz-Wp!go~*ZNJU@Q+U)V{f}h+l-?@NU3&IHkq;A9{P!Ncaff-+
zydO*AF67qoY?fGk`;zh+op<v8Ll;+k{`OwE@bJx<p@maJPL~GHlK;$HJXvt|Pss!U
zKmQsg(}@kWZCwYH7CoQ#)@3_0lXdEG(Ji|(zVoDcyp#BTb(@vmPD2;DJw;Q)WxhN7
zT%KquS<$ULJ47Z(ahL02Kdl{1Y28ffK5HW+7O|>dRL-<C_6v4*JJ!8uRiplV#w~LW
z{Vn_?vSs&)hLx)fO*-T@O6O|J9Sfg5@yVN`{`ztIEv)xd82);A_vPv5vKtC7olUm3
zn;g5i*@ty4Q{58dW7@(-onKzv_;g~fk=3#I_KBW<nfA&4ikZAEYSFUGEys?zZ#&44
zGH2blV;Q+Sc>icg9Vq3hUY@XU;nax^^G@WMi10{#;$lsn%Cg(MTmO`g`mALpufB6V
zVh;G2lk`#g-;{^_2ddv3SlZMgcj1S!!TO{%U;bX$ugu3YYwPK>ONH-cc>FDFw{G?3
z@s>QhFp)9dYIph5EcQ<pXQtcD_%`)I@`9gsMQUf;Qln?J9oCDuc{<&C&*=|S5{x5k
z8s1B4`ApyRtI}Wvm&_~6n`aU#k1_3*=C@{>HA%mHDVJzL;N(ii-QT|WCfw9mwP}`A
zb?dD)Q;#<@gt4TFxa<i%=Qz*3D#h0NS6E0?_v2qpT~9tHS=^go`RZ-*u|L~%);)Z(
zuFhjkhD_0)6M`X=7ynp)p+{-T8@Jb5%a7&B>*^e+=I{B#RlGgoTN#hVt=1IvBR_<%
z89%=7aHPg7!+3hWV3WefPfUR_b4~<`ZRX(Lvg5sG&8{1*94Ak0;OyKkp4Ss2qsS~{
zJ@xpR^URAEt(Q!EbYlshvR7`Zp84j@dlL@n3T`-%;s5k?=u?K)DZ;Y@KTLm;Y!vj~
zC$(=+CvPQBvTn1rLz>RK3}xP!Srv&A-Zz&8%y@4$Px9zw9r=yhyRVx6z2mnic?$oG
z;=tt098Kv54MOkCGFxiRZ8o~poNZb(XN!7WMMzAwhN0257ylF1B!8^waEo}6cBQ+0
zOCMubM%gaQbE`y(Cnp359Maj`A-(dD$2|9LNxr9vO)pn=-r2lsMX-eT1?JVodCr&I
z*sdp6i(gx_{;zMz@%20<=Qc}D2s~BrT|@omkE`9?kN;l2Zm+bFsq^EP<KoZ74~N@J
zm3W&rna$|s-70k|>aWR*Nr__Giih|Y#l@{YYk6o(_p)$KThqjpf)ipAQhzntK4<)w
zF1tIWb#Jom$<!HZ6g3T7480gCRXGZ89aZ1q_B+F-T7vbRx|;Vn?p=bC1-G6VJlN@c
zQBw9<+sUq*j`u?^zMbE5P2c*_49(p~?>|4L@F7NMje=mR<d?&D7B4YBc+ofEw$6k4
zlGpQMD_x(s<sabwa+LdG^!{B-&iy^6c4uYj=I9w*YDN7fhdmahzuBa-Y&GXnbMI4y
zVaZpfX~gRulUP-$rW4Pj(5AoC<H4DQ%g^kXrqQ$hgP7ovq#5Bh!gU+32ES4IW~l4h
zk}LRfhOm?F<df}BZWSC02|i!WpuRDGw%onH&hdNioV@8~EW+F>v5s|3;pWuKPRE@U
zUvPJLZl0FCOY*`S7B$UBA?h<iJa_0jf8M94zg6dNTP4HdiD7A6`VUs=g$tMPz1$nh
z8F71gPtq;#^6#hhXO+G<o^C()IP+G6*uyfe>M~I)4Apn=E_ZhO`t5O+z{}>dHqV;E
z)TTbVx8Ue2=f#_s=eJ9gEjICeFLj|og0t%4i`R*6JTek#Kb~w3__e0<<dhX*&T}}`
zT>HPLPCP8(G4rl0`|FqoUuBP}9xAl*z1JG0{9RR0?C|F))A&Ew3a;POf5Y9-_>06L
zgVvS}w%H4+M7Y-M*c*RO;nv2fSFM@T?GC?X(O;$)c$jB~<Zgo=HfF;Whr%N^|8P0F
zXX@rowMS|(*Yl+8*G5Oy>6k~{G~FM;a5Lm3-zm{+v*&Jd`?h0G+{6R-W*>d;^2^9n
z@0R=br-v^{3gktJ23-DpFg5Dplg{X^oNFH1Z2YgxdOggsBq?qwH{<a~PeS<Kt@6$Y
zek-J3eceru_ui>#kqPx_!kSyANVm#2`)`nm73LEOyZMc?SMg2Uou$Hl-Y;$`THFcW
zqd!4$ulHK+hwm6aS(zz3`Wo3=k#}72?WS8w>boy7$jYjo`Fk<=x!il^uaobH>@oew
z?-d?oe*Ium?&5}@)4s*6*q7RSE@k?~12=58%`cw(C&B;Pp3?^}YOG)pKl@s5tKZzY
zzf&$QnR70?tEODGTSJ!RHfOEwn~VJ+E>6!veVdxvpC?&uvq%t6K2%WBd*7!}*=t70
zQ{k)TZBlM5riM2scusiw(fW~FL4b?js=8U%*DUQaHR@r@KYn?_KA%JCdm5Pvo^=Vv
zdo4OXp*iU9ao3oj_!)<%O%Z*ut!v+v;3=gG{G0Y3cvJc*@0ZHSgLSucmoEu@x>1Rx
z)Q`VjKxXeF(OV^@YL^paqH;gAtYoWs5~#6vaty2K;=b@T6Hk>1O5K)Hy(qE0{r0Dn
z&`rU+PHvhIk$g}2QkALJ)0~?fii_qpX+$nPEwIFv*X!-wYrFD%WM<m2idNV4yyt0O
zs&v93^3wlSrr#{PubAx0IZ-PUz|3oFT64+dOGSc7>ZgjXue@=WXPioMO1#JZFHdpr
z2KnF@@v9jB<nk@^x2>>x@qg_d$xl{_C(>UZ)P3&tak=O!v*Ng(`pk1Dn*^Av*mk{s
zF>R(o$j(%Wg?`=JJVJKb-1*<Nq_RqO`?cV+JM{nf9aOQ=D@qeTajoFt_SywYr}S()
zU8#LAxB5ZV+pRL|Kdmi2bnCil-A4KQb9(=k)QDYJYW8{pbGnJ-`4>BtXFXb*Dcrbl
z!u!63+2X1;i|j-+PG0CemhCnD)ZL~>`ijgAtN10frT70_T<Ehg;`ZuAdJ7sCGH#K#
z`5yT5w_#*jZ`9$rb7jB&&7D<u;Z~gI!LG;@4dGQU%z96U+*)@@S73S0b8Q)obq@mn
z9J;+k=p@g}LmZ#)C9l&ym2%SaUG_Pb)%iJ-GdgP1mUi;?f4)Ac=g7}ZXZ8h}ABhSU
z$-VR5U=~mBlOOLy>Y^UVaPLkmh;xvNIa`>#_o0vf^US-OS8h#MX80y0R^)S*#ZJZ$
z?$~tRHOx=GEeoiWyE9wwp;V)c*;B)__6wfqm)hO_5hFagp`hth+{I~M-k&pQQ1UBy
zabv+IiD!MB861Awe1#76H}EcO==<R)B5=syn{2m`7CZOjv&rEnB^NL{PJU3kRH3fo
zq~@GP7FoTF>Nf5ti$C!29O7x~`fRkQ@WkZ!oKq7n@#*H~91fFw^d;#>*H(x14>THV
zPZ;`Jekr~3&B&s`-O=>%idoiAW!fWHivx`l7pBU%IA3{wK`s5(LB=GN>ct2C^1T1x
zl+W{iElXI$@zde9SJeMYu4R6<a7AH3VE^o=Y%4del3#lA3ERrsZ++R~HL_WyZZ2G(
zyHhPIbs|^Fu0@4fL0dE*9s1sUqs=kdY0J?G?l(-;78S6wc}#rWv|^E<r^HN0!9UxB
z&bDfb@_pXG%WfigIN%MN=;4)>F~0N8`LE<ou8sK`>$W2x&v-VY>an|F_PfRBKeJ3~
zixo@D3Ja;2DLqp_T{D<HWR{>+_vz$9=7#CZXBb?Ih_n)D%sRj6b*QG(I_5l!3oH`H
z)LMkBRNru{yK$W1Yu=u97W2;c=4yT2`2FkqQ|x|87SB?gByJy{)xl_57w_o!Jc-%&
zz^;rZcMpa{RW&NNoMYc(z;AK?A-h6HgLA~Cs<V;@eIq#nZAw<mbeQv4wdU<&ZG(Sy
zoO|}nQM?r<x2h`Sv{Oih_UCuJhc_*nUp{r??Cd<QEX(Yv?w(ST903RFf2-fS#=RwR
zVnyF>y(!!}2e@ZgT76c!?_Os7YOc(jH*ddQwG{lj^+d8$me0n{Vu^-ibsN=vp-;nA
zA`|AE>yEZ>tStU!EuOoe)nWJf&}rc-S>3fv&aPtNNZPo{DceZ+k!j=dGj39xt{W8M
zt`r;>yK35{l6U&zUvUqH6Dyzo)2!QD&-VXcwTN|3=U+$m!;%cETt8I^p9*Jr>a8OF
z)*wl=vA`i^`SHK+`Q24!_PGi9o@`x^{6o@IGp3XA^>V2SW`7B_`3BW>l{em*F01G@
z%(9t#eM>N(X;o6j>J{v_uXjzq<B~mN&W8!Hd6%E$R`o<N_a-UM7JB5Es~h$C?Z^EM
zf~LyVH|MD2ZuVJrcxlY%1HN;4lqc*ou(6L)d#YLWR;gcYuVlbh_rg!UaVw6`F$*%9
zBmK|qvJ-p%k`~5wce*F4Ef#8@#MjLnVJ5cg7tfp>CVqvLSx0*g^C~^k4w7^baF}^!
zQ?hb<Zuj%qEbq@n?z-f~Wh3df=I*-%6O8)S2_O6rk-1@I>}v7FoM#=1^*+W%{qHSM
z`@}JML5zmley2M|Pmg;T2+11Vw^5!G7xl{9;K-u11J8@MPElFy$zsU<ciO{)QE%Qa
zw&nBb4ZAo+_~VM*g;OdgCuH+W1mEm)yI`sELTG8*3W?8s#ind41wtHhl$whB-l$qe
zWgK_@Y@==2X|X&@u=v>Se(`&4&mF{X{^yw2W83p{v9jFiE#e`E0<IkHd9!*_jG}CW
zQKi`j&lP4t8AS)UR2;-qmgmgse4Z1ZF;DA~g5`lTaw|l8s?wVBPEPN#%g(#Y7}{K8
z7?3nOp`Z23nxdV5{x!_MP|YrME@$FomF06>dshkW%qe2CxHVx{_ZFAr?de+THbJMf
zW-mK<>Tt)N-TB5o%e)sx#ij?(s7`#MCjIEk<7j=`gqg3}lo|M^+&R-+t}Yq(sx(Mg
zaarUyEsF&9N#-@-Ck&RTo_zD|&lA>%J`#UDKE7NrUHQzHn_7;1vY$_;op#z=IkolS
zk?lGxUOn@AMSjfq%HCUjZh7P<<xghYFRl+We^FMIwrvsH*1fNtm<@$re;0cpd6Un3
zg~yZbIqQ6?zx`k<^Z!-LCB2g2MyqrRU*)!sPpr0@zEE_Vcq)5t*h;;aAGr^jg+r&?
zt}eASoqXU)iz@%FCvA&80@nK5tm|<NV3t1=rj;#r@6EMa&x<cVYp7fzYU=0CUUNGx
zbK2p$-+NEWaH`ImP|`K&Vx&vt#(00T^0vFKDXr5?ujfoZ%4Q-OIwy3)mS_FjOus1H
z*mscCHm$llDQ-&ZmU{*PXZW|9gtb22_f);8u}->P@gCm{8^y)9&PkmJ_jt8lzjV>(
z6tB)u<6!yC9+USdg)vX>S+~IBbW~T*5vw;%g&E08VM}(c`;;awu`@Jp?e-64tk)D@
zRYuMKcVV_pPxQiDF2O20|AZf0)U@OXbF<{uB|@2^n?AnFFc)&0Ke2pyvYCdj?b<0U
zd7BoSZ_%;{@OzrKci+n@=f&%exO%rN<+)%!f7;*2-!JTy-k*G}Bw$tfe3LhB^{iZN
zF-GYV97R0TKQB??7udLYVoQ_`$5d%QrV9}V796>Hq(IH+i0h=Y6Xo|WHOXg~Z26>h
zxksA8?n7(R=SMM{v|O7b%@F%z*}CahA09kt+LO{6_r9C?()FOzf4(ZLUKJW8YxDQp
z_xrz=Z!?@PaX0MD%d2TlMUUer&b+bUU9qgktFHHj7L5!xh07iCel1=i9JOkp-G#G)
za~|!nO8R@`=87Mo?QgdVBrot_b3T`~^W|Zddvk(<a`@hCJa#xyMk1tLlmC7KQ}nrm
zEJyj42wuLR$^1~~;OaM(hJq1i9lO0x#dmCckfYTp-(xp#)$Sb8rGmYC_jS+P6!K*6
z?i#OI?q4LnmPhTVaNZ%`_-`BIy<>H@*{`l|e*5d|n^nT^yDl=bK9};IYLUHh?$(K$
zT)td>DLFgm;+EyX<r(v4+C4s2dTi%p=ddGh4*h<yw?y`lzwev9%Pyxee^L^;uWZ(_
zf6-yZrz>3&=PYHo6=mF>#pv=-p#N5nLcE#ciRro=ml{;!^ZHc`zWrT3<LkW#3iFnm
z#{G}WKJV@2ZZWsXV7a{94Eq2%&m~b4OFS!9u1!dCG-Cgn`{|4C<e<(&YB?PT<i%#X
zF8lJ(KYfw)yxkM8_U}GglaM9%HbyJxyVjTZw;d~v)wjq+3+?JJvx<J@5wV}^V5~il
z#Nivp+pix@3;9x&utn?!>+Xx)bDD}Lp1TzB%t%x%=y6Hgb~bruon>uG#h*LoYz{6d
z6?2#Suqrs@u7Z8d&)~lgm0}xIf|iE|TFqXV`181kMdI8Q>Qd`|#PDrhEcPwk%Jaz6
z9XkRJ6-+)6!es3t#=qg<Nd=#l_1upSq%6oYe6!jszNWb3-ECcF^K0b+aceXmH71^1
zI_*~I2CtskN6$^O-Zi~cPKVik=8Ort@BTDM-jc|_%zOCWMD}$n*A$%i@LYMq*QHlg
z;&w0j`h%x>P3B71H``C}2ySysy|_tQV(s<&pP#*->=S%(-_@Dl-(6dN+p6Y52m7I)
z!MrEGeHIU|pH-H;OJnjRex9oiCn`l!o+&+FGvWW|JVw#!OBT1Bny1uhx$xZU19s{w
zCfVM+efYM$?Q0pUt0#2#?X8`dUiZ<$AZe3x=DD8<WnOKvi7!KIQnNFo^lne#=M7z=
zt2gPAndR*lO_xjd?0UCg^}?cQv(y-PR_ku67kYk;aarUZ?hL_$_c@(X_N=R7REYX`
zvd!#s(wsAr42Q#WbeC<3V+dyzsZo}gd0vghefjQ}Y`YpwxNQvfzIi7jo?Y*kdZ_A5
z<*~Q2KVu~V;(jY%ZMt}*s5ZS~OH7<%`G@Bwv5&URsd3<Kt2uq`p#$&9f@KL_N!4;*
z-0IHfWz6!Nb}QVT%lb>O=h1;(2aa3BChR&^^vPgPdnAvmbcXe>ru0ema&e!wv;Dqp
z_MJPbqiys1NhSLpubQ#mz-4~dl1p{vn_oU#dS77Q!o!uB{tllDHS7-@-&gtX*#*8`
zpZ12IQJZ(_^weVA-`i!S0#h$0uuJj$USs@t)9m0&qPs;hWzzSa_GlIUVBQ_ZUL09?
z<gQ5QtrW2rZ)W7RHQs8>nVh&l{UL9T_foZNn{W4S)!hztR9t_wOz*-3nQ42LW;J!C
zERmKycwYU|q_Ctz$#*6#xbR`Siq@)g${gHvdWABKK?ytyv@I{(z3(IR;c_YaX@7U4
zrulC@JdKU2X7?}Wo_58k&n($oY5gt9#L5VJvCox--N#?-*>NsIdH<hhv-Q94|NDqL
z@p$p<EPwr)Bavm6F`KI&U%BAX6vyw=QYEq@TmIMncaxnb7bHuBwTjL?+g+$*@4GW*
zlh>Kx{x<KZwPugcuMp(1_NXzED4e`iRA%LyrdNNiwh6h3{E=AR$kms=c2`)?Lm}xG
z?^EV4YcFdtW#0C5ulJ^fwKI5Y*2r2&J9T$jrAZ(AzWp%I#Mby6#b2{O?a^ZlOqM+M
zaDvfH_9oWm7B#1}s#>qOlf;kBG1is2X~Ctxd&(*Ck5=lO*EfCI!moG9n{AK$1_#ZU
zdh-uHv*Ni5yt{(4y33PI(lmvwR`~}^ne5Ujq$&|9rN>#O@o(-SPOXcoHLSWN(Is|*
z8T&MjR9!mCyx*85Nzle)ucf&7ogF`-ToY72l?q8oP5Q5+t*tgS?w0eM-G??jm~uE*
zxS=q)&?Knz=5v0BUoLIEI)W_H5uBxm)y{RE4UzhjzvA(c=m~4@Gya|+d*Mlt@3&QN
z_?!1ly|zJAGckrU;>C)i{P}5uTXjo5bOye>>M(Wv{G1!J)MLMCOsc*0$Yp8ew8?uq
z!$T(v&NvlW{POKGK6~BE?Nh&Q;=HYsv;V%)${#n2k}`{;)Wfrwo_=6+t4v<J*}igV
zsE9+&sjW92cjUJVW^U5hp)LBP)`LIta*0yK$>b29yer3rJ})knbI|BYvOBP2op6Z7
zl%pBD+L&8bY?#kds$7x%e!gS<{N<-tALwj$Tzfe)tUYM$EFNj!sP!(zi?rr`>zMA^
zdLqfjchT;{FV1Z#>i+(n)kiyJZ_cwf$Y)w!-2CjOxc~k>)%uh#9l<Qp{7c?{5&Z2Z
z-F5J0>F!nh5g&!T=UkI%^qA%}{mZ<wGlMJcOnS34#WnnG(|W_*-~QQ|$ozi6>HpO1
z)WtNv121<wnKc(J<8y4gbKTTuMR8~N_EjIIN=}($a@bu^?-ys?_M>WR)Qc<_gn}QQ
znpjdZT~Ye=+w!E$H|<+4uTj4c_?xkyYrE^ug;8n;{B(kPVrp7mzt7=WKk1&L`@yqG
z%j&mlvv;>QzUay`&`!Rkms%zED|2JJ>G^4eC!Ly}wneuz7HSuFgr$qWUYa1PCCqKe
zQ^;q%QLNk7((}gboLM2}Yre)mU153fPOs=J1`X-PH_llMvm6e)n&^I*wRO@~_0E_7
z+0Re!n7?A?$p!hPW~Y7D`xPCuHD-1_Eg`(7zc4*%Vt~(<d37p(&dy=~n>cgQOpOPY
zQawG73a;&4waxOwH*cx-KaOuV6btO@^j$6`v+x_o%E|l^zm?T@pPXXGQS8KN6tqIo
z(01y@TfB39v>v8Tx^ie~yu`uA4YQWN6yZI%N#&H-49{yT)_l6S;pAZ@#>(*92@4CA
z-*xRS^*H<XZi>vu1?}6Gu6lY-h28V%+Bx-yzV%Ce)Rzm9;J!2~Y5SVl>~}9Rem^)}
zLFU+==qDD7Uvsq@`J9=&Y5(Lc`Z~c|zNnaYn`S+n=rv(GJKsbJ7Kw#S*ACc9_u86E
zFJ2JBkQ0Al?L+;kg5uFdq6d?2GTu41d$p69YuU~E-1CwGo_7wf+4w|2eS^|Iy(8&;
zTs&K!mo7<;_?*_ZC$_gECS}d<RcBZK`S&|!Sz1wRC_~@E?q|}yUP1TXZ9geBkt?<M
zl2NKlu4bX~-t9W-<rDti<7|i)3q7`Gno)q%iw4e=@2f&XteypUe7Jda*^PU<vwek_
zUaz)%I8Rv2XF=P_&v~M^ZFF|rGuy^^e(&`(aoye5e|%f@GCO+3rlc3I@0oU{zm?rl
zHf7erZ8jUc9%aYvZTY;;q_d&#!QEXoKR&V?h@9SVkyq=(vYDHtg=QNh>`2*t=S;|x
zKWwa3KNdIHpLrv>zsPBC+T8Wgo^}r}8wXy0wKr#WgwheW6&y;t0-yR_u3z90+7Ps&
z`j`UmjYU(JAKqy-QF5UPo7t(ea?8?gzX{%zU46z^`s|0&cJFQPg#X;PJ-Mj)cJT5@
z@zsypY`kx;=x{o_V~ILLA@`Gm{p}799n$R#KRTtBXHFIWkux<pZlCy!q@CjO?$2Iz
zMKGjSeO<NCh+(hq<|3<}zKi9YcfHrOU%Xw}byLS-6NA|8h@_2t3q7xV({yR#DdBPz
zQ}6USVra;!P-S;WT<rdu424slB2whL7gSGfDNZ%qvD`S(Nl7S*dGUs62ie$5HXptI
z<kYLk>!qoZGZtiRRpIa06A@g?(jN2gALqe4?zYF*2z*j}=R4)b$-~Ug?l!cy>8y-=
z&5<>;du=)^$H7{gXDP>3@{jZHi(NTKRE_nzQiItkt!1s#UQgV<z1Lf=@tt+CQD@7E
zNY~#w{{3x&nHpMK7S0w^y2In=+H}4DWr*4*F;Uk5_cd7@58~{<76ofKo=!g_Uj23Q
ziE1Mee;w!B0@6Zm$xam|H|HGto1lN$H7wXnh+%iXW_{l~S7!bjn*tf8zj$%)hR3q6
z>p6w`8fqWT+CGzq%`u^FO2x!$oWFP`Ox(Rudvm6K!0LlBJx6M?+YRM9Hl%4-JbLNS
zR&z0ab4}EpAfs#*4`+)i7nfaA^d2Wzd@weB`tRc`V`~>DspYrVn;0swv+TX(G0COa
z_?KGkrG0<CbuZs<zJ03jEuTl*_7orDK38z4YZp(&k3iGeC9P+lh8(mwz~FbP_gUHF
zi^sEqt}VP(wDZfk_9nL<H9t%*$d<a8pPDE5bpfxHHrvI**y%SbLO<UWv{+!M(KYo-
zgyx>Wi@Le$iKn@PROT^#t1TC?mHqdR|Ha~@=2oTT85LfPyVUC?RyynzzOyDF<*kaZ
z5^v1CC5Pi5t2Mn}|8(!ciq?e+KgAh-86Nx~e{R;{mfj75>pZ#2|DCETbL`7Kns1nz
zJAZ9}_~h0X$9aoGbl*)pU*e@;Wy^K_)6WP?aoL6wi|q7uyxDASWN<O;O*)k-!te6T
zG4yEp{7@dBJ@)&T|KfN5o}?=0bE?r>wWd=<h?V(KRHcfN@zdTqo0O&9r{~=;-6GBW
zdcmCqyJrQb@10!BudvJ8FlPCuu5-bUsyVrNUDqYmFRRTL<XL6%)@j0?&WSn)uFR8I
zzwo6%M#<5h6r*!ePr5WGpSo|svhmLXXSvr2Gd5fOdw3-vjemlz!c_rH6+;G{`@v7D
z1e+3?8M}Adnmjp`_WFgqjpfCYH$NWjzWDlaxPITgJ-aJ@ziZM_`nNFVUe4b=ZOPv@
zY2Emk6~rJM!8t$gh5F?AJyWAx*d9+X581lz#kxwbgUqexN)6Ag3y*xOy=>W}tJ9{R
z;5AqK<S~2O?mZt(6v7MmZ+~`dJ^naNX8oC!NlnX~r~cM?(4VH2`_xXrDw_4iZsA#*
z?*E^lvf#o;4e_g0&4z5B_!XAS5%|Q>^?usH3DJS)9812gGI)0O`Xz<l$ke#qvd!xE
z3m2U9@K5qw_~uW5Y=pb@CplhL)uI$<A^sUQj)jd%ZR=$lT=j0Z%{yZx$hYduy8JBB
z({ICebZzFIXZ7oe(T;gf?UnxBQ|0Cf;`z(GGKoD!z{Q|xKQn)usEzQeu%4N&+Y=9X
zF5CQuZ`$%Q1*hv}Wf~XW<Zhhhuex~q88!Kcqh6W&O6m={7>|bEYjj^^$*$tpQ#1R`
zhJW9ZC!H<4c8789@|BOiFFTsDLc-QTBJG<RyOPRnyJIQ0!<+7WSQdAtymiI)^?qw=
zE!*F2Tv5js`BZt?-v`qAh3~qbzM6WW`Y}g)eC<oy$d5sm4-$0Cru2B4PVMOEXk5`y
zH+2U$>)NJkEhn_1WUY>0v=AusUvxCX&D`GP%RFZ;lc~o%UgU8Jb=Pc{3Cdk#tmM7k
z`<f-+hWx^HHVgMA6vV|fFXl^M8Xj(-(AKj&Bzj8)oA%K&cTI9kL{kh@^EG##QnsDU
z$jtWllKi5LEZ6QXKER-Pqg!diiM`%0oE^Te%dp*$sP1*LV7|=}rP&)Te0q<qo3pM>
zB%QB0-JvZn;*PBBk{ew|dw<OGd*%7+*&nV?DxFsT?LL=TH$5ma*%ABRP5+(79cJEX
z>8*2@wqA&8%Gjx9I$_@@ekY}a$7@fpX>PMTbz04xq4?dTw%v1%aJAXYJ+CQN6na5k
z%>09NyT`Hkzxz5OesIhTt9xK0!^`5haZz~du1@*cqHVW&&FV!?ZV7a`_~97y!_sH2
z=MUYz88NZ!@{L*bv!;~&HkZ@<Q~mSl!t+NSxCcsA+n&kfzxH`W^Aeuh8p~#Xk9hQU
z!^)E)w;wEXxx3KEW{YbG`@hq_UpBA3@YC^wrP3v}d-p$;9c-I$+dcQAQ$+cJi?*vh
z)pxO-Tke)UJtdD}a!unF-37HCYs3zm^O`YVGw=S2@=e>_SMbR2{CdVWqsc%!Is4X<
zC6}FU@ig-L7P;N&T6)N+t!8qFa$53|100JD`3)+h&Skwyw<~GUWAVMSj$eNA1dTu)
zfsG0+QYXwEOx+#*mX$K5x*T4<^1SY^bl0j2KeFfd?0>}WvhKo<I~fTcu@m?DoUT22
zam5|GmP8fitbc!|t=!7}R7!uog~@srXTQ9f(uopxgpy@W^k&?9^68FIfo2@{ndgEE
zLdP1_dSVzpo}W;BPT=K)U}48zu0_TTF3$PtGr7X5CoIb@{cf|fC@A__FiX>J$KuVQ
zM*Uus`b6({i-m4~Sz{-|7hB2E9LF8|#_qUpYOGC%#t)fovs2D$sa8BVCc1C?zJd>*
ze!h76l0W@;dcFK!+kHPIS5(+e+|>H=xqvNup7>IMJ^YSo;TdgvJyuziaGi>1Jd?5F
z4zo(Fxe%kvjamGDMSE_o%=7R%*xc^pv&wSzi^An%7B3Zd)=fRUZbkTka0T<ez5q$)
znE?$UWy^hL6d#{)@W8(Ni;`Vt=`6V+J?Z1;N7HsU=JGE#mk4wH#vv&Apl|a_k-N&L
zO9BHN9iA12{g&dBe8sq0xWB)6<`fCF0uhcqTJ=7bT9Zs?-dz;Gr6#J$p>!kPEt@IR
z*xqpaPc074T=+v!uH(s)6PK$*ezJv}@%nUjZ`<R_4<+-~^af_^X1Zlyd%M)5z5Al@
z;&o@Xzn*9remiXH$F(aqHLL6vyr6Yw#tz>iEBz&Xu39HAL}wc{O0Jmt@Ilr~20>qg
zv)@>Fw;ob)UGbFfw1rw|xDH#^0n;hA3x&6v&7GF&dR)^&ys+n3rhwVuZ@xl|d`kl+
zKX-jI=l6}>Gam8Je!j_e(XwqR+b0_?UHdk-zWKdWmHEyViI(Ncm$rOcd$axA*0pcS
zkG@|rnVGBh!>$uE<P0yZ<IOdgdp{&xGu-z*Yh`5qs`kTix6bkYD|4LDll`jk?h5m_
zYFyd3W1dG`u)BZia=_HB3R}Ye@d~$o;$V!hnV`m)dsMVN=hnOu{zq5lDwo_T({1j3
zwJb{C&Qf{D2HoeuUoOR+)$S8^-SGd!A)PcIjUVUc*>d057qcYsjig`#-{SB;PoFG1
zp|<k<3`H6Fd&`z;+~{_nvEgfb`EvdF#+AEG9&k$ia`)OP^`h;Nx3bB>J&!C*9*OPP
zSuWBrLBIRsrSDJ9uHL>}KYq^9-o5jVe&_g+Skf;l|8C*R#M3EX<R49YXU-CK;NI!*
zTgmG-dT-)h*l7?v|MU;r3Y(SUVK3yqiX6Z8{>I0rPoCAgJb%1h-G25t{j0fVtC!BV
zP1^cC_R9BNo45W=)Rt9eC^DA1YbY!*IaYA*lk#T*vsP{EKWI_ye6vPUs%?SrLylPo
zJA1bFS(gN}72CfP;*)1K59mJhH$!d{vsh<PZ}gY8tFxtJmPqJ@*CkzKS?4?VaPy;h
z<3kSXnYSCo?mF{w@s7*;Ru(uv|F}f#=hf}!`QEFiJ&%e17c(JrQ_kuB7g=ma7BZTs
zxQE<2zNUN4iMgC16B9KV7Wnv!6_jrlSeN*VC2OY4mA1L7)cLtvWFJ*<@f_Z@k;5wG
z`Ht`N61(^%kDaViTvWVad-UZ`CEZPKd++5;=HGk!+LOC7YZcR;xbA#$;Ph@G<5I;1
zInOJNgRZmxk*U~swU_%3SIn{2LpwV@nDQDIedaVS`h5FLhqgWU3!&^D#rr>4Wp$jS
z6OOUvoUA(eN<iMLV!qigu{p{=bmwxf@b<mOYLM9d#M!H>XIgP3i|zG&j8o2+htyac
z^0?FXb?3wUouO?)^R}=#d|PrVJmb<6tNv{v!Xcen5+bYKzpoTcJz(<csloR(?+WuT
zm#$mp({fJlZ^e&Sb()hIB*S*^jnH4_y=j^CjxTwV7eZIv@nT%P^jWtN>uOD7(Pz7K
zg4MOJCV!7TaJI`@;6~3>7xlffifki}uCOu_n6_MwgWvFjxAH9$iR|v+h|pm3H)Z!D
zPCU2jpE*@vwer@33y;lyJSR(-;oZG!2mNkK2^vO9-{xS_39pP$zB}!q(C0Fi8C`5{
z*Vghr+8(GT@cnlB?O1^dDGrH4N45#JtmH4VRBGJ9827j@!g04~_4Hi|-)3z;Ja;>{
z$nHG9J*Q8$v*m{I?C{+7=u>Pwzwg0~?Qds#n|d&ReiqHsekAZ2r(WN)H;&Vq8+U&H
zA+{=h(ZiDuwkPOyEP5HJT)eck!_lNj=&qTk*21F~`EJeMW)U|1%mm^3ryB$&@|;wg
z<m`3W_u!hz)Atn|JoTynD7)XDDLW+1%3a(1_9ZOS_D$fpv`TGqM@rB3#m`)2-GxOA
zqskW>Pu$j@=hr#^;4zmkmYZc|{Jdk;5-eY3Fkh137OnpF=hyPu6CchB?&mu0;5YL@
z0_)V3>o!ab_!50|-xuKx5{rYEZu|BoWk;Hilj4M}*?Uwcr|G=3eB7{U-<nG$iUo~5
zWe>HjGFBd4@<Y+(RLKISlGt5(Uk>F9_MD&5+bDI!K_^*(N8bIx=JU<A)yyVWj98i+
zIK7SYiiPL3Ja}{0cKR0cCj08|zka@qv=L~3(WcPUKg0L=oWJ7dGH%!8&XB7}D*hS~
zQJL~@S@89{F4y-5eq17N6TfB0=En1{t7LN??mswR)7x)L@!l_zM#qnoGBa&G+niV@
zGp9wbVtb((kISBtU3rR&3}tnfiWpxCIOgQntZVRb-KymZQcIRi)QyYd*4mzK?7#M{
z$)dFO)<RdyFsTWLpK}+v9m&>QXt*NGTg~AK*Am~!JiDt?U#s5OuyE@CS6BAD>AD~)
z9vfq%eConB@zkJ%8!iU2Tm}NaRyBI3P1#ix66P&h@0Fq1oz%zJd++Io4@T3rt82ub
zUfWa6T5q4;Z2a+oSBuxtC5m%=U6>NjAK(0WyTr{WHFK|@oI6?L>GP64zIQc8l^1_=
zxWB}FU1DIHt(xRAC5HyTnGvgAhX$!t>hjnfZ?lv&in3aywn~2K>|ZS6^63k&i+9DI
zn`vfJz1&jwp>&PN-Qxl58<p&qNJ^VA)EZ<iSy8w0Rou;p%zeuh|LxKWm>RQwqmEYf
zM%8?#J=`j6!a-iyS?W&34`)e#(TLY|^Zv4Ha>&gmy%(M3{_beM;1GJ4|JH*knQO)S
zC!b_Lb9sx$JB~Wh=;O|RygwOsYL?_GN61clvuwqjm?z%^8xQ=Lvterx+rwka)?|mV
z&-47gc=0pkgS%MG6g8H|a4s>Falc?Iuw1@%_2=%#-Ipg{Jbn3keO+Oi#SzV*`z5Qh
zFYiB@)MeNfqGGi3Yli%#i$#adc^!ZHb*gZwu)ULIv1I+Ur+%}p+<kHU^8US5g%W$6
ziX*3dm{j@AU-15|j*N~qrcp<euNcf^;0x~l<>&dxSx`blR<mm1-Hk^!>u@h%c{5X`
z*Yu*~X;ZhmYR+%2`~Ux-xpn^Ed$AS9LEAf-n_ujxnOW;GQ)yE-3v2B3x?>XFli5Wt
zrN49g?{TXBM1ba`8wq_c`ZG^PMokt9`>%Y=&vNZjZy9fMM(;(jf-87rSpq{(GxFwN
z+%hjG`Qa3o36|O`HJ$cbT-SIo!_(N*V?y8xi;~3Ik$*nDUjMiEpa*xw@#Q&IyL1Z;
zRAo}93-1(ubY7#??6|p#VU6RHep~kSPPZGT*gZSM!JB%jaL24w4BsBx$q2e%=D2aw
z*SYEC_B1W?qXKLf>zN$eE9IWKzFWF`?*f;zGJlLU1^+kJ?X~Q$+K?u}!@gGJbW&-p
zaOVTIi<i?Gg1n~inV6)BoZB|TZ2OrTyP}RQkJdkS)Fx@4TeSl3nuHlV9y`T1$$k>*
zyRw6cjq9T%e<Y79^K<Qq4K1}ClPgVTtG`<(&S=_lzpX$hM|I`l9IsoNStgpyURraV
zjT|4Rn#}M|`0rykVXx_;DyARX1!ihxcm8`aqwCcS1_u+*=a0j64<6WX@Ayq)pL?gL
z*lg)|%E9nBQ%XS4Avoy&ItPVmUvxM29)02-^xSu)MZTuc8iR}er)wWx<lHO#`shFY
ze@4bDBz08hJ-!jzwY~G)HV?5dZ!<gbfGasHdXI|^J6^GQ`rP$n;#Qg7%`z{#H(c0~
zo4zB@V%GFGb<sz(uYOy~^3;F2@$Km!_y3LV`K20I&i{3$a7u3GVJjh#f-94alvnkr
zfA>C?pefYR?Y8Pg($=)q`?~jWu$VuLP}umx`;BDX_J=L{OI&1)9`YJaK2?1G(U-Ha
z*AzSy?_X4oDsQ|0;km=P`CD!pr=<wg{@cl5|KQ3z_ZwU5G(<KOg#65Z?z}x&aH6c}
z@nH6OTW1EUWY1ICzs)ydW8qCFi}dCLvXN6|7j^WSO)8%3FZpL~$QS+eJ=Glf6OI{(
zP7>c+|KVrA-Osv~L58grUT#)THb^S#)W|({FJ4?Da`+g}yj_YbW}lC}^=y7&%I0It
z^Cz0^cqm=ID`F$>Zdv=gWj1xQ)-RMUx2wBVwtvpn1AhyDKYM=je%5E};K#Wtjn?13
zIht8AKH-u)#1Ud^_xHB?X`dg3(|*jjksXtgae&kC;riZZ@wzS|pIgG2nquWcH6*tx
z?CP&>TlFyUcImA)59MDKjK7#f{NsB%A5N4zf6ly>F>ceGyYG_SWjbd*UE*fQvgvo7
zx4PQB{qHtk4$qID_wRxI^20IN_pfoQ*8Z>g_dR^$Pc}9FzbTOi*-{=od2{yX&QQza
zoJUV7t<d<$aK>Nwdd6i|jsE4j)7aH!?YA|JGhegh#bbvO&Z|3_Z*GgRVzjC_GO5jF
z6*s3@_V+9I%$;AKH;+mG$+Ea{gLc=sVs(?leSQaT7O88c{GGqxyw-oMd9&s(^!zu!
z@4T7+bms*Hn|jikj7?VFdiGqvDopckx`E=seEaNoYIo|m{FS~ujA-j$;U4_Gw_L|*
zex=Bj;*wSGR$2F7;i-Ie?m<@3q=IDI)&IE#{^?)H%*^QswG%w68f(DmEAiDbHtu$b
ztlP)@-oIx(PM<vFEWEMsxWt9&N!KG(dks=weVcrqIcC{&{d+-9R+}dqscBD@S`<C)
z1Do;(k;TW;cDiid<if4wv3Ta$J#WNLE%w{dB%b>w^{S@oRk7%JpBoc@?B40*E|WU_
z^8eFjTLkakI+iTFcFX?xKWD9w+qZw7kKJ4Wg#*f*rLSFi^f;tr{&I(>Y@2ny@Zav@
z`O~i*m^JgfgvE)Iyd0ZWo-R8!|73LP*9d*%nZAzsA;-U&&AlzPa>u*mf){s89RKtB
zu@)PKi)zLT7-|IF?n%D4;T!8pn|oJYh4wuDF*iW{*-PEYYcr;)&A8Vz*({;Q@y(X0
z=hAl_`eT#xZNYQV2_2Vy9kN<rSIFia&A-@K`4`JMnP<V8&w_a?gM0!7xr;yE+T;?Q
zQn@WccZ#0O;_x+M-ur&nTGjkIDp0jv`uXgO#}*tk*_!go%t)DCc#eM4%QZ)?Ow`oY
zn)5VH<Kkg~yFARxmx(mYo_26z`OeGl=FK{KKs0`i?0&g}FHL{_{PE=c_bV@)bGBW6
zc&t-(?rDjCN>y@mByPOSmQ8uND`x33i<Czyxqe$>0@-E$HI)8X-KDIkG;4{dn$UsS
z3lFQm66563S^cmyFy?&lE}y1NtB)Rh_x@GVOkci?%5OjOUQYj;p1xV$@4k=w{TII`
zpZs7IA6Rqj<EvluZ`RC{2{AwVmP44!XWi!an_pfGumACC_WFhHf6uY65ZU+W`O8V`
z#2%fixmNS9(D2l$zM>gN__lG+Ty-nrwb7IOs;jKAQ~XpO+?DE9d$hs+^>S{#yCUUt
zP0H4_9sQaU=(U$m<=fNK`}cJDoo^8p5{?XAJ^R_4%dJ{#y9x_8S~EGQUyM*a@<>|4
z{iBrR+Zx*~y$xPBd#>j#$-bA-mZ(@BvGqm5vfJmD6h&nQiyWF>#q`B_1M{Oo{f_;N
z`T?u|uj6_UxL4h`=C%&2%Vl>{msS6^wK3^@UM!XLe(rx`Z=pv<^6eotqL<9#9SwH`
zCzm{!b>wP@#rDaU-imyFw}NH)1uLC?<AwKjU1PhxXvQ{=c-`eQ7Ejrf5_BPH<_5dy
z0H0&$4ON(>7YAn@o8((_L~%x_l5v{Ggd(H$UH|v*&d<-2w*2<D-kvpSDc6-*i{ww*
zst2y~cb&E+Ztjg~>s9ajdIeq-;Pi@^$imz(tu*%EyYgR##<u(o6V{}BZwZ}!LS<R{
z1>?(?FZaj4KX%CV$;`fb`$)~y-zPsm|Nqjhd&UV1n@U45y)3`I=l3c{SiWAlf8lnG
zA1;3zBtCjASugm-xASw()a-2OAc+Hv+jt`?_TT+qu)*BU=H~tC@(KgHQ1(X;S9)?r
z*3AkqVsKF^IFk9P@cG&QKPB4yA}$|$w%H`_eMirct@T?Z#hq+F+-4V+h`(j^Uu^B+
zsN_1`U&nnk6yjsdM89UuyUSHGalM;qA<vGZXJp&@oHs7qu%S-;>vB&iA1Q;5x=;0;
zS5<q@Rm;v$kKrowk`J<e74Gzxb!yN1<P!!7hTj9aEpGns?s8O`eD&1#t>qdIgXAh3
zOa-G~nnxP%uRVHUUP0{Shl>pSZ980p`>bN`_^7Sqo8+K%)a2UFo0mTe>YbSzI`#AB
zcT9Vmm!6+0^QSB=d37?wqGpb!A4=&@&SbLJ@7w!2fB&~Vmva~oI!iLIi+p)MY}J-%
zSNRi4TxMGP0@ww8lmZ2`HXYo|clzvmD;2qYGsGqzyKdvRMzu#w_<4&{XJUx=j&mG;
zOje%S_3Wn0)7&enbKbnFVaVTK>wW%y<8vbxp>xF#mT<1Sog!H4e6s({lfVU!cV5n0
zQhvJeQrf%5|DC%|Fj;S(aohUX#J`i9Pnfw)u-q-(^={%U?k7r$Tie|4rmgv5tC=Gs
zp`?`lmQCnf<K5+!2HX!G&w1QDS;0AGk#&Ex!ez_sw*LpXG)f=u@L+ned~HhnT&1T?
z3zlRvWnW8GRJgML<n*49{*pNzvD-gRyu@MGd{cJutj(Uz<-$8AcKoSixO0q$Non~#
zj|s)69$$;lyBqnYi%;*7b(qMvQy+vTCK@fUk^aeN<!My0KEifdhRkB?>O105*Cm@z
zm#i0LI>S=b>Br()s_w%rbYlOCuFP|yRhk*6E(+{b-}Bq@>9<IOHkGi{8%HZXa+JlM
zOnUOyC$LV9O)BW==c2nVw@MUyGcNwSDPmFk<@w~t{O`Z>A7^)e|NoChQ}kwCIoCP9
ze^q!D_VseUKfF>%_;uC)!@s|`=ldVOCs1=N=YFf&<*NFcnp>Z1zbwvNqgMKU-sS!O
zW&avxzRtKgn>GH}(Fyy%W%_>R-@WJh9N+cfd;SRuPt25elZi}=@hNf<pUh!4|L(u}
z?HlXNrC5~nKi_<pc=uRG+)*!EHN{0<orbQ`UN$cd=1<_hwdIP`?garlj*}lI$Cicb
ztW4Rp_1oIn)7*V4OE2m(Xjsm>!ZC^apU(%zs3nyrVqT@hgomuEp83Rk>1k$V_Oc5L
zr-c2wd|;meKkwC+^oc(k5BWZOR?hFkdwTL_C6AzfSL@xj=Pv30X^P+L(!KOtdpozd
z?IuZs_2Grd<x?1Z7Cl^Zr*zT2BeUnqcD0u}y^lLC&iqQ!=EJozL5A7AGV>>DXr^~4
z9oo`V682l`*SD*)@|E+=f6M#%_22LL-hY43&FX3aH&5fmJeR9{Dy%CDs@h{eRP5}u
zR!v|FU+;6mSogA0#+_`>?tizF_q4YBH;&KzucNSkZGh>VuH`RI8NYh*b~k^;lMZv?
zy8)enFI;mL7PNfGw9IljUgDh^>)EY;ssG)s_qFLq{4F&Pcx`UZ*}HOE{f5nsFV|gO
z6%%;q!x}B|7`x5KTJ~$PKPlLu_<2FoBR$<mZ}%r%Iy?17P}tFxZ}OgrzMOhjDs|18
z^_`Eyw>L@YA1x_gdtBmf;|8f8XN=@m?0+90b5wHefscz9z6yT!?~D3PE~mD*jFZeW
z{QCAhWX~yi`uBH`_#5%4Evxp&_A%Y?;9)N^=8515)U7h}m=JI`wt?wY=Yic1_&!eC
zVAgLo^O?fVIa`&Ed(;>|XJDv3XFd1!IgSlo$Io-}A99WUq}0kc!!Bo2fZ(mZ^dQUi
z5}99P{T&6a7aK&%UFB7@sSmF7a{t3{+iS`r>ysyayCM%QJ2ri$kA`_z+$7!pMSoYU
zGXBB7Qz^eMdqZuC2Df#4yFtBzZ4yJhPH0-D(Sjq@Yuq{yss41bufO{({`%|-!Ye|J
zC+{?fPpF75{cSRbwNR5`qv+1UoEfjK9bI#RwRFLpk6EfmRXo2s2pXB|7`RHkw{m{_
zqIkp6Gs*{(>ohF(O-#Hi;FnQ*@PAZFaA5C@0>+&xibow5nMteu$xUoMHtmJv>+O>+
zKW<Jw_0^0&@~N-1N_)%63*uK*^H!vYN4s}4n_u$$@VGT9|N11=Yi?4(Nriiqf)-u7
z5kH;J;Y;O=`r~hm@2~v1+97*Q(ce|fvI~Ab`|;rLYv&aK?CC#VytsP%@%Q%M)#~l%
zQnxf8IN3hE%T1k;e`6@mwKZ#R^h@l$&A)x_$9SDfETWg0xvCmpEz#|ED}Q)hX8wXy
z|M-WTQm%K-DJCom<ZfwEy~5%$gQK5g8lV2v#`2x(G%QjV{P)cF%m_GM&v{N%XXSF=
zgF^ND-eo6<i1$=2X|xO6-o2Xt(4%YdrMH%J{OH;|ui^EdFyB*K%=Vq!JNfTo<#0i_
zmcAg_e&)YgUiy(*Hy5>h>o!@f?#j4uZD?rN*X}JlVphq{d35BAli0&=>G$2Ar2klP
zw7oI0D{;pWO&=bIr%KaRemLCNly`Y$Xop;dTgh%gHbMS*x&6<c`o2@{Zl9aUKj)6d
z+rI~wv*y)3W;uUpJHym1L0a3Q;)_eat$4b7_4y`!n`!F{E@-eR8oYV7Xw~K|J2fTc
zzjW8M8!s#WCu)9c`mgLWDl6?TPTO#9vF<J7OAnoc-2L~6<x4-8vn%N9yta25L(R5H
zC3BS6d`bgN0?w4y&7L5%RIjfkXN%q|?PY%E9$(!fUIo=D=qGfZ*pU=)@YkcJt1t7|
zt97F*wi;!&ZIg92-M^v#c^PkckXelJy_E2G<)8WNzQ<nrkQsR`Z2iw9_VVLLeV-g<
z`X2Y@OwhaSXC7X5WES6JYx{nILe2lZOE@=r$C=09z2q<{XF~Z&rP%a%zJ;?6<S{MC
za@(&m$Ms0%>e;XU*u7Fan$@%`|EkZTe+61<NBCy0-zl>u>AH1s%D1gM&4ecIJwE4#
z=Nh$=+uLhzC0E|Q_^@Y^N!gW}Gd9aAoq`R8WL|BTymTRHU&h?RC7Qdn6Cz(-day{V
z;c-Puj@<E+6;rQ9Ob>28yVNSlK()3jaPyb#Zu-}Ev_*WhVJniJYulJACY|?TRn@k=
ziz>RR#b0|rSzK|pGxFZA*3;edFDfb2K3N{a_V4V;|99Ct<J8~t#bw##e5mlh#`At=
z{W-N>q2H%Jv8}&Ts(GT}mPPQPm3tb0ugqFe_~F8fiiyr|!;d|f_iS<!tNA>CS2c}-
zrNT?~W3}p@PPm`u->>`e!NNx?`0lxU=BWCf$Pn>gMCU_qE%)1(;w)FL?r1pCnl?pX
zo8*-fVO+6s1;1qOuuQ)xlgY57Giu7sw*dh&ratA+I}~s+dh64JYnF-su=uxT-)%Wn
zcjIS1TMu;ZC}Nv*cy>p?q9u8sLXGs*um7>@QrO2VkUHnMA|v0a>y9bgHf2sZ#>u)i
zaVFQdD<u-l8!Xuaop<<iYOPUdO1He%vHWPxw8IZqzSrI1a)p60h)?0F>ArnZ3l$cq
zILF2)EQ+4Tlfbis$xf&He8uXU*IXM`&vCOk*lZD~BNUQ%y7Usmi~LTFY_od>vtI0q
z+!2t^wc<Trm5D?(3#06xwLc1%=Gqy|nEGf-((+yQQ+IV(x|WNoY`?p-CVNWF--H^?
zN3SBE+zeX5@aenko9Ste!6y1s91p3V(b4%6o$ks%?Puz<1yxLo)I;O)xfqUUcdJG{
zyZX&(kBY(V&((q(RH9~WpS$sn1M9O=-t(&ydAG7NurIrDXh-WF50TA_)|WK7nWyAi
zJ~naQ;U5?Bv~-_KC5J(o*AgDy0J(LxTcubecib0Z;>=^(eMQ9iZqwTnahq<hysGHo
zpdfS4LjS=emL4(f`Hlq~vQiGhSEJ8=J$+RD@+sRBOBrlVXdYblY3Y?0abGoVUd~DK
zR5-z~WkuB8)KJa2Yhw;w<)0tK(^{tYK=7YYXm%w}ZJ(`C+J9q)C5pvCm-tTDY{>C<
zQPfj<IN9&n)1$08@^dWJmQ=<19k*~bVC#`xv$W<{kEL+cnk12iC*~6tOq*QFYUF(O
zI<MljUD8>ME(;RdBzotcIuvq$#r2&+Q|g1I<&S(&4Li2uQ5R2;gKl^I8dHh9y=^z!
zz6LjSv)yMs(mjdCqWqS}qBN&dZC{I;R!`%}Gr4|bp4#qnmSR0s26_hm$+x|>2u<PX
z3bgZ*TWM%>EA2ti)~$>eg{GU73B_mr&R?*5*PME%GyY9a_A<z`ZrE~!x0ZQ#;NPWU
zxA}K0WGpYXn=TaYXRFpay<+xd{rqYDkD6*2T~nv*X?`??yHw@=qBC=)cKFTGt&lzH
zW4fto;!4#C`i!EX=T_cQNUh|}e7588>PJHTJ{#O8ElB)wF@=F+X13LXHomS^izZ!X
znC9p1vo^)HKyZ!SoV<1AwtBoQ3hbp$LK`w2gJ*F?h;eM^KH!(OUNw1Xm*H`j;uH7M
z6xXFK>3dt6@>2BC|4RnTpYp!qf5)lgKFdrdd&iUu-?9q6h-gJh@}HCC$uqvES!%iE
z#v#dLcbS5hvC2KG*l;X-`X$Q*h0Qkevwgxe8ki&)SY7p))ePTUSrzg*S%ER_+_cma
z;j*tRbRVj=aV|LGv~#Y^xsX$yGM167I*C(%G%X1Ff9;ZoaJ)eI;wcf2GbX71OPc29
zthuMAymZsVJ$ex`-drE9<Xk>4;3vQSSHcnnr}|TCRtU$goBvefU(7j2bD^hAFTE01
zbKme@r=wf2PgCM;NlB06-J5rI|Nl1cz=m%(bvn;SR!Da3jeF7bv`kEEMXU8Azb^@Q
zIwRQXIL|#;y|w7rUcF<^XZKngMmh0pVilQevCdCwM^ES6o{Pq>PW-BwZSj?}bkf?%
z@hkp%Chc4t*u3`pt_@4SCMurF=@n$08r>=^#6PD+*ZKTzz5JP7PegQ^RxVX@W^bKc
zzE1j8zwXal61HdTj@G?-ecF55`|u3yyUlKW@?8tucyH9N;%w+VFe}?><FY#0ZqsLO
z;VY(z+;57JKAUuq>*5ak=_@j|pGdUC700{sCJ8S)TKx5Bd)gb<xSh)sc3DZZ{EYN;
zN-i^sth>1>Mod^|VuJZpl}9dd&Z6^vy9RdcbMETjm?M8<YBXcGa+<;|^$PckC*Mp|
z{b#`<`q8{L<L<*o+aJ4_cZHm^ijjTGeLA<aeb%YmsVz!R+ka{c-!9yJs(iA3m(-CA
zkIWCk%TgQUTo}A>Y)&gzSaWQj$bYez>2s8NtK8&2%JALY$YW~Gyy+rS+Kx7>(_NO2
zI{CXBU*0Zh>;F?3xAwU3*QlQf6KmI9owxW-&xaJvX_Gh3yJK<Yp}|b0g3AHdzdo&B
zc{Kd~s?`UQ#2;?_&{Jys(9eB&_R{KkOWnI!HLnyf?O%OrS;#J{c}D~;-v9V|=a#B>
z4|%u5t^br|7C-&9mFN5wXV086(%AlLm#e7SN26xV#!X)7{ku*$+CHgx>KCZ6Gh28|
zn9IIw)hE2AeWkU@=8M;^J+yJA#m?J)7f)<Ik++gd-OP7Gn66~s*MGtBPaA@3PCt#1
z+9K@D&A;$VfC_8G)QZKc+ms7dHh4<q8EYKA@;)K`5C@mV!^dKlrZO#k#-dvaSzdj!
z@wmG5^-0&TmH+?E7m-`^@pS3o(6|?CWOJNr*l(YGv8p9`^6DdUb1yvTQ=C{;_Gi)j
z*~>a^xh_|aiJWyOa>8Gu6`D4p^CzgD&8gFyb#>9M6qoX8PL8Kp?!5jb@3o`5Qdml!
zap#s2YqN`Y)R-(v#8}g_wN1k~%`R--ZmF_+re)HU@`TCkg0sE+mVUo@Vro{;ZmzY$
z-J!+VmWMl@g*2_tTCk6I#p#)vN15CV9XY)2HN3d8&@-oAZ?)#qvzs!{&bVCaux&&C
z-QeB!2R|lm;XT|`A2jP+YtZ}Iw*yN~y^V`pcl=6P&g~N?`|K5~@6Yyodvw|Fx`kma
zmvoBxIy@3*T{_Zhao4EAHRkEEm?8nOzPj|jrO_hRH?LW3d-3UP%9F0Uv;O8v?2f<Z
zV4J-3rq<7Gow~N`tQy;{KfnCEO60Dm^wz$(+u!$nS`piO<82IkhwK4%xlDeG_oj0s
zU*$aL{iJR?b?X<+OEWdR*%NN<Z~p!A>`r|JUhgYgL?>_DU4P3}azCdV|EyB(<E3Hh
z%P!?^3)|n+$#SMK<X0!x1=ed3u|k<j=j&?ESfwlHTdYuw^x>**>wLaALH-`AXPd24
z^mm;*U+(oaC7t;vpPc-2M$CPUtg3dlb&NCWmRz_bHTm$HE!W;SzW(BM(W}%wGJa}y
zgm%=tT`o@-ud7j*{cft%vpIYACh7NF(F@PsEcaO3>QUIOY0POmYulAS&nw^Ky-8K<
zaa%BxQSYoZk98RH7q8r<8vnt4t7nlDKeLn7f&(f>SC?*WH%|PpM`LAV?W8F_tYym#
zWIKdI&*+F$ehXbWOY~#Y^t9Glb3O|^OEO%1<tlHiDc^jT^Co`5&+aYWT-+ka|AcE!
zk>@q<6ZUg7^+IpH)wmfQbl1YeK7Em#-~p%Aoopgr^Zhb2cPJM;{?Xug&bis?v)U=K
z-8Ul|pZ`ht6mmLKQSpTR>(C_@msq}RVQg8q=8XN7VCKvf@0Wfvm^F)gMV3`p#>rp8
zmf8yspL>2J;!%vY#eK<1nLWGYkDlqsHrTh#KDUxHY3Hs-?_M0>S33B!@Rh|s8y`DA
zjk9Iq2h#ZJEbRQw+xHc;KI7f_optZhD(zxtvzO*Fj12<SGD2CQwjH?+?rQgJ9z}7y
zWaIdvUi|pTI^p|PH5)4OHXS$@Ry1LTGsl*QPbn9Irn662nEGg^f^E{QZS$@C-uGO7
z+f%k`|JvjVw)>Tnll8Y~Fr3{hA+tqQg7a-6*ZykuHP!1yquN*JZC}T*e4;{I(_UA`
ziJ#(X*7n;ux|T@W^DkCE<1g{mIQUQ``=1Yi2^G!yYQ?)ASjY4@^B23`wrgJ&le|eo
zZ~dC;Fn0ZY9$Qk4ZU$HRHBUWSW4iZ3hT*L{5l??=R8H2-KUnL3^xDb>^$2^fuG5+;
znRdP3eoTYs7pq0Ob?DqRo4A;CpDn0c`(WPUtu0#7*IKzPzb1H1>Am@8wXJQ$bvKr8
z*KgM~L^S`@m8}xcaDP@E!`V}}PBe1cxf4tM^y(eY?Vh_!>2#KwxRnv>H2ZmbDx&gs
z6|jBVY`2fS>{r&Qi`JLIKFvG5()o%Un|12cOJ~JzX0-;o@953#QM|Es73ZvzlO64L
z$*77YPs|g$EipIw(!Qrp*?6`J^c}KI-lMS5iuo*)i%`;%mvU}@9_-`f5%RravqsxO
z=fat&bp|#ptG<eSwVFNO<aK7?q9u(QJvEWcmp}j9axA+&i+y67N5Qsv%J-PqzFe7H
z!>Pu3t*Umz##RQUwoVCcMpmavp2K%bLXTuC8q7RZdw%Qh@E8tLO)anTlQ$EdrFXoJ
z3p~cA!!WOggYBRLC%X}+UB;IyDvaDW(<a@F{#{xpEhf9cF8u#bW6uvZ`%L#Az42`2
zv|rmk<o$Q&?dEWdUh(xJTeEc9<F|S|Wl>FCeET;hy$W1*MU!XU{y9FAtgot9eEah9
z{r|^1-!osn%)Hw+_Rf-9JMzD6?C-s)b)Lcd?9C7RR-b!(**Q|pR&4Ld*<6#N*JXe9
zS*z{)xF=&`M|SAj-<%OQRu*l!RTbJMe(0qXkNC_<728dh{jc!K?J52rwQjFL{jAb=
zk$h{tbv{^~{`)GA&okWCfn!3V%RYaVw!}(zY0Dp}W>UAO?8-NCJej$St*8CigzZwx
zLiW69|I$!yle0lvx!&T8YVWb;CC{JFIe%xfg6Jo8H~FU-`BAS`C30>~5mOeIeJgAA
zfJ6S1`JyfP=NXb#C(eCif3yBi#SEGFKYRYO{A2%j(9?d2jC{uH_$hrej7<H0>YwnO
z_<xIJ^^&<9>wD+Aeqafk)bc01r77gqp9zd>HaGh<W*IRZ;WAL?xpZ;r`}Zp5f8*9(
z$(b?1x#OJtnM>2<<K9Y%GtRcv2%T}pChF|=y6Tnwe}xyd%RQ+0{ahxOziQ3b5c4BP
z?*C-@lV<tvf%^UZkFM-~-TA#BX4iGk^gp#9%2ZdroFU@KI```Rch9yT=knmP2~^s^
z_hjbx3Ho#8nld*n)I7}6cdOW`zwAh5`h*+KU#jzdefza_UP!I<+haLpXLtQoTKi5`
z=xFSYzzQob^|UNoMQ&Dgxzz14F^PAjuN55<lsMYc^IGP_{eU!OyRFTQ-__14*f?w#
z_-Xe1!gn5i2FXf43%-)%V^SsCMcAFT^(||7)1Y-m<i5lVHu-nGGYy@No6ZeLoA>DE
zsWPJ<`YiIBdnX+~xjB~e%=@=}|I+2t-EP)~-oB}r&a;#wbmE1r?fh-stRY1<i#mJT
zQy<A~xR?3sL*P^f#S=Fg+_o7uh{}C8Invl!_~p%t86q8mldM#yY?$PwJmch#-Lq|e
zCa(HtooV0vPP|z2ShE(R|LQ3MvClVHAAiNpc3fDkpu%cHc==ipZ`T(cb8HXpXXSNp
z{h}S@VZAddK0(p_vd^v6TkTh^S#`&~Amn?LXJ04puHz?s>b7oP{#<TK_p8d5N}J1$
z8}AyGeDzsTXZ3Nxv(vn){XAh&vOW&o?2DOadCET0h-Tb<M^N6Yu`#CVlkUcK@g^%<
zIA^6Rp6C}ktMRgI!G|jvmOJ&rw#lqm=K6iw{EheYel|%wKcF18PWnsy1|6r>yQP-L
zFVPB`#g(5GGL!3njnh}H`8L1rzW@I~zHUX&wo~zQ?sv~pwQ>^V2>j=A`p1Ia8LB(~
z%YNb5{d#A+fOKTfM?DF?BQuzT3)!;cXEm*jn0WR0mS*S4Ni(>2<kj>UI(_&x@2g#H
zSI;;9jVHR8rGD+uk8-Jg%ko3x)c4lbyA?CV<u|{TFk|Vr+S={Q#<>4s8MhSAOJ$Rw
zkcYPt<E^@{w?;C)t<ZXq^13&+Qao)2zw!UN-e#+v6ZjkT>+P!?xtjlfOu9MKR&H7L
zZ1H1{IGZ-FT(5uZ;-|HWt7WZE##}nkyoyiywwunH`k<(Why5EQB}Mywm+-XcZLn-p
zkC^$wbwT$O=7x?rZnwCc7wO9!WzCe@D|e7x>#5KCDpM!XqbK4{*tGs^UEL~`yr;kV
zfq(mg>9Zt%T#|FIN!!@<@Zkw*NiBX^U%jN48S@2<+YUvpk6N3TFX7lLyL-b%X_IO3
ziMq!lKlPWcR1=uA%Tz|`ue?I$%}Wmh+--`glK$xRi`LvevF6N^CFupT56?Dv!od1g
zabq2yv^DR??G3ujE95r37315`oNcL;$hSf(j!EwJe)GCOoA11QGcSg-ES!`q^Sw1l
z?^R`3{L{h<mbM4x8*cLUEwa;?H229(gPRBcN42T7WyC*z^Sn4lrv87m_fO@YiG8-q
zo?FYmXFGOTUVO!s{}yi?BetshmR<Z+(SPxxENA?W?XvH+HU5?<FI-#Ka;q&xo^xtk
zS?on+X%^=_YchB2{c^H)InUM)H-xT=m%cQ2Wj^Dl@N;I$kt6AS+kRx;nDq15G37#|
zna$TUpG()Dt8j0LRGH@~zS3HGQ|7Pz<?jp1`W5*O&9u}wDQ^7jy;k3zH^)rN{7Y@M
zW74|Xif%RYyz(@?y5usuagyCCc{a1zKi}N^In(6iM5|-E^~|X{dvujw&f3p>B`EFW
z0Xy9_KTV^eB8tzyHZHce_c!>v#$T9Yz2*C73^Kb~I>XP*Jrn$#eNF76c-zCdZj(>C
z@643RPYf0R9=X}#aq|mdoyRik_87lgSN3vJ`{I`-U%&N)6vhfL@442u_|>}T1kTd1
zkDvGNy!7gW>#L7#>(5zqtlaVQmVsizBE=sL%Z@5cG5z~qPwCm3?2a`@HQd~$dP;R{
z-JNja%-5ig>l`M?7&L6@m@XMxxu{MwCgumjVub}Z9)F*<FEHt9ejK&e%vq)8cyn5V
zAJb*#=Q(j9ms2LhrX4M+p7Mt!@&LnXW(FC~x@dC=t@Z`B&YLFRl-b}j>*WsqGUscz
zrX2exDQtYIB4<XynTk}N`yqipv>BF6W%%6Ev&LXb=*#QoPlDY)ESvP(X|=+EUjch{
zo*0X&xA-*tF?P+FboRo64T}Hv&N5nM8gHID^NLqY(2I?~jx!}}|0H?Bq4(d8rDto8
zFvv!97rFKxpO<Zw*(P~xgSS_W(+ZQmDL0Kp*EEVhS4oidujq1>_POTKnkA!h-1H~Q
znYr`3c<Q+BFdX}u`p(FN>5Ay<B_d3BlCI`Dro1n)J@_Ngp=7p6n+2<~l29b$&dHl=
zo_L)7VD+49<%y+wQWO8p4qLs!wesWsLb=x>(h7Rd6tteDY%xA&aK551;fVwvgQm8`
zYMWUxD`OX&jpXoguD||E_2uc=t1nf2Xx*#W=F6PgcX85rt0eBz0^*(@dYKL44qQ+7
z*R{T4U%GPBiq#FbIMqXH_ZMZ~@xPO<zfAp6_O9SV^I|j}tYy)2(OR98XtVQZWA*m`
zi?e&uFMc`nai#RV-Qo8VB<ArZobchd)%q1v+Q2DswOm=Raf9;a>G8|&y#8FXd->J#
zoSO@di?&2=7yZ|>uInE&8=tMU_-FP_LDf^4HptY6GD*#FlvK7}w0qI?<iCdx2wa<L
z*}h@L<H!%Y0)KzXIs19P^Q^yf@2vc@tS?$(%4(@sTZC`*8E?PkoHL=s$9am)6O(0K
zbuK^eOx#$*d?>w9`c29`zQ>RD{HVUNcH&m&<?3g@Mx4BGvQ{Pf{)VmZY<OLRn_u)_
zdb@dUddi%gUMm+>ns9RE>F$fLOxc=Pm%Zne0NYaKADgUh*8h=k?Ek*;8c#;`Y5%9D
zsUoZHZ&>$PAn88Oh6lcEoIFR*yyh~M@oKv^?VDA436suro0$rd4!>32xSbMCc<^A6
z<W{ft%_Yx`m)Y9X?QwRVE_&&GIZMgRB~842N!GjOB{sg;TJzucLh{9VbD1Z{Zw#FJ
z$dFg3#YJh}I_+cJVyCWXl$G576U6=Jx^-%!A#;l1^d%K1Dp~Gvf1O&Gu)okr@!pZS
z&i3nUE*#irSa-84!9V{}>jsCeIXCC1@(0gf6uY-WGDGa^<<;`lVXBYV&OM!2Drdmt
zS|6-rR@51PWqJhnyI6*7zU`0o1MmOLU$tJu<&0vD&>oww4x8SnZ=F~hnH$2$mfz}~
zcF{o3OiT023k?(1?Jl!digRw!=XY10R?9M3aLSR=Zw-7(lGnF;{r_`DPc6V#`Pm1@
z9QPHhA(O8fpJ3+C6EA!y@}-$Cu-yHAIQN&YPwrg|{m{6g_-nVrcD+)s88=S<6*DcH
z)AZoRob}F*ru=_j%{7*oY4g9P(=Tp|xM98DPuoY%+*;4{{~z0T?1zEAPV1VWwguVO
zS8ON?%t_rNz2$9JrE=Rh{jIBhg|$DJ`RL$Io$XTHwPx$DtQT9gGVIllJB3;1t{z)j
z+%2A%E9kk+E0uX;tCckC<$}%eXJ%#3zCQ6o_}8~i2@8*Tr{<|vf1dqjo7#128D(Xr
zU8{ETu`P2faQe!$;e_Or4xY)kB>St(FCCn<yX<d3yHeS{Xx7(X_#~pv*=>HNd1Yb6
zmzQNaZ}}oF9pjXn@;*;6-o0^_=uxqj^n9kIxLNadH~kK<I(M>Py}o)f-_r!!8LrKe
z{9y?$jTf(LnFO2jwfqrkl1#B>FRl6$qO<&|?_3^%pjbhhiodsHw?-Ux&%d|Vu4-o6
z)LFR?Dk6I&zuQaMiK>K%e60wYT6#9yUg&{R?Zx-~{t1VdT3g@9U|%(N-wtb*_5G8D
z?lzp$Q$Ch^C%$%1Oy9!`Od1}aZeP^xi(IzXJMt*+gjl}Y&cUk`H2kuPe;A6g2>%qU
z;SW1=(${cvtG%E@f>mho6#cHW<Jas9O1&%P#a}!tH9k7&^+urxlPQZO!&MpQmu}Oz
zVz|apVbj%BT2p5<dh=i0a-sEK;h~;#&(d_Q*@;e}6*te!o?>xguB2^KYRm*h=07|u
zgU)xKRz0vYCE!x}Nmj>ak<5}&F{v)^gIC=<+`206?fb*5Ee^s$PQDy`=Y9yi{=4c<
zpKF`A$;<rigwwl|BSdR|haPvmxQ|QcsQ*^JS0S@o=fpTNnpbdtw_NfveSO&ng-cZe
zvJU+68${N{?*7QKx_OV<w)T#@(zo^=H2hlYe5*X9-(`Q_)4dk8yt6XoQ+}R}-731f
znSX^=@%D(IgM0_e-GA4noLn_yi;kR^>Wjk;H{!mrFtYCNc`tX$>DJFoyE_ZrS+Z8$
zy0rf4-`AfFZXUF|n%M8Z;(fpWr2XI0VmwQ|A52}ey)OR8jK{1WrgWWuHa{kG;y=e@
z%XS$0*fX85Fb#YEFn?KOY4D0#$N202&SWldw9#R368*F3#Z@=4*D{mu8NIz<@cF;D
z<k!<D{_%e5J-znG6Y1Y~j!$r3Ulkg4TYYg+dO*^ppQ@`KKg@ENJMFqbWmU!hN~ML)
zL0jeD9)4k9o}RZaUSIKLmyye5{?o5hD-VCpRanhnr^&m{y=sQ-mct*tGLM<95O{F*
z|I}ZLf{GpNuDs?B+G;p!iSx;q%MbtLOqHKw)W|FT$>*Y%mF~*CD(&{RXJ*|8K6NkJ
z7b6}V*x&tYgZg=g>vOCvEB@9<v+vow<KbLSg=AOP>w0HQO5JyNq)sl64chnl`zNM%
zUU%*@@T>hvE2>_(?@o)XX4qC^!#<1Rx|chDxiqxzn40lXI%a~xwJC*dl55@cOyyLg
z9hKeUzc?gKJYKqVuGECrk+(&dU7xi*(737;%znR5Sz+>X|M`E{KRKMm_4@Tr_v(NZ
zbB$Veu)A2aJ^j(q_C;giF4kW~y+2x7<P48nZ8(_nGQrYL>0<X%wxjHqPsprz`M>Vl
z@r#$2FMhuN_v6j>NBmUVlLHdZa58P&zf1RK$dS%F8d;7#$}xONPh^5B&(u`;_|I#%
z+&PC$E8+N|jClon7@U_x_3rrhOu|?C%JBo-+isXd2s<%sjJ@jgmaBo0HS24_x(IPi
z=X-8m%aa24DP7wX`%24ZLxaMfQfc3n>yAA8UBi8qFY>&Ry0V1DO3n-XQG6TikKQ$y
zn;4uFQx|EFmDt>38Foa2$wWqdTViqHbkhVUY0-v_G8b+>%`N-NGdsW7f=BRj8OH+t
z2JxumB^pnjb}__soRH>xF|X4s;BB`0q{obNg0@Xj+$XJbUDVMlp#R~moGUw-USFQT
zp1;{j;z9Pj*gTsEMK^=}K|9Ws@H%Bk`d{v_inU^MTzJ)hC8l36R_>PV3lEc;B?r{H
zmb4sbzb;+&Y3_Ct6Q4Efe8gACyt_3mLr2Q%+QtBR-{L77MYOx57>;hARbVC<tQC->
z(NoscAE$6*bu;h3qO%iJ0<xa%T(@1T`-sZ@Zl!GjvR$iEHjD3F8vJFU)6bG6y&tbe
ztS-@IWxA4gP4eawja`B1j^?v2e|}#7<L~=92L+>aVh)OD&A#Sjx^abG!CIBjN$<FR
zsEVFQXpA{EY0Inq|Jkm8vdI^yn|zGlYvP0L9FJPhWf)!amTf)5d@3d;YNPMfDEnm@
z4<_#soMqniW7_?mIS<=YG_LJssQSb7_4B5fh0oY`Sva`rzBc{Cm|AWaK6l2cY*FLr
zg~v+5xMegttQr#{YF7xmD7?J?>d^K$vH7|Rlc)c<8L;!+B2HcFU+TS^*W??0Xg;#t
zv;5Kah<k4hcjbM)zVVw(B$t1_`v0jm{ij7*J{{a1KgagIE&ses|I68{ZhzZjrnb8!
zVCEvuR@q7aY)*#vUV47&YT#kL_hnt(m6euF0>&RaY^qWn4Lvr!_{q9(!{=L05gA8n
zb|)lc^xyh?>9J(H&YajgYCkrsPMviBzApc=aN~JPC%$0Wc=bT1A;<hhvnve#fBt>m
zJ|v{>$4m89`_H^#w%+wD{`VON`5m9F97IK)x&0NKDOFx8@LI6I@R9E0!j9!R*%uUF
zv};&&O<lppw%l-@-j4^3^Ze&J-`Ojkqq_V!`|%f*Dr+ZSaVlumkSk<jFS;PNH0#ug
zCZ3%tp7TwoZV=Wmm{?H99JBtV9IvZG#Vnua2X7^Y#%R}^<PKM!mfWoovc9`J*kH??
zIq&Amy-ik2H_Y6lb?ydl<m&xfXUl)TCofl0`dDTr?}C25Bjpc1EYnxsoBX%qz)z8r
z4-{I>9G}Ixggnu`F!zDUnbrOka~=vc7i{JFROAq@vF_lVL(?kt#Mnw-OnrA^>g~0;
zPt~5E`jqgrDXUg^tCG^(Nt31eB36EDbe^5X*y6<hJLPRd&LmlJ(f?hScGdo_ox|O?
zokRJPq~+Ju603GkSUjEc^o<=6y(c+z{c>&#>aiX0mP^g(DOsGHTHj{<{l)n$cQ44#
zmtszy<{0}+VE@styRNT@tz4+acy<$q`$YCxky7u<n<uU+`>OCP-+6Za1UCWEE&Z{Q
zvfU?IO-?@DntqDa#&(Bs*S*6vU-cgE&OG+z?~y70DgzE3WO-<5?Nbn9)zP+BIq}?+
zhI8$nyZ%3X^5w_bivK^(&fdG7ePzY>_kX5OU|eAm_b+N%beu!j+MldCl^rtbCQ=no
zHrBXZc+{h0c<e>P3h^52HpT;U^*-$ulgsPjsWe=F>+2M&SoP4x>`2?rk4I%%C)Z4T
z{99`;SM8y5cO*MRCx5@5EHcgE?26NJxuOi!PuiDCeVe&PaL%i*oc&9lJ2&ofsd$#P
z`{1_i_dB-g3(ShMDDcgF;Oi){OMy>V{a@>+z(1RtJ63iEt^1qt?f0&u9jOvhd@qca
zY+sV(`@?JdZHHC7Vh7o?R@THlSzNdHHHTM0a=7M?bNx-b&2^;qbK2zHYq{s$IrHP|
z#oOyGYw{NyZ`oFLJ!tuqJAc=&DBtBOJKIRNYxCu~o|dk~+@kGIZnGb3w7#mC`5;wE
zS8r3>B|`;vC$Fs+mX!pbxzJ{HIwr3qBZ<9J_`_Njy{UEvFT&zmTq?bfha{eIGn~HY
zs#c}$uAl2JMSW(Tq1+zxZN(23wcxF%UDnw|bZzAE(L3FH^d{p%$!jwsHmmu3`WPO!
z`s=<;i;n(mfAFo=x!S2w==8?5zlHWK*E-Gh@vqeP?oT__Kl&a!o}174PRHBI_JZD&
z=UMCjpR8I_$?5OP_$5Q{?IxMel210@uK2pQZljE2ulV*SCvQK#etdo3|0V10JvsH}
z_WtMDO}5>N4<24?)tks2k?!?ockJ=7IcGlm|J<{7!P?u4bFOba#TLT#ME~bog{irh
z-X<8$labl?=R?<GgU>0Zdp$}txLqGiV3aLb`ZVp$8==dygZKYPEfKpJ`DlrAbzE_K
zN2N)odQ+lBtcw7Dz~z@`78h(4KQYsk_q=k`)FZ1_hTPbY?eL;O;<AxX2~TV9#9}Xn
z{mj-q;!E;`XIowCs<-}_wAA_=`*DGr&8b1_xOxt0J+GX5*7uO?&SP#TrS)Do9_?p5
z6E}}fV%AfMT?+O)4=9@&?i4H7m%!fHmw0Gh`qNo8yk|orcWXtKpGZ32d?40BDeG{&
z3IC<d`)yWi(#h4{QC4u)<-X`Wxml@uU(|3H-)4{dQdN8KJkMmkr<=|v=s$nj`mJzV
zZ|MA2es_K48ka|Yt94(0`+=zSz2{rM>mBo4;kV}QldlK)*ME<jo3QY@G{?zBM(doW
zemaqvdr4zCL*3%ZZZ1px4<GvW=l6p<a~#gjUURZ!Y4}6`X+?2+-Wb%)E=>4wf10_O
zZkpBIHOH!6?Ojs3=-!$|2lmQlC2GYT_}=MTyrTC#gI|RnW0ZC1p?LWf(x*><uYUjE
ztZsYxFXb*%-Bgw6NzBKr_iC=rp19^Q2b=omh#T=uXHOJK)U6hD;OyP8OiFmwq8`3e
z&5;RH%lpsV;@rjjJMZArIqN>1+`5*-(|ii+jr#m4ZvtfXe5Qu<tITNIs<ubs;#1fD
zmLo}}ja{4%G?k33=IM#s9cw;!q-mLi7H`dIErC^X9K2Cmnw-zKub6m;C-g|)o_Ttr
zRi72CIi$Usxt`BqlB}HbMKq#nqX}aX*CemI;!kUxvsNt?veK)1d1Q9TgSrs24^Q}<
zH%?5NCS88GD?N?t-<_3n`92(<mZa$MGkxc~aKnwy`-P<D96YX&SF=*=<BF0F?ZnO9
zbq<bNQHy5g%OrRUl*hSGv-qZzo%l)hWcG6n<|j<w7<Oh#actU<w<RT+uVTxCLu+13
zbEoY1GfnR&kFNW-x>Y*+8pT4z4($-PToHYt{O$~eA6u%e4$pmUtDVQ>cVY60@++4M
z+8G=?wf0q+gdV?R+|K2HTDC5=h0BCX;}H|r*|d}YC&k)MIP|@F(!b1Yd8b^<B7H8k
zaCz<1IhfD!cc0bS?9z2_88iBMS4b^6D=K2P@^Y^Ik?PXgoyMBeH$O6R6mj0d{_wC!
z%3KlN4PuV}?cN2q&hLMFHMI5817By^jtHp(3pJYJW+&Bo1>DTZSo!0IEQ9Oz7os=a
zwiMjg?O9hkMgELee;Bvr5s$FNsUeoL<Q*?MbXi~i%C+sJ*WK_>UUR3)m&d7Ff9_w<
z+_K?*`RY@j=AS=wN+E7zv*GvE$BgGauJI_}>R`F8r~Sh13&FNuEgrwym~p48`|7UB
zy>82rZsm)~{d)SoeyLij_oKrR)_fhmUZ}mVFYbFX@kjZ~Ya5d}8$N#DprgKe>aW9w
ziTy4?hDQbUo_|tXYw|71bid}b7nbgGj9gv+?>6=93bb{6agytOSG~B@{R5T(vXi&o
z-B)^2P|N$9&gsurcOHKnE33~W{)>&@{lW>A@{c>amBWf0F8sW=hwoeI;`K?7-mE`k
z$@cEq?EgRZ$|ldA7$L8EYoXXZmM0H8u35%LFfKO9OVDBCTIZk<arUL+-D;aAr6bJJ
zmqq#of~V(mb^Khmd!|B`c1(9syRwUK`QBu){o8g1Kbu|dR<ZVK?X*188-n*dMV?>O
zIb5mO{bm+pl`QK)mbDcuk+qezRcnr|b&fJ9(o~j-n*6ix^1bJ87Jk2((Qdwkp+0*4
zv%X16bp=K;W^QTUJ5Kh!$=Pd}ld@rw!JIjV4sS4G+rRDjnmp}5#kuZRo_-KkNw}Hr
z{C#1<@~=<b>hoUO=`po>hsS=ssy8cb>Q;dW-|w4_OupY{zHoK^%=%N>h1b$gM{n8D
zziZh`AEiC7lMg-%%De13%f_?p9?O;Uwi#vjl6~rpSX*D5$a~-PZt>iIhbpy|8DykC
zb3c!t=)m3^xc>XW$J;dXcqcLFf7~Iu$zACo*WG|#>$upk_X{Qnwfi}|XY8pn(3Y`!
znB?I7c6a~l*y)SzGk9K}ILo@^;a%rFjmsAEtUkxr$dbX;sNN#?{9uL0hD<3nG1fHJ
zwi~;eV-<IH_pfX1oK%}+<~xJgtFLmQADjKrX{UNBS=m2aRAl;Wa&zhO$5~c#zdyc?
zXta5i=)u3^O`BKi+P7v=xs&)#UF3Ktr1asy1Cs))Z_^lDAI{vcdqU6T_={I(M%|F8
zWU0Ax=ke`LmX~H+`zhl5N9jh7fOcQpx`WF1(m0oAHtjNKeUNh?+a&X_2}}0t2dhGU
zmVD8$>Uunx{nbnpf$S|y8v_;vHAb#Ks(!S~d#Tbd<<9222a60oiL)|#CCa90&X9h`
z5YFZQta96x-wRF^&n}2Ezgig~cI3E1eC*WI(Xowcu36TT+0J#Fi2a+s@At<aZ|}SK
zNW0v6>%2Pn#h&9%#~r)AJ-+vQ>AV%+mtTldaA|feTAX?9M8ok6i}>RgOzz3M)XZOM
zZ5^fRJvWZQlh3_c?)|A=PM?X|8|KK=o)uvTXHR#}Sny@WzmzVI1=bqbMu++yH%M%|
z5O{x?WRvUEEK}Z$Gg%Ji;+n^9PD`xZ6>7M1-t)yTt2Q>xu6dc4BX;H8s}82T>GO{?
z9Xa~EYPY_+_o}s5l0^?~{(Eh~LaDjs#pe#yT#kD^>wTsj`@O&pnHs~U{|67wDKCF{
z_J89q$;D?MM6QazX!o#fo)6zlpUwZy%u1`Bc{Jqz%rimFmhazfnj3jJ$9VIMdF;2B
zxs)zlUv=!LlAyVm-7Pi^j_Ze?OkT+)SvpB;QWpE_)oELnt-Ew}onv@%e6)y!Q|X%2
z>RrVRKPr7qcer`Dwp^C3k*YoQ?Dd^sx1Z5kRc?aoFHG2f@7mO@b0TI33oCer{fkmk
z&a7T_HumgnX%62t*St$~66Wm7KDMyS(2Gmp50@LmrMbx}R=X7&TiU|21txr3dXwkQ
zC-I$D&fP+X&95HqWwyvO5^P#7>TGkH{lK0ZmKIkdZwp#(F1+qjEnmR6>cvSrvm=}3
zoqSfr9Mzf~lRo|2s@%INd;OJUo>pof4UN1c7^*i_Z+?E4Nx#PB$vtPz<<_J;Z;{cS
z`d84`Tx^Z^!$_^lxwCrJ^w!ON>#FlVt#9XzJNq^mIrsTC?tSf2CnC8pZbwINh2qvH
zHWIGyPp-S#z5Y^h?^;RGjK;_XwXNLC?x)ZF?%n+3nWzQhZRIOwNup&dS0C*XVY!f@
z`AmQI;;_>Srzd_r<z=}1@)D0)_9xmk$?;BVI&*$L<=q+lJxt|=9h=S1x%$seuGc%a
zOm&^=zN%Z5HMj4_MSWGxx$m)X-nQ0ReRs_7Ec<gsV9~$ZRg%B==G^)?DR%#Zw&RJf
z1MgR#Z;!T0;=H>>mesxP?e2*S%-+>0oj7(^`-pGMMkR%%*Z%FWp4T#+wclB!Z<d_?
zvh8c%I~A_~dUcoPvwzZ;wkw}8kldicm{iAAf4_Y3Hrx5Z?^(G@->jW=#!1jw(nDxk
zQti#8+uv)W7yPzQ?Ps<QN^*V9Xa9fx{!q<Z&d<bd7|$!<44As_)N^f@R<?G{D^152
zO-<M#)w-H9ZExOf`M9Q;SAXmZ+c=G3uC}aM>TTg22QJT1H?zH4U3zI({)?NPb<_Uc
z_)uW08E$FkTmSRs%I{l**G`w|oc1j~YthB^*()uxU0xbUWhid)NaML-y`*98q4lkt
z^Buj`XNW{6JwN(3B0YEGWY5@CXZOPjuFgmNCST`Ou?YWZFXK}4)$~nUoQdA2r%$pb
zhF-7bP)s`Vt<p!7ML2@v!Scr!KThjyy`;CJN5{48!R}vz;q`xC$CpnQW^=oA?)}YO
zk-;IcYwy0ECf0Pl$gE}8_Qewg+1|T0Y@TrJfYXC|mU(CQbbrintGs*6X1zeymj%~S
z7G-d*yp{YR@Q}mfB=M&`m&|SkoGSB`+4Zll*+of2TJ|8vMzs^mJ}ABjZN44kcJ9p4
z-E2!Xro4Z#{)d`Q`18+!4lAc0pI|iCE%IY!%yg->W^y-0R$oq7=yf-U%hmQAL-s=M
zEA28%<HEK|uU#E{YTD(E73)r?pS>tlvWI`eidn+R2lGAFo%rx@!iI?2n&4Y8#~5We
z6f^l<KJn=lPm0m>N)7(r{D4K}Xql(xuiFWW|GEkGUs*Y4hg;ww=M{#2U3}hw-PuZ|
zPJVp?Cq!*y@;W#<RUP=RowS{B_ux-W*Q39;Ut7ANQ|hSr^&ZBEEAw_gTKwVOnmqeW
zzngfv=4mH)8+q|Ocq5W?bjwBA_!+Y8=X8Yki8=Znx6rO^ZhNLs;IsShfz8J&PMT_m
zcWv3ySHy8=!Zj(*G^sdU>vo$`)jYLZ${}ZZ_6Qv@NUSSa{^P>)^Yf$LsupQTcD|Xp
z_DtYSrKQm<ckDLJZc<!a6r2A4@)>Qm+n!!`Jh`L}2YAP1zWbNgcw^7*I~sQnS-31*
z`iu9-zKW{sBd@(ww%vVWJ8^E+!m?NDSN{ZQ#{RY8S@?5VdpHwY%jFl}Zm^0e+LZ3w
zA64M+YuYcHZ93JO(?2}iG*xVx68n$p8+{zds@8v4K1EFPl*fdk_x$m)`)q6WmseTT
z{e1Z1D`O~AHh=i8{zW|UQ|2sL894Qq>1oTQ8=fwz(|_0dGT``zi^dz8HhV3WnsBZ#
zGIh1~nWww7@>90yomwD$V2k@Sf5)!OLg$q+>XmZB3MYhjX<oV?)nrru@3{S`tGC5w
z3cQ=VZ?e;>#cDg5j|3Gy+E!Z8|9SiM0)`0QP0~}!?rw53lRf!8R;^q@RVVo1;xByV
z+m7|llWty7aA?V~qgOUcX8ur^_Nw6EV}?nWFFG0?w3xJzk$0DZHFxb%|BL#6VsE(E
z@m#AeouQ%h{L9AIT#uz9lv>ss2u+)r^opa%ApW58M~=N;xn!0s7CR=<HPI)B`6q9}
zQv;UTkX7mXn9~-!rkru;Vo~pX$z5uC)Ad2_n$;`%<p1jX6<_(ElQGLT(EVW51L3{r
z7rXa=_`guUbltxL8+t2hADVD=Uz)b3RiQ@A_JNJgw1Ac!M$7dlE#le!iS734zZ;Gn
zP%m|G%;oJd__yK~W78A&o*U;@in+uI=J!eI{hzCP`s<^nKWDtQN9&t>;@ZmQA)WJ~
z_EVtek^aL^l&|JB?tk@_^?$RLvXL1R%jYbI*kfw~ri&_lj*}If|8c$S4~bi=wtG!%
z<Z<(A{ITQcVSl-^r;1E|KfdfP|1sgOM4dj{3!$0Mr{8=cHal~kef_U5<zKX#bZ0T_
z6}X_$(UA8wUVp(u`6t@5JCE8I{K<N{dU8zoy?+mX{C)X*@Ak)wxBp&mFC*i0$tdMf
zUtio_+q(K4`^$?wtQp*8^M5^DvUjFj_MWFF+o$LE@h|G#xHZdaS@F3QvqJWKm1Uds
z%4?BC!;*idhZIz{I(SD2>R(zjPoz~S%d+L!RsBnkidIgM=<=DhGfmY;KcwpNnY*{5
z_Z(0-DtGK**1FRtnHC*k&=HrgK2-1cqc+0$kj?GhGaKh*NC<p23kXiSsp9YR_+o14
zy71=ohkwhoE30d&c4*ID*(Y#mvdG4t6E1vSy==ys=aNmE)PCn1ZFnQK-^eiN-ER+f
zfgnanG4I{Sf@2=9j96W0&9+xIeCZ`d)%5da=jSRNUF1`BuSq)dTI)8|ttZ{z1$nzG
zi#vC|c+Pg|U!i);TSnW5J7jmM-LbiC`S5kr^v74v&$hhwr?c>q$>OR@Q+L^kPA-}L
z?$D~kuVqT&n9Kqv>8x~o-N~@_(DJQK4KLaY4JM|4lw260kTk0<b?z6&B)LQR7B#Hb
z8SXVlYpi^B+4PCP*3zjeH@6*(Wi0ZabvyK@O1|1!UcGIm_uA!_$jC02Eq<7KY-8rq
zrFO@?F6^nievVT$wSnDp-qr0PjthKd#l!~q9t``H-0-b=v6$10lF)P84vPIWzESDf
za8c%PVPU66;j&eSd@VX%IuibdXU#Q<xX56*S&?CVn~s6m<O7r39`v{Qi0E!HI@8sV
z#46m>*mmpl7qcs8W!7;`covrQuYy}LKypC}W0;yow-vuDTTN8>@>>_eLYTH45{{ae
zz9;RxyRo`}bNv?KNwb<eg&Vg<zx!9<`%t}5`A?gQ@yf7Qx;dMsMBG`Mc2<EYuHK+T
zdNO~nPM+$eQ-WuHUs&AQU|nNqq0+hKQdzk`zT~nsvu_?;uTT&fAZdB_>PLag3pI1~
zSp6L|cC5K#HsR3K2G&ip?C!d+`KR((O>N3UXZy^XYfAgVKJv&vn3{1_bLm6p<ypBW
zj<<eY5w`tw+Jtv*r^FAoZ>(l)na{as>$B6F6F>cVZO}QruEjs=o*kq0%tv?Da&CAM
z;>GZ0-Q_T@%~PVMUDaF7vEk;*4;)Lk)jc$<_1%70wc&6&)8mt(68u+Q8vC6TT6TX~
zu6U)cxxB`Qg|n*k=6rrI@#&H2>p2x}JTpyw7RcZEccM_f@vNwtqZb!X?6c%d`?z!F
z(S_zQwyTpnqR!bp-XCX^T<(zbz-3RU%g!seRYZ&XHu<yc^)>3gy)#$Nq3YoB(58dW
z^@4cp)=ui_V0~YpKXcp0#k)Jq${#%{t~b{_ZeD-+#qR(70p83kA`A=+91OxMzeY@(
zU9|H#BLl;AW(EdD1_p-Q)Z+ZSq|(fs6#b;c<m}YE6#cyXyi_P#ub^^muy6Jq1A)E2
z!);C+jO*~d@z{yW_wqES*<!mcI0g0S^ydmj8eOW`eLFt>WOjZ`)ysuU$=UnvRU1Fn
zuK8Q^-}e6s6-ob}?X!4RyG^|P@T)?K`_FAVJlB0V#;3mgR^P_GH}f{W=a_#Yx_K7g
zlD8MyZ45f?Jf+gBr=%Kxda*)h;je>MZ3f3SC8YNHrwPwzOO4{_|2rov#K~^*%D<CJ
z%lDnXmt^?;*0%1o{We=xiQPZ)IxpwGoGP!NzNgU2*6$S?+MYGt{B!TkB$kH~7lrdC
z&Jvh3&)3v6<KzTkpPA}+W1PDbyKXJq6xRNs+^Krkv4h!1L%i(XZP2&#U*Kf_uDe?G
zr+Y{D0qG~}m-XKbv7L9}THh06sn-)uUfg-XrS?{WNr{Yy(N%7xmTbc+u5y35pG#Y^
z^p@yttC$lo?_Zwlv^wQ0Vu>Oa$qk1!7H6GV%YM5%=TFF;hnlewcaq+_Re4=LJL`bg
zzxpQuf>EUk%#F<#R`Hp{HK=iA^A*~;nrg+0>lU6|7=Og>_8;ZN?WQ~CgneDg`8=s$
zv08m^R?3faeY@P$`C8mGWZ7H~z5H-nWc9Tps=9|JFMWT0>7z}*H!PjCpeKD{shrvO
zEez{})Gg=D;W||xc=E~O8TNNC1tx@_n|dm0gU0Lws%-z*5UGS`<<|(=*SA9g^B5Qu
zA22c~V^1Yz#YP5(28eX>c5iL<?PD9w|J2*D_FcK7Al<cT?h^e|fzhthWMkd86-5?J
zdOodWqX4H@heH#q!^u^zpKrGRyls6%!<08$YO5Bl?o}0<ad+<BxpQaE{dqR6<kR2J
z^SAYFDzsXEY3*T8tM!{Rr%kiIcuz?(etGoyHh;U@J>R;I*3OKLy?$}Cy8r%LP5=Ms
zS?%>(9G)3^X0d10>}N-l*!0~?XPvS8of9RtIm2X@-s{wveQtqf(ITm`s-G(Z)l0+9
ztUmu_v0*^i{`AtQYpxSt>vR9Ty*tuwj>zVRI<wP1tp8gWH9gbH=0tGLf04TWNm^DG
zq5V43Z@T=AyRX0Lr)XXMsn{5much;1SN*HyujgCze&P9N+vPX^T(V>J2WHo0K0n_U
zPJI4yM%!YIH{z!)dz>r`LgeGs9?veZTlpmU^G~DG>i^m|@7eLmURr#!>$K&m&4+l>
z8QK=uh1aisUp?RT!)K;@vLAA4cki*PF!vL`k^A$+uiZZ4l}3K<H%m-TF1x&iWgg$6
z<X_+FFa35b;jV4C?|x(95|>3Ad^T0?s*gRO^lQ!fUlY&eZ{9TH@~jE#WM=fU*?hVv
z^2^jeEwgw>s+H%fC!5c2$}F+6`CGrwUgB+i`G)`Y?d#*;UFdkyx@6C(&8y7bq?^5+
z8b0-JMBC&|8o@u-SADrq^F`A3S8e1Up3RbPlbTPv&YKrnYB|Bwale)G-XCu^ds_8Q
zN{#htII%<SZkX~zzkavv%q=sDJ?q@&^XxzRKaNLfwf(u^u;qHcE?%4e<&b3E>HQxb
z_<CQsy+|tVAou6naeth{bSM8=66d$+5qq72oXh&|%3I;@Q$Mfr`y`XL{mVUD%bMDv
zUF9WT{(R{DEOdt9P1O6?ckKVBc!n*#XZ7mn2L4Z+dyk*#+>tH#J@<GV_r=_xw3Dgx
z+{(lktyy$^^_G9@KUc1q&He94b*j`|@zX0}&OP68I8*$?lj{o0<{Vr6TxVT^=7FM_
zs-HRi{^kV!w|vH!@5X4CRKGw!aO&CPb_bXHxBC~k9^QUbXRUEYEXUox!~)R|ITbS*
zw7a&<I&Pvip>)HFE{&59?N6VQ-JP`C_U!J!p0h^+1Kl>>ui@cdRoc|SeMBIxdDD`%
z?V=qY(?3nWC2D`6ebbFIGRqZ?KYurU&#}2n@8rM!v3XjbeRa+8{XC_APOs~$|Jl)3
zfA!MG^>X(=u6LIGziaj5c>6_<<F}Xm`QF&~xcK?1)bFjIi!<!MoSW7Bw>D$L{`XRE
z-pd=_xWAR>TYtYq&WpLG?7xp+Ncexl^oG4%(uV!~{NExo^w&z{e3<){?YEAK#k^9^
zzVz1|eD!SeA0$}s$}s+XQtMa0<w^&$$CW}B0%eQ7{|~Km;JdwOw*6bXjgQ`cHffv}
z(p@sg_x;NjuluUWYt`IL=W-sdu+Tjf8T9>(ltjgv7vJrZZI?tniL}*nyKJ*_mD>Wb
zP}@KJS>o;s6c*|omTLWK{<$zYx%r>1BbVrl7vC>_D{RqsuP`&})_(IeN5ZyUxo1YG
zx_PDv8?S-ZGC@-*(F@0oW;5*XklXOjOncggpEhgTE}rz=b|CzD^zkn?+cq5eykBb5
zzf!S$`Tfjing8vqk&1uOw)gzm&Gwhu*YD%E|Gn8}Rh#-6#--1D_A}f|k}s$fT>hn{
z^ANK<U*q}I*t@A;OZh#H{gq7*JI)&6{W&$OtY=Gumgc7aZ*HD*jj!J=`8HIPM>2x*
zltb-Y!R&_46~Zxx^nVs@^H3KwbMIc%@PEqG6*7{a_iQ?$T71^!$1bnWD{b3;Oxnix
z_2k>_8<J+|i0z1PXnUD5D?IbV%NO0TN%=Chg1()V!M^h(wPpv-d!AZ3_1tBnm6tDy
z&PY_AqM^KHXBGFQRUh{&8=MM?nz=!xJjdxnIse-2ivONx|NHv&-s<Mb@4tWJcgw#o
zbI@jT#jRayw{3`?CG$t_{R4FmCi}PFe;-!u+4kn^&iF-}&TlG=3^}?*F4i}%D&g0a
z9goXC*oN&tC{_9^WSR4g36EdLN$&SKAhFj<{@c9eSAAo3{(Zch`Z2HLzvaB;e~xqJ
zOt4w|`rpqFci-=8DqR`n;GA9Y<I~rVvz!0!oy`1FB*Ix?&83qow2m*fnR(bv?4M}r
zdaY?sExww4>5Du0fy=MG>eQL%)>|?j+*b7Lh_mVWogVG4|7Pl<-qQ<z>aKS4$qvz7
ze)&x-KS$;1|90MvMQw3*mA@YyedxdV^5csa@4cR${y{6kd-g?XWv?ZR1^bF-#w-og
zmtJ;QqciVPwOvKhA1^8Y)jRr&*y87iCcN`K{UzT!=9`^l0;65Y)Vs@yGbZLZR|MWL
zYU!_Q=`D*D36)x~?4(Mli2kXZX;Z!%=A12T(yD5^R;KiKxp=Eir@)Q5syBjea~mor
zMmuMV%Jl!VJ!3ZGlE$@<p_NK)b8C5-N}SX~`C?t=dDfiKyfH(iD)IjF)1F+fnIvKl
z&hiXUSny+p`}LE#T`Y-bp9F4nshpIix+UVy*~OeQ*58!a7HblF=z2!JNbtg#T<)7$
zyCbely=}4Gq-T-s606>K>o$KZEt&gFVORd8634&$W%nOeOt`Gc`|<sS?2IxE>wR*Z
zudi@9ZTmLER=HksaXJ&vqmP?bIhwJETh5QV<z}WXzIK9PRZPH(uGdS;w;k(R^4G!p
z^`U#VdGgoqNwr1AAK80%v%b%DEAt(vo9u)SrMB&x7HPO#+-=LE^0#bl*NpcrKh<K}
za&*?6#~U|ktkQD+JgaZ+?kUszqSn{kI&)A+_WFu%3hD((+H>lH76xT(n9jGpp#0Un
zQ@8&%ny^cq)z$JUxFhTsu~2iymG4`a**Enqc>8MB72Sw~!Y?jP(~W9&wyiE={C{{R
zM=?{s_NUMrpHw^5BzHbd;C0)3`ZvdO>ACeUS$`+~_-<Fs;{Q=)@%5~d-wzIKZ;0X-
znV}o;!a!1#C!*}U!+S5A@CWBpj80ahzB(!-x+QG2UBE+GRjIl6HYhD?*v?&|aBtbd
z+zd{=mztSeIzbI4oKr<gnXg^mHcjb@%NhyJw9exR+Sk^Z&6Wr;-8-@K;kVPub&@8*
z79p1|?x@@D>?2=do%KilX2H#tzB}yu)-3JGQ7g`w&o|#W{zm=te|eVQuGH)4xy(6m
zK>L#4DnYMff-AUf3KHITT;qKyw)^65{$Dpt<quEMTCe)+N<nh-Dn66Rsd2NfXWsm_
zW^&0KoeQ3Nx)Yx9`AY1Y_cC1noXKuIrI@#(0n-kv+f5Yp^Y#@}db!o`Y<J$dd7+n;
zdP6@7hCY$|w`k9nA1?FTUe|jq&f`nqsGT3W*X~{Pq95_Qdv6|6lsW$}XU=lXNSm8A
zlkTPo3pjmvxF|xW*yezf_B54kIXy{UW~~9~Vm!T0=Qh<I`MYf5rrj0$_>^Nx*^e!<
zZ29JB7GHeyjmfmHRqy9YhP^cX9>H}@iz%sZuZ>J&U0Bl(`LpQ>2`lEVoq2V8>zAsx
zb>D7U_^&#({j_boSq_s@uQ<bnl{4mO_&+*-C9TIzq3FO0*{>J2OicYg(eEpxT%z)w
zXzL|+oOkOBSvarZjnqBqC-Lgq?LVAf48G)OaLL|Hi|G3)aaa7X{`{JsU-}O(-}u{W
z>iOCI_Of=BLKWwB6)6Vu%cZ*QoGWlS$;CWF)6VVrqR$hG3k4Px9p4_SJkey<iptfV
zTcYCpHf<^r*Q`B!{EtiE>?Pe7g0tKnX#dsbXrEktW6}4`PAf$gRWF$4*e)a2TyX8t
zELXq0(66=~dn8XB$>BctC9`a)Nv@^c=AXHRle^BYNJ%+!nv4I_?WQ^68{}TP)Rj7M
zcgv~d&RVDY_0bVVO}(i%b#LuBz#6$~k*ujqsH^Fbv&MgRo_J;}xks&ez4lfw4W7t5
z-!Gg^mI_lVwL1RSvWZhj=+ds5#@P?v%2et8ezJ6rg{9Km9{W4$Yd=qk<F75Vn7`z`
zUPyhJQugVU(?7@+^!+--Vs`c5%3WQu61jyeY^Rb=N*@V*xAocjKC`fO6U6WGZwpdk
zWe{Ka_`*r8qFIfbt_Z(danLH}qfU&C-MxhirkA&EXbNmHRoxYJVy*FKzl|3jURSW%
z9q`}WY3a^27g~;sd2Kjyq4tr!Y&GjE)hiqK`9x>z(0uhNCiX;QgqZ8vdl5&^++&^=
zY=7X{nY7I_AFR5bZ&W>5FLkQr+8uU*=NM|=n#WC3jWy^x*wwS=tkAE%w+u3g%{6U0
z&rSz!j-2S9IL&K$<HN}Pj;m`gYQ2}<`fT5fwT6%LPG|dWon^a3kIU!yvuHz+-;uT=
zB_8D!LcL#iy!P3;vGMM?W$&N(Jjj0;`QuEr)@)__qk7v;rWMCItTQi;+-|c@e9q@R
z5x;)zve}_jvHQS2##-<0cuVoWEB9)3KV`~jTwoI!*R|%2rIDf?%h#W(cH-4@8GSYV
z3-=$YuTFbVyGQC!|C)<mXGim-W^~?vd}aCPr#;_#eV1FlUh%bP_1X6`>=zs{cwNJ0
zntJ&_+W*M1i+A+Tx(erM<lS5U!N6rE&zUJbvgK363SS-hmbT&M=eo_S7o9cPCMPSn
z=Xh_0jqdc!$wyL|rfrF+d1o|z$FzBpA)j*}rkXYhwq7@qbFh^x|NT4T{n~juG@~1y
zh!)M-mm$D6|Mv@y;P<9+f@*X2N_(*c<v-SMU%$V;`q%W{M$^r;e@p*Nf4qJ9k6N1z
z)7^@vymFuabk@tWect*mABt3_2yy?2%}C{uNi(_4-}~mtkGHe`HedXF*xbS<>s;4#
zDJgjs&QAw!1>1|A&A%@vXB)1<%w1ucY*qQ_Oa1@1v(4Gp`@7$>D4G7dUs3DGJsJ7=
zby@35E<IVhzv)TyapC#%FWaW<nIt~@VqD$yJK;|hd=~8%^1mE(-%7(+#rHs;=D`Jr
z4jg{X!dtdSX3uWF=Zupo0vrCx8+3edy1py>>-@EePZmGf^r`ikR-CQF%LDU2^7y=%
zcq_)!R7sns|FdAt)b!6=#8d2S1j@LrW>2w^cy=v%{=vT=c9*+WGVi?`n#^yn+P5}#
z>;9vHxhz|466Rb;v@-Z#5k6sB<fQa^|MHJI9QK@V?u91F)aBb;uHs<iKEG|=yBL@F
z3+iXTRz~)UG0Hv@_BXoVRxDF`XkJzkLvY8ofWpnvb}YxYe2XddxT12yA;;!|Si|3v
z6H(9eu5Wx1#PrIemHF?Ze;b~0U$p4b<@=Kxd8I_{gW5|*Yv#q=f_Bd?A5{9&D-gCi
z&DN^=m)OICdrkuCW>44z_TG`%l`NO@^oNqn=F68pN1e-(RdqDJvg&8K?R7tX)<rtS
z#jn$%nJS!*{foW-Cpt4dyH`6Sx842r)0P*XtY@qg{eG_M$@Sb_me*|-`(9LRI#HU*
zHg9u&whp^y{KS}!;`96Sr{<rv$#MIA{pF9gWgFGa%Ifa-Py75uHZHwUb)AaxvFi^M
z&DiFyp7h%8&%xQDFE?NI)^<7F7ySOH{UcH1$hCLaS~c&6l^vOqBvj3PKKW{UY|y^*
z$)~67I=1_Wq<isd<&)EzK82bdVQ+tYw8+FaEwV2E`~8KCtAEt`2+DojZT}~aWq)k}
z`!-3{%_raQJ5*p;ci?B(UF-Yd2|w1p6R>}N`|H68V(mo-_7uk)zp&}^p6niWUE}|M
zB_7A<h&P<q;7Md*J7QP<VDmG(?Jxh$IJ>{*n(NGE3ZADvnx1zKIydXG!r^Ag*z8-i
zVz<}7_Y!_-5!bBy>f-SYQ`{f%$=WaZpf{WS@SYuqS9dp@*z)r2-pbVA&%XuuCf8W6
zpT^zurRDBhH;-8>G<$Yz`mMZN^xp=*jpwE%&rhs4zca+H=yGIP{dcBszy3`Sy`v%@
zb-XdLc2Vn^nLi7)cUtzeuX`@WmAm@ZLyzN|@+SRt72keYH@kH9K93fMWVbmN82I>K
zzFe~^Zq5B(-My1L9&FzH=6%WUFC2%yz2?0&`AbpdSB^zr=J~GGd(S*MShe^<=Kp^h
zbv;*3ml<oGonc;mm-l$_g^V@Ueml!}D><)kX|3>HsU5HMg;he>;bxG*hwMVb-BPP}
zP29qizQ^;R_64i8Sv8x)fA}@+zr9Z{_(%Tf>33RJotS<kf3_s^-KX2GcNlE3)73eZ
zr{EZ?bNu=zg;d9@Cv!GVTED6PUr=J&i;8L2t{**esU};|<H&~Hwtv@g{wRF^+iCjR
zbMmte9q@CJzV*&XV9%9z6K?fdTT9A)Kb1FWUX;$I%JZqo&u45*E-%no^0}~a`_<is
zH)clHe{jAm?)mg?XtCBTBfiYAHRbDseWV%!@2LHp^k(ai_Q`+4&%0OW$MyNe&pWjL
z_x*_(Y;LDgf^N+GdZYZf`oZTtbMExq3tKr|ggxoM9&2<`C*%69AN>Q(PVAdH`Grtv
z`)hTVQ_krJdrojq78bT#%R29?Th1Zgx6@CXET7OgF-GQC_384+d8$wU{<N&rJ9j==
zf2#W?>4_p6FaCPvZ&lwN^*PUKRpCtCR}*(GGI8EIvvr=r_GpDAGRJnOEG*AzpRjw`
zt4Q9~^{snUh4*b0v}K<EdH3y@IN$pky1rL5tT|`2USD#dZsC<{rg!T1{;0P6;kvu$
z@Vdm^`C@w;>SxFq_8-pa30S<rdZCWgugCjkn)Zn7iV~P<-fMm@+W32-a#eqSeaBnh
zik^E9twUN~O}gA)XL0b#?rUcv^26uZ{QY(E-^bP0mmfdwuCBQ7!cG&bunpc4*9-nQ
zv(CLW-`B40Bv<>R-t((_Gq`te|6M7Xn>p=peBqZ$2eSwLzSSFwWVhQU>RxGkuhAD<
z85{F2=eTdDF~9xSye#i7=F-QjUM%ZVbDNjnViaX4)5>+l;(^71lA;<<FRuxmH*Q24
zet9(cLgf;>FYd?Qub6Qmfn}<x6Ib-233o3)y!WT>0juHKu8>^^uFU!<<nl6i*X#Cg
zftO@Vwmx=Yz1^Zet7eKtWl0EMrS0!!9jDLj+TDJzV%q$Nnm2k*?m1*5==1f_4YA*E
zIr#o;`MB<jpC@-cm)xbj4(AL02%mR<eW$otYLcmB65F>&AC`x+ThDnjt?*NIEYtJP
z)jiYNW;V@JnG>k2JW=JRSe5=q&ecy>EbzFeTep)*RyM?N$q%K9vv*RCADR1qTH}NM
zD4TTQ^sD}J#833(KK(ZP=^w{6aqY+FFNh8^iT6HUlyUG?^t`kADY9GU{LU->@yprF
zB{|3AfTUclK*Z~`1G&flW$nr?e(+9;ng3t$&kbhEQHPcO+eQeyVm#H}_v}N^KA*`a
zZA(SVPVEU`@>+g3WXi4yeo>th1jXK6T0T$I=J{sMm+VINzaCu+S4nx)b<OzROJ?C^
zkLP-<fB1p>*NtT#Z~r_i)9l;Y`$Ti|x$EEmyl>y}zAr$J`)=s=Yq5&|OcsSkPrI*W
z_F?w9ln?HV&B=Goc2C=Lzrf*c(Z0%tyN_KHS0!#`O^jOKdyV@<&Qn{v>=NG#m$F*^
zMy6jrefr;zkDDKy{$+4=Lek-nrIXH9FMF@FnXQZcQ@MM7lt_EKhhciay~ew$hd&&T
zk9eJ}7rVC1!{OrHcOPDfnwopwQVD5#p*Fktor3Fv4n6iL*<-RB#jZI@elb>mBbWAY
ziQe?&Q_9v4@7gGMUt%d=d_Yd>qJjdiY23R9`cW^x|M{EKwBq9JWu6vgn_sO=*L6N*
zc&+X9QI_|Qt`_rp^Zny&$<)}c9s5>0o3FNd&M%EZu9R7G0<3;n*d8|c9^iC%5zEAR
z=fo<m%X8;N=0E=X{AzozT}_MFJBPp1?Y4gODDVzo6Ss+6_M+5FU8p{%H+3?D^&-uZ
zZOcN!|DLs}4gYQ;_?hjUrO~U@+ZV6%I(N>S@S@nddd1EvL%-lZUs9e3`_1_uuuPD<
zHzA90cE`@84eIH_XVxAK>pRDPMvx&*O!b!76pgcbyShHV4mIJlxw;@}Uy$uH|66h;
zyYe<aIuo$y$@2~FO%*Gn|E!PYjrI`W*PZ9}=i{s<QMR|=ee&7P@|i`pX&XFW9kW@&
zzW<P6&D-tvQ>;2Rht56P_4)fpR|_jY-Hyhu(ZvP_Haa9oxz^pEx<Rjc)$6<dN7+Aj
zzFG6RQl@LS(RYn4)8F0}*}C+pm+NzN&Vv`Gg>@b}J6pLlvZ!+X=FX!}Hk^z7U#hyK
zr^S1<)%m=j&+AGrCYRQRoHwvOxKrb|QrG|cHzx6{@3s<6P%*jll1b^;w;!P`7E%V?
zIp^aKJ-O#{;w9sJ$tQ&+>%&EN-1D4u`HuT#mD6h#uAY5ye9b<w3htaFfxiWx4s+VO
zeZL{{d{*M8eVOO?<gbhPW7xJnaNDXkTxR}3of&1*IyT#!d%iwoL9h8T;Ye|&T|b)?
z=6vz6U!P!k(2p~%@!Rd&x4%SXUii4lB{oRDG~oe1=l4(PQ*Kp-woiH69{1(hN!v4d
zcb4-^tC%)5HIQwQK*m(Ie8Zm>s$mb?e*b*)^5}-b87t-A>TJ#{O0}Q!aJRqSEOCxW
zg7T;NxS!0u5b6<heQDY1BT_mn;=*mqH~v~@&(|N2dLy}ILFyZcClhCX*>{yc<!k80
zjM{fXKDTGrH~B2T@_B<ndf95t$My4Vql#WXNI8^W`##d!`qSU`W7Tg0u2jWYR7BOU
z6`IkUm3&=RSTQ-G?qz{O$@Pzq?Y-IfW=%b2{kAN4=k4fPBOAu1qz7|k-@ZOw|A{AR
z*M)uQ*Yl1utM8a|?Fw7U?yWlWkNN+3_V)F~mj_S2<h*y|rG49^-;(P+m+dV!k$V%f
zd%`v6cM~4VeqMECxueF7o_jKTY$|%6&rY%OS>(NM<7vTOYu)Ydf|{Pz6>q5j^Xurt
z)7$g;9@w0F@bx#N?xe~>^PUGazRIlf490TS6P0`?9=pi?<E}@eaRhIPojvcK1?q{i
z&jVLvJ~+6m_t4^p&whNYzt{A|-6*4^BG&2c-{h{l-IscPPh1^zK<$6$oXK}}9`a<_
zpPtWu_u^chkmlEE3(qzkH@sN+E;TMjt@69^b5r}$Lq9&*E)97nyy57kB@K3>ivt$&
zUFWlq(mxfl_kPCI4@Pc1(;qGrNsPPrtHX`=<59I2Go__pz6$4MS=x8c#I^PKhR?q~
zzmlK-_@~eRNmX}tx>W6IY?M~9HJBT<@x+|#zvh1CTzz=vrS`M?b=DmBtq;7q_VfBa
z3D)Qv$qZBf-N;+{OEsPMZLgy5&4T_77rreI=bv$;bjjmi!cwkpy%!d5`{-UXsn_|B
zyVH@y!P5`hJ=T@p(v+U2&{6QAw;{2~NqzE!Z&w$}31;Nf`DeI%=2T9fdfM`7<0jL%
zrK)NtpWL)?Zr3?{`vb2H^PX0=yQbPDwl+1J{>}Mg^!d||oi}^F9el8oRmOkj^K)GM
z61!y{%wFg&e@0l`$dUatTknITH>ZnR1p4jmP+Y3iUYdQ=DomzYVb@>Aa2wq(QJT4K
z)ss8BECXk(l(OkOz_syDV}V{qk4>DygY)WQTt6;HH`w0X=W;C~|JrIf=V+m$=8K(q
z(t5ocr(X;R%{n>J`qanAN2V%VEI1}=wPb}zTiyN%Uj+VaSsG{>xZrtx_??CB^#=mC
z`nj*jZQJ)sk>lL8X=3iRlWaNCoIEaT>O?aK-M*x;T;~XfbeHmC2DLr*-P5`=f?iBq
z9QTeX&-L&_1GDK~<tOLNt={-dC^#=u{Efn$Q^FH+!dZ<oy!57-N-a(8<d`qA#JA#U
zNXuir&}q5ei#HhG;bd*z-qy%9S!7@4u|EHO#s`n`J&K&Wy6MMCc25JH>ECsEy~;Dv
zEnla4q)zuZ=A0e8rmUr+|N4Tw<$Js*YtCpb_v{RxJ^geP_rKdYOv!#xQZ6;FOr2Aw
z9bV3|W>wtdmhPI&&UJg#-+bqak3DdH(b4Z0{)*j|o+*7{f;fL|#p{;nmGk}UK0G{s
z{IuMk$mo9!e9QmH9<e_i^~?Xt>n-ZfCRY7wF4<LoZ$nP>m+5jh)wlXi$z?P<rKI~>
zN40s$=@&T$U#$iFUcJ12ltq?T|689QU)bKAn;xIi$laUzPUhxok<=YG;<V4`{CT-$
z%g1(;)9<`RUVc3klVYM*etmM9^p>dm`~QD<$o%Wb%jutgwyn}Uq;zVpy=m?x)2to;
z|7@wRzb_<}d!E^r!?$MAJ8siGP8V9j^Y6Fomi*oFIbwy&yy@Q0<IURE^_QwC#LNG7
zxTPo2TwI;wcy*K9qKs0tD5aQu-uemJ?P{yVxvLJHSS;+3k`t4-yF;$a!L0GJebpj+
z^^T4lhA8Hbu8hZb91Hm@5k6h~tVMPGk%~K}J2qsubFPYLyl|>y_uQS@iIK$`?76$2
ztzNy!^>F@;?QU$I$1ArrhI8=qrFVp1DV|VLaw6b?m8a#A(yFWrs(DsIkwR&?N9G%y
zT`Jjq!EF26yLRICmrb{y`k8obo2}I$Fa5dMk++in8(k{6+jVSb(xrU&LyWcV-b)kT
z^nGPtR$6Uu#wX&tZ|8!NAFT>W-=;jbH}~9jsX-^OWnCcW(^_lK*VUX=A98p%>K&OA
zAfGgQeq`(xv2T9O`>!}&Fnh4(ovmS@)?wF;FCz7C-JN*C?CT1_^q4X))(2iHK9=8V
zl)2X2ohW%d)5x=yL$TAV%s%8PH<N)Ai?lYcS!?V5hD}*V)_&X6U^0O((<GR`$0UE@
ziCDg%DHm;~C~emE2o&AK860vZ==Hq3L=8T_hR+()Ej~;-^m6(Eo3kH21g_m5cJ~1P
zHJRvnvC}*&<z-@&<Lur%yw$^ZplCn);b~_I&nQ02xs{?P(_hlaux+z(PXH@(dDGGG
zMJ{Q(G9PbS&k#Dv>*%smlbKDAG9MP%Z0X{&v*MJQ#`L4i#nnPWdqiX(A3a)8*?eV%
z=$?!Vyw4UGZcXCQKB@O~;e)wau_njP$`^n76KNxJO#EU#XTi0si^nv+GhVH@;2CMA
zc=5c3qOkK!qs@ySp5%7co#}Jsq1~mM;!eVquNL)jw@edlUVf_EWy%_*hIw-T>KRP`
ztYY+T@7;RfbJH{X+(S2Fc}sR&mA+cYeys1GX^2fg!h%eWhzSK5%}U2B3cg7l%6-st
zsaV8D|BEuy4qf%90@-fHVbTxNtv$;ko>a6QV2_xc{9@uC!>7`mp|!^<Cl>{K-Ovgt
zm!4vJbyM@5w}Bz;40icnv!|VzewL3VvW#V|%*G{^d8Nmb9*U&fmR*l9mfX5?mz4DP
zg$vz<c0OM6!sK#sN8Enf`&azjE-qnuDt7MAk%<#5Y+c0{&fE6;g&yNQ?_ZNI<Rset
zGg+nZ>Df8go7^08C%UPv=$<Ef^og7z*VenunS!U7r?YPBdp&8T{335FOFKTvHeFsW
zrD<H3elbXIQF%BcZ{7v2lgD1gKIfV6V8Z=%A3i6XVO5+~V()ft@jLem^V{VX-Tk3^
zUvpj8k_mN(j@`^<xBNOktZ#W~oa0xSYvE?Tt7r8}ZmZfEF?sLrGw-iCx&7PxA~eXM
z`;6lkySj6FY2R4FKl*KPth?J=`q=$Z@EQ4_1_kTD9@mA}>wezVnV-D)V`;2@*|zPg
zKbBf~uUgpl^6-aqZ#$XdZp;f^qMc)3{prc+AI(dfCQFN*eROrXP~R_&oj%1m<|38>
zim9#<sh4(q7Hg5t-Wza*|NrSjo)13q9$I=U!0XMed$0T0r>d<`STCdb&m#WkqCb-J
zv(7A<ci*w%+_jjZ_sM~Jk7QRjE6Dv%JlMOU^7n=JHeM?ix6I4_?mU0tvOAZpTuc^p
z)!l#Hlly1W?Xwch;a|#klr-tof3&;5TGv53A-rj=R`#m^mt~d@b9S|?aXTZkr)4>_
zzIlk@A1C|L;_Xd8{xA7nzCbLpCI6j>r}+Ah-0wP<K4~|%4}I8{=)JxC^bhmB^50xv
zER0`XzfM@J?RWRlfFnvuGj&(pD71aUuB@D4>z%l?{cPj*x+u4#i{G!`(Nuh_$+nVt
zO``Qr)eU7<V#{vNikh?h&!S9ikL%AwU-}vE`O9WG&#hYDkN@6>+HdvNcLd^cEFRzb
zA>3pW*uJlG$s{YSQ`0p~j^8R-oc+NmcWeJ;Z`Qctfa@!M%%7t$MS1g)lsQJBCEM4C
zFV1)za{b`K#)$#DYkytcykfajuV1O*Mv48Mzav_NSl=v7DC7N@WgAuCTD<d6l9Jfd
zhi&H#f5<0oJAC0{(TwEQn=g&jd+Vo#T8O>TKdu~5dTM$6-r`@ozCUv?o$l8*zp9wU
zjI~sHv(2W{sdIyF8Yb8<@o1~dXcdVjzVkQQuxxVm7t@f5Y_7{bow@eazNU2ctP^Y3
zY^kZK)Ozxx>)?!;j|yX*i}tpu=Q4}l|Kg&*Grrb!f#AMxwi3U-+PW<|5w+AY>BBLb
zqmNcZlnYMxTjRCyXi&E=Z+nf2h+@#PHwF({y#%FX=0A&Uu>bod_)D@=h2fM3s?tqf
z+s+^T+<cICTC(}0f_5!eQBLoz|86d{%zx#pcm3XhD934`-6?ab%#Q4Nl_ImT{OXby
zkI&bxeQU5qKIl`fYvI0Snb)r_l%FY)&vey#>C;`G@?Ce!23^bjlsk2wlPPEGsm!3e
z5zi`kqw4?My!ELnUi5&)#@14wEBp7ZzkDOwUw>2ijH#94aY5g{I!t$a@{Q50*rwK0
zcDseB&*S^A1r+w}{u0?1t+b?{g+KKDyyw$4wcq{TBDcqC(lSHgK>yt4hU#mqS&?n;
zkKU59jk|VUI`djl?@|d<8~g7E?mW|8A$N{B<frc5)*~)%b2(q`7V`-xkovWU-)82@
z_?Vr4d6yX3?8s97wN`G=YUwD$KNq*k@^m)eOtq?1y;fYTTQ%2(F@N^$*X5y%W?Rgk
zR+ptRM(;khmtB79>7A1_vwq*4H&NEUhnrD&&6li@owqlHGUu)qmHTp{WA+=xOv|(K
zTN%o2m*0M@`ADGr`iGY#6F1D&z9pGnFQvhidDVdXx%Die^i!qc-_&_n^RIn()>bue
z%<1EKC~DC^aZ>8~=~J5;7vCsb^Hrgw?czfD$-5+%eom@%{i<*|GR#|MFI(oM4QXw<
z7ah;G*p%=FZP&BOn!ZNl`t1u}%rv%(_^dXSz5ah@NJaOpzBSw0ldX9z%%8gMa@x4V
zQ`}aqW>MvT)%TT+6J&ea?pVD1b8TK|w)7$MgELw#GW<86=j)bQwEXVM?Vff;r>AR_
zJQU#7%rT8xEHq_znZ^nCTXxmEJ~x;cy;qOu=<L#)`Otor#hj_rT}4m5y}B;>q3GF3
zR(E+n8=hagS!?3a1OK9oSoImo=01HYWwLU{oRWI4fV7;66K3VUJ#~t$;KI>h-5@Q_
znPoa2<ujZ=e^oa+xkUTg%QZhwajHIJYL?=(Nsr%r;^%|4!Br(KuKON7(Qw=wz<&9~
zU7h!m{GT&tZo0pJ{W+EQ8O7UOufKd2b|&_B!)2~^S;tLbmrl-#RP(*L*=X*Q>(1fj
zr*^YcCOj!$5!`Qa>}8&qx!JtN&d`((ll}-~9x(`5btz$^&Pq3{=~l}x&%C$s#mh^l
zHa+Han(tS=e90zDmDHe+Ze>=R)}TvkX0MV7Z)$Um;}`n=ck6k{{d-;=zA8TdkouaF
zJN$Hy#qVHK4tL)p@`WpVzQCgbH}j1_4A&=3c=os7Zl`>0)?=F|uSAq$4K^^zJ6G)G
znxI{$v+rHhe*3OzdS)xl8>h?;k%?V@?Mc^sO^)W+JGpv=e|{uuu8)0EbhJP4cw2wy
z@hMu%#2?FOvwUYxS6^QxRxH8#*4eJ`U>A$xGR<#di$9*U%w}1|rL$Q)b>o`tT`$Fy
z3U+>Lni;#M?acI<V!3_iqji~98Ad#M{Cb<m<Ei$BB^zc0eLoR@dwY|t)z(mVuKK9f
zsbv$twyjF<T0QmjtgMB;s?!a3oxG*H`o!T`CzgHx^KV`1e6w(e+kdYtzZP>{<H1V4
z<zltp?gzeqT621<NPOLw@Uz>iA8z~qXVuSbS^M_iICpi8nIxOe(Y>wl;$jOnmApT+
zT!^Rp|M|(h^^(s$Ln}=;A6oeG@t#G07_}b+zEeB3(M2PfNoEeO-xGej$uCphZ<6YB
zzglE<_TEpyH(F`8v|=P`YBxr>CTuiNiDEeay<7DL$CJYNWuZ%zk3_a_eSG=;;SY8^
zxl;nWOl0D_AGF+ev-%=)GGNN*j5)g*pNJglKiT^1qeH2UK|)7~^+mTYj}BLDS`g(P
zr($C3vORL;hssZ~M=#tCzw$V{cKLx0*}~$3N&GiTqSG0&HvE5bZ~xZyaTehYvwdIp
z9bB~fl+*U|H>|7f3v>QmbW6Q(Ler~-UtV@={CoB}?(@^SI}u%%9)6Wv*}nEm<lN5m
zy=Mg`@};fMdd;}`L(`Oq+wU6<Mf3gn;`jILyZ@i>*N<0E+W)@LV@?+O{&-11g7s+|
z&Cp{FU-unT>ie{4N2H$0Hig-`Di>@QTA6LQo3^53v8BP;7q1R2WAc4${=w#unM$dN
z_rZJ1mYHAeDe~^H^>lP`I;Xf;;!rXB6}5{gp1sM;zw`ON`SJJ1Prf?&%FUb?pBv{h
zgsJ>!I?MgA`L?*kR@cVk`TPQk_5u@_q^Db&HOGYYB(uavxjZqHN}P4k^-SujO$=)$
zJ-4b{IwR`Y6xS6S;#KDG8wUruaqMpW?2_GP6M6X9rK0l2&!$f6*X{q%carbpwD}VP
zdwm>FKe+w+Uw+lISv&WCmAn40UD4)UNP4v{pEb|!LyQ-XZjA|d?LMh0>Lc}hn)g4h
zY5uLDiwi=NX0^HY=B-bZRj}*i6KuZx+vvE3q-gaKiBraWR)<ZrF02q2Yx$pc#k)P+
z*)J}@^Ss*AmG3u6Slv8&_|Yn#wDXg#eu}X$eLB}4k|dP<Ilt)Up6Y2cuR7_h-V$r&
zq%vos%gKd&#!dXEt0(4s*{yoiY_a*vH9LHJZ}%OZ$suj$_~1uJ<Kz0O(j)qZPrkGI
z|L)}X_M-N0dA04&I=^yUjdU>V&JD5HT_gE8<gW6i7w*zQU1_b&FOCKWtC_D@Zjl%E
zQ^)7!)b+Io{u|%1_0-#N*6Z8m9pXJdDh)l^mmE>3fBQ<(WSZMPwVJNm;rkDKs^@t1
zX^xQ-(@MRPtaXO<A8Hkr8_bx?6tYoyM#%Tde1HBag)1L^$ewg?->QUyoD-D_bCzZ7
zKNL47YfeM$jRYORoU@FZf9|>X;&of+p@4M~v)JdIKKp{Dg`*>1{L;ybw$&g1O`P#4
z#H?Xf>K2U`HIWUc`Y&WI_<vZwf-`Ok^Y0@MtYo>;JKaS*MI+}FYVtZYlvd7Dyf9%+
zo&DDQzK_i_1OgUrV-mKTuh72bTw*bkNLr!jh0i5x9r*h%)VdsF-M7y9ieyM)!qv}i
z&ztt1jSq-V=eD@}%-~d`U(~+cdLM2HAAa$&M69Cv!D$|4`Gx9#RGYt@<+6CZOf~d_
z!3uv(#Z{cQKfdfrZLB%}{LZ$f$(yRC_B7V_SRYL<)#*!+l+IlwVYQ86bvDnW=n@gx
z{|dFHlaGJjyroMkU1{|LpM7<#lbN(t&#t`Ft$mYcSE#S{onP17l)O7UC1qbf@xB{$
zCV9y$p62Bj!;}_AiA!9m&Yx>+arE|$!?_b(cy6_RNb6x_+cPn|(D!-Q+RLeY>U|Z>
zYxkWjiRc!Yx9*CD=qz!rL@QnWnU`$cKB=|r^eA_f>FF`v|2By;D(Az}KYk)}6P8w9
zQV{(d;G!zo!}ZqBuS!Pv_z$M;ZHp4yX3b{{UUC0}>!k1_d?{x>SPAuKwqAT`kRdgD
z?*Xs1je^@uzB=mGzTsXeIrV!_RZ_dc^ML+6-pV@fTcucEmY=B4h@Dnb>ifAmb9(QB
zX${|PBBFnObN}{Sqsmp|`ie&nUNrE1n80}YMaaQrJ$hB0ylOLE)y}+DuDQa3FMa20
zhc5!#pD0*~XzbGRU7RiB)Mb70)r6IKOBgLvkKS<dop%1hWX%Ip7_Z3(z0K3U!yKe+
z;Bh}}o$--(YXp0Ecctv)NpU@X_~8Yi$!>29_r-2X*gG$2?PSiH#P^rX#Js}`R3DrR
zSoLhrjMRb)3M&M2uSIlQ86TN?PSR0%LyY#X?UT3bC;0dH^}D-Qua6J9nyO%)aAWp_
z=ww?@d7ViKtaB_sxpU{snB-T___ZTXc=0QSrIr&o{~ybK>F2Z4W+zMXvWPH;;}gAf
zye&_tnMa09tq#3%!l2sWQ%tbrOU2J@H4p6_Zu(_}y)F#N`69-X{--hbU=`=e*UuMh
zu+G%`TmQ!`eae^fkMG|7{A2I3Zx7|)ms;JbymRFGtAO?ka+jaqDlT4gl-Vcok=)x?
z`!anw-Ty8~>$#?CH|hDYkl2f2hTkXlc6M!F#5%{~`zt2n9T|d?19tkXc4h3II(^Od
zk88JjSWHx@mgto@vSvw6%XWtSzi#e2oHbi(@&13y+;_R1ZvI>GcA3@k)fea46i-Ux
zE!f3U;p3gPF6R^D;X}u_7&yxo-ngTs>^*N&*^Zh^CR=}S=jNU)-ZPWAg6WGvw9DGy
z3sbb6LT_6Bd2V%W;`c?l3amF4ajZ{Q-TLMJrm6b`qdhlXo-2M@d25#4g|&_SH-#q&
zu9*1QwD@nMT3qqhHn)b})3)5!^?SOfP4zMTzUIUFT*0|ZKFBUx8*Y93_U0_3?~|@w
z{&{WFEis4rZ%?1r|Nr5s{JejKGeWw{ulZhAtt@K%BETx(D)aT;@%hPFzn-7pcTA$`
z{)hMR58u}>yuUw6`Cy&$y#?3n`q$Swudn^7`|n@+zrU>i{za?p-9BrMu=a7AZUMRV
zrzXFOVy{ar?Qu6-vGKERUB)H0N3SnE<I#G$ed^2yuSJ>K-0Wl8TE$L#z43mVALaWu
zdQY_5?92l}GJKo{RStXpfBm!GV$S|~^Z%RjyvY8WaOw=-Kk<KCKOH)ndBi)_<MMRn
z4EgDKvB?ij@5=r;|GzJ_Jx}u2-_Elk8`qXUovs$Gn-{>PBfb0TCLP1)VUYn&Z9GSK
zH*GOye8{%2{#=ypEoL#x$eTaDwXKv~aBcC&!bOG--Gxe;l1wh_zR_3A&P?^1J1s-+
z%1Z+)#q5BnCb__w`&dfZRE+&TEK{)RN&hj=^^Mx>2PaZ^5C6X)rmV#hA2-E(s?)RZ
zxksZovhpqO1wGXM)O2_Dh84DJBW8R*s;Ayv`MOprf6sGuyPPAjtLHF&;3(p>zVdm`
z0%>WruRmGjS(#lJ-w2CLO0>K&>BS>QkNlcLyLSD}Raq_j#`sE*&Du*fxr<I$1@&Cj
zYWg1S*;qK6_nS$0;x03e__CMDUj=uXiR&9JT9|gAz3+PE?-w6#zyI#H|2AjiEiD$s
zikENtt$kM~8&}QC^PSeMP=3KbaMAO529Jur@GO{Z;l1}mj5CkU;V*r8b^?)ei*HZ8
znjtjzs^^9|$)>)~92;g_7G2Y}X5I2BhkFfscHCq7ZkO#<<;q^B=(zY}UTfa64NX<5
zzg)Imcz9#`?c|md%l5c?M_qk>micI<?6z>{q_|s)_cLiU|Cw;;f3}?qL&Lq2!!?Ut
z?sU~Ag#S_W+qUb5x#oLqt-KwZ7@Jr^4(;^$dE&x`<1H&ZgZz5Lmo6%am*4V6WPPef
zMXYGnb4`a$cWx^k{&1kDz_Dl34*8F_w%hwVosQDIeSziSy+Dbc4fmteIQCUOh;^|p
zcD?uXk)*?|NpF)&9tpPId9Jl%ea>NnkgwY87cC<88AVLGQ1oF>|M4Am2HT!FuP~DN
zdgYtQKD{@qdEQtsUCi`w+p~H9;pT3>l~WeThvu`rGo8Ci_?&dS{nH%_FYWBQJz4D6
z#rccW^W1I4wjA!uTsOzGSyKO2xB0rWYZZ<+HF|~35whf&lp#O;(?9X}3^N|fv;-gX
z!>g7BY}wy?{>3ZhZ>&k#J7%nzBUEZ*UUH_Bfw!gh)ApcwGyZ?z5>^gvd}qdQ?)8W1
z{D*S|llnfl+zp<zDSa*5>S(U_DNWm-SuE3)64BHOZIn;n%68n?EWxlX&dK_)ry=v-
z(s>W}FA0dO-E5>&GB;`W^MzbTS6OY0pB2Hz$IJh^sk-aWyW7^b4bkV$@+$2PE-L-e
z7RJBphp3vO+)L)->(&?IJ0xujVnm*0r?T?LOpaVH<{G`%>z(`88Ok|q*Zy5KoFOyw
zNyOWxEivMYSIP8Sth@NH<(=+X)>*}ZJC;A$S8u({M)y?l>FdTt8vTyu$6rh8ryPAW
zXSL?eIox&2EgsbEbYmBEpUxY3<NVEBvx5b)SEGNwbC3GProUy~<W^5sVdg1s8A>@f
zhU#7_G~0UETPLY1w&0P(8(xzPudoTq>oRz3gKAw?ADU;lJv~F^!c<Y#MJEbg$eB&9
z5G{VOqD*knze=-p=U+rctlQ$95Z0RT_5J6$8Ecm6y?#|Ic3rz~HGf`k+OY{wZn9qH
z5d09gWm)lGb4%ap0wEtA_bqy`TfJ0p#dA)bT$Wc?5>vzkgUzH>Jm;;Nyytjm)tBuu
zOWqltw7pl!Zuh35T*+>h`&3b$qQ-AC7FMYK_-nPcp-RN&^%{u^(RG)e@8gqNUa(-D
z>jG}EweH*A&(VxXJUiEDmfk-8t%ntS{`oY2-Lv;u+0UZVKSl4Icd^8+S=sRU=~BJO
zum7C?Pd+R0@7IKdMmhlnOSU{Pl>BO@dzy!L>6SZ}uF6S;Wm_lvNb?75w5xmb`)uLs
zDXvFi4`@u@v_fmqX5qK{EpAm;Zrc0*vi}!uneSgKI@WoFil60-VfeZ7XOp_XVcpBJ
z3s&sb5*Od8b~59e4^QkdOK0A=IlmU?>U@^FpZmwZ>VCJTSgHVLclqp?bo*a<_sYY!
z&9c2b)!^O6ok#aBp5VINNGiHG=Gp<fGWL6c)*n2W4u>9T7hF_Ra`DJQ#mGmt7E8~6
zGw^s|bhdl<zIK+T<O6f|6}a47@HsB^!Lfy=vj6}7IP}`=t)Um+Mx#W{iU7Y*{;jj8
zvp2_8F8NVgyUW_^=mf9!{#)n!bKV6z^She;x9nW9i^siDb^8pRyT>-Kb#_sAeSQ6t
zLaAnjV%d$qX0zX|Z~XCS?tVA(@*7@>$KxwiKBlN>>56n|w${(s`jADpnvcC+_VW}=
z+i4P#dk@AwI=5uY8?M%?yn7b^DalLK$j)<dUT4!{yg$92S8dndjBl5!@7<3(_f4_J
zJuJY8t18L9%z5v^36cGi)|@Xf>e+Yr_lw59EgFWGdPLm5RYsd^{Gxc`!l!F|%X!an
z%(Z&*?b@QtpA`~X^c>j^svU0M(Xu$>OnF`TPrXjTwhzZRm|s@rG5xdLwf^Y)6b-JM
z2^wV$JNtNco-_NJZSi2~i+|>sy9CTG1f{OLU~@j?EbHAbE?aNiQux<!@Nh@2-!7y5
zr|&Oh5?f)~WM5i&KaRDhd~=t~<E-SEugB&kXwE(rzxruM;D@y(ZyRDJTKL_ct)|?+
z`2O;z;eFNz*_f_)N(=7!C3pE!Y5k7J4pqT!m)xvX-F?3>&+A}MjhqtO6TEx+Dwo@W
zQ&P*M_2hRq8SX0UNOJxC>)}dq8J5<-i%|ma7Ee2$Tq&DkroUaRHB+GR>4!Xlzolok
z>E6iw`0ca!@#7zl#(Vlt*5P&coxR*slk5JGgd1HID=q#NKhh{(shQEt7vt}1{A(?f
zn}V9Kc%7oD*xGZi-@KC2ml8{5OP9MQCoXB!QktgHee%FVZ;sp3m1J1CwoAC=`F73Z
z_}lrWqB>7*k?bx$;dI*{8k(2nrFB!^{&}KzWGZ*PSjs+w83Ly__B+jTS)7=yutbLU
zaogupxf!i;sV`!0uxZA-n>injeclrs%(2&E(bE&E%ij7nDNhnxR$A=zdc_gfCF>%c
zZWX>RG7pxEd3G=N@lC%4yF6crWxck{x^w&d<9)lfR8~9?-kSebu{8eLjtPc5RepiT
zuJQiS(adMs-oEU1|7)>-D=PGs2-$^2bszt|e!eaDoxP_z4v9w^F(@j1kIWN@au*DE
ze{kIeBRP+PF8<6ee(B&lxv77%pZ_$hRaV-wSKjvax!?Ws@?4M3%NPE?E$h%)_0pfF
z|5o&#<(<s0U-(mnk@c_M(h1eq#LeTxe!Tsh<WrRCyvWmNs=7qq#;m@R#b>tjpRC?s
zxTsB{>`rRa(G{1Na)iC6Z`!0Gb24}9Th?bG0vi{E?h%O1=5A<FE{gW$zq&=C$@Gum
z@5?qj4{<TqN2jT(x9?!P-}A{#!}9st*N5l#Om2+(Qfnys^!=5U4x2A6Js5K1q5N85
zC;x-DP8i0`IV-mCMac2O?5B!6(?7qFy>B`5igTb{Zg_t8KJE5C?|oZ86kh-Nd7{#c
zo7Xn#i*7E_+3=btJ72E;PWsd**}_M3^VbU8|FJo!rGCweL-R{-e7W&9k9T+J>2~&e
zs?&7UmkIA$7~ddw{I>r4q&KT~p5Y10E7DP`Ssr=k>dvQIgQ{j<-;<|N^<duh?%sD@
z^Nl;&wmdxZRd3hy^qcozw$-_4UbA}mxv28!RcZE#r|QiDnS+)~{oB$fbGb>EWr}#T
zxpQoW*&Y6iKMyIp+)d*8^7_>Dkn7&zPgeBL7EXDwLi^YDNzS`8#7@t7T61Wn_oVj^
z#U6F6{?@Yf?2FX48~fF4E*dv;pYieT_%dw|qkX#Io68SB{E^YmK7T%O*ZK2L1C|Bo
z|Hza6*M2`QI7Cow{)K&YUu&HH|NGJNZ{@3#=YDkS&kKrq`^~Wad%dyJr$0}ATs`>W
z=fUo~%l~}8_xkbW_k8y*xO+(PIQ>Ynkcsm+KO=d@+t6fQOBp^1tLVO^!LGL2?_1rj
zZEqKw9k!p-<cF_L|E*(_Tml8dntZj+EX;R0Q~1KqkXe7fI!lSbe$EyD431}Ux>|kS
zd{JSOInzD2wvB=XqL#NdO5Utq9K5lz_6w8baqBH!8Ivuy{>o@x^*`eG`AyYVziLRm
z>|3JL_`Yt_-5)91tKVsFU`^a*Zd!NxYDJIb4iO2}#JwV!3`sV<KPsonu2R#I@Hm|-
zG*@=H;;)SCIqrKSORf7J6|VETQ?QsR`o{LC;|o|<@4jaKhpY05*ZP+{CwJ@4`fhOh
zMA0?{Ck}pHgJn0A*G$<o*LjiO;)0IF`PO0nNAKor+QYG>cZ12se=e?k!dq^6ypix)
z{p*>zE$3Cc%76Cn%%7E-M;}<6yE1N}>C5a6{>!^FG~zRCn-)xrG27M>ruRy4@wYck
z%YLnU_mJ^WX}<Up*OqH_o6A4=?tiboKdSlS*_N-YX}e40l|{dP{`(-J!p2ceus>?5
zUVYOJ&m6@pmW#VRm*1PMy_IR2qsYI57Kf8|29!u7@qK>u<j>W(0G>!8505iytHe}m
zC!|j=sj%jaFi#1}Ti7mBsu{4fZTXX!jNjj8wjVj$dSH=5^_1czg%gh)c59fNcXZow
z>w-teEFQewbwf?b`GHH0d%I)%o$2!|^>yDhUi>3=#(2xVx09mpSYMIIU_5PhUtkZ@
z3*H%j`vM-Wx-~ug4Y%Nte3kZ2fmu7wh?`i%6-DtaQwz|4;n(`;(Z_#5U6D6VK7A(>
zJ)L#KbPmrmPj@jZU)xsW)Q}>ZqVnPT{5S*a`M-{Bn3=Ti<Lo7#ek-*l?sy938osi+
zT3X0nbxrj~P;bz!A4@nqTaI?9PV#G(E%4%(`ZmME>Ea)uU2#iiNUix8oxoeEJumKR
zfN;puGwT;0lJKtzbosXE1^?m~OC%x$n<UyAuP>@NxiRL%$tm|&H+XEd*(T}eQfQyf
z%_Khc`mfZe#ZUD&oYM60?fR}P>2>0eXvsr~!~KF)y|ap5pZ}<&nD_aEijvwczXbK2
z{tL1bPrr0{U3HLW;foq(+1K~1D!nF&?kno&tiM_3_;S{@rBSC})mA-Z@9Erg<OQ#m
zoW<iWnvdiceZF8j`JmlG=bHNGF<}=hU$e*C{XSMBmMtS`Q~CHrS66q{_Q*$$=Vf2S
zcK5Ho%KCiDBgMNnisih|NXO3PZSgp$c}=8e!}&KhPWlaTyb^(a0ur_>!&c6T+s3g<
zJ<@QGTCGIRY#x(+c1Pos?SGu(nfB=Zw8$=Rrv8nFwI|+a8FMvEe7)?nNMm3?)k7Em
zkU#84IUbnGcE@oUZ_VFmvOlMw|9XVB;BKFvxfLJhH9wqjMe|`xz+1OFFHFl#x-56d
z9o7}(HR)TonRCU8W!`%XHcm14D9EV!Bfo3!@>SDCCM1+T44B}$k}>vH#<V-`ua0#Z
z=oqLcovXdF_NKC>Yn|g~uEnWymY<Z#EnsTV?mnH`>abaJjd>I|k4Q_xE|v4f6HNpA
z4_OCnUvlqT=!u^$O;;EEl}>3Y&TYxL`7Ck9&4s>a1bUxDF8Qh%{{KpNliCiI#?{AG
zK6bvq-TA(0Mp4^N^Xp<ciotEK`7b63D7W3pnYaCXqR?lhnJ=bX(XPm=^jx_jSmI7<
z;GLZRvSKUm#G9SF_tE9OWlc`@q<ix&XW6K)J9;m*M5K17@++=5z2=m=RdqAZ8rp~y
zeqI%;GgV{$LJR%P-aj+C9UNDLearp&=A^Oa!LBOx`ZrrXiEb&{Gl3<bIbEju{Q>*u
zH{K>rbq+6VV*T-A*OEoiQpY@4FM2jiFf|l1KkPm)Ha|P~UumOil5&ZX^iIbm+h00u
zm0A2lJ!jcM=P%h3vk!b*JE2`+dg&60Ol|&G?lX(lWG1_aOjMoY5TY_A?^|%Y>9nL1
zj%jBSWqq&ut>SKba^}a2U58oM_q%R7%b{tqnq~7ubD5ntT-#TjPTC|B+_%83^3DI7
zQP&<`=9E~p^T`I!`O@F)CS83wrJOhCh?lk2wvW#mH_Y5nqR;v1<k@YHO&02Sw|JE?
z?7i@QVO!!?ha=8mnTwNdl%#KyebLOuZ}Wpa^mo~k5Q(`5m%O@P<ma{A+TugAp=;T-
z%gvk?4@&v#qUUUhnExs8eYcIo_4h13?+axseymXa(x_XT_9*$6{tSN+Cr3Rw193|x
z#go12r+uwnADH+(YmWSin#;mB)>pV}y=M7-QIXSzR5P)xNFBGUrL(SGeX%M>O!A%5
zGOpwEF1%j*_v5S$ji2tXj=J>GuO;DU{zI3eRwp}-zH)pT&EfBCRk5?>TXMqxWZv?Y
zvv~o9Q&xRn@$9#B|0@PVfkNp%t_!l?#kgHoUlpAr@A&a>*U<;peq1%~V6L0`z~b%i
zS?wNX5eD`RdLO==+%D5&Tho$$)XeMN63h9Hb287ltDktdaMdB*Rec|WyH2irw}7=;
zu<?ysdP(3W-~Usir<ZK%Wldk0ExvJueb~$b{a=xuZIW5{q-OcoG;!p(?XYSzIK0e5
zGNJ!Y)B7sXrmq_&{OnvY#kBSRt{MG-{>-x)m)0cQ`RJqF_3!q~B<_pZi-mP{@7?Wf
zRs3J^efRoDz4ns*VtrAodMh{zN=|Myi<<K|zEt74)vOO(OD^b&*}6Syxv?eAF<biX
z8|96UV~%I$FA1^<oZV_V<NMmu0~M_zXWH4DqImQ;@5#1tEZZc(_O|ND`Lb>E7P=p>
z*(kZ!XKhC6FP~RlH)d^n!#wl(+bweO9Z^}?k2e-`KHt@MhgJ5KmQ2Ck2XYZRE7|Vm
zd~j0PvsrbE-WsWgY>$8c?NY4ypxw6q`UEZMf8FLHB_$Sbw|U;>zm>Xat9<U7H}{S$
zu0EddwQPRf<;R^b_HXABs;$U3Im(}x+!!ssAX&tjTlv$OE~P_@T<Q+_NgSWSU=_I2
zWn=WcWWAeB59%#MxdYdT8t6SPTXbE!B3ajzljW9xEIVI;X8EJstsxsC6a0=o3Og_-
z+4IkagwD+Q3*I{<wk@&_S}gNgBVXyTfk^Sr#OocaPR;vJmFVL)OU*)Z?uwXPb=G(9
zPEK6K5Fh$z+Y>L1j9`g2_P#e;^PA=QFP8Z}XWq1jhpkZU-C}vanAQBPE-~5VUH6NQ
zS#}lku35%(Z?9ZRsew`BJC;i+PB(7qDXb1sXE|&+`?g=p!{qW4v+K|C^=;dB;;7i)
z`TvFgzCL=$uI%Z2(<e7(SMI;z`lf15a_z!}-vq2DesK$Yy5Y$w*UG>jLS5!_KY0cJ
z{NZkJ^7X`Led{&M^P4XScH8m3J!K%>Riofq;=b@ukoO@r)vy`d9aGG%pEx3_y7%aI
zk&s&5KA~3KHO-Mrtdc9dcTShPxg}G~{EYN(&P)IAWUN{yWB)nRZ1E?T1HC`mB$SVe
zm>8Z4kQG!lWLU>3+!yrnMe1j#zl^t&RSVYIPU+8F!RV4b>%yN(mA`y*ZmI3J|IB}~
zvhUo_-3^=n#_6s4yl2PaJ4<ge<t%9}4OMyC@a3sNnnw7|t8+HYII)&*Q|-Kv53{^d
z#1l#^t+oEIQMf<9qjuNSd!OVQ=C>c2_v4ALnuSvBt?e#ck6QCqy?k_em$mnU45{=c
zl|GM@Em~@)3(ICconf<d@5W^bX4ZD5KFWt5n+v-BWb#_2w{v=qz4-Ksl=n|7q|291
za1?p3`8;IZyY-i=TPCQSW!b&LD`K(cG!K!PRUE(74PWs1Y|&9&b%Fne+tGY$84d?m
zsiH~FP0GIiD!AS(W01QR_U_{2-s?9lKIO*jIn?BEa6-FoRra*U$8Tt`3-Ny4SaMH;
z;jMeHMN-Rw{@VY?-Gwa{&R*O9V98m><JbADmmWU*Zp+m#JIk%FtW8=Y%g<VKNjC3W
zR^`d<%I}UpTfrHa|6hs2^C5e%b^NOhInOUQJdZlw;dS#MTig8jXP3*~bIiz0U$dpr
zM)lXX@;+(abLTU^`OQquSbuTt+^L6qFK6UEoT7YjpXk!=63GtD4Ox52s|><+2jxF)
z(SLZS*z2xbxTg3&o~bWbE$1dVl%&OnrK?(H<_QOS#9ml$&pu0ijjceV`|{&+enwyO
zOOzBT3a|P6YC+Ua>C;iCHq5Qtqvs(0^!0<}?zdt;{+OJ6%Qa>8MZq4C9`hEKn?bw2
z&Awc_E_PekY8IovX_oEZF8zI7Qj^?#*Z%qD+j)XV)b8Kro~L#+^Fg}A0jAeni@i7R
zpDh?{bok-xzvk@g`QqlklYP6#&a9L7-L5+?CphLUH#9x<%44!~So=?#GtYK>?VSHF
zZdFu%yn}+o)d_cJr6u<kzwvt<>nd{Z{`pcyz1gxH-W@V8zN)=!+B~<+cUy40!@pde
zbyqc`<K$OlzvyS4wSJ%dL)NT9PG;^mo_Fhuy^6j{pF4CwLG)wPtM<Irg^~S7Uf<vp
zFR@&do_xCbgno0`^KQAHJJMJ1>ugZ}<a}$*<`)Mv(k6TE`8TUFdg=MX0(Y+1ZBylC
zd8YO%sjqi^D7tH+-+FHz_xS<V=llD3JiAVQt%^Thw?vUs+<?{b_nu!Wk3T&*>dv2Y
zwBgUoAFOU)yw6Or)v_1)bHDZTxvX0~ej$?rpK?XTS`>+I*)ZwRMXO0CcCnQkxL-eU
z@8rGLd^;Tv_eX5nCHr%KJAX#x=cX63Qh|S)>NZ*xFtEM9SF=g~s{G!s9y49{yKD|C
z3^tLSefHl!@yu@)^XDvhyY(Ma?0mCTQ@@3rGU_?Dgn7qgPN}1pkMnE@-u{5~o6^dx
zpQqBbw(R=zWbMAWmkZ}TsZjS#WXNCrq-#F+*9VHy8GGgCTsisU8S9#5SLzPU<LZ5Q
z=0yC8#8`E&%_4WjME8~(7YVG2&@6SAU!k_@@b1#W#ML_s^*UZw{I8!rrDXa4KmGpm
zYWFUd`TfIlPi+D3od+wvA5EIlwfk74R!5X9lVIu1X>sc>DPDSA%D}$T^8F&A>{oG@
zE2pp+9gkM?DgI-fxWhEQ`s&}BH|abx!&doUKE-LWiT}{P9ohL=ebL`0ZxOSYyW@z&
zy$7L>B}5NYJktIzZ@K5j$pW(tuiu=`O<LC;G^bgiCw3qA)!kdY-rV||X*lmo#`QIB
z-+H}ov7X%K_Hyaf@`Z=jyt(yiR!-ddlAUWrTjF(|m$X*5Tze`gT`zm<V84=gOmc_{
z&+>%B*~<?b&SBiUW0hg!j$kc|^@onV-!2sT%6p!-dO)B5-{TJ~n=go77Gt<QsYCfo
zMC`YDhxR9&{ys-M`t;OHH_ydBUdAUBlis(!b6noRcirPocIHo!TDePq;z|#!-*#@o
z+q8rie1B67lXxb?YPKrZZ_d^zVRu%4_R(7C|ECYL%(5<A{g^cKc`x(NA2*jP{nx52
z-{c`J#%uEN%Vg7uXZ;Q0SKd7GB-r$$&FX@g(Tg9jZDKbs=#XSD4v4-Ymv6pnN9XDG
z&o2x5B9m4%GOyVcv-9ymlMT!}dmk;IeP(yf52=W|AMXA6mooEW?uO*F#%ViLJr;|s
zdz2&i&Of!ho$uW7H4DX0<_0DeA6H%P{rXLd|69MkdRa$~KB#zdqCQZ>WNLcflg7DQ
zRW2O7)g96_O@xot`XLvm;;Iz0Hs*M)gfq$74-Q4`WLorTCEN2nCsV7E$b~<vnl#Ux
zKDzy6&AAQhZ?Es~?~9i+wsKbW7G6KqCHmqNmh=7}dRP8htEFV(l%C+f`wsh~Q^gZ3
zEnd3cJzi?@^WKTYzTxwq2bXx3$zI;}{Zogrj>^H9ddCU=vU?9*U$f3&L&^uH1#7h$
z{&)3vZ~C{iQSyxUOumoO4@_>%?!1>OG2<BT#F<`fDI5Rnw9UEu>Iavw<a{>1mHU3Q
z744qZGa+=xH|?pH?id#wnxR|bB>Dc)@l2)iZTsC%GOq7BY2?p*^XF={MXS`6^}6k5
z3G!x}9lFY$^Qve2H0c!^r@dnBN@KpUe`&W_lD%T_u9O^?1rCDE%Z`5E5a&Iy;hbN2
zm`aA`vhDX0_FiL7ek*ZfqPfQIQwRJ?zQnxZ^tdr)rR9Rv+!bFeN*1g><PhD+_-4Pm
zPGJ^rNuhFt%;}xS4c=tx{G4#`{hCTqx2rK{r+DazK29*dBo-`Q*>fOWfA-ElqAm}z
zCFhm+)junJaNy|4$<iln7S^jCzxUz#s?zqr)I0o~J~LT290`x*Zgn`K*_yd1c=zck
z3Uw>%l!BH7b(bz=yt;UQo~&#1&-lQ@98>jpo}3Q)z_qsiU#a!#RjE<A_J99gwl~ob
z$cg=YPn*a4Q{eZgDxv6yH}<@g4Jtj@dEm#TuQF@R_6F^Jy39~)E$7DRLEcNvU#rYm
zQ(R$j_9NGfHReD2AN^E+y7yU$x{93b#~(XC^fT`|EdO^}*CrjY52u$Nak(gH(ev$R
zo&Emj2fTRZZOUl8v-ZK)-8p_+13hEev|i<}TIbDjQmMf#WNDNi|1txH?l~?S{48&q
zo0p0UNi$zL!N{7oYtG_RGwv_r%Q*D+jZks!(+~$0-jk)znc72yFKgwWIv5wke`C?-
zXj>Up+e59HT+fu+il>A~Nu<8uVXOMSd%cf*uFmwUQHvJKmu0Kia{F*ZWh?P0Djsny
zp8a;Ug3$h~_4}9cXk={e5N=eOkvZWN--<eari`T`Q-3$CeXrS&b^CqrN^!jxg&gnq
zaeEb5+&n3F`KWrxl?6fJ1-IB`{v}PHcl7T)1@==X&%db4ud2T-xAls&rN{YOLJkw+
zbyD{*F&w>HbKyWlcxkWZs+cCvsv8-Xm*;<;_3Sg>;?$M^hC{})XSL4o{ZS|7cq8Mw
zqQW|@|E#ZLUZ*?%WLk2k-v0074<{!-+^qlq#~1#ES?g^KpLop(P*A<j_f+Wou7V{Y
zTYWX0CNJQ+d&}+oJe$8(Rl8>_@cp85gU!l#sR6?^fzzKSifF#w>+pKX|48ri_ZGPZ
z>pyRacG_X2pq}KXmMGnOA|jYUDD{Zis^uE1<zqgDOIVur7nvNN^|I;TWr>gHSnDee
z2QLbG?x-4kJwS1@*H_+*brtgUOO9;W|G?*^V$=8KNt2o1q*=dN`^)hQLyzP1%Xt~h
z|0mpV?6Fuiz2@7OM{hFOlh*$F*gAQ~zlq0go)f#*ACdcwb23M|Zr;q|?uVAo?8^Ml
zA2-?=S?IX2dhH{g*Vj`sesWIB<~U$=+y27liK-WOl{xsXP7;tvD;L%+*3#X6CMM!@
zBAegmC2jjtt{11}XUuu~>uTDTzmLn0yR%p4f7@^U=V3y6lt|9B6_<E>XKyUEx@qxJ
zcOj4V#^roXY5oV_=@o43`|Ffn@ra9!_iFj0#l20Ysyuc9EE$v69echi!NfUZ<(XYB
z&!;YZRTR^@(CpLK84{V!bF{M6?>2Z%?OXpmrl?oTz3_*o^MfB+OBAR3GP|Zo+q(U>
zJ{)u;(>2rCdre6=OMBM|a}(i>lC#n$KK9q0ZJ@wp*tvR2&i}yJFI%=RwG7^xG_8Dw
z_Nx!e!k9g*PJS+I5Se#Sb{?bZ{OLEB#O^#Guas!L%tTrxE4Z|(A(ziXF_67qq$Tgu
z*U+GQ9o{Y`JF1W9`xN!;-F5xz^#sn9Th=oO&h^Mrb8G&w&`o5O{Bm~{-xr=t)$1l^
zu5Ri4nK4)B<Lrxui~&+-x9xmCfBR1R5A5$>O$}4uS0Aq!&#CF<zw)2CEA!O$lX|5~
z{kwQn&)$%cJDSV(>$?ZP^U=25x!bqCoa5uLcxCskuXVqAJzCoiUhD|VnD~dkKO*7(
zm#B|ib?g7cv9DR_aGu$pcjvvd_nqMfgZ>En{hf3*xpOxM%OWACyYFPAe7>wIjLbeL
zIdSh7c?+@MS3?&ckejvoYvv0-&lkmJ|GB?wb>4e%;{EpCm2vk^y?cIS+O};ECJP_i
z_^vvC#kP{9p0ocC_`03ncWQ!XnAtkdEpLlsv!XW$s!Y6EZr||Z=fyx(znEPIR4%w2
z6q@?yc1LH%>Ts>s3$HJJ$-Ugg!lr1OMk?RQ*F_U@l2@1TeOq_ux03Y<54W(amJemT
zUxW>>JQuGv`XJTO-TYy$(n@P)KkhWgTN~EzT)lnjE|)`Ft}lx*uW~)GhyRkp%GH~z
z0!~QfH;LGBXKZ#<`^-CYr{+`JMHRZX(a-G)4R_|;77SbPe!J(?B;oamyKD|Ju!J?{
z@;sE>%==S%=jn{>*?S$<|4=kfT~evo^v<@j<o~V{$6kK8y}jN2yt815)_dOKSx>Jg
z#@$)EwD$Jx3$jx0h0LQlU-->3cM!Xm`dNSeQN=?>Jlb;Y|Ngz?-~U<3jwwXYp!2<6
z))j_yF2kG>)15DOp8vg-#riheChgmPr*1kQ+x-36)hLsNFWUoSH?QCSTT9k{#;1dI
z;Rh;brYMMOGWxmKe0#LLc;f5@>eXqo(zcf#__g#2=TFk{fAek6iEi!WKU?NRH@=wA
zXRtljex~QTPu7p$c@(VS*d6@WQ?;$uGW*LT<9AITmL$#72=>3=FXWSu;_ayHDH7a#
zaMe2jHLKFu2Btg*#2Ss%O`DGCWuJVuY&QF{Ju2QQjFWbmIppnX%VCd@zRQ>t&NE@n
zOT~p@iY5II{uS9(hd%M{TD&4g#q><Ned3Jt5|5xF+2vOZ#df82%Ip`5THr8cHTRj>
zmZ{ZVvpb!F-WF<A-){?%^|<wKF4Gmw;D=0iyP_8-McceG^lR|Ceg0X(LZg2>P2AUW
zJF&+Z3wJ3p&J^&UR=jH7E}g|ceCAe&b9_pj@cCC3mxHWsx9iM>pUw4;$+T#)JX`rt
z>tIy&34Puf?pHRP?s=DIs;(U_%3yVM!aGh4PtAKSvsv30bcx6=P-y=8D%*&Cu7Avo
z6Z0~f`Wxm=$+{`}BF}Tj;@etHT(xp-N}J<fc-g<b*Yxjz$7VJ^#;D$l@?L)zf3P~V
zKyJapxEYsr_XwR9oh+aep6J1Olr#9Tnqj1@nAIjb*`1*;C8sfqibNbqR+uHlBjeWD
zTasS(=2nOo_aXlK=NfHo^bZHCKUrS*R+vfiug8Mj#~bh1GQ@v)bF#Iy<+wy3qm4}o
z@AplKQZb8}+MmA@^)C7!{U~S_%h#=wuK&Gmuec_4NBV!QISzZLOWke@mwd^%`>fOx
z+2&l6?WYPC|8jbITK)Z!6xp?M0+KIlEEmV#yS)3l_5H8U(?5JWdg|Uf<CN9>r#826
z&(@xqxYPQ@O%>_lx#k<9PR6!phwB%K%$weky1sSFq__DmcRZNH5osBB?nX~YsN1yS
zU@vCx5J3ed`*j`R67Q@ZNHDHnr;&76dtu%5tPSQCC1O&Vd{;HNG$wOsTcw{cFu!D1
z$arUmz=fEDO&u1YNt0PsRNrdPjP$v<WRg+i3#DoCwNJ8U=&st_vPk4-RwyUa+)26z
z?}fP5J<<?uj=jA0A@9Mgm<1P14K80VyPFiah5Pu*6-iN?6ZZ&eU64%A`lu$MTi`UK
zb;0{7D;s0yH%!@m=%o4&WzoG#mxQnKt};zHZO3a@lkP6x^3I3L_Ig@qVMB`!SCpm?
zbG{FUQE&I5?rniZZw@Kxo~%f`um4^7!UCrD<bcCn@2`hOcSLq*^i8Zimc*Su?Q`(X
zGmNE|+6-3ZZED^6t@*ms%DFb30f8F~5{e8aPx<1I9TXBiYh7LAhUK%XpL<W)ue9QE
zIMeLMH_O+aKKP04?G~ZC(FsAU>=xB>iw|pZvcxd2hz!4Ix~h$Bmw%EHi?(D*`TM`E
zn?#-ouZuO=SLUAgUh$^Hg8ltpjxRcOq*)@g%hdg@sD3*Coyxq}X;yLD`5v8r@0egS
zW7l2-+ecAaJGRSv1zqcNNQrz=wJfFeq3iWodoSKzv{w6R(ZBOA+MoEZN$7rXvv$$H
zHBWENIF|o>hhfMM!Q=&tDmL$Zzw24V|K{eG>+~y^D*bd|YJDIsd-Tom^(U>h!u<a6
zSh8%++A=5o>)zvf8?S$Px<1A4!s0b|Gp3aa)UVin@w@0Iw&iwj6RKxVzPMpySY7db
zhC>TxKalOPWiK+!d7x{uznLR&m*E7re*R#_gWDYLmR!HgD(5d4{#Eba^N%W1KHLi3
zUvuO~1@|GAH&Si3e<j*Z`mXo+x9-<dWr=A@9CvMIFALqf`YhY;;9QFtS0DXiG_X7)
zcvQw~!M@LOa*?Kvvv2!zoV@S4(x7}V3&&RD!mCjeHwtkdt80Jld2(%Xj6j#rB^Adx
zTRMf-FBXe^DLQf5{h7P|DDs|&kImg;yehv~eD<Ojig!1B)-}tk?X916vQp;P+*6g=
zVP_2Dqb;p^MYc7TPFC5^zN*sO_u{wRHj7uVe(hP1CVWQlb@R{u=jY$l73N!e+p((L
zcmHLv%UaQ^K6Y8hvVC>w7Y?e%M!uBDjMKMURlH#CBK5Sl?@D*%hP>Y$D}Jp~^}brn
zg4m@i53Q-L;Qh4JDc|6Jc8_PBL$lwFhY21*d%akbt^_A$rfhScen#44S<Zvv%!Icm
z|Ls!S_(nJR!|F{*8Si)RYGDuLb)LrH_iu*U%zYoPtZr1D5OX)Mea_lI2cNbzed|tG
zO0E6JZ<6eseM8>my6xI`vF1;*oY^;3EvU{;2*`aA%>M35yG8DSSy9~A&gfMOyqtYb
z$mm(n3f<mY%S{ASRy(Q~=<HrweIcqQE9{Pr!1sHT9zW$g9px-PS-E+2*R_i&C(TUb
zIvw_}PW+;Dc(wX5C%rjc^QM2l=sPRuBzMn~{R>~)a_T?HwtXGPRDZ#<O}_WSdykAz
z<%)I36Q@@`+pYUGSonNuXT_PlZT!JC6U|sZS!F5-y<q2M-Q;8>>y>&h<5)q9&$<sn
z+vcTR@0hsZ@#~2j)9%%0bZ|%3Dx6&{Xd}bNwdBL0mIANEn=5))Hwjw2T6DAf=ndy(
zPP5+emHY^OEdB7s@r@2wTH|=qmbIMp*dc9lc<Ra9i$9q!-n;Z|*YCRjyO*(h{awJf
z?Omdln^2k1Ps2soVN7wVzau&YQ!X?7Y%JY&d-0QrOt%l+o4In8dineNe!uQ|w#g=!
zov`0q;qYFXeZt=*I(Lm%O>MACc(?b7SVmi<$ZW>*v5kM*ABDJnZ`o&gV3D@eSqbIa
zH!h#d%lel1idBN|>;04+Ra_<>4=!}+MW)vMu$X9_wcy9@r_Ah{U8ap&{{?L9kEzvt
z9k)kKB5s{f(gme}`qO?-Eh5ZJpGdEcZoCi>fBV6&vraZog0Fl0c@x%tHumb%BA@9T
z753}bXRTpi*i%%J_m917-qMpk2I8tFO%AU)wr^T;s-)!LlcNkNY8(u+r_2uBbxBkD
z%F=DtZn_?Rt9J2Zbo$hvVclsMIJNdck$efO(Py~@tPl8474AAVIdo%LMUuysSbHr4
zL+*K}tmGGMToJu##hpa$I)#)k6IU2cb5gz%U2$<=*5TT}ORH{P+y6}LZ@hi(o+{0j
zqaG_2uiJ5|x|e-)n;+vO%75In{Xci#T=siYzPe4%?yAyV+q>fU$(kuP{GA0nAqP*0
z?cNr&Vv^9)KregG`{~XHPN^8T=5Ko^5YU>w?xKpDefNwbzpRyY7CTymWaQr7D7hkI
z(br{X?5a+@o3*M{WRAq?6+CtOr~Th~_tBOJo#0E$djDvj_jq@3|BE?C=J#7^uMN3;
zAn;_>>t=s1A%jg5?7g1Y>9y3yPF!tP+WnLHvHbJihuqN~zce0f6`geb)pf4GhdwLk
zW}PTKnGx;Gej~fhdiU|YGA>mmuXAf3S5@{{D&Nz+zS6fhqVvp_e^rfMnP(lFmS%HC
zF5UY1!nKO~Ugbdt<jh!)>u+H@&TBHS$h7r@X+w6j=B>C>0!!5l*8jg8)A*yP#^?G@
zwLq8F`uso3j=N_4mM&<STOOCR*3UhB`&QlCdqR!c%M-tzez#vt?cXHp^}kBb|5bly
zc}1i!o40fC6t)w0woZ}SxANdFzyJSl?>RF?thr&%DMyZtH<`9Cx%6Yc*<3e?jAs6Y
z(aIbCf7~4(#*)DO@aBftuKtMs`<DnLZu?{W<i!4;e0dd?(ti6k>)-yE`{7I>$C`%U
zf|?Eswsik~sNyUB!#m$sGVyYO&4g{yQxopIO^-UcmTlE$t2ZSd7qdKiRhZ{y|M$yf
zzb|_>ByS9zuxx>UV3Org&xyXl;;o^3&c$WRG(WrbP-6mD??C~Ud6|1RA31UM!PK>)
ze1SX$Ik#mKHv7NITKU4<I<0ldmSw-pPu?)EiP7SpSSNX^)#$ToNCek%qcDz$)*1hN
z_xL;y*=*ya*+20}0)OOFY4ejO{U$f;`|5T6>{7NxGb2>X&W5h5Ir4*7Ya07<me~sp
z5AR=e=VEx#Q<nYw8@*r5fB#iNm`m8nt3~led(4}IFU7WZ*DU{|<LkF7|IlAv%j5*j
z(*bhnTf7ecKjyYN>Flm`MtqBeN|R;f6Q3SjvqJLEqSTu<ZlC{$G;h%Vby(Q%2K$F&
z-)n^4PcsZFdKPfM>y+vI{Xw304*xysbdcv(r-WDAG|j%73}3(8v9P?UENjIyZNrf`
zfvV@5p5#dPz1hkrBdOdz>FkvITwj}gy7mY+i2ixS${P@|hE@3q`)Tj0m8VuHxQj2n
zXHZt^BUyeU-KXkq_m{sS)tiLQ99;8ShV`_rQ*%&n)?9&_?B^24?F<YjPw=Q&utj5)
z*6uTVrOwPcA7<6fCHFCDuLTqTv|wJYK+ZRp0@dHARh|!dW~&>_mi}rrM{fGAT@M${
zuDn@U#BU^}A{#$9J>=06)wr0_46jDXsp1-W>FZ`ju>QJmI`9(9n;2E!wBuIXCP)4%
ztv-HzgO|n?=Q#7y<G%ZpetS$`YRWJ4D$U|Xck1&4a#iy4#a!e59*C6u=qFNdS|hYx
zT1EQsl{4Bk+=+9_;k(q?0u>ydbB3)rSknJC@@VCr^Yd(e8vRR{d(vdl#VsdJmQ*&Z
zm~MV@SLKQ7)kQl*`lWZq%xZe_TkD1K#pXa=<=D-QOBV%2d#iI!UC(decEM*6pYWB+
zJFLq419w~sICv{jOyu=Fz8!NeuhDU}*E+<w;g{UBZk5Fgzbv`Of0HjwwEhHlaqbjt
zCjPL=oof=)b{U#;*jY`j+L`xej$6rw^*?8sRtTTEbeNep!i_P&(p}1eXPruP#OEu|
z6q9cS)Gc~8U-m&~y85KjpwpEtsZ%a4T;(R{vnx2~_%5pi3BJF)>!u6&b3Z=UA{HVR
zqW5I0S;hMYDsxVHXIwktm-_g+#Mg;W%r6!#Y>;5tdLmilYDq}O)t5Pe_l>!}>dY1R
z#Sm#+_GSVD;{jzo_MOEij!iqaOW8Q)5qqquyRKn%zz^p1lzH1Wd!^orh+5#cZ{l<&
zi`h3r%sX_qooRSAN$Ez#Ds8Ffx?%jc`%dcozHPK}UF+2;E`1B8^W5SIV}B*(DKfv=
z;<&|=AD`3X>uviEi+lIl9ZY+D^!f9RTjyD+xpd9SJ-*`DXLsLcGb%qF^_#J9c0%i{
z6hBEdVR@J7sk82cY~i-NvEuvleM0A)>(6_t|JSxr&$Vu{-<iO?=i9ZZiL<)ua_1Pm
zd)Ug_^@7<d_G;?4K7pSX?wmNCY8L4ly-zOS=*9iImz@LHvt1TwFu#~#=Ey7mIqvF$
z!};w$=C7~%`>%krEcax^Z22|4m#3zS`CY%zbm0qo;+|_<-^=?#u80NiZZlASxbnhd
z2Lm<Eq_4FXN-8^ames9M?7#h|^Hprf>+t*)W%mQr&7!_(REPXsk+S-osk_!xmdejE
zH%>?H5|21vm9?w9_crI|>}#qk6fcL(DegP&wSG;7y?Nd<w`+^OFX{9MWNdk;zEyX1
zPGYvR?X6vk8Zm+uUVlTru|%$y`g&lajDTom=W=HwPq8%>`z$LeKUnQ@R&ElJzHN8q
zhc&ZP*#Tj@Ls^GH=bjPccy-|G!wofuWK4B_=WLJqn%E_BHJ6#6aoeNVt{09|6&EWg
zO)^Y;asK^B=C?BUFFnv-u=?+uiq1c?^IX_oR^HMJJ7?TBSyH^Rug=#ovFY)o4WA5^
z?(f)jGWmR}RY=v0AD0rPqt^!Al(zoWURo{v+`~ECveB_?YV8azms-8c`*k-56_^<O
z+^@GenuV!h`zh5~sbQ-hxiuKiI4HVpTM45;*6j4W6RpMDSTbz-g1p2Q@2Q@mX}jyB
z=jqoefrfEn6HSh+5j#6!$1O(14DZ)Gg`2ms-U*qYZ@3|M(l^$W(}zzxJ=cAsu#R`_
z$3;SHdYk#;B0Ts!Us$cVRLz{wwvE40cZ&Cn>EG_TT&uFV%>7EqikY!f{@BFBv5UVg
z`xf=Nq1tS%d7R9@FRv2VCn|4v$GMKh=Zt}65sU27>q7sQDjrZ`p6qOQ|Is9w%nlB}
zR|5Ke`OTR#bhK<1nv3dJtoeB)BIcK2^LjT`zPF_-!c4PXv0AO#-t|(<?5FP&Q?JcO
zy0@+}RpQ>WoIAL}c)?SzlCtQ%&GWglm2{q6_wtzOnr1p%;QFT!rd6$lRXJ%+yYfGN
zX_cM-0(3t7<Lml-@%w6vA2fw`?D@)fr_K3fO4TXXjlLUMx9pLg*xX*tA#6H7Vp7!F
zvewl0Nx!9A%I2#@`h9Mz+dX>=<Ns|>1Krf_G;5lRKQ1r4uVj8jX0G+4!;6<qj8V(n
zdSXiD^cA@)ue0R%Zd$wg>5o~@i;iUrnEx@AW86}iDZMz!^vkWv!|(H@D<oADOw%9S
zKUt)6ATQ*Gg~_*v1uuRy@86nz{>#2!cPAgb{#Um0@70sr>nlFJImzdAaK$f1)~Oy%
z`rkiJ%KfkLs&>5s+lfjygOH6ioYO8^%v^kE<tmMd8;>oyq1!z-bjcbuHm=_->vlBQ
zUdYckSbtHxH|g!WU-MGhgyv54x_W!ntKT-Itg77g4~5>DcSV?7_ABVms@f9Txq9uR
z$&0)$?wqEPztQ9MzWdg)8!IL5CtY0-dF(-r<Sw3s9Wmwtg_G95wDMIlPxg*$c(<f)
z>9ZG}*W9cxc7}L6)c02#gv{xvUi<rm=}!Z7@p(H~M7y;ESZ97sFP?tw$drr|0yh@S
z_o-r7Yx?9^wA|{{rHWO~>9Q>Q?jAV)#hSl${Ra1coDZ~<UR@IVw|Cq0oj*T&CxqL~
zx^ye^xGkTg<N4Da!v0$|T6L{fU0Na&-_H_m-=crvo88e#KUDT?^3It5xhC9Vd-uCD
zH{Wy4UAZqjt~g(PpVO56x@(%&K4m)^F1^?Lannw&J%P(*x>}?(?tX4i)a*;n74V#X
zU%tJf)1IF((uK!$-8whU5|!^vvl<hY8$Gj$eYN@1S*}T~@2z;g9a+F^qEmPN<NDp+
zrTdO;=CpQy+x{WIcqQ|N$$gy}Ra$cFoLTb>!j%~3oR2sx$8~NQLw4TsuM#HiY`?CY
zXE=T1hR1zXjUThmov-KjIlb=YPo{_W?{9zmk>Bxi+T*`ng|#;}%$vCNbK>JW&AG*?
z4iO;<SvITIEwO!Dyu6Pi>R!S#bGEN9!tVW<eCuYrt117sNB5O;_I+zwlGJ>l>3Z76
zB1fYz#Z^zHv%YY=!lPj<l^$>~|8Vt>)fwsil8x6H@0R}8coC2zw9E1JE(=ppA*VpI
z%{iBNo~0~`NM_vkc1=^$dh4s1N3N!YmTcs@dShzXEdFo1uWd0o@-*Oz_jj>e*+si&
zdHs>CWSm{N@4`WGF0Q1Cy=)7EZ!Bawd)aa2IsNMkN;|&E%t*X;w?Rp8nf0l*$EGiu
zv_8DsSG{I&tAD4c|59m|kdVb}r=3gK3)6NkFyJ_QLt~?K5@&Q>i&cuBwCS-IyI*|P
z`W5`;*V~Kf((}U=zCN%oymMFE`RQkekZqcl71sNFPo4TAQpLu5glqG4rB&}v{9PFK
zSZJb7<n#Q4%@Ye;9(CPnaIulwVJjbCSitOfEPj#WVXq5TUK>{>mR-AIG*ia1&hl$Q
zE9d2S?xne5v2Tz4e)TM3A$Nwo=u}IwlNpwQa~rzjb)?ob8=T(bSTZGM+0Q(mqvtQG
zR!i||R;T=#^!N(9_g=oAU!=`m+`hi}a`WWN!kbUXXE!(9OAP)mu)!_-)~p-3*RRAR
z^8WSa3H)PtY(+(s-8Gq`^ZgShJ?b~}j=s~v|M#QLqWYz*zvQ!@)GkRq9=a{(e{N5;
zrWx1bAdQ>%I;UQ86Bk{!?WIGzc4phouy5<H-P?cSmh#0DY!%B}+t0g3|IUsqjgJ1z
z<l`78m}|(-&)c^473bR-ZgUqM^VoM_*TgIAfBjYn^S@=VeE9j%s;J%UC0FuhewWhk
z4Sgv8=$~Z<`|mQvh5zj97T^8(_j5)0cbmHWAAkD4^R;|v|GeYo0q4D$%_l;lF3pV&
z-SSScY)4XH^OM8AH;zlJ*S7l4*>kO){VL<kKb~LN&Y%3XI`QA?#CyKq1KW1?MO5_u
zmdJS>8FVkCzHDCN&yNMS=WdzCc<*_n`{eBH|An4Ux*TgEdM@dEOxBkNm*u<`KKtu@
z@-5Tq#hNdwrg*fn)Wq(*t+^pZS#axu8GmFhJ`X%!<ar~ui0SkHr$0mHpYaeoof~WY
z^TXGZFYjHvxW9d=PVN7z5&s~lB02Kf)Aipz)%WaO!}3H*ZFASuUn*gr|Jwy$eDtM$
z&DM<hld|?`*eorXm|p&O`MfRrXH5s8J(Vk;o;<wPy|kxXdV)5ua<|V3lTTJZ<TGSV
zXB<{w{+u-FU4#Nd^NN^HCSE^-A9nm{H9r$kGVAOE75mLyLCMQh95-(FR@)gD=gGLf
zb#D8I=)X^OZ=ASX9V#|E>-IaLRZa``l#1Df72eS0V6dojvWPm)QKI*O_q~QC_x}wq
zs(!Yy{EGS-l0A>T@q*cgs9kjoRn_dLd8fHI2EO0@anroKzl!gY4_z^taK&nm_Q9Ap
zxj98k9Xls1-}0CDvSys1Ox?``al!3tSz}TbpIR~Rw(^n6Vt$r2+%;3pI-+?WA3Wgy
zvz@bkl?%^>Z!=%6Y2my1blW%Py`>h%m+mm1|3NW8_CZSoQ*M{5(;S~4hgVKrKjB`|
zC+^4bFD=Rf%8s4hv}BjA)HcS(vP-iZq~EZty3N8f^>oZalLEQk)>kIl9QP`go!TGJ
zHHRV9W%_q9)r}v09PG39U0Y&!rl0Sh`AxQ|b8GgUyeWS8g>PADuj=&o7Oso^w0yQq
zdvKRCtbjGMv*U`C8ROcp?sKu7g@2w-n56p3=poDU$}0DX2Y<u{X~|w#DdX$uC8lT~
z_F%C|x!2cAvuCs#<V?KqE~UFJTdi!@$GDlC&p-E`m--#-G9^7O=~iu1X2q6#&)sJu
zszswk8&_=ZymCcsiM)2@sjX{8{#?&1aZ5V7==6!n{8Me@7xEmtFf+-kRwbOXse0|<
zh?{2D`hL3c1xwCVmU!_XqPqQ7RjjwNM?l~9{UIS|@}^z8e$++2f_I+Y3LR<Ll#+l0
z`>$CtZkhjLzstYR(!YY+dOomJI8>az{qgzL=fXiIGtMb&dSJ!Uz$#yAGb856#GdjC
zkr$Gl{4%eJQkI%t8^z9NBcfAjCb*+w)4{xptY1yVjD;7n$sBXK^W%MS&P&&zs|gJE
zj_3;apFOmhtF+^urODjQY3(O=dAU39e7JDIyiG+K`X%!;=Cv=}^CU|lvQY9FZ}U{!
zV<k=1Z6_Tar%j74*Yq^eei5h65vUXr7U_GAd%_ikGlu`CJlI}R)+EQMwsF~<M-5F3
zE!l5UVvq0hdHLaiQTde5uP>)@nr`qky|g!Dqu=93fujzG0_-<Lac&oRD6Z~lxiD0_
zcuk^f;PmQwy`HC?pR=k5ygz6zz98{gM!@<A?(QW*Yv!MQ!TVO$Ny}%-iqN?SYfM7R
zO&48NKH+{RdA-4E-Yu!QNi(-y)4Ei$iY?p2Tw&jb=Lf&KaF+O=>U^aY_exw(<<<pl
z`Ow36Oun?vwK(K@GUein^fix`a?QxBTse2y*`jlQx6a;ms{6Fc`>dCYDbe{K99#lf
zHeU7nd~MyuIhtOcE+MA5_A%FAwg+6Ce^VerA>3<~VE7`o$fc9#)t#9wQ<EqDfAxik
zKiu9`3@z`zt=@aRU7yd-uRKnk{X_1YMdhnKjtG7);K*LNM)L3FECs$hB|;+o^&2ko
z{rJxi;LVJ5Z=v?IHj8*B1_nh|1_pdL(itTsf^RX@E2yjuiOs%kAX58%{f-Ijx3>s-
zN;I?m+ORB@`}M6uhwL<tYJ4lzRr7Y6bocB1_g-bQEO;+Bdp;>XZ~6U2l<<##1%I=v
zw2MN-mcM42D!kNTbBjOkdF?rRH*{tl@G@WTW)sdQw)tnfrmfwfWllfZ!n8FuIIo;N
ztLvcR`o$|ucD3nfM_-pZV<b?zxR-g|l(IXVYjZ?+tKV%Ed?mS~^=!a#D{rRFy668d
z&??(%f9P50eoKbPw_lguc;|5N{Mq|5()vzPsyR2FeLw8G?N`y}U%U4G-qX`?Enr`6
zYmM-ZPxXBFxt?AyVSBmr@S5+@fm6Kma^Ghg{_t|syPPWWLu9?6o+4kZ?xVWR2PO##
zdF{~g);aY_rfIIK<v#vzJ8O96%{%w-z^NC18|N?Il7CkJwpqrcDSJP%KNIxb#Xi~0
zbzW(P&c>?6d(R3U@R~Z+>5*cN-(f@RMrnn}b*~MC-%GrVV3G(`?+Ig6(Ya7?U~brs
z{3Gi*bKb3gKm9|KiORO68rr#?UpAf3Zc#mYY|=eL>(g5gHd&vuX}V=Ft#VqR;m%jD
zEq!ID8=ah~vB&RC@#M=f#{#mLEuY>{jy#^)ZRUA-<I{xJ9FN4<qL!LDwtEj(rJ5}{
zw&wA%o8k{wsmzN%qQ2t(p*)rHCo9g)xppbZ<5qu5%hj8bwOeXe8|+VDKfWc}Lv;C0
z^$)@eFKCqoeB}FU(facHS$;j;j7Wj4t9N`VKg9awdh;dyH!8~?9(r`~`^+OH?Gj(y
z=WjoD!SZBylEllk;oCR3{%XB)%+ln}#kDD!5-Lx-bo~1JKa?1#e5~8_Z+5cz{NN1q
z^!Za^;we!2R3MN(jq#*UYc}35iN2@Bu9>#B)&_J1zIh$xGp$Eu_v`)lr@q-zD7B1z
z@(K6nbE@BMRr~Pw->>Um!k(<q@e60wQuk_1W1KHFFWka5d2<Gn_uV}bA44oHW}mh9
zdHGS$O!ScXmMF(YS+BcSN+e`HS#^0W&OWheQ|a1+I?RFQw=5obWgee<;S`_5wMeDe
zxt0IeLpL7&%P~9r?=yy!t=A_d?Pg|uJA1#S**pWOvb)~OSA+|=XKM(7)8}8`ZGVb3
z|Jk+c_nwZ1YX^4Zw$@zT^QrzDB7NT5wn$_8om=-_{Y)^Gl=K%5d=R|HZAXj6lq$LJ
zvstH!Ob9rX8krP0ZMnc3of99eLXJFj{_v%Ot2)f>{r5jM%W5<0Zf<j&yyVSPdxQRr
zOXdcd!Qz|vdR4>nw`{j$ideZR$m34?*-W!E_X1{>)1|U*k7Sj%sx}0c9?B4PIK*_8
z?M`NEe(Mj@#<Rbw_BNz1S$1pMqBUDoFP*kqFE~v^+PkX#jm~v8?spcSIkXN(Jd1Q|
zKN(s-@3KOX=Hxk@hh87CGq*gO%CppLLU5n$q|%se8Iw(9qxr&4w253(Wk1n=^Re}s
z@HFSFGgf(XYQ@%hJ^JZd)AGyoja!j>->Wm3y1H#k{(5*s%$sw;{PuLN&)nOtFT3kx
zRXC@b$zG6aZ4$fa`wRWSGwS01Jh;>}jWuw0mv+5sj6=P(#@{o2MN)b?ay6SgeZo5&
z@Bi9k+V)E&z9VtT_NaS@#9oRANiM%o;68oQ(!>c<v^QDU<~;nE;PL2h%3t&2d3A0J
z|1zVNpY3iQcaxYH7~~10Pg7j!bB&;9COb5JZpD&5O(5y>`MlzH7eVRsA@=l{3Q3<*
zA7d;n=AJ#j?8^_1*IW;!qt-4sz_&CnON*_2Pv4?TFQhiD$%)N2IPGwy*NksR(5*uC
zEt>*O-t4^Ywj%w3*fnR_*E*bM%xwNQuex#VA3Ui}Puk4NYHwa&oU?}`bIOLa*Z29&
zZ+<#`_S5TE?>;LrMLGXmCi=<u!Kwc@>$RsiUzS+%Tx|2LT-QLoom=;=|9mjqsA#6%
zq65n-dJ8xUU%a+?XU?soskpG^^rj<=bo>==L{518J7NCm;}2fGWcjwH=id9Dm0rKE
z{n?b;tmb)Bx;{bf;u33v%-|=H?Z<>xo8P)E!?-3SQd8yK;b$f?o0WGkPI|hF&-mfO
zbZZ$|uZBghS}tliw6IF??zqfVp8LbJ@$28Of0^PYxE<LhlCo4cFz#Ds?}jDUBZ90`
z(s!Cg6da%F9w2<o=)94ZT6nGP@|ll=)GUQtuXomF70o&=;gzefT%=m%^^Tm2YMEBs
zWY$dJ)m-DvH=%#?^74rFXWGupD7|CxTPbGhk<Z;fIKD<->3z~Cb9LtBs3;!G-;EPC
z{Q1ymcXMCpjQ9<Eop0$a>3V!e_(x|zhN$(5iuSr0hu-{t#y(wai%!R_(3qdn51D?Q
zc6=#bHsx|b;>QQCeUf%L^88wSK05iuoG03bJzv63N8eER>y-7FMe5xPzfC4QlZsr$
zmbbfC*hoyOu#fzIcH`{%ffz-oe*87rqs$Bp`#AAe@#csmx;6A--fc6H+Uwy0C!1A{
zJbSY!T9COmLUz6JtTNW566ql41xvMObGUM;q*~YS_x9ShL_@BP_jB{&fa%ZY6<1W$
z`pWIQ_t$XWb4?HC$Ej?WKFw*KH*voAw08-A+WeZbjl!R9es+7VYQEa#?a6<Bb*?FM
zuxk#Sl(K<+;VC9_VeT~?O);yRR6OHudO1%Lh@0XSeP~I@w8(W!IGfUZXI`FMtGDxx
zP}+%CTS|0TSXVQ?aB4Ul|8Vo_h&8j+O7bV1O*wo?eZtL^7tQzoSQwYXmHF@l*FH<p
z%1_<NTuYN%T8cI;T5Z2yZ_>~8-9MK<o!-B>;lc8o`&RC-F#qx3-^+bZFE#0zKKQ;e
z?WP{9;{>iWAKy2z&N{Cy_M|tmPg%q8X<kd*jolmK&M3Is?|fqBsl==#FL*w^ZA$&;
zKQk-7EV-t9>EWg7`-)rovUA@huM#Q|xoo`8{oTPMxrX1|&QG?@XkO8m;k!9Jp~a_2
zZ$Y%#Q4Qa?mDygCLPYHx*L^v@?cJ<D@BHqByy&`X=v{Uy;o|S8|2uj3&nq|GDPFt8
z{ZU)Oy%XZ93qxPq-B@LE<Hb|HSz5f3n|pR~Jz39N`nGEJ#>w~Zx4+qUa87y)r{K~l
z>3vxp?fTmvhqS1K&svg^8|(SqCnRB!h1{aKzFMrCcdYeT6LhGd+@qsbkZ)VV4xfW_
zm;DeI3CdC5vGHQ}tK%nsU9CFaV3zLHn|f;&^Y+~ubMCc?NBvnFBp&7X%-r0f<(0AG
z<!CF(uJybI1v}gOgO;UqC?-`G9Q-bRRq~R7nM)^6bi$=2vrD%xk*f}pec>8&c1NT5
zV->DKyQ~69AMLe<F^?nzt8Ax#uHM90!!*T2Np-VDA+KeF!}`Xyj|z90n+575-gn2n
zTb{ps@9d+g%lMu>e0O>Kvw5@Tt|~Z{dqL*Trphu&&6sIkGQ~@CZ4GV)KQGcQ-sM)p
zZN|lZ;NgkSZ?v-%;~v(pP!#eJa8gUR%)NZBZdLEqJw1os-@mx^^N~AEEN698By(2j
z_L;XosIQ+TskNi#Rm-PY341>7yP~+h_~G&mpDoWw{_1dYTCM&6`?-bx4)yGHpHa3@
zXpw2<#zp*Bm;L<O6=T2V_l*yqzMh^IDiO@>ULPX6Vxf$=uh5=oqhzbko1|>(o-ImD
za|z;^c*gqCg^vchr!U<7QyhE0BGhX8-IN-es;|f6J}$n$zs%$Ky{rEY-pHAD?@r6d
zUr$%$D6~)Cl<#v^Z0%0>OwrqioENX#y2SC&PG{2unV^n!e!c76o^Z)eycc>${LlR-
zabmyiJ$#@2cX{Kf#r2mPwW9j|QT<0gGXujR4*aEnB~mF6axm|<g}~m|+8s|EI5+Mr
z6VMT0w%yWqo6UDOYf?${k~Rl#WpF9*)S`aBv)8sIJ7RMJ*YIugIlree|5@R=lYgJj
zUjNv7V&f)*eP<ml133(gKka&SQ|#FE9HF_Bcdnb)dm~47=NzB)$9@$0PK#EMKbYlO
zbffV~Xy?fzjQWdL80=EXjJmSUY{D{^DO1h*3YKnp?3a<cc!lldZy%n`(_U!S61~Yr
z=B@Y11Ck8eCOr5!{l`0HvD4c)ZbzmVM}B@I7*eP4MO9{BCf~*o$7wk~-+oq_yFdPn
z{hhih^KK41UZ&{lPIAHbf5`u>Z!JpDV*XLtvGZ-;B8^ij+qY>}-ksLN&N3-dgh5ol
zagUNoz`kW?6Zu%nyfhwOGTElkEy!7u=J9j=sqbB<+a0n@m2CBz|5vw!c`iO{zir)t
zBb?Tc*q<=^Tw+bmO<U^4t*Cgnabw5Zmwp$Sg{!2lw=J2ecld?j7w_4oe>Zm@f7UJ%
zV4b*yYvCcG5~iO^L`!o1Hb+c#T{2x#=Q3N-JB!bP9v33EUA@LTX=Bjj^A|Z|PFW-?
zsjr_P-sh2fZ03?B7ur&8G^kB_yJOA4W1dD!3a><ZzB5?rGxyphCjrav37@U4PB8rZ
z{A%CbPvWc7BRsiYKN6qFKl!TXn)PRHWg5KRQTWYsN3PGs6#IsM;f41+C!NvP`*6;@
zSM74P*+O-V=TGt#c7|P<sC&Qhd(;l;xTMoZg>;Kq3ZmC}+>kuW7x=4lugsk7hxtAK
z9!e;?y!y1_MS)$LYt7BW*DrTk5o3Sz_iTRl&$rgDE0kXoDEw&M{J$H#?5}W%J3X~}
zWmf-2F}vD8=XOK)OHKn>*2C(}voAWH@tbLHDxldXqIh}nvvnEz^Ce&RtVsIx*V=d2
z-A#<FZPp&e5!a<-SmYGnJSe;Eu~4pB&r<z`sY%}B9cgnC<9~X4bN8KfQ@k?Ms^)&h
zmF;(SS+~68%hKGfra$e?zPRnuHs8J)yo)`pedK=Gnv6p-Zw}j32P`l8qv~_<jn;ED
z{!LM~iM5G`-*luHU0(H~^KjqgHLF(aZ#ups@p0+X-EYe;9JX6=pT9}o>E9{kx9sI_
z`CosEEGu-JeAPRD`-J6wa%RgCyVve?&NRJ$pmz1TY|ri%?*>T+>lA_cvRw0fPe|@l
z+PgVL<Hz?W|6<<!S1_IXUwk9`N{uh_sQFd(NufeJGXuk0{Q1=gsbju1#5W(DU&94X
zHVP#b=jJ!M@;<p>m1mxDOIKjAya#jRG&eKBSt1@@h5!EYY2KXlXxojXK-rv`^C~~z
zJM(zX<lFt>@yE=Sm{SvL<~A2C5=eOVB=qEF-JWz%er?s8-*Y2JcBbz#{bQR?=6Hog
zE4&9~*cFbiirP;eVZ84enE0h{NoL^AQx3C)HfnDzY|&mSTkfPS?fQ1+ws!OHAzWJ(
z?@YS-Fk}B@o;i#O-kfsvt?%uUc4l>NxTUo8<g9f51)rQ3`ak?oTHLXeYg5wd_43nS
zK6?N3(cQ1@+dp?axU8_DRP~AB*RB6A{twq+UuM!UzkSB*cN$%be2TK2Pu^UkE6LBH
z@>zpHYaerwXNIg(X7LQ?#<@aXJ4||YPb9f8&9@BtxBScAN1ya2?2?}-H~rv$TPKOF
zj8nZHCiq>8@?P_!&70eE@lE?}S_hACT3_Q8W&a?1>ghw(m!Br8Z4O%6I$^@K1f5GC
zPA$ur&S~45?R?4SeUrDrm*Cl^e^+-Ow`>&&*lG~f8j#32tF7h&mlfkb$2FIfE`8>i
zmdR{cKIbQgN`}tutk-NOBUYY#o*|`|I>&J0WbY@fmqTV3s%dI&QI!0)q%*~Iy66oH
z&o+}jEANxC%iaXF`)(I-(X+YnsEyCa;opv3^BevgeI*$->Cmnpkx%YE`KNL%JngLs
zxEZQ($86c<>0hib*o!{*RX_RY5z}?&%Na(sC)K{NJe^a+HYwXx_U0$4J%10GeiDk-
zo0c(Cx#4z^>z}s@XLkkunrJIOXZzuDP&R(`vfIAh#W^GQcV1pzrhjX|&blqz!{75g
z+ZrAF@KwZOwIi|iKNH{n3GlunyY%&n+kY0euX%fLLk_dvGW7!`B0TeX^4!=B?Nk5V
za9Cmy)Z)`WYxknPHEC;%7xlc{o^SH<nm}BM!5zn0hj-n2koSQjF?M^mC)d{t#V0Kt
z*DoxTK5qJ$XZ6|msHh)Ho1In|hyK|2X+{2yQge>WvLQibzH#er<ZjKIUi;>C;+@;m
z!aMfAi@4Zgd857Z+XBC*KfGrwx*2-TS1x61)uCU9+HMM-Oj#CsQMg@pd1PczJ!^mA
z;bX5amEV59V0Uf6etDMrt$(Wfx5(ewYQN_6^P5Lmec#Qm-rZ_b`e}n9Z*<OCUa!?Z
z*z%%FW4)tPVwlb_+)`}*@h0F$j?1|ZqA%yFIv@P+|E~Y&Kem-GAMNk3^>AJIp9ztV
zc~*Xnn6s<EklUGop|zZmL5YEZAvd)+KQE~?GbcqKTGQ%RB<H83LOFT`m2YeRm)$nI
z^x}Ud*SgE^7hgGX>ioCYY39|hZ+NX*oBaER-|U#<?(LH@X7jpcd1`GlKmPnq`cD1A
z|NHxk=07>d!yu%<AT(ueU2gf-Xm_Q?g9!!_XL#6}f8V=!@Z9dRcQeG)DtB1UYxfkK
z>zerO&h03+&D{l`Pky+#_xHWBU3<<g`rLh}`qPV#o6oBE&$Ic~r|<OMcgFHgbAJ2Q
z!d)>Asp~nKkM6BbkKFY^ZSv;Oji(NsJkl+8+C+Pgg6AbAjYTFW-`{<F{#@9}H6E8O
z<SSN(n#fmZ)_6}(6cfob`>-iML}%Ufz@m4oJIl{VOK|PDobb)i=b2@FjBUK@$36cF
z8ZC}r45^k|{`^togt^B9<2u4`zf6)mnz(K1-08U-28(zmK6?79ro@zc`i-NE)hd7Q
zEw8WVS-<de`n``Ie*8U{vFY#OjNivU-h2K0yUmY+2Q51q{s`5}Fnc8`PM=x0<dfC3
zqJ<iohjM1Neh3$l4)1?=SNi?io^O47#pnHB_~HHD+xPBEDu(56<9l#3z5bc~_dhnV
zshbO?ojd$6$Ko?POZ>kdjAGoIZn}QaWVto7>x@ajY1Mz}I@P6D7aG`<>Hm4qSpBf|
z+Ru_--5dXNuhnokdMNFHxYPsgWW(h1XIy(ljK!};9iMb;QQ)Hf{TmbNB<G55UG!$=
z!ViC>(s;$5@z}`gIb6zF=KSqYfU@aSwomg8<||v7hBVbAKDo8WE~j(p6D6Id9bwaK
zjYaJGKUYOoEfL?lbGy0JTN&SN_vK{Y@1H5N@2;%u#Vy`*0)-pOwttIzpSw3u{oS@W
zN1y3$o9}LS|1p0dN1^4EoAp1-g;~yB-{ZhMXOebbo!ow_c|X1~nScMr-#354nMVDV
zZ$^BJSXRAR>Y1VNR=MTd36GN3vycCHw(;dz;hN7!zC6?1SDBTr`#56Xo%{Dw_a4l@
zG52wfsME*q$_x6wYjqU=*}DDx;ey`pb$6<ETF>gaC)@w6@7V9^oCociQ@*q_{$+K#
zyx+3=#IobO!k6rO`Bq2u@2_l`^77~V388zA-{)x*y0^Xm7hBy&dHY~)`^AUu*JSJc
z3DNyCMfBgXm>-={KRC7joQaY6FoD}%&hGFbf8AF3t6aiQ)Sn&dzjCNQ;^FaQhwAIJ
zrvLr?K~v0B_?<QDn{t+~H_MMLx~~<mUv<U#f2Sk9ycFK~;_^dboh-SY<^5L|^>2J(
zUc2|n*}c`DKb+wXV-?Xk6lu8gkk(}X1v(8(mtI%Tu6O>LytU`><UI_!+*ewHmo<po
z{Q6nwQIXk)Pf7FEas4tsWAwm$;SU~u2XAk+$^x-(el=N*SHx1T`QDpSf9e9aC+DZQ
z#sl}fyTe~<&FtT#b9U9TO$w(D&pLMH^Y+W4FB}(`RIO2#`&#=#_DCYb(Zwq4iZa!L
z8CmJ~N_TzITm0vcc2GWRK6gNX<k}r|7GEUI0?I6<o7lFT5~}*YT>Rc*v5<3r)*j&&
zOxK@#HY`%?+}_jNFZhr1ga&85+4+6u#8++Gk9jgqVb=OyQ~$$TN_8(!*a?BqWpU5y
zXVm{q^r+w0wtwG(%KD0VOIN4953HY||Cr;I6Z<co7q$5{Zn7d5CSOhBvbtx(TfFGH
z>jzGaf|*QJn==HD+!Kn@b=azQR)41Q*$p280$R3mMm^O^)UB-lIxoaU@NLasrZkbu
z28|-~9UR;9D!Y87++25@sQ$aksNwj&dZrorEK8nq-QRTZ!;E)X&sx84koffR$z#81
zE#glN9;}?sw3y|F{<Z%#TU~O^mpJY>?{2nH|7LyeP{9;|>A}$!fohXAI=fCTncn_U
z(w8r$UW?`9M}v6Z=YiAg+dDT4pXD;k7wK58(UX5Aigo4NkZf_DF5y{<&Yp{pd#NvH
zI^6v7YS=W^8ZN8HZY=t@1sslj2x$<1(DbvWX(^}7nd%>1U+<|ocrH~kN-VSb;PBRI
z_dCmfF2)DVA2b}EeR+n;<_+S3xsqY=vah+GCT?I6G+M4TRffB8Va`g$=I6RaK8a0J
z_U=9NK=gf9*Da-QUoG}%9s8~E`NFNaM>6)<x&Jfy(xb&IDY5^%;zw<rr?2iY&k%ho
zJx4<D99L$}ly?ey+nP4a`Z4YH6zQL{ZfEiDG5%j{@<-&z>JP_$$2jeh)c7$|^XAUR
z#=Vzk7cIZt`0MX}fi+UAA9F<AsC^*Fccfa)Z_QaIEuQ=r@iQ%Zm$W_qcX)lRjQZ;U
zfrx)%44?D)RMv&sG*8=eK55RL_42=R&#W_#nwT5ycHLnMlf;}ADuNuV+7f<yUl#Gc
zsPg_gw_s#I8&l?n5Z^@yCvWop(fsxK=`%Zx|2u!$ne%PgF?)@6>6_1!E6&brHx7!u
z#LF_HG5nPy-yF7rhn9c-UQcmQnem&e^uG1J2G^Na+w>dFS?@kJ>e=-3!0fio45eGW
zf7Ca;J3Pg3LivYJbIse!7I-N&HnA;c30ZH#EP8tOfhPNluP0s37Cg6@p|0S|!n+p!
z6K{l+uHe;JJKtSV_sx#1XNebIuU>j3HSCe<!4Brks(IUV_Ld);ZFTggjho)n%RAnr
z9G%+0d1d;9_Xn%{e74Sbl_KS2zhOnE*{iC!Z-10d_}Z$US)M87y~;e8S+JNjyR}2c
zoNuj)hijF!r^?UcuTMH(yRvkWLcGV$A2riYwJzz={CoMS%aPmaF(F%CuWI4k@IY2L
zW$TX##$o;+itY!vU)ikfu6E1xg~0(E^A%HPUs<|8<5ker@W~!~Q!hVzX0nOPs_@aj
zESE_f%}GyB3m?10qTZk#z3t)zm6!WFUpTo)hn?oh{eI$(P`zb{7)vmt(}|dtnZMgt
zFX<3d+}T?7Pw7-~$;t&g-=|!O*qGD&@5pl_S^Mpq^7B#{>y{m=T39jT6+^A7*$df_
zQ(9qHcIUo0<o)d4tIpgDiuD(s+x4kLEQmT)Q?l>qd&7j?OLuf^tUaYLZLjEZX8&8>
zAzq%+UCTEu+Y{9mx!ztUS}}ub#;vB^XD-EGh~C-tY)Qkx#Rfk`QZt)^xt4{AooiN-
zIObSnXW1U~vy=ZXM_A#*`FxuTB-suA{`LLh@aym7=l=8NuHqG7JNi{<WueU+*2;^Y
z6K$RPXK&s3dBcn)XIMku-T(GSDCp(H%T<QnlZ|h=Jd3sDpX_O}{`Hh@1_{BtHIr9e
zem2Qb#(Jval?@-ST}o9i3JJaHZhA^IF>cGD#ZDRwfx6{dZ~C&uHa*u{8WWhXboV0z
z{y;^Z$u~=@<u9ww{x58js#Ur>jxTF-MZ4!Nt!b;3%qxU0hU-Kne-26uzazqWSVKN;
ziKW5&B2{mtm3AJD4Et+;pD~xH-NS2tLM*@`cYX`|_q(5dPV%c?Ip_AbyKE<Gq}A^<
zcQf(&Y|>HTR-JLyDd58Md&@N()|X8QWE6_A<XXmb#KPvh&5;MUm`$Zpl%~aa9JqM#
z6>H~quSN9@vT|qJ?@7-%`r_lfgHi(V$*tKsZVacA<W6YzTV_Rax^VYg+R0+=)%K$B
zxGtMrM1!M{afk(nlVt3Ln$L|tRi+Dm4~};$d=tCuru!@YJ<|{Dm)(4w#c02W{>knB
z3>TAH%`EC7L^a#i2QTrkWBFV))%eKCyi=+>9DMIQVYHdV#KOC-GGa2bbIe9wmCqLx
zq&~<Nl=ezroX5}gFr9yLNok!S!-gO4FGw>g7yaPptXDW_;w8a(f+hWM$i(=CMOWYJ
z*l-)qNL5rYIeg3c{n7%lm<fs2DSfT35-K<94`_b4(P!y6;enV;qD)BE6QidV&zR;a
z={8Bse8sa}(xT|G?7sDruAgZBz<99BVpXU`q~H1t9R(*elNzGCJxZDbBXp+K?9}sK
zm}l7X{A$ado-Xd5iC$HEEOaWSZ|G{>F_*RZ&!KqH^x5}+*7i(G+O{%we#MUqzb}W!
z@3*b{diQ$#Ur*zpkUOEhp8`Wo&Yu3d-DTygG*>x2b?<P&HT!0L<v(8~!DV*D{yb>u
z?$(r5EtQ?if8C#6m~z-6+BZ#N&$Vcl@X9aeKd?^Pq5m+z=f(@?`9_9rUlx2iWFUC@
zTgHwolRI%wU3Vp%KemA-X6~z6hK{5^pB@Ueh~0jd{J?W&g0$z}e-HFR1w2nU?e2b%
z+%Y@UmX&=iV~clynv7zfO%3;YhvJz_<l_@~ocG%~?YU#yy2N-<-vXWJ6Z<q8c}=GN
z{1~pzq|?6R7w5Y92^{xYIG0HAZizj>C?0cu_1)4tQFqSwac#&x=jxjgbaBtl)st>S
zD_^PIcO{O+a`LK7ndQ@WurQSU@aGFoS!j{9^Oe_Y#)m%yzJEC{f9Uh)_lLDV7R<Mr
zm9Lh$jpI>!`2AYzpWkje&uKWkrR7-SO0Dh-y`2S%maLh&+ABj<^s8d{7Tv3i2Qn-J
zG9&M|q;MbQ{+C*@Y{3-c_bVRA+^XYW-!*CKGDpAUGqYcP_m`XNRdPpZ{=)5!vNu00
zdnoxz(SqaPnuv#1&LUp~#CEL}cVt}s?BD7A^6%cuhuhfvO?6VeP=8+I|4iWzZT&}{
zPYN;Tw-=t6cP9DE&MWU1D13XDHse=mpBQhLPA^w1+ZiE0jTzjf_c_n56svnCsP;tN
zU2SS=4d1g{#XnU)Pwr-V@t`MjVp_7S`^n>-H{8P80t_l7KQmOtRn2QS@V$UHKJB7<
z$YqB31unB(S9mr3E0p~7fJ01G=-{XGhjN!Ti6jcJeO`D;;c#q4i*=Xix)<8s{yN-w
zf=rIR8ro_rXCJyNt7EwAm!;*o#v+k0vk!JpPb{1qS-6ygLu~be6CJ;vo%!Z!@!KQh
zePD!l(2?u40S$*%s|GNCQN5>>arC*1LB!?;huNR*2z#u&vTBjVlMOHC{Ws>543=BT
zJ4+(GXaQfJ@5;2vn?4^D&uDnccj-s-daLLq|L&^_UA|!5Z`ZnD=c8jBFMi7ZS*6O#
zE~YG$CMfbd-NNy;S-8*q+$$a{M9mJ#iJ$Hk2zhR4qmq|+p6N?eQ8fGAFp&pSm}e&Q
zG?-?*N@`khY1<>mf4lO^wY;}2-1O^S($=;uk93=sYW2SsdlbJnUry5JoDj$By24oY
zR1MR}L$k#EZk=8jDnEC<(I&fH)7<a-Cd=Nu7<}#2?b(j%zU@|bRzHf7%U$cgP{5c^
z^}JDp`2~aAw$-o7-$@u;O4By@A)OuSC(y2TW7q2g98R~w{AM3hoE!I0=(-16n%81(
z<GopJ$8M_`OP#u@E}%SdtBjG<I`PuQhYBxV4AtMH;d$d>@clJr+P=|KAFdLKe5=Nz
zEn(-L#8I+t`<XAI4>eYw-||6c*DJ}ItTYDa%Go<^{eSaQ|8VgI9lp4Ix2^2YA1ZD*
z`$hC&@`u;wVrCkvHLf_~zD<4mO~J{6ItF<aC9fqk6IZ<7Rl4%g9_trA$+xph9v56)
zE3J|IZk6=5ZP#BM6V%I6i^yIxDKtHE<(4mHYvrOZzPa}{S5eu}>;c2mCASTxZJK(>
zRZS)FeS*W?3ooy^rhGoUt9#SVa+Uku+n>pPSuNV$7pwJ^;ZZwtOtfruSf;>{Ia_q@
zyRyp~zPfh)`i{HLt{I9o)c@{_nEj^hr<`V3>@*!$(cR5`TM{p<wP(NM{^W}2I_o=*
z>Qb}bw*9~8DskL>vrd#)>~f#J(A45*e7~Od_#Ka%wC--ChJmQ<{?~T96fUo=@0nfh
z#eHyX^{m7~_PNCempI?Qmn%GTTk7qNdyB)3C!5yXzPIzyrIpoOCSTO8zUGCkFa5o5
zZKKCNtL&|rFP83GY_TR^W0l*CwXSkb6Xz`5yKh&i^D>31i907xobxcWXWgc?0&${=
zhra(=Ij6+pZOZ4urzcq7hH3p~>Q`PpYb{UbIo0X;-Zc+;=S*hcy%QIiE3tg~4&4<R
zS6*DyUcLJ5$$+PeudaTQJSk3Xmh~Q;_14MW)2FLG+j~c)&1j3`o4eoZmYl7uY?qSi
z%CvP2Po8&nkB)EmtZM&HiX0JLtLNly4RgHLwcp>qQ+?IbCyDY!l6S@S&NhF)bP7lI
zGkbeec9~OV5oZ`1jJEoH3eNWFb+Ai4@%iV?wi>Gyb6Y3cuiO?Gy=ab=!t8Cz(ncwb
z*_#{MHi|x+Hdp)O#W}i(omDS<-fq~*e5KFSDCGXrbp|_XZ?k=~KN$CN>z9`+ttQV_
zTNxy@eEKftpE0?wj$NDfq;t!bwmkuB45QzNTPt3iv++OIzuh9zDYH)<Q?2VtOl`?D
zIvns|iNWO1qe^R-s`o@r*kHS5#fRcUOE+DSE8>0ou)sp*#13cAMF(AHnLnz26n@}O
z+L|r1+7+i~#A?e$uD;0@b3ZyG)p$*k$Rn|~0LjFztHtbMSJfuo`N8>?%_u@l=1S~*
z{k|5z2W`Dm)ud*xUTeQx_qWN~!)vZbbF<&x=O6sL&1(CE%x7;6)Xk1xdcAp<pjfih
z=Q(BR3F#NC0>AWbRSVKs`uVniQ|lJKbzgONTvJR*U3*I{n$=1tNn+!Eu5+&ySR+10
zasAfVJX><>(oIbE_g6d*G|JX_k<d3Obj4mBK^wvQGE;;*LzbomF&Xi6?Q6beB5=kz
z<%#^<)2@4BCAYthYINTu^<(q8)hjlivN>n<NbeM@`Ryl%UoPu#XqL;7IWIROXs1XW
z*ZuVF%KbJ$pENtNoe%Q!eBtU|8`!vM?v^~6ZZqS9nJqpJC1S>Ti=ubD+4ntair79r
zL1E`pvL^&4{4Eq+sp~%NxlWbV2aUv@vIV;iIdf0lHYK~mB0juyUBhL^UiVuMoEWD)
z6Vx?vJiIgT(G`g)*F|!EMO|^d-+wf2^Qn17J|BIe*60|d8ZY|IyfoNKS~E6`kMI8X
zxZeAFB_DET_0KnwyjORqT)A-a?uX^x36(-pQ3-Nex0QXl`BU)3&Bsg6YIG+5JEd6f
z`ol~|LtXx@QRk7nDl?u{rKri;KA)SIxP!B3(#fM!{FdpsPY;^6`5uec7p21vS$vXx
zNs{I#4_j#-TKa;&!uXfN)VUGHamH`A2SizKNu8YY$8>Q;XISJey&oxE+M6z$h)AxG
zPUII`9>=+(ZbMw7e#b(dn%t|arE)dzsvL~WpX$!1&9Yk6cEjpzTUVH}hwfRG7|~I(
zqU`L6O>7qh(;tV-X!qWDOhougd^+a~g%2Uxz4JL9ubb{H_Nj0A$7!c6)(Ct)dx`({
zLFeNk+qH7-GxOekI~loq-6J;(VU^~o**)j8w-oxCzH>`lP_?x1vPkv0<DOxWv;8+k
zT+@j>Reajr>T!Ua@r&8)j0Qg<zMc0F|NS94+<W)_>kVtTr@6h%JaTPMk#x7&+W72j
z;~NK^J}+O_S#N%aH*SNL*w%}$P4~|FP{g*;EiiP=^J7kTZ3Kg&%U|?fEG+q4D4|q1
zn`5c?eqPOzj69EQ!-KvW(b>L>jvBpt*|Ez_$@}ZohlP$iSLqyac(>vH$KN+6UFn^;
zCzJc4mPcyg%-3fnj&?;R2C-dTkY=iX{a9Oy?CBdl%cgGqm9N)iqtV4P*WB*A`j2&X
zv$t+5y%}VEXl|&@$|L=IBHLc>3m02cZJl(dsePOIs-A-jP9FK(o4B3vx<JXpfU^%g
zSIfR&<NI4AeaGl_RM(n=yM9FW*RJI?+gNZjhTZH~f9y}gr-D_dmE3KNnryjrKkj8O
zX|P=z9lC#O0K-~EYyQ&v&!<<O2zt_g*!fpir2YBi$j1}awc2ZEUS5ByU!_`gL2c5^
zUzb*<o9Q@SyR<v%MEJj=8y_cVUJUSG-cc5}y70NPR*kf*Z`<Q#b0z(M8u+^RvDL&a
zd%pSQET5IDnvE>wBGe1c?{Ij#U2$o^-Dw?%W`%p)wc9Y=_?ElqYTxzhHmk!*KV4q4
z?W#_~bzf=iSzY^2rie{Z|L-6AY|U~8oxq9bm%N^_W5I<RWtIm%amI9B`c=(1-}FFH
zRpY)bTX$Pm{w&+GJ9+P8*Pm0So}Qb-@;K=8lPhZ_wkCK~lybeE-FZ;XgeQA{XM&bv
z#XLiGnZJj(S5JO?@#4mZpCm6Y&st!8b=9uWqK(l(MF}(iFPA-`x@nQ+rR*<NTg<KQ
zSjm+t%$TRLws^bsWFNK0yVKKc7UhYBY(Dm+G&MdqY4@!oY7V=q=dLx}da{51E`e=+
z+DpS;uai2RWIAQx_LY;0-CxEW-{q@zKG#UnzI3Ne`Q+1UEw-5Lo92A5c6Fd!39Dsk
z|Jfb&=?asL)>z74W4r!$ZZCh`o9JVYg5{6yS^V<sSA%^<A;N)jCu6=<3vV;)-_F+i
z`t#Yz3n!MCcGSLR$(P7hQ@XN>_t9(?&z-U{oTjQ;y$*aLJZy2fsk+j8-pfAx+IMKX
z;of6kN^QOh%v0=~^x5n4lGTN3ZeLsXzJB>$qxd&>p{Y7&R0U6(*ZaWOIAQtQw^rQL
zf8J_qtybsqYWd{j%YW?%skH8%tlsv0YJ#5MJhQH6kDlCIDY!9l=8pUQMZ0GD+HZe<
z{dnwZtE+zY3oAaddzrJ{o9RF4Vz86GZPx;aLsCX;IW^0+_)D9LEIaM#aJ{rs<%X@f
z$V;Etz6wEx*j0X++QDk;>~2Qf<@!>>88X>V{aS&m<OR{l$}fK!85S;%K65*jd3}td
z{<EAZub+Rs)h>Db(DB4AJlzXV8F@cn9l7y(P_T9HF$3F57A7YL*@~)NuF31#^VHtv
zZVRrT9DP51`dKA+-P3v18}p_|XFH`wr0#RjRQ53MGtoNyj8VOV`6Ba^>F3kULzi!q
zefh&Bc>9|}YtKBsxbmOmX*UI<NVB7?47V;Fa(xi<W$Tiz3xYGxze}6Wv9&AlNS~H@
z3~PWhgYd%{UuD~U)rB9GZ+bmtdr{fxeIX|QMUHss8JxVlYU;X0DLm_f9>4H#+2Zp&
zROa)Z_Snm^rG+obv)Wd7d@K93H7$5=m}$F(BD?CWHV*T}4GSJh8=PqK{I=Bm=8fM`
zb@?yPWcO9R|8(_D(u=<`K?bWP9gSvXvwFjN_hpAxz$d}toZ|;8?Y<nF!ry<%Q~6Ko
z1ksB*qU@11xs0aWhZR0+Y%V*MKk-qfykwZ*d7r-JS1w4`w^bT<-+#rHa93&fVci35
zFXP{Gy)xdNdVRy}84s$ZR&EPT?iCE;dlDpGB64m1`(=EE8U6-w6YH<1XY8JJ(V{bW
z<B8j;2dY-@2wUs;!DglB#BUScmp*#=UhhKnwANRi9GfnG{iD3}<KD0X=5_C?&rA<{
zHp#uxeQn{zL%sfr(Kge3%zH0?er?^c_kXPXY{9ryU!S%6DPLYVyYbGchWMr#m%g@F
zIR{-lcll(@_GJRwW!}A9Z+ddqoE1Oz`Wl)f%#OO$8&O=%*1WB2TYgWX`R{yhgV2mR
zXP0Vjo_$vmS?t$ebU!U#&utQNU&^-i>%6IMdOy;)=$!6)UdpPQJ10Xdc=GlsQj@sL
z=Ba&^y80x6<Fjj9yjWLdke%CU)wt`0$6BAyw|!A-;A<GBEgs&`{+Us0N*3Q??}|yS
z+!~hOFSXqLcTiY|Z+48b&eEjv`yA2<%PchC2~G?@R1_g}f1RP8(_!(et=Erp+_v*@
zS$#|6X<}pDqdk#&vm1iz`zuO?DutG`xv2=;{>}bgo!vf1wpY#lc>7~!m$Ll*eG3=n
zPQJWW=DE_-o!5$rY(G6@Rh(o0ecMmP$GSh3rd$0wuI0MkRHv!x#}OX(Sq&ODLPJkg
zJFoWkHe)z`)Aic#&y(%c9^9Q!?7Y#f=6t$UChKy2Pw7)$CEGqGKK?gf&TsLP#JZ0U
zoj*x(-94~h-powuZ`~A`(%5_J&gHLuXK(d8=ULvibGF}?%(XkZO2gbQW3qGfeV6V_
zd$cARn0ur=VUFTm``yVpFi!U4HQDPOl4Yv`)iu3us*5k{H`U-;Hj8Qf;#3P~fe+Ol
zb?3PrE3(eyFP{8a#{NxLrdIU3`IYrdb-VaJwI0o^x?jz&|MFAI5&cyzx`}q&0q=}>
zr?K6LxPN78miO#1h8Jg!h3}nv@!^l<7tcMpT2XFtQ&Rq$eBD*)_p*Cz)BNKO)x76_
zURu6=EoY2*-^WX{8y{Y%H{HZ0mDr=U`Rm%>Jl75$-E~8CN{*;P_&JHQi<M>=HQ5+N
zCNJT(dY~pcMXF$F;VZA?YdtU4Us)0Nci;BORn@<b|2bzIF=IMoRgGaqU`x>BqiGd~
zZ*MwK&GR8lX4jJkZzK5GcIv-#b2eBYvGG)J0Fyn_@}MQU8OtnRtS#|x-5z!5*Sr(u
zSHdTJsMCo^Yl}1E-}IbceqYtkA15EDpO>rs+`H1CREV|eGsm6p6_Q_Tj+&fM_R%@<
z>;cQ^DeQ-i1PgCib#qp3aQxN{9S<w6{@wObIO&7vud}BPs${4=?0hEk%`Z-(`WxRA
zQ@K3>tN|6GkLE3HY;X(w`sj3*mZWc8MLWO9gq@d8_byiR_{OyC=0&p%)#H=@Za@C?
zOw|@em8Osdvnr)?vW3+9OE_o#+4y_;^#i*K?N2@p{`TwIgs7Eeuf?QR)@8p)x)QLf
zOZ&J^tz)A0Ifq-PDh^K(+j(2rZ8`fVarJ-UzmMDZ@GZ^rk9(W9*X|Q<_Iyu|g48B!
z^;e(V4CXsNGm%nF_1>kI66V*ddH?#2d1ahj>F!^zZP@Wf{U4i9z_nD{n>D#t*J?>z
zJ^uC8^b@j6BySwuH$~Vi#av6dWZw5#rI%QBY@fWE_W#CGwp({ye^~h~ceJ^ec>Vg-
zZ7r)^!p?m-b~4iIm5SVY%^hD;9<GR*^|!v=YDc>jM@7)P=4*Rvw70zQnd>X=c<!&)
z*EAhFkB=LFDIGojXx}PxWq02-;t~sEc3jZ3P~!Xa$lXT!+p10Re@^qvWr;NHo9i$w
zj$f5wi7>~Vdx`??*DKT?9KM?|i}mJLXU*Bqe;t^a{mX)T<$8B(`$tdPOga7+CCamj
zyi<AQd~>Vm&iTcM=e?D6cSzY>7O4FEfnL9?=gZ??rMBKKSv}kQ>!LmSy96)1aerE2
zp1ZlrDBF|O`RRu&N%zewCM;!Kn=4xTL+UvLPkZ%|{5m&>^JnB1eLEn{oTHZ_QS|7Q
zfpFZ9hv%yIIP&N}X<_vHG~xcGx$#T14K96pFpF1se}ZuSoohmQAs=>_D?HR=Tygwc
z<nv;K-(9CO#AYd*@Yp`wbZ)JB+pkp?i#JCJH@h6}zq@R=ZtLw|t}45H_xF9fFPGQv
za{St@Nq_Qhe19&v?Mtu4#H!V)!hSV#%)am}SR<&jEZ4Sgvf>h!?`L02SMS-98^3-@
z!{kZnlb23Q{+G7#q`<@5P1i&ib(`)5X>&j3bl((n;Gtxax1nDy_vEGW+k;-b+IoHZ
zU9}9oL$^cL>t47Mwm#&inH_hM_4QIQ(I1%|vk#tMFW6ntGDqae8@5CP-qUCQ#w)M!
z4_nuE(8T|-sMLxRC-r`XdaqfXdf*zD>K5IwyTR>uayw#I`(<}I=S)&y+Pjsd(^)5;
z{o}8vhyLAinH6?b>wHhrZMEAyf~~ntzN?=oUESifPRV!m3!U?I#V4cRz4DuOO;haN
z+M5}#POa^AV-C3OV<Pg@)=*=rZ?H+u+(i$61&6HOweQrz#v(KGEwj$GwS{fYoY(0!
z>2WCUlAwHstS-~Y<D1X72QwW==D2!l+J&iy1a>R+t>$CBrenG+h$BrhJ^gCeCKW@;
z*w)RWt^zZPW-u(+<8XXRhssQT@q=%Yj9DX9U;Q-OW`DUSKU-_+;%)`!&pk0My&V$I
zR@leuid{ea)0D%R`LszwvQSB{Z={P_{-OIn`eiJB*w143c+`H*_(sfit5(-|p2?hS
zhuZ%i^ig>7QH7_@va-bMpsjS9EmQI1OI)4tTd!Vpda4$&>w>X3d)V{4Pkr78d4At2
z<Il(Uz5HIDynJFs_a3|diie-q8}BsWT`B+OUgp|HukSBPjLv6u?39zrn8Ls8#Pn%5
z{%>Qw9aBG7GrwJJ<*}WCdriY9FRPoLb#+Valc=MqQ^n`E<(8d()><^}G50+4%oN#X
z#qZWhvgvPB=Uo)7DNz*H{Oqc5=00oi);W7u8cyG|?T(dWvZPc9r+Zm)9_P+{pIoOx
zp58yVPOKLF!ggV9<h7_;*}knzlT+p{m^bgik+8@|_crxZ=W6#yW$)OuV)2>Pm$LY>
za-*2zR&C%}m0&HqHH~NL)41-JQQyKI$IfSF6nT;1n`D?9bo#WH{^=OAwO2V8>h4<m
z+jl}eOMt(e{qObZ_ig`vyIFr#OiG6H)Y0T#!D|QSe>8ZtY16)nzh=zsEc;C3OqV*m
zoYv;DJaC)Wx5+<#h0c20a@u0A+xv@-v&2v9uzod9mpkHa_Rs$OrK_8i_Xo?q<zm=p
z_dsa-zpo5TC6{?QtCGu$=O4Pe{j4$vw?MwHrigLj$Gl+0c`sLN>`^%*<)z!Cv9WtT
zn`gIZr^lAo$R<MvGp-reBd)HWIxjZiO!kZ!OPe?sta!*D!Xb7b)VI`R$ppWeq{H6#
zcCB^e)C%9Oy4ysjt#7N>{#&m#4`&L$Rufve`qi=c%nSdvDMtU(;nce_VMUO2-I`0@
ztF$#PPVEfg(hAUF2|Z<D7#g{F=Ej@`)n}I!wq6(e_fRjkP(r(t-zsR&F-KDevuUeD
zix=$<Sw8bq*#n`syce`MzH2HcYl!YjpZHC0)s6h{_6wO8mib0(Zn@d17qLxQc}Kz9
zUHguHHCI_BI!FC~&fQrVg`wAX#;m%0=4sgjq3PEZOwE)d8BM=7mtVD?^vUJrzJgC`
zMV;?nt(~Uhx${@=_y7N{|Nr)2;>9g*9`S`s88{Ue7M{MNe*NjEX&jrT?MzkM!nSSZ
zx2VE&x5-&n1<}FQLg!~T{JY({uI|mxXr3d*Uk^NccQ`c9_;k+IQ+Mw!`COZ?eeg@}
zh6_ipFD(q*Zno={bk{QN!v?SS7I7}mRMax@XXlQ{6ua{9#+jqfJ{NFx{E|#beLk0O
zx9D1luEuip(9<4^clw_a+Wfhd-`uC`Oi6%1;hL(*4OcEa^-R9{uY70DQt8hj%a-oS
zIUU)*OYeqX_t#(CrN1|oJ^p+D|KaZ37Zs&(*Y8~0VkUSmvZh@0?zyDfu_?2UZVe2H
z4pnb%S+?3G>(fr%J!O9{M4kHK;Av|(Q%!d6qsa?TE%97#s&c+XE<gKC$#aX_>pre~
z##qo_{MJfKv(IZ)pI5X@;&X{Z>pnJ@9@`f8_nDm64^~NQ7oj%ZON+ZNZJc*VG3zsn
zkJGX6)4_MyQ=_J4&C|H6Ja_3!t6g1>_;eC^_Vhac=v%(}N#%}<*JtnEZF+*`QYx#_
zRqgg53yX~tj3nB;_^cLN2=rgMuxZB${iSt*ip!dA#P)pgdabfx;cLS%xrK#3mnu6d
z4@ofWnXa(o*x#2tb&aa-!WT9*9*^_eaqL`u0+-wr3nsJqhsBPwuD_a*^~s3un~e62
zqR*3#M(e-gOPO<Jmexd`(%u&(#tFTpDaj$KZQi+-la@;vp3P5K_vVFpMoMI-=@veo
zkcsO*-E~OY_-n4d&e7S2vcB1Bb!x6TRhwJ1A;U(UO~BV<n|qh!;zbI}qIXE`esQ_!
z^c%JP`QA4kF)779T2@r2tsu;o5)mU>7w_w2p_-m^b?Ypp#E#eQ&MVAW4=z?$c3OI1
zLtC_ljHG#T>d#K!$#WKU2visya-8a89JOVV@s)j3l)m<!H{Db?#oBq!{H`evL$<Aq
z*i;j%AHRybnwMqr?GUl)3!ZDe`|xb%!#3mCnC^pWAO9?B3OCgGa8!l=e4+N7b?T3b
zW*_JKS;Y1DQdp3d<l<Q0iG^aJHsUw0r^Xz8mB_W>viIC4%Xt@PFKA}%n3&_VtHWpZ
zwI33yZ_oVtnQ$eUGfPj}SXxc*Hp4r2ZYh5Ql~sow!+%dU+kaT@>xqi_Q<tv$>bLsY
z>od3B@0b+$(acW#8-u~L#JQg8yOl1r)R#UCm7T}+n6GdD^-o8GcUA1UufzwM`~9G?
zp<wd<5WQ8#4OO}y5;LFARFpfwKdo`z(~qluEolx|d%%zVqiN99GZxdM1t#*Jva6W?
zbh<hJ&k51zRL$>4oY2!u_Vt@ybMD%sb8jS5q<6U;(74jsxc}q2^{-FvT(V_HSy{;E
z+hL(<Z6cR=#O7P;W_&K$BYMd6M9c1s9e#I~SvE=DIi-0hDp32g^p$Hfnx9qQc{O=`
zO-!=MVc%6*u0EbZ&lXnQjGuMndR*gmlMmUF296fL))ef%6MaDD>#`cRs|_Dti)dcd
zTq8W=w#uGw&oq}UJ(GB8-L#TG-U-tuO;x`h5VWgoB4g*`{x!a9<}nqO<g%<jJ2(CP
zw)m_~r7J#9aMcvL)3joS?SCG@Gq-nb-v9U8*^KuUTbeg|T#pk<N}D=m(vFJHFM19&
zaKD;5FZ{XPv@?bs4cu$HA54zvwq4tH{P4u=$u1jT8_rQXW)RaN<z3#**HGrX{jHU;
zRq~4qSLZ$m+5c@yz+?X1a{og6KA+mY`dIGwRZ<1dlny_XJEA}T^udDWoT%k7=3Q45
z>lim}$>Le*eMm<5>btU}B}Si@_FX>Iaa#5)S8fKUeyU%F@0KOf8`s!<GMgTFa?6#=
z@885MuPQy^l#;mi?T#)1g<6li`k)!lXFOk#^XPQq#AO?+LT=Pa?Pze#d{!iN<66X-
zSA4}yPj0RGtoUSG+VkrUp?hN|XPj-~2zzP%qE9k5QLZ?mxBB1hC(3FiBHr?{FOEh2
zmA91DFWYv&qU_HV&W}Q`TdMk7lP(qcd%Gux{YbyYIVa5M<f(>PpH7{6+GD1^UNe-l
zYtg~KIgA}s7rk7iAiAj~fkEr4A}cqm*yMYxlM{YgSaKNciC`;!@$0?2``f#jX3egu
ziJZG{>~C5iJzx9jI+i7zv(&aMk&g7r3NyWUx|#RDfseln_w28_Z(|e_e7VNHSeY$i
zZeELELCMp^v)m;jZ%X<*j2Lw_l1{NK_;1p+_|Y$QH|B@4-F05r$S&{YzId>}W)`cb
z(7E`fGd=1juU>vqC)AK@Uan)oxryhswp@GGU%u##!@0{BXH8yOr?+0xCQnN!$5udP
z`{oW-we{h7yw9|XJ@~UXaV%4}_T8{`xAj7wp0u1-AAJ-;ejaRxj1qpF7;KxCvZ-tF
z^~HNHKD_pE#k^fdRPUX-*D_5qx-ek({Qn!bAIN5X^zBDg^s~}7%c6+s*DS+Uyjy>X
z;e|qKLaleG8Qbftq5S`|42skhrq;dWa$mk;>3>;Iudml553Q`6SJITbX4(RSf8zBr
zSMw!SbxB;$UpeXHk)<1V-EQ<w4lSIqNysR7#UoWg4MFRxN$f|g!;5W?-QZ}E<B~kL
z{^ul(Q+iz5$xRc4Z`v(9q1Ghy_sH>$ZVa<$d+wUqnqw?npa1*qNml=-*LIlc=BZiV
z{NQ--E(5Q*(oT_!d>51IUR_$NT=<-2-FlvFn^r_+Et|gh$z^{>wo^CrvTV7sga!9s
z`;zqbe|6no?=$Pq`rcaO`C=9C{I<F>!E+OC$i82be*4et(>lLcV&44sQ;&Zwbvsw=
z-|w{4c~V?wA}3l+OK+-c{LX*HXT^)ISTV~FYD^guiuduZcd8L}_q@?u?=LrZT_w9<
zSlyqRx3>;%ib#Ff-NiBESdU-n$M7dLigpp3J2xB5+3yfEeZt3+YY!fJQycg|W}Um<
z7Il%V2;D2XK@VSEe!n`byl3a^!2Jhz>GB5Nc1mi0I8W|y9rrfhQ|1ZxwyhJW{HV73
znD6mpH6H)kZoK|xcb~`nkK&1L*MKh~Vx@<|V$ZWgP4k_!Oeb{Fs**o9XSA#=bTxdE
zvgt|ks~z)hDQ?wS_2Z!NjyFtGx5;T-&6)mzYtkjxJxdv`Xzu#fyXQ(|Evwz_A0H0>
zuPJ4&H|J>7c3F`1^vcYbPgORvs~M(Fe(|jNzxeqrPUegy(aU1j+=zdEXwA2RSq6&J
zGq&p*#jW->=+1hseEqo5!Wn{!yDUDO5_=-I;>#<kt(&&ZyVTp!=bl&}u5u;v&Lyk<
z+izN$J@swx-M?9Xj>+N2RI|$$PCM}=>3x_tYs&o=X(Q=FkIQR#U9PylSo%SI^{lgd
zD_6bPEAmhxd5ufuV@+<M&rI)?j^3D}!MQ10Z0n@f{}HZ|8HXGnH7--1#cV5b;0%M$
zQr_vhOv^vqoBTv~zV{??$Gt1EI;>-_3f+0Q`fNqdRMwYA%c`pbHmuruOzA*k(eDhU
zt74gdPd_QIx)`VUE@;BN&ChFR8e~iU$qUS5vO4*5TZ4JzEq6{WE}OeEY!a48KQ-!m
zQ<df%m}mUu%ei$+Ri(6cuWWDY@~v9PdD5))LcsD{ci%gezm$41SvX>*Ia^b%zyHTG
zmYH*2&UAmnyDUcHjGlo6kFvh!Hx3TwvTD;;Zxh7MHK+<tS*&32=*y;A)8!W`Dt``n
z?7jT!L4h@MBPQut{Ho9@c5V*KQ3#&>&1=@{$d$X4lwKJnT#Py|vT54CuCDc=8jrqh
zc=4y{(R%}--lK~S_9vX%A6{ed<yh<arYp}q{=J^?C|-HX?d*o|lRA9OXLj%5@ca=Z
znZdC24#VPa`hnBfHYd5RWYO~oKC`jn(CI@$%xquwu!$QNo%d?&Jv6scUE@AatTpoz
zMvkl#w`<)P?G{{|zE7rY>oMaAZW^Yi|E!IO61%UN#w97?lBat@bP3a4>$PhIKTLS{
zcik-$3CD_PtGS-W9;-N~yl~ZXuf4s*F5B(8vc*01wrX926ywDP?>4ok)v|l<J+ObN
z=Eje<cMt#hd+fmGuXp2a{+|~s_SaVR<y5)N(a*|`wcr2!%V=5Ijjd~Y-*3M!C)f9_
zPu(V1)9JoJrEa#(!T#hM(pvmU2g<c?{ygNnW6Embec7+?JH$P`b6~UbwI6NU5B&69
zFFV(>=FHu|ZQe`k+!h`<)v)FGhBiyzPjfWOuPj~2ZuT{G!r8#83vYve^nGFdd^NbD
zx1->fV(~BA{~|g;3sY<p{yHE3e1C#_!q#`ct(b2!J7<3g-NB}=7R`9H;nY^?@JZ|V
zSeZM-{GC!WuB#dTWD?`NJ6rujc;?4`Hg=|KCbwMw{A-;#bIpGZ%_sFgHhiosW3IQp
z%O1%z<K`Z@rwUW_I_f=wHxvZ~Y-xZ0_j&!aqgn!Yc3$-Qc1ii*fo(mLXCH4|#8GkT
z$k+0xE)xPWWk0h{Ot?Df)`P`c`(k#^+p+4o!Lxn0S3NYE9cDW*EcD2ly3Jl;>}xkx
z9shFlY+=kYwka&fj(u2rr--L<uG5BHvU!E^o0c)U{(Pdu^GxxD@wVST7FErOXf@os
zc#d$;w$<;#mC9`muHD>u^=ZnHU$gz5i@ooj%)Yzz&M}uiPbCtx{_)K=nfv$A+r+nN
zLgq)eP7kqMKl4s~!mS-YSQ=MH+9{k(Gxgg!ZFZ&Qk+$S|)xy&sA8?dNvL6<e{C0G9
zYpeXaNlH;Ii*=Y!FXiD<H=dewXnwUwdt{2mdYL0{-xe+877wpfTl&~ZdX40tLo+zD
z9~bHuEoBRR)2-=eoY7UCX%U&c;<%NrkBXS=D%P@9x8mQv+40rn;epBbLKGL+onNrQ
zO<=`Wm!QUbOXs__KMsFC-?*6RUxEF*{{dg8OMQBzR2{9NS>L*m({aj!yQ(j*n&xkg
z_b-1flD?{RQCZV+i&D28mIk30Bt0HqYyW*OaMo1GlgqB(t5{w${qXD!GGZ?C<v!@F
z+~82hvp#-_cOJV^{=vsgC0*{v8p9S`eN=G0lUu{U?C@&8&@FNX*%lEOx29RPc1=Fs
zapdIWTW)H{g6G)Ss_vK6NLY0xgR#0H*>%JGc}8Eh9X04%C{dj|DI?r?pO>b)s?~9!
zy<MB;$bL9`IB9E&Gspg}63O=Yhay;3te)t6#c1xUz%*0Yb340N2W+{ln9BZB)!@dY
z8g;Lq8}hSa)0r<TCh7VMSj%1N+5hyM$jh8grsWGcIgea>_>JHFQ((8k?3d=kx3Z?s
zGn8~{Zo4dK5PQE_P$~ZFscFB~DSZ20cHe*7w*KSxy=phS|0)Cqzg;~4`1(He4SX`a
z-wWq{+%IWYw076$<jx;TGnW3GYJ5unf8Lu<&PofXRW5!hlX`Ng`PP)Z$6r_+&Sd8{
zi5L7QttQjRb7KBi_qm1B9j9$cO<r-zBlo}s_mi$2KX*Jkcjw>dYY*>Ly#Jc=`|7)E
z*>f(4zPM$0H+mCq+m`>|Kl0k!d|ZFVIJ@w`+ZlPb({6g}pWgDo>1)VW^EB0u2@@Pt
z*1et*w??i&>ALZ<b-}Y%XW!-J*vZ0lH%vh(d9q&Y!@^(gN$>R+x7;aOm>;`#cai<8
zbDt-)9!l2Q{Yq#C=hCKyYYpT$T$y$G(~kyBd7bJMUYh)Eo5H!(1!Zj6SvP7DGpEg{
z*rq;jrR?kJ8y}?qzQ5#isLZ#_{8+!kkET32pt!c=&e4PIv!4bX5v=s|jkCI9_;{hF
ztE%#gDf#=4`%dr6o|!JQckkQ@dsxekUE!#@9W>?YueGd~YYye-ynk`>i3G2Uw^q!-
z{f9&Y<yHvtW`(WKbhx!CV1+RUe~yJ?uII|e%3RJ$uftXor8M{cTD#ePn^(b1s~54N
zy<1EC{v8bxINdRIYGvQqc^Qcc;U+WxEepLm!}#WgZL_}f-@WRxdBWx2>$=?jY_Qch
z6SeaC+_Z~-WU7vuuUc^6SlcPFpDO!%&YimJ`7yfWzDnGSSNfix+)nDmoz3(=_29>{
zvsPMm$0t2=`Z4qDYvFvpDvx8|o;|aAyrNco^6J-ow{r42^&;7~D2en;(3G}6)?v`J
zp<v>sS*=Ff-CAd@Of0@{y{K_MYp1yGv=;~Fv~RX}(AHKyZ7FwtweaFe2Dv9}zJyuW
zdrf;3arKkSq_<OAS*8Zv^L6eDPHAP&Y1KVdQ$DBknN4TPRHt}<8*xvWaNfmlm+fpj
zd&^_Z=bp>DzjYF89*XTsdnQ-=s8iAVQjViz`Q7U?xVcyRZ8rF^V$a4CHt7@BuFm>;
z)P-qvaDZ6azh~z^CK&Svo?d#DZ~g7lKRgR-j%sY-c{bU#z;vOiR-fmNXCf0+8dg3M
zlAhPWVx;f!r7Yyvo9=m=4`n=?TanlQee?S_p<Dm>&Qs^wmC>=|5v%-^EwSAVSN!8j
zY?rp5cNMg|xaG)oHt#DwKb6_%u3yrZonEv59G{k0Z#CDWYZ~iJy@K3hc+XF|!BaRp
zwDI)?QSk?>m;(5A<h;rVEOA=!SaV{kMR!xhi`=>Ffkt2ME!UoM!j9wKi!SlS0*+;R
zE=$ta9)8^ExHM(<4BL{alWm>_IH^4g-<kO9CX3Fa{%*&(GZRZ{QYyJ;$Z}3T{#@NI
z^tkq|Y~hoKl-yRBRvzc_HHdBsIk)1O1YgSPNef&{*R}b2tvK4`bMs&K62;;xt2K|F
zp3>j&$Y6K6c%W@-U9$J{LMzsrdATRJO4Ft#d|J9*^!B!Uf2@RGJd|B$^D6!1BZYIH
z<AUp5T34}8V_qjCo2_->_q}U1=e{VM`J*XP)$`6>%>Bm?^&@wqZGK*vX0R>WDA3B=
zpfOC+|C+3?SN*d63j}5yXo`>G6=il7=kU?b<@hG35V58H`i41)zMH%`W^R1;WMcHw
z%s;F1Zchw7+1$5$9?QvlN_9)N8ho}7uvyh}l(~Q2DxWtqltMq0U$<GQSLkIEce-wi
z+eU-bmVDWzE+q#mtgcO}jVN%~Xkc*K=J?S?&-sJ*zvomq_4%cK9kcbL<0e7h3=jD`
zpL)2}_{yX7zY4C-OQt#9HWt)-BeX^%<BYm`>_*1PyN@sU;%_EDUunhNkN5hc^~>ES
zU)=rpqTIXla;Arm^mpEnZDlxo$j<7=&eFO#=BF`_CI1UN*=%T0$1|}mbMoR1lV=8f
zosh|LW|5wQ=Ax>}tf5zUoXjlV6fO8QQD3(<Pkr)gUd1a{a=aX3{AV0!SlOBo7Jl7+
z=NtQ#z71_>LKmGkztz;3e|l-uv+hW)9qg_Onp<~0E6s|D;!ulsEr)DAliYjLYQv6m
zIp+G^WxTIUV^6oNm0-Six+}qVM(&bhWe3F?zwMaV7`@?zfziC*4}WiViMpu4TldrH
z`QCeWe?KQz-2H6%fs-}#XKizP3fojQkzLE9qE+RyO((qf(by=p>RXiK^@j#aCyS>a
zUwLC@&@<1&x@L*o2TqILU6A6Ct~uMtEAHN$0)vlNHWb~{dUoXb>^jR28R2VNP0Y1t
z6^NB5Ea;r?`uRe1+s$P=#5S#25o&#Xca&+``xSf5TeD({id|(c8gI5=A5{3Pxl38@
z!^MgNfwc#sHk^APt}tzeWVZF~?_7T$zhn}&VwtgrQOxenuBYEjg^$Qpes>i5V{q%1
zq^w_`+m5f+mN%^aJ?s!No3P}7@PTIqe}5~qa?4n;?6Iu#uoK!<pd86+_}ZY+QQ+C-
zrkrqwz4|rF7p6^L@xGUB>yIhF*|TJS2Wd=WOEv0>WtTefvmv)fA~iC>Hn`i_L~z@?
zGZqtM+%)+wmg;=76<bhpW)YX@3)T(gvs`_v?$_q~*v)!XQxP!l$(-18HyI1O7~iI@
zR*^qc!Mob<+~ER7<?9TxZZi`ep3VD{VUahj$a(tD#Fv-0Ei9iB^in}nc;7|tqNS~k
z2iev|B_4m)oc*kt?Otl!+6<}BpI=zYd9|H$xp0f;d>r$Wo31A|y^3u!6u44gKP53i
zE@JzPm-~EYa<`mPWb^h)Y5!}KvT?Q5k)U6RQg64Msh!k*x*@34ut6vNSES4wWBwav
zhRmCPFZO?Ewtr@O-Z8IkZg1xbH)f5^^?#UsQpEPLC^x>+*PV8oU+&5QyNZNmlXa2~
zFwBlr=}}OR^?xAUJ>k`|15tXh3mi3HZ+Udj*R#~};PEuy8Rq&u3=4Bj7dvP-ttjiN
zNt%1$?5u5!5zIQpmqib2P5tzm_3Yu>me+d)tz;js^Z5Vw@Uf8G_xmd??@9aCNxYZo
zQGaY6z24pZ*@+d=629AxmEU{c7w_lN#jM#?b-2V}H|wc?(h*mW>mT3!`0@AN4QFib
z=FU%^8<!|E<5G**uD0W562J8}f6&=gwEW47yBWXV8s2=(-o7~eae3;zI=)la0`^%M
zo4cG3jJO!q8&oB`rtjXqqzFTSyfZ(ms;iZPe)yNU>EGX1*Sm1F`}_NQ?%a1ZtKGSO
z|L-SvzuE0+&R6gKcFtzbx^oB5S(fHk@7c~>{5WG%X-A6e|CWpe)=wr#WasZUtI4?V
zK#4u%w!KAK#lh)mTRxmr`lT+;z4h>v7s~}5q<?N)Dc*4C$JrnCho0QHKl@Ezoz&Z;
zFfP7p$Hc`Q?IO?V`TS;lU*W^NLWN`A$J;HMH)8S^&Rwg}ciDSaWj~Yfg$WNY$hW0N
zJh))ZaJ7F6OUOoh*2pRAisZgN*l4_R!z$?u2W~g5JGsH>^rDWm)e=*j4oI4sd3{!K
zb=~m9&*s0B|LGSSqs@!gyBmrGtx6Jmen8G(Eo-6s3^p5$7l*8wYPFs$>Ew!8w&4GQ
zhiBJ2cAiOZ;LH=Q^1c{pz+EZ9vGfR!-Nr4xXR=NfmQT1F9FcPUUJ~nEM$T@LgA#(V
zs~h94=a^PpVqUv6{_NdXni=xTo-g6L8K?8QeC_6Q`ww=r7oTB2Q~a{i@9Pb=mnJi6
zUCPTnt3v)d$L!qc=fUiA^V>eTb079UEqc&;^o{<ClIIIOZnw{|S6wz+n3HFlo$^6W
zBZgNqe(1+->gjJ>`!N3I`?`aFK7L((?6~-i^4Pyg4!WzvUZo~pI?Po2KL1|wZoaJ@
zmp?0hKl<g|pY5LeqV!&FSae}c>d}WgzqiF^axOcb%xvy>J^a8f>G>O<+CMdyUJ!LT
z<I&MQIT4Xurt@}kztpl33l(!Z?Yk~gV)N%!-f|OyuAh6NpnPe6fTFXHfvJ80cUqU`
z!U>5-3r+{~<Q_VqZg_0T#r&G9))sgE|IYY5WA2MrTeylZwqzaL5hJ>DijlTOpMa=A
zdL8e{_W7n-mhLM)voYNH_Tojxe}QRx!XNK7JoQ$2vD#&p4*f}buf>w*K1)$v-Liaz
zpm5CXN9(2w2$u8CTvQ<KZDEtc9cUik$lLj~hhyeM-hUUrN(U=z-i~H23R&3m%p<Vt
zQ?`~%fzQK|iIq|}s=~G7w#DkNPY(Dvb5gayWJA{(JtwE`<=toV;5FAS=_w!YT{K)~
zb>LTw^>pQhbJBG+ez!-rzkmJW#pbWv5&@~VkH0T>zwzSq_G;_hi}{XSo~?VJvcBlg
zzlK-(dI?GkxZO9;%-ih#wCCTs-+R}ZKhEv_RB??xYoedvhGIjZBaSbl3T!xC<d)o(
zEo9<rw=;Y8KCi97;@5npmclKSRz{XNXXl!2;Ci#C)s?l@LB?HjLffjFt4dq+oXc$Z
zS-J21Q}jFRCNw4R(~^MI3-`Xeu_^f4Z~g!KY%41*?kOq<#5LJpS6E+fFt>8<ou3PA
zI(4s`%|Co@eev{Gu{W!8Lw=t~nAte5T&}8O`NOT-E!C1+mQIR0bSr4V+X?O^>Q=F{
z<JR_=PFRrDShQ7=k*~qL-}Q+18OQ&Jt<P&-&Tf<}On;HQ?CnXNUfYOed%hU0bbPFB
zXx!VD_vX{T7ZqR9lBV6^O1;DJ|69h9#=SSK475!5Z#UjFDSD#TgP*f@ojJ^GYIbtD
z+<Za3YmB#<CdC}SW?gcoE_vUw*^8xIvrE(tzbk(>TTbWvyOPidF4o!yj`rWfp1-g;
zF;P0Vx~Mk)%-dw22Tx+-0+`CKIn274Z<c=H-<ih>`!)FeT7K$8wC(6_%VV0hFG7Ut
zY~O2!y|+^R!s=L$9{Bw(`=6+<bfF>Zm(48Z36YI@0?r#!#8(%eF_*ol*XChfQ^5OQ
z?LxMS$+;t+b!PZwdWk)|%Pl&)XWh{gfB2uJO#87iY!O4}=7;$gzPH6XXE?UJXHgP5
z9uf7Z&uIRd&F>12O}}`)DKdZ6(w3*kLnbE+&F+>CIBlu4eE!U<>%YF8SCjVV-PsqG
zsobA37EO6Cu<fq>`xz!}u}J|<yMEtp^}evImgDcW<gH1Emu^to5u6*%{9VDzq1IJl
z=lti|jB6&=xZj^;sK}QiyylUUW9^*(EU(_0@Lip=ecjcccRytv-(td^WjFQH(_NW&
zm<lC%5+hGPx^^r)TB&vV2mYy<_fzUNJ+IA9SGP8oTySgV%WZp7yp?ZF3v+v}%6v;U
z;^f9MYjxT1m7%AWPx+7{E4QdiOL*#rYY&wQBR3a4-NI0@Jtl?e_v%f7+0!KFw)$9<
zKTy2>>a9;nho#W#m?Obj>khiDc^3OAu(Evn8Bfus^3z^!JNB2x87bXuoH^(9_QGIY
z^}fqbU!7gZcS5RdL2^wDzfD+qLa)rJ1)(RUZcklj`{}{;GQTr*)4!@jTYF0-?%t$Q
zH)YNIZ#!~JL;RyFLeH^gaklL2ttno&U(efYspsF`&r8&l{-2$;Uwd1~X8Yg(K6C%+
zm$mO2J-x3j_H?NVkAZ^dkt_Z>vpC$pZ#0=!^)piD$<7_ex(h3U3y<v(EqNts^W>s;
z+TH^ewK*GJvS~k+bIdGUBx3R@I{2O>ms*z6;;aX+I~E+C=GxOG$7NmY%DJTV=UD;9
zPygx>M`;MJ{2KATY!<&80|P@M0|SE$>QNfWiACx8`tk9Zd6^~g@p=W7-TnS&PImT(
zZwT#p7R12x^~|10R~9ubx*}96+u`6>m*iDb8JOf~7@#t(TYIgBeYhk4I-RW^ipJX&
z_OEbZ)LXK+;lg27w6k(MzW-UUjh%tvq%s48G&cK_K*xHd7U>mKzKzVyzilS)Z(aPs
zUGg~#`!1y3XG)2fv@Lpr31?XH4FMLm+>3_kGrzc4IR<=Tf1Cei`rE!M+?s)XOzE<0
zXHInM+>?DjulnJ{8ehBE{lC9HXgWVL;LQV@RHx6Z=|2T6Z(jI0NmfQJfARGvK6!G*
zb=$8zS#N*x;qAkRnSXrNwG^L~YA_=|#m{uQQWsnE!BV~Vm8V1^H{~2IauqXD->iE+
zNblW=lgm9te5b_-{)jZzGPyWu&C9N<Ch{{UF=?Junx6e6{g2;-K)27<(`+YAIr~sB
zZBKe(%8mz9XFacJ_R=`Cf=OB^M6Ii*<7LUltGDO)E^k@y811`4AV_*?XviL~mCF<&
zG{g2@>X#1b&@$3gQT5bJ+`DjRQl-d8)|o1k@2|V>f4;7!{@dlBPx;*i8~q*Ixw7~!
zyIlN!PQ>%8%*_2yM0gorC?DSQKvKBmY+uKvowZXpvChoenUu67Vw;5U*<fQEweKdk
znKBm!8U0MPa@=+DaofrnGBx4-4_?n!xV!eMls&_p$a5>wT7;Y(p1dhHyPj;|Hkp0h
zbQgWelRFYza;_VH*>vgl&7P$$d8I<3lll_Wc5R!b)Ezkg!<3#YW&2zb9P1k@Vopd3
zFMD1%c`qAt>XiErxUcqIVV_WToTd2$gYAWAUrSb>6G?KNF<1VW7M@cGV|mh$zNg#o
zYmR4ag?qx=84J261zk0?{ITqx?9KKaAEMvv2)A9AZlwK(d-1XT^VsbryS!&^TCAs=
zC8VsO*_38sqLiF&*I|8PO_h~-hu_L14QBRFS|YZwemuXWRvq)Jtub0Hyguvf3ITcX
z8B-;A`r8>>a(4WX+OA+^vd`;*$>f9wSE_c1E{|nQO6PU$P+sF+bLGmu^fiAHGuI`r
z_vOAHr?(~j{nCXmw``Ytm%DzhY07%#HSK#%x8|>(%KxqD;o?JS$6w4WDP}O$>CR|!
zp7(M22c~Hg{a(-gc<<SH9sd(`;W7LSGDY%?bCjOs&wBpl;`Z7}F$GKWXH{0dUas`1
zw80_K@Mz*D?iOK<=U&Q8PLE#kt~PpbHi5CZU^1K7;%J5`PBvcK`!>Damb&wH(xcT1
z5eBPHY)o!e&0CzB#<rs^dSj@L?6HmN$}5*KW*(b&E+|CH>QnYv-fL1KS9P4WJ72ff
zod0@R@x6n)rxhPtYxHV2_sm^;TNhuLdEt-d^o4fTvD3mPHPvZf{n37>ZFBqHHrt0?
zwo(#~(b<8AOruu^#xw_6Mi|=0+8%fuazfK&+2^Y(Qu=q-#7bQ+`1)Kgy#8a%Tb%%F
z@!6lZZ2od%Vg15aH#%$MKbVB%UGvdTjf#lS{gk|+PU;1V&He-F%A#oproP;rS#~*e
zWu9V`-qH;22wRgM_Lq3e?wGrE{wuQSuQ4&(x+kb~%e6G4<&oFkg}gSqyk$mfwvPAY
zYYi=jw>cj9<GhfM{e$^Tp0q7m+dfQ<e*Joh^y2InW|!5LUVN}j;7G64$=*o{@^UHj
zz6l4nO=~~4&h5LZm#O))N5}ZT#knnXShjnq%!=4&R}TyCS>~kh_<36Y&aVCwd)Hb`
zV2vmY<4@iB^U_qeQia|FSI-tr<T>4Ub*B1_6Meh1{N9AlIT|KWzirb-$+!9wD)gsU
z^*;F>AaQYS-O`!oy$(!z`9J5^`LxN>l51@r*i|0>cjHpg?g_e~8SJy$<Ejg*)joEv
zmYt~m#wW(PAt$2p(bW#s#RpjU-ETNeRu$C@Oh}hJ?&dW4ct-o;Z#{1{m+jJ>(R|6$
zb*V4=jpe2v-nRID`*>l&wOci_@0w>kd*`}zUY+fRoj2s)9bEnRVDZIom2o0(!etZo
zb2Xej`epS2n+Hi7*bf}|o6}%BPn>l|x50rAb`ob}YGivho_g0_toZO|#P%O?BKZ^U
zvF@C^gLn6t?|rXVe~S!nE%jP=$URo{fH+41WB>MrMT)M6=JPIbJSF6!vinu7RGOwc
z<A#)bY+N}vrB@1H+{-VtM50znjGLihhw#cfuBVhs8nu?cZVYjhYT`=ZeE#WOaL)e&
zA=~)lSN#)V4u5lFyZ@?M>o1K>cNxQP+)J7k_k4-bh2M=zH-7R)*9!8n^c_o|IcNQ;
zj>fCOUu~>xn$4G=c%7Vd#L{<_`?V`3sbN=dr2F^CDIEEeAC>Qs_1FAn*jw2Tme;*A
z4*jfgzjN8dba%^!+07T@H+}JLG}}6zeO}+*O9vk}$aq{XxLAAHkJqL2eD=I-fs3VA
zAE%vraQ5SZ`d1BtxtpAry=N3#oz_`9)0QVadbiz#Z9A*(d++6p^ZDo++4w9d;(NP;
znPI(%pVt4F!oq16*QUO1n61y2$7ktarKR9<^}1T@!n3U>gY<l!FF4Gj_hen3<A&#H
zH#Ft+j<1*`XD%VMuR-^9+F=)~RhGK_iWy%^xl3GC*Eg8wolKpXbhheS-QJ7ev=;1{
z{&ihW^zl<+Q;K7h4+?%xof@hZ@oE;gXNk31TJWB5nVJokZ6tYGt(Yfy?&MTSSb1;f
zF)@*C??UTlG8#>4nyG6$Z)s0w-Gpb-^SX|BzJ79fR_dyh!Y@hdls>Q>I+0%*8apv<
z3ol#b=?@7@7K&=FGcZ5<<>^MlhTE@Mv;XDFN)+u~W*RRV_;}&rX~Bi;z8pG*OBo7y
zf2!?!yGl!Uu5>wn>*Soj4o8o-DxE!G=OolzB&g-f<T24JLgp_oYI9>%)HY=w4hDuo
z83qP%Y}I{oTDo3A<zC6#d5@2Mof~gBLEeMONHC{+fx-i&DEHlhN!8npE~^>vRQdF+
zc^RZ)>|C{0?~mi(-nz*1mWOxmn6xTaJ4dDJ*`4?8mdV@Y>;HWH<K?Dw^-+yr_m&CT
znp4iFS@vIh^r!dx+|pxun`>4-xx6dk|1b6G&v$2=KmYKReVYgO!~;uD86V}IxpbQ8
zOrL2>^=>@f{axp|7x&XhvAI*CGSs-w$}PG&`LW%G&}C+O5{yy>!~G=>ux78k*_MBE
zmOXda8rB0Up5G#u`R9Z#6WnxR-_diD{zAu>wwGkfU0Tz?o;~eY&+&~e0Svc{7D;f2
zJ=2Na$bNIhiFY?xFSqWh|8V2}H7Ciof(DJqJPse-xf^rCHfd;2zHve|?uVMc!%UYt
zp?zOJd`P$}x}Z_RCTOkC)9&97jw*?37IZJU@SV4%SKyiD6RoIbp2^egYvt?yAMeb5
zf7r42_{U{A-)kPd3vjkPXgzIf(9O2ihpTkFR1Zx!$-84cgLf0>$?jXL`jX;4Xgrj%
z377BOa_7qVCzEu%XPr)(y?FJGw8qenAG1F7FZD@Uxa#t=isYsxcK0~uF72#Yvwr=@
z_uHRd{-Y|iv(sQ_Qlt2vZ-sJk|4jD(sVw{~r^IBJ$gu11Su^qar>8a^K2Ub{=+!^h
z4Ssz1{O1_Mlm~mPtxwo>iZs5}l&M?sr?#E3@cyE^Y^Q&|ne{=eHQ<k6Ky;OL!^1br
z#kQTe5_@*t(U*m<Corv>=6WoxH-j(g_UyycUq>H#{pxX!XVnE>{q8e{UV8h>7@Hb9
z-Soul&*e8A-F>vivdD7xE-CB1KXadadFE_TRQ2=WuPU=5yZ@*4H!J3z?mF6~`p8wo
z{o{GNw1ub7{l8<nw$O;>!_<nzIf1;5A!nvukm`9U`TK`}U(MkT4~CaK{MHND0ysJT
zi@b{Aay?lg#_iI$?YgP{uUegO?KK^Z<*KEQf=r+8OFs9OJ;dm;_q?2<=z~YH{#zDU
zYZUk-*E$!zXfX)$sSe6sv7YJ4s>FRa^jsFbeQ;f5zuuehJtZc)cO-l}(#F!O9eHP(
zRNXwwPg`@}zn|$dmum@o;<-H<f)gbFY6~pCy0E-?{#ucMZ*$a?Y=!-TpWIxoEVRI7
zQiDdo)VInVjyAqGeW!KRE}8U1BPcwa-P5twx=rNBXS*QxfQ;bPMprI8I=1|r;iVZp
z^1>YUfoykmbdRoE($-qd)BV(Z;|#gOO{)&Bl+o*Z=urBUg)dj@ol)k6s*}-AljZlE
zR6OC*vH9D3HZO<B563r6dVXV>Z0->@zR-i23Fjqv-Ku<zIsENDuTAS`;$q4^K9j8~
z--NHrCAezy8{v3vIqL}Szj^H3&DB~*lYMnxm~Up76%oAbes>ewsudwzDMxHHd|O)&
z?|S67a>YYWtvIeLw&xeP9roQnFFdH!U}3=ID*;yBXBs9w3b+v2c<Jhzsz06gx13JD
zRq%d0>xYNCzQx_;&<e8ak@{ku)cWrLOG)sG+}CzYhc`6DZ(3itWx>R@yJC@fI@~H{
zHGKaMoKBi79=+J=#(bBsL)W%W=+!;Zx@Hr5U60wZDf6!jtr1$WNw{@uVNXF~@x96Q
z{e10TUnnK#MKxQjRhbdSR3dzKK_ja`{sc>}5B>tX?Mu``)>p1Ow&Lg}saXf=^LL6B
zFo<=tetqg4V_D$+F+=U1|I2AcHzRdk8}>AH9-GqaWWre`^y|;}N$Rp^Qr6a9Xr34P
zwWi?+kJ*xG3@g^o4ous)$G&5(%Ke5~X78JQw^WS6=1xefZ_oBwc~8Jsl>Kje2H)9~
z;O2KuOA=B=14LI9u>4t8VpcwBQ?h_nrfa9t&L)$cH&&mGHDK4glH01l6P4Wh&`e>q
zq>!q_>Vtb74P+UYx?SThpM0#;V2faA^b*r0uiptCI+OQrfz_3ZxgBpE<vGgOUfYK#
zF?1U2+|YBV<*&|WA^%A%W;yd3Rwl(fH~lmHSf|0!xCKhihE`rYEe#JV42-`$+jl)o
zEy97dig(dBZLbGO&G(LN$+%!pk$6+)bDQM;s;zTeT>e)6Idj=#i!5)K@wKEIM`und
zyxYj8GV8%wvyP2>UfrK{>Mlonp{>llUmuOm%qUO~wKB9=Wa68>`>}vmq`&sm?Z29v
zlS_(Y%gb4e!xw9xc$ad;amA0Xp+&nrLsV1x4|pyLYxHn@qR?7<lOek4|9-x1<FdVH
zw@>h08M|R>jh1MSsp`4VJsGK|=Cv~IGF;l#);ZzC>;;TVKmXV0o1iImApMi(*(nx=
z>-vi0QVZS)vCmD3lAAtZm$iQDoT-1kqr@dH-|Sp`e&2=nt7G|hJ(gX5JugA-M@K-4
ztJC!V44XKYsPWEjvz>jH?XTq24!(P8EN^eOyyI?vwNzX~?y>^+=9-m_>{C4Zyxsr)
z+GJkK^f!P{TGb*UVbeCwH&?C(ERw9th`U`W^~!FB&mpD|mu#a6A&C=Pzet^%xP{YU
z;hb69%j^CMov+TWJDE4tNUkqp#f1AGMJmb~-+P%~*yLgpuC=&x`QanMk2rO>e{=h?
z9Jy?=BzT5YFXuty*Wv<SR-G%GQFuGbKVjdw1BayL4!Y<a&~@u5voC(5*Kl{rv?#kf
zTIzGfcTS#bm#dNIvhiHf@xD(+F&}$<wtd@jeD^KANqV_C3r#=z_%GvCcTW6N)iCp3
z(^4~cgI5}io%)qk9=yz^UO!i#w3AfZ{pL@7xBgb0^^=oh{EV+|Z<9J}>}OwUBXL!G
zSAZsa`KrCvZXO<s^F;-_YAvR0i0bU0{&-7J!(0)erd7f`9ZU{MDgLt8c1TTYUG!4b
z_i^jp4W3JUz8=kYJl@+Q5`A@oR9>x&abw%scU*r$)%GmqP1w7Nt6n~N!;>jDeyx|_
z5qk1JVWX@byU(|LL<0nLbZD;m)nB1<3=E;g3=Hzv8X%c@C8<RPMX4p=F^8?TZznxI
z*8Bgf$lST|OL96l?>-qCyE5z1n)2f(!>)asW?NRXH2CC{8&hU1^l0@x*JEVLKjr!k
zb!&#dXZbxh$E`k<-RZLUVg>{6f{V7|Z;toBubWwS;@Td8nqPJgUFR;9T%Y#ltX*9G
z&o8B4ib@XNoA%pzYVJ1E-~0b>xUL_+f8HVc`lR>Wvz~w0bZdHOOnR!J)ZU7ZO!LEj
zcOBlZqpQ75uiHBAYUIYm{Kr|rn`ReH-`ui1a$=(L!B>-NPrF8LFt@+g<7OTmS15M4
ze$k!6uqmZ`PFbGb92>^nrmy^s|J<Za99hTSR~&rxs=*?}{mPnqN%h|&_sSm4xtdZb
z6q<A_D@TrlAyISxb&G}1f9J+%e|lu2|DJX8*@zuouG`w4w+9A_)z~B!PGm^T37*Ee
zyPx0WoZAi;2mjq17A)}$pRL4XqBmB=nirlcv$!L;VJ(}~=Q(RFR{z*PYt19i78{w~
zORMf|d}@^YYT2XHs;A3XWW`VLC*Ah2^?GC#_k5$k9h+NEo_f_!|9{%}H-p+Tz0-Fb
z{tIUY-uM0-k~7=t^w;&JGoRPI{dzmZGNJcdq3VvhF!^sMzDI13Hf`|;_Pg^W^tI*(
zuLTcIEEoL9y5ZGz6|w95+53*KQ-71Z^ZC)BBbo)DtE;}1*InqHxlr^5htJFnlN^q;
zy!}+P_~5(M75@J-e)NC*Wp?jFxto&vVx3g;i)a7W?1|g=_x9J@`}hBUw|=u=GylQ{
z$D%|Hoyls?%|D!AcF@!4Fh81@a$i!byl~>um@DVBfA`IZ+PS`>aC&I!MrPit0oT7>
z<e0LBZL88XPPSX>92*jTJMU%v`7im)tE((Wcvz--Pdt;=(!-cAf1_+~)54z5Ee5H=
z4wdJ(=DqwmwbmzK4>x!D=fAt(r|b9$9hlD4Ct4s9t#}|?Wc_-#RZn?-XsPR+dp@n4
zyX@#b=BrXO#pD*O&}MF2<)%EFoh#iS@rx<9SkbhGw4beY8rxzbeLJ3PUn)}?(a-x~
z)uWHPe;=uoys>qR3lEKqoKhXIP4GPH^!_hD8W(?0ovgm%tajYuzszzbO^YAJ+kYrk
z)|I@qfHPuF&R*8YP~K0Q_B`!8bp1_X!-3>&>%0^rW;q&5eBY<_eiKVtMk#~eWQEQ9
zr+!ahS=~7&bd%ccAAQN!wby-6Ja~bt;1j#TYKLI6L?!KOGS4Gs1!ajYO08Z$Z-L-m
zSB8zQM#qI)`xG93oyBcb>G6DhpTR$`X8~N2eN0DuimaqwaxT<t)12t0rWDuGSSj4&
zzF2ULz=5e2k&hk=L<StOwo6vvNjCdyeB$`-oY?cHui76pXk2&s|5TQSe_4&jo7=h>
zoqs15G~NkWozU}4Yiq%em5-_y_$}<1&}A?+C~5iKm+pM*$2x^>9h=g~@S{wJ=ia3)
z&6@2iS=*Xx8a$rK>~udick0TkTbXvg+;r@OV$ZI|g`Zb3Wv$KSdCpdI=u3il^7L1=
zEZil*qOXk}zTppl^VBlr_QGX_YP_s#9=9;PxMBYFzZhfS;|m&=oxL5sN-Q2<rA|2T
zr6{y7>T?uxW|+5uC9Tv(T2}QbtL{}nA(pp+VaZwT&lXwLw0be_7uIaKUBN%+=d0FN
zVSF;2!A{fC_|MjPdY}KKw{Ak@Lj9}{^_~JcXYVVRl(>K3d0-rrm80<S{DF$&)@p_g
z#?JRAgkI=pnIJO3yotYY;+3e<2ST0a6PJCf<hjGSEaT<0B{Je~9xJ-fYdqWb@`Tv~
z)dwmk1euc>vwHu`T_Ci~a3#l$P8+tBk&F-CZLm*xyg=^nQ?*6m2KGlLEPcXJkg=2b
z-oYrfLn&!tYhGl>oXSsNtMGkesK4*vL5uwK4F#?lh6N{Cn0GP;vgz4w-_L(DYlHdc
zcgA18_BF3*kl$nXr6esrD1ULXME;`rTmr`{<*%#RCeQwIal?l#m;P!9-*~mymT|IT
zo-dnV_56ho^`l-jMD0_1AGw)<Rjx;IR^68;vwhap?l97r?qYR%5hLgHuHt5G*B~e9
zpdO*W1rDmae>G{EGR$9Uu_1o>ey`?#uRmSyd}Vb$&-Zp#ySLJ*ov(P;G7AXbFEafU
zT_?cB`e4%Ow|z&yZ~tECI_>SgHF>Eliofeu+f<)qJ<0xdKiAVA54(J~D6p>RSSsA>
zu{{3UJ%`_1YvYt`R!{Vpyl_Xwp{#~TCWZTX6L!|VG0xonSaSDb&K+|Ph)Wa-IqGZ>
ze)z-l_G5=$^#j)%PR~mGqOfY)#(B~|j<)ou-cWzTkn8<GkC9Jd!t#CYT47m<QoGqc
zs5M<!$=7^e;pJf`o@XMv+=_pRt9Nvr`7Zc(_2cH79>u@d*U98;4m++@7P5fnUg(3w
zi4~2#9kchS>FcTM>n!5npExtMtxi+y20N$tYpunq`4{A;oe@f{Yft<wxL^mP>j8xy
zY(0G|zE+n%5%~4oa|K7-qeX#X?W<)LO#M7LWs=z8ORvk{=ijUUFZ+NqZhy_!_@Yaz
z-L7~W&rnuTeY(rg?tG`<G0wHi4=Y3mY_UCexzOf!P>RKx#R)slbj)Gi?85$9Lm@(H
zgX+orM}Mr={am)j=-=!O3p|CZ4Hmh-T<Y=n$c66cLJ_7z%lCNx$X66wH2Hp4()~3L
zj+Y$^OP%R_d-ke{PZ~Y@1TXry3pUg|sy%-1-0QwSp-b0&^1Uh}o_66#5o_5NZ}EK(
z`3;XTG3RGr*wq-WZIE@lY`5^XvmZ0g8RU!2ie22AEp4=Y`FGc_|1#kw758^peqLEp
z#Jt}><B8hpe(qe>?n~cV-rbk2-QWNEF^AXJLj^x(ODuA{8n#YQ!#snB*<T?@E?H`Q
z`n@-^{ilDbnE$eF_gRCbrLHBbKD5VNQ;j%S)%kwf>3|P5a}DetePoVo>9`_bm{neX
zs3?Dt_@9^!uiJMqDc!7%xw7Hj-k(3>&hPy)=?njte+)+2S%Q)F$@2sGOEVsamS~<x
zT-di&rczGlhhDj$g<7a?!A0J~56*{6=*GsfKHkW`s;cvm3g=g?t!qxJ+Hk*rwm!X^
z<L|0k3%UNiWj6WcLJXgtKd8If9o>4+qFYW+YE6p!hf7t#E^IAd6!%DNUakEtYlCFa
zCjIYx>VMy`)>R#TZBpUgnI<r8R`~8U4E-W4sn_4^+Whl{->KjwpM~oc4PCBp_vyKl
z$jme4P^q3wr?UAPbGF|zTP~Ug&C1(glYdZig{9lSYdV6S8-@FCtZ68lD0=>OCi|2>
zV%bZ$xwf<!MPGTm-RkoV#{ZAH_gx4uvr3$HS7O)s;FxfOPfL4Bram;dQ~mq!?AfnX
z)z+UkQTdoR^?;WJzrplXck(m2f4`|bZ70RNvbec)ulVNE-UV-!zA!JZjLBKF=~m38
znwT(~r=mWh)Auho<qdMVT{S)4A;b76Yo6DXS5LHVco{KH;b|@{K9n`r{J8$wukVZ}
zGV=BZE&3bY&$LsnMo%ci*8V6L)2*XZ&qQ5bf4^6;c}s|4)v_(xY%Ul1&(62Im!qik
zbWysgjrqQS=+x8aH&(s-oHkiB*QkH>b9SjuiY3B{&wu!@ioIQ#)jjcH`)T{n0jrk9
zy!RG-c>cxw)UcMu71wq=OFXqps8K2|blt%pYgTVMp8fOgSq`2APQ{!(&rjEF|29R|
zC9}$I{=!K9{`prw^L}`6^Ka7Pvg5T{l}Q((md>}&ySvHPrGKuC-{Gxu)}{w9xV827
z|5_H_9A2(loeOJLTWxyc9rU$$xrn2x(tg(GGs+S)dh5iW^FA|tZ2Ru?%D;N@t!GSj
z-ITj}>hALkv&&ZrcRHGASM*tjHyQnW5Ow8&;OQ!sNRh_8EqBtL>)Fj$mtAmVi<!5=
zLbAr>Efb?A->DO)bq{r`tWIGHtb2YWaBunq&ZovJpY2#URaB2HvucBF-D1YqwWqFS
zC{3RF<*@Qpg<!dbMYlu34zt~V%TjUZ{j}%K!T%mfe%PYB)@QTJgqs?nQ43lZyS`$5
z_3O~pg1Zi{A2_Kxc_^OAUaHXT_vQIA#WPXMeuYZQIPc_2ci7Z8FY~S5E^oG$W$up-
zEPUV}EajN8%*BT1ig-lvGw!{~yF<=>40>Izu{VBcb6M*4U5^8-GbegIiC_(z*FGg=
zA(up0q^|CTuuxeQn{!Kz9z8N&deq<FBtf>|6mPHK2P>YG*n^KRSFEvJQC|>Nu=6FS
zkHX63b8R;Ti3DD0RPa51y<zRb+_I}tX`5H*sHCc1Q#{$`6lV1?>irMpiB8jQWh}B?
zmOS66Fjr$9yVw4vqcQv9HCBD!E^YEdtMi@up{ZJIw$YC1@8o$dB$SE%;SIO#UHH;J
zP@wK3>jlegB{uiY$;|BYxzh2sk6m-Z=Vz<-&T())_x#m^ykEP^oz&j!$=jm;>!`Sb
zCZF)sr(C}mU$`1EX@k@Yd+n5VZg$0;F7sRXc+<t_e=WA_b<4STbd~LN|3fR+l(J`w
z2T8kdzB>Qw@!QvpE9-fU|3&%Q)w&zK^YdDF^}^#MW$`Y@z=>_w{<%eK*Gs<kWi^*t
z$sv3B&9yrdmR|d{=37(gTu*DQz`2_aOv_nu!R1|OnRm^Un+73ge(gS5dv5u}V^4Gp
z=k9gdePxEbeY&Vvl2ppAK;y7An;BnyyO<tqs<n6JirbkDs(QBW;_iEe%5HNRPg{C!
zw_C_%W{b1ZFY_um_XV45-;wam+0^(<UEqaj=C_Zt{(d?=J}oV?<zec|BF(GUtiu)u
z<vCb&{wQ`0T@=#wBCU`06u;A<Lwmcze>UC?S2)HaR_^pj+|%{VYZ-$+8J2TWd+#x6
zue`=r|L~Z-?)sMYZQrh^w(=F!ZTM9%-{U2#YSevozk4F{1ov$)cCOj}s3`cW?T&{L
zj}y$zK0LmvWTm@7E>QdtQ{IQ4OJ|-CnRX$&MSh9Rq54B}w<zp>CzYelW5akg_(4dW
z<AP?tPXCFLGClXbz1g$G*Bk$ib9X+>E#Gm9J!j2)rc3ORUrMJG-F<&ZQ^i>Mn$GuK
zwyCvcwQMH>CnvX^VEnDZ?U2*iz4@#Bink`)(iWU&sHmIPc+G6@UjBz6l0UBIioa2`
za`}HOo&VLr(;RXSnSUh79W1YM;eYoe=k=W(H=auxs0Qh{ZQrqC<@ukdkM0P~TA>k^
zKb0}~w)BsJGyiIi#!YrLh=}7&^lYAfaWPXRS4`i7Z=H`??`lO%3SK>9XUR9EFJ-gN
z&kohu(y%l4+2)t>;voSqZF&}PZ*?{~>LL@F%AfS);@=e$?S17Jepk=A;=G~kh_%V@
zDN$Q$<M!OH_|x)Y<Lam1<qgm7`t$DW_Uotn?PKac{}b=oKV`D9>6H_*0Vl1#ZVK<a
z7ohoL-y;X6S@(aeJ0oP}GU4JmLDzJny^WnqUh(B@)4G<f*l#9SJ@G^6=E{en%wGe4
zF6CQPE7U4!(DPxk#L`=g{UUCMS^9p@_BK%4HaYG{BWuo9);rI)x;k7g^Zgy`JvEUt
z({yg7rN*k;0qnXddlj$O%|5g9WHIZ->k9ezr*dvjtx40@&E@K{eW}wh-7e^FV&yE)
zxd*T0RU9<j?H--4w?|Kz@rSwny&0e7Sr%sBOls?_h!7N-s(pEO$%!pD6>cib{@mKw
zy<x>(k3%~*a(sHyr_(>V=F^&GkJnXCV9e`bd9^mmbfZkc<s!%5FDgwmd{uA1k&xv&
zp~$*LZGS&MllR+MvgT9wv>onTWqFPzn<bPzX_vyW2d7dd$>dB?Tlks5faQ!v(cga8
zPD_h|CJxJMg|Cx2CFQo9`kp!2nj<yTKK<;!X`lCcO;~lQ&bn%;>t7oWW`h^~zZ&@7
zEp1-CxN$yHyR_BLlr8?rU8}Y1T0V<KX;})F7JYrOIr6Or<EvJuye!#ThuDv)92125
zcT0Y0;u7yavz$r#w(FYjd)J6bziPSHWxQJ{!T#u?9g9jWc&4mn=x6yobH%@7+_^yp
zj>lRrNN2{*zGV2x{Gu<j-;Y0Pzb2lRdAelk^egAZ@A2<7I>0<dMt6PCsd9sAopY>m
zk%=3G)~)a}nrfNJ+GVsd&UNmSmG6#e%kFF_d~^2^Lu`k9@V>V;T3(e+{)#0N<|^?!
zOn3endsuYAb<0R`&6&q%wF-F1{I)3;W|@@Kv*1hG3(uxA>ooPW+-I2CI3EyGHMk%<
zqnGW<x4!4>wd>rwgSme$c2YIv=kYlgoACPK<%!aN_k`|jdU!&WRcY;FD}z~`DP|`A
zTmM&bD*Zq8eUb5_2Q|O48bgf_hC6OAVZZlSOvK?V!<p*4Yv;WDFlANUgVQ^F=TB_5
z{1cI}A@$X@rwpYl!=qUQHkVZfZr@$<Z~4tdz3%Q2Zh!s+crO36a<BiI!~fFw)uJL<
zX8${G672P}Zoi^VoZE*2dGFN|qvu?n$IHVzW$G8R>~jx_Uj1yHwX5^^o6h^|p1NkP
zIRC=UcKL}z23M|xzfcdJ`zPGu{>Re3Dm{J+&0Ln<%Xp_;4Zfq8Q*mUUeo7+Si}cpz
z4p)^Hd`L71WjZo1{M;Q6(Z0EV*CzXkv+OQerp0-6mX6Cd%`5zy;${e^nt85T!n!i3
z?(52(_S^dv>+5sO^V%#jbe88ws7lW_5AeUlbk~&cdPK7AopnKR3yd0)RxW&TAnOgo
zmXd~A&M;A3mI_yoH!S|jwv`{;bT~|OPbXezZ)ZR2%DVQ@zQt=l{F(fhSLakv_Q~^s
z9%tIW{E|QRdV|b~%}w(=*lkuTs%OkMcRCw!eA$lR7eAv;MpVy=&=XAB*y6MO;?Kx@
zmb`oM^|uxo{ER7C>RhsP-OBf>Cs!@3%?vkp*Hpi?YKG<FWT$g7uVPv6dtCnVW7a3n
z<S(DOA1_wU3%+IkY4R~fds)@<mr`$(Em>RjDDS)AqNz`kb}Z~XfBI{#hmO(TvR_+l
z9sj6gL{H;AviV@?=}+gI{2a7j=N)F?-^n^_!kL)&g1e?g<`(z<4Pes9SvzCh)IU9|
zpUuqnTlMP9$t7R(<zjE{k=T~It8C%*eJ7uEXQj{iZdSTnh;i=B&nibl{I?vDaTD2k
zp4Z~@?<X&FSAE%>9{RH9@r)}?A~R-O*1El+%i`8sjm_6%@87y}aqsQle8;U`PTtoL
z@8P`Q?BsLHbfU}>3_2gIIK(iqR%W`OOG;m3MeW^t=X>9lD^;xREQ;T@y5sHBMO!D7
zrg%JCe`jS-yY(Hhcl%DV{tlS7{cPOQ{0|*#d6P8xz1h9C?%n@9q(DvbwV}Tn{~Xu*
zFAwc(VY1qgn((TQdzV4d(aJ{6hr8G0xYQj8GOx_DotScj&#pl2MDV)X6RVcIdKPj;
zr~mi1#g%td7T>PYaawbJ^3Sv$zf(-Vj(1!72*34R&-bb(S2fG4ag|BT)Lb)%fJY0K
zY%(`xtIlM0+J5@MtvkOW-%V61vp=;j{Py%GYcKgaIxH{z@^z_H*}pqa6t9ZheVo`=
zq559bX`WbxEc3fLCqq>imFV>BX|fc|(-eN&)>Rv+^2=kRllSEOQ!`a=y|mu2`m)!V
zEvB|IeBqb+R>?f%>z3#hV372DxzX<)Z_{-BmnCKr4?LrvY&cQ8V0nUJpUv+po=m6L
z6)+kk?oEpB@L(>U*L*SYpWpKjHzIA1*{1#7QJ*~R%em@5H;Ve5<5|UOqQ33gTiiO$
zBb6o7_lU85^7gc&fA8EYpa1=*x9x6UKl`;}Yv+p`(<pP#yeaaIZC7gd*L7PmRc_cl
zuIQRmc>4IOS?9Qyx?P*U*GOfN_wx1cKfJ2kA``%=@8KxWQyP_d>6YcT!%~x2xfizG
z=5Czd@Jm9V?ej$et@0dqgQzv<AO0$=*>}UL?^#2}tMkbZKJMLH%rN<b$&G&;p1MV9
z%_Te!IHH(D<}7v>PdRqi;M9+eb`o*NMb~fFVNE}|-Q4!Tn&z+Grz*^}O?Ul&$EEK2
zY}NF~lU`d!OYCJ?d+*l9HAfeGX#cEm^s{=_!9&)H=e}+8d$IBD=~?{OyD!DgYdxW4
zEw-d=;nuxIJn#G0oamf<zMIWE)JZ4(#m(Jv{kQ*R{VqNy@*w@<@+o`yWhW+Y-e&Xl
z)STG?c`u#xZ6?dP-%#&fGgW<4zMt1h?c~~~tA|(lPtcTjZlqnsqO<kKo#VNW3+Aa<
zFE&cFH`IMm{D1e_Ery#_mpM0Gy#3B6{E?(YvvS^F&6~NtM-89ZwJVkU2vnJO|Lshx
z_W7>iC!Rij_qorkivN#y{;r+kJ6GzRK5X~8@2K>il$FnQgx*b3>-16BAfJ)E<rYU|
z9s81)OZx@CdTcG9c*xzAJ!FBxYJ;mweZT2l-E$}9wa4;jxvf31ieH1LDx3KSC%!9S
zslD=C`s8aL*D0N<pWLR&&nREDXx-l%QHpyD@12^@yS8)hR{ObcZg*a*`+EN4wQCM1
zCYEpNKf)QcF8JbE=CZlDCzt=5>TTgY-EF<Z_5DGW%hvgBNU5Ek&>Xn><RaBKmD{Ys
zkE!1~d1#(;Yr2Nx?*%tj`YcJdE&up$=gou5{m-XW<^S#ZTAZY2KG)T{uztaf2<MWr
z>vIooTb1`~^|PGtxmIG!S4`t7^9!%s`gEsyt1kDOU5nm-SQ4JS_08P#x8lBDRbT7%
z@y$h<hspjIZv|YP#WFSA@OpIYUbU6KT3(sHm*|?`TpGV~X_U$IeM@Fcn<DY;e(9`B
zEWcuBK3|sA{m<Rq^ft4EW@4E{BH!L*yHm3`wEk>pXPV0;P-$|(e5#mt{j)GJ?pHI-
zkA}8vF7{pH%(CM5Vyk$GkXQei`c2k+JU)4S!zYjaMRA99pU&lOzqZ!kt=**NL;I%P
z_gir9*o^jfj<wI`8rq94y7^eC^=L~-tj7v@-AMm~KP3EhgxNB$u@(o}g+*=;(~Dq#
zd@s{fd$RGnc{eZLYs-$cF+ak8b8p0nyA{)U6`kg@Uw&zIG$C;In$_Zr*K`lpAM8G0
zVOz&ivM}TLl!jSC!3&puo*8oOfyO+>3HK!LRYx@*DN~&H^6MO<t!sbO-;`f4SA6E&
z-PLPOSPNavtekL1{==i(^2GdmT+2>Pc<sR3(zeUc<W>KP{+x5#_qHXmd@erWyJU94
ziCH|3UpACmn97zcU8P=MQC<J_#_4km`D`&scdl>0dQI(e_R7ms55-&k`n}Ql<ul22
zUE{vz4Nc#8d}YGFN6voA{KURgd7rxcrroAH`P<UB>z|hXqEV7vv}=oY{%v;ajmK|z
z3Y6@f==nS%u)eZ-zEnx4OWc;jk3DBwTKSy#a$o%5;n?c$Px{IyGU&fcdpF<X!>Z|9
zxj%~CX<vVl%d>wj*O6z>_`PS?D+vB&Iq>P@AK$`=8%1f(O}mukv*oTj*6m@MvDf2t
z(J!Ma)3q%&Hy+H}fACQBUAd&>okts{*X);j{W##6fq0nrR=(#|>~|A(Ow^d2b#{75
zi;rx`mF?|GHTmbePFeZA*O*YY$l$Viv;N`#2elu)SSL`*`(SbRTmGw)_uP>yFU!cC
z{>0|x?T2lBuRRqn9e=RJ<Ld2wm#d9_7F^}yyuJLp-i`RLiR^pjUoN|Gb+g~b<AI79
zu0`orel+Gbnz3cpUz|`~etPOep5?p3-?GHdl)E_pYN-m_8q+0~UwT<~AO5jRr&vyW
z(mVl%DM7CzO;vC2T7F<k+f6Pts|z=Z)jVfj*x2Z-{$g^G^rfR};x4tNh2N%s`u5c>
z=1>XGuGuBV7rZvvrD#{yyRY$kXHshEYqZhLyZ84G*Q9?>0s>cM+kbe^dR6uIq0@8D
zsl5LptN84VZ*W7zRbR*Bs~iq!@$vZ0GPT%~pv)H)zV+3I_BTsxC9bUr`}0CYCdj_R
z=uz(mzk5eF-#!;sqdtG}jpu5)QK9MU;yGp*?E2Jt^Y3njAK(35GT1Z28SkzrEoWqX
zHh2HGWd4IQweKxm>!?+*Rr9OiR->i+cPhQv>-MGCtmoFscxkHzZ_WfJ{N8#zJ$iD^
zn%Sw=AE$M^wVdLkVXtt^^FC+#|4E^_XTJI<2R%;`uV41}@`hiJB>7#$BP;@*%_`@=
zptm^uuJNwF|Jptp)VLh+yS;FaxU*fZ<@E#6tapF6M=$YuRkO{`Lv_YY4aT}e+1i;w
zlHHd3*PUPPE}Qcuz4;Ei$d>G`^&3he;#&SJwR7LV=)Q|FR=a%qGmC?&n*AM{ie@oR
zm#gaAxMq7zt@f<g*}T6h{RNrb9`CxUU>&tXR`BBYO!n@|tX+xyCCg^ozWQ9NQ!{08
ztrYv+yC0SvI{osJ1OL6A&qB+7e|k5ysz7sNoYb1>o|W+nGRn6<dn=mW@gq=nquFs@
z>kmuLS^d9$F|E?EdC!frzvksOH$N;=TR-6?e+f^Zz>690nH?u?;yWP4&{p5yoVk`Q
zLSpT~zam!)MRWhz25>Bj&QER(oIP(ZV}j%ih8Ty-_nSYje19+HW_$So&X(V&_x+yy
zor6jE*}vMI9Ca7OQ}zD_`~Uj9zU^{IweHLNPxrfcR46yS)O@t?_2GrOd*`!%GVl28
zZFP5j{o>RqdoN7<w?NxzhhSEYT-l7Uk8S_5r0-d|M6jvsx4pM)g7UPCX}{JpTzr^S
zDB92<sQSgXoXNiGo1FdRi2O~zY*sG&_BUa<O5|q#hA-F8Yjo7Q|M=j~>{j6vC8tt0
zdB!P||6dNXcO`DAvOPOvTXN%ce`UM=e`uG|{#(?1Ae@bX;io8$75KS{d6{Xc#U*+L
zm2)E==7E;LuV1ckNj{I=I>U%Zf=9&l_7;bR9A2ySw*y%8bm!*kZCWvLig4l$=C`Kb
zQg$!am?)I0o>_O~+TD*Hckh0`d-41Y{p;fU&#!agYHhoj%GN5F&6suW-V~d=hu-}8
zlKQD<@8s0AN7Axy)c@b~dHVC`#(%!s?$+UXvLa+@$Q_PIm6In=o?N8Yn7To%RbggY
z_R5G;SKT(r>K~EXl9)ZQ+0ON`N~HGA<kL@g8BJ|^I;m5(%D6|o)#Tbrzd0waEY&dU
z$=+6QTI!_GJKlNs-#ztN-@<tGv*zN%DdI||!QVLlt!in~@w^uwqo-&8?@Zj*vUs)U
z`seFr_(<0NyHPW5zHi>7^7;34?&*uy$L#0t4PT@%J7&!b<<)n^eV_Z@b-vX(^|#Jc
zpLFYaTAh89v*+FW#Jk}3yN>h1ZS}&-XZpN-eE-}2P>~w;$(7&b;<p5v2d}@^yhuW3
z<AbR;y_Q}~Dy&l7BKb;jv!wIh?tlfsQ_YO`v##TrBKabu^HR@Ckq>9)?bbgxdzQ7z
z{J>V1Q_(BlFFD1x-|-Z0&Jv-58!WPSvUJ|v_`OP~(yVB~qcHcNz$KMa4?YaICx3nV
zRW0$V?q5@<R4%yD_)yaP&blS57EHZ-ue_-Aa`(Sk;X7xp)atWa7L&B|RfY1U1Ge|4
zTFP9Ia(Tsgm5VE-ecz|~&zP@&{BxCkUiJ(%{SJY98y48jh%w&GdhMG1Ua_v7tE8<w
zir1O`R(PjatahH6hy7gq8R6acADhomdb=PxZ0gytEwc<v8G5Gf_L2{_6!~hDEy`yn
zTeW6F!R9x67OtJj_WbK1HqC!G9TkOiIHlumH7VImaCctwI^lur&0qZGhYx-4U-!s8
z?)SfjLsu(;mBTKHeP`bK)+uFmRcGj1{)^L!9~iHB+;~ImgTphe>z=o(s!wm;aN*D`
zEeSK%(8s@TZ;G0zdO4x{)OEqa`qsGJatALa@K@TNX0TVW+GfjOE-hGWD?Dr8fm%+l
zHwEtVZr@{C%H*}!R6B+7iuELJjfDr&=3Z0&dszFiSW(9T(Hw))Red7TiAnQ9WRfi&
zCCi`m%1d(2d@UDmuxQ$)t^0QDH{sdN<`;a3Lz8t@M*+X^WrgkcQ*&Pk80GfeogpMN
zx&MRmj+cSeJ%PdQQqD13Pk!2PK!?>}+e^;O)c5ilivL!gb!iZs-ZWvAl*~3kzMQ=p
zHc1il=C8E#uh%V@t{->nz@AKAN6p(7zLFe0lauE3WZawl#nxbP#_l;f_ltP*JGY5h
z#5YMg9=@P*>_|qhQ0bA-X(vl!5+hTu)GayjIZL@qaOZq}<-5~XGkx*6D=&RBNaj>x
zn{kmr+mFU?%h>NOJ9%~<-{L;U+K&1B$#z}68_&J2iS4|4**0+RHoiAT+*dzDuy2%N
zZr&s#vg>rU!bZ;b(Jcy_H2GNc>Kju^A~r}y2OT>m^z6bNmYhnC8b*ItOGz(zuJi}l
z6DF%ybg65s`m%KG7e{G1HLVAM>>uQ&|GN^WZvVjHNvCnjjeko71t#-f&3~(6vQPir
z;uYN4S*PAMoc#Nz<kpNhF^xOgiCXi1SL@9!I>#$?bCr?7|6R>@xibH13(xxar|<eK
z%j>~1`+4?C<U4;+|JHWyvWWf>p0cGY|DId1W~0E#GJT^H%eMT<)4rtZS0|P6`QHln
z-H%u$k9#D3nx*&9@|#S|mQ^?BJr^}w@+_)%xth&`4T~=-^enHw{jhqcq(RO4ZQHjr
z`rKj3VE%AI)5vp|$ni7xRvnYrE314*RUsv7*8MLJ%2JQ-|2Os2{!dQ|c)y0dN%xOW
zb$^#1;cl;a#@4@0E;qZ-k%ys5*nInAw_I=Qyr*jK+22<6s>=M`o${UU#+Fx&xlc^?
zoGRCtr#APX@wOio9}E4q&dG~+PiiUc<BpS;7wTlVcQbzduBaIAt&f+Pi`R*DO}IZx
zX2~Rf<&aJJ*UBQwC9=()R_eVM2=VdEbV_>Iwp8fvgWQgjOb=xWgf@Mgwqe~w4vxoX
z->Tp1&^@6uc|mvQ!r$qAb!B@}(mxxQwHHfl;^T6799Xzn#49|jBka$)51TeUU7E+?
zd@@KVcFqOe^{N{tU$*<#oSi;>qgmUx*7Ye>zu$`2-#fQHw|j$~e{o4xees*6eRF=K
zx%*$VjXmwv8lJMpYT5Q(x4s_lefQx0kKm)u?LB>0d0)PrV9;^r?8MvKRImMK4De=V
z5n*6p;9vl42`l7eoxPWZfgy(<$Cj+J)S}|d{5-va%B|tK`H$QL{=JJg^j%`SuPNEX
zUa=!&>8g@Tq2XI=R<vm3oDs0zSYEq3dxweFKmY%3^^xh<%{KOC7G?4&-b;HvGd->>
z&7$>w{oj}U2aj90tSk7C*c)?vw!~A3x-$_H4-=lSpVN%#dgFKO`oy;Se{F#VQoJvo
z%Gee3a&o4ssa)Rpps%>7s7UjN*wQv{we_qQ++BrO4X-oRIjUN;D4l)rC$veyLTmmM
znRI1WuG3G|uJ1hZROr!^08@i=t=k@)(yYH!9(iVcqvj0DzRkyY8KWley)YvtkGFp5
zQub!<89(Kdmp=beYFO4FXWF*rNyOveOS(5U`R&`6TzE`!vQF!)laX7lzn3m!-Eqpm
z#4xmVn#-sD;2K56I0dun$xm1|rldqhemzun?z+nLp7o+HI4+-J|Lr%^bHYcP*N1)m
zGNct9H}bx+*1lKV{PJ@8{GKC`=d<Spl%&Xo8F7mQ3B1aR6nZ`HcKKdcL57L13vKtX
zEfkR~P2R@0pzDM9mh`|iCla%NBzbwp9WF_lb1!kym2<99=~*>p+r$>?pFHe%=*L$5
zCtqhCwVk}fvD4<rW~DRbArj4|X&!-(6<P20m&}@Ti{;deN0t+QSoW(f3wfE9udyvs
z;r+}jS>mr(TrbwYW4A;2vr(z-`_7t|yUrUWFLke)w^=-?h~uf<F5R!eKhCCTCz&nf
zay))gYN6j+{@ogU${w0~pNU)+xO~~oyIXA5I`Mm<>l7VRr|u9f{If{A())AoqwJsM
z?b|kNKK!arNZC<t`giT*jV9#_!hZ9f)fE-ZJlp=*HMC*hYuVFBk1c(1XZ{cMf4v=*
z`LAuaoC_)vGGUtG_i)e5Da>m)@8mx}_~_t%^{BmXYj%8iP%UBi!;$-{+F#D{FJ5<;
zLt4)(iwYbRcG)a)_xrk?Ez4|WS39J=+p{Y-EIzc(N9pUz=$3{5@BR2@@yCpH%VH*_
z)~_F>w6qt7v3~xTup?u6`EQ>S`<6M})0xP7<>7zttlb)Z-I{H`GD|cK9Pb!y^1SYQ
zL(U<1($h|}<cXPk_Wd@?<l&w8*z(Pb-ui9Ti_dPI8}W2+c~ppfPLFfQ^e5`#A1u>5
zV<Ue(OV8Vta@F`H!`X$k>`$)z{qLmNx8=~xmm9y9?bcLyu~X`ovwg%`FJWuuj_im)
zLs6lM?|fmx3sO7xZ7Hz#WOlU@ysfl`Y4wFhkt-9K>c0prF+ap<CE<Hw>-37xS!b_D
ze>uPVuUXUH`;GsdrC;`T{pl!35WC@+u}(ZR{PLHBdzLM_#aX#p;q1!OxA?MOeJR|p
zCtf@!YP-v4;a>)ut(^+XZ^=4D=iUnBT$9C|wp=S`#@7uw%$mD3!!{>{FHoDG!2Rab
zmzsIY!_&++Khyft_DN3uTGDat8t;XyH%jlG>fL<vg0%Xj8T!`OP9GEe_H?Imc;&3X
zTAzpMZgV#)ZnA#0X-?m(4V*L6wzj-q_JD0&>9l|CQ!3iqwU7N?Tkx`UzT&B?l1X<q
z&#lY+z32Mcjo%a0ift?|?p4_{g?HzVIl;M?@&e@DpA}x1c(Q2Dv&{Ki&AX)xmQM4j
zpM7hx!@_rxlje1Pw0&sz=Xt`G$-fVN)y&o0{59xI0rx{$pTcgxJ@H+3FWJmF?uEZg
zZ82Tb6!Pb`anSR4)KafaqtmaDk%1wL8M7Ilo0y%7yb-o`l415?1A*4^|6R>Ik#8oX
zWiNF0v}Tc#@@R9?beed6TZb;EC*Rrq?{97tIz6T8!iSIdUcQ`{zTy7fy0rH}3yNms
z7KOx#3B48GBcZ2tCagQvsClcIxc2E&hqHcu;ArPc?Do?>@v&#C8Sl>n%K1V<@>(w)
zuH3n}a_aLS%MVX1iqu&})(XXC9nF5Jzd)e)%)#spYnj&RDNJ?G*16=ld5fw=nxyYb
z-d%AjoXLCENj9hd@M_riv+A_}k8jP3zTP@_nez^JZh;f)EImIL^Y6cv>K<%!kyqwY
z(yB`K(G}nE_}X3en7#6UQ}qtaTD|G1>ZZ2Y2V9()Bl=oHUd*`O(__vYs^s@ZtFyv?
ziSqr8y3AXz1lAsNe7`&3%y&zx$K{hm!pt`a?8;o>eN!UW_DHp-BG<e_^FIbj>~C?I
zJma7k6QB6wfGba4Y0H=_ey4nM#bU>o&Y~0Fg#~bZtQUy68|D)q`sVd~+Zk@PeYuDA
zn%~baRo{<@D$p9<4$j!Gr92D_YQ_u<QfO;<!BLf*pPLJ=pRPv5=ihb{s=vNG;t2ng
zfJooVuSKuU<+hkKXI1E%13`S8GL1`DOx<JX`pM(e#>5}H@1J=y>5l63Npq}N{rJtc
zelAZ>uQOIDJ+kb5n|z=8q34OG`j30dr6s9WTuNWQ@p=5`$KiXYuT?hdc=X$4&3fZ+
zub%Sn-*D43J-<?_HRoi0rNB|?3CWV*&DLJi>NGo38h$%xcER=3Bw=^YV|xsGjP!*A
zXK2lf%Wu|V+IXVU<LQfY&kaA7-empzzxn=iCd<ca9oLF<zirC)J#78sR?zjEwK|7P
zKL?p*Z#~j=wrX?#d$)HFwqJbE|MBPSy6%JSn$I4t^;k4v+rlI6PbZzzJk+CJc<AB#
zL*A9=d{^b~U2>IcPr=@=*Y4b{FtkqOS9$ZpZ@wk-^40r}8rJ^*urT7Lo^4c>z0KL{
zi;kuX?XLLy+aZ4Pp&hGEE?2SL`)!g%{O>n+C!M?haeq{F<K|BBN1tZy3YqeyJ0f+5
z-O}#7*Bh@!Rs7@SpZ;!EyUoW<8iwYgT_21iEtYdHeQ~aTnoPL;h1RIOzKX?hk3QAA
z?E1=Nc6OV$;70j4Bc&HP>veMM4U}Hw*hk%nGX&9*H~t;$Sg`qTPU7!QLC5spM-P4T
zU&S@|?bKXudt;>&C)fmTIV_p^I)9J!JH4M;tq0;fMVq%TukX2Y^XSo(54T_bxMM5r
z@3ynbv%0+U<L?ZE;^WVoPySAHtg)UIH;1{<WT%C!R8p5w>C!(B{yu&BqUPB?x%u<s
z>Pp%lpSJC}-2Hue^Terz7PIEm$?)Di_%g+4ZQ#Yp7ca!vNzdoMd%C-O=I?hU-)4JG
zPFpU&++%$Pb6SAKymL89UG?{}91UjjtoBgc)ctlBFDoDWqN`gjCm!Fw$yJ0^h=W0a
zYe%Lv_jj|e!YM+E%s1!BtJb_sjnnViEW*|3tvM;g?7<J7bEfC-bcAdxJsT~k!#Hcl
z<(C^K3qPB%CO9kl=G%$8qV;cl>MG|ym$tKH*O{9s-p@CdtbTM$=jNv-whvo<4>kF`
zw(;2NE4wjK#7Z){tL1lO0l&eluF?~mR)la}mq^*Rv;Y0gt>VYOw^|rJc*oD()#JE4
z_(ZcQ-wLfD!DTbWf9;9QcynoC>8fhY7i*`<H&{sTVZGm#cFC;T+x?vhn_KgL(|PA+
za)hWDOpFO{Q7XP$cB(ma`q~K|wadCEE--mL+53y_<Jl2)OaEB)JL#@iv9O&>LF>nP
zl_$3vX2f5U2-v&iaj18((Zj+;b5u@ePW!UjFv{|Oor3Q=@9MJH9b9{Px4b-VSFLfU
z`p<No`IFfX8%DUTeyUYh{padL*5~V(@_Dl-c5k@mw@1IWq-oB~uWB30SmU2x(ww7l
zDB32epHcnu;<LxNr#Es~awXnxbCYHiow_k&Y1rjyclZ*Y&e`|lwn}4upN`_ZUvWK(
zHlG#dr>3^A3tG9}NjZh-HM^|os(zChr6os>X-_+Nq4`*W+lPhc4`~|A$UJcTf8OGr
z^3H=lpFF6V<HDWKn5ul7+5fD-EJ?>r3I9)3GG6_CsM63pSFHLspV{}9lP_-)Y}uG~
z(?*v)<-N<Rm$zMcY665>^iJ*8+LYlqRXXtgS}Tc1mzQr~^IsjbuJZF#TPcI7^#;lf
zU%67BmHE1M-Pk(g+N)n7=TxUyaH{gHIl#vxw@vYMeX4%3+bYuquX;HO*UwqBCuOeL
z)+JGEpEyg1y=t^|^Lo+{#U31+I(=10x(UxAx3$3w_FdP0{)2bUhN<tpuA7<9GLCWF
zE1VMGz+rUdTl(IGA2hk{CT*K{ez(rElWq>$yFwStR^M$~QovDL8@lLN->>6WrR(me
zUdWuNQN`q-ms_6I$sHpieOe~m-+xd1%i51Z5;Lynrk~o(qo<IxWnV{As`Qo81#Tis
zmfV&|Y}T*NIc3Rs+U;JRYn_+hFHaU*?gV2o#=D_UjcS)~K5mnI{LSB|OU|#`tmF6l
ze!c&yOufb<w`%-*KU4_oZfATSn?CzNM~`gwF}{tA&kf_+1ruG$c%>&-W(j^(-tm&h
z^hcoLH6gLS#iwsg;k_WffSY~d^ir#{4jYR4+W7^p9G}cSp|<3isKCY*%a_Go=P+r}
zIMUx;%>MV#9S4TS*3HJx9mE6N@A7I-t5kYAwff;U<K~GI_f}NYG@hOCFT9xbeTku|
zjpZqW$he*~x8>|pdZ%wK{B-1PS=YJyM?=__tZ2M0I6Ia{|JSDvVYe?VH~Fp9)Szpj
z!km6lsh4SoaGD^?#7$rPBUvNP)o+saXgA%p(`S*zGw;Y>*YE5v^xkIn&#>!@=F*-i
zOBGVuGOXWNm$@76$X<1JCtryM=iXY8Ww%-Wet$BFONYn&X6<<v?xL{yVtYR9)2*7|
z=E-J$;b!UYb-`8)r?fb?%5xmq-q@JW%NQT|Z|kM=-R@UruQXfM?`(fVZ+3f0jaCTX
z%get-9QIt&*9x}uV&MHB+McKB7rcGXpRSF!KScT7%6Kivbkszczs+~n+O4^ddr!_*
zxpk~p`uIYI(=OTb_Fn!_cdx{FQIvu2s|36GnjiXlI4rhjx~shxC^*Od?9_qyQ>Szu
zrh81|vbs9snK4tm*zurK-CunDSPLs-mNos6jK2GRPE#3s==sYTvwsxz9lm3by)|Ir
z4u`{6_bgt<`bTD?aiP1b#uLX?vy)F0&I>cskn}oo>3n>%9&_{-1`oF{fmMO>vrpes
zeQ@RB7HbAq?`H`?mL@x|NO#XWRk`G;m+hIK%k8Y68D0JTK~^aI(%PM7S+C@kQ$qe$
z?YLDE(%R=2d2#Mt-&l|0uNE>X>nF?GhDkO=M?OlE6#SrgcVg*6J9V}d$!6c|+?8^s
zi(a|7YEj6dSML~9yDqO=cH^#|DTja?uSDZa^Ned*+gDjOS9{EwkQKV_*-}xpnaNjY
zi?2JHy!gr5L#tB0E(@PBHSTAcUc&xqUJ88=Qc6#m=XA`QzN>Ib*KRXDZz-+w2^tS>
zZgw>C5lVXc^QPSltsg}TjJ7Q4e9vUl$QKmox_zP3x@v8^%L)nN>X-5|Wwc)(=vjR&
zZxb)mb-kt~pV<soeNxy^(x0s_>-|X8N1vD1rE_<O<~N7sG5MKY@;gKJtY+kQsd$_;
zDXL0nLWR*qtKd@epa>ly{_2zK?sd(XJm;cR-KDMD-Ic?OoAu0!XDq784r_Iv<z<>0
zTEykK>iX5#gVNKgJYF(dZRoe_VSAsxe7(Bz^0bXd=4%u_R@o(b`tD=5DSLurcq5z7
zyJ_3*l{on&oty1n#?LvQmu*`Y7o`y$v{3ff#o*h4oyxzKZxp|i`6KKlN9(e-X%mup
zZzp=PtIB%j{_^^9bMg9wJIg1|OSx(%)_Wr3YQTXjcD$^~&hct8H(z>e?bVvNSN6)0
zE&Gcev@L6M)>lZ1ci=iEo5l6y_Tw$AI^`AVJSpuf?;6ewHT;<1&polPu}kzUOK*FN
zkmOoECACerjxS=9l#bb$^lV}BJiSX3*0yw=-o38HO)k&eM1Gt1ht0MIj@QG^NhUsK
z?ywJ=pC@B<k~1i|FR$VI{KQF>+it%7pZ4lhM%vmhMwTb!E}WQBk}MwlWmCWB+4ze`
zPF?#X^Y%$))QNxFHX5G}EtvH=hV6BwaIHYA_Qrc^UtYYsdFgMarTFQj)hctf4*unL
zE&6zD&1uO~TY`7(S9<?s_qP3I7k1j8RbTt3dfVc8T?Mi$k|wWbzTCDs&nocG*3OxX
zuOfdRPX5a|XSV&W>z|iaIOI<~#1>ZlAYX2;;g>lE7UlCkJ(*_xRB+j+waZUM?O3F;
zWO~`td_JkNa@P6_N*|_i?X@@-KIMy@la}tgC%ex4YdRFt|Gu$MEa?3gZN*j3vmAFH
z(vD_XB{Sj5kG0Q=1%sacP`o!QJutlYW2pLqEmGTW`$}zf)^=mL{Uu6j(e>-wZ9Egw
z0^V=Dd}z@LmU++bnLGc;tg{Z8qG>A<>eb6Uaet6dcrBx_2gm2LoxzoxIDR{*{ViA-
z@M`_LGuy>~T{=~{<DhwCe_zc>o|{=3r{hgtPkOqW-!|dZ$13M-cDi|$_uien`R995
zkooU(vlfLO7v27{#x!<*)tNB+qPfdfX0d5IyRuE+|Mzl;{gjH!=TmoS&Hw#Hd1l_c
zW3@kf9(?rj|5w>}w4Sx~y5p7)O?wm+EOigu+vZoYv#0ZvSYhkAS@8~sMReL4bLLJ>
zxOF2kM2K;7pqyy_EVm<b9&$Z-Uj2P#-wMxv3K1vEzdmsa)GSZ3UO4aS0-={7k4rpy
zw4Ukgw!QFdUDOr^Psw@f+o$ZEX!K^$+(SpU_gqyBo8J_3UvILPcfE5&nZ#{TUf~$s
zjTsF$|L#6-`k%Kt-z4<r&;LjV9DzD3Ve9iBByck@Owh#9uS~5-O)f3T2c2+qH!3>+
z&N0!t>+5H@uzDQRK2$2#m9vqRCwg7)k!b?j8BCepJtr2Lh)zFTkhb;Ks$cJIpY!M&
ztCZ{B%#-u_vB~?~9LwqNV|KQ`dHnKqe1F}fl^R<us-|~dIuX-VbuKQ<X0MpL{-fvY
z?Qf>8+O~DiF0(gBKimI5aBdxIwf+{ZNVPoIg{ws0B)fgMdeAX$wW#-`n%rw!J%rT4
zr>^3CoVt?7JZS2#2McyCzdk*5ZO}r~$Fpj;M4v6ytx!9?y6m~+-Hh)ua$C<Q{Ee($
zE%sJ@>Fm#scii2pbtSYqzg0*4)27-otykX_mgpSqnY+qsO6N1nnth^M+1w_FtksG;
z%)4@Oua5E7i^gR^3kB@Ea=k@ecC7m8wLPRbVrGZ6@~cVWo}WvO*{%5W!!L{Zj=VX)
z|6Ah=?&r=u+I-)ye{y(!fBfGc?+)L8&d#G}weZoiTd7j}<i7Ynj+nB2Q<&<^1(C&f
z?iYpgJ<V^aFI{`!-@8K#J(SxDbw5UP@73dpR`~yVmB8~&CdNOKwjSv&&VBXt#j#E5
z6O>L(lHORFabVKS|Ehh-3ohNM4_;m0{b{km^LtWCdu%K`xcM5YzRtVf@z{Fey53c5
z&G<RDf3dir!|Gu?mHA#vtWQ_p&C}7U#%I_4)O~bDV;SrE%h}Ub&+@!15Y>1=$S=*U
zDQKonXV0_M*Yr~=R|hp!`$WIEq7r-1a{8t@))%bHON=jkF5>ih8Q#XA=;$DHae{_Z
znRsZ>nZ=rs-De!nuTSmLs*B7^U$=4MmA}nL9n^|Glty|@R#_<KYM0C>^IWH3f<#H5
z>Go+Xy=vO0FWfn<BoQp;@*rp>)4A%y+`3BHZhJngs8Bt<WFd$5EdPH(*UiQBvi}*i
z3r9Sw`8<8=v)PvMA0uugpIq=fTJ?}tT>fE2;k60ezvG`=etxtq{~*tvMK@OZs=bo>
zyC{y|VrA9`V+*gfzN_axWSV$-H;dxhi_`2KpC~FE`1JXygJ=1&XT10K?3)#JKexf-
z=}IOi<%28CdE>S+FnZ;SyZld#;jPs@=N8smvr6LBW8U@N1!pc)H-$HxyL*W7&#W3L
z1NYr}p%Yu>9)Fx_uw<S=S6XsX(EA%*>Mq7&G3%@=k7>tBs&zKE)y1EVN^yK*`>k}h
z!qs<I-<-IiD<*s4=*p(aJ05Oa)zem>;qfCnZjI}WrJD^la1?YbOt{7`=4{@%NKnP*
zMDJ3mMLo96DXi}6<M-D8d|X)c>+{Fi<@?o^>z}`;_fDS4ChMrL#2?d+|4UOO`}{f<
zrOG!glg+Q!nbl+P=0$$&qe7(&1CBEXUA$hq+NG$cZY=%Wc2<9eQc+~Kb0o9YqMnJS
zFB~U(%=U5mcterHDQQCKW9b#KS&><XPlvR`?dtxUQ*38)uPENs=xNE!9Wn8(l?hKb
zXsI21*S<vFKp}wb<OVnA_2;kdl6iFJ(2TE{E2_1)W^P{Y+3fzv@v+61pJ$Hq9cG&F
z@G@&1%M@4t^vN!Nlf(iePCs*4yJKk(TX%(q?Qe-#Kk=oH6}%o*z04}GbFow6<`Xdy
z{1)uuuxk$UHeGw;W8F@<lfJ24^2=WOHEG7<+pEt?8TnuFmA>cj<IAxip5sF9%1X^V
zE?bVdKb)$yAavbPJt5yaGwygFYuTUpfz2_W(dhf9!!vIFoq1ySCxt!VT`D@7Hm>n+
zd78vz)W5v*jgQdRA2Jtrx6C`Y-}>98^@~bQ)Fgg*sM2w)$|~i8b3&{CiDU`yg%^+9
zV!S)WtG+VyR1LS{OzCZc2X$TEGVQ+jmc>x|z2du@evOZ+#sA;B_OScS7VC_5e}{v9
z-MwABdyY-~mGI%k%9YPMd%i~A`&v2s{_nc1DGO(ZynFg$=WH9zj%|7#W?ajI<e9Yj
z<4zx&wux0@_j|MH7rxa7+rRNEyjvTb|5y1^C|lQeB}S3s+I?p#xK~SV-dbnBoTKow
z@tTEwx135O=i1NTA5mrPctva5nI&4nZ)USr+m)%T-&Q8udAB)(XZ78XwcTs>aPX|Y
zJ|Wm=gMAolt>E!lN_-N1YJUp6f*<LLPEE`|@ZMg-`H#%?(%UEfi~sVkS#m{cd5HAI
z9d{ktf^r)^cOQ5buwu&sv9$b$%T8^||HkpfBJmps)86l1StggJNc`f`v0nStCu(kd
zF^65KyK8dArm~Lm4`wcmUU&F6wI$^LY*=NpLqq@6<Vk;nPVHXo#AIH@y|9oqJ<j<n
zV|@r8C$ratt!)M6oJ;efyfbuj=CqvaJ16wy(VtBMg&S^X6+FvRE#towdO5v$Z_XUv
z*9t28fAatRU0bqnfA$>)yVmF8k$Y;ySf7~1t-mzkR;01n^V_K(L)Tsl{jq5I1H<|6
z56eg}_E;!uJ6YXuu=F{0c%{&kACJ}vtz`WBwjuVyw@m^&Go-q<UDNQ}YL-`N6(n)Y
zi+3Um?}Rl6p3lyB$;10BFXIT`ir)Vb^L%*}%hoM7c&#nS+-E%R#>y9+j%}aMs+!x1
z-}JAzu9Ny{pYfSj&nEU>a$^=WS)sE@W%2@1nPWk-Uuv$9oclG{b9T?3!u0b+e76f<
zxdi)eh~~JT-1(1<Rk5r8ylmpiprUEtJq)gd>(4m&&-94C@{~6+O=sTZx$m0sdPz{!
zy@$>zMxU;Ph+GTk<@#^_YE$gTJDtpt*BO1(d_6i&IBjRVuYaJg-|(p~Pfvv#TaEsM
zd%G_u|Kj>n9)H<)8-w1VzPB9~aSNC-+G;-iYMDF#U)i^BPn<vfjh|LL?dmF}iyO)_
zj!*FWoOeF^S8db7-|=?yHhSm$T6pitGI_bn2@Fcs#}!Rhr>M$UO>gze*AU6rD`vH<
zaNC0@uHJ{K-O|QaSzq?D^jT=Eeq?H{r}(?8^;O7`U}Ki!mrL&GIvYpVZ~4<Mysq#1
zGpQnzUXA0NOE)lwnmFaGJW^qFZ{CWC*)pyE%eDU&UTz2vU-r-~!))UzPS&)@y&MY~
z!nblPl31J}>Xap2#-vxAxzMEOTD6E@yl1rHu66_NaMix&jI43e`L8!zvre&Jd`+5T
zLY6}5rT-kf6Bv%@C(8S?-n~{A_h|MJyJnuZ&v}|x3qNA8d3I`<r_83NR0aQk!oo>^
z?z-Ml@hMJU^g@Z}{CxSp43?jiW<74|=B;T-t(Us8@q*Y%AC)i1n$Km<{IL97MJ*Q>
z=ZOag7_WTruy}B6xx=D^vAavfHJ0_syfA9p#nr{T$1>31XIW*M|D2eu!QE>+Hfk96
z>T!q0v}njqTzK+^$=vf#b9OyHc3Qi*!~T5ZuP3UCP2$W;cC+Qho~q5unQHa0U0Tmp
zJ!_Mg?d$3pk-@7<nEce1{crC1^6|~rlltlLy6RhX-h8@zy#4jwg;j4R#|tc4e(1AE
zid?(IevfSlKWlZ5%Ck({w=L@Kf&Gg6ShaiO7HBpYoGTM5b&g+r-d&=@m!bLFg+r?w
zPnq<2tn{2`%6#J`=aYYvGGo13B=jc*<!BU}9*+4Y`Cv`(srX|X<G!CM<NUF~@yK$f
z-D`i&=9TEP+q$sPe{RrYi{!)47(OV4hkiVM;Ap)$LwfSZ^xdaF)bT6GDZLSUZyhGL
zLTrw8(xna|@rf+E<2?+@j_lhzo&P>t9KWyfO~>D6H(f6)T|dia%eFH8{_JVro<1rG
z-<3V(iOlP-8o&MLKTF`hDf{JDqw1PJvpil_eeubfvwDmDRf+wF<~Rl4_w4JgxZR|6
zcb{3`$Lof9N_ke^zaN$TYF$@7;rs*j366YQ-KSQ_ZZiM!Y)aYzlVc0N$8XM?#N9IM
z`-(jqm_w(nKYgV-)vMZ}Yp!s{>HO{Y{%Ngzx@9i+8+O4D&9^gdgl*#d`SP0Onn<fH
z-?I}J?3&l~nQac+4UayChK?Eh-+SwJT=WyEGV(Qe$I1Ba+l7Nq|30gGke<%fukz@;
zVpUO|$7>Huxi1`({_5OaZuMtjbKN1vciZOWeBP$y`SQEBt>yc4-^(m_=S%+;M@%Dt
z=DF)jrMH~oWngGF!kp&@Pa~vd=A<STWa<@Eo|VeZf4t-4?t0dZnhHCgXUNaL#bBv0
z-FMy2)45`^x7;{XTDryM=A9FhR=Eq6PyByxrlMw`(A$*a@GWd*%ALlCAMUYy!nph2
zkAI&ZF70s%>pa{Yk+RiiiAMho&x4D%TGWW|nJKg3@}3*hingx1x!XMd|CzjNO@EbE
z*(7h=A)FbP!_a@VDPL{!k~8KyJd>B@c?q`p<aO;?BYA$)o@ZOnZ1y_L61eXs11E36
zFYf)K>HHHl1TvQ0tItT0ntwXv#rMlL-cMF(c3yBvzINLwP5YR3*<wxhwijw=!(T-o
zd|j$FJ?(+=9;rY2q3)|iCZGIzc6oRI!}IC&`_qo+ymOVFabvdOdJ)%MN845V^IlJK
zU-bP`^2u(~x}CzQtZyp2PpWuThH73b6jhhk?^ENc+vwroW;D4};@4D<$&%5Jf(}PC
zy_mRjCDRf4KK8c;AFkMacdSr6th&CXO=`j3w73P+n)(^M>)+q2s#RM0BV2jatz{P%
zb6YS3<Z)ViscQTyXkKQpi22YhcURBN{Vso6L+?$QxT5cdZ-M6Os(ag8ShZ3g9_r3{
zEV1A_&vDm98lUx*RynV=Y52f)=I$vSKJSPuE`x_{;tZd+vL2i-{&eGw1N*O72U#Q@
zJk4c!`F=WcMaf1*ojU15xmy@Rogb7fI9xGji`q7!(i@XCZ{C_BTeshN+uVy&nf{m;
zuQ=+uSHJSRN-gi3*(?0l+TVBZy&Do5yDO8=z^X`;L3H7^?|m2AZG_#eYn5)?IrQJo
zL!M{9)jmyW4&O(NVUo|bf3cdo<-`+>WbKPj0;Yey$MJ7pRYtl&isWR`;68?g!~378
z+U#w9FFo_(=h?@P-?WQL$=J_4_nbhvK=tna8%Y^U)=oLZ(lIL_@wkF;ev|%QiOY(t
z-<Pg&jp%N_<vv3p&&>6y@PQu2`wLb)E)TvC#3t10QuxNSwCIO={;io#vx-Y{IXrg1
zaZuy=bX{Q!>!w5Y`$Sit{Iz4v5rz3b@3qUE*`#$~5$ocfkoBeli?=%GebBkBSv=$2
zj2#=!REa)nl1o@1GQ*zxz!&fL^S^vG`0?1@!>69XiB0{ax0)l5^0n+htBUs0ZJSx7
z<J`03*(C3GFwQx;NQPI(`(VDh^G(Gc#Vn=g5(5oa7f<jOvp(YDRlA`zwPlgh;wTlT
zWQ~=M|LxA%vL0YA<6NaS>xix5I|XJzSFyx1+3zkN*pmFGVeXx$MrykcUQ*8M3US*L
zW)o)pbI~2fdSS+g%!fBBuKC%NwCc{aY=xgf^VStkFpUgu{2|cxv*xJd*9_(pS~Y6_
zbWX}{_?~ogO~kz`uEE>qC;yRHq`Q;5v*A+xBClDE+20CwPj}G2Ki^8B+`@3}M^1IK
zBO9(Xvk0|MWcl2CNlk2@DdYM>O6#9A+rM2q?~=yN!~WO9<&VWV%beL;(`mWnlUOZt
z+ao`RiyGQ9LrvLxe-#}|lDrx$KBH@q%T>?Rbqr!_xA$rFdGep<HO_yjQ<HggN22DU
z(|%iob*A29zFuswUeacM%I#KVwppoPJ{#+Dtn7KP;mNkP-E+KJTh{RwW~_4*FZS=P
zj9s+h^*u%%-o&YQR|=b}<<1B&<Nf7v;J%iJWI|HU=A~<PGw{r5x}(FzrI{eUB5d19
zZ-p5}H&WJArX@-|l2H<QcI1@OMzKG6rw?#P_FcSUQGMValfMVE+phCGUYy*KtBur7
zi7a=yy2R8~vLrJgQ260BuA7s$#CKO@2{!Dw+3J&YZB1s9WgJt?GS-NmO<ZSKKIpR)
zJuO>qd56VZ;KdP{@9M_4mh${rsHMDCOXiIRTfnZLZrcMCSnh3kuXsA_xSq?>4DmSg
zg_TVyi{%ZiKdX9dUa9!PU}Dn^-OJUv56TRZ<~1y+D-qms_)*aY&0?b$9L?t{b$8UA
zyRvlcBC~Auw=csquU`2Rq299ED4%P3TKbx}tNyEE!aptfELpto<eE61H;Jm7{)KsW
zr~C;##{cTEN0sKaYpVO(6BDj%Q(5EqynCO_?E`mpZ@KL}P>?5ZT$J}k)Ta0Sky;7q
ziDzw79i}n$yD#lIQ?=&o(<C46`iQy{YXsMIvayIv-}Eamg-L0(L$&?$gd{$*-i-as
zofG%-WUQ2Usk^LOP)lm<Y=u=%Sy=)LJJiH?zbR?kb57tw>Jn4^!l%D;3x3>`EKQpx
z+}jjAMb+z&R`r=1*N?wEu$fQcTY{m(P8;8q$svaFA)yWWP8P4CXR&dM-ng+q_*tfa
zSL2QY6F)Q*D9QU=VV+Rg-E6cxaQ)<e5kH*eOb%Xub5LQTyG;gP)sy5KNhf{OKejq=
zW`2~xA7FB&E<Zu%sP<HK;m9!4DRY17zKF98Nf2$=kvg--KrkrEbfuP9xoGrfYeNO`
zZjWPG_6?d-r>ou%+oE;EH?@rWrbN&eF5#TIepQo}Ev6~QT{^DlEfw9X)qY4MSNKvo
zn~Nh4EBoS|@y+hJpW7;?{D1eOIb?SF0h23EJ(DgqC`d?cQ@B{LAg;mGeUH%99-$w$
zOXfs189qEzz*)%m)alv>5n)TUuUut(rpvxBa2LBSdTG_MWv<C9W31Y4eYoD{#S->x
z-Mx)3x#rBBUeoG(d+)-6cT+35j!IbDwI#{V{CH>M;YZVw4&L!LshytK7}j<q(NtA`
z=?!Z}-Jjbp++Q@?HlOp}!>8BX^%*J;soi+*`=V!6a^chsnfuP4zMVhw^Pic;eOJ$%
z&d_~-<bT9v=JPvtR@J+z{#?INgC*~gQozUcr@A-Pojqc^_Ry+Z&5XRia(|R*UYMz*
zacJWmv#X{*H3A+K>KIOV`Rcl>b6!C|-^3M9Q@Q(1b6#)I&QNX$$n3U#b>|_!O6=(t
z_f@s-g})b`)`?i+)O(A2mzyJ7@0AS_<u^+@KgCTu5FD4c@#<>h+Y-}W`ALU7w`12R
z%V${dwB=r>KYPKYB`?|84~2e<3)^me@!FnU0g(@bCo6q2_-<KXa>U*1g!|u;#|+^U
z|4m9?-L}5!53h4fRzkz=%jf6M<xxJDDqb>!eRjA0&NF|^F8QQi2^M79{AKQ$*<9IP
zRxhHKRhDpbCU>iKMx-2^GV_k{T<w0TGfsIemp9x`SMzb&7V|<jrQqAoH(%D9tJ}xS
z+ZoC?@4K?tsg#S%hil&aE(v@VP#&(tchThbqPuL4m;1wPZ(r~AvOU>nP;$U;L!{~A
zt4*^nE2V4cuGZmUT)a|BOJP^b94?V5%~H$aSLjN2)$TaicGloZb41kU>d5tqpNsBH
zWk1MK>3+|2b@1=*(EQxx=Xtit{#<@Y{okUi?;Kj}S3DG&Ig#;vsYp=#l*MI<CknD3
zlpj@4S~cCoC@Ob--jXfFKE{#f`D2&4cYK@nyu-@x*2e{DE&Ty!9`0H3hs#M;ga5Uz
zsFr5tj+L`yAKh5AyEAlhz|-f`GXI8lXY~BCxE9pLY0Y~!%zdrv-m*BO8<W;&+<v>_
zg>d(sKHt=AksFy`zP_F@h1L4Kr)0l<X7*0`qa6YVt>?|LP)k1dHer*3@bxD$x4W0<
zulfHd>0`vZpV@B<zwXv8m$BS$ZT8IYmSf=dnOj{q-m*=xygcvZiuH`qJY3DU#II~m
z{8=(L`B}rKj)&8x{hB`abx4F>p_ut>-}ybOR=;z#T(e}u&xucXTf*jc-Rfcey?YV+
zotbAWCVg|+lPoT5KjHTS7o}#6z7P9$GjCbEqF3`vFUx<I)oJeQpRxXx%<jyP`fxqx
z)c&RV$tMe4Qg0OA5V!g!@wV^DrT#NpZpbd&(!DKAN2dK;VEdC!h7Zw^%P#+1Zt>3j
z&GH%7a&-^ST)lXyzRZsg-;e6*zFE|eoqW0FrC#T&<wur1Y5(NvQW4r6v+?g5={f6q
zZ&=Q|c_EQOBy?6r-_)sAPlD71cU@uPe{;Qd;nfp))i0PQJe|kwwd7pU>x{<M+~4Px
zJ;-`+)^@Ycnw#Rq0tMesu94ZdKawXZwTW-~On-&+)R~7<?7MYsE$?i95NfJb{rwHc
zS2pg3c^eN(<$to`v`L<Q{nQD@HBl?iuXtp*Z(727Evr{&nH23W%Cm2F7qsbPk6HEB
zz@xHl?@^g&WiAKugN6Qi1TOB63cuDOV%YZf*~;CCxfgaj-nx*|X?ffvwf;TN6-9lA
z%3Eo-wtb14eNph~%vr1%T0d|1Z9jN#VaVYZdz!bXrnPQfc%tmyO{Fg%*XrN*N#(ft
z{L<UAi>Ax_oL-ahYPyUEf1mDM_e+=ed3rdf=RK1>QlOIH;Z@Eb-+V#dCcR<*xnS?J
z_p_UBEM=N|$?E3z>%aaq@#QRCnV7L<ZTy<X!otUwMDD3p@0_&ZXZy$MHEdH>y;zdP
zz@Efv*}3zR_|<hbf1f^izWKxB<*VnP^UFW9e{SureLH?V$cTTp;~D3XcNMod&d04R
zJ-=*!K*Sus2OqBNmP?Cea(o~;cRJ6VwYoW}``4(>mnilrV))Ve`Cor(|Em8sDGhpy
zzN}0-Tq<&4;_B#)a}6grOFvD~HM{zuY(|_G!|db>@78_kdlh=;Jma06Of%NK=d+4o
z>MP~<Ykhhy$iu#Gb;$qls-oDhRh|3zZoG_g+5Wch`fA?zlP^NcYhAuyvV42u!a=qd
zo5GgIyzMogWO&Y`M2mmDXX2I&+sk_|EYM7va`fEpvQyR3S=|pgA8wy19r!wOg7dZ%
zPybnGI)YP;esCV{+*kfTq_XdL^FqEm&9mRFkB-`Q@Zw$fW|0fA4=;MnHCGhoXFU;D
zo4ZjyexpUZK)*`ogj&v^YW}-rhi}(Sy?>U=f8(xL^IZ<+vThmMV|NwDGt83IJyxmB
zmtt9(^}-&t3+UMtY9GhWz_47Lfk77AO0x9SywsvZ$n4D7i1_?R76SFpgCnj_W!i3%
z_5JOQJXJ4ee%V&J3%jEgMRs;JzG0i~?Zdt5*WLVMejUC{yQA)UUT5d}b|(K{mCa*g
zqq-e`U+<A;?OFb2kGPTE;>shF#4^`sZb*49f2aGF<jan)dYxk4o^~-Y|D4pk-QGoN
zS#aJo?mk+@TH|80Yt_|foe_ff=jT6BOWfzb=xUV8q=0j+ON@kU&Su1z-;Y)dk+Ge6
zEqUXKYfKxX8h7L<M_gQgra#C&#ecS|ZuHdMrANeDmZb!(b}cq4RG%+zv;Xtz>p$0;
z@5sK&@h8(_=7ol}nUglD9Dj3%`5DV~`72e%(F;#Dos7~=DPAP;hxM_}!XOp9+v|j<
zEz1awZG2wOS(`aAM9nullrvZGdBCLP$$xYH^RP_M(XQP&LDwL2hnxJRidPb^ER8>P
z^01_{W;f4?U(9tY>v-W5om}CYvmJPZv${UTE!k8x|3b?|kv*dCJ+?ehN>rTL?NYch
z)kA4#_N1j1jY~W{w8DHos=RscJ0<XSsI2eNos3JFW^KB1R`hDs9Kn7yg-*M~0)<&I
zA*)<JaHq^qVlsMucPjIi1BXH-zVUfVs4R)P%yh)9>9WI|q?YyKRkF;yT$gw7tqTp@
z61y^4=y&!+CgBS^K6kX2E`MqA?e_wAzam$?sIt5a+d16n`_DX@5-J>P)xqktY%Py~
z(%L0{#f<Myre-fw5P5cwjl=O(^Wy8J8?T-8_-D@cl>MHos$z$izsJ;FshN{4*5|L!
z@8hoAyh!Lx#x&i06Rn)-uR?yjc3BgtRIaX6>Gto)pT~VHqM1CL)AO$Fnx(T?<kKwn
zo;?OaTq=>5(mgWwo#tQqQvO5uymF0mo8orn*Y|KTJWkx2>7#Esb>Ht7JK|lAyk?s+
zd#1#}pN!oXFR0CI3eKu#i8%Fm)*;EMWeF4Iw}<8yZM}a<^OKK$+GegFB~_NeN}G<j
zSZ%q<bU|_EIX?dT_gGZ71#;c6>AKmOklDF&x^Cw-{g00d;xi6Cv|Dk$zUs*r%`_LT
zL-R8CEEL*zn0Hy8;3uES9=Xm>XKZmVzjx&Qw_kCuMH}v~ll{KjE!Ch)Akjrz#zNak
z;7lk7PyK-|J-aZrukYmB7I&7vE^lkjd;hNR%DgXa%^Mf5+1ivld-mh}(AK-tPA+#}
zn66P_ZQa6b!qR#pO6u14yx7}keiSdB^6uQ)^3N5^P23k0txA`>kaA70dt&{QuY14U
z_-*FoSFz~FABlOHKlT(T)V%zj_a|JT{&!jm-{*fW9etfAl&%=O*<9o*{D1bWDH~RY
z8i>5(x7M2fFL=ES$Iof;MW6m3Gp_zJNy@eH!rY1b{31He-p&;{v2s_JdLDb8^cw5n
zn1)GR^KTs6D^-5ESHN)boHOP&7uFW<dwz$fy>_{4(yl5l&70dkFomqzp)f)9E8D97
zuPl7;H1y}~=J(`{Z@a7aPkKeaV%@iQY=<W<ulL_|`1rxKpWQAn7i>BFMRn5YUB&zE
zpL&1WdvR{*tqqBqlTGysW9}y&ZrXowrS+Ap>=>7$Z*v#$x=&50`L3L>pknF#q9uoB
zH7&osHNr=-;BTh6w70l1_nBM24U8N0b3%P=^>Zh(U6+(R&7v-S#<^+&`{R=*e*fLr
zyK}*=Fy@ape#zg<=y|^4eedyU7Z#<KtW%KP*2}eQ_r&Y-Di$Z#TtEJ!C{=5xo$O;L
zQUA?xvQN*N*q*JMyLtNFy+VpThZ>728t=*f<D4P8NAZnFXX2a2<aCWsKRyKb&YBzG
zonc+K(0azkOC_5xy*+t0c|E^s1%p}1ZCU=^ZZF~%T`=8I)%<bE-S@XcLY!S=Cca*o
z{h1~84LA1!^TjqM0!p5jmfkp`xM68if$6TmfC*|9d%o=9kbQ0wC6IIel3HJm8q=fp
z9Nw)>9~o9HDeU3fYCZ2S`>}Zz+_E0^o;!WczAC={{TzSSv8|l<CGXwe{`T*(o%Y|}
zRnJY7f3?%~^TmxWuM?%UYIt;0GR~f>Ub3e3%fDB>>W^0$ZL__kdplISS#ryJ+x^$q
zHr<}bvid-k1h1mJ`h3Qx33ghSlh|V}B;GMS8*MkIKVn1U#kVsL9@&z=YV~~4368v1
z9m<}3Typ1C@eF=fhh!nqT#3s6oi!Sd8mA{29(){c_DVuq;b0uYO7`CGk~>o;sjlvL
zo%~(pkgQ<w*S!}C{r_!ZNpH{#S4rD5@51z=_uSo=J>og9`|Uh$qb$c?%o(buU1)PK
z<JZ<Z%Co&D6c=@>-xm3IPBW|^;@ax)sam`dU7CMmUoGHQ6j}bLa>1KK=XI&~LT#Tf
z_}%Y$W!u%9`p3tXhVJ|L$(BQ2MtH`*7yBj#^);5<d~i6mi@*A)PW+x$hWc+}mwuhw
zK0!yl@#7JTAOX>QSuw|H$2}7EmQE>>|G%>!Z_(C=pOPN<f3I$<wkc*g_c!sZRR?eC
z(ibuOw^Cj1=le~pSr*5}WB4;!`gEMA|J+&ix|91;LO70FA9!NduB1F!HcRzU`kqJ1
znT!u6KlrXzX1S)I<HKC7V@_-jd^d2+?>=DbeM<b;)XWa6Ga1ISjpdnA-^wE@X3(mM
zoO(yWU#1KU`41T|j%fyu&1Rw;)BLvfZ~5&L6Cb?)r@i6vUUs8p8n-9URXLTVw@Kyv
zi(}iqs8~+!3~P5_(Kx8YsK*eMwB^_R^>)8@ODm-Mzx#HV`+kor)7`6guU@_S_3G90
zi#Jbh-k-BqTdnfulW6zIxNS$boOnGqBY&b_-lw(KA5T9&&;9q+q)_qe=DA;fJzZ_@
z^4z@gi(URIqf?*G|6CJwW?|fwXD|OqirDSfoRwkZE&XG=*6l4CvsbiAg=Yr)EPA<V
z&KB3uWt$hpx~9%cuN2!F8lrz%LpMAya9icx6~#Zq6GBaGOy=h@imVDad+hwOQq%rP
zDZ6r}m(EiOG>i`^<u*OF%6H?$XOhzwx-Ill?mqJ>)#xDOr{7+CPn<sQ8awq*#l&sq
zn;&`Yvu>P!{>XQ$>GyA4U8J#o@s`eWuGx=0P3JQgxitR${xY|&!v3WAjirMB?fhTA
z-XrU}dCQ)-W!Ec>{KXe%7`2CU?rHdcdXL}jRelQ+nDg^Koy<M-{$poGX4IKaC4mvX
zdt1}1)!i4l)Xn#w#&G;4uf0gBfazrE85*lE?5wf6H1(X?Ri)`$Ux^%>a?Ll7+5Y%*
z^)GjHZeHpTU6j3G{>|qxJe^)Di#k@APIG;}`Bjz3*@+Jl%$`L5jGk7-e>rl>&wswG
zS8TfaUhAy?{Dx;@&*vE;zClwwV?#eIIG64qf1xT`^{7c?h;MMr*$rZ6FZ%yHm8I%^
zJH)J*;lAMEO$=wgGSyw{{kQDJhRjcv4QnT-S<V&vUU~R)?w>s;FQ2K3kF7QG77stB
zFTpr{danMfSG)Y4uR3_RIzn;7Cchs$-zg~^k~nnx@nv&&cJ_ApNuT##mghS^nZNoy
z|M@E&Z#89Yx*rtB-F^17W8c0;)*lN`75&@FfB)W@RVUZheF<Ar@Hb`sy3134ey-}2
zIb6Z?W53?p^!$cDpRP0%UAwm7!k71p&-{o>`?>euPrLklt;b*6pZ?KW&l|A%XQ=7p
z`-jud&lA1;qNe8G>63|@{y%>B&);3X?#9BRxu+}lYb`(eb(3GE=jW`nN0~jdV!fZR
z@7%R>QDE{Mjyk0-`LoYYo3ScYg`4P}$&U72H8b*`*4zVEQa-I;)N20cwvJYXv|+ZV
z;jfFv^D<lx$-L0*E@M=e_m;Tmdik1i%Av(CxYSZzdJ2|sJiN4W#+e1H-E#l337FcQ
z{$D(E`s6zmH7^}^>~)rNH{k2?JS|%gwd2U%XA3d}ECa1(y9O+0Ib#~gwI-L(*tl`I
z_JbD@O5N|ezNy{1wMes3SBZIzNQXf~(X{6meQ)c{n)^2Qk^AFS`<~_BHvgHkk@t>L
z{;jv?Gh-Dty#4#V+Fn*o{rLO7Z}pya_pJXih)jO7-~K1V{ExoY^KGpytZr9-KBrr}
zjam8D`n1h+!Z`X~3%OM~KJI5caC-Xs|GILL_VvH5Uq9bpoBsFDyQP0GulqeW_y*h8
z-`BsLx1V7jzxT-YmL#Q!2eyGyv7!fh8fUt^Oiw7b%)1>~w{_1xwk^!LI*n^it%wvc
zow8WAKJtvw9fi+oO`J3D*i?W1_~I_3?~~tqg<X#QE@^yn&RFNd#{+*AE`0P8k-so~
z;>RsbQ_b}M%}f9B%Vhpvo?`B$eWx--`xkkX?K=4P+2Ml^XZPC|q(1m<8L)PRYdq@>
zOAk#3f%|*(PZ|H<V)cm#_+`wqxXCd{JYmJ<Rr7?I8?Kt1-^|pJvaRadk2f<DR!jGN
zepB=QPlkPE`Il!U@4tw@acsVHnq|eGRerChzIpWfadW>zVA{^vA{Ny~>o-01>3#C%
z_}<Hhn;i_<?>vm>`))r^d18{JnDB%hPk%o)|Npw+e@*T7KD#;c^Y-1ny}e59o9T@O
z;f6_1-Yj1%yzzF)+QuJ`e_q_Z_;Y;Hf?ekCzkRE(DlaLU_eOrdy=7H-#jHKG+qb9v
z%=ydnT6P)Fz9-)|oH-h<a5a>B(!s4iVy}mujThgb-L%JgVf?jzYs(#P=f^*6emg(@
z^Zfju=ktH|XXO8WzW;)J?CTlXvc+p3YyX@4aenr{;1BcL{%`s7eBS>xF1B0uZ1+F^
zT~e)P<_Z1YKbu0H{`+NJ^)0;Z-*x4<qf+zV_u2i~!l<|XxsLDKJN3ttL-*JJpZnE%
z?elBz|70!tb%?t{W&c~B%gg49K3)4WLo?un{pnR9U$)0inQV1@uIAjGi*M9#Z|C`b
z_t@c|52r*~{@IxLWUu`R9~;9m<{3<r-nG|oGlkpz{`OTOto6-Lp>5T_PnL$=;D6U}
zS0|v|aGvRgs}>U+m_ErJc=ya?yN=Ok^A7EsZ*J*LPMh!OD{#JG&hzEf^5^ay+GS;7
zW62`+Gx7h64?30ARe$znSI+X5V&FKq*XMa<(DUm*ZADfUYqIda`thh<{pGd$-?#ny
zRrH#F`o|BE)BG1N@jShV^;y;xxd-;vCxqKCUi<!Ida8a6kHOxuV`o2Q38)+7|H$!3
zb*x+bXv5!@*60wGjYlLZBJP@LaPuThdiz+>Jl#an|Cy)E-Uai&@R^)Xjs5gKea%fd
z{o6-3rGDhCus*!vxo5EI4)aIL9z00?Ape-#<!JZA?t0de0M<jCD^y))t2C?4_jTWs
zt`^CtWziMs_Wr})9eeWvL+@-<RaVSAsxZyz^#YcH;}f=BUHmtdIcZ`=q37@Oi+Q6>
zdEZ|tzkAW-w2S;gVe9xy8onRcBOX@;u*_KU|A|?=Df1up#Kk+jw}`K3p0Am;#p1sB
z_b-3t_9v$<Y5ncJdqel$Zl-pA`w-1loFRToTjaWAr5qM+Tz25$(p8LSMR?adGGk2?
z>u#Kuqnwmc-ZZO%F;~IkNj1wyqnNhejE}f9e&-tcs^6LYd!d|8(?tE*aRwPil}2;+
zeVn=ZmZ_I5Q{pKGPL{Qz2fwY}#UN=kS5;JZHE-MJP>0wi<8bBmr43Q$xt}cOib^u3
zAL0*w{&R-u{*tnfs@j3d0fMGmlOHlHZ{8wSmA{dx{|f8wB8`7DKTBPoB4<8%kHoUG
z6YIA=ocZ_Fq0Rf5D(^}LFLAwEdiU$D%n~*MX6|`~N0P7K?sTvaW8BLw==$6Js$Jp9
z*)z61+!U+nxcf<h#NX5FR2$Z_E6r16zx*b0&BOXPGG1;gPi8WOM5e4zcwC%Q_T*h(
za(40)-k5jyr`vs<9j2cz`atJ`U*9h4_m7kBtm$63U*N)@m?@|4R0TdO@4WHi<N2fK
zuIcErvo6rAD!mz6beOS|%bB~UQ6VMi@(;&p)iU-X{e=w7yG}*D%lcS4MIu4N+3ezh
z?S|*wuiGh{u0FG{yw^%6cw<ucCy$DkG5uz>Gj$eCTwTQ5{^CX?$KPuWySZZd&i++M
zpS)$~z22>Hi+`H#`MYyQ^P-+v&o3U|rl8(lQfZQ5F!63@+Etag7kg&SKCk1Ly!F77
zEz(neoOzP=RqKQ)$DxQDx7ZJFO#C5t!)U&ohu^xc7w2E*%#>fWEyp>IVcW0oLX)et
z8x3Cyd_H^bm}ir!e9Fh;DxLFh-rzj*EGp)q+gfSoKT;-Y0(M)kuf3?O!PKk9ACWW1
z?1hfTJ9g(c(w~%>rk|g6$JI&vW9#nQt^8TD(l;_IUu*hz{4vw4-%c?(7cT1Q1T5AQ
zix4a>+c;NmZ&zl~@o)Q{K7Bq{!>s4Qfg_Ea>X&9ET2EzK#gWLjfI;YC{O^s79C6b7
z-z0f`bDP@oYpMKA)!9`_TZ{w!Y+hV@<YKw@Or+}3dum*ox#4@SSNX?lE<N?a>D9!=
zyVr@iDgH^_uU=+7`=!z&#|<K@Pw2U~?3%W~#q`26l{M2`^A_B!lUrdtcj@)K%DQid
z+8X_As}h+{eq!~~^qhMyGOAhEVWw-Sq2^M{CwDh;$8t@WHYM}ngs^SOzB^ug5ja0p
zFHWjK((+KI?_Jx|R~JZ4Sk%sUHtclOq}PQfBa4o&mw5V2b#mth=YT?C+2ub?)?Yj+
zvMPSc<eNsf7kHoLvOOj(re@_(_(ePY0#j6M?Wx9irp{M<77v`Rww%>mDVF<Ks!N2o
zjmM$;>D4teRPz4X?TQuIvE=@;17A!h+VuOq;@aKUV-b7q)`}*(>#l4?qQ5;BA5_V_
zl_TOS#{F;7_Q@Natv3ZJX|euFGSL)p?o(Gw-uArl%v3iOyCROppGGJ6o87!Z6Mn4e
zmN^@mH=$GiuD2eiMOoOBH16(OY}eM8ED1<l{pItE6)J+^VIOlc=Wj@EjaoNPOVwn(
ze{$Oc@dN$=_lv5n-K-b26o1Tme(CjVMz&vP3U43T`NVVb3`rB`<zEzkRjJv$pL8cB
z^IOg1*?;O7m&9`XuQt*B6!~mn9NXd$PIE487LIhA)$cx48QgJ9oI8QF-rXZ;$r>p}
zo5zdJKIc8*{LpjhMD|;fi@z=mhzZ@s{_BT|+_!}EI1}DBt`%%w3M%DxFW)_L(#$i9
zl=81RIbXf3aZG9%i-Pz?mMgsC9|M_ld9AzSu2xpPe)Py>f7{h**G<wctl|xsu$Je#
z;hI1Dja51Kwb^joOZMq%7hjWqE{j3?8{dj&SKeDbXgDzO?h2j_&mKhVO%mrg@>JF4
z&t9G8!U6-|!+bx!6tni|MJsJx{P(~r#U`z;jk>E>gy+n=VO6oCzGtiMR)&WuTwk6=
zq|R?zcc5Z}?%@*uw~Jry6ON5JfB0a(!A0XQe=fMmHcBx6_Dkg~StVU${`}bSCF>*(
zhpgWy|L5A9o~qs@t@`hdyB2R_`ZYWLSMJP9ho^5%cRXNr_8Zd_g$nb$3Xiuk>t9Z`
zjGDwaA<WnM*_m563RtqrH=J6$>pG)j*@;!zFVai*t!S;gw)pSg-^{C*bH1$hWV(Ms
za)!-27yhj1x<7F*jw<-H{GHg`z4ml__~PsR0ZHHYZ+m!u?)m?p_xH40A3pfQ-1)L8
z`>WjDE3{vfDR1#8Q}tkGw|pdX`GLkEfx|8<(yW!jRz=21?w?W-`+UdruH_;#w>&-?
zz_!Kj9!tXc=C%8d$}&8!o}ZEO|7bTyZ&+kh`WJ=O7Yf5SOj3zVIQu%6ujyQp<zfl3
zc%PjeC&T%KqH12wOzc+QV5%w>k>AiGZhL9zn^VgTj5V0__E|a<9C^G^sojuOf!FS5
zP1T`w4Eb4Kxe}~jE>E0r{Jiy#if+M@&mT);b;X;nKkQu_sb|2`-}H9Isfjuj^K&<+
z1+=Vw`0iF(7Mse1ceP^58ON3E@-9Sj*?&C#Y1^82r(QgKs{Bpy*RzLLADeqLxnECh
zWt{Q&#h$pxDcchg>$Tst+Z>K4WEDSl;9;W3gv%~hQ#P$Re$oHR4=E2Ow!B9h66E6S
zk0tjVl@gJNVZG%dbM&!)Xds_RQQP4_{R>=Ij^6!jrLgCe|Mr|qn%^I(uQ=u5@8HOM
zv$mn$$Gzdt6JrPAwGHhR*;Peb{4aW5ZsiDWQg8p{DQEwULuAb|)^_(?iEZyr9@`i9
zvr=wu=;uAU4l|~1xiDd7#BR1F4qjIL$4+^>U16NSGQ}`A+ab}nFEl1$%jKu3o7V*H
z@%ChX!C=1fl~ul2=uE}4ei<G?{5n!L)dqEUdu{U7_XzwsFyG*hLh|CE`M=b*7$4E)
zxNNj5J7MA4>u;O%XIb=!oV5$McV($%)g*yvMe(+oj}2~hte7BSe4O2F-(Q}clTE(&
zCjMNgC;ax^FTvKj^E^hTRi8H|{+t_XeoM{$hS%Kx&xMZIu03w3yqxLK%G*6l!*BOI
z+HfZ2dhP<{wx{P>D;_%Rp3<7@bN$ZDdC7cv+ue#XF0HWn@;lXYic4$S73OW4-70M=
zG6Md-(a-e4uk<qsKaOq-*?VAj-?uHiVcRuVx`!@QeIz{L#v8peJFZT25AF*|cw23F
z@x0%XJ9oc)TQw_Hu8|=jCqGKpv)e>7U+0|pQq?w=%NJFP<-2)n=Y}m*y`phbt3i18
z^Ye?#56r&7Q+Qa*ulwyX(=9x!>Z@XXVrJ^d<z8Lk+LLri-|R~}_vyY8iRQEkag1m6
zZrd!mqivlYkQ8Ld!FZ7MYGSI&+q7-F7*z_tYM;s4t?IohwxwswH01*itMj`hql67k
z%r4iu74C3KK_oNtZI&yK=c>KCM4jgyHs)gf&vC(^>fri0i|t?StYpf#;cA&!8*TpI
zX-odh90vKr3E_@HlDDn)SG~S<<mkC<?f2KTXFT5$!~5=d*_2~lKd+o>%6qe5!R3%t
zpNiv}5z}@x+lZ#z-n9ME>Y7P<mBkT~4F$PzPcQPf%k%kvKgZ9nly;%g@?hlgxR8Lw
zeNV&^Lu^ksI-XdpaQ(vjr=oe&Z*LLEocsCu+eMkvDmVXqb+uf-KK;u7jk^vvd=`vW
zp8ol#*N46;%gLAc%O0F}-ON(@W=(9GE2~m=V#UsRmsffu>Fji1|HCrN<=W)+4vU>_
zo_?=5m6ou;;Z)qk*jqCWG!$)p;gTfuL2$~owiLrdvpz{Yl>Kt}HSda-qPMR;S5S4g
z7f%hlTbj&!<ittcQ@bxmmb#zt-d_Lv)%W%Let-MA-FDe$0neMPEQ^acwdIua9zR^F
zeqh3Pueo1?^8+`B@5@_SyZUgc^`i-sQ<WB`XD1naSo~{8Tkk#ZR{vim+ZX>%&ugrf
z-H~|vl|{_aOqDzQN|V{X`Dbp4+HR)%ZE@Du+ubd%?^`5U?hse>2%6?-sS{ZDg0W4b
z^WelwR~JS$T&wFoDt@5p^tOeIl-2$&+4XeR!LCD9CHbs-zLaw;YglVycO=izS|dS0
zPv_&KdmU39ZYr&A;8lpqRC#P+!zNv}CH3`#S|<<jBLNx<XV~}6Qe|}C<#nWrL!zYW
zLCach=|J{;g(R~>%oCp6$UV%lCFR!Rwm{J^OY?V2J&hjvmD%v#SiP^KBH`Z0HBrZG
z<gHgp*l#Fat;My`@ajd;hGVWD1*ZPlWpdqF-T%00b&1IIcUf=3BR)NR7n!mp@pIVR
z^o5VAE(ggT*3jN*yP`ebeAS1t)#e8Ut3S9esp9`#_OLI3OY{A!;P1@bHpY2bM;P*_
zY+Jyq?<lcvgFumG3A4A)`xEOg?cywav3<GfeTI86H_}AC4J@Dfp5Nw}S;)(na6+Cd
z<ss(=&3xwDTUnl8{Bgv%_JKQxxU>`t^XUYxzX!EkrhnMHnEBzh1vVz4Tu&c<<$r%%
z<h0?3g{+I3J-Az}wte#uW9v=5*Y#J~&CZ8OUEAui75hYSm(!8=7Oh?LRrwT8(pQ$)
z)500wR;a6Ju4tb5{`$dN9#e}ISaMq=8v2)Y-i+;fzTWFr`Y)MH4AUbdLS)!t*BrDk
zz5c0n>sq<9FBk0MP;yxq^~vX@(A4)g-anJnIU8W1V)i|8et`T9<2$d`-PhmH$)faW
zkKYXGMrH$tiQ&c<j!m#!#HCroZ(-J>x!FX?&!G9)e#U=`mA3|d{&=j*HDyj$?%8YV
zMTTv1r@uz-wm!wu_q{B4hfI~&t9g}IihnD-ySKSk;8AOC2jA=odyYPyqHurTktqwl
z9#DKdVX0T!{I=N-wzrxVfB)7buu<@MdVS|I(~O$((Aw<tR<p%~|4vi0uQ=xWw~Sxv
z%TbO;?lad(Y%%A~P!_#*d_r2MMRbO3n9Px=iZBM#whKPp^LB+fe!l$j$mFk&bnhPF
zuzJ8=x5M4x%}bM&$BtJoxU->M?H5D9%)|zPISM;Wm_K^WIu_Ot?K30kw9>678OMyG
zo7==ar;8~0T@#)6Mp3J@z~SOGi`WPE8#Qv+(h36Hl2}fhV(4A%zlr(8SCPzL?u_m!
zedk`YT%3L_<CXato4f<8zxHU}<vbeuAni~t_y6lz7kEm)%oUU95;73lS!jI8@IvPM
zS4N9I1#b5%?mg(TfHSLc#T5&2Zr#^GKWkU_M?bVv3Mt^cAh3yn`NqplyO?i;&NWY)
zq1feo<D%NCWomgR?!CM`+1mYE+WFXoV9nl!Lq)wCG)2Q$?u#DV#pIrFz;2>#f8WDU
z)&%hl)018}2=mTzwbNXtlzCyzsyxlr(b8*IE!|RC#JBML+1Jy*ul7)hk?K0yVm8;o
zS#|aEn?*^<t&S7lPE`_LwBL7imQAFN!HeJdI$8^+@pf<BsVmm4_NL$h@5eb8@BQO^
zl72HIdApVNg4I_<%$l|S3hkQ2Y@Mj7xjI4g`o&N_fm>P^c-Bnn(miouKdWi^-j<~r
zOggV;U2EalFFN<rN+${72m8;M@)cOWNL(3i!m6;rlEHAUK;<!mkk+S?w^%guubC|R
zTper{;m>{ffWG~=nO7U;$Gx%M!Dhen^!YD49&x?8k(U#EYNI80gHwy%CgoYHIT)X*
z%4y|ZXlIyg-1_nHjtO^O{831XcDZ-v_y)n12c~Ygd(yu4*UO8A-ySG5X()(^tdvu`
zRbQAtKj>{A)3?f;<v)ElC_egm;^s>UgY{q6IjqP#yoM>`6|dEkqQh4EVh?T$E@@}k
z`P}@M3cvc6n?=r1tFLpuFB9?ETfOFX)UH1a+1tgpGM4*Hw#aHfUbKgI`|B@rEFInc
zG*y4|Jw7REp(%&J(ksn+&NH?MMzp?sc`R+6UQ<EIn*`I3x7McmrEHj|bs^GNux;VL
zS0Py$o?Y%wefwVCKI0JBr{CZ3+ULe~u36u>=1w+ZXn)aqru4v!HGkzKzjrXda}DD&
z_ED*6d+@UG^IpTxvqegpF7Dhf&A#}*XX<3xGncD<l(%=6*qMZRJ8TO|JYQ&VTv;>N
zt!GN*jpfca5B;0$@qF&pA3f<iZCzGh-|{kr`PP{b&Y7GJa*CCQ0!kUQjamMz<>i{)
zYhJJ@_T;LJuhTqzk6XxUOq{fLBAeEgrbe%4RvinCUr0XuynXkzmG=yvsyy*~cgeHw
zVTDt^NwuK+BgT*i4tpG?)Jnbm^W#B<`Y*-&#k)>KNHHd|f6r3QYi!weK!fGnch5vl
zH>SWpEpHZ25#45}v)*gXy4c+_<L4eq&Q3nKTWa;nn80hPnk!~2ip(mB)qQC@Yt9da
zX_AGFx5c^&?|L3z(z@>I&wx&jRW4uLJ{bkuU$GEqt$2Nzo9T0o!_8yyYBhZRj^#!&
z8X1kgxA~^&{t+>FvwV~A9*1OG&g(XHX*{<d`n1aIJ~}U?J=VJ1!z##w)78WC#lLfk
zt9f}%YnnK#rg!spCd+$Wm%XAm**SR6RoNWJ%9dxRd+t@W-O@k0*7yjw^8!PMZ}Z#>
zgQ{PB2r`bi=pd-U7%QR3%6R{HtYD{-SfLcZ+#HUh#}_`#yV|fQBimb*scCJKo!Omj
zX*X6)d3mf%VP)|jM-L9ysV~@?I&K=O9b|7(-SwJV`n%tTx;ssegm;V8oO2ZPzqn3%
zee0R$B~7-*Z{OYGmM@Vgm~6Y&^5Q(%%a0-$t~Weper~&Yjn`L)O@1@Wos7KJzMg8J
zxc;SRv}U!#%gq;R7o@C|^Y|rDFR!9|xSVN|F;fZSravca52U2E+>6r`T`1fqxa1o1
z@c_wd&O$RquQ>?aa#r8rnz;7&z1Hr=|Fd<YKCAF5t#6K+``OI)ZpcjYs^^YfGPbh9
zo?J=MCdT{$)mbhPj7E&iFDi~WJc?bP%^+T_68x~`&$GFlg=&4X@|HevVosTM|9!%>
z?|MgLSIkh%wOsso`j_&@%=0ISv{c(`Bp?6(uVJ~J{NnER<EP(WU8%oKrjp&oeb@Xn
zIg?+yMNV-q_@p;p-1lJ1#mp;<`RnghmzN04m21*rays$wyW2W7xoJ|n-iDfPUgzs_
z%kgE2dF;iG>+j1KPnTL_viG~U?%v1Wj5KFXIk3P$@%oaeMNR^VpMUTuM4sRE;*8gx
zCowf2v{Mp<y!uY8G>p6^p*br?RQ2sCHo5CpCN%C?DCH&b`b4vePu8jkhgTw7mm9MG
zE10)g;n;DuP4aJ>CuE;q?DPLr<kB=D^`qzBBnO-^np?6mh+TkL%>S;}sx{A7a58;0
zx;o`@q#@@LlWCft<nMBQu8c}^n<T4!oiDW1_z6q!>jjQdSMsdiPW))FLhR(@gqSF~
z-<!N99X{{>_=qg`GL2uyQ=2y#K3~&ww@+1g-P5IV#c?;b?$cA0N{XBz8&duMz0lu3
z%t4|Z?~^=jX6-(*etIFpSD}kdsYW$f^BDbBH17~w?d)1I(fLoj{13e;fBTnjcsf@-
zzt8T?+<%i~Waiq<dUG+lSm}IPL+~waW0&1(hARa0?cOLho&U4$k))pBf@iWEmH%2A
zHSF?BHtXx<99B#`vo82j*VfgWl1`<cQ*rNAd9AxFXYz5uQww_+@6Fz`W3_Z(+DqSd
z|C7^S?%68$Ztujsg8M6${n_fC7^1S}r$NrHO-m&C8^33N-^{)Kd)|q4`{N}wY_^=A
zbzP|}B>lEvvC_(bwx{M(J+mTa{}gV!)V+D`<ShqhFfe)X+1>JL&0#+)!Eolmqzu09
z%@Jn~B~FugBlv`|wmm4d^85?W$SR&?kIwRGs5%|tU@hAC;j-c<iA_(En=B{p{gwUt
z=AwRA&Sg^y8TTIfD86lJOuu%@XH!8*li689#@$h~#g3_WY?b2Fbc<PaWV*`Dw*0_F
zKeZg$)y1ZB=H$<u6`x!ldg+SP`o@-rRdPL-Hk~+n+WS-*U(g@(>Qt5!8Q~s6A~O$8
z+InYk>7md0Ivos4ookBPrB8G&WvWkU-(`H$*06Q1kjEblb7jR^g}psqM{iEGdHj5~
z%&+M1-ZNbXw`Vd+FG_HfoK-xPd&<e(XM%d}oS3{@s`g{4$%0ayXFOh0bh^(o-nx73
zZu$PVeyYl`S!!DrFm<)w$iC`yUN2_hyGbzxI^MdoZ44ijKJ7f*?_aP`uJ_Ju-s(#m
z&zvk4ZaQR}vWZ_t(I6}S!xCG=u#o59Hx#**q`Z8PBT#p#E5JplZo-rl*@?d8*LR)h
zUZ!PNRbNz7)mPpi`~Ll0dD;4o(DoI}<{f(HDHy>Kx{Jd^;9b7{st?ZBbaws9G?>c%
z;9l1f?lY<`&sgJX?%UKHig8iM5_uF5^+o<^^Q*_nZ&bXGoG<2iKX0pf>DE2_4t_pe
z5_48tE&Z<V3?)g!y)904t3n?=*}ZCksE^`}y;JkuWdEHh3J?y^(G71}+0(%LM8kba
zP1zlW(5X%z1ln&;e=*NT`mI;=OAYg2AKrJ@*1cLcb&+_W&Av|kzjIF)-7L&IdUTWV
zq06DOn%kF{`vx5JD%WtbS$mjgr#A1=%ZH{oUWh8*!d3MwKt_%?TifdY!)1$>@$GQr
zt&?ro`B3nXY2`2LUCC1q25jDyX;~F?r2oJ^?~fc7n;*Z}F=yhvK(<pB3s^os3fU)f
zKk~Uuv)AeeZDz}|x+=Xb`(`a^Vvsf5vn9}qFaDB@->n0!XSHq2Pu%`+xBUJ-zKbeJ
z_b-KaTw`~PK4CU(S&Qb4-xv7OBU(D@zZ`lwr{wTw35(-m?+op>_WheZWy8NCvoEGE
zPO5iLxcIgGv#^DR=!)InG#d6;XxB{8Kj3je<5arf!@X8r9^BV-wOu13RZ|$>9qL<C
z^7H(MnJ3!6o&PZN-Ums~sW~rR@7$uCV{xr^@;TO0$F^k*<%bRPyuRpu_?OUn`@rQz
ze^<Zm@_A|^7&H5>_qnZ6KLpd}JXpbE#Bl4F_$8M23vOz>YpcF6Q{c_%L-|v>o9q(v
zH)&jc?mI1Qww%T#)yup`zpXF%>N@=;V`_w&_1<@GGr#hcpPPRFeco}Sy^XSLeO8C9
zu01&M?f?3(|Gd*RU#YsEcqDGBmh!%2bN-~C=1*8ek9R-Vx#Og5*?Okb6FXkK=>8mJ
znd4Ew_cTJX^|DJvrN)k#Z#Ddcq)gRkcUWib)ZH~xbB|h%g;|qE$AOvz@p~uEr?CJ2
zS5Z@@cc}R1o*zm_m8aysySM1D$MnA7kH!UmdF2akK2Q^xnVda6^SSPyJJyz;@*Wx;
zX$%giarw4kPvp5fuN&4ye2A$xKe^=8C(A$f-UVyLYxZ2<!9U@>=)tycFaK^@)^lO{
z!`me@xXpBPa=)?KB)!-+?W4`D=5p;RYz9%c*;IL+2%RjHsavamrPMp(d+L|iV5PSP
z{ySY=Ene-;ijun?FgejY`b0ra#`KBh*AwJh|179sd=vN~aLwYaJ&iNO56!s0b|ud}
z0cR)OU+yQ?-+a8)+^RC*W2CoL!pw6wo-TB{cQ$y7k?nmJfgbk9YHF5NSMullHT9eB
zy8B#aUFLn0>zk)aJ}7=XPkgyt$miBc6W2Uu`;_2w;*X?Vn&PfT(c?AGruH34oFIJj
z{R^)z^Ll2?RepOWELTQju|aO5n`X?@isY^hm)q7|Q=HlP;@bqCbIT62iZut#c-qrm
zbLXM5tPjtebse*2XIY+J!v4)mUevXJ`i`AR*FpmOG+ekPvW#b3-!QAnCf3?BgXL$f
zUgfGc>x>lo7ybBsH~;wh4}8BJwy$wHP@)v<Boq89T%Su<cUFv9tC8k{Jc0TrXHLw}
zj9jQD$2Oz!&9Z~MY`a_!K4ts#&1>tUQl|%jTMn#_pS5g4=I1X~&3_BSme!nCFezc!
z(iMG1VVT&riDlbeCDR^$ET{<=*Nt`FyrTPjLusq|-QU|*rA?NO>Dl!8Q{%f`Hyz72
zxmBfs7KzBuudOLAs_OBq{#!UJnWMz9&)4<=BahCs6H{hfz1q}&XT!}^LhjcCZZYpt
zp7zsRj^SR*hwU%E@%;<ZD>yZKkv|Wc7<W{)=JPf-0}c`6T}!!dNw<EKx#Ib+Rp(Ju
z+eyQM`lvTuC7Im6-}l?infrck_4GM&<o4PAI{nVsVTF<K+1mw7%?05ca?-7j#JH#C
zUY@mRvEXh)>ua3LmtO4JykOqpv~X{JjbFxGHXr`%T-36B{>Lwgotz=L4>Ue_I$HkX
z+0CYB&#l8KvYmHczq;m%M}`L5DnuSU@5qx|T^Z-&*l|~<{?k3CcX^V5`=1m}Xi!|0
zy@)5pHo`zp<cD|hvKyxrJv=^7*;r?1a5C8_UZd)A?>w3P*0=tv{;Yie<?zLJ`AO}+
zkKcW~J->JH19tcH7am1i^LC0ea7C8!B)uz|_`vYOp3JwU6}xoi#yY)>-8KKo@g>hw
z`!u_DDKA`_qV;}G!mNuQZ8=Wz8Hm?NY-2bW`SkTkEnVlD>oYU1ZetW?Yd!w6HN<bZ
z{tDL0+bxbSUN<&=d&%c~{PgjAW(mt0?{IAM(0;%izM*x}kCYQt!46IaO@9P8on1Gd
zC;APeUP@bTo`C;*)3*mLEX88l)+`HHznu4AnrkzUMz`42H8U7gi%zw-X)-fk4V`19
zw&r=5)wM`<Ubb~i7g|0Zk=YqKS>veWPmK?Uj%EpH6$|da?Vn)Y8MvbV``Z<BG>>|6
z$|Y~IoE*B>Ao3!2^7CsGna=Doc$m!YyGt%|Yf<Cx2lqXjPQ7JFnIV+e<fU40;8L2A
zr?{?L?Z#8PvOoA0*6kHsALF!2eX)nElEIcZ)3`S*&$=ZuVtzRBJ}8`i(Q?w3L+UGH
zIrR)~&Pbgv7k|ByZ_%@x$N&C4e7N~=^9;U)SA|0q;y#^})MB4~OQCLe`4_(K7M*!V
zcIfQQVqfv;*rXQ5H~SeP%2&HRH&tJlnZl;|Y3X69ACfGkB_c(SiuP^UxbV05(W}q5
z9A01}R^akE=7skq$NC=EzZL2cPn`DduX)q7-Qj1|gR^rVJ1zZ}oHC2&f~e*M&82UT
zUemtO^tD#)n0Doz{Jm8Mz4w<L?fJY@+x5(jb1u&x*D72H6KFQb)y}$XHFwXg4V9CE
zp39!(E%9*EomGDIw9Lng_f7^LII%$VOr7D6N|z{pbv?DoVG(N-<l>)q-#j%<^WMW_
z3(Eed9o@NhL;Q=p!j`C+j;ET|-0bs-d=zCbZTwZ_;I*H5JUh}Bl~?86<(hG$a+}SG
zw)N(k%TBzQ#dP?%*@^DAENi@0*!J#RnQ+B=X3Tr-;O*t+vS;j+?(-iGUfnZw?=|`J
zOK#d;G@H>_UB5m*<;w#LSGG28{nW>4(^q?L;@iLb;E(ScY7ds0KKRRbs8n;k`Pn4y
znKhT<zO1d=^)U4QqFb4svDpTtO~z-J`uCV5$iIAcbKOtQy$|zVJux{wW$I+MZD!9b
zD>HXE#tQFD7y5JL=)!3(@!w5P%1!#cE^YI3rdb>J@}$Y<?c|SGX1?h|<(BmO%&UcT
z0t_6(d`{lIWtH7iArbrkI^)$n7hPsGrN&5St$Da7s$oj>8^f$Kho07byL{2}&`yza
zJ3<X}A{7i~JKp&5@${s1x{hVX)uLE>LuIxfU~u>%x&2Mf>WWBN#ni5<w$_5$bjh0m
zX{Gbhw6CN|&0zVgHnn(aWWP_K(%wmXo*Zqjn||4{&tYB9^JCN2ZObb&f5FyxcxJ`o
zlAgKgKV4?OQ>t3Z9U;EHwfCXK|A~8&q7FEGT+IKxeR=-(Z~Tut7WSrAIBm#Z<YV}L
z*GD4>#}g^qyfbXJ^2c43n9b-IP<Cj)zL8q@g}#f~r5_^}7`(sD9`twGrZoWtOrjb6
zUr%L+9$NKLB7pO^$IOBanuedx>?=#V_OavVTWjlvtGt(E%@}UXUa#%V^;IU#Z~p$J
z-jC{%7bT1QRl8uV-dm^;9`xz0hEz`3qaukJJq{6B(-cF}tq=e3-gB=|y=t=AQI}1@
z6QkWlO^Z2inWYp*NXvbHX#6ZS<JzC!tjFFhbg9qSW}7MU?(&HRs@CpJH)ki9?^`48
zHsy$hNUXp+fjSG7!1f#8@5Q`4=VuUdapLMZJ4|+Q1@8S~bbe*{wOtmc8*ipIl^tol
zP!^P=-S>gpK<>n*oErJBJJoaNpYaVm-8b*qhvhr;-b%RJ?DiJouIx$=-TI^JUzvLx
z-~Kew9EQ6wHxB&0Ep3|Nbu9k#1w*k%tJTzIlxwGWcIi&N*I!_qdOq=a^uq58EI+H|
z?%`M&8OL|#-zDF+PcwV3Dc(&;nOCv6x_OF~E0^EQg;6zA)kQ8V^gC)#W(&0z+s67S
zr1{Rjv@qX1`vc<M-)}jH)Gs=vTB7BB|4`rdtGYcqbd9`<JG4aQtGYG6bAOSVYyJ7r
zJg1!GbFEc<rA-Tao(s)7dYEVO3ymtx|IWITqzbF9ta)bO%$yaQ7H6|K-E3A*+Sk{N
z{p!!&@yA{;*}}+K!B$Xpi#KMk*nx$=^cov3J~^ur`($@bci-KJiK?n$MN!tLtfC)<
z$7%E3DYD#uDw{KG>CT1A=Pvk~&Ai9sNVD&bT!({6yC(H!C@CaPlWMWG|2}*3;w3As
z((~Tf3Fn^a+&=y128~k{$_aDx#J=AvV4P|6qTH#DIlr;I)aL@*gTh5t3uhPa5;U3B
z=2wszyL`2}!{p+dyc4<Dew=@~=?J%_=8j5%)0^{E>OwAiOgMiy*`%UEMk`-vpV(gG
zV7byD<<{iqHyKtIxtCr${iUSEez*Aa8t(+RNoS9Uzj!<8i=ROIucxVRzO@F<K40Xe
zD-$PG9dYb^#|MkIoqLY3Y5ts7wQpC@*~vNUiyx&ncKEG|v5vg>@uWrQ&k2ETla;p>
z9r9MVD{dgk5xQ6=Vui@QC4MYk@h2Mmc>})4?lwDn!B2X%kyY`Li+XcYf3DT>E&dp0
za@|r^eEJlFeb<)xmQ8#hyxN9&xq_n+&)uJ;KW1L{3aWd!#aPdJ*`4q|JAO0-aCIlC
zylZ|Mkh}F5^YacCwL>kFr?9;&3E*42XnGclMz8Bm`+I!lU+NAU<R^Z2+Yl4+Y}R2m
zyV<-q^h{KA4sEe~%6zj+Ktwf`Pi3Xr(mIQtSo>8c`kg1_8qItD)_3Z{u*9Mz|E*2_
z&b#$b-Sz)}zl%+OzLY5M%q)^s=Cz->@9o{5D^@qkULR42-I%NW=h8ek)u$!w<q^A2
zIGo;J`shoZc(wWwVdu|(4sMx#vC;oao=f-&rHO0rp7C8Q^F`wLf`$t}FP{{h<>UMG
zl)8VQfWPAjZnr1LM6%a@J`{ZDLzDmQErwlkAq%egT`>K=VsopNopn_5mUXtxHV+dx
zmEJDV6I<)i>9l;G6Z^MR-s{^{O8zrlzELi9?TX<ceZGzNEmq7kGF-S?cEW|YW{nD8
z^H^I|&zNwlU4C!5{C9E5hrV!%Z@zn>cA<2%AM<nbQg5Tu^z}c^exJ;y&l}5KBb4K~
ztYb>*-5iZyt%X%rBG33Td5c8_zSmD#d%9a<-!aF+0KM|S`G;#*bX=dADSn9jm9lBp
znNRu)TLLmVW`uOgB+uEwR`XRY$Mv9GV(3c)7wr$*QoldmH`(@R%ktZk$`72JXE7(7
zMM>q8j9Hw*?#rc(I<l)$&loiJZ?P(VDQxXOf9Dy79ovl;FXhf(YPxy#rJa4@bE6h8
zyt`21f5>>{&dx67U2M~*>PX98a?=!w5-_Y_U(-DKt<c2D*PX1iTy`04YFyQ#rWmbO
z*CX<@Dbwf{v-su-ypc;3;={vK&%Lwz)+Vp4ziqPbsri5Qz3SX`H}9<N^!UPro^*%B
zg|<RpG;2y^HC*x)c-YR}sopwaf7H8*z1u5OKR&(?tMGsJD<w|OXN$DjY?Y0RFaO^z
zJ6rAEa$diAHhiTQ1%Gs}d;7UF^31-H4`R9P1qp>;1;k{^k~mi?1<kejvtuup-eP0f
zUDs<Lrl0LiXjJ-TWsvVz@~PjbKr+H&zsHu<t9sX}ykOfjwc=ywk7X{u<0^kg73Hf>
ziEpd><K3`5@}|!*t<@C^Hc3pC37CK1C-HPY_lybcR}{HK_8V?_t>$lhBfiJ`{RhpZ
zdo~qin$Af((Rj$y?r5x0#Km>aEB!CBUUdt%JY%c+pvb}F(8?4h{ZluT&23l|`Wn-m
z7Dhe#`rMek%amu03Ul2XgZW0sHQmeCc6=^8&~duz=Zht_7V29i7$$2n$x37`NfT1t
zl)pvcV1k2r>@3Yo)6H657Zyy-F?w#ry;xDC)zf+7u9l6aKU~6Xg5O>clVNc(QHzY*
zaD*+}Rh4tmgX{i>6C1wi2Aq3TXnfpOeSVFt{;8O@BjHQ0ZNJ@hZhKKojodk=F8Mb~
zVM4#UW{Rt)s7yL)KIP)_kH;r5{X3(v@5O9($-f_d^v(`GFFVbq!Tr?gy&~O3N-Zxk
z|0qa4RKC}nbo^|xQip?OMb7lY-JwiRA8ZU>$G45Ue{R`l*9~`T1gnD&Je{)XMbG5L
zUM^LZWxm3eo#spSzIbD(TzFn}@8=7v%iZQpY<MeRz2wZ?b-lvAtoNR5K5x4->fj5F
z#pcI$zRY89y6BPMToG_dW>S@$%#=d+pWJ^P?x$b5Dj<9R_Qjy21#@-;sT&%}K2~Vi
zr<0+3r9tBPEy3O8$1Ir3<JphDziTa=)t(Z?Qm=UC{`bWi(>@6;RT5L>ab7jeP=Bt4
z!}L0h<oLsPVtFERf=gW7zfFh}UY{@1xA?W7D|dB!<;~C=s}4OW7nEjw`Cvxy&A01!
z%)Ym$V9UocxzA#A&*ll1R<UZ!B-j|a##@~ZapIn|HRo3Jibap3FHiof>{TVPVIIe|
zz1^R+C$q30I_~pDw<~5L@4nyD^tp8wY}HjuYF&G+X<o#Fxs07HORUyph$h*cFr9y*
z#wTtQ<MfEbDo-Yf=U8qza)whhS8rOlvBMNki~T~A3&Ro&w}$?#+j-Y$-j|miUIho{
zSr{|@R<~n)!tLL3BhdYpuZ+yhI~`5iBOm8wJB$8)pB8X7`oe{6{6cc_H<)T3ZCvPn
z{bcJo$JLgNZzpny?U=Axfi1lv*X4NIbUvS&l}Wc$r@3XNC|_MMees2;WSyC6C+wKH
zdHS_pnieKbSfy{DWSPD!g3Yk-mHy#~D)aJEXU6ima(bs0Z_?c_9%aY%Y{!*Hec!Ee
zmbz5%ExjUK9<qcrk&W&Bx$Moc(mk8XwG4{l+(eR2>x+tBNh)>QAL#w2D8=BwR*lKb
zk}LPIT#a{?*&u1VLq=lTr)O--^n?B74tt%ppC<O_VCiM&gz$%gXIAG(-dVrn|Ln_u
z>$iVwTM_Z?qQc*XN~TD|!i1ScrnxyUPk!!L71wGb^G5VhvRBCm$*GIydTiV$F?HHp
zkG0DsrcR#gk=Q5WX+1HD+i+2k&4KmX)MI{$>*q*5H(GIX#y^(ZGO4>ob&6AN>|Bs5
zvH4Y>f&0z_%d~6jJ5O!yb7bBYdD!=BO`PitjowYa88j|+Bu?(g`y_cUM!{z9p^iq?
z7GITwg@(~<Kg?NWaCS*#*oOIHDrpz91tv$&taVY@Rq|B5vLrnxxbJ<m;r(@&^?c36
zjs5qOEPtQYqyO<o)Q4-8$3G<RPIzB?xO(~C=l?X>0{>Wu{rLUimH0lR%kN|~Zr**%
zd*)UA<;rT#+N%;V|G)ozb}!$wYq`|2>NX?3*~@!BR(#v`V8N~#n|3Lz^0%2LZdlQC
zZNK4$=@*>qY#F60EI&%!xbB&q5*+ixNO18v*F9TR&!1XUa-e2=+_aXy9h-GmgeU&A
zm#w$4|5@>GxrNG-D)F#ZKbKhw{mDFgckVD>zj<4qV(I-GFPKlatjWLEdTr)*Rhz`K
z7FN-5nsz;5pVW@eS+hbucI~1c{q=tqPcCQUy;!qw;s%x<<q|t%OMfmmOxtsr+0cpC
zGWH*nwKS{cg3RU1J;Qc!>{R?L@Gv%G?WY$p0Y{HMbhP}a8{lRkVg8~|<7R&Jr{=v@
zPruxFBxu<ETIbmfp`E^Qe}e>%S8`4C_>)lS@#lp=+njSXtv+95qIPZOU&5umR@6OR
z{^hM7Gj0n1ZJqst%iJm`jqO*?y)|NNcc)0jor^T)I;HpO>EzZ$pH^#WmJ6!c*GBow
zIjDUq^XVN^9e>Wq%)YlBR?bTpCvJ-C^!4(pNQzo}V#9O6R9lyAE<fd8{+hIMAD2OI
z+}@g>_6`=g>gE>}_PalBZ*f2IG<o^6z1-gqWeV)++ES_{(Y11w;`7V?@3YrOJU-;I
z{zWT8Std_GQcQ68^Es|O>~444EhA?Ht>1Oir}Vf#f6nJ%y}h>sEh?T)D~&GxzGJ>Y
z&i1Jf{xUXgyRuZWX->$G^L^2=@#`P<X4lMKFV!>aFWP=?scmQe^7Ak-RIB3H&s~zA
zpOc)Cn3<<nP`Na!I{)zw!T<L2n|!%E_LXj_zU^FH@X)z-+veGMN$eZT*Wb=@I3Xlk
zyg1zTWMATw-Q{gpnx{NTxhUnKF!`|J^S{!k(o+hJe_sD7`aMGB#?Pha7xk>S^kz?)
zvg2Oc-2LVE=FXW|IOk39zYQl({4Rfgf8x`&iP>t8I)3DwZnEG^ls!2^dfuEhmn~GL
ztoy9vFS)d(-E&Ubk={iX#l~{(ixzm^$r1h#>RG@Xf3;=u(sjp$%tdu{(~n<&ryTw0
zN3V>&hOAibUW=&D?9BxqPfRY9QL{;SIjM8af^UxuT8zb~G)mh(dB?nX;p{J+;)kq$
z9WeUQ9q}ry(Ch9O$0^cNS07TSv#`|M*Wo+w<AOia-U`dv3WQHs8g+D$jm~x7hmpN$
zZ!~W&%?mpBgJ&zB&GnR*I{WYWy!`RF<j>2ZZ;1s?4;J$sm^Wkk;e|Yw%a1N_YnOVM
zDdX84QXTGWwKP1#BgCegaju4oadz4+w)GDLrSp?M%$zK&U(mXOfAfb&EjKl?{blPu
z{`@}s_D}oek5wgwyq~OA>D_Ovzxm0Vlq%!7zRNa$44?Bg@{rPn*6rJQj-9sP+tYhm
z`RJwe><{{KAA5qLHzdSL<g>CIG5V79^&nfc#8nf9<m?T(E1pQqU}Ch@S;}-&!sN)S
z$)V?%=l_yf#JqQ_|0Iz)_rJcB+G57=`mAtCf%%TZFRLeHin*_GKUY7Q|J9El2ZI+c
zY+(8~`|wg7gK)c9EVo`Zy8XVE5YO4PJ0#vmDV9Ou^8Q&ZQ(riQ+RCdNvd<BjqjAG%
zclx>$UWcdszOHjmY}%B_Wkn6#3c*~PW_f)!h?aeBd@NJF`jiy6v)tOppAIB&FTb#K
zNA{~<`&L>8q|GW+`*QW`i|p60A6%YRU3jX-y!iFa@S6*aw&gYZTK;fe&AKG@S}oU1
z;iYNT7Bkl*Sif7>6eT;uOEKiG%?X#wA4E4!R^K4J**EgZt*&G5zP{Rf?nFzf4)4XE
z<<iq~7r1yZ3s<Nty`^xR>&&@AxgRM<I~uAc80@!WsadX39w)nf+nhVGoq8|5mWj+X
zQw<c6erBtrJooK}-6EEYSKGVAi;Ie%_+`I^CrEYf`E~o86u;hPw99#-wfx+g(rYj6
zz8IaIStq4&SwCaRwinqo`ga^Q+$xxGHgZ<!(Y=RROT#B9eBv>7nfka~Q{TopEx>1G
z^SNfT8;k`FCj74+K00B!TfC)zf<ew#SDrv!{bkzj^ZJuaw{y2o-@%x2VAbQJb`6aS
zr>4LD9KZJ7$CA=1{akyd?^Kjx%(MGy5#pkM;;+&)sq|7--=u@{4W^yis>$3UR@xbM
zdx4ov(!yI3-p{$VRI6|LvhSMyq=tv@*L*(tqv}hh*YwXnul{)aqR35OZ~Zdo?maI<
zQfhZpE9*qDc5!ExY@QZoy+1HI-e3H)<ldcg<IcKIK6cD%`?*~1xgHPH+5a~dp4=;7
z<oo9O2W8JnmEb8GKFVMF$N7DU)304c@0M<RkhvhY(QDHyD;CeGHk)ea=iF6bS5#Ii
zR<LlrQ4}BZhpkcMbj}p6Ym%Q&bZd(pI32TkZG7~TF9+uPul0MjH-F;QD;#HD#syYX
zJ>{1b(u&BAp7!<Zji+zg?ar#U^w{Y?zrOhC(~1(-$Pb50%=XIaE*EYRo2K&rwB9qR
z7ug4nE?NDS;pp_FUtHX)nVR>y%{%4B_LZlZSMEVlz!8QT?<YQ9OVncfbY^IUWS#5Z
zE2Fsb$+d*dCpWq9+}k&GiqLrljf&_6SBq2B=lF`TU3#WCC8sGsjaSsTSvvmq<d;XE
z@@%=<*B5u%^OQ@`ujkIQ|NOiX!_XmnBU@C8C-2JZl^<d>0`mkW<hLH1Qr;!5w4hPQ
zD*51&oy=?<JKoP@$W>!B>Du=7t#m`}>$O)WTib*d7OtP4e{d6*`Ibxmu@|krh22<s
zqF>Z&LcytbrEb?E8$-3`EZPvR+9Fr6G--qH+tX75G?%sI>bv}qw6s@`*9r;Sbf|B-
z%!ijdch24xlXv+{QLew{)2yOP$E8=TD@>9Nsq8Y{&Lt|EqVAiPzRP4sSX<l7)w}rf
ztGw19-C1~M;``IZPb>a2Xk?sLoIY_?hTvjrr$w9ITJX(2)3v;k-6HDj!;D&OzNqC_
zrm3DgAu3{4`G$#4`nal6qFme?2AO-|hh+QzFt_bA<ehD$wfDx=#?pv|6ZeN0aRpqC
zwI~TF*ZIWtY+7m3jE$jz%H}P7wYLS0tD-+AO^uCafAY!3B4=*S{0+|^KK$~2`MK{i
z+`nC$ICIJOKUHh5+*07RFFoA)OXlgU#}}AV>};gx2KKzV{XkYEW7DSu`?OQ*%Oa-U
zvFYCER&kZ@zx@yWC+j4#(tpWH8*Ym`{d=Q?lg-6f^KWnm>^Bkh)4H(Z$F2y!^)GWu
zY~MO}AK%-1Y+c6$ou|?7*jyS8Pvhg){2wSVon?W7(E8Maf|X6v!=j#-U%R(-g`1yi
z@R`{DJfEkFuLZtLi*c}@cI?h}wj)xa{k4;o9t8et`5gXfq2cbw6XoBtockYWW2SLU
zGg(`)d`H9a`{I+;THh}_z{aWeYUMn0n-n?L>J9mAW&)co>^kC|tazoj)A`wrfcHBz
zrtW&Y!1Y3z(<hdb${*(FUbZ+@>SVU`)aQnSavzMff84s%bfoy8C~M@sx~1Far<d`c
z-Rm{;cSg#gS8PmHPCMs#eLK+X`bw~D!2|EZ&vIQ3D|-9y*&KCkn~KK@-=255*TWtA
zKAp77<jssd#2tO-&bi~4k0#Zv{&sOkg{R;3yc5lP+3cfY^#0q<jlZD(`84O=K%F)5
zYrV|7gfpJ6-+w{0{Xmo0?1=plzf#Y{T`*~rc&X?9bW3E@sf*!TE3D`1bD!)|U1s3&
zwM#p3v%1-Vj?DC*N&au1Ph6G$?SE{CTbj6nsdiA4(kbo=cdMBx*Y2nuoN`fb1@AuD
z!=A!BB))r#&M?U8Ys&I)d3^Qzt}j!jSKhtKHtUjU{UNSpS86Jjg|57MKhVQJH2Oh(
z!~BGZ&7U5zKUrwR&bNB9$LYfse7AK)6P<L$w{B%g&}rUsbe1eDXGF^M(^XHlD^}`n
zb_jJeXmge?l3%=WkJ$FpkH4&b`>t-^dxMIn<*jM=8q%I!H@{GG=hEtn&u{*CyoE#m
z?ro97<==ZPa#t+5S6Og>t$6}t$=o@+7cZ{$s@zeO7@Xf0xPyOZ0mriM7nVGaOW3=h
z?~wgEz4ZBAwmfkQUb!=*ZJj%N$B{MX@0v^B4Rd~fv|RhBa!F|3uYmUNTpN}(K00Ok
zDaJu-cgzXf3$N@%nc9<HN6s~1dLe5OJ*!i;U8M1Ev}+sZ`*yLp(YJgbdG|)Ko;;(%
zXyJG-xrkNe)jC%1+0qU#KYe#`^0@D@gm*>cG5wZ(3<gY=3)YyG1~nWLeZOP(kxRuF
z+L;`$OUN%=aG+f3S?PlFVLzMK##K-FbyrfdSs`NKRhOO<oU1-GpS$+P+jMVuQNv}=
z_phcMT)_T(+V#e@GT*MK`-gs875zD@->Sj8+g0*gdnogkyfTL_zE#TnpC>GPV{hp{
zGrxZ3Jw3hW#-GHW=kIkpHC10Rx8#L)4P(iMj-?H?m7nev?>(~T(uMoQCzZkuial&p
z+sk|I>xZ+#OM|X&J)QV-*_Eu#uXfZN)8U-8>|^p{y(rG=FTUYVMZ=DB{oQmkAn&^B
zXT#^sN^C1``F=lMm87!3{!bBqM|{n}>j!<s57)T<3A+EktLO2fJpake_4y8MYvtuL
z)~^oR@Kj8R!8p~w+WF4<139l>?T=6m@%@$|;e33p-`m#0dAv_&3wvxlc#d_#)194v
zR9jEfOk3t$skXeJFtF#<!tnU($sbIUSMJda&v{Z`y7m6a2WLOLc(3$kTg|gWyT5My
z&d{#ceJz~xd`0H-h+9kdTvy-XA5`w{-92N~7lq9?zrLF#**43uM(+ZD$m94UQ|9ds
z?*EhNac^d2MB0_Pv)vw;%36Ls)VlfcU4bRbK5bo6c~m`WXGqr-ulJWWbIh<mX?&Sc
z_NTYRZlV3B7e<Lo-&p?d%j771_APb-$<6D&rN+p~$-X(jo}yj6@$U`w+w=CUoVvR7
zmC%8#GhTPHQwoCHjh3F;ocQ$zqf7R^#zXr;;shV`_Jq7!`0Pha(xkL&8mz6MZ7c$1
ztbCia&(#)HyxSUfZ>_h(x?Fc{l`6yivi|C>{ogjHE;_d?wd?wwud#XWpCH{aD7^A(
zL?3tZsWt@$hL$EA2T+t0B_^j9Bo-B?7U>mKUbX!j{@7yD{?FkVFRIU<Eb%bkTfTdH
zjPYiZ7Rj>A2aZ)~znrdRC$;V<e6!{)gXFaTe^+@;TD!ib|KE-BJ?6HZx>LQD2Gx33
z9z5swt?sskkDHD5&tr~fHfu?$@41m=y*b0=p>+PP_1EJz+^yNBG3m7D(R+LD{V{&+
zZ&7{zv`w<%{%4tXvz_e2K4$D<>-{}>Ny=gqt%vt*RxeV~j%2mfTVy1;@uQ7&sOLP_
z%pl!}W0hx;!=A30k*;$}Oy{Il+!-#u|4eK4G_?QP%-i53`)SK=Grdom+=oBznI&$+
z6KOQ}sVl4PrafH+6N-GdyzKk*Qslx^-m?4d;d{!h9~tMU%#QigBOb`Ad@5}73XRGL
zd%mB#3j(IGgq6Hpwd}IV{*d#_JZ6~e40yk;va#05fl=YpR@0w*qRvcuGs#u;b@#f>
zD`sW<^?R_o!cnD}bNZ{$s56HJ_4=DaugteQ_~0wYpKZG|7fJG1rv1(P|JYOi&flHe
ze{XMIJb&9Yi9eoGD$C}IRJyI!`2B5`dv<n`VQ1D~C8>{xRUR`roH@RM!E;(j;tj1z
zt9Kg;Cw<zmrlIx0d_M1uy6Y0!pDE6FJDR$a)k0P+)wDtVu-WY&jj~U<^!_RC&~r+@
zeeK5G4X2z{!o7K~nN>eraDn@OdLy&Q1J-}*XFoIFlM!hvXqeIPKYFowz2?NJZozTB
zpCW8lp1eQHZF}k`>-%m;Zu2_kyvev^;v91&t?j_Y&q|BiZ~2%U5~~UGI22Uga`gds
z1)Gb+HT%0a-{x-Ief@iM`Rwm+-kq&|{f__p+XHed-}HS>k_ufrYuntmgt=`lbK4|x
zlYf>M-rBoHOKff3ca2$}cG%Bfx<_}zuD(l_=F_IiF)uGxYCP%5FgIMzY}LeT;>#Y}
zoK5($b{D6?)XR$&2_CAd*nV`)iS#`yg!s;IWXPXyNs;=pyZU5D+J%eh#xhJN3)jYa
zB;Ecn!(dm#SuWl0i?@6+S$kxfK>e)+YW=Gh_Pl$W_BGMl{D$#_9nYQ_rn7H&_s-YN
z{nNqZKl6Vwon+NFc{KAq?~1eHn<px<n*_?Q4SXWD_KvO8XUX$P!8Q)34_?SIn<dWb
zvHXM5$wL;J+e(5S^%Zese9`K@_$u!F%~tE>_FsQRKbK6FmbR+DclUI9ljzxWspnVD
zm+afK+xq;wcPr1=^15%haJP2z;f<#w|BGzQl<Nze-S}Z^__?RTZ+;ccUfZqC=x|S|
z<l59D9#&=(9F20;iy3${`5g|GoosHE^`P&V(5xTKM(Ue4NUo1$n0z&UgK>_h8QZs$
z4o!!rd|cgbn|QyWbi*u#BqKJ_^*<Ihe>&@YCNJn?=FP0x202NL438e&);qiUs@jI_
z9Q+6PdiN<PTi!Cvyv6lTU7=>-&D_g}+3$#4vDe(}+HrH5TG4Iq(CrD4OIPdU+RR_L
z?aj5=Bahg2%b)vo{CzWDLHAOx&y}XL!_V4<-9CNq#KIg6lc&tH<=*Vj=zg8HtKgf-
z{*&F>58BzwcIDoiv*2O4&eBU6T)fVi*F3AACCyv1QGzY8Tw+E@w9bV!8Vdvj3T8Dh
zR`R+`(^?dN=BLr+=Ta9|h|c-B-N(N2iH#GdzL=ucZ{4eb4|aH+zM0Ts_2JRt=8HGZ
zu(z&J`#(oUqj#mE;>-mHr2Hof>YQ$IH`MPqd#>Ves;WV4wXd*HQk#xE_tiE#&k#cc
zM$7J`5~sXLSxxeXFYa0MDO018cdqbDmI9+Z@94z=uV*<-nzS!gBl5~Dk22o=hw<KL
zubpYi+V(H0ckO1SEynwzxjW{_dKFs<@V<=PzH4n$YVOItRzB1E&EaLj`QbrK76QMN
zrLWIsJQaIdI7{+Ilg7`)-~4ya+Oy^!JD8VrFoo|4e@>RDYut|<W@p(8L5&-FDy4K2
zGOq@Ging1znCHc&y{YRjOw+R1v3zOT<~<Yc96XZ6&8M0tkTd15PL~SXI<4XjtEWtk
zHe%tmQJt6l;DDmmr=nx-Nhf>)c<h;XFMK7GogD4fviZ>&c3%~TtshLwb$ur{SZ8*9
ziknsNH6<pzOD;dMDMkECSjogsjkbR6OXdjZx9#Ij*xa;NaZBR^u8O3na|dmTqc0k-
zmVKA7aYjeW)q^!JUvlzQ2#Rw1oBup^`S=v^dF#@ep9-|_MDjW8d2g{L*lkkpwtuHC
zd(ZmOEBo-}yDb|ZocO+DX<$slE|=KOoJ7Xxdj+OPYQAw~Y?>$^G^zJe<(a^$gJq|=
z%NL!N{-xNouuAo3qNc&-vs@P1>MOQ?_|RK0wZg3E;)eL>z03FLEcULhKCyhR>0(2V
z5P=X*iT%AXi@!2I43NHMb9V8JsmdF2SFgLe*Z$#BJ(0&Uxwkmm_NUY<`ny-2xj1dr
z4Hc%n;a!2c3BhuyH;S8PMVF~3YBH6%UZ1J4Vos#ycH5$PB8wE3NiABN_e{v&L~JwP
z#bZT^nflYe_D>di8X%)}Ye&EwHC~;wDxWgKuRAb^{uVRM`Cgh}sV%YJWxw=~c~b(s
zTlpR;9&3qytiW+@u18yh=}JwHho>fbxiK%)3Jqus_qvgwRq$um@8jloug9`K*?&j<
z!~OF=dD$<>-u$Vi6*+GyciR-lR?a;V-Z}5?RNl8Qn_--*w&9IXlI?Qthzrtc8XVsk
zOm;j-(DHHodA#9#M|ESGOpcGVh>pPQrXn_j0~rPrCCn`QcfUzEBlc6~%)vmr<14m{
zs~kJos(2(#v)}6u1Gm}ySh2vKXlEX_lFlbDPC3b_yJo)ii?~tNzTv)F`jU_PTQ%Da
z4;=e^?M-i6^8!zc-n4a5;$nBiq*<h;S$O9td@W?=skk!DIXhpYIq>z;Sy^*icWzlL
z#lLqpQ!wj7o)=0Rbnfry?8-@=clO}6+Y(DX4X%_2$ck(Huz$XQ`GPX*^+g+Ef3v;w
zX0TZ|ktw>{<oLI_sY>_RXH}{yt4_*bKAt7FY5G}?vspJRu6j4kTOu4(x5eN`@`AM%
zoB=PN3VF3%*6H=>D*e64;P;7`o+}Q@lcPO*tM1hCZTz}yT0E1Tg2Cbq8>esc^!k<5
ztQzH-@HqOU!i1793~7EpCU@@7)7NPHw{B1T^1|aALLV>4Js`gM{<p_0?_6aTb>w!&
z?vYiQF6q&{z*$=U`-d`v^~a?D%UYNSzuxrifz7MTE4M-yv}_W7*x*_|cfsv$#Y2-m
zzT`RMemK$Y@nRVbZ=Z{6GVUs{`bOs5atu3g=`nlW^-TvH_OL0I$kmAIWqR~Rf7z+X
z;6I&dee1Eu2a=1$tA0vsy7s29;gaOGR)Hfw{z}yxiwKH*RQ7y9_5IYn(IvkdJ~7Wq
zYxjK9uJ+TvD~0PH+lBo)nrc3;8?p)<mrWL&w`9kX8S5=O#e3#BMA@f0K2TEKkS{fT
z`<y4AP25V=&dODDFH<UB=G5P({Oat@8~@Zhy|u4&*3VG&+hn<Y?YXb>HXOZXDjYc9
z`RyX9zsF`qeZ2MHO%jXA)R}A5!k3@TpR+SqB7N<Zh>3E~wi|4@u%zqjoC4dgt2`X_
z5}(c3<kf4xhW+N81F=%R`j0%m-iw-AcWgz$_uzRcx;J;}I=y(CXX!neD}H;Y!=tqw
z%QFr#PRtC`u<KB4y;7rbY4)|XVyFK3ENQn}bGJe*N-8|sYGL$srq0!TyVva$nZ4@4
zpRN@vlDD7PCdVYdJE1dq!O1m;lbD%JdtNPy)ME20a}d6$^lRNB%?BJ`rnlrob23RU
z(wBJcBd3;^UUm2E+Tdm0k@vUFe!l0O)Jf+*+15{t#Ci-qT{tOFdNnn)e1c<mW7FiO
z#%cUTJ0&;OB?LExepyp{Q&EupmmSNLZL5#x1zWODT@`D(A?um!`%PKa2C37&E6(t}
z^-j>>Y|ZAw{0Aa$b!}N^{p0GLa5a&3;ST8uN!Kzu4Kf2ZaVuGM7Qa#Wd}>C?wF?*S
zakTj4NxyuP*7~bgaKl2cO2I^F!P|?<t7e^EBr6dwvFCVLQ24F|p>w1{R_yy*@^JNb
zX)9}ASNX`u2}=KMXKwu>Cwu5{vKsT=)X4{5E6$33{W?$i&u1y0d((bw|EC>g?6jDx
zzwwVSn~|~Ne!0mPo*YR#WHt5VUB2BjRTg(fed*xb-7O@#sZ{pC+iNegXP6}1|CV&Q
zY~@;2zQ#xWLWj%tyJ;yi<}Rq4cJ=K3J!=|{x*Ht%d^G<0$%WbX<c^7JDkwD9JNz(^
z_x{empF=fYJhRf7LI1|e0-KZPRNN=*Q4;+gklhug)n&zcZ$^~Tq=!Wbw_Ut>*1r1q
zEQPfx%g`fcd32<3)~~NeW=ER;eBZ9_RkFM%DR=%g<5vDnRe=WjzS4(FKG>Yw8Btf1
z(5oP~C)Un4z3apISDs3yt7TmK>f73i_iyDA{<P`rMEORUH<s-7tM{<ExrrF|C>9=>
z+gkHok@?P@FI&`KDb^;xdg0uqweia}&zUKyqN&RF4*AJO$z}h4z<q>o^X3nN%Y*h8
z&2e4*@z$j0KQ?mbbq7{xOk6YjR8_y@2Px;c<G+9Z*uOaWPkH_G4{O}xKhAHS-`D3~
zeQ-lx!xiTRR)>31xqp5A-fu7S_GO{mNl~ejyxTswO=;oJ)t|Ou<HfyA{IUsqx5e$}
zI3#pr$t9LeHX&B2n+lw&&VPvvGo2afoWJ6w`qX~)Onr8R!wHKnF?bzX6ntsPrR9}p
zdROe6n*F`)sQ$C*r{1q`)?j_6aKJy{^3MFNH)VaF{j=G<c;=mGMa8*)U#Dv)^YA<7
zYs9L*3HkDF;*yy7`2UhK)LE-07Oi|LG1WigUYQ$X;gq~NKAYP*5~K?v3qlJ7{$-ZT
zeci;ZxVN>>e#3SZ{d$J&h0nK?U*SJr*6&|+_*>Vs-PXJ9zu$=7;`A_aPJat0gTl9d
z|MIu{_AZWpx8na^rUjD43Aslq#X?GVF+Jz9Z8>u6Q;OHsbZ#^KL_5nik5>x&InHOQ
z_B=SB8oKL+&=i?}jJNJSVG29yTC<<ezr^JuLnvF%qHMXB+a9y+4xGVhI#=&T%e0oM
zi)-B2{AU__IWMeL7GqlyF2wvhn<s3&C?DH4waY7e?j|fXI59b8@ty+)raU2ji!AmZ
z^vq~jpzp)Ze*G1{nG}=XC!bARmVyqN8+{Ub&TPE2^2$!{+gqxS?~cw13f)}v`l@!)
zjl8&+F8}pvHgorSO)R^rote9jY0mD+S+lbCwDBcr)QTr7cbXqKEK<tbVaxQ$>keng
z$(Ze|^RI2XyRum5{;H;stoy#3X58P#G;8kG>AWtp^qSc&d2d_!lKa-}HD9@lQu)6Z
zw#zD%{K|PL%k$&qv<GRCCv_(8TykQ4)2EPQ`96WEwo)Ql%&QMxlg{whQ1A&1t=)3K
zbjP&Tx8EieiHL3#Ta|KABC=}<w_?pv@dO_0KsUoR3$|O|b3M3NyVxLVSw`EvXzfht
zCRwwL?pN1uMsM4BCun1dNa&)5v`|k@u}~i498qWI*un}0)-{5%Hj8>)R8tR@P8MhB
z-`O#1uVd1bS*C{9r}S%wg#R+DS$Olz*Of9+pKg74W58pY(e}dCWEYbl<E<G_0@pD<
zj<j^2Xu=#C5PrNXPGgl+r-F<B9ns|#4Z_cZBekA8^E&e_72;M(?Po5z+3DfkWnSpV
zu<NedoQz_jcHLc@Ypzw@%`s|}E?}N4C|W7D(DBiArIkBYO`G(US>&SA=|1<3=XlPR
zZC(7>ezL)A4n>WF6FxW?Go`iHbk{|{{E%hLoSBy4Xj-yex^at&m7gvf@0^8J&lk1c
z>)?snv0}0B(I@3DPILBeNULbOxOhcMi1yYbvDJH5&se@I`>Mj;Lu%i)wR_&0{Hc7^
z<7EwIH!LpNtc`Li>nzqT|Ngf9!L4tC6CZSnT{8Y6#;a^H-7QPRqxVhiq6nd*`R4_F
zGDOUOz5H5m)M|Ei&KD`GEhgG8_t^!W{pj<`E4STlj^iWoo^QoRQl79rxs$W-v_Ry3
zrO(L>az{55C#Y&VzqR2G^L%lIm+#(unfc$Ut4kN|TOA#)yEb$^NA{en>Y|lvSU0zX
zdUoceMpj*$-Lf*kZY|qZ{YBETKCyXsVvcrKUC3HsvD)sgI-k~w;|zPgN9TWcu77?v
zvENVJqu};bi`C0Gwya&-xBKzdLud03FDlxw{?Pmqiz~<HpJ;Lad++7HK9j0gK9ie^
z^6tcKHa*03uY#w3#jnT+d#kP1Zsn17D#eZl24UYCZ+tWSa9MKc%yU|H7r(7sG9fhT
zfmwvB)A@5k*=%JA?jg&UR@SvzFYfGI)PG|}lWyb_&lJVW>nw|}FJnLSUWH-9X_>cc
z*I%7|K1#b>d4HzBU!iUnd9(J_VjffG&-C6@T(P0}+l;RQy!#I&iPZf0pP+l-jQ6tQ
zDef%_fzB?nug(g}$;tfX{a0DOtGMcd_3xg)Y8kxVk~++NSF4MTwm+-7&0X{7-TJ+E
z|4kCDW4g#96DA(B{?b%lwz%%E7fURx>}vNHzu=PHFJ;8fxaN}ED}{T)S?}j9UG3Ae
zN6ULc9nV~C1^cT_x1!ecK7PMSXnx?7h2GtUJO*(G-X37?QFTw}S}XY`#;Wf0<?wq}
zMITFoS<KE%wKCRvb?4QONKR|pL(-}xCR4xmFme^1Gyf6O!zvM`w@GW4>ruV)YRwy}
zPMnzSHvOc=o=4n)x2pautpBvI-=Mtz{{H)xw+{EeFX!t!wD+Fp`;7JFTYd}5cjoUX
zZ7!Gh_v`;|_vYKf*~)8<$iLcgxcP2#-HNZjzy1(e-_P-#&o6Pm?EJcr#ozjV6?Ob&
z-g09a<KNdGcYk>DLt?w{2k-Y^?)v>_@b71{R<~fQ`&Dqwn%i;R9(#*LcbBS(eyg)S
z_+M6T4&$|`IM1Ajt-fz3uir7<<kG`+B944BC*(6qhB7(Dcs^)-e6#HA4Y#8Cr|x`k
zSyvvg^}l^~NP@=;|1%suCC@mgMY_*04GGn&PcGge6&xx0(e=gREd4u-XMJ|hWW7G&
z;;dRZrw1`he`<JrZOpwD)mbIp(QWY{WlKS6_uc2JtlQ<XnhIu1<UO0Pg70+|^R6$;
z1jX*%;u9>Hs&pj&hT~(Y*~c>7ZpAbNU3!!lF-bd&vH0oP!wJ*Zu3?Qjd8(c9S69)M
z`8!v49AtOie(dUb{;v*x2ZjFqWPTH}cGdO%3hi*=t(GPi&3Abi8BA9>zRIJ26+g$l
z@8|mZ4^7@&@cr+(`&AF$wFh(k-_LAV^Gi_Nq5DejshYT+AHt4vW$P_iqXQc@9ofGA
ziQD>R8^14&e!ev9&>nG@gO}9wwTeuVY&g8{i3J_bO4Cosyb{56IzaH$rd@MB2gw9z
zM9(YBmG%feylu<=oJS>Bxlhd5S0y>~=Dl_MO|u_#+&`NBS%X(<!)f2_8rwDcGb2;=
zy2b9Rl_m3J&N{4b@Yl00<*~gPXOoz!bE~M+Gq%=DgFlSUFP8qAFU?kVp37c8yflDS
zb>7W2t5|2Ba~DozKkedJd*ZHG_3D1p?Mv+QkM!;}<@!4F$@=|ker5D`oy@$`$626l
zef7(-Ig58aK6xuE?Ah0}Cf8@{>f9b~Qu(c#_WO4J{#?UE@%Hq;!2!)D!i~z>SQ)v$
z*=jVtZ(Xgh?r8Gjrr^XLR_`hL$&&={C$ABlR^xSgu9{$&&4an@42Ju=#O!ZzwFj_X
zELcACC0o+Ly{lWZq$CADSA9D@WwrwMvibh~{#DCs=O6pNq{+0gMPQD}gqD9L<(Dnu
z`9I6KZ<ynfRjA~iYofH#p7HXLwuHEIjC1XdYP)2%@7kErc>k*8%S}HmI#)bpT^hDC
zo$uBT{-qJ~OF~Z1@Bga$F~-~dtE`Tcs`G9B{kku*l>hQ{?2VbXW|?jH6#c?=Q(U*c
z;Zx?^Vq~=KUe-HxqoWa)pUbcAEmOH5zxpuOz1(2=FlT9Z^SwFO_UwK!>;2j*E9!dO
z`V_W3pZs9Y6w7Pw6;|3C1s&d86?PK|%d+24CzZR8x$n=;?VGP#^BTSpkdv3K<1zRf
zH=o_qOYCUi)TQ?}DbMr0{XQ~nU90t@)ccOl7dV%;Z#s6tvg^HVXMcTEqtZR41uG*P
z17>%fu$VTdCsgJ3p6!i%?T^akcDq0O_}+P$-<{(bKYTv&?N2S9uBsv-z_Pl9MeVMV
zivPOZ%nv+EwmaO9ZCfC1p)GnY>-L?Td{OZOhj*#g6kd)$Vt#{*pU+)9b>2Dc_YV_U
zy?Fk4)s*YT{pJZ1=UFbc)iktai`g_+@!7A|re0blSl?NjvW-nw>^NI5-vO@nMJ4>X
zf@)Web+_L+(Ru$zao&`lW?>7A-w2;QsGoVOa*d4FESrPp0z>mTj%zyaeps^6NYq_4
z#Y;ruF<bnSS*Ljd<5Z?|%EkYCZnNBbUdu1>bV-wf(nl+mW14T-33|m&nUb|M{)D9G
zRaVc5YT;H2&I(%-r!2ACuF5}cW8pzdFWy~~cv(f%UZh>%^q%Kcw!qPOWs}%N(S$pR
z;t8^xDvy+Q9W=7YwT;WTD{=eHCRwd4Vb_XVsuR0+-6|J3JBjPeqx+3|YY(0~_P_0L
znR{Z6LvqUTxW!hdjCbvDo0E8mSuWzITCDMsj*IVor|<0-+9fT0cWuqKfaM-9W^e>O
zD3sxQW7{9}G0FMyTYJIs{Q_qe?fnq+v_n0_P$NKNC5PIshmX{ZZ@l|?v~<$>lg=6+
zO-!vhmc21jS8uZLX;yuwl{EX3`>}?@65evDxk}Z}HCrO%(;0U)zT@n7y<~c|-+J$X
zJ0~)No<x4yy+gY9+(yAx_sJT&pUe`wsQyJ;&2HkXde*;ZTx?v6D%|hv5j*ex=#$by
zlaGGW`yM@5ap7l}n2Xubn;mJfn|yuRUm2u#br@HE+`+`?oglO1Rr$+PDgU>2Gavp{
zyQfmGze7*h;!(qmuGfz~@TW_N{h5?3S#ogqr=qoCf`4Ljnx_93+_6jH6Z`z9JW?}a
z9qLUoUFAZxZhNWhU2p27b#l3$LMUJ7i*>tI<g%TXPyN2M;gJyg|7phyT=iQcpLqOE
z4gNhxbLS0@jE<Vu(}J#SZ$7*5-tLe4KYUR?nz3!$y(>>8f9$k1nas_ks`&P(*Y4$?
z<+k~0y!fZFp8LPtr#*MNUzdpMRNi1cY=4;1yKUF@MTaKOnxEvV{&n`%eZB=j@*g{w
zoqqLdO8cYUW3t7vdv?Ej^>M3aY1TE1^{b`^?)ZM&<?PlE=iLKalEMobCz>;#+s<da
zEAw<pXyV6Dr+N3=73;{~P7!vrE$oW?Bh%&-y=u+1Ri|ZKrT($hzS(>4-@%KH{~!G5
z&|;b;rBL6js%rR8T4ulH&L=zOdux?;E_Pe?c(SNUR@^$Z{^wq&^4*lq-#D*2`8}84
zqSNmlw(pIbd&gD%gu?Xwjao8Gn)bYPEco_u&HcqnlgjtjS_#}<_?p4%x7+Tg<=J({
zi(WO`O`mma>q3L<ReL{gn*BA+bp1^8X?4+ER}R+&&NBJhp%?n4-1~)6zVqK-QzkIi
z&Woydk_wFd_bTi2RMTQ#$vIYs;{H!_tWBw{U%tOs;+vm;zrWxg$z>f!%-@$X-n+e5
zb7hW-RDk35uf`gyBNkbv>#c4{b1mX!QLhfPTa|tJYrA)sVe1^jQ-*7!n_j3Vww$<W
zRQKoTVYv*>Zm*>L)QL6iECGjd-b!z1*&+4z<;o|w_D$|tn7k-5QG4w__KTM`X<w<|
zT6<r{+F*{wNtQ4@miNpDCVV>CUf#~Wd!D@C$Jy<xws>u7lim_H?T(L&Sg8F*1(&IM
zb4?biemvyAoPGbBFSGg1N`DO9_w7mIQ<=%flRa(cb+71~%RW1;a*x|q@ov$O2)o>^
z54_tCeqhOsEKcaHy)&WW@3oST($9)^pC~_V5%N29`ZLP~Wv^3X*KV!Sx+OK|cV|kW
z_w?$mB01#|r>E4-GRfIp(--}Aa$VkrbCF%E=1;Xe$!^7Cck)-2we8OxbsIL#XPdn%
zDx$XgyRc|w?fPZ!^}MwiK3#n`N2XCi?}@*(BGW33<G&2qelI(l`&dlj{oE)1OWMBQ
z^Eb`@thZE6f7f;EJ3nvS<}NSi<3G={zw+nbXZ}aBXZmf4xX~LBG-)bNU)Tb@{HZSk
z3WGQKbk!X%t2rgGc;EjByYBi6OLu)*7XIGVAe&7|>o)hUb9-Nx{PkOP{dcL?#Z?zy
z?A!d>MsXcO<g^%-FRN#HMkWbNKKK7Z@5|WcZ{KWpPkLZf7;~RD^m;IVPPfMm>o3W2
zyYAjzpI<xe;wzRj3m@oq9h8sCFU+mW$T$2Z_MDYJ<EfdM#&qR+jVW`}?Kga@T=u`<
zVd{!H?Q<QT^QYh6zU%({@}uid{8_zg?X9<;!?HhAJwAVU`rFUn#LO)AS9<cFKmB?0
z!|(RnZuURVt>9xW5xDi6zx^-s1?9cl4Cn1Qe^e^}!}rfQ9k#Q#W%lh?{dwyY+oQ|d
z7oF+Pli0RHPyD;X_25aDCqFEFb;(iU-YLet+ud))scxR|z~h9;M0SPj3$y?I+n|#%
zVU17&8$){b$<nHSuUC9uyGe6x)WK_id2^+EKDe!(w%qDK_Mwh*RvS~wgEP8!$M>d9
zceR_p)$DBJlc-9me+N&scf^Z-HTmPed7((uyte;OO?*P*+;17^d@z%AImUl_<rbf;
z%xkWPF5j56O1E$!lb+tqONS~KEpd1?UAm<4+jK!`3#Gd!J@=Qp6fbdKtF70x{`R5C
zM%E`(rcbg`y6N#+<y~OnxBP^wY__G_-`RGo;xIViSsM6fdKD+@#E3s~^UE@2$|PAl
z%z4Z#&8zfYH#8@+D|~%y)wApeH|Lv=$_mR9_;;N@cf7dDSiSReW~I@2*$<P`AH{t$
z>P!tfG-KJbvqFa@pYyTqcD*Oh7grSeSh8rcMX`o@T5Le*8lSFp7SYXio8Cs4ygxC&
zRqa=3#VmJ)w4%T#;Rf5)V>eYk(Pb8`wEDG>e_=&${O*#;C+_QdDtR9<JyPPmC0^&n
zAw`+_F6x&4i+Y?^=1+9Io?o+vr!l(g)JcutSl2Bde;2I&`&c{R$@*LO`TyOkO?@_F
z<8BQ_Gwa3o<Q>u(6s=6Wr``E<W9iDB>mrO7*X3L)KeVlIPeR+m9mhjLt9GARxPI~4
z%~w56`%k>8Tf?_2z2>iJX!%vw{F1notLJ0)Bv^}Ae3aD@`zPlww$fX;ROhAB(H1{l
zgU8qZ#&8AC@ca7p&a3}Bjh!biNmIx?dPTVQ+?P!<I?Zo{wsA5(UTSlu{$&3D-pf;b
z^weimq;Kp0&Fih_{%yT%gho%Z_1Cv@#t+~9JoMb>Otsb9i)UUwxH8TD&ZG38H=kRd
zWi5Cy$4P-_wpv_Y*X-`4riVITzj@(jS~-a+=YLF>OX0WWZeQ*njocSB^||nQp}Je^
zHg$W-&zN(?(0BLN|IDa&XoOZw@;t)Mz+fcBz@UKbax3r>hLXgh^wg4Ky@JZE5wG)Z
zyNUf<zg*$~tA?uD)0Fy9hoBuobGfFb9u5<`$)#tj)PCu}p2V~a@7d2{zeRpKS@rDD
zY>&vSi9!ZC=jNO?e{N^v{C)dm{ck<LR309g$EG4^vZST=LTcMz-i`OI#rGPU_-&S5
z{JPiSz5c!Z&fUC@*ISlza-A^lyrjcsr^3-!t>~Tnq%u*j$jyfTqJ{TN2Mf=jMpj?p
zdzVf6<{vZkFkq?cncv~QQ+z_`J~I`+jneL!JH@<@3dV|7|5xj2j!`x{oD_U}PwVx0
zKhJu6^nPPBYmMNujEk=?3h2%`TAvr2|EJsfU#Zo9lUIrrTdWRl@HaYRk=T0Xqp3se
ziLcRH;}(~BeDaB$rBN+Wv^{E7@S%^!QjFh%)<mulW>rz<v^cta$&%g6<}m-7By*=&
z{;`IW<2=_Z;cjl39d~pS_9t1W>1$RyDY?Fq&^WW0qvBAJ`>Y=C<O#Xcii8$i^_#y@
ze1bq_w$h$SH@Y_{#8jNW^`iEqbx@d`!f)kAO_`5p*4jA<K26H3`O;vw;Ayj6!YP49
z4rh}<hB>8E*8Q5M_~fwpH3#oW=Ow!~)))6XSs2_ebWA#Mn&VU@ANzepdFKy79S>T9
z9p`(V<k&aWYYxi;>%d=55%mprH4f9}8?*6k)RO)5F_`1O%K9JO$rcuq`(8*_{0(}M
zaKX4rY0?+&qNR@)HQGOA%6u{PsU=qsOJ$?kkC_TRr!GfpEa>^6l)5{JO?g5f=cYPE
z3kIXr;qf|WzkR*EL80Kl5ks+BK1b&!uG^RDzCWm_x$wG3-}jFOe}{VPruTPRizlCa
zaOk4YpFa!w)g_J!vhV-qo$}n&COP+c;?{DTc|E?b1s81%VGDh~AY{_wg-WY`$K+aX
znh{V?aryYMlvymr{7&=oemC#3e4go4Wov(E&SL8oW*3b)#bz)T=z87c^>J-|{?)S6
zDOK)d=*mf_{Swa}nmysDvcY4YWi2L&Q~6ZAT_&sR_k57jIQ_hInohjqz3OEPDl*ml
zE^JDQI9%!4%_Xpm_rXi1wWk)UPcf{B|NlKjsVC*#d~=<<Up4*-Zu*wJqI8a^m$t#R
zRWCVh^7|(LNa#LP=5y<9F;nA?E#FS9>3Q{O`<DKa?}aZX+>M*@%=5wCglP>nD-(HK
zxz{Ug3fX2CzG%q_j^nEt7QgjayJEpBF8dE00_NpD4ARFvzF)0jo;PK7`hl0rU$;03
zH=K>RHDR%M(+{<?iy0<yK8kJEx)Sn2oaxq{9{0<WB_dC=>F$2bUZH6fF+Xzu_qQ3H
zZ~w>L+8=wvzKTEp|Axi$jW#Au_}VPL#&NFgvE8B{!vgkMtC}A12#bwB8^iGAtm8ud
zz{CurX}?;W|7#uk>>#u!$6>10^|rhQyKCKBb9fzc&F1Qy{Uz?!y6w?l;j;pLPac*{
zz1Flau6>He%?D8zcHQ>t4mV>D{ihH(CofJR_^On`X|KD}xtrNId9&9QFHrr_mUV?I
zo@4DQvjy7|j6Hu`SfD)7aru=~THWCST{{&nL>CHO`F29=%=z!y8xFQij;-fr4n7dC
z@u00P)PyyALD&B<xxGScm$`qe()F@_y6Rd;XM@1HvxZq=6E5;*8$1&!`1+vO;hyc8
zpiAE-uzkB45X9$d74m%Z>WiLf;ma9LKIq(%RdQD8&XuhRT6Zl%3YjKHuMm2_@y){c
zwyYY#)eklXA5e@goxMsp*6@A~JA37U<n}$K5ff{|CTRH26<K?u_A=A8-sMvAJmrs{
z99>X5!~53egR0Lr`OPbHYMEC1bt~tC**ScnAqS#^LvO!Vd9>tqmU?<Zy5-vR?dOiV
zm1k$#7;`Q%eHZX}-^0f&YhQILZ=JH_Q^KCR4BVaCY?5it8BPzIFN!Iw$q2gVYvks%
zOZJmZOZ``0Jz>Qq4KhUwoOkSNk>cUo^+e{@3>{Uen2XoAE(E-O%5XANv6a(^RpVFI
zWwEuVwY!RETnR6dF@IcD_+V8a*WC4+OqKQ=EBGkj=bf-(cl2S#KAV~8EL!?=Pj7rC
z<K=99;oxzvHplxi`tiJyC%=h1tutL*@?}EayI_mkXMNYSzFGfu-Zt?kbvvG&ZQ|74
zkP!K_>5tNb7lI5=c%{}}o^?+A-QBBCZ+u<$`Qw|<N4~0Ewl3eZW9RH$->1D=k^Rsi
z{2YgH5!b!liXYaUj8%QSZPhkk!PClK@*#}17A?hQbN|1(dq;1X`RB_FVc%OW7n)9y
zVKmvdbKl%^4|v{PEwQte4L_dh!noy4XY0LFiT%$D&i|K<TbOa^epvz67d;F0c@Ne{
zd=>aL`ONP18>H`leS7xqp}7oS|787o`T6eC%okl#DtJ#aUS#dFE!<?$c;Tt5aH3(P
z`Bm>1!rz~tpDz+{^7=Y9HFwj<-HDOq@6PPqQ{L~b!BH*xzwYbL>QAqp^JrHe?7#UX
z{k`^tdTYa<uXulL@aB7Y<9o-p^Kx&?T`vjU<6PKQUS=Hjuy|2uSNHRi-)>B<Kcd9?
zwfxXU#T~|xp$A#A@5au%V&NCEPrda23)$X>yPYjG_Mhe{UGMp-v-<Tp^>;OaAO9u?
ze%iG!Ik33l_iy)$imtlF+xD?sajW?|@!9|XvtRTd`m|g3l5CxG!nUosGddF`LcVL}
z?R!xmlssd7jo$LCO=TC7-<DbVN$xzuJj+fh%i_dhTW!6~I;^^7DaS4z4^j$jI(P5j
z=k;-acWa2uxi=rt0st*yWME)mU;+^g3=E3cS^z1DC5ig+@tJv<CGqik1(nPUs0Qdc
z>i+g%W?&HHU|>+jX+S|yYEFJ)ie574X0G1Q!2HD)0(IxtOI-Bgwp#geZeD!Z{G!Hp
zi@Y0~OUkw9rtEyca-Xp;=W<@i)BX1o+65-%eE;NN@cHcXndgm@_Z7Ww*6H(@G||=O
zGxPn~3?9p(Z|=C)V#*r-@V|>;Emw<$lXKkVddZs|UC*P<D^J)}KlYE@(DJjksQUN6
z@{XqUaxso8zq-}V@Z){wc4BMo>}hLm`Dm}2c`5j{?cM5oQ+BOWo2>oe_O5$QzQvj%
zFD7MayfkL!$~s)+r@cZlw_-Efy#+HL26eI(1#ajpEIP}+DX^tBy>hjrW`yhZH42t%
zwNiz)IrzLi;=IZ0LX%DKPqTFoy6i$dc4p0vDZW_JwJ7wWY4QGZmo$3p8aE$#QN^%l
zcir5j^Y`6(caJgrg76p5CyOq=+0C}mNi|R-;O%9%uKI{|SI^$>ZT_;{eu=wMXxBEa
z1%guZ0+z6y3_bl|<yDP`Vp?w87npv&=5@cj+hfKQr&ZGFa~_J;9NV0DN$dX456gmM
zZvTkVj9mQtfyulFE7huh#Mv|iTAqEMUeA{DZ^AOiEh_ab7j<e?>Si<*|NW(W``k}X
zUorb7pC1^VP1tObFWzc>jp=B|{6Mw1gmsIK9S_S4ljjRQ$bDV4Ytfb!zAqPkVqMcx
zvv89^Q{c`pk7lDXZN;Cn%p-Q&9*(n#N?>SfeZYCu!>H?PM9}ul6N=fdU%UD)Xs_Ht
zQ??^t{-<yMvHiry1deGM(|YdxYxyowHFMMTqZ_m?o|-dJbp4E1e=V#<uEy@**i<KY
zDEI%YC51vuP8*z1*tgp`sA0O0r9d;E<b!R+=S_sp?be7p^x(nU-`u=?z3+dS-gzr?
zVp`^h>xXj~&oPwkaW<cqC;e3|O!FDvjxO!D=O(Fi)EGQGoH4sO+`jAWre(WIn)5xm
z65IL9KXCuq#oljb;PgY~%YH}p&*%Q^mgwEN*zmx->?0R^r#i=onXz1dZskxF#w-<Z
zIPkXGkr_VccE^2imu5TlI$~1dWN*#?*Ou=IKfdSYWK-9Y6|%-hYpf%4@AL6y>rE0j
z*4}N&`}Ua0vbpKsxE@+GU7sYkb$Kq+nf9AMPkMBIo^tc&x5uX+=<a{KNWRz1KH`iV
z^ZYaE-L7oUYyW**V`<-K{o#`8vw3&#6+ZI)ht!q_<z(05dC6`}3=Gxmm~Hv|+=9%U
z)S_bKj9fZ7F#EQF!14QkHCbv;u=&3HWhC)NF?+heiCvdW0wkPIe7hN_?Cmyb^3&V?
z+j1g{l=k2KU%%Y?<)7V-x2G@v{<AIZfasa)mIc1tT%V+)uBhBT{O932yPb~xi|o9k
z-kDbI`2R_C?_0*dOsW>A9&-3xnYz+h%46z`C)3qZO`KoFEN#*Z;pj99ygH>Z#KZLE
zojElMstYd5S!9VkRh=ao6!L=a;wrJA{-2v!k`GB7dtv=+vcl)Ha@F}|*^jTc?QhDO
zVb&CSi^;9x<_xtg5ARMUoh)D0@~C4Ow^Dy`+54!hnYC!a|6_|c?b>(2>%xxgi~W6_
zI{IhdmE2#*CA@Tj*Ug)gzd3yR*yLtV?4|Tq<XE5RvbsJGdxgvM7Pu%Ie`sMASHI_P
zcj9fRzTW0YoAqVgSI_I-%e{VHdrxIlp4jTQ3EG>L?(Ds?AgBEF(_gat{~pU-8GU4f
z+nv1YYg05%InHkUI78*hk)T-_vr5;q1?v~L1|QB*PcyabtX#HxTFddA&$}-6trgGz
z<=A&|*~~6W_d|<9Hw9Wfdur%BH$yPwZ*JsY#pqu$t8`lucDPSHA<foNq^tCyD5%kh
zQAO;o;p+4s!Pn~+T;+Qlu{Dul)zliFwMI^_9x+~wEBK!;UtJOPRBMj#>4ll4?hCnf
z{q$rulsfq@>DKLEoGVzik$<r$v&dQz#*4F*+sybB_xRd<pS{uEVaK%BDYuH(6-Y`j
zPEG98=1S%7yYQisXAZ-5ZuPQzQyw1RvEVr#aQ$n;!2_HeJahi+lDTyK-7}=kwLB}o
zMl`?w{(lMw1H&|J1_o)g$^f1Q6N_{83M$`9W#>OO`?R~BmH)4TboR~MT@fN|?;2tz
z?PcpN|9(qkXPf}X7MGiMrfSG~-u%e=@4dNmV7}$YWwXzU_BJS7nlMNFxu@|IPahlo
zGbL&>p9{(@@4V8&H8EpVrP7szgv3s*dtc0+CV8$<n%?Z#A)z*T#!45Ln!p4L;cPu&
zLF0wz^J=Fltuw65|M&mMw&YDIw~V`O>^qaSn7TRl1<4t%<nmD$OE{ifce<6SDoRaS
z&3@|VXR1pg4Anlit(tM_Mzd;EnqAO$k$`1IE8iG+2k$SJQQ<%N^vS2~{OR{j_NS}c
z&)xs~c#gw^jYgZjj>&C&ZLF+k*XVKdf6}*?VHaln7H5l^fB)LEIlr{^Zk*J5XqUb5
zfx6O@)7Q=v3#v6YGJM>_QX=>H|E#+vMQ0sW1iyQoEl|nxUOZ;z_u0~)!i&;3SZBKI
zEJ%CuD{T(*zN7rdYyYnec9<r6qFn4#ET`qB3Acql)v_;oHQ{c8!3X74B9-iW#HB5D
z;@o!rQ`VX$8Ef?5x}&5l^HayKxeWIwOue>pmhW=G#X$`(e;5UNuDEz&na_@yvwme-
zeT|*T86Z^b_;k{#w^yd`swj7MyJ$JZk(0Uo)ddc9p@UgjCL1gag#7)_-;?`aRaja0
z?|UR$#X$?Pb2CgHWZy5kW-hV1bmN-Nee(4M`i=K4&T+b+y3krA;gp>sL&<s>hEI>>
zEK9=qyq8YDX*IJ}xWUhPR&1UIBex<)(ZQ|Hc}2Sq8GfuSP%&Gb|8~ZPXt9Ig+`HKN
z+3wF0+|oMf|0ho2mq&MopX<2%A?3k@=EY$NCDF^--Q~<D<jFZ^mb^7-YHu$4&eyZH
zzfq@a&!m%5Tq*k_+;)7rV0~bdxTg@~58Ymo&3x_sr-D8lxws@GWZj}5?WIb`N+%X`
z9uI3OY@XTmV#Ok+Tjq&DmD20N<z^)u^s(f8w5hpR#vyKPLeZh-Nas4^Z40_)YH-}l
zacWM8NL#pY^M`9(Jf|dkcfH;f6LYF3R7_cdd&+VH|6g(E8Vu(N7XDA067f+<vPIxx
zRKMf|H|brWYD+@0v#*6N{BW7)@a@^x`MUBYT+aGAwC2ZEbFbrM7Ikc}EqYaz<#VS%
zP(|8QW}=Ik`=7T$Z0(De{Zio0P~md+OJ=yyzPEMZg`HOQ<?MUjuHsDK)!oH7^?QQ5
zx97J9<<E|*+wWWdIBbnP_l4W-kKa7XHEmhNrjRm6;EsODJAs3G;*9(6Ufx~v^xV#y
zt53u{_H`5Z*s@Gh_@KasihFPQ^9vR|@3~brAzZxFx?z`V(`A_ib}`lu^{Lkwrt|uE
zF1zd#KI525yTgVAH5b_?siuJ3$X+M4A8QZ3eR)JU;b(T*N|DHoM|RKWOL%wYnC{9i
zyo@Y@i>hbO<aIrqc4MRU@!sU8hr(LsxHcZ@c)zSlRg!nk-8I5o3qvl&q^vPa*r~aV
z@1FJV)a6@5?yg(SReJrQVD#n}23x<2XJ3ykS<B0RLn->2q(i%NgxtyRmsxG61xrh<
ze3KCQxsmCX;{3LNS(RGc&UMj}`WIexykPN5H+(UNv;MX2%nV80S94z4tbJrY$?`_i
z^W}a!Io2lq^IzV!MXh<!gtOb^QjGpjUb@%wiMsxSOOw`3{W)P}w&=cOiGyD(U-yd$
zgzOQRRI)|&g8x%7?m)(~Cj5N4%2TH}^SpmOw{2nZpVM<h?h5Way^^JVqP38Uk0jHC
zMZUrX*N-3Sn^W^+>XY{Zlcau6aAN!2bK|lRquw74?ugpoL94>UY7>&PR-1J5Z*Uhm
zq?6lL(U2fB-@;b9_T7Z=G`C*OD?!U<P7mUI=<U39;_|{>0iIL%UxXfAHTOwr_U=5x
z(*K)JRESJjwmCkeC*NiV>(d2+1{06^1f6a3jdPp3<M{e?cL6O&afNd8eWugnnOS>Q
z|6CM);eda@yH1ak9{s~i9}F9x#BAd8iIqQ_=Qda4#*up_jBmQv<X$_=a4=gc(%V4g
zi<#|}?))w@zU&yALI(bVh5Gj<rF@+DQ|ed7LSZM?X$$O*yl_3TVUy+F9UHh+fBPR(
zRjxX^@UH)tE=NTsxno;}T_14UC^ax_s!b5D2#-0l@T;rIy-bmZzfYc@zTe@-g-ENH
zCwfxvzZbs|Rad|En*40*!kapJw=QRY4mIH9;eGpG%75|fMOXi=y_a?Ucb>O({+jKf
z$$yUqKQM1&=MdenIKyp&(08G^*JM~s3?>;Yny_BJ%WIo%=GWqFI}dvOu`64r;>+n3
zW3GFcFG4y(cJc)W!3^1oRR?!1V7XhcVMXtgS%R~LwE1+k9kypIdd2f>P3fJr#SUz#
zzqNZR@*L$qcia^HlGpuqWp?vlUDkpdx6MlrhwR<QAo%Ai|5l^JFJ2$uTf{!I;oqj_
zwRerbtl>5bX>(_vYV9AgamTfsRl8U{<f~d(^Ufq~2(;`ysIaW?$)U0xg<qa+&0c%F
zH8*ixisIx0wwu@4+kcp%n>TmU(Likxk%RJwKc{as4BmhD;DJ{>+436FEz9_)PRU3*
zS8V!ps)$nOq|{4dPX%-Det8w|fANy<{daF)&RaC|<*u`nO*JpqfBt><+tNezD?j|7
zA!--4P&DD!bIqR<-3m7}w4bcp8-HZU(c@)FxiXpM8y5ZNlbh_lvghM@T}6KN%a7+j
z??1WRVQFNXeXv~d{t&s}tCmly|G@L@g5mA!ehCRZGY)7>{r5_>xwet#*#9k(Z&VZi
z_O+yL_NrX}bjP*TU+<PxewgNR^4017yZnD{#I7j1w0fofpV{T*`m<AV6^<NdIm;WO
zKfjopb^aeFf9<Fz=4H1IEVg^_z1HExvZB?FDaGP1(ypgmUcTtd_CMDZr~Uu;Zbey6
zeb)6qQmls_f4-cYz4td0%aw(P?=>EqnOA6kE>r#VyWAa%US;xqJ+@_+Vp+ug?_P5A
zy7{7+lOJzh{9Lzv-bS`v`P0uoV&!HMt2r={U%maEMO@{dThaTz&wBd*>Ab~F^YYLC
zXGipGL5&$6^Ftn&g%}t_TNxN6aW!U=K}{Lk?BLrcHr@XzTKu5-%^KaD8<QD!-_z=w
zyxCjVbH~Ax?{xW=PF=duwp-5b631ijkN5MxpYf17`Kfz?K+{Suo!+V_<GZ$hXSJ7|
z_<8fS{p{su7CQROR@dXTkT#H#o%nd;+n$W#^EtV1C*)bobIY-Kl(PQnz3g{ezeO!E
zU-U$`_i)3GFSDv1-e^D75`6pqEh(3U{yNzcKBz33<~qZkPucH{0>{p?krGFuqgUzl
zoZWcV{iW{wzDNU=GM_50-pplJ4{ux(rS)xZ!Hj7?Zz%MCy_~+NF+Wd6Yn9mv)83>V
z8|GY)zbzPgRVE|zfkI1avE0VGLz#0Hy@>k%@5j1q+3!{Ie*eC1{QfK^^wUjV?xf3d
z{kF3X$vyTJFEH+R%NJb0@uuR97W2D#hkUtWnu-_A=HXeldSTw2Z>L3G`R|z5%<U!1
zrJ!lI<NcvpQ<HSfnD<Mh4)y(6vwPzFLna@NeSDJ;5&L@9(ayI=Z3-i27(V|KY`*@!
z=+wQhUL98O%>FB-;+^<FDDn-nvwE3GgG*$YNssg=$AxP;npx*mX-*T~(|G-5P1cD^
z{)?=iFS6#o(Gh#<h24CME3e%>)e7>D#F{>-nDO!Xo9mW5i|XFE<ebTzka)&RE9KI1
z8!mN|U0t6YCr=C6pRldXzEEZYH}||x8WWW@m&FLm&cF2W#>$#Ge2!n2@ucQ<ACUi)
zeW<|YIB(#C<JbK*sysduCOhR+!<RGn{?FUHao7I6FaOnjdUsu!amkftVYe$=ch3E4
z^04gw;{BI3OYd`wew<~w$6WR@+e(cqfjdilm@iD{I~{uT^_HAf&X*qC;%sI-t@2Pe
zBTVeV<OG3f4<ba^oO+k_obE31=w}UgSoOuc`mf1`+GlgRf@JI5v`?{>xGQSZ@fNgk
zc5S;WSi0_Bo8DcmfEbR;``^r%<QKNhb?*$hv#i{|>x0|#b0d#0Uw*Cf{a4E=u@dJF
zF1)DFR$QT6AN9#yY+GvLZr%F0lk=HBZdRZF_O0}EsZ;U{&krzM+}XRc`l8*gJ;o;#
zdN}R~icR3z5OX}Cu%e=%qT-6(6yFQ)>T_hLd2xMD5WBtfclgrZ%o&fbiLGd{P@8#c
zb!qo0)xE2{g?5!V7<H#uo?uH{m1X#qjhE@oGWQE>SNP4^|6u)^)_R*+&&+>_2W~ie
zaE<A12bJlP8lu~TTL1fsv<7mvpG}I|v~p|XN5dUlhddpElxLaG%(<`hYj^HqJy-V9
zge3kz5uW2WPFZC(<|W+O6mr~QwnKV<g3kO+GvXc2>q%cQd37*$Wk_U+V;kG1o1d1J
z$crA`;~0@+87OhweTjTq+~NzyACD(E$O$@2&vRp)B2#jMYo$!i`$HN%Hjjm>zU%R1
zxIT4!R2g<Hg_pI=Ep+vBm-~w93Jff_9`Afo`~STjqv5-Ga|JcslnW;3=r7u4t-8RU
z^D*zEw#I{3WjQBva8&s|=1JB{NK-v(tdw4&J7J5WN65vsb6UEN&Hb_{@I{gP{!ERa
zvM2tw`HSt;x_H+<S2AW{7HSdW$r7_TG{u8MhHF;KlOrL@4-RFpEnL&8Y~(6_`@^)A
zGRa+PlMQxliV@SidFhL>N9VFxydV8iV*eSjZ&Bs4v=BM6Ju+Z7-^^(B?JV3Z->ufp
zzogdrd;W>L^-PQJMCEj5zU<xXU|zj-OKxjg<DrQYm@XK~1~}dj=*?0vy2ioM<`!o2
z_4mT%zpPG`cs8G4f0ZV4k#YA#b8ZR#wHks;9piM?6dYEL-oShO;Bf|)M@~Gm9({N>
zGxql93m)+?5~;;0F=7k!#d-F;@!x*CRd9uX<W50zqZY3fRh&D%i#t_w$S&f%&QQ&C
zVSAg(jKU=v>^2j>v<W$;q)bvU5INDkJ0^Sa35jEC*UXy!zF|WZr^l7^+l6l4)xWuU
zQ_Ed3tNp*3LOCA0`6zsI5^N}ZlT?%HtShmI*F?0XU4`+gURUbk6Ww>27Rj1%1T^HG
z&h`6$iQQgwHKXp$1*e3z79H4a{i0;)6YYMLb%nxTCggv<)h*t1rBv|;uWygl&!<ZN
zrn@Xye1FQ8?k@A<tx0FTi}%KeERgbYn$vS|-*sQv;B}AJy%0&<(0{{_n^)N(G9b>_
z!CLYwlbx|-^L?*u*Jn&00;NP}%O^|CExx*D*2PxF89U9t&QU7=YP3+W{@Kh3BOgYW
z!rWtx%%@ef^7He%jZ)h#Y@f8yPre~$((Z|eUN4%H>~Wt}G>Ltk?9Ppv7r(gi*qoJ6
zJ+Jy#lSk7oC^6_)7L)0ziHXcdr}Q^8eB?;3aADoP;9%{nS!*qFm)A_bn!A6K-QJ%C
zb)Wvp@@<T_(my-xrqQK#_M`3WzYg!U@8;*{=KtQ!e|y!d@X5*oQ+K>@mS6U+=-rjK
z69k_>{*h5`zDSN$&hf>A*xzXqyydKlWtJJ6E5Z#5uk+5W_}<J?BVNQHS9pK5gBx@4
zp>;QA>^dX1<3rwe|1B2Q%N5odZs&S)z@FoRm!*WGnDJ-MB?mA62-W|!VA0`2(Z?em
z6xAMK*H*CG!Tu=5@0oI2#Z$SC@8J%6)+@$2Z$BW*CF+)@kSoqGadG29-AitUZEwpS
zIDA$qSseAe!ON`R!0*c+uW0N)c%;I9Dw~VSWW%{}Q!X5pTDd|XYgSX1NU>J0%^EM!
ztHoTpOEUF;o2&@eTN2(bcd6M`?e2MAl}$e!T11WpBsgAJ;L2(B{`A^_BPSLvJm6=e
z7gRs((^UnbAIx*SuS`E{A5oB7eI~bW?nJXGM-(o-z9Xgk;kKTh_)ZBoX@|799UG3t
zh4OxC&RFyzyXR>Bo%pEu5}}Z-vIWm{4!Sko2<GdNN{SbBjVq}9{<TLs!{Z=>h@h}a
z+94+MISed<b*<ly%;bBRxOR<#pi7mX<hPl1$=+!z75DmctlhlIH1?&e`$XHRbE6;S
zWW7k6y3s2|>g&`A63<UHDk-crNcuHVHu0O_oN^iSBXYM^tXgey`px`lk-B?p`>c*N
zDP7im`r_%q@-#_@>!Ba(>k8)ao%|hTn0b(;enX?dG~p=b3yTaG@7N#k=XRJb=^A+O
z`{NkCBTS}?IU8h|+xY*S3vgChyLv^VO$A3#&AKb^CvZMqZ17Ov^heFAbUtynnHFZx
z+JrdDl^%9C-#&9d^18PEk}9=zty&Q#)Bgw@>|MS!sWtMrQ_5$~Tir@3yM*N?9+Hzk
z+fmA@l=!^ML*%}|Q6D`G|C4g=|1`_J&$)dx`>G}3H9OIL-|^UoM$(pIhKvy|M%J1)
z6s~qC#{J~I@hDL6yu%%v1%fWi437Ms;;+H0QWqKB;x_+HL*+bO?~sVEjy_k|9=dFp
z{%7uyIXx`5D)i!X{P!B~*tpPc?g^bbxos0ULzK6@4!RyA7QZ#Rn`up1bzsX>JKxS(
z{_#&;bbT|=E?$umYNxzRX|pV^dfWU$H<5Xh8d*B;AD0kYA?WeOe&YTW?=6;8{uSpj
zJm37oc#cMmhr`KfNwt!9Zh2U*2zY&XMTo~Nt`GW;+Coy&UoCSg^UD-V;Z4+0uk~qp
z)3<!#>6lr6cj=T(iujQ8{dl<k_ag-#ogV~BX!tw|wKsRXYEkt#X>vk}x+QPn6}=Xl
z-2!tPikR7|g{!56f8R<|`pD+o#hNwGqwET|y1<=<ACE;Uy_oNIcFXTg_ch#nrCLrF
zgsAje`sbbb%Ut|_elhFv9~EvzSCVs9?3%_q@x9o>-*ZmX#-Et;X7P?|+NU<u2?y8Q
zoWaB+|4d_ZpZL~_t9K?Z<cynD>ZHxid|-A{(PSHupPENjBpl%qxx8X}d`#c5%_m&F
zt}VQ2XYy+G7B9W-&KLE<Vu7*s6XUH^4u^E5$Z0Kzdi5uiHO5<8)APlO`>ler(t_qr
z($rZisM+@B$2=3kKh~*o8OogVY%9x{KWtp|$@Npg{f50~{(L$!Pc3V9z~9^4SBr1X
zI{3B4s9)UpwD&EG?j0(kmflBw-~4t>x_@&A&-CA^-<+d=hfjQ4d!ciV{MO~_@9kvg
z&)c)@+^+qZ0k>b6Fx~j}+1UHM?)5b%@202Dx<2pE$_aZWu}39(J^5`GW^_Dk!=$ZS
zKTMJjJGtzXz2hAnt#co*KU?Fz&R*t|(!F2d+y7{vb+&&Yle<lz#5nY~MDW)8=kM?Y
zTv~E{VY#olu#xogFWEjPrlhB^<;-viS@xRojiOo#*Sn{}^X6W>$u+NM>JiqL#}?JJ
zu8WbLxxOQQ6Hf)h*4d9c`W9bUSg513KPrRsdRFqR&g@$Schh{6)<0j!`R>3;C*fS{
zb2(wJEswI@4?g9U{OXKVi7Lzcbu&-DxqoigHLgty&U&&gnrAANzs<4cyV0VuFHa{=
zZ<Vb(A02CRG33zn2}>45=-m17NrLfiuh{j*%~ccPPOw)Lu27fS)RBHRwlv!%HYqM|
zed@NTr<Inr0XeImtrhR`x|7=&t+O?P>7TK~d)>TFFPrVgRa-AjyL;x1YRvAXzx#i@
zo9=C~;Qh^*9nL|fFGH&eKRj`I%DVAZpVWgTv(JYv_qIQAV&AeO#cp*k%sAEwJyed#
zX=Y^fOZC=u3YoNAaaD?k#=9$LuJyH~I2ERPJ=(e8>@m4w33eW4Y4wnuJVr7fGSB)f
zd@yfA$@^tN?G>xva$GiVT)Xw^>K&(7@424UnK%9IZ>8H?9X4Fno5WX<Jn7R?fsn!v
z_qT~RzY@2<`MG9xF{f4R#VCcWU+dhqY4VusubuOI_j$GDmL@vy%Y)>)EUqY&2dwh9
zt2mc;>id)QkiznNDSIw#Uy*fnUEs#T-7CvX)|otS4E&n%|Fn<ei6gd00-b;8yZwKz
zv1p%ctnN(y2s`V>wQ=(Avo?#peyn>YUT0?5Pqm=`*}DXa%<nnLzgua^G~1Lldue{D
zbxGB)mv6JOHykar^}Ta?#(J@Nma~>`_)_(7*|p+3{;!1Qe+qoDs`Ns|zR5S_dzXuv
z9{uUN^S{{an?f&kKF<ADF#DvZ-dy38cl3g<$cRo>4!x|k`s}nd`*V-}a8^71bX~(G
zmyXE9Y3cl5JpY@#nR@Yk^V9F;9u7y7Qd^uWa<=Ekuk5jr+q&VF#w_3C>$jRGZ9Vh5
zY0d9XJ-g@Su9q_Sxj|d*+}4VK(Dg?%r-xmUnN`hxbJx31oAQ5t$lf(oG%w}i`86fl
zoa~K@YwlG_oIi9thGl=#@0H$RJ6}%P75`DD?R-hxC06dYqGCFCvQ>{{-F}cB=44|k
z?>X-b`^HQc*$px8zQ3_}JK^z+7UoaiE>})(cwK!#VRyhs4iy&_sjFwTH%hW^zumzz
zA>z!^x5rN13o1KdFt_p0wgd9s@yoZ$m>gBGRd^dVedX?_6>*Z?b9a6D)8|_KWAE>q
zvqHqYvQm<zp1ru<eLDY|&Xgw!yr(}*IQ;*#tLJSA)!guBJo;>HHq}o(T)ZlB9?o5M
zCSBb1bV;mbqWSxPOVvB_1+H;SN%_5`de_|Lv)<ZGI4$ORHtEG?$p-&A2E8c@-OI0B
zlbB(>M0`@kl!8e;t=d5wCeAWeo+d67(;K>T?R#gTf@i^n0%>PG{8w+{>}gO)v*}q@
zAg`V!y>?d7#L1Q!3cf{Z=K`8OYV!pjbxmmEUy^SfZqc*C@;d+NubryreRNk%)!*%$
zR>t|h{8iUWJ>imF8Y~s-c5wdBTETqOM|R!S%ge5OP;k@gd)<1f_ss(1Lb1qKOFsrI
zJua1Elyr_m^~A?RGiKd(kVuF*dHL+04WXa1cK>hYyD_VC>!zz0xSpwApVgQCVz(8y
zw3U2q-HW<okEFNq->-PH?&I%?*O%A)7JO$MvP9dL%_KZ1;?ZXIpDGRC1Y3F+RdRKu
zEuG;1IBTiZO~v;MgO0>RUE=)IBlMGzvGz^I)9g8Hyl!?Tdgf9&3)!MwOYgq6dFOS=
z-t%ktTX(Uo^7~dj4oSV|^7e3Omb~1#(>q?a_-J;#JbeBE`v;Ng_nZF<KVP=Sd|Qa`
zt<1AM>s$JT*KH2(zBhfb97A5?Lgt5o&%>_m)!v_?H0{{h>nZ6hCd;PzKfWP%sqa9*
zvDIarB4vwi)GYDgcyXpes`!=n<_!hOf?>jQ^f$&%6Fxl0QvA2l?IlXft_T|V^K_nP
zNDT}AuW{j6R-JxW@bg#4IO9*Ztlg^de5Ul~sWp{8EmO<n>&_iJn}0B6?|-3XuVzZF
z5I$?PvOq5+e(q`KT^oML?&@v)6~_}YbF;Ma*9(Q$4$q#NzS8r5h19Oi%X5w2+y2x0
z+`Dhi=koa4o3r;fO32r@s@zcf{x#v|Z{I5)ZW=S3O1_i5HH!6Ucu=|ZlV+R5@OdA)
zC%+Od^w}8^xboTU<AEKUp9g46JF<I;KYN9fS-Nlf4B159!}1w!v5n#9>a2cLDQBNK
zt=bznHSX2aE$?3}yKr3o-nBIQ_13FTsak!Fyt{mZUe)4z&)1jFd-&a{ea9>1ldH^^
zy6?I^MbP7Zl=b2avD)R5>}6}eEKub9yLD}I^3&6sxL<F){wHgmf!H$TCsB)pSG^S4
z(qD5lx#HISX<B0Q*Uy-LAadCf?T|at`~5!(3#LcZU5gFA`>_0w`LDdi@8$gNpZ)vk
zkK04r@K$%RU-SR-BSykNQ_E|+?r+UuWnhREV_?w5IT9A1R+^Vwl9`_upIA~-l$lgo
zk_uWgx;G*>|F)UHzj^V61r1StvCA`W)fP<4U3qaY!|i}Aniuj}bOXf#yF@fj^@%^(
z|K8)I+1F<$jvCZ&^u71_&c}*9)}LhF2~RWb;FgqHm%<lf9C2xm>jIS-EX$_|WF3CW
z<s`cC=S@qMV<|uXd@4G6R%dy(ma1=>cI25UaW@b0M#ue|bNAAr6#*xIh+a)RbUmjn
z*!)YG=9Nh)O+}T$_m}1CzhsVVRoo~hkk#|-^q~!rzskC1nQ`(9Kd|JGGs^7MN;y(;
zSnqJjti_2O3=u1GR{zv86lf8y`26dYRNZ3lvojMuRGw`K{P1{{)QqQj52lBD?VQo7
z_4lOm#xo&q0w4F7aNT9ra=V-1e};ATp|;s9Q_AkIGMKQc<G9U|u#zm>mnV!&`lXwX
z6?gVTdqf`TF6qCN<=uMIY1!3T?iy*~;_s#_PCa<kS}nUTIKFS^-cu&;=ErT$VB0Z$
zYUZ_6t-hIVX0!G``dPA`m$x8BdX?$aH0#5v^L0<GkN+1pVfXLf{`GtQ7yW-|eCN<(
zNw0%5xcokUlsWczqx1%OJ>FgMtl38wbJ{eeExRBTcmF`JZ<=SRsxx1-w}*hmrGyrl
z#V1pWn(tiRyKQR9#fp8;C9hB2+PS8t;P0`IZz5Z`JkR}4w412f!0nx?naO^gPc-K0
zO|z2O!g{RJ*W}HV&AeRkX!1$J^tYxN$&cHD4IAq8t$VCPl6F|H-LSpLX75f*#-2;Q
zTlAb3f60_lT{gQjWtR5Yv)j6b?uc#o;QYwx@!|09^6T&QvIT_=ZQLsg{5keAt4Q>|
zic#19&G50ZC4qnDrLD3GDoG1Z7>lv}{^?lQaLLB@T-Z7D8{eK8to4tWI62Rv%{F1#
zw2Cv^QqC6d6UniN<$m??m_?q@+OE(`lUI~Ae%vvi@r0prQXyyD^>#+5HFX81`LiBm
zI^NAaGTTzebn*Q^E7jkBuk-(w>>u~2n^h~hXoIs><$Z3i<y$^)+4Z8`V4;+r!t6si
zX4#)DOB$AY&#K@G4_-01zi3v#-cO<-Q*vc(zlg=3Uuz*}^k~zLxhgZA{`y=`-g5Fv
ztHd;(jh>Qoj`MFiyhGU3CUnu7=PY^E^8C^k1-n#hrT7C)&+(Q?FWjuZ<3N~0r>XS=
zHQx%)TMsO<RvGI_R9<;Hb6&_XZnwwEw^Nt5|I{!2y8Y#$?zqEVmFIhdTAfVGznwUx
z^;62(+9GN}aFUajCbyy$f9n0fl?Gpnl|oO}9eU*D(0h2<`m>xOe)rNHc6YqpwsT8q
z|BYi2>t;nRw0^tgW%bEd-r+MJW-gwZ9q`tr>GjDCwI?%vtc`nh`q%9(8>cw?J#k*P
zYWd!cGpmn>ym%;>-nw_{)V8Nf)V+Q=?`Qm?QT%LOVXslex#W(BGr7xsPTW1-Utgz?
z!lWNpvAF)OZr$;NQL);q-<@0NtF0A#uw%ma^7+eJ7G%fdS-eP9O22>D;`M?_72B<@
zoSx&^Jgr<_SO3F=6}un2<*<1!y6J>}27`B@e7(@FzF6bybIjiB@J>(<jje2R+5LLP
zjsoA}@ah)dggd!U7$tiGI>Zk3)U1`;^j|FFsgRuQdd5~IwbxvH2Oe{M_+81mF8F}n
zrge`P)>h}=`F4L#(V+*ib>|unZ_ACVdbWE@nMLV>OLMpH^UhtqnqBMM79)ul>N0Ba
zpXF>LzP4p`E=}LC&1+xb?v0C=oZ)2Iy)<~y65g+sAN>sHaJEWEoPBg`<M*m#&*KVh
zE|%U;_FKB-wI#czX8F|>u?GtlX<g&Lc5nIS%}1}V-}^q`c|rR99tB;4t@@G|bcFBh
zo2vOeW?Ilrp&#Lwrrb>5cJ%c0t<SaBZ(rwiA;Ylg_&>cJ+aKnYo@<uh$+yEZ|8f19
z9sl1ueVBiTZ{E3otcYS8G=VXH;;LH*%@`PVzGlE!+Xr8bkql#jCNgSYmq{PL_@Lg-
z)&15SMje4^PjmbZ>FjT5(wLp?bwyC~c4S++%>k2+jcmq0(%6;==*nlrC(qA$ed+qn
z2TqszHt)7_XEC@O3jv|Ae?#W%um1Y@U#8K-NX_s5Ni#!FnoK;}Xc6TydFGvZ!<v2H
zLwY_PUFESZeQL$WKdZ%m>(AR?p{SP@v}a=Kyv~SwCrskcEZnpr#pJuzpZEV+OXF&K
zOaCeOZSq?7VN=8t*AUgpZQIRtKkei={Bl#2m=TYwQG5B+j!io2S9t8)zI=YK`mfh2
z>>l%1nMm@x#PNv-no4&#y}E7`eeUb`C6ipIKF?e!AF|qYQf&7M5%D`!GNBh$dQSyS
z+g16w!`o;2&6b20-!nJzsCy_}ZG0FYafYjN>+AE+GwbeFv^{CIyE6Yd_q!ccYr0=v
z-)qbGf8W{57E;SU<^0(^Cxp4GY|dR3*Le>;Wa?*mFd07x+_Zn?lif9nn>X|<Gh#Wi
zF4ab0`N<ziTPH9VDsG&+B4V!>7sFif)$)_x#7=yExzR#d;{M623G4HJ$%$Ui3<{Il
zA7~e^vQnq7D_dsI${iAMfBxPrwD|R{;>+EWxAXZpm{+Yn<`imkD(u_U0*g4c%r*D-
z9+4NnFli0jqpR7Hiu<SJ75Y}jK0dq2=@-K~qqHsYs*}5R-}rQaRduuUgAJKU2Gz{T
zb5lO4%zn1DXx6=5ON?3aPMVywJ9X&8`QM+**EhO6U%jTwZtIlQ)9bgMT2yIdxpaBn
zPpf<l7x&FF&$dJxOfz_3uwT9N>8J2tH?#V?UNt%wbvVnI{rFTH@`dTUuYthhnwdx2
zpJiTH{_0_Cyyl(&eY+`}5|Ydnf4}F+F=cK0X1d|_WOaYNG*8WC7c@E>G){U2HYzMC
zJbrxXiRDUO!4+qBO!e}pJ@e^ykv`Lls{t`j7RBgAtmyE$H|r9!;L!s`q7yjUcFmZ~
zB9ttUzy0vu#aqt2v@MYOa8K!cl90-2t^QP2W7gAt53EDP{-o@P;AMQhckj%eq{x=1
zMOMCcjMLg56&p0)V>AA@JL1Ce<^DfD>i+ZmanWY}gX6wiJU$rvHSOM8^Jg=^=JD_k
zBK8c%8lOadcTAc1xhP1b+bhjaz1@C#S5%-P>jwTaWe>V-e>`LE6Hu~Qy6kdDEzirs
zJwf_jS^v`WzWHuhpvil9g4@lnM!Tjhaw^hZ@nKH%y0k#mQ<3{xEajGNzqpFUO8M!F
z)^**o2Nma^=4ksR)@FN(X-3XXl~|^Q?ZyYE=spzQ6?BNZ^KYDEzMxTq4DXQ_H;n~i
zAJ2cddX1Vh!!IjMhXlhgr9`z$xooOE_e`ReT`l0BU#X(l#;10$@x{UWj`a)V4rE+Z
zmNWe^<FY#My_WXUPj4cVj|k^KnB3zr^TT?<&rO+0lJ0koUE1<H#OME?8ix9R+J7ql
zng07J+^cDzf2KzB`^4^#;h`>)S6Ux2>P$JnRXpccVSKY>g5r<hgH499IywR`D(*B0
zaa4#NXckLo)N<dERDFTlVS?Sf`m^%&i}-&r8+=%N>IL(Og}<eR8zKt#)^Ww0J2F4|
z(PLxR|2seLh?pj7tK;?igPPaOt}jPtMqXdKwB%$-*{Z4APflt4X#V-p^A~LoFN&Y$
zU!670m{Uw!#`mvM_bE%;W9J)x<*qvW_4dxXn(geDbgr!F)OoS-$%n-;Q}_P6r^3Q@
z<>=|Vac>hfSI-OoJ4xc(D*b=UKPWOB;Qbnvy->)s-F3U#ORqOCEl+Yi%DGzp>dD=>
zS@+HyUJ}OI!dt$#tu63*+hoa(|M$f0EE7Ve3vn<t?P)yaa3xym%7^#gzn`j!^jUIy
zRr`^BD?E!Ps4ide+v1bo$!#CKx&>oapL!b86ei6b(I9sE6j$twFijnO4P!@+h3|Cw
z;^zHft)HUu?#R|NDU1<o0%qxYb8?Gh>}UOAzkAw(M{9Z}u(TaFQuT4T^1|!n{llEA
zg!ld{$Zryo`*@`9>z5;mjZ3cyOpBOi`nKj>`FGKaGLOBOetGKTP0nJwyI`q-nygS^
z{Kg5XqR&>o>rl|;zjm_Ob)tVtWLw(PcV9abmNBfTOFYvRa3Z1V@7!JUYD<3kHMOQ>
z#oGu^GpMe9E+4nw?x*1%3vU1Zdv(mM$pM11dyZ%QNbR>wbWnLY`OKBmUTS&kUNG*H
z>X5E^v{{>BuCx8a`*K3p)mKHyGzL8Sa`pA)#rfwPwc_;yx3(-TVAHlL<CI9>(cV#K
z@$1<Sn?D77Qe`VnPcGU}HsR}oMN>>gc1Cxfd2x65-3^AK0&_jN)wqsY&!}zPGj0BY
z1jY6)!75jSKab=O8@>OVT=BE!|M~Fqzv^@U|B7c)TD-WaTY5(F4(@=x6Bfu_7D#YE
z_3&QD2d?`vd#l@}g#&!1{ws<M+aPslzIOdZ{vB=)bblXwaa{iI@jW5zi}~**Z!Kd@
z*Z==}#m6SahpVLwcF$p3zgK*R1KavN?pdYW`|Pc3KgF%sYEbe2;h#h9q52^QU%VH;
zKX32X_-S7r#n_5uZF)LWr1;j|!)kNWVp)YvwH_(zgc~rpFR0)A!%3Ivo4WQa*2T3?
z1Y~%%?fy9#e^pN}`p5G7&mT9w@82A%b`?w9mwPbb%h7-J3pk$CrU<ZnspL})?6?#s
zYg%~4Ds#Vo&~m+Pi#RhrF4-TxXQ}oR-V-vC-+TT@T19NsV7kZP+OD8yd?)Zjjb3Cf
zYpOM~kb;3ppU$+SO6*b#%4T-EDlQkwP*{-9s<p&xw^z1O$X33j{_lq#%cNxPWZBm1
zwRhQCHmA%@P2W|zUAwe7O%8kM{d1i<eM;<f56;OA$9N0MtWF$BaXN6#N;v+lrTw?L
zlMb_#?DaR1sg+x@gr_p}jjyAXcY@?zUD-!^-`7~I=UPzWz--PYS+!uIr$eIqvzZ?2
ztOVlD?mOBQcQ|IrdBwj=%e}6>5?2ja^osTHg8H5RuTH(qsy*ek_KtVW+rMaU%#%F#
z=q^LVWyvgt`fL};rfrVi%P&vwyLbEJ)j8jzU;F%SFe$aaEVz{EU-g&8>(;+}`}b^w
zT=nM{!888^%k5(=ytDk>#m^Qp>z#5Ex9i<ww!Y4j_+s{C%TMtRajkLEygJgGul>y~
z-q^Ni%j}0XtJI8JqnzKxiFk)Tw&Qs$QQ)&YbKxc7-`kIUmleKov-s`Xw-YtvW~;j!
zTmJmP_D#&z<THQ&L;i$=VQ;@5e}8X&Z{PXAt2_xOL#w&s{<x**-<vx}?y>gPQ=dLx
zp1l43L+6-BOc`&jqT4peH|ss}duVjSKXLWMlV4touUP$V`2s7kU%yM|yjUNwG=|~j
zk8sP$npX|J1pa>zJI^bYbD!JkQx0)zhV{%WkH19O_a|)$I-tMc`kp;AD_&$iX*(rz
z{Kd=o7KQ&Sl9iZxH|edJaLu06|2cc&EmrQr>#3&Ser-QCzb^h^g_?Y7huOW#PyU-W
zwr!ZM5%}M&*hc%lxbvNyN8h#GIpddX_{p^P%O|gwE6(4Qzy7X&{Rj6A_1{7l%-<8>
zA2&liezki1Z1ts8L60U|_h#!HKb<Y_IY&)4Vqf2-peUaLFX0Q>FKim_R2SP-)eAOF
zs`FEx(a54+?Qy35=i*2E4Taw1UsF6<{4h1dYg_ksy|()c8Wm>7WG$|&Fcf(9yItGV
z{h?>XTCq<KGw<uqRSHp<mZR0yzU14A_LM^hyxebcT{!x*?Vitx;{n(1z3?*Vo~-pm
zt!k;ya^{1Rj#o_ZxE3L^M&YMM`1S>}H_LYLSQ)5rB(0dR)7Uj|#Ut+C?&H&>&ZRDh
zV-HVp+4S`Frs?-Gt-gB1Y&;XZR{9su5%Ktp4;yyvv9Yq}JAW^B&YZor<>nKwML*-2
zkt+Oomw3<NqbXuv`0q59)+*>1&#AvTGfVca+K#0LyIE6N*{3<C1wV7)uZwzWeaO91
zBcaRd;kl5ErW?B#_imUa+Tgu&neG>+`0VX{S=oGtXXylOxf@)1OLpOI?-&K9bUP;7
zl&y^q_MiV9yW&jZ#E540HR_M=Boyie2gD?Bhu!s>*=aHJP#v!?$8zy>CdH}FMw1M<
zw|N{`SKoD=Pd_(SFvNI5Qh091V`-OpA~R*(-+cM<+kA)Xd4cDgJDJv3&X=4jnqxgV
zC&*(<w~OZNtEWmAzf2T5=DCqg`kFkC(XnEm-333CY_}{)FrE13kYn`iRF+4~TW+sy
z&u=;A7Q6aDTB59qwi@U4>Yi!SP6f({uW-JwLb3Rg5_k23%t@YNSBv;!Rl{fY*jbgb
zZHssvvHVNjamRcA6=mPNPye}(@!ib(*E$+joLSPtIP<rO#MIw0)wi#SU4PBeXJ4gr
zuBhluT(c76+AAr36a1Io=3Ol7xQfY(@#cB$l~WdfTR3AuEZf}r+n1kNC`V6Qr@2aL
z)&$0qyGv$0$&7n)I!pahfa=Ox_9F>T4EKu1FW!HPl`)vbH~wwPNso^=rEZ3MdYT;M
ztvGnOx@$^<zE~rd#IagomCJvbmgHYCHB)tC@)bLo(tdDZh2TL`*>vxaF4s7<6a^P+
zF?NTL*EcL~wyN)l{ORdu@hc^^d#;U<->Q?pmae|{#=Pt3NiWUk$y?-&1THH7er+>r
z&fNN$2mZf$_GZuibzh|~6m3gC|Ngw|#xvhMeFJu9_q>|u#dLXAr=o`9T658(6*<SZ
z%u19={VAz&x-?<I#>)!rTgAhl*xZ$NR-Yo}#ig2&%kE?^v&-w1dx&S@#y=guX6ZHU
z4h-LWS#P%Wy}07L0h2U3s*|q@X*E9Iw2AA%)Qcw)-`^Fgz2Y||M)UE$b2;Cihi<eg
zC{5H`zjim9B>$G6(##*Rf5kf%yGzREE-7DK_<nYg&HC8I4vilpIs)azoxU7e$@U?#
zVIixq=%c`AZ?rUCMVZ%JQ1(>Jl9*i@BT{*BLyy5JpK_PLi}#LhnY`<Ud3zu8g^o)l
zJfEbr66Oe965U_0*nghQPq$6a8x{ly1TK4FeBcIq%~Hn#$*#|tJg0aMzgNn;|F**a
zdyPV$)`jKAPJ3N?zigt1`PtiRpRKsVlOgo2#4=#wQ4@=F`FlFMCO+Ey|6lo0*^HK{
zJ6H>kuFv}rx!{oVy)|Omg3mV{c_4konycvNhUZL~j&{<$9cR3F&OP34{)EA?Qy^}~
zv3b&_lL8f;x5hN|MSij|T71)J##T#)l<>ccmU=yOxLn)wF1_tUi&cb+tI2lbi%f0&
z6JlaI1Z^B_*>}0^N_n$3n?+^@!?T%g2j51nx4d%BON)=6Rlkwp(CnGfSBk^DM857j
zld(GQNTR&zq2~_Q<ubfa$?lqWc8b!<<z`b;-rlfSzhyhm-xe#G0tT6ep7$0>m2H;C
zgyd{;0}T5w$`x&O+qQFWc3%GPeJh+_IR9MPBznE#>k7NKS$E>hTGroclPfzp^Wdyr
z{XEavk7Tw_*xm5>?CQ;rk0><CE<MV`>&Bau)PHod^TUZQub19iQ7(8}YvX<izclUZ
zr}|<$ZstBtR%F{Pk+UMS!F;=Q?et{dtIp~Cn^fCZoefy=y70a152LkP8?0x`Had&)
zziaN?S~=@hZrJIV+(a+EwHyAh-ki^By?t|@>#NB*yY1DqnwX{s1zj%i)>U#Tu#how
zcw4!0<uta~@WrN4PZuP!U;O^t_6bK@+y?ulv4{3)-dHmEJM;g8+Y)xKTu>%ZyM9|_
zm)W)L*<tnEVh4W+gga^Iuy1orzx1Kw=iw*imwG~$n`L>ecxtyOneQH#*Fm9Z-T5-d
zpXttv-L3rP;`s*i<QS=GD{TbcG%l!HRC(^0md!h>?4ILtX>VQgRfSf^UE45!lG~l^
zRmVkpBtES&<(aVV_rZh7r$e`<MP7}5ptdUa?Y-r^+h$Jc+<cL3!QD$dCq6Fd^cVMg
z_2lx0=Qby++IZPc?cBXzW0G|0x1g=xL$6y;=S)x7V0ilYe=)8g;k4$g_Fnb=wFfnX
zqW&&b<oUDm=?b0wdyXyoI)#0OCSSMBwn>+meq9d?tofb)deP$tX<LM>H+^^Z%f08E
z8g9Qv|L3Z+xnechx6(tle0{HIuvTbc$n@f<Iu?C<RX3egKm4cIiniCT_Ig+`^XP^|
zxznCoLfV!sPul;@?BEH{n7xa&4!$*YEchdpk#ytvrYP-8vWLS{p08TpwQt|!;%RyJ
z9&0=aH0Id$EBIUW5rs`o5r&gpJ=o`+DqAA@q_lVQtdnPdyuKS;xFupq#XF5&SN^k_
zDVvWPMEC7|wmEBQ-qQT9?mT`48p{scJn&|Z!0$KGaSry+E-s&t<C5w1Fi@)?`m#vX
zvKubJvyV-`zfN^c?jk)V29Nc*b7no`R+Kxi`qt!a=U5gTNUh9x@zgIdJZEZ=wx;OA
zlf8Nw|J|gvYTsc{z1>?s(P%C6zOFqw_n*C={_RWAdHXYK+-5J;3~##hK9%#A!+Cqf
zwOxzm$+e|?=MRnP;#+iq%XG1mO@HDuhr9Owf1cOPs*F7PbCc3q>BGnE_SBaC`Ss-O
z$JGq{d<RN2ZpE1%EI6WM&e!_dOY`{Z7Z&`Re|P?65=*zTUReL5RU)ycaiM<i^ai8-
zE&5x(ak}Ts-FL<L(=Lv6YZpuK#Ro`kS@L>q-@8!FDvh(tU70Sge)GBUX5U7qGlj~B
z@5nB#GCsUep`+^gZLw3&KU;2jb9Keh;?gU3rnyea*|^4uujZDN?zd0xqOzsUK1n2;
z{qTEzj{1YGe;<k$O>iqrsW+97^gLJNb3dUq$oisR-siZo!m3`?ZYlGmJFB=BTK62A
z{P5!Gi_#SfG+NkiZ|UA~%C%^2;t8)woD*Je?38-9`+4`r4DO7T<|1njwBHud$en+o
zZqdZD9=@X)kqJJ6y6--;pF6Pd^vAP5zbo6VJm{M|Iaa!iKRkqA$!Y5(R)fx5o0-jC
zjvMW=_PQiZZtk0E#>#yx!84uPTT;{`x3#V5dMk(Mp#wJ`e}B09yTYBiBTn*08LxuQ
zA5G&~esj<KJ%9hb+5PzQ1jPh52H~%3`d{1-IHI!ce*WU5;58akXB*eEXg&L0dqFc$
z?MO<TIQxqO$CaJ8F0XLV2s}7Z*I0l}$VBJV{(=YUNfH58jm&};l`6NUG3D|WsntGM
zTE}sXqv55{7OUo@=^ZS#IZdZuRXHyF)gL_J@z!~nleSFbc3d9B$}i12ze||s^zq37
zp$&eP7c2_dLsbfUPO1B-GKMf-ovvOmWzo!pr&$wDY}~w}$Kh(gVzCSF0@^#So9DL7
z4qsH4_iIvDM%?aO7bM=4^h_+wot?{Cs?#9FW^?4uk@fE{ht4!{61Kj-rts$;HPfpX
zoD;vEt$(|To$ax;eKxDEbh72|)B4Y{o}MjWzj`rh`;7gqVHU4XpD|g^nids3%jEPU
z@2^+&9WKsHTlb3fz|;_%_aAK<W_?dlYZWZCef?q5*RAUR-+unQo4N4w&(+o+FFzMA
zxBq)wc=?R3$Oo64&j}q;mTEh4Fp=Ya!AtJLjpioO%<)Wu8w}6Sjj7VUSoy`h{6eDL
zT3yk}x&2id&&rcH78HF?<X=>4crZ~<?OY;%)w-Esx7A;sV1F}DAm#rj?fh*k5AA1;
zw3WG<<2>#6%kJ`mvy$9zTI@Est(K|Z|L4_%F2CoczCNd=c6{`F<acbt#)qD7!j;Z#
z{`yMh249QT&w>iOlE)2s%4hN?eOM>o5+-<%Ywa86?URzNlos|KU;R_{OGJ_x3wzki
z^K+GVD4jE0)vPc@NLfXz)@Q#;(JkhU8YfprzGLCDRXrK^>fgd$$)*CUcbb;%)3d$u
z?y}~-qt}Y=u2}KXEp7IjUCm1jGwMCP+%rT3>Now0iJHE^&PeK-vCY|!Prg5$?C>Y<
zi`3L#;iYvPRr~dShurX~W%WK^byzWL$F_u^$=2;h*-oki)TLLxaqJPEG5z8xr+E&m
zV;dgMZRDPuIWZ)VOK3&-;Y;z`w;i~;{sIHr>OP@V!~AxS+lMz_d6khDy~1<#4Azgq
zE^fssu2+NK>9r|eXf8Zluu^@4WoFsa>>1%}b$3W^JCh`GLnhkM-SnG5yBF`*Ek@Hc
z#l0^)i9COF`?`=$p@7x5HtqY`bl*BIZSI>>L7@tlFLG$yeEv!LT*8df1?u5lzdl`N
zdVI6@leU9MwUwF(tJ2v?uOmMfzFt+ncS`C_rliX^y7X^7+}f+3y{F&$RBz(CXudsy
z`#%+n-bp_*=irU33mQj!54~H<bJ0lF?Xi*nPghgzs}-}H5{qYV_Vir&|Ms!}e<t*;
ze}5rrR)duMIl~JJFUYzJFH`pXp*r)>c7;Rv9p<~YH(GCA!Ss|<S~T*5L1yyG`^~MX
zmn{M>WWH8-tM^Vm{Kj^^*ZCdCo-jqY-zzeef1WA1s7t))i=NtPo|zk>j%;tw`DNV_
zdolX{r>G?#C*ESbs$-hfxrABz?xkaaMj|sFs>Cl4<o{xsy2ioXzg^K;G%xgW?3QhZ
z4-{^AajJH4xK`?2rN^SdQ8Kr596vpjT)fJ4W-wcL(Jh0mKRRc+-K~fUFIhXAzv1S^
za`8p2SN&49x$jzgSg82_ve*KyfVHtjN$QclZ<omDO`aF|HgVOA`;RW1X;WEu^4Qvd
z>Ki_}W|tfJf7^b1F++BC@8XBI5(~7~9kZCF;FlPvrz5dn+G>m3|GiGC34AlAnwi{B
znX>qgC(rr9dVTMy;r@Skr5FoaewMYby<q*L&2d^wvi0J3K0R*2d=1~!4A!<QuQAX0
zKSx3@`aJWT);Ww3)n<1h+v=KA_8fI7?)=UuE2)*?_-8^&Vclu>9l`fQ4?bKs({u6K
zKT2$TtjGO&Cbw+f_ljlRdP~7uw;q0$SUW*t%96fvP0nM2Y;kfd_N*H%SBhQ=G<<&I
zf_T(Ii&J4!7#>`!e4zW*Z>iLWV-s#}vw2c=`N8JxGxu}b-(ECj>I1z1jmVfUNe9&*
zWt~1!Bp6*}F>&SVPbstY@?VLU?w6kQb{k(vLQYjrskU!c_oQRDeHs?*-nqc>+4=I^
z3x7@|PIum=R8~Hz#LwAm$)muiOr14%x};NI<nab>y{dU@$KRWLze=xfdlr8G`kx>#
z^Amzj9jPLhIepi9Z#u)18}O-mQC%nF@9mcNbPU8rn~tt%GknUn^h|xQm!5A{)}ytd
zYy!O;%f8MIu(;7MZAFmZC!KYn7Yl_e4E%o{tzPo;mSpGy&X_abV$Qkr^Sa9#74`Zp
zxLn&6_O!v%DPp>_e|CO^;OpPJj;HO8pZW6L(IS4MFK>@5`XsCnXr*&XTSIiO@1-je
z&l*!Lp2ZaXs#(X;vVWqaWu4aK!2buFe!pBkU#)NL{G_i(C+~mmUBawm$ozt9pTAGm
z4X!Bpj?0@b|NppKT~B~};w4FoPaL<|BwF7IYYJ|!{J8PSnXclKa&7<Zx#bhZ+V;rj
z&+PfLC^c=}Mz(jGLJC^rtM>}{G{xTy+I-f)=xDjT?*k*@?GokbpKj-9R{JPRK2OS$
z?{%NB;KK6>yB=TN_R#+B#j1$nBI)v@hc6h+?g+HrvBTd{*ry`;L8m1TSHrjVugCXR
z9cU5%eurUE@-;ybKQHm1v)j+zxhlpW-J^8wL&KwGlN26l{C(eYc#nm!p&p}%;lr2!
z;}XBxfD=~jIvc*mB{%B0&M_{yk^F%7VFUlGE0Rea3uBlCCd@SZEVHSR@AG^UzdqeN
z2K(;Ic0E7q>|c?1X~MaEhvPC_w0XWoWxlyn9Cgx8e-6jd-OPV-8}I*B&bF*sD&{J!
zb>`EqzSLTV*&cq+Hg-)uWLVm@s#!_o(T&3_pQm%1yL>t|zq7ZZSpM6tUA*V5{vBQ$
zJ#(?Wbe8nbg!eVCG;f$(Y0oNablBO;f3@Z1br;r~p*+Hm7HmtnW0=Aq<mPHxsb00j
z^?-2Y_4}D6-=c1D-V^<4`m7}2;0-y4<uNn2+m)?OK2Vlkdh^DTs4o-FCtjSwcRTab
zY-Ty-sXe?)&6g$xOt(t-_1W^+oM($XPW5Zs=rB(1__QqXURZ!rNLw#!@~Q_Pdya&>
z`OB#KE?`!WSGZi@S<AK!ms;KP{!UsPZn#hQbNLf4xd)~p@$tcF-O)W-KP3;lP7Un!
zzq{bt(L_;+V5eId0Y;O|Sf*|acrfK;I_q4iuF0BBu8N8q3wdW>TCn-o(YBxcLQ@@*
z6f|W`zV5XzK4WfD;?p(d%l3UHc8AVAnjRr=b^q_zs=C}_zR^LeeI?X5RBBakZTNO8
zWHGaX)~*ZDoHwRyNL0*FdGb_b*EvODnd8n2r-=q#y7}nw+R5^r@~>l8%vCv<kiY+c
z>Xpx_4-dKZ1>0==eQxd-`4d`ePCYU@b?dLAuh`B|gS`q~>}hM?6;(W!oxV9Gn)#~h
z!8sZWUcFP=Cd#1Au+ixMt!;~hYF8=!i7FS%S}4i3JbLw^f*VJT+TZcZ@7#8<wN0#a
z<L-hxvrgKl+U=cxeupc|pRV1L+w(mgZrI)HYvJ7aJ50rEa(32>i^moi@>tJ1{c~;L
zwSX6OyUS{)cP`TZS5ve5?K+h@5v_8`o##|%u2ib-^*(&)>;F|hj|Zfvhh_2p=b0Y)
zsZ&B>P0@{zkdwTv^?b8BoxWTYeg5Q>)bs~}@lPUVC?3+_dS554&Z=hhV_GQ7s)WP6
z?$2{y3rggAd_Izquy-!=(y2UqvStc%zCLlnl!u|^n&Z)W(UW@~XZvVh-+5clEW+l9
zLH#yP9+rwXzM<dQ59fs6Z>unP^P{%n-`k77ABSJr^vSKgqDTAS>p8PF+N^z)p&e+m
z_4D)3vpNf}&xx`s)ST2U^uz4Vhc{}+A5@73-1FOIWq6G(_>o;!(AFv@86}I0`wu@X
z@D8dtYn77uvU+p<VTbuynF;&-?p?`P_HFhN_t(y6wv{dqvQd22$?x0Xe*I7U<!fSo
z(}JqK&IGne=G9ylnJ#gvY~}6pX{uArHciX@dSacg?d`Ptv5PDYXXGAKlzi`4bZw=_
zUB_!NtA*kgGfY*QXkM{HB)`6|W&i8jMV7Z3JEPj3J&Z|d%zFQGz0nJ;c`yDyQp`Ul
zu*Fw5jzjbI+)$Y*k&~O$Zm8W9nsZ$3QFB}E0?F-5gpQq?D!C&uWSjUe9+!ei3s3D{
z|LzN8Z}zz~)-%%&O<%<n=@qi=<t0X|SA8YSdb3?v)s7d&%sf8hO!GOXRex@Tx_)0f
zxmi^?SoUSj(|DJLwz~`s)>qGR>KG;WE}i^I+IfM&!e3qt`QaAqYm_)1{7fnGj=$J&
zukfF)1Ix9Xlevz2SoYXmh?`|#>Ng``eg<3C6XV3Z>dTMc@EFf-aw;lX(A(Z#eU@Q+
z*Jo4C7hke%Y*SU5<%Pr5<1g*u$y(u8wLLxGsDStVp#|3$2CFUb`!P+_+$3@R+*cV(
zC&nC`$&#z9oV+Eo`rl1{;}Fx2FIEVtA9$3qqhNc5N!qU?N;B8TEc_T}I(^~vl_$hq
zo0c=*ee`UC;?dt5-*c8eP3%5V_}Vf<O4j=PhZ!2bw60vQoN{nez!mFVQ<=AHd{ZJ_
z5wj<1vY1I@?L|{|m*ZEy)g<q`bbZoxzjNX>OVWDp2k~Z16~85LG%PXwmaV9G`ucNx
z0dALG2HL!c^f>ihAXWPh*OJZ5#~0}cnZC+b-DmZjz1Td9n~zb>ea`NVn-`B(d8o+q
zKi_LB-uM56WR;?!l4wanaq(Gx&u{Bae9r9O#J1|ALV22L{EMsSvJd(;Jy?D{T*In;
z_0-8Lw4yHgPdn<eJg`u8dv4il<tWA~&x<<`1?{VRu<2!ua@K;y8<t;an7C_c29ty2
zv#W_4)-3y7&($F`W$}93c-6g9_ryGp&duHSC1n1g1owWUjSrsIpW-y}pVRy=*CkKl
z=SO+fipL=z+LKoCexH9*Qs#%u#aCrpuN>Ffy7;YZ@0`nbS3Wsr)v#CHc}MY&$-k{n
zCI0Asy5y6&_$l9>?aIG(SBf8Ve%$@DE<1AW!*Iom>mPqOx5m$AYUQe_Wqk`@3$0l5
zTtU}Fk3*OF+UjiIU0M~Zv~#<b9DZ=cWpXNy<DIYDDpxFNHqxq(jul^_ZNa-<>|xM(
z-``h6HGX}ojQFlK_tOOBR}(ge#?0l|r}BNqx3nk^Zm;U5h6Is){-;u>%nLtlanev(
zLHk9`r+GO}4709ypGm2TZJshi`Nx!KPD?MB;61;*&G|Ncv^qG$KI7E8vbL{^W!Fw^
zU7T?Gs)3>Tr3Z`^{YN8@TqwP{)yI(ULqMyY$vNkbPwbc6xfvyrP}3@zntk&1x4OOI
zTKgU~l=khH|HSmZ<j`N<_1p^zc;=`s*t|?sux{d>BMIDM@3d^(XTP0wRImARU`0ul
zS7m)uV1T@ubJMh+%NTmx+!yEf9}ZW4?ym3OFL@!{ZUO7_(8qr=Kip&MYPm2!+s`h~
zja4n3^Ynoe4>vX>yWipLX;kfT%6+6^Ss!s)HeFDHWB=Ax@$f|FTE5<n)q+Q_Zk9@U
z_$>PJ)XLQGPLu9S-(G1RSA4T*X&0x}3;veEtNjm7Yya4!H?7D!eCg_Ic|B9^1kQfT
z^!dgt?WeY!r{<Q1Ukr#d<WQfh6D;B-dVI#4$ThZI*K*c1SRL21u=~60RHqVW^$B*%
zolWAL4|$FHc?74{e7s+{geCm*rT<roI5<Up9{##fxwWL)Yn|@YGhI6;<$73!es*}W
zLw$$qWBHD7GpU(Bq{G*TU6eesEQ~o)dd0=qZxfTuwoSOL9DK<`bJ88P^QWAiD;*Je
z)N8Tj_mR3Dn<rhrT~l^!z21`gz+NoS%xTfe^S3Pgbti@FajRaz##;7C?@aIGC$_6*
z-u#!AadDCS8u>c?Rg3RUpT&A=?_@Xc;EH2*)3z=b-ulPj>B-q_tKM5kHM2MdPUN(V
zKeyY4&;O`p>y?*J+!wW*=YMC-&AbvDJY^Hl;Tt)RRBnCKU{KiYb+RjV=Y+{AyPQ_%
zI<87QSsunH#~~ncIdSdlHB!OWmv0Gfby}8a_b;-Y(I;)K-IBL+w0hX1Z!iX(5Z_!T
zd;DvDQn8>KgIIJ-L}>^|f}Zw0>0CRvyLJ24vfXIPvDClqx4BGbn|)$9^Q}%spOCpP
zr2fwRw{!np|Fyp_-0I`7cD302O~3ZqhMNh;H#!?DY~L*7b<pdtLHXYD4L6xzO9;Ld
z{JQSSo$oe_-!`xAcX1E;IQRCa2U~c{7x{2Zx$jf8Xydn4rQ5bzU%kk_?7D1qMO>^m
z!>3;1O_S>m%ywU{dFJztj&l#W|0`*yi(mD+FpaOj<gpiD7bmOBYBz`O&v|7RkLFCi
z&~t6ml<R@dSB2WHn0$4A-@L`q+$PI+nq(J0`pwzPwnX~o{JY!C+593qqo$l_>^`Ix
zVCA`A_l>1dHe=_Es^UGXQYyF3+bL!8;cTMBk(YOr7Vow#uzvP6>A~a3`He?Y+8!F7
z3u^du>AcPcUomF>32YZj!Y)n|Ec?H!!jgI7&O|mX-kX^lO;0~aRW6K|J$~++tj*7V
zvkPXqW#7nOel*%qrSh}GhP-wgms)m%C^m=R*(T4nl<wzA$acPeZoyUa_bgj?Idd#^
z+BVnbcH$d><F9x5i{7<b*So`S^8NRQZbwh6P0+pi^XvyT&B=w6)TU0~$viJ_p+xx;
z%^ki87bE&khjPB!%PyKMYNmBtKisKO%p>Lc=LypuS*aJ!lV)EQB`PBk80fO+`jeE4
zPHG|#7rdW)_0EFN-4Z3S$7|vuz9p*qPQP!`8m-|_o8NhoS9$Kt5W&n`m%Gj9CRIIp
z@lP;Mt>Q{ToY|r~Vkc9i*QWM~9oc%(;n%*;wdzF^znwd1W;?Iia_V*-Gw&z*9lLtp
z{&2Pa;2?VS!h(%_o1MgqzAf(KaXNNAzUrZ064z&or`mUAb@Nloj#f0A$o)OFQzh-!
zLyJ|Sa=t203-faG)>$6YJ5*7SBjtO=^mfXOP19{IRhs<NJoK7}O(KdRNkwz(^2f6;
zdMwO1@KKhx({4vw-MUSe5@S@QYSwm1PvuC|@N-+fsGMoToRk;ab<BSGWmot%FFSE8
zjYna<W%cFeMOC#C%&+PLlKZdCzGk-J<hF^mu`f?XN#C8Zd3|B=?e#57^YV3@TIW1B
z4_bQl(C*E*l+w1{oOaGR;UwoS!>WV3xVJSq-d}s<;rS9-#w))SWf!;>{ofL%<^0=p
zs>Rap!9ERLmWF$ZHbn^sOkLs7&ax~__oPtNnTMR8N-mXrux*u<xzy47YF6oMJ+aXE
z$qUcA&j|Gl+x*<_=;!(KN*KK!?oB(TJY!1Dw9wqo`xI`xe8pWA+T8N(qoT0??Mn_%
z{L&r?$@zY^*`XA`@jU3_#ChAkq@0LQ5VB40v6yc2ZOS|S(|11J-gmfWa*w-@@R^y?
z?{hY_9Xi2#_S=U{{Y*LiH%C~1xE^P7SbMB6?Z=A9yjSH*KCAppTCo1#6?1vp>k|W1
z<I7UlJ-!pl`ZZtX?$({9j)uM7_U0AK%M4sDww;eJv0kTlKW=WG@#SqX>br~`#4EWs
zgkH{#3#+i-JhT4(!o{Ay#o6BR?5TUWAo)e%`-(e~>*}3TjHlkV`I&xY=7qESrkES;
zP4Bw$&283$*J%&t<jLGjxb>-zXHuimmgwo{IFD>h+7-6%p_Iy3{XVWcfh!M{cHh{$
zW?!EC>}A^TX5U`hc<7Gfu4%K59pC5{bkEMrZI(Q9X8a=6H%)c9Vr4Pe84Xw0TU~gr
zdOL+}PwTTe##5!Eo2BA*6iZuM=U&@g@t>{M!}<NQuC4Au)0c*wzH)YQMW5gOc2}Lp
zo9^CPv*iAPdG<-!#df7z@^5qpEScI>V>B;}r*?8^w#k(?p2hca58URS<0rs>hw;}6
zlO>kN9{&0{MN@I^zHde1pQkL_<Q@G~#etcJIc(v6gS2-uCB2^K-~Q(~zv1NUt830J
z_q!$2p=`WvPU{iJgKhIyH{Q(@`MD_gZOXIwu8(K#E|*QqKBK-)uZXqx?b)9%{<{A7
zdofd&Ehv7;A=S6fCLCTY%P^mL)1KSj(T=50Th=AMJvvu4+vb?Zl?1ut?>_cVna`TL
z;!)|Hw+Xd-OrL1+W&KTjF;)24uaG^8vU5Hi6mTeGnJ79X-}*@5xxLJW=S;UT<WF?-
z6x%XM?}USMasNRRt;v(O?KLV{yjtzzoK>qr!;X0rzgW=YrSxCsTS<lM?^x{&jTa5?
zEbcy3wu+n<YPVjnq__0X-aqG;>KJC8<2bLL_)WS|d_&@;RPI^j{(i^3KDI<xT{8Hl
zD7{6;RNAsW{qVn5Yt`A&6}e|xJ)1xIOq#lh_vSCDuhK`i6z+Qwr|tAwa#6K((5|Xw
zdc2!^pSm7a%Momx+b18g@$RoJ&pbkWWgj+kY8{<yYre<wSo^N&7j9PGh*CE^`Y^$b
z&8azz)5p>-{Q2iSGaj$otFbEkc9}Ux!p#)^O2JgsH3d6Ps|)<*NWLHOka6Yu_&0~u
zoNFqoKP?V;$Gze`my3+lYP+jvx7P|ONOX%lh{_fcePG(T=KQx;(-+u_a@lrIdiW}}
zjonN59#`?dvMn!OE$&u5&Ux)XsIkHe(6snu-R7KGugq`e<sFs(->~=2^379K(_UVP
zn<J$%SGK2_QNxRCz4Y~f-uLa1rJRd+!gUIN{i=y*Zt=|2<eUHbf>$fku?LH5D;?X^
zesTt@s)g=a6~4dCm-$}#4xP}?r#bBvl?4KxJpHL{bI)Fr_hrCMiLT8)GO2|V)juv^
zyChpW-H@U3(Y4tc3vHaV=5h%sq+4&^x6F9{HHUpI%TGRWII}7%P_E|Z)6$@`(<J(A
z{u?E!?7N~Y-na5i@U!iIGv>TG%oT3FIMboz+Ec6Z>w`Tnh_S^5P22FL=H&HDe@#32
z|Nm&Wulu@{f7#hn?6xxEM!zD8s^a-<js&mr{Ayj8l-E@I@z2bNlPfgpuW#ED$M$>u
zq3i0)k3YQm`ug+Z;tx+x?k+yCAnkayR^5bGQqD_Towi<H{QbU6@?HCXiZ=GYKh%}v
ztjq5!*=c2&F{8pL!HPqYQEbzeaP`NI@vA(-?W{GwDm~hL%;aRFIPVm*XRn3qwG<EE
zdcv8l6Bp3@UMcs^hHYyXuI>}G=R4_lM51)N-Q7dW6mkTf&vLq*s&uc{WcFnFwJU4;
zZ{IIzuzRU#!4j=zoXDRqRQ}{m0sE2It(s4}KT52TUv>8J7Us-yZ)s(g_A4KSe%$Cx
zxOU;(a)0xudwzc^<GNcRa%4xPxb5Se;euCRTw32QzvW2CU190Vv%Ji&2JonF=G|U%
zZ*$^|Pf?-0Q)lkjTByF}jrfay+afCB{JM^oF|qHw_qSYy|JVk}^+Hh}uY2t|{`5uK
zh0bn8$>P(c<zHU)*1z6*W46AVvi$L`<=wAzeRZv!{OaCp`}uah()afXAAEe7q~a(2
z^9dKf@;*6$&+CGCp3s>^++7@P#xGu#m`pZ`;(vL8QTuS<%5K-b{U4XluZwEf_U4G@
z8Rd|l{3aXc?RI^;jY)aKCkd;b>t-A_tq-CtbuWI{l*bo$L|6XhS*x1O=d`V)t`;xd
zSh(M?qsFecKe+tn!jEZM*OzZvvt{F4H}1N8`2+Fc2?jZ`!X^3H$yaB4+eEqDi<Ujp
zmT91pp<jRZ%A$KGcYQi|<lm#vZ|`nx53X-W*<yaw`1H9(-USzaJip5qwSw!Bq>tfb
zWryBVSK_AKdt_a3-|ifj!x=xmPiexXC#OBNSm3!W^oZ1l?-R3EKAY#iTrFjyo7dYN
z25O4Uy(KyC^|HNFFLliC;p#6hFJLrt2yFUN9no(VC-l-vQ2x>GoH)sqeoYLDjyuc(
z*0&zA7wa~WUc0$di?Qjj^XZu#{o7w{ee`V0n@7v;UE*5tCacfx@t#_ht;Zf+yI9mN
z8$ADBvBvi7XUl&*Nfw{;y1x14H`Q2Ck4K_wRkaSU+}-769a$RR5zl&D=TT1C%^PcL
z&Kzu3Wq*F~(kinz*DcpJuUnflzueGty-<9$i^oq*@o%kfqZI!a&lGv{aE815();c|
zIX`bnoDs~zJn8NKV6hnm%B!aB<9t-6_Vb$ZHAaK;(mfx(KGW8o8j$1naoK|$ac1j|
z^Rqr*=?M0k{+#y^+rgWYivGzR>#I&JtLj<(;OhRnIZWA(x%C|JORb~l?_FK{s4}Eo
zbHbxqRny+kSbs(?-KdPOFRMx>FSgQOaBSbV*Nc_8co(Wq4J**~c2Ao2T>ht8K<J!=
zvkB*<532|F_2i^|Td8vH#p6v@YwSNtvXyrx<s0s>cz&5#^?kNMsDsSv;uN+%!Azgo
zjS*=sJYJt4#uhkiyWeVd&g#TgKlhS#T75;vtZO`-pXMC<(_;SpMEcW^uP1Ir-PC@#
z{O}<YSIw&JGK_0IQ;%=m@$Q6IN=x8vu0u0RctldVCGM`j$FoW@us^9-Bkt$Ks}m1?
zJhl3HsPdnAvRylLxsK`X(0d$jtho4SM_G=Xl?3DbgsM$?b7ocCT-z~uPvUc#_MQu?
zuP=AMKj*d$pMqnw=A&5dL!G5RZi%J;n8Up`<P)cD<#yj`H&kSkD}NQ3WDC08esJr|
z)s{vh*4(3oCl@h@xXVqkycfhgi8*jiaM<#_Y)xm6xc6S^iB9QRd3XQPnA`ljZ=C)4
zy<5L$_NG%d_rA{jk^lT@;qoQjQcruom*n}xF|R(feao6j9n9a>o>;K>^7MjV@j+k3
zDkIhYsczo#@6$Wq)V&7}Uzi%z^s-1bN+Z*1$?8Ur3p3kNcXTiw@o{aM6gj6c$!}x7
zTQl=b<tv?Y`akTgO)Wn9_uX|C(`jb?hh7|ccjm?xSEk7sv9E;mA20DtXgaiXj)=sn
zlut9Z#JpP;<Y1|k?^`Eo|9SFGvEv*YzgpZEH&u2&lW{M+X-nGdUGDQ%9v71DSG6b;
zm(<;1^WoXO@7`Wnp1hmht=hJ`rd#po{7YNaOODUl_0{qAx04n<EBSbi)L-86n16ps
z(S!aY3%{?{m7ciI_|)FqPZRnkyx0<aPBKrZq2IiA%fHu#`3shNT{ybw|0>Pz8lT@f
z3af6cTob)yjV1rBvo>?hdrM=yZz+XuwY;;_RQPzEhv24*JI(}uS(rF6?%^|mH+zm;
zirsx`9@GABhqjbHYy9@mD(Bpkb+04;{yZEmv31sDo>S8L7190g7e9D;zWDyUrHis-
z9$!2jJ<o1^-0Bn3bGIxxb$HW^96N^(3scs<6pj9$aXWvFtks<3n{zYMFK$Y4<u}$&
zY*RHdSjBSuq|906OZI1e7$|SP{d3xhvsEY7)ICYjX6RdDGW+(t>brumyE;nP{%gL8
zRu0&ov|K}6CMwE)q1+z(`u5N7=gecjr*LtT+w(VH7iMdmF=yKTBYmp(EmQ9KK1cn%
z%1@uUC~S3FmdR=FKmTWbYWp5+b*i1aAZzjr#@6X3FB>O*bc<eVwJGp@+2P}6adFi@
z=X%v`JDK=G@?THntiHdi_LQ2)nn|XwoW9UX>3~N0vR3776|=+Dr*R$6FkxS}BVgro
z!{sK-#kzmz@74VsTmGZ)orztRj_@m+F1frL{5ws{_jUMw-el)^Pp<Bwl!@=c={M%f
z{CKhW%J#g4ikH7X|G@NnZppg*u;zq&UrN?C2B`HNUUruGw$&O*yKg3c*IllWS-SAl
z*=vV|UO(PDp{XQ<pJhgv>a`;UmNRB(KXTh_GqWUry|vTICW-uF^H}r9*KG<t+;ugT
zQ`W9qH$~(@jp&l<SBq@ke>5vOWi42EFLUnlrW^BvJ2RbTN(y-2C|0f6YWl3$ew}6G
zg_3h>c2kV!Z`^lEl|S`IU$k`wqi3?I!H?s8agUe%xN_yWzH{Z|<>s%HVs)>HUX40^
zu-N}sa=Y{PC05?+Htl%yEhxDA(iNka<?HIIUramNdExQ`b_G?DZyhP+tXD1d&g*J8
zH(76UpYiqinrR;y)f5CR|E&3Sn)9n}@J{7#J}hO=ZY$-LvuUkqogyywT&7M!Uwr9m
z_NBX%XXJG%dD|{;@ZPspFeK{JhbM2pr{9;I-@Za$cK`C;S+c*KP1og_oc4U{wK?Mu
zr>9Shcg%q&8WrcuwV4HOtvS16-Q?wYM?~JJcegBBdsCn<IA_l4JMY$&hi`r0P}s9}
z%No6DTdf5p7J2Pnbe+43P2>J46IrVZUw-n3n0)AQXx-jWq%!U9p`=Tt4m+-J$%HZV
z#4hm(bzu(E^4pjit@JG5I>!o+jOiz@a2(V>vvucI8|J*=n7RYPDGQDsV%)x>@8`=7
zS%&@J>yeJ82kn2;5IbYdC&$3>Witcr(}<G`3P3yGY+o1O-ZuIE-|z>M_^0Rz<yx-0
zyd$*!xklcrm6I!y)P2ui&CuZ5bR%F%-;$iwa{u3N-(4Y~urhp}uhLnSXUq{g4M+EF
zh`E!VzTE%5nLpEfcg=h`{)#EAha1${-xNIhseJEFY5BHyoBeENsvdl*k-Xb_?OnA$
z-#g~^TU4LBY>~uVcl2<DQQIk<$M-6-vu7MhzV@1T`Aw6Dd*!%~O}02WL)^9SS*oMV
z(&*?<Gx-->{aPUPGg78~WtG74cSlaUy)v8a+w@{mrKa`t+#TzhWc^w09C}<R5x*)u
z`G^_MuUE2(^(BvsSKUeoxAA<q==t%-ozn}hvfN`++!OpYE1IWn`o%5fvI={)IPxER
zIW^z@<%wC>V$+ZOEkFO5F+b;OD7Wn^%WZE{BZa;!m%P5V^xnR=e}DaQU0z;M_wUt@
zldnH7-puw|MBdZm@dLGvpzE`JoYpbOJnD6NYALpX`*-38Kk;{S4)kipXgpUp-z5<f
zKK&F^=(9gNcC}3JG0i#|(Jy%K$3pSgu<N_HF0B+_cC$p_NEOrhdnKQK$*z(K3va&}
zv~`~A<vl{@lzcu&wEer~t)#Gi-t?GdpN^&^*=}`Y3q0n``b8q2VUuMI@5e8^iFIx>
z^d(}C#PPrXQ}`g!erDDqi$%L%O`7a&E4uvrvooyn%j<-EjN~#qetEL4?5Uh~<ho7e
z^k>-~wkz`%#3a|e{q4YHTQOTT*zv38`6nA5N88Q(F?D@oCeO{C)&HKq3|#;DcHr~x
zkHydPW#pa|eRrHwzGCL`jkD9@?4RuaEGfTdN$5Y551T*VY%z~G>MVSv!M}p#&jtQZ
zOMise&Yr1SS@QJwMS}~Qzsp#p3w(T>At8Q>)l)`rc1ZJFdn4~Q$1i+8dVj5+J>T`7
z#RvZvD<k(ExxvCTH;||2?jskI<^Fr7Y%WV&`Ptwpd-3UGfA{a4pPT!Y&)=^q{ki}7
z2RB<E+gE(};lBLfhot9ju{Kl0*UsGa!##G(m80`^RjBBf*_LixtS2((Zte1HlRpem
za#kB`@-OEUT(o*|&oW0so#$PIfMM*0h~qmiNyKD|tTW*Y-<7+E%l5&6nJy0ZO15v?
z##VDeX@SS1uQgXD2Q5G5&fdVVrb6X1^MZ?$70&8C@Z5fG*8UCRg(~dg95ebOcAu4D
zI4t{7pguzIr<p*+*-XC0J5Ekb@tSKT`gq|A-o1NDgPhLoJgvB3MX~DcRlI_A!jdYd
zpI%pBdtyAzPu)drdrisl678HPuFMN|cu%*KTK2X0U(fQKH)n5bZJ%V9wn0x&e#fuV
zjT1jEOZ+zdF;kLrM04Wr@CVoT?Ayw^M%Op;`InHuu(ipXJxfEy=N@#tR<z;y;yo&i
zk=~USIR+6dbKGXPiT!)#JVA9cGxztFW;UVFlL6l+rJJ&ZD*EVusNB9zvD470uW*V=
zVNk{)?x45}stG^h-QO?zVU^^y>A7vv_dLOWcWq~cHMN|ndlmc0s@UO)MRb)&)d9BV
zHP<KGvLEAIoH#L@c>?n;kIjdISDyA*)$;YCH21QCgyMEK?o0FLAJGiRl@D3(R{4tg
zK{ERp!yU7N1HC?I9dY^)qQ9p=r|oIU!ulNoT3Y<e6K`DBkXG1WyeZ07{@d?25*jUx
zb`Kl&zWL9)<S5I;UI+6phgzzeB?HqZm^QppR-at1Gf&N6TDZ;C10o-HPHkR$Je+@}
z=`3EUxm|Kk7pu2#U#llowBpvI^NV&p+py*A>^UZDr>2xU23`Mu;Y5Rs+)-xV2!}s=
z9VhrX<zEYa68`z{mOV?Ja1~kc%Sp6!eqFqS-NwA5X42V3o@??hByyf<z1))&$o-&n
zHA9ok>xUQiu!pS3a`v^A=$o0KSQNGX@e|n++lktT1x`6UZnG)l>XELu%XquRqx0G?
zhqU)w{{0kQ(R@Irc}1Bhd$ZN<&=YU}9C`PzYmU;nj^5kGf^QnX@MUw^bDJi7U8Ew)
zBFA{jVngJS<$3)JlfDTpk#oMVX2A!?lN>Ycw|$Q+ws?5b!sGITuEVRi9={f8jThcJ
zS0b)qpO-SzpLny=>)adpnYd0B&R@QA`Wc=IjitxqOp+bEdp>x_mc3GqeBke_&za6U
ztuc@@dxv?GD9>Dv^v88FU7HxLHn65C`6+1Ry|H4rG_T1)%5k^CVTP;O`O}&NxDH*>
z?forc6}o!&XSQsg=1&Znr(W#y3{m~_grR>+LYBctr+Yp^c074U&Nf};`y8uqknQ*T
zR?)moM_z08J}zbHdDtYeMwjc{T|OVVR|mz#kG^~#mAacdV#~joT^o<CR#i~HK1r50
zVA9Q>B0d+nCmE~c>J+{1h?HZRU6!B}x!kjDrG!^(o`nBm#tC*t&lw%UKS$1+I&s3g
zM}B9SbXU9Hjkde-_RptUhMAAAo8=cR<4bn9yXH#jxyhR0f8!0Rn%oa|eU3QRxUqpR
z`_TE{4XdxF6_=F<UVi^fO6(4w?D3tVhbyNiGw9gPVKV>ma~j*fcjAAuW+|=SAu3$>
zJ-E-UF*!=-GoRGTCo_vKF5BvJ=4tiWGfkc+rs`k$b&{Q75o@E?Q3t!7pAM~D*r8-Q
z`$-Mo)<*fJJ5M=3njX!SIHS|?ktagbFGM(D>-~S7YzIQ5n|?I^eEdSecy{r^s7Xst
zd^+HDV3t?slwKu%mpzWJA8Ka)z8tdQiebicNB^ypuDv?azxlO<+jZurrlu3~cNV`=
z`SX97<DrQcAHB$4BR%QsY+2I>2mNPEu#8jYU)q&&d$L5wK~t?ayL#dmhBI-_;%#cw
z(T@_{5D>%AU}&l4sFCX69iX&KQ2sdQc0msZ6~?0%S4{mN=HQf|pm8qYXT?hXGbs*1
zDYHJvm<O0uCn(QZtkfVPqaf_Ge%bwIubbyTyqSK>@9*+CRfXGhZmrdn5c?PxVSHCq
zXm{+B8+p&4e!l#8@?xu9j_ThQwH}<cBWW#1=+d)gd|up*Z;mj&_rK^B@{0TOh4+(|
zzPWbj(L08-XYBjW&8gz-JJ_FdZJ{lv{Iyrz(?3hAUJiP-{Z{sywv$`jdp3rh5C3S;
z!M1nb#wl-8ZH`ac<Nq)B$}(pCkX7~tt2;k9_^Wxo`I+*o&sHGFdBTPti{Afy@6*fv
z*Ene|*L3Ev6YtacW?a&IY4lg+#HI<m--Jg@dGY&`(tUx$-&@7SEv$F46$UE5mtZ-p
z=s#hVYFmdh7qfxd+8nD!yTbf4et!3C%o`ccMF@$%{;I*YH}`<C-kFdY%MPU9Go2;9
zS!Qjr1E(0fgucv^ZpK&dGrNw7sxLhHli{J=>ym&^93clEO^PkMz;Sv5gVxRj4n}qp
z1=bf)2VLi$;V_m7mhs;k_SW>r>xU;#PCk6@{fn+$TVJ^Bn#H#z{#0GHr0>=0T{_bR
zic1&ljR^hvz2t8Z=fe=I3+L9a`qlsG*HWQFqNNLDlSRKCtuBnzQrwfisc!$Se~0(f
zt!ydSb@EqT>EFM5_C-EAH^pskX48?*uG&LaZ!zY{yE{Z(;%?OmyXfWoYqMuJyOLIy
z)1!rqJAWpm{%x)fi+p=X@w#PE&xAEf&x8J)ti4_FT=lVm^ovDL_T;xcyn5rMl#ob9
zz$ey8ffpvYW|>9rUjJuq%la>EUggZ5+P(*G<|I|fd{}-aYo~$SinQX8f)J)73)JFG
zb7H3KcyTRvjgDWJlb5-mNNei`NAIjY)`f9tPld`?NA!J{sh7A_GwW@(s>4ntPIpz7
zcXOHoSMOPKOY*^)@;B0YS0z-vZ*Te`vLt51p2x;I&B~2#x|PlgLip!hmvJ~Y!I9(q
zTtBu2Ue|N_m|OX;@Gbc*mGM<)a>msYg_lm;y;PdK_Q`^$6Oy>2PbJ=BRxo(1?l|A(
z<JL*>a?9En?(8mqulezP%-tT(x7^Kk0;-#m?o4KRRsZ2Y>!F_yw66Dm+T9Sco6Es+
zs?sE#pu-Alg(ff7nZ1Pl_HBiYf65Iz7A8u>FJ83yZLWRJ+y5Vuv&-GZ#o45UmQD%p
zQ#*X8ZuQIQ8~kJsEvnmiS#>W{SmcCbzpH=mEE8Q~`{w!C-dV@EyeGV4h<g9z2dCa5
zbNBV<`r`L(kiH;LsJ_(q^~?*Wr3EB98g(Sq1JW9uoZLR#DRghsm=kyS!ezPHryj2V
za`lNwLzD3ISqwfso>k8h3-+*tOmm#D<Y$(xim#k!xy+x(owWs*PP85tD7kJRa!jpp
z+17gsqLRI4*XFZ5bXX~*Iiq$F%Z4A?SKcis-E(5L^^6M67s^*QA3pJB&aI?Ns-68y
zSlx;gZ1!&|w__FAu<t_r1?AKkM`m4Mo%`=#B+Dz#g?y`~1Q<S<z!5FB!nkqYLMO9F
zTdEeteD^4Pe3*ef*DpZJvsf|w$d;+@QTu<g*<Sb<;M>mVo%k?SIiTy3W(>2?hH1)~
zR@|;#N1mAZ>Gi!<z0>qk;9>IZ<8A)Mp`Hxx{YsIaoR?P?Sx<;gQ}N6^8*$G-CtCUP
zt;RsVJuGjMmft(;9&ELrQEp1n)7YwoGgcJ!J=gX+l^?1va3=o8Dw!hgb85!vt2Z!l
z-ir}yU43oJ?M0;_-&ikgmijYQuc<rlZqAlV>y!AdFiWlYAf|A~GWPU=x}RU3GG1a5
zXkdR*KQn*9-}H?fEQ`~nxVAcF-0opNvPOG{$+`bLqUp(+i_2#yYhKbS4Rl*I*R)H_
zVB2-BNsAMY3!9u-YoY2~^&#i`!la%P|LQWgm)(^uKYsH5d+~erLhtwQeyjCDTd3yX
z?@p-`tsnj^(*L^nZJFfeuluS)vR-Fy4DQ*siEDST_FKo9S3+F^`$FTQKG}1vxya|X
z{3rX1QyTrV>sbU(Oh~ve=ZEt0><@+!_tNG@v->XSez(ZaGUMq~shEi5?W@{u@c(F@
zV|wn9n7rOv|G9HMG>WG-?q`u|KRB<^hHddvhlUgKCGYK)P0I<2<eX*8?ZkRbRp*c3
zth>q&e|S~IEltZhbs@uE?1b*uW#=zm`gvld{#tJ~56c^kKE~U-oNw&s7F^F*tgb#i
z$Lmi&li?**Va<Sm(AU|$7la=a-|4o?>6xU%9VWSSF^6W`UMqY1I6I9OzkV~-D(WZA
zYF+*1`I|p2ft8<@>Aj!S5qYxv=@R~9no+y$PAVovsV?`F<5`-#;F-J4%M}{hUpx<=
zv6O#d)_Ni&YRbB2Uk~+cXQ{ZUp73DZ;hvWHEB@K(zFmL+(!PsA(;9ysIboC_A>MuF
z{UkBTC8zA8CMQT;-Bx}#NRQihw?v4B^|Wg_TQq-d_Pr8&$so{UmqNgL$ICtI3%yyA
z&z~{>_eLo08W;2CDaDW0pRp~y`ZN2Lf#;r^UD{sF+WgykV&W15AD*{7{8w9F(qO`M
zpV^!lyqvpVUOF5ZweP`)^p+s;sQHf-53+B&5qzy%@}mMf=ahq5oEG<I=^g!WGkQUG
zMbCx)8`q9>-k4Mw)4a$m)p6&4t>Y|ODOZeyPOndLR+hfPtNzT1B{1UEq|k*uS8sHk
zI2I~>(sIkq(^)4z?|yAE|J%HU$Dh5ueed#O_4V_&MnB6_|94{DciS&J_>z|0u?~^&
zDY@^gFOl2fznCQ?Wm4{CjVB4Fo}0PN6E1WsKJqBoY}oyH(fn}BootS;f>~yE&r3G<
z)7!o|_bGE`m9K%HzHt5>mw>a5!n0@i%rcQW8y38dQ=?sf){e@XJeSlWTFxpQo|q$~
zw8(6)=&8@&`1_;#zipQnn@}Z~9`mNbsox;zklY%!*S7UPzj*MmRmBue(a7kOwX-a{
zY1r3&W1r*n*o&5XB7_$F{JuE&p^Tp2f;p4!^TpfRRu%qvB&m3HU7b!rY1mSug_mcD
zv>p5UE2Qn<HleVIcRN-T*90V(m$lsb{dpF@sP^~LACuizy<t#Z6!73==)~hv6Qa-0
zd)m5q_0z^sR{683nR<0+f;VeVX*H{rKYSr>tM{T6d^0DgWwIttWt_M)m-*z}jhTgd
z`dkm&m=;)eZrC%?+2gvCtHZTJl_6VKe_*`)_9eID-D%b@HFL#SFWx^@&TUpLq->&{
z<kGq&sY1J8h36sFY>6krT8mz<Fx$3#=D~+IZ(dwoeBsJDnZwL^`Zk}>UhF=suI`?;
zHBa+YgNIwxHxUnCUi}XnLw%Y#vldS7U-We8<=S@-!b-%Kxaw^=?a2B5{G&5z*OT)1
z%gviBZNa%G?9k(O(T^Iwa=cDgy(a8Cd^n|M60euskw?r=)p!EtZ~PWi?D1u0q+r0$
z$D7?w#_znq{?p*Qqt<)vj+%`py9B=()jiK;XO0V*!}d06MS}@XUBX)ToMQ(AJd!!N
zOq)%P#qx2zc(MGli{3J=@aK<@U%IMkJ-c2twQSpmw^#nm>q;~+TVZZ@#s9VQ)Lo75
zcARz7y8HEK%Cnjq$M+iX#Jwn1Q4rkaAdo8gcDBArOw7Y;kILlj%A)(bwf9JAe>}Rj
z?~w6?KTFS=ENROAR%|)J^zE9Dz0Qqtw?4ghI{x|Cztx-mn>?JcD*N2Cze3r1HTltZ
z#GN9vIKG$5wJ-#RT*%*Nz3l7Sw|7K57yMwHsI~p(=AT{PbFMuMk1wfa7byA}Diil{
zeYJo3y4liJKO*<s6wl6aD_K3~u5|kA1=EiEE~@x@=HAuwPwTX#TV}{62WoUqwOzc%
zpvM2!0X3c@L25jwZm=}g7_~0iCKmH8f%UTYzl?&?kUGBoX6o*Ke;+gIKe@T`x_#fQ
zEonL5)wrH{XZmROTu|eBHoLb;)A7fH4v8<Tww_4--N}@=p>eONbcDeFPdj;<-)o*Z
zx<$==qwcDe^=o%-P0Bfa%53UWPYvma?k3ifP({6KeX=veUoCq0Y)$ps7t@(e<~$NM
z`^Y)_M~iQbQ>y#ES3g+xglZ=~>aV(dWm3KH$CcB*h;;JXd=BCBp47^_uuQl^WSQXR
zkck&{7PCHxQj;zF9e2uba_^s-E%Sb#FqpgQp|bI&)phUnHs+sQp6ZjUxpSUMoA?1v
zruW+~`{ldNQh1=mq_Sw&-it@>=Paw^-=cKcbhe^%7}N9jb8B;KUWvKhJQ6tb?&snh
zmD%UyuQUWH|NK15PqMuH_}!I7vp9C}t0cU&ycD@KdhOTQS%JY{w*Hy)$lm$o-B5wk
zvJsoVevI7Ox|PvBhVw&p!k+Cy59)jFJ}Hg<kvLVXZ0}db_v=|Ij$g6cKg*%>EZ>3f
zXQuy)-o-8YKGn(Q-RdXNQ|4};va(Yss`Vd7+oFTNrsPdmk4gV56x4e%b`M+VMF)#C
z-||%Lbi>`xbYug~c<PKfne9(7FsVgd`KeI5VQ-A?1B1o=rxxq6n%tB6S$0-rced)K
zt;H{-yxixBlo$Hl@t?vczWL=zy-D?sJvCeF8(*wbELM8eH&uqKmF2{>1*^8*GxmMQ
zu68_jT5l<5<|>t>9kK0#|31BDm}old(u!0|-CF0o((ok}zYU)6V)*p8#%`5Yn5*aI
zLfd7fVYREyf6rZ9o9z~MRpxwm^R;si;^v*?yK-XLj?+s&Zu+q7b-Pi(ae33@Gt~c2
zT0URxj3)~_FVp)?EC2kT(Pdn@UFBIuC5uQ|LhX*#u5N4juXjz16592ZHEDxmlVa1G
zQjt3%LXF)nCBZ%p$Bu6~sWVB*c&b{(^Mx~aP2U%ETx%zvJpawY<%^5IJhJupsBLrF
zKkeD<CMM659lQ?H6YqRCIIdsk!{XE^bT%-1#r#B}og%&3KKHdYZSTr|yz$Iq`Qqsg
z7Zn#c+ZPq>J99eVP(+~DlY6y0)}?-TPQBuKP|5U>@0+(h-isHUV&0?1^n10!hHa{U
zR&ZrW-rhQwx&Q99pd8)LyEesYZQM9{zp{0uu;%xzxBe8pJ>|NG(@5!NtJwK-hl7??
z%qmh`$5-+uX=jU2sMcf4DVw<NMwVZdpD2+L;L>EaSL)2an&Qka0<0#XvWgLTdp=1x
z-aK)fuRcoh|9XvIEB{pTL~_pvO!%6^>9(qpcUg&APF!W>ru-_kON_}?H#omHCq7u+
zb9P37B_~@&R;G*kldj|`Uo<CFvVAa@o%&?K_dg%5M9ECr65%_?%*8BrpTU*DS-)ym
zhgR)Q-*Z=cZ*9t++K?LWbm<e@cUvFb{>j8I_R+kGg7Z4dFHT-(C~e<6uWEOA&F>R6
zzgK(+TcCdb){n>+Cxux5X!Z8@yKVUHIw@N++x=i!$*J=vENpVmuCOXS)7`!N_7$1M
zk;@I+jpJoX&K6JM+3Yc=aQW{J*_ec!m(EdIeIb8e#5d%GT<u*o>;JXz(CeN4@!Nh(
zD}Tl>*slF3mb>w#_L-fPVSo2~RZo5WS35MiG}7kr&L&H}h^Nz-RQo%^y0aQ*ZK?et
ztrPHg#iN3EoR_DT&aS(>D)x?vR+vNRwEi&8CGk6=#53z|pN}&=yYY<wLlypwvzVi+
zcdnS`Ql_JSZJsn!&Le}8Z67lX1fFjXcz#avySaN-p#P_!vr{K=*PXc>eScqVwSrmj
z$B2*#T>q@+3K{p_l<1#1Aum6o`?8{3Nt2fHFK)vxSHI+RT~_f<Um4YR{^$<r<)U-u
zZHsD`V7Y!PI`q1z>BROKUB<58IPO}z$j$iR`Qm5EKhM>!YKoTLAIr{*3Y`C1(Q?p2
zz+H2}{*XBv8b7=^QF3Zk<sHk5nZ}nVE<eYxh3~>olOB&J-)v57zp*&t{S;#xMK_rW
z{cW~O?{B;Mi}UZcxVGiBlNOf=bnjeJtfA?>>ZP05a=E4tzF$}7{Jd%S>9hJ&Ki`Vl
z=<14FTMOsd^iH}}!+S>9H>>gVUAE6{k{8a+-h6lNHU9PTv+fm`2px4)c+?`SFLbW@
zfY>gz%d;*moWQH4;a_!7IpjpFo?*%L#B;~E)}@Kv*d3jE`^ARM*42%dE!&LFIDXiX
z(6B1F&^XHHq>|^G6FY_Ows}5sw%PksJ=^X}%nHj07DKkkJ7QrMFPz@9L3dAZ80%Nx
z;}Tb%_dI8=KPxNo{qzi}zM1?{PgIw$Whl)#XY!QQgZZ5L4^Q4^%a&4ghX-|Hj7PSb
zKYMI9flKzQdZ$3Ra1`TaCIcpy`7=7KW<@?UHcZT!bi{mfO<>lg&GyohHgkVzFo<nk
zdg<Dmk2CyvHJqj{jFu`6RX2TYvgK{|_P|=DXEFk(>~vQ;JS{$xGjH+k@TVyo?ufeb
z-HCYBpCJ$*qqs;`^z?b@({XWpt+Ag@`4&z)IOAi^y@hvX%N8ZK-<k7EsVzxjt#QZv
zGgsKwERg!8btd_*O5Jhg1swH4e!+j#5ARjo%&zskLdmFLmYo6DmrY@Fjm<m$UTMv2
z_;>7Z58tfEfyJ}(nqMje73QnY@w@Zs=QsPh;O*b$uWpFnKGAOW+P|{QpETErS`~<>
zYMY#IUHD?7&dfAr3E|F+X1*J(g?taTW}lk8^mhS|`J-=l?*83-_mX;aNW`4T_1}Jb
z_ZR%H`d$B*Ir+<+ckVZjZA;oURoS8Y!0MzIUu#cl%?LRdutm7oT|a!&wHZ@_<FsO8
z>YBF%Y<6C^G<|L2PR89|U02vv<zI<;@ipkpx>K6GOUgG#$8X<z_o^GSu~LS9=5`%r
zjSH*a6s)#lGXB1<_EXO+c~|SpzpYohez7krFS~Ph@7=J>-?xJv${2A@S;oDLVdI)f
zR?GcbuRdqA;x1X!#AFozbH;Ml0CV1Dt8N@RC3WD{k?+N-Ytv7zS+n7R=kt{NY!@5u
zPdO94dBq2}P3AY2EBE}H`@2*_^5C=2jQlSjx?a!?+HNr8tn>Rr{MWKY<~&`+n|dne
z*Tb5xX^T&uxtgN4D?X}Q)8~tm>$Bn$A;!w*Y8)p$KX@_b{-n00rl0N!9q4M@dhO~b
zSC^??N5ynko_+OmSJ?SOlK-Y;zufoX=0aXY<MqvgjZ4lit@iKC6Zz5Wzn#VYSC#Sc
zXWE~C>#4Ps&N*0V;cEHrUX_Xd5~mZ7ZBADz9{j16@jrR<qWX64Lo;sae~a9rH79@S
zx|9bsulAfzyS8^z<B!rei>3C)SpHdm_gbO-=kh1Bd><TG8&-Ju%8LHPI`3EYHyuni
zPwiJXKQ%E=)_&*4HQIabZwUTXoBig>oZDV?RrB{wNo-w{ywT;bXJ+8Ck2dN1ye}EK
z7D~h)`@$&jsl`lhtC#xo<0)a?;bHux=Sr&rkCe~yT^7b?{?Vm=*B+Ti7c#r7-tPEc
z{@ZMQy?J`UKDT+w5$ASJ4SQWPIn?{#KGU*dJNv+(ne+bJwlA(Zc-ZEH_0IPm)1zNj
z^ewZSz1To6H8-a=^UKYM)gjx;%FD{Q&a6N3>D}h=M|aE%-^Ix5{La>w?AZL=rn2Fq
zN~d9@y3G=gtBrjtIA{G!-8cVWK2yoU8Sipk4qoJVyS`z<njQIJHRm>~?0a_7+W73v
zhpV5PK0eB{O>Z&By2e1&$Lkd*BpiMvew=SgTCL(~_ir<OG}S%%cP`j?jcdKnTTlK;
zGq)|>a!VyJberS+6w$a7=i~leHS+XUx_;t>enk4o;Gc85xvkc2v)g{4#&J`_dfDFJ
zH3kowgKLU!Mb19{@#OP!e|9Doao64FnC!gjR>98q(@$?~?fUp1?PBE>KTfi~WMyEu
zF2ukfh4b|5V!eXOqtK(S-^CwP)W}%8ZCV<K8OMnY=X`H3@D$f^+<4G{WtLTRj!KZi
z${Y7C{NJbiHR+_jZ;Z$cdls|G?;qYh+-s=*<lVQk@r$z$I!Z~z9#vR7gZqMF<y_-=
z2VUq{yq!B?<EiUWIzry({Nm^KemH;ri5+7Rvzw>TVdW)S=L2R&Bt)(^zpkYmXriC9
zP_e7yMA1^+#2~HHYXUBPsk%DL$nji`k;<|ePooMAmfhR5VUzdSPtU$vi5EG}Q2c&X
z&~bt#caY)g{vA{LowQ%(?2IWqaW`>mj@A?AjNtBnmF2&~mK1ECHf?Q|!@5l};^sk*
zvliYuf5gi}m?OC9YS4aT<sVz)cNuLx)jQeM{rMBS9shrSGm_fBU#5P?uOE7E1pkDD
z9i7nZ@@QwnvkT^5Z|&0M{4`P9QoK9r4cmGTj~$bWx2lF0Z)l&k?TJ~n=mU#D3BkQ`
z<`bRRj6e48-_r52mGk0E^QPOK8>>3*uW$W$e|d0`<G-&De%qP&&zxYQGWq3)4HsSp
zGj%U#iL+$1T6Lyv`j_lO>Bl+#m-K9~bo$}VKhtlfValBrzyAdeyt60BwAk{`GTNze
zgXsg4hWVD5p2R*$jU^ibub59b*Ul0);Zbhu+i2-Y?mT6C?o9Z>Jy%;cHC3eLZo!Sm
z4F?WzbLO@x$_mALyyQAj`=R~3-LzlL7k2b}9a6|i@R_)Har1(WLi*dbZ8Th+eDT73
ziyI0Hq8%&c4o#2udSCy!B`rZ%)VxIJfZIj`iO$z6o~=0_Y^<<2e(rba%O(jAC$;o-
zdd@f(J;jP=n%>P@KXN{tsroCn+}c9;*W!?sQ5sfnm8QBrv1VFz=vnJs1;yG)sSotO
zORiA9!mn8wnf2E2+wF;89q*`S^p@B3d|#}3d6MM%9lnlwKMW(HZ~2<Wxrb_J?C#l}
zxY|PA&0g_+VPNLL$XV-73Ux$yELBwdF+1eM5k>ZvJ<rw!PE0+tX7UrB#dTpf#BRha
z5lfcIZ|_+*C+eZrPRT`m4><J{_Nlm~I(%wBy5g14idNm$lRH{l7EMZ0|K`5Pa<l2l
z9h_wuiF)rjiZ{F{d9dQ;2SbG$*EY-+7Lz!=#nd}-vYl+~MaS;I<v|f0Maw?kyT~eR
zxwGSJkJoA5*;k&JIbF<~Y87F_Uz67Ak?d3U*QLfv-F45QLyv4&JNIOzExf;VY3P<a
z?6%^QKk#@<iQTzq%3HqX^(y}lEaCsXmQMeALO8)8<(>EbxF2g;-k2|295{J%ftAD?
z%RhUpWU9+6&is7tKCk}W`TKo+dVj)xeN@r%QO~{;R4eK{iJ|-9%4*9AbNNn&PT<<n
z(zUBJBVRE;wBYcD+X-dr2jsQpEWO09%N_k$xNQ5i7cPGp*Y$4QHRIX3_tRE1X7B&n
zH>)=9Z9?+x9LdlOzIz2CFE7O3HYzzWdv$rHvxwNdI`49i7n7{2cXkyT?OV_~x4+I&
zyU-;}@AvMB52rUR6_a@IHK+ISa_L{cr(C+Lp_R7s!IC+?@AgQutJyqWRu!jhqb2zG
zO#^3ZYSR8g)8}5jD{8V*^!Luim7m=>^1O}iumqgtk+}Kqd0DsIgJUcwkGyQsf80Im
zfmz9hltbUlwP&R4h+yL{;(pT3U35z|*f=raeeq)d<LafI*PpZ&vfd3nwd>VlcJ4Fs
z!U3NaZMktbwPj&@`3?D!H5tAZcOO@ZRnOPIu(kKh1=hP;1Y52gaNNoq*v`<*>%{jv
zVtoMLC(hqLTJoQNE@IuYA?MjG$?FGJ9V=bD<dwkNUkj3NO?<e7-{_7AGpE4p6+HK|
zq;8+#HC}pYZqTP`iYsp$A6^r&g?paC)2J7U^Ni0|6k2_~x;N<C_U*xp<@b`WPMrJo
zitUN{;fddEKdS9cxcsd5kw<=<=4^KFzhVc^9G^9P;f4Rd`F`HAek_^a^GmWgaMz_S
ziQG>ou3kLx<G*yyqSms1^Bu}(yvt#Kf9!GFCI3SrI(s*}>V&-Jtmufzv-s=Bc!O*E
z+MGM$GwmkJST`0F&*`~(DfGILpZ3WMf8`H8mHQhddF%4M{le?b%jX~4`yXwc(aR}C
zOI~R)Ff=Y>V35ICL6oK>f~ttx-^I7LZTj&3r*^@k_c30*CvNy%TJo;&`LeP}RkOmA
zm%o%fzSuc%!jU$mP`f`FYX5(OR~k76<yF1A>Lb(1BHn#;-$sV=8!vA^zW-->;gQQt
zztxN9P5Y?y>?dROF3!cG-@iBCwYGkvar@4bk42%I{@&eNEC0_XEnWLu+(#wvn{(nn
zsoY-kFfr^?LGAN%O6RZTSjC2<PW}9H%F)-p)28eATwcR-+QPfry8Mahys+%Aw%Sd;
z5$mp;Uv%bi$;!H^=F&fo9%`C<lCQ~uv2W9y^M{Rc;?A2b+I;M3=_K8&TTS^CJJVm?
zd%@Rye)AWjbDKrlzr3+}#FBRCUYhhgzwUyA>Q}V%mW3BuonP0*SuJ_~T%K9YA-&2t
zhu4`?)|w~siQl_$+5Yov>*Sl7_qv2LmRs3Q5^vDrE)$#c_x$bj%ZumFll@!s>DN)l
z(yRX;T<mh6AD3F3w}m$?bk3R3!}1@GN6yf%%-j~(5_~o;G}Xe}LgDmtruUC6w2mH-
z5%&!!<~zd3)|IsGqIKByyff4GsIAM&xG;O8?6kD{7WOwk58vH;tT=F*-lL_*#3D@m
zetPaYai+|3P92lf%KxTD=9xSC7Edp^nsYyek@H)|)W(=QJB!s<J$on;nJN3<^NuyE
zl^DB0phtUg!e!2ydP(swe;+l;ZaU9$|F%lvoGSJ=f1C_@ws+gx{BK>Zr*pK`eD|+Y
z^Y(07zW&W=?ceuWD(!l@jvFM^{%+j!*CAf>m3H|)k3Y|A!gO<wq(@FGN%&{u!xi_q
zc3Sux2R+s!)`3D|th4vUwzA4E<X}Jl;QWsVe5UqQpI^N_c{=?)!<^+2*A`pr`^Wv)
zS=W8?qsba&hoH`b9<_lCN0Tpae?QOG{wMGJZ}r0G<+(O^&d^(3aB`(H!;{YAWj9{O
z_xIgU;+)Q^eb|46{iPm8L9HiSloo_tey%@%-;8~=RaI5rF7N(+`Fj4mebt4lG!qYe
z{Hx+Uy-sbb<8S3CQSAh!o2T~GfBE-A)0%lzeV6yP?c#6PtKZ1Re~?jWd4133{`s{1
z=O5qU=idM1HE+#VnY)!Yc;4^M6S~H~u|45_%bq8i=MPW%9Tk)RXVMj?z~+yC!t<>g
zq9%OTxsW(1CA@B`*j2Wp9p`IpznkjhFPO>p_X11r<h$(`!sHpH8g5TWKisglF^y}J
zE8m8$1$Jx!-~UwRGqe6|WG=eWZQ<}PcY%U^iNijrraQMC9P3h?)K<zUZ85*#<M{7d
zlg^Ii@;l5ObXk9H<g65&W*l(;Z$vfoS&=8|W~Ob7!lu7wX`Z-0bAtKPuV#Pl-1qT5
zwT{*5`D~l+ioh>6uYR82ru5}r-2N~o^+lZQTP~F?xXY!_>i%IFL+#5KEDqlfU0Wc}
zlk_(J=+jdPUJSK+L|?RTKXB_}=VEc*Ta%9Lk$SS{VL#j7wPzJ?CUFPe(P`)WbRg{V
zlf69LKJ~(^H<vE^ZSByXD}6$&`on9XMXMz4Wd6^ZdN5w$yb=F(F_rVr!(-X*w7hx7
z_l32#i0!rjkN-u^ILB=>n%7L^pQq=}zKmJlBr26XM0nHEPnUQ&l$2Ncu|9G%-Y3<T
zlii=hT6nD{!2i4X<ptlRBi3(P6cQt}yil^;^N;%Z#$B!}x46$*`>bO9zGp0dPo(wx
zzI<-Ox&9=pm*a``=DzOdr8AZ}*57`#$8wARp|5LBFQ{TZYx3f_?wa-o)y!v2GP<3w
z@qgQH82k6^mY(Qk*?-?2UhDAP?D7KLXVED?LuZ^nxbW|kwD6VjUVR&D;`3*xG5uSd
zp#8z9X4Z+aXp`Uvxo@X0T^cXCC%ja-{_)?si<MUjf<Dhq^nT215<Efo;LayMb+p;m
zo_Q)J^?Tx5uewKj{KZ$7{XHv^;+@m=VN$Tp_4n3a&4VZCw(EOU%-H6<LoFrC?17hE
zmPO5iKMvP*gC9)FGE2F(+fM4scHRqzKMH<|jjveZ7`^15^x+Hcyu7SUMzJlfma*-r
z%cp)~o5gvdzqu_+_jAC+CzIS$r=5<O+*(p^%zD!-u_$7S&xuV-KA0y;nqFk85-GV}
zdfDMtSwo<Jh*`H*@0@LSLE&_JVn$5M6U)|0spa10>D9~=S26rOa&3ic*wd6#znc^U
zj@rD+T&xg1<(y^On#FqCJ-5EjU#1Y<^3UND6Jvyk(sDiXsm_l;$@|k`xf8{5s)=%D
zYMWShUi5L?cI8X^ob;b_tb@bV&g}*Hzp`e=XV(bTrTisN9!lNePFQ8;{v8w&hJP5C
z)b@(nbD8g`Vhq~crTgtO+bqo!{!)MTcpj3T|GaYA@64_9EZg2Z%nhje`|N|Kv#;~>
zrlqTuV#+czlXlM&liG4rR(oDfvOu*>nQ+PFF7a(u#ZCW8tuKhxFA(=TBcJ-&Z}roQ
zvGy-F&5Sx!K6k<4J4@9<t@rF^%~&{n--#I0XHOcH66+3cYE>>itN84><>{bx#y50M
zN1kvvyxw{L18EUYyY!9}g~okc=B++4n~f%)%-pJHmS`-HVGz!vVEkIF<ls%KW_$g<
zzJwd|cg)nO|M~1|_utF&@9nXkU1wqWd*xJv<056Dd8;m|FaNY4`=8Bz^`0wJZfzE|
z$WXj+CNSu1wc={Ezb8Mke|vMTNTJ?5<f7h9uIFw^rHu=JS@nEcBfRJN_p~mP6z{%O
zCEPdW{jbwLF-^jgY0>@-uMYl9(LS-wT*oNt?_>^Rja$5D9ta=j;d}U}NPEuy;t!u~
z&YgT)WX$=Y_;^w;@6E6W$AWrZ9A&-zIo|eumT%hmhku^_)A18DR`+xebvxYoY;W7=
zb}PMoA`7fr*+L(NEr{-B-8q@d?AoHp^&9VG-(ag@i@8|$V&26yw<F$}GVwpKo$B)@
zP3VH$?ZS?u*A8_{r|jDmx&1uXg4}&(*S5N9T|8NHVU7016^`~BzP7jAS-fQB-Pvo6
zR)0Ih({_SW%^^MU3#XG(m-6+ErYqz8H+M4rv^Gx>IHf20XzQ%flyf?o`{f>_-&|M!
z)2(@%%SMgohY#3hna#Pk$@ak36|E9Rov~iK7=KwW&zq#@&K~^#8OQzE3*^njOATLN
z<({q(?YTwo#BaW(*ZHLsPM6hQ`gGx&t-^&Cj=l1!Ek195mELo{{oO-fbEUlp@5Q_Z
zscG}{!UZDET5k+}`-?egYSzXAG0kSZ=B2k^rrDO%rBriNPW=_ZYRnL6{<<|s`nH8C
zzoI)Eqk5^}ZWp;bvwnVPI=|RW=y-wPu7}nCYOF8xy5#EblPbwqSm9{@=0Mb}WhOD^
zrJNRK>CugKR|;12-q<&JrSw^;yBrtp-#X>&T3*PxO-$)G-_|SQ3{swJ)l#@Te@Cv@
z&swXvTYTs51JyUyu<vNfDRe(KS%+(-M!@yCTYfPVzSK1foS^%x;e+XM)*p;dFU~Iu
zn;?JF?6uYTpGK!vZMl8+^P9A}lIQbtzdtyi%cE;1y{v8NG=r^dv)&Xnn3rsp+xlfk
zpkPzKNIg&Gp3=>E#=mzwyrgsO;fBW#JJSv?N;-Lp-D?VO8^flX4*Sk5I&Q-^{hvU|
z`J8K$|8JeREWN-{@wn1VKf^7vcV1_oXTr;1*L?EBzsNPSzpDMz5uD!VSih=Gso|Wc
z1M`-rE0Prtit#v|ZF7uf`g}a?ad*~(dzmJ)zWP2c4^w+5d;E<``s;$lMrkvwg(FQo
z^^9fRW^SnU>56>0;WYENPTfs&YG-Zm7F&Mz<YtDRv%4gE_jl~NTG7|K=4GnLNvAM_
z<Q%J`T+J^_LO!GzCI+^A{mGv8^Iglw?7oxxkA=?6vP}qC$;08hG`v1xx|RRCEgT}^
zmo?6JJ!%NtSg@OMoss|4_PPb!H`RHXk1{`#RJ}FtapA*8<$a4b*!Y~YUF~=K@T@1-
zBVRe?1*)D5;XlXFcz9ZWFaMWfg+d$oUS?kpM<-uXUyW|JBo*P#mkWR7Cw;BW_%|bC
zmh3A1$5N~_b{$ZXT#)&9+w60Pn*2lEwq3lmYo+|{#DDF)^V>5e-F<elvaV*3(U2Bf
zyUHf@bC<HSaI@$KZJ!wpUXcvj*qG;U@SS&dHHUe^l?~2qjrnbwW=?IgcXuBT$lp*T
zI?YGz3)i-u1JkCM7szH$m~kSyVRod9#DTEXotk{_?(2JXoHJIquXJ)<LHFUmAO1D(
zy?b|Wt@3xjCk{v5RNsVcn)!oc`vRGcu**iXg_dem+Z|ddtLwohuF;~jT<);wH~uv$
z*PnbkmdveY=UAZrYUUP0W+{2q{l9+d_i64|%3k!r-dyRnbN}7s>sKC{e!G-5nPE=4
z@PUjPMU%tz!C(K(n!Y+GZgp3Z=;su>qnz^|{rEUDaEgd<jOBzXhV_qqxG%ExY&cPW
z=8yb`GF$(jcXyY6?GJ7`eP~NuBggc_IZWzjHWeN1@)eq{suy-9FN2l&M)x$IkYe6U
z;YCfpn^I*MgI>zC#eR~}S#(3b<$U`~UhOa&&nD|%hEbxL76Q_e5~mkFvg8na^;&u(
z-yyY0;@s0ti3-QLDEb&3`g0;kp~$B{bAh5TE8jo)(6-m=N%sX~mOcD2o2P*LhGtA~
zu0w`H%_gDNCqfPn|4ZmGJTndPl<=MW{w8NZyhP(7PH}^X=BS2eylZ#Vd{N!RSk0fM
zuD@F3iTTczTjzIbEt*)h^wr*XLMz#_a)p<zn8fsrQFGIY4Nn$2oNAGhF^V{}Ub4f%
z#Y?egLeEW^U7{&-Q$Npk*zTUU;^sr~gxR~}&dMLJIJo=uOK$h|8;&l?`=}gsY`47q
ztn&gh9>>3%`>*Kz5Aj-A_l`vNJK7bNLX(AJ5@W)04t3oB{O;fW`uaaFdb4XBRxEU$
zGku1I$n@hMrl*y9?^|g4C1$%_M&u0HvP}wRXT*|Pa}F<-nEF)fOrl(2zTl&VyH_eM
z+APXue`A-}deF3SakKe}h2e%Lm^RqGdM0UeFOOq~k|4wBLWfB~9C^~3TD`Y#Ja%Vd
zJ#}cY!-Fv8zTY*!<Xny3ZAedK{3QBl-U1Wh9_~{t`;z`!=$E%OzI!n3V9W*g39X!Z
zd^a{8yyEe4>jh4=j~_NMFG=WbI$KeBw9<=z`^olKZ)Lv3Ke*O&bVf<OqNL)2kG+2N
zjH<7jLPB0&{At-EANhSzoykrM`w!m_Jha*`A^iD)i>l2Y7T4n&l4i?kL>Z_qwblP2
z8*)}-<ynu}6Rh8?yi%-iY}V-s5f)NLci(8SaH>~Jo6P&maOHl^Bx$o<PQ3+3Z*Fqh
zuE55n(A;lk`Rw?^lN&>}M!7x>z2wl^@v73SH{kz-Z#E*;C)Uh%xV@vrT0zV5W6|k*
zZbe*=Hl4LsU>3BtaS=TJk?Wx7-kp{foCzCj=Jwm<ze%WJeg9*6-|_Q_MmP65i&^GN
zE1L$seEH&daJhSG-Q#_Ui4#9%2Qd`hl;ip8eD&&^EoaQsRmG25-c3li<hQ@;BrS0y
z<HM9MoCURlK8n941*xeY`5YPgI^N{0!s1Ey14CANGA}T?e&kv0BwLlMTl<SW_E?y?
zUTsn_Jhiufaui4PpVg-4r^o!7{v_;Txb_<*|5HEiJ`8-QmlgSRBIm@zMY^+m?A*VW
zA5Ph;ZCE=s>Db&ek3=VJI%Cukw6!(r`aO27$VFTMlS=&G=CQpIedPa6xL-@8{PDW_
zsf%x%d7V3HYppM%C&#Lsa)<k|4ZG*`Wtb#?TkpKB{DG3u-RtHb!q*BP+5GF-)&)Fg
zKDnMPwO|y8jMc8mlv-9e@nO}SISv!ry@ear<*JKmOn&z3Qh@yFCA(tT8C%RMBNcwS
zPup!T_af`IAKME9xARN#Wq552POP{c*XG%K+~u6eryT+Mk#V1QiW+*vy?DEQZ3@q(
zxysTvzgTT}dUfq`tFJ3se5FEo4kz+&3!5)A>m^6?f@hIiGbL@gtR`MgxpUJb+d*xU
z?75%i0xMU`e-&g}d}iK^#MyZkhD;vPyDFkItMVW5ZYkK@{YWJIJoB4d<_SH1`L_4U
zW;4#&?zC%q|9+ul^YrJ6ZXEmDE_^gT!`Sog+9gE^9$g_T<!*s>XVrc3SXMqRNjUn|
z{@t~?o_b<GBqH6cE0v0Rb6=Y!&K7lLe#F5bvG#}1inagmK0Cju&eCPY2?nK5QTI1`
z)1;l|h}P{oZRQ!8uxLTgVlB?%GV!;IcV$ZZI)+;NKX5E@I~jeoqIKR6o%2pTI@b&v
zSi+|Z3zXEwFW4X5G?lkl;Q`Mdu^NZwm?pm!kBn9yxO3dnMru;LO}}^%bNxj@)!AV_
zvBk6YuD#0U8uTrb>3F2eXPK_eoDUARAB=1GdBgM<uafDh4`=$CWIC^ZQkdq+Y|y%c
zdl8o#hs&KxHhaz6j-Jw8Evj=>QV;r8D@wDyVc`rndEm6?#02?9@q}H|&4riz3e8UF
zUH+ljPqrX?itgnf{)e=m%lJ1pzJKu5rKrV7P-|19jn8YTa6wlqh4@7_SKpQhq^AD(
z9q{|&J1^DNj`KY-H@}zGxu-1=nacR~ipQ}l6Rxh%sMXpep~alK`0O=Nwfj35jgA-y
zv`;h({>4;QJm-PKJ%yGz%_&o7R8^J9CWUppIDI%nb?<4XuUaeKGxa{d>kzO@@a4TH
z&l+C-jml~16JTiW44;0%T;6|1sO}pEYoTUl{pqs;k5%fZozV+k8+~du&-%Xh^h=(%
z%oa|#mQ*%1-{#;MejcuT%LiR^q&s=0*{yJyq@v8h`Xc;{x760V7g}De)0`O+&|3bg
z;mrSrfYmF417|#GZcuQM*tbusd)LbMi<oR2gZ>IHs8Blj{Su?qvad~+uGw8GV)srM
zT&O(u=&RHsky8P)oJG&ZOgP#Q8e{Qzh2!f(r3x*US%z-K9qHQQ)e;NU6TNF*KPp(Q
zE*Y1!Z(+1+LWuv&z-|WNBkLXcog37c{z`9;N#3bryR>!Ho>Lmz%@!2iTQcWL`YNaG
z_FC%#yC;ek2=b@*hiumqTiWS1(NRypTzUdylq8d)il^IyU%iaVHfy<$Z*Am|$XJ&1
zmZPEh)?rrT90vXa{Sp=n)_w^#;eOm;+uF9|yUYvin&eYA)oVB}bHqOUWl=O$RF`YR
zq>1dUxBSf(Ipt28KDpAU(ZjsZEIE3cwM^Fa3NFt47ye@BjIPLXelYrUKy`VFjeru{
zzNMEh8!h`g|7|<_eTQRzQ|29*f6(z!c-FZUw$d`XbxYa#UN#;+m{|Xr@iVVQ!rsU6
z(OE(kOZoQCymDA|x%&y`&UM+33ZFK0o-IDWvbkw`*7BYP#%*?om#7)(JeU{i?ZV94
z`-T7a2Dj;_?9;aNI=#C-!B0Y}>|yM}Qr!iUP2(F^3I7xgNi52!m=|$+eh}xC34#}P
zED@b4f0*U#DVbU=hMvdA-db2@?oWHS+p}Gujm>vLkCJ%LI@VK3fx2RaBEfzVvNvYF
zIvQtsNR_Q!Z|(8shnzpEo-9uNsXo(zX}06G$Ek0>#(q>;__S!P=I>6PGBMMzshd;T
zisXXD7no0$Fc*`$Bd}<z=(nuNq9t9&SeBa|n*46V;b~l#Z`pXhF?IL!pSbLbr~7Ob
z#%0H@KU}Wnd4VHS?pPvId(XNI$>x%Gp<#>{W|~aSC=cd2eC*JUed)?O53YL3d-y`;
zQ@=jmlM0o3B03rqctSVr7n@a>ke*Pe8hwl_>F4dzIg#NT?#o*(j_nBUNRoc>pJlQ4
zjuVQ`D`s=@)MVCZdP{V9OY9ZYWvTs;{@~ERKMC)hbdOg4t3AKBN@VgrmBq@RvIVj$
zcJNF(dq`4BA+Xz_bO&Q~_wiGVOP8u;tmnGh#q!Mc6nDlJ!|ogXg&c16k&aJhWcc$-
zyuP}Ax%(!sNBc^8TW<@W>*D#cqaaQ;fweMm31f91XKsM|0b_3g#S3o|x{VL&98z>H
zbdx-$s+f|Z6f(!^z$LDIhxrA|9ql%W$nE87oh!t8c&oBbkA>Ev>-pyl?2a&rM6&5O
zZ8)*DuDwGov2$IP%cdnYf{Q;)={ywN*1A0B$@#^<Bl4>vlJ+`DhjvQ%bS>YZ-SBg2
z<P8Ou>ui&CavuKNU%O1l&Ed??ryJ(JKNPYf;-Xu?1F@AIF%2Jf8KulxzUMsCT>bfi
zSEiq@2(K$&<5_Av+iOk#P5$<r_==Jf^}Cz?)~w&hBGc(qQuOCv>ZZEly?T}Q`C8tS
zKWyTYXi4^VTeO0C(Z#7IZ}=*vt^B^(a3hoKCWRRH0yj%NlLMCv<CZVwSfq2Mz(G{|
zRmA2(jtaftfUVs+;@L+St)DG=!+3Rf$=lW@^-|6^C-fKcKhLt7nDzfb<AV9IPCJ;>
z`j&8o>`8Xyx8LhscEIn=2K(DS!qux;t-oa6@_fC-bc%Dfj>VM2{}yuOaGq#x{?=r!
zs<L}RP;AcK!}}JqZxm7f`to1vZuaf}awTl9Z%av-+wZqV=DhVQi{CEptBUM}Z*RCB
z8g$I7$0ckg*KCb-f^YgyS?JyVyhHhL&Q!kq%{l6ax6VAfEauwbledc#x_^HWIg!Nq
zU^nM&>BUaJPFYGa{iwI|TvWmRW=nwQ+nquQ+3U8uFL}1qS?8d;TXo*tWj2ov8qG-9
zwNc}>@>Iv8=L%hClsuVpH}v<?_u;N}@z3_ZvkEJezMQTXxJveVUn#G1$9$O>7Kzqe
zx7?#?oS!G>hQ0L(PVwWgC|mI=@a5?<&4+aht+kB!yR{W|`1tWSyxS$1t29s5;*W%E
z#?In~;4j=aE-zYft;zD$lph{XPHgz1_Q&@0W1+dLEtgN=mibe-JEzjULbRpdtXX3F
zk~KS5DD%utIB%JD-kNja7ez~EZkw7D%MZ8Txs+qAd6v2R&b3uPdp25CpMPt0Jt`_;
zYTCbC!RRUVa(V?zi@ldz`6ls+H~%wFUd_(4&fDc}zX(14xH7Rwn&}1O-8QcJ%&dJv
z`}fZ*i%s>Y-O$ooFpVkDJnxOmBlnbN2fiN_VChaO^2uE9GUs>GHKD)!GyeY&cr^d)
zlFE)9KMUK>&TwHp|0`&TZ9w^he=LEHu6KhfTC+r#?pz|nta-FFMr6vAz*#FK`{p-F
zH6PHu9{K9DLBHayDKiaA56p}*ay@S0%DePbWaf;uN`5O({`R%Jwp3dC#p82Vj--Ef
z5c{0LU)a!LF^Rc9?B}IGi&c{<M8Z3^=1$ZVovC-~$AsErK_&}TKW>!XcG9b6HEWBK
zIo}D(wD{t@wC1G35WWp&Zv0Bm*RH;ty0vUB<Ke#8eN0o+A1+$qA^5WNprv2c#N6D|
zhfeFbB`aC6wFPLL$`MgxUg3GpwN5ZEkjZn&-dQt^7_Zl__y6~ER>%}>e})AscY67(
z`r@E-@36ve0d3|>V*O5DX-tR1R{Bld;&?hUbmcvRnT`4E{R-v5oLesIT$^aTV%Oi?
zEnNRz1gjlL<%_)(u(Io5=%>}`(d~B@+f4mrIQMv^;j0zT?<H1<2v<)G(|`ECYWr1D
z@jI-=+dB$t8K--FRaz0n<rE*ZUby^#_{zA>eF0)S%+(pEySn~Qdfl%#n|X$eu<g4N
z(K@T7>u;y*x$Uy$_T8*wQk%aXo2fK0)9-VO$VNqv5bFg(S{I5!mM)Gsbh77(i*x%6
z_T0?G`!+W&t*M(Tygjs9h-b;t**{gM*MBSUU)}y&cdvcyt3USLC%*YyZA*A6YS;aE
z$B~PXk6MInP8~8_z<1%(yFQOgN%P7NeK^47_BHvetZ>=+ijdP~wvHhyt8Q;n7jMmr
z_i#UQIXA_0<^;#hR=;ko$vwnm{Kckg<q3ZOqj_FJvF;03vuJtAnlfzE@a&Ir%{ms{
z$~Pl@Pr!-Snn%qp=7sMwol?3xeewB^E>jP5PQNPQtanJ{(IHLUSkDwg<^Ha?YuA`$
z#LvA@xOU=E^lB!n<#kWy3VDQmYN}zpWADK+*;dfq*YB!#p<D8f*O|4o4LxU4W?I{-
zeBUpnb?MEkB?())x3V4h7s(>`TYZrp!;9W^Z0;f<#Z0^Wdgih9FVA8P3{5|)xw!sB
z(fJcg-fOJ>s$Z2K7`JqXtxd$=2N{e>Lg^LW_h<V}_cY_4{Bp{~aF#byKehCJI6kBH
zU(&TVNoV*>7DRt53zCQwZR})b>C1fkFn3;V!Q9Nxd*41-mcgzalh^y!`iI8UEI;oj
zMiMG<l?S~U-*d=I{S~*h&N~p(^P#c6L)~vR$Ne1_5AfS}`|{n@cXME#$IO5C@AE&&
zRpp1=3QBndq!RWocwoIC<)?<-oxgVf#2<dDt$9Chv3}=tQx+9Y7Ly0TJ^#2hnN<|z
zSIcL!e@n3E{O!QU(8xN)H}L*rlhe|NFCNZ{-Maq9ezEQ)T49q?csst@I;<%4f7N;S
zR~GN}CwC*~cx_Yv#$Pn^CwGY6=Bq;7Yg<25Bu$>L=(pBYt?=CIkTS*l)6`iaHK%mG
zsLUx7d1lUhJ|o9LzroC)$KYqpk6XJZUbNH@u&J2oH<|Hk@r%%>hw7QEw2xd`y<=x!
zj~;7yWy~i*uRRM@UB2jUy(y``!Y?vp+pF@b*rT3IEhjgYEE8BgW#N^TOBi?)UgWg<
zT)Fn+(cg0Yd;8L#71}MB_|z}9s-kIWUbogkSC4>?raH{8KKm@==jL1ZcTVmq879dE
zOqMkZK1=4>A2Wy&(@FGH*3dh0ydhZLPW8LS<xdi#e;+bQZe9MjGJ>a(W81XbWj@;N
z)=rVCSA;BHm@`&4yPAc@U2xMr5Uz9M(j)yzp%;!axQS@(Th7SUCme1tXF-(v20e%B
zQU{%aV<9<wryNgTI2WP(OzE2Fk*A+CMJ{r!*_VCAL7GFRJ9ytrtEbhAdU_;weGoDz
z5_jKqcIFl~6PW<+kGrCz9~5m!UKHhjWQ9@(r<BK?#b>{VKRN$WS;h9^baTVjGl#zJ
zUD9Ns6CBQ@B&&DWf^(%4YcN|*+{JwkCl{ssT=S-D<LmOK6<j9VYOlOHewNlnrsc0l
zm(<8|wlP!?(suHhpV%2cHOwXa_=&C49Tp3ub29k96nA7ZSjXh#8tvgP)@1)=X03r#
zV2^OpBL>OoD{_0vl`8ztrscFaI~cqX_<LaG!N5b44fyU!ypElBLuSdDth*ik<q~q@
zPD>+Z^?OfI^|Hx1aHhG3{Z0KQFU7OboC{?GI1apRxX)`cd8fmZT6<RWf<FC@DZfvq
zCb6<Ky;>q2kl=QI&c9`=HoI8GXCwx`?wG<Pc5IDkSxZZX1Bavhib*@GEE}?xUMXu9
zTAg?G-ic?Af6fZnQ}^lZm)q@()@N_L50%}x{c;WOIf1jwESf)U=#;Y)QoXroZeq61
zw~3Wp-OgF^1-8qZ>^Xz27AJJQ;c{sIuAOzzr1#9M$`8wU^~1{&Eq2W2V3F0a{p)%-
zV*jnst!%L+ruHFbm)=V67DznQ%)m3}{DW9?19^M-%X%{&Y?LW!dSa{4+upF<JWyee
z<fpv{Pv6OXqqAhK+q&=f`^4sXS!_IS5^ixZc;oGIlYfh}+C<NNDh(IVjyUsy?@H@Q
zjufwuq=K4i(}#Bgx3`{Ja8O8fTStGkn(GO+5LLqyl_D8)rJVwHSLd#nn^V8;{>8Rb
z_wPFF@8sfkOQgAmoZK$N{_lG?^P>;tT}>_D%R3IT?YSuMrzqOsM>xl^&DnQ6dd<Wa
zr>^@Z!C@FU@6Gh6aLcFep&t)<1RLGo_F&EmQ;toFmiiaO1Joy9dAH$Zx{a<x5|>5N
zQ=@f-z9}o2zd5VjDq4C{<KnqK0onA+o8Of!)V-|tqup!On~q&?WgmU{&e37n*mt8+
zr&XNI?Ph<_anTt?jyK~!3hYRYy0a!dQt7jvw#rVQT^-V&+BGf<+gmk<J@dHYbHjWu
z{{!jjFWJ-YFL&5dY<2F;J>N<(nMV7j$#r%2YL<U*{oD6!9`nU7$JfYh^mCisuxD4-
zk;@FJv)-&>n(nqwTI#>lOQS0%t87lVmNlJ{%TGSM*lOG9%j##l^cPG&;&O26R35#f
zXAZD_eA<1m-9_|PTpz2FqVW4=6L?E^Pio?it$BGurdDij-O9~gWp*94+ls}%?{`$6
zVdZ*JkUM3Iw1eIx-wiI@wkBUBUT!+jSzCO+?EE9veH$4~9FlWhEzY|k*&#b)U4`M4
zDL<0bl*M*<GF&l}D>4r+bIV$g6tYM#wtYv;2FZ(WdNlbh4VQh`@Xu;v#j6W{5;Fr|
zU8xLX%xe$3@x^CFg|x-htd-8!_Gd+DM_K0!Z>`_eo{_EA_g`6M>AYp``S;)1&iVK2
z&E1zLXJ5DYA<ws;yKL{TXUV^x-J4fgUcbGtT>gEQtmnPmE8eU%{%}t_@mSq6^BTP?
zZ2P9One$0Y+1|=IkazZ|WtpZ1V~PHv>hERpC-keU+h#XqJ3lIL>C!!LhEv~f{tS&z
z@2@3DpPTh=LR0yh2M^<4Klpe}*5;qL>=hIFR|)mkcNgd{2$8m_^*!I4>;6=6+OsF7
zU1wN=CkZRf?zz(U>^tlEgL}>x8E&psTf)}r<J-;2kov3heveJe+@g?ergn02d@DCs
zR2|<DGI7d-gE8%|BLaRe_AtMryz$Z76NO&yu3x{{T%=jS^ViJf;1|9JEBn-rE7wfQ
zXpNS8B|CePoAShLDgMbPjCadf_Z44IkC-83&&V4w<*RE!ZcLHBi1U6o1OHNsQ<uE`
ze%HA~dCA!|y!5)Y>ynQAi7$Wqghf^exT&dZwClQ5a6s^t=biHFdOijZ{4OZ1&RNSC
zHrLDHfQzTbv(!R+{il`FDy}$$-*oQP3EW|~?5nZCQOD*jAsVdL)jOtIba?%JrOA6y
zC{A8rP2|Qo%AXy}oA%giA3Wl@^u&)1l3M;AQv9;Dnwo2UEw9x)F`W05>+!@|Sr10z
zzZ*CAh_3GXbm8^v-ok(-AsJTdH8$wf_5QqiV#)O-?_LGeOYdGY#m^^jo#%)5Vm+^8
zeoVc$LR(tPv9H&0pXW_>fe&w1O{jj<dMo^(_$$k`_X?idwAGd5u;$6KrleS8I7~U|
zSgdcM$;K+l{5^d6ez}$0_qpe}+u4dl9^sPtklJ-6cU}FI7v?Lq%pxDTW@{LwERlV0
z^tkRqHP`#ad;cE)z5D*#yY+tx^2`5k%;bBz(KWnD=j@%Xgfn)p6IZ_w`Wx&Vv@GOg
z`==yx5k|GSx4q}w@Vjy$bI-0dEiY6LA1>R<WO#6IZutM-5{56XZSI<TEN|Yjq^AF=
zZU1gPyls(h{O#Q>4wmSYDIA6?9&l|w%OP9hCv<*UslokB`AqjMby}PIoZi=Put-Wo
z&wb%5xTT|ub;`fXfAd0vF3IeZ^-g}VV9}GRBf^#%$u^VKPBDw*FaJ@>aKU^<@%jEK
zmsdF~y?I4v!fx3u=DU3h@*;#+bL6k``#tUWV@vCshUX(a^3=X2UUc1aY_h6DaaZ!m
z(8RSiY^OGTdQ~B=^~f|qzffCwMS|5z*4KNBJH8Z}eTnn*^1c)L-a%O1|B>6=-8<@K
z949p%D7A~}n{>J+S@{3$;-J|Txtn^Us~S$_MD@?xF26TpipjwpMbiV-p4uANZkLX6
zFTZkeM`Wh!+gVj#?K^|-hI1<h-nU*oO-(Ps{N*f*)mZ}av*t^k*jcql(el~L4}U+Y
zZwuajezCZIu%(Fh-Z@6MegrurMaxfrs4ly{Vcv>zi+Gd5@{-c?wJLSV2Cq_TJvZg5
z+?!+f_fO^IV!>UjwwPHRSS69E+ORLlwJxKs;35P6+@dABkCr}TT|4FC&UL)%$62J~
zPCPbBJ!=~Jch2K|9HsZy?&;(d<Gp#h(&%j3{?%*Bwp=>?`?PYwf4kjR8{3aGSmk#y
zd3Fisf2=cDCHu>|b<66@yLK~rbISPpb54%tp7ytorLy7sor$rlLsuNWynCwaZ?Ecr
z@9zz`?z$}KT9DaSWAS8R=d#jJ?Y5_1&%YCCW9X}&wJuD6MO;|8RWYE1%XgAQ@7mDb
zW3x_c>Yq<HSJl_!G3tM{(N867hcdI~yw9a=?u+GjJ^CuP@YcRLY5~5pJ1wiSR|r=d
z=x(+xGHmMHZM#@Dd8K;Pm88eIZ;wlVUK_Syo8|poeEK<sH;!D?y>mGF!%nuGSJF9w
zQ){}OJFT(YXO!4AbIwYuSl0<LtLtxO+^Va;6!32C&y7bDZt&(+9dL8(T`9f2MJ;Zn
zp4`rimqt5Zn8y~~-o4IivGA|Gty*$tx~lDEHtoHeuz%<Lns(b>r4JG*eN8qGk1;O$
z|1DnjfAsvx5f8%3WAYZS{m!w8@xAQy_6>3yioKRN%--8Q(JSxF<`o<c;b$LD2$Fsg
zba#6D<vYihl`O4O*4-;?{9SP4?;Uf0TSZKLo#MV<Q}=Xj<pmX<gXZ_<KDpdz^!2wy
zaE4x7*}FKy*T?GWtKWS8ufK8q&v#RA=sD+qzQSV~sINC&=W4jnWkrD*wMV+7Z#Vo~
zD_F6*U9Nct!z90_)z7AuOP%l8#WX!rWOdz&>g^YG8TkDpY!mb!OFpYT@Zd!L!Q18M
z=h;`A+x~s|a(DXiE1yGBIF?y0zFspoxccY(R~&a(Hg_iXhW1^Gx^zU)S7e`F$*j)y
zJteL^6_QEno(@3^ni%RgJ70MfSC;eTW=Z5m*UP29vtPVBF(H1<?|^-dBC?aOpZh40
ztGscKo}O~-yPnF}pQ|+2*c&(o)j7{UJ^N*jRrl%lXXTS5AOCx8e*FAA``Z7X-aI|o
z|Ls?+)RQYdf2Bobnr87b?TTHP>zNxh$zbon?Xx@n=6{cueeA^cPye6w?CN-pcBR=C
z6Eh=bt_!@#w8piA`A7MeS2_&ea@#lPeS5`n*S&XEx6G0k{Z1`<xgQs9x_Pgk<9Scr
z-=lZ)j%_MhZCsdW5fF5))%n0fy#<*evbCnuV*eieTE^sNo*VSRzAOB$q>|}`iEBT9
z4La^pU#hvF{NvKNRqMJfpQzqhEXJ#IC}5G3>{rVmf4`PT&bmt*|1O>@68LRz`toh+
zVSD)ZR-5Kb-0_3Ek2%Aq>+V$h;@x+?<laB`;$7~YM&WnY{>3}GmtQ&JGRHlMv-w7^
z^8K&3wrZ9JSlrq%Ble^p$DbeP{<8;oGqZ>=Ffed1@T~kAar~cRk30(lg8>f%gB;E^
zvXvzn`FVN;m3zZ(=iRmtsJ$NUGnxI?3f+{+%S|URwa&iFTgAOWb658QfsD));f0=!
zOCGIqwa=(e-oM8A)w`HEwUM?Gp9-GMdHC>5!0`{yug>28?7d6ZsYic|oS(YrUC?<@
zdhjyuIseC#Ur0>bwW22?U*^wm{yFpJ{9~GaYN5(*%`Ff8GDM%c<tuuAx-^w-GRu)^
z(_{*kZsC?Q>+0+4i(9|O*ybzSiLH&PPtCq)?TngU(>vi+uA+*R^yFd@Q;l_6Em6$d
z3uLeQ6y7m<vB)j|O!Ss0&y88r^{>n|h|0~(7LO0+IcK~>nXSsxM%MfWOZk)B51R}F
zlq_S8U$2jkRXJ_1H!WY^{?ERShIwtKSJ{l;RY?EXS5l+;Q8#QxEzg{MmsjgnGo^oM
zDCB6ZJ;eV;v1?ICQMUBMTP*5tPnQU?8U(GMxGi=i>(}hLH=ZB3^x#NSY>KnDLF$ZV
zr!zT8e>InNioBZkLg!Qs*XQsJm!htD{dg{6r+ne3)@w~ijpd1!%&QaICkU?M&Il0|
zz2XtO!cj|xb$?;z#^-U1y?5OCcuMWgn%wi%vipUv-3>6TjeL`QXTwjM=hrUwPk3`$
zBDeim#^?JN?AmA4s>JSERAPIHC#(BWbPPkHEqm1F#2a?Zq9?;@xZfH-lDwsQZ=ubB
z@;l!mmtFi7eB*<)%t42Sg@?*bTW>2&(Q;PSezk`&;I{GxUgpMt(_f$6JNC_NQeq>^
zvP)W#i*HRnb1}Xok^N!4-v{<@&UbfQKgg(;*JGTp{+$1#%khsl8=Jj7eC*Qx<;=Eo
zwx3tqm^!a}eeK==v+sP9Cw^X#trLDIl#}=3mu)v+`^~<sBE0P8s|6Ru53t#uV>-^h
zc7wWSso1Zr23JBRFXr`HX}jP|-?BBIZ*gvKT;THRc=<Gw<)$AWDj&;B^8Fj4drWHL
z9@m(B?GO7b+9z*xzhN#eCO>EW<T<8auZ5oeK4I#KxEb;j+PoLWHXnMi^<nhsWyv48
zrOeM~TsA1?n8e0)h>iDcutl1pIM;luc>j1SpA}UrKFfsqJ$mZ><5X6p{tn;hWpjmj
z9lVd5o=7S4pTT^7m59;nR}Vh+YToJXc=03uSJ&6+%NKC&o_|Y2x~Ze`VRgQeR4IGb
zg;#$oox?NrEvo;>C4ZMvm{SlL5SZ9*a_ZPL)>zrg6&|Ltr^BzWJ1CcYsp8mt9jRTX
z!*-o}yx<LESI8~3fBTfDJP}*XneE0hTaG0myp-2m(4joicGZo87o^L)is#PVc=)QL
z-~ZigZ`ltNyZn&QQ;%r+A5r~N=#R~o^MMLqxt6$ol;ORUsCK!%Yt!76-`5pZIvxJJ
z@K?>AjW$Pw=ei0_d>HVv<Xvv%ob5kbe(ig_=?G`5kNcKf^Jh8#_HzC)JWw@hm;Kgr
z_h<77U$$5;d;T@E<oS-os4owvh;7=!+_h}y-taHNs6`9oh4f{@@(c`bI~f=xaTP5o
z;6pzD7T?~nasTi24sTxu?DFt=^W@TM>s^`Wih}mvDpWi7^;V&+maCJ{d6AXJ`A=K*
z|Np*yH-kq5%h!i0Z?miC&F*$#>^_>be<K6`jjQbs<9|P2c>ZzE_w!70&mXEhd1+X^
z`NJQ{_wqaSzwzDh+!V3&Vac@3i^bdB|1K7HcYkxaXEXOaRYUF{vi*~e%2;ilQ~i1G
zUe8%)Zf2Nheo}h6Sdja9x60X>;>SJTJxvr!ude<SIcX=i{`{5eHN)p`O4{QgJU@MA
z)ui=ei8iTm$Lvlj#)LP{Q&tPK2s^*GM5;A%U7elhvu=Y&FK3s`TB#N&asQJ^u&-TQ
zZ3VaQy0F4`cUPNnt;xD_Gx<Zg)cw{>p~o%$?`!uRko<Z>mZ6znS^n6kpnJ*FzZ{<b
zbJg)fIa_!hD@3MM$F}Zndg*;fB<X2+aezHn{!fhukCUvLZl>B+tx`*?v7TA@|C<tL
z1;3lH!}Eu=66x<u^hB<d7cR8gzOAv}Vy@+xtd~m-1Ln829i6?w|K0NawHC5-|GfP2
z<b3-3`?A7JlX4y_^)Ruf{FqjKf_>&ar3c({%)5Uo>OZ#(IUiQ#EqDK?rw!-wRX14;
z(j-1_u9$S?)=Jkv-L0jUqEEH1H$G4xTK)Ng{qp5izpaElSp3pBPn?~%kw@I)ko=yW
z&5l2F`rRe%^Kz&4)IY1+w_UtPt;x^jQSyTK246nE*72`Cmj2`ZS>7+z3LWRJe4m@F
zw*TT}CBDyd(k*Sueog)qy*|s)N2N|oe(QY|@$UGm;&00xn*#-wU3pS3^Xp~cmV!ku
z^7zi*-VoXEb0NOl_riV2xe0P>l+Ur1TvOa^t5w}!T^;zKU+4nc=MUmR_19GG*lSB;
zqwl&tX|;IpwRg@%?!Tu){ugz`&-wRs;o^BRC)M5k_&+?{Xx>+0&*JCixGcSX*VCGd
z-xsa0_hXuHWYcT!n_r*4i#5LaRlJ6&xZU)}^0RvlOP!{Ec-Fh~X5DEMhlbx@POp<@
zsCy_O+@Kzuep_@7M@rzbTBAj}r?1}g^VOgH`SxdJ{nIxJ<mNON8g2<*zHs%f<4)J#
zzJGt&Sk20R(iC3(wuC#(Wp*}&uF5}-q$RAh6%+q#=pSjcFf8MUM8HOerE|Wn2)E-l
z=H&UonWJ*>%fULq6*<qAW_&+x6JI3fTx{pAp78E&)7ujliVH=Pl0G!}ANb7>ch-He
z-?7D>{fgpER{g~r43stZ?3i%Kty)kw;ros$X$A$`^b$_o{H^jV)cKG=TY>uxxn(?R
zRfdd*7>)OQb@)78SKD~OKfVZgbw=3)xzh&U({*}2n{aZ?Z~oaMSrNbg|1?dNZBm<`
zwU*>;ezEcIdv=!FwHxn?nq+T&@x%OlO+e1<%KwGy-#B?2JpHNBo+o4d+qlW$^~Kb`
z@4wzVo{%c~c+TGcpI;uo*xtW9|NK8Lhq?cL9#}a|G*Q)cpT;MysQym%gnd5^Zyjg*
zA+&Z%b8BxP+oY2R63=g$XZ}p#kmZl(J)+0zLReztS!<J;{P!hqJ5^+7pY~X#^A>xH
z>XE!01BO5YOJAGx-|zOZ?lnHdH#?(3@xO?rJfkq<Axi_kiVc=)9$I)SeRQ^4y<uvv
z+lvzU*Dt>E*lhcud|z<w3${;-`Z$`a7w~&=v6~(a)_*Q5Jbj%fyFy?^?VnF<nJ&Wi
zc?;6N?Qc_@u-$cix>ii#W0kp&+xx0M6f;?EJ|eqeS6yYz<+o98^{Vdn@8`ca`m<WL
zz5c4vpY2&c4(2_s-~IT<{cSz}qx${_U%AcOc->m*!z_UnpLcWKo8sJ4Sfbctu;Fgh
zsp$)YC%;zpzpN6w_*+iED~CTUTeg`$-QCz2x3(c*>szL^Z0Qq=Bxm$1=tRA3yPhem
zU1U6u;ne!(Np1yGL??Sz#2;j2=>5kh6}$Xm{IU57J0HzDCtl{WD&<F?a&7|egYwl=
z%_`%3GagMjci@2|-v^H1J6og{?&rNJqNnI`Hg9V0i;}k|Oxjtue>!~AbMBM2;+#*S
z0VjVHaz`?$%&xtW&$iS)_i*Th8?UlTt_$nSot(g%^!ti;xYfH4+%|Xboe~y1lwOb<
zpj~m7i*@0;peymeZrJQ=W(e|*YY5MeIx4qRZPog>W?>BK(Y<LugEw~UD7bgv@vfII
zHFB6lk45tR+j%V_$d%!0uAR-EM?b$-uwMLncJj^*%ol~XoVVU3WuNf=-v1Me80tKg
zICzYH^(4B8u%2mdV0U8eGIH5{>_*l^Ch=vHpS>tQZ{;Uqad%g7pX9lv+nX8=pEi^d
zSj=K~Lx3Z+gGa~z#+C1eIvj^iwk)5*Jh##?+Ufq1jwY!y3XN@=-#=%ta=&dnzP?HE
znz(?g%aNON#YJTvUVbdsZFz*{L+P1p1>*;6WSHAqo}Ok=>r~UbzDTD)no)1X+s^hv
zR=*i;4B`h&6Eykv$9Nd*nWc4Lzu(cdwkKl@=I2aNUp(df!9yhr{lj!BZoS;a`)`|(
z_=erb?u%xBFL`Eau{HhEqL--);%6-Kj_AEzV$>ixXP)!gS@uGj2@W$nUkR03U)aIU
z_}sQuTBhu6ZGy)2=mml=D`w9YFrW4CoUvKnx9nrRW*M2+wVblWRy~x;-JTPlu#@AS
zyyheJ@SJHZp;zWDkDKFqV4sOmlC=6q6FsZCmYYph%}Oski`G1EIhgBgEy5-(Vt!(~
zRClM$b~Qr<@5v`-r>UqvKRo&QjNL1QzKZh5yX<9HuGq?XtZ}t-`#h#&bISbE?#Z%0
zd}`n$&>+zlo>OT3_VgXIsNZXrm%5uWe6&_#XqtUM{R5{#cawyur2kwVfkQctA-z&R
zq+NbA=%&j!E~=Z=c<aNA3++>-lyZ;17hkZLp|eHmaKBVXk8qTW>8WkOer<2Rpa1^Q
z+{<$6+Du&*lbDNcK`nLaMkhZ^x)mcW^PJ<X$4=c}SB}ShG4;N%<dVBr#gm5?ES#~u
zr~c^t3tF;by8GEVxvmmdq%6uLHZMDNA@b=bE)l)&hdp0p|1n~`c*-|*R!a1WV4luv
zw-0fNd|^{8;N^5=43vGidL?tkl1BbLB2sxRc3BPnn|`Zhe7Rz@J4@8&#i!~s7Nst$
zmjyXr<9*!peydQ_sV4!8jk=nmk2hPeF`sg^^WG^Q;dH8KLt6M@&KLd<X4l_t|DeX+
z=6h+E{|4a=3ool`vPml0>THm)^4T!!o<ubJk=2JgL4}8H!b1}`U4|@?*|m>7o?cRn
zXP?(&_xI)Fm$M(fcy;!6@N&-&%mKj*k~|i#_1L^b=B1CF>x3UJN#`frotw_1xVJay
z*Q#q<dUJh0^3V2M*HXW(P~|~UU4PpS?zB%Iek|K`=IqHuChl@vo0(F~7fcFY%DFT|
znW5iiMwpbI)m_t?)%Gfm*?O9NciC4z6Ak1$XTNs+jQXD&`SYaxlOwK#{?zHLy?5S{
zg~wrokDZ)#*}8_SXDoEpGgbACdS{r#cfGOWx$@-${}#I=zQ0Sa{GQSL{Gi>g_4gU<
z>ysN98;hIb)F&7Ae+WH#g7Fu#<>!Nj^SEv+CPqJ~nW6evrP}UK1jEwjObs6Yn^}2<
zKNwFl_9=bu9kuA}$<DQFJuVs){qwammRzv#Sy@zJgqrpD=ThIfFDY25?3We@lKHu_
zqgAPK52x+bzLWJSakGLBhuv%5z@DyXJ4c5xpKqGZ;Zps%b0!yEQ+G<f+d7Xm;wiUj
z_{)a9`~Q?w#XM}!+FI|H(|_yhhojy1jsER-<uDX3Fl=jMvi$M>xzgssnd}!Mxn?Oc
zKJUH4YV_3RWKn8)jsD|E;i;xqWN)0vj=pTXb=md(_WN!gy`RqzRIqRJ!JDo22kO78
zE$DnBGpVt^)jBV0nbRy*sY9;IPKfTUF*tDhqEGJ+mQ}KHb&8v0_x<qMHFx_A>jftQ
zUdFui(pEfS@oafV!pu)|8vj3gaVyyGpXJ3(&F5uj7;Pv}`mV8C?Bs^Nz9h}>bq7!V
zw%PM|hp;vO`@$(+H>(A$e6)Rd1D<W(S;DRqeZgKob;+FY2~0PpxCF9rmR`=AoV>)x
z)b65C>24{O#Va?ait<amzO8Y>>WXl{;d(=dPX<h$0k(5)*C_mXZQM~^pfaIEFRNyY
z!y0A*hNT_rTN#vt+(ml=y*yIpb#PoVKWr;Ek<DqUhD9TL*oME$1ljTy6r|tpIeCTW
zbjMm|!O$SxMT?$&JN##2TV-8+{r>wZDW*IHmuDYk(rBK?`RUC!Wt;uKKDMvkA6sj+
z*TQaRO?_!)-6^XRf%cs@Tqm7nTHo5fD23~z_{7vn9kUoe+_3m*!+5^a?|}yQ`;HLH
z*9$6>it}5&4f!*7<_I&)^a<j4Avk4;rU3Ib!Ey~R!wp@=f^m=M?_C@6uyQq*h_vJ-
z_PWZN&CTbGcge}#j|g1J`n=48ebUTK-PIyXJN9TVTOuEzbHIFYd{CcUCZCs5)XmMO
z*k`oNXs%ULe&?FN8(?C+@N}$Kc+%99S1vd_iGAg=efiC81+PEk2Nya0-^{*d(u7I3
zjP9*?YWyZ8x9_iJEce|Msg9-wnQ8I=ZXEMrU+Ud*<(kJ2OOc%AryAFBF$SI~NzZsV
zkKe!k$H%!5<z7piZ_E?9tR}VXPKU?A?mu!zFHhkV;<>rx=;yaJ-RfuG9bzs#!Ns%3
zAm^KRuft56BHzNY1%2X~n;v9t3Hlfjt)o=R{40d1_PX%um};+s3u@yuF5A502r9Yx
z{f+C)#tp_3Wql^QXbDW55M8}B_)Ry9*%I|vzk-)V@@NTuR46LDt(-1r9<FZ^?pL&I
zXF+^onwe@|;>D_caVC+Iee-=qSEc-F6ZzT3@@$&s0@=&<^C$kgsrI&6>CsG!?+5R{
z?B=}{7F=`SoXf}ULd9DOuT3jWtEemc`0&r0_T-6?yX<N@e_X%p{p~~3t9LmOYp=$w
zny#Y2W~o=<v14oS`3H>h3mh%%|DQe@aJBkYN~*?XjXF<;DIzN0e|~u4@uH}xKr>!}
zDT|9M=b%de32wCnr7ate-+XFQ=Ui3y=6tbt-gU1}-=`nGygk3p=6_4e^jP!!6Op^`
z{aoqcVi`MIvO@aaXP=#uHA*5%yMmRZbS@d3Qx8?t+w?4cU0<Bczr4FGylOMj8yxQ)
zo5uU4^vTaFpTigH@E=N9lBiaa<UBj)g6g;4#`ViRu1r&W`+iMg{px*pi@aQA?uGyE
zk^8mE|8Dvbuh8`5sUF4cuJ<2_RBv6#w>x@$K+y8~keOa;^K!L#c~{Njy)@l`N9uaj
zjOD@WTt(drignL>-??M*V`W|3%c$Pw)EcRhwJEb-9SmB0OKktW%86^L7WzJ|*?MEq
zCohYg^8-J+%w2sd-7vLPalw^||Fa@Wv#$m!x!nr6rK}`tc{qpdlBL$`zFVgYThy0T
zsiu1VzU7xB9FW^`O}l9Y%f6}0vZe=wa$ZsQC}m92`(;ukbouS;hSMj%y!s)P>ab&N
zW1ak5+Yg_az6TW4FFH}NbG5F})Gd!$<9__@n#8oF{oPZM@T?CDLOH^+S59RNDfTzZ
z-mvwkYhG+?=I^t*zgKKxY8820W~#w-+Ei2{tvUCV{}i17_sh|d*7vWkFPp#N?*9Cw
zo6~e|+E}jk->24|bZPUwoxNtI1*_(+e6u1*&^TOKN1pNVndY_J#Zy(Xv=f-0&orIz
z^^tY8>jB2yJ&mXToYvm<q_3y-!gj%(CNDRvobY0aPM2cfYDcGo&H|TShu3PV9L+N8
z5i3~F)>CX#+gDn$-Ei5bX&Un?gPPekt@XP8OwYRbgFryo8Afx(XO2SFmW~3?+bd>O
zD{2Uee3M$C@nL?lqkO}XH4kz-B6B_*NLX9A?&`WVkD|9O<uYD%aMh}M7O5$h4XQn^
zteTd}o3QyG-`B3^%W4EG?Zof#zGL`*^*g)Lj!BgUkt;44L^qwja!~K@onrU@O5w3;
z7Vb{@#WHivJPJ+}zcgxgj@Rka@!fT{@RXs-pHp?y(jR{~&)DDIy*VSaXR)kk;fp)V
z{;e))K5O>Pt?{PTdecb{8*VP+^EA;?JlX7fVp*&C(d00{1)}}e&&~Q+eb0vNFb{Wc
zx5X^(^iMZz0&)ze9Qs~j^8B)+{MB&vmVFz)2pXl!6c+agpW~ZlU~@X{rH$r+&w19W
z*YEL8>6)(=skSF@s^3+So=>t~O^L1RRl+?Ln=N+PpSj#<^7`$*mcE}3|1W88lwQF<
zHA`i$2j@k`i(8{^o$1~<=ge{8uSJ!Gk0Vwexpr>u^%(1*2hTDO>SzYdpPby{zW?iH
zZ7!XTc@kH6x6BBg=Y0Eu;eyL&LiIOVZ#yt0!PH<&v{lFU`78_Gu=z16zAB&LdfI{A
z?40@q<?@+rmMfHx@AN*z@I^(6@7n>nhn>%+t~@OB&t}1G@g=>Jw0nL!KXrNi{MDA7
zrJ=K@HP!w288!P<?>m8cz7o3G@d=J)iJiOcS5zx@s5h&6oX)VVPV#nFI_tEyfj?*I
zwsm?@s|C*_ZSlD%?a^AjaARiZ%cbRqjpeJ>&sw=Q`1Q>Ni~K)F^te51^{?BpOaAa*
z2k#hW_KlZ~Bs8AA$eMe1Df_!64<!ybC)$6wqN^4Yccn%`pXG7>?(d5phqP{dvt4qM
z^vMMsTpE7C`SW)2{a!mm)|F=lL-%sG#Q*11^5?v{J@HRdwqJ*Bhr9sWrxO-Eu1(xC
z+3pDIOg;K2_Cw`~#}7`eFh9U4HLE+OtEq2R+q9^6mIV_M3Vh|XKHvMIt$pH~+?L{y
zPaM<gN>ir4>(j2OI{#PcxHUsUZLnWx^J7tC@i@`P3>RPQYWS+%w@Y-og>)y&9-I7V
z%Y7M+Qa>kWb-(eR`}5azx%rohwJz<tqvyIJ^4_dPUN1kVOj-Kx*kzB`i$Y58x85np
zIs0<T_auokE#0e~D^|5}2<d%S=x*I{oxS_G=#yHtiCItOc~u>CWFP*jn(}aV-_B*F
zE^=NnCej=JCBALvZJBg(z17rH`{H|CB02@R<b52{6Dz|ni|zW_Q2XJMj|ji{uIcK1
zN+#Q9y2Q)WUA;B+fWf~7w>d?=s*281Uu*33=$OE9mKVpb@+X_WwEzCj`qpH*)mKk-
zbd@pdbTYSwC`@;>a6P^4vq3|&`ipDFH$7!F>6>N2|J2EzPp--R_?EO^Gwz#z&9z>z
zYCdDo-8Tt|VP7w^m4&h^Nb#)x`d>>Y`rf>cA<MQhWNcWQwRu|M`;ud!l}EqsslI+}
z_g7ZOZASAPJvPs)e{b?{Z}jo~(LAj-HQ!m}u3eLx@qXR8qt8yv{;`A2=Y2Ml-g~cG
zM>gMD>&3gxbYV?owTeVg>`&ECrkqu+x20Dwe|uR}QK?hj*RE(_D^-}~zMa2hmr^PV
zpW4&IFXpICy}XPwj!W&ZD{sQAgf<htQ(}*nnO5m|UAEEf5)4maD4q22yw&~ilI#ut
zZk)ETIW8@p;{I^Hm}bpelkK-RiZ+==wQua-klSO^*JSgwh~x7+Hp8NRhnrlV?*+W@
z)NJt#QE@#s=lKS<c@YMBMirX`@{c8N3A}KmG^aDoX?BE0n!wehr5?A%wD-qz<Y-?h
zKcN`D_vn{dmOroLD|bBm_ElwpTCC4cW7S6=7dHLNxXBQIfBUTWi&J+?y#H)mbF=>O
zYKAFh7YxIs?NVR8o?JccvxxHSPluGxyuBdOW0S4?&S3Kf(F$FWLjk36E|nHq#>Y)<
zw)i9!3tzP8=${ze|7iKNY_2CIoBM<xy*z9G$97rC1zDrWc~vg0j=TqD-xXcDA{yG>
z;2D;>kBQ-}+zIEI74w81wnl7@ez11tFSA38*P7FewHAn#?o)Zq)MM4I*%Vk)SNL_h
zaKl`ee>@dOPCUyI-aGYdh}34)ed6V%37q~%*!ff6eb}h~@S7q3+Zk7PU7a@5!<b3=
ze*O2VFTbWPU9z-G^7)6~y}g$|ZlCTxJD>gFo870lYrn1gHOuhTr+-J;Bwn7}&}Dnt
zXLnVD(x+seNm2XTAF<qV7rOQO*V7f|&sfuJh0>kZnCI=wy<|G$@~VI}#<TSUUx(!C
zn63CFSnMIn`s#9_zn;F`oVoMO-p8!^b9R+=+7;>T$tz#3JiJ>fF8gkTtd3p*cSvSd
zPJlG4^^R|ug4$(GKO0X4i*MXj5%@l}%5~n9<h82|KK{+hN$Oi1pB24XmgT_8yd9-^
zZxj;FDbMP=xV!TA>b=YN^W55&-LderG|!!W*FO`}6AD*tHIi7Hl;8bfZKUJY!_C?4
ztFIa8*fx9Fnm(L&D1NhL<PUCtwMnc2wIQj7X%~Ceu3ENJJ?$}*l5(|{{+7H}+fG3q
zWw}R&$7b=GZ|VH2=9SF5^^AO4r+Q!T&qJ>!y_L~6Z!$<c-m|S@(GULA+3b!_j%%G=
z@cyrj1oP>0bI&zLtvJ3;TWmwLW6hd`mnW9&NwJjAm*samVOM!s^Wu#YuX1mPCoHHp
zoMQZR^+C>QHgXYrPyI_=U#7=Wm9$>B%*U%YmEXnx#O8^S#V6nMY@U+DpY+s<m+`QH
zJbQbncb5#4$D#Qv!aV!LTZ5%ucXRTuKJ7nu>21;AV#j~ou1#TS?lUWP8Po`B-sqip
z^;rDLrX%OAl<QSr8nSQU5HLM(q)pS&DsI!s$rom3{CFUEq(ttRm88QaZMTA(p_7=Z
z-sF2K`k&Xgb+KLe+4&6f{K~9}bxi5gD|r;t?{Gg+i|RjX7yW2{lF{5<XG^x3&MIxI
zUBtdrp;c1JM9JtXS5VaAr}|I01%tWYUJ8&1I&E{|mCe6}uHSSI?z%er);*<dtD59y
zGe2>Rwzz1lX=$*pG?eki?j0+#4s0>^{<7*x`!2hfIlp{1*+g;9lMm~4-MVi2W=+{h
z{UcAAUVV?UU0!$B;qSE!Ue?XxTaRsSesq>||Fr_s4|hTihw4qwR=@enN^j1`D8IYg
zF1%j3G|nphirR+{5vG&HkB5XaE&lxAOFfgV`_YN^jT}qw91r5q<#rZYU0!Jr7nSgT
zarJ-c$7|mfro3)ks@x!v$&&uJL*M+{a!b7m1}3Rr(hCX~{MMSEs8e^w%KBjHd9xoM
zZ^;XWzq{zr5fFRr&ZlX!^1^rb&$CMAt6Q>a!q=*hKic=NUG{Y8&25^^{LHuHjO1aD
zz)4My8-gYKSIp!2Q}(krD^kqB_*Yf?(<NJDS{M}blEl`EU3RJIc<NRqo4d<;Mw{$P
z-Br(Q|6kc8!tng}LGAC~`}T>a?kP+^8SGbnr)bOn8IDV>*;?7;mY>vZ-?99TKy+2b
z;k$b))DP~SEd0&-`-hoqyOi}<W)z!!`xCv<ZjIHJi*tCy9=$OVmpH#twl(N<LW=Ci
zn`OtFqd2m6)&2?;FWytMgg2b0{;2oT*CkutcVrlENDO)uz_-89X?~&Su9b4@S3cjx
zz0^LP*^@7`w)u3a@U8ljv-$h3%;tX~=JfWUpZQ1mw-v(wFP=01X#X{(=c(B{Q}yH?
z#i!i%doo_G-4yHhFheP=@nYS-v|8SUg)2O&)z+-s(a-;$HReKT<<~<_d-fl&@zDHR
z_VC);o6cKS%Us=^s-HFKQ%7^*)_jl7%~h;%hn&qlVtG!7-|7h9%)ceL)UKkR`NxXY
zK6eec8#%t%FSh*`ap1t^S5Iwil+K7JIILc%kiaW&*J~+fWm~{2@#KfSj^#p{HoPH9
zp|j>a)%lVhYBK+=>=g0)Oe~S?lcwgYUFuVLRAGN|6W>kNp4@Y%wU)~KQGD^Dx^>R$
zJBz>n?+6lU=?g!#$odRpNRa5Gj;Q;#F_{Tz0=yRrwoU(2a)$5hblJ|YX7f6~^1g01
z70xay{itXg{5II`X~pY+Q?Z4Iebh?}_P)2O=b!iYZs`BlR(o#=-2HWeWu@VQkE^X&
zoA<mpF?oWOmywp~JJT08?iHnW`nwi*=x_RMYL)XKvzPC6_sw1GU*&~eZ&j?c6P_Kw
zS0;Ef?`-M1c70tzZ{-69%3_jJBAEL0pF~afJ-Jz6+l9FG#j*RMCj83LORwm9?^&)C
z=$gUv&|<IW`=y_6w4FCvB48R}_3L7{5Zk#I8%mA7ur1&XzVYdRBddr{_M^#yuag()
zNhMVL-0E$xWy<m*Wu5D?As#pKE@iBYzg3hY?Gl-|V9tuTw>(wfwOfVa_lWW4Gu^V%
zTY2#AKIN}l;%b=m++VJ`bjdApy@~n}y<M8O&nyuxUH|og<DcIV=@;s?pWmwc`E~z|
zqwm(2ZWK+*+$PcaIpB-b>#h^WZm<0+w0Hgsrr>Y=Ma8R??%BU6TX)IxsQIlEwpvyx
z`hG9ZfBBRW*sIfPdgHvD<>nW6&wa>B{n@N-^Kr^$#^09TAFcVhYYubev%EBs!s#DO
z{5|h3THO_W$EvYs=k5>{jdgoht`j}NbT4Xmxw`r<?x6WE+#gAI)R!ttSNv<wH_CY|
z=VkGq)lSY-PU3lA)SSgS;^}qUeZS|d{L24ib^GJnJ(a=y=6p9NoUFckM6tliu%T2&
zC;II11CwWH9XS24+SH?DtIfR@r{&>Kz4;iFmM<}H49wS=5bn*lTKlt<zW&XvN)aj5
zar+lp-`TdxU|xEi(afB-pPxLoY;jn(b<Ng@%~K8)JnH_iEiUlqBpbDLe}tLkc1AvW
zv+LPy;c)3o3h&bcw=-T@kk7m2?FSF$hMOBF>AjpAa3$!M&LdkjCYQals-A1r3Cx@B
zuC?*&FHyDSar<BOAKtU(^>pUR7JF<K&9|B^p1=Fo?+y3VR-XU*sWwCV;EV9Q<_if{
z`sWyg4Sq;5^iNrH;@Z^rw}Qhbru(n^_J2>+A9ZipYwu5o{eQ3Zr@r^!zM?PfC+DlX
z*558)vu*R99XxYubi$+^Cv12)k2Ub!ulLdiGrIz239OVqD0)f$U$*nE^+Ff79<!-N
zUZf+u@@vG;RV8vd#taOXco`XRF49R!ElEu-0ZpgZ{tdtFvFXM8pW0Oq=PFwpN_{fi
zx%th*bBR1BKZptWDa^d-zC%v&<N^ineUo}Vrv1DhANsX@*V1Xa&7PY!U$o@hbY<1M
zb?erxU$-tU{kZ$?{rNI3bu*qkJXR;5=4#S&D5v{vkL`b>I~C9J?4r{Dme`zL)P1_i
z_IAy$oX0nxZBBpl#3-dbah{qE$NIw-vi%Q|!&>gWxVSiRTHlQXgE=CTb!2!VOr(}a
z9^9ki$-Tbgl8Sh0OnHmKqZcvLUfLuT2tL>=Z7-AjQtr0*y2U!a8@S%SR5UU4I`l7<
zOZLS^|I8^od)_F$7wob5V)VbLKsL>CYTu`WCSFY?v%cR5wBnoW_>R~4Z=Jw$aq+|p
z$&2nJ%vt)fU_x(I|E^7Y6N}z1KWVUQ0`EUnuRS?skLDg<sG}U;%P{X%hKy?X1(Bcc
zl7yaJS-@C-QP_Xd3pbm}FCHRi)t_GwkiU0I{qYU$woJ20`!@$n-8)AlP^Vt>VTMgl
z(pR%kfv%etUV1a8Zx&vWe!}n0<a(L6yubFp`}%+1|7Tyt5+`iG<L{o_5NNhnU+zWf
z73<rlKSu1ev)Uxmuuf#=^b=0&fB1VJ%$X#<>5BD^?IIH^);;<y!Fk?ZV8^|=s`otp
zUD?m)?KC+)Ys>c+f<A3`3tsp>YMNT{aZ*F)s|SC-?RkB1aYOyQe8zL-%KI(Oa%WuV
ztQL4$QeSp#+s)_EYdGaMmYg`2*(iLu`?OW8%$7-utYhtxUgy|r9-8rWrSD&L|107F
zGhFM=B<%aAmVWRji`C2DA!eVB+i^d(nG@F*`GPCsxJkPNk3emW+@aVLe|8-Ir18-?
z@b;}#iT?J<7W38`F1YeqgM(3%sYQPGL*El!-uy2`B%CH~KK`)xx%fw(d2Kr1-F`@&
z_-Lrl$~<{#rIk*Ru*-zD3mI8&Cd^`vl}b<K+tGM4)*>L?#)~nvZiZ;w6ox;V2ZSBc
zUbgt|UGgAy^5TM5KlqgXTw!eR>$iMVFaLl4gZe)=y!Eb}Wz#o2Ha(r`8|NdQ*^m7<
z@yud2Ro84*GGOSiZv7}C-ReJ~JTSb0McsU>S?}>{VYZb{XCKwCFukQ~_GS%}#~B??
zo_ZmcpEB>-H<c&<eR(v#ehs7dd3(>4moqd36U9Pn4Y-_}SGWF+5j(?qU%BQ3N9IIf
z)1GZ974JGW|M9!tdpUDP=`Mr2GlcDS7ga?5z9Ds3^7Z1XwBM_8b~b*vab)+~%UWGh
z+%r!EUO45q{YA$jZvoFPm52E%|L^Erwe6k9ps-(2=-Gi|OfPQmZM|09Y!s!ipwYsI
zYnxDB(OO&66%m3pCVMg$Wx3XRly$VpNXPEuKl0k*!+b$emKvTP^AkiQmfBZdpZ9|y
z-#6f&$^?DJ!_TZmav#awo2CCb(_~8i%X>AoZ;uM;-3!y2D>{AUk@-Iw?=IQ>{6o#$
zy|R4D@<+X!)=1ox*!zSj$=s&j!HhY&dHR7W$8rzX#^>wqxe0A>Di^$3DY=mApTu6x
zO&)#wc3iif%%8Ks!PR7U>tg#4$<+^kRBZ|T&9ot3cW%sM|HV21>$Ymx++Xpf&3ws5
z(W#d@r}w99t>At!^WtLnC6XG2whpx^4GYxox!z#hn$m4KON~kX(P>?`Tg(%FIusn!
z4c30QsrNtI(?`0QXX0wKOqUs-OI`6+IX@=U?N^-4Vz=t5sFhb3>aGRvQn(&<C5F9i
zD{Ju@j=xC{_*0fw-Kw7PKehAYjj*<eF0GdRYbF!~O<hnhK|0}O=%@SJCYdycTK-90
zYkK|FnOxP3pjAdcPKRk}bhB*xenc!p@K36?YUDgE4Y?bqisBY|UGmT7w_L4J?YTc!
zwQ~YUqqeD$SMRH(c`xhNDQO+DIXc^TNqzIF-77>MXp2ov^{m=to+<Qcr;7BtWg)Zf
z)+#j~s}}7&=;N~}$&BIhjs3Tho@aKgGPs#Oe}P`pri4?8#R=<7{7ddBY~CHjzo@^_
zF<IT)*6{&P{3T=k^N!5R?yqBG4OM-s9&Rxy+u*|{gAZKiMZ?lMH%|FAp}eB`Lt%d)
z_i4S=%NjHD9Vccfo4VDv#+K?kEpV{^%w=$;nd6FO)BUyPzLIv!ug1+S6cW^^4LQnw
zD{y~PWzvnbId*IjyP0bEF9poKqL;AXWl4cu=c5IGcwVwf{W`_$B$`rWB*{Em^x6D8
z)>&qX?n@q9d=anJ-)O*R`q@TYr9a6^@pji6oxDU}+f6nve%JBm9+s=F{<re{|Kst8
z-nEq<*I}3BSDt@NaDlzc%J^BWn?w&>R&xk32`HQu=X<QVxTuYXq4MUM#fd%1K^M9H
z3*G8=Nxo#HZgk)Mz3_o+d$ix(IQ=Q$fEq{a*Q-|5$B)l(-uI>GO3*pyXIDS4%;|O0
zE$^|i<Z{$|%s<;m&qKyq+iL1zUV*$Bvk$NNzI%7-1-1hlF1q&Cu`pie4Ee;?{O?Zu
zz4!8O%6K(qiZkkO*?HE=`MELEPw%qmM=kx*r2=Ve4r*LZ#y06M9FmrYC~<u@p2pnD
zD6>5K`2Ck>B_ns3b2w_+nYepLAF$dNTIZW;b=Uo>rEjRGlwj~rp`4cz9nRm3-mlno
zDt*OMnX2S3HJ+}|Ynk-@Oy?`juYQ$$^Q~^$>_t@@lg#)!Lmk%3-1Koj^T}Luxxd|&
z#A&^sxHZg6?x}}+TKV2cXMDJAa{2Zb;-S^APiQXwy6BB$`)3xdKQk2kC6;-_zPJ&5
zlu>T>qH-mlKP8hy3Z!$UF6mc(%6$3gL9NvVi<M+Fmj~_LrFi9g-XxWX%kuO8-nPHd
zS}wb3>-mRorP^)V|5?m<r~K}rQ|-*Bk1zBeU|U&zp2ss!<7QZ$?#F#gMS`Um?*3f9
z+iYpK{ss$yr`9iT92WXh$9H=2*WGOIovl4S+A$tJ_2+;D)5V6(9n)t$7LhoS_Gn7?
z&nex#n&DedoGS@iCZ%P{|7meS>@A5en>;`3t~CC(<kpr+e#v{?QnKR83=b+wKiRzG
zLtcw?`jq(Jx~tYlci3*bVPKP;;U^Ms_r+?1)p6<X8(VfBb)WP5R`&^wU(()(3>d^Z
zE$l5ScW*c-mc7Y#m&@-R!AGw-C8ll5SE^%BX2^|6I2xvPdpF}(hAW&QI!9J<NmtHa
zz$UQ%M?k0WguTKUk{*ftAx9q?>@sxt=srv64Oc;)UEktGk9YWeFWDURH&BdkV)%vQ
z7ff%yPn`19m0x<o2G2!tm-BO`zDYT3Fn5v76NyHvd~>^Ej_n?yk1Bs3G)fB&kk-4&
z>a_WZj!x^n)$$G78|I$Bk*E1;m6prhxBEL7-kT*?J)85i-|<M>ilEY6&wkACS#@p3
z(hS=}p{ykmliT++hBoT%JhyCmOeSOWzw~YM9~&`Uy7TkNqvu?&etNNLwFNS2uus&M
zFx0hVh<yIxftHTAyi85OJr|R6zApcka)n=PKbEuS#jPJoi`s&ncV3#5{Q4$84@;y#
z<(uou0Vf;#s~rUv?m2Su3+MH{f8<+2@83}Cm*93__njxZ_nx^}^|d`Yyi55Ge!5}8
z?8>q0eX~<nlFY`B%q1sdH#y(=v0mXfOSL&ubF$R29a%^CzTN+G_wMi7{uAPX)}Bl&
z?j*M#m;dDxT~e*_%)Xp0T(ey7YG3Bg9apCQ$dcWsD5$ffTB%`5!_hB_;;+rTiw)Ad
zyuaT$eRAWihwB@eIcvrBpS(D^CRn@r@=-3k$^Ig?mkhEDv|ol<*=?=<*%!QK&%))~
zmo7W^di@7sfy*n-{`;^wIjHrXcvk0h+uL{Ulz3b{XdStH`re9tEAvh*SAHkCZ1$&@
zr=@>R-+u0v#A4m66NOXF%vu~YPdAmNiLq)M&uzHFP%2`#l9jQ8k#UzL>jH<A1)KA%
zcQ5I<bgGi=l&sOa*C#IfDEf)NdHXSL8e>-D-H@mV)%n4qTLV^Z?AGhO@Iy?eXhpTq
zE0#@ei+8e$w*PC1a!c9h##K9Q=2Y+Jvm%t#=lxJTr5;xk<I|+^RI13`Ri(wCyUQnY
z>khNyrBM><S7LU@?$tcUpMQUTj%9>#!nL^y^^EHnGcMe7nEhn-&fMt4&3kg1-IAT9
zqJNq&?XK;fnsSLP`anRbwUf#56<KdS<^M5J(A?^&6MUiC@^r?dGi$Ti_h+m-e$)0&
z?LVFpmdvLfON2K)e0o}Z+VrU_56x`}lv6#RBW!==gXE6gr|M>1KXdog35|yhn-AxF
zJeW5>cY<A6!H0(d!TI}wURUXyK7Q!Wjj;R=lE18{#3q$J`kEJ?ILmFCqCa22xp$lL
z8P8hmUNCEogV6pr7Vi(KoY{Nl;ilUsGZtn`I=%UQ)7Mz`k;(Pd)qkJaI!8~xUiR3&
zcIQTwhyVHRpIP{O@&~qvS9S}Glz$7p|7*hRd{_I>0XwEStP^Tx-4=>||8aHOvj?t+
z1X!=lZP*{fa%Wj!c*C4G+vR1y2q^CT+Nd!1=bdn|Xcn99V{_L9o=l8Lk(gQ7>e9X}
z(RpWhq{OoYHEma?DY%v2lf8BP(xoe#oaS0Hx9nEF%2$+MBFB~xEdOxz;yUer`x{Pj
zf4Q~SP4|KQ($28CUna}+s5oe^dn5nfZaeGaLK(Xd<9pN3-ncpce$U_g<<C5JmtC#A
zDOQmD;OLU@g$2(`<(F@q?)tNf?a-r)by+303x7>c^LyrAKGFM1<@^-IkoI-bZg<~k
zRAl_`wb|m6{#bHG&*P74UKhO2jIZP{*}sxQMPkL(@)uqEuGG#~y>Q&NC@dvVK&vA9
zS5&%c&%`N)B?nGT`}A|ewryoKFH?7%FkoUjVipi$5UK2JU>?}(8oIDw=151<lX<Gs
zZ+k>6xhChxU}G^MNs#$Z*R|L!Q@dWKK8aV-VfAEuvFF|AuFS^Drm75^*NgP{k1pzY
zy60_>6mvn&=BCAexE}WGDOmSr^U;rQzF+u}|FU+SP?TxL;eFErZ!O=tRk-5no+ByI
zb?cOO7xMbAWxu-bq26Q-`43N3-}y|p|9L86d0eHDk89x0UuCQGnLhI!YZ2~i7yh1N
z#^)dEV5Ga^lY6SbrVsazoD6;IJooGL`%;aEKWsJn<K2_d9dhi|!cf*D6^y|i8V*Ui
zn_Oo8+jg;Efm`Rf=Y+szm&C3+n?0?)nyirhDr~R){z}$8%_mnUHJ*IhJZ*Z%lds7O
z#3kQwzc?b0HSJhq$5A~;PxE4{l=fN4ejhW-d=gLWajQA_F#N{fs-rKjCSRVAB$`m9
zyt<Ri<${UGYo8~IPa2QbMKDfTeu90%6YeNQ`9<?*=Qqz-ba>`_-We$zVur2%bg#Dr
zHttaVQ*$DvqdvjFRQr&0)Yf(1dwOkeEq=f`E!gQ$|52xRCSA$<VrrS^Ix}{voqn3q
z68LQgM@28=)67Rr|6&@A+~n;Gt1s%Zl*%ptCpx<-P|-RpH)3MggM_oT2h%oxs8<(M
z5c#QlZo<Y5^Se%a>fMrBq|dtFaAWJO2l>|Of44g+o=I(~i|uq?>CUKj(f;tc8v@=Z
zI94ZG{#e7uqQ6k~#K}oZZk}l8T%6WlKJW4Ub342fJ>2dDie8&?!Q{hE>0nd;Ca35A
z%immC`9|A7=K1u$=J|duAIi69^BP@Tx4UUs<X?dY@%t(cZ1aAw=xh2`uC|vdoD6Rp
zN?GT=?=9?9vEGxq^?icP)#VQPPe0uBWG(-(!?D6{=L?JD2LdvJdG(xn1FM=RB^cPO
zzfn}hRkycjPnMnCo>_l3yomf%>;C+h*zL_FUC%s48~DG~-hRJ+wfy47`};nvat||O
z*q3{kNt-8FjjK}a@5Mjsreq(I_cfnoKdaknm*(lBdXs-!e=fd$^W?r&zw6G5?zU0V
zOj#{@FnmXC>YJw;n(132*;obgnhuIDIMS$Q$SBs!?XIG@MmOqQX`GhqVu$E8Q~6%)
z-hGWR?(F<^3)Y{T&v*4q@gnKIrDmTQTwj=#t@<NkZhKO;ZAI_G&CU9W^+z;*FF$5f
z7J2T@tQ(EzO=5fBGas43cp*Re{(4WN#0bf^?&VxFb{$UQ+QwPks?+A9b=NTFEBjp$
z>CoriTl3VElzVm+Z0~)@+RMtnYG-!NgGX8xL2n$o<u^~hu-_+0VbV<5IT2>9&sR7+
zh<X<lyg&0V^H+<;$F66MmYSQaHsfMrkyDxO&HPGf=9I+jM{}1wnZB_<iZyl3T-R-9
z7H6$2Q<k;ZaaM=h+~tWL&nAYKR~)Xr+_!M~mNnAX4<&xk(wwo2w^fDrvq9R;(vREq
z9`2BPvb*|YrP;};xyu&q{CUbQe8mBSX-~CwyFE=Ue-<j$nOwZxZJ(c7cXUVVmS>U&
zLUu%yX6tX??9KG?V)PO-E$L(H&*rlpwf-75*>k<~R>n7)hj*`=vat8=WR@+u|Gx3a
zZD0F;h4X{Gx2N$LC(nA{TV&sT%yq^M_3cW$q3c*Hr=-sIaN$?_-qfJ<_NYr&v1pJ|
z+W`j=)<xmHQUTk&vX4F9xbe=sgLbKm<$;Bcx=D95L?m-Ib7}Oc7#!eYe<Po|e4(n$
zq&3d=3iq3)if1VG9$cX##dz|f*;(}_jq=9b`33CPJv-*98VJQ7T+GK`cB?Grz9Rqi
z4R-TiU6MC!7nH4j&*uLATio0KeEip^JleokQ4&~nZR;mS4K`adgDFfxmw7+CS!LAU
zwzM;`(HHv^o|4a#w033bB3s+w;MCn(Gj?Aq-Ffwlz1{t1=NDRTUT?IwY?I*Y{}<{%
zJz*C-wm;*ixwPUE#?}qYt2SSFI`@4_-;)J%`wvcj=N|s&=gfcq&e)Zma6dlj<O`X-
zOTTP;J>gvXBJVY|vqCfF4$HlbQ98b@c}k7kFS%dACoccB*zcoW_(9@uyTI~|;;MJ_
z--yQWfB0y-&uok09xuTMJNUM%`R99`pL$W@yOOthGEY8}$-Nh6tyiDS>E(=k)|rrC
zAjIzKaPDzk^9>`1hugNOB^-EMQo!qzCtBpz{{865JyPopA6;C>>-C`X-J0pny2pH<
zFi-d$uVE(gn(N}sW1`37SY@hGo%_qSP2*%0aFA;{=TcX9=kHRH^k)wg7;04#&V|=h
zFX;N#Ql>APdZXu4cTi#9MfLK+&OG-XuZLH!*A#v`#;~~Ue8A(SvEjlyKAscIinZcM
zl{7zJ&C;QsI<ew(v=Qs^+BLr(*lqJID=`dL-?dXmVg0pJYh|Ki?AdaX;!jo@x$oTi
zwe9`M4L-llrEPCoyFF<mlVQE=(#do3HBL$I@OF*K5S`Vaowg|K+$yHG9h@5?7=u*B
z3)yrxbVPJ&`u5J$Ztb09Y<1xGt6-}&`UlfyO}$<zv!dSN;Htmd+ug0zfA4=I|7QN5
z#hucw&U(E83Y}Ah%szekKeuJ3c!!Mj3<KA-x+mBj&WQ$msr7y@8E1N&JI?pqbib?h
z!IC#z`^1{|Ry;e$89(R!{|nwxKhFQ3!*FH8jU?IcAJ5<Ab^jvdC9}`oqEWDFbNFL-
zmSaLw{3bB$Imb0`Tc>bfyp^z^*NOQS*D}wfmhGt!JKgm5NcBwPuI_Rl6M>w7l<POM
zT>cal`#o5&*L24@w;eL&a?@^yYS#Ci(rdApv}?h$<g=Y;o24|$4|8bBrv{x`Xs+eI
zv`gaL4F0MOar_gu{@C^<&h6>1?Gq0(=skb(;m6O-zFf?YZ*65}dGUFNf$2J1yN)kw
zWDdni`n2Zrv}LdBI1v?hPoi|smMb4OZS0%g{pv=#^?SZb)}@&argPtfuWDr9X65(o
zd1ygJ&6h_z8<*}r6q=ClZLh7iAn4{xuZ;!`2U(Pr)x9pTUE0?uDE?4%!m%GlhPB$J
zbMofhe4fAc&gES<rPagDI?lgR4cCl2t=aL(e&;2bNpGLp#(l0}Rm^eSG>dK5);(r-
zzwg@X;CSJ08n=_;(tRn>A76L9Rq3|bEo!*0Tvjbcm!p*B!oM1Q=5M|q*-uqHHRQM+
zCv<dU`elw++K)uGUzbr_`Nc!$TK-DUX{pmcZJTvy-O?4=MKhA_A1PC=HIQChcjssH
z!)rI~+Da`VPh3CB_x=8!f4wanZs8yHCe=AUjJ4rvG}GPGosz^jReZBWO5uUnB9Twd
zwk)k_y4-s!eA9Z5NLlJ|PZ8kp*m%2NtgZ0$gbDY4>|R%RBgAHpm<FqEPTicg>n}qk
z5}x%6T>hB*`G`pAx+A5|#+u9bM!xvDrqcJwycKHIA8waTHaA$Udgn>8rTE)}FZa9-
znz8s#;{E<hE9{*;i!XTDeto7Mv+#ITnb|!1$pt@aj!bW!uK(tgw&~K|Pg>k|6PWLL
zX=H78XelqwiM+c#duo2XBmcHOJD;Api)*)4x5&lBx+?oUW-RWjnP>SudLi$fW0z;y
zxjcMtQp7H$$t+*`_gGET;`Y+A2cn7*k(bW5|MTCsyzirLX_D>9ZFc+gYJa<OCFwgX
za+t~9BD(m|oJDOW@3V_;vP$F~xRF17^Zc8Rvsi7uYet=|yqbCIcul|?8(qCt#p$0H
zyy7kiNorr49lhnQneX}?(Vs=4Jnb001L7Y)c`!eE@qs7i^%r|;U$$)Q-dB8qX<bx?
zPjT?)J)at8X(Yt{=+0;^xq5rAYJ2Ldr}C4}7kr=o=Gx0Jwbu&$dP4ns_TFX+b}Kn`
zV)w%NxBatkish_!diR*mptb()o|=#P8&p2tKP`Uu+{^zwWoG~8Z~u7yZ14Vge_#K9
zU^OA`^WonqZd2UT8Sk-Fd^-I&JL9I<Z;mwP-w&Vn_m#-IbolK3y1mr@^PG#)q3jLC
z-nHtllgcuu?Az>|VVQox>h{S>KK=_Amr1hz{1&m_znaD1^`?ll1q<BzBBQ2>?dI6v
za@S2TU-p+6^XeDNk2Xw*7W6xRtN8A2&BES0*Du^HVVdz;^%xI#7WcV73)nPvRlL}E
z;rfIL0qZs8qSr6IA6&LhBPsQqz}}x5_V3;w+$U7Y;eW{_&LA#dL;U!9_rC`pC0;&N
z*LzWW_5aO$N$k)3%KudqDlb{O_R^8i|9izQMBkWQoZBnLp}Mw~ll8y7$i`cFsgLwE
zKJ@fn*mW=NUA371>f8HInLY?Ry+6M7xx?P_SciW?d!FQV?|WaDzJ7ssq4S50MJ2y(
z`f}T=Px~e1+$>rzoLu~#_2(|ZJ6awweZpyzGCKBG1(Y*~{8m3=uQchC+nM>&i>`zp
z*uCbLf5-2jNgY>1SKAog*PR*c%$E>3Rmv&GH1APS)W=EJ53-kj7hBtK?Q`~u6j|>z
zCXu%yJkM^7sn(X)zxnOe^<~njr^-Dd7U$TX>D~0yaNCz;zl_|aO}md@+s3yxw0q$+
ziD=y;*K#6?dva5srY+S`O3*Ey{CdGn;b%OL4!pb;rp7qW^mgMOgB`UEubZd-DEsk_
z)B0-Cj&r-d)*f1%DYK?6XaQ$w`!Xf*#nbd1^h^Xy0>y-S?rpio5`0M9k<Wr5Y+e4g
zMWJB}mdb2hBzj}vd5?g=1?dsxHv?s=81jskwfx##GAZ-tRqM*@YbV_)5?X1cFCS*I
z)vI~&qC&A}`!zo=(C&Ym{?*iKTkmI^XUjK57Krsd`Bk$cb<y9-lSKvG8-io=uHD|O
zvGZK>mJFMDx7Gei%=vBZHRmyh!&S$=f_#n2&;Id89>v53J$xp!%6nOBpvxwOrM%~J
z^1QPytF8Cx{-dYuV-wZ8<gZfnQgQe9*PPxMD(-0iIa@+5?U*<V@6)1K?JjY#+ewF1
zy%qUA0#?0JI9#)8YW}Io>DG0i0gpe0k8eJ^Jby;fn@@M@e@UtQ{~)d~gDG68e{a$T
z<DC*VzY9OSd3o)bfAnmB_P=*0Gd8UZ3)^;Fc;)t>E5@59e15ll_PezH+5`6QE<c}r
ztuHK0Vs{cZS6auSKY=;C_VLO0HZ<6+=e&?@%ggfR`6Tsa&t^xsNr+mXbCUo0eAb%S
z#vdD=WywE&Hp9@fTr>Y@lwRJPHp`}djR&3Qee^Z|wY^+q%3<U!I4|sE|ME98D{dwH
z{l44!iQE1zu5ZFyo*(Tl3SS~ID^|+y+n=ZPJN4_LI37H`?8fl_>*C*Uma;uacogsY
zan13KKN&v=JhyR`Qj<EAcRs?e^JsuoyG`caZ?>&Z8(V_ASH6l}x$s3KxADfbUkf*-
z>{{qr^-5+|uDNF$+i^AXoGcm9^`S2hd%0>!7G7p*yw_K$&8n(WXwa|pb5oRWYvjGQ
zeLh<cpWD`Z`Bq16zPX;vnX4whmaM)Mw}|8LQT0H_%<mm4sl3rSZ$IC<e`D4S>m6$E
z8`vir7%Vvu`MqrIqQxQS<D;i?O#2jap5^~rmA>HT7jCk=J^ZwK@sXVMXPg&DbLVlb
zKlMV!@~&I+xty8;t&J+)Z@2GUZ?XL4{|~c^e*Cx<<h<qny31PJT_2BLvh?dvGhqHa
z`}?Oko6_>H9nw(~iu&!N=9{27+f(%2pF4^by3_4l&T3~bxpc=xslwL5NN~@ZYCUNK
z1NG$`ajI|c7_R5o+J0n(!_*TpK@YjEy${=49TnHT&9^}2Uj1p7xbhCCbxj+7JA7Ex
zbM6yo=!)gXUhMHxyWgI+@w@!`-74iPl;@-iR<v?GRytDOc}5`Q{Pk0Ojnj`xR{rM^
ztgvM{sduMgD^t+i!?GUl{(U{ZZ3&yJ_{1CgwI{tZZ0%R?T)5+k(zcIT@<-#{twTP@
zzBS#ldckt7$2mLKC;bfEdHi43uLW7N)x~(<9nO`Fz3IlaXCKSn4ukvOjwqVBg*;PV
zyFQ%r#ckEe?^QlAs0b-`MW+A1db?bm*Kh^z;g54AqbF1byQ-cw{P^elQ-PkGkJgj2
zJ?uVpolfTBxb^#Y^q-5GZoJZ7Tkm<CS+!n!#$T@3tzUCL_Hk!TbJY28F+9CTcYB11
z)WoybV;}we`0LopikrRCOrp0oO#iL4um9iv+b{UDU)nrVVG*gg(6(>tZ0FudSM4`E
z@)4<6Yaq?a9)8}#Fvd!mwS7xY7}p*t<6wysYu^UU@qY5T<<lL0-$z@PZO!;|@10VN
z(sS0ht$V~Pww|bMydLCrYLd?*|Am+K$hMz6Exz<+olR%ghRCIcGa3K?sOx$p<niBl
z)s+0QIDNBv?e2yWoA}3p9G|pKzn<UCe^!9Il{@&<`#t|&J(9h(LBVpXW!u&pk9V=m
z-_G|rU-fFZj7HV;W}&ScdcOR*{CAPN?ACWlz1LKJFfjhVmTdO%<(>t;r^Dm-)bb`S
z)n&Nz*2gn@_1OsVHLH(T^nUr3J-_*fz(k#Z;<qeLZ#Mn@_Gj`_4(C4Js!W-*6Bn<W
z#az8HWx>6>>ItF`>K+z^{<y0au{GAfd-mj#e>Us~U+}-*daPgf;12mE*RP*+QIAa4
z7Bh5scSDRt$LqfJdfPj?n`>pd>?_iC?5ys6K4bIQvX^%!1-}y5Cz_Q#`EbzUl}6@I
zg_fk&ZHe*oUi&U}b!^CE^U05bcJjaS4*q`L@@A3UB>|n8F_+vf>=FHbQs*bDq{m&~
zfRjNfA9`;!`gqTA{&)1tEB||6Uu~CG3|PthFMfylvfv8gV}Ws7?mm2}V35w)%ERFu
z7Wnz@n$459@6HdkTchZ+uK2uu@cyZ})~qs>lXsl(uVg-VfKAM6mf=aU%m^W+x5}YX
z(bB%BuWULc_57lfq$2;<Uz3$ozGQFwI6q&u+=IQV#EVh!){VETE+1NXe&54my7MLM
zS}MJti+W^b?pd`Xv08P`78~)j>coHh4CUT1h3c>JsZw3Vqro?s@8F9~|I_@RA7u^D
zv~{#tG-Ww+`*u^Q<sWB1-V-4I+K%UI!8~o}<m5dYWcEJuIe2&rudtzcA(J@6q^%P=
zc7_|)Z^#v@+c)Ll^B+5NUmu!tx9jv9xg3L|?^5zY%cs<9E?&KD^4_yQSG~>AuQhI;
zzx(f<JEs)YW*5&;dwEAiWoNhRD`8IlyHUc8c7MNa{i)ES)3cK`A~bi+%AKn}S-py0
zAvIOR(s94z)dTZIr@z!PcUrr4t*o%*M-IDV+8XA!4p;XIcWf_`Hu`JS7W|mE*=?J{
zd`IWrZ9Dhxxo>}?R$_htxBYY}#j~5Y>a3RBl4dHu&!qq72ASf>9gP`tZOhGh{SI{=
zJm-CD<C@ZG#~h~~e^Ky$#<FN{`#UoVj|9l-l&rn=MS+VYu2hxDnP1Fs<)!*fy7~KD
zyPw_a4$r@+5OA`~?!ezkV!f@u8H$}2oI6~g=-9p5v}MKK&%6tdngwK^eO^-REwg#E
zls89vuBUf~p}ym~#)j8>PRw{}I;nEU&%JvZ6Mh)ToeDXjc5B*)-DggfGbGGA*dUtG
z|9;=fTWWJ}uaLUYpue$pmidY6MWQ;VLKs4mzOzfnZ{gjaGOMHS{q9Sls^LdUzy4I%
z#r1R7kHiw;&d}FiqULPAd9B`AIeyvGsINld!j~hnGQGFI*?;EMHCrE@TD1h;j)d^~
z74xrO?^m8MQG>z8?5smv+m1}R>BnAJ&v#$o%DS}4e-2a1tI`wk4_~;nPR_niv8{Ic
zU$IL+Yc!9|^PLzfqOkEP=gcpKGjFu$&q~mqb?)JleAefOd=xA%*Vt(p>ZkpGz&knr
zT)L=-Q`kk%CdpUqC2Oo@139{w-`&!9!Saab@aZ?{!D}|l`gl!heSG7yvzGl{pT`07
zOb(n+4fmb+oIiyB(g(xWJvOl>-wf`aR^ew>s&|r>_TN-EEBy2O>0A6iXwGg-m5Nx-
z6nFJyfa=Ltisjm8f)kck>=9cNeT(CM(jDQs#Z}vat%IbFM=>wlD;inYv82Jd({RaE
zQMsxUdJUV)etb;W(t7o?w!w#l=O;NzE=Nv3z;O0)2uDyM8*}^zMZGgja?vhlOjpfg
z+kVboqBZW&W$xBExraOTgY(<2teV?+k!f1llT#w*m%6?RH#DDi6O=vuiSzusDU%!g
z+@HC-hw#t4mUT?duVa$!tlK}HT5buJu{xOExMIz%CGnRtD|$CAUBKCq{pskG3sYh)
zXx{KVarr~zs`(3=m>*w%&%JwP+o}NHyqojn>`kW3U&s4PSk%iY<{C?6%M%O7tBb0P
z%tJhS#a7&uIP_n-Fd%yFr%92=i%%auY~2@ew{X{?`h}kQr+?k!V3}zB)#%Qh9R62D
zE=i6HWUUxvkL4}azdk|0%HLGu_@Q~H4>o>Rc3_c<JGWIqVB76SiJUG^wR4yzr!j3*
ztp5J*#}a#s8?KD{q9zNb>o|3<Szh>8aNQqM#wC$Ux3Ffp${o|FYkV4JthUN;T6=C&
zp3S_{T^1?#N~I3A%oT|{Sl*R9r?`aC%Kc2h^)<b7S8X$_nm)-}kbCoSg^T^4O?tn6
zQ2zTVX~y!MO$7{RC*144T=hbEUVKzm;y2TvtA!cSGgzMFv?vO`p4W8OtM{yEmRUry
zg3_G4>s*`OJY9J>d6jI=1JAURe*<;(O)P#bSQBQm_VH#zcGpa=Yf}79i)-4fwzggA
z+v{$zW2g1EE^qN40US1lZ>Fqxp>(jm?8r~ky`MB@-+uPvy+ThU=RrFojjI)c;wgz=
zKU9XUIm^&>aTAlkF83KvPMq$1?&ln3?VfkUefg8@69)^lj--|yd(~Q_rB*JMUu!J3
zDwmyiN&ht-!@ayKihmc^WS_0??tC4vFJ)qVE9adZO)OnnXJRET%iQ3)zUzdTSkmH!
zXJ4<_>ASN?QZ-Ppvha(4PnE|ZP3JlXTP3+xojryH5j)H`3G};gElttW3$#hPye*<+
zV#CYW`B!Z=w=O!hY>im?tOr`l8aFI{^<oy=WHa`vqC4BNgO|JSopXEo&gnhOdW_od
z4?I4uD*fV`fc5rMX?hoKd|&n;YrjzR-k9$uDtXczx$nLgiAs1FnPwHKDi^G4;|gTi
zlbSfiTU95$Q|x5aGdZc%AC)d7wO{nTymI4fCqq3A<HZ>%C(EDse3D>y?wY~sG37zZ
zDc;%L^^In668v|U{apT2V_I3jm5;BBE?!spacjd{GpFl*e^N@1?7BL!Ncg6KHHT~4
zp?pS_kor^aG{3jIx=PBZnb%!ZGuX(urteW{%7!nzOK-8bTJ8_Z3AL}_Kg!P=ZRe-S
znw2G;ys*uC>7F?GovWt#T)q>`61!~T6#r*AuLCCEQd@eD&v0YFw02v;()OCaN~*1s
zW;1Cdd)h6`W%T%^65FMwU=+Q`>AObH=8_yA!3y`JXbI^$S?w(GE~Qn=)1PiL?!6SV
zz%#LdBX!wn<>)Nc_bxZXT2rP<=Z96WWgk9KfBJV=Q+xM>mm3o}`#)MeKIgwE{Pe<E
zwlj}T|Gh%Qb-JpAqS>R{A@z^{92ebi*4WxH)2Ko7nS3?tx}6+PH15w{pZ<XL>)o4K
zk8g)%9(Vt_HNG%s^?5%=sdc%x&VLH&wkWxz+P*~hp~Tr;Q!DN~|1mwzHE+(Zz-RtR
z`ofDRzxEc~C8^8izf^J_Pg_Zm=+xymI^O>BUTeSV=%)K8YJQe0DfYf|S1*{-nKtG3
z%Yqj-4h!FCRxjkw(N^9SY+X=(c7@^+>8&-Hv1$?NZYC%5PQKfsv_J6QTScCS2lM7H
z;i~2}pRB@nQR<<QD#zqY>v!M2ZnwSCA;ikMrQ+qn^jed~w4RdQin+eWN{+C|NiOu$
z2-M4+(RPs|;^gMD%k_7+t>1HT*WHS$Ygg|E%Bu6Zb%Z}>`d_B4x583q?J>7@zM}=#
z`FsAZ39ak?x4+}sq?a}s2Yx)%n^e)Xsg>X9Q0(n2g;!;hzEm>S?{s7DZSV7#VSh)q
z)1hF7k%U4?y6c^({j)go6{Xr1Ojz=9>xG$5SZwEe&JF5L&*ZpZEc=9a_2pZ?jN`sX
zie{}!Or1S{+UZB#&p6W_TueK&XTzQYM-S}|i>{vg%t5YAdEKjmW&F)u^Nx9W?n`UA
z(pvnScS2c#kdpbAO*geme5OU^_Frpgx}u(|#iKQW>z)4GWs>1B7q?m*oGMZ_=i83y
zvp4z1J!K7XkeQ?*Hhr7cf&*)g&-p#4eS)3L&p<=ttr0fU1$4t1+Wr=?KInVQHg(TF
zgUY`aXAk>D1+G|=ZF=IUW0~}CmkHmVI@gymo}WD_Xvy>WC+6>tO_x0U?xon72pa)T
zubY22Fa6micY5L7k4K;KbT*`259B;~^sDOy<MwmMID$VMfA}r^6;H>e+q^r=mmU1M
z)hK$#_Reb0X@7cFZ$5VIMfH-(mA7wa)SIR5jM&#L^!B#zIu5OCFD5;lJl!VcMZ8Os
zlWK2=*AB72oEmwY^Rrg`_$apg=9;``g&nmI-tEZZxpY2miR#r`nPsUf<v0v4P26_N
z@p>C;TBz#nDi`*OEA7rcyb6;|WcfA;K1eE*Y&@lUZeG^L&;{;MkMH`=%(|z%HCC#)
zs9r1H=Dt~qWcmD97T)e1L27&b)XFAqNq9WN^3~hzy=x`riY?KZ|9|#kuKwPesq8^V
z*W_0(duzS>qH9Qn;f)!e`S-Bf)`*yJR)_r9$6Xz|$@50BOJkRWi}MDX35{CK(~rJ%
zee${Fs{P(2&px><WMc{X`s859;_3Ptr&r`XO-u`%m|l|n<<HE|YqO>KmF|R}*(rTw
z)5(j~SvfkAM`owKt)F%y+vQSy1H%=i!f;`i?gjgF=cn2AwteS*w)Lke=c+ILvXA?#
zbEVY^{`+10y60f=q1WuW<&yO${~k37Sk1LMJUUb3t=+@L+r-o7zI~!%SAXR27m38P
z>HSXyOZr>w4n02Q^xuoyT%)ldeZI)Y(yvP<`?qDRw_K;7Jms15?0q5XA(d-evh~Bl
zZ#!R-*wQ`8{qb2}o8pygnZKDNt-kLyq2g!8(>v@5UiUt;y-S@a_q+Y$Y8&U8<u!Xg
zzuWMz_ie)`)fp2b3Vysb@^N92e{Xg!qpNFK*z>3~iLM{Yr}y&wc>K|XY1$LlONX8x
z-`63<xgh%M8}oM+2QFPLjb@ndR~i4r`BT-Dxq^lB=WV<;r;AlR;7)VVOfR!;38S(I
zZt18z_LiuJD}QVfTX%uOfH}wMrQ=hkLqSUphp(^sA7&8gto+Aow)^6RC%T&(pPFQ(
z+mu9ZXGxh-TW6`c=*HYQw|}av&l4hIO(#UD+pPGU@%%}6ZlJ*2k520(?{}s%Z#wAZ
zJEQMIqkNKp-`vGIdr#~UG<qbHI`ebd^B)_MYC5Ma<k@Jl!@ca@wm8L`R*y<QGc|HN
zkH7fr@9$jg!WkC#UN~-h-@p3iWsZ}Fj1AUVvVXaoW7TYO^r-pv<j~s>uWYECdds(O
zisZSTFpeL`=L<6~<+yyo;hyrDHPav8Wa|B~a8JVfS)3=1JWMcQ6{)((G2y04(CcH-
z(oeKbgz2o_p1bMjwSaZ|;xyk`{+m5%=1bG|#~bgr7|dQ)=>8<pw0J}N`uB}?e`-{J
z{AS~Qd@;-P@>Nam(`}`HGD}y_+Ekyh>iY-oi2j4Oy_v!eYNajdDp@n_qt&zsnRN|~
zJn~2VoW)i;&khmvdmvv|<}!bFw)6ZATb(NY34}5!Z@J3e?|C$5-NvrOwU>HNyG~ss
zm;7F1eMMb*bm-d2SMM;N>`$?|{oE@!|Eq@7jQtA)<cnm#^-1kpxFTvw$WrA==f8$<
z$7HT$u3K5cvU<|oV$oMePnA3kcpKLAM8w{%T0nEtxw!q6|CyI6gx*Y=*vTz(@b}xw
z=_kJKHJG?@W2mq97vD?n>P|K5H<?|$e_iR?Oqt%76ZXFQ{&r?c?|O^FvWXRS?~>jH
z9W38C)g?hW|BO0oDZ`7J3G>9`rd;_Qa68Mrw{3ROjm-0@0`vU!63X_?R_WYuvOxcd
z*zcICX&PaV!ZvGGrrd~F65_S_*Bh;JOJ>!8D@V3HR#?=ear2z|b0+?G7yn(Hml)X_
zYsc9k^l#HyvuO5LjEaK1ogT$^X6GFJaqak#eMKod+q6=x&1AzH?bYU2UeC8zldiZc
zDP@(#D5V&{9QK%PkJU@TTNf8UW6cld*#1qN`_nOQfrgoKyDL7mym#Fp;O?`)*vs-^
zV~OFB`!_^-vI`7XiM!4a*AhE*^Ty)b?*|qC3O+jW;J}iZjK<6nNwej4y^vZizsu`D
zRoCGK;b&JkXrDM>bot~_RafE1d%8ZI7Gkb(j}bd{cV~0+T=Vtp?bhy6BC}F|2&t?3
znoWOys#{}u^Kqs-iF21up0j<{W+lPns}44HO=&ie>WaNy^t9@Qt6{FooGRn*6Fa*D
zO9~?=Tv+@^Q0{TM)8b?=nNJrF_r191&Kl9&!rb)w`<`byyRJ1?R=!GWE}rw~?96-9
zgl#oSo}6vz&XP#0da#@8#MY1#7tGf=9!YbTv^vPWbN9uYAC4z)D|9Z9x%FV)l-kL+
z7wa)donLU!;6?;<CrhXBY@y5<0kR?~7F{d82k%+i=G-HF?8D7NcM7-q6>c)pYc89d
z{Hi;!(`u>VnbZx-_po|=F@Ge&5i@Pwc_C+p@|-oRkN=Z9=V4GTy<@ZG#>~>D$v0Kp
zm+2b*k&G_%-qOCAePYjg%SH7bKRHUKzge-?y=k&crR15-GQ#2)o)yj6n{;05ZH>s$
ze-Y0&+(<C6sH@&#e&cR6>l7m{c99c*+BMqlc$D=1T`2n3*~{k9J=25PRb|O}S5H3C
zPEE<bUhuIi=T`ToXeJ@~bVXgeq)g7fgAMk^N5UF5of7<8BIY1^vP7^z{OcDlqu7g=
zgKPS^=d8%L?v=NX{$Y5R>-nk)nn6D`L>IC~ehXj0Rk$_RGqpoqa^mdD6>IN{DoI_q
z#x?PN&-ecYQ(q{WNdK;h^4h+zv#9)S+xgA*JL{4+HNBVOWB(C*IC9nEUa52Ca}WRf
z*j3W!x?KP2$GlT-6kJs-lOEqW@!O>-yrxI9$m(3ehhJxZ|4V2H*`vvkETY=W%K!cT
zp4xOVdEw8S#O-fczWiUc;d|oy1ApAgEOmFtuXXNy{c%;b%o3g}iXlh#?RN@^Y2nOx
zVo}R>K!S~ThUE+HBQ|%Zyw$UJxqXr8X^A(_s+LUMFD0*Y<d$tr;$D>Pp`G}BMxVoh
zJIMQNK!@SxhVKtw#mB&~HH?8l9@mMLY57GZMTwx(aNov6m)|xMs{6kFfExc4Gojj-
zsw;QBx~9E*-S&OCZ_I8k{_!C|MJ3U9ViePs#m|21f6wDEfx-1;QPT3fu&NCn0unsW
z+Va`9%$xjq^WN=mmBlX1xcn{ABl%!k&obFf)?b?qbKmcXmOk&PKl5CWnH2Y?&0F_g
zZnM`vd3464<WrMpw0xQ6cCv)2xpTq4l;q?YYQm2y5BsEOeziHIc3DOANdIG(A5E%;
z_ivoIeI)19Bf*cBJ1_Whp4Z&5PHv{pRgJ4MDw8$4GfsVde2lHpUtpv5tJabUy*Bo;
zAE)KKeL8pT?t3%X!jF4;L`$EY^P**Mx?#Dhpzro_7V}vRck@NkcU^a!BRW}tiQgur
z{7~I=@2P8UBuDCGEOD2A#5=)YdDhBn_a)B%c@dMM=q*+(<YLDWP~2nw^>2oW$7ZLL
z-=Eg)dtP#+Wc%jk!;AV~nK;hnHxg@Ix2NaEfw04-8f@2lqdo=S3JTlw-)=!rrx(9_
zPJ!WUuaEf~6n7Tr|Et~h{%hU6_kW8jiY`p7Et2M#G^K6dhp#%vXMSK8{M&jiqe9E`
z-9`tGtR>4Xs)%0F>^*pb*^S%r&C6{wZ%#gT-BE}?Qt?J|0lV1c!xb|^er+`AT>3Wq
z<TT&3^BqUS6(s-0`q+2><>c;5S$%WA)}1+x_beFm@7}n<u(jB)uE~9+e73A<)i%kO
ztJBh*FS)%w@kdZK_7Tt30C!u?mjX7^j`~!@HDAuSq4dSJS3+F&!a2d3?>jy8qoel9
zGHusoa@o`QXif6w8%jOZj<X8xDK@KgPPw<1pE<FtBe~<+%9l%7+F~@0{tCRmamllo
zLq&d*W?bWuOACA=sw1sZVEA)G+H#5IPoIXlT->j7B+%nPRE@XZvbM&ejXO<t{aTc2
zc-=HV>gS@}uU1EXN?&z7ZByi{!Z*bodkY)9&x$u}S1_8jI(OD3#p?O@8+e<=cs7?t
zJz38^&FOyg*%K4eJTGsUpn59c&s4n#_d}Y0FKT9(dj4kb5xi-#s5aB*(h@!Iqf6}`
zZxPCr@_Q$%;&b4B;(NxEF~OhCOgV2X^dq?bfRb9;JL?Z^N2OZ&i#hVnoowK83|11l
z@!nz!Pv?5uiwf<w`IEkIeK)@oYW4n+wR(lx-Fvcu4`0Tv3#`ZrX5+tCz!oSJQ_J7Q
z-C1bqJ2~)`{~Wb*pWpPgc5KvlnEj8%rK{&ql*Q5=B8<|z=SlmnjJSF3+BNM@{B!y*
zbSzr9qc5>k&dBzIB{$c#r3+tV1SO{m-)OWhuHLjXSNq$Hw6Irp2O<vyCA1}No*=}M
zyj1f>*vYo+oojL~DsC*<^un)dMO(FyuV%u+h>y2|f~PEcZ1>~i8SVh4ojWcR?3u81
zX@Azv&?Op6Tm6E#TGS(@0{H*RGVfia*U7woDI=RgcFnqX=i=te?YU>Gc6@ic`un82
zWfet?8yjr2*F?YaVv;_*=Wcq{k$)%WWj_A7YN?M+@l?4tS%J>_m!jfNKiRLk(_{_L
zR|EF-MKdGc3N8xL+<Rvp*X5TXH&?gj{H@HIZYHgI>CE%?6MDC=w3R>K61wNs^~c(u
z9X7CC=hJvDr_dB>`FO7Jm$_vIa}WLd(expQYvGcYdMXhU4R@r81>Q(tx^Vu^lvCzQ
zQ+KViwl6%KDc@9o{j!fy;>DJ?C&V9L4Pn&|3Xw5AB_KL0O>G7H0%0C@o2k|2K0UVe
z2PS*i3Op`4wr8?Af8jLub3gl84!5q?i(_ixJap)Lf;xlPfk&G;eQO=1&Ggx%4)U|4
zTzmiKfFH*^E+<uwB{>#FR>f~_efede`fhR71@05;VnkY`)nBscOYM4S&)F?~G^*kB
zKfmXjX0E;v(CE8wO8vUnFH!y~_XM1*;+`{^&zqLi^nOxp#LCB(8d9tEEBUrr2l!qK
zGIWu)y{oa)k$b(D|1mi+rMvv+G&l|v$jodI6@RNxl=uAT3UP+Z1>!bppO|kk@Fm{p
z7buMvIR4aN|K5enE^B-^Pm1tKKAKi=KJ(U36VuHFyXIW_V`0g*G*a0sIi=UdJ1R8z
z!ecLGiA@$PyCs&?S)DfJFK7F-rkRl|r0L?vP#M7&oF`seS+%n)`>g%_&DVeazt`{m
zJik2t{ri(MZCgwBO567)E)JR~=@zqO<}t~w3fqjgdlyag$(<9r|MX0ufZZ{A3_Ht;
zH)iE$zhu4oF`Dt~WE~+M=Jd8nmpA$>E@aj?>s`spk-KhDo*8TG6Q!&rfu~oodCi}A
z|I`$1<F$>hLekcAH}AOd;7ai%Uq-!4O_O9d_Si<0XWR<Y%Vg2i%{2Km@7?-2%NVAz
zpIjN}9{K6wg_1{!FBrA%iOw~3;8=KhPjSISD^XEqy+0OTE(;j9_FUfObNAnuxe@^@
zi@(>c`Xy;&+WqO6<D5`!nXs*EKLt#;oR??FY|*^@>KXA|uZ1hEjb5CO<X(AVTa-{_
z9N$i9=c%azk(L{^<+OX^BWyGU8xplb-xb?Vsa<%m{f8p+`swNo3}*L#1U`wGHdFN1
zl$%eRH$N@eV6&wqF<pAsnTzpONz3zC-W)zL@s7i^-BUkbo%>iYZqH1oJZWw<!@%l}
z*`nMtGVZ_K&bP$*rBA~ucYcG*Z<}2bCEBD`&U!23D%_v!&#$!TQkjc;ox$Xcx4ZM7
zTt9d1T6o(p#@nH*Zm(hp*wOIW`Fr;F?DEqq7gS`g61NbaR9EVMY5kqGqMrG)mngnb
zR*Bgp8)5Xu`S()k6FZhaS+s@4%k=rGcXbw9{Q7rEg!o=@lo!x@9kR=!d6qNZiF@w4
zBJUQgz85v|cDDVg4CY;CzH<}y?=ShRdrHj4=<%=MHDOM>xMg?qJ-ewiNBh@}qjI5E
z7hL`FUEWH$sj=J%n)u$cpkL#6-<406H<M*zRa7K*M7kU>wG_)>@V<26jk#FTDeKv@
zCvZNLoHl#O;<JuszvjA5+<)@;$zJyIJcFeA^u+JC=f2G^?>Sf&$r$^y!oT+KX~T&9
zYq%EF|CDHLs9&^4+m(Sg{DO<1-|1g%EiDrobXU6S3BQ&0O7c?uz*y>T9I5#9ihpxq
zoQHaH7kjMTarZf=_V$QKO!4_M(=pGXG4ot;lS;~A#hyOb$daR*TEDggJ5E~Ix0y}%
zENhq<gH1{Sug{&HOdbi|*XKUj1cb>|&E6}n&yiqZbn33eY~HBKY{_q;AAjySQ)ab9
zH#qiXdD_FMz8sAgYlW2DDotx7CugKfS-oA%|8TAGb9cA+t%qHzG%s;1?kvt!S4@7@
z&LBDU(((Cq{}Sid{gHD1@WOk8t5)hOxdUt^$LsE|4BI}}OSbxD<w^Is)2;*ueLTqh
zA!5HrbNwgfeTQClJ)Uy%ot*DYQ;GFfJk!{Z&E7QWrC<8opcf9x!j~o;JnhN<=&{bC
zgefz;R1P=IQa3giV-IA@{C0LmBP+kc-<^+6ar0H}-R9@IZM#=rmjT<{O^o{lH$=+$
ztUm2~tkUi0v(szePT#71()jnn&yF(>zuo;~=d&mI@=JE!`4=$%>2tMn(pt^tLe(aH
zd6kvy6HLF}HqF0s(_?#<O~gZs>e^ek?d|h#YQ2prPi0$r?&oUHDYd`ir@LpGM=cM$
zdj7f3;!`@Atu3q6dZSdmH{~WiT=+@8>x{0=y!btbxEl<9q$-rxDE$y_*w4>jR1)}P
zcmAq>dlv8&l~jB>{V$vU^rH6sjU6}ZgtvycBzM%$6+H2E<#eBaCg*;sWXb*SFYQ^h
z<HG{e?n$rSCR=<HI8pL^?r)oJ`BOV9)Arr@Dv`N-qm)hBHucYorR$HqFOG^;3|QeN
zud=po(SC)8e|}tk^Vr?yY}>=TvqH=mV||x>u3SBF#Tui7)vm`ieSP*tN11N=bv;0Q
zhTN>S<C_)3#0{!U5}NN#+P(hI<RzcHPi)E2&}Q{LtatV0>#Ey7CvBVioTcf)$GY}6
zZHn`XPlktWG%2X^yLW2UVQI1Ulf1{h96eZhTb4fz3H<(`)A4<qko{3B?tP(l%YH1f
zNb7T*y5vPv`p!_1)xY&_$bJl4<SBLe%Jh6TkzA#-j}C~Ne7TbC>7OlrH72d_SmusH
zd09OZCnS88-E8%Vf7LB}o;ll#+gxwDZk_b+>9k#+eO@<D^J*6<a(Y>!<#ebzIPB9s
z0m*xZufKJlc1bbrMUqwf(e~-uQ?A(m)U_=6^>?#Y*Up8Rv(7lTExod3_KAgeDxZA%
za`ffBO!u%AJNtyvVrTqF^f)Y~r)+j)dvxf_DZXu2r`pR!uoUGk&<l;Z;AHlRJ>%lO
z7k+=Vqgr*{-S^90cbd-XanwQPt;Vi-7G^u+Z26+T^qceZb@24)BwtRO<8o5NF!bYw
z7c1C!Zx*Z+lNAiUo4sPolg&&aQCW#sziJ$m)=#{qJi~X-TZs>@rZ$;x7Den~F9>9Q
z*BjN7n0;bXn@&Gtq?u~U%RAzmYFM@f9JArqkz1p%apj7VXWGF>|Lsn=JSRJD3;W~W
z*Jizt^eL44AsD;y#nOzEpYvq4u2ZTBjDFnoMaJ6O=da7Q^}naDv0tcH`}={Y<7$bD
zvVw?G+sF0${<q}cSZBMg%#_>a+=bG&C-c|6wpwrFw(OE;c<tZH+F;R3eTNmej)n6V
zw1fogs$Eq1zl7yvrdG(z;JcF3<E-Z9NPo9B^$T-%IdU{stB0Yu=&aMT|25Y>+o_#f
z@z-ve$)1lU5&1t}f7r}tzq(ESud<><-LpE)BY&38u>Rx!_w%D$U-zk8-~1*1>HouT
z=Pvl;{c(SL<FnV_&&j{r`}z5kx3{;;e#-8#U+3g3Zr4_5`?LH~=!P?i7g<zV5<FNR
z-7P6nIdrQa=6VKuqWxSKr7H^~1Z`NK?fd&HZtG+hzDV}Z`dTyAbF0taTTryAx<G$_
zcWqC7_Ws|C{_vS)es$)J*|%oOkrac=(|*`y-hc7`;)5lO{2w&(rYtdbX8HUs<Kxnr
z%bE8}vitTf2@jJEx4IYeIJ~s?o8`=pTZ(+j-iupy$A;hB^ZkBLVB%lv*N^vjaW=o5
z&-!cP<MX|2!dk~XGtOodrdi$85<VIDfZg=}=InpF-<^KDR+pjT$6@Va{Uv^p1^dgr
z&hb@W{XEaV>haQNt+5U3<bK3Fy?!?A`nF8<v+Vr)j%Kg<&l~{1^96LA#N#zhzWZ4j
z7>@EYFvu`4Fyy8d=jSDrX6B^mC+FuDWagw673*gumL=*HR89@QU3A+_p!RwAf^*DA
zSGrigbGFX8JM&6l^zyP-owlA<U2V)0y#>uUH!x(JJp1GRZie?$YB=R{7$bDf&5M1b
z7dLVB>Fx8=pX)HKODGd#zOIv~!2D_1f<Ug#$^TDOy85{m>ff}w`sBxpuOE5-|M6HC
ztRTLCMcwd@qgt1YxiGIu`5c$7IW37nuY#N;gr<o*WjR@j&&pEUQ8cH@Z^gUm@d0zq
zoTpBkmHKu?jA)R{f~Z2?=)DuSWE}s_`Z(K3bmuz8A9Z;jQgf~{%=m1r#%k{I{5A&{
z^U`U(E^!-pmSm;)zwWHEO^-e{^?b;&AG#;pUYW0oD9KxXE@bo5Lnjusa_;=L{{PN7
z?aS-W`Tw`7{_p-k;7?Y;f%i%Wg}3FE#40@QIV|aa#A6-f-s64yp4_+-^)OTG!oj}B
zcP>~<9owLFU2$r*sKTD@I+wbq3fvT7f9~_L^-|GJ74;{pul}(<E5efU@Z2><ahW?$
zubhiNy=h+A^mEORT_i)h_8exG5>o3AHqJfymFf7Z(;D&9OL!~RWe4mkn|3rU=2Ntu
z*`2j2hyC;I_PA>u{`~X!&!3^$%!lfZuzcR>zRtC~YsHgZ!Lp~NTR%zuUBx^rwfX4d
zkB_E2&=9*A_fkGi>u<nKA?K#;ErrVt7c5fnUdFO*!a`2R`%^S`9^P>zfVX3-k)Y8T
z?dxpL^5qe?`V&o9kGwr9w#e(04tMm@>;LY5Q@e0RuKmbfcmHa~)jm^Me_j3@y{0?0
zdkd@i0n@F|`S`6~^6&Apy!BRk{^?1@dm?gKwur2CY(JK3mXSTrXmYWRyxh#cx6)TP
z>oQ*EU(YAediKz}_`Y)tnipHXO-VOhyx#t%?K_Xj8l{1+?Cxc?U6z^0*z37?va0%t
zHff$cx8haT)xUV>D7yQvu&>CfgJ(GM4lc^yShdI6>u`|c{U~Em<H+OLTqbNkjndx+
z=LuZzYG--$UzRmbzre>&-?W8w>JI<pC#}-UE>BoD<-{u1x!Yz)FD&@Z^e%4o^8KMF
zH|<D$P`LQxv4lytALSnW?bI;c(qmPk(UC{I%nZs$y6Q{Q0~3RLeD@s_vkqD`CF1s(
z4~*V<IerTFCtrUezQ^=W=G|w;)^DYbT@R=T%#QlC>cotBS45*7AKI==4dnh6bK=gQ
zjIv+mO&>i^Uz?I+dw$X;Q?_kd)2g?;KiZmJIz#K}TA}lj?WY1f#m%~srtRk6__s6f
z^@AH6mAAWJ#CaaOb8Gdnbzir7&foh+Q@J>J{hDjRi?6)*n)CC>t2C7hYeUcRynb!B
zVC_K@Q}q%)13^ER#(D4F9^G+c2V1#H(wj+scY@S6&lk|$=B;$l%jT3}+Nt{<Z5wZV
ziLB#UW;^H2k3*$*SN;0V^J40~d6!Rx9#cvYh(6G9hg0XhrK|J0EiOLYs)mwBZtuQ&
z#qdpC-M!6UHW+WWZWh?vxA4%9#n~EvPj~4CtG!y(c5sVB(8g1)vwtj6+_nDT{eV3T
zarU{7Q$!<97*2TacjDrN5YL%Sdv#x^6#71QnI$)+W@|#vW2e-UGb{L2HoYxYb`kh1
z^*H=zUi%{5g`uC{<Ohi@ogCOI+pum~o5Nz8JiWZFImJD`ru#INSI>Ufs*@l;f9tg4
z8f(n@GILh6EMHkO?c7hXMM0NC*}7bW43-~DDfN##U^LZ%=j^ef&HMfJXT()7sJNfz
zUvsVB=hdV%Uwb#Rkizg}Bkf9?qfHGLSI4?qJkZ?~@#gkPb@nHx`!d<5O9q(m$;(LX
zc5^zpo4@!!x4rj?y&9fg?;BPyDb=iU4O^@<TSQ=o-^^R<0}t(2otz*qxRIe-clq`e
z$M^i%@GDeZ>iomPA5ID(@2^kEie2&GLqTulvY46WmlxKS-_VKsYm?$NbpfAcP7dRx
z2Dd5w3Y*#1wWyx3uXx#ea<5)|G}|GqwJldauX&wv=62e0&kgHm1)grJD*iUVb}paP
z_J4oOOXfayTUK3mwQJ_8XH485BWo9LzrE<@zLI}vmwoMiu<ye{76yjZf_Mu4{G_a8
zy@JZO5qI-%n+eokk3Xo&za=2r<5IiMt(Y|hU1k}V#AdYTdN4Om^D~p~6mdD#8Th3B
z{=_TGA6rFi<dqPxZ@KibV*Y+>*<z2nza{^UKbdq~LBvN-NMP1-nNt(?=tb;lI_X*P
zM0V0l9W&MVbtaaUR(3NV%nvq-XWYr8%IcZGJ5#5~#>ZsCozItoo~d+Q@(NdV5qwyw
z=<Pd0AjtUa(tvs4m%l7~kmNZ->GQ7`0h2!)brch4<z7yGm~!RGorsAaT{r)|n76;(
zSJ_}%<w0YO(8GqSIltDOd%rWlan8r+j7YtYspj{CLU^x72b$U>H+|s<eH!FazDDFl
z*pX99i=>M_s>)5+UTWOqwD|U(ExT;zO{z5b|M~LljBoGGzWIB!efvW958=D{lVrUo
ze){%9G_8+&hrr4^j~*`-G4nNjKD+PA^D{ek9L+GzK3uy`Q0Mu_rAxp4+%6m-Z4m9r
zGVOWgi#b709zQz0rZCHd<NXfb4*9CE4V(@~r#UQZnRO!2-A}<aqVQm;NUuoB%Na*D
z9?a|z-1WpOUOV<)59b}{w*2TTroWmFaB%MH^VB-6QQp?(+<iRk`h(-4BGZFbPS9C$
z=2%N|j<Zws#AVigJAX)O%cw+_`La7MF@N!ZU9)VZ&uX3SsL9nzJ;q-R?Q_nX3i6a4
zTh8k#-Rj6N$Jx54LZl({vw@t1#oPUFCO>vED($`>dB6Se1=jmZ|B0tsxzA~iJGq4Q
zuu#dAg3y#4Vbd9sKT|%Pda{GtkMl+c%R&yv4%7I<Dc78*B(2C5PMq=RwpCX7rai6)
zQ+ubzy-c`P9qPPRZ*rGkq>ga+ZRc=ad+oUkrX_rRWqfU)n&so9Ez@j1p1gi+!{YfT
z4yQYAe`~spCGh?pj?}cp$96R)COgS4Pc?BBeo~UN_Tz1-BXy=4haLaFdVl4_ulb@f
zv$}U@1?YW#Fz5KSMH@FhPV+zccly^`{NKJ`%L(qPes%WPr7PbyeEJrWA3nvlASXJ4
zeb-}GrqxEd`wPB(Zj+0@eDb}{X@Qm>2ae84wV5gMvFqNJ<2r|ar|-L@EH&x%>{`2v
z$tjgf3f^~4j#WRwovn1|^`wh`rQ+=>?^#7Y*wG{$@~6dQ&h%5g$5iwJ-@M2_sj5HE
zqwIZp^XgTHN)$b;elE`E(fVhv_UGb;$G`b=`8QoYTOje`y!H9o7d!cRe_vpbJ3seD
z{A-sm7xx{NFWgj&)30vVGoLbZW4qb+%@0;x%9+R*w^O08!Z>1nKG%Z&HUsGws}2-j
z=#rVy;mcaxB>$!Km$Uwwo*gZI$5uS!sS6HJ3KP3@^P`B`?$eJt9xZ4)xH{2xs}-At
zxxt)EGk*DVE#3T%t+{x$N5o74UC*Tn;kzaNty_6O$TYL3-e&XZnbCdycZ;&bayI9Q
z%b%OYemqgm@4NcF$jq-__IxZ?wON&ae%<cfi&i(wepA?>{as9Tuiu@-g)2|T{e8*8
z=_}S-wdN9++x^M&*GWFOdXwW{VwANsUsBQ<j)=ep54V!0p5U&jEvxtQMpY-S-ygre
zTd6s}=Eyd?*swDP4<58`abR;<-=JdSyO2e&S&92XIm02(C0#q}nH2ORAFIqyJrl?@
z<-uQ8M4J{gbyMYPp?8Xffgwl;&pn2qqOG6+T)5?e3b%jn;t#6IXB^x%A%%6*&f<-S
zG;b~NlunS_rfA9%wJ66-NV8*#@ZuBo_dojT_hsiFHA`^#a&Xa!#~<H4EIz)t|DwLR
z`2PNN5k5PYEI!>*bTr8Av|&~3gbG*p^oO4BC45~sYThhbdg12Dmp3`;&RxuLy=XeM
zX>rTCOtmf<HDy=Nd#{%+JrO9fbm}TEDc6ptts0_AbGThagk!!{t@F?2IySw-!=(80
zp$n&vFIvJGn6f)wB&_}Qxvip-(LWycr~R<KThVG+oe<Mjc<kK@@mX;PkB2;AJ)QCL
zNz!-C?1k@kT;BX-s(8g|ZGB^x3-XO!F&|#cn<8_k%VX!1G6x;I<8$BT-sV{FVER@0
zueWTcEsC`G{rH)$N$vNvU;jQGzFo+F@bR7HHL~3EHdXyHeIxVu%cSK=-hES>X6F`7
z%Ad7vTgtH?vI`#EkNcH$*z?>Y?aQ~P-M`0>exO9PA!4uG4>i?aJAT;g-T5)@tMw25
z>?O^G=QFNxgrs<0WJ%<W4NS0}a6x3oQH$WfE7MK9+co-3Lyt3D5}o`iY*mq+%a_Kq
z4_mM9W-D)yPG*_!Jf+L%)Y`R=*Ijhp9QHiXsLNaNsf2FJiM9^LJ;^Q636Etr>$KeB
zI_)*-?jydw3O>C$ftu@+GN+~n<`#LkmL2ouKK9k7KXHffe5pxNt$YmE7RtKWFeW^b
zKHS$h`P*?jTd_%<wXD5gbDc_JIo@3RuT%P|qj*)A(#n$?mS}m+&@tN7X_NhnQEKm{
z>N^d=K_^^g5*H};ibh|)SYnV-=p_`9FU%P5aqi)_aZ}0{>?+C0Jj(y3TDxRJq;J04
z<`^BJ!*`RVh3q}28VIh7t9@i9waz^FZ{0}+iQ+>Q^|}#43-s@un>_u+N8#hQpJg9D
zv?4c~g*&A-KkN7@#Y172IBscheU{<xEoE5M?c<RYeekAd_Fco{+y6&OH0?CdvUW7#
z){n^1k;<}uR?YNrf6pVmJNKnd+qrx{vhZ-Qd#$<J_amjk>vX$vZofE?m$I-qWTw&a
z`If&AypFc{)te$YK~Sn^z2~t>fr9Hl?3tH#;@-T^tn(ij?wb4lGuQm46O&oLpR>4a
z%FNr-`NeT6%lr6`zneezPG-Gg6cBfmeT$=EXr4&UW1%bG{!fcDvDk6<Yx04qp$j()
z`%3-&yFSG5p#8Exo~j}&{iS+FOV5|Byr9=!_GIz%mM?QA1Z>Z!^Yi>4<z=KbtM6yB
zaQ!Zk;&S8Y?Jswoh<|kGwbw*fw})|V!rqp?-)}Bk;J?a*xj6KINtE^*367ntLe2u)
z!g+StNyrv@O3T)&Oa9Z!<n)Q;$Uf%icTN11U7Ho(g5oXnW|&&pTvwTsP#eq1x9Vs>
zqnWs@MqZ`UDHhE}Ezfe*-gm{_mMp98ov1MQ@sa(yh3(f~@qLBwq|(**ZM0Y;n|R`C
z-1^L@v)g_y%A9xIckO@uRjl0Kg3fhG{g1L>+r2_;XY_8{gq$6_d)rK6Hs`ay&AEHe
zid{<XSI>p6nyC)$=@a7QJ~_MozJIJ&P4M8;xYhsi9^H{G54c#?vP46}|5pV|lQ2&p
z&-(=Hlr!;M|3qqIMI`^e3f%RZ!Pd&Eik;_-Mv!)w(6nV+me?#4(p|A@`IP9j5lX+~
zSx+o7jnUuKb7P)>$(MgDsHNbS|B`R#@h~v_SHaW3D=IAp9TT}WDmVY}4#9u(;t#5^
zs+8yEK6)z}&aAh~V^8_P)c6Uf-^NZ{#-tl)W<F_!@=}X^3jg;StEdKU+Vk<NRKj(!
z_%`Fi?dQ(~*eTlA?fQ{gbX0kow%N{}$hc1}#+J(Y+)`_Arbx|^n>(R6Fh@0ht+$b_
z?QFkg%P(v0j5Pi<Pjlkr8MYfjL?nIGR2Sd87^vjxcF17mDX&ciDmL0JI-F;V120YL
zj**qUxoyd*#X%h*S9w=Oi3Pd%tTYtV(#Y7kZnxLBh&&bDSLr8b&C5ObS#)97of}u1
z7sQ2%q`BUnv+$f|{I$E?e;U0fF8<biyyNA;<m8#3|9Fb%@QeCJ%;>t>bu{@?VENwz
z+ro-eHZ?8xSrzqZXRgF#ji=vrdTwrtY7JR;;aAHY7W4nVws4%^A3x`R!Ow@gZwfZr
zuTD`>>CW`b4t&3Ql3p-d_r@D*st+#yloq|gP%@*$b>kmJp~^$yy*f7{=50Q0Be=J4
zt2|qb^9jzAN7t9Q-TV9X%bB^;KmC#GS!e%xr}*tTX*Rnqt$p`n-~Y8%&$AgdO4yI_
z#PD_WSY$7~mV0~gV&%w{Mn~?R{gE#fdTYCJfzGdoVN)Ococ*9n`|sa(eP>Qijys?o
zbgDStE${uYWe=~^Mm%gbxBPzW2=m9uA|Gw-zrOmn`QX3J%j&Ie*ysMb&+~16=C7*>
z`w#tlzId_5Qm={G8}=TX9$zncwr@*|aMQX@51kpOY;T<V<9Nq7=uqccN3V*N5wm(8
zZkC*8EGF!=PS5_&h8=wNvHJI7|1EmD)FeK%<miD$Ij?Ue+WoJepD=#iX1{;$KZXFl
z^<wkI!|mlZ2(SIT_hj^za_3Y&^~kH|GGyPG`TXX+w$%Q;D5Kt#+d>W7ew{k;{8p`b
z_Ckq;lLT99L<JA5ULw?Bp>}$einN=Sgh2knTEA;NY)oHsTJ|gt3aRw*a(vPJVB==l
z6eG=<TB6?`KDlmR|Nmpw$8W#>{62lY`v70e^wfoE>*Lo~>|8g^LvwxMJC<^X`s%Y&
zSIwxZE&H~8|NObHBH!2lsi~_K-naLkU-chb-3i?BMOAu5*S;r-%@zw_iD7N`%RF;L
zXJKemUn2vL+X1F|^@)N;y9!rnE1SvrT|9iud1h5die$N&igtP1!TlVwb}uelIy12_
z|FVN;hlS1aREb|~x86)#n(+6`*F!TH1Vjps_GGZDI<?JATo5_ED@u2k{klUQT&yCS
zTRK?N*)>YsY}y0%Hb#0*U6#1{m2bj|S<9m2Z%pCeAk2K3XMUMlg>2B*S0@)o8b^n+
zemJO+Vbi!f^Y4Wj_cq>&Fx*gg|3&5B)H@q9-r3c-_86w;*}1Jfv?2K5BrUO92C^Zn
zEOyWAO&?wrR}Pt>@PdKsw1LpdhU73Mm1&9V4zDWzeut~|!K;T(a_25+&q!sKJ8vcR
zZk^xb8~NdEANjc!yzZ@%dVYY5U&rK)0FzQEd+G+m?d7_9A1|yZGg!4q(MoA@eTK%?
zC{H%cV8448LpFvrEZQ*pwt&#47x$W^Ppb9o++tC-$XwwP=bd?REQya6xP%xbDJF1g
z-c^e{D1NYbzZmyA({8q)%C#RKd|jj!KdaNFHRid`9fpO1XBO6^7cNQQFYR~XQ8D_y
z%4lW{w-octE|x<f<=abwH%ydy5V*W)f@;F0SMM3lf8L{_E_tM~{>g{9zu#?47|V8M
z_HB~j=Z#oterKNIC$5tmeLG)wZhU=Vx0{ooqq`*cU;ACz>g`|NDos$xdsO-M0AF9X
zhQR~|al=o`EiK>vatY$wn4;1CRhWNri`gUl$R}wX(VYLjxt~|LWLat3;qYwlB$MFA
z>&!Jfx+~I;%l@{$WxayugFwrJV*=aPZctY!n2~X1E6=jUY3n*nLuEPlO8#Kq%5^lx
zO<r_LBV*3VV%a^4e9ZD3JomGI9VnU7Rxs=3l??963w;)kfBO}4^MsqauT41W^<ah0
z;!2(y%ttIDG9Mm%&~pBphupkCg^pXFG%i$R8MZ{MKDE>MLDI*chyBCD*&2fQN_u4;
z9&Gz`>HVVqzl>jW<swr~iMcABY`BuV>CPl(ht5v%ceXj<eV+w;b0^3<JW^1#T5v^|
z*`>m1Uvlc~JDH2je)4YGqNtl?Vs`rAg=UE)A<qrvOsSfOHLm&`Yd^V!!MXH{(J~*O
z?<~F_zfC;(zuEiW^RsUZJ^M|hUdLQJks-O(G4LeQ(G@+{{xxhhe#Blc`S+%AT5sWp
z-}Bey=`Cc5ED1UObjy*$p>^(#=6k1ew)fPO7y9t+Dw`SnJgU&iAt|bH{}hH<H#V54
ze&2cH317x3)2pJ6I<u6rPAYX-+Fj~W<}UQT%zIZWC}7V_j}t#%e-2;o5$l{?tCaFk
z^+BEYm8g)+HEXZWC`@U5k>k_#`|6Rf?=zG(y3Z2bplmtK+C^07(aA7=-Z?7+uI-IK
z!?)ga-_K_`RkuD(E9D3go-oZ_>f%eSE~nIeO^TM@_kGR^_sVA+eE4#ww0{}D;U&52
zVFh<2_uf9p^=Z!`dui5H9uwyXaL4>+Zj11p<H9|2`%bePZQ5z;Saj?Ue4F;+gqOF#
zhc%OX+GOVN<f$tkcII8A9+Up_>z#YIvQ{q<NS%GBam7q;3Dd|23EmQQA`g9U$1JZ=
z_Lk>$j_ADiKBXxzzIIO1+!ueX*-uK=Ug`h5`QqD^rjO^JO^umwO6yA1Pm2lvk3HLU
z=|u#0=f=ASYHz;zpHw(y&A$y>SG2x2IA4EeUpuGELa$9f4Oir?d~jn^|BH?1SM;y?
z_3m5~=PJd!X;}xwA70+ixM%J2?*dzj=Y}R<&%G}0)PAt+N8g*W@HvawKP85460qP(
z3gA2<lBB}(GN|)P$&}Yo8`A=IL}$NW&({8bnyCL{wWjymeJ8v8u`u&FSajln!JS{R
zv1Ok<>#S!x<(jc4?fO(!>@M>AsK`v+&J2%5U(DhjZ)XWVq|wc9;=6ZuY~?SO4xUZ^
zCu)MHG1ok-|Ih98@9cw&#fz=oSI=(P=N~`sIkVOE`q<0)2dyJo-f>i4y^^zYf@IxC
zYuA{~%nxoym%n;*PP4K68}FvwzZctm*`@V0A@9>|JxgbA^T_JP{@X@po_Mt#{_<C2
z&2F*6%_>KdqRVHiE)MCP%`GO&eJ6UM^R;8AZywn^UCRI2=bO7%>kE{|HGW@Z74|Zz
z`P<fvO)Ptwo~}C3aQw?x1yuom^%D|dcPeKuR`5tJ=3S!OFr~8R>!wu-cbjyM?0lV@
zUU`b^)#`*lER#b{X2`rLns_4A``z#RPH%Q-wDH}aQla*J`=vj>7Cluz`oxmKN5Zka
z*frKHO;JrtL2u9T*-{G%@=JDzOuo2j#^XodyvkmD$~%95?N0mF&GxpozmL_`W!o)J
zzxRHDopOfBJzfi6spRsDwz?OrmE(S!9l6~f$=)+#ewNO*L$g)nTEb^IYU@l8Z8s^p
zy}s@v?}UACubSU;{B6XxIpIvM>82#6QvD@6HGTeXeIz8ska}g$*`Pjy6GieBIbBXI
zs}HJr2JH$ucy6L}$7F$BY%$4<Z0{rwybS-d<b3nK?W?01!b`txV$aX@i%wb;oGdL`
zvmo<mjl`{$$ptbYao@h}WfqFDKfv8$^G#8H(}g+J2W}c<s~<I7FBm&L!OH9be-2x!
z&iTxy<D0&)F5A2!@^IX;UB@1J1^crexw*FV!J8vV-(3&Pt98yTSp0uS+l#a3uI9yx
z+05J>Z_%A8<^SdT^SGNgUR=w*$Tau6=62s#S*2gzE?@j?MgGFQbKgaD<hI|u!ehE@
zMp58%xroaza~5kIwd)qzQ{}+<dAZw#&6E9RH|_jgblZQ=X_*`*{#TYR>-%P}jgQ{h
zR3#JYF0?i|`~CIvHx9T~-tEl}s!h+2Pks}bVp33aBe_$3x$rFY3&!<}9yBobop1Bh
ze4-dOM}Q+PrO5Hs_x1vnYchxO-QGW3^CG;rbpFo6H7#D+k5mJ+J}kPC(N}Wh<y7`b
zJ>BoTPtDtR;a$?335y=I+^N~~!$Ns_T$<hui5Ht$%b6?lKS(k287~Q*b^rJ`qea3N
zYmAzoFZ=%O`?mP71(#SwezR9bYzlGNWivBHDea|9+N0kdpLa!GeXnwGeuDF!TEjSz
zIkMX}7+S4b(vrZjFEaSd!vi05t(LdUGESYv_wlNwhEV68DN4S+GPl<#E=;;KG5u?s
z3iGb5-}F~<z0{s8`>WxNz~^<pwkn^NZ@c%AXZ{Wkb&KMnIo-)m#I?QS?I%Ch4L)AI
zIXZT}Uyqf<^#>Z6ndg6H9sgs)xM3c{BK2SUV$T*g8f@JkXyIQOm}9*^q(J^vyta(I
z{OpM@)VnenuJC*d^SyNF&o#wOJ74m$Ez&>XZB`o~FexGI%;Xl&zqhCEn3k0`W4@+K
zRja3t<-MMp^16S-5&as_jO7*$JI~du3=DdL3=FckW-N=#Gt)pFo4MhTk?ZgA2e)cy
zEZ#ODm0y~t;=qKe=nGqTqwGrzc$%i21C3mJX!V)DslPw**P@i|rOVi(Z9eX+E8k<i
zPi6kQ`!)0Kb+RmJe3{F2scS8Rt@3_Ro12HfSnZSAt75*&B5ULA=%U)MkH3o4*QuSh
zolu@IMMcxbX<3)d%ud#M{ch1~iw@n`wq+^Xv5phmOLZRxX`NmhaH+@5^z4+`PODjZ
zW(uS}YPwzf`J^1TVtI@7rZuj|3g4NeC0*`_IpMx=YRN8fe@+p<ip`dRm5N3emffrg
z7FJU^d4zd`h}qM=!o9`Ma!wk>{VUy{U|z46ckkZ5|H)=bKdw|c+NpWv9bGr^E8jyw
zp}ePIyx&Z}%`r5*Gn4aY!#30ZXWyB-pDdnur!s3t{fo-n183tBzqlzE3q+q5VVcmr
z-}czOjgnPg-Bij_b$0FTdEfH!{cF>ilk4}?M5V-dSShdmx<o0awL5mlkBho5zA)!<
zTz5X?@7%=6@xRZ_^H{Iq{5e~FEfzgXwUMrzxBK?@d~x}ke~%x1zkU8izm)$m2VJh$
zIUjqv?uqq*{43UewvkKvCZzUTu4P%e;i!p7P{c7M=9^_s4>*mEB#0#$D)vh-w&b|k
z_(U&_j5}!k`f<$9E7dKDondSf?`cf+?KsdgLs04oyK86aw2fgWjs86lo|+zKEA=<-
zWbr2L<<&e}rYmeolsg}l7cAEC(jrgx_zTm#?eo6PS<_>;xc<fCJ(Vx3P58y{3k2^p
zUjOgd+=CJ`c06+{f3;n&$$G;YfzI>k@<$D4{*yYk{&OsIm`vwSt0!&$PwFxT9qw5j
z#krd2eanu9`33r=oV9P+FGwA%Yhx^_dJvWL(KtA7*}S_K8vQjz6gDQPyKiH@>3Q5J
zDyrLiL#fr{s_x^b*Xv#6-MQg%*q(-YSxc-F&n)e~RnvIHEXq8-EvhQAZqdqh-!^I*
zB|bdqwzcKst1RC*VX5FhUv~!Xe*JY;(QZ-yi$7R;K4f<rY1v)$4!)J{R?~H<jf3q&
zEYl3@hoYwy+^QdFW`u>l32^+%$p7hS;K~*s!6hkC8!rc(bJ%=(en8^0sxPg(*cSEp
zN>1aS|M$Fi(tM8-v!+bTH<CyzSa->&`GVIH8}7+ohpv3QFzt7U_y2~NoJ!T&jI9$q
z!<N}@j+MHe&da^TQi{9sDxcoP($}BvbV_KfIxgN8`~Qc{>&X|=)R%2Jz_m_Lru*nr
z*_OM;`wX>K+uf*r?zy*fuGz`;*S~%~zf2_ZRM5ix!hUO1ZtR>dV4dU4k}|XTnb@Lz
zx{l4o{C(L;rn`@QYnQ$6_@bqx#oEf+aJznft5)piH8bM2U-i(MyL<Wy#hO4Tx3&5i
zPhVASle_*^{lH%ReTVNCygB6FcDUqIz~Y*KUkh2;s*BAP9z77~>AuqZ>{j)KyQP=>
zY{hzdn|~g!4`1rnu(P@0ca@(>mb#zE^}5%ezUTJ&DZaJXn2~*Mo8<auXUw+cr9{ua
z?HYI9Ils{9`h=p>wXMf%*G)-{U3Yx1<k8?+C)XP@86T|Ae7+&>0sE=jWkppxn6?`+
z-=FfSR{Yo2PfGT87OHT~&J$@7XtWQQuGr~SC^I8C=jr8m1N{#{OKNt%z4_Afqhqpt
zug20=u}g0He>V7P_5VG~uzJdQ$0-u~CHf1})7>6kTD^P9(eG0|&poSZJ97Ba;m0vc
z-FMf9^Aw#<m-Sn8QgN<%rRb_&{+Jsp#KTp>+PU|#e>yxT=Ih<7F%lNltUVboOfo*5
zns6lEURubJy}Tlcw@-5Ysu>pA8*eLS?9QmkY<l=~hId!e-JfOEy7#)xor-#!g)c5W
zBJ9cM@a>OaN2r8FGwZpxR+B=$-u<}m+n2IJkBVuojB_5RKiZhl-0YEYfNA!mvlHhW
zI$|o&E<8)`?zi=ij3o}tT3r(RSU}f*_Xd7G{U@v2>Mw}+>+LxEMe@>o!#6cgZ|$*~
zx?S!s+Vte){0D0SI2jmzE8!WvDoe}(txMS&8J&OILagrm`UeX9la_5W%jD)c){s82
zbkfWPnZhPB59-`;SfF|<O}U#%^Y}-$zwfL0RJ|6d+@IAaFBE&C`0>t~=Pzd5xjXOw
z-TluLy+vNfyXu_$F~!(YAzhRA`I`UN>@BU-lqarJoqyK&)3+yIa^?U1aeDW>rzXWq
zMJ35!N9-k&+2o#!M=xFs>0;$<dTA8xCC1XCAEapPG}$G^<grqqyZce&g@2}`6&KH5
z8$9m}N9dD%3XgxM{Z<m&e9d@@!ZYE|ckayoE`CyYx{~8fy?M^lls?N<CIuaI73gyH
zQhhx!+iqw4@`A#};WY`bn-tbPFw`+;asSzTaZYQ$yems|m-?j+ho?Hvw6b$1q!+bC
z`Jdcd|Ns8&?u0MLkG?p3b@_dEcb2-N_X0e`F80hitH9A+H1k~LjD<a4pXyX{xf(q+
z-uzElM#}$2sF7%I=`k+Zww3F1Zmn0an8p2J;;%y;OLZ9QIW4twi}U8K?e9A@L(BEw
zB12QQg0rpW7MG?Z%{nu!<k*P`7XBM9T=cI@dFQMiFTPRJLfF4TjAdQY$1UzRjGd+V
z56rm!p?;0g&j7jC4F_`jeOh_McK%?F?w_ZY{dWhKljanu37rCk{RJByG+3BcTisi5
zXW2B(7mt4~4SC!iv@D3nyJ=3+`X|OF;&HAbCZD_aCNw=dRcE`fi`D6ObCaq5(%rkx
zvFx!F3(_$@{yXhGlckf`5u3^u+vz4@Ym9OZMJ!=zO_Y44x<DfDlgEGa+-|SzlL~Vt
z&tb4s`=6*7dni;;=>e;!+KChEGtNgWYmNQz|K$pP1(T4%rfZ)ij63Yi&TcDPq5JMJ
z`|P?SYNsRT8c2lMpY|^@w_Se!`s=yuOb0W|gxkE#W;PaHPEA|6aK1{(!Ed7V`KLwm
znLCb`9{nW$K*98@L$!9w7ANC9GFvX)P5b6?xXb;6>4td8gkWDmo;!<P#>dzGVmPXp
zRrUHn*JUUBC&`AY`E5VlLOPFW?+V+wbI;xx{dsox;$q`(?1?J5-5wa&zTv*p|8Jj<
zzI{IX;?cWz`NUSHtQ1iUUNzY}w)VA%_4l_gwRpWIFvV@2y|>7G-cN0hE9dL%nf&UX
zm~^aJvE|bh?V!tDo|;b*KYdvq@b|Hu7o&xT=~83OeR>P)*mh)wvoWdXK9JiUS5$T6
zXKux#{lAaeubsZDtzy>A3yS$#+xTz4X_zxjlDk3n$qAkaR_%FbnXLkq&c&w`FZSH2
zks<!Q?Bu<Fvvn$ESOuqBuVK2$rf}T&3h#-DEvlzkCz~X%)Ac^A5TS9bIbQK7W5~<z
z=`l=;7aC`9W(G?#EBkc+yl2k#`&Z`#?mY!(o7Xp~=dENsVfL@|!-Gm$qdD^=6z64}
z;-AV?F0XRz<w-Tmdy<wFLdQ;b$m*Qh?d)2)-E+!!H<1JvL0@^D)4!clE7zxHvNfGu
zz{TatXu7UhAlv2PFKtD6?|fFB$c4oY3r*L&%kclF!f<)o9VZ>z1qFONOa051TfR_o
zVSAGHX=<xvrQ-cLt1@iUC$U|gk+=5N*3gL6SxHmZcCCxu(08)sSZLfQ-4CnhOYF(N
zn)-K{%l&JTrZe70c8lKjO5M&?CVI=8-zW3uZh_s;PISCz+vWV`(M@d@XSc(%dMrOk
z<uz%_Z9A5!ExokvUC}MkI;lyMw{6$I!gH?dRf2a~!9o@NsH`LFFED#(Sg!j%`H!2^
z-Bq(wSw0-)iHWq-T{WqwVP<UXHg2B1r=Bmj={&GS*z@VFDPeY+jhoGa4qxr<RM5F%
zca-79)6@+wo;luq#N~M7>Cxv8-t})jFaCU%@u6j!^?Y4kv&*?RJdV@jJ#lunwp4%i
znzvO^Czn6e4!3Fa)8d>Nz4ztIUzeXwu99zwE)8eBw=r+7^Q2@cA?}YI3iDEm+ny~s
zZJ|8lW9K;sF99C50!OXGmU@#I+?JbWb)J|xDJG&~ZIIZbHR_*UOFdk9eNCR{-HGXX
z4@1^}cD_3y{loUfrUu?!AO0xLWUbGT-^+W`(b7Xc-S1`T-8ZLouid`;@UHB&AJ45H
z?X=+1Ue-R>uy_BWYg<(9+l(eM?u%5rxc}hV>nv6dJx*_(Z<Q~TxNUQJR%C<5rHG7X
z=@)CAlR^)#*rF}scl@}j-)ghjvN4Lu;^LLLb9p+BT)(RL@Xh(_b9Y*ozS}Z;bH|<#
zqoiwxBx*FD9QZ97dQyD(hQ`ZTOE+|daca%>c3W)2Ia@PWTUGW7vxrEk?a#)Pvmva{
z)xuVuYS&U~j3~BZYi}<+`SGmRC6m-m=N2pb=O2C+YLUS9!<e!0SjLZerV?*&Ht(sf
zcX>R+FUd^KT>1IIsNWm*8n5uzWS7;vyV7miIliE~p9MHt&MxGAwoW^9YTt%{3u}3<
zM5=WC3B9{RqvQHIrz*v8-kcjsDg7yLH1n>fWgp#8BKYTFd85U#p7=wY37cHzXZU1r
zeMmby`;OYY$(9Q1G+%C=JgIcSv<1hX=yZ7<ne^CJCeLZsj5TX(&+hqhYG=s7n2Dm7
zTTNSEb=)^FI6F<2K`q|)^0Cl~9tzqE3tVl_r=Irc>vwS3f3&elP?`Im*@S#w#apqO
zK?;t?)%oY@7e1NOC;sJT>#pY1L#6+oR@esJtNr<?;@<4bj^DpAS*b*<C^9tU+%5Za
zZ^#Obovx|Zj9Y*C$t2%9zq9Q0(o_D0$5`toDwQZ6IKWis*S_+@^>@r=AN_81<*Eg#
ze<+vW`~A`G(c?t@f_siU0`HD<=XaakWs-PieK&D>e)%s$mWls@5?m)V@<|_Fk<e~;
zfk!NtgJp??OoQ{*`^gU3W?^-aXCoKMC;!Q~vNU<w?~YvKkfj^0waeRlKl{~w{~o*F
zfA#)fYE5TTeJ{_t`ZoKCx06pT-BY)B#{G-0<gTASnY7YKY2J(}GA-?0)2a(Y*-EmT
zDh)5K%yV2&dLrub@2*GRGR?c9eQh_&SU;;?TF+^=dt&*n_R?LuPtKqH^{$8<x1`0g
z6zdzyGFDu=u}$()gu=4U{BP|h(m&+b(#!-Oa<y`ls0Wwr{WUwTk^lX4O^%uMY)AK-
z&bje#R>#{-tl2%Dw|S>jK4ll%wr19fc}pK|sJqOpGk?bW{KI?P+mCr}GoCS{=4$TQ
z2@&faCQk_oPQTmWvH!=scFEnb9;(4NQg7dI-O1YQ^yr#^`}dmPe5<#=xP8|&N$<tY
z^cm5Mj}~5TzrSso)rF$e?1$G^R=-`b&;O(Rq79|ba|`{VlcO)AuMlQnU|?VZ5ey6r
z>bUybxtSH2dByti@tJv<CGqik1(nPUsNMF=nK=p5nHd=VvNJHK5HKdOpdcqzub}d7
z=-Is6ZUXy0YqEW66!N;*7|7DvAW|TzDww72q$|S5(;P9;x$yPh*YAQh1$=4zB~`oW
zT#=`zUy(+Yj{c!@?`n)cpEY01y(4<>-ud@F2u(fwa+A~3%Ci^GJ-D@D)4`Xa|Fm{C
z>@;IPy}h@6|No}d;o<iW2UUusY<G)(wlmDrNUAq1?0rQmpGy6+Q;utO86_J7vNCr#
zye_Jmrn2>_P}ico+U$)Q4c>=79++}zUvsf%{wMasSH)&Dm%g9&e5cFusSjo!d~Y^K
z{JiR{8C>fV=dQP3FLw0L;iP|`KRx~($@GQypKJfE-TF&&Y;SYyd3Y|EH*R{=o&txh
zkHfS*|M2*APk#C5<;DvS@9r^I(U3W2qL*;Dpz1-x!M17*)^``uWMe-i@NIB65VKvy
zRdcwbg-w=kiO~Mk9h{8SI~3j6{MeuC3Qc!vSl6uW@uhd2hE%2Dd)@n6<d_4_iiXAB
zxR&a0O-?@|$2)3*!~>P;LkueMN7(lM<n`u%TzmNRvhHxMXEKV~xvF#dZDW?ISL#%r
zE-$$&Rq^|D`j&+|ReIS@tG{w%t9~c_$+k_6EmE>rN~^`Z_J)e*u8hF=!(Ve3WZ2A6
z+q|S$?PTqOTb^yA>$A74@H&;$T-U$iLHM#A0zA)}SQnPgNv<#AHE+{+Wwd+#Yp%t0
z%vphdN@}-j*xg;%Rc?O${rj~0*Df}H{x<PaoyYR;S3;6aS<7!NlU#B+N;>4yl77KS
zR!kRzt~BM|y|HkGvBKB0=f0XXzU)`|Ah6WAf7L7PT5*|!kKXHUpR)7%;WtN>>;(V3
z<=WD9<mt(a<-VcE6MMJHYpyr3np%}{gU?eXrefWJt;;5tPw+Z&rs22pjGVdZZJx*O
zx~({{Fma1!fK1VjvL|t7kr$>NnxV2<>Ak+E)g!~*xw~H~H<l|O6nU`Oef129EUlAn
zirIHpy;`$Q(l;nubghZNkqC({#<O#U%TLYS<vQj0Br^rxj%tqB6Duz)+HN!NlG09L
zPNOqMYxRDt5DkiNcl7J$&s09S$0Rq<_+%&Z^O;}uN>b+7{r_M!cTSar-D=J^yi2C9
z-8|iCy3d>ie$`J_U%&O^w43*xh&%ITlKx%@{kSyap>@TI%P&9mH+)QIcc`9fRev&6
z^A^{BMc;#0FV|mr{=fCs<JkvT?;bbWv8rQEZ|XM#zs|#37OQdd)SuP=yQF{eXDz3x
zjPJX7B$nU(|4Ba2X4dPlkVFmVfQ|`^PwvmH?3nZiX$Jvlwbi9rR}Uw#Gcfo_Ffb?)
z%GgD@uoYKsLjTsq8y46FIH}&6HgS=_1Z$RU#fC!1-Cj9IbFgiUTDM~D$=I~=%t*~o
z_pLWS30m^zNa6ao4{u!-pLn|Rc4cK*+Wdpxr>ooh-Sg6$B070<h=%&~pc#^TbR^?D
zPny_C*fb}{=JlKj<6Fkwe);5=ger#Thq72#?hxIn$DP8W9$_e<)2pZ8Ic@6d9uJ`j
zt}A<)mrW@<<GJ=t!iMeJzsF5+i%400{lK)Q#aVoQ&C#3*%NkU*Q}!|LWm(r9^z6_L
ziAeTlw`JQNp3L=HX_O$gPKx`H1>Y*}O(xU3zd7q&<vp48kNK{5u*`FxRCVdruAkBW
zx2AFhF@1IQY}+q5+u`CZ35^Q9e3waGu2WUdq-;}svLxBNS)cRzPBYW94tfu@_WgSK
z$;7g*w(8HbH+T1^F&~KE;JhL_bIT{W{FXU+)2o(5ufMzb?T$!^jyqjZ2aR_`d8%wU
zkf3<dq-U+<;UH-Zv!`s=m<-bVR){Dck!d~2rSW9$ksnJB75#GBC0*!vTw;ydGoJ*h
zCzeMiE5&eZzoePvtoLlr#O_m^LR+SIEs4ubJ>Iao*CxtPG%Z8XBj#Wp3#V4qE=T=3
zu{#F~_D-sK`gLLdTGx|avzhLj_wESke^hmP=ANVHLpjyo*9)~x@?=o6-+yq9)ZwUI
zqMx>{y4c)v-K<siP`BILgoeu589u#Ebzf$_U2JuD!aR?6&#o;rU-xMHrC-lqXFvIK
zw7cun98b}+33ayX#Q9#R&We$7NmN}OzNzft21U!9@MT+D`o5oBxaQQ{rKe`a_+;-|
z-1b>RiuvEgV^NaZ{(e(+6x*x7HvdoGYn^|x+yAN_W%n;;Tjz6o>f&?Pe$D<X5qmj}
z%`VbL#N<}{!$cG53Ne=j;Zq-N@t)?rePuV}WsdGO4jwMbny=&b+4D1OYmQTKS@xod
zBUb$C`yH+<zAKk_Pg*GYvxsGK{Q>K>vmSl1@%C|M|6)4L?4euq?!R94hgCvTnnMcN
z#r@vz_|RagvUE=KS}!IhZjUapNozcFm-olZ^hTZR{XN;#`1X!%8;{hUSsxvhALH$j
z$jA6r^49;K7w%sE<l6VrS?0sp<gUItX=%oX$JPq)*`5Bs@@YMrzF=OLE3?VkaEoBi
z$()^Qr+HVZ=bX7z(qU=wE9;W=l3ZgpK~qiD?_oKcmkG~_JiaPC-G1KuM+fIE+mK(P
zdHl!rZ}r|&7!Q4vunU=S=?cS@t!9a;+t+d&`FBdAtE_o}_zN-RV8-JM-I6wSJk8#=
z@oV9=ty?z#>)2>LtEnMm3dd)skG_*Qw~Csu#agznKXmp$GVeb9i*o<J?U<Eew9-|5
z>x31`6CP~*DYdo8y1Vn}nga%j`i&gBgr)X*X=(3jyA-75oBYgcL&yyGHE&$cb?{F$
zsjyjeri<%#*^7IzF>|lAC&WHpaoZs*v1Qk#Z~NAJ-=DvHx|>Pov_skXygd5-@%;_k
zUe0cuB4v7RPR6<LLtDjW&Ogq6-g?p2LyJ5(gKb!pwpoV+-H@1grc+9z`j5wt=8%<f
z(LeY^rbaTTO)Pt|$aSmZ$9u_^PJHXU(`F~XIDhm09bds;ON+1Un0hc)<@B7bGdpXa
z@+>+xQP6g$-A=dD5o-UMh4x=}Zee=AE;xBseQd7%jlQ$*y?3{pEX>UR^0@N#^|TEa
ztm;GF=DoJ(|08QVCE&(KHC1Dt>ck^=TB6Rj=&m{Unm_OABR2)71sm6uGX!_*eBRPJ
z^}MwEOr6WtcX&No8QmESXKXyY??d4J<p<U|pGyz6dA>1m<{VcCr)}K%i|s7`{`&N6
z#iU&=vtCNixs`M)(&w#(EzjXY=c867?iSxtWH&dqf7au5kMHdJk$3*t?+fix=8yUo
zo%r9b*`7AR-07Ks)QuggueWFXdtATV|MTKU!cnF<voiA<zjC!}yKo9Q1?N3EzAL&-
zr#mL#%gM*P#k_4!uSxFW-oG`?PR`y&qJQ4LrKw-?uRapHlJsDD->Qf^oLw)M8;VRV
z-SFW%Lml(t*yQNY4$En;X2cxwNv_)5!Tz;dTu?1G-1GBW^Bjd8!cu}3&cAjFtxe=x
z?rX2rmS->U)~uYnO}A0+b#}i2dux34YJ)4v@$03UuP&b9&TaK1BQIKI=jE@?GfnxY
zCFY&#UsT84A@g?2_8*>=Hd!-Xh_xk)OYA7h-Eg(@AN#Ibr#C+iP?+*qgnOaJ$>4|_
zr}gh_JJnz9INXux!oI)Nbn$L&-+YCQ_YWVs`9QIoDPxj%Fu%z6-+BV&sd_t0WczEr
z#jN>z(>CCb)LoOByO!Ik{Y~<Ju7AFH`8J1z>L;pf55B*-@!x{8yoYsH|B^etm|ZSd
za?Kp=^xwZL>!Od`O8LDb?fYA=^};n>m1_SrFN?RI=kMS5*5h-B?_Ms~2rZYoIeRp%
zw%$?9I?$&n&ZF2Yq;U1lagM{TpDpg18anOqDVcaFDKqimuWa9aPL52MML0JK>6}dF
za<7i;_|aJDs5LKq<%}z>H>?jx)%U)h!|&(%K;-bP%EcGwn_ZhT|HtdOpI6`QeD>#R
z*^Hl$tv8&H;s3jz_qX=e#QjXDP48*}m39$U1_o9>1_osUHFR=vQH5SX<<fA-qUd$;
zg&B4pZn}!4_O1?XqJG<0v%8geH;A<<Ubu8JNqeG{r|P%1f8S+SibvOF2K&hKbRMsM
z_x9n(8b*2hJ2hPQKZ&#+`=IBXSaB}!=!a!#nT-#1c74%H(0jf1(d$D8-h8^Mvt+(@
zg@(Yrh0~afYK{b56V+^X46BS=m%{2f$$VMh43z_`qqLZPI5KBE49YlP{qfOJ+iP5=
zE4OAZ$o4r|!{yeb_@i26#mu&!HhccFtXz{7x2S1O=$<=nEDtJWH(mKV`{uQnHH};3
ztn3$QtXeZ)HU4Ygoi6uvOE$>e&kI_!w(`)ahl*7{{ya3B`M=Qm|L1pq-*069@<l^K
zE?Bc@-@C+nfn7TeSWi5CxYza%XZPZ@wE<P%udP0_o0Z?Ycdfeklu|!w6N89C=1k9(
z;lU@CHf2TUKjdr-$_hxC;*gdjX6kg*e9ooW3;os}x%KWrm2~ihOIqtEt_qo^P#oUC
z<*R7C$t~)P#L@6xNA4-XH)a~&exZ3Gt35qD#93w4g+rllw4)YerAR+{#l4KJX?fG~
z*3HwW`D8nZ1%-au`}Tp6W#_F4*Z)jB;>&CPeSRlXNGi*t^j}lEY+KdyxGu^11hYln
z`gO&f<NDml^WMQ*Jyk^aKKgI*Ox0&?sn5~<4_8KJIKQmuxL5S{-gNJvzt<CgPOszP
zwtrLd@z<qzzvz>{);zh|_~fd>Oj(b#<|khpmn6-0T-Lv3*@O03aetS7U)!yBICQgI
z`_@UDY=p1ppE2SQo7>5Lb;0I`0Z}36Lph$Y+)Fok5wEuK`ImEZ<<&2Hu2NBqvHp>0
zo2vA3#{3s*=YO)zJuSbnbketMlY>h(Pq?@}U-`>z)+D8`l6pHlCpjd~^jG-9de6JD
zdRg(JHb(8<D)X|S-x|kWPMMR%)o9GNYvtRCR~%wfxcL-w_LlwW{ByFQoH4)S<keM=
zH`LB~8r<lnbDAlBb&3Ccr6k|XN$ShW_Q+(pJ=C9;{NUm-d4V1EQA*`c<-~M@`_IU~
znK}0svwr`<IQ#O&Zxf=OYfEaw9^YPf<H~|bvzGg9)BX{+;bWYt-JP?)FWsD%8QIXZ
z)+;M^b#DIYuWNq(`FFX*f3n5pjN9GwXY9SQ<S$d+vTZYS9TgNWC`~=T)w8wUJm#WQ
z<<*FP83%l0KTVl!D-{r*H)X?DY4^!uvWjIN0~9_koaZn7H#xK@XL^t3jio)8|GxDI
zP&mEeuf_c3!gVv9CZ<iAp2M)rT9>W<ea{d3){MKps#9mJ{b+gAnprVrk?*min>jwj
z^2}nJG^u<2f94l2xLyXCMr}7Q`MHN{&c5kl#|zl&-ps0f&QNN(U936x*ZIx6nIpfv
znmaQ-_I18{W9;Qzmis&2c24Y6crIt?;Vs41S0(n-nK@{Wy>9J!Rp0ba*0$&8h52=?
zog1jV(D}4-u7qipwE#<9#bf_t(Ra+M+gsl96u%8_e%Kwk=MUqhyOk<Q$v0EZxBpr_
zr)^c*vK@A<p2Eu>CcSUl!aq%nZQa_P8^U5{1Skh*3SNp_-uNIr;Mlo6e=X&6xNRL4
zG`lqJ5S)1V$?UDK8|4kHXSk?*Q%^5`J|*|wvF{s|9gn=4^?}LGQYA<GzARJq`b!D3
zuJ{-}(){}Nh}FamQ>UeB8yvl$_}jPS&sNKXSF0YTnwebqY*MOo#_aO6E{zqhwbKkF
zn*IBJ?(A4UEmxNPmdx|Co=pnQ-vqYo(to+%FXeIPn>9J{O?3~upD0NvDclze|5$XX
z*RT4e^x^9NjEF)N)a`NobyUuPhk@akGU4%z<ebF3biIPgwNd|rZ(E4{pS$15y}n?R
zuME?aZ8J~bD|Om_J2s+<ee+x1<0+!io*^=~x8^9E{;>c4bI(o6)|?mSCR;r?ajDw>
z{b~34%fGN%|1bHov|5Q-Q2XLvi7t!j!J3;GtEYcT(A)L<-@S9(W?q+4)zUxDdHeqB
z{j%@hzkR=XG-g9<fae*fLghs&u?dE!S>xZl@!6bm@Yv(biQ+RQ`e(*0@tkHXcii(_
z@ysJx>FMR=-|xCSmE`}zFk4OXwBqL{PrhHir}5}x59>*#sS{7!n4+Ju<;%vD^y8<z
zLVhlJ=Bl^&Q}8|?)oDdX_14Jldq15mqgvT=Wt@xAKCziv|EGPvw=`3wZ@S?XHuYbj
z?U|F^0+Xk#$>pi-=;rqnF?0LB`|yY2UH=|^`SU$6cZJcqE!(!d(oyyQt2OOu&n5e*
zca@C|W_3UKWy0Ay*P^?-h^@zZ;`Kv*XC9o>-2FlS-{+TqE53aGeQ~{f{cnQ{)26v~
z{BTS2T+^JLx+k9Z>asQ^QNtjO35zzp*dY^b^sVXWNprgdd)aqi%gdNPJ-6^!q$2$}
zXBpdu#}RBlRf`riKNnv4<?~fh=}pyZPds*=SHWENvUK^vCz~w-ck+aUb4$LO9xiKb
zyz8m=*4lNIvFG|G9=v(&<TKr8c2mOCJB~R0TN(WG=CS31(+xE>x4x6?O|PCRYiw<_
z+U-}_lK9>?w<rG1dUBvoCPcaHaeDo=HP`lw*~HEiNsz0%8R|Ie)p`B+Y04*`te)4j
zpDDFUc~|4_Q)kNKUQKnIAG9qgXW3S%nb+msWH=hNSk5!MV641w29tG)&gYLimb#d{
zy)dDt_1h**Cb`&MeAnmY%|5bJK6J^28{f1I-(J<`__Ed}LvKEV-FN=4p2F)|`b;jI
z)W0<0`J&LX3+De`r4W7ZNJ>%Alepc7v-B6)NIw7U^C2L&X1l|}b$d@dH(EBGaiPJz
zYa;eWr81|^WZQ2kU&X3_<LJ$gHyLhdi8hM{ZedALa~0XtnV_kzGdJsrsltgnwdFUK
zoRAGv^=tEd^EBsNzDw?|cwg2v9;(SxKU)Y`b%`ZgOCPw}c_;1tXM>!p-)tsUF1UNG
ztfyMsRqc5~Z~^a)K%EDMk0*L1Y-r2+_VNB#h2%pw4!wvFy}WXdu-ja5*SPAb6O1Q@
z3tkh=HxBN9ct()f>yX*&e=oxRXT{Gv5Gb)(?L}<Z>-Bo<;o7Ce>yAx!a@*N+T+KCm
z>V_aQ&q*1+-7}A*#GL;2D{Y?YUCr&iw+oN{o^Z?PJn#Os3zuFElkV?usp%KKz9eql
z>D{ZOC$SYvr{p$<vG8Vd+4y|9HeKw5$MG5|r>&W@t#kT*iQN>It~h9?e$&)l=;%T<
z8?)GM$=S~<tzLXx^djw{`pq@%hF6{E-ct%Pwx4mb{zSoz`m6R9McT8os-!+jcJV$u
z=h_yq(Pm>&^o0Y(Vw~%W=IpgxrJ(WRhL|FA{^D8j3mk&%g!5z<#;EL=^sM@zOcM)J
zZ)b_hBpW$>NgLfi%kCFEIbqS!6;N`rxnskp;Cbi&uJ7!Lz7{V#*>q_zBlDuvIoI>z
zO}Wp_5q;di(fhjk(3yi$cPr0)Jf>U_tg$?JV&=N8y&L%#2exmk)^3z5lNXOvyzw@M
z!FooNo|<P%D}#;u9M3NkvU+ac`2EI4l<`IJ0>iM!YgIU$?lELfpJAc<=)jf9XQuaU
z@tk!2q|gpClb35ZmM$oEQRO~Zme2ZTci-gO72AcFE1pR%FnBEaVxzMD40W#~vRxl0
zEsZQvc0M@a+l}Q~X~qj*O}TyJ{4~$Nc|4WRx{MuJ*T%X2Y5lzGw4HZy{qkF;%WH&t
zme2avI%V<_&9g^j7di9P9^EVx*z>ka$2-7%g#e>}%9F>dbZ^%B?Eg0Vp7CX)EuSY#
z+|e~>D-hdL`P$P|y-4aL!#xe#NaKSV*9;E5;Ak$l@?e)d^R==m*mz2pzmmsZ)uVUM
z7hW>e(yZgnRGU+u{#QB0PSefhKwrzIx4jpezc_e(R61q;`v*^j-aCtF+*a#$ir((g
zd^>Z|FZN6JTowP?P47&cvUuX`i;{i|Z>{k;d`ee+mxIc^C6-qEuUFNdSnfJ2S-K>m
z&F=S7hFvkICkQ>s?-Ow{VfC1O(EVu3EYaS)U*Y0T9j4!w1hoe2ZEoIPy?)i!?$nbj
zR|m0$GViLn7AH6D;p=G+Ut1}DUKb<e<lyL+>C|d(W&QWd$0xOOD<zKZ+i`m0*0oa)
zDP5a-eecuAp4c*8eZ~Wp#w$);G|*v~k|-YIUZUu|cy0OBb(xBrbF!Z+TZ_tuPvQ0`
zJ3Qr$!jb<LHXr)`*seb~K_=R_b!*r@$H0XdyWS=4*tFzs%bQ7>`OUXm+pbOzi=Mk+
z%DwF~eB?RLzHRIXa&Nl9|3c}arbVxE&3EVYT>oF}_s&;b4YjP<e=X$iv?EE~4BPqd
zsvL?oT^gr)dY-H}tJa%I5uxtI+Ru3$Z-gxi^t-sJDrV026W6tuOPnhf$ZfLim56tn
zGA%z~PSept3xpe+8vSb=c-d7I%a`0~2=-Tzl{3+t$#D1lxtr7H*;v1SYF-hu;C`eC
zcbajBqqfrOEn(t@6PG$Jdbg`APW-i%#MGBE)m|aRHv3oh8%|{Z_ju_)W52bYYI)Vg
zzZ-6ya0z|C{(HRrX6J>Iw31|2?X+|apL;4k$IPU|c0a@YHPi2Fo$>qWIyY}lPd@8@
zx!Jq<x9+`_bv5{!Z=}(#D676n4__5}AF~f)aQ@!xd`7rO?~>uf<C8*ODwSrHSkL|C
z$8!6@A<^VHQr<E*#4eVfs{hOL)A@v#R9491n!sgNZ&z&J%Nlt7uKo$dD#y8<EZrVX
zh3S3rOIDib{NmB_vtRpX-xqVK;KkcN{%{L?AHU%9k&dF5y0!C|y5?u7%bomv?bg<$
z-FNS-N%J*Xf4I-zPo#sptmW)W?@-@r&IuhK(huF;GE?c0pR?RoUKigp%f6^dylvVL
zB$=h-)LUtx-J7x?BKF}lg+;rnj=!&$s<7ztdLEN&f7<N#wwR3759a@xmZkWqQYfr&
zq1^c&7uIkpO~^4$=r@{O<zH5{?BRn2uFt+SKJKu+bgi=TYEWhCyVaJ9<5s53O1Rv&
zVVc@BkF7mtn;5=4iVE5Oc$IIH<MvwTJ0J3uO0Fk*CS@xXeA=<yA|c_|J+&NT-kr~8
zD0r>Ds+@AA=Ygnasm3DZ$I$|<%-_~GxwBk&WAiL?#z)C>bBtKGGQBc>`RM4`$lX65
zPN-BldOK?84JUK1_Nq%)#W=g4ND6&fvRXF0<>$2n*U#m-&R)0BptI`Pa`mjaF<Kj$
z)&^Hq)QfZY+D1tSR=?^kxe=huvF`4ry+40HsD9g9J!_p=sNdIZVot_0PoKCUk{5G%
zO8cc5&tC{O)Fkb(s?aeA{qyeSnd=!&Es`^BJsTEJbGaP4T6N``OD#&ls;?jB{a@nw
zc3C%@cX_zbo~@^ub0(kfVGpaW_*BNZY4_7x%Y16jX619suK(i@yL{gR*$cWnJMPC-
zx-yEE?9Z*X&fop5SN43BwzH<c_`W#dGl9Q8o;)g9_HpfmnE}6Ilz1GrTR8t>KKf<-
zhZh0%LES~Z8yDP4sNMg6)674&`=>pd9&vW@(TFXLB5AEQFXX>@r1mE`KihkF@%H?9
z-=@q01-@T@oBtg=c=6x8lw0;zHZ`JqW_{yt`tVio{r<?{gwvl3=OyH<yU3bT8f?AP
z_`yY`d#W;@uk2c`&HwINcGzc$O@*t~|G&R)oY!^a@$Ok>+f!eOy*XaOyY<P&%;ZZe
zeCGAtd%X8`zNDQ=&BIBlhYUh4eVAwT>mcK<Qa3ko)h~N<XZ}i+Rh(3!+m_bqkUT9z
zt*|@e#cd<436k1D`FB}v-`bt~J}U5bl-#ZTZ%w7*^ILTfty_|!XSU|**Z9T7vo}BT
zoD?oA{j0BH)%&hm*S#wiJ(#tRb%o2k<Bcx!-({X_UcP?f8Kcb)k9T}_+dpOB+Q;v|
zFL;`K_uQ@Ram~-Ri+(*;$NeNJs8sfEh?0bM`!BB)YlGL{iq2YjFEhI%+0cIbn$zw*
zI)^7Iimm*)URYShQ>4qct!#^5fX{E=dy8VO1-N9to|Y-zP<`p`r*BDxTGg97uHCB3
zjz3eo<^D~B*zb4OpLF5<-rzB3hvP)`V|AJ5bfjyFas;h&4~OqcyK+Q4?n1`1V+Yzg
z{+{?|wrR)n?UUR8-FwEp{dnP(n%3B(-A<l~I&W9;aU1)t{y4A2<MFC$?I($UogBmO
z{70HW1@$<V96o(Q&yIoN;wNHy9GTgvpsAMH>iXMmlOFv4Cz6|)?|4fk#d>Cro22UN
z6Pu1(cRk(w#v(HEbc0LqAqf_X3Xew_U+%7#`^$2mJ;mC%eE;SAV~U+_rRAlidv~p>
zik8`5_wDotgPAAROgTJ#<C#?{vrZ(1+st*JTx?k*WVdU(?zhiB7kQjJr~UEC#mDN0
z)%)kwsNS3B{c*C+XP+aVoR<BpVbkySa@$<}eVMDB@ZyVG*1dA-b5ojm_VXg4z-doI
zLsTon?(Htm&(40m{E61dBPzY8f~GAxbu^;ulZ{pi&-_*1n#LRX^N%L|f9Py@GX1m4
zR9DG+yT9A5Joi~@m$koFp=Ps*sL-sd#f6;yE+v+0g9X(u>a@pCeiI|+DVi#*`OMYM
z@97$z%s=UsQ|_H!&ZD+aaE`lp(3yf5M@xa}&rh-(5WU3r$!67y_K0aGBiWQ|875a9
zXx<<0q+dAY*-RM+@0|jb)AWv{#?`c}ca57rclTmWLH6(OG~f7qGMOrTtnXK5RQhDC
z^TD4FN6za1`h3Zx*6#-9^SM^qPyH&f%w}S0=I)vLU!G?f`foB8occ(2{Y{%y=PswL
z5r1P^6S`WmZDHiGM>@WzR(<`=vy$;%p1sFs<Il;nQsfH-uhy5&7LTl*Q8VSdSfq)!
zTKks?Cz2KVKAUJwx>Rk#Fl)})?~Kg%&My<U732M9Ah|#G%+fkN9wQOom+a5j?<UQ!
zzhOUpa=-o4jco-Jr<6{a7AmX0Gw+x2-!h;54`Z&ZW?l0kWDoECf4_buZ2AAZ`S1Qc
zHD8my&ug%^y%lk;u_o2bbIHpeGymm2G?iUx8oV~{Tw19pqo@3#u0496wAhV4#Z9>B
z8uUc+t>4#6jek#OXO-VDG7<Tn66GcL$1F$jp4mhR^@h_TKNxh*nCKtLF=XF#{H>by
zof%uQ6P%}H<xkyFtM-HCci4jxdFH@pKR(T5iE5tfD=iW?WyABwlYTgcgt{87)9!3o
z#+m2*W?P#s_kOL4AKrn??z25v%)9NpSWG_u68rgM{f5^r{<)<u{PVx+=%;<CU3lPV
zrTr7l`Ksa{Bxao5Y`*^#Q@P*=b`^n$8H~jXbj)L!*%ov5d!7$?voi1f-Rh6eUfg|s
z@$=#3`h5?tJ7rz@-lf3tZ~6Dbe;@uXxgh?qnO`ws>G#9$+CMzG_@RF}|8M&>zrN)^
zlE3o!l0Cy-?*;V|%U<8A<5*nZe37T1V*i)-ca>Q>Yo{NZFP5I_Z`gL>@5b{-m|7a1
z*fjn3o2-4{-n<vAho>_bOUSX+W(l9(G0*;G&ZH^bn<g1wmHA)m_J3b<_|;E)tg5Ov
za96lno$kEa_GsmSj|z-uKXau<v#g#iF1hA_$|2QxE|RC_WX4UN6R_ai>a4hT@7~Ng
z=yfeQW}@sP^~YA8$^Uj3ufJUK{I&g`kE?V4gq+xab<-NI%84gVKYX0;=u`Lk#p?XG
zTjb1_O}+Gi@&CEy3-=t_Yt}P!@y>`!8?DzXYh`CVmx$+nJSC3((u4Kfe-%F6Z<`t@
z>%U@m@~`g=|K_R}pOklSIjM0?qqUbcD0fQZfqfJ91}(eH$k`uj$hMOC!aQc?DYb@w
z<Yq{3nlJ2d;N?0+)uZxWoR7jzmfi6ExwI#9GSeEXUe`9CW|b%W&wTIHX*}>s5K+-s
zS$=p5Tc6ef&$ax*KZ@%(jqJs`_o&@tEDB@$KIfx=u=s(VM(Grx3br1tu4F?QCv(@W
z%q&(m%$H^gzn-CTbP3x@<(PMG94<?Fb!weu(a4Qym@(-<(*$S1&l4x_(qOD!z&yoB
zOYQlIogY1S&gcy+iq5c*3#k^<tq6O{;8{0uMOas^Z{nw=C%D-s1uZ!9dts$p#GGZN
zm3>z%W<5{6`g->A2Jxu4e({t~LSa!0>-QDRigvt^cY8^rXI<kamYLa7?T<AB82)_M
z@xRO8u~qv<!UE&Q9p_$YFRimYAi(e;XomELPjU|g({72UNAd>TvFo2F`*u^%ahJ9z
zd5)8;7ZYSYpIYqmaSD6m6E^7sM^6|@g}gfL@WrnG(WUplcc>W22u3pbwf9@gEn>;G
zb$aB*=G63w?=s`k9rI2qtxDk+TYj;1mST~QJ4dU}3fq<oADRC77Cl%JsT<9Iw@@{<
zcIW0_lPj+9)<xU+b3M5we8aZYWv#44#S)IHi$DAN_4dEdEo||!$ScVTd*q>&!nb8*
zT4|K(=a8~oiToQD>)-F4x9|SzS%<e-^yC@VM9dJ#;Ne)5{<~5`E_&sHok17k{~Ph1
z+2eITN<Y8byok*@XhXnVMmKpzp@ulMOj&OuCa<mj9y2dKy6zB=-;)%faa!)mIfiT2
zmv}`yvR-VK5^w2up5XX$#l^#%rG~Q>_)7I}VCCC1{maY;6R+Gg_p@zytRbiR@hV4Y
zW32A#No%ZJ4=kUb_&eeAgo0S5eN|!ck=vWCI^5Ut7OC^LMJWGkm>hOxwcX-RYp?Uy
zzm!sXo4RrP^A~{}g)7fZKXC8OQlrJ5-3u%3#NXUgo%!JIWR{mdw)D@)(S0R!W=FQF
z+@W6wvJ7T~70*0$XWF7V{RM&glCt~CJ{`ZSntZz?!~58lMW^%a^QX7{;J&iROY-|2
zbE|-!KS}e>CqACxp0Mz$>$Mw)OQ*$5ykxOSN@1V1)2ZGA_q3)=`Z0ga+6}qK_Dd{x
zogrqrc%gasx>HZy7rhUi=ec%<pDVZfg~xg?>{&IZez<@4nZ{?MBW(+Rw=G`R$8cqj
zM6XBK_Qo~W>O;gYFUY+SQ+;D+{2iVnTcc8Y`G0KWKb1B;_lmLCD?R?w?CjSOl{+V`
zS`vChc5O`T`gm#UjXWnETi)vwD?YfN8j`Xl>cri7s=}9!u&)d2Tl4Oh+ib5j@_Q$K
zHksvdZE{***y6$#?n6HNlO=CPPH2!^-Xi%wr>d3lnu6!q`b?2TiFtf2QUTxJpRz3O
z((QZpg0cIOaQT<4AIpAc3Z7ND#WUZIVN0snD+!i1od=fZWL+njmEGT4_4D-l#eWyi
zkK1o!Q(;{7^VQpfv%~%Q-P`r+ZOSx_Pfj|u)aMS@x{Y6irm}1haEP^)`d=zvQl-SY
zZ24!7t?66NU6|x>|GvYKO0kevvrinnFyUou@&bdCZZ|z9uHC5MJmJmW2X}%w_!jTi
zXXz8rNx88+gL^S&>ur~v{GSiq)MB|^yY017K(M|Ne|qM|1?2*QtBo{G?^^w+=bYg-
zf0|-!l61$GYu9pS&R+7l`JO2w&qVQ8>rFqLvzV@$#C@jbM(B$rtzn02`VPrf%ziy3
z_fxZ(`G&`35&XCEpLXng*wM?p`<h3JZrrzRD^z=a{k6O?p+{m1-|cHDGrL)}mM+td
znW3?_M{McQ$3@0A988}j+w;$Qwi&V%b6X1B3j2L+lbGeI6E`e`?PdS(xzBlis;q^U
zLHRkASxam-?6ZHS!~W;U0--#k9M)ed5^0wEMdy??GP?-wde0zStI9j0ZSpEtx9MqF
zu9uAL+qasZE;h2bcrNAZM&a;fvxQ$RFzkppx4i7I-o#X{7y<Twr^~|oKD>EYmXX+g
z;k8<r3Hwgl1M6H*CoVoeY5!%*3vU<5+GaJKew`H;{;unzenRAF)6;1O7rj5T@7fZM
zNRi6I-G%#>m(NPRx^04SL`Y&;q>1VQ8;`=&@3%hXIS49TmH+zl!1WJ5$^}~*Z{Kpt
zn-N*H<J!(H20v@HFGdWabL7he-41?}J@1(&zFVoFPlDkc+v$g!riv?EKJh`B-FB7R
zwXf>JkG%IwvhDmW-F51I!;A9{+70VhTU_m&<*<CxD~)AG&P?gsT$QJ7^Zdi9jw9RE
z?@f7_=@NCJvc>rZ=PjRQ0ba8k&z_ofJTqqXp1ocM>^GjU)i$P2joxtJbU{Z)^zX-U
zrynl-&@~~}U;B4Na_O9|H3oCFLfKN!hWocwB(coj_fyKAcf;4zmgmPU=P#KsrHDaE
z&_P|{+Gi$HQOAE}2UY|~RlKzDx!M?L!oFyRIOmP`cgi*Tgu@TzYx8$B_UJdKxcDZr
ztqSsayhu6bt=_YPib)e(FQ;7CQ0#CkaM85FX^S_DsS7V^V}IbF%KV{f65kx7`JN^`
zr){JcaPOISl8xz$Q&)dv9jA7Glg-K|Apu`?{}Lm!nI|f*9tfYJ>u{z0UEYq4OR?qZ
zzxD~p@M|{a-kxH6?n0H<+GRJijz5l>a>-Ty-Q!38&NGjmQaXN^bKB9aU#CssSh9To
zKT)^)%rXAIYwz#5o5s#vZh0a2v!KtpNjBNL-dxaiUcWUrVO|Z#6~^S2kK3e5s?*P;
zOm9$~$a~Fb{hN6i=huDp3f0;5w(i#D1#{DE`L*8MPU_jw5-U=^zq9^%g4zYi$0lyh
zmhb*9yu0<EvWPIJnyMo2w^s)r7XQjTaHLdovXku18=?`s1_uvIAI#cR6#Mbnd{@yk
zN1{(Z&0Dc@*2$BP@2>Yh`q$QwFCl|*6K}#I+piy9U$*<CdO9b(;0dqT{d3Ae4^@jJ
z4tPC0bg-|B_u@3xvpng$xE39raHhiZpuW9Y@jKqPOW$ojtu?<}=!UzSq4Z@hv987i
z+xM(dU-2dJj`zcPi970(D?V*}yLs25r509p4r^0q`v05ZzT!vdqYXxH_%>Yrc~3^I
z;(V&LhE4@<jqju2*0*V!wgrE_aqCu9yo-(HVx9+!CM+z`{JKHe>cOF41Enmp{V!cE
zH#j-^IeB_2e9PyYk*n*x{jlHa1#3$utT79I{aSfPZ>Yplk+sKO>247SUtG0TL@#i9
zjnYf66#+KBh8@j*kp&Yb7f-nO=;p)3&M8%VI%gQ1>b*q$<?LkYnxEfHnf0mBX5+#6
zlinQty`h-H_w#1&ix;aBFXZ3yoV_S*>ZbhbXPen4{5fj0S8cmV-SYME@635Se?F;U
z@%YZe`Gd16Y#U4QvEH}xsWTRcE=jp&p{4rjP1o^n)@%;_JB#CY$3NX>TJUkc-3^h1
zRR{K`F$!+jRQ20;_KwF6nZ_zr&F9@@QVfF}#dz-@yxZ9jYnRAu#pssx;rIc^(6sf|
zcMl8yC@ubc_3du%Rjto=ojk4Ky^2*^)M7@+S3kW_Z+E{JH+0X)1<rbyyu|IznIqpT
zlOhr%P8Zf*<L=9JS>&`-ZpmzS(ZZmni<>2u29|}nryqDap@?VwP1ZwKAJ#3&jjTCT
z<YC46vb@xaH*Q)|(38~6M9uwnH_m){P**9Ob<Q#P^y?(0&L6Y2<{i7+@I1d-Mtx?M
zKmQ@7w8<e0#1HR~|L!jrIk%kcL{r+?35P#?c)EK3j<8wgF7XMk&&j>(Y?#k}uXxMH
zH&$&K*ADbeSbUl(RH-boZNaO)G(or39$|N0PPkn8)<$dZb}PSG+YH;7nIDO?8J4XQ
z`fV+7l3Rabqb2)H1}<-ny0h7<eO`1}%SWj?njCmxxWnD@W&=Cd<CD&7CwvX>+dDB_
z@Iq<y^jpV1Oj`UnzNVS$g4n{?$V=x{lLWrTzTpYH!l=r$(XHs-ff>s#O0rrVJz2t4
z#DDm#!^Pl4r&t9pyPJD|eVcvJJifVb*5=Jojy%!pbr$oN{z$mxU%<@cvTD)3H4~Wr
zar>P7e#rW@)dIOW0`pg|>Tt7JZ`-!&yXt0{O+GdmD<6wJkKA`eIqO2hB#8$nIkhEE
z-A|J_@8<g8gWrvJqBgUpuJvsx>D_HrP*oAH(vcqLWVXLz{;qsw_n5u8q2gt~u5lG_
zvt1!FopF=fgB*vu)sC^g?e{kYPFtM!CZF|}=AI*h-_+!aeD|zQ$UCE4E?4ZZcsHBz
z5<cNWM+CP@e3$D|F1xgNs#2QBiuHGt8h$6Ri)$ZX?!MLXM~h2E`H<T_zt>HBvUh1#
zO@Huwql&BCuaw)?u`hmTsxf<4Y@X4#O7yJeJ8qL=r#0`dJbkt9b=YFLdDfpz6P^p(
z?C&oAB_4iZ!|&@mY!uEdYlwX(?Q$-4&+_oCliz129$u34O}}P_;>Uw?o(Roc^y`I~
z`rL%fJEdEtOZGMK?@r|X_}+ON&k~)krwUKGChXgtZ^s$g?{LY5d-uz`-9kM#u5}cc
zG%y=U9lXM*nYCzEWZ5IHK8Ht#-@W*nKViLc{I%xmzbam^t6YuzZnk6Vo?E$HyRA>I
zt3B?y{84U4`-0{T2Q~&ZSXr7IwoRE+I_HDn^H@H0hmGGi-_>|`VNPOZHJj$7FLQ<4
z+ar4y%C=-GmhXQU#F8+#hI2)!<iC@(P5ZV#<jb(!sPRG0tkCV$e1&`NMH9C-)h9V-
zO*|RM$+*2tx%jv3^N*XG=g050wvkz(d*R~=(YPnq3|hK)qVDzX(e$%C&akul&*F#I
zTTHbtIh0QEiY-}@uV;Up&)Q(`f<s!4YZba@f1e%Jov)+)`c6ki_+uT0<C0BWv6F9X
z<;ctCDOvGN_*zJlit~Aij+@;!oxdMR$(Fz2x>NmS?zY4izsnyzbH0{)t9*ubSXT8b
z?*qCkAF3P)D4(`7Z5B_{+9=br#mA!_O4M3EyykeVS+$MdTUYkf2fgN0>q^(iguah$
z@!uTJ1Z5odyb$uZDcC;6y?WiWl9z5v-<KU(&tlf7VUb&L(1MHYyksbYPxjMgjsh{p
zR(U$}uL&-y-=((ZZq5EP(u*}Vs?2Q<uq-Ipl5W4wMCGsNyPffKOkLal?F|1?9)I3?
zZJPO#B}W)vo><Wr(`&u{-xTGU0uQ@{-Y`5^x#PX<>s(E(n?-xy+%7TG+xG8FyGUb}
z@QacOdyF_Oqxni^R6klGy5LUn@4QP-ZT}ywmzufBb?fy_H{$kNR{VXI@&Cb(iU;~P
z=6zo~`IP${n@f&w{w!$z6yEdCET%7h$KPuie*epQ*0nx7f8y<`vypSBzT%x(_LjH$
zIpe&~ml6dpZ93<7<cDoVc2I*Lvy|{E=NJ1H%&)w8q**q;*K3)i-XBx@eVK~x_CL<m
zpS`d7W4Xq^iMbWUo6Foo;%8**e|6XCSDHCdf1{_*JtcFG3zudbeq{1e&+?bwbsKg&
z_qrKN-jrQ2o%--`jhZ3<mXgiqEbdIZbjaZO?8Ei<_gqam$S$97p`ACuedd*Ux-th;
zkMS{CP86D-yvOy)jm>I(O(Nm?7E=~3J>~3vck88dUOiJ61U6`$Sh&pOT8Ep}*>1Ki
zyN+Bge8oRm`{YFDcg)Xz%vdKs^-8?&vja8{J-F)o=B7WIyhtk6MRT^d!{XMS#adjS
zD?`IRwDzc4rMzZ+e9@KjtaVYUM)l;PQgg<|(&Y?6eFo--mThn>%2E5+z`iY5zQ@R~
zs(vE3RjF*pa;wEN_mxX5{TKLZTZPo|r1?SH%D&bAY_*s9`y>AMx5>Xk-KTyQ7Y<_8
z*pQbi>UHY~&pF;Q+vB#;>vtvR^S7ioS8VH_ZN1!TfyJ9+Pv)HS|MEPze9>piV^0=b
z?|jUqWTTnh<!^MVDaCxsrvrVTPxT((>7mrBZph@*bL64%FE*QJOy%b-LsJ(_e!FMJ
z#LuUDcXxh}ncQdbSV~uOZ{~^ymH^A|o|Q-Lz5KPUaM4G%C0)XS-vk3bY*|-iw_~f1
z=2XFs&WX+3hq4_{I%v(4*erKdYeib^{MCxSW{P)rD?j#1zQ@(2a>?d@#Ci8qOBpt6
ziM`HX<j-`=ymQ0BfQvb*b<U4vizOSjpZ>5X_~)FP=hr06v9Suho5aMkg5_^D@3xlT
zF1nTGAG4)cCS-qasE^ul(d|Lt8|&!6_op|{xwNP;hFAUBff7;fbB5+>M(^%;9!OsB
z!HjkJ!s8lR9}=8pvn1@*{+LZ%cuuqXb*1s{iwQrUbj|q~e&TR!&Vi~}&FAeKc5n7A
zf9qV~C9lN8*!uO)WY*lD*6gBTrV8^`$|hz{X$tK+QRKUIb-+RO7wfg%3$4$Vs;<am
z%{baA@X{@I^4qSs;{{ViMA=LCu-(z}TUzw_^G2QatqXFlv$M=weC<KBd;dGLmU)%$
zGDC9Jm&r{L7L|Iw%FF*5PpM_a<G{rW{l#s6Z>ik3^-Zs^+N}vccw9~WL|nf-(B_L;
z!4TjjYP!Mix7_)!*}F>~9?iaZpr<IodeIeg{ke-A6HVsLxH9u!RLiL~Yq;a$61pQ@
zS*IAxI=k+N$aNX#iZH(Gf8U*YTPrs!)Z@0x;*yVgT)E3cU-t<8ePv~O*KNbD-|L;t
zUNm!xJ=w<NoPL$vI3uNU<LURa9v`;v({ro$n3G_mwts<hM1c02z&A+?m_F>Co}0A!
zyI6WqdCUBy;x}yfJPv7v_r-g$95s$(T6E6P&~Ll{n<;gvb>8-Rr^An(Y}H`hyd&LW
z@AL~33SKl@Kd$rsbl>U!2JV(k7vtw@EjKyv)H{Xah~DI>cWT3{7Jj(-q+?H|N#57B
z8On(#`qG=sHtS{1OF7rR{hV9k%iPeY+7HoQ0j*oV%Wr=vHur5_>AbhU9<IKzt5S$3
z?Zu%bqL&o&9gh~tIM2U)KyUJ-MU9@nmmN;;*N#wCQnm8&jEs;~bKo&ODlBNaD!4y;
zUCr+n=Q{r{v)3Bi%U!5V;b`%(EnIrsqRX*6M`q@S3ojQPv{*68^E#LBCmxZ&n1wp~
zOE$Rw&`*gwBD6h~Sw^fQLGFZ@afY3y`%FImQ1)L6aR(QOoYl%dpeXEeb;iurM-g6!
zquq6`x~~!lZWmf%`nK=N`?Qeuto6!HF>^Fi{kC7(xOrYvdWBkBq4w2xTx?;BnD#Gx
z{BQHz!*>FA?w%WUeIo0w#@8FyB&_#6{8@CL``c{?*)N`a{BSb+_v-6nGtK{Ae*fUR
z`|@*z(lx)9|NL)o>#W?d!~}_pPO)p3w3_VCX)WbHQdv}X?_cH76X&vS3d+}o2mKEE
z^38SbLxV*BuliyyZfi76ns|68i+7F1m81rRTaIG8B%1DCyL>>^Ipz9wmIrDVIPwK=
z9GD%^uC<6`>Vpc!v?;14$BdOv-Cx91D><E$`O>3B^`{CvCPz9s@v;59D$JZB7W+`_
zmT>>Nf61rnzeP^^xcTAY)%o%t=XWn|YnrF@*j?x41efQMm)^t%c3f?<W2`jLNx5mN
zwWvSJU;n)3ri`}|M@$`lOfmh^{wcubT~4Esj8yIVYpIof=hZ$6AG9-?wJ_{UD3^T4
zOU=;5uRnZvB%jQ6ZD0F*xeoQ1DV^+B>R7|4sXvuos(brd{+)FXO1rQAxSSrzn{IIU
z>1oHc|CW3^WM62zNPDjwv+0boV&{16Sf02X*^R90-ppKB)El#Lr?V(mfYjE=%W9w1
z7|t}DlKdUDVjolA^twDB*(oP27T!<|5&g52y{_v)-jV(PcV}$s%x0*#-1XZn?24M^
z<>Trbp87ufXIxqHQGlaDfAP+aO~#TH%P#cGv>Y>iapwIVSpn|_mnPr%e$i!0W50Y*
zl0sqRg47>N^~;V-o+i1gF8OWkr*peR?LSB+1sfjbF<x!*m+#f3Ska}ajm-OJhy9x=
zve^Ga>bi61KA60n_AOg{(zOZGa}=iB+bXG;mlszOA^vW$N_=K{#pPMep3%P5(f_r3
z?Q2eKV`C~=@Mg_>X{EpKcLi)z(l{vBboHj}*@>c!9Os$>1D2S$u77;aw0Mcho~E<*
zmg_Ee>KvVs)Gl(TBgT9|NH1$AtNQ`QO@EiUwobkFY2_on7pZ^LT`lTnE&Y7{{^|M0
zoxbndb?tPa^HaGOGQZ1y9};~Me=j0_yJ(p4mdphn7yWkgs~k&t{BO5nzH!OFnVNsf
zm%R1wPgc&)Q|@_tnp3Bk=W&r(@5iOw+bzGYRXnKosX29N#<hCQ!0T#X`~@m@={%eJ
z^xm_IyD@)EH~wo~qM-b#jH%$jWA!zrt%+0A(yu&DpVq$Uq?y%g_jRSu{?=<Q|Mzd|
z(mQhlSYF2`r##QO=W_mujn<JTyHhn*Cs=JNGW>iuD8JVG3ER(-s8d|6i(l3+a40){
z&n#?u*IoTh)9rG_|K8X2*LAYr?jaf<x2kK~n?HNM9nNhn?P-#VZCzb<{J-+2Uu8<+
z)``5Tlb+<N7}jxGzAt~#QN=tX>dhme=vg^z?ZMJ}J}yiYeEnSO+^jkMvQO7;3-z_D
zjpk|hT<~7p{I8Dw&s7se{vH&Wr+LbAVnC&B&#L@mmsj6j7m{P7_Ud+%M?6pbIV;Va
zJC?oC-^CA`bV;`L-->fo-&`$}9V&9cR`lJ2DrT!SJ*S#olVavqcCUQQAP~2G*RoZA
z9M*g7I<j3rH&%M}=~ch?{5y7D;MUH}ZF0VQ6qhE=R5LDq>AB(S<%1tDuD;maynS&x
z`}z2NRt^7U_WgPJ^meoP;>X+l@9()=B%Jdzb>C`L2Jf_^r`gxf%e^V?t&=n9WJySH
zRZ#lz_i-QF(-%K(4$pshcp>wFlZGbyOI4+dz6l35e%^g*#U*}&t2br)FJJO+*;Tfo
zbaC81Gmj4zyQO(A3wG}bioO+K*1ff|@$ZGU`!{_1Oz#VnFZ&|hmZKVYtN7`JN0xK`
z*nC)Y)Arzz#qrhx(+~f6^6G5q*$Yz1yMAk&dCFqDYNt{D9M;04du<J`^Bk+~;{3T<
zRr256X|apGd|2_RuJEyZcA{hQuFXe9o?i=PJgb`&vLW=6rb3+i%KNTWN4ae?+;r|b
z_0+zxeDbDaw@#j!-kfV6ZbYA**V=ddg2;vo#s+Wv^Nhdl*dKK0!rl$`*V6k;s?(kw
z+ZuVbx0=t(!ktG)GJKU`oUc~bylb73mz*2TukN^UBh=X@w<U3R!#Am%HIftFmi{`m
z_T<gdNq;7@um%+z(AD6PXqr21wZg33&T4`hJRj<%*Phn@en<S5qTSr@w;o-|H5G^z
znkv0&joGx-!S3tCG%n>&HMo;{JvZUd+J=gD4=desJBzBqN<$tmpSkt)$M&^tn==fj
zt(v8&8lR-%G|RolT_#NS@o68;tCQAAAM@~e-615dy66r2^cy>hyWT7-&ApO2|C~p{
z|MhOU+dN%LqnqTUT=;)AIv30NyeQ#3VB$Ni!9{=Rg8B<QTwxQ8^Pes+VO4%GV@p~>
zx&6NCjoSB8BPy*fZ(c4Kd-=eOr!(`+wUi3gudjZQ8+*7U|G=W%$8I*VIk41T{(VIF
z*j81BI`hwKG^4M$%&1%-w@&@ehD%|>b2ay^Uc2P%$<@Z{+b@f*whT?*_S#50r+Ckv
z$TrU9Ri=FR%hs<GQf;kLXey6ve0nReopV}jf~(-E$Uf27)iN86R;gT@lll7bTB}3P
zK1cg~T&}}<YJ=li4(3X|t4E(sG<aaCZFnhlx8~QBu8F>8UN-9;%?|DBetk3N;U3SU
zTYZ0-t9nhSI<nn!rPG2%&+px9bA9~sRH#?Nr!Iv@zo#S|bv{tF`q#1KAM$%P3#gv>
zV6sV3cNLG!@qorQAI&XO<~De)Q+Tk$<Im;VeOt4>{JFdO@8fq~CvHEId>s(dIMG`v
z;iAS{hi8n%L00KXFK%(o;eN;vB*XUJHMG~uD`QioaLS|SuDf$SM(^XvzSwq5Jo>eV
zpJCO<S9f3hcyV|3U*=E;|K$ub5<M#p%8DJI(fa&XRHgBml|2pX5`}kGp3XmS*fO<O
zM_%=a@T3_{5jUGBHyxa3_4V(>DHGmW-^q*4Ug6PYzUQ)A)ZFkY7dzRHk3-95KD$?C
z*7v=i{WilxUMCqw$%8j0mWV$(`fuOPu+@%NH_lliaWY$D{x+7}g)7T%uXXj+xHomu
z+|Fdn&Mc+(9NdLhW`264vEHX``iV!S>Ak0NZg*`C2=z)oe<`bQUrgqzrsq{^Yj(bV
zXe#zFF<G>PckW4>wcdaBKVIeJ(y_KS-TQ}{j<4@p`R)_%rzQN<y;pZI*ktp8C$5)S
zmgY1&gmK0neO-G0ujy2mf@jQ3+a?`P`nkvd(Iy=}ucOxOTE$&z7nlG1lyr5eS5^w&
z?FX!EQXg4r#pgTDR`u?4y7GO`<o##OCWkX@jyZPIpto0OLxpwYDVf?HlWZvoH-=g6
zrVkCJ)t0`i(c619RjxGr+>?eRxl-+OODen5c;z?o&3jNaYunN4m8+gE{&wQ}v<i!L
zi~7&3nOXP4i)C$mNQg@NlU=L#{1-pB@==cZt~aWEhF5qND!BKY5c58v+R3t3lx1e%
zPWGb;G8Nw*8K+o3<(Zqc%5d4u&vQdnDwXzlwQiFr>6p&$?Ea>&wAC%se@pQ`?shFN
zrGjP#|Bc=<uQuNP?7S^XbJ<SY10rr!{}$-~n_IqeJ$Lli`X1l2*Y|Z;O--}X5quo|
zt~hqNm;M?vi-)hD^E>W7T=`pEONq7m@63-g$~UuKp0;kA+y=$WsKi3vYTgw>Upl{W
zetf!bnO;BR(|c_1Ul!Vi3jS8?bBQYwQo489LACu?iQvTYy_Zb9E=~Gmy)%T<m+8so
zT}PcZpDof;KWXytw&GN4?yw;KBd_jAPTe?t$DDhm5><z4w0#aOe(^^3b$aB<C5<nw
zqN<iTYiZ3(xtsHyuYJckHaolX-B}i%U7o$So?W?EEL<&~p3SSVS@Gnu8iAw-u`aDz
zcCrsb=cPT}cy8}KIoaN;%LDHIy2`ylE8F1H+kK+P&u&W-inD2Ev)%M*&l&^Eoy!*#
zD>!I-$lZ^PTyXR}-{UOzisIPvqK>DfXPeV5CmCO!vFhaE3&N|E>(;6jChIszwe)Pd
zP=0XMFZP(kdD?}V+BuV!XMI=gW3InFm9M1wVqxfovl<mq{i+RLOf_q-|5f?Yy8gg~
zS>}R|=Waf?PWzVmH>*0`XQnUiE{e|B`ffwE5)0E3nIG#oUmTnJUh+Xf(i(Z+f^%=@
zx2)m5Q61B7d${WFSJAu;n^ql9{mf)`XK7B1+#V~de_thb@Z5i_lu{wqRZ?VkI{At2
zDQ`E`19OUmf9y*SY2*@{$lJWUce2;%!Z&luEwA^4@7lZG_r=@gBK<cs44m9tXC=h-
z20v(8svD~N@>1iAccyQyDxCc0wnF0Ko#?JThF=O+zTRjw_lW(!i!}yWQK2m7|2^hr
zc0HcHbJMGhSKb<RGq^uF)55>`>eOoP)klB6*|p~RXOoY)56^Kwk1-XQzA>cr_Nz<A
zm)5qedG7o7Y3g)OxuQ*K;wmRfG>^=<%W*5+KxcKUCy(>2Vg^@T^^RmICR5Gki=RJh
z@wcs#TWGU$SH)i2w|ZZDu59xNI>Vp*z9(Bn&i;4zf!R4pv4to5Toa>q7R|cE7*}%q
z>nEMl+{>!hTu$KS{q%2R(MrWv6E9BPyI|k0dkb>|4tDi>S-g^!-KC^-L91#(UrYew
zXNe7=PtSaG*<QKrQ1Knc#ix7I=DPooowaG<n|E8=`+_>_S*Py0=w7|d%;l!CKtx-%
zSm<7M{*I;J><!DZjLq{eu2Fk@=hYkeqaTC<TluxtH}9VPZAIV>H|3=#dfJw5&)ar|
zORSN7PaON^PfV|)7EcdbcGy$uP6?m0rA_3eDm$~3ZPRWGEMI!hG5e)RZN&ad6Xjoc
zE{r~}CMb6xs;_Ion_4Zdq?2q*ch_^@QC<0X$LH7cbk2ktWQaccyyU{MyA8RT?6cM_
z@08jSwjli*)3g%D@Z^+}E>>)EzKKm!Z?V~#*f2hNedw#H_^hjiiOE~N4Dwe!xh3#a
zoiSkdvtq_mIqA1oo>JcP^^K79j8{+QY_YXE7BW3O>QccJyQ_0+XIE{GpUo?)V6w&`
zmV3=_wezcPpUMjqtJXD7xUFH@UnbY_J;Yz+<*}XDmwp${;Po$SxHvC%m-&}3wo)6m
z{5i10&g1s!?9%oLidxYZ=9yZZ_bJexW5ZyR@No*q>4nd{PAhPG-t}+)Znh#jp7->!
z>Xr%OmQex@iz)<GaVl?Eq5aZ&$*V0gX2%w<|7#t0b2|IFIUSQFe)}!8Dk-T|KJx0T
zobmO{s>#N6Ue^lNw0G$(>oK`?V1-ki)7dkvqGxvoT9>-4f6yfBurx;XJ#X+?(-Lj5
z;Ggfa)0y8Kn=-2=zIV@Yt$_J;ySHs&KWp=C>FMVEr=<1b3v*w7c3T;x)^Q-qT=#kA
z?XR!ir0ma*J{Xh#rELD&lw#XQeII8!w68rTGyCY7jp-K;O!@95{iFPB=d1PGSAJX5
z^5VJBg4toO=byY8F)LeKI`GLKf%*@pcbAs`(VsGD&!z8QT4Vg@3#{0u`|YKgpxv7E
z%@fv5aJ|+V$iK(qn)=E6o(dnXMqW;s_57i!{f?jSoW(A<J$=7Jcka?V3WhUdW<FjK
zF*}%PuUXU4t2gq@6n@@cd%#l2YU+>O!RuUh|35E%?$%EIy7x-ISBLMJ8}xmB=z)2@
zn<l+gvH7Lr#j{!FqmFyb;iNe!tM$dcb~o+ZeCzsl|CN0=GB(I&R@d#>pxSKcRO`kb
zZ{~65<LP5LrJpZsIqn+!C*{t05gVfyGD7_>_ZOS<{Set%_WW+w=hpA$R$oQRzDf)A
zo?tn!pf`hE;FwVLgVPQV7pg7l<MzIFSC3aXPK<reni-ETo!ZUDCHo}DM`v5P-YNgE
zE#fVER01+XCDuw^ZrEe->d{_XlaSp?8TrD>zn7g0;LbbJG0|D@OT^shqPchV^CEQb
zie48v#A$WecejDXEAL-L$CkLTSLMsCs%Cmwci?tUvi&K$hF{)_7FJ^2+gW|PL%ggv
z97}j}wf`Q&fp>bxUadR+PH0U?iL^`n@#IBjyH}q~*f3i%)S%XHk$;1i(IUNQ(F$FY
zrN3X@HnGm<4Lu>tzW5m5q3tg>9bS6o!cLvM*RkCnH`Mn{E%?W2kn?xO%tt!WxpQx>
znfG<3&ddjlI}P`A|JY<B9d+brk7dz<lb3WGU;Ufd^|y6d-{YT4Uj9C=cv|z8Vz`Oq
z%{>mE!oDnGn&5l>pze~X(<?WB;mcVpV50Iz_UN_ySu2~a%Q%;qRF&6!NGtjA<#_Yq
zi?7Yu&&U5Wl6v{0DkxY}|MafnS;zZ-si=p1RJ0I#y+6uGs^U2J=Vito52ojEo&UVa
zM<m?%-6KZpNj=s(pB^%}w=bym|7uSS$JP7h7FRgWJ-K@4oDeI+1;39~cNLcx<^B8f
zCH>sC%HlosUyga+x+%0;IIpD6SAAQqwyE2@GcVht4=wm;pm@A$`#Q_lRsXI#L|m>9
z=R1E^C}J+hZI`Zf`xl*_I$O*9wKtdFY~hU$_kC^E=GmedBl<e{$h#%&0h9P-*9ztR
zRzG}vdE&)W<_GNGKl}2ZH(LDsgg0-mJ6!d<AQEkUw_38|>$R=si+(>n8x}2_!6S8b
zMM9=bk$2k;o%@U%Wt@J8?AjeMJIn7)Qu05q)Eo8j@2nWhmLHm|lo58sV`|y_psksE
z_S-mh&$nGTeUkGQE#W&)=D6RPH#_O}tYEfXH*fm5s;{sPIW_s&TCH`vA4P`5JZimG
z!;;qYD{3!)$MbWGy54W=+f%j8xMxZSXVB)ZI&sC^?(Yf-pHGMWeW>~1>h}8`_rm>;
zafa2Nox}a6boz9jW$v7zUrwhKZmSX4Twt``{c^^%CEQBUFBYV}|0S|x7K8mwj<0-K
zQ+6$8nSPM{nA-B67G6j9$@!^Y$Q5QgdVK#9_8+z{geB6?mB_5(7c&n|PuO+V+1e^N
zR_t0*vC4v()j7wqR!FV874dFe);qO(?tBdyG0!r418@DR+2`v~K4<m5hYvrW`JyQo
zvt))D%Xx=QpV!>96D^s)$8cH1X%oZ6smfgQuWYf>ZV;TD(46Znap}0QNG|h)r8oW^
zzJA{>Gw8cp@peBkr-szy8SBq?vZkzFCvv6bP4z6-NPp}4wy)C))2D6AOue{fcYLwu
z$vgA7&HATk8nwO)y6`xYQ~9oEN0hJF_h&D7ckbgndFAurBN-o_utc3LnrON3rM2E;
zwemw7ESi$?Ia!{Sv-H;6)E%3?ps`l$><-qd_R}_hRR3({e7a}Vv#0OQoqPH;b;T~O
z&yRA_rT*r!Up-mWp2WL&%c<ulm++il9l7glti0M|x0|hOIbGiz%uJpc8*Je}=Fo5^
z;n)iXhMNc8=}-MC{#<MQk_qXbRx$D`EJ&L-^(3p@_e8scsRuhtDtaF~o%rGNY2S11
z-9n|E%wI1tux&YAlbf+&$%l^DMSMGEToakwW?t<nzVnG|zQg0gg<F1kv)`}pIrLwm
zz5lSgZd8<G*6Iw-gn2en|2}?c{N=w}ZhGD2^R}Ts-7^Xvi#|DBu4wYaCM4p{_79Co
z|0a8GT_@)x(dK<c#b?L0m;QYly3YC;z4O!ir}Qi{WFxoR-F1fB7Ny6jR89=(J~!_a
z*RP4;C)WBmX%vV~`)=gmcm5Ywn@`NAuF1?z!GSM6ZNH!Jux|0izsFYpke>hfmr#mc
z@t&`f_g?gn^c3w{o;j2M$BJ0n;~lIs4Cjgor9|wzU$SE^GoQuB{I;|@<&rCEyN$Jq
zdk#I%>0-U#xPtlTkAIcylU}Cu6fII}oxE;d_$$FZkHfz`IvN`M<<w*2&OdV!mV7D<
zJ?>e@p|)+G*sA^Bo*~I=%QYV^do=6kB)3i94cv|`&U0qk;lXe)a@n@N`&l*(A9ug5
zTETJpLQslq!oSvx?4LQ?)uQHEn~3UPkvMfn`kUK_-di`H97yQ=Te3mh$wl2*;OO4T
zl12%Rh7(IRb1c_i;qt1<N#tBA^Q|df);^Or?|LA0e~r)t&Iax?OF~ZUf3-VrW^<F2
z!0&&jj;&poePZF!gEmKgzP_{fT5itrObNwpqL&_4zy35o{%OsHeR|>_-KAUC>7N(e
z{BKc~+s6&v9OhAH^CmB}tTTOMki~OnaW;eK9H#pGiMq4TiUi5EpV-7z>VEUdZ1;XS
zRu>6b|J5oPlWyFeo+N+2Fi#~+^4pQGFU&ShT61FMQnNERVip`wxMHTaI_E>wR<GsR
z8!z6le9Ocq@@o%s(zY1B)67g=0@+7&Z#I~RZ?JIww}eH?YVy2f$$9qnwZ$LS9L$^Y
z=1ZQU@hWZ06<?Hi&vdY*Ec<57__F%e9%<X_&g)E4RCDfj+kf?5UOV3}?97+9m$&PG
zw@+Qx`?2QS%3mIPUi<97k+e-SBz0psZ_|fAtQXdJ+br02^>Y6A@Mpz~c3Ld*jAUlo
zU%_^vsJc^V?#A60-FLny%yHQrw0QmJhw^Hh-*>Lwpz%C2=quBeaOPbrTI+69-?6WJ
z^O++*FXDj0%iFKT7-Lo_veq7F=W<#%Ddqp#EzbiMU3z(GN9o-s=Vx4OP&AKG;njV6
zY3p)}$6VnzHqV=teEhWDq>o)c&0Mv@PBec1^<q-pC9#IdGTskO?kt~cD!<E+Z2{w9
zxl4DZo2~eF!IG&rKez9|oaiT!mu@=yo6B-2%(ZoPiOAqv-#V@4#@deQMU}I*bXT)n
z3A(|o%=6>=@1^Dkub6ywb$z`dTZ{eAiq~cli_2e5J@L3SWUlp+uBDegET2~?udg1s
zpp<1^Q|j}bx^Wr7VjtJ8aSXr3!q3!RXzKay>c!}Q&pnntW|}J)s(5aFk`e#u&chRV
zMnh!-V@s&Rr|7~>Y-v9({<M)_G1*Y*KvUM8nTy3b4KD6}6)ndb!E1e!mCxiz{RW5h
z{9Et8`_J~SGqR06*;=4ln6antmgP2WnaPvGzTEkw8ntqn@V<>T>&||UYdy4zWomIJ
z=QORQE#Ehu`h8@Y%$Yuq$4s(cCNZXJi{6;NbHSpbwTs2|_D<MX_~Wu*hT{J)^%dF4
z=li_lH5ZF~<(u{RqTx=982NQCT>_b&o!-Ekb0DBVU>RqF+5NZMx1VD<lsx(VnZU@U
zA9w>oqi643_^QZmQ8M?|n2?y3{GB^fIKTSNT^MQ|{;cHrk*l4m)}KAwgCn!%8f<JV
zw>IH#T%jYs*w%QFn#=mnb>AcRbLA#RNc_AvYv1Fy;awc2_cUx6Pe1xI)xU53b8}|v
zgV{}m&VHI+Q+C8%E&P1q!e8S*JFhxfH$*Kx`R3t~`dgD4G6RcWI!tA4kq&FUe&AKz
z=dTu##U9)KEO462$FMWhd+!r1owT?og|-tzm><ku-+tjFgE5m=*7vKze-c?e!WM-X
zBpvwq?TOF=$E2SHCJp;aYtBndPMi}zW6pwSPq@1B+$D||KNLOBd;W7vUfuOa%O2`9
z$8WL!W2CjAK*0LkESa;t45h|lFAdu6{5cu2+of~A>#CgAdsYiJ^6U*cBR-k)#)Qc-
zdw&?07TI2XX}^YL;fjT84n9<@Es3{3bwT^}6fZ69pjNMYhCO_22}S4s9<j?b>ir_f
zDm&-+i}nYzOK$!)>(!fZv2j((Vuha*nf)9co{70_`ye>)x#ah|Y|rLu&#AW6vPzs5
z8vAyS6vI5hZDzB+NoR4pUq9>Ulzq?M?Bd0H2MvxkGkjgQo@M#j4{oKmjTXDcPVHUJ
z@yl{y!)eu|c}?Yuw{hR#wzwY7vVJG;t^IKkiswB8Z!EBw9X)f(*S%q>_36R>d!oB4
z|IUBv7Ic0QPxo^Rk;GRbOV2WMsC7Q=-fY!$pzQytDMwr0%{h}9!mqTKQEgULUB)$u
zVuhD~y`-el|K7;GY{GAC^R*@YYX9o4S2?lg6jRa~CEd@26y7-F>pZp7XI1}ayZsgm
zPCk65q841|^K6NG!J+LtCv7}3NwXt}y}>%{j^C;?{h1eyqD(|hTX~A!ecR=5S}^@r
z^V}_s&oAWW=XVEu^E<!3Eh|fc=ScjMrZ)<o(vxGE6b+wn^B!jLpK$fzl)SbYrp$$v
zud9k#`ej^XXMc|BQa5e27RY2i&E#8D7|HlQZ@Przq2(;vI^L(0=4|>|HEl8Ptq>RO
z!_}eu>+c`fw%Xy7V&?5@D%od>lS(8rif{aK+p^76VrkXK*>_)sEdQA4_JDUmZa9y~
zi>tQxHzl7A+!GT}QuZzMtUZI2nRJFqhT`QAE-QA&t|eKGlD2*CF6|BzcrR{VyUHbI
z<&R6c6&sE=37!_7Qt?IDSIx6$>Z6t0y8CA9Xsz0M!>xbYvkI+1%URD;i>_whuI{za
z_TPDE%6b2=b<?u;I@Lt(eXT3Hw4kq{aq6j-9M8p9Cp=L+cH@J=?@w&noG17)7jJxX
z*Z<L+4Hdt4WXY|xsN&WT{x-YyTcF;Cc_P1CGc-PVJ-YW|wy31W`iZrB*RO8a?!v>v
zr>G^|ao*w1*LND$@1}?3t-hBg()a1W=dZ^uY@O9BaO&N~IR_g2SBCh%dh=x4o)5=%
zvh;Mb$BN`szUf<Tw`1v%L!Nf=U*=>;<OkQ!e0%ARtiff!yJbJuHJaa$-GB1g#htEa
zZAxbU)ylggRTAeDIJ>n*XyT8Id14G4Gaq%-D8Ej!v;Om79p|rWSJqx!e#iRNm&)fm
z-*xnM%}o}1B-{VC>uO||;n9dB#<o_g7!?hMilAn$buw-dcaMlnlvP_GEn=CqEVCqS
z>WTQBUd-|plV;8+78O=!OZXvU{_!7pSI_Rd9=o)J_rAQ6sufytq<MMq1DW3uD<3kt
zmu`xjrMsiXd3P9_#PjbT*9grwdo5o+Wkq>@bf?i||HNw(z6Kp)ORE%!D4rv^W7WsH
zc`vnF?-;oKU|8m2b0kK%z2c?2KXZ7_X7j|~u5%CCx(L5x+RJ;G`PX&JCX)cUcRS5y
zCGW93e3)s<9wF=B`~Mu0@2mT>zV^50-&0TX3iup0&8^*e-E+l4?d0~VT)7zSzXFEg
z?&*B%%WWbKes0M>o2ekzv2ulRnxIAPLZSYz1r8HfHk{Tyvq$FO2Zr^Pl3w?6W=a0?
z^=mr(_u}Ql&g<GY=6e>I9QdEuHtY45>fV1Z10{WzzMTE-i=6Xf@ku%B*BsZ%v#<I4
zY3pR>7rSRqpDSJXOyb+x^Fakgy3J}YB28{?W(iJOV!d`{@bx=kbEhqHh>trnOPynX
zr>x9Bzp3wU)LFNGnEhSt?9F+1Q$D4X|6u9woF#fFm*-~X&5$oT=B0l!%1ak*WNz-A
zdpjd*Hixvg<1yV$X?stuD?0YdI^9H|PfXIz-Q4dD`*cC(d5hng|H(HxeUtf7%J*N-
z?q2a?DdF5*W_znCVM_4ah@_W1-wKxNb<37KT9~arvqt2rjH^QTtO-h!Wj0@5ZG7N+
zU}Q`2M9CSa>V=h!7s&Qqo3ll-;6V1heJS}<i&s47d9kqd?)@{NOQv1hv#m2Usq^Ya
z?|lt{O7DD5?w|i@f5_+Z_Ip8pY?t0&R6O_A{i}DvS6qMbc<!0BPPZGjjDMnSr%mhq
zpgN`I^2g~5_nF<j>y=$zYA^D$hArK-GtheN;V$vU#q2*D+W7)A!*{nnc&TgBnJb#<
z=V<hD=C;{Kb~a^fO<J``&X;AU-|x^}pZL#CeW{|B#3n5`InsNTS-^}g=CI97%`A0n
zOaa|q>WiQ8&3|gvI!|Efl1+>BR&tmut(`d8anFe?p7l#uRCftKH?2zfu>6`$>B^Y$
zHQy{A#Fs3%YU#GV@4|$g-I3pRy0sl&w>Vm5ALHx?;U5_O*m&7po8yvJA2ah@*(JUO
z9BswNTpuK)-@M7AylUxro#T`Dy%fBc@lj(<Co_MR%h#X_ch{V%dNj>oxuj{vvXAT5
z`(2K-Nz3i!{d4@R`Jzo>Gje~P{2Xon$R{puQG$~&pNd5`>!QFz4JQ}K7jWJe|NWae
zbeUYOw3g}tl?v{sA0)KCu4J6FO;kK1<d#a6u7OR5aKJ}P^)var_tSq0ESUc^RCROW
z)c8{+*$!Rl%o?AgH@W=}Q$OH)VZV;0|15^E%DxY?4$M*$esJLPlFJ;kmQC%B%H8hZ
zePz$X<&*8-%-hEF`c}bZNAVkNlmANH+Z`Bsf9Jeq>s(iNraxHnzWg7n#FdA6>XRml
z@Ga4QDJUbklyAfJgTb$JE`QDm_4B<@aj<LEHG^nweq+~+uTsXz=H+hT0+P3)>|?Jn
zXeiHQs1V;(VCJZJevy(Izxa&J*~g#n%DkX_%+E~cwQt4MM?Dj{qZ4Hh=-qj}gv-k}
z(9$CDvB470q7OS|pLLu$nLh8A>CvS#64&bdzpQhpygaYedfBa$(sLKGuVNFKb^T;{
z%|q6I<}aSDzjvs{QZ4&X(xjPN97|3Gex7(!_TM_~3w|rNc3K2~oW!@|VS!X=pjAi?
zLz=%xac7+8qvKhNR~&xNnK>{0B&&TXL*WY{x#<s|ZU}2EeQYTa=3$%VZ`xj5aV+Qe
z)NM=$HcGzcEOJh=srmUzf9{lu@1=W<EzNe7WEP!0c<7bGk5KXIY196FaAUac>ajb4
zzv@zz$9j$``#t|I@0oDFoxe)`|L2E?Uxxjc|G)X_@%V>tkKe!CAHDqlj}MA(>|f;9
zYRKoUO!t>M&mpj)=YD=G|F1eW^`M5*(@CWQqEmbf7l~Nr$$eJ!*gS33%PFmMTGL(Q
z&R16?GN#@?;Bd8m{)75Lk+TvXP4~{q`Fd)*^_Ns*<%+Ey4l1W6hF+hg_Cf3FKlS}f
zChWY;kgwr<(K%h9w)9c&sX&usCgyVuU*7dN*1mD0L2}Yoj)>ze>lKeK=nJ^tB33NX
zc6}mq&a@cScdaa8?e+czF{1l=dwusX%--O%E9ayLZ(qn8{{^q~FK=y&QEiqxmbq#Z
z$4j;CCR4+IoNZjb#piok^X*8N8@c(uiM`vN$IPD@&z{zy71`&0W6jcc3VU|Xt6Kin
z;l7Sz(ME?|8)hvso^g0hn3~M&!!mEzEGuQY`$3`L+JxQWQ(o;`{Z4FW@6T-g|L@F<
zn;&itKhIZJ^Ia)Jdd_lfrbfeD)t|fXY%ag>;DclSr6dpDy*g?JVZ}<HW#-9<9<RBW
z>7HTG^?r(Wp~clHQ>?^NxpxHxN!l$GPF`kv+W6B?=HSh#3;OPr++XoZwCAEoU~=!u
zx))~`&oB`?vG@0_IFZGlqswQr_%j#Z&wSEoCZGI6RpLQTtMHGjZ@2yq%VzntT9`R&
z_Tohbru$ZwPDp>narAK7Z`qtQk%wYa@^p{n7QRQ`Zw|U>t1*e?u@Wl-gCHN_gTIsW
za|@DFi%L+B4lLk0;g))^@Y~X3VLAnybzhwB(mNa`G0!1z%Gqg3tdqJH^ZtEr{p#u_
zp(}U4C@$zPKQG%~&aW^2;r8$F`g8XSPAy6Ne7nW-bnv+^T<eORzUS=Y5x>W}CNwT<
z-|grKJ-zA0e?Bw4`^Iz6Xt9dQn|Yj5(=&LcO+52CXsuDlqAeR*(*jv+PEXzDuq0$!
z#JVLP_nb`m)cACkq{-^kgd(?#wydiUDE)~_{W)vlLn#ftoe5GwlL`adGTv75t}%M+
zwYe<y^qkYO0?g$rrXPx}`2O*)@0Nd0)BgVYcK5tC|A*Cwcn(iES-mRdRC(@#{Eu&9
zHbu`|73{ih>KeaWEAD++)R-l`;br*Rle+{fd?do$iyB`(S&`7-a7H(v(ef(e5-;bl
zXR0z13F~wwbEdULOqV;X@R(ob^E3nJyM3SU9@uKfWN=FIy~MJ3j)2UmH+ydG^|~M(
zC75m6&wW}ZpzFAw*7jCThNZmoCcj`>t(?rKr#ycq^C`A{jz{N9Y&EcbV|h3H-wK6e
z3Y$W#4&P5@p1vY7Lca3&`@-EP9$szluh?6W&$Hpfi}XGF82IkIySS~mS5jq5-%4A>
zKNog<wRsgJyHY0f=lxJ$SC{u^xbpvtE-y>gdG=VZ=CJS9dwCbX&F4CEp7r6S_=9QE
zSDIRXKRjO_`(tg2`J@=LNvHib<*1zYE4u2j&Z;w0<=FkI_*)Bv#l&|fZrK?0sI#D6
zX<gB-g!d%}Z{1+}@O-z_Po{OfyFaY!oz`9OG4{e0zF%4~SCekP4OJBC*m&els%q|U
zQKQ7DDeL;nrZheHWW21p>OAL}|36|`?kgWTJ@a|i^i1{_Ss_PN#8iEZl}<~hcx_(Q
zW3_x;j>tN$=Nfv7&qFxnF01kDF;5J=xKLpA<IRsRnqQ5)yIj5g?Bx*SG#xR6W8ZUx
zc+9?T?%aO#%C1MR`|gXK*%EsuEH3q^u*-Mt|8=?t?HqnRnsi%ZmXz8h$useXtW{^1
zt?m9HHF@e$U*Fy5Gux(|Sdsbjgh=Ko`5By^lYBltN>5*HC-XANWQl;8mB3x`FAB!D
z72i30)Si03uJmAj^TG?EKTiDZJom{^w!)5Ww^jJX!uZUIjphDPH81tKR_ZD}a_|by
z{r<hQ<letq6I{4;V^6U$M6^AR*siO3Rq@4dtw7Pkkp`}DhJSwF{u(ZOskZp}Uhgla
zTvyy(>vOu^UOq0}Agn4g|Lv<q-+NTn{3|R|s#`N_X`T2lISrNi7ga$@OYd#g6#Ze;
zbIO3BZ~fC(KVH_{`u=3suJvkc-(LjIF?cndclMz`LHAE5KPEc1Ia!_Lnj;ut^irTG
z>El$7eb@Nj-E<OlS*<L0MY2q)c<p`(kGY<ChQ=Aj&z3Z<`dzT?g3g&3i{SLIrD<l@
zta+_ec3R)NvVO&t<BQ75`e$t|jN>b-jG7v=)w1mSjMa_J&wllP{iU_Jx>r?XX;X=4
z+v4+Fe->vR|Nl+yvc-GNQ$3wiM4oOhS#7`nqyL4dM}NvRtlFFoDO!KC|KYsqL_|&3
zxul79A}h02U+&1Vs1aBG{^}pQkBRM3nX|5E&+<LVdnfYT@VM~hYiT{@LLT<7O#};q
zPlr87n`bQhU1RpOe<%8b4^A{Y)v4x@Wl`&%H?7AbXUYomH~W&$hjDJseZ#r-D66=q
z`#OL2=M~NB{1sBiWqckLES<P{nezwXv;%6-W?$t_(VgS)Z2Q0D-kO|!j{JR(vKBx8
zvEKg$pU|$4w{(}SeK7e^(XG}#$K1Fz+cwWMfA>GR;(dI8H#3U}0|NsG1L#<f$;QX#
z^sq88l=3q$s1i7xH8m%xsI*wGpz<m7eAajI2ThqX)=#^z<hOyuhYbfxZ!d_GPPlpN
z;769IMLFwCG$({4ZGXXk>;4V>+s<B_{!CJn-H<4srqEYnbI*29^}7l?Mf+I0YH?qe
zQ&XQ_bUijzc;|yOhjZN1^eRil>|f5AFj3FUO=nu)pP%fO)kWV-4qe~=#K}@`V+L35
z4B@C!tDP6MC#h7v^g2Abr9<?ZOrlq&cu3Cj&o3@6{=BoaZK<O}QEo?ck<ql`;73!}
zw%iezJ2_-Mm*UQihTBT4wyxb1vhs4&Ew=^R{qur3wkn*NwAwA@bY)`6skdP#KS-tR
z2}ouB(5j{W$X5QUT)*gt87~fXPW>TpZlb~F4O^pR*6+CL)m6E;b|v>Zq0>e8)bqL4
z|L@8#XqppqG<<(t-{gy@Kfbtn^tE_1-@)aEhp+Y;M6I3BcI?s)(YGs?-TKgDdF{nP
zyYpJ%=UrZ{Gh^+$>8ZMT8(&WGws!|3t3}%;tNru6(z(H<Fl_=iXX&RTlUI`~UwSOF
z4BOJ5`>^)<ZGCtB-zi03m-*`iAL``ykP(`HaDhu(=}WF0x4a2ArPnZOTK1mzdt7>l
zQ_aP#t>u)-(yP_SiUT|kgiR{ZonG1Ra)0vmsE=G5|1&W8UFqIlwYQAZ`jO>kn<r<5
zb3N?xCSSa|*TKfOMJd?IzpHgwZBu&)vuyN-SH7t=aeAxLUu(`0Q(7CB+Ie(ORa#i#
zypKKS>~a|sCQiMiy8TQ@31fq1?>!^UmpSs!)}3<y)xvk8<l6mJGW9PsL;Bv_-~IT_
zI@u?M4o9x9aI4yXd^!I+cZEgUStB~tCfOzQDj$>H?y~h??B@AaruXN?@A+M5qp<X;
z%FO9bX(!hvvc7Pbqo&!^vy6!=y7&K?#>1~{uN9q4un(E|-g3o`TX&k8=eR1ep5OMS
zS;sL{I?c>et%q0V&2L|3r*bV}iH#FlvZNOr(Vk{#DSGPcgrM^`9qz5JP+Bv4(a*C{
zeA%-PC|%i-YsGMC_l-9NJA-CkI;mkf-)F^kPxmcPC!98M$-U0$kjy`S{mz!td9!}i
z+0~p|!a7CZ{tANw;*nP>cJ=)EIl-iUN8;0U=C-++ud-PcpX`g-v-^fp$U5)!qHlS>
z8TG0?7flZ7F8mg@BXxS1qsSdTzOAbtEPio&n^K6@=^kOLCHHR2TD(pZnq1uZg{xgG
z_*Bo0rTbc0k6yRf_<muWxm^*vfd|8*(1UBvIZilyd9Sd!{Ncjs3*8m0S&L8KC{X+B
zynTh0$3w?3GwEcDrTosDl^<-pkl$<WmOj^Z)5BF!65Dpo&-tINc2)3Kd*_$?1y44Y
z{7AHZeB{y;PmYT6qu0cyzcMhHY<tb*?`FIF)AQ;lYqH+E{ZNaq=cm%9HHW`S_8$K3
z`{Q1^_x;OGD<1ZJO@AC8_upn_i|CS^@|T|;70EogGsC$ufBN+Z_9sf~<Z8Q&c=#m!
zOONf|Qd0S4?)%5bGLqY`d~n({<?=Nb*}E4WY#00*{wsau+q*U%d7Q?J7$(I|bDwzk
zhT8mc!@Z2czoq?CW0@yS`@C-9^>4FZzg}M(@^Smre{3J;`R=)HCFipKy7iKz#|iuG
zWql8nPQEqSJLX+c1H+8-pVxmYdLCkHyRGbs+Rpvw$^}i7j)vL%U|aF?eW&`vxI=O+
zEN!zKyq3P+^{F)4+o`X}=lIkE{yn?<(i18ke`P4#<&!h>dD2}mwL9DI`JbqK<>jL*
zeJ8ynf8Vo6g=v?zU;V?|cK)VJ*LEi7b93ImXe__#zy5G=Aj5*=J6&pC7ydVxJ!5*|
z+dCguKbrUY`0O3atpWu1Jq$VKJbg#vrYCpH)RqT)oRX4d$g}o{{nQypf2XwCF)a&A
zYEfRvYJJAlwNgBOq5n_ChIiq;?AJrMdlz(gKiqh~z~%3U(|OWb_pgV!3Oze^SG)4L
z+dm<{r&DEl{?((M3!CC|<J2cs28KpH1_n(+#d&UVa#3bMNot;6L1k~aZ~kL5fxWN8
zH_UF<aS6NZs$V*B5%=-8%TB7fJ!0L(%hWjSn3%9<h^N-Jz%TpD+ZLsq^ebE4tT^%W
z(V6D?FNDkN_x~ua(G}7#?a>d`=#AhE5dOCCktf^Z?-ys5A6mBQmgdHDJk|Bz4*Ta!
zWYl&zJ!$C&rk!iJt|YTnJgn4K<rX`>`qmY$M>9GXO*&-|H|<h^a>`2E_jh-f7pum*
zaLp<V>sYIC(@Sfa@j8XnPM=2IgE<UdX0BJK`1<?bTyvpQXzIbEE@D$pIKJfYt(^B+
zu{5M`^49rj;hjZiccgKPhl#l6+H|`3-}$hZH`3HmZr$zA&ysHDZsA^gU~TB0rn|F+
zt|#rh5qjax?X#)6pG<DeUsjzRy6o&BljbKsg_p6O-<8yz@iEn|d%1l2<<+NW-&dDA
zyu6g_X?MV;Euw{PX}^~?zS#bERbvg8=oF5LE)MDy7uUVDIbmwDagKr$OIJYYbf(F3
zm3=}ovSZ$?lD*BaS|mX=IL)YU=_v<iW|rO=mpI=}h)!R}tDX`y>64T|VCA_dT_J|k
z)h4gp=JD{D#>O?g6BbU@5cGet?V94@(DeSWklqOWhBKmnBu@kwemMK&6Q|H&x7j`_
zGrvxM5|h0p#w+x}_j5D7Qw2=j<GRJ~tkW(l{LU)kC=lUv)LEr1N7<)s*WBzgivF`^
z+!EeY{QTNyo1Xc(BI_Ti%XS-`%<joMay80dfa$u^Z1&tM$p?<@|FU0J#^vPaA085C
z?QP7MW-uMx@NrE~>>~Dusshd{mqobOeOdDNz%$X?;^kW&p4zc@qx_q%ZFV;`e|<du
zSl!m`kM_E<x)Vo|)%UialHTPfW*D@3)ApB@+gNP%ez+`<-1_ox#~P)jdTvvW@ZH?F
z#y52K#I_pIO(82Li5n!&m^4B3M)>5#ew#Co{;i!6Ql-R{wEX?Kevw5#@8;B%ThG0F
zzx~X99nOc3y-u=hQM<F)Bje(&7N@%lb#uK+CO=x_TdY-bD3ojE{hzjp^C!9rESxo+
zBUtmZ%Htavip@%%8(OrpVm9??c&}8S!_J+QD6p>L#)|ayZ~dfwXTCQ$Kj%ix<hKR9
z=Cj(A1Uq|IyL8F^D?YyK#Ftwy=IsrMs>oSVb*$`=-9`uX*AeV-&)W`)?Q@SYj$I#S
zkyCPoea_hzKeZ+I?%T6d>d=u_`GQC7m_BP4+&X=7?+oY3(!v)fyF9SaNH{uciL0G;
z>8*ouUTTMVmKN%rdR{U0^VTv4r%iJW_8(vW@Ach`ht4;)<p!EQ`%`PLA|#pEwA4hS
z(QR>=jjKi9mV^Br2mT!TEai50f#gp;z14lP(>@o~`b~8G68712-s%H}eL6REk}n_6
zQ{?!in!zNoWWuA~3fC`oQ9qMy<7@WJuHDh`eEat6AOAj$-~73L&9(h?1v4Hl3%>m%
z@JZgPTU&05l(PQ`k=}QPv7b4!coX+TiCL2;J8%BRQQDeyLDFVL6>FA=OKrcSg@~dw
zXWH7$h9-{v!M%3L`{SpvU0X2g#3AL2+p|B0-HTrxRFHFH|H^LFZL@L?F7MRHnls7c
zrgTJ<nbx$QeC|pSLY9l=m++rjR-aQ)BDP7|^ItuWQ`Rl+>$9ZyD1<6ivdx<7qsX~)
z<88aWFJip^WO?pT>|A$7_1?R<1Di^6QevhjS$h?wto(1ev8vThswy`z{<EXJqd`k_
zdGJkBTW=%X@6N5dyZ3LaS(?0G^z7_;1smlB`}802S+mEA{J1*X;kZdtcJ$(ko-Zb6
z?iMD#ZT|LRonhwt86L{-dXHVo-@N<BzsK#nZ?=Awd7R=@*KHm%wL*X92Gw&SS0YwO
z#h6LOeEzfW`LDtPZ-qnU%Psck^HeU$jhnv3(P$3i?8bi+4}Wu5f7DuG-Lx~D-*;^-
z7jX3F*;X-Y`;)4Rb{3t-_pO&Xb<yrvgWI*62P1c0xbQc$qe^scu5iYSWBaE~TGw3S
z{pRn|pO5F6MlL+PwP}C$!Vjzlt4}b=SeC9#?Ykc3_B`QB`pPDkHDxK8@*!80lXpE_
z>LPBd!7Ev}GCBM0p9HnCA3Xae9=~=dT<B((jodcTi4(ueqxJ(tR3f5OBpDbE1`xhS
zDLt=Lub^_TO?LThvrYH^Y8TAmpR&&N*TikNE5dDWYx!MYUU^r|*0cZd>Q)aACuhN!
zrY&oqJlTJLCZj_W|52}7o9#Mv9~nyUuzg-8w;^0#en0R0QxPdqEz>(sc<r3B$RgeT
znN3{x2OTTRiUVm{_r;2~>fO9~^5x<WZ=SsA*&D~bO)x4|N6=g;^e3Cz=AaK}4<6hU
zAZ<2ZfAuD<BQ@uqsD-<pteCcP()6IzUk@I9`0ychVP1-o$?X%?Gc&h^u>St}GhZic
zcFeLx7YvjSPBWPL-u1G~!8^^&>?MM``%i0idoK-oD;4rLGkEFJGu)!wYg4xsowd}z
zzA|RVai<;ryP|GfT(|VjGlPkRXX9@3x&=Ndb8B&M*xMJf_LZCYsnUHXCW`IvSS#sx
zx7%x(=arnT3tQ)!81ru4+Hv1LxRb$2=jQ7dU*GHNKiga%d!}w@&A-n-8Jp#|zqzw0
zk1;0CEcB%K$_lMgPWOOS5lh!{D(#-wdg_J4+a=x0PRj4%-u=j7NtA?%9K&i435Mk-
z#WtlBa{USNd9lU(cFpNL*3;a9To$j3&Ng1kUfBAWGofFiy1<e9+*-rLsE1FcGU#~(
zFPml|dLm+7Xi`P{^i)OhP)&ggL1{`0Q?+dqFJwJT^bTZvp3l;ByWoK-!<NjoXRkcs
z7o46`vU}RcS=YLQ*O@w;3)$HCd@bwr6@@9=_DnLr5c~Aa$MyTWnJhVGNSx>OOFopB
zy0dNP*GmqLa?*3|@ZG$kSIsc}!`s{2pL?v3wwV?oRyeiDAx6hl(dfYyj$<}EYkt3Z
zB(tIYDtDuY<gVvlr>)gC2Z?ygaYu-G97`%*|LR$@#Qf)-5h1HB^}~M2NW9+Ib9y!F
zomHGR3a4XUZrZVr?TVeyI)96KCcAgdyYTq+qC?9SVpuPHdifw>YG^TQ&%TNBFJ5hD
zWL_g%&}{S6h+FE!K~IN<_&F@=Qd6VDN>8uMwOkv0F6VUQ-A@;`*{q4)l6#T&oC{~d
zflVutoT9sn@~@cBwq`DDp8qOz%Z9Z-PG;L?&pQ9-Tf6V>_UzS*?<()J%w1L^Ja^l!
zbAQ&Q$<{qCIO-qwI`Z<Jo^vgya()}FU-sq3oXz+0#I)w#_s|tLn)<XXzw7679`mWq
zJIqe&NGAkef5;~EIL+p5|C;JM7q<F1?EK1ptIV7yrH=Euugc$vzTul|xP)BqGglpo
zI=gVLsF`;3qehXiqxV=Ihpv1xtMkcfpO-<$tW*?&U#;mk+WRzmZ}pm&d3+KrpU)j!
zcKyMhhP@A6*%tXUr}+gh>J^--(ON(6tb<KBD~Ghmk<Kpd5IGelrE4o%cpgYdvLBjs
zP}SM6?~-Waon5TcG~4elk*%259HK4S@z+PhhIQhKf?aMK)diy1{&IPox#BjhLqtDd
zfwnGBi_@RwlP(;&dnMqx65DR|G;^D^M_L-48Y~%B3uwA?Y=~L5DPZ~r@i-L=1yOCe
z{K!+ALyv|xR83vXR#F|^Ve0-eenr++w!0r1Ca&SVufV!pVL_l``U>YwqGwimaz-gk
z-S8-hJGqfhcurBcn9N2djckL%E`p2re5HSV5Lr^YDOJh&=sW`nrHtDeFH*&phcd0*
zFz@18O#_h$!Hj#pJ3Vo`-I%)gdP-pC74ZWbRx+IV$C@0vF;$y&cjSj3wnEJQ-xEuO
z=K4fzmTyq2V7wt-vB@x^GU1MB2XEs9Lm9D8OzZg8hO+JDNy|>)ENi-;^hB%Wu8fTw
zYr$cim`}Yv(pA|KKM&2*m+O7ZX8u{`m*k`Z#pUlFXN4YEI8})yd$E?$^*PJ5__qF0
za0*zVt)N%nY4-Q!_v_;8|0vd^f8X?A_T9<lTbYfIzCY}BIPKQkXod4?F^3zOa&wdo
z7$hQ8EOSo#T6IitpEj$bPy2$}Zq;iHehS%_13l9Y{50Y$Hpq2*R<OU*?^u{#uGxbB
zI$LU4uPDmCP~;G*TC(he@0n7`f6E`ee7NN58l%(fZ@;Cks*vpZ*P=Qr=INI;ce7lw
zcjqdfe84Zv7{1ovoO?A(fyM@<^IlSyUtY<cx8io0w9&gww^fWIy%s!VpSWdr9yg~9
z`;mi-H^heBkh7Cn6sTk>8~!5NH+M#Y#=iIKCKq2&_snl>|I2zpyzBa&7dfIlmnvkV
zRIP8QZ_2uSw_+*dRo;H?t9S33JMS)jp4b{R<HRES_gn1OpE8L*q#CT1FSx8au4Lt!
zbz!djpCaXr<al2&u*z`!DYO2&%{;TAZI8wevlxvBtanqL3w{P%W1JOxCqpqos83~v
zT~7Jo)^}_F+-0a<!L@^V`;Nfca~H01r6}t>l9{i0>fyW0Z)}a+&PpHm6<YrI{MK+@
z!mGsp+wH!Ym*_Z1CB94Ikbhy+%zk<H|Gx(kzXljBT44VDBE!>wFN;@SmHhKoV87&s
z1!7?jOb$J>s!6M{+w=Bvj$}DQojHraN{5ZdGkhC#r<UsJ|B%k?ICaUYI95?*dg_dY
z@0gS|Rg_aRT+SX!Z=OEIf-y~8=&85uiNwF#71#7W%WgL2`rNE>WkSHc&epeV?ONS0
z-|S}Y={fTIt%A*)g%$<%wukh%9xN{H7v3*_OLC=>#i39$Q}NILx~Hgp@4YFIYjxUQ
zN@dOL<R^~rP5k`X(i{CZ|83BUUn$V6zjDWG8NL;>OK$|PFuk!^aRc|v69T49^TG<<
zISz!Lt&nNA%<$jv>0rg}64i!1jAz9cU2eQ1x=1T$+Fz55%V*1G<o71tHGT5v@?`_N
z-HT&CUoy3`;(YAhzpM8`!{Wbg{{P!+IPWP+eNISEbXaY+QK<8;&D-r2BBpK^<CFPy
zD};is2wimQlQD}6n6JqrU%GUHgSQpSe}+AG=c%dWUY>nx2HX8F9~s5icjY+l57^=J
zO_ay1Eo#Z>c}HY-CA+(S6RBFfUpD09)gsOJ3GT-}C^xdU&D=MAc3<DVIrIDa{C3?b
zDJl82@OsHHYhP9O=JeeHib+0k^F4CX+2%E{eO_aBx$$Vx7saiKvu*x&^JHFG#QE>k
z!(Rvg-CC|P&HKQf)tfeba1&FNxNNey`0VS+?>8%+O12O%(3frCTiqyN%677WwPM%d
zdrDK68$O)Sxy3yHz=xAlc67VmOJB-p%se&t#MVfaa1p*$H#6m}neQCi@MLwL9P2)I
z?*q#(r1SD!`5aca<o1TNskLYLmq$GiI#hUb!nY0I44v7QG)p%e4{y-k*FQDslga^B
zBWCx&X?xOp7|f5Wm>pDj`Lg18{NJ13BP3JO1YH({PR~EP^Rn3Pb+@^aIb)6M+xNNi
zx8*Ef_tf{J=!2uZcifBBmGoPTpL}|IAU4b96z_#P{iA(;W(xvzOJYv!S<hzHVY`OI
zX6NPFx8Lt-2-q6EU06_ce&2=j#{0`EpWQvU^?;nr+e6%Ho+c0U`MSS~m&O#hH7dXV
zsm=0F{AKypACL8eK57`V#RPsh^ZVC%2~CIjvXj}S>ReZ;_dHhl>7s7_lC{hdLdsh?
z`fndyajWL=XSIDY?9YE>C(ZvfXI_6_47U)+>{mB(C4R@I?YYirT)46Rn&mAGT?hH3
zNtIh3mP^#lwhNyrA>Z)yU<}hSHsxn#Q3l5|4xUhz{pb<b{89hROqakC+l4<KST?sA
za@QvuOxQH}oUXx5&z(y&%>qu<B+a>AVsg%K_pW7PQuevLdk^t13r{hhvF);6x75N3
z61}nauRgqd^Uv|+{`?d3n<5?FepG8z@9DlaTY9r{*;bxIyZbqQ2`?4Yd-0w3FW;H0
z&zx^e14Atniy0moow?|3a{IZ2ktAb*6pL5FttDF*hp(64|Ksgfmcm(w>YEiLeny=+
zX~dSHzHM!c@bBw7{ISzSD!ea#cfTZQqr`hJ!jkJ=>cJg~3cWKg&F8Q*l4pGr`)yrC
zINReY0U6iqT89OV56*QlFg}%wn3m99@UGp5JMKvKfkyGA%RYRsyfE+1{d<{r`Qv=^
z-(I%8_K$td-^1Z+Yp=b^pY-&tq{EMn=LM5aa)`^<i#^<Ymm|L6Lx^{~#-~V=hKGv;
z{`|fEn3emHs?nPu|3ge2C%7&Jeu&wb!_vIkM<|oqhh<WKS+nQF!~F*~%;%H*5EM7n
zG35~3iKCaDE#BB4m~puM<Bc`H8vc587@V6mgXgeyyR}-1L87B)ZB5e3p!ciiaIRab
zA;p&Ne&9+$_D4l0j~|I8=4xWcuk4geyK(OnbC#ur#R4aWZ^dD@tTUe$eP6uHhw+TL
zU-GgVL3jIqCe>`b-^vm+x&OUAW0qMhT=o6aw++IpY(AXU3)*zd;D1wr#`kZ3%#%+G
zGhCSStt(1no7F+N7Pr0DiN+$vER3dapXP{doT=f(Ctc2`b^MQNbjPQ#jx$es7<`nb
zi)_)#Ty%DAW_S0>X9+fLs|A9c48^JvN_!X1)I4>-a8tr7v+QrlLanBqFAiTm{d|AS
zAFKMGua8bXy<NlZu=z_BgW46Q&x*hJJ^w8DYq`q*z{MteI?i5fI=nP6q;hd~>GQf*
zU2`THsrUamwXW%?P5*U`a`DewLY_JA+a#Z4vf-x}%jA2Zl0O<bB|{@-oUEu#opbsI
z(^RD$|DJTa><Qko&?C)T)YEqV)W}77Uo(1+`K?yJw{Ai40_Lp;ozxe9+)+EXTBNgL
zQje6@gF4N-f<4D$m+TW*t{*q!wGYP!%lFY$v7#r#8?MV7mX>efmuum?qql>9nE~78
zxe8Gx-Id3Lc2r5#w6yAeSvkG&+|Iodilq-2oMychocEn~Z}Ub|<@GL{a|9+oylJp`
zdE@!ou0N5_JSq$eoVK224yl~D(VXS_jEC!Q+~#Ed<KYqblcBi$>U_zT)6=IL8-!T>
z7W(~WHS3c@j6c=60`@g5R0!$`zr%D-+hkFw+M26=J3k+DlZmlw-<<dOZis8-3=hj3
z>+}fO()WJ5wuXl1{hJrf%$QQSY@rO#y;h@{iN(EFdp`%AE#Bg*^T?Yg=;!b6Jue)u
z%#C81+8gZ7l90o=b)`v&;nNpa-+dA^5TCp}d|&)k=f}mNk%BsQuS$Go6lz!<w|Efv
z=4jXauby5i3k5Il=-MHCY?eBEx|eBD@&XCo0#%;m=Tdj7|7q+q|2bz>f{y9I6#MV1
zjlQQnotqjZX0Rn`!P9xa8Iz9lsW5Mj<#G*Lv^Dg3T&;?KQPA&>`L~Rgvqg&M@X8$G
z`?CJclW99nJ~OY{7w9?l($38K#Xt72c-H*)<E+%xtdi)SINM|UQf<?nSDOB2d0FXq
zIf*WQAi4JZtd3o27P6~zSD7$2b3J6)C${RT?u~U3j{>s_@(bN9{F@DTFO6K5#d#*y
z^_j%2-|r8WY;l{<-v7ovD09Jy97XM>u7533lGnug%&y;i<$s}%=}%Xhapx7oYk`W_
zz8?D}wPdkXf|=+<M)ror9o~GmP9D_iYwmlcDYDMkeB+`|-d`uomD}~w_H5e0@L$=A
z;k#Hxd|SCL9JwOx!Ls4|^9U0gcFl!Bml^pwQlD2{kWuwN9e+G2eWsem%6ExnCY7m0
z?1!ZCwcWmDEMIK)q450WDdEr4ud8q#I?WJyEW5($4NvulbqSt4S~EP|*F10A$yW65
z)n0~a;pxw>Cu=*{&f0b``lpphrIh(T=6MSWCrHmtIGXd|<jn==3q<Ue2_HY;A&}&y
zc6fp`(_*IS3wH8_eDxL2$}=m9UZBpKq_p6wn%s`e&xQQgl>}d~ck4`Z3fAD2@t@j}
z`MtF<<J+T~r%x{zuWs1$wBTlsvfa@`?+mZ9@!k7lWAst}ytJ{}iJ&PCK{{^VUwX}n
zzIVKj|Ausc>>-hau#o+kdn<H5^mwm&YJPRnji-N-9wl3`J{ObDSoUsXA9oL*quYkY
z&sH+-Z<gzBo^_A8K>GsciVacwk4)WqP~)j;n`XqZT+!98>n3JwS#ZKP<$|3|MZ-$I
zD-Jy8m^V#jS-!yc!*_<KyDzi9-gM^c&yR(Qc}sS%#`)!&P1FiI-oM}4*4Fx~!>sAb
zGGDn4aMt8#UAf{W&a(M)x%bj@56?G=H?HT-Dp|gx?)QPW7Y~MU2{x+RYc+koc=f;R
z{_1jDHaWef{rjzXUkS_o-o0i0?F~XV82OxXJ{4u3XOhtFV5(Zm?2_1ds!6LXG;~{M
zN4btUdyISPsY7kDy7!WA9p0)hZX)xfPeJY9mWNx-bBu)B&Tn;X;^<f(S<)^SzRRM`
zR*pGa_I~aEyMK1)ADDS&)ouZw>5t#{FJAHU`s-un9k(9nd6#*IF|lqi*|#jUYhvz-
z(=CZBq;{pW`rPq02t0D)$@_-tqmxTc=UrDyjt&iMHTWQwuJA1UfO>~bbXH2<h6vGW
z{mUV<XFa@USJ;1-x8zvENfB<T%tMh0I~H~}y|6O688PMV;s=rJEep44imEwmKbQ9D
zRrlH3I_=8}rY)24vnn_fZM{S2#79xd6(aAhd~<VoBYG$NVW_eH4f&~hg5f4xR~<6;
z?+`!O!z8vzMs}}@>D2z+Rf6uWkNA%IT~9hRf76X`(jVD>gf2B_+RVgq$gbam!#(Ew
z%hq`pD+-L(M4#VYw*Be<xkC59?4Gf1_FeXTqm6GkIc`2*RnycMZB*2*IQjX-+%=ot
zJ+s>^d!x&|uK(;7^Gj!Bs~0tVnJRh1?7^I0KlU&hB*y-)bSP$ZRQ9iLTiq!zd%E%?
zD-#_R$z%W7<g_XnXZ`+jKf~^?w9X;X8wMXNID|@dC!D__7<+o@xn~dj&7F<s%-^_W
z+fPXmnT+K<1&b5<8{MQ5;=DbY4{um!{^3khu)>{}KVE&=RW1^1Y_A(CtNQuR*8ejZ
z-hMD;ukG8IbH-niyS<O8*6n-Uh37n6LgqWGKTa{`5t<b)Sh+2i>9z2rpBic!2IpdU
zSx?sR%bYX0`1+Tu(DS7)?%5r@bo|A}?Xlu5I&Ee?Te+%#JhbRBDP?nuH+VDMbk@3!
z!PE1;W-_$<B&@4F!00cuLrv<eV0+KqP3G76W(CZUxW6H1t^Y>JYU#wIKCM53{4(y%
z*wAX}*soj=He0<%@D|t0z|(T!8yDIgdp$ez`rQK)Oy_TZAzv0|)TgcMa=!Wq@2u4M
zw#$0nZvM|}6LIB}%8G@t{9TJI_nrBYdM@Qosdwz0Q?~`PbazXBc+q=rkABa~rQd&j
zQ@FQpMXIA&0sBuwj-@Z%t~qmDXO7;PW7W&;?zz}6hi7lD@DBs)p5PsOmL1Hyc&+qK
z{p6fKOZr0BhRh0xO7pA_s(8h+#%IU!bGz&h^NTN0PCOXspQ6`%e^!^{?mI{JY+%dw
zk<ha+eDAUJ+19O9Us^8w%6L}O^{bq%n{}E)kAd&9yol+dG0R?^w$NH59J9BfeZy52
ziKMt~N3PrY$yQA>o4qnGl9|K!fZ7SyKBH49Yx2&1U^r;G;=|R~+x~<G%AC|mnm+TS
z`7w<Pw#S!?s4XqFss8o&^Zb>pd-=bgo6UZDX}Q(G6^%vwU1r;v<{XeK+of?RTI=As
z&;Jy!GA8wxoE3e4ttRI8&Zk!E@0=9*{`o{HpX7Cch@{T<k-JoMUYS0~i_BX5$-(A>
zlJWaXGknkQd9&%r7nL{i>AfDJa`8=P*enwlPd}&q{@MEaKbc}%1tw>_FKsGX+w%5E
zTJy?lM^1B?goaNM`=BGZL&l-MFr@kAlG{2q5!Y*(u73R(Tpgh89r5(Xq!TZawSzs@
z?`xXDcTD)2UoX@3=*cP)^-|^UXU%+iIyURJ{;s&wBHDXBlp9<Oa?+(6U)RkDdYO6M
z;q#%VXRD8ffBkhm{CRET?VWccwmekc?|<tJV|Cm87ZWrVZeCzgC%xB%J9_*3KX(>r
zMuoSRofRrylFO3u^5gXh&*ekza*HWG5@^XUYFs+WNNsl8t6x@qNyaQGB6nsV*=ONh
zV3i!J!#2Z;$tzfb&92?xn?>B=SV60(>9e<_3&u{2RB5y-SC(ICDB9Zk_4D($i=xcG
z^sTC!r@!rU)Ze#S34iAB-B8X665bsr`qH$;NyYKucbSL!NoAWt&VF9t-Si_#(|_-u
z+PeEvd;EEhG)<W;t$9(%jd%az(kqwyw$-_&={8>8=U(mjT_w(6gh$_~;{IR8@Mrn&
z=Ot(CNRIg*8d>cB>Ptf0*M+5LJAWJ9@l8vAt2xnrs?66IW9H-A3n!Ro<)3RR+j=0b
zC{@Enz<Pg4_>{XA>+asD(N@ggSHfDqT}5Zv<t?`=F6PbtU|d(%`{Bsdrpl*D+l_o}
z1Cp92+J$TOE_4W1=h`#vfp+PQjD01F$!@Mm9KBgP&(8k2@9UJAGV#fRx~qg9ct)?E
zmh@0uvh)$3w(zPM`(jTr-k2%w=ymH1hpJP=<XaMc?h`m>Y_c&*@BX}U+7|7STb!>J
zKG_l|wO00gU%bx0856%P=wTPgUM?|f*85{O(_^>4`Y_Ageaowh7q73qJ*nowAJ-|r
zy>3nCuaq@T`TXnXk;=)noA&H)-<+HD^vOkq@J6QC240r71HXAr|28n*acFw)-}Pxm
zj`gYgw2nOY>(SwxD!O;!yiDfA1BQ<LE1rJ3wXBL?*r(-t@zUQNT}^)~d(?geXclKW
z{=3c;RrE4}=eqa%^^rGUdfxBJc`v;<{M+tSt7!tRSI<~$-FmW#>9?qc(B%IwmP$u5
z)kSWN<jCs&?8UEX_$j4uW&hm#-0lRnoCT*&UHmb*ojKIm+UU=PrB3{-WM4WLyt=&E
zuDU&Kx$oQiAL~uk8XxZEZBzEJdt(#&-@*U<hqt?B`woT*>nLon_Pltvi#y6f`OSKb
z#t$d&H9Poi3|AIh&BT3NweI7Uga4UP=UA-5n`&RMGca70Abf>VW?o5Z4rr-WL~j0L
zGogR$;vL`AO{m@aWO{ApbqB5|n=;ScQ1O%Aes{NmKt|`Jn*mF_g8VKe{jY8pNj<r#
z_@i7IKl_}-h)*4#4?R4b-d5GQZvDM_o^zQ#JCqLUD8^i#B4p`$oV71pWk!qgdsQpJ
zql=f^^jdr};}4&17|T-^&OV_{YCa;CFBE+X-c_y?vFuv3<;qf(z?O_Sj+KJXVlvjO
zd~oV>+@6ZUJt0w#Zg2%?sa#4ZK4zNuKu2FgS!k)n@*W}4s<^L9CM5X^FS-!)LiErI
zfi63q%@%wTdzCfTiB@l(JbB;Ns>a7ZO)dN{SU!Dv_`vSv3n~+n&%b1TI`zD9+`Q)2
zTg5N_GVIzPG_RxDG^2Ie>aTL~&;M?7?O&DkML%TfjM&#k3zKeJow@%xCaGoB`!C6k
zm2DfGxTha8;CcP$W{L5xHS$;fh1wp7w2z$l<DHYr5#BQuk^L`xF7Za()|lG6N$zLJ
z6M>R0v4@Z5hcCZ)(%#SC?u_2~WpYjavU(4*wOF@T6dd!Dp2!~X>&M5(A`iDN;Otu2
z<K3pZV1<Ir2Jyp5hbJ8U^S6d8vfV|GG1jKp^HbH%*=LUPXdC}2+GjEMmaCUXm-n)}
zNu5rY=ln}_Y(EfYFrO#j<l9ekWB>KM3pa_oYQ>ewsO+XFv1MNJnS<6rOLbI2HyAL7
zB&=N7JHs}rL^UNcEh92$8iUUihwlplCd^pYuO?>@>fREXTeGxu;j+UEg;wr6KB?sj
zOZK&5kBWd*i7_IMw#N^=)!%X2%b||JgHOe?vn6GsLrr4!O~r2sk2Vzl6z~0LoLkpx
z!7DvcweNk@w#LXaY+S8p+S0xkPU?t|{8$jz*v;~c%|a*U<($fS>5e<6hg8k||2ONo
zgr325*1%aR91BkI1V`2|_AdPRx<F)~)Pj%FJNC7{j^44a?e+Eo*~4FD4Yn929DHHm
zKS`6zsJY^|hmhL_C574hH#N;EVqLs!w&1jhXU_h<y#IfVnC$<OGTYX<|K=V0m8Que
zePDj^sxQ17zP;78a;m>|@!4nQ4eSxScFN|sa7RjY%BTEe`01PVH`@A1@YAfitutbC
zb~C;He{6ERfzQtUZ%@nrymqzb$@Zl;<6hqIJRW_ibF$yICF|#WxjHSxa^<R}^WW%i
zxGDHam!<Z+t~*!igrZf8S1jl7{;lytE|$x0nRNCl7L#wk9;U_Ae}18A73Q&|tn%<g
zS0|;8NBi8g_pr@6xPZ}{<7XGEZ~@~Ug9ip1GBeC`bhhT4+p;xi=8V|0?0qbv6SD=L
ztKN}T3bjyQ!SG7BOX8i?e0{b9#k*3u+B}moL@PEuN!vVCCc7!+WCv@0rpILq$Gz@>
zQg*F3k`HbbIkPD_xm&v2Ao6k4lwBI8UWwgbVoSU|KghN$JhkUm&bpr`KFVI{_BB#G
z{!l1Ej?<iLL-6#o8*VL=KauPoGPlvd^l94ST=8;A(T}Gb$|N@maRo))O+L!$=@Il-
z+bHnvktAQ0a~<|Cq8^s%hb^A+vg%ROF~8YD|G!->yTJ2VCrWURLm;zA;Q<eB7s-oi
zYdofAddW*^9Q>CtL4|Wmv`m@Do<-Fq-Y2-G&D?Y=;Dp1JfQ(OX>Q>v_w!c=8{r{~6
z!;9S_tmioHaEppXtUq+0<*BXuyV;8TbFaLay;0J=^2{j~p-!or&4o$9g}bfgnI+7{
zi*Fy<r>|LB!6qGc@z0lw<|p`Te{5weopdKZ#_8aLO2MT(`Ip#z&uzJT&1SA?#&k0d
zmJJ#W2`R4xuV`nl7CRKO-+mL1{iolT*UmBR{J)p$=)@I21rG1=@43fw&nqsLXYq|M
zow+_wE*Sfj?>e!3xtm<WwY7`~a?<5lIgds<ED>Ro`&VHiwYOFJ#!HjOPEv6iKV`+g
z%Y;^cmHhhg^?R+aS>nnTURP|~Cp|B@zvtzSwi({H7kGWD_I%1Hw(Fque`)O*hK2PF
z6Z5r|H_tVY`FNLkmQgW>!ueT6H!arbK3RHcTcm1(j>1EMxgmF7cQwgW1^&#iz4p>=
z8#`Z+Vw37L_X5^ss&~Bl9Fj6+*BUl&dS=q_$DHef#Eu%_r@7^aucp4$Jn&R3;{Fze
zD>okoN&M<JI@CGSkNI-*56&&j0k)U4S4ejrda2iH!5+P(VngnQS5jMQ?%(qb3EiY=
zbocV+WxC=fYp?sRy;peI?&6lcxhH347V{?;zuuO4IIrw&2~$KOt9rGZdqlP;qp(Vr
zSfRe6{p1UL+tlByscn6$_iN?mjQ1<q56mz1-u-zJ<GELFAOCr#!O2j*{O^a?C5H~z
z2O1xISie|Q?%ZVCwFTi;WtVE#ekjP-wz+egi~si8g6-mbNzdxnGClD+@0hYVbb@07
z$GHg=*P|=!cK_KB8`wKhz`?KL(rvwBGtR^E(j5Nwn=iaIE~r>}d-dO$NAvdgp4Th?
zefCc~YySR?|JP1Rx7+?#Z~ogbBi@#U4_@8cQ#N<yHSx`StKy~lvf@gTM2sEe8(R|J
z{?V9in|?{<^P^wWg;_4Md8s|K4LdDy(wpsOq5krkV?GhlzrLNFyEX6LB(b*gUd@e`
z?Az8zzS_Rh@ce=un@*XExcvU5b4+L3yEnz=-){vLEA+BG<M!s>U4B_MerBDi(a~My
zkHd?<MN7u@vuD^!F4*sytLnO;W!c_ydNba%uSy8{zF=#<=I)hp2PgV}zm}X~du{UE
ztDBD++&Yt({`SsSZ&_Y5(}Ew5|AqbizjV35alPuCeA!pK+%Glvl}-)1|C<}pQUGm!
z$vfUZ#gCPNVWj}!%`ch7IhlFcsYQAPm3zZu^Y54m)LdU55hM3b=7iI%?NS+y*UF-m
zJ*7?Bw>2hm*kqO_DNk(j__;>p?|a!vlS<{c30phzx79A%vHA4Phwpw#?yau=cKu`a
z%#B7hH4`^)+BD(LybJujC%o+HX71^jcX4IjudsFA-um%1pLKP;mzn2mSu|(;&P%?$
z)|+%*X=p{o2G0_k`!>oicv9)&Xm2OY+}5d4Gc{(NP0N4M8`8#gH)z>wx3D`>o0e|)
z60_yc9Icgh37VaY?7jCaiCR&Y{rpf#r01avR;L^028VHOwNttgly0#+)PHOLg{)Ic
zGh5D{(rB=fIPmnCbXIgyX5dMFi_5$1{g~OBdOZUU&OUkd=4|6VXL8h6t?IwCPP9kR
zg#TijLz{%B)+Mg$B|^FL8;mnoT&rw9Y_fLWG|R^~Hwq}0C0k5L^v<1O)cE|!M-f-%
z#%=jaqIO$MV?OCQ>4$Pyk?E$Ib?Z`BPxU_j)Av~KV{5*Zx2mS8-SwFInm0(1J4)^J
z_x$shFUOzrkB|NH>$9iJj~+RryG43yBy9IQn)ms>&4rm~-fYURNVoSFyd!u;?#qO;
zFK=fQS?RdMNb)h-a`QZLZwT&gajwdJ<GK3xvgN&xr|K%R$GM;2p0TF+oI}~OdlvVZ
z@4Qe}TRivUtc90WDaHPna;+zXM@sP8wxX+%We%+&7p52Ao;hQK)q|Z=w;lew^5(&-
zOifGydmqpK@+$wFj;`6#l2uLn4S#!W-x?m)aQf>-g;`to9DBWP;pY4Iox=r~Sb~ba
zF;;bCDlc?gnjhQjm~o}KM}5hAw(Wr;Tiooqls8|G+ajKJ=h^xvNi|khoi-dMKgy<P
z&uBMLEGyIL<*D3uw1VAi*Xkm1*Q0umJsoxiJh^nWI`uHq@hr6~GcOr4)f%spzJ30{
z&YK0ZFSs^NUu<D>PIsNRkNp#_4uO`WvX_T)^||uq{;PQ>tC!W#_Fe2<%@)VDxu@pz
zxT@yzGsvv*IHugbVq%Vwlc%<Q(d=E!%NE7XZoMsadFu)*JH_PN%2xm6uD{r7@=d5e
z+;QVOX2-I%i%zfR6tMEvUd{ht-tmsLsS{@lU*YRsvbQ7lAcx)ui}tNAw5<E{AM)ET
z2($chCiK0@^c7D|tK10>{Q02ai#FHg#YyK{yqxQTC+@VGv~AhP!s;1QuU&2Y8<HyK
zUcH>(qlQ^i()yr{NbmV`35``3zkF|ab<S+=-Djq2Gy?5S!w>IV-TUG!%byULkk=xm
zt0tHW^St3d^Zavc@!R5x1+zBroILY>#hK6UtdU%kuU(jKQ}Aftyqw2JTCDizM=!1Y
zvh_`Yv;JJAr1jm-^X)lBzFPdTT%vKd^6FadJ3roX=<M5Ey4v4+(Z<RwuP<-zs3&}H
zh;I_J`W1erL;P2>;(f(GCBa!PjbbJ7$K*a}t8l%DoqTxFjCMK4|36lw{L{ZRDL-_Y
z&-EW+wmav)XKhPcW}dmcZQ9SDOX?#X?&;p$b+>=j#6R_}mok*^K1-hBm}kJWV_A#T
zw9>FOd_Sw0g3C`E7oYW8BVTyVS!U^eKO2dwMqf6ZPp>YIh&}U%!{m%uU!v)J4!Hw{
zEi3mV8Q)eGaai%|cKPQGSw}^>HtK6juzHtY&zpVp@7!x8N2g6yzN2u*U*hQ^S8t#8
zv;UgfiX;Q<9?!CCn_Ey5&$Vr4Wa*|;m&N`IPMyC<E$6FqOaBGm4VNGP4fbFt-~a7=
z$HxC!_xK(L2T0u0&HHlg*<8ELmnTm<X}xXwYPsTHR~KrDPrs3LL$B}K>nVkcl~ewG
zk$#?4r)%F;9sT9YrN4*&d~r-!ZN2M>-3{6DW&4;*%$fauB!2Sg_OemvaCfy)__bia
z%r|>Pkqp`>^Y5%aqber@!yF~TE30!;ON#Q#Q;V`en`Q1sM(5u?AzF8Ry~GjzNdlhQ
z!Q$Rdn=>9}L@O7{sJOjes~{j^IYmv)k|jOEJNC)`?`J-ki65IDE26uKJ=*GixnA+J
z4`*Jy;Hmxl=U?8Bi9ak7D=I`Ev`n7xAgA@;q^f_6{BtkvC~nistU7h#-+_t7cI9m!
z(mV6`C1R7^ghd{(%Um>JOFgntyxc0$E&0i=#B-l{cIzn>dKvfaQCWEBaf{lT%axy>
zofV&xHls00(OKuH-Hz{q%R9V3+br(4*qv_wcT(b+8vR2VvhNE79x%lIEBX0N_fzJa
zNgU}KUy_98x+QG8tob)EZ13acQ&g&-7?wo4nM?I13D&xlg;u<N(wJf*_&P$qc23s<
zwij;y{x|q1n7M3Ud^_HL{oT|1*XrBH)c$(Cs`){v<dKuj{*x!X(eA!J!Fkey)hbJ*
zHge4}eXlk3bdbS{d$DpG>g#=(?;I37+<MsfgdL-3o6QzwnV*6=j4N79oIh&XE_Clv
z*eavWsB-DC(rli^Gh{fIST^`@xwr(+%HCt7HRZcRnRb@|?^CxUGvqTE?m3)(Y@@t;
zPI96~%T?A(x#!q8mMpbZJXxf%OoF?3V|jn;!idkkFWyOivwUSM*HJ&=-=7o7JUZ$o
z-48#nG!eh>Z$-qXc{U7lmcRHrJwEYrV!Yue*S3Ue_7@XBFu%CAPI39X_#+`}1@>y+
zEwlQ#_<eQc8z;YtX}^<Z$F}W!om#!EX>Of=%|6BqhWGYDYWMTECp<9E+_?KV=edsi
zu?v06XQW+u&nNY;EMS7%GAq9M(jBuU@(;}9JZB;ht&#U&C*!$nj%(Ein`gXeiCT5(
z-0?eUoD02*Zh7=M&e}F{85?K)W=n-&jnmf-Oiz1odfSX?Za&_}GnFl^R_cCOD)?iQ
z>W8I*JB;&{Jy$-<>x;f~cB9*@?Gv9_y{viDlN+XZHPcV~tYK#E$LWu{B;GuFywgw1
zMN4rLXQ1zn-&#_8&S|8Is@hha%UKreHPdV6{M%E0?({2+(&+P>xg|jDZtnByi`E6R
ze*M4s%urUETd;|3&Ws03*wT}gy`3&JcnimvEtq+K=A=72B`?HqX4sYaTnIeS$>|p&
z5UmmRU}dLY=!Hvj&30W#FA3quDoAVE%oZ~vJ60n*)<W&YiU&tnW^dK=na_Ro`5l($
z$)%d#qC##&oeeR4J7eaANo?C<th@4UjBC9;S>J#BYipVv+0mddU#$OV{gV}}v5Q%j
zxMT)Bi;U_BIb^s^QsHvWmcku=vm$$DvfaP+W38J-+-;r-nP#^vwyR~{JrpTD<?(Yf
zArH}8cNUp^Z&lu0U8H&Yn)UB?sfYh#`e&bg&m+L{e?4zOReICesQGXD#EpZCuVwrT
zk6JEy!HM_9%6+>G%xf0r{CISTMPH;Kv8kJF&fM9$!CqN6HYTM1=}OCgKWA5||9sXD
z2QP(fetKu-YoSTv^HtI^f<7H;PJ0-^S$?I*n%ld2p-iyw>lw3pN^g|sG`)W@#gjXA
zQSdU|DbHpeDc0`$8L{^2<BK|B6ZU-AASy3+CRAio*C+ouFLnr++|AG1x_{@b|9U+~
zJx_Y~{hIXQ%h_#vY<HWqzJKu~zUbTMN0*g)ZIq^mRcZ^DF23XH<r(FDs;>C*mYGJ?
z=Dx>H>F%G&CuJLUDx&y#IrE;=->Y_5do7kf^1E9-&8&3G_Q<}aCu<WoDnFM!HD~p#
zpf9V;|0X?fW-_=b%2;Ck)aOZ9U&*YW6W^<z_*|)XOszwOe~ZM<1sy8ilQwKV{Z!&b
z%b(_kjG$YZ9};b=xs~(JyS>nMZ7G+$m3Zu^&ACk-Op_AlPdA>m+P{AP&kg@x)$RH9
zCGjt7(^PH!B;JCKm>u#0?{?X?E#A=IX200qM00s$QKO=lhC7q2;Im(nscRgMYJcWf
zvpv`CI`{7V6CYS7Rcg6q@LXfloS@d`T9?w>yX&uCZlKkzN}kh3B8QJ>on94g`~CIB
zeRI+~We(hXd*_OM$E15ZJ9XOLeXC9uzxL{>V7dI>HJYz>85}s7w)*%2!TBryy$Tim
zyO^W7EirV1sUFw8t|JdDa%H}3+a?`+O!x5Q^eGE|=*Sw*viZpD`R%+$`_2ph?uqy|
zTo&lM-TG$t(F=al&O7*gVA<d_K|a!F`{JbCdpwq{Svkje%ePG(4m+JheDX>RFJGBA
zw?XV`xJZCyyPe~aE?NGcmXA%`I>nPC1>!^>IPke0W!BL4|7O*neC4mO=cPHjn?8Tm
zcyaBT(V5RYH*%&_{V_<&bg{7e6t{ETzqCEAdrI76e`v2x;TM0UC9T8nT=eGaY#Yui
z-Ew<{Cu`=;GhEsgwygMKYt4L>3zJK|L!)9W!*g}`0(_WH?6jO-cQ1H1bGXXuQpV_w
zW_Ne+2v)UESv%pysq?o?qJAw4+J0w=gxt3y_B%K1TxCD2m`~nt`c@75*;8*m`pa|j
zO()ls{j(-4S$pmG+h{hQk6U=w-@kqHg4U9AS{B>G?(y#0WfbBxg*_s6j>fs7*a;G4
zNixUJt8UAA5)}HH*-43S<HWBL2R5y9S<2nEaZ$^y>n-Bp+!@z+FBzS#V9>6cd$2_;
z>g_Y7O~pqq{;<wzT9vuE_GUoBs+d1-gl&VfvzA7?nQyZ+?wivswrskMhl_a4%=C@I
zv7u)_Oqdj&=j^pc*27pQZ`O>B_b-NC^N)BOQuhA3<ewbLFZ_AuzNB-z6f|qeuV?<o
zG-t2Hd;tZU2NSORDiC<)l2_fjw9cDBNN>*T+1Ibhty=6EGjYkHAD6fDt0wOF>ku?y
zxpW}Ub<NnV`(&m(+_&h=SL>_G)-HOuXs+Yr+N*u1es^A3z3toiPp{(s7~Hy3^tnZ5
zX=<Par%fpTj_2+?dK}L}1){QqE=~O<{4u!EV26oq;Z%|9f=YdYFWq17zA)ir$3exT
zGk;WWxh}i!{kPJtC7t(p1akClTC9F+Y__g0=kcqhX8#0v+h(rVRGxdRW>&$ZClSmA
zDrXjyAL6%RRe9*#w)c!Z&%?;3_1Wt;E@J=u@u;E5Y{O4Mh3YQ^Ur*8du<Y59QuXII
zeE0IqQ{?;Z8~&qYuk7ML#t+WLPo}9@cuAORrA?o#v10eJ{?o2u&IK|es*RIvrhUIS
zFK<u&^^<8&bGo0zZG93He!qb|uyw%}k?mJkC3nn!cXW1~>JK;1ORJsR7nq&Cx@~=p
zxc28|v)})bMr~{5ojF>Y$-=<k%T0JQLP2^aX!}~&?Y!G=0=3V>dET%GZ8&1}E|_zN
zgMxIYpt)cabFPBKk*=67>B+mh?=DR>`>?;fEj(~j_Gi~e1<%gBeWU3AaQ)S*_TAAF
z3o?H`QhR!-)2BfAp!?ZLbM*BN6~7mm=5^gIr<h&*xqMyo?m5mU*G`)7$vsXZHc7_f
zoY(o&Jz9!=n@@$d9XIR<(th0Fxl*Rs$@6uky1Kf&`8CODCTu6BFt*QF?QcF|V~~jH
z3Lc@*tiXa~=P%#)@SV6CbwbyGyL_+bO|#W$diqC}`R_b*d)+((nFGI;dn(FR%=zTI
zwRh&tTb1d7w>pFV+@5mF=7r#)WshzD<j<<v_dzQA^aH&;zxVCxn?8U2^!U7ebzL?G
zR`Wmo6eyuO+pzTF^~ITwtjcObK5a6t*t21eZ$Z~?ffosl2i*d~cL*5gt3_Sg)h5fH
zyW_FZQBGs`<ZU}_KB^SF)7;K!yYP-|%=~1&u)q(~9>42q`u1?v+TAfrXYekbQS6qZ
zb(~W}c+zs;TU_p)*ZBH%mN|t@o%6u!+X2oMbDpqm{drKB{h*$>=e;N1Txq&W-l<-D
z)?4ogIeTc^)3p^xj!$h{ZNI<RdCP-_7GJpuvc)$zrzgLeAf?`slI`$|@8Krz*OhUT
zdtY3)=lNy7`9$_2m#%;N?s4tkd%SPrQztI*<Bd;U&6<zC{}6gI&#+{o<sF0Dle#+U
zIPKZ5vHVlJ=K1dYyuFG{fsvs*DvtYj+x0~J?zV3^VmWR4+x~j{vj!IK9*49i?l6^G
zYx!@#=(eBr_5Pjh3cLOk+c$mvTa)#t;n-p!z8bxI4?n-QuIX65^>kshz9s*@^N)8-
z>?&M&Y1IRZ?<%6pKFYNBt8ci(nr|gHz2V9Fo|XggTQ>faN&7v+D9=B<NBy=zaQ}kh
zB;F`h?Mjx8Td9)As-~pW+OG}kezM}2_#%JlhtVmkXRFSA60Nve-C^a*!v|Sem)$fq
zR1gvCcAcLf=9_ja{GoY3wMpedo25H-O6Q2?ybyEMx;1_2_S;8iX8m9AT>0;t3+iP-
zD<9Pw*Sb!<e!POcwdc~k{L9<6ahQ3DzW1?NwC4AZy*4TrH5xXiv3WiUSe+a+Z$|DK
zty}DR??3bV?XZ2l=<kyyGZuLyt9+FXR<sp;DO|?v^yt*8Nz%_M3|Q?I*fzPZS<F3!
z@ydpyz5FajQh9$@TE_<OF<qu2nAv>pL$7pDy5dUXznoQv`BhU4zBGld(_i%a=9_|T
z!Czk9i`baFwf6kZ%C}ckD|1%s2>U17u*uEa?pLg1!K!%7LHe>!#nwMP>>I2*zpVQm
zeIn#-&hNNLofCVnemR^}GwI9YDy<sMH-Qs<{;qpIp?KP-?PB-Ea<zSvQfG6my!7<u
z&Bl-?ntN}(c&z^7(ix}b`Fcl{`O|i&I?F5WFY)YWS(Z=~y-_!R#>9-b`_&9hnCt6~
zNbkDUK1K4V*lvyuOY}azdD_7f`Lp;-)xFE>K1M&UzxJ-E`K`?Anfuk#|3z>1os}Pw
z;CX0kb8DXC#KY%~^UrI_d!;ArAFuGR9#K$%#_8PeUq7^vm4U%sfPq1gz;@dbP&u_U
z{C@szGl9D6@r4<3DT}8~*zx)>PfEmtl-V1%Xj?HyCrU8s&dpgTv~psI(E1nu_bIzZ
zPJC;^_ln)w>eIg8UqAL)HQU?A{FlA^Nu>2y#<Yb7HqTe66@+dqX})M-$A2zCYxUYk
zuX`Im{yb{2Xuo{oKF5moD6SJ9__!mdF5zK|lw{dCNma!&Zgy1SBnEx$l{^NDOA_0>
z7dAh*x;k8bW6%oEwG$iH8K{2Nl;CW8@chRClQS)5tG2z63W^Nd<G^aEUAeKBQ-#B3
z*Oj-EZ-&LJX)JkuZ@NXF_v`F~;cJb}AN6T#>byJa+%>hdaYNCJ<DdQI^CrE_H@|#8
z{eAsh7Ki;}tVd(DT+dzCJ!9=9EN&sZ^UnPnhvYZjxP6Ol>F(uWsjpZW#iXSD&uM&~
zW0sMy;St-Vrc3MHCU~<x-FEAcEz{Dg3r=Wsp1I+Z)iTMxz^ky$YOD6OZSC2)Jr3Th
z_qeSJ32ZnME9hk+J#(VzrKDpT`&RKrEtqrY+?<<H{S8ax&U=OUx@cWIH1&;f)Phav
z(obH=`|$F-Gq<^GQJr~ki&~0esOS4={^=(Z@3icBR=y=Byx{Lg;lPGfJq|Ly_Q4z7
z3(lWyD=A;5*{qXWlcn6^oo~j$<F7Jx&y)X_?^J!(er@rpKO4MRVPEfypVP9x?}?f8
zNW5JnjP<e7oC8UgSuD@LsrLM{;Ez6e%R6P>`xNoGvW=5__NMHayyxR2bL-A;ljIMj
zez^K`&cju4-{;19M%p}ltAA!w+Vj^jS6?t(=Z$+{#P>OJ_I$_R26I^an$ufErR2=k
zhZI{~jVYL{!rbd>*YZNWLcewSvfz^|IoRH0ohhB9wX$@3R()6DqsJQ`n{zxjesPXL
z_PXwiT}A2#8C}mV(vFnjYnEMSJl$ww#aox_mFMIGj_aIeQ@osNk@KR&RYp5}Uab0x
zpuVW9D@EK+GUeU0jajNWY4RC?o9vfwuU3?0vf_<7P*PJ@cdydTGPyKyQuQ*cX>YS!
zU&iYEUiZb!&iVMa>l-diuT<Z%#M)s0_Vk(@{ylaq)y1#eZuf3$t9tayvv<Ah+!Z%f
zME&nZxvz9TSa!#<nSb-kKK>Z%c?%O(Hwo>(wQXC>|H?CqFDkPnsbB5fQF{K(hDqOe
zcSzo3+sfM5;^L&WC%cyG|Jt2Ol9kWd1?)mt{dZQnD7@ObRcKq^-xZg7mj{W9vzpwz
z&YhWDvBImb)KjuiG<D9iP0EMaBHPZMzWmeb(e#@dmwY}oy=}<!^Hr!Rkvc4{7*!tZ
zshXZ`v$VtCfn#RI<ibKB!F`>M!giWFe*BSjU~fLSe3kn4;O!P`nU1HOeI$@`zI)x(
z>d#kv=jJeNdpbX9YjebwQ|wE#tLEiyy+8feW6x^2m9kT+Raf|i&W`&u*JXo{|B_lc
zw~6g1HIJOumpyd7w)p#sDIxmB)`upU_x483^_$@*({b;(T9A0@HTyGXa{hQO+x23t
zS%h79=&P78UcF3(_P>p{PAK*qR?a)8=lp7CS@-wX>E>T&N5`69%|0kUr@M1v=K`&J
z4;6G@#FZOtI+4EXwVzyk&Hkx+zPdl9mCu`H=N(_R`7(F6(zA_bK9afb%bE>#@wNZe
z&6~|@+coR=3hrt8$0k2D4yYGh>~V8VjNIWR+WQ_ZI(CmqOzfDbLYLOj)=m?nsd-9S
zXRK-jz3$JvJ-IgHljP=Ai@Luw@PFsNx2BwB%k$amUV9!D`FQWb6Yn)=Th?yTnZ>&K
zWyVYMK<2Ay>tC#%C4MuH#WuDu{KA{WD<Pt+XMK06K3u?WXQT5qspw<b%gwjv&0OZt
zzVl_X?umIzr?yx4#y4%e+VggLORdC~rg|0e=2(>{j~_jHn_?*=SD5yucIMtAe}1%H
zJAUp*o#5{ezk?5k$+_<Gy{7R^N~N&t+mCZj@3+05dqY=t>C57nWxS4m5;$J&{&X=Y
z{qEM_?)>VP{}JUoXwa{Ew~^I4F$RWuF9rr}0_A&IW^rj^PH{<TN@l)ZLFG}K?Bd(o
zK-*(4{9<0Z(&c2|<YTiQ7w0dsSh>8;_sy|PTRGXT79ACllg<;Sm0JINUtZ2Q;lb(t
zdEZRrlcf4t%QoIH-*Z;)-2GZPIqv!Hllc3Y<WiFqE36Xph0e!+dbrN|-mSFD7B`nX
zDx10S?#FX>yJL#BJu>QxIPktgLS1{taie!@w`~*4+>^BVrqcOOQ_iRPteIqSc80iX
z;j>hwz9-kNeZOD-KTU7*mCq|1Qw=8@=!tametsOP<TTIe^`+AVRVO(2h;N+S?H??~
z(C|$0zEI$?%dO9g#U1l<XKsDA?`O}_pQp?^JMw0#-&}fc$?IK5-(9*LaAM6xKaaMg
zdv7=%M_=`Dezuc?dHap3pQ*?ELl2jn{JUPg@Ic~v?y{G0|ElUNX8$X(`1|w4m%}OD
z2kkct^}lnGa&OtiRuo|t+Qw${P*7&Be#OQI)|a<!Z2PtF$Ej{z*~9u(@tT*8*5rQ-
zDB3zR*CLD2K=t#Dn3Oa85BFSVj6R|nojZv)x_H_Wo93lg3RAuH8qJUFZAj+b@ns{s
z`1J>8q?px`=hU2T{E>L#5vw0-Qrc;YhN}tFrl+o)@m$i~fm`rn!?d$c8yr`+wd-c`
z`Rsngk@u9bjv*s7a`w^B`ghJp<nI;vH|g4EXMe8-nWHbc>h5P0INm82J+=K2->%Os
zdw>7Xp1{7N-B{kAe@4cEYf90F?j&U@Xnrta)YPb2F#YbWU6b|8(j6w~ob7y=J}KQe
z!P1gZtU~?I8>wAvA8My1Y!{D<-*x;z-;J8$V&(~T>KD#smA?16vDNrfP`%~O9Tp{d
zY$a|sPdAhwQcs@5{I6i?Ga0{J!K&?Vy!DKguAV%Z&dNC<-$ARYY<2AJvisbt-=AH6
zK8tz2Uc`yLE!jnnWyCr}Ch(i@5SDl$Ch)CHO5xPLyM1==-|gGI+-&8Y{3DM!e)&D_
z;NP|{H&<}wjn%eCPd{7GuzQcq84n&!1%}J5!PQ&8i_eMTef(~oUeFe~rk7PK-oIb+
z$LrqD%@Q12h5oxoEton<^{3Y>)rIN;SGF?RhGoxVJ({$Am9)f15fRTrwE>Cy9@SU`
z?bV7Ausffh|MFj7oiNY3!!Ncg?>MEw7xXT*ibeP$(^95)K?kp=Sl`wRyHYWKD#w0}
zD7G__wGq>|=&DVZZBy71H&y7f1)sIY$9v8@V+0-<owaQI=WAikQPkZc^;;$7U8{Jc
zT*nQuk9&i@HO=^%@quxL*Y~rxUvip!QIBR3pK2V}C%WRh)4@q!6b@!)n=PH`xmN3`
z&6JyLUyPbImKgv2*XH^&i|;zGOD!i$i%q<$<h;vVekav6qW0aZe94x$_#CI|8D$Hj
z@3nf4oCl6ix)S!nb^GC$hMK*~KW;kv7O|Xe&#{{I?}M}EB*9K?LDr8^-=;b!MXrAl
z_CQ(i71zRSt%h~&a~+d~ygS?4vpJRqOpY{&u3q^l(?ZW;@@nw{wPpMk7hX9n3l!PK
z`u1>oLR><>nd6;!zka*_R<q~Log*(RUpGf~Zk$}5O>MD_wOv*9!8!(pKXMW>5my`>
zt(w0mS_scBF4!r()!9B*JXSYm**g6@(XY>G8j5N7*;PIdnce+u!L5leznzZSELk7f
z^MBjYukStd9)Asd(q4Js<eLr){w<HxrMpG9@o9){kPnn)=De}8V_${T3D)-Njb}Ew
z__;0Sux>kL*M0f+#Z%o6%66R25zRaN*L%slFK(w~M1JZ|f8W0TpxMdb1S7Ni5>Fk>
z*fXvbJbX5BhkDYvO%-B|Gj=@QYv=t_%dOi{;xx;f-Sxd93l{GG5_CcCzf;cx^@8d*
zuM*uQBf}MEI6F$IuW(LWw(GD@Y|@sU@e6i5ij!)}?Gr9K$-IL}scALmt{mCti3=1L
zaWbrmf5thhl0!de+syZ#XLrW!_-1zL(Mb(9xqeTlo9Yg{mD?otT{{z2@H1F4Gv>LH
zuJ`&fZJ&itHSbBS4n2Kk^<FRSs0FigIN8_lcGS5l@$$u&%Qw%rix;H()!Y5yuvWUb
z^49~0gSLVbPo!;@lY7yS+8}sdtswmJza<eJeARp=%6nV$xDwK2nAU!&e>OYrj{3Kr
ziRZ4LtC{x0d&%t@v56Jo_sfOWEhzrXd+zz)i_a%JKVxO&-du5D((M^4;#|5W=U2a8
zz4qX#SBr0HKH<rk$$YK&UHn_il5-}j`p+=+u8%*v>g~~zEhUYo8z0v4zuWa;Z@}x+
zO-HUS(k@^)_(o5SG2Se3+83>DOP?P+mJxrHK~AaV`ucfx(#Ni)RcB<`Bs0hD%F1Ju
zn$LV-UY^Y2zK2_bn~rj|F|M1M@qNPYSw%^<mpODkoo}97TmF6P?%n(M8<+hOP7Qs(
zr|A1#!#APcF7_$cHazpoDJyL}TBZAk>yCzPLcKxfoVt@jFZh>69cfkiwdx5Em$1pB
zRXxjp>F&ujl8CHhJF!&hK~C0}_0`>CC7RV;zaz5MZ+*G>Vg9y+nGt8IE5E(VX)>B1
zyEd%yS)<pn!snTDj@HR&y><5!y!HMLch}AbtDj{q`IfzwgRgqi%dgwDted)RCjU%Q
ze0Q3c@rkGGjArwFmZqP=Vz?##ggjcxcsO2bA^*KaCBpjAmn1L6{8|70l!{2?`NFyX
zzNYLb4xay_ic`zwsNdGu=;hpNIruDZmEO_c*ij|ru)nWQ?v_i(jMIm*I9rZ-1Zu}w
z6*c^d&Pv~6uz?}=!WyL}VWAY;to%K9I@KTK_&<KLVouSFWreryh!{AYG-kf@hsVbM
zR!DLC+BYp3l45y_Ryk}D++?({bd8$EixuD9`EKNKh?>4yzw__y-z@dU%l+LKZ<LsE
z^_RKnk>Ght3}+oQ-f?&K@|amg`t8sC%q<Ku#R@{_^9l-P9=MwJPyWW@cy`gFzVAPt
zyl^1&$ltl03wf_`9Ncna`BC@sxEY__CD@l(^Cq*iA4^*2k+QjQ_OqV%0h?JIxm4Es
zD_zq+@{O}j=HBl)N6ODL&TY72a&2yklvgKjaG=Guu8;Q`Ze%E)IMicjFnh&B>vNk`
z&gV3(n6^sc^`fpzY=sLnivNB5@aOT(FCQK~dXvoF`ap<d7t2v4(OFZ^>UCIko>Sy-
z`OrM4PTl4n>v<{R>&HVf0<50TVoAsgyxp>J@;{BoS8e`e8}Idd6}C-ogO~Nr1N{PV
z(VyQ=oc3C62Uq9(tYv?apKrBZH~H=l!4JVlIfFi(Tp^k8c>ReFB7ar{cfM(8QaH82
zK{LgP#muwkaiGHgDX04t=1N<<c;%(?z2(1*V-d60+dmmyX%~fbz6Go_+;lrx<WGUI
zZ^^+pb*9JlY}*ytIhl1Y9pk8Xul)UEu9LHmhe^84ho4nxj}|=JGDYdhVlLmwx87K)
zZ`sGSg!}2)2PJIx<SP1}=%=krw&n<zXbQYIqx|^spibF3|CP);BhNk#NY7~S-e4=T
z??jj4gSk-~4(xQbOIV#GURC*}J#-J>-J7QBv;9<s9^FdPb^rbD!(W#58x)WEPJOe&
zRW~a7*a3&?AHT%croMIFapvHM46E&`3m^X!&t;c5>)R%^|9ll!+5f7ZnCCkTF0IUu
zJ1?gow*Oa0^R3uS{uj1^&69$&x>}QY+U{%3Oq_H1!HLDYJLjrZonj44n4^}k$MV18
z7wN}56E0gHn8I1XA{RY<=b|R&yGeg@W-^)1^0vNq>)d4V|M8pjLeo}8EYj_G-2Q2%
zk=wJxYeGfF%mHFt%ABjqOJ?(iYg^9g=83T9SyC!o^W?9vVC@d6x*2}2Hw(GS$oQKJ
zz2RK=DEaHbg2x#j@6UY|l))`&aBlmnZ6D^#CwrJb=S|Q%A!lGY<(I6S{9fDo;-8n7
ztmDZr`6anHiKSruj(hX(gdCfw9oPOdBw@E{!h_r;aVpL{kLoS{y0$L7X%KV7@WqtM
zS4*Xf4o%piv7wYJq}+Db`VG19zkZpUFMjFz*P%W^`#RTGGe%7ooyygEY^OpEPQP~v
z(3+Jw^UacwWfNpCcuWj>vA!p98(*$%u4{YMn#BirH>f=c*v05|Zt)l4BIdjwt9rX`
zYgu*{)t9)`<hU9Cb!NAh;EKF<WP9<}=50^U{F{3*&^p?#ugdW2S7D2&2I=RzM)S5k
z)|=QfPp2R(G41IkZ>z#XyX1~mFqCh;cX`A8n?E1Fc;6#EeZv$#!9s<n4^k9Y8)Wpl
zT{1MdQ_KDGM68C(WntCJW-$g|SWo@gF5dPr$~)Lg;q2oaPgZs<kMkiO(KjVuTbX?5
zNSGcs@8}GsFB>f!TrXI%UU<nYz?kiSe7nK3^C3}+cXs%0sk*AX>M4ubw2P_#ov#MY
zZLgd!<GX#ik7`h#hh>A0iE&%5&%~v(zg-UdbvD%H^-LFsVqd>^n!j7->CT+}_JPoa
zL#Fw?4_-4&%dl9r>OZ6Ex-Vr5j|DFOZ|ZfYC}Y(Q&G*Obmd{(dD&XR@tWB+7Lb(?F
z3$EkxT3R=Ga>2?&jBNZj4vTs)eg8eh+2Nh}vlSEW#e7RRC47zd>#nb+x1Tta=A{Om
z-YFTLeRiVZJn?Nif5q^7XM_fD{$N~ptB0LE+VkRZnGyxn&d@!|riP1e8G2;x)PE5)
z{ZZ=6yNQXs9Lh<*D-uPf8a>?j!F88!Nt=q9;J#Los-2a`(jR0st1)cUO|RHtY_ZEC
zME2$;mr(v$iHmj|+Qd9nR@Z6%-5ryCrS9-g$vv^S=4kK)fxTKE>YC3U{hIRKjWff6
zrBQ@;fxxVspw@C;?|TzAwoE>ip*}7Cq5FEFe>w${8n0K~FA`_Cv@dSoj->N9j{Y+)
z-{`+Pqve$LgWmPQzW1aK-{X$;`Zh^bBlHvR4~uY7_61Hn&6ygNEN5Eo)j5P$3qPN+
zx_HAGBc4K=suL9}4Vqe`L|qo2e4iKmtJ+BFV9kGRtyQcmT-JEW{Iz~Q>CgX*=T6_9
z{@eatpZn<wTb2vXhDSc_RMgn<(CbI0&SO`zFYRhV#%DHoq|I=TUtA%}>$#QR)^dsO
z3B`hoLhPb@_I}a0vQXen*MlvUWz0Lo8b6*5{}QP`e@(^9RVi%$xBrkazPjLd`iqH=
zTklD~PrO!e&?jaS-=(7|h9_;Fz3D%`dnv<$B$2M>vm*X$f~VAF@^AO#I8gsR^3}u`
zs{{Y9?BfsH5~?GUd1v{NP@5J511qz<$y<)3OxfLb`~9zo3DKrZUj;<G_i`O8*e)F4
zeZWaG?%FlG2ebFFZZ|FQ7d-8%YccOrf!O)|Q!Wat7WmHF8~sD&;2rOcMnTRmeDYp4
z+9wn;)kG&A-jw#R_Q3@9MVBM9y#7yQSbRz8>?}LsM{CP&ZrZZ-)OyKp%jVQ%hwR!s
zPhhgg-l*dZo7VAOy%p*COQ478r)0$Dx;{Un8Qz5*#ic3NQ*5u~3+rgDT736R?TUkM
z<a3@MJ-0(N^|^a_jQ76i&EJmA-CQO!A#rb&=$Rj``-N|u)=Q9BpU3)blk|<%dI`T{
z55$!-|K7-b<J=DBTjzF2-+JwrVI6y+Z1=*q<xaQXHhnuF`KEm1!E<rqTiE#$>$gis
zS=Yb$^MhfF_}vR-w->&(XUJVIeXBbxWA`=92ag%UyPw=UG&6`nB=v_=g5rc-vr<;h
zRIT5B+2H=t`?Df#wJxpb*tt#n--o5kE?J5^HIi<u+%2$OdGR0j@|OPhzdRS6`XFrL
zaA7CQee;9MMOkOGIcILLaM*dNc*}upfty4RO8B^(epG#A_m+$6w`xwktNZ!O`8wOT
z?guv=y6#Z?PjEVGc2}R@^5gsWSeJw>QggZ;wEsbcj%H2})6tgKOgDO$b#L=l_0O7p
zbl16QZ%oaa->(-nk<|Us@KEr&!}(3#(j~$E|F<NVN=$e*!|HOj?ZKkb3o<cJCfaM?
zE4|X4EZ6bLKH){~>Tt&l+r_0m_inC<Nikcz$|_XVXWEx`&Aw$70<Cga|LIn6n<Slh
z<$OA7V)#{y)te4mJyW~zd$(}Q!Y-Y~$$a})@J#!h8=&v7Cp2qzPI5ui;xpB2j&alm
ztUlqPel)G)ozG4#JGU8=r_8Qe>Q|)1c$!sa`IQSPJj&L=TTX}gYR`~~f4ZSabI-r+
zi8kzQGiSZsv9#Ugs(orlPt)}h0j)M;ht)IUmRy*u_jdzZyQsjLrC0b?B&h|g<6CcY
z|A5jKj@M2%t^D?%GWyyPy45h&^F?of(ayCU$^RPSRyEu>{DAexcW-^(3l{tmzsf?k
zzI)ic&@}x8Lu7F8X1TnQ9EGfRd&TmN%5%Pbu$&ZqvpM<A?M-gY8&-Xea_y0A3zV*H
zKEK1Mzaow)nQwx^2EjEem;9Kfn04Tp(k5YL(av8d=84)cEHKNPr~1HA++T3lJ&lNb
z0lhUj67#-y7J7CU)x8uG{lUcj;#K*R%+P(7RYkSiC33t{b$4wINnWgA`1FQjPm_E2
zlM8XB4L9!;TyH96opiMOMD_KH854Kj@KSxStoz<ZM){e0tPcNj`I>UBX{p#TCXWk;
zx=x+gFUd6VMn>`3%i1;vPRLqoEy!rvcS82-tdrB6ZbZfItSXqe%~#DXEL3sXzCZgP
z)W7PTX<VP6xR=FoeTb`$W6zyW9L;G<gm3)Zy?xcR#zQR6FVAQDW-VFe^eE9NeQwto
zJDaoDrZ5^A#C#L(uko8I5Mk-bpIoW6!74gcE@264bHbx!hC8QT{B5lh*l;X`gLSzB
zYpYkf_uqAaZ6BkYzFV#0xSjiVkJ7yRofgv{rUj%(JZ!#K8N{W2AU0U~0^@|xowBnJ
zW=`FzUaG`;Zr{^iUp(F<>jvIW&Hvf-h12%?*@AVtF`elWR!g6G9`|CK811q`W7W~c
ziF)o<bFH}+O@DlMI>X(`C->H}3)L91<oxYf^oIS^T$u$Gk&z+7Q&Vp|JUR7(=);D7
z$5XG{zrRS-3^CQ67vp_5kpFKy&x|dV3|bp@e?FzilbszPzt?Nc9ImUU**E$Nh1;f1
zIAQrK(#Sw{e|zqV?MHXLU|HMx$+VF3WY@7>Us6I^zb!RXGZ1{qn7;q#7s=RJB4rvi
zk<5$aOLGizR^NY;U^bCGZ}zsl(gYpLt5s}Uk4^jaHT`PN^m!gz1@2xk&DLAGd-kXL
z=S<8uXFONE?0eE!SNft~aR0igIWC2XZdFm&BKlRgT{V1~kx-doB-+*ywR=nT%LgHu
zLXVb<Y0lh}bvvu&!_p;&&L{Y1wAEh`GVJGly{z5;ZQYOX8S?o{o~*8nh)O<n_0uA!
z%9U01>*m#1T<YSpG5d1wWq9nC{rXAyNuTeR9(fksYVh|!_{787r<`SGd}%q@JZZyL
zJJ~A9RqaM+XN44NgjTKCVdwfg^uhc^zyDXBdHVVJdErn2^(ph0{JX%mbJh~hq^eV&
z?0Kh8c$83oZtC^zYt+8}Z%bMIm4zYy$`TD(qn*L0TxV?!-L*`0`>nXo>OXzNC4~J#
zv=&I21iAkCebD0MHcmB`#(;FGNfVYUsrftWypFnf`D;co^9Sye>~5T|Zi!qfp5T@!
z!Lu@L=i)83I~r2k5(@%&-aNT)b?DV@hs%%d+OK^lwYqSMipy+PJ*j_&{Ys}bh57U5
zU$`jxR4ecn@8r&Hxjj7oZVx|bh3J2AtZoW>@W@Z}u;dfNovs1_x0lIGWz66A?bU+z
zztenK6f_RJ{<%=%uIuFNJ8!<;Yl#rtzgjdR{2{{uf#gf^3J#Zh?MfI=`YPYckTcot
z`e}i9O773&F>)H!t#=P(T;I1#V#VvPoom0Ct}+t6VR(SsVI%vi_z&@cC$hv=yxFog
z?X#t7!_>Je=FH#sHzecR9Hy;WGj4^P<vl8)y(_+bdHc4-zthFM@*l@%Yue0?UJz=h
z-oNb6W~W!hDof7nl-YadZhh>TYxPzQKO~CTjo&hUmHE+NYaJCId;iPoOKE<tmAVTT
zPrL4(|2g_KV~}p-!t0rC&0kfsf;gI;3fAmsU;CdOG3*VR*6cUFU;2=RfuWk0fkBzT
zuy;kWp&9DE8yR*d+;kNS8<-3yB(_e@J$A|L1&>Z^B8Q1<<aLiFZb2LOF8p8XzV}Ah
zn=R*-@wb&cu`S<I{jSfh+5TO=T$A+^Cn-UnBt=~{jV~Pc#Cw)2Nwht`C)pFa@!}32
zU7qv$ZH#|o4w{I5aFkG06!TXKcJ(`zz<SzN|DsmAhL=}#mY{1x<-#qjYD+hrSv2X`
z=X-l9KSzp0Nd&D<P2f6s(uRHY0jr89Q6ELPD<tCgG#eI76`#S$%X!-Hc1z2{O5Pnt
zZ)e{X(U^XK$45H+kinU`t0ncK;`5#gXQ|G;yggfw>p5ehssZov_;>k>Kjv?Ld|zF@
zUbfP~zgy{vaJbRIRPN7>i&}zwQWnk2&w1D%@g^siKea4>?WrAt6-vg7zCGz->fdsZ
zp_w)6fuw6Zze1qYC*O^YQyIEei5e}FFnZ0D$?{}}TUUV&Pr3HFGUn^IBpL$!Dm66%
zBiXc87ER!uy=umqiDH|>9xvK*h*7oV%?_jJS&S3594r=!73wc~_@L;UhD^Y{jl5YO
zLkqa~hIZMkee<zL()mQt%Q^eZd1Kc6O00dNYIm_H^1#{W`Yw#8HZd&Hs9%!8pU`Ti
zdUtJRm%`(%{%<)S?lOE`nO*l$FKEgang8ofh#T%TQTF=BTV!oK?T{hw`wJoOKU=Q+
z7o7Oh^;p0!<r!z$w?4R2`{Us9;{8)~_*KMvpCoBZnoW8bR&>)tZ@bWCj~@H)`%LYQ
zCk5*5KBqV3RNRMe;?F8Je=S{g`qk-$m7#kcHagt?@#WU^e<xOdOZM^DxB2yTrc+i^
zO}(}RUNKhk{w45-MSg0|iAYV=DQw(%rY^#PtkRpKOZ(G2dThcP_MVcMv8mvTxr6BL
zMlQt_*^5twzWBbqBK^a>h{^g=`*tkfbY^DHtfDTTnJPQP)KUuXEMD==|K6^9x4qNT
zQ_~iUUbfzrlkC^HXh&JWcIjBFtXU?N7XLzYEH`|L?R{v-Tk%`jdHR3fv!=6pmzHg>
z3H*P%PyLF!(zLZVj)k1I-u1>c_c-^fh^5o?+GHD;ern!IFR+)~zNK*QMZ*A(Z6{W^
z>YA<H9GYLmBmE{*DBk;V)w`~pKbPJSUm&|<*;YnPj>eWF?W<(7K8APBN_i6ca!0nq
znr<G;Tee*LN~GqQ@!X!<&Q~PBI^XP9`>H25^dy)I7D;4=gx}Q?)e-x8eD$K7VBcAR
zlQ!xaoLwjQqx$R1{Z{!gg5fuU{`6n*7L}A<Y}3i0+a~W3n*G!L;R_~#R1Nv~_Q>W*
z?}{%pb6#@Upj^&uWvy#?{P?9e0`F$Z?_PPq!l8Hjq}~I*?U&!Yb4XiTmHg~^R@fEu
z#=9~as_Rz2oftY%<@r39{`3-Yi;TV}{CE4^eotTeerHO|%CcW8S4XQ%klJ;5@roKl
zlW7-s6ofa-lfU!h??p#xXY-R8ox4QNwJrY1Z=j~1?BjRzhp{xvt^~8ac5H6fJ-RoE
z%w?TuDY2uhtjTHdmPSFJ&n63;mcKrb9kA=%ow;wEW&ckQWsSX7b)){=)T-L!_U2YE
zy(C0^j2Cf~UOI8J=f<HGYvMM%+?Kv|_6n}vTDM8AosoNTGxd#^BsuSqyD~*!(yt9^
zVPAGV`0G6Hj9d6;s~wY-H@;bQ{zTL4S6eSd|Ed<;)!g!~>Q!9T+6SwhZr<MI=XZ9U
z+vmFb)pFbQ_I%ezEg?T8EOfBrVPJ4jz$hV8QVUY^Qd0AhGgFK8<Kr{)GE3s)^$IHA
zM&8Yn*)F>8d9XlG<6YLU$2UBq92%l6HcjQ&sG}S-k*&$#@Z5)QF3pnc^X$7eTcO-l
zenI~Q_tTTVSgWL`e^bwB{<dmGV)QNNPapo&J(qc>xxe=RFa7lVP(5kw^Xs^7T7+t4
zp8L5v?1^^eH>ICFb3bw4&FhI;CsY6N=4bm4yQe<6e(6=4_$SY>U26;btTnTaMP!zo
zo!q)%(&}ATkA1wpX)15T^VydBv*wuet~j>Ed_G_1`z^b##0K|dUOyFeRY$+%?kcZY
z%I3b3{q<Gz@~<A^Xg<um*nED`O{=A|4L?ThnyUAv=JbQrexZJ*kALTzUpral6X`WQ
zENIHgp6g3p_pe$q*Oim|Wy-rMN$;y7?%&+=e#}|5R{EJtT!n~t=5w33^}eotTuY{A
zOq1p4S-Nt?DwC)BKle_rH#%X#Ddo%e_TGA#sQvLbuWw&2KVw<EMaivysuyK#e|7}(
zO<$D#t97pigXM+#v+Mrubbj3zUU#?q#@7QkPM$oeAZWhH^ios5!bDwh--Fz##eY@K
zwuM)%{M52>g3_Ub9cwq=$&BONJmqRzcWbGeg4&U&oF59WJ36zxa<c><iTsi5OYY9d
z4d+zf8O<r4_vln)<kUN_97;}{yS_cYa^cckwZ8R7gtuj%eXSS&kgYi(Mfn@&)6ElO
z9?ZYG^@*j?sZU$gcTL?i=butV;&)fo`3DbP(o+8LdrtI+ltaI~jg6j6Ht3qRY;(``
zd&SY-Yc{OEGWX%yK+{DDYj)h;a%tXS`SZf}?DWnT-JO!vd0t;g@7A_SdrTHh%g&Y4
zT`^z%&!Z?CuRp(B53S`7Id(5xw&tMs&SzWOKJ+rR6yEjVmfRQbY0+FBCY2EpIxYS1
z-^-pWzp^N?dloAvCO-<*e7!@jaFJ$+<B=D<%@-Q3-8ywqYR|E)ngz^zTp2y5v#&pJ
zO+ZaT%bcrm8B2C=os*4N&Bl-1aXU0`PB|Rb!OZ<%;g((52dPG#yz6b*^EDSevYf<V
z-f-@Z>XSn|c6+4tw60M~JW&v_?9G$zyv)wCTt$aB?9w=J!sMRbG!Yq@2g=qFRhk=_
z%Wi+*m(6kFssH)f{#i<M-cF^D$vh|Rrsf`6UurO)e=$b_hdSFk%OKua>!(J4EZoOh
zEIP}nTuV!(WA4X{6$)IOUwx#_gf_E?Oqi^{P)ucGt-$1;(wf}!YqO24Yi6}poOJv6
zyqID6u_l8S%U4N)!E9aC7U%gGjb~4OT)4i8bK!R5*mq4T(qY}pKBsNI^l{zSy1W#<
zwM#`-gnWL{JBQt-nf2iu%|MsH6%W$4CCj@U`}RlYm5zPquBA0DNxGrVQGJuT56Ldu
zcSTBC##Pc$?7<UH$-6%u-CeHRUA_5!?7cfn?%%z0CpBeP*y>})1vjwmifWI&lkxW1
z0nQZ32_E)Q8J{H-9?waQd}e3qmeaxg`)Pjt@q>F_as50~zv9Xx$+t=6vsAb)<(54E
zEBgN9?ZtmhLkl;ZF5_p^nt48RnxOd~XEAk$k34BV8E+Te4R!rey{=m~>)WPz#*-G@
zRcMo*7Jev7D0%-oUw&IVYyQyX6IA_!uWC$R7VPxUGM^#%xs0KKyz~zl(}Eu+Gd~|U
zt^76TzUunWckllG+x;YTbLEV=`LhLXZ@uJ`e)1bv(!Rsn(@k#AQ(V75_<~vIZJ`67
zN-pg#HhL41dZXt`O}mTax~2A}S=?6Q2}esd^|Ic&wJ^BkWJj;K$SU<y%a*dwnEody
zB<$TAgG;5$5~HQ&wATKM>AQbf;=kI*(mh<YP7P0OTi-8?(!QhhvthxUHibD44y1hB
zuvq%;2mR399|SMGxG??V%>OZ47ld3;SADLsB7tL0rlsZXUoShps2g7LPqXjW`<|n5
zpuEE2&|Y2To9}$oYyCD_GsVb%%5Du=I>G&|sg3j{D~D_Aa+5tJ-bQ(tME7Lb@w6<7
zUX(vEmEA%4g}bL}#NwQ@$E4Ejf;X@Ia`Q#Zp>;76xTalM-1_g^J?R}cyl;e?yubL;
zYkQ%!s<HGgnN8<qj`kkuoVk8N|5FLM&e$IAy8>##?9+dD<%KKVxoC6g=ncp3UJj0q
z8rEMtnq~yM3%!bB-Xq3+cW1y8n?n)LuNqHMalR`QdWdtGU>AeWNvG22?uM1zL4g&e
zyef{pmThNtsKz}!I73Tp7JtWEQ&(fjRXj5m7O<3@IiN0b;>q5|n?25dIo2)Y7G%_s
zj-A>gpyj#t{dDh(p?bO7mj|zE)Z|Nj5xnGy_TIFc;pXPs%WFe!zHp1^t$#mz@q_0t
zV(x3OZBG9an0LWlBu+_Z15a+Lrthuw`Wcrj7B5@HJNMOEw~{r@6UBuD-F+Yb*J<mo
zHQw>yUb^ietF?xUlr`l)I4&=Fw%xh9{?q=BHzuqs^>0@;s0A<b6+5{hdBddd7J-Et
zGnB8a-C!`Y|At@fWWRvg$M*Hwff{8>=|;2P7P4J`tI4ylT*7?P?cL$!;o>Q)FTNFe
zC42MN+12mw?fKVxH2b*M{*9B)zT}hYietO^FaBnkmh``*9fyxBnk8$qER!){HIJ_b
zV~x`z2Fc=P&axMqbs0Av|GetbYlayir`@*pdmVSOw!c%M!{xDc(L%Ln^S;WOGRmx8
znxXXXvP}Blw<c$#L%%ea*sC77oS4U%yH?BD(Yo)i<%8nR`L5|J{5mXFEHeD|<KE1F
zu6b|0yC<f%eDK-%^BhOM%vG67-SZ4eE<Vj#sP)t=WsBR7RdPQASi9#0-nmhwnt4Py
zH~D1biQK8@l3wSQx;3Z%4_x5UV%V{LYQdLB2XeHFLzNUc+1~b?iqKfNqkWf1QhQ8U
z-r?y{!3^u4f7#+_D*H`ls`)c-&;MF&nS2sGr544@RlZ11TDMfP_LuPOWsiSu^fFAh
zKku|;@8Z?hpZNb^`|T{-y?BMJ@5$QhhA($_O?C3P{Nen6pTw-^XT<+!T|RFTQoXbO
zc_aJY<%iegI|my|xtQ0#TCKtBxzB@dQyiDQc<P<&du6wB-Z;IX=ZmF<k?b0QxP$Nb
z<?c-Se!s4^@bkM*uU;$jFFpB|e|vfUI{8Bn4FZ<Obxn8AwYu#acQAaDQ`DzT*+ubM
zHTQlj;O6JmJF{Wme+he!3&r_{JVy%EdbT-!l8c+y8ngaFbL`H)buCZlmcH1bF-bFB
z)AZXs`%km($^6;tE~oWJ#p`?;Pw{fjD%Ck{=eM30y05I9(p;guzGbHs+w%D<SE^oC
zwO)02zx<`e+HC>*wEo_BGoPt^9@`$iQ*99{Icq}rrX8)RXgj3nbxNu)pdoVEimB_i
z_s=&zzf)}X+W@&|Z+Z8Ad0Be+x5k@T+q!&_H7{SWK4M6epZ%p{(&1{sS?|BhEi-a0
zn*L=Cd&2t0)&JJjKAYB%q-%5Tx=7f=LdOM{Z9nA+e^NUZH$&n@?&89(N9zMrqqzQG
zW!vjFDZflUsYaK>?wh`E*8<V6S?<nu84(g2;~X@lFLZxez&dAvSc^v9g}bM|=1p+j
zpu1(erxX9hp1GeCC)&LE+P`&DRF<_<#+M~5>p$;1>gKu9;L3s7(+*5J!e$;j@9}@*
zf2%A%rSe$aXx$!sqo_kQM&Itj?4pQe>?*4wAEx>jte)0eu&-xI&9AgO|6|&<DmGqX
z@N77<t@E3%iT!Wo`qgW8@9&U#|6abYHuB4d1Acp5A2j^XWw-A<k?8;8?_G@t#(NnQ
z(?o5rFTSw-5R3fp4GWj=kUF;@^81x$2i3YeM<!+Nwg0Xo&ZD-dapkP9kG0N(F5VRO
zackxW*9UDoc;9!JUX8pTs*>D){QI_T_0Qz5Hz|Iu{#&N_U`o8uYbU$8$Jd+5uthW+
zVp;O`y6o0-^4~K;zlOY@xZs`8D$(jE@+<A{s@7&)v0Ew;E8xMswpr!j^c{xpxg1^o
z8|T?R)!<3LB6-v{N<!JJF8W95@7N2gH1@0P`Y)N8@xH^wUg@Zk3TtHFi^J`2OYfy^
z-Bf9EYf)3<nslZ|3ad7LYPjVwUHqw?sBC)h_TM4f7tMRq;5xgzd2Qu&xi`%ZuYWxl
zx<IdZbLQQDhc?AtE1I7X&XlTmUtN32vCE7b3$NO(wOBA=)it>Ziqoch$wyjjlH~|m
z=YC{k`mbw-Rmbb4O==`v+JDI&cATHMFzQ&c!^3OG0~X}<zPGQf%Smi}Q2(zcJyj=c
z`7fEzw@PjoM4LHq+<YgL8@Ttz(lz#LLmL-fdpBwRu2+F3(YGSz_b2X~UsDo);n(q8
zvD%XOcfxi1RTr@SxVpaYyHv+tlUuzX@80;<^PdyZ{Q#{?e8p*WGeDYw!77J=K^}F0
z2BrIvlvtb!>U!8_7e6+ebpNmRhHva%lCx%?eH*&8q;ON;+nFz(J+!>N*;;dcx9j8y
zXJ#mgPTJ)D`cwV>cgLC;I8J@?(TkpH9jdB4(P8n$d=se;a@O_re+vKm&il0K;qS{m
z({t@kSK21FpH|uX@b`U}`1fx%F3#Gy?(<LI)BAq@(*M7W|Nrl4v3Cl-O*0QYX;gQ-
zJ8NgdxiwEuCb3t=+<C$~`zdRBX6QE0II}gae3JQ<x1L>Cx#C&nskG3uKbB9so*H!E
zw5mR1tI2cUmc{F4ZHto7m6ll1)+XApN>ZU>_L<7VlV)w+)3W{a62B<F!%PixBYF2e
zuGp3pZrYzbO@CVG-Azk$R+~Ah%#!`7(fV`c`>7wdXs~Si709<@TWIJD_P13trx#B%
zdE?Y`{Pb0)-V&z!s#1YV<n$8k6r&ZMcKwOk>%01>(1mr<S9Mya7fzh=+08UCHl*A9
z=hvfEC!N2ESxlY&=fyH6yS64x_4z^jT&_5O3l2>=S$fcaeSPE2mN!%8?SJ-K@qoh<
zwx}Z=!WYcqRGwC)`<tEfRyeqc&F<QD&%>efr`tGc$ro2lWfI;LU|V(keR<g@$=w}#
zb#?VZ@_$Q;zEu5scQvK`;PJV&^ZDFAHQt;vy}UAZs!GAEE59b*EHd8aZf>*pui(7d
zvFpMsC$4N$u4<N7>=F00eeQ5LbEeqp9{J~`!cps&DIA#Zbab}bmA~f$p9EFJseiR<
zng3PGRc6!YtkC5bCe5wMdac5GiPP=i<nTRDG%iXWR0??9c+*v(!^W@BNuyur@AvJW
z7q6Q0^mDQuGpD10HH$*sY;#_dkSnfA8=CuW?8*3%5`4O=;LgpPp503_Z)^;@yH#w@
zMBVmeMm-Luzbg_;Cz;zMe>cz2xK-7=V!NnD!OX~O3{@`|%G9{ou{=%Ky?b}M#spq2
zuS54jRj&u9{5H_hkBl@7$(VMpVPaComQ|rMU9aqac3R0(aOL4`Yd^mZJ?;NWisxeO
zy?Z~N@i24!TEy6rc+zC*oOA=vhCZ95S?=9hk1cLLS$E3#n4rN28Megl2^y=78uU9w
zp4)DkC!^XDx?sM!&B=&Mo2ppZsuiD<dmR5T`J-gSp*?4ATgaL2nbCXm-*=Y@>v-#?
zIXskIEq<aT=HL^tpY|uyjww9jZRD8wb&rF-L85Q8@SE-zzW26F|M2;g9Mh4~(CKeJ
zoiaYRDt28|HcM5I8u!1S6K1n4+bgz9@!-Aiueo!cnlkdvO!QaNG4Sy;a8R=p+9#0A
z`RkC3kbsEiBZ0j~4;}fvA*Q^bA@+w|)~zLZ(o<Fh3LHOpLz2_<h~WN<702t|Uf$=x
zwQWMS(5r+TrD|S%-^2s=@7^eC(-$^ik<+a|eS5Z6w%dz`D#xnd6tG^}^MLc$udcNW
z8-Gi0h*MZM*JwTO&*u%%GtIl%N}bKuzT)}kZ^zkUr=Kr<<y7{)El!&J_Azss7`cQb
zbQh?<kKb=)Rr|f@7ni(#{`23OH*G$Cdhzz*YvG!SdXu8%N^WI7Vqw;K{YuZ>c5mF|
zb&S!cbXFRNaZKh-WWKS4>kw~;oX7IQN!MlWP2X;#yu-e3#=f01_8q=>p?gc^%45I%
z3k26helnT=^}zJ)32M)@r<h-;U+_80u}mN;)O*YSAFCtH6?C|~1${ivutc7#x7%+~
z+3noD?5<C-l0wA~)9f(sFWe2*0^h&<QI<H^re0d*{2|Tsh2$!?!w%*L_JkYcDzLAb
zFY)Bb<D)kpp5A<TyZV0%+v?utiJq5auP!()@~n|#MJIz_lV--(FxKl9<vo{uMJ5z`
z>M^P&?l$;o*|SCaC$~w=;@b>6Mdzpmd_4N{rSv0n(_6={b3O7lxO-i|^d9p=X}5>I
zv*Vw$&R}mm|52KG{+bO>UL3AwzFD$0N5`<bzU0R}fkP&dQS0yf)c-ktdwMK$!ri|~
zX{JB*Rafkv)x>p9cj@}$@^we1-+Uz%o4CC5#pU~qKOa7IW!Wh9PmcBPcSn!56N^tP
zTRX6nE@S-f_Ev1ki@7%$<Qz6!YS3QDps{Sj<8O6S#1wXW+^95Wbm{v%MW;k#%{|db
zi66N$_a9&pnh@8hIKiRjo0&p<+<nhi9tKzVQ&>W^o+@Abe~GP5HSPW8wQ-L-za3;z
z*pS2>l6>JO%fg8{${#j%_SRRJ?mV5xweVWVkFc<(`~Ez&+UlrMuFE2RGU|oJg7!i`
z)7x1a?rzNf^jFxxwq4Mz#icRA;>ErTwwglQvRyj@HCrmh8fxoK7(ZMf$Gm%D%pxBN
z2I1E;mn`UDsG1bME$XpR7OVHslMdMzjDNZRShx7E(*9C~C%!&<B32yJGxlCJX}JDt
z_g$BD*-5UvvWFbRIU;gO4yvAL>*3vgH#z;J?d^K!d71lP%;9KVE@0W{GetW>Pn%!O
z$F^fFW0KY4mF?$FFf7stm~x;y-K?y%NM2e(O2pLQ>*s}n-m<p;yI(kS#_C^XGO6NJ
zDVlDpuwn1fpn|81rGGA(5%#}|gL}*R$xB_>AKhFqRrr$4J6`GLHD$?VRS%>My3>=s
zYHn#dKPmL$tW%1f%~nl+dv#o<bY7F(A}4y`%t05XWgM%W)eFLRH}dP=G-q?3Rn)##
ze0AzU)+(`L-q{S^OK<h4=|=18p4R#C&hdh|+I^wpA9zDm`{Zvnhy6R=`DfvjcOQQ*
zkmiyL%GnzGU{#f)&sGM}j`x$2j_zLP#gLgbV+P|Y^Ph(P+7tGlswrcP**9xPo_hda
zq0G*Gt_vLhI_9|_+#P(||HZpgQ+UhfU!T+L{p;rwn-`MV-1`I9TfX4qexh@!G^p>4
z;PGQc4B_$1I*mM^MCLO7lY9Cy$-ml2;OT)05~Wc|?eb?{JyoiFF6Fs;u8hg{Fz?^N
z5%U!pUca2b{GHUQ{^Q&ZDmTunZhOOeT7Un{nAopXrI{1XZuq1v|Gi}P@|S5lp4{&&
z%lZ_3DNAd`m$&a7Revrr*Nu*uyr`n@#JhLz_C3<obxYAdoET)c_UP0}8#P?E&)V+D
zeC+Y9bH2&5jysC2{pgY2t{hd$o%?#_HH$BoPW`PhJ*D*C=J=7HKE-iA=Wkqn;g<L5
zfVV3RG+Giq*ExL)Ich2G%dkaF>FZ&pn1V%((r4y;*<G>o{@%A6@6EdtR<nKjt^com
z-W&Yk>64zjJ#qU7$Jw!qo(AVOojS0_{ggiE1s$=D<4Ngk8S^3}r>LAhQl1jzo%zM1
z+%Bg<y{Fzw%v+}F-lt`E*|}UZwS;yk*?xG%B<vz5H?wiMZKiU}8{a#8(rZ`lSvyN?
zT4YM?>22!_Ry$iqX;@u;JUNYnGucL3kf+Mb-OtKwleL$--Gy+=*}jZzHy!rBzg@ib
zU)<E~sipC3W>TkSr&iuwo|2F=bw+lydgSXvPUm;9`kr~FSH3gz_mzE@T3EB#6(r20
zm`~^)tbgVySpLn)>Ax4hLb&TP-rAs_y;rAP?T@n&pRvS)e_CAi*E72(>Tv0J+OM+A
zTduZX_4j4HDu1uu-sK^3#%#f-M`ejOrE(YRiS}zwm0Xj$s`|=xuXhYf7u>l%BYWpV
z(}+uFrdca7+`gZ_;6szomd}fFfAr-)TeVkln$dJm?x!#3hrVHM7H{Qs4(fE6lKs;-
zWyjq^iIxmj_Tk(7x0W8->c=G_pnNBzYV+nOE%wx$gEDE6dN!qsLdW^^Gv?M!zEfDG
zX)5`X;n<?1Ilp@D%xqJ)G+}zopxoD~a%1ze{p$`i9omx7c_qQ!<zz{tmga&+&ckyL
zaPzU<6p>ADe&mxA+<CYAfiq_l>$y*}Rxumh+Vg(3SYi9^*<uC>JbgRYH+*22Yv^Vc
zJj1Ms?RhDSz>C*ULo+&mUY&Z}m+6*6?iaHy>$5^t*0^q&FyXZOEuGcNP8KqiU2IZ(
zD-hoCM3c>#W8;)KzRSB0h#Z@&#?JSUPl0c><l4lDEyvTAYSb8*>!~bjU74AlvUh>^
z-bXK3qpCMQwmbMj?I_FfoYo}Q9G;tJymBrEd_Q1gA7ARTNF(3V%!WmHvZQqAk_E;!
z3!NwYn{==%e^E-OM*oA~JFW*wz2KhlP*}VE(`3)Ni)AFPNzF8nVb{-pu4HO|<4As+
zt9lPxd!qI<Tj4D}e>-@N8UKFuk|A*;U&148o(T$j3R_HnOg^~x>aC3|`&_>1RD`ee
zyK5)o8KJ&)iqNm%zY<AX9jX>jc(LubO7KY!>1unP*LIsUHe7Q%)N=d~@0YcmlA$HP
zx7XQoezOpJ)aU9Fc<iUp{*D_*bHDD%dE7j=d45EN?YAPwBA%@Wji(l+<$NiLf4b`a
z<nz~OmY(W7*dcM%_s_*S(qAPuPH`7nyX51uwi)Zs_3EtCTK;kCzWpm18tde@mKAd4
zzp<JZ_wwA-d=BOO+P=C?K0mj4FTQu`gmuH@o!6RgoEE4*e(;X*hoD=w>Hkw3-bCtr
zOS`&hk-wLwknS1AsBWpn6_abeunU$tyRmP7rMbh%DClg~$=4SxE*agrpCrY4YC+Pj
z&krwpcCPMt(Xey1OnLnAPpa1*Ik8T7(Z)Z;izom61WkiYVPS{$o>?dSz0;nf<T`WK
ziT7o~?#~u3{Cs5hd#4Yx%2evVZ8x04v#Rab;znEkjFtPWO2QYlPYJ*ORxL=R#4s|s
za?U)1TZOy!PA-yMk+x;~#n(B`W~}ALA&Zx?<k%Q)x1VzJdRoar@u}CWCIocY|7Nok
zNL=y0cc)nH1%0jb#Jsr;2gM(k_FLN>^pA_Se#{i~;v-M2{*m87Z+AVK;;OFwZa3@c
zMVA8&%4aA&Xg=!GyPLO3`q7OqiWe4jT3_hf!q&epVnWtRlS|td7HoJD^Zr<w$BXk0
z{EZjve))aKyi>fi=+dl%%(vbD$}Z;Xv@P3pBDy$K%&={z^473ptb%&XSNvY<M?^bx
zzu2|t)+xS8ED0@kt0%3ITXSQ@t<55?W=y9~%=N7o_w;|W@~+8L=OD3`t_`}<OXuy#
zyCE*|>riP#O5Y}r$A&ZB{%KB6n%9!n%CT3*FMg>tn?u9=8_^u6X3RL>lGHo#aaeGO
zZt-(Z2jjal-d^Xih+V9xF!%qarKcE;SQflzt6j81b;CK&Swi_GVZ49t=6-)!6~f$e
z^8&w@`X)ZM#{$gr^4_wm?ftU!M%0HFXA}OtI`BuZ?2gTa`%B_3G#{Im(0aA;*P^HY
z99rd>XVpE8;yCZL?ETiQom)I5s+Qb$yE5_lg{fyR=x5t0^sajH-qR(+K)Hlz$%Mo*
zuRrGh-U_{Tp7i<uOu^5eQ)dcF1ioC6roQT?$61vv6E|}?Z1@~JbBeXH^bXDXqL8&+
zJq`z7gs}xbbnU!Xq;Pgok@h{6PLJJ_zgXX!#_{N@#k|QT&&@e?nzqNb*&FX|n*5_>
zn#<EjwnqXc(_?M^Xl~i~X^IoaqTA|`ZU+Tr6@#a8>ufZ0*SZ$y^CsZgu{_U1P0MZe
z{$LTyYLtHeEzPK^X;JdT*Z*DS?dsfII#Z{}XXE<2GycZg<O>(~=v5oPT=byD)I}xq
z;fg2X_SJ9RR_$EYRcqtPoL%!lVC{`}9xe;!#)Oy09B?$P-|F@1jOd<wLBCnAMK0%D
z)7Px;W5Rknl=a4o43}R!U5)v6y{QaTxBd})X%BPB`ybglnKEbC@-*(3o+@)>ecWo%
zu_8ywO5$;0Pnx2bK&k4|r@d`b_MO~PO0Pvy&dWySE8DCnyc3!|`7EE;B6c1B)Ck{?
zQ|`WBe)%)E>%qzX(w|l@bbj!#=C$zG%ZJ@3n+ZO7871Fbdw0V{fxIjobMBCPiA*Of
zt5(ME7QMJ&@}<8#Y7cFWUd>XQF=bM`HM@@gs%wA3r&LXz{Yi8}=d$doxWfgr7;4;E
z<}m7=z3<1k_Geab<d&P~+8U}iRQfKhd**W`c?Or>0$Di|f%s`_FT2`YS@h<Mg7wpH
z3)&r5NOEiQNEl~M_L$4S!oQ%Oum3~F!Jg|I-<Zo;H#Zngs+KV-m!BIi6X(;vtEcHe
z(-a@m%KEZTpPuO0{eSu4&668XW)vSe%ph<ns^WLE>>-cM(fjtTf8`_p!a>1Clh=Ir
z@nyd2t$eO%UtK*ZROzXb)11_aTM~AQ*}u5A?c46Er=e<AAJ(1<F}UuLzT(T|iD8<j
zHCk+6OW(?Rtp924Z_^8n#eHI*OMd-6@axc_pZxO{O7@g(RC;{C!|&F@l~e9L{1o%z
zU7ozez38&{%kI9;UY7Jr_G(Dg-CZT_`zJ5!zRG=`?Q!Fw%a4O?a!Y)l)<h&HCH+7A
zT=79?m{p;cR?Iv{nMjk_-iMkFyqhw8bJlLTdf{tFEZ?>nM0Kp#ba67nHwoGG6HNI|
z#jUuzob`F`;@3F`W|Uv`77@D8*;{8hf3KbiKktuh4HiG^wElhBo2uSCObQJ9nwhgv
zZS|7PJ9q__&Rn}v=){3LvB9}^ryJ&<t&6LDk-I13nefET`+ijaSvKo@;omO3E%8kG
zr9x9*9h2*_`B4xn8kuhU(WgZr_JfGdgYPHo4j88CM+huT{gZInXU^^8v#xc1TKF%(
zv6e&ckNGdJ{!E>?7`9ac2jWxrFL+$kEOGL(iJIMpYyE#-Z%n+tv*5$$_d9!Z{Mt37
zUTOa|W{dfM+j`UcYl5%$bhWShduYM(sV=ovarGN-+<0KteNHTU-viaT*QQrY5r{}&
z+gx6wekAx=)QfEmw|%))Eq*OMb^7Ad9P^3?{Rh|W=xQ(0=t>QLys>`WP92Ny!rT0N
zAJ`vA+>-EQo6D4r4V<o>^W=BG4e>sg%>7kqM#Z<PsC%le^Gc=Ews24J{NpdNy*=^i
zq4R94hc)<Kq_|bJ{fgN0p4;x=v~Th20`7<EdR{WtZupWbeSVKb^6Dhs85j2L={Xd<
zcH`ZqP4&CBJ&*jy-?GSY{$59Yo5ICG=9P+@Ll@T>C2Rkb(0F-k%GMXci@ZZSUa3Uw
zu2TCWd1=|_rgO7iKHPYEf=r3_(zh+S!A?oVbCTb6R%!XSbxqtg(OisQ^Sb(r=f^Vq
zD_n9-n5Pz+-CgjQ@o=5zL9?$C^Nrn}+t(l8oLg~s%CB`Mi?xqV(k?dm`zlRnZ`SgX
zrd_RxuHn&7-}bgG&6Al}`d%>BW6>rl#oyIID#r{KztD?(_UOzNiRPjw>jG=nKisU$
zB!0?v-ZVe^If`1Zp4cx-`Vz@qnAqDpbH`_gB-XapZk?YOyT#d@;u#y(%WxFsNJlAI
zJFTA8E3kUE&C}m6_Dm{#qWW3xw?b#-^+3kgw?F>y41IU`a+uoX#;jw(tJhvU*YNk_
z<KvwgC-d_%R==60clna)&qeFx6y-d(taSOucHT@u(N|X5(v5+MS;j=+)$8N+LH#dV
zHi>@hWBYZhz?#8%dW@z26vr)F7pFh<5afHX-@eMVw_sA=Vq=>p^H$&b^lysvgPnnV
z7eaLAJM)}-`YBetK(ZlYd+D?#$09q|PI5Yb{?&|^6J>L`D~-CZ>dum7c1(45-g<D^
zTVpwH8<nyv*HyxAuF1-jcxNdw^LNVK7e;!sHf~DQ+gCErdCHm#+Ph6$ef(pXGWesU
zN|&Xjc5BI8{CY8B-K_K1OzzilE}CrDmT;@1IKcia)0Ty21M;nY-cZ=)r&g_RQd(AE
z&Gn*KFWH^rils#23b&bo+{>jrFHH&KUAHUOxnIF`>A^#x3Sv7JNE`5c>K5L4wdPv=
zo9|Of)@;waS<ZFkyN>7ORp*}Q_TATvxX<lvoO^e2z$wo|;VyjdH_a418N)esN6%X8
zhl*QX@BODc+jNug31{B2Em0@5pBypU_-*!uT_;{X+w8G${SsNGWfPssdcuCbj#Kdc
zdLe63+si#qUsr6?3jTU-&pZE^*-l6IN0{6{$Wpy)fwb`Hot{}aSHw#?C4Bu2k58Ji
zE$(}27~jIcLt3xZ4$Yrf(HieQT`2qPcWw1PWzXXWQdIfg=gM$gKk@C*^?55Mm8fjL
zc(y}U{G|F#iG+jw6L}Bh%?LI;&}hwJD_1(<%%iv-hYGRi!!yq8zfutRjJG7FP~v6V
zLjE^5LXNcM-MM^7c+nXdjh&L-cXM9XtURae=)LO4tu5cPbAI^T;coc5dXuB7-DB=G
z%{S^l&)t<GaN*BB>lAH&v8L%eCtv?*I;BOh^|Yyf-chrN=1_UldE#tK*PZNFvs&JB
z+;i%D(X8-Q-HcZ!DAoB!Ogo=8$8Y7TbDut$EZ=K$OXI*p-<7M_T2+hJSPHtz-94+d
zXtLI^Z8;1lEZM{qc=<Oc{6Bm6lcB=h=tmpaq|cnT$!d;W<aGYQ$sZS|G@Nc)@Ni<v
zVhu6g{#mnJ9-LC<HG1(=sWYIo;k<a)%X}3P6`><4&s_{Rxb!G2Z4$V<d~fn6-i&Vt
z*1KI_kXsyg>c+l<CuBH04lm`rXR7s4#C>b4I!on*ZTELv3BP|a+qm|Z&9dmFGY|Ki
z-yL1$BNrgrH2?c6g9SIb4kb6dTCuTo$If!m*H<UA8tpCc|0?1m&g}Q4u3-IK3yWu0
zcst@|tXcXy;`phhQV*wP2z|@%m;Juy&C-l&)$LabRu?w?dwc$n;NJxcPB&kD733<{
z*}T%q-p0gTD$7}RY0Gbge@Ex&x#~>$Hnn)NFQ3iyhh5>xTNNwZm`k@W(EhxGMNI#-
zP3BJHxp#^W=cU}q%3^!0zg+(QJRc2a-}J*P-wEgB%@mChRX17v`d{QEzWE&DcQ&kI
zek#ej=vis#<=Asv3u7P4yw&^k<MoU6^}YMdoFaGWM;UcbyS`%920l^u{Hs&fCutce
z9M;}wT<dES`#WgmY+e<ORkmk?U%Q1rDtHpaGvmJc%zekMDi;Tq_pi?1c{Bfh?3-83
zY4=`NeU1LGyu5$k$)z*r`v%3d3fXAcUDQ+MSa8%OYGGq*504z5_ZH2X+b6VQ6Msj0
zt(?!pe8}tjGcUux-}CEVzx2LnGrioiwEl#XkbM57BjU2PQhtJ*w~kK8JA5qm%M-nm
zFa5Z#`X8Em&c^m>@5Ke2k9OS@Fs{D3_eAgot3B;)hnF$m-|~U&ZKrX4?X%!YX-5Su
zlXp{mcPshlpDw%2`5<v}_R5403*YFiC`&h6xWx9X{Jm9)7iZYmuw^}8Gr!2pWbyj<
zQxe5ulV|;Ts(yHKjg*1D$3E?EhZL_*-Pi9ucbD+l*6{M~oo{TnJwH-(Pv&OAx8FBK
z<0@jK>W&*OTpT=6V%qHbqUL`#&4m-=d?(J@SF`%Ju-ulZ*F}Y1iBCWFXI;$MOAZs+
z^BCjoj0K%T1*Hyc4rp4~bZFbMsJ*H4?j8EXZK>E4a$&}zRe9155~Tsz-OJ{04PD$e
zF|p0<ejJPb6Scr8YNz+KdOVz8<1+j2swB4Qj{NcVul_AEQvNW-k>!TZJkE))Woz&E
z7)+E}c`Pm?f8**kRZ$h+`uCOj1j*J&`JSHXB4hjZU(i{xO3wEh-|Y7JSnYZC`rs7j
zo6nZsQ3(Ee_gp;d%WYQYH51Ig9oSnv*Xzgb_L4#l-w+3Z`n`+GRTrFN$-U!R@AtMW
z{_uRAXaCN;4J>8VSh%8~>fSkxy+8lFvi!Q8OJsAMNWIxZ?;Wa+e;98r{kQDM{t5BF
z&PV;>5AbGY5n*6p;9vkv#)<0$nVG6GFf`0&U{Js}8JC}5Tmm{7r1pRLZHvAi?|*8S
zOx~-$d+SuSmu0&ueRpS0KKCT|))&*4@7_GEu{yd;)^yX7sZUh))qUDu&+wt!qifpK
zb4y-dzkWl6qe+2-Nx>txDt$g*z4W{z$<wCgRM;eDiuxyqy{TlcG})JQc<zIn$CiE9
zJ3ZaiX7{Q+bJK6{K0G(w`uv{H+RtheQm0i3mmQv@Gv7INebU96<m9N7Vtt<F-C2Pf
z48A<7oF_U}d}(HwYv`P%Pmi@}XwUd#*10NUj!WuEuSk>FC6BdE3xx*gezurf8TfMU
zXSYu)c6mMWzIjOfhvqDPrbr9_O_7UvG~2s`ei&)ZtSLKDG>u97*y+W)4Np(J*I2$y
zN84<@d}oz#*v3NDY^L+;7E4|@FaPZN=E7-yk7p{qulm-<B~|gP&~jS9)zE{BJSF{<
zU({@53G?0i`N5z0^ZO2!@0Z*A`}W7<@!!mBestJv{BkU7*@>dC5JQ2arlYRYE*Wqh
zSiCEPx$URP*SyCilkQHtx6Zti+wE<&=aw^Kp)XxoKc8~#GrgI@|6u+E0iPQtQ7Tgz
zK3AEq(P&J~x%B<fmNko19$uJd{^j47Z(qK=vH4R|Rkcra`QsGB#OUdfVPS`Nf9R{f
zT_qIrbSJZ%8~412GfqystRs7C?Q|1A{>)#Dyw6yr<Mfg;-WmBVW|BBFGup3tO6a<2
z*S3Ao(mEEtzJ2|%n>PKzVSAqWR&5XGxzWr2y}W!|oK5>l<BuvA{_WW#$-jL*`)%pj
z4d0T(3@6N5@hLB{W!)xMqmPT0oY}+Ww*J(U1&X!BGwik>jy|yc>0jrbuk+Y>g%&<s
zU1=7n^5$zn9P7m8wN;*G%VxfQTfM%4_wtW-U&R!wKhBZ3y8PWvJHIEBRXCND<bM9z
z|Ht#^{tFLpHmR6MJ-%}Ilq<_#59Jvf85xc*W&f{t(<16X59?WG{>t1(3<`Ug-X2)}
z@Q1_q$rgLREsAVWI{33mp?Jb9i}ozZvmb;^F6wBht%zH<DS8F_iVbNG<{Ccp-Fzsy
z{GyCj!O8urR@LNZzy9{kY{5O&NW<H+Qj$~Lc5ap3_oH~n+5O=>Dh%^uLO-`~yLhB_
z3zfK5FqgPxhO+(GVV%_~aHOUtR`lYG+(O+A8W{_m1ZD`dmVR<L^QD%rYfBz;ed~&j
z^^dvgj$}rN-j>mQRLj)$*jwtpZKctNO)pL4jt450K0G4)Ye9><+}2gS=S;kXQoe}_
z$4~sLs$*ktt6D`)y>QnK=0w|+=?9kCPPbt-SakUMxlak!6(5_X8FW534)~HC^7e0>
z&GH2Y&O5NkPF^l7H>2jlblvxNi`eFteeYH~*%kS8-YkV+R=x$*W@gbHa|#|mJ=4PN
zXfjXPl79)ymX!F{ukWA##<FCoK;E(S4qgF<F+Ay$F9vA1W_(TG9J;r)ygK@ax1S~p
z-~7a4`9+4N<x|hzOg)$v>ueIaXj1JiC(Db@>e(wD4<_6^XCt+^O85VQG6#9dw+`ON
zH~eaP`J`7^Of=@Q`^!tG6Yhz`l}J{HnrQEp<4$X2=XrBEi1(0XW9kM&<<kuXhvq!p
zbSC^vQGowBA(1D%kEJF_E1T&4)OxhhWLHb6=!3+)ds!J`$_v??r%w>*`=_hO%<J@O
zPB|Y>R}P=Ox~f3CMxm|ujo7=bD*Mvz`5$ii%w=M<Tl(Cw$9JDMR9i4M-l+X3{NQ`l
zipkfrHj6*pytXoI!&=GJS{eE*v7OsaUt^kb^+Ld&*+~l}4>>VUu-LOdZTpTrJbP}O
zt-Vr_pgJ{FkXe00eN5}YS<S0Ot|xiC`R&@s+&YD)BXBz3y$4LqDUAA?q^0%*=~)~)
zF=3hHr;cTB{k>LLEY3S-pI>ZucW+JOo~piSNBo)jzXVQst{|K_Ri~5b=!eQJEl007
z-`b-wuldLV(Sy;Cn1AwbbMihsD|qA0NgDH=cy&ZxTj)(>uf1?HMdo?JyoPv2p%d0|
zDF=Kq;~r^USbXo&sTgT@g>-Yd9znjNxA%RQ(_ra8B7Jz1So7)wksD+y)FaD$O|Hz@
z%hcKGdi-_aYi}I~$9ctDcL-O!Z;Z<@*eI^DkgvQc_kF@4#aBnUo(cV_Sd>u4;2U(1
z=LjdmwijM0yM+WibtLo_oLD1eTqQ5eZ=k@iQ;p%<de#jbtSnYRi>CB!Kcy|<GNW>h
z6nky!Kg$~*RV|{NOn7HyDk)zR;?Zza;MsHCx!7otRrjQ4iY5$~XC>ctU95g^<Kb1N
zW*eA~g?m`NKe1md;TXfiq$}oT|5p7hX#90A`TwnY{>9vv=8GB_{Bf^umOEs!%Wv~-
z5sM>Jc3%y?|Le|WNArCDit_r<xWs@)>zOSrA}fSAJU`16bN@Hct72lc;Ce8L>G^7d
zH&b<H@|mn*&RojCaD(l`{1vV8EPMiDTa5o1%4di^-1*JB@$BOD3iEz<Y`wl>)6-o0
z!~Xl(`h!{bG3|T*S3PvK_EQU^)wdKL?3<jk!szRM!Pf5w&9kKb32m#se>X5@^OmTE
zE1u?O<mg4jahQF-D8`f;_<3`})kO@w&-ZU?%R2vi+4hq6yzPrvZr1(3m7%oq_{3`m
zZS{Bm;ZpK`+qgizwE2PkaaGHfmovU{R3&tGn%$G?<&ERZ%6w71-lp#i%L7-I#BxcQ
zt;ttjSggLeWU<El4^uhSJElDKeScZ#+TD=Zv!2X(-Xm7^QnvA6uW)F^ZsEYGr>D#O
zkI;~P=d^IPXwDU}D8I8UDZ+26#rMU%;<x!|9ed{UQu|vEZ0DYgYB1LMta7X}aD#)z
z`n`vqS6S}qX!~Do@MrzS%XRM`-Ta`xSiN@t{)H0`2#GFQw&~SB|DS2!(tf6WQmdc5
z@8{(E;U6w2s@p8$bNBzRQn>w9<GIaplC1n90-`w@5(YOHFiLd)`2UK*Gp{XGL~q?4
zM(LNXpCvijo%w!UD{&FN8JKe}==Vz*!@1(zy&+oqVjCRJN8WJjYMHs=^wBfCN^JXB
z7d;J(R85Irw_<wpUWU{ERC*lC4v5W|&J~pWTRrAM!^PyVX}2C7W#-`Gt8YmV2wf`U
zEL0<OZJzv(Y3q(WjpV6_{ru?WiAD8{ZQo?IeOJ8Q8(7?MNNLy6pC#^Xr)B+|gjqAz
z>{ifI|H#AfYJJ`cQRZ7~R&QKlE+e*7<wNuO$T{D5L~5Tr7dP?Qz$y1)O7{LISzFIU
z7AH+e-I@Q%&!{}ZSbS@X-E0-6x%)3jGMgzl?{j&+_&KxgzNLHTc07IG9V;Q^n{qBf
zHZ3TskSi=Za*^v2;fWizr1K=*uipFqt%cO~We?3G)ZYJPkl<9C(#iD8(m?fbQuUSV
zoHikA$~VOtx$|nAIAp&6On`m!XPtj66aO^*Ikf&o&9Co#x570Tr|pPVI+9&D@zTn`
zsb`|{7fXogEZ2?D-(eN}L&$02r5Wc-ctkpOY<m#g?7Gz;>(gPwpS4{ZqJop>f6uX<
zTq3Hnm7imy*0tp=lL}(Zb6%ZeDQkZnq&jiO7R5#nF^^3P&!v2S6coLo`r4cenhYvJ
zLV{mEM8><fuVUtob(?tadOgQ?`M-(p{KG6{5_UIabN8K^`eor_ks7~*e>2tywLB_o
zzu51~rC#8&;GOral?>(lU+Yfpm0no0=QhV4wXP$lIanTu2yz{tl<sBpYV!<@j1oa#
zSE+B6slB^8F9@Xnx$wr}ufX?>|MYmndYsRspM1yXH(C7r+sH*1y1v@vC2d`Mz`?km
zsp#Z_i=q+I+`Hp{c?8_y)0>`Ie~m3y_xrz1yb+GRw-#h6A2@$|qvcyh`_ho8vo49o
z>yj6(Jd^umn^y4EtlPT(`0l@W@?-6n_JlQ!r>Z}CuS>38UsnE3{-*sUiEW1*qYT|y
zdYNM*`K0d1Tv=qFq2MH|qIPG&zeKJQZ{11T8=cp%`##KFbg{K?L)4S7kR|J+`%gsX
zFcgPxOcVRByEFCIv?F?PTV};GEliO3f3-DPCTPR)HEAN-jD08R?@*gqmMGm``XP5N
zcW?iW1Dosrax`Awv%j|Y)w`59*QZnM{u(|=x$ZV&UY6$#+j`M|kAoB+S0%QpJ>>V5
z513-xddN6_CT~)%gYUD(+ILO=0-O(jy3Y2}();wTeOr~bKAdHm{V{aO+Dn_(rL6JK
zEmbR>`}M%ibC&y}wl*%e$~(U3>N%hHD?1z~Rx*@z|9^H?`fO_v^XaMW53W1CJ}rH1
z2lxATe~uk_T$=64mONSKdDNdXmTIe)o{pMSy8HLK_}%No_uV?RVzJl175Q71&D<tC
zyJTl~)n?w=3k1Jh(%6ujwl4ET)0cD2lXtAqOYm@anf7h>vb@W`MRN|dT$L7Ont%NJ
zoIRB$o(Bs#c<xWhFP>T*9sS@)ysn<%maVSQEL*mp-=B9hp<r{->!0WK<Ac7R;t>&f
z>zgWN*2V9ac&U>ulf7q>{3|ohrLDbriE9pinWed*Jyuem>rUjPI8LoCJ>Lb3SFPa4
zP1F&bwCute=M_9F<{q0V>naj9%W%`yDNIT)-wIz#2utbSvpv^Ifl=&8-@~xFlZE*w
zUrhgUpkOio46)A(vQFhm`+Mo1yd<eDVmD<rYvPh=)d8LR-Xw}nn$jPcHM2i++NF2v
z7hSK>GDw)<S;Lz4)RX1)4FAdQvv+1|v-EKt`W<{gtM1B{qE`Eit8VHZ*WOjHf4Til
zH*=?%&ZaP1g=`zs!~N%{mq~EgTm63AJ$LWKo6(<mA8qrK;*gozdj9*aZ$Ibts@Mf?
zFkU4+q3&VFo-+p?rff5NQDpW?vwPNGCAr9hvAP1w(oSApR>Ao;GI@3B{38OFL{gRp
z)SVIze00ZPvkud@*H(IuPkmU`s<5s<r{h$Z!ZZFWx}OcS()e9MlQ&u);bcDe%$}ii
z`a6fz;PsXNH=fU4JxMPkOxux@Q6jrTYVS%l{z<npG#}d-g=|%>s!*M>Fe2~BvB}36
zZ?<@DxVB;c<NO;%nwr<2?^&}*_wuC~hN_{)g<+hpmzDQik!0K+adaWuru8DNO*3tK
zS6|XxHO;j3Y1QlOqjBGjdk!4l*SGwgfmB;q{>B#@cWb^4w3~O~UbEG)=GfmM!P2{n
zVnV*1NW6LLoPt2<(zWt(H)cl5^A(<Lwio{QJ?78MAIiJu?|G?L)wSKf(C*>^fq!?b
zU$5&(xv=X(h1<Q3Lr$-IZ(egTG5gtfP43Di%lsELuGY5U%1$;W>YM-9-n9|GYZHI<
zEW7FZj9p=0J<YiD7BdN#R0YpB`8RL-gWp24=F~1;|6NI0a`TEG)2t=?w){MEdDj7v
zd2WS574wDKo_&z$d0TOaOF_ogecyaH!D9VS4MJN^Y$`ePE%1nxUBuqv?#rpiRt2QB
zEMBIUz5m3^28E8pE3QAe5wkXV;zf~FI?R*52lS-8xg8+RHfv(w@g7T)T*)PZYbE-k
z8%j4czNwm`@ieD0ZtYs%&i?xsHG0x6T`1>B>61*GS}v*I_+XKrQO5zEQ>T9LnHPT*
znfS}X^Ss^iO;*1>t@$@CpU)y$aeaGG2;XDFK+}fz>@SO+e26^ddaf(ZKH$dA-|wV(
zJ?1d$cV4=wG;3pR{ha5sUOV2?d6(T}lPP-eZfj%DDh-EoA4C4mv)Lm&=hFNA8&yrT
zUjME=J5AHOEow>MSIrHKx|+)t>TK5#neZ_F!sTP{w$4=Et^cd@%D0-(zFXZ2f9>wa
zEP6j}re2Wc<~2^|KCg2<$+~Rm10UCQvqf*n-k6>IVCS}-&i6C;TZ9)$=en0y_%v9n
zng=>XPSGkq|7NPk<1JHKA6Y-1;WXhm%e?PT9{gIg=$Pu$gOVMwa?8!U4CQ6pk9*!e
z(#ITSyKYsg++-^^q0d+Ddi;3dc==}U+}Q{3-!+lbX_TLyAiDUAZx2sq-`&U0)Bn_6
z_IGA^XcE0-vY2Zw!}-TTU;U~#JTo{v*-<lDxN^sv-gVzv7yO#r*2!=vgX!J5M?%y5
zmsYMx&bCed^*Q(X8iv<=#vX~kYInb1e=EP6m0wDFdzOxr^u^~#FD>4zZ^5m)`{J%1
z!}6v{$%|*6blmuGmA16woQQ)aMeYYJ;vLREE8J9)^iWwl=i{7Z^?SFv7GM7`|K4#|
z&KS>>cSc#|XA=)KcGz4r`{ErPS|IH3_A&EY$GM@`mPE;?^mJXTbb6h&N@3;M>Y2<M
zler!*>budkg?lm2*O~T3PoID2QId0+_O|WDb-Aw>=d3s@STEmP<}-~~t!wf0<fQ16
z#cD5l<dh2qIDNiMnC4Z@sjz6mt4+&yPJJ-3XZ=f$(34M+_w`&VH~s4o&2La^|K!E@
z6RCx3W`~@2e#|J6v3F4-lg8{hjei6j?q69FU&v6|%~mZphr7P@<OeG@qngZ4=FQ(_
zzllXY^||~1Td1+iyWHMcea-?5s*9QyZrbs^)YM|G_S=&}4|JCGO*tg;Y^G_B)}|N1
zWv4@gR&P61m?q=uy6MPdkqtlY#~IF?sV~NSN%x$nhsj%xptJ+6A^x+E@bk=Ay?)b<
z@1f!?b;WEMRerxz6gg)dW9eM8F;7w=Oyg1&my>Y3w88WR8`ft_#@j0HTylBKozH)M
zRcw4e;r0BwU!HS*Kk!*TMb5xn><<g8s&sZ2?_QHw*6T8M+Z9=b&XkC0Zrw5O<6gGE
z1;*{%C0!<aKi<yY|5ovTg5#bpwFPPC4_=tPU}3lG_KFI#ui85!jzxV@mObo{U}o^C
zF}i{`_Qn?5N?ifl6ya}S+lyZ;Ozm1^{xHw|^7`H~7u|B}KMOP5<3(6XSEyK?nU`J0
zq`Tre%g);CG7}VJyz3XIRxP~XHa&Hkj@Gr;-ukf*4CU=kaQ$|9RWEkmpl;SFIq6qR
z&w7Y>I-gkbRju>G+I<;Sm)I9KUz^->&OY<gzUSLD!fjaYEy%t9TkS@&_7&06t$Gfz
z2lrObj<S8Gw#=M$rKh@w?&2vuVKd)%7rbPM+tsr8szRIP{TGjgB^uOyKm8P3$}_XC
z`kH~l>72kBi!V9P6niy$>CL3FtJimT?Ts`{Kk@HH_UHdQgxsGLPFp-v?^Df0mKD!0
z?ySz-^4M-wNBZdm4y7&X^E2X=HFojtv|Lo_dx!PlSG#$7)r<NHTiPF-Y%}<_Qq=75
zg2x|9`nY|pXTDkMuiM(-@b+)x)x*nmrAru^&aZ4gBO+um{jAHB7pE85@GJ{kSS9#m
zbzjt!rJbp=cO<W7FUf4Re022JlcOs`W}6#rp0)U5(N_I;Cdtd6t;i`_BAKyzW4Gsn
zBYCW4uhdeGZ{+l?yM12Y%fctlz;fB!=*WLdiY|)E=kmVaP*73*jZO7kd(vs%y>~Ap
z-T83wr1~@F@}y|yPj$EN990(Cq;yU*`uV4*QyFEGx4x9Ha9PKD@p_%GzWJOSw!+_{
zDSO>lD&Jah@`6Kc3)klSH=CuIPD#xuS;Kue?)R+)#iHU<ere2AYpVVu__Qa=XLj4K
z41Z1KSn1pv596TwGqWNUI#rwwsjY2Z+SVz&A*?Q=XP?=$-S-R2Lfx5nmE;Pr*{g0n
zthP{AKic?VO8-Ks%+T;Ht%tX;Itn;nI%fRmK?{%6?e75(HmnUR?cT&S>7rMKXPUBl
z-2WNDZp!|ZDS1s-A_PPoE}oDpn!sbYOmzp#+f5#CBQ~{1YdoB_SMbk@4S%I9R8RAM
z%-A)xg}-+5f}Jxjhgf%V#=TcIag^1{eSh`b=jvBS|81{+^>yF6XJ6*LUG?JQwqJkP
zmv4T5p{1+R!bWC|=e8x2zj-+s>*OkBa<*$M*!Q-<<BjfA(SZAxB+eetp1W$b`N0y=
z+@3UN(H$RR_S}%(xz&dKRf9`(*sSxv`&KlGN*>#zW!b)qVY`s-fv6Mf1lKCXINVU)
zs5z(TUjCNcCBJs2-g$oA+~I?=@zp8Y%Ge!WO@4Rl&{H;1;ef8ot@bv@TBFuYJNEB(
z6^n)Pk_%<b&o`Fdisk&8-pBcFQTfsz<_)sOGZW67RM}T<@XSC=J6~P+_nG@ry}RD*
z5?%3QYHSO;-F=^1F%?qMPd;t#G_pCiwp>72#5Uq{_IkeSd=r<omoL4jnz&Z`#PQ3;
z-?bL4eXh&&(kOYsw8Rr8!rQkznA5fR+QIa~qS)JR+iaK2;w!E0da4~cli@-Kht#F{
zy6458E#8(Mxp>jkNTyF`?_bn1XuZXFN}2DAgzQbv+Vb{uPa<X=mf_3sW?$go9;n{x
z-8Soyo1T?=>Wf?77TcY8k^i{y>P}N0gY((h{6`A&{hqyA)ezf#|F>Sq{fm0LnGH3*
zmh~QCmOSYA$mxzJ=hC<5w~O_7wEA`E?$Xl9>weeuRw&l)>lFQ4){mu){-jB-S|KCT
zWx#STbC%BQoY}9mv@1i}+ZULY*z8!?B<ofYviNk&#}z$Q!eN)9rIOi~a;o!~d}4SN
z_jp@$y{KCHi{lxYSHiyPF)&+r=k*-u=i8jLA$CQWQb0HNCM}lE-e5VeJ&&1hb(Mep
z6w-V%j4`j|ihuah1+NXN);vjmHia*Oiz_pO$MMoK5zo$mc}5?EFSF+9T-v7;cQk16
z>`xvmxI|8#wP3x(;}mKAz58^jg4fZlE6pcv*1IB=I>o$n*5f!9&tzr)n#<O!{d=aw
z?Yp3#>2tL-_Q2E`X;XG(Owem&&U*TO?e6LNhs4jfbH?eK&so}?c6=7|N}FXBy>|bz
z%6@6TH;L0YzB|Tzx7XBeK?SxNQ;7w#`=2{Gtz4W?@=LT|cETpce@PQ&l>K##STtK_
z-ih1iO;R|jqEmjU#vgR%|NLjq-oHNKZf>vE8gozj?(=QqJDH`b58iN>m!DYkwEg1a
zyVLczw61Ea`Z#AnoXvOlG!N<dhm=>#a!yQJc%tosX~!z{$@?#-@*m}xGO=jGi|vk2
zgPZ5<b8GK;++uTj=h3d2RW|~k9yYm|wjfJ!xA4hXuNI#bPPyNodHYHKm5w{Vjb^=k
zyx?PzVc4;sX4*H7Pk;H%!Ki=lZ1-7V2VZ6XXy3el|KYzfyY`v)AHVKh__euidrw_G
z+xb1Fe4CpN=4}$0d_4a^<%LPfA>R_Fg{QLGXT&b!O)~i9bSO*mQ<YMZyG`k<g^iw<
z_8hWuDB@N3zhJ+@^Tq4w4-9TC_*hk+e0uSs6J3qvbNp`1{ZSY2v06j&@3t-S%ND)d
zwN6r2=;w}kwcfoaX207Wwk+0iV$X|1OH8Iu-MEA8?VhYl$<LzKIV$jkGIvk8ZW_9?
zXk+wp&CSbv>*5?&d#Xn1R?eJd_Hbp#8{?U$cIL~Ry=Ht<SFUf@!=v8bPi#HdxTTlN
zO*yk&<?unRIZt)=>ZpHny6e?aYv$hTdfd;XZ`TLLml3yZVh_15O%5$pyiot<v-MOr
ziyu#t0+ul8Fg|{!c&GF7k`{)Ybzk)kmMk$zKIJX6P<Pgcr0F{o{wz6QGkXKW`n_>4
z+FC0g#&21%$<m8aa*gFucTt;@!rxDL-VAn9nfG#cueX?m`)rO^HhneAXTFkPyHZ(l
z_Q}&t6)sJi-c_uNU6}jnqj!&r{-ZAWg%>^;>^ie0MEq88orB9x#+xDgZ_drLcGdfE
zIOD78vfene@9s;wSI@Nnw2y`5nDLxP2dd3aicI~^I_p_g&j!8eH{x<K>(5DEC|tj^
zsFuzC)Xujp55wKf%<@+r-5;=U^2)OJOa2wIxtd6?e>t(l^5gxDbA7*lV*2dLlYVoN
z#OCjk5-;N_MW5eU^`qoRSX%QV#@vzwot$=c^`+Nu*X-Q=`FY)g%Hx|&7Vj>+X|v(C
z_-#M;3I22Xrdg+NNZfkDk!R7#CD(U+FkZK}N;^&a4CD2wnH9566viC2xUJG}cJxN*
z6~RwE!cWU;cDLV`uy7Rj-^=Nuo4ID+=S}x}Vs<U>*rmV7e$$<`CfQ32ZwR}3M;UE$
zN@4IkGHuJuWHr@QF)9;Rr^ze}c=x=OWdl?0s-0H*(wlpvgkNOeezNi9OR>z~yYz$|
zee9WcD}UZ)y8qs}Epd}qRwbIS@f~cH;QsrKPkD8eY*o<{=iPrSYdagiI^TKfr`=r^
zZQ=XBqg;0L{=#L8Lc1R76?*CGKeFtYKJDQC&fh*OT-OALgn7w7ted_x@YLKNXYK9p
z*Y3Q<FIZmvpi$;Hcm1o+ftM~xRot&By!-vg{m0Hl_fM>z7{M&nan&hQJ!O^Dop8;h
zJ=^y$kMr8{{<G_WjkA-wpGWze<GI21ancqm!ONP9KYfl}Ij!&1>R>(1J6QpjPNc^-
zpZ7U@<-^G-r`-Cw{;WB1vSfnE2bqeyAy#=$4)p*2p;Xty^Kt9pHGFzI16C$3JF!o=
z#bZe^zklk6-Rmyp@7UG%<Ve|mvG;GD|M)qPU+(wPg1EKHjjLA&>xTb$rF1{$`UN+E
zyAEBJwI#(p6HgtNU(azU`m5~38dgIiQ?;TX+slhms=g#`RZstT?(Bw@=Eqqb_J|(3
zW|PnrcuHsfq(6Rs=V~_{-IEdXv0_(+viOGsK9>Tkdrc(%?cS?<>DbxHRcoW0mt_=Q
za9cIOZ{^Qly+XDf5zE-Br$3uDL;R-B6R{<3&(t+^7g^3STJt1-;l>WL=$4zwdu@1*
z9Qm^A!z1}TwU@ks8`rw;%6-ap?W$}>;{2_%f4Zz!`P;&l*87Bgfmzno9lp*ky=kYP
zsos3Fq2;pRlVg4Bc3io>b^EQ5&Z{>0ruIJ?E}1OcD^$38ckwxnXBYO&ba_y<TyLF2
zcf}O3l9>00R_gC$xgg#6<aE!rnh1Uo(-YI1W$q`HiK!c|$gI)4_%c#@(=SuEj<5}x
z3KM0Qi+W#E*t{;FDelUvJL}`)pF|%@I;d%N?eNcS897z&g~XP2-#J*eChru_v^6&p
zuWRqvqGuz$vsGwbiAVYJ|Gg#Ub?ciq^&DK)aCB+cBNyYIwbF^+#_!hNy}UqHd|OV%
zqKo35Yi1m7iQ86oa`#NvZ9>~^Vsp659-c~@vbO5K|8AC``UU5-whO3iKAf|B(}lfG
zPon1dZ5GuDzFxcD!2L_Gp=r;wyQ${yUYoyO_xaL}=Bn1N;Lq-B=g8C=yUaU%J@3Th
z!tN7`#jRQIiT~TCGd;5DxZ#TnvmRcVA}Jzv{TAz;sTIXZo~JIoW^{{~^Hj8sNpr8n
z#J)!vHy(Xa+kI?%<sz-K3^z;XsK~AN|84r`?CeLW%5ykNI4$^3pPbHrwNa!nqs?MT
z&cazwzhtre6G*<2$f~u8-7TR_@KSAkpl`eW)>1LuxlOEpD)QHVFt-f;x4Y)l-oyLl
zYwfJ<{&MX98SOUjo8zYsuj+1RZ!5ClY5s5P6Hs>}Af|S~Ui;SLE-z%`GQQO)U&=Li
z;+Uk$YJ1N&Pj8y|?FV-D*&O$OS^c;)f9Ec?HS1T3hwCN&UaCC%&`LWCOHTg(KMidx
z|NSt}6b;O2JQ*JB`%2eZ&hk;u@#)1)J*G`g|2}Lu_UEIB!2YL+Uk>kZv0u!W7VIPY
z{j&KJ>DPKGVN>_C_*U1yYpe8rc53^<zk5F4&2Qd3YlZon%>Vz4-R^!&`<>YOS3u&}
z&m@oUtO*vU_sBBXx+e9@CtmD+{@}}R!9S86my&!`cX;c2KMV7e`IuE0n=AKRRqSlG
zhR&mc&r*8lIcwvZ9XZ=iWv?(2PnlvWGqv!<rnWuRKbgGWWm(K)c4}oQ+t0X|MP5(9
z`A0>5f1TyO7k`Vse0=fw;LnSS`cIfR=1+Y;skBz$m-sZJ8riv1Joo$$+ao?{zol9H
zrQ4OQx8vUPJlgnke)-GZIXfO}81)_9#mWEwkNCeO_sRs$&wHPjlV=fk`O2qVhNYp8
z4m|!YEXmHvmi7FK&Jyp|HBPq<8LyvvRqsh+XO;cLLQ~WGflH=cv^H7qacR5sciY$Z
zRR2xTIN1Ko*8S@;CAqRCt0$N2t5KL&mVDYYx+`BetnX;JGV?>nTGo;ZW&X|U-Z<Qu
zag?e440}>{d;Zk}JN!QcSggsOA=jqmH<@Xloxhsl{-y3u?YgIP=0}7lT@8*~!4yzx
z=%?>oB4T=DYOU~=ePVO@@9bL^aNgfuW`FRls`}gVnHNkZ`M%ivxw-hq;}s5zch@fz
zy|`f2q<;?YPySeS;?kO6f0hhy|9gLb{S=wj)@LhtA-g&$+~WV&&le9SR#eoKefaj|
z#fA5`F6*#b%YO0MeopJfwtw^LZ0s%AWN+*|z3Py>S)GHr1n1n}EgQ0{O1|9wIqTma
zyP}K#Uis)Vu2=l=`QYwZkGB3%&*=U8R%!W#;!NQ~<=0|g99YGi-CFu)LrdP<kIygb
zKUZ)`?>F-*X*7&mf1~r2)UMW7&IZDVK0oGn?{_nqZ1~L2<@yERMgIdfE&G`2KJ~C-
zbj6Q<KXfge`;R$f$;Y!vma0#0{%@T*?Yl$ilE}vGmuiYizMbFvc`<+N*Ii+c`-9$W
zRywubs<g}5Zj;1n@wgJDm2G*6pAG-8pZaq6u_yac_1&6=jK5CA_-u-F&q~XkV{Q5O
z=|daiEN$aepS{`)cTWoK-jmJF@?}=u9ND?`KffHdHa`AX|MC7mOM~M@J}7gy=cNBq
zShdW)Yt0kK6jl3{HLGsC^AlzIudqnYpoQgc^NFeh0zzMsCr>?omxF1CyPE3RyvLr~
zr#dxkd$F~D`F{($8XISG{j`LAn+h$?U)phMm*n(bFWoQm<>%VYW1sOkw!Bch#Ju>>
zy3Z#L1-QIad7T!(bwMnx&hAG=#jk}|ZU4$ndGs&H+==tkM9J_?P4{NXm6jboBh~L4
zC)&H-aM6Je{~jl)zkD^_TKk_xlK#`}?LyJve<mK8Cab)-*UP@|gvse$H#e5em3LQK
zmK|I6S!~wUI+K|XEu`WDzr8LG(AKs$yLk67%WG#Aes2Ch2NyPW1v0#D6m!^oZU1Q&
zf$LYxm1Z?>3p`cMe6P;Z&XR}U->)H}=6cW1FQ;!#thi?8!?tSj<L%mkAJg|YGk)BY
z>@&f6Tj~EF&fnj%^ZjY>d}x%esI6r4?&@0Os@83Ge?MOitoZWt!JE_17rPtH5!=!1
zX`IB>rg}JKwqI<))!*g5i*LVJCVijt!^Ewx-yY80fBU%kzjx+xv$_^slBw`IeDSz*
z`ZQ+$;vZ=DGBMtm&$~p9fnk3U{v}t*xry130}%cO-?7-V|8w|@6QMUZOZrT@`~98l
z_Q_Q`6Lhw61~`=67hPB**Uu(mv+caRL9x#N->>sLx22qBe)H~jd3fpMRSes%WNrQB
zy*BJTcUjq{|Mt=HE@v)J%9lM?5!Jc#!BM{3XBYpNmA{uWE_Y8tb>u#+BUek0-rH04
z_v^LU;rVf!KWCq_`()&Ov*-RNmDA!EW`^2C<>Z{{&N+CfATGT0;Nc0KuJc4iyDyon
zUgVXMx$+jv<rPnUeLcA8k*k#IZ=2_u3xw7mTl4pCg5+nJ-?RA7hg;friN!c_i**Dj
zEt6WJaoBp|xlOx^bS9cEnDgP0@|nOTHD^w(5_lP^<Tb;t=hXC2!K0xPQx)wlUwG_V
zayeo5cfo%a5ubLf+mxj9-=;n8kBXMpy7>~1Pl`oOJ92%Z$8p_;%@(H_*%iubgfB@X
zhQu%)V@;TIr|2tBVAKDHqU#?lt>F-!^D(n_Y2cL`x|7~yISV(|F@!R)M2H*er+&6s
zwT?Gw?t%Hc&hPPi%vGTKwYll_{Y}pzD`UfzF4l)SY~8JNYWDtc%L`LnRju#e5GXE_
zoAdwc6NNj!|0TR{KfL(6wKR`i^Ay|Vm9ugys<gXwRLw5ST(*0)rDt=A-ntU&t>@Zb
z+8E#N6p_%=xA-H^u+1SOhRG!=_{p=ZeulT7Ex)+u-M-N=d4-PZB#sOA{1cedpO?=2
zFmcXRrP)_G`6ups%IEWk+2A7Uha0MUr)r0%L~d>FaX-IEsm$!GShr3oqtV5Trw8Ak
zp5XM7l~bqmlUKv+^$}+2qBhC`N4Obp?>&2DP0IC)x<Lz1MVu5gHapLyrp1~Os6Msf
z<R-6%J%$s7W(ajG5NYzr-#p`q&4kSd0#(Ji7u@JmtP+2I(D0=Dlo%70y?auG7x&gr
zS=jUFzjEuL{yiECCr^rY;xCNo2+?`fI_uKfoGY%1A?Fi$-oJhF`hm1R<J7(DDo%BC
zr0hEKGyG`R&zgzh+EOZKZ+%}Zm$3MCOKiox8I|rze}x|E&kx#|VsRiwWzP|H`>suW
zLS<oBjVErrzCK|4zE66*E6O7q@7y@#Dwc7gHHYD`LZsP>%RT2MxAE=_v#L8e`R5GX
zQ`(QV2;Q!GeQCuc=MT)A0>oFY?zR7ZYxx^FMs`h|pUf9nuDFIR-z;0kuWVbP%siKM
zg_W!991BI43<j&ciMCOUPd*y0m^L;2fMV|&hSbW?Z4EpNUoh_3u_fT7v+9f$S4?wX
zcxuNiSQ;=v@ZJnxN9MS=zCfO0h2p5Sx#^1@SKLkd&Lp9z-X@wE7tY1r7BTTmDtBD0
za{T8dPu$jj&JOfC+w-PceNs!~*659z?A@(x9p`Vn+x@vYm^C_tNusAC%fWDqoJVcv
zrMOEx!WAam2~&2ZY!6giq$$9b$!=s3oRoK9qj>kxz^)D#!x__sZpD9YV$UsJ{J1=_
zRQG7;CAmLMGaZvWMO-x3DlLsM`e4UmV0&=|&#u>N7)r%<GyXik?cTANyV-IVf~5bx
zbv3{Kdv|mB@#XA)S<R>4WN6{O7oB9(-mAG``j;0!?!;WXpY3}4+_6Qk?4o)C|3{p@
zm1XI@cTd7{nW=W>1t|v<pUgj#AYm5!^$YW>YG$Twlk)GLNnarO$f;%FA)bjUdk(D4
zxjR+%ndCX{8O^h;zx<qV_nT{sr=1ml*=5lU$wEuROG}QnU->Ul$a;T+-a$6in<5%5
zUzls78C;&YW&F@%I;M0hL42~s`-5Ma^*U6Ho5BSc`(GNK<eFC6_b=db`<DHAj#oC#
z5#CZa-8Z@5Z%Ocn<C!H9e@ivYV?SQDxwh?G4d({chfD=xwfd~fA5UX8eVUT%5Swr;
zi={B^Lu81n<7I^z*OX>PG6Wdai=KGR^G)d66NdnnEsriGcU;u(_$*V;P<!CX(jVDo
ze}!JpKfSa(v+>1x)@sfT)1Iu?3CxvlX4v~gxi^@5wf%0!6TePAZ9C|^d$VMBnz7={
z%MauvHa@6d&nj^ENk>{$M{o1oc}*M>P9J)xpqsdx(?~8<<;4{Ni*<fS?`Q98t8Dys
z%E?1JaldTuEk_4|iiiD8ZpVH{2i{lKKPnyhX&vhx(Py3iQd5%KelZCglK;ltIQwE|
zs>f!_pYt!=oAku%>weEar_&Z`m?xGqUU8UyCxWHvW}d54#?6NhjM$bN?>lDx%p>SR
zp#K!p$kxiaD%vlZ%%<ItYK?1+J$*Zii}{CS#ZH6XMqaLr#7vuI@fAGT(TWut=6;ag
z{3f+CVaxeLMS}NLWOOHqcpCY$_8S{;Ijg<>Q}JKoOrGPaiTB++d9N`4y639>V1<xw
z`>lCzV$+qL9W0;EXaB}}g|+C8%NrK4?mH?mS2yOtja5CSvfLYjtWp?1%?=Z;QmmJs
z$<!9Nv$Z9Lb^l_KgNf{Ko?ZH!c0ot$iJyD#Vw>9Jl*14CZ&W)<AGPA&vo3B~UDTJ~
zS(`gpZX{oKV-AqIX`yyA)FH6%pLJ%lE?<-SrJIWyI6v^VCBJE1X#S}+PFlI-@$Hh}
z><9f<v<`@^=JMPXU^MIahGlJwI>bc|GrkDRIQiaXTFqL~J!bD7_qy>J+<h@&eOzSs
zzP70ak83Z+p7ze2@b+t^-Hc90DbX2+E_m=CXKPdYUF>F<ev7H-oI}y{V<+zj9(I$N
z8}}t^lV;`ONncNgMt)><o^Z4&N&Mak#j{-BpM5Vo`dMS2<K&BO;y&kHgqB`r%iVQ-
zaunmKrE3<MJgZx7dsNeX-OOE2PW*0M|87&#F|)bN`I}sMvt(+kk1lR(?0&eXx$E2X
z2R&k@JNkQrKZb0}d%zIAU3<lM&i!25m>#kG333dJdtdCBe(E$|Y%)XmWW%auIns^?
z`#Q8U9&BdhPDypxXc6dk`BHq}3B&Apbthf2X7N8+7r<7!)htTta_9l;Mb77~;<in>
z!eHilz+>O`t^2<hes6F7@c84u<^1dqPrm#4UATX5%Ds4-&gLegBI&sTX7f5DCRlPl
zXIf+bQeS@Wtc}MK?idEF{nT);c;l2r|NCW2n3nRM+E@2t*0yUo73#WHUiUcV&H4`%
zHObzd+hl!9ka3b;W}J?#z_|o}-qSXZch2(n_Yu85qp`&>d&<I%!8#RjE9O2*2+4U@
ztKC~5;Uy}0DBq$$!fr<64%x5lKRQ$9e)Vn@?fLrs)5EptN4a!!b-%CX@;&VvJdw|R
z$+n}{6uv)eoWfGVyDU&MY1yOSYm4s6MCz&Poc1~M{6XK+P<uXZE<v8knV%(&@HEa!
zjQ9`|wxutuqx<OU)z&{6CpByoRY(g-d+W6*Fks#OjiI#%?=|j^3A{4BOhE9@!bKb2
zcJxQziF+WnR)ov_evoO$f@4)mTTcHoiCedIxm(IERqGkMZT{>pXqv_NB{G~j&VEDV
z_S)FGb+tZXZ{+95$h?)8dHc7NLHPKOgRzQQ@1%9ypG%%lo7Hf5)#E*Zl5P_J{vG62
z(f{4VBxCdSXvf~v^-FerQ~L1Pw)nZmP3|uNeX|WS<4^T*T|1b&VERUjOVLyP?sJ3`
zSg#GMn>}4T?m{QOL_)mZmXh+hU&ZR(8x9|Nedu--e_r>FmW{W>?`F=smZ|=xNB%<k
z`r|sQKi0>Ite0MI*p|C`PRIR2GOHgm*i3Z^byjDxZF+Z=^<_`krFV-i-I!6P-es}j
z<Pp>J%ey|cbjID+TrquiucF+g+uE7A7ryS9q_}<GWzRV``%3lYZp>wP&+vk^{@6{P
zvJ{JU_WXi=lka`@bKlqay`OlAe}3?v@`9=^{|T?Y9NB#3z1&Tw1%6Z3^&IT%s!3zd
z>u9KdAsBFT)i(n!`vq=q!_>kr^UE7%r7PY2a?bOwFq>2MG;zswJBy@*rvGhPoA`W=
zhwmz1;TP}vMH@AW8Fd1bw0ayXtmXdw@chOoZ`GG|CV9oI%NHUQ^A6U1IK{KyJSF1E
zlXt8v7sB_&o-96G?46@oc3dug!|PS2PS1V&Ry$!*RoBL2xu+TxS~cqLils(=F8b}C
z|L@OP0WH?>9U}M6ov;6xqrR#6luc(sScS@!7Rl39TFtqdj5&LAfBw0&wMil;+adDJ
ziaqR$lB+!$4QCs9xo!>GC%q?b%RZsD4IN#I3~Xm|$_ymeU!BEp=ewQU99j9+_k8`|
z4qtx!xVWg)_y3(XnJboVL4VVmrl0$AGyZ%5N5ea&{#OEf0_;A&Rb;<4OEB(n>(*w6
z<{fX|_SNyuonV#zu>J7n&w9N-&P-gEusgitz4(#uOjCE|e~Pef?kh>^zH@iE^=xnV
zDJLC#-sdvt|L4A)R>?4%$;yCZ^_la`Hwxp^TX&j0V|e?jq@DMbh^=z*ibRQLt0LE5
zTPK~`Ub2Vj`KLGY-qo%TJKo_c>8X-(NZ9b`1?E3Le)ax(YQH~lzs}RepQP@Hbot*n
z?d~_(C+y|COIwl`XlLg}T<u6oIa0-a>)-ZFlWms99>#|MC9G?tm;8Cssig7r{iCZ(
zc{|cf7XClp{CU=l`YmU9yrRQqY+S4REl|#Em5G$9!Usm>IJRd;e46jEEB|GmX_QjO
z;p5%9oWaqBB`@K1lk|=YcjjM`7e4mprH2a7Et?s4mS3q|*#G?h?js@xB>Hz7zl{7-
zJ~>BB#g+G-!i(~HL0#{U{C1g}>oQJz>8C&0w0J^*!eYxWSKB{aOSD<F(2%?7Kmfn(
zaTmqNM05GaZYxx#Emk=B?!%tr0agdDKYOrv-shs4vW9)Pq<$>EKS3ZU{6@+F=KIH=
zXJt#zI$gXhNyb6Yj+t@(J;@yhKTlgKVXXY(a^>Q0P1a|Og?`!`j}b1dXj|RB-;Ddl
z=Q8hax_n>C*3{)q7BH>9Ia_>=!dXwH{nPIJ$P{_n%2OP<E5I&`pEFiJvm*bAK}Ohw
zvyT`beu(+l>?y9a_NUwXwPk-!#*4D9XyN&`%P{rHGF5-?#$y}z%d<4>cslDwM8-;i
z#dZ9@r~H<k@ado9DqR!9@BBt5FV$=ko!ze|&$#o-?85AevFZ<MJ&JBW*4K}VFXKCX
z`(4p7W|lCfM#DGmEUrR-eYE@=R?j%gK6Te$UAvm!#(#cYJ)cse`pc-m&9Yg{+Kab`
z{gA|0jrj*B@zoj6)%v~SaM0`h!q)4ScZpnin_sx}e%;o$9bqdb=VZ@YG}Yp|jLZ*j
zi)^)xZY&}9-FJB<Z+Np&QZ<vooGn4VYt@mr`~ACepR{%S&F}e_H|462uW4GK$0M6G
z^9RzsY|GZ#s~xwV_HiPsOw2Cz?^6O7&G+=~lhOH5!}@i$-l@xCDR+}Pj$cnK;BC9&
zxB7K<&yPd<-iMt@5cdC_CD|S{vry$t?fUy0?nq>85qOu?drX;i=kFE$7k(9rPiD|-
zeK_aIhma-ghAsPF#+L}bTy;5Jx%u~_XA4!*Ph7t3Zg$wIa>}b3Z#mImh9<wZ-yav&
zJ>mLwPQ|+FcJRce@Row!<@4<?C%3;l=JD+4xohUrvm2)|2b^|4@XuY{ckM#XT>hg=
zs~ttv`E(N7&#vM9;ywAze$K@!_wAoy{^7Gt?3ddw7alL2keqh@qGPl1v6SaC&T=2%
zOn$!iPN3<wPcJ`iDH0PcH&~Foz%0S!`@76p{Ep0$DNAalp6-19!GE3`7xP-_66XH~
ziSgH>4;<@`WPWA%mQSf})%)a1<w+aVO9IW~_r#|x_VqMgAN<ha?KAzoS0y=Rud+N*
z%WD7KzP#+7*Jbv#otE5x7tP-KNuo@?VVAe;w+G=0dPi5?efIFQfZStK#U&R@w>9LN
z-cFl$%izKKS0Vep=-4VHcj~s}s-6FER{cnDZT3|5n$DB2^!!TwG7?tjJmLSc?fBdf
zrtHgqX2(QH7=M3RXRcW@e?p4jf;)G9Eu5^eQ_YB3DE!pzTZdTh2hFJNSX1fCV!7z-
zvD2@(@*RFG_*ap*<3!r4r~cP%-j)lh7D&pmo+)w4P&BaR437KywPR9%iNjODtnRMU
zr(=o&_Dtls5I#k8_4`1UH$9VhR9>ua&Tk55oAFKL(EUG;|Mu@*&OclE6`%I(gGSFe
z6>cq=Ju74T$)(R`etIr)GWtQO>7K@fJF9;=e@vJZxyYR}d!F|l+cytp?!KQF<jdXo
z<br(fzqyqc9iNn+-;?p4S@L?!7w?*u^1vdigvoKukIg14AANCurucr>XGf3j`oj6a
zdE2-CGJ83nC8{yAvkMt>KRP_iNm970a-p;)vTOhB$TsHY{}lyQWfe6hJKsli9S^)|
z{jcJY+tVb@eXTFE%w#Hla=0;kdsFlMPr>=7>Y68}fufR6!m^A1yqmjSEJ5G=Xx&}k
zd)tDNuYHmBn^~E&;os5ArLn(mn*U$3(==-RjqSz1lRmGX5r5f#p`*OZN$$x_zt>L*
z-K@57nYuvsrmQzrA}?4=d6eptpL~qoeq!~Z_jv~MD-Iu)J23NzlIX%c6PD#$$9#GG
z<x|o$k9@i8#h>G6M+cn?yQF<k+CQId&d+miwY+XDy6w_6@q?aOuX8Em3CGau&9`p5
ztM9J1f3we?<GyUY)vFjjqYH1=D*c$9IJNb~#$=ll4Hx(8B``*xx4U$g**)T&LrPO`
zpbDe?kManYa=k59&tFLyrcUyC7oO$MT%2KVY$|!|lI}qPUNdfkyLR9Ao;@$O+4Zf8
z_G;a!CzI|i<G-;yNRP$h-y^a04GS+#oF27M)?({i@3+rFYvR><5*|#bdsQv8AaS*Y
zgyg!~;@JyJub=T^&aO5668@y>!_3nEHwsVkPk+Cv%`+%b^r_6rE`v$3K}p`S0&n%&
z4<$bdxKP${)@b9V2R`w6+IQ-@pS5iLZDpuu#AkNMptJAcn>Q=sZI19SVD{qT_$Rp{
zciQ{6Z%%wzVa<^A^3C_HI&KMpuQs!rJ>2}<f@_obXQsn?C8kT)XUawHyqCD(UkQ(7
zPW7!h0Y^l`LKAng&Mw+3eQMIpu*kI^u2s#}UGU=ji9=2Ay1J&^U1?j|=o++P!ex>C
z1K}S_qu;V^oREEX*@pXVbLIRB9N$Tss$PzterKO3Z%$Jvd)0O8UM;)nwYk2II}LZo
z9xr0dkrg|a!M*X`+4X6*30lfMSq6^;@=Kq2>D|vg|L}Ft685f$FMQKjJKn$E<auCo
zL>>2q4|~p^yZC*R)y$K(rz=fmH?QgJoK#d=A}Dk6by|R9o5yeW(jPzNP84@PU6t}u
zE_0H=85{40k`r=Sc103%&L=$h_%BKGy}o&MC!emK{GGY>Q^n+)_zu6`+0E*gXcm^(
z!F76mgP-0ej`Qce6KVw{ULHPp_=;|!$1=^Q4_^hC@EF9N{K@8UWeZDeB!lK>mm`b3
z!qWCMcZr^v+tBDSMN{#!dQ{Qk<G$~nN;z#kTPqs;wMXNAYt^>R%KkRCGxwVm9iGhX
z-s*Vi%{ors#a=5zPj-jZuV8rBe)zp#xj#SuIhknAznRT(44u-JJCDVjJyW{VBlB9o
zC12CjwO(SU*Sb3AH->Mlu62--abJ@*<AL%$iRINZqnLEsu6pGjU-*9I;n1fESKM>C
zOJ1*G_o<H;xvO%1xm94hd$qjXTls{Hzh|T`8uqV^NUQnho%mjUkF|}J4ZHkVUMs=i
zx1awCec&}VJ+OPW$0d)5G>xR$pRMku>{f42-r~8T$WZ@<)Vtn2Yr9z6Pwfy0p0JNk
zVx~}t_@<@>dKODqK4>>Dmp;dPL-KiS^^UJ|mi)Be|L^nsYhV2rWg6%g*oWT>iIht@
zdev-#v8Z8wU0!Cw`u&xr9NjOx?xr@KHueAXmgVz=Rk>GM7988As@}eZlj#AgkMOgK
zSlvnD5vLx6eXu_EN3CX7y3*QNpK|6XJz0G3(0a>7$NX*fb4`6z{?l~VzXkh*?~15=
z`ThMM#~r0LN-Z7N`QF)Py?SesaOLXl)*tNi4<_$in-zD`w}eSwpr3s^^Xi#5D<9q5
zvHDffnnS4yr;pF7y8UZW<D+lf?ELH>Kjm^?w$)g)-v7kz_i-EUTChn5ZvDxVJpbs1
z-5pzaPOeIjh}7KbS8`yIX8p-k$!{;dR9f7b)?;H}lolDgmDyrJVvgvW?Pd$>gR{SG
zuRF2&e1Po2fY~7?aS1zSn8d6#UDVrmZ$+bQ=9+fx4{c9mI`&#V<}1#B{h^LCdV(9b
z*492p%aDWnHS{jdNuGSb^7>u}Ym><EPnZ82y<3@L+#vtha-ZHC<=0IS{daE9<@<G@
zvcvPjis=vi#9qc(Wx6kDXz;XM{QBjTB(0dp8O;HlE`8rSl5B+~#om6~_O13)#ir8g
z5XTeS9!VzL_&h<DuZi_bfM1KE^_I*Z-@6>;-tJp|tufFraMhHSlb=t7^nd%iVESRN
z|NGs`ioU*OtNZY|N%qdF;;Ym2dd=7BACgba6}2ime)7aQBdurG`%kaw-Lh8mpyTR|
z$#Lx=(ec@{`?5>^3)J|{RiEG2zg)!q{^ayk&u%cqy6!!>l*3?Ba`4ZZ**m&V9F&c;
zO}`+&*ky}#dO)*;(7Smj%~(0+{*Jk@N>%Pml;K)q1;@jSHhg-val@;OEyvzo3hfeU
z5C7W4Res>p)azT)ml*Z0-FH5ua?O`xJLY8USnsxy`{d?NkLsVtE>^N~opVB{fA*^Q
z+*b)VPp=TTbjV)))sjW?4kxDniIC1Yo0t2Ssg*x(=Z1$OPaO67b{|?G(VJpxwwhTr
z_Fyqjmx<^^wj{4+xr2|LlrBXl8Kk~{CqGYL{KwDwiM&!j1b;?&e>eQy`lwm{sHSt^
zF2?o)t3t1Nhb}R#z7y2Fb=oh<D~r!3xBb1z(5Mqs*zV<~=DB6YIi+ne^MlPk6naHh
zUr6^n`{{burCI*Z8@yf`zjd~_BT${5w0hU_U2<#1-t6>yV7Q9?LG0PdFIG)vY6@MR
z6}qKgy=I};QnRhxo>3uRon|icJ*eG&EX+Lkqu17|3^9pUuL>4#{d?|3idOmJ+Rqgx
zC9gle^qX|sGHAt#b>GeEn)kNfRsMNn*Mt|Je(&zypQoI_Y-IcYTIMn{-`=@q?#nd4
z6ep!FH0KR*T0Bwal1TcIFUNLjsiubf{rJnF>1gksOYIN07Bxld{PALbu)<*XLi^s?
zw~bskzRXUDOH#C5de7wDuWWXM=mmT8Qv8qU99({iD@fDJ_+f}x!jy8Q^`#q6o&6>@
zYqHU~CCb4|{C+C!o;uqt^a<zYwHxi0d`kIf!)m_Cm$h2idbObVtOai@4UgRqyZ-6h
zhh823yz+(KQRnpDuXwV%G9#JCXhKNVwiUroj2`ni*L`#f&{@^=dJmtJUB@Yd^IjW|
zblE)8Vx27))UYSybzZ=01J=zUTenvB#&}Mg^{{oDf{C7VYRSea_e<l-Ry3YfU$=hV
zfyv(^JC@7syY6<E>GD<H4IazWKS@nv=r-o6@tF}G{(0^HPgauyvuF0CUVCUA86RfI
zv{Yqvb9Mca%VsBAQ>t}2Lz-URU^r8FStXY9mPFv%H?}?2CjU(2I$3kfQ*E@u&mO3e
z)P3PCv_VEUuhgeJ);;9gnM)^*Ri`D_)b+X;^YzAW_}p{xs)LnCU@$xT`HaR)b;(p+
zlVkzCPk;2E?)chtE?I=HXX}bz=U2Qxpd{IFD{0@S6Pm~6Px+nv-Kp-{#v1uof#XK|
z-NoPMm))12^Kj<Tj>LcBGq-))ap&t?dEcXVU8j^=tUP#cg{@EGj;E>WVY%X8uWs!-
zYZs<yQ)2o?F-GYIkN?kD_v7yDX;%{`-`uTUIeYeOzKU1YT26bLKZgEd`Th9s-Zg;>
z<ZNti@cFLm@Of_gyk?^Gl6~g44sBShCfaZM^w*i4J#M~Tl3wc!r6-v!7c$;AZQ<n@
zwMwsvc@5iytTUg4epkLNtDlyr<MedePpL2y*6q8F%?Wg#{`EBH4xVWfU%72NRV#Dj
zY+bqe>lv2i%B2TaYj&q!%X7c5%Wik*9EXIn_x)tQ-)r{Xp0A*raNS`0j&E;v&E@W6
z`IPE=icL#2e9o4m*}p?MCv4l0u;HlSfwhO@?<wZT<wVpbJZ_zpzu>^aiCG)dq;Kq=
zo0EGn#?+O!Jv7}dA~X10LCZY1VlMBeddH(0OcvbR(kr<*dr@-Fsn}m$ksBXg`up?j
zRGS-8IgjqKpY)q?(~4*IK4zwQcEToSRGIiSkF2_Wc*gGEW|ujiinqVnvCrk?6z*>2
zE!isDt?ve%ZC?3j?;ejoclc7SO%*qBS-x-DnTdZI*UPBtXT$|&=KpEaDtaj_`M~AR
zyPnrCwi&K{aqYo(AJ#YOdhtsng^lGN25LlQUEk@oYf>NkGrJe>t(}C|*4@`C%!;^K
zo4xDSFK!E`qLY(D>l@=1tYn`ac<p%nif)6Rt^(0h>gNvzI`hj;cDiz+BJXuWYp|5`
z*7GlX?7a`h3vo0U^}Vxrn<yUH*>}m5XJX0uQq>K4Ttf5sx_?9kai(gm_Lglr6suWj
z6!_5Ude@^>$9|UYk6e=Z&??;d(V;VquLaXz%A^)qwJy45a%gwv%th6j>J_0bm+u8`
zZRuox<;K^#Z*5Q6{OMC8%j4>|cwMagxqaHTO-qU*#6$#Em#*Hzw%YZvSj=+q#4oX3
z3y;m8p?ucl%C}Rdtjd9>KFA5p5cqz5(%$Zj@a>;ZOkcvY(olKpnGIWeS@X~2cz1lg
zzvMzx*FSM~PyIuGpXypa6F>KNUHr{U3zsi7IIDScje_8w46ao3(p$UlUs_PH?00IB
zuBhSBnMxZ=F5UR6)m=LI=hi&e@7EeGrarD`L>wvtx`I*ucle<c76yhQ9{d-KCFds=
z6(v>{>lIX<4fD-^Y$mYxbvTb1`^^<=mc3kRI$_buNjn^`-4yw_kXu<GBU5GbG>@rE
zCP}&euWtXfDW!6=qyJUK#v?zg^3&vM+5G#j?>}$%iKF${&DfqpA6gdAIvjd%k?uLY
zKgG{^m?GbZ`fq2`JGcLLom+if%T=+&&M2;qkF3U#PoD6wMZUA>oMhRO7&I#=QG)3_
z_evfE#U+Vt-V0@y|C}~O$tWmo*WZM1tm2vmysOnF>`#=sEpa_!!2+wre}&G59lN#o
z51X>En~{D++o|T|d(CFZ>&!L?JXaPwC&5!+d9qbVwzJ5ah^}3hI%SzEu7@sv`%^fb
z?P`1AoEAZit@*sOuN$oQR{OxY=FipV$7dV-_^P&Je|5we*#*nLwJCph{=v!>(sQor
znq8Opx+N=q<lE%&&HpuR=iBgO=4)?Gsyf5U7VRngz~bC__g24uau?s)-_vjM=igq=
zoqvbhJ|gb!{W(?@zy56575UG&G|5L{l8@##{@FRgOa|=R!#BSU4VAa=3`vZe?(?nr
z(f$V;t5dbE7AyUp<({^d*Z26T{X)N=U;f6M_xi)c?9FnFmGch0S^n*c?L~?2J71<8
zN#0>I?`-GogmPPjD{=CZ*!A{G9&NGy8f>E2uYOr8?1;;m<g^a~H(p+uQt<aph@DAd
zDd+SD%L1RAv)+^bp);m=7awm-^TN<`OU<s#uvyM{(|M&~-iZyWhjL>jOyWMAIx8mT
zc!70kNq!Gk!Nox92X~Jx+q&s_wt3P?pCFz^T`xAS*PZ$IxkKA|uGxi`JUikIQY}ua
zsaIDgMcdBa^U}puOD@G{iE8fOrwgTnpXbiGdZk`adFPIuJ*RoLa;r34+c5KV;M}j@
zOVjhMUwyl6I$v0KVQR*M-}5~zCpqNLI9Y41uWq?g{GW>Ed(CYt7sbb}pJle$X;*@a
z{({S1-*!ctct4!@V8SI=$;(o1k!r`ok8jcYeYl<f>i@j#8BPgzqhjXF|Iff_RDJj7
zxf?;=N{y3$MLj%w!As`tb?)?rddZNcREJe-Bs~AMY<o4kPJY?epuKsX_70a;X=Pk>
zIV`W5`*zur$efwiQUg!^Qc-Z{e^(cIN#1K}<%fc;GkzUDRCMbx@1;+tFWq}%w6R>T
zS@-Ve&1d3X#-47>^|0);-nH}OI<CnluOG|$S>Y~wVnrqMsx=qd6~*tgJakE(79yJ?
z`Y+=B{eV|qh4Lzyb>@yNQ?``6D*xEN=~i29amDV0x92qfY<|M^I4dbHa#>-@qR!G)
z*QC~jbh1aTIC^i<nkl;{|5jGa-}ZEi-tFgS)Xtfi97#~g_@y}IX1q?w&jV|`uBdS4
zW`_N^8+mC%L8SGr^U2G_XGz_5J$0|2Z}O6p)}_b&V%j@(T<;vp<2QWW_^|APTLD{k
z0{hid@{X&IeKI&9$N9KIoF%E}<L}omd5rYRY~!q=wyk;fK76MPTP5>*onQMM<a`fr
z-*39%x$+HWnWm*%gq1~9Bm}&#95TI-!}hoCezTr|QlnZyW@fohczH$h&)22@xls!#
zl@gzR8BPX<h0+WRstgPaxv9nZc}b<2IVt)nsYtgVCg<m+Wu}+p=jZ4ZR8EbE&VOts
zR`-2<f;#^st4$A5zNPZ+xN%eEvgR${=D9i>n6IzCV6=9_M3<>kChc(iSAAa5)pN>|
zH!cT!QYPA5e}AXKX<tnIpYng){t*jr{8=umt+nsDkKW1Slhn#{>cn)@)StvmVLy3!
zch?+UKl?N1#nP8QdDb_v-cXfmQ!>Afa4KKB=g|zi*>9Jg@RWJ~det<YKF;&rirP-y
zP9a+!Eebe0FT-1O^XcjSqLW$A>P4L75>T~lSyH{f#w(&T{kMERpX%;Kmf0&@ExD$A
zT&p^>kd=#ZZZ@NPlI!<1|K-w^d~fQhtU6O68a#8=1RH~u4Zd?a_AHsyYj?y_mv364
zrmI%wI-SF|`elaMBAv5Cci+rA)%bQz<@7WALfa>aYcA}%V{+}{t(@$6Z*NWRt=lYl
zfAZ`X&t88`t@-!!)1T+_*VV<G<FMh?4znrH<a#TdeeYdxy}G``jUb~R_Dq5iJbC`_
z0w+DY^R>20uglh7Un1l9g(sUMCj~C;_*tjyaz6dvjoyPr%PjX*e}5M<e=?7R7K`+T
zn>TCcXl@cO-Kf0v(lmw6W&T<T0+K@JU*yU{8}{x!Vf3-%_klZ;CRLX)=!-o0CwP}5
zS|cNlQL}A+ugA@U5}BPMqCZ(LYz&)vhvANCNXL!rv?UBajJ%D<&vJ4zDfm4&5%gHT
z?h4ztrYS2V{<z*W;jQqOJoP}6ThZC;?q{RCeKpp)^TeE-)`aMp*3>W@ew*um=yvp`
z<u=R)`PsRxbL1L?k4pHINGz<@Hkod=wD0nQrQiLh1q95|m?-^^Yf1C`(AZD1E+6~e
zxIB!EO0g@y!mM$1lgE+1qx>eTC8O@I$f#S?`_Nr!NeU-h!`**r|DI_?MifYPykI_H
z@GEpV_pG(~i>_Uk-lP=1DB<lniP*Pqj^+N1tv$cK<9gQXmsj^0$E!LEuKU>cHgj(1
z$G8&~6PfPpQJSA|ZGleT!w`NM?Eu3=TMipP^L}6d`sknc(tq@C?fK5MSTCTZcu&J0
z(cfLEzb8mcZ3ywGs!Z_Q6UX)8kXlf{3+{OtpIbis+h~#FH0h$!+RUmeMh7>2owmwb
z?XN;stHkp3`^FP(+`FqAm8VTz{CMXkeOaZz^&D53zWrDpYoQqLy7u8;58pQ&2KN>}
z5jEDh{PWl?;ScK!r#f5>)GK7(Jaw(aK0&P}j&HVm+1Os2vCYj8s1CTg%anOV+08@&
zbFGq=Yu&!{CtYWreLZzEXOW)P*=<{kYmBq~J-@Xd4bgd-Tzz0g`bQb5^WUCI%02PY
z?*1J!vr4*gmu|4&p`9LUec7*A`SCD4Fs*uh&Ld;%HkIh$SF5rWuB8iEW$}F$da;{>
zO(2`=oY&^U={vf73$rSmc$;5k?A#_({bspg(o3HoTb|xi>pdr<v0FPJoq2ZM?wSP}
zElU3<M+VM1a^acg2XBXG_Ag#t4r=B3l|Rk-k3*Mj!-1oF8oE>}g<i=oZE(346?gTw
zZGDo~p*`7}Pp(-syNEsA;`Q#2=I$r!Wc?QS1_t!_{B7enHfeduM#X@qm2Fc`cN<8&
ze!@3fwJS09+KtzDH#4rieffpXFM*|dX3d{h`{VZ87GF=fr9oGg?&nZi+4`-q#z6Xw
z)XW|HmdAHkE!_51?akHgs$otWE+{GNx17|VykPq3(>-hZL)I3|XfyA-ZMT`H$e<;*
zRK4t2Nmn4}T$!?vP50d=>gum}vP)Cxx_rJ}vaM`Jwv^6+1&Ui!xvV?9CLf+U#eTyz
zm5v{?yxVrhxYn+`RjwkC&2)OZHW%AxL%Ft_oL{wETYXhZZY>biGPzmzyKm#|AB|F1
zmXzomv+S{!*}3DS)f~IqYrhv&R;)R;{>wb&?nY?_-&F-B-6e-Uuv>p*Jnp0)zI(^@
zyf|JD2d*QGY-!>OPx7X>8$L8rS>(2%?C_-ZFZZdxPW*e5<@M8>#}p5K+2Hoa|H6)#
z&R4>x>NS@(@I9V&a*npmYWteiK?&21UL|$bY=7l`t%EJ+dXm-Kn;GJE>Njk2e77H%
z7ZDU*GCT3o!7|ZXzHJfgMHlqmvs_-uVI^lPxwH5EiI(*d>-EKE<Zqn0<b&JX_^tE5
zomz3Gug_vN8>8C7el0E?H??@Sg9>l!GJk&yNKXw?+cL-8^Td{S8He65c<$AmW3kdf
zS%+=QnX)-)CzRK}vzpzWR@L~Y<*v-ny=^M2d*kNvXB}^l`=ZJ|_g2oYLxqbxKkeyS
zmLzB*8@<-@(d@b-zP@K~Zd2&Fc=M}J@O18s+w11}9D2;crq!_GoaQRQV`t8^ZMe#p
z+m=_7_OdX@TCu-e=9T7zmV?>xvpY98s7!r*prQZLjIRuDx1D~J*(FmYTwRoU`mo-t
zu0WIbCC(}H)n@iuDOuc^I`!+zG$U4?p6oZT{yNNyxAFN^aIL(9MffJi{5;_><;O(}
zo>tXZ?dp@0Et9x=Y~9I%>NAe~<{DG{UcdaJu<P<|rsvnI*c`n&-*Rqw$K|Hqa80Z*
zIbUH>*`8zWzqQYW-ukq&^ItGSys^upzhY-5cEuaa_>`&YBN_ktee}e)HQPH5IlPeM
z_|h&m`;hblCX?gI?%EzM-ZECTXPGWMs}A2^b#UW^H|Gs~nSMO3m?~j-Q#$ixaq$!D
zpNkmd4cO$Xw<H{tZaOk|)xOT#{})=b#d$aH*`DUFn%w%ncJH62&)c8d?`O&7skjjM
zpYQJ8`<u%JwgkNX=`y*g{@-`qZo^6Jahu!TCFE8K#+XlzXwIpYzL-5Pbm@DAH#;sx
zzZNlD>*X<Hir>*(z4G5)j(=U%&M_FR+0Y$mf32rlt=Bh%>D0o1J~1K9&(FEeeY=G<
zD9nI^)otEZKmA?xwR!JN;}+fTO23fMG5y$*y^J@ccJAHyZFfmh?{5ZKyE4PHy(gu=
zMORyw+*va1^}X5W=g)1{H*@;G@PnGY;mgITd}{p*)frazA3xo;qFB^Kw@mrtcSX;l
zs`@W{S}IR#vsTF7HM*-Z(^=zS;jM4ye)KNMtzX~x_t@sORu-xU3^vW#RlQxjK>0UQ
zP<551Oiss<JnvU-ZU0Q&{N0P^_|3f$*_*^J@6BWJ-Rjsyv$+vvInm1nOzoZad<nR8
zvEp4zrK0yGr(y|H+Z{J`YmF`Ks^0o}2N#r;XZ$<1!hR8_*j%TGTLINaneRJJ%irAO
z`4PPj_)Wg~uY~{u!vb^sx4b2nrX=bWRBo02oqzk-&+@;b*DDxKMl5<;q7lTXH_b9r
zTF1BP$Z4|^QjUS@GfiDL*%)n0dr^P?d+qlJvhsbK*SQItescGF-TjvxwKe}g&EIUE
zd8qhc`ugiO>o5DBT5VY!c<iL<d|PgRb@w-mG`@%K+Pm)N=F6M&(?8t*{^rxH&G9=l
zincwQUl}&V`o@_ox%X<5eM8?wh~&=NwX#BFV@bGJ=-Ed$`mc8Qb;tOqy}D_p9rmmE
z=-1^=FZ{pm^ZBgX&ANL^!s#9R&Rv??_EYX(2*=?7`#XxU8&-U`(cbn;^1S`>(22rV
zUwxf*-Dc(DB{_?H_jqsK8@0QO^?G*Pr%BHhmZ$uGrT0+P$T(I0`=V#NzfHZR{_y2o
zg$uJQPB(t_+?6=};nV&1_IK&k)s=qSem%c_mcPWGp2^=<)uycX>5841wnwPyZfljn
z!qDmS7xBlKMAqJ%BANcYL)2bZ?{K+G)f`=ySl#7oz9)o=+$=Kk+!Vo4c5%()Y1aEs
z=NU|Y;S#JQSR<QSxG#4?<bj<ZCT;q%?2PvddxodFHwA^~Y_<?)?Y>qc%-owcnT5^&
zV9O<&wTn-P+uZh<sXE>Av(7|@2eWVQxYcE8@X5$GD}`xh)x`JH8E5}Ja8Jx~y3w)u
zVL8vu0tC{JUN4m0UKFeFtl;$PjNp)qd^JjED_bu0tGLDg<C?~{BaJ!X@-vT_Q|sPI
zKWMzk%$B&Vv44Zf^lEmMTSblbp>vvY`6QO^|9CH>BmCapdv!ZLMQCxfH=Yfv4r?}#
z|MT}LcNu5Ze$UqvYE9Nhrydhc|DN0;>!d$J;!y(Q`acRLT2p3~Pg$|m%v9st*Y+@z
z7QPzGTcWSk9@~oU_hhY&({p_AoxME%Xnpn$2cxTbYelZCs9af^v6@*`<azb}ECrQ!
zJ1%<2D@m|z4%6+pxa!)mxT_NnESO$#`oPt@g1=wS(|kOCQ}nr0UHKJ9Up1v>);U{E
zj9!{0GD%Z7b6!COZ&yqG_UnabKb`kfx|<ox;H%BNqx;jYb>4>dmXYF}9FC%|r>yzQ
z;<@yH+AW*(*IIvh_6vOR<a$;r9(R5B8xJGX(+3x)J(BWCvYi}q?uqnuyPx^fUi9Wn
zJEtVD{R+dXqu;0OaM&4o*xE?CJ#)#MHS$}Tq)&W2vFX|@O@`JEjYEHor%F3mH9fNb
zJC&<L(03o-uD<+ju7&&huBh!#&*huYH@(<n$<HOb7YishwfcVaD)HcvlUL8#zx>Oo
zvfdRpxgLG?5{V3MKAFoX+af5=&LVvLdH)v4Fq^pdH+|#oEUGN(kV?2Ly<uV8oJN<+
zS5BPQ{hly$i>=2Gu`@H?Ub5zJ7FQQPeq4Ra&NW@}j+>sCEb`mj^He5`VNz_(VNT8+
z9@o}bMlTojFk3h2b;Z=e=q95LFC>1R-FeEF=Z@v$ouW%`^1sQsw_WQ%!-4a?QgynQ
z_M~gfQ#!)^OF*QH!*{-Hvu6IDo3E?6e=x4Ond2;{#L*(OGCA>@_I`OwdB>%!3-0z`
z6}n=uI_<T$bR%nM%-g_a4O<)hS2CC{EnTe?{aftVfpe_eQl)QQl)EJ%<M}{SeBZ5~
z;;U@S_UzNUmg{=Kdzs`C{>9qnmKD3CKBWjU@JHJw-Eh;8*vxohdhps)7q{GdAkE?T
zV%3(SOSNn>SDCK<(DuIZdP3o@IbUu_^GRx$CmmV)`q{b#iU-~1C*O8UsdRmC#k)S@
zwEoi|NtOi7=B1zawTTKuAMJ9vvi#)6Z<`B`TVL;ceo9EWGwsd>CN3ZE6qYqt#kiIh
z>qcr=U9rCYG{;TTZ)K=nv)Mg`7g7ypgW|ut8~x$PsG8B+$a%tt>6g|)my^P8He7oq
zTgC80_?q(~_KWJ%J6#$x<(>AGEYvjabSt-VyP?5);$*-or;ka-#-$znRVz~bBv0A7
zH6(FMn9G&bc?O5xm}il5@AePAO+pLLxV<^8v{|%aa#`DwgYR;?7VeQ*;$=DAWJ1?s
z{^pafZNxvW($bRmm~SLMyFqjE|Nk6Eg|_QPXl)Rbz54P9Yb3{6zUsi)1?kntIThy2
z->tN<OPKG4{FVxp%}e=gCnfv}`>S}^MOV|1&+%scs@MA)nC9L}o%b?p8?T8#*R*Yu
z`=WO#7jQj_GMXiFNG+y$w$-1=qHvR&XI{FRy*$>HE4L)1A?oXehYrkgOYU9ISNwCx
zo_X3oyXaN7E>Ef#yY6sSZ<5~w&bZl8YE}OqeM;ZG{@{k0Njo3TED(46wVO54(e(-Y
zn^TIMz7IDF_zSIAn-%#erc%9kh2JKnPGhaR3%3jZmTfV7A+e!3L)LBgyWc&Jb)2mh
zmYgsZe^8+O?#1T<=}p(>{?YbVGU7@sUhug6^XAJR-kjoQS~KrmZldgkX0H{NS$`Th
zCdRF?iQJg@d(lcBR<1=)pa18-zif+D&a$Fa4sIsb=PsEYHGQ4n`L}hKx4x(>Z~2t4
z$S%oz&UCMTx#vU`_L-J6D6Ew@9qlM=5E0_o+rqY9WLg7@fzZXQ-64KL6)pKw)?|mz
z53^wO%$sH7xJmz!j`QuPFEf{G3Pkvcy$^dm<7#o&^RJI?ZhF37Q0%jZdd&u5;YD8A
zk~2htR6i$Zumwy^ImlC`ctOWb?We=<bsPK~SN#4wEyVedx~OFKhc^tJE`=Y8Up_kK
zdh1id<Ju*Cj<b*1{<XWYmM_iQI?j2fnNUH=Pt{c{u^%{BJ-w&5n6J6--;ox+*z<ui
zDn4l(ufOE4b0PkDhJ?UwJ>AvCd+fxXbl<iK3tsq}`SW{z#?()LPOVPmQ#mcA$H1r3
z5&h=Gf?5_2ivaGu0*f7UzI1JxF{_P*DXLB0O40H~8jp1hU&^^@j^@R7TJ1YN)TLkj
z+R@}~`hj00Cad+DaM#te;w4Vb(qY;))s_42T&~=pJk#&i<utpFuYxyBrqz{{Rn2Q;
zTl%*2&W2l)7KELWoN#j1y&{$8lYZae-e`ZszOL^3Y3<L)+sohUz12E<sL`(DSj+x{
zd1thBrae*Kkn!}CE{lf7>Jwf0-`^^=?2uuq-0-x2GY9*L12%^)w%AITKXh4;Kg(o}
z$WOK;S6$=QlDfImSa;TBG%<AuSp|K0Cp(v6YUsv1p>wn5+;^00oVaMw9K|Sm_rg<-
z&1sx_cGkYwB>d%!YkrePgOI@_HPLPNe2*oIZkTrRM94Zm>kKi6nP)c1<<8{3AJie6
zU&^~fhVMvs>h>P%uwbWd6%%`dz3e=jwk!L;uUTI5(&4w3n(pV^ogvNb>r`YMJ^n3S
zZkO<7;R?m&-M2*+mA{UhD6Z2k>F{h{SEI7=@z*If!V-#n?^8EiIkNF~#EF31>3pW^
zH>`e@cJ5|ye#HK}t^U=aE8m5c$Q=$oWOJ|ZX2aHEUQGw7l?^N(_Za(ptd9>|+Iscn
zV}<OTpR&HIzAm`1eouYyp)l67Q!Tz7UVd=?m7Ix>mfz#uX2kUH^9#9v^C#qlrtbAW
zdq;lBSB{b?&tz7(EV7Srn;%#E<HxVN(JIx2R=?{iWh!jF-<NI9?X^4pGq%3(`dq<>
zZ+3F4u6mym{EFvp=~KHa@@3r59CchaSWWGGWK<gcVZE!V#YATDBZU^xM^Ey)<<*6U
zZ{)c%OQl%r-OjB={+2F3J0{j>y71oaJQyDS+s}=urdG*mmHgkt{+FR1yDz?crFSRH
zHTYNhyLok~8An!5etc}V#;lyRS=v_f<a27wuN;3Q*{&Mu*RFPE&fJ89XXH;DiSOsB
z;{DfqJ5yuY-pe1ZY@YKpkvV5CTl%uK&wIpzMdqD*Y1X=a`_>-i#+7>04tFh@e%)2B
ziLs1-ZXRQrl-G2Y%dJHUnj7qGzt5^NuD)j}ax+s|wo7lJ&C!pHFA{WZ6LbTfH7qx|
zQ+d%i^pB&DpqTsf8`Zzp)|T@4NF7*ik^Mtk#?D4)`5f(eb0#R5M>ak><I0<KQ1Jxk
z?!A5+Z%>&zHNkLQ=iQr+^!{x<FmvBRkp*+-&YQQZ`_de-pJ`Wpa%;T0nRjMuaOLi)
zj;iE%&v|O$^!HY+*E8nGcHLN9R(`~8fryRmZ$<{W?yDCTA22@W`~J)YtNNynj=oUF
zlYb62wyPC1KhHgNW3I4aX;k`U!Jc;WH5CzoPMP<Zd(365-1-U+#hK^S{}5|gT(ai+
zq|Xjq4+Q%9C3+v*>}E@_sN_DsulnBnKIw9)H98?W+YI>Uaq{e#nkxMGxRJBomm5D;
zE;q>i;-Y9_R`9gbtfpzkt<6k}JJ_2tvripv?{Vh2=(t$&8}BqFtC03p=Pw>pIi=IO
zOyf(_(LXnhUdVsH`F#5_yE2E%7O(cyJD-&~!Fwl`Ydv@3+4EPPs^*I9aJLQGK4*=z
zU+(`^&+b~>WE2W==|3L5*V;wXw|<Kk+n#GuuNOsn+ANIC+c8bysH5)Y^6!7F^Uv+6
zU-EPN`3=1-`xn3e*VF&*!S#i+`8*<CNlj%k4)E%^*TFEYRJnV?vK9%?FIF!dUf%9h
zmQ!F661~OB6me^__Vn_CH_zU2&(ZdKs9D31bjrxk|HFHU!jfwaT_?BSeO|w3&OHTd
z<)9)JBQ1dwzpohE$0^m@gge~Z-5-B4bi07;@#iu7XKq%@ul1V0xFznrPV$R;EuAtq
zT%#8%pFVSzdrroV#etPqGyhc0KFxMF<f5xo+^Ne4)l^npVHJ#jH+PnUaVq!gtP`8!
zUwSK*oW2wHY|+l=CtT+?di}5ODln6c|KRhtc*$=AOSN_-i|y}qc6vXpnRV8#c~AES
ziI~(phRV%8ak6t#Q)_!O{r_z|_hz+2SIjNei8uD%SyeA*XBvES>at%Y2XamH7jFwX
zDLSR~%gchNm4BHIZquD5X1h)PvgSYDxDpk+3lhf-PIoWg@y5Wx<$K!;r+>$aweMUy
z{jV+K^vX3hCXd|8j(*;dYU$}aRdRYF<4(a<RjW@)1o!GJP~_X1%9c5!HSx#pgAYH7
zhcp$My_fOhn;Wj=w&!a2AF=Z{`_G?0r?#Ix_BM0LImxRteYXd{STk$)l!&?nC2=`r
zd$V^;tp^{RX^kt{vTjDk&Gx4edyZzRxoMeYwyau|pML*v;I{S)#@pxGmgO8Q()9T3
zYuI$pEZn%!^ibCP6N$@BBMb7~ymRXw7VRz7$h*6-{lZ))N3ZR<XB%gB%?|7l47;*#
zAH%wzU+*k*cG~`yXUV-*8?Vny)h{jlcg*)WnY>T!Zgtri#we+uYq=xu9pm6rs($fR
z<ciSKF24Twmrl!t=AMh*`<wC9i{%!oGlSP$G%Sf(7RCKcbe^}aZ0E)BWVz{Qcvo5_
z-ZB)i+pYPjBUWo)w~g<kGaTLw3ueFD)4Xx=qBT#~7OlGc;s26I$L*qBi#E?_o1Ga~
zKHu2v^pkn#xW6;~DJ{%S=R279@mL{e?c6=WJ}<*_7kdBNEqh-yl<VIe!{z$1URO>p
z=`j!eDF5eP$Xok==ju;4@6xK3e$SfelyF?-LyWHGfh|jxru;s5*N>~VyKUF9X!#$m
z{UxoOli8GS-TG?I#-S>E?(%o;pkHNy)6_EOzGeTU_3wt+rWe<JLiTOX-VkM6uj@Dc
z+s_HL<`q6_%OsW>&)+Juc|q3GSccNYGGBA=svm!!c9rAr=|!)uh<k-?YG7=A<$ccK
zQSuSSR7tky^OnCzI;Zn4T;WSVy<*P7{UW9JelEKDWIyVh&XxDazWVVnFc_&YFeu`g
z(@9A!NlgY_XR$WwcmADYg8%;h>ss5}l;R{fty$!SXkOy$#NFF+7EYVX@~ZLS#M8Tb
zD^yOmKUuxt|K9s=nq%x#v>jP*?23MOu6p0h$XA-bOX~i7K3FaIdCxQUeBpWKN}_wB
zHcd|z$^Uuq^Mjj@G_AEx)vB7^ZnLc~`*HZ-=k)XZH;+!+Y#b+U>HWj>d{<HX;WZC0
z=56#?opk(=LGJ8rj}lKDS*NqA&9ySlBv83)Pn^z|sF)PV{-?9fUoz{Tz39Y;K-+Ui
zZsp{BTYAD=XVuNtG=VjXXGz~ukC%>n8d!G5d!BQD#rw_wKA*fkWBQRJaW;?7Zu2<s
z+WF!fvD|rI`gz(D+@+kj4yy^9>ag5OH|Rg{^WwIKk2PiIwD%_Y%@W?d=7z)VDX}c#
z`{&GWanJYbySMl6hpL?kKQ7L$tkYekG+oVv>#O&*b0$rVtM=Z!;$5>!?#G+uT3X)o
zUc6tvVa3|d+4DYY9h%&#QuR^w$mZ?G)hn47=_@>bE)%wE&FoX@*%eHEC#2`6<e%<Y
z{Z)Y@Z1usy%AmIrZ)7IKublkpL8VB%t90E){mR^pM-$h?_|@+GB)|Ms*2a#_E7q;O
zJ1g{U)I_nGb(N($kB$Y$c`Q<ka^i{#nsl2<YohQxx7=%24%hz3XJyTMFP0|!s80Qr
z)JCbcytA9Hq=(n+UouzD`p55vO^^KSJNVx;ZIqPdv`V|n_UopoCtq5#>~xE5Qg2=v
zsRzt=lF2rHx2%unS*i9Wmg8G%S=Kj4E7d%&=w_VTrCi->V{l<Yuqda>ed~SpD_1Ql
z`gmruuYh=^aOWPmTMHuov+;Wv2NZn0l^Iv8mf&g{)2_jtAoPKq>CLTOiP?TJ6RSDj
zW^G%Pw(^8UHkVkexKiRryK^owsShT9;)-&9>AI4cS!`~nSiaya-b4}Ms+Pzp`B6Fn
zEH#ge7{V^e@|Nj)yywk#iZBzAov^EN%i~Kw4G#K-<hp$<7Tj~@yLP7F@s#exZ<KUQ
z-py}Z_}a?l>PN}HpK6}n3}~u(8p_%H>C^(3ldI=uNX=`Rd;9ysNpAC84iy|So41=k
z=j)Ab@i!mV+x^}ytHw8JYuA>%9O>BN9nH^myo7cz%e{EHLqPO`!-Ck4*$4AAUa<-o
z?P?Ow(sC?GkbcTJr=30e$Em<wD-}N6ES<7-&Ym?AY>OURTdeM1vi!`>XQ911<r0q^
zLPXF1C}oLJmD+gZ#o7A;Dl+j598<Xzuk8BK^>Xrr6$hPih0g|VU$=9~N*14pEqV*y
z_GWB*6E47CzKY>bmi+1;^-+NzpKLs&amzF_{<9HN$mg7VVV{lpy$4DHe1)Gqh%OZV
z*8QMK>U6=TMAucC&f*rTeYa-)7SsKuIe}Ye(;ODgtfvR3cqwUwxbD80)Svjs`{6d%
z*{aG(C!9BUEGas&^HHgKYnJFLGya_1l1c5YI_I`dk^fq@{>6c_ZJJwF{5&A<D(uDS
zydbJ~P05lcm5z@6O$<hp)-R0=6A91F6c((Uvz3$oVsuZ;?4VyZHT&A%+}3;YM=zk}
z^!I&F&FUW+*JrWSGaOO7yiDu2vgo_EuT2gSPuAvcpC0KJbYDbt${I7>t>UJ3g-seP
z$-3Nj|Ju1%USB!$c5RdTQ}**_jSfp!&*n&ca_Y{Pr*iok9IP!0-Y0cWca}*t=tMb9
z3(MaS{PZ99wSeY_Oz-}APq?^amwNCY+x7NGHdh_VIpx9qmd{$Q+k^iw%ijB6;|o``
ztDFy4FHwA5zR;j!*O^7N9tpfX8Y^QbRLgEyEzSPopI2Q#T=^rj&Ww*QK7aJyJZ(#M
zl-0jKr`F_@u_m!+uRs5yIWl+0q94DSzKd-4{H3hB&(iMi#WkrnzxG|bxBq`p+O@K!
z3zlyFygg0zx$m4MTYfZ}yB}Ykw$~x(jaStF4*&G$X@8%+?)3;@&93@#`TG1X;`N2g
zxm3DJgo^Ioi&Q<PH~B?t;f<{Nxj!$hoW)tvW;iKqf$oE%!|pSk1KZL**)l!8G&8eq
zuBhlce%EuUPfg!0H_o-0yYpqj)-9*iI@i^%|0KJlw6y8dI$maRQKi&{#_a{SxLh{-
zx-OjRu<G)xnW-_)=bn3_{_Ml#b&6dol5$TQi{;&;Pt2Xu$`K&rzx3XFVTZZfZ))2Z
z-Z9=J#N)i5>43b|Vn3a)K3vl`SMSyfeSgM$`Fln=<&0N%geF@{pPSsYI%%cEM)kID
zlR2I2PPK&bDoAU&OicJ;o%_>O@Kx_hpG*ZygWg}k%NC}_tXN{38ZRWCVHv;^XzS?s
z^|_eLLB-^fNxMAyf1EO$HS_9&2Uik)@y6BG{r(qm&H1!UtgKBh!{K=>k1y^tm$#4A
zconku5ZeKUTYoj)TCLBBu*_(AQ#QAL>&{<qVxu0dx$*tX#w+DLrB9YLd#Ef9{J2SH
z$)T;w%7iDcEX?Cqxxy`A^QCX|yuAqvRczT)6b*}~{$xnmmut?Pd~4Cut85}khjchY
zj2#^{N_QIVKA3v)%)6PAJMYga;E9*?d}T5BcZ82+a^upgVi&&XKVR0_yUX{6(VC?#
z#T%`4E_w=_^0T^f(x7V16poCn^TOsEwYFZV(9?f$==p3{n{Dg*m|oSoPN}?7>iGKZ
zzB|^<pR@ZIm*2W7tuZ0$siS$tr7$VI6d_IL4Yw^6)Ew6PcC<X{eEoOjF6Z{HK;y_w
z(RJo2&f@knlCHl!_SS;$>_KKrlZ9(vnEeoL4(yTW{@7kM`(j+=-L`Wt7b#8jdhuRa
zzVk}XoNt+7F+2G#ovU$YsyZV%xl&@yag+V^3;(FTWRraroM(NwyK}iq4NIjthwx2l
z{}Rq8M!g-v*OdIbmwpm{_WJwLG~u<zelM>sztl3P@6Af3wnc>vOJ<8-<zo<hzxdAE
zb5-|3#ELlPzT4v*@3!uu(TwHy#T+YFD*NV1-T!o<e~QTeJA7@mTes;MEm;|=I3Z-(
z`K77T`|j;oX<)kRoWA<}6@O~oWzs8NvRN7`#2%P<mA7k=eOacD@G_kp8jXANQ(v{R
z9eB9>$T^Rhdy0xeA{N)A<wi(ukiQTaWuTtIt{&=jvby)smxFarrzi5wn#@-8-#*MW
z__>w5-JvDU!OQw4b=*A_Uq0`$=2EY<$u_;Im*s9v=zpql{eZVc^pV2o!0%dy{WTN2
zxMnh(ys~!XF-Q3;d?C`xQr+`bv%m9o{j_*X-r}}AuB2DSPwtA?>OSR_*|^c#@bDp}
z<uiEQe0d8t30|46KYwjo<N}u0^YwHlnaAAq|0>&f=-te6_NpBRWMafi_(FxVE~n0l
zHCfo->HH>eo4dQC^Er(f@>dr{y_vt_*Jqcu{X85hpK^Bb*E<|dZ{9J3lUr8YN_hEW
z-~0O#mdo6hyZqk9U~i=Dg`zKyo(NiP%#WR8XYoSU^xT|N31Qc3cGbMt)whmad5?$B
zrWuhd^rMU(T{-Ukxg?csnz!7FZcZn;N>j_q!&|CC{^#G~$<lhU$zXbrrBuru!}|5J
zneGK``sl?MtJ?3X^(eE<(V|q>Jmb^9k0&1Xd<Z$8YStzbDl>P9$upnHYl}Ma7CzWG
z&1FSo^y%ppKKqYv%2@f`j4k<q<X`RwoqBWr?DP7vr*87~Z3}YWE&Fgp?RxRv=etg6
zlxT*={4C;-jEyO*DlFBwACTB`D5UtmwAPWI9gEZpdEPFUF)d!6=wV#Kz}q@m)kA<~
z*3TW4f~9xYElrG3?X+(Wy|;ybf!)+gPc=>%Wo7E=FT8i>E!$b1$>(-HR%Mqk-rQ3e
zQ0V&A_i6O@b8(Z`g<Pt#+pu6)PUW57dn8xuEeq06d-s<)e0trk-w&30&3kzDBD29F
zDW}OIpUu?+Z;SNRcrUWMHS?2y*R`<Y>w6kjc&TmO`cD7&TDIekmevk7%afdQEcO<7
zYTtOYY{iqWg+BQKbFTXMGZicd*WpWBu|8ET>0(OtP2LZ?7OqxP4K!K%DdgPdz2@5I
zB|5{{IvCO<h5khCJGS%Yr#Y|o&v<@!p>Axh&^{k4!>@MS{kx~%efz5-DzI97*1B@3
z3(b>XZM|u*%UZ|w{V(CGe@m{YR!xd-_A5HA%dgQ8n>9J`@t>?>74d%yjEtYlhrCQa
zXIJ+ta$nfTrwi^MJr^_e#Z~E}H`jFCV4v4`ZhKXMu5gEy%ar>acVzeT1=OFq(0TDc
zr@QFfSyv@r+gx+{F8Hf$=9O&qvXZtOquj%dRqmDkOr^68Y8S0$*>}-e|3%ZjzzefY
zt9EPt&ug2-y7KkI&FS@Nd1o!Fe@#DpSbmq)>d8ME9VSWltX(pp-k`xPU4BDX+v#~P
z9@V3EMyi)hRG2Eyzz|l>z#xaWGg78kQ28{ry7;l#r2qHlGd;hl6=W^+eClb{eHP_%
zw~Y&rt?#y-d3INfO;?LfpJveU_T07C@BiH;&EKS;a@u(I-jKOj=E{>Dm@`bI_SZ2~
z9Xsdu{hyJQPx8F*nvw}0_V}r5>Tkbs&ZcX5%@?bRogaJNihXvS8Rwh*?bp-Q=E^_L
ze}7YR>ZaiOt~siI+R~5KuuY9TyZGj@V@q_>ba>Q#?@qDdiL{z6o_cnXjsB|@e%*U+
z-I#EG-KL~9`^2aI3M=}WD|hv>&Q;e{nZe6v{#z}1{<PAwsp}&2pJmn^UDP#qwfkhX
z{@066Xx&^dSypvtNu<z{%Cn~{Pd?oLc*P^fLys5ryjrv-WcvM&9LF~tUl<~D)n=kg
zlfzVnq6>!=XQv*WT6OyK>@7M)k2<9^*B{o|J+t-3OoRRfi?r5etXO2eXHA25V$7Lm
zfhXI)H5Z6I?N(e}5pwKuz`mCKuZ7s=FBSDs+ViZuRPt!4M5v<O<lcu4q1FaE^A0aL
z-u-v?jPu!xF4@^U`nttqmExI#vyB4V=B4cs(LH-OEAVQK*s{twrkwtlHf_3hV8W5h
z#=mwiwMqG1e&CDEsWa(szkfbDN1nMoW&Y#HlC{=*t6A!|xQ0$tn!hCcL{x0wyg7#_
z$0ZudEpye`*SGFVj!#3n>&_RSU(Bsg>^^%*D=hU@=E=oNxYXwgeSWQdQ9Ja_mtS5b
zr(Rrevr2q^@Mr$=-w)sU|K2Un*LOcZ*WkyNrYovNEU%5u{&cj{TvN2|z}xNpXC`gi
z;MuhMGSd}@=zuj#1X?&snDrt<<({kE^nP5`%ym36B=pVm$IR7z_BEeMFE&aD*QL2$
zO4)O(DNw#CB(C8=%&Y0=Z|rW~FY`8kqknK;m+Qq(>;doF!q@0+NVZ9o&s+S7OJ()E
zWuh6ai%tqndlnqGY^!6h+oWruw=-ACy-+H8n~?A4@o%xumyBfPhr&^tuZo1lG;NA;
zd#bc%)=8DUpLy%@4bLZRHBXtms72H(=I*Oa<p<pC9|;M*xpC)?&GC1K|0lSKy;;?H
ziX%jbhyPe*^pxu!U8#Y5`RfY4Twak@B$_06vtvfP5~C|4*R@rXmu@I2o8P&Mcg^39
zUU7wg0Wu;*hZemtiwfb9;QiCQbYkkN{4ei&a*dPMH0EsDWx%HSjGv`aY)NRv>}Q^Z
z(LayPX>Q9sHK)?!?&9S(!AB>rXpwq%i92DJ#`^i8t?b3hE${wXu74HwpoQVrHW{x|
z7IPI}tlGloy#LWnmKm&4Y23?`PlWkCH|><_;^4Z#I@O-P?9)+I-{*ylm)BUwn-<6Y
zYIZPh?Jaqs-Q;ZRc{|Q#es%LSwl91Vyq7oXo@P_%*w@~_!2bQBHIKqxuIh0P*&6Wp
zQ1!)-r`#2v9<5?yduYBQ)ke2#b<bt($J*1f#FftQbqQVMTdcykQNI0H)fSU^_a)`8
z8a+uq@lKxY7|ZLp!(aTn*i`bPc~%8G`BawAa4P)W%xk;!6X(9tGi-(mQ(o0YU+8dL
z@g+>m$06$Kt#9Tl|16VX?8!W#r^ha4I;VB{q$OV7FPS!5%N|XAnf-0D!huQew*KRA
zKYzOIJNJpWHjPjXo#}s-B4@>~{+_nqN_FA+UFCP{EMC~$fA@Xg{k%{U)r6g@dzl#8
z7OdUo?l$X)K%W4MWLVRG{)c_$Rv&H@Pn+PU%DOUqwu|kSS8|DqOy`(Jq;F{Y*SCr1
zxM_~|qxrF$WW+99KC$*$QMv24mAk_?Y&E!=^Wv)|o6WULj@!ayw<%d~&nXiPZ76d%
z@Sediq|P+L%+HZw`qJGEG8Q5M8X6VspJf&NI2IR%rud#c%xUwfn&rb{t4}){bWi69
zebM&(!4bvr=!P`U9oc~3@4vq`T)VMK@5Z6-poJ@*xmq69|F<fwi6Mi3?%v|Mc^-dS
z-`u$@weyYW)CmhWUwCTl9da;_xzDF7%*)i}aDUYLtlW}Te?{T1*P=J3ghXz#yXfb-
z%lqS*m+RhdkZ|}`Z*OzCO#Ihj#y85I+xF_Fo;I$$<g9jWl}M=X%AD2f`zNvKmiKl2
z`1RlR*6+s*#)r>X&DapVLCvd=Ex5O-cP{(l-Z%QQb|_A3h;+33n3EW?ulGWJ$c7io
zJcQeRs|hibm1I1)w4q@}LfGl8J7zR5yb-<aZ|=1<b&5Y~Zr(lMa(>0*H)d-O?pfn1
zej&`cJ#cTrX0>^X9H%b)y>hJ!n`QvhYn{1E4W)8rmagl(IPu83OVS&15=-Wv%Gme4
zEW?OtO}L)))Uca-P8!{k-~BkecykEX5svFq7$?g%&s!209j~vH6tOwu;IWJ*uZo@>
z--?-YL^)Iqv}&9_i&yebVEooq_AcGwh2{_G)B5dST;8sn5EmZB`SNU^UgMXt*YPY-
zyDe^Ke0|NZ`|kFyiaWiTOd9q@Bz7cCt}QP88T|f};ffhL&0VW^Xt8`SkDGYu)J6Gb
zBaTVZ?k^lyW-eT`Yqn|R+;hg^r7t5_MJT#DRwPVnQhk}i#1ioOAQQ{ctE=bkY0F#N
z=G)1X^zLCP&&=m-s?1lPY`^|1d%A($b%8bftLHH+td>=?ThnmD-|=|fqtzGQzY<*#
zxx7d9$*gU=@2H8_-ATKyl~pUX+E@SU#_3m-*>1?QT`eoTEzf;*lGsnBkkw1yz7BZ%
z@ZoxQUFlmhTHkZU^K7|4<KNL;9S#in8?w$lHaR8X=D?7hX1;l1hjatq>}3rh%LGNV
z*Gs)|bA1(&WctuHjcLiT^72p8?;;|delcg=`=oQYerXuD)!z$@x+y&uw><EXV7kY9
zJW?b+S%T}-o$AGVAMgFUUH*PG|NkkO>W<4L6n1U-RcNvQ^6SRV=zAZRXf*CE4H4R)
z>Y^mSuks{AwcvM6jfPcn7vt`oIkv~7<G^P_H^qeChrefvcAjO3PIZvn6%u%(;p6TM
zw%;cwh+6Lc{qFXM+xa|3Pu3luaDV&#j<N|)w`-o^Nzh7WS)9K=ki}(gQCfg!cKTfN
z^~}Yx7PbG5xIdZSDDQmfY?4%s=H2NlrtSNy*5YW*!0YQGa5iw2^_=!P>9UJL{g*%8
z%8x5w{%*lHts8p{ZF&NPZ+dG#YtQ|r_JhxtZ|BU-cb}g>`GH}{@q3ON%@2M*vLnA~
zx@-!+YN}<|xdTQ_Yyz(ieDDok*w7JVy`24^_={HeHAgBV?=0c;cM2C+`#NLEC)NM+
z)pXB(s*1MN6h5GEQu6v#+4VKIy;O}l*cY2HXXRA>UN(2tH;wDtHg2qH;p$s_p)->&
zf6<zUb_}xwn`8`*JI=41&cKi&+MLNIXl(K>dSYR`;eORbUYmJE7ry0I@6)*<rv0q+
z$CGDVl0`h%^R8#4ow)KP&s)B6owWDi8>UOOZ&=Rv-}J)E;4;gEzj>v1pO|Q583)`j
zd$vf?`=`BAMr72%WU-w7X$QFlT(qm5zWAj3R@g7H`*H8y3)k=32_fh5opYsT##V-e
z2YyxZ?s+A~e8!+ryEJL-#B8P29o;t@Vzp$%!+ldrG9`QMXRP*2Xh~(3FluGq;-qvY
z`_EmobxiN4NU=B_SR_?pw_bBUgLzR_W60jdnO~;qn$Nk`d7wDXE#WxZ+8b}pRA*Ie
z(0x$nJ=-<pl0{+j43WsNJ560Lj8cx=n>uH|?d{u6=>dH!7W*X|NQ>RlH#>ELh3(^k
z|DUZLY8yTtJhQ;}?k34&G2eA3uC%=JN5fe|$bIT5euw3u38habcRbGD=s)L=*#hGm
zFFrhY`|{jR|7b@6j~LFJGYxeoZ>4BC$dvs_EiO56Yt?LLk#*7U8aZ{#&T6D@ex)Y1
zH!yEH*S@D4{Ia_xd|A$1dB%NHc0u@pz`EICQ^XtBCK^9$*&f{ddZ+wM=L!b@iH0hk
z+madO*jkvhTN?J6pW4&t5+2T|!}(J}SVYE-{pvC%y$H?4oPtw!UDG;hQq8M%Z}*Gl
zX`$UR(-dDgUHBF#%Q|bS__wA#dlXtOn!A;TYkpP#xKQM+IMa_7qnABmap@wt->ViE
zMxNm7+j4b@=gLzvxEyji6@I^94akmv@**d&<l@6+?JxgFls?c?IDFAV&~c*TCX4fj
zPES7+T%^c)>cqkGJd@K796Pw`=U0y{uO@2x#%Hd0n;o@x9;as_^E)MDuM92eNl`QA
zNE8<>NSxWzekddVs@f#+XKe{$s$c$`HmlAw*vPc^%+#0_YIg+!e;)jDdsj?}IxnNC
zH&@)#I9{%W$4u+JwI|BlX^3<b=Xt3g68S;QHoa+Qpsc@cQp7shj4Aqgi(N0=m#eCt
zA-rqFOqOPW=NybZjLeKn7xR_o*d2SJx}7KR_4~h0H>S;AoOki}${nt143?=j7b>>c
zF0yT9>X^ZFeKw0`<7rDpmco{&9LHatt8VU|{x(T`PCEOBsrTPbPYsMZn{qUC!iU1*
ztA-mR+V_drgnU=n>~Tc;OXQy=7LA;iM?NWvYP<1r`|GWom*Cf;IrmZ@qik-0-^mbn
zzV>{3Ihl8@UrOJbUkJ{*bLEPF*v5>&m4}-j^QTq5VVP#WV(#B9pHJHf*j7{@tGUIc
z>vUGeM7ck$>g*JmEgyM=-)5Ybz7TcNcdZJ~XC2qlgurMK-tJ=(?X$QFy|`AExCu$I
z?65PO;pW}9f!pn>!F~ROzPr1Vm`<sB9=wsY$Y-T~gxgdZo(sqACi7kC%TM~0+p>7$
z3C{CN&lWbj-(C9m%&NLRxzY#$8QXUXg&IF@R3DL9p>gGxTv@4{s_mmS`?t7<FM2MQ
zy*PtuQ}l$1N|yIBoAyjQpmHSRl=L;Bphqr|uXFY!1Pipji>S&Lu|M_WWnS2d#I<_^
z*EqW?mCaXkTaw^EO>d3+<)GgZd)^C)haF2^CEB&-lB(|Za~k*MX2cg6JejQKcRX|2
zweGl!l6f45g4(ofK7N#NnDD56cVF$rUlV*6d^GgBHvhe<v|N=1vwcvb$FIEodp^}@
zKYg#)I^W1kwyxrj&AMAAyxvDkHP-Cht-3Zg?@VL1*;4Vaj{=kbew?T;$#mI_!>jRz
ziafj2!Ng5(ClyS}3thOCbHTOhoA;U*Pn){urrJx(t-B5c)~>a4Nj;ueAG53?@uhH8
z)v-VJ$6bp}{~Al#lm;67e12e&=j;8`Jg+xQa#X+0SiM?FTw7#D!Gg_NzB^ne`>Q#m
zcC^VkbnNW-;k}!CE8B`F(=3N`FL`ftu00ei=(c-4*ThFzO4aO^ZnJd``z{DLwlJV0
z$%d&avgilP*OaBRE*!CSv|qb@-JR^Ly<bz-FZG+Wly$e^E=!?vB3BYORLxLrX1S)X
zV~}4NARoVAuAf(HWaqW7yHd~huCo*WXSBTe+Np}yYrg3jysesA(y^Z1?tF?<U$4zV
zyFZz1D+`OwWhB%$XwO>DxvI}QbIoM$$*C2eyd65VPB~ueW@Ra|$o_spZr?<^IK_2I
zoKX`sEggk!@CdHkdTqDO!wanTA}i;+nID><#K7@|dqzT(t}my|F2_F#3w>U1pX(t1
z!St!RXyZw1;b~G$k2fgK(@;C@dQ@?%|AguD&a7y!75;PcQ)Q&B_=`-XjH}lpCcQsV
zC}eoFG*ithpi4<;gMZ6Gh9i@Tr1f>Omds3%lQ_lMz@XQcx{`yj$*|S0<+Gcr=*=Y;
zBvf;{m27@7w){GNV13vA%O5B0SC70FS{dKksq@sb-S2SD$=Jx|85j4yY^wWUwbg6g
zsp&C4^Z$6hyjy<4wnH&xro^!a{%LQx?N11WyjI*K@PUC#FfFNjpLL9f!jnxe8!j~Y
zZ<S^Jc=>!GyGucZeusU<YqfVuT@@b$7CTLr`Wafx(7Pbfg@4x%mYr`-cpW@1v1aXS
zQyc#+%saQ4lpou=-Mjs?$NMEO-Y1`A+L7`jb#dXbQn%SgubG2Wzdy1#H2DG7<E@FZ
z56?~NliXf*|Effz&*p86%alT<cz7N!$&Nd>s&V1N^C$Zz@l9~Dnp3c`=*!Yen}l6H
ztklxzo3YZ!;zF4BwxxHnM1FIMXx@)MP<P{GiN;wzzJ`050h?^rYu~6SSR?RxAs^qD
zM~m_v#<6-|WB=lBB7aTX<g8lsqc18K<@T&rtL(mexFYt&?$h@5)54w<e5hg#SJD5v
zYVu_lR~_9b?Q`>PM288ea-Q3{be+t{)YR+;Irh_KrAj`}PC4lwG-u6*t%sSHD({cx
z5q?x4ZRV$5^7{LpD;f*VrO4T=coThm>h-h!|4;2H2|7RH$tQm9M&YgX5mTZs=Ox?T
zHeoCNbS7qvOuz}=>pwr-^)%_+aaf*lXJy!fg{B@1bJm=F_wZNF>c+go?BC^P%1K03
zGSmi{CSNJsbz?#LlO~QOfz$r=8XH_=%(&~4+9mB}-gM1gPd?(&WqX_V)g^iNq$fB?
zu1xo?cG#p9bW+WGx6)p(1!~tloG*&1EIC-eOZGs^^y3;g&XoN)Hi0X$an|40bNZMM
z1vtJ{)qe5XtmIkXn+v;L_-6exYMS!?a{1xIYo2a6^Q*e8UD_g-GdDnP@8;ZFcDp^5
z4Ocq*+*7tc*rQh(Q0?`!Axlox+S&D!WkTK*DfXY<mL9@hu1;k$SKFmI2Zrc8-s#^g
zvta)7sXYBpZCpP*SS4vGmv^YbYn$fZMn~i2DO!wG6HYE-ypjGaQl$C9`+4&gaX9R^
zonE=*_@uBbg-a(7$@co2z0cKu<-Fmg!fx)gqAoSloctY;dH43$+;FMWJ;39%_^GjM
zj9NBJX)8~)dcx7wi+|aL9L!}9m2E!z_v&E>=VWuEtGBPDT;6?NZjbM5?L3)x3(udq
ze0#B>nH!VR<TfjFah4|nlZ`DLW#2rQ)_p(u;j>k;n`Vg~Ej8wk$zeY`yK~F3cc<UY
zdcAaluJ4xUX$j^cf!8;ztmwFxeq-sEMR&#CRYgDTPEo$H=CO%**9E(rJz8tF#u?o)
zUfF%pApBy%-ZjF42FKV-mUuZi3$EcR_wV!b@B7|={`?$S1Dg%~DsF!d{L`(_+$>Yo
zaY)c0WY(!_?PoDTPFg-O51SSmyyCpEsid;+h){`@OGN0}<%-LGH!YD5Nq$f_ZT{@~
z-%NcT{!@L_F4wX2ynnpmNvFxKNgl@9*UL3KdV&`mZnPKGZ?$G<7drIpMfGy)-STDk
z-nX+K-`y_%{oCQa&GF}Y<}rR<9&qz^eR)AmL0v&nj*y_D=aYzO$1;68mtFXs#rMTc
zbkdP8^U5}}ZFatuFF4Enz$K+-PY0i{nM{qRB&{_{ip#B1kAIZku)WpsUG<q4qR+e~
z)t|i2;CdhMS>xNn=Ukj6i7D?Bx&kL>IGulIb!=|r<096LS6?<~FXP=Mc4pSj{Qc4A
zr03cSK5|lzzjN%I@wbV3<(;!v>7_Z<DlA#m^lRO<xXyWRFHKWk&N^l4GqVhZsERDX
z!zCP3S-RZAo|W%75Yp(udjF*j!)HV7HLE`E2`D^0xlyIc!Chl@hEq$!W}Yd`yVz1Q
zUslV!GWn{q_R$KLcKM|}f#=G;KU#fF$>poc^{HQCwx4;W!Zb@;gk53Mjn!$7n&&Ah
zuQ{L4oPGD(M!yA{7VJ4#%s(}4J!jCCC*L&wdfcjfylth)_MoS-m8&mK$j!^QleexZ
z+LWw+UGd{#FQN4@%yN5;n)FVjh8#DDPq_A4f^p4LKK1u(Z%>uY+u1Pp=tbvlwx`ec
zneZ>tys=2jDSXY@7vJA1#_qfJK5e}}^XDk-%t+Bk0-Z-(@|(i%Kg?nXRXwEOtkt;4
zU!CW&%rAM>Z?mTE+pM~nWyxXj+rKVZJ7^V41at8JT_>WY{YTQ;`Rl!R8+Pbx&5nJ4
zVMbw7n_a{5Ewhrur#fYbiso)DVq|Je?LIHXm!nwS64&?bykFnp_;3GTKW1c$?f3g;
zC--iCt~6iL`}@Azdpg}>%3Vud&YSb-*skIoYO#kef3(Qm+9>~CMpyBTkbbT>zg+&q
z>wn|V35eTV%J%-b)^UbHa{H^3yUXVphrF6A^VrJ7eA&(?fh(LtYL|bjEVy^ZSkETx
z#l?MlWTfW33VrHxvv7}@>&b~{xn(owzI?)7u6SMInai95RWd7mZ4R0|y8rW>{`>Fe
z&pS;Q4ztuTd8_}ygZuqP2ZeAO{?bh<CCvg0OU?!Vj@^C#;jD;vFW)+qmvYM)&-!rW
z?zDqDPPDuhn^LrW@50QDJO5s6;B}~uP+wa(E9lddH4j2G`_KQ%w4U2mG&PIGOL7q>
z$A7Kd+P*E1tUm2bnS8uT>(91j1{{_g=lxqE?r{HF=JJ5i(Diz!`j=?qwO;##pM0sj
z7{B<<Dxc3wO26w``gN<=`0sdm(UNh)swEEl7BP6NS|}hU8@D+4osyFNI&l$o`-?6@
zZOis7YkslviIdIc7u=$T8N$n({ciL5e;2-cTYFvf$Gj&AHq-lq?>@*-|DYxA@cx?n
z%Vsvi?!3}3z9+sc-YucwRyy&8>up_?oAZrqXV<eXyJ>!7$GR<%`e`4gwx`T5sES-4
zU$`{mwet1wMeoiyM!r{CUS9t6w&>Pp#qN7A2ge47&z-qkX4mr|Yw;kd3$G8%=8X1x
z($W#4x#z`>Cko%K*xv|0Q+yGuSr{2IHHJGaY{j0SEm{|Py^h<y6gxM0^M8Zz-S5lS
zZCjE$C5+>_QmxUt;)5q9{N!uny?du2R@TJL-#2LT<Vl|kr~Zg=y0<>kEqsCOCfDzV
zB`bA;DlT<<$cP6?c1$VFbPso49nmQM<%sLicLto_U3=zE5u5GvYQ}`w#xJf<o|{td
ztp7MfA;InVtd!)w3lD_z92M8Qd^1;OxN!fE$iA0xpPNoOMJ`C(dgAqqbL!ta+S@1F
zxZhwDUbfLz=9KoA<Bz6qb>hzrU2U<m;A7RjIj1bL))l(*#(Lb1+$BE!*Omto?+?6v
ze<|4fZe~bpuz|CKWku4lf;sbC<9@p(FyC0lTKTf4KV^%=vJDs4ino`?om<2`YjU1^
zo$&mvlbv+fmENc>oGq`Ra_IG|>U!7u)kmJ4n3{g-{Ey}bSNh|=H!V=y9GN_;_rks2
zB9)w~x3YqLr>D*@cz@GMy7}|3XH%u$KeyTH`oN|`c>~j)e|n3fjg<F0Wp@9*>KxE#
zn51{VTC(Q1RmICrVVn4M-wj2+Tkh&C(K)y0Lc-j~h1;CB6f;+4?~b&2v75nFe+}pH
z^o^yPKUJlF>$vsQ=woK*>UK8ny9c9W-vt)_ImfGU>89WGXvy3AHmuVy&FG9&-Bhxn
z<;nlO-+!jHU6#6g?VfWz<GEGZUK4-Mh<|=Gw@+!M#t*JwYomy3r;jOqZr!xJHskrp
zYZEOvpRW0t+Id=IZc&p>O5dJSezL|<veN^_uWK?*zb2N)Q}#$!<G#@E%J<FRu6Et~
zb=Snj;I+V$!`JHdXWy8z-b_E2`TI-v-CHu+E;pUg4*vE$m62<iUu^a)k#*}{?5_Rt
zYwzLPd1hMmeo7Wcxwjta_hc!#chY<s-~PutBn&PKJU$gV@vg&eMnBiMaPjq3Cpo?K
zjKbw5?pi!HHteW8`LSi^RnhmY7xwG(9cBCXD3<e7>$%?jKO|TEtrGFMGFg1T*Z)3i
z=7U#fbuG;ZTX9gQ(6-}?+~3zyjyIp|+q1)Wo>l!q&(1kdJ*T7z2mF7eU(&z$I>Uro
zVZTL@vvl?57tG8KRd)@}mzK4#wYXdUTl7RflkFS1rr3E?)W7t6|9oz}^+SJk_un)A
z=}vxoY|bLyqrA&|JSJA^9P(teK3n1PPvX=0Z5MYeSU<UE-P)O&9<tRg?kmq1#a>;w
z#VLK|`Cpd(KQ{J#`NE+an`U8~<o1$1Oen^i>FJDugn6!}yA;mu?z~;CeI?bo;wIy+
z&9O`WM!K6@a5k;Icy`L=KSFcvzft|Y=vK&*s>GCu@4PkT)YF|c+>Mxa@%Wn<`}}{D
zQTXyq)vgPZJ(t&R__@_8baPDa#TJGny|^vYf0l-Bl>BbuS1NnwdxzbP7pZ?&UD%T?
zCATLp>Sz$l#wXuZem!<?K51I^ms!Yrb*rfU$CjIA-#<#J9e!+n`p<^5ajf?fEiUX$
zkbnRG`K0PBnGfr&wzEcU)myyh(2AA$SvQwE%r@Qm-Sy4kTaSG0t7kVn2zub5d*{rx
z4TY);-aN<`Y&x{yzZp}^{j1j-ZyWv9;hXUNYV)rd?T<EYIQ8Rt-iL%pt#46P-zIje
z+*Y3PDUR=jll}{b2UVuo3y(zYarN>~d}p*SsrvP1QSblppGAKq%wD<8x#`}&<sWLg
zTf7ecdbiH+N4Do0$I25Qn^(@+ad`o&LS1Mt-)2`1k438|75_?9@8P=4spBiRk>k<S
z23d|Bhw?W(;K|<<uq8B+<=-zaz9UvoUL6zR*;V6m&x1wxSm}c|Dre1m*bhFeZC^ZZ
z$Lb5WnK<XDept#{&9AGybal*RMQP!EJd%IXH_Tf3nvo&n{*PK6|EjmvcK`VPpBI%s
z`Y>`X>&)&1jUpcXjK=U)dnXo^T&*>@&^M)SpVnE!$+MXLF}Y2NdC+X7b=-*ei@#Jm
z-^M*wVn6Rs`qus5YysOn?R(AMZuPe&J*k^(T2kD6Xrt1eXQ8`pcU*k2ZLx}H@5F7o
z6Ivg<>58_w(#EU3YG?6smrIp9pPk#|`)y)w+|}mm`Ek2n?L4a&>bs}(>grj0B5p~|
zs0o}Iwyx^d;dkpa<9BC0+Y=WUxTo~0v&GIui)!9J@jd>1e~a^~p6k&oO5_fAWGy_;
zAM3`KpZI$9o!=KehgzNbKl$#|ciI)DA5-U@sQ(*RtrVN8X&kEj;GVy0+2n0|&!60C
zqSh;uq5VCw+J3jc{i$lNM5bRVA+rLs88X5oH&2V{j(mOoOj{(Mu*V98)JZGi9q+vR
z&#*{B{Hel;zPK-S#zr@6Z~ffx{)geogzry&+&%dF!=EQl0(P;uc+5SLe!H;AOYGAA
z_b>ET=6lQKmAL8GZD(n}`qQ^X^s$iXG`=@q4p$qpTz_z`&f5CE{iMg2_W#$YzVo|M
zJkaOaYOB*7oSWNK*6mAw)%VY|&Be5?U-4#n_3pMOzwU}<dnjeGDId_!=IJ<9f3sp5
zS6cc4C$)<Q_xn1^oi{WH{~&k#E7Iy>o|RuC7B)28h!SRCXm=qnp<kM$S5UdvI=lGs
zj*0jGY76WRT9T(RO+LDM_qw2WYR2F0#iXUjN-i(bT-)tBal#o>R|6K!$mgHy_rGIv
zU{Xmvz4J~%_8t*VlU>q(-9ER}?)~{A{_^?AL)<5q&ku^ba?|MXRn_YFV<&Cr&ud@q
zuKuQ3qdaumuJt#6zPx$#%bzcQdhXsU{$@OVQG(|E4>41+XPn8BTi@R|ZED13jVQCy
z;Ex(fH+PAIo_(}Ppfo0Z(S$0W9UZFX>(|R=$B7pHn>c+BL&&7q1G|2&KHf6j;(A@h
zZtb7bE6$p3`II=dBWdPZo)fd%ud-KN@V)4K*!0o7bZ+A-`vnbDCVia5{zg3NrN4~9
z58o75k#KFv4ZQ1BZ2E*Y>OJoA=UK5yXth?{X*)&pS34!s;?@^$w7T?N)V$nj*6#ZZ
zhQ;ykPpygA7_sU0;>9^9^A6wMe>cWe{@>$Qhv(bX{(SkV<KWVVpOYqsE?Q7)Fr%cu
zudi>C&9q6iIbyQre-tmPbG_j7p3QoB$-!$&+iI%37br<=JkjNSz{^nQ-1CNn;Ab`W
z9y=aLiM@MwqvUTTE;|N6Pq}b~d`+GmeZ?pHGdxaBS8$7*cs1~e_dI>(umgGVN*fv?
zzr-1xSGvl5<FMFv9>d==RKLzScE9a?_uaW_{Q5Vi?D?dgxcf-Jh8li>FKXwK*s2bE
z+7V&;vFrSvE3-=y7%vKZWJ&r^|CW2NzlL2T-x;3Z&HnQCFVY#k7pwMr<`?uXE-MQ8
zT<W=qJ%RU`cAPugocoCkJx>`-Cr2v2-r=$1{#m|VN2@fX9T@gY-&16`^gQ&>d*85+
zSCS(WEAH@RFwP8Q@aT24`J4CY2;-|0$r;|P0uGOyF0n6r+`4cr!_F6b7^;^Q^d<y-
zYT(!Xx7X&X*tOfM9_A|_a}`)-p;LVSQRq?087Bm-UsTKg|Ky%@I>^LTs%r8>zZ9cI
z)7M5>PO$8Vy!e(iGh)RC-hkhZ57iAmv(7r;HD$MrGpmoWq<)cIHrEFk{)8>dS~Zpl
zy=cn(^Mdte$+WjOdA&mp@IDO7)RWF`$x*G2N#9^~JMHV<BJXeOzVK{cpTRxjd;8`O
zk92H4tNq^-E6H;-yRxS`HJ~o&wY~DY9rcTU7~6MpuTR_Q@klCU0n>RI^{p;voqq{`
zIY0UF|JTbF8*>Hk%Lr5Om#Ns#7R@22p6i+Hzn?jT(@>?!{?n3`g{x<pyRB|NythDe
zRcXxcjQ>n&Zw+SZEckYBzR#Sqtn-euI_Q7aIr(Z@_@*bEx10VmC$6lN+Q9ZB?mqML
zZQu7KD8ydn`^Y-2#N_CLB^s@QXWvC8Zb_E<6=$5r;&wjV`PthoyZ3F0xRm41%0KaB
zm66DNxj)HeGD&kD`jnNIIb6O}?X+p$|Gy{aeR*@!=5A3~!G_?i3H+@$nC>@}J8-o}
z@aRN@eP*%swPxO?aY+1_g;c-5qr=x3^k?b#8zwxISeH{d&${5H>E5{ue}B_$=X%{R
z>1e6XA;l?jTNP)#-x_Q?WhP(u{Pp|(eQFJ3@t=Q(n<M#Y&bz6WAGnej`j70|>$v0f
zoBap>v%EM_#J5oWUef{Zik|JB%Gn#gy;GZfAc}2ioW4`T4E{pTJ5NkoShs{7Fxl}f
z&5L>W{MLvCZcZmII4lV)=5%Cf3G+_Kt2T~R{kCeQM?%G{uHy_mN0!aDTpC{#e&wTb
zrCaM(-TSt6=h<WmR5$Ino#*Vj{Hcw6Ypz6vM1Z@){nPAR#s{M&@GNX_wz<m5H{Elp
zZpD-}7w4RvD{AvuY}>g|{u`%Wilml3+gQFfg#F!{ms2iew{JOdDM$I&ms_E1B0(FP
zR^0lRVrTn$jbk}`npnAf*@W;=@$4g&>tdJZPkzScVle%0-Z8(}I;%D*l}l&RPfKj@
zQe<LtN!;jp->mY5<EI+;V|;8pYcEc^esXW3A?uz4OjQ;S-rP+vddQmK`t<T!rzb1l
z`!U&m+_GA`QGLezj5$u<%r71gvJMNkp471PMDa$~ZoWTp%@y(A9?dHA{gJ-*#<I*h
z@7`RU4^_L1Sr|<-7>W#+<V|5=zI>2dceae>tOPdgX&=12id;6BI~#8MqUL3}{D#!Q
zU&3a8nQu9lhaWp4tH0SYbTLoN<^U%f*BNr0@A|w;jjwbm?l9D?T>YiL>F(mFa~F0C
z-Yb8(?fom(CP$e?I<gh&E}G0?PJ7tCNz`nZ{(QD+k)prw`Kmo$LN&V%Ew`0+zQ?AJ
z{E2sw=<-YKfm;POOjltkY<_p=x&WvBjB>4pp6wI=3aFJBzdO3^u@8$P8*7{&Q%+0z
zOwr6GOSOXJ?&!;h<<)gdnsr`w>bNsio#UwI<8L~zdTaxCX=DV71wWXoDsWO~l|)>_
ziQ_6y7Od1%>3*=gF>t9y(2;#&wh>kqj`D4#GnRE_|GliTN2Fjuo2I8+2WM-W0JpH6
zfz8qli=SrQkiN4qI;2BhVxDRLM6ZB|gh>GxA8*nWy7g)P|4(1VOr_omx|le~%~A|~
ztHi-q6Qm~O*s(u>{n>Ge7TNob5^noVc78a(+xNFB)cw@m*%|hyH(N0aX76RrEt<~#
z<@@bP!5xxvVU25rnOEmullHg%s$l)|!V8|`4^6Y4nCf5HwLS7h$HrwV4jTV{dvQ^Q
z`G3jRTEY7=UQHAE(yA5d`1|^~jgec~U2h+1_^qn#SakD|+}6y)=8FzW-@0b_fJN}h
z#YGP)e?7V7(fe!j_Wm0FuODUyupPXYkYDg|?~KN;>kQ}rDZ3$iuFPBex$L5Ht+}6_
z*2}k)gjlkDjGowb?5*yTg@LaVtJ<}9^dIw>qOA5@;7)GvCi@Sc<9ekpdIki|dv3De
z!30^aF9|R9Ofh$6lNXD7*L_b-+2fVRvggM>9?A_5(3ovoah{X^?dtnm9&eP%h<g3U
zouxS6!zuM#qQPCuhdYiG1-^b7b77XEo`A>w<Q~;eQ&$|gvQ~esdAj0mt(4$G(bDKt
z?hk1jWA%*#IaO!cU7GjqfO2|gthxpN&8=OjYi4?+-92Z{so{1e?Coi$BEe1lO~*WR
z-aclLbAF<v$o5{X<r>e9T?t28B(3%-NN71Q3SHftEOU37h@(KC;rfh?K{6X2)QfNW
zF2KVn5%}^|_mfgyYqgo{`NVcPYoAom<(k`dd#3cBcV~M_WSTy{zFb^BgOP{f^?{D~
zZM;_&@3ju^JNwykrby2$8!P^%`OK;deFWQ&3M|g8kQa$dXlS^!FXT|ntmPH0?H2du
zuBz8q`D4wt+qV}dozhwPCCWF0Rb}fpR;MsOi&M*7^gcU&{9C$g*6R61tJW@b?)3Xn
z9n=}c@TrG&#|;IGQ*1|5Qy64t@9laNaQ3@V=<IbnmtQ}=$E$0Z*N^nqj7#~R9Xz4;
z&EkHf))DbHw+hp*8->*AbZl3V=dY}@xc~j*zSab;3&yU0Dqe1v?VWXDa_SA&51uxR
zJr`L8Kd1Z-`!DxOWX6R?zn2GV`Cc6_o?-M|OYxQT(qylV4^{?;EfV(Jn_Knl#Lc_i
zJ;u+K9$P)j`(Loxe}>dW%lI<+d;xVE5h2eu*1G0f25y#$h7*#`{ywI6Uhb9})6}U>
z=dOEbUC~H-@#LzOfzievyk%-Kkx!hNf93>EPEML&_Fm$b><sOlOvOH{>#ugpOLwo6
zy;65ze&t(FgFn)>b&a!Sjjt*n%=>3!cJ%)##?XLj&Enk~mh3s7yhpEim96ER`@-iV
zww*m8S0#SO&f4Y0Tcu-S>!WsmOgJC+wK=1xw8h(%^{n>pPnZ0;szhD3J9*u>amgx3
zD^y$mxA$siVJnyH?iEix1gv#fr4BMUo}QYJ(dMz;g{kPRRoLHc`EiPRFE5*fJu~Do
zuUx%}Pjg2B5ARX62O&Du2JX-9Ec7jBp4g}#e(hXE33FzF&bIz#ik9sYP29w8ExEX%
z)J09B_{WxzeJ-a<+|p+r<nCnow|d9P3ZLtfPo2*_JJWBnj5YIzgl+TF{x@r~vQ)nP
z%QV+Df3ZyPlgOj4cOIn51y^jFP^^DczPVQBiixjG|6+AL6PwMZ7pAP;+o;~&{AJnv
z4Kh6maSb}JxjcSuk+)kGko8mJ?5?ayw@r=9v*jbLgsOD3<m@f{JL5NpJDz>}^*!H{
z<=<N_%uo0Cc(eKX;{$B3r*tu@#mFz-9bflrnM*&r1A9QvT)w^2<W)p?|Ac=sy>9S5
z!BA@UD-EAc+q`PtO{@4nbE&Vgu=5M<u)4(dl<!%i?Vb&8ljQ;>Lv#C0Z@c|m;#@UB
zcy-N<t3KR|ayTX5?BtvwvMJ*2fi>*KjeEajvOQ)})X}@>^;1q^>jyQT^*Q@Hey`Qf
zUwn9z!OuEwW0t40#5ep*C<xw|d)~KVBj@!5_svbGKg6A|dUGtIHtI@c;=JA5hn*E>
zor|%#v9am7`12W)OeTfD%A1<@immNbP{$mjY1Q*yPgHtdv3Y%1+xy4Mt_95Qxy9v>
zbh&2fyrVDG^v()>vT52quW{MCVCC>`!>Qsyrb0=!yH>a-zl!?0|4Nge+Y>&Qid@$l
z-Lh4$SAL3Xe))k*x#4ES;x+sZRki*8vHbT{KWA~Iccd#wbj+#yWW(bS%Eqbvmh(o=
zvW7Vd!Cxv?9}Jw!)z`6l=eJutJLLUEk6+I|`t|Bjwx+-Q>qCy-mTYTZzxIWU#=c#z
z?kROHEtI&M;dsTWc!lGE$oDhM^w`BR4lHsq+tX0+fx-BpZ}EFshwIB8wcNE*FPDh)
zQvV)wb<-xH**v|!>XWJ`@YyoQelTvevwCnj;qGRS%c57UH}M<};Qt@;S|P+Je(fLo
zibHI#E^0r?@@<gxzIvSN#_E~NB>XqCyEknRtn^!(oYSqU5c<$K^7gcFwY9FwdJ39x
zW(N1z7M*guV)ysd%0;hM{o@s0_%PFG&w+=@`fE0;WgTDEoPPPw+S_Xt4dw>lE>{nX
zz2F^qpGQ~b-pbEHQM}$A0#S#h;#S<2&1f?}!+193AIF|a`?&Wk_u9qrcJ<mr`~7Y_
zm{;kXv3wQRt}9Ed7A{j*cs4nLYo@KAeEko*U;lPz&QrVi^Cf@!<<+m{_4ob$*xvnJ
zTs+-A?mxr-*!l7E<L1u&_xgADd;Nbu?#1QI{AjcE!(mRvW$TXYT)*p^)%Ts2#YOY`
zwtau8S~9(Snvs3%az<t$rfptxC+)Po5OV0k!)EOjj;4j1{s!~^+}`K0gypv8mA-F&
z6L!s6X3KMMqehF>^1#%k>sZ!yPPx0`-I}$stuE2ZIdV7FeQ){8a_rG#hU!yqEUR{{
z<6mIRdn=D;$E2$(oWu$qsCct3k6OA;AmHHfB;FOi(bLLjJAIqu{C!t*4#TmCKDqDT
z{FeKK&$>OKZSn@?Tt3Mh>8JkBmQR1)+)}s4lvjWEtzuu<%oTp2!2!QNNS}Lj{L7WP
z`ASa%j~ZsLtXNU?u{Ph>e(t{t@k{sL_5XS+cv1MyoYluaOv*jyeBs82ng?RmH+I<=
z+_Ow%QGb<n<n5V)(9UIF+Do=h4*BlE?-FrR=#AMt3HCQUGwQFG>GoEY<u{jIe3#30
zm09JJRkh3HI}@I?ccpC!RJOY%rt+^t;^$|(yvE+$b926)*VUcuFBJB>uXF2^*v;bS
z?OuN7{#436@5qh2bJI?%E)R-M|D1BY>iSQk-y7bpH}DTo<v8;_{{H`;r<d#7m$GYw
z<!_3+C3EPefn6kTohPeF;&G7&E3CssMI-}Gh^XKA;Gg^9$-M0|LsxI=m}R&>{V&t%
zg^Cw)#T&0G2=|!G`SMBcLGP<0Oza)28+J=s?Vq@~Y2W_R=PX=#2|e3pHJ^MgZsjiZ
zMWS~{f@!)+mu;diW28=Pof}U`sL7cFt1TLN)HWzvdQC_)-dM8x!LsZU7L8h#2H{55
zgqN<a?a9B7McZyU9_6MNx!yrWxQ(mdyNpM0-LjVtILfo1=%%sWUnEzu{OGL1ZdW!2
zawp$<S91GEyYr0O68qPS9CHX_y;Y%NU9shSPz&!q_D!PEEb|0}H?&VpkYeo;mxwFt
zvMz8gTJa*vLWAKzU-FWQH-E&`+9z!Kb~Tyf<TmN{1DmaM+729e_|xrgRKY5qOxxVY
zy@H<G!m_?r)X2WdDY<6guMt!!X?C+!F~-`;V#4lQ>-O+ur&-+-IGyxdU0S^O>+M1b
z{m1_&@ouj8a-f`TgO!jmf0VG*rk+m0H-9|kiqx)N7Ztj<LGwfN<a@itUIo^Niq8CU
z+hVPL*juyusqr)W1MQh@i>Eq#OuGEL;F|BoGut=$B~48fT_$_!;`eL)ug>fddUR`<
znY?C6yu<CwzPxVRSMN`Lbvyh(J==e^+HX@9?(%dw#aY#1THDc)A^Lgod0pY=I_a{#
zKHn-<|NhVX@a^>FJJz`UIl#YC_j}&2!+*CsZ4h1jS7V#`jqC9;E2QRY1@>-xoe{Zk
z*O7?3KE|E<{*@_DHvGNR?8M#KwwHcHU0YPRr99oAt9kn6%;&MeQ(5f;7Ue5!{NEsx
z`ceBy*^JvMUtgF{c=vQ`ymQr=Z07Zhy2*1F=@<1~HeY^bIfw6+mN%kl35>fBzPC{Q
z)FQVh)xKeRgH|o`jiupJ)9d%Y`af&mZ&Q={L-hyM7~LPSPh7-kb;P-ri@STKqE(}n
z^^T(l-dy{1<JP+Ambv+=Z&D<~1z5Lo+Adimrh8sF*R6VHdW_3^<t*!}@bueWiF5bF
z@0H5E{+@5WXy*pW>1s>YSy<fG-+zPsoO9Y&K_?!8O9xlaII{OU>-%|^1<%)<I8~>w
zF8BNI1pZlpT%G?}QMcI`T>klinS+5LSCWB23C}j0w8Z3+{Gv*|g36;2@%gvS1nR#p
zSGdJ~yH%;=?(9Y}-@8jr-!gH1yzn;D;l-+_o+(Xa@;v&rt#(0eZ|$bL6Q{WR^_-r>
z{7n4zm5=}Kzkl~-MofLh-^VAd=NT-#dD8V%%R|ZZEJr`@S#NHh-2CI^6T`?;pH}?H
z%RjMs`Td&ePj6ms&OecL{)Fn~pb1m%Zj7168l%>BaZ&NZ_4b^T9?#7`*=nHE-o9!|
zmz3Volu4SA6V9rw_E~x(&AEc{JkLTWk7Um;DUZ%?@=|d-6?2{aSwzuB<&eo!(?#-E
zrkVC%Uz5V*<JFfwUpP!@vxdc<lr;Td+oFvjMu}1RT;3aZ+V))7v#KI*N5)OpC%;zk
zYTpvB*VcTITbx_TS<j|2a}lexM``rrxwU3p^R6#v{`IMBy2r$ivA+KwmTlj{&iJw=
zJw<eV-LHaek#*(UYN|i}JDcS6z}STCh@onR+?_nmxhf?!$t|{#2T#6eozZE%ZpjAD
zK<|uxr&CPA8qaUfdLuNck9*r4Z;z9mOLJWJBsMwT@^GEkoajC4dCBa}vuBr@BptXF
zXSaNU;j0S1nV0vb%zw1}Z|nTb1<y@h*}PhDt#(US{O2QgG8QZSsMYFw{qJ*m%<S2Y
zuhvShdT^*=hvDss>*q$>X+}-c`MaOzkN7Nmwigd(z1X|v)07;^jXBJF7a6u6`aV@R
zan|FXw>DRWI(DT#(a=u1GI54&>+2u+$9WRHJR3GGWfeZ;dQ2pVP1#7<Qg@r?)|hFo
z%hlTV^*pwC6|N^S`ANuY1^ZeZv2$nK`{jNzCoKt8U#n?(c^yL+m%)-V2U#}-F<5Tg
zo%Q$e4rY<NA4OiQWMJO$(B%34g^~#xh6@C36s2Y~don#>;tVdIo*AAQpkE$R7@1jg
z+I7`LlMq$4`QLmP+{HXRI`8~DCG<fmgQ+fIW$H2BK%NOv3vS3P>OCX$Uj6NSR=tlg
zCc79OA7-7Xm3m5gm%~)?ZBrlUr?h36+>%Xx-pzcz_{<ccvtEK9diP&aiT4!LWn|4#
z<GEz{z(tEuDr*aa#3}0&yz>qTGx7FJnzXWQ@>u}~cfN-kympx_Sg2n0*0J^0H%H&<
z-krf0Cz;Q&<_x&~q=rrBpn078j!Kn~hnty9T9po-$;-W4B0VL$=Z5dvUH)cU!?VvX
z+{%8GH~UUlwa{TE_s)>6mqA@3zgM1}w_{=%ALkLf%S@k44n<{GF#LX*&v5T@N6tc?
z*!hQ3F6`AXTeHlbdF{cR)h1rQj^5k&%dS0rzeQ=__Ao9MX}N{Vrdh1(-4f;Gb3&Ns
zhHydY<c@V#LPu9@{F>;g94%Qr-MZIp)_azt7nz$mP0Re%V=`{v&R!_aS9mJ#?{&$7
zzn8zhdL#7srSWmapuo(_r&=eON+_%<6K#r%X>MEHGbPnPG|@KC%=qjl9VNY0V#2d~
z_H5tm^2Ag8(A)Nh5saUCIJQogc9CUzC#CRVuSiadw{h*2&TFpE+GD=d%{f%Vba1z%
zWc;<@2gXHqhqn1HT7ThaY}VHwjtACCulJXKy?CQsqUoE!KF+LT%N?Q~RHzrEEQ*R|
z{J!G8PfvVydG$u|=HG69tB=<5yR+onO}LY8KV!P?{f8p9DK~WY&Wf+UvF**T_Tu~9
z9}gctP*wT$-=9Zk(@IOf>a7Ux7O^nmNxFW~FOX09%ZX`*v*)pe=RRcqaL2Gk=?8D`
z{i50D)EVWTM9NH4kGTAk`@^^2^0A+yZa?38@9yzBj)*IlL)^bNYX4%6w~i}!KQ{5^
z8}85Mbq134?+faE_PI|FNZ#OX&dafkxBEw4p~xoz!DA0sZc?$9QLDW4_E+ER5|Mq<
zuO_K(IAV3`$LX-+>GtdF=FO|O*=zH=<m<<`i|!gGOK22`&HBov_G+pe*YWq2U-&24
z?WujdDc8q?UvjbBF}sKppFVwgdvitu!@ETc2J&ZaeBEMrF0s;$Kl$6M_U`i4-QSb%
zSiSh@Q06G8U$x=8d&IxLS;rXJR?Dm}(Y9VQKe3pXHL0k-Vz>H9=|`vjE<GkL-Ff=j
zwwvYYyJr55>Jiau{91J}`boj5`yzRb(Iw_PEiEe@w=M9>R`QXQpLusXe{~vn&$Xk>
zdOMq06}EON`rc8x;wmN<=_`KKcz>X1PrJ}gSpl)Xg>J=XXU*J^7?x@N;g_n?MAwxP
zXIiB$2)pm)*~D;VmEgH^#TEj|JG@q!vZrvBRF}HQ2i;h9CqUJ;?#p50mtht8oSVbC
zgg?k=7H2)E7xdX@(YsY6xjG^G?=7tqRm*-w<AjpZ+}rIXb-IPSn=dRA&2daLIv3^s
zPgqNFzhktEzk|{dyBELIPBfIB`Kq>5fWvV1`D)+ON1w_(HhL+$PND7LkIv5}#&vbE
z*LuHvEPM0DTwwO1x+!z}_Snr>SG_ZP>(axjXWoV$`#Pm+Q=7xn4O~my?-xW!wKwMO
ze(_-IeVv@m6U`Iu-4Q8WENAlGV&c=nYs-698@2YPgnfRw`+pisjI)B)H8ZY>>E`8<
z;%9W3=R41f<YO-Q*wggm?DfefSq{(JIbCdC$oZz&$Fq9ZO4(H%JRq=V%B-eymmlt4
zWwl74<GRkocWdQlZElY_Uue4Ka8vt1vG-fE!|t8ao@{&C`}eAYd5f5XUUN@6bz~VU
z$42w`Jr#~|-+JX3|1PWV-{V|XTW*^#!PYnD=AoB+?)`GQS+mefZqqm0Et3M=|2$x`
zj<MOv@JaF)ua;fUtW<lka|!3_Zl--?<k<T3@-(JT_7-fL*SAdh&*9kA<$N{muh)vF
zF3JrTjyEL=R^Ps}(|+^6Ie&N&O$gA$-i~(G3RQLnhMU3+3@Z4V5Jic(spa`a*`S*s
z!f)r@b`z+*9?tWKJ&4owCf~251Fpfx{d%qXxVdw=oE5^Jc-@+HOSNozP>aI<do!Q@
zePnXAS!c5G=3>j@v~MhO^7rcJ-R+#=eK>tP=k%~Otk=aq=p}!gcK+Pq%O^QwR=!zr
zG%fq#pD%CTzWMXz506+hpZv~1A)$TGSDq?c!82|1-IPt&ve*N+oXcHTDbjc&)hjw7
zNbB^PfJ;-19(GB_?X5d+taq{X#}13MKl9#JFkFw<xjt#>+1(3N%m1oAlf0?Dw$-{w
zLv;12CB+-2aXs)~*ZVthjaboSuI7(&+HbwGr?2w;sFPfF+vt14f4@`rzs*?4n!qMD
zxijLhQp}&f1+uY!%WA*=e*3q*oAbePlQU1_GE`&RyuQAEb}>b0`5B3>(9P1lh4NGC
z@)mt*_naa2?Ciyeecjil`nmj@#r@^!WbPSD{kuQ#HP;-fnC`u!rCRmpk(X*Uy{bY%
zH#9!+`d?@CFe!Fi$;n{5k751OCE^D@H@@uM{4egvxs-<e_fI}HYM64;_ng_DVl&yO
zd6um=&%bkjXi+<7{f}M2T>C9l?i9SP_G99&i}G8(b=FDab$>G>e%rP5zAyAjoh$a(
zH`XPTqj&f8tNqhzeOx_eI$VF@|Mw9~-Y1jNyynn==ysP3x#*?+vC?-}?U^zoie0hg
zZs3Yz9XmC`cKa;3(Y=+U)<pP*p|b9S>hE0Z(pFYH3s@<YFpK%N@x)D`r}k$4HYvYk
z(c~~AZsUvOuN!|a;QPv|Jze=?OSa<VeM=6@m!8~`Jb(9%DqkPj<Lz|`4)a2a#DZOI
z1tt|d{roau(~76Nb-XKsU6>6gH{2;~5w#23>2o0c$5iQgJ`WXEyomnSv{C7w)mz0o
zQC^ByH~ZO1uxkJ5W!dn!Ghy2D;{{jddAAt^K0K;=XTz1A`D-kN*2wHBl6cu<_)yI7
zmACsUz2}$P*iKDn7Fuz0$+8I(&GZVRPn5;HY)Ft%+WIFd^TdiQ<+6@G!-mj(AFtn=
z8+882?j;wtJP7~vOZsK~*?pC<B6APK%cwl(EPcB<gk4J|sr%@*)Pq~Ub{*GQ-k4(h
zSc`x4;{|WjKeYelEDkGGu=vK;aKR}~GEcYCV>yT9^2$SVzfSmbAZXRRt;~yet`yMp
zQdx1fWRGes51XRqlX**j?0Nn&Q9J2R+KiCPo6}i~#4VjW^d2Q{P~&l2*0Uk${O%pE
zuPxDvXc4)iJ$=6DhZoPp882)$I3@R`Q}ms<(fjAZpMz8tFV~#idV2233ZK&+K};u)
zw`j~Quw~u4K1F6#)ibWb=AF+~Ts|su?<+EX7`poD;d%FX#rP99Iwx^Fc$l%>Yo0RS
ztTV|mFAo2?C~LJ}So`dk!n(@^9BF&gHyeB|J98$$z9BR(aj8M;lfpBXru0kaw0T=N
zY(K2<E>^;Nv!3_aiySlN?QKfAATOk|!1Zk7&h2;qEHHj0Fx96#(&Tl2$+pW!7yeeh
zyx__5EU5=i&KGRYm~YcC&-m|uhUaINJK4D}jsKFaVVKeVu6e@Dj$bdk?PXt0`xwe@
zQ@L51|6b3{*nMY0kBA<a#FDmMbfQGnJ>ATsku#RgTN$C9oECXX$BC&ta_zr^tCG^6
zc*t6~+AB8K?pVD*PGK$UhldxlVjk|~t2(x$S23{f)ypm6x)#&d?cMcaWzO2OXO7my
z-Q(YItEWv*HGST+2jwZ-pMQ2aYPojiyE23SCm#9t&wn27b?L(SNUQ%}7iLcW*(CXA
zU+HtDV6*%~YwwnBZaDX_>KoJYsq@6|T+=<xklwmb{M&rLo%eTCaZgFhzH@u!yVg%d
z9h0w3iGLyIbNb;uo!81OF+FdR_LnH{o_8-VXnUC7u3b9Or_Ja6c%ZRYIOkSWjq@9;
zTU)G+Zw0!F<ppj1wD&siwC8d8mk&*udQ4BT@OQ}y-)USiubpFFo?qs_{Pe4q#IWug
z3l;Z&a(w^m(pe6sxzf^ayRGBY%|%w7=15y+xpqoU*ql#Q9=m^D-Xv^({C2_Cc~dS<
zKa}=wm;7(eHyj5xxcP`|3DtSD(^2Dbo8;rA<!T>}>2??1@t2Vm+ve@y`Q=ee_O6b<
z3a3L423~%+?9udhzqWqNd~P<O=w-OpyFHg3eNNrTx}5v=tg2?t&3WH?thDc)*t#Or
z<GuO0f+^DL;~%Q6jo*J(d*K9*o`-E+=IQfH>g>**o0fPbE_MI)hl?9t+&wjG!N)Fv
z<2&+qg!)~T_PnrzZ?}x`p-arxQoBqI&YbIe=B0VxD0G#HrK67I#2tTGP90iyT(YWT
z{lvegIULtkx4pX16?<@n?DE?4TeO`5qBFmqN#)q0C!9BX*Op$*zw`MXMCm<BR}cFl
z9yclKxAMKag+7V<f0RZwh4HTEI$f&R%vhE<WoGr-Hy&A5w<feQ|LxYYTP)l9?Ax8r
zZ_#Hu1^y<v?sIl%y>ViR{8QyU%M~77JEfTGVZQX-jiN@z%DBWA;?B+n$9Cm~UNY=G
zr|=_w%j>IVdru;*p8;J9CwI`9e+dTzgTEC1D*-Z6(oFRVD&I=p&bw{#EjHfKgnyFS
zwq-9D@JlOLTNg}H%eW<CJu{bmouYwIYN2wl)FiK0x}V-x^J%_HIyo=ldFkJTlTUWu
zui&e7sry^<FSYKlu$sv1_~kws^9t4cPwI>M7Maxx@BP+yV$qsylhzme-rHmMGm|gA
zUb);-S$>8VtLIH+?NeFICtQqoePnp7_q;1*PlAeO>#`V)MU0B6vs7m>2L-OHblMa&
zi8q{6n@cMqQv1-pOf^<rhAl}<EM6AD6Q`dna(-m7x>Pq(MtI*!ua%sli>`=pYMsx%
zwkb+wmk#$+u~XlCjl5SZveN&tckw6Ax~ekuF0&QE`Jcm<`E2?UzAXL8eN}P8so7T<
z?gt;0xwCU}dG$x#MA1_wuXXDZtn`E1IowYEkXl;uf_rljySA(!b58FwhJ*V2C1+)p
zzDmsP+<MApjqcjMb8Djah$Y<XQR`Jys<^uJj@6TA>3cGl<WBp#?NO5N3Z?RdXFYdZ
z%lFss>JSeX@BV&W{{Gx57Q4wT){6HG53028l`A-MM0xsBgN2t9VoJPgPsDDoY54G@
zN%xab)Ai4LmMrj^xcc+y?ZRvvYS#`0pTAK5_0?5TQB9Xudv)Yz2=KfpNIWEZQgFkE
zJ%)yCTe=tyFIuM4JmX2zYYRRR?M;$`C5QbwFBQ2}?V2mJfB7_fWqyAN*X0Q(is!vp
z+PJ^FPVn~C9tX8G*&htv-J4~xh}CJ$3CW)kTw;@c-ap%IYF#J8<*;S_gvh!_+Z7&c
zE#od?GyTK&+n8aMR*i#JmS^k#I}?xgFOf;AQQFabW`7~ee(Ou;SuV+)T)oT5eB%_G
z!nxAUZgnrVE=in!QlTg6^TLO0X2ou=c!a)9HS{^~L@>NC?3&VD!P$-r1!VUtFFMs*
zZ1{4Lnr<t9s>(%E-7a0t9hZ)Mj*Jyq<|7b0i}hdx*R6tyBBfk6pL1}3W66H8TKYg~
zUDUcL2A#qM>{545%$_ov>(GfQ6BnLYAgbf$6}(b(mhOk=*Xt};jE-H-VfLwMU8?_4
z@ZyAR`#H4_B=0+=IYqa=h35dH*dB%o-TQOaIel8JD6vR2n9onr_>D+!M(e}`73Jd+
zFD@UkitnAGc08ST<2hSaasG|ooy=`Izox|)%Wm)3og{v&GJV-L_6{+=ZL=$0JT04-
zmcLj_k+J)l;Lo@F#CGw`{*kdKkBKqlri1FObJ?sP3rdr_Swhr2Rb@gq3rYtWyw!HP
zEb`I(1w%#N!zIkN<qH@)ZujUf$g&oc=HyjQ$XF%N!lf)7)evf?;C}kqJjc9)VlBDH
zS_LO`y%oOuu5Fg#gp+a#=1;%uk+`+L|Ms=n#?ki6oY^!Q)=#gSBVHJsdZyTCvgq!R
zSj%6<r}%_c@YipBpIm2KQ{UPazhL1S;e#KxFf^}Jd%m~u-_^)t`xDvRX0TkF6mdW)
zR5XTtgN?HK!%s&hv=#Vn@YgW5IMuDRNV!VlrsbihN9{_D8@JvySaslYLCimoroBD!
z>mAm}e7@`<<tN12t$f#6@qu0Lw4Gm$?{R-p;PdOmv6oD1GZ%+!vd`k%+Hoh}lXIc|
z>?xUd*1D;<y*c)?+cZz-z1)#R-K@q7i{8~<aP;|_bnr^j`t~0>6IG{G+4T6BDt?b~
zu$ZV;>+65Zl)v9c>qN<uzKJH`l|NGy|Nbu*uiv;^V(N;yMof>-DNEIEl$h7w8ZECU
zeLm6f%jfN#7q#l64|<1(AN!geBO1Lde&3siyLKBssIGY<arn04xyw^87w*5a_|wz6
zYcqo_rC05l-S~U%%lN7ODo-_UPBU#xp6wu*VE^5=%*F1u9QQf5zU2}b2TusgY%dVm
zmACOe*AZ!JhK8P8;|tM!g*hF$N-W<lK303f_28EH3;$KQ{dJr7f9aL1Im2rm`0dHw
zR+eddvbi?wpZKBqRoYVTs$kaZs(k?kI?neQrf#@D(`fBkxdmU@7rAF>ys(}3weQt6
zg~x@430#l8`(>_~tk4bIedW;HuP2+&1x#MKY@OxgteeIUvR*c=D&9Hm_QK=dPt|s$
zK1&umcHi*ayxya?5-kgOdM4j6Z;LJ4P+a0O;n0PeeLMgC`1fdjJ4aOQ_lvbB7bt%7
zm%8AbsBacxoqCk<YCMxwz+3%Z(+Osh(+#%Xc%qqmD4}A;ZPsA<=bU*7_r4xtOYfEX
z8g82<;K`xP6BqefHpHZ~{km(!WS?B6TMzo>GXpm#WS%!$qgbq=@WG)#{?_8lS0^0$
z=<U%F^ziQ4c`MWN%)b{Him^KCYclxzX6Q?vI`gJ^Qp&U6clezz1swQfy}m?G(pTN;
z`bCW=x2AM{OPln*_hH10_vcv+?j26P!rm+KWo@B)w%N0H$98=PX#TOk=yhw%riJ`H
z4-R%M-z|Hg+&D=~m`}#+Myy?+LfB`g+aeocb~HSkvg}6J<*4b)EYAB};QzV(Y|G1o
zBCV$m{y+R^S!(vIjqZEYTF;#<@%ixP$zkSDC;xLRd_Fn+ioeS5wyZw#Pq0vpZ~uO`
zciLZgH=au|JAE>FOIz9|E<Xo}_wv@^#RtD%yqomp<=@>$-yT2xx?EVif8yQF_j&pG
z^PKrb56hY6onQ-?;8vUR-lAde!QR>S(w09GZr}8{+xK1hXV|fxv+L{&b6>1q(^!2s
zqqxF(Cr8cpH_^sw4?_5sOTUir6W(gP?mEkD#@R`g1yNrPeK+rL(ptbUBRa|EbfH)|
z`?f<b)17C(c8OlG^$Ej{>eV+U<vjm;<J`~mz0w&PEiX(i_Z=)=CsD#-aImd5XU`Xj
z*zax<zd}@aWNkmZ>Ct$g{AH$QSF^R5f|<{*XV+9%i%$hj<l^H{KJNKN?H8xMzt1|;
zOedGUJKNVWPdTo8<yg-u=B{V_4MOj)PKa(%ui#<75we!Ck)f!-Hmzr4dfwfQ$u5^o
z82&g4-%P&Se)r{^+W|#i*Zys1OfTe><M?*R`uv2(Of$7S<HO8>*S)Wu+)=&KC)hb#
z*yi8-6IVqR_Dz1ibHCgyjU#tnUKe<e)W89aBS@?5Ecz<Sz`&e_zk!pRS)2@N;Mist
z-*%gH|EIRvrK^k{9uc3EXKQF*x7zaN#hP~SAibNDwtf(hn6$xxfxTf#q}Jc>Z|AWa
zR7~2mBxbE}n9#%nKK}mumoHD><a_S^{(rRvPj>70+<b5$Iq_M4?X))&!wpN9=X|(w
z?`7`fM3MDE^+sn;T%LP3o%zT4{wGPNP8fPGo=}l<ut{T{WBMdRtJjYG-7Du$+9+@E
z$Su+BuYsy$$%lwzch0o?IhuToHR=;G`W!r+m612n#Gmu`oQ*0=7)^R3IXHIOdB449
z(V2Fn@Yv^^c?QQ7|LOEi>bYRhW7NfPInLis`n<Dw_acQ*exYUiQdi&LS8rMNWRbeV
zt!+%Ehj+64Tk%cCVCs1{lhjuqvs>@Ida(I)lFP#Nwl--uO+H;}>$5-qSK;&FMVa&G
ztiRNAwo84}bnC^}E4M#1{ByxNRBq2ggO@7rrCO8gn?g?f{;V$kVToB^LRS_?&HiP=
z%L3%NcYMt}&G_48TS3}V&EwaF8(Uue{8yz^aN*edpUFju@qa%5Z8ZM#G~vg)4^Q64
z^&fEm)X>Up-|3_mDRjp1qeu45uBXvrn_3R-j$8k|pKIAO-`@CdzsvL6m#gRV-8VD1
zEGM_Ws=OfktBskO;^~<DHy#tz5_Y-s@LDcDe{pq<!@aqZ8q?&BGS<1AvlHuYyUby-
zap&`|lhh`c@Spg4t9<im6YpOi{)X<@m6fBnyyI>EACui{e4m|CYM%aT?L`NJ$6gzl
zM2d~r8x?*Fu~#25x*X8oYiAg9_>php?8@v5-jCXkv`oLD)c29!$KE?5Bcj^!9OqX@
zbEz#SWu)D?ZuBx$dmmV%@S;RcdHGEDX?13*>N?W<>XMn|WHxv^pZ}h5jEl*{Ur?>I
z@@nvj@($*6t`|*?$IgHMug-AqULkh};RFe1jx!EhPtM+;kSZ(N6Zdc3jH$lKN3NXl
zohy4;<#T3&Sw^Hh<2O!^jQFAr^B3=3zb_(;U3AAC^PmLbDOuA_3*0d>JF1zO@WnZI
zO`N~vN^e)yCn=Gtjt}oPEYqx%z2dVjvRX-1$n<vMp9|+@j{8I!yqi4XoJ07|eWn_f
z?QvO7e3woMUEWlDfn$qF?dlBf#kZ2(b}sh*d%^Xraj)#}>JLW^9*E7jdgXhB(*gV4
z*I%5!&|UZC0PE%ti!ZP%i2fHkYy7G3P5V6NG_{2ZD|qw`*7Qe*`A<)>TgL4xV?OKX
zgRR2VUcv33g+eb190+XP&bT<?o#Cf)eTm%*ZEH1uWW>IUnR;{v^H)YM6ZV{MCtZ!w
zrGi)aonK@3LwIuv*N5l|qf`;LLw0k1oe(<NV6>}IKF->rH!Z-F<;fNO^}kmA=UAi~
zHf^$|!A$=pHb-QC)N!#`*6pA7`u39<$5^(`by1jaSgfd5TDgS%n?iy_z|7Mt-}_xu
zPRQWQGwnRl#8#X(QAcTtPQ)aq>e<YH?l*7#eE9O@Vuu%M?$;}JeJ&|4zs?|7m1uue
zMt|RpK>f1Q`epS2`ej=B`_9Mn2yOdNSn#5I^23J)e}Z?cz1Stg*Pim-{dY0vF>c1k
zJO3_X`g8N#{UhD4R_uOsbhFkxYx_5Q1oX9R%i=o3{Z}U+m@~gqe5u@S`+q+UzvJ6?
z<81t$Z?~odci()sXr@H(9G8X9xURFxh3(dpUQxdJhDPG$r<tdAE#`bL&GoLbcO}af
znfu1Na?C9yOuOPa8Mh^71vxY(3B0Vl<G_*nVzS^2mXC88#J!7>u7`SenYMA9`22NO
zc(#I}{>*mMZ%zVNB-u+Q&5{aSD^&7u<$I@f6_2iGO!b|dVaM1#Q!u0?!fKDLi)-aQ
zcUS)z9gP27zMPq#JGpq8qF@luhUqH3AC8}5n00~mE3;J-t9cL;?;{JYri{*W9=%$3
zf@d|Ko)p^r@>+WG<06?wyLO*Bu&Vh?=SDfX{9CM3KC&`tUi15*8gKgG);=M>$4vLw
z&hj^kEK_{y#KjWtEwV(~aQZn#8TP}B+fJs4t;;i(dQ)tC;p}WF!>27f__L=lhOj8^
zOUva<w^;t3->>h!_y2R%&-s1{)gOvK?=P5p{AkEoyHjdziEF1^%J~>oRheTF@2(pm
zuwc&0pAuoxGj<29TQu#@@=y1tOGRb}*B%dJ_Y_iHD=Z~_I76<YMoEIn(O|Jot5m+5
zaZHc@iC(iyxv517H@)86)tA^7{&=ZhfE>pGFE*Fng2=}c8K##nFmf?I(BJvG&LHSh
zp~1I5ESFQcr|~tkuI{f@a+0%>OFpLN7cs|0&pSBar{L^Mt@5hdHlAzS<G9^jVTOue
z_>PITx=Q|XaaIyM%WY1yswtg1b35z9#VZNHBCLC#$4!m6dvFcM-qS_vmjC~@n{}Vx
z$E|77_KRCCzV1t{SbSGN;Nro8LkXXR#8`xHuZZBvZPiK^j9D1A_`Z$Kz8OqL_n39s
z<kY@o#mj^?ul#mmrOW5sPu%DEmuT>;&hXRNv8M9W<c+Qij$ikbRCirf+Im&=dfwJ5
zsc*%hoy=T|%;!{ZDR^VRbY9@9OJ47K;hhVjgzrwwe*gN@B`K~cPvg$y&wYMhrES85
zD4R6BXnS@+i@*Al)*ctuNItSLtM7ug(@|ZXh=`l1zH8#T?GhQHpT%7E-Z({n(}r-4
z1B*G2crN?;UqNB|u>_sxTluyaa<FKhf0p>{{EWh@t7qLz+o}JQ*Mh?~KR{sr!CgWI
zALLg}+nhS3$ZKIwR_c<|+N+QH9@?+=f0Ds@6TWlj{LX*l;W&KiL(6}+ZQ*-m>sHC>
z_detFzbWBnx$C=gN8f>l89!K0y!oc+w2brTx9A@mHJJCU<ZYgNrhcahhg-sH-D1I?
zaynTj_8*b{_}ML0zr0RqyZzP$ULpdQwaj<A_Iy^qV`C-|S7&(C=J$@)X#sj>ze^|n
zUZ)f(X1>_8UG_GUsre^~pK0^o+?g8hy!F`!r7*9X!iw)|7VAIxIg>Zy#LXKs!nOXa
z2~w^IHLcvKTl4<Xj*6H!oilxJCo3$LVVrmFnUsX{_r@F7CcWx<FO$09%XQnC$AS`{
zuG_mi*<SU^XN4!p5=*8{Zmrv~pz-}eiF1LTmzMoI@4(j7;G?)i;(T*L>jRF`&6d1H
zpOiKnbSQi5a4FlqY)k071cOw^oGobu@8kpT=uf)9JM&R_<R7idwy^Wv+BygM+tt~8
z4Hhv^|LygdYx~kIcE@(HWGNd2xG-wv=S7(EFUjCvSbtNOOU#{dS)b{{Kp%g{N~gsa
z=J1H|XN!Avs2y?&Ub7=FigmN}{bc{0iWR4>x0*P#Wi9+_X8FAHy=rsf4Ibk)ip+s+
z`%lVDo47%uQ;qYf{(*@*1RI{6c9!w>U9r9~`VkXH`twAgW~U1C)CA7S8oumJ`U|9f
zt$O<5`{QO?Kjuk(KehO-1q4e~F)m<S68C65>tR*d-)H8eHVLL*(g>~cNchYu?>+b8
z9ex{8@flYg4rWbqICt)lm+r0WKNsy4ky-3j|K*rN-i(6J&+?zU-=5^SBguW4W@5rr
z0pA&O&$*{DO|rgJ=@N2E(fds6)l2L;Je8uy8Bb4sbN}D;H_LzedM<Izt84#kvA6wa
z>B8#vpI77mr{0k}w4;(KYW|i;tD`rR>%ZL2so}rI^yO*Jor8CZn)l!M9kI{*@r&Du
zo4PjtHY|Ol)RVVw+U-9_Zyo3JzO|@LO62KWfeF9P8K3d;xOZ%_<nHzcpAGfx1qXib
zKk~@lU+3KN8QBH9gZ=pD6u&xUx|C`Dwv^zD!rq>-JZA!ar0DlNcH41uh3dRzBGYzX
zEqk<bTbz5=;u+#+f8P=a-^Egx)Lou>(@|o>Ha8>VVCSo)r*(uDF1yEcy|H7Ve31h0
zN{!gGnC)}+KRgjuY}On3m#ItV>}vhOPlDO2zh|vB(yUm?dG6ut+TMcF8$UEtUmriV
zlR;s*b6(fG`zqUAe{}?F-p`5<Tr61j(%3BT(;AfnuO>^z7B*~<5?mY*GgCRzL2At}
znWOuh1%;T?FRK;b%yizqZCjo1%p3KO1v+A^x^7ul#NLP!lullJXU3z|xk6pb_1`?t
zdf4fDJ7SXW-OI&BM|gSdmxwObt=8Qie&GPmigf)~=cQ(uZqX_T$UNJ==C_uY-M3ZR
zF*Ag?-ptiH%vBISQCfrhiQ3glF9BEn*xmr0gD)ymJj1tT95=TU7GuBCx@|{}x~Is4
zOM6qwb=G~3I&|yN$%|Li_IKW0V$mtK@3@N`L#n8;a>*0+x@}B9OnMK6T<v_ICY-0Q
z8qsevzc-@kXo}MV3xj$#?}#aKg)Ixtvp;_>^5>(3LQBW%j#TesKjOao<lb$vjr(|*
zUHi_T;FgMtgL{(?COwq<6crhAbCSd?w>O+Z2Tn}?*{}Yn-_~^9n!2UUm-5!6YJd6f
zIip<j%Z}CcE31>=tIu}2!f0l8`J3B@A6&&53OtuHPJT}{@I1<7wlI-x*(~XlChKkm
z*~J>OCn<D2+VaZtcTu;s>-1HjGp7Ij%Jy{HsqJRJt}J+Wub{@TWaIgHX4MD3wl03;
z?|e0bwLkOmv0cA%wj7MhS`)o&!Pd;y@B?abOBXH*ipv*hZ4UUk$7$;9g`pyMo-Lnt
z;EuB5UxgXx7k%N(J0;I#zVb`S*$D;G&CiokKLsz5Dn1h;IcrU)V92)Uhl-2;3bt8#
zPJ6V^Z=njWb@DIvCC4J8{Zi)e)Z1FyTa>3<<q1>I$UG$7c<-(E-dEdaDd+qOna05_
zJ$c&3%pB94hb2Cy<_@o)y*l$^xyH?mWAEen3%8y7xca}PZS{(uOiXnZ;VgXqa(s<k
z2Nl0fG1<8_U!`cfo9&U1`ME|%Y}NE8{Zu<55tBCS*J6gf$IqO1=t{k#v-yRM?tL!f
z#Q)(dPn^Bp5NpJ6ch}6=n>sJ^=3I8$>{vN>cFTdAEQ$>)o8Kxc-8EUCf5*J`)Ky34
zI)RDu`92NWtXn@<Fz2?pbX?$+>p1gf*;U7>GG{lYD4T6M;?tIV>2`u{@&((6ZRecg
zHm?71jdwwe=T^yYPeU&#9$C@7{>hAUe$QtL$fv)`Dbs7&F6!=lWkZeqyl^9tYpv#+
zm+RZN$RFCX<e-wdywka^8i(TS)%&-m{{5nOWEYbG-}HYhJRHrOOc4h@c)48taDK!2
zaO00$ADHG^`sEa{EVwQ!<)l7;R>$M%b2uM4eF&A|-qp@w;&njwJey}@#f;64Os)1W
zDlRCpJc)0YtoWF`oTuf1rSUh*+XpxpJg?nm$mrvZUfUpZ?#{1PR!5g<fkG8KH7ioK
zvhCT&wziI?@1E<*Vm|u`QOZL7Yp+&yuhZFHGhh9J%&SU2D|t&-zmp<i!Pfcuh1ar7
zemyxR@SxYW@8H_2n+|1Y%3kHuT=ufQ>B6&KZYRq}u`lN+*YOlqNcVqSS|c|#XmV4L
z)a)*`?Y%S4l@<1~@XkN5Uv=Wzn|;52vfP}y=Z^Y$j(OED?kviRpZKt`=ksUftsG_N
z^v|7ApCQ`!>AjNunV6^rFWs}ap8ShD>Z|VkSjtV;d)b@McMI)*e*N*hxq9*Xhbt3<
z!zX&J+SRxB+iAZPp$98AF@)qExb#71NoVS|H1G3vH~-#K(vP3?{E79W=qLM6o_lVd
zuM;SBQh!p#FPYn4PV(1oN}jrWi*L)^u#2lzJmTe=z0*t%AK(2g__w5M!h&y{2Y+)~
zoqox4dxO2}1J{irr>+-VOfTE{{mm(+Id?OY+&a^xt{j-ZRPFq_6Af>stzC8FQJbU6
zrm4lwr=rXvoqX;uKWG&kv6*AqiM7{H?d)E;o#)tT<3;)s@45M&g{Z7w+VM|s9v^2e
zd(fo^il?Hwudg;x2!Ad%fBD1P8LYExV$~U6ZNAFtx?%6bnwwIQl@8x>k2r~iY!Krx
zQLyu$soej2O?UmA5>shc$A{rh;_uuR`sW&XraS%|U))|h{TRQ;k(*{kUYW6cF{{>n
zujrd;xjvf;MJ~;7z5gt)Exu~Q0)gwznO)4Y7Djq+OcOirT>SajPmL#wE9*4*qU=@b
z<#VT5SiJbuy~4<;SvB^faJyb|oNY6ovFKIa?8hh8tyZ4JGL`wAg8SbU2JZvk_|NOJ
z+xs*3aO|g~%T`jgQu@|fy<YGCpSUGr_rdM>f>+s-VrSoXWNiA!`ujqZPjTU|UnTuA
zHGRqx`VJ~2zA=8cYTI@RbqBKu=eW;npB$?D*sT7@AiHp*P+di!<CC*TS3a}}*3O#8
zED%$_$LRBMnZDVU3;zB%7qa_Z8^c7Y(AG<AVc!KLn;UJUf;hdUZgFi0o2#<iBeU@2
z+%*UNKb~NX|NJqM$^3Iv!@htJn@NTe4ADoY**>dvOlePz%iH%}{&*Dcy4AJk-3`_$
z+`EwWHDc-ht%0YmGJoG6+q=I|&(FVqR^0smpZ`315OHsxTG6ZerrX#5Etq}g)9qg}
zdo~Bkm1&(~`NGAJYaX9_IDYCEnf3b3hFS`zxqc^v&s=GJ=tGxm=qJJ8g1SEm99mg(
zToyMhTtCH5P-n&*`(KwNb=p4f>Yv)8+IN>BZNd2k`@KI@Tojs>9C=dc{c7X8S5sbo
z7PfuG;&qClaE4&XL2FJ`m7Avf<@s}qUpi!c)mimsfxKJpzR7DZOmpkY^LqO2*XE}E
zy(0NXeKcM%D}?%PU*ou<&NrseEPzuh%xap?ac7BjlTw4OE+{wg{l3As+|-XhV{XOA
z@L8^#f9+jxN2J5)!9pFz$@_T%R6b0s;6BiDKaKgLTU^1^leOL*SB_qtCvjw%#FCGX
zBb5psUoT#;tiI_W=i-(9>1UO6^t~PSel*bk@iIoabJuac^D{fQrfxejgL%P~k7?X&
zlcZJGXuQ_ye!E!eQLgLKKXPG98s?vvl{~TiY<9HaE(R&Tt;u<}_jInA<ZZgE>1jyl
zyhF#7n<YBLuN{8!w3Nxks(S;E*Sv?HgV)OOt=B%8tDVkw-0gME*)RdAM=$pn=IJFR
z=ScS+KcQTwvcbVM!hdbhGL30saUNIm#O;=8Jk{N*@oLNODBo=-GUKNDOpDvCAYIVR
z6e!8#YkbOik;fgUS=ozLNYx%sILjPlc1(5Ui|o+FfjVdR-MKKoG{@z|GR6I=uJiwt
zTW#E>Csz^DVp3PTd~vwKlE|8!%ZhjBNx%IdKl?}Dt%uFl*4;5r44m|4e~w%KBqZr+
z(4#vG51gOnD|p?y^V=bn>$&gtCOvMxuYWFXuVr;<&4=4BZ|=Ufx_ha;hF*Kwk4aVg
z-$pFU>AN2Ax%JaNLy=&OyZMh<=WxVrVB|E2zTnm{zuwknmxWE{_YFdSC*I(lw!{3+
zJFQurzI}T_b!TY!H_dl>^!dSkvl(443iHdheO&T2Bb4>ypFcA0cK^2?Wa*mMZ`OIv
zx#er8PI|H__m5pSMK+vIessTR&DJIxxdqQwe4c#wwczu&^1N@iMeDhIPD)fOiJJF+
z-Kwo;@;*g|8qJjz4&EE}TrH$>ZRe$&bFQ2zo@-ZMPYYe9;1yoLwDjy_zAvd8PamGO
z;@P8ZZ7)s4973PB{Qg$s^&xe#<j2~7?DGPGr}|y4k<zl)x*WJW-a`3jZL{afxcFs`
zvpW+q)pSJ}cWv+rzxAU&Rp9#Zx%1^67ibpG_&xpA&3pF(awa@bYpZI>{b=KS)#cP)
zkxbRo(bjj{g1-IP<#EkLN!9OZ?xnm(HLi!QXjmpqZ;W@0xM%nBuQX!inefW55k^X@
z_kQAFU=UQqf22fiL8e|o<<rRM{M&9~b<fw&=#_74QN32$RhE6A`|K%Ctt)-J5#37y
zSen$@FRjs>^q}X-injm1=NTKTw2PlEo5j?<jv@L=%(<`D(<S95yk5Q8|8cS0MxPBI
zP10sQ;Y@$ZSsC1Nv8%WLuk!N-pHE5QpPqV6dc633eE-Ay=To*NJ!$H+Q8v82$wdF!
zhM68>>txk6Kbvwkr6`-Lax)#e?i%MMloqMyeDbr8MW3X%S)|Hm8_}x`cSLQXCk0H1
zG@WvNva0cs+WD!`anEKx%1TRCi&SY|af8Kk$FrB`*6ihEU43oN#-`K->05Ru6iq#z
z6q0}XI;(%ArP6h4#hbe#Gf%iwPWzzB6)iY>#YD-TFJjq?t~wb!%iWQ3$VW}_Ma;WZ
zk)MqtvOCW#dQ`U3GVJuayy>$R9zFArbLP*@_t)KHn;d`7uWoK#Mg1dzA3R1`X8Y15
zwVh{d7UQ4!CD%A*eazy=!F9p9yBRio=<yA+bU0Z!r@kzt=zVqB_w{wP_B;Q4$oo}y
zrMzo>dehCPPk&zc@-_eZ=I!GA^Mp6IG~8x7e4bU*k7MhSWy-4C|9XBhipXwE%=P}#
zcy)Vu;!Y9ugr~-GCwER@m@xCd+HKum*}dC#{FuXS`JQv%hZ8^Kuj<Gau*YV6Uz)h>
z4nxw3m4XN2jb2{Ln$gG6yJGn?CZ<<c1>#%MpU9~dx&}TFf1!QaU@^b?)&uNMgd*Z&
zd_CtFPYm>Y_vzELJB1U9nj3d1?~K{FX_?NewW`ev&Yh@vxMHEknIyUPNv2W!uUTgu
zklT8cMXIO7>HN|Uyh_dD?%QU&ZI#)2YDMPOw<!)5vjY#f9xy%`^dO>lp)IrA?s?m$
z&vHv%*<Lv168l>D2rcjOtvkaeOjj^CZe`@2uyRJh&FxBzuLaL;ex#vw@p}ssSF*zr
zkK0k#qD)>jsW^(Q6I7M|)N}Q*nTnskpq9GsnyB9zLGtcf=A~!mn;&?w@^AdUH;V%l
zKX7X8SfhAZ;WR(@mKo94x%P8-pFDge_oDQP{>8I88K?3sWAk5by20jo;s1!6Cq4x%
z_FcBZY@?Lp-V$C%=aPQ$vs@F-n^%YzbN}I%-*)Gt&bjw3ujhW5)R$(rJi0+*$~A_%
zl^Kg4>(-WR<eQ?=AGv||GH<YToOSHXZ;LqWU+|^IU#Xkdy{hd+i7Br_TGPpvDuKua
z_Weq`GA>r|-I{my`Q_zpfgeqlCx+NfzrA~Ye^wsXj_z$=7louAxw$Uk^FljDUOQI>
zhK&d9774~U%w1*tt>ezxiY-zemRw=Fl6<%JpKy0mDPf*5`%Tn-UT?X3OBU#AEJ_QV
zGO=a4Q{M^R5Eh9uR!1fo_@3l7G20N88`YZH)6ul0b=mJ@5l+Te9ezzNXt9wJaBXkD
zV&hnK*<az%d=~9zny-_uDilw7a+js@5wpTso4;R#V|Bh=_<B>kb7oQBCasXHjl#Z6
z^Cz@iZ`R^S`C!`NnjXQrlCfDSS~x*qr$ft>oVodoS+AYmwK0ZY=50;5@#lKT9KWKu
z!L6QCm#+!k%B8O>w&3##B@_Fo8C(-<Lt8KKzDy{r*q9-H{Q=wVwu@Ug{92^$JtMP8
zYF}UQTze6{DZFc!N&fn(!OA}2f#CPu&dmXxBIa)nG`B1l%9^cN6w%b89Wl$HIb~M*
zRY|AMcV0DoEKgn$zCP~i`5W1Hr)I1V3gK#<&}np{rqXFzVrBEkWvg=czFc#L+i0In
z*jiy3uhVm59!3VOb2_jh;BLq<i4=|c37IF4s7>`<+%?~{=fi?aN!v7omYrwV_kOW#
ztkt}xberAR7C-xET;wFg$hcJ^yMD@ao;#wyN)KCv7nf-ptk>MS*+E&=(uQ@{s@<{A
zKeEj^xLM=b(r=x2C#MANYWy_c@f3sMz1D!VSDrktSuU;-d7t*_h`3OL_J&tG5*m!p
z=ss?#dU9dX5#=t9RrY#MR;48RoO~Yl=@7q8Nwmw$AIbsF=4wy!Jsv2FNJniya(C+*
zorfI{c}?7JEiHXextDcCAJ^?;=bM$}Caf07*7@@Efl)^^ht8IBY{IkbcPveQ7`Zd?
z@1;cjSH<^UFHtWwDO~*g_r+PC-h5jxvZ|ipqSl2Crt5Q<(*7_f>{|Y~SX6la1Uc=u
zi@(c#|My<u$hH<X_aY|-CN4qq0CvBspL$+DeQPItuUx~l-_CbCt9edo(GNb$z^OV>
ziGT0@{1P9YpSC|>u7`sAv9x3CVFq1}lFP~;`U%K1?whgFn!B;QM=-CeJm5~{mAs|x
zDuuf>eRu2UT3&Q^Wcz#LY*D|?Z#Bzvt51L3ce(j@gzoxNW-OQ8Ww!_j{$!h>RTLsn
z>vy?ns?6GV$xl|sUX#2$$KWF8<BgK*mBjs-nf$*kRCv6$Ra?U?hOP0SNLd_L*s9Gh
z@7><};@R4FZ3RD58_Ulmu9`G$r}V}{kvR_8*FR@x&MUP~V3sQlS<r6bd7;92L6+Cr
zoiYK|8w_5bR<8Zf7FMeh_EWa?-(;l=Qy%)ttem?gaV_)NtW8?0nt5kv9eTUB^wj&j
zoUF!sS9kcdB&hte=I-h5egCO9$B3!MT<iwZ+ets0T2r?adB3XbdtYDi;lzIK95>EC
zUsl|@Z}hUvK=0+>=KB8*8`-1UFWvp+eIV;$9l!dPS3hsOUTVA`mi^?s;IrXJJW6?2
z^es5gE%-F{z)s2K|G!@pVD&%hoNCmZCMspNX}^_{N%m?^zxle|T0x;bd|n@WZg@54
z%f-%r?0o-^t@Wx^7c6f{Th2{hal2MK&9$>i{KR4-@k*tQiaCcK>N9^~&J~#S_%*|V
z*7ti`R+R{UdX{BX@%>(%Y_RNIH?K{8-Z!`w9CSN(Brse~W2cu&PQh7S!v_!2PJiz8
zC~q#jwJY=8T*L1%=H<?j^16<<?zu{JiTT+3tWj`05VgMM)$}dz<_T}uf2y@L<HaYF
z{qJt``AT1UJAMEE8!t^?+a5M@n*8(EjBU|BnPvz%pLr!~UDG6AUty?y;}eJWjLg0I
z23rp7UZHKa`PhxLC)yVu+iY80`t8Nj&6eK|73@0y@s!uPKmVWD6mRYL`gO|ojQ8(T
zo?6CDVc=ZL_U-CrxuaQpYm+8cADrqH{pr<_&s)B5b}!go_KzFUS^~|lPb;77%_+^m
zAew=Hoqj=fdUAeVT4uUlLFHB3`r_N$CjI{%yx`;6fL&fCZ@%39`o(YVva(54ua3;S
zQM<SA@#6p$m5(!(LYp=%dj7e5|6NuGCKZj-g}1AhX9{()h;<+RcTaWqc|Co<f7un&
zTx^7EDx^NI@ma>H@Al@aQO~oQiYNQ;+)h9KvnW_)bLGjtIJtdNa(iv8Qo@VR-7B7$
zuJf$i=InIt8E3rY^uB#t=DIJz(I9r}>LzwZZ?V&RG$LoDR!UCuoX2UJCOPf1$;=mw
z;va(VepFxh;McF&=T-GL8Q4Dbp2s-pV%mXM@AK{4YdQnieGa@}U{H!l?Av)u=VyDt
zLD7Qx#u?Ju`%k``q;$T3zn;5WWzG_rXY++`%(u`fk2|vG!ADhn_BT!9?;EW=k3FpB
z^JY<+6Lr7YWd7L-n}n=8A8pvB_;1|*tipXLNzFv=w9<UhhfWzb%RI%{V{**{%GpI3
z^`5ZWMxT#5P?Xoi^tW?GN%5{zi;T`+&f2;qf>m(d=XtvVLhctW+}~Mw%Ko+d)3li>
z#$sG$Tena5xjD7|>+7SlAN)9Oe%yX;U4{9r<PQsvKJmEat@h!>*G1`^Z&ZC=PuwT3
zu_5co%cPB3A34qm1s<Aq+UC?{+hV5m{ih3?o}CDtx#Up)rzUf@dE)AxDZIW$4mptp
zKW?+PR4}x3=JD>)%S%6AY37@zE_1F^+5hcZ*GvtU+SekDK8HKJgDU2IXExd-vsLfV
z(k1fI_s+Emo^^Pk>AuI)B%$q&mM`arXD1%)c&+{aIZs=xwo%-E-r$4zYz0D-q8|oH
z&zwD5+RSXhmyBx-7wv14cWU^~+y3O^&6mpE7qjkj-^tzb;HgdjORqD_bxuAg68k7O
z=luzri;T0Mxo(*7!OeH2kSABNTMpBnyXlAD%PnlRku0^6w|uc8=XN8*kDO_rg5-MV
zWj$b?ZCc+L!tkq(>4;8|!poGYOA6PYw|H~!*q#3$|9o22)UjIWZWPCFQ}q~W?z>lv
zmlqW&sr0_)-SyxQr(&({q%5g#Z)XOxam{A<ak*ydLA{&{Y(MxbkL^}#e$@Z6-D-sx
z&y{$)KQAlu3nd@xxZQKO$9nhnXS+GowbDoLu4J`%v^A?tk$>L0+(geQ9qAjC*J$0`
z*R2~E7sC_TRM}d+dqb+}@3XS!Z&dZw7j9$9<8FLW9A}a~X%Vwd(1z?=*9<Zx#4?_0
zH!w{}KV@|8F_*mbl>DTB?5B@))GmCL{QHgjJUz)tf-8hJA5GhN)A5Z@?w5`&8Jt&o
z=5=Hl#mPrpx_)18zOUakt(&^PpS{ZaS-y7TZoYsI^4FP<8R^D0%wPU?y>rz1KN=#b
z=U-1!xgch-mfyWDbPY>|+Xh{$ce+Y;k5d_rR4kgZ-pJ~a$<vL_S7QIA_!{5X^!v!x
zZ5yY(GhfNj{Kp|V_rb;Elbvp;`00sMMW0>I@WI=cYmW7%xl0+Vg*s()HVI#RlC)oc
zYgF`Rz6)w|q&9}%ZcsQm$%vz>Y5C>lf{ou=KLzBoH!fi2u5Q}@_VnCYo88>F6#CR|
zc(_de%V6xV>i!n_rp~KEwvlqPU+v-$zVWqvkImIxbC2hDDe1p*eP7XNw@1l=t?>#+
zkMqSXSp_FE&xlp-@!HvT=u?x&qOV+UUvzS~UN)K2sb<H_c6{b~=8b}?@i%0yB^{qJ
z=f?xTlgCaxy{Db(_PfMQwLdrVQKsJCy}gfKhAd=%v+Klri$$XAf<8>mV7T#0BlhSV
zChNp?pGC49U0y7hdWDf!>#g5G`_{USovyaMCKq^3Y#wTVn&stMBtFe#EyJE4#TxMk
z87}g4XZ+ivd?6)EzImVUmFu@=6^kd?hf0a+1k0?>UZ5Rd@^q8G=s6KS3x=fYQLi%7
z`GX@X#MLwxCS@3O?z|y5*Da;b&i{7Dm(><`BbL8?5f=E<_-&(dL~ca;)k)%e_r<Th
zn0x<35{sdJWe8itUzL+p)4aWypY*O(yutVI`kDteuPgWO+xg|!t4k{E*K1#Web<{>
z^TjK`uj+4movl%<=f3d8OsO2d{>q-6wdqO4#g@f$XKM9cjc%Fm`ib98ZRuy5*RC^;
z*KC?~P|e>!b4!Ep$ux#Qb<vx)hkmW9NO-+u&g`C3_MbhBY+ftypZTN{p1R<o%m#)l
z%WUp&xH!tc-D)n=#IPc8-klS^r|({L6FVorZo|hJd#B{_RzAJ0bhoW<p-t+0&Mx-U
z-HtAY8e*eYcB#2^i#A?#Jg+9ODeX49){D9wM=rl$%zg4<p`6{f8`sZBSKB>{spi;x
zf05{)&C1+=C;yVZ)Vt-8?t%@iQ(D_(=5x<=_`0}e=gY6Nlh^I-o_~+^_;dMt^Y(Ga
z&7V8>zfjD-s>-j=Y772+d-HX-H~(Yf_ZzMqI-#XJne|QZ@!M}+7cSi>_k43*w%(@w
zHmqlVZTs>>yT`xlkft?9i^x}re-TzfmS40d2+sDqw93MZX90KL=TNQEmp$ow9Lk*^
zxt{UXdYJe{b2od8oLy>M_e+(sq?t`s%hxhL+nu%Pzj@!C`R8V&FSq}*GN<!d=%l-c
z1l1+2Jo!G}xzp4B^ZfDC9arZcIQjqizYp`5Y|<%C$$fj;?_asihfQVQ<t^W5-H{Od
z(inB}lEAsz%U?T-^^EwP*cWK;@Luh5=4Q+E><{vi@j9n_i(HNWNxCI4`a6rWIh=`0
zKD9GSGMOvvSx;6`OMa<0W0y{7b96~HpXuD)e|0*PH*d1CzF4-cCzR{mX@-sAK70S~
z+kWoH!+4vmVm(#=Ki|Ci^5)BS^S(DLCuw*mM#;UfjySoXXzR~oRXHK?l^Nb^_HEs~
z^XDXocZF`#Zuw7f-tp|N&E%zvyOwskhxF|5&5u>L(_B06_=5_*-`Dl?I~EIlvFbed
zF^}tzZq?t}Ywb2K{Ike4r%jYE|HdTYQ)&k`WeD9oANfi0wQ%{3hKcDb?r)sNocBlH
zQ|x*6$8b08g+3Aw7_L8E#gce%N6V`(LZu7DRsWx=<aoF*tMo&5Omx?td0n>+4sCL)
zi2T?nyJgb#d5aCy7uuyPS-N@l!s|(Oa|LC$Oj^L4*7CF<>|X1~)xv%2jVwDlW!CIf
ztYx0Qfa^*`+Wg$SV8xILKFxo&r6pXkF+CAid|3BsLStt49?7}=(NAuh#T-9xa5ieO
z^XfO24jIqa*u8l6ZAt93#qMX>ro3Gis_7>B*-G0j^b}*#YZotlqi#)w$-J7eW$PcT
zh`9aQd~2n5q1(?SMmIGM*M?<WDa?1AmMI^!5(<A@<(3d3CM|u@(to<@27@q#Ro~>)
z1vb22alL@)#g^BH!+Osh&YSa)RX>Qo)!F%85a0Z5LPl@)ZM8gO@8iI&5>b{iJymd>
z`huTkHyRbSCq1oEy|Ls(e&w^xmm{Y=Ho5;@ddV9l^}1<GE|#k``2{h^#`X0@O^Ntb
zG*_d4r}OP_lZbZKWij)7+B0V?v6;5?gVLF@JL>9-58XR-hriNOJ4o%~!JVc_`xnfg
zw0?tm-q}>KY;zOifZv`!PfqR(3%PzL-Tu%~o4)<G8c&LD6Q40%$RkI59aH3g&nw-N
zEq=4SyKS@QaZV(o_={>$?F+A#zBlck{HZJIyVhCVnpJO;SJvzL&RCt%!_l<(P3<YW
z)aQ~j9SeB!cAh$TcvbO(%pdymo2pU*J-$|7;89`{-*V)4BIiFdb(vRdqM6-apGi1-
zeC6tOGw<cC)hc}%y6VJpk*3rew*yyRZO;42#umD_!`7s;(Z<6|EvYX|sP@j5`L)fl
z4u%&#gk1@il`T7YG*R-G<%Df5@+!B>6_@2RcK-W%!t2RQ>Fpd@cNT~S<|bU)9K~@^
zsG6lP=*zE!>nA-WrG)qH<KMIMjO(YJ*Eg+M%eul=akJUYN2ZUL^<9`<@ax&ZhH!ql
zMHBOPRMdW5Y;N#SV&{)ujZb?_R&u`MJK;aGpzyBEH0ebQXE+Ojlr!}ew_Z}#Ezzsr
z`=_F=PIS(kI+iu-uG$=)ZFYm@j{O3Ys)W<(3vVzbK7JMVu<*)xzxoLgyBTwA+3sXt
zb;}N8mQve0SMqq)?uR?WWf|XU_2re{(7P3G*S9N7bBEhEZYABooqg-#dfWH{f@>B_
z9_88KAJ(mU^=OvU3%k}<>o&Lff5fb(d)9ecZTQT!H7i*7u;(F<fRe;OE}c}5s%pK~
z++#~-OxWE%liysV^pH{Cgv-lzNwRwF+WyJll?KoIOIA~*jYTV;#;={Gx!-TYt7jG+
z0UQtVH_M(*m=PAe^|8+ei>P!}>F=TcPUq;Zbaaqe+FoMe6{fOni_^0(b<4KYz9sV)
zZG7p^>$BMPLl*Znoz82FrR(n|@h^{`KRfoL$)-{^VY99U+p}x8Y@HGFbNy!CIR#Q_
zn?o%gFHRFklzXS#da<n7KGIE8_M7e%6SJ?UlK(CZ^j|t5*~fZIeuFZz)+&=J4J$LI
z#&6x*Ul2XVJ6tBWRck`f(}?Be;m41teA!k1V&Bda&UbSkZ!SM6%jUK^_4eGwm8}1B
zr;7NV_OrP@vpcggtZmzi54)l^X1bnu^*e5E+nPgh)mzqc@2SWV`?@M=MMlBo#>QSJ
z?JaqQjbA<<zfu?EpU2ww`;D&tV#^<EX7IATuXM8ADKYhc=IS}TJGYlQ-ed~MoZjGI
zvPXeeZt{}S<y>ynpRT*9&e%{XF6Me{#q>83?W??(o%RrHd%Wc1PyTlt-BS`P5(`w0
zuW-3`+;(Q-w*wI$+QoI3=ZSCIY|EX#TDy_abhl5)ynE+fM<2eVvb#2?r|{9XE76O&
z<hUM587~zQsfpBB>M6x*GH2lh1MQFVzw682`1_Fg!V`{td#Zk%%g7BpX*uPgYlPQV
zL6%L~W)1ls=M*HabY&+je)H;pNx`+9$_sWH9F{)iES9=~p)Atd{raY>cP$^hyR!V|
zrq9lNXFmM<lz)7akiay~mRaJ`9E;EPsB`ey>9I9th&Auo<G-nVKhMq|yfrhMUnI<W
zzV(-?o493g$6_CyfJc4q7U$9h7HcQ4wn%EOQM>)<s!K_A!fH{Qq-)G>g)a`;#22(Q
zeF*MzG<4)YYOv5$lfhMy<)+?-6-`bN-2z4b8@p_-76%%HZA>q0;5orvF8)`X{aRQ4
z3Xz){i?z5u-bkys!e<~e*TpKy`s?DeJ4&{m==;5|f7z}h+PX(emWfQbXm)){DMRMY
z*@rhXPv5>XWYbFd<ilJyzFvH>?7e<rUUrS<@AHgz{vLku;NQXQ7u?rRE#LqC)be#x
z9V6EtC|@2R`XeYiW5KTZZ8=<PK3FWWUi?#{Yxg8Jf7al4hlAJOcaN!lFy{i(8|yNc
zP2Db*dk)Ge=Ra}EpYN(*JjLx`omH3F%<nISKVN8S5NSB6v{2x~R-qbY|JEg$?^z;C
zeO@#*`5rv_O7IM$T4i(^>qIpp#ar!{oL+f1)W~nN&snT@UE`@T|B|||JQ2?pywW=4
zeM0Qprl~Vtx-bW=U3q=AV_CqeHMQ<bkG@%u5vh{vvNhYAo%zP}8O*s=>c*vuwQeY_
zN_6})^ZE7_+*gct1%+<7%zr%He*T_`$Bi-=SW+dPvvhbx9n)m;$gyF6s(s_bl&fcr
zo-v7SIc9e9>Z%Uy=iBEvEOzylbQbnHd^X>LW7VO@1~o!i_pOvevKudUHODirnN$*e
zjPZy5>xA~ku!wBeqsRLB4*#lUt&g65=Ensa>6>jq%^NP{^si=X^5wl;x<hbM^aqoR
zn-tR<c8EL7uolSUsjZOMT(fFVj7f84+El}>hAw6cr2>Mygl&8-zGF%-dGsTom_OKW
zrvPVJbc4O`%LlVW+EZR$PYly4pUw5;M2*eUz?HvB1s2R`e~=s|+@F#3b;j*2m##LH
zy^YUb@mIlTacEbqk-VX-#$;{NpK(7Q=<z?kDzyAsp5+d%2l8qg-2axyExmr2vqE`w
zkoouUfOD%lL#w1qp2rHEzGJ?qr7**UU$|<9)ARjH=Uc5j%&}^})|=|u1zI^gFNKs<
zJRch?7?;LyZ5I!kUHnw{?8-ZQ0S4BMDxH~!zp^C1ie~73d*LL{8{x=C)4UUX0SqiM
zi_f3yPMNl1xlp51cHE4m?=03oQZ<mxc)05F$<I$6uIYsdElja$Jt<JA%zSBv%=~-i
z3l4_d*lDw8mG#jF-vXw2e-Kwxu4ERSV<ogXT$P25xn+W8!|myIyPvRyzuR0Hsdx0n
zg9J8~c;A4pG6B10|FQV_RY8y`z_Q}2e7)tLO*8NBv8j4$(|nrCe5G$@HtT$~`7^7$
znc^PKJfOVj?9B3s+s~}^nmAoc;INm?gIR@7&b(sfQGUFZ(`t8c{6?t`kGT!33pX{}
zq^;~MX_&UUdCnhMS4q_kcK+2*%yRQGwpW!N{=HRU>!c;Q>#x2J@BPa6K6A#T|0QjY
z=bV$C>NX|)=B~AW{>S{V5cpFYAa1)VXovj1JL&SFCCx2L4-_;L*TzrP5%}CNLB!#N
z%#wm$rnfCC1g=O-IDI+x@J4P8S)GT??_S<io-O5;ZG1F)XNp9Z?+vCso)&%=E-ZL%
z?pJ5O*4OXg<z6F;ww&j!V!2Z?mPQ21dhBPqZg`+mwSSW4Ox^>{QydSztak1Vb>nBz
z>PldFseMI!*}a9GT+8l+EI#l>=IzI`7x&9sWfsj_I{TTYz}%~048m*dvnOk<z8H1&
zaiourD#NyR-9tHxO}uy~zEM7Reagzq`5p5Ys=r}+CN8S7e~sL$HGP_P@57{fH~!UY
zO@D3vI@QEB$M3c2vG44@CcnZwFD`j^?v%*g>BmhUn(0P3R`@W#Tkz!DM_0!mT1*Km
zCTsofYY3Y$gFSQN-0C)stqBbOQYWpAdO!WemE&GZUu`P5tg|(^!fd6d=gWrs34i9d
zn)%kOc-mIcF2z5wp-O&AdeqdkUpF2Is%vjp|MV-H-m_oft`c{(w(ls@b9{AZw+-V|
zK0{}rg)8HqA6>h1!zp&VgL0>rHq<%442e2@H|c#>-2sW|{g3;EmuzM1I=4W|a(V5y
zb$OQO^RoK_HnL2JJZQ4O^77WM54SC+ODWW+pF3K6{iZ{Et@t<BQ=3c#6ql9i`pE?{
zPRm&wwBYQSI*XI<Z{5sTzGjEGpLLNL6Hh>DS%O;$H@9eT$I_F({;;i@Gb@CD-_LLQ
z>-+Zo-JZ{%7HAT3g17k6Y3G<^iKer@58b)UH!j>N)7JO(#7F6cca{IEoLe0Fcb(9e
zE5SU^FJ^4|Ke13l&t#pR)_%8VK^KkI9=fuz=XLN~p*7`4t`}UXi#x-o=HOV9e}(aZ
zQk(m~huhf`vX>qe{I@4&Np&BqpT_S%3BMT!l9Vn;1{{+xTQj4*b@PRbk2U={%~Lqm
zUN$Y3Gp;MpT%&Z#NbS$Ax~Cs>IX6i?u8D4+v@*i3^ZHuLkIXivi=Y3|aSuEvH-lsA
zUgxcuwiB&>y81J{DJY)(;`G6}&gu$IZ;#zb$vRLV#@;*e*~E<4YrWCWPd+#vyXlhr
zYTvV$<38GMdv^7q?Yy3!99nl=>(dYK@!N6j_~d^w!mBx$QW~X-l~dKfm8`mKVZ3<P
zmGb%XUB%~qXz6}?@$PPSq5jv(H(e`tmWD6qS#<W#<E8%T3CaxuFAkjMJ^baunuq(Q
zZgu2jGfxRHKl#4w%sc<TSuUaf=RD|sH;>yWU|&zt-Hji^EI)7VUmvsJ#+DPBUFQvT
z8Y>tVU*S2!GHIdNmIDh!4$kAbaeS)AZI5@GAOCIClHrrkS3dP4sYNU>YW75K$J*dZ
zx4%ykHl&KJtS$Q8#;nv`y{ULs`mr^)I)h#96H5Pc=Bzt+XJz41d+jf?#dnzoot^V!
zxs|H#yBCYs^d+?M+g5x1@QrQNh>6~xzmQpMdAiqX&ZdtpyXzPD2<2!U{~r4&*yPZe
zu(Af@)eD$y^!ukw61o$iw)9nuvZ>#Wy*kZhcV~q@4O$WN`BNIZ?<IvDK9?Wd(GPe%
z_tv87sJX(C?ICj}eyzFkS=gtyiuI}O)6<$ue{a?+THKb)tZa55q-*NAYcC(X+S1{8
z&hLd_zQmo@n=kq0<Lm!S-6UG-c{|7LP2+tw#_vB<<L4=>aa%Q<bh7DB*Vy8ezGo>%
zvZiKN!ef!>txtOtN)FWWuCvr?emL{nG)8_OUzHhqrha?izv25WxgBz%X7<~j?w``y
z^@YETA!F)=+<&~YKj&PImn_(!-TJO|ew)5bkos$*jNem=)qCa4V%(SJ?dN9M_wd@<
z?^z7K<sttW=8Gg={^FQ?@SOR5(?6H1!rGrzXi4c`5b74st*O&**=B3s=|8Q_M=<;f
z=Xvq(1#cg^p3N5c`~F1I)#HaZ@pu(a^>kU<ud07VvS5Y4s+GR>l3OHst>=BnG|!C+
zP5C=9Jw&)*b@&S%o)`VWf+59oE+xKN=^3HHo)9I<p}jpc;&u3E)x6lKta!EZkd5AH
z+e<gfAKCL{mA-y2`>%tVRezW7@tU=h(ZB7+qN1}KI=SO_^-7xEkxg~3F=v#p<*#q+
zKe*gmGG0&i<WA{R&8Ft7qSRJNGw%+%{9?fhug`sKUA5oL+5`4qoVP%3iK~&SO>b+>
zA2Y@BQfEnpnbV99gv6$A-LDzUzsjm@*-Q>e*Sf`g-d9)8^7(SCHO$(1E9d6T{;zU&
zZ%*u~$^9tuEZ9KFUGj57z`T3%k0xKXTe*1c&3g-F?mnE!*wc4T<9INm^_raEr#m&-
zTQ{x$)SJU5@PSW!#_s7q_a#gdDLC~isZ#p6pxIF-@4%U%)0SxG?^!lk@1AXYSnq`+
z@0db`?>=?e{FeFuDr>8rX9BsaI=V~BJtPtg*8Y0>@?78g1(S+6nyv;LY*=o4>f?lC
z_g2l}+kdpid`|3dSuf4Kx#rpT4*7fdOFUrso6t}vRre-f@slX=A1!|>aunWgGuriW
z!w$PWJMCn6`SWK9<=B_3IVl?4wtjNf?UgC}dX6lscQy6bdtmA3wQS|T152MW$$Crw
zI}?1}Y_`dh>d!8*KbG!N4o_P<)xG}{6Vuw%c~?!nIBrF)?RdsDslm7ZjFoxouB-Ly
zm*r;eH@9H2|NTZq=h}fCM!E^6Cl<Ur7$$L*@k@9ObJ>wn4`;V|QkNZi??m2}%b2+_
z^cb7@ia4W1LUXt93jYp!z4o!D<p+bLLpyG^N-zIWzab#x^1oU8u1s#(c+_{{#cx&F
zY`GUB5?2Lpjh*S^`dUi;x~IkE?O#PMAK7DSH8b^`i+ye6XVY&iPgZJ8@xEUqcWhba
z#64O2Rx>#^MTOQ}p0e3b>ypEFX)A>dTn?uTYo4sS*|`3Ilt1rPCoS%?*Q~q#l^$5+
zT5<d5g-Zu20+wfY+&(#V@&vcL8@_tqp3f1r|6^0vGygf!x$b-azqn}L9C>Bx`Sx9M
zF<G|S&GL_BozE_>K9d|EcCTWyyRi3i-t2uhwpj1IRukM;x&C*jM0k1s2AR^=3cD^|
zn3UCLX0ssn{+lONp%dPOtcoj+URwL&slP|`&$8bCXs2fW&bT4*hlzn9fSrLs8PAbd
z1v!Z&Y57IDdIgoep}zUI4S4qc4i|WP&`eA^wp>DB!Qn2myIr}CjZZfya`0STCak;Z
ziKkci|KEZCI+AxEUFMw7apm#j$L{AI{yzM+|An@Hpj6L0<0;dg%Y2nt=RNJ6!LA<t
zJ;gf$Q<wfMOMm$3(c9e}b@vWuwSVC4oiyR0FjuJ97YUtBhZc*kmNlPH+&DoiQ*t_+
zj_rvHNm-V*LRqJSPfTU2*|tJeI7KH=sCCNX&uL;a+zx56ZhjKsvh2u|7fS_l0vDw@
zg*cSwoPTQ8vo~fn(<Bx98_ma57~`gR33p66Wh8#3qSyb=37)cNxAn5NuJVf6#FV}v
zL-Xslo1OO`SsuOgaBGHdkgVLxZRyb_YYp}0xHZ|AeT&*Gw`lLyP)|<=;|-r|<{j3G
z`&$#CVm@EoJpSGE`OoAoWC{k_6|PNLTmHM|Vti$s)(pdt13?ewF01*cvDf^d$?^@3
zXARV^?s#J6$<(YgpV4(jb3N0m^9ldkU#^`gyg7Q_t*slY-0olBbgM<6wqfa{8xM9S
z^Qpd4=;_}PJe7IAW!uk*3+1mh?)G>nxF+DHV}N(e)@c>pW*=@xCvCg;WuJ<y`IX#h
zCq<gCrL!F|dvlZ5@%r26&qP|HmK96xyWA7}e$NG-gEu`s?whZD;m7X-rmc&YiJj<S
zowS-)VE)%HbN>|Tb8gJ`?Adv>PjhSNq*aTSSYH0`eK}rhM<>hu-4}D_NttIHm?t6r
zCNSXt@~>wu{5iEo?zXaWz01_uD&g#(b~R14dvNi^vsqe-$2oaDqhfjW?-Yuv?Z|A}
zxOlS6#-=^F(=UJ8-CVkAv1Re(*2@V?mg!IJ$w+x}Z9QkSY=Xtt8qKHHYCQYiY3{hA
zo@@2`?CZMRrvC+3J+giMd`cJYJ!q;L>U@!{EL6rXt^C}}ec27i?tX1>Ib*Q;bh=jZ
z#uwiCY66Q@?#EoUI2<*>;qndr*A+2tU#>f3D~EqIS~Z<pbg6r03xiaR{lBF<c-(Bo
z%sk|Kqkm;KmM!1Jxb3RU<_Dz@_T9E!fBV_%liO|ye7tz1x}Gt>o0&y~fq{X80W=SN
zwdSvHsVD<OfG-1sBEHO1S(1^T2U@rnQ<#6-V$*;7`Aydo6s5DZJuiD#A3XhVspqZJ
z*|S(mtKKR}zewrawsoTFT#c(=xj)^_PxJ7a;$rzyPp+Uny~MoFg|Gea!!!A9hjTWc
z{QC0xM^}*#E+0Nto|vpO%hkp{<@ii_ogY7z?%uuitly=ax$d7`55~RQS93B?Y)<VH
zCEth>`#)NoopzyL^iF(U?%7WzCvEb>#8S`M_Pd_eIm`V_-81Tk>lC%5Y;W7yQ#}Kg
zWa_xRF;_54(yY<`@jYqk@0lu7ejZioTQ=*I>7P~A;;(hQo}CeY<JS9X*RH!lGn?y_
zxAk1!S!Ml|^*Zk+8{QoP_a=#Vn|yf}u3UD?cwPfT)7P8d8`4j#`uRb5tH`s(vrCWZ
z|5cUWxcNQnd13o?_j_-o=yL5_Ghaim$z-N$@tkeXp0>=pb6~RH;|bz68d}T#KDal(
zcwyYRnhA0HuI0Zz_x=g@T^)9@@XWgP(oCCo{`a$g+cWd-dDZ@@7v4Xgbkr|+y88V^
zHoh4@L$gnA5>Hub{&{*}%vRQk=Mw`GH#i#Yo_5|*JMGP}y+5D+I%ECw_RW*+pHF{p
zkLIzv62ER6`zgj*T~SL;K2T~|9vF~wwfDE{=XvTj-yhDsc*CrF^RJ0FgI-U~`zH9!
zW6Fogu3Xk0Mgm9n3B0M|y)|i$y6e0yo+pel%Kgn<w;wLd>6@=1*eZWqPHVRXi(*1^
zbl?+Zw*R|V-{#bhPJiue#u{rlzph!bWd6A#KC9Wq_D>RD=gO#lmph}ZY!<D5G|Gdu
zV$wqO`^W1Hy+1!yv|IOb`sT<ldw=TmO$$8eeEz)B`EUPb&v*Z4@@%%-?_<SRcy3Od
zSCwCQT0U~ybFqF_`y3Om<@*b-EYjWEbXkM*`?s9k#R=6b!l&p+UD#b}<eH>&^yQtC
zY_}75uFr~|b}oYPS%?%1qj2wH0W~pIMw^%e!auejFg<g8K~?r5hEtQ)?U``?kCC3u
zgbm^i^ByiRuRQrxqpIS9{<lkaZ<od!+OxzaJl-fJbL`{f6%qXhFR_0=5XQCUNsid>
z;xM&~_TEprU0annN+w)Y{eI9}$I@2xd*HK|J7o;hZPvYUmw4Lugw=v|y1>DJdFBE(
z^Litgp0$T%9qD;no{_glaCiLApL@1GF@IOMX`i&5)T=2UYYa+OGYT1<+~b`Q@xD*8
zd8bjz(W7%GP4kQhKH`7wV7=;Bg&Rg5(<4QS`7;m3yu3N5dF|xgtkc##X^s|P)QO8}
zi?JwIel}z8oW!N^)1Q8-`pZ5=TXXu&T}vbX-+v;rU|HT2qc?9gCLG)GG@otl{i{Ca
z-2!frzYJI>oD)@KvER41P+!T>Y4>jCJpIcp{Zhe8_$~DKZ4(w}ceCETD`3SD@ZH6^
zA%FI#*O8(}UrhYf$)?&SYUT7hK;J)?Mf#Jw&;hQ0FZP9qJlvb+WB+QK>;D9^BlmSh
z1T)&&1P?}*&0hI^$DvCXR<QfM_1Jz>{9IVV+=8t^4DH`*&U(Z$Z10@1)?&uFsr$ur
zyf+KYnQXLiHOG%R%RUEfxS(HiU7?~?tWcD5Q;YZidEVK)d2=RSWRbgZ==>&AfpVuG
zzj~wEG@Yl)^4!!p%Ui@S{c|b9x9XPoi}RK}t!eDJtNxO!?kl&Hg3&}~Lsp+-hO>*B
zC0^C=6s+D^y(ndxoY8XjMhk`A?QI2f+5Qyp-8}qw#Z`w#d=+2MvG=~*=lbX3|7%AS
zZP(7KSh75jd-@HFxAhAraO^2&VYB4ypKDfoNOpEqN#Lnv*F@7c8ZMbC{_Fj&-EP;9
zKg&uJaP_RY_TgR1G7rYD`vQ-hVsUgf`=?!+dqX(6`>@$0q579M))a}lg;w*Mo;&|@
z!6E*0^&4vw?we@ZI=}h<PVryW6)ES^TrX!O$w^JA_ipDny??q)_F>!O`-RaD(w6#a
z2lcQTE?VNt@jvNZchld^Ei1eQzG({QHIzv*o{+a_lt~MECJ=fp_r$u0s0oTP7AD^_
zC66xDZn8PW^{{8l4x2m2^m2A7y6xD!>`hbZjW69P^#^bKIdg%ZH|_9lx9S`7I0{<(
zN)9BYzdpF(?z3w%=iIH?w{PdJT{9}?tEb<4`SZ!M&u4!gJ>q!%NrzHPrbTa_WYY%&
zUG85eKg&pkWmnB*s{7bt|Cl*p=7vLpf6UjYhCF%w>`K8c2d2-Ad2@a(l<@e}))rWz
z7yak_lUJXnuxFk)|H<a;+9g)^Sb~`ZBK=SQJYea0+Crr#C^|-T&&GrPNfjK2U0Dwc
z-tb>|xGsrVq~Mv*ImwM@rk?8HZ99A~aY}ReBC9{9g;lq=E#KWJ;_+KE=)#c+W;wn>
zTsv&$7<siV)K~Y-nkk%95j|5=nB&p%PbL{t4>WftU3gvSX7b{~w%?iD;oP?!l~;*c
zHgjF7ESe)Fo&3jafrj7W6z-1T-B}ZlDW+|oQ<uQ;=hM@W_A_b>$1E>vA2Io{`R6H<
zy%!c4F1jt0e)@#=`zx1M7saj3o7((RdTo)z+m9D~zwx^1ZMo{G*f38|O1{K;=DPj+
zi<uSfNSaB1?$JM{@=84IfX>Sukq64Il#6mO{tzxwZ%<`#Zn}D}{C*G5q!sTJAAH@^
zp)g_9CC@2>j*t6Unp)?dS!lkaP4mDWktl}!9}cwVPTn%DZuZne^NXkNeY(Moh5ult
z;2Iun(W@Iai)@JKc;CUcu<(N&=Zvc<c>!}i9ncpnTBP2U!q4+hGB2WvBg|9e5W_09
z6xQ{x*u#Z)ZauhmW4DIp{>xhuvo{^oobOg=Wb#B{S&WLGW6+9LC7+#VYmaoUVant>
zuuS9Ob(1Soj=wzR%F)LlK3&nY&49TjcU#YexXmjBF7W=zpYlv^cEJR<z?4S?>FIpy
zHqS}Q*ciOq^Jl5L5R<^)bF266z3$taedvT-Yj)yUYqpw*vdt|Qdo9+_EZ>#=TWrI+
zy&1<$1lX2rl(@R|fAlQrgBSh<UyRy)*xOj{)U~4I9o$!xH+~50UA`xxFk<(d^NJj&
zGCvmZ_pM&*bxBO?VRBn|pwKeyg~ronXfM*)d#69sPF~RP1{0(DQYCxlXBJ*QM%T07
z|NY5&sQdAD@$}^zj((DnaofWtyWj?Aj9yFZp9@;i8zi((vMbCxRl8Mq-nA23{j~q|
zSWfwv*)425k;$e#$bSlV<`aJz<;F(>4|0w@lVW{6Cs%mpnKj<*-FI`^<sUd4eat6x
zOP<}A;o4O$@AYNs6|!zSkF;cbxO@MShNQ_{uA}Su<Yrkgl+4Mz;wCkTBX#kU>$`bZ
zMH!m}b9_H|N4VcF+Tq;Go43!u-@AFeIp3?q$=m;N{;#=`Rh2EU>orf&pKpKe9{u?H
zq`d6nMa9?E7wxW!K9-iG-C#B^=<J=VUeka7tXgm^`{@mlvu=}ogG>_Uy8b=+Zso+4
zds#266p2;8azw-Vt)>6X5PN>H(k-lP8(069+P)(}=aW-{35z5Dj$NU*KRpbpsV{yY
zyJwa7A}gC0Ynq!{ce!U<E3AF-;Os&EpiL7$7EZE1Hu>GB9@|;JXM}B%vF1xVcU+_L
zzbm^^MlZLd&os_wos(XrwAz~d_!az*BS4%vobQ`9TM7T%=hr^$IW{LjIU)CZbrFN_
z&4^#kIdT&ie5zcg9Q$X~5-(SM(o`&$`RK;^`oB3#RqpEhKi@1g`&+!%hQC22ZDmi_
zn@#-0>E`BflzWGC)uzMe?<i_-*>cvhd8*GT)$H4{nTs}WEmMq})RuYC=<)|XIlH^z
zI+ym`HIGV@Yp|O4y`<lOu`{jH?_26+tM-d(%hYr?lqQ(2*GjDMeJS`Owjuj2V}Ibm
zt?Zhe?$_(j@j0K)&<QZt&hHAV+j)2IYZK?!cTR1eur)6=;7Z4jYrRf)!u6jyemG>O
z)And<!PMDh9OquJHn$7xvH14y$3#Y<9UMF{B^MSQlr2%s`u#4xiZeoGok5%Qv5lAK
z%GG5Yj;eV7e6#5ppZ?DZ>A!v)DcCmkt?Jz%Ve7kfv)FQ8yHA#uFqpdSq}Ri;qV)aQ
zU4NCo@NYPK&vC+IV=r#c0(&Fp=B4|O6>}YU6DlFI)h{b6sOZA_xQ@q$8=7OBKEK_2
z_xgJNHa!hhhKUVabq00c_AeE%Yqz};;2N%ZY+lHsAhm?(7Mm4<TE@2@NFVwy=XGkC
zvj->l2{tWXkGSCZE&VsL1X;Nix<6`YKYwMj*E{DS`*(@|!ohWZ3pkRi4Bl5vIC5|W
zL%g=Vzee($Bs0r4j-Bl?Y#)r4gdhKF^podysM{S0p552>nPgh!1+j5#P;fC4IQGy{
zG-`3kuN_)8lh!?Fj%Tj8K6mcI+Tx#11wKjKTrU(dq(fpgPHg=?>GVhI9}D|x_vCD@
zzfk>Vf6u?^?f(tb`lYn|CvjWuIWw0<m8Fl9rSE|5i-$Fa_ikHPd`<s-O-%0VmnCwt
zD>DxqGf3e%=3|ukT~z4=x4(b<GS#)tk{4I)l#vr`IJ^2|igSfQVc?RVY{3q9*EU_R
z&18MTSZN!hZ~Gv4lFE^-JkDS4o^Gm3NO*sh%jD1(`(L^1zdqVH|L(dIQa|sBsjvO2
z=$}z??EdPgCNZ8yjd@Lb%yNwEr-+A3mo4b#i8b(9V9$KKu<ou!@A;-IUg>EaCT(v{
zA3u5DKVag4We=_!rq*_GNTf(<=PcP5RS+4qI5#5bgAMZn?th`Ir73)~A75_VAg>=B
zn6pIgfEfE_k@bvL-A2o<e!F>weOt(~<Ehsz=O0X1IxFp5Dvx8nxsbY|#JQ!`%)4VR
z%TK5|Etg|_#<Jo<rC6=|Wv{D#FXl_Q9CUqoe8JB}o}#uBKlRso^0*4PF<)O<^QukZ
zNu=RxH;dmgA0pFTb8_VO+upa|yJLq%{qL7QF6-O3B%29u3;y$0;@8W}m^uIC&n#+x
zCVYxvuHSk4(5ee7iZ;qP1_ne%7O$$Ri$3@I#-_tNid%1cyU$vYrhLPF)0)RwO2KdU
zGu`{Rx##yztCS089Zzb0DWB^nD9WdQ`Cs!iwMm)H|Ia-3@ljcMcE|Y;r%v01l-G-@
zezVR^KGgm2LY2|=6FIBXx9{pU^^Q_aU7eGu?VZ&*ZL9cJm4Jf=A@}b;OxbiSMM>|&
z8^_bUdzoi?95{3_CszDY!X$<Z&Vo7>b3a5qj6O1Br%_?X*EBU2WB2!S0@Je>Wx2F$
zyA$#J$gN2;4{WZzw|R!fn{P9Vti7+dDy*%tI-0Ruqxyma|1D3>a>jE@7FN1E@ORHT
zS6fwn(z1!I%E0$=K|p8&kGsI~1#jyP{Od2$_V^~Ra@PGh|GC25T^1)+Dqi35DeC1^
zX4Rr^B5Q09CTpy=y?$$Q`d`6o^F7Yon!G8kb>~vE`h-feP4j2vTj;-EEuH)B#k#BS
z^i^eF1}mQuwJl`1ui9g#mJ!+O=HzSkLTkmE))|(<eYcjCSydn4Y_eqWdARx4Dd#!M
zzNfZvaNarc)l<3nRvGX4rFPAh{)Y3m@GkD!k*c{j`ASwq*u|}DE(){mxR#oK+3>pS
z<O%yGopVi0_AWHn_Vl>t8<D5~G55sFR;%^-^ZxB&n6t)Kyux|q`zk@VP}v%pyTuI~
z7q0PEpD~NguI=K?wz*$@d=m2(zbWlyP&>wY^Is6dES9D^hDMdJW}z3CfAag5+^@a-
z?dZ14X;Y3ApReDT^{)5pkLxCE6=_#)yq)H4-MsI%&Hv2kdjf9vr~KpnvVWt@Tj{vw
zZ_WQ7m}dAtz3=etYnqx(dR}I%^CioK%-E7F)>%_(Udyz8yDC+ZEFyKNsUiCLR?$9-
zNyU|JSFSF~398vtbHA!fTYXJKT=BU;p^9BfYy6_0hI}$<oVw#J-$kyK=k)#c?B>sl
zbyhKZWu|uP)gF(yp2}5{Y!5>(TPMH#{mSB;>^I|`0iX7LQT6KSJUHpmbn9TTU6(wr
zJ#pG^SuPy+CdFFhU4J<H`m$*a>eK6*O5G!#Y~8&7_w&2q?A6uQVpeWPCtcY#*WvG(
zQx^Ab-oAVHc73ka3t?8>y@jpZw>?$W_~I-N%NN`Hes|A%_2Z49$7|+P#GljWkCU}5
zj}8;Rp%WMJ<Iv>rt0jgjb{{yh@UoGJ%v)>Tk}Hx`6}zjy%LMrP{)>JV_eAyHsU=Kz
zK5%geY*g44J8J=d|LWZ==dOu;3uFrW?#90Df#~|1x=(BUE3WVOnYsCdbnd3Lm6v^_
z-A~NcDJxC&kh8uVxjA{~yH^?u^G<)VvB{sv+QzW$$(*a98Ec|ib_o0q;Jn7+9KtbG
zSdUxDxTJoUMozR|YIErp-PF?jFk#zQ_jbtHl<0-;zAk@neoX8>>-zkim2ds(X5N`o
zTa#lY72ALNz2yo?AIlzvYg5HN%sV^}>Ai8Pe0S_j-z;I%Q@LAm4EwdaPwrp(U1Ni*
z-}mZ(b6jeAmpAk{u95mNTP5{h<EkyQA8*MzJ<BI|$K$ZOdnK-lIj!8a%fw(yQ0diN
zuAgEuYXjqNWL(!YxwdlW{`s}D=ETP~RUR_(_ny8=DC&G=v)KZ}@L5+lep-27Idz%g
ze(2KMn{VVDt(nykX5@ZN$+|?he_rmEy|b73x-Jl5nIN6scUf|4sJ?lf!L^4U7e0D@
zaR-C?)ekYZH-8NOF1}{cv`lB^1yO~SRRK@3?_9~?TJ%hjNy^nmk@2I}d*(Qe4-V6s
z)!g3RI4N&Zz3n`|LfDpSzwdS1mr6PQTpOkN#xmV%P3w&bW!tAs-(#)ucG&`t`5#*U
z-f7j}oRqt_)b7Q<w;VSXS!p+<PE)ubSY7c(v(@2HUhH*GQ?qN+PMr;GU+dRx!ngO>
zJ%c>9)J(Q>zYkaYzq9dAJ?(z!^p{CNqFmA(vGVu-tex+3_5C#?3#q5G?)yFWtJ|j9
z`p+j)^hn0q+~dk;UvK)wyhG+P+c(FTdQuMN3$oscSWRA=|FpEY{TciD)Qz?EuFu&R
zA1%-@Ty)`fr{5lrsSXog-<$2uS$RkD<Sj?;1FJlJziwW=tGD5jLh#cz->2*L?&)5x
z?P;;%-w~b`@k+s;9}nbRahrPd?gIX~&8PHVMYXZHe>$(>6KwP8;GIfsUDelqOMDA&
zRvw)8MZI*BiPsA`r9~~GccYhW5z9)*c6fI#R{8bT!%yzlPGE?7xyCO0RFU2aKKr>R
z6&rgE4)w9TIMQU47c!gwqvjc=$&*CvL&Ftkx37_Kxf+(dILj_wv1<F%{&lYAJayMT
zY-{A*lhU(hGJn_vrNEV<3vJ@L?jD(F_I|eOh4a^LUZ3rM{JouQz0L2UuP>XY?sXAb
zd$9O**o$Sqb=X7#uSec;R25bCvd?<MyiIxeu3|<1^s-eZ^DoSLE#7xQHg4Db+tCi9
z5^r9AV&4^Rs%pHf)2wPmWSIEv7yaoGZRT3v=kL$Ewr6!$?bl1Hv#<H>Tv2sot?u9O
zd3oBYdsgQgtxQ;Z(@Sjo%Ct}7cLn51|LIM!*|hGrC+Gct2`0;WjN-($?fX~p=b?|{
zzF+=vl~e3&Z++Qb>K5%>T=pg1FC**ATglIpZ2x^&@~h(g-`%<=e(YyJ9kYFPZQ%)L
z5e9}Z9|i_lJY%+nC7?}1Hrc_qJ+|HdDH{8%`N^RU73UkeSvPiZDjJ8#wY2Uu-X7s~
zby}3$^-U>D#2zgC;rKoOjsET8Uy7yPx{u$eSyzWnP4K?E-2Z!}{gd3Hk5BLB@0P#Z
z@l^D-ZExhc%POf)6)QI{xyXCFR&>veTWZIT7KJX`EbSM!x8mnvy+7a8iz*MFP!AKe
z?7S&^y6Y*En((<7hh}~F{=eCBecYir;r0_Q&)Li)H|_MIB{sUB)~;QmBc{SLdDeAR
zZs$pQ4<yx1&U5Rvg+xa$zW72mdXvnB?l2Y4ht81`muPUZtDLj+^xBp1-PMvm;l;IS
zZHB#Hj!$~&@4D3f<5i=x=`CSTf))z;WF9qPd)uYXFBq+)CH(lA`my}39YMm2mHaPB
z>Ua70+l!U!J@m77=k1eB7rf5=aL)6RV<t<|w153P$*ljfx^_Ezj^+H5N5B5i|2#8h
zx4FqeLH$#q_08{}GMnmLU>1use0|rsEB&PipQYmTgHQk0SaSB)+gbiA`1N!7VO^%_
zvjjxDQ)em8oy9!S{EVZ{{>>Brv-nJZ_Qu4&>)ehlIz<N)e?{Dies&@vUn}+Osri>y
zF?pGD<m4XJQGBS&pWf4c+Gy|MIjxy;sikMM>I0AbQ0)m8XzrRW%vAoWXKVZ+>l@-9
zns*qh?XGW}{9{JgAFh3Ir-N^(m4;r{iDs<cr*?W)xQnh!o`mS1+0Rnm|1q-pTT}S+
z+2i9Mo=-M^@At22qq_L*-}ygks=h_mhfWsFQL_m0V0fyMyyek`bL(@g`~yppEapbe
zTF$z2f1;{zkkUheR?ANAu%~htCVzUt=IUV^z}*mVL1x;*ZdIRM{yQZ;TUGp2s_;yx
zn)d7~bEK&0PW@LpY6TOj?pK$FzFT?t&hDq{zn`<@u(>^X@>lb%^Y=dV+`r7wVePHT
zU&q*jZ+>w;mH2G+^acBGNuTvG6*Vh5_x<C9BB%Emvo31B3A?PRX|zDtQ=4fH0~7Za
zmPsp%r|^r;(V1&3&3|3bG2zmj-)#R`t{Qpoe9wCC$E%}XXZ-PqI~{yvb;<(4;-XUB
zjaPHHc1%#dkaTd;r`ZqcyG_g`uO*$|=%mkRH>YXZOortJ>y>0m81!4@R6}z4zBVZs
zfAV7E4mI;;_*8XvOOxiaMac(?7ObDG_=a)G!cV+&j=w$jAeuFLhnIsyaX@xc?`-{o
zBMhp|KktT0G5mV<(4<C7>QBX*zTg!+5#sY+rD|Ug)%hm4mvfHYyLqy)(@c#E!cQ|9
z#Gf_EuuyY%f6{(fZl2l8D|_y($UOO?=Jb+1hWSascd8!EE$)A#aqP%n&aZ8&-j+E&
z*V&_~CFgf}&!_zN8IiJ0o2sU}IYs&gG{$oCvdM2@sn?8T>fzt@^7-cO(;sv*G#)jl
z_<Dp)Iid6D$)Zgwv^*;}TrThN=;iMU`+RrHv!?GHM)E~-7QQvP@ONXH{`r{m&P^UA
zyO|W<#ob)Ie)}BeGe`F{HZw*alZ)8$uRyQa_#wlEGXWpf&dK}VpZBM%=#OZHx$&<Z
z><x?ZAKmYf&A#0_djiY)0`|mEb<bZ9W|w6$tx!3t_>pJ!tAl5?dTwr+Cp$^=hnm^T
zgO$HJ3oplb>|pu3NaE^Kp%7+)dc_xd4;DxtZMoelaOH>cqsq1CytyWv{~&k8w=n)^
zo5{oA-ab`+t}}cGI&F(97F$^AR<?4T{{C(6#|Llz%1IgOGEQE9)X6TdAyZ!?;77}e
z-&;~<F(^!_w{$ArDZl4~mA9tN1BTN|y?^%=2`Vp2l~pU5*mRL`=_A`eKM%at787=q
zN#sqqX|U!)!vD$wiwxtAEipFCd~OC-zUA-#xtO<lo__Hx(uDEd!GG`W&aV#8zBa$(
zUrvGlX_=BK^DFXISUENbbqF8)dg8^#=F^umRJO=g6+Ym+^3z8D-Nb#iFRne+{5f%*
zomC9?E+I9cxfS_2r}o_8_b8hZcwxo!niG$|x65hB3C&{6i92=p!up75J{(a}OL-5p
zv!y2NIJ<!7S%K8%zDv7#?mb!knp5&Z`vaE?HDS(2if)8<D}0;ZeaB>a=-!m2_Iy%n
z1mqjL;&!u^FR|a!Cih)nfvmXNFON6RUR`~-)t2E;MH~BK+aDXgX7tG%bNG34UJ=U{
z&w!6!9UdzWJAb{@!hR}ydX_N5{^bXf3%u@du{}8W;^+xkp$DvI^a}jCtlpp8_i$rL
ztc|5-u-y^%1I_l{b8K##9+F*9|McxVt^E$pd*7{+dd^opN0;H<7J;qjuY8<u#<@bx
z%=heP>F*n=+jgB-{>8&k?Wo$zarkMo_Di1gKcl-&xk{h$f64qN*6s-N%De-7M-E9c
zMV?T6H`}Q0yuzUjrs71K^A}kszT|3Qsk>}*<<Jd-z6z0rjn^NV*!^Qw+WqI$>z1tw
z=i)v`o_o{1C(3(=jncl-?hO)YpT1sW<4TK|IYWxkGpVCEd`hpoqsw&7<&nRvKOeta
z*f1xIW4HeL>Q77A8cg2xTe-#B#hpvf(kz)jTd?-<Md^HnU8%`e1yv-fIjdJ3nC?9H
z;)>{(_e$9g2QLgf_L%R&q`TJydNxM<u4dR)X#b$6k=Y=^Yx30lcf|h4eVnkUnB#SJ
z=;}2>8a*2;lQO2=$-e0xcxg-0x;-=A*XngB7Cc%~_JHrAMYy+EVv-@>o_B2dKbx9Z
z*4paGB+dz7|1NTbLFSN6(muvQCD}W@+YJtRDo^<z^<<`)Y0H6NHbJ99i6+-)aBB*D
z(z>GlLcBnuaFY<{?ZfjH?9dFH+_aiyv0#y8(t{gf;g-i$wyJHaF*^3+)u%UiB~RSr
zO-nGC&V1sTPEx4r=}>0Q*zXroVg>)3ShSxlj(>c2UcR-D|F)9A21ynkd#{KK`3#z}
z`aOFNU0V{teMK>&SBmF_Q09~Eiw&J01>KNXST4FPLFD#6>+NrpX2=RjI@q2J-<a;k
z<COfuecoObjmXP$GeRp?FK@SP%`FOBw%J77(xr}h-*elwC-Oc${o=xM?Lph68SAtJ
z*B<QJa&CvAq;KF}mI*zp5_qRIbjbG2)YalS))-xOFzBjavwfuC%9LvENB`7V`z1=5
zBz$&$DRj^i6fH?pjtbY1eef{RrQ=b$58I=QJ?m5Q*1B1%a_q5Qdzq(rD$57sN1oNO
zXCk|vUU=%p8SZg}(bD%x;u0lCPO%MXb7R+cRXI(YagAlkL9xlz(+*zTyukZ>TW{;-
zNp6$E+9o*fU~qY6a#n?t-BS5t*VhR)eQGI7YRqQ(7iC}j_~WE;Or86sd*SPj9hrJ@
zenZlOkTZ6RE^AbL{`N!oj>Pu5ldM@WCi9xsE%9JkY~ir-!?IG>eW?<OE8@4#J-`^{
zY~XX)ta9>Q<!a^0Cv&vamKO4R1s*?^$WZV4pt-1M@i7kWj7^VgwyoCU6%bf5<N47>
zkwbPd3qvw<zHK=2Ma+Z!LrcOo!F4uFZpICY?m?F(gh=k>Oqk-hL;YI#9#s|o(x~LH
zfG<1&U-*;*WEzE(gf@tN(Ar>8!|I?tA$sBMOjCC!(_q<_H}i6i7vFT;8f<i)YroD}
zo%!CAXXQT;^q8IC;wMoavp(?kr=3$9V{>*%+-Z5K=lSw&N#d;qaSJp9U%AeHB~tKv
z!xU?m>@t>L@jMqMCge{E;XOCu+06#-oKR_YCA}33P455lJ^KDcup%$dmtQXnc{W`O
z;l1U0OJtMr@jSI}x9{w?-ku+)aA=oVtIgWSom{0CdGE}a_GaD@)*^E$)hWBYQsj9P
zH$S}UJ-6{(SfkF41rJYs>r%bH`>ESkR&(XOawa0o4^~}uI-#ax!;!7jquW)o+KKHz
zVsE3)!;IDmvlaRyr(G0UXvebp!FOBH?eBd9?0Fo5r@l>-kBM+i<zIPBc8>U(7Xcf0
z2nWsQjykkHRZ@bv`8wOzFv%pvEdR#PY9sxrx&bpKBR!1|?wZNrIE%~ecWbVe6O+vM
zseT@hE!Mosyb;CqUu$u9rVqd1yRC_NTQZssaflhk$HlJn@s(U<eLYMn`bC-Yy$v7l
zs~tDjnbobrJz32mqx_|b-@*0T!D*j&R;X<HS+?Y6=z|Z58vpgvOe|mUmYE2?D|Tnk
zx_)ixEtiu!=a^ba3ubQF?HzrH@j(U0QQ>^^>MiC!p9pgDU+77-vj4a%`9PJ=!N7Y7
z3U9-hWTH16V*Q-;I{#Nz(}uL=da^q1m44PrKQBmXXHA(U@iN}Tq%44!=bGc*gEv;N
zb1lC%lXJr7-8#Jg1l0N*vLw?UOf_Pv7mU!HSF&Zvm3D))D6!(SXeZVOGbfu~dnLbq
zk9|SL*>BdN!E>0d@yUI^B#;}Fb9SZaQK!lxrbG3iH<pX&y4X+H(=2B>H%y5$`Ofvi
zh20_v*AE;nvoJsW)xB_n07H$k$*jG9U$3y)UT}SyM}2AT{j&uN?yOs#Y^L*Y4gZZj
z(|mh1c#Jnaza!eXbJosz{0HwPH?!U-ko?E>VbR966I07K#;)Pry{2S!p|Z%U$rZcH
z@5#&0k5p>@ksUp?V$rgHH`3zg@A;Q;^ZP>ytBVX}^0Rpi?@cw|o2_lolgzZtc4|yV
zd*>XryLvq@raWI_J=Y-i;Epek9he<9l&3G_$=H|Gw#uZr>oP+R2e08Wm*XP;?ldcl
zPxzkD6_S00CG?_YeJ(@G*I5o}O&v_y35FF;bt>%2o$j-4JUH6GFrTabM#D5wQQ_NJ
zm&GTE6-?4{mJ&TZb)tg!SCQ~%7kpN%l0D2BAKPzTY*^c)Cnmsk;nl>K?w>kxecrw`
zv{2EXZ=-Cj9=<Cp?BJ#*hP#t4ss`p=lkN(Wj(*B>Wmj0?>^awY{`gH@tFoy{P1)cp
z>tD-<Gfpno{r+i(L2gsfta6jpGwYwey{DAGAEU`%Xrgn~fmJlY)-F=fz=C5FGiTVQ
z?TYhcI_;Hi?*CHV7QlC~uX~>%OGxFcav3=esdrK{HdVe9(D;3+O^17V@sV%mY+U_Z
z46UtpJA4ye*ska8b<b}4TgR6-kIL<D4!n`saU`q3Cc)5QdRplE)631}{SMvN+c!sM
z@r7!!h1GdE4c|_^d7AO-yu*yzixHaF1-@GRsd~DUby|c?9ee%y-KF7gxCPG5u&;_<
z9@+CMYKdCG><0@(kH*~3GP5pnmC0=l6Z@AMd@)5~@5S`&%46a)7`+_pKI&X-6tWE7
zX#aXor#@fQRXeq`b)p>p#U;lQ_$}vd+_c-x)PMS;8*A9s$_Ve2Tyat<sZiJ2{jMd?
z+iBk_&rSRhak+2fvm45>*9CgJ*rqF<vIt9Fo4PCM#^FQ(wmqDppVqx(+MuyR?aGt`
zQ4f4eF0lXm_+>3;<?KIAZ-Xz3w%p5&-;y@5FEBUe`a!mR=U7e`#@@b@wlutcWy&(4
zncBzX^p5yn6<ngAd|NoxfBC~$(Zuh2KKz~X*J#1Z*u>-P-(s4tNQ#~2*e{jnrf<A#
z4%bwzgWFhrUMAHgXy4EN5d3%Qyo;SnB`#U|D)AI9?h9G#ns~5l@%+~*dCvnxmo2!o
zeW86-w}so&O%FDHf6~#w-gLh1PhZ-n+pgboZO@<Ee(Ky3-^uHGc_J51*>n4?ZR~vM
zcPB18afeK2;c{H^wQ{c8XK#n|iMLa3Xm(XD>iYlk@zaw>moDCYreV9JMhmmj9#8L?
zw!!N}8aNWJUrt*-v10dohf*7<3G)IPEB-d$)T!)Y4*9f>H@W(zwXcKt(+{swUz<df
zH$AmX;(zk8;h>>+KyE->8T+rWOYxT~k1IyFSuV(LW7B%`*jM{amsOSiU*;hHmh-B|
zWA^U2*RZptv8Ddsi-?fr7nlziTgqha`da?^yzF@c34fEglG8t~DV<MS@oT1O`P%ro
z=f3-#t~<UbMtXL*$f6lv%9mN+4zajgoq6Jvj}C)?gyhS^KT;q4OndV5zwVFdJ;wJW
zt9fNkyT|QVB)^FxEj3X8ulVByQ!X;^TXw;>?ZtJQH8Q>Dj?d)fIlEWwuECtC7v~mR
z*&I6Y@gmcQC5wOA8^vDvena)c!DrW(UC3vMpPk_7vSI1Di?@wmSV;9<4LF_unQ3~_
z4i~xPh4(zKT%P><!^{*%W2FeO1F}L40^VOfeshnle8Ci=v|#_F-vyz?bLY7veYw3*
zOp5E^o_@C-rP+IKYg(OQ5s4O5{cae|^uV<DvgdaFl{Y6UeLZ$HapMi+t%=)ZYx-ZT
z4_y+bSo_>#?bU3*GSjzmJ8POvvuc}Hzdd7XH1|B?o!eadTXzIX-8%5#uko{#1<98i
zF0KBt<>QRXH|sjqFn%`;oLQ(AFFCW;l_~m}YcJoT=J?Bhge43v_SgJ4TYW#Faq^t$
ztMw!9mu))`sqAy+TkKA|{nK;h%P0KXmbL%>$=Y-A|JfC{MSkA%&SVqor39w$eL2r&
ze9@Nu-@k3g`z(ecvkNbMziKDnUnsEM_uQwPrQ5l#2?w8iboL>q3-6|IAz{r;Tur&1
z#?v+jm6Rv3>4{F}Daiex`up>@kF|Cww>sZ&3%@<7RDS%*lQJ)de_84eQ>;BFHHmAu
zd0q7oZ+&Cr9CLf0#m0aZL0!J7`!f^L3$}-{u0Ccio1(q)MBp|_`3+T(tD?M)?$+p5
zIwZn*<nxc^JxAuRi92?H^HK824WS*9nZ_5hE*x@P<FjGgrRVFuJDQk=JagK+TFJvE
zq=ZfXYQz)GE4>@jPTR!2;{BsmA+o>aV##FdMMWjn))k%Ry8mpg-miX=aM)|ZX}=S?
zTcy77i-w6ez0P=V+OYTFt$*LGHoZT`djG_M9h|qe>c7_bGxyZ>^ZT=2tdo<{cjk3f
z=~S0>ZoB%2IaDyT{c}p$o+D)yYGRT#fme1fEdP-#%=%#MnWnC%4vgnNG2MUjQ6_Gw
z^~VqGr+UBi{nvHctm~0bCdv7Fh0w;SAM<Aaah=ippndN8Ti)CUYVJR`57GIW&mLR3
zy(Zq}=?C*G`#%?7`QIr&(@k`7YDvY_->!=voNk}rciwKl{oj)xi`^S*gyQDSt=%(C
zAZpR6IEn4uYR9+PPrkxe_U&3u@7uF`!)90Sz4$Dy{`lFQKDQn`n<MC!U(B9W%r2e#
z?tyjQxuy5m&7bp_6%_wR8+{C`y=_p)&cMJf%7FKV;o{`PoWz2}WY7)6OCw_QA0HE~
zy}o|NEq)cj&ewNYDh(bi;J#VNdwX~HG0&(SY=(>6E=8!c&ye&A>-zV7p7kHGl_s-a
z9Tj<gZtwHDxz$gLzg?dGy8et@ijI+TTDkYc$eoj%;y3kM_M0btQ`|FS&gPw`_@maD
zPpjQg@&E0c!$;e>ziknG6DTot<I)?QE>AV}jI}GQX0F-d6)CcoD>_5a)o0nxOVd8;
z1W$`zX%u|&$(=l*ohw-PJ$SvODo!*qXR4RaUnf)lZxc@EoZXS=KXsmg52u&=)#r2G
z-05~!-SEKeO8Rvramkuq{{BOGS1yGZ6`tDOd*P2@eAG#=6wNgqxw_2~xj&<>eE<B`
zD(t4$I_dgtuXk1(UfBGoz)wEw;H&H@VHIjcN9P?{USGGf^I84wnfLG4?%F%Yphhd-
zb=%~qRJ|utyJmk24gX}J*YC0V%#oVK6Tb945L_VkVeN^QXBM-4)aq>yz5HJ-aO%V9
zzi<D1UM~MWZ~0-1_Rq)rznlN(RP)}Lr1p$+IfvWSF!{JxqxFwF%u}_OF5YsaXR};Y
z{;LoC_P1@XXBT&J#GSrjC%t-k#lIP{aejAK{8^~Yf9b|^#!u55&epB)-#hU|g??&N
z(mdU#lcFzbNsFh4zxkQ^=$*pN{le~Qo7v)-?+3^qop?(3%ang@*@?C5Z5$p5oG}QC
zV&Gn`JjvDlhi~$axOGRpUaZ(9#NxQv?ylN}*ALIHv6-v-^ZWg?OT3EvAC#TxX6b#Z
zGQGWLx$Q-_c<HGVo<CW6e@pp{;#^h#KXF-d@8#WQrF$KilYRMAW<uV(g&`7A6CQni
zV|vvzc*oplLW-I3*KYp0{Nsf&mjHtsW8bqITMuW{?U%YB7<=&Me5rJI#!SYdb5?C?
zlV_cqx4Y3vmd8poL_qz{4B^aA?)O-yFTJ^W^X7@c(|7Ma)728vwp3%DjWgrit82RQ
z8*=$|bRY3XYwQ*E=8|U<Sdo36U-5V72A>COLwOp#`FgBlxn1%PU+G%=BzmH>mEOsF
zn{2NblytFeRBzwl7MY~5s7q<4r?l%n!IN310-h{Ta@R_3`5O9U@`s#Qg(oU;W@`Q~
zxLp5EKIL*D%w@`>xkjd6r{C=p`1|+sbM^IaV-88U3I1}?c75Vte6|0Q!j%~;C;fgf
zURBz%^O&k~F8kc_!|hAdb5?$nRO(qT_Sr7j>M5tOtDec1DWTpM&wD(NbFlfG<9^pG
z%{we{rV*=bm42ewqH3X3>3zaIJc_0%j%f>~>4@bV-}<DRCG}?3Vv_|Qp60U@9M&y9
z+}pWbW~FhWbhA+W4VAv2YuQbi!arC4Qhd?&FpAUpLrm_QrFS=!${63cby#uh@xQK#
z57!!e`Q(^(G`d)N;)jjTWzv~g{h0OEw9Tw6dp`H$Hz6<K&|iNa99i(H_QI~EQze+~
zx(@Cz611A)UB>!}EvcYt{_{B|XV!!??hb$B-lz1!>faW}$&JDjBo@i4sXXn`bveU5
z-Q1r$Od@K3-t*6zszzb1o0cT(OmW_`c%ARwvX^g7ivQ2rl4#!G`zLEnt-05`titB5
zmUVdzTs*%z{<116oGX``$s1XmrG0!=)zs5(;tvE&RE%FS_k&ujitSvHYf87%GPu_F
zznD|IMMv;X#5N0q?Fy6ke|2?W@cpW6kh-4r2&Zu9jfqy1)_R;Y^m||7zQpH1#=7fs
zADO>?KJ~kIrue_+0~He|gambHpMO22QvKTQZPR9T?Uk9b;A;EB(^BUP?5@q<cWc6I
zjc~VpfBkyf)%;antkugDW{hi5y8a<_#tH6u_xJxffBXG|f4?96Oo}PWh~0CPiTkXq
z+ojvR*Sz|zXD`0R=6HuUb@iet%buCYe__s(mwI<y;&!Q9zhl$G?S-3<zg=+T#&qXZ
z*(}Y8KkHcE%3O5acxcZOUxSu+Wpjl+*Y1j8@xS-zuC?2oN!d#i(lkqB@99?WOP1@q
z=NToq?|<GBSO1`d`)Y3`i%#vhEwxE$X>QDp2Zs*lNbls$oN>DNf=wBx?x&XHCQA=Q
zb!r^v`pO^2uuY@h>0-8VK;!42d3Bwaf-TRz6fX$fP!l2fp)c(9iJ!6;lip5T8+Ejz
zv5e<Re`4#M?{m~19sPPrI{!eO!93NsN-tEu`7(bGJ$Xj{$K@>R<yY69{;D<g+Lr7T
z_X5QLHVMu2&F#j=9n&|*3)?)r>XmgtS*c;}`78UgVgndnEZY8ce_gEG!pXr;v$8uX
zYwypt4e&^)GBC_;UjN~L?fWC92ep4U)>`k`c%do(|9rb8jg`9&R-J2oATDrrLjBUk
z()+VkmY*qKdPVPZs%35P*Tf6!+aCBwE>Y->ie2!_C-PXvMf<F(7Gt+Y53e|*M|b5v
zE@Fz+lwg*U5iIh#?r&%`EpluBnS&7%&7`jts$TJ4o~$X-c(rCn;F{IU+tV*CbD7P3
zeamchuiTXnw2iM!UG|6fYv#WXpTG7lRyVc{$_UxHV7kO^UaqM#RIX&Soqcyh>*4F5
z`0Eb-w<pf_-<7eq=k#yUPV;Qfh<*Cio1gTp6WhLef#9sxXQ%Z4yDHwlFh_lQM}m~h
z-(M@2HFy^pdonNzUvtw8yI%X`&qr^YgHQG&CJaGGGhe^(O@A>j1H(}r{1b+ypp%)m
zM&%aYHWT`{F1~T|ZN<`w5yxMCsd}|C{OGjUxv8g<wF|Af+Ln5FB>4*JI7D45`E@^E
zT;WIFP0y&_$0rm%By4=Y`+?%ly>@>u$o|&jWqsRcBX#WGrR96v*(N?-m-+pMRhH}|
zVX?P6_D3Cm^5ezV*?NC|iO*c8xpPTV>ygF$CJ7hW#3s+Mnk}|w#=2U^X>|^rrw`ru
z=<Jvj@!;Z&T^sqknYMk3-IOxt!toiOE^t0bba7TV_*L^<S<-<*3)S~-v3|_z%jR8;
zD%z&FZLiOxmf+iJ|J0If)chni-Ed5}n6)(7=SBXUSNTejE^~H<q?~^g`=nj_5r<K(
zX36PGE2I@RnYFp|{b`jezp2)gTr{!%a<IRJ@T0D~Di1$gTq+o}JUmmx_G*scj~L^G
z2HiQTZxzCKJU+Hf`ON|G!gd=5BZV6~cngl+vv|1f>a_-wnh%!TOL>BPj%MHP6{>!j
z^Cw~X`RxTPS10?Ko-dc|oqOnkYVY+k!bcar)LRsOj?H7w-Od?#pVT#NIBH(5Pde7r
zBUqHerM&fImxrxj$-8@zffMawn3yH*U(K`)=6AT_ZM1dS{uutZljpaqi!WaNdES#J
zmt!QKIj;>n%`2mL;-^J>Si8~c^la^zem%$Ee=hXr-WD;5DD&Xh^FmOtctT{~U1hgK
z^~KKbw)4ez%1x+#wfm#bx%pAe1?Ksa-}OJ~Y7NP4l%MD_Wp=LiZLKLh`VX=Xlxat^
z>~ZM&aN!zT&vpKlGfoO_FtV1N8NF|VZF~OT3pvlFPx%&V*~D&A`QkC(r_#w=nD6Ax
z7l)s2aKG31k7tp_f^?Y|w~Xraiyq&->d0)rXZyq`hq;n>m&UQ?7^-b}Q<HOMcDYsP
ztBJ4dJXvn7I#P15DkryS>Crh&`5c=SrS{A*JRsVidvto?GQW9SSz-(xvzGrjmt%i=
z0mI(|S{22Awr_I1@JVwbhsp!XU%Ue0uHxyRKP|lWVC%IjA2sriou03J%Y5~LsKt6y
z5^rx_{OO}(UzZ#Ek_paJ{68vHni|C=O<(4Db>iW#wmTj-uaUm9Jaf*;-1Em<)CK&^
zr!1MH+^wRfsD1SG6mJR5){Ez4f@a(~W^(G{Sv7I4D6NxD;j2y3Mb#c`TePm|;L2|g
zlBH!id{&;zuzh;<pI!Je&lRsGIK7>4fHRzvrE%XuvHd&UcE7l<aAJDv?c2*A6+LUK
z<oqCZZk^eNFcY)hk}Ddk*If!(x+F?_%KQ(^Cjy^Lh}<6Mutn7VExWqM3Qn~<u8($~
zJ`l;7%(p7m#q`!x-R>w2_H9?5&s$q&I{UlE#760LLi@S9)Ob>+FxDTOzTph>mP)2z
zL&kvO=W~VnCI&W{r0r5X8~=9RD)(2FON4xu+_FBHlhvyj>{vVF{6m!$>~llZ^gb(i
z{95p#wn$|w%b_wR!IW=De)$PT^gUTLZ6)i9-8QpB>OP3<T;1_=-5RmL_6;oM=RRu(
zC+(Tk6Mb31=-J!I_ZG(&T$<Hc$!4@WY2%g`iqCmW{?7W;tN-Ck(So~6nvR6DAHT24
z+P7wo{1f@VO674ple09vn9sGapOo{Qy`eP1W2)v^=F5SbUHYdjE?Joo>l?W&vgvGV
zKVOyn&84ZWF0SXDF3nE=t70&-+}!B*nJXJoL`@b*udJJSZb{bEzjG&-6%-U~U#9pY
z-u{C@$Sa%8%H2W%eH>q!b)UvRh-6k{ezmlizp_Y9h=sZ7z<lmaALUoN&*5#3+@Yqg
z9c0kmqu^v4Q1X4ByX>ae_c}%lcIg?}3mR7(_W0Ve;6VAuThk}-Jz4F<bwu%n%bG`#
zt9s@HhPp4@>%DD3%1Tz7CmV14`gqG^ms|C|{;jU;%jf<+EfLM9q3K!Rmr(X%-NcpJ
z?fMNjU92o79#9a8zI$@x70ZK024Yc9rfhzp>DMx)DuT(Z*hz(P){mSx1GbLUCxj~(
zWT|b``TYD!#^nC33i>A>UEO)we}?rf>*-$<RmvAvoK@sCm^UvYEZ{vuXmk!&(Q}r@
zi+Lx4Rnm3T53M;Evu*XM#q*x;+xJNKLbJ!u<_E<euCn<q-mm`0*5XdN7~|Xd@q2g6
z#PFmFTxoXG-0G}zratHVbNyp`=JKu2WwDd)ZQovf;d0oK)Lop<dM~92GJi2Uy^ytc
zv#Esq+b<nH5fg>iue~o3;^P{Wc)aoXPc4_kZ(XZ(<^-OI<U474d_}u;no5S#L0-<r
zI+s9}tXT<KDHDwacFH#$aTdR`V!zITw-HU5OJfu?S++8yO^jE*v%K1Rr_8PQ?B<IP
z-v0O@yd=Ni+gf=Rl}jZe2UN1R-aozK*H)fM(sNoWCRqM$y!Gz&z2hH}{|J{}?~#a~
z8UJ^4?h`Z4n{yw<&wA!~rmO4fdBvSer=-L*d$=hGHCQBt<QB~6s`{aMitRw!v71ls
zUVWKhH7n-k<BQSB^U}7t`DwM(oX|gQSg&?fOodgfXFu;>)5+z_FEV`YU)Z<y>-)D4
z#3W4j>|}LXwKC)_bIbRK@$ES~<uC6`OJmpJP71Q;SG@N1Mb(VWn*Gms<}iF$-aJic
zdGM)Y{b#j1{&uIN%FWrJ^1;dZd&{a*{EiZP*niz-Wm6Ss`FP7hV|qzI^&y$RGAcr+
zX9+tgRp#1eEx9ylPEo_^U$T1_EKM#9+v`zyO>4oL$l_`%yL0WIcfDv;o%EsUvF+Eu
zj~^!=y*Pb)jotdI!Ggcl!<>9ueHYI!ov#%=Z)KF!!AnMqL!weP?Wz9rM5z4tjIQOs
zk6Af!>+$W;<DD{p-J{>;zC!1h|G#?l!#<@S?>?UU-jMj{r_qhxMf&TSEdSarOo*8`
z_xj<PXEwE`tzE9M`$A-TR@@RNz3`JMmH%sc&sjO}UODp5uhjBX-_sP|so@h79aLoM
zPQHBcJKX14V^6~24SV>Xr~Z%A>4_6Pk#W8+yI19L*Tj-luY^v%O)l46oz}1}J&3h^
zRyV)rl&1<-&aPWteftp-;kKJCDA%_!SoG_?5UoQ_E6!{Y5imH+UX)t<P#|^f43`|u
zBb9Fq8BO&<m@7VhtbXL&=I$4__m#+nlmyZ29<CI}#^YyR3!K=({Hh~D?VRH6sQIt$
z<m7|dgC;TkxwxjQe&OuOk8P^yEzzdaU45^8Ou4^$qmxtU<+Ey;I~K%h`UO9YF)$S0
zq;S7DDRcGI+X}(eojlg*QeNke<`y+XeN^TYv^r`M>*KU)E|2Hc%f9E{J~rFR;OaDO
z-?LWjH0_6{R!o(#Og#ExKI5q$@jX0NQG5KGs?}>whMv7Iwxf9eoz-S5F7;g(zxzz&
z&c1&^AEs?RHZ9~m`$^I0itkHvs?+w=o9~l|xw(D0xZByk3mZyOA9JTGp5eN-T+?}<
z=uHQ{cDtjEyQ&o<CLD=)e!z^?)?;_Jc!_#+#(7z;oss*Wom&1y>tl+Q<=ih*`n_wP
zx!sF>ywI>qK<B$bVK0+9Tk%bX`_um^@9=x-Zh3UJ)2q;g?IF9*oC#j`(xmxU=j8YM
z-s&BAp0?n~l53}!cHgk6iRWXf5MOkezm#Y3w;0jG4_1ghO@DCftMLyh6*<#YhptXP
zU7fdO*2)+A%%swn{_g#IboS$4Jxs2P)w+UKWnI6RR;Kyf$nT)MMeFG=rox5MWoB~w
z|DXH!E_$(F{amZXvm&2xx>lWUnyMPN`*Aj_fKAQ%W6@WxX5EaxxV_J==;<Zz_=>65
zvd;Lay?QfytJ$lnkBk0ZPM#kA+IyFH%)`u!;p;z|Fn;#xn^wis`*G(!#iUK_2OH`q
z{bV`ka8-1_q>)YN?pd<eYDCKde2%_4|1I$Rg^9O9d#5>ndU&`!?%LD?da8+XX?_br
zrPJB9^fcO+<Tx72J}EgYrxoWC8~H|QmG1g~ajlt8CYedS>-v5-`<l>J8)kXQ3H+I<
zcgk7k>PtQrS}UX<E%ZXQVo%fI^|5C1PLp<ZHp#M?PC24=@Yzm&uNfUjI3F}tt!20`
z^6BuCjalmYyH=dz$$Ou=b<g8ij=9?twgj$y`S<%Zu0ONSOv(O!T{b|wQP%YK(eRbO
zG}iu_db0aTm;9O6Po$j}s%*b0Z+4oMceR|u?A7i*mE673hkx9#^5Jdz!yX-aChC8L
z#HtMskB4#RW<P%LTlEP)r*3qt_vZ)M_b1u2%YORj^!@Cc(+B^nnXB>qv5}d>m%r)b
z<daXoR#?bxoBw9DsH0nWJYSLRjCp_d@Gtq>?BaR(#$x%X`fUx4s!yW&)WlU1H}5*c
zy!pU~u3t}<`s`1;kt*sZysAz7+&m?>XCX%uFL2c~b@Bgyy?0N}f`WX`z@INTRnM8S
zUvJp8K}9cE%4YihhtC7dR5s^5nWZMPO74E^oIBe4e+jA0W<8p>)5l1<AtliN>+N=L
z_Vt}951VZZd$uwZEuXZc>S%xVN1ZD|S028*^~BpbR8hd~Uqhl+jQXNweEv;tZ|%?C
z4E%oobNI9RYI)tSTmP=&UAJ&nqPePP(Q(^lb3ccl+Y&ZMb>h!meWBlX++4V!m+`6_
zhvBIhG41((xD@)Q{<YUi`QKS*^hn@kfa}KF3nV6a9+|3XR28&>>C&#LRWtsHNAGQ1
z^C_%x?fs9hugAX+esA$0CUx)TTh*P{z8?K~^2w{5l6xO6Eh_ze`fW+Y%x_Oy*9hfC
zdVYJY|EDxc_16Yo9nB;9`U?Wj{kPG&DqL+fvuCy(zr9aBTe^Ak>4$fpJX<8lu>Rns
z;AijSmZ{gSik|0poF($ut9^~ey<F0l7`l2qOdnK+y;$&DynD^gAMREE`B8g!R>lQ#
zKbaU9ZgMj)XyaK9nvz(OsPF8Xn4RjASzJ=AS5i?jH_W$qk%PeA=iwz2WlpG0EzZ;F
z(-UPqd?4>_r<2U%H5_^gK`W>HudSAFJE$T5(d_d3(*1RJeJZ(EPdGkdiOutm>>os1
zTn}#B&D16G&9XV^Y;nZL83(QPuf5#YFh`WtKW=_rp5m=GX|bHjL)(AnPS{vqJ#XXE
zf89H-6y@yrZIXV>m~++VhjN;`b^e}S<Wyf#(XcYnzb4s9<H5^+&)k;XUTWBHSK?)3
zkp9{IPor;LvIO_*;=?s=ZU$vF)hx-$UMFiMIm!~ZaK_J+&6CV1pTEsenVmP;wJoXi
z{Kx0TkGec$D=#>tim>P$3b#sHkzO&aGw{{UCr8bfEvURXFVRlm@9R|#4}yg}3JkW^
z1@M|2cN6iRHiP5x-t`x)?iSZ7t;krvK+FEs%hOjH{M5ZwKSa1Ti{BS2v)H^dS@`zi
zLs2#tniDo!q*rP04cu%yU5KxMyDj_Qk_~*t8+o|ZtlG`x9{Cx_oaLwp+K?mawkF5d
ze)G0j6CWov?mD@Z;gwc)Oi|LrjRlM6XLeP_y%3(FUmx^9`Go0V#vN_H)djXsbN4x4
z?tR^Rl6TrUeIbc?N>iODJ)W4nUnl;=o;wY<TAz8H3Y`9JX0}+a*XFQHndR?yw0{sw
zvxzyPQ?I3%d^|9|-DY{_=bEm^vvy9iwQQfeZX@gMj|ncvrun)Z-@C5hQpk}NKPq?g
z#%wnJYWsM{x($3+FC5V_%QC5b9sOA8byjb8msb3~>wd0s*Fx`i<vvM1n)UR&-HCb9
zs`f117anh#bJxR1*=Kcb-%q9K{#QfW`%f+jJDPR8w4%Z`oqJufuuJ$|q3Tty6?^K+
z<EG{M{T1YNn^ryR<n`0SpSWLfJ6+IQx@y^($r|_cBd;%cE#>!DyGVV{;j8D~y#3Jk
zQak<EYq<rL4fhzMT(b}7$UXaHFnRy(vr7d|A9jDcW!YKlg$XA=?B~+2m{p>i*jt^o
z!0o+K$&bs*wb~2Q0{@;|pTD~1`_$*{hd<^oVY(jF#B!Y_=74;><HGGny3JRzXj%S8
zIs^kWK4R^$=Gp;v1_pTv1_piNbC8cum@haNMMM_Q_7JGMzJA7}V9}7LD?ZIJS4wQ>
z73*^Fd)nz_uqmyVZJKjjzSsZS-On2wo$MB|OQ-Fs{`KRR#JUq^X_5~uS4VvFxiRfX
zsqc4J-&b=?L{-1`g{GV~@|qX1_w?*pAzRi-*8ectrF7D+Zpp=Yh1>GK1$zF^jPMM8
zeJ_%A-F^l6y7TYey!TsjuU|Mp^VFaGSy!%=SgFq2yCe4Yc0Y#)xkgf+g|729KDo&?
zXTq6x)8;>P7dz*Fqpf-EQrq8rG8cRI$DKLZ`<9jOP0E^8Yo``Jzi)l9X786fGi94X
z&hOse{cg^I_zY1dg}PgfreQmxnAH`-%YrsL#{^sO_^Go;h3Py`NM*}9Bzz&~^Q2=Z
z&m|p+6*$j(h<g#|pKU$M0|nLlKQeEfz_sT<UsCsknfrGX=3hO1h^_91sY~YTBh%7;
zZ7iD`z?B}Y7!+k6_***Q-Ni}yQ<gh4pZ~DrD%<RXeo5=o?lW!b*5-NJmLzks@u)!J
zmRdiF^_e?+g{`bCJAP;z{reF8LH@W3NBFt^t#2oOjF7vfxuCz@U2sx#$HG4+58DfK
za-9FWYg71srI=FZbg^~eN)l-@Zv%{d-4w#zcwO?P^&Ta?&7AsK<22uI4<_~6XCLRO
z2G%fm9G7l*W9QH55O!qdnKF|~mlpfLNk`^9kztts<hPRE%AV(c#5Kgu{@J~Be}PzH
z0dJmH(g~)6{5hF?GlPWvGPNv>f35#9zxb45@~Ii&kv*p->eMHk+<IcUj_{iaZk~KE
zn68~Qmf;KN_HN7as$abBosv@pZ?^K>Ue6B?%_T}zI1)E)3Ev>eYFz))qifPN-;=2}
zo4T4ZvLCiT;bqToxhYWmWaBZexyz^6iZnDnKKaDQdgAQ$E3O}8J+%1G&c(i*1__*p
zM7a1Hglavyy38{Ftt>5fO`139)kM*TJI-@9PI35=soKJu#VgA5gyEBY)1Lm^g2uT|
zCa|b3V7jMpCdhTxsU3wYBEKB?#KzPiFw3isCu2^iWr~Quafepdg3A+2ni`gdSQ>@M
z6*nAj>^oV(tjhGJUHz22#BtRLzgG60W{(P2+8m*JQTO_yRSP(88$~s>D^7EF*&fld
z;@qCEcV@aT+}kuo*kk1@p{^~Wzg|DRB=}RiCh7j|b?NnAUHFn@Chtfvt$1%g%T4lj
zi2etymw_+b<FBtXw|}@!KI@?FMjexC=@d~f-x|J?f0Z2%7gkKS*b-Y=<6--D%l4C-
z@6AxRGTqSgx+z`E{(xKPaV2jSD}l|Yej52)h<I`?a9#&TkVBJL%!N&L+pbjqjk(Y_
zr)7W1swRWUOT2$7Y;i7McKS!eb>7TSPyOr5;(pEFqWv|6L$c^>r}Kuq4=lILkBjAP
z2@1Iy>*#mq=jW~Ly<)3dH@??*&bYO0`S+tGiEpyE#ns!1R=vree~RTgH*e`<!N&}L
z#aBhQrn-LB{xoHJBv*-Ex~X%>NwG}}ZyYc@J-cVsE#^#1D`}=LO(9Mpwt<I41q#+X
z$JRGo3ZBqp^{q2FaMIVVHQF!lFVO7TBl0<M5$|iqjg!>2sh{%oNVZ+anUVR2>uP#N
zhWGWR_bE?RnN6Ciblika+A-HxzY$K}F*)>c&7R<mSMnkP4b4|xi`^RLr01@1NP|_u
zEZDp2`?R7cCBNhu{PQ-fXH+{lch}byH-o({nBMqYe@d!HG()FrpZUwlTT*u^M{aLt
zyJ7aoXWoaE_ftcHLmPv6>P<s^lP+*gIect&$5DgDvo@@<6gp)U_4eo9iwmw_+>+fQ
z*b?(fTleMc-xG{(uF*U-%k1Zuw=Sw8+urwlbdN}w(JSh$sgv`eC3C93=<eM|JKsm0
zlYFG7a<lsJj)}U;w(ptDo}cU8UGPlbxA;eOZQoU1`2`Yp_slo^q_X<E`<d*Md(37Y
zELg~Wk7r8C-y4f3U!3;tWvid$m8r|>%wK%Hw|Q5Y-ATUi=VkNuDiz0OJ^a?}uprbo
zcm~5mtJ9zPq;jJc-@E>5QG;;(q~aZ)&Aueb8hPD5*_(4?LU`!mOA2m*8=XEeRWmKw
zn8#jGJu~UE@z+aPQt8omJwG*Rud|);`BBpR>ANb*FHf}Fld6-+7+$0k!?Wsl+q)#0
z_S0qm#j+UhDSeMH4RW5eNI;|6H<_vXm5jQ&;l}M-Cu>A(S#g!)ido0+#0TrYtPT46
zYwPy<UK2a^l9aX24k?EQKPvBwkX$Hp$8_UCeum}g`!2k8Ikx35pFR7WZ&p)-nOC2Z
zkmgcYuqIdY(c(h|&*sGcUAnT7OGqQmWV!5{tu99!ePr*-Sw9e2{B&mA#G<7hYi>Pa
zdC0C=7w~ak?DP4?DT(gg+bY@Kidea(Uzz?+Y{lo0+GQ`z^mJV=?7wq#t<0JNrAwuM
zT!O5ZeR=gqA#i`vi}T65=FeRte|+z$i<AHHt<0akjHj+W;ONCucG8dUiz-(379_Hn
zPiLx~9QJ+n>ioi)YL!~cFTDHq&&5@K{gLmUi<>7em(5Lo^HB5Wr?VXVQy=f*=B*ZW
z3jSELLh00Z=W{u0U#J}j^Q!;M^j-DXgMQi7`?y_-%SGp`owr_LZjsev&udFU?mw?y
zH7m$^s_AiqvlC86^@peIIo6-P$FbMGY>~y~qbIUmmX)0Tuxi?8$Nv&MbK}^~D@<KD
zYi9j2c|*>H8CuN!Mn8R$oK+?sIkuAdi>^kXr(^#P;g+bm=#7EpAEF;lWMp8N#KOR!
zM^s}VAh9IFGcPS4+!mPZ>wm~WpzZx%(aEP4&QK`N=jMrc8D1uSB{(>-wO2PQx`*>+
zefe+3RAsem-kX1)v$1~vCMVqUi`F5RcPX3v4~5jcN!7Y`O-OTdEq_(}M(<}5yPn)z
zp14@dT>a)Zy_1X&AMc)g$GpeqiCB5FQNeMi<7s>Hj~JcS6=Hee>(D=U6`RQNZ^@#X
z|5$u93qKxQ{+X|*t559Sk%RjUUg%m^XV3Ke7PV&b;kHEop2fHSvPr+Q7r(i{{!ZBC
z@;8AVE2>1let6m)>g=_=#V*uv_Tw4)8f_x!KW>;a#HHx0nfbWiLGAs<n3Fa!r%jl<
z_#S=}N|ZSL{FU(@xg$l}|4ZeR{mx!-V|$3p>a|N5QUf1%8}TjhnX$K7h)ej+r;|#|
zpKqLfe~fGMF~)QHuGs>8&#%o)+8(y`)Yd53+ONHfb7C4h<KO3J<~i*Xo!M|+W9r3X
zolUo2eTqrhS6){2enDvP+bxl|625q5R+dh`^8GgBwAtL2S?i*rHeWYdzRi5)k5w_h
z?X!x0iV00jz33LvBfKwRx=tN4YF~+gfq{VuL@+QgXb_6r`1s7c%#!$cy@E<+q(v~G
z7Gu2bjCIEu85n-BFfb^gnv<DVl3G+ylv<Knq>p4m@1*-#w+%#&z5goG{$-K2hT_+E
zY`ZfiZ(<G8FcEJK>`9t$aVy2sdfM(U6TeASZ#o(HIKu0it2kTz^Z6zF?z7t1o!Q?v
zRVTpQVw!4}`gNg~%y%LJa|-78E_=h2c5L5-HD-L9UY44jTXxe_$DHH)4GCUVyTwM^
zz8!rKa3%2I{QDP{mYcp$Tqvt0uafOyk!g~=_@YM1L_4=>7wXmHQgqI@237LOKa^&!
z*As8=@s?BR4)K1z;f(i|6@UMBPycgV-!b%Yu+zCSSHiTGoOheL`;@}{+>IG?BQ)PI
zTmRiQbydtSz88-UtjV3T^1pcG5AU4EANJl~a^>U<RkL;L&8u`*o2^OFo6`|2e|xIx
zXW8zQH+$-f*3>)o?h~IDpE7yMo!q~lwgm8}XbF|d99gRzxMR+TbnTPxOSYe=OEh;;
znpu+F<Fs&c_Q@}c<`!N((C|UaJt%zdw<9-Z`S4C=WLL=M?`m%RD06SapRLXxvwrNe
zVS7-~6Ir@D_uI?&K}Hrbh6f+cX#23v{Jg!xLjlD@3!5L$DO<kt;RK<>im6X~-l-cr
zDiB&=JZo;+>#Y1;sxN(~p06lKyk2}DMnXtXd<k>@L;FR#9?sV+b|;~qo@Ziw?#>KZ
z28Icn@Fs)g{M>@foYW${g37nHZ;KwAP5S>=B;q{3SETF5Gim1A*L{lHvrVnA_xQZc
zwkPv`hVbY*36*OEc?Tt1>)Bt}d(8G`>Emt&#-JrR=PjlOs>*e;NcFnaFTBVQH{o-6
z`~M%mEM{F$SspLnYNEL)(`9q)ru{r>#lOC;et7O0chLmB{LL9=`X^S;oxXlw-PX^q
zRCmq@{xt1brjygJiN{_RF;4Y#Y;FyFSpUC0p>WM-T}v-6sl%spW~Mm`E<Jh8#9REx
z_vNdTrUu?uzsM9Ps^T$eOM>dBwYnd3CLJ@J`yu_2pl=xW&)QvHYOb@6y-HoR&z1FT
zPx#TdMqX(uCr%y}b5FFG;v2tqk;NLjIZGsYo0V4B@xPp;=CIY%<@2lEB_|8l+QccG
zee~i~mE3aUpE;BCrUm+Jj@f5Z|Nqz5i}ruIga23jf6~rq8LgUb5`VNc^zgds1M)Iw
zUOqW|+hoZmFP7$sy2f1f>zn4BdbIcQ>UzeR^*)a$q%lug^8S*|i8RZ)+TyeOawk4J
zpDp#EVBUq-jo)HJ)Dow#hc`U9_(erGZux4J814@%TuMuf7xrxUJFAYz*~;;qS1Ff@
ztAMJ>?j5n07N^YOo4}m$qFzA5@X8nQ(<a|PPR()Vo7GZrDxktS-<6TKeab}tt#=oj
zyNda6*)RSd=Q=Z|#No;3Iczsm-n9o#JFTb4_mAZ`_s$RoE9t-2e=pvAapC`G&lx*~
zR)qhMZ?@ptxSF|WlA6eF_D4pl;)lEI_euX`x9{V-Co}iYhSM*yCwn(tJF$BDn#W7l
zu+2H=y5?^`qr$O$g-+RDe=tW@9my<I^Dvpfe@-%&uhAqb)Sdm@<xsPQ%U37u)cUf>
zSwyS#lK;O#tJ#Y0W!)<`hE99@>Oi|7qiKiH>QxHHGH#QT9Qpz~Sq#^kb~f9n+h2H8
zv-L=m$({3Q+93`3>#A1;)t7r4no0Xgz4Nk|E+?Syk?n|ZO=JA!msg};>%KXDQ74m$
zJ7tEO`EC_`qpv)iySa55=I&_`PyXt5J#1CWzk&*l`a4n;e`MXlc>c|v&+DV|Lgi~<
zq1b^Ld;V%)*#0VaiqE4^kBKK8%`W-m&wqLQp`d=Fvu)ms&bHvr{>HltPWf2voRr|`
zn^daYxu(>2v(8x;b>BH+3&gZE)=F>aZD);+5M6MQD<f#z+U;i17w0rS`NegEuVwk0
zV=_7=e{Wmt-4>s<_P+=727##4dY4w$IrA<qnvfqC%z69#-fv&y+&wE~VpAQ<vac6s
z$jt4#loEQQO76+OIe`n^9u$2^RI{4@;5q9Lzd*kv4L>pMAH}Yo0>@S6PGXv~DqbbA
zUU9+wM3$4KA!knN?@|3P&dXOIoZK@(M053TMx9BA`lhcBXJ2$6O-Vs3U*qPYvdz~7
zT4R)y<2+|~`R?;?@YNSQ;IJ$1@OR6zEzE~*-bi>*?yy&9ZbQcvjjdB8MK-4<ib$W>
zrRZrU%@(&{&4L#Pq<&fd+shE58Da461%rfM>=k?KCb7I@4$F1@RQ@+TW8KwjTe7WP
z`G>M<a&`6Z=a#J7PCF<z$towF+LPtExMzuELFFgLeTKiyTcq~9I{5N-x%=_O#+%&B
zZZtn$JlXusbMLF4T+3G9iFwy6weIE8<@c(R4Kozy9!gR2T6E}pwPo*e=1GdCTNk~s
z*8I<SFJoW-a^Bi~QBKu=7dEjK^sM^3Nn;B$Uy`B!;hG&$P4;fp<qmugcBL@2d@ie;
z_^I=}_xi$WTgPJoOcVA;hn?>hkcbF-w*OW*EBEry*7&!p?tTBsP`~~e@2BUpFR>m;
z+_XaR*y#z{{<|jLt8mzHn!|Zn<&?PjHGj=zrWHN0Na*`H=h(vYvPHdrbPd-`_|5oZ
zVNg{6f}HiLRmU3a7%VTuzAk*+yY={*C)52KBu&`74&S%`{ZK~DefQIxcR|7DlP~DL
za_w*Y8WB8a;abfk{<EJM3SWE{`e8lm-n-ZoZL0~jybep>#P+dA|JD6p@FlOL$im9f
zLh9;+hgVk=pYNO-SHU~Yv|x8)T=SRY$SJ?{*1e8>pXmGj_N0d|o;>*R_u&b98>`g|
zTXXlt?k%!l$gavb`1Ur(tyqRB_viK+=%pxizj^1-{X39pvYd#NNl`5;tAEIuh2>YC
z_r1I)E5?4Y*7A<zyNd67j;Q$BCGF9@-Q9dNR6^jx-97*P_B`Bw!1l%6FP<i<f(?w%
zB^<uyv8{=&b$UE!lJo}oe<xS||Nh<mxVXD|(2Cx76{6b(bF9jLtE^kk%)olZ@@BpD
zChfyA7m{OTGUhg4vhP24&hPx1Pc`eF=OrIFxsjdahp+%cLA~QWwv%g1o=#O(xx*a9
zBCoNB@%?;Fs}*+MGpfB_@Sd@IbeplB`*PzKEB1`aEfL2Ip1g?Ic(PG$$FEkO1qu6}
zHd}xF_Jt+DKHMtoD?{YNpi6}gtFpM}h5V44r?IW+{kMdk?GY{F%kx$xuiP~KXT#5$
z5B}S{9^_AGxzVk`XVj+gtM<9?imt%sWxEw~m3Nt~J7M?qz;^BRtdH8hBumvVu|3LK
z&!)HHlj4Na{|mR&TUcekD7C#X_u>3<nE>`D+POE5UpVq_=XyuR1->2sPBI2r-7`A#
zykyr?@2AE3S9MOsyXL61ZC>H67O(Yz@7!4}%?-<=MCvtW@h_}d9~81<B42ylDG?3P
z*3--U_O@Joa`W<&<S9#axY%EucF*2ZugNWX-8TPay)omY(wqI$L=QguIdPW3hj`gl
zpH4=xHdWn7ytPS7<HC*$yY=O^&TVwrf2m|un!=m#_CALD4Uw0t56<7h(%2{~?DBJo
zu4us_?M2RAJhwLU&6weEN`0>5kDqTJY4yrZ_|ZL$!Eya+%ePuD8(5<kF`v9HIN`ii
zL*#{{Q$6|rEivx6({?fJ!UnckNwQ4Q+cLv#Cp6YZ#@l9aGT5w%S-j-O&1vT1iWYv6
z1*;{3?J_tSo+z;FJ<zmLsO{exW<h4b(^ok)=jR@XstXW_EMYyh>{QCr*?d(h(_dTn
zu@%McH4%GrXhs6RvMa-6$Ft$mUk@?GeBNa$pR#jx-AUnh-(@+Pt{p$Aa;*EDh*_5P
ziJX1+JFdM`n{_J3qg1_9ihHZ+p)*<y6FKaH>Zd-iVpntO=-6X)u6L=`1i!@T_YZCP
z;<h~EX{h&trP*4Endh>$7pPrfy1#M9S~qs%XHz#7gud)s*Bh02F4trFKc)Gc&&BF8
z6F1!|nE0vbuSsWq`OzyPamRBu9_pLt$ZhxI-{u)j{I55DRbl-z?atk5x09@XiEE1*
zS^|aCFIk?8J$1DsbJj$Gn#_Cr&0C%=v0rm!&5XnIST>67zO~hDnUAXEr+q(G&-u3J
zl*;U!*AuoMb(vkNDzrA?_Ktge!K>fju<7{x@fDYwWc%{FHUi-u>N@V3{n8ghrzv);
zWqSM;Yw?^V61ZuRY=_aVhcCK9z1dwCtvt!$w`Z>IV|I3d_MfkBDA%hz6sVVOHBd@E
zEOJ%msiZqkv+B2n?e<<q49h&DJ_xCKC@P)U^Qv-V&qCItT>+NMIGbmDKY9Ozx16@t
z%&2@eM#j)cr=FWa)y#jtu6o3ImbbA~-0`CGwg-(`_oC!A4hLk5|1$f#VR=Wbciwcp
z_}fQ&y4t@pT-mbVmz2m$-rmq<y%)+3T;iVNs%X>Ll5^_J;}ug6vYxoUZt7Jw=IC0J
zBd$lQrmPi>iJtDd;<QE8^m7~D-FRXU#(pn(YevKpyN07@l$JQHm-2nEj^T8S(~Q0U
z4scm)P|~qD<82Yb@W?D>rgx2x_p8k}_aB%UC~YV$AoqHsO7OQ$QqgO_7{rQMc0c-1
z<1tZo(tnYQ*}I!piCkmq3iQ4_t7_8HmcNDlH~v20{<Ux4k9*Dw{;sleedh48{F77o
ztIn{cuT^H5cpN|3wsfn9q58*lSGWI~RuOuy<61+UC!c`))Vk15Gq&tz@io`v|8A7<
z#`Q^brSyuR@}*fjB6O2?)$Q#*df)V#Q_qEEFP=ue>0}F@Hod*<!W*uzjVl`XSto0r
z@3OzV`_RPc>*mh<82L;1>6|(G;$OZ#sxhfrRhzE+HH>@3^z&;Jwu(MY%m0-Xu-dSx
zi|_do_gz`HqE9Q7teKh|-(s15W^1y_G={4Ubw)2Dj|WZC?|piT>;0RVGV)LVsdyJB
z|1hv*)=Ioo>9I=7;p-lCLphCBRW;@0=<02ykGJr9pGvLSkbdem+lG>+H#6^?+WoTl
zRZ`!p4_a}J+P5F;|B{PV5k8WzukYEG4WB;LpSPZ%c_^b?q}RjhtIUf}X_qXnWOTgl
zs5Lvq{ML3uKtI37e)|grTbJ~TN2$9>=*e`jy3cgCt>In&ORsa)wcn>AjI~-9_Sje*
zJzyMVb@tp$MKc-cr&$FDFBG+umGb5nCCR944mDVOCar1e{?AS&lIm~HPdclW&}BaH
z|0i_=n*(8;<@vK%zSpE>1vK!!ottZLNF)B(gR`DBRe!6M_V0GP|7*q3Rj=+Wzq%&v
zknOrvmozfsIBFOD;f%?Xjb1rLF)i)nozt4?ELV!uPk&FDx34ujmC;+;>}H=S_f(5p
z=Ng<hC<&;>7P-W#T1s%AFE8x*%rAJR`cUjm$;I<3+C)|2=Dpm-(HUf;F@2fSzH953
zdcS?k<MNJw-O270>2FiLS4Ew<{A-P`k)TT`pKp+XQugb_!wNi0g}s*l6Uj2rNMmPl
zmuP685&ND!yizLp#?-4NK0ODmPiMRlzw?>r;^nO|ColP5yR$eb+WB<W|MLZsDXt<%
z_O815$mU4p%Kt8He#L#?3fQ7d3#Vl=vk4_9&D6guH8nmuauM5YVc)4wHg2u#n?6m>
z{oe-nGOgk-3QW>ZZnZMMdZiG1RPl2AiuLcN@Lfphy}co~Wnb<4nR{MNb2ro$JmHzR
zA+=18SEFS4b6GjrNs}*g&y0(jXgH(CPxkKJ&AYN0=A}+ivwc5*aWVHCZL1^&ldpb$
zp6}0Pecl(}xV7<BqFeOK`IVas<HY3*!n)?0<Q$BCwbfJj?>>_Wv!WB$1%K9%^WS&T
zIyiPq-6y-1Y|*8?OFg%B&bE)bwsLvpgr4Iw-n_K*+7mlVc>Wi!l3zQvCWtK$cl6;?
zImdO$a_R1rI1z*Sf1XLt;#se3&}`C^aBBY9eFx+3&tbTnB$3Z1GHb6zfzp#DS;n<G
z!W+x1mg~xPe_21vGuC%%R$K4P#^6o!w<^S%`#+wXkjrs%nZ)%6Q{}AL*POjMuQNGR
z%fLs~#5BBgSL5jdmx)_-BEGHF`DKwO`ugbRB55y&&kAeie$T4pl#<l<cIuV={NSAN
z)%NqV&C5f2&Ig~Jv09J6O3dLKpPk=nNeOw0qHw+o@|&us@o+V>ubU|0RMTOxM&f*y
z&S@JFZsUr8J0iXRI^K5Am^!1pq-fREf(n`INyh#g{hHo3zE!w%Cja3LQ#SDh9@V|`
zyr=SoP28y1Z|2geFTW>e^~=w_A+`I$uD`ApG`sq<GW2Elv8g@^XHToHIlXdw?e-n_
zzeR{7Hh$#dy%sUs^RHSjd*75F-;M@Z=(d{Oisw0+EXj4JOj@;dlI;WcZJTy^8@%c`
zAGe6()B5#$J_<+9j4?O<`TqPliA(=axVfsX+BQcy<LT}heO~XfXMdd&RouAY)wH5{
zoki?-I^8sVt-0^mFTDLe=<Z&B0jZqzXH}P)yt4T^>AG{sr~Lbs(^=HZCp|hJQoqRf
zx?i7Mq%K$MT`$$HO|e%NPP6~75PD<Fs=qxU52HSRKf3&>&BrO-|MK2`za5^opVM7H
z^k$Xji*-llyk`5g&175FhqrxErYpj$)7E~Aba1o%8h1NPX8H9QqJj^t=G*LEd%s-l
zX!5LE(^A##OvSE!%{M)K;@<M>Zi26m2Ut$(dBIyy*tc^PU+W*4ErH)-RJ}tpTV7B7
ztNT^7Z=2ZaROMTVOnR?BUaSqc@ZB(crs~JnAxqUh_1NV^2CHaf3auCRnO<4(BI;_)
z^OYTI7wi5J3BB}ovczt`Xf7t}b7xdp3`MOw{>ytXxSqN)E7xz^ycZwy@26dt(0lXj
zR*1E0%P${mw=<@lWovvU7he8mvweH6+tRIvlBSe#_iR1CYxf0-?ziWoGrSz$m`sVP
z)L8kc#VAl;{Cv9F`4cLys&tMrbTUodz*nvL{q2WUZzekP#9vM_ayNWZdPy^|W~bXH
z5w_k-Y5^AuobK;D!oBN?Lf5UEjLeJp+7h2it6zVsdQl_Res0|Ym087EjBC=O{>mJ=
zIJ4w>l+o6IfBlwTp84UL0_)r5l@o&<c)O%6bHAva;+}Uk?Nny(f@w3>7V}=+s5AS?
z;_RufCtcD$zQ-mgZI@<ee9(H=0w1B@f|u7<F7bKqz5Gn(Hd*r}FAO)^mdxF5pe^_K
z_f*5gSw2Q9njbD=I<_D}*HcipCA0GDgtMpb1v;*4o)eS$l6}^O43XX&yJT*6v*|WX
zKK+vE{&J6*3v<@it^WMnLoPgZnxkR9muz{?hLG9X^JAkbbGa(lT24L_Jl+4^&1*J)
zv-WDsovPj$$h2#L!_1a@RyXfl)u@wG<-N0I!jH-cOOKsD#`$>HwK?{O-s#na+*JD(
za&3+AvR^yX<8@Y^T-TrNDY<n1xt>)#pKaeQ$^84{$g`=XU%GSu_H3K_HQBT^Q`Fj(
zA?m^YRm{4lI%20So9kRs8@Hfp21nhp%xC&cJpuuzU9#T4`L~H%@>`D4>SP|38GnMB
zjkhsGzL>q;e5ZeArQ^TWaK{I0MOCz()be?i9MbvaVVv%(wqQZD(1VH%ZSN=ZdsfZ$
z5V;{G?O~Jt!+P8A6-rxwByu;Z&6_TBDB@ew#pAs-tgYo2I3K*WHs4cyXeZn66Rbfp
zM~_IInqJZrKB2Yd`D(X}eP`A7E}Lo3S!7q7^0MI3*3IF1x6iQczT&wietKSv>D>P|
zdk!t@S!DW7aq-v3KiY(z&9id&YN+(%ZbFUKdLhp59lxdO&DSj}(zg0B^WD<wzdE7&
z_I-?<y|sGtty?>?mi`I9weoCK$8o#ETSGTZ+Hv{#)An=oD>n(<*E><{-l61g`RDWf
z_)C}8f1O;=Yp;@8H~nKu`Krt7`{%zplIi>IS+3Dst+(c{W85bNzy7oA+NVR8XJ1P(
z`@2f^?GoABJ=2*v-WrFO-`;w~>b&dj1g$6HOE0YnIi*<dH1(5CkfQz6x*3o5Zl3RM
zyCvy|Uev<M*qwX-Cr>G>w!il9Gym7xFLVD-OB3b`)GS%MTibuv`%M@3M-}U`_BemO
zo&PERIVax{P44rh&Hwwer<&$n3QD=MY3_~1`c`|}o>m=uVL$PDgyN;cG47sg^ge%3
z5B%tq@b1U{S#8I6OkMc@z5UX2^-H!KJ}$Il-8{8`iGqRmUMYmg{0Z8pW^cLv<&~_r
z2DW?b_ZA&XUs~XQ;MvUAb1gnOZVKd_!g=l$8`CN^R_nEA7ioR*nxR)Y@dJ4DPPy><
z43o#pdiA6Q&UCG6*cR&0rKWdp?M}1p@wd89or|fR?Nlkf>3Yr9I|ufh@Z0~aZ^rhx
zozai3YfZ0Moy%ACb^6w;PZieeyquf<<88cjg3W^Izw&zSu~(Xl8~wX?McC}&yTbu5
zw8c37H_SRy<l(jbNa1fU>FZ~9h}?dya#sJu(U%W3IS*afqvQ}{`EmZP8{teb{*Nw|
zd`j$_>N53K(1V{9^EjO^1TESm`P%LSC$~lXL(@~7PrIl5(R$i*F7wcK_n5U@L1&oH
zlz1##EpwuGwaW@_lMEe}*6Fhro}J4sA9-ZkgZ`gin=F@h&sln2@z<=~i(-Us$F?%=
zG_H!&nsB%1#~C3G=6kDh^`G`WxvHzZj5{@SrB3sV&{+1((E@XpZx3f!S?#M;dUtou
zn#GsaR$YsHrP@&am3L|Ny7|WIUtip~wd%mN6LU5%{dqvn;dtXm*_p=69nEGc-z@S~
z*}B{|xu{KEMZ9XOkGJ>!>y>&nl_#qDrDvIc+4fxWtL^p5*V8Yt^cemYzPkFR{|mO;
z3@df3n~yB+lbaX+CSGRh@(YIY7g(p<Z2A^Zf5%>0c2+=d-j=o&_15OD?HArO^spp8
zYFTZV6c-Zfw_Wl;snkldXUsQiHm}#8y=6v(;(osB*|n~r^1mNG{p_F;+_5lwW6UyU
zf%`L;%5GZvG|qMMb$`D-yQ`W0a~_&#ZM^BqwbCiy`?kz{UNUdt%5_@HV}+OL-P<8^
zg5A&YZeH2m-D?irZQS$Ele^+{`k9>%!$WRA&oNCr{$B8-enwmex67693r~1hXR|2e
zK55;-s@$Q!S1^1+`X!S-*GrR?Z*1PXxAxpm@#>>xt2Y#H|Ct#3DDG}&Oi?H&w?@pL
z4HqY|I5&irsvkLfaN-BS56coZXzbdPbuyews62M<YV9B1FHSH06}T?ADP4u*<K+4|
z=h9vT%Y2TR<$XCx?u4Ju$9X)DW6K#ov@D-_|8DiGUvh3z{`)zX$b{@+N-0rOzZII1
zs{j67xoN{A9n-H-_q}5;HGFRJl609`vfSF^%$zB1|34r5bfn>7sP^=`wXwzzJ%3(_
z=Uk!NRH7q)va)IB<9B<%CP%WnH(n6&QFUfBG@NnYDkMxfZS@?X=54pUQeGz?$gz5*
zkb5h9`|FP4W3tsHY-LZse$)`(Y~EA3{7&NIf9IzKR;{i1nj>lKAwQ#BcAHILTKtu)
zol%KW%e)N_h8ldg(uoPl|7UV;Q;fg(?p?EOzRniQ<+yk5ga3U=_w4KUonI}<|2uO!
z|Dxj5*cDDsZ}DDQmmN@P7C75>)>naRJ(HC!!nse2W<9$6Ghkh+XX^W<!DS~JxhfJj
zoO-(cfQfz6&9GT-589ZtPrKTDZ*IHiY!8-&w{PrKW%wQ!Wm#NY{?~V7Y}<eKs5#ya
zUHt2$^`;xo%H6fucY@dHJJXL`Zt{DxX%3J7q6v&EO(*9>pE%xEY1;qEpI3hQ+q1ff
zUO&~`E(UL^WnX(I|MumMjHoi9{1-<aW>1`)edO2E_On5y8Iw5gFzh@V^m*&{A4^T5
z!?@qwoNhVg(>jkIc{2qzFR==q&*`?$EGw>9f1`6m<(DlV=RMLpbNAh@BVsl;X8u3*
z_v4M(lj=^@-#3l1Ub6G7aMO=9g2#idL|wRZvw^c;Zu>-s<FCJ+ooy~zeD}}vX}_PZ
zE{%>no3%7;`k~VHPwL;aF9_dTz3X5sPh#)vyAyBZaY$R}++|zvFz?;@NA)%pCQ|u4
z+uN2b{T9u9WhG;DjQ77EQ5&|#*00#LMpCm~tad?d5ns{l)i=!L-aI?~Ao|wsYh7<Q
zOYQx(I3j<;jkrE_la9O}xoZ}2m8}Y1*u3b(BJHv@bHu*2v`;m;fA(?zpCjT%%RdHL
zta&96bJe1IVgrBX5sB#bKW3lXQ&Y~jo|CQHd%u)TZJ*0SE0>42WE^5YCGhVr<(&|z
z-d*?Yg+#)ajD;I}m6EglG)uJ^5@r7_URwT)<-$va>cwfB{nIv`oLqIZbk;^8{#OqQ
zZweI8z9zjhHt&RPjlTO)_01<v?I^sxCNk}^#C4&4_brwl?$flMcVEr5AbFQ{{ngGr
z|Jt0)*QoEmwf<7h`ic7;5*uA-d<d>s*kAv1+neObhrXdd&SX_&-O>J0q{)5akKn{z
zyBmrUw7&OTe=@7-ZdV$ob;5(LLlc7Lz56^dZHC>JuyP3xkFZjiH;t7ZfiisjVU-j0
z^cG0y#+>h)G~wO}ar+A`X%)Aa_yYDHed^P<V`bk0?T}gPx}L7uptSV<e(QVoR-mEP
zUv&~!RlZ2J)U_P3`;Qn0&ffPd_SyeVk9VgNRf_|sl#Bh{rW5sQ@+2=^5%;@_TD$J-
z31(QjNNj3$Tg+vHTXxma8@ybCZ9g7*{+xNrrJMy8WwI9)&MiD4`N=X))h1P4kux{!
zkk|soV@C^wp17VD&YiPae0fjfC&MV)z$+gLnx1T1t~>krjHX`!fe$$6Sz14LGP(I|
zUcvN`4{Hw2WYK?EIQ3J}Wntf0dMx2ryJy;ahFhpO+-A8V;-7i3qENJT`nLmX*B#Q3
zmUg-3@ON#MX+C?@nh!i&Vunm*>FT>}R25CEI&!YBT>g1`eR$dHdzZVMJrC;b;hz(K
z=5Yi|fcvo)UvKw?yW-5$KXW`Yls{D}x-e5)((K)11s#|5O()rBwd9=;?S8IvS!w3x
zXAHe<M#s*{K996!m7kSl_9Qc~RZO(X(ak&|sP*Vm)sI;QWh;EFR0YqZSzau7H$$mB
z&0xOAk52ugbM!nWW?cxXa}{fz%+DebIbUq@Lap6r7WFH<_27B1RK(m`w0KY8UYkwF
z9cz{~SXRV0Gt7O>|0?2iU+fhPs|KTh85_PxuH~#yE{W^1;$NZp%k<tad&DvU(5+}H
zM&+xw3o<ZN`7ki(;-215Ni9gtOG(X3u1rhJ$w^8~&MpR>xGR%geB12P?t0d&dWF*E
zMU%Fb%bSEgud0kO_MLU+O6Ib~6(%B_H`izexlbrF+4txB?W4^R4GWf7?EAKArkN3^
zj#zi?d#BgS?rnHlba!j);pyICIonDvZ`!izm0520E+KXGY?;X-p{Hl(9)9@$>nrnl
zTMzL(lfR{Q_EzfQ|93@s&riR;J+pY_a@Dje%hs@;FWUDs^xWz-4-VCDf7NAV&YwTK
zBs*?T^ZWI$=FBda)_b)|C+ykZ*Se4XD&P05J`=Q2hx?-6%#7KKb{%<tRO;US4{ir;
zq=w~h(|l7uIqXBoezOmnlhS&ZKa=Fyet&-Li5)RDr|MSSeqI{>^xINK_ZK_7Sj`0<
zhwtbW|MoQ7^ND8lxnP^w^MAbk((?BIgqti=#jpBCiT(V3Hg)^MP;E7J^{TUF+gY<V
zglzacIqB@V$)Drz+eF*_e0X!ReEgp;>u1K~75rdJ+$14svCWoq=cFFRWxv+X-omN>
z@Z<IKce8F^`SGHC*O|nflP9n7X;qj~KX2Mot+VS|r3{_UblwU&cm2R8*U&AeQ*|nK
z&NJHdqsKKR$s{$DOU8`()gG385e)3HK9V}&_w}w<h1RUxp{FapdY7L54H=6Cj~a!W
zk6vDvGkvR!{+yN1PhM8a7H?@RG-b{?wC|5!-OR56uG?GB`U&lxJujqq)6ye$^KR_i
zQ20FN`4p~q2G;jwUE_8LZ<6}raBJDUg3mW(byV+4uUv9p^4RLxi&knsNz6B>eC+4A
zl`+fn%G2Kcj#ejSpEniwOC{{!KlWma%eq27@&2IsPhO}@=%_v$T*SKgol^h)MKjMA
zuF1P`_jteF8pVF*4M$t8Gh)ppx7+mh@GW-u($XFoDlfr0VM)Zn#*B|eEUYDhGvt4!
znN3)rrt7e_B_vkn>#C~j@)HtjHs_XS?fic6cZaBx)AZ*jK4(1Am#vkS+%qBUV)?uI
zpZ}dNyc5$Z?e4!WXp3_~?v3ri-(+WmKPlf};n5j7k@*zIl|}1UOxo~yR;TXy15&Q-
zQ}+LKxwT^N`Wa>?ggCD;ro9!tbbzPhhUxvg*L?YAXoN6wUi@U@-xgwc-1WxO;J!3j
zJ890ZeE<Kueirmsd%rDp;?lPd65j0c+~w+F`0wG$&8cx6xijA_`NG)xcFEDj+;>`Q
z4_FwebU)g%YW3Y^?~bTgy<FS;Ah&<XHi6fnforq<WB0FpaQo0ko}gs*kgt-}C-pDq
zunVk9m>(H?(D1;<h)qW(du)iis4>y+*UyGMPK+y`G)-Ib{DDeHNr^{w<~4pF`NTWH
z#$Q7|y;;fqeoMNH;>=3sIF&uO8t+e?I#(ml!qTPp@13s)lfG6s8R}Q2%5DBR$F?ZY
zcCkwLwNhTSTdQWXUXUy6?9rRR9waF7F8aNx)^dj3ye0crA3ap^eM9}5r2M@*T@*xr
z2t6_C>-m2uulw7ocTsH97I=iKP8VX*aPObAzjm%oQ~tbn-!HU1pY(IN&uyUtQHjh#
z2Bm8`^xI$5nOcj<F)F+5&|I?U_gt^M8zqZU!(Z~QxaPI$`ZqC&Jx`?_LnlniO?rR8
zQ0K8?p0M`8!xw|Pep?!+9IjjRM_XabgOsKTY`MDy5AWq;DB2zQal*y+jlZOCy2j~u
z-aB*YP1ozW8h;Hw%e*cPPxb!A<nU_wLe8SoE{h}Ee;pD!IA<3lZ_kzelO>*ZEWWty
zwD*O%-wN08dFZ=8J<>OmS2dsWl;9R;{c3@Qp-d)iQ<AJNGldj+H1r96ELXoTd8{d;
z>ay6?pu<ze(tcVk+%-Sf!lTZv)$oIyE=$hb=X+PHa2)Wyuts#%wp?AVt!5XG<eqif
z7B=t5W6hR~lPZb_?iIe2$`B7ambAiF_Ra(*tr;#Q42QYerX4jk7yL4X;m(!H@Ix~{
zn|b#oDV077Pe^c(T{pF9&5yT}*zV2S8qVX+uJU@(sp$eAiYF|bB)8*{gMACfCzUfy
z`r?PaRXj3M&8gnWcu#B9y|oKAw$yEPdDXaKdx2e7Vp6@}PJsuk+tyD|?A**gMYdwY
z7G<|5%hhLhu9z_WNYjGKi8;H?wlyp}Gf`a0SVQNY^2!@BjF03m#D!0HS^w|dq${g0
z8M<wnRpN5o>R%u~udVdz-7nbAPVhW&lk40>tNe_aZR!?YFYPBBIF?<)Y@7ai#!>GF
z`z@*>uV0^G>(o0TYX8(FTvOI9SfwK6ndrG<^{z9I7fRbRK2JZoS!BwUH??2ILPGa$
zJH7Ly<w2EKet(qq%Gm43-W1Nr3i}uTjyr9UwMEAn4e6V*zxi&;7i8TMKkR=ZS$sz9
zxwJL8R(6R@HTR5;*T}QfyK)P<%zA#VMn7}gi_bEt8?!E@nTIndCxt#?zQAfViOI58
z*|tkc$lTIsxzdtnKP0DW?*9EEf_JYF=ei|c9|L=yWJ^BVy}NM5YhR`oo=Yj3qPx4a
zId*;0sJZm|#rzpglhb7_QhSX5Y<*UKueo1tb7jYEmsFb@ub(*GGJC!-J5YC~IJ3~@
zlfNWWm#dd<)zdrZ9Z(pj!0xHzdP0AH`_TnCiWRFjcKaH!?qG8AKPB4i`|x76KKISV
z0yA<vSN9xWoHF4h%Y9Kx7YpIY{yxd`jOz3LZY=9rW3?gi`=;h=&wjd@3#|Bg?euz%
z9ez$HoHui8tlYNj?q|*^<`>o;s#|cgaJyB)3Fj*o5{+%Se<ubW(>F@`q~bKw<wl3H
zRIS$khU?Cr&AU$XNg3<=cV4u}_?xmOF;Oltt?EpHSzdP9G)7mBXTM8LZgMYqQz3Ko
z%8jM0Y>@&+scy@C7M<MDsrtpPoU@ko;f*fmh-=KJguf-N<;mU3tg&*1_W4ah1v7Pa
zGI5l~t<XtP@hCM5Unz7T>@kb+zL3MACwmTDo*7f3m7>~}8PB}%$%6F^F;QEqo<F!*
z?lp7K_sh964^3$hwr1GwDWh9+)UbE+x5#yDQ*W%8W7e`q_08_ko3f@ssqu{6r+01r
zxNx#Z!5+ydZ3%C?`{uk0E30)x8|RD4+%dgtHfN<J$0nVittSjOYnabe%$+ii{n+j)
zq1S{Io?72vQ_beM-Z}Ye?F}2w#0>lJMFvKZueR@sd7z>sC~xshnnSzzR3fi_`Htg?
zw<ESO_+6fJkk|T3tnrG<A6Ca-xa+h3VY>h81ZS*{W`$j-d%}(2Z~SW<uPvQ(=+jAo
zdj&DC^csw=BrO#=x+0^xb5XQhPIWNz@5A!i44aMZlG=C1t4WIsIg8BNG-JmLS!Jdl
zANNQuU!_^hUBzH}X5Aw7Bm6@5YNmw96o&+TY`PJ;A-TY7?bEb!Td|1WjxQY*Z2Rx<
z_O{8S|72a7eSpQ5y<*?%_nC{YM0~OQwCHB?>ZYWX9~gp8c=CluShm{oZ<+ggkJluD
zoSaEAm*4yrlbrXe$VC6!@`bDJwJueNvY*F)D$wLZaZGj4iAikb_k`WJrb$^XnRjdd
z71zHCTfc-b{t^}_VVNP7=N4YN+4FSjHt*FDxjdhxV^3?H6MUxFvf<d&KVjmbdm`q$
zmH$aD(fT?sq^c{afaCl08UJMy?K@XY=l#)9_~rHH`OPJ=ic8o0^V&9f;{G>mpO^*O
z5C4{E*&(X+uVO~R<6PCv|4qeAN}f8sxWsy^taXyYKh40~xAGM(Z0TQB6IZf&%X>$4
z&bR9mZZ2lGc8$IE+k<71nCXX-ott*d-g0)`0mbzpif(#_?>LjoS{|uy=ajROSh?lt
z60QFUrH$+>I5iX}Mm-C@5@o-C`<~)U(_FJcyp0d6HdYAep0k+oEYJGA?q3;oGJMjS
z+dN&;)&4Y};+$2-TY5!cNvwszT#g0veY~Y#Y22S_tiJPD-DAeGR$+$i>z$|bMlxKU
zBIhE>DWStSYu)X)h3`T>>25t;DR6Pc4@Is|8}26Gka+w&E=zCC?2pD-LO0^?Y~%eb
zc}(nC@7crFPg$dDKhA!B?EH6!ZPrKPk8e1;uxZx$7sp*PPpM?iRAHAWlRA;uZ_W4V
zyk?_J0yD3QPW?0GrH<L5D|dD7bG;kcksZqKr`Yh&-1RQ!wUW>ovFDadX_(_BdGNu!
z(&#JGcJ^_Vavjw8$=iNbL|R|Kcz!_S;Tpb8KlaZ2bzw?iyu0jSLq7lgjmdN6IHkUP
zk*oOa`cWcW-u~Fp3EXTJU0hc+7*({^b=WR&yY<|=b%nvYo<6Tzw=`Crzw_$N^98E5
z7d%T&bY{(->zyieInqAJ{jE^{(xNSoTH{_HTI*7HGsQIHk#zKtiMng`J$#+`mt2>2
zTG-Y5rrt2|$6Po6vXZd6vJZI=R92rmU&|z{nCHb*n&$M*u{<I3yu-IIR$4yGT>4i`
z@3Xq_ds23nddIEhEnKCq>?>Sf?VDL+#GjjQkp0>6Cu{s_iHIFHF0>k2oKTEE^Zi+p
zZC`cZMCOG?D<{>M@xDDObn5S_DdG3i`xW$7XuNmZ;#RuA@+9|KrswjuYd79o_w4nZ
zl-QlAbp?jS+iv}={C{F%&`IfHvD|I0B_Y`_SDWk4SX{Z-{iJ#P+kDlj`=a(=G4tMj
zeC<~@x4LIZ=CPG?!;b5I@0R&JlY83HS7n>+@(xZv`s(iL=Z9JM|D3{_J!6mMqy_5}
z->f!2%=%w0?t)RyiF=O=&d&Pxbj!^PM!%dN9X|Wz;)b(+kH7F=-LZgY#!;gu_o~d-
zPC5C0DcAbRXKFStRc{mdTX~sR#MZB~RE+-|^S`Ir1s@LXNSG%ZJg+gkaigEbimhr6
zO#9n%KQm9eRHgm=WaV~U%Rj$aayVDbKAQBz?amd?;|z?4>W&=!A@V3WV#=M@HtBB)
zlekqP=9P36tK3}F73O#7aYt6ne2t6Yrak@UZ_?&%YAsDwV>!59XnWIRk=)W38rdeh
z);zl&C)-`_QeoLwwBW1Y2EK!PBs!L4&Rk&q`_`K?CabL~^&(@BoEACt{9vA$k8k2!
z%?mG_nqAG;Tw7C9@%p&f^gipW7eD_|+qm5L+P2R(-M=cRUvcM6lhuB{%4*+!ePRDZ
z$$kITLY+Kb=Dm_py|R0qjP#6&Su4dRK0f|%Nr2~#oy=du0}6DmeNL~?5Hvcamh1U}
z^OUKc+9YAF6y_Em<K|^Q3$pU2Bz|<-ZS;BK>-)B!7KaJ`UTgY*ePv_EYo;HJIjwGI
zXD*um&|-6jg^|Uo84k1LttQ5O+smt{dewaCEf?Kusg1`xY>H>vPSi}Ax~2E7i^wgp
ztGh)fx9yhmFe%Imp7MKI#iF`6ZJs=fiDH+&*h&b=@f}}X{dv`+iyO}7d9Tx{db_<r
zcp;-=lk6kE($L#;Do;0WlIEAIofJH)TIw@{z!#>TWjq2_YdqB3AGWO*Z@pF!@!_}3
zo8qhLn+~68|F-baHfzrh(^OW!+}gX2iC0m_;{T-u`}Don_sxi#cp=p?VE&CWD$HMQ
zYp;8)7o;iCaqF!T!(8hPg(~m&`SOM4T7A`K7RqK?ecWYT-jvBA?pKc1esA-6b6@Pn
zj?K5lX71T<@!*g#o85w4w^vk|Z}N$?xVU!h#!K`5ICFJ;P|2A8SNNUq{fFMOE+ySL
zAHtshmNm-h3EzfoORB4+-cRGb*_s>8V^r+m_22p3zSf<V9GWpI2D;qNK?|Gv*Z*dI
zw_Cbz&l$rT#{$K9oj30dGd%utS#MnJj0YW`bAuO5KUsHJd*bpCo<%1$--)nvne%Ez
z9o{t~w|#l3YUDPJ+HJ}b3Y#T`WXr#P*DUmERn<@1u|9=&T2<1-%~L<8sarpM)3DMh
zs7zv3odaiR*A&LQr*3?+PM=;W#<9cy%|_u)k>JWmk(=G&4He9XU$i7XH`!_N*u?a4
zzca&<gFp6NzV$#OdQEkfLgZtnUaq7!n~wfXUv)-W?|yY);u`jyW|PxzM=RSTulGHA
zS^sx~Rp{JawT;)9jxEyucswHI_GX4ZFVE*h%wXv%ntXJ_mf|%`my_k+or?8e)V{OI
zUBge|)oa=LK{oaay82o+ZSYX&-+TXczQ&BOUA+27jBeX6D86RO%fQ}maol?Dt<o9x
z@^Led`#<nftV>}!lUn;EL^5B3ljGycKPy{qheRB`$Zaki6Rf0rBhR{{)%=C*#Y{dX
zl{=P3I({$KO^6Pe7ZjxaCM?Wu=^qU%hLpS47uAI(d+4pKej9n={%M6@<x4~_g`cjS
zdSt(f+DZ8{E9P&UAN*CD^Cee>_f{*O=zM`s0iN$IzbH4Y{Lh3s0(5lYk&B-57#QM?
zGBK#)9s$bCgKzfGE2w<4H@jHceUiqn*!_#zyKb=A2)J$9J5Tc1!<b;9)MA}ZD;3rC
z&1qX^J2dBTJ3L;%7!)J-Z^3W#cly>pSGZqWEY0h6&$|4vQV!RPb*HLQQ&ZEPJ}xZ!
z^zLcBO=WCfS7oe?rHuIJP)p73r+J(9pKuR9I(dD&zr3wqTuArr)XK`OUi<2Py?L!3
zZ~ymKWKmV9N`BX_S?Z4;?V1tREg9k$=4w~0^~e6d`IVo)q}P1TEwYFg4X)T36LPvH
zH0-l`zuM`nX(=~T_D1P<>v*4%+!L+(vnFos3Xi`pCRUYAy&it~lhaj6zS5gFmEx}*
zy;L7_X8q|@)8lzR*SlTaB=LOpoq9Vxv7<6-i6LU87fx;2^<{o2_q&DPe<a2F9pAXg
z;Lp>f$Tf$~^{u+OXpY!v2C<%`khAJbGk>Se)c@lB$Ihd!ZGZl%LcuQ*;q2-@w%7N6
z{e7=-?n3^bo6hJjbG7y0vlCtXm8*V^$cKWcYg_o3<K8}heY)9yagw53=Y9LI%ZAr%
zcKz5Zv6iiWQrmfL3GFgT1%_EuKR-Ge%Iaa^(Z_MY|L9wV#x_RD{Mn5n^TSTpY&rGG
z>hLCJmkBu&*RR{Ot08k?e(Kz*pK~HZKm3Z_7_#>3*C{&Fu0A!If3?bs&+g!@GoN2t
z*V%d8d-P$0@@Mb&bJ-LN-I^;`&cE9gBrLI6qak>~eXb)rPGkqaay5;Adg1QVmv0wY
z%<*5v_*NnGljRf{75lqSPJ7pFZwh++M%iw~*Y&QU=|8HSy+6N-4K3bV`E_#B290T(
zi?(VV`*m>7t@iqO-{K03cFBY4>Z}W%|1h1z5c4Ogl1IaE@3QT$e~Q|kTCn$P(Y}TJ
zNf}Iw`JP{IXiCng=&gvFt**~e>vv83ana9Bv&4@d{U0U%HOpC9pK&&${q*LPHTz`!
z?uD%mzglH?FW_tFMCIP9=sP@L$|H`Y8lFn*I<xrs=~u~y@*S6Ks-+t~w>^}Uxp0WN
zZ2!sUKT|h8DVJurvRd_w<(ui>9k|Zs%v>Aad;Rhu$Iq3#pMST_JFK^){^~m4dmp})
z%OCP+%Bp&{M|@Z4^e3E77U$Dh6^^EU^b{`s8#HD8iicJwUq5;A(|&K!thh(ffA3CH
z@-lB;ySQ6;ZWS|s2;=6=eD$9tRTKN|+`hfj{@XR(HMI9jz~$gYAq^89LXTu!x*Y7_
z`>$-zJZ4r&(bBW~O+}-b{!R1V+jzIUbfUg{xMaevRbR?%=iX{Na!%6b(iYzD^=$4x
zUMN3ky?ylgd;a+SXZ*hR*IQVet^4(}C2^lc)#tSTZ@nuP)Xh(eDfs{O{O|p9T;$W#
zm;YYRzbE{B{mD4FJ-6!r|GKirqUQIzzbjj6eu!o7I~OM>H~TpI|H2QC{=WS8`8xZy
z;Qx2*x7o+Z+u7f<|98}`f;m?v&HcT<YRUWMue{2>y!-Ou#oNxhAMYN#J>9%rpO4?q
z#k1zc|8sG&`^vZ<GXMVlfu%af{i9KJ@t04wQ+^Z_)HLbd`ndP+gPQu{f?tm>dOyE-
z^5E{jkN;j)=6?6#ZTI!}@p2DbWcM_PUr7Ahlzu^sCq2ZzSx%OPKVEikUG10RvQMXH
zUvJN^HwymqZTXw$hcC<f7S?@wJW*nE#Qw{F<(UqAy7~I=cKbc|{~x?oySu*X$H9L!
z<uwIG1w8!s-gcYy^Z$EZEwO&??8)-qKdLJ<#MXR$!|S_n|GNDt>hACR<2za}@3%j|
zBL9Cu;vA>)xE%!x4=C!bTw7IDp!AJ%0}HF%i9g&sx_3pSmZ&^k?Uh^p;Fghv`1)>D
zn^SpS4_wlYzFH+U`|Zl|CrOcq6r<zBU0&Qv^*FMF<CA_<bTzyEPgleE^E|5U?`PSs
z%lf-^U)1_jEB|eco1Xl)Hgbm1fjE1kD<xK}R!)1?RIxl^e#!Rb<rN#Iq86Fu|IYqb
zXwE#Klh+tMUuF5>%klSQQ}pX>Dn4F*cw4?K)9+59@$9A#_V*N4u5z8J7!<2;=vTaR
z;{4C~kyotw+J78he7ecz)#099<#Y9~n!oE|d2QV0zG2GgqL_?l=f!$2-JG1Ymqmy_
z#+1n|r_v=<&N*Eydqz!_zfBY`ckK0}7LlPRHK*u>-4SGSJo-9?f7zG6GS{B_7=Ltr
zBG0aq#Z#}*;OS!a#Ps9AKOZdrrFJ|E+`6kOHqK#rLu78+numv<#;<uDYMLz3UZ7DY
z<q~(qdZXkIM)|y>GsIaftREzv+wF6i%f-L#psj~naE<!&w;6kH)jhiP>yFLJyJ{<$
z-xN4Sg?&%i8q+`Fu#9$$bvlo*>=SX{;DRkSiqi};ST}CHccteRySzgZ>xuQ(J_~OB
z%oL%PB76Q^$?Qg#rN>vbo@v~_{oHv`HJd6EJvGl|Gv>URb$ip2ZS4229bG4R@8tw_
z4lRD6{GAgs=6|28{=eapPV%$M#yPE-!WY(T(tGY8{CsiK!%Ymg?wfM6r!G4>C;r=H
z`?sp+%jUYKDyn<tuj|_B7N(H@vuNghHRA)U6a3eAtGH`SU%h(CES2*?%nN5Q{i)o_
z^{epPmpjtF^|#C1b=;jUN6ft)vb7*i&UVpX<~gr(rs?NPTKU?ZIQLZRbXBS0+y<K!
zVoW=~$IeU5&wa7-h1@miQ&|lvpVId%U{X7^N<Hsm)ZB;wzd7*-Zux)uT4Ji_zFO|z
z%iUYkelCBLTsZrnlEcyE{bv$Bf3yfzxLR>l-!vquM{46+RR`O}>B|rQ{i&;S-Zj*B
zbF@Zh{G({uiJV`BcH1#IS+`Am{?l3KXz9k!7AvQnbbrBAAiYZda8c-)SM%Dr8l2=e
z_88lzzdHRh@508^xF!}!;XT!pLl!pAYkT5X`}6WAyOYaLE6LwCaywk2Rxbar@K$+L
zL)`g*P=j+j&KulMe_q$Q<OrX3tpEF6@@1Fq&Q?8Nwq%ah>g$UpKKON4>KXTxA5|+J
zNXO}M-+25|pItq3epFj8XRyor299r+w!3HUmv8N5-JWmC$`rk1(Ml1OOS?P{n{_zt
zFutg)!y>lgzJa{&TBp5nl9KLgdK;ReId`s%T>VFaY0c@(iECdknjW>%y0KMX<c`b7
zsFoc)#V-{+=kxvlyZ-R<m3QPmR_043TZUZtQMvwh!PcgX(-T)l9hBJj``hMY8#v!9
zF$Y+^RD9Jq<3f)46i)lFf<vx9Z>Q^Vao7}F{kT1CX{P$whBk>qE?;Nf(d1$^$vE(&
zW8cMx<$)S^C32@c68f6$q1;ttw}I<_^lAZ_BNL2!%a*s+oolmUwY_TjV!HVyi-~r>
zEBKP%{QPWg!0y4)QN8To`g#8=9M*7uJ20pG@z)&3rz}+hyAJ-}`{04xhuxNC*|U1{
zK3D3OrFAPR<(emlvp3Y69Q8N6+%1w}aDwUcqqL}V-2azcK3=@RXj|Q+Rdw+pmp8_B
z))jb_T19^>&YjMv_RFebKZ6?6(gS-7V&|<8<(OD&=eES}1<#JKbcc?-qJWd(C(RrD
zPtF(qw{Ujr{oMvh4LjKXxBE`*c(pp>{l7Ui;!~D6b*N@7?mEaXvZAiT^4=`V7t0t7
z%US<qvMiWeye4k-OuzcM%hR^RTuMCsb=H)v$1N;le|ODlDXL~Od;9CC$^NrpsvmBw
zuGw~@y7l>b>&jRE4mq^Ue7yHq*EB_r=$l;m-VI49r9bC8Tx~lrd0qPFTax{!86OI>
z9+#dhvs>;?L1#+N#n*>jW_&-Fr!3NDxa;u#Fy9GpoTfhXo-^Y@h?9P?gXiU)_Szi(
zFC5OhSrDJ7YkRaRRZ!Nq-FZpQyw+zkFZ+L8S#*~_uJHc%9iJ6vxmDll;O@6Ow|aJ^
znd;S(YlFlUXR000xmYB)YvDE4f8{@_MEC5Qy`=nd^@<sbKgq{0*)l6Q#<y74hUK8u
z>}Q`(m)3E%eDN%r{%>CV^Ot}3va{)*b?0aJe4=O4ui0xoS|9M6TJb+L==OL0eER<9
zrRK~lvv|JRXnt*B4JzCqw|@E2Lc_E67h_BKug>cVTaw8o^O8kSXQlYj6?3L2-`KD#
zqqpeWsT*24AEk0mq`dsX^@8;u`&ou(6SFvXw3>2Vuqgdm6?(S7D)CaD@X~X-5x-ZQ
z+iUf5Z^h(#9Txi~q3WKs(T6Q3ojK+2F#Gp~_BnySgEXTYWS-l-oj*tIdTQU_h%gHl
zJLB%F87tgR$lg<LwT<7jVAgy+r9S>RSsD2~wS@&ttG~Rts9c;qJM!5vy~nc7ErOxu
zGxz=WicIl!H<sXf-1oU9pZ{gn-P(-}ry4wdeKFT(yxYKYKAf#j=#=r%Ij@e_v7h>x
zu}e<8hvU`EV_|=#*MB`zere_G_?nX|>(3R3tezczRcrQx*i^Ra-C`fKRD06nN*@HT
zPn^0*Tc9Md;@8G~%P#M)Jp3}gOzGXpoYbhkQ=-}J#*<zfMRZth=CHQ5-XD@};k3#$
zfm`O`n(HaoOcq+LQN6Bp{%O^`gICT?uu=Bo)4gaNqq_KO5oa*pj8$s8k5ye+als>I
zO}OVyue?()L#8W#@P4-BCJ*~||B2UG-^vErb}sYdI&dd5_N`j@>Z^<H{XHG8clzqp
zUrc;^ZpN=LSZH7W*E{n1fxy2{-`}^X<$BEfy;R>IqrlfAVRHMc6&kCBR>jVk^w#Ta
zZiGjyp+%Nt>Dh)Ji%r6bs{YB%GG0=;rh3z*y)xLMrimO;3G#fe8XNppGo8iDQ*}*d
zz||`@3--iWex2%hRiIaAp8x8L$G3l2y0a=WeRZnc`sFL^({v@K)INPU?-$3dH(!4)
ziI{78>Cd!#%tzyxwjMT4keSPu``*-MVeq%3v#0-A)pxij<H0M_3!x8Q@$eZH@wQHs
zENrYvZd`ryHNObkk)^3g>pu%#(%3u2%UNqjz1ETAC+8hX|2{V({_|JI<9DR0^hyfr
zS$@@?f4%CKM!;LAJBMao_ws!3%6;pKd5>)F->se%v21%@?}bxGR{x5Sh+sIpt)+g|
zQ(d{oud967O(%KH@+|#u`=q?UPwA({jJ$k*3N2@fcv!!@QvPP=f=8vDYYraOmAtK*
zaU_)g@50luXJjwk$~)Ge_+jePRpD2iZJgUru+O)xEW5|n_PUEbFY)AqH#^_(b=}q8
zSasm);ctDX-B_}to+cYjJl&C&Zs8Vaf906Lt7{#FAFfNg^8J1sCR_Qz%t86Uxll{_
zb>a;vuJ84hnq7{~UUYeLgv|o0zt#M0j~1*_RpgKRHOI0%;_9b6Q^mKeVp^Nm;1ZA+
z<+-LmgngxQZpVWCRjd=VPpO@LW$ziJc<EVbR#Ys5xS(cxhT9&7q7}RbvjYy^mfKet
zm=n*rh4ER+my2g6N-eS1&xz~0w%tNC@~HXpyxj+8vHkua8*h41*W#V=iiqhMlf%y@
ziVKPRo^m#xve4z^vS1yTEp3x7%xyDw-r{_t=fK&5zmlfAFFZ{;D^htphlS~M$mFjz
zQ!XA2NeS*TPSvqIE&lKK4Mz60N92BIuV&dFoA|ft*@O&j>3sqBgRHW0f8M+Mm%(jG
zN&B83cak$^Pgv&n%++w+REDKhEb)!=#5gw!RZW}7qxe4R#^c8u8GduExV~qWz2c$=
zT%qQ!TsGP#(@)qdA7iYPRAaxs;c@^s-*Ly#D@+lMZMy^b=baD!G3k8gbyq)Y|0l65
zSK2o(j9F@WvL?zwICe_}pSqchvDcBs8~HurnI8X=y?VByMTgtU-|eWuwlis$%HD2$
zcTp&8p9FW1NTuoqr-#B0fzNyFqUzS0Fkao$Zgc-`);Yn0;pZpya+mj9|F3u^Wj&`#
zzRb=qc0uU|S_z*M;?GK)e-#&R^!q^18SY8Zn;%Wy)e>g@WBKc&A{S@;Pc5GRxzTy!
z73ad2Cr|x4(6M*=B)JAv;S}X(-9=v}u8|13Ie)|UWzO$*{<5&to2M|nW83Hdkt(Zf
z99FuY4w|^)$#W)2K?mOhN4t|+zir$fF1~@s{6q1S!`Il(h#I_HCMtO0P57<iHCuNa
zx&2o%&n#r)foHp1?uM}@-D`SL6y&RFG`+ZWe#_1Rj|CqkI@XEBewC1}Jhf2Ia86^#
za!utNpN*%Mb)+Sv)|MMJuAUcS+it&gOZV&J9%)<LOIR00T@#VEep$xHufL_~wt-ch
zY1A4)(}Mm92aim1Sf`~BGM}?KG=*`BMsex1PwPUacK-f%_2xPE^ZzYFuFRF}j9cCr
z@F&7~vBeqvTWU->`9Yd|`%@Ncr`|bwcGlnb^B?fep1&Y@<*lL}8Iegloz2d$w_O)G
zo5UK$draj-rse+~lIx<gj0+Yk^D)dapWVn|w|!x`W9K`ErE{)vgp0l6t2#X8Sa&Yl
zeytaa61T>&D7;<Go3Jc3PW$d2ZkIhb7@A)6M$eSn8os;1a}QJGzs13qZSDr_jEY?u
z&0N3r%W7VRBXe7#WA|jRFFYzEG}+iDQO4on>%0dMSzS$!!le&P=*`GUIXAmZ;qjxS
z+Ls~A)Mslko@TDy(zAj6VEtas80Hy$SEqh#jgE{?*%Bria%ZLPynKcYF=2U!zoa;;
zCLefpZA;nOwO2bE%d$4<Y+QJ0&I*3XB|A#rc9#jbl|H&+?r$D?ZPWVjX#0CHf1`fR
zWMlZ!T_%td_devAyY#A+)v9afeeMi+@>i|lfT{m-MahZ!yBampy07Y*$gnPsFJoT1
zepS+hE4%X=(tg@-vCJ!HK5!^qq-~P-?#7*SA1X?>AAWDfuxhhLs^EEZrjA8xD(>+;
z_<ko>vMzrGgOE+^)?KeN<hO^1mw)z){kmrFqJ3ghMXzrD)+N|=p;byl@6^iWU%#vs
zoqnKU*WD%R(poon2X9|hyHC>L$&_vVw^v{H-Ln3j&+n|qT?_MO#;|b4=QD`sUDS&X
zzPa+qg){qJu{6D}PZIcXcG*n@=jj>tXIASOPv~`Q==Nc@z0aZ0cJ$GqOy|;lGR3bi
zZT{A!p=+@<>?qs&r6socM;yL~TF-bb$R(+_e&xKa;UQ`Key(5FY<;wM@e-f=GIM11
zp1rr<*5>R5P2;1|ZL6*|)wra-?0nRE?N_DG>?*0;w?F>g-rk;He}eCR+WWr#f0ZAa
zZrfElJkGd1+4Y9+$47P-EIYCr*_JxLy4gKxrSl~9fYvz{t35x>&JO!H`_szg)02ui
z1p}wK?p^UL!{ZghZ{IexA8X|{-JHVa`+Z%_<<GOzPkofuyuFlnD)aRAP`^CkilsU_
zj1xAAsMT7}{(fc2(j%QoS2Ig)n9M9&c4mpSubtmL$^7W&tg{&2ZTkGSK>qKtC9n7W
zTX4%=+{w0hjgO_dE8oo<Hep<El}k20&v`Gb%_b5%Jt=%|gkqh4RPNKB<EiD+_f4EP
z_Q_hw^l-0!S!?XFPqKL7iS%8|w)^CWr{8V*dc3gtw(3*4y6$s^yY(+M9@1OCJ?3EL
zm7vLdg4>tXT#30{xasMvbBlfVrfz1x8CiEJ=DbyKk?!x^JI~pFRuym4Kf81Zx3>6n
z|6Ny==ik_1WSiHPu<p~&Wj}XrWZQkxYU_`{+kbZUZI4U+x@G6Tk5zihPyESQx3T|~
zRiwL3#=5V{rwd}7|7Pg@Rh$1_>u>p#Ju5aYZuz+><no$&)9Lk`O}f*M=Iib_^Ju27
zo}9^btCWZ5z8wFTx7zuT^^}#Rs-G3YP76$o_@QmeJJCFM$)V2^uRS?bEz_K!zmp-m
zue-{YwMBq2w{7|9=+A0ZTAaM!19rc%OgUXG!K_q!Y)Z65aHebW)5Q_B!b^PaZ%uGm
zb@#(3RWGe2kFGBA{&1sR;jN(DA%?&YDxww#J~-aH#W7Fg7<=SpL!O`j)%}$*C-U|3
z119rY#6GIi$$R~TD@!YxGof(O*Q7w5M)Qcpri>44-{ilskd_J7>Dy`ja(+YFL4oka
zs~1)`B%Qx<Av?L(aqZI=H`31(pGdB8)z2&16B5E!dNTB7RiaPG@<W2#3X)BP4(>fx
zX~bTy+q}@D=cnvp`SXTXkCuJiP<uYJTfF@A%jFw)8L3TkD)^`prOdNzsaBi*tb#dz
zE}y)5bUGW`hIJK;OlyQ@DJQ;RlYVy4_2=itM?3Fc+Vu1@-=U-bBrHC01(w<9-Q0KW
zjdALVf3uqv7_+46xlM{3s%MINiOf2f-p|vPyjG(w_z=Szj_EU2A4t3KY159DV7YAq
z_vdJE3z$ATFDQM4r<=1!Z_*~iGtZ9p7TpP19da)B4};M$V@GWtm04{&x}R@!z4%~C
zy~M6_uie+NtNm=5c`UZ-$+0~W7KSgB&h_h_TlZ3WE6<a{?qi%<ds<i`mp5*odAn|X
zaL3ff^Cd^;T)62}x+b5k`nq#j(pQ<IHQ!&pR(R3QY_Mt9Y(_Jk>@&MVX5?iZmj11B
zPjw#mVqtaW#k&sb>Rqxtec7~kruPKLbJGG?4`1ht$^5ka#kS%M0XHU5p+wF@&*aqC
z^ZkE(_Tak0UrOPI3bBjlJX(6-qnlX4W2O1WvXt-6VsOq(5@O`|(NwqYWP43u)*Ti5
zxlCP8OSb91dN;!)B<uF(<<Di)ZxkJWE1aXZ^wd+a$vukPw;wLLRmk1ou&AU&u4}SV
zQ{k?M`rG@?w#;vHaAuU3R2G*oJ^s2@hsiN}hlpBZ*u<%;f3O@lwD$RvpB`MjPu~6V
zKmB{5iS8bzH?ze~{fMia@N$Cnb**1#wn#laGa>uBOvuKC;eKyQ5{mr}v%fgudEyB}
z+_#?2*tJZCAF6ZC_3K`-c%+#1Vv}VF!*Rb~QnK6Gw;h|C>14Y{{W`brohibyQ=((;
zFPCsDi+S@>k&D^MmLa$Bv5(*}p8^e)sCwOXx1XCX&RZPs)T|eJc5Ydr#H8m%Iu9mQ
zJ_*bT=KQu%^K*nCe^F}N&y&l|f9B3@nYJ-eK;!Z5MdJUaCQZrs7+vkQkT*}`7t<z2
zu1f;GS?zBGrT9x1_z1bG3v}iEFYwXjpCt0|e4hArz2*+bj=Z*>Kh@Qqug=s<DX-&b
z?%AICM#0qKrs$+6vfI{NyL*H46<gu%9P`M75;Il)Cf?KE_MPEez)^<g`Xhd>&aCG-
zZaoT|Y`A@cL)tQpH1D^^78b>8MH$>I{W{;OA^Hl7q)O!{E~i*?*GVcV3DLDY?w#`_
zYbHoeSKXF;UjJ3ruDC+g&iyaKkI0?P`7?J;jgGjU%eK#^4DBcXZCN)->a?MM#m;%p
zywigd-o_d3kx{Fc6u(}-GW>DY-dBeU49;;x`9E&-`g{Cz%j;DvKe9_!w>C32#~jYo
zdvNfa)|G>NMtae08msG{?wh-$-t%Mnuk5a}|Mt^A7nVM*TE@{bYm0ka^P$O!k(Z0s
zDjjd#E&b70aM>>jZ`S=^Zp`kMVVvkaRj}}d$W_r(vo<hp@ZGFESy3|oy2by!Q_>8+
z{)*6df8*Qs(fQ_&t!L9O+8)VtG!G3wA$2Y8Wkk_Ao)oDYOZXoji+FhHW)GWhx=&F_
zQG<BWTLq_YEcbkk=1dROui@T&bN8u6=6K!e2D{9?Nz2u10uFJ8HcV*ReEUT1mBSmn
zKIMz}lzP1T@q795<L&3~&tH`MZ};EFlbhe%z4-8UaF6(p65}VS2la$k{}IYmZ?v^B
zT41p0-M`)C5*m_+KbZ+^JKlEktZ9?Fy7m`72Q%xPJGI=yUx*o>dY-8fX27!5=!vUC
zo$lkVA9uN*<Z54$yvvYo&~t6s*G5x^IOc*QIz^wvYhE4sdwKq|4*w&KKX#vcpt@_#
z>$X>Z)&k7zAE(_22=71i=4|NI$Fu$>cqdzI^}P11@Yz=uO?LS&A0IDR{Q2w=>)Bsa
z>vZR)uJQK~;Mo2!$0$Lk<lA$WPdrODT>R{6UEHHFllkcH;!D;%^)^<Pw$mp+sH$Pm
zl+|55i}RHQ2lrE_>qYIinOKh(gerX4UnX$i<+lSnav8d}WE55%yk5}JaHUdhL7O4(
z^0Zjze6i)v1Vj&R^au{T<=GwR_1vH@XIZGjm1?z@TLSiG>g<pTzCOR}HruBz`5uX=
zbJribg*pZtPnCapd2_|vwi88nG?T<GsCy<$T4t|)P;|erz;gQf?U&BWo!4~VrSMQ$
zW<GD}BISlRyEFpS1*c?A)_>nze(Ggjm*L7QG3|o8k9kN+ZRXTi_KwGKZu?@1<Oy4*
zc3x-_mYcTlM?iAPgLQW6#BJyPWOm~|zH{BK@?A0R%RFDjSA<)4RGQhUv)^W&-0=Qx
zj*@L|hxenJc(I3mHw0vtEvZy$+RfjcZ6(Fv?RHd7>A-zP#$Vgkbga7{6;`S^>2kAr
z)+CPTMANSwb_*?f8&B$a`kp@5DzeD5OUCBXU6oMAGoA+4OT;3?CulL{Fe~mpX}nAQ
zia<$KSg+`}#MeQ`LYn3Iw^Z=n|G?9&KEvR~qg*q0k*f-e8QZ0Q-3qoXxzqYR@*e9q
zH`c!SVjcmR!G}Ms`Ban@^7GAF?{m91>2s|){4vdL`|7WvdFLcn&%L=bIN@FSnggD`
zOBd}wC6{fR{@3Hd`~Mb}D-$?9{<=<=u-=uiO?myhGmq7+bz(05y)P;oQ<7R3tZScD
z?$0Q@%5C|Idj|4*ub6avxl*F_wKR_RvZj^^OQrPc7V|Zql2VR$%NvJQ34XpcGuu-0
zmtjFzcP3xZH9xk?o12Tjtf}8G+*u)9bEZ;2j`4Jpv*k+PMf>JHT$p-ndXmJR^xe-b
zu76++Z~Drhl52NRKx(G?#2*}uE?cMG?f&{`VvPOrjx_NSpD8!$CbOPP$@OMpTG!Z}
zoMAh6b>fNpQ+joE7V+L((#Zc_r9|>-<VU_e?*zXsoFj4T@*3OP3-?OGoy+Gh`hH~P
z1Q{pk<aZ2@^_{EV-YA~y|4~@$xDJP?ZYA@~{-ceh;tm_PeKb6va$BsuJwIM{q0WQz
z6?52UuTaQ5IhVg_dX)hC-D8t>MjKq(xzTfy=-Y*77k;gjmF<p+iT--+?yab;kDAN5
ze&~M;?fhZX*M9S6%dd})Np`za;$jwudIX-~op_YFE-Y63Qw`(Er8B0?Z_9igwBzp;
zzb6OfzCBa9b84-(_;t=L>(zOuvSseRQ6ON_uNm`QqoIT+DJbP#P7nXp&}rU_45IiJ
z?9fu)Co69fY7l%b@wfZg%PO^jXAKvfH`4UF@<T=I%!WBusUH>7dJd&emTl#`eCS}z
zmxBrGIv2b;XaDU`;H^G0BWB*q{<khI>y=KheE*4e#=WXV57R%d6pKA7d+*NGQ^%{)
zL`t6&*{!i$*go?s+aw9$uktkkpGuAy%>3c-bl1h+rce<>zEwS%R+1ev|IA&d9Inb&
zQ+oRFvMC#%-RXB(BC|}+kiF16{%NrA%JA~dGozCxdX!$fUf*e6cyPLG`NyP=AnUi0
zKf~3}mALv<dp_}=^GWXfbSu{*>pnM5HF4dfr5h7u`FzqM$Cb;s{8?kTYIEq)UCWMm
zn3mq3?XzI5Q|*z;JMTg!PujA)*?Z-TO^HsI?}enlc{#gf{gMq5FCN5Ir$2X+7dY9r
z{43LrZPhO$PX0)F-SCQYt?rL^+5VdaJTHr{koe=3lw$Scu()KHiEQHGinpf?!spkn
z`t+4m`PVn=e5qN&&nlVKOr4fp+@E>ER{y<_pW|tn8LU-iUzSCsJ>(9x*ILc?FYKFf
zb@`hki??=s|CnmbSQYwCWbT>u^7`wHPHyF~c;|Q__r&=c)@ci+9{zi^VoTC(r_|sZ
z3wBJB_l;V@_gd9l@6E~yS4<>dMg0wSTvgmwG0o~@WXq*`J0q^LwKJR2cf?NhIwj|{
zVycKh=IMpYlx)kpQq03eWef8hYc#xGEos;`BQ8def1>V&o{zE2C$BJUk$$&x%7n9e
zFS%UvbQnD+`CZIxUu3nD#qO7@Zs(?_XRh{Xq|ZB9q{cp7b7@&$alNunos;LGLl?~Q
zFQ&xZx_|w~R}Ym>_dB1-2Ho!qYCd8u;bOD$+wa0^^SsqIX2)2{%zg$<W%@sH=^>lS
zP4l#OTMP7yDKBW*-ms)XT%~#EuAA;6TaG=6J0TfcE~*#AC6~B9(r4G48xQ9)SpF(I
z{M1|HwM+g=u_~k5Zig_r+5>qeF}AMj=RV3=vE{N>_QT@4$)7p4uB-oeeDccG_gz1q
z%}@3Z+0C63aQoznXD=jgI=DnFzp?90XrJ$V-E*4l?t5Qdw8{L<$Kd%*p}Q`=eBHyg
z`w3j>+*#kx9VwmQGV6WmtvBh_#}ousem$V*D!XO#x#I#0885zSTyTTgH=lh{PTp+>
zIcsKX<>m?Vcw&M!<}$yUvEjs;9j~69HWW?rp1m`yTeOqw$hqxY+%bjOnT@kQe&Wj8
zwUsM{b9#gJZ*x&bmsoSl@BFWPr+hIFP+4kix=!wwR>a{;2d`Yo{a`+qW6~QDL61{h
zQg_O?l#1JHebjF~^-N{o@2{`!PWr^%ZqhgZ@Rl1+g2l>j6lO=yGALBY;{7ZbbZ8!v
zP}t_l>$(>3@)q<5&P_Tan;d_(IPTHY*ruJ6MSKzs7JXVFX4W$I<e8S;qW}6<nMUOt
zHvd#H@d`(C*J`G<t6YL#_|IwVkl3U9j*ZX5F}P>4HSf!N37jRLgl_FME_lE6*JPs|
z0UPcyw*Gsn!1_N@uPUwP;EIstr5~3Su1uP@aNX?)=BIfQ8C4eQ`G+r_>gii^w0G{0
z<cID}J7c-`C_fcjzMWH9M63V8sb6fuB|fXAL-w7$@t!|YsETFtq6aG%Y!)eTN_Ic1
z*C?v~M0WLtCw8@)vlt{pk58H%H{+4H!8!ig4^30{s@QrTo7(Y0oaJ8Lb^-a>S8^A4
zif~Qxsq0nIoWghi-`2o-gHz%jif0uUvbu<gODoFk`70pWG2g6fQj*MDqm<7ZU%Xy+
zW5L62T^Dx4&{~`OJN2(OFS|U+u5sb<k5&Ji64~a?`S4rT`pc2f{3Ol^f-|+amK=@U
z9Oq~mwf=v7tlS1Y-K$<xAN3f$I}u{qn{7FZF;!Oc<*kR!SM;WR+Ij1Gm>+9l(4O}A
zpoa^Vp6_kDxvXo$$$Ke%xsl4})KsfHx11Jyy3?bW&2{ak{L@*jJLMY`TE)_L)oxq7
z(Mq!TLds^T;-s%Zt%_3)PTg}US29UFmFG*LkpJmZ@`8&dFWkt=C(}M<TEdj`KYz8>
zK0KcNX=6U?iz6MSXOzS&txVGU#Poc&KeQ4T2>Tg*G+BB==R<E(iJoj7n<We8XO-QW
zH0{x?bH_5)aT+{|;cVjzU8WWIIp<G|PWPW=_Jez_dY)UO_a#Gv>CyLJI~-Cr=3NWZ
ziJv|-J8BMZZBbx=`rE6*MjlOl-+t%5ekr(X2N!!{kVor{qOIrV`~7$O+`fCRtXsjS
z6Y?#OOal0Nr_R`aWw+8-YgwV>_3;c`S4A7-cEx@@GP#oDd`V{J>=hGv?o}Bdv0Y(U
ze?-g4;!02AU3R~jE<4|SPH}Jct)8q{wp-%e=2*wi&1(f`elxqSbldLSjxe)8hJdH7
z1_tVlx3hVQ+_F5L@~mst)L8xUz}wR+W5j<Jl`Q?_zthq+WO0-f|E;$>_Ap;OHt+8*
z_qA263*Ww(_cMn@VdbQtRYGg?BOlFa?b&dj?_Wmn`aO56t?u{e7H*gwke<BxEz8=a
ziA#j8JbPwlc1iw^$%-i@yt40<*Pr}c75VIOkxI);t)IRduJ7O2_HuXn{P+168ovL$
zFzKM!uVo+7jJG|0&cCR*x7))uEAF_i|NkGJv-xMAk1Tv#WWlKRV495E%`T}(XRCjO
z2cMsF(&j5v+xu3InY$~nNpqse?CUz+>J5UcwmgtcxGl!5UmScyGkku_zdI6K4~tq2
zf2GM<Cr<yC6lhd5pC|hK_D+!$i`<$PH-4f1O(wkR;+NN^gllsdik7pvbS`D<^bfdm
zEPBREv74^h+84Zj>uimjcsZ;w<jk>oKkO22Cinm2+j3yr@_(X-wsXYjeo@&P)~=O!
z*I!-q`u=%(-hO9V68%F<OeOkCCvNNT)99UdX;(~c?|unO?LfcP%+1>Df?YeB{rhxs
z=W*?q$&~+;_5bhd%Wq!X)s#BP(zQJQ-?bGFH!Tx;`_1r@iIbG?k*kr97WuCUa<`v%
z;LgEk!72~$`>)Rk|NXdk?Uzkf6AP>EBm|l{epxqh+gWA)#^x<Ib|0!bRQve4$wQGt
zzbn@-X_Zym6`HvxccO9N?|aMHx1=7Q8pD)o(<ZFFZBm&umpHflgfoi{&6+Vu*zRum
z-{>{R=IsBJ{K(w;>e;$04rV%rUwFBGy|2!{etBiBMsPUuJGaa4I%lUDKKkdDJIh|O
z`d@RS?8|vSpDjHmWGQ^!=l1hCzGe{t6)ECtZ|#Zs_iduJ<8RrbIcDjq2F33_@Y=rL
zA!ZnFX3AOL;x4VZ<H7&9Dy5eiw)+~^eLbS3_EOKNU*c*~<MixR(SC(rdAMJ*)%LdB
z3EKE}ku=Zu6Z6{i^1sSvHM+c9taz2}#XQ-gc|~t$%rluJyEbfB`MOA61+EW|j+SIv
zORzp%@=7gEMy5Pv-6Knb8Ep+G0-_J=UzA9<QOQl3r_+@h*}J#w@<W5GH?u35YwA`j
z+p#V@Irm{fd-JR-M^z2&^Iq%4YlOY+K4V;T+UP|0^&g>e!v3?b9$mCC*Iij=OPQ<F
z3@L><rzN)EJkq=0*JAh6s<;=s?{+`Z+ON0zYtfBm+utiqvD~rp>QYCil<=cmU*^iS
zD}LW$QM7Q{q+K<CYFrkx9P#<~k1@jec|)T_xYMPp@45Nrl=3J^%G|zwBa$nsM{bhe
zx98SZkJVm2*THj{U;d&{=!QI*S*0}wc7fY&F>f_u3M_laVj?E~t~_UQMSrf!jYJ7c
zqX$(=Wf|A=6x#WkkM-~RlW$xj^7nw-w+mOpT5tMp-Evo?hPPPb?l-aP$NU&HZZj{b
zHJn_YX7JsQW7|<v_SoHz+uogh^6PTuPDa_ROGaE9qt$HA8H-*$I_ntAwuUH%(8lQR
zla_L_D*KtAG-2smcEsWjPyLw-fp_|Me=^zqa>ixbMb({i|9F1B$p6{vgv&XnT@og@
zyzk2`jaYDexoO+eu8hcS7GGJHiz_RC5?U*#B<}xgoua)Io8d=2PWG&YznIH*oz${V
zVL8~jY`eOCMzmjGV8Vn)JcTWDx)SOu!l(VSdcNCW&&9%&sErCPQFEhBTa)T9U3_Mv
zmN@N?WMZ)<`?N#W+-Dvf4mXZC8y{FTSKKsb{(*xYs_F+f98?qBlTdO|?mer={~gED
zW$N1hxdb2MUnFC?>)#I@qorxzRs2j-;+CIz_}Fqotj~*V4gdFlK5cjr8eCbUo_Z{;
zYQco~Gq)w{?Wb3)U)grNGb)>t_uWQ2uf~m1rx$b`xIZCqvcJ!flhTPx{#=^xTG+8w
zB_!!d=99&568x@lFZfjIt2O`2gC9R$RG43#x6(@4g7uWy6i3MwrVJ|EEv$Cg&r#9m
zOSE;!QBc+T((U|B)%wmkzP^d4jx$$X^zhki8=?B{y4>C!x)(OBnLbPMwy$zxyUxPD
zrT27F3}t^!SKd5@!EVz=sUs<J9RD-Kf7$BX@15N4+h(ygsj~X2OzpCk73;2M?C_q)
zeEhFqY3AK62A%SUeGX0K>%F@m@y=HNoioK4IhnJ$w!NsZ)$Q|r__<H2?Oe1-Z^Ubl
zlH<oudi!iTt+s1Rwtne>q^BQyHVcGw&yq~mlM#J&RArZBPHz2~gRc#D=q_8P=U}o*
zI&Y4F+gc;1yo|g1-+s(8ou!xE{FL=sQ+VJy<+h75`J(C`Gw0T@JvItZSGe9WfjR0`
zR^XZHyv@xi&(ql78$MuQ^x8CiUHD}6`ojzp9C#m>R56{&->Fr#F1Ad1t8w6((4f_S
zCkHRe@bi~q=t+B=6Y}cK7Tf)O!JNvSpPx1<f9Y9ubglV+gKP<Bzbqr))TK7g^>35x
z#HO6}EAu(MGjQ`u`DYDY)s}ILQ%bi*J^NhM6};v8;@rfu>&##Kuui=peBb<9^W~D6
znlpXNyG6M-n(u2p`Z6?Byd=_b+YQd=Ykl-ArpIQcPrG#Fi3abpV!!{79JSUpPGl2m
z{^ES%Wya3_%Ph;k@=PcW+VtwM+Jwv#+#f7vK7HJz@0cr|@AV?oZl*#?-*WG13Q@oK
zHaK^k5}fK75$9fetN6~l!$oG7+w`*Lw=Dh3V#Kz2@AHlSg2jAqm;d^?B6q<}=Te6#
z!KwWk*EaPr`Ry-px_w~9Is4izjHy=|`m1)uoL4RpiJ!Sk;y}i#yf;@j_r$2}>AIb{
zJ5hPcSJ7-<C&QDa`)@9on%K+Jx9p_&lxNFkGd=4M-uGv^Mx4|J7T$d_Em?c+Ufh}W
zhxhhZJB=MLoE)Z|$zF1+I3OqbzUAkG-37Nit1tdlJ-TbU+CKA(VGmSZ3H3UhG<Cgj
z!c^^Dl7Dv6DxadpRYgqfdGb-=XV-j>`1bL+llSb;izKqUVt!3v^XN3x%C6&N*my$t
zkG;Z@+`SzK-@0e<r62tiB-SsMwOcOd-ZVd%i94jWdip7~9{SJzWC`!1rli}MCbJ6b
zKeE+v7;W5}v+&4oTm3MDo=wLp?mG9qw22kpJEeP>-1X(VmOeh#dUvz(qm@Pcsnzi-
zE;%NwQ%N?w;9exvE_CBBmoXFntn4HMk8|fPu5(Y9DY;i=U@WrcTT^D*^326L3*v38
z|2hhZ%f@WG_TGA1a?-!688=mbiRjL0R;Y>=x6L<|Q=fJF_?_k>@06WS3qB55&6&M<
zQyfpRSJ4EQFI;?AVkF~&Pn)nF_`7D+8>gjfU%cG;Bqsc0-{u9240TtX?szwsZ`RHX
z+gkDY=1bpME}rqSw(o*3+g6(c-LpJn4#!RV^Dp*sUj7w6p6~Jd?S5G<o^W0wM1Ap$
zzsK3v^Y!uH+c)80>67EU46?ItD1MJK&$@Pc`GQmZ+b2dWGW)upcjJ|o4!6`evzs52
z6vLm+x0BBM#E`#}>zz-FC*RgB-Bs2m-IAAmf14)>a(g?Uo*Lw~enZysbd|*0t6$8G
z`F{6SZ2P?p+P+;|{-!S6)D*Oc{b=&Ujc<?Yp6{Ph_<udarJ1YGUW}58dh~GBEZ@uj
zc23{fu=_+cN5|@0%pb12VK`(tb46I{3e&aqIsp%iJ<f5ivUug^&-m(iPf|^`;z{d8
z28;!UJK8z*g{m?_Pn~_FQ`h6oTz<xC^>t;Xss#-#S6{qnX<K~k(e+#2{O6y)ewZ8S
z6Ig#$K<h}e#hKSUmQQ9h`5(^vR(0H8g5i6WK;(>PEP=lk7yQ}v^c=^5vIl)e+y3&a
z^W<iVX&XD22tAhJ&~&mlx-7IT?*gxz56`xD_uF2&2X&vgwLItG59Zk!J4_xO+vxCN
zm*sq}Pa4|is@K?Xhd=pr-rQ@-!oD@-6^~7}dQTLV*xVNBc3~6GKE)$C*1yZX|H=7&
zvi$ks%u-?Ao`vfEha+qF6lT9?6Eyc<_vvZGQPT~ci+u{DeV$uAb?KF;vyGo+!l)QC
zRY6kW^@6vmM|0O-<oqUf?QZz7rCaBDep^55-nKg{B!6q(GdOuS_{;4TYFhpejEg!;
zT<+~&|8eH0dX+VKr4ga?MOp*Gey%(>(`+AOMe~w9EMX$w+qGOhtlzLmeeSWXto;7<
z@4LH~f7|jIwhAvvYm=WLvwzjkNW0}bL}R5SmfZ?=x%i>+;C_zego3Qi&vwjql&lk(
zJL&ft(@w6`$y?^c&o(=0!S!ITSL|$`iCK%@U73-3?8JdD_vPmIy{xx6G(q<d!{?vJ
zG;_HFPAM`T`kc7HEB?9nO7#%sz9-uqHlK;zbm~e@<8CkAXA|t7U3dBSP+{JpN#}eF
zq%U0USSbEvmdT5zuYWvyyJW70xKw>mnsYrkzkctAy9=}YM80Wkjt_c1eb<}LSsgi%
zF=F%E-uSNkesV*ckN1TAhDq;q{=4k|Ht*~Cc{bMX&E-F>y|Ic{@5vKRk*RZq*^_(r
zUj8#frYAw;!Pe738Vel@#Tfeyu59n<4!A0Jd+%l5v#z%}U%il-SZMBlRquFOa)WxC
z<ke91mv`sRJNUcWzHRectLfjDdddXPQM2I7mE5GdvcuVoEpvmdKx9Py>Lr%vO81_%
zFSEKc|Nge)UjpW*HC>u;HQZ%clB-{u&=U6-9pTFg%}q|MdiX}gVyVT0r@GbC>VAJ;
z+pOtTU9-J;?MB%>8X?!MHtDKHAN!!TvE_J+%g2C_-fUyf@<Wa9-@MwlYV$om7S0sw
za`{H1H*X}CZ<Boy^J)La@(<#>w;L}|d=n7&M0O*y$Ru-}it}@o6#bI!=`4Mj?G<wT
z=blhSGudddpEE42l70ysjFom#|1md2eVahAzO4RgS0B@BeJkc~b-vLn(tZ5*pIvOX
zdLy&9WC-nEtd`BV>GuWxq@7PKjB}2PpL;o3ovo@Uw!X=KRp;-jU0RK=wH|O78@j!)
zlhS%Am{7^TYnt*p4U6NG-u%^6etqO|izv@i*GHWJP2Qd7U38keUR{|tGmt4+OLEQx
zUGG-I`ux+PpBwB}Yu)}5vHcL|Hp6|#m&t8Ud^XMfPxaA;EDr1PO&@>Dp65O|bE5rQ
z%eDN@a%W%PH#p%?8f(66-XiYTe@#DyUC8_-{WIX2g1d_P>aRQ2l*E_aU7fRkXWart
zgT$1jYXz6SW~+M|^*omUeEBRlqgR#t_Dw1N5p!0ydQN}k{oS8CbRNZCF#rFjTyRaE
z`vymgt<6W|+cvQaw|vOxn>nd*+ALLbo)<Byy4$bjJ`3M<V#T%Kmx=3Nx-9AoJ)rmH
z)yk<$d@e6&E>u`3#a3~<mi5lcga2mNE)HE&bSU=Rl^-X5<`p=qn`nlz8{D)AIF|0}
z{p(xSg3OIQ>$ZE=75~|m+^H%xXNNO?-uX!DS5x1nCBGMAyFat?_4T(lX%=xD=DgEn
zciYa4`CZHXn|FHyS3s2Rccb@7R>te^NNMSrUzzc2b9dpqnp?hh3tuldy}Lf>@52?G
z^L2Wbh43#<id)>CzW(my*p`MX&C1T#XGB-;>Fxa~dMozX<DIN~mc`t*?JY|)WjTIX
zAkgT`{`X?bB2F?~Jfrq&+RM34uQ)EZon56oVV~dUN{I>QwK#n~=B?aOcF&Xln02tU
zXkH_?y2-}J0f9jdi!?b_vR|AjnwhZ9=zBv<->imPH#R-s?b)TErY)x5yZ6%chaZ+b
zJ+34eDX#faWlv$oa<eH#-@jG1Bo)m%d`9y|_KI`fuX#R~PG$B!aBW-Hs<#I+G_|Dd
z&CWc3b=gaGZ_7%V_3jm_>qO>VNM+ot(tW<W>5|7IS>fML4@DZA?p)M%GO=iCyf|m-
z;^2!cC&h#+1uUkp*qoDbc@=v%ruSe`=ELLn3>|*!X4S1p(qFXh9`}k#R*%Kq%}OkO
z$80G2SCiV$<i>nuIoDPZEv-MB^3FeMTCy&f`C71tL}2m*{&kMaLOh-HuT9@Ocl*^-
zI*xS<57pf6d|Z01tk~G%Q2Oi0Pxe9zvB&PK&JYr~@~Uh4j(eRhhFSi~=kLr)y&B{5
zj3>mgyCd$7l6&~IQ+7drl-Djepc9wA&6DZ*BjLu!r{AX=vNC1fIUKi&Wp(E4ACDd`
z+r5DQkV$sr`v+dT_GD~Xq<-7dq{l}s<Hn(s(#qWtiC<P74Ygd<aLx3W>*c#5@o)b0
ziByETF1YHt@a^)cZ#*A6i<ca&XP?^i+G>ugUFG>bKiy7Sl;<$~=rUR#|MYy-WW`my
zRe%3|SoOn1Pruu0$Borq*Sx#9i<inwR`cyu)Rs6BP#tt)X~x6$**$z-wzsA!NU}w#
zc!X^EDR6PyoCKR^&XU)rbuyUq_#8hVelMZ%{rgq@%g;|+Xk>QAr}(*a;%Vm}sY_k1
zg$jIczNC|-8Y?*QT2GJKgVL$jYW&&m#ebUgqws<vSNXzx{gb?jTXppH4W}=;9LyEn
zU%8)E$L_=P?VgVFxTig?)Zvo#<LPw}65v>4K5t>()EiIsG4VXI%n7_9zLa&w>DA%S
z%mmKx_Gd-f6y6fNaA=tibJzCM;f(vXpWK)6;^AeEPi20Vw|l;~g&f)^+WfZXOY4`-
z@+}rO+cp_~SK8lUmaLZU^YxsvPwtW)*J{)1w<Vh{S4>=E+RRy=({gCb$v<%);}V)g
zWnL^aoaxfLOvc?e>`mIzDSekt80O7i+{eCcjpiLg-Whx9FRX07^=PV@fzvM2MYgl}
ztE~Qf-=9}I{ZdK8O0gQ*1+y4*b1Mvk|K80!yea=FpWp$*eLb?1vSJq>lGmRVlBfHw
zc>a(6oY0!6uT17{wTypO%kxG{>Oa^uW66e(H8Hv6ujIcZDek^1wu<%g<`?h2Urc<S
ztrYd^;?2#UBSbXwFD(0V`EGin{Dj*~7mlXSHxv>2wsk>#&8e4S^1W|A2rQW`JR`S$
z2H(UjvyXk-rE5}BoLY2<W9#p8Zu!0kuLtc@)Q<OAzd$tM`A4@1>BFfS9qpTvIAyol
zG+4b%d|u<QGVIcyWeR`P4n@a`yjsTToApBIz4`LF_cwfZSR9?IlCN`+$EHiv<fokL
zntGe(-qN!(o%uZSotPTq1Xq0Op1f?Gi>AyvKA|-pf(3p~p9Cw+^~7G3h5I>JSQ)$X
zeER$6U+Tt+#c|)0BrFSV)ooyo`s{FvneEq}sk56Mi$!&<+`7I@ou{zb`dP(>H^RrB
z??}GLeCZ8STAZ}%&SkA4Q|?Awn&~Vct90Vylr`^q>@qbP+vIMqeUNDX)T>d-WaBC^
zrKUX{lX9%`%zKw-lv%Ky&pH^=A9=ZiyTqOOLW{%g_1lhJy_{Q@R($u+tC`p4{64p^
z{_f8W#~is{i=7K7fAm@U>mtcx%#wKr_g2l=k^WmsSu63SfZKu{$6okcN}OUQw2Jdr
zqq<G2#q7kGg?m{Z_wPOEQg><Lg41{RGft}Vbe0mHe(2j~-T$5@w(A#MSQGX0xb<_9
zUaeVM*LNK(DnGeU$aS?<SmB*Rn~$7#xFW%nlwd7uP(M5T{+gWR4$E&jXFo*VjV=q^
zvhDEUfRg^Ch}6GP&Z?mr9+9hADodZtlAjU9#CWLc)spTAy^8e2|B8ncGh;kwI+Y!B
zIC;_W<KfPII~WZ)L%&qa-L_1o;l$kd7a`V{SH5Rkz%P=RcC~-StPkf{Pb%%olU~ew
zZt|PP-RpYaHm3RIa|JEpnf!c3;rs>OvRm8(A1Y}r3yc$&^WiF9xJ*3j+NO!!(Yz{I
zlfG0=v%PNm{P!!Src=KdEEE>89sbW0d!bBr-`1Ys>nH9QJo(zx_=V-bzV>e#inB}K
z-;BQMcxd~{{7)A}J#6*YX(h~PvzMDY=NBW76l1^+8+oRmvA^aP2)t}u&i-6!b$Id_
zy*tIax>Fvyy!s-#ZPpH<`NH*==bip|fB#bHQc1P@8_x^8tl!(l)Xg{h{q>pqa^GJz
zk6D_0_3y_YTVHbCK7WYeEz2qE63r$53_otKoW<I{;@RIj3$s27+&wWXDZjIK<+K+U
zRvNrbF5I0i`{qNe*`YO;*S4jo<@U672S2$GUvuMsQsX|$k8@q}=5_OKTf8xLSzE4n
z+o>}Zi!)a{2E9L-`f|JH-u{WDuIJ_VDtVoq|LAGDS8<EA2t#jnQCdro_|q*hJ8v!y
z^Vryu$G>u3k=ONYY-_n<W{3sO{=Q}1j$LW73U3d!O*Q2UJ=gM3=KQHyXDTZzc4yQF
zu1~+Wal1~*8%ZgHd%xpCPu0(tY}xkV%8$%bKE3m+&dyV)*3G`<W|F+&-&)=ot`p3R
z^a^_ya=kA}D?5EM*G=qrrApuy&+-*>D;q=vbBkrmS=VmrzAmEl<;<4ua}r^HgWI+o
zeHFRE*y;4MBY#X3ln&ZR2m9ZjnRw^$%*l5W4>T>x-xITMet5vHI@V1eSIx*)TX}H4
z)6?*G4_pLKnk+V%^Tp(6`}#XMW?Bnm9=&0UpXhBab@fcM&g=VmOJkQa9LPAl-r3XS
z5l6pU`4RrwC33fGc1X(hr`?+KUF`0WEfPt2CkubIWxsvo_;>1wb+<P}l)by4)7R9}
zdF3<j@!h&Nf-QX*_*=_)t$)w6-l{BFAtLbEBkF~y^6PWzKA)v{etqybpZDBRE3+@+
zPC{P9dV>S?84OYdHX*hihn)A`zogz_%a|&X@>0~Kpt<JLW{aJ?5p#u2XA7=&Jm(ny
zSl2nEQugHIb;Y+X9Lg)7yufPFyM?|%Mr)^SI%oKg)oJneAd|@{!Tr)U7v=6H-n-K~
zcW<!n`&X9V*13t!`=Dl)<=A@nIWw!qB+lC_Ped$R^)^d8Gjg-B)|R_dR+}x}rCB8$
z%sr=LuE5SvSr`4tCV||-4<&0>Cw|`(*L$P&+T1o{XRdSXk6t<De*Mgmp4VU1mGLU)
z&5HXX93r0k;zErrq}@6%@LgN^PSkHjh(ffY^?bjlp*C#ME0+bY3+3;h_L%90s0xo0
z-xkRU8<#!!w|Aq2bZtKKhVWZ*?fF+SwVS#%t0YwxbCn4(A5Qo*Ib^P^46DJ4?zF>h
zN(Hl(-v_Ts`5d-&OG{3B^sf6X=UJNmxPRKR_j9@5&uZbf`g=AlZc?j?ce%Q(`Cm7S
zM&8^DKEdCX9KUB6@@e1ut?w1j%-m;Lv^R0$k=?AbzZ(RLu;;Vaz4a~kDNmdIcGJ9+
z%X6pPZFX2O$=Atc(w*<p<#X;OuX#J)@8)U0pZ*#5r!_n}`iE8d_LAFucUUScqQXpP
z|29=n3|J~2p%!?3?yTu|7}i$vPx*8EUh8(9#`2fV4bPLrCMsp>sAdG4tNZ$HRa(8!
zce%%>9}-XA6iM&r7wc#=(Kvqh?FYLimzB1$Du=WMLl>FM6XZJ;<WO|TFK?NP!Y2=g
zmAl2BH-(-)u+jHhvAKo&H`|c2j|^+uyR#Ut&S)(4=T%n_yUy#!-zI2p=~U*(wkPLY
z!;*!4*EhGWzA)wS2csz+=DU)@54v8=ds?1X`Hd|wMB7v6{l8RJ|J+ai|L=OR^7+x-
zl@}lX_hROWx)Zl&d4hBOjh-Tn#b-bN+-_fHw^I6&{eIUq72DS|e4ZJY^Vf8m18df-
zKa&0S&jfo;+?Tz0a=nY{yMJlIvo;HRwX5E&lG`CI7gkuTxwPd#wM}zuS;eC1A700X
zx_>xvCZWCW^B?)cU#4wt;`veaQcAY+qN|Q0Z*8O3?Ue2JC9FD(KN$WhJ1PBUTEC{)
zx>d6savSe`KV5T*z3bBpm!jhjFaB_R?<e9t-L>j|zqR}+y_}`>1;Py7JCszOFW8^@
zG4re1{O8k;etL1}tM!9|O!g}#XHCRk9L;KFyXrY@qG<85U)HPjr;2cIPF-A`mCwG|
zxVQbm>g(J+EoNIBq_?~bnGup}s<xti|HtbWI4gMT<z21fYJ_Cjzl1by{~*0)ZdHk3
zxkhm7qbhOn?#Cf5>T{UCuWZPBq2cgzo}Pgv@9H((g$1t{RVkFHEIa<J?@B3Kc2UOS
zoyu4BnLFASG;gaaGx{#neCC>+yyD-^X^n4e>T-pcVk|ZY`}{hZYRICPu;k1?27!e^
z!4=baCtC|{J{?@W{NSQDU7u?>bMJk8f8vW!&9&>nQWozccSQC~^U7A65Vl22HR<}|
zb90&BXHIVSerezM^YoR{8|$jS3+`mh-97Cj!=y#O9!Xts>c1Zr&EH~`{IFH8|Iznr
zyL7CAG?Ggn>$jR$o_<thdv?0y8+pl++5TE9yu(Cy*>7^WJlC(b^_ZmOy{xoSK9MJ8
zi@VKC_uf7$d$4P1N6S_gt*uPQ>N~<SWH@ayj6==i4%&E~cF1yeHF}k|ZJCo6n=co)
zV@t%7;`1rKJ`8!+KfF4V=Dc*CtNw;Vx9>&t2+G@UYhNQi^OX4;X{Sf_Y3~(mLe@UD
zvQa-7TUjB!{4CF_q@}vguhjmXneidURp-_2uUjPMRKNURr+3Nl%ltpCCw=A4&OY`y
zrDXT6RnIclN(vMoot@y5T=q!UP;2Y!ylMSmB2y-P`Enxm_LAz>rp!k_7Kv-zHWw{^
z_|#O6qoTAm%;!p1YwgNMNm}7oZzq}h%v)XNlW8)~KW|C@jpW;#q?T+=Oj7?X{i<YF
z()Fm&4BPqQJANB}_vKi%ZR&;syZuXNFmGwg+GCT*5&u)%xpIc}P7WEx(CT|Dt7=}(
zUz6Rpi(}5sRWgdQo3jIpTr$=B9J!un`?am=F}P7+<+XL%Jh`$-Grrwi@|L+_v+g2>
z*0>k?Q+908bdpxiN)8EdanEJupIh=a_j#qQxBQjo+kdO)FLC7JvYyTI)Wcu-`RrmZ
z_cNJOW?Vcwi;Xohc5kI~`y9?$ywg8#UF~*xoA#-?7zYJmAtgOYsh@=wI{K>2TV!tB
zHoYKj({^Irae3}&lk;MU?Thb4m~1?Fagk}TuX@gu;ty6rSF+OHwHOL(2J?14c%{O2
z?U|6$PQ7BaRJYGv6CJhpyzW)!6q%eY=wvAKtI;y%PL8z2@pF+z9PHZ;vc{g_EL{}Z
zaln7EY<uU%(~-|D_sv|$WnKQ`DsRp*`%@iD9FscAQ<L*<ocMG!_oCTdAr--7)29a<
z731H|d&Qu2)y99Z`usl;iynPa{-?g{_SfZ>5$tt$mhAbp_#|JK+v2Yl=?^*l9@lJ*
zvO0J#!AL_UzpXv0t+DX*YbB{zK6@GWN4b{&ZNo3#UQ=_oee;j7XqDoe`?J>0THkRo
z@kC9I)AUD4OD+hmlrRerSv&Dd6~EBrOJ+<z-o@QaRr&n-;tT!H*(xWk1T5IUe$4tf
z_2`#tE$63QQQx<z=vUjslf@aCC2t>l|FTHr>#KQw)patDzJV%J<0GpArS79!z67z)
z+9&yG-J!$?qa}CO&iwG;@r8}MJTGmzdt|klK=eEgW=7|bueH2xd`G)k5_(Tf?aS|L
z?u@V0Uh*}H@43dSxOMg=ubtc8U64-nmgD8@o}azwW_R?r^X1RiW%>DEXb`X1RNA>p
zaP69^s&5nD<(jY2=F&SjOX~X18!I<Gm8xdC7Z-Bi@b1OFo1!e<Z#b;~(IMu1shr!7
z{fFOiycV2WA)<fTScBn7lHu9>-UaP^Rxdr|R3|ncxbXAtv(K(GE@!6h&D`=M<iSz-
z6B&OSkGjcD_5bPCs%W-SWzw3YoActAe0C7sa9$$qc7SBn;f|}Pi{AX}YZDVV=X!Jx
z+dBEnvQ0Wu3RSaorH&{a+c)na&m8SC9~Fs=3ttZK?TC41d`($#zq$$I*(AH2x8ok^
zM1?jApL&>aGV#p$+iGHVr`}wj@kO@g(T(@-cSJjx9dM0VF`;%<s(fRMQ^rNPC?@+^
zZyhF`I~XsvVT*Rx+3AySnD|yb-5_x(=k}hvwQ1eShZ=7;zJ2?KPvgJzM&7>TRYw9v
z?Ja~iT(~!9Bl{y(nUgJ(6h9VcEN+kJFP)*|`$ywe<JTGMS4TQ>H89RQEU|s&uH_;V
z<TPeXQa_@arSq7>F2kV1v2Kfy)55d~-z|(*GPLP^<TrRG@#T<oRdGY@nwRfcr31BY
zaD2_(tCeQh8X<G~ql+UON3DYG)5zCs3i6T(it1By8CITs+5W~<!174T=XcRh3X7cf
zCLC_Nxamkw@Fo3d&;On;{;oab+M95-`$**GTPt>`J*}Cua=ER5(yH#5dtdDQ(w;uO
zs<rdTv13nDf&!xFoLToQg8TH=uG>lXqwPONS#(MFUs`ed6&riV>zl7`RWVFWTVHw2
zX4^&n&=O<Oh0;1&-h%apEP>5x2NXP(E1nejHk;L$f8`GQe<Cx!_bOeTR$H>{uXlOS
z+N<+4EjcHZ6<FSJO!~f)(X3(*Z??4hg>x!56w9(A|GYYI#Z*iAiJ$kXon8XXyCaXX
zDK>^3U3#FldigPtxI>QmkB_&^V7vU%_V?D;RcxC#h}*p6TGjUPOt_$}@LNMEx6QUw
zmoACAYjyMGUCB1z>+V}ZnN$t3zyI~92q?8$Ar&nnrN-Q3WgcQ3DQ=eeSjN?_>x#YB
zCEq(?2l6t@x%ti6PEM5St~~H&Wop1V+iO0;VdWR3&wbvOD{+-;qPL2<%8ayIdTHO1
zcO(iK9?{xxuz<ZM$+1C5_j}0OLc{mJ_uc$q=phnwcqfO8liBl)v%{_)|N2Prgz!e@
zm-|#?r#rV@U9dJ*g6rtTPc96#wYxP=&X}2(+m~E??U2gbSt1E`^LT4^u_n!KpOcxx
z^k{}q$==Vg8!rgV=3%q2yK*E{c<RoX7T@Pu`!yX5<k2{`#!trCys`0KN%fL@o90KC
zoLltu!uO-u_pE9>Zf|Xm^=mdclay{ZOYBnghr1{EvL5_j+wjikdgMFBs&f(NCjR}b
zdnmQEujT38!tCEikDq*b@wD>Vmm!=tJs*S!X+%x<tH!eBe%ndKcDwV({R7;+TQBPF
z3}6V1P-ai5l}wv<@Mhh-_9y8w?q{PKRhDUFGmD;de7l^*xY2;E^RaY>Q25T1Oy^2h
zJlK{NTg+Da(lX#r`|k~`T-A;5)#jaE^p^YA?k!o<Y-R@X+-2O9X%V%N?e(jMgTJJI
zFVJ3mb4hS?uBPZ$fx|8{G|rs8Fej&P<#y|j^KPlX&+M7QzD=3UGgPX3UIEJye{sWG
zQ@IPGL&W!Y|7hFd{evfL`klUcDjXNJl(i$m!V`}==$$$+^GV~2wZ&{N^g6eky%yE8
zNajV{s|@y4ZZ|S6_zCO_;ImV>e(z1yEYrIy)>j+0d9HGq6Mj9-Z_jn6kfK9!noA0q
zR0UI>Jo-6l{(9r<N(+T`JoRg<UH0AGI5TW+#=fe#59bB0RWHwYmXT-ub=D1L(=#`2
z7MY#@q8pteb1{N@Rm_CW&K+)RPtRSmyz`OlU1sY;(Yvk%>SkZemF;-W9rmDzbB>Gt
z-=`0j6becOoLbITxJUM0LRHQz#RpIH@?`BUn<sXjT{7j)mA?B<m#;4p&0o}0f5h_o
zjTz}{u7~7gw>~}gdELge+l*T`22F2XDd;i1dEv^u^hisQ$UVZor%v&*_b+#Nz`Ww`
zf{v&<HW6ocvx-w6Cv&dct8l8{x87D%U;G`ntnDr7MNI#fMTm(w{9o*KRQR>`fjP!|
zID~UW=ee017hH7=+i-UIW$rSyvWkiJW@5>~dt5I|Cm*;k;eUZUB(?owT<(j4k00Kf
zuDNWa^2E>oNXm(u2L$qW#T3hEE_aOGvwVMs`(m*=k43rad(5x*@f{cCxtKg5s&dwi
z+`c|*wH;gg)<~RNdCS%L%z=}QU&T_6{p!uvy|N(B^ytyKO!k*N>@%)4+`1@Oa@F;0
z;zk*16_1x^ws`)Mu`O_AlrEB~KdN^2#`6CYd$J8~+?Zrpt#s}~X>x07?|&)2Pz`za
z-~%_}gzf$`MsMpZ?OLx{9Plg0%kJ@(J4?9hEtD78#kXwb5X(BuyY96}V>%cAVR4^1
z=U98$8~?AI<7RFD>h0khIadXHPvx>@hD>ppYp|=RR?NvlK2G$-9+zb)(J?+&xh$%m
zcIiz!ca&+myoaHVP{NTjs^a{cWOClkW>qxbcSmU6gU&v)Y?ZGLnP0B^WLbRK6!gbM
z;QoVz9a~=pNu)1odnr|N`|6FG?}9Hi8#rG2lF{e%(nR|1v*O9WT0%^<jneKW$S$=z
z<dL;t>W1{mbHA+H;a~pao9xzwX*Zt#tvgZaes}sEMV`do#EsSd(N^+5woi1CxZW+5
zwbEyvN%fI%;rT1ILUn&_y5G#Q&-d*QyQulfzgC==S7yA){AH@$d_(QVg@So6LPA*t
zC#}~J;f~4Xv}>Cy*lpXFr?t*RZ05I5*BlSVg_%9zpLN5kAlP>Q%XPNqcZKTgw%s-O
zEOj$u_tuhCOYS~76aBcv<g~pQQ%t~teMO~5;u^LVswyi-Z#!_t@rA&ysX1O-n>R2P
z&F=hhY@*184LddqT{bQ5On>{3HD<@NpQjH`{`-7Af8XZ$b!K5FtlS=MuP^^Bv;VHW
z?Vkb$)wjxm8!V+ZF+6QOe}2cBWH-0j8(wa+-#>M|`PL+*u$GU?u5~Z!%MVtpJiNEE
z&g{=IZq}cBi<%<j{7U#Vy;}|aniuEa(DO^-_RL#4HIXIf#o^s)QAu|1?z%luT71}b
z>(ZurpEqxg9k}r}sM}f9@x<HuofEE|O%mOv+`PxzTFbWX<Cf=>SLF&NAF~pT>u1}@
zUh?FlL)oqDDNDaSYIpwZe)5l2l9+KtwWFNvbElK_x!*sfSuZNs)p{{Jciqa9$>C3H
zE<~{Z<||u#YW3N)L)$s!0vULP6B(<`^)3V~o6&z^`TR4Vx?S0%6ZScMPSicxRbgwt
za>MUsi}==_zWL|e70De9pSd3Ynf3Dp-wSKjj@YSR9&YDt$uA9WP;E~x+qY`_%D-Dz
z@tPFvk`ot^N}c`7KeYC+<!ghBKjx*kzvVblb<obGAbQK^xA#M>XQku^hkqB$J-mA3
z%9{><_s5Hzj@-#)6V7n<{TZh+i^&b!3#t^1)Jqan?(BN2e(Ul>^ZLg%d_A_O^g}dW
zxTt9IepP%vWAfZazFE`R=52Xzrzdu~CM3b@diU)mGjzkYA7NU+DKxWu=B6*)se3JN
zH)RHk?BQ_eym)eR>&0U$oU(TqT9$5fNak?-xk%aRi{ZA!VvYK8d#P7v9Ub<ZeI-*6
z=lW1HC8Yn-mE)Rsr4*0&EAM!G?Jg&?{OSh^i|TnFclIoK`Qs7SKS8xuz6(|y<<oV(
zYJX^Bj81E5tgXkNgVh150bUz~R`9uo@y-8JA=@`;xxxAATg<*>Z%HlveEr#%RUIWK
zzfYfNmebg6*S4gwa5Z<r{M`X@cX{jX*hp>v$~N0m-Q{m&!0SEoeb?VjblAumvncj=
zLfP?WZVqo-w#nt)+<p8c<IiP<6%AQCpV+jQtWfnxOijOY`J9?ddG&%%84<_M+A2Se
z(lZwQ^=`r4vs!Hy`%jkDJ-%lCGpeva%ti81wn~e^tF=-$=6?&>%4RKI_I2J8{VCCX
zb9|S)uqyavE40&^t<>J-<p-(5Y76-*Tzk?3lZ(sm<mm8Rk0_lJd*e#$44ch0N0qpQ
zoR2<9e-nJ~#iYzFlh+78NXUqL+otS#%xva^kCX27wx61)D0#3e#5nc#B)%ML#~$I!
z2J*YtT|eI<5qwwnQJk&KoFjf(@>7IlLl{)epDan6d8>J~+0o)FSFKx%pTzCC61wHn
z(e#xOHmZ57bAxa1T<PSsQLDhNI6xhA^qb6_6!~xcpfmJ3KLz`}UC;OL@q?qkgRdM(
zvHx3hsj+a=)!UNG-43d8Jh1TaJCU^g-+{#rs$Sg*PgXM?-OF+Jc12U&2C-`vQA-V9
zwQ5W3EPlD6;A>V?+!p=0g(CYRindK$J6*rw!_|{7|Gj+J{pRb#&wbt*j(@s!9&(nx
zFy;4Lv*`1m&0?2w7oLua%Z)p|S|-$X{^n_RE$jX2?zk^~CYGJ)@MrZJ)l!X3(?0Et
zJ*}P8EL%RGZ}rP94-ZQ1+B|EbecYW>6SPedm>)N`UFzbT5$ZElN7M4bwHX2qKez%I
zy8d4h<SqHju6XeI!iIi^hnMWz&+WaIoPGP)I~^B+1@e|>uNG|%YVH4$|1Ycm%Qs)X
ztyZ~3%zqbF-(k2A{pak(({Hy~I9EK-`~N1iPtWxIVe=~+6IOqIe17pQp?}ZwFP~p<
zrO73KyJ6_jcAeYlx;LK1-t2X~^f&)rcdqoC?=?5~sRSH|?>o`D_*lERO5z-$TSw-}
zHkEww-2cOoouSgVys+v*Nnl`)WzEKeTb}=z-uPuP#{t>Dujc<gE-Nmlm9zWBMAqw>
z5=)OdmSmmD5Y&9N<8NcX@c%Q@ndBc_PtOf&5u1>{wrQGyjj9RT*^_w>G}IogeZTf?
zY5=orI?Ln&^Ensu__x_Fy!$IYkm>vzkyG+>%50ZBb+Mb$S8pfz{i4Hzy6dm6Txd`^
zl;*y3>$yVpL&6CH$?7cMPRcCl5m+)~<14L?CZ%6q`hDE%(skl&*>!#aMN^4QUp`BJ
zZD~B8x1-TBFFV>$Gk!&8ZQl0nZ@M<mzrRKM#nx?a4e!pr_3psjZD!X?dve|1rJw0p
zaDH9V>XQY}t3sHscqgWOd}Lx>^ZVW3l^bpvet+TeKIfwO`}p~CY3}d+ckbv}__v8U
z=9R`B{l0s9Zq|37+0YrYgy&6QtEbD<zmN5~_Bk3aSTnW9c=5_r?;_hxBwrfr7u>)Y
z{Yj?Luru56>CxMTXBzHA^JVL#%sbB8d`32O!duh0x|8J-PwiJTQ2zDraJR6<xw;>A
zy~{HKZ(R7eZ3^?e7jG_R>P-II9$3qDL)AjSa&6zst!fXhNh!Pwxg^jME$wpa_P(Nd
z5^vPfp4<$JoYoZWygb|LQp)7YO}hn{+O|7g;(4~|#}vi@hVX@(RNnILf3<wW^b(UA
zt%);)WVTJa@-fT!japVR<Mj<%ld|?kt$AD6KiP2B$<?xZ+jG<x8Sc9<XZj+88ovwr
z&!wD8m+HRj)N)#8Z}|Dhj@laL24BX*Q6Ib(3fx~C{9x}MvBb~C>JzV*$LF^u{c2{+
zs7#gWS@0x+$MBm_K}Tf3hgr<VoFxkCF0qF-CAP17Z{*uE_2#Qd>l-`LUNQ0t@%_4H
z)q6k3v^UXxq4}k{_*T32<+j}m4zeol$@^TZ9zFBPJGt#;q0=`o=TEL-<@cGB#?bIA
z)7Z#wvAlW3#Fj8?L3j4e(koT+=A{<SoyY(B=$0>&%O0sO;1A({mGVW+BUHMy*PwUa
zQqF*l$4_O)wXRzyTvORxsGweH87d+&?W@p>|Bt5q-F_i4@Oa8{)+;5GG-o|voU^N-
z>%bWXy#pTu&Z(<hWomq+f9Ox-k<voXrw3*;3ioAN$aqb5^;y4o(qz$@$6TIWnxSyb
z)@1F*>$g8}EEfH%T$$F(vr}c=<Gw?0WD~_TzrAAXzxm{R+^!Xyznm2QlruAVpGkRR
zka6O{+3!15tAEx0Xxh2{L+{L>?;B^te{VIv`On+(^K%2OR?jlOu!<9{?t4ye{du{Y
z<*cTHU(XM2U+zQGjpnTSEVfIs`Ka*1r0=P#yKLfKGw8FeWiGg{CHTnfGEex4Uxk8w
zIxXcTmk((_VXZhcA-3yvd@P@(#En-*69mJi8!ojxo7|>ZD8l|_?jF|iBh3|BZj1}1
z{Z~{Re3nzY{P6axhF@>`w^umj?rmAtce84d`s6wJH!j}Uxq8pJG=ul4Vdu7<?$v7i
z^GZ>zY_|a?tM8W09!oaOojX@NWy%4=#m6286;4-`UjHKDN5+Ba7O_FRT$4(?TBbf#
zoV&22&r@@f<i-^yk{Um1=B!T_mpF2->V{xi*N!z8!aw$HTP1AMwBqmg_i^v#_tozH
z|Lnn=my`F;|Npc4NXPs6@8`>$NdLyOuwlbtMH$}9RXgTQKXL!jhxBf)-uVe?KW}J0
zm;ATkYr-yrP=24Dd6n${HF@Q#zW)@cTJ^g536Iu1_T`&nqOCfrl6>wjU*(vh_h!SH
z$M3dzOrFxb@$IU2uUn-zCd_=(;a0w3tL*JtenM{ZGJh;F*ZO^FQcgw8Y~QE{OO8h_
zt=pQp^upyX{(Jl614_JN<b86(+jMUQO4u;&+<v+}<B*<u;nFypjQRyLO1E*St&d#e
zq3O+W>s{27(5+Qmi-QVE#Mf-PTmSd-KYjIH{Y{fE|GmyW@%s7tlT*GHhA2L=b<tSA
zd3yVC-}Mex%HmA5eB$KxSXcc1r1D9py7b2{g^EW0x#{fr_DANdIgt`SCvjKurd4&{
zp1pYLcqQ=l`rbP4$%`ENLziv&bs;!TcpHCx{u=vJ;-|V*nHDYdGF|^uYT@3i`Tx_R
zziyG?b8|g!`o+k->Hdt~ZMpN=y#!A3=Pu=v6z5LyY6uKxIj@?NXt=0OE|kaXtM$v^
z1pn)+i?*gYXY@q8no}et^;xw3u2-D0V6D~FiHS2(k3YG$=cn;cxr!x4Up|IyNc|S8
zRXf!n#!BtT?6u(%#{~QR)+KlUcr)`t%a8R(JSB>99BqFFU2(bI5V@~FVM5>K_w4KP
zI5gV?H;HJUkg@)~Ezk6J*S1vqf&!D96C27`oSeHs*W{G@?)<5i8-JM0T9^IhX3^v8
ztd|uIw^Y2ITgCZO$vgA!$&b$JkDf(xn*{jI<vM@0_r{Xjw-5Z^p1jau+2z$t%8T_T
zs?YJ$EXs)uY-5|+5cHXo^^@om&S`pv7v3aA^_{vJk~V2g_tdW0=01E=uipr*i=A<0
zMultj<|Df!HoaYXXS&F9k$<|3J5071NuAPLy}MAhnP<&J&FsdfzPirFPeXoG&3d=|
z+*bwn-@ONG&%F20U9_81_+Xdzvq@}Loo$cAj%UT@bx%!uV>`j*v9i}8?~^BEif(JS
zO+S2O(r>%%W<D|(Z=Dx%vW;2z{yxXXC5N7buAb`k#51$j_rGRe%jB~u@9yr_uu1${
zdUB>yx~re&>-Jbaf$vk^Za!hWen+JL{qH5&TUSP%FcDqO<t455#MAuaJUx$77f*#R
zdv$uHS*&Hc`=X?p{?w53uMAgaJNt9|-WK_=I*oho?hxV9aGQ{zNXsLWZfyK)QTV-9
zZ_ZQ3Q+=i72JJ6=x5`AXUnO`_WlpsC=6#=xo^h@>@!$12P-SX%l&?@(XmK6?o3*R<
z)wYNB|Jr!?>X(ymS0-85Z(m*#p_P!h|MfHD;O!pYZI#Mu3d)WiSNs^%dSls}Jzm8p
ze3DdFT@;VxTKahd_r}Gu?|L!|-gkZc?c8LSZ#Qf6-F|r--+6Mb#XAYRqd%;F$!N#2
z*zmNoba>>Oavl$!b%kr!AHI3%6+!&7%U4|99p)e0zGJdlnj_1BE8^ml43#&WyX3g1
zxuTa_HiUEO`+0l;vGPkzzw^&Zx!7mE^@O;p|HRm;Wu;Ngd9&tCDZZm>Di`K9k$q3*
z!fiIIe@t0+GX6&5b~m-m{;wV$4)2ciyy;MUdtl26#WLB0Dy}7E3yShN7tHG2m-0q)
z{roA`Uw664$o2+_YsCgMF>jSA&42px;O>~09m$4OlOJE1^4)UoJH10Cd+JZ5wsKj&
zyyPZz<D0qQIaB8!8Hb;?{y*?qWAfj<4=#K>?#zBKu3*+LF~b*MPuR@T)RuSCdQcoW
zZL4&iVVP5kgWUrLHJvU^ru%=dS46zonLcH|&zAk)nv4~rdWx)FPZsR4$g=tNq`$)O
z#vR6xMRV_E6>oZAJJa%q@%ni+bKe))Zhy`ocXw@8T;#6M<I=%X%P!PaSvlOkBOb=U
zc5DCRuQnlnXSOS?WzrG3%i@~CcaH5%;7y^GYdrTY$ZDVXH<jhsG#19x&09UTpE0Yb
zG+qD9pKB_cTiTAD+FO}7p6=XXsA!}*?RbmY$6c;jLQ9YE1~p&MU$HNeZ)%?BVM!Im
zlLaU0PF&qG`8!)l;Fo2U%z5P>x!qIatZgKY%XPmGUcV*T<oxBuyvoUiF^|NL3q1?l
z7{0{0C1+3aAA`cXI@@pCl^wrdV6%L~hOJI~oiimKUgrJyAkl07w+9id5ud)tGT+u&
z-fHT?wca7cSI2YJ?JG)uC78MyzrES9?da9>2kqrohr~2<*=AKq3wOBwEqwD(q2cJe
zmL7q-a?AXy^Cv9wzHg}7SGZYvkA59<s-D~b1<R7IS8sG)|Jrue9+BV6K025L@A+wy
zbF1T>-@7?B>r%7X+cm#EW^d+6YM<Snw`=dySt(a|4{@-$Pb|;&I<e%`n!E|+S&wqd
z&mKNlx^d6dN%CBcQGH30!L!A0#4XsPIZL+fmC%+BhvGYH^u%o6oD~xczjJMAqjO(m
z{mC=0#a1vxy*+qcjJ0X;qt8wi3v^FByJ@biAQ}{UCu6H&Q_mA86NPQ(7KZk?91AM5
z3My;0P0(27s3G0>VfFeNeqN=?Y0s}%sjJ#>a;Vy5FPI{Jw5G)L^mO^J52Y2SAKRTg
zS@=+x9B-k%$Ibcc{rLS(d_McV=yIyuvqxgKpKtFyXVp_1?eysmk4X|^n!kgIYj@?H
z723@|7A38%pZGN-*3jE>g1URBNeX9ss3ET(zt!|Tt;=uTC_DRq#?yOQS&w!Ix^@T8
zS<jx>;?dnKylq}`#~B_89Z{`m&(F?qdv)UOG{)Z(^u6b>wj32anYl?ue)f#}ype%{
zv(9noSTnugWK}C!d}QH^hZD+Ub*iLSedchL5)z*zlke5})T@+zNr+=vRP&;_BHJdH
zu&;XmMy))+`P9T+?ssl<Fc+RYcBUzS=iL8i5<QDINc7x~=~S=#J@?(EmELL_{j{~z
zq)z-@v*vi}jk_1sL~a%Gzi;o3iq(8wvW<C5>d};KDFF-Koc@~YwQaLz^TB7Q<4-xP
zfAB5H=jo(0CVh*;CcNKf8b_GFt<mUqnXK$|@~qUPux%_0Y##Qs-comKKfS!0VUB%<
z3txiN%beNTlTWOa4eUE``!nwW=PRG10!kL^g}s{aLh|eh1xxGq*?b%ea_@@BC-Udz
zpIEf&jDywwYnKHlB&qLdjY@m$6nCzR>*tjx^>0-DtvSEBg#7AU<@t5ajFYqV_WMY8
zFZEPN=}vzBLU7JCrObv?hN?o2+4(MaBoC>l#jfi*pb~SVYO(R+Czn?`xp;K_a9{Y2
zrStgw$+s%q6~4SWu;7iI?-e`Vay=%_VA;8sGNohob#P{H@Hr-TBwmrpEk0+5LP7V(
zmoJS1_C3tvvCv#DrNG>@EqvYj3uzk8-`9M*$7zzMUly!u@3v0%Pf|nF>a395oYIXt
zt5bLGx*NjB_p*D{HnTZa_J5uGp4VT!e6y%(+H`B#cjxmPQ<?YdY!JLyQT~_X#JsFI
z{RYY&B~w_fg!Swusj}Ei=xMgKVyKb6?h+NcL@jFC(X8$qhsVN?%RSqdrvJF)aaDUd
zr@+Oi%e8!6>s4fD3nngIx3)#4dHw~<pe>m$w{@kaDHSKbE_4jMe=%0{=Z*y>YPp_~
zx2`T>)cO4C?#F{C4}NTKeslNV%YNS|mute?+oWz>3tw>3-O0Yb^vkcW7th~3sh=Mw
zzwhr$l~pspxPATbAY)<MB-ND}hbEOImn~oMq2k2czkzETE(EM{PnulsXk5{JJm;H7
z__NtQic=*7Zap=Y>!|i<mCzG@E0(u;WnWy8`Sk<-vpsjU^Y6YDvpP;>aZ%Ci1P<}@
zX<a$*cPzI){KU3FP1tdHfXm@kk7W}Q?(cfuXQ9N(vMK14UGK3?$2FpFJ`igNyZm*P
z#|pu3!Ya~nT@|%coqLmZ9+@3ywtsH(9flae)ISo-a-Zl#oHW_GC2DDL<7Sz=l^5?-
zteElIa88hIxI_EN>%wo1dXr)k4{TsxAG)dga{#ALqHuzMkoDo0&2^dw{m$>Mx^$T9
zFsG_n|J7CJLk<@EZrtc}`%l196I=O3Dr`?vkMD{8c2P7Z?$8Iz&|=0|$=Z##?%6V}
z)jl}$?U6GD*HaT3zO#Sy-K05TS~B0IyfTqGHPP6>tJ{rx&ZVtQ-t&B=Jn#LamU-{A
zx3^gM9B#6!)<2MIq1Y(>Q)#*K!Opq$8j~k_PcHxG8NY4+(evBSTk=cyS-*JZ+`mh|
z?95i#!hD0{ZMOFwJeRNDV(V9@H|c(7lh~S&na>?$^EC>N9{Ay}yfB45YQeJ0MPci9
z7|3`2tkGfkBr-vEnbAh)ekm)dxWGc+UdeFo=;@rtzPYav+$zd2eHP10gAc~>=PjhO
z*30QxT6kEosMKDwul{uA_G~Rjw|<odW*cj^lk8tYmcO5<+}&v3tGQ?1LNVt1hwba%
zulvMglTekPn_gV!uw|Oj<}ig<nbkMClS-R^IhOJN*uAH3w&bH<Y~PvAM+h%1$xLMS
zV$YJ`_0Fxm&(t2>K6eG@4IPz)%^i$=@3>?C8~f)PeJEKJxGhO|WoM8<=7;NU$M$W0
z=D>T!y*wfMv8;LGq|<kL&sNDPe3|~#=*+uk@BVc>(#aE-i#D@m*<1Fw;B8W;@)^mq
z&*w+&N<aH8cvZr(Al=+8B|K6cYo9RPVBNBaIcm{*!P$#GxL%tdxNd9M8P~mx;vw$)
zcRaYNs=vcQP4xFf>(55<PkqIu9d6oxm?|tZd$zWU-C|W8!*)w8Ax7nom*TW<>uCQz
z(YoQz`zs4JHC&C>oXXSvm;ccVJLdbQhnIb<m5Q0@o9vhrcKRzveQ)Rov)r0%Nrn<@
z4-0ELSuZeIm~8#SGW@}T74g2sCHhwl7rQ*;lHZlxabK1<cFkqkl1b{(M`iZ&HEHD=
z>Dn0Xwf)#%VkM<%qG80PtGIq~;2L>3_S@m?EK(loceY$#Y$BE=wd2U=UZur{pE!t5
zJZpHMckZS~9gE6y)}1R>P%oIxp{L07w&>Tgxz=91tQ&rRf5ta?Rr{v>_or95Y0EsD
zw|j-N*I6BvQwBkcc#57yWF(!BiFy8S@|soKwg$85hDKV;L~U8Bws*n*ZK>ZDP5!>|
z!2#ACH+B>ne41N0@l<}RSMz51w$6JdQ8g{DqIad3%I#Jso3F~XD7h<e@q=T;m-q(X
zMfG<#c-8;Qcymd<H&y<z$1=ZuwyNclpVe5mU)0J^=_xtMk^Z>ET33CJ;QHhb@yp)a
zTRX?l>*nldplu*e93F=rVhAq_y!kssF0?nbK<xXvPf~pwQu$95oRUpi{lUNG(W|O!
zXPNvj=Wb!X&sI1!X<_3>VSY6k^QTWMYYd+29jUz*f2?OAPf*Z1GZ!<5y-#z)u6>Q-
z+{ZW7tKHeVe_q*_=FnHcsk5TgozL@yCYZC{_w#JK67wLgpug|#n`@t>*RI^_!W^bh
zE9TLg<*?5vSeSQ`XqMcZ*_C&mx!T=ZcGy{g=X7ZAgz7bGDktSltSoL{{YIrb)lk!3
z(J`nhvd{m4rRn7PX<I9dbk}vSl<d47Z#Z?O{3V-vQ)S<DS<2|0&gLl&ll<{yVoj*U
zbC!m%Q~5vm(>|=)<FNE>!ST@9Q!Y6j3~2ap=k}8`E=PQ%VnnWo`Rj?DFbe#&bnz+C
zuWVKG=Ikui=U+6PP5Oh~ciTP1SN;Y6D&A)#(9N3bVs%s1&A9wb-?XJ2nSs~iBr+x}
zSSG?Y>-MJ58-Y_wZ0dgN87NF{S)#LH#|pKEDaFFk(&t1S!unQ8?KI1<+0y$kv@zV{
z(30Bcee6BYGGzk!b+3HV<jJc!JuT~cfrs+HrSqnUzUI5t{4MADUMaD)F+EL|hpLPA
zXx$J9p6&QK@Emum;M9jYCsy?<{qBflebZ9jnZ%f#!z+E^YEqHvuK#KG5)OZA5bk}u
zO*w(tVe90#dP-^TrjOq$mv1_Hu1CrHOm88(zxkZ-J9$@>uSG5^_xt`Y<o@y|o!*uz
zX~7dpZSOK3e_#sLKeTH`m`Hxy{A=%D%)i&cpJVz(aj(d>ZC)?4{hpZrINHNI^>$;R
z`i6;nqD3#9u<2}fjIRteWYMyG@_OF)GusywI~IhCKTul#x^1m;_~b4dvvk+MparWx
z6~!@Hcj=XgSH|{fG<ezV_wDmzXwCanSQj09<)c)1BCGzzqkac3O|4eHY7#%KRG$0L
z#+JYtA9pF-)O38d_snw6WBy9Lm-=>1eY-bG?C9so)Bi4PD&66gSG1?(M??buvByk@
z7vJ2mt|j3sAA5I_^STti<L`syPdOj(W94>hd$MXtHcy3lr2ox_0f9zSMcbSF40#^h
zSr~d{_M$b*4s<;7TzaVK>6G$&;a~W8`FFlt)b{g~<j1KRllC}ryFC&3%746%^E9vF
z`rx^Llq<dFbX0uF=X};CIWMJMUEc41a`VfLi)F$TOAL3hm1;9CV+?eNHS1a3#JZ`l
zb;pKXiwq))Meo))zv&ja=B&*2JaU=sR2$j4<81-QswNkd9$C3)^M!z!>^qM)AE`?`
zU!C;Ff6mA6=jXlM_3+V@7faK(xo@rb)P9w>!|K)Vr<<bmZ{_Xzn#wA2uiz|~Q{X?>
zcaf3-KEAnA+ur_+`twC=orp@x(q$<cUaI#Wt++Wo;SbxI1>f$LUEg=#Bu04iCR>ej
z;?A?zF00XACvahVp~LMNkq<Z3E<BPtKRMxQ+1H*^Wh<LY^_jQrp6&ZD=j<GjsCnL3
z+aG0>NVW!xWQkU?dA|A)t1w}~c9s3FlD}2{SsAJ}_iE9_POox_HQVx&7FdVnIpnPC
z{gR+0=*X|vSmtz{hruGnBP_ei(!{gBQf)%?K4Ilu;um`s2v@!HHMG4{ef(mOTkoyz
z_$fbn7F4`6RPK8-tv|r#)D#7|4`z9X-)~y{{C~)H#-1s%L3bYfD@av8e?on4u<N_v
zV3h#<<7a+at49}Z({c}cGUIhw!H2yv;x(7^ZYLz)t0<ewD;~`D@`exZ-KuF<k2fW6
zyf2`?_*QtJlknR;4i&+^KO+0omsT#_qB1+C@r=4n;_g`sbIoUWGJAjIJ*e`3<7Q8<
zV;?Q%c$x04+LpQHwr|1){{2hl_MM4RUp{T`gdWlM8SdxHoG)H%TYY|=a%ot>dPetM
zOt%k(oRe8KapUEMTJN5`C@G1ZF}HK!8<E`FDWB737TPxN{<Nw%_(su;J8Mr_A3iK>
zwSt#J^wqw*{hMXpur5sgwk`DYvb&j*i7%E(N3s|mpK0~r=;Fk!5rq~B=2er9-1zV!
z;8k7VDU<C}kLsGd^7Ag}d^YRyKkcYXRe3QjDhtog+*T*6@z^FcQF_0~mSfH-S&pVs
zYqD!E-&*D*IaxA#Q?JyP*|(%-vEI%Qc-I?tLe8xH+BOcgv?D4x_A5G~m||5GPX0Q|
z#<<~k>)d!{wU*q(Nh+!?H-fs)tjOK&Dd4!U`1q+A)ssJnM^4v!^x!)0&wwWHqy7p9
zZgh+1ewhD?Blw-{!H6SMeyQZ~-#)GxV)Os5+wXXlw0vb*`!9K0r(VpMT>4a0=Y6Rz
zi?^ePBJ)g1QSHNvcUC`~6I9feugW&}yJ}-(->w*~t&%b<*OS%-&3`s2>gDPh7O7wX
z$)mUP?)A*O&%N<e%~cK0liwu0T_)>Kb=o9hzvgLM#CKWAz#mIiq^+AK-(6T#IQz+B
z!4s9Ar*=)_)hMd0Jgw)qukHFhPktN6SNxtQg1DY#EpE}jsZ(v_K10WUx00mA-`LIh
zdEq?26Sn(jgh}*1Tb(;)ZhI`#_F0WCp#lr%?z+|gvF(rWM#aJ;k@?$tcz-h-S2)<!
zA!)d5#nR&VH8&<+ig{UbCe&`#v&o-?z9k%6*?vY^+EAZ|@%PtneAdn9ErR8Qro4|7
z=132fGMe{YD)fak^ZP)ytE@h%I#;;A>TU=~m95m7wXjsD!0JlY$}4tuadAoqX1jMT
zn!Ha#<GJ>{r*-#dobt-hFmkcJvogAy?O*V^hw-v<D;tw%_pd6{(fwUzTKQ@F753{B
zih7H9*%dOb2K_&^Xl}OlbIA?NGkMRKq#szKY!YA)zt8{uW6tMyS3b&7xZCroO3>zY
zi|3Ed$djF?`X`H@X`K{#Ewt}@#fnBnSJP_NHP2TUoqD;<;Fl>+hL0kDgZ{zfl09o0
zih7f|7c8!N%%?o3;}@sdWY%znq(7=xL|5OOd-vL@zxUNTChni8%FCer$#Ub}6t=d{
z;!oErcXBjaERSS9)XP*8y5HEZcUSrJe|<Z)tS(*hJz81W?4ZMg`;~F$XKgT;`*d;Y
zQrQBg?do^aFS)(+D_$-o#A3zn>z+2h_f=@XwmzQyCk0kWe`&IMx<=P&-kK<;(>H&o
zy!Ad`)1>Lg;kxzQZ0p3Y&*q;ib-8RjPhnB6QO&oiX*c^GEbaUC^wZZ(Ap&MA&(5Ep
zqr3I9-L9kkH}csdGq|pJhO-CktuDK&u=`xzr`6W6`<KZYCkX6`|9U0KG@>Csv##E^
zy>5$MzSzEdMPf|`Y~}S)_k^?k<L#1}rpPicl|AgDc-OJjva?O?@!xPM;akfe&SqC?
zj;fXU?eKSL!JfIl{WgD#w-+yppAqrTFGy{s!U>n3?`Ld3rs%hk#Ye6FOCM8ioU4A~
z{uNiuXL>%jEG>($dNN0I(Squ0H$G{tZP&;Ysy%U~<J4XM%DQerI|bF4`>W?Y6)#<}
zd)@}#&>0VIiKeN)W&C|7tmj<qiqP~D#tW+oUam7Yn4hM6xvoMpp=sW(Z435xKCh6A
z;d!t;cd`7ZTPI3#vr>g>j~=X(-g+c*<CPvGxinUdr|fGl7QZbEODz`PXI61}{aQ1|
zaEDJbofc;twTb$wBk|1m&dvbMP8E~McLR&v_ZsV!+6CkucUbVKH}Pb~+$@bOc^AF<
zGt)A&<ECzUds<DaW~%PXce~F{m{I*aYH#<dTYa~eMp&gz&Y#3pYr1XI+O=jkCOmeJ
zezcHR<G_qJcXk%MFMlu7y;qY%?enX;<DvBlt9*Hrp7XuB^FBlAeUtQ--uFH}t>ViX
zb)+X=T6EO2>PYw6OPaSoBre+5rRbLD_Jm*g=H)u4H#=plMXqqhbX)1HztFwv=Ec08
z{%eVIW?kDQoa3<4@Z*FZ*70s#tj`6+r6;a?pQs)D^4zsAzOoaSJd53UBvn0|Tj8vN
zke>Gvo0<#m{FUv>`JIKWtaDxL{q{~{X7%PfA-H+>&I!BooR=Fuyu8xnasB-$W53yM
z7UfCIXXnk$^7+4fSN_|)#}=3Vy^A+wwC53MUhvf0>>+2l^Xy5BdvjiT6z$n<!f(RD
z_Qd4@PaKa!SK5z%-`?&jDgT<wFk#c&qZ?g?jB8iFTeoiA>EO5}&q`gUZZ6)C_B_$z
zboIFt7e#J0AF02(O6%DX_SBBmlV)D|R=?imMBI6ci(f<3H`hDqU)_J<>^*_@OS^Zs
zi7QW>Z*!G%t%zSni}i~CzjxNnE^%uzz91Ixd23tcxjRpVEj%iBek`+I-XDH5l)1An
zyLWXnkJP!`u6K_(w`+5y9x|9`rKElEdE!QcX^Kmjlg=DD{O;N=^NlZitn~J%#fRz&
zh~<5f>X$v%@vUa-QiXY*p<jYa_Rb70zqLTAamG4PNr87qKIp8f5I6Mmyy0B#BdghT
zgoP!!D_{R>#TkW<S()E6^rk&cy18Ge`K{>Ac?+zRRv0TeD)~NXoG$a4r<uJpwsvdO
z`;z>3rfl;fntsX(h6;YMTfXPT2EoZ!zh79pEbis1jGt9^1pa7LN$-?hR#$f2x$7e1
ziIo;J9{7JbQYhv!Cri6wy_k(`N|0amO1^T3pjY{GD&DPK(aKa-%DOr`oBwUXj&(;q
z>CVc$xlht4bb>)Z$??^Cj`Oac-FE#=<hy51{ObSuR;>D=tG0fB?zNk~fyqJNbZ<L+
z?d20qtoQ2r<@9Y);SrCs#Xo}c)?K@OEk9<1CfACl8-ihz%5>KL&^@JP&iYwM>O9A9
zBb|)etqN)`0@bzi-|rCrv@qke@S2An$9Ftb7IBR&^<QxEMGN!Y3Ypw<mObCK3qNF>
z3{%;C+qcEBz;Z?z`{d0_4<yG_ZkQ68cPwYOP<~#K@z<=wck+I87$0#q`L^pE!(PU^
z^Vdx^cdin;vNe}^Vw~`o-*aQczPeg|()!cJ^2)NM<*BZ2*w!%q8}}Q2Sze1bHn7>{
z_dz?awSUKld9zGQ#AH52$9Qe$;Ge4zXSDOm$AvK_DY+(Xm;dPJ{QK+8cb&iPuJV29
zV&-!e{ogMv=?r2zlGQZ%)ujxZowLgBFKRB8-+%VK(uIZBqOU)HdvNtjgWtAWR#dUh
zExy`n_J~!8vq<zw#hv4eI!<obyQDBZWLmpqWy{lwk{kAlg=Z3#gnh2u68_&36z!8M
z6&dXHB05$#!FQ(ggXNL`{yWS4W#F8!hM)WBsvVLuX3HckUwL9;@N<SmIq4rC7n>c*
zwz$(0t?IFLahYlEwL(eVrSmV%{}v?MReXl6dt%GHkdv{ztIe`!6zlb@o_Q;7b0nvY
zs~p!wsa<B<VsEd%%E|oX>Ut~gnEXc@vYRe^>04kZeQfs%>(<>@J$F{Ld3p96Qu9(*
z3H1AJIahJDqqWYns({?ERZ|vobxd`ieza)e<+^36%ceXEnL0_+>&|20oHE(xs%Hd`
zO?X?;Uj1v~i~|=R-hKFGZrGj2V%s;qzO7&FF5La=^Ap>XfoC>wi(4N$f8jykwpUI@
zEd?1*f?Dz)DfV_~J=mE4WBs|+m0NeQ8cb?(+8L;)qu>2{RiyKjZCasSUQ>L&UwvV0
zv3Kk7eO7bdDhB0B-fMfWxsZW({laGHgXO35cgG6GE<Dkz?x@c=ZIYe0MTd%Aqs7$!
z2Ogcb&U^Ghw)bjV=~5Rx+1(-n>@LR{4DL-;w>-nd@!7iFNNkE-AE&Sj-=XEnw_Q9Z
z?>_LUid!;KZ}(1}Y-XMNi$$jV>sisdw5)Nx^2ZuU>nRPpcX%9IRd!e9>1^TqB?*Sd
z6S60F%((JsSL`;vwu!zCdF>0kB3+C(82TKknd5gOB{1;9jHQPb7hGV@;>`E__}jqv
zp^ST3|I<fvE*gHDyQNzyU;|fyy{7$|X<gy{tE-ysgr)Jw9MTnWKGdMR!kp=OuGdes
z$?5jXxBG>}K1v8|X=LS|xT!$mm0P!1sc!AXImx#fTVDh&dTHRr`Egc?_r*2q^U8ji
z$i!WGX#Ilgv%&`{#wm7>{!Dsmn^t?K=+hd$sJHh+_ebC3Pg;}D?AG#cj`q!`dwFJO
zU9J6YU^{oAZ`DQL!s)lV6UDAbww`Xvo8c0-Z=cc%W4q=&U8d-cYd>dPas7Mw=*<M_
zUXSguGnEu|o(RvLC>v~ih>@8~>dx`jyE{L5t)4m6&Q5ItSKDNs#a&0AW?1yP_=GN+
zQX-vm{O#JP=<v>n6$){xF^hJytbN09k!QXOOLttPUOU&dy9@mvJmI>y@5eVA!<2~|
zw{KizQuVKI`5n)$cFUbBjLbz!gO@vJPg|MsBK_N>)7QVhsa)qRxv?qMQdVQr)090q
zQj-f-bH|((QK~8tHE!CivGhou&&8#)ctp(aaEG7a_nPE)RXf}I@zk;zk&b+3=W>3&
z;n_T2J1X2X?0S9ci;`E{8u!1jJI2%5sTr|y@rSfX9k<IuO<BJx=N<30VT<SEJyNG9
zU(rx`W$UL|YObEOOP42Kn*TrV8k=C3Lw7(k2ZR5Dl#+!1QMD&{7JmJq8!poxAsFF)
zrSJHe&)W;8Kir)E#j~b@Hz7qbFXLE9cY)e%&9DWZ1=}CbGyB+;>124v>WRNhwM~b(
z?Yy-D`?xmjUm?~~bgA<7#n_;-=1e~QRkQE-uDrKYI(Ex9&&6I_yO%Ai$-5<Hz!acw
zVG*WqE&Gj+z$;PBjJrmrDQSW~6`yFldF6F?VQ8v%)6)k13vVtoWj?eG5Y)SAbM!-K
zQjwp<F6mvNalzX^1^S6PxW0=C`2Qg2_8NV?i&0M6x=}wj?a?ySZ@-$b`wL6zHpTwP
z6oVB>b-{PGU5ql6?cVm7MP28}#*c|?<(V%O=Uuise|n4O+NBAcjqZ8{Y%3P8Qk02G
zzu&s;<(*?My>q0)IxT}|&uDu;J9OnrmV}ZH&gCipx9wQ4Gtk|=d53k2TKmVUi?e*J
z5>|EvsV1s^Vr}`XwtC*<cT0D6Nb`#JpZs>xi(!om@1mW%nzCk2yK&b-Jm^iH_D}6u
z%h~KsoV(e&UnaO;^+>O@tkkK4Jz^4*-#p^oRd(`5?t)P6Z+m`Dhz&n0^Yr6=TL-gv
z9mW5B^;Tyl9cQk&$8|?+&&T^ozdG5R%nsHwh%HH#FK6AMC9L$a(lXyc?rCt#^^~Z~
z885OEOSm(B)x;%bW%?Z6JI9Yh>VuJmUr+PjSIaKO`mGU=nvum2A$lz)R`cTawdYPw
zIK`OCm%&@?-6X$7d7k)o-rH9bmaEKWX7KoO>sa%ZXD)6RWqVV1_+Q~Z>nnR@{*65!
zD*cvg@YG-2<9^jtjP1=a(a&19W;oui37PL4q|C8ix#MYy_f*Y`PI;k^A1TbxdGm3p
zZKlX^snmR_12XM>j7y#*R;ery6us-cUL;iU#qNtfW;3;y<!-&d{qKo)mOaLi|BU2S
z`d)d=H@aaFnJ{zm{NS&zN=<by2Wnra?`d6_n3Hkm=&W0P8f_AmHFFPqZ1>MRr1g98
z#f%pl-W`4u5?*!9QL(Mg>E2S~Uf+b4x_8H&VqZG^Jh-Xl9K*~t7AcQgZpa8fY3-3O
zNYN7&eI(0iuOZp{dHY<684?{Yq$8f|aoQi58*g~2n)_d87(4srn3l%bv*%Rn>@4Ri
z)Z}5FAuPo(_m~vZt!v%64IzJoo^>{VU+8y5bw$85=|<zd4)^aaG}d4Ce0RdSf>j?4
zcV~p$aQ*V+O6&ZR<{1f_zV-f4J?VJj#Oab3Yi4=sZL*yA-9Jy)fB*k#E$?a8<?_m}
z4}C1*@_c{)K~%?+xC3ol?B<&)1xaqyao_y4rj9jE<nNw(E4^>^cK80z-+cLF`tSNj
z_v`B|e)Ruf4w>+ZO<;rlmq#yy4kT{pT*+5-c!A1#{mi2^3;A-k=1;%MaxO2x+WE^)
zZr1zOZ(dGtxh;HOK6XOFwEI8%3XE<x{p+epS~JyAy;VWRyMyOK>Amipok_PXZ!HS=
z`$|P)!fsQOmwAi7ikV7CwC1*aKC3BUc6LEv-hsU<^Ip{!J>2X*Z~o2Wuk*gG+;x9(
zSm)k=Uq-<-2eevBH4eGYnJTOK=efeQkTmnpX3rHunQyaCC~ue_{UYL}gwvW&fyPq`
z`u3W9yTbg}PWNv6vIAk<b;WNB=C8=fVxD3XefC3;#rn>E3C&Y05<co&d?>^-bIWn*
zt+V!)Ze-=`I}-M9$>x~qtot^`$9E)7solu1wo2lh;nAeSk@8&X3tqo%R1lVz5A5vU
zyg9^AC1RTR=VyCn^!tXq5_4;E+4#QyzTJQ8XDnyqWa|IF<v)J^ko?5tQ~J`jYaELC
zSLZAaRao~Wy#2cNE#u>A!Sm{C92aD6vERD&{-rOs%x?wzK9PFAjzK<mL1oFT6K9_s
z^O?J!@$B8Q|K|nb%71UXay|X+x+(orZ_oPT`0)O$H;L^`yRyHYKCbd>{k~_9dH=^R
z`saLYuYUQACCN^v2P6vOmlUrqn{wr{+J3pY5_69p^L-M!{d0-cyh;3X&bZu{H$3R|
zMJ`@+vUh2w$fPCn^xU21i?0aW9=ZSO{nw9_KIpM6_pZ1a<7Dt->cUNauFbPQWz{kJ
z?b`fAMWeFB=~QizZcE0*jqgJ06Mpg3r|q@=A?nOC*U|T;_|-|GD(@>J&m6n8;epwy
z)7N)PeE4zfO?+RUL$L0V+3NeEbu-<L9b4nBy5*9<=VZPM=^eda{1S^Zi@X;;4pvfq
zvCUY+JvC{P;(YFkX-AiT5_#42T5jXwoO5g4R<})cexke8w{I)2*!R8z+MYGMAGq&Z
ziX5J)xZEP$spjt+Wj`g)l?yLxpJtQ4KP7c{UiB7-Gr<d19<I*4wdj$|lbSEvS7%kt
zw3zzL?U_gChDm#K{<|Nw>8=X(6<}R6C;a&gw#vHGXBar`QhfzAmx!k_2YOnu^iH;I
zd>Q9F;qCtpy|P7fx9MyyDlrs_k6jnm{q4hp2aBR&*PTzCC>ODX@z>XeP1$laAAjzz
z-P*o?a&G?C|LywoYd&6`UjOSAKmVE!_xJs|Glj*<Nc_cfc6+-<<JS+4pMQB={L5qS
zUyc?TKllA*W!GBQIEPo}^{x8O?{EH2pMSYu|Ao7^ecdsw_@Lr1rw*PD3sDVXdYtl0
zXZHM;@6?k-w`?q6J7_UMIeBKFz}7y-n775MI}RIKr#a8OqLpp1NNKP2)eE)xTTb>?
zMHegoy8O{#MnS(6>zCiFe$8}>&eYg{Pom-V>aPrLJ%0*|9or_v*9sLdi1)w#y~QRz
z{!doy{nLK4tk^}*W-*;JcyX0u+u=8N|E<wwc=6zQk-QDly3<d0Ke@E~^xNAzc;Ci<
zm&|pVxq6#^oPE)K`%}s3xBIjs0{OP>TUUJZUsd)2&y&0FuUnSoAjtKE{nf=pow{F%
z&Zb84FFKYda6c({8=v;%8%J%+B#uWe4{K}#?foxuZ0+XGEU>cwVYMMNZ|Ul9OmEq$
zByRful;tUCDVOW%JK%8c_xvLJ{Gw3noeN4O3gldyPlQWo_f*A|F1sV8u5a>3|EiI5
z=`a7U+9oeIZDff#Jn3s={c)YoZpXz=PJ2}CcJreQYyA$Uv-#~SPhFXEc<IT{?mt$V
z{oHo(x`+O;+P=b>OI8_cx7AoJ3l?a;VIFYk`JZ|3B%Umrzrs6kr%pq=C_}kH(R<#9
zqTXkhPY|AV_I&EvrFDvR+mh>8?y$_`e5+*NwSu>1XQ=)+MRS+?M_4W$f3YCxw&uRA
zX0O-T|9d7BX1Y&#wq5<B?KVf_b}x0PuP@)vys?>U7yH~<Ki}>AH8o=1i}Q-J7uvt#
zIr(dG%=wM)OAGcf+2(PVeP6P+W9DB2U$bffU(xSgIZ1DO*t}VUriW>Bgr1pky|A*R
zW$T(|QN<ILD~^`!zWZKx*_G6QGuAa_7d2;W?dW1M+k05N!1C?k>4)Eh#A@3gWoNr7
zm-g!Bo`B@_r5srcz6kGPWSF6P@&Ah{b1Y9VGAZsqx5&zFyU7l%n(trU#>dZFkj4M6
z=JS`UA74M-t{?9%_(o9ie(>*3E%^m6e=iK{m+*~v*Bx_Mx!Kq6o%F{AljqO$ZG3+@
zehYV!28+@C@U30Hy&g<nB5NjCs<vYCO3yVKUuVP~<!@75DC>1jO_{rucP@|2nk&1l
zcX)htnP1(0bFNmcJmbqrH_vJ9ef7d-eg5yMp*Igc7CfB5<20SkCv%&vlk6J437MYj
z-8v8O@JVkw)b;tU=c#>BSw9$B7C*^w4fx_C*Ib-x{IpRjM)r@9xS(6^%4;@0&MGGp
zWqvCqPGa0|$usM#kHO(LUbYwFZ6q^}HO}*1yIVh3mcRems~fJbSOrzNzRy0fPSHK?
zyu3kp@-N$I4Kml5c}*^!uXkGVmf5`HoW8HBwRh#jwi`k>5;PcYMG1Yed9kF1L&8?-
zX;i?$d+x=_<=0s<ui8v`-S@AAC8c`i&w@X@cJ!T;3o>7<Z8>R6n5|@59!r@K^NwGM
zN9R4AWgwGOwt1`7rr*pAlLZwM#oj&6RutJHQ^7U+;?chW+^hOC8(Q7jMJ0J!G#xjv
zZe^MEREsx9EJ;2m@=><WhFu?X%jVyzX-|>d9CSS+q^j@dtoz@RXBAX!jE#@goOVro
zQu>y*BXi!Q=Eu+5b4Km-vfN1ac#D7~9emn8Vfzjym)zVkEtg&D3TLF~vYgE`8+?Q>
z)(1Z2P;Ot})4grQ@y}atnHlGQ_#oJL*5E<N!6P$5w`Z*Vzjn{t=g<FaOA23C*yq0L
zoB!&F(vp|zt4(gLbq~AMFYdfZ>FnHp$C=o+t#tSz_CY_(RX6^#OTe;yH?xCF*QqFp
zhTmr2x5qS4uVDL*#j9IF@22|Bt!@5fcIaP5){)qoC++3_JW`zIT9~xyU_eUDqQVbq
z(TObb;k|~lTK&#+-8}!vrm5-bLiy&}aP$A`EzZod`}wDT%Y^Tn@&!_lu@r=CofM(5
zWR9YpMcnC>*zb>wziDU%wqHMMDB8&TAn<P3<gFKuEzMl~o^O@D>+W4sZ^h2~V_V15
z;K7o!zHcw{*ZWhe_Pgx=&3x$p)0Nj)_c)k+o!|Fh)+8q`Mc)J&wVGsqW*et_KQ_4u
z-z;fS^p{CK9@nH6bE!M|*5rkXtKM2E8_o#{idbSFo9rPt<D^AgzP`{lBMHfKn-o9z
zs3*&(wS+01vzq(-!&SB&wfc*8t)9So)xX2QnDfD;De-$$b`(vKk>b!dR<lnHZ2K2*
zqU!P)=XbhY4~-Z#Kl<*ps!jc{J6upL&xY4##x#~^k{LHnY?|*AH0Kq6Lt3Cp`RnJ7
z2QsCkZt*Kg#4p;WnHtNsa{GU;Y5Bfd99%Z?H~y)8y3v})n5CC4^~7#LM#&nTddn9x
z8B6!RQ@^-5(dWiLhg*tCj>fl5&Yw5nIP_Iwh2oyM(<@jWr=MTZ$2n=z;!j*3+#e>l
znVw$rGBeNP^A??Sf#f?CTTgzl^ZKx6h6;;w(F?Pu*_l&03}er)Tvps%u+(CL{)Hvq
zxp;KALLSMyD*6$X5S}d*zIgW%nR7-3-}Xp97Ri(_JTI`uZSHfk!^!PB@24C%!nn!t
zq4B?{i7!hn_3a)!G_yM9vOWI)hd)P8{&@29wPBiX&EGFKFJJfH|Nq%b>CMd3mU(0|
z@4Ly!#%8eS#;&r-E=PK%E?re}a_^hlsfBfX?B+|E@~>$dO!@hMv%tmVeQi!iZQ3Ed
zU12#QW}mZcXLlaHxaW<iZGh87#;KXh-}8Tw^yF%)G}U~)O=h*SuVJ#^9lMuOo5C!O
zFSYG<nXutiW197&Ri$}*4u5bdTxI#;s;pmD<(_p1luEsGXGtt??Y(?ivg^Y!{tb3p
zUPy>%g>AOp9QA&)bq-5%&Ka5PhQ@tTj~v{McAMAFcXBt$n33`QWWE8<vkFrtfl~=N
zZ&!SuzFm34_VcrovRtNy=qXJL{&B{nDwsX!&C^LK%mG0c51AC0a;(#EIB=)w=gmYj
zsouJ;aghRZc~v)7yWOh$c3j=xE-ZelpVh4mZijw_d2bS^zA<m^Nj-OM579qQk4@Zv
zP+z0+k{Nfyz2zdtZ}mMBvsV1IUTN4UAiutRKkM8%aT$D<UVn|#5KLRCctUVt;<;0=
zx3A%DX8tVcslViWOET}rq!sU(COr@cIUT<3`|&RKyD7C@pY19?Cnab-XZyXzR$A)k
ziOWg_($lKtl&)t#o*|W?$CA@F^XLtA1968HjD;eq8ZMWFO&=99?e*o04LYO6|Mi}t
zsDOvn*Q`owHT5HQ!HNM#JFSKHANt1XFYkUn;L-B<wO9P6UrMN)@sh9E@}-%;?%g}K
z?=TbHxAJSpj&~Cb){0z}e<5^++0dgZddck>9}|pEoS1xftAKb$ZPX1lr{{N!XP4$?
z*hIfbin~#5r?+=46G!ptL!J)O3&I!=^14|c+H|Bj{^4d}4&SCGxw*;{=AG%+S(dKk
z82`-ldhdc8dFRA$>}63B{kGTn73;0ZFTJlky8Q004AV)?o@;Mc?ObGZ{&nWhM2X4`
zxvBn~Ra@rlQ<>lvJKbu=b>RrHV7u@|3VG5R8<k6z><+wgXz5<1n0IB}GgFh7MZGYX
z{JSD{@!6?PQ?B?i>#D4rH$l_rN}lGok~rVxsb^0n+_F1%Tv@*B)%lC7op)(J61si;
zh1uhc>+Ss_CRUqlkBFb0*g7@rX<O+d!$TWxT<+Uq^XM}3x$gG(dr}`{4;@NeK2i1A
za*3~O(LMUtkJ%^x<}PHBv%4gt-JUOSwByP?i3N>)vu^iZSG;(b-T%hhHP7n5efoO+
zyuaVPI{UinKfi7-&p&=&zW)1{vtftloh(fMDVwO6@NQCs`gZBZZ3}07?Opim#vZfW
z*P*r{>6d@n^OYVk-*@@p9JUSby5xIKTv+9+a+^8AVAmhJ#G^r}zm8mKU+}FhYF!{#
za1hV$$NO&If3D>I>dRmEkLPxuoaOiSf}*8nxRvi0OXu6}ujCn@M{W>&zwxclfmF%Q
z`_BgY?b+FK;hU?W=H6-g-C|d_Jl+=b#g^5&=0f(uJumz;UOj0z;??vf!fA2a2fK|^
zSZe+W9n&!X!y$2juUdTK8u#d>?e_{<AEvHSyXolhmcgtmvSiae+49%>)B|p3P3jSP
zwpPtpZug!)5-K6N+~+2Ta-48yaXeD_Bq>yerTeJC#L%g^5p}J3+he9^hQH{N5B&Dl
zR)S|I%cBLnn>cn#rM^|I5Yy89U&ATq&{Z`3Xz9y_@^=$MdwVqARuyq-C6zXqWQ9(#
zU9)`osl(!~{?Aep{&Od29=oF(TDYXixc{Z}N3JQ$%YW@E<liS2Y?ZN3rpm5lLsFl(
zX_tD_%4?g~hTjxuK7B^%!0G6NzrzmKUbt59xz@T#k*6SIiGgpu+p|ZC$9DC*KQfCe
zGM>HR^f~>Ru4@CQXx!NCTy*-Pr^dOPYkmdHaw&*7mvwTx<GT~{d-mOUU@?uW`-R#Z
zf%(bz6piL=KiZ@`*YIME?UNj@A0aNbyL|ZPuZm+XdU9h&agU;F_?f#bQhDLQTmKyw
zb%=K?yzhD~a`N&m3Fj-GcE^4TQrg%QynoIa(S@B&XA8EciYbO|IN|o1)nM{JP5tAW
z9aGv}Wz8%+A06E_Yum(Wi{5i`H5BHq-6ws}K7Q5i9j`d8oL!mzGL}{N)SPPhUjLI_
z_+I|O6L-bSTRElE0{_nX_T;kNBmIs<t^=Rehi=v{S$*hHFOS%-#dlp+OxJ0Md|o}f
zrb$07B4B&+>%-EgonIYpTDI@(p*!pihG%O(U#vg4eaUhQ_AR~~p_<R0aWqd3@GSVL
z^?LPw2bS2GERNy4GMD$oPA=Gcmb2v&f7Y*?9~=EW0^}#&cjlgX&Fe{Q)_1LGrYmbM
zgq5Z=no2+35!LCvCNx~CzC@)a{#n8IB^tA|53ziErLz0=t7Wq|zE9kG>+9*OyN;Dy
zT~IyC+`J~|#mDd`UYCDe+mfDY8Sbom@u$;AFN?+E0s$Vs=N{qPuuXHB&C$6YT#Ih4
zX5U)nk?LBzePZfLw{tuGEID>Hj4APRi)ccaW<t@{$4iCMYPOqRefa$U*SnVw^T_!f
z$QAtayC<6K7Zan&j+<3a`kdHBH7tIzNU)_WRShyX7rQFf`DekxhTmU)PmDTgl{TrI
z=hr>0bqAeQ!(*&k*Uw#YYfElP)Y}FQ|JP+_B@6yDD#`0;&)ssxEqp<U!)u3Xy}L!v
z?o`cRC%n5~uf(KRWD`%)mKAE}?D+40Xa7FyPSaVtg>wq$Tw^X*eYeOVLucLWQ|Hfg
z=Cn8Kum7^`=SCL$e^>41ZwQh7b|WPHszY4s=})V6wsDodKcT>(m>1Q$YJNbI{}ERA
zT#Y?1ud?0x@w_H^o1ddI3y;7hws{{WG_12PNcXuglk<sM&?nKn+TF+7iuOzT?*4Hu
zqrvc8>V&LtjYsE$-bbVseYh6)t#?{}#-i89oS$!hvL^k2xJKVJey;WF_D_B4lpOFX
z>Y^sEa{a1bd(Q{Bs^@kte)I0{!tIL5`mf%0Dl{&cdeL94BaSgCzFL3tp9R14i^6sb
zC*R_lH0Q&wKdr1>yOm9==HC<FH(iq>MC8;RaldVGD{C}(p1SYT-*!Uz(yBxYF@^O?
zygaj$(>~oky7n=L@RzS1#!>OwLQCd$a_Hr|3zz17^L3b~yz7bDih|}PEz2FZBuCtJ
ze>o$^@{(crlUp|oE$qz8P7CKdH?B7}S?I0#-}&!8x0Ler*)O7NX56j3e}A^M{;|?m
z3+8`3;~;U-FH+3>n2f|%t_#oV)tio0em=wdV@vX@uT}R0HfNlFTD{A*?PH5W@@;#=
zxze-mwIoVBwXlhN;Be6R%A8`WrC(%19bbv}&B}b~;XLo<)7>il^<oUmFJG(pyvW1-
z+!kG_Q0ChvmpCW0t(Z7N@kq}>Z3U4G<p8s?qR0gO#ZQ;k&gkmt4bN(M^sZ2_<?OEh
z%EKl(t0!mjPJdb>SbCfH!0a-^pE)M4+=65nYpvg$KAP6NKxMYw8|9s*0X0|p8yOrV
z-`=?XJ!5OAl)&<1js+`D*73Uf=)Cn_d*(uyz)th8nj)NQ`|__!%$R(mWrg3i6;c|r
zLrtynSDY>BlY4IV;KI!|sgnOs&T^l*f4M7n&D-k*p*7#rSNyxrdFz3|><aTIw-+ql
zuEP3y&ko(`5B~KFO3tZsj`MN(lYBAl{ks)atA6~udm>fDm^b<0OqtC3>OXAzngSil
zxj%UXoDq|G`X<kXZIS-5^YQ(UZeKa@ruSCS(Kq6K71nnxy*k2Dqwe*b?YZ>(<BZDC
z&r4>W_x`r^$u2`y+p3z1#@p*!SkK*ZTl?(yS^WymtV-1~gMuT^b@tD`f7$npvF(e(
zIp<1$Y`@*bmeKqy$J2h@oYi5bFMeIJi#Rv)f1t}A3;WMc?N+an{`ApwrgkFF>u~)!
zzqs}qFD%-0Kd-?2&sw(U91gLMi{qv^m&pBD-52E5ICt?BeXGS&`2Q_+{~62tkzqEw
z=lj;=CGY>cw*Q!abW?W9tBo=feg*eD-u_~H+0@>Tla7e_thxC^g?rbMT|$eey_<G^
z$)f9v5>qN&^vj&RzioDTq_ofd&!x4uh5OG=a^rn06B2#s=`0;~j=V|DMWr^3y}V7k
zo;`_XFuJpERnAQouAk<wLXNI*yLyi$^yHP6i=B=C4AmW3uNv!GoNHi}c(2tMmNTm|
zc0q=tEK6V2=GljW<98+h?W_C!Y!l;LdA5Tb*4GVRaBW`wm8<la)Pu<%cB@(47I&0S
z_%LbL%?ockU*`BKw!Qnc-CuVaOYP%Jk`qm3`uASgA@O4g-y*e$zQXAjq`H}S`{I`0
z%vf-@>|oxZ=_);HQcWknoK&8a`rD)YeZX(l@XO^71di9onSK5=*YA2os8NHKjr5`D
z%c+|qBtqA|QknFBnbK-b&2_80rA+*#KfeERyj1P&f_>{X{&EB>__%u%@0F7Ce;dxK
zxi)%o&sW*(`umdF4W3f3FZVsFUO0I}zt46#k4t;sM3=7L#S&`yCTfQBJINf?jqCG1
ztLE1Vi&yMCBC^zI^;<cuva8=_3O#DPHTU_{U1uE+U5(!QQ2F+|ExgOL%qDb{@BBD*
zYTm|`UkxmNyL_3{JoWji&1zq5cI{L)R%Bv0TWxbg?ry@V?j)v}CETUQbL>6K&!)^#
zyl>Kx(V;TUPv24R_=4&+Ve7wJ?%&dS!_(3$XD6TK(%98`X4fTDHyU-iAH3G_kn6yX
zt4HJK@=bkpaqZWa8c}C;c5H8-5&LYe()rd||1BlbW=Vc6J$_U&`P?CY9UiTZ&VpC+
zvW^y>obCOg@b8g>H`=Y`;!hrT^)7gL>(ASLlJ~?o1zYkir_cT+t^33>J@5i+e@@S|
z1HSW$51HpDuyD0kb2)nNPP(J&I%mccA<@F5O%sF)-`QGNcN94^+}#%_l)c|#>t8<2
zk8$xO7cXZ`y!G?zuC^}@{s%wuX+<%8Q2DiJ;qpfJqf;K83NNbOvhvo8vlpj_@rcDb
zt)BQcz5J(r*K4Ky{jV6ehZQXdVejJe&@?E^z1W!RujlRG=@?NF_5R@`g?*-9UiG~8
zy1*f*KBrjnZ@A)|4Y&SpYvDfG=6C3s*Na;gi9Hd!Q&gqy$X(L6V3_&gCNnqd0mr88
z*0!nj5+a>P_hq}^G&WUy+Rh}KH08|c2S<0V=vm4;<=crmO9jIvhmFiWRis?edcDh2
z!g|euvmBPJhv%jK4|#oP?yTy>dAZXkr}!+)&dxAQV7;fhI^EFRN=1Lt(Pw(xa-8A&
zWRouh1sV%}P^)R*bLYWyf8%hguGPO91(ePmn;uf}WuD?(X{N0;?H}{?e_QY7o$P<g
zcV!A|!BwX1zrQxgy5&nnR7%W~sG9K0?SB@_O~;KwBHRD4`A0iz)GB=Y9C=x0j`-<|
zL358C*7?>}m37a8+d{ya)xq#B(?o|`P5k_B&FeRO)au>KB)H&asm+76g*gcq!);#7
z47spqrJ&e$F+PR!`T;xbrH^QTPd=A6J2%YFd9&c5v?W^pM}NNjWc<lep~>w8yL^G@
z%y8i&#!t-MC1zZjw07bBBc~ZPX6fB(Tr0$@yuiXyz~T4FNgrl5&gGgt;hb)o;X$b_
zf``f#mTum2&EZbk{V(|jJKmRiAH6W0!)2MGnsD3SJn4<+-~LthV9#3`tothH)65f!
zldNvH9zF1K#>3D1+M9JJ9KU?NLuIb`>#Q{v(_f{f@A3_N)b_~LGWB9x(TB<(f1a1A
z++>xx@nF@B$9msi?7LF@>+<HZy^1W49UdGOdQ=*gy~i(+>y+4(%9mR&Y~)L7>E^d`
z)h$g}y?)tQ-`UHTsW?5bD73!Suww~ZLw-<igMD79-0Qs+EB`RuTlDzl+9U_BBL~(k
zs86mrqxfS<@yTOi#uLh?UERV`ewy{onKQYru}SIu`?F8`*IhEmP~B0I)WmSc?a5Z_
zwNWh74qa~e#Z~@MYX6;YPP+E88+L#26#A*rvha|xO6Y=OuCF%vGj_SG2*0=ZlkHmd
z*OrQ9JhB$2tMcYoNxIt3aQQZ+LUEF~<%_hG57J^O-|uw<T>pCE?Sk;~vx`p4nMid1
zcAqr&b%uueoxA<p1*Lu}a!rl8B(<n3^{~{Jzu9fED}UNdsSl1jGBc?ECI9<*^4`)9
z&&urH8Bmy=_j*tG&VRbUETpYh{fkIgy_2i&>XHW~t8X=JX)Smu7^U?-_4!@S7k{S|
zbf@<G@i_jm_|*qahWoAmc8W2{bRXOH%<SdahnuI@{$0HK>eY$-uGz+H8V}j^Sa;~&
z+-om-YRB=q(9NINHm!D8VfbRRX_s0<ke1+5wIgLaYQJ6BT(POE-ROOwih84;kW7?~
zN$`;+OhzKRriC{5R>)tvxW?I|?19avISZx>hP3@Uu2paLAmM?Wr;d+q!?Qn(U(P!S
zZ#raHqNup2Zj-Q&`#$A>_JtEW{#<=me$_yTXOF9%EAO2fH)nkCQ|+9R%=2sc)yRlT
zHwAvJir)EN)l95H_vEEKpWQu&7r#BvbKGx7VcMe-^RUjPd`lnvvd|Sj_rmRpQ}wB(
zs=`aIh&ZQcG`6hK;u4n)PkO|C#s1KIvt=%28$+ER-*5|c%V_J|%yYs!<m&4n=YNey
zFSssysLRl96uI-6`BB~Wy%ozIO7K)OiL~v`D3syMH5GcyH{UNkP537F#3>Rb%(0ul
z+kKk5H+!wPv3o+%29wzWKbN)sJmmAkn<eGOLEeq66{iZmUZ|13CH*^o_D>NNr%lDV
z(^+1WyKgf3n8N;n(O2@_GU@xl7K{fOkI400X3aLwc%;X%t|X@X_x$IbTX@$t7@oD9
z&-qn%+DgTVAC~6b(>NF9AMYUKwxD2V%~}q-{nzqm@bGWid3SH=isZSLa(7PdY0H_Z
zz?ylc;CN)q3zh08`|Qu?73y4l^NmCCs*uT^f=rLfT)!7qOv_X!e{B1`pE>oqX=$R4
zgC4J;zMPlO+jWmiME?Hmt(w03*33>VTW+(*zA1WFQj_@7^6RZ)E}q(x$05mk>B04u
z5ASaKKUro_v2S_IIj(xuylZdrpX%N^#blOOb$6xy#NOVsuU@`B#3Y%iZO3(ef~oX>
zo*M=4`>gpp1%tDLK5~~wm#f7I=D**iZC#!`#dhJ8k2hy>=9o_w;&h0=F4x>-VmW{5
z=hN)(^QCr1KUmCXcdAQCGQCOETK9Q>^t#)+dNRMJo!0KUc{J(943kEUDq+T79|hVU
z&yp>WjW>OHv;ETUkNe&4+kCq#ZFFu`{%k>+=6gN6`j%W#{uRDQC$RF`ggJ*z8)ZG*
z6c<Gvx!w1nvw&s6)$egXU!OM5SAHFxYjZ7H*EMSGkw<0me)BICMZadUUi(J(+|3u~
zrcJcna)R~uKb1?t?P9N9RUM4}v)X>y$_4SO9h{T;!v1*wEq=DN>hSiX5B@GpvMhY(
zD0)yledPk#&5Jb8AI#3^c_Po~#(4dS;<Mci^&hJq&#A7yS%0YOu+Opec~|+EzZkyx
zE?~l(@%VIw%&JKTFZ@Z=VpDXkn#!sla9Zz`iOPeHtdk#33YOlfUa&9F->&$z=H#yr
z66SaGWwNwucW@_t3GkWlkZ;fXuOhSl7Js|>?UR}4Mu!EZm5wzkDhKDU{1^KwY-!Hb
zVy>0?S*wocFKiK;_a<n!*22gO`{ivpEB!ZIJJk7($Kl_Tdd2{6W)=|!1_llW;gw$_
zmL8FCOH^TC$lb-jpu@nxkegbZpO;jcnUkWQnOBlpR8W*!l3Ik!&QHopO)e?cE2w;H
z`?vV^v5os*uitU%GULslj;U&y^VLp;OiT?wzj5irCrk20czGtebDDB&U|7+g^=1G5
zyTAW2aa@{o`CQ0lE0%)o5U_i@`Px&Go|9fKiVQLF^e~$}J=FQqB8}NwPM%tHPhh>*
z*VX&Zy_{PW5p!;Jkx%y5%9wNSpT2LqXSzMq>i&%xNzR|Q>^!&G`{pS_o4yl<TYC1p
z%(R#`KYfcHx5m4D`p;zypMQO-bXr}mXV0FXhV-W?6E8>ARUeo0*C^Th!}6?niAtPo
z?7!wd>7ONBEe-zc<-EFC88h}zHPFBOQ9a7%NxkR?<0$jvp*N>IHkzKgdC|hFdlr3o
zpBfb$S+c=#*Z*&)7kO@O3QPZ9TovJSTClQuc3AkI=hiBhFU|?e3=UhIx*_7Fb8p8R
z?f>uZpQ>@vZrGV|>GYgmPp383`vyN*^8HJhO8x#t42e7@b9C0;b@;D#a?cv!7qPZN
z=jZ30UA`&bzq^Qk)!uWL+1T{7*SURowquRunng9*3-r3Ouf1H7)U!e4%@k&tiCh{p
z?_XH5?D3`<DwcZ}Rvt=ZjA$-lFHb%dA$I@Xl1ekiBVxu;CR?jE$NRl7IG}D=W+fSa
z`J?)arYAGLr#em)Z_vK~f6ku2t^dD&c~J2_<^7u%Eqg8Ney9C^@%Qy%^OLKaueZPF
zf3UR0eqnJ!XjG4}tz_KE^6zu5u2wo*e@bulmR;g=8^w1`U|}u(zsf6}t7lEsnft3}
zsxRB5(^k{QqqbB3{42HDPTt22_P7Qu58kyf<-}i^-Se(J;koB~GP34d{c-k_|L*gB
zyDzt|e)D0rp6$v9i~9`ijy#V1)j6wWs_Xar2icQ1oblSSqjBNfw61sWFMTvU<2<K4
zZRfN~-5>Sx?C;$x@(o+x{CxRHDC21T=DNE}rv6a<InP$)SM9@6{R{e=y?3cBPjy<V
zbNLb1^J}Yf?tD1(*k)~ZQNW#)&`5>l^Db4MT6Xt#Jlm=_1?kRbr$vd~P%LHkRby9I
zKhXK!?>@uhw;7eCbz<@xPfmFDJmABlrZ=zpn>)fnBUKORl~%bf7L;_DIq}i=hXu*W
z$xh2ztOAxkW_$L=UOZAY^+<zoTD!|1_nHIUb31|ppFeq~E!oGyaN+Q!*vwPMXPmzv
zn^ba6w)Tz2x5dITUvy)iG#p5cd=~I<P1FU&o4*)m))}6EX}M2c@ZWlGPdj0UIS#Il
z4cfPO7I~G%ACliRY4Vz5mKKeV)?ePU?9Ec0oV_A@?-b4!iA_pPNJ}dXyW$(w^O9kM
z#K~5xe*u@hCNzi3ztd21Fby!3v5HdJWTzOF)hX%15ozLV=6cZgMfw+`f6vZ;Je{#a
zuti8e%j&}8w^N(K7BCl1Jh!4#W8djlE|+o*wg{TO=zP3v-^G~gOI<gtax4v<8d~hx
zrJR4o^wq)iz_rWV8cmoRMWT94;wSij`L}J2nu_RYp_#f_7nW;e_by}A)SjeutDuNE
zGg4XqM6}oQRZn<d1*&MXFi%>hV%j0`;*_oC>}-j(mGhdmdE`AbS3O%A_Ic5TV8;Gl
zfw@N>eSGuc>P0^Ni1_K<HBB9%C1Lj(oEW=avFw|A;dtS!=Nmqqa%%7mo$zH-jD};4
z$``km(-*C;7c*Bz+U0c2Z1~k6b#>w|n@LMHqz3Zp_N{NUUbV|tVD2WR^$T27(!Tm{
z_^@&1k@hnU6Awfm@LV^?(5C5y828fybM8k-Rs8#tWKq({&`^A3E&Jp|pZCukbRYc5
zGEfPYxWw5v`SK&y`R^OoUz-vd!RUQI?dXy{YZ*28j;X9WwTUt3@~V~j#u-+>zFt3(
z_+9*fpM2MwJZ^KAmZ?Wo<+>;L$Je$9`bsBos7YS(4%jTl`ytk`?xF8dJ_CtGg<OBS
zzZULUo;gj~<_+5m?dTinPKBv@%Tr>emhNSZxpCmR<Q3MZBGcAZKlrD$cfIa~4ZoO^
zxL<j#=KL0|^z3Y^;nOK`<}=)C9`qiQQ|n*V-1<)WlCoHk_Xqi+;|rcChgl~VZQOV;
zJgfWgP9b{((_f#%0&5gExcm7{T61ESisTiO`CcFQUe-J2ek8!A;U=$Pa$m*X8OrC6
za@D-NE;ma>j7j!p=l_%^aVAT>vovM%G&MCij3$^p7I6`utUG<f%ZMvMaaX(Uw5>}%
z<n%+MF1f{^Bg&fBnD=D!sYDw+N0}wQQqC`>j!k{k;xmKC$II=XV@rXsqCvtf{<UtB
zOR{JAyA(PwY(H=K&-lQsyGL(wv6iw-UGueT>fFE?f|IS{&M^8~RdgKrCH(e;--hEY
z)1x<i?_8oWW$V-8^RE;ZoQ{r-w)wV}=SYC*#3g@Man97u?mB+;*XaoTlgs?JKYcy#
zfW^w#h;O$=KYj{~5|!qkxQ{{Z=%@eT0Sgn#%)fhe7`#gtYSArJ*y~f;+G%puBWOX@
zXNIj3^Y2Q&;k_D?^&)B2!E2qXFB*uLn%!1gaBzd<b2E!Cs|rLGEPB^`+xq9hL&2|V
zS1-_fwWeX|iiH!WT)ulWaF2NMiZ@E1KCZo&V8nZTl2B6V1FpUc2~W;_O>$ZCDmf=H
zvOUoGi$!CpYeM#-+x+_O|7?_#sy0kd{uW-`th8O$$%%WWxx^>iQ``S9{-)96uhaR%
z=kCwDU3U{ZG8=#QxTGn?ouB2xZF*7T)=i^zlRwCA*dSc-`_evR9}jun>o=zu>P+{w
z6OQ7xzg>_Ss=E0X*R$s)LLC#^A6)v!@rozvQQ_&wzNr_NENN6<pK4rxq^#^jv&N4M
z=NC5=xEKyU*f4Wb_&QeE9(}QU43Ga`HT$*gYR{2-*Vi2W={@^=^y*bY(?YxUU%Pxh
zj8Dex`ZMw7(@(#hOVUrw?fPZ3&@*)M^O>8vW?z}U>S*zCyRwVTpV(a7{=BW&ZT^<m
zHJSI*?5)3h8<rpY^Q`#;3-bb#)mLAx-@3*0M1IIS_u6pQKS@W#lOitsTG_hc-d3AN
zk#Ae=E@p7o>xiFT^k`XV;pay$k8Clr{5D-Q$y#XAwQZ{|2iKkO?LT?+S<UwC_O(CG
zUDf~P|50_$6N3xym&7%h1vGp1@}BC_Uby!$_lcIN8gJfc#WJyPpMKsuzW*&#@T6do
zx7K2o)BTDP-&#eA9JhIvAW)X>eSAv(l~3hcAKy$lUK-8T70IRlYDS~cmK`@QE(<(d
z{jE4E)uY!cV5Oe;)ftN{`zy~esYWC?hc{Lg-uyUKaf+yK=(XZ!cV4}72~%0)$QHO`
z;S6;R7wdOlqr$Z27QdhP`ij&2!1kF1FZ2Z3j9J`rpY%mt;M*O}d|YX<+=3ce7yG)3
z&B+E6ib~HkZcJD|S4=PDaQhL9pf7CYPybB+JM(-~q2<Cuei7!Ai!Q!k7q}iUeR{0O
z$sKdfCMbR2E3DVwaPdS!_r$b@i4w0STCY$pzTs9ABeTagc)_ud=;Kdj&kIwzXC67%
z{_A?KDF&-HrRIoU77o72%eC!H{-x@!$#t9Otg*c4Ie({Ll~4JmoMV%xs@rm&`7IXp
zEBIbffb(qSHnEFwx?%nOL5KF}SX8D7r|C>zY_3wTl6Cd5tw!F0JI-I;J^1pXwy5gM
z!<7FDmX=ml&dV-tK72SR<j2Ru5B=AtRN6M*>Y88o<KxwboK4S+*DSsB@b~7)i!VQJ
zu5FQ;sPWHzrf74qn2`AY;=n^^c0JxV%lgYzi^BzmUmn`c3OXmlviivnv9}GWvc~*^
z*;giWwaH%i#JK&6xoQu0LQU_6pBxUVr!42}R%KecB;cSSH}gR!i#s3gH&*3)XsB5Q
z=&dR^^y9~e9}X}1f?gGE^%k!x{qXrWzy04OJJs~pJGAbIiQ!e6@JZskYGl5;)Jw~5
zkq1&!kIrbTUbgaGuFyI6B`gnlJYFfN?*8WSB{}?5&5OtDUcKdDPZa-`|GQ+4+%IXi
z&EC<`(UZbH7)zCjmesi1`9F}~wP(?a{Mn}p-kHm-Xw;5Pcf7@?WVEfM$;;*+^VDNI
zHwG<i`*-Pmc=(;ecJjubK0f@Y{8=>kot2w=$>tR&4=2kUeIesF`(RL;WaJGV*)6Sp
zHruZ-JyEg^m5h60n(%R7PTchFq(dfCH~3rLk?kpW_}g*sqG8p<<C~iIueU!Y__J1i
z+xv8mZze6KXAdd}9hPRl>)_v`vozT^$H`91dGX8s&TEPD7=;=1%pDYam7jcl9}=i{
z>u}BO@BS>`l1_)rFI~)}_y3}hkifP0>{X`zx5D4Xh`5=4yKw!#&G8H2PaD(xZC5*$
zpV{@Our$@&b3vM_o6-@z4-?sWbL;+p_*B?#lVksH!^=&Rb<|X4%q!J;Hcn!xTX<62
z({0~((Q5_|?%g`%@$Q;v{h1eQT>6gx=qg^u{^`~ob>XeW>k{WxJATVMmDA*Hu<pLZ
zRYu<l&t}c~^RR49a*&RpPRG8eJ<ES_Oy2Bp`($a9@uiNsNB+y|*~>QRCnP=fWqW1t
zu;<fMiQ+@e*CQ=X<(_&Rm>`$HqPNDed(p|FPe%W~>3{T=eWdc0xmZO+???aUw{s1<
zpIzkb=+0?+(!4Eylh8HOyn4-xT1zxo^(|MPU_SIK_Uno1ho*>pndY!Q=k9?G*=KiT
ze$da@@#y1}9JN&oyd1B5T(oMz+$9N&?-FNEYvlKP>XD<sVESj@X}Pow1t-OCD_U1D
zbV-Y>f16ZwkG(f>jcfAp6sbLj9WMqp@J?8u>{rTjWOJGMy$MWi%$u9OS*$qmYQy$}
zZ_K9Womue1clTt)5N64psj<dOQ>3?AO*1)u;_<iHj??p|+3_f`e0=`7gXzjSwP`c{
z>slTacFK9QJ$S0}z4;4wap+B7e}4Inwkv)`)un&@7wtT-NBp9>kj?DLdv00ZX11Ec
z$m;id{=^v<s$x=&Bn%6jnzTEAzj<-0X}$USOKQBC9cMZOs$K1!&2t)m<gXQVI{9|G
z+t#<!|7xq9d1Y)U{WQO-iQ(I%(utRUh3>kvch9T4r~SXgnYQl#y?v?<*Y4@hcF#*l
z+p=pB=RBuL4qs-MmOS)3J6U_SuCc<WZ4tS_Pm8}CTjS@TZKU+?mh*x&UpJU3vkTY7
z9c@hEHd?80iY@xkMdoGAXa8;ycsRXxN{ech2X7X~*SYOan42egdvQ1M9-W=Lx}8-a
zk?~Sn)Nxj^&BDg%sRcJPSRZnq3*EYlpS8he`@|g_EhZH{g<Kq4R+?OMDAf^~bLzR%
zeaD06O6TV)A2~AR{aWpk84f`bnZkd#u3ViuUGV0tA8)s86Ft0qiFSa-QNE9d^DeI6
zpU36BM<Ffd{O2{2F0<1P)XqOR!)-P{+Xr_WpKmOWnO1i{`L|VK{?&LRt*nbt=l+~O
z_g#NSv&QN~WzJ})brYrp+dX`B$!f#FGrL|GCWgL{?YU!-{pt6OhHu<&mVEA7Ho1C&
zqxls}4ZkZtGt`#eh&22mfA&V><|)j2+RSn%Y#ol?O0nikGu56eT>e9y=jxvb>&*wZ
z^-A6M5%0dKx;Ck(%=e`Gw|~kXbKhNyKhhpFFHO7qkKEoX9%+2RGCNl9?q4o6X}Zku
z*z%P{WzW)N7qq>w`)QXFlm6HJtAvMLM_*#jO~%}d{-ssg?*FZ9M4qV5T>8D|P|cSX
z#pN>`^0lJ$iym~PvNSGjpDDZWccq_HLK_?NGRCZpU-hG=7BMy#`EFhCF<5w6{}%?0
zNri3m_00o}b7J-O=I#oUYyMpSbJun4l;~rxQy8zd3acb6;`qYLuh;crll|YNcS8i%
zX{Kgc=HEE?`OeaduF@0NRb_HyeZK0pWdrx#-U+$^Z`Q83(ZrOiyRapmX$#*mk1FOO
z)f_KpVJ+)0o#optgwwgp%6Dupeae?w#8v&C&EM?P1Wz@;*w{(D2_l=4TG^xC8mg?X
zxtw?{is{kk8OLtEv0?uH=UdK^sVkR1QR2Ips&rrYuS-tqmm9X`=Xt)q5N=hU5--uZ
zLvp2g^zBcf1yTtU-_F%7R$9R?tu~)!F0;2wL9`P4;+fmFvftkM!hCkY;q{Ly|L3^P
zE~_@>bv`)D&iDO<-8T)N{glv{d?X>`&4QcUTVK9qYF_?m@7tXUlX$oHUop@TU2Iky
zHhay79I1y1x5HLP+iP1julM8GExfN+;E-Edh*<m#$4?dSpS&q}zx>J7gN8Y}-~8^)
zN&3XVc4dQY-|3q+hdYuoj3;$^xP(oNmE$!ldi^Bwqi0yd{(Ge^Kkt=pN}8kZa8u}N
z)zycN0jri4$d;aodv4ElGwAE}KIg9+a&K&$q`Nj<jMYGUrt5Nv2qoV9Hw%~F?0Y)j
z$x>N+wYV+goeNyXyeD5h+L)fY`Jw2oBcj#+UUr>->$1yYDsx=zOa9*Qj0Rhqf@917
zeTY%`v@_p>G3|`UXP4AZyTa#w-uHz?GtIy0v3BFk_rH#LUh%ArHxG%dyxRSbVa9<S
zd-Y5!*Gyj>-7R_e`^F=)jFSuaKK*#OF+XF9wf;OSrV}DBR;``4Bl2z(zy9pBg$r0(
zMJ_KfnrNiACLr?X#9LJ--Ph{>%{};O&Xx4f)3;xf-mQN`qC@I)s8zMj+-AYM?LkII
zbc-fwciwNDbi?Yn(wQ}n9438b=Tf<;SSZ8K`Rb9$+%0eK{7SfzbSmt}SH?wL(dR<8
zT|0euVa%_^CpfP1EeYy*$*WeMBE2}4Ws+#f_9KR-b8emMx~$ye6qUSnRl%Q^UD-YM
z%R`@Rc2U^AIPPW0u~5##C!S=S$vn>XYSVR%kp0@fFU~tt%z4}5f6mghFdplmmz5@$
zj=f6DeYYj?tlDqZ+vlHdk=Qa#Vv_ucZM_@sSscwc-tv`o@yuzTC(k#_y_}ghxgh%O
znv|923?@c3s`qZnnprq$^Ov$e%YQ6AW1iv`c5~b54SP2QSDl=hmAG)%4(&1#vq?!=
zAHKNlW^29qr;sbVsBqSsZG9c<#5ZwUE*1znY;*WR(ah^y&x~8<wcS+uy6b!?o1ssP
z$W#%Rm5(&%WxJ&7iYmHoPdOIy?HSL#HJUC?4D({T3ifQ5c;slg>DQkNOI{c|E?Qxp
z&c3Dc+?D%VZ)N5ze`pj@&++D6@70yLr!TBpDY9+VqxGThBmO4y{g~=l_r&t=8unVg
z-t7|d!t(nM%KuZSxFPG;vN@*5V)8y^MdxbQRQEK_^sqqRU7|wMR$2&L7u8vFB<DWY
ztoGm60=o8u%N-HS5oo;J*y8i2Of#Y;ti((zVDlXj(Q{@yk6uoV4&MFa3vcMgM~qXw
z7RPP9eeJH(+G7Qi<rDSNW!%@=nxwwIrSx{&YSw6Jk5gB#$4+C`njD{!J9njXa8dNl
z8Z}={E1e#OihY@fLq6%u&0+hS_o-UZ`okCVnM*C_buSQp=NI?NHLc!%RqMu|>#wNl
z@#-1;ZaJKx`|H{|^FG@wY3<or5!_u*zb@?w*gEw>MBMh^wIV@_*B8C~ocG@JhEe^;
zo8L<7^*s*+e7keIX7kB}dxDFLZ)u3Xi1c53rA08}x63@|(^s}Hswndmyd-=}Gw8ud
zDJ?;R5?0Ag3_TK^ayshM6PvC`H!GaXxh9bEp=WA#k#h%2ZAi}lLv8;87j9#n*5R;Z
z%`-=jUps`X;$B+#Yi9*jYcRQGJ73j%k$Y*?{mw#TjWnlX_PB;azghp)mDLn|X<Pcn
z)tBkoM@N<WM%S+_n(=0rrqdF2^+LOrKbArf?dI%rEjL9h*Iw?vYqI{+iwAiaZbe^+
zspqsmS2FQ==gkdOiVR=OHrwyiylwpd`=*y|Jv@BghL5;jeta9WxhXnQFyn!g(2r@p
zf$vscpLrys@@mfVwQ~(lEU<p~>A>gjEoT${n$`4O^YPS?ShWAmp97oX7V7b5n{bz;
zXudnG+2%g&tQd1gIGcgh#GTWVJ4EyEa%^6AVv(kI?vZSX-F*4pXWm`=wWo2)<oUdh
z%j2UD|M=23U0sf`@c~!!gQx#qJm&gzzUjm*rQ^+3rspS3)11<*>)QP&IPjj>MJc~C
z3;2Ci_&C;8Jv{p1PNnvA$1_u&9uhWpZ4C=t?r}Y7*83mf{%ghM96$e`@S-EV;K_P%
z<B#$7-;JIwxNG`1e)GHh{A;N(=l%B8->$#?ul2@^;t$8TH@T<%VY4iAQ(6^yY#~p+
z-Y#{YJKfQ@5-uiPzcL|nTCif)(YwWpg3^-TFS*Jxg_-c_FIVMRADJENnB5ffcFsCc
zl`TOn7b^AzYz+VG`rqrM$=uYRdn2dse_5M;OvU>uTZjEuyQ*kWlk4sIA6LE?e0+4N
zv-ZzNovgdv`=8Gd+O<)1!*8XGuV=qqNqkWiG^N6MZ~iNT8J{dSKH~j)<kX|@>bDds
zBtE)Lo0pNfa=G=Ljaw^D&rUFJF#P?ArMD}2YW>?un`RrS1?1kj&}sK_)0CNWH2=n!
z1ifA3rxv<Ze5qfkv$mkOPHFp{Exq5LY<<4QfUC7kZAQR)V^t}!7ZKWpPfdm9CcZ4a
zeqv>G`OC7DnOomzy6l^~SSDc0TGKSPh5CtWHg3A!@%qD-scm<+rK##n)ejX5*?Ro1
zwC_i*XJzLES)F1o&sA%kdy(Uc)!z9Ff9~47DNuvuu|V(7O1?LDj(*zY!*OW0NyTUR
z^<47JzrWwyv-5pU@HCFAb;>>8h2z#YKY8@eJJg7UH{U1!{PTN8zE?e03kFXA{^<^L
z_nL*?!rSg|RQeM!ZMMQJk1K{N)ox9>lDNS2?v%~O4>E7H+><>t?TOwMnfvP`KD%zY
z!}rbo&-DFVa?)qA?zlZXySy^{(zA~_lWttTV$=T2!{T0!d-v<7JJOfm5I(b2YkgkU
zCP`g!gQzzOcXA_ZlRB5nzE_aGx=iNqygjPdzwSA8N-O&v>jLSh*lAl&nBG^NA}gu$
z$oh}8h@|{M@yd@{)n!`T=Y$WwpCtI!=s?yCwx8!1^&^<<I^(~kC)X_O_?RL-+4;=p
zEOoDAudk&Fr7bV6iYb`BZvLC3q%{jVex%lmHM7q@s^4#w!*Vg0J@`+A&9OH!QgL}&
z+!Y~Dl}~G&s=vj0B;xVi<A0`?iWoCS&0fwvKXp?3bt9QnZqcdco2q%Alrib?-alMb
zy^1N4r_;jWVAqVOMH9J$D&=3zEQ~I4omt6vb!}6PN$O|!H{#|Kmrw5OabGq2s0g!E
zL=TU{lX@A=o+Sqze7^C1j?_uf;r+i(KO^mDc!Ae6iHp74RXjY*xc&$UMArHpzZr7F
z`9|$_-_GfB%4YJsLNz^453S}<nKmzUJ+tH4+d;2X=0}{myQ0>_NokX{<^B`11C1M5
z_xv{65^$oMcY4eoxtL2!q7SZF9P+tumPgqI{W;lh&e~KjdY4sRzT=jx|0lUqk59FB
zD)4&=f4n?#248MKiPid;liI(|Jz4+bE!R(Py#sv<&35ZYs~kBVFrhLsy*#h|*ybY-
zrCm4vEq|$QoI6itHnT&}>{u10I{lmCEqr{l-v6?CeEmz=AL(B&e*Zc;jqS`9zk<8z
z)-Tfe>-L|!ylml##ed!|+L4x|@o;UFw?p}ptpA(8#Mqo%r2L3;H}`3lhKY0ceEXgv
zZT{fbQT`{d|HWN3PqRp8=84<P;mdI2&NQucoAb^e+Q4<P+`#qnyLHc5-gUn<xm0lS
zS+n6$dGoKbY>&76FwI(X@ZgMPYYeR~O8$CXFqJ1iWx2^UmA59VU%4GWdFpm&Pzz^`
z*!ssyrX6@)+_-RJS9A5U`<H$nSjrr;oWn?%r|-0lZm)Wc*Me7PG<N73E6hy!*jM?0
zw`qa)CW9EqnP=G>ZF>}j=6z(@EY<lo-!jr;sm2yT)BUr{<n82zrySIps8XGrqZ>YN
z*`f}$i)-dEI5Mp>h;2H4^KI86uV2Ywg3QYAgLM9_ef;B0o#jG@OZ+wq9JYN<IFQ1g
zp0dn6ohw<mfr(?6*8)SOz`(r3`0dNQ7@GQyY*xL|(c#;vVZNcZTJ}PASNW&Brwj6)
zMbByeWvX_ZMQW{s_?i5SLy4+9(;ghFN|<K4exc{hwEoYhH0?@TO7}QSK5g44F0$_A
zk`ycLz250Fe%@Ux?r(g+>BuY<$tjW&>GE+MYbtE)qd23tRvmPD_|jIb_OYI$Tw-37
z(9B;wE=S%k>-*T0p7{7ti~OBKCDlLr9$PD^rXAny>c;3hS2gr-TS9sJtz$<TLO#WO
z+R_)DV*Na#PCmMEqrsfIylXb+uB(09EjRT{tMv1x2%SO|Hx-)<Gd<C~>lMG%eN_JT
z2tMJ{x_6`Fb&C*>{!`09fq<TVr8%W9ysVEU_U_ow5?-{G???Y6znXGMfuMh@&)qrA
zvG4p<?lV$FV(&%2KYG?0#<QkdJdSgL%?<IVA`@Sm`tN<xKSe0_?#&|0x_RmQ=Ne2}
z{fBeM#)%SbhU!c=ek@wlkn21<(COyQ1fvfV7WZ5e&+;|&Vq<Rc{T#EqcT*y3nMac8
znd&V~(hE0g>3voV$Sa)sX7!$H-(K&VmmkP|?SxswvE|Rtznv7>xnlFai%}Z4jY^*@
z)K{%yc$VI^E6)DZ?o)XN>*RK8^mV=9&e-GcUoXkK?CIZs4=36@ur=wofAMDC!WUs*
z16#I8efndS!1cZ5#HZ6a>sXf`n8m&S;@zWDHTM-Vf8?L+dqX_({f`vk7m~BR#i!1l
zmU?1(9i!vpJRz$lpQn`?jT6LK?ks=F$5h3<NMqtvPHxv%8xKA^vRy-b_I3M?h=o#h
zCXchDKCk8z{#Yfj%I>K4#-HEspZTG1<%%P}P`0s=zu61kr@2w;pSC0xRnDJbweT>n
zuDece;FC`Wb}XuP`Ev32-3jdRHJ{t&FMa&d{a)F_jd~kn^Y<N(j_Y(}i9Pzp=g+ak
zqIWNgr@#Cmtows^anoX+BhG8g_PjWoaQ+Qv{3U+P-IKm-;wwuzds$m8d8c}~#}~$J
zY+|oHm1=Gt){Jj3yTR;j`r}Y-#^dt~WH0UBe*EIEFQvB3$1k3KBc;7#*Aw=qpWUr^
zdS^dt?n*t)8E~36SFtQ)u936&hB=qzvVN47Jd~BtwTXPhCcR}2Uy+!Wbp3a?RqHHr
zS?yM+w@*@vXtHb4+_B=-o3=LLEU8SfeIGAhK5%KugQ+}+A~)S;;M*Q*)!uu9MJ!fe
z>c#c*!o&|uwp4T}s{Hbm=?q(JK9?nbNA(JOwKKof&WdcP6}h{@Gq`H2VeamxUa|g2
zE@9?>{sn#x`DzutnjMqg7@fYzU6Z+E?o;_FTNmX!O@*E(e^}|RTcCWV+0!v<@q+H$
zF88+H(`T<<-M28(G%xP7x172Dk0Sl^{Z9mMswYJ;hfh83SRA^3YVOTR3fp3JjNZIH
zce&@x&og=EOU$<@`53#mzgr?>Y<JLxdx5mCmzJKxl9D!_13vMZpTm<C9PJ#dLwuAz
z9ly5BPgC`}ukrfweZO9DNt72#GGDGas=}qL{r~4xnXuLC_f`MAyKSRar1f!i`>Kro
z$#<$*`V3AKa~rjL?Pq-@$**UzVzwb?)LzkR0_W|D-n}|_u)wnH#X&oxYiuXAq*==5
zhV78}%9J*ZmvM7hx_5)6+TyU+{A+T)`el6Ieuw2t(;mA&zjreWo<Hcoku2o-`SzE6
zY14OJifTy-2-?h-H2KemIhw|;t`Y4SE6!Xu@QJdkN>e|wfBi+ypKXsPIGA2`TYP_A
z!n23VlWhWCy)BN`bz^*ewCsh2@cX%XUrIL!9IocQd~{pp?i*ppxGR3#`txaP`n3o(
z*CyuAk+&_f+rC=dKJaoI)3$dv>gBdAD|p$cEAQa_p<s8Z{?5bQZAZ@iUv^c9BS0zS
z;^j-$>ngq^U7sesCVD&5`JCN#n|_qP_G7umyK&dtbn&>NCedm4pBpf8ILF-<+xWWW
ze^qqyXEo<N6TX}&T=HhV=Ks#~999#%eww{dxoQ9UvGh&*-`mqyuh10cVGc{*`}1*@
z&B_ap!yBhhb-TcH;9HRUBA=Qc|E?aqzw~|*-`(SxJ02dYv)lb=R#{oVvGfJ6{~wRK
z_D1v2ggjBrNwQ(n)y(8;@9ApSGEM!s&vegi=XS=#J5JZ0&(mC^r9b^#jXBTndx<M1
z+1PUwn9n|1Rjsx&CQi5KAeT<cwTS(D^Rh~Qv$@YTJ`m?1(k#Z&nZ+BCBzl6m`CG>~
z=QC!9TGV%cpHSQta__Iowm(J6E6kpozJ3!w#U^3T)Z^{_ZfAlWzOg+iY|wN%b>!rt
zjOmYLTC{{#?Vp~WxtFIYaK&dAL8D@8k<}6Gb2dFrn5=baqgCw1q;`v=*KJujHiTKR
zXgCFJxjfB%g~iKFG0Y#Px&()H%<;a(+g<Sc=lt{AIJQfAFu!0uvsm!<l`!)^3=8&j
zuC)FA#{B-awE3xGMwLG=)ScAn+2X|T#`;vO+<MDN>NRB-C71bbcrMPCuxDG`^MB%R
zKi^p#cd9;nkA?l#OpdwFK3>q+di&VzSp~V1yXN*EwU9`<DixqSz1>`6L&u6Uv;TEO
zF5J|3YOVW(X5Oi$pS_N<YAC#kSP_3}_YskUr>i8sMz?Fdtx%~x_*VDLr(37jJgi*2
z&N05@<m)$m9}*bLmZWvP%=&mrpXcn?2U~Q+E^fSUFZw)Mpz_Dm=U)#^-KmkEToe^{
zb+1*Rp4AMo@5`dCT0KAg6rQnl<{~qNT7_Df%W>})|1~*(vH8K-%6YG@yRbh#@so>d
zi<y1Pr}wA0-~2gYaQf)lSFx=5rc*u(Pqlmc_M_uB&;P6c*L;%_)NKrz73HkqIC;yC
zi}78vPjF3m7Iivw-@@MISCe|a%%AgV^=T_Vncc4XyZD?wDp@aC`c7*1=3DD5@BFAo
zELGxJ`8DD>*Xsxd9tMW1#taM!xR)wrmnRmbgO(><jlNrSdzaw8@4*R^xPO<3oXym$
zy|^;@_;Sz3$Ao{U+&Y<&(b1xEMCBmUf*jkR_{IL$V*gA~;PeVP_HxT}CHI5p-z9Cd
zzpppr`jdCxUcJw^`#5E4*WRBKHU@nbP5(3}CdB0K2J`&q`{(UZo4)9l=e~OxpWfF`
z+`fO`U*(<m4T=s=(Kso3ds9q^&#D)P_?M<x_MG<eShZ8bKP*T@#WQT{I#q9>L)<ei
zwM<)jA+6QQvhwSztMNDAd7kKrIZ+zh5aaS*OKjb&!;2;hZ<ki9+^H5a@wf2lgMBJ*
zA`jmz*qdI$U$RMi-YdzUM@%Q1%%2#oxy6I^&#&1R;&0ez>qS1}IQzWr`KD);*W^W}
zPQA&ye9?*uzFQwYPtQA`e<I?jS3t?BnX~j)Ce=NhI{(JcrL0;O&%O6Qs@?fCXv&J-
z^&v&O&di)OQF@0)+@{mL4cT)hW+$Zm-y=Bl_t(gKnVh#~Og!%vbs_h#bBgJNnaf#g
zb6j@rY21J3>S?d8_c~YS?{;swxOItZ@uBYvk|Hntxz@KkwIY^tM!>HQ@yFBd*{#!e
z-TCOX_BN)OAGOk+_+2qd<?3^J8ujqTNzYlqOHY)>E)$O|%Rb8B9gu$Z?cbuhBBuxY
zJ639J5}K4@5I8IKq`c6rzROL|t(C%-NY0Kn+T-)t$~jQJ;Ifst_pI&K@@ZvvGM5-T
zp5~cZn91>UPmN0S9=RD?x7^=2<yyhT17fX3_L`oqJ5z(2*JxX4ysB`UClP6!du?jM
z^Jq7@yDwK59m)89$gyB)CZ~Odp5)oG;`O4ZZwpzz&)d{=sVMfc>6yFd?F*Og*VGkP
zkNf)mfYJMzmjYYw=W6_5H@x;b^zYKJSrOT@%<p`3lK%Dm^L=j%<xd~evTU;I_)pJ>
z(>WuyRj_oPs`jbR#hXNw%oooR_qp;*rf>CGh80f?9}9Ixe_pcFmccJdUb<-88$HLM
zz=&mWE#*Jb-TS<X6nEa+suQ`>w*S|Hsk_?}gs!X3`e<G7#@F%b<C)jr#4(5Y9rm#|
z44cHxD=pWv)K<rKX?xiDson9<?UvM9r=E{lF2LxQ{v_lw*Z=KqT0fkd*!*^Xnz{QO
zN7aRcYXZt93JV;%$~V_fa&pB3t(6B>f1dM{zxTKxqnrP%;4>XU3m)+@r!JO_&JRgB
z{3$E+`G@+GRc5jiO4T0uGcEMEw59Wb@M6{<3!COIcsF<I>`0@|l9EZs)weupKjt5M
zVTVTfS%Ei8q-t-^z5Bj4L-vODgUrL1c^77$(t2>tV$Jk(+drE0Ok=s?eX=X?%tXDT
z7Uw_gQi_?cCDdXz`HR^C%f(&uPVF(tSa439WtsK#z0dY*tF70ye(l%2&+om&)R)h?
zPX9HWA$M(+(G;N%_ZGUnm)N|~{{Z8`ch%y*F4&4rk|^JKKZ0`|!^6_`2b$+>{B}F)
z=AnwT@baCHL|m40F^AO4Bwgf6inR$?y2WYg{K;mQ-uA~j&iS-Zn<u?HjQQ+K#cHQA
zTeV^{sRJSX)rTDp9|+pUBNLD>v}NaygJ)vZ=YF_<uJ>4=dR2Ez-i&)4Z>D*j&Ai9w
ze%|R=BEyT4xJV_>=KW<$46cM``}6Iw+&NqO;1oG&?*DlonYr7i95uCb*}3Od%mUll
z#vi(E{_k-~xwu#T^{!0ash*D%6}NogpYi*%%mk^5Ljjt1{M6O_n|`egX<*ToVM=p)
z$5eT9v!zqhGpXHX=5M!ux}kJlsDa_c>%bK=qdING{X1`o`jt1{UBDCjywrX7qFH{n
zGs3q|)@0eoz5L`Pu{Y1T|B4?-)Dcs+E;@cEtzYF-Oi|5ke$Pth)6=IKh->z;?&8Z2
zX1^mbqv9I(ySTO<Z65Yb({HbRag1$!lyHxXW24fPw4)c|7fk!{Bw)SN<9Cdo16rq@
zo4#wy#<CNVhuj$jbonaOkG_xGKVy?ar6KDzIX_<ZruEhdJ2ETWoGljq6u#TKQBTJ2
zf>V-Ij<{aAKzsO>b6-zvQZqD@iF4T5cJ4;~;ji)vzBcdo3m&mh;y=2j{7U!2!vSA}
z!gq>CzR?d0<5`$6VUN>`Ps(Z5%l6u8ZI7NKzUj<Td;e1h#iuRw_^p4ib;-F(tH7KJ
zEt$=wmrT!!3Rp?p`7>qN>xLBf_m3?uREo98>ui2EW8Lb7=^N9h*?2~U=D56=$0xJD
zbeqhzlb($0j;_A5<x|aHuEvdpyBsf>KYd-8aCYvg()2d=CL@07eA(YJRZW>isvEa5
zwwMK}uZuY7dg6KX<ukJ;_APpFz&Ppk><1Qp@jG+N`21JRstfPd{v$a#J8=5UmqPP?
z#w9Y?{++-$$1IRv%IAB;tiUsuxmLL>VwLNje&f;|!Ni{X(<Vr-+VIV}ExqgM>i840
z?Pp%L*mFy}@rKs6Z*$H(|LpcBuwjSSnR{-M2Q9@9=5_2bV%jBY{4|jJ;Dq8$+SUe<
zi3h{qI<np|aOr-x{K?G?-*OBNdCxjh(XV50I<c42<H04hr5qv$j-}7oTVvOqw)?Q(
zwUuY*)+s5vcqs~h(0KZ*s&MM|){x8ntbNW!8%1QTR9|S_v<f_*y!S50@%s_QyE?9I
z;FL`dw_O+PT)Sj~S@EriI+<;^ZtS!_kdqlF|7iY==J)pN=dO6$&3?_G+)#)0X%g4b
z8GUSa?k}@fy?gm<dBWN0?ataA`QBY^^81_rr%y4wc7NiUQ<+?xSDtLiyY(UMz=U%j
z_-sAp?b;WJfAVyc4ZeQe^rz759mgVP$=BQQ9`#X@4vzVKH&<_^mY@286Kv70kHh%W
z-!ezIKUyuZz}NL!#*XJqXFqAosr!HCQdIJZ&X|q$^FR9wImW$^dLyuF$-?R1k8Jo8
z8&;&%`E>EoMTW2I&J+ZRm`qjrIJdjPCI9{_x9(TdeP&c&el+z*{Dftm>Wckw$G6SR
z*dkT`GlzfrgV(+S%NNZ(v5hfO`}Tjf(|lI-QVAE8vu~Z2ZPAcibC*$vJy0}q*Yv~v
zA&+KvFkLtiuB~>q`bXQewhh%`B4>@APG}}PTEhMM#|FOlS3e0^?^(O~X4|`ko62IZ
z-Dr(s;<;0Fbh?eXe#X2L6-&3ND}7;k$U4PT^Lpp&9c8~K-ktY0VybOL<D6+}Zuhx(
zH-E4#mDqQoezF%+NX5O)4p&#(avuv=wN~y{a+G22D(BxJ=k6U0R5^d+bVcm;i-I*~
zA9XkMwVt2&_gRj5lFCBoueLg`!v9s4xO)Ze`&sdE>DJHNjGA7@Uwi%I>EVliEQNmO
zI$f&t=~^&(+xHc-)_&W2JAA$JZRfbslcsi4*`{^%Z#=l#CFsJcosygPuMOBMq#W-v
zqr&{tgGpgmZ}`mZ-Fu0liJ@QLJ#F*ELW84*ngv-Q0*hOIh%|hf*TZZcr^8X{`>!$n
za82vgCB2JRC21~S#}=$Cb4575x6r>lptwJiG4RTX5W)FbKL3Q{4?TUG_rth<%fq!+
z)Ak5+?(#Ud?_vA-Epkuhs0w~hJb&#(xj=e_Rnzlprv4eBy=P{f*xmC;=CvBzxf@xX
z{Zn^EKb^}a)Gwu8R#H+nXMP1|V9CpPhGPuDMeXqumlkj<n=>qwT3q#Dd1y#3FVp8Q
zAHuB74PG11F3rDh`#ID>Rp30!j>3;dS|67rKH&UP5g%@u-Q3<US3NuDw|f1fwWd;E
z-21XNEbix&+9G|&Ik-O}|9$=2mf-VcCt_;s_J|2BXrJly{_^Z4Kc(w5Q+{=vHIEXz
znt6Cj?T2IAr5-$03RUUe{*5`icfsUqP7CatjMmNblP<m{c;xJ-lUHhQ%|5r_rr}KY
zGM2AzICiQ1^i$8BF7NtxMfO)|wPJ(Fe5=~sHAbb)%6x(S4&9zN4hh*SobDI$ziRkx
zUEhUHSG&udyT4wpy}D?*@{)3p4uKr7j<1g_UL7rYb@+Ybmzmt3?GD|JnERmp%G~!>
zw&$EhUd-6JBj0V!ma``+@~`A?tK|RAX34TDQ-+hHe!0<)v@gn27cY%+WSli4HTUMf
zxp|qFRx(E`qzXNsJFT?q?fEmI=6h#7PtE!sceuR1+(PHeZReimsy|1bbREn;`K@;K
zwZErwA|l_ec4uFj(ea^gy?b+g_k}gNuKe~-t*`v-EKBYawEJ;l-FhM8uUiByr4?^7
z-nS1jjo_2{?K4-7YXXn7#zi~t`&DdZw*`0nK5tm%mRb3;<mo*I_gRdKEB@M}_8wBx
z^c>a*GB9*RGB7CP?md9_KjbE6=IIqw-j&Jjzq9S*@4sBf{we5g2+LLWyv)4r#8EqQ
z_T&6V#Frl}Q_N6(w>D|*j;oK)aUZr{QNMWq8snOdB_40H&c8nLR<Yy#4+*~KM<ve%
zd_Ot+y8r)w50=|3P4$(JN!yb1Db;UvaM3=`OQN+OEUGGs=G!FB&Yc>+Uh312hl`K%
z%h}ib>4;gYQR$c+HmT>{g{ItV1~W}eBBO=>ea=7B9zTs&cfsCU8?-Wu!sh8{Z&NGW
zlQVnUqC%ffrX{8-n%>tw2!1`;nUlQr*V>zTpFYh}G2Lk;D6q)mY>cv*>%JG;(@UJa
zZ$!<yyzBn<jL%BN45DwUyn@0m>SRvJlVy$Pt!5NC<^3z=XhU7_r>tfV`{mK5b-^27
zYeinq`m<U(DzwrqzWbZz&WigNR{3z<T=49v!>X*{z#sK2zn2;sDAl&#p4Oljx372p
zf2*he_wCs6>*LkS@6MZxuRmXJx4-JEasI-mzH>GSUCWISz5nd2R@~*Zqekb0x|b}=
zYMfyFEvS57)E~FYX<qX#vh4gi>0a4>`=tgdzEZP%{ZG7;zvCm8A0exLwbWL1Ny_sN
zr#CBQN<|%FTYllwtgDN*r<~9Kng95}KH+B0`6ZEhH>XHQ@2Hp`bZ&m<onOmNU9X&c
z|3aT_&H4Py(8DXteOX_eSQsa_$7cVon(Biq|4f?th3i<u4!x71C13lmi+`LfuRqUb
zf6dSB!F@LE$}Z;14tx>1{zB}ZCOgaIBrgGvZzle;g>ALFg0|gz!unw8G5d+U&lWJc
z6~&08{*X8CG+nQMS^RzGEwhu07UXA4Rd<c!PQ4o3Gxdr}^Esx^TRdLPvdKOja`I2`
z(&pP6Za;nUWl3`GOa*;EYuP@Xr?1+sW=LKNUa;xHwk0!kCA6PC+w?rLEb`ESMHQ37
zelDy0x4Qo1uh@N^pHt^t+;y_Zpps+d>$9vKJ3QC<C*EB3`oyZ-n5|1?^49#Gl%JTf
z)mD1T$9gWYt$SWJ22E&To3FKTCaY;~lO|^aqet=|)0-deKdV|_GP&Vq>eL&jPj*Ih
zb^qyB(PtNlTQ}>Xs>G{3XJ%XQWk=~OKa@9bQp11gzYYJ}TX}Cb*fGZ>Jc!>e9o0J7
z!#PJhL91}D@#QZspLK5RPm=s-dUEELyJ6Ec=cKDyeKT-8WR+!}@F4StqQ@qka~2ny
zgAHA_draPWoQG4O^6nAS=~mo*d3FplCOL@DyIaiQVX&8X4!bx1nYim73%XTm+b5|p
zp0q#i=l1Vtk9N`BMgwVnrVztxHv%@Ks&trW2CjZAIzch+Nor8z<^>BXt&cP1t>%(h
zydy1lYLGzds^(W;WH^FyE-`O>Ey4L=mf1$DR1uxcZv_lQSHG6{B382JX4HW-^Ozli
zUaD3uw3?gDD4xT(Ip$=c6(6(4%$JQBUwT+}dS%^^@6FfV@?18(>MT2>^nxYZi&YX*
zd#v=O)znh=wFHMY-ZxBnqqKF3{JH6T>#kbKO|gsQ@z_;pvp|e*!&=7X|F%U|ljluz
z6lFbmxm4pqDqmUzn*v|N=3<ouSE=yCJM)+w#gu-%IXwAnIWt?d&X&L5%H%k9_*~=b
zx>2Se(O>(aM3&==8;fpj!=_3V1OBx3<SU1tDDc?%`EA*L(lunAzRjcyvvl_aq%eHX
zSk7`(@^MqVS46?F*;e7dB|k*(S~HQaV9t-~Jmn5YVW&Twd(2rZ=1*X+S3T&^B9g(r
zeM4H5#@pkGe08sL);(t9(EL10`hw9?#dk$shxR6@we9b<x612hxKZl(c-yjvMisn)
z3~XDsFn?XHnti&*<F$iCKeNZ-jt5K!Et1au&EBRWKY>xcd9R>V*RjJdX6G+z7f|82
z_-f7DDIz*gRctoTnK3D~B#H4^Nv})JVa<iRGXsOGkK65vWV*Qcf`rz>yB2b;BBB5O
zWQGX-u_}Hv|HP(G0xQKI^8BCmUO}tf)N-S$<s);k$d3KeBI|3jPcb;`O7mLw=+>1f
z8w9QkCdi1bS(Y9i>g~IOO|-`Q#l1Yfk}aW}!Mw~&$w6G}8hO$SPTGpOWWJUDwO*_*
z=2qsq!>1EpA7Xx}-QXg9^~;jA(%Yux@@bTxQI+}e{%)f!>vr}tt+_@yQw8&~nF=mD
zov1Bduy4VF?HB&*F#5i_HEoR&XUoMVGwUzfGnE2uv{KisYth-rIzfzYMQxQ<fa^}l
zt#Kh2mGWkM2vE@ClAYP4VZT12)BMInzT;}ug1pBIYdcQYYS$jPx5V#Uglz7lG||7u
zJ_(g|Rk3q5&7R}KIlF+*=$zxd<G0c-o0VG3l#W_g=b#r>={rqijphrHiZ{`lm|E{W
zVv{P8T;q9CDyX?rMZ4^DuimYLssHXVuXc>6c*>J4)T6?!VCt~uMebDdKWd>Ztf%_c
zO)}D6U@PUs^Y3v%QQd7HvFM2ANvTcODyEwJ(P!QKFyxzqkY1^;#DpapcecvN@qav*
zD*I1mVnpOU2c2yX4(m_emeDrj)w~#~D-sg_e#!-Ueo&G;v@U0p_cNdU%(ISH2=eVn
z{lMbUEwfL(?{IYtUx&ezZD|Ejj}B&<v-4dz@TJUQMfJA}#gD$(@coxGdN*e(dyiwN
z<BIohd)m}o5BSb_zUkZn<2{onTU}(xJMgg~^n4k^uGOhU)1R*PI}_Wz<xpbvyGh20
z7k1aNn>}p(HN_*+{;|5?2R(LMo8Y=jN4QVzSj}$GB%`HiZ0Jz)yFj32&(-_QM;E`C
z*k<r@PVYhM$o}IGc@5V^ZRp#a%%=aXUti?so=-;ezY7RmD)M47w-qjU&MIm4WNX3I
zFS|<i%`SR)>a3jPymdB7A}anRJDD#W{(0rda(>fSo<?hw%&d!3YVOVF63XT=e|kew
zOZAGxx|C}^pI7XDf8w6kbDmCn^~Yz!?Nc`#ue*CO>g^^oE&iO9v+ZLGZECGImGxfZ
zQ%?MSGV9@ncju}M88Rabx5#{3b}v@o?44WkIxY9J-8Ezm3Eb^pzyI*%LzAM-MSs-m
zZ+_tEwNv`BZ`S>d?s_j>);$b4*C@oX`Dnvhx$3`PzQ*@G<~dYXc0eJ1?nH$jN9HE&
zaqH1JdV_o0`@YSGo7eQ{el6c>Ag7VMrrR+0z@`#bSLXJU31VSlRuSbp8?_d4GHg%$
z$)0QEQ#SS2x{ZIr`KrQpOYHb#<i1ejkwf^CkRw4$|0*2YW!Ugfv&mvg)L)*@?>*M!
zz0{u@R%Uo)qsEd6vb!peHdM1T-M7A4{Yu67v%?>e-_N4+LYX#1KI-_8y5<lk+tWq2
zeJh;xe=RmSsr1;U<g)kt*&fVZ-!-2Y2`#E#vDCe)Bek?D<7rBGy?;>VRB3<B!{(o!
z+L^BXBG)dwFn)>dvmbvax}~wN+#B>V=+|b?tA=lXO!r9l-+F$_=L05l*}d!cRX9I?
zcU4gHec1o!Z>D5l{GA#e{8;U#!RvdA9Ol3Lc0Ie6DfUC#CI1;W;#Z!SyuW-(Nqypy
zWu5n)uhTkdpS9gabWgIxA;~z_&9QkEdd~d8AKo~bSR9;eByGHYiHUJ)@*kgMp=U=8
z9=%)ETN<$UY4QBl;NP0h_Ol0xomk^9Iy0?!hmXq-_VV{8Ji$+=ZTnWH`!34BHt$XN
z)$iSB+5C4k-OM|!X?4G#<>ZI0+3`jZ?o)nCU*G=7wV|+jwwOcCea;neN-viy7&9+n
zyATrnKJf(Od5f|tgQxmQCyICNU7;2BRZY!O!s`C-nFW$DjsH?+{O}FhBc#BkJugRZ
z(x+X%>oj+MR}?+Df8`0O{EROD(?)i$nj7t(M;y#+l*|kYjtdp{vlF^1E2D5ejq%w<
zm6^G-W-qz%{CtVeqslVJ)$cqbBszjFc1{isIdE`tVroO7V}{Ag*|V)2E<ae55W22y
zGIPdLkv(-{SMN8z_M3Y@G%RNpLwS02ckgkH-}|a79&>f&ePOa?HYi!~>vYM{xf{P-
zVb?G=nR)+V+iv~ByDpDXI{J36YHioBc*|wL@0wi4@NwdaV4cV*Q_L1KEiPkbd!wi7
zC1%RT!ob?*_CZ|xR@<=~X4_mca^}weZFBPdj$2zLBbpD+(koc_-ck8=z@oRB4wC6x
zMUzw4F4__1?^39|e(^~Oi%mNW;sbVWdgXp$@Aqk@A~rKU?>yUkI;!}7#qI3QDTmbG
z{K$%KYqVmH|GOuxy>8x3)0tb@|41rc<Lb!yzb~n=@K=VC(w2)gl`=2YCrsX3c95xc
z-M8!0R@?q@NQf|IFEIRi?temY1S{hbch<n7ipZxC{Yn+n!XNxt(ZUzG{loR9B(4_w
z!%x}cPu*`#Hjd5zpmKGoS3%sq#nB>OwRcYa>XiuD@1=E4;P0sd_a+zaJpMy|`_EW>
zVl|TT3A(-|%V+l$W*t7`2S&eKU%yRTojt#0#;mU_PI=GOc0N^*WVzw8-@k6@f^(@C
zCX}o0KKk&)X0GIWQpM?Wj@8)d#H|;)!T<7uS7daGZN(hj*K?-l=t@Ya#xQ>4n4@f&
zCwyl&(;Ul`=={aD9uFRExw3A*aNu139hDodan2RGxzgnyPx-qUe(jAf{5hGbxSqY+
zwIz0MkNqCME4wY0zc&<re%15u)xBREj^Dm#C|EXe@A|hQ86PJZZm?U`5z-<MEuyQr
zMaJrcE|=Cp=hpDK-x$iC$GWbctfg&`!uaxNRv>3vw^HQAF1IJ`V*CzyM_NuUl92uC
zuxN23>*@veuC9}FxT_q!w+boPt8QOy6FV`w?`BuJ+CtC%gX_6(7^v#qIVs+yA)k9W
z>GtxA4>A=!%%%z?on!i%R`-(Yw1h{^Hr|zmEsyLX${yMza6EsksNTZEQ*l#o`_HV0
z%C{OdZ(hind)<`fy4=UT#yKDRE7zNF9I1?AVD@Y0d+_)9dkOX87l%32OpmB@hfLi6
zJmmRt)_b0Xe2nVS>qLHR6}5S2aOvc3|04|EtIPNF?aB)-QP^x_Dra$Ly3~XF!ZIR@
zR><(%*xY{D67}qQMC7@p99Lq0OEuX=ER<37ODqt5s4f_CpfE1)dE+9bIVWf5X0+U_
z_B+udmc@Af<EvZh={mny|Ag;dq;_%U*^=oULHATbdcU5KUVLuL+^<SOs(o1vwTUeq
zEmEA_5m{}YZylbXZ2sXvRj%oJMs@!)3k#Ly_pP$?QY_Tb+@Zc^N8`>PH48VdVo`Z~
z*nPKI%+<{YihkUb`}m2&w`@&S(nHs_xoZz5P3Jf)>sYgUF9XxmGutGsYp$2Fw8X0S
zrYwmnzQo<&W|X#UW>eEwe{OC@=hqW1tqQo2cHDBSSM{;GTtDOc>iR_bs>_Xvm5+)X
zwVmei@wWHZMI|57mVUotKIcTV=-gEjzAV2PKdB2G{H^m^;>ZMvKGn90?>Zhz+Be_3
z34Z>&rC+a0hb@$6(F~J~>(XOho$0!{c;}9=W3zT73wSHo%dZr04`%uPIOts3UB!30
zA>xHzNBBZ>9v}Vn-0#dT8-tkTH~zonJ6wIp>~J&F^Q{Mj)K4E4^e<!#&9wJ_>%XZm
z=BPyPyS>%l?{R#W5?@^LP~jZ^6r=Cfs(0kSD@ijh**kOk-0gKjLKSSA-!TN-mYcb}
zu{bi2?XPrCRE+%b1Ma+X^WXejdSrI<q!N~gFJ~97oE`kh@$K`)6OUT1Ka;;N^4RIK
z$ExkLj7_s*o8x!2?3wPpYgX3xrMt={^(u3k^?$uGR?T(({<Qi2j+>>C_r#yh&AKk0
z>KeUP_U~;A?dW~p&tn3Dqo*&DkKemf>ZsG^q9eb*&imK;jIZy9+WVwa0d_ao(-jPD
zzDUm5U3BrB)c<ojZ`k=JJBA<pU%8-e;dzGDZEElRuJE7zWRQ0Kdncd&-P<R<SgxPH
z{k3C#`;*7MRr9~?%USU8=1#^S?Maf|EY<dZBri($%yXK1x}v9my&^+VQSMm6-UA^l
zU#yzT76w+#4zWyo`^xiuY4^{AHu}kH*wq(Le`#;KvHr~R)>o%H_bp*9si@eq?jz^C
zA4{@ICW}<I-S^~4+#o7`*dX4?xnl8j)%g|c<}Ep}v(o?aW4Sra27eb%^q4H4y7b4x
zzJvW+l=!0BU1yh_`LMhH)8f8^HR1afMrX_G|5em}=U}_`g~Q#AGtT^b6tB;7G4<TH
z>;L<nuJBs1&&7}1<goj<f;*+Fqo*qst@_U8Db=a)Vs`JjNbzu%!d>T*_QVBfw|u&P
z@+9)97NDu(Xt_B?eDVwoIn@jd>bM7cN-7Id<C8N|le07P()9`|_uAeryKOP){V%S*
zPY#-k3v$yZz5Hf5FYjoWkgv?`?9-m<d+c~r51QQ;S*fadGHSbhMt$=BoYh<moDB=~
zUZ(syqhjXC5ZbycoU!s*%pBRj-yT`WY_v$$|CKEE{GsoOOSQ|bdELt29G$oQa>X+l
zwacke_wGGC_y6zu&D%F`fBoh09M=yvbJa2@w0qvkFqwV!yUwglCdGM^uAKa2BJ<R5
z-y9?MG^xAoAJ?+qH<2>WG%Bq5pEm7$(6iru7LA@o>K%_&mharuRw43C=j>#aQ&xUV
z|NUpyFm66n;y1yP*>L{zla+2KQ>5G&+G-5vv|fzZmn(a2lg&(?rZ3Z;%0B1aC%oT8
z=63z7?|&=K$XWTlSM+ZVJa=sQ;rll=*iYQsID=94#t(}#3D@duy3&%%M3zOKU6ViQ
z&pQj5WsXut67_}RODrVhbsmN<IlSV>*ZGcJ-J34z@V5yb{{Awj<%)E?%I1<Io3<S>
zohihqx^23o_x()__O?sSKkYW0ZRDUPckt7v$I3r*ZZ7=m`&dD1{>h1o`(`fV`6t6B
z**w$j1e0gfna_!gM_wH__hgq)IoB+ZVa#B5z`bZ1=jllnT<u4<?co(P{PQ{4sBOL-
z)9-@^4)11}vH7u!!}Skr47<6F>ZP8P*Bx7Cx~28M#U^<Po)<?y8~8rr-0)3(ftk<-
zmFp(Hd6yG{8u+ZeGv<GM&ikPD+~spK?zR+mY!)h?o-^0-XDq{=*+$Q`<IOtOv0aas
zR`)z3@U}Mn!NdFEKOWq&T(D91&(gaYE#^PIosK+jUvuC3&jtI+?fxEuHFHkavN;@`
zxohol4GG698uq3;<`}E3o3--3M78?<WnZ5=uByw*6PU1(|3^L7BFV&~*T3CAx9CI-
zs|Mem(-I8(HVN)$&JXli=inS8zF*_~I_s%dtycJ1@dZv0v)jF&_1-Sd{QiRYQ>mwA
zKd^1iJkqs4(<c7n=RMhW-4o;(crDDd)dU#|MKTng`^A<<h%_%`(@M$;mhEC=S|P=o
zV4~jBxVQMmBn_Fx8C%^{*d#YyVtpKvWv%~@alaf}U`xtgtrL+G8Zu7a<oxnZ(MbFG
z)jxcd;^`%Mhb_D3vT6h=tet%4g7rTEg$KW+)E@*emgy$_s#RIq;1Hd^U%>N0&aW$s
zYx$gIJDb!tAL!aFqO!`8G0DnVZDB=;b>Hj1^I8hEncpQRdp4H+Ug>OXcj<}$*)~Jb
zO&sizHVP|PWB+P&<fk9h4fc?JyZTQ=zwm@d!tzICEPIR3PwQ5ZZT@oq+=P?1`@Td@
zX!<wL)lo{<GxpAzM}pyJ0xS5tlqC9VGnYrbT`y};m;CR`&i*wV=btQ^^XK7N-VM)^
zAGn@mYQM0C@serPrw_W`j-H#t693pd=w^xys7UhuaJhDJn)y4Oef^VNV-(ote7o_+
z!gn95#fraA%(POTx$r*LIet}b!4A<wkJkSV%am&Je9!Raz=zovrDuLxz3a?%t5f{%
zoGwg~oWS<v1K*c2Be}x`0gE>zynEE0BjS<~FtNd~$G=&1(;e^hzFTU}vmRABJm749
zvWhjpvfd)UStI#vpK=}RkM8yj=3fq<njZ69he4|^kZqdqHrefR3M?@NpBvT{&YNiI
zXy$*j{=8Fw!WYp1>lv;J`#I-dxLm<fChjh9b8V2KozxQJHjgO#5>W{^2e}Q5-c!5{
z8Yde#E4%c?)^N|#p6A<kAk)RO>G)J{7oBBq^R53E#D!g-!Ep3_lVvdzi#W^wrH7T;
zcF)*ZBVD+Y=SAD(n71*jf3!*(G8tLd9`!sobJg8-dS%Rh5pk2QO`N3`P;iPRh)b>L
z<g20;KTS;A0~C*akt_Rs;OEU%PovhQx^nVWGi+wq@=sDE)j>_^YQ#lPasHRwf8vjC
z-DPXOuDH8uW6P71x#IDQc5xK$TRpe$^QOmp_FZ#iG0C_PTA?fYZSilWtp%^_-iC|m
zh_rVFGVb^+@vrpzN{6*S7j?GeF7sWu>#3LjI@W!6`#x{)`~1E4VRVi84>9S3+pibK
z<?`HN{x|WVy!d@)p9?1>{}o<TS(t6NreO!eD|PJv%YTLjjhh&j9QeGM(Yvpn=go#c
zEgM!G(6D-V;HGkIT8A;`Z@nJ|x)<ghdThKjit&=@ugxO4p^2<c2bRn-+B$`I)%2|a
zZ*%#kE<9z<mZkifi{reZir(7Qk3Ot3*>dO7sUNGpaQ$pqlGdl!w{w+X-UF%b?z9)H
z=X}V1sJYI_`P1vL+4aABZfAGAoTK0sY2c>S_*!!ghe7pW)yAL-Q8{(-8BP%_J*CCd
z3=OAl=<_{4Q)jt%3DYN*gYEK<0}Wi&B@JgcuAcYkUSHtfwhc?2&A3iw=I!L~|M*73
zt8Ig~$cEH&Hav57r%Zaleo{x+qVmB3=P%-^otqQR6^l%Gp0sSDQ*>Ty%hci}ho^O0
z@Y{JrPP@G0WM1ZX9%hw!MZzqT8D+T+_dQNb$WH2;_)T!fg0(zKy=D{Z4qScruQWRO
zVA5)}1rz2!e)INFr<?edc27eM_LVcv70u?4{S#+!+mMe%@j&4Y(L<93)=9sO%I3J@
z@=uU+x!D``T}lG44~j8<<`w>tFfH&K`<<&N3uF?cI-I05Wm<Qy{prrMadp7wg`O*g
z`HX%{($o38*_xxFc82iR1a7(av)5(q{mr$Tfq4SAp!A|0A$pph^AvLCvHX0oZtAXZ
zYyG-?|FU22xB2J%yKwpD?<}_@+rsb8yw-cWpVMKYF;h~|v=f2}R%hKS{;~uGlnUSJ
zH#)UT^KaMvJ^J_dw}f+DV$u&fw&VZFzt-n}IxYC$EvLp5>Te+)+G{$!ai7$FwZgu4
zclRxRsje(oAkz2AC?MW9ruFF4C(E+c<~K*goSeTtyicB);S>w2nnClQj<`i4H|?uy
zF2%H2y6zLI%ys@$5?RXe&M>*Prue~`y*W~?m8WeP;%?+-&)?K8IQtpjQunINSxdBI
zxH;#3w)pR@wTJUv&F2R8LlZJ5c%^bbWP4$x&Yhp^pT2<Uv^K*f=ZkZ<-I{T(De}pB
z-p=o}?Th1hJ{_9ltFUIR#kucg+Nabm*F^G^KT241`>jIUHaEEnjmr#W6S_Zfgzwot
z`>C|KNYdsV%mEoQxD?htu(`+F`RdV~N$b6}|D^wjs{fUrn$tMv*kv)jxPu3!4PG7N
zQC^_AkG*Ps3Hx7v+y95tf9&y4-~J-oobOY?xtND{PrMPC^^aMu*_@^Khny^jvf%sI
zmZ|U0rvCrYabrTX>)*G(FLyIW?0Nj|<nGh&c1s1M>^ibFWmmM|Q-;iD$MtI5^DBNi
zqzGm(O}uJ%V8R~djDwGBp9U^;<=1(sEgX5*f|=>><Zj3BKW_Z5sA}<eGu>j%R|#E?
z)p83@Utj0EXX*Lt>s%xA?p-Zqjjv8y*|hnt>pK&Mzn|~b$9+3r?Jj!7@|?^buc=46
zcHfa|EMJ|L6McNu5#c#^FE74a8*pz5)3>KJ|7`VGew<lkD3#vG@FKZjL$i>-%kvfW
z7i){}SesvP3@Dj!w{XTngQY=!C6bxk;q6C@k9tkEy>VZs^8KkrjoB+K-n!1*y8T*~
zf!?P;bH&5&gcr<cV4rmLc3snK6TX%uYk#uM%=lH&x=1KdVegVJXY+bF8Lz)usTsSg
zX5tB%J`b6!Hjzd9o;hAN4b7W5?^>v-Z{n+;mJDkbbj{BQI3N1`64&RL9opB9dN@xx
z%#|O}u_9u_q*n%y9$#p=r4qfFJ5JSq^C_MAlUlTyl6+)a66$8(a<Sq(w2ku&mr#xu
z+hH@iVms%GnMd@FDE4qCn(-<Z%sSxw&SJmvlgBN8(${WVdr|Pu{EY<-3B9X6D=)bI
zb3fDG55<RGUF&)N_Sf1CZ(6s>Ypm8#&)lf^;D=4<H<n^yw<X8QGi}!AO!mC>anGSR
zwxF^L-ad?n-#51<HQ&$`W6_Ez4O^V*(6u5o=Qh{7|BVSktCJqKP5&ySQ=#KjkSgZ0
z<HyFWf8MHu)EqGl$XW4AMJ>iaym?QxK$w<DQ;Dx|!^&5}ljX$Tvi(<+4qE?gzUA{C
zb=CmAgR7>-v8-oX$aL@z|BOq&4VbKg=P}Cc70G0OW5z6N%yd4;$B-%9>FCWgP3v8M
zvZhT9ndX0S%K7j9YF=K&sUpj|O-{1jT<yejRq4R>_U5PIOD~D0+{`(&Y110*V{1;V
zm}qyHby=oSYUY+Jt34Peu$AaBW^bHs#M?N3>qgrqX74AOhZmWt@@z@}r*!81AI{V7
zCmHTx*HAlX``B~-?gT4VgL#&<A!~b9&va#&<g_nnV&Re|kB5&ne$Jby(Nyj7`&TJz
zanx?HSF=4^?ltuvwfVh?@$sp%5~`P$YkocXpud6pU&}j*`rT=94^16-`e(B*o^<9g
zn|Os^P10nA=nWZP6^@kMe3qejf7?2po>OoCmF`~r=#D01ZvMlNHLM4=)$Q)FDUE+}
z+hG&?{;&y0I<|IyIK#=Y;9c38S+_b$6Zbr7p1x>vm+SQp%`>Wbe>Y$G=4W^Hi1X?z
zTSG3ca@%&)bHhHKiEl1{{86yR-}Of*lY{T;ut#>h!Cc?_s?zg+AHV7l{=Rb~gKgU7
z*#?sgb+^Ayogc<(Ffq8|M)@6OyP&n&?gISQKPF7_+QGcyZ2DotmTF~*eI<cqSN*nK
zYo2xfdB+#OKD{vaH(8$_?RutCZFBxM!{*Y3f6TaZ<z6%|=+ju!{@~?<jYfhO%C1*G
zeY?Yd?j$9<y!TR@L}a5^7kn$MzovBV_r4P=@3CkzeE#s|@$q+_ruPF{3#1p7ojG?T
zl%sFbNtKS{(ofU(F$=u?^=F#u?5)!p?yP5->37&rTjorV<FbQEmvdHs6AjJZ*}wLi
z)T@^fOY=(>A2f63VF)`@u;D<A?w?fe%a<4q=c#RunR0a>=ejJ_Cf3E)CM!Jb&MGeq
z`P+Cl@u*_efwK#>7Jl4NqiMhY`N`PJ5}yoLHCC;W-p@Z_#Z~5p(6)2_y>5@c1i$~Y
zr~b-k|MP5rFHc@2cA+B4+iZo<1rhDZ>ZZ{fmHyt|w)g3^^{GuRF&E5&I{N)ZcSm&Y
z*4nl)t|{k~_(8?m-Qh2y6+5<6dp$WUpCWDM+x74PyK?u&7(V@9f`%W%>aLXiD_UT4
zN~H0GLD$3L7qPxNPGJ)hW=e|v6JuY`anZe|+UWU2*FA1xPZf`(`N{cRNPKAeQpqi4
zk8S@HIqB-EQw-BTHGSN1bkQamu_#9u-G-NL*SB6j;Frlzu4ABdNY5~2qgP^I^`1?$
zHl0mrD0chFn&a!4H)Ycd%e~K*x0F6LHMC#)VN2+QO)o?a@;J<ies$F(tf2nw{5i3F
zF<M8jpP9env$*uNC(5&BTjWJ$+B%M`nO7{*H#gO&SdFK6<NkTF<-gU{@AmJFuiSop
zef}<S+h2dhqd%WLe)_TFefzyK2fmag$36Ed^0*#x-#%U}D$vZZb=s4gU0jbg@UgO#
z*5<DI(y`j=@vDcseD_^Eu>9?<3$>enNJsD1UVZN6m8m<fy^ni+pY8FpI`vD_rvGBQ
zTP_{;D@^?7rw3(^rS4CQ``@_x@!ork(ZRuMSj~1tN#$L-^rl+rYS-P^bIi*RYB8<p
zU?^>24RZBab>{cCFF$^K*<Ane>EpuxPY%1DWty`=Y}Y*%mG?J`gjzq=F1s$+D-jWp
zdA-`xC8)uG>!Q$)TUPTANx0W;F33pcnR)w>?d#Q%EK0ZJ4=7!;h(2~bK3`zn`V%r1
z+8X8IZ?oz(emb9G75(+sJpRw(d$;vgd_DX9>{92@e+4hO1t!{B%)I)<;pF9d=Xqh_
zZ{_OW)!m#G{9}{j7LI9=JC__(5;(q$=k7$qwST@l%{nD+w?jX&fO~<Xk44MfLZ23m
zz}0%sA0Jav-8_di`TW(+6Bj>DoLg1Trn%2cH%ry_f8M73z3t``b03AQ&XJdkck*HU
z{Ed%&`SZW`j#@DW`jubvWUqa2y2gKp-NgjIJsa<d+vp}MH5?OCtIV0_Qhe=D&6P&&
zG>u0R69xa=kltf&yXuAbJnNFy(@Npuo$rHYz88Iy{(t?Hm!}?XJN`@OS8y~#`9<s3
z^U4$JwLXZxj1+cJ?bqAvzIXEBy4Y_kY+mkC%09w>X4j^Li>th*h0oq}vp|G3vaN4x
z)haROPS(dudu;?K`vlwQhy=CU9Zs`z_sHEgD>Y31`rSE=8%$q(+VPzEc1*<KSF2dA
zd}Ht3$eu1{c++IJ<o*0Rax4#iWms2+%@*c%mJ83_bUvcwGt*Sw3o~qVKdhWla7pIv
zo#Jk8EwM97m14WkHc!9JvVHN&x_e&|6m=>~FZO8vKE=;+zp*Iw#?l4(kMys|^W`UZ
zF~0P<rE%iJ9LWz(60UpB%>JA;uZk=9$n-tG|LF6USpGTx_uy|+%ZIsq)7F3W>z(}k
zo3DOZO0LvT_e0kTx268O#c(Xe@MinMt=bx^ryA~?bxeQL%$i-hRg%(JEmzO!zcY<v
z)wNarhZSl9FZLxZQSe%GKw$f|wC^XAJ8X&)|9%wm@#=Vbed*16K`!t5pJ=(}p8tOF
z-;aNjD~?zHFy7l6yX7;-v+~!9p)c}dZ`?VW)p1_+)!&s%<F*7X*>-DDs8X}e#<gc^
zjO%MA`$SlTYaVN`{QD?=PTV~CyqHNhzX|M}TO(=jx8HTjzPqcWqm?`Vs2BL1yT9=J
z*SFny_3;c0AJPIgGhSWIdrf$gs_f%mHQO3L9BXNM|NF+ysHeh<E$=a<T$G6W5qm>J
zFfHlo1oId%o?r5*%cS}5FEpFk=oRL;B+l;f9r3LfbXIVN*LbOBeYh<2-e3J!C97cg
zLT<-Hw=FzpD&|ZpHcl%$QpB<_N{b<D{@m|+RnO;F{fpfGNI#;g_2Bz+5mxC_o^4eZ
z3JL$O+F!`Nm;20<SP`=|GX$6KSK2Yfbpmhrmy@fDKI=Yx_Q}3iT+~iPe$~RmvU%I<
zg<DErPCg~DhC^kB{F6}WpI=YUeYLz>W$$*kxlaw=sl9lx-ly(CE9+sM&NR!#J-f7b
zJGgFmoOr!_S*dUc<LqUg^Li$Eu=pJN<=S#w?odt0x1YBawzL#I)i{2(S@U1%?9Dxo
zc8hFim~d{6zrJhddB&Hr??tEmf9mj$MVQIoY>rdM=Fdxa8d`Hb-gii1Yp%)T<HcE@
zk3OEWBXQ=Jec}g$z6qTYoAzmgK*SNlA0HF@Hntr;&KTPMp~&;{XFlnDAvaGc9{ymo
z_v5Y>kEf?2XRNmjzVz<O$DOZ}o{K5$aQPi5x9y4gs*1H&V+2A@8l1dQbx~Yo&oP4+
z6JCcEPV;#-xgvc^z*>nnr_^2rR{rP7TW;@k_<1n5>9+ZHkNukyJ&tZYsWboL&Dd`Y
zicw<cW?r}0&(d04aZmP3%`5)cz<+CV{fwq<<5)hiLF=;=+w4Pi{c%1`fwKzE)#!RH
zk7+w~Wsc9oSLaWkxuZH^rGxCBl0TB~mrDIKsa(DG*`sS+_YHai6AsK)+bLMzKmAdA
z;KyLMz9m0g54IZVxx9Qg```A-5)&ewqo?X=2P!>uzhRm4Z#nnOjTW!=uKgu^s_{o|
zt^e-LmgiG~m@8t||H^;y>?X&CW$!sNKfC<o(+U1n!IQgN>&erT?UOH`SC`&#V)pX5
zDTfQhR@bMR1r&%oI6HW|IAwIO-<tR0nDX{D(;hq5y}D2}ed6asnlqVJNIbZ|pZzlf
zM_KGE)e!qzw`N^#Pfut5qPSU8y45ix=GC;98C5odH&^{y68Iqh&801`uYNWCu%+~9
z)h<rX$KBIsWr>#>e@&^M79~E}Yw5X(&!?zy#yW_6*!RhzGd^VB$2r`4&L8MiYG2<o
z-)}=}qYSr|?mN>z^=0;@<_~<ewOri$`19r+NYDQ2nfqZ==A8SBMU6M4-`IBHV6ja`
z+_VzrDeZrs-g)jEua!DErBAbM(aWCph^k4;d@gE~zgp|DmBI3<OH@D4sl%m<9~ADA
zZun%l^`=Bc_)3%PjSDK@u<TYkRB>#|v#v81!b=^VU)<XCILzsT3X>H7mI)dU($_xf
z3DoRNR6DkPQd#uQ4~t!PMXdK>m}=gsDZg#wMCZ6-)p?Qmj+M_!mS5)hytP73$YPTC
zq>8-h_m{h!EE9>1`)gZ&Jz9EZ#3~h0`!hj*FaK56JKf5$@6X9s=PoL;-OS&$a9cpg
z`el|}-?v&zoxRl4YdfXv)U?9F<7Z{qlx>2o&SgAiihI(`zR|{e(H-WOGcQd0nzB#x
z+k_JqVKE0S=OnBTneqEt)Qv2of4(0tcQ-$nDyon+^<=kc-zTXksa12Y?0$0GDCFlq
zPqo<&(_e?K-IzJ?sqxm2$FC$j4c~Qnp=N8;6`q3YZjY{t?G}6SK34AV-BTxJHs(jX
zo1qqYB6P)Nkpt$ZAKRV!n|f&DvyJTG*QfaCm74Y#y>ni*g(JUiDTj~REJM$-g1q4M
zqK20IYs4ZR&RirVrJQv1Y*WP@tv$Vlb6X}YZ}p6OJGHAN+HChuPWgS>T?WlJRaPui
zzQx0=8}(&Qo{n6>oDcu(_6Sc%=DwUXTUON6{?Xcv9mcyNwDvi(6)Ls7usSu(_Q<(l
z`P-lVZ2o-j_P>1TU*CnQXKVX(H*8~0%DPuQ^X-zk>$Y5cdEjcfR-pc*bN2j`sx^2&
zACS%pmo`c~{N%3Qe)ddflh~ZJ3-hFptyiA6YM*NTvZp;ut=5+~O4u^n?Pr(xTA?;|
z^G5$`?Y~U8;y+9GnMBRz(Vw>R*k93P12$pXId|8YuHSQM&pD+VUXP}!rW?-lI=?Ef
z(Y8DyO8nFP?n|G9nEt->@(zABVf8czvvzT-e-0&u;#`*-W*f(91?{a0ZjVlG&Goo*
z%s3}iT5X~|`#JeG!KL@T60TfXw5jQ6USw0<sVI@S>C#>Q*#7*~lVQH;a!V;a!~Unb
zpn$G${#Bji&P)E<FO;NPvotn035BR$_7A%G{iC!E+typjH*2r*uc+dAouIdVy=Gj5
zu~~K*clD>&?_{^-9$p<=D!uM(^mVZv2XbcUZl2?N>hqK6yStC^r-!|7ZP<S7ZT5`@
zwu4_nWd8d-vfp5A*Lg!eL4V8hAJ(-!TPF$3Sy?F6q`TmGrqRRt^GRz2PK5tiwaEU$
z>B=9>AEeZ~*W7*e=eorD>Sp`f`?u6TtP;q#St+A_^naIzSKRMo8=cMLm9Omk?2$k3
z)!eS8Lyr}XZrtR)JoQiB{w<YfOV2*iX*U#&W7reU%Q?G5aITGvLCQ}i|ME8z)^82J
zBc!Bfv%&ZGm6)9?>e{<M-a7c&eg16!(<kQS%{R~p5?@r@z39Ef+-0XOUyIqjI(2sU
z|ExT*seH?;lJDosKKFKyIU9cGcu&ffyEntjf<yG?&t}uSs~&b|;$zKo-)Fsk#w8}p
zmRxuLr;FO8Zy&9k3X`oTOm*&)57A3hWw=%1{WkCT&DR$C^EsFo=+~ETE$+SZ<=55K
z)7NiX!0#n`uhQr7I?GI}ttBg&lABYeE8MK!$|@7DB4d!{t-<%?=oVFm>f6j8*84JU
z(BOOcCG1Pv4#8sQ*ub417G04!A!jjjrAF6n-<LB4F0tqzH94|-f_VgU#gRG8ttIQ?
z;}+K3)ogp0q$ZZszxdtH=l@QAf7y2B<<?yNC7DlFv&9uIcs*se<hCoh%Ob!3@-&Nc
zz7iC(KTzbcL6c_mdz<uv<3@Fv8I_#V_B?9N+v52$Yw9uMdG2lQopOISC~!-<*zCQp
zAh7em6#w_z?>&6VQ0=xY!zh8@#^Ygb=C*%DtVhGI<=lPSb7o)ZntMh6Uzw(w=|sL%
z6Z;x-)^7Kvp6gq7%$uPjJxzPoTc+%qqH?KQQ7^+Q>a9|wE9$px_`Yz5`*xw<ub!8z
zS*f*q_wuUN3QLp6<rd<uZ<I`*T*y6ec<G^5-nq$B4&2~boSG4HJV$B5S`n$<Uwbut
zU#v7;`qW9gpJPf^if5U97gq@9jl%zDt-ghKZCx#Xv5LLE<4hdSuI7Ia)f`^mb(iQ}
zlWVu&8o%`C^%Fl&Uq5wOt8awY;$Y|FncC|vwTIo$*5CF(Y;EDM<2g@$>&4C5dC)ED
zP3qS9s)Aw1-mY-JH}&kMm*OU8_?N`UZOPseUSc-$w1)PLkp8m$-@{}U<vBR3Un`SY
z#2b5DQMC0-@0`yQZ%NjvJg!;N>{8mZS#_@E4&K^V`HGt*emy?<=lr{${0sHY>~2k(
z+c5oQa8zY;iJ1PO)vjBoEtS2wEIwY_uhUIAQ%`h#XS{jF#~Cd)`DY{@I@=Z;yTwz{
zTKBbY;ywPo_oDyXmF~Y~azD-0!SKP)(1e8*50_ps^Y?gkX=&r0a;NOs2Mm6EXZT|?
zFJgsRz=;W~f2g0_GV8GE+f^cti9#F8Yaa70dLBM8%(cVj&uQ<QCWlVnkCnf?-!4Dn
z^W90Nmd~_GCi3pmou*Lwh1XkRmy^*)gOl%TUjDkcQ7SReL4I!e`TaR-pJ%;2VP(D9
z&+(S+%vbaNN%BSow3aA{x3zVCF5kNDe%seqD;Cbvy00?7M{DH*rr8QjzE+c0-0BFM
z{cf?|@v<lO>dQ}*&iJ@_;-mvAXT(;neR1-2mFvmr;<j79&FX);OW;p_=uP+2X^sZ^
z&emBGPY<cPEXhf{I`2b%#qMPnx4+Z6bZmA&OsdL-C1>`BcDaAs$C+$-Z+_f0vkbM+
zZ1LaO^LZU_EbrqyC$MhKLi5bSvySf1di)`7R>n)Mf={>i-Ey@|t*W<PRIhM#dHv3?
zzsncPt(tBg`OosIlI8aWe^>L*P|^DrnWlec(S-It*0P1uKg|23@8D88|9zC5_{*I#
zn_JfY=UlEE(`WO2P43U*Y3J<rSlifE-mY)=T2`O*r8)Xip_-@J&PC}`Et$)%wfR0?
zopSA!XJ6-*|LlnU6QGMCRJQqE6l7#zc+SMYpo@D-y`U&FH?t(OEVWoaK0Y%qvm`!V
zub{GY!bPvc1|n_mKZ~%J8Mc<3iQ|g%DSzk?IETk^Ny^(uX^+VTQZ4)T#@^0Ix*qrM
ze*LB5eXMWdx67ZLd?wI*#v86He)Ci=>E^6Cq3v_&>MY#{2X9PEiL~^%{*rf3ILG-L
z61=Q+i;cFudv;*q3dz$(3qz(Il&vv(vF~Y{$CiFKQ4eoBm+!|kM6CF>8<iJsy3FUj
z#G*!c*Aa_b){}PiY_8kO9HiVU_rvDrcJ`<%b369fa!h)(!eHL~#~-!zulfFyN!$Nc
z|CnD&Rz&A!^$A-|pD0W)d-V9h8F8i7<fSios{W-Hw-ilyS^1=F&4tLd`YiL@?|kX5
zuDg0)M9w(I^6F{*l!r&=1lV~WdKsYAzB1|Dx|{r{VY{PtuHq^d28Nw{3=CRCg>7O{
zQDP-%#X`7u{$n$NeXqkeoNzRH#c@xj%HWz~bIv7Gv(lg=jN1&D8n?Nbm8S-&uCy^b
zQU89zmFQ1udqdcx7p2*q`z-yc<IcUBUsW|n%?^mloKJo*OO@xzlsTy-o0}g`E_ft6
zv3R1b_qMy4MMjoC9i~|;)HeyuIr4#F<%w@A+)Xa*o$j$wJ#fkstLXx+EpLq#O&8AL
z_B9obsf^pWY`*ca?JZiHzRZb}XzR(IFq7p^Y%uH6x(9-L)?L4!u-Lxagw1lBcJY+O
zuSM=iZ%@<ReeOf6SgS-HYoSV1c1%s>lA_h8mP;?3)t_EbKQm};<Kn5lGkjL8n6`%{
zD<<~9;~Sf~Pw&syTg0x_ecZBsfo8X$o_V0t+Q6r8>=p+#>df8aSzNkI<aUwrP65M&
zHA0(sbf5fu-u+qs^HKR=?&=Vh<~KPeA`cl1FV2wIb<xt-Q+YyIqQZfv`#x`XoxO9z
zwVLf4KkxDNnyQo@bSZuM^aV4QTs7L0<hB0Pj63)Htu>`B%ac4dWJ#o3buqDK8mT4y
z&Gp*#>+!Pq;78^@-`$`5n4-hN&Yr0^HThI?V1%P`26s|O_oHPG<-YhG(K@qvMixih
zs_oA{nKxyh+VN?*->#azIk$G`&Skp)DpvFLyf)SC3%m{Yygj+6Z_l==QJdJ^F0Y!$
zf8+M6<`0k7@7}!nwkBr~&x;vLO7{0@R%(5_>)7@8p;nfevj5_b{tLvepMLSTVE-Og
z^LT|G;XEeW#CcU2`L{|1cz!<TJ&-o1|HRx?Q7cz)P2%vJG$&uDH*tNSugagv#+{Q2
z&zv#xQqIoXx4P`uzu;wg>)z!pUm7<>QS*;Y)qK5u*B<p8|8V8|$uHq&LZ)4M-f`LX
zhTLY}#aq_=X02A5KIg}kFPr068|6&(cpk|$G09%)*4r}eD`%73uWMY1I(=ah!>su7
zGXA44SofA(-I43OVR<#jjpBBOy7xjgJ71+WRcBqUeXuB~bZ@@qDW_>_r5p<tj27q2
z$jN-Py~xTVrO$D>uhrIhYg#?B!*$lIT(N?MU*YZNM-9t%`W$uQDzi!c==^-^&VmC5
zts7>2;$>+y*v5CL|JNlxljnvrzn<N+YO$m2oujLGmCcH_O|j&;8Bx{vBt>cKtULV9
zvQ3)T^fOm2h*p<%=bP@c*<uy5^VGj$N6U-u&rNEd^#A|VjgnSnB1w|zxAx4Ox;0X~
z#I}zu`(~E@;n!yZ<Fn7mf7&o*<=rh)TvzS6_S*B~D`iW$9>#;O%7m70eyFiEn}zYM
zocz0uPpq$m9-U*P^6%Y3U5}dTBbwW)H`cFbbA2+agC&~3`?fEKblm1Nj;=jCx4ugK
zTD<U+&Y9O?4&n8w-}ir?^;6f~=YqUi?INvbUX_;)B`=;6Hd9k$SL~+CX;E)<)_NX(
z#UJDre@%8yk*47q!Q;yBDjwXhcCh(sXzj8=mv2#w<Ad3@hx?CB4_=d2FZ9ohQ@tX6
zd*Dy2$%kZFYd)WSWS3Yb^73>W_ka11pAXOQSo?FKy`4wETWwM4-<HO&EwA{k>E#vs
ze(K(ynUSAXU#{@adi!L%?j5f+YkSMmdQTL*&-`g4t92yqXz7{u<-94+PBVVrH6iE(
z->HRqvv&X6n6ZBDGr^O;tDncCmUz=G-4;DzVqoxR$9wG%Qf-oypP!SO2-=o6HRQej
zZ3BV7^Y%Ydvs0Pq#8T69#3Ug@K_Ye0WV29>qS@Zr&u&e8E3zu{|L=2U(UYdhN85#b
z{rU6m?$6fm56;Y*Hp@R<tdFmcFVVvJN0*!Dih@Qb)8Z*&I-4rDu$OP2U;l>N&M~uK
ze)yKd*?qejCb#*f?Wmt3@3J+lSmX4rt!s~MVzJAgvhBc<kZF<YmUJ?yoiEnYedVV7
zw{PY_Q?t&7eFuLqs(*9p<SKop9Cv+z<JmP)t#39RT$M9LbLPBR0+V08+PHgHsG82-
zUqN~^9$f95w{4w?@Y297r@T{Q{2C=Cg4VPp+Wo1lj++-dXMSw#y&BCwKle^Gm{FO^
zrjo=u?bb21ZK+IFu0NUeMRx0b`Ba;+T|e$@(@UK{zn`w|S=5<u?7+$(rkOl{y>^|I
z?#+B{$NNcp&C9YKPqyg@H!nKp&@0bXFk{W?y$w5*_5Bk6E8o%RY&=%GZ0Tx`OEu2!
zF1B4?B)vL6S>Bqt%IBV$=;j%J?!DQizpX1HCx#^_V(LSWZOtZOmwihQC~j!}KiRF8
zmnFJD&1-AXMeVFAztjHg&99k+!fV-@&K?(SULN{RvTIeyzT27K*p8n~_`$?__Q?N>
zbLxNB71g@?Jlq#2&V2m%hcELMeY*eB?#s(-y`^QVc4V?dPn&f1V)Uu%*1RV-wNl!{
zygOoNS<LyfMeg#~EYoGux8|{ig_SlmJ^M6E+B&NLa4lP+NY}fV3PG0*%8vvxwv@ke
zb}TOYuxQIa>B&Eo=Gls0W-z_>R;FKL(#}KgFXxHc=I4nT<w!R!PPEIobNNKe;ssUP
znDRqzWN*HzyQ`$&jc^a&JI72Z39jSP0cTfS(R*dEpyrRHn{QIlOdCe?d&|!43J{*4
zB;-`5roI1oONDU6mz))n%j5F*AHH4d8#H5k+q}qa4i0|&Yt*Wai+}Jlw!1i6ds>3L
zXiM<iTI*z!m>R9hy)EwB7qsYJYKw|KxU%Hz$JQUeK3m-Vc6!;$^|#V4UwomDnp*<)
zowQlZ%)r3H&A^~ZRQn($Gr2^spt3hC*8j1ENbULcI~LoiI4Uy9DQ}EodE>{*yhh{F
znpIjw((P3qk9yu3yjA-5JI?yPr@b0~X!88(n)e&u7pi^uQ}X%mmw9V5)Ly<cSu``r
zaIsRu>N#t!efe_8ezRJ^+0Sbe)@QSdr;9%~hz|bYrg~ms(R-7Jm0g7kG(6Wvd=NQg
zpckT;A;IKbtS2%-=W&<DG2_h0t21sr)2U`vN=%ztxbOXDpTLRSUHiS2GG*UKG@O6@
zi9L4ZdYjG_AI_W*DNLDpp=g<m@l4xi77Hs_4=>FS`E)Ph*!w!ck6N#{tLyDvAO7S2
z`W6jW<1?GQCl^aj^Dwsf{r#m`jryXhxoPiJ5(V4DqeNYHMilZG-)C6A|6bgEU-^H0
zJQYDxS+avCxAa`%5IN-?wn~As<cR^Jb;>H$S#s@VqNX?ZNV4i=PZiL7*mm`iRqWE|
z#_{LREES3iew*}=_elBaNlH?W|84GBX;7l#o5cU)lRJa8=bpSq#v5~`a>V`qH?YsU
zI4RtI(*fC%nEemkpUJh}b}CG@Uz&AR`K5TJi%6;6tjNDNvXu^-@7mfd6tlN2b;9-I
zk6P9={`#MHMLX1#<A0yQ{B>8)`*VIf=W$8qjO|Rn2VMqS-K@5~^8Mns>wn4rPcjX{
z3(v@@sKmOlm@(GOnKR|<MV9CVZ-gx@Z`SOZXBzQr)^bZh9#4Lq;@{^_U;VqTwQco*
zr>Z$I?-{NheysDSc9;I~7t8oPlKCP|Z#wwcaFNxlD|u>LHYn%Zm7RB>JLlI9t4@Jp
z#=?nfdxVn~3$r%;)0yFrB4TLUlVNi2>g+f3rz)qXtT=M^?e_(INAfyfq|I5HceUfB
zjpA(sWlht!S-1GS^LO)EuNIKJQPup$Y*OO>)>S8jrM$kyt4sVY6sa-nxctB@>6x_l
z!7~@L(`FTAm?=A*eZ*6K==jADtGwm=9<Nk2kroVPslQh4^7GpE`r{lyx7*%kUc8fb
zci-#~w-txC2%D)cVw@%>Q}Xx5l3h=1B%iKIf1chQySyO%*x9w$o?JCt?-=ymXI16#
zncr2z6idG?{-bhF$HYn@{eRfs+=*K^N;Q5oIyrUTjycn>bccPqR`mU3ullL_GpE&N
zm*;QVyESaawtzh+`E#5uygnH<g)t*eP{(b_a}TZFvtQoteaLB%@64L`!su{6pZd1<
zFU0ItP2JaVewM`KYxBjULUo&O{3_dP{kLBwy?rsyxr(<sUrqauRCH#ah<nSEHh&@?
zmtDk6MXQ*r8*>drxL?<!=5*Kn^R%^D7#O5^iLDni^GZ_FQ;YNpD$j<+=HE6Gsr|lw
zhiibxtrXL<_gd6uOs`lQ_&mASIERC&ahk^LUYAuWPp?RSyI=0<xh+L~V;q|g|2B_U
zxp}`27FV)tHy5wxS+27z=Hf$@g)y6_1WF!Sq404MpMTTigMxFqlXPz;t$g_8#}nH#
z(?s-E3dsoVS~OFmD29F3q?!p{6P-ntF4a@*RZ6H-T*7u}=LHwzgI5=9;%sUt^i5UN
z{CBQ%QSVx7hMKyiM;!hr9aVm6=kud0MMv_aYo=Lno$G^L3npbK*6x^BzjWh2l}#;=
zUVIjw*v;wRntyP|2H_oD-O>wJh40nN5bET0GOgRv#++}k;^hOA$J`2BX%^ED>CE_B
zY20_tzW2Pn|2n(2vgXBA^$}4_Toy|?GkSzOOFfM;erAc=2sa=5e=_lM*$$oAqK@ou
zqR-X~q`PQ#Z(Xp7tNV7}McYHR6{5demd!9eHnUGD{G!fR$20re+P2(JlWV%H^t{5r
zrdj)7W^0mMXp%*&{*48Se(Z;C&w6C%==U{9MN6Z*CF9k<y+5<$+E;SC?zT=$jp1LM
zHF1Bs_M|1LU5lUVZta*dZN}we6~-IW|MO3CY}cQ)R^p^t=x3(S$`YQ-rgI#Bbgtd+
zB3t?N$*XtY7KjmckvE!jUYO~=v&5~l(@YNk+G6?nPk2J!GO;6R+1(qt8SM{!4^Nab
zYA<MGFG!nwx=?<Oyv{klJLg>E1WpRPpDKH7|J~kYwc9LgZ4Z2XRVDV-t-6@w?c?bm
zGtB;7Vt)08;ZjM>?e>f9buGVkSCpM_bzWnCr(G}Rw}tG%xwlp%>oQN^;><jmd|M;H
zu9MAk|5Tqvsgn$hd#~M?{>c5R?F@Fll<S?{C*LP-*73UW>S}Od?Z&NV=L@qhp2r#N
z>UK>~-Eu2e)>gsLRPA1k`lU}aLSn3MxAMN%P>Z~lk#8&h?wds;FKfE=(e2eH&2Qaq
zES`}RlX)ol)h$!IGp#4~Y<Qf${4m>&q=^?-gj_Kd$rdu>_t!|hVe#`q!1sfd@(<QB
z#OH*BSn4k^xcScQ<I&?YGoG|pNF_~tzI3P98iV~dj0ZQH+Hn5t*jwzE+?3+5WJ2Jl
z9c{BsuW_&&9bYkNl@rtQ=ksQEtkqvWttiH;v%I6DyQOOP&rGWbbHhcmo2@?En}6?0
z3%RdrcJpo78mqm>m?lg3%)Ip7_m^DF3aj!Pd5_HwtCd!#ZYjTV?@;H&-H-pB*~a_H
zUj18|_nO+%MdsbnzLm2tomD+o8Z<4nFFw{|f}N&uZB>uxi48~mH!9R0YFZQYa_^Im
zdDGv&E-5&eRNL?Uu}QS&$FGM+7xxywi+jxX&*;uwu6O&2o*aD5vRG5E+<)ns<8j_P
zJyE7wft`(p1}z`<D>HuEytd=r%IPf+SKiv|xBHxrQE{@UMymF-fEnu-a=y&IS^It6
zt(E=G8cTokJ)Q0I$6lr?`uAtF=Ed%Hd(ORPWMEKdA$ItoC^0WRRj;73HRyi!Z3BV2
z@9~8f+AWj?W94{tr<klsi<SzrFPW0`<j0&0i%A#yFRl4fe?M~DW0kuz<lam!nZNJ-
zzTMmv5qItU_IH|kbzk1%^3p~1f=a>SpH<zLC3pAeC9L~$ujA~sgKvtyNp8|TRKCT_
zsZ&2fd#|#L#gpADjI!7(<0_x?KC|qY8+MFwdXVM2mPuw^yNtJAcgkysKCwvbxP<Vf
zg%{agMi+G3+VwSrJ@9Go`Ta<I-CdPCOSe3C?LD5Z_&@G)Yw$Af$@+W5p7!4S;kIS2
zOR`Xi<FQTiSG(Hnk3O@1*=c=GkAM9u*yGpqWW89F5nG)7kbS!Jp5W3>wSVn5j2Awh
zw(>|<jBwBnn||GES6S9PKBnq$$9K&a#UplqT&&|?ggG%Sc08ZKb2&RgtMl#WvzzAi
zbR5rFV41MKt-$8VWUjPXO%J#Z+4D_`GF>}ibI#Ss+?m%^%O&>9zO&!by!7<#qsf<;
zJwrOzPj>!iy>+Sivi)y+0`qS3XhaIETJk?&iSh3zEtA)LcaszSEb`!dyGl*$;xZF)
zmkkDPGmUM;uYCBtvU7DH!-43Ex3W{p7ieirnZ7i4(Sf6G?x7s7s^9HdXSn^5d0W!I
zOUwKUiYwZ38JM+_6DOQFsb2Kp=V4}E6}eM(LPe+QlH%Lf2F`Q%&wyG_y*Yn2`!NRt
zL#;9cgEmnu(&CaL$R?Y!QrY=;%s&18$F=RB0%z>%*IUXn#7h(6A8m1qRljcGSl#D;
z!7D~zc<qWwlisd<_`l9rMKy4J?9RLf<0h9S&(BsC&anOT?d<9M-_A$41bcq>PoDKG
z=j4hRlOOB!gq8fCX+QhTL~)zj9A$e?o!oqLGjq|#MNh=FD!r1boQ3DDW$b@q65~Iu
zX}za_PWK)G6Aq5(^q40qKEd<aEg!F(<8x--f~Vr^%|H7dyOb^DRb+VaNX`9t<@GJP
zURmZL9txr^HFH}XmbD~j`njrU{MpN)s(bJ*XXE_q-Tfw~>K}Rf91VG^AsUw+(qd^I
zy*{I(Y5wKty=;XUG9TD{PW2z%S~In!(l1zG+nv8Z&078zeQi5kwen<24BOXxnN`AS
zI&4v_v;56ieoTKbKV#MQ6uk!S=)8NLS~>;!OkvTJxc@);Zmxc?d%j=XpPH(Fk7FLb
zkt{vw^-|l@E7PaQV!OeqZUe<>D@C08IlVv6eaE(S?b;<fIgf_a*9L{n^jV}bWzwF|
zT`!yq-U{zz(Oqw&TjMkRfs;;ZrNE9!YNs_HcJ~*X9JwM^<0s>7c3k=Q`IDCZE0-<u
z2|sXh=e+npW-DHyI9{%r0~bGu_AiZ3DV!1fecvzLe-?uNpC>H6G&B1}k!;46OyQ_!
z3r{@NJsqxEv-fhp<K-QU@#}ssoF230@Sc{dtLskm&snM}Q}^AObCznNi?_pOnG3q!
z5l5qRw;fQ`S-OdFO<CI-wTLij9x>*EqfW<NS)=p59DXhnvp^_vJ)5F%9rwSG!>hh3
zluS(J&Di>`T`!2|SO<5<Goi!xULVg|x?5=D*1HF58(0GCvTw5NPD~71x|z}bzVdOV
zJ$xrNuK3vPw(raRIeV+E)z@*IQi;)jG~tfq$uN_~B`bw5gg-eq+b@bIPGh3vgxiN6
zJh}hA@BFb17B(R^ZJKlU@8fU_{+%SgRleTVa-YS|QkIp^tu^M(-6N}fk^eD^)cQxC
zW3?6~JU;pNf=c@DyK;?-La)h8j^%u!wMpla$5!TmDNb)#|7px%IAM{tgZILPT9^4L
zmz&Eg@`5|3FMt1BHA-Of>|Cz-^Y+{PT-%l=FuDBp!`uh4`_i4A<x`ZW96K~i-1tP_
zLp6`XrlF<&p(Y#ZVlOPn5LF7zymYa{J@xUz@Uwo0T@S4CvkX>w7WyaZ>**;`M`kC7
z2c~d_rdE2D2+qGP8hdiv1Dlr|*T3=Cb3Q8(d|p)cbm8Z-ZrypJ7pHxgoAm4Ek@c3L
zUOm(HYrWKc8NKxH=96)sUV7bolX(19@~l41MmGL(e$)9;8{OnDt-jV;e=Maga$9G3
zbV<$*yEkmR4rwQKam?zFnRI$J7gsU2gHykI&#BLD1<#T$-^rNx&3VPW2kZX&n$IeX
z`YJv1fmh{v#|igbO-@_CwT;Wnm|nX0{&&?6J{bWXuk>`Q&!4o_iFsw)@N_Qof9d*X
zB}W=W&MKE4wYqXQQ<24>twlIEf61v8^V65++XS|loL#`Z$whn1Km8vItG}Ide8}JZ
z{z1%w<Cir4ZGGVSOm2%0>vnOLmYxY0u55Mrw5v@>vDxd=Hmw;iry2<cGQGOZXSs`g
z6Tf?lc)|7<rmQO8+T|y2yYw9WA~a#0+S>_2BDrt4o}c(DQ2$icGWfRAWxo?&pSQiT
zTQU8s>E$Imcln30^K8#M?p6AB-cHf*vlUW&>e?A@DSNwCTHD=SIooZnjFjg2U6nbf
zxi#+Im|~z}z3JAx)wkIL;_43kGX5`rKlIuAtDD%u<_0>SezrAJW4-p0<ynzzO9MkT
z@3g6KDZO;vVn=NHPAh%c3%>hr*QKmCzPt9V)wbii?>)|5yU&U*J2_Tu{tDm66*o5R
zzjQ?}ZTZ)zpr+E9Ei6+sqVHW;V*0l2zMbM({_jQyeikkayuYQi;7@UN!Hox3JslJS
zlEr^pM1B7n>)v!D_|h$jYPVIb%}psH+t2kFcrH*4FIILE)-c@6#od+ESsd_K=F5YG
zpRdH4WZMf@E}6wVeYKz|bM7^X=s!o57+A7)m+Vqh))IS{SnJdN+0KWnN{J=^>c4|t
zYuoEDoZg~QuPEoSMD0k5<HxWfXV<>RUVTj#$y%#6_SvrZ+5Js&YL)2x#$7kGXV?n=
zn$x6dx0v;{r0w6{L!omoKdnFf*S`Pzf8*Q#|8Y(Bc+itO`<IYUwbV7O1Al`z?tk5M
zb<sV}NtrXly=qnVRk=iURP9*HE|j+~=~B<u%6*3#%~lzu`0M@EITOBXw_`~2)6lsM
zpC2;c`u<ug<xR}Lt$G$#FT<9)&5HV5YrT5<VzKSUA(@hQUL-yHvioX)8n@1xWq-GL
zO%`0VVrH+FHgDpUH_J5nno5pHo~oT|vbG~;>*o8Kn<{<21#>)!3#`^yug1-1sPXai
z9PYY}_L@82>uU1Xy}wv@@{+zb(=nT0N`}&vYnDI18=RW?f8jT_wx)y8<<ZaV3JovY
zN2b_DyzW}dmeW5iru&NW-pU<8d+xt}alMr1{pn}(W-%TySWx+PlQ`S^|7N!}jU&#d
z)a^TVP11y$=lHIfRbE|p4lhsP5TALm!;zWit5f8}TZ)eF7jPsR3luI`D`%)&lfS36
zc<}{?<08k!O?u57`tLndUec1=%v;*s+THRhe1AskW`?b1Z@1q$F=w5wlHG|TDifj}
z7x;L*@LaTEg0J6=^#b$Mq&IQpuXwn%pWS0!rrZ>t*z*yrC+;TfR;exGs#US;$oDvR
zZOgKg4w-kCd#!l1pvCL*SDQUcIG0S|PpMzS=u#bfq+8|KJI)iF6U1++-?w;j+Uv#l
zwnJh6Wtrr^J&JXGaHxKI6W6bM)-L-hby?nP&Claa4Hol~$T%i@zuX|jbo)LZzW-b1
z7GIF~P`#e3toHbe8Jz2kEoOz!x*Ggj!Q*AFz>Ywr<-aEQdah5HDk?L3Meu2E$HrSu
zE6O=5&8FnvU^e-8*)zGjf1A&PRtH|?vwIfKUYyaZ@XV!J_{xdbQ=Bc{hQ8}7Z2K?E
zVrKlpB4lTf9DBWj#KV9UJKl9HT-MQbe@o4$fS~Wv<u_KYX)(-S;3N0G*zA|`-!l?5
z+2?~+MSRuMooup)^V^p6ipl>OQQJzVwmQi?V`5;)<78k^V_;waA2F9ynwgWL59+)Z
z6%?hGq!uM57N_bXO_|n)dFM+R3haBoe!~>!D9%MK_q4t`C<F>tE@%l`yDBU7+U5tF
zZbYx2-cld`{#Wh-nF)W+Ry_M`^POq0-ZJ|({w)mG4ivaGct!;Y%)hwf*ip8&#j9Vx
zVe+l06)4#|F{7mRbEd^Exw{LVvRzO%nWM;5y`o}o@brl+droh%IUYLo`3vq}Qx(7N
zo@2<lNNmBs`Qh~oCQN76eW5#N>Z{A)ae@M3vo&@1tWwx``4pc`cIKg}Ph#zo+O9Y1
zD1403-aU!C-7oX<%#yy$$-=yX%Y}dJuGU{LZHlq`l(&VhCtHL)7Ho{z9=k=Vd;d0V
zr=wGhD;oFfnh55ex+Sttv|+p4Wraqe?NiURR{3siui<829Um6qRd8mF8#8OV%KBY@
zp3b&A)fc49nwlLYx6f3;=}^>}A5G>FYv$TL{=EIen)m(6z3)oauhf`%Jic0vUzT_7
z>*@0n7F;&+^|$rgcF6X~6X!Fh)b-w1p6-~sBIVtRBA2AFPXWv)clwt$T-$Tf`L5o#
z8Abx$s`EBZigwI5V)^nn_sL7S4M|*+c|~qV-*ITNKN#KQ<9Ic&QFVe#f%cDU&(GbT
zKmXJ7wH6-(mr7Z!`y$rl{&vHkdDC^Z*F1fC{%9<pXbEe>QN^b35iaS|m<j{7oa6Ml
zx@zt1A9dmUv0b}mejH!&;=PVG>-~kRr&dY5pS|0$B)nMhV*9^S7ZWb{`Sr`|a<})p
zJ-V2zGe^=Usw(Tv4EGrt*?U!vF|J^eniElTWg^d0cMpl141G!&5<i0s92R}K=r(gj
z-CJo5&P~!>%*AuqbN)DNxKtq%@#T-f1*wx77an|6xKLrlW+JhDw|~f$H&SJ5<?d~H
ztbF9qj^%6R7p^K?ygB~{$2H&i_vXk~drI4R2;b-}*(ZMIk`e2>@GzDgKkYZP3a!_c
zKb#PmX%G{d$T_nmGOg?;U%-a6-gj(Tq930Ks&AWHmQgm>?oa;Z*3_BrcJ{3-^Q+yk
z>tT|o%Ht~<w@+<|y4dde4Q(FW{cYu|U5pG2nk@LX?L%@(X<kNtP6~M7YijVptj7id
zdw*-QRb}vQ^}H0#$9>Zz$GLoWW9h<bp-r}ZTerG9P1-E&^}km2xZf)?&9(eO9-r^+
z`EFv@9KZT?`-|NtCh)kOmO0twv|!#LpO0&fWC-;)8PD+EdNnCFYDUko@QW!XlFmU&
ze;kxKi|!<-hQ2+JF!8!$Kt?2UvTL$*Z%^ZjsaM1-CT_XI<*CN8%XoKa)3pP<DzbWh
zI~`~KJ9uW6+)kD5sLYbr=f6EGy8ipb&%FH;L;HRS{W*7;Yw}vB%O4-_=Luc?$YKA(
zsVCB_?pBD`CdT}ho9gj<*Sy>X53@JNed#$D#^^ccPn_<JKWT>hWAD|@W_z%2^0iyH
zc&|H7NM>BKaMRSfho_e1*R~7P-gGWIvu?3LQ_s^W3)^{(Im$!-JwCSJwZ)n~?=?kg
z*6z)F4%uGP%rH5)`qMY5)yhnL_UE`Y*$-V-IlLvlX{W&tvp?OB_S8F86!Dx_;I@zF
z@UQ#2B=L;I$6IHgY|duSlR5aivE+4Iu|RZ<+`O=F>o$kodENPI$+k6rLls;D{#`8E
zAY^eR!+U1)l>n0|m8a*PxZHT>vhvCOxflGNwI?ZVSo(hT-A3b#8X@$8@_Rwg=1xuq
zhFm#((;VRF2NC&6S*gh-pp*W$O5QHIz2j?aeB&B<l~j$s$>+W}ZoVaX+|zufTG_6!
zZErJ7L|mN2q`4k6Es(vsxc+`|fg<BXpUZoHC@LN-<~#Ry8F$h5k6-tvz5hJrW7pYx
zsXeP}rW;$ThpYO2&-rGwPbPLkcA#8p-Tv?=PoH-0KNA<Xuf}m&wVT}ruYyS%*~2<M
zF`RHQtdi(03zG4e^d>9Rdzy-h{S+rHCrk0JRWTn<9Xhh{cbUe@H8Zvxf8%}1i}%I8
z{g3&#oY<T_apQ@-F(-dZ<*(JbHcwP_GViH%3%m^F1UYlW_;prBXjM!TIg!6f+?DNs
zSSW*1sFPKU?#;EfC41yPY&fx<?}hG!1-F~-=KVh$Br3Ti{Oe!o<9|;uX?=6G^@{47
z)to%@bG4K9CX*vC%}PVo$Hmqsbj>PGkeImFd;PYllT1RdKReBS>ZR?A+$rx*7{&ej
z{do41UvFo>-oJnM&q6z;56e%^_$}1H?)*FJuSToTN)0!uZ%q<`9ie;=ds1B*mp(i+
zOH8HRI#pBh&uyXp<o7$ahI6lUoSfn*cH+^-6#HOH$-@UNl%fMa=NMk=u@B%>*Vwe=
z!<^uCV&0LPS1z0&wq;d^@hMZ?uFm9o)+5(~l@0!-=CF$|W0<5exl43+2ZsRjA1Q|A
zDc_hg^XD`(e9SP3`p3g}`tk(N>Kg{TdOpUP{Nmc6#IX0#aZ`g8CpR`Nv=6Gh5@J^v
z@RjR~=)y-6S~LWn*2b-zdhp2g>y@i`rdUSz%jC;VHU1TN{O7S-ziqb8=1=zS{XU_2
z@d?(rKV4yO*cP2WRA0B`)4od*a`j@TFUqhz(!G*i=99xB#V5tP&Z^v<#bb^8;@wr;
z%dW2LkT8EEsB0v-{dqDkSC@I*#fi6nG<|HI^L*9E=I0F&`QFZ{d`I$2S6oVZ8XSLk
zuX&U4TkRhgeu+(L3|a6^Y4tO|PtR7jF_^Nj?>lqukKfd=M7OEg@yGe3D=V#9zwfTO
zS|pI7Q^0QTcdS-r${G2hD3#bC#`lVMjW<p!<uqb#f7blfNY*2e`NciOl54M5G>d(b
zsgb+FCbB%rOUG75hC?M-W%W|Obw?yR6Qnv8#yu6aDcY2}WSzoV$4|O0t4>dJe_MFo
zLbI{K$mD>I%zTCK;S(}`ceZ!=@;Y-GnW)cY*gQ}4(H1?<`Fq7zc&rWgJC;0~i+6qb
zqXQR?X2vosF;-qMeMXbxk+%~Ws$E`mtYEXzSa-Td%dAq$toqM0`T6Va-9IavcBrl~
zE5J4W;EtWKYR@AA{#wsizEa!vMu5ZIB$qcOCk<l`D~F!TyQLQ~v88Q=c66J;naz8&
zxT}0DYz<^zS(PY?+&<CzCBS=~zM(+jqJxuDu1qjYySg;_QenVcN2}#xteR(cZ|tv^
zxK(_q^AFz~Po`pfWfp@dmG=9mroOL{TX3z#QcEH6Zkb@i8k;Yr417xtW<8OU5?cD?
z$N|T)he>UB&gS&9Dl&5Z%uk3koBO?s-#qFD=RUvvU&StOK3j6$%sBVt_IRm@%baT0
zvd{UkK{5SWDvvvJ!K7!RpQW#y%=^<>|LoC4#Yyky+3?Qa=PVrgz0S#c&X)6w-`jt+
zc&=HN*w6Rs(X|~b-sZl!`9~*u_p;+V&usX=<*&Z{D!#@zmzOasn0FNU%lZpFeO2VE
zz?=N9Ia9&-&qK~x_BxvvmRYYgeIX(2c6Q^<tR44lb{>~l6S(;@o9XIO8FtR3s-`n>
z6NReSZ$GrE&X{(NcM-pBcaQbI+b5o>T>SLVJMQV8pef6z`J^ON$Cwo?N!zh;(zniM
zN93j$3ZE%(3BEFWHOqfzE2E83Gy19*GybUGxGf^SbP?n8jVVqOuH~N7{C@O$ZvB^<
zSk7$*S;h6PbA5NjPPo2p$1<kX6@8cUl$R{M_HAaC{?X*71)j$H+YY<mF6|CdJ+Vno
zLQUtf^vB6zXZFN@x~6!?LNc94{o4k=x5pkA9^X9eQ%5ZK6<=je<*1Ce9FhBO8{TzP
zbQYD^@85l~VZF~nF6Ec%>K8TN-RoN`-WGjqfouCT?%nzwd=e{e=smx&VuNk%3CEQm
zWdE&S{b+?ELw}Z<{^R{|$EIH>d%N-s$7G>1B6l8p+wxvonrrz>cVTFMapdYR+@JjK
zMos7ylc>6?8L8v(d6S|;<3c^j`<yeAmP~&BhP&s)`IC*SO8g((D4r?7QFX=m;Bl@i
z2Wz*lnjlwZv1nD%4B-v@t=?vFpBlWT+HcTll<4CzkA9)?vDE7B57{*<x_#2k6lMfX
zad~-f``3rgv5x!C6eu)Xi}u_o-t_Us;yryoj`e@oX0<cqxuvVblUtp?k`FCA_%Z3>
zQ*nLG2VbSs43cl#)@|1OU(h$7xA4!Jhd0hF{(JbxlH#ODhWD!B7giP@Our{|aA|h1
z*N-!M&fh6pb}KtLzmVg?w#}#IwwN7je!MiyqKdEQM8((FzX~jF{pI@cu<_J+NAA9z
zqK`f#a7f<D`@i9eXR@Q(b8gQ3rwhL`v6}1`OpzA2rNeekv*z)tWZPFBN!LvuzDna*
zb@yq>jErlXY!BC7E54p#apB(yix)PrymueHsy@%gw8iSZo{mo3llM2C9hshVXM4|z
zg)+Vd^1HQX-7I`4`03f{mD9D}`0!{l&EahK%zasM{?hpu@ejBb^hljA<T!k!firSB
zTmPw@4@)OBeh*RgUTA#gf4A(kdB3$CS=z76<9xj2My;dmxxb7ufA^#^dwWk^eJihb
z?}1~{RpRsBofrImOaIKAg$I?J?uu?mVp;wEdED9~7R81SqI!CDn<tdsR@!06wTY8$
z*Zi}=1!prai>c2|{kG;p=e0AxKM2%)`@XXK+@-CI$$t)(KHRtVp~dv3<R3fip5@Ln
zv|r@Qrg-JuB**P~rGNgdye0mw=FmQc?Exh!MU#2AhfUR6aDsc%CY%53y6TSi{3w|D
zZ>AIXZB9pxUGASaR{9y;zB)tfz_dR*wy$G(^lxUUVaY7}g--t-PT~nY?Jy}_)^n1J
z)BKFfPZ#Wed+h%Ds^w3&etXwd5&t{()0TO+I}iT;<1?==L+iP9L9f~7hjC4>__=>e
z`$q3A+?md;@oU}oQf{#bOQ9p*!V})Jb~Y(lEWThY<}_v31}jsAoJ9rsvqB~~N9R^(
zXLI~6T`lSG|0J98vUrE0-6p<n#mn9s<vh7DONzyM(qo?XpEHHN{5#~w`GU*srB3%>
zyXp!P`^R^e9CgmjvihcZpfj*`QpQ?UPlK3tF9(PCnq09H!mHn{mpr>{r{%@n&%XZj
zF+K7n|GCK)L5XM4>;B}PGOQE($B+@bW&isgwmMUpcY%NAd;GcY`tQ8hk$meqR@9Df
z=+f_*%8CpOlO`}QXyEVorlcn47bTYD7lE2{cWtxtrQIjp|EsNL#OIurdF<Q0hYXKi
zbU${#cH;==wOe=OL>lEL`et4`ESV;^Xsgw~@2kW2FPkl*dirKcr^2$dU8`5GUbXu5
z)wAs<cgx5Bdwa3`XUx>zsxN5^PnpF(TQyJR{PmlEoNTMC>i#@P{In=4{_4-4uCr}w
z|2*mMpJ!M1OT}_uz{&5cR-Q^(s23WzHvEERX6Ux64+)Xst5eLP%W}h4-_$u7{(4p3
z<TX00&9XnQ%2{%@V$J=v0wELU_f858oO}AV>%Elp)>Wm8r+?bMCrti%mhXd-X7kk5
zuS(ZG_`m+kX+fL4XS!-W?y-9>aMEqp`CXqDX^DyLsZ_Y3yUA>}c;sab<A%y3y3=AU
z^H;AjcyC_1El=*n&v|FRUY9Xg)b{J3jK`||+rwY)vGL!eW?A<^AztnH<H!I1e!TkT
z==`|7KR(aie&0_{<-@{{JD&Q~<}@b0J5s-9^|o2zN11P5Tlm&$we*aswWZTcS6Thu
zJ!`w+rN0jOZYOuY<9YDu`{Vg(7Lh-iR>Y=lt@*v-<g3re7-QFl&fPjyQS0Oh{!bGw
z&So@_c^AV!)u-@Wc=p%eF#byqO0B%kty&l3qik_*^`^DP2h`7>Dyxbq&&oJf@o#$m
z{FVhDS2kv(3p2Y+=(v0G^>$<1&PKIwo((Tg^i*4=Y<rl#aM}i`XOV$t(wftzn5>HM
zbJFUWv}*5xt;-X6CcB^K*{gow!p51in*A)CpD&%c;xo^)R*AW*rxgTcwdu$#c(Lwk
z)4v%EC(2(<_nTT=T4Ylf7dO|)=<(yc*cFpQT(bV~a$LHdwJ>4M<B#Q)m**{!dibSe
z%96ewhsjsGLaI)EshqLr+-tULT{?aboWpe{89(Jx=`-R|HEBFqAFsR1>Er$6#vjXk
z8YY~SsZzaabaIc|29e2o7P9%DZj~)R(0i}3Dag5E?p7vVR^`*)?}D_p26U_FPY>Oz
z6nd=L>;UWZ2K9dbmzHbNE>xa$y_S+2t^E0NW%zZ22Wwn5Sq2F;R2)*+AiF2)Sf0Dw
z7VBtZ)0cbyPQItaQ*rJ{yMF%apv*a3p;dq6)XpzEDX*({>8SJbi<g5x-(&b1&2j9&
zqIG(l9|aqwJliKW8*wK_{*5qIsoS9Ba(u&*kL7MJvx8PQtLo>zQGd+0?~S)^$19DW
zmu#LDK5gwVsNqiAm2b#ns@_t;a?xf1XL{x0rrfj%`;NU;Jg&Q`NtcCn;aR&CDY2%O
zcIUX1>&{xpN=<OuztnzrL6r0KTgQ_pd@q~8^)O+p=i`OTzRWlO@8cvr@uvT)<#H=o
zUo98--Ms5o$k#{VOG++Z+u&*czn0VVl6Jns*{zZ<{xD8n$k1x{Wo7@hn-vSs?fUHa
zOYB$5l?*1AhRopY4?ifBy<Bf%<XmW}tikw=nSE_ro21%;TF3Zjs%K01+tzbE?K#-<
zlO<+$%GHB$th0rif0>5qp1Sy&sf<7LP)D`uszBYhM&374PrVZ4`<9Wp>ycP*81K8x
z)UV!Vp8G2QJlWWNCaC|X-@#?ufAGEiWk1pJkGR33uG7(d_XVc7vo=*8Y5N*`;iB8m
z9(i_&p7@3d3!)2{*d}fD_qYG8wOUkf6Z6lvXHM^sWNr|c-WFTT^~AZ_BY)ZkiTK4!
zzyH4Y{@CuzZl@|@*Rrpy<0-D4E86?%MY(m;^JxwbYV<sK876$3#Bueq^daWA$$U)v
z4%)Zt-Cf^1pTj2Zdho0h8iD(LQoY`UG&t@%m1wK;@6DUyXNuAf-*Uc~b(y^_@!CWN
z{iG>x9+#c?SpEFhU5ozt>;43U%@+FIcu#`k^?|4HdZBAQZXRYi-X^tg*}3U#4gEZg
zY+Z~IB^Jl(*MBN1*yPi{Zui?jFKPF7X?Ny*ngR~YlJoeO4Xn$WQ-A4pOf2C!+x<kU
z{r<AUGYam;Mc&!sxF!5Xr1f3qzp0OY-(8$g^x@#TBe(ZYOE8<eLD<sBZr(p>lM631
z<FC$R=~Jt!K4|>x?8S>0y>D>eh;}{S<!d5iKQn&CPxhWVg>;`c3`<u?ZoZJbAd`3Z
zTO0N@LIo2<f93n`JJro|Ak>M;U{&if@vCgx=16^e^^<j5w7Af32J0j~xx~nrga1XU
zZ*#Ug3cX@1xGwQ7GGoixRi{r2g)r%COXzc%`QT+D_XfEF4F%qq+gDhax4iq_%=q`{
z1>^fG-gj8q@Q9!AJLwj+fB&@{iNnABa_=t|uJv6lxaH-p6YJ7aw*@snyf*9BO_{~H
zoqd|2Ix|k1{+qv1vM>EguGww1=Ip91vhSi)*WBK5f1RkHn^nt-d(*snsvoQq)zx4=
zlGZd$M(6PDHLWj_n3iRP{yaQu?(WIW3+8rZ%e6+Wz0DEQwONL(M*mA_+&P|mm7TL+
zKMve<%8t$d@ieict!27}i!$<in<HFm<M&=Dj4jXRk#;)oJN3oc1-@ZdokUf_ukN~E
z>oResYU@OcO`jbsCZ%`R<T=~0q|EtqrT*dpbJl;153W5)Um&ZIvP{g!<ntEor<Flv
ztBpfsz1dm1Y!+N>2>7@rF@GV4?ty6;yk~h#zRxI;ntj|#td+Zb;z2j2rdg$~voG9A
zp5neEajS<cPiA4k@q>y>I6i#f+B>B*Hujmt#3yUA3ukE0%Dnu{)iELAIn%F0)m!>r
z*nZn{LT{>b^`j-H7pFeRJblMuk)6_f-Iw0h3+;BR@A)@D<cF_t!NDY!5VONPo74o)
zI&a+Wa@DlsrkAO2**f1Bow1D;{6RKnCsc&QwH`VUV(y%<Vu7T3{<O5Y4_0+<X?$6A
zz~YPT$7w>}n%IA?inh$@TF4;a&G=xQ71M-T8-W8Bl{{NcI9%DasUdgc)W6wDTaUL+
z`l|7yqvMPeTl_<|lm+`DZ_QAwW6<V#b@QB`xQO<<V`pl^8QrfQ=P{3$+Ugvpn(n$a
zvGwDdo134!p6BG}c<Xr5(+N>>7ydi4ch2X_YA^H8QLc7r{&>st5lg=16AMGGi3u6G
zD;b-_{MQuzHk!YE*IeP(X4CZgyjL*@+gD!*f9tyS!U=Bk<q{h{Y<Qm5WY6Y#@at5A
zUwn5wA1;>u5V^5TKyGLC;V&oWe*C{RKs`X|-DP2IvoFuS1fP`8d9hB!a{c?nS^t}}
z*X&#%b0YNW!E2F?OTX>2FASMs+h_aY?TZ6jzn@Iqyg6TC@%#U`Z{1$tW453~&*5WJ
z<K7jMeDB45uv;1ydGlHE=7*VIEf!s<2s}}I&Sc7Kzq0H1?%i0B%XfkE-S1Sss3e0L
z`xIH{gw<89VwTSztlG7VXQu3e?bXE&ePu#Uy$+N3jE^;*>)K%0u+6P?Q^VZ@+Y&@R
zhXu<w*KnE2thoF!uU_F*jeN$R``zDbGuB*x{Y7Bs9gRgYmL48LUg-<Z7Vu@&x~3eg
z6?>!2db{HKf_dVPraaLz?dsSj^_!!SIrKf3TK}7QH?!a8G|cE>ayGfzf9~RkgSQw{
zyjGrLyy!jEtuf-Kxx<r-4;@_k7qm<eWLVbLrrGay@_eK1+*f89pECsda#^N%M>9^p
z@cc+>Yugn!@2G87r_b+Rl^rzSf5Xr7EeB_8`mD^di}C%NJ59EB^<m2x|Gws*px^sk
z=nRLZdh_kXe-AEMykU~*F5S3?cNYVj-s|NDO#80BT={>xql$~5z4hFi*&%GvhPMwW
zYl{5nJ-M}QTd6I_mj3gNk=LtkytUv}c3Sl!@ptR7G66?%*5fvHX&J&FkMqwzHZ#kd
zD`bf^x5U3F=KW8XWH{aO>DhQ}=Cs5Ye>WU#*sU!ub7|M6w$%=4Up%LryAc0H;4R~R
z=6n2;pLerf7nE3S_e?;2>#wD!vo}62-}vOFua2X*Uzk#9MT)h{ZR=S~XXi6!<y_RT
zDF5TFR&V5ZWBK6@lbILy&3JeCy@6T-yJ7ypuluHMsYp(YFl6^<x>sbAW2V9{RF!bY
zgV!hZ+7J1kRbe5j6;sycL^@3nj1p$Gd=eb_GbJ*ulshb}<}S<25ZkIbp%;#3`suo#
zX_b}zaCr7d$*}e%TLK$xi}v~+kC|;`A*Jdr^Z(d~^6ba?LhSjPYaBdU7oGZ(bH#D7
za1G0ozQW~O)6Z;vT{An!NZRuW<Ae!*3LiUE9CC!ZqUKC2y0Rko_oWX8m7!*`GZ$~z
zXRdX0$N4>P4;1WD(w_6`!;BA)<IYdd;w=+s-FPac`LF$x9ar^pTN)S_Nw%FWnA?2F
zf}MMN)VGG6&m?cD?%<C9sXVRf@$u5<GmHQ6^=Z%9l-|($OJbwox3?epKfZM{{P<<v
zwue^gCVyv_P7HpM(fZG?)w9H~OL;*@j`EhgYvB))r)DnpmNpCsSvJEovO)A_(3X{p
zFECg!2nL+~qpYythC%A=Q!VyiE>9FbwZ8L~h=H8@0aMZT3k{heqRY}($lA`BUEy+i
z(WzS#-!lejm^N^ANqd~XbzxRqqV<93;)znXw@voA#JQkv;?<`~4UYdG*lzr#VsGjt
zWp(H9yt)g=UcOP^=(lOV%i28}uiDgh?47e9v36FC=i(#V{>1LmV31zdQ1P7E>eiOn
znQu>Amz}ktd%3Cw|DPsrp3vTfzs;X+5)v1(@%wygt)<FWSuwN1<<~cs>->K4?yTtn
zHAS`uw;DrR*Gaa|;8YGhx4Lx(=as9gE1rB%YW=Tc!xuei6WiPjIrm#;+cet~eIK)M
zD@$!ZZN+@Owkheg`IVJTZC|fQ@^ZyxYHD52V&sZ^E+KqAFt+4I^BSfzJ9Rhj6neDg
z;60|j$2PVeZR#;%={n;0d(F9vLMLvBnq9a*pJA=L%vyQHyYo-U`}^Nl_t~`3TK<Og
zs<S?8uf4s>ve@<sztO|HI|Gf4O|#zla1<{P`Eo!*Tg&9a;x88x^`aD($d{fJN;kWi
zaVVW_-j5?D9R3rG7waY5Sooq=#9La<@Z-drI{Kflg=kthE&3cBCdTKzOEuoDC_+g#
zJz@Vrt!Y}^{YO4^dG*eTiuOsnwbG~h(XISTH^h4HHwZLr|FZu7DM#k-oWG|p6;eIc
z;-X@bw}#ztyToFx1J^c9P_<>TQSi>nxjNy*%!X<`UdO%+gWEl#7h5!(pQUFn@O;SI
zeNe4@No@Op55iG9H*wTFI<`6|gMphX>=92#%YP#gKU?$Wha1wRPD?D=Xpxg{UD;|M
zS!w#>;q>1-Ok><<EY5V0kZE~!Db+?#><&}qk0<vhEf*28;NeR;e&^y=&)S`q41M=X
z8@g?G&QfH}Q;&{Xb7WDNwm?@<?!G9EfWBhCQ!9D+zusv+5Ga?W85q8GQIVf#RhsUX
z+`9is8jBT_^OW1BP29kG{`H(s+(*2U<ZdjHd;jmsTB9|7r^RN>F8^&%yLT_EdF=Gc
zS=vJO&;PQW&W%$4_2AO&tFtuE*_&n`x-I=dG+6EIE34gJv3)yL_v&drvRl8n_41Sd
zK7rG}W~{Y-?O1%~^#!JqhN`(d0jtlRJiOOz^X+*r-k<$u(wogzud`u_U}@0Z8NrIy
zOHck^cxj)+`|AvPGSX+3wPnV?n8nVYcKq*V#~1vY8_lbKUw^-Ew(RUzz2(`a=QlIy
z{8*Hr%$K=JZ}p<bZ~U~=L^`7MlQ#r7bSL@z{?FXReVFS{qvQlHnTy+GW%~DrIvlI1
zGqOIG93<8Hy!PT*CTlZA@hRuHq}Jco^lA8SWym2Z(spgFlT)biLLT1dN0t->GJkp-
zwazc2`YNZ|)3;_*A1!>I^yiw+5v!7iH|{0r_ipf==F?#yeEvuI!B+|i=lxvdW|T9w
z9@}-V$*4SRKc~-@AD>lkxXzGR9oRavXZFI6YV3jxrwVV!B(^cNFg9y1P+Ftp@Rje_
zeD7bW;S=ucSeBg4*R`+ayX<6!^b2Q<*W6#d=IGSOyNANGB44N;O*0GHzWrnbN5VOI
zi^>e&xbk^UEGb>_0nD|#-8R}gW+X=}3bftzQ#JTXkXP2MoRtjxFBCW3*t(=N+9)(J
zH<@LkuuTw4>Z+7EwQSRO9=pSQu}8??tW&%qEF>$L!?k=-$YqVI^G>P;FkbiTV_a2J
zcW{REu|=;IGDz+)Ke6Lq5AzOV&5evkO@IGyTx%R#(j0qXp@L%a<OgeSDIE9K+<au$
zGAn!gaI2nNi^aK}x07<K-?`u2wp;X{zOVV=70k<=*^I;Q*eyRHzxk5L&MbeSkkuxx
zzL$%=)}}NZ32u$77kqhG`-XchOYGgO@V;rTY-KmqG6UN6KksBbevNyzoYn=GOSS#~
z7UT#`xi4~m)}*g}{0&y894@82-hS3{((U3;`i4v77Iy4OTE73B8IyaBWS9Od!N0$Z
zy*F}nmKZWl^_BF!Txf7T@3D(RFxU0_N0(I2+@rO7D$nxGcSVgZFJ1MaaLOOq&Xbq3
z&Lmz4;F~EZ{9tmYTEfb^v(DH4ww@Bl=XYj?I_ohDw<EI2Hu^iKd{8%>?de>&Q+k0$
z!b!7TC)So{ZR;x7d!N^z-`@I6lmDrz!wj0~3#`)@-2EUR(A811ReSOw-xVH-TXnY_
znP_+9_&Oz5-I`;o1WyYeGU|<!I287$ZDC6Wt3i}To`X`2c*{FK%LKt%;l5u_PuzU=
z*P!j@s=db*IW}Lloa)hV>)oOFn?_Zw-sW4julh3W?-q~B)Q}K~r6(<|`vkhbAG{p*
zbe{OM<wdJ&MbEtpD>k^c@$O^2x&J#qmwi*oFR89-K7H}fqph|MvRn5tYpi9rW8A<W
zuz=~&mACG%PjJn@B=jx*$5q{X+R3W^hkL9{Czz`Jl>G5*|Fvb0uWa6PCVLytGMyI_
z!=oBXg#VVWS($S+IREOGjfP$IuRLz8b36Cq;o-S+dE^cn@9&;yn31)Q{b2AkiN1NC
zzRLyIMmqfa<)5R$5_{2Gwacc5)!T6A?u;X>wpZ_ETsWQ;cb7l(Eu(C2*1lAG_t0q3
z1FWg$-%O)!&wQA>YuBwe>lD`bU6y`mtF@)M@Z;5AZ=VZY|1h8B`F2MM|M%H0Rlh8C
z!tDfhEdO85c>Vd5a>u8Ki_}D>{4#tImH3Z0W-fP^(1!b~oo6h&-0}Bc=vIgL_VtsC
zlxC&u@Sd_z`G4NJhtp0SI-_$yW6#|O1~m>AK|fm01erx{wQqbF_UE6V?~NKix%S5P
zdpW@uVxzvT&_25FWy_Hh7RDkug37x}`<x^_ta4oEuHCMZW*K^JLjBu|Z9J()Gb{tH
zd)(;Ptu8aYdva3$nLR1@{~X%*;o}9)pG#DKaH!3?@8MOX<Lt48*|&V16r1ECW%r|M
zyEh%E*ta!G{HBbvUwG#!)fY==WDDJseVN5yyQ}lZE6W6>fWH$o=5ro0_;p}%o{{b$
z8zwt5C7r;!<gOpD4@)WiE550*?AAFB_KD^f3%~4+d)8#WcBNsS(}G{2BC9H2Hcnle
zxypB*z=}PchpxP@S@d9@;nWYF41M$58$Zq#m~!n}@ckXP7^C*zw{6K3l<X4yb!GF}
zGTtNWzxOEfR(-iP`}md87s?^m^~(kB?YYNzFF-d*@||>^{$HiDWxV=Rczn<7ZGOKn
z^TsLZTRBa^*^AtYTmI--wbb7Bm;5MZv2|H4$E`ixP22K$Uo0%QnaR9=<KdI%_)bVF
z?QA~KFL3AG3O&~LJ;u9spX&Oj)hW6r&B#)sXY<!b8Q*LK-1R<BOEeET5MH`#8OQqb
zo|`tW%08_4vEb^S7h=1*f|_0jv2YkzsQXN~b4X=Xt=8&K6EF5gUDG&rUeHPS$SI-4
zmooB|3u-1@+P0X%CO`CDXO!Y8>6Ly<=lJN%S8khkZsU)g9G+VQRMwq4*lVx7w<LW1
zo0VsxZ>;}ZpU{^wwf4b|IoSrX6OI)1<y5Au`@&kOIc@*;3Pz1hcQ{@#Z2tDTlrc=m
z<JtvTjR_Z7E*$UD^iyV9VGu0p@|w>kWa)J;<KoMY|Fjt8zx(ODe@jOA7QHj8FITa5
zI@>z@`_LJG^QCCO>%!&)_w{S6n-25^d0TH;$Ci8iU5>Ko?cLfc$p=cN-EJ3Nt>OQ*
zwNdPhLFF`?iBIaJ*gvp;|0lXU{rt3tAzMp6MaHB{&p#+Ec)?<`!-P3=^wq?FEJ<AF
z#wq{w*#@I{R<TcsZ=`wx@44nVPcD1g*Q^#~Tjjzkpnl!&V^fU%;{3g`{|~T#ysv3j
zV7No(*HPZ-Dp`jg7F1V>^r${An0xf(%JYI+?BCR#Lbc0haeUj;UU_5FtiQsG9#(xW
z%>8-I>3eEB_kxTmlH31?ycO7MbGR;V#kxc1)31r0*l8#(T*P|mU9fcC-iZIP@gYl2
zXsT)dcBtGM`s{4F71!<Zq!k&tYN1)1f4YXvJMHqOGl%E+9hnkA2}dst-cLt0pLg7u
zo_|$sYV_m_)qI>CLX6TICjU-TIUd4&egEt;iCa#~zpMG|sCc>HYC=!wzaF#u_0QUW
z2OqM%^{j2iKgMD${^?aOWBPJ;KK8xz{(*;U?6Y}`F5Qpa{_(Q+U)G=^o_zbdhfP}V
z+ZI}WE0HKNy3rSV+VO(d{f8MF8LLZT^ZGZK^A%~YDa&yTTyreJ@?DG|yMp`F4vu90
zHdQ&BeT{6^Z5_@>lS4O2lrde|x+S7AU`6D04Xc&z>JR%4-P*o5`%CGuPrsrL<X@f`
zd;eQiYSilkf4h`t1@C#Ws9d7&efqqE^$*{kF~6(vfU#=Eo&(BzU%cxrk!|}r;p|I`
zHU0};%q#xrq^f9FQswhw#`!GIbNB7NQ{G8!2~WM{ZKm>l#w<zR=ELubmalni!+z)B
zZPA}notZ^<i|$>#zkj>q{Mq`(CIQZeYv0GVvHY!jXME(m?{oe0{JU=%7~};Q@zx%S
zv`FK>7QR@b_|~;>zHhDfF5fs=5a06o(bfz-LDrqJGg^g~ZnLy*yd-dc-cr?r56|58
zU0tEZnPpt^iM?R%iVRkr$RCGK$9%WHmh)jtBXiXgg~$3OzwaD-Q}w#;{+Br=x7HiE
zXPe(O2sQsAdB$99#h#-}O4-WQH|hAOr!8B4@(RbSk7X=g``_$0SMa)N*Y0vIU8d|p
zb^Zh8KBl_7sP6~UlE2T=&-$<Ot@OTO`kU?BZM*NLcM7lDo0<Bk-8XRmb33;a0XN<%
z{3u@(mEYZVFmFzoia{Mmm7%#hU%rUm9_fHjo8{)W^v+k@7^T<57~OT_<dxJrncRn0
z-J0Y7>HV5X-z7!&CZ<f6{xTtZ|6PYo!Z)WD3vuO3F1V2sm@%7mbwMLz@9e{08H3mT
z<ndA3w^c0ry|nCqw*)me{q3ejr!2U9)*0PeU*;0W@lnxY&r50Pef}-8>W)b1H*Ia%
z{Lo~b`BMYi*b|P;l^?b*%bR)sU09O!AL$K7<>DL`hMzW0-#q=%FIj=7HEgm~izX`v
z-Sbb~cJ9by_FKu-EQ?Hz{r|c7{_cCfL<@J9%Kh8YxJBy7F1Kk@<&Ip-m$4Dwe_tWv
zlJwhq?|1ac&zxSGblyJoTlmgNtm{v7Z;Lgbyndh6`P<#^c%E(e)wO=fkF3(I`+jj<
zVgB%C_5UA_>;LVZ<0o|1<+#E}vjdD48azd_=AJ!%et+dhTbl{Gzc`{#I98g}xqh6P
z!1sLj6O%31y0%)eXD?i~XruUzugllieO%8`vj6eX_q*3A^3>P9oMLApw=!vgkKfYH
zZwvwg+qBL`wycz%*B#=u``L^oieHsyF11-2EV`}F%Vz49_`Nrc74F(U<~7w_{<rY&
zvwI&d-1t2^{kv(L;H>jMZ@C-Cf64oJi|dCw1OJ*{%ZKrjFPBTosp)Im=xtfC;zZn~
zSsM;4xt-wg)K+I&!f%1;Vkf5-_5IU{RiABieCby8r$2k-GWPtkuUFpq@xg)nya9f1
zb}Zk`@!9lLRT<mlbI)@76E;odSX*=H?ZgQl4tMUAdD_3f_+pXY^ndU4TO$wG6&=>P
zu=H@^jjemHJh%C7RQKY;FWsCsSM)ljC++wv#O#*&O8)M*YY{!Ud_R);&8EBO9w=C`
z>vOkYhXj{YR;ho<ilzhUN1kfzDrmDy>kHe#sDH7g<iW~S9GYEqKVBS~+-tP_<BtUv
zj`<%Pn6s>W!tN`4m%Ha?|Lf<G2;uN4h91JR|F<w19$vfIi)Ho8vkuI&zHgo6<8b)R
z<SFy#9oaR{tK-B?>r!rmpodQtE=&*mx0jpmP9C4$$G}>itxC>6CrR-X+poTNCM;pw
z1%16OKUbyyZ<w&>=k4$7)t>oG`=cdyjr&@~Hp!3__f)2}mjVNJuH`kGyNbPATQ6YN
zFN;(*$xUZptXQJpT6iRFkN=eK!YOlf#hBY$4qNN^+8xh*ckTl7shcKo{N=Ixs>3zI
z*~6Y27cp%4=zd_$iVbe++Dn(8%5D{(#P`hgv3Bg*b+uO|V|QKn-Zu5Nb7aAsjg1X=
z&#%4N<)5x#b^6a^hyAzKF4kQ=<B08yZx3S~^z>P;IR09=w}j0uA$+084&R@i7s@I%
zHT(YQ&y?JJtgUY8>93zO_MY>Xo1b@Cxw`hqr%x`Yzi$gyWQuXIaemp&9n-%n;_S!b
znKd(G^3_j%{ra^md%fhAldf*xC#>Eclet4WX9oWlufl6$=TGn-{CK)CmpP5Ag8S%}
z@3({aY}j{lIPASKC+u9S?88MVx0me|k$xEvthPy@^nvo9&c}{YJ*T-tr$1ZS%IExc
zTbpur;08Y3hqWt?B;J*qUm$y5axTLay_~w)_8U@#OUwN({`87jxA9)7_UmFUImWMX
z5C7hmh%9ET7yPqB^!C1t<JN({4A}lh)-iWS2;6=$=MGbDiD3V=?{Q_j<TqBF<lFw;
zE@tZD#f#;=LZ2+<)i}XhGeb4Ic$K@$<9T%|-G9{gSMV;o?Y&&W^wmOJo{DD@{B<!;
z*52azr6?rJGx79d3lXPxOy)UfS_}Avxhg*J&P$i5oO0Rt=ALy@Tvt`C*iTG*=KS*e
ztZj@p#A2Ssxck<YA3IyHyO%BgLiCMy!8YHYKmE41DAVrnW=Bc4lUtWt9DeM+IrN^q
zp2W*K(;Yg;LXO15%QbFFt=n^~TS3Ks`SrI?zdfJA^OH|M?!ugDn;oUC>{O2b3ly2M
zv22!S)%;)gjyTj!?G5+h^RsbH;5Z(0c)q#&Y#xm%azC|{-(Kc^zhT8{S95izuOd85
zos}%NOD;9<eq*|1#-AIE;=eZTyY*>7;JcVp&4;&zsaLyQn7-zq@1v`M3iJMLSh@W0
z6_1LCck;t$KajS6k){9m_Z_dcXDKUElh3~sJ+~`i+PYlFiYdnm_1-?z`+Kxi>{5PA
z<x+iT!-W9{(*w=cTgyBMbTQd$SYLkX#7u$I?EkJ`C$68cZ{=$KRW?47a|3VRZ&!Mi
zURmcGs<M2EhS9SNYcqF0-L!w!oHv*Mu4>7zNvpLh{V+S?-94vg_e~B6rxeBXdKkW1
z``qNQ{9K*YXZIhuRBpC^@9F=Wm-qfO-}7CqKawl)==y{EpY2Zjw)9SpBd=c2Kg+^m
z?lm$NFR~5PFTH<$^WBUGymRBFHyP}IE54+WfA^*5#j35o6ARWi{J7BbG2e#kOXt;F
z^G!uss^VWc%7(f0TO}HwRC|-vD!=CS$<rq?RVPZZTwd+O+oJvA_11!E)1xO!9d+ZE
zIe+U%>8gc0{$>SktozVbdRbxJx|B$_6OE}#Y{&ejznk1>ZJz%R>27<_*=(z(<pnNf
zWMH_$%s^;|K}u$EVp0xx+4Rzhj@h>z1X|z!)@Cc}V4YTQXSPCX!t%A5x7ZdrcXKA`
zp1pN>UD?&SQ@j7yh6lazI;PnE&e3D>%<ucQ7qj~JpML+5Su{i9acJkU$x0=fcdl-_
zk!a(e_J~Vto1Mk2cQ$9z&EG%znN!DnlkXw-CewgNa$DD~HsFy<Rc$HS)?^djn=kXs
zG9WbixuaC_-Y+S<+#iEJx6e8wrsDj~XnKyy;=6y29Qs_i$v8@~e_ffxy!*TEJGwYd
zOR<-G|M}?h-$$Qcz23jFp&(B5Rn_-PzQ4D}*DtxvHp9s~EkfvYubcVK9PzKWRJB%I
zc%L&<Jm@v&;;_rfM^A7CC&=?eJvDh?EAad4#qX6|d(*90Iuz>aonFV@a?aA=-oCwH
zZBFv3*Y&z@IXildKR9N&6^7ZkcC}<2EPiBT@hml7U;W|Y);-4Ud`Zb`-(79CG?e^y
zN#w>hU;m`Qs=UcN+2UtkQv9Fb6v@t#a_hI`^99@$BE8jmm3^PeHJeWvBy4X}|8qB?
zA*wvFz1m}1$dA(PoB!Rv>C4kuxn-_-;rT%SpuLrwrtfl`=kkBK)vkv9s4Hs9OOl*V
zGB7Z#V<fnuCbc3twV)(3Kd)G?pt5&@ZT=wxfwuDhU6UgYP0(oR<#l3LnGo>u!qp@C
zN3z}+r?YSUzt3%IROl;q^E;pH&cFQP_hLi5{q*SD2i>PgGtYl>(n)L!&#u>jW}$1<
zt`t=WSHBZB{hAYJR%*O>x!e}#6o0mG9+{YFnvT{>{SNi5I(7HaLAjH=4otH9(0-jy
zG4h*NX>;F1Gdss7h4<&z{OI!&@A}lzQy&>_8*zD)<HyUb_optMbNu%Dk8$q}<a(!?
zR@*!>Qd*X@RQaD#)H&N<AM@%|FX;b2^d2=hTD&|=k1{hbEa75cP{qH%C?hqeAhie-
z7PVoy`LjI){+(Mdv9*gq*3I)5?@PZ|PcLPc>@*3wvr7H6Q?~Jq+X>U&>E$VD|Nom-
z&X}CsJf-E$8Jo}F&TM%9@a4z#?<ZI9I}-HpiQeI$&vO?0JV-t|EqhMP@#*)fcL-ix
z{bcplw%4au^G|+#`nC3qb%Os~RlQCWbhoZBOW~2adF*qMrrCsLm20y*Gr4MlIafAL
zU3$T%IB=DldSCR-V-BJ<f(Mr+1ue`G`H<Q<)il%ey;tw1Ngn(2qZ3`0M~8iQvpD9e
zn!wdZ-Oi8KxBNLOS2^$c99`GI2bWeI&DogK|26yQX;A~#;GnaKQvUy|_xR@9-M{yz
z`1^<QM~t@TPB&?abj!0`vfQ*QT21-;w?Ew{r*=J98E4~_Xkx2>SmskxW^Zc363(4J
zqJkuh_iz1n(q`XtukU@&J`1ST&#@>M3|tcPF(@-k&#)kF_M~I}Q9)k(N{26K&TiKf
zdYQa<#;M3;7O&GAf|oA3zNzJAT;jc7OV08Al?yeiJ2c;P(vIhQ`ClGTS+(oJ$xfDs
z<ufej#&{$g@ZM1R`aoY%{{n@Ud7Ihdgag8Ve2DNm=Xr0>pR}*mqB?APZrQurdm=*<
zXR@BTs{6)KOU9IAZ`|BDXA0Zzxo$if@-S#hWYi2ppX-ZG1gz={IBwc=AkdI;zq`-=
zg;%z$<C-&flhuX171y|(q}p|t8E$O&U4Q<Y$GUSRCoe8)uIJ3X96xK>`Qsmq_SrOV
zulD;Um@oUJnB_K`=`$&FEsp!gF5LEY%`q$8Z=U);XLa4J<p*OI`mK!WshYmaRgh;{
z*Oy;&?Pl*<l-Kk0VbvD@qeV+g?-f0hjA#DkY4z)$r}mji*T3|(*;yLjNZIoIPi)zd
z@{>CbO_sL$Fq`-8k#whf2C~1|zo?a%%j;#OrguGGpO#y`dhgS+?TMj#SKJBmt>QLo
zn!okJi~~*`O=`b{7kf%CF~1R+_K^2l@V|5SB|pyoe@-GY!FuO5#d{~OCS2@!uQ+FY
zYVSVBO-na8)a5<;?7pF5WqW|gI?;CJHuuk0*$j6F6wB*1*csLRasFU5W3J{8@BPQV
zcrJR;Z)y4Le}<f|aoWFkyh1nj{@keSRB-I;XU^*v56<A7Zya!2IG|bd0`Iw+fc1A-
zzy4nkcQoSK@6~Sl<>m1wGKxKxwZ2)$J%7T?-ItjEy$bp6Zs@q4%O|_FF+btp-7KFI
zde_rt`J{w@Z2xiT{c@`tCd$d8;VPGM9Pho6VS6aBQufnf?(hfo#%u~-W-(pKzV@r|
z%u&(WsdsEH%zqa4Y=vXKPf<vT{TZEbQ3)QAoj3XZGozLRc3Sekd1M$EoU8DiO$ypG
zg1+NUub}d+ZFcc(i%IuCYa4tE4Lo&fmrC_-i>noR!nbc0`U*W4O3!<5qt_;;*qz*U
z<zu4z<4^Vb-yLgaVC<TrzInTR*w)z_Jr?Y~_(EKYH)DQnP5qzk&E_ZPq^sIn^j3zc
zcDINde=CwbJN?gtqhD@Lt}UCg-rTil@0uIk>F57fF#P}1IalAZ`t)g=WW)VWGxx<g
zriXpZ_{vf>M}P99vzJ%2)PG*nHEB(X=$9Q`r&7*|m71-eWYc|V$*m1NpJyCjb1E`0
zUFVdU&PlDfHQapvnbz!SXn(euxxq>HQ^~KCz$e;bZQZ+8am%&oM6Uh3s7Wp|&b4Dn
zjnXZj<*#JV=S@~RKj8sq^xDOXp0NIDZ1$Y2eN|@SlW_abm7%Np7OV5vE$3BD|5E4F
z-zgdU{*~4)ugc@mAHRRElwy`;V%>6pFKxB*1LglgdwVy%*!9wX{RV9_`}=DuEh~+}
zoFBwLtMRqj;QnFNgNtX`|Lr%`=Y8NAR{VOQ<GaqLCHL+ex^q;&`?b{0h$#R5PcypN
z<zKJ1(CquXrg3#<_fH%BMOykMx$7%iihuOoU#aHVxmYWtIr(Spp-Dzl^pkIvoxE(C
zpK!EB@M@;0n1SX?UH<$ZX@|rzLqct48+_fuBDKlFC$QnL>c{<aHf++G^u{VO$F4Ev
zg`$^@WrE`>QKea5jeiDg<9zMI5ZwEvS>6B1WSI|V99K`6#u@E?RY=u;-x{-Qg$7qu
z>+Agq&)#=s@G^+Ksj2#R|GodA#qa(5>MUx%Uzhy2D>y@Tp|j>sLnggLU-sx1O;UCf
z$bYx!(XJ`+d5aG**qDAf&%AS@bKIWZYaLCpObd^n+_P&z`47wab*CKKX0bm~+_o>^
zm3inPosPY8en>GJ{u2*R5dM>&5cXI9(vmj}V(MabkI&bBlX6*bCS2y3KGPxfgu4eG
z=_Z~#&=*@Mwy|=`G7CNfSHqf<O<jLuri<<~5&gF)yH1aHo2+Mq_}sPXItFp9(<e82
zuuStdtY5!0_T3D-goj7Gr)*hxIb5OkeZcRBZ>1Anw+bye-O1Euu%#w8PO4tpX&%S+
zM2X3p-yFB;bU!xvqmKYj7T-4elasV~+*SR>g{Q4|z94VsoOS%o1M6>mXU?yYbmrY<
zCFNhb-nGDGU(><Qu5oK_>}~nr`|&`_HfDE;Kkvml7*+%xy{O>RywP#>Grdg-*Ic7#
zUOzgg-F05Li@c2@_syC}?%FvU7X+S5$eF-ju#8P&hU(+lcX{^aSZ4db`rCZ>)hfRr
zgTKbvO)`Z$w^YCL4ozR35zF+kvQdaX{zSpVqYTq?vyHUeRFav3&2o!c=JGIJIb*2K
z_p*}rTJ?0frn@IhejTpsl;PRFEkn)2WJ3HKH-*!jeY@`TF1=zt>7H88!P|NZ4;uge
zyGM_!X0Dp#`J#&Y4|irvR{l6Gb%EjqxjhN76O=D9ic2nC*>f(T?SR--39rVRUY{*J
zcQL-tJ88U)O<-yR(>=w*`wxUn7iczl5WXks*+zzU>Jpx_Hg22Sz__4HN~6>0hkOwK
zr%yk{Y>Wg%x#s_goZzx7Ok2t9d4got54rO^5l;e_2{EnsW8?nECd5DIM)Kn4FPl_F
zdA75h?>Se+nCv6QuCV*STF!mUbGCLk9yDES-m)-1f={8F<rwS2b&P&SjsiziqQVZQ
z9M*U*B*E9Gxk});=$XU5-JMsnWP{>et-P+?jB>f~<c5gy)`yWzmpymh)pps-vv^a`
zHI8Gw%h+nwqJA%WCfB_4{396^uFgGe3Nl}RJw0Bm?Go<$FgiAcSMY(<V}ZBcdpv^l
zHtKE4IJ)#8bKcAR7O8)?6V`S4erB~lp=EONW=Dg=|D1Wp9j+$^gm*XFvnPu@X}!Br
zv8S<%*>!Q+GS`|j3L1<Se`Y-1ukPB&%{M_)+E4AtR^3C3p9_DB=}*Zi)m*gX$ui~H
zmv|IZ3ar;pFyyg3EGGEJ`;f~8!D`)%SsSbW3HWgQR{Uq2cVqUm193)CNwZ8R+iv#I
z<+!eRWL_|j#d7=So@QCrQ#vy>)Sm@)+PL~eyjkev()BO6(br4KC0XYDu9=G#XFoW8
zdx=iqu_KEnWv~|RzFr{L#P&4Cr_JE@wka>aO-{QYw)Td2hfZSSY4_V5hb5&uGnxF=
zIhZy^tX+Nf$^zCulKK~v4oGe9GGee=F2IqxD|%Y%PJM0XCHF4Zr@U|brny(H_wKvf
zQ||~CbN9zxSh!(r)TVt*o}!x;o!oGbS$rX<LSbmGe0$d<ndVFed(DDHbq~Dym706*
zZ!DS|dQn{L=#EeOZy9W?`R=eeM@`4qV8$|oU5_%oG+U(}G9RjvZDtpcm2ptp-C0!M
zy-+4MB{fwdRw`Sgxk=CW&h6Wm>o5B>OrB_a%*3ikLU_Xd_y@jHsn<<+L`CVYyJo<D
zz$NbN@;4Uh<~Pn1hBPqmdQ@Bz_@*y7%(dc__Pzr@c;<1wZt`gsHTY@zNBYdqE8cP&
zU3Oj*csgm%We-E)v(7a??ihHcvK+}j^mEer{4L8r8Z;&)M;uu_aj{0`PnW&btsNKk
z1*LCXG<R#Nz}mirWiAutJC3XFnB|wZ)@7Z_BSXC-Kd0<Hf6yS7v0S+<bTYroI!~K}
zH{3-h7#)>ZE7S5L_MVHe>LGREt4(`6xP;<)e?7XnRJZ@oNlBiCdc59OoE$cYy7o$4
zuu^oHY<F}e+gkgS#yK+{c-}rWd-Jj<3y$714bU`}O2}Td^l|dB;F%4XnOB$|SH8JZ
z6{WCQ^HOs`iPpbw1!5X9C)@s?ViNp2F`naC!u!_hFCI*FvrZi1PpDY2(C(7+%L#{X
zU--!NEWNv!;{+#b-Sq`_(QE&i9dcE>;9vOYMJ~Jh$HmVlSKPY!hHLZ0bJ6pr-Qkbg
zvOR8MHKR}Cg-L0-8zxDLPwZRB;VpT4!P*^7ck&zVDMsyP*t)hwb%M9k#x?uZqvYyN
z)t%})*pl-}s)mK-tkGWGKaxKk-*7vMm7I0tyK&D}@WY1h^15fg7aww;_(v_6Ng-}d
zb`#TKA7;haX_fQmdNlKQYsKZb+>zHcc-zjx&9<0v)`29Qnfez~%=mn)6p95o&-e#&
znjK0xR<v?5=l7)FXZAH@t~PFp)YmF;pH=9@JV&SGbc`dz^$p9In>!9z*GzG-J?tvD
z?&eATsBDun;ipVzwLedZO77BoD{gW=DKK^G);n=(kB&0d@$*i4T5+!1MaTMwxZQf~
zkjXmd`Mz8z|6E(M>avi><UiN4jLu(P##;N4CA9aCMBT-Ps5p)`=GoHnGa_CJP4Mlx
zesep|H0{M~KHaJtOpcef)YVSB;deEA;op@K6%V90y<4E_oh<D*U5vZ+NYufd?%y3b
z)>%5N>=LYEZWNs}WrF^CiIwN=e(TRj<6wU*BPyLPJVlA|R>p6=<7c>;(!Aq3u6)hf
ze9s}f!!7W`r6+7RUYS4p{pRk?pC`|p{iEP{X??&vmzGx>y%ZY1owwBe_or{oL~Zs>
zRa<YT&+il|ESmdtUTC|+DwV58HSfLoCE4=jwcf?*iQBI7+H?NCt61F^xuIunef^=h
zdaM6m9<qqVt~OQOAu+RUQp(~ruZ||Y+BmPbhx;|>pW@5)DO|kTFPC{lcjkL9^LXsD
zJ7e8}*Nc?jeU-ef7Tb5$sYfK|>XVmZAKqWyRl|9y+Bf)tV^a2isaft<YS?A|eo(%f
z#J(Y4GynEs@riftPSuvzT=|NzS5jib6p0DlM^<0ob5d=!)movD!u^KEC$I2as}*6o
zeunGS?nmDGSNtMmFV19ieixw9&HGKPdrf0Z&D7_bEd92|U$h10==Eu=yxZ)!SuygB
z0`v0PMXY{0A-7enC)c^W{IlduXpZudVB505y^A``oDE%W>^QtX|7g>17w3r&wtY!1
z*t0r3e9w=!DKAs6ncwG~zv+jevc>DgampvU-3vA3Z8!zEZP^Yl-!8yB)p_C-?VP_7
zHu~L5qMDxiJv;0g{<VT<-*tglm(Quo4KpQ!FII^MPdfVNbb@kguWa&O(SMfun^s7y
zc|J8`A2U;E!qdYJjuESwvQ4fyCm1aeUJ?1iROC_hscSlwGyfc7*WRLPd|Bo6kAid4
zuL`oX?EblstLp5+@M^YO`)-__^rrSy-lji###)x&q&S3T?wxrn^`7m*+{d~G+e(>k
zwe1L8lKp&!#%?Kd>8L_m_mr%Bo=7j<Ga2I3x2}3z{wDIh-8KH2;_2dsmlHBYR~X&h
zv9Wu}V<TRrxwDiKiyQAhRMsoWy#3<zjG(RYEIOS}g3{*xyCm|xm#HLSLlo~k-~Vs@
zFQ*H29?iIYwDQNAzp4DQkD6^+$0&2~zx6f6Yu7eEDb&8~<l3^AQLk>+MZdzx*-e`4
zk-QVKVqS?zM{Ip)7wKy~Pg3X0WfpI{U^WYu?0+As6MQ#cnJj5!{jKF#k=~Ry6(T}X
zmenF|$Is<B9(U8_61vu>kiX7C)OD+{;{mS}vkO-|+?y}%PE0C@{3a&7V)w+WDb=o9
z?k(~@xxryUyydJLt2=~~7ED?F=z^9}@9WZ8X9~GC@IH;>Z%+O?;b<?%1f6^KJEBi+
zX<qW$@Aj4LCLjK#rET~brt$D>%iTqCT_1fMw}m~;_+#+xhKcrsj~TPNI;%w9mUXjK
zF?r7TcDt`8{dUR8SNj<_cy$=s&fM`UDco?s`p&nFAH%}GbxmCtdfmFVyi9L%ww>6a
zMJJ{!Z@U(@Hl%&gwG#z9N?FR%t}`vKewd?fadpZ}FR`_?8*9HcChJb!-^cN}_61Mp
zY|&>T-kbBz+)5C;Fl(-;WmSoA-je4@S)o;(Gc^)d?sLtXq&Y2Jz2mT<)TYk{uT#4M
zHx+Ep;ho35WA39Aj|mw!lh24)xEEXL&R*B7##s{@|2pMEhM-1uyKwvMx!;-oF{{>|
z%t_JHDhmyNBlo#slFXXAqkj@4?6&xtn>26=p52ypWcB9F=0U2zA`KQwZFb!Kq5DC}
zL6?QHlNTR$ikVv<mgF?G-1Y3ok`qczJI-$wj{ouPexvdBzMQOO-sain8v0RjKQ1+L
z-LUfdx<_+a>_<)2!UNV9thZ0u{q6iD&A-=uC+JS%nfx_AmqG9GZj;lSME>!v*KGUc
zQjx6SUl6>f{O!%2J8hTK4u6~45Lf?$XMeiq<@|ruYZu<BD&TqK_w984?p<%Ey}uBc
zfA)@2z#GX`Ck1o)8I`sP&G5-x_K1fup}q5Nrd98m1@+sndzpS~bqf5oCtogj--<UG
z9M-v<9XZ=C{9q}qauhRXR)3q!RZ+lb{!`%L!Aak8Ce0{k4{~tJ*I~^)b8z1aX&qVF
zoc?b|^DUzeS>)`{XXE+q8l1c7d_ti5s_G+}NA5f>oV~(RUfeq6yVwVXlT9;gt8%J-
zowI9eQCz=Vl4bG2%U?cR$SnUfe}3G)pEt6;_ul4vSb4kdxyj$x?UScJSC@}^yRY=t
zUdx{^7>WhGGwPn)-}P2-)#V=#oh00P^7YPES{+hynUgQlq4qjZ@3U2J;nawPMs7dF
zV;5349a5E==Pny~Ri(Ya=CIS5DU*~gh*;J8Z8~3~=O~-?H^(!q*uo%LIX!Rh<r|YM
z7uE-@Y$=(vEArUVz5HGOU&h`~u(w_id|&O^FTsGmz1=d}sqatMoP1N?U+7bPt+OxD
z=Rf0`q+99Am(pq$+W1X;Cu8TWucN?oYoVYouln`FG1mpkpVa@`7q;UCZ}_hzyCqKL
z%uktJ?J9S0+HAl7Q(ng_UjIMk<^Ih++spZEi*j>Z|LuSNEz7Gz=xn_5@$%hkgI)x3
z9`MiizhC=nN9)6VZ-d|eo3K^?_txH1k4vh{MXTp5m>tId*(_T0>Qo^WSNRiWTCbjN
zO#Z!Nt!eG_ydSbhHwwq^tN*-GwsqRqsh52^n(pR>F8AC0`SN!4w`GMzueVs+{oTl`
zTi#h+U6#YLx3?ol{OhIUjjH?gbn4<}1tu82yZeLrf}LrA^y7b9JT@QS=lnE2KJE_7
z@6b(}w}Va}p2M-sMuuG|kax`icW=Iv+IzERlvz(cu2PyJRQ@}Pakj?!e<#+ge-_c-
z|9%$BnMd0una->I!`Ps~tD_j0o_#rTI;+zA@Ick=9Nrsm|2lsExA~&GNlx=qq^l3w
ziq&T4E-c)4UFoj-2l;<*)PKC5pt<erbxpa6tXDp(N?qUngI(7Ad;X03Zi}Yv6Np`Q
z-8F8#`+45zCi(m(sTJGHy5Dw-=zXXXFn4^rq)08NW%^E^jLD^U3Jq2!XUnbEcATH`
z=KLY0x<Uo>NsZ6XFTW@IvvZ&2!wV||%QD~joHwt&Ja2dVkq6tRF+FgfCztWQw_HX^
zVNGoN#;XU?-^i&?>6gFNZp*Sx{zn_%8U8!BE{gYT+*>{4O8Z_l*&gYj43noz{Fx6Q
zULC6`^LGWuKcih7i<{%)<o=w0>iXl&gZoeK`ya38RP)MdeY4&9^4&QzwSqstoD}`x
z*}T^;Kga0x99!|IuXg_LMQ(oo4mh~;s;#|!q;2kTe!tEpnf{}KQx%^5jJn6#xc$Wi
z-hhxTL7iUQyju^QGF&isgYrbzh^yHFCN*}OuD9AqpR8Q;TlkdWy#3Og91D8Sx5vpT
zL~<tWT(*1tkLek4OQp;1H&k8N6xtPA?7G|H>Vmwphnz1~RG!(ZVDINOVL9*H>3zre
zpILmpw%agZ&iZeP!9I>cqH||o-KOfT*7M_P;sLfC;rU^|ZY^q+Ing|&cF!BvhU1@W
zcPu;m`n76tnx~-jjx@I$iknMr&pOndKHcf9THicX-S`LV=YBu&G5_#HiATmqRMs9!
z*vGLjE84|*iLg*|*4KVNL#~hKHIBGWi7j4ODVy_d_V@X_pUd9k<zz0qdEsz>iPPFk
zk>cy@F28x1GwsAK+uqH`rez!Wef+Vf`MJ-9ckd1|AGyJ%uxz#S#1B_34&G1bcv`gh
z_{1HYGIxu&+wg5_<=i)8n$YSAVKV;m9f$W<i0n2z7Sg^es#Du&d4=7?S3eeg(YtkE
z7H1lR|1zlqVy0h?N4tpdSapXzyc)n{uHhIwg(YZ(YM9|6s|uw`%WvOq?5bmua;i*k
zQvNJ9Avas=l$FHB^+|tkT#yL=s&a918(V(rtW_=FuPuK$>({)i4*99G*sgR;C|JH%
zuqPvJeRb;fwUeI5`DD#Y3!BQC_2bpIeeXoKx!l@*WZGFNg^mULS;BinZ{PZH_TJyF
zG?sL?c?ZuL2}ESC_;DaAe&!5b+o^}E&-`2TYM1XN|NFA@|Kuv2Fr2*N+ez>IExEC=
zMmFV3)|&;kZ7RLqnP(Bz_Ii)V*1e}UtXG)ta8vZB^4+~xBaLN$Pmi<N=JRTHZtR4T
z^lmvJR!_;@{65)j+E+Jy-Fxnqzm$&ahX+$jma>=axu+2R-MqtFO_$?`NAJA2_!oK8
z{SF6+#hl)_jX7OrvDK@-v+5Bdg$=s=PjdGqmHv||wx74-sEeYt#<r^0VzDug`W`Uv
zQvTs^=1Jd*-c6r!#rgZ^@XgcSzb$jw3|lEphe>9;*k4Rz-RSdX<*6XATgeCVra#}Q
zXmfDYQN`I8f^r2ibvfgV-n`QJ{9xmG4T<H`%MCa^%VwWX)p4lO@xQiR$GT>2F8j@=
zo+5wd6>ngQ&se8l_>4(*)tkH70f!=N->~L#+^bl2H8(oys=o`f0?*5R*9@+R9*!0H
zacaBhj5a3ArORBuNk5KH?rfj=u+i)W)3)ZNIcpOdga5idn0vFg`n-*;#?g@PKC|WO
z=g*xlJOAu0apBF&{S{~VT|Rqx`6fQD{H6PpvhCs@)h^j_W6AB?bAJ6#Nj!f~k^9H=
zRUHjFGp#u1Y;m8>_-yNbxo*wP`wS{XR5)dwtzYzr?>U}m9U~HS_u#u+)jzRw!pt>H
z#qHm3b=%o~a7n#W$*Yd6w+lN1GxB}-`j(|0ug=}Q;q{HnTe^<5_{_L}!v5BQY~!3S
zLSZ`u!lk=c-?{qr?mq6m-`7OXsa-$vPqq2lk+++t7kPS2t>yl>TVTq|<SmaC-f!M)
zbvAgeTdrQ0TeW2nyV5b);}RQ|ACwC3_;xceB&_7&ZbOf#b7B?C`6RRpyZL$w`?5oJ
zPH<Ye%lYYN2bY}kN=3K!uWIudkEU-s^;pW}&eUYX-43e~?*A<5+pZTCez3d5NBb`m
z8`JuiN8+Cx@IGF!oB1c>Vb;R!9|crre|0fX`5eD@ZQqQqPt7{L8m>(}S^cJhP36jy
zL<t?&{MA}sj*C~BytZL{CQ`NMtVd#37oQx<vejREs=I$mJN###y8mpsB!|b`9DR<r
zs+ay7tIf4O=U*n#XjK_&lce(NkzoZx$keL(4xcG+@0|3heA<06)88om%Wsx-XJ5Th
z=gGc5_nncD?eRaaTc5iN%!<Fcp|4KBeE0dF=@&|;7tiBO-}R^<@nosVy|3Av`+RLo
zyMOup+*{52Jn{T2arKzbyK1ICZMy7xcFGIC@VAz^XD9F2ymr4=p{IM-MzIs$UmNfx
zoOispuKN1hbJKV%63Qp+dAlgh^nR4SvJ$hr_1ii6odIU&x%W&qI>RlprEzzwez4W9
zd%F@H<{w}7S~>CVT#kFDzCOh&?>26#XJlNjWc-EYsOB*qE`xuIvhOk~w3Ho?_i8k`
zb17=O>&>(;uG5!fPBj+bm90M-)Mvg;NoJzZG_}<a*%oA~D~c|fz58yRPE(1z|Lo+4
zEmDheS#GgKD=kX?x$NAI@60=xT%NL@Tgw^8vS`xc?5qc!&!?naF1~)6L+oJxk=Jw9
znK-yFYXAA*@piGzVQX^Z*cDEGT4De6zK@^OA|_*tDH;4vR%(2dlss^ovF})MqRFl$
zb0$5z9~Nq55ZcLC&SYR49)HbXM}VZ8q8G1a`MIV;0TVmh(%v{!Jmg&e`16uzW8G7$
z`Ev8t8Zb5L1-uOEyeodLBm9@|)b=EaZ?0lar?362TH?^ZeeEApk;rK#HTKTk-{u|I
zy!>ru@RBRHE?#JMeY{wJ|M-vQ6Tw;s1%J4N+Q^nC1v+!bCNzm3QOme}q)7E--jVl*
zLoT|!bN9dbX0PL7$t@X7f7Q6xYrdSdVP2z7lkl#%)c60`yn8H8sQ)|Tz!xQO@PmxM
z>ifIb4+k&Kj^uMZd9>HAFLzqMwUp9Q&($r3&WrVD|6IMjd-t}ks~5jav;6U_;Pq0+
z-km}Aw&uN-)AD<p6n>oK4ZU)2_MHY*@s883HY$$Z@kg`PTqqXb^xRVWdJW&4FFxm6
z%yxaKdb;URV2@T|Ml-`K9@UWD4{dipUbk*l+rHiDyKMHCKY8S1d~a#awaunqB%_Zp
ze}8gR|J+I6qS!S{>Ypp7uYS?C&hq?q>1pY0TS}Kir>u0lt{=SXxlm^c3xCsr>pzaK
za9vzJJ<4dyUe{bx;a>{dw>-^fUOD}6kgxE!l0#d}Ufnklsy4nSy}fi^ZA2^c+nuNG
zmkE6C`MvHy`F$4VA8pgb<lj26ylz=mu~j#I|9QVnoAh>QEZ!k(Zh6{?^N*<6mVIf{
z4(^_x#$BWIO>5sJR@G-)7P;oCFF5)sSmvcV>&KYzqV)`0ikW6P-`ldPyrg+c<eB%`
zyKdSU<wa~{ySy)YmFa!f`9XX|B0sW&|EpeLx>xADy<KH$?==^WzZ^H-o2;4U5na9c
z)$+ep7j&eg+onz^cXe7STw=3u<z+$9-ANPg$8Cw6dTYyh@8#2v9(H@ae*5b`4J98p
z2uf+@-*mXVl{ez^;o7+m?lkgwP5n`kq3TsLTdv8mWbyVND|bXLuKK30o#%Py$08ek
zqp2^BIe&Q4T%mJq{ijD|duAqYIVP$nZr|c+&u-AB_(wj#o0&y~fq{X80ko_pf&Z+(
z9U}vS78Ai`HTeap;Nwg53MxY<#Csn$5IK7Px8^#YlgmPm9^c5bN;l|5RIIsV$Br9!
zZ#m4KqVo0g?Im~RKTr8=t^WPq9nL4~AD;8CXmnaEFCQQgR}@mr5fv8l!v3CZMcm31
zW{q8J6_>qI6<)oc7k<SjJ7VE9rR+dM<*Qe$Ht%HrJJVsoj+Ig-dkP+y-hAfJct=P*
zywED6{=)1EQOjE67Y23PU)A}fFATkYq`0WM>aJ-_N!1Zyk0<AE=$$pYCVpwonLU$Y
zYZ+RX1vB}ye$Y)_`@5e>oGtXW^_c=qhiT{jrIxlE+!bb;;&d{rw_0QAtH-wt0w0_S
ztvj{p$hS>bmu(K-oqltR&&N7@K9~I43WdhOUVX}Sb6;Ndh`$!Nq4S!UF8d^xo!&bC
zSoP-Vy|k=o6#tSWmM9^<VoqOhc5$Ixvclg@4?G^5^puI!)d;=kM~wl?L`%n83=9nU
zj0_BNs0%!DGV`)ii%@QvjO}yGJ_K9P<iV|W#8#|IU}->y!m{?JDXFu4&OAsfzZo0-
z`MtDo^3|Pt`@gs8HzjTU<x`{;SnYF9`$}V$(|0Cr?bB?+^U`#hmTsK8xK_9!y?EY-
zp7ReEJ4P%vm(u#<n3{9DUvWW><m$PZihrlcHAZE}G_;<6*<ksSd6#5P_gQI89V^)<
zFE6b#NRV9iPq_J?)|#h*toG8E{&n2zj=$v8Tc5XL+2yHr#%e7gUK|yzcLTZ}=uEzq
z=kal^ug$*B_j9T$ZuUl9f0|;lR&MUQpZi14@4tbTE(Pz-+t1I$z;K+Ifk6s;sDS3W
z^+5MC`1aodos1dY^FUyNhu2Hppw+HZmacfCr?urS*IJ$Y83NhD)~`1P{`_7lqp`vE
z3j66<{on7|_=|^~KHvY*DQyME<DX(vr|xu_d}xPQWaCE-$xV7bCA9`c;SmzN_xm4R
zEcn8BjrEZ1q_7P~ZKv&8S7RI@BFZhxwy^B{(lZL$tb#&MZaHXP<(Be_$SYx;^ZcAu
z^PJ{2S-CnKOSg!IWx4jqCa;Jot-9^3dzFvn;H~Gy5$dnwPixMvnd!Ih-1~G*=6a^G
zNegayFAlv>nlpc%bI-=vY?g&y`>awNRcoSk^HV!lH*b1WuK#5DzgNq36w0mU&Tl=_
zwT!PQo<l_IV3oO1>{YvzhM2n>0w0~ey>Iu`e$E=6$ts5;@4jyTkn_pxRG-zcG{yJ=
z!8=*)uMT}mG_7Z8UhgNB|9s-ojf)fSb7`>|?EcSZI?F4H>FxUo)65hm+$~Bhd!lI`
zIA>z#yr|OXGm64p+vgv4otBupbKx%ch-bAO_6Ij#OI^MAs*;Z?&z|Ou;ZLHK{}(Sj
ztzNcn<Maa;J#Y24TS=8NDvCZ)+RS`ml}*boj~N_KwlV&RPQRev(G(phH1F!W3!l>F
zxE0RO)R3*v{;ugFzF&sdL1=qxNahShp3Qz@liswgsr0%pWNLBp<jQQPw>fX$sLuVG
zzh!0lwLjt&m&M{E-o-vV%lGlxtj#yWy?^ju2sQhtedHelYUaAzo+7Wn&A`y2$-p3k
zJsG8>mZT<wE)shhRULfWL+Jng`AJ+^-exzf78J#t3*D#9$MNu*fS$$896>MZX~(vS
zWgfGh#IrAF-|y1%8A~SW&YaM+cbAnGf3)%CyO;ap?T?u4+-LRkigcUZW6sxe*?X2h
zR7u(7-}mgw{Ehb-cVEAyc06g{l!qnLCN=N<+kEffy@QOBXC-zfbUsi?;1=tw<Z1Uj
zm2oG_cS%R*bKgxSlh1tikT~D!!}&C3i3u;O|0mmZ+1DO<_?+D=ankMKjWt`NS?c_L
zDotrpo_(2p{@ICs;cH_$Eg#1@sjtbd{nqek3Ty1A)f_wBpPIa!)Drme{2tcHoOAL@
zqt?!8O?eh<)P1A*=On%7it~kLO%TkPJ7J>rub;23Sl3lo{dxTJX=MDy>p|{{`<XYn
zJ)5k$yzmA8)ysO8k0YOUmR?AGdh|@@>viA!;*Web*tA3DIsY5q)wgytIJeD_J<l>@
z=T)v7Eop(XzC1KiUpW7sislLPqV~i^cK7d1V*L4O>y7fqDjCN2FN>EH{5-bs(o3Oq
zuK#zVti?OSw@bFH%=xT*YWY0*tNDFmh52t?#4g;rThkb?UA=r?{BF^C-@~3<Z8Gs%
zSoXN=ODb0t-=2^PM(>&PpWVKFOr<uuHMZ&9woe+K%oCT^F8ab7KV!-(@AfbM+~!QI
z*1TujA^t97eb;17k4H5RN@NTtaV`2ObauK=i%OgM&!?xa$J-SjesDVcYvjfMpRN`r
zX8Q!oy8H+};;d+MGnA>kXM)?lJ}c$S85?eW$Znn>;Oymkxkt6LoPSC2*@o!voyoGy
z{h1fU?AYoTbY8ldVVQ2;SD5>JTeL^q&%pLi9_O}lnSV`s`|j_m`{gJ7m}lxF?mTiY
zW|QZS3+l;=N*Dfmq!s8r;VxvK#_z=Ws(;$mr&Y7wC{Dd%Z1=(MWtW?|wqu#5#pPq`
z9h#FDcX2+FiM_(5AvVEbQ^T?=OC29*>g(~W5`FpTaF5^2wRgMPc6o5DX;;~P^5tP0
zuD=3$9?v#RW~ksYN}e>)WkQKtaMAe=f6JLh4Xy|N#e8=0nNpxvozNw+KxM(7T~VIz
zHtei8{Q0!J|NZLl_x|_i)GH+}+Hz6<3g^z_`-97a9{x}lVHaF}{q#?#6s=g71NuHr
z1r?`iujM_u5IXUi%l^Q1u|XT|ZAp(^#UfK6Ei!q@R~_>J<L!G}&r5H=856B7Q^p=@
z&bYer!Bn3nd9B?U^(%Kc_kMozPO)Jk4|5o2bjX~2@0#2sm1iZZ9EmmieoS$B(M!iG
zr=Kp4322QIv5<Z2FiXLLwJPYUVUI?rY}CDF@0N1hc_W!|^6QnAn^`kXUC^=R`e6TJ
z<r$`r@r$krFV$FS6Ueu?UC8~_)IhoNi#u#GrmGiSKD*ncq?5gA+SG}?zg0V(exEC-
zSoBW!4vT|guJwG&I||GAU%gJ)&pb=F^?<O4z$A^dRlg19PTYK&pKX)L(mGa+rCudz
z?bb4Ndsa9kRP%=Q9?|BwCh;ztr6+GU+YYv?Q5$rvmPStDU$E=?f%?m)eHZ8VFLuuh
znz(-o*8|~;Nda*oho3#Tz5YhUM!k!l`0oWUsBKx2WFNq};;KYRz<PFRlK_j04)VHU
z+fMqQi9GPp!$?Z!B+m<nw@Ws$iSJqN>1fors;SSBb=&ey;$N<)-(H=xdiGSOCxX8h
z)V%f-Fg`4`wDh)p-l@>tB|0Cf%1xaD!<6%9JE$&tpmFlG%_iZ?Px&M_YrY9-^gfyH
zaoJdFCI87oxk0ghD^~4llc-g>H|0da{wb$S93^j^bA91GvBUFK$%d>1-)=Fv!?6tZ
zSKmES6xsWaN6uSeLB;l^kKb*v-)r~h@8yT9@Auz}e{lbBxNJH595#=V9G~Fjt3UDu
zC44nL5VdISwYw`tZtmF|f3UB`RHj%iPTp#*+T6I9dYif?eX+nbC$B4<;I7P`Z0lHm
z|H<4L(i`+nUNVR}&F3oIxBBR1PchdC@fT)P9o;*>HNn3)wByqy2I*T<S2=CJ*TExj
z?upi#1WvI@3{eqR7umjH{dBbB<JG@swrg$K=4Q-ru4pq`;H=wawZG3RG5^-(Oz-Gs
zigEPF*uinlThaT&#h{c)e+o)Xs(v#+Sk2=rt+8-#KSONrgBN)(v+eKAE7SdP#p3qH
z+h%fhfBLuPp1+uso142g^`g!DWmDA(ZWZ_6^}CnWd`MA;<BO%dgZtjZisL7CXHVN<
z)$@C4+PQ;IYfbMMwLh@$`MpBs#}{p>=8}vpt^t)x<`&*Pu|&}~^1{Y*B3y@qU4u+)
zC1S)`uHV)^6_S`V!D**Yp<%1ku7z)IpR#%6&E%W9LbR*6k!P<0<MH3R%>{fO)+ZY@
zd=KmwE(n@Gk<;U{q1IpL-Pc!XC-4W=G0wjCWNx5{kJ75^^OtHzCGL*SWZuJbm{Z(9
z&hp2Rrme-CQ*Pw>+3ehCad+C(8{OYFhh680KkYrG_jP&6nqHUx>u<T+Zf|~em-mLn
z>}`&^A10p;4ZrtH`PDD2?cK@;8jBZwkSWyczvJpL_fELj41w@V2Cw3aul)X<Qv2c0
z+NH*A6POcJ9&6;cMlOB-o6kM;Rd;jD|DQ{_SHH1)w7c7Cd2IQe<1=!;J#|xy6Bqin
zH{d_h+N$7V2WLHWxN3SVSgng`!eXEKqQQ5=qTXm&)I2>@m&&H=@b!?T?u1kCR=2CS
zufHa{ATIT*$g1Vu7r(Z$Jqy{oqbh5E+~xWDZx(%=b-7aErHFvr&V{dhWkvF@>U!_|
zWc^2bvEYYZ`I$yGn~z*wc9f@S!KPO?cqP+{zw~uanE$uMbMj*m_Ej$$tbYV)&E#Ik
zb%ZHlVI=d<Qy*W)-?c4YpFPp#=$WM)M)E<XtXDla17)0Zn*%uinr-ol&|Q?wlsKhp
z%lmYmIb6S%e_a1yvzY0bH=H}eiyv5i{`fTE!pmE!pJcrFpFaH-FeClrjXe47Cnqeu
zP{uSzIaoA$-#q2#-?&bH;_P+(x^?-azT883r}>WM%ZQ5v=CaChY<l!t>Yr(r!|@fj
ztgjl>J<BbB{(kQHJ4Q+d?;fq2T)uem!wtb(8qca+%|0rVb()psrjbJEe5YIPnp27&
z>!dEv*rgXTjj{TKef^O$OYGJsXz{%@Zz)^5Eziqw)#9(OY+r5iS<c5Hb-ePtc=YXO
zrZ=3mSRAgZOyT^pZ$j?LZ~yMS-fJH{W8wBM^9&SDb@H8ho0408I;`6+!R-5+v+Q$c
z|Gk~2Dtq?1V6~<0UdO!?BKB^UcfO%)z9_Ezk#~W7AnPmToNAS3t@>BLV@1<1D0yrZ
z`L%EM<y|70m)AFJTeQI6sP6bt+Z7>SV`?|C#yXt2B%rYD0INd4X7iW%JI$P!t~~v5
z<5=Cw?FT0KOKd*CaLA9pQRYIshg=W)vq%Q<Yd`lSEd5mU^rU>uWR3sXE4(h~D&<IY
zdmZkYC(4_+Aa-y4_w$z@2ioiVT?yRMQz@sjcIvA_VUHa_ZGoyKXU<F5e9aR+QhQzC
z$$sGlM^${9CtsTOGc7jz)Ml^B9lxSgmQLDMTFhUcQQ|+nlPm4uVpTi#;?;_cbzA2z
zmozbQxqsx`x3riIE{#`eyb?qw@xNJ{Gq=CrFy^X0*Nuf?bDusc$<^9m9WDQKT6U=S
zv+LV>7{%?IdwpBqNL}C2nEc20j-J_usIR-CBL9DUw&Y*U!_=P})5}+83kFK6iP_xp
zU*ou1_HpjU(^j*cWgNdn`CO{zn)*QUvCpfhx6WKsQ=~RM;rw{F{fFI-Qsp^OXK&9{
zXScdk%=2h=%>|hgJDK8^d|5Bs6VB7rb^G_}dx`n^@&C`otamREN;xJh5Seu9aQ)^7
zKR1azVaX59++*2U8{=s@J1*DeSY~lh_OmU0$DYssXTiKqWcQki;MDm4zc2ef-Ru7v
zZ9mS$nd$<3It&bUPZ$_vvA3+D-B<AX<IM8gZj<i+)vj7v$!(;z@NlR4!@e>l?@f!%
zt@ccMQxUfKIAf<;t00Ghg^FR^|L<#8y<^)|_+i3|8#8a{Z&cm1``4;f>vmti`SbQ)
z{=3TgCz@Nz`D5jl+&l5Ou>Y;wxev3-x4%7`{yIm$XW2&ceSSB;J-b#`UR_*0J2s}c
z?960?1ik%F>m+;^7<=zDuKboG(k^`Meg7tt?#lh=_jrmN(=2XM@R@ssyZOmY<F7Xp
zR@Ctbe+{<k-IH);PD|{H{v^GFx0ux*ay`ncd2;uIvi^>Th3#|a?yr6O^G}V`l5=}=
za#t@Cp0oNr@0I7T%D?_~EO>o1v0=5v4*5?U%Wn#5pQ#V8om=sy+H=*ecde5-j`fy5
zHq^^GqW7kI|9;yS@Bfx;_`dz{Wb?i0JpWGYJ8bZ5-DIm(pYQ*evU@p8-F@k0;+H#K
zpRF`pJ8R}E-P7DwZOmVo_La*X`e;}EE$4-`=b>{S8QPMLSDjz6|M|CwNyi?EPw#*5
zWX}Qb-+#jn{S9pYSlze!?ZHib5AJ(sR9_X#K4gF6#I)QSeOa*%(x>jeJiJa-NabJ0
zha<aW|9?7U=TrHHr^fHWdWH+05+BT7|J%NC@6ip0>`%CQ^i3b+=GLgc_`T)cKI0?J
zZ;pGq_;UVI;Q7n+>ej8Of1mBzHGLDfh0Ds%Ue1;?{?W}D!7+`q!Xlw<`NR!6j(d)V
z*&kBSQS{l8z3}wU)xn$hE~$UcnpZJ>%a)V<mABkmmW#fymbi58pjwnEN6N)hTOJ#U
zb*N09@0AqZ{$hjUv`v8;*JcYGJCS<Z)O*JsqvzU&3vN8R)p_Ea)i;J*m&>1CO}?^L
zN3MfOY~97itBD)xH6K*>^Od~Y@YM2gnctrHPRpzBN<XR=Su4$W%6{^ahIi=+%|B-@
zw>wI=ZFewyY?P(Lnm(a&-|c>7^}X}9?_ad?^-+`Ce1&r#U9XvNN}f^Xzf#x!6H1Pc
zWfLO5g}To_WD^j_u;az=sN|gyj3Ln_>~=QKUp`Hk_36o~UF>VUGbVl5a`oB<-MxJ~
zl_%ytu{JJCUTMpxEa$UG%Z2wr^M$R9f%1n$ycYlQ2tUda5%=QR;k3qb|KzWiH^?*S
z-uZOxf<ISW+#TM}#}3L(-y7M?`QvAS#Wydu;NR}j&p$bu$uSDIJoVY(IPu5IzJ#B)
zq1G(-LX01VYwY9MpZ4qZr&VmntUKo3XpTO?E6EY?=GM-qZ{GgXZVQ-Hx#H1}@^dDY
z3iScm2X}uqEO=n_=CWUh^hSn+j+|q<t)En59EI6g4hzP*T$nbEXa9lr18*k(5li+I
zTX<pejq^nk?aJT$cg4P9ZTM#Y)Wz{ckMX^OicE~A5AOIzNIhG?rc&@rCUffUt=BCd
z7_cwoKA(PV!2$EN{Z|eY+iM0onRpa5K6+K^Jdfr7h6s`N?ek90Tzu_#>`rxA!{8t1
z8|9K$->5mx{BeihjNF&Xk2y?k*2Gr0seO22b*4uA*~CX|JdK}=u4g@;^yHt&3AfHk
zx(W&HcJ~=O@7=52TFxWCWoZki^jEH>Wfuimxx-7QSx=Y{;pqE&dA>ehKmY&o?~guw
zS+c+S+cTMyvXwJ-n3(i9D}GGgSD^h#R)0fPL-|qBq}*xt64UK(Xw`3s{rAB2XS2)i
z2a}&9?Z`@JxLnkxDHF|d!r<)1`^DTn?P{#^+&9S2y7Sg$qWxQUL;1?@tp?rFAM_f8
z*SvEu7F3#h=wHmC{oy<zLi!7D8%ul=tGOb$r~P+<#)s^C+)_ea9hwRomAe${wH2~e
z`kJ52Z{|qn31(7hTf<r$DfijZNzG=VWJlw=61L<!j62Rfx*fFrRL7g2eyJ1BA9b4=
zDe-6Xl&}!x-3M}h2`}vY%9VKk!da^|GfwtwUdOoZV@k2yo7sHKFAW$SO3ohOi;OG~
zZYgj4b!XQ4Lz3~?+>L6t^3#ktWoMn3e`ftw+xr)%<(gfZ#=3UP{WEDlw@rJOzS8=Y
zy7*^}Y3kvsPL(&V#oN`r+IYKv{tbKkx?j)hqqilrtrba8zj*oG<Rus0m-lQfn{ia<
zcl<)}Enj+bri;vUQ(KVjG%vesl5>NYNOPK{^nnvuqCEc=+a31LeXSX4QdxiY((3C+
zzcw*(2dJhyumxY3_Rwzk;q2*C7((VU7T1YI8QigSW{=un{o}mj<)9Ug#d*%>S@R~R
zte9K<()70~cd(HZtKMvj?>mFe)yVZ+ey#fTU44C{>$~QSa=*{syQjSLxDn%ZC7w6C
z>rR_aUgC1Q^xMP3?Q(IhlD9NtE-iKVbh2DHvQE!;se`tH>&N}qUiqvJpI*?At^U&A
z$o}iEorWt?UR|0|yx2+eOT>~nd>8xep6Tp-cY^cSOyg&3+zw3cSavobvo~qhwot1%
z$5*>fOP%WwuENZu*6~2^+a(bLGZsei1w{@)_It9OAOHMy<#C9n!|%@pi*D|Tc>Uwg
z-?-V!jy#pwtH2w0;n_rC>kpcTu6BH8dg+s~(%=Jcj$Y7?8BE;l{~sNmvM{pgNB^SW
zBPUsII`XkCGiVg^Si`f#maq4r`q?!vShqi%pyT`Fr~%I<i!T#Bk2Up*B=Nn|JmZ=7
z+DG~E<*41)Zl0fWW?{yJuE6-luM2wZ5(*rD=k@T^o%%QRVOWRSC9hSDD^C4=bM2#X
zp1D!pov3`1T+Wvlr_7zZO@O(O@6l_nAE#egInG;mOKx)Zj`cA~k^I*enmSCraMs7B
zPDOgrSJSiGwk$aDxO+{~+}Jtq=6^f#RH*pEpJhK~op1C<see%KGy5QOpR?C9!+2fR
zb?*!7&L`wVXwSO%e!|qsl>$r-@k$$P0@em_AFSW^anb>={hEqgI!77J()3SAvWA|0
z&>c9V;>HecCkFQ>mzj)9<|a;i)N<<1MgPO@4;Z6X2p$rcn{CB6MR!(rqmRr5k3I3e
z_qisXJ?wMJuW32YkIxp_f&br06)ff#xlzJ?j^TFAthRrfPh1o$)|{`DP*QRI{DTed
z3mkQ}-4pfeX-oh4A*-xSaAAtz+VAom{vYPeD}JzS;lToVo4mJ+x88cn^e}6gs;QXr
z@#izxKS+Puc3mu{^3dFhj2#*=`f*h^|Hzf^*U$CeEGy@&xbMS`Z>>wqRxuy5{lLb3
zCPYi1amwroQ@akk&Yu6}h1ZYNl`8ks70oy_Z;IXty}o?eECv@T&aCi!zk7!D%i0#`
zhwSnQdm+nt=;;XowH>o}M}NH4k-X!D?X8V7Cg;6mx!klZ!e}m!lYENdL4JvtU!ptD
z315;q5x2p7%l}@VMQgt=^)8y;X~AxG<hMchjTR+UH5nJ@!sbJwk(=(CG@pMOATaTP
zm5z$vrCjfXC$f89yzFiG_2=JQVRnX`o4xZcY<=IXqxHLct^c#imi3H@6*89GbKhB6
zpXFt4SYM&BTj9Fq%ZhtXnY(K2PqLjf@%))`(>hRI`t5?9M`Qhtm_$mq@6zk&^^tT^
zJ#cwai+T1XW_{VVcS1HddfYQ3TlN*XP0e<5N@sR3ny>y#^~cqZ(PCenjozNU$-OY{
zM6buXz%%D6t3UsloU`OBSLtD$m=wRB3~hUz{HsoS=ei`=%T;&zoBoyE>iSvC=#B1c
zwwrI|>Q=0Xy|8DEk4Nk_f1!;M6St+v^`4jIzJ6K4Z7I9K#Nf>1KRRwntkb-C;>R1w
zDm$r%S4+jU>fZgSdapY3@%-g8U$?q)M6KrWxpl+0`P<U1g+)~*zn)#WbZ+gF*b}+8
zmtA(*Ud^nM+W6nsr;PtIlRnFz#zsTYt%pijG}EWu@@}?!sWb0#qRjhue@iNgE^NM0
zy!i0d&9jazf3LS<;f#c%$u4nRikIv{1zhFaS1|2p^Rl}#vB;nG*wplh+b7n|o+0M`
zJ;hPVf76Uzol~2brf+?JJ?iwujvEIAJEX4|clI4DG7<l|(Y)udip)~6xR=ed4p?Ws
z-1*{cGh3MQ_Z44#%|43Mnw8luD7&|#&hu$r(GsPw2L>KH|NoFxGT31K{ob9w3)S{7
zmObQ=c1y^3$<8f;M}N)PQCZ0SbIx<uuW5ol%VN*$-gH5w)Ok;{$e-;JFRuB|5j4NE
z;6?QIUDvOL{w`XbF#Yu#ha10RBvZPN-B~z+Q+VY$-&V8o*A;eVTfa_x8k)sBc}Ic#
zf>Phw#Fy6_N_W<$PSllnmUEApORS(gd;gV}i&jpyyWo1Ub6Rg$MCnEE2jN%6I2PXF
z$rt6^afMm7>4kmk!@57-cIumbH`m*_PhP6D@aymBzW+-acfMZH^_bOb(vlBC)+zHI
zeAndHSm6+y$F<idqgrdyi3=wU*yhchx0&C;W8wQFaxs1xx*z`L2&rjwH(zR5rgg}=
z#q3~Q!Rf{`<yGf|qnX<aX7nG+o5Iq1edqCOC-|HHx*plmv*|@zqu8ca-<IqOUuKQv
z8x@y_F-N!NaHxMWd6aF{bgEaC+vXil&OV{oNvDncViqorej&Bi?00+Hx$biRO$t6y
zUkz<S&zy@E-BcDVuV||2*TJ>_Am7*Mgt-T&E&XTGU$5+{#9Qp9wD)cK92>DGF3zi6
z-voSWKj&B|leE~9d!B`N@xxBO#Qko(6W)sNYo5TcB<qK7`x6nxMPGa#GP|wc@oswZ
z{X;R)Ex%*(rtRQ6$MQJ;f&Az0y8Sc6Of>3#`YL^2t9S3sYTmWmcRkE-7k@3k{5M14
zwPVv~ge>?Xyz#uo=9>ST{(p)-os;TU%yd6q@_z7*SkZGTl5LA8x?Y(pZ(8%*@6Ju;
zJvXMsu7Bkbwq=7>)%oP6+S0rQi^KfFst^CzH*eE4#kK4~?V^uAM)&V_jki9)9Nx82
z*&(uN!{@*+zeChI*^lQ&-&Oc>xR7H>X6eUUw<h+n%Q(uNY=3y|^!aj??*>)ZCp7Gz
z;vD%m@yKD8Mo%vW(enP|FQ4E3rMT)<{DWiV&b6<fmc`1{?d$d0YtPkImYjR~`!;iP
z^QY@pznvbv<J`F)`ZLA5RoKi5+RV%S-gGVS5V>j4W8CGe$i$!gZo-uF3k^9+<H{}c
zVx<4bsi`PSPt|Bsj{a#AXLincYrW<z?U(OA9KK|=qx`+c*Wl~F*63v|Jz-;S(Rj|J
zzf!8b+-9F=$%Nh$KLvUYp13e|?&@RT!aJHAR)sCs%2<0u$^GMM<MQh7Z+3+K?=9Ri
z*;;<e(oR$MTL)7P#7^Ix|8e#9>TaiJfhH^$cD&Iz*5Irc6YZ&8_U=i)aZMWUz8$~T
z#xM7&Wt^O}QuA41)4>YnA9H@E=$!S{3w#l{#&qR1CtbE5vYcK=Q^XTvu5=n*ipe*5
zR47<@*2Q9K&#Q9>Jv|siPT2G;-&Sytzu`{4!3`dXhS|J(8?UU2UD<qiO@)j_UHprS
zMUyAov9Ky{4DINTnz+sTC|hU60S;gFqhj2eW<9ZehQ*dHzZ_&e{_bdc>@8x#Xe0bQ
zi$QSRg;!TE6(rc7?kKlZzLb7+XN6<a$Ek^8;_1!{m$=-mWLVas{6^x+WF|f5!aSW%
za~1sy^go20*rCv)Q6|SXvE|URh390?2F+;d;0x&4-o`0X*(nr#sNwWUzd4#Uya9(f
zmtP3wTxONTZef+7>vzbE;a=N?hK7$UH*3pfQXajzZt5b}W~js$c`Cy*?}Wyu$9$8o
z3M~CT&wjg5%89*kPKq_P3LB;*{ZX;_R>l?G>}GPI?*Us-qiHMqT!CBOC!JU{URFEv
zaDF=?tJ<hiz+Zaf?pF5C?XuG8emw1JxqQs0W}ja>&FiRQ^@KJ)*|NjStrL?TtDCWT
zEt=dUu%hSMq({$-8}4lEPMosh^HbkbdoFJ>&~N@NvR!A9rH0k*$(gLq>VoR-R?7@e
zhh16M(0xQuRY{`4fzgL4)}3|REujT@LO~@e>=TT$R^Hd#?6&yjio1!v_n&@=i@0{b
zt+PCTM@j$Q>KCCOKS`~dQQZ@F?y~6pdGqA!UR0edowq?_mR1ob`}VjQsuJhAR3<G8
zp5}AmP0K|M8-I?I$$J`?_sDEH#Bb!7WW%xfW2vQXP>^tFWFV(<iiGIrj~gd2KkH^X
zB{aoc{r!>lE9bp6GuSg2SMOE`Q)@VBB*=R1SlH^h<$LvIQZwQ{x^91#@j~_Rs<rE0
zgo}B~Ny$eXuyuOf|0cvEC%=hD^`Lu_|J#+P?!+a?II8jKx^v6!)Udg=&?KJ6CBW5E
zBgelfo7YY6X63Pk@0oICWcS*;i7$Fz_DMta;Ezy#slEwEbrl_hudx0zwB>2DKKbwE
zmp@ARI~K)+O{v`XW=X>8>RqX4Px8E*zrVWl-}lem&5tiFNj>0Xc+>RZ_PEy@x31mF
z^kSBY{G;cu+~3|#lu%jdzxPW2t?d$b>-z8ijr=ciuI1cu;hAbCkJ5HBz7Y3__^3N4
z|9)>`nxW|(E%Tnu49!|!&2CRMd)TtCVqv|b@|5Qvi_YHIr)n(D)zrq9s`s(s!?#&?
zgjU}!owTkY<Ro83%9q{dN*@=S<?ozSU|ZZ}(z))-vdG+tL33AdO!xY%p!2<==D?pb
zvMv>|T;i|89zBqsk)2rTe&KMGYaPoRW>e+Kl?+X5L#t(`hgw_sIQ4q*u`*o_*_pob
zXlbZ<ZR={z%=rt%GnW1Kzdy6{;bn(*ty-fweJ6L`c=Kv?LgNfuCFk(A%;>kRAKc5P
zoWAxkjdkG<<K;X~zTpmw9_u!QadX<5c*$+6*r)&P*2la}ZD-fHp7uC%s><cf-!r|8
zd_mqPyjka-muXZe6<uPq`A00<2Rp@wYd2qCu|p>3&D?!;x=gAW?OjKHWV26=J?5_5
zlQXy1-E&5VmXO#^-K%0NUMVb^)R7v@ks7h?&xM**$^tJk!{+usn(Qy%?ff&PUPPK-
z{?Ui||1L1T@jt)#>x~Lt5iXTmVNX6P9h>#Z|Eq6g$pp*7J&A968xNewVm0bI%_;c5
zq^j)4vkyx;_A#|)otW&h{mInc)kn2n^|n~9DJ?q`8qqmh^S8gwZl=2j=FOiM?YWQh
zNcAOyFQx(x()SrOefA&RA}QDJ$n4T!xntew+I2iOu7aMtOsZ27esJB|6(h%}yWpd4
zz+tP_!0vB?YKx}LJ1#$m>$S>*kk^+s%nI2q>Z{#4cgvpn;kT~(NOM}decWm|pW)<p
zo+GK&k0z8p4Qx289_iFCHDTN1U29J~V@%t)WsQz(ZT{A;&Q+lb(Q;fYn=Jp__!RWf
z)9vKxa||Mjb)M!%AJ5?pzge%4uie_QdgdjYEyr>fNA5FP+v+=Q+O(^iy_Rfy60~(|
zSBi1qWbb8Dd4o6ZVocAr=$^*?C{d#4&&&UbI%(Atc4XI^?r0L5GHH8j*d*tS`$_e`
z7S*ieSlqJ9Nr3-xkI|0x-M_dxo*Bxw8Ma>W^o-JOQc&Rh6>63kE$Jz=qvu1~L^b1-
zqBkZ9?ioVon)lraSZ%FxfOnaeY0Q;?&n>FruZ34n%{vi#apJ;Usp8v-XU%@!^j?4Q
zQ|AZog8wP!g0*%px^{T(^WQsuyKYn5<aowDgzdACfzbhn?v2gX$Nva)L>n&=-ZSy>
z&m?xn^!$^DjW+roIby@r)g_|Zs<r6SdRfOisv=fX_HliZ2w<E$<8jY~-4CYC*?V{I
zk4`}+t2*}`IR&y&pX|k!H0%sEWar&v60ausL1=3*yZidoPx56he9FE58P`OnCnViT
z>g;M|{L0}sRd`XM{!g2XPXC+nFT@`^X({Hhd}%$+vO-?x8*g@~^@eq9msAQXxvy=|
zt=(6|^Z0kxo5eSo|JU|ux9&gv_qm+$+1<*!x;*ud>kA21>~buedv;Dz*bVikp(R<7
zvkYe&zdXgI`SQoRTazv4R;Zm4UpZro?p}_J7h%(K8C|DN2z=-1<Tv|W*3=I^jx0(m
zBl~st`CZm{nVX}MD8_I3Lf{VH<B!J_r2li7JkL2`clYZ<^J<H4|6c91j@GZQ_!uP4
z{@@3*sn5J1-s&0ESAt3eyl$`K&^k6%DC_!}WS+}s*k*j+<QVN+-u|P|Ib`dt8^8Xw
z+l$-!8oBuhvYraoWegD!O6)M`EOGifY2o(k{HcjLDOFNSl;r2g#AV8)DXHC8>}>va
z$@`;?jE~pO-SZ}~OYWQ^&hz)o)y9QV3h4p|Q`~}<O!&v)uPjq**i%~n&6;WI#rNfx
zZyu00zf|DtaO0BHl>N8WgbQUOe#oqpzQG@-vgixX8UM7<--`bnk8jcW{O^V5w^PQi
zUm9!IoS)^jQO5iFF}J4tZ@n*L5)zeS1DU>V6yNhR^1{Lo?+^30-sif&yH&PyvwPyC
z1+(K{|NqvI`7EKU!aqlF|ARXd>r;4Ul!_lSKcp`7WKsv)k%I>8_to#Si+YIeD-?7(
z9Q)}dlbHV;hl0bM!c)D@aLihE@#OZL&B}qtIzQci`Pu5;qKhVPl;8W=l&rjTUYgln
zCT9=Bw~s}|5Ayc@c^6&&<I`{XJ8$#nz7^Lu+b>=F`p*ZZ^dE;REpOeMaHKW1`O3aH
z`&<9MwZDCL@mu+9R`-B!Y?mg4o^<}Ix@>)kMxcw#oW|@gfy<d3rbJI_%4YxaZ0#c<
zo*#3!w0r69E67TCxlpV&Gpl!1`;^10OkFM>%ko*caj9YRbL*UxuXa+g_K~7VPNGFA
zrMoT7%I&lS=5P7%bk-e~Q=9cSE&I?OeltQ}D<#0QzgA_%f5G}m3z=u+ynl3$yJ*7C
zOsAr0-wiWQv2s2!y<xIw?L#J`_Q3O#4Z1&=?bv0V=C=9SN)-vQrSoQlx@f&@dv`j2
z?edSyc4TO`K8w3jzI?+|(bM<3YWXb}^lh4TxU^uht7!8h;cIVpZP~R*qq+3zlSz>!
zv%Ia2g~hJxR9{edcJ;B_A>HD?&+YlT;QNHbhh(p7bw1g&dBwu(MOt~xAOBAN8N1Kn
z{H0CTYPyVrZwA*qTIzGyvWrcq%jAVe;jHdv`4x*!Tr1CUW-gIqdwAq!!=3K859(O6
z<oW~G#V{Mjg!a75WL~k$cGuR^PYd2<NETnu`F3pg(pSqAeAiFiy_Qq>fPwH+-=!<E
z?>%gK&6GXajWL7KXdU~b{ZnQ>UDEKwqT{W`C98M38|tp7*|(O<^zB*P_}L|}Omb>Z
ztE{sSN0Y#=8$EB;crPzGWthYzWsz*8&|kzJsvr>N7$O+veqmzfepl79S&L)RBEt4*
zR`Q=e&$&!V$B#pI`HydYV(LaR9xL3v%7nBS@9wz1>(Wj=pPz9Gi#BXEote`iq-j`o
ze%TThp3MhVUTh7DzTmv@Wzg4#w2vQ|E*#nU{&ic#=1XUVRLjzOmL2fe_E&^YPx!+A
z)_QMyQLf(q6Q@k*ty%U<<?JchUEM1k8?H30?q2YuDeL;VB^f?U?Wt8tE*$&s$tC|>
zs_FHAN3PF~J-)rKWS_AI9BMZI;Bal;D!s7O)%xbIyY{WNXHe@lyjR86uy*z8Q)eTl
zX#8~kb#Wg{|25`6>aX9pi!?ht2)M_$sqg=!N(J@>nsR!|sjJu)DgF<c`&YZP&D=v)
zdBRH1(7&n4zn^~lKD)l|<6oKf*>?XfSKO^L{(seI-+Y~-hsW}-T9^C$5BsCQ9)9P|
z!=M#g7KmE($))~@bS=DPYBYtDL+O+)uXXk%r@fzcEd8nIRIBUa@#?IET=ka!pQ3|H
z*JWLP8yCsAt@i%bFE<i|U6MBxEZ1b)8)<0o9BFYfyNaohd-k@qNwp8%dA@Jeet4VP
z=2*g$F45JM%pbJ0XYEuqVa@&;ks>JOTF1t6k2Q3+^MPFrd#%G7y^o%W-+M2<=+TDW
zsJ!c+xaZqEJ+xaWr2N_@!QOiBKf!@d^@19WvZiiQV2YoTa?<%$?M$c6?;4@((~sIb
zTpiG|IC-YRuLgyuH${u2md1YX_5EL7H(|Nr<r^#BF7e;In13$+*2&!m+cwz+@{6ln
z3U2+S`n3JTn_E{3K5b8t31r`LImIa`TJy2w{b>SWR*GlEy%uj0*VboXbv0vWkUo8(
zb^aY?kIPrR8DeFU9*S*yZhde^T9{}2uD7$&C$Sfs_snCytgCbOLyyA=p%YByXY)4Y
ziT}|^eXZuQ>fy7$eE*J%Yad-2zG#i9%_EsxqH_=G6z)5B&zrURZ|mO#8}AnvtZgJ7
z1(cn6F#no{d)3$4{@Npo_K`tM>3d>VPQN3yHgtF7ru(;g`d+h@E!fC?H^6m~R!+pD
zp32I;I0hqA1KGqUZ#TXY`7GCO9=iIKZm-D}7n{=HklK}>lTZDVz8rdF>lu-)S2`sx
zM_rq-(%<|2?jvWs7|#@cd$WDl+pmW5FXtYu-u+92k-K3*63?EX39LKzB!66V+c~zU
zcux0DPn-HRuHG|^bnSMYF4(qt!@1yyPl9HPoo?o?sA)Ue68_v|%?=*Zn_24)2XHmn
zzn^EnP@%%Wvu&ez<F8Ieg@XU(rAw8kpZPF*Q~ig7dDcFkZ7i&<ZC}ry_vQZFH}ZSz
zY%FiQpa1{wkE<^){yg`Lt4QJ*&&E(sgTJ;>@!8(TuJ2=7y`%9%xtL(*)Z+)`emb3z
zKX)r4yew{YR@$XpVct{XVHz%z*=-6Je2%M`-=079<;IweZy28@uAcqLgY{X^87|kr
z*Q=Hsizv7=eY4NqudmL066>E;<;899dSmI7^`WYp&g-t+Tyk!2n83Oh(JMb~aagpc
zG;w}QI?Gk9&yy~HX8w}1t?RJP)iVd!zpUU>6jKX4^y?LqmDc-JfAwx|`gY1O&^JFb
z%;D*w#wMk2iTSTnm5mofRX%?Bq5CoW&m&=H_`)VM_ZB`_vZ1+d_umsPIb8E!^gR}E
zE`PQ(@$-RDUwiic--mAA&OdlVB&_af_Uek>XRG&I*PH$>X4d)DeL3qV9-rP_R42(3
zcjndU$M06J+~Bxu_S0240n>L*HQQJ8%f0wl<%fQ|Q+lEg>Py7-MRgwx|8`%`OHlvp
z5B(o|oBf|BbgivuGxXme>lj}jwT~?*|0a9B-RZLd?@#~v^Zk%~=&Sd?;y1+}e)W%Q
zhM~~Xasi1j{=dFCGUDw~O-o)r`Qtma@u|1@^izei=PW<cSvUF79q0W~bE+psuDrK2
z=<dfS6D$3trY|*5JKrarnyo&sX5zCD)Ajl%XIM?nKeK4(tIgZy{Q2g-DPif7eQFDn
zw{8hfkZk3h@`%NIN4Tq&*Gk1A#x0wK)-Y?m(!TTLVNldsf30nA4(7f)vZ|{|Yx$eq
zEi<O<(?7Md>Y!==-Ype@QAb*n0uFcF@0@jF%3Z}dCZ?=$;lEj`;tuKZZ;pAp_{A-Y
zlO;?JlY=g9{gc@9|D=rk{l#nDj)vM@yeywsEvkK>UE@5ny3kc8jXS;D>en~w|5*3;
zbU;75?akWH9_v^HHe`fLSv$&EvM;ZHZONk>6sIt0)yil5Un|>xzR@W-cH%_9UYS<K
zy_Nh<yL^rw_kZD7_~eC5_Yt8bw+mK?@@G9g@1eYBWAo4RtCn<YY}cK)KeR)&Ond3~
zSD87HqOA=lgB~4<ty6sFym%GosXLz6KIP<<7nJS0z3fZPDi+5}6Zb_hxu^zL{fhcn
z-;%Dh(?TXA?Qi4N3Hpl19~y_e{iXDoT`JrC>{*E!(m&UCI4om0bCz*M_4k@qw*IA4
z+fF^+uYB^)6X62~_*JcQs{U`k#dKQm3+wb3%{JWH%hm=T>Z|A#F<+;lvhLN9{gyQ<
z|JgWr*I#r?&M&=a_+PATS?I$HR`aAMFYi1wMMI=*;S0C5+ga~D)?U&Z?ltG2drjZQ
zj(x9xyIt)Na;e&|NHVT3+j!c4_q|J=P2V-QHfDx@rP*#3zudobU$us%@3G$bHRk-!
zmv7_lD^x9bX|(&o&l78&&%IJ<|L}6MpUq?6q@OX<XC1q2dnL2S=Dg09E8IapZwDTI
z`C_&XpZotM4=0v=J#xJ(uB5=hZ`l>G&x+-O>dE!BNr@-b#g0_lAN3Ai@|D+-+s?Ye
zx9Ro6d)a$G-8|wgvoIpzp@sPTl^-=-U7B}ntpD)puJmjN0h@p+3_gXyC(32b63nYE
ztoXH~d23<Crt-3anu4N@)mN-7k7_Tv^DB7q+Kj1TKaLhnNn558+IViWXK6~J{z2vi
ztZIVK&fk1~_uc;bm9y8s&`8!X5orl|^k~974yKdsUF8p0Ppe(d@M<+luA0_)w{uqU
z;{ZE_Y4*yk^<nemr!u=O3k_IM<#hK))EkBx?Yav(atp$mS6q<y`R%oAZnCrT;xNYI
ztH(a?dQq1BxT5_1^23vvS6QxHKi%NxUDn!ld+!DZN{DTBTP!60z;5Mbt@8L4*Z#NF
z^lbCB6yzve`tHFk#eTl{#Jk7leNzi4E?n`{MrG^cxAL-6eP`&&rzBVL3%Z-<dH&h*
zY^Q$ighjE!7fxNxW{Q<t*|AZ`xMuhNRSs)sEfsmZ_4JOf5$gA>tdELZIl|pGXRrPJ
zdv|`FGYEfC#+V|0FXNU`@!vn~Q#XA|fB90{{(nhT$%bmSkneE;bAzW^{ayd+;hU{%
z4$R?Eno;3YU{rYItno9({*4QSZy7DU>e%PNblYh~eZ?O!3AgnrGp_|ytNPEDo4^11
zJ+sz$pX8%FC%4^9SjfG~J=8Ju#!mUSf1-j|E~cmihMoVY?|n%<t=81b#dwKg)qzFJ
zlIQ*~x^ExOyu!^Q%Axac%n$F?nzoA~Im1<_@LY5&yM0ps>!dY{Rd&dJJl~xEeWr?F
zu}&tN_rd7hKYy9G)rFKjK2x%<*Jl0(^-J&G=q%C<42!qxY!~_Dl>CVO@6YU#Z*PBU
zFYs+rnfLMaHI0c)W>3rGUw+=c!2hj+op!IClYT^cyK>oa-GB+~bL2!jSDst+X<K69
zkCk5{f-k;#a;$sCB?%LQzAxF#O<a|H-gZg3{91f^LQyY+LU)PygnWJ`$kp$Y>usmH
zCF9t)ry0FlL~VsK-mZG}`@+uteZ{WZ^?Ui(t`WP;wm^qLQDW~bC7;y^74kMqIz>P1
zKCJL`-%^Hag}bZYYp<`iiYwRrzTMEdxRJ?t{@fOopn2Wxx^geiS<hFy`+b92%0w;g
zc$e=jjZ#fK6PF9}KY4E&sPt(nZ}!$z@5Fxxy=eNn;`+^ZYajp2SnN7AD);%dX?t~F
z&29_}+flt(F{>xfqh3Ga)v~f*`{Ro3wXVPY{PGuP1b6#^c?NFLqN{(n2h<(r)Q&Hy
zUs}$v;vZ|-`fCdgg#BR4E#`ikk}_p=t3mmZ(_5cTYo1|k{&~vZt5;IOH-9|lC{g@4
zuc~4vYg30}jJD6t2?5O;c)mB9OFL@Y8vnfN`uj+s%Y1z%jefUZb8TzBS6A<P_j-5o
z{?+BjMb=)s!=oIU_f5I+N6J?5RXV?SZ*i<Q^uM>N;>%%vf6WU_KUTeYRq=i5j;)~*
z9J`wpzO0yF;ugWnc2DBUmDaVbtE;z5r5{ROu<^sPMNR9!+>|s7xU1pRb!~6W3oV0O
z%eMahADVN-?2=rIMf$B@YYHB)*!aM1lfC;Mg_D2w`0T0S@cX-J@BCwNshfOO&zRES
z<aqP{r2H>8`7T>O5WdX*ozG5oNt%Mv(Ube<^ZOMfWF_mfl%BY^<^P_&J2Ueyepb3w
zA(bGtW!wH{d1ddj_4%QS+n=T`h+cC<V$+(aGsh*D#@tDs8|`}i$EP-reI6fXHay~+
zuFe!9SS)RFds=B`e5_Tt?vLl|*PcH6jz9eT?YH?)*86=A|0O!{cG;RoF1Zu34esnn
zJ(%)zduaHAtX!q8FHws9p%%_H$@}K1@^5ZY{4_^ElI8q5XXT3?{U-(Yh1TR8IsW{~
za;2Nvfz#LDdb+2*Xj|fwnZm+5|2x&+e{{c|Yx9(UUk$b#`E~yPk^PT3O(j<9Yb8z=
zdbX<exI=K*ziEqVO!?}CX9}=HtzCco#AJ>|t+Tut-8%a@_liAd6;!a4%iQPA88}s#
zMWV2-{Or-};_EeCjozU>OViaFU2lq(FOiJ+-hSDSt8tg#wQ#;aR;CW?b#k<flm(JC
zx;P|PYZ&On{}8#w{<HTZkLyyOSIpas6(?6M7CN%?(oRj@bzvvsA3XGAKGBn|x>fi0
z%+;HwC`?nI=lz7~cWaEK`E!4xI<`XpMA_Y?N#_mcSF@CLHwE(u6gX$fu|5x&f1>=o
zD*uudtM+ZtS#+bNDSfq!d5qu<(G6z%c5lthJ7_hVb+(sWM(Fa$8An|=WpG~D-SS%B
zPSYgtjY#^14ZlCl?DWo7_I|`$GnFkl^TYj_t?q#m3$`ouvhUcMzW&QX;g1W%4Hk<e
zs~NA1e35@m$b9{E!K-4|X6+JrRKfWsQhQaP?CKL@q0Z~GbIX_`n0a$Jr!HMHXY1;j
zx-U)R{6eCC7yj&>*s#RX#&2<nt6YC={u{=po0Hi$p6Sq77CXK0ed^>Q4Yd!d)2akm
z6x2^_VXt^u{_)+a1I82obNz`(ImIQn`VPNUxmny&ACq?*LP9$$J<n@*Z>x%Fxx4Go
zx<%)_<Q9tTWL9)LQxp64;#Vf4>ycr5r@ZKi75%lXDf-XKSijSIt{Qwl-lFtHUEzOA
z-o6Hojz;afOG2;KJu(0L(B;GwAr-Ek*w%@y2WA`#o-F+JWaPcXzijeNY;noEr_5N#
z<$OiTOgm)Ze9g*Pj9f20e`R)`{C?x)@56r&$6m9_HqI5_+E$%t(!2L#>8Ys0X3V0`
zcfb4g?ArHLkK-f`UwtC+uJp>YhKrNeYjOX2Zu4sYjW_xEU(M=Y<mP|>{!RZEhm$-@
zyI6QfO}!;gZH<)&%jXSieXBPgzW3Pv+codMr6mg4Tdr`n*K^F0esf5nMbGQ0$horF
zvZ;rq`ISw2%~kJD7ZjRxo0Cn1q4D@7xu5qA?dYujm7Bi0_U2u!#ee^tV%_n$D$~An
zX)~7uWBJ3T1E)4udgO}cs-%<~%C|i}@H;fj>cYG93-OvICW0q#848C4UNK8JHgnbV
z=Yf1vJMS&%Uf6hLx_*-PUcT@q_xAM*9=RQ6&0DFi|Goakoqy9_PCnaI)0QE9;?cqz
z+(ku(umAm<_a%bYtY=z^@Vlt5@7F(ml{oe8x+(T$A$GfN34S^JHRIhmUU8{uiMt(+
zaI{uBZ2$f&x>Z_XnZi@?Dn8x+QvZUZS*!N)F8J?#OMK~sRg9sJh4jkoIUe2Cl)JlU
z@g?5U)i%5?yAs(o9U`=yOjanK^eN<HHCeE<FJxX}z8TBQ%@0c}g6)z$O)7+zT8Zzy
z6=~3z{bYNR?KXdLog(E^3n#eoM$MU;!W?=yHCd!hBc5+gM1<eAH@U0X>Qp_;J93<k
zol-iTaq8^V{hRyw{Qs2|T&u4x`|#_-;l+PTPFc6F_q-6iI{x&IvpcW%S4uTIN#9r5
z{Hnh;@X(XX*LkZIzTI88<>Qfz?QgX6s_wgT*H4Y_6JGNw@zG+wbXC{=7i?CkD%w__
z^Z&lW?q>SWIqN3v*f8nAfAi|<-X(jg%kF5^r%gFO>(0*uK5AjgEzKtzcI%bjf7G7;
z{h9OQK$9)={vs_T=2`hQVtK{F?kzkF4C^!*7|`~==H{oA=A@$Re_b1uTYTG0=-;~d
zMsNFoU5jTfD~?|!dEcaT&avs@)l#O{rNa+5dUza~sT9GmW%1`9`|s;9G%>jDJhxP?
zUw7h-r%B&$hJTR$^zqfz_3G~{4rU$o)AI_;-uKMs+{x2zV$o%vV!yq8B3-05YwwfU
zYt`=8{(e-w>4wp#d76QfC*9rTWn#TRdDg|dEMofGVkVldm(X-stGQnEqQizoU4kd2
zPKvBqHjDXZl*gg+-U(H+-nc|wmi11Xd@`y__T=Z%)zK$E-O*LtvaVG%M7VtAl38M+
zp<O?{tL}fOa$cdteO&Xj72oP<;i+C_8r4U`@8%Zoj4loo4~^aw9<%D5-Fnl>3KoBk
z#-^xhw=9YBxGH${(OcQ6(o+vD*IxJ`+5L{~nrN-as{wm`Pf7<)EeYLt`f7c|!r)JG
zBImNpwuvV6_3fINr2O)n{fj@w9D$c#or;_9^JA9Irlb4UpZmPo{CRr5zTF>_`2s&I
zMfTobu)iebsl?Rk2kL5~5)VqF#oar4=gLl;_<Gu@D|NdJt+-yc-QK+?HR#i%(%anA
zrmaadW!UoIjDG#q*xUYUY-~^VYTWLsWtm~Hx;_2;yhzr`Y>7cax*Th@HW_m>a#d-2
zP4zvK#2ou$>63Wz@F!2NvNAH}JIXnyc^)_xBfM2qHzDmP2Xpt8yra|Z9b&z4IIdaK
zye<8##J$jY^QJKUW0=yoNOv2<Yg@qwib5(aww+r)>n;v9Fg?Y{wCikyqxUv8_J^j|
zEA2wpL@ie_I5<b8apGi2%b)B&6|$BK{`uLqCw0xiUXw}pn>Mk{UgUbPXB)$=>VkO9
zTW7b0haG2|Kj*1pl%KPu+D9kVsK^a5TsNw==p}#EoxbRp!KB<7=kA`Gbo!;vv&0zF
z>q_C97}U<qT;`uTttzkoug$TuTnRIHU4q|oT}WCW_I};|LI;K#KJmjxD-^SI<YQ&;
zbb5A$c?npqS6Fl<$wBmf4`=gVIrAW&M`qKLf5=^s$aUpD=9!-xA-R<8`1$fJ&$5?&
zDXo|-HtYVTJ0BgMojzm8)v(WC=kgtl>Z*s_m_B?EiwT>zg`;rxjjY1yPIVWa^i8zp
zV`Ta(Hb?2p%(d5gXW7^9dsuaQ-6p3u^Jc%ud$L7-e(}<%W%Ks`_}%@U{Y0q|&$f*9
z$GlBjJeOTvVRmQl42H`OcD#Gwwx{H@#+#Zs=8taQmH#Cx@j!#~j<nwWkR;dDGKc?K
zMAqBi<|<_ga6fsM>8i1V<Fdzo(<l9IzqzCQ$|4yhvprXjN8M4|-r88XtbgY>p&j#Q
zIm_*1;G1!2z4%Ri(*qx(GH2derOf@R>#0%ej?>rve4cZFYl4F1&JBrG6Zbx5DBiK_
z%|v!fxy!C!wrEUfe6e=T$*)EoJ2q{2nDpZ6appA>KMO8W`119<V`7m&xm*{YjKj1%
z&alcIJZ2wG$R$jUaoo5fGj@aKJ^w(<%|9Jayp!|%$JQUI{yl6e|M!Z&iji)wBbVMN
z<eTYx@A3rhdXJpgu1Aj!@oes$HsQQtf|l*pS-yLBrJcSRZpSc{n_Km5C=cHbo-J>9
z?reP9xbs=*%-ve28in>RG}U3+{mHnRSM=x7KN)6|%8p6x<^CY!KY7yMdqpQtSw?aO
zHck}Zl<IzMmjjP$P3!`b>AYg^w(PRgQ4!ROm?!hF#QmV{={omg%b7MPR!(AwNZ{W3
zZPVUm3BQze9RCVz_1S6L|2j{hXJ2~0p1t0j^jpXIwLYBNd)|KYqN^|dyxh<w`|*j~
zi;T5X6gIGV9G8CK{-fTK<&fjUsjUtt7TT<nd44W!`Q3ICqqCVmo@QRXxT4bU?f!FI
z%fH1-W&JYwVI!>&(R@~>#;||(h8c(6s{LTAb@}l2WW<|?j}>1yi6rS6<r<l&E_ij|
z&dCG2P8#V5-s3E6uG77vB>aWzvd~Kx$u${oeBHC0wup;p#D3{rb6ZlZdf}bV^WtVN
zQg2PL=2pB`_-NbN4)6aAu6cJ;T<X%*FCTXonk8W|O;Kw>&g`0_*;?N%V<!H7xllXu
zx12}z&VLj4Fh{4jNq_S^Vfr@m>>=B^xsip*^GY^ry6k->opEKuNoJQqlj8Yj7N{3R
ze}4O{?o~p^qU3{>Sre{VPvbS&DDNW8@+(Jo!J|3n7TnZ6TfR4chV~4_s>*|tD(-LJ
zl4Yo($g0-q_h6;EMQNO&^s^x6su@44Ch$(NG-YX@dB#=8{rcO-6Ab^o5pi4d((2{!
zqN4X(zKj2KxNv&!rIUMwW#9ks6jYF2qaXFutYP&7`!zq;{#)xO#~tu`N&bEBK1u0Q
zm1j0bOq@Jf_)^H3vkMB!4s86dR;|&pr-wgwxBliQ0m5t@Q?#Ewcb}Pg<-EQ48JB6A
zZ~jksvtxa&KoR@fy`OWFWHU@IxkuhhDpXm=FYrP+hapuu>G6)NK-&|u<0rhHFOb0O
zz{0Wpv4Tp?QSRK&yWU=y@WXCnlWMWLV#_^0jUCr&YdCDrb_#iB&M%s~!)3Zc{%$>k
zqp!Q;@6SJf@~7@<UU{CH`DbqkeO7v>rMkOzGkb4he#8Z<iyKldd%3Zg^+t0&v`yF{
zXwlNrS9V(E^a<~R-_|X1YggH7GQM?Vb4h5tyrLlElJP;4b7gn8ggneR;c%XNX+cGa
z`}dm~S&x1(czj|MT9n4VspBxKipc6Mk|!D(v;2N66Ek|zZgSY^M#IX@4;Qf}?tXOU
z+2zBhPQ?9G_hXst$l&#B=bDvn{HrclE9Ng?uw&bDFw4WY_M}8ecP5K@^-~M+)do*z
z&#p*MUwbKOyMb)w_U-Z?*YDlZQ=@P$E9@ZKv%L6*%<q|JP7B@OU(>LEarxXi8xGY<
zMSm4=;65AmtX_52Jp-N@GfaXf&oz6HRpGkWR&W8EWyXh|nn#P6beJ}oGRQ49Tfz5e
z8=u8{9`};D+n&8B>G4tII$XrFf7X@)#)dU#H5(6qJmVm1{Z8)q-ya7`V%hp1Mm+y?
z_34~HO|798YxvTZ)y+v(v)nMT_rv5f@^Ah%H=6vD`6$Kzt#N;a<lg;9n3)qdA99Sm
zeZ6kqUw=2{*Wz0=7Jm_4Ywlkn{@uZNVO`K#nVnN^iXE?#pX?eS(Ed<EM~u5e&0_W`
zCfmyQ+t1gX-nB|k=BdThC29F9g)77~=B<_yP*c3(c!@>0eyiX=pXQpWh5If9WOORr
z+hBX=50@yvZx_$ch((eY_nqpB&0Kc&ZtK0c4-qz5Ck`JB2w!Gn725qQlW$gCYQ^U8
zLz~mjpL5|g^mJA%zkYVn2g?nGir;6PjykgZP(fm!-J#14=hN>6=-gOSqrWhzp#SKO
zG<DZgEte+TxE%HOZ12KftE<mxtysv!70$IX;8(?xYiIlA<}P;al3IEDY_q3iti1fJ
zn^W7_wi{~)sGXP;y>R*Ur$!$<qnf@l`sm&@NRRHWOFr@V@QjIjDu4W#U|DkHhv4Kr
zFE2jobgpp9IM1^DqvV@2@{<2LdYfYVR~-{NJM-{Ed81QV_vgO&xp`;a;fojVY>eG;
z*(CnI8<+c87jdzhk{*c%YGq}LetAY*n!8nP!*3OfJl|=xj%l3rX4XGiYD2eQx$reu
zEx6v^XV0mepJJJMe;$2lV_)O&*||Vt{?GFhzv;i)I>X;;>)!NPvxIqe9g3Q@%XOyx
z+b@Z?YnYqm^UddQGDx%5F3~nT9aS<Z)HI`3E$nZ}QSE>C-7QK^{XFn)!=$wvcW!9n
zFTMQs^O?t-1<a{k?fqBh<=W=HOu3a)e$UF{*WMo=q`2nC^}F-691pl|=Hr(>Gv3_h
zapCdZxy;uRF8}7J?-b<Z^0__X(eyh)Uo2`1?EX9d7i#(aYn%R-GiUS_${8JJDpyZp
zx#9Qg*&~5Rv7aRzYgInF=5CRVvrzolxo3mZkx9P&pAYU3Qqf;%axU?c?w5CY%Bw4H
zaQ4hNxU2KM<@z(Lb^rCUOs-n6He*4+F{j%ca?^Iqh}h6}Y`d@vZw*tgV9)QKX)|}P
z*roipVWH+8-I9q@7duRwH@!MB>1lJqvki7EzZAd4YW%qMUHBizs{TDi5B3DTxSnxJ
z-Sf|Ls~0Ek)iV6H-`4f7Pjp%NkCk)3*Rpox&YA5Kvp1)l^XpBopq=yAt=+QN-I;lw
zXOenR-Jz_I=Jj=jw?m}*)J69fPB&lE7UX&Rjpy7t|B%C6`<{L4ReF0XGxc6?;1hMd
zTx;J0dfXYe8&>ZX=v;8iv@gf6Q_w!x_vlxXlap?KJ;^=$#x9Qpai_N>^K%xwZ4+6c
zdtK#3#bK99k!#bk-z}T!xQ=7-)kMqq&DP=CGk<)W`1hXCit9C<w}YE&?uq=>c&a>k
zj#F}unscXigL_v`fX(N9KL4-kAMw#$?7Y&!s@zPpSk^<n*KJ=&(FCo8>yi(a&!1_#
zc-yjha(po{OJ4eKx_UzJ%Y@s~pUV!*f7~K?YvL#UC^^P2nJV)$4$t56uO9VCk{pv|
zVg-^63}qDz43elDC*l2_LeP06Z*5_hwru#u9wa(*@{>s`t*=@b&pa~oqwl@KvhSys
zCIyP56gy8ek`D{f`@i6~^!L;2r1KjTRIN|?1Z`b2ca5)^l*8it83%qp`8zxPzfHx&
zrCV0KJos^rnD4d|8K#Q<VV+ff{Bkbe-@Tc<{ApHjYWj2D%7XX*l#7b|PI^a8XPtT3
zd)D;Ts#}zKeW!`N`TtkH!G1?Q!~Z|*mU>dN4j<174fC8l_2^vd?o~09EaJBKMqjj0
zyD7BKR7JCEQ=-Dxxz>+jBTvtN^?BRLqMy;5BU6t`dS(?V#n(nX6U^1}TD*A9qXT{q
z(pxO71Y_McEua2$&)JvOTz|#u{Xb3XJ9%+An+Id<=ln&DS%%r0Yu@eC39s33?saP1
zyp!d{yB4tqn4iti-LJnXNiO)sdaX$|VFI%aE7Shes4&E(Y}Q)&fK^B+K11Q=NulW~
z=hL#Pe*C_;e9ESey(d5Gv`fZa;(9K={AtnDkPnZ1IXfO%MXtD+cH`)(MIY85VST)2
z(w0u`s*7o&bC1hk_bh#uDR6Mo1&Ijtza84jv*h<z)qi?&wEM@+kGp^L*Y{j~|Ks!O
zO$*d7oM_IOb|qv{MU<HDB+)HSHy$Si9%{*GTEjeLMaC?X5<9i}2OEA|UsMx(?L+ih
zhWLwLB_iGU;&pGX(mKB?W#zPIqL*}6OV4Or@?V;dNoJ>l`o)v~_gHq#|5x|rOaJ5W
z{l4!6Dr(kzmHRP6Dqh#FLr;qH@3zX%A9>VvoH%!8YyEB?yGz@9H(p}XI<F-AIy_q8
z=oemv>6H^A<HFz1=E_Jov~$U;3+#z!4IdXxbY5_?o$1EAlItt|-oJ?3ImI|KannjG
z_dB1{BX1QvF!6siYftmcEumiXnVJu)tg^r6pRjIWldP|WiCuMdb^V32yVg8o;kdMD
z*NT&i)_5>$`6($02}fRfwr7s}1+T>#lT_y(_!4KV>HX>Qu9eGPX&(<zK2R+nJ44cT
z>JkG_n`f(3t8QKM-D%T!@WQe0?<7`y_N@ES+hn0|e?LRq+*f`xHyqn>=!SmX7WSjd
z4HZ9JQn}Oq_`KT9_M90J_iZenSPM*_6*k=@PW7zimf2HN^DezgompqLk>R+x$J*jq
zXAZj5{PvzAntAVBrVV@b6tmQ+fp;VLBp#$*KQ8kpGVH3`@nuf$w#aQb%+{5==F>8!
z-yw&rt~t+1T4O5R?3vZfmnyY;!fw5DSKN}<e9pZX6H>B0aeL&R2LAcBX-Cy!CjHqH
zwA7ku+s(d)`&`TKx&{87cSZe!*9N)mzb^`Ye|C>E{oIqoa<>(}T=ASLQhILgXT`j<
zmX37kf^2cm+2%<xvlf(2ezNnw?xdaf7yQat@MFXNo9BEkUa?(sN^HjN3-Jyg?><ba
zz5RzvPp@3eS^b+t;eMmM1~*fIO^o*z7Z)s@r(St>?<tApq1&}f+5}RLw&gV&Oufim
z)V}!{)1wV*PRz34%bulw?8pa6brl1d(+NI$vm#gog<F_o`j13>EKC#psw|iJlzqNZ
zub9EBc##WsmTc{jzv?*M<~-;8$Nau%f!56F28JE7o>lWi(x)_BWj)L_QC=$gpZ89K
z3lCp+vDQ0;9q(Uz(&}_^CuhN$%z3vTr@n5=X*zTMrt_z+W*?)27u9EN^EEpCvV^O6
zPtcDKoCyn?PCC30H0ro`BahW9$6LFlAe!-hPG+k>-s(MzELrRBUJ7ZHe7ipPR-xv)
z#bu`K3pr%H=BS%KuX@qZxLW*NL)fV;ULJpsG5YRg>XvqHKIyhE-}da(qs6yZ@!Rs=
zK9hSf&33^YL7j+-)C)yRj)pOW1UYhOt~UI@a?tcpfZmP;3=g(S&u3LG`Y?m_QB>bS
z;o4&XO_P)!ItwTW6mL0{Y%(YL$_j-uJ{_+_eGPL>)HknTc-y<-!^^XiC*Qv~f2zcF
zh0Q*Vx=qdx>g;BDbo?w`u$JBLO^=vi!fI!;Ey61uPIHNT^4xt&bGpTqyEd%{{?GN(
znYC!O?ct3QLfMQDm<9JraLd<;GtKvP`)sNCnu9m@%X%Yir`4hyKRNzMAK<%a%F0{N
zEmv}SU);Bgf)N375iL)XCN7Pf)PKU?;`woVP9^(eQ#o%R`de3UQA2?LRnfr<N*aF-
z*Tp^M4467`uBN;H>dHtK-k%XuvNt{Jnl)+Lis%==g*Py6QPrNI%;M5eJh#y)!?CoP
z`M@VP-z$zMUvB1Dmv((prJj_;x6%iTI~aK{-`;tU$9`pgPyI2SWA1vFd@|Q7tl5~h
zA-H9pTlXg2XL<^DnUM{*a$d@cv%Y3kIecOB++z<S8yM!Yu_x_pTFL5EeBg1)52xr0
z$5bkK#H>H`_$a<V8h3f2B5QE9-|r_J*LE+u6cB7_@?-_~nJ?!!eJ>TCi{xZx$z@8}
zaG{`dflO0@>CVQ5sjrx~xRl@dID_GMFXvh<iT&rA+E#N^Gr!Umj&Up!UvBY<v#k7R
zz<~>_8#Cn^?byC^&$Qu@`{mK^-z8#k#Ie-ww`RUclV^!t@%=VOm(abZHmmV)Z1`vN
z^GKcb9(ya>9rnEkQl5Ew9Zq18Z%$xYymnKl#U}A$*1ZOsg*G19dV;x4LDopU=0wb?
zjpZ}WDMyxE6nnXF<2Gy4XJt<&{J(!<>Y~v7Pj(t{8AnOV8Ejv0=c2@x#cn){($6<b
zo+$~_{dyyKrLs)@Jvr5Qqub%H*cfg!^L2dsq|@~Okn4fBrmN0xKRfktaJ=xlz|5+T
z5dwcNIGkg=!}s&Cgly0plPar&mp2{iWUqPlq3!>Iy}N2Z-52;ZA#_?@$}HIstF)4n
zMVoI;_?)u!){Bg_i7y|RtZbCu`!eCh%KT!Mw91QfqZPum79C9uo635uJlXKz#S<}2
z-N(+${eEK3#ie=Pa^{RIrqqxRkr7@wi%mrDKP!4Hvb7-gKF{%vyomP9-CDPUuJ<qc
z-M^^XZtp?MCHluUOR&oCmrK-PIil528ZjkNRl7o^#Va>9O#a|`2H(i1(i@)oPMhp|
zvnjaZWSESMtBI~bM9e{!rpk3fd4_k}oiD%buF5x!{gP~7yo+D`pxDu)yXH*&X~T1F
zc3P-^-H*g;^BNx=)nrh2kNkOfjn;M3zYpJ@TrXc|UGd|^!+wWGIis@YNAGGqi<bYv
zvgGvK82(K&ghU@YIJEEjG=Z^6^NDP4)yKpwJB967?l8(9TWI~z`GD*PP4B(JLAlpW
z)7pNCPkE~IG%H~Cgl?_g?jpa}7xFD96i<wP*gW$WkIRH)7BjcJQyrO;B6|-uPUeW8
zuqN%~W~Mbe-ZUL`>*MHr_9A6QpqqQSo6WS|$O8xWUwhm0SM4Id;o^60PVOI8ow?n%
zT(kVug+He*cYX-`-ZkSP>-Pg!N{-A9=s8f3`0eE9$MyScW_^fYxuaTeC7^%3rst()
ztY`Nt`fhc6%(>|7xAiA2*S<Kf!Xj$G9AD(@5Po&a_O<oboEy`={n_}7fvvPeXrow_
ziCRGDv<!~OrA!qLKeAsqT$r`gk2lQ0{r0z$hEAU68*L=!D@?jv9h~2Bx?z!;rE)!U
zyQuh4;kXCME06C@o#ZU;{lPjQu;|`h>EA!xi#U3M4IgG)`8xaK%uth`FFqE1wK(`K
zdDHoC3w2(pMEcH^V*kKbcPLMuSu5=K!bhiC4Ek84V&B?)dA-2;N1gke^<gaQ_-0HB
zIDe>cacgkihW8OBSDB73d+c-eqj2G;yk^B4dJFADB;*x07jK)!sk80a6R!_CmmF4`
zvz?qG6LH2-e&=-=uTRIUIyQ$s6!%!qox93x2~T4|N>}aHRxRzY+~oZFTg)X7_udk3
zIvwy<qUTNt<7=ji8XsOZScN{|n#H=}z_lOudM*b@dMG?8H58vM>vJx78yB<nvvA96
zr<cD8)o+SU(hOS@8*cRNq`iiw#tQy~Et{uZGZpGdonY|2Im`7^?6X|HYbh;1ZdwWN
zWZr&I^xQOoqlZ2SpE>>EY5JMhM~#vrT*A3}#Z6=x?@U@3_;>SD1tWoreUI9@IeoI&
zF1D=q=YOSM8T+YAY=Ozl>6*7Yl76P~>@oPvGf#D~#;j#3@#?dq%wNpB{rghp?js&P
zCi4QPDdkD#`nWvFw^LRuO%7}R(|%3qyNd3&#M(Xb470D^JJWa~uVvE5AI!HNegD$k
ze~ABc`5&o|$L1aCTi3c=+IjP0hxSO><ipPdocSD1zd4@RkjP&wb9ds`83${f8fCUP
zy>qdC*Zyj|<!!g)!bU|E+twDd-7-G)Z{J489-Y>QGaP?1?O}DRI(=@}x4aF(ezWTK
zZQ5n_Gb^Jq-`z30Hs9I7Zu-sn`!|VA>}m95Z}}}_GvngdiHQscSKO;_F8CAorGxdc
zOps{kr}(o;rvgeJJ_vXpT9~%N*e^ldFyCxi=$4D^v%->WYP98>5&~Tn4khS2O`Iw9
zdC8m{0hQd~Q?(~17NuNyz;?N2lT4>;s?l7QfG|&1{<{TSRf<0&9MoKPvPNVlHzfJE
zr7)>|vUzC9dZugR4rY_`Sz8jSLuy^m_Be&bsD(~TsOydkx>K)xdvh`K%;4Jx-8<Kn
zG~Efh%r^P`HIWKmo&L&<Q0W~JS}ZlvcVg3jzxlA=wBy>$rkRVEo-mAEA>7WruWH8B
zZ(+RMS|ZAuS~y<ECrr58YF4XrbE2-E*3Zn1GAr%V6ihyM%5Xi)31xHJ!@P}4<<bG(
zJu^C9C~?*7=uUawv2*&7@M~wAv!|@N$6tK-nq5jsr|9#2YgNwJDtgo_&Au5nvFx6$
z1=l?@rQMyj22bX39Jj9gI7#)!9<9Z@?azfCufOY5T2b&*MQ&@1!rh!m7rRec?AenX
z#kK9`{`w@)?ZxoFc&5+KKPOl!^iF;*lD+(N)y<MCl6E&Tx7{c>{J3Cgg8uKx@v^U)
zyc7cOUomhr*;XAQRAIHZbzbR}oOH$frFnn9-idi%=2sB$m3tAZTGmy88K0xwt<spP
zgN2KK-l*Hsqv0`SUD%%96%Et*N@Qoo&RnIXX|_;M=vu}jyXl2)KHXPVI9Vk6iAwv+
zvMy9LZgQNHxYX14ualLc=4-pWi2pB|=bg0TzV>h)!yRS$xkk@&CG+*NzAuu0-^li1
z<*z+Hkx!K8Oy9Cr%i;7R|Fu&LN|hI1KKCM-hheFZ*lgQ%$6gtDocLDb|M33GnKxfJ
z+Z|YMZMfouafMd&*F}yA6_IH<`%gyLY&!N<eM7*56HA}Zn4a=yIrp5h4L*}XTQ2zN
zc6Yfgn4J0jwoFv$$4$p_{}sG{b#JRqm>E}n!G0ax+ckZr@;fTs*S(AHKN%-K`OVsh
zxLB1a^M?KylW_iZse&5Gy|%}7e)r6hh-&dX#d2p&x&Qnmk+#hr^ICfDCLNwQRpr=K
zCw9+t5uK|Giue8be)0g*XOoGI(QiUtPG)#@d-G!R^ZoHMNB!^p{kCuNdtN?17w;`A
z_jBBcZ(4aT=v#ir#w)FsEE9F6#~kEY@qGo?>w1INSJ(Giz3W-bRlPasm_*8%;M+V8
z_@}2xm)UUKx^dDldA`$3mu9xMxm&KilDJ~A{JIsR9sAuCI!r$<`mD{md_Yy$yx(=H
z$PEr=@n~L-0)tEO%G}x^JA&73T$8c%lJP{<l@&)$%-ZgAkWbZUZR(`%+Y9F%S#sjI
z#3|n|MWsRgRwv&?&FXXRx8=6pyYa{V-A!pfZv79P)hEYM{C+?8rNENBUj7p^KWJ1=
zQnJvPxo7Xcf=|y5b9UX1o!q+Np#JgoSJZ=BZ14Wga{g!;%MyO$zUd}MgSSi{dX(3D
z+E3wr#Ogf3xi#;d;f3O;<)O#EJWD*VR#aci@Xq4Z*~=H|HaWfbWW35_utomGvZdRN
z7H|4lXZL0K(vLT5wL|PGj$FCvGG+ate|5iv&38ZOj%Zuf9lGW7v>h@ro+hi}vh{B<
zb4$PPo%6P~CQoPPruzNS<~j?-T-Hy?TH)xKnqWTR+Jouw^Y_?SeSM-j<A}b_)*mZ$
zrTTL=y}!*OF<-Vdq9IQ_g|C7;@!0ay<;+fRe_duOvEaOr7O(KjUFARD)Bl?S?%h6Q
zm(v!#Ri`vN_3g12a!bD$?2zBMXXEVZtFN=&!`%w5&gL%g*SN31{^8+`3EgWBglPYW
zeI$_bWv}ap+;6dM?{dGHCY7~roj#ZC=kd)E_hWL-t$MZZ_YIj7=aY(OoIRUd?EQU1
zuWr5M>^l{@r;n|Rl~znty(;T#_Vl1p+Qi<a_LYC%m}V&6`Eg;>)T<uHQtY0a@}7|R
zrEJ}<;pe(@d*K7-38&<P)o10*z7|;)9aY<?{k=WsID7rHzP?_@i^pzdcAbl5*jBrP
zqsH_}!W8RAT*X~1w~P7J-@Gv2D3E+!sjn@TbB)#Cn)s%~pVQ`c&b4LFy}W$~@3$*0
zbAS6S`}WtuW!`K?wqqh?@7Nza-t*DnY}MC=|Jc@v?x<WIf9WT4<DQ-0ukS2Qo&Ed!
z^U9*2eR=OrGOBLdUBvV^{^_Y&ez}i+C4bmrlWcZ<7OhF@En6M@MqE2P{;=Nqzt8q0
zm$g0J{k<=K-#?!B5do@iG*qTE<z714uHJh&byE6g^`d?)o_QuL>325V<=S{~q3NXs
z5m)z!mAZYDxSDDv{^Z!iO<Oz@&Mok`${Bp-o9E?Id#nzhyVhQ0W%oGSpi6``)3=H*
za6uA7byk+*={;7`QEFj3(<d3Ia4tIFyx*c~&+%g{ypdlf&N$kYSWs}rXxe$E?=xEF
z9%GxcFI(Q0^DXP{3dOTeJ!-_oD}UZHU(MR{UTZg>MOd8Qyk`o<g=e?1B$vqlsGC^%
zf3a-+&iLxAn)frTimsYXR{XoUHhF5xA??JiGWLaYbQ1qq82Rz!-!2n<%kY=+cAaTi
z%wKgqYwLAYF8_4h)meG>FOs;k_1a;tsA{7-^|38E4%)SkuRLd*S=Lec@ukL>jmzXD
ztZLHT*8aVns#E)p@q5}O_M})F_S4IshMX+iHsNNG;n8^l5f@W6Smb_c+}gbGAFF28
zg!cM(%a`$1Nqc>IS;MAU?xj{@u2UiY$8_};UtyCk5s{}qv#s9rEU7JYdvYDKYgyO_
zp)j4<vFA2z-j=gnO}giF$DWUq^?L5emGir%|Jc0e!?%D`w>`0OGoH?ve|`0S=E{xt
z{a(~QJa~4u$vTHWldD5Lr`T@|e|~LO^m3b!j5__Q9~-78+kAggJ5la;<&|RY$Kmfj
z-p`!3e(tl2s|wn6`u|Tm`ZC0Q#XH_rw?Ekh**8o~+4lI~5vz5Q)vx`nrg!e1$!4p`
zWTyOhyN}S?t{GbUYKt7M$URczu068&$nLFc4l4#O@jm>;<Y}qa?RRUo$YlO+UG2P5
z!1c!Nc{46`t@zb_&Sgo}<W&bA{`m6VV@>5WsdHu*PQ@8WwtY%ECbjt5^D}ub1FhT3
zN?sl0+Vs@@@Fpw1Tl-Epah`7$|9WN1Psy3nS}**u)%S^N@=4Y1hz%)SAUm_!YFf|(
zedDz6-!}x!;5_)bJ<Cz;-bSVd!TJn|`S<4Y#r{x!aj@;#SJtH;?#?c=E01iLe&=g=
zCU5b9;((34QUCs3_4m+Scl*Vr8A@B$bhmyKf9IQ$xAG-l=}W1Nlh;k$t0{i!p>oCj
z?YVb%T8qe^Ka_nXcILOujprqPOIhbUY%Dl)Vu|^>Ew|&UU+SK2Z13U}*<1A@r>Y<<
z>`aM<?ZL48Sy%RR#clfa$3i}Gw|55bxyw%HG9JxezP$DP^owivTAK2Uoi?5MCFR_|
zs$(CyR?RNDzWPn4{O->3$kX0_NBuABR^PZbb@Lhjii+97TkA^f#Lw-mz5V`(<h%JF
zpGR1|KQce(r%~S)BiFml)ot(py*O@fZ72C6Fpk6SNkjd?-3QAHZtT9jQqB9$tDe~R
zU*ARd-}L+>(KmU~jHjjbPi0+hzU(#U^SzaO-*L*_KdsRlqe3_TRWnE{@;~~s$?MM6
zjDO7s_ddB{98kJ^jf}R9{9&`dDu3jT8S-w(Px%q$^@BI=BG<trvD(G^Ul*+U{j+*e
z%iQJPru?02xKVHiBkRpM*=cTFuNIb?rQdmdOyosJ?7F8rBVM;PUtW?VEq!Kw+L5&D
zw~I}W@PApoI!7se1{bS+S>cH<!AJC362d(;TtD|Wyh`p{4|mz?0Hf9UWyN!BTRiRs
z2^-JqwOaY$u63ZbyZM{NeIKm+@3`>XRW<p=&g=6r?7)scCqgz9&s6x$T(Ti=_1Wft
z;Iy1`2a5kL*vUEV%=3*im|{PaUg(&k9QN^=_pBVQlJ!|$?Ca7G{l3<)skqRzuw>(#
z-E$(k+IBtAS@py8;2y!9-c2i3=9eYU`k%B(wnfSJ!@G|)i(MWjY5L#XsKrn;b=UOm
zAAkFaNS@^pRagGS9G<qurclFLE$)4?H&5-`KU2G<!>n(J+$g(oCFa{Pqwae$J^$m*
z{L5C)TXBS`sGNPW$FFzKduCi?-uG(nx<&T`9&GmS<F3p0?D{H|ed_(9=huIDx%Nxj
z{8_f9WyRb0J(uq_>t#3HvXGc_=7U^BUN!IOz=ygqrM@4Xj&=NrTlZ4+>ztXlo`)-c
zzPrM;Y+0VfF{OpOjy!xMCz`Y>!i%{s$vWuI`FRx|Hg@Y?H(^*%dGg(b^_;&~_vx)T
zkZF<Zt6Te&A(Gwwnr#pp^Wpt(FYL`J{_#xx_92t4@4ZeOyYlnZj+o7tKgOHtY*yyh
zialpt`E0HD@z3_U2cMieKhLevH1AZi(3kh89xF%Red96jzs!OOTboxe`!@I8qbEPS
zmS;3hny0+R_ig8wwQo}u`q*85bhXR2Zxa{s{r7O?^|P`WS5(s58EXIAbIWI$M}!@I
z>2mQN@27pv70a~lRIRwyF!kHjM9JSm#rrS4J{!StTfDGgMyyRq6~D!gkUGs5R(k0t
z#4Dty7|I+LDLuM=yYp-QmkiA}IQ}DDKmb~nR`UD&j}5{M3_IKz7^JaJ(<J96W~b^E
zRBpBTTYP)R#{I9?AJCkuIP=7o;@a}d7em(8ZY#QYWMgdf$)}-VmLja4Ho+?L_BpHN
zzUIHzv-4<>-!$j>=R2NC4Y4|9;=dVnKDXV8nOkdZ@!eKx*_Q;9<%!SqYi4~p>G`Hg
zyXwQ@+AEdLev2z6|2Q4$R%cW7U)(4z@YBp?fgaDk%wr4O!)7rlu>9^zok<zKGU*f3
zE1hK9f4sKvGJ4dOIA!Nd`PNK#6V;G^U6<tk<R8!5_Db*%&!3rZyu&M>v47IMeWY%O
zN}kuTB(3Ok1~q3A1Pu;8&zQ%)#r?;3Q&y)#>+>dv`%d3{f93R(%L8|GsH|hUsq?+L
zvVTqCL<gQfT#Hiqr%7KHnDOMN$y9}VxAra;%6p^cJuCKD&O+NmzvfuR{!sLtt5dXK
zH^Z01J!*wc4}+WTKiO>2Ibm0Spuuv_!vWF}4zdEh<?V9>8m=F%uaS)9KR?HR|JM^Q
z9;MY3)xDe3yYA*^SCLDG4qrRutu)WhsW$)cJWtH@;ryMM8>KcoKX}hv8aPe-%fj%=
ze_tA2zbuU?o~7z=fiwHS^BHQ{_NQOO^c^~8u&XQRYoN0smt<;#vU{&kvzuz+VfTKc
zdt3}pj^629d_}YH(>CkWAT#!^nfCMC5}!3W2tDD<-)1FS?|AInkNWj(=UyIv_;UHh
zqw8zUW)*g<p6k4{YiaAA!cE5aPg^~G;MBRJ?ry`a;HBZ=Go%kl2l(b**=Vxo`(%xj
z-`=k(Z!YP}xuDisXnRQV64OGixgQ-i^xNOr%^5#Wd`G5No%f%fe~*^!D}P#5{%%s;
zQck0%&GG@86FROwH~8^f?cS-6&O56&+0Aqf3@E9-C}p<S{xh@v?Jt27yY%dRjLkXb
z?BrL=%qiyEd64CpPq*X3-OH?Q*e>rd*ILs2Lj0f5l<<Ia^KWy0KT?slV?u+z;-47?
zuM_64nwy^Ytf`ja$4aM~Iq9k*7lNWhq}Auvy|<dGI#uoP6Q|7w1=Q9}kG=f=^xu|q
zSHHT%9NwboXWwi!Euuwe+U6qZWe)RxXCC8xUE-&2A3wLpeSgn6_s17MwDFucV!>&i
zAf2If<<JYk$7~w^-~5xidh1U>wzM77!%vbQ_A@qDxjV1hxLT+C^1p`<FP#tjd4_GR
z<)0_%8`7#yTr05PUUc)}Enmll{6Ft`SN5yD?Kfe#JmpjFjh$AOe@i~Sz91RfbL^bH
zy18>iQ=-IN^FRE1yxugOJ7>wcefx1O2AfGYmt7Egb)-hAeY*vBh)y?0469#)z{jw>
z9ZNJ%DotAZXUc<sPY>7`X9fy2{<BlbuyH;zzi~J3!EXZFBqlvky!c_Eb=oeq4GrZs
zY3ElYiywHF?0IOmANw1g#oSX*9-Pa5PVtP-&NZuFKWx8fULw2X_wwbJ&#TWrpisAS
zpIlte+|L)!N>p!aXBA)9{#@bTdWLeNe-(FB)%V|tnO85#zn0G^F!|kw+Yz6p)i4$d
zJ32gUX7akLp3o)sPq{MU;Hu^muFKL_tDKsy{b<s=#Cd8dymMYM?V0Y9S*5^m>1>r4
z>ppiT`#s8;@75aFS+w}N@%?iX;H$r#t6eViifwu2q&E=-;xcbeTCTfztMi%AHJ4q-
z-|5JHbe;S2<VLPH`cr=99ec6O|C}dd_Q7?`>~}SKlMgP}-uCM8x~q)ITtC+M$tm?T
zxnv&blxit7ma$eBPrq}WbK{!Wgw>rN88dA94LEMq9h#=?`TMf)w%m!4Yie&Fm0R%m
zQISvE{f1=osdi0n`mMQ%bry{~j!4GE#~-Q+uyo`+kfxSUwkX9}MZ~3zdzQl#Rw;&8
z{Fi^e<6%3!^0{D+42L>rElaRVUBYIMv;*ex96!F8*B_97oa(+q_-@IptcuK!9~hJD
zJKFwUI4{FqA+1xjVBzK+@!VgJR6NtWJf%tbTd-PTLUX6WUMmk#ruN3z;w=#ko4Jw?
zBvs66W;M~>t+3`ui^{DI_9;yJzw~jvbG+PRb!1lB>Wq1}DtQ>yP3QNhcH8fC>9vzz
zvh6F^k7M?WIS!f&?aHa-yT-p)VScdtDjAoLLY~goi*Fc-ZSiFJlW8x(o*W`O!SpSs
zY{Rwi1sh*lzHpt=Ud(x1PDXETI>Yv`<sqp(1_l#9D&~p(>hX<=NmzJS_O^u2#|7-t
z-e221q}MF(Oc48-=y31*)}O-H+23Cf`7+zaj>C*)isbUMl`(Ug4nEk}mm86~VY06A
zg@8F}MImj*oHzO$C!2YPZJNrsW~oq5fC2xzMSEAqO1zk{^Zc_NCxsuZy|w=K1%>xz
z-VTCFiTi|=n_NX$E;2uBc+he!Vbj5hlYFPB+Z@{xIic$#>nk=#_Sg4z*B#K&R9Am{
zzfFJcUXy3r+jf~8D3zYXT*Uq2fwSF>{qA)c|E3<FkeRsu-?CS0Gb5*IZ8vXu=&QJ(
zsdd+!Z`Qj!9jA#bZV_3U*Az0LU8kz)f6R%S(@ncM7CcinVq@LGkbhWCErZkGo{#W1
zRxy_S4i-PQo>*9%r76{{&e73$xk6`i*uRixdynb`zMX0EYX<ALt5Y^4K0cwdcD-6+
zjd`cdn)s!wHe8=2C@OvXiRYXH$}83{d%r9zDDkKJH-G!v?jN#)Zg{7yV{z}(uC$#|
zl6&J?R;st<`EsMBNkJ0nSCl1xubJU!Xue_o)4uCx#h-f_<{fPFYx#4MVUf}=kG(dJ
z*R3kN{rb7+hNtse_TDs_%j4PE_&`i|o869tx&^G(kq^6FcRb12clM@QqZ<#)iqmJJ
zdt*ZGz07;OrTNr#Wsb*{C(~=03l92;6gjT&zkMq$lu6FzTK43%OfOO`Qv{gJcCLN3
z@RWM2<3)yo-Xx)i_N#aG)paUgx9mFJAW+b-(vX*D?acoVC%k#U`Sin<tsfUK7VY3!
zYaEeK;x8g$)^5iflfS9Vc=F=+TLls#cd7i$OFtcRX@c5;AoaTp=e92PSj`%KHA7)m
zZEmD<!WS#GUin2m7F8!EUz(mDd6n&5fThW|%b8dC>~<F|e6xN>MBSP1?Q4bqUN2ui
z`Q@qCI$~A(t9w^*>WL|w>yf^;_`-Ro&h(e!btUb~b;EDG$(g;_P42`S$BmEbeHTx1
z__X5AmKN!MoBuA}uzrV+X;OV_=_AgZYLkUadv#x~v(UVw{W>-H72m6!DqH^E5%iZ_
z{wqO|)liBpL;ck<p;)ujrL$Jnu5vxxW<B5fR%qXuMOm_6LrxuF7PYzH{by%PA4~p=
zEJuZNbs-KHuP{6~_Cnys%_;mF6}t8)?6`NekKz2~Sqr+qu?6Ta$WuDLnZ5SHwu+$5
zUW(Q)BbS_eRA_a1PFu8)?))h`D_-8#Zk({_-mX<XOHPYOEW3Qnb|Lf4(+ab8Hr9yj
zj@#d3)N6EC^TDgGD~BKJ%Gf7#=NcB8?y%+gYSGVZC3xG7cka^M8GhwAKAehMo9po@
z??TP)%&rTUZq3*BwQh0!@n*5<TLGcl)6_OGUcA?%wW&+|<B}^ehJE^K=TxMBm`whz
z|Fr$i2ivq2@h6xW_k6!q*mXT(`<(AjwJxM=YT-KZ_u%^Te=bbqeII{dD%&6Z%REQ_
z{;9WA%?LC<{XN6;tjB)6)m(e@O-<LISTw1v%gt6?$msZIF2_s7VH2u%WIg#*W1z&W
zb>t|gvG!AKr3sVN%$QF)|FTe!zoW3!D_qF6;?&8<COLAkH9K0`Hf=j<a>GL~Snj5K
z+pEg2t2tFSyj|Ts>vu~&S5B+^RcnT`rqUG`J?BbZ6BhZt{L#O8vFs-k9_=iwnv?iu
z&lFvzDY4C39H(_7ToPTqUk9vYDHXUG+_dWXo0v!EYM-1>R{#26*VtI<-uJ6q0%{Tu
zYBa?Y9|>Ktmf-dF(b#ZzYd2rD=+eks8y<c4gnQW!E^3^Lu`WKe#G&tU@*3HWM>`z0
z%Inn?gkJI55M}&S%3+GxgN5%k;}qxZs}A>@@A{^EUSLyCx0qVd#64TLoMsff<EatN
zWBMcFjt<-7ZLQ_(p&K{wUd@V=x};sdP>O%&T<PR1g_DApGO#kH30&p-;bL|q>Vf#A
zjF~%L7o{(+ke|ytqi{vH_k#&HQy*`+vrfd;P%lUBspRjr4lWLjBZZ=krDZ|oj%S(7
zrECiM6QiEU&Xizh|5NjdA-KxsqmZc_`~FAITjl?~lL}7A|9?Js>Z2RaL@F=Nd8BzK
z@GzsypL{)@1zaioi-qUk+gvRW7ZK`rU3|4QYfQ7c=;tt<{0~R=Z%>-}MsnYFx5q!D
zTfGgsw=<nn5jiBUQ)JY8d%|>qnE1H9lW%jc&-t_3x;DKuztW?-_+|y0@a!<(0G`;>
zMZGpp%*_RZoeCZ+igLS&ZxG*^^JD64#gmIpUD}s)G~ni`l*zYGtDH*yy!YyiZti$x
zEz_S@&)sIyG*OGZ#j)at{<3>(wc<<PWa-AwTw1)f{+go1(o9_~2H(X|-D*lXHaT%S
zDizEG^HyG1%v><j{(pzwX2I!UJJcSBb}nDYw`#?1nGkNnjc*RE5ebeA`@ANiLP>qH
z_<ZIkiJw3GPWm-hVCtg4YjJF?=Rf|kPSQ;dmtA<UCu40>_{xbZIs`+!(>|GUYH!V1
zbwETQc0$$Bxkf#O``(E11hCzizBGI4UR^EGknaa;j&}dKH~kRX0_g|8BTKVB-VJ&a
z`0?~g9S2Qglakfi3exK*dTqIN?Kz+4$^hNuUZX#z-A6xs_%3{R2Aho%>w^1B3KBh5
zUNu=8(`>f=<B`IgUa2l7_8;>s4pa+;iH57jnP)e+hVU@WYdyGS(sXXFr8X6pN>WZI
z=GvQNrNx{(ocBFASoyK*r#Oi>R`I(`)vTUfzp*y9BKyVmGEuJ5)bOh=cXyoUHvKA8
z!n?xw#4PnEpTZvZ#s<6eEc*I8YAwe!=@^da<rUMSPqO>%uPfNcw?5x(y10NTca%1x
z+4qg+i|hIH6F)qCab~AcMCzKA?~F~W*6Dd~U3+wk`t{}Vb1xpf`5}u#UOf3gq^X+M
zj<`0)pt{c;Px<dCWfi^8^m#vV8ds9=!NPEZDOG#A7;V{;mDQtEH+Ei&xe@PMwL@5x
zbJjG!PS%;bZlv4h9{yMno1}Aj+O1aKvu?8;vif}<6t7Y-iF2ALeyLo;j`@*k#f#$i
zEDtAsx)PD9^-CknvitrC(=FD2&Gwl+SwBhWOkCsUtyT#fVvaR(roGdW!WXyNt<L58
z8hCJB_$#TSvklC|o-Wq#Ij6Xq_2X{F=dRiL)en~^X;1FWn<-brA#8X~d~>o9OQUhi
zO=jklk`Lk^F6d3uZMTw{Y+fL9jk|V(Pr2L%=GT*|PVvZSzL9y9sS}g2y?c3}+?kmh
zk8)ml^jzKV-8TPuFZf?>+tjL{cUiw*XxEbdth~jc7dOOBOqJDcljH6z2(7q#;ESK~
zystbr!kdK_iUgcmHD!%dO}|C9y|3YF$&7EV3P<+l8hxrt+OuTS9o|!yPCxBlY%1J1
zg)!;A<xMGW`=i233h(|e={8*IrLnkr$?prf!F&?SH?u`o+&MS3>GG0$=QeKNt1zL%
zJlo?k*VEv%Ew9SL4UT>kPk1c0rp#ipOISkuytFrV9$6>3MSe328J6!eNO~)J%vjcZ
zmY3<-U)`#Ee|h_<X$xL$kG#5a_J!%5-VfHL7f-iwdNc2Yu*9m66r;8chn8%b(Ec)g
zR^*y%Y^UwyE6=JgoRC^5f7xL9@zd#BEalbRFPlB#x%v3}a_`-f=ihx_UgQ4k@;|9b
z3q!i+WKL^68Sj#lYSC}Cko6N+ITuG=@3QwUqH~uCo9%n?Xo)~Y)g|BS&QAAED;-jD
zNbqNkdb^}QcIO#`2F+i&6@5)}T3K#pt+%`qcTDk3$g@npYh8K9NhKeq`}};*dRk(N
zfJLujn3*(F(oQ?ue^VRR2eB+)^L6HqT@g)7mif&*bl9lyw)))QcJpN=R{QL2)?OB3
z)_otwn>t(Ru|}fS*U%|TP0CJbvCOeq`pm9ucA~R<sOi;D2bRnIY+BoCW0rGZw@uvt
z=PeIbl<@0??KD0SzNze=)a3<^XTLwSabKvVv|_<x?#Rll(-D6~4xHi2XnkIKWY)I=
zuc}u$QJLm_DhjG$YtI=+d-(scczpG4_;mBd`7QS@3)pb|<P}=~LQ(gC^y9b74*Pfp
zIWecjsf1o#8o6!uBi+^iR~%g~;JdkeQHY)Dl{EJy%RcH0-`CvyuP=Y<O#A=*e>U8g
zEWKlOTjkO#?Lx1X75h!EHEa}A{C({b=T}`r9+R8vvsgod?ZPBp#bq9knj|x^{$s-B
zOWU@eU1Gf=F2%wB=^n+NNv4ziUWz!xZSZ}k>Fs#-mFAYHGW9j;PfwbyUSs%FM&EDt
z?Kkg3E<ZkXxcFzG@kz7W=ae|uU%d(sdRonvwRAzz?-Tk(_cwRPn5~P_Iq-HqTi~^e
zZ+c2YXDssnyPb6wlTPJP&ceLn)`Xw>0uiTn{_?lqI(PMJcH>*E)v646-9?2ve|c1D
z+0T6S*5Y1#j?|+2maID)54L9n2HiG0Ao%_W56`!x)jPh6n||V&656ZdUAKRU)Y28}
z3a(t|aQ&)fpSF6R){WI-`LEt5bCyiz+PvJW)uv?HS+CL;|Mc@qS!<?OyoqN%Xg+u5
z+7n6z`P#ES@N8av@j~dOyc=ao$Aq6MxSqf396up*zUxz^*X`X#j0V4+ZtB|Bl_l}?
zZtYywt69vw`G3RO!Va{AX*KxYJ|$4O^n&`TSJT@2KgFJ1wRNWZso!DC5@faf`1|#3
zes*0rFrj^Wm(_>wj%gpyNhiO38*nkKR#EKumHXCNTIoVzZ<k+M^)mEw)v<N&Wjh~>
za@Eb^jaciqYpIabv{UgjKN!nzdR8C&dF`D&>JOK>-`l4fpW4J`mmJA_WckEkjjfJ6
z-kf=*|F}`tV_OHTI#A2cz#!p?anoonbpL5`X-cAALFLn!=;GTuMC-n<KcL31k}Y}d
z=&pBG(bo&hjBlnG$ENR=ja<CY^G1^ML@oVomwo<KpJ%LK^axm%<7++lmEt0Y2Zwjc
zKVUfL{pt4c>-92!A6e>j+`Je)owc+4@x~0db7tE%C%M<&vaRquclhk|6T4$om)w8b
zd-7@5#P2$M%#Su%KWm?D+M~?5`8qqhdEgGU(@%Y8EfI{?>)d{?CD7@O0*A2m$3qHs
z7AI~gO|w^xH;XIqelsH`jbqBXLZ<t>&k5G(v)$TPazeH{=|H5_!>VLvw`=nCRd#z8
z`@OpLb4785-T8Y@Z1*Z8UQ|o^px-+4rjSIboigLi1^kHz^d7qUd0#yDPG3$)K-A~I
zT}kl#(vBZ>(sx?erT%1Fr~S<M+;HHz4Uf=m?uZuQ2OIb*rSII__k5n~c1<p$cN5CL
zmz8M8u_^v%?Dbf+`_Gy`w^}|<`fs<vVU78dNpb)FK0f;C&-3oj<@xr1OdbapZEES5
zuCv_!+({>^JJ;t;mYFh_yN|Vef8(<mU&5Xly#Ki^C+mgg>89YyboV5`<J%w4nB#ix
zRd4?NV@-*h70w9dJUGs(pq}`S$Kr2k^RtxSpS^!^-#BLDx9F%7!@Q-Q9R*KBe${d<
zkly!JVC(aPue(ooe?HxP{d9T#?5RfcpF3aRxnju8pz~{{n_urm#WdgbYEn7v2P{?x
zM~K*@mDN;9F6Eh`R^e_ey2<Rd8{41ab@%EjK5GjEM9s;ZQ(slfwplvX>dhrRo28C(
zZd|uJ{jl{y-T~#k2fU|w8>jvAZRgl}CS|Q>P~T<VZl7+k<~5&0dDyS}ge{c5T=KXn
zaYlUi_8*lSzcnqDu6(fU^qJ83Gn)#xn#-1E6g;;`IDamyvbl}n@h45~e5vEEXUZo2
zuQ~N=cF~LNK6drzYS&B%n|r}0&#>xHkHn;S2`$~J{D;mJNuOF<x3RS2LxD`ovH8;P
zB0r=iPFx(G5wLXG0`=}i227h*xCvffQS5jvbIydRwZ}QCH_Scq-|2t>r;DKf4<V*c
z4-Y6?-f>I)XqeL!=An1^!v8m_l@)GQiVp%liL?DNn6xJ63!8qyj2HJ`U(8$nSLbAx
z=I0nm!-Es}zc6n;!jfQLYS>Z#<L{q4N*3vET*bHjAG7M+-oPNN$kEPj$ksWb#h~8B
z$GX6Cs*q2#+0OXZ2P?0f$l<aV=&u!<vBI~zrrfKFMT9kTLWKg`1{DF;ddv5EE^}sR
znz(IaXEeTEz}fwBZNLl7lLDs%R%X<kT+CQ9Tl+>lujEmN-2GN>9oIcKWI0m6U&Qe~
zxyJBK|4UE)=AQSgFPk%@E(K2i#&&G`xyKu9tu7uqRI->WXL{cOtv21n<6FYp-}b&(
z;FO#1;os0wm>t2pmErc)1AH0Zm#Dt+@YdbJue~9*ib-Y5)VChqx&7bRO>Z0&smx%v
zz7kMvB)jlj>W#@SCwyD}Hq`7&K=%fPqt6e_yWl8WcBg&GibH+7OD^T>w+PP_IJS3{
zwZa>LkZbw8s|A@3e0#M)-8#Vf!oj|_5~I+>g)6r=tA5FhXXd^fs>8^1Xu<t^dB3f0
zF8Ut6@~&u@I!j13@3#HT)4!Hn;d3tu3cOjsab?@FD-*b8G<))HzCZ2Ux^seUd!>GF
zh-wMz*q@tdYR15z9vZ}&6TSUy)>1C7HNn;rTbGJuh^nnWH1A5H|E`Q9Zw(w{W93$)
zp1IfJcU7d#w>i_>=gfk;QfcdF?e{ZK_PLedcX9O&Kan#BOPqdd&1LS`*&N0xXsAAU
z)-1N*2+=uL41TXIF<~wAYm@T1aB)i$=br6H-dy^)qR&$DQex}5lbpYDxqTu`4m2(4
zvy^L`xq8OqMDKfoleyP5S<brDIBPB2;zIAe{f4pG74m#9RxJ9SD1UafsG7wjxAz;&
zBv;m%SV)GJY|#*3J@xN#O~XqMiUsbmyIp+B7IswcjmK8)@KR46?N?r3k5AEjFHpX2
z)20<`R&G_<`DL1_+WlLBVs|P7B_4=%tV?{zZ~be=x<eKVKTfwu%(iPys7<`OV144`
zpF30JzFo}>d8&Q8c-2?w$&+L6K23^k%>VyHYuZ)C4XsBUm+wfQaPi2wje_1<<q=22
zwqJVd`TI`I{;HXIHDOcyQx^UFm$pzWc-F^HvIR?(j%?pA<h1hEB+fVNT2HJ0tKJu2
ze(C*nuclT;l9>0kFvCq+Q|(uBOxyGD)E1ujw;{8|mA);B<$Nc|`rLMY^ywSZXZ<%f
zxqEw2rpUtQ9Yqn5S&su996FRbIAs=@N$+%WQ*wL!<(A2_Ct5qZ)-|2`-tFA8`Tk*h
zt+yV|K7v)rhqAkmN#FPW@i=VPr=q7q5=TxQGt!?q`<&0($)~JhO(yd`jL=H85cOUc
zV$5>4xZNw|ii>r;hw5pyrCgt{MkmkxBfDl}uW#4OA10MkBj+Zng=QH^nS{>jdcpPo
zrqV&LyXx}JpZ84qo?Le(s#k~e>87KHzWC_PEuN+NS-<Mw?loPx=UT<D`rg}Ck+j`#
zqd4=@DUl+_H-(E;x>m8g&W=#*R#cq6euen%xIg_DxP?BiE`0X;g}A~})0Bz|r%Ao}
zw_Zi=)yR^ls1nVe@%Uqr`jQHh<0eUlD;<inSaxa5xiy=2bEEovd7clO<}WMxC3_|@
zvo*}7Sv7;Dpi9;1O5DxBD38=QW`jcx&!2u|X1~1kSj>!y9|{Gno3<Tkyz{B#@;Q00
zUa_+`J~il`En6T_yY7z6gZiNDS63`u=g9rEl*`c5@$IqC!Vx^56kX5jELquWY`LbS
zL;jP>B}Hw2%fCYT$<i7Rf7WC#s{HuK_2ZwmU?s1c7MkBPlh_nlIHt3Hn|1V1dwk>W
z_U|!C_6Oc{C2((fZNM9IV(X35sd_G+=MS=$UVP{i$evK7!e(^m$2R6=CGS;NH}S8U
z5c5vd;%vsQt`!%oyp11+b@5a>hAz2!mu26|_W~D8ozHoeZcqGNkpCxPg7b?-H)9?g
z=WJ#v<M3(k_A!6F&&u_|)awj6-8<%-_Gmx9`-5@Y0?&x5H*M!c{wft%Hg0wGI4p7U
z*4N$KH{*>KubWjjGy19W{X>hUrmWe~IjgI<DRuXMk;j^WZ$;G4_x}|1Z&KIqlybGQ
zDPK0}#YS~G3(dbA>Dvyr#82A4>5OF(hi%2SlEaCAK3pq)(0)bOeznTYBby&TjxOl`
zBDLO9X8&g)n_z3Z`uzH|<JapdYWHkQESHk)-da=hhpp_*iMxgzG8s{6DaD+@>AZ)R
zMBZpVY{qH7uz5xK+<RQ%A)!UTn3!I0`)Gbo{33bhYTt#&C%=kwYIf!nPJCp=!oVRV
z5Fap4QzDS%W9nN~Lq^H}Up`LOiionj_eizr>07nfRe^IBESJuY*z(O_#(rkcO&s&@
z-RA$!qx6UAB*&rpTgF8f-+vDYX+K^ktFx%<mu1aIEBSdLIx7D&++r)e&qeZz2UNbg
z`zh1y>*2Hz=GAxnownA-YhUeR`DNv(v7*TDe%vI(x&zFnccaQ?KS;Q>Z{um5JxNRF
zF1t95Z(@3)Q~UHcW}CbxH{IWu@7*@FG{b29ao-;QHlLGjUthTEf1Xw}{|f7+dFKxI
zPp{8O-9A^!ebQ39s|^(wzi_Vln{mAFta$CCOnWO4_H}G>&%;7?%5J^*b=8VLtG7%}
zpLyWRNi~KkZ%(ott2SihRoC@-@cn}S4(b1i_bVr8ik%PoyJM2@yyZoO=Na~K#hNeL
zs}shU_u`1jj?XdYpLsLRc|POu{f)^J1oJJtj?8+d(ex(&_!|zfmJJ#QcI)z&OkMML
zdZvK0AD?nWxa?hn*}`GV>$CZ!t`uL`>?6v5WM0PV$9r2>pNz{1J?_Pwyw|7j_@5kU
z*{n-n&n;WYd^2+K-t>%;AM%$qwird6SKIKoSSI4KS`Blj_9yAvC#M}v&yF}?6!VvB
z*I)f3eUD3Yk9F=&|1{~>_U{Jz@xLBj?$}^0#t<~)-nvt_^N;XG%1CgYtO@+GR_Df#
zBd4?VA84CANn7}Kqo<sSZB*oHH(%W~p&d_VUbDKWr&qq^+HuFIWByZIPBXmP<a?xm
z|9j65OOtIgQ?0))ocwj(ixh?Jdo6Ef$R`FL_PWYxbjZE`*4!szOA^n#J7#q&`By#5
zTh20r%1yF8-_qD0|GnYZJ5`MFW%!ACI~M#>-IE*<c;xwf=QTDq<tObI{s}u3qH|-}
z(%WwiavbB(^t}*KeB-9Vuij@HLfeB24%xog5bv+m@A6QcJuYe9^1vfaN2-D@yth|>
zA^e#ssCv?^fBo0`I1?fw9qj#YH!shetsg3X+3ecn?N=vcAFU|duqfe5_1rGwnUSgQ
zHlFKLd6PTQ!HT(6(^NQZx&7w3>N#8j{pU`o8s0vo#G})7XV<KKB>{833)j0{Dft)h
zbb&?Ns&8xLMa`2;=DrtYudI5!+W7_lfh+TM{a$Xb-S+#Q-2v&^Ecpk%+sy1=g}$5f
z^6PgQ?rHj}E3_{DY4yrh4z!M%nzX;^K(^4c=9&#LTlu)>K6314@^*PT$HP`a=l8))
z1>XDrFcfySFX*4Ebn5e~|0)}=S<l|<nt%PQSsAP46xO_+=f=wphAW1dPDx3Al@?f}
za`0@rdj+@R;ixO0{Eocvef2xrx-j8b<@bzT7JGIr`g3s4E~Bf{R%@UBb@9cN53@L?
zo?ab%f~hsWC!*wuyzZLV?(d<m+io7bxF*BkdE1X>#viX{e#nrt_<!iq?u}Iu29F<q
z+>mlHaMxCe{&w!4KR&K|?9Jx$^omyd%<gz!g;$-&cpTeGF3jurvqE=yQ~&#}#f$d2
zu>8NuGU@8GRKF*Osu&N|=duT0F}&p}yU1$I3}*e0VaK|UsZCh3NvGK8UTepiSIhh4
zUv=DAba{<La8t;)vrKC?8RjuPmR=d8<#91ZTwB*H!8r5JmUDvnIZP+Z@-{^*v%2de
zUGlj%{*|7RXZwst=XZXLKfUVcPMfZTPX66j9{U_#x>)-0<Q*6EUR8b475~K8{PucN
zTmF5?Y0F*&_|#TJO$c1RUUOCY>CZ~*GnQ()9!qM=l2^49+j5}Td7kd%t+N(BoSK^1
z*70(y^93>0lOMd5|8TX=n$~?<rLb^nWXTHEJk#{#qIIed`Sw38QP;aSO>>=^*y2f#
zbUq)Ke6lxd^_-tNRno05)y!U}ZF_5X@muKXyz=F{)2F<5npIxgf6xAwU7fU|saL>}
zUsLAJR64t^ekR+|2l*M>1ZU3r@%`~#)yEG-r!9^adl2xZPk7$5@I;H{GQTHC$ktf(
zUf(0STldQW(btcSP5QFp)^ACxQ_r*bWH+<&$oi~@&-OnLzs=jb|L^{9N3Xek=V@NO
zFY-!bsaUvtSkLKolG98|OAOfAE3OLsUoONS^m+e`mA}vXe%PmQZ>_lala?DsKQ>uP
zXUhJOM(wnRXD?Wk&&t3MC%}Mfbxul7VqUslLFLi#-0V9R0{`~ycTyF(X}SL9v^tH(
z)@o1Y#_Xt!>hcL}i?<%%ot1Oiqv+D!OaJSPKb=06oxe_=&u>DC@hnN(&vw<v?Dp*c
zll^nI&qAXOd(JJ`WHfz&{tf-D9_1TqB-e|jzcCMezxB>Lo$8%cA7|CxVXWqM3)N|6
z*9eJSB(quJ6suAF9nZr>kqq9UsjX{xHfv01Y`x+oqID%~nNIkugW=q}gjnOQ1w4Gc
zlI4+@*jEnTH<!N#IV<X<d{nx=D#de>`L>G_RD7mwy)><JRZ!T3q|Ff}Tl72D{$DfU
zjmzV>N4)!@Bt<G#Z(7#Sv9*5v>X_0w%-Nk0)wej3%j<7m{#G1QcrAzRT$*v}G|^k}
z*<X6@aWLDizk7Xx>Q<x93(=R2r$71V#3yxMJ7l`V#L28B-=Af3nOZ6(wVFtr_?t9Q
z?2trRWJlKRC`p+}`8XX3x#QCn?)9#@G3)LME}7V{OG1*F;foA56kK^ddv&>o<qzEl
zlC}qxkA;6+ef?usyKXw0<*_rFo=nWHa)#$$yeqU?w$hP3(Z=9+4!ho!hQ1BfQ)lj2
zX?&*V!R-R?_WXrRy(La_1EfB6hvgIr@;2SC-Lm(jY)tb>R=I$gzu)z^_Z>c>em=HG
zVCQl6^L?KZRBVN;ejd4X-MoXL?b*q2{}s`H!qayC-;lWE``XuYF8?d<-eCMADY^E4
znZG-C=7SZxnCgDM3|F7EdfBN*c311=rsswWUEcC|O7N|}T<vRS7yP^_ZWtu7@wfXg
z>vOJ$9{yf*{+{Ih%9(fD(i0B4%{{GK^>xKGt-zq47gldyz1w-GjJMj>4b~#zYRmjT
zimR?Z;JJ6l;b{&2$F5AOe4+e)=0j~WZQ+VphYWwXcb-~#^QVpAVWyy&Yqn+IyHWFV
zR=bbHvJ>T(Eu!|$7jmB_yl+Q<68D_0f<wG||K9KintX7}Uiw`0(vc2BKT##_A5$G-
zB{z3Xd{xHBrM-dO=)7jL(j@O!Y0Yn|+dpx<o|c{vq#OGzuv+(4<XQfU3mm)lsm*o&
zG`U9I%u6CAx0rKz`Y}6s=|>y4{+l_=%Ivd$&x9<UN5x-ywT!sxJ1S15tP+n=e|J=@
zoGGyO*|gk-QVYe;whqVc9JWj1fAXC9LPV5?uYjMAQ`)w;<i5({>HZ(BO4(#@`5rqU
zs5I?yQRC-=w{5pgUabAO{l^K}(Bt1ZnI9fq&YAK1NKKeRKxTpPrbS+g4vi<GWe-(K
zT7@+HFyKm%-^lq_+9&WEdwXijexLh6lS4#YuZuU^O*XsI;BoP8rYnbd>BRW(<r^<n
zGWf1;Vc)perg2mC0`a-Bdd0`PkFGu3zrN_-k{cx*e^xx=yX#RFciX}>MyP_-_WrIP
z%Ktz9d+PCV@i8urnCYixZF=`xb#3sLt?T0_IyukYXs~ihtkdu6-uXOl3o@5;h45#0
zHB4`tF)!j=#<|4fJbNr(GR<AJ>Bu|5mN)ADg8y2!ukN1S{;j3+%8Rb6g})hd*_PWL
z`>Fo=fb)yB{F`TAPmEvCZQ*`;a@6XzVyO<sZEV`RxaNKgG&h)KDw}7%p?~&?H#svt
zAK-kP|Fh`kQttiMM)#T@SU1>OM@G7TZe|d!`u29_zjJ0BnxVcEcgn4jUL*IrgmuSZ
z%cynUiOlCJtmiz>IcU84bx-Yqv<BldPem4+v00o6dB-(fujfwKjgY(M=HEE}FwW30
zF?#E-VWMEtW?lR@ILf@Ot(S{)bCUC)+xbfWLe1wiYxn%`-E=ND&%^zV?Ta9(u0G{6
zCbxyFmOrg)Dm<~?aC^7Pzb}DDG%E~eO^D-Jp_{<4=x4;I2Rk_}tKUuc{lRi>dEB)L
ztbd-#eitbbz4iWlNY@rkufP-g6)p0+fB&i3Qd?&9PyBT9v7=~*`+b^m`{rXl1_nP9
z1_m|kt0+?|N>YpR5_94Uit@8klR+n6ES1hKzP;n)?mE`2dWEZtE9Yg;zL()9yL{W^
z&qp@eZk!x*{OSh{p-qL$IHoD&u9o}%{oNx+CY7%rLW@0Bipn?M_^wy*`^m3YPp&r?
zPrDFvp?UL^XQI&tQGO?WEBU>9dC>pi!;JYdpOZp2?f%{Mr{u?F#hp8sKQR`yQP-?p
zBB?*E!CgyA-+i&`$>}OxVx^(eO}aRu#rCZ6nDcy3m-eyZg^67|cAdX*hau+R`HBC|
zwf<ClXZ-8VpB2wtPYP?zx_)(4!cW;w)}0qaoSol)+1X@!uxfr~RJw`6tNZ#QKThpG
z8p+$Q_u{hDhRrnxO%Jv`GJ0IjIP<!W_u17g`rOkl25q^|^W|gv=kN0C7oUH>e%(1e
zJ1Le~_G&iq8+Nyy?asfr{d@eP)%w%r1#d7c+p@rNg>vE+#mZ^nTh2Uwb7W66uVees
z!*h2ZyL$NU#u^1qokuNFHf{V}lMdbg91+m`q4C%XTY>Wo2^>z#1#h^0YS^^>+sBvH
z4t{>?{q+6TJ^Ve(wBdTo^unXMfgksDMf#nVUeGg%|HSg;JN5*}7w$BvI>3JDkJgTk
z58ES?JC9{ZPOhJ2ziHC*jOokIbLw9Bz?8cA+Iwxjq;8iz4ttw-GV>q*E;C0_VxsAM
z>nPX$!jq3G-4;)}cky|{5}AFXk|#v3bDwxW=jp_x??LOnbgnzLSTK6R><`c4!<S$D
zsK5O9`~zBQMUp$&Q%?$-KD)ueo;qpXh9y#45A=F!CGTZBzUbO*gG+UZZ_;+I(N6g>
zr}NdSC!+opX@|XMn_c*SMBe;>UF%wz>x&+Fe?5I{!<1JM%d57qT{1J&WEWV%d+X|=
zrAP9ko*ZghuRU$y^Ql{!3nRBNd2fo~xU{S1K1Yd-q-j>$g-J#oRg1K8w|vj!`t)nA
z+Es&DpNx4*Vzi=s9FA%{jaD$pKIo<AvPJoWGDjD;m16O_tu68#GLyeD9qjL7)V(<S
zLpI;)JL|4K&oPtgy<%s`m6T#Q`z^cM=GUoz7}oGcO}TZ<<Kw0VnFB>(t`qe$wn-Fd
zG=^C#&PzRfk0C<alw;#*3;(5)%$WE(%Q+I+*YYe_d-Vvzn#HFTqt1s)y1zDg9=Yl>
z)1#ZGKBsN|c*N*_)3kpUIVpB|@r_>&ZeCSAuWN%|kih2uk4!m}pZbb;{8kCN@H%<H
zpFMr<@1#z(o(M@Riq8tSe{B$~q1^3YkrCgpu)+F#^_8!`+4j{wX=-YclDPHiB<ri0
zq6@yvTkCvr+M@+8(q*S43OgTpXs)-*OrGKT{X5sUE=XNc#$8{2HBfEhT7KP`0>U#M
zl+FyOdE3t%T`lW-a?gfoUZ1x)v*?8G`($+`g3s#YCVMA+*6kZkxUy>9c#y=zu(?lF
zP}P0^$=&<dccvelx3{pHPq5!<Q-V{`6!k0pT?~u4*1XoO@SL_f>1k=N*h-0giw`BK
zRWln;xSQY}J>%py!^JC1&ZLMLzu`Tz!RF+vDS7D~xydV*UNJaob?f|NRntA0x2K$s
z+I&}iy5-MvpQhM5e%-7fS|S<s#%IFbluwVFKHE0!t17ChEiU?Y)Mozir*RH-hwpru
z?fR}WRq|q(yI8<n=9_ySu|0Kn{`hj9>UR(AbBqrR&qZkMo_t}^*SXXARrD%(SBHN$
zJmr36%9-#bOT7PeTowB?d)k|ctA4p`ymzTVHgcMX*NINy<XGp;joz~y-+%E~-1Xa5
zDLJ~ujCbqe3cZT3@Q^%Ck&`EdRXg7t_lQZjpw45Z$+tmfTR_=1J<dbFF3y(Fwp_o9
zb5U=ZmUYSfaHEZ!o1LaixzNUt`t?S6(bF5NjCD3eWb%lKB^Q0*FFIK4{m4z8d1ivw
zp5+w}cizgJt#tploW4Q%=~<mGR9Yl|8Pt?Z$W<ltoUK#O&pdW$iJrHId*HcXtFo{L
z)7eM1GT1Xr{Jh&J?$;z~@oSH&I(Kp_ESdh=_Q&i6^)n_#udi&WkuUJywc~x;-;ZaW
z^4B=*-0}8kt+1QDOj73`hS#gETo76|^Tm#Xc9s15ST8n(&YKXYn#>+QVMfQ26jqCP
zzYsoUBl{E{u`T6S7Ct{(dh~sUTvzoC^|g}<cevSP{PrulG@IwzjZ;>Ji=VZXzFa4I
zjA?e{w>SOfudl1_b-XI8YPu_C^)kik!{G@>-)ZG8XN=gsul(!NFNbfgzf{9F<+gwS
zmCeff1&dm?p7aZSS^Yfye~ZVu6)W~!3;6lbV{guhmEWaL&W)9sUvFy}s&esRb6(r6
z2D{fRIy1Qp*uK6pvA_DxMlOqO>ts!(2}aWkuPX3OpTy{?>!oIr$d?|VdMYX~>yrHL
zeMRS4#g5!N{krkbdG4!4b?g7ImY!y8=MYr)>8kQ>%(si1STSkwTam@Cds1$4-Tj>U
z{^#@Z2~$4Ke{nbddt7-m&tk@pul^`L_x~ASZSm#iv6&H_U3#(R7tQ{he)`onS%c#a
zXJ!7ymj$lxv&!bjT<%)n@A$ZR>F$}ToT5jrToL&7C0TO$ErY2W|0pgxZ_?~_<7Ggh
zys<csyT5coh}-(lC*Gx8J;B1T(_j*dwr*Hh$-!It-Jf?i%t&0`b9iskX35rjR>oTe
zQf;{<S2&fNl{lk)F5E6iJz_dTtlIVDA6MV=c{ZObDZQh(+%$aSo@MK-0!^~DQzl<r
z%JA3jbK{+T+3tU{ECVOohg>N*dgtoF-16$}JI>@>6LI>#((;G`$00#Kv0CN$vztvi
z^L`b)*nQ}ho9s>b@~zEYg+3e9^M9{B6D~IS2VZpP;cWg&Xa1`iOAX)3ni{W>%~@x*
zdfCmMZBsQiKmJsu_(u3d<a~eiCoSHEq81Us*6PKxjsyt3au)ufcHr>G8&3P{wKfXr
z?=C&Pr%g!KYkJpb9|y*eKn|(%tRj<F=`}G~8mrVu-D`jH_-Oc~rE@=}-8W@_|K~{b
z>bmOsbvA|e&4w(TUfj2xLM5*$a5kr_NqK$#xj3J>_xi$b=gplQSMPce$RQ>D`poaC
zf^VngTFtk*F01Cd+&uN}>#SK!Ix$JH&%_PG{yQCV>Zxb5bpPYH*lLDg!CULnU6Xs6
zf?wU-8{qzKm15Uvqc}@W$8F9ZmTr9zG_PB*zhdE$JyX^57cP0exlp=Cb>qyv&)T#+
z*WQ0(k$tE#SX|OIF6F-B|5<0t-rfDCn9CXAQN<|5+t_Eb*sx{Zs+dG$?Y;SO+|w8?
zbNBTNgv~8k(WJ29#K|YO`D6^-R$QDsxh0T;zeM!GzQ<Op3$iT|H<aDrog*bwU0BZj
z%y`D~1i{$khD!ZCi^VHGR6RMSnc{YGr|03nk!AUo2`82KI=D9Rcg(kBnZf?tcYpNZ
z{<~81U+|V!2EP4x|KGpkx0C<y<Qs<+^Tc!CHapkorK`|9`QP2MAyP|PZ*jF;pWU@t
zRhWt0RpQMX9gTj$hnfF#1g#9uNQAxbuReaK<8;E&WfjE|dpWQ6=!dBr8C~6P<J0kf
z1y}6TGyII53FrI1?z5V9F8cEe2_ctH2i~w*9y56<*YxXG#+2r3SH+szO2b#r>am=)
zVdbs{h3LiU5&LV|#nw)YQEPNs(k=MLIV6Hv%)5T2%7&2SmQ9ORMs5psood*;#I|JG
zo9{Zs8?Vc-OcdYzO<V8cjMai_C;H8P-;*v+HpsbRl;FdZw$7Ei^oQ%L#RkV4O6_Kx
z_;}Re$`NiJ#Xld#?`5V}xW>&=eEXWEMAh-RjFex@RiV>DyU*&E&ReWFyK$y_-Gs}^
z#v+aL<=)B6V7w)xw5icRlUwoM-0h6K)4B_sRxdwN^iQdB!c*lvSB^7rpHKSofOTf|
zQQb&6rbpUYSFG~xZ4=Tt^(J|$=k+}zQujDN<klT%nO~4IMct+~)_?D=D49QRzOE6z
zaCrHog@Ui&@;2#gin<eh?>_&^-g#^0ZRI#IUwMj8aq2-2=`{~E=Vl#Ln%y6~{MpTr
zs~uWPQ!R7#ueDq^SDzklKHaH-C3@znw-$8~EvH%>1E&1R^y0JrJ?W&6rf<~dZ56YG
z9x&MiJ=%LCB+l9VWp3!=D0ZpR3I9!(W<&^_@BMi*OSY)=dlSd0`%=ccA7?zB{Qo}V
zx~c9q#fpbEU+R?l%PTYKt9$*~nC}l7US>P(SoCt<EXh*;h=zts2FhlcADkT)`FvP#
zV$PYD!gI=|nRTe_+<M_wQU&*-bt`p4UVkZ&Hp+-p<a3#zSYi2g%euEe&Q_E#)TK%P
zsj_CNosq+;ogt9_;{<bw4y*93Zx7REnC{x>=XsrLX>|J6_-~6^Ow=|kRpwv~kIygo
z_eyr|oVZ#GYkS*IR@0U8cJH4nA=`9qnyWaw4BOp;S53=gKerswv~V~Xc2d_lcl&Is
z{kynV3NwE=w(|SLXIpx-&&1q4EdA+ImTq2u(p8<<m(P7}KH${;8>?dfW#UZVx#{e8
zH*ftoTO*Rs@arMjw54KBEll;&*Mt^*3_0hyebI$<%k2AtQjd(Z7cC2sxbW=)dw;~*
zYM#sdhD$EWie>*vxb>0S`}r=u-CJW!CbTWcH<#TxUEr_UDYseEN@u#wUEP~&Q#!R!
zI;@!a()TGdD|fM8^gVaQxc%FVxmDZC&E~W|a&X}7n7xd#%l)Wm!?y6JA<ysbFTLev
z^<q-#(Y6!Y+c$@Ge2j7Vo6UGP;NIuPdxgEh2^wnoy)J2Ux1|(#e$TwH*sv_3Y<<|9
zQ|k_G@;R~Vwn@R$ldqmVnR2B^O0h(4&fXn7`>U8Q*YZ~XyR?btBX`&8<~Oddj~olG
zyTr3^^*5{Ko8<TST@K&8ekZTN5$iQ<y6TSl|M=@B99o-}yo}?~{OQ-f{eHXVIwxcL
z>vbAh&EKxy39{M!qkywI>wVGh+~djp4POEt#a3|K&${wC=K1W8ySjUh?7F~pFX?X8
zSF_j?n>TE`d$#-Xl@^v_%kx!R9&g>V){u*Nmv4FPf-JE&?mF!I8#g<J=Z7$#{<5z6
z_YJMt+HPul7J5D?-WH&lXya4=<3jHD&;=HUllQ+A^lR9-?Pg+N@LASZQR&V;&lI>_
z?|0_cZ7+Z9{OiPK_gCB>iccJFf4F=9gBYL2ZGm@%-pltte=D0NdcOL<e9P5*o|rC^
z#=8f$Y&Y0Fy-hWLH_yfD({Gwm4wc1U-+g4hSZ(jYJ)ImPXY!p5#6GL3#9pZSyW>Xi
z!uvddz3H#aL>C?8(B)h#&~5xJewA{ddC9_5p0<co*{X*R71n6<x&LQI9nO^hZe?J^
z%fQfW#=szfy_=j?3|fH{{Tg)o{r`3QnI6|DTwQ$A;;ro~$@@p9TdY-IIk$7_x4arT
zHYLSQPS*^MOWS6h{9m`5yMaZ1)6!czU!MKh?91eB^X+GJ!rzwIJ+(j2|25ClDN_CB
zFFbMjOC8apiq>%-D-^%YZ}oTgzrnpTO8jL_;HGqc{<?(8tqJzrs>RbfvL~LrDzq<o
z>4Vc3Gr~@&b}xzy4QuUCnx+@NNkj5{apWhXsXH&JXvgVoD#`kN|4{aUdxy-=US6L$
z?}T(Kud?&D2VDC%tq;1nylAi2XUoT3zGtMItiPPh<=ovovwoWA)Xs*N``@#yG5Ft_
z9(uQA*7+qrcl@iGd2(m&?6AyfH~Q)yoNf^>4rF`dy3}i@OqKOn;X>&Rm;cO4&n${L
zqn$Eslk>7l&8|?z2jv{q0)hs%|5~CAFVC45>(h6CPiNeJsVnF0=kK@4H1+ALU-I2}
zW;bV#k-@Ji+KI<&R4u%o``lr9^OaXe*j!G5-&Lsg5L@c~uprl8w$ojr*4K1$J@EJt
z>b2+SwaK?5)&yK*<kE2pboW}rBvdtJmB!h{PF@c}6peDEdoM}OZkb%a*S0h6Psyi8
zUtiwrZ&zls&kf8njBQZjTwcC7W`gJ`)si29pSNe;a(G$P7q-IkNf7_XM|*Z?a0{e3
z<Zmc4%(A=qN{Vy!tX1<EcK$Q!_4buXkJ0?*_u<J`-WPqJUjN(pjQ`)8w{Q1~y_Swt
zS#wR_Y%=TYl^YuTofRamUQy~#WtuE+6e{*kC*#Tb{3zos%NE4mE=*R)<DLC%)sx7w
z6U&0q?q1XIJh;^7Q1K<Md9jDCgxfAs{qSPL!?5kUpM3r&v3O$KpVi!JrR$F0daLGl
zK5p)2<>TjS^Ox;usPsQ<UoUR=_1G*OLF0nB%z4uSpJ-1!%k(Vckm6^V(vQb-{=ZKt
z>eUF@D%5Jv_u6pI`s2K!JUmvxdMS$zWle3c`aS=3+@FsZa+Y}I?{)Ugz29sm*_Ft~
zvpMD4UT3wu;7~2^CHJdTwCAZ$ZK}PRvTdnzm){MchsDdK-^})(dS=z8xM`QKsI%QI
zc=2GZ|D(K%d%ksw#B-IX@h!}iQi#*vZ1VrfrB~DVGWnDvlxp6Utgm3amd5!dx}8P$
zg3yEF_14WBDs&eGnT3=F_g75)7~!&N)>)~$8QaV30$=8TW&5!6c5GMbUEcG)-^H)1
ztoagPb4*X9DscnHarI`~#{LGg>;E&24=UXI6!G=*q<SF+{uy(dnp(b1niClokbI!d
zcJ7~&e|1b}9jbc+FM0U#^6@&VhCZ?T6!Bw&$=hz(>z($jjEqr=ms-BY75dHJCaD!E
zdLU7DOUdLD>n}S!dy(thVJgU~_~?Aaof*5VEAm$u{@!*q*!SV*U4qw)%6cxCf2!y^
zlDX!tyRxF?UyfgkuG?JxXnX3YFUvmmDNS=~4>WMZzW6Qk=W(jFN9o~bp}L9g2co91
zEs@Q8VC>U$UrhQ&&OWzIA789fWOKR7AYT8h_FevG?%ke&l^0?&?*C){^-bW%^$!)H
zC;FAxEYpnCT&kArezeNrb8iuc-DB(Ne6trnwSIlSC^gFSl;s&YVUH{46_S3>Q`^4d
zOY?`{?d$gJ&ss9~(~rp~goAEQI^z3Iq;~dh^-G$$Y4L|&oISB>TYM7ZE~cv%Oy?4k
zZmie2)~l?c+Rezj;H~hhOAqu5L^+Lkj~Rd2`nqbv!O#iIEiav0|M*cs`j(At^HVqG
zWj_`^_BcY1aT|l->Y}}xc4xQj4)SUFeBqryidy)puX|_8{cmYgtTUdgAaFKI=kDCw
z9ot)Ca<oED=CO3AvRYV7oEtgi)vK0ccW!*x)AsetvlWI9l#l<GC{|i}Wy#w=3;g@!
z7KEuD@4dU&gG=_xlBm=shPVSJw~mFeES>)3xZ1<QefyMTo4+4^_w9n+TJF&4{_Ah$
zmFzitE>>Xk*=x7I*sYx;6LFZiJ%wFu%h^|Tbqas(J(<aC{jPZJ+`l&a{AE8a4+}{y
z&#Kpsyc$s{?Pz&Kmv`&i_;CB!_rZEW9?MtRxYZr}!)0WC^xCGTOqQ9tb2AKzd6E<+
z>=3i;617hhIFbK-vk1eKDCMfv$KCQ*saV&2ZmazNEyE#Yr^ki*s{2)EEiCQ_71->b
z=(A$R`U@YAamRhQ@$ATt%ir#8{WHgS*0EbzaeUqR7m5R#E`64|@#}_AW^_lXqzH2q
z<9a^EYpoZOw%waFIVGozqwP`sA^95)-?rX4I5#ok^nr&r^ok6+b6-x&{MW28J@%~L
z?n8Ta?q8|9;Z}XV{}kTb-Kth$88f}o%RN5q)@?m@>tgKxyzGNh?e@)m5Mdg#xA}9d
zPS1T)scR=sRjhJ(er1}G#Dc#}yRRoi`S&`qK2UpNEcD3J$Ng7>t*4&S$9E2=IEv3+
ztmUwrnD+EwDF2&FnSVS3Pb77RUa}Nn_`6f5;j;I)ossWN{f&=2jN|Z*{j_P`hM9ur
zzaDn+S-tZ;V@G_bs#~-K^C5%D##LVR!avG)>9xM%6BY3P@?L=TLH|Slmirc)b>4iG
zo0#Y&bTOmue@B9#-jUo%=NM1t=Np&o+N`)I;eI%ePG+24(^7%{|M@zs<<-j<O2kS8
ztZJXxbv13S;;gGG6<T|J7)7^Dl@9!&r*VAV?y{QiZfBBT$Uiu>UydVb(~DBMoZbm%
z&h6`Sl7F-0;*X=7tM^+-Y-?<mdds)!x%NCw!!LI?$L`zh{gdD6iRw(n-rL<G&&8d0
zz4zO^l&QS$O6=CVkD{(yn!a5$_1gh!jo*CFH}7Veb**uFb&}1A&Ra$qS8Mn1MOx2|
zUAXObu32N5_rKZFQ`kT3P24H>`eWqZ88Pd=@768<${ziBvfdiG*4ZU0f7+idz4?0E
z9G6dTCyK`P*v{y`yI9LO>-UVV15zb_HqOkQwoiBS#5+d253}qNyz2Ag_1yH*whinm
z^L9_w(o2m!^Qd~;8AtUxMx&YGk(EzEpXU6}zjvebicKZYoHwSaQgQRQS65fx$QN9+
zjwzBsWyxy?jy9*mZikO=33(%>C^yZdFhc!}o66UWt~CDHzn5Q@>`g1r{kS5kQ-XWf
zq=sFYSuZZN_m)U-SWK|E#ByWKGOm~3+%~GNuoSu~Zg6?)Q`OH8e}^`zcdEv<E{U*P
zc5FxQGX<d!`U$5qXE`jN$uD`&z(M@IiMj2&1y{oRUClL;r!S5@YkKPDJ?>49Pk6lC
zbg{e5OVp4_`O2SrXV>jq+xo6;&#Y}HzHZIE8+)Ibzwi1^&3h$`tIk)kJEU7({_fgf
zRybqRUGFxFDGXm$d^j$}=e@+>rMJ(6E;qGQMwRyI#}uTVF45&XuIgqIao&CAvwevv
z3G27`NHVhusXr8DIA68fDCX_^<rB|+h<SEcHvD<PKIhZRyK3ewd-dV2X53|S9~aRV
z+`psNJw6auAm`h)Dm>p{#=?tQCvNzZO?%c?xuAN7cK(tU=XEZ5CdadWPOOz!EI;$>
z&e<O(9e!4t>Gl7cpy>ynY3oy_s^3<dZTxA%o6UyD^n0rUiv+6nMk-8Oc)rrpFYkBe
z3C%^N=Pi6@1Y}0pt~Nd`{EbiJbEH+f!jU|&7acF&u}+uNudq8Foz7|}9$b22;^#@s
z-#bkwY*u~osbXK*F=n5zM~Z>U3f6W@i_R>ceV<?L_~*k0JU6y#guIse-nsVt<>S2f
z^wr<%`JF$%=Oeq1ll>L#Yj+Kf{cwKVydvY|O4+BLNq@U$ywtzNmGg)zFUvyf`qC7U
zng5Hv>&|k1lU>lV)1N`B!<6+^2j8^zrqaFhzG?W%WS@$y&fWHA>-EG_@vqC+*(_K)
zOebv!-Sl|lza@=KWsbQP4;D1)Nn|`;?^pOJ^g{V=F`XAl-c6i)i=K#OI5=@jIXoyb
zNc(i@S7(XlAwSM3y)|v3_e3A^Y&q`7Z}>9n#Ft%HPw(6Qyk>KFbBk17hW2Kc>JCe<
z4=wW^mmQRiUh`6G6Xy=82O2I5toUN34)2pnZYb~J=)QQlCUh!G&L*FG83~&oEX(0}
z#!&tAfQBf;Y_CTP)_DC%IeGm==K)E7Pm`*%Y3o)PwApZ*MLZBLelDYY@Kv{R^}HsT
z?fnujUhPO?KWrg#u0-#V$4T8O-wID0TyatSh_`}o@!PTzo{P~^clMwDFCqR`%`kUD
zgLlU3_1$G=Uv4<BZH!}QxqJC-g36k8jH#>wpVZ4<zI{J=QA6dzey8Z8`_KEIzqfC`
z&GO@)zYABri@2w{VbATB-><j4v|RrB#4|35J-1cd7WP+}nR>JxD=e|hNR_rbAoSwh
zgDX2S+a{g=ZS0Vo&ldc>^vWtG?p;d#-BWCCOl+@fPtrd6Nx!eVtmFjC)OqZmKPG%O
z(pztq*5G?lTXc7Axxd_tN%jvK-YvXY^ZJUz^S-aAw)IIy&wu~7Pi6nl?=5v~U9Y!t
z+Uh@>&E;7B@bm#mCe7zzrQ7?MKJun+KRokB0Bc_J-ss|voCMu}d5iAvcva1<wQ)w{
zsS4}tSIg|r&3N0B%B?0*zs6g1HVb3TZsphKt~zZ0{9sl7<!AQAH3=7Zs@zK|CofOs
z`uN=ZVSRGxFN=8gH?#9+C97p9tljW`;==7&{m<U+&%E&cZ2RMj^$Y>t%q$`d3=A9$
zphI1lb03I(2x4G(Jd+XEvXS(>{M=N%g37nG*~PcrHoYkS&$XuJ9P3WS%+qB;$De0h
zkMk}InJ9mK(&pJg5gGz4u4_D+xEm&I)%yGWw(a?O>~d35^6g^6ZYnj-oEPrzzyEn+
z!Joqa@`o4ec!sB1+00qCT5EP{=0~N9t$mX#t!j*_{ya$hU=<%Pdh_NUu6Z{1{?>8)
z|0^)(%;g8MQO{N<%!*smU9-34l;hN6r`h=r8Q9EBPu*~4`D|CIHQj%dW-m)M@E3o*
zg(GctXi)0URXk~xf_q}0p8j(2_Tn5Nk(WyAF1=)qRESHt8XAx{sZwD2!AQHG>9ax(
z=Y)z@?(~bC=vWZupl{~N^x^SU6N}a7+ArHQ>e<W?{b|&(=;pFpBAFtrH;d+qi%yAp
z8hXa+!-K|(X$Lr-eqZC&t#w{}Y0ZIM&hk%QMem$>;KhR6uS>l4hfH_f6SjZ-wVSVa
ze%F6$_@1F+eW_aD!1D**teg4wRvu5w7T9yPYw`{YZ|xtyJbT_gH<`EWUGmR{aNC%(
zpBS4@*4KL_K3E<9_$b?gc`<7*yP8cjt?Ru$^T)ph`oET1ncYn3UinvGnXT?MSFZoJ
z*H7zUXSh?j@5K2h#%#g+D)wrwuF?GMR4==3*~{sSK3=nOR#hB&rX0JJ_0iG5FsGM?
zud+Tk`X#h*o8uJiROZVibDf@sPGVH+DEszwv-TQxTlOiJ&exc_zy7>gCI0LtW6sBq
zf8Nag*1#0ZFL@<$&JrPsnac#%)Jh#R^ExNUnlhiyPHxYA`@XuLza47&@5#u?eqd*R
zU!Pjfe_ww79xJP^Z~XR>`#=8vT{HDj)~Q$Q@8kcA$=3h)^KvW0q_vBT)+(9#7ETqP
zx6b#G(Nx)}r}CeL)b`69xE`<fbGvzF&+ccnRV()${?TpnP<o4?0$;V%Ty75@C1>9S
z%B!``C75pf{bL22z#5N9;y1otYT0@2G{?eIRYD)n$bRMX5a05tY94c<bb(gs2UXAO
za}sJa6110IPIlSbZ@DHj<e0I>_wzDpecyk^&)(zparZsx4QJ1HRjjo7@=!^aYeAO$
z&*I26K3zGnQ<WW3m#}OqVf<|##UPfGq++%CK}yM|+sB(<d_B*;zTUFt|2Njx7R?7a
z-KKbLS`cO9bVx-1N7%e~>7HL5t_M~3<^N4qDA26T&fCBLA^*Pn88cPl*KKxPrT%wo
zg#-7*rIU{Gai)HlzU0QiW3__f%>Q~9bFNL-e<l6mQ2V1DS_x4ZmesBkCOl%Bu6^i~
zTK5i}#F^d;bW%n2#cWNhYwceCuxx&&WcX)Ai|p>6)8YqNGWO|BdU|ocS!Ur;e$$Ft
zBd4a4sIa3E(^s8ad{(L~Rw~uOZ4rxqAorvSe)dO|Q`am15PbaShqvzL)GTpDW?}7;
zGrMzod>xa#<$c#JI2ySpG9=7-&M()^J$zl~e$FuaAuaRpUz(U<()Y-_XLK%Siv5o7
ze7yVF)2l+?&Q_|ty6)3pBam;->ba$By5_e3iD!TEZRY>d5U|%qvNq1~W^m^^<vE)j
zZ(lUK7I0a=V_R5w!fkQG#ZIOiYCGp<Y>M<1H@lW1bMmkM;>@rs{6S)~jKdB$Dclla
zDA|6(>qN5Djp^187Mh;?b!O{xT_(1#d*trkdRE95oh8WlHj=UJc6F>@<NBm!GoEl{
z+}8OW6r3|v$1K<^`M`>2t^CC|T6*{@PySug(9E7_;c#bGK+lKH<aEK;*X^xdH!(+S
zc*K)jo48F^e{)ux@rK8hF$$N>G#@cVsC^W$eD7kTB72-S;?N`}Cuikfg`CHA<~2P_
zo}F}}P4ng?U9E3|6F137Pf4Amzh||_#a&kS&kNhTO?OSo;Y_Zab5+$>Kl#bUbJMts
zBi?)zf39g=p!DA5ijQ<iqk2=K1utWY1;?SH%47eI&DJ`;Upqm?`R>ZftuZEVW*Bvb
z>#lcn(4PG*=G#+lpEBppr$0+BeUS1CN$Apgy~b$cxtMp22W>C(7HvD_sPV*l?=s8o
zoT^{VYiiZGbW*~%t@L_Rch)m|ohxTf&E1(g-b|(}8_hrY_wM()WN<Y0MVNM#`Ml{N
zJ-3<yF6dg$%{g_w;Zgd_RcXmlUl!)QnsvUz=TupX+Ye90n{B18EKE9&MP;JCeY{m<
zBGk(|)9>oTzVr%py@Xln0WbILV-V_3nRsmV*;xS+4XZV{{yc5g{kU2pFyk}V`$voB
z9Pd^OQ;dr_7M@xgp0SeSc$%L*-#tB_<vX^mn67MgV^40ui*;+l)xL;bdo0>v5`1Ir
zwZ~>Yy5~2S9@*YL{b=@W<9lv_mjjgYHmk-OG-VmTnxwb*(aPJ)-ky3>GAnxd@z*@B
zuX1UJ_Be$*3qDvZb<gU|N<)co(Nv)wFYf+4n6;TjYJ1ExQ<Zn`qVJwQc`c#$tk%q<
z9@kyZ_dBY^FR?9FxE-8fXK__8wQx$;i5i{I<M*s4*HoqMDX`w>Iz9hriCW;)Lst%H
zCrf3w?e~4iV%78O!mm)D>#lZd>unF;%&WK?w7YAw>)+SiX%EED9?+lFSlsk>9nZz$
zQo%EldxUSe@5ne9r*JSJb<5HesT)-e4WAw)ZkT^IZH4<|uDz96CgL1^a%Gx(x-ULx
zI3Z!o+-))U)PhsZlanUfb^QDG^FxOHuiN<-{~eqiKEK~DE~8h=e*1#uuQ<aS+P)>S
zvm1)ZdVHwnkP`jRzo@x>PED2Q-d|tDN{@?}r5f1yzG&8eV#e;i^LDgBtu4cg&qA9%
zUN-#S`+oCH(U)g-$1iIBKL5U~`+EC5)!!f5et8k0yXqCgw`WrrFGPI|teU8=cS+7D
zsd}NOwDZM1OM}zTe_7$wE^}zfSBag|xW3ojUzsA{me1<IAz_~Sa7)s@=jm@wcshzF
z-r;Yn-}s&3dg8k`Z~mNWTy{{h==kB5&BwRgRS;7X);L>OE976un_zcXRUyN`(~)KF
zvV&=|Pc}c$)RWC}pE2{@gBK6(9{fGo@x$qZ`OImVzrS9+_`G?7^Qp806C{?Iu8q;1
zA=%~2RXt5_fk{@<=1IC&v^;;h6vQO1-FSb8BZteP^{fos5B|P9osh3zvC8|0)U)2{
zE4NRX!F|`+OfFx4W6birq=_jDyq6Yi*pR&NxxRnere&d<bzc6{@e$WFJ{YHd|Lr}N
zBHQFJ{h9}Tf2Yk2{(O)BAB(XZgUETG)D&G~Q^&iz>vg9+Zu>rGoyvspr7XNV&dvKO
zx=d$=$WKd!za^8E{<<9E-ozMkAU|yGmIRMKcF}*0({v8lbg2JiTlulMJs>qM^!2Bs
zi`~;BP4D|$F#D9zn%ds8?bG}IO`Gm4dAj)S-RI{$rk;HE=Kjqj!Txg>w%DHP-t7L=
zW`ECvpBk2@|IPCKUiatY&CBxh>@VDku{g9Sbe7-cl_6gqtow61?nBC#zwa`{x6Mpg
zEU2>m;}@ON8=r*o-QWL{Vd_@j9pan%TK=+6;$aV*vUZbJS5@k+8N4fUzq<+uRr{UD
z;5)ZFZdcJ}zwWsDB?%L5)y8r$^h->hv#xjYY=gZQypxN&tX6nMEmeEI>U`4cKTF#;
z*NR;?RWN*zy;b47{QO8xtv#KI%Ga)BY%+Sd(|p~^=bNof%|nyhUWJ_8;Po?mLHLPR
zhh`+II?1om+oTl#u<pO9p3$6Jm+U8N-?$~NIp1R`!`42BeAfvNp8eb+^O5iSI^ILV
z>l`ckj?6eDzK5;W%%J<UYREjbO?{sat*THv!f<8RX{#@hzSc~kZ^Diwuf7zzE8_H|
zA9vq5mG-?e*i`uKbhJv6)p5<2D}LTs*OKF=a)T$d)ozQH&iRimfz3kpe_Iz#I@uo<
z`SHr!<b@Rq#yaz^=(2bHKUej@Ird>&koSXI%KTbfuOh>IoVYt*&b{n=z^^%drE{ju
zE+46G`7ovx>JPRbXJ_rO+T+f?HsDLblvlZ?1$?*K&X=C}&0>5g;-iAjrTW}WN^=hh
zZ`+#xi_J!&>&=~vY58H7=RHqZFZ*WRx}MKk&oAX1dV2XoGoPz+;+EH~>p!1OI<=!;
zbB?X&(Fa~Hxh$kD=1hN4!R-EGbD)5kzvqwWeT?tEYdLWCR(mt7OqbKx{D7;>yq!;b
zs=mVtiPpclZZb*oCHyS*!QqX`_q<*8yU%K!YFw*y{JWIJXRS;7@-I!f*)~aS7H3+p
zsmiVN^styEJU3Rz{T9sGZ@tR2&{~XXCimGn%&ekwq^`9l%-Sp%^X#bQF8)W6MWPD=
zjegW#-S9}UsO97`jR{YuoMtiN-)6$qcX`Ujp3OBIPv{G_nq}WOow<ic;`n!^90`-x
zRvfLD<93)jOPHNiOJbNlb?4Wr{#;+jWpUHa#2xCl?Nw*;m57{n`Q<_8>i9+;jgyb2
zoL}a6ld)xifNJ{M;ycZUl1h#q>C;@J`{BXXZh<Oa-yJNX!IP%!iQM+-|LK_zmT$fM
zZf4P;ZN_h&#aRDdwd33J^Yv@yez@)PO()t{xkTjc&u#Y=4utFPh+)wd@bV2_ah=iI
z<+Oz7zM~r%k}a0>C<df`>$zCJT4Nq}(smwG?Tafdo)%<j2e3LzCp<1ubDy?+MVi2?
z)4ZFLG>$NboqH~1b7$>Jjhp}0ndYx(5;XPRpi|W9r+ql3gt6LPTtf6^m0+`k4Btf-
zv5A|Vg6hf=vRhWRl=Yb!Pk5lRE3p04J!V@CH(#E(u=05tD{GQE77IT4@pgSar|QDv
zlP7EaUa{zWz^AJX-%sk@{<7X}(#PfoyR;qK4<BFrzP{;c9!us4%e5csDwaL`C|bX=
zCi|!V+tAye*TpsL{Ux|iW0e!PiOjp^0~;LME}b@NQGL+CEZQNh@|;b^zHrgj-4_mQ
zd9cjo;bV~}W)acLsyKBoilp<zc0A(j+FfZGb^K~g%fGF*?ZK%w3fJd<`z7Z$ZLc^(
zb?x4X4W$nsTYY`}ea6c23FaB1Cw;Fi?q)e}@_CEUuSJK7&*?`#Kd_)pWj4=}3a-Ul
zmiL@_)-dUq!kXq5y%RU2&8APbU_4}%`gz8xuiaj|8ukXu9B3#>dedx~bnS6YTlCsT
zwxwx{c1Rq}PPtIEr?0Jf*8$B}Ojmc^EJ=NnA^nppZMB$g=X}xi+IrR&rIA0jm2UA*
z6lbb`9C^&_%=a(P__SB<GF-=eJJoQu_>??HectuAo8#19w)sXZzO(9X>#qV)yGL&(
zRGK|;XyZuH@R!tl<;B*2D0!1EgGyJf-R@a@-vSx?_?IfY34XRYTyK(D`Sr`u+!lK>
zRK+7Yem*?&@V1ivyZ*42!}W@H5|93yfAIez=lI4F0iV^@Z?X&4p1ZkE?)Iy%i*7%d
z9bv<mx?)%6IbNRarK}6jD0%O&e6}yVfBS!5u`?-4XN8~Usmh4eik7bJE_D(pk5pMx
zU*G-t>NHmmdA{4%ol6-m9O4dsG~r>`q{z~*4|*O?PkaAXNpZ~qyMwn(Pg~97TcOmq
zn58n+!t%v)l~w0HuerFqVZ&eldXu9Z^XD_xbyOT=_REsxS#v4m;Z=p|uiIw-|97oP
zihoarX!Dz&3l_~2-CHCcVWskP-KP~|+hqQ{QYoC9bFF*I@9dT<=GrpmFWshwq_rCq
zUeqZu)4V8L_-~6N=NXgDt9C5ydAI0lZ9-U?+OpLf7MHJj=eKE&)jho^X|<+=fJI--
zd42cT)cpVW`K0&DkTc6%7BYYHm9t~<{PXVRk~JI8a-^)A(6b{=Eqbl_ozrqzMhD}j
zR!eBe%W!#pFEB2Yans$o^H~4dtEFdI4zsK+=}nsaurq)2vX-^2MPh%yMV9<vnDS%F
zI`=<;;+K0Rq*uNX^tr=U@a$)@)}P6aCb#r8lK8i6v_ElPDA#<(tAzG*Px^|MI<=Ob
zy?Es{JLl)BpS7ZF`>zW%6-;8A9kl9Z_8Fmnx~hL-q8|Kze=V$I|Bupdu5+fY6!pCu
zE#&p_YS`mMh0f#;sXIAlB-<GV966L=zNUd&c(UAu%&iSq^>3*7Can;SS;kn#F}EY&
z_L*s|Tjz+2=_r>weAwyoUCHE1(lO3A>I_GH*?gFpCfB-6Kfhy>!^*B48Q$5Umlu4q
z{k?&&T#r$-U{V*a)uL%Pr_A1S#Kihr9pCCRSFbEFSf44_BEcN~R4}?hpf$0D$)|AN
zjRO{v``<8r=@N5TtaZ)nu~6DZE+MfU@52s91~|*7s%CHblz+!(!V5kviFZ1uHF%c3
zZ`vl=pBAH?Z~km~#n!touC%!Zy*6C1U3dQ5!b6|mzWI<>z3%KiJ^Ru*wzn;!FCAXz
zTXy5ww5c<#Mao+1xhMVp&6VkXoo&};iSAW5^0@2H<leB+I~29Tt9d!wrz`R&7T<kf
z*DLJcTXsH`+ah^pVU2pvy#o=dwnpV4Tf*l=D&^eX{bP>MzDds&nT|;;pS-(i!IHhF
z^s{%I4L<KuxQc0tAjcAu>=P$vf7@y_$3beco$MN~2;;j}TPM7Z<v8rL{awhdOUv)^
z)ooW_KHua+SL@l6U0IVgwe8$CF)*DqIM3d<wxzXMwyxFs4&RYJjqBU4#(eo*q8OJP
zqgXZH-#q5|)JqGm``B@n*v`G|x^@4lZq>S%iN-bi5(UpnE<c;h`S+AoMv^dxfyK(@
z4+~D5E>H}aE-&pfQN*C-iv2p)X*{h_2i6%bdobbBDJCbC_3WC9*;hI^$9ab&S=~{b
zUh?7hY5w{CEiI{6FX^uS!Os*`o%VWC--Y}hx4owA6Y{kb3>Z?y;)EIBq%Ao$drMHn
z{k4}SF5luUvp_siXp?BUM2iahmaf$i>c=I|e!g_L<Vu-EVP}<Z`r1ivF7QwO`s;Nm
zZ$kOIIkDI3OMXOhu6yL*t~GTRk0<|x@Dk-jztYvLX;sn6R?B+~_N8e(x_-a5{Z+J_
z-<|Jy+L^Z3t)5EF`ShK4sWoF$^OM@dtnX8fCT1>q#?f;;a+TIfjm5ie_-qngqjk(}
zgVx5Fvh6bMEeG3;&n8OfxG}etJe3W&k^j=u`s~MYFWv1NPme4WdyqJF{R5YW7d}{S
zo477O+ivM(&h$AxGcLUNrn_P5<f50+9cy%$l_qbxAiVF^feGuIHp`SN%RPE}RVz^}
z?^ODuz;iLrc_OM(4AOq=pLt$zkMx`Peed(#E^lCr*|$&XVZH5-yZrl-mp8q-d{toK
zM&`u-50sa!T&&*2!jiD2r^UA2Z1$xk2l;;9@9=$J9sT<G8uv6i`>S_WEuCchv^d3f
z>tXfpDzB^yr-r#2{;htr{&UdB1=Vb`b1sFJZQwdq>2Gx5S>w_23-g>A_a2>~c++~T
zr$BILpKZyM{fRq7=Uj7G^Jw$l%NuU230St^>^Ipb5;N~e{Y(`o_I;J`y2gQtr#hM;
zam`G-A3JrjgyviAp7!Rbg2mMM<8n@Cc{BfYI&9nU?~Ut(odK<$N{3Ef(SI4LKc&Xf
zLFtvZ&zqo-We)3SO>yfMaNoNpD!%pGoO3VR7SD7%o0~rW!RHUNa}MQ}%|AQgOs>ej
zuYPxu#AhClJuIeVFZG?(yW{nJ(W9(g-BQ|5yRsHVb)P!QYI@<9?S$Q4SL>>$#Vr@V
zv&NfMA#3Z0i>7nmKDYRLovm(Z`S}UQpY^fZ7E9087w<mRVsPVDPSUaP{RXNkA``NF
zBKxwYym<U3+~tInU$%}9e{;X974tg}?{6`|6Pb$zD^|wM<?#CUMM5=8@tU^nA=|Fq
zytfp2SNZd19-Ycradr!1utoFD`&%5e)&y@-@;2g_bo%AI_`=oE3%4ztQaIm{zwmKw
z++N4~tC@SANV3RZPMSIO#M+JQfAwV6@EJXdlg{k@RG9MV!t0bH<wn8<|F($RY-5U%
z=nh+ae9lpw3$2=;wI(|sN!{I6X?a)n{+=JTrDvDFJ@({7PeEVmePge=+pE6J`uIrx
zr@ooK?c&eOG4(}hVjoqL>(74iXi|Q@+EUB0Y*p36_p3M5|4Q0nZMNg*Z-c_JO-s#E
z3xYxpo6Z%pahA^GOkOj`ciTiY-HWLn9A}HXPq^DMo-WgVlQ3VjV$0gzu#n`5m1}|<
zs+RQs<N9%srRe6V$Nyihv3zh$h+}en&bcq<QZ*khUtFbQKUt~w{9N;GjV)(GXQv)X
z=Q?=aXU#IjxJ&%vQWNIxefN~P{OV`BaEoV2otD#2Xn*}>{?BdW9|Z@AHM2D0_9qx5
z#8s?+%yoI;)83_jigl!(Dzxl*=eG9J`EMD`^Y!L2ecHVBxWiw8zrWVBAAG3wLGFRh
z$!80$nap4QRBMgJ&aV!=;Wm4wthKhD5|-Y$u5VX)=H<jVyVL^9b~y$6hRyBS4;rf^
zr~AmCGtCga%(3uQzoc060~Uvtiiu8kq08R!Y?c4G$|X5MXuXZYbHi61Ou>I1&FubA
zp=5T@DB?Kl<-CN;J<ksq#PIvbMMhTn9Ns6I@FBpI>Ho9?Z_*ENPbynGPt(0iNHFvr
zH-C&q^JJD4XZSLgtv)EY@FdUM8F}wz_}uE!HZ144WOL|>|0L%`w_Rm&X{#6H{<<mo
zmZ#}ft*V65<c%Ns51(eb`Ymgj?-A?ki+;|QZECQ-KFhF8ykqVu*?pP{)+yS3s}31;
z=q{^Zum~%vXIv;NFyjQbsbr(`fzl@{vv|)*Z{ya!es?+Jv&yQ{nc~4u1)p&9-0$PF
za)0hK{o?x@e;F>%W4u-PB{V<Ad(G6l4XVXycH4R7`b#$}Tyn{u`Ddq?%tJxh$Vtpb
zLc3e{O{re^wtMC8fE*#7L$l>Rm&#u+cX87Yuh{chq}%AGXRfS*%#54POIVhMzRLQc
z5~G&-TUh4)`x~8N^A|Ft39?k(KM=A0lK0B+iPyqE1}~P6lVn*gzU|lnHZ7J(zN-(e
zV*FGg%ou$}QslKvNNUBG9q+z7y=;2Vxaz3Ng~$og1~PK32g?_6`?d6Us-DyO&G@g@
zP+}8Tv(<@|d8wvv)~2RbobM6n={7JH^J$p5eiQ2^q4aH;NwXDx&Mzxpd&~a$^b_q2
zubmfd+&YyrqdMxrEk9;kFK(8P%FInYIVV1Ne6n7*V#(S0MWTlH**iXI8@}{OKbUs>
zad{Q@l#eZsOc%5+FR>0QIoh*wVd#P*tv8>x81vf9I=(c-rTwsCa6O-Rje6_3uuogF
zuiX^Rur#v07o&EQKj-0ky*|~bbO*t^R#RRm%A6JZ7%6$MGJU1d&BE3`gL|Kqu1FS(
zNZ!%YUE%)oZiU{zbbtNx6H~<s&Z~dkTPT&eU8+!NB74|8FCmtLn?vvI+ps#x%<lfT
z5Fd$qdpG=M4{7}&b8)i&v;O3WzDH8mp8IG`I5nZt)6a3roi#IGC<R^fDCFt*A<C$>
zD7g8RQF^+@WuAoH%%!^b3c?P^C36<U{XMm1u8r)Xk`JscdOHfl*hSCn7Rz2z9I$1^
zuEjagn|4Wh?5|;6kRG{2-}&VZku#Qk9jQv6*mq97r13O0m1pXLYuC2A2WB)qw(L!K
zUa04mx?kw$`>I#>cJ7@Z&c&WpdqO$!-65GxvrF{9a7btPq%Qs2-j`kdWU2I-zGn<q
zoKD=SS}t?oMrzNRnT40<Ri|~lH|LD@n>^*(jFv}%uV-xiA=v*_#WLlqzzp@56WC?W
zF`oW*^lJGZpD(L2?k+5QlKxWN$+pwY<*lOk5~Fv_ryH~b&nbNSx=XKm_UX)~`(LL{
zQ1!h&r{bdC)j2139IVJ#ox%ORD{24hUp3ji?SB_8kNP{qM@LcFruL2JWCi=u%kHn=
zn_bz?xoG{r$!)*p>AJ7B%U$8sIeXp5oHrp2c6pm`?a*An75!xW-Xmwdv-LD3+sZv(
zPn&e@vu^5Lp-WZ!RKMuRu6-13wKrwUlJt{X7{e!NRysPeD;@2glx-@tVsihJe9gez
zR^~nV%jD{FPVYUld)*x4$2!kuN5^JH-wK_u`G(4aodzGbM3t6k8kO#f+k7$HVjjz_
z1TDcAU8|Ozw9e6zoA}1QdxP1!O(`p1g+*BIPfxYctd7{xUzGItk3G*l2jO`li_Zvd
zyE%_#amVUa4}`_jRCzL+4jwqL@<WXlZ^h9`4N_XNKaRdhUvoeD^5x5t98az@z4E=`
za?!f;dF-v=Lsb`6CTawyYv#!rtHnJpb#GYZ8oFrW;_b}m%cRn7<OJ1N*Zw-Bs<w4$
zt7biW$7w(LjI6ze41p#3Gv4xuUtjd@Y~Oa12e%*E-;>?LQP(%Q_{#qy;+1BpS+yZC
zQ-4l+lJQ)NcS?2E+ld!87-}BgZ+_Nu@!Z)rXBlmoc(hS$bwc|g#qBplvezXC>)!}r
z+;#mx)55jgA~)W0%SE4LG2ha6^wqmpZH5bD&95Aajj&%5#ggjL$~8?t)PGO0$4aIk
z>BBc}u>9Mk@GJMD9CyQf-#pb_ymxGCPn0y(@;l~k);C`w*H*tb(t~eS_K$zdAGK-P
z?VMY(s`*$$_Cqz#{wd2YeE4^@dWGHW)c7YsU#G~_8Ce~9eM_x-ODJD@)B@cnW##)8
zu)q8gSIWR;#Fc(|ox9T1Gs|l1H}I^n*!!o^(?-nqh_lIV_3T$R^SR|5Q(p$KA6!?z
zU2?N=*Ye<tmi=!7VkS6hM@ZQhXDbP+t<K-St>CYBa_aA`i%&kaE`Csw^uR$bz%GcB
zdo9=f|Lfn}^}G3cyZ<$5)$M`*e&tN=i~7O8aL?8)+x6-eiM)QKQUB`j<vypv)dn%j
zXLohoi2A&GbzEuJtWz(P{Io3QhaJw;I+XR0;R2`6xvrYcdZ{5o#j6ioRbOYRw)gAV
zl*xWmgkt;K7wb;&_FmpDb?wNi+X5}gExZS1TJxXg+jF&B->MSfW62hYpZG2>Y`W{7
zG>?<Kj}I}k$bGnfYiskpmdjJ;OaHF*oRuQx*!u3mvf{&yE8neSS^2WELAp*`_N&;u
zx|=y`u5Zo~+s7&vxWjOz^zN|6bNmtot|m@T>>5)y6t8tF*nIe#&b_dT-v6&RK78w=
zG1uiHZ|_nYyUNm{A5kf%ewTcxx0kQ8y3t=}`=g}h$3t6z{<-_#yzSdpZ+GkNLg5JG
z%6oyv`%ay3yCM;v>2Ki4cW`~5(907JpG@?*3#TnB%$RHQ_ooNb(l_qKvi+>{7IgVO
z>zw}6_g>ut$tV1oY(E*^-a8vx_-)gy;7yu8-+IoFo$<Ud#X2aZRs5jk8Kx!cg$wk)
zDQq|R`F{FB){dEH$}NQ-9`al}@y)y!Hxw*V=SodpU2ITmd28#U%6ap<3w`1O?yU)a
z|99Up;hTap-vxzl%6}jD;!2He*OOWkWy=pii!SU^<@qW6I&Z_XH}!AlN1MM6vVW{+
zCeD6Ddg`i>)7$s9RSW&HbGRhELeW}b@1cX-&M)ht8dkiPxpQ0e#0s{s>uhDlN(=g8
zWq5L@EOy=aP;*)J=^x%R|61R5KJ!|*#^`BbU(lcSd;KR;Uhib<(raH_737?>a7FR?
zIl?jjjK7~eS7{ibeOU6eh7QlZJ@qGk$5?Z*sO{o<eQ?53?Q>m5CXYpqT#-7NmRR)J
zQDCNH^o9DB!tVd)&EwIU|JXJ)S@OkJcclq^{@?6t><YsQeU(>y`_^>)P0q!~Cw`tv
z{5MbA!d823#YAoYf|(5;J3}7Lp0&Vpj>$>It9R}!s^#Bx&o{3wD%Pe~o@HKPcUE(V
z!|`3NO`dlrsakHRwl;J;=+(cs(YDQ~bdTYe*{uBMB8;TivffMWyVLS4WvAx3Nok)&
zWQ#6Ls9B+UH#$jb)*dd2ryYA2A2YbKCPc1#Z?^W{*_^@K7ft#5_upB+)k#8GJI^>Z
zt`V2rb@Y<?!yig<p8ibihi_UtyLQ}A{t%WJENwOGl2}8Eloi`8iM2*GD~*?%?T9;V
zd@AA_Uq|saulUa<jrR2xb`SrSFMg9EdyO~pzI3|!{h(BZU**>{m^p(^%(}NVD_%sm
z{Hkv6BYt1g$&0NF!%iy%%xYb+SYzu^+t;gpHE;H^y6zy~al>Jq-wJgx2kmQJhXbeP
zHa+aW{%iJ!CCn!~epu>1;`BW9{oCL6a`yf`d(JLS<;rz^Q89g5=+76&)#sU2tO<!=
zJ(Q|HBUg-j-f5xYB%P2iT+GinRhlMGpSrDP^3?!crX;)Rj0tw$#&g;<+>`eAsLV+{
zptNGi?1c|^owZ?Y^#8)py*yaveo)+UouIl83pedPY`n~57gu-4(zDWrulKM^@tP#B
zdvsy)bSIx*A09qg8r*t0t8DL_{(y)lcebzp>v7|*?dye~f{t5Q?O_W_xqRvR-Lnl`
z;V<GdcWybn<x0a9LEoqwQ!dtJ$i>7iyc3f4LSofs)v4hDNk2R8O9V4ZN`(3c$ksi%
zc1uz&_P))oeK#c!#>E{A^*{gdfZ-8tlegdh_VjKOo6WK6yk+>s(CoC5+{ZcIXUf)<
z@-KY6$a~-C$pQRlZ*pyT$B-v#eNg+JYF(4_j$$5G_RE%iO!l{r1ZB8Rs^9odbCuJY
zS<(R;-v(;A)D(&o`l$z1eyrMV<CK~7|9a4^HTF)~UAraOtmZD5)GC#c&Ji^$<?rbR
zohkdYE9BY!|2S?R$Flyh=)DAKjzj0KhI^#!m@Q(qsq_4${Z&7e4jzeZ=j`g7!7A|Y
zz`>a(_WwC)vM2NDl&WV1S&KGTrhL;Cbl4Ph=kJ!!o3?9Y)%0BbcFpxw<h5h%cSV2c
z7WxGQOrDjTq<rj2(e!)YxTf)ch@BqfWflD{DQWT(Rlc21w)M{}TYK|*>gzfD+h#hw
zT#<CH>*@5O*^wJh%-S%)oTFq{j`hq}i`Lxn>sQ>Qb@G(w?99*Fk&b^`uFR8<t`dxM
z>#kv1yWmDg_X&-Nwar4_TXMp!k7^~`mrRVy&Hk`up8P(2@w+Nok3+*!|GUMSpJ|Y>
z{_H4n%IAJ)*P@`!EBLNPE||!Xb+9GXt(iAD=<kH3+?VHv*?qes?zBs7->ECk%>I*K
zn9iBDa?_T=W3j&lexBPept3+o*Lz-bxJl6CoD}Ov1#u;U&RZ|sjpNue>u{p^UgkHe
z<jg)zFiv>=j;YT0<Kb|<Iqn5|3dheZRh$<qcH!N5)m^d0abj^#POHxI2~In-CN!k@
zK%88Kn9SS#mQ`QBRfyzFj{5)e@^ky2N6L-7_&-ftAl+JNw)I_JeZI=8(?90yZeHMV
z{?YkANA~Cl@w|A{W`ASJ8*kx*aZ?WkX}v13vyxtT=+r3*=J|(%Z*xA{t#WS1>_t}-
zw#B}3czu{p|3&jXrjlo^+EuyR8cHX|K1gkTbk6=zkHkc^LywmI{Sf$L<L!+eHX?EJ
zs!#u{*7|BM_jY1nZG)ym_*37KwHF>9J7D%o>Oc$AmPcRq<T9==;Ov;O$dt|OPuz}`
zX@{Q|OgOUiqGfoS=FU&0LDF-RT$kNZ%opD>ZNnj@n_|i}X`j|EGZ44!x|qu7bamUc
z7Co6M-!IQtv}g}=LbBNff#X4+DyJBolPWoB{CuY2nY_&b-x)W)vo?3gxyt|f-K<}w
z_RgP^C*FDAWxUFI!iL$uVwYceb<1UC<8Alea_chdP%Zzk2W9iaR;(;OFst-pf}_!q
z9eg{c^{ai2-4G)#Bfb6YomEqoSoJQxeDCgh*{#vJMK8WqFDNUDd;8*o_WKqa$+zjA
zs<uz!*RI>)vHHxyBZr;u#5_n_Z+H5SIM0u{jad&b*lb<<a#ObSQ_D1IsclLJr8L&<
zs1P^pk`T-Pxu`%W$?TNO+}CZVgN;{C=lAV>vy3ILq_)oN$;O{2?kzIsx_JAv3C|36
z0bco+q93NrK03u=&WD(aGj0neXDP4TH77m5y7TPr6%6|)eQr?KzCB@2AU|_fsoYxO
zi68nbH@*C8#KpI8rR&UMNA@M+Cb_Iy2N@c}mxZ$Kh}q;_Td}{nvS#9@-E|A<z4J0f
zJFkn~tdy$x^ECI%ufxC1+w&JMKD_^}e4Ug)#qs^Jixt^_v}j#S>qy$%wPW&3E~Au{
z3~3uVKDSJNm&DIBf9~{IcOws^JU&&shw0P~F7FBcr@B^udCIkE_EDD4_5$1oU$v}{
z&whVJ<>2XAGZ(H7{A0R4!IF1!flhu^T2Af#c|C$>3ixMBu`K_8>xt;(((3q%dl&S5
zY{Gr}880_qU_IE=ZCk2){FRc-?&Ix?ByHs<{#TQH_;TY#kH>4@d|1@~f9I4B@yg;h
zuTQ>8^4C%F6}n%wY;nJS+e|O}-1TcTxC_}<#D?&M@D`SK{hyL+bLyq$?Fs(<_5Y07
zcYn^b%=Z7Wq{Ke|s7~E)<LxUSR@;<U_E}ZFS@wF*nG1hv&p%&ZV!UK?evqE<{{3h7
z8dWvtIPX6*@7KvAwv(h<*}uE$H+o67dxuAriY<-}4Ag$<Ai?;ve@CWE(8FBU$+u3}
zzgl1WeaHTM*{kU$|J*&<PyJP%5U<tnNj#N}{ibL!M^fk3qC-(EuO2li#V?x7!<e+>
zj9aSSV;@m&wfFOvgvYGo+0Vn|oiOE2*$ehFrZPrtX_NFmd7rJgB~fvF&9dH^2jtk+
zCuAilbDz}mXlzyeyd+q8_hqBGQ6CDbwoJdM`uRT7LWgIim;GE0nR}n>lUbW9yergd
zUG+Jm!;5cO+K5fx8Z>+Dw=LgPoSq8Yx^yW2{o+ka7oDBHa+w%Q)ZdEjM-Iro$;r8^
zw|3c~;_yR<6YRq!FZ^^}cW&yjot0njc-%PlNNKA>=buKU`8L9>J=Pgl@3o6b?AqM2
ze}{jS2cJ$x?>bgTo0IyN{+(E*oa1}^hTy}<okE<Zn>O<Z|6ZUit!{VOB=UenNzc2`
z^Yf$?>?KbhUGZ*pTD1494OS@}ub$bRxH4(t&dMuWN^jb2D%x)1d!OTZ>hgaT5&zlG
z9Ia?i>DKC9+>?5<itqKazQaW_0dF47JF<s&o#v@Goqv*84!;u1UEudPSDE+8?P(6o
z59dF5!thqA<bq6ofwsEb!UbJBICn1Jn^ZGV{Ft$=iE@|Uo$%QS3fYo8{PMit<$3M@
z^I!j$ny$TMmPU4AzWueBj5GIpR?fD`43T5IIGcaIAK(2ykR^m)8@tvsU3(VTkl7iq
zkZtiSWAjg0ay<4tA5<5gd!w0lG|}aD(;xq9yRW*|&HHp)#$d)2_Lip|pTnnroVs^!
zx{1|dalY@7Pj01u`=6-M)PIv#I8EaCK2x6fkmI4#^ctSO*;C_tv-I7z2KW9p?&7a)
z`4umu%de|sw%Wdaakl;O%-zan+55JbE<C?4%a8w3SLT*;-uoP#-Zd-oo2RiRJUsQI
zY`y8Jd(!sy9Mf)UO)_wilD%j!-K#pq%=Yc-?d|XT{o`b1UHAWqwHH2kv;Md4E&Gbk
zuRdQqsj>HjxcGrhOh1{U{#AT=WBAI{qZhuk=i7~jk`MpFf8>VVm$fy_{@-M47jyPg
zoX1YR8B4GKT-DXMOGIP!Mj?;IJ&V2Pnp7`;?5N-&alNiO`a!ss`)do!{_|4O50_sk
zyO8dnB0h0PY~Rgo2JJhT4sAZgk|nqQ|GqM{Bf2-f-`>mfjHfGQgKOoIBejRig*nW(
zTu9DxJ^p`7{q3~dw=b=Eq<ibaH0Lw#4_p&9ZNCvPf6Yt&-CMJ>q?xaZL>#b@;m+Zi
z5wy%VStfL6`B~F;NB?b{M_v`LTyJ@tC0pT-pW*GNPPS=XjT`D8XEQUT7o2*2^qx|j
z-?G9FtQC`Yq}=s(R9c`ZpLV07W6NjmEW^TkKh~bmk=axDB}lYfezQkH?cSMFb~W2y
z$uT-9aDKJglJ_+Wa`wtzIKPNRNh_~c{zS^3%gd}TUCipXdKGqa+T6P@EUzznbf@me
z)2l_3^xt)Myn4g=WkTMrY^@2`B%K9sO%Pr2_t46y$rDUiTZ{beKdQZZ;(+CKgW$g}
z4z9W*a;E5f&a=V~QPne&g@jU$$JKw2Rq)|cG3f7>|5ze*^1*Dm?)8PLyh#_X%C&1S
zeY_%(_i5P-Rqa&IVu@glMe}D${r`AlgP?AZP+`=!=KU<YV?=lEdUdfygj+dlx^|UV
z8js6z7VDCizVpo8R#muNo)r7&ZcPR29uF_I_z%_(GrE>sn4>iBbMunlA5=sNKXYda
zte!OErU|FQtfZYsGcC8iEwz06$%E_EUOTg2XV%TWD|~O3^P{z$o<1i1=jR^Xm08hK
z&C0ubhFH|n{(EcnuTEkRb+O*>GWU7N=GjvcFRd^QtuT&0u_rUBbm^vBJKr@=nJlr!
zJ+ZazM#g2ilohjIzf;e<_d7uT#bcLm7UJ_}Si}hnq+k8zw|Ir({GPc<%agLcN{1Id
zQSp6~C!iDh%Z0c7*N+o7CxuN=71EmFX|XIo(spN3WckvByN4$*I9M_*h{^BLxj&`t
z+wSuvPk62x%zCK1Aet+Be}Z}8bfaT)9S+X+aAmO$m+yb!;#zd`<L=#Ger$=JWjDi7
zd3sc`(5YE0Q%oK&d1`c2wpiuY#n)R;cE4}2^f7;XHR0>ugy`(oFL&v({9P2tY02Ry
z&MDIvlRBd!>A<nt-Q4r;?E0qj(<wdcSM=;j+t*$#n_%a%`CyespRL4lkLuHYT@SW}
z?dDy^sH1pL>%YJ3)z3%zF0EO;YTLKfg-feHugUY;obqse>D08f)}h<i<S{PZo3!rD
z+EcS9-Q;(8;<0+e&NEu_r*=z4ae2vg#B%P?nt3Q-qsF6!Kd$m{mby8=yLTm|XZPs`
zDtrEX`1$1V^U2eFMGe-6EHd^!oA0#k;PV~(pRVF^y}U!N=TmW_UDJ=fJ14hW<h<OY
zU*}b}YG2aJ^D*xoGiHm-GFCavc;iX&k@cM_(kuKP9a>qsh%u4*(8_PRhq>mu==Mh6
zy!SHm`a`zWdG3>KOHOV$x!LJ;>P1cN;!lbDHk?RkymKUvxq9*RFWdO)t50X%-~B(d
z(|FnnZ?TOMKGzoSn{TA?=jozv6S{9zU(aqloNe`YnZ><^Q#O}pU1~COF5S8`cfv)<
zdD=6w9d6xvuGX-l{ALxOx~5O^;d#n3j^YIdUwse!`Msg`^VLw6PiKqW)jrQ)eIyum
z&ga^)TM{fui3=`&ELrvG)Iy1E;@8R>-{;EDzHlLTuk4(X<S8O0O&e6buO=$I(`63v
z4lHMHo4o$gCC48d4zD!cu~w(|W=G5K=BY9-|K0lPaVKqa$*d<oxpJK2K1|3z)glpF
zGx?Z?_j_&Aj~%Pyl@w0cCC>{xEzx`6r1~4{Xp4y!eLG?V_a@JpTGsUW%PS-OWvgBW
z_&ILU<oY4I_LHWiegc~c<0hVv$5mStrpr%G46L2>@_x6@jh-1%TicF*v7O1=bZ^_M
z$l28*a=q2xe#S{(HV-hAO*_!~c*&Y`@u!vkmoGfNrl`kb)tQ#U7fY0i?w#GVxwqs9
zQ{35xBBMjA_FgDm#sBo?ZS~LDRUW@X6E6LG7}7L(=I0|;J?&>?l7poqJ-L=ov{Zf)
zeK{wP!*+}F>unJgM{VxkmMLAsH|L#1KzYOV#}kgdYx%k1u()hedovGDe3`iEwix?+
zyQZ$Osi~Hj`{&!o2QNP4UpyYJZhwE)4Nfcf<XL(%Ud>*&$@0}kVb2E{AF7WYWnl0W
z{}%esP`@xnj-A<&E7fe0(ahziB|6K~zc(iQfAIL=@4qk3KD@~Ii#Nl%gLTVf&6duI
zisy8#+!BmZQ+En<*7UiG-|i9jU6mrWI(E4gTh5}NLO-&L-k!Q7T76jf!GwT|(p}y2
zwul~{{6KnIh}sXiQ<d*G+nyDlRsG;&o`>RbgS-oU8&_Xh!+pg<VxpU(&E$y_HU;|T
z-FfhC+A3$YsS}@lH4W^aAmZAxTe$FF#ZnPl;VRR&wUaZ%)lWUWvT63*Lo<F(I<eMp
z@Ad`4b!LS{Thdo8`RTmfX{LzeW3KN<^c+Ojy-6&nb>1<#PWq{porNW6O}>Ry-QUj#
zcZXm6_i*{{$@(|bbX_M!F#Or_M@!i<J7(=VgPFe^;#dyWF1aA^S}|!=<>FPxA7%Sw
zYw%89`_9?TH0zgX&!KNh+{Y$QJhhyU-BU(lT4tn^`8SE_67239tmendZth5V$)*>x
zrgTlqi3U&cd)bfT4mnD1pSA7vv6ATQe`^=S>CRMh{dVKa&QDUe3g>P&*wDQ=PCZY#
z{d9hZQLcNJkJmKCaJ4gMt9F}4IHk_aIkx(3-}dQY1se`dI?jINPQe)_kw&c}+*-~H
z{-1tq?X6?<_H&;^tM)n%8JVr8b>Fn{#Rv4xGcnXZc6-^ZA0KZ&DAZgU%ysK-s!e+g
zpZ287yA|GO`6$MJJtVuA$@);@)+Lkm-52WqIJ51(S*_|bg#}dtaUtAEZPsTvn(db?
z=ySD6iR%8i-G9YnOU@%dxpg8cri(b#&eiecDb0yoa`M^5Bb7PHlk{)zThY7oS%4yU
z=;>{D+)_4W?JRWb@mOzBs5E<?ux|2o>5`rkNgKWV(u{iV{5ii<>8Zj7exZGzcpeCR
zocLCF!@1lIdrmDsd#e7mYnvs{&AS~nCwlZnJ6}{Utne-<ik!DmhR0O&N%rPrIgwYV
zw@(k5wI{epr0gMAp=*cKf{Ecgli6G51PgG;zj~GWLh^S}!nUOUId^1_)wLC?nObPN
zR%f0mwm2)?J~OOPZ_jqKeXo`<^C<U(*=|(zp2o(i9X0dpi>Z<K8<@5V&P&L=<#!_D
z>RZ*YPPLj1(=MLl-v8$IhL|H3a~Zienmp9my_i}4NNgaJy;zh^?iL0kK~8?1WWGbw
zZK7K4`wGk|xo}f;#{O)U1s;z%BIZ9_9?krH9;e8Th2j_1O$;mI%gWkz=9G(&_!VB)
zH!|#MYDaSeqPCrQ(W9t+b&6|FwXxg8w(C{r^4csCnOUnIbj&K9f9>rB9meamb9AG<
zW3D*p-o3x*-Lcs#H0^@F)n44LRjPWEdve0;C0wDCnEg&(65SBK;^S*WriYwgBBOF&
z>b}>!bzyJo-p_L@eC?d>^!#eO`0VrDm3>um2UD)ZYB8Q^JLIvr`I9@N2WNfmq~nX0
ze(O=(6>?3c?NH^V=W;I_mo0wP)bsS4&f`ljpO-xmu>Z=*z53BAJEd~Xmrr8-?6!(#
zr5mR{>QdcR@@lHpXTQy}q`hm{McE6UU-tU?JkC$|PlQQ&;{2E&k<W{Ma2K+)e*68~
zMlD83VMdIN#Xr%m$A>kq)_lwC5m@~3P1jn*iarB7`DodI>)o>z%L7|CuiAah;f$3`
z#;XMqm*eietKgFI*Z8wz`4o#KHNg)w)23KQYuz#WDYNY1vlncsPP-?~dQdghtnSq^
zX~$ik7d|^zdD(8dE?54aIYke-bz9rt&s-Q#<aDIu#Y(jcXTN*-&3`_3sxqJ1{^b)E
z-V}S55|V2iD}Kc=^!AU;Bdl8uu4!$)TfJTNH@}W}V)*oJZE^X=J6Y}&wd6#es8HRs
z>39458&RiIzw5MUKDxHIEPe(jyZ=?DE6Oa_*{(0*_GV8r2&)&kqh#T-fxGHq!0qsE
z9X;t6x(m0?@+-Bk_AR?*Te92u$CA%^LB7{pnge^7ITzn7D-N6ccvXS31AB9?&il>W
zDtE%Sp1rZ)?4|ROZ=RP;Y&dD-d+s*#-q+6egkQ+4+P9POeZT1QjHtb59@IRJ&0T)?
zPVwADfz~(AW-<RUEP2Lvc~`B)3!UGemU^V${g7*Y;gOu*vjaho683$Icy_huqbb{=
zhtpIiG_1E}$;;^6k^bAZ|L`55doApD%iMB5HCsQ}=QHtE0`u4F9Xn2+s9pD6h{09i
zzfMTOKCaXGD?X%le|moTWVk~}apQD_MPBhtoN7JhqH+hjcG>^EXgKTDi~2dNb#I01
zFYM;~so-pA`H<^aXT9W&*}E=o3O3!O^dfY+({GvA65HOh9yk`9obCR7(|QM40lk1-
zpH?5xn<Vxp?}STIo<saGCZT=jXH0zihiirQ!P~ED<V$6B&#}mewscQ@>vN!NqJYoT
zw}H8?t7Q}x#lGnd<jVJ+%zAWc=)9bh#+R~kHUAWB{{65kw=MkAv)oU0`X${jRM!1E
zcgX9q{sxN~xuMZ#bgv4??q^9kJ4bp^UasElFIvlHo%vnv*w6h-&1DYfV@B^sf^Bb@
zCMz1Px)q}_=fUjtd16beOxWV{9?lA=3H>npdBOo*0e`Pje(#&X&s?UyJk3*PF4V}F
zyG5w+p}Xaj;s`t4?Jr~QJuQ-(xFK65pRs?&q}|mG&dtrY&3>ia>$O(Zkzg@?RTN|4
zID68M%sJ0;0%K>W%`Fd{KJy04lV#m+TqWfdOON|kDfXr<`p2<1Te8l@Dr|kF*EUn(
z3I4yEW@*2Q_qCFm**dwu&FahSQ)!mZ)ebl2y^HzTqtmE-ugj?B%bERgKQEWfS7cCl
zY$*Ne`ZLF)-y}c1y?JhrpQW9?h3=Z1AD>cBe4OJmgIo5cSzdXVyI{%o8H<ir&l1@^
z@4zaR-czRYew-?v@ua~cbAz1s{@!~A8%+HqKOd5?`qBMKs?Po0l>e>=+4plQUhLZ`
zD5p2EXl9!CIX>~6gW=cSD>*YpTIDL}$N2ZM-gsoxls--9XGCOTQ5S#HT;ZNH&F2-&
ze8+b9%=n)$Gf_$BnDMH*k48F+L-$4cmiug#*gnC#oqNW!>|0M~@69eNx3xTfG244y
zj=ogF&c+*`#6RBnJ;`kbU&dUqt?7E2myN3&<F<TRe52qG7jxr_C0g0eb6>Qq+hN>n
zarn=)_2qH<?mV2pqW4aNu{QnA^36}39BbAzFOvA_7cjvzziCOt_pl77`GI^hotj;<
zgBPg%SD0NeMd5;vw{_C?tEIEDa-x3sRPW@QFv%%;;e%bgJDHZ$9&w3QI_~vD$9Uod
z`@{*Q^Q3<noDcM0JjM6!%^e@l?7!PPrR-GI^z1`^Pv_?Am{jR3teY*Zb$WfVed@ap
zveEI*FXv7vs$TZJO!>yVjkkW)oz9Ec^7ifY?MIjXe&F$X=E`^SmCEVj`@Y(nUfbQb
zxx~+Z>f?s~j1$dEe3o67(B;)C>onc26mcPH<+k(RF4Tn-mTrA8b#Hsm$_sh6nJq!$
zmL>8AYd>vO_;~hYt??P__>yx%v2L;J)ZgSJt2cJc)O>L*XqNrYS#!^vo++Rh`ik$h
z(3fi>foB?(*0H}!`1AjoVuw*}lSGEM%_E&X*Ct&&EAXB{GBke94JSk2?$bY3^$0iy
z_3yoFa%*yA4u`c0TZ!JSE3UG~GXC~S`8-OQ*BqQ&d2CxyiuPkO&;A2zcZwZ9EZ5ah
z6`#>G;YP*Xeap4>-~ViK=l=(*s_%*aKVNiQd?2f)Vrh8$`^As9zwe7!vqe*^-<H>?
zX@~d($z(2%%++DcpGw8_^<KyXU7YZJlGC&NRa@3n?P_K&>zp-fp`$|7J>y>szkQ##
z^@&Nzm9GyLFEnfkzEoFpJaZ!Bv8g((#^v{oAMo?k$o!t*8tah}zj~piP`mk+m63}l
zeOvJS%`1oBc4Zxtw*HD+a_PL&-LnoH=H>w^>#V$%KlrGgRxDEOEADyf_X{3_?H}1Q
zvW{e@X1=;~_x(EQ{@&;pQT|*1KQJwgt5u%JnYzlkk880?{AKBd1&oW|c}7JpGW^eL
z`F-N5;7=l~-b_b@7ey*7rdPgv;$+-CMK^L?iEUB4=UJ03A)%7mSDLF6oU_#9)87{;
z`ez6Tu9l8n_&TTbt?z|3m%cs-Ra+A*{%FQs;lBqOC30s9{FoxW?#b<cJNT5(u=&aN
zXRDvl+If5DlgS$omYmrB>|-K_@yUDj(-S}3XOufw^Db5OGh43qS+UlQGt3S@2!B@L
zm?&>6{!GF)<^5eT3#ZwVS8J!gpJDrzdGhVUXX77tXldp18vmEh%>Fa4O)z*%;d_Rs
zMJsZDzWVyM_m_?`@BgE^zd!tIwH3JBxc`XqN5L-)zQ_7o{yIqfioT=1d@^rdYi89n
zE%k{tv4(G-uDsq_uzU96r~fiPo-*0JFfPA-vw*)~$%lVi_sn~BV{ZUQ*582F8=NLh
zD=TOD`%$cKLC>4>k5sO1cPc4LUZiI^SBoRoqM-Yu<Zi_ikE?DS+^iY5_EXo#dA<KC
zs+xXnoACU6{36@=9^AM7o}88%E<QtUQrx7XU#VyEogB+%Xt3;O`1W~T!S*iwTuGlL
zi=1PZUU{?lc7w|X-i7ZfkBe@4RvG-1^WKk5k=B0UM(6vRt4)nxeN=t?uI^O3Peizn
zxl!fG>;E1u|8@7Um+&w5?H|6a46<8O+17n4ny)4%@2{%L5qGZNU!wx1nfYtpiI(tt
z@p1AmrjoloW%t)DKf!d&hVjIVl=O!yJS*Q=r~f|0$gisVR(gW!{D-G6+*v-)VZDhE
z+tajO&y342<3kzGXozKQ*Ek!sHsN>N62V%1eb$Mku35aLt2&Z;<eQV%xW7JB@Nbj2
zjil}G%q`i=Rca;v*y_#T7PY#$v_jk@ubZ`?r(3)Bqfqu)Gmn!WFYh(u`?p1Wh3vD=
zr%OAd(jG?ddFbiq_<q*6U(5Qx6+}!?h~L1y^eE3J6W#rn-Rk+7zi$e9EWBwQ-wo4y
zNlHz79K_Ugd;S=0+x9Q<gYgCD8I7)0V(Q^JCsXP__MO<lwahZ=`OekT-%UQ5r+UQn
z#0=ePuZ<~>{}=}J{FxyVo2>enzul<!(FK*3LL;-_n^|kSO8fd=*K(~r7IJl=RnzN*
zeS5ha9(i8hc{9c1d;z~oeegBQJZ;(R=M%3>ud1q@zU*d+<I~BTO8;72mpRC7&O6u9
z>&wb>F-DIQCWRh+mQ#2%xbJ9Ad`xG#QLE6u)bClv=hqdPTsqhGMs3;D9s9x+)f4?~
zf*0HBxg5N5ZO^Np$*L>l!`A3^DKT{&)REXOClS*U-K_2X_R*Q=eA~;qD|Cy@v_GBX
zKNo*VyL7FhlhUHC)w!EQKjqz>yGCo3&8Al&M<hZYP2$S7p8M(cndhNf_2O-+N~VQ&
zR~S8tsg0XsTlM?j;oZ&d9yM|cj~T6&TY7$(y^Vj}92?*H{&Me+O}_i%=H%tOC*S11
z{Nv=iFCRC*pM3KB$Io}=o9+ppY5&s_7x7u`_omY7lO^Tf{+#^sQ|IT$n|XhpoP50e
zzJ2|qH+G(r)OSx#zict{?~HeL|37kOzh}QCSM@xv*efyj_Y|)d*@mS{Q-fZs%#Uj=
z<t)v7lfqo69^$xZ7Vi^w`$ZCtHlZIIgCm|@aQ!ar>1yJwy)W{s+$B>*ZX?Z4r;SX*
zo~*xFqVFsJ-(=>WA3tvD{MGbS^PlHiUu87c?*GH~`E?!g%k6#C&ZqY;Kbe=qU%i|4
zrmXGPSbv{m$FC=>xFmaP;+hmTp<^Kjop;Lb>3$k-@TWj8llRG*E{p9tJ2|iOAKcEg
zs`lzZ_e<q#H=47st~@00`Dxkq$gZB_a@uGA-qu!D&s=4-LMK}FeQ5Nqkl&8(kCpW%
z`m{$TH*J}mvUBpS{Kd;Ze~5c|c24=hMV4NR?l!&puyf+8AD7jNQcR=R4;kCGbe#FW
zLt^Ez?{7C;+A^nl?K7h@cT+6(q*iRGu3fQP^x3?)CEdra95`nt7!$BP_fce~efIr_
zIoVd%Gj_Hg<m8CowB<%u#c$Q(1de~NqxS5Q{CC~--Fc1qu0^%^HWlf)$)z?`T~W8$
z?X^5yvqk49JA{PIdHwaQz_N0d(CLL&h2K_gQebqxKKtwMT5aQ_wF2Ts5BWN8K2j)+
z=#2VxSn#}a^M}XwsdN9CGUhDvVB2x7#B+VD^RB-2)6X>b+^>yv-dHl-R)3pH%#W82
zdm_T6J-hC#zO8!x!@BV4bA(?pt@q1RpZ0vlpS5r1l{<w7=>L=1`&-qj;{VUPg<pOh
z-d!$#&wc-&zc<WM7JOY4o4V#wigf>WFP@8OS2M2#o$Sy2mC5C6eorEBQ*P8Rl~tFX
zRvj!od2i#E8_v(lSsRjgx>eq0G<YW3`|lQ;cQ$g<*S^;6O*}U)SVsIynw=MubGf(s
zSYAeR(+$Jz=1cZj+b2Y?^L?rB@3-j7^`uFML=Pnj@R;yib2+-G+hq4$=?`D~!{%3;
zFE*)Nz2}X|$~nK;jPm7A?0M|K^W*b+1A)CNM;spgx;AJ1r_)mv4xMSAloPg9@Tyv{
zv`1cFl+p8@cleoq^i;D*XPth#WLwt_wzL4>GwY`>Pu?)~*ZVoE7e9C~Eh^+edZE7W
z$6bmHEG5#BcU1Jbo?Ytt?wgdkXF>D)Ef&2JUV9%fb{$ZBtiY&o>6KKk@E`NKK=Xj-
zpC{ba{NnUvQ~ssm1$xX0uYboX9WzV%7kTN^4aQ7wNiNG5ifQWV^SRGGU^TV9B|5?E
zVy<Jso-nzYuU~JMITvH6ah-d{SAEf&F|~*5JN)n557wMJ<v`J@WsfK6UeVD$#Z~bj
zBxZtx{`-z@rG1+gOszDK(Ngf-r)BQFCwr|_<lpU*)kP843SJh^+;zh+Cg^m=-fER~
zz4N-HZpiwGlq8<Lz2`@yQ0j%I(`&d7uguC^AXa!_x${!-yQ?pM+-*Id>t0-Fy|TFV
z_pYO!?0>ws9o+w<zrB9lzCE)4CsiNVzl81oB)%Wvi{Bd^4p^|{t-kiO(1kghneO+*
zUY1Du_HEmZ`5ABgMZOjL<|J?y)tzB|;@7?Ed&L5)i!FOB+@7sBE|;6_obJ_p<`|c~
z+?}#F=O*!q_**QHU2*qme81k7j@7UFRu@jzK5)%w{SK8EwN;rXcL#O~&-}Eyex7Y$
zp2OLoP3yMK-LU3W>C~C~XVv_f>JmBeiqpr*VQp)r4D&X7O-Q`CNotnt_BBSnjioNz
zH{Rmv+oCq@%{iyrhVehmF6P?lhJ>UZ(6bR0y2HD5^@fGlMZ7x>-j3kYQj<KrB$Kc0
zm}}M~o-Td$z7O9w<mhEo8y-(vKKE0J=<(Q8rB^zS;{xx!QB01n^@~lhxjwgAHhj(P
zYtqstdHL$SH_f*NHwMV_edFZ*6jWoHD7n^U)x^_G5%Lpeb}^*roW1fvhyCWNQ<CzB
zC0O?`_d5ucPgqz#Utq^6lh|nv+~+PQ?DTy0=adPLvoy<Uoy0joVF#J#J!<)}UcqUh
z@sz}0i@E=)fA8{*<4jrlVgKp-;V(Y;Y1tHb+lt&%IC!ppy7eBWySi<6IQ1j8Sj){m
z^O1AGq5nY^;(8Vp-I}x2`T0{g9WP8cp_m-c!?^x~b-8d#OlGpe0;%&oJTIaS?LXMK
zGui!~Sn!ITWtxjtluEQL>wTsepl`v_bp1`t%h)f?aqoH57Rtwb$>!PzT4)k6<<5^T
zC+S*YTg@)-r_8@!D;RwYd31_XdQ!#ys|xaeBV)r3{n_wgQfI>RrB90D-m%ozJ?UAn
zFg<2&;p};5->lnv^z!wJB43ZEXT6W@+vsP+9{fbQ>7MJn$c-zmUypmI=iRi~=y$o)
zoJ7~UxsM+IU#Z;{<SDwRwllWsWS`WRrT3OR)eO4wI{W>a2~$H)$zIhyFm1ZTg^xxr
z_Wt<_+MoY@{XN+|EK}|)+LwP&&*nIB%u?srS%sWK-0Q4%smA?z$1|^7MB@AR`Tc!A
z{vYfOesyfFsY2A=%^LBHohQN~MVES5HQoC^vH0$L_IIluw6C?~KAd=Zr}!M#9>p3-
z(U+2Q5(^e}h%)}LvGKDJ*rM^`?H(7qhqli5{yFFb-+!xImmx2%xoh_;JH8Neo2hpr
z1=f`G_byn!;nbR{!yjG#nN0WZ(mVF6>(6A<BJbuIPL|S&>m}>%EVkT#C-g>K;%8ye
z8O1qLr}Ua7odS7NgCD=-Sn3#}_04I);ct=&SB?vF@+<lnbsjs&@bBa9*2G`p9$}F|
z3tweTv@@voc)8HE^jUPEtnf$qb=^O5B-uM8rzy|2N&h$f?(DOB)7?MspYi0F#Jo=R
z{Kfla_t@6Rzm?x(XO*{T)wv%!RrhOazWcu4$r!HJdv@iFn)N&1`1vMZP5kb=J*MRM
z3d4J|*VbOI`Lx@kAh+*Gl$+a<U2<+}tP}Pe@_wReS7%jG{G)%mAorVO|GxTvA6~Nb
zwS+y`TeqJ#ea+?v-z+|hNi3-C+oJY&*7l3*E4lv~&049RHpO=8tnlFQZBw@`ZC>U&
zb^X-|bBb=+2qeoSD+zw)^qqadsAx*(-JKaeZVn=|{g|3|v!~yB7##EddlTpHZ4=U-
z)f(LUchmZ#e#8%%1lIo9tD|R&r+t`SKZPUHW}2DgZA0Iu85vENt&CMxHszhl=*(2!
z!8h~T@`F1+Dt%%t*y#8|W8E|cJ)5#6`#C!APr4Ag!Q$-kq`Pt+^|g~{F#VR>yK4c{
z#>@W%^5zyf?Tud7?Vm2RKG6SFAam5dnY?~8dBp`vKb(5=AT!nC*?Du}GmAcS=$bmG
z{`(pjHtm3e{jZnDm%F7Nu8FT=i+X<e>o?}dvn8YtMFyNUpHjQF+si-v^bU>ZI?D^M
zch`Eze(kdk+^FJl&*Fo8S?$HgbGuGSM8-~07u&|S^wx@7yV>UFS6^&DC3x5Lmvzk3
zRMtCDn|$ZKb-H=_bB^vCzuP8@uKbK%`N7cfveN#ZOHX(0n)JXr=6ZtpzOQo<zLa(r
zR`Xbk|7n}~>z2xrsD)o-*L8S=zdy1qBY2ti;f-IKCh33KdYbRL+d4@G!>IBZaoJhb
z(&e3EVR0w?4V#Xyf3YvN#6)ggOW23gZxXIv*7}ll#yWGYY-#Ccr#Wr0){U{xT&kL<
z&pNy#GjV_a7Qs_8i;`<LX>x6Oe7fOTjo2RBQ)&lI{C5UMwHa()_9az{G4w!{eGlh`
zv|5or)AB1kienZAbVQlw^y&Z5u<*OQ;B8%iS%>Go8IM8(-?HDS+8kk1_36h=|HS>Q
z2CG<DY-cdGZxPrX9D0ax?q`>GCSUCor;8<CHaYCheXQO_eEnx#nLSN<c5!Y(-;19<
z+A6&8Rq>AGWvlPmZ3_F47<6p`mjQp)4#h?N>64!<f8JmJt58h+{4)Q`^7H=wIQ%(%
z^YZiamfp9olk<O6^8KU#=9fM1p8i(M?^#*k(JeVAqb19<HSuMp!<*7Kvz$D{Q|@)y
z7XRH>a%RTs+>1`jEDQ`e)@4XPT34he`cmLQt8DMHZ4rN_KH9U(i#f&ZuTAy$1v=}q
zlHPbqYbqUa-8W&aDy!z|j{SC$v!cI$+aelm|3-$lEmF;-baf~9W$Eo^R=0#%bzSGW
z@%x)9f8Xjnzi-~oneKgozO7>Su7)a{yC{^Rx@3>{ge3)P4F6Znxoe-G$9z}HX~(tb
z-bYj8&t2wASfg?BJcID{QtO-IM{0IE#QiUu)p~tT`HTLKp&zeJnf`UnJ-*$44<3xV
zesI%|M~6;KU3zMcRBv)2W6}xMt6H1l)MgyboZBcfZ_e@b%;Ja^ohKVkwKv5tj0}}L
zeMjnk@)CousTzMptJKRL9hiOS%1=iL`BmNjG_1}GHBEVKa<ZX(<`U06nlqKzlciV3
zgv+tzU+!AMH*s+|&v}mU8Jdb&uRYfL&Wn1Ybz!mQS}P{2?tf3pMC)&cUta0sD78U*
z+boCnWsR(od0X42o$6Z1n>NGv|H>d9?>Ex+Cmzj6xpZJ9o48V#-?FS+ZFSa5vy5E3
zcCPriOHXpi!``M3{tc3Ig_5&W#8=uTu2yOHJ}St3`#=S==G|En8mC{IoR)feitN<9
z-P)p65AM3APAoasUwgY+sDj;s!|hnD`00o2FW#)3R9e4uAIH2YA%W9#=h(^3-zQOL
zf9&x#rYxBrft`CAM6LzyR<xNM-uKb*xAnu-)zd_`uia&5Kly7x4zH+gd)|EO?SXOc
z*h^o#WpfwppCtWk&c+|2EbHp#zcq1Rd*4dg*iiLFL8b7n+OK^)r*^6Ou1XY9eRS_+
z`(J+j9W#2uCoH_QDCIcof*Y3iR8|>HEVkdbrs*?_h5fT_)BQMmlS;yR(-YR*Jn-iG
zfjRFQuZAnHx7xnXaNgpN9PuAQp4}09F89Ldr<LL2jV{wqIc${=-?;GB<K6d!8>Tz7
zPpWj8E1P~O@Y(`FnYLGw!U}~FDWQSC1)dnV?v*ru)HYo)?X7>&mS68%8#W$(o+vM?
zTzn+<`!m1FUDqzvn@O#)PMSBzHu9nMv&;u7`>s#EXl;7spzXQ`6PuI%zMUPM_19q4
z;iQ@Kx|{5`O@3i~B%yP|%=tX=g_2cnm8A#cHy(XD*Y1>>P3e+(46H9)eFMK6w2EG0
zpHg^R<mBSK`#C9ctpS&2SKlu_wTf?5!Jm@5HQB<<|ID<H=$JIPEcEowyLLqCZO7K|
z{M$LcHQq``)}Ha*GOKFsS*P0)bv=RiwPGCo7hXS?=&)<~3syhD&5!owhMwNib<yOn
zX~N-?|4a{fMP1FB^y$N@x4n{LioK=fMqGvlCmwE_)jCPZwSHp9?ufD-3z%2Fy|M3;
zgN)R=LQlh)-^&_%o-NEjSbY5ei(K3BL%E09G#o>O)=7EZ`_d7#!zEwt!;HOrM{K#}
ze{OYZcDNsE%wfmiADnVIWN!+SdF%0>lzFE+H{|OS8W{E*{MqsH+fS)?vEBOSk9K<f
z++4mk?75nWRPeS<k`K?UUv92wzc@qA-#7HwGZqO0mEINY$w3p<BARZ0Zw_QR+|;mq
zq663Ok1Ma*m%ZG0XrrNNNynQ2-n6UHGCw81%|D!Hb<NoC)gLyu_h;)=LY=P_NhX)c
zw^u#$Vyua;GyQ0qJuym9dWq!G7Y#eybc$Uf^0VA6_X^1fCf*Ry@V0rnRdVsdQ=Ct-
z_USJ@y50LgM%f#oR;iZ#eU-VroWTJXm86PKYs_;sm7M2&e{ZCYQ|x`CvtOGue(HW=
z>54aGd~Y=MFLUJiYqHbJc5G3dUwCNGgmB-;EAx6TbR9DD^Et#d-S2`K^Gd6QrhaPf
z9upqj)_C{xZc=sWtKYVMu{GxwKfR~<GI#N}yB1!)PEX6f<bL|Fx3<XHxxQeIaV%qw
zC6C~oC8@3Z3ri)^4t}q1x^Qd@YmoTgrVx3fQ^%erT(RNay~jmy@sbd}WXm~RV#$h2
zH+9)hO6)9p#LMupgp235(%z1R7CSA4t36H6rz}?UVSIJx)HUM|9DExDb8f!RDQoK%
zvfI8OxarucMSBw6#nP_{O#lD(qxIvB`BC%No@4kIyi{$%`}O%N-p!Udb8l{VjK!vf
z_unOju^(}mCw;i>!@a%r%l|A}XKHYv-O6Lq=kxi28c!T7?R1KtY&ek|xKsbWRO7Tg
zi!a*5FZh`+xxPBzere5>OUX0EmUlJJkDR;q;J-6(0>AUv>`reu@$kU4o$(81ohWP8
zFkoY_|51;6P-ej5_eXU^7#OAoF)+w5Ffin%7U$<Bm1gFo=;!9Al;)%s>u2Pbq~s^-
z6;$rE$<Dv+w(b5`?KDvxk6evwH+98gnWL6S?_N96L{DgYwSEb!o^PLynaIl1?Xt0l
z|JR<MDgNBmGjCV8L()X!;%8?n&sLs!!TR&Z<)igy?~6*Vjk4N*D)Xx7>n5}3Pj1J~
z%6;+Y{KuP5SSy3yfAcNe{_@29^KrG#d1h1oc--ElWVv^F>fYOjEG}Ivv7WhRc9r*}
zl)L4%&XZe2ZpYp&QCYicm-p^P>u#M?;b@xedvQ|k-0!NYyO-_LFS<2}SGRnN;_H2<
zBK$Y4lP+@CzIEWltG*|t*B*!P@V$(#*}l@cf>%IY*f8|2+mg5Wj9G5C!}h)XX8mT~
zwkK{1lHPap?8`UQF#J?LtgiIuJv*28iaO8JaeH^Iy0%qfjobZit~1?Jy1!_2NB;=B
zR=!C%dy4J-FS+6Q`Inycl}-Fu68iMZW|_&CWm}(XX*Z}Oy=bl3-hU$W>cwSVrytIh
ziA*@XZsCXjxwnEWE#?UPhzb3k8TsVCS$R*J!;)41R^}zvef#>B`9E99qRLO6Hnr}-
zPn3PGUeI})A!itopOxUmShKV7p2w7q4Ilq#vu|8|o2AhwP43H=_g~+xH+g*}NO-P+
z{gqTdX?cb@DvX?G?G&Sr-uPbXDyVAdVC1^3KHT8jquZy?OWs{5b8?@8e!1_i+|rc}
zM*ol8Z?0H-(zoXGefwCo{JI@ApTE8O`~7*3M2?O4`WCOipag-re-@qCb@D>wNxtc;
z`V}sOWcOy4#+#HL-QtyGyysGNmdHfg^=;wGwxu@{UQfJ}#{WI@aG-DA38ru!?jNeT
zhZJ^lrtMMHzPwHKe(}*I;-$x0)kCu97M^;rT-R!sZ~1eEm(RI4Hs|bC6Y8;8B%sZ@
z<iK%#X2v(JhTiWooBvp<Gq{-M?aJ-klYME)?F+g`SFW2`vPAXVvgAoqYyBq2-pY-7
z^KD&*_2%w%`&YHQ#D=G&$s|3go48jyZ}t|+xV%ek&t5&<7<y~+?$7i19<KA)v}EmX
zwZ)#n*YBRtvfS#x_u`?PmonePp4r)HY$5Fr*wb!WPHH^YxXt_Yr#W}7m0HexQsSGy
zbSKA4LhRn+y>c$9J3CblJW1O+YvRxQThsNHEx574a^j-Y1*?0C6a*a`W@(t`I4gKx
zJ0&Qz{>JQ+DW4u+{r#l<_3ZA~<|p;1%iG1p?q?U}I`=65QFwa#2IsYoX~J7#bocQ4
zizi>$%^7axCvw`X_1fkGlAf2pgdW;{V#Cs>R!TR`%qtFPFdaJ>`D{b$F@~1jKF0Yf
ztGD0Ya_X>TW#@r}^{g*yw_o@bAM@|izvt!e(+t_CUbWmRcHsIq{wbveW@=n_RWw&E
z@)l~$nYu{N$ZBhb%K6f6$<Dq1@AyyY$WVJ9W8N+Jkj;O4&<-m;K8wTqXY~5$PrhBt
zl(DS#rlUEZ>b<MG4K~bXevlKjtt8Fqq4Sl9&4S_FzCVuVBxJWw3(FN*<$0e$>{r*@
zytbQ@ekax3W%!%<Z(>m*gTTCH0W)eRi&b9qnDT|U`y|J5wl5rOzZUN<%2=_%X5YrY
zYwaf3|C*tq@`a<!t8eYmmt0EbE-Gh?PQ1$Et>JxEoVe!MiB%2VnJ&vdSH^95nd|x7
z;a!`N|JFI1Z!ViS>&XZ9hGwI;RU!+dQn-JJ{*MxO`mgd(d9Kn#HCuf~hFym@Pu;re
zNOtc;m!AD@@pre#zf$}rwdCxnS-!?E_C#jx*dTav`Kr1V7aT=a#ch5YreVG3*{b~9
z!wlT9dpe}=xExp|z4)>3AGUAoPnzGH&ylH<6p6c0V>$7l>_;KC;w29MXC;aIJrCZJ
zvD>IsmPxMR@yU?Ma&5wkrw5g!Nwe&jX=nbPTTwu%afYBsM0F@zn9!c9o$o`p2{50Z
zu#GdD=cf_N)ih@PGjVcuC(eefXq?}drJKfGx8v{p7klr<ihch$)6&n$wtS1*s*E}B
z0)8C1#CGe_CF}OBlOI24-MK>Y=Vz&o{qM~r+#Mo3x9`q7&$dPV(HEva$MdewtN(g6
zx8H_6Lcyf8_<QKZZMJ`J$N&3e$~jY-@8V}kOa7B*n3<bjmGP@RHm=mz#Va8yu;8e-
zN={(z0g>?7o$4>YZQJqs^}eqTKc?ASIlFwz%IXQKJaesiHW@#AyM4*(gW~t!F|g$b
zymmS>X_6RI?W;z%iM5->&#)$$=`e{Wf7)`_!Z~C1Qi&g)j#qn{{wM@B_?WtRI;Qv5
zi<H+1*o5#)8QVm;DDgZyc!vML(Wk0W`Jax9{S$nZbd>Et++UdjIfI5B0do2>syolH
zJ%2c<Jg)Jq*@4}g4EtvD7PCy?e!wcVGxk<P#+`*zkFQ;upSf;{O-}lp*H)*KxsTbK
zZ(%yuk=lHCe=?hV3RlX~B`zBBEg?(RPkAz_y(FK}>1NBuqgDP~B}aZP;g0?vv)ApW
zMS_aT%IgP}kAKYkc*4z&ReSQeI;s8-J`%^Krg=rGIpu812)cMuTufAMezKpxQQQiT
z@9ZL-%I^+y?qg7T_9)l*tdMKioTjiSH*FiYy^rjkx?bGk&MaZsR{7`8-i`9V9_#b+
zXaDt$YIt!=bFIOI_>*4*BmSDGzFqe2^qf0ELF*%vUd^$wJL<^8a%WlW3xU4L?f(1U
zJW@Hh*4lH2r6|jEi?wOS*VhL=$&>tTYvUGh*n}hayM#gPrM7EDtxdWYj?Za2*f6hI
zebNGTrhT1;k7h9JnD$Jvj@jzsuJZ?0EZnoLqeCL&;n%A_qWdkK^KIU~O52|>F}S7W
zR7J@7`)6dn`wB}oHoJ!}k<quj91?x~&Dp-a50mCTI>{Nr_bc~@<<;`Zj}EHzE_{9H
z(=3kavr*3*yK;nWH7_UDpE={MqVe?Yx^$O4vO8bRvb<4XTPt#;R_S%qv_s-*hoZdw
zXKKcq*vfgYUA||1LftI}jc;E)FAJYqrk?-u-=@r*ZH!N+IP7Y%+{IxUro+B5esQwd
z)*HN^PxLg2@l~WfDG{xm+Q)mqg?(M|kN*qSXU@AlasGvvsgobyG}6^?$uyoR7SS7F
zDAPOX)WRF5C#_|F<X=AXK}W;lo0mJYXa7-1iiqjBU-QlX_RfPvn?4qs*7Yr3Hizw3
zm>!SzGKE`9RtWX{(~?~FslE8!6sEuj>t|ag*RnDH{q^|kdHH)WYVzyW=g0XgYYQ(r
zI%WO;kDssZ=H5J?=cjFS@8p%Tw+p+r&U?_cb<P8$8RyM2tp!pG!+H20s7$oiIdSvh
zg1j?PY<zVG&&Vv9k(^iNcgy*r*QLItr2;93f)zHu;9#*Xe8dp&IDB4>0KdYs;sw5D
z&rh8B*>s^={AB!W>nceH4*osA>Q{5Tn3;FwVPpHvT|V#c9O2V4QRt9bUDU8cw;@>W
z6=zw@ku$y5x7xB+{a7_+-ruDwHo2&{nC@FpttdS0%tWRJt!B<MO$v+i8dl{kIWk@B
zyY+^>CNV}clwbY1DVtk6L1F$x8KKixH*(&riTn4M%j=l+k>95u6fph?(pXT%nZ8t%
zy|SWmLi@8N98n>hWf5-@{#d8>eF(X^J(b@+FDU3)`-6*1g^R>y%u+5^Jv6Jv^4<3O
zl^l+IPZ#?|EQ|a1;moI|ngx;liIxl0UJ1&+&Y2?mmqp^KsnW@XGjinwi!N=y<Ys(Q
zI<CJ*M*P-d=UyS!+gJH#7Pg#xIXU5-(~?8S#g^PGc*pYL$u}j2&wC%Q>zTr8`}6Iy
z3JH_>)}}mLqx=MGFVEOL@zZqAJ>`DekNh}e`N+@Z<F@acW4dc94fb=T_3X%2(F>RJ
zS9MtaV+Q+T>xQVrLq!%}zBwH3alP{<_ffHztKe^!{}aEnefMeJ@u?zx){*|TSyzfL
z9b?;O|0vW@d!GE&B<o4+^GYrpC|R*1*wnCf{r$!p&(f;GQ%v@(YgS27c^-Ag#MbtO
z{RSS^v{^ProtJeY{weRxeZA@Zj)NSg-ya6Je!OBdC$7Ra<gU${%p66(O=mW1ZB$hB
zQBl%6e<Q+eoAO$oq7&)U9wa0`beT|GdFE;0j%H3fmNJ`l)?Vu`Y^-0lwQ8Pei{d+_
zodP$%e*R&0*6yH0?d~JY(mKo>m!2K^^yq);G|^5i-Pi9sw=w!8Z@8)9W3lD+NxQl;
z+84Loew24+Nh*Ja^pYC~zW7)_oaudX!-`XHDiv;QW-_sflRUiN;76T><f*$_hYDXy
z*Ey8*wmxi-Khcx_deUvvFpcXf@`bk-FetmZ1y!k}rLA}8d45LP;P)ig#t-kVX@1Z;
z&eh>Ek4^50L|&J=lAN<y_k~MV-@fz+7acnHxo|meW!>II3)e;qrnvTOu?aZVkQfxO
z^Hj#`HpOXwg)VV7_l3;4yK16D*XjO^LE7fLt`7w_niM~lQqk5_5ODXC`txbo#0?WP
zt}vaSeB$oiBNh+S6VLov6@66bu3xBexvkP=JB60)gs^{0y3Sb5uuFQse5FtRGMBaw
zzby(l)zz~yPWreX+F<oj<II_rCmMV1idpXPTs|cwK<KBT{IMSiPb)MRO@6ka_i3B$
zlnY(K29tta9xl&l+>w9TKjg-zu<~PhzhXV7SMgZN*!1h$JHNQ`aOd>?Et(0Rrp-J!
z^{H$1%cPxs?-XSV>TfFESs8tPqv>anh))btEqbkOQ+q5t|5ztBxYxD1pYQu4$C#bt
zIIkk~{LYM1b@tL;Tl=QxJ8-1AZ)|&EI=kDkSeIXH#iiRxtK3<Wy+64MC{Nz4`D|jJ
zn?U+kNp1UzB=gm`H3Gjpcy-~XiR5>S%bnjGzK0$?nH2A!Hmm9I>gTgeBBt)sIqGQi
zy=C63)E%LnFV?p?eg6?2@L}UWoq1c|?3O;!H%Gc;x!kqmehF6`mRy)?pmdO#L-y$8
zy$@=2oAyPY-`|*E&)S?O8`2>!b>X%_MNN@Xq^@@Jf#+wQ-HO=w;n##`vZqC6-afpU
zv3JMfTTu>E1d8A5RiA3~-Sgq{tw~ESvdxyveGuLK-05hGw(-Hl6tgp*_q7{KAB>R{
zeIqwR)Nq-^>x~5#tEIWx^ivPA+v^GNsdwD`9KDObnY~N&n!+W&U-~8!4o6$>+I;>u
z<EGal{a2fc!W63c9=aV8%{5hWdlcEz=>6)(2k%WOyJgqMKX}N+m(_K2-v7dl!h%h;
zW_6MdXAbmp_j{Y4YTy=&R8oEZrTD<Fneh{i<0O7Q3y7MU94Ww;zp(qwM?v<RRXKaq
zg1PsvkZoRYvD9$KM-L4-zTNJ%Hmfa?Wct?~+TO0qC$iq3S!2@Gyi=b_)}6R`Yj$#T
ztByWfsU>gp#?5+n&i=SjQTJhQtj^Lo>-zL2Og|)cda-Tm*%*)5L)HZrt{PH(pRVnD
zu<?S<@ekL&s!cM>?uu3STO?h$a>t1jpPpkSCMm&J0~0fu>n54ckW9_p+sq&yF|o++
z{l|4{pT1ns$>9<_DJ`~;|G}MZ9j4mX3KJ!s+n(!{f3B8!hQCv-);rZG#o*qI^qGRv
z;+x*y<~#rCp^QoDwXdOnwCuQfm@;;EHXqwiv`wozaM8{1mCx>^9N(e)Ok=Z`%2%fH
zB+dn^-#%<|U%dFQd$7L?$Kg5myLc;B&RT86F#Cssrr~voh3RT5yZk1H@%uaf=X;az
z=KiGEwW)t4ye^+mn6zE{K*P~2+ugU`vhUuw<At%n;p;EA=iGd<)ZX$<xz?P0%dI6h
zGskrA7BN2E^VrWx?TyQ#gEGnSo>$&yx6iY_^R3qJZQr8Om;L9<{mz)MpRbVq{^QH<
z>c4!;<{sq=N$1&Ib42&8S?Ri_Z^s?FO`D1z7W1tay7%AH<6m}Zew^JtS-sC2&rCKB
zS@XtUC($MEQT}RMo4=kZ6Mk@;^LG?1acYb`AzT-HZ$)+Ws)VXshwoS0t!}&wHTYg!
zz!fSv`({wfi7M4&8g>2Lt#!gvR-XHykh8a9q2Tj5=?Cr}?YrkQja_c>$Jb}&3e@k!
z^_B2{kJ*3r{i%bDE1#7`xK3=YUfV3M;C4iyf7<jo-`EQ;mgeo-q#hr3bg$iu+V|3{
zR(<=m_~ykuCM#@Tes4BZ?V8;^foGX%<;2YI)8i+|U-qApz}IIJu;*UuI<M<*HlEm|
zy~$tIw1I!pDn3ya&L$tB4NSXhS8x~aHtG7T{kCke+S@fOh8(|L=YFg{z3^+WvT@<p
zpRfLwUuVetF;VcP;KEG%?*0GRV&>dT@i9O4&QgAoN^VcMLdc7Zc+=?}me<X{<aW<3
z*>?IG`{{({Y6F?6*ZR9Z*=*d@cKDq})E{o46)SsMUYzk;zLb~uXtB$+gZIVz-@W~-
z{=0AH|2x}bTKJhx9Qyyw)w#GsVOL`A$1|SoH+N4mEZpE3{r0-+6TQ@Zrn$ijsxKEc
z{L6c>E;sj9+_zhQ6vdw|jb4#3ZD-<i(V2|*#6p$g_sr6qY0AFx@|AZ>>oU12*E(<B
zqg|Q*Kj!~cp)>{qxq|-0->0{q-dg<ZXJBnD*AH3OpE`cYTTUC>1n!QQu=%9pB?*=1
zt!{hm-77s@f3&Ym`#ReyQK3toq4)=Hr^iV#^EdYz*JOSElX&g?(hpnbm|Xg&D=Kj+
zf5J)m=QDd1SA{z(eK&7&TBBV&>yuRR#(Ty#ZQSmsr?UNKm0UT!BF$XXUB8EASx|4H
z=)Yyjcb5N5JYFYr<W#K0l8uMzJeNJ(J6+PQXpT?ke~n!~G8>ndF#diNzrQb@)qUEd
zovk0NPfTOGZ&C7NK11&HBX##JOY+lXHWlXl+!=i0(ab$ATE9Q<xn#id>k7YT{KhWz
z=CiZfY>#;G&)wBrP#^bB=3IZ+#=nPu9^9U2Jh3f6<k^w51=SLnTlu%T+;|=wlCUG@
zfME12v-H%RvgiHgNiIJsm|6FsLG-IpTc1UofQ_<Ph?M)BFLs;^!k_dLHUBN$l~UVm
zA2T7ObRDbQ_CMwIYd*F7FkKL^d`E-u%h{Drjx2b^Uc2U3``pb9oJX&0EIf2b?s?p$
z%4ZX~#l#9C+E&bX5pg}_=ao$to~A^n*gw2$p|m<kj!8f*BOvp_L-#BH`r8&aGQDb$
zTV8NxTj{w-lOy_l(|K!qau|-w)#xrMVv_UDm~_rptk5DUlp*g^KI$mrj7uVoI{XX_
zvi1xNQrJfsGYu{B^a?89N@o|}Hv6=@o>lLsLy?kU=jH6;S%K%*J$_PCILBvA%=*O_
z3o?WzMFz8Y2i46v{{L^;M<s`*ZJ&0$ytCz3Lid5Bjrwo8FC-WJdU$pJ@#B$B-Lv}o
zgQ84s8ZExs@@9Hrk>By%4>!*}{-j~5dFVE){1fjsKfgcurlsopjI&&mE_u(|T*Uj@
z!};;obLTcCWed5U_T9WPLu6u3?50(Ug@GH?@{Gc+2(?|!TGuoCv+U2kcIRJit;)zd
zwI*WX4mIPQ8X?(y>!lSWFYHZzskU5M>0kYl4Y?oJTik!KaB<SfCrNvM<xGB>Szgd9
z^Ymt9zD>He=`>N^wWqoc-4|G~Sn!0#P6s8`4+nLAy}W$!<LVd7;}?auum5f@d*02W
zqU6)V%Q{uRKX=H?opbJ6fB)i}|D^x@`FDAZ_19M~7Ju!z?;qiqzTt64ifhPawOu`*
zb$X@4EHkXTvsY<U`6h=P<=o5E!WzFdey!PxO;rh*GcL7+c0|8^(IDzOM|6vmRKODD
zPv5lGg+0nXXtzOX-YdaZJ<Bd0o%%CmlhvX0t+A0CLq*qT2hR)@d@g@v2h-}wTH3R%
zVlFOQc)ho2UB(<Y%M&%i&AO@HM%?N9Yb<*B{uNey`1az-*_8GJ?T-c6L;_QFs*XSA
zDeL(x=va0sJo3_;EvvUYYh|3<bT=s3?8&vo326r;a?fNs&)|BoLRPB5#PrzCojux)
zL6eS`@*d~iRyp_SmFptx!i){`*JzlZWl<@dbM<VESe;hG?Va<E`QHsuPW<uE|3|pM
zx;8$u(!<vdC%e0Pt#=o5Vr1F1`q7ewFMn^2&%AUc>!UQ+F{UQ(iHicmkD95KesW4F
z*m$8h=W@ZehA*<&*I&F*^LlA??}<V6v4}j5MR|{G%KP0i!xm1sH~mG&qZ+;raoYuI
zalFh6C9^G~jSIw*?<6GbN=Yi8EN&w!oZ4OdzG`l@@}s3&_GLu8)b;thUoic^+Q0g0
zue6s;Jzl{OUea;5t7-Bpee(#btXK7$*8I4<qP~3bxmi|GOjDV6#TZBQeOgt0>W9_E
z=8&?oMSuJA{nT?!W=gB*oY*q=gQcUK)NXZ`yWC!N=e{y|GczhawVbPe#Q0qL>De#W
zG_fSAH{6YXd;Xi@gE~IWUm>-^Rug*o<@x>j(_=(7++TYmjrH1NUytmM_bPfOCePV0
z#n1k1Tz`C(a<P$L@Qmos7x;{;UKv{E&)PK4rdI2->4~^7*67O<LRT-}aW;6vq|I|a
zy??y;xxW9Q&uMdK@6dm7R&@2H%#{3<ZT@V>_!pi0oU+Aw!;5=2L#L=2eerK|<l;4|
zGUN#HT5$Jd-l2m!6Q6zLdNJQ-{*(vPj-9MHxvKQejT06E6L$YrxNtHoK<sI>L$l`6
z*+yF0CnTpiymCG;<D18WyK5UBZ(8EI>#0;!=$bCBD$~l33`HIxmLHz%{>^y3uyo<i
z?u@xd1O((B2@8F0=Xk&&f9P;y!<n@Y<fi;9^4^)x8RoG=ZgKZq>w@`4)9mUswH5aV
zORj9FD*5!wcE_}BYM=J<h*ci!D+&nMn(BJZWn%p0n$FU;bAIYajDsTdXJk0N=Cu&E
z=lB|x9D2ct@lb*9?BZ$H9xh|~@A)@cJE|(%r=U`VX}bEus~xftwv~Azb86l&IQnEO
zM7iyE>RPC9cB9yzb<XNdA3WNBo|uy^;r1Y8;(F=drOzBD^L}5-EoYTCH-ynK;(Vz`
z-1XH@cS+81X5{xPO5B;gKDzSe=5nX6)uv+4Is^Q(c{XTWYCPvIaU#@qu}V`+XzDcg
z83&op+a$52{8>EHeao>=FD@zvF1WrVZMN3J4u((KVX0fxayXa9@-2x8x+k=PanDts
zsS1h;fpfS5o12zR5St!(l#8b-gKOe}o&$9aiV}&h&Pv*BuUcmznv(ZG=ttwyh69?)
z0ry4c*v{PaZfoim3yZeOq)Y#FYCbyuI3pbW=4Dlc%`DT6_vd|-ld^sKN@>RAU9%Uk
z-xfJ){K;v-ndfY4cCkBN(0gg3^rhnVgcpsol5HY6U#gzgUm2h7>a<*;b-$gvrbK|%
z{#T84*BMPC1ddKJ7y4Q2T7SD??h>2mB7Fx=?SiS<C#$@^doH_sth4^M?#_2pYM5&I
zqW*epe__WN#`$a|*S+YTjsR=D0M$Lm{XNzvUY$2NM>G8FRHMDDo!wJJ*1SAd;3%2i
zGrN4w)h*ZGyuA6g#l~oYjgnEKQ``@(O>Hf6=L8mX^X{}--r830vT2sdg5H3m{GMg6
z9iE?>t1BS(w*SCJC$<=ahm&%<uJGsB&AGAclaIdfymbZdU$1^CC>Q6UHmTU-`0`yW
z)#_|~=OU+Fm>|FQfQt2M%jAR^`?Al+Exo>Q^UAz8jDO}FpKh{iiD+Ar%B`cOzqC0Y
zv5T=)&AqVct!LYwyHzLH1><9cZ`}`iQJdiF|MykQ)hB09sw-u3x#V|6?O6Y4kzvHg
zx;b{-^Z%bUemh0pA>iB=Tc4I^4!taV^&fPmY!JzHysWj+Jz(FILf6{hD&_8m1?SB#
z@TKT(Pn>XP){b``hdFKp>}rfSqMgv=v`F{yMD^Hr^A5-zi8owvKHrz=J=1&RQpO`&
ze(BA$-qg9y;jj{iUzv(@=BXviV<e6n9Nn-~=bY%V+gEcHcW0bD=-A10Dd4M#Yh{J7
zzrcy_90A=)=IgR-p6E(ObTplRwUx(iaq4B^tnbEGE-A)6KhTu?;!ASF?w^aib52+v
zed&;<_(jq2uYyEW?)DW9Z8qv`Nd{LqjBS=%J~?}D1-E9}&Nb|^Y_mG^TMo89JvC+D
zo8UznBBArvH?&25_*T)kv0deTXAi^v+w4gyKG)S88b8>beH3TZkf>k4<YAN()7D!q
zowmT2_4eFPVrr#(Ta7GkmfUNOV^7)azp^?fBlIo<?_s$c(e^94C6_S7D)LWUSKPAu
zJMZ1?zRQ!nrfn`b-*Efzy=B?g4E{{?w*8iHI&|m3giPP8%#Lm99EUFEo2uBp<-749
zsOa)MvpESbZY{H|EvSEag?)bE>%+bBA{M6mZaWCD|K!#ws0yC<=VA7tWnJA?;`&aN
z3k$2$SDf2W5V`2fCKve-w`ZP<{SMFj+vV$48TzSH?#bcMj<)TWf3N-YL;U{j%9>~$
zjew=M{r=_cfA?m((0R7k%zr;IO6=MGGs`S)?XuOv>uZ-B(e62S@YR&yZ%=HOvf2D}
zn{57KO-^fP=#oT%yG1TqS*xQ`wrQq%=7lJJa=p}S%5h80O<wN=&m4g(hl`cZi#e(6
zd*{=0;<bcdx0En1XYq$!re20OIQhzcHq?vfy+6Zxt+iwtYZGIv{iodhOI!||PrjjW
zy7--R#nw;d;ZC=go{qhtQMNPXckqvc(d>#EYZ=x*)Ly%FcJs7GvBR?k_NOpTe4lwj
zG>B_z^foPt0=X*w=RqwCIX{UjtE6+fTZtO^nuW4%RM3j>Vpd<|n18fZJtgXI>WirD
z3AHcpE>id(ba&>N^$(A92j_3@Q3yC3SEIJy`$T(Ds$8^T{IQd)77LW(f(>lt+~!H<
z+v|tD=&cMik~=JX$Tz>&wLI?itF7k7mwK)pzPUa|HR?c@zmfL++mkbQ#vKj*EVf>G
zZO0jt_@!UxM;cjVw=In{x$`RbUB%8D?_Mc%K8g;PJIdqOamD{|NxVyylJqC5pMSE>
zR!#UT<Fz*H>#^8<8+Z3GhH+`e=SH)s9TR!mws?N`%vRQ1!>+)S*YjS~P7Siyuv|dT
zXO4f5spA8InHxC&S-36eOO#kWk+qqjT`q-vYtov+kfq1gXnB3CzVdcsS9<G$rY82+
zV!OLqm#>=nZ6e3>8&11c=<ICEe)~gy#We?+&wiTMjwx#_{y5)eTlYJ;RdJ4&#oqK!
zy!CReVz>4ARZT2+Wt9sP9w#(({D1$TV0w|P&flPOSKjaSHl5<TGqC*C1Y3dQRve9r
zTNi~Nl3H;~>Drq{lSc<$B|U$<Y{JyOm)Qqb91n_2%IDF$`|QMD({mS=$NygO#<0mz
zP_}8Ea?qOWU(Io`FLdOr4L;p%+pW;(vnKx$=dscYw$s%n$Ev<{{qZ@vig~4x%jP*s
zO3t?mV=u2Vyglz&pH}HN1J;=PQ_SaO%1I>N-fcfE;jBek+@;U&t5YxUTlaF$n#`51
zRz+v**}v(|%=qs6R?fd;uFqF150ek?Z`W!|OBzU}R{Rv!*NI%dd|~oMu~M7#>zjpI
zKjzknubZj7_+@39E9;AQKNPCUE2?(=fA--D_b+dGJ4OByrVqyD-%sr|d|lF8Vx0NV
zL22vrS+6{pmOfwzwq^XepZ~**KR%V#^VU2xNDmM>8K*Djx3g>6jbQUKX5T|)k8~dt
zc^a}_VUOb2#TRQm_xOayq}P%R`4x|)0?d1s<h0Cvw)uz7e#ykx!<=1=0_C$i7Wc<q
zXftUzEbQCy!{}U5&E{7(xF)FGnQ-Opnh7!?vqd6(_0;|>^)2>mJ?UA_8j<SIx?qPR
zSFFvSBVD{te2+cqQVOfd?#}Pr*uQb*M6D^2F%x_*dVS=1rT^u#=3$w;;i{bbyx+c0
z{hAq7ylqb4`C0A04d0WWJ&J2)K9zOi!@c6=%E{)*ACl)k={tX&z52nP-3-y<bDq~8
z-!MPD&{p7U*b8Q!C->D}eDr_6hQG~na#pis;nKw^_w^KoB^FQGdC91Fcm9;wyo>he
zI|j4fJiJ2WiP+D%**~AFRIdBl=i~piydwU1#-lBJXSd%rK76)UvG7yWzjd=^xKh?_
z33zzZ%3Or|*quBdrG2rpPT0p!)xPDEd-?O+*~jCS&syA9(cs7_!V?>{G0*j5w)Xw^
zbr-jaN>7~kXaDXUkKXCO=Dx`PW%}LKw|`&yuJb;<sqyzR@7upkQ~zz99@umG`~LT(
zB9mAC|JW*0`ZI6A+Ba;a@#cY_<1hK-ojttb2hZ%nJEyNVyim#gJZJWLSH{yqv5C3m
zhj*+OmlN5uw{Y(LNAddCOxOCIVA-=H?)Y5wxV6S?M^Ep)#sBQQSX%Wf{sQ&`A!6oF
zQs$Pe`<;>eNa9P>-cN=z_tt-{b2>HqnardM;t#ziC4}*|xBZt1dhy`&I_WKKuS#RK
zGMqc}X^r*Gm5-}_bKF^U)gy#^X7HceZKhZJkHns0S$j_4{DZr#-^w+vg>^JXFFW$M
zX`;jh<-*Np7uc<=-FIr@yn;2G%KxjL?VK2Kw|?ct-EIe$KJol<bOGPjo4-Hz9hU#s
z*X(gExXW(GylwY>ou4gm*j%x!qK-w>ht2X>{fa-LPT$kHXFT7se~Q3y$0YMQ2gPe_
z*8f=%eQe>CUn8PwGW%w;FfcF+FfhpB=wm0R7MJ7~<?0nwo(<2<zilS)Z(Y3O0(lk2
zP1D3=xg<_ZQ1UfeoGWB<DlS2yNoTIGp3%xlA!7O`>hDjSq~WzKSm*GCm(4k!D~?ys
zt6m&GarJ5b{l0b=WoERTT*I*JMOV{|N#8@K-9Plix8}iKrQ>^Uaa0wrJ~6xb`g@Ne
z?kC0`=R6p{2Ykxvt#WbP_HED92icRBt&Y0NbZN?k(xa_PlF2ctT}5hp%R03Lx;|gh
zTjA?^llP>GXOwl}^14q8E;wKLccyz+ONYt)cn1H({VA!r)6;T}MyIacyCyTTNBp{!
zgXi?SR;e%iRT=IZRxxQFI{$u)^V&m&lg^#fUqAWF<Mq}h(`L5pXqeOOQ>bXYw7)*>
zk=t*P%!+^|<yDSl`?d6f|K9%mqD!Ul)9<IARewI8{CNE4&zo12f6SOHl@|0OV#71x
z+^5WEr(VzB#v$#rZbDhXl69Bwo{QZ7<lP#U{em~6b_ELPXzS1Z`s~b}GfPx<d|`ib
z>cG^-Qtdfrv%e@;>K081KJv5E%hdl-c3Z@=ScONyQHNT01Tk%N^S$uMIH94(X`%0_
zqlcnSPh?d!Vwt=yz(4x$^Jg~eKh{lC_KjI1eXJ>PTd6|Y^X1}CE}Yzaz<#ey^?&9p
z@3n8;kJxwI|0f~;V7t`a)6-OC)E2dEFbp`r<=t$w>XONXfOSfbSdw40DXL7Kf5I}|
z;O)=V+5(Oe(cFD`H{LsK-l(bV+u3(erm{=NcCkd+kvTRFankML+(&-=FfrM|R(hIS
z@_K0F8`l1?Rr33@n%?`*KKu6kiM*<!58^NK)&)IIJl%Lj(yH`wsd!a)_PhKYcRb>M
zXNEi$O^xv4U9e#4yQGwN=}fz&n)mKnTN7ls@i@~quQxsA)w(60{@&X0IWkxG{_3?a
zs`h`MyJzX|j2p>4cT}>(72}Kb7daa2elEAtVd>!mDd!ig*fqy;-Njp02XhyctvwsT
z$iI8-?evgoy9`?vzOKEj&zzmg&Y@jwRl@Uq&z|;%)NG3{x34{J{~LFEMsuQG|F16l
zFaP5=ZxsIUfrl|ZTWf*A+{NOiYg)EVi26~ToiV$@cS#<XXYAAqrLEJqKRWu2(|5zN
z!<h+PmDzFMr}j?ff6tcpSn7u9>%;33qgw7R>GUX_qugtdo7}6K#I~9>ep=rNiBk1C
zWv``<Iv*8;Yb|~Hgm!Yh*{XUj-_V!o`I!}}33<YKf^CWRjMG(Pm!3*t{<UGQ(&5Wt
z{}#7?o04@m(8x^J;o9k@F55|K!|r%D-VHuDbKfrBqn~BhimBgzvU*<rWUu{C+g9Ed
z(f;_Bac0K(6Bmz`Hcc&GvebPUNB^I|CJR9cSqld#=_TCeAAc*H`m^-U!dK-B&Yzn-
z?|{?(`1@Z|%1U0c=80M9xwD+x{YL7$#+G+Wu0>>@SobW^e5d!RxH)sC)Up@7)sUOC
zWBNY3>UqmO7E8W0C|Ppaw`;EXYVWOAXTJ@9v(`rYm`mNto92;oOji9f7nuFp`H4$5
zPuj=%?uQyzzn9i$%GT35@0|P2>c8}gLp<x>dYZYc%wMalKlfJ89I<Ci-EEb^JNM{a
zVE6a0seQXV((`}Qw^#fB_9y;uUnaR^?fu37EqYro{FX*7)*@E~^aissFsu{AIdqtn
zSeB?)P<b`tE~rSW{~qtSgnts#%z{q_B5XEWiZ7kZp3Sy4I>&&gaoRaS>BuV@r#hpb
z)ZY(WvQMWvbNj-hUmm@vxc_~(wU+;h-><vxx390{$mBa5$+GfMHeZp?ymXzO#0o$6
zX7v=UO>>`^Z&Z4|__MK5f8(CUm?bJrx++Sy7sv!2Fl#;-)y2!%RJxFh)6wCFnsAWd
zv}I0)M_p&}vrU_3D5_o)x_4FVvCGnjij1~rncX_J>Vap-N=?nEwD)t$b}VyUcO>oH
z6JCw|pUu3LcYHtT?cr#|dNF&Ra=Yd0mpn(+9&?`9b4j|fDS%bfHiG-6@S~MXGd-V7
z(VoWKt00o$WfHYaDYR!X^XFK$%_X`upO|L&U1wd8u;TA3&+vlhlf%njEO>ZC#Ze?h
ziGRYB@b}wiDZc+1l)8G;o}&>Pm{J*hn*8r2^j@5tsUyJXHYe;%#?Mc2ih2Q$dONyY
zK2P8Op261Je$$c_p0_Nu@1JA1`i`|@@rSVK+b-z@UD&8Ba4p5}d3{Vg+vRxu<?GYJ
z^^Y?*`Ck`Keq?)yJ!<*iPd>T}&t557mNeUR$w395h<TIm-<T$;ooAnuZ=+#)Ze83S
z)yZK8)_vxDDl^|g`Pb!+KAH0dZX1sAJ<tqyeDG|-n%YZ6$#=>Q7=L`Fu5UD9oqM+D
zdP^tS2p`dIjpeRliAs0$zpkvCBi;Q%;i%eeCjsVe1JiRiIOHwA?e^k3Ehk+0qNSTx
z<VDGqyNSx@OK%=~D^->9qd0c8THTSRlj;XO8##?9iCog1u5?wHO<Rw#Io<cAxGc-%
zc)K%k@jA!nuHZ9Sdpr2;<W<wyMUsp+sjy3PpY0A+JE|UXE5u`(?#J`7aT1@sCtpnW
z{Vd%hyL$f7dzGDgx1|_+%7quWx%bwT@7qz@(4VpL=Qf|LgPhAEetq4sOn--*e7yC<
zy?w@MJ8E}pf4x#NchhM{_uJC@@`BbelwAL8Iwf-Aijzq%g?*pDzMG==b;jfm=?6DX
zdAhp%0*Bt2=rZPvBP{W~JEz6@ZaVmKou$y>i|0Oeo;wn8{*01$g5h$j=x)Dh_fLKI
zdbA-{Z}-{S7lt#h{?e;hA-42-@h`K>*|SuC)$Y{Uz195taoZ=aJq5ooW$yX5*7Uu^
zk^iCw^)_<<j~o2i_u_Zs0^`}Qs?BfL3vO`bi?e@blCrZ%_I2O1vQ-9!8mrh+<2KLJ
zQ482}HbU`en!Eju7TvA8U5eYvh5kjBC#*g7&s8;rll!2p<h&nGR4hJ9ac!M)tl{jg
zb8c_#Uq$I;^W8abb?5y2ud)Y@6`hehY;O36{mizdeXZ9%b#2mVHYvJ(ZhG7S{)5wP
zck`Q+?NVdN=e)mc&(amsE<aW|vOs4Sf6SUw(ILtW?9$WRG=iEh`|*}v{J89j&qKLW
ziI?~O=2cGb|Mce9-8YXv|4c0~tp1+!zd+)B;H%w%N1pCmbo1)h_R8p^o1WUng<Sh{
zPbBbqm0{GYsF&Uet)_FYzgj97@^p{e!EZmVy)>1QZ(DY;{qMw@AC__l?|-;8`@!{(
z+x6%4bKIC^w<=u3sHJAnY$@UA!htK+1pHjGYwcvwWxR>zhH^Kyhy9vALGs?V;-(!p
zC*BUZv()9N&qU*2Q~FNK^^jfaZNj6fmvg{aVTL?U<Ox~T^mG^H_ivU@+vhRmX!GwG
z>n-Z89bZw)YIwUyF|+#8o7%ozZ1bi?z5Bns>VLWQsehLn;vTQR&FRIz^+1Et36=Y=
zx<z+MZ3ulQwdwiAv$~UFa`let%v{R#{RUs-4pZ-~p1pUC_HNAC`ZFc*--V28t6l52
z7fwq^-o5<liTZi(YKp3Ey<t$9a(Lg*Cng^wlh^8B4BmWDD>46rIBHR>>k-cs#mvB9
z#le7Ut$227Wm#g5UP0y5(CF;j1|oIe*9&|(Xr`hhT_Wy$+--W^!q==)$J{jBHuejz
z?MqSFnH%=&etBPhq2B8mazc^6&RO2y`Kse?O#MH@KWf4OVr`Q}rc9p6BD~SR)nl4L
z%~|(*g4S1$-a2vg(#GqH!}Hm{{GR7K{ea$qtfN6Y+GE7Er=;;6IrZ6Sakx(3=1WuA
z9?duzy0ACdN%L*X<fzE=+2^+8mgmKKY)v?{DRXh-_NK?~?L2|+oR+8ZF^B#44_PLi
z!X7KQH0Ipx;*~Np4l(>Y*V-z!?90z)18!@D%@dBbZZoV^Uf<*U^UL$E7IuHF>}==9
z)OFglWyi;_&faACO7ZsXS+971@y?t6<WN)@-|Om$*ToO^<tIJ~^-`Oj9{y&@^Na`g
zLzDhB{8X;1Ipe-#v)`Fiy?W;=r}q3025X)MpD<t!@)SSb*lHuaVOG_VKXQroYxXWq
zJ<a4J@X2qD7>7AS$l>q@)2z1c(FrQitaz1|`E#e(O8KiExA=Fxe%^M&-CK3Sl`OLm
zPMLHe<{*ykJ#+hn*Bb3~h&|Vm^Mi5or%1KDw)s!C@4PEuo^bk(Yc)sD{maGeMQO6R
z6Kf~roh)I@I{u`g(W|8EXvL%HdeZwoJFhyG6TR!y7BijcT&ulgcP(pu`b7RGi^79M
zp0zIPS2QNgv{TAGl(cf`2Z;qGKf+g@s^FdPYAd>(U9~Es@8d+*f{4#?OMZEGikc~i
zB`sfhVk!3@VV&dQ?OzWjGqon)ca1xALn1ehi@8rB^pK;&+~<;p89#&jCZ3*W-FtHN
z>{D_}^VPq(dCXyZyXC=E73pxN8(ogi=5ww&I>qwr3Zt8s%Q|h`-*C>m9k+Vt!!^OY
zN0(i?tr%RN%Rg(|+|_yqFR+GQEvq?qp-Q6ct>c1a-79MuX74Z$5111Y#O!lgseR`D
zrO!{@NhrB;Xus@+-R)vKGpB0)Uvh2x{}+bcjcONfW&}rHI`%o}8Q=PIE_vpjhZju`
z(^|4hh~v$=_}epIWWL-s!|3$w^|~e>H^iJ-d(NBPaOqMmpL&DhfbW+wT<;!OtLMv9
zsC9Db^oA5|)tL2N7glDR-?MGbnNRUitNw4et1Z^UzprKPZfmtNQ?nxqtDh-b%}>&O
zGd)iA`s~FlA6Hal%<^_z?^5uCbHSPK_m|A_UtIQjV^(~NJ!+nmSZJ5MgOP!uhnayv
z7JIKRH$SB$wYWsDpt3aRVAdT2kv*@q<(?!+?@{CZl9b_bGf#SQ%I*oaTUwH)eEl4?
zR+rP$Z`QPb)hefNg?g-N)_J-2VozEP)Arf^_r<Q~w8uPNlr=&6no)>q&6JYs4<D_u
zP*vX`^2u{!ZTf>ZU+z}lDC00+!P?Fyzd^icgN1<yyHk`Z+ltp^CW{a4Vl(qt$P;j`
zbzvLlx|202^Hd&JFOb@1yoTd$c1_G*v#`l;_Y0oAk<9lm`eWFcv#gKVriNrZuU=)?
zuyaS%lC1T`yKiy4oz}8JY}?UqztckX^}|oE&icDlCE>Vt-1)-n)})Z$&PSyVp~n~h
zUodCSA>T*;)Zg{+o$$P{KJx9B$^~5ln_jQnwrzn~T;Q);6V|8*M{fQ1N7T;c-I9|E
zQppQFpIJ-g<SO(S2VY-#Y~NYMNnyu68Ar@H998h;*^Y(oomywR4)fmJnDSnW&17yy
ziQ%bZyQclK4Y}*FWK&3Kd#(PYOU#QF|GDrd|5}ycA@1D*2^AhK^X@N-jY^e?<>L#w
zbzuEWv+{%2<t-~#pT6<ke4b6=l9Nl7KPF!KSuU?8l&({lG)KAT+Z+C6_by&flQaJE
z{r0I96*6nx)1F8oqMT>t*NDBL{@)fTGcbIZ!oVPpJ<1ER)06Y_(lXOQGwQZ~i*K7v
z+y8t01GQ@BOfBQQTkqax`t5zTI@<rP$@Cp>-|moVQ&OCr-SuSBl-#-3|Nq|0&%ojl
zAn$o=?oR8}V-r0dJbd`@VeLc4iZ^?!KY!Zacm7huldTqZzApEcoDK;Iejh1$H2l$z
z%z~mXH>v}t%+}hwCu`4g_4)Osf4)3<8T|f_SA~7Yt`mD*?sTlt2oJcK?XtznDk|*g
zDel8hcSVLP@$4-L6$^drS{Y{&I9aUntm`AC(=I;zAv0Zc7MEUA$-GlAQzdJWMfa<y
zEvZ+O^#a|_hECJFa@+jEGwF&Fm3r~5zpmw+GTHxS(Jkxg7Hq37Wf%T_wT@AXLC;>~
zq?NF6|9|_l(_NPv?61&XQ2z6L;5M;Od-XO%ERVcYJEJ4$iNiw+(bDgCxi~p%U)Y}S
z^8UI;L)Xdn|I06L{(LF@@##zMkH@n=UzU&GAFO(ITGOXrMtYx8t5&`&uKn30w<qMN
z+2n5zGw*d|NgmzhuW6^D%~;Q@uz;gc_fhte#Vy~B{yaQB-G1&~uKK#K-((jF*8M+y
z#JcwHyFWK?N-k{QUtjm_+n1Z4H;4cERywh}nBiGQir`hJ#(!ZhCmandgulv8Smz>R
zswBCBdvAZYR#unSWUi`fE}42-IYP&aAJx`Nhfe<^YCW~(`i})+`%f+6`}qB0;I1#{
znm_N~S1G#h$GfZD@BQQdr&c{V*e;dc#?|^r=B|?2lsztTdEDhUp39zLN!*ird{57+
zsE}vci@R4{$^6}MyW-og^$$;n=kJkx@H?3AL`+0Z0-xE&^ba!s=Q-=UHotJX|9aUh
z;We8tKY!2T5c5wbcE-~c3TK_(>oa9=@BR6&Y>Bnqydus&cRILM8nZUo3kkd5Y|Z1g
zuiPSZIDdMkT0u&?x5}cv)l=el#iPP+iUeNgfAv+#bG20VoTa77(~ntBcC=@UTg=fU
zxqD_+_o5SDl4l$W4Po3{s%xq9xo+ZyHJ79p+$y-}^`~}j7@L8qLPM97Ysz91JLLsc
z8TVsdr+R!j%;+}bd-SV^UuJKe@vKxhHIhSlLu$-n(X&$niY_pyCR9mGNHhxzl+fS&
zqA1}*Uc<kOO38<mHXBLIjxOp{^l1KjikaW->A|JnbDzJ^sQLUi-f70ne8)-qs?2j;
zZ?tx+S*z8j@7dP#rn~g6i1sw$b?M6)e&pHBZ{Bl3qIbpOeQBljPW)9x6;l}R3FmJS
zP4+c;p8o#b8|Jk2`}&Uact>e%?za4YY~Pa8XW#6J>OOffg73!d@c%zAzr20-@z(zv
zc+Tlw7g*7`_c}+7319W(XB=J?i6QM5-mQrEll$tR{05fe_dZ@f@qSJ6#TU$>)32Gh
zeu_v4oW=iGd0JFPV`6B-58rIjO<}(rO)h#@sEG!ycAdiKacS3?MZPC)x!a!YvPg1O
z5-t27leJe*DD0ZU{TLOUZ;kivyG80QD9!t{)N$H-moToIg0FICJj)brTO5_*{f4D8
z^03&93aN>l5-q+hvYS*JUtOB>qQ&jXmaAzDW(q4B!q)b3|K(~tEdA$v-NIQ-(_gKQ
zT@a)1G~?7-1J}<CGv6lN)92tx_l^y>3^1y8Ix^{ZLrF)qyXHzalOxm5EZ1#3-(235
zom_fYyfHBQnArxMv+EDvUd?nR*!j}J^>g_qXr1dcD=$5CMIuvfGv{KNjt9rJ1Py9K
z%`*b3*SkGdK07^->DfA&#FMkHUC>y4<Y19%=&S`_8R{!JCj1oe-k{PIamDoT(;|z%
z$MfzrW$~Q-z2@_yjqG81e%k9bKWLvhA)RO)?5Fm{Znj{Op54LnKWm-YkIs;H?I@7u
z^++h`Trlfxu;X6I8DhI8?|pb=`6lsee|}zJyE{R}sQsWCTVh-NE}s=vU;SNgFL{%<
z=cXi|{!(U^xgCdHs#Y|td&8-@!(UZ+j&12zcAM}F3x<TmSv|)RRBwOUr`suiZRxc7
z#Wx~CcNiQzd$#ODu7c@fvlSBOIDCHn5UQ^~^j^$$+JZ^yxu)|f{^f>LtKMQX`8!+t
z;m^ZubN+io&*|Tjy>X}Rsw2!r>oiS58D=kJ*y-6_`u3=T!}dc>&#r7>`q;o0?&=iR
z-67Pnm1XDciqyd6Z+7OeE}OuyVDZ1rDxROcSD$uqxGX1`zcE~Jt9$;^#P1vef{{%z
z7a3|VNu5!Bk-q4#O7zF5j@2A510Aof_?Q>0;8i2~bUM>b)lU{p%VmD7UC^K+!pF16
zeC7cOK95|kT?c0@E!``2LZjt@nZ^khiRdoPuot>5;&(+dl_q?-$0pcoc<gb$V!zRY
zG?$RC**P1xrG)hqHuxDm+iZF>*YXRW2Hzp)KW3Xw7{uJteDd4QT{3$M*F?P&(x#i{
zo4lF0GE3vyDy4S}9gAesE^k^9V5bnfwN>G5$+V(xK5YjNGZx-_bopMymcrc(r{bGh
zx2!vQ;`+i94rg^XOUt}D)%_>p+tgU5Ifm*7r`L1&J&4YJ!uGX_u~v2Y!tNI<x}Uyq
zZh7Zto?%mFl*qE|RM^4S3KH3~WKXd)e2d<4+`7Z-$?A(@J7qQ8Pqe8TDa1_A>kHV(
zT)8r1+EJ;fvOV%{!QNHrvaeX8*p}T~_j*FqR-IqAR!`Ex+0q+=X7N8U+>vvv+xggm
zyN2b<C7QV(-;_C-wTPujSY6>&#S7^Z;eWQdPj8PYeH7fXqx4O{cexvE>lTMB5ZIl&
zvhj18aX@0Y=!=WD?yo)?^`$#Bkjv!4r0$UOt9M6C$q8Sv!+rI?jjJb$ES{Web>ip5
zjca&UoOpKXa?_g#|FAB78J@D2%_4aVGp+KLe3)G^z2TefpC8U&A8cQ&t1NH!_~tW{
z-{wK>mUkX2a_{&$!K83zhL>dl<7JLx&t&3O=0yKqv8iy{lI4|i)(U?Vx_3t1NaQ{@
z%V8T8z4wc|ZfU!oT(uy&rT@C9P0KCKleYgXH>q<wDXeZftubeAF+*F;Gttt9`%U{r
zGwqTl9Qes>e8-V*&R6A@3t^2bkJy^0Z|^-2mJw6=W<&gm$8Q*=K4hrNRb)p>m5UjF
zP|ltFxpZb{e^0cWh~K;!YqI_toKb#h^!<!@%{`%=b5+8g*Z0TW5W9YFS!8rUdc^4s
zk5-ib&*%E<w(P<~t#@jt^c?fle!txDpZnT$SLdh$+cJM7&YheZk$CN$(T|&nhAgRP
ztYUV}n;Ox@)y!wm^3r$KnuAB5o2`hD{gJop<|DSRD;`;LNhF6I%m_al#=d%2;YO{6
zS97mcK6=pMczB^_wv?%?)We0350pM%xFdT*(pnLwKj&W`obsq)vFrNuGKK5CEvFSO
zZ0?_0e?scJa?g$axqSOC3t0YsGGXmnk(Dnu%FOrmSjlGFBUi1@Z6tlFbXuf|(%u6G
zw_2F<86OGD6!M(RIba~h*KlJ((JA3Jr=ok#ry2w$DrEKs^(-`I-?Mr}*@43^{O77Y
z*rYSvqO@zN`a6RRHiZYW5q3T&I?Jo49t+Q4KbXv};L~{0knc*{8V0c$=Z+ig=6oFA
zkgv06deTHUOTX9$&iSDh*0*9DC&q9vbt*T0S<UQzvfQa6+&B2zWp#hC*Qc!_!Xno0
z%j+`ISan+cYiObLq1g)ieEuu@rp=#U^Y!X}ySt0#O?b_tXp`V1XVI-TOYo-Fo$R>Y
zZ{Z*KbibW{E6{&VlTFlB)#A;{nN#PQ8kpakzcBL4y~73hx2~9+y2qs>o1nsOF|GQ5
zHLFQ~Lw@i)gSgi(HC-JqUW#cDDmff=ea0C_xn#yOl{IH>e67q`{)BCz%5;hHC5AWT
zV{b++wUKC1{msA1R^gM*F{O#eQ|`}C{O)t5U=_RQXOC>5?-p*8Oq_ouwLe|3!?#^3
z>D(rVwj;+vv>!}UYTINu{jY(5`PNs8!PZPG-PZ9Q^WOjK^S+Nkf8JP5=I2=XmiOa_
z8|OCp7hGVOvHj)U$MIRJ9GQ};Jn~kJ@}c5;|L1LCZBMZ{a_IH;ZJM?(BU$Ed@W^+v
zuKiS27tPK4&gSe+Th_ao9D9#;`9GL+TREMJ_3Z+_wS_lI&t^D3?>&8I%j8^{g9@G*
zbE^}UnLOy3?lgDNvfRddmwqL`U)yp0!Nofq22B^r9F{hIF<q;1`fJ{ek7mctzdD!f
zUuoGUYGxFY;GWnUxm<^3)74c6RMMqoZkW8S@ZYnHsj=}^W~=AhuTnf3S6a8V9ZWSB
zDO>4sRQ0J`_4{6-_XkUKu0>Az-8+jd<706D;+o4b3%|B~3wy$FCDCxrqnUS(X!kBz
zyLORnz~49PmzhS`&FDYAV^xoAWbP?n`<U!iNv`QR*VitHIpl5l_{E}`{p>T2&Rh4l
z;=UY*&9`|^B}&>JGNrkmb~`Isp2y?I{QSwQ?Rn{k=CBurm@DrWHfDL6bkMM8vt6u-
z?>F{qqKjvV=@`%UpB`|Lv)<|n_pe9`@g=oc{!w!-?Wxe~Imo-`d3IHZd5&rjQ!``W
z!6fw)GMh5*_ic5Mc1W7D)Z&MOu$H4=|JxrES9KTVdpu)d+w;Cv!*PYnN7GeT>{eHm
zHtsmWuuf?8BexB27PdxzIKkr~(Y1Es{lcAc0hh!obq_u=;)<%vRhH{ET7QfoYVx|4
zPD!i8J1H~Pcz@t?@JKtF8=az{>K`fBD_XKW)yw~EU;FYD_u1y#3g4OPRZGvirM6|>
znQKkGqUp(c=0Z-pS9Vv;J;Kwwdvn8@RkE$0q^9s}UjNYRu)@^L8eXe{#y;+fXT2*<
zYrNB#c3i`Q`+fHN&kt7iPwmRS#P#D#_E(-Y>+{yCT7`G7m{h8^>ynG@o6uLO`Ed%F
z&kpYLF|a@0=bW|b+w}a@ce)p^MBSQjbN;ngm+!>oX?Z<)&i((j<g6S2{p$Za)TjRu
z|6k+#{?AU|=bIF6t1uMux)t2?jyUi=zFM8nd&buM+CrmNqvEJe?Te=C^dEc=v40V@
z)--=(mM5cZgsVgMG>#uzmo}f<`AqT9bP2^KzO#1h{!MdD_D+6db}F&#ur+^totBp3
zYNy>V)`$4^3NdAxdWdAaG(O*6KR<A5x6hN1x_hc@``!j7X<Q7@?~M{!>9Y6SEZNrv
zB0v3$*V~`Z(^y<^Ej^hh|HRS%|BCi4X;)ry_C>;niO(9BF&{K<m-^qsX(<&LQ>UqA
zp#9P{SLNfw^aGNcZ@&r@Z=ZDCW#<yZ|2~bqD=b4_TRZ-Xp5<X$CE6I(Y2?FyqhW%$
zrOip<E72#Kb7oX&nd^AI_<5}FQ>XQ%wZY1BXLqdsJa6aIc#p}AasQ>;nlp}aX1=>W
zk!O;FkgTceQTJZqw!*+=Q#w-_uG~7^wfto$vjl6Q_*#cMTMqT=$h`RdVx4J5kLbz!
zD!yNAELd|}1Uvn9%}lX!w!X*v^SiW<)t7hQ9>_CPY|j^3#d|ky=WgR`Z_oIgRJ>AB
zSbQS><AP5T&#g2%f|sfNo8;3Q!f=$`Z|WnLqkP{^EW9@@zwW%Ci}lrIG7F@#`a*99
zonf*{Y}$ENR%$U*);A0HWtaI<{mV}8_}Or;!1q+FM{c4zXZ|5`_HzcpQ+2yudG`8A
zhN`$~q`b~N?Cms3u4o$Tv^{wy=I@G5ttrgY>HEca$HOQ4?E1{7Oix%k_Goo`nPn$v
z9X;f{w9!cQY-V@-y$?b@O>sw$Fno*4p8oxPsF%l+yDpJkGqqIHeu(8NzL%euxaHja
z+24wGo-AOp5B&YDGige#_kQ)Poh^3~L~>QG6m0!$#2%QXd&uUSOQ`7D(*I{G9cpzJ
zoy&=Mw%9s)@~W1}aSX?O%D*-#D16+h>6m8B<ler`&AOw^)V+1Z-o=a&HubSP)kDgo
zxp%KB^L@YljbmdOOFYAx8&bS)d5TX}PUc>E;84cGZvJ?oz*04ym#L?@0_W7W&#8TG
zATvdMc1Lo?_2}o<D+_0zevsjNPkC8%@|&sCUM%S0+O+6#+1nY{`w!l*jtf)h%<q0B
zwYE{*pzi!N&!`9e|5nSpOmh3ThrJ_!^QxK>LsZeE1&cNGFE$&u&Ye*xC*bvd-?K%>
z_gl3J`mM9Rd_(5vamj@>&-%BA?s@F<;?9wZjD-gei8$WUN=`V)C@yg6j$%~hg{i^S
z&qWr-9Gen&e<I`6Ur$n}G9{ZzKU=l3tG{Xb_Ejf$vS0S%t}J=ydr;|m?MD49ex|D%
zwJLVJx>k7ZYu^INv*xdFepqL)`o#w`qrJJu*DRFFyP20NUUu+!C)cvY*Hk@Rw@HMS
zEY>^lWcR^h2a~U23p%c}S@adncoMK+if>lp^6eKhuaq28%{RK5>A0u7<cj?+m$`cj
ze*L;F&lphM*Ez9i{WL2%=W@e)i%nK;JadzcMdRU7>*>3_4^$ldASC5p!_dOAWZU}W
zDIGpPML#5RJzMvE9{*a2-uu^O=4>jT^@!2vXRqkh3*GkXKh55vRW!xHe)ZdrTKZG8
z+Mk8p6z|}hvb*5jtfN)m`Q0)u-kJ3JRD107MN$u=Ch1(4)Ve1UvRdQFUQ_8>SI_!W
zORv5UduT7QPiV(y-XQBeT3y*MXXq_U%Q+=`NAZHsfrl!WT6Gei9{H$je924FAR~D7
z+y1)>ub2BxDA7|}|H@nPvsQA-o<@b%w<}W4EloVV!z{jJdYd6<K;DF~%zdveYAE|N
z87`bZSEt2Km&>wqciNIw{rY}6e_Oj4=gsb77dQFaSj$;-`rA?Q%R9YqM9T@Ze$FUd
zrsq1xZKkJAROhlgdj)uUQme$9J`}#aHhHO!xGakdTT1qN5!Q3hqcab^+Mp-FcSYW>
zfBC<P84??J9{s9u`N-8wyTF>MPJ$oSn`^L1Z{6*g)UHt5XPxL=^mevJ($R|>*QN&k
zXe^(#`HJJr9`EE9QGE-};2Dk6j&o()XjrsXE9QqO=Tuf9W}inXJTsJbx1CX%Z<?Ux
zdz7bnvq#In`%46mKK~gbFZ=0w$*H`>y*oWRFF5|v`)II$FH>z-alpl^=GDh|(iWsL
zCNJJuXK&Xin841{&JesSq~U3iZ0G?ar?y#w*)w&+UyAx)lDT#vY0H&GQbAs21x{XW
z4xu_5*0H`%$g%dW)_$6INU%dhQcOD4sP?LP1@D5D$90O1?QK}~CR<zk=N~aqZ`Y^y
z3;$m=OzF#5v@`y__}qdn!)5!|cefdFlwQ%y{gJ4<T&(xJ@<};QMUN-h85!xXb+x)4
z_TJE4w=tq_LnoK(k(7qso#%G58VlM)eGm=Y<tZ~S<4KQOh};6k-f281Rz{qdr^@pn
z+;Xk5)ej#2GUmrSPV9|OIM99jRu7-tjEe6^FHhEI`!V;}3fXDr?kwG|kp1$%!m5uf
z8@{ZQk9huls)q54+b52{NPqhO)z4*8v98yd-kjsP@~HQbK-!jRt|C%3yZU!B9{alQ
zypxy9%YQvTIujRuI3~2X<(BRuuZE5-oeZCQRu`Of_^O!GC0F72(?U+R{yW!U=4i*6
zd@VL>`JInxe4ZFJV|T;FIj*rO*?wt8W=A(%JY;>~ul+q^HU7Ht47X#}4+7f^&5mE%
zQgTC#d#kO_qP){Lb>?(jvVV};Ut@9IGWpr9dwCq!ex|9!UP(-w{H<W?Uk6FEt0@mA
zY_?qxp&okjt;sPbskQUoGNwJau%@4J#q^zTCC)A>PMTe}kNxO6{nd*y_-@P*TU@Wg
zAF$w#^+hW~qtH3r5uZ{yrwMUrEpom4nYVk>!@c*7-#_XzpZUV0|FOo22T?g$HcJ;~
zGi4c-EDAJ|cl5K?{CAM+M9@T^2j<T<#Ko<gxwFfxh<6#YTUv;6R`>(|u2(aRPW`?a
zyw2`F^Bv>()hYX3Pu9Pfbz#bywTD^eoC%j^=eAT*@7uP+obAi;3&93Di%cuHUR*6G
z^6j&BG-;PwFyTke#~0gm_f9M`TxaiGywK|U0_j=ob`j4xZ@As=KIm=w%PcxUS8~tm
zeTNKpu>EZC*mk1+*_;yDSPf}ssaX4x`zybFczd?_>YS7yrS2!;(k3>n91X98TE70>
ztMlc<hX>{C7N^V?TUTpJtnQ0mmmes3gYA;i;wqB~_pD9W*w^LROyg#V7syKZdx?qF
zcZqwKw47!3DdmuiRT3#v5|1@n8h$kS&zD~%^~fpx`V5KN&z49T1h3k0GJWwC>pi8{
zcM4cdYdPFo$MvIK?u)3*tVL&w{#_0}Q*=-F(ADL$Ie8t<6)L*@R+w9<uRQC)k!Ng)
zeEEiP&Dv}%r@CEkbb73NSU4%Kf3u0m27li@c2~a$YOi}Y^RMyOjk+AycyG5~TlZ?;
zHWhKxC2OzQ9cAg~olvJA-&FKl)upig<2%9aPXq)5@=AMud!=x$cDTQ<EW4;T-dryv
zyzu&;GNu*XrJ~(>E&C>1WO?1pc-tWB(dr9ZHs7rcP}kG?-E8onc&Yna!@@7Wt2aun
zthATw|E=kLN$b_b(0v@b_gm(FHJ3Y~7+h-L8)?bdJo|gpk4??~SB%@&EZY*UrP{hO
zZ&lBP^!AWL-(=<UOVp;Y+>;AudF=B0E*IaA6W`nCaW~4(KjLS7{-E^X%y!}GYYjj6
z>^NR+>bJR3{e70s+TC9s+*)|)x#pK$CzdmOt9B4oTrR&LdRyH~7vXyeOH<V=yo?$o
zW8IT(U0`$L<0{zi<}G<}=g}<>ZS)H4ADxLeKmFMLcXG@$jT1*V7TiB=b+A9zqGapC
zk9@(0R`gzUwybZvYMdw)Fva!kwwr$suiv@;Q0Sa$t!Cd#?D98q>~m&3V9(Gxzwt*v
zrh@e~VYcSKJL@<6R$@F6>$xg;+jYH*B^)xv*ITT19eaD`i$G%Jp4JU92QFr0n=}7^
zV=||j*SY$yvwM}<Pd<fMqquU8ipxiD=R8T6Gu>{+A7g_z)jRUv&*Xh<%4+`ZWY`<g
zqY~CW$;vAX%hLDXGKin$IH7v+w*>CjTDQ4B`RAW!P?~b@-pi%`H+OBlb9#mMex`Ni
zkJl`EoP1E#^s?{P%eU<H9h25%y>I;%U2F4a@2c;LKfZ*Yv=>|GFkfjutKrQCKF7Bg
zoBl8A4UY^y6t1~Kcgx1ajz{c=>#Sb2D>9wCEfJZ1C}7dKcQT%T)?}3|zVdTwmf*90
zPx!Ag=e2%+XMa5Z!9@0Z+&ixXR{wKw<J71Y4P5BjA0pS*zO!@xuj4oWUT%-Cz1JC5
z*<tRNYsFJ6@!+p`heNuc{fpT==~j=I%};Nhq*6RzH<@Sg-W5;IiHFMjojWt<{dVmQ
z=UN%l7NrKJ)ZXD`Vc$DJH&-H!^UovK!cBX`18a0YwM<d%-xa6oe7kf?ZeaiI>W=va
zM{Cq7vqaziGA)p@m~yDMc1GNs3yMVyLG#78_j;w38gObdY?Zxv&_q>uRr1k`ce0#!
z-RaLhb^I*TR-GMBWv1IDFn^Byv)t~;SBu8})xX=-zw<MfG5+0fy?Bakwn<kt*Jg*p
zgWnvL#2z%Pc71oS;S9sI`aRDdoIgCdp7GY-?u-B23+}6{yuRsv`Ahl2$1|5b-eAlc
z@{sFNYf9(Nxe_sMPj6pX|MqX<K@V2;)2Wx@lZ3Y2v@+P}Ap13T*}L{j0@tS8kUV*q
zV^7syl}pjtpK>eqZ`ZlselvF2|BOt9%^?z->!x{q-+bT8-udv<e~qpG=H8Gi`@&+y
zqjF8<@*CY-GX$rt_{tfY;IsW}j!wgyWb2ET8q8^vPaABKF8JZ5E0%RNHQt2h_XmfP
z5^vkzdCxs7g<h}S)?g<*DXKVj%L5rJuFY<y`tu$>+kS27+y`BzyQlNt{hRm9{nxW;
zORn_oYUy3>EA??^;<aAghs<kAs`@|3TZ!$6md}t{k^1_eC^uIjOY|aXGr5Li^6zhd
z?bb89y|JjdWb*3!0&HSdU$V}>-?d?ZPGxK6%AF0|-+r9%cxS61^wFv4WyAMFo%_1B
z?%()+QSs3~m7Z+(&*^=$KkYfs`$KQ#=h$k4&drj4ua(}8SIFz)363q;e45Aq^*<$x
zkG;xotfw=+dj2-ob>Fu;3%s4Ti!9_dGSnB}q$eh2{cu&|$D95ct50uX==~fXf6HRF
z!L5kq_3ylb%q9BnhMw_0VYkDbtt{S7_K2Ts(oOf=L(%OY^o~S|trhcpa@Y6Z)gw<z
zm)<M(Uvnx=d3(c;EwTP-cH5TwSl@Pi`lWiiX6hyNXA?_Xf7?A#O^LZEuduD>cTOtv
z=T+XOrV}DIyIZfTtxnnWc>hi2ef$^t*|u;m*Z&!y`A7CsTl-DhdwnKLm6w0$_}4D0
zyOrnfPsa^!PQP!P7yUPL{ruqVQomvwUKMR?JZ`q*oopwU6nC)kK9f0a*RE%4R4+fq
zdHUE+zV_66=jU<;>D*a<Omwcuy;pY=ZoksCWWKVIv+8J|-oI7P_kOyqS7P!#dq(ND
zySFVvj#q|fZ2!RJ!pu|ud_j*hr&UYS6sIlTx*yigE|_pjTwT^V|G(-VC#CFr+KbH|
z+!RmDvAyhDCND7MM~U;oS(7Si%*6SsHZmXA_`1VU*4|+0XLdHnn+r8VbJlBws~cUt
z`7C`;QyyQdri{(4*s?cFo65X2EoyIzY<R3$wlMUt%wd7QwifM%PP0!dE?>Ck+zSD<
z1sq$se@(HtdZ)*s`$NrHq1@L+Y|b_8!9@=q$T^?g%RRkq-LJq&CNK32q>rdPPU2Rr
zY>bOlbx=EQyfyGD50k-yeV<p|GW6Z;e{l}y`I5lWs_ScVqav5>UA^U3UyJjn8^u)<
zML(9#wysLNxA&E$$-^VBUmI6kGmPH4H`QFNeDCLbd<i;d?&@9Zy>+KC(4v&rWZpd8
zcRg=4glpxr?!6MfxJ~}c&BCp!k8^(>2&mw%JzA~1Te-cnaZ=0m;<(o?@n=;IRNT7l
z_fGD@LuIx20w?#FHDU=V+YYOrUwbQ|?)cuDY1il8b$+r#xM_ptq$XL(B@4IPEU@tG
z7g9eIwPw-kt-tOlZeUw7qxPZCaia?pmdd^Ki@lyw#=PZ<>;D_}Gff=Y_C9`L_w>Jn
zM#l6LPKRr5xgK>o7*@f&D5;yL@cSi=WzkIM4`(p`6*$iO#I5t1_q^HCd+x80HcEW8
zpvd(5)01cKzD+E(Sjn_^X86e@=BU_&Cx@+Ei%pizJzFExUs|B`PGLFs?TV_$2WOVd
z%TH!dS(%h@;a#lp#9VXLt*W=@ZU2-bcf@t4;TjeRuGIID!2#i%4O1JIyQvF@UYK&G
zLgCAqjhmaFKX>^&-D~%S^6&_SoT8V@Vq3pl?Ap68Gtfq!!SD39RkQZpz8M*Hf7wml
zeOm=9vnQ-de%ZX!)3j81x25B*?OV%DX74+4m+#0*SN8C%#eTk*4t{>HYK3P&)4I2_
z`B%+2&9bF>h1aKNaobKiSqr4qy{o;uGV`{u&xvQflT_-L%N>(;kkh#~{S~{#RbS;-
zY<0m$UOLYEa`oYX16Fq~*v)NOxA2-=Wyj}omi;#(-^GdK%avcc?{xX@anI>5)lv+$
zSUxjaednCncHIUu{Zp0yI`#zge!Eh*Ojt?!0;BM{J$^IUs*<Z0Jxf1O^vq(?x$<ke
zO^-~Hm;8HvaJpZ2rMuQ=hIzN77Q9&RCz_H}=i&77Qh2&_MZZPnE5XxgY%e>eyk-no
z_+g^s=f0h*x9hFa)pEDhnBnvKfl;o=ilSv_3XaSzYbd<3p@nPx$%pR*mR>rzndj7v
z9d{>9_Sh&p)9;p{9Z&ITv-TeGWdT79bEnyBiJ2y4%0Bvb+4b!{HUGz{kri5pi@FnT
zTQf)d`K)-%U$I;^MI=+Fr=~bHi@#!uW3JFcEwA<0|Jw*XSST79==H{4QuQ1A>$rKp
z&RXfG8kYY%yn9uV3|oW5%BNAh(j7mKRqxq0W6Pg2oSsY7cyiX~e!sLz_xx9vEbhZL
z%iga2owsS?u86fSq-RH|udTT)KEv6`cbBxs_f}Q+lx41GE-l*pnD2a-iiW%7hXb<$
zt9j0C_psZk_T--Xr939b>w(M6&y?Q#d*qRTnN!TKfRiWHcFp;?#lWq+-tm2e=Z}zG
z$pSyhY?Jb2HkF+E?>5c!msYrt==XD1#9wRt+@<%(B+KP~^O6Skqa{`14_M{~`|>md
z)Wm-N7r`@);cnKh35y<9Uw<0<PU=yM-|Zv56;=#Vk{53Iq|d*URaJRxU*(sFpEcZ;
zd7hADxScmKEpzkCM-RoaEBkHcJ%2iTI`^-NKP*Yd?rmaR`_;8~_x+bY^nJBvcrwb*
zohMSWKJ?0kpItMiuw1^^z;@)o4u+d$H{1MvOkRFXLVVk6>2+%sN6*pA`@P3DDO647
z=DDo+)SK`1cO?{jbe5g-w5&5~e*|mBHt7p_XERgtf1a;eKEd^_NLq<O0B7P}*NLji
z#TOG_i&>pY^Aoq)>|FV}`CrG(|5NpPm|5*x?(xl%cYE)gdCy)Z=RsLyWWu$1I_}%2
z>3lp;?!q7UO?O7;!!r*8{dQIqhAs(syj%YM-0!Rb?-i!r<5H26xBaO1K)>sga!Jj{
zD_c!YUHX5lRPMlvIiG5^41yo%SMHj7_`{C!O`Y!?D<3cZ&xpFXXTABhy<4Oi7);Y}
zuCXkrEXl|Rot1IcCcF6diHY~WY76{a#gL~Fv2F6%b?>G`**{tHX!@y3c0oMcY$p{v
zML88JI-b4!a)15q=Z$g+4qo5lUWKH3Go)2jRsFKH{d{8go{F!pFWyekx)dZc_q<D#
z>Sq@b^?RRf=II^1c=^MR2NS;=o!;)cDI)CN<;UvxE5p4X?iEg*R%KkM92U8+tu9XW
z(bt0q_nf#ECvx`nDm@pG%9B>-yH0gqHd*~h>*S?R4;=Q+X1cQQyYvCcsz}Q(r&428
zS1%0bxVz}qGtXTg9$nfUG{Kqo!<%AO3+6rLH`l~<E>y3dzx=b$RukXr9j~-zmfTyv
zskLtU)0Wx)z65J_T~|70S+hWY*WD$4Va9h~S)Db@4AHxOQ)kz`BS)FkK5o)mom0!o
zzi89^bC+lSu=x_F!1DKRzLKbGOy|wpOInVfUbSMm#fvvatGib+R2ZCBn&;HbKl%QV
zEluXrPfJLhc$u{&O-Y==Zm!y)GY@OS_MUrH^3ALM_O7VI&a4Hc>Ibx%&Icw%B)&L1
zxkQX}LHWdEt24Gq$Lw1>?SKT=o$ehz%f!FD@?qSevB_0%efzu|$+L-Nk&Hb8C(C$u
zUAXCE;JL6oj$vJEo32XgBBwvA{Th^tI2qPyT=QfVNnSDQ>B(*uJ2i6$wFj%ZUmWh<
zZ{7BwK7G==sw*o@`{g%Z^%2pNIIu^FNpe=4GXHE>&!eI>5>?{z=k?Cp{i_j+wb}p6
zu<A3n&YS-8_Vf03-K(u&?Vrv!L0F-KO+=>R!{jvaNX_(VY58AdOc}p)Pmhc`%2^=Q
z*CS-K<lOU@zI(jV&Ud@^GV$;VK8>7`o~mMfD&5zb>3T`{r;l+tZEx~zpXq2mKItX$
zy!dQ8JF~5-?u076_YPMXs`RHzYAjl)uKKRmfM=R_(DayZx?xrQZ&-y`TJma{Q;ol`
zJG8n!W{#_Vy-oGcXMg_Q_v5H-(iP<~G}jb1W(msrrZqE+W6!S@5pNc}%-qr;a>P3z
zuc>ycDC@~T7pg_W4f7vQic(v<W@+=^^RvTkbz}F=_%=~%+4}V{C2oaNOnup-ITxyY
zd~QBlZo!HDivO-p(u|rrTOx$_uWI|WE%Vkr5_(cnJ#Sj*o~XSyS<+J3)HiYddvc&g
zeZ#p)rH`&=OiEq7@n_7n$&pNMYu9jn)|)7>SSv2VcH!9>{ePvl%$J(`Mts4AMQrXa
zoBwvUOU$^Qt>n|myl~m{<~NS>9$qjiYiRP#?`xc=oqRhmyNc`E?h0$cpqGobR4i{e
z?5}Ae{q^+a3!mq{y2Cz$y;qhcV*9=$N80tYLv}6jd}Q<SeZ=Ms=h79-9j{N|v)G{A
zGVNHlAfx=*$>%vH$(^q1>n~?#_sX{W|6{wiM0LsAvzrg?Zgb7c4CTLau(V^YV`A8k
zTJw}S)1EmV-_l&iy!`qT!5!Y58>}Q`-m5zOvefJN>0<MFlVye5B+<(&73N7+2^;oi
zU-<Ho>%g^cRg=I8LdV)U3cKv2JRY-2HQ#5LzwJqACFcuWg#@GfRfVCVCzq^qI6CEP
zN#~(19`g`|$0clh;u`NoKCEWpN{Pv_H3*ioQ1iYZb5$syW&f3oc_Q~F{1Pvf^4<2p
zA?3AAq@eg~OQy>Urzjof%}jc1Safvml2bls_8R$3&XS&zWXk@WUvz~ktKH=_cHdlY
zTYl*K=XJr4=P>iP4;$AUe8butz$j}{WOrQ5w|J7EgwdJCzKj;Xr^zkr{P}|UI7Aaz
zt{#xL_{GFp{(UNMOl`CYw|5|;>7%MpK~0CmbDJmDD|3ld)bkuOjhmWu;Cc6I*8NgJ
zMlA1K&n_(2-L{0kbHRt%my2B&e0ic`7Zv+x`X%}P1^+9)JV`n8vPVeOeOuaEl?2J>
z3AelwbRPs6@p*7=czeQ6@I!j*y~S5A`-Jvo?`ymt#C<9J@{To3@*lomUE;i?<;%0?
zo%P%q_dHcqLO-n3zw1|@P{_f!Wn<fRp@bkeg<jT*$qzW1g@O<8y1G<7X2@q=eDVk<
z$JTGPPFxGl+4;8~3;o7pdP-&HD_QAN%zNLj%~pN$=yOTv^atm*N%#u(Ei1iXSjq8h
zi}yNP<40dMDa@^^iwU23f6;tXi4VpMs*8-~X(?CPeq$-v@qBvpg|6)X3D-SVo%PJ#
z)s||Up!7rgkFIx+_q<0+j;DL}yw*;&mzy>3>>G!i-HU~0$^KKQEBAT6F#Emrv`Q~Q
z;~Pv8j7$&DSi9V4kDGf)#w&mJ)gzpot8)K*Y8PXlu(3hIua>Pn#z)E1W{b@IB?3Fe
z?=QH?@b2R@rnCKX+9nm`%jOsU@SV7{+b(PKP3AY5)6Pw9U8=;lE6e+&(Tz9V^X=v}
z2C`YGZQ<}JX8O*0N$gbx=MmFge_kG4{keZG-?6g_-it$CuH^sHac|y!>-|iR|NnWk
z=W_3FmAU&qC^2@;`Q?8o{h?t~Rq3~1KmGI9&)Z*7y-j>#!ve!Ay5ddNlN+t)$b7Yo
z^jbUNRKL)MlE5V<`%)H8w)>v*!q8qOYU7K>*IMRQ3yXEQRW9>6a4+aid|7$TVwXx8
z?`@NdYy}xiHEoF*7H1Enwt94~R#UcAGvnDJVC>3gA|~Lcvb1ak)6KSN<qTnxa}Rwr
zyZ@_qd(RAsy9_Hzx3u03`PI5?Zjo?wuSB-%TE4sfZ_laNF55e4X_&CU#I_?puKd!I
zo!)W#&9<y7Q!YBBOm{3_(9Sd|HmYHY`Q;1Y)#kBB5__+m{c^Rt%sF7I<(kEr%jfOp
zo*3ue(Cg)8+I=8?yY*VuJ#%N?cyjGh?LJRYmrHiP)Hj9yu2nh6^Y)&vo7eYbORaQ%
z-(Nv$ET!A8WtYc`DBKk=o&4%{)!TQwyDq!R>boqN?p2z%zx?~W<U{V|3)#zer^W~c
zzg+ffXT9B?t#$9(*FK$b`1<=_$1}b^dVgoHMVMdDJGM(g|1Nl)W3_p*l&y^K+z&R{
zeZgkj9}bl*zw}JP_NUdsIX~{De3|}aek50B!b6?q8@V6nN6fJMa>q>c-tDw%j>ZpK
zw_QrTGMg^1UKDmwVAesoox#(%1P>X!SamMkscn%K^JUMLUPFyrC-~;paJzci`R_8w
z7qD@h-z{mC$`y1wdCGeCTcHw*wcGOKesR^tC0qMS|7hRzTd|d+J?F*YzZV&+ZoU2R
zM*PF4M^pBkaayxky5#6qedCn}7lhrCbg{|2!uy^nN^0-%Q@2$T<ZJe`{*&3o{5tW!
z<hS((Qg;{}K5Y~b+4D_%=NW-J%su`&LGz;?6#VcP+V5|%uV~`qu1O-Q%gR=z=&p&|
zWGTTgwfxlPJ3q3S`S&o*ca{CISiEcf>l<9(ce43j`>D0Spms%@l*t3Fq)o>J6Y5+p
zYluqUS?6##KP4i+py6B;<7qZ4{`a5v7)IZ!;g)A`;F4`-`0rNFUeD}2i_u_Lri@C(
z)y<!cBs|2gb^U%Ku%RZl?doE0uF^BJmRx*$cY&_ZiGNqZZ*@L6IC1l*ioIzbO`5(F
zZ0D#sd93V+ba;Hrch=k<ffZXATA2>+zm_TJf1p%kPD=fpbR*WpgdYrLr>;wssa^m3
zvHx(s;VX%(u$e1VICX5FvBvH&X=ZJ%=5<=Iyfm=EtMgKhn#A!U^{pT8?0E6vLFdo=
zOP1f<u3z|dX8Zld?fSiso&N9(?EAgM#Oi@x&dhSItm}!}tu5PnrX4EjS5RxaKK1L~
zQwO4-u4QJQvTzdDSBn?2Q$GcHs)}d6li$1RMiF;a)$Qg-vEEM?7WgPn-Ftt1OG<Ei
z!%6<ABX?%-%{dj;C^MPwa)XS=v!BctLV9C6R{6)btYXWa5US4?b?ue&tG|<$Y|d%E
zy)t3`6$QC9J>OrwjlQyU($x8_o3CcAxT3iChv@wlF`IxF7o*-ylj@ZDnc3qhBX(S)
z@P=kJmyczV!EuR*T$NpVu0Ar77x@lr=9;wpnD5<tYpt`E;)0IT4buaK)0RoxomqT+
zR=1%rSHk?Y2j;Wi?%s5+P+92v%b&jrj4w%^xFPh?=&Rtt%%TjwX0z3QHi@iUUdEax
z$D_^l{_fNB`t4eUPp02Hdiwa!uw^$7sTLhJnc1+IeHlYZ&$A`v=l}nEnEd12AKO3u
zsruhE4)D)>bmWVa+kzQ&&CZWYx~+Uy#xTA#UMapJzqNewkvN_=ArIWXF5c52{#wG&
z)s1Q6OrE`m510KCoTK1)@~Dvud$H{DOPZ`vqO59ajO{|k{j9kPlY>3>Shbrk-LkYp
zZ69;cnWzUB1=5PM5+jv0MZ%I@FD=@$-O|Wb=V3;7_?$fEyFqMM4@{h*7dPEJc>W&!
zzp|WJ3)-ekXXh;LlDN=5$=c^<`>Er6e+0@kYNxN6=)a&vd(qZzjq{2ok0+N_{Q1}1
zwd>xz{T37V=4GDQozZsZ(R=3Dj;RdaKQtat%~)O{u%P;N@#R~plRIbq+$%0s!`IQt
zz0j#9V(I~P4nCpDk98jIzS?Ix)9v1OJ)iOwc@w@(FubGvL}B_id0yYGrpEcR{B~^=
zt$Fcn#lu<4`uCLX)Sdt9*p^D~2_FtGURh&P_3f>c?`_5082#i9^Hd4**oVtlm_Pse
zbG<xWUEny=_hyFNX;vprA2pe&9(+~#sI1_fL=hWdt~`s1Gr7ypRq=6WsUCgBS)8J3
z&SvuX@y74&yuEQYlKi_;9=fu4h>EdB`<7hV-rKeH<<e@MOIBLjUwdxr%2UXgt<rEr
z?6=hXZ}aE6@~&agRNJ%FC-Xl4*MOLghV(SYP5-KX>HN8u|9Z*Z6$$T>Tl<a}&18)J
zF;{kepGr_>h)TMA$s+;Jl)2p-wR_oej{mOf+v>$^n(Ox^j6ck_>Fk5`yQ?31ZTcZG
zqpxq{BZe()mtHtN?C<N}C;#7gN&I&IHvjiCm}W9=UiVn^#>A{$CY9Cf7YgFmhh5Q1
zkYCHep1Xy0{Z_$O=OoT<J>MMH%hw}x^VJdSJ*kWD%C>zA%h&%Mv9ara{P{!6-^RYL
zy|E{CUl_YKx2FCD$tA9gjJwu(H5#(Vx4ez7o$%6({}11d@W^MnlaFp{-Y0i@cW!@`
z`GaXai{~!2P%z+O7L{tf>QgQIf12o)oq?=(|1H=baarZ=)hm~BylVbFKEGZ4xWE1V
zlmGi49_Lrx&t~!|!0G9xo0I=eJhWo+nl;z@S=M{no4!ssZY}G($j&vwSLmdMhZ9eQ
z*W8H1SB#nG<W1Zh;w*S-zRqIF3>!(uh`Mg&#5tTMO=TvnT<au{B!x_MFIKM?eYvoA
zuA<4&QY~@ki`NfaOnLHpRYuUoDYHz@E=#Zwx^r7gI(5ma4b8E6mnY~SpU}HZDAb!V
zD>kg1H_GL;w&L|p)48u-$<E}z_TaqObH&q>uGd6fkl1iwt?zGnnW<;K?Atqe^Wt}R
ze#^hVCjOdJr`@aJ--UHE%9cyqta~W%xv73y<-v(e%T#`|2eak5Y*21o%PV+``D5wB
zwdcRt)u>J1cjtS>(K6lHty5EGCi3>K<C=Hc^I+5N?$6BK@w1LB)0O1fpes}nq1;l>
zcsxxbzB$;)cuvdjKTk`U<{3%|wobSju=j9Tl}7p3knapfZEu!d&pT~9=}GS0r7sqF
zde+VV!u(Ix@^hcf7ITfWZX6u5_ZK@~+8LX{R?Ov4{d>1(?(0{I-<I8UHhFKgT<45<
z*p9<q2X|k!UMBLw;?K7kS&bXYH#5Gx*IE9~UTfp!&}*?wy~iK#-C3=?e2qrjY0Y&9
zI@b!#49W|i*H^*Nkj6AQKj(JV!JwWwF3GnHf;Y+>IC6KJ+O5E&n!A*z7WY;LEWU4Y
z%zxVdnO&3JBu%1oc5lD8V!_VMJ8xZlDLeD&8g0d!yW8G=E9zB_*r5_TMI!G^W8cy~
zVfJs23{BqhUz_EeqI}_Q0|UpS!@*0~-PU#o|1kfe!xNZy=3G0kkbsUW<2(K;{pD>}
z{;XX;clWfN1@G?dUK)_cDSa|o==zD~-MgOrd$#=WwJ?Wor8a-9KdGg!Y&T4OtY*D?
zrI59iuu`_d&6lD|9CM?Brxr{<(iNu5RJwIW^SR!+-=>$`v{v5H$QSrm*X7cxkFm;k
zW1G_$%SGmWWuD&qewSqPI~L~EPk7o*q~AL4mf>|bxL+j^CqLC#`(p5wFQRtAs~7Ei
zC~E4|uUpDFf91qUsXeyA8KHh(ukL^2va5JqlV9r!nTSc7ejQ<7kl(c}<Y3UW@F(&;
zOBnipt6kB0cPsS5WtpN3vGnck*|#=^@b{_iOy@h{|LCP@+dV1OKP$V|8vA9xFft05
zb(d*o<JWr~ZzBU!T$ihz=-IYg%!6;K^nLx{!t4t>FJDORk2;wv|7X!={_oFRgJri*
zmyb3r{$FmBd8$<Y#Pn|=a>r(WpL6H^vH2gqn7+yMFuBz5ufAZ#v1NxBNF~npEYB<w
z3!cs39{NmR`{~x8#*)XU9yfi{p0z&g*Q*#Q`9}2}>}#3Zj4sM<(GvKYc<A%@_4Wrg
znU~9M=nzT!x;#HKthYV!`rG#wObst?pI#+sZZPNSzdaI>aqk;kvibgPJvU>Oazohr
zyI-$Ov3$flW7VT??Rgt>kDt_9?m8)a)3=6YYpz|lc#=N<=$3U8-s-V#xUZ$jX<~h`
zc@3}PW^KV0c7=QgHm~TN(^z%z@2acsOPQK}?)|N`c-BJyy^GcTOdHv`BKapBEs?f3
zKe>d@@Y|b=?dP?Ga&}5sI4ZO#MOiG}Q+MRC?6jLK<r9^3J^iP}%&C5Av^sppcmL>x
zC!VTSp3bl+d9}H9s?~&u>5D>C*-pi>+6$D28)<c_9SweTEk%<hh-G$~>n4u|zIi;X
zdwJ!S>u$1%3z$AzC9n627e7l#?yaIfj;CTmX18Bhw8BfLm4oSay4*IIF9#bgIWbPV
zawdh}{>=7GJEm$JDq0#b!y$eC&7hVd`*qQqaxQP@+Pq7t_3fJ239FZUUmE#(+Vpem
z*VsK)7#=&dO!L>z8<G#sWS(G5&RUh5>(BK6wsCXhiN%wv{f}OJD_6X!`mO7I1MXJ+
z-`5Ux3W)~%m41G?W9y#Nj{lroLphFq_UW3s>xJd=m)F|1xZCL#Y!2q)mRo;qLdWs5
z3?U{{4ze&`W{}EPQ(#kAUOZdpb3w35LV=9L;rNd_vl<qNFG%zJdTCkd3Z9Ppjtf;|
zI}3evZ)aRdNl%UREHf&(Z>peb^D@O|(znjS<3BIA$WD7_t8injbL8<%Bk@$%tF~GX
z%U2(>4tXrw_rC9n%2Ayox999qb&>LGnV&oR#L8uNqL<8l7G5sO^J~epqC2N|bXq<v
z<Ja>)qiGi2I;}V;YMsa2l3gY>KSOiYySs4SIMCHuGVAQ5lEPQlul{*qtv>y=yi-xw
z`p*XrNuRjuTE5HezuLi1ZKj{@$nO=LtbTWX(lQ5YvF5_<`#ik3jXznaC&sK<@x(5S
zVKHCf|LRFon_fAjN^O~&vCqHo_d5B#4`$5j`FuHgzv1EsQL~n+b6)=zRu`~sySILX
z&E9`Sr*`XSH|*GQNa|e1%+%|rOy|!zQ5?$WUL&;aPI%>q1hJCh{#*O6zIrin`<hjI
zY%2d$Y`(c-_0B_UB5dY$&OW~Lg!iBKFMizoUSFxBtg%N}VWwCAow9}Io>HC+TkQR|
z`b0XWEja13?cL0cmnOaN{}i{aSlQ8jYS+}PV^&i=(!%vbb9a1twxeLP&ob|pt9mY#
zPgZI#xw2H>E1K8T$AxJQ|DNunS5Ci`jlPz7?(gDgyR{d$t0zy>pSsAzX->z^#5(uj
zAD;tedKYK?v;Ua2X$#jGZXvPKMRH2#57Za_`*-!HyTa+j#kR^Kha?x+eNl?Dt86@_
zruBHI!^WiDA48_h7LDHZpV7K)$IOYhzc0;DRsF!Xz{p_k9qy!+CYP`2JUO>Hea<@G
z{iROU^CZK=XGeUWd7(5}VSe<d<dDwrcGuZ+vm|8&PH$tnGFRue-G?Q7qPz3ijB3t&
z`w=4N_3~<L%gSq&DQp?+@geV+%$Vi~+vQiEYHnA^Zf5-3^nH_#pR`WY)y2yc=9_fg
zYEk=t<V@*(Po}kAYv%5ijXD-N;q-wwXM7*>v!`*zTUm>ISDDcp>3wq#t39`c(CWWO
zWMpQ0&F`!4x;SH9=iH`kGf#Y(w(rGKR&{Sp?rB#Al2<i<czPka^VIa>*auf-OW*x%
z+gccH^T<2&Wn6MnG{et`66LGDbJl2_Z1Zk+-4$|;f3nwyr7NdTcD|M>9T#+WvbN5x
z%S)sATI;XJZr2xXUia*0Q|MiFwzl7QOeM~y*Pa#4(h6VL7ShPaRuJCkUGTcd@!0dQ
zZ?Bhqf9hf=a**3_PifGjLbofEMQ@$j^m@r=p~?D|VaXq=JS?q4pXNMbIzPumpyA;r
zP0fG7m7am;Esq|n`f?|1xz=Onms7pPm#?3*`uUw&^ZzHdab7sN)8Dt7yDRfBSD??u
zc{~3vD;9jaVCS+nr&@IxTle}E+a{EX*SbZ9Z~61G+DF1VafLQ_?eVV*4{8Oz`_JH?
z&-nCt^wW*68{Lx4PR*ZxWAO{7rhq#stEFvP?)Y>}zx`+B%WF$sSueTsQhW<{!JBG<
z@}oj(XYcQ2xOD%m<q9U_%J16C6n<`V(RunIz|`tXN}c%S9=))`roYbRgbMKPTlKE*
zNauWwZ4**ArSipJIJic09@F9M#T%TyN!wI}>OEF!|L)qwKI=n|{h2k(S~TZf@;H!S
z5Yf$}&RZPwz_Zq0?81udJ4`))HuLUr3v;@mJyGv~pUuID+IO`<%N_|gv&UX}oj%{D
z==V!27lYV@RY$m1-@GLBehZ(iP2)-#!BY=TIWC{!k<8#4qo%#<(SylF*ZwX}|M%na
zgtn}>*80ZjXI&0B<(<tGVe`A*oPLZ;K`MXpmVZ6zao0+wo5d~=$PVpI2`;nslw9%u
zz$sIwW)5%9*Eep9NEC=|5xN;waoymsTIZZ+*L)X0+hjg3KEm-s<a4c)OV6w*70mzf
zxc#(tnvWpsv>lmmo%;HY&vETFb<<uNZI+sBXTJDJ+VdysZ|-OMY^*6-a@#a{+n(Jf
z%l|&K+_s!+p4yRs#qYF@bA^({GR)c+?t1>rW%~4{J*@wJ^M^D^W&F68k}b96wLg1p
z>+-#9y`C#Rrpi>h>DZK8pP$x$P58o!q#yG%eC`$8l&>)9I$8L0Y3s9&a%t)LduA$m
zb?k~+xUx!K^74@xfpLaUcBEcEXQpNTLQdEE-P}FjS`@FGQhV&Vy2t3(-`<W>6}*1_
zYxXG%WlkzQ=cYU}Y{qY`^#$CI?|&5Xuv;JSNmBEx{hX@fw)<xKYR`SxbiBQy;@YVQ
zgITVc;%EJ=PoBJb{^ISNjSDXEM2V~Qo>{s%Z1wzC4DtML9`mX^`@!Y4!6*8|xti&1
z<)NGGZX8z9h|M*7y<o9Xh4QSoiv*N-|J2Wk^*WolaE0NPoe2gK?@!4YY{@;EqL|O^
ztADbjdD^;1zC5zJ6KaBwyttaL;Z(4C@jZ`K_IfvipVd_#e|5{$_xG2d4;G%f(WN)*
z>Vf2p-4YM9)sHN)Tzo9={kL;`*G}jJbMHO)-t@DXyp>)`NVxm1@*Q)+O&;|d`u@4Z
zDLJ8hcI!E#`0G5kza4Y^BmTAN;{WAa1Rkgao@@D{F2-;{d&3t-{f94))iB#^DKAjq
z=T#BStNpW`<D1CSf(es$WTg7N&06S}$+u;r*|a4K+`M<46aH>{Cso$@xad-$1xgYJ
zY=6WDcr&wzFfcH1Fo4eN+jH4e{Wl8(gBvf-(;FbOea3nPmA&D&^KM%R)P4^aIMMvp
zA@K6D7kWGr8Rnj|70$A5ZG3l#gCk1nW{md|hoG`Oj{j=g7ioBJx*WpaXYnY;qWBq4
zv5OkNc>VmE=Ykx(>emf94h!>Tx$JwQ6Lsih`-d&%F6UDBh1P5|d2;yWZ-4b4pV?>X
zHQs5O)^ub;TgWp>En#Mz*I$KHjh!-sW;ih}ZAsr5(q^EzB(cqVVf9|GW!tSLDLv%Y
zH@H2gn>BHkkG6B-3*MA#@u!|oz0<8fpXXSAT7GKG5&?nl-=kD6?f1W+Us3$IY5B%*
zxi1`c^^q5+tYn?hFh~5>i8mKsMIHGd64Bn}%J%5@&;0_DvQy0VH8Qm3J$fIr_+H9M
zkt23XIs;u(E(`jnEL6I{7|FR)Fht*2^72)-x3BMAXg|@)I92<=eF0-8k#51YIZ3NF
zsE5bb#l&5>{hPb$b8(SF?m3eQv3>`CbF2#0GcC<llwa~~z4_H;G9kx!<&JUgX^uJB
znlv+SSsdpyI}6Kcrizyfew{z8YP)}z&HkPHew%4cE`AWxTb{ozkZt<1>m_$1U!|A?
z<xadDbN|nquT`P*_Wk)`rkHFLJ<&yLlTu8{Cl7-^p&AivGq{rX+kb!Cwdi(>{a5Bk
z({_2h`SesU*Io1SESsFOL0!hri!V4nDY&A|UsU`3tK8rB4=i6i_d6eD$9w)CkN-zq
zwi5A3mEOP~7rENcIq-0P6BWM`V0B@F8lz>|S1Y?RP03v)x821fjvO>tBf2ZP-1=hB
z3`RGh*BeeGm)KUU+kb00|34QK?Zxl==Y)mJZMiC>Cy@12a<7~7m78;nHfr2pdLcE%
z^rh*pPkm9oiYDo4FQ?wRH20ME)KlkWTll}-o;YVuVBPeC=ij!i%HB0y`pR`T)|9hT
z?pnxA(e}@J7@pVp$oJFBOK0phzPT8@d41d31$Q0mB|jA|u4FoNDI_mL@l;Ol@>LCq
zy=T@HwFczwEWe_XWYQexK25XBrZsYAdu9f|$?e4r$K98l>J82?FJpe~y^{CnB<T|y
z4tn(~c9@0--PkFTW^r~0gY2!|g|{QLlP_=oa(s!r@z#eN2gEM*onTd2<58G3l|doq
z@j2aV>-?X!uC!=4B2?lj-<p~bT;w}fN_Lx1Slflg)BgVAUc&Bls3K|S#cIR5+@CJj
zDzT*(y*=qRJ^%5gz0*!)v^FfaNsZZHd1(n#+m32osgRtu#fc>qkKb&Zwp;3K6z}JZ
z+^_ukD`%a^D_sB8Y{?HN&g;i~FX=xwGgUQXTX!sQp~$uAT$14{J|$%GC*1$?b<O9~
zS$iru%ulTBytnNo+dHM1sXj;84X1nU)GD$%-m+TPweuF=tF-;44L0#!dum$4zfaC|
zc$H|7<8*oV1HO>*ppveM`R6axrwg^0WrX=jJ1;Xb`{SC+KP&szit`U#wruKL>BJ<w
z%#o`%Y0=gDI*!xd*01K1Gn)6sxy2*&_^oq%%)I^UCzYqKnsR0D;$7da-{-oRx8&*7
zq?o*!bKg~^pAC|mF2A)k=(k9mKY!GY8#h<4)8bWr+og4EVrSWf&HB^*1)qG=vh(<L
ze(Or{exqk=ruuoje6lm~pXwKJq2DqOJvK>k1?{=B{-9>A#j}kYijK1~HWmm9@jRI8
z|8aTwENP2_|4qUo^8dOS=FWTVa9VNI@$<FSXOB+2zkRdh$+ITcV-j31iJXr1j&Ixi
zUAa1Yv+I`YN`1?J@qb(Arq>v%@OJmzd%CZX?konCn$mNYS1B?wFfcJOFi0|By|cKm
z!~}HS&4i74hYSST%I%MO@~8-PYAo_r(b_s?TOc>9sk3!tSP`3dr|cVUq1s=wq+G1N
zu<?Jt|NQ)O#+o(q_LI#+7nRL;BAOKxwD9bMeWFkKCVN_?G0&L&E#qpLyMg5WJ5C#&
zBNiD;Y1t&?-a1z7pdoc^i79V^p7kr8BED6by{ZCH(n3pm%HG^rl)U<jSWEMxo~1SZ
z;t9_DhaO%EiS2#<MW{7x-O@xKPmN2DviCmtJpJe&(|Fr-o*GuA&{-F@iT$ly_&K}V
zFznhPOa0kx-i!B{oxAZq_UEgYvT3%tCU-8ENVIQpdigyxO7Qu_!%=+;($D_dXR+sP
zNUi@bd%GsvkIYfe?eomOx|Lm;yKL%;tLAQr-`2BE+Wp$i@n!S5SNG;McHiVjt&Kj_
zP3R#QuBMQ1^*am=SJ_z}z9Cwvogpe3tV$W0O3XgfuFi?}?wosTy4TZ}g$1kI8l`RS
z)X%q{@BU$9<qw~@t72OZFIf>Vc@kGHU-{Y_?+j-y4K{0P&GZj@`;BGuOJBC9a*3_y
zGFE)(*qSMQo^fG@#N=xx2X?+$vH67Mie;wL95Qk}CK%n?SlsQm_L8*#-znp1pO|AC
z%6EzLg)e)RWwU&`h6%SWZ?c!u%xUqnRpV{+#r2Q=(oBD#EwJ)Z%eJjA&U44cME7jW
z)t&QslTM5j@7BU|b?>#V_2(PNXDt5MxT#R)64%oE;hC;;-1)LC8yijKe?9uJZC~5G
zFZDG{?2p{HoU6ZM^V#j%>tC6wSzmhtXZ+1>eDZBqV8E{ho2xdYKS=t<j2f;|lgsQh
z7#SG2@ugQYaJU9~A2twZxc^z3uO@>#TZ36$MD4|#sFLC&`7fF+Uw5(ITH?K~`RD7i
zXO6vU{yw37_wRSRPm9*9k+ZuTzSZrmfv(n-C0VUz?YsTfZJ*Isd2C%m+OFo%*}4ZU
zq|*cP1jSzTv~hjEF=O3V8G%#NHr|>g*0Q4dl`a?Ks<%C=6QZOifzs=gMb68=uq|o+
z)Ka){vGE7L@0T7P3aM>g{%WVlq}Fx3$*bBXO^;u_bB68tbp4~BG}9j_3&dnP-H!b7
zex{zD=CNzNCFgdlC8pVIQM3Fl8>%CJKf!9lv5S3b7daO7#NYp*<K-0Jy45}=)79w+
z-|Q+D=2|-u^~96OJiUMFYgnv>s<)i`|Dfbi@0%6YW!g7a<o7tgkLO;pefsUDOX5|l
z*~QuQ5|NI;;#v7MLXNFu*9Jib25C#2CxjN2g3rI&8vVEE_71`S@&1i*{}f6mMyT)2
zPB#fX-uL#&6_v8A)1LVyQf+FA-QryVoR_w}I?4Ri^jFH=qvDJciYCoo{aj6b;sK@`
z=kLFB@;~u(_vHG%`%g4=EoILeMP2);wft&}Ozz|o-{a>OHy;!(I<sxJ*8a%rPxk*;
zJkLK*zUSe5`4el_WHRcn)?GcxD*b7~hE+G(j(l9Ta(34-!;|J8)~R_$Zi?c0$oy4f
zeP*a}*bMeFHLJ>R@7bfssb1__=xnLIe)gUdi)6&sZWC>-UoY&pxM$f8tJOQ=-l+N(
zd^N6Gp634R?8{nS_SV=vsgc1K1SkIAzrbK$&3uvGN)zpHA78W0N7cIiRJoY3?!K6R
zblsN;A6Qpk&;RsVYh}?X_b06T=BQugUF-g2$3xTGC-OHNE&i^2L%?^o)y`vk4?J6?
zvNp4<?yt6Q_Kd$>(?t5*Hk(_ncW1uzJzZF~(Is!P()qqsv(uP2u}IbXuM*t3X0@8@
zyp-u{RtDX<`P6FV1cSU%^DFJ1H`8W|Z+Y}qUD;_u`XNh>-s6$y3eVr{5b>-O{+zb;
z)O*eAAv%Jt3f@x9YD?z_EScr|NJoA7d%yF3e&_qrmrwurnqT=-TG=<Ne+IMvtL%&Y
zS5i_~CA5F$-iGzlm5uE8&N=P>Jp6Nc_>ag>DP?7Up1pcvVmC8(j@<e4`VBH??Dp@n
zVB7V+U$0Lu?qIWV*d@!HG?!0C&$jfjE)OVVJ3Oy<ao)?fa+^2#6-{70=YCd#^J=)V
z|NG!wu2<zIUN2W*w`4d!_vri&jMwjP>pA|Z`s6)BJ^Q@OttYbuHqFSXSTXgihAD^h
z{@Y=1mU)@o346WDr>p$a&x8r<PuR@*|L2{F-M^P#etdoN=Bi7<sjX})UrtY$ex>TQ
z)|WLt-D-=~D_Nsia~=5#s!QCqi<Ip2alHR^iSXYXbEE3uS!w=Tcih!Wm#a-&@<its
z$I&OYkAFY&Ql2sOHk+<XoppZJpRC}IH*4y=S8JVLk@k5WYqe?I&AY#s9NMcS&i=OM
z<@=;ndnZQ<9#2)Tj8cBzSQd05GLvzdN1R!z)$%=jqU?*r7i|8KU?C}yo_IQ)DXMW@
ziedjcuZZ-I9Sf#;J1af^DE2K@WXp^R*#$SB`A(cZ|IzL}anh%vTyNbJwa{4jHH~Ne
z>ZSF4;*~S+UNACI-**1O+_m?Y*iJdSZRx9~&8rT~-E=CgVd=GREEgDzkAzJs;}Om>
zQrs}<yUw|TG2T-5Lr<1<3to}?WbMIdn>+bVz??e0KfXaaQ^ItbOe7{M+|6UoKDPBq
zCQnv()YFgk3Nz~&A5H92__Ap6v;*b$Ys+2C9tp0z?&*7N%?XRh%S?TqVG1^a*H3nZ
zI^7WTk<d8)=hGaYwH;Dy77W{~1pfY*{(`}-u%oVW;{VxcmmfryFr05IDsl^FQ2AuE
z{;|cAEfEVJn}wNej6FJ`=fB#Y-$&-mHQ%taKthu1+MPset`lw>p9%lDpSW&X|MR%J
zE8beRJ{98Yi7vc;<3iP0BRSLP4hxf-f~3lT=Cf?VmO}Qs7up5<zN~yDJYT?KwaGn|
z%%fj+eDk#avN`G9Lg@)hVvgK$QkmKu)Ami|WtNlk#d(=>b@@qKE1$4ee?G+bOK@-M
zQC(ik8+xv_6@9-h^qGD%E#c3v@p(|RRCvc>rimi+3SRUbdHyrYd~SFH<6QFv?ViC`
zE+4&A`|i!g+N-;7A1GRQAmPhGW#=EMK?SRp@%Fw_cAt8yxaWefbxePc_Z;)vO?ow*
zy6#$bem)Zf%q}(VUVE_NV%82%p~T}!+)Kn*Qs;P`@U8Rq{u;KYBTBz_Udw{*EE)0z
zmm2OeGX7w*Q(gS&A=?ti9Us=Duy(K=%4g2|EX>M&_;ug<$Cn;51paU^cjyX8?J25q
zdG=c7#HA%6$=+eP4d<<$vyV${^2<9|ZkVEz!MyUl#0(BD7C!Cs2RYjenO5lg7h0`z
zuh^9N*5cv}DNaT2BQMuzeEs;?o$=P46YK(d)7YOqkQ56P(Y0oNz<SEU|0DOVzjj~S
z!snI!{-UcYQ(~^T#FF)2=KZbd6K`yOdOX}HpH*u11Xlw&Zl=@s?sBaC$NRc$uTsVK
zSxeV6n1%*yytdip(mGue)_=?&g+iD&9A^8vRPDi`@+VIor7!k<vBojnUU5n5p7oyB
zTbj}?m@U|TD#hn%_b!Gz(|73c%$me4*>m(-^^vdAp-Br_uAHxZyvlk0>$KSE<-d&G
zO8!a~buYQoYWc(dhT@L{8^j`?1u!&7<%S##G?-*yARs6fsndSAQ~QBRyUFSEQHLKK
zGMKt#QJKPmWm^IxyrtKk-6_-~x}!~7pHD}CWroGH!|L0*uQ<=weLMM~*R`G%52qYI
zF}vXWvE7jg5;2#iOqFbWFw0vdv4(vWZxFMI>Qe)jr%jXNq~~{cr@yLj)aL2h%9xoP
zeDt2H0@J-sPY(!t?BVMAxBE`yyH|aadZs%1z7x7}P^|dJ8N1EfBA&)xwR%^$@qysM
zO{z~c6AKQpES{vJT(qu!U0LaCo_Cguy7DAis`mc6aQhP1-yiw+rp)<!_4cXOWRvLA
z8!d#l%`RZKS9E7}|17@em_=fDxc?^um&A+lPo8LQ{IV|J<+s>ct@Z|ei@-xx5?c?I
ztyw<ffbD4$;m%SAWur+hA2zJAlnSigk@-NdqQ?B!`(2Apsz-md3kV7diDeVxUK4kj
zE0OC)esJgkY003S*IWfB_VTwcPOO<O7wMt3UhwyUgpQAEFNb>m7ir+v6JoRad{smJ
z!U1)!n`PpBZ!bKa)vH`Mp`9~E+55L!$Lh@3_f4tO`|j;spqf14Y43}<pA<LV-10U;
zL3Z!SgQiE$mE{JD<=iqUT{NX<y<)*eYbNF52b)<oX=KbwS+eN1lBZybr~J$ZY&uzG
zPM2=pQWE$TbYe1x#jhI)*3(6et&*2KFF(floImHC`llO3xeS#ly85RgxFavG&DrxJ
z+VjW(k+a&zVvd)sU3BKAvfJs*3Lz6?mDr6x|IJKu*!|LMe&nrHKP~2qr1kaI&DP!W
zJY(XDZ3@e8E$mA0J`=cR@2bdS%WSeHYQ&^2w0-I}eO-I48RP5u?+z}MIJWod?AJQ$
zL!?^nANa7r;awk7_tBK{-UH{(UM@L$dtoNmqrVfb8HUF8l^+Se_e@m#;_Kb|K6me^
z-VnTDSJHEUe{=cnMI9a{@0^~Wvv`{Icv9+t!vUK%#a3EeI(Pb5i<0D<v^GUC!viyJ
zy;R<~f9X1f8A9KtuV&uWaB;TOa;?I8o5<~#3)CaupWj|zKS}S8*wRDmb<A2Kc7301
znU{XzwN$CKqwQMd?H`r>Rg_$O%x_mcpCbC@{=TSV|6aMf{=fPpLG9k^x^>y&EOYo>
zJ)OSCBxEm(`P8iOd*-v#SKc3M;m<Yv{CPvY;`&WLXRE%=Jsq`X`SK?s%M14NKE2$2
zT&(R%$TSoC=qY=jT}_U<79H_z3*XN>+K&&&zu;KlKPj$rU2u<eM&y-iE2n7eTNI-D
z_1-$~m5cs|Pg!PnVl%VuHHImn-AXr}Ob8NJ@DD9{WU|S)PD|VGt5me1soM9fJukuv
z8P_E6C2D`V_+I?Ytv}aW7<#uS*eFCePU)P&C2)P)fnAPMIg%dVJZ^To<IUn3=d%@D
z4tnhCXXN>4w_o2mm`AB?YDLWE2$8*q#I`LIkK)UfspDKe`K}Y=uh31eOI{|No}t>A
zdpP~}#0UXS^@8=%i#{@jZJKs3VyC$=WBG&L!#--xYxMd4MBJLxdxW#fcyifVj#8!q
z_h(OMJox_2cgyn#pToa-n{>D9oab=h;mhL}wpznl)OlzrTjMH?Cwac}=g*(x|AAvd
zR<}xYhSY`TJ#t&h))a8=;p=i*=E-oOQRRt))3mm*EM{NM3Y{g5s<jKkn*|n|KJM6*
zb$M^b@-}B)x4SArk@}fQ*$qW<(OUW0q095xtezEp=`=jJWQTXzp$|Lm*jg~E^-fgR
z4lIpT51q!OqWE~G2e+)(+ij*jF>9JWzIphsSfQ-8fA=}%3$>YShP$qBP`;<PeuDX_
zh6gGS3$~>9WR#y)JiIix^~LUw0%e^`cpfDOsSDn|mf$&c{kChIQ$Mjj7XGkVe_b5w
zyp9b%aqmt}j9KKiKvHyhfy&Kf^ZmlJ|Ld=LcYnT>ghav`gRMdD659puB(*esuC*zs
z<+=Yl`NR72=RYK-Yv@|J<d*-^D4e}+ZQ0yqDr{QYcWWNGAi2!;7}va`uRb*$^lF%R
z!IW{*<yTLeS1b+pDYd@w&a(8)tA`6#9X=&^an+V;4ZGbYGe6wEQ1IO9^1e+)@ugwb
zdaJopMHBmdBgBp#32LqT@XO_1_seN%)(?+8Wzbs6QnX-7#LR6>?S+fxFb4(5u6exN
z|7uK*m*atk-b9(E6@qKG-{$bnH9BR`Euw2_;1c9<YOae-{zi7kAT_H3(WWWWb~M<F
z9_?W{U9uov*XN?cJuNfoocC8wpFI#K%IeL=)#HA9Nu0aPL{1x_%9jNnb9Ppk6>@hw
z2rO^Vvc7&w>{F8S^=WHzyA<Vk0-h}UP$pZGxXpe$zmv_P(A5uC{R!E$JLr|L+TkNH
z&mHAW75OXPoIiL$d)B5+H#`fq#QoOn&{ml9#<=lTb7aGfmXwW?cTK*_rB%FA%*o<~
zW5)bTHB&{(Uu&G`T$$#+`livho8PoDPK$8OscG0(zWMgMsAms_16P`Dw_aSr%MsIh
zc6L*&x@*p>vMS%eEz(;bux#I29&#)GYuTyW0!isJT>b_Av9=SOe{}z2?T<gTKGe27
zh*b|!UzeX(>bCOEy@2(La}4&0-+Xg<xm<uf6GvZ#kgm|p*^FLJTUySu$ZFRsxR>@u
z?yZPdRn_01_2=KEZS{+DPt8vb2zlbg6~JaQC(?~Kle@C?+G@iOHb2<DHaxU?{O%$z
zPj2Zm6UDrVy0L+e40t9K3Ct6fc8M+A$*XWwdFqs{Ifq<Tcu!7r*(e^!no!_SI!k`y
zbffZrP06cgD(*fhbtlc~d*aIH5%&^i7@g)i%(WnK;VMJh4W`2H+<ks?iL3a{x%isx
zT=&hjtA6bCYO&4xWcS=R$YDj!ra7fsA9K5#1_rSxoS7i(KKahqlpvWm)^dNeWA-lR
ze8OMwNvP>qopO*Hhll7ffB6UU#~XLGPJ9>YVE#A6Q9}OJ0yX)Y<<Anb-+Ax<wdsrS
zLd(+<Clw4YYb`wMsL>eu{Frs-jla*M*qE-X#o0Z1=qdlC_s{8le=WlA%k}M9x{IZC
z@9MygJI(tiHNQA-|81u9Kijr7buZIz>N6f(Z6;mFJbi6PtkAWuuIm<FkPvs@5_-w{
z!8X+#@0KY2eF~cEkKYaz3u!&4+5B<Fy~7<cvH3wK>J-jNo#vK&9QrceIQa4&$7C1V
z7u+KMeomcfk)iIUrrFfWms<GY=E8LEX>XUz_L<&gmBgZ$e?ZOoP5s|T0xv9|J$%D6
z&1%Z?;I<34*S6>XTd?`(xx77oZ!X8(Jh3l)Lw(t;vJ-1Ic|Lz~@W)!7Kl%R~|8MU9
z`)z4OQPHn=Pv4w<x$y1><6152xy7F!hAwy~*0c4UR)_e?yc~%?f-jFByr6$mi=nON
zb^YRnk>{g#e}3}otnaf}wn+~6SAW%({?vUenq}SP2OsXvUVQWB&5O4$AJ+K%#c`WX
z=qIbt|L-ptW`4f%@6q<_m;66uY56bN_j5``)YC(oeVDIWAH2}FM~p$@@Y)?}Uq0O2
z`8(C_-P@d(W!IeQE^Od=Uz*Tt%UHAfq@nJk1&luIER~jx*R2$iEMiPQxb_xFB{;i&
zoVART?_73+H1CprhU<xYEIRYnzUZ=@sLMLDRd$<wQqc6`wcPuZ-)R5wjF~Eyym$VD
z7XELo5vAd0L?)Lxq;&U(E@iQ=TKmhvD~cme-*3X)(!Fgz7KI$D3FrOUu+sVxSNNv~
zn~Rs;*xmX@CS=RRyr=8cmfg#*`t?rr`-C6&{wq#=Gs)B_ak8xa<#QS7b+@11e)ryb
zjrERStD1h#)_zlE;eV@Rb?lrqg57C$dBUb#{?>{=eNXB<*zlc=xyjq+QiRdt*Bmpr
zS$?lqJ`ug+Q(aHu*G;c&mo^?R3wCbfv2=13*`BZ4>nlC?yS3^09jY@ACNyk1Jo{f|
z(|*-}?SFUM3uV;5RhYT<M1+0Q1mpJR|43WoK*PRP6?Usnu`)1B;Kw=6Q=FNbqE}G4
z6?(bVyZD1!<yE$JO<N|*CUN4zm9JsS`nqY`vlAtll;`Fi5_&mt%3K}L<yKR4P8A9z
z9N<w|cBK7#-T909Cx4ti{@z_&hk4zDj4905bIv(@J9%?fnzx0OXJ57cNryH0s?j>8
zmX>v&wP)%y#xx1dd9tC=X^ppyyUB%3*JpbNPBNJrzH8EiWi3;)6-^h;;r2BZj`>>k
z)w*_fT8-lhrOCfyCYk)W)S-W))aR6w&bRXQ+F?)5p7xoN9o7(X_T7TIiwqLi6|M_?
zsBf}TbUnUlYGADV4+GER^Y{O=l<2$sd4H18yg9yZ&0mtfFv=fiUlJ3{>d7~ALP&Sm
z`=8TJ9ql;p>T^xOdztBzZ*#kP*H2iUy)fv1Woo(fb7{-N(!DPa1jKgj(Na)*ciZFG
zjk70JX8!qM<ikF{t@-oCtMY&44*G|;SQ{SeXx{$%_XP#_x2tDZRQtGvMJF$;dh+3+
zL7%Italri*CP8W(FK>R1beyWh+-!HhZR?XG62~`jm-W85z2f}>vAE^y@2hRPsdakx
zKSk5C`+`2)`FFCoVf%T8dF}^xo1a&jXV#oI@0;-V`C<ngKQuSUm3@A{`2BQer_Xcd
zh|bDYIQ;I&*X{53@3Hi(TKuuVNNu^wmP1TDl>)m}Z@ty^-}Ci$+1<(m9zXbZD`)KA
zerK;)*kdav?bx$Dku!G(@qM4QNOQ);tMBJuys^#sP=d{_KN3e&Ed1^%RzF<z$m{ZJ
zCO`E}O(*7_PVCb;YH>MJN=xIJ;m23I-*0!ll5ZTInA{$?$@=Bo&M1*CZ?6m96IU;Z
zdVZtj;oZFJRaw#MFRWM8c9b{#zIEh#>^TnR){6xRC0;M19#_xz+O?q1@B7Wd5DAmo
zwnMYrx;tC;YpW@iZ?sZ*cy){Obj}=?jg1p73;E4tlAV3y(y9x~!<(F4o-yrYyPsUs
zxpwW%#FbZ+RyLM$&QN%I@yH2v`?*PqI~VcsbuDyN+?IJXJSJ!7=f*uM@(PQmGHqgI
z(QwR|b};Jw%Fe=7S0=Y+@CaqNPAg$%VHe-Y_F&o!E}zmuZ=U;%kB-P~{QpK>x$x)B
z*{l!e%Kr>EQ~8lAs($TVNamcHtrMyrADFo@%1QHr%-)n!d=gIU&l+<XKQ0fyYWBU<
zQ`?x~*FTevPQhE|#!H;imqoa3Zu|b5*WLZe3v-tkgQd$SKhZwEZuYhQb7%O<&nJm*
zO;PwUM^`KJ_#gLGFLSPK>tks(y{PVg;-KBUbGIxTGViP24sp#*QGY!tDf6u!cjw+I
zJo!Fl7g^j{mu$H=Ii_LL&Le7N*ZKDx-Lpb;kAn7&yIeEb1G60zjiRn(I^5pSc6h_d
z@Y#n?WY@g*yQRkO?>nhSOO}oOxSZI5yQ}=owtWdV)GMn~^Ko8z=tN6m>f2+w_ZL;4
z4@y~Jx!W-}ExF33+Q7T;^xRq7+J0-;xgSxE<gs<-pS5##pVh3jX3cX;6<+u?Cv{15
zy|90gyv5x(&T;+q+H79`*9Xk%RBo*FI395#G|k5^aH+D-Vw+px_a=T?!TRjd%m?un
z{8D*2uiPeDEC1Lhzhif1Q;sBC`24?46}JSp9C}jx{J^ADTaG+SIJV-H$!4xv<JWe6
z4f!)f?l36%eEOgNwSMZ}2_DlEKO|e+6VKPuy?J2~)0!jx>G#_*9pY|x9dgV}U!B-!
za3GtxGA8g*`O2RO$8Y{DxK(l}Tj-6-d*!`-_uhy9(cQR@cd@&l&+VJZe7j4p3oOan
z6L$6F=DQhfetbgfBP)Gxq-E%|GI={#OjD84HPdl-Sh{PKX8eL4k)4_QADj(y6>nfk
ztTCO{bS^URiP)7br~8y2x_Qq^?A9oenYr?-{x{LG=7!>}%4@a%mM&i{*F8`D&XM)X
zpB$}p??1YG;{V0OpPHqcElYGKh6W{BFNt|#aqG}7zN9(Ifj%|o`OeJVD^<j-wJ@U1
z#(dJA+AHy%e#`iTZyO!+Og*-CCx=nghWZ8jc*@@QrA^wlJ>vSNttRh_Ui-Q2tw*Z?
zwh2C%bB&XML0gA`0msb;#rdU0$*IMupzAJ<N`V$ke2a~D+`>PNA@qdEjds%sM@uGc
z5#BOcOj<upJWs(uY-)zKchtnJN1DIhSM%vBX`WnHyjET)wu0~cU$?y~&*%63|NF{$
zW0Gk4dOzc^P9^;aYxR7oUAxlO$EmX)^ezf9pS^9zF0m(H59-&ecW1l(OW3o{<Ji7U
zoARzPxU(#Nt#IOYmG32!_b%5rnW!G!wKCc<BlK!h*P?Y53*<X}gG0hwiZ)$H=!~o_
z(r!?Q_~SmeRJFVF*Z+^7_UEWRSSS2tQ%ZCDr*~UUW%sT*UUpM7)vRX5#<tJ{?^h+%
z{K)IwGxg}w%D9lGt-hxpyjOjCMu(f3Y5%H!A;q`iK1%4_zkfpe=c6l5bMLH+Xg+iN
z!xwGc?l->GR~KHX`2S?ZxrU3|dlo%7cf(i4CHkAc(Y965TCb)_2lc)3y09qeZPH~A
z$s;b47U?-&((&G}aqCNL@Mn?tXXV<`n?EMc-Z(Awxetru#L2Fkew<%E`OAy%lNWzq
zp8o#XBxlZ5S7sP3-ZW25Mb%m_tYJa?o$iRt*D^j$mie)MXT98eqQiDsO$@19n!9G5
z$oZ~@P)|$s{7pWZnr~iqKg(kLm$xp`ls(U0Bt}R4<bJIO87EmE6!WTCnwih;?v~qj
zBKTri4ojZP>^-^%Vr~~-Y&wvXI_;!2TNJZqiU;5Q;@NYi{c-%wU=^>Hf9liUvzNP{
z?0I)flzFjLtoc%Z=gU)O=c*jY`;g+N_j(sklfvK6-zRVW@^^l5_LI}r7t0;_bXOET
zmfU0+JkR>mvJEVE3^~gadzDywyt`|PcQEX`I=ScR7VV=CKQYx>aflq=tMQMsPe5;y
z@h-NfCB7$>p2o)CX#3vOJa=kH{GJNNCr^)tUO!c!HC?dKmo-t;&2@*KMJA)B$NU9f
z7*#H`n20?#dpIMuZ|?W%N6#mz{&P5d<+t|F2{H~A3nPyiWp<YRmQ-K8>lD|_5RTlL
z{yZ#8rY-xPUin{lqHtnPsF&7iMR5nYh4BF~XP5+E?hGopo@30+@@0~<lt-IUN>hHZ
zl<yn&0~f4LzgJ%D&ZYYO`iwiVlO9*HzB{$NX3=(o+4JNaHXHG=UkziHw0wKV;IFir
z{MVo>Ep=<Vd)9Q7U7fl`RrfSwDXWOO*Mt2VMc*<kILDcNd)LvR=F8eVe}cTY1miAj
zV)^;?_t5~y)JxM|c$I7kdBt3v5aGJQgCSvyQie+B!aN^~eSET8gttzaX4;~w@uX{&
zK&Dht*fYbzN$>9Xo{@6OT9F+g?dHiZc{990+0lB2K`u{|#MJ5H|B6n0t8e6#owPke
z^WSb$;p?TxCa*i`u=(Nke`|Z5Cp2u{8O1SuWt2?+wIvD}<+6A3BDwXq{QUa*?c%ov
z>wI@My!)(sVTMq(z#hr9zvWo>u3HcjUwiS(l1rRhuWh*H*g1dm|I&<}{+Jm*Lip<h
zE5GvV$X#r2xBTVDC;eZeBi_R7heYKG^J9BIb?{GWuD;)NTH|N6Q`3+54~rf(HCY|H
z{nqqojY_l%OD|(s%l3)iXC<o0GiD_E9O$r`YW7%Eva7xBtoNrrPW5*ab_x5cd$3N7
zbhGI^_;{xBc{f(;8*H<ic-13JN+c)!oN!i9&VS?Y1fQam1o@9&7i>D{ctKk&NR?I2
zP0ZE5`P1Pw4F~jZ`9>AoYt)vq5o1tFzy58~B(nqU_i`>j?XRgk-&FHuc2U5V=G{MT
zuL!CQyFb%RX~|2!x=lwnZkZ-9clDz9zj{`4zP3uFO^ozez<yM`eO3Ago)VElyA$u6
zY;9icSaF@ZA$9V3KgT$0CbuU+%Xi)1@I2Kc<^Lg*kZ&g!SidrS(U$j&{qJ4g%byM3
z2b;b-vSwYbd)hqLYD0bQYx7V3U2GuvHSyRqH>(2$GAGa6{dp#(&b;u&!p_?8$#y$8
zZhE<M?&A{-Wntlc-p(BbUGDd<Mn^gPeS7B4p__|z7hGwJX`A{pU5Cs5JjdBWHde=N
zcOOg<GG6dW&OtZL%<cr=^MJ`)LxNi_{y7|(Ad_Kp{-e02b8+~|X_LZc7j(`(!d8Aq
zc}GXv#7jAP8|5NWj9Oo{Uw$Onujee%^U^zytI$_3`v<dNfSQH|?*`{ai^|~bl1ky9
zeceN9dA9m~TNrdj<ECP}-{XX!C2wEWdaQqOHOF0<@wm!eUbS%Fui9$*Ka6J^+J6*T
zX{chhdWps@^~MwHj;KwnyKmi6-umdI^B&c=j)j>@Iye1tsxxNwIsZG5Qr-OMh>+#~
zny!GR9GhZ`iH%N5PW?xujoWHpeP}rIZ;rr4bGgZDimcros%s{+FE-9@4|`Z%DY!GX
zg7?n)7PClGqqCP{{4Vr67**`QB5KyRS$)lAN$nLAzgKt$c1ju6<xEMKZk%3Vb~s7u
zY{ae2pOfrNggVtEl-M%LdD5RJCyEGvKPSFFr#$6-`g5DZr(`3z^C$0l=Wu1>+E1z(
zO$Uu8seP(EVQ?ria#5U!NlZk=m1{2Q4LYjJxUX$iVqGBbc3EMQ;)iSAOy6U3gbzr#
zL}_oIV(onYWW>?Rq&KI$6w7#B&pms^`KaXPgBe$z@I8oFv_j_k4c(oEo37LfHN9X-
z_j5iw*G_G#VV#NXZRK;Tt%Bu0HFD1scsK8x@5kl!yKe9OACmFzc;Cwni_{*d6=WWr
zT2ebRu*iCPcJj}16}vOD7P4$V_A@#2UzUHbuk6HAS_uYeEYpLV+AbxPP5AS+w8)^_
zrq+i?b$*<t^4Xkh&UyYnPUY4|tT@T2Yf`l<y!ianzLg6mSbb0^UX?NXK+@}tGp*jw
zS;-^#U3Bu2TY)o-h4wjjE?HBjeX^UyKmMxC%Ihy%7l+mcS^Ma{dUIe^hHBt)0h1Rl
zog1ASyDFC-yLjn?mrOd#lbj{2@7gUY`x>3C{}d^dh9yhQJpEB{Q_~{3<8G%cvyZ-e
zdtj!)g7xNS)67I0Or3XqyV!Ys>iH6ndx6<cHw(|q+0VG|y`59BPS2FYOooG1W`5ka
z9!*T2t~e)mQAkqhokuD^KA!PuUi-m#;m&l^O=}qc*8Y~WnXR;K#%KOg<FJmTj3DKz
zzjmjjy)rl(G$!W?^&hZ2mK8MVy>G_vusH2Y_0cS4MjXb)Cl7FEn(OmC<~?Qh`K|k0
z^Q_aZA2^kRuK1n}D)&5Kf8w=d0GlNfN7?bOp2bGjULPrccYTXi*vbfdFXjzZk4&PP
z-<11l37(JrU_EDol-tw#|5x7$pFjBW$+^iVR|cP)t3K&|uHvJqa&fUuiz?1ddM9|=
zay#3GEQ#>M-827Ne!YA*Yq{>6SCi5|>}*(ME>klhbKhAj+v?wfI#=teUS2WXb?lGp
zwHdc%p4!QaSQuQqdzYCz`M&dqlS}5l&x_aj@Hpef%H?04WGylJugrI{Nxg^RrIV)U
z1h#)kQ9=6>_Qr~=&6@vEF6uLvyT~7T)U`G9_CL-yV`pIC7Q?xMwmh*iCovB+E-)2-
zL+rt|{F4kKUv%a2AG0aRo~#=&OQd@@KTDf~_m;D+LZ%bF9<lzsU+&&1lBt=wtldTJ
z{qMSRn^&ScfBpD({-@>n2-TZ^bke6jias}s_2<TAH|L$bud+UU{R!(pd8vK3wLd-k
zI@|mSb8g-V|3x>p$4q+f{o`xd<-cA<Wxo&SY|C}=yi{^~)waY;uZqZSH^Hb-r@*7G
zs_B0xZODHW@HxwUh05wUhom2V??i8~=g7O<6Vp+<`~SW~$NIYEuG!Pity=qH=49W~
z-FG@Fu6wDT63s31kz|U~ymp1Rc|T`Hx~9dPy9)$uFSo9^!DW_oXmyCu)O(kjo`-a%
zIUQ;9a$}2+n0L)-*@A#$f8WpE{qFkuAM(1rCp8yKEaEOpSDEJ1wd#Si@~bJ??S)^T
z*d?2~<(oZ@-sBZlUu)xe|8LQ!ch@&}&lfjl>KD7@YLu#$b?JoF^8|I>q$a<o?<<$3
zF;DL;6F;f#AyQoSw_x6#&1*tSf-6)kS4Xl+oU+(#b$|BOX786r&I-)q_0~(h+Y#&R
z{W59c%8ZX2qsu*)JC)yzS;@BOqU9{n5U--C7hj#{f4;ESY0HakA6MS?J-C_mCP(0n
zqiY@nNV<1VGTk1bc~5EmrbTBNy_g#KugUzXb^oimzGy>Sr;o^GGmoCXhnBpynqYOw
z(dR=h`@IL*(O*wzpJsoSuur_9*PB-)q0M7``ewh+@?QcjXuTJbkqez__~6Z>FOziU
zR&h1&?&IIO&u?GzG=_Y)zeQKK=)8(3-qyP6xoCK%lvh~J#)6zM@w_f&qyLWAuP1%j
zwKh`Nt#j&w4{m-14tk56j{7fbusnaCF+ckQlc`MMy*CS*GS5l(`>slx6~`2zb#00C
zyW^!(YgRpY`-`K0W3W`V_C@hXqpjjQeQrtVBtC4udsN+_^<`}&OZP#BKeE45q8$RW
z4kcvlJ=*wiBme#A{rWeLM9EIL9)0V<J)@S6BfDA_&6slG|CwXgCu*;Low+d7RPoZg
zoBPDsVy8A*>GVl7I^TBE_0Lpvyf5M&-lWXeyU(+2oz4ILuE4i`S>2s1PTP(I{b2K2
zI9>E6m%+U6q8G$BUk*)fGITasduvw$!_s2Ct6OicyY_lU$->wfWlOcwN<Q#DWp+Pg
zn7}D>zOMJ-=dLf7v%W8h{r~6X<(ogNgAT1cukGe#p?`ATJtL*elRoJOFYipZ6XMJj
zf6!PP&;9%9r>xWzRXNQo+99ocrwZa^bVQ!l&QtEsd@^I=0><?U?#&JJcxGR{?7cGf
z)0aIDb}qg!^^@w1d0!k0tAo|D*p5loBnRy>iJQIDG?Bq!LB<c=3W11w;ZOLlxyEo#
z3gr0Tmb!)Y)~5jZgr!^}F8cY#3vL)kEaz?B@!HslPwj)uqzx+9=j5=;th><2n4zKn
zXA}D@+wdIUnMslB_xGH<QuU<b(DiKb5`#;nUbRz9r!;r|yCcMAuN7qQg*U+S$Ts^3
zPKjHYO6G40)Mv?PFVQXZW-eqlNa12$ynt!)0ZvPis9mk69Os+*+*#?@we4htR;jNi
zgO|HhmVMlM_6eG{60c@mQ7k&{`sUH~=F<|Pi$$8Vc|ZJJzaeLu!F@H;(BCfCW~{6h
zoy966K2go&&q=X*H^CdGpH)(o+&$NMKIGVX`vK!k`RCs}B$Rh+OWw?T@S!?QT;<PM
zqpu>YtMe+AwS3Oac=BsUQ1TX^=|>;S$T|k>wcY*WN9NbC{c&|sFTa0n(Gi}xa__|b
zo@T1a&YPt(3{Ri?@^8BTv+`MT9Gq)6nzm*XJz38DxxeE09sdV%^L?hMnn)fwTVm7j
zws2p%$@^KCQXJfZ=EfP>t-O}3E#uu|eX!=<=5rHE*G2aKIlSEX?dAoS9~yMN*jvR`
z|HG!=vHy{$3}49kq>CTxt3F#cy!^Yo#`{}v#Np?x6^GTO*2+9w=iM-QrkniF$Di%r
zNG2;kEM7d%-uzL;r9C+dtdr)*?7Z;W@0o!y?{@L(>NvUh<%iqP-zk(^{Bq)2`=&;*
zeC~~VH@YugdB*tv(Z!N++-;s`_U?RH$m70k;fD=Nm)G8Z?=SIw#-&#Y=R*p`*IoR2
zcA>#LOLeA_M#pR7-bqaE8y-q<PA<Oxq?1Qr`y;u|y<v>^{$*O85x;V3&8;G4_f@y`
zY@(<6-)>SqbYtGb+wM%lU)LpQ@>nN+*uC7pJW}^6&%7gy`5#I@t=-q#H;YZvW!Zj{
zuS;ia^<|D#TKlIhuPyDpou%wP&Rx%+MR-g4tlT{P!t)Ydm(!eYPx^%i95%F26i8om
z>(gB$i62e>{_$Q9&i|QF^GY%M;qQ{VT-#sIq7>s9&)yN*S!CDE7JkfZ#(ldlGW`c{
zgoR9gaQD*B9A@LG#(95rD@5g74dv!^vZp6&Upp@xmAPbN^$gC`j`tV4v$D3PyPR+5
zKk?b4=%Cg9tt#u=ejTe@rS7o9YH5kG>qV_){>%KH=a?N9Yn$(CvE@vC<c~M$qVJ9U
z)AQFK{m<~EHvT8tB4M>-(py$>GcfE@!Cm2I=B4D97wZ*No{h>azHKJ-Z(V%j?3nft
zrHh4^?w!qaTPqytXZrE>&7w=vuE#H_s4QH@A?I+b(D>i`?c4$?Ka}QA{&v_fcqU8Z
z(S7eXC(NIC`t#xVw&OZWI+q-dbeY_<Rzg(ylN#?KUfF%0;=awB$m#!{H9Ftu)2pZd
z_*3>ReA41IZ$ihtOEZ>7N4OhF<y7yT`XKtz@6|S^S-;jE+NLQk$vLSd-SJq3QuW@X
z9<`s>?i6RfV=*niS$k@dDW}TJ?_7uGEj0f-hw-$-yB7CKA9k1jb5*tP%~%;96YxO&
zr@#?Q-Fwr8w`q8uS;zjwD!uSZmF(xOlF6QKu38#@st(A0b##5mYZU2YH)o!|KmXsw
zH$Q&4RR6y)fak^Un=haIcvbL9{+!;j$v<x%&8fQS_`_<#mF|oat`iCsd7pCnZ)#8t
zIg=PKQtZ%|(copbw4C|VKRtnL+nyfRf4qDipQjYPe7yPQ`4cf(oISip)TQ~>8C*Cv
zw~jBfOU$@C=-_pw8(z2BlsF$1+wzsgPTXn!|N74>^Z(e)-7|mgKIyL<F|lkrS@IWL
zi`IW~d&<!((<1n9OxCfTnYlS@MY!+PeUF15tEq;D#Fv~n<m1ox*uiV_Ro0HV-4ndF
z&$%l9va-U}WU1$q^$E*l8kZdRN#kDZ`JSWg{E<|(g!`$<zNWSBVpR{EbJ{uUyIB46
z1c_Oq_n!L}&HT7lE;_6vLg-kf%ij)8sit^?Tgx<!6IY!1^2J$gi7Sikf*97#)3@>I
zIX!hQy?NGaUV7%dUJjj25kbzpYF1w_s@~D*eDOThH+V&)O2x7}dL5?y|M_3BKflA~
zd1dV<H<<&Q;uc;yG`~lEaa!z|s(T`JTwm{PR1pf9WOy_Dyi&{U@LyAR)#sk5ZJGJU
z@70e&X~_!~uikul!6O#>@<QpmFILOfr@NG}a?VoK`CJ=*slrqtETXp~*>y_t&xSL>
zT6gw^uiF~-b#<h}h0l%(J<n$uDw;mY^bzMR<+ZxHC8kMWxy{1TL(#KxD^&K{^eWWu
zh(EQx!qS!N;N4OgYvsLbz9t3e)oj=z)Toj8Y_?B`#&RDY4c=p|+jb@2D4kYo^ygyL
zx{z&;nvN`pePp$e+53>mR?}6BGM1)??7kAG-5;=Z^{kB@+Q&s0CvTa!KK6LVmWai#
z^d|iDKX>6Wlab<q8&8gQPg)jU+$U<`vvTz^D;2f84?^0#)?SS9>G!?Pq(8~{cKT$A
z3!kL{yFp`)!j&YiI^Twm(Kob(E&oovaNgw1<_A)T<aaE%qEz6ic{3$a%e}ffds^<N
zY?Gh!y!f=%eSIr8*=TuD{{QytzpuTjEO2(z%w)Lp>eM6;24lg8+LIWs++<PWs&rAl
z!uQKA>$6nB`MJ3n^{cZr*yhLj?wx;L?|G;oWA%0CC28*tUD+yW+kLfPr_WLLyNZa6
z(IL5uT1qoS7?WL3<TD+3HSG>t=rTPH#&q7>6%pEhv#0$qOfe0gd9C@X&j%L6y9dO0
z{%k)HdMuKw@<K`)_Xq9Q7o$Jgblzz@Ext!XF<S9@3L}rE21|7SV@vDNE1T~3sBP8n
zHdwaLBD!)lvp(OXuLeCI<t~TyeCI#0cJ;I4Iy)H;FJ@c&d=ih{qe~WjZLj_<yw7(z
z{YlHh$RAp(lcqiqnj`heLU_SskrdZr(LUB&>~WJ;C_gHfI8(}UO1ZIYQtxvC@zS4}
zI+@{2H$BfqY;i1ZuiX9i=G<mAn||f35|=wQ<6N!;3s0L7ryIX3pqf2JI^|&+L)T})
z1K%$4bWe*}xB0v9tf%+yeGdA1@3Ya*nKh4X|F6D0x79}Q8@u&MIr(}EMX{|<rggoE
zKEd0*LCCxG;G5l-wS&LOD~6q^5IWjFqhg=ihuu=EPw#TP%-CqhWE{!4{+uO)W;~nr
zE2(&fmM7vnPQ0Bgp2FCc-SSw>gX5K_R7b&MF*DXn24zL1HuGiA`z>F~aBrKeM706`
zzv8)b^GuZPd$!lOZ@U-u!KU>0U$LoCVXWtRRHn|}IxU7<>dutKZ(sb1U)TTAH|L^-
zhy3Gzo`oBB^T=HJy;JDURz<!Dxhw`hsoh)~t}G}LzjwFu((ertSuKj&?{AO1*t;zH
z(?1FKr%T-CzquGKcRwiHX}0t6bKdWN@2}RMTUY#V^0Km$n^#Y7@-35nB2{wb)#_NC
zR*qtp4qjIK6OVKDMDTI+ZN9qq+=N*v`;YkOCdxZ{zin8jcX?5!#?`C2HM=FJpMIJg
zo$cJ`r4U_qSnA%^bAhWo8uX%BPRT2-GMU+W?Y+<*g}vpg4>aw0e7kqf)&p{7(`2=8
zO@3P$VI8t_o7k2GW|KSKG8M?0zq%Cc9=W}x+VI-9kd^04o}Bu9dn@PqF#UH{4+>v+
zyE85k+VS*~cXQ6;zsDq>^fqq~-~8D5|D!iKbq%7Dhws}J?czHmE#RFyU$gF`&4J!u
ze^aeXBc1()4rXk7yoAw8#@c-5l9l-(&rAyP(qA`Jhw(J3zFK{J_p8jia_3JRWy$GS
zz_mb6J)5hMdrD_}ZSSW!j0%-UB6T`A8E!Ld*p#^3kxPb6>r%s=+=v~Di48O4W-)Yb
z+4|w5Z61^BE87K=M1C<dco-~W6S!{5;b(V7f7$e1Gue8UhPO+ZG2CO`_fT@y`pt`#
z53R3n=6w}5`DfNqyJjs}mz3Up4zqr2>h%;m7k6l(LD3P$YVEp$GE@8gLH8cZobkK*
z_R^|&|InI7+gZ2TSF!DUF4xcW!N6B6N#d+`+`P0BNzIH`tAmd4*?w4_b?`)2lC-E!
z_12>uu5-+j=B_^cO21x^|H2K=r@D+&65q1keh_!{t+igB!?c`WE|I4qt%WC+hb^&W
zRQUhou6xJ#uPfd-Zw*sivEumAD*k(a`OZdfP&fZ`u3cR}X7l_AlYjr@*T-K!dc=oq
zQlj4KBRT478<sNvPY~Oazdy`KIgd$9Xxf_C7vH8FS3b~oX<O4gExFY$DXCpzhkhm>
zllT;?cJQfHd+73FS@!~m+KpTK6T(@H!<pvpD(OycmpmdZ$2~>eXO-Wo`RiBDS?1Lj
z^=!h8gPN|VkDg9luDj+E(`M6#7u!zRE|%~pdv)D1^4awX6>K}A<NvOjU*_6ny=^t;
z_ZP<uWG|(z;p3a46uWok_CxLKZxo3~y}7sNSJXqsxuyxK9s;{RYG+<_WoCGn`pZHv
zccGJ{qs)N=``<G2)bQLhSs(Ot<%1bb3=cjA%$?Hvb+v)`j1PZX+-2u7#+^SQv$?88
zOYxv?y5O_P1`}rZt!QW|Jl>f7Kvu}(;%Dy*ANi83WE>2<t|iQ7*<a(?bv$T>P4A9-
z%F9Z_&xvnYqV?{=RNEh~0)@jC|5A{5Iv!lJP|?=*T75-Kt#-23{?^jJMZr2Ox0cGu
zyge?v?n<dkqqtn_r6Z<WyuyAzao==*FUxxSM-f)X^BEr*d&nG3=i7Pv^1eg+KWP2^
zbpC_c8Rwh^n^mVKF!;Zal>K#Ut+vK4=`Ud`_vqYak<6UU*Ih2){9O93_VlBHZ}&NV
z<9NE}g<X@zq01qT8}k$%9XxQs<%9LHWw#qYUh=#1EwSy~mlgjFXRv+}_uHOu`q#`!
zemOs0zm}SDF(YBpu2BD370+daws1QB5$pDHu3&i3cR%oIu88Amjw@l>jmKZ{FS%{P
zHsPUF^^7$&%j0`%eqE805>?hM68+5jFzdnj8&1{&6WF*FzOw&+@OJj;moH~ee%bil
zmASFqisQ$w_er~El&|^D5bK<r%$M?OZt<1vF{bX0y}y>k#`DjPpSUG<V_&CCgLVl=
z<*}s5Lwls+T-DnuSotU4h<T+uOZVya$C=&vYfEw)*!7E|K1+E;SR7t>_Ktvwk=#5P
zJ4NTx^?%Z@TGlAHE^a>j(o*h)%#~ZNdvw;M>)buYmzRCtZO^vzpK~s3`Mvh!4(qfV
z^R3HP?){s@cyjS$lhlR2H$E;i__E{2ZOer=|0K-&J#Sq$eWrKLa?MZKVC4@12SY-7
zx)00#i4TiXpBO)jW5Ip9NjY<wc1|l~Pf4_0D6S9}9)G53#$Uf~{bOhS&vZP>zQ3(>
zhKTjG{Z-jqfA67Bv@X4{YU33K1_pgb1_n9Q9hSw(MVSR9#rpB_nR%Hd@$q^EmA-zb
zy^c5t>^UDU@?_J+vzul%x680x>|P*np?QIl;pJqvGPy4$F8}X&Mil<O6nix`H1^@b
z{gqko?szB$7iVj9Z0_4}I8^Fbr_|ottGTWl{@w6<220ibxCezwcY^yE+xEQ>n5=Kb
z!5gP}`l2$gk?bAoIsOw_|DL%b?xpFxEn}0!@%;H0TYEFDQy%K}#I;MEeR|2dHRzm@
zi=$=K!yq4{V$N&Y!HI9;`r0hw9g;S^lde10bmZb0<+*ocuD?36vL*MQoX-24!f*X0
zd%c;x>+*JA-xanWb(Hb&A?a7_%nS?`><kQw*ux_^CowNQEx#x?5j6E&8=9Ma+d$yo
zyZD7$MQ-budD{0na4n5aypWs7ofFU$_@;Q#*=ap0>1X%fe|dJ}<%=~P$uD>Aem<}I
zr0LI%|9)s!C#e>&-h9rrBh8d~r^<I(UH%DopM8EY%ckR<%FTZZPQI=A*qFoTu&+UA
zPDnwETZ!&1LEbIBi=w)wiMZZ<9p@A%aIMTK%gIuFR+ie1u0;iE-({zA9oqe>e6EP9
z#?w6|A@Wk&xb?36c=h-Brsu6<i#W?4-i?2Lpx=ipud>pERmv-N3h&e3Q75LoV#xE=
zTI}FHfvZz&X~sl(7Kx(U-nUjU{Qk1YvFO&CyOk%L=35>6-lDasa}ih8>9cOSF*lYx
z+tRx9Y`WV6R;guQCgprmud&nC-EQ1;X?p#%ly=RB-J7-hmg&v@6P=#2q_=gM%5G`S
z>GlfG*^Jj-dzT<7_@`%*o>=iFrT#6Bch8Ehjx|^lVA`3IZ~Mq;VoJ;Gi9hnT&N%+^
z=7ar$=9}6%52^QsKfGT3NhUo~)nC#}Z1H2A-<&~QlKJf34)-p5FiB5dDD&b3*KF?v
zp&P9;13a@PT01Bi+|hn>Smmhu#jI;qK|(weC-$9CnE4^-*OddS(s(1%c=iX@ho3Ha
z&2&-9`q5d76-(1U=RJM!JjLqd4!=k4JdHJT$|6pv9t_YsvqR<iqK65wCu~Ju%&K8u
z>g&^6Y<;5DZo_N;bAn|#c7{cof2R60UpJCiCM?6%-t>6Q=b#X`$F3KI`_ClLXk<Aa
z>wD|YH@#<XUfc>zxWb*SxPSWZdp;j--TRSb72&sf)q;O^2i-PCE(q9Sa(H7`?xEIW
z%ewDx2wpT@HN<Bh>#eVAR-ThcJnpX;*uRaxIo#~1$tD9;?=6l~BtIXKe(LOSf9Acf
zsycJ3<DUms?me<cC&KqKd*bXEv#ZT7W@{;&ifev7<IGQmaPwDMYUV0xh5w>AEc|-8
zcw?=rcp!)Pj$NUq58PHW{)~HbLPf5<xBYGV=9bv=Ur*(9n%r;RYOZ~Jxw-7`%%1g4
z&L%Id{-=M?nzj05&V<@;S?2u`zMp36JT&>mj+%?U@^JEQU}RtrW5HOy0V`F&xu_&F
zr4qD?FZf{A9Rq>AueI5VHt=Roes--@#HmVi$%YHIB2ETT)o(;^OtO-i`tE-Cv^8hT
zq>D7Ju%A@kTlx9e=NjhwW%Ku6_h04wcEi6*i_=Usmgw3<+?3t8FFWrjuZ>i-lBt~J
zyFB}vmcN1zwXGH}JU-t-(z@LyVajF!=9!YW%09f|ye)Pmhu6?!Ew6W&o3-L6$=<L@
zhh?nmH>6mV=xvNRdE8Uh=%`+ccD-}l_M9_Q-WSbT`6FejoTJqZ?u(BF81Jfly|L+)
z|I-Cedv1H|Y-|n>zOU_7$oh3Tx8~W!GvBuK{MD1qVQpzQ__AETaG}%Bm?KhOgBIU#
z2>kzn%W~h%4OYvH#8(GNw1((kjn=yD`1e=6*Wsx6mAqds<z-C!)6Y94aZMig?`NKt
zb$k=1uL#cct9o>T^WFK!`EnUwx|_>BE?c9Q(EH|h*t+kjf$N1*w_Cj2SCG?ma)yoA
z`xMK^D-SFDv<=A1J}M!-S1M)QiygWZ;?g{S^$gr&PjIeCm3unt${cRBbw0Jc*7YZk
zY~`u{u#0=c{#u5t6SHQi9y$3?^i9#NpY<C5O;RTPezo}Q&KIvERqN0;J^${wxmb#c
zf#D4^1A_vtA~Q8HucRn76*N?o8+@?qwt>Lj-`Z&>4;red-E`((7^!j7J8`#&S-TU5
z+eY_~CApp+kMFi!s(&BRH+jn%ze^ckp6#t%%(<tg{*Ph(A|c-cKd*D~PFDM({o_$c
z<l{ef@hZYMBFaCNtdV>te%gP-TETsZ8`!jJ4j<bUc8_s!)?}CJ+fIQm`mFn18LwEq
zmYiZZO?0xUqUSk7>0_}LvD-_JU+GbIf12I=xYNJyj9^GZ?xc_v2e-cwJpAQCV6dnt
z=lcV7Y=*m<a{swBmJ8iVH>ht&&n}qSpp$EBFu^kYSj2v{4?10YUSv%u+`)RgZ~@oB
ztb{<hZqK!+l`ko&mUq3L(`416nI3+m&eFeaxz*hxdOZ)A7~dZ;Jt2I%MChgB1M~Yo
z?K8jeJ7gXezx+_OA|WEa>))1?b-DsyZ}!fc9$sYYJZYC$v!~>T=_RRbmzos)7^|XI
zrMIX?*Z+!`730tUKU@0GDR%WIRcs|DVQbvqujPNe_Pv4i?yECbemc(IGw~bGilFre
z6}6jpo9e7T+NQQ_HrrIecBhvo3r&prlKA?~PEF8Km|VGOF8lAi11Fmse)_tf_ekv*
zkv(^p(=NR0YD{o5zxhhJ)E-`)WQAF&cW2(u+c@9x6@TV6{w4c_-ZmbYn^^Ms*s82m
z>_-Y?e)s%2wxOag-1(kGYg8cf#AQ9TMTgTB>pf2E8?So%|3(#WX5f}CpTH%|6Zc*J
zw7Mwq*S6?&-y%PWqZT61Sht(6U}0c5z{9|xf+Jn!CT6F`7nSD4CzqsyYU8EhzWKK;
z1or+8-@qAgGTPm9!*&)f0hN2MjoS=`#H$T>8mGCLC3l8+YHi*AqW-?3Yps<Z-|KFt
zB8&HD+2v<m=6}9)(sS)&=NtD=NLp{+^xx8J=?PDfrAzfxT?7*=6_=<@DPFiTt!eee
z74s&)Zt`ON8ZmXXQ<ub)tTeNwX_3aaR-dYM{Hm6``qp=z_N~45#Cz6rhNjp_sZJ1z
zERt`$a$0mId;E+`+)JMp`JBt+c>F8N<%4*)&2pQ-UeDu2o=%%0bf#bXkZHBMcF$aU
zn@3B^Yir;3zWJj0Q`*8~RpXu7z3x?$o-J_H+MSg=Wyj(^^Bq%P8?moTFFWe*aCDNW
zn&rap{YzXMpRJtGqUI?w-K*QCNMvu}@zjKCD?dN2PVY2VymvG5kjjy$6SjPYvI0pG
z!c8qNxTh{G@4qZmHzi|gOL63(mK+6bfyfhUPsVPZpW*muK4;y%7E#eP8l{0*t;~6!
zWUJ=y;d^!1@XE_|4kjKRTjwv)Vg9OiulexgoU;~Z`5OOAFeS@hFuMFODRQx0$pMZl
zB4O2Q<nJDe{!qH!q`)^+etCSpef{qFc2*Ov>{eCZKWp00S|^bi*9<%)w}}g8UastT
zVRiCb%ir4-$JZ6=ygB|MAk;cs<aSi+H;Eft7tAb;n{0Ic`^00W7czeMe&A|cs?z+b
zf<>=8S*Y!aP=EHN$fB8jyUfI|UaUM?d;0KAeZ6U-(I?_u{|M}Byn0Av(oCir#(meM
zC)->%G@IU5uy_0R2^&mUUutF52?flw*tsSsxlhtrb;C_QDaDL66Ag?Xnx*DU-*w8-
zt~6v(?2}m^h1}Mf`|xwCh)DJx{O;$YUY#8L&Hcnt?gY7@-gwWtDNfB&yoF-v)4jWo
zPAfg^Q!X%F>eodXwj!^2+tw&d5U<KNUcAe2k%h1sPwol3bHd7Pxf8t9XS~XD-x)cf
z$U^$^p?e(9PDp<J61BhW>*hq;goZtDzUaR{rt<39vEO&iUleBK_a}U-G_y6xdGyln
zR$qyNyzZ&v|2Z$a+&8S5b>F^bzI?h#&#gwo)YnOuI`+m^zdIv$=}oHS?<bW4YpZhk
zr(NB0<?|-hMNjwT-|+C7kpD4X{wc@P087nwS+fw8ZDkhkjw?HU-JF=0a%9d9gTt?k
z3qQ7AO;5^`D=z-IcE-ayY>%W;CTz}o(r&2aaJO=8%DnGpvUi35O!0Bva_e#97sFW#
zl<pWc#PYa)|0#6mqE2&4SnskRu1eDrp5e_CYQvr4#jiPZ8{PZCZdDfe`oLU`Z+<^l
zE&i*2xZNd)Thpyi_}`&bpYw9~@2(THOK<u9*s!@#&)U`8?dw-d#q94~UT3!1)u?MU
z_Rl;N6H$NBXKQA;R!B8>j=yGo%>vG2s~oM8((2yr`*H3i7k7XD%qb65FBWats`{B%
zZpDm6DVKs4-efzmDkU<>JYZUE<zwY}(*Esi$CI|){q#yPr+mh{yy(*}E>|D?<|DFi
z(_h27MKPOYPWaBgc<|D0m0e2<z1a`EpK|(G!0ahD$u+OPUk<hX$o%+@$Psh*eP`DM
zvc9}7cg!#9)-`vwz#|{G_WsX&p!?P}&`+{oY5k(c|ArDtx6EfHv)wqY-+g+uYSk~a
znU?vv-kKha3=IDmao3=^De?J5@dd?t1;vKB6a4)TIS3qm|5rqRDZ5lobCq#MK+h>x
zUyB9mo3{m9-FkQJE~`q*`*$Z6eSDy{d#3&SziOLpeSD6GEZVf}=-V^VLAsG8*Y*TH
zTr8(IeV^Gk9^<H2u4_N6`NE_uzNtp}X2fdIn}=@b>HAbG&YS;vNtn(C&&4M!FYzrt
zuXN<G>*^hxzce0xeys7*O7HyS<1b4?q;ixMLVj(3vYB&x@Y_9?SQF3v`ts!I#aT`c
zC-QcDG*Y$`S$62hx1*W&G`(+?FFf~j-ip-S4S!e*B-NJw+-u@`G}NAB;zjmHi*%Dy
z_{HkG=SEI0H8nkJzjy2E$0hrj47R_~+--brv3!2}?m2dzI#&-)eCHbe>GgY|w@<z;
z=ygw>w(CgSA3?2Y8HrQ(Bre|jqJrbRt|iAkt@Cb&1-J6udocCEw9uoh?4^gA9k(3b
z^{nlJzeMC?)(LKCN3^wYtoM;;WMEjrh_UMg-e}D)0JT?r0}gr}b`aS6KHTP3cdOcx
zkJp+Nv?5+OZeU+HWka6YS%*#1W$GFBC+~kaJ;%khJ+-{;`@KCkBOm>I`A_xsX65-B
zx34~Fm0q^v=-Y%?@5q_rX`Q<bVwC1bAAHV!YSEpPs@UY`tyZj$1r~|&-7_)#vSL-*
z6vLp<#_Cp<YrhqYl_fVv=*X><)==7cqS=9Ij?{vOeL`y<ls;M4R^Y$Wuzi~FmkGXB
z5=*wq3F*H%KY4?iqIyNP=PgcN3E{JEuN54Ya*TCa|KP}Sy-fG7=FieMT<JS>H(zyn
z;-Z@^&4$aCu@!y^H=B1^ti9&EXP@Vz%+@z-Z&I@tEZkh99$fSNwEF)dF}d!`QpKAr
z*QQDBwZ7zUf2Ke0iNB2J_GcRn|92g#L0ZZUI<zG+;*XUqCj&#YCe9It<ovSKqQvx6
zy@JZCQMvuMcL@G_7k}{Hwh410yv)KE9A)Brx4|}M{SG$A$^4Al+8n&U%!>59GV#hS
zx7+{kNp?-qjQn=$x6lI~ooiz0ZHH&3w;dMLKe4>O{<qNIQ^8?cVt*%X4EijZ{;BIv
z#Kn@ci^@OVKFPXM?5f|V+gsJ%-;4X#S`%md$$y!Pr%~DYqCn9D?k0<mrfizDNWpW{
zs#4v^Ndj>pPFYT;gECg_)R?+dGvL6cXO+(~A}Y@>)d;+?M)KUxBBMf~C%LXmlZ=%f
z`oF!>!|@~d>!wLcsa*TQL)JI4${h;n^M9`ucTZ^5iRUL(lC>vwRja+!<#t`WI%>7{
zC(D0RwQCn|iD6j3BK4GzX3IV%$4kB+r!Ku!pB3_5{>dY=lRLKT&pJBEX1~7BjCWl+
zttZljAJyk2I;iEGmf5YEC-3X|W!{INcuBi}vZKYzPRzNZb4GaEQ!7!)X7zmaXPohG
zmrnXQhvneaCka*x{}sHhb(|2DR+xEneS$ix95df})52pWvkpyY(LH}9^TGPXflVBq
z2Y#>hPL^m4G}y_NU-L<lbI}PuDV=52XLlJ%|2>;<uV_~OH1RL#Pou<lE|tG<Z$k8{
zf?FKB8N@H~d<b0kLpO8HUZ%UI7XA+}y|8_18T*Xqj*|(CW3%WY)#Naz6cNUbe__R(
ze^_<1XFa!Gq&4l+)pHILLwwxCg35MHyDKpz#Aa{sl67Zv+OHUQEbqAx!^x1|Y7o9+
zeVWiy>9cDcn5-u8oZ)=9)%Ua1gH7$5nL-?0o_^<PV!xKIwpn<sV#12q>qNJuXtJg#
zKkYN%`@dxBzJ)WGu8BB_`z*V*sO><Qk8odq<VBy$R=&#~h%Zdyx%p%DgVYyCWgjTy
zbu@{E^<8_kO!Avz6W`W#%>s-HruIr(+zd8P)?-V!|2SsL#wQ0-d+s(}PvWuQI^nMK
zhDpD|zI}@17g6UUr%fWgqL#frlB%#;Lq}MmI{EYI2P-xyFOl4(IB|0AlHb>yggwQK
zr(Wu6-P>axyMrO~!p}Ote=_@TH_w^Wvp&q{k=}x`rOTp)%_nT?h}fxM_%lfM*~-bs
z-ab)Gj-7F1d!F-#B@=QlD;?fi5vkLWa>4UO-L<$aMtTB^eGM|TOi#xIBpM|8R7fsN
zwQ707X(B!MQAw$^kL}%d8^b4`1+%|Qf9iARW~0?1o`wYbP%)z)I!)=BYYlg^-aXr~
zN3AhYn&nC3p1n*nKEIXgwp6?!R@pG~^4s0}bme>7-#>oeJkR&Lsw0o8Pu27#6B-ZC
z6OAwT{l9CsC4b$4klP7nO#*Y2nj+2j-h9PSQua_{vF)<tBf4w0t)06&W}Qh#X6QyE
z?!ynbJ@QU3{Gt5E-s*pee)m(3SNn=T1RvbD=<tHxIs+?B$<qoUTMnERW65$$xV3Fp
z)0+mxE71$WH^;~w<@_=4)cseg)pc9GY+|pA6VSa_r|RGCtG)W;ZH>ls=I58=9wvWy
z`SPR2p9k+g7X7%Gv%3C$XPVEy3meY7Oqz0Jv%?3;x8DnX8C<qc|K+gXw*CLcW%jTB
z`vpFi72YNFIQT)E==alCoSk{JxSIFGbhhtIR(Wmsc~Z9DXBY2TMkRb5g-nUYeQzr+
zBu*-=oWgjl>PSiPoEdq$jvPzr__|D~<ax)osE=!IYj^%CeR7pCq&?MIr_6iRI)e=l
zS0`A#%{GYny5l_S&S^Xw-5z!v;%<>|S#yIyTCDnn#KWIwW$FahKl>mqf1<JT)|G>y
zn;xdBnQ6&HEQnmPdRf6amhci8alh6I&)+kO=JU?k-NC@z+TP@Nh%IUQQ~}iuiz*o|
z%KkN-@u({*OTczbhI{0KF7rv*V(XgZ_x<jV7y9>p_c4q5D$@l?+wE#L$zJ)j^vr^5
z%4-%}TPvvd@58dNPiH4h&yT3&XZTg#>1r&w?W}yg#iH#8?k*Czx!{&T$Jy158#Q@U
zSfB0tKkHxEAI+anm+RZd%KIfvvVHVz!Lj4*b*1;Y-m`t$z|MbE&+Sc{d2V-F468`v
zZ^a|6cS`$AlXpJ+(bao=<JYh!K`$eIrFn1kZ8fxE-&u2~?X9`0TmFZ&#mn~BA1~p#
zd-u+<E)Ca|YpY)+-Py9<uOxim-rIU7>=jh47-m+v8ZTXF5LCJ@^beEWvV>R62j(5D
z-Z$HC=ARzp;N|lU2KPVj*cbZ$DAx>z@3oH<&Pr}`+WJWH^RHcO_mAvZld;QTnOjxo
zg{DK|Q?CDQ?Mbq~SXO2FX~qv8zZXYWZ@v21=AifEj@rHLi}e%BGN0XFUEQ{k&+A%#
zT1H(o*GVO{r4zWK_m*;+=6^eJ#Ohd}`<l11^NyX1^*r$PTi|c^)32QW>{0zKedAw)
zd05A@TM;@tj!B)V%-wRcnC+X?d)2LCvo(@ueTwN#%MuWsyZp8Ui_ABUf9v?8d*=Ci
zGN>zU>pdIzXMyL3Ikq#@=U<6sKDeof)#hFhTVIJo)Sa&@_C<PMj407jm|&r`FvCLG
zeny%vi)pZ<VUXO-?KWMl(_cp0arP~*3X>4Z&slc(*(GONoscIhZFP9Ke&5z9UOyxB
z74w;FQ^u)QTEBK(D7qf*TDgnoRbh!=zu^71tsYCuMYDVCw!Yma_kP~}iL<AB+Aj6*
z^4^r9u>IKfTkF0{1W&y(sXh32Rh*H9!<4nR&ZhFMuyAJacrN7r{n-)6hQ)e`3ELLz
zc=9y-)pL>Ece0l!MS0h(pZT6cWu@#*j>_e;t}$P0k)JSEC$oy(qQ_P`GFAU9b8$ZF
z=gGSd3;ox~&)(Db;bKpVWbn!-qH+B*+3l_W%YKYi)?F6awlMKX%MN?f*l2;J&l_8X
z{<Lkn<dN&dy1Dm~`l4Gs=b5#0&VI_0+tP68Sb_Lu_mZ2lGHT>Pr6O&8KlmP$aNQ$r
zaDGXj{>J4YzdxmHsq!_dS3A3A!@M9h#omjoT_;YM-nEex5%J;aQ~A2GXwghz{kAPa
ze&<q)!s~^SJ49PIzqP3-(A(2=E#<)9>TI9770fI(#kboIZz~V#PkwD1J#|~*pNiZ)
zyS}MJZs)G+Dv3{-zi3nHBvnB*&cyQbLbL1B`1!s|Z#<iqSv`5(!!F&HbU&Xz2^;ST
zeVhF|@4>>!O^dTv+kQV#FIX_^>Vu5)FJ>g%X1uTJ>B+t4L`V3|NlO;&@e!(C@Ap<@
z-^&Y%@0@-x>y*?NS8i?4ef>WG<w)VPpBJ5IV`N~M!NkCz%z$z@Cak@hlA2SVS&~s)
znwFMXp;u6u8gwx0F?gUg?WLmG>=`Q6+`b8!`mJJIXBP@IT{yP5V%s+lkD}XuYTY+p
z-moU`^Ot*jmS4Pc;PmIeuis4MJ0Y0PZ(5|}EfMzN_H5_o&8ep0<^|9HXkOUpxnYie
z-N9{+6^C9(WYrwM_S3Iq!i5sAn-8om-1@eXe}!ql^H`6B8L>v4GVV*=&K%V|61->1
z%O{=v2}(IrS6y^^vD4t8MEHiaa+=FxeG=mj<uD(~T<X9VnNgT9^+Pi6X~uKM*%L)4
zOWo%8@_n;*>G@OhADCIF-xEvvzkC_PNzSXX2FG~s@NMbo<P*+Qds^<?8TC+oX;R=S
z;~8_#^In_qw*2#7Ng3;&2TApvmJbe{GE~3%MCwblqQ)PY(+3akVsJfY&1%c)t$WJ2
zGqvbyd*=NvMaRmwQ(4W7&)w0sYug}NB>UN>>)^6K(~I&hZr7d7r#j(A#pGG9)+@^;
z-}q$TxS=Yq^L|%%$pe-tq6srj*GJ#%s8RgAVOn|CUCE@i#}%K{pF2FYbMJex)wL`4
zF`!1{rF+u8Cc+F1`Cd5N$0?}=X_*zNMWFVv&FkRXr@r3*slDxK^O|E~69i@%Ee*~y
z*ju8or1AD_Nxj7rmu}rF9vM`=l%e*|d)svROY7v0DL(mLkk+L7*0MUTI&SwTvz@;x
zK2;W-OPa-LW$B#}w#jnwp9wPJfqRxrzJBoCHM7e3;{9`Ur>R!%-Tgg{>A&oR*Q%=G
zAx|VdUx?3oc9g5Z({u6FYuDyH*A{B~ylRaFuk)cW*K^)NsgZGRs;7-NZr!>xzso&w
z-?OjgjE85v-_tdFb!zCQE&Eobv7S%X$~y6BW5UfQm!_C(tEPn3lw~<-FLpfPd}^|D
z(bE|^8E%y!mkd&w^z5Ipo^=vD`|{egtNqs>Uj4fK^<()Hf|Z*~i)8C&`1vnWFWA~1
zKHp9*{(pyf{?n`e@?XBbwtrB{t2sX|w$5VTj7JY@_w2FwT_IX$WzVVKXWuq|+4CO{
z?!N!OVfX)cU;o|Ko$w?6QjOSB6*tuhmFGNXK3{pm>UTkDZB3n=(xwl;J_#}UFAibY
zS}4Wo=(osdSJM9_j|#dEs4pzOz<fGFvQ63X^3NF}s^SI@CT!sOk*ehL@Hfwf-zlHe
zKPjGH!E}^=_G`wkvVTMjR(^M1zt27K-#o$kEVl<|4)zCHwf|<VblsDB-dII?>2tfE
zmd`sItv>HMZ*pbd?<cSBF(t>HKg=idVU??MU*Cy?`%X_}vGEhioAB@K>-u#c_r12;
zJLmj$#>0;jZ=ByI@oRy7^rjb$`>Qsve(INF$#P+L4&N^8IcM$kBmbg2zc89ly0QN3
zFT?IIoq1`h^)gq@-tkLWS{RzVe*J)bn(LpBZ$7<#6BokzRM~#T#;gS1=exg!%<i4}
zI6Fs+^K=H|f>WniL)q%S=cTN4F%~Y6Qe8Z4Rn7mj@7uaRb651m^<47W#gYBE@FVYw
zI@zPlEcVmy)fL5NWee|kzGg|(|H|n9f6tu_jSqJg@?9XP{b|>$%$7&LXFF$yO8nEk
zu<pk7$sct?N;)pQe%p0SVp%=Q%)?GU?6*94@F`(`WTsc9gu(Kce-i9n>h2uXoTj*g
z?^n(5sBWoEz2Xjkf8IN`wkdD@<_5{<nOg+z7nZJ{|0sLMA&Cou5lfid`Lks1x#lu;
zc1tO_uov6S=Z^aJxb0)?6{|Bg@uIh0*1P-iod0lk+U!kl-dQh9yJ_=(eym7FXy7Ta
zo8Lo^3tz6$f45-WuYb$7l}+k>w4qDpz&*8(Ny{Fwo-tL6*O>p*iJe{H!L0Bt`fd;A
z2=N^|vHzWNFPq$}eBHw#ioOXGtlFdAAL}gK&QMnT+DS$0<r>B}DqHgR=*Xsjp15Q!
zXQaU`(Vr*$tV_OxCh{%SPhX}gAbu!ZGSMy1<vq)3$C_AQaY1pDm{mLMe%v{cRnao7
z*R;Xz$QF&xlZG14Enj>Ko;o$hb$P|p?-6lxnid6Qyz{Y1inuKG*l<$r?Q<KZHmH28
z`(4H{DZ2C9;l4I06^qS5FJ@Hyxq9Zc!5={bBSnXpNuF<PzUUfe=jG(Fgg?A_^y$fx
zDcuT3rEg_11-7lW$y~|DcGP=Eu7;t6oo~PYiT$rn&$pi&>%aE(%jYkv#RJ<f_wL+k
zG4GW9fdcW+_JG-?^%>9V*3RhP!kQH6oNLUnPi^D;h2g4^aogtYPX6+wSy^_QiBH3w
z)SoB*m+|qsoea5Om7R0*)6xfPHLq*OdmUij|Jt;rI4aC$GDpsamStuE=TB|Cw%GP=
z^V3}ixt4@G?XQ?)yGlC1HstKwN$!So9e-RX-<P&++xyik_wub<t+dp9)0_hVg|`#D
z6&^`E=R7pU@YR9sx=ikO-pIbYKk2^1mk-OHFQ2#id2Z2O7G(j$^n}OUQCvdqnO?#{
z&l03=vJ^}<di2S2=5yVIiId~C1BFiT75RDYT(Ww>^+!HiUeEA4*tq%P9qXeU-`A_%
z`rG#ZctrXXL4`RdEbc_jeiX>EV%f#K>A49~ua@i$>tFXSYENcVo=It99RER?H_--j
z=N!6l>HHa?n3Sn^Q-AJFa#!Osvu|tLUR!ed#InsTa=Y$-yO^60vii$Wj^&Yu7U?Y3
z`&#vOr)W;{eLt4C?IP(jHeaxgUiit5SMu9S>zT8*mn-bqxSQ=8-<?1H$`X3f8wGD4
z3cUY**<`7^T3yq1sy%x)co-~NciL^Y#P8s^-ib-qwypd0=23C>d9i&-Gf(S13)p(o
z_4$?Ax;c+rH`+!Xs9*bL+To=KH(!a?xjs$${E?ZVtHqC~?_=(LbTpI2C-Tz=U5)6z
zm41KC3w^hJHH+igzS`-K(TO{oSY>bS`975)?U;g=!e1Y^y!V0U&C9B``b|uJ%6B4}
zV^T)PeA{Vh`aJf6&+{IByKqkGo0Q$V=@QIxA%{Mk&eM)(2x)u7ZZ5L^aHl*+D8Iy#
zw0YOhGKFl*p6;vsewOjnHU+Z_!b>D4#3%ev{25bsl;bL|qk-dx>~ot0FJyUUp4)Wf
zMdb4mt@RV<UUF77o?8@q%EjI*`s$`!{!jZ@MB54%Uz$B_?ma8BLl@lc+}dMqdTm+S
z+2pUk;{?;H_N<%YdtH3um9mS0EmEaVI2NoHR`t6!ZT;-2yIVg#_|(Z8*e8`XFVlQS
zr9fZ%ll9TlG=$owrQY#ak$ZlI`OXyqKIhnOU(Q~)THSYVq|g@S%q+9Mz7u)jM~nk5
z&Ykph{#@OkQF~U%9p`v+>VZC&%5(Egi(4KA{r_LT;flN4<t4c*9GxE9EG$b^QJtW?
z=WNwpC&n|+%&v1E$Zejorzh?0ZoTehZ?A?aWQ#<|XS~Q%n^AdF_`|0P7ydm9Cs>|#
zNW7}u$gsES&aAB$Z!=udnslJ({>Q1ubieQa_3HWZQl((;wW-0%k99lBi$1SjtFfbW
z_e%GMO56WGyH>q?@i8-t_lPbxt6|A8r%E@=DchPDZ3D$F3p(_xW;^c_Vq5clnubN3
z%hMv}=)7%Z6W;cnI2$N)yfACV^PBFsi|eLZ7MwX4*QH;&;zj+;&8Bje3y&7deEh!o
z$FC`2{^IKezpI7q56gSDdFA_go7>&Ol7kAk%HM>%&c4JF?$UA1H!D6UqvI}1>9xh;
zHTUe+ZrC_uzR1UCo-qvbI;TIHckop3rLWbSdOQMpgANr0E?L8}@?AyprY^ZBPcP1^
zH@><1ErWRAqz4zBVtFUrpBU)1d1BA=6sHfn556zwRbBkO>e;N0aJHut4o`g{I;THt
z)$;0jYiBvW(&=z~b1UQVq~j^;PBHGB@bs@iVoXb_T+yym`%jd;7uC&QB6z=VqARO?
z&h^`$ZfNu!EONWhaoju8yO8B6*A$ZlcBii9NIc!D&#S|-{7vJTq8c6V`Jzfp9)X2Y
zJM7j!W4|4HYHOd0|KB$eJUyP~%l2@1JwCVFXuH6^o-e;A34}}T;V8Yn()^D^f%=b(
z8TTH1o+_JnQej)@<T<OpeKY#ywDGv^O^y?i^S+(c{;+<*{f;xMO=_o9N9(A4X*?$S
zq~NaGk6nj60@okypKs$k<-#?KnYl$%4`+oQ4$$B^5$oEoa_sh}j*qLnyu%oRmDX4A
zMDAy;naOx{!#U301J_c&aY=?4FS<6{Vhf*I_Ex6IvwJ5l?sU7q?)aLEtf3QKvKFqk
zZv0r*KJR^+h#S{iS;2r1&eMkLy^K~z%<?HpIX2OSn@M8ng7xk*WgbWh_f#!hk(RMX
zS^ioHw}XhuG3Dn%E10&sUua$Z(&Q!|i&b}(Wdg&h&h0l}-;(p<@yU5|;M>~OW}SVx
zR}VbsO<Z<fg7t#-b^e<D>3O#GwkzsgysH&Fx!+Dp4V1S$TA;JkH1i4jhOL#Wg5)15
z@ce9Y<eu%4P|dW@MYSS2dFRo)O6N9PMhiq8vvt#4e0O1<vgwt`FAT{VjZwUIKNoYx
z{AxS>&MSfA?_2f-VP`iS$~C^iyXKS0d9eg0hm>U=ZAbZ2*!QPAG4ka*x&I&YeFl;J
zf6W-8BV1FBx1QX+XVo14dzJg1irnsJGdtg4v0rq}g^os*mrE{KuP|lMV>-%pEUxkD
z(N9a+K13L)6h^La6O*%zIu)m*yk@UbM?~?5f2ZzD43|}V@LD<Y<aFHx-bjxpF(#Z>
z?4EYH%~UYt$V&XO`pC-XK@us^ta~nXP4l+Cc*E^EE8prR2fU{i&T3k2u%d9bw%5e#
z?mzlg%KI+49JHm5uV^2KjAm#;;RlmL;toYc?wO1%hQ4w~l?9VTmul8&7AZ>X$d%cV
zBpH44`O@vG@*J#_9c#{~Z&<W(o<m>JOeu|TEj@f)?tw-QYdN+WoIQ})XwJ5}X~Q9d
zSW%a}IgQ(b=KPIY*RpidtdM+`?yf`$Au~BI<1eBcZY}xTDP|D##HiPKqsCgVve_9&
zm93>O?n^(A{CY?8K6l$|nGWXv_~zWpa^Jp>vGm;X>rZAm8tpEf^-A_q+bo&;Td&`I
z8`(QU?T|Zbpn_}IO6A>eK3ZFLwcJ?Y8gylLo7f@gYr4E&PW;OFlUM(4t>G3yxlPeI
z&X&aodiOf-sa;%Ht{$ozT)frySDbdzi_HnSoArwhdQM+;%5ZNX!xy$E7J=^K36@W0
zF8IG9;n)|$f|Ru`7guTK-+1^o_|sd()!JFC%D)TUpO{VyD|<cj&6^43cdL$x9#E70
z;OG{`Tj=Tg*^Y6++Y+A;^V3T{7-W3m<=lN$(a7K2LL^hY@$d8LOZLx`x|Ox0?!4mG
zT$c8i85c^P)w~q^Dtq_pr_@*6dVGHrQ=Y85GwWBz;Z-NXm8Q&H(s6&Y&vWr<2BpcK
z^A6<PN<S*G`H~^0qsdw8>c!If$Hkv6nDt%l$9|XMZuVyiozL9QzHT~r^2>YqIxG9{
zy(--fnqr$-?tI+*P2<Y6Ijq0q=5ha8vF?i8TwXi26v227&qcEsl<cN(_)b?_XTh$`
z{aAG0l&5p!;{Fx<@!ZSRYBuXpCfAwV)j{c7@9EE+dv)2X9jyO24V1+4avvPD-@@k5
z=p5sFSgO4uOLpGQ#r+9V6%DIfFP-sqm{fg^g`p|?HuJCO>KS_JLfP^PSvMy?d&+QN
z^5^fXKIJ`p+Ul6TLdtVhURl1iP=-pLRrnr*DucV36*qL^Q>*W9YEtEK*{Q+1R(ezX
zyk$k_)ngcSXY5j#CM-66m2;Qc-Kgv56wg}iJSunpfK}k0mzQT|zrFJANX#QI#m^jC
zttmaC%u|+YbszfWsAe1g$$IMJ8z<M;aEDL7U-jHXq5i1Aq9@W@<}BSKv!Zz7|9x89
z_aCa=wJW#lcJ3X~`c*Zu%?Iy4j9Tqz^;aU-!dFOT_gelkS4P&>nC<+|u1|CKZuy-Z
zzPdF_ysN0uB)rPgdJ9k3|Fyq1CP%zjcxT&2Ev{9QCbc|VxOkFtXJad48ry_NPg5oZ
ztdT4^;rK|+pm*1niw$>8HBE}vI)$W3J6h*Xa5ibLEh>D`rt|Pv_A@sBhWfnf=Q2*$
zW)*jAxi)7Ti`C`4$^IeBcvF(}Yd@u1)~Kg$uAJw5uJQe%W{dJCca6&BZnP<cmoxDB
zeBEkmx!~^I4IRmy>D3FPrNj5@zxop95OrzeLXRp(ri6S|H``pkZh_DrjD~D;ow@jO
zt{V1U?wW40kNaYa!Ypf%7bn&wSuHtcbc}CXkj|4-CcOpfKk_;D=oM$kcTS%v`uy#a
zhpz$~t}MHewBVCYU#HD}w>@)Tn=~ePXfd=%o;!TUgIP~++4bX-H}fyI7C$b3&To16
z^@B%Omap!ZlDWX<_I-OFxo_V$Ok?V2v$8Xa6?&5PE=~4@amehDxX8fm)iGE7QlGpy
z$8==ta^t?L@5ie9pEs(@U;OyJ^pnrru7YoGRF|wUY-4%+&(S9(Xl+XF{7O~Ehflws
zs!p<Rv~%#%tk+)D5@5i*U!BRRjw#o76?f+E15Y9z2R$_WwDq&-D~4$YH*^`9Ef@Ho
z;?FDp@XibQbUTaS#>SuwpG}G4OD9_hacI@wW@L~Od3Cf?##(EK_94w*mL&&oOk?c)
zIQ5?EZM7Y>O-t`~txKE2{B=`3vtG;&i^b;}4VUm|Jym@w6?(U5_C?myMhdw)(Ha%p
zp6ix!u$+%j+AVibEiCG+zL~*g-E!tvv$IytH;U-c+HG`x{_L5#A?><X@=HtVXEPs(
zYB+xGlyfqRd)6D4azl-O30>3vO}%xM;r%(~sncG}*V_0_r6f$3V_!^XtbanG&lSz0
zJFhg8do>q3Y`o<ec+uy+y`_CP@4A=ISDxIdDCt#ncUF^4|7z!UEv+U!pTirZJKW*~
z7UnVYxc}JhapnHfU;8zl+*g@8HG<*hqV(@a*RHwX=~<-|*ARB4h^g;>%<iAc_gAms
zUmH<f_#&I#Nd1oVx?-=Fg0E%rPcLgQOZ_@Ix_;Tacat0X6ntAUM4#*Nn*@k1d$VKZ
ztC+AgcY{k=EiRhQb^h8mcT?|t#mA=$bC*}vEw>f=A=r_2i!0rvZ^M7iBX^TGi>^^S
z#Kurz>iA^+J%yCej2eax*F#!eo{T@0rPds{x9Lu0!0$c$5orrvH*LHzPtAU_&dK+M
z$-eu%6V8-{h|bX5doz~vzKG_H%vA1zT%BWmn|tzvXWo9jN15}4roqGuLS530?Bb@M
zZ>K~~Yqhv@Gm;^|l=<e`vM1}APyTYKy{oy(<gTT~jq1I;tIgIu*<Gtx|M_=${{6Ra
z-@lt_dNKCB!;G54OD2}wfB$uXvgFG7hFmJni|3gf|IWT#(unu;y(`~-tFgTkGwf@;
z?fQ|;?B0$WjPGCN|3zC?=9AN5e365J!AAjOTPtGNw4gXSF;B0c@@?enpeH*-|K0ar
z*cfuN?HKEs`AasZw6Uf+vr2HySmm4XDCl<9g*CT7c^Ub%e{iVmwTbN0E4w}I%+gJh
z;|tFo&7J>w?&@=vldfNU`t#xWXmu0SR)y%}lA0=WgAb`^>_75S_U5hL?e4E%G)(pO
z%YUzO>+Zd~ZsFxDbA=9aO_^9dX>$={jfc>l7Z?8hj_>+oYo(`h@}Z@^<nc+Hl1ye5
zZ*%Z8TAy;%bCSZYhH{~YixPq+cU(MS=N&n3@)euS{Sn3CNtM$tM}D5XZ2yxb|BlYK
z-l>yW*uB9aJgiLSe8Den%}qNN91YK@zf$!g{p5Pl$t+)HEMEQN)%xe|ClAi==lfSw
z^X+m<%Y#c6Y?g}mRVo5rMmWz2@U%D=KIOdko<o18op261WE`~Q^l6bA#~+1;>5DHO
z{8?F4Q}yrXBdwhlPSpt!b2hnp77Kk!__ZO?@KE-iul;}5?$6Et`!LP;SF%9nvBmS-
zB~O~4-H{MERha+(3*ilMZ|18WPiI$;=j)&J`L8zX=5OCu-dNx|D_pX1_v?gRWx{^)
zX3Gu#2)~@4&HMi4^TYb;vDaRn>6mkFSyHf}+XsU`29?_-^IfF(M}Lf~`zd&%de5S)
zjrl&#tOh?91e)~iigv8o`R3F*7Rh>pM_gelTPDnLdU5H5-5j4Ya~)qsUo2mo{Ul<q
z-M^P_J|De!@ZZzGE89~!5>sC(G#RCK+@1CEL*FGC?#4N1j4bC&wA68q3Ye*~P~m4y
z&h-Ez_79vwlllc$r+n5ns(Dql;1i!=18=lWvdD)>ft5?c&V_Gz74%`_mCAW35syw5
zd-A(UU9m{F;67bx^6Ejv+=esvO5?f1K2G7NxH~;+|Eo*W=iI&AlX5bLGwW!($<*t&
z%6>d&3y_<?>r2|hj_`|OEh!E+S0x+nkPY8?M(Wz?A1z$9^@|nQG7ighD6L=G+2wXA
zX!Swn9j|8x3g<G~U7NV+;XLt*Kz6I+N8c`47jxY)Y8vB_V!jD7;s<?Ow*6~47vUII
z*m`Tlj0^Yfb)6F~Rlc&v{Lt1LQ#Dn@Q#$ysy!i0NCv)*P-%lAf;kwSL(_hMbwET1b
z`mqpk#@9*{%R^MmF0)L0*u}xJc#as$#X}9p<~-1uc!A5wBW;>v{0(je%k6diaVm3+
z^}aDxMH~1vX^5rzrAqj8E4-4*>#E#zz$mn;?0VfA`F5|oD-Vq(mhYIg%Jjqyk;^Fz
zi!`H~1tzfMF5UfXh4)&9NsMW;b@n}7qjh*LN7xVMhlx)%tUdgs!EWY{MXIYW$nH}&
zP+s7*B5$6cMsC^y2Mci@cb7vMNpC(L(B$!ukv4JFQh4XlYVP)2CQVWzIq1}7u7<`-
z*Hpb+-YjUmcuhwlQe=*PW=wd-bo0=MQR?@6d%RV(Od9%%Z#NbSo{iRs-PZlS^hNwP
zqY`!|V+Z+XlB;Dn<O6#)>%3{)bx8VkSd-(5;7NP)p3LBC($kWN6o2Bec71`|9H*5_
zQuCU)Y)>>?5k8mfe<N6ChZXO%t5!aHvo1c&&aAyFyi99j+SlSJMKje|24-*muKA!J
zb3OF+iy)_ykrx+l_3v4`aI3swd~j`5?ztN&Z1#6l;@yAi?)%o%e5pH)<*bBA@Q&PP
z-+lgWN>1&*w|JWS4X==na<vNaV;$e+jJB{kpIa~bR3Kr`XTkT!m~Q-O5$IpzrTehj
zKC#nMr{?uDm!0xvYL)A>_FX@&zg|;3uv}*Sj9tP$O)si`A3NLY#>)M9jo<FWR!i4-
zY+Mug?BL?n=Py6msQpg!N8RehOV3A#yLDd`{<<sK#8T<~hAUU+>4~W<ju4XW-le0X
zrC4efZZci&h~&)GqDvGmb!Gd_&`i3)9{%X;%v=}uty~;`FL<SYHeibqIb<>M`RQL1
zPu(%hSfLxKRM8Q%py5};n$lg<S4O>fy=33g(EWcOPJMlnnOi}U+3c#W&wiHk8Mz<)
z&YzTgu-qvAP~9Si%^@8uQ@_l6;=TO?&$bhdu2<%B&7S$ud=|%l_rr1Ni~rw>T)+9`
z|2XGcua&>pw$J!~p8x;RKNr?aIQNKg^;s!Fo7%%>0vz`@ajz*|Y5rvECWS4xKV7@H
zvT&=c*M+rO`jZsbC^wb-ZYr05I5&EkRNjn&HjBr0ldB95H*JYwTfO^Cp;t&a+huz;
zKdZysQ!`DQ^%uYGR5-xqbumx7)O-)$<im$M*Hkpl=qP3Vbt*&9>bSJ(^6wW!g*3J&
zUwxYWdfubsY=2j#_OtTJ%}=uOZ<ct(o~>81=*sF1vmDZybe}8<R&PDIAWiYsQiBSe
z1*f+>j9j_ZDke+*yMvBgNbTFunA$r>?(j~p6R|Hi@x;I&eb-H)Z6&Ei{yR!P_i3Gy
z)yrk}k56tDGy1*i$d$`8|L@2YU(sRp=H>I<yA&=cHD0td^o>&S)!g?@DE!+RUzP1k
z8cem~U4P50xaId@OMdoupOewfe{WrB^=r1gx~wesiSF}U+cPI;hHu~!QpjFkeqw9)
zUz;$evuWi!)@O@--O6{E`Awmsp-#7y{>lw~5{uavnO&JW>&TTWo_7m3bx+&G>hOY}
zrK0rFhL*(SV}|icjPK>&ai~}2yB_5(um~?cdC6x}#<nYqXS~XH^DfTFDJx*w6jH@!
zb}O878;{Tr?}*=09&fB{a};t?GvoKZ;Ct|+_4bYrE~%I1-44}Vx0}Q2jKkGAzbYr~
z&|MP0>(+HEtLLIUy<91)YZp9O+V<p4#{WG3@~4jS)z`|6)xYz6w1}*~cWP4J->ll7
zT+#W*UUY@en|U;eM|`Q-J@f8Ghkxgm?z-~4*!i*W=2hwW6B1|aVf_#p%(i;IQsCKN
z^EDi1e=s-5{TXR+z4x&9O4UPmyZJNz-gy;JF`<2Z$W8Op``4^LTK+XORMY#59oN0r
z@h?7d{_~me@^ry%ABDWCzWKUl`f=B$?q}r6c=c<EZO#@RR{nA|9_#$vez&YCO^*Z)
zZMg6^>9XwVH$QcDI0U<8ox0cR_(JT~b>{R7on2Xm$}%Dj4go9kKR%jUSZ8dub>D@?
z*P?xO`e)e9E1uM}yso>l+2I&Zc2nxL;24SCe`s4b)^N{VWX{OIa1-~!)0E7j<c!3;
zbnxt>?*zx}!v;L9@BfK5$xb>Tbn8%=Mv1|#(+ippR!K}r+T-HMvsFfC`Ii56MY9go
z7<}72?_Rp?!SC1KEx&VHs&nI?j0uZ!b=yq$@GpC}F(#DzD@(Nfou;?HI94D1v~<c_
zQ9j#4>YLOvJ~XA<TNpaKJf4!(T)v>x`k3K@YYBHBII}oES=@O|SbJ*f%`*0Bi`tK|
zy?DdQ$>W^O?49}I*vf?q**<iAl?Zh0T(h^>bNBV=CKWc3?)>GS51*W>qG9S@UB@O@
z-~J%`Ny)yCk2UYHdB=9yX<SX<PFxbR>w^^E)q6!YMLf%yPHlJD9j4&janhp2x9joa
zM<y%zw?)RT^Uu0u8(ykEt!A6(WT}8<&i_}ex;5wg&pS&5zJ#UCc$L~Tn>QuOI@$B}
zn{x{BD?Vf;&#SoX>ZGr^MdONm0Lr|*lh51YtNaWM&UQFAN2TVK8Re#B=73g2ZjG+a
zzilD(|Ni`@f-*(PjeDz)F51oUfccV2Zn5tp1-~lYO>GLNL(cT-y!>*4+4bG#`#kYV
zsyD-S?PYLHEsT@lYq#fHX=}9G=AV&OGGlMCl~wGe9SMqyZ!%i?{7rCm&p)>R+qV;e
zlkC#p<b_T!-@mWYd0qIFIhSoZPfoJCpy7G_fIHW#_0@X~yssVkd}xz~@vF*~wU<@2
zJLHdhJ`~sK{2b@M@AUl7ik=VR<Mb}+aAx$KU%e?|qFSWu7tg;M^Mb|h3)-t+4?175
z=E>zBiXM+9+`TG&EpX9&){|DLf@h1au823$IOZL7VL?EPx74rHkS8l*E>>*ZzwE~B
z2{HZa_s7kvaF_S*vzr@NWAQ@pN3iYrcR}{2GuN{_oj7%VuffSZt|u2QwN_YMKgo5H
zOB1scN6!)F#KNl!Kb}0A{{HjBspTfN`)zEkcYZp@uYa7sF67c3Sq`^#dMxpMjlHR!
zHv1O0o_2jJe7xFz@27ir=ggC}X0!d5D&nT8c0JOw`q=yLbuHiCP3&H>fc;6KYw{!g
z>34qKjO|>^t31{1%6U!3TP)F@8y95<sr<129_UiI!_iAFMThmi<N7))`<cG_Y2ohs
zb^aduuNr?*Ln`#hPyIWd3TH2O#k{la@Nlmzs?oTuSJ{1dZ^gtTAtinn`h6AG8B6KD
zJaoQks&PoOrQ@`PPx(Ld`*^GKwf!>Md%TZbyG@ZXv3KvD#fE49H1*9rXtuW8al-V(
z6Z3fX{{5%7wq0Xgf}`Y5Nk+jZj7~y-oLh8cUe9<`^KtX@w`?j4%oqRHjC7kWER$}c
ztgq%5B&O)H@$ykdhuPCu9e>H*<=v!mzIWXx4=Ex00~hC7R8DjV(m2pFx60n*ztH@G
zg+;eMid;H6NkT*ZMZcM=N9|hO2`{*I)uld>y*%OQ6ppxwQm^W6EZr9KNB3;k-`!L0
zU)EW6@q4D&p8HG9JWjvA%-M5)b%DsQY%$yaynE;T-+kqB#mPT60^Yi;(I|+UoG|sk
zu6h1>b6Iyc-(Qt_@1l{SRh!P{o15YUet!5Svw>;DoMVYfMFwew=aUV!ZO)&~6uDMp
z^6%m6tb?`<u3u)b9?gwQajvjSwyd9b{$xu{^~RlII^T@l;*YZkC@-B5Iy=YQuw=RB
zV&9G};>RD9-clC3zki-~#P9E4N}t_gI>O_|d0B-0Y`=x!ghvTiGOo6~chgJDG>_`|
zbgpII48FTBTqoo$dHc4rl6k-R0(S9f&VBwrRy_zgxo_tyox(VSxnF*+(J&Et*5SA8
zbz%Pc?d4LFo-a{3-NNuiwbF}O%&xfYBFDv+V?oZEjA=rD&NUv<_Xs;?$e{Pa;R$m=
zkw8n2kHDh|?qaT7n^--k74G2*Hi$kw)$_*n+tI3(iBV;HlXkkKro=kkZdzo=l40jQ
zk3-RN8T$+Ng6A(jefoRzVY}o)hIHi((qiltA`$DiPiN*+W129@Xu0>4=DRIRx3Lr%
zr+)c%;OO4HjSPnag&LOcy`mqccjnygGwm0eA3i>Lh$FXix#a=ZM~0{Wx~_}h@zI`J
zs2%-GDztcZgLJ}1_xTwLB~o(~T{<TH3qO=p&dCsdYQ1BQy~C5IZ9B>(>pw1=f6MV}
zuEv#gJLV~WB<~haO7(p9t^Qo4ON*zZK4;Hm|LN`5<$phU?xpzsTr!*U+2A(zlg+z0
z*<{^*nbvCgEq8AE&Hrw_Vqj;gbJmK~_!sUj$>KBFQj8S$U$b4YBI4YmJs%!76g^Uu
zpVK9Ah$~&}7US=pe=QcZKjbw(F8`c<=lK$mhU;o->~i_Cy9?!64i>2%TX;UzNN>aW
z<C8vGxZa+f^VvRGvBx_5OzexK)n7FG?7wTg`)<?mh24Wm&rhmg{>HAWGGa?IC4OF5
z+j(PR-)9lA;O*P)7hSP&d_A|(K>x*&8!6RQua5k9>fLM_`RA(V%P)8L&#IcZb9Por
z{zW<6-3Iezqk9&eu1RSKtgeo)^6zz&ZZrw=y0BU&NK-0v(zGPOmFL1zZt?5B+LCV?
zxH_~=Tsw2wt*oA$&r6P2y<}5PY~xby)naJd)EbmG_rSrg0Rdq(q6#YwU$=Dy@4xhB
z(`{>!<tqggR{Fm4d&T>&jkBs{+wF#wn2u%JSxO8Ki(Sm}P%r0j(p~v%%C8IW4Ni!K
zNU~<;Jq*=275!WDk(1t;$jv78zom0d^Ih3|=a1E!xAOTP-wOXxk6(IH`Rt_!Z}T^#
zH%t?eU-))uP~ypNo4;z6RLo5K`&)}^>Ws5i+ch~jwFF%)`WHW#ro+2iZvTheik{c8
zy4BoI4xcVPm2!jo=u_b=+sFJ9+TR`Sx#YU<$n@{;AO5`iM&kbZQ$72C7Zg6;Gviar
zNu!fn0$%JaIdJ&>j<30ItE=}v40I}&w7l{3_P>iiA1)Vu?{WR#FN<ekIjKprimoYD
z=eaCUeSUg+>?DIVM;84R3211a|H9Z^cj_IHgjZ_L>GA2;)t}!x`tT>`^!U$zbos8Y
zEw1@=?zhF<*y{Fhclo_9&&)hu&ar3DEV;R7(k^QUuX<X)Z_Sk>hdV0Wr<>n4+q3@H
zZI!wJ)-~&R-93xqm#sBieV2Fcg9W{hO&Us5r7mi9Ja=x|ao72be&9SkwJ?pHT}3T!
z6XowO+#JXhtL(RFYNq{)>oTpr9xrMx?}~G~KjFvI+1I`WJv7!nRAIufo%6BpLFVpF
za@nWCWG;pTpW3kcL6NU4+x#!vJa~6_H`{D%h)p=6;H^@le*ABhgnhBR=_=tFxvV!M
z!deAct?MFH`W`O+I;r{cvvb+^n6k}-5BJFb<XglPy?laF_G;nB0x2?UG78>ziixxE
zdrBJXF#et>e%bvF?~_F{ZtHINoaDJVCn>|i?q^M5ahaMM$KzeAY(H2W`o;fl#tu%Q
z!;JIH&+}WHZTWBBmXWeDJ9mnUamCe*?gk!@n1b@Q_U@OT#IEbEF{|PHzd+B&pWn$n
ze$u%A@<OissAnp2M^7j|n&NqH$>o{Ll~$jcD||HE^i<cAmJ_XuvsO-vx^gL^x;`cD
z)|`5uY#w8?7st<)2i!ZA`a)>wbl!coJ1y*N_b~kDx{{lwI7dxyO{9Uo!cmK6-nJbz
zhE9wA{?&DnnWHFLf5T7x=|kmHCSkH0PM#1lnq;o_C5q2n=xcy~(Og^hXVZ31V|l&%
zy-9M!wZGfvC%%2&aKv+Ir%jTk+Y;MdA*qRq0au;#8LJB-GL}90civJ(WsQD@@$Jf=
zI(ezjb!Al+q)+~`Gqf$|wSsEYHm;6ox_fjdEEhVm&?Q)`{;v5aZ|zGW4~i0+7H$jm
zJiKu2v<Hh6`ii4>hna3KDQqv=<gQhAs7SK0?#e;?)LHo^r!(G^e{Tx7ILjk7*!Juz
zakhzm+uc5yDlVE?oE>>X&G=R?+uWT!Hflmwr~R7np;71ENAt9qdAgh0+f$c^T{+Gj
z<aX3=gQrF}5Bnb_2i_~9uR}gQO!K#YFZ_Iel3-QJQLZ+bqHag-$ajK4vc1hL{%_U&
zB3l;Q&tZ&<7f3y_sw7S1)SPHh=?Hh}EtenU3e23Oqa<9fRK}3NSGj85$Apae#pMPo
znwc)%*`#{W;9^q7+Fm~1KdV`CUa)Mh3I4zAD3?#*x{Q)Zb{DVNX|;XRW19YM?!3mJ
zkmdV4qyByP6?ga1M;AjUA9XQ}>XyG6pDt8dx+hgWe8wO>%arHp*22!xv}TX%@*+nU
zxPFtk`_xRi?Rv53#J8p~W~#22rDm77M||iuxWV*!(Nc?MmCpyu?&>a`xvtA}^|iRE
z#aXMY`!h=CS>_+nV843nLs!umfekyh-nf%s%k?rve4a>1b$Rr*Tw`^HV%_H3z0a1s
z{Z_WEa{Jx0CVP%n?Tb0#W1nAga0&14q>qLBUM_vXdfvILAY}EdgBtPgo?Kr&>yfB_
z*{7FJBR+PD>(*4wSv~pDu^m@Zq*w11TYoS2vI76~@{aY}Qt$hiX-2$R|GCiZ@(KPG
zdmUbFElId4TwpZqpKPupV^-lr?j03xC0Ql69G;jyebJ2MIR|gD7qLIv<`McU|9REw
zgf)w=Ueff-{_yMm(tRm6l+sS`JgpY#W|(&W-HgIbn=h{0e7Kw6yj|We?cQ0QmdaNW
zXEtoGve&*~n72H5OIh@)2FL6@QO|!qT6%@|L&J%Te9hZiPG)Q<Q2OkXcHQHuty2H)
ztSs%$-*^2^Z{zU`PFO51v};$d9)I?oZ#@_GZc0DA?L)rU9kX{E->zCJu<Fmw$6Ptd
znJdhm&a^mdJ~yLdUFAis=!XaQD5kr=J+)(!!+eELMb{tP?J3OXUB&hLW@BWs;o-wq
z0&m~mIz9aA?X!XL{ETrfuVx9fNB_BbA>?rRTMr+}dk^wD?lqjeWiU<kirvxdcdt_3
ziw4~<jZgSplpy}naoN+YtoIh>@qT~(^2-|AE3DcX2B}vbMG5PF5ITNLGm&??Lhk3K
z_cnWce!g{q$eglQD+-?Xf13ZI#MVBpuE{mM>f=8Vqqi@2Kfb)$ZP^uV39f`k|9Wes
zH}*}bJbO%-nd#!D2&2GAX2!cZGi&F@`YykIuiuE>VDfZT&xLC<<eE7muEy16$aUWc
z<Ydu$zpHPb*_#>V9kR8{uM1w!naefzk$$E4RgPetH_h>X7M-|q@Jv8v){?vI)^9!>
z?lpXBzRc-)NBptL?<&;(<_Dedp1&q?-sT^9C)O|7=p^FertG@#V*LHr{GRn!<oEPs
zACR@`c)7cv*SI|<O4qwFNaB8s$zQ(Y-*cb)^<H{!IK4YQs^fS2v(!E8&pzi1x=D%_
zMy6eP(;bysF4M~!l@Q?m_FBFN`#+^7+oxi}w>CCMR^1iYXO$GHSr=}#?Zq~=dA_YS
zd!p8!{;TsPC1I=I@?UWeI=j|4^7%};U-bH%L-$tJ-Cw!p>6lka31-?}4LWyTwZiBa
z|MFw~+G1;BTyM-sX{upg<G9$OLGIDUJA0en-4%2+k0{danK|1m>+1SLoU=|JVn6jI
z+=2OMkUUTExzjs79NDfA+Vg&&+Ya?f%#Al>9D}qztXj82;*EQd)&CReQ>R><bVrpX
z|9;=?f=|L{&&sxQbgB6mIP<yJtFO2xC=tE<#D=s73A3+X@%gvkdacK#6=Cb{GHsDs
z8vS8`=D}l5)_YXF_FdZ(vT02vXGyf+^rT0{Y#q<1B`<Z}z0NV!Z#BQbM~)-^6arJV
zy4P&#(?9j$d}&^RN$0;!0gt3VuI!K#O-^0#>GIajueM32gF?b5UbOxv8MC^na5vlW
zTcz)AoR~FX&1I4IyHt2R*>8Sxd9knSYK!^w&1-sYGaZWR7m*TNy|@4R#i!DVb3bnE
zJLGZh`Vy5!`N=AM^S*}jPWfmo{F70^^Fv^V#HS;hJrcU#ym)aa-1qLY+i!pUbm#Ue
z?+#kpbzG<;wc)?azpKs>#~Ll<QX7;Xveq)m8@rhNNM(*-?D($#XVM}Mj}1*N%UWkf
zurA!6x&PG+&tT@yr3q<1H?-QMpJqI`6#x9z=Ot=eX0mPb7QO!?Z0%X*Gq3cT|AcLM
zdZFmTZ?q8ss~>MNudy&Nc=9nYsA6BqpIT9pT9lWVQ&5zjm6{AX>R@j8?Yzfk0=3`6
zH{4+Niir03zS8soQ+Hal&W7m;k6F1a+8n&6tX<<Gq#~N1@Z-L<b6~i(U!bjuP-U9M
zbmPMxrHkszf1iI8Jg*?}$D`y^t!FpSd97NxKBDMBclpJ$Z+L$OuS%c$o`2e&-9NvU
zZ?Y@+G*epB<J9~L#Zb<oBSm57(q>Lm?R>mu)6{2$KA(a-b2){bqSA^r&*VJ2z9jSB
zjC<P4c=Pw2UbSK8C8LMOo+RDZnVt1q{B^R(=60p~rs;PMrZaCn&&9%NobooeYmt!e
zyT?l(DVga!E=~%Wcw6EP!{<p&lFoL2w#0CU-O2oULU{Ka!HS@Hjm0||a%3dpQi_$P
ze$KjSC0LtSAk@;|zE!}kqn9OTLa6dXyLN`flP%7c@-u61FmQRhYLADz#rCqsGp!rf
zXt+h}uWHnLQrFTlmHUeDb?eMubw8#~)Sfm~>vXr>hFEE*U^}*7Qx(^w*b7`v)yjCV
zL-^b+7TMCg$~UDubXrqBvj0?KeJ@mW=53<_W79s~VyFHRza1VaTz?`jo=WS!pV8rR
z$||vD(}}slDPK%Ve(X`<=jU%~bKY@<C8=}D+{fH%_s?*0?FgU5t<mw~M3=ndeC~%I
zLY^<4eotq+K)-L)Yd6-jd?$^WzPbf%@rrIf$7ZtV;WsDAQ)zuO6z)eAS8CWTxaxR3
zYWc+<Dne3SD}JajBs20Q++@qmxWo8RWnZU->XVXn$uf;URW~!9ayxUxYu2B10k>JJ
znYaWNOz{2n!68E;&S1&e8}&~-y6Zbt4_j!wP`W#DS<sCVpFbMqYUjANz4yE88CkN4
ztBOnG_=zpNS}(L7=-#|=lqu^R!}pilxJ6Uk8y{aNzo<7Mexme?-I|;)?#J(&d|tsv
z_B6+mIdYL<^}TD>iB8!1PW9~izel-Ne7dH5y~s+vDAC$CBXiCa&1>1ol~WGr3h}&I
zd$>w+=0xA#Z5^5%9$c#1D{Ok-b!Y^J&N<<AL&4^ImcM#0@5Xg54s)+g*yHy6fE>er
zroh=f9e!!DSH54pZu7-JZyrOLm49x|i?{8+zrH=5UvhiJtJ1eCg=cF7>@Pcdlg;q`
z>GQvj|JVP1m-Dcmv|nx+tJt|?DZ5^FJjq$BADp~1>QKCG`?bJn2kxmxy3a34Hs7%0
z=&b5PQ`fKiyg6xeU*6{<xr;X3OA^@Fp{~Jc{UutJ<s56A<-!0z1+gFR1?*PlFDZEL
z{r8SioB4WXr~jE-AK$%Ma(>zJulk`GIsfK49H}gH@;|@hw)gxsYgVoKzF@w@o2P$I
zm(N%jc4q6UeX9DVt2hhqM|;1&p`xO#Rs3S<Eb-*vDQz>@Q~M`Q{qUvzG;dsy?ok)z
z16%ka!%w?T^^%-nn(!*6`HQ5B*pisnq2}6d0devB*Wcx{*tBZy%>5PVJJl_htxh}@
zFUY_he(%Nf=ufGoirNz;Pp}=Yi<h@ieZXpxrC$Cj+tR&c!K2W+E6?}DCMLbNbYFL9
z$1Q=~=cj*|nsROFZSyp<!(7Lhj&<e)tT`-Hve@w4w6`<<#J$)4^RVD~nT>o_#F0xP
z?l#-y50thaySTceDqvq<X4{k3EAnji^{sAy{90m<=sM+^V+*_@n{0DkdB4cYMek@>
z@40R7SE&=_>920DpFdrZQ||4*tD8;!tu$q14}TnQe|ANzvJL-^RjZkUzU!k7m8$Gs
zvagwifuWWc=UjbyYDr0I1*kyW8kU>=*g^nw65C=OuNyZ!e?PQfvfP$)d+CMOQ?tdy
zybPkEx0P;Hov)G~)c5<n`6Si-PnNbce{Q#sI%^|kTV?W?`^%q_&$=}UoKL&jzH2_6
zmD+Pkb=Nx2pbH<gqFBUVY+i9+<urHiI<e{Yi%T6Z=7(_h1^sHCwrHIKU#8b8g%e9w
z1jwZK=Be~1A6XUU(aZ7NN%$;FxZ{Hyr=RsM&rBzF{o0td?|P6*NU7YfwP`l)E(=Qq
zBH}y4Vq;2lKOa;1n3Ap*{9I_FNpI)u*$-SoL?3F}8OpYO%|7Sp`jN+M+Qem7v}<lz
zs?J*Cv+DC6??a!9V_luRxGp^3seSQ8OIr{}ZJNX9zd0Xb{kAUKEm)LpEg8CU&mtpv
z!J9YlbtlbvxmO|EN|HI#L#Qcr{%r;}kDy7%R5_L_W-Uq)I(%)qN2aCg!}S@mwgyY%
z6Lv(ham?fX^5>Z8O~r|du?DS1VL>eKLsZIKXDw>-dbO8(ZT8kV=eOU^o$^^t$Y{Ry
z#Fx4gOWt|RYJMaYbdEcAs-d{%-0MnlI_oyI|30oCzka^5apK3Ac?#JJ7tMO1^efol
z-Q{_TZ<G>>kHwzeZpJU2eT8+R{_JyGQg=BlT2}L@A-&_1%Myc#hi>T)^((U81z%e{
zLtXe%3e)Xpzk~HWxn9o*XF0O5%E<OZV&rSKaNdJ!zn^o-N}V+80k@5<%e(C#FFwAm
zdYQS#bK$ZN*G@{k)LXdKZL+n+GWUh=T@GK4)@+@#P+d!VnaCCCY>74D-fWjnen`JK
zCAUtp+2w7Zb=%o{|I7CLZ{`<bm=s-VYO}8OoThwccH1A;Lg(<%J13^|nwwmT<y&gu
z{I<34Z0ozDT%P)KeWq+XIq%BJ%kN+B{@s52c}L-Nn>igfSA1V?eIP)%-$dbg%?C!^
z^u^!5$fw?Smi}e0(PO8u{Y^yDI}ttRY+tUhWrk1fZ%ui~Ke@@Bvt*6u_Md&9`BrdO
zAB@kt{`z+Q>)Efrem(nF{(J?qhuwl$=RMw?)^T41A96f-&`}uqZLUt!qBy^}J!TDF
zFU(acRV{ga|8Oxk9X6V5DzatXH-qMd%S+0>eEPxOZeF3HB>Yb*`Loc6?DEZxM|-~9
zYh|hmlMP(A#LTq7+3|bztnW|v%FjAf`-SZWx6P$L5f2?6)hpZ)(^H-+wr~IY_w(ak
zCLF7}ce$v0<MJmDFN&E|_TFax<|47{|0|Dt!M6O}$9?x}>5AHxGdiyo6?j~_xR5<P
zchSWJp0gDj3cklCmZY@Dv|O;>snsbal<&4FwnQ|qC}6>{cGaxkf$V>F@#V%ZbJv!>
zb?8voBrVhS3%lIk1+Q6~v99u`rFGd=`TAchxu@owD7ZAKRgQJ}I{pK0ZzeHMxmUrJ
zC6M+p=5vmHKbyzeg>$o0H?LoIuDIgmtqqw5YYtT3`eJSWZSE!Zs!w4Y(mVCP|Gt<g
zKdW@-_ov6AcL_b_-FNLQo6Wb)&AMCNJx>>U#X3r;9P2YZ{$Eq`%VjRzX~(UP%zL<?
z>}$v0wXzYnvdbncwl(!X_Tkd5d*7z+FWR_u>;029R)0En@cd&%Exq2}D%N|$&A?Ek
z&A_09y;+xDlAV&DoROMSkP6z}H&-e<U)ucB?t0eQ3nDmUb1yTL%k#Xr@a0hqvqk2F
z9U0v7H!djC%*@W*si1k=>B9dy<C<dmN$Z`Y*SCFsR50(#K9zX8y?<*9?}n_In)7jA
z+S;sZyu#C;_`0vwjozad7rRI0|FgS+CbQQnt&jivp`Z27XaAzjsZW?E?@=|aPO!fB
zwsD4r+jnvC?1SHz=v-$n6<DL=x%vH$fR=5#;UT7brizP;sr4JF$NXB~9;#k(G^HVj
zf7Q*M`5`%0S}Mj$T}k~?Z)QyuUTC_jYE?vgQqiZ*@-@1uv76_ZY^uq*HOt=XZ;Y(@
z2UGP;w@p{E9J^#xx+hC5^lrx||9e~f_F0wr?p6$$G`pL7ZKs0w`p}PVIeZ!I{#B`F
z<rb`Kvqct)r{7Fc{OK6Nvm<@yw9RLjQtVu}Sefj$TK2KQQ)olF(vh0EF87V1j2Sg9
zO?Fw}xyd&7R_W&Cc_)~cc~;ck*f{N-@*)N+=WhpES{}a*w0iO7-Icob=Q7{Kn6G`=
zz<h%<I&6#Y3E=~qPyBr4Z<#QW;rynX3|6bB#58Cd?esX4cin66lkjt!V$A*hnJy$9
z{k37U&$sViwH{7jI5+8imVbu)`AH#D)i?H^pRnoPMUUe@epgm%=6?M@;ZxYb#dd2u
znj5DvR!tMEew7jJ|G~KX>HUQ6#tjRCjHa@=OCCIDlxe0be&*SP1IHUqOVmsgRb%87
z)!0$SW%<5$kDt(K<CC+(w07M-s(HET)a1%w87HHn^Nu%WaWAsCKXIArcB?0hj{lD~
z98K>L{Vcw=&)@9drroExndCLPq#eJj&SK>9+ZOoUbiJ75PrqU_i^sbZ{e1Gi_BggC
z+~v#Rexb4Z%(H-<3G7EYG!wm5OPH_zU32UD^e4-9<Sp4X)$7jFB~>gOHqTg2ZCLOq
zqAVm=HR<o7ZiBmb-B`*O{B^&#$ujbfxBZO2rmv^SaFuN7nqN}snfG4ri&VD!gXp^<
zS;tZt?@JxLy)#)V>tBxF1Bsfu^UpG8A2@Bdcjr&b!^}*4iKz-Z68r_Czw&Iz<2@U@
zP?|$zoneIe{OVsEyi<5ISigyEZrQAuWPLK|=(_vUuD`GU_2=1V`KR|UZuGB<yUTdA
z^6c?7vLY<=H5IyM1Z)nsG^<&lu$r%HUD=sS`&8!hU3jH=LZHBH?V}%O1g~rnRqp>F
zfArm?X7$5HnIZ>6Z^_BO+_*s}Z`%Wtxd{p{8$A~-aD2*SA+%3zf{n^ugUo{6F_ZNd
ze-p5cw*D;i@BBp}?;rNtt#qB^qiS|m{yx3l{PXSb>FeL$IcD9V@S^lKml5yJG|#x!
zyUe9Kr%Qji@wI!s!c*yw;*r58&YD){ToF?VD4p;m`^@7_|6U)BeZ#gOuj<jXT*uvf
z=cTS4HsreHaV@(w{bv2`Gcxm3=UVr_-dyilm#dh%(%D<|w(QCLXC7ZI51kZTp+Ctv
zQ?a^AMca)pX!{Ws(f0>V2r6$~+V$q^lYrcxw#LWV7p^Gxa|~z>39q^w?o{BRJZZ9Q
z@XVeYGlZB9J8nJNTdc_W?8-FzXE(YQzp#}#FSnid{=ry{1&5dIY7SZubL5m(zWB*$
zoM9rZ?g5Wx+`6eTXU6o**?lkWEpEA$xoJh-W$($}>C4XRvpzrd%y+X4qruZzes`Ic
z6fn$8yYI5#U&8aX+WS>a*A{+Sx}|p$BVXi<L;Q22^)DwMlxn^mWV)@TG?&G0isg%#
zyXSK2ZH~#TnzY(x9ZTrc_80HYG%nT;{(ZIAZ~wNVb3^iVbF-_u_eIZ~WO;4X*WC8X
z124{(axgc^o7h`1?zPIg^Yy6ziy(=q54?5>UI^aKH!J@s_ouaAS!UN>+*@$LReJWR
zt^k*9+7ZP`@;%1FJzv(@i1aSew%qLU*+gc7z)b6yxm}AAPR!l#vt#Fj$roBDaHc56
zFLN~!%PVBg+Vu53!{PJKxEb^}map2Xnze;-)5hHPzQDlNTNaxZ3LICfY$)^!E>|<Z
ztnPUK2=j}H5q=j|zpT4BFZq#gmARet3|Vgu!;&R-*1ILAD<oXj7vtL=;Qy-i{c;(}
zY9{yA#oIgzxAsphczW`&q^o6$!bJz^Uox&XpFDkSu33gMEy}k2P}VIm+p&3}KeNA7
z$g@W;oD+NbCLGHS3A?xV|KGz`Rey?dP1rq2>z-*u`k5_#p}ePp&ffN!IL+}bd!T7M
z)6El?FK&5v^kUVewAU+K-YRiB7T)<RCZE3j^^QAt&YmoioIc-0;N8|t{)Ka9&$dXo
zE?fA2bE)0KDSW#Y1;sx<Aoon~s)St9dX{A4*LUq^&bqa4k05*6w@Fiy6S%)F5$rqj
zO@EoxZ#VS^vzg}1iJ$YzRxV`S)h+67VX_hooYih0qNSu5H#RG7nBnBUG<cEc`_{SJ
z3OJQ+$CkZRNs)X1K=WM0zW09FfdMzT3isJdTrz#%bK{snYVz;H)1UapI`<zx;#9Wg
z(Cde@cKi%lR^2$|@obj8Ml<APv))Zw*zd$6n{(5AO)8Vr`B^XG9N5(=?`)cOf&Im-
z!VHGTOv@^cl;vNrh$!p-!;pC9y1=>{i-Vfl8y(Y)ObkPPwQgviW4C+7ogO^r)l9b8
zv(0QPTE$M>u2^s&W!*PRU2UG@1{S=x=Re^oWjA@N<FPhYId9rA$s0n;pT0OO?;*E-
z-!J25la^n6_`p=}k8N*;l}T^5od4q6-~1lmes26n`|xh7<JULY^rp43-&edLylpOH
zotvKa9ieARi#L^N{C|A-%)7<Y-+fGS(HAjL=Ta>!XtMa1J6)fp==^56gARMR>kdEr
z)-JF2{+Z+DiyWozgv7h={q5_&&HqL2b=1~Jf9{0@KEHC~KvLt$7mgow)=m3wc|f7}
z?Mk^DKe?KIbts<t*tRT9<cO9Jo520=J*7eC%R^jczWm|X{LlGtVp-fq-BxwM@Syv@
zL^f1ro9#T9rnyx-Yo&j3r+T-<vrivf%x6xrQ5D(s>DS!DQCmJfzntm1oTJ(*>+b;-
zT^`0{5eu0ahc8{eQ6Y73>B95&`VX8P8uH(-jC!=r{o=8_^_PWA%*1<nSb|#(&cq%R
zD!UxW>$0ZR?eZbpi#Fe4w%jujZx{6Vb4RxFr996q=A4fgE^gfMQaO=7U~+>C^M-^6
zRo(}(j%uzAY_hCYF;aijVz)b_TD-yOLHp;AL2m=vmqxY!Id3k%?()Y=To-JwO_~1i
zQAA$r-^8ekyI;kdwZ)y$G_q3iyRQ62tbS$TqXSLv?!9sS__t%><tYYE-`2)7T-tQN
zqhncavfYtmX6<kIgA$9G%-q=>>J7qjk6f8(;c5BNcf-?P>nfF|J_vHUy(z6}tLWvt
zrIu}b_T+tuJ^SP5joEWLnXAIyey`YN_3EX_S^4{dz3+83u9aH|PxyE=bieZb!vW^f
z`G>FH40rw$9=N$(_jc*}&Cl-`^cY0c_+IU>ymjCEPQUB7b?^V2ou}Lo#Ku+-5puCX
z=<b8Bdeu4Fzt_BODF{v2vta3Np?dZv_FB^`$&+3^4Lv0s?$^GP@%+n;dQwYFR^Ifm
z3pqVYbWe)e4u&hoGNP=vM)|kZ-k5*zi~QxthxQNe9oV(!_gj05$;}INt31BBPkwV;
ze)C2ifxvtBzOwGz&T?tmKJ^og=Qz4Fj<fD8=WP3YxWj?HuI)m{;ediK>l{o%*%MUE
zn&wTMb&0=q*LChoQg?-)JEW($P6-PrN|n!3nDg<@ZmXXOC-+V=j@ejf(a<iQlcd{T
z@ow&{iK71>ow+jWY{bt4$)6jupC+qM;P)||Qj#>O$2P-b22VSmM1KOGn14Rwdh@@P
zPdF<|SVeB{o-d`-RVGr<CHU{;(?=}Jzqpl63a|QTbX4c)tY^=D-+Xu}qS{t9kEc9J
z!|VuihQ@=N?W^_o*XZ1@|5Nn&*{@xHzWjW3_xJs;Q@ws%v^%o6_VYOr)!k7!5*k0h
zy*hpN_V@W8bz5~}&Mdvk70=!gcX#$p{mLV6%3|j4?nq7f{(;RS-;AF-@LcBt^|TX(
zw**f9^=`OWA?Nqc@b>$Hs4Ki*C2}`iesaw6(Z&5e9#iDZi+pS?6lMo3pPc&Mc&fE}
zS?=zsnp=GGRwmqU7P>LFK0j`&<?+k!5C5_9kBg0IIO_HHo=@bf%)L5aYXWX{-re(%
zL9sQLyRLD|_k!;0dY`-hBb|~byz*;=_vZBN?-&^v!dY<k6*BTmkoyXy!M^!(3<UOm
z*1i+NFm-EDpUYB@l~cSzcW3Pk;ZS5xGxv*>?mfHg=Xcrq4;Mq;G#))O+dThXkN*n&
zHM#zi=L+1KcJlO!i$)8lY&+z&)@Ra@{99-8pH*%uitxL9xnmcz^M%Qa9~*n~ANwYB
zTU__5lkx`}E)#?KZ*OZ{oymE4mC8rKl&4LPzE{lCTkz(h`z9Nw9WQ=|9f_DG#}_22
z-KKb#^?-c$AzMeuSFa7Ye$Nr}DOq>=lUtASihs)#E~*>yZd)@uR!dcHL;Q=(NzVSc
z@0Cxi6MymMA=ir~Z<wp^vMy3ljO0<D8u+8?xYoZ=sc7kL-*bHPXM}vyOZ;+qv3%4+
z9+M}@D&Okg<}Zz(s-0lt`_4F{X2Cj^t8JINUDj4CKW@J1*75a83lbbY8c$gFc>Sx7
zzqdcG{W^n<D}AYUnDDm5Pfv;y3=X_X3toIL&1~T!|JI4SMNcxFKfaUmo%=OC<?L9S
zRZa$up)t1iE`Ep&zf$%6)^y{eHa$%f8;o9XEb?5Y{4-$F?S$9`ORE>eD9m&;4vyI%
zn*F6kc8kltZ9>0(?EhgssYbCg{7L-py{Gx-*N5@P*InpZ_Oh#=MKQH{|E7wF?AE89
zb(IJI-74A>!Ez#OS<}hQmrDLJ1}@gro}*Ad|7qBv=WBDtrA;e0ZG3O`lN+^XS$DBR
zZw@m9gBcgjak0#j;*$LQ9KC|dxna@ymkmVf&abz)BsZx`Eyw0Vz)Fu~<`xr)q`562
zp%bTDtX15od;6wq$NzI1lb>HIHF)8j{oDHf$DcKNwoR+`pWna49Tu=I^Vh~DcQ$kd
zZfywm?2`43Pd$E7a1Q6s1vkplA6)%-GCSg}M$MwA0*#ltYg=<J@bReniiCQZOn4re
z9p(C2CPKN@$iYIqO+sx)pVEHyk{_;D!i1J)M!f#!rWF`)SD7a_<>)KMjjLb&-H^e%
zy81<PN)5NmVXZEiwN0t-m8?T=U%U6c+uActZqmd}XFBb@A32%uK1}^{q;S@~Eo<~H
zPg+^grxmhf?OCHbp>qPQZat^3*_?JLVOwN+eyhjKi*6lNJbcmhn;dO4-yGISR#H7W
zgT3kNGtSd)PrjM1F+3i-w<mtVWDO_h0NwNZxsM5}2lff+I!K$c*UwJ8TBwsSHP#^a
z+K#<5ofpi@b2s>BFfV+L$(7)RUW>o-Tr%%4;7&iRb>NJ2M77e&8NE+7A22RRU!ba+
z^J{tn%a&PAsv;7uJJ!X%N|Q)72p18abJ+7q*}EAxzgo^(yW*_NBDr%j7qtq$Qk>Wo
z_NGp=M6L5?s<}&W^+OdGBj<}VqrOc#oAYm$o7K;%<?aCqs(j+dvfrK1Wo>4?d3E{I
zLk=zi(p-lEd$_V09DN*hxtdZ%BzC9DJvrzUng7dKdY`>xAG1^+3*W?x)iuU*E8gUE
z$(F2tWPI`3QscD}`p!NdE=T{9%KYo`nfc$|$TrS3Z?jbjuXX(3|95})iY>-!2me00
z|5rY7tHdg)V=KdjU0Rcrx2n%QuyIb$RLeWp*Uj`@r?SuDwEf=QyR80xc$anF^4N<v
z*N)FtJiwxQJtS#<h2(iYmRI_lTiiXxcU<fKl4AVTCENFZd)BEW;p=P}iptv8MQei2
zGr#115trq3q4dj{v}%u~KU+$<?w@|NCOhTil?B^1W(ny(Rr6Sude-MrcdCNx!S;V9
zg{j$#y1BI<arTrqZB2M%dM);Ud6@FTWgYK3IL;>g>o{AtYvG0OyAJzQd-W{(cG9}%
z8qdVirfrLl&ApLk_j1qWJgp_t4>jh?bH6*y$M)7|xAo75neqD$r`H{y`^|RUX`WO0
zGY{R{we&`>;eUPm=lSdH<K{e%*Vhj>OUUi-+HExRtdl$cmcuPC56{`~{_rA)3-=2+
zH=aFJv2p$7$C_n7LfuxS*!9k1{bQ}M=b`b7H}|{tAKqmzJh$Vr)%VRGX8nKg=-kr|
z@fQz{{N_c?*2Wz_+m+cE80-abt_;piEzZx2Ppts044xaFoB!C1=ij{eh0gXj4hk(U
zZ-48|mjB|{CfN&HS!W&Qea+gIq}>}9eMx0!X2Femc}?#+?<gMb2}d?*e0r$dwZ!kl
z-@8ZUKWEP~PQ39a_+ZOZ>2qJ2=4j5!zxl_x$jVajdC*(a`a4md9)9_I-15&KhiTDn
zb?I(gK^xM;yh0BqB}uMTo7_81^yDVr-0ZWPdOmo0=5mTUMP=<2Ni+KRehH_4+I_pA
zzbjUl>GX)6pMR<><<-_pM(N9@Zm&LiRC!^W&f(QT&qSt~1Wa18ZI6kko+)>NUVKDc
z^e(-dwwLEjyJL|u+4G=TO6=!N1p*~Ds-NdaxtyF?x8~wyYxA8m1b&z_snq&v>CHH4
z8ot85_gr=|qj2`y$#a)^H8%BL;a$qPa{|i_rCnky68BC=3GWm(4hp?`{YB@y`o3kh
zmpOI2da7m@n#{kxXyKdOm2<T2EZE*^)*~9{WGo;aw?UDMA?<-D&;6s>Q_dX-U!8gE
z$mb@V$<fD|b>*j>WIg}3d1IB^gY>OTZ23zP`U>=Nob~Q2gmTsxpAY_g@4TY-;-4wX
z*?~tc`<-iCe#f9Fjlt^H{wq<hEPg%xyq>$r@96aviq_XJ&8XDVKI$E|AnnuJx&PYV
z?6|vV?as@-iyB`op0DvnYh6FX<aH}t=S|vE#5247^3^vCzm+%7TvR6Qzx?twj|fH<
z*~#oXL|yw&mM_Uaur_^ZV)u0uUX{<fEVl22e7q(fV7@NUZ7K7w;?`T&8>jrzBc@+j
zwLq--;AtOr>xvTJ0?x3-+8^Y%7axA=rx}#ox1zG+-MMM|T_v0h6Uvi(RO>zU9$m~*
zc&XSG=5X!y?1}}|xB7Qqv~$SQez3cLv8=dG(+AZ%bJP3!^Yd<L_|+cb%3O7*Cg9W8
zC!!hgc6Vd8tz%D2XJ|}G<MxWNk+t}(w&G^v59cq>m6+a5DfTYS+j?YO!nSVK0P*q{
zX)0aIIs;YPx7)k9e_6a~?iGL5>&-h~9^viPJ&-h6;a6hg%azIo9-c>M)gI5>u=e`I
z>x*|JDO|WZ;mNzpcT?jZ8(+@8X>WYxX^+|EA8R<H&c`|`|7+!DTxuES=vkyuBvfSG
zDj4GBtnH?=K4QA1jnMM|=G>OkmV$m7DO?}tZ2NM~W1sdVx%BpyvWr1Y);E_KycBIs
zG02Yay1QQb#I0o=$9QL4%QN8JayVxOLxa{qiIuG9KQ5^bYTVgYnJ44>;&Mi?Q2V0o
z4ywMECsP?smOS~QYTtVPcmMrzZT}O0Kjr-VX}5dFzH@nb({EmV`+PR{nvVD#8c)tS
zh=_F@39WBBk-*2%A{4^--oZ{`(gwz=_M7$IrH!+L3w~)Z`0+1Fix4<)@I}|IEBr|j
z0$sBnCLir}RAyk=b|{p&=O=6DFGqPJ*VWrKt-=?4aJ!|gBkOzjrL}$b+Vi)*{NeI_
z->~ec1-I$ceG+Mc;_V;RZZVoXtL8oOUpL~wqLK+0_?+(le6YHX-^2QRK}S{a{ep)Z
z!)N6lkPmCQS&@)Y(%1K}ZCmm?=l%o9{2A((ebiZ<9SRMmwy|62d#v<SJ{#g${G!N8
z*I8TQhO_os))~L*#rh^*^EYBYH(Pz3f@pEK<-xg^%TB%eJ3&RfF1PFTC&4t!oTkrF
z`h1rT9$@fbFzV7}mf72ODla&`XqnE=z2zINZpnMJJwE%!<iGh0YkuLJRk!4na__18
zExw;tFK4rQdG343WR2wD%Co(%Rl*NH+xYejJMZ4vlh*N?Zm#ow5}ojUx-I969d~{1
z$auz-Ui$W9!Ya|Q3}*&~vX88$(LSOV$^&>$8b)NiYBJfAS?!sz?(CWDnCrg1D+FJO
zbsW5MSnDTGxo8H%iWQlW?<Nb_>Be2T{aUq9U2)0c#b@KRzt?T#>MD3|b4(>hVop%_
zl|M~>v(?*8dyOB@2=y$#sxZN}x?JiyKdb-4&PMP0>oMD>b21p1*?HvZR$P!~abEg%
zuhg~w&U2j1e(q;iTi&!r_O7e&V)pM#6TkE&e)GGPmLavCd*%MMYD-%_Z=Ko4>a>sT
z;L>$BC(7-;_~}&Ys_Oz3W|su5jhp5yscmXIzPvoWnR9{FX_hVO1^&l5PHpNcnwV<W
z_aKbVR<0zs;#L8}w)uu#3OE0vH5*;uS1eo2$iT3Y8D}RWw>Uj5w*)>RQ5zJWJ;y<y
z{=UEA1oo|=o}VtXGjqG^PjQfPdhGnbB4zdB?F)9Fepg}AQuDp9Dz5b!$D?=e@Aqvk
zW<Bq}d-@Z{sVi*NzKdoBZFSn-xOVDO!O6G3M8zC5PmZ6P)yJ~^x_P{Uz0x0te3Ouh
zL)UKf)jDWcD`urzX>{#celIbw;nkW#mY{6sNmDMybx0QXPCfT{&-cIjuYEf2o$uJW
z=EYU5yA59^a2xKDNtxbK@_JUC#-q%XLoakZQ$s~RooQ{nv~77ptBGyxfloho9E%Lr
z-0r64`F!@S#R|{Tu5QZL<UV&|)#6DimY4Kxv$NuKOMg4_$WF5HoX+}V_MDcNCNp$(
zt~G0N+Z8Soc*Ao2b-@9%3CsCUUA{Nj+GRow>(Wf+2KnUUrynnye_F!cS+Q=5+hVS-
zoud72k9UNAedGPSe%7UbS-t+13+G(SJQ*zJ=56;@_qRa}_rCj2f8O=pcl+7xyMNC=
zPx$Qr;rEl06V1!TH&2<iDfjSSo%y>2nYUXuoS#1BVIBL1N8ires967T>Ae58bDVD6
zoYoy9aon<-{hH2&%maMg&h7hZXPnnP@uT+$+LEH_cfV!JFf%ZSvg2$@6jUbX=N3RV
z8O;qn2wF_E_qF!26OKY*VoBmJ4mL39m|3!%NV|QEm5YVVv3v0h>8=#dTb%)4?psgE
zjV#+U{i@@%6EnZx+aq{9{KJ>uZ|_fLk6irCVyF0u<{Xt>mNnb<#63<4i&GE(aP-Ex
zlhaEZZhrk@9<fGn-y(A<mb^g8+d*<HPja0OesYy=KQNU^we-UU3HC(YmyTLG2fSmI
zPcUqGWF{3RdqZzc?>xruAKJWJr(B4f^M2!tt7U@Od`?ySf+9G#@MX&d_(Un2aZPsF
zc5Mg4ea~>lW5O5HQs=I`c>MV}^<HD$E6cX3D6hJ${w6#kWV*`#92K?|4L6J)dtZru
z*`pV4kn-~S?&bOYZ~lGE{P^=><KK_h|K3&7ePDHdvP*(-(>bMS=bv+45IvpGv0nfF
z`)iL%MZ;|aWP5Ae1#5p?FMBgrPc{6%=mw)i-spEK{dz^8O01fz&d!xjWO;Q|yG&5i
zZd(wCYvc9Z4hFva_b5wVN^)X7`?<t!uHNb1tuHp!+{i7f-u%-@@><J;zG?Ek$CB^3
zX`c2>X03UeeC^_f=f<1!-p>=;{=I(F7vVzvhr%Z6CH8(YsyvdLZVLW$vg)tvOA(3@
z3A;4=nQoeI-K3fu)8;X4;+Q)B(2;4D$xe)GZfw>4)_>{Vj;g&=Hn6{Yxl;I6%e__o
zj>;1!E-1+mUBB_T$||O1KilW5XbaM-b$<Rw#MO=KzuI9dZ|~bn#arTD+&?(+z1ypt
z@X8~<Ry-}}<@YUP(E4?$OJm2etcPYLw|;*P`TAX1N~`|a+4B#-9`8%@xK^Yq{UtGe
z?Ssbe0neAtt(RESpQNLo(C|WVQDcJ6tDFN`3Z<(}`kk}BT)k*E@yNnpt;4R{zUP>5
zYcx#>DwpV<)8iQGcq-!b(lnjBj<Pp6yWK)h-aY-Ta@U*fey_a0%?(@fMqtKa-ZOn&
zJ-k|dPyY%?KS(=WV`9#yd_Ci8qnn6{wuzJds+a9~@1C6CSs?0@9MZqr_4(3^KCg})
z@MXQZp7rPAqlSOljy=v?-XFYkiT#XUQ?FiJ@|>gneMG*~ocB+@K8cp<|Eo}McddR|
z#<$HP(=Gm?U2T?latGrAHU<VGK?YnG1Qt}5WaQ_?XXd5l>lIY?hUezrHUlk7IjD3X
zg}LjFiNq|n&)dp8uQOx{9gw}H$id=e6`k{iZBo%<(Vy>kD{Dq>n!4rhgiBBM?zbto
zsxVwXb&mU@8O|FMLl<A(G{c8)MuhlMmSdZHQWst5TI+SPMC*fs(TABrt~@>&ZRVTw
zBCc3G3-8hX#=EI!$%|!8!Rp-gVZ0};Qab}|P9;oqP*r>;HR<pkpI1C;!V|-nUhy&Q
z`Z0NusOl??eNJm4`Bv#Hic0ZZkff=#w#VnvDZcz0+c%vP`lJ1Rrk?kF*R31*<Q}aF
zOJc4#T^BFI?(QzUQHj^_Xld2&PkIeXf%jYdmd~5~`mCQi&wtekUpcKm?^~p3r#;nw
zePQI9BUMJ82}iFjaQ@<VJt{>@#mqFckjqkM-6^KWZG7vGH2-{9Vlh!R+(CV{EPv1f
zX(rj2Hvuf^d#}Gd)1@`#SWj!=Jd0n`6ci3WGCE&5u_g6O=_|{q^M&i?q>31FSxRQS
zy)7tXv8y#X<L27wk9D|=&ctVU#@Kw*;R{>zVCE10Lz|Q)Pc8OpT9<loU-_iHE!pqp
z@>Se6w*49HrE_VGA48}2Y!{xnIu=rf$L28kJFJTIcbHl@xAO&O?z^r2@!l0}_x62z
zal1--dHMQj|0YU3+Le$lz!{g2>9z5p)N85L0m~2M<tQgKHy*k2Abwd;VCaN^Vxgl8
z=4G*7v72*r>!s9tugWXG1lEZp6=t8Pz5e^aoA=YMq(}JZ_*HIXbA5kh!-hwt%jSx_
z+Tq72CbHVg#9t)4%HY7{sfOo!WH=?xO56|V5|ZN6mb+g($!Bh6&ii#tOCp&zguM2e
zd+vGmk`;>?URUos%27Rsdudj{=gHTP=TG33v|lX0vayT9fGfrK`Vlb`r3k@qia~pL
z`u>_dNS&y7tgv_9$~gT=nyO54rz;N&ctpf*6m@HV;+B!WfwgTN50B24xA_Y*np@j5
z9cPIy6q&u~(c<ZwbM1F_=xsYTYhD>+e)Z{XJSklBp7OXy*5~w}@2gf*T)ACWnE!Rs
zaSLtBC2g<&+}*rNKk3LX+lms6Yi1{lui2awiHXs*-@A7Y&-D6Qi~kk-WM-v(YMy4x
z{H)e@GvjB4llJ;cX7k+Zvth4qyD0CqoikgM*V#VcihIln?Yk|~dY#XAix;|nc(IU?
z?ai<KbB#O>z57;Z^z1Qz=<gm8y=}YLFW9}iePeC+b3f&qe24pXhbzVxSMds_y-mAt
z?JlF4L2>BX8LPClw6lV|%Qz}oEbb)T&$B$FAl2vez3Gv%_HobMnR&CyBFq-7d@FcG
zz&K9Q!Z@45PTQyYm=+5gd-aEeS2G`6;yN^uK|1cjwB`+yi<{2{-&r$BDCA-0vFsNA
zJ#I@>SSCGnQ`s@|q({cd)W=6^o_u#$EqS}``^+%AnUdOPi&{f(hMe8T8ql!dYmWWq
zZy7=scf(emP70ZJbIW7ZUn|QiKfZf*-(P;+`W17e4(!e1Sr8_4+<AYvU`_1p@6%=G
z&$Z9cI5EBNYM#~M(2V-)hMyH$*zdm9owZqmN4@BVp4>@cKS9ltM}!VEa39%pZo<mx
zS1Ru<sNP;~T$1-`^TFF}tJW1{Hm=M)dSMa6H>phpYoCg=CcOETzc1GFZ2wK=S0$1v
zI=p8!d7=&YPL%3=zVPn4SeN?bji-K`6>+mJ3fa3U`ktTL^y?DNF-h}83Lb5~9(#H#
zv(>8W85=XVESQpQJ>~z8$;YQ`Y-PD~s=)D&>Z(&mKhB;UzTeO7)S~XRXz9ZX_}0qp
z^WFPdfBvDT_V4e<*BCzAe)ap5>CB%z)rw*~CQS%edSj8{DA&9A^@eagjwmzhsd;CQ
zCvg?YEnmcNbBo@>d!JW7J^FR(<+^=uBHVj#EZ=XtYqRV(0q0hxv-KIbueEh)f6h(y
zI`(iu(l$GRFFTHK+>qt{cs?_A#ndq6&z@{zUkVzJJoO6|;Es7X$CIOAiebw7RxeMN
zI;)%49D|NAzBF}ZI4Z-=r(xTloB3c)%vuMgy2w=uS1Zc`8eRT=sXd`wxZ-D&EEmg@
zZNEiS6B^<d2X12j^s|^NW73h*v(7ym_f1+YW6WHzBG_|21LyDT`kBl0lo$1-8Fp2e
z`~LWTG_|5^W6ke(pZ@U7{%U)?NI7GLO4sa5%aa=x1g_Mqy;LD<|E;EcS?_)0%e?t-
z6_(6i$9m{nZqBD!@5S>Cl&kNHM`y0f`o8o=%8qpPzA|Ph|KC^MEey@x?8x<Y<=(pv
z8#kVLEB>TA?)F_ifp_N&E;`&lSNNp1=+Ny4Gjt|%6&EO#oj%xcb8k-Wo9EZ7F6{rP
z-aq3Q@;n6Sww~^q3ynR@3=GK}I1iOCN=;AAi%-r-P0j`{TACVqyYIG{K<)K#o=yCl
z0zC_uw(zsbEV!A|y<n$Eq%!Y@2#zfln`SQcXcV{p_nXf(HfR0BElgo?LFw<()AAnt
zd%r#Y^Y=wgsfP8(11$r&O}u~XO})zZIsB;7&c^7wa=ka+$?S>R^T%}g_52O@6l)w-
zix%8jd?nZU(1Qu4o<Y)g9U`yYt87l?T$H)B@W7NyeU=NS`cC?HPA-@27T@u(5Pu=#
z4Rx2LVi(Hp-;u0+MQlcE>6Lhqsb(i;CO7|!w%Wh+^M~5QtJFhker#oaXPg(fH+ZXD
zgKvj(*I9-iSJ>45A4+yQxW4?5)6%_94lKF4!SREb<&|3pu1BBU=poc+s^JnhYeChu
zy{wWEe%p**<aw)~n3e3iyCo{?*|Q1z+j_4R&1A53T+OgB;YwgZPPXDjH-`$X{6oBJ
zG>TnM-&yx#+0o9MNsn8fsEVsG8`_I<Ut28k^Fi9)MV50<sntktTqO5!{rpP1MTe3n
ztXh+hTQg<f%N2%A3qO~1pJV#$XCCsu%d=ADmPg5y<7Wl!?(FB}WB$Huwc(QOLNmP<
zb}xQ$^<VRaiq{Jg{XJL=Q(Pv0J*800aVXWnCFI~|W~S>7Dc$oHb27NcMe5dSyj}1~
zICfU^h9f)l4^^o>yjQ7bBGWP@<Q=nh+bwNvi&=h$pYOJRZ^u;lSvrhw%kuqF9W4@}
z+e8{>@7-~GvE{B<j<yqzZ{K-o)3E8J;wPn!GQl#-O^i}Cd@fFLdpcToKlpSn=)3N(
z%LlIO-+el};-=@^yCQzSv%=#-K1#(dI=OFAy}(_=qTlXY-pyLRrsT50(dirX?s31C
zTVvcW`K3;;u}}7*eOBv4yU@d(9qETYaN8`Y^pkX1Ji}+R@w`}@mm#<0nb(&dtv?+7
z*0<GORAKsWi*U`>3;+M$==3RGv!F1_c535q<F49!>ep6F8b?=8+pZTprS+-9N?TUR
zI}2J^KO9!ldcH4n{n<w0&Nb(QWmH=HlRMilM*fSbYY_YLYAOGrw+`D~IuEucq)$F~
zxMJP%j|Q{UxC=Lln|%7QW?q`mX0gtLhqzqVgoyg-oK~9_JIl8C|E{-%mVfv!H~W~a
zo75q9E7vqjH)FxnUD3ju3!~3mlACdE@ttCBTZPwBN|MDUrB6>5$Q4x^&OQ1y^mESs
zGy1OzxMUAoyxzYt{`|26O=YFNw_`S{z4>&N>(Zv283Cy?-GsLs=KiC1M`wejOvjSn
z?bA=YdmY}7I-Weq?aAUqW(J0n><kQY*cTvz?#?WM&J%?m1m)wszqL8uI8I44zCEXj
zHAtbrJo7?HqJrLqL!vBEQc)}_lT=q;bKCI$o}%W-qBn7?nsX-|Hh+J%XP*3t>u>${
zuit-yYfAIi=TcLqJ2llR$@8q2irAmp-_5@1;<KEm8$UjI`<VaziFJ&hv@O<p@YXx8
z_HF;(!G2Fy?9i*eDNA3}<}cLgeABaSUcu5W&*QS5ighRYS8a%UeXUp8sq{{`?;(Rb
z=4)+w7@}jAHG8dIwOuTD)0CsVhP#h3t>4b^v!-d)_gj25601wnQ@G2za(7xyTPN-`
z??7*0tbnQauW<c?)7@XXxBbgmVkPwM1Yau0rsUoB+s;3I_Wb!-{rT~Bwz?d4&TC%t
zAA7|mqqWX)fx_zrE|D71Q<-iCEUaMn4~+J^X0LQd{N<l}mC-6I6mL!Zo)UjVHvjxf
z4V(WS_a|^1+QR7S7`n@?>HX$=-CuX>@cSH9wX<=GzU0N~vg&<*nxtVON0NuD)U5k0
zo`$YPp~5-ub{x~bQzgFQ;v2=&`N3ye4f7^c__mjNu`K86QJ3H7qJOLY%HCD;*Ixa`
zlxh)X`e#Ff@B+0RA(^*V8}W$wK6T~Qev}jHJv(c!QhVICuQ|F`gvII)-<~EPb;I~r
z*yev5dHwvk<zD69(g;gA`SxO~xBL~$Z+=?!mp5DM`rDk4Rx<jg`=L74J9KL;Z=_It
z&R0dI|I0q)-sD#{tYO{8nl``8zLDv4;id1MC%VHX*mW!Mo>?0FE@=M@6`s&VhY!t~
zWy9CbIoUAIQ{sZvj+kRvS$nMa%9PCCnkRc@=Nbv^T1iQjg!SzSr{p~ORS&8y`J?pY
z`k9$wzYLoDo;6R2*80CvHCpe!&gMNo=F3`Y<sNTa;_CB2S5}?<@n%g&uEc^*iPMtr
zv{Y?h#aX#U{z%z_ms3^WZr0K+y4J3^;JaV%!Oz(;$6n7$^DS%sr|VI?J~HJI)8vmI
zOxybGtakcTt-avW^zQf$(Y?>EC1!q^5$U~5%<tQ|Rc+p`(>Dg*|H(Mbi{)p8Vc}aN
z3$rHA@FY<~cZSr?5|i08TME8CkDdJRl~4PB5wn`h6AD~YvbuU~l0U!uA@c8H#mcH3
z+s=oqy14y<;&12n_YDCS2by)CgdeuQv*Xx)t%BqJUyc|o%eOsy^Nr2~8`tH23P10B
z(JSn(N1O3yTKn}$Ff#*#1_#a&8qgtxNu`-NDS8E!YeT)W?-&T|`yK8h-IcqmY_dod
zN6x|}B3zm*vz!wnd#*{n*P5!Td~$ZnrT_OPJ_)}uP43p-3e*1lxcP4BAHIHjy#0~e
zl@&T-^DVX1r5c}c*_EuZODK$-r=DK0cDK6nH+J^v&&A(Ac-QcOb#2&zj~zkfx<4D8
zuc>(^mvDz({j$zHB2?j)pESFV=Gz&<Q8!g2Q?}hNb-SMNR>ks*--(Y;HoTQmG)$VN
zx@xgORBJ*rr+fR>)l&k#=a|mRIeTTD_@w^6t)MD*@pZY_(CvFBIVEoGxe#<#<@2J8
z-*!DUSNY|#C^}7N*2!z;4qbOMekh1s=ijzyQc3X4Ymzbr*3bC34@X=1soIq~y={!#
z(Y@`A-&W6u7YrgFPW08ic*VAl*GDz&M@LXZIcxb--dgi(Gv9KpS-Eq8=C26t8=m_t
zO5J3{-B*6^4xV%JuhXG3_w1a{FRb8q+PRwLMLFAi(JN<^UbHRv>X(%5sAR2V@u*W?
zNkE3zZMM48<-L!ZmtR$ovDChy$eVxt{r3~67kpuzB)&#nY|7j6cmLB>;)3OF2Dr~-
zZ#Uqx4=s|cVp{L~$x(Jz>7si}TpRnhzOh^uV%>P|>vL@nZrhIJ$)9w8>S#`XD){8q
z?4v!~73ZwfJa^{(rnI26;;ttmO|6<wH|OiPn%w(;RO(!EH?zW}+8~wx#(zQ{38nt!
zd0H-Ww(Y^i>^|X&w5q9pTNyTToH~A4RU-dfyHiK`yx-?b#GCW-w&<%S?TNe*drsnF
z+6OzyvI+b5c6BuhtH>qqZ#0Pzk2@-}?4aJc&*f=LHm<by3)iVSay6vScDCh4rj6lS
z60}U*q<8N#wtaT;K!Frfuz!Gbu5Jc%SC~R9&-rxknaVf#viBES+FW?Jp!(#(?GImV
zVN@2Y+_Z7ijp;WQZ@7JJ`D(4%SC={-+w9OcQ8x30)`F!b=MuJgW@^Yvsb5%jd!|M3
zVeguf6&2euU%X;zIK;fBJ|p^<+q9hYzvkJW=4+aS6g}QJeYcJ^@0Q4Co6c_UR!Kho
zPxW-ihx$t~X~xej^`?A1$vwrleB!+Q7xVmPSgeeh7T3O!U##@KfliB(!hzG_-%`2O
zE3|IebKR*|y8cFWw|DhKo%J713LEa@T0Qa0<zNFlrqf^d&)PjxeLn+gWyxa4ox6{h
zf#HN9&P|xbmAOgzIjI#TMTyBJ`Je^+ZxM$x?Pm1*b}j7D68$HyY*V)PpN^fy=6mbj
zp>&N+F1PP^ESk3D&yGd+|E77o%Cs)rcJ@(01aq(M#5oVo{IQrLxvBcer$<lsSEcJL
z=v=b*@&vUmUkTCUPgK4(OTLxe#lF_|ld*qzlW%&LjNF(0st?aKcg_m@G|g+?gbC*|
zk6e~u6L$T(gH?H5nvakq$22Xc>0Un?C%GIH*x7a5W>SlPhySu1KVhZxeG3#jZ$$h^
zVr`CGWU<9B!X>uIYGv>2pT%B6>pToTPuAq!y-Rer&;t%$gSd}8&*XNciRsKN5d7VB
zFyx`(<OAF<PD@W?I{&22!!`KDvY!WDOrG!8*uBQ6kb7d0TXOuS1O1Cc&jbgEEf;kC
z$t!Nx_|ACgrN@8&CY+jLEjXnu<etX7T`@l214B-!3t#wMcYyU@XY#Ud|BoFycro$6
z2FH9GIs0lWzIpOL{MFh0fBDziSA08C|EI>tQcC{U!^`Q8*-8~YHu;lQ`UIR;HsI6~
z`6xVN$GrBOt#7QidPN$kDqIQu*L7O&MTnHvy4n4G7Z(}q-TGZ{{<HU=>?&`w`e#1!
ztamDYv~R|;eG|4^y%gWX(-r=%b4J>VRor(ky?as{W6xuI-)!65IDLVbQ}=qjpO!Et
z3)^>Jc`!#^Wd0H<i(Sp>R$ETAo$qm5`PR+hux58pZ2^bpL&nC3C1(B%b)E@x9(+Gg
z$#OR;{QbSTmGk}X&7VJS|Hrub^Y$|BEO1);ef>GV^Zz^ZbG1z@-fJ%6{<<$A(B)6Y
z!}S9DH8Z*o=%}1`anL=o<n@*)1r^TC7IBpgWjCMAblRa>=hM%)WRY`~eOBG^s9W#%
z|Nkd1$+767-wdWEhNE+qKUCI@7Pors$h|C$<!$KFd#dM{T$XwsaF(zxSg`W@otHA=
zQNFdBXa9&bX};RnnLgbu`rxN)mtRk^R$Fsq)sh{lO4-E@7ySCNpFIui@NqmY93EiL
z!t>O3M@Q*ph4-QIS{gdjT=p+I-OyBA#k=PG&Z@JURccgO#CaFKU%Ta4i~722Gs1$8
zuP_jO@WAG1<rCeSi3c8-*_}u(dOFW=W!r*Xfzyu^Wqs8O^=LittXz}nMt_NT_rA7i
zj;t}eR<2Lei)Avs8P}Y9bc1N?kre^YH_tm&{)qc0kMNI2lg?*9`1j~Z&zmD$S%#G?
z2mY5on&7_eYyjKyhtC!rI~G;_MEDhJA-9+78$Auq%10Vaww?B0BQIU}H%s9=<GU$R
zbGN_#ux7=bo<+s-e?`9)8AmuDI>deCs;`dY-%BaySp2=*u6;fk=`x-7?X2nRe3X~n
zdU``~lC<QbZI1<Z_MNFIEYI}W(H*yibFzHhj>sqL{U=Qo<BEDSsrjRVkMFm0zmj~u
z-tskO-PQ7Lsq^&%EXhjElS0$4vu=@mkzjf!THWH%OOvTfWwToUv5Fc_7D}kse>L;V
zalyT<HaCn*&w4xXtKR25aZvAwv!8Fyh6j(>4sM^@T5Gl{H{z<dh0wK-@(nMhR!?>8
zG2HS`f&I1Znu_|*p+^{Z+AsFkc*B-`$24)Onw^bAX_?V2v02BWZg<?vTP1apx9h!B
zvxNGDl(hWT4@<X&-rZUGcA|O6%Lw7>gdbh|KhF@YmdIQ1qv)yC4%>?vOa_uxdj<As
z)p$P)U`{L1y!y;yL8qzq+Lj9(68zH>WE`j6a?h-~_Hu#uI|cRUpYHxVc{`l%TSVWN
zjDiUwGU6BVrJZCyB{}>OU06HA^oXRyMrWDH?2k%1`TE<UQ~i^a%k*OoUWsJz|G;ot
zLDZ9<>BQ7Z#<WCE-nX-R3uAsZ{$o>Up5nc&Mxk|)kYeAW*<T|*{%jL2TiY(l*lweB
zGUKDr?uuD#FF53N4o<Q?GAAij+V}j!gC8HR$hfaOoy&-IGWW*+87$A1d00Bv1^Z+>
z#s6&SuU|T&U}o%9mR3=(Zb_E~T#Fvq{CaapyUkIh!t6|llhLw9{+U8WoC-gkrEE4t
zx_WXH%W!(~J+auF^Tw%X@A}Ejg~t|M_;bg9v&OCZYxY)mnA;}=o+)v-cJK1x=kES}
z^JHbhwnhr>vp-cHzvWQ+b9I-~(tkc*`pM+!w?Z(Q@5Kap_9umRdEAx@OybdQ>33V)
zb@uD2gK~U@cj6uUb8S~7|60Skn}gx9ZoGDX$)4b1d9yQ<Z9cJ1-hcbP$i7vJw@YO*
zEi`{F?;$jKzrgFLT~bZc+ooqWZfE#*MaReEwxJkHN~jY5^G8o!y+4;x%N_Z?dFGiq
zwWD@E>GfwOCHK57T6J`XZ{5~~!h1JFG+BO@{loPtsy9aOf57y!A5T}Td(rr(Ti@VN
z%y*sE&zYO`X8xYoX6LJ*C~CJvz+lb0nmL>2@4Y<z-s$*re)X61WRG15XQ(*Ekb6EW
z|9HdP*~hLi9%*0pUAf5OkjLhlIwPq@qw}X0v1&-yOuX{@pzz)-RmpU>>oWg13T&qw
zYvKGLE$~e3)ZI$^Le8CR65p3C`QG?NZ{0=Bi}#J#HoasLe*fyK{9@xHf)W-C$@VX!
z#Hvb4=PQ2oZM*V)!t4E$6fSuBpBHi4!0lq8(8A=lEQ@u<t496<Mq;8Fi!7eA-JI9Q
z(fHal?Q1cY9($30K<$TjLh^=OO%HbRN*O+#y0>nB{gwASo>+A~E97Sn``PQ*Jgc?j
z{hjFLRs4S!{ExHAsR%5dRB3kk;_Q&;+crFwt_b2uId1gFxafDY^7iSh>v%57Ik8qh
zVK#98^IFvFmOx&>=Bt^;KM(Sr+rP18=ep*SeXMqYZA;5EHBJhBTO6SDd)w#68sRTV
zAHVy5`8Tut&bkZ#1;eG+EaRRw<K-rczseh=+yW(w<{k=feb1b5RY1~I?N6!4?`sdL
zIC$?UuPi+w`p3EMLV5d}YZ}+Ds`Dl8o^<cnzo7pTU#wjXpRa!KGEr67|Mra=%y$w_
zOZjAf-4vC$cFpXCyuOW6pQVpCJv0@rn8(B@bD{j@rdi_4o6gTX*AxEa?bGA)KNbjX
z%8)%Mx_9B*H*X$Cd-IvfxhSOQcjWxZj<$1rwD$Z<lUZG#bdL33cX+eQWB*K}c6Y(&
z=10r}_O@mGm%7xnQ?<?YWzwuro!hPM2Gb{1U22=LWFJRKN9O8l(<Zz;uP}qPNKo~g
z#>uq@(tA2G_+@`QZE)(|wQ2I}gD*oCgsgR2Cu%qGhVtB0!`egJ`zpJSsXaTJ^6|&b
zb)Evd?`Xx%o4ZiVA^Zxv;@K#@X+}{Tp&=7@tIT}O{qk(B*vm6bs(Q1$-DP*JnHc`d
zJ2x|L7aQ|U&*o+RDk}tD9N4pKn;i2pb<O4-$Na;td3wE?#9fn`BqzceruAZvqhHn=
zcAvE|MM9p{U9miemWChH=?#7np&YonCrtLhhVqI#ulskUe%-avFClo5n8x!5?{`(r
zjkw?Y;{K+Ph)>Ugk2dBpI&&_mF@GUZkaL%R)`}DU0c)z)pV;Whc6+z&5ufcD_aCJ2
z6kPj$Xnlc^jDPJ$2V=IJg^xszdvk7BR4uQ!THs)C<_88NdxrxbH@wMSDkHwScv}z0
z`nGe&Pj8<5*?d{vWqS*&qIXMcj916}4Exc>`C(74T|<3zZXy>`w6@HT#+dLYTLWGi
zar~d2%YI(z#8oX;(dPc@`cMDFmq#h^&i>1}v*j=Uv^T#D``?*giRnvx5?iq%>6Y5l
zTPC3zi_@=f_Z8Z-a4U;d)hU&0eU~<FG0<q(zkAoQPdoIsP5W_*Bl&dt^aIJ=oxQ6*
z&&Ud?-k-fBP;tLlp@8?{t7=;~XLh&0n62?3T~}+RfAR4bOJtTLrW||sKqS9ZLm;rd
zMp0g8)w%S}gk8!`t6V3i-C5f{FKspZ5m9LyxyC4Y+e^n69!=D^mE*{&>(BZ6_~P%Y
zxZccQxHbLtru>3CrZ?Xnux>doo3ySWNz;DLi&Vah<v+d#exCBGhp#hN!{H9^2|dmA
zQMpbUE4I8zSpP6|R<EPKa6!p87ti}AE?u0Wvj35+TD9e=IUzf5h#Q<cDET<<#Ab~(
z0$eK(U4D9GPAh8+hm=O`WyhchmWcMYKyI0({+mDj-Fj)a6YuM7u|>JuY9A)ATHyV~
z*WA{@Uv#~|tsia)x>DKqoBaMb6b8DSD8DJ0GF#;P>liiL38vB8tUKnudL5~DsO;#;
zw-wtqxy?JBI`z!5;wf`a%y^XDdu3YH8@(qvrfa<Nq8oF>i#S8?PncDD<!zPKocQHQ
zLhaXWylS;?J$r7x!R(D{?lRNod*;PE%&G6Yr^S5V=rMP%r-$kn(U30peHC*<)x~!7
zNgZJ^mE=C^%xQXA{m6{f50obF&{5cXCD&!+jBCQJ)rvPmdh6ET+ID5mzxP|!Hn&{g
zu<h-U3gwd3Q72YA@4o;0u>aerdBro+PyO1oZKqR~&CeN5C!%8t+1k4p=N-Cz;oP?!
zmruUGzKg}b=enL?nN-yMuVxAVey)mc{JDI`!^+ujzldpVTC%t7r(b@vfT_fx%N_lH
zJJ!StvAw($+Va=q#244)jW2IEKM2cQI!nb@J}co-ioVKg{XLU(Za>|tyGO0jJkU2i
z-26fBisQWj%ihk=y)QL|d8cS);Qs9O>o@=Rh`S=rzh}c#(YrBcZ-ogRTzaeaGoQp+
zXEh(URSTCZPkMDnVG~<*#*ObAtT}Qx^LF{hDkrZz{Gm-{tH#;OmoEKLTNrERvD&J8
zpJ(8j>db9&kA8l$uKm#c-?~Bl$>hSPm7n%xUYMx3Q*nn@(yF9~W!(!?7liEoS$QF=
zG0~P^@p)xM{mqYiBplvXo-16vthz<X?tsd(!~Z_6xSWZ8F~t4YXjy$G28Qb_3=C4(
zM@vf*(~Ci4F~Rq<ZyN~IeUC5PB63^t+ogTF7aSwGwNsQg*zjyhNcsIH!(!3}&DcXX
z{_mSSHN{Z#_31APDtG(e?|$!h{X^-$AG)(oa)~B>i&<Q>X=29m4+$<?kG;{G?{fV^
z;OxCq-`+ZS_sKU~oogKPCvItyir;WK?Qr3PfSg4uHdZmaUd*|BEh(_!jzq33$I>mr
zep#-8B^8%TY%Xpy2@CfSdDL6*+HczN2bS^u>+<rKWH}1xELw4l%}R?!^yxiC%hMv0
zL^knXxW8QR!z5nir*^4*)}DQnEb^CjUrzXTT4{4=x=GRQ(33{r@{&8OPg$7$N>2N2
z8=TZUGwklYczau0n`5g#YTkX_9kX`(yMH_>|7_~LK7Ww=da?J-ga>ldV!V@rGPbZX
z2YnSXcyDp`w%>G58>zk0M_&p|<W8M<@X4gEs3<X~6;&@Dz2z#`^DL`<H}`yQgv{#`
z$KTKBwf{ebeMbpT{FXx{qH|x0)Q1=TbM~J4rRK6s=+bPTOB!32Eb@}(>78(jb*^=M
z_)qha$YbH=C8CFUO>CzhE8h7g&2QOcJ<sr$maW}ktY`LF>i>=Vw)@Nu!#OuLe3CWh
zeK_y!#MQ#Od)>ZHI=TO2?L4`nZ(=I{)IDq*_c6Y>+nSrn)m?MU{(%4Wtd93v-f`Jq
z@j1L(PkrIz6m7YsjZe)Ye)xxG+oz@LHLh21`XB7CxpV#gb5bRfv_wAq4p<U?fPedo
zh&fL+tETd7@|x6@9uhjEphN#QZ^)zLFZfZ%8S-QtRUR-fFoZKQFlgdPW~s#`@j3a4
zDXA&(x%nxjIjNvjXFK7b-w^{Im-j!pyk#=@UFLj0AYSl>ccF&KySxR3i*DSUwEy_p
zZ9hz;_WB%)%kq10=hBkU622s@om>@*bmEfK%$_|gd>&j^ye!yTf8x3al4{A*Y|qWp
z<eXakqx+c6!IEwso9huQA*RO|;$^dxuWNKEaNoY<Xmn@ev89LG1dMFC*W6_PYOLZP
zyEuq1*R}0!8;g{^xuw>Duv*Po*3Xw@Y*2f!>A%5`s;AsO-)uM4Y`Ah>Fz%khq!^wT
zf5f+{+sM_e?Be;o&1_3ZMa0*?3)(mIbA4mC=3jj7VE7edp*^$gQG<z%S@{YmH%?~3
zIXqgLmzh^wl9&V9<dPd4n0?!Ur|$cDfhPy~y!UM3PnIx}c+1wD)1#Z*T-ws@-`9V$
z{FzER=hFYRpKkg-Hv9f)^OE<!Rpy#BzK_qZKO3&*?rrgZ$;C~YJimDEnQQ46*3H#h
z#Cd1OvlnOArR<1{+1ps!`9bnz<b@r_Pnm9g&=7bvFr*^<a9Z$|J5_gb4qWN|%yTO0
zcvtUc5!dFk7a#Zb_inTfV0o>v>dra?(L+Lyb_vhyZj6)mUbAY|Z_l3x3Pmz?9CrI=
zvxh6K<LUS-^6dSC?#(k?6_y7qn-t^0A%4&ycb@XanM(`gw2}pTSg$X5yCSW@tUT&d
z)G=N0&)Yw4dH%Xj)2T-5(7c!P9~yP4KWDsqa&F1xZ52jhVOL{gnXk-Nn>laJoBre-
z85UmBM^m#rr028z2#H$hIIHrR$iDr}<vtf>IX{0Du6c62>x0swt?6?XHyo2b?OD?;
zYV=BH-oe%d%lY<49lCn5wOvNKjsKzY;tRGvjQ`Ht*O4C+{WbN~0+#QN&lH=hYdjur
zyz{cvKg)Sq`M2YbOB@o{EEFoON@xFZI>@iGpUIBvZ@?=B6WQ*X!&0wxs~!XymK^q;
zP#toJ>$dU}-Hke|Pd`2I30P&@c4}LPn9a33{YX#0#6`8)!cWVm9JGp+e01MPz5b9(
zcf@^d$sPg0-q~XRT^^e*_<nAF`H97A7RgE}-}rp<V6#Vn(V9D7Sf8GH>twqrBPh6?
zr(<SJVn$9xmS)$lsx5EsvVN^QKW}}uK(AXO@}xIt^IgZec~cab7#PmuPHSb!#U+X9
z>EH?Pr6ISwZX1A3Uh}!hep_I6%0h3$B>}hWM7AxxU?bur5S5wJy;W85<jy~}$2ZQk
zxV=>O%7fEqJktBl^*raRtNH)MxH^Ps>+v_;F0vsjFNl6PSQMCCHeY|S^^c4<Cs(fG
zE7%{i_w0+046~&kYF90Gd?Y8G9DR$2u~OP~sj;p>SlPnj6A~+~Nr^XP=Q8o1%8++m
ze185PCZ4<dsyChE`10j#0ayFv&|OUL5`|rbyan8*uS%+Z82KP{(TS`L4DvDuOA^zj
z?#Z0Dqe9L%-%5Rg=To<K=i3FJCOB&9o#X01liaK{BXem+D&y=wfj>8>9@lGqV_Rb^
z)y?sO>zzr>7xBUku?=6}*jRFE&buk#$<ZUgUsS6)C9W*nrl*GEVB))p)`9BV*N7!g
zidkeJG}+{=cDmK<HJA3>&za09(9e|HaQ?Y?XWX87X_qvu+WEDvB<Q>fyv4d;na-9H
z*~xou?zVWlI`CeTr(6a9RO=^3o}UA6KM8w$ROh2Z;M9=ccRmF?uTZJ1HM(Z7_ffoL
z@5cSXQW*=stl8|sn||fN*<Xh$0#<&sus?HlUGM7xB`f~F6Ju*S{`V%$l%K;j!>8s_
z#*4!1FI#q>`hTy)tDP}P>zwM#kfW80_rLi#{jD$io69-Vj~;&4qvdnENLT&8v*FJ8
zpU?jpe^2r<Gih>`5|x@}BJMRyX4dw<cOup+rmcDEWh}<ezP$3{b}x^riB-)r-fdr<
zG=14cv_q^M*(0CoGBPm4FyU-hR3;YZf|d$SG|WG&AkbP~cQjNsXSLxe8O^Dy)~&sA
zFj_=0Nx`+3@t~si|9uk4$M3#kJ$SeF{oT!<${3D?9C@LdynsF3mdX5>l6$VNLQ3W5
z@Z+@;PTL;o{=99vqK<w=`K_2n_7@z2L5=;({E{Cs$o{>+=+F3fXX7`~EeDw!zoaf{
zf84b^|DP0l<_GQYS812sb_(=NuZrEec7or_*=wGuz25X#_D-clgndVgZu8Fs`(u4+
zOf5O96)WFJ-h2B%NbUX}pTHUSxMnVsx4ty*e%@E6d0)5ODzleOw15BQK+dbxV&%ct
zG?N$?U)NZuvvI}$sdJTLu2(h&U#$y!F8jr}^=60Oqm7>f^K38H|G4$#$*UC~tz9*I
zV~ds?y}`HYW02|P`cVD}i*DB1PGsszS#l&&<l7UpTfG<<7#Ns91Oo$u0&1;VlA2qP
zlUR~ktREkrnU`4-AFo$X$&5Doe@swd;tUoB26r9?1{GZTlM4#qhUpbl9t{fwt?aCO
zzJA9o{z<ovcw9<6FlULw?6S4(D%{&dZckui(Y+`p-X-L5s`ufq{qH>jw~1OGGfS9}
zc;nK?cNO11zO(-J@cQiU`{m=hrf47Lcb5zg^I^H}ToJv|<axV#v+||(?oG3@4bSS%
zk&*q+u-&p<JI{+%a(-cC80)RZr)v~a7M*6&n0sa0wK+iouAy1nJ}WO7X?vwM`8|~B
z$yVIl_|#Q(=F_wU3A@5A6W2cMclzW%CpD%&z>DML&MB(CtGl+P74QX$d~Nkgom*%j
zymX^fbEUI~{bS*U7I*%9`s^>Sm-q7P?bZAjqC<B5nY?_OR@jHseu2h^;yx>G*c#aS
z@++L3**0DOW9qa6NsbKmNkY3_D+>9JYcKpQF`KtNGcwx3y7=4X-HWTgbJ(7i+rb!W
zmH9Tos98Tg<b6r%DoduN4|Yt{nVxbw{=Jzv+Xv}IZSy9V85KoI*EOGC9NhFzV3zL%
zn>YRoxceTj;PxqD5S-=0{-WgA)`N$e6<xYN?D@jYVX%7X($uH?;-c>st@qJhxGZGX
zD~tNKU(0Id6nCwhw|sq^Y`yqh^_CCr;zIwHZB0!+X{b^Y*}mBzb?xP;41c*&btVga
z-@5DB3#QW?#*)U$L0cSNFKKk>GCaF|^|DJjQ3e{Jr#$0*7HH1kd6B>P^>y_RZ*NCA
z>HquD5#&`E9pY-a=eNzS8v9-UJjA!^%J0bPTfcT!m`A?d{@pUM3)*{@Ukb75HP-yO
zSo^~f%g2{K)F<5B;+DM9$WU=@^WMO>pU<tiniLa#ePf}Guv<^7NEu(DzD$9>=dOiz
zuk(y`{=47Flzbu_5^Jj$`+q`+QS!D&krjo-C*szwIv%vd`OBW2BI?WcG3fYMPRohy
z+1V%Tv61Jkrc|ck;bOT-3$AE9I8^kq{=_c5ZyQf4eShPu?%{IU{P(1rJ-HTd+-_}h
z6=r$&ac{ogd7IeXZ)2oxU$~Mhc5cVpccom%{@t}HyY#gFXtV8)a+@8E1>yl7);`nu
ztXAyJc=&d~=lurv^(MXE&6xE=imT?)35O!St&WQ}s{Yu?A@+QY<DbAb&x~cyGrEhf
z=&$j-^uT)axoi3?R~!9hz8lPV6<hM7u3L0bwUbX@)QSr^&ds`y9`<a{xPJW{->p)i
z>C5lua=bm}XA^2_`Z+1aYnP)oN1C3|p1cK{58Nza|GxcGug9JYZ5hog%zw3V`sUSo
zdCp+&t;@dm>vMZSt7>P%!vx+)<)*y&gbIa+b;+*^HF_8$PaFu6TyGHIexhS$wezgU
zT62%fiQf-35ti!p(%m8XPUzT01+RIXHSszBUOjo8l(%7ua`UMh^87icHWrKid&$Vz
z?mWBi_+G2M{T2yP65aYQH#Dt3&9Qx*+_Ehi#%I<`8Wpw(r7Y~6@u(=`XkKtkvhdCx
z*=_eOPv$$Mx?Ps<QJUof@u=fVqJHcv%x284|DK(1$-MpsOV&1}+zG`e6sGAGRqryr
z!+2=V&K0X>U-)tNb?T#b*1X$S#Ot^8smTae6m}?dd=7iVRni=`O@D><T3xQHcX7{j
zW2AFm*vW=y&lR{Pe6?o!tIM1li;LE5*?#D*@6sn|)z3lZH?!H885ndiSM<RPGyUXZ
zI2%;3h310#xBuS77kb;@XuGmRnrGT2$LXaPF6O0j<^*&FzVTk<I;}@#JFnvZTJ>np
zxzjJbJDui}H22-S>XPpsR!tAjK94^hZsVN!;fIlX=FgVJ?+#a<+$1Tt-?!?ZAWz87
z3pG}oKWr=i#OP++l5OJU)c0K@Br-rIBE?m}XN#7Culm%rCd)KGEDE{BG&v|TZRez8
zzeV^GVhSg!i**MXbgLQm?3<8u#Hv7HhT-%Sj;4e*rxhl~FRd8PDexRVRbbir@X&;x
zCLE`-bSl_pa<`=Zo$eL(fNR=mh8HJ0T3Q!g)qC^o`1keV&4It({`uAP!0L3+>iaWp
zsx5J@&^u!BPO>2CndxJrtfu_;4KG)AUO&K4!!*%YHC$tP8JqmV>$6JzosA_0*i{XF
zuH1Q4TkoQ?TKp8f8NFo{4XMQ@3RAr!b{5T6d3oexCU>Or)R;pjZ*7bE*)Lw)n|6m`
zubrykyR~7S%Xf#)S)O7SxLz_?s*3rQ^J>S^;__QhE-o&p&P)_PbfzViX}5c>hvJ3y
zf|vWlzq<4ZhjGqcwJA)%@=hDSk9U-d)*P1e_gc#f1s*Iu?YciQ^=5>^(?th^=PeDK
zdd`f^>6r?v8jE67tfJ!tuFgj@B<BUPxE?=yiADas_WRVeQ)k_`{_a-nXTM47*b2>m
zd#_JBUQisoWYLw+f!=2O?wvhSchUSz&)?s@4;PuG{BJxJzx;Lh$*R?NB-chfIy}wr
z)`Oa$BTb%%j8v41O3&V#SZwS*rF&AQ%t{UKZMQzQS&7+4|NXC0k*sN-YHa*y&T^9r
zKKdGq7jISn%_+{FdY^aChs(^;8M*lfuP(FoIr!A3_Q8^NyDNK=_Rp01U;0C;KS*xk
znP(i=WbNl!g&cdzn%3~s`dCPE{C<@PuGP;p!ZZ6+1<y{r<$Il{H{jCKsk)1*3TLh;
z+EnE0=v8d;*ZG)+&!HcZ&wPuU)7JB}h1~meY<qFB^3mFQOOvSw+?VTIzjf=C*R@NB
z@7>*6cx&=G<K-E$4}RS$x@$Q#O7C|2!G*?2kN3DgSg@?w9<@K}aPnG11PcR0BR2#3
zVSezeqn`|C>J?O;4TEg_I2T`79N@txWbSFN8_TsN^LnMnriAQ`yqOLcE}eYj6wKtQ
zY8dnXyR7D^Z8GLJ>~b5Ky}uu;o>#r_`-APTzt_veo#5Ge^l)L{t&>iREL*p4J>g|z
zBPqMl)?)puof9u#I(YKp$L}9jy6kX?&OGr^E;RJ~34WO_$>i3RX$LAV?l`9KTp_(Q
zRfc1&w)&hkTYAlm<r6M>OzoFBm!&FmYoh3vmM4p?j>|7SG(X@;#xa%D9!<-Ks_$bS
z@Jv#<xw?18IhGJB=WXiTr&dppDt@rPe|_BC1J~DQbK3v^tn6u-&XD3&RPnvC=3`yW
z*NOU4;dd9tP3oGmmb=8M?(fgLM}N#wdNM;ZI(gbNuZN5Mi(fP^-1I}=Cc0tm@^h&N
zcQKq#`x;a7aL&ZZ$13k#{t_2uInisE<r3ykg1tq}4>!zzWqvq!ndrV5OQiDW@6?c*
z`*T&1ZrTo?_VtpBtG0xm+O}GyblEJKhwZMCTBo?R-hJXt*8je8`I1&WDI1Ta4OVPw
z9J+@?tQHn4C<__iXpfOPGiR2w+7uz-R)d+&$rmG5a243es3x||>_71*)nop@ix~?m
z$^)!gjw%TxPLK*ad@*}ljN6*qH@5kdvv8lY{d4Vau+TNG*F}-Nr_6Juj1@~?$+yf*
zW1lef(1Cw;d+)3ln&kRw>W90MGV5FZtv7oTv7}jCY|akn^K<zx|ES!$SU>*Dg9H2T
z-<P=?^lonWk@7oU(@y(du;#kgE_1AkyEu2%{uN=Fn>zg078fyiPLm1vQN3!G{%=i{
z?jL)2x^8USv+D3Gh345$93^zWPSM_9eJ)OQyR(~iSJ|YarWRFBQS4e<T=>>CZOB@o
zFQ60XvFV2Flh@K`wLb`MKK3(CX`k1_J^2A^q)sL;G1hsw%aiZEz2wCw(+s00iAruc
z{^5o9gT0@*ejEzxJ-K0R-2ttwrB_b1T%5_aS0($rRqMM5{W-7NZvV^)(%fhG@JNhi
z@vZwJT|YQ_-3v5&O*On0PR@TK=;A*qFzEhA_Lp8=G7P-VXY^d2-#f~!x?_phYhJmJ
z;%vbImXBH!XM4VB6pUW6!>4GCX5fD5PQ(9h((I*X{><8mS{2ssrcTW8FXz0RGKFXV
z#Gl1GTX$=e9K92CU2R&=%U8RFgO^;q{3X>*XIk5KVej;>Y11ndBBpr1xW8iI^;9SK
z>*c|AtBVd@fA`x&(KGC&lb@&T*2S7xCMNoF8=srG+>#Ot`uSMx(6(16;^qj?mXvHe
z@>=QoL!;Kd_X#)DvgW7UGI~B!QP29>Jjt_()}K|iLTxv{xW0PL?zDCFf1f_*e?I@m
z)!V1}4PGS6{8?`nC$4qJ=S%0xL*07k)TT(RDewLw@hkt^qdw6K^Z!}=crErif8h?V
zOD((ng8T&1Y#EYG)?PdGvy|oH|Al5Ysf`mP<mKnK&rx-hkk;oq9roh$tp(}3H;0+|
zcicH!u;F`k@!?JX7pJ5OUcPChQ{MV2{<*c@&#7-Go0P})zsW}}m$n}{R5zQ2fx(Z5
zfdTF8cz9u?pIn-f2<M>`O$Tqut8DL_xa4qyrDvnrODld)u^i29io6_Ai*)s_a6@}8
zimsMnZ&+?GKWmWlvZ8!Xb;Wm?-(R-B{%rqEKSha4`P=c88f)fwEp-1<dvvnT8+l%S
zkNNYaUUfPhnfCJH!H4``)P%nT&DgYH<qYo7Fv~Y9L~YblR-K+>WVSYUEo*Yfv(S~g
zPhA6}@=_ybESPM~J~?VtNrr2jW?rkLRG&Jd^i`>U8dHCGeh7JCxTIx*k4EUGC4QFK
zZ(nHkE?S}A?Q(VH0`*NMVal`0TfPJvPHkOqegD5tpO0^rF8liLlk!_#?bv^+LZ`Xr
zb%*u~bp9yT>%L)IVC(%YV^X1S{QhI7YaFI~JAIsZ`G)SL@a10$bW7xuFJIKq%=Y&8
zoAdY2w+H8JzpZ%s{m_L)C6{hJOlgbXC$jhP)|Fxos}{8PrfgM;{#Ru_(?sOHfaxBm
zTPIIs=KkQd<L~4A!#ImCOYVpI4c7C8S6tO@E#5xS_>l9IkkFFt?Ei}w^72jU%h<wm
z{=yNa4bQf2TC?Vlqw_<vU#ChHyCs9y1^L~t+AAyne6Hf_%TLbEKKy>sZbrpN2U*+i
zFWFYJh^6W9X{!wxnWv)Evl;)KIux-^<lEL=Vg-$pocx6IQkb|S_@zvy%-QfJ^JmDc
z^F@BAl?0dQFW<6q&Xi5}kB8^?zu2DNFI4vJxw?ns;bj4>bLxKB?6Z)MuT46AYufik
z8Rs_Y?hiY$&c1$!#QcNKT0*H>6OXJ6dUSB=uLG9Cr#k8rZ<=@}M=mMyielGy`#PyS
zZ|$_nw|3p@eZ148NNMU8ZmI8wK7M0s&RcPQ*KMBD{{_p#*v>Fr{rdQnsgS3Ld7AdT
zrQ+u9Z?3MYT9jhc^!)77ih?)&_b<(KczNxo%ZmyJVUdNlZ4;*z&-vWJveb={d-c@+
ziv6J<mDcMR`@7_D`9<xm)|`Fzf!pG|6}tH*feHQZYiC#Sy}FgFe)&e*x4g>*$8zWA
zKS_9F@0+4t{O`U-A@d`>MJ6vN#2LLg@NL!6?cC?<y_@>({mSc+`pCgFkL8BDZbq(y
z(Y7UZRzcmF*$p-+9P!0_8+4bgjIUVY-dvtHcWpe!D(Cq|-waNCG`nSgKdI$KpTJ~C
zZmzRtIyaa&()YOT*q2o%ux_%2)c4)J8M`+MpYNJA)74H>^!5Uggy|<mrt?{F=bSCu
zP^W#r<4E_mLxG!iq{lBk`{3qs6As}87xT|X*Z&jH3+!Rwxon!k%W`+$l*bN-bdO(|
z93betDWq{>P@rOf`>_LO_BK9pnW&T0-~C>FniuclAn!!C-7SSCJ#6P){srayV|w~J
zDKX&i#6}~l$Mep!RBbyjUv5%?#hRC;Z?3+qdeE>%pnLs;4NccWTh^}rEqVI1$WK#d
zwLS$#M&GAArxQhM!#H~16-rv?>|L(Dwpn$%tXsimnG4)=lZ13@XYbhBuysG<w(z+N
z!*iHSqbHi3uuN%4?Y_f(R&rVW4Ab<Cm#;5;x*PrMfIrup+afb6HuNb>vifvMz;Qxa
z?}e$)*=E1lv1HxVZ7ZJN+&$C0Fn7zsJ*G>pc`2?_-*r<j|L(;N)oE+4ZhutU=5q2r
zYUy_JYL47*W(EcUE(QiQT*ERcIf;4cD8*aoebB);b=Tt$Znd~!w`JeAZ(BrU3wGRV
zkiNF|#xH{f;T)S>)uU21CqH@Cr11Z@#!bJ^t8Z^u&gwhs!V~vbm)$>!)a~B=^Y0(^
z(8V7s{zWe0Tow32?L(s8E6I8L_4RLP)@=E_H2894!*}uN_YeN%c__BmRN<rK*16k7
z*cn|<M?B8qo?{;SLZ*ms)!b-t2Z`inj#E<hKeh-icr|5O>VdL#t`6~4j`t@deUbRl
zeCfx`I%6}5Lq+S(h_tj<AG^V`bz96QL8f(zr#D?Y<)^&GY36FfbL^3qqHk&+yHKKg
z=kKr6{qybaeV%WBr*6@P$ye{(wBNvYr$g+z`jcfZLIjn+9}GO#?k<q`iaTPh#078D
z3GU7-FZvwj*|)RpbW(*_Joj=Yvs+Kp^KDo@w#fDL3dBA+Jw1NkjLDl>einR;h{=5<
zBUH|&SADwbY}vtg>8F_g@;*H@TQKvt1M?k*(!!%0Z5@@0Iv4l5-)@+ZzB?o(eZt8%
zI*fLUKbLeGH0GGr#Pj#7m@T^8c)N1fGftZn?uR^r$4jT2{JQ;Svg4il-kUErziV1y
z5@h!4<D|@|xzAtqHZGX@(J{l<vibD{1rN=T6xBVeG@BN6|I3LAUGJHA_5X9;lbOEZ
zzu)Pq$jv@?Wn)Z)#wiD>RxVCMEjHDaVQ$M#o_V0_@w7vDZ_BJzolBj!wwx2@PLSph
z?9(bZr0ZQ&KmCbweu-O#o!Tk$Pd9hYezHeu?ytl0JLDLvci#B;!R`+?+oby&uSw|q
zF8RAYD$zi0!`Aah>nHtK&2)dV`JQF@@*38vp9}9?tqEXJ?QxY|VIx@M^7NvSsqFXD
z+cwRz*Iuu+G&JJap){{cOO~xzDE?#OJgK+Qnv-8DtPgwEsV@?HizVpo(F^f=|4Z0C
z3Op6OW2y8VL7T0PSsb%YB}MS=Tg}$xz3tLLyM>X(oyA%qNo!ei*?+aR`332Jc5zs1
z?Ro7=+BMB3l0`>mq^E}M3Ho{e>a=Zs3$B(fZk;(PJ<9IE^m!^lMv`mil=!oLi=B{u
za++w*le-$qma-YIT)g>rby*btNOvzi$!X$Lt#j&FncFkhkkcJueis)g|1IqD-16LW
z`qORyJ}u&zmc83yx_J8EES>h*Mc3N)yl~I?vh=VV^9$LM{U^W2vVDGWRr&bYSCh~2
zn+RTgm%V(_mBptEmS$S_cQ605d}_djc~e)tjGlCHYW4l%dUKP9J8pM#-d@!mB9^rI
zl#b-$w(V6F^$+uF_;&sMu}nH+)i&Gm@5iPcf2U(>lxV(>{bql!g4w&1U%q4tK97AD
zXwEvPp8xyP-c^U0d2bj`+FU&+XIa8~$#gICelE@Jhq`Uox94P+r1u+k2u<;f-umH4
z>YF2f8E+rov>$C$_pDBK@DyeShL;=+3>vtKkF@-vlA^>s<O1YqsBivl3xU0#!_TO(
z-)v1z*}Yuq#KPNKx^-sdZOCn8?Q&YMWa3#~S1y&QM+|=5|2}croD=eU*Xd7dGw%PK
zcCY8$%g=Ye+KbDFo;>#XsP9p=6;T_bFWe5BroFGicE8B;FXy&pFQ2yBVZDBRt#f>s
z&-OQK7k0@<+}`FW!#b^3VC!byr<HeG&lS#_oE7z&$ul`;f@9?4>iKF+B6BZYwJErq
zC3)lg-Xp@wZv2h%Q=Uoh;a(Uz@w$O!<|oCbbsDFQK5_>I&5KI+URR)RtF@NXJm}yN
zf58szCjo+c65Je?%1n1$zj8{{X(waR>{m9{{@a!bJS<o^InP#n(Z*1A{y$f*aS477
zUdq*Aq!YDVZbDbaZl<s(os8h}Wj!&)%F_Q7T{3+qXa$9<eV8Q6D<{Hx&SNhBw38tM
zb?jvUdqsG-mOJ+!c)#>g^ZQ7~TAkjDsqAwez1*R<QMfwxQ{w(mjgRa4R>+im&MKRc
z;^b~Uoo|-a0pCkEncF_^&v>D7`-^|{njE)C`Dtel{AJ|rD-oNL`|G*<%LR|3%B-Gj
z^Hpj+y!}m})#5Wo*8`u1?@zry@kV8cy@kj2H;dlb&YQ93qNlAWtGDNs2?CSjA8wFp
zX}O_svf_Y$Oqt@TbB|-&BxduK&FZcxY-it{fAi?q_wo65arbL}Dc>(Sc+Ys!KfRXt
zgWP<#vp?C1sdgN+{w1An9bOcdJZW3Z!Xpe<o0AJ<-A@PHEP342cKY$fOC>ww&0DYj
zZ2q(=AgZ-=&3&)X8{!Nup+U<XxlY;yJ1aH+bu~L#GGS8KGrRhbMAj!R*|QATI}~dU
zc=zs@`rT$$NQj~DCYRt}tWS3@x_&q&=gYQ|%A>kMYj<2(5na=K>&BGVo~wLU?&i9-
zMSe~28}Z{klXK?z`lsmK`kl%*@%T=!=$uIhn^Xf<r<%$7J@+<yqwt_2S7nCF&gJ)R
zNQ<nTP*;5?_=W0g@8y%?9!L6H<OWE2sJn|W&iu`?At`cWw@=%l<ChvQO!()&EM=GM
zQPJ#N|Fw@k=832-(e!>Ztuw9oYnIhwv9`9v&e@;dz2E<@=KnkIe=py@t!9|h`*ObR
z`i{+89&ER^v$}9IN2Detx##j9`|@KG4@#VOvFAH)EAO9SpD>xnC_q)|5{t?tCaG`p
z>~b#eea*=$fA*!*lG^)^KL>Xld2K#D(&)HKT*#A(`0{z|qJJVAgF|AJ_5bwO9w@J4
zf3aNrANQM&-=99&?*0eu7!ITV)_#AO7#KP@@N|2!63bA#J)yDww+%#Uzpvk+&F{(L
z((37<{ixAU&LP=(G5=(Nt~+10nOc;kShucvRe!&9QW__(F#qIj8bQIo=lrf*x0k(q
zdwiW-ov5Z(cYAnnh~F8OS%Pz(+r&P2SZI?{U9j-;RKd@!&5s{mRF}{f$h(lm8XU9e
zN~N1k!3pDIX>REgR5l+HWt+_6GA;XYgZ5I{awqNRWTX6qAP&o3*|eQc_;PbBYZVKh
zOsi1bxix&t0g31ZQ>-eVc+bnxEMRjKFqkGTtQq8CD|PLu|DuXE>4^1`7mS6wyf@gj
ziM*R5n8ml<eqVfiT+ihE=jPK>GB%v+tvhlh^vpp`?U`F&&f0Y)iAz$P>(DJO^Wy6N
z0=cq3-Oo7fm+}rN-rm5UZt&*K@8@}`nw=5idgo5|O<winfE~|)kLp_%Y}p?B<I$}O
zfw|u<estYYaO2kPoE!2sJjb{b8}C^Kf7*IqmwD&=AFn<;+r3CleHd-4Y5i-J@z(hU
zFRqzcG#n^yVm8|0lI$sA(3B8cpMR=X^IU~u?4r*>7A!mX=j{v(`RY>jbZ#w=oYJum
zN2{x!wB5PzJzqR~HTPsQ?vzXAdMiU7-Q9X&i>8Qaq}Q#&We!F@la^diztc74jG)D;
zNz;-(nWuQzGKQuIn;fx!d1@_F)e)JM8LC=2ohKA{XRLa;J2%rc<L>T5Uk<39`5*t;
zJ@%~m{ke;lPuXzj`MIPUN_E$wl)^)NyseZsyszH>P1|G6E1l<T$E|!G`z34KpS&X7
zZkF4h%`X@1T%a(EF>~r7TP0(~-|kDA?@LZ%4(sPs&5Zl0AsYHigYkWF$mEP@uCG&U
zxG!DeSS7QlN<q8&w#c@7niFhyD2g_IZkKt;Yp$)KGv9+HukrfyX}W5qJCnCf^Rr)g
zOC|V><{!-<k&^t2_8}$G%T{mjv7CBzN?5DnBr~SBEAkC_9w}65e+lAU<Mn;ktm^3R
z`*uE96u9)!F25g-SR-F9i20r#>TPE`J(2nL#apwNmw0}Z%55z7+b*`Edd8ReM!YrZ
zJ?3qVf0<C*)pjNfvGbW37#Mi)w5!2qO(Iu|Yr`Pb;_L7;R_wPn=zdA&-_5qgVIo`Z
zhTDs7JloK%CLodd#9)GluIEuRp8wzZzUEr$nXN0GpwU(HIqlim0PzoBPyeoeR^Q37
z^x)6Zo=aUW3*rv!p5xAMQU7@VC%p$jPo;II@r&KtQ}x&Sj*UW%(_)n)KU!9vGQPzw
zR{5;5Gfc82G3bU<vP9E~qNTb8np2;KX=K{0pSO8-%n8*3W^<G22YTy2zn{MP!>7kr
zpU%HN-(JUN!RjNQ|N3|&N^dByinN%_GSyN_ah;)-&VGNxEi;~KZs%Y$I99Y)&Tv!m
zwzcjHpGdyD!Lv<s`spV9LUUzn{}sH2&8!=8ZI`)zQ9RZnzLGaIu4p;y{cX)V@7_J~
z*@`V?b@fVzTiMwm3zbbQ-F8bpeDZX~ekYIQ%2|_SS98y)c+z~m;^&F4|I7MI|83lC
z;c;yK*Ej5XsWB%EymlI%%ldvTr}kdB5#L0&Pljvm?9+FV>d)5e*83?u<3Hp4sYkpt
zR2EeA`X6%o(W-RiVrsY9saf33A4-!oriEuaUfexZK46hrrIn>q<~9AZPD(**Oggd?
zPqA)2tZ-&+%HKP0<Ijlf4AwrjAZ1shOXiBrEUE_skLNx4FY)TVQ`njXTFjnbS(dQu
zZj8uq3aMfayIQC$&Z9mvA^CjzWTBcFuNn4j6umxa4_9#b$%D~l<~(VOl{qvP1kU@e
zROvX^LBfDPE43l7ugS6K{MkvT%mh~IC|?tuc0W%>Xr`4~i>#D1`^A!9zpl?Z&Kje>
z!6`!MRb5g=qG+qh<7<nSaVQ_DF<$NCuI08%G&838j<Uon*_E$z4gZ997<qg@6gEX_
zj)hIngw?A5134}I+;Vo`+ZZ_W<W}!P38kV>*2$f^yM5FA6UiRF8+!ZZJo1^me$T<g
z!&`RbcgH#0o?6Y8DW_Wc)gvMDR<*qBLgtp2j4$opi{%^Z#m?yITm5b3>jUxWSIwtL
ztU4q)+h^X=Vsq;c`$U(n{^b7eNcE~WEZlk*4(sZ@J3e7v#VN@IufL67UIfLTyR-Gi
z#7WoYmNLrNR{ZhueO%|xCzbs!_1mHeymPo_9rV;FeV+gF%6s+1(skPl?q2cih<(a(
z_k+rkC|k$BHiF6PcQh~dT_m(t`0S$<e!twm&t$!%mAvA`^n-I;rP8mseBb>+c%x<W
zqB<`x{VNj|J+n&N8+@*Gf#}^84_D3bd)XjrHuL{6wSQihCC%2QhP^$vb;1?5*YT28
z&)fbRc1L^emo#WCyIqc&#p9RM738omF#P0ZU{J@^_RUYqLR-{uHZ0fw3HZ1w!&p0&
z?gaiF{;_?N-#w^W%EY&|JWIPpM}6j9QwzTo>jPQ&|ErJpZGI!Y<?j_Gfs=bGpUq4^
zcC+#Ry7T{T?4Mwn)&2W9YnHmZ&{+YyD@yYp{JZ#|;q8IUQ2$;Te;FBBnSUJd>KxNE
zw0T+W7OZ+T>Cb_M8j{j8SFxOP@6F~Z;@h-F`>{httmVU$rMX))Ya7-~TqR+lldURq
zs}VYBF@MRS`GF!C=R8kI1RFgTzPIxLr;6vMU}-}=)(|WAZOZObu6tzZH2klt`}&Pz
zUw!?w50~xjCr>G6b6BR*-hcm`{<(AO?LJ37UR8aiIB4Rg(nh}%>-X30v9Mpt!TRjf
zwHeD>gMK`@{N{JU3Y~x4=eHfW7A#(LWEaEww69U1S&PWWHt#ZjDXcxSWKteiW`B*#
z;+XaK<9)v#EjXRoTJICofBpQNUa7gi*A?k{%~}38`Pd5i-07>{=&gVKHSFlVeY1U?
z!hd#1+0>uEF+29r)GZfWTijQQ2xKcbX9O<$#u>{XIdR58J&{WZ@2-dxEu3;f#L2An
z*rJUAy$604Oz99zvr_nMzL4dY^WxS=cO5h3(>61-IV!DfYfd(sf4u7Y>uBS<LOK@t
zNeOrDS&|f|Pc3ardsREzOLK|e-)4iyHT<7C4L0od*5~hD@<ijS*N=xReBw_3lVc5K
zo`pIG-mm=MKD#;k{|#pKcNY)8T-qz2Z2h9r_rro?s~@{gi1?JKJ@fqZ!W)O0bv0Th
z#y2lCyDIzDz&GvV%H9cY94}R=R+n60-g>1tiQ}Y>-T7vvPqV^HZ|J5JOt#@#yi~6E
z>GaDdZ$H^~KBN8OrA<F#)NB>sa*O^5YFMrCMoEdcNj1k)Y^C$Qd987c{xi(a37@^R
zyWpO=hM3OhtCu9Fb?x^2cHS(_VrS|ZzY|?Nw~{NqsIu(&yy(}=wNjIly}JWeU%4iD
zex+Nw)R##e*%k#HcW=fSU*p|=*=V&${4Hjd`z~Tzo@&Z93PpID2I`%k8YnlnMsudZ
ztrH%ewdduR&JK7I5NdzqjZ?|H*gY58y_4>o$`I;EEMfhs5~scGq>?mS&ay|RG&d}B
z`OBty<B#-3;Zi$aW|N&+T$9>b10*}kcKFUvYhLo->Dl_HVtH#EdRMCc15IBv?GaC2
za`4KR^E?r6`17C7JQp=H=TPIRMKMgBi`(L!bIQiv@2`v$4T-n@o9Q%Z&n0C`wbCnm
z$5vdt@Z?9A?KZ_rw{A>0B|n|>_A2G7!ib!_lo=xHyCd4Q#jW-<C(d4R_rw<0bIQ&U
zWheF;&Hr1*>JzZ?RsOo>rMcJddR*UM_w(uHm*I6^AAS=462|@Z@BHbHyq?7Excb8U
z8NcEcuiSfCuQ|2FFR4xW|IqI4Cetu+w>zTe*Tme7EBw8LQ!w<|6TxfF8WS%zM03Y)
z+I@M~zP_hx>e#-uuVLL~%QAnC{yv?_3cWqOmprw<+|*UvI&~8FVcvxJMq7)YS9hoE
zd-^&(QEYSc=6N~Y+kc(?aOwGxLy5|-#n;DuLtDc2?AX$%coqhR<=l9h^q>L@xk++1
zEZYB$n@HXK_`+Qpo5T;Yoe1{qoZ>JmkCkO>=dCV<>>T;^?8lO`(|FdH{k~tFW)t^~
zEo*+%mW;Q>vp?59H`>j-KYs4to%MP~A#C4|TWV=@HU5&gXKtfi_&=lMK-q&WdCQ`F
zytv)j+wBic7kbF#yH??N^_0@!iSiLoM3Y<BX?sjsv~}$<6~;i*t=kSvU8TEyQJC6|
z5Iu)mTr>N1!g`;Gojp-d<@9Od-pA*i9_gPbzLGr2=-3jE$wn_@AFwRaxRq%#KSU;L
zs^V=y)~BHyt(GeFJ^J@$4t{^{Kk3Pr_5LcpLg3<xKmPdh^v9?DPp;YeRd$u-N{^d6
z9rS(H?W?nppC8mBW1J~<=247SO-UwSticqv|E=ll8$O5Z)QFIOaCA*v*SWP<m2%fU
zw(Wc0D!6jOAwNaA3H<p>WqI0Hue6iSv(){6l;vv0-!qXHSDgtp4cv36(x&FL#MQ;C
zgXZ2#d)>+v`ZqJ|*DN*GspbFrHeTO-CG?PkJilDa6bD;oO{e3AqW!C7PIMgMDN_`e
zGS*%`p-{6@OYoBB7PhU8yBJ;{3Y41l`enzN_-ckP{ZWN8zpx*5o^jSjRBC0asLY<!
z&y^0l`|{3~cpJRmbFN|I{|RlacW%U7S^Oz>y8F@AuDi_FC+F~Qnv{Lx?$YVMUELOS
z%oVD$Xgu6{;jif|neK`Yry8D?zc^8x7-haG?aSNQQg3#C|NXjI+H2o;E(U(<lQsK#
zs=Uvd8~lD4$9(t2uW7GD-8X-@^3%Oqz;b>@Ki|&fk9NM2cQ)ZZU%Z~<@9ZnR_Z3qL
zWNi!9w#-twq`Ppk`NgvnF0NbjH01-QlC9!f)|b}G?9t8lEw9LNv~{RNW(a*M{rgPh
zM@M9KthZpc>h^QjwZ;BEnQ%$6Z9%O2?{w+SQg;o~yf!H{znh`*L#Xcgo&$EqrK^qK
zL>)*LJr(gP<4{Ivx8Ebnug7Jb>o-mI51Bn9bLust$XR7d>qRWz7InEz`SDNLWy(om
zy;F;(>o0xeD*e-A;k!xfiQZjr40&tM*txvFcl>kcjs<bil8%cm^lL2dYB_y)OXiCf
z!PzG_L=@#{1a4RFH2Lm!n?2O5*Vb@mPVuB)2iI?PDBj~M;l4QIhtD(pr_bK2-j@h=
z-YYF>v@H8WpZ|okfQ!@RHU`XHGCRg9JGHHoy~%aw4>3Nes=4kZCB^2RtE|*(?#?+b
z=(#CMG|B1J0$JaHh09hJcF1nGyL9Wsgj2H9i!QHZu1*Z`S=KsVcsX~>?{3kmeR~t9
zuef<)OY%8G=a_G2_8QDRocF_f%BH%)m-e|^|6SVo>+R?D^8Wi(roY#>JCq>$^g;dB
zKfeP0O<UyeAsY9!aN5F_1a0$ER__0AcHP;;6}H_Wg28|7wp|krd37qkvU9X-oL|Y`
zfANYG^Zd)VFRx}u{rdg(hZ&V=hXj9Q$bQiJbm&5}V?>$L^jkun(X(<Aw;g=3Ij35D
zyT|k%^SX^XJx+1i+n#RASZ)6I+k6J@&%HJCciP=Vn~jKnbkv-knSmjb9Zv~WR9aku
zTtXcU2?Q;ss=K~^hbn)W*Q2txmt(9Xw3`ocrM^C_!0Wd0e6Luf*`zyW692!?6|pXz
z^`ugb<!8<JyUTaK&*RxIpZEVvU6;tzgEwQ_PIbjB=zAD_^s?wVy~W&SZSPaJUVK!U
z`tZ}E&*Bv^igy-kil+Q%+O&qNi@AGGg3k3+M$bvtw_Tf|qR_SKir9{zrBB1AoHDp}
z^UX4$SCTs#kL#@~Sa3S(gwCdjkV(-d6Caj1bxpLr!LRtS@1A6GkdAPy^z1MH3YZ-Q
zdhE{z`{s8(YBlbi^)}mY;@gaaH-1Xqb&@!dJ=H4ggVqw3M;zWPHN}|*%GV?(2+x$9
z<EUn`EG$pqY0#&oE)jVP%vSJDv5a7MFEP13yW`IJ$aM}H-Jr6d@(|~leN8)dwJb|?
z=y%ha($t-OZCg+1S0RlxFYns^{}ysVu!P^4^~UNmj+GzIvNo;f<nb;(EAzUE+kK07
zSmr6^tIG?X_+QyH!*1)_j9ubV$Jy7g=iGbwL$3Zo@XJs7Q_Xm0z1!l-u}omcj07*2
zxE1Ht1sbyWmgoI#=P8c!o;_vibaBfw&Ee}r1$~!XettG|!wiG8up^D1B$ppHc^Tzu
zDZ4dx-?1rM{dQYVbkz8yo_Qppw3p@a>CXH<%fHLFmU<~nxo6k#X<4n!Bkk5G_4S9=
zaa=B*RdGgc5&!#-8c!wO{gnDH;<oEE*OG@1@9NB|x*4jU)Vt-WROsxK2*Hay!6!3i
zUh<0aR_@~L><C!7#&}az?DVJwo&A!B6}Z&YXZ(J)F5uLs8xnF|o{L%&`~T*=Gp#N8
z>sVUn_wssW<y%*O|E@3QJTe`*2cGX=`L@I9+tG_J7a9L3lL?HH(Ag=d=~|(glioQi
zljo1pI{v$%zj`e?XReQ9_bYz4ZjJAQwS5N`h`8U{R&2fE_Q_d!x4o223hZv2VqRW5
zQRaS-^>=0|^=l`-UArRve#5dho7oo@oca5#rYFxe>-n))n!fwvj@-L#8|}Yc<P}$`
zMJL<C$^3DjAJpDv<ra7TF;OQzaQU5p)VoLCChZd4%bWTiZD5{r^_91u7#SEUSn=ef
z;>6s7oYb^L&{->$pylyXz&Yvo{jZvQzb=RhUH+Qe$lG;$-OX9LIyY}{9Mt%BGjM~d
z;>kvXUw6xko*X%t+8Lko_y4cCPcF}0mta==!?s3H)2sV%VcVt7m<5st_da_m)n0y4
zcXw07%ejI_Zymh*_BX#lyt2;)El$b2jUl^~_+&nHZM?IBYm&<P*jxiohma^q_870H
zJA}QWjx{|ii#oxyqqXvZmV8NQw^6rD*sdphxm%w8lXc786R+aedn@79zvgEqR|{?~
zp8xIFPll|mo?G92ydOS0;`Qf>u%gH>FWA@5Yxm8K?f>iesIuhn_P<kV6+ha{x)v$l
z>$yiKGJn~trqKHypIjyVa_7%pyK^VY+sV2|T=+g`{7e5e<H-5`kJmqLKd;R8#pL3m
z6+%HfrtLC!eJg#SEG@!s;Y775?Kf1nm-!rGnCH@Y{)Dl~@sIzquO<AOZ8)t*{ql6d
zx5<aL=1*xYO>;Orf6}fD$J@6vV`L8L?Y-);{GtC>w@AH*%71dps^`Y_^X<3gm~<`9
zCT0KBwc)#W=JIOs<;!NPNbHk4@gl_Gc!rqe%f$)5ZmF&gUVHF_$J=dw6KZEqxSZLO
z(DF?E{g%7UZ`X@{vJyYpus7(I@tMT>8qY={-ttp>f_LrQ<#zn=zQ%{k&sDxXeOTdc
zmC&ro(JX48qSsY6o;Ewh`x|Y{_lleTZ#xzShFxNKmf%4WO=fNZXjj<V2=D&c9-u?B
zwxsdhnAn@Pd3vv^`%H`VH*G{T?Q%?JEie-)d(Y52D{arY6aQ;hOG_E3nVs3NTILcv
zxAWET{&lO?Kb%wZ^UtgGC)uAlO*!!7RI`WC{KgrRPS4ntJ;P?JKHKw@bC1_1tlp~P
zuU}W~CYG%rulP{#;{!e>x%L(ADi;b2KCtq4KK`-Nht+~FG4V{Rib>awC6hjCNb;Q7
zyEI#mb%yrN-pDOVCW_o5Urrv1tNHuq*3A9Yw)OR2U%oAID9BXaCcCM_Gx=fAnxLob
zkNEF2sB!*uI&9IP{YSD*VdXwc=f&Tip8n~+$8Z*($t-resx=#A(q}k4=;st&of75L
zXS6wM<?}KZX9Z*3rR%@Xzt`wt5THEa|J~`FKiFElg$q>nv#M$z@VoRhAmaM{7f*g4
zeR8wcRBc+bed|e|YzwKk$x91k4rdun?BvbfrPn)i3FB|RdxdX<1Qbn<aZmNy<+EhL
zx+5&>cZM&yEb5?Y@qvHG$|a{6O5)s8KFz6lBsk?|PoaO*Vb&bY6*tO`bg>>k@N}Dl
z^LiQ12(gaHq=g?2FL1ibS<9Hz@z+UplmDK$WZw#{m{65Z8Ugpt7Jpqmd*_?%%Lmib
z)AM(na5*8=eNCCMH%v3u(a7z1e&Zj{_ZohR{b$YxR$bT|RGk0$+V{1;pZ&Xe^JcTr
zj=7-;IWuB}&p4T^S&%qAf5U0TqMhxF^V61In*S%U_X^J!@84NJzqxI&d0)1*CwG4L
zgj0&oe&iP{JvLXgIC&3yQPInqa0R}kH9QN9l)SIE?e&R#5ZT|Ex&K&IuTJzS4}OEG
zx^qIee^!jJbU(A|kD-)o$jeT~6;@vYzpgxf)RV<FwC~`ZJduxz$86v24%)b^*XQaK
zE$thZS6mEO>=w5El;#zyhucb799i?;$gMDc_4MLzoq#U2zrBmBw*LO)x~+aqg4b4|
z2wmmlhgN;-;e6Bnt>=5JQM}6qS55u=#gqQ$3f(pBnW=P=e~v+Dlj-KCCnv8-l71ew
z)4P9D#KVVSY1NX;+o#-3xGnHTdYb&S**`_+Ut1Zv`*g79H3!=}$Lu<{#yzuFT>Ed4
z<JN!vQXyaGT+NO2;r=aJ{M1xV=J=~G6~W6yPk+?)_@t;GKIzDVN4M8{=Oylbcqn*%
z`m?DQU-+;-=+16=Uw6bgVoQIG_m1@?%bxVHX-?bwgvGtWA;LvvAJ=SKuT|5!U-L}3
z^Zw~#ZvC=E7wy+B$CDS$tx12j`H#t^O3Q=Z*Tpa2&oAqnv~J?$r6QAO?0Orq*lm;S
zGiToAjg9?9S>8w3gG#)M-npHY<@~84`o7Adu}t!b@ALE9s*5Xr>1Y_pOZq<kb-nP>
zejC3%moIzBYn^#{NJg`-Uh2g08!P>pmp4v1Z5i=;z1ZEE%XD^z)F)@J+x6zy)|nTp
z*zV4GH^oSNs?zyL)#f+1mL5AjtK{zGX}VV=t|fb|*%n{fYpK}V?m89y@(jr<XA}N1
zF)%#B*Z3<-%t4uPx*8gvf7w8w{`+zZtA#2TLKjy{&aH4zIHIEFo8;t?E4uUKR@34)
z0@lf)SKptzS-7br_o#85N6!8KyYJ6E|KRuC=kuT6cWFEI;HPijsjj65vY6z(=dJx%
zW3wwE{e$Q9*<Nd|i5(MvfA8>LsfS{{VG|xJd&P>Wu!~h5ys_yL>ynq7ww1PKaxKy*
zO>NX(s=M7uTeyO2c|suf%zhoQrQojVEya^3!aj6QsBlg{c0+3Em6yuXZE{r~FuMeP
zS>ejZD$bRZti3SovgL=YRG}Mrk{683u5Xo{>ay9pgFSw(+Kp*b|FzEa71b~Jo@Ex?
z{AAYKvYwE4k)PM?+aQ_pI3wQMq$P98Mf0Lb7i&De$!|0gvG7s2)%I7<OXBoK7gx>m
zEK)&MU)PmQpKTH4xv@aBW70!KU;Q~(r`e?Q%%79}<!shzaiNo@Rwa3^(TiVeRqwlD
zY=6_*s@O^L^iq|swOK0VEA2$yHAz2wq<qzLvW8on-0H5)$sDd6xAS&qYX@E9)-*Co
zI(WtP&A*x#{oU)b@<Kf<f(+ZYyX^ROJ!Ap1=>F`u#Kli{{E${Ed6e5(-6#F~(C=FU
zeZS_#8;j|b6?FGA>&TtCVw+jQb!Ju%Pt!~0bu(py6Q(Qh>^aBoJiqIsfZpWGOyP<*
z_6Qa&klpq%Ue)$b*}=c^FKmm0k1lw9`&O^8vo*`wCu~{H7o&LVA{v%HOulBvoU-82
z)wYz(9TkU+fAP-US-NSSK!p1l@s>ZiAxj?G^-YWVK0C!Tx&6{bM$I*K7ut0<Z+H4{
z^0v5Z*0ZLxw^ueF_*^b`OV{?&<+ru#H~zi4@A3avd74+8f4Sc<y;$Ql>B9ZqO=0EP
zI)$vep7QI>Y}q}*^whdyE(=j@8;)ghEH1q_!lM2*WKEw`*rjybC+OT|IlezLPNvLV
z?9IaY@|60w6R9%2QVOyk_eeS~xhwI*@xWg07kT&lQZD)QOi-%Xw2s^6$ltxE)7IPf
z?J<_U?Pxr=Mr}_=_93~?2ba7teCxm9@#2-q_63h!wr@r|j25&x54J;326a5Tv?MbJ
z@9w-vQ<iOq*clkMNHH)-VAGqNUj(`l?QUdr{v9*n+Ux5RCbMVW-a6se${W{Qg^uSo
zE%R*HVZMXAQM<P+(tD9t&^B?$f7R(8uXatp!P@kG6Mvkpr3~NsIXeUD&fMEy{qgt7
z?1@fGA3h0Xn<}`IVQa$qta*74o|x1L*`z(+bWdyJJ&CekPhMZ1d|7?@@;61yZ_+Pp
zN|L<ep!ixy+?aU}Pm_DU9P9H<Mlm6?Bt@>cbza#J6tXDCD@`TX_h`u~m)sH=mi@U4
zHZ^I_i*ug3kxSvS%Jff*HZ1lD`EmLE4UNFHky@vtMDB3NoLZ_hSG12kPXF-2=%cT1
zou0Pm)R#G&hg;GXtyyX`$7kA_2{y?wo1G+r8CGvkYu56fY0CP7K|O2b)`*89xxvkc
z^sh`~3O;aA!G=lJ^2Ah~$VpFnGeuN7@3(whHR;%_m2*9g@%nSGGu_hm#ko;_!d>C`
zrEeGCymfei>vTtjqB6<&e;?l|S=Lt;{=2-|++L5VO@8;$w%5LjVQYUqQT_KWeeOJ#
zcRW_}-ef(E<7Vy>-<u*c-85V(MEm2M><VRLiLNchTPI~7^_IPHvip^rM&#a5{S)8Q
zGv4TnzAG)2ynH~kD9P_g#JP`a3Lh=atl0TRWY4OWpHszoWAd^$SpC|%*6#n~trw21
zJ@&Nm=%tHKAL+Huy3oIC`Alamp2K+^9jl(?9u14$&Z9n8Qu4`*kR|IpCwVweJb!a~
z%-XL_C$Gj&m}Pm|m66-z;o7T5xU<=!e!GPkY`1co?-UYn@*<N;`F4h#Q8M$sExYV)
z?r}6jto&Hy=Cr>yx1=WL?wGRgnD9BSIYs=BJ+qn4-OOh{9L$}`DIp!%&Mm00asppq
z)C<{|jHHW(X~+Eb&97Ku&wcE?CEH}iW9mk4!e;QcWxQgV%XIW(-}jg|S9B(<+4Du(
z{xyrn3DX(2QNN~g8DwckJ)Pu}&yZ&5e9_KiTXorK3Ay_R-`^;36N`AG9k<9^_E_E(
z+iLUOioY$SH-4+!{I1j5?TJKneyv)lLuB9L*aK7TFRqGwEMo4HpAwvs<NC9kNqkds
zivHKCgE<raZvP;on-stC!}(X|yPoNrPq|QfTBh3X%-8C^pRPNOpZS*j*R9^Fyw}#W
z?2>n6ij4Q6=+j?09v^!8-q`2*$IZ{5+dp=Aukme>=4o9qBi=J>mwP#FJ$tmPtk2Uj
z>i*{(=9GV8{LWYTLwZw~MJJ2x*D1R_*>J|9wc>ND=KHPG_<w4uf_JIOwwux0k3Tk_
zQuy_R@#UDBBX7f|o)+%jwjiceqVD0G)`}J>ZX4UA)Me_Io}`-w{E%9ybH6}_+xhHS
zw&S^<7VwHcc457GmiO9n*Jy?fN@k^uKWh74TuNO3O=M2y$ro;JXX4~U<0m}~KYeb_
z@olP$bd-x<N1F6b%zY!aLFPWgWRK+QY!kjGf7_<DZOz3Akw!NjC*1VYNOqa5(^r*o
zW8P=m8D<{}wy#WSo;$}g%BSzN(p{lD_KMycx2;N>;JI=42NQ|P8&>A|t3<@tOnh`q
z!+%!e?exW}B^J|J*E)%OnU(y+ZRO&dN$t)led6Z~H{E8DxoODdpPR<R#j{M?ddr=Q
z7j8=aT+9Au7H_cZr@+cb(S3?h-Ht`aJ>8GG-><FsRCv&?=I_VfbD!MrI=W5YBup|*
zTe{P;$v?$;(i!(DvJsAFXSq+5Tls$*?`^qD)1#m3tmc$;*w<}W^F~m8%lbrbjqKT<
zm3FHfGi<49+Im|zFKbP^z}jtWlUcaVP29cm%m!B*Zt2PMYlP3G9lzH4`NNAnSF_LV
zaC&>1ef57cndYZXM;P7u&0-@qgawIpudMbs^2o4fNu1)sjP@#_FO8cQziF5xbY+*R
zr_}31wVD<E?k5xVa-JPFxX65H(#NpO>F?YMdVRVor$wGSUzYmk)s5798o!Qg6JDR7
z(KkURW!BsevpJ4%c~vqC?+#dKeO1x7deRksnZ<SC85^dipAGrk;5da-{fXqYJ&CjG
z0~~khJ9KgLUf%5~_fJtei{Zn%jMW^m?UjwTg>9})CV_?<b&}*WX6s)${=s4Djl+$5
z|CLvAg~~5>V4rQ8lz-*z%G1a9m>pfIoyYHTa-oyO)`l+vYZadE*uVenc8j3dg&X4d
z0$!hcGx3*9PNjj*|9O7zL`pb+t#K*Z|L&;jeYSt=nP2yRygBjf?;4?7%V*s)UOL&^
z%C(}UOFU=0aGk`L;!DS8H(hXgICuAheSD|Feb=k~^X@wJweZ)Di*k+sC)~|k+>vp`
zGO_-_>=P3w-Q0W5BW3e018zaz+Us7<-g^$;WA88v`=>wgLvehiN800UJ+q>xD}7p~
zA=G`~#nz;J&$wC6>(y$!&Dqx3FYp$8%T}oMI@jdg^7j|#_3ABNtYg%~WiBOg=bm_u
zoI(v-F`t}K{gU3Q458(lEjM?Fv-?`VSotmJ+esCV30F3KtJ_}Scehu`QNZSHT%!Aj
z?=#Qt*!(T^i0qQyg?oO;8Q4Gi+PiyueOPc*T4!~>#e>`j-{<XXx$$yEwEAw=@(DM>
z|6Qr)7i)Vv`{j>E=NQr+Jen)b;eI-Q>8^7vR!5Zgw+7m5yqd1^JV(BB*`8(fEHa_f
znN!?ZdE({g?q}RONy>cT>hmkE+>9;`e9$;)(skkF;|DKf%Ea_!uRQx<>xG40(cNEm
zHRLQmb<49>_m#^NPqteN6xmy5iT-Mj^SrovL4nQ8mAOv;b+W?$F{935=g${(oXg0-
zu#Jg<0c)E9w6Q-ezX)`ALT=#MEYJbjuQl7w9-J+-TKf663r@3Qm@+j=_*(^fa(dss
zJT+;;6V<vU``qTQQBD^(Q?>GZ@q6a`+1x*VKK>W}(?j=G$J1uF*(;QJqIY~<CA(qG
z6StTHb3Yd^sPhQOUAKDEt&r;*qy_dRmx!6jU9hk>k`!9?QTE|``4b<`>}+J8ec?m;
z2fY<8=eRDinmfgo2hU=<W_sa7J?E6Idb$%dj%01k3USHk?GjY}@qlm1$!`g<FKtRD
z=NgAddTpM<BmQW`<3}&2rOlVrI`r;^*3*-@ChNo(t($6Sb4a{GZ=Y|<7u#0%>+ib7
z4^Av&cHPin<y3S*VS=ndfD`Xop3d7Ha?yF~&#q!Cmd$50stc(;qpYA^xc;r(c_WSY
z=^K|c6(3$JaKJtJ_}K|dL$1H>Shl-KZL!J6x+JdY0d=kF>4m!wd_Jj>8L>#YIjr|Y
zV$77drH=o~Qm(5vYHJ+Zv*!}K)ryw+)2}<}>YaaU$=bH~KYQCw%at2v{wggz{`G0Z
z&hG6;Wei;M7-GKb-LL0cpU!B%^1^Z5H&52iwcqeLX6g^LfgB5oj&Kep1_m=01_nuN
z&AEd7;>-%rL0dt-+0uprdtZn1oJ-t$bhpL3r4m6M!s0%$)(PTFOLe-+Qo6I2rmAd@
zyY+9uzuteFyriu^?y~$6aM$GXz1imS;v07D-h2L;*Mh<sXT40~JX=lLUeD^*O<P=Z
zLhr$`YrHGZUOSvoVR_2!@I}=%+d1SfL^7+^x#qssns88gy;aNo{R)SapPQcPahIJG
z68$JH^6(6mXve@4bMFg^v98d1VpEX3CSS2{W8C`k^trd1R|m4xD=jiP*3>VsL1@(r
z*VXJ3td*0dWIvs4Qy^*G;gz_@uC69ndo$y^gxZ3M+};%?7q*$*<z5p#zrP`>SYJ2P
z{X)v}lFHQ?c}J(ODET$NpuI<w^}5xTQr7vCF6VrjX}ECb>!M%JnO@E?<XG<_*(UPK
zRjX^Cvu^N-dxs85$!u@<kz{ebQFH3CfQ#2Me$8F*P?S&M=QJLM-VLb|2SPV}HmaVy
z#NTM%tn{-#Zf$&O)K&77t^G<(<>!4f?j7#G{6FcFPUl;hh4!6i0!p^c5sH*LARDxF
z4!3X~bLRGf<q>*YN^kgEb38ir@aDQ-Cr^cOT+5%xCmuCfR3dGyOo8u-(`;pWdH3_3
zUnug)dbw)sS*q6lGVbSuvy=B*MXZaOUwHjT{GL-!Wcgc!_Ozbh>-%u$g2cY$cQ%PS
ze~o8Y*>)y;Ef8d`IGXwR*oJfKeLo+n{c~H+UhmR${Z}hjB5lP5-BA;^In$asj)9>f
zn2|viTk<K*%PdPRDoz9s0oG=g-*(&dqWmwH%RWnnT&}1`o<_4YHY%U)yjO8?<CBzo
zQ@<ok$nfg$Y&fViGq9xo_v)qLIwDJd+^dwIch1L$;qKMDS3zK_&8NQpxIfvCL#@Oj
zHO=^hCx*UM5k0!@dyQPb{?TK8JGOp1ar^x9Zl%3D*6f+P_U+u>xohX@zJC%_vEFrN
zdYsa_BPR3DFW3~`S+Q-~wr%_N{kt=J*<vL<u{gVrT^8P-W|nI%D-NufY$Y9@Iq&G@
zEm182Wx2UQ2cB!px)K`Oq4DX`O&fhJ{d1f4bZyKz>H4g&l(XRKcjbzh;MDH!%9trm
z_S2{S(%e+FtZsUD(0`T-uga&M^ErDl;_n>)$61raH!lpowzzU)ziTAlUKuyR@Jh!0
z4_5A()8+reKX&Qmh2a?%k87+%lUIK?`Cv1D+N%GT7xf+Mc(JfN_DC^9*ujeBfpIE}
zJT`N$n-;dHU{$Eohv{Bto=q;%y3#J(_@C)g{1VnJbHuwBepj2<=~7?8x%BG{@!||-
zfv0m{gg**ywY~V*|G2y_YoJKvI=Q;$ozsQQovkFUzBCDxo#|VA^Jl>v@m=*U2JG{X
zCG|x}R@pzltRm-o^!CO43wO6}EqOGzMg9Np7Yeuj|4jHlzdgV1R_x~o{p{X%dl$4j
ztnCP4{VJ-Y!FEMnv~nu*wd+1h4SJp!q&_@+bIrO9XTviiUvh<2rpx@UH1pJd)s*qU
zHRfoUr%WW%`;do^S5-v+*|EaKvm|q>$j#8GCz85?kv|UXDM~!|%)r$(vu@_T58S&e
zW*xlnytUzf-=m<GAM@u-Sh-sEy0V1YWAW_1<%N+|f?MicCjZvz&*Woj?K!9?e#CzD
z<K2GKa|8BwB(VmB8;CeO($m@9bl>jNylQbJW-s~2Pq_HQW-Zx~!L`6C!6@_P(aV{2
zy#G_U^+IEhO)cjP(Z2Lb=!U0GW9ueX{sl+oHGkIn?#493J+ez>$)k%Gwe$Hqc@_Q%
zi8u1=|5<2$>b1^IYtH-W3@^6yE=fF|ah^Rpd&io4Vh#)*nH<v@fBcX;aA?B$>(>@d
zcAKpJFG08Je#K9@xOJ|AJyJg&%q#c0`?cQ6=41Px;(aUhKI<_3n!y--HNUb?IjVc2
zi|fjLa@~dVRM$@kemqOK_16Jell}3}JL~>wuKf}f`aW){@|#svHN0oE&mQ@g%2(Y{
zm3h%~^}gN}sc-izU0&bSS~c;?X3HMS*)G$Swy_;xeQUSZ^_k|R<iM5Y?u#bK=I*al
zR4cSq?MtY&*{Rc#aeZTad8p2(Zl<yh`Q*EM%a!ISnOE3tbHD!V^8RI#SI()gI-+mW
z_)2hF$H(Iujh7-rbrx;W$zG^FeOjVbq)REAbXLf-Qp0WguCZS0T6b#2n&&5kPGw9}
z|9VBl^U))#vx~R`UC-Do+944?>%7e+4zsuyj>n@vdiGfFV~C%%Wd5xDiOFRmew#mT
z@pE}T-SghnJiET-u}=#_x7?q$c+2Oni(D2J?F;E(y!XCyve~|v-m|mkcorqCRr<<z
zZO_+L0t#L|tm`<xifv$<E&0Z2X{B-dKITvQSvnbe*LO*zFJ;M@E_Faf_YAY)r5!?k
zoO1%V_PZR2Rn5IIf8%S(4vy58Lo6NEAGAG>^L4D=;W6=CqKNpT$$wc-xVb!46%h4G
z`{liAHS_$w55XZ_JFBKo3(R@JG=I~Q6PJ(F1@~PR3C!5YSz#L&<IsJr+ok7{#q4GB
zt$#Ol=qIo(>kiC3Jm<iz()%&TULL<yw~qUFag@d0Im;q*?b8<(9c+x4VR~;$S?hh{
z-z(Q_-m_(1Vgl!z;%~EyR?SanPJeUQ>L~lyhudZ17!JOuviN&|TdF@`Nr$+>#LH31
zTuYv6ZQUt!R=Cf)yFv7&=9aRQvo8u(1WNk5{N@$evqNCli}$5mB}sut-k0))aK(n{
zb1{ZYkLz4<YH^9s+2VvWvEbJ8X1OO@TT~~P7zws+UDRdO{prlo{CoV;vr}*WPUK4$
zVxRBR%)5rExZ(M#wnhOj@8`^66DqcdD|6|mG7G%9ym*g@S>2OszOT*nT+U}dG2}ce
zC&1@(`;1O^ny1A4mpdHJtvkZ}HEdFxie${O%Z;kDRiEu}cRjl1eJyJ?&%VYD%*T&S
z-mZV|UDFOWBbh(z*Bqa&Fg^Cz<9_G5$OHE*Vh<eDT<`dZjnS8@B=cG3MXTlR6}%sG
z62<4`@wDIjYPEF!?X7tWGsK_h?yTO=;8)INd`wBIBl_A*-6_>9MTZ&enj?<6&+5)x
z=fB{`>~p#f*@dB^j5!+431?mZwKM#w(tn(($+kPlr8a(1jmDvF0fWLV7H1xCaJ?11
z$8p4Oik_sWD&LLj+8Pe$XF{Fr)jIMqPMmKxIBj8)jd{3Hw*Rt<gYxX(&I)dNT@_)A
z-f%xTCvjYEnX*E3P51AI5<m8`xF?xz)6Tv$r}O2J-DggFsW=N95YBR_=}KJeU>Wn^
z<hn1LWOl_odo0qRDs;=rd*$o3b-OQVbM0u@cwvgvC8K9S|9;M5`0{pL$j6$qv6n1P
z>&P6t9K8SYjdtVucaOL1KWWT(`84}1y`QE9{p*U{YVTiPUvR1GkJaaO`X62Nrm~hC
zXnWV!ctg9!f#<W}Wvc}YGFNx#@|2r%rMz@K5YrIo%6RU=h1pZZOV&wMRmPrueM)lo
zk{p>uEe-Vw++9i%EmA@UBxbB<FiVLDm|EX*;^wo12bi;_&o3ymd1Ec(zd&ZSgOkI7
zA4UqA2^-q>w#FZ<a5HXtv0RRK@9RB3I3yS^W^XSnk*iX9|L#zs&U~hrC>Q7VA0PK$
zKQT-2+~*v_4`%z0PY&iiQjvAVSTWai6Yt(Fl@BTyT3oyLs_t6Lq3uxgdkc^E(eAX5
z?u-&npV}NZ^&C^bCmATm(D3fSVav&C4{Bd<{z%&9C}Ys`*y^V7V-x2DA7-V@1ulx8
z1uUXtQ<5zjE92i(MyIXovS78bp3>N^=D)VplShR8#n-*+77;mB41XWGNvwMHSjxBK
z-jx5pwpeU#kk6?(%piEOLC<)G<dr4&wC$Qz)hgcc)y8@x9t(MW@bH-nYh+faOp8oT
zdy??><H?UNc1D;n^W`Kee_OKRVd%Mzt=~SMZ;7h;nD4giPzuZc=q}GWzgQv;%dOX{
z5O8(m*VDXJagW)?_+6A!q(S$?H|$G%_w;UP+)yF0<Kv;e=hqI*P2b1hC~J{0Y1)bR
z-*-G<)2eR0w$1j_y|jD3&D;OqI<T2ptMy^>%UXpD`3aT}{`E-rh4(eSj@(+8I?;Xl
z(X^lDd2SzgVwgi$ta#ZbzSOon%VFV(NkUJz9pHb?eLv}R??;C9fu%F9c4!veH*%S1
zaYS&MlsEG$FLz-Uq5I~ys-C<(J~O_uV9Od$q2}J{r90)qSPJA0oL{b?pHQt~a$`f=
z3EA}0$c1m(N*xPsZrFNoq268leaE)_J7WFS++oj`KY9lHoSKBVDkRu-%#*}l`E>g@
zi^!>eEqPT|*Q_q`tA4)U&dncA{1z?$VKTW$RF=uZ!b!A;y?d9Iv+2iwubUrl&tLR+
z`}%nM`p-&MmKJuF-vU>)W==6`*t+217m-8%n>*i^aYgMc{Qc9luzQu$y~OBj_fJo+
zsw{}DuH4m-!rW_IDe!s!?x?Gt)^9m}-mGlS4?UW6{h4c~XE4ii6V}#kJ&mX5JyAa(
zu&MLF@@ut+7i1`wG%m9H!r<*9JwxH!^Me{6ZgXoD28dK%Jo|U{n)pY{gB`_Rq+8WV
zr_60>uSjK_TzIR|UUhrK4U-!GyD}5Mc?%}<%w;TDkaJRgO2y}YPo5sz9@KBw_SL2@
zJK@)g^Cw>mb(Bu3I}}%OC!W(!)~Ug6Vz$tNi3*-#rw=(L*;GZ9ANjK=P2?2wZJ)Wp
zert*kmF_w4tM!2LNsZ&Fp6Yyz>_3_OEiG<)r5*FX!BU*g={uD{hS9=t@h{%W3#Lkn
zatFUL=XBmaRy+Tr;31}qYc&KK@BMU*IPWQQEcd?plAl*tWp-UW%hGJ;RHk0_f;Eka
zoj0naTdBSL{+!pBPWVgA<+Un$u=MTGnH_Gkf3UN=S~Ofa^wZ%Dn_>IaD^KNhg!gc=
zi9PwPYw+KCeP;LSml?&%4cwI~AG9ZRUk$pY!0OVvYmS(R=h6a^uVO+9JpJd~3ueeH
zmf>%Bku^E}{^E~^b1o<TP%FHZ+jzY0OkhoY-JbdijhFRe`YL~$H?Yi|<tdi?|6m6@
zbE!yn>@1ddwW=I53tlYWRQ)kS#_oUNf73k%>CW#hIZQbY&sGxXpZdCBfm?!N?83up
zMu)wNUc9x@=Uw!PQ{TCEraOD(8cyqXTf9CptlM|-(P8E_YKCDk6_$qoFD!nnT369_
zw<pk*wc4)apOOEUi9*{2mWrmIDA}R%?QviAb?(Cfik`7jZ)aV7H!(>{&7?Q;zLQm3
zv*DWy8;+$N$ojCwX310Ci_NNfU3=zPtE#vh<w{ttyCb9TcI`{nhAT;o%<7E^3x1sS
z)@XdXeIftj(-Q4kTvu(+>(|WKW|3USvHX)u{mp>*j-HR#0#_T0oRPITwLLNJw!!-D
z5be+~reC2KIloNio$^(NE$8OPi3Y4aTm2^c{&=qB8_^zI$+)n7a-h#=raQK?_1L8D
zZDi%I{w3)Uwl{XorH{v3&AqgFbLK8D*(-hN<fe0X#b=l*I#^o1opnHX0;}ca<cr4B
z*zbiTW$xe6*6C=ZD|-C2d-#^QLi?wQSFP0e&$##E=|`JZJ$w4@*|V=-OFOgzE@`HJ
zRsYC2y|!ul-`Okr<qwx_-?@3~*Q?hq&t3j7)pWMi-b&A30b4v2yICZpxEGxAaeIIF
z+?-q~m4$n~c84o*ufN>?GDam+=GoDsYIeDgF7?g$>vnBdP05}ay`M6z`a)K-tPRQM
zG_Q$d+#RhrMb-Jid@<?g%dda<@Bj4Uv7P<THP4FO^4aryJ@X0wS;aOC9;HkUY&S&H
zw0M^JUv!KAy(QcESrP9{2|iBeUu(LzT6?a3v94;{C%&u2J<o;uwa;BR>mG74QuSjK
ztEa+(=gT(rrzQ2bKd5_Ty6^bjErG!um5PDRw^_d27MvAm`El+&g+0=DHgo>FcUITA
zS$<zE^U|yz>M30OZ|?E0t>atU$NS`(+wH()|7^Y*8{PI-so7$g94o9Y$ZmQ%Uwmi6
z)*8EZQEr)e+cFmX7g#z)Qcj!A`Pwn@4eFa!!o2=9tw~Hfz{IU-_MzS`^SSn(e({v0
zVO}%YBA0E8IOwF%-LJne!r;Z5*j2~7d``|0yK-N-LVaeKrFgQ*Cui0^hMSD%j-NQP
zO2(4i^KshB-CWA^=Jn<lvpGkLXPcCjM-*LS+BEaXHP3$0z;&ynQ~WC}m8#cX;n{d3
z$74-EoGXtb-`)q0H(X`5n7ty+bKQUISIirt9as~^w{tZ<IW~RQIj_Anp1bN^J?dT4
z5wdO<x2#O~W!5dd(lwRg>#wf5yJ?Datj;B$?=P=euDal`s&Mz|3IFaS3)%MZ-QR0p
zcRjRz_Urijq5rSX`(+*T|8nft|EbrPAFgIT^f6YT@4o!L2(E>D!sXxPEv`=Ac<XOg
z=$-#x-mO^u?{aA2{ow!ks~_E4_delW{_02nmfPL=pBsATcI}Scy~pbA82(rv?)vZc
z<oUZ_)o<4NRQ;-cx7Me(zxZCMv`n_1`2Y0D{nMOQyt~@I`*uK8m00VfJzd|F|GYmx
zF+`N1J1RcDJe2XF-KXmx(!*{pxW?r7t##MT>FEVO;+dS94^%%tVpaEk^Tb;vhEv?0
zir$+(?bEegU%t(^`53U=KxHapz_CM;e!Ar+CqC%<&@y#J*VR+A_Xs_kCvEm|R%=?&
z_s5(`ZQD+1tn+g$W3|zrBe+PksqL$G)U}UStk=C#IcuAmVtS-3konAA_BjS-CHZY}
zbA1DMJ1&@fgyD!@?mU^yfO{!Y@hd(Wy?V8#;iY-`%P-|REz=(BUwXAk?qcGh73Y6G
zf3|0ypZWg3&t96B_#M19X^YJDJr^g7?z6mLE+YF^{CuWlqO@py%*3fSck?E)SUcW*
zke7U%ea)rnV*8D9@7D8sgx|0E|G6qzxa>-(Yze231&4I?is`u>+gB}i*!gOCbVGHY
zkn!IF`=Ij=r2oFI+tqX0`$yA%mPV$v0*ZwO5;ua3A0*Gb(4*b2kiA=jMUY2MrK0)5
z-qPEXPRsO|9FbY^hb60;F|&5#fddmSynOw=oa=4xIc-JRo4!`tmV8OS#i}&p==@V(
z_!IAnKT5dx$ZeMHq_s&3^^03)E!k|h$ob5M#?N`e%+J_*6IQuzS+-d^<Lu*CMh|(f
z?)WNXW4_^%lJ4pY`SBZ**q<ETbURA^oJmwhl}gyVM&{j#`}Woa?9S?9{<?U-D?{J4
zwoQzGI@NtUOE&Gi?6B+O;k!A_J9n>t#Wwk33ICZBnjinNMZHsskl>hWKJlwlyXxX4
z?ltjZ$(Q$S&bxe4mV5Jb;}u5l_O1v$y)b{bw)5<tyt--IUuBq93GS28K47|K#fJ;V
z87uT}>V-xLO75E0bZ?Gh`hl3L8=cmsegeS`cUFp3C8XNUTrz*!=FIk{qv|JrNz@l?
zu)2HCmOpTD#Em=A@AG?fDst{G&RVTj!*Te-p33F7mUJAucG6+3TV?ObmlKVfg}c_5
z2fk$7ap%Ug@?*D>QX`{<7BOyKUKepzZ2tbcNlV)nd;D3~DiXy0{?zM9d@kFziiRY6
z)GRppX{WP-r`)0`9c-#fnSr{TtnqIOPk*_>c{D~NT3=V`Rn*)pN1lLB&-+##`m@06
z^JKle$86Rq-TZx*PP<u(#ms#h`8sQ9>fznF`u{Js@yg2aG=A$lJaw`D<=Usp&*uwE
z-^#U+F}!@ebw|3wuYWAE=L5F0eDbxss8r!;&huf`t(IDaso{ZcZt8(jd?GO|GFLpN
zxgGc+=)K8t^Q-l~IzP;0j?a`zVyJzmW})NozB;APd}rXBneP@#eKc~roV3q-FXNB+
zDaUe_+%C>geNq&tQ=n6~o^{QvVDanEi$W)NZe3{|!o4>zO0OzM%BnN%)9&vpcygXR
z3saV5P&gMVZ)%rm^zGd;%|&w^ix<uCOz{(+yK<A=oJa4Aje_)!J#*W?*Kzx+mJG{j
zs*Ud&T^TklFbgT$^PcI7e0zIjDZ_uQ<K7CcHB;uzs>l&gjp{y}dF@VJ<<-)6E29$=
zR<m45KFnto>HT|cWZWcole4?GC8r%OFcFepwd+&TT$|k=kN3alkKcPC>+Jmda*H>9
z_-1?FMfiW))PGF1`xAm$%R*M={s}XEE4?C?b^5l1IZVv++uG7HEDY)kx<t>%-gtAb
z%zuL7A(IbJT%wNp9h!eb^_z*6<$L=I;SI6+R+2)mK87C-;P}sxn3JoQy7bsX(e#pj
zg&Uh07khua<Uf0Q@%^&crp4bDO};iGUxulCRf`Mf?y}=;-d@T}-`uJ-ZO!*jU4Bm1
zC~D<n=PlP?ADvP1c*E=R%QB4{zlH8G2^14qG5<o##(OVwtFmJ44~EQNKiluXq00FW
z<5(^fTnluc+Th^vPO9@u+kO$vtm`cIZNqndNenQUvWxe6X4mu}Ro(LYJ3N;?nfu`P
z!talnp5;x8SB#!8Uw5IK?yH4H+neUrO<BBN@qWALOV_S*>X-bOOBqiwu%12e<o7L&
z!pEy^d?!do>IrhG@rBkLTDa_LiQp}bi~C>q)W($Uohs0s_A~bBn&!z(E3S7fJYOcc
zGs7hC)^C@^7vh*Vo&G&r;QkFWn<B%NMr~&bj_*71PyNP$*eJDUr^MdxGUTldyu-Iw
znpakiec#!4IsUH>G;Ek5cjkxomb3p7_SGrmuJ|INx0gRO=D?{x3`gd--}&gg!16^{
zC!bc1SjX*{QqL*A-<oDRgc`mnk*|EMEKs#@^TtK}QqoPwmqzaAULJF8_Ny|-8%$F+
z$tF!&togNLNuGZD*RUm>Yfb(oY`n@pTV5yb>%ru`ty{BaS?=h5$^Vq&SK7XpPnEal
zthsk#f|t)5&j#&JTjlzH{6Bxkj=MNoaQB&qRb2IDX3M=Zx;DO8K3Q^AQ?=d~xx5tz
zt^RzdZ`(PEwc&wrv5@DZ9noB`!q0g4824GFPMf-O&0(YIo1(s+n341G9-q`ki-P8D
zJmz)>4p@7>G)mcI>nhdnuGv<c^tvEUVapVIg-7;l&fLCpZEK?F=H2J|zdx(m#m<{{
zQFBA0v)<=P8OjMI&pl2bPxUoQ;mviZ(NVvhX5nzj?+Du`x!;l18bO~FyG{wmy!^bT
zp|5+7O7l_P*BS9$d3;K;4Y@1TH$2JRylAfQy1h|Wz8!a-rs(ex+iE6u^{*=DY?JpQ
zS^{p%zfPYMzwOtd7lIwGrNKAVEq4aLKl8^iMsEr`bJ2<$Z`9u~Uh!p3wPK!jUc}*)
z@(j!Ov*sv$5Snqv=+hdlPn!Ewe>P6&IcLr#w^?vcm)^&F%-hv7&m5T-WuhUNzOej+
zdzER-%UMU3ZIqJXS)i45&{|4*t0#X^*38!vGH-ZH;Br_cygu-I%hS2Mj-o2&pYMDs
zP_ww}($&{(pufjR*6E7y(}4SD1cRiP7<13|uDqb0U1q#jwfgl2&O}qT%<DgLVm38j
zHJ!yJ9W!<3@}KWl-O0b%5T4MkBlgkGFONG_^k1o1W&F1c!_b@J?62CgSsfhSosOSt
zyL0kMzTB5DHW$Y*yY&`uD(FT;HrOk_e;1v`FA%!qxMJ%GPAQ>jMt+kfN;;bbwBL=p
zw`HTH6zg@v37<Y)ZhlaZqQfm9`PQC8q@91$9Zky@7n>7SHh8j0wHj3k=<qeAEbLk=
zVaqYCt084U=6OqTsiui$rh5fupDp@nD_e5Rym!jwdGDf(+x8rozjVi$&z`P)J9fQv
zI`Ax#YjrN`EM>p14#yc(xY)k>99wR5*!<(lDhCsuz(2l$z2-Zo^<6UF@E~&GS~<51
zTn$$}`BJ_r6d18hYgBE{vE`V-bzx~^BE!0=ic=3bX}$dDH*xnFm86*U>|b9ft@h2Y
zJ1@8GgW;R$kzc<{Ox*k^nDt0YFLy)ws&1p&^1AlVTSe8Et}tdz^!S)>SakT?wFQ!M
z7k;*z6f^&0<Su{q3dQeg>*JE%a2Czq=KQQpo#)?!%Qm_$NwI~C+M9b>_X)*Ezuud#
zc5$h7Tp|Piju|??=c)R=zvVsoU#+L3^Hb4R5tUhNWid+I41*GT+v7Gh%y;G&dz0X?
zk=@Sca^=6qi}R|5e;ja<Pm;JAe8tnBEwRP;a7N?2Q};IZoLcc`p`lU3mp38q4D~|H
z$0y}GFMlk^emCHv*&PX!<#uJ9>*ttV$mXf@5Sg2OJ$(~93q!8}%YmjW9;b${d!-{^
zmx-5UXFc1NdwiLw4hQd4rw{#`u6-!C&8U{{O$vE&z4qIb#E;_9H#Jrt4e?N!nZWy{
z=>H4b;FCJ@F2_8sUH`6Oe%;r%*KZtA|8YD<@Modn?_Zkx`Zsd@$*B{zm4E*Eqq+a~
zZ6CD%<kbB9ZQjdY^S;M9!6+p8`9kA)7E79b)vRi36!&giXKCWVR?@##zHqY<Z-$JW
zzmTlM^fLD~EXuoowegC7nBHgq=(6(L>fWDbwZYTRM_ikp&RTlRXz2|8uk5|tF_wWR
z&%N;MoFA;yf9~c6l@NoeTbwitt~X1vtgM|@^Y_Z*g*AV#G&ahdxmU73q42@#x!VNi
z$H?n3Pifq#DKh_|<C!HQi65^Q$Xpe<ap}_hsN|TacZ)TQ4F6^w7ja7QUB2+wg`8V$
zZNDC8$gNoP(0|dSYaiWXBzmuf{B`fsl97$IO;uWFB5GqVa)wnvZSPCQ{_B^Xn>sJa
zuVd<2eXd{)yW#5Pg@<=|mcQEY$8`U{Un}2S^jqM(_;g~ASnCWHvn2N3d@;S*X<Lu!
zo1Q$Lx+2wVQ?~d`x7a+dN4J;kyx-!eSbf_k{bTD52gfYutf+@J?q;!5U!Q8LIlo1I
z(>~_!Rt`t6``_LuEaEAcy30`Tg#2Rm8`r*F{#%!DVr>}P*FQfm)d?=&?Y{rpbmq@<
z*ZzIG@y><$t3Nb;xwEx<^8S*}eLdmxx}>7L?q@A<|4}KrJor<B!|~Q-@}JiDY&!RI
z+U$2}GWB2IUY?sjk8Qt9`~82p0>_^I31&XVu}xoLme~@OeO{A4Se?_maPZgbvuoFz
zmG8T`=gj)mHO=BD+f;7!21ccRc(2wt?etxj*NW@j%I~e-U0+c1=UeQTKX?C~Z&zpE
zU-wt!hrrBo3wMc~CzT|c4cm1;GI$iX^BL{b_^3Cr#b(PEr>$x)UA&$gdeXH>)N7HT
zTioBRR<*a@efW3scRBmNotGoC@BP;l>$R|OQBA48CaH9>e*R1b!y_e2em#4;@$iq@
z=Naws74C)~r%vUyyUA-kZKJ!&9+M<#PisTjH~y<~83UFmRj+h-_2aqJiXS_QANA!W
zZFuGXIP%ixr2-qIldoj_kSVKizqv&qe3Kau?_$5+mhBrEr>;7BPx!}C??t>ny^ck;
z?Q;B4aY1K7$Ih%$;mq34&zqm?pLw)j_MYj5nHtAT*PP8fU!bo)t#8}kn^JF7CuBa#
zUBWMS_36>Hriac6uXmoG@nFqEwyn8*tM+8o7P?*icvniS=4(V#oY9){M_Nxs*iW-@
zEHGPtJke;^`44U%<u~$a-IuxbqW_wBdWP)%wF?i1M|6eX{IpS5TJTVQ-_w|lcBfa}
z(s{K^ddJVE=i;AKF61wf=vvsbx$6#(N4Z#F&aJcq_wHx!o;g8#s@9L=f^nz4h2t_e
ztbSCgbLA}S9QRG9x^#~+T3vo6FXSe@EA7T5gQHrP?iXuj`X60VbgWDCMBWZP0qGS>
zUaiUtXm4%2nCRJkf2WP~vWFd0eQtOh*l_aCtUYE6?yX!n<1^#yQ*#p5g|M7_yGMDG
zNbMfE;#{l0E6mu|ZkqJcS+trz;WghTk9X(8E?k)%Gc{ah<D!j*|BLqg|K<AS^g-);
z-79rk!)`p*`jqf&vF5Wrn|Vj~KjqLmyNaQEUfxV*qx#=<=WqX8R(kA0lt3)slhtq6
zbJj~;GkX&ru~*hFBs@Ig;k(GLHE-7+-rpX*?@C-#jgphq!9dTRjk2qkc-7oiRZh~p
z&SEDvrNYGIWT3@Xfn7`XSy$=ipG?`+8CQIHlQxU`+L$G&Tuwo=xaYaQ$#2p)A^5ez
zp*8t#Nu6Xr%c}s3Em7MX*QYQt94&iNrXu_^Z8r1C1%GYX_VaVuTX@g=Qz@1I=VQ%d
z`|}U4|9?0?{p8QdjA}8GH}<~F=+X=P+>{zz($dSQ@45S_tkt^9TC*=+yjkLTs`P?>
zpLF1lGW`X@#(V)nIs9zT{mN%CFY`NbLGcue7puTRhr6Nde)|s1Q=AxiRzUWZd&GOs
zu8UFZGAnM@yp%ZKchz;?741!L0@vQX9CdsD&aX}J-}3U<_dOQZa&9=$zWU(aJ5fJZ
zy|i{+^XZj_R{s9)xdxYC*{!qB-7e3$|F&TB?4DzrcWSNM)Yy7?m9yrvADoeM_xvy~
z{q)Fg?wqcAVYS<N3%m_}=D&J!wAQN9zI+RN=_f98`ES3v)`h)~{C2;8pY~(!^7-==
zFU{?nxyD0IefxpR1I$Wo`Rb2*gS&X_pD=uU?)<8L`uiu!oD6&y40C35oed0$yQ3ic
zk?V*tU-%3$mGr+8&x!t*dX>1fBtmtm(2~9FJ2qsdsHjP#D}B53-LE!ha&bq&38v=K
zS3G;lQnla3rt|*064?Ie$80YHcfKicyb}-BCR~-@wRJ7;jjYoqo3u(;uid<0nDY9)
zL|wAhChnejeT|DYD4kH#_!@I8-04=4nux|UuV{uXro!zDLk>+eS(bD^-bA|ZvQJi=
zp2j+l(-&{N(mggi==QA%i~KWh1(@%6<z*fuIk(}+=gI<B>AQUsH%$5dKDOj;#}@wp
znU^1b+gjf--`e_VQ)0p|>8q-YlK*V)-rU;MyZvC@c9}O{8WZ+M@R?OB+}Qgx;plsQ
zmfr>|Zl7LQx4-7ls&>b}c|U9J@?QNG^+sxSZ3pLy0}~Q84&^^lQR=!s?cW35SLQvp
zT3LMcqV3jgR@pm!H><hX1?#Cg_b;1zO@H#mKRrq-I_}pk^J!c9WLFx@`NDs#IdZGm
zVl!UTugcH3x&A(T8S{$!)fr#Y#-%@`=L9TDy<b?bedPU{>#L4uzW-5i?ByIgpVHse
z$+s_`T{+uDXOZ`oyYahEpNc#(&Gf*+zmxwhlnGv8te5s;z1HLThu@ckoj38;f2^ge
z`#9Rv<Gugi&;FMxx|hUMU*T-Z3*F24p?=TSKf!hXHczg)mAUiGmQ_F4WA=AHI(a!_
z+CF~u?GfuFAI$st)@buPwU~AHx&k&Vc_z-ku97|fpUmN3-MTsV?;a|emm599ZcFR?
zcL&}FeX|ig74x7~!aw=i-xV8j8YfHgs=RssecPes@!qY%Guw;b7<>L*`iZsvN#f3e
z(~sYXYwDbu_~6B>gU5CDhrRB--0AV-$0nAUIcjY4&VQ{H-S>CmnYaSoQ>RWOFFE%}
zb<U|Dt4kI~AJN#j>fWgn_l3^&Yb8nDT$-Gx!r%MWmwop&ix2apd?#PfaGxn=e<^;g
z8FRdn##4p$BKIaM?P9H{Si!woXj6;GG5ZV3J)6&6yLdK0#mZoIl4+yUr311LUstSK
zHSN^0o39p$7EinAlb9x|bH?yp=S`1xMfI46b9`Nk7A7-&@sTNCGI>&Hox#zQI!AB(
zxAdOZ^5Osg4{P6U$*y1gBI$ys`yva@<Asr|cAq?19^||entJV9o|FVnNSdPcYsIIQ
zFF4#=UjDS;@8jxjxVdb8+wF(JpRBJgdua4i@~QBN&05#I7p-~l;6b39qRT2KX_?7Q
z`y(oTS1Q%DY`&-ZROfrywr%s<qU&$p`1zaR)=#rPUH5Wow{CvQ`q{~2b%?9&`b&{s
zdaY|RuWboF93xgzTR8XgM4`F1EX)5Lmhr8cXXsWL({gY9j&<u>)z5yezjgonw(Z;6
zuC0<hnE70pRes9U-h&>IiHvV<hw>aLJFBNMWs>yvkCQer75+(z6!$b<I_FGEtI<B6
zqf;NmyqLM=PvOhoEt{Q_7z+J_E%!Ysj9>6qc3F_d$&0L$H$RkhaGSkdM%A@(&2vv5
zPwvTcoc|U1952~4A^7C6bcx!?*!8O|dyKstBg2&ZLcAK|Tltgyj^sGrwBDG=C!xvT
zWAt|V(@UpJr<Pn0<k=gb=6jI;e(gike{z-oHM?paTlq57sOkNXs-5**-u;nK^MwK>
zYtgE?2P}%NMkX;=&*oI)S$<~zy~vEInkPb~%6d)At3EicPUg^-|7_ZOB~pW_cIIM#
z_H$Qk);Z{$w%{>Zu5#Ev>gh!BGUsKl(@&oLR`7h=&6vcAW%nB<?tKyE&NAoQhB=G@
zDd*W*4ho<Dd3kMMqVb7+X68@+9=>+${`vU<f9H!A$MBskd%K(c@-P0g*9y;V^t;!X
zwEpjPOL2!#jp^<CW%m63`1WJtu6wIaNF7l;K4GU)q4Voat2eC;netYC-_+^s(afrT
z33k(F?7eO9Q*7dn6c$zEgI_P2>|>d?ZL?@zZu^0x2EI?FGK)U9-n+Lqj%iWf^6eH^
zKON`)kj-7kd+q;kwpDs2uXw(D>{Zp8T|T#O&ZNcWKJu5R2_F#RUhs3q;(n`2o#tTs
zne}^a6ue2lFz@?!advw*2?f=vzyGeDRGjtY$8*`0tWotwuJi9+czE$(m#N|W`JtbW
z9@Njjx4-J?DpBTb?tLGQ*vUU;IcH!j^5OA<rS&cEz1N=o$lvZKd1p!NTAxRz1y6W?
z`=6EYIjOenNC?9j%PG8bwmc0=mYZT2ed|NUfjiQtG#A!BWL^7n)vS-N9A<qmf4#{;
zc-#8<UI%aSI$HT|?$2B3_u|x{^O+l5TQWA@bMLt1nc;cgdUNT~t=lFj3pSdp3VUV$
z<#&(v%b)FiENAnQ=Ff_qdU5iuT{kD@dNWGD&-=BSCqp>pXx8LjMYBLw`~Ktd$v)oi
zzVsIM?OZYI?%^kwzq=`i6-jI88@84+Z`&fg)4pO#&8MHwR6W!VwA`7da-l4G@}Gaa
zPajJ?HSUVo=vn6fHt^(kUZy2`;`p6p&Nsiv@~kbqedtX~eQpZF!qt{lZ?}c^UHWZq
z<~93)d#3cKMJ$;mMfndly!c>nVF6R%%T~7C29mt4OJ}fKz0uvZ_}okJV;%QwtUpU@
zY1GT}&hyH#JNG5<#1XL?wy%~8(++nqrTk1!S-0$KSIJg4Gqz&)#VhUwFPFJ?J6U}3
zoF=QA%pGs02j6*m^GQpy?(|ZxIBOX`f&CXwda7QYv*?gP_|BNU4!8NPiyxS(`BQzV
z<DxAcx9`8P`CFEr{(*n_&imOsYV#*m*IV^+TbP~NQuIPqq{^O4sDjb(wM=x`-5F1h
ztT}ac=W?~uV`4coe(C93<OS%>-hElD&SrjopZT)FvOwnc+by1sy=RYAIQNw?yK^%g
zaXqW%cxq(^>*SZOtX$b;4%`cQu#Mw`_nt{kk!ix`R^6T*?QdSb?^a0X4KohyRR7b`
z2Df@&E480Hcy80lN1-LXMZTPWB<DKTzF%W?`rH!R#1=ODz_|<cgIhR5VkQ;@{a9`u
z_V@PJ;(CRpw#EHEv0V#<U%a^{UnObxYVFRedSP$(J!s?4zIIC|o6GS1dg*453BMN$
zzOj31qL;XB?i;<7m+jt+yRS{@J@(`WyY?1cA=5;=g9Tk>joX&pW!!a-akA&51v1Br
zPqjR|$@`*Y&aV!3CzW;jNA%duW*rT>To9iAJt|+W+FD^*?)t5(yj$#Eu4<am81>kC
zqBG~R_fm@LQ8T#wcn_9y$sAZ|8Ne;VH}i^;CsUEYy6=LY99QsO>h*CFES}^s_1=0<
zZG$Zfm}Qxb9cE7}*-*RYcE`IOmAIlyg~b!^NCru2e~)2*D8H`7_I!MA(?@Cjs^_J%
zW^T`$lI;8G#^wKkldhlM&H2hZe|f&;m6-}fo-=xR65k*CvT5#8!Ti|EJ9lP2+g#r0
zk+aq9YHL8Bv-bSxr9b5u4Rbb!%{>!#^|jo_lop9-xAIlHRUWsO6e~?!r_m`SE^_+)
z+LJCT^!`oQ{Y@-)V)Ezp?JT@@yIwf)m04OpF|-odutofxQl{Xcw(YhGSsBJwrWc;h
zc~`gQ-MgJ{X0*zMB~RG#YT7EE13ep3Og}IzOLa{Cox5Vmx(^p8%~gC@Up8C(bKdhQ
zE8hH+Y4~%c=b5ndvARjtMV0HMJc_pX9zAi~<0|9IsT*c0Un@TK`>&>JyR+i%?7FGe
zF-M+l*j>UJkdRikE6Z`|xeBp*kzdC*%hmG9ia$7zvRv5wpTFO$2Ddinp0p?Loxgrr
z^sJyo|HF}2QhF!4jvv|>G9j=@>Ft&6*;5srAD;3nTEMP-QEbCL-dB5$$;)1Ds_);k
zSR(gLL-&V8#+ilQsix2Eomu8ytpES`nER)1=O48Dep@GXeu?XW)+;6v4NDK^K794C
zYlp<P1?8V6<|PHnzR;6hrW7-)zjCFv!IAfC4ga2Dypic=YTT%IzbdpQ@rU{CcRO4T
zIl6Xebu{m0o;+KXXJ4?%*W5KWpU%xYx$XQs$?HDbOSx;9SVVblEOff|*xLV&%Pqk+
zt1ru!-Fo@$-LZ2&g=bi<-l-N`_hfE|<gZfhyVjM{l|3~IyPPE@?T=*!hkj*0dugK0
zr(M4}7SB=G$jY;R&9zO<PR{y|Zu@CD&6pT^yLx)|b?2$4!|t6fd;TE&d)Yk&?%Ng#
zb5A7C{n~Zb?PElJ`s$3n{yLTqX&2<Uw%%{){x)}YgX@IvHzuU3=6x0Zzr@4x&AK^N
z&VuGbPiG_tyRKZV_wmM!-G<F4UP{YH^_}+?|EM)p<7KIF!U+zU&xK`8ug>gdkS#lY
z-FBPUXP$>gF8JD>67IN|ksnd;LHD)bd)vce%}?*98{}+XT5hmwj!1ca+%>k#8zW7&
zFJaHk{xqw3^2zAgR|;*d9$oh<@!#ty(7>@Ws_&R(T*-&?`rr1HzG@fUvW}Z$y;9ws
zTXD}Tq-Tn<_ZGPYxON^3{djfar;bHi5^80Yj@;W5b+`DX<_@Vz<{uZF>|xN^HLEmm
za@0c(lO0k#YuI*nc3itO$yhOR*%Nu!V~YYCr-kS3kGdY|A|vZF`M{Q)O?L%Fn*BTL
zdCuK^y7i3lUSY1SX$>Z=_Ph5S@jCwH#7xJ@c|W{PwyYISKELhkllxC??k6byQ`XYT
z41C@_d6}wJt3h1j<qU@}zczh&c;!^>6K{jtCxY557fHD7tv1^^vvuLca1rI6%8u*V
zL2I=SFWr+;yu|#`t(Ez4?I#KozLaV*-H-A-GRIJ;x|-(%-?l^hZF#rX&Xzu5X|UTm
z_-j=6p<NoM6IbkAQuJLY*yWQ)-=ou)Zd;uec)Y1qHK}J`WYrtnRfT>VzdiQdzDr4?
zIy#k;@%y6CiW{{VewwQ5r<FwC`nfG~@g?b)ufMX_7+eVpx7xWfamlv$scQ@`ZeHlp
z5dFSw|Gi&Xf(y32(fKUBb!O16z5?giMU7|Pt-HaV<d&SxC(R`8cR6-TY5b{6JMzNc
zyqKW9vNYh^bk4(ptJw<_#V1^D7PXij^sC}^{Iu66%8Gbyo^unPB7XYSy8|iTH>pU@
znDjvLQ_FJC_<1S07v1g(?LGRyL!|T?_oH6>wtJs@|I1WGOV`UM@oep7)XF|N>8f4H
zrkCdY8~l$k$kkqcamV=oHM^^J^QZ01nZ@UtqonG;t3YRx)0>;dvrBG^8Pq-gAoOQL
zHCuhN`a%Bc^mKb0=?%FWt{c9m%~;EL?sK2i{Hxz{o^lC&FkT;X#_i{o#$V~hbA><M
zGmZN9jyvN=<cGr-%eiFl&(F&!Uh(43$p<sv@k*W0WQ<FBoO#Z2Y02lBy$ltKi^D%1
z4>~$A>|f(D4kH8mIqdqEbS^6v$jn)L@Au;OPab~xy?Jwb-u{P254@^e=Ktn&`vU0?
zhKU)M8CGwc_RfBL`v1hzSMOG`=9$ku*4jQZ>0R$U;}A`g(<?f!_<l1#vGKXl7Ki1X
zQr9ait(sI--`$`7e@CQS^7iseGp_!SP1#n%X8OH-<z;oPJ1R<_(x!XHI+{%HvON9v
zdED`p=a;JQxzBjILdNQym)Cyvzr4Ln65F%Cd{(K;ly8lioBw;qgZs8e#Cu|XoS39p
zTWa=N)Z@-?wWz9$7N1w<d28-AZ0*0ho$+>><0LNq_q)x_HQ#!DF0qS$Yg)DWNy_a*
z;oK8?&9ClM-Cn<1vvQ+~)#M4bH@2QqFxcifdm3XGLz3Bgv7nAAllGVQvZcK_cyz&}
zSyv1kHl<DtGi5YjtT5PWy_I1(w^4Dpo{aplpEVnQAN<Xss<$PcN!Qe-)5mh%A{(!d
znhzI8OljoY<ea9U`Td%rpH-yq(vZyT+c`YuCJC~+yIY#-gTu^CwivFdHJr1^S#E2;
z2VZ7+=f}5CZ#LanxbOApv~yq7K8Uz(;xpJC9dYC1*6nr4@{ak}XG*Cwp2`t;ZQeUA
z|GM<4$anLX?2Yr>TPzY=RHd%i{zgFH1i!9z$j^PfQ>@dk?sZmHy)$cf@(0evSC=Mo
zZ`-}zC&eye>&7Wpov#$%OW$1~l(E=*<*KD>d)KK+-~aXf>eHEPmlc;6^8HkKG*Q%K
zsaCk{jbQt>IJI?xPpkL&fBJo7uEQgzf-)X%LG=hf-G9p%4X*8dy}_6<=lW%rV}CjW
zcRA=Q%ncWBR_2}=Bi_jJea275$$NGEH)s^<&tp&#3Z3#$tnOjtkNs9o52WUtdSvkW
z`ak9g)|~6P6;#}``@eoxn0`P@UE58+<f@at)5MD>3%F-2G_^?XabKch_DC_%s&i6_
zk)T8v&+$82$IQc5>zx0)JwMLv_r;65o5SD7%UsBvwEt(t+3Gj8>sQZFGCV%@o8l8g
zugw`|u6!HcaF=-sd2-c8E;z0rW3ib#@Rf^I@TuvKZ12TH@7@_3eRwnD_P@`5e$3wf
zvwqFJFZN-1GozO@h<e)2c7NRA+t)0!oH_hw=Z_HCeQ)>8OS^X^$#-sR<+R&#GJDQw
zbf1nqFZ)ABPQ3C+*xFw2cWx7m*kl);y3;Ficn$mi)h;^AjcdNXvQBEey6W=EN=1zi
z_vbwi>gcL@YVW1KWXsN*yKGNyQObTDcKn#p1oqS4zVDWvCI0cK&bLoFIrkekZM5xd
zc{U?6kxlg8$DAog<Q``>dF_?{Q+ry<wzz94Lz;nMwr%Yu&n=7p>W62^pSYEtde6RR
z**=-gPH{#>Yu_q2xXe5=k?E$g^7Gm!IS(XabS0vj7O1jVUe}6R{O6+Q4d>e8XNU8y
zO7WGJJ-8CPN^MH2RmmDZ=6}48KZXfja9^-&^O^XkT$`i?Rtw!OuoCHHZ2fWY@tp)t
zKC4|X?#66AxP8j(xv!3X532U~ZBhC7ly_C}g#~{ZEv$12U5w<}Pls(bS(LFpsaoKl
z@`NXsPR{h)bI3=)JbgBQl-bwsk1AIe*#7u#KIQB$n_Xeg>vydVGP!VmT0=q#)AEvF
zqX|OtoXmTKZ;0GG_C5dY<vmkQ<k`Ke3SS=me2<mmmW7>5Q{BT0Q#)1`Cbr(Q+A5gP
zF<Eefi_2VzOQ-q@T;D%b+~b(`q`{^nQtV&p+nge$_ID9&V%xUn+*gdwxWgN}L|f~X
zut!fr|I*z|xj{Jvd-zj+*OqMac#v+@x7>MV#g0?iGjm(QSY-AXRIf8S=;D0MXTj;X
zn1nV4A)XW^!Mox!#NSq2)Hh-Z6j9a`$m5?qY01AWmmlR#&J{XrIsa^myIo1l!>GR-
zn_@Nu+&pEJ{OWdIwN%^IL#G37E_(S+O^bcm=?M!m=1vTrH%+9H&2XZ(RV0hYoZa(y
zPMXeql<It}QdN~N*V&Elrs~}6CDXpka?Z_=@!OerqgzJBz{Kjw4Ia+b`l*b4xtkZP
zTpsc1%dF@9bDmCR=R8-X*`+P;Qln2+ymHy^6`R&2l<um1AphctJM+Ty<*S31CgieN
z{8ALnxvw+#(eclEzQT(S^4d%(VqkDscGe>$eKwnK=4#)|TybAtpS&1+=_sF-*6PjG
zw=R6y)VtU8ePE2p$EIFZrd-2^EG<Ti^V)LONJ$!p`zpFzy}NClZ?tyC;!G>IT@Ghf
zXS#P-=H4<bo0WW^(J!sB!8EEh_+GgZqds#cQ=<6v?04dSE+yw*ES@p@Xz-J{TKZb|
zZXUAV?#t=Ce8~st+bvfEPjf5{zJK-5r%i#;X2)Y6znwDY&AynIv(vbC`%auusb{g|
z%LVy}gEhB|Zz?2kn>_E&{l19(;A^49uMO&~Ec#nErYjqzwu`+LR1Z8~sQhN$O1l&1
zZhAY^22~!ncox;8`PJ*j&PyA;_P3sH(3xO3JMW8JhJ0D_xwY2kpZ_i4ca7awaUeIK
zEWpk4WSW+^=9|=cSC<^mtJ$HKny_HzZ1L_(`8(D3y?8QbS38#wvt~%->5H<q+igTG
z8>dH$am|pG^yO@gFS;embBkf|GMi6(RJHjHyN@R;9<*yPTO|5=kr;D>Q<=i@=e~Z&
zgdHPG?yNl#p2HE?H_Nn7!|P?#?vN&yL#x=>t11q27;#yB<x8;GTy|;B)-_M0O>fu>
z6n)^ScD;5;<W$ll+r?~}ONFlnNM7_fwfJNkJKr~v;v|hp-{#M>@x4}d<yO~<DQ6W8
z4_}<eC!Mm3_mED0fM3!y>+RdlZ9b`Jw#eqeQ<>E_WDAxoy0VNzw*F<Z-PbABKDoSX
z&nDd3E4ggj-)SEo6>dBF?8k5Gzg;byyPto5vHsN>ueF>BDy~NNGrioqwxm1=@|~i?
zIj20oL8zkpSfzMO@S2RiPJu1SFNL=At9$zx|4};7*c-1han*fc1;M)+OT0UbE$3W&
ze&}ZBeADuz<rCxj)u+6>e8x|)@90aRhBXiLO6FKZ?LT|>ZpVvVQRfflUb^>?<>}gK
zwpV@??fJ3kjl6YxbJ6tR+i$L(o_gSidnMb;D9sQ28E(;fx2oF86JJ(cyHLZY#j?Di
z?OStWR@eJ&>#nWjdb-(I%`>@pMo`z2mRC!bBr89ZeJFD{*6^Yw3x})Jb=fZ~PjMej
zeVgvt|N8ao_uh^df4Vpc2ER~PUgcEPHznyqVx8w5->=$57p_`b{#@#_^Y7p9_p9f(
z-D5hu@r7gJqWdb6O!H6Zxop_0dfjXqZ$|ZhlLR*johQp5lw`kn%d>a6^ZVBezw7oq
z6ggKP&%1X&@80~jd-qj?Llf6({fJ1^x#=aaUU`cJkIIT0Yi20jcv-?_@nwOO!|QY3
zWpB-UYHsNow&?UVCb>_hPTtl^>lZ~;Cq*)Tm0WjJ^77Vs(sh4lq!pAMyWjA)*gUA8
zr};9g$@<mpPH%ZmA2zJ8(>`&$|0UbrDe6(}Ie*h^l+MkynzB&k%+6NbR?C3)C5~x!
zD{d{_u93d5NMM(~(AUt}!ZOPLLIZfLCU`BG6>#^`nTDIp&!S~@_v~77qwk*1-W_W+
ztY=*+KT{fVq~?_L^UvnT+h^!;=+1t*Z}FN>maHd~)dfU(7lk<9cR2KTwMI6(+@-B%
zg52K(KXxwTT5|2tjPd}5$?BiCFgK*Gade2fy!qO-{U@e2cIwYu<kTC}vq`bO-84s6
z!i7cG`QH3JEN%C9*f7jvo!yk4-qE}4k&>K##@`dFo8AA*7XAPBV!yMjN!P!?ooU~H
z%wM={!P0Q?*n?|#+_dsGTp>2c<!P_7_9v_NDknE-&r*3RH&-o;Bl_#~V~zDfnZ@dp
zL={i&d_N^p$kQ_FkyPoF#Xs20ck3MgtoN6L|K1+kAJ-55<7&Enq+asyKKB%Vvr_XL
zXD_cU7P{@W<<U~<$(x=&pKUjHpT(B9i>m+sS-eN*vY<@5hL5{)tTwy4sevZbBCZ`u
zt1g`5>{%S(Ej@SrrI~#9PjS!i<1Pq0)atXk(1&Y7kL;EZO*`Qew>>%iEk!3R{;9EF
zs7UjnS06W@0B`oDDH~-(xDR9}>F;xx-gQ6V$JIdV<1fBC?Dwo_s4~s`y)jIg+jjke
zYu}RBFWSF_`=-k8o#x8Szl+~{vVD4fZ`PCh&u=Vzcf5Ya&O6PwZDyRFAnN%f;6z4X
zXVAqHT-Kb;4WB~V%-IDs7S8V~{baB%UGGfQ0)MOWd2!p7&iq~5{3Vm`9%Ir8v(%^a
z^hH1ab6EZ2@8(B6I+Ne+FfWnb&2GWtTzb92aBkJ-FS&Lv3r+f}FDPF$ui1U;xx~KP
zH*62wJ$d0%H}}L6!!41SItM<us0h{nh!k6K>BFC>2a=NfcTb#J>-TY*;PlkqYR*;m
zlXiIQsqDJ;^QYQ*ez#4JERGq?S3bVc?by35k2oS?Cry09`!4CN&DA=oXfNkmPC|yO
z^qJ}p|B2k3F?Gfd^M-S`W8WX{l|GbI@S8EPqIpAp^lh#44`!^>?Ci=&oozAegX8O!
znX$p&%+rn^`lobe`qtgn_4E70A4hM#P_X}{+`c<K=Qc_Ic>YZ%+q`S<meiGLrGGfC
zKAeB<)!dT4<$-1=+SV1@IaaN3xfrDMFzo8jg)3vTgg<%y5qvSF=`Q0Rsk_QY)c4F^
zyy5N(n?<vy9xuO?^88ZI?5RyrehUS%*X%yL>dxwb)e9#E9(|)~JY}(7<-vj)mar?2
za#r_mS!`PJY-iWw*<Ru7QoAm8B=<-7&)gaRB*e6Ia%TJ;=C$uO#jkp?_r=R|iq%Ws
z=Fi&3TXy%y-m1nej{_`P4s^QR+~RwCw)g-0MvG$B3x2-n(6xZ~+i}&et?hfhz23>3
zb1TW_(~k~^w<{(*&Rk~uN%rgF|8G8=z4&|bgDHo+`Rf*RsGskPv$e1J{Ospz=DI&0
ze|}`N-&iCtEl_^T_V@m`9z1y3eYkv;*)FGo)#qy@b-j2alB0SVRSP7QCq3!l_0g_s
zO_WZN;5Q3d@H?aLOP=TdG|SVP`TCxn(-y9J6cJo{rfz+tro767f<ER&M-t3K=JxqH
ztWMq&w7sWtX>(Iw#mn-U93J@vZs%6INu^bN-FCOnR3PoF!n_q{cph=>V~*BN<Pkk8
z8?ih2t_?%=t?$h{&vPC3{_|N=$%^&CiIcyb9^Sq6EXsuK=nd1!f^$>Po6M}dzJdMq
z$)bp<UB;`zKFQwU>b^fe{;dU%_t}HjeomP6{@DLM&S#q!?+CeHb-8!qfvcwS7NS1K
zZNy8O+rlS(X%&dsroP;IUgt*lt-sCQD1JM5U;}TO{`W`HIjLWFO1398{$D$1ace<>
zqRpI5ljC(3X1Lw?zguPPhoAoie6@Y*{T79N@ea{lZ#tXl(DTWhQQzlzu~=WrJ>{@u
zl8V<%z9_x+^h*{@xxzoJIyR|)+-k)bBsxzsR4ViAR8J?hbvIkiRG&O~_SMUf`=@U6
zPG9p`gEh6gb4qNo<Vz;OcCN?4oE?jAS<kdQzif`qEGM(aFC>^xU0{{;FDPc?o^(6l
z`&AV~%^PloGWDChxLY-Mol%Qe@}~Rct8QPuHX~c>?&B-|I@>O}`Xt%nn%%UH87IBB
z2%lqjvHH#_Z?N@jY}BNKiB@Xm^CP5MUYrX$|5T&l1m~R&b#A^HD%Xp1w5)n2%A8N;
z*gOAo_8&fxEi<@P^tO5#1e<+yw>uLQP?u3L@p=ibW4Fe1cVQFni63(#)nh~r_j2!z
zx6DenRo4;JS#j#&@{f6~XIozcG-(!BIO=KW$$M;&P-yJ66Ohe#`_VAYqh{rWOX8WO
zk^LGoOpaf@H%IpwH{Y7rJiEVDzomWueK~A2g*UDIDEFSAw&15PecX?3X1ckpXKu<A
z(Frx0j8<Qkh(>?+T5A4M;A*&ykw)JF<E1ju^VWL#ET1ubt{D4Kb)&Rn;s;tS|1e0i
zPTaaBLSkB1HbcCJo%D;nl^JhO2q}jsYe_Y-|FK_M-<mVE_{3_x9j_QSRqlRur!HW{
z>&r#AZ|5i1@7ne1)?5keQz4IDtx7b_=+o$EZ@bK5EbA=p7M1xfDtwB5bp88+nG5n3
zbTTuSn&t;rvOLI7xw7Xj`(d7=E1sP3F=V+BCw=kzuCs#H+jo?1?M!+l+bmxZkfZ<Y
zTKMGi*QW|9zI$f7=vP&?+m<ia4OO$4H#~F6-&Q+$5tq(vQO@nvQBRJupXttus${IW
zHuGY|uRX!Zmfq{EJ2%b0%pkfwfmKV*cKXL1kCrtEMwR-jgwH>cdbMk&#z)azEd`}l
z)!#i$`?Y@Eoy`2rFKakwAG4RT5oov?>7AGLZbgc8YULF3T{<@(<%M&<THLcoLs@s1
z%t}wLRj;NBU+us5?fy)QCmpG=>P7$dr8TL2J(YOIM~Z2cO3L%KBF^CxBVsvA=L;<i
z)-qS!ZrByQN$Y~eTcwQ)9r`x9r0uO#Ocl3Y-5_^XuRs2z?>#ng7sIKO`Wsx5(jzus
zF?Zf3QI}?ztJ`&#@o1ErRL|MeDZAEi^X>C+_$L!yx$v{oDxDQ(3A!5DXFIpan=O_w
z`*5gYNl20Ei6j%&&O;NI2Hv`$=kVl_YHKC)bZv>bmt&tkJ#%Smy{gent<q_SEBD&=
z?R)zuu6ZHn{VKC5`?oy|muO?TXvMJm@kNdWRlhQq?&1;;3AMcw`nhjm^yS+18;xfM
z`Ts~yx7T@b?$Dn5h9Y}E<SniF73||C{>nz}tD(#PSu#_Wxf@AzfBo0R)!j2WQ%bMr
zn#``E%x|63VxDb%qAjC&SC(P%(Z4PMuUu-A@0ygh$*t&MtbOu$%5>WqC-m+td8u3e
z_|+**_MQ%&Eg_4{dipw7ADQS8+c4`3Pe9Y9;FyWCHP_x!IvpKR#26~yz;P+W_WS9%
z{d@kmy2mY%eCm)QyIeQTkv;e<_pV<r?wG&0Sn}`)$Huz_Yr4C3x3ApmDQmU6*(<eo
zq1Oo)zuXMDD~{Ds|GwNxO0oZ{IkRYcx|L*>x~=V}d)GvB_^0jWTYA-LnYY-p7fcsl
zbli>Jw`8LM`v#8p(|WQ@ze!zPePScG&HwY=e-?G5t3E&EW}Vb`YDv#(=h@qKMdey&
zlzuzQKQ|>M#_jI5z%A!j2`D*fi|%pbT~)((_(fU8R6ErU@qJSqlR|%M-<!PXwbePp
zCWW?D2fP><U+;d@@}}=%n92TgQ=C;6*(}`A&m&`8KK)^-&0h`c)U$>)67lCgsWfm|
zMim|josbZ)qC@A@KNs&7Et@{R`r7h}q6FLh))oJf9!$9E!a8etnDoPtlrC@6gEC(d
zPLxJzg-^DbbciMJDWB~6ch;f?f1iKS?r&Tk@GQ2wVa_MdkTV5F&7R-C?7ezzOVCY!
zA;*`o&n~wJUzl9dcumYJ^Qm_DQx_lBSyrJ7zwcSX(KA2k%pA9qi#Kb1U3Y1b-d>^5
zL<gpnU)rk|{nXvJtmmuAW{x=`Ek~VJZI!6;kg}b!Cna>|YoWs-8l_@hr86E+%VG0u
z?b^TO`j#2T)-1lswY`1bpYwgc=kGuHKPUSC?L@KVE3Ot6scl-)kiv5JO#12j%)HA!
z{@_UA<@WBJX`w7tbYqF6XmopxXw;HRTOHKj8r%)rzjd?4KhM)Mlzry7vhm6CEzV$(
znij11%<*y3rc&{XQX6`{FJ7_k^xDNYr>pLJ^mpnK(f6^k?UxG=8vPdWJ09Zj%tQNA
zw$Nm)N82WC-&S>h@1ly>vb8I|e*GFgBXDOn@20Hj%2$gN@)rFKs7$(ZR?kj&wnIRD
zY3!PPEIrfh%0J)t5nTIj&D!2ZGcT{~N#X@wbqoF44@mYG{A>EQym4OMuj$YB#CE0E
z*oYcR{=AU5dtP<vN|CE`*WCK?{KU+rSW742`5IhahI4rek65i~{Fc9bc~;8oZ#%hq
zzD2D)DX4hm0^_@YlZ&oqY!GU*Zg05Dv(`e!g3Za<c6t8ymvdKrpSeqU@~%Z2Yf_jt
zPj&2k<dSl{YhlUT&?PSNU5~G3N9HWjh^XuN_Vb+WrO3o@ySQH(FdG#x<rM4fD>+hH
zX|?2^`BR~69_RBt7YbL0iZ-x$wYHZX;Lx69Wmzq%$+2d`AN^%NH41L2FgTyDe{)-~
z;|k-F*FH`M=G?Al>;JUo47=^IFQvRUw{4Z&7^SDQalyv7OV7sKzq5?HKr@tQXRww?
zt@CET`)gRj9+nE8PZj#e7W_VIC$sgh6HE75wx8Z+by;?g^lu?o>(4t=dlp3dU$rTh
zeDm;kaOjtqmk!d!*Y9rEW7zREAXT*WNawS}cV7ctI}L*__Z*h|a5^@3YLEVHu3+I~
zGlaN<V+<p&9phqNygoMCC%-BAp5eWuCt?$2y0t7g<2SG8WjpOMKWMML&2&D!!qlTR
z3yTe|9b0y@+-=tl@hM9~4m2{k9P^Aiar>T$^Ihu?Q!m^sugG^$_TOuMBW|6T_9odl
zQ|3)`?o4oYn;6o*Nph{sJU)rW&~uv8kC$j!@NbG$D+t^0uI=>Yjgpd&uKt)6<vdYV
z<7>f_Z^!)h$O^7{YpnBpLm7J#v%2(>6FCm+^7FaXA~j7PuIwl=yR-5{&W4q;=R92d
z4%}G58^Fh7BC?@zO5VP`;vy@P__`N<s_A}r?K-<%_Y|+_2EI7HPV@9_-RE*AEH~f&
zoLM$<!PdTyr=sq;I8SFjxc%<j9pO8&o<7?!Tl$Bd)P=+DD&J?Qg{HQyJd_j17wM`l
zJIO=%oTlit?N6klCLNO87QwoRZ{g*}CC|i6-e%u7>B;)L;*|1}{k_N9OU`8;-w|bZ
z=tA3yMQ4trrY_8zcRn@xF0YGvUJSqAvrAbV2OeB+Sh!vM&Y3M5H(h40-dgkh?!k?g
zcC+v6KXfu{(!Azz{7+HArj4&ybk?re%q(Ub{9}?>Z%_iC(hG+juUqe0FNx(aGkEdJ
z;miFV9@kSMuU%XZ&R!%V^uhD`&iNKi;Ubev^;WI(*JCc8;$wKIcl8&q53MpUCkM#3
zY+Rew)zck&EWhHuTjz?B2^LGsomz`tvSw;H<?pFBJ6Swwv)b<T#XBTg=7mXqoXI`o
zeM_G0q?oMkl$0t?ef>+_B45{kTybXkiW+sso_$u!g-TCqtC~nV3rY8V4{SJ=P~svP
zwQ=XIMW$?%rnv|5Wdz20HL{;Gm^!CHIg2I!#eJr#YE`R6W;10!P2ApJ=AXgnXZ3T&
z#(C39;x*p>7FbcL+SUJd<7dwnsge`!Nlp7$UYtC(nfr{2gTu4SLGz0{{g$t4KE3Wn
z+FBiczczNy!(1wE#d9`a-crHf_3`(+R}q2leC9J->aA&i$f2#h@@uG-(;=P@`&4Ys
ztYZFAu8?o$xXxz6bq$d%Q;YO_0+t_~Sm(5Ms>Q#bKX*5a&+~dxTl4A9lY;xfkr(^#
z$?mbK5P#`peJ(omo3^f}{KK>D8mHwSGZok!ePSviP*N3mc2DpYXO??g6>S%pZL+!T
zu<fWid+FL$TAxh0mN78oH8AR1^ojR(#46VLr=2?1{5krA#1dKKnul>Gl~$aS3pbrt
zzEtK=mFy#f3pYY%aTL8`vaAs+p0up<&6xnVvgG|95A4Mw_0A^Ls$QKD($uB+U|+-c
zR2Hw3Yvq=?ofV!hl$#-}VET)F4vWY61vYmU7KhrDc6r@@FUMZtkk?{z@wM^$l>zs(
ztF9cDyYfm`RVHJ8*qYC-``7a2=IoNFRxn|@vt#uU(S8nj2{HEnrS__ps_Zw5?oTS<
zo0L5%JoWc#nYqV1{Z3d<a+<TGo<sO>gY%+kSuyz*Jh7Tryrmgs&Kz{eoBL{Q;DdK7
zo^@~0+8~~O*~ZW6&9@AR#{W*!K6t%QbSpJ_5H&sKZN+W23rC)Rc(Pm0Rm0D~v(ad~
z?I8w<NTti}$7jaH@9{bQWb2u-TWhxZuL%yAvr<}d>%DO6my*GC#-H`p-grLIr)E`E
zf2!4=N6WPe6mAq5mx*OA@_%3XJmeH7r|zGd^L5+*p4_6Rzc#sIw$6No=6BOJh>DeK
ziYA_)*{C7kV4;!U*JRmw*)#Li0psbx-$E)5{ZOnZ><JVOF>u?|(O-G>;mV&(W_sy6
zs(f0mEPXwr%+M%$;%Dc(_qT)}OU}RTB~f47Iel*KmfGVBtbTOg748l1a{DO$T>3z!
zXS1(*#^pyJe1BB?zWdew<<zZj@`)ER9bPj{tnv-xF=f?G-rgbb?Uok%J!i(5AzuRT
z&)8YC(c|{ShoW^;{r0XulwT=sUcFV;c0yA?*_+2QD>r@o$in7O?eE@ds?4;tg?Wwm
zgBNShE=Yb}opaPeV%>(|(pJ}ue2pcVvAvx}7E535`k4J<F2Bx)<Nvr>zPhI_7E&&B
z<n3C&C2Fe5Ua!-88oX{tTl>FXXCk`cN?0C~`#CK|nd4_on#8x8|Cn#Tcec)~GplZ&
zm5vJja(lO<x6D7yRT9Am&fPfo>06%2ov39Oe_UT1koPE}H+^eG@OQZj&TfhJvre0N
zuIiuNs6A`-=~y|BUr}*&?A$W_D(5|Uy9H$vzD`qmlD^ZzN{nr{l<TDr+Y@VfesAe3
zJpb|Tm%ZUP1g(!mHX7b{UAfqB&XSiIIen)L=TA)ye0|{Zq3+x6@5G+5HZ1!-CBf6-
z+mrpeGG3uZAB1fSocKRzH*02wl)A{bO^FoxWg`|g)BIIz`X;^9BQGWL%$k;aEv;n!
zSlhFr`F+U_x4^?jXI8l>1*C_HHp;b5xh_#&ey*#e`4ZpMjGcA8J71piz7f5G!_F*r
zVVj(&Qflw-h55M&FZ6f$$2KwOCcShpZqMiIn>YWD&mxUeM=zI5TeOVhiCapk+|k5I
z*EL>*sy{M1nzE?L?--Nwm&FdA2Og;ehFP3anxkB%qS0}nZ92!yKF@3yr}q&XUaXz-
z)XmgDPUiR1_la>aIZU(GDOX7L>0gq+l=A-N{e5@u1@U$6bdPYU_v-0-eAa-GW!F@X
zT$a4cI~;?{x0Lbx`s$eUn)%>PHQ}__PMgBiNeu4!u3UOc^DcjW&Z;y;{n*#DyL8O#
zYk!x1`FgoG`-lCUX#I8jZ{2K}{Ld<t>CgGQn~gP!%f9Jre2LeuuPrTWyU%v(XwX^4
z`75~%mrt>6C@PsJ$$3V1MxE1|#er6jPX4Yt|J$l&)$&j-t@kIK?s~uaIYlXUqfKVV
zsmD2tjis>(c6?tfn@VF!G`<*mnMMigRlHF!dj9q3Qf_g}TlP;>+gSU#JXgp5t$I+q
z-96-*(C^ZTVde==o;|sJbDr!lxRN$6XqNSaZ}Z*%#C;dtb@PYFk01A*m$I)G%*|N1
zed<&P#`RJzjYZKd>zWG{GjtSHEuZqg2zpz;pMCGA+ow*<3-mmd<Q~H{pYwBIzvaZ4
z8*^q`vgo`tpK@wvCi`-Ods8~hPs;Lqm!9hVS|BJe*5~?)HgU^0%Z(2+ePP=k9&~?K
zm*vgQZLV|W8g~71+pD`L=hvLOb9)^5y&Y#oy9><zQF_p{cTu0C-KV;mx<^wVE6qLK
z{j5t#>gcV&IS&g{-e@PumYiVtr;zrN?UmvO4xS@UToq?cyjF*A$SSb**)s96_b0Et
z%l1qXj(AsHXTcP?O7?7(hOXuJC1#?LE@$Qi`YLnOt-fS!YLshledGVnwco!z^?t7F
z_kVhPkiwD&r;jsV`MCYP&e0!6|Ap5-G=E<G|Hr5Or~Lgm%m3B<Zn$gawP^A-=|vM_
zyKf$demnV|@cS$6^&hvD6yKMhb#UXy!@}8W;T^rNc$T%si*DZ_8eMeZa(S3|L4)Cg
z7Twl9p6^#*O?RHd#g%>~!|CO;o1X7gzfNzQ>J{{MLe}d0q0?_(X}fRqcT?M`jc@yY
zc)FLp<w{(4Ypzc254P!BC2m~2qgG*U^42uFWLepT{Z}*C9-XPXzwL8v^7X>N<*7>3
z3cSQxj!idQ_SB)iUX%Bt!|_62M(zt!@Aqy`E3DpUuyQj;un?Ps@xjiea%~SU7$3Y8
z{k~i@;_Rx2s>NBqKJoA_@@iVm6JQvo)+)er=X2Hd%sV^d<^@>G&XWJbzIMr%<=R0H
zlNP^yJS{ZzxA^T-zR8h~c2u0Q%l4cpT(v1T$o!h$q4_&RBn^0$o@?Y|yZgd~V@k%~
z?i1P1m^ZpD-hKDb`331$E`8}-@_qNai2>_W4d*sL(P_|1EN4noRIJacWO2TFMYUba
z^t-qHKKq)|q91PBm+EWw{XgGquK$Hs_?PC(?xlaXukYuJm)*12TD7L|%e%M#t!~&i
zK3|@leayLP&iUY{T_)!on-02^RYb3;she8vSb6fGmqE;Nj}N~NsyDDc%?SDQX^P-S
zf5&x84p_Z1yvx6_cjtw*C;r4Th&sHmQr)%3wP=Olu2|W{j_Tbf=PU?(CHY5CL09*R
zaMKpK%Q-!rCUeav->G8xc(+ojdyUAuavt&A{R<;LoE6V-&)e_PU->y?*IX49wX<4J
z7cFVo`^+~cywXI_kZrx**NVp<-6JOb66{Y|QF&S7z=cWA8buf<?pYnOUh@_^n^dTN
z!q&K{8DW_hSnkgDTU;eJUH+@bW7a&YPn`bmHh<x_dbOflM$Z1w!llW!8?+Ygy<l_r
z+bX#L=j{b@N;YR#nNM2p9&FL=_tpE={<<bnk7s{hv3l4g3$E;TyOR3yUG1I@i{EM=
z%f8MkYIFAqJJ-Hi=mQh~_EYRV*DTb79;-?P%+rV$)_X2#<l_)+{qFRvW0}2+<pM8E
z7dl*f_#wyS)>FJ)kCYZND_q%i;s;0I(>C6MJ0iCt=f2ThyyEejq+h~H)eFw2%<WcK
zRv2&aq%8NSe+<Vdmu(vpEU$TU1PA+1cba<jmc!kNh7YYDPmWT^Qj?2c_Ga<dS@rMY
zpKX|Tc>aC4`4hrAoG$3N@)ic&?A^3B=a<b{4>2B<uRU8=q`dFy<NwCTv?XO*Pq|iv
zQ03%}r+kiHbWH2A-2Zu3NPI~Q^JJ%1iM^$&_A|TuSLhx5leS@w+Sic6ACWfU1s<8p
z{sss0l`oiU6zKkj^-^VWSDoB3yPD}Yf=(2$Z7EFP`Ri@Rd;C<%bVXnBB{P)LJxVH$
z6deD^p;}}&;c3M@vuAt1D0iL8jGG$hve0qk;)(?ZvIo>HLw^Wo%KY!ud;CeL-r)F=
zh(3=w`=<14nape(dHCXcl{2yBpI!=YyLjn-Vfx0<U3N>{_Z1n69BinZy5&{&%4G{T
zZ2My<_4iHj@fYu`ro3D5xa{q@i(hZ+eBoKX-|4r~DTNh>FFX{yXd7?onKe~WM<<h6
zT=P`Oj6RLMT^G|Y6@8WG<d%vQ3$fJc)qZ&+Ca_1~%gjBef~Q3;tNgcd-s}yTQRSx$
zp1u5`Jf~XE?6uF|C($ks-pmyEWi@~HA?bUCz7O3lt>X0JZ;JIbyfHV8d)JIJFW9{s
zr{0-mcBQI7Hvf0G_32|aYl5z>G5nc5)vL(#k-hfTgV`k-omo@0vgSUvcRUcMm6ot;
z^Bs2H8@?6ij$AF$zjTDl<)$M4g{R-RY^U&aC|GVcK08Sz;eyq6*;`h5E*4dni&xBM
zy121R*I-iTay>7v5Y~%=`{zxbRT{Q=pVgPSeK8$fVvX5)N!F<|w;Z@)_rAn@-K7qX
z!t0m&(%xO#?&&YKY1v8LRUW?6f`ea(DP5YRnvr++d`sR}*?RNa2|>ZW7ba^K-JYQ?
zZR`9@;_L&}jzxVtn`+;*-e6d$)VsW*JlTS;^|I18MW^DJ@aHDGCP*$eh-s;EzwoT$
zoo9FHzqZv0iFxZJitbG3WR*LVbc(Bgjo+I9gXCv3lO>HjnIE59bzxg+WMfal<en`j
zrM2Ycx@JvLo5Op~s9*E>6nT@tJGWn@WF(({)Vp5%GixN<qEMcbvhNC~uusu8nYrx7
zj@Vcu`(^X^GPD=2ZPyietLgTxaQc5P=cALtd@Z(x&agTZXEDdS>BONoIcn`kF5GQ<
zyGJN2+p)MaVoFYjoN9i2<T69S-RniZzy9RbtMqaAPBC|@$VVwp)Qp#2a^4)g)hISv
z;<Cmf27{2xbvI>x%-&-a!nRtgXz~}sRsYhff8ULNnG^Z-w~?plmRUl(uUDl>&k9>*
z_%Z*>_uCzx0)DJLwfDG~P4(UvY^RNC<PRKMx$dsKUg2%_1CyerGZ-$-E0=EYN!dB|
z?$MN~oi|0BrF#pwmfz30TBRA7vDdNZHfzR#Yuqu@KCF=0Id9^Y13iJ?CH%uL{Zf?h
z_db(enfpjRqKh^Cv%+JZZ-E`_@AfRt*>(67>lOJV7v4<?%1OEJG;0)>J-RDs{?{OS
z3t!P@R_>ef9!k#`s?I%2I>Ix@Ubgbat4;szK0KdyLz1Vxsr>l$SN~GB*Pgss-g<+P
zqf+jV$>M2mHVEDjoglVS^-`(AtM@k9y(=cJ-|^Ub)$_#P|2n)UPn1#IcGxK|GCX6W
zm1$Mp<SPn0_lAB<?>(sCbMNfwg59nA=D5FA&}*>TC(ySudyXzsONw@Wf~9}H^88q(
zleYI(-b>i4GlltRVfwxxj@|^L?b9n;ZixOgVq9&0)xsg@)Owz-ZTs5JT~~YGVA|Cd
z@viXDtj)(J9@?N*=qjiC?d9I{uP)hLSYOd_t-X5n9%pN|s{5Y%oHH-fcYXi6^p9uz
zjU$s^Td+6!9+g?n^SMOh*zC_0Q49Zad30|UyfE$PT!U4+d1j|5Bp2P6h%$e3d;Sy4
zSA~BPi?2T0Ca)SMQyM07^k`P;_dOON#Vekt_rIFG$uEO7Jm+udt$iM<3?FW-YBD_)
zq?O#9VxC!}(;B&Sj_S*s*TSb1nH4%Nyxku)KS(;r?B%tdJ2O+l?)p91AGXTk)4CUy
zTW5Ye9l-c&rLe>OPQTMC!smtjtr$w=zDgJi{}VSp_A9LS+eQCPE?g<z`)7sz*t#y+
z+I{+){1vHPajV=nZ`N@&cCY*w$asFY#&P);v(_7*($X`RJ8!A3>67!k^R6_<r2Jcc
zWbE?o(<^^QUbuc&A@2hJ8|_fjSYO7CHK!A*Udt)&+TE$1p89xM()y$GSX9GP^4X`(
zTKQP*&`XIk6;spZFHPoor6@bu+_dbt$n&4yzxmwvxfwfo_4DE{J{x!Z{_b=CyG2Oa
z?}L9tg|v@0zj*z_Aue;%Dov;IUI*8}X}{d;+}+=rdxiR+)4q67yQFfxzC+*Y2S1K}
zUtOwb<)kRH_fcX}wxHYe?zE?@^S`Y*mS?%;QSU20)kY`j)<r9x7c7|OXr;;9!SbNG
z!N?@=*q8cM?5F13tSGpwxBDEYsiya)?Hd!nR>->8-?|W${IGVB_Gh)mB_VrO?N$g8
zQJ#P1r&{mgw=c}6oQ&LgT%!E%qo>Qi|N7@(by9v$?aiWz@4K$PfAqD}F>w9wzuC9G
z&Y4hjxQ*}UI=8use%Id5^4ugKu%taqTvIh``HO-zPJcF^o;^D>VeX@X)?Zr1BFVGf
z&*V{TcfZ&5$xrjNa%O68)|t#pEvmY8fjX*19M@w@0$-Nx;+L4cnd{%7mVl$~_xf*j
zxE-jU${nQ{Ty)UzHCNW<se(Nl9NLWqt}toe72%k?*&<L;+Nyi=Y^f?Cv7a%k{}$%k
zF6uG6SN`I#nMBs_H(Jvl2whQ3m{fA$vT9!XhK^G)%bvQ}>acEH>a$JtroqpK|8t6X
zQdLe0$#muvch6GVGD*gmWAQ$n#Q3+XC7J#S_B|HruixMCs3Yve>N$%a{W6hk4w#mz
zRPNU*8^E_|b)JUOZm(_|=e4mbdKZXfG_5#)=u(-dTx+Ou;mWhKly-aDUQPR$UywJ2
z)$li?+h++Q&cBE9<Cm*G{c}lV>4oc&<`d2z4m02Na?ARObry%!yaT;<T+A=BUw9(M
zQTt&|Nm1XtElP^zY{x|=?4RgdZLGT1>`e3Cx2amX$5*hPnHoCbuXE0$?H=I*I!7vZ
zl{AaoYgrVpuqD>y#k|T*lPg{?V0dw7YnkQh+vhJnnffQ?i|U5l@Og}1CtkbGWxKv+
zx#&M%vCWgp+~)XpZB_Vs{kny%TFG&}=}+rEU0As#E3;$I<a6FKo3D1>QwTin(((PF
z)~(*f!q*>jU&@oM$nrORdG?<^>YWmfekWZQu`)2+=ErgQKv{8WUYTA&<=*h<{M%+C
zb=TJ`%wa#(ymrgc3!;pBbc<!rILv0*`aJ0bQ{yy^*`~g`RGxBo{rf(5@od%Gh1+;$
z#QRKqUiY(NhQwZ##2HKUOl^2NBi3yxY|&gQTkNF$y7K6}ZBI`vyFB%x;P$KM#8-#z
zj59Q!o)jf`K3F~F=hGiWQ#nqa&R?m_79ZDC#^SiLUi0gk8{JzTKK<s-SH*U_WBr9K
zO$wn&XM0mOEfF%i!y)>*_w9rv!DDwmo@nK&iTXTYX2!e9I0+-ogD>SOKXCk6@l-Fi
zHT(3{S!H|N6=oWVFFHHPlCNaSrFizg_urqmd$#v^<I71~_SNQB#%=rgcDK1ykFCO|
zJ={h<9br$3^B7!A)FunwaBJDbCsFCMY^Ab5I#ZVCt|sP3&*n4~C2ol-dTOP>#?Q*)
zH(66%Ewsy5mH&i5r{k@*x1Tml=+IQ@Y-RL+%6DY#*QVnNO5MW2)+bn}Z)z_4Qpz(c
zMx?^f-y@><j{la<AEGm}bZ;;DUA%3_sYl9_&fKZ3`CC@kV9%`7qh#(A6&I8(Epm^=
z_+3qvxzztk`vtj|ngiT+OLi=Lu6m)r`QqK&isJ7p?K#vJAAHMl{h|E!!yhXQq%Pl4
z2)(>zdO2esU%va}*ZlGZ?<7u~owHh}!|7~6^4T8UL(Xc4mIb&dPe0}~J@Qo50=2?3
zYn#vHw#=3{*i-rSm+!RHh(95P3%I9>zHguZBKX)m9*1?C?Vn$4`ta7P%OfF8(OG5E
zPUGJ~t6!g)t#{*$tI79F73O_UxBTtdrnI;6-+7Pjc~eU!<$nu0=3!*|n}5w+k9kke
z`Sq|}uWlE;z015R?ZziIh10)om*?MJYu5N;zH;_f<Hin|jy%8F1zeu*ryh{Fb9jIM
zFROriN=CO{9Wh<~vM8dVWoJzEiOmly*<M##1u(E2+Lh*Ql=zb|;}_@K*CEF$S1l|$
zv7OoR{>yueM@l!;@c(dZIV$n$%G#jk;j`qVE^a;dgWc)&TsGFXN(-Xg`L~C&)l8ie
zSyz(s<GRR(vvI5MPEOw<cS(UiQ|{t|^$*Je7*-uzBHzP!IfvmV&$j&fn$9ifZ|N*a
zEBx^DZvwYlboC)o+2s>YFZokYGHch9yBF2A+?yoJ$~xI$_1fb(Tm2^nbhe2o1~!OA
z?)SM9xK$xjSZ?*{6LWS<`*0&tPk2+xZq5HsYhtgS%3@t{%5!ajXPo}lLt3}iUKCo|
z$-iDsK0~(t;}pBFcQ&=lfB!st=#0>&UEf7m7pnzCyxhkU^DaJad9)&{@$S?2gA^a1
zE^RS)IwsGcxmMX*(sfG7qMLDxIJgXK0**0GjLZAE@TPc1g<aW`3-g=~TW>zRcTwJd
ze(~vrcQ-s2{mcEpiL)a@QopbF0*mqdIQIaN0EvRL{%#i<dv7s?BssVyMw+~=PE0&<
z+c%+)B{X%d;^e0RXFHNC{+8~(d+~4kLy3Qxu7a6Q8NzY|Cl*EVd`kP~t!(XESj}s}
z$DD5|$-X`3<YU9*kz!4q;a&db51M=@yW~`xaHp^zJK}NtL3}^cloCd751s=rEA)3?
znf0i-SFrDQX*NHH(9Ece`Onf+wm#i@c2D>DJM5y%ndGgO%sS(I)I3NduR3}1C$&9u
z|AzWKd(W~bXJLkL9#8*iWBYOob78$_A&skCFHgHQwI@wv<*BuN3SXJpF7Fqyomdu8
zxQFR`Gn-%hQk6N+v{v@cT)F7Q*I7*cw_kdQv#oS&^%T~6y1Z)Z$=a{|KQHV^U%{v`
zOQf4GQhcNHH=`n3jeXbOc1=px^;Yv)R+DgM;c4+7rw*FSCJAMJjgnPL<BG4058A3=
zXp-JscQi}kYRhq@$4523ZKz;*eC?;jbpDD+mCfqsg!ShbZD!Y>+xEP5&13hVcSR5L
zgx7LxUSjDY-*a_lLd(u9b>{WF#y`wHzT_3I5I?-R|7pN6!OhwEhqYT+B(|J7wLWsz
z^;c-Ovpa<fO??cyEQlFL!Cs!3XKbWbP&qZ|VBT#5p1rTNJH90B-q5SEn}^YAL1r<>
ztW?%niOg*W15&L7)x6nMw|`ZCYyK;B@|-2T&2h(OpZG3!(mnRT;lFRs=cuw~b>H0N
z@-{_vVp_r7f{llBX7%4>y)$E(^3J=KGy2po=UC12OW5rEqw89R#z)SnnOXj9?R(?|
z;{H1|u%A<p$Z9_&zS8i>T$5QFyL@<E1GlbI)!~}3b-m?-DCz6YI?0PKzG%O)v~pX5
zv`C$kU;&r&X<H5-*3ubnC*4;>={il*e!1(;W=ZQ4*S>j9u-+GQ-D59nUShF?ig?=x
z3+MfJAGs!6?%&03(zW|kKrPGJ=#{6UJ++npu`Ip(eNJ@B8jT%6b(^(+h|UdLe7}eD
z=-Uax^SM=wj~#IDocjHweou(VM%Pf)3AK$|FIv22RCKZmpBL%bx^Ho2!13lK&rFvI
z*t%;j5L@<zEyi{2>P_bZKdC)lQGK0f<M*}VA6phC-8((Y!n1$F)!2>m*5|zonz1K4
zDPQHt=jIciZa19>;QH>db<4HrJL;1XpC@WB>^W*7snFrwoqoJ)F?+DG#CB(^KbP8i
z9P+nqIUuU2Z=I2AvH$kZE6D}2UY;6r7V5Ph?Jn6jt2*58?f09_zcpiuZrzg1`ILRP
zwxIj}w>Q6k-Pznf{Xg1$L(Hu6r%qvJU=ZVAV30<=Fs8gHu|PjQJ~J<~BtBlRpt3d8
zH~+Djz~0~CJR8_=Hs~tcyxYyF|80Zqn}vI~xbnLyUbu83&3U4hXQW`)zwi4N?wfOV
z*;!S=pJ~s|&NlaX8|$32yRGE1mHbQgKYMTPSsc$C9%AkP@l=V$m$<F%$3lIUW=o~6
zZoW9p^QZUq4ZX9=IezYZ8l>&qq<XMT*{^fW>Zyk5p?0z_yEjKJIra6LMW||qN2*rd
z&9I!)iMtm|$}jsN`CtBH$ASxUqu>8~Vx;8WIe9|G+T)BZGj}cBdN1(y&ugs{Upf2j
z-(hOGYf15P->s7_%e=5rXx=7%YH3xH$5yi)7q_l3U7~c&)#>W&bpbqzO34yVPuN`7
zNj=zT`Q+7s5{0@vTlR%zmtV#8*_{8rMXTd{Y~O|B+fSq|&1PSGUUBiiRj0ETUEZ*1
z;-baI=TqI|n5Ly|Ir{X0mH*^0ZeNevs}&banVVECJMk)4>SAx%c<%Y?58vk$NBK4s
zoH_NW*Ra(6cKcoJ7gq6&OevD8jqDPq9({kT7y2WL`}vi`tT?NcM=y2RNQX6QYSp_v
ztz~Lk{aPVV$Z;-jx02)4oRnogH>0eS&+KT4yd_|}I&F@)mD}V1zenqK`EL9CCw#dr
zAM+FKhs{g+d1_Y8{V#u=+vE$6{Hqs#41#>ue)lT#Ugi5GP0;cD!j`TXhd1=t%obBR
zx=by+zU8-Vg{}M>=ac&GOY|qqx>%f&zw!F_=ndkAc{$?e&9$Z_U!IYD;oP}RCq4^&
zJ2`(<H=l(rpX3CGs!1J7btWB5d10lqd-E-U7rTrz3x7tMu6-Cd)6F(<tCd0M=5qJO
zg@;9Xj;HQjZ@l&Y<Zhd+4)1`%T$c9}{<OUfE!AE5E}oyUyEx#r(Ji@KrJH^&j(jBQ
z@42hYEK;k|C)!atPjVy23=z*ZgI?~!dz<QRT}~}{aP7$_C3RV?*g(cI*01O6dwH{@
z7lgd}V1DNF@h@J|qDy>#X;pWte?GZO?t|j|+K8ma?7uw*yhdw#{MVdj<F|P(y+dx3
z=tWWURI6pef9Hl8c%&zlEouMT7We<o@6R6n`H9m+tuOt4pBy(sa07q-(nBdyK7tea
z@3;Qhd{aeLEOFbX|GDKpH&)7S`8HwS`*|ybZT;L&%lLh<lieFLMYwiGgRtnFnmcD+
zuGCnN9GJsAyUM-YzvcX6rz^#8_NeYWvo@=u=eNwFHy(!zg14qjn!ZS)ebdxdU6ltK
zKZEY&<QYU?jz92pw&A~hE&o31cDpV-o%b27{a(Exi6u&dfnnDy1_p5~nHiL$^$IG_
z+WsxReXMBz>-7##UN+PyD&F3BH+*Z>q7#0LD*vroyJySdjD!x0NgW;yj1DKeR{h`m
zyYRlngejkIX{J94c#xQ%pP#=!FaLeumydr>|CiaXr?x2P$PW|o)My{>KzX<0t8<LR
zA1^=oc(40K&#k-GcHi97JI}7}la1Bv?ialotBg(^-5L?HT6K^3R;B27Z+%~9NiKa^
za(7+!#ASgSV?s-%Q&S_iMn;FED&JP={FS?NMOyWz-%GTjKkkebnSMv>{H>f#CuX^s
ztlC+(<X+@;?u_|Y9(~`M5%qrMir1^Y&0D)^m*A_&r4P?+PV19BZ9n_xE?u!#>%(-y
zFDEUG&rUG;_4`**Xt;1<Kvte~w#(%tx7aM3TS+S!w{Bm(XpU>7@Z6dE?6#YiZVRga
z&$eV*$nG;zA0N$BI{LIbebJndoe$)_FJ2S=D*gB1`S8eY=HUH%+U?yhR?m?CbIf<y
z>!M3xSDk_@1J_^X+|)2j@9Saxh8xm%m(D!u8Ol9J>T69WPtw<4zjq1bT4~=3{POsv
z<d^vH%~BrUYQy?x%#N#_*CD#;gvKt-Q+sx01}S8l`o2z$=4M<Uq8+%**X-(C@dLVF
zSBZVl4|4nZwfV$^zxTRk>+;&K(`W3ze`Lv9gQYI@`Rix6rJuZ6zqfwsygy%FJ;`65
zUvG1#`@!NJ%W}g{rUV`kT5z1DUEQ>`vZb}vXMNOuJ%;9-jqbkpJIdmoUYuA}B^SK@
zqehqd={H^%rmvY7`tj(!xaj*u`}-FKH?_tDn_SF)&34Ttv}?s$r5Wo_hO$W1|M_7h
zG{1XUu3KQR>&+y=yD6od?@fd}bkic|Do>bEC|p^xv&}SUo%F=x7ge+udkZRV72h6c
zs9jk1w$c17)59rO-%HxIJ)Qh$^Wqn4;<{}eH)|HwwyyqgA^V&2wuaOl-ydGBUy{B&
zKW^{upFDDPpCwez>D$kpx3{YH*GHYdKR$ogzrWYgu9n;W=nl0{-p|&YF5P%yvgg*G
z@8A03_xlw#**Pu#ED^35#23N)-+cbV{bx-linaw@F}Uq<;rsD)b^C+Td(KUsU1>Oz
zKPf_ca;43k+ozA3G^MYNU=R&{SH-}zB-7FAkp1C|Kkxe-Jnuc;FYmHBZi~&8zkmO(
zIL9?5c1M;;{bQC!3zG+pUlg1_Wz7^--RGLmoO9sZOU8c-^o9Br{n?qD-B0exx@8p2
z^-j+I%HG?*6Qu5c{Qdoe{f|7c*z|6t{<?o3tlqKC>M+XB>ngM3@HzkCVeGBN$FJ${
zFaI6hGimD1V@ny?;=5jO%wW78E1ds2jOiSAo8kF&tZTYOH!ytZ>TWrp@Fp;1N`v<_
zcjJr|7pA^wco1=2)hzj#g5wbz#`8}~4n!%PlXzIPIxna}T}`2lZ?X4;HC+$gTU?^n
zMt!&Z7@Xrd`N{Ilo4+6M(-x3-;+t|p>Han4@V`q=r?s7aa{beFq51PedpK4t5OVX$
zTDE8J$vpQ3LbKF<naBk<Z*2OY*~z(zq2|}a<JDsI-*g0DoSyH&9MElKTkdmjbIK&s
zw+rTTDEnW3+;m{2#E;b}v9C&vWG3!fd+qH+)yy{M-UgA7ZF?s$C{H@!w3TQ7`k0cL
ze6x0nR3;|+8w=Q3dOfoCZU4<7?(5R9*t(@m|Ku7@o7T|AJJY8M8y*ldIIzaim7~PF
z!PnpA?!VY83A24qbSOP((+d-tbi8`5nhC>(9YQPl3vv%Nyc4~?$KBg)LXyLt#=O97
zdCxN>i|%{cykRJnJT~*z29pDF?{kjr`o5q|v2DS@)6OTi24#JnsL;dh)tEYUy?9gn
zzBbD<dJpv{94${cq58=9K<3Abe-lfbrs>>Vd6UIw>&^*>v^n{X%N|>t5v7>t5o2;Y
zK%!}CA$NZ^Lnvce*R%Ke5C5xnY5d)0p3Q$a`cqbPdT@eL-C>{ACxjznL^s?Q)O!DL
z-X;?Vb}pfgw=xBD(_|mArMU|0ZZ6{O&-Yy8p}lZTLwWGpBa^m>t#)PmbJpljN7&9K
zlavMiU2kbTma*8QVur<y6{T`|5>p-;G6(Mz;}&3A<au$GTuTVo%AV7=!%W(zxqK@T
z);@K(xp~3Yl7hcq97?DBId*LM?W-C|eH)gsEf;19v17>Df4T2a!pz#dF8d=FqYd2J
z=O%vXf1pzt>2s_2(wy{@g_YF@4<9T%T(RxqAxGarUvV`ap5xPXR_Wxkaj2hU)jM>s
zKx5^;xP!@#Tf8rJ$viOsqjc43X4t3IJ3QCB_HNtzb&1&Z)~_qdk9aKP4K}-LmtNj+
zy0$9)VWIuL&4oLr=L)q5_BS1xY4`WC?;B5VFF_`s7qd@Sbi7W;5<4jJi$Oaf;fIsZ
zlxwkGYNqRUH~vf0$tYNRZFTE|nN9Ui?yRr&jpuc~E&iIN=B}%0=e}281-I!&L_D}S
zx2=Z%-;@O7t%6B6A8cX`=kN(*lGBuLToHb~Bdf`-tm$=?X$SwK#7k?$T)pE(XI=R8
z=OgRQb=UoqqBT2Grny8f`*ZSOm+aMN5BL|HIym`B=BFno4}NBjk*gQcj;~3|f1I!9
z_UGx#){7I&<oxA(jt9T8d;0G99ovhCBg!SC+{?EA@N}Q}B>0EmES0TG0=T$8cV7Iv
z>7qtZ4bR!9#(z)UsCDhz@j1<bu|56&mXz=Ae(R6(XiV0;_hj$$V>(L=+qf>|{o9sR
zzv5bIUR-el%e|`kzUwy4tk7KM8kr!i$&+ZgRMXDuvZJzCu)9nlOV<r$R{n6i-28AQ
z+ZNSteO9N%cAQFh=J~JZ!gJ=mFaP9q`{t~cie9GnZEnK#55oV>|2^o;ayR>X=WQ87
zmpTWRyYUj1b87xIX??nv%apLbJLXBIUYH3_^b>36V~Jn(?LFiWvQ33!{lSTWE>`;s
z;!kwHoN}cpv-9KTfM8X<U>?nHz74;<Ld7>TMFsHNY~H<R8IzP!`CiZMqKRiO2b$`v
zs$1PvBrwZJ;G=e$W7TP+)2gBycCXrZbfu~A)CL)eBfs1u7R>VJVGyueRh`kfpEqX4
zJa^%!wI98E4@}+BJ5A!R(oG+ol}W6UM{SaqzrNv<&||i#b?<FmsmHz7AKj_@?d17A
zQ0BwI4e1JepN=h<sFir5bY_?4R-Z1lvwE|$HnOowHC*#%Z{|OkX^_zF?4ION!RXHW
za)OFU-7DFWtlNK>t5oYbn!`Oe$-lT3?clkMX|<Ajtet!mm&aK(36(|j66T0KXG$=a
zP}5T1o-^q{mHn=BubTGAPMCRgP0XqftKXfS$oG7fv~ZKH#H*(+`L*p2|0Hc%(y(UQ
zc8OEImH*gxb4CBkQ(3L;ck<Co!4ED)*HY$+U8!E4d~^A$yd9+)RdacJCIpt<U|X|f
zL%6s2<L6t-L<PK^N|x;3e{c7Do18PZ*)!Lar%y0j;;j9S-(r?MTcOPzH{N^aKW6y9
zzFV#8dGn8J3)5phk0lcfjG`r(i?o&FYWDD*d9AQjUR{5mr(E;Poow1Sd9J;kcvebz
z`Tix*@@!xK{`q-qU!m;%Gn>VJTTgc^<2fDvx=QI0_x56k5~=%%pR3pM>H2t{dd-%w
z=%~u)YPUzdX;S;wsoiYKv6bsIHR0J4kzmgIrn}<aJg!Ibn+|<l*3$iB@e7%WGOOq7
zTU5<;oiB30-{wIE>#jMAc0X92;J{U5Ah&>>|Nh|$KW66GCvWDiTv0AGcU#oIrro@!
zUq@*)Jdn7yts%9*yi4C9t~g^tnj2%|&jaO&&!&IyFHI19^}uNLNe{1>quQ#xEB%(1
zn=;4j$YQlzCE=?5#(m1`r7I4W%L{N^%X;`BL-23#7m<_yEY^Gt(7n8-VH(f&1O5T#
zR+~jN_mp3m@K-S85Jzlucf)^$D{@Ama_4rqbzVDLWu<E;+;k^z`--<_Q#NT_{PVQ*
z?FLVGb-!3c?ZTsy2{i}rDZLd)=-*KOLaE9<;2rNFs}P6VYvop%v`onR5F)Cfk#=|C
z+U2`8?8;-xb2+j8?zLmq0lPPyD~S9&X~B)yoAc%S=1Z5Se`e6Vow@t#rw@fe-jc~l
z+4{K__pB0hb3J2(PX{FwSWCFrs0K8Au<5$~w&YK^<eftc;-}B+i)WWO*)ws;%yj?x
z`xQ<YF-$9nJLbSBt5*EcQa^1`Cc9YJTulyXGez%3(oUO=eJ2V3YTmZw<`0?DHG$r*
z%gUZei1BO`f6)-EwTjiVPV&p!ri3bqS>-3*zCUa!J8Q-7vhxK}{}(jBS##@M$oB8;
z7w7(1wX<B->4)zpPo<m77~OS$ZGUl6Z|+{r10NaYu8v!pD}Fce&8N+eynO>!AOCz@
z+$?O0M8aMsIh8EqTNUY%Pps$KM(3DKSih_K@8v~#QLVN5pDuY78d%lWy+}BdyM%LD
zv0>T4kIz4?T9Y^9Kc`QL`+<F{a%Hx3&Sn06O453};I0=H!j8(d{_B@-IP+kI)c&d)
z=YPbp#0xq4X}>M?uGsiy!Ohe|4PsXMiT`8vR&HFMmf>Q_v;C@7RM#34U%hYpOLtZ=
zE7{3qIK?uS7Ti;bEWO;lB;)8N&Xt}oo^<)Bd{}d^+kL-{>%Nzpz2sbvGt})olc3|^
ze<!!cAX#D6vWbk2vz9Yjt7LEWd&?Nk)zDC*<IM2m+5UGDHZK@=>MlvB=eQ^`Q}A%t
zQm&6HP8?D+WH0r5{pwbi*j;wUvd5yF`L4V^;j!I<_8B2!OP61tYdPuSS^aqmKkfLd
zm@QZQ4J=uAQc&%{Q9hOc#+xr*D|7#7KHksta+mslMg!K5pR;ym<>!i(Sah)!l)Ekx
zF254W(pi3Gk_KPXGXEMY)#h6>Y%WS|K9FIox^kUs?BWN8w#+-t8nvUQ_Dz54pqRS;
z{cmo8C9EA2nD*?~E|flX`GCJc`y%y}=WG|(8Dx~@9?>{f6Pe*ueoXEl&(6BjPF@+-
z+qm+j_f1GUaR12KsU|x(%NKVUD%7z5|Kbz5$FQPBIx^$@M%#7j=Z;ubv1uHCeC#Uo
z`sSS{XJ;mVem&!h<+oW|=0~^A-zwT`fAVgr+LyE=R#BQ8q#s6Yy`{BmT6Ctt5#9%P
zd(-|*2t4!qaBR+^^@g!$&s7;1dY$Red9`KTsxY??PxiHB|9y3GM%B9RS)8m#D&?)W
z-Hpo5UX)=`<#Df1^8C7WbDq~niS4`j{Kn?GjT4fz8cKGoIbbuh@x&aR;`Hb&k-H&Z
zMFs91nXCEKe1ca8zr=5gw3|(*(^Rug39s{dv8=aFCu;IkuJd<Iu6k}eHs?Rn(j9*D
z{bXh=JR>{RYHo${#);D_<S*{`d(>NZ`{3D9MyDi(*o?+b_WLiHnV3KR78G`Qx3-Sq
z2KRw3#ljDP?H_(he(e7IUC;5c?NP;-LVNZ(&sE{)y?UMHnOU@c)MXI~_7hQUW$(;X
zCm6+Ltge<^;#Rff<*KZx>g^T^a#x<skCK0Q*3ozI#J^43H9ds9*zH{_V-H-Y@cwXi
zb^rT&%ij0<|110Rc=eYjKb|ZPe|h>czk;E|ZZ>n}vsIze6It%v?{E>Siq@ICRr1#N
zrNx5ho@v=~=C9AYk#uk6<_Bt@nG*}bn)dJS)%4xldzrW5^x7x6`fY;mDkY0od9XC?
z7x>Z2A@j%e8BcWA`KpEO`PO2sGsAp5Km3{$^prh9-%4CLA$-D<Pw}sW?SFinWawKr
z--c6#|8c>$8?q4!3rv?Q%n<WZ+NqrO=xfi9z%Np_T+}N>SYDXz>@qrMvow|4&1(H6
z4*!!9O0TC%-<b5_dQ?IGyz~7$cU-ehHs4SX;jg`Z$y%mG*Lt7&%8)O%sxr>)8?GdV
z>{e@=$SxwLF!{X`n{JKLt%Yy*tN3vrXKQ%3E9BFRwib~;H+r7P32nOnTuifUvhKQF
z@7c=?3jWLqx%B+7$g>BnMv;f&eAgR`Z0oUlwC#lzBfnAAnHbi`*R9WsoWE8$&;4iB
z&OM=GLV991Z72Fg2DkR?Z*E$D;Jf4Vsb_AT$qCqb+oxt4=T7eQH|MSz)%`kMtABmg
zMh|;63GI!)e&xS7vz6I>;xec0@=3fk8`I^v&l)lR{m<zgp~-f)cE()GhV=NCN?$Hi
zUJiF>J0Q1KNkB-!X7%c?T8nhbh38dVFbQP-u-bA@-~Wh1k@o4|x%bPJ9haMMQzZKE
zzskvnINvpN-#XaDWX2U6UR$2Q(e|TM>$&2KW##uGE>%u7PpA{qzQb&0{p(Yx<O>7F
zR_Bwe_uOthvj6hkPlxjkB(<M#iVrzB^Pk+U%*iS2hgxsvsm-f;eqJEp&=32C^IF$0
zO1Qp);dNHHb=MNL{8eSXg){kl+*#T<TY1cK=I36x_)}G3wed&x%l4V80;f!z;veXz
zoqmvc*FlN0^$XW5T33E_VJE|;1*|uWj$Z7q>|gY``(bUuyk9!6Vyg-lZ(GH!9=6nU
z!<@uE-lhMpE%;WnYhPRKA%2hYCjos))m#gb<vzKc-@?`Qb(fw<<&T#t+L!n2(#$-^
zyMtALNhWl%WM9Mi<e%lj@i%5CFT7G9?hxO$qj<_Sd%Z2EGr4^`e}6eAvwcHf)C{(|
zO)az6UWkmiTyc2!7A4Ev#_*U2A6UN%S~M)IQ+8+lx7g-8n~cDh;5BxoQTya(EL<<S
zaQpn98|Ji4c)ri^ce}`@<7w+QM0ZuG>4;~Egg%gEYz^I^-WB>p{ax_YBIz@=fwy>P
zFZGygvS{kTxr~P--!a`3wfSqi<L$o?|0ssH7iQ<(ei;}n`)uxpAfa{Bw(z@UhW0g0
zzkKiPmF;`u?3g7N?+pJiFL$ldbl#~Z2O9R@k!7n6$p51%*0cHNF2#6BvD&k<d-eo#
z#8s#k&wp|BMD681QTdzoD|7AYZCTQ|Q&)UlrtErhQi&RaXXV_hMW%1KPDP7wzINg~
zeb8`f^2_l0y>laEm)vReoE!FwW7p+{tnuQ4PJ3saob&6`$&;s7yNljj{I1Wr%pzpV
zG8Sw8+(!vZvuyR$&b~f!&wTOPHv&)8>#lEIYbH6TrNAI}?P=A8Ki_@XQn;%8wQ1>V
zk1vHy_R@NdOL<-i@+hm^a#^xR@OewhPNOcn+AEeC8uj;&na&oIe|C6B)q(cM(UE&!
z=PSD?^_jih{rupvkI{h(j`SH-@4qo;v!)?47ypu%_ul(vsmSi1r*uR`M1g<RwR3{=
z4m_K3cZYe1!~4=pznB!PzbzI|+EUH6a;dL}#kDErb51-u=c;x7sRqY~jHSLtHygVW
zUVd0SdsD94HQTjMUDu~DHDskf^*U{$BOn~|*7XwKlsUWaTYX}f)To{uWhH&JH+yBw
z*??cq*sjFJxh=UQyV#klD%~{a1+Q?cue>7T<`=V<7#uh-=cmC|PMQBbl}rz$FHAn2
zHIaWo`+<jR+&4tbyeHGNW!d?;=I6pM-8?u)U!K98A<t!tmRh)yzm@J8w>^sIj_v(c
zu*ct$X;o7M6I1*YU5=R+|4e_d)$J)}+xvD+%pL1cyPOZK!Kv;?Ca*bo_SB=#3)C&S
z><#CgHuU}&_=Qch%53K0MUf|Og|2ZeU^AMhIZM*$tH-IF8^(s04?4^$=}ffS`SIwk
zV{d9LBTjY2wtw<=%3EB1D^BcllbL${18yl1-lx?+&aSv}ec`R}%+*g1WfkT3|983i
zbI~T5GjmsXONS`UU}`b7n<n(p^o87^KHKKmi(d9fTs~a-lqH_~_%@&I{nej#Z(M!6
zy>G+x2QOnd>O&8mU$n)U?ba_gV^^~SP0ll{oRv;gd9nrCI`7yn)&A;l-~arlhqL&k
zUh+8k++V${{o>sA?&<b9{kP;4JuHrIs8r}`nBJ;7ErogK#H%M(ZT~cZUp+hN>(oW5
z7YozBXFOi{JiLxE+3C}ohw3I*4dSQFn9lFMLsCVm()_yS4#yWOg0l~u`}w<d_k@j8
zmTYwAD!Q6wcij4X$RU}BUvs}C>u#EMbLWPT_=}Eq3625hjNR@w&6{k*FLKD%`>f{+
z?Si#uxmNu<ky;UR*z?xD8Gk0dQe(cp;Kp5^PjA$+>y7U0>%W>b<>rQC23{rF+AKo-
zFW(dtuRGs$ri@Qrb60^_rDJN-iwdbA&ME$L1JyR0ZdHAI{eoIF)8)7e7ZdrP%{j+9
zSzpyI-Meec`G=1FLMJaC+_jQ_mZeS~v(P;DtuqdG=txg{n6xygChp{)M`>|uX1!q6
zD__a>VT0SFy`|sYJ>7lyg}BY5;A3m8ShnxzRpXu_VDWvc!(CN##mwNYzSDtseZ*&M
zeXc%zi%n}g*XvzcMNM6=t5=#yZg3Mkt|xW>WOYi_KHo)`C$+Z<_6Ro36L_+x>7t_Z
zWy97~HYdK-KBX({R)%fYeB~JNZO5+|tAafLENkAotm}mue(4tUKc3lGd!x4cH=FbS
z-iePDeyARi37(Se+hDa&In~y7>60%DMP7dWc1Zo}w&S~WwOA$`%9@%u``m-p%96bq
zxe_1$)ok0(`>jUIVJm-JacmwdM{bjVe3*t_fzy$r$8EKm=AYX)?HKox(~qXDzM8Xa
z@zq;%Hhyz^{G6loH;?E>*)N+{t2HfF+L85??d!GRE9W${yiY9l($!9lv&fq1Z=$ww
z@!bB@yXIC2HlIutoOX*S%$xm{C3xPlY#m1RuW@?Ww>Y_Fw7EsHBPMTiEDiLH+!$n3
zaP<C0wb<OZ8--N#G;$eN9~DUnwcL1Q>cgIbUnSGuNq@DU<=QBEclMI6ldiO6J!dK2
zFiEoNwB;(L(=(3<NWOKuY4=ds=d@{>tMjq=Qc=hA5w{ob5<9%UDUs95&egZ?j)Ud$
z)TI|bZn}P9ja^)GcjL?tG9d|na@IUuz3GBMM!=a(CmyeTvt6dlsbQYvlFS#kX7n$*
z-1a4FVcDvEM?Jhc54K4QGD|XS_df6_Y^UJN)ou9~i?$p%IYn_zf=+*8bIAqH3#kWx
z?Gen~5?A=ASJ3B=>W{}SBQJ=Qb-z{M_n4adMRo1|{KerH;<xB!ZszF;^vpIrdL%t0
zd-IkBoOTNqIWj();l#`Qo_j^EDNpqWyLBs#92yqgztx>8qS)uYY{vHoGHFk%d}bSe
zJbL2R(~!H58DkZS)mb<$lpW%+cr>}?>&bbG)>gcn7Lu{(>@Cx&Cp`qtZZN4(NRtm`
z4_dcPhxcX2IgbDAd0okG*GE4$cz(T3Y5wG3DeHZ%Tb6wK{bJ6#pATZLt$e@OOX1e@
zJ)X_KW&iKF+~~5s{@bxvGZmf}2POzMB~Fl7^=8Kxt)hhy|M(r>J@>t~V9u6#dB?UD
z-`iSn-lM|!>>~O7y~l63SDdRZH`}%R$@a^~RQ?CGCvHkuCN*#3!Bg2Dvr@~dPyVyM
zoE*CL8uzI<7Rl{GUzvD*PnS3ov`F!$&$1Khm;Fp`ZIIe!Afjfy=SRoWSVPlEy(>+W
zIDM}1yqp>~ZHe0SdPNJj?Z<Wt#S}c)_N2mO^Bz^%4F@*$ta_8P>9dhS@b2LBr&o&V
zP3OABMA{#owAa$w@7A<Q&);hZ<X9%%ZatQ!eEq4GL;2P`{>9cm4u!1?TXoF)=7y*5
zW~mo_KU`WAWOY3_t-Ep6k;ex%1#dpFI9&Db9*uQp-#;j5(qoljd6v0o@mhsfoA)jg
zs%A4j_pS9>;Wo*VCPsO_<DSVyFEyS?+&9~ou<J>2!^X+1Vmcq$UKLedy*OoF?S08j
zIm>64`YU}1Wr`?}SaWR6yffX|t0K6jEoEIl`O~*|j}LRnN;Dphb={=BdV#?Q-uWF&
z#~$X?Jp9PN?&aK@%dhirJ!=29+Rmb9YIs3&(GnknTt)V8ChNI3*}pmKvq9fW-MY8=
zyq4+7td%alR*^|ZKHJFo2ZW^lEHym%Ib4^Ozm92{<*Y}Wmi#vD@mbvGk$)ttwplIr
zS&Z9#{k1a=S3HmCny>Zmn^=EIOvdskrG5Pt2Y70)PWARXFS|9R{9LlEcE#+f&3p;=
zkDS_fB<#Fpb5dT*-EXg1iJDCB$C%IqQ-35JEV`(qyV(2Z)YD-K-vbNI$n7!ZoAR+m
z*2cM=!S>jcYESMv-OZd5zb;8`Jk-RnLM3%WTo<=w*WwS;4)*Z<RX%a-zBB9c&u%A#
z-t0Q3`ywELA)q9<!i%&1=E2SR^J+dnI@x_(x<qla*sJQ&4ex(jX{&!$wtMV-yX~=e
z)e@;=btP{W?N(fN&UKd3nTPMPH?E0jZl2ru|M6L~^lzEBHul}T5PbFT+&BBK?a~mG
zXJD$|7<u_vPs973uHuR-Q8#w)x!-HFa!=^l?pWpvn@cD3R-gE}{8?a<^O1m^DO>(L
zSD0Sq)UaySK|ht3ma<pu6CWzt<!t*GXe>U@_D{;!H8&$yoIY6`v2pkMzZWtUME0d6
zuAXjoS+hrP+uhDaGb81uTT>5LP34`K67#t75t|Ncn03{I46*GD8vmHY5ABG2yz#AK
z&)j==R=&`8-#^zi>~)&n`>7oKqS8H`=gcCnWY2cXSdyiDYoiXMrQGAyeLbNY%=Gwk
zb6@T~e(!{0e)~ta#ihy}Q=^XVnreKzX7QN-#{Vx@eo^T6jhI^}kQ>{Pt?kKqUuxp1
zuz7tiy{EQ*nA#kwzes=CBhjz`{feSfDF;@t@oQgblMi+Dyqdn5d(+8HCekG=skx@Q
z_ll2w%t$RQ_{R}9O=&xmp_}lhZ*yuNXLU~0Z&Jyg_9*+-{;AQYwhKKGDp#GevXuSv
z)r)zb-^2?gAKH2C7^mc&{l|Jweu-~lf5$fcpXiPS8<Va|FwANYw>x|wHPA2Qjg#Bg
zQZJ`G>s5)?{d@U@<{Z0UpnT9YcJVdCovByN%tTfmJH7e%;ul9Z|8`#RWApJnS<h|?
z*SOWM3BRz`L}0#M{ll{}-!Stq1%z<u)%|($()|3q{Xd@X|986Z+ux@rpQQft`eV?0
zbJY^HJLTo<jER+U*J`e9e^S1E^RtMS^LrQN*>zhRp8lEB-f>Slu-W0*CkNT*XHLpp
zy&n0B*H_`f&ziK%YYW0&i@xI8kZ<an_i3@8*9_Y&>#Fj&_aA!UR$}`;ulbRoeD74T
zw0Bz`oqINaUO2<0nGt)IY%t#Zp`d-`-yh$%$D6EVxT_j$v#wYB&wk6(vzB=TX-%8p
zmvt(Pg)Q`X#gC-v4^}pwJ8CHIx24Hyiuj_UD6?bpp1K+qeLk^ep*P>`3CFe=-TKIU
zX)8ll>SRuV9Z##j<gKy_FFto+&FrnKc1aejKX=B9A+MiB=BeQS8=Ase*5S3gRF=%1
zI3w#_Y0K<&HxHgy6)QN<J$u1(_5Q{C57_(9m;8BIw>T@b{fTwqM>hUS+q_R=Vm@_h
z8{RmF-G3B$j`5wB+{25eTGI-isP;TbQjA)-DoNwSZT<aM%z3=JZiR<V+V*$SZta;j
zc%Pm99{ce{{Oco+Kk5etZ8wpdc{Vci-ElKVhW8g@m%C=3eaQFG?6;rc%9F;Gk8kgY
zSm$#0z@&v-51+O9x*gcwc;UC;CcQ)F6PEV$ryn@+G0~*=?8Xz#)}=S|7oFp&DitbF
zHUDPW^^WQI%RuhK<yU`}N={zBwOd%KemVEv+0%EsE!gh0;fYogcV&I_I+3mR39ZYr
zLVn#!Rk1BCudi7CYj=O>+xrg#?i+})XlAZG&-}RUk4(=;`xT4yF8=wwMpNzL+;=iB
z?o3|#m^bxS8&~0D_sw1jwUO7;X8ry(<DC1#g>~iWYLD#ro?QIC{P&LPxizzQ%=r+h
zdO61M@?_T?M=esi8nv=lbH;`HYMz~P^_bvZW|^OSQTw91-D{hEI&b~4x4P*E^Z)zP
zc#Hh{pZsT*w9|>LI;V8_{=?mzd)IdAhKrPayzZ_LGII-Goa4bmoh>Gsi%Qq&Jqd}`
z<6$pOSvUXBHT(TJ>q`6&R2|`+#VFKx$KsFCr7RY?6YJY=r>n$!%w^ROIKXngkH78t
zN6wQs%l<@7*<AMSzO+JTdD(8E##c;yDbEe8>k{Ukl&|iuTAOu5y)N_VxeGTAtd2UJ
zYsVs>b&fMk!Q{vT$BL5^7O`!~*zn|P)>T<CgNAiA>?zas?|tCFmJyyPxpavzBUicd
zb00a|mzf=AEce40zqJJO+|AeQmHpfFtp8o4`<|y;GK=qU&DXnj_D=J*N#SRfPcK<>
zZC7C(gMW~ZyiM2DJdp_X+*YH;^a^qJM!TIEYVO}^-YeBUSv@DPRHZ*G(9?cP(91K6
zt*7|z`KYk(MyL9rKO1_*%N{XT`-#|;yxdv&|IfrXA534CExUEd=T=kNe2&>Gz3e}q
znIfC}{FAn-$f65u-;Z6%T~ZNWaDK|VJwL6wIE&u=kPW*L6d(PpiJx`GmHE5EcD&Et
zWy@#1{Hpn_&uVPPtFINxt}|a~nRrXneB$cWf=!njnL=7OUlAxXEbu?LXjS&i607H@
z&Xo9{f4E*XZtm#`?@WDaykze-8(&?w*;R;t_q(93$E?qo?w4ErRl3hPXZo9I+f?WE
zELy(!#Z8T0uQjSZ9b);iGDtG?)1qb88fLp4HkG|$vg6-;@S0QWkC(b(E4DwHdxWuY
zK7;?|#Kk$cE}cv{WanuW%JX;Lg)+}stpckZ??txmbvF7as($)fWb4%{Ru*y=UVL&A
z=Ta63<t=#g@|eqCw#6yk`=*+91YZ@uZ`-PV@Cmb?k-+880i0stz7fj<-Y$`rGu5#>
zbE_cAFiGqI-~T5vhs^7CIv4fdmz;InKVBp3!{*w;$IG*X?xgJ$WA1#qZrclc7q$xS
z<1dwWB(M3YwZzjj)TZyow7MniS!=luciQ}&YQvnfvF+ifd9o3QGmf{Zf3%9;_Smqw
znZNxI&-&TA+qxd^{$Q|C%t9<-;>m)l<p<7tEmh_{_vUhEiRJIC1q<JpO`a!q;pA+u
z#>dC4*4#OK>Q|cKcC(gWmD^V?ahMh#tx#g1Rlq&x%|&b0425rU?MBDAK6iaR#WwGS
zT-|$7>rZpy4tNHNuX!PN_hCX(Y+0*vUJcWQ50|u#>^{hvu<M1V7ti9wbuZiG=5$AX
zU9xI-Vf)3#orzj1oNp{|{rqIW)8O{IV)mCmb@iWP6CbWz8h2K*@;nPKn?Xrp<#XTF
z%a)e%yi(+B`1Hx+x!bV?n$mkxi#{7Y`qj1n#a*}j%|iZ8mtW@0wW^9dnDTD7#M|Ka
zzvJHjww8^kd|=T$=j!a3)$ew{Nqzib=2qUDOaAUo`*HJWj#R>$=5JPU|AVIIt8SL(
zpPgX&XThW!E%Ry&W%NJvm7Ll(`<RR1IsFG(f87+qpX^~ifA$dL=M&oV-iq!EY)Veq
z_40;u<6=vmvUJ8n;ZtTQJFMfd3=zNT%=}+wiF?}3jq|s>_hfy&Bl*0Ty6mywT~}u^
zzHTZh&z;THa{LD8^J@R)doF!HyEpmY-WmJ?HyC%-Pux?N`EYCZg=wMwPO90rX1(8j
zuf&HbptioI>{GD#UiXV1AF<VX^K5Ho{`T+g@yq{Hx-R@JGkB?N@Ip<J?c~9azgzid
zyRl9as`~tKza5*xyr7*KJ*rz5HHK>YUr)~p;?TN&>9Fg}t2;Vn8a8Wq8H%N@Q=4=?
zv8+5IMaryKpnRI;+$^vE>*ihf-!&uV730~BDsy9nkL@<-VsTXGjP2|5@2^`FSo4T`
z?WvggZvsAMnk`Z`>P=iQKh5=f)=GDu$^M*Im;W%4Q?@*|qsLCrrt$X+$#ByJvyc5K
zND4HI;I!aA@cW`=aCt}NWux2*m;HA|8YbJ!_NcuaQSotmD1*ZN&#U`w7wvfyCOS!&
zfn~9cnJt&yf#%35H>UbLQhp{O{mkI9%JZZ1yDnVwvv}`v@BEQjmGaJWemi`tHFfWm
z+&Ych_f4d!w$)?vt`BC1zHhO-of3TT`>7w2(kFs<u6V7i{rchKo2SpYaV=w2%h7vi
zCu_B?F}rc=pGV5!Q{1+#zMQpg$(Li#PumK2nh4Flyd)tlSaZ+P&(8gymR;><N~)@_
zkFU39obXLENT*U{?`|<u*DPth*3L$onN=N6{F^3d?Dx`~6cSq<5a21X>(hZ_*MxTo
zC59aRQ@yB6;_dW17cE0;p7yZ5I)3sRqh|hZ<yBKJd#v1Ca@dupV^+`d9orh5W-^pS
zGFkKNUCw^}bKG_HkO@^qyPKaac4d+*xERosyY%9ZxGN=ntF)@O9oN}0`RArnrV%lv
zk+W-j{Of=IeBA!;&xcrnNyk+6+LklB{tsNT{6jrMfHyOX2m=EH2ZQj+uMrjtCvIxt
zWMIfs#J;u|v>dS{KR-vWpz>~HZvJgIp?~Y*H@fmEl&W7WYxvg8AnG9-Fa2c}%U1rK
z&F2*~3NsBC?s)Sqs4wBi{`<zikBM6rU6OmZPL#<t=G{4)&vu*Zj_KXs_viSZ{HL?7
zcb$)ay60MIVA0M5{aHDCAAWv*^5qjrYw@#j)3!^Woi~48t?lva=5MkN-}H~^ob|Nk
zxc0@I!Wo(Ka@8k0b?JIvUUYTslgv}6a+Q~)MaFW^eHnBm%cw9rYkiuJ#{V5+rGfX%
zW`@MH>CO(DKDGYR?`3Q9BbVKnnp_gyIW^sJ|J$r0_07lhk1u*y>ZSd2)zqs!dk>%Q
z?$5p_FiUdxQ>&?a9?g7|^<&Djndj1k%YGOtTvogM+Lvoq@M*F0vsdv{+<SEKppVf0
z9jaRsFZbkz?#^0LasK+Okf05#pS+r%uYc*YyxzI`ny<fpw<f;1s=hW!ZNrJ|g+H6_
z=2o2DWMj@Xal7tJh9A<*b5o}ZeVO)>_r8(ti+YWU?&~V1D^_gPkzN}Sx!L}2N#W0D
zU!R_TuCDT-^VWw|v&v^*J*o1XHPD-R@r_xT2bKDDDj(k4Yns1Eb9O!V3e)XH6E-|+
zP4ZrCH&ftfp6#`z>wXwniQmo*d#*L>;O;4LZrQs9eBE1wPS$67pDYg8GfB53*{6B=
zJ-J7T^~VE4wRl$vtdDfdQhv8!Sy$@rHETA79-X<p?eP_r+KG=d?2eZen(GVdXIpG%
zj7Z5{I=#Mi-_M@Z>`USq*^KwE9}uy9WhZu!d(kl)Q??FkJx#8xyca7}7y>_d9rr%^
z<W$G{s=X?WLH$*~mi*~TFWURkBtfn>{fYLrTbr$JfBJ8Kv)zGB!hWHc_KnNG7^-<U
zHaXqde6b_z$E-_<@Af|GUm&5L;BWj_C52<w+1zHA1AFILy|s0$bMV>r^?AesfyEs>
z7ddu{a-Lx+Ixl~ktMx}ug6r0ts{xkh>I%G`9QI$4r62Y4_vw_dTg$gH9o(i-@2IPt
z`AR<b{ha=-z5126eKPgte~|k=?bXj`nhW?2T=vN2Ir};Ez_0Snhcq%LFWl2xRpz3*
z?Aep2<vROxUYn*bKWUzR^5vKEWVh)SpG3bn+a6xvuu#xA<d^T^>?7SyyH6hf+w}h6
zf(Lcp&oWiqK3z%Px`B()d$Q2qcTbq_uddj|p=4elE^E#=cdc+dOZOw`2{v3+e{u`b
zdoCShC|UWltU+pT;$)H3xyO&>pV}9->F3R)gyRY`;va1IU%<Wb^v;X?8+{s#`!*cN
z-tzBtt=AUK`!V-@#M$kbIBxu6=}?@ZR3+K5xq40=LyK4?H-k@o-F+LEb3#itbIoJU
zFWh;iAktvz(;nWb+Y_`EwUWh4&gjm%lD(Nb-u!s&b3<i`xBAvkCx`Vk2&<bN6WhE}
zI5bVw>diqB#>D%Q6JNY&wltm~8hJoShKuu<%P*@>oHo05+U+%zzI%%2MA_2Y);4oI
zu7;>CWt4cE^GfCTl~8%PZBb=UAKO3r;AiZlI>mHy&{I{>wd)u=mL>PbzMI&+U0j~?
zbL#eq4^x(JZ25cVn#bLxMZ#PwFI+Kc)nDSGxk1#uAmqf}^BxVxEsy5k>)s^yXqM#6
zW%D`LC#N!<VEDX#lh-Gm`^NtSGxb#5H<bs5xn=t|B-AHPoEgf$bc0E<{~L{{$5m}l
zA9p-ruAi~%LWRn+v^Npw4sFQZv(P^9@K5t7^Q^+6r0YV)PuAVqbV`^fUw!v;bu)uY
z)yH2Z*1cb7v!gtWfBqvoW8rzh1uM<joGzT}aV_sK*d?K1<tnPs86(A<<doI9d|lPf
zFJH7ug7tE0L)fOoekd*Yt;u~tMXT__{Nu@=t}T{a^}lrL9>Yy(qI>rhp3L^Ob^WiU
zVrkA_wx*A9?rFD>XIiPAg;u4<*Yq4rJhN)rZ$J5EK9^hkd1k%tnD=~(`6kWw**VAR
zp8V$4Y_*y9VbOJt!#%80#@o!oZE_~RJ>$!q{_I)vtPPHAG7enk8Vw>3V%-yeYNnjO
zVQsNDD5FD0;<4-^)g0ME>CM_-BC5ab3oVg8DwP=G*_(9R;lIsow^i;pcC7EznmU79
z|Gn&sBhh;zXO{IIxjZxG;th}LT$Ycr>osS1r|5^e?{eSPXv};xclJr1Kb3i%(W0gQ
zt{GY$zHXJB$Pi%sAbU;_Lu}`nJO4OJx;zs$GR69QJza2l$_=yh2TT0Un=M@?S5b2L
zE5F>yGb=B?XMFgAC(&zOdaiMXiOzS&t5SET9^D(gd7<=|2$>&F>>J~sAG?$Gw^^~!
z-MslL^TOjwzmg(5{zqp2h=1o*<5u(Wg-d3?{-Sl+cYmsFy1%n$_nVG`zGZsR&y==K
zp4`|PpLV0@@7%0})g~r2%6s{|tZ%NczQ4N5gDECUEKc=>jp);+ih#tI$?vBG&YV^2
zzN$azmCWx2D=T_7E}Av3>hbQk+7Z3es?-lLsw`i2^~#qXsTRHiYuvY5SKN?g30mCu
zcY&+MBJ;G>FSousys^FT@PT_%JyMo!Y)<t3=_7YtMo8^_w*G}94#m;Qw_<jk{nlBg
zc>7w`6=kdM1;Jm%kItUoTy1z={>j_a!T`;uYwezUZkYS(`KdYCN*8WRe*c@4H2Fu>
z;p_4z<fi;%<_nqGBdROn@n_|R8P%PK-Gl^7o=2N?ACBO%DcNbf>edq5mw)_4ek^NJ
zdi0{@mrCoAdnJZDm&zPFTf0wG`(|qB>Eq2$48ts5t>C$vDX_<#L*`gOxUWWh^;gan
zzV{|}_kB(8E{@N(n{?yuGMC8Pm)Js%ie<0<v`uvFCr_md8+TsJeCTmM=F9Cr)%7(~
z)U8)fJpMc3!>Kqcz3czJ^tv|(3GI#z{-$d!oqk-&>E`q~E%%h{7I1!1`SA8aTEL^X
z27#*`|J;oJ{av=&c5ivq!r}sRao6tps~`A_)~WVP)tFnXX<a>G^9ui4w-yDvpOb%a
z@$5Wi{lYDVXZhwHy0?4A>3#ZKW#K_pY{lOf$1+?vJN2jZ1BIh={@h&p-|vk7(^tD+
zeogxK)%S+^i;$PXy9-ZlmworqoImtSp>E!ayZw=>Majy?WItUzxOd^~J$;h%>?Cwb
zBDeqPm{7OkW6-bX>rQ&Twby@tP~^+%rLWi`g_}+6|3vK+XmWPEVHC4q2kS0pdG71C
zpHA;f)>Ep!>GORa=kIet`{Xy(z4&_gdvYKDU#9Ac?D7-+A(x;3Waf=Y?(6?BGjWOI
zJn0t?6m8mbm-SSh_xiI%TCZ%sM%LX8l^@K%F5avE_h!u%Rh8TPSL$Y}sfx-^TfDoW
zS@@saBimJ0ezSKsC7ZLfoaEHH{ma;;#aBmE-(v^U_jdO0h07<`GY7yMZ!#;tMr_&g
zs4bVDfgw(ZfkBpmfgv}wI6qI<P|sA)Krbb;xI{NIFD+l+**_rC)6e~GRCMv}W1@B6
z*WV~w7M#hpY_3VB^z+V*PukWxXS(dnQ=8nbx<O$(+lCW*3SED{+D_lwxFn_gSD5cI
zQ_nXyH$VS0_x+rs+#h%Dchx^VSLl7|N~`5@HlLr^Pbs}s^62%?*G_+Y%NB28|M>Ow
z_4_tEGt7DZ&JJJy?f2i9OJ>E%+t*9oJGHl}k^BAn_jOU-M_+mE*&7+F`+mCl>a7*!
z#p-rz)^it@*H)Joe|@N17keQ%{PfqqcR#iB|KR2Pk)^jTWUaMrLs8zpL)pfk)n{>T
zpX{p~rD|<>z>_^ST0JGa^HPcEdZDcwlS)<zgnhjhlH3_D9w%ZKooODiSMp=E;@lMl
z-l3gm9oK}OblS)C^IFgCxj+17NZDmnoSTxode_4U{bYX;ZQuG0RlB8IZkC_o3g8rb
z^-$r7#hae1|CjyUGpAU)ZLSPU&aSOOVr9`)CvGbSJLIM+uk-xUDU{sKuJU&31XWMY
zs0PUgk^09DFvmHrmC5I2lU<X^rMQ+$UMgtUfy)oJCx;*0bZN`lmwQzHFSzkK@pw_i
z;hh!fIxjEwZ!;G#Jh|%P!-MX|`l)X2g^!%#KLu?L-^TDg@`I4pLhFC!ifqbWoPNij
z?-BXesgvNUZM`$}h0UGoy-&|+hjsk*yZG_o?=9<9ZthI|CbgJzNleCtmOGEjcDZ|Q
zU3YNS-c71q`+j`;`d&ZNn)zAcVRpyI57;(X{bIP2GL>7%@rhe$LQ7Dyw)!Pw+sUWv
z%^v&29EkceeQxZtxc2`S)cAKv1x^#Ktf^ppCAj4(pD5$r=(jSgHb*7Z8FxNaxpHko
zG^ZxV%d2wkQTd^3*R($UlI<(@za@IhvP%Ufo{^$5Yj$svJSj4vWsz}nM#<{J@(+uR
zziv4Gp=gVu#Zso%?RS(N<9O@?TK=s6TDIkj^^T>1k~Md7{;@7BShed7-yhi>$vGPK
zS=muPHr_eOw}p?BDe$6YO;B6IqI{|U8^wY)RC>f1+Af%0SmNU`J1*HtGU%LqG517<
z^oI57?B_0W`~5ob;%xxm^Ssqsx<?CMd`_-6`F5F8<IO|wOEU^Mly#RjygOu=#I)h%
zpN&zGj1z1;?w;@!{$zi6Dbqy}<_%NqrlcHcZOBVttFSmE9nB?oEhWs7CnEZUlVi00
zBPPBDa;diupW7g?K=#la@kf)p_l0lxtgI58{B8P4uJBW@*f%_C7RnGXx9(%O^LP*M
zpO<@8wmAmWD9c){UmUWgfWN1%L++T?ovu5rJ2%{aSv0+o(IUG+ieYBv)n>KuB$4LK
znt2?oVrFJFOoI2$R+?2NMm(L;?4kJD`^FiQDIyzu@=Muw&-wL7q@UUE>f|r_M>hW4
z^VMM1-uE7R)=PzL4LbfOWbYOc%?xoXx7BO1_$IL5RX4iBwutrdlF4g#@%UY5aM?CZ
zRkTxS^~8%S)V&s#PFXqm`hBG-zoqK0Jw9$J5Nvi^U+RK-%!;Lf{32!_Igb`Ro#`<l
z<%Zc7uDW`!pGw|cjDhzLT=Q+nHP2(Pwy9vb=XlX|*5oQX(G2B7ABCd?_xL=0cQb3E
zu&7JwExE_Fix12&o$)C1)2Gy{ac3UQOp6n{{+r|U1`pE-4c8bX#9y@b=4kYN6T4pO
zVt4FZbbNx?6Swe_0U65=E=^JVz5CJ4Ad!vQ_nH5BTQMrVViPxa&~%In+oU8~#BRRg
z+EW2O)AEoAC$Ci#|8bVthuNiRPt1Pmrf(!M)5S3@cZ+nvouZPEr<up6eYkY_M1M=g
zN|Tkx6IxzII@=ryj9GvBVh`V>?Nh%AJI(ifqY<F@^vgEoH|+r~@)Hx!yD2qY&0+mE
zP3ipApKnZB`+t<$l$|(mK4{*ZhK~NX7ndcmpUM$AA{^l6>cQvr{Pz--l2_XWA1yza
z>&^V_Sy69`xwk#rqV>-ot@l`6aC`g5AB~ZnUr!vpdi>SRG&S$dGE+rEJSR$eD6}-3
zJMySQoWZgsnCbBAs|?dPAF^M#9#Y*Kv)K5q_oqG0!jF$nKT!2XOj^Bo!r6j~$Y|F2
zCIY+JgOw)C4=KL?|6$w0+fAYql5LND<h-P6@%}jP8dhzm1>bsG9QyA!oQuhlt$p0-
zdT;wv6Z<5?iBBiXo}W^DNUZFFyfOP-FP6Lincv48FuKY=BjG|3Poq*}Q=jxA?~9)!
zjo&lIvL{;qT+s29wRJ_mS!u5ge^)~mL*37M#=sug8-{}HHi6&POh{0h!{d9vj%)X+
zefb;in#fwrUDI>pX{fgJ%7gd*<dj)#P~tqfR=RL=^P5t?DBqir(GK%3T-1=wil6sG
z{GHIPgv*-of{gzfCc1?ApY9WHVJ>Wcy;^t0d6oQCbM7bgujAO7r#H>?m;E;<z6o5(
zR#vGOqQe~XRR8%XJeU679kM}b`?g~{r>7X$xMjLM@&6-fqwlKxJ?{#$+}6NoJ*I?>
z3u+#*xUcvjb0E++;pp7_t&`^%Sw0u&6a8~hD45mI=jgJD5*oo7Zneu=+?1cr(64L^
zEi64C;`+WdVxpeFHm-d<2gTQNU)tcmMuKbK%x>$c{%y~;lxp*H-s}tHC<tKBGd{RD
zJwk3LOQv#;8PkbC8O6no|IIfl`QJ{{d+4taIWbDn$b)NbnC7>lT&WkGJNB`^sS<wm
zrghJg$$bKu(O1N;KCWZFv+7|7N0jB)-n)wb=E{Tw)mpq$*|*$C>f4=^>Q4{U0yEz%
z-cbL1Vc$`Krf-hr66$wscjZ*K?2x#mAsqc(SJHXooR{ZPw`~q(R*4X-D86<mxST;s
zR$lM6McxdiMF)7iuWtNsF;+n*jH@zu;zUlai;7EU+e`N=oO@Bsv+~FE8Pbc>Cpex8
zZR5}lk+e~pHQD$a-^zlIo_^k6uVh?RZ3_FcKmX5#tDCQ${rl<dSDs1l3l*x9Z~e5L
zP?Y}r$<3*b2WI+MZq)gyEi4-4&uKSB^y>`G7gr)TD`|Mn`J9$yvqI45gX0U1qtkDg
z3K!oyl>XN1Ae)hts_eGlpHuGXd*0+a!eLe`d}WH`@s!so3q3=2rkDP(WB=?q;c2C<
ztOIAP`kaH4cKV8b2-&ys=*p?752|iXIsKh2eNBjbDwiO~3x=DK3KzokKTc?WF`Mss
z@dX3rjR8WlF8r1)Pwa?ao_6k!?~}&pmljW&<&;d<p9om?>c<_WBUV0XpEu^5SaqmA
z`c3(#jx$SGuI_E!ry|U?Z6CAylk`P(T*swDm+s2SVa}cF;=>^J?thbYzhN(rOq)bP
z+vbxlm$hEZoWXwMqs6})2L5-W=a>e*((2fDX~R6u0~a4?7qfDGe10PI*u*(**Q^qE
zrc2aFy`8($D9P|<?8KGlGlG|FS-CRO#^z$zlgm42c&YGjKew#XvvKn6Ri2`KYoyap
zx-2#9Q%jzCW2H<flW=>D_u0PvoDbqmH#(S$%Ui8j)Hi3DT;k%O<lo*xo4F@h+_#X~
zd?IJY)ZUHrWMWm9^;^sF7tMH;`|0K9`pdH_XSrsjF&<W$u`BH1w~5!+pK0iR^p^MP
z^xlWdcrKTDzm=UP7<9HbfN#z!k$9FwsT94B(uTVqFlt5^ZgYu#@lxXhzn$|6<>3BR
zXB6f&m`fd5wRTI*`jR`<KXy0RGm5Y=JrWQzmW!2iI@hRKUZ&jA_FX*7C;pIWTTWq~
zm?W>?-YK;QX72mXVf9nuS-bNEwqEBYOU$mWy6^TjzkkC5>kpjMN{Tc^>MlR}YLdkq
z#&$385aV9$q|1$yZ%zK0b7I*8^LXBKQy8{gng9Hemvz?M50|!y$v4(F#qt?)E?PC4
z*?hy5%H-~;2@QKZ&U(*k5<Qt{_dPb~D^uywg$E0}XW92YKHXWYU$~BSf_?OwqeZsD
z_Bz*2mm0h~{`7CZx%|7M$B*8<n^d}gPh9ux-G8F~J)0Y`rcSIre%-o;cNzN_>yEr!
z;jMnLMLX0?%~#T;I7qVK6@#zd%q}UVYOak5XMR8Z`};N1ntfF}WA^TjUiYu+@8z$r
z_6gX>-rxIIa7)ae4K@4s{GaLc;_j!q(!I~Fvx~(Yd;5q_=G()+kNob`?by9HGQN20
z)7yvG^2Hqf%b8s*dF^0sd`HypFsn_vZ@%fJVygn)i>>_ue^ig0eYVslw}j6^P|p0o
z*0Pp2=cZU~JIV9v-@K{IHvV*dooRe}<M-*7HGFDEUEgoL^P)}f{Pc)Q)(i9V6l^2d
zYOY?`AY9VoXDz+8Wws8-0!4YrlC0Yq3GqvJ={(9UH<WyO?Bx0M$A6nTna+KY-mB>3
zek!+6PVl|%p=r$f8XvqU`%_bAP~~@uoiDZNw3M&(?@orDVcUwV=RSP=>Vua<mF0o2
zT<@=KzMbx&p|GuHY6DAK`mPGa=dEll$7V{u=zW}Zy8Kzh(d4zqq8~qYo4&@<tw-{w
z^xewzv>mhjdGzM(73Pn6xKa8r<8ISsw_dBwm#u4Bl=Ca@(G&s8gB@MhgUlB{%~F|N
z^+sstLZymlz5;t#4?H;g_Mo&jdt-B92g~0If#<155_heUGl`va?cZ146Abw+ABvjA
z&r5!|8>8d3hBKqJVb6}wN}{iHH0|C^*yVru>yJ$zZob}j!0Gf{LmSqmp3k3bnwz%n
z!0jy83Z?*esZ;AhYC7f}Um*9FPo#X++YeVKnFu6rHghabH0z!3B$!{>x}o{Z^z~5>
zY-Z^1+kc7CF}eBU;+x6pN7km8NZd3Qo^#GUe@lsPnY57Q_WfcD71#ZjYBV{h@zUEz
z{q7<a7yrqNba?*wNK~uE8rvlwD&99a_f^Jhud5f<ec(zsc6H{(om+Gj0~M}c?9!a;
zo_#rY=6o4uHRtfYvs(Ot-IsTMeD>g^o7DwI-3d8TC;!-WAL}u5i?wK2A08eNets{T
z`+ohr{D%{t+TUNmof*Z@QT1WH{*(3Z9_BAOWp_{Y;QhbidK!PSMJ{JLEx5|I>6nwW
zUCT<hiB><ORxc}J;$l&;ZvMxXuPN&C?9KG}bip4PMh{otRb&xfxa$3{O@38+dh2|?
zxBuAZFm18pkN0}4rLV6nvsxf7!0GUDvD`lE6Q|0`%)56!;%j)`|50hmtg0}E0wyst
zKK&IxGVRrQHT=#O-Eo+rnEZ5GcSf3gSK*GRyDPq&;<`J5%~wWmPGgbD4mX~8iEC%v
ztNArOKERj5M)v*Vy-yGA&6YX8M6rF#Q@;E)mJ*jzAL+CI_#OJksj7LN`}Q^aFFm&N
zShXg7R-6CC{Q_Eg9~yt0d;0XdhSC>h4wjgGe}33psJQ#nY{~*dw~!?kN~M3(oG%+$
zO5SXBnC8s!{rujdUvfKsXVv}{3R$Kaf9S&eM{@t>8jDQsz2bMj;E;FopT^}9KmL2{
zXa1<RdF|9$D+HS6Wbhv0ky(4YPoThobAe9D@%(Q;Gd&-@e)lEjv-p2T)P8#YWw!MD
zObiT<*%%n)aQ4%ET|*pQ977zZhTaakZ6HwlJ^alFC+lQsr{%$~rukiV$h_rXG$ZKO
zmB5^%f-l<iIRE`#CnKEng6Hh*D68ig<y)=n7WYj#GVw{5)afZ_9w@wZeeQCBhh?jm
z+w0!AUuJjvi}YCxOWA5?Y|i4FHEX6((}|`-SB&GD)~;Qw^lKT5ugS`QjCXUk-Mkm4
ze52u#Q|F5JcVlMq?5oa}^f~cXcVfu4)10C$A9?b=Wc@7`-6wsoLo_7n%G>OqGn!lO
z8*W*d#QFQ;krmQWJDxm0s?i)%8LaR?abnlbo%7i?_Ra}Q{L*~QJJsv<HF<lcM`wRM
za+(k=#cOf!NqSF`?C}!EotK)t*mo+Qi#}mg!OfXqv{YZ_*|v7+;CoN!o?tchGP6<P
znX=^-XNrdGR8`%D@4ele*Kht>8BxN1dz-Stv7Z97m-I#{m`0oHgd1;HNxQp~@2`xo
zdCTFB6Q>@3WxdzA#$xklzPuiG;o~W+m6s<pSSug3sOMQ1ueRZkM)%8>{&=5hS())F
zz8luO7N|Md|6krF>C*l32Nl{=6`fcPrEQ%o#U9Z1!uPVv$=A7+FL$q%Y>zg+mw)!f
z+kF3*x&D?f0`#V)x!#EEzx&LY^ZE^&)!s{Y^y<Bso8ERSMRmr(<%=(zDGQjqzUT37
z`5yKC?a!A#?A4Fxd@#8>-Ggn?N$F1-g=f}eiw7>7F1L*R17pU4Ll*_#m|5>WA5x+*
zG3s~7iMvx59j<4vn_jT>7@MuAz}9uvOxiczZEl|Rl%+7jxT?+dlJ?y%kIygKx}$$X
zv-0N8QXM+~7fQ@!z0Q=@=unYpc5%**ge$U>+0M)i6*_xRbH<`ZZFBadM7K5BQw+aN
zlbRt}GI!GTM90N4&ivkqFAh|#omwdNfj@vbU;U6-%9iln@2NRFK4LO+x!a$W7<42G
zG#L8$wHGGm+T?MBpQ$RDcSkXVweoga^d-s3XH55UFmEwAlUN)e_Ik5VhM%L>%$O?S
za~$l&uL>@F3Y7ZGikdanuC00y&A`9_!qPaiM!1Kos}JizL$1RHJggUDmtVNSXQU^|
zwa?+Dm{Uf&xSi(#565ZkclN!nEnjew{T~12L;X`;vbJ6~(7z-2m}m2~pWn`8dj0h4
zjy$pZw2jQ$AEJEn3%2I9p3fFCZ4KGm@ekEaKAUep(Pdy@FkxU|P{Zk_)Vz|S%J_o(
z%)F9fy^@NOZohNqwa=aR?A7<vJEfzc+4uC6ukN|?!5cyuE_*JWX{lM2kd~K}HczzU
z0Ta?BENC3>*yS^RybKHs+zbp1$~Y}7$uEe{Ni9pw0oisMWVW}~*)yIG(M>zWq!H?*
z#lUbsn1MkCr)fd1&i+9zYv;I6UVLiXis#?Achr7J`@rVW(8Au>a-rpb^h4V}zuI?g
zpSUXI_uYy@wph2ozp0yyrk|ZEk{CXf;S2jW_8;yKzP+ojt9>c7o%et6j;EjHzs!I1
z)4kqd_uFKN!~gp|(sp{^KX2BoUwz12iuY)9_Nuj4?y4NpSSOv|FV{E0JHAZ7=fR8r
zBL9uNVxRVJVPEinN8S9e)bH~9wf_D1D!)hZY_t8PO|S3T{7?S9`%3)3S<MrCO|xum
zCZG8g+#y)3-4fpG?$n^O&Uj(q@-NFCr}vxwmGyl1|1<vw`@YH3GT&R&U#Y(w(3JSq
zO4+~qFssaDeH{j2zK09ipSw3|7U@QOSDqxnTz<1Lf6cA8lWo4nMet2x<+FNp`ABc^
zI?n#QkR3GzTeYrAZ+6u$PrbqIT9qtk-O+TxJZAruOv(Kh3_dYg9F$~?{+#ndg6qL5
zYrdy;ihE4*A4wYjwc52?*SE~N<H&ur=i3VBmHp-R-8X4(M5p?(((ljz6s0Y>=_Xn%
z)%UtaR_Wu7IY)z)AN=IX({2yGp#AQ9(I4j7-L_>qTxnLfe@2OG3CiB;w27FxI##+q
zVXxwahEFM{Ke0InbSTAV)?IBoANzsnOvCG{^XDhkZ5R1)D`4@3`?J(+^!d+QEO2$d
z<~F(WO`!1&SuUX?()t{)HO?LupL288;t3~wi#eu+?3`a{v>|(L#-yZ~SvnC5OKqdM
z40NitHVX>XEp2`JB0P1<KE0zqxngP#w>WHaf9q!F`Ny%)_~RpW-`#6JXNf<1sTeJ{
z@xGW?v%m*#gWT1dI8I;xx+78b=Z$N|4GoX3#WfUo9lI>*^z(@Q9JxK=AA3@Q&HukE
zwH8sjry8-NZql@e)0gi%E#lC(r(@n6g^77{Pc%sgA8|eHQ0w_2JaYTu$BYN2x7<k-
z_-J-ADR}QM+4SP$+20&Cya}q#wslZmw|w7Iy)BWle>?Y>22@JMTJ(K<yD*UB`2G*4
zUa*GE_H|t$x-xQ&@;xPQkKj2iFa4}0iBC-selzdmvzpxp!mHT@XFsiIW_`HB^J6LV
zDp|?acBvhAu3qKx`8#c^Y0>!)%;wq(2|-l~5{DMa3D&YVa<uMyd@t15pLbFG!VX=1
zrxnH9j~}o!I1pgOn9Y#%qufo6>-j@(?>)^06RK|O?XUZ@X|}B2qX`dRWVoGptG`yM
zjkW27x%spFIqM=A-A{6sNe6jVM0xi7IaY11&B~*`O-HrD_C@-0hqwBV51Ae9e6Mo%
z!0c;6H{Z?ZW7)V;uPx|)M(gZp`WD{P5A6CXrTu(z*oxQeRjI1tRy(wNcE6hOv-+-u
z#0*9Cf6MkreAy=wcvbA(>MyUB*n3Rh`}0FmijEC`mx*HV$|Ksgd`ELGuGrMG_~Avd
z1F}vH0-xHdZ#@>D@u6V%?Z-l0t8VQ~Y1+CVzO-A+P)2TP8soj?fd#)8p0KTSKV<Q%
z_3QH8KcwAF{bt8KV0C))?~MOh&QO*TkspokL#8(rF$PTzQt{vM;=KS@Tc`e>eQV<~
zQqEiMxYGS@?;*d%%BjZ-eSDnHi9`skua0fvxi7kEm)%8cmOs0MD!*n0UU;*|vYTiA
zjya*8dx8Y6PxmSlJ7jYp?3nXw4-f0<ttmytqAXw5t=W3JEb({K>=1KHj^<w$bAp}q
ztFQ4ozTZ@$Hfwuf=g%LqVkd$HZ5|v?v)6nRTM&DL|0{Rz-RX}#-v_>ua=jPS`>Od&
z-@*bLE1UPPCv$6X?Ol^~+`-?z?a>A6+z+p|opRd$K5i<{O6H52I<HQ3?5xrXdty_y
ztR=CZ`vr6LgTRigERB|``_q^j1K;%CY|oeCz7$Y#U{|Vt@pacZ>w_l0RFO(~vE;0K
zgm2~3z?182OSWgaH!6Htmw32%ensVrngSQOA_LdydyTdzU6U)>qU9h^%PzZ)`R#@k
z{3VeKeknX*|HRiiaeHJ~>HgfA8`j?5P#-NTWF5o&iSJ;w^u7<aj`l&{<|XZn{#?D<
z>|xjLPi+woTwUKUIBOsrzcM=K%c=v<Tz2f4oD_HUvS;jrDfLp)YrjmIB%ZIfzUttL
z{zV05yJdS8zW-eiJ!?m4clf=|d-oshF4=P;fj9cQG~=Zxr3IE3^q*W6Z0figWB%gQ
zjA!P*+ne)G-)#$?z0Y1RC{0iDW6~1#-&eaI)s{y3vrM=w5ir~Q^NR}-<rc^P9(Z9b
za`2w~^|!zL6Qcr7vF!F=b~-ioQ6Nj3(2-?vXS&~>3{_g%pZW6PF-gPoPx^lN{n?{u
zd0#?zg^;8A%ImfA<pMLRv#uUmv#@!uin}8-^9Pf;-!F?LHolMgtiEmSE~`JH`}VDR
zy!U#*v$VNeuCgEQo?dW$C(qxHdAbiyvfkjnF>i$($D)eMd5^lw><^Y+{d(K$XX5u=
z0j~cnPRuqo<Ga)NV%Idk4ioFgJp0o++#C7kOnv^0DQSUs-ZC-AeSx>*iz>c;Toqc}
z?wLDjVqf?yBmP{bL*~=?k~$WiWy|3WE#JGk?4C+PqQXB>%Vn{*!q<E3KYm_s%i2>X
zE(JZhu&&=Fm+P8)cI%2)M)PBjTzuEu`^^8k&)(Yw=fBD){=Cn7<$uz@pMP_oZ_d5W
zanOS4mgw#UGIPqgUv`~Le!6Pf#p&6nL^mm^uikldqe9ChdG+XJx7+@Io_>8nVbO2l
z;OaB8^wOs`yf1gl;yZgd)8l`l!^Eh7rQ6hA{oBxL^F-``u>8YN$+~oL{xx%BypPWA
zc>Hm5+|m^~C!eQ&E}F{2DRWKIEj(Dt@UwN7i(TV!J~qV<)>ZFU&gxwJJ#+4lgG{TM
z3eS14#!uFHWo1zmxM)?!?ttK@X1Nl}7R-P7q5Rj<(;CMje^@;<blIiA{j|XLbmpd9
z`vboPnbQ~R_X?Y=dm&cyhg<sRxw<=3G+o{=JTyW5)dJN@nN276Tw2)u)_cyLT`t$B
z%uY7T`#72R|A}M!HiuU~TjM>;GBMs#H0|oImjOw^_d3*0{*bJjCAVpZMquhhf3q*j
zvwxgZ>vn$}Vjk?g;EusJiS1U)wplTrm}AU(u)|{iyuN!YcgMYv?Fo|q{y^XC>)gGX
zk9)T)G)r7J(<QgBsK3*pR>Un}@3S`z{98&3+RiC#yCK$gQ9hNaKEgXCrtl$48pA^U
zBIoHljE^6byyCEXYw@>#8*aW@W1BYP@zY-4r1>{C$Fs_RGp}TK_1CiAbTlVfW393L
z!Px4oi^eBXYhUnxiMY9r%{^%A;(`}<ul$Vu7F}zk_^Z;$tU9tI?li|n*@(Md?sHS)
z{(ipriSL;}=DEzKlTQ8RA|GXczJ6~0+jGYpEj1gZoR2piUP<Gc%I2^~SL|3{ONFyu
z(Yoi~ZhT(0XYqpX4lm6w_s1P}`o<$KcV^Ldq4?fgc1D#=`y;p1hIa_rZkx5d>&GVh
zZOhLp3mW`v{C@MY;Gvlh7}9u6+PTwhuW`Q<y!2P&qd>?s-c|7vrmpKhCOf;#p!ML5
z@`8ucGQY^RJ*<6nqp0@e!PLHvKJ#z7B3b<V?^&N<o%4ED;nR8D{Zd-*4gLt1@Z5fP
zxAdK9S^VRjVl9U(H4HXsA8n4xYF5~#EgF5tg||U!d&CV}=dv$*Hw5hH|8V)x?dTMi
zSuTqM{#LxzILB^keB$v`R*Nz@K8A_$71Nf5cg`(SX{<}nyIJ_r%=glX027-DpP!wX
zJJoQ`54A5$VYV-Pl4HDgv#lzdzmq%OZnDONUk7-e=gRN@?Wgx9{~^cc*Yoy$s*qeh
zBd?T0@B7)ckCiqoywJkFY?Jiitk3QiTy@LsvYGPc?sHi9L}$tBTA`9Iu9Aw#hN4$C
za-Fr8`4@M-()5##@w8bo+qq4X<riP?VWXV8-*;x+<+SPQ;_$7ywr<{B^D5IOe$oBG
z(Rr(1+tyrDx^499?D@wEZMDnm?yb71JF_d#?tSB<B`zIT0xDj4)znNh5xo`s^Xm<z
zS>Y@ARqiE5zxk55t2Xp$-KTk9{c2`uM=5LnesbZn_f`(QW%r9r)*U?9Kjnnb#LCT&
z8Hz5Ki@4R!$h*I*?uYJYqnh8Rxbs&1WSmy1H-S}@S#wIM=nwBB`5SMz2nAeDt=g>G
z%JJ)6Y21Oo%lIEg9}9_Ly(+dUc!jv>4~s<$?k7)4xs!UlvD2|KL9R`O`A8!3&cmJG
zFT64T5x(;4eo3#r3EN9gYn%UgeBHgi`efIf9o3h)?kyI!@_zFEtKzN}pI0I3Uxg%U
z9(-)Q$^HD{re?=Ku_yL(2jqUwJXRFR&$wRoqJws-cI1jlOi^pny!S6nS?BESy1Mmy
zPi4S^&6|EP-+0?4u2$>l`Spw;d-w;<BW91bx+}S!Tw#5&C#GaiU~|vwTQSA6z1tOf
z{_uQ_=eD0!_|4*5-Mm1romVy2T~aHY=b&0q@j@cRvE26Nf?HQOcQ^+KEU$C0x)|{9
zl%~w~_qVS|Z~OCo>l(&i?VH8AXa5az<5_=9+r$0<^X(%Ei7PJeZF_$0(BIdhl{s2W
z{}p=o*H<a-c3?SiJ?)m*fxFzALCoq;bXd-PJSE@s_o6}IogLB-OeJ>tt`z*DUh+4}
zkKv)w{#EJE8f_f@m2s`+>Sr<D6uRTdL+$t^ej{N)Yl{;P_>MaMQFq+$w`JP5vP9`G
zFCR4ZGqS{Z8*w{HU0xU=pH^zl?lH-@GveiGKGno0>`w&tsQrIFfpbR8vzA%jrcyh;
zvy?hpFr>=n`ro%=wSGKx^Sri&4%?snU+w(6eb<+hvo|M1hFBV0KDzVn1H~z}rB}W>
z-{eiYE_+8>L6>XkH{Y%Ci!-+$UHTyXO?J(e-aPf+W(r6DG8Ft1Ju~w~68Ggl8taa3
zw4OIDapud<7i7(qw*8zhKVkOUukp6K4A-dEo0u`rJo0>DjSNf0(v<M4iLQGJ%;hvU
zXp7H?xOLNd4%7Y}r}pm*yqf3sHk4(n;S+P)t6v=EKfHS3$RQ36j_c2yd;26VtYRtO
zBAVYQSk*1MQ2*lf`wz~@#*42JIp=HUX7Y5+l<P;^Sybkn-mzUg{K2#48#0P)`xdU#
z;QhzPI#GVX)aiS*Ha_k3oG;RSy~upU2JU=CqqX~7EA9NtEBA4|<(#|QRF}27J;^?I
zt@;;VZlyabHnXqq3emXcq_TO5$+meSJK6JQWGL^|+L$k&5&VAp*{vtP8E=!l$DR0D
zOX6>a*4Kwd5ef0D3f8+ghxiCFd~kWdx_tM9s-HJMmWy~f%wKqSid+6}g%eM2#yy_-
zNqS~*;nD9dA{!hJ-D1DSJNL5H=EB)V40*G)K7B2CuK()Av-R0m`66APHeOVlR^$??
zv2`kUpz+k&r)RqOrkdVeZZz#<zs9|ZBHx<xL|@LCCLep`|Nh|LT;;ESy;XQ(azD_%
zK=9C-=Y=uLm+rh45_0c7(;kL^CjJ?ouKmA7K1SEE{Yw%4-?V+b-3gn%JNKG3oX^hi
z*?aq7t;X554NI>+xM|B?WK!C{LPFrG@BIh!bq>$ZxS#)gd%`A`Pfi=BeL0dW{!LG}
zLfT>(@08pX`9GytC6pfdtGnM*67KnP(B;q3b9c8NK6y%|>$j#v{uYO|8MBOZUTaAj
zw+eU$nHE}f_Y@dzW@Wgk`|;<=@_)Sk^6Q!W|E@CMcr*EY=zD9al+7~calcCf3jdYN
z6<L#Hv*yh0llPpwe`H5}?cG=Vp#AM@w*Aw#+?}(iXx>tmrPnl%_C4VFHD~b@hD%%f
zSud~S(AdbebLM${*7Ny)48EJKt+BoJ`j&^S-^Vo$(|-y)5#ATY8zQ_ZP5pr2K`AEI
zmAV@2N!8wo8|2qqivP0c^X)C~4u@xJ$xmiFlwD(5vO#zbOLy+%uvmcy#r>5%efNHJ
zNm={l*p+cG{!Li)PexI%UA)AnT2=K}R)KcpC4Ip~*VhLoPrl;$?c*!9Y0Eatt#r9>
z)RE5N{>S>a<fHv^Co*;>vpiU#EBy3)-`t636SoPy-4pZ3=aWJH?TH(m<BxRQ3={iV
z-=X&Q)0Ub&u8*gGGRq0v7PRx>jCX5A%s35IwuhYL@mCD-pLE@mH!S+5Ze7)f`tYkt
zZ*FIC-9G;M(Xr6;*D{y7tX?xUkMHUm<^q|Ag+WhV6l~dY>y00u+HS?A?@#D2|8(DN
z#pCNPz6S%|O!Ev67Cw^sDJYZgZYQte+hbB(QnwU}bN%EBr8XVsQ(IX-z2?7Ho9gQ3
zi(1KkC64oZ_P%Xfc6Y^L=awa<Q_o9S&3$Vk7+fvP-SU6;jpJLS@9cTqu25?$+pYT4
z<XP1ES5GC+RvbH5Jd@*_#kq3l<(hYT97CqWs($}ubCIe3lWRSn(Qko&v-Zw4oM(6{
z!Rl>kljY7#gSn446k5M9u(ew7p;u(%#>r1E%=TJ%L)x0-^#-0pm;4X+_bJ<Z#H1_C
zSSP*X+WSm4(V_zX2Zimr*_R(5=shkF<top$UwQlg56ZWTcZX|V`(d&u-h6&t5-a1p
zf|XX&-b^y#DwmzguzY*Zp3KsDm-;{PsqIrKc>iEk)#qQPH=R1C9b~%Gmy>Yf)YA>@
zYicjeKNBik)N7G<Xnlj{V!hdoiU-%<75YD+J~e+mW9WPa=beY1+iful6iYd1dwYu%
zuT$+yiG{s#M;FaaDlPgV>!Zl>&3I?g?Q5}dq0jp)xcef$Y`PPkEAYnc1Lx#zLQ!3N
zuFQ3-o&R;?Huom>U9AV7od5LW?);BuKE=QAR*9?SNZ~qI$YwR?akAL<imJCitYtSE
zmT9Hbx|TjGdOc6w<;3|f-<LFOUt#0azc$!+$*%c{H@|#%pwiKq*?08Nl21ZrKSGtm
z<?lLb{E3@f$z0#PZMU*=*(xQk4<R!hmMl@~)=|AbH*e>h4Hb;$E`F7J3cFv(vOc!w
zR^f=Bt*r6LBG|j8wIm}~pL^N8c8MZ+k1qyu+;uX!^_E!fy|Zn~_e#Iszo&cJuiLe>
zcJa?CX*B(QEt}(3&Pg}pO-{=sL~QyWc(yjaWQ_VIX8TTo$+=#v@X4>*t9tnpZOp%S
zzIG}4r@;MDLHwJ<&Bo>DyXHJ<x*_{1)I4a5WqzZ;w|VFHERNpJv3ynSo;;h}SGJAs
zt{j}kmZEoY@wRmLDOQ2MufFAb%-Mae<5iq#@4ZBYpPRpWG;vg~4ONmo*cn#3y0)3A
z*wE;>K-6(-{hI-CYd#$Hv|Vo3R%`dx%>U=+O(L1!XEj!wduef;_rgYlt?!@SVd(gq
z==oiIi{|5N7F|b|{QkkrFei`wvA`Go2iv_AtU3)&6fs4c73H+O5!<m&P`r3W?YTW+
zn=d%edHwFxrVr0{2mDFT`P;GotH;+}HZ!W@YC6&x<@qWzZ&n1bhRlgxE};BeH+o0T
z&Mk{du9{`a{1vZy_wBsd<m;#Y7P9E?RXn<Dhk*ODT@r84yfEz5Zug$P;kS{VMXuJT
zh~#ns&ja?G_dk1fB-zKp{rI=6u6f@+H%Ty0-OXef=lW9MbI^LL=RD7JDp$?xmAG>L
z#k0_@(@VP@A8hdr`|EaUDof=Zr;X|+^S)ej@8Vl9yW$$x{WIG+gC%|$Z~MI6W>wkW
z>%6@o-@BbMxL-1yU|G(*C@{M>rM%Z>%Jnxn&eb0-$@La1hFbF|)`uN=SXv$9XCc4-
zU|}qCoS91Z0mt74UEdY+H>Rw7XT<eIZ|yzi9~+w&=;zA6FMAxRXmetA{=`e`-v4{?
z{NMY4Cjn)Kfd-ay+?-tadk<PQEo-Qq6nLO3Fm+X|;;UE9+B+rHpFCe#FX=pK-KW<U
z4`lAl72CY<S<Liv&C(v{quH-#b-LMJ+`#9;Em7jydgrGs-`{TK-{~@E-wN;RS#>>8
z&P#dj%ts8rPp+w&IA6wP>-Onk^Ve@EJZWryZd$a}u8U%N&hb_6_VItd?~@(B>h=5`
z+jj>$)K0k9`kSMnRQ`+bWi92C>l*l++iw@`h+22rPU~iU*{4JH3;%cBiCewk!=reI
z)$iPIL<EZGtmofk<r67;?&rZiO;*+kRYn$SZ_6~?9PBs!7rP*|v+|#fY7MXYp?l9Z
z2^hp)PWr|<^S;DS#@}l@(q~FAm>-*xw_<rp`AZr5&^LS2zm(26|6HJ{(D!_a2G;_O
zmvftJv=>ZP%-po&#-mt=j=c{m#OEnKOfTkW3H&cz_q6tHcTnm+shL&WKc^?(eSPOu
z%vIGi5vM)5nd`Yuq{nf*V>x~Qg{)VN=Cgf$pJv=Kt5cQ#lk;lRlEdqlT-GxeepMQ_
zUq`33vS<2}OXs`PHQjYZw(Ssedhk8zi}uf8VMW$B-|USOty^bVt@FJ%adyw{%PZun
zKfb${EAN?MlMu_9ugA6Qf&BKg{Z|$~R$utP;(eW;O`_1mqW4TO7Z=a&-R6<{>G5C1
zGvP9!pRya2j<1OCo34BG?vnohCJuL(x!zj-`1ynT3gO1r_?~Uzx>;*+?dMCiU~{Kc
zImw0v`=+y%ekl5*<nf@dqCcZf;z{_8-%++s{w7KsO&W8%Zb{`8I~4HQme^#y?6eHG
z)k}TT>>zXce$m(Y;SW<gbmdPR-u~%T)MK`u2%%MnyW18E{jr$(*2TP_?t+ErD>;qX
zE8<S3JN)_5f8l@91cln}(A365lYc(TEO~!WQYfzfPlU<DT0MT72OJ!w%^z;=J290r
z@8rw#um2hy`uzBZ?{kHYk6RBc(SITl)^p_UNjs~bOU@o}OPaj(*MoN()~c-hs*|mJ
zqkq>2Bahe9K4!NqW)|AX|KP$`ryVD+d$Uh|+@j+r_<T>Xn}&&{%N^yF(SJYLB>la=
zrsDec_toK1QHl>vX_v3vwRcX$Q`V3tZGE>D?#>t5k<)cU`unb_$3ONlot!WCc&2~d
zt<A;DGBz#ZkX^bWVSe)ivC6AUS1oBef3DFm)^FyyyDTMH+f{gL_osc}wV&eob?M55
zTZDHwsYqw+Qr0_sQ=@F(Bct^9UUyggPV9{-nH4i_x9H_ym;Y9OpHF}9ww|H#l?cbG
zwPw8g(~hxb1sqcpeY$D=o-cD2GVt8lYM{34c%Q<F`6Z98b2z>T-+yk|{awDTr)(|4
zIVOm7uYSudFZ(xx^WCMhSDM#kJNxijcD?Ah`S0qKKbOn?+B)5`z3m$BTGHp&zxTvZ
z+qU$(m#%MD(tTg8wzFya!RYg$SGKt=;@NQ7t}L4AU;dYZZ-?`B=UpvXEHYm-a8~J6
z_ONP|z0cA=GOhXcweQ}VzjD{tv`&@l-Qzs5{;7Im+<y5_j4XyFiW+Zbr)eIvn#Q?X
z#J!-2eP@T<oyB`Td)gSuO65<qV*LO5-_K9KvoD1jUOU?7`F27}>4J=Fp4;_3v>#4i
ztl>3pom14@?+eUi>SU_||L-~x`giUBhHW<%zn?78FMG;^ZS9IYj$g0Jp0J#?tc|Yj
zKiI%zw`A?!!}p@i>!<VDi#KocVUqg(V&S7UrEqb@=|YqDdh?vhGPA!~U1<AblXS$I
zea`o|Q|klwpIFGv_)TrT)cXAQVL97`wS;diHBSw_?iY0+^<-o7jMpA(rptbv`D1N?
zK>7^c)5=e@S!x$$ypynwT-O`awv0`DyWv&&)Wh8itG}-HXHl~c{Qu`)mCI69jZWp)
zxkm(_pF5LUGFK#%<6_;OwIc5nKe))ZUs`%8vwdRxx7a{d=YKa(&bz+inbX0(86OQy
zQ!Z7ml>6|=bMMDn6Q^4&T6-b7-{AQDT-_t-@1pBkFMa1rdM*>CP}g|Qv-;pWiRlX@
z?mqpwtU9d!T31$w-H$g%)dfEZf6D&a{ifUb{Fm%Qacq%uJ@wa`NbR{e{dne1>)F58
zi~JE-_^&1Zvx?xK$2R+?^gq}lKk4y?^J(mN_4nC4cY4rn%cSPstGJg>Y*+BhMCT7P
z>MGNI2pj(>`eo#;v;2<o>S%+^v!9tO!ry**=e~CC&B$3R6$`d>KAym)UefM#<#=V=
z=VdWVXIs~sz20vY<aMo5rHJ!T@aKf1p}Rbnep#$`cGH0z-ivIneVQlxs=w4Na<Tio
z_+4+tZ#C0!C7#78)*`=sZk*q|`Am5n`zD9!Ov+Oj9Db>?wp5kxt`~f~N$Xx-<=m5#
zRd@cWWc<77*7x6wB8^rY75f(@bg(K#t7-EY=ec&f*EoLhPQM&~Wy!1NS6hD>Y0Eah
zG}*CcQs4a~1^olRl7fFZEPfugmE+4b&gQe;!kb&SMa%t}ILqltcFnUz$F?q;s1(4I
zu=N{r=4PH;-_v(ZHbty@WOZ(HwQ{T7UQdzsd;E6)(tagg-+$dT!mRSf_bsRPcnV(9
zmOuA>NlsA4((`|>MoRZbudjPk5wXtxeQm(}4e{r$tY=*QX!!xB-+N-8&dHJ46W6|M
zo{HzY=NovhpZ=*3TO&Vl{_*=i)SoEFxP9MhQN2MfME<Ty;)8Vw7dh7kBtLj_I<(Nj
zP<55Hg!L8OOpD{XRV@elFTDLdJzGI)YnFL|S;EoNS0iRr1nw0{->39`yGc7kQJK8>
z^4Q)PjPnbxslQn6b*&=u?9S}49_zdEV)-jPuYCP1`-p+xzBuUEX4BK(Ror+V@F^<(
zF#eIfP;;`EQIK+C@AnrMcTSGzJn`m^-`Z&Jon||ZS^O?M8oTi9(!&;C<ihp_PrUB&
z{8&=wRKK&0DyId{U$WEO^FqftbdS7xspGnheB~ehmE8HXL_hs&ec)`lT1BI#=_x+h
zD<_;>ds8;{n%Vhn&r|t-o`^q^7Lv)ZPi4}yMb>X@cl}}i5v9h;s@k7AX+=R;Pyep`
znNDlOzU?g7rsKCq_sRtSlZlyM7yOp|Q6&|U-4-Onx3jS&d2LWScX&&!j)!JR`0niB
zpQr22v@SB7|JVP6d-SKJ{YtG}vkfa6*TgT_I!Wrw4&C4X_|E=28W|-l;wzQNW@hRC
z>0RW{Un@LfqxNi#>wl%<aPLIp@6`F*4n6wxkBf=J{zl;B^DCB!2@1$0e5y3;Q?j=!
z59fWm?CZnVF|qQy-=<F6AF(g|hnn16o$Q<KcE*eEGNw1ZZrqgQcFeJ0^HKq(x-F`c
zcjwqWE!|ZnvUug>hV9n=(JdV1W&9Hp7JsPX>`>h4uw9r{_ruiiZ53SZ_Fko4rx(nM
z<NZI?f?slSQooDAOrHrloQ0}O8e@W2c!=<`X`hNztcbX`Y>~!~XMgMDYwCM6M3^SV
z*0xk_iq@L?j<fH3htV?sIE#Yv7ar-Xrag|nM=x*g`qBAo_2P%ObKUM4mlj?~DX21G
zJ7dAb7v55-a<o|Bb=<Rq`xY;`zU<kBbdC@A>i)RByZm4)*M-T)5BtvWf6cLKN$vi{
zbHkoiIj;RRO^b)${gmwXi<5p-s%`$M^~bo}``2%?n%Asne0OH~Efc<@eZlaJp5SBY
zl?AKxqZWB`L<YV;uN6_r@pDfe^CJ0!=PgcTwqN@A`$wqMsn+X}OISR`qC+N2=Dp=j
ziL%(cvxm(gM(0Z>Po<of!9TvAMY5meD;|Wb4bGqZ?q6NMgX!X0pB<a#zk8o_>in|<
zA_iu9rEL>m->_aaXU?NH5=I>RXR>@y-o7fH^^QvT=UcudE$bp2tG@bfocxR_Vuf*k
zf3c9fe3HudR~IGptwsJdTI59@i{9EG@AhJWPIBqj_uE@<GcTXA>xNeR!eTcyt9P$A
zJ^ZryYVmn)CkfA*M{J39xoJD47irYyUf9UOHTU`PjJf?1xeNHy>&q2_d~-|U51sRE
zJeyp2_-s$xD%pRLJNB>JcmBPufO2J;+t&@M<+>gYu4Xse{Zb=0Px-UsYyX9v+7bn=
zwx{am9o{b<7`J2Y|FA@^<Yl^?BHbz(n@yiMXYifOO!2sPjoI)%&mF}z-<~PmPX4oJ
z=I=nmrY&D5r`tX&-8W-pSX$lo#})4`#(dV_tpBtry4P#LcgtzgD^w#kEH6~v@7&qH
zN@kjJOwCT7`prv!f1NmYPpx(4uGZ7JX+6s(igg6&hdylnW$08=a=tXWpd*mutKgsX
zo<FuOW_@DvQ&_!bO~2TfB`-cDFxT(eo39JSRgdyiB&|)D^!jA<ypGyC;)OT9-{x4~
zceXfeLRs-FNybBK&;FfSrpF-QuOf1D&BL3!-kUew&)@y$=Ccoh5{3V7Ji2*5@_+X4
zxjdzU`VBAbwtt(-*vwo!n<s49tp*2Sjq9(qH+{dsVm6OmRN&7=q5pkT_itouY;BCY
zdpbn#-NacJCVjZ|NLwtwGGfkayJ<H*+uqx@`MZrp)%zR&x#xbnJDvIOCzB;!s&fxC
zSzWSYZ4(y{+A!I8P2&AUH%>86ZkY9a+Py~;bQ6B9kl$}tbm-?=rixO@IYNBymscqG
zHGZpGXsTcxCR`pi)8*l!WoH$RyRwye&)d*1z4*nW6)*O4HYJ8wDP5Xq)@FM1(9Ww1
zK7PD$eCl$y-)9^{nvNK`=%yaLA9&)pZ=nAD`$s15iwb+64f^GFw;*o2eZs|?2Dh8m
zwETH@>G;K<;u9}#AFG#ht+^w%U-|gi$!__+)?NH2Tmg$7{_vQU#Oudqz4>*c)9aRd
z(Vw$E<uG_Otg$J3!T)Y2@8b=BVh_~|vvJFLPjdcsd}`<Ejfd{8P*R$_OLgvCw(0u{
zneR>C(OjvxT=$u~z1QQHllSFt=h&s^WXe0ASk2VkpFgMOj`q~5@Q7WV;x$=O@2c`+
zeXDPozglcCZ`<4J>g(AJk5^p^zI-{>R_3|VykCJ?t5W>$TQKZ#ymZj2k;(l1*XNyV
z9(5)KcY`WI_q{Cnz53w8ty>DdO0lV@S}?KivFn!1nfr?CeDcB#TeAx#`&{STwVq)<
zZ@U)fm&bYU?rvwEclzfuwx9EywtUrMC{`$RdA3W~<-yjaucLoVn!>S2YqeF5r|O@Z
zhir|to>xv(=9y!^c*k@>m+!}3uH5dQ&=hmAP4;Ydv&h8bW|QlS9_z+bEV%pa$nhHP
z%@_I?$(?$?J~d<N8L_};)5N=O2OhY@G5y+32dVoBi<lPI6i?32%lQ1@apmWx9~t^?
z^^1?aU#BAA_;bdkV$Lhe7~U#6hO6CQs<HT0!=o(;;_B(^V(QzUE}t;5|IX9DlTOsE
zdcnF)sXFJI`%eDa)$=s`kLm?4UwFs!dz113G0OupKJwM~ulu#3qRgm9uk&xc{Of<t
zUtj-vA0KBs*{Sq&s>vIlXQjcn?VS!<g`QK=cq%7+n7RI%w$`rLuhH9`7kqcEZY-aF
zV|7f@R%X9vSLSW9u;XH$s(ZHJtG?&!+=U8~K2HS$ot#t6Wf#^Z)jQoTo99!`ylms+
zT18cJoplU#Q%;Lry$}~E|MKQO5y?dEEqj|+et$Pn{ENVj`7a)yY6x*y)GMlexhhZk
z>&3?x_av}SFw5&_j`rBls-*k&#rexe<W>Hy=K0RaKa+2MzTgfw3BQaV7B9a4(><>p
z-DsoM{`~cUm9p78ZNJ|*c;ol!+<yoES7txD%+Or1jlX{rn?Pkn#pHSm_Ucu6FD_br
zlDxDd_Hg5Ym9xHoT)%qTh3Aa(rq1&(xopN=TPdMXYWawNzIneUd-1$q0edefTg`OR
z{Bq*jaj(j-^b_)BKiBiyKg_O*KPBOi#cv>IeQ=xl>yTyNq8dz({?NO?cTiSv`lfq_
znssAa?H||2ulR99e44->hIg#%Z};$NhA!eU{CH{Ep+budXE}C-@7z0QYSrDOjrz|+
z-~aJ1VXb&k?YQ4ybAhyPH*cb4Q%Fndkw-85XXi>zX65+$b3@LdpGDXI$^Y7X??b0v
z+{_d!uBcg?f;Mt#DaU`GHD_Yu)UJisyMCQL?)Tbu#>eLe-~Qe@qyEL*-G4>u-mhvl
zzOuXJ*TZLu&lL`BeACpn)^&TRqP%?AWYrsc`Mz&Hmggzh(qy0W`~H`b-=C`N>fNt%
z?VVI5w%s+SYpL-;P5G04#jmdHy|HY$PDl0Z)~JH^iSP3hezO1Fqx{KJ=g&^9yhkn!
zYYs{L-FPoZyg%?r8`BvFZ{P0^z1oCd76jPszHtAg^ZaN3V`u-K{i7!O%<Fa6I<4a`
z{rh;}$+>%bFBo3>T&TIMb@7vb8*g71a|lhHX!(XuUGR_f2j}^-l?s)%t@oU18UJ1@
zee&av2BNzBkFOd%Z%JMu9%~<Qx2E#Vhwt7;>y1{w(>;FYefR4L^JI%Aobw6Y@?GYd
z>&?Z-b{>@DcVKg3z9z8jW>}tgLMMOI9ho1Wr+tgI{9d<@t+@OCo|1D4vO)!(o)aeo
zSPMl@SllPOxXF6n_B&?m<tl!S@@iIP@AJQO{qmG>QoAC!%d4e*=OeD&yiu0!7SF%$
zOOToH(`VBPf7|;BU*x9#SM$s4Jg|Pb-^nz6#W%;g1JwOfzFI7gymMw&TY=2`1Bnm#
z771+@4r#W2b@z#V_on$}6CTG^P3mhE+w8i6*ClV-vuAhaDXzZm+Fi)cxL)?$mWU(g
zXFD7zfA;xw_Vk3~ZdQu2A0IX?oKyPv(Xv@{HGHm~He~!<l_FC4GGq1R`P1(fzA*ma
z-H<cq!{Vjp|3ahIf6R@@ek*h9R#C5?ap-j0O(!Zuyp*!MU-TXMw`<nt>)KM6*Rjv@
zJXFuOD(&;BkNMaA*%BHnH+Y@gcdY9|jg?iSX#6*|b8gjXN7bdCblkjf=DBsx1o@3d
z*_U|s{=FEVC30_zu)%|K_cULs?*BRGl8olpn-a$CTPl2_`i@-v7%(F`&g)O9!57}_
zxe;N%s;d`mt<65?m;H|OYLLY2VD1%`_6I)m+80U1OboKgivCwq_2ysI#fRoe5#QcE
zx)K_-&)h(*+-bi`MJ1PDhhAmPxtrCAEkBq=bwBzQR5LrTZRO0YHm>==|6$*%xi&I~
z|4e;jUOtN}<-ji9S<wy(555{qpYnF$RR39L9wn%4@_fX<>buBC{wK!O0q4);eYgKF
z9^lQ$B*HAh06S2~VR~crQ2_>qJBADlIt&P~r4htN*`c0TlBk~oB8oE-i&FJ-6Z1gW
zP#>&F&k)_@sI_wQ_cAgtG%zzTc!3Oq;w_E*f@pi+L53okT#%oWomrx5sGpczl9``Z
zte>2ps|U6vsWdYuMK3e2xFj(rN3S41Co{Pc-CmG2Odx`Rfk6yPgQzWyCc;pA!N%yv
z$7jOsVMRA%_Tqgj+?W{{s@T!Z$U-xtAh9GPCo@T}0K*;P$DThw!NkDe!p^`T3UUAx
zZ)toYhU$)z%7V<ibSy^9J0dK<l%IiNvLU(=_a#w`NGwXv$t*5GGlFO3*ND@Z0c^3Q
z3=C#GObo(M7l5cOjoUR*i~xrT76a~1I$63}i-EywK6+5N&POpIIlm|s6p3hNfKIIv
zPrSVPITHheA1As$R8FCok&;@FmYI`^#fZva2MZfP1_mi>2Jk(cAU}ZcmPWg?C`P2_
zl_lrrrDdXrCnzxTOT=cX>M$_4EoNYl1nGw2Esg8%p&OD}l%JQInui{yAn$nj+~xCQ
zV_+~6K{tk*n-OxV12{DGa}$#@GV@ZgcnRbh6$LT(MgazfFmv>fogj#6Omcp10cNm(
z%&_R*q3}eAfuY8k0WEr6mC((|OG67+kO3#$&Zw*LF)+;1K#!UzQ&a;|Qp-~F%CH!5
ze(G%XSYZZ+J9g-9*zAmE1ZElqh3A_(uJs;F3=FSW(BsxI9Mu5Off+c`SVdp7r3xbh
zgDMkxXzq)|Gz5E=U8=$26D-KUaK;4PA!5;(X5=Pj=Ai`#$TycI*aHP+7#OBbKo8M*
zIjDxD<rn29q9-s=r1WZ?Y1H9jVDL~t579>*s78QFFf=!S45+o`P;pUbV6dKv9vJqM
z(G7r>r6}bW$c&S9zL!kp7#Kp!85ltI1vIZPY-!xS3*C&8qI@)0fI{L!!?oUM5e9~T
zJ`4;(FzpNs3|kuIZlaoylaHQVLHaF}e&6twXJGg>A3Y>jzD3nvkXTflT7>2VkSF-X
zpXqHAV_;zQLHC3vFB3{uElw>dEkH8?<cN7yzn^F-FfiP0WMGg&@r0lXnhB*z1x5K;
zsmUe9Xy$-iqVR9-qn2<6hDGs=XgRgW1=XCARIDZWheK=U<gqd^bPF&rD4;k*eGaMt
zrJ(vTDJL}^N0AJ2&fktBi~n#lFznWa>^gxNxTW#(LKM^T3raHcN>Ymoic(9k2C>*f
zuESE23=Emc=&{7P4#TAUJoK;ug>m#vo={N5deZ?txrQA_F`}R-KfNe17n>Qk;x;UL
zsLa6dc_q3TUv8n8QIuL<l!@sTkULiK{F>&<$iQ%z2|cbk|D%|ZSX_dy`LJWp+0Yt3
z28K2_$U#4dz-?n-Mox7gbMS}mNm;XB;Q|Z{daeu%@-TD2dB~O@n^8si#RaM0W)oT(
z1o<yeeg6R=W(J0-eCY1FD34)SL4I*bK~a8kYB9Fpo)MwIT*k@3Fv$kJ4wO^IG^z;f
zNh~h<Y@%;7gO!2diWa&tr*$xlDa$O*EXhaD<{*!O0tVLR1MS!Z@j-Y?<18Z-W0De+
zvs3d@a77*{XV|#+mzTvbFy!<wGN77u1G`yJGtol{WR~|)-mahP85s6IU}8`LIS7ik
zG<Nl4byr?yUREO1KrF#EZFbSl=Zp*t*O?g@6rpB;s4b0$?OBi$7Sss+y!^aWC>zZ<
zkn?0;-wp}PV_;BxzzE*R1~LkSw=}+V#A;kwv5|qH0d@mH@t{4e%_5$OfkBZKvNH~3
z7zl4^tlogzKqK4+{#2NF3S^)HhJn(XaT{oi+rV}=kGn}s3=HxZ2JYU9+dxy?2I|LO
zlRe7Jz_5=K-OF)1a2sfj+raN1)qmtOGcX+DKsPXD4{if3aT}=mq)?%qnStRghJhjn
za2jZYBT_)gX3nkxLvCjVhSqXMv{ZfPFjfOAlJiq=BtuZDd0#e*-;IHRA&~*SE>dS_
zMNZYpiACx8xbiN@q>k@@7Hnf@U^uA^IUX03_CR<`<8o{!fm`Vql^V#PRZ-iNeK;5x
z3T4n+g46i1I4L;|z5N0Tr(E-^zd}JRsABZ8TU-K*A>c9+Yc&gU(Z5B_2g2DH7=DVP
z2hvJ2EQaMK=4GZ~HY7kM6>_r9-pj(kki(B2NLIF3Oe#w)D$dNu*3xa$==3XOWMIf*
zMt72d6RJVEiP@>R;tdp19h|XWOL-U=)Qr(9-rLStOiIqr&BbsL$eghC`41Af85kyL
zqPwUg0E;=P6{*Rk*lU#fQt2(Hco`U)jnD&0DF%y4pe|lwK_*%m3kq$|rcnDhb_Ry!
z;^=j*Y8DoQ(o^$NixM&21oB-@y`$hSQwE0ohv?~PUm+Hw@TVuKZD;=S^Dr<}tD?K>
z>vAlHfew{U&cNQ|>Elj5)uzC}(9(qNF8eLmj4Db@PQ}?`53QKwd4!#T!AJ_dnagw)
zmtiG|Md_&+t!_~0gEBv?VSrj;vfRaD8mMoHE1iOj({t4Q?ZM2zAc#?vy5cmhpeQvb
zKQTow8I%do2bx@q=Ow!_F)&oKqx<&U1621xh5(9+aXAl^K$_ow|38I;fnl09dZG<_
zjKj3V;#{;u3o?ku{E)|GAqED~R`h0>{2LqwC8HSw3a+(X_qXP-GBCu7F))C3=!0Sd
zgts(m{>NoZd|GK9xcwTRSW;4ynN(Vmimhcef8wfJ2hA85cD_b$2|Zw8L#Z?10S6sL
zDZ*x)hS(WvJ~;-4FPqUr?twKf;|j2K7gzi^$@-F&f#JFkdP$}ph07pp4thDIXvr%r
z28PCE=p~s)0xok(Qxef40Th?V|0(v!voJ6i@IX#80Yv}^Z)wcw#${4vNe0&PmGMIQ
zGGTcJhPR#Q>Ed`l4zp6woCHc2KUbB==@>IGT;fG<VhgUvWlU;GYBIL5lHBn9;j8!<
z7`BF?7e1AbaF~^rUsO_*h^<C@yr#)_KPv;nQGWDLPxy$#u&l%~Y@xpU!M+a*Sr`~r
z3!<A8`5lKz`AJ#mnFthrRjw9#r&t&mf`riH&*TptlQ2>z$gD5_CEw2DVPN>Lg6=9S
zMt1DErl=HSGy)WbTQuxESF<uO=n0}%A3}UMOe!wVOv4s~lk*>}3E*U4_^pKQs2{>O
zj4DgaK@W70qd>_TR@$qBI8eN$u}Kz(Nx7L7nRz%1Rgj^XGjkHAGcz#!WoKYeff@*+
zwltn3U}$1N0mfK1C>Acwx_UT?oq@qef&s1lyhsthGZTx@OKXq|s|8frMOYaaSozR<
z3@)1Z%}Y)$szA%1AP2hsIw}V$E{-XqdwHfF0RwXqF=jGACN4RA`h=bx1H;8n=q7So
z6EZO~8{33HV-m|_B~}IoK|Tfs)VQv$Bw%8GZb5Qt5!R$=d~8k+D+5C*KLdj*D3YOg
zOXH(D{D!9HBo&onE67uPZk+nW%D~Xb$H1ToH4a2=Y24UCz{uR<<f6=il2r7P3KXCs
zDiKjCk_-$71JKjZt1kS;rstJniE^v(rrH<m3=CH#&?Cri34ZfH%}mgJBj`<=yyN{-
z{8$+nRtlg;P{kSoCKl&p=4E5_%Rt`#cUGTKm6L&CjuLuka&N+KXl`mrQGR)9Q8u<n
z$~$wkHj{;c!Iv97G|PA6H?|-hTch9o{`Er(Ss57I1<+e33J36;SAuRF$k)}ojjYy*
zF)-A7F)(O@5)Tw_X=FHt-?*~O;?l&N;*!#oOl%|c{l@o8AF?noRP&;j9N+KYH@G6%
z&<rgZfr_F}2@4(Uco-NQ6wnQne1u|PN@_uBUP@|Sa%L*d(ii0QSDZ#S1Ed)kta8w+
z_ZjbS8<><>j9zAd3=`K0GBZ_WU}%_)-r82>;y|wcP+XUkpI?lvuwc9~pLdBI1H=9z
zbkk<&<2DW44Zsp|^1s6mrLZtC6!D;kT$LXl)AAFGiV`c)(=;e5R7!mMWjGla7D}U+
zW%9xJ3<S-cf_i&c-1tqt`LBfl1H%Gy^vI}-!DA$5yA<TUEANke_2Xe+Fj7I!BcF3{
z8<v8t9SAb6df7yUsqzdAVddz}q=rg-#$lV$T-eZXBTAToq1^@DtiYLg%qqpU48Y*>
z&kxKT3=FxF=tax(HMq@6OH3}wFRDa~15g^?(au_-%Fe)WQy9IV*4m24yrRV1)bjkI
zY%~)=At!gxnSTif1B1U5daO>|gWJT6lr&Q`!$8iHR@+(hRg{5&ISt*gqNBJC%groC
zZ~B5<W~8)w?<Woh20=yicvx~9k6{?&Fd&CbE1&GmDb2tjnt>i}m!9A@s~|fa>uLg!
z>wah4kod#Iz!1QWo?~ShIB}LH1v!Z&pow2BVRyCWuWzX+14Do>dX9)<#$zC^&f2SM
z3r{$UFffGqpf}O^Byk&8h^?p#tG#Vd$j-pPE{Yy_J-WD!Do#$!Ni0ZA#+K-=U-+iK
zn3sX!DD*B2XpP3OrP1CLw~3|bwIe7Vtc(lfeljsI+~h{D9c7(y8wDQfarRBjPW8zw
zh8ziq-h#3ASaa<FI|GBf1OtOU%z@y!w|F<A4fgQ~^97v%h;I1u577@NGBPksVqsv=
zLoqzZj~K%P5=$~X^V0IMnGG@y)(_GEaiDlhqh|mCv+*p7ir1a7?l>a@!w(kpl58TX
zsh}1ibiNqhXqAcaxjQpt85kyPLN{+l5Q;02&4Uf%V97ozM&+xw3o<ZN`Jj(B6%^n!
z4_?z(rX}X&fF@DU>rznRadhF4i=Ois7~+mHq4f)jns6G8<ZLw8f>Q0$BNA?jDhv#{
zyU-Wj{ZrsVE<KQp(MMwEC*fLY@SN*)1OpEP!&PJScF9UtoF-?NCl;k+^LlEUp2HeJ
z28NDE^iuA5AWqZ3i}kRqj{${cwA>scK6wU)oNDxb!Ifm329{J7q{b&_q$X!$Un!@u
z&G(`pBLf3yl^N<tqk1z=Lko&Bb2Cda%W$_qK@qj1cCO+o76yi$d<+a)(2NA4wlp@k
z5MwmBfrcdkOt*Af^n{6l!Ji#H0hD$UV{TG@eoiXZQLKP{Cv6rpGcd4lqj!=P_Yh-p
zN+!lg8z>-L_s`STW?^8E=0$gK?*w9u1ts2ej9wkc<lXD`oO{j4z@W~89>h#ji7~k-
zF)tmxy$>??&H1z0k2x3^YL(Gz2Gi-pm|I*@ggv>P+Ug|pjER9Ej}vm_EGRvI@Rr8J
z1-J|b^+|9QhaktgzpZ?=i;;mrlLb9rbT7tlW@%nVeohM3ko{iJv$>O#fgx88Jt=f8
z#cL?Ywb+XokXu8Se$P}^WMG&yfq?<Ff{9v>*VvTQ<b3e-7J5+wGIiCoyuhW53=CJ8
z(L?p{1^lLF7AGd<U=4usk|gJo3=9nG7|~t2<`P~rQ!A2F3&6{dvE<zrFAr1Dr2i5w
z^uE>Z%Xm%ANX;oo#h8HrdEQP-{x^>d1A}uFdhK=iI$k3|*$P_Qf+7uzYZLg-`r9!w
zFlaHMhpW^Vyhi62V4aHuIoC4L((x7p14BL|deeN)R}?cLLpeD6_#m?c@6OxL&&0rR
zoEd%2WYagSX5sMX-S!lD1#Sk07L3{7pFgmggR?U^ai+QepAG|q-4pbtb1(}xa^(#3
z9h623d{A|_ykcSZ79IwMb($CfWq@K-ZhlH>4*ser$7GpUfg}S%Sq1v^OOGvfv#_@2
zOMajKu|b%DVTU{VWS4O`R%39DSy%_GI#A2cz#!p?9&s|+*bTxy6cC=hU{O9R14Enu
zx`QrOVKpZO$1wA!8Mkjf=3`*+GeJ-3l?_-8O06hKEy_#GiHEM-M2kRB>XiR(Wnje1
zz|d{Rz#suC<e_*=<AQ#yW~QN+ZJ=bpocloRLl6VQ<C%;Mpo7z)hA?bt<d}=ql=Qs(
zT=Y5(WKh83_eXU^7#OAoq0g2We!yx_Mt(_3K6>vOWYUaFB8@uy3=FdN=&?7Qg$Fs2
z!%}9Zp#}O-G$??gYBKv~voJ6)3!ta)-@@3<Nlq;;$;UdC5xF9uH<*=yVI63xKP-&E
zU9L+KSk1yR{RVQAu17pm6f*;Z6$g4K#mZqdCp)#WED_r<w!}ia>>Z2@3_Z-~MZrf!
ztS05=r{Gw@yEoMT+X7_<h7VKF$3~tgV>Jrb=mRMB)|+qJyG5FT!88rshX>uU8-{J1
z02EexE}N?VW?^7(<3;!3`eZyN8Dq&S(sPzqDKauJFfpMQP){?k8dX?gg2k9mbrX89
z8)KV=!x;3jD3HgbCYRZ1FfuT3W4LB&HV$LZ$FxBqEyq@}Yl9#IgR~`jKKYV^)fgO8
zrdAbpt52~qFihY_H|I_rR&$CobFs~yZxehl=NcyigSHNOGP>7--JJZ=qU6-#RP>P@
zP#DeI|2W@_oq>T{3_bEc_F*-wJh3t-F%O%&)Q(ASS;fu3uuBEqsHADwjmpeR$uCDQ
zEkUkYdSTVZD+~+_`WUSX_eCg1L1xJCwk{4Il77X`%)ns5jy|duz8I@n$)L&wG(?B7
zHv{CfuRNT*8yFcF#8}Wnf9^8e#+78IpbzGP4Ex=2bFmZ?1H&6;^sai>3LJ)|CgznC
zrDCj!0h#uUb-Vcr76yg`Jm{lzk5*wf4YVXFzNj=WKDi_vTk4pf>#ga*$iVQA5#4=f
z*5fcSB|g6>zMxpIpcrFEU<=23A9+Rwh9!*X86apQcGL0;&_fNBAtNLHSjloSFhpZC
zsa9^nVNO|UQ6knZ;@QuOPP8#HFw9^=AKqZvgVn5*)SU9nl8oZgw6sk0xpPn?T)HRi
z3)*Oy?}c6)p4^MWz=E{Q3ap(MpPUZkiyRCLJ__hL%JL#Evx<|kjtQ*cp1a7Lk%8eR
zMohZi!fsS%QE~>TUyW_Oy_3(|;;Z}&49<4wnPAs#tfr;rl^NxN7D-|$?X7;i$-KtG
zz~IS;-kCb{8oOc8MjP%no67Db`<hu87-})9w5K1i8kwG2Qj%JMEepK8Rjl`hn}MN7
z8-0{=@mK6dm1L*nCqp`VSbXcfIeq&(Mh1p(j8W9{jJ(LLE?Ch9X}{q#ukK=p-W+BI
z1~V@7H1d}jt9h9v#W<$-j5~g|E3+{$*bAV?>J@gZMuCU<;!`Wo+o_;@;QGE|*=j}x
zhLz0d;by{z-LT^HwA>P${+xdITeb`{1A{1NKpv%KC@+B3yn;&TSTUAJNIbcNaRF!t
zryzQrP$7)NFwly)c+dsiXvTpGr0$vvjiB~nGRCsda4D?D6{V)9=0V0Yv1a^9Zci2`
zGBYroWJfPVROGN5Seh4)BUYK#eti<m%)p?*fgY;|6|tHHDnY<2<I#Kyid7an?%aL6
z3=Ag>(erAcDt5yvbCdFOQY%V|z%!ayjJzKkEvwJOz;K-fqgF7+YGg?w#y~a5X?Ze^
zDi0VK7{WngXebF}rzv)GQj1ICK}&N}Q{tgr94yXbV^+Qba^7T&`u>3#R%1)^;QP~2
z_Edu0*l}*&6h$TmhVvMP`B-8#tSq^>BrzTPsHr1+<WpTn28I}n-D<0>u^Lv1x!4!v
zC{S3zW{Xfa7V_Jom{XFP3!1&eKSps(P+;N=76t})j7Eq*F4K|=3gAX#iGhR6Z)USG
zGcf34<StDo9PUdl#%G|z$!iS}EDQ{d7^{5>TyYtQ&%EtN4%LA=z@XI(sH?^}yl|OU
znv#gm$dgxd<bE?VFbHs=4`e*^!(k+NOaz~qXLYiJr!X@xyyQS13RMlpVJ38?EIw0>
z{#*NjX2Cl+&`X5>VK__$_1W<mX=lO^JD-_>0W^sPy3h@jKtXs*qg@mZBf&KhJ~QK&
z)D`5gFfjb&Mju^QjKg6jXgx0el=<w~(x`YA28QL_=zhPHgvU_4?tFCA9MoIMWJfo$
zBprv5pzbC<BRN-JdHacxfuVvG-N=1eIE*Y#%q_@C#l8pyRAgLn)BkP9!oaXg483yy
zoP*cM%-jNOgDjF)&L;e2VqkcL;p@Ue9Oi+R0ORvDD8ax=HPE$sAU+6hY1~+XVq|Ga
zW)9vCWTYv}wnOX;3|pko2LRt<GYPcm8cQjbKVQ&sE+YfOHYW7(nx{2b+yg3TL48mx
zCRs>ygmW-4FqpBR53=m3!)8)`F-AuP)MyFYoN3J*$G}h#%*Y@M3K=Ng()hapi!r5n
znV_9uSjWg5{Z6_rVr5{s&5!OP%llZ2Dl5i3NCK3qoI-`BJ_ZF5GrBQCPq7$No|$KC
zge82KS?5m$m2+Yo=%dLx&rysiFG?)HHzQZQA&DhQgMne!Ec8u)KVM-Q1TqbaYb+K{
z+|<I!z>uei?wSr^KIHa3NWVUaz|xKb-8#8t%cHhjeg=j(j1@DkvQUF`4fRa*4D?bm
zi%WDtO;vqo|A0tOKX>G{Cm^HHFSv!qJj0g8w>r3tf?aouZWj8Dpa`=#3~-qh?&0d{
zgKiM|HJ%8A=HN64{ZdbKGtqDAM3~8Ih|6&(_jaNih<;fo!oX;p212gx4De=U1F8PZ
R@R^~~lY!xSG#>*40|3y;w|)Qs

diff --git a/python/wheels/meson-1.8.1-py3-none-any.whl b/python/wheels/meson-1.8.1-py3-none-any.whl
new file mode 100644
index 0000000000000000000000000000000000000000..a885f0e18cea1d1c32987540dc12d91cb74bcb9d
GIT binary patch
literal 1013001
zcmWIWW@Zs#U|`^2NLsf&>Zb_viy}b=hDKus1|0?lhTPQR{5)MlJqtZUy_Cd~M13$(
zoRL_Rs-K&f2f~K>U`2X{XRU4*JvQ6){twrcJu<t!9`(ddy*uUn&9#$q&-P6ExKyWd
z(v^x++!H6X7`hs;WJG$t-9P``u~r3D|2;R~JUuGLSYm$Rd!EAFz3JkQUtU$MF8$KA
zch`gHvOmv$NdMR=7B%&a#$U6eozc2kWy`K*$36QMI?3<;=F=CCT5Me1*0XtP%({rs
z)q76%)J#b`{j67~Xxa8#9j1<R`j@AhPkw##$txpIJ&vF(hF<YaF&R5`T+j6+tuiXo
ztrzSlkNo^K>WZh2QmXLb9WmK4bF|aK8uIrYecEp{{pqC4o$I&^6IK~IZ<UxeRpQ*$
z;6<}n1#L~_4&A)<lxwWfTCudl*^JT^BCV^gEi!2c6Wwswh<%DoN17A=jJ!>vkF7Gj
zIJH~M45qDg5B$6|VXMOtgHIF1Pe)Dr*)TWNCYtjQ)0ap^d6!u##y@sG+mtd*@R4Uq
z@59edJMMDxUVbXJ;;ixUavRn23H%$DF7gn#xkxiHdesxwP0EU9%4xbj!G`QJRJKda
z6pYB*>0}+XVo`v!ul3=l8xG`L*$`EzJK?&EuWp0)trC`{!QaBJ8SDt<T`gVDw|J7z
zRPLQQ4O0z5qZbI@xTU%IR?_!xnx5(^387hYe&@LBbjDm$GG2Ah%~)ze>LT;0D$`GK
z+^{t-X_2#tHs6uk5~btPs}y@B%hy|XpUN8FyPQR=YxJik#(8q6fAXIu^+br#eYRs<
z5pzwW@WG(<{TtRg6{uTHD2iPzb;Kk}VuO0$surF&6V}f$k534)$*k+xEa`C5*)`?)
zZ5E3-A;l|e&Y0{eI6db~;^yBHlO~ltNjf<DkV^49TaF0sPrSPdHBal;95B=7jPkp}
z`k*R=KVi~}T`4IAExV6qc6#4jzWXTe?r0yL_0tdC=)ZjagS}^66Z48qH#P-DG`raz
zjE&5yTfOSc5zYV+RoP0%EYU3*nOix|Pc%Ah^GH|kf0NR;4r`kaLU%njh~1MgC}GY?
zxY;$`TVRvU+BU0ov!WtquQ(bsCE?tHh=lYF^POI>^e6CN>|%cNm|MZ8*<5?`BF<^u
zug?f{Sm<t#F4M`~;+kgGWUsJk$!Z1#p?l)@{#P~4+VH`tIq2yY(Ma_yVU49dXGLyF
zRzGoN{_SYrE?xGSS;e2Z{P5=os$7wW8egY6uhTzKb-jd<LqPU#>je3o=aYX|_AHBP
z4n87WvAoI0^-ZRiUe>9&oxO7$G-k#w*1OC5zU_gNY0sipArGt)zn3*kJzK@M&OU0F
zkn7cT-I)e+vSbrq_cR&vEYA$p*%5QjOn}KzPgkZq>Pf|Ys|n{$PU7@fdQpO@soD0X
z`|Is@Vgkg378DmvKH8Vgtd*sE@UcV7!n-D>KewObx@1%k%~liOmEm<%i*KQb&ce3G
z*F?0~epfVw9oDHAwD+8TWz&asYPVKBbzd3kxKTH3-`-Ql<^^sm(LcR!U4i4ZombNO
zXB1j|6zf%5$ND3s_sQm|H6oe$Z}T#$;xfaT#a1tlTiJWoseq+$lG}sEqmxZMxhsy<
zS-5wE#jGgN(D`D(#1m%l{PE<7kCtt(6&+^kHuZm)?076F>VN0U_GvBrH_{dMGpK4z
zR9~WX@9R?8ISx5z9c%B$-Hqu<3qIn#QjSBg^yq}=+r{2S96Pg3Nae>Gu?-9|=dQSU
zpPg6N=rKWNheWYOg13x>fN<T!(CJ$~&nS2HDBe@-{7cySU2HMiI_Z<{tJj#v7T!1$
zbKs=s)xGnT|Go**x_WoQBvY6AbsC4FO_v?vv7L5Z@WeL-gQDZ=%VRQJSNz)j>uH+M
z_xSHl&h>Y>ue`Qj5x-RGTGJ1qk0*O8EXoBK-fog`{(JYrDv8GU#5c#!R0Ml-EEDlq
zd*{N(6-wI+_msR_JW0dJQ%}X|cd@eO`VYG|+Hsc1@wKkjJ;r;zE_so9Rlys!9}QoR
zzo{u|Ua^eHgkuV;dHCe#<&%A;^lu7N-KBcrRkLQsiiG@2`TyqZvwV}Z_Th#DPE!Ih
zx2u=@v_G~qxu9tKT*enO@0Tu|CNOt@Q>gukRmr?>E`Rxb^6TF(-@g2M_G<UXn>oKM
zAGKcBJRQa5>)m-z;gG=P-`o7pe^{Ef`Qq-CTdlf#i_B)9&onXgF$vYI@z^dRVC3|7
zxw*Bw;Z~Kkb076L^v{{f61^;N^%oV}Q#%!Np7{1gN#3dVd2&OD(=0P<srIRtdm?}N
z=$r}Ye0kU}CU%`Ai>$`O7*iHy4z+1he&jBRRORxEzO7_1r8cL??wVO|+oDZbF^iZ(
zoSym4d|Dn5Qoh#y%?nq_1M<>8=lk!P6LBkrOZ31Bu2*6!nwzii-C`202s}}FHoMcl
z^(0^UN5=ri-kgnYSG%uXou{W5(9_13t9@2BX6>QLPbbSL>gIl~zwTwBaBjJY*@h$!
zXEvYt-|Z63{L{Xx*hOs#xjpHBx$0t}gWp*N3htUsShQ|h(&NMK`4@{_H>c`U`kmOY
zc!JYOhOO*Q>z*FH-`eRq`PZ)xE$4W=mQGvx=jhM0pm(xUf3H6|!RwWG<Sf-CJHKSM
zCSNX>>GAW(b`bwQ_rzn7oIj6$yeTuY`uo7Z{qC$Xu9YsrwoZnBIm-DOpI2pVe75M)
z7tiBjqEntNI&<QbM`oL%e7Ateo9j6fLa!=ZZeDZpr-D2~w$Itq2gU!LV9)xey4Zfh
zlD42qhDhW8)&f2gQW!Vxa%B7?r(zgwyC|a4=_v0i<L56XY-s5*(X~2uXH!FtX<?=0
z)t`Er&iy+c%Nwkif6vcu&h8cWR&l8{iG_1-*`Si3CA?!+oy$wk48|1;mi_C!TGA!K
zxBN}|*%?fm<D(n-*96}wyV2CGG|lBzqU5DpKm8=n*!ATvo4oq8#N63k2Kzkwqy9TZ
zzFAj)@L|g#g<EsFGmb2};OgXX*CScB_=N4OZTU0Q0-txRN{Ns-oXumMFl$?+%e@=x
z-<72Lef!$Su<x?vt9Q0q=d))f`W&-iROa}a{!zunG)MJqvO{c(lzZBg89QsPrM+5u
zKul)+?VjW2t6l_zgaw)$ozkGN!u43pXC2=>?Wffx+<M$6BG_zSg?L>*WK!xGdqACw
zdD{|8tAA{f+<S_-GY)ZRs0f@Ens#of+rz{2gx+x3oLD9NJ-4*oL+b4{CFM151nzB}
zQ{?kdVRci3HY4AU3);JPZ&}1_P;ji|K=p>U^{T=FbxtDAoZEPwtdmW95_Lgb&9R7a
zXC2SZGtXl;EIaawq3v;KMB5`HEq6nU#^On=H!u5z+`F=eDfReMKUK}mick6{x!-J$
z=Ct(N<+Cx{vG=!zxW(d0GhRta*G1j9_O!%#l5)ud=?hzfmTcUc^3LFG%9)JDShE0W
zaceJ&tLxJb|GINEQ=i3n=Q^%TC68ZiQ)DXQCf{zJKjEH`TnNLOXsdVPOqa9HzGmNl
z+h9TMHP3H1#kn3h9&Zo$A%8u9(>+l_qI<29N&1%)2Mxb=PCr}qVx3w}REH(&ONlo3
z75_KnKV4>f>Bh3^b7kvF+B*+<9p8MQkXhpLA;H%c(apt^4_FqhOnkp3{YqI&8Sjl|
zx7)J<R&QlEdEnxSAAR@sD9-5L?ZsYnC{H`+6YrJ;%X5j3Z5Tor7fcYixJ+Ix{qgnb
z+r__s>E6_-dGh*eww!Hq(^!_qa<zT*yrFo#Z0nC(Q4;G}9xL&zUCwJ|e?Yu-y2U*c
zw?}`c=<f3JG5_<|bIKEyYl(rgcP)7$Y52U@BJD57?ao@Oi+}8WYHbr|{Cd6b99Nv9
z!?~Lc7jIfO?FiW1+rI6_&7D^nzb=t(S~0tM-}(5KZRg%=_nl-9-XFr9vnWu{XaB7X
z>-)FfT+l7qy0<i8o56F%UY>&|b}f`xx3VbjZqwhZ!E-0f((t(D(SK|2u0M<J9&~D5
zQkx#S;$c}q`(mj)DOrP-Z#*w=)z#>&Xj~d_ruUY_#iwakWN)4=OA?6ZaPJcT>iUh@
zHax|3);D*v7D4}Qi~ZN~<geuk{Pj_7<yGgj3ul)oTAz|T@bN}RYW-thp(URdWU)&;
z+PM32Sys_jP41&B<IVL<x7|**y0IeKA$8B8yypD7H_i!fGD}^|#C5&qw2d6c>)MK#
zePNa>Im-N&yu05Nx>Z6*bk~h{2PQAmn90s`%e3Rx??yBI;~Zz!7WU57e!Ow#<CKy;
zFXBuVtdR0x5<J)&;hgKx<8H^Fdq|G)^Q{xC+h@H@$h~c`MO$ypxj=i1S&L>ZesDW%
zadx8jgxK6N<IczN%XjwtG~LF!LFoqT&)BLz>{s5-^36ZDKw<NTYfF<Brnw7VH+8?i
zwCql9OnmK@2Z0rG)9*z-=*ZsZDzL6&8*j+240TB#!`N-}3)2og54eBpn&WvUTeoQ5
z4a}QO+Esj}91#0*(scEoUG2OzuQQG|-^dG@yIpqrwQD)HCSSzUD?EiBzdJcCOI`m!
z!UMnA{F_SaZiJTPSTbF`buI0m$H&+gyAGvf-}luxs}dNw<vG*g!}g0KHeWou`{SFZ
zvKkgWtOtY7+`4r-?w*15p|Csej@yMSyftUtYQIVT*B9UX{rl$Cy+=R&+Wfb^Uv~bL
zzw_?xtF`|5@p9+yIe$xR|LwWW_m_Fgzq}cuO_yyCNdCL=`^TgC@A7IB@5j!ya{a&P
z*(|%x+SL=*HNJ5CEB8QrZ9(UI#<DwaMdzO24>pT**}kj5uE5)B;qDoWGhV;DE4p_<
zg11MCwe5ta+8t7J@AupF<-5I)N$0WsGGX`efR9`5FMWOXk=3*7iLRl$zXV)bn_9nL
z@al2d^9D=*$Xi}3<=e~cu;$kLwv07zii&>TeIZxUG{gK;m*>Kc>|g)QqyC$hF>Fm#
zTv^^aJu-Dh!PozZ(@!lfQ?c`_XZ{~0-2XkW;>!7j^@rXyEdKEL=GC7+%sVdpN`HAF
zXZn==UdIFe?|5%CS8c-+?w!-Wb#AG)WS=D-zvwN)f9A%QlJ75mZhd%Y7f*jr%FcT8
zHwq=^KCEk(`|3F1dcwV<5BEQlGs_G3b>jN|KQF)N9;h&k`&Ur<c`x^3>Hm)A_50r%
zE(-o-_p;&VtK8@F^zyHX{w}GjF8pg5bL-aXo~S=}7`E;?eehhW%#N4rT5@w8cJ7_!
zsb!P7LZbiM#gg}YH`Z5~3ixNdY<BOJ@|3-@y=>FlJ-lz-ep}2vbcnD2diURpx@T0c
z{9V=i?#uZ{haVc-PP^)L`E9{TPwPKZzwqs=KObrr$8%<7kd6HOzPxkys>5f6^LzhR
zVxIkG#?Hgv{wlYvyC0D@Gf#~B=aGAJ=iXf4;m2&P=9cDrFq<v=P`CDWiQ?M(a=n6D
zWu?~D);|UI?ApzBckdqcxJRqXA9~Jxy#B1(o9yke7N>v7Etq`#x?*g@%zq|xd-YEw
z7<ltFvhUWlmVS|#@l5XI+n0Lt41P0(2()<zZg_v(eEMU4K_T;hOgxcSH*9`=n?uY!
zj?E(G!&a7TwjaN@FYZ3sKL1z7n?Kwe9BU>dJlTKlX;FYjGFSFezUgyyKd$|-dB>cE
zR*Ua%4YHp2<G9D2@Mmvp19xry^;&$<uhg9xFTz+9Y;N+E{#}#1IFtW>;$gXeJpm!>
zZ%;Qasnv+he$J75KCD~%Rh;A2H`y6EBBd2#0bVYer&m3A*u}l`$@|=PlZ$%m3oTtH
zv-RAQn*CQnwS57jXcsr*uFauedK>$a>tEk*pSe4G`<0hd=5Am6agFM!&-Z?(XXPJx
z9rcDu(8-lk@xnt_8NK=%zR)bjH$L6ne{Otz%M)lNp2jYa`sA{LY;5v7k+{Ph>L+A0
zx(`V+Mm%%6$X^j1vg(JfNA=yte#>3!p9Wsp=6Koev%JA2#y8(GdA+<8vNbe$@+_;`
zxvPC{R&PBxJ%IW8yZcVx{<MS?2R7<h+6o=)71;a3SAAc}TFuB0Qe0f>z4g|UHmxW=
z)y;eV(vNpy4Wb8T`Y@TZ6*k6pCuQH~JsRG4POztb&Y2q}X0z`4tu;8{bzkN32PwO+
z&F&|4-}Z9-V0<;V-nD;Xx74u@m$$9G8~LZZzu~dP%!F0#Y47jduYPj;{ujMhMpk)$
zo}3LRKep8IUDE}n1<gLklg)k^?Dd*7)$r=c*VkLlTw<@>x9zc%T8^>x+w=eJ15n0p
zqSngI-^<9r(7?>V;6-5UrXW8jJF`UBP(LxbBr`v+SU)*GR}VanlT@0SlcJZIS6q^q
zlcQIVpOcwfIXB3=f3|_ZzR%h*_Ydb>@eUOXyPKlD_KN$GG=5vf<2(k^8&>8f{QPce
z=;_hFw^HtY^0CP_`^-&WUyQhvb@=*6=JXXy&UsFi{#W&5*RLb;mo<KF_`TEi&prFi
zVb@ha-9y#e`|WD0ZyN1m(%?zz`}U-SdxQ0xWygdqx7mN+{8sXU<ikCDpN$yK+gBXX
zetzpb!(oFX+-(uFh1TfZQQ&b(Xj=LyOZK_m^LsapX1fU{d-iKxSF;T{v2XF$EPvUn
zmcLD-+I^Xde_oqey39{q{+hJr$<Vuo({?qcG0CgvRKzWK{%`Z73C}Y%?icWP<TuQi
zQo3ke@?}js&!1`bvrMk|b$n5sGV`;X_oppuOn>n%O}6cPVAZIq5KzIW?d7w-L~e!5
z$ql}n&ODgk$Mft=rdxPX{ESNB9SO|BKU-71OlE9j<2Lzs`r^7bdlp51P1-9E`!<JT
z`N7vw{4)cRSCuerf3eRmD=MJBds+4?`DGJC>el%@;a&Nr<wo30@d=r_-o~8)Ue*sM
z%q_T6P;XvdF0$@$ynoMojmKd-x|UyvWOfg_(6{c=tHsx6dj4w<p0O!j-{X07WY8~<
zw)`HU9ric&BN9o<y6sV0wmfRf<!4}s(_vsxLr)}`#U;9#d1?9jIho0+dBv&4`p*6V
zk)D3;ccY?<Zyyt_`@a50(X!x7wq<ioGNqq)ZhX?V);ZH<XP(;RcGV3E+u1gp&{OF8
z`_*>(-o_;<<-fvwmzjFLxw-lIr@8Ov9OeGFbHA(p>A6DhOIKPgkF)vw#C}TYt&&Ht
zf4+A5<6E|P3;V~fudm;?*_mO^^LKXm`ftDg##}NhPTsy=>fWinRgK*5*T1ie>OT6)
zYtP=uSl##2%~x-&C@)sGTeF_Ku)Maqy!h)w-MZKd!QrRB{=NIDo&N_f=Z`GCbs=l5
zZ5xX6{vFCT{;WQWbNggp<tSBa!vmh|snO~w;hmRCMAr*#-I!FeN+9g(wUFe_c=0$9
zyXZ{wh`o{@s}<+2DDV#LJnOh7^rX{1rk~e(ZqNPUH$%!UqvG6@<kh<#M(8K|i)j1S
zZ>ZWW-Ey=16juPJ*sF&MPb}W_T>Zc7@18lu+HG@XSaNo46%s3pt~zmBG1wtDRe7D~
zmrkMNc6ODwQzxi;az-^sK8Vymc7Qp~aji@~FPrR|OfJQ>T=G&uyAE7_usu2a;HFDk
z*1p`M@_)gN*NMlADh}_gNY{CJv45MnfZ@qi7atyUH`Y&eb1!`46#pq`bNDuf?~xyb
zv=&<bD_3Mw_TuzA{(O(fzfPS5S8eN^p)YLiT<?8)PCKmQuiwRw2Y+u_uX1x|>Nlyy
zoJ(RdF0|ZvT(-;IbL+Z;v-WOM?b`R_+t>H{nbyqD5)ZRGK7PQq!Ri;oos_BELXJ<|
zN)uXwnzhw08QV@iU2pc-C+0xZpXqaBpT)KRzo5pyODb@hXk|?W<14`}SNTL4_eQ^!
zVYN9bsm{3bsmhgW8=^TiIbL3sbC1doUAw0B>6dI@vHva6Tb5laF!78Om07cUljKQ}
z2`!6^n=?vQ7nXlmZ2Wb@@ef5?6fKrAy>7pw>=?&mAJFn={nxTBU#xd54V0|8lk<;t
zVZo|hZ}|Sm?nutju+Pel`myoONxm(7oJ@fiEo*|>8W!bC{og1Sw4u@?#?W@b^uiJ!
zkJ)j_PLe_A<cql{GNd=GS7$$Wk=yUrffsKB_@3vj*3vy%@ZxiFy~(%BoEmQ)dS9AR
zz@e<WwBg+$!z88+FaK<eie#K%<8k+duka`P!%LYiiZE}OVmBq_NNYo00$YW}A?au?
zxoat5mOK&BC!8Fk^&c_uEs#sSefZo4fd#UM=7>L<+`TV+!)Ilc;N)-9PjZEydd0rs
zQL|8nfVp)a!=1-_c>lcItFp~8phj8NYW?DnH3j@VbsciYwC;4>Y2CTu{>!52jf@uA
z4N?p<Gp{zQg(rzLXV%Q)U==ent6>tncec{3GBM)mlx7db*WNeIm`oAb;FDj<zI)EE
zKO+6iepe@d(Lb{B=bo<yv-ZCC*t1?LY-`Z*KOuX!h-hYrTe+=Xlf^fI{jR#v9kxZR
zkC#kdyNk!~I)lr$X{w@~N~<ScT%qo@uyo4G$=B~IP5CWVf9>&cOMzgs+xk)$)MHjG
z4dfRw`^b5;;OR_{2`M+sws6(ed;L`M?qUqQf8d&LL#}xqgSAZs%RR@7uCpdr*@<Q-
zANnX9CAi1u>ARa*6NN=xQg6vUu3da!hUtt)nV&wTUX45RXl7cR*!ABWr#E<*PH4Es
zAR+#uwKqqj@0-~5QWv{p=c3~i#Gbf?pA5)YesF1u;_uy$ZU%{L)V|OB&)bSo=@px}
zxr3%-RM;jZ(IR&971y2$@R^o}L^ye^n)r{i%s$L6O?zVYQ#XAhiJ2~rX}MdZ3+@z^
zggnhWKJCM$%P0C<Dps1TJf6_<GSb=RP+-jZ(-(XACT*YkP1tF^?;DK(y{BKcDZgnC
zaFL&wc-~E^>1qz^w`oe}ul{^v(%S!{)TZpjf%8H0?lg4tzrDCDiTzZL$PwWHH&+in
zujjv)sFb|gF8FBq!CY_VZ_kQ)Tg<)f*%qyT{%F0&>Vn(bKmKTp?EHG-=+)z|Zl<Yu
zZ<d)V8sa%o(nF!8;oOl&9pVg@Ex}BOUteXI#`%!_!u62q-k8P4cfCLDX%>EbeENZ^
zH)7K2#S_jJR76Iz&NmU*%^s{YVSY&Q{r?Z!7T#_WosevM>?7wTRg3q>dDpONJ1zLu
z+v3oFzu{a=mTc|gPS<<epPJYw8BTmUS@!&t;zMF(7vzoE?|QM^{m=Y9=77;v{uv1u
zig+588k_p07kOX&9BKTXF_t~i`sad<r>w0j`prsvZTPzyvKZ=q)-wk7$lfp%WVZ?Y
zwq`<t+8iF=19n`yPwmU!aMwiEV(yxr8&5;ErB@!j_a~>!VuKRr$+gmjo15R1`bGKP
zjEr`ef8nBrY*zfdAL8$XZY5mSj2C45*D%o~%>Q(scnfo3`|H)ZE6%IrubOi|sec{E
z);zswroZgJIq^;4O182}y$~Jdn5X*BN8!2j_wJAlO53*`+c`bOz{V}p?TP;%NgI7v
z<?ne{nB}$xM(Z&pY+O+Dh{b)y519jjz6nR?=5L)m$H?-zK%eNJi$cMyhCWA^O_b0G
z&Ty+;*5ao8bcTLqV`yRN0TI{ttq~LT1h#SQ<2fk4miy8M|1}a^`(}1qPxWtmwxv{?
zpYvv4AV)y}d!F&Z#pw}pJ6ST7bIh1d1j;BbZv1b)QOW;yn%+Zyg~*9fibft>Yr{0Z
z73E63=-jc7{Y{ndt2eECo=ol&$c(-se)Vx3^PN=>J2;{&zxLi${5Mx7B&gQnoyxxD
zMpEDIq*Q-;pca_<X7Psl=L`Fe3N(FlESFHfW4kM-x@CvNB@N-|@4AxC8|S<{m%43p
zD6>k0U`6q@L&4<?QnK=Tw=ME!FfBU3<9&7Ghl{ZaI$>Ou!4oHPa$QthI@?~lU*X(~
zVxE;hrq7UGoIb(vRA?KAZiu9f+N{aO=lE6@eDw75{(2?js%lf%m;L#FE?nJw_3YnI
zZ@=<PdS9qeoqX%3?S!KA-%oB%bv!WB$8w|2Pi<k*D1T17DWYFzXuh}-xmiiWbI#|q
zB%2k2Mjsqsa2%a}!&JEV-l6ojUI*EXq*P_M1^=9KPv7$<*AWi0THz~G9FM2GPFd&~
zvNOH(haLN8&k0W}ZDk!eW7X#zoV3$d^h3zLjYn5bO?^;xbIR%OZ0T!4<Wso>IbJZ_
zj8wP~rvGt5`-|Cp&x<b@C~pi9nswo~Y<Xfw{PMJOe|(=bM!&Rp(k!QBy8cAKvR6Ou
zC>^o#N&CDp=ftW*_0ez2KXsg0!g6(Q>pm4>u5J66-Jhf{s^dB?9lCT^Rt|ISTo)e(
zv3LKQtosdnd1Tro652MObh)hcV&)9?8y_wH-7xUK8$HJ~@Re4_wo4o4aUQt%K)aZg
z>*Mnip~oi9al2-fxHDa%M(XX{okmH9H)AKRJf9J~WXsBxkv29LyPjO$Im1hZfBU&*
zm7a~0Z?Ezc?OP+Ae$r*BVV_#^%o{6ZN|}V)YrN0)?dN<DXS&hBTwLC2#iG7B%j6Ol
z2POaZ7TU}`$>P3+%;pn0Gp6=#oF@~jx~$(?j=yNetK3g7Ki6NLRXNKwD~<86(u`eU
z55G;kzWz)@_oKJGSEu(rT*h;`%=@kEG{K;=y#ai4R*A&3Bub^|eUvub{eV$3!f=~Q
z^oy4oANcK@S11SfuR5bJufbgE$f~tlYSx$Bss6FM!Jbisjp>nqn6X@}q|>=Z&GItk
zmbUNWSw8WHOxtn_^TZ^1{q|0&Juq|Me-5jk63^P5FR=AGFIi%Cb=7^hxB2}W7Fd7a
zoK{k#DN=X&(N~i!<}kK<frl9PYA0Q8oP2BY&zuv>9+=1To}0q3?aKV;kG!n2=6<-e
zO-#PAzA2W^kaN+h+05n}u2d#>Pfcjp<8jt|R+H$-M7!^?L0_3lk1jk|*gea>_wnh@
zV*SE(tP|{`*BmXf6}H#8cDmHy-SMY?`_1Lw9X)>Z?%kx){d?lNXYc+K_3zo-h&6R$
z_3`W0HN4B%$5?md<qB{0i!IurW@^5YF2zBT1+N%<^=5WSDOGcAOgQuV>EGY4nbz#9
z+8MKVcl5e{RevvkeYH=(KKB0Jzk*w0{%ok(zvur<rx$lW)s^mjcAZ@;?%3N$d@|o2
z{(a<kr*6mYy^-<7Tc6%O#Fj7S@L$gCYRPK{bK^Ureur6Y(tYzyFBMxA@Lp`~5BQ^c
z<m|JhHn}By7J_o-2ey{Ayg4_;YTHSkSO4ZsUAFP3>+4M8(;L4}x2)k)JL>v=>zx;E
zdgrG{RI*-}pQm6O!B%ti!Uo}z7C&q0tu3>4I2I_%OO|Ba&Pa$~x=ZI#Zn>f4(_<&k
zr$7GN)X8-2i}YSaC-+mig>r)Lbq`Hr-q-lxMcJR4I)f^|Q|x@HO{b-NrGIxa><rsh
zWIgxc<5wTN9I7l2eC2w7ZS(DP4-JKFHB%c{+R}GbC_ZmxYdJPk`bF>KtkdPsB911n
zJr@1=vD@@DmTo<gKc(+hrl;+g<<FxxZ?7<a)WeO^hZ%R9F1z(wZN6+>)1sVTagU}5
zSRU-?x*lY{_-U5P?5a0HI~OWdJo6RU!+PMs*|!I!wb>h+3p-f;RtP*#J(9R<jhspB
zq-+1a@}6MGZ~0KvEPh_{!`&DiuQi+*tqps2d{z>DrK4&0Zo)4A%U^$N`f&60wgXP5
z=Nj6uF7<r=WYgTVbq8)|xmGX*xJ#W{7gEzP@Av|_zkDL)tKNRNI>|&Jd9#^gd7@eG
zd?&&D%GM3dXQr=@dSEj{f8YK~jE>389~a+DRzI>f#YEz!vGAO8?)h6ve9NSTEVu6$
zTd271zf_~iL5-K*KI(TDskr!0UZlhG$48=CE!NmB`B3q`$+@pGW_w+|u<ip_!m+C}
zFYer;s~D(o{bHBqT=(qDxija>FsnI-_np<^5A43Y^W(DzC*7<rFzQaokvjRuuKQSz
znOm$y!}{>>i171!+1&T*=jA_~_|*RX0`ANxhK{Na>-C?kfA=td$tk;gst51?71z`F
zlPz*N(`ms~woS*Jr0rT(x=pnD8MS&@5fc}SigoipwtP)dmuGLL$EOSa$S``i`mQ32
z@WNH^e{J%s($ib#^S%AYK8I<G9e=#nV=aAsWtr6iaRE+;kBjB@S)VvnR%YJ4^ATUe
z^Zt)YQ)X3#F%&R~nepkb_>pO^&a2^fzUYp_6vgDH+qyH-<hu%YMBQES<rLT532eSH
zdUG0!Om?{O%u8H5<6h0L>G1)+95%A=AMbs7Xm7U6`6Y_&Tb}aeud$T4l=?`Y{m1Xn
zKTcK6^W3+u*?;M=oyV#*>9gAWC+-)}()-Z(<J{Ay-!+uJD08sH?ECY>=0e5YpJr1Q
z7`lZlu}~`go92Ak$WroVtHU&Bj_>F97X6aj@jI*buTaP`)%Zgf=0B4AH`iEXa_<$t
z`vr%*oBuQ}m-zADV?Xmpwasg%&RQYRG$(`i2#?I#+kFBB4x9^gN{;7$`<dza==HlV
zF`vc%Ga@?dpcOd`3=9lRAcBE`K@8Sm2M^Nd$H!;pWtPOp>lIWoGob34y?EaWH)aNg
zDt1g=1&JjYIhjd%1(kC{a=WiM@cg?MFZjhd|NP!{>$-L=P}p~1VG%nQSJ9Vcxw~X@
z)l=j0)_45Bd&Z~y?z_2M-@I?neB$}Z#`E2w<Daj```tS&H1*)*%Un~ZZgtt)G<~mz
zv`u8%_sP3Ibp3KXU7DO&S^ty4&Xhy`!h|NS^&6J%OSa#ju}j7CvI%3Io#`b9_o>-}
zJX@I`Y&E&opn7A%KR&0)!J-^5T63c!Q)V&V)^0hpwlU;@Mqsp}Xw9@$i+UN2CA#NE
zsy^Jdahv(-qe;5CkGs|^$-DS-377h9tvbCWhJ0rqo&0q3aVI~!VWj<ywh*@}*|&0b
z6~8hhH~Q<&Xp4zH_;KSSsjnXmML5nSuui=aajWdagOEbIMYEc>9JtDrzEU`B+M?Wc
z2H`j6yjnY^#QNXLTfO(ow|{2cE|u>$O_W*Ll*Hh7&tq#F?{u*Sy`5ilHf8QxrtDF5
z(16QnsqE(|NAJXkP2DnS%K0R|ZJd9UzxaJm5m@nT^Zi>VW=~?7;?WnL>@!iM`^5gO
zdyYLYPGj5}ytMzg>W1>0T*)^aGI%WJu;%Vq#b%oJA?)3yq!UrUo^{w5@0POu#4<ta
z;_t@Sy;t|GUdG8<@S!q9F(u{yo4Nj{lzvaVJTFG}(w@&}B~J%r>uTL`-Zi;3ZmntQ
zgy&l~`z6miykc@d*BXvg)srE+-|El2>#CjOJ8QT7dCPpaO1^mK6<_8Ap1-L-_x<0=
z6R)?oC-?jJJ^t=GDJM{(+*<GU;*_R}j19K_d`>bq-riNQd6yoSwNGFAT2lDjk8{r)
z`Q69m95v0)nEmTHrEcablhb>i{mOWD`?LG5&KEDwhpy<p-WhP<%R9Bsvl25?d6M1;
zeXbOX;F@N{a<;g2wvD{w3U^(d%=;I9>&b*Fcfb5CSjWQlEV<U6Sw-}|MV6R(&-*Zr
zys{S`Gq_A<AMN=YoXGpQ%gX4+wc-c&rYwzhbi86TKi@UGfK6TB?P1++HpAmvcl@uJ
z_vYZsf4`5vyIub;o&Vmm|I_DIM4Wtb;8kKNvxyhOv9J61H^~+^ZhrpJbautV($2lD
zoBQ*(sQq<6vVf;>(Vuf7=5zmZbe&1#+{AM6^M;d0cX;H_opN^yOK9HQNhez>HoskR
z|8`&1gJ%U>4nI75ai2#WT7DHj_Wbz?CI$u<b_NDfwES99S&*5R4$gSDvu-;G)ZSk&
zF^T=QLidDk3nikYZnaAVNp)m!D|T!xOVM3ZHudgQ*{}V-r2lR@w@&5wIo6)P39)JC
zW*Qs2SMzN*kFP(!KDF`I!y3(i>PW9G+&i)=0w4Y{+MDqF!%>sDQ(vDt{PgHk))di0
z<t1*-2Y9tEUuj|P-(z>;?|1WM=U=|J)!FLq>Udk?^j?!$8#iy>JnyJ!M8Hj^n(H2W
z+qgoTuPyDVHTK$Z_<DfGJDFW9G0`ChG<}MumENt|7gUklYu*}|9JS(5#Ju9ApJeO~
z$uj@)J+{U3lKuM+*Dw8yop9G!Ej#E9J8zHFpVoi^Ue}{vrB?1xVNJWTV{O1;v4fAC
zwRN2?|Ln4=nO>K$)b#6wX^$5#@4PG`!}BNE_gI9R(eFJbuciK+d|NWfH%+9|_Tbv>
zBGQbPKc;Q#Sj(ZKcz*8oO1sh(rzFqVGurAY_+FN6{nPx2cixl8#uO1@N9U<+5pJ8p
z)3-0)efk}zu;Z34?TllrTlrW$q*RuhwjR8=!$RW`gVajb`%%40jiIj(hAs<b+VXM3
zp%bEBRU(<^=d|hye0Jk{v?#V&bFqHblAn`XUrao#tIJy2=vi=9OtX6(>(5dv@AmAJ
z*V(%reVuNl6wC@rd;ROsmYoe#>x4EjiR=&ynb>ZA`IJe-Hm_3K`Hxlkoa!?^v22eM
zTl>iD+r4OyKEDT6-{NNpEcFjK(6-v_SL~#37XvT3+R2$4#+Md%tNI$GXc(oPz8+E}
zVRhTM?Muajp2Y3mRcH5Z+_Ltd2IHs7j#<1>sXJ~wj$Ew1s%n8(#zZE0@sf`d&0a_P
zDHnF}EvYR%7}0*JswQ#E^Pt`8Oi9rWVjH!SuW+|4Wj;OWW1pNOfAEU$f>)k)i|8Hk
zYg2rEk-dDyzZq>G9`g2S-?hzt#ku4o%LFUVC;kj;{h4I-^V_w2R{zy@tJt~r#pcCE
zk5_)Uqse~zH$Q5nldvF3u26u1VX+BD(oZZ(&&ez<(JQFj8}+wHdb{BN`TmVwa}^~g
zFYn(nx5c>VwMWsZl{!1O#i%Q1XMEt8w4$&5^g}<9$<G>pN!4z8r`KS8hh6iu-)YIq
zS7bLtywNMG-`!pN?c3Lz{D-+EyCS+DR;WGlIk(iq{f+CP!%HRP*xTpUmaUrPt0jKA
zM^;`=mcO6Bpa169pbg<pt7n`&vbQ5-Q`1Qu;hNByALiE^%k&lROM7e~EV#!<c<Lvg
zRXZ-vT%L7QZF1$jrz>ap%!oO-yXT`tm?ZDTvNJaQhkaIh>{bk%<?ocTDOtWntIH+h
z*$sE4bK&o{Yt37BbV|<T6BP${q+OreH)r$f2fvPAe?Iy0{(1BN<<|WCyW;Qz=hN&H
zd)~XOy8FMcd;5vh3P=9E7Z*mU8htu8_ZGYCguV)ag+0%^JkMGbJ4dQ4=Q;B8?(NOz
zcAx&pZ|~=~K5nmE{G9zWd-T_zzaO)2$BdYs{ne-aZupj8mEDln5%0OphjsqL^N}t0
zGu!Ux^}fqpewkBwovF3(W}BA_J(`Mtyy~|)^5NdSd%soB-<aEz?sL|0u7S=ZMbG)I
zHfg~J)3n5Nf>k%$#J)Hnu;bV9pR>&$Z{Gab+bre%bfxG=za`qAq=-y&3%}cKGSzs)
zCcW8t39kju^Jq$m3z+`d6Qaq{xqgxd&y5dno?aC#FrB{f0#AK$Ldg%l`llPe+c5l2
zx+&BmRiw+tx^=4ppUM304CYhujPeG48&pKU2R)s&(%{VHkRuBfZq=~;kI=ccfKPD2
zQt>S&@th&i)1Eb*ZS<9F542;BvWd=`#hc|*xoe~UHKXWF4{v;^N!-S9>+kQ~#RAv3
zcNZ^cmkK!1;O9_Sz?Oc(M22aKOpdUHq`};FZ<A~Nhd(F>XCAzIJW)ybqhZ4I1DktF
zk2OwmOFd+^wSddvsjHH+<_qhYDoJTScJ7%qXYTyH)wx&1jc0BYJ#Vz-p6QFA13@_}
zuYEAMx4~!Kgc2VimaY#4W-ZQvr#cQ_3$_rcJmURy(FKQlQeSz5R8^0bNeV5ww`Q4^
zR>y$=(Wfa*LM86Yd468-p2wx0qG`h68p*qOLs}BYwb!TBM78D~lsfQEtAOqP%6Gq8
zWPf#8Cc2j%wo5#I)UwE3a?A4S>jzicJihF)N7VjlhNHQacmD5V#U;CAfBkoQ#gkIP
zo+HG1$&8~<pQWmSBX04gKZjG_C?(`i*XmD8VTn4^ajS~6Il<tC<=KPx8=14unbf_I
zOKD+S7do%WmF3M8oyHR@TpEPgA}4h=O-SiU>pml~@>1X|%>+SJX>JKFxdYExWa@V*
z3U6HZz*VGDXHAjsGj1`>pcqd6#&aTC0#kndefcsVUHXQ1zQoz7O^fa3oh&)vBKECQ
zrqA8Daqm58u9-@^yAR5I5Xcv5Y!Vh=^O9`HK56Qux|!Yl#FZmwUVOdD^=Gn@lY;w<
zZGk%zO&rgD*kNJ+?Z=dowSl4YCfdDy_VL5i+3f0%ez+#9@BQAQ^4vp+-(t>zifga=
zBNXI}ehd5jx!HNwc8-lRYs=A_v+{c$I;?4n$Xv_uB6mjVntATpx+{W<S6q8-U;j@g
zBS}LtuHlVg3eRFqf5o^d>*vq>esWXA|IOd+JX7a<-H~`rK3w(1SrfCMjtt$4F-pE}
zseXESWqD>#mHMmm{%oJT^;C=Cfshs%9-*yA8)dwzADoVn`t0gIHT_u5g*9_xg-wfm
zR`zloi&fa!6qw*SiQQQ)V7Y<e3a+c1tWONeZp%-$xoP}4;LjVmS@Q24(@&k;UFtG5
zAlYx@9kWw;Pr0n07L`7-j#yK%xi&=cRF0nf97!=Tj&}Zg3lbl59@)(Dpk>L-8|{9N
zemp-CD5>~`>4xJwVLlguJ57b(e$Cw`+AH0dFQ=&EsF4)As??(OtdHS6=1n~lXC^Ol
z{qXF^$JV_Yt>)K%ib#3(f1{-E!f(1qPp^LcS@5Q%#rBY=-KhuSL<&_K4>KK@=U%{d
zNn)?q1Le1TH)0s~F!)9Wo!0UG^5Q`Pqn*}#r3tnXif86OGnzGXKD(!!D|`Kq$J^uI
zKVC1QEdNF%raywee_x}_L;v>p`e3i8FE}sRX)Wp1-^H+fc}CYk9i;;4jMRU3c8Kq}
zy?xI9N0Nt>*^=kHXG_?qq);|tCG!kMGyeSM!w)npwrpOP)ZpB)UHU@P!(%C0CuXy}
z;fmd!=G`aPqS$ThRu|3e!TCpaNs^*mLoG+QS-_V|dGDVcKG@E`{r|5Ii}<x!;%gb)
zs^ptyAAY!f`}tq>dH;X@&T}=f?meBuuJFO>h{#R#8LJ$QL<dVK#$A@^VVGvVBjhQc
z0q+fwy2B18R^BhQ<s463jJNbjU9hBh`-?@pSGKOc)BnrN#XZ$)%lUQd&#iNt)@0V9
z=6O}5;BuR!#kwh-m0O;*eDl8Dx;J&lZ8?^SdKM-=lLYi0{TC1`SM~a~$FYrpb6HQS
z*~~9nI-WHv)hyPze{{jV+3T1~GlJ{<uJ6?q?tG-|IH}`j!N1TZg{ki5*AL#XQ{(7}
z+SwwUyHKI7;G>dp%k{*G!eT9o7c$r#s`6$!vKCdb)W$VcPI;|5Z;R)mk~H2!wck!k
z3LL%XyuW`VPpsMLYp0Z|WLKIVO!>fN@@-+i#s)W4!w*w~geJO4m$*Jjb9imC`aHuS
zM=`lvHqrO;(r(85Gk@P{HtFj1VR)A+W7M@pYv(7+Q?iDpoKnlgst^CH6<((sEB!A}
z*vBQI&V2h^t;h)ym#m%jpK(+zZAoa;w<(<Esqn~3+<g00!;TqWkGLN5+#&MtZinyG
zu7nTX2W$_qwoG4PCA6CDeN+1329cPf9pV$FS%xhYc;TwbHDim{Qn!C`O8PzL9#l+<
ze_ZUdOYOn`vyR3mw=QYw=~WjnbZe8l8mqzEoZ^tNvx9d{?CLM)J}b=#zcqzvso4RO
zsq-Giv!o_6rPPZ}H<su;H?zSk#X*a^>u{8D%9Pakyz?jXx&I4vJeoJX<m$O+OE*bB
z-<cL`-oDuR%JSJ4?Cc!h%W=-T<`=b5DC$JAx8;NQGcWQZdE&ONOJi`%ytpyqy@B_X
zl@r&ArR>XhHRPFBv8B+__={)y;yK$&Ta(_{g$Z2zA8^c5&FN^HY5%(eM>Oh}O3Yhj
zQ5=|h>acZ*j@VLZjl7~@tv3f&F8UClnI!7{NZRjfOIWl)`@<ueCuRAkKdO*=wnax^
zmDiSqHUaJ4pDTj5UJ|?gAtSI*PeYr}H;R{)P2g(nrlaqI&YV_s|9<AxY4fP7InBF2
z?Y&!|^6X~*mY1h4<y~JY8@fmJ>690o*EEkX1TSPbuJ2PSRcN|KJND};x%6+Miw*{;
zsxAL^!D5!W&*wY(N^06NMHxG+3Og-rKBfF)n6~}KeDU*kfp3;s{dC>d?!Wf3X6E;7
z#f!I}a-PdzIn$<p>)q0ARxh#ywrKD&O?J(E@=13Y(-jB5C3l|KT@YPX_F%)^17g~m
z-?xX#{ZQRvc9LHs>{!H#IiZ!eyJq*~t7=?a-FcMjjsA7UcbY*AMRGsiG+(QGr2OsE
z?8VCYhq*Z>%#08{5yG^lN+NN`^1p|dx$72xZ1#9_GUgB4n#>QY4rwi4`{k#_e(RIg
z4tzoqGq&cvO?qajYWr3@Klaz;D>3YhN6x>U?pe{D@-=KJzl6&MnFZo+mLIYCU(8*h
zwS39+rt49UKC|pA*SnO&d2f<v_6oJQexnVy<!<pZ?h#$vtFrM8&#R~-TB50C*3<dd
zSobAPnKRS&!T~+Y+=|AVat8!`ygpdEDo$XTaPY>J)R64e9Bdyx2lsi1%D=y-GT~n4
z$F@d~Bm2zTSlz!SGdoM26TDpVUE<ohf4&OaBMxt2v->DhGmnXRH(TKL7F#}p8`GoT
z{F+(zJve;JCWoz3L3_Pc*=KBU>HZcgve0R3XT&qdi?`mb{n0$lzFT;e%9L4}iqR5@
z>!#{?1q!avvb=x$cD3`HK;!;f{2bx0&PLvrEj@Z{feXuHiPP>=WTQmZJ$$pCac!|n
zrR)C9YZz|M5)gYWJMsICk3ar>lI>1234fmOcIS27r*Yv7*2~^6K3K5AcwQQNLuebf
z#9Wap4ZJ4`KZl&I&Pro?#4$Zie4|5!tM2)4GO0IDe@bY`Y?zo4GyT5!e0J0BXRd4i
z_^zF0aGEpq0oM(s!y+?oH!hnctt|6(MPTW6k4x!OA4y#_xtpu?cU__E291a!C(b`d
zvNNTMuAh#PZc;lv?H0SwVdJcMhwJa}t$1u3A8eVY%vv-1Ur2FKY1=3FEtlqKO?h!=
z+YO#Fwc`<+v{xQ%>S7Y+%PLK3x$t#++}VAqtlM_BWWRhDbxh=CVJE+xVui$ngPB{}
z<4*7Td(ARoUa#c3w!8NaX3hNeX4=WgGi<AjHm4rkYsuWO&ocU7!K%E;=WlMczU;NW
z`oyeBcGv&T6#8_;Y+_W6g4j)|g{xfCzM4%D7e6&`<7!Fu*;!xDJ-W2$+9UaG!KVrw
z=0A8H^IWF;1MhsdIPEDbcj_7{moZ#yI=$*gXO6B*A@8Bxe;RHuX`0+s+{JKSx#~*K
zcjx&*%fqcUtAu{P)E9KQzDuAenj>{r)wkEOlRuTb@0)(9<?gDV4{B!%hbtfd5V7az
zuD9DZt~I#FdQYMMDYNVX&y{{>8l-2+WZh9YEgZamTh#i9P|=nhWg2yH7eay$>b`p~
zqIfOT^W(3cy?sr$78;3e4LjnjF)3<hg4g%>J4cnY){94pM_O#yCwh2$=Byuk4+ZgW
z%e;5&%VMjb0*8dJ4p|SDUAOt*a$u^&gSULGR~aYRuMTKf=^Y~aV0+ZIC6a4rTdPMs
zbrlF_)>`1Wa`~e02QN<=uU`8r>+)o6$0^r2yc%!KP7+%?BUa0*Ol;bc1CMR{H=n;C
zwyDYb$X!vT+sky+6X#qI*}s>E(R!ZC=MMcZ=^0ALF4dVVe0f!<<jSX>cNcS?%iOkH
z_bj#SVusKn={KJDcPH<jz!dfNrR(<l`PWYIgrCz&-I{fC%d=l%(P~1Aw_SL~pDX)N
zMChhs92cA8;uHU4es9<Od)_;GTXjs$=Qk~4Ypf%5*nf%c)=%E>$VJgE$^L+Rmj3S4
zKj&i94;o0dO|TRR_j{32HNBLpC_^}{Ec4=Ry&na8)}*})Yw9skd%0F8ZFS10D|HKV
zLn>=yMJ_KeYWF|vlu;UTR5gX=`h=)?$&Cxl-!D47z4VpDXSR;)rcjr2RXZNt)8BDn
zeRXY*oaoQ%RcvfUlRjyAzu)|Ek7;B{V%mW;u6(zf*}1{hyRYr94!@MOJ9qVqq^Wz0
zz0Eh?-5R}%vwiml{aIf!5*)Qw?74gE!H30DLjBfCCpKh%-c!9(zW>9quWT~QUdCL#
zsh=mn6zK7s!R#g5PN7%Vwcjmui(y>)amCiH9r8<*9>-kybNzCa-fpdL*E4%}WS3tv
ztQ6LLaD3i;ukID=CY6;(n@QYaaKAX+;NKLE+gndLUUd`fNLqMe(~DmZy_RsdY${Q%
z)p{0j>#@j$11}b@c*n|FRh4J(_x|sfZ?CGxtbe%s_JP8)<=ykSrmg&CxG7+NP{Hw@
z=ih=Yw_acAkdSru0Ke0z`Hl0P9yb<mdQf4MvvldBr)T$8`o1`GFYf!_<<G4%Kb_+?
z%<W{bwlq9F&Hu%{*u6KOx^0bdTo`;Mg=OcxgAUvucLnK%njN!V@*;|1=k-eykAD`B
zaWF4UJd-PX);4S6+btR&em~Ql<Q32NJIH@^?>X&d_kS;4H1Gb>{d_m{O&bp$uG{`O
z9(9Z&Bjet~>6Hu&^AwmEgi(j*lE5n;3o762{ar47e4@sm-T%7`f6g^_U~%ftnG~Bh
zBRg`E@H?+*c9%W(On=tccA!Cq`#^$WgGSrw|9`Ko-o0Ahm_fy|zxwdxh$lY&Usvzi
zb+2^B+`X0m4qrT-6{9!n(~FWIy=zyuXoVlYc{$Z^pI-kw9{JkB8MdpZZ(sfDRn=VE
z$}c}o3jTR+e)IeF)NiYDUb&iS-k-j?%CfzGb7|z6{Xdd+t$Kbl!{qK7^VLNrr&j&k
z6t{MB(#93nkM3F}&TB4teRHJcGWKO>m&_5HeX}a4_d4^B$NSBnDpc>CHDz_tCz*L4
z%O@wr_N2RBp7PH6bH;>&ENQ}d7I$@yz1}tNX4>YfX(q>J)+Qb+u{7J?mpJX&_t%Sd
z&I_IX?0i=2I*xM+(PG(um*t(wKb`d_FYV#FH~FtW9sZRTs`K{#_S0E~Q$>Bh?Ok)l
zV6$>V<{_7+<CBXb^%C-rh2CUY|7`Owt%@x%SHo8)<wcz<>`yrGtn__1Pu;(O^J+(*
zuBoa08QiH|8`k&w=o8g<D*Lp;nX|t6nl^u3o?G`ZF-EU&^@IF~16hG~yVo%mvfZ3r
zr0V}BZ0=Ns;xN+&-|ak{Vu_(W*B396eE6AB&-vyIwaCqJ2N&J2&s2Z7{bE|++I)B4
zy^+1A+Z1D`zP>1OY^z2>*5Xpj_;X#Re~xKf&e3B$R<&8r{eAaMHoHT6Wgf2UomF&F
zL91p1Q_a%nRcz-a{}yEK&^-J1_1USj{&gSyofWDtaQ}bE8m*k}3dh^_v#uUxSr+%_
zX&H<3MwTs&tS?T-UGe6>9)EfM|Hyk%HWJrAtDecZ`eQch;k|m?cSQbdou=CyUm07l
zbJfw^7uQ6@9CVQSQQ+dw7HK&9;$z>!)M@;7)!SF(i!Dwwo*O3rVZvI*dn*o3wv>BV
z{`6Gejwps_`r#K+N+V5{N?tclZFK*A`%_v%U45L>X2Ul}o^<Q4%KY~C!|(r9pOe14
z;n$z{_xa21`|X$Q<5YY6pF@DDqc5&+dc~=(n+m_>0-F7I|30;-{AF1DUfGi?C%G;E
z{IkvMqiVvH*`a&aHC|cqZ2Hk3vND>V*UKKd{%3oZWbR4h$_2MpxL(>nTmM|f^tk+M
zr_V}#dwyl>4Zddc+hzZ1JKdjG+OoC8FW-OdcFDG#Ehm*(u1+i8Vfg>nwk`klD}Tqn
zo=~&rM?ha?=6SCJwH6y$=X0ruu7Blua{u1AxfeUHO?Y)O?HR{6?O(#xx~0k%(|e<L
ztxq(%&lKR+a(_CvgTMg;mkDatj4Hn$Gg;Z6pPxIc)b{_r2*$z_>@&ZA*PL*U|Hp;8
zK97m<0w<<lO=WrWMk<5ZWLJ#n>gYcgbb4zy?6q$D_jTDU-yelnx~sPHd#K$|G*OuU
zfmhF_?srpWuI0mHz2=p_L>dH57Hz&+Y<bA{{JcH?49yS7FFDwefBa^u?sATLwWm*?
zy^?5aI9>U!m*v98M~BRw>}C12CoAXk<)anbW==W(aAx)oxeJ1vPU08zr#*gsakq4Y
z_?-W-c5(-q=RBy`xg`Gm{vS-5_c)?flwJPAH~-$_$7<)7ebqX=pK*o1^83a8|JnB~
z6MQy#;w(=)1OBt0cBuEfR5q6V-ZYKpUyI?Pry(yYFWmQeT4?s=dFa!+`gk4f8MnDE
zIMut=_ZKElWV-b3vhr!8JAKcN3fak+-%DQ_vvNxj?|QDDS3(nud_9)W`uySL-4~zA
zRCH#|6tj<i=$n<kN<!>&j|9W69d8$}_BGX-=KWbcHpzS{^I`sV*+;Uzwy>?1FDU;e
z`R39Zsqoi<M?KnpvmRd%xAJ1izNXa$X59b2sAtIe6}10x-|#c_M^0?aO!pI88PWp|
zU43o)==KfUsPOl?Gj7Qw{}dL;4n6pwb*{nrx6@9&(lcB9tgJ5byxaTL%XY0vJK$CM
zI&H%}n>{NhXz$3$lYX#D!gprq16{t4O*1F6ochDRw}Vf}HuU&(`4`Ox{7w2k3wQ6S
zHD2_|`6b&WyA%HzW7JD_xVY%sfB3k!RdoHaA1RR+Csy8{Va&b5H+@lrPgtqx!nzj;
zcfF6Rh`qVBHGqNT#+6t7JNA2SJan~O#ra%eVdTnn4;Rnf-M6db;o9#rP6dhOgetvK
zdH6SEjZ;R}Y=IMd8Z0l(ZDy#`x+kve-pOz~VTI(TvmerpgW8ubuRDIaQSy0GS>Aij
z-z@98y1Tm@_XaPTe>BZ*)l6~gW7bRO%l_5NZaf_GTH}T7%_)_yGuedlmfgPHn4z)3
z?)m*|-Jg_xx61Kzdl@${UFw}zY;SFOQf~X9OZ7_`%%1Aa|8!HkQ81!n?Y<w6y4SC{
zac8!;{H#~{PdWMa`%AZVDE%<fKW562w7nyojVWmRy&R|0JlaQ<54P{%_!;gJCeLJb
zM$K8R`-`^OhHS3-+mD$)aj!M}_CBrkY<t1f1Ev>Fw^x2U@O#;R*E?-&Grxab^10?m
zaI9|C4FQg`;%8*$>NPlpPF}uxHSZ}I-}BSke%o}YnzWW~it32_d0+j$$c9g~jGyns
zomk&m^SwqghT&jr*&EJ3&fiu2ncq!+tYbc>Q16myeC3%%ipe`}O_}@nC-X)r-ztG3
z72QqB$(p+rcXM55xl?;D@<{T5E3+c5Pu!(ko@M^LQ_`|Yo$aqqWRs=an?%or^Ul7K
z-gA3`h^bt`oPVrm<S#Z`-Z=c`_x1Df^6BQPZ;Zbb&-QKLSijjd(r;5z;q0rIb82Io
zE|}<Fzy6g)Wy|TaQu241W=~=CYqI$ycWYgC<M(ws({EljU(U-g=kB5_oEe;NpWpP|
zTg6__zkkBoIcdH-<$h*g%RY5;$`_F>1_qi|Qg(L9vlsrC_35fFJh1-Kf!0Np-0vK?
zH>p>BVC3e@=-?B-^x%oGyk8G*HJ=gNg`13vCcZwn@Uq{5=PKD{b7zMiO}cOVxp;ni
zq^(|BD$i&6TIsTbZqq8aKTN*fwr__1_3aAn%gROb)wf@&&i9qR-*h@>Wytjxev%Ha
ze^hiSyZV;wzp>}--4$;Y@7}OJxATuflE}HYzt0whF-4bzt;?)xKJ)k7k6x>LOQ-J0
zn`))#`82#iz{pl=)xMi$vA6%O>wfoI+ON*k)s&-K_e|7^;1g~l)&JgZoF=aGOY7f6
z@tzQA7j3;s-iiK=jLeU0vaA+Qe!v)VXSEF1lWlXBv3`}G8n}pmhV1GmSAIPHD)DmV
zhul)*Bh3fjT+*+S=eWn-qHt~E!`Ww7)iCe>?sM67@2toAM`C$71NQT;4_k3(&Y|P+
z^HP2m%=rF0uHT^O@aC^q8ul^@xE%ZBs5arZqGLn-ov3xMFZv%i^3v30srdT2%S(c0
zR|*Etw9a1>cE|cz>lFLiNR{bNO?#i5FHsJhE|dOz^XKE@YqoZMJE`Cj?`f;xU0cYZ
z;mlQ<Q0XOc`t7e-CQo>a?8PoKhMHYonPB-+rE(fOJG;ND?T&qV*KV2y$p6`T=0d=R
z%n7+o&W9h>AA2RT_<gIMt(e%2HJkxj8TKX{?#A^ryb6DP(c_2G(tGyT>UpMKT`F(j
z<z`~Bk<H}uiF|eTY?TO~F7Y|X_hbab>aYL&#r@lX@(EJECrVlD;rA6&%n90b_xJjU
zMNCx_o$Js2d%1W;m=OP#Z9g9=vCnw5JI<bUo=?VcrxnReO*-kE^O??b^A;@iTK!jj
z)<J7-55_kuKTL?z58wQ2(~OCS-bF~>JooqUGCzqgFJ^sx_l|vo-d`1;)trBF8qTKW
zG~c>(I4<^$(J%iO>{l<oTXphc)|B`k<_ueRw|uU&)en1LmU-q>=Jg<z6Csx?H*Prl
z;Fgc6=ES!`VKZ(?+UZ=C=--n2L*}1{=_PR+Q=7-^Yu|1?c=<MaE*JMS>Hc2|$xqw)
z&)&Pe^75N|eGyYmGixQQZZ!PhQT0CRP3}qAsB34dV)U2IXG>*@uaROo>XX&o|1f3p
z+-crBPRuwc#8x71wc6hL+qs^k8+t*~o8~dhzVxPInwtZg`RQZt8Tn61+W8+WkC!a&
z+*$g_(`WV3l$0sI64j5zytrmBA0giVu$#Z2@F3UThwQI<FB+Yk-Tg#q%F(QvSU<OC
z+Qp(Ls-z$Fud{nGtI?d{-rHq63)qfUCorE9x+&Dw-gD~0O@98(mo-<#cZJUM&H7Y(
z^4MxA3+^<z2cnwE*UU@ZypE+c=sfhDxtm|a;NOcUED@8~V$&|j`0wzzb24@BJ~55R
z;@JEJFNGY|G(Jy$$6B6fseSCJfs<;oVQ{rzaQaR)cFx{7huKs0PX<g_@O)$Cti3B|
z39jYTeo$R|<Oqw|qV-oF?Ny$|89qhDG3|DBR(-DXgH!)*Oqi$b{Q2YVH_vuS#it+3
z>EF$M$NY<d;Odo=LZ!Cey?-dqh|fUg&i>i2g~aMvrSlI+hD+S}$@Y7XPGEQBY{3Iz
zxwDE)uN?jy%5*D8v5WDzc$I#1q@s*6w@CKsu+!$w59U7iUH_ijp<!C6^OIady=uGj
zq9(m=g??7K65Yv6u00=SsczNM-TdYLzn;rideV~S{j<2G{%U)%vFmwj^&U-4minwi
zbA;>eaNo?XpZ1>ZX0`QE!JRF=ZoAKX{HySKWBjZg6BV7;hHaid!<6^Tx1xW1%m37Q
z6n|`uxX*O?XXTEhD<^cX>}i=Q?AaM7`+1W}$cZY;KkF{NeyBTBviGfoif_r&FBNK%
z?H?ytZCe-Ec`@WN%jMEMJJ~}C7b{vqJ~Qds{4hKzwvF{-=Ys!Nc*<TrP<i=TY~i%o
zQTOeqIDI*Ec|~Y{o8G+Vl?yt)Mjq6YsPmTZau@J8{A*%T(yrGkx=JgRt{vEP-~to7
zJ?DvSQ!T$SKi&8FVP}L8v+&O)yz^?FGc(5-v9Z*oNDE}VXLj&ZZEH~SkmmUG{i~r1
z%S?&BNf}Y4_dadpzvK~Z=%HM;^`LQlS>#+H<<dKK(h0gMKMqX2rl4fFbD`k@*44(m
z`Zmj-#PA>6p6S!^@#9qC=d)~D7SH8L46ya~END4a$aZtf=WdhI8+LVTpZ|Swv*K3w
zmzpES&CiwJ{+{KuICkz7p@m#x(;wPIN#yK$eyiow?EQ!S-P%_-&G%len*Djd?Pt!^
zCEm}!Te7?_>*mjbop0E!b)uJ-o~~*<_DpxNmRf!0gu;dSM#uCmT3T8zx=t&2!u&Dc
zOggGEaZe=cvUMAm&)Co=RkA|;x_RnMt1ItrNqA0}XwG4EY15bPq6?v{PLa#p6y}RP
z{@Ql+z5D`YvD6#9lPv#bNNflc*>lO*syWkf*(Tu>-``Q`ec6gu#rHS2nQ@Bx?BBba
z{o}`ncmKZsRPen+c9!^=0}SWgXEWA3>?jdgeDQ!pYIsVJV3F_YYy3wiPc2{l<M0Qb
zJ*$tX8u`V^#s1@Z{9_kKcnN>S!{zf@JDh_wqK^K^nP7TJ;c~-Mv-91`H<c3}ZLa#b
z@5m08_79TPrHeL1N4(|wzH;fy$Eh2&p6$xMa!h2pukGzM-j#WU@6G<4<GuL1r&QzH
z>c)=8%-@xEuVmQVXi*`;*zzT*=~8X0pYeeehyR;#3rvgIzh_^=b^pVWskSBW)|zK~
ztA6CV`6Eb1F8Z@|O}oM&WuaS!g<GcfD>fz^DCkkVXe@WDm3M;NLbh!u^bFGG?p`Qy
zC)wd{9%mze{jERqyXAiJr_2qmI5Llai`|-Ij;&psYBQT{4*U{(dARxL9{XK0R&uab
zU0!qSUfqP7RorI}y<c~#^?R&H&jw~5iQVkU$4|6($0i)sys<_~;nBv)2a9TQ<uCnv
z<J}_9C|dXD>8pPhyQ@EaTr%T($_X!-XP+zeTjc7GPSUB~@bgeh;he&Ep6L>yJ0+&S
zu}M}c{nX8vC-VNZ#!Z_$+fE1`KUnm-V8&jjrLC@>Q(ooTKU-=2>C!8e<Xxxhe|gFM
zkV@-!x0736p0Ke{`RxPlB>yAEW>;iCc>IrHdf(u<>d8KzbhdtrRr=wo!ZwOKTx1_|
z+!Q<_cf9?Hd&i%~zyjeZU29)t+&rJdBXf^w#pH;yjje~jb7o9C-F5He6W&Cl=_d7T
zznj)@Pl^?+%;e@;^sZZZCcmXr%ZbW+J5)`iowJN1^Imvrn&+HR<7_(>pFQDAuknsg
z7c<<e_|B#-Hw;|3$U#1mQ_)Vo^PtNUYuP!sF0)^C<K?sD5S^KLd3VynW7nVlnA>pB
z{{atkYdOo&>kA*o#pN=z7U;iZ3RAhWLAZpOq0h2F^4_ij^FM;S0}s47C6!jckL}*o
z&07<^6=n+O89IE~>(u*a)xDUHu8)pBHZlpiw$>}cg5g4f&iYh8j;oq`*0V^qDwW)v
z?a-){7S-6C+;QCdT4B<&3p%F_dvf3KF@G|(sJm>b#aF2*Vsibb+p=YCW@pZ29V*UB
zh@33Fh&3{DBHOiti$s?{4qhv5U2|oF^YwQ*eb2oWEPEZdUOSv<aO~0ix{Sh$4;S41
zaPge&iBLlWkNpAS?EfCzDZJI(^Wb1&zg1@F!o{4N(qAstbN`>f@A0{6qQa)ti?U8B
zEZQ@DzTqJbK4C+nDG{GFBjpZy|9fJ<?o{sfFm1-)@VyJ)t`S%16STQ?Bv#StpJ$tR
zGLJ{Islb}Vd;Y&mn5OqiMa@6YY_wG}`NPvEKHt`a3e<7MHh$nXKhpJblj6zlGspBd
z1?<XfSv1*Vc5HZq>*|kR*Pam7&wU;Fb={eL&Se7U-*1jikQaM$RZs6N!w<2QyfR_)
zO1Ey<F3zmppdhwbeZJ-8GFO8ytL8{|%AVJ{w;=7<j(=ZyIRtt?uH7zV*BE(_mqF;1
zi+}5J;T;oKMmy)MoA|ybQQUH2<9dO9r(E`#;#xHeXLu~{<J@^Nsm@Zfuk;_6k;Yfs
zjj}E3uV1Qto6W)4@yXqParBuv)x|&A%a-5xlPtAtt^J=*f9@WgFk_PE``VKCM^|L!
zdziYWOfwDcsdv9*ZujQpLv4ZJ3HL1yH&1(FpZMFx^UwFEQ3euKhSwVszOGt#-Rsk{
zjhmj_xfRps_xf>a;^#k){!Dx{O@-g>Q1AC(0n@0ASBKN|CHvMl*6^I%I;+N+cYET*
z!yB}va&LZlc01#5Z0kw;^>gLj*IF=E-$=d4bhi0Yi9q266-DiP*RQI~7JuTz@HhNS
z{U+g62XZ5JrfCEhcx_NlDb!kY`2|mrua8mTmaA2VPiD02*H_wk#A$N&;gTy?ikB31
zYko?ebV03^qk=>CuFtw+oee%4a}Rx&s;`;-b&Bk9;puC(%v}`DsrSR`uFJzt(TcDB
zxAN|On`$Ghxzl_5L5Vxu#TOdBoRXg-GX3$x%j@UwZDN1+?{l-zp&4v%P3P}kBVMz!
zz45iz-q$N1+4|aOXO|baiOn^V+{_f(_<GNbyCU0D_RX8x>852?r~j1e^uHZZM^l|`
zdQVzD7MZDF9LSLt<$bWQTX2TM#0Ccyr&?{9eXJKm1Fg%{kIs~@`|&Vh$*b273LZ(W
zZ*tLWx@t9-Us%8B=XXKT)TR74x2#C>u)e@E_wTFe73ak7JWS>E;mTCrRJ3&!^Fpc3
zTD<vPSDF64^8L5$;gTbNBKBs^dv5Qxys6O2ddFtvUG@sqjt8|^Byt#+EK&<q_2LuR
zD$p#rRI6y;*|g4&uT(n{uFl$Vy|8i4-L$|u21|~UB7PG(6gK5AntY(swSZgVbk?Eb
ztv)hKpGzGo;n`{*Qpl*{aH(VV|D|SS+xR3Uo^=UtZ|ZC-6Y1V3k>Y8uq$q#?+UwxM
zrd>%vd$%T4o4)+I`94>AvRnqsoT>Hhk8NH`ytsP*V$;8M*>mdMxqt2c#;U5$qc~0X
zVBeVp*N1$}(np@n*<;(+r4n90L;r)#Tj31J*XvYYU$wl;CN6(5(c525F2B0p%i~kA
z6i-IHehse(d(90FXQQK9W#>$M-yBr<dSQp_ZC=0JdBUy^KR&NnHdpv^g7ED{XC54^
zF!|#$i~V4sB=^O*pRy4(AuTG;1hxrD^~;1*6z^4-D!kTcW9JPq)3g*#m$_>jo^M|f
zTA+K#TOeHNb*FlMq{8~>G;>zZ8$TvqT)r{NMmVxQPA8AqW0CoB$Br;JwQ#>*|4hZ!
zZ!uf3MbA>|Tf*Y5uT@u9vqi?~Yuac|&)_!uI??2G_ls>xX~C173*JndJ@uAr1n;NP
zOG!OztTz1?u~A?0p6$G<$>lQtNYyFAb1F{WR)2S9Q}(~4os23nF0$KH0#E&3aP)YH
z8hiF^hJuZ??zjAO()13hs9tKkq$YJdw9c^OAfM1};T;@ezT)Rst!K#*`x*Z3*`x_x
zRU2BPzr{!|&797dcjWtJj?JClRNTEx3*Rxx6&TqU=5cw3IA&PH-POA;k-xFUnJ2d2
zTstIZ(GjbV`}58|oV?hxv~`W%x8pngCt6K@SF_n6R-WPLoYhlLE-4DVen3PoVB`CS
z*u%%X|6NWjj<xxDb-n1yJ#u-|Ui^Es%veV}ndjT``Uex{JemFV%ZvDj4}`YgobzP$
zBqqI*ocD^wyOy8lecgYm?#4G|2QHJ&#9!Kc(oe6?h-BvfKYvwP@R?1UzorFUz4b4E
zZ++VdHSg+2^RKU%yyWKjQ%vpCp1S`uxO4XP!_uFP;_I&4+y6W3dcCjd!ueI~cfu|$
z4hYyh$(`LVL^k8#%GB#OEn5=1Udo2I>WHZ=o4L-TYYR((WHYy@`t_$domGjOUw+7l
z^Es8XbLSk!duJTwn$Ip@!1Lv#Y?f*3ZJtj&3|5{GC0Ku3ZT#DooND>*@z==3f$y)Z
zv#LEAHJgpiBzdBo3jdXR>m$<R;`gn8<-2$vdrp1=XItdI(7bm?d5<-UNTlvzo5)*t
z(tW3~b6Q7%Oyeuw6i15|^BG4!wQXB7>%grXsY}WW&#t|BX0QH!%fAn=cKdt?>GAb#
zma|qdGBdUbxL|wPRYLj1&FfcFms*CNd();-e(2ELhSyJL+~at5t=zxvPoUh*^-Hbi
z>{frE#Z%P#e0xLPCEoI%4vS}{1+f^{rs~@oC#No}d2vxI@8RzKGPhzZF4P}ow444^
zs`vDi>mOD<5GmGt7We%JgW5mQWf_YiTb56h|HS!a(~Dcm5x!9?Ha}D8G+Lc%Fo%`f
z!0M@-+slJ#8=6kVt26yz_$>6G;OV6gVmFEly(hEPKfQa@_{0?R_OK0Km@}7^?wgl>
z=SXde(2BxGrn`Jo@BLBfF{s(KW3NYh&Jj!bj{+Q1Dv}bjeVE;I&nG)Dz8CcD@odnU
zuq8@#aY$_7_G@2PDtH_aFz$CV+nr$WQd3d#ndijUt51u~Jfg5br^2htu+C_sTcwq{
z$P<Z!;=j^`s?Ivu&0(4x!2RS1vqE{9#1f^r=e?X)rQdDwo}+svd#hGnjLec!+hb4m
zyemAfmU`t!Rvh=ao3{(Thd9UG-*ToV#Ny4a$7O!~>qYN>O|Cals4)?%u3Y?h&Fpj9
zbGAPVDd{d@Z>(@=+{hX?v*56AUS)~!A%!}Irh}orjOja+wBOEQO#e~a+Ba?bc9)yJ
z_uPAzMD5>n<jkeXS$7u2{H)_>Zt^_Qll!P}Ub)}D`F6thCoHmwQMB*4ahQMZfxX8c
z_*n1y=2^12aqGjE=lzR3=gzpgTmJp^GKOa{ix=*SJG;5L{OMax+5YA``;VQ_sG4;3
zFq@x*&PmQQ{|aZ6u%+J@ns{7a_Eh+r4*!+YX4KzK`pt8PV{7m&zj>#hpXxeMGkxNc
zveywys|1~UmQQ<pWbW<FO`jB+mZaS-H8Rt@zx9RAk>!m(^^b}Y_6T?ND1Y|&-n&0-
zj(B*-qr|j7oj29ft+XF(5ISng&V1th?~fL*d(9^=dVj#C`h!A4fNsF_&OZ+?=KOhZ
z@bKcu&GQcESJ+R#B-S$jYt>B|`<e>Y_*}h<r(Y{RbzlDUVZ3~p?`F-}?fvq9Uzzv6
zIDB#S^7Q|fRX@MnzCZt=Q0?Yb|AX|RgxC4JG_ATcN4w~PaktR~)k2QjhtFJ}a!m5s
zjPH?ZyFP?$PipU6$8<maVy7-=n&IC=x9-e2c{cxYUOaaKD__&j>Bjc_pLRw)UjN)6
zLx0){f5jg$cNXNPYb~w1P$d3){{Pm}Kc6#~7YFlHz1XpE%JJiAofp?R@1A_fl1u)j
zS(1bKPVvMisUe$g&6unwrsiSUaQt?tqeWrxm)R?4x;L&!`zC(ZvvZf3+ROv0F3kJd
zo7(@mFHJdfV9CRE%cr%he)&Yr?19I_)m(2pmbrZVl*>M+b$<8m`9ChGHBWlybG7N(
zJdMn%FEbU-#Mw5l^-~kq{TY?e8|8EDq@w4fZ%4AbG#38tC<=;*^b1<Hc!Su=qF811
zi%X?vvJ_4Evs$e*WkP%Up{1rZO-f(Q7Kxb5k!)>^_gcFxA-(R({t1^_Za4<MnoxSp
zVn$0hr+`~lL1$daKhZMH#AS)PHj7?o&iK1gbGfvaNc$R%n9Z|4Ze<ELxjDZpQn67n
z&BNF1h!pdYd3@^|r)PC+4Ek3i{L;u{PLdAuhK=`>+D~>GOj@M7I#kJ$_qR*Ls~eB5
zr|<iAZnBK3rpSb%lb>IDXce#SUq0o~v1R>+c?rBtY*N;Y--@@bo3`VzXy%SUht=0|
z_!Q<}Sa5t(%#VHV)?GisxFOGTuAoU^+giTmlU`W#FAHLNawC-aq~9Ty_L%*TZbaus
zUu8PFP@#9>y6J*-Pp@9`sL2j~*e>sO)l^9S_AHr)$Ja%)$CO#6FX~@^)xy_hTIkHW
z#+B_3Vmo+@uBd0O3r~Kg<Ql2L+P`Wo<M$u47Ddm#^<&xkQ<fefbE<Z2$b8Pp&YU>!
zO6QI%i%V@Eo#(k1dvD!OB~OKU7gY>bEmJPyTdLx#Z1?-tf{zt5_C`*9V(y-~Y3V}s
zJ6?<A!*)H2&*zo?FzvhF!D=IuHAjvxC5JmVwJtgRvuiTf-iU%<5^B9KZyKu1n#+(I
z$>yfI`s;^VXByuxF9_7$JLiXd^uHC)HF+0#&s!_^a`qigZ{tHUF6?ubH9dcNm!)w6
zliACnw_ksY=oX&t;@tLV8uwzo7SY|h9|bKXH9OoUH|EWq^jCY%gc;T+IZsCVFI_0T
zn#pT+GWWg<)AM%moZFmt(56gq-?Z5`-#mPL{QtMr_hlx@u=P%OZ(H@}wfg^WPvYx-
zKDoHxYQ?=p^EGB!ZhIN(v(@V6r^a=Gm%lUq{JllqVpYNAgWq|NZ{8Hq+HU-A+um6J
z=IqwX-HykyE+!S;w!Z%TnZk}GY;wl-8PaPylY4%AEqTkQ`1o|y&C~8rRBf2}&V?E#
zWy!hCspzW-?#nRcxhZS;a$^6zMcWKZVi^@JHFfhoF#D`H%~v&P!<(Q(k{UT#bA4BJ
zT6!JXdhqaSNA;YK-!@Nd^;v3peb$awi79THY<gV_I42%EGC5P$Z&u7q9k#I2DJ?4D
zx_NS`5@BX+kMG}nc6a9U$}+C^v8z0m<>b^&zQOnDtV%xTnfD11G3q&=c3sLbc`$9|
zj0NiYdtGNQ@i3flJHXOqdC7-KELvw*^LzdJ@+j84`-khk&ju?m^@aAc9s0)i*qfJY
zF~>y9t#->eW-&EBsZeWU-*Km>Kxg4?t62pbIT*{zTPh!=tDmqv7<us8<2@(0e0AwM
zb}dzSskp_F6xoRB#cI<<I5b&bo>XsekvRS1*_X&eOAhXt^*p)7Dpf~!>hbJnc{f_#
znN1Bo<6*(y)3LZ~E3eUamZ!_Re-y_SvO7KrF_^x}?xOxg%`=XBxO}%ioRM>8{l6vi
z|GD%YzIO1T;Fe`#7p+n%xMr}tu2BelD|A`z=-wI2cDHVm7C+ahzo^=oDPg5xV1DrV
zr?+ZF19v<q-h9q0yiMY@re=Hm|Bqju7Psm@dN%*ghIKjfcF#817av-)P$F-i!FSQ0
zc{ezute>>b_bru}VSTAC@!sByNu`3O&-U%;Pw5vr>V92h*L-#NgmT47<;>)g_|x3S
z<{f^;WA;w5#v)zxUhA@Fn@?L?uMeLUUK@Vz-j&s!!Y6L83}lG2aO;VBxjlNBgZ%4E
z9-G~rv!>LDzu2o`wf^ihK8~+^pKr5u^|;*foxrxr^+iNy{OQ<*$3^P%+R{1>TK7L$
zTs}Xuao)pzD~r{C`tMv=v;XYtOU?d<w;U|=mPmX*d`FpQ&1tu+6Ej0{=HKF1Qe4%k
zy^A9!ui%l#;@-t=!ljb-66-W0c;-AwN_lcJW4=bk=@UyH24(lRGM<QDHtV>8*Mmu?
z6jn*5PTi}RGwnm4#{qStqi<7;_AXO3)3N<JO)$W5SHisCM^%?Clhdhu+jFFM{_?|T
z@10roE`G`M6HYmtQQnj9tPEbZ@!B^(N2~gh!u&_6btbJA^=E$GkxK79^uXPt=B-?G
z-=@;u;E-LV2ja!e?mM5o7<p6npZI}WufLwYy4SAi+nR%)7oNYfbmKvJzmO-@CoJXM
z4u~9TI2W?4eYeS;+VD+_TatfFwwL=?^h3j3XsKztDo4k)l&LGPs4RSHsCY|8MrO{!
z_YGVJ-2M5wU5@BY*md4(s$ZAb<dh{k+##t}y4{hcmD}3VJTf;hZ}0aHx^JEpGJU&Q
z($v?dehBX5xcYd_QuZxk3A#4wMr*v-w;Y;s<ixq~>=?hKpQl}}b;a|&JyPj)Z%2))
z>@j1JwuS@m_p<CUI1#pd#Z9Nh(N1X-yFa_=_`A<P;;L&|7Lb2E#L;E(_4xJ++b+px
z-F);kMyIFBf6LLZ9e(ONdi*BNZ&rUf`OvH0fXQ<2p8fpjx@Do+&u*#oPwR}k&(2+H
zcAQsP^t4WXvQbj%$%{O-52H&I8kXj}?7X!=YFpCmhM)qG;F9^G>C)jI3ti5u-dcCy
zwDd|g2BCKGr5cWH6>+h#>my55I*lLXaJoOcp<LX{b3&)%`0bU6ucyXWiNx;iyr_Qs
z-Pf+zYi0(D-0$6zUaLN4-=lt8T)cgk-ijMjMA~N*o>{fyFmE*fX3aD6uB}#oQoNh*
z`HfR;wUvF`f4s8q1-iOVV}CrA?NRH-Bj!rKBNo5<|7q*qJI7Wq+c5uY73HX%Z6Eh>
zSNj4xwy#HLeY(Bok?+ByyPQh@-<src+39(d!2dGV^W}>dt<fnB)>`b?SeUSR=56Nu
zGj83z?i-ITJ#d>PO1m%nn~?7pr3q_qJuq?o)-8~u+@|@e-QLY-6X(66lkdZHmZ(J)
zMi!sEt|mC??JD&hd&~-oSINYm?9s}STDE7NlkB6bA3yR%?d7X6pDK1{@)qG@?mNy3
z;dYA|jbp{MPwh|s=KU_k$>>a-W9t12tKL4pkyOEyn&sln5D^>No%l^&B;07`iW?SI
zTzL=d6c(kQYb~1;d;RpJ`Cb|}wP#DKTc`H~T)H5*{f(!}=M%l|##Zb8+IskL9aEif
zpnMinjrU8ot4nrYd6e`o_d*QA>A;@j4i9}l+D0C@wK#1@i|~y%O_P!~^4VRPs3ETZ
zcJb8-RXd(<H`LhAKAF${#pKhKlZ?)^_CBkZO3CLv<Y-@Vx<IXsMgDzH|6RMyx1v5Q
zi_814i|?8B1Zy85W3@E`JM=x~>#DrH<h*m6O0!h@Y>uMCJ4^o+YYGNU_T>1-CVU~_
z!sVyAQ?B&$DDtXZUbXC;XH60Ja(Ri8j}uK_DqCKimitw9`Qy-?iBH{li`zJZ9^P1?
z&Skg3r>XV(n}?g(`DIj>%nZJ@A+hM}<JY@wXTDdLlt{kqnX+dh!{P#$S65V2G}<TM
z)me8oVinsvfm@x{>Wa>KmAlIf*p5zLx4Kk#`@Kn7CmJUBta=}<udh2{&9SKCSIh3N
zy1MDnv8*{_J-32+Do;N<7%2TM<mZ*6CsU#)9j!~66tP@))!fJ2g*&eW^06v$KAjpc
z*YewBhBSVm@Ffd%Dwj(LzgzN<Rr2tb6FCO<jPIA3%&Od?w3u74@X5IgUg7TrpZ>kP
zQg0($tk68gUUMhq39ox9mw32eUsjnTKD|(0O>BOx`Q0yVzHMtCRko*X<IT37{6gxf
ztHbKpWyW_lbmUYQuYP;yR>{f4b5mOS%H5?I-mQ7Uw)S$TWA=1Wk;O9(eRXAcVz1Q@
z^!$P4L-Tv$PkggX{0tg5Zpdosd@(6G#P`OA*8&NJ)>A?a&aXL`Qnpo~-HYwqRu<s~
zwNyuQ1J2FYvcF2Ua;r}iyUjB<`djCXp50G7-Zp$oc*UG|sX5uA`hA|qLYsEUqO#a3
zdxJw(dHi0F{2Y$=E{qBK!xDBie&%6@Pnv8ZUTWIk)~88Kf4au)+N4dB47R^-3Q1_!
zP~wif$q@I@n4jfz%?;a0*VVosYjBo%U0#zVqW{!CCn2^V;9UNp#x*M*DQK%6X=ab*
zNx9l}HFc|6q_xjvT~1r30=EB}oA=jUT|3`Iw}7*T(^yPn8`msr?PFKWRsOxvY<=Y4
zEipyp#TWi=yN8#{>>7moHmhD<vf%X$!JVh(?XdbXWiBK0{@;HUk6pda+ZM6C&hEIt
z8kr}Lc3-e;=)Qf$;g9=^Q2(%LasTg0J+fW1@9@9<F?Y9H*QmypKKtvS-Ll;xPWM(m
zd*=&>Vh)vH4_RM@P3P|f=$Tt_o5?(uUUc(|;M9*Adau7PUC#QdWY)>!);kqhS1`tJ
z<v8)<*y}m2oi5)uK4V(e82-ND&fC16xaAr5BDb@yzW&%Cv&hm`!I|r+kR6AERFvZ^
zi;e3Rp1NA45<6{9d&r!f9S@JVt_|w*dExDSQcmsJr^8pOA~&xKe`@gi@2VX~{4EQ`
z)SewUc$3ll;1mXxBDPe)f_NMAsV`2o#h*@ErqrFXGq+4LJ~y|{A;vwnp;NSvk&oxo
z{FZiAyM%idTUVcv5M!C1)?s*fi<Jd;mK{@vtwbw7Z{9XB?RICKUwc?z{+OFzxlnk<
zK^4vYQHSEyM5K6UdmMQ5#(m?2OjC)8yOZ8bZ&@e)ujK;c<BeY<znFx*Yss1`E~ERU
z>ukN&J@HBnPU*K>i+6EsvEK0Ph2FdF^SQ@fq@Vj6c;!skMu)bGhr*`pT-^8mbBmpO
zd&kddk)~zo{(`=}T-w~W{!XVkSznu6z1pPzJ3Hd^Oxp|{$piMSDcg--URbs$wQR$Y
z%Tk;I1>D<9I$lpYBg6FhRD@o2ts}eYCPVhuYYZoMcBFk?W59TR=FH2ys#jNv&3N6Z
zF+nll!YqktEp>^t%?Gzm<K7;8v2>bY<ZA8BJufrE*C>DKl`-nsvhbMxl_tagC!=)d
z=glZ(V>X^Q_il*6%Oi3Olgmx}x`fj{>%=4#^>>~04re^Y_WYahVV1mEn=c+<4Efde
zXY#WB?d+aK%YJ&-&RaA0!m==q^Io&IpFCN0ez}_QGAR|G6k7+reQTD_>t4V)X@YW+
zUwuIKsUv|uv&<!2B{<6s9qJ}#ttwcS8pPK==}Te92_chPQ=&sF61|_!OOQSs<7U7d
zA1UGXGEw<Q#q|YtOV=8AUoKs+?e!}m`6d25x|h2SJrwx4bVh6cGfmcb>tOwNF88OI
z-|FuOJDDUGe&fSLX7fK6KZN&Rx@XtP`Dg?0@mFTMPTT7woLqiR`T7)I!(+M=Io~hn
z|2^gTbOp!Nd?t$`wxrH~_wnMU9sBveE_uuS=k@X3x*IqY)OVZ-+N{<Zx^d~WwGTfO
zou2ozy)Q5Qo$A+rpWm(0J-GN&;J4`Sl5CeYo`1W<QcC=?y0KP|%6+%aiMyn_Yu|HS
zbB$q4l(;7OVc&Z8xI-NupY>(&M9se?_;$9>nPRamTdvMma+29LWpfu-XTa+pOb%vu
z_p@AT{kct`<mHmoqH2k0R#)ZkOy<dNC}r}`$Wbf3n`JE3tP}F>+0pi8zq~6Com_op
zj^NsYeb3Uu%g$W>S<}2Hwez|3kGrL|>(ZZV#q%$(`*7pYoA0XAjk7e?MO0R0)XU9R
zj*~o{@XB~%B;#8x9iBAfqz&^G7*<R@FP5cxXZeZDMOle+*P3znxR$xKc$&@?(m(x4
z@8qMWQTqxWTuZvU-oidk({t}#m#W&;);`6{)#|58Y%)A&8Rd}v-0rjT{Od=5$Uc|(
z@!oglpS-60L;g?xoIkaa<><}p2KAFn1=i`G3OXe8N9?hb^3ORQb9_?GkJdji7M^^M
zrCYMEPIrrqTIuf6SFGEYC&g!YJz?6}r}nlvX!U)oBE1L|Wq<ZvdA}7pDodG5T}vu1
z$QSSPo^1JAn183`<F*^SH6)5Q2=^OyE_Rm{ySBJ{$pc<>c13OeRQ89D%ug*`6Ctws
z_Wmi4Vw)3Y-{5E1|NKM1+;1wc`Y%5+IVK-fxxi9A^Lv1QW4u;ph?M6a!O22=_2>I;
z)_?tx>k@X~NHuxCqR5r4FV?atY}(KMbuD|?<@wtm87DQ)%s7@4c70L9mDw#ULieLe
z<^8YhOju`Im9;-nRaf_Tbo=uB(#nkRyvm88Y%ABSZ+BWz(z<9r=faTZ`kw^utjs-K
z__x0IT$%9kGOgJ$chCD+sq%C$Vrq$e&e+(nu&6}%=OMSi)F(4uNbSnv|DM6u-T5*7
z%&o#Mjk(!hMECor{@{7t#jsf;^SJN_$xn7$_6y%}=PjS!GH08cQ^}g92e$7x?AEot
z6g4%z7B9Q$uI=pU+Fs>b_XVExUOh?n<pYL&+NYNmT4;7(UE?JGn)TT>_wQR;^EDrK
z_Fns}+T&KmpDp?8tq)UGvvi?$!;@L<*6Ti(zuPi3t#HYvhUbMpLSCgR-u20!p|oaG
zyl2#|*XNGrDT#iFw%Q(GuKM8bG%3!7ZS!ZJ{Pb%^qPl$eW`5yCaer$>E3VAEdMaE_
z!=LlSY1#jE^Z)0xR+c<^yG=>Vv3!P@<M(u7mx-5Ni|#qQ{Y!(utw}Z8TSGQ0=PJop
z7-@1;XNwz8{TsTpYU^2pg#ssb@2%-EmFxK+w``ka@@yL~waooXmn?l7uRr}+_1anw
z6;5}3%?XD)-@ja}=c4{c%f4WeVcFDN&r7n)N;oc^Txss6eysE1=9&uG70oglr<P7<
zXgRNJ@MQz<rO>G|f;Q*&PPy?-+iLTs#<koz(og5QXh_bL3tq70-VWX42feKigx$Sn
zAaO0HJ@Kh~{XE`2jq8$?0%uOVGgxAzz-x4IZ_GWlW49td=|_I#ufJDdH;+@?^-)fP
z<nrvvT~8m)%~jJ{$@tVG__RvG8L9O}`#l9&uANcY!*HhG`|N>IhQ+(;&87;ZCr)f}
zGBnWR%J}!`L`V9n-cK`5ai2T&{A%^W*KbaQ%@Mk2u=tmYnXWyjP5k~J&%T!H{}FSX
zWxR^F^P=Dsvn|K(hl+4K<>*bZb)LDcY^Lg|okbOq6BL)eUa+EOeaPcApMt*M*jEyD
zV_w76%k^B3md&5tyEW;_9_N^XMaue-2e&n5y;v!DDT_nK)~LjI(S@~^r%#Fg-mq|;
zgO2T~9-DRH1^4w|v)*2t&3c^8KSbky!4=7qcNu2bS~l-W{3q}?DR#x7yq;9ciEAWg
zFEz3+`@6xk$EWFU$^D9>Y+J(iZ~9{P({R~$&d(2)D>z!qSQ?sVDOlghTPQr`+^M`r
zCL7P?Y%`gtx8{)MtT(!4-@{sWDJ<pUTp{=N>M|)t^LgKWGwN=+ujoB8JKng_dEU$?
zr|LBKU3RGTvfiq;Wi`v<ohvW=d_PHcyIrM^+?HCmWkIXT=DJ+fDc$|*$eMc(9$!(N
z8j-JT+fX*epZW0oB~pw6TO5MD?(%%h3*>W9^nW`?YQp+;Yc_6|^0RaeHqg2w#Jn}@
zL|~KE?YX7_WtLaYFMPh1_rye%|5K6{b@3EFOp?fsxmpzUGEVj3?xzQgmox01nQy(=
z?u>}>m9~k?e>u-)cFs6qpz>&z;)mmF?!7Tf`g+jr@!zQ41<6|qoFm>ZxaOQB&FY?_
zx@wWw{Dlc-t7|LIzh~K0Z2V%ziRCil=WUa|hTCbU{oQ13f18`vE5HA5Y;upA?$nyS
z-S1YVt$H>2pT()7<z<0eC+qln=8Im<S<ho%C9~oE>POd%=EQuOd`Nq}SV8h_t-01q
z1G_(7ob9>W{Hz{x>C#n~Ix@ds*4zEd>aNkbCGyXFdbZ7reYZVtuS*+Cw7z`)-KxCp
zrLUJxc=S(OYw>UGoV_zoy65fXDVe_ZyLfBT^r%PE%3cPpe4@WHLv(##$^EH2%>JEp
zT(o1Yc}&`j%gmlp0-<c;yBJq4KV;DMx53|c$z>snm{ng}-mSTL`*Zj9$bNU<-*@t@
z^~6H2{;}@s4i8qc(G%Q$Z)un9nSb12t&c@Q?1G<|$Inl-4=BnLWh~jc!jSX-#gagI
z*Gzx@m#0@5%Gig^X=wdvd?M~EFV~UHlHw<iL`^Mqo|)bkV2~_n*b|meo;W!sC9HUB
zh{@(jkM8ZrJ;N0Kr}EUocqfKgpA9q=l$eXpOt#bvJJA2#qtu;0uYzx-fx23G;im9E
zp7Oz8S^ruY{o$}_{y)7>K5|l>!G4*IffE1Ul;@Q$D0`E8kahOF^E{e|_}DLKy4;(y
z@4(*LT{G5Xh3W(!+j9KY<5OZhOOsPi?+xE}CpFbOF7l6R%5l}J2Q(J`<&gZ`x6Cr!
z?$)`L<p(^(rsq7pv-_B==**so4Xcl)UAc2k|MkrmwmlQMo!CD6ZoApL*S~HT|Kk6@
z^Z(B<Z1Cw_|2oR(#*BG4r+<9A<w%ZbwqIw1=ER*k8k%<^wzlt&4;Nk#_TzR@=z7hN
z$+OQ0oPL^XRbN!4kkqwp?t49pCDU1o#qZrUHs62X$eS4tulN_-+9av>;~3wv^=oBk
zSlzaqduLIqnZpDZZicGz`>k@F`IkzSZ>R88PLa8HF!s^QzXvxu$%MZ#a**rE<~sIk
zp5e9BT^<hGZ|eSg_1HYlYs!&%?t<P?CvAOfLQk%9Hd>`yz0#_X`G}*Y`MIT@bG;kq
z7ri&AZsXgv<Cfa#3l~LhbTIy5-pl)9y|~EQMt+Udt24T^q6Ai~S)d-*+AX;GkHoW|
z3Lh(W@+`9HUl!pnd5=$X-Zpp3CfSS^@uoL*rUy<wF#DkPr-Bdei6)<|fBd<pCXu?C
zbJfy`@lTRI1ZNuQi%B#1U22%F`Bh=dgksas^)c_P^*ttSKj55On)YxypXV!EO(~zX
zVR!c2dGp8ekNeZi1s592{Wx!k`p<lo{9nW8<mEqllKcY29Cv!PO0}{D<vu2DJHOSs
z)GFrI&W!zUJg0VF5B9ovkJ076U%t?}_W>!lO?Yc%OTKPf(tE$0_u{|u6Q3qa?wD7k
zXj!t%<mh9ra9)>C%OKI4A^XfHKj+-oRdXvRExhmNG#gciwC1`=hc9jZ_WV0%Yxd3K
z4f{VFv?x-1a;{}U*83H@4WcJE{xtsf;nT-Er{9+Bx}#*8$QxUHlzpDg^%$E}35z31
z+3WvJY+9zJc+;jv<hS?9!)eC%CveOVwz{MhVdj=tcA6>8a5s})X|3(~6Ys^9@1&dh
zNC^Kv$91wbanoNPgY4cWx1&-m_QH;tDb=hym8?yV?Y*%xeA&7MGyizTtn5DhKdg@H
zl1223<rQn{{<%zjV*Bc+`McL0lGW$)KR!DoA7=5oRqCUg^!6Q%rs|7t$}K$*nya51
zdLq?5f1QiHnp67kyd4`Qu4L}1nD-<im;2j|&dINfUYaar(yW=Xdn>0bNB=~&TZd9+
zKj6unGso?q!IX)oOVZX}m)yMCXtAAYQc6tdg&ywagI_jS%}wFDa*v1aYwkjO+vnw1
zjUFC;psTm5)a`u9S?SLvrAFI+%hyfWZn8eKXQIfZ<29cok~g?bIU_f9=8ab!QEvl(
zD$O%j%WvIx{ofvYO|{h9jCUUw+$vN%@9_Lv$&<%_dze4GXpq=(q}t>}^uqT^c@uwG
zq=~Lj$>f$W^!=&R&h<R|>)j_6*+0yCn9kh(W8r(sY`wl{+%2PD8fm-F9*&8!{IRC+
z`)c8(mzKEqE#Nz1s%9b;pZ`-#{u3*EZnLaue7(qVR{6;Rk1y5Djc55_yM9H++dYeJ
z<`$PR$Yi`ecO?0Eyr`O&YUbl+=ls2sS^Rgb3YZZ!p*wNMljv;*rR=P)7Kna$dcc20
zo!0TQQziVD%~<lm%jf7C=8iLgy>q|Xe76aG$h52PvqXh_W;-X}+ZVo>oy#^k>|#B4
zj;*+5{`L}qoyQc<EcqlFpD|^j!m~Q=h~SNG$9nF&EsfsGzo%%{EA8r&<+abnZ-&Hw
z?&g!|2{6$Q_HSG=XWx=r<#ylxSe$*kRiWkN#F=HRt=n(RYuaFCxM6y}SkUpR`HQqq
z&i~x)-#Q^~-Fenf-LL60vcCM^UH$(3d4m@>&Y$`-gZag!B~sJXZ~pwT`S2UdNp3-=
zI<v*B7R9;>{yVXJ{tscbbsaBb)N6&cqy;8zD_MX0Irsi@oj~r`D>|OiQ-9uAdP8XX
z_N#N*Tc;hm@-*@NIqPPg?{n0>T%RmnoGU0&xl8`vjvF`E%v&5OHSOgjp{P!E2CLs;
z*|Y8DZxK26wML!2(^<NZCwS$x7}oDn$sC6KyDH91?rsQqy7uoP9?phsKFs%9Pm3<I
zDNhpesE7%fm$LC_OYGaX_m2F~bDkm@{BTO7YueAEM$3%Jn#sQJ)NZ}}vx`NpZ~eTG
z5XSGH&c5VdAIFfKYP$T~a~_ssGerXaJKN5_@p4Aj?a8xjH|ghV?v2>QY~$ndv^~q@
zcDr7(Vvz+?;TQd<O3SNH=9if=ADQuU?YGayA3sFtHa&^p`A{i;=BT`Uwcx@pib2m)
zg8I@`ZcP4nT<P<^ySB2yOjZpIqFa~bsA-=LZ?UP^>3wir!8%R*d2d&}>+&euc*3kZ
zsb^-Ah40$czuH&=uGcnO?iI5A@y=zzniU6pHg2eCjoUNtYzq74V<`_0eZ6C(y}8<)
zPt7gu%9X@5|2VAfu-oK*I`R70GHGLbi3=8zzLx$$%I(K(KS&E(pUD>}t@`=9=xTy(
z_9mC}mIruTXM71=ZufQf+a1qh78n0~>a=n0;v=sUni_vNW%2G(bKbgpx3BWYHBX)L
z!}nW9tdm|_`cf=->RJx_CA$=K?n%nFOGYe7@X26bdno0&MwE{Jmhi-d9@<ZIuX9KC
z=IQ1cv0gd1G5yEqkhx*eQmZm7`VQ{iefZCeM7HjXx)};9G{fJol|207<3xSMRlbj0
zb(gMgxxi~|{59+Z-z39po_1d0%MJuLw<+h#8wG!9JoQAol-n`l_|sJB_l`dI7tC%h
z%loS?qZaD(;Loy{RR@<wUHm!G!1!XC;kWD!FXZhvocpsSj;TC*)#J<?te#$C?587S
zpHHiL7CTpV&yqFXXS|cnpRLW?WtPy+9((Fy*nac1`-SGd7pr}f`0e@YBE~fV`?Qj;
z+BNOa6s-!rHH$^y@=<4p#_vxTX-%E4yewhG^RKfcbk$#MKjFI0@qJBg;{LgFe)Oe3
zOK<0q+Y}YINo7{#^j$Z139h@?ZXkI4R)WZ_FApR?9-iXPt;~EO+9cxe?yXyA1<#8+
z|E5qnq~|Q(BwJgHlXLd7?(*s4=GqyW{aImWSck3DcW&9J<O#YnIBiv%YAtTdr0q(7
z>c^YGE#tFdU;kBmC9_vsl(LG;_Y})8<!lYf-P>)q_srdSA`6n&F5mei&(vtCn!_}%
zC4VnkD*GfKdOPvfyPMW(lb<Enq%zCDX4L#UT{B>}RDAgR#{y15XCG(RWpC<{_1suL
zYtr2JMc4jUPARuP_1o&s<MVRgIh1Z2-dBmqG4^nL=5UMKCEa)NtF~6nxiidnRYdn5
z+kW%+Cf}E4yY3`}sor1uNbKU(fSFUw-cOPFd1k9uPK3e!*_T4w4-~R|d%@z9J^h}}
zD!%x>t-e9?l1h5`*Ex7hW_YNzbH+2X<CDUkt;zoR;Qj^uJ9U!+-mrf^<d^6CHu>J=
z_7{_dHcp*%WL2q2<KJ@i_5E)Tl$A5S+$CE6!Q#VA*E9wDv#-;*k8NFdy{_#?#hcuF
zOuPG!ybI*M#Qnc0=dw;M*Xty{O`jyV7KiO?UY@L%zJKB@F1w8q37u-r4L;jalMmef
zoG@$J!>_x9Z@Y9(+P&;kt%;ptyB)XF(vu#kIa{`T3T5ES4@&f7yE)(gen9M5q4$ob
zrk>1hJL+tH;<J9!`t{derxySD@KE&5#@XIF=RQtIdimnn(|Gws%9jt<SAY5ufB1oc
z4ttyQWZTp8>T11y6|PimT)ZlLdr;)`(wP;GGk=LpUy~T`n!0<!!$Uzi3g*Q=@mEcx
zgN4rL==&}ICD0c7#!Ry9`-hK<@7q*<%AEiI(`CE=;_r)l3X4PiM541c9$K^Y>5SSm
zog^!!GM$BYmK<SNa%#biV_AkP?}bn1)!F;v%uTucul(%GmOOA=qI*zz&zjlGyf(bO
zdL^)FhPq3ifSTUSrghw9bA>x+3Y%nayqOhS)1Gram2YBp;A>T>Ei20wChHyBl)2(Z
z%$YqOZicKr`(t}%kdT+O^{uCe-&IOUNSXMgYQNXsbm!RVs9iFb9<$s`HRRepUE}JC
z9Y<o4-k!8~U7F-6UAN!|b1ZkvMEhS_7q9lM`*DA>io*<tAN^C*6eoHp>4?PcNnUhO
zMbKkelX&lit>5Gxy{LZX)3(}miCu~IpG)Q1JTLZlM4yXk747Ak)A{P_y>lDN6^i%R
zznE?5=KA>E*&O~Ux!)A{{S!s{7;Tt;-8WTM3ar-n=rQSZQFiswuZG9xf36pdnRdU-
z_(|16Q@NUzCeeXK+Zfi_@~b_LKXkU|(zEK&xC=LR&bD1}S+cc%{*i;f<}iv~m~^bR
zM6LGDqJPu3)GgBuQ@ro2_~F@2d6}7eiw&ksYIs<!*%I`)dQt%ATN5*L;cuxM*2*uB
zDnHYv<{alBqIGUn<&{LSt4&JMs-{Y<ifcAk-YqzwTz-4eUk>)IsaywJ{%;FDATP<u
zwqloK<dW8xF>eZL?D%S5t<?2sTB5xv;n1p?Zwx1Axi-3IO`UjY>s~*-?CX<^)<67Y
zd`&z2@`i&KmTFq+xj0WTGC6-*wZkCfNObsO#}m6&WQC{Bx0PA>>G}#A9iw-rax9Mq
zTblE4=_{Ro@_ws(QTQBfo^;;*bt|6DwtV+QcwW+s%adw!CY$Jn#rW<1EW>K%!oS_B
zID6H-rW}{MKl`Fy&-D#{^>SL2dC0q$c~$Q(Jr8DDtkENO?M2LWmuaS--_JO4bp}(i
zXLEg9<cma6=Kf?EOOJaF%QOV<6iRGlx1D%My-?nFPU?Yn$?0#jUfjB?*qdc|LS%(4
z-^-P!CwsozvVGYsL-nImc4sX7oawcDOSsq5t}~*H@yn)Z$C_Wsclsk1J@IpyL;S0>
zgIbyaj2S;XE-|(>AGZzAzWMtA-_qGrQ=a`w_|s##@auuEN%uC!8>@RxUUPlRbomqI
z8JA*y{8$;tzf>*b;p$5Xhc{etQ%XB{zTs@<hGhQk&)o{lcGoVtSXoKN-dncUyk`4f
zoAT8qVduSd)?VJBV%yfMp854=GyAlYst@N))-Ye;T~RFci}%dwq=%;pnbywTytU@z
zxjTX!>m&U=B(;B)WgX^=`f%;gCohfFJ3M!$Yh2-0R+v7cx_Qom4T=gMe<=QYez4gw
zY~As9+cwN=oH8ly5BD*ZX@#62!I~92R~e`Y@v*!z2(9ehEM#%D_6qy{e^>P<cl-UV
z%+U+xy6wRFJh><Dtl*x;V)j+{@>fKi<`Q<(i8&Ouuutyk#f3bweA^x^&g;Iu{Tg$g
zab|UVci6P&(v1s_pUS^pcm4h*fora3bXk03j%W)pY8HfMuj4C^R$p5E@6N`BU3;`S
z<kKJf>g`|o^R)H$3&k(Bp6Hd{FTb%d<NBSx){w4QtRG!p1a_w=20p!^yGWF4@4dnw
zFS*WroNlMA_xK?HpI$Y~t8@Qn?2eiCv2UyQwfV>7t#5u=kuH8QJo>fY<(!~1!P@RN
zXXoGa$?Le#DmCqovFXX9lUL1Hmy&<^k9ERQtuHfmn6h#=ynK*XR-bU?MC;d*y!M&m
z$I8zzdG0#-Y2K}q7EioCPs<a%5Swl4-a9dxQ)ZL>Ynu<fDJFvcY<iEk9%6}7-gjyb
z_jLWj7n8(UCI?zt-7n()zjKS^#}}6zotAT_r{{|<+NT;`V9o!ZZJK81Y2%~{#fH@C
zz}hUMx>L(KU)JrLxpwu^Q;ZM28q)m@9UEl@q>m)Ji$7v{zLYE7nuGOy^AV|@GdI=t
zsm5y`>9QBy>=e|c9N#$e)rJS=_S=(Pr$28i4r7_^=kUSSP^v8GyvjC)zp7mufBep5
zwyiYho>Z}<(P~)>hg+}i&(rNE?<(K6)-&7^6UgfvJ>ib4^Q8L=9<1emwchnF+n4z2
zlU(omE*xyzdU=Yk`lNTiX6afkzS1zyUG4Uy75f-oKA5}Y9?y-JMLB1axh5S}lb)#G
z`Cj<4OxiKYR%QVoPh-~pVi~XMTQ=Jd$*nopVt(*Y)laU_bp5vvPHzA9$!x9z!`;m@
zx7!q^{bbqwPWR(%t{<|l0UMo8A7K%UIF&Wyit-}y`869;pIKW!v0Z0Xeg1E4Org^<
z`_HV)7yNy5efAum#TzdKHMuG~DO}y4{>Aj!!n5ZS+r-pVQr~xrUax6<&B>noZdFLY
z73l>EucP&3HXT!Ol;7gM)oaO?hhG-G+1tDA;qBQcihOQoYwb$>&TJcA%eC(*OVtbQ
zrG2JCKRwT$uzjHYe3nIE@V;FRi+82i1YJmZesa2i{(<G`>(3lDdcxdZJhSOYpZLj1
zOHLMU(YVbY{;6Y&@cSd2KV`l|9ll-lsNk^3XTS9Knp5Q(lHKorvHRH3dM2c0XA;k+
zb^G5PVV>W<AUmVa$9s|6@5K5Yj^}5_sWV=0)rvl!w}5-j86T<LCNtZ<$Itt5`cT@r
zlR6P=_letCSAG5R#@=0je%<fio0qUJ`5dHDcPiTJ>=%`NzW(ug6^?fgU3C98-Sa@9
zjg$CW<3PWE3um6u`(`gZu|L|SOu%}s<sNIR&Pln?KI+bDa5?r}_EKfbw2CT;S!)&^
z-d$6~&Fs#6((7NS+ne7BEDdQ9)kU{UmP9`9`SB#Id-cUVmG*hfD{dyO-nnpr#QY?N
zhjpdjmZu-NF8Ke+C0X{kJ${Ytryu?F>5j{e39Nf1{pF4561N-cc8EyUY^WA>_xW0D
zI6XG4=%%UH<@V4C54!ZYckoL+$?^S`!&k0U$oX4fy~rM`k_(|vBOGFnNbHx8P*sUa
zFc6v`!Tzeb-Ff8?m5cLRlZ=l|@Nm8^Q8{hNv}=>2Pw0qW^E0z%aL;HJ+;lD4`%3nb
zcva`cQGy{mr^fg<X}RvUtv?eLDKtyx`m63@ru$uK8y?OG;oHgL%P?=}`<t$_1^QAP
zQ{MNk=3mRlqdJu*uz9g;*ZPm@&dTdg=BlPWY!km`wSQ&|W1m%A?t^^2@U_1qnV2tT
z@E!7L`d$`yF3oq_s&(t4pSnLc>zv)j&hxC?+BmCZy`1}Y?qzSSPZk(FEV>?$v&1Zy
z{ia9p>}XMisMO!9el=tmsR!Qeto(L?WA>e#X&GJ(Yj^8@<nWkOt$6mVfl6>$R>g}q
z+h)1Q8OZshoih=VSIC@mR?Yp{cmAnA*T$`TdHweV|8DOY{YP#HWNF&A`Z6-F$|<w>
zw?T2gN9`lYgMFLl_4>X}Z}<QA_4<A<Cf^nFx9@h|t~qsP(7r{DJ0A$G6>NKFP#@lV
zM1Q47-;P!9T0W_j|9?L5)gv9TMc4J$eOR;Z@6z+{zMQdm+4}xlif~VGW2?MSkhtW(
z?{hZ$E|PD1^-@6oX3Mq~fl24&FT}K*WmwtK6|jxvl(gQuKA|Z>CTpXA?buRL8R_?W
zs>|V1wk9*LDmZ=pb#8Jq*YAaojUx{Pgt8}z&wIISE%Od-b>7)L&qdQiru}&ll53P{
zKKW?%jv0H5)i$g5%WYpJ5mYgIRltGjnV<F@lrKt{-674D-EJ>=HAHo9mSVQ~9YbHo
ze~%CSuik!s+0J$EJXiSyU!5$wX+Dqq#iKi)ELzfHZ^Aoub)(4ri#aiA)8|*REpMyi
zde|y>v*7Erg_8T0CAofEwIoO-+3D|@v~@=6ORvuV@%fB`zn+%hzwOJ8yy$rR%t6fN
zzu|tFvl%_=!95#(81ApQJ<av_pPa+h)s2#APivF&3@f@q=WSos<6j+7CE8{?Bj&HB
z8CUn~rM1UYzwUAAdGYA+ZFAvk=eR@7wO-uxmRaAC8~xPksd&3+nN-$|u=hvab01Df
z*y6lotHNQ^uQ|*?5<i^;1>#R$iW6SSysE-i@XX!VRe$asz91gQxk^aVEjHlE;*(|Z
z789FT7P!3dH7QzeQ@HDKt?tc(E0(O$QEi`eAo*WK`^BB5s*-1Or-nbCcfDWkrp(*F
zdfWetnXk^+%p6i$dQ@d%-;Ue7LR(a)TTRoc;5oE2n6vFcq}yuA%418jjEwh1SS2!v
zwanczRbuxFmiY++yEL5=7u3EubGW;^o6&9dhEv(SjgHTErdAaPC(V&j`NX~U#%6&#
zyW-EOe0=|JDrd|~)?k;k63#i3x)+@OtF(LDYT+AgXRXfY{V_B=miNWd`(CAk_O|0q
z<;+W$?TmjWtN!9kZ<+5|p)Ag(71jpz7OC5vTYlxP(^;o~Wu~NlM*M8egS$JUj$e?x
z{(oAPg3UEQ%V$BV4}MC0d%x6o)yxQKW3|_lgJOgBZ%X?cn^DT-w#3LJ*JkdF(75=Z
zbh&@0zwy7BXZUFL-NMBd78XCGW^UP7khSE@hi7+#`W|-cA2aUZbbeI6>w#$X=2iEY
zW9#EOH_6-mU8mCT_2r*vRC4pt6;;{)1pZg<SSP<pTsr@E#>ojEgsMDD>x!#=kLXU&
z?BH=Sea$PpR`)QEdIbl!%a=$iIlZOIbGF95xybQ%mAi6eq11)Kf|r|n)OapkSs!31
z<rw|5#yge&-v!;bs~>&alwI5Dz_c~~{*;2*g}X9^I6i+l_9Rw#wOE0n^|8*%WhQgF
z3toNEO|6NaQKS%ma4o~3_rI=vGrzm>04Jj)+v*)!4@0iL;m!V3$M5s@W7U;4$Ar!Z
zzu&p}Wku|<CljjkW|u_Bw7I{rTyeaXf05=<F~;i(bC%4T$CqZ5qxelnn^E^nNNQx=
zzL~<=pYEnL{@b0i^7Q{55s8*Qh6#SBc0B2wm1a;UwNtv}|K$F@6zBHBL^E$0;pf|?
zRH_v0{}W(!=KNe=1@+uFS69v0os*US!%=JFI^MDmIt86=XA1JNOJ~GhH}{|Lc0uJ)
z-nxlDIDY6a*^*nx(y4#!sE~8YAA>(8DNo+moN&BVEy~BWy+7^n=Lh*|Dvh<-^3zqf
zoT$BFd)E0DbG5tZKJWh<*Dx;+{o=*5acQSI@A{|PUt}9!_n))Cx7K%`-t)%Gb|#|R
zjy>wTf8d6(A4~e5?M07U#LscPyW5w{tX~<*UswJ81!zZg&HvpmW|^Peqt&!nF!51F
zif}F88#R|q*}YmJ)v{~1J?V42tNtb6&?Em8*W&Fn_Rfz!`{Q)v!M7o<r7UjZBKr%!
zoZb_VJNxOHLp+_f+$-w;y*Tu{>5;u1gKN8*L(1p%`|7H`J-WSoeOwKzu(`tTSAS<u
z_xIm#$}1Bi{&C^Ohe|ODuZ&hrPZmp`ztwP8MseLGtLeF(Wr1N!zTA?Twf$6>bg<8v
zw#bRM=X!1Py4$Jd`+8~Jv%8;G_gq|JUwgahgtXn$dUuU1rz$)9wo@_sNur9a@=|(I
z_3p2#x{SCdG=FY6l*j(d>O{<2;TTti9l3?GG(=xU|GSd<-pwFK$5C<jndrnB42F+l
z3<OKF_ryuFge&Nk_D@><&5Wb_`@QA*b7npApY&(v$3<+-qD2;JS?edC$$s#9M#k<x
z>N{NAbYJZ43_o7~{#o6lI@hMf|BF&JBTWUu3>sd}Kk)yh@gMb^`B8oI^fJBqsyo*8
zG|T>K`1IH*r6Q7-+i~Z7p}2`lY;63q_)j~OTD;xu5nGq8CHL*{jrSQ$_pU8tzAx-C
z*JZERqWXf=2;;>ZHf0m1@GbLw6m@39y;m($p3DeMcJ%xg=saP!m%E44Cxf%EkL%>=
zoc&^#YI*tL`G;{;Qe{?pYqiR1XKXT(a_~w&vN!X1K~>f=6JPhJx4TX&%;{aW;wZ<_
zEwaxR-oLfu>Xycnsxc8_+8O8Ps%UWVuTcITC#^rp!8_<zF+<uWb)6RX7cbJK7xbv^
zaaT*3`L|--s_zT}a?8(T1RL^g(I{l#y*)vi`6OrgvP~N%8t861ARb?ny7X||&-?0g
z9L`Q}YF*(zX~RXuh1^p&*SmC^ZP8Nx{ptqijW12%Z9gP`RkwRjy7e=B;okp0?&?jS
zBUU-Bbn`W%+C#fmsHznj7)|!|?05TjIHakrb}RSC>%3<at}>aQJ*{$i<NwCwbr0Vu
z3vA?HpJ}B(?OM{MixcJ9*%rKe=gcVe{UFE68=|Y^>V7<IfBeSs!z&5J%Tu1-N!zBS
z{$G1*g!1XjJG-hJD>i;D{`l^9$e(@JS7;|i?mSm=(5b}hp@4(8F;5)-!fj`q=agBR
zZR5Jl5+T>3sCxgl^8QKjXIL8K3V+#2uh3OK^yf#oU*RL;>=h0EvMjp<JEhz?t;&qD
z<kQS*jaYYAhBk@CW%3*Qgq^y-#Ag3WDgLJhQ*L*#uXEZE6?pMRh}GMdiG3Quc@3T6
z!Eq0}q7U|(X3uT+Jy)=R>5liW7g{wZBK@K>owpwFoTN67<>vXic5#tKf(cC#jn13a
zuU|WJlJ7%(DL($P3Auk`-n)vai!xQz`OTgsp}1SP@!mY+O-6YYud46z<~%8>j!mi#
zHg3{6HCxsoB|pR?Ci&euL*t42?oK%S<*~Ee>vK;YUvNt7cx`si@Xe~nDxUuD=D6ti
zRR|~P317A-WuM1=qT6Td=PUY0E-%gAw=MQu?leu~73TvQ_6dtviduwnYWG;N?I~Wr
zBY`bx!ug|09kbhmb}v`FmA`0~T~Yb_jcV@}FGyRz>dWm+79-aBR>rbj&*EaZ`!~(%
zy%EhIyZ?p%j=xU?`x$g!A2N8h^m2^4&x+_0wXlccD}rR6%j}(CvGnnqoZ_EqQyYDD
zvdE{e|1mxNdZ{U&iMvq#iy+sz7n`s5WGr0A-L^?`vF(vC>2E(i82_HN(B$BAHP$sR
zdyev+{2}wI@QiKon*S17b!Yw`N<IAHPfN_P<^}BcJdZA%@ZED+OsSsx=~Z7g*FF1j
zq-85-)dE-9{jRl+)BP_LF8W=})UhQ~zFg^rui%lhn_|9h*fvW+I_a{4u^02yg?^8Z
z9LV{juyHxFbnYdsu-6~??%a}&U)vCO|3EAs^Ty0gTcnqN@9X~k^l{b21>RvN!e6{U
z;yc?<b)L&}hAxF|TaOg*oV?ibyVrcR)geC?qnULUebZmBDBR(xq587?pvd3p7p8kW
z;@a3`lg&AU+30{;@7s+m1rO?Hd+f~FBF@^V+wJ;dTYKk$)u$8G{utc1D#<fHQN<B+
zsVz{_A;`Kt>*9F}?mN}rGDDhe&cw|w(tVNWlE-m1B*Zp$x7O6GH}2{y&xYNt2|suG
z=Tgp%iyR8J*x#Svze8K}$Fwftu8PaA_qR^dUh}l`Qvb&be0%|op5G*yj&09kIHvY~
z_dV8iE97RH9Wu{r`yaS_|2E6(=kk(6wAONoD*CKjcw2C?yyZjhn{qc7iT&#DmQ-t<
zew69u#5pEUewgK0$6PUJ(M)4wn8Q#fTzB|XzDUJ7qt!BL^=(Jj<j<Henf=!0!|m%|
zxxQ^&vW79paB{<;drBuy9A2EDHQA_oTJiBjx%9*4$_fwUwlO}`b5>~YYFA`RRb$$J
zO2kPpcAAjj?>6b;T%WHsHPx;kgM2z>yL`#*_TRbYwC4t$AI__aF0%*!Qk>9zb=SeK
zZPp7iTE6`5Jt4hij``!ztufQPYqHPVn|Ah9|FkgV7C*m+N$~hjR`s|!43Az3imm=B
z(ae@Pr8C-4UVplEIg{`9vdd!p51vKU%=qUsS++l1zV2CPk+`+br%%ssUF3g!eE+>v
zmJipTOEVhFz2^Ga`*E^+zuZOr{m0_p*?+Gp|GKsImI6=RyUg?X$C4ciWZ3>i=}mt;
zKl|Frb=&-_0_)E0b$hf`Z&vw{o*JHcTif2>SkJRlWcn(>{T#mhZi~#X>sq$V6!Yq4
zp0BoU<%jH@+vI-aD_7V|(W~H3xOVss!=rB#x!9Lp`0Q?$a-eMayZkMIo`I#)g|9um
zyClIS*}AVHCgsT$9@}Xhj=@YV+9{%joJ>`_7e<@zRDOGd*Ri82@a~*tGXuT;omuJn
z_ob@%o&RPAdII)#LGv8W-TBH;rnqZku-}10mzVe6(Y5{X*gwJfmh*w;EAqN#52n@5
zdscq1<9)lvO&5b(&SlYx%yT3v7CI$cm>)T@kagPokH0*0CtPnZdbi}Ju~6fOPQQCe
z^IE%~IoqCTJAE=W&E~fcANQtf0ZPJtY)MM{4A(RG@ZUJ^X|khZ{e4@vR}EE`0m+}A
zoXz;^wC;xg;=saOxm5*QW+d!05IL#Q&L8G+zUt}*nWRlKXZbnS3phjvGl}<jHcnk=
zn^#brZ}?*SF`lbmH20jzW#VVwlf{%VBZzeco9x%BUiUc<W^Z{uXMOMQ&F3c0c5N-p
zO%-NpZq0b*I{B+b6zj1@Pty#YTKkesQ-7VFb;wEe32#`}laN)7b=~|;s!tZ1IrZ6R
zYGthC=d&o|Na?)H&G<%riTD1k>dS7eJKW>CFG#sU+iJz>tcmU>W}$1@rQa<(KS4c`
z;pvT4hI|ay8ehy>^FnfIt*K&5(B`ZsEBE)_)$qApXSl&L;biTEcMDvkzQ4FL$&zDr
z^~BAQb;tMLU(Gvviq3+WB`I}9lk9VzvBpeay(-2hZTqf`-U@l5`CdZT9)GmGQFxYT
zx$qZtdD$9P1AZpse*cwUyDHDA$Nic8_iuHvg73Qb6YgtVGkeWgtgH94KeXR!&7Zzw
zny<Xhxo({#6r`AOa=+n3mk%?}6ojprDCo&|#n|I#FyBTG`Q!c(d`vDs7q+Mec|S~d
zyp^lyb2rXw-zf%-z3c9uzjpHX=i*}jkokVffnLlKPvX}-Z@4X-DqubLyyWDIdp@Rx
zu76#4_VtWvZqD`h!i7(k^6)%OH9dUg-;!FcJ1!;5>b;7)MFo#}1xwUTkleP`@Pmxz
z&0SfC3fUzu`6@)_B-}36>&$yBrFX4lp=6ya^G*3<eaHR3etXIMh(|0*^~<4E<)$KL
z*-!r7@@cJGdbEBP_kYK;t!`q=-rQ4XNQq%sK3Cc78FT;s32xWkeJ;=6{oBT>&Sd(#
z1@?K#)6N~Lx>r}UO;dAcd*`Aa*`vkhPZ>@9$SEzq@YdA2&80zd_P?gb+jChyHL<T$
zs?^_EaQo3V^KF;6<=EI-o$sHp_S^^i!!_%J>Oy8rvie%&bdlj*(BUA{)hAZlWlv*G
zJki(L(ooxccWqXm?;Me{rs;p5n|$&Up6F|)`uxVM(9d36?99mxhb7BXH}O^f?rZMc
z&}=z5`;7ONtbmdnHmm7HF|un)<7eD?^lZr-LC8@8$q{+a{JH#A?O)M9%QTd6Qd7>B
zw#l7WL<>?E3kw*&HLJ<+2{31!x=YFZ=*P6yb8j|BmoDGUe{reVM+;jsuNx;T|K6Lr
zIl9bg{}FbDcroLwxlC!VuJZMCCA!F5wca6edZw1Wd)IQS)8YkpK8G;n$%%zpWHc!0
zCQQ8l+UkB#DWmR!&rg4uu{qvIOu6(eX2P@dB;{1g*?&KTta@v+{omrfcb45cWw`aY
zLKokyukD8B^DZBEoIJ7O|Nh<I|NYb0VY&QMZ~M$sclGo_)*YC%wqVKIC-KU&eJ`cP
z2uUp!ws;%S_gyGdj&)hEdw5)SIghc4d{L6G{Sx8L8}+0P@NT((cs)b2=&G+>o7TH+
zy(wyO<h|k4%x6#5vHZJPem^)W(OB<GR7Rfo>qpHipPu<OO)}l^;)hkHvK{yBtB+Z&
zi;Ug>c+T603QKOEDOpgwR_>OlWLo`-e1qCGCzp3`c2m#!Jkz@&dd=r!OSkHNS&{Tp
zNLc8x%$rlmU(c3{-P*LqaKFv!35C92CY^0yDrBnZFNn51bGB4fGFFrM`XjMhyDwL*
zaCrE(v-AD_%3uF4OPw`Le#~;hw^e(y){ND`cN$k`y~~<-v6Wk(?fUDVZ$3Qx^^N1=
z<Bod=8Ty`WcR%!5<{@uEOV%mnX<mI5!F_L*$$VTU^Kp~NEa4v!-g}la-#ad`f9mfG
zy-`2gx24Q^79hkgFz0m3zO%FE7#psQGPxsPU8}ZBqikcMVET`fYFp<XGuAKK{c6(Z
z3oqwhJet34UGemeYss%VlUj_k=7)aIdXwO_`PT*iO`SJ?bx+D$%eXOdr%7is`y<Z9
zk59*ctX{6w6QWrDy*`_F$?m&uVZxmC2i|}3(pD)C6gU*lZa@9p&9Dmp7c(DjJXg1Q
zeo|EMvVcyRAmz)q-z7Si-KdZ{G*K{n=ftAWr|lnk@@9VzoH?T+X3_;+SG%Z?&zwfC
zDq4|c2STI^QeM?P?`u-G7FZW{^NnO@s!kVc!v2`VS5aYqmRoe!m*1+NbB6I$6nmK!
zdmQJB0-s#%7h%rHOu0uRie8=6dcR)mtMHyf>C4_comRv*Z4cMQ0)q`1ddn9X-(0ol
z$=2hJQirC^5T6_%Sp4nE>D!9`mOpoXwS51D`Bta@xTju{K9J*h>hR)+>ONVX8;=V*
zJDvFY((La?*)tb{Cwe{O+Yl_^yxv{&%>*HaKPo-yH!UyTp7*le;rCg^k1wyh54<KI
z%&N*2vbWq?J7B%F=!!YtZ-p<AyERMJ-@pDrP)l-1-~E{BF=89ogxG}MS5KC{`N`kF
z_<(O(W%sMYD^|KMOPz7<$9$<<^%lIj&1phgj&5I?^l|q2YrD<ZABw5?JlM1D+Vz{0
z8%1tvq^nvk3vc|IsFHAT6{C~>R2%Wq36)RzTTYA3C{MJS(XiR;ysDSmoPxYx>|bUV
z?M?XVx=}~(e(b?beyg=T+vOD+%XtH0)n1$COaF^s*Zn{G<*|#dNoTGu{I^o}|LV-+
z_RV@ntaE;^aH>(XSmr(5m3h$|%WI3j3hi9-=iS7TTK@eT&&&Kdl<@BJ1OtzmiQGq@
zrTjSaXg%kO^6&k3ShalHN*+uNK6)tC*R|_rg^CTEXt%BN+ihN+JV%!1xs_zB>3O@y
z<jb-vNplV`NgMIh8!wBx|3H1l_xw+1rC!K9xTvvW<C4^x|C3!S7aw|S={7IT%;3T~
z`B)FHl>gp|w&tff=N!8y>+?ur;oa|xO-*xubZb1iXYzaYYV|j)!mHI^Ont8}nw+nY
zow>b5?9iK#RexR|ewt=h{X@UMUis_u0NvHy$7`Mcob+9pRZ^U5urv1hQyJOrQ)`}U
zPW@2v?Wp%hH~Ew@pJ{g-#Jc_$#((YCX?)9^%b99<uqk9ootnA)CHwPQUi~j$MV%6U
zI{oBNhXBQg2L<Gq7BXCaUi@>#!Q-iwk-BE`R~GEkll~;)*p_l2E~1jTx#4~Eopqbz
zx|qA%!aZ+p>kaWVQ=8NlQ<1fCuB5+S^h{|MQKM9mtcBBA?`EY5By}9n=lk<f_CV<7
zBx6SH&r7?y{o0+x*yI1bw5|WSY5q4JFV_{8Z<ke1E6U*8v07mHng>#`Y<+uvX6wYW
z+C134et&&okLz8tDTZvve_v?%E6J{TJUdy@_Rh4@n-S_w?dRoe0vP7Y3eA4xdj9Q;
zQxl@}>QAa|j{KmtQEzu#Yp(YDsq>mRd5vZ~RIuK?a@m38BuAI8)0C2V%Z%Px&f)%W
zKcwlhs5bxR{0#ye*BnzUXK!WV=gl&IXts#y&9;x*KPG3*iQNC=aqRUfb>XuMGjz7x
z46d<zxn$8_UIq92Ti@Cqw)rZ)>C>A|hCB&2&kGfkf6PC`*Er$T&Egl&h2}n*ytCc8
zUV2$=n0mdu;5PU2KfGnHE|<Oh-z95x#ORJf>B5VDPOPwa<g{(iOikHe+j51a%fFx7
zs+0QqndO4RJ3f4_d#<yA-R<(h1mRt&y^lJRR(dF_oYVAN^yEuO=I5i|F3LWXO<b_$
zzJzRIt9&JYEzeiK_VQAJ_qiF&48a-2Grl@FSy?qbclYhAx~n|z5@$_9*Wr#m0x1VJ
zpJ3BHyzxzcMpKH|s%cyQ3Y@XXEbMugIpyo`3J2*MT|55wE5+@S$ze|ow5XKc>++A&
z_GR3B-kQv;oJlfXqUlxE`gKfknjzoc?U1~7`bE1U?~}=4pOVW@^F6xU{=w4h^0l3R
zJMQMZD$w>ldb`sz`_#E(jh2_*#8=#|y>;jC(SIv6XRwyI^?c*aVVHQX{eP+5pZntC
zk@-L3Rle~2H#d~nDj^khhvWM!m48{sg&*FqtLRt$=fhm|W54vJ`smfM@;ex7uQ3bU
zXVQI{rJMIbUyxz?f@Q1?M;A<~4}7tBN&4c|dn>X|9I2i1!rV++b)WZlM>W+FN6oyO
zy<dc~XH8^Zw6ZbSM@{b%Pq+WVP29RZKOQ<<@32d`w5N!xG<k3In(*!aib{4wul$+c
z>FF1}c~O$gzIQyk|Lk0xTzcuDzuIoW?rFPT)-Ww)N@pt07I0R6``JP2W9RX67v6{~
z?&*-bIj88F>BZjIkD0nD-s_u$7}#2-?VI3m^>U!*jD|1ICl!bmU!D3!`ESYQb=OU~
zT2hWITI{&)?@{a4^PB<Qyie7I&)qDk%e=cU+5T@v=iktTH*cRFzO!24@LtaJkiB+~
zFYaxR?<n?=KE5(=cIcfx)eSw%&27ylvTF!9WIDHO*vuho<MYyq{mjRW8PlHbm=)H+
zbUN$Lx#NvrE*-!8_NOd=Q{#%qwKM*%%nC59+IG)pRaDMn_m(zM%fr7mZYkRPW(qT3
z{lAwlet7ovaW*cxdwHTX{~E)&Yj%A7!Ex@!s(-(~SMjVdJoS3wvSNc1d=*J=7+x;>
zRwy^&*y9CP{{~*WcW?E7AHfgjMHs8zC6)CEg|v%z-_d(%YVmbl<Wb3sheCRVa^-mC
z?W;^`Og4yJa7yR-*P6#E-mvtm#U>7qSDV*tkGxU%XSdnY7K1m}(~p_ApYuvGsG0hn
z<wxKG!waibjP34iIx;i-6vL6y?E%-WS=~Kz!;~%EM@YB-;-$HYHEiowtz=3$vu}pM
zmHn5hxpjYh)m)YB<k3DY-MHYmF{{uFi!_D(olj<Y`o+umS+m9;40`F%`}KTUksjOB
zQ17cuXA2A-SF*YoZ+^qHj_>B?NcN=;l6#hKaqV0E_mfNEQuC$Oajy(}y^mLBzIk)x
zg!7tBE{Urhxfgfq9;^5|tNGHlP3mj@dK5nGbdR4`qGxv2?e-Ge!Yg4GTRxn4c-vDz
zPUp4<ch$D$EjiuxuOFRS<|Djbw4y~x;h9oYq3Kf_xoxYHFLm$c3(83N`g(Pp{oY*u
zzs<W+tsiw;Sbp5Hr{`t0tY=Sw=fyQ*ho0Q}5OMpY&-YD!r@k*WGH&6%^=STs+(!zA
z9}DI-AI@1nbMB!j>q=)_a%amlF>5%*5^*C#i*v(;NWX8~8$KxfJ<JwSVE;dXQLKQq
zZJ*5?`*kOurEZK^Jt?L}(=W|5!OZPdTyfv0*3#z|E$bHU^zvuVw)&D}vE!4^dH!QB
zc^)x*EQ}Ul_nwh!DDz~_?7mwH`&ynG>mN6mx+*cxoa<r0$&3Fb4}a_zJKQ)g{MoWn
zQ}ZCnl(>b$D$C1{yOjK#>1MF<nn#ZK%7i@Izv7O(MJHEi|NC72CSv7^*Z#fE9Y?<N
z*%UHzSzrIGkgHO--$QSW)MVCKtf|a~CqG4cJig>F65!jjN`79Uhf9|f*G}hUtbWJ!
z<kk!Ie8~U*Dc_$-+O0SBbV`UI>yO#HIHae}`Y7~lf317svR(0qdp}<)__^1ZOS-C4
zhFk2ljxS$a|B{n${TiA!cox58pKfb?WV*Kgy-RoZ*Sx;<<JPyX<i#94H<s^7|7Y%W
z(Ld$DL2tgvwi6TC_1`KQTsLkG&^I~AE>^dcyMCFMi|^<ARorztvh(jeyl!i{?BC!0
zr#tqRe_2xhfA=5Z9n$>2n`%FmeLl2!!tM`7tN5nvUtrBPd)52DcR#(Z-8uQ_6jh$n
z9QWMZ^S*m-Uv$^~%t6UTw;A5;T=6RHM^*7tz4pv|7f&CIJ$?E&bJ>jb9r@M|4$7x+
zi)+>isCKSZyZhtbu6VPXZ3~^xTbzD+owcjxl6$mk_}5vNO*EJC<!|U>aI<p=^*OKq
zqxh^x;>85(wJ+C1tUuj4y-fJss-G>dKP2@%Da^E1TGZQ|wf=zBi7Od19zIn5v3UFW
zgFGS+&Yj$$+OEhn_fSnl!T;|M^h5hM9jfs$YVUt_EWG<>fE9~mlun4-_rmOrMaBxs
zZ2iJ=yX+KXQle{{Lylf8d=vgjaPPZ_u<&JlJU4diouv1#Cd)K7;tR9m*=83uy_GAh
z^RyReGv8g=q4%%moYO9z{O?J-eq7$QH=65JTfv)a$x?-Jvc(6sKXN#4E%_^9i&)vm
zq7$`YEm!W&cM_Kua{jSQX9DB@ZF?ja<y#vxHH7T7`8DOdp?>q)vbH&g7C&6SvCsPe
z>sE^_)#p|zcGaid45VcRVzzHS(YpESisR90p%#rxW!VGUH2Lf6A5JhR3tV*Vqf7Os
z>0dAXnRmDMX4K0*{kZK(d(SA_&Xb+KSK;crkGh>}Kii!Du)aq+aK*$dkE&N0_kV8s
zE$3S?{atj4nrWBJ0%z}Y`91D+#`Et7z2rS*m5|&W*y}uDS`3reWT&{~B}T^-_q)rx
zC&Z{edbjpg&(`wmU+&N1V2R-PSf*loX+~Qv%eI9x_4w@)d(Jw`U0C?EqcnY)%O=hp
zwR@R3m(Q6q_4Vf$U2-$BIL$u$B!@Px@$PmJIa4Pt_IGMX$2_LZm)Q2NGjw?~C0nLw
z&sy8sBUj32Np)=&@wPCOaxq_CQupcYW$XPvv|r`$^YQ(7AkwSw_vu=F-t7`4!R(u+
z?~>iOY|hfIjc?_TOL-mp6jJvtBGSWtjUi9Z<Ib|RS}vc%Ht+8g`@Q<%3-^xbNs)fq
zy&bH)6O$)+UQM5JdRB=0kIUzZCeN7=Bes0^o%9;PZk@$7jb9fXH#l{DuBFAFlUw?%
zEt5X-Ze3G-y6(Ty$DS(@%6{iMrzDEW^j`DV%kMq%Y@t+L_ND_%zU_-py1#KNzviCZ
zTVpjCwf0-@F5h9eK0H07=j)>6oR}N46}K^cUZUhLU3ZaHdch>~Ja41<UmkvnT5bGQ
zeSvL=+rr16GdpK(*Iljdbv*WVZ%0(cYa#Ehwtqrvy3e^9COrRoBwlir0zZHGkFwa9
zrR`62i?3^}DQGBi+${UM`{V9OE2qCz`aetl*<6W)*JlN6T~Gb1p04@e-Mq+IhYU=e
zR6nz599=Azc7K1}zgefY9+X{rN=Uig)LlL1{4V1^hhJ}gZ|oPaB{EP^kU5jT)L!40
zY18_>`Q{8Kp79D@QQvTfOIK{ItN%Y9Daqs2J<2<Bu3eQXpRD95eSe1<@5#3}pYD;E
znIpif@T1~x_c7lh*6%itW}Q>^oR+voyh-G5#kuF=e=kVLPVko~`@-Qe`A4KgZ~7<k
zstc_L7B!sT&$@o*x=AnR)P0W6F3P%gr<&~$^BIk=f!(uwi>>dymG~WaQ|eam0tLBL
zbxGH9VZW}Ym(5=G{O@(wU3l`-?Eg{%l5r2~6HjU0lD@X>OCJB`vVVuKJW`z7cI`+1
zf2WHv%)a(s2QPgQNshWQ|7F{osYXV9*IpI+|Ft{tq{z1RlGBuHrB?!uxBeIEVw<S_
zkZ%W9jQT9Qto<MDcW>!j@$Hj|lg^o>Q|ylCT0h=7@|W$R@{Dc%FE7fUs{Rmea%SiB
z+-Hh^PYM-tD~rke`S$K&ZQ1u9ph?}L|GPcD8Tf8Z7Z4~Ba&uGu(Hqn5#ymA7vuTx3
zZ5PwZKq1GMho={~iq7s#YgeidIb$O_vHgm=UF-rO#*h;eMBmEoe7W8HbKks6#nOAX
z?2Fr`v7$V1#Y-=?%&TIWb500<PQH3PPJW^l$9=Zy=SB4&b03*qzU?CNvD~P8hvG}7
z%KMTFtID`ba%}g7&AWK)ZpWX-6Uuik-%OciqF3@r$@0_n)m6o%bN8AuJ-+Su?b?Rt
zAFSUziQe3pfAVbfk?Q^TR5O<~Za-*z&~idhmhvCP((tPi|6{qtHLf3-x3}`wU-^<>
zDmCUunOZ)atJ-T{|1-$(H(NkK!-<yCOG_Rd`BYZR8!+S2$3<seB{l8Lo7d^yWV2T6
zeSr6~G)M0yTZK>el72EjJl=NFcc;nm+~;SPz7Bq#<-!rCwUb5j1OGLa<8HF$GAlaQ
z-|oKnXVS--M^jlgs-I|ovhvn#2hUgAJZA{#+lg%4{3NwzO;Xehv#ctf?$!fKbI)wu
zq#C|;-`eI$^(G&;-Ok({aqXsP)9W{UkzFYgZh0=-YrOf7OsR<Fm@VL|9LeEeEM_;u
z!fVOZS8F7M`CA00zGL-`a9PW>-1qb4g;zcM1Kb|*pMSE#b#u++2m}AgOBfE9e>qsV
zE3x};S%3AV=IIu_X$)`6XJlS9d$?_G=Io*u$pU(@PeeAkm~45`ELEqi_Ul~3Jf4X?
z1^2U#P5s@ku;a_-nhQ^=mh3*DADyyqg2254kpaEtCmtJUuW}W5pWD^+{YrR&M9rer
zTr1rRABkm%6iHujWO>gdvG3Qfmp8lf=kKff7;3lS17ZR{MtxiRjRS3UlepHn#%zvy
zk-Gk18*f?vO&en^wj^V*GW)VydzkDEE42;>oI5gWsqMR&d7N#Z<n{X3)b}q?oG-;Q
zG24kZc>Q#K?o-)4D|<i0b3T$OD!34^sJZF$>c2nF8tW^!{fK)tFZ}6*VA-!>Kl?AN
z`2P6A@srK}^#AR@!&BYv_ayRx)lIR62{DZxHAfxh96!14Z_30@raceYR(QJz3Mbun
zn;h-q*2XzA&wAC7D9-SwO6lMHYv<o=lKnAVc*6YKS1$Snue;{Bx6=55<2T_~VK+4I
zXH7ct{mdb&XD{V0|1vK9-gaQy9>&d!%qy(^T)lK`Lz;1}ug=1-H-BCfii9@I_d0NE
zu4Cwt6AQkaKOY%(;(%B_)BAmuT*u|}OP{QseBhSuhGPn=ST^`EKj$;`t+DKR9DMfM
zTGu(6DVCidn^qs!zdcn<-tO?q&LwG&MP(iw2=EVH8*%cE@Y-1w?d8QOl_&C_=H^UI
zGY{?GeZ-Nm)Bb{$Gz04j+wFGeMbCYaXpYz+P`-t$lBHyMtJ02HM|#|RSG{(0>&mw+
z*>z&y+Uv`Y*)E>5Ct~fZscoj3>4s}+8y9p4zFz+!Y0aD3Y@exeQg_3i>O5>oI`-(S
z)P<nk0f(L3xup`<eNs4Dz+`yhc+d(<#`~+eV<s)X*nZ5!XPFd3p0G@?)}PW^*C})S
zue`ifJY7?2iO-_Uwc$(lDg;h>B+YbP^!%^$vF~&L<(t0xuj}*g_ff%%{O@INr`>W(
zKIGhY_S`b5$mY2cFK<2U(b$yMEqM3Gp94mRtgdS3ezAC3e*WPpkJ?!#Q!4fqu4~Kr
z{XIHnW^J=~$uhkXL+<boA5?Z5*9(*$agv_>Xw{pq{khuV83)*I+^uXr<2*aGZjRC7
zXKWU0&9@ZB&Ne@OZ`vL9`|8^i?EP|mKFp2F`r+{ZWz??7cZq^qg)dAD_{bJ@;#l5^
zGKMvKcW2)amhO#7*?hcM+Sabt$IR|z;zQF5>fAF;zNW8Ae5}p3#f~9TUpnA8*TfxK
zt(RI^&5oW>a*Mi}x0HFdN!Q6E1`mV(7f<*wdunh@MC1K-r&X~zN6yx^DJXJJ+brm0
zYk0)vwewuRgBlOnn8d;sA5{$VS13tqJ-1>)k$=_O@<NT=U%Ck)74J<qFS2@?=+}QU
z-R|Mp>r3?*SiU^{__vg0YoJc{o8LWBOuhTv?uIO{<re5Xzr15h>FirCcj;_6;CrNQ
z68FsI3C6yEGp0mrWn*_(t<bTidc~rIg|`h4zEn)NKak(v#&K0<Lu|L&A@?U9TY?;T
zy}#T|6a1xKR;|3wtUD}j$>gsuihjQ?S#bNbsNSCB#p|r{j_sGPdnr73f6v=l2QvCo
z&KJJemE$8OIpb)G@wU*AuB*FdHK{E9qhoi``o(MedHZVK-7S*!Q+YG_;-fc$J65!q
zUv~f5<kH93IZN@HqKZskY?jovzuEme&hKAUdp|tnZO-lc{m1VdSJ<|^t=|0jhcFAq
zlYTXOr#I>eUfkQxsCDk!*4ct*w(p4uSQ%ht?0Eac-02tQta_lLl(?wS+F+s4ys51B
z3)d-J68ch9eO^X;x}vC0RKR=@uc(waDdt<)ek$$06Z2I5IQzlc(gZ#0Q&&{4&y@{$
zHEFSk<?fhb+3&p7J9BpiFVap~F0DK<!Cc{tMo`5k-$^0WPj<A%l?tyq@49$R*E9RB
ztLu(d)@y~Wjf{P8*YEcAz2du<c|M%WQ6jUixMG#g^7qa%OWi$Jy9!kr-LmZ7`+434
z|7@}6`!`QovTW|uXI8maQ$7`>ZK(MX{Ba+Lx0{gCcGg#nd8ejq+WqX_jKD4)Mpv=D
z-)y{2PW*W=|H5TE=4ww*--yi0?cdzexDr{*lHyiMC<~X^m^JQtzs6}w*MqCuLL5Ek
zIs9*YowR4or!v{L-2w(@Eo5WYue{`3F`sRXeBNOXjg}(DBkIpBbIU#)lsV$2=Hn=p
z@SSO`|HBh2=ZEf$?pn;S>3{AysRa%4#e2&u#dn7NmNZDH<p1;U&92hYbZOOnTR(g5
zVmX?9>0&eM(_M;h4r}=JD_@>;=JHLSL@VXRCT^Z5BX|6fINI-%<o+&T$2$!jmFu~C
zwlp2t89uc{tVQGeA%WC$QM*)sOEsjkom?3$CGdA8`{k|WH{P;mUNf+l(!Z#5pG_-B
zxn<9{c>8w2xW8t_f`1tIC+}Ode!~KZ`Ex$)_qW($EZBAO*is8V;m?waW*dH9_|VGE
z&hBrS9%gv@RVw43xp!iXT>7|GyCp;UzWx$Yn`W<2abZ>D<x<zoNCS?v-j}-4TLeWl
zy6ShBex2=lm!tgNo&@K~3oJgDvH0(~w|B<7thvdvL%+&RHeCP8@_W)G69p9><%y?z
ziWN7n*G#{-NZG>V^7otCDi!AoeE)~6@!^>*zj&9Jo4qXaBguyn+o$k%r`^h7EY!7D
zFS65|cX&eG&M#M_+5U*?=zlPJ9ew+3Szzw0`<XLBES~=HyX*5^{HNX>W5(0<(uqnO
zzvI_2Jo<a|eNlgQ-07~B>;Cyyhi{(k#?$h?vdgzx!D9-0N65;li#+x|x%5rMm1C2d
zQ)I-JI0ubWyUYK**~(tc>2hb5^v$m~=0)B%etdp@`}3CWK%Nt>C0ot}U;5Y)S|Z?=
zJijG=-a#=Dlct}IPMq?Lkr|qWGf&4nn7hWJUbTD^XZpjyqSC6w!;ig_>>VOozAG>J
zw|KFiqx;<M9xK^cy<@?wkMkdW(pa)&h5w3|4z49F8<MThfBV+7Liu9JDmK%5`pob6
zpEbC!GJ3fAu`m8#$If^4Y-9YBTdO{4l}taqWzyp9uOiCY>=n;=S=1Z6y3N#FpCl^r
z^6=-Cva=)Ng3bl=gqHo*sQt+&%2+1*$LI0Fdo%98efxFWja5(Hm4$54C_llj_0imP
zno{d^!F~IKy5yB7aqnAM&eqc2AJK7dj(bB;&AY!LmrnK7O?utAsk7+wlCSqU_fB@!
z>2|3)&hDgRD$><@C``5WfxYqBs*g_$?W8phzjiTRc3kTEcaKP}J-<ck`d@TpUuX&6
z-2ZG^yhX?DT`wb#9X$|IbmGWu<A_byO7Di$%yd6F&+hE54AEr6^uy6lSlir-!nUpL
zw2^h0BHg8$sweTCHSp(62X%XEp<^A^OtLj!&v#z0|I%Wqxa+Y?Om|XB%GVtWj#TgK
zyK6gTd8N{q>KmC41s;iPuQyu1deuGOH+7zM?$h2rIdbBt>cbs>ZKtc4>G^(}!J4$B
z(b#`4<H!7W{`Z#XbrpB{-PSb9K4m9wc%X8Y^41vj51Rj0-aGW_?0hR@j^CQCmGKoO
zq3<jM7YMd4zO&5xNXxY~%T0>j?y%UyYxB|kz~NODUGk^4KH97pG-X-Q`tU_TZ#O=W
zPrms2{+fK%^$BXb**5C=nn=BP=xzB}a-Q$*2&sYvYNvg#>K#~nNXX#$Mu{UlOFpm#
zaW=ns!zMOULc6kb>9@H4g481uZddOzJSFlk$?6{en&(IP`FE*a^I*KXDd+SG!P5m%
z=Xy8zH`v)3F)#3OG~MxDS)r@=erbcs3p3#oub8*fmX$?E?s?FgQ<3m;LBTvDqm7H#
zoxiqpm1>z2Ywr7%@w?YrPUQO-CKWMnTKCkM4b0trt8FhGWRcEZBiE~RI#=cYk_WtL
zy!X83@&8+w!F*xq`ig6Ho3EeUz2sHu$tACTY(5fv&78--)L87SP72F9lR`zUr;fFn
zAHH_J`#XDrWKw}6|8WDirO&qAERQ{q?e?L}wWEFIzjtxd7_WMFpL0;~@46Ys7R71I
z+p=&+o-pg8xp{>fpFNVX?O9PQvGbHo$|}7%vs_mO>%ZPDZrx{ET=DNFZ}sN9lS}wZ
ztNZtCPT{F_aENs@khi(ALF2%Rxj+9EZ7a;`Heb%SLE5)8MdQVSosE5Wi{#z!>C8R5
z>*@pTnxjjW`FR_EwsBoFVXolS<6VuG3k@$%68)mHtKrq8tVefJo+Z9eatTwHQs2X`
zvgJG9``b-^=dZ5x$$GToj?VQPnJ?Z3>^mx|Cc0~Sb(G`Y9lzL7?{V%aQM>+Lk%8fR
z1p|W^0|P^DYH@yE66gkJ{p9?j)Re@MM7@H_x3+JKZd*+H|5rrjIr~cK&W&@=#4OUv
zUz=<#dA(<H$eWqBb=P-$drmlF=vu^iY1_5uwezcct2e#Qs}W#OygBpk+P%B1{(7Vc
zWtd3)?PdF-wBtw3r}m5fH>Zfs={=XWCSz0Ou~&r!Axkf-O3NOpw$^WYyeaDX&7_+w
z?A5>5yRlcZ-)EifEjGtEPV8XM-A#Megk7-Ah}gBs>d*Ij$N9`RpRdV?;M0G-YRzRe
z?e4jAD`VF+sm$E&8@*YDbCc+v?4~Umr`l$Hm@E4;hsz<gJz{J0)2B%iQ>JEU%7@+j
zqL%()27mLmvuUp^<BKoW-V?jLOs9C=fhVQ2eF_gfs=c=1R+WA1vPi{yzNc-{gQfiU
z{tY=FaW+l;=9WNb(>MEeuD<N`aJQ4!)0-}(on=fv1pfNHU*7XUp6z*qQ`m;bshrwI
zJa(I->?DIezk4ri=6`#Sr~1wsQ(^u|tI|HdiL-g^J6E*Z=JAGQ*&jUu)J~o**=8KD
z!}Hb4n-}KW8~MJTDp5S|sn1r+xU+Rl?(ZL7e7@z`nrq!tihP;FwrKnQN<H_^wD6j!
z0-JBM_X~4=y~n5R>+F2{>Md;leSGt{-EiTm2Uokf+!v&`^uL(P(Ab#id&K^FYVe^?
zZ%T4a=bwo<%9Zdw^Vp7$RZ;7-W;mbSonO`U>0m(Z??V;=6%sX>++RcYS;lR8dA8Eh
zctX!v#)tiE5pItA{-|0eUcK3QahB-z$XGEIr%hKgzn{o>@kwyqf#tuN!fwsEuC+I@
zFnIZas4aF?Vb4E2lCb={CF9lBi>k~w*EH5XxbJ!Dt5^IM;RUbPH|)E3?ct2ea};M~
z?iJhf*?ZP@o|N}{RQXuLl8isHxjre1o!K&LOQc=!gnJL=r*C++MsT&o+2C`{-Kkuk
zN^9zr7JTr~{hFXN>tT9%`FHMS&H@+K*{n}xmXvPw>W-Yiyj{ywkxgt@_vU45+b*n`
zk<NX=!I_t@`m96Qqr4Ww3r4Z5Qx~+in5p?jEH7vDx^>J@{HCsUjK}4xItRl#+n&Dl
z_U16rnk97M6-&vQhn|J}VVR+teiKYyUU=VMCi%E2CbPkrrD(177d5H>EWvv=-ST-o
z=`%}d^Z!~#@50kIyenGIiXL2eh$AXvt(?5*r1cwm8`iW;R_VVXxncRc>A6!kYk##r
z*!lR!tTeMNM^Ys!qIL@DwpBB}Hezn&>CxQ6{-VLxS$Kn7isgOr6?-M(H%b2G?5J6F
zf35T}`{idRHT;P=;NrTUbDx8@*yG#tH%T{@=h`oH<B;poOJdRakR7SMeZk2I6(@CO
zpO2K~WxB9A;b<3YR@_gq{Y5hlbRD(UXE^YD4OiB;>1ND|T(eSdvBdXT`pi10wNAq5
zDR1+0$qi0B#NQvUF0{SNzwq&Hu_;y_2e+(Qm>nu+%<@;UdHG8v4T;%|dyHln-0a`w
zsgiK*Vcj3KHgyKh)RhcZ`A)a4a!!=GqbvF6FvrZEm_CVHX$zVvE-WfoknyCla`_A~
zc9x1FE5?_;yl>0fe;ZbqF=d?=yjgqT_1oJP73YJ#xY%vl{a~HWA+;Ue*@iX_!oHUi
z^rRNLTzk4^?xX@X+Zj$rJx*9Bxp|uB{^ZqN@R#q*!Jhl6XN|ZPrdvpO7w2vBytK=2
z;`=%4_MF<x_N%qIckVj3-`739?k(`1+??GM>uzv7BY3johujVCr8y2BPyCZTQ}o`s
z2i0#HP75{6^A}6_)8N09+4&hmtBPYOSB>>AS<SGdzZ*ps#Ygw4)m~~6xLm(NE9_?c
z%^Z)a-D#H2(q{Uv7ihdsS<hLhX}}XdP4|Y(gDIQ~wz=&KVQZMNF7jIH?g+L$F&i0X
zZ1h{I$Mm8yQm4W!`Cx`i2lH0PssaXsxw;#=E=5%-wfy}jae{TS*tZ^u$Ks9?KKHD@
zl(y?iUP4NBYth%k1}cv^%vQS1jalDV!OCndHG{v>wP<z}gGevaT&WBDE!4A&avkjs
z9-Yw3u&hY#AnW<AHJ+0?HrMcJsm)(0D$RXW^S70Mr`5?W{TKN$-zH3ZlN`C>oXy8=
zPO>7e9iQzzsdG?zj)B13wVSI9K2*uDElg!td){VGblT;m^ZAyn&WU2-KgS~fSogyI
zw`z7T(m1Dd^RhHb9g8nBPB+MSWpi;)(IT0XrjpWI8U?GaeboH3_|JU*>GpH#7!|6O
z{C<3NF8cHG@$b$2A2Q-4&U{`h@BeT;^TmJPS*nlDO0~SK(~uX~BqQxx+}9M^IB)x(
z8+_s$Pc3BMxgq+S_(4JbFjWn&O;rb(nlxtAMIGKX#o)Zu6AoV9==Ms#G^eP}60_#_
z-W;n;bOI(dc=^m?TpL)xu_x@VPRoO~ZQ3fXg3AQUx7^_CvUzqkp`*@vp14cp`J~4C
zJ}MKrp9mUC)xU|pfAB_{nB(5V54v{6+}0Ns+>w=j?(vnJ7?&#_`TNz{7EEwlxYlHn
z`GeGNdnGsin7yDc)@o)&9OIGfVwZnw1ltelvWfZ|E?Hc5r|{wnC5hsigavFrCfTQ-
zn!M>u_2%Ypj%ogzn*9$KHu(tXJvQdpaN$%;Zrs$hEIq0x4yy4gTJpvGPp<OqlVMlo
zwwc1l!n{}{yX0c4j25HtzBLhDoO6X9{m6`RJizTW)8x6$Tr;Luvcf^TnNH7T+&Mw)
zNrm9o+b^dS+T|A;Y^;pDw?%ZvmW<N;%`-nNwrHunz&+z#D(kVCP5}*iysP-)Yz{SF
z+j`PKBk)^T3x~MHc}1yzF3WU}m4zLhs_R^nvZG2bX@$1vGJe~j-Z?2LwTl|LLmslf
zy%N5iQ$s&xUuBW=$7Wmp4$VaYTTh5_&RCy%L%Ma!wP*hxZS~;P<WPIQ{O6P~(}!<a
z8f?~1XJNOVbWyNmn%T;0&h!2`8#AcfO<o!8&+lB@|F$OViGY<`_#_wQ#-sf<CUQJ&
z{(SCP|IB-rOn+o~c)~>q_VDYmmyhdxJYXs8X*4Zh4RZ*qY#rk{jSTaYx2~Q=H^YoY
zJU3P}M)^*B$Z*`8_2wRBgN3X8rD6_pFnUi;`pBAQzjVP&D{ht7S|LswJv|pPb?{^;
zTw50P_Lu$X{Tr@UGRr((oc4S>!v;UM180<DyEYYG-8|X+V?^h^BksM5wM~!OW5eAi
z%-Xjk>qYn?-ae)mWmA~eeG2wk*Er#|N&U3D3|D_PnjT;}vfL=Y%TGUYf}U!L+418N
zCyNxOnDFr!H~-kPfR$mo<R0S>r;b={j?7s){mZK>es)}KW}ZuO_g9_QIK=4?Joj2@
zWOb~*%>Kh-J7<XrJ8&;Q5qWZbgt-2xV<!w+qBK{Z3|sRtxbe@fMHhXOyZs$LeeK!m
zs^t?q?OI%8?**%5fz-}g?!$!vGbU`QTRUfQRmYl*trw&VE-w7c9Cqz+2+JjnoO!>u
z8vmC5z*fy7kZkpN|JzN|q!%ofiM#22XXDKNlXcvSAF^+@StRZB?y$&<V-IQ=(k`w|
z+SizFTljC!;%_GH6ILz$mL_i@rfYqEVi~iZl*6ALm%HPRPmD3XV7JJ7L7BI~+shXJ
zlwS%c>$2MgS&Pn7-m>oCw}21ZQ(p4?4PY$Tw5(67d~VaRn<h_kqtah2|G0e55%m>@
z+a{g;_WhjqM8!$04mYa!CtSE0_mL$cx@Yxd$9oOui&=tB9SZk+VxJuHaG}TMY0Hl;
z@)h?<>-%D~>-B}+EDmFj{#XB}ip7?G)=gROt7CZW#L1I?<Q7fi+Ouivyjic31iv=T
ztn_M*h>`lf@6?e!wOy6ZJj2eoRBd8V6uma<NI*(v!#xI84jY~dtJBv%`hDuYQOY3t
zmD{6q#-FBlf4Pmjf;Z}(6y8<sv@Cpv-CBe5Ez)5M-Bu0F?;;DM{gz5|KJxsz-NGU}
zV2P&gto5xr$<LNVcJ;=*aCchxhkIq5L+P9ZpACjRhjlgg?tSv^(?Or*rpw$WM}~Q?
zTWC|KRDN;|ud4Zm!>nFnxn_^|Iw(&$`Ap!>8uRyk_vPmAt2VCs{O;?;jQam6`Cp!;
z)Yos>UcROLPnrC^eRdqV{dRNyJ?jho8oj$|nrcnFtnB-}f90xV-pb4O_<iT^bN{{m
z-l6&VaeIHgJA3cn@5zhH^Wx{Gx-zi;zW;XazN)WTU!MIv`SHcqgBMp{ynX%uzp5?u
zUtYZ}zdwJ^zkg4@_`c}&cG2Rxps?!HT}GYt9UtdkKX6vTcFOauyRYON>{|bZ+2%IG
z`MOm7Zp#I;ziv0?zm@#%$Kjc2^^=cP-Oa7~bdK}DA}-N&msg*7kk>u^V1NLN`GV`F
z9LbBXJU(@$FYEr~GeOtYHWdjvTbn*qTd}$=r%FH7VWsfGrAG5QG%u;Og}wYyDHy}i
z&rs^n^769cvv<>(L&Sdg<ZnukXmb8txk58U;GhwY1y8~5q^Tl$XKOc0H!!Qot@diZ
zd*emo+ux0kH#jZg_Gi9+;DC~VsdmOcC%tX<XFs@JY&P@CJh?^p)hW5Qv^S}e-k0qS
zULIb-#qei)p0?1|cSd_t7j$HQsJ@o8nmIIa+Or+`qElGI{+J|Xv6<{_Txs-pONsH;
zldPLVf2$Pzp4yq?c*@Y+{4lQ%^R>A?FBYEKzxrTIc{i)b^S33LNwT|@R!;Qo2}?fw
zW}=SC#G|_J89!}eu`bpyO5B{c+Lwp7qgZmrtGPQlFRL9p$h4;-+G<WqgRZ#S%n+T@
zx+~vBV)E|K+TW?8Smd?sQMvv6za^i(GyHgX`RG#3ylHVB%XS=oZ!vG-b}=QF^ebzk
zx#oLBUdw&R{(hR3LP{*t)5feddrR(UD(Cs1C|S^ZwB(VX`$^0Ez>8nyA|KalT?p4~
zUey+%<dLZ@|5r4KBS`kay5!>aOB!WTyx-N!!WRa=-5>b6J4qt^?dc<nUQKy&lVz6r
zsS|g$hu*hI>pkbLHS51z^2VH3Ij?LRAAa7m&hps7FR@m;>~C6sYPuu;lua(JKfv*!
z(qx%rFP6B64>Gt9$j<#>l<)Z8=Rh)xsa}_wRI_g!OVhcC_ll?I8|+)>xb|V3;>$}f
zg$#Pw+ML>3RYQ*U$<2(gHhK|YVN&aVctQEgm2);fFE#U;Q|1$5;CHch&&#!|vyFFN
z6*K<Om+yG|*1WZI7e=JYbbD{x!oWQ_zp{6iU9;&?2`=+VncHnIby!JGvHZnpbL?*O
zjJx3*)@_I@O|fq(=yd<wICnJzSIJri(VUC^)e>us`aCM4S7xsK((#I^r{(|mV`1_<
z4VxCF?wzi)oz2bdmdU!U2Jy`f^P8`*FV;zXy*y$WlTGdE7H<XDRxSTL10@#!MW+g0
zx2&4~_dv^AeW@^$m>r3k%CYh~l1HvD`o}5qP&ZG~CFsasm+HhRsULzIoNH%_DRJ94
ziMxfRr0xj)CKTnpI8RJI%EjdiZ<x?j$7Mxx+WD7t|Cg|zpkcpg6ZhYaNspNeD+L`j
zIN7!x$vt{_L+-Q1<_{U>E~t7J&#>HFiT%}2y*mug^0+0KO#4sH@5<sSzZAKpQPx*%
znIms;>iPqL=Pu4)`zd7ExiyCZIO3w#>`-;@H^~Y6S{dVTDb#P#oL(2fJ!cn08`t}<
z6<B8!qVT!*&-1B<XUf(ku64|8-WSPwzrktW>8^10h5E_&bXM*;$Sr5#7Uur=ShUE$
zhfkb~ib^V{{Q2<mkBQ8$DZxLsPcP&Pv#CFMaYyUBX)<-|n)A(@?JR#6HP)RwJ?*+a
zuSar~LgT8S-5cAj1CJ|(X*@Tvwg3NM^%70tEi?LZ9+)3!cw#n1Oyb|?&!O?1QWMNq
znEsjZC*#|V8;MM|dHb9$dL}Qeyw~>T{q^_BQlY8;V)8bhO_$Gz(`!%{3;ZD`&9+HV
zYineirhQkVl~a4j2A=x=vsrH(+s|C(lh|$WgS9RF^?}CsjORJ`&6&Wv)6e+aoX3h6
zZETh$8z%9@ZPc81btY?2Alss2zY_mt7%V9<DOk8$<&Lq;Io_Y2#SiY@YL(rzF-~FE
zqU+na<I7t^6&#Eb{Y{TavTSGL5!l8yfAO<htfm(?Ol8{D-B>&8{?hCVyA)<{hlEa<
zdt{X%bK4~ynNWoY^@fvQ>(oWHnC<l6->;cp^S_EEV$1i%t{0=$Et-95<4(8Aa*0c^
z^J;zUYWLav{_^qBsTJ!5CiAmj*V=L9mwSbTRAu?;;QJm|lOq&L+FhMxr%mn*+HmyS
z+`WQrs=qH-y!f@_$FJ{4GhV&SnRa8%gJa9M{vD9Is<G~1W2SOKaPQghgjqFqe<#h6
zm;GPx?c<gHuh$dhHs3bdpE}Xy>jj5uh4ihed7pR|F34YDxhVJdJB_1e?To+r{~nj#
zR_N|!x8U4nUzf73AX~*2&+bVnt5^yTHb`7cJubnYEcQb7vHirYOBVSly(_Y^y~}kr
z`Bvo{&A3K+)h8*(c=zcReXuCvVhoH9T_aa|p!#lW+by9o(KmimZc9jdmumTlnQx4I
z<oo`_PH(qu=TGdklk%Ii`qVrR{;Y`kp_bXL{wy;TP8u}p$Ysr#w(`>3>RGKnI&MUK
zo33-M^do2dd^0hPg`T1-*6m*0bLl1TjnJikLT%^Pc-?sAa6ipu#-y7)O>dO6>wKO2
zi*7bWu2`_<Qnk&5lEa7JZ8(4a!GVW{7g<-ghI|RXa((~(7dCs(hrQKm;3z+oHAO0i
z>wbgaM!ks_Cr;U=YjAsydOuf%)+xt@>o*-UJ{0%=BG(kw!m|(W9f&b&FEV`Fd|Fs;
zyUiEP=g%+r=Pg$c+9IRX73}9Pw2^(u{g7pWS1(Gf;@q1a?DL?(>c8q^-HzX`m(Ojw
zbluiudrM#%%d`mF=^eEap_Lx>J<S&^*d$&x#XL@#a&6Nho$K}gE+pOQxjaqihoY0g
zgu}V3PH(a<cz%`5*rY^s;)-7{Vi=lKFPMqEFzdYP;PYaJ&Z6gR0z5OTCgeuwH+@g9
zx3HIuULLifW*>)ynEKHzf0-_FPxE~d9I@s>MH%PeDt0NQwy0<x?MXRRtFIsE(VEb3
zR$<bSEoE;Sen#9oDQva$01umM#g@o3t#iBnx=ak2Fm1Q=rvmO?<&%D=6u7poHQEx@
zw`-N}MT5qfQmJ#2p75=*nlJDoRN>rI|J2VCOK)EKxl3B~ifJF)(f(2&k4Hkm8ydbk
zANr-CVQYVHWt@Ap>(zd%DdD^4zLGe<OlSS_IeT??Oz`bFnz$+R@|B5xDeZT&1x{)&
z*5mx1>CbaJXTH>4soOK%b!r5j%3I1w7~OIFUa{&v`;v<#ITCgp75(k}ObgV%ZM>Pl
zeUjtLg$0KXEZg!h^V=TVjYb0ZQ%&<H<q0SHxUjw2!~SJP`zrwllkBf?_HRSgPVGG{
z7cO0KH^=et1&`>}dVdq2r_Sv>W9L?rTNpg0yj6HL3;z!Hexa0g4Kwc4%V~XC>k)U7
z|EJ)uEpr}wXK*C#Ze7+beIiC@(L1r7=Vry!ym~+7RA=w<wW>)w&PqJqwp4HC>;20%
z{(WC7UG{I<xoy$m3zr+Xtqq>y`oBVDo~v1QzsBwLYnJTx*EL%`xA^3Vjz{s!_i>kh
zJ63P+QGMHS=ZD!_jI<J)d3Dxm{eINB-sWuAhUYBozowqGtuWi79`mHXRAJ>r`6u(_
z@1)+%YhTvC_}4+X8rz7<MOXRXU(KIkx?`1$!58Ky=bbK;<}P8s+H1(Fz98o2hFx>@
z@8;fW_&=j#;r60-741xuW=9o<)~8_tNgH*a86ErIwq{25`aqc}M++xNNbPmq@|0QE
z;P<ltfg<aQ#s?Q(Y4Ka~+hp3l$qBihd#(Ra)=B3Qt$nxCy8gxg`=@_;{^n!bW`3;{
zce{02%vs(2W9Wn>CR+dMPE{?|dA!v=LiFCv{khBkx?KG@c`Enn($=rfr^NU({`j^2
z(Fvn8UXxwB_DZufiFYlw5%N;lwXbEd_2$zRvp%VD@wO~@&UV$cZtAJ9SF2Yo3a#qb
zDe3rk`hdTRPvswO&DO*DOQs!rJKxdh(zl|D)qMBXeH98h=*#_)L4R7)Jic6pdjF|m
z@r_Ll-yIezRAn96W4Lgw!IQ&tPCnVTG1!o!PW+8zTyEsrqYJ9M+qcx870c!Or}v>f
ziD6&PY?jTo*$RG(7Ykp}na6pO<#2!+|Cw6Z!ox!O+IzO2ycf2yy`pN-KLL*{;}nzp
zsq<t*?TX_MUfkxd&N-nsZ;rwK!<DmV?PfeGak`-AM7E+$<Mqk!1SYdR=&dxYtq^{#
zEB?>K`C)oxb9;aOqbceVCtaH3xZnRYe^vEcC3Vr$-ul@Q!D&U=PcBd2zOm=Rop1hf
zD-QRsGpsn|RPyC{EL+RtZD#4c@As|tzEgMb_QG8vv-h2NA}@CKbd-U<^!Lv{g`(GJ
z?~`QTey!8|@!lj+uBE=u4lK0c`IO;dI!&WnmfO%Zw%xt-lExdOd;S|=h=<txobqdy
zE9;6`_aj!>iWua6my*6Y<96`0iZ3djd~3_Xdj5qoT(T5bH}<yEEhze?`t!%j&(nhg
zQoU3wPG9Ibd`Nm?sC?nJ(#v9o^KN%nTL({>FX%si!W{Kro3`aDmkpoI%}bHnEmFDv
zS3bA-SCR9)QU(eY^ZD-WlK)hcZ^Ic=6jb$V9sgCernUb0+f}#qT%2l9^VoE6Rq~~a
zdu%RdN}Dc8|9^AgcCI^lI`hiKkE*^})?!z8L^i{1TkX_!sapHixLMxYy6QFa5l-K^
z-;Xm3%2k9+o@nZ2zJ%?Ag+;VTi6j3Ej@tMznLq6-db7_=)|Yj7@KEG5^UGIqg`1c^
z|NiE-eoc5s_1}$Rs`2Vt{Wq-Zy5(J#=uV8?HYupK!RXN09B-5I(#T(D=Bn(=$(g5g
z=S*MSlB=t>r`C(GCpw&Z_xjVJ$-*U4Dwk|{nM?OeStRhp++5aoz;MZA8M#B1T0)6y
zH*C<i(e^2;ezDKKulYh+c$Zc4hW*~V6pMQf$kk8NUK@JlU30o$|L%ti!tMU@OwQEq
zN#A+MpKaET=dU!FpZfb)`|kc(6|6ktmQ-<Wiutb%kIHi5m~Vd$vbmYP@}6hOvfJfB
z1x=mmR>JSzDH}*MZTs+EwBoUe=2Zs2hbAg#t1hd4UA|#m9v7SaqmT(7l#K&&jys2b
zGCkhBYKL*}J@(S~ulxUf+p&84;Y^Dwmzk3)dRkg5Lca#CU&VXEKD~lrhbUwG&BvDu
z1k>5q9Nk#*=qkrIUb!QF$(0d1tPMrt@*f?@tz=3%ec^%k{aD@IyLY>9o~gxp$$fk1
z!%Zf!C0kc~FjLRzEAu$}bE(cX0dw`kZ<0T+6MX(Dt=4;cRl<&4(@XaFXeP@TEZzO=
zT~o+Cw#Y^y)|)|k8+5jbmGfG-fBcXY?022x605cGu47t<7yb6z`%rP;w9D&uNAmnv
z`muTMp-)SGJ~&_Rc9>^dF`w|+>ko?0_d4fW@GUbw+I87{!|DTDR37~LmSuI?Ys<A)
zs~(Gaw`Bfhi(bVv|6o&G%Ng%_m)5gtqPHHOez)rF{Y9TjTodvwY6SFqCKM>Ji9bH3
z7kcI(oAov?(T%L7hi`AJpPYWY^kMsP`){FU57L`Ay|_L>gJs_P+cu%;M>0ECW)&QZ
zSgOT-a*<5E)&H7rmtRhQa`)oVm7+hs_~~yF4V_!+;{C+Z=C#%=-L+;pSNuNsrCqOU
zot!es^vAJ2r_$u<I!k_-KaCC5clQgE+5GWUSG@w?zdWZF^DWDwuCuVIX*^it5TDp~
z@>uWnN$WP`#c0{NzIdzG^lQ${4O2EPX5OpG|Bq$Gl9(4a?OT<mEjaA9xkotYcAk}~
z{rsbAcg@+DaMMIoet(VUbKxg`6+5eb`iZdih<rPpHg*4x2(upbmrHVHKUuM=Xxbj(
z7SEJl6I^=Uak7@qPqXZAoHj40`lO)Xg?bP6W&DO4*<R`9UiuU8BxP51YpE@#Y=?l|
zLaR$2Z&?0!mxiiZKKsdiH%|7D#L2_KFDkSzR7BZMaelOO{@P@_(B8|1+pVgUUlo`!
zin2`V+f?1==VTxee(mO^`-{G@9{65&+_BAfQKQA_C5bDw&-i<VcCE=-)}qerBlzB7
zc4V92vt_^JIM?px2xIBFo0@8|;X(bH>dFgFdU`d&<zEte-aR?NVidkmMr}{nF~5`p
zX{SEr9r6xHxE#G_o3DUV9OvZD&kKq!yi2UeUF-jTLFRU&zvT=DPknpJy{{)+k_=FL
zrO<uYD>nPdiPf(Q3_kE?+}oeO(^c|%xzUnOhnx$wCeE2H>XI3*m>Ml$bNq19=75+V
zJFJiRG&7z#5-j>V)wlddz+ZzViK7=X<y7VymoBa}FBfvMYW=Q1;m}&9rv;~P*cjZu
ztMbrxo_^PR^CCa?FQ=ZgXDge(oRee5P-S_zC1cV}mYde^?@YE3317u7EpT@6?Z(;V
zccMOi&u}z#<zgtW57K@tlD<sqxw-rklXHb$qUz^z&#C_BxcXs#Z=+duivHKBO}}?f
zOZecwK=0MmD+(<|r?(4-%+7q_zC514d38a_rw<iBK1dv6N>f?JHTn0h%s6}ZQ&)D}
zKXl-8fyp8><(%S<_P0l7YGj-6E@8i~UGk1$(Zy|oJO<a7aSN|n@<8<OgP=dt#cI~S
zh!c1^Z_Q$f*HL<%|F1jceZQ)j%f2sZ;qAXIzj$9phdt0Uuj$SH`&iid>t=!N?7Ln%
zUjK67`WM%NKHaaaf0(8#%AMCZdT!cJ=j2tQ|5h;HvbGXx-5qkR-%!J+P}^Z)6T{*U
zZ*L2n{J0?Pg5nPk#m0Fv-*nzrJ^R6_cV5tgw@HoV$&$xc{oeihZfizg-4Cwo!S_B2
zAGW{bKCRfa?)K>^*OG54%Dj5G_r|LEPaX)!xd@!^?|pWA&hz>!I;&>gRbw;w`!)JO
zW{qZ($b{Qj&a3ygdfoaH!#g=hyqZ_^{|vrO`mM72j^A)9zU}odg8lC$UvJ+l`fDrJ
z?S5hX@YnSVx71GWHkkQu$(^lF_wwg1+M#t*g>}_aPk(OiX&vcrR~@<;{rvdzk2d)~
zFWpdQ{PMge)<?ObHNm^og)i>JYK}RExo1@5SG8Mf=|w%ToESBK*%iwJ9)C=3M*Ke(
zU854udHVUR;5&1e;{L2Uyl&OPAM)nbR}(I#bUa|;JM6$Z=e$JfZ^x_8`z2gTywcX?
zoe1(QQ~pxRB#~FP(tGuuf}_3Bd<hpP2-#)nDjBR;^g^V~lIQ3*vAY+~&OUs>?xNtU
z$y3_HuU9B1PrkS8>%(;wdv{j`C!hTE%3x1|Q)IW1YX?`5>x+fEl3Mi29xr&4-J`x~
zs>P~yQ^8;DY$AyvUu>5uZ?Y<HnV9}OOhPpIpBI1R$299FTILH@J@j3FcZI^u7rT}J
zdN=o4iM_mfS0df~!-Jre>!w+}S)*K+vXVzOzxv<HUjI)GZa;ZvnC<!%e8)vSyy3Av
z%cb{keXcS7_MZLB=D|&;*IWBIzWHZJ2(3RgLG!!!@uF%yxjb*1mj=no@dw^U$7E$2
zFY^nSv$^V`y-)ui=TpThmxE&)ygIq|W@z2)-v2XGe$JgGWk+(?Ij8&bzWlRF$+Xn+
z%?HcmYOAigHm^zBg63Yhc>d}{p3)oKnN~b4S?{~NJ}&m2ZZ4NSnbpL=`Mp-vDfbrT
zSsM2puLiG}eD_C;)}9sd_1h=j-+L=vu1-UG?@tk%3vBAQPI-3zDOe=eaQ}P4qpuR|
z^AENx`Y&nC>G@t~{gs(&(LPtwj}^6_dr`9Y|CgtCZ=O8)^7xZaFHW~#KK<nJ#h))(
zf0>p34F3~*Pfh6h^|lI&6%*8Rj><32Y(6Ra`({$qly{ROSItj2q#JAS{k`C`&DH$x
z!z<rQs+C?noE0gS{q^{BdAr&_i+?GfEmhvNJFITL!;>8`OTYG3DXgywt>4!A*+FIc
zQOn|=9nEtkE*5`1@*(-^;+c-(fBcrOdBEth?LRZ>5)tvl%d4L=F);XXGBAiTpezwd
zNi9gr%t_TNs9YKroqgLtr0)9q3ojJRe0{EOXEl=0PHnx^Ys%lOB5~F(k9A#+PUYe$
z|Gv*vJ}s{5Wjy0viQfJ4JgaY#`~TN{EiTkH4v-Qvx71MP<~%#8ex2(#j_%V>n&y7g
z5B+=RM7#T8eSN!{C-w@@<6CEbmY%BGBkKG0$mJ~=zPBA_75xke?|taB@)U=%_EO1W
zqt7wkUk|iC%RUyt$GYBiv7**eroB&IKRM>0TsL*Y#bq~-)_mkl-5xaitX1T8(^Ge+
zUMaTQ`KHYK*hiDxn~HxIi^qRFd#+0AqD_Njt*3of@rwSHOT0Y0o3aD5Hf&mDS~36Z
zo24tH{3I8tzBk&M^g6m=&7`Sn3yS`_&pMv5Ep&6mmW9c8&kG8MHZzr|WjV~-?R8K=
zb=#Wdp8_YW{rvIhysq^Vp8n;zJze>Xb+x6*`(m5zzl1Yx=kjlVWyJ9~Rn%{O)<cJv
z9h;b4cQE8XN=(^ip)YcEPE);YPuc<7B|J?|mWPU*j><4^$Z%O1;M+fiLHCYH>(>&G
z*&Vx%6?O{f@kuf9Ju2idf0e(eLU@n(<4(6*<~N$%`*QM_`wu^~n*GtYb&}mW-n|E2
zR<6#Ra?)tRiT_tKI5O_Cuvtm;n?L1!U=$jwDtX##VPWd6jzy(K>hlz~ck^y<**^E(
z!f3xW-*-0sikg-ul5v08%8*M-GM6mWdG_bTBiYl5$_H%Js;ky8UlMES`xkDs`AV_4
z+S}vP!}B%Y`ZC#0&x@{3RXBZa0?)6dH8<prlz-`DYhKy8&7^M;zmn1-(N&8r3@VPa
zu(=ffIXZJmb$+E^f-=Wc{X)i`g&P*0J29_o(-Ol29~q~5URd{x>-P31+rsuQoyJzA
z^<eufyQz!r^u*rTdDiSN-=rGL+=lDrB^z$OtB<de(|1+p`IXQSGJV1P*=J8im!xg;
zdLp&i@oCh~Ph8Ui@~sZ<b+G;%T(eCzcP=;cy2snRH=5_I+bX=5-<oyfLDuND=?i@)
zOBNYs{#nUrE$Q)395rVwmD9LxCd9xn&z6Bf95rX8=9MMq=cQ$)>lIX9wZ2_;+hWrD
ze_TDE9W<4-UzV8Ner)_s_IQ|3?(c2WCi@+GeYnlT!)dmXC5xu(>&Nx?S21xkiKKcL
zSIN08zpYrf(wZyO;UlYb?A$tAi^+{0Q!OOgl+HbM>3TCkcDc=r&Svw!*Q@n!curbp
zWI6Zgo3pRw@5vmPU;ZXd?Z(ak&ofRN1p+6XOEfyoI{*D!-%Tm!YU+cYxT@96KUp~|
z#qx3CoF_KZJ=dI>G2yvQ$BrPUsm(c;=Vb;QwKzM;Aw>75*3^$v3XkTQNC=95F8aqX
zkM~R6O*3~ZWlOWOPqR%^6*sH6v9aA}o~YDn`%Sac$*%9n(;wx6PkcK9jjsA?o=@jn
zqg`?L_GIC*%lm(pnSSuM<MpePjH|J^ll<YbgV3P_OF0*&z|T3Qp0e>3AsiC~IOJN^
zuxP7_s2F%1a*=b@VgI>!O+=K-L=Mvo3B!q(m6R1XclIQNskd!!WyrAMi=3e970A!s
zrNg}E;;P$=_2gEvw5(ckN;LXZjhlthLFXykR<y7z5VM)AA#?S9HRJl@3#QBr(V1S{
zxY_97k}lg2%fpce98Wk|&UEmX;V={X8PpNs?{tULFG)+&D8PilN6n{kC5PC_>VtLM
zlYA65@Be!9w^F(%Pl@W$l4HwSc?890iy!RKO}9BNE@>USfRRB-TYs{WfA=3%r{mvu
zZRwdP8+6^}m<`iuz9mYbA3gcLJY{mZtiIRdDzj0>nq{?ZIcE;2#h;Rxuwr^`l#*0?
zAS?UMB{soIZ#EV-7A@K7&FMAobi_HwjoQ=FZNet2%<kTBzHV;gjAsY99cC?`_~V?K
zLB^Tp>I*rs>I+XC3~0QgCw$+r({@RotA{fqPvgW6k51K<>>P7N3K#Giy6<FMs&&4L
z!Lf1TQyGz^Ju9@7-!#YGJATsWTl1C=>NR@GoQL}&+Ij9gw&6~Df3M2+v(!@Ky!cHE
zs^;82?iyytmLIpjE;s((PW@MPp?2+BQ^h7!6vx~7eUiUF<@}^@6Bkb*|JNyJ@Bd9%
zepYo&XW^0m{vo<6i{{U*)T;fxSd}Y8bLvu-j;dt#Wtk6b!Waq;EmE2sH}~EP`}$4i
z@1Iux`Zzvr_xaG{XU>JJRF0`yxnR}O_`NziXNCXxxc1fWf0wPFUz|B5U1<8`?bltG
zo1D36q^VS3>Ev?D?BLM@Moi16Y;dqvk7)h<{@$<m?dJbZUQPdh_~XwHITjLcr?<^t
z_epY%eCBqUg8VJ^4|cIH_xQ&i^HZYgTMWm(HZHO9-+PYQrn8woU8j9&VxsT6^Cz~e
z1>P-hZ?b;Avh1>8|8my(T~faltkZ3G%as*;Jo>+==I#8LdGWmG*{=Wl`SGe^jsXL|
z`Jw2DZMFi@W$aFs3P*ONo)7+DsbI6WZjbY`xpQtjowDr8hp*XN53EQG;Z<Y}e7t?O
z|8()PuZfpe%CgmQ{S`H<+t7RRN4ZnQ&wu-~bEUMmg>`IpdU~VkZ)Hg`yMD!yjUP{c
zyty&A$8pPzib5N!cC*7TX7;?-Hv6k_WzMhk<$Rk{KVM((SDg{%fA?UU{N=9)-#YR6
zSZ})UVxxyiwV!@b#;*>~yI&(VcPO#j&sv|L=vc6+Rr5|v+`Qamw)d$$3qoI(PV9J`
zy*td~<#FZRE*&SjK1H1VednpL)4@rnPp{7R^N%>={dHcQ-TqB?ig~tn{CwQK`C;{K
zzQWcHwJU}ecCvG7H@x<2(r$Zp@xy!O+iZFo^MrOTo}JyX+%3;PYFqRgZ^`zV3qJ1W
z)Aw7?zW7v<UgrLDlb48i8$AEs^6|-^AL8Ag<Wpb&-?8@P-!BgDU*0JFdfGi=s<?cc
z{913r$#*Qd=bc*FvDGo2*Pic9QrDuRcNojdzCGR3#4Z-J>i4T(pOjZgoBsZkI@|um
z##MVw_>49NPfSy42++#eu4%^pS@W?wPkPeEEqgOMMIJS5Z(p#Qk8jbM>wo`Oa7!L~
z`QTMmK~asd#n*{#lWr~V-5gavd;0xnp<k}N+P!O&ch4fRvLe1H$-AeweCaY5I8ka4
z{NmM)KR@1Ff1IzZz`LzqHD0qnN}nyB?fMM~=eEf&%@VHe-(&H+?d(F2S`U@5xX$NV
z-a!+e3J7Fw5GZq$Vrh(h_uI-&tDehee|Wa%>YWN^b2&e}__nNGt2w57y=~wQ=ZSF*
zWhOR<13Q<*A8buL=RIj-`*B-uHJ5e!PB}-cl3jH6U10l)t$Nl!X7(l?4LM-U7+n{W
zn_8bXkMY66RFi_~+4)l(nive9hCE3t>7Tb*<>c4NQJPhYca(BUr?frH>`Aoc|HP!6
z!pz+i>iCd_m0RHUW=WR=kxbscDy>a5$}67E@p(2cNg`>9WWyvzRvos8Gn;iH7i~Ph
z)<;Xp{M3_W|1H^WMA@7FHRjm;@#nj97nvLx9-6xp-B#OWZOt3xal+O|=ALG1YXyIH
zS@M?!>^J0ku5RAL>%^i`_SPaI-)GXk6}$PWWIL{inDib{SkK8<>XBqzv`MV@QQ;Ym
z(7kH2?HpcI+<5-=#J1hO=Q8AOu#_#*wRXvh&RQ&7{VHVIwQa0RuNjyJM1RX)bmLt9
z@?CH4DI{KwUM^>*9RFU<?u7l6NNwr2X*2U4CG)<Ja!#0)dD3;Y;WECTFUn3aPq&kr
zKWB|qW;biv((89_{@HYC|CFMIym#Bp<6L&GY6<$DaG)(*{^i8-i0^T0eeN~<&irsQ
z=ArM0a{o2{4HuM|wx{wl&qz3y`sVRNr`69s8oXN9`|#JDxi{RFhKqc9nzl{aV_wQU
zed$%X%#150D9gkeyDiz5TNAG}zduw+bmt3`yK2Xsr*E6Q|J;(Pb=N8x_VmY^)VM@2
zeY^JMs@ZPeMlL2HdjrAF{&erDLea|8%zW1|-}Iclw&GXngw1p3MSI-vy<WNP*1R3N
zzOiQZ2CA4e$lBbFI=!{<$LDYIa^KgMDYEpXbkuV@+GPo^uQk&OvN<lAw#DvQb;Xx!
z246k~^goYc+P)~BQGCVvu(J2N?wZ}!obusl`9po<o_m|0$HpWd+JEA*>Bc{feDBNm
zJ^07tbUb&@oN2EFdpIm+bYH)5A<;bh?l&F2^}F2!DrK8)yH3pFshGBEZ({E?!<2af
zjlUS%%I(fCJEeN--I3Q{*5yuGo3gG^|H2y4g3{{iv7fsHbjxKX>VG+;JUM#7H&g%U
z^)r2M+?1JQY$moLr({vzM&2WD1cE<LwL5+N<?mT3+NzN!8MJ4u@mjY}{~x2|6uv_*
zPyCsnTB3V7?=#<NlU?oMZpSLjTF##hdFk=EFnGqXDcvgak2-C<99mMFii<0&Jl$VT
z*_o0wPbWZ5t8kKYiP3~g?Grm&9p*nU;PRTbb4GOD`=h7Mn$1~o&eJA<!S+IW+<C`$
z*EVf^wu$vcdA-Qfr*EgI%Ko%Sxh=5Ea<7Yo|B}gXO}?KvAUgl@+o_9wOaI89qtmiG
zL|W*bq409qcRJ~l8~%HjxSW>D*z)Ayt{=1as=O81_(=Gn^DjGVC;Pjm?t;&4W}J-R
zdF**<<^7adtPGN@FWFZtD6gKodDYfXeI-8C{?*^BCmvO@%2D%?sxZ`hXueyv+f#Vz
z^ySLe+^<dM5@Ks9e1ESgnf2@fk<)LNFPc$y{;M^Uc(~f7Gp@{A)_B%E`g>LIwqmt{
z$*hU)pTiVuTRJx6RK5B4CNrmA`Qv$4J8!3Mx%1Z)W}b3Aw%AYL;68RmhOTEfH_I-%
zTD;<u)~fgo@vPj!d(!59WX<s~jO|>snz`{s1hc-`XO`H_T1Hlt3#~6LO$a>XENFGW
zjnnKn(<6x)2bsCnyhxjnSNyExzkkQA%&X?sqI+cW^;~@_IC*6EPf53UI*q}4(h=!I
z8OFQbz5W&jdGWuB&;FNvF*i?V=B$gXB0-n)+a%7vtyHLztz7B1{q|yIceD7VtF_{c
zXRSIaFm>4(xlnHBm!Gz6usUY!$A5;Yt#azY2eac`ek?hAs=DO+TD2L>2^Q~XY=67`
z<<<kmK~VxXS*;4Izn_=m`EmSzukE+zUsp(+zwYtZ>tWf44>!J_viO!+bo#*7cQFno
zX$RJ7&$_j9y74WSm9Ndul_n-wy49cDEaB1e=WVf%@C9`P<`)Meci6JsHVfZj{h~@}
zl@r6`bDu+G_f?rr{kcZsyW*L8SI3(>CIqgKk8hMXP!xAG>80hL%&oijNV;DCVYHaX
zUzVTk`2>k(!=9&CUgsU1)cA41|Jsty3t~@&5_8rlIsJZ<)zPO}`udh(f9a#MAGaO$
zi}Y?(zIxHQs?V(2^lEjv?P1^Z7p|@jusSGTQNQP`=QL^lqHo{7zujzFqLa8V^8Zz<
zb9ZyR_4>c;6+H7X>qYZbkz3_Q)~Ua3iSb|gxGyE9=Dwim*_)ikXICimRc^DsyxgR-
z^gv>KU!3O;`}hO%Swk-#I6Ue3!8b)$?#{Ac`1T+(s9^317Gqic_!sr2F@Jp)Jp8!v
z7;FDworw?oa%5gdT6bPZSjAm<>}l;r<xl<=>FQTnmiAeQ{fu~f>RaoH`~809PHR72
zDRh1!^}g?qP}<wBy9rqmdB>J}+H{8bUw#mkYsvgEzwuhq3gu&SGP38$Cw!Rpg6EEv
zQE0>6{B|$5Ktul*$MUDRL~P!|8|HLj!!xDZp{wQf?e_m-xm*_X+9WT+c>3;L4l_31
zel?Z%yZUDJLaP;R*AK5h&#}ed)R$|$rnQ`t-uAcRZ@6DD>uX>3@p)3daJ6En;YIxt
z%SEeQlr7IC=p4J5b<DWq(rPhgZf&*H2YoIHk9Ko(-MP{)u|&!Fc;`o%Q(8QwXV!E7
zE#d6Cvb8rNgJZUd+6DF*QXL!Ot=}FxZ0Gy7?F!eSc}DHp<sbE;l5S>vyY?+ulK((>
zqNUu9t^A)~xflG($SB`+tC4w2Zia`9(wDt6<v)f7Ikb6em`P5~);-U;a*c6?ezM2D
zynyBHd6Ra>E<GrbzW%!86)n?$D}$KD3#RJtTrN99;;NCH^-?#*S+=th`McwuXB<iB
zdwRic9_QN3(+3vc*yZ)_%on-WE+GQlGZRj`Tw;D2{7qn**X{WpD|J@hGq@JcI;GrR
zqNo0p+}DG3bJ8c&C>Y;h$q8Y-aV|4swM2g5wb<JyH#i2(?@#~x^6!-p;hWBz%Q&rt
zPyJeatM|aO$RCUEsF+N3C^6WRZ}?t%-ocG6p=$*yP3Lau*L>eq!EpAm=<W3$H`*=o
z4i(GE);`#9?%L7KdP>t9cYjJ)aV@%R9iwpIOXjHKo9(wcZr<@vQu))lrL&S}aLtMK
zQJKZH$@KFj=GmM1H_fQ)KDnlP$*1p4d;LE}uKjmA?Ca%+8grYzl>E|uxw<Lkr3~lQ
z#D%7h^B6QUJ+{7B@Y7IK_nY~d9|nJ_>@1ErYb~xcxTn!H*YB8R@tXFTI^w*SY=5nE
z_TJ30*NS;Qi(TBzeE&MTB>OM*Z}yv&IylJ(9OXO^^Ke?5=V!Kt61CQ?AKrdh{)5wN
zvti4VpPa&%)f=j$^JExbJ*u(i_^^4_xo5W*Y~6j~)#vGUXL#P#>TG!Dz~(!_;IpMg
z#EZW&##vL_H$0cI+`O(WoH<K8@>)*(ZjZMyeJ`Z8K7VBU@JH*(sdbCreOvqK+q#{r
zBaOCC?EUq)W${1XC5y`h`uCRB`FZKz@Mu2jx>vq?>4|S2rQ9z$%FQS>JYK<n)?U<8
ziZl3Jzv7A$1rj?_i*E+3<>mc&qSyA9@6nys)}~vznyO}P%3#c1n00fD?3&BRP3&?l
ze#Oj{<2RrFRC48AkptVJCAO}t&_BB4?%k%Z8%uWz3h!E{{Ik*Sz1gSb=L<?a{L6!z
zN(>I}PgMHAtQnrv^7`A?xpv%_+5*KBGMOSydN$Wvta+d9xKdT%*er>)hVH&8ulf&f
z%j1469U@#{ec|@4o0?aD%&4>u`7~vz$g!GGEv7$rl(wiY7E`O%aQ*aRr_|nS-&W?o
z{P<h1cJ85-6NL0bbj;%nyj3h1*Js{-+A%NjoTtd7C;L2l8DGEl;Q3{C=f^fl4V8K6
zEH3PP+R{n;F3tb@(*N%Trql0_NyUqQS$#PA?5a(U=C0fk2OF+0Kcc6RG)Y7vV0v=>
z;gSdDix<v3r=ja0b-O%s?VZkp7dbY)XpnT>5cgoIx=s9Kw`Xt9F!Wwp<!i1|@wLfp
zwc(to)$;#?!p>~JQkH%7=B!`6qIb;yKCTGeufOhod06UC_j8-qUDZ22;Xu}od0yLO
zQd4@~P28#({MG$utY@~@){O>7r=;&l&J|Vvnmc*c$!$q#tJ~DCeX)DG=uGv5ez|q_
zL4IG4HhpLCaq^e^#N@k2%;mD$3Aq(YE@i*>^*?*|yMK#E$y;%OZSl|7>lLq>t-#Bu
z`gJqA^|7_TGOzppmTX|%@clpPP}4PyYl_YW3=C>p85krnhMF>q^7C?2^GfszD(}{2
z7T@-m_MrT4S5B3(L)pX)y1QfY&Ss^BOnMVET}M;r>cxeD2NY(i1Trz2@p<N~ufOoG
z_iyU&zB4Xre6KXZ-+wVWBsTLzP37L2ayuL0=jrVG`}!7l`V?7O%{sNDBW>cDvLpAj
z=IA`hxLv>TtIwO|t4qbsinrdV`&d-H<!{pO)*TTZA03}%DlPlucI;&qXRoW`;iZ=!
z{Qr}mvH368?HcXANlwQ;7(_3PjBv@^wAJ+VrKKEAk&#no@-PYNK8#d6q~giFYEpjg
z%1tXKL{3~*xQ_c$jYe2u#F<MumLfA{x@ve`e=gEl6cMg<ZMDYCZUb@gT^W;(ZJeX=
zz=R=whWpGpZLSg8agSUcXT<2YnRW?Tb|>xJx^@2?xx@YCA0F$RDVo_CySwRr#k$|u
z4wzo~H?4tx?c0ZUUDg#WaQ@in_*OsY#@dAz-r+`^p9<RUr!Jevw=(nVZ-;Y-jPwo_
zp1G<gHgihu`A?xTqK-4pCjR{wx2*NZdmi2CiDr>3=0>M06)ZNqKfP1(_B97zm8J7{
z&O5I8_fO!u*Q>>r7l&>+b*WNJ&v)`+>l=?%dd}~NSwF!iPc74^``J68T6xvPZTlWb
zu85RX-7K<f*1=CHt}2OE*FCFdvrG<^JaZ^jB>3jP_7742WYPq;oo!EJ6P3~l-{2p)
z?$p`*a)v;;mP)<pk1K4iuyRZKrKZ&#+LvZ<;#GOgW}Zc_Dy{zU23-7e=CV=q+g8TH
z^P7!k3Y>f0_jnDDT7}6^%ZKN7^gLR*F5w#2xwAeoKg8>;t$DuHTip5o@x_zBd|xjc
zF0T!}5OzG?tvqnjZ}Y&ow!*k6mo=`wty{LKSj)O^T`Kn+sWh2mLMvI<a6dkAJ~8Ih
zomKU-TeW}rZ~wvZxhG#{M%sFY;LEyI3#!lYFY;tO{{GN${ppnxdCzWMy>{)|$(JWT
zsCfURwxHruaY0pCVM$dH-&K81kNeiYKh|!juln@vMQy>h@{i5tBKKZZ$$i+wwt7QE
zMf1W{yZ<M?KYsYZo5v4#FOK(pds66vc0_8yhxb`u`}yz5zTazqJnCbKSo`NYO{HaN
za(-djpGDeyqGc3hJr6By*;uvZv)$BcgQY9ya5@}gcy?<)=VRG}9i{?{>%{|(N%x=V
zYB6bFt8*wtY2zz_`TPsK6&5G$j9Y8FYPRQs6P*oQQomxv7!$$^gwtwQNNYUW7Od{u
zaBQ;9+0U|uY-ePdI&=;Mz7KG>Sin91yKPTl{<?~Sy>b2j>X!5s2QoBIEPvP%Al1ka
zJR|5O@1pMaCbJG~=HS?VCNWp**YV>b_UAhiKTbQb@`3W=j9D59yNfC$mPUrGY5yQ1
zmZ_Gvl*3q4=z+8OrKTgxnRaqrnbBIPbL`=hC<TQVi+z0byG`^<)a`f_PU&h~(A#@f
zv_ww8$4ZoQ!)2a-?cYAUHaoj%E5~t79?pf;_y3oa)Cl~!xmjUp=b75iyX#kq$J8kA
zd2sjT@rGL!;TGz9EuD_-6j}Cas*@Aj4)ObKuVem%Jv+KgGj#LH2LTr!Tsp+B=k(-|
zZI4j)`Z6AdTR}H=nYbs(r*4RA$ZME)^T3tHi^W?x!gO_yaGu%S)G)tL?Qpi%!JDDy
z0~|QIncDc-*$wXg*X^D3@9CM}JhFc@e?QvF|9;gg>B?#LQy&-In_qcjqeuFq&5gfX
z1z7z!&y;sLa8y<*dAw{hd2mw6=UIo@XA9Z(jSHCHRfp=oI-~e!t=oG0r#C`+XJjt8
z+PtH;i*@~ZzObhK78@Pk>P!!s`)s97gAL1P&#K8^U;cNv_fhbu>ms3uRjE@l&gIYB
z`zijQu!NL+fkqX(jw9cZ`k9><B>!tRhD|@vcq&v!zc9#o)~%}nFPs*g@n90+)!0<J
zHG8#Uj`z$5%R(>t{lCN`W>#bp)ckoJ+jRZ1ZIahjJk=KUFS_O#wZ~bZJ#t!_3bXEF
zndpFn3C9opY7TkU$^PV-9+OPFuS=00gP~HWj=E~6ckXY~HD$j1w?yas3OVzeamJoc
zJ3p$-WxDsiOWft|7L6CH-54iHIq2r`2><&Y%kQ^!tM)Y>2CclVVkM5|2l4k8hYD<|
zSbV-=ed~`uM?Xt8n^q|Q{2JNzEnoa%O5nod40c~nM&EV}*mg_&nA<LiSzkWdvp?PN
z;J<3zOUA$T9bqBQ3p<)te~hrXsC}bN?dmH#3GaX)H=mQIB|prYyXy*rcVq4@)~@tN
z8Eq{VljHQ9t}(MPAAZ`d>Dv%-{K&5KR|f;891!bvjd&p%${SVb_f=xrt<QHvbtT$u
z=N#uKylqoDb8={TnpVG^@dN#NmuK$1btCP<S?;TklGcj#{qULd=+qrIgWHxT?(IyA
zx@@rf-lq0eCQ+}tEwT{~HFodAKd<^GwNt}a^-*7OxyM@Lg4J7k?>y^jQScD)c5sjq
zS|1#*{m$C0_51gSrx|N*wkZDQ=Df{c6sD)z*S|#e%H71+#tenyt?idZ7948iem?1$
zhH{L}ft9r`OaA8XW4vkTS~xp3aB;-jux7*7>3v(?OwKs=h1KPsLpXPUU$<k715XpX
zoTnO_f!r%DrO+Lp7Hck4G)>+zv*f^T_9*Q&=_}@>YxJF8<a4ssqWG>rxc(l_#S)$~
z``z`mUfg*byuIR3kbviUWfg@icFqpF1cyBidc7u!E%(=Q2R-bzt2#UNf|7Zp=`XpC
zi0S(4UWs(h&R==5vFreQ!u<y6t^&D7PKtdBYA#uRX-XE_^XA1l9msQ$G}bkq>hAv}
z^Rh+YipaNJH=7h6Wlg&Ed!C_HwoaaXuGnQZQG-a4(>o?tu718w<78@FbAR-jU1e4?
z%Re)P_B8LyoSM5mbcR9Ag{kqY0tFA2bT0iGvT=%Twc@Sc<;zaJX4&-L<U&f5M(RI?
zRY$rn%=j-Ku;AL|N!Nd5C%Z<fOMKAE&|5QY`MKHV6O&X~Y=oaz#BEt<CVsl0_sb_W
zCPCLyzM2^;g|qG{Fs^3|oE-R7;2`&%i!u2djMp8Tch5NM{N>HN>x*N3jMWn!D0p69
z#3z60@CC_r#V;ml{M3DOU3A0rf6?{3V?)X;@3z+S7%kuXJJM9PsW&B)^N99=`luyq
z*yf*;Wi?{{)!aRQ<JSd_%I{czPSJcJoV4tb$G40Li}Ge4V}AeS#gp~ba^2IIlUqF|
z{EVGdX0nirYqqP+uf}Cezl@TMrT?5cocc00a+k|ACGWL2*Z$s6W_jyX*WK<lQ~EfW
zmzw50oh)-_{Ym@DCX9SRVY?a@?+oZ)dyCsKgqxr1QEEGvv-UR;(>DH3k3(l(vwZpS
za=g5man#q<rd4f+BU)C=tj+$Zr2BX!$MO&UcbFb32nyeLt<p1bZ(~7Qk*(-ihaVb^
zOLZN;Z(Q)T@aRr&F@IMn|GBz9V|P^q^IsQPwJzzQdt^Ri@I{?B{fFo9?E0H>VMW&t
zrhbN{%PpnKf8FEwom{(~^JY_DeZqNn{i7ZXLRz99SFL8B^d-mUK1YmfZ|{K@Q*zpx
zLN^&?9a^cqX#Reas{t&F`VMZ`D*mhD*oE+ytIL@WEwFZp`+X+nrj~Y{$kAfHX|FCR
zc8c=m1W)>~I`^BIiO*~K<u^sX1Sb?!EV$&w5|%Xg%*GEtemv*D_E1UN@B(Z69Pz|s
z)9hLKK4x~bD<0%hnz&u)!KBh%3VV*v{~P{qyNY<);}s6iuOyrZYvRz5*btYo?!d(K
z?M4anj|x3dW=$5IDe89m_iXio9C6KwZOoQ^hgd??pWdi+o02bh&%@$m@Ql1E4SJ3e
zd?l@NdX5!LoU@m)PdHvAr|Nm+6tma^CC!Lbp~;uHCQsgAEwuE`oG^B?wziXOg`0bB
z?RM^9oHFM+S7-C8;N1P@x9T45cgZ?mKbJkA=c(Vz)B6ib|Gl<Z@ao5Lz1r2Q_OA`E
zKYjK7uBG=2UzX>+l-8?#Jgx5Z()+uXuHX4(YxJ)!@A#cdZ^!I<J8j>SOSdX2P2+a0
zb}SaV7k}r{_LyJSbpQ5w?=SYg|AXU3HLAu_#{(<Y{|nNt^<J8vz4U(I%kr(4%tL-H
z3;U%zweEJ4=n)0cOWWsguC}vPlc|~R`Sb5j$8u)1TP{9jIlmfz#8`%H;hHN^v%W)r
z>(|4g9bCbS+z&YC^n{o6tg<{5W5;=O^PPP4xV>@yGRt3@_A_W1e-}vpbZW7APkr{m
z`K-^%Gi)R#ZFHFP{{7quf1Rs;oRH-=QECs?6<({taCfe|k7U@)IVV>7sQD~h!2e~R
z<kdsrwF{Jm|Ass}ctK8Kf}I$<Qkl^tfo3Nzjo%*b6-;RlmoEx8efRTG`xi0W5@$1J
z1=Z6^0nq_hP95d)(2eSBh&?c$XNk_e#JJa*S2Sy+;x~Fs3^|^;tLc4Y)H(4BTho}Q
zS#RFtyYRYarGU0G_xTyM%d9<E8sm-?soXrA$1thJWpduT5VgZErG86>Ctc=>J^G|U
zMKQQD{nl-+JsgbX2`W5SjibGnE%P#1{~_q0L-V#y+n3>@`nm$)UN?(;XGr%>zN#ai
zH%}#*v2S_e;x*l6F`F-cdFA(hQkMBr{j#uEqL;m2`S3@rF1r1pdBuV!$2E>mU`XY1
zljGw*bdn`Pc`EP6@9Ph~>~9Xc{XzBG&P^*B-YoEC@=y;qy3X9e5Gr5zxBA2Z#?3!u
zmL5!6$h75E3;RX>wOV=!OZU5+x)GHosbJNitC6W;u6?s4mVb?+e!sn8?&YdKGjDdR
zD-(}fx~fb;JMV9rjq6f2?YqxqcN~fOp5!3td!7G&{hHeI@9e8S=FX@;aVeSo|6eh=
z9c6zyrY?WA*ym7^e}?Vn^?Ui}+UA6QHs1aDclpwrck5T%?qa<)<=!*KU&+6Zt=adu
zZQ)MAh^kNQERMgqZ1|Wyu{d>o;Jjs+@VEY<+?N373$GT<*648+e0F``k5>N!EsIhg
zN*;f$ar8{1>(cb>306WZZ6^XQXlY4$^gDEhuBh>KDrsGJS?FQ+8lNMp-wI~*FqNsg
z_f&nJRrktpn#lZ5r(f#l$0=(od1%jE7ci66b7e<>_u>P_0yjl8Oc${kxGt%0j671=
z#r%OQ<jpm!6RY+GM3hzW`6y2R$kUszpfqW-8?W+g$5<n6=FVP0)vI-a*GtsJ-G%#X
zj-C7Rroq<L_}J~%nC|FIro(g8_E{vY4_DmWBT`w(zSmu2Q_}jGf2t)f)_u4(alN4H
z9-%<lTY&}FG`!MI{7TB~-;&(2r)W=H*4HCPm3-Evt7d#o;Z2xqHS4@i!I84!KIumS
zeg_Tb1l(?O`>}~Fjw{%RWA~YSwUSS2+!JQmnqTWYs(eJsb&;cd{{&~@OQ%=fx~nX!
zW-6<dsNndSWx**W)rU4Nj&m11`SD@Tm#O==^{#*3^Z3Q(Q>l&0X3^}{XEIhk?c8GW
zO5$gY@~kI!Z<{Y#&ts6iMCVF|!znI>g?u~*5|^evlau^$L*wMJ_S|?^g^+g^n^Ov!
zj2G1CDScLG`?@ZKe{D!pb=A}Ge>Hby1cb8=teaK3VOFl?6^&G>HpbVtUaZWVz3ol#
zb)T0#lh2ym7M1I{z3GQ$)k-am*=GgaLaHj_ULUW0F+t2tW^Y>Xp@6-~=dUn6Y%k%c
zDV$fdMeWeMWj%`(A1EHxS2B8#^x|+AGv8KEuX1h+##O0`h96XSP2&=qz-naA_`i9r
za?XdNi9OzHl0|w}<{Xat9CmNf%ABaA6P^}+`B#n!em2_|bz1X%@P@d&-|RlNJUR1P
zDldND<+Oh9!j*47*v78-`@5pYcGkX!@%x;7B+jJYx~dqJ`{DHTGTkPv+*d7?KUL}+
z+%L|)fAM_HqGw5RI)`i&!o*b>+0(!6Rp^M@TPw_RuXgX1f*BI^GuCLk+c|{??4I#I
z;Al&jS;Cjnw;|E>_ve}4vA1}?t@7jicNtP&oFjLcuMBv$VRyOjtGM}#Eem`zkMauG
z`QJ?I?%`hiVYc%pSpyC3Tc^Fw*@Zv4YHo6^f67v=jchyY3|uF~PBc7ls>vcjC9Z^f
z>PD%nfeVi@dZnApKG|c*xo+P_gNb=u&7XRGIVD*Fx>aLyHhpwW*0Y*%LTk$O$*t=}
zW3?C;O;bCt?ePnFpRIE=53HMYwxdWlVpm5)(*1X77mF91Q86vp>~pHHugu1zCz4+%
za?7;ETkidO@cv}%W`mx0x7=2V%jy4I;Hq@?7qk3~oo9Yk&FQmTe$S`1|GJdo{$sQ1
z`u6cZmFTwFR`+4@sYJHuOGX=BbzJsZnWQ0q`s$Htm%j$l`zr5VQ#g{_=)TqM+>BCL
z^)Qk392x(<dtT)@_UW?l?i17G-iCdixFkK-x&0Hb!S8!q=E<g&pJ%N*dSSYwv_jn%
zfdDRn2E*jkWegG<g8DbA-CNc@N$ITkz3Jchq<6a{9C|v%z500lqV4$$vZOg~yjWnF
z(Kc!N$=8#d7#^JV&Hh}&I=krnJe|d%?{+%gmNQX|>IzacTXD24>%)~Tiyod;2-=-=
z-DJ^K?V=e6?&n9VFO=5a`OHM{cwo@IPP?B+4x1*VbuCJ>dvGJFcijQ0Mx%R~t#7V=
zD;C%hxI<}u)f9~ikI40@(@s>Z;4r^?OXtZYj>gHZ)0VZWsy>=KdEtbkN0xirtT>~Q
zu|R0kd54!~BHRKKFYejIB(<~i=cHX)kLRRp{djKMozt%qMR&J!{`PFQ+UNg5(C<YX
z-`StFYTuS^NIbDK@adj&tZ&7Bg`KiI{x4N1()>m8BX`a4Cw5Wl!q+&om)*IZ7?aG|
zawC5>?}OSY{&QYBd>5A&X`ArXNu$J}*ZkRnFFteL_S(tKegAmhGy}C=Whsph7?sYq
zChotr?Aw#vu4yZn-H+bNU&w4S<63CE<rmquiZ82QUFl%%QsWi<cj3oIZ|~D}SMv5&
z{{4ILXxraSC!QF8eE8yx%rwr>`-ZRoWz0MfG{a`D^0lOZwdXHql{)W=GTF#<ef~s_
zBtDg_Q!<|JyV%)3JXu@4^4$LB8F?!VA{WV-RI;wle&=)H&gB&^5<XwbV{KM)$vezb
zYP?5$YC+2Xe>eS`p1OaWnebQhchmR7nrV)SLMwkM>@hp+_u{c`SJKq?HuZMx$^m_b
z?;cl{9-g+}uK$zFkt5GL_dK2K^lbuP#e!|?yf!VV)6)EuDpI$|^p8nnppE;<7nVLk
zXKm-(m@k>IEI@pMyoTie)g6=no1DCObmM(R(VS;e=Z{!w^14_Zijg%7`qESM`D!Fj
zwp>M~@ih~%s?(t>d=)=1Xq@TSoX5UF&{T5i&a0gcyC>YzbKS&X^JB62gGQP4osu>x
zZ}v@EYTaPtFsH8PjL#3n?dxTq99Y79W};yq<NA9FXCEnd2;Q)`aJXX5)T!5QJ;~>{
zkoli;@bl{84&J@n`xjhX;QHt9dtHVa)|tMI8MA`fwjI5gs&6k>XJcu@XZL3AT-mvM
z?2mW!@jv7;UKUcWkvL_(t?QS)vWffhIQFiowK>YTVe7wN9oNo;Z`k<jTgSGp&4G^}
z8S*mrZ#G#JmmJa{cX^t$&C;hSw(WxUbz3eQ1iyVZ>60PvVv~BO)sLQep3PI@QK=2O
ze0#$Toq1P^X0?7cnRzrjC;D#%ON*;S?DQM6_S-CaYO}EHvwQE4Zso5VH{D5>{W(uW
z>cxshRWhxymx6AevFr`B6uSRQKb}L(W4YFn_}hhnvt*Yt%{-QJu<&4@%=FVH;zxX+
zTxmLP$$sUpBEv7Ct&?gP3)Hk?Svy``Y>}PMa_@8{ha9`M)_noz*$oTkbw?{zPI>0c
zc#WA&DQD$^tbKC>f3^8vvT1Z*wIe~{)c<1fhozPbUpQW;S)MsDarKF|=c)5-<=syf
z$GN=KX|I(lJlV2Nw`XZt#o}jEExg+oHawFOv0S0DskrBwLn(uDqterkqvx|a;!ZE*
z$l89*wp>HwWM9zxRln;F&o4XLed~y`h--|z!~JUUNuPaRF4%jk$362r*P6pmRCfQ^
zFXkdO-ReR#$J8ksKHdzraQ$Yo^<Mm)z^hyKd{+r#xU|S#cJ2u+agI%Cc1j|=TIWtb
z`66@9k1gxdl~a6avsQ9XvNdgzTNLWwyYTqR_-7Zw-y8RQ_dfsr!kZ75gFk-QA$`GE
z-C6nVh9I6qo!48o%<c3Ol71|-ymHOOwPz-OtX_Lv(8q{jwa;$1tLLTMm(LEkb>Nuz
z!Z`}}i_Y-RcS<n1yt1EzcYEf$ii<m@-ZuSy`$EjZJLZ1UpX9aX-FV?<yWzLt@;K-9
zAr7lwtJ>TRJNM??PO1O%t5?1`{PX@feLj1Z-_`Qp>p$GO7P4|aqg--y;`XY-l5+LQ
zjZ=@Esn}@|(Xqkp;5y3{h7;wk+0MF}_kGprG_9^*VXp!dH%)Ge*y&<F^+Ao9%f`zw
zs<S(mc)5$*YY<U6bW-Ken}!m{6fMIUbF9T2a=1lO1yuxkcB&}rGAiz`^qKy`)?fGB
zd|Q9_iVS=E$?h+>&S^w`UBE4R$RVMGUo5g@Z@QG~>lvx}i?^-|4bmvpJM*4*-igN5
zPa`%aUyVIs=HTDjusmUpUdpVQIYnX#?ivy%a@YO8G6;z5xbgDf$^&Ooa(DuIf<(5j
z{E?!2Uj0I&SI^c(0p(LubzR!ETDuq*_@6EP^(Xbi$vdwad4KVjY+QB2s4F^t-4l~X
zA`>-dYSvmAeT(E|P-Jp=xi5A{^81*x&3wQApLP<mOuwQQ=E~SPvG9r8PD>N5GM`qS
z*GZziTjU?5GVL;3V0uVP>&$^QbA)aQt={amU~&_KV&n4!@3<Pf&RdIn9II>i8)6<k
zG23YK`em549AAX+l_s_{wa1S4+V(7YCidi|W&a^Ahlg*1w_6!p_~HD<V3pG`!($&z
z|6aP5rm?Ea$mQ({(+=a`-#0Ee;U!t{Z&#Mn)x^??9mmgQzM3;{?Xqhp54u$P*iHDV
zX0ch~fR(T8zksC*FUlL)r(L#6+0+>M_P4C?YM$mdQ|?_6{MpXd->~Mb>UZa~YJQnN
zo;?+15pPZ3U*%F+vSGqOlT$uc2PbMhQDtU4Q_IELwfb^l>Aa6#+HdA|G8_{Tb-WP%
zamJKuLeUc%44*I`+Am$nt#&$dfsk8NrSLiNf}Ul+<@t7$`E5DSd-v$RKdZERn9S^T
zE=J!qJHkEbh58wlGZAwmR&ZF%ycD?qX!Mk{IX$IiA>BdTMxs}?s+g<GDf;N|NOSF4
zzhK6j>7Emp{_LvSp!zsUJy-Fh$<|f(@~$q6)SaKQLT7c?uT>m(TTIusnK}Is)8m=-
zLCdCsLnm}MYhSAgKjV_syC*DA-DIF~{`c3Ld^gvNF1fxn`}<nns}AzlJ@~VdSG!%9
z7TLu6)8S2uW1*DaPJ5m{^VgT<4|r-lFXohGo)=^lr0{<C9E*i}-My|cw|`W7Iw5gx
z`a#nbMK%%2$`03cUYua*+{622!tZMfWw#tOD^@mrnI3k{-sPu|`S}%dH70MHQFb-(
z@a1VqZL%k;q&}_DN*1n-e7Mwd<AT?H(^fjwuR8ry{;5n>f>_oBzpp``xB|0WTf?m7
zZaVxfx)2j@th(p3zyqcu9z8GJrd7wu&bqcS&_6OHJpFx)4cDI5OofON+dD3qo}c7X
zyE{Bh9>uk}O_((0WZShxtVtTjBCB*KKi?p`<I&|TL#eH^uV3|vJ@U@?wb_dk#Sd<<
z$?ckIm-CdTs(1G}Z&^pDh?qO|TFrvrMU}Q}|C4p&gGrCVnvAdA50+m&V*J_ebI-mG
z?p@)jy2|m-UI^wN7kE{~dghH;)X8~s*Kav{`&&5At}q|d7TyUz53S)<pSf6IyA*5I
z2lMm0`!{aAx}*H0*1NwvPiAwj+?>2e$iZ<|Dig<N{+T->QcQ)OS9ECgGTn5{i{1F6
zxRLYP|C~&jzBA|aBDv>qHEuh|`IN(?WbOGjRX=VU&W+WR`F03T$zQtesnCR_yMzzK
zM|oWnO%Hgt;-<XCX~D)ll4&(-m&|+F*J*Mye#-Ni+vaZ-kQGZ|jP^Ppz+xDpx!{A=
zjbas<u(IT}oo~0K@7%wo=uo`n$_3WX8GJGhDduKq1!g|JDs)<)Ib+Mb6}LmK?s5x!
zI=}vbf`;PWQtKmkvJ6W#mRpFFe|!0COMS%t4b3InB7a@Yuy}fFr|p4wC7)tl)>the
zjXUlVr+qk0xFf98B&Mo)FRf$d{Mi$JYksnJaahX>k4`y8fj`TYx5WCNJ>l^;b1&<Y
z!*xj&-)`7RpE#Abd4)#6qT|tFuZ%eMPG8s<mDVGs7rE?B)_32dS-bCAYJ@H|Vvj#<
zI%{*0mr(DqtxKxBnf9$b6sE6Zp|19rYi2Wx>fCch&QX_Ue#p?_I3!)P$cc+*w&<m>
zS{s!XZ_%c6(^YLw>A!t=;lU9n<Crx*ma1!hFfUr~rn~!teSwkGTV1ou5@jjh_bV}8
z-&1iod}jUyhF5yG5??>n+uU+$@1z47-R(NcQOd=xRiBG|%#Zq>_#fd^x#Zo01$CWM
zeB_yr^vz*<yUc9nqG<jTY#EIw`crj#^&fb63NoDM5!sgYPI!SyljN7|?yi%^7o3_L
z{`K>8UGW8WIVK+8RaLs=7A)~!v*!H@)qPb*8|Ur(&7&V@*{}8X)>2Ict3aWW*HgY4
z##pQ^IIU_S`$lXo<J`lquT8zW+UZW`<(0-y+7#~CmsdBH@k?v69!^YeT*s0A>GSki
z4|dG#yAiNzR&D`LvOz+O--Culr*Z=__AzSBJExR+=dJbB)uD1`%PxK?-mbDI_vS6G
z-8W?3ZTt1`%b!KECx7I!<yyF{*Qzk-3Vr;;Dq`!$D<uz@d;fI4NGJ$qtmMiH(^%SI
z!@Ahu0MG2#PXj&MH>L)A8h&bgbzzcwt<r46eSbB3La$HPd$Kz1ybhoJx_nh9`vu>n
zzC`^$Z(-KmazpffbYz5=S@zOvb3>d|cinQh5!8J2`hly`UM0Vj4;6XU9htQHnVnzs
zx8C*bzqU$pJ}rG={YJ})-*vz5#XK3_CxIu74T{8<rCyll_;ulOzS6tzJ_xP)`D)#R
zE%pxoj;>#tVRFNvCn|&gzTnROj4uXdZ{;_sznIsddc^8U<Keg}%MKpfxjlVrUevKK
zUc18SUG_5nPLs(yRV_C4t+w^tebsaC^3J7G-`on`w|u7M5siwO%y)BAy1iDktdO$W
z=d?H7Wx3wjpU3nRUlnuL7at6oVyJnwWlk?sVC@UP)V)6Zt7F&p$KDT1Ii#~Py(;}F
ztL(z586Njc&qV2QZ|V>@)EBU0izs*LqDZsrJ?&fEtfo)RYfL%nQC#aCwO-9wc6Vun
z!S+QtVeg9Fr<FV99&?S=Nv#+B5}@xtvFwUByR=i`p8gpHg`MF~D{qE4oPBZN3}<5>
z-<yY>`3oAJJubgH^+12s@v|0B-{`!E@?7@f!IK)fDV2*;r<xyTDXejS(Jgy5mv7gd
zkGA(C<TA55G-u8awO)JLob|n>nk%=d!x6W=5^FiuZFv2lhwoCuVKLu{kv&&tv*hr$
zU0QJD$^G6l-BKO88LR^Ns>1CXl3jj8B$;ev<<4s6(*HG4Mryvv;h={SPxd>VJ2)qz
za#q%-U{?JnRrOhG!>w0TJzKCT=6#3sGyel~rL3kTdCl$S)2Lh9sjuWU`ORhDH|~Y&
z8<)DCw3d8u`+3-u9LLJ;ORtNL9?9ShS$g8y-?Z({4<mE$I%hK9ee=9{_xh*P(i&Ng
z2}-2hJNDhm{nD13+rC7m9yAv<X;cks%6vQJN%_^d+)`U}q0g%O?DCJ;zy7-Myh3pP
z_u@GR=hZ!*znpo=tFj0OyRT|%_c#<A@9SlZXIsHE#lf#jhgoVdvt9YFg+lW8eP#u6
z34BhPd1~g~C6hx^ZY%6w!CHPqh^Nfw*{RKQH#aUmx_<4vgpxk1C%RK_#jkQdm*@Oz
z^;_raNk@ex%quMZPE!nvSm2}+AaVJ5M)`Ku-W--=r>@<Il}XyJVl8piC9>(s`jVeb
z(pgL|HqLWjvq2(pnn&n6hIb!gH015Pl&?<U$vn#Petzin_;p_tEDX;rHElhAb;Clb
zwpUF-FLxi`mU?{-<0r8Pw@ygAT(1i)+<x;K<K3N~mMCv`Q;+_;;@a+4`Hy?O1Fm)*
ze<8L^a^cjXkp2Gyf8R`O*;N%#ushjod)$Rxj89{kZodBN@%p*KvLy@t6l<nU`kS!P
z=G?R3OIs6<YMaIxFdulJ);(p0N|i)cYNCMpcDJeBGIO4^uL$5gs#qp;!%o8QmDkVh
z4_jP6xAd-9aeM92wMGlCueqq@;`cqX@%7byxAS&U8oY@D8a8T;n%AdYJr(5Zd{4CR
zBg5$!p5=?gI{p3U9Xc3jy|ks`XQ*k%ou~y`Z?B}*-U#b{CU}_t?n^x*UG5F1-8mV3
zr+$k1oHAW6xY~68!Y;n-IlO-hLxV0k<<7B~SpH(?rJJIq2V!`wt3=(tYn=&rc_c@Y
zv-rkM?WIWvE^2mIIG(>PczA(B@JoZ(AdiK0@fm8G-B!-wZEYtG-4=*nEpS|PQpjVj
zH_TNJ=X+1SA%0?wYVX5I7fwgbx#Oy^kS!vr?engeYqoOR&++@s!gfEX>t=nn$H#`S
z1?h3uXJ0E^nUz&LcggC~`U`zY9-kN5n&rjMUdFhxF6zeSy1%Z<r=Fhr#QtjYf=yz#
zF8zA!AM#h_ZoOU3<A=h0o_o)Q9DAGHv!l3n>(h7L$DF2Sos@WLRetF9!`V(=E3zb$
z<{swLo_SbjQdQ$Mzub+t9;?n$n0=7V^yD(dLnaHaU6>@kVD_<#c9T*rZk?Q_dwbe~
zV(*X1sgHtxMBco>n|rBK)o$Y^8}G~hV&@-o<Q4j?i)UbU@e!Q2BEyYgrReQ78xr?#
zvse|PqAOFvCE*)ZniriTm9_n`(Fxxs4x6mL_=wM1t`|%{Kg*o-ys<fX+e=oKOrwdq
z6B|VRc8Xni7P+YVl=RZnbNe?Za^7~@e=ciM;f$3YqOwUz)}9)_x|1&(uGzyXV>qMW
z)h6-deSb{__SfFfdayV5!T&3dFYlW^b;;g~7dm^RRifYiTPkz@?DQK>{Og$CZK^jG
zIgq+;zs9%cH-fa5#nj$jZhrc8c4F1v^+(M4?qFH0lBX5%O!s!`+9dA_6Z3zsep}vu
zHRgX->9QBU+?9_Vcq&x8C4|55|Ap)J2e!YHDCSN7%FNg7Ie+49A8&>x=arI<Su3_4
zy4s#tviC^b&u3q5U))-qq_N~PSJ9sZM|>`rJ^Nq3>>S6wH-3AgoqW8{-RVwgFMgtD
zcw*@yE$1Xp-3?BwbwA7uoRRu4DpI|5(;2Qk2Q@xlWANEJt!6IYSu@7{7i=90cRu#@
zz4d>wt@JtTyVjRZnYiyeFMh6rIXOexs6=~hQR;y;C3<^yX(mP9Sg8Hge}Vawe_Cwo
z5BU`D%(CBk_v1vHYwjukf9CzxU;kcSMq{?krZcyH#{Xx_X_DK*pC`KFyX%C=^D)_B
ziAD!5|Ki!E`e#Z-``)9gUso<TBx#oO;je9(PTp&QUDK|8N!t5tak8Y(RqwB}Vuc>;
z6yRMEeoA)L+gB?#oPN5h;r~s&MAtPh`-`$xil2FM=8wUVNpVThN00Jv_2<Y=GF!WI
z7t<xCja_?}Z$Bh9<B;5i>6e!H&3^uVW<~jz*X@U8LoQ$W{pP`*(@$r_&#Lw=tiOJ3
zX~N@T=Cbbg-K<LP6)y`P)p(s#$W^=I#}W0OrDR^c^zuh9b@-m=E?WC<%j?#w<|#V%
zZ}-~U@Yh+f%ZbRy3;4fc>zF^Qb#mO_ZQOJCt$!tHHne5Fk4jl}ySYLB?2(Sn-wQrI
zmYyVWch?K|xl`7K#a9P@JAZE82CX#5f1TMIJE!Gs^3L8Dw>{Y|V~q#f0~z~(Q<=|#
z^M0?mp0xOr<NC$Hw~`oM|F~57xahl&?&dYSMeiEl-0^7I*5@m{0_4@!8m@O1j*7cc
z*d_B%eBs0z(KH3i2U}k)=}7u6v?6)sq8!lx_n9j{c_}XVy>$DlZELfanJn;dza$<s
z^)1uYRXK5=b~_nJOU{Y7og}5ZbnfQa+`qiOJ4th@7V>k)F1%K@VA+zZk+wB+S>kFg
zg}=3r)V*xDGh%hL>z}YTP4!TopILeh8)nr=$@*k?m)p;*KJtxK%Inp4dx`&V)|nlj
z`zus>ZQ`x6!!M`wR{i;O_({|*MX_0_FL^i2_T#FmcUp0KVhC%{)|u_E1X?zC1y1-P
zYvc7L@3Mqh_oMi!W(iGE5s}BfhMljH_^h3oW%n$R*JoAy{Du`KrA-TB+pA*554?2g
zv^;mKZ(;CUi^R*{BW^@YFX3=rz4z?ehgKF}jpwgF^!4j|$M&{cJ?mZu1Xk~r>u6E4
zTCpp2eJ_Jp=B7tW4DxsF;r<wB*0KK>@0!KD7aGfjTOYk~PpDn4{=V<t<?L5ewF1K5
zTL!!n&+O=_+u1BP)k^!@YnIw-w!TBW*|86eV|O388pL+8`S9lc_TSaw?d&Z#)8+l|
zD@R}K`n;EKJ(rN#|H}8t%r3F7pH9CuY2VNFD?dev|Fzh^X3}SK7S=4CqEc^R3HIBo
z%fi;4Q+3=^)${M;lDZzFD*;iv&ILx_iTv)l>dyRYr;D~ob4=XzHRLA8AD@sPMk#k+
zF<w)7uKQ|+M{|zx^mB*4+EzIHI;f(zyyCkg%R=w>zb{|@-2LE1%KsnBn-4cH?w50T
zuwr>)c5#Gl&Grqq|NMCIyT4lg|F?!`GnnpV{rLFh3)5uRi~7G9-=4e|mH#igLYS?4
zN>E~KRsG%HmHIy(emR^NT^~MI-5}iiSE--U%S~QcPqkxoSG^CnUh|{!Mq{XH=CZp=
zMY?QPZJnmQUS8O-YYn^q1@*f761S?i+}q!|eCOL&8tra2n&L-|Kc2pKTsXj~><A<0
zg(nFf*PiJrR~&d-z0oR}ZJ%Qg50}^qpT0K<sk^vC`zr(a9<Sg^5eha6h$y(B>~xQJ
z&rSyZw+7BiRgGc>*(-Hklo>2_nfhbfeVwS8;<c%&CH}p<2I5n`Mrn4<+AhD#@{yEt
zhEksFmsC|{)4~;{GQYNeV%q&_@=YOa*=E0s7tFUmnLSfo=7i}CT}z1<r8aEevyRWY
z$k*#1!|+>#;n;Pi6qo2dVY<#jbtP<O>QbAoB`?<RKI?n>=_y;Gyi;bY`I+UMpWp2^
z$U2+#Q)f-y3)2a6CM6fEmwn>fURgY$SNF~y9iDgghO-Q26-+Z)&OCLJdt%<q9`B$R
z%dEFNvD)hP`?u9c<4C(_1_^JkDJL8~QX7A6?VMiqmDl+HAKqkBu>M26?8AlqS$s8;
zC9dnAT+q)|i_DXGHYq5BspYhIxaqyN1jn~*zi!ue?o{_)o!l#WdS&w~?hD6LmTjnM
zTTmV%rWhl#XI90mxs&Z)lrAo2ZCBu#Bln~0>ihSO2QyzXK31RpxZ>~c-v$$+suo^f
z<QAW}(qzFjyBlJke(w$_cq8}E_}r-kCKE2vpSxu$uIr_HZ&`jKY0>Ta?C-PHR~)#a
zenV{A+Fh$$I;0Y1x#V2E)qHNRyy@q4%aqrY=iPoYmnBSM+La6+H)mZxFk^Kqe`C<o
zV_Awt{LO)>3yT~I&N<wf!dp<~{wj9EjC0P_Uw1AIxUKo?SNG1T4bOC3+TvbUbac8T
zKhoX0RB@v2gXsrs(?ae9?6p0&NjK3!H|Q+WQ+X3tyFwTL2o+P6t!AP7y@lT=++ViE
zHRx$+Y|9t7dHw0t;`SVM^ZAy2T(J8c`|;yDKYFW6utzR=^x^v9JHET$STwxcE2k11
z;C5}-!M*$BW)!HN`o-&3c)sbcSlaBcRo5d{?|)aDGJEb?i`Dzm_MTs6o$~j}{prtF
z*nZ3U?Q-eB<Zqo(X5U{XUQXrz`^=f+4zus_t=7k%t>SJ{tYvoHwXd|aC$YM@jp3N`
zPv>7LH`dmkvbOxG{5$l+>{@M~KhD2WZ=AK$-hE2`^7_>6nO}MrJ(Rzye>m^kO8@Kf
zmsT>}dvkTqjAr90uO837fBNt4rRB0*d1ro|o#L){J-^(3mCk{4w+o|XPBhql;^X*r
z`k1g;%nj8iGqyE8T3xW)G4DR}Cf&8-J5Pli2wZYV<BB!&4G)IcP0IYwAFrNM{Kk68
z_n7Ms_TInmzHX!cx$wu1AvYXu)@p2EzPm6_p?OtNrsR98qQ{q;CfL693+g!SP@}A8
z>r*sKWN}PV*B!w}M}jXsE#G6k{r%hE26m~tYKb<QhWwNK0?x*Ay}D#17?2^d{CxPj
z=l{L-98`TP*3mb|>wdDH)5f2>?=8?>61l!7?9PYS??0CAfAqn@EheXY>(4bBT%XpL
z#?7nI`lnjBKP)LAcDM2z-7Ox<al)KycF+5s_uhG}kIc?3yKe@0n@@OQEA>snN2oUY
zc<8Y%z1LfJ?UQ)=<|Di8T&WHI$p#{FkM0%ijjGOl{akI1K__q2o7ZcL*37mK6^+{X
zD$nTiJBd?L$5*}giv7OkF7r0NS+>o`*tVZv_|{eEYxRMvA3i({TYLERHj}bDWolp6
zg?~t&QMgU-{~~dg>D_<WxcsMToK5|vs(R*lbV}l9M&8Q;+1lG@oJ<SuogZr;tsU*f
zz4nXl-TP~%-9KCWT+1`<RbSP!D}~!a4zHiQ*m**lrSFV=Q+BMlXLh)p(R1VBe|45t
zmPh34c#nDf5x7?{f#<owVzD{S2{J*a{JfUR1+GxJ^{Bh*NK1gZ(7M&%1HPnXc1hp9
zoNLi(=9k3s=tEBAhv-{ZwF}?LPLbOy711BI`(8Wu(SriQEP)T(HXqTmy1LWvIGctK
zqmujfGr#A_Ej54Q5yh^xEa%ye)h4&U{##qfyizXp?h($(rxpY*jlHe5<7&%SsU3@}
zUTFLf)n6NX!@J<a_Q%X`@9^%r{z&oqdYK*lEnbmgT1FeLa$aXkQ+9Wr(G(W_AMKC}
zmteh}(QFJ18$>X69^@t_XJqE3LXUvi8u2>swwcJk_sbtllHX+Deqz&K38spSSxcfX
z+__+}`v5PGn^o7%Q&Sv+JohT_Z@GSB^4mF!yIrI6E-fk!v{d5XU;N*rDmo@s?(fdx
zRY@1b%KU^b_$}o+v(IA2=?X6E>Wg{#(K63Iw+5C6tA8u2|52EpU;bWQ=JL4}w+}r%
z#x<SWoYnBq|MY}n-Dhh588&{t_V0K9gQ@Db9NQkJ&69o^vaWjXl_$oAGnce#^Z2Ma
zoh>-Wxw7<K#F1~S6t~aNu2o+my0}W?T<NNJ&n`t6e2vJ{zOdrhtWc(_A9~K5xsq#p
zHch_1D={u=NswWeTYapYKVQAIT}^e-zt?sC50=NsK4%kpnX>oSshQlLs~#SR^D@un
ze8!WWz4I|onnZG@n7GZy-DkKQf*<=tY4fF@TzTn(TWZ0{W8ZGCb8Y_<bgpHoDd!Ri
zv!zpK`}`8yWFlg{zvFX^v!(z1+>h)XD%Tr@`Gc$l->{49>)&wT>C9Q0>}d)`XXaN1
zh_yKF+;c*xFx#O{gg^L#u1@#QWh^%yZ9BDbMeUg@?gG)LJO36XRrvemnM!P%u{b^P
z%8k1biS3UQB<}FE9O63o>V(Bt=OXntrvDa&a{jgw&~)?i_IYZj_Bv|u2a6BEf;<J!
zSS~)vWy_vyzJj}Cj`|Bh$0?o@Z{DyfR&G<$h}reI_<*CV>+(}p^CFL3V-Q=D7n5{Z
zYVouiy01^qsPQT`UOi{Uq30W3emJ=6#ZuAF%6@S=n|sn0>C`LaGTr8xoDtre`Jt*b
zc5b5f@6xR+Yr>pvRoDoa>HF|>W<|c7E~(pp%IoNfwbP4Ucppnqnx_2PGRW|?WKM>_
zsiVmTMyxCveeukKdnV3Y8vd{D(?Q)Z`J)Gp*EPz8eYui-!N6B(X+eVLHmA#HE+3!S
zYVR<g{pqq9oEK{2_UW`H1_$40e)-GkS3-`ARQt9ish+L#Bn-Sc*Oa%kC@*-v(J({H
z>5$cuiC3=K9sGLvflpdU>x7QTNclGlDpH#F8~ZCw{V`8qdvO%!UX9Xs-R>1!hvqHM
z$}IgVe#`EB3eVpMSJy8WU(fHS9xi_UJzu~2dp$k3^-W>Et@><MR+Z&-1!X>~i@Tpb
zTPC<pz5BF7`@_#WGefo7%bP?SXTA)-#g=-^I{DqlkLKM!qb#<wn)gbW#}+j=9kb$*
z%-zDR!mOL;C?d9SgUQUjuCd>E`SOx-)0bcJ)0$a#!GV2Y{=WP30u7J%^39N4#K~Nm
z)KYgjV$-U%ySJ^~zo^$o#Cgdr)oWEIn#Nw@8}ib5t<(Bm7+u<SqP(<A^1PnpTUMTp
zP8DXy)YhBoH@7Y3?*AC^uzTgZlijLZGmkoaFxw>+cE>DTtTu)_tKomZwCh|focFBj
z6SQx9V%;|Fb9~_W@0T=gC9`gRs(e_WQz2#dmBk0%Yun7xnEQl3EI|LZM%SK~m!2p7
z+`FXl`}>XmKX%^Ne^H*<>AmW6d`PZ)Plv+P!jx!%X@Ri|Z)+{65K>*D;hcH<?CrUZ
zTwd}?cBg~RAIf<rc5oLT^ES=I1+F*BJbZsFF?wmf>-cW-xp$tt{u>pSwd%}mky&rd
zI$h5l(t79oW6P{dr{-+m@Pn&q&$S!NSC|Qw8ZSKMG0VDW_u_e0I?-E~XYDgQA6%Wd
zz`CPFYG?E^yC+jEbj@C#2=dgN_5H-IM{(ZV&n*s#T)zADckZdMu#K-HUb2`7{FQpy
zWv+EB>gA79Zj<^gTF>gpt+Q5;zWvFDd8Op1+Y0l<H%A-X7Z8vZV>V-5{jV*>_}#H%
ziLGAQ8M4N9>pvcl*!kju%0`1@v!$=xX+3lO2m4gb*Go?=b$3+ycC3B#3La0@)4z0s
zKioQSJ8*ONDS^zcduiQ2m0lFpiX1(`_jf^Qf_vQ*{nGDGcCMJVccagpv)zw7mOqfR
z5G~g@Vdq}9M!WgS&$T)8Vh`^(`O!UNcOh4;Mt$Cc$8A27`kLF``-UxbdbPwh=hQ>q
zY6r>fJ~jGhK7WvWwwinX@%;ge&lerO>~i=2{CU@of8gJFspaykP4E7Gh<aQ)vyRts
zl6vt=b=d`%^$W8q9ac-!Iq~HGjxSLCd+BxD%gEyF*!>#Y^*(EFpL*)=)W^Bk=l(wR
zl+7$|hiTfYeMMJ)^DcU-Z6!VX&aL#NUefBmK4E^Vm+F;l(LR&wyd!f@`Du2AU7wN{
zUc7qb^0um->dEFSGA*5=_FR8H<qz7Ob$SkZyC(=RFjSjk+*y~KoS$0&Ig#vabanCL
zZG!*r&u99&)LColirv}EPp$|RI=<68uV}rcb*|O6_C+26k7PX!STv)*{@7h!&NxBA
z_2ws)%xdFKPaCoByGQfoTjp)p{Qdr4o65N@Hq&c9X+5f(dW2Iy{ml}NL#Fd>zR#1h
zO<ca{#<Y`Ju^XTJ&$mx~o_+3Kfo74|M_zx|i3e@MJ}OvSb$L%Tyx;$NmEO+xn^m-3
zA~!0WcNGokJn{76#g899cJI;J-s+JskLUD~6%jgK+jtK7+w@0lIMupl(u7te?MYLr
z4IaPnm@IV3rj|wQO!3LHlkb=@KiRcz(v>}-x0OzY>r8kPvr)3k<f)=z>W`iZnJby1
zs)<XFi8yZco4oX8J^%Wu$@4N#2W@<1zOW==R-Tw^`o!`tzm)I4$}_(8WpYmZot8Pr
zdT+AJE!pwGbHzRTraONY#GEwr7M>8ir**s0jbF1B*8ZH~8F#gH|3sVnD?~FIQ|B(3
z$e!z|S#&94^K-5x51xDeGkno+p8SF}L|}9A`#<sT<9{r--(&Ij<JH^m)7^RgN$O5t
zt)!u9Z^dM3bX0iD&Lh`*POg&Kcrx7Kk?Dq7#`WP@Rh&H2e_lwta%G|t$9YeYkUQ#m
zi<Xp}J=`PWeB^%Doa|*uY;MPAIp&;_xpi}i#$?_Lg&R~wRM{6bvi~o3i&Oe5p>s}F
zQ|d_U1dn^cUDDReOCuMFG#YjIPl=x95oHkYDcC4`cY01?cErx;is?HquQB*>zH<I2
z2C-?Z{Ek`<)4tuGlv<E<sC2@5i`5TY;<`Tx-zq=tuNn~~yWzrWu1NkM%?QOMKGQUV
zc(jym-)7z2_IdLoOMS-%!QFnVOl9)aF1>hIIwitv&lCm6{+EBJ-kHFh7dh$hssp|p
zvGW#-`nx@4j+nx<H1Ow&4T?|aSKmK)()F~IwD#e}HA~;}B(nUU*Cn%KMZ$TW;|7e=
zgi>mPIyw2=53=^mtFoQ6)99qLU$4R5CrdtB`PVsWZ@upD;Dh$U9cjhevRggnxQ!g8
zj8;Ba^1-XBBdag>fUK9?e#XA1jNf+dc<bjf?Y-EFmpY89&sW=Tc>imebeD}^Si>E`
z+n-)#yXSUJxudGaHE*{Kzbi}2Gr!oQllA8cCS~6-Qajk3!uUpZ`;(<g9d{&5RxM$c
z>h<W~{5Pt3rI^C*4*o9X5;3p141=t>WwG5qTBS-KK6od);Ky>y%emoZUm}A0`VN^)
z5bEKYeJ=A&^o+GHj+f5*<-t=?JZ09jgjIW&y_2?(d(F#wbKgm;zRA*G{dhCp+j&^7
zthqncruTT&axQz_mrnE3H!p76`q!1~`AL&%)xEpVosry}zBo<fMg-TYCFcZxciGM^
z<ulY>^mDnP`1y5K%v*XdS;!xlY;fwhWS()k$!*5A+8I($rt`fjQMM~w{P5`7svXg1
z9xSOnb+j~Z*95CaS(~riJ#<klt=pmS-<MT_hrWDtx{zhOq>Md7_l-yA@=5#`Uh}Y5
z?e>`+$b0?X<DJ`bi|t?c3d)`OqYx?et@nt5{+WucVu9HgVowKT89zJ_)UhS@F{kxO
z1GXL)jgJNMyL7lec~nVO%r-qQ**}Tvugp%)mX@@v3CkYMT5YOQP<A`<&O>vXHLDr+
z%r<`aO=Dgy$H7wz?!5c5j`8_o_9|n+tGincM};Z9-rl6ZbTeP)^`84*3^mp++b#A%
zH0|O>7S7UbYh~2t@W#su$}?NB-a3^nW$^Ow?HQ$iU(WdYCs%&C|EITC8!jJxruOgB
z4d-c128?&Ut#JAvFf(y&C~tqQh01PzyQnoT3K!?@2+(<DW3*wR%F<fH8v*^T+}ZB0
zrr5lEZ!8q^?11Z>1hvWe2mL;aHds{L>`&m+T5;$AyZi0BeVa>mUuU+=YAIi8tCF)y
zG40N)b*nBMk9)B>y2<7;Z^R{`$5YHwK9;m+r!4t#m3y+}BC)k*OsC^!GtDfEm*qRV
z?~HZtt0w+mHPt@J3cHnps}#A@7lkRQ-wh~h&KGchtY^_*aph~em}_%E+3Zf0T{BiF
z?zT4QoOA7Q&E=zcy2pNhxUF`_!oWGV;ZCE<_uQfjyWeL$G%)fnZ(_Orc6RsQf9?C;
zY!F>~yxW9h=WBx->mOS$7F4md-m~M|$JY~;_Pv{X^+wio<}*xFS4~_pnS0Tb2Pa|^
z6%uZJakFTb`Yy;S*qczTX)%wteaEf0GW!Gr4n8R|5wLRX;rqA#+1$Q&iH8)f$NgAU
zoVWYJhu=x7j1+RG&26oIruq76m$%mBGjEt0o0gZ&ZeXnV@cm6=*-e?-zt6w=|CRBt
z>GDta7DpH)&*<Oob|O^tBcH48nOgO2+JC}M#|1d>aY`;UPQ3SJ+m6|H!^*D}WUt_F
zYmmH@`mQ44chTB?7xOdrJ8o-v5`JaUoYwCSmda%}JVkEK<VZR!q9Y=hP&V`aw`~RK
zNj$RqOLJy0Wr*%tnbgr6A0+y`&i73l=a+(yYaa(c=Wp+On`C`@%g2KPvmWo<YkF`!
zSH*jsAAwFcc{l8ume<DkU+<>jkMdPFO5c{7moQ#$e397peKGrQlbEfJTh?(WYz%$v
zaJ?v9;MnV|<?UJ%SR?jc4sV(EqcV2MpF@*u+~QYp$t;<>fXCW*D;EpPG6&NM+Z<l^
z^>mb)t2pMKEPii!AlYF@kE5pGrykR`2@z*aO>g^}C{5X5yQ<TPDeI^5jOQO`bDjUt
zYHYdn+dI}v`Yk?rcP>tid%{^Q8vMZZYfMU1(W=dV=h`0rCUYo_XV%88y))Ne_uRpD
zV2#Yml>)DWAFN<o+2VO5(Z``h>7nGitz8V-(}WDZy|kNWZ>3UjU9Ml|`-y~yr})hZ
zw8H<`6=n9%v0X3N;woM>?a;PdmF0mKXXfPmZE!Z<?7@^W!EMu`22};;G|6S+-sif4
zT4I{+Zc<oxz~#%8mA|YTcbZ=NpE`e`?Mn8gnV;FaHt6yN=koPmkK1H>@osxX?ULfv
z7y15ayto+{J>!#tyqI3;*9#KAj+adOc6h`7iTgQOnkW8=yCB_g>vWbxU1`wW_JkkR
z+r&y&P1-t%z2M2UJx6v)ebJx6snuJ$_TV)J`{t!L3Xb1+5FME2@a=v|jeO%uv)#3a
z&bh?4IpoKNw$AZg9&zjACKZ-{t}&GhPb{;Uf2C-bXNv5SO{*5W_!xW6p1ba->9qSV
zQy1B_sVrPM&3{r26GQyuQ|hO60~nvoc(GHsZgItnXBw*QDJ3tb9T%Tozvs`JPqR<&
zkFA>i?&*o0R?B9j+DtgnyJhW?eR?c*db{L5xLd8rdT?ig*-U5g-0DcN13t!yS>=5>
zv$x%9kCl@6Qh$E_Nt5F?^4?`@ZNgSY>^k>cuEgpWPqy?j3&~|YH)_t!YfQS=F=?MS
z<EAHbB-aMBo{6}7y)Tlpm1XkmT}wU{iT7>ed7j1IS1<h~y7_%`@@2WK4{3SqKi^qC
zZC`x1)-Y7xP{u8JwHKe!i=w;wOKw;kIK=SR<bgvkA6u-|G4?lBHy&M=XXH&~mRvCR
zsGHuI^4j(8-)qip|H8}bV|?;rtS5tKr|7K{86mSY7DR@-eln?OOxye-@M=wx+kUq9
z-5VQCy=zbSbVf3Vdg^J*z1i^H>(ni$wV^?4U#l(*ZI0#jP_+p2`~T^v`1yXTl#)Z&
zr~fN>WiGR8@9D-^lghoDd0h6I+;0_Lclwd6>dH$SLac;-O<r};NnhRi4(Hn$>G|Ou
zRn>2{&TekHQyZF8BjKt$Wy|x&6R)H!JNI_(cFz0{cRwb5ahbZC|KM4B+0a0_Mq%BA
zeeYkl+w$h*7fh2&cWwI>ard6-o44Hha)R&Q*xm|X_U2Nz?sua)hbLP$PY>o=xaNah
z`Y)XgM^(7<{JMXMe7c>raG%`srl+ObSaMDz%u6}0wLCE~(7Rw4hw?9P{aLx~hu++L
zwBf)$U5y)?^WS=wpOd?}rEt6H^_#sn-_F>l+F;(W=k<b?8KqCH^0&x*aAr6f!s5($
zc&G4WcMk#Yj=)D+;;KHM=j0XsJ)qK9H95=r^dy@`jvW6>8z#=}dB}WTp(2^}h<Zl<
zDxGtmdG-1vXNbJ|=YH*W=e#(Thw5dYpT<WswK(*;=go4Q`rqf1y?wY5`>z8NO~NNI
zcy_P#OJ8_W+vTCv`}p~D_SbxW*t<CCW21nqzA5i9BlCqFKmIG(mS?1jhTYH#*?!)p
zD1M#P-wSJd{bt>pB-?zu>qgj>C##xFQtjtE-M@ZrMeqKZp06)F)O?+l|Mr50K<$oW
z(ZL;zzE3W#WQx%+Q=BxT;Z1^KpW)sn<w}n;B?X_{6H+d)hy>emIDgl@t+;B_Zs&kI
zGY^QF8uHBlWjudFxy1RH#mk~{H>~n`V3TmRaXCZsTT{(1nG)qk94DQUeNn1r@A+?9
ze0{g``E3HlDW9jSuRkBh!}0ClCDt$RSH{W2?R#-(+SY^aiq{#u-Zfkkj;<-W&hzO^
z#_771!V~7p*{R+1UBIhwqQ+I%YmYLQ;}%zL`|H<*@^5-3tPm|>oOxK`&&5YvjK2#O
z8P(Z1h#skGNp=*uXd4);Cds_uqOa*LMR6CAuW2jlLu}##S+yHV8@hI#_WCYnSN-|X
zo4dC+^DhrBxgNapS*BGc`{|XtlqChLR<_0*T7Bu*I^nzSg^n-3<XOnc%O`V2-JfJC
zn0RB;yRF+V7VJyczn-S*SIiQ1`9bIg&Qm*!>pngFE&e>rzb|Qy_55hxTgB%mZrmnn
z7IUCxE?0txpLoE`tb<dUpNMns+1J1nzVKpC>>hi|{|D{spReA!Jp9%A|KFaR<@UFq
z|M$zMr>p1dr~MLLza(zvfp7oz`l-E|vb~3`WNq0y4+k%f6Q^$NJGQXQ@#47)r5=AL
zCj39N%1Ej(^6cE#9CBZ?_FC_)wl`hz)w<lu`BzA1q;HR;q0_cf9{C%#*K8cwxa`|p
z4Hn#7o-4detT>|H{o;?_*wzZAWv5qsa4}$8!_<G~=z~Ri9~K$(yWR71v}k?2=F;!<
zX-gE%;-@mYNN`r{6@3!%$#G)zZr`hUxqp6%?(S<m_h6rDqvb&rV}s5Q3%*QcRnYsf
zUcb@(P4ePz3mZQbZmZrVc3sEW`{Lz~(jI}~{gL%fS0mQQ+zxYg%FL^Lf9n0CRp+}K
zjg7ckvj6N>c*On8DPp$Tlnp_LZkN0`@-<LscFvRcN7warwM%U4lI?#y&F0GcqXn<4
z+bfpcW88Mq{@}sA_Dj_IS-!26xpe8&tKQFh`=)TP<-Iqby7}&nzNALmi4O{1><QSH
z;Aku^^-Mg%eAgDPFr$+WC64D@buX`FJiBz~+a-CL-y``;1q(9&*Bmn5FS9_gVyegA
zCrroYRwpVj{{EPzJSS#WpFPvU;8%%{oK`$%uG@XK-!Z0rnf2mt!EIli`L@R<T<L!B
zz<#=1nCf$dj_~~WeX}i<9eNh5b7>2gRy=c8C@km2wSTiW*Uy=?Vqwa)d27BDp4a7(
zu-R>H-Lz0^nbOWz@?XyIPivfaaW$*@B%%2>Pu9sftX^rz&fyp;ZEzx^E~(|==8cug
z@7rScd}zM$xa86Mjpq{I|242lTN`=#taxx4^S{$v&CgA<c70bZm4CU-VSm4#p?CTZ
zgEZ^RqUkGYUT7Dodv(suH)ZdRKHL4Pl2MH>dX17q`0;7c+b%rY_CX@W@tVGekD%D;
zx=p(0XU$r(@dW!69x=IVKXx7sDqNAr_xcC(`@QD&bBY`tZXN0}{C$Vra;AJ@<@=A@
zdH3-oy_+PFD%yB>PILeFD~q?Uc|2qCUiUpZzWg?3whF&2=Uwspx#+_cW~~P=>`~A2
zx$<&x>oj2ohEjJ124U3md~%cX^U^@aM%%nCda`Ze|F0rDu7*xb4!&~y*t*>-rQ_Ew
z?Oj}9A2MyuZtY0dV3o8svGy4POO~9RC-)*w*?-zQHisq!OQ~G5saBTSXB%F)E#AMI
zF>QWq+?>DP5AN1^*!qP1xu*WAoOvIMPTgDcIOQb2-=W2OYs<8*%{GeG(Jm`0`Lmn(
z$5-9mQAOY8c?WKoa{qJ8nsA0QT5{{H80!DpH&|Bk8mQmj@OjZAOB<c*i+Wc3h*Vd9
z4q6i-a`yEqy-JadIjrZk#Kc=yWOUuReK|Su=xMKxm|2afI@2r5viF@zjZNM8Q*BnJ
zX#E<wQx$h>?yuRLbTH}Ux-$VvpXR7nSt@CoOu2I{a-LOkr$(hz_(o%$Yh2FdQ^dbV
zYI3FYe@<zAbC}oSaAe@rL$YU%I`JRfWVARxrL^uFv%bZK;3<qoJ4A}sZfm-ucU`sp
zzSJe1j05+Zdp0-C*JI6Sn77zGaaqlh_4c27zwS7Cdv2=!j_GG_hE{yF7tddO*?y1h
z-;aL|^Ix`Qvu|<hRA4&T@aX30*eQ#I6nJN4l`M=|^El{}t(4EF2(PkV|9sYJ)++aW
zD3Uz9{F~>6gxNl#I{zlvT;>Uh2}?De^~6R`IOM11ZqcgRKat0|P1?^z@E!|tJ-}(%
zYP;`rN-6J-yem?_brhebZl4qTSF=i8tow)AbH*C~M^Qy#9gh^+Vwc+ps+gS&I@q8z
zLF!V=u9+Q5o!W=KzkAI8{+#`uRO5(O&zZipX0tBge<<xxoOa>BuitN)S0u3Wd&g~%
zDC^9M)62SIn{ZspjFaWaPLUr|LcRGG3H%Tbi#eFQ>13_iWTWQ08`mWK|Ml<f)8qWp
z?dQrV_47ZS^!%rzb)?+8r8Rvw7Nsf9U&8A1x#!6t^ItbvZ9l5Ld0?%u^?{eF6z8-W
z#xqY+Tb!6|Uq77lMswza=NICxeD8_b+aPM7m42`Okh_B3y3bk9TJMS7Xl@Ss#~?EK
z=NTK$n5TiE*X|tpQk@{rFBMx*-(dfGW_i~OiHF{f%L<RqJb&2r#Ir?uK?k-zW3{-g
z^0;Wz+zn1L6S%&en58W1GQH*POUv^UO4TH?)C!_AXRlaY8oQ9|h}XsKmp*NFb>4GK
z*5vedvBbhxzn)oE)jiTK<mWn>QoCF4XugZEq<&YoiMOPS+5I2i3;UjZTXti@uLI0W
zZ69P9%@jTGROz9GwnFw?pV>zbDql@)6!=jg^z2dN^nJIq&a*!#zTm_i*Yxq=zC9nz
zCyLg22bwWfHu1YyJ05x0RQ&$e<eFU{Z?z_f>7=dPXL{TCbISjjinaOq{=e-5&)m0D
zn=|97^nSS@hrDB7#jY`2U<^5Y;;zQ2t~Fgs@t<nsH111CKF=s-kZV61oX|euq1C!+
zi8b0E*XQq>ZgVbk!AzUXn@l_(Izn1cIq!>=J`r8u>$>MrUHMwi2Re1eZ#AxJq<+Zd
zxO-q40|)D++D%>Zi(4Ko>M81&7<jJRb!*Gc`*Nk}kF*3?W~zy0^w%;Mug~9A?AZ48
z+~l*Lto_)%eNM%yAFq_#>gHbfX3}Z{w#^4;9JI;VDY-69XvPhX=$p>%2OGsc9^7^2
z-NE;jlTXe#kf8XB`<uk_#YI^OOIDn2$=2My*;#u(m-vI$Tb2J9#Duet6`Guk<qxyo
z*0DrG*<dH{f`ttmuFu@tuXA|CsyULg(=CtZh!!z$ocSts;j;<D<70E3<6bkw>mGD}
zp_3#jo|z}$`N`Z+`$zLzqt&TCCk-sW^Oj${xM)J)na!+EZe-r5?BQSxbr4>p_EUS;
z9izy^7VC+MDUY;YS~p#tb?NBh45!acQ|xlDbl5l5CB3?KZm-=gNrw*mB;P-?4by);
zc+$?(6XH<tNmSxRawRt>dqKKgPn>S!Ru-Lw-dzEDkCW^B-syZ*pImTK{&EiE!gGO|
z>F=e^?zdPXcfV)7&+7CIMf$DZs)ZIDkYBLl*vfz(P650HvO&g)zrQ>zby~V?Vwllp
zN%;xfljH5ZPl~DTVoUg9+B-+&^RFMf7&mVAUo25uf5nRN@q{z4?in0au)PxE?r8dZ
zo8~!g4+9&X)yK2u^oURXz`FH0>#WcGmu8*c9KYx<_l*zJFNFV*ynb`~=69DTA2vFr
za=W4DN>2ZYvXbD#9L<&8(sRDw{QaZvaFJ?wAnPh0hW4K6!2tpSSG;ui7g&fCUp>(9
zYU>9rx7bEYb_XFvxBd1`Pgi93oYOLC<htSH@*$n^=a&GJm+gPkFZ-!?zwl<S)^5mH
z6KIsMYsOFU$dA!H^6wS~E$EUpT9x<y==?i8`eMgi=j8u8G~d%L<CS-CzqW?2?$(0R
zbv?!!-*+!PbjNz}E&nOf-&Q7G5q8a*H?bo5?)6~Ls9Qez8s7~(+aCq~o}pzHBl?<4
zYq|2O`p(6E2k)CRNgp_*{P=eu%Wt2lo4wx@1sq>I?T6uJ*X-vTl6y*KxQT|}mM{`A
zTVmp}d+Ny}N^ke?Fzap?nxwjk?WiA@_%cxuap`FeZR~NJ-38i$chU_bgjP&@vhvoP
zNt_*>_Meut{h2sH?2q85{W+}vG`K50f^}8o1M&q|tm)p6s{Q1dtLV|nZ5kC;$L@!(
zkDI&lo`A?-Q;~HntTKGJQ>Gh*N=-K@UU-JF<MLY850Zv|{MU*Ym~6^w_I$3@@^+I&
z^hvgvr*gFe4@U7vb`>U^>)UVZBsSH7SzmS9iUXH*&P#rJ&ln@JpMC1lt&AH(&61xB
z#EAV-_EfIUZ?q5h4%EM3ojPUCx>qTk*@9dOA|Df!6?#u^ar~BV#_A#bCpI<Vsso?e
zRtLw6P0o3IH~Rehm|m@%D&XCizE&=5)nm1Wn$RF7(Fet%|4ptZY!z9a_+rzJzhY;Y
zqpyBl6<`x_Y*jVWsd;BNyA=8gx}MKZ<XsUfS+@Ur*)#r4xpu;bm5+XynYSodF?E~d
zNuE2`WxS5vw%9rQr^2KLSzom>uD()r2j{DAZvWupziG~BZJFh(+@C7?()Ns1w!FcA
z)8AbNjb@v!Pm8;f%Khl^@rIlGbLS*H|91WT4MR(}*0S}BvyVsxT-cwIy+8OQyWd8+
zFRwlx(A+uq!P3c|2Kn;hk{r1re;>?$&#TfDVAC-7>fS}4ys~r8Oj{ta=ZKrA%j<ak
z+d&0-N4{J?(8!$rC0h4j-lL{1{XAhu%R@vbm<qRco$}M|y3@kjuq1QY-j%N(zYI8d
zEyw5Z+g;Wr-Yb>~&b#*GM|M`!{l-hLHLJ=#1#fA)8ht#?ef}h)ItN~6AH{z~zgjFz
zuDH(EC_Q+b`JoK|i4Bq*{~4_!6j@3hWK1aESN=9L<L;@=^;<aIW~uy<dZaHuf#q0%
z;@Qc6&YS88t=yXS%71>R$`uy>rV~?VHf&n6YU><1IlYE?zr>WTzAD(um>w*%&g}Ks
zL^V~Gy@wyy|Nl0dvBx>5RpVGFFTYe7f8Qk68=T!rS1lHVy|`t!xo}Imcpty|sac67
z?;54Q+Ad$s`tnAp{OtLxUe7u`c3z!t`bR$C#K)9caVefhijsRhgFU8QwLBvfoNQpX
z#jHzWX~h8srJL(xTW9?7I#<mgn_64MIk8uqk<-;xz~PvoNka6pe7051J!@@qBI<ol
z{TBV)dzn?l;NJ5qy{~HvVp^wiWw%IVG2fUL#3))U)DbRf>v&dhS!MsP#}Aw?_?>Cx
zI4mZ)fz^2n*Yc@OlMje=BtKXZDD;4dh2zH2<u+1=jeB;@h<+&YRx41Hb7AO0$DlUX
z2Ak3gFO3aLo7UzEA32(5{$u%Vhr<gPxi0<Ed;5dQI`6BDq8!VYhCbN^$?P7i3+(Q6
zGM7I(kT~O&^WL%ran=DMN`Z>AioXlA2uyr&K&0S4<Ko9cuHti9RT<NEShk*%JhH7(
zOz|7v#=2AMH%oIF{0QIad&y_ETE(RoshyRZ{_pnO|Ni=sIqNxg#@es>yk_N+#isge
zmu<KEY;b(XtDLJP8TYP>?m8g<vu*jR?M2g6uU<{_ZQVa>@iG04W%BP_ztw3}#kO{M
z&3$CI|4whMn99PUnfpW-Km58Jtp0H)v&E`siLVdujS)B<dt+195|eU1!4G>bY(Kc`
z*OC+bs_RR5ug#QZm^k^h^^&j%Yqk4J6{1(VRTy+yt#R#Gm66K5q~==r-0hLdQ?{Gl
zXV03S_atc5znmwBGPSPG$P87}TbYzCI-NV==k>R1bX#|S)4V;AXTDSGtCVROWqiA5
z)m%HXkTHGI)F-ntt4_?k@nm0`6mP_~cBi0MHwA@Pt`%dbz4mC)<XG>Bx1RaoCadPm
zF6D1~o14KiSMzXm#@CLN-5QohoRa2D`_}e+XT=5X7aOC0+<9=>y09!ZH8ihevfb*(
zSN_E<2wU<z!cy^Fim<p{@0KZ-nC5cclMEL(Y1kU}H9_L?Opmr>|62O@<k||nZSa4+
z>4-=;BhSYxhw2m;Y++r#IPG?CY5VRgPTBu@{fzHi(7O1->F^W7FYFm=GmcB}C`>QA
z;IUpdbLsWIm8vq1URPZ%ExL05Sj)}rmnE%#Sw}9Kz2qs^s+6@ov$%YoEW4M&E!I9o
zc>CYvU#Hj2t6Mq2;!W7g39KLUvv)mwsd@2oe#^FRPj8&8i*denE$vm?lKHCo_578Y
zu|=+P#d}O2Y<#(Jj*5%tedm^oF^x@S+r4iZh9sHI`&Fh<dWfk|+EQGSTXdoEvoCGm
zy%h~Q?zC>~`LOx7%<umX)gJHM^^kStc3H2?hJYT~$Gd$0J8JFye}YRR%IM9ri%a*0
z^8ENBb-&WKYfXb@RPT$8^^5qL4*R&BNHG5_p~$w}?(kMO+mZ`AxkK-WX@zLkOYYdw
z+-I^S{X?$%f;FuCC0kcUgfq35#`wMvaBuV3+te}d)^+V$t}@5}2ux>{?fnv-Suo2|
z?%wgz>Q6kXhaO+K;+*IHpK+D{U7IJFFG?2edSRb5!9ix0+tbBYTUliCO4jSHnkCG5
zcG}%v?{8aPTz<ji;<sOmmp63?PWT=!`9$Oz+ilODShE=8bqj6(&)l&ud%N$A7yHe9
z(&PRgSrFQ^=1Q0J!dqUo+{b5J{BA#g|8A@Q0(0m77pdK|!|MN!hnrN_HdUQr{dXni
z&R5&GX^U904s`b3Ke1Sz+apXf)c@X-%nmOOf%EKbc`p+u{*=7%;;@~3mFgv{?GNJP
zoFl`J^!^F1c=LFDT*eOhlD%4|W;}J{)^91jx-h;ma#29)<=S*ESs~$7^UA&y-kc=q
zE~cj_lj*k3+wQzvJ74bin?Dyh91b>~J=?qCA!Dyk>BNnZo@XU&wby$8p0dO>?Vaw$
z-3*EOObxG-UiKZ@?tCx6`_it4wuvVaG}ctC)N9p@VSaOH{<3achlxuwuS@+ss}b$K
zh2_xVoh-SJZZd4nU2LFjGI?6lImcU)&(7Vxw(i98-I^=buRU(YwRr0)=M6#c`5(-5
zc^=yIfnQ#K{k*7m+U?)ZE3(=?pXu8D>{Qm=r+fZbpOl;&>wRNKiL8*r9;=Dfn!*3&
z-yNCSS^V_r{0;4TtQ%Ont#*p=Pkgk^`9XkU?{THW;@%TORj-`knm(7&Y~^ZAi@o2&
z*5$^$C}>PSWij>bjFpb}f2}uc-t$t$gxT8p<kz#M3j~V8zBe%%l%G^Q@c!|WzGT-6
z0sm4}t5<*E_b!_tck+MZ5s!Vws>^S!`{nd@mJOSo(1GR4PZ~d}ohVZt$tuaLsCOX#
z+uMhEA~NSn*{02}p3m^<<Vo2*e81lM7;m4gaQ}FC;4PI*>l>me4iVnlwQpHoEW5#d
z+=u!4{NByyv~JywI~0(=cfMNG0%MJ9dlx=QP;h;@Tk7?<hU5FvlHdM*H_0LQ{K1|%
zLVK?GZe4xH#`&N_RO7qXmRs*TezotO<M{Z_RL$Kpf2A87_vGIv&}=tb=eS8(^p8kx
zX|)4Rsqc10I+o9meNk;N=jA`9)p8#iLb*a`KM>Xk@k)u9yS!rV`)S5&1V6S^O!dsX
zKmF#;!-iGgpU=E@{K7u2z!^VPW^t{$+LnKK&I<8Yy{F>3v$fYv^lm!P5*njg!e0E0
z#cs`Uw!%lRXV$IXoV4)PEt$L<-(O8<njKf%So`r><?o^-y<<yn%H*qvPu<Cq@lJZh
zC;m>uziZ;V!VlkFc+P*(dG{HNpXUU4Y|PJ5=8fVhzV2>*dGcfR9|bkWwswd3)xR8k
z&ACkQW{1GBU_NHcWexj9ejQ=gpH`5Zu!gZ%q@>;CL_^<x<&@%weGvugx96sP;djaH
zTK__g_nRd5L!mo+%(~Wc-Tge{`A4T&Znv&f70<EgjJ@;BHb{8=<f&HmFRL|cmF~vu
z+19XT`yuz`uiyWgYN#?Li@&JsfqL2EqMZD{=5bf8-aWe&e)stE+bzO#Q)69jX3gcF
zC{Yr>O1&%5``6pcY2_8CYcsZcedzovl@=OhCp`awYT5lYmkMQ1CWxlxX>VK28`~>i
znSbrO9mf}m$Xl;xT>gE#vC@)%)1{n!nHI0#I!HuZknr`)kTsQ<Qxf$cZi&K8nMg*)
zyLZnB-G4XhQp5lEJRBMMyPLHhFZ92%$GpR_o;ByK*V=`58D33~km6pnJ-Fw=thns<
zz}q6hAD8|vbLcO5?%LtA*ZhIfLhe837@78JCuF=!aj8qX``N#3)z2ioU-_%DdP-i~
z2kF;dbV+J<6W)+LcS*se9q**2DwHqqZRmX-tk1CJZ@>kWIF$wcqCcG9q#C{Y>@TbP
zW^eP#l^c#PpTC)X_lEFiN8b9@#&fOMt-r~%-aF-HrT8n8-^Fti?M#nXJz#vlqPy$y
z*%L+1>r1xmjjO7k8<r^&U%e!-{$|B|H~p9YFDVqsR)^2*o%Qb1qKSdGj;Z_R2*u{#
ztU7V>-hBqtVZ22gGjCb(F)-}XU_iecF*hZ(EH$qTbT^{Z-~8LhzLx(L4Oe{;*zI!r
zW&n@W6~(Djk7XxSPn^CbfOVRZzgTwHlZqvxj+g&^+xz`ppH0xDxeJ+iy7!d7e|_(J
z=FH{U&ni!E(kOmdsS}l+8E0VcdFhb;B9n=8`|75jvYY%=>GWj>kIZ|&e%3yF9yH^*
z)0)kxBH`zYLd61e<}Gr1;yUZt)o)3&T~FG6R^9!&WZDUzXX2|Zq9pwC9tP^}cy@JB
z&!Y|JuLUY`+xLBa6?MX7qnXv@Cx)jkr|3?4G<m-JKP54RgX}D`YdBrnE`7cEK66Ti
z0*j98rQ0r^Gx7og0;kOUuHpLW#`_JA=T`?lV0(B{RKR5)<6ikS53W{Bb!&XFIp)ZZ
zeakC-I#-zJ+`I7DKk2qmf$Z|{vKM|&y1TP{{~f<QA9tVpv3&Jw`Sv4SOmROBHhVaI
z-tSbkbW71o@w(;3)t@Ur75>Wm^lz{E&q||I<!z5|x~+@(==#C#apW$+oiUvj%glfK
zJ!jqR$8DH0d#c9_`L+_PpS7J?EPGQneps4NrxP5Ldem!8<itnyVoS0k+$J(~^L*0K
zZdl#2_m9EMdolj@ednDLUiF;d%}S`e#(7j|W2LBKdybZT*t4hmE_!d@av{0-ed9$J
zjb4q6>uwJ}9F$PuY1MI?qodYSRKdum?zX)o%;BnjazxqBlg4QWa?Bp>U_7eg!eh|6
zz~i&-dt1l44W6IbU8nGy9rs+!asJ{ylPeP%6<B(el#^yYYkHbG=>eyu)WZpqfxmO4
zR2vh--|eivS3T?EhM4pN@lAOKkLugkGs<`y?mB%sedlh^N4lqr61aN)-dFt~WfWK~
zS1cm^{9XC_M*d?rS5M}6dHDSwc11-7!>2lRXAI^9L>QdVyVJdXQYM2{)Nj`9eNi=z
z>Xnc7Fn@}%oK?8<&}3t2iTWvyQe1ZRe#-fs8rrHENy3cRyJoIWw-f0<XtjoKNl|0}
zWd8hh>-5#-6~A>Js{is?klj4$x95*FjQyfAvjlGNRH+6C7S8J2QyDW=@nC1y9saHt
zfd)m9PiESL9=GM0BDdD!NniQ9Ub~Gmbw2I<<kNNPRJNPQX;}}mf_d|<7dvVxcqV8?
zF?6ujAKSsFB(uNSYmdoyqnBx)npQi^c-Cb)Wx439wy92CHP$&9?yq@PoXs%*l|IQS
z&iUAhXhktL)l-v}7K-G2yqh%pXV9fpY|M(XM-%ez9hlF}DaG=obX!UDR1Ud4TXZ&U
zDllQ*dri;dVCTIzZA`sqU+#2JJvB!vB;Zw2Uu!kb!?>31uQDe+*R=S5cFMjlvnDO(
zknNUelP_KNU|Xt!#@vO=Efa*DEiRtc(D-2Dd8<<Ul~lq6kpr;?-0k)IcFnu9Z)f%L
zx6(lpB0{1mXM2+tI5D?(|5_Av@a~#L2~P`Z{@;zS=)b7BJ)Dn|p>Oez#_f@3ugkoU
zQOiqTW_aee=;n229&xz*l76olHDg-rk75f^!3U14ENP!Uu>>haT;X~pu|j6X!ef6F
zJc`dO{CMq~T*Ar77ZGp&EjT6FBY3YUmgjcglDV(fwbWQ<%X`X)Eo+K9v-NbRzUw<>
z&Iw;4c$f69WGYsblX;r)zUWhC(O=G<>SOvp{%{_+-EaPXM$h{_ug&GvIQA7Bl&WVh
zt?1k@wjp@u*RW@qUF$X!tkr1VAW+feaUybYLec%ZKJTApc*^B`Em$8sce9(>mY9VH
zZ`iBL|9iT3Kg%_>{PlHi%f9d(?hQJb*MFjC+suxIb3B(Op69)kvpVxtfJcJzvG{lA
zzVF#6zUbV#nQGs-<bR4TYLMvtH6i29p%YDs+K0}Dn({n6*e{g+Fe#v|Yw}yIo8P8!
zYcnccpCQl~6>}|c(W2k-%>Mm-*NzD0uMg8O5J+owx%u|cbnW%)ZfSI#X4bxDy0d-i
zy$OY@C7#~uyYIefgHVfBn)5_QUhPQ?K8McAy<7M%!tHw~|AzwmW#ZG>a&Bj`+`1Vf
zAJG>1OyJhT6MI984^1@H`Bd^NWWKEVQC|5?+XMbO<(^l~P|$q9det*P!9lZkhvU2V
z?(6S%7w=o&BOXyaJ#%JDU+KI^y=fPxGrw<`pcqhpL(fCw4~y)B#q!e+G2bp+we8?T
zu4c}FAB`OP8!k>N5eg`<;A%VM%D=<qb#(q_-SyiPbXQ3H=a82=dbuZK!E?)xe^{${
zDpZdq=3La$H1Y5~o~1HHU`5u^6<ig5ss15)kp~i3ug+pO<9laNl$H3)%zp2`$(u|C
z?G=-RFI@gPS!?mLAYa~zI+}42=blb#H$5YE=8Z(znqGmwmrQ@JRK5Cix{Tb6eR__6
zc<!=qTgi8=i;rtT@YdY#4-b7lt@QQL6@J-2ZSfsvCai2@cibR!bY9=2>q5@mQMpq^
z^>0Wd8KnMwYt=W2Jxi~C&!0w3mQ{>ir)6&Ux$hS!wP)KpPryp#gwsstW?2oD&JD5E
zSpns}XJ;+mx~NLt!%$%Do-d7ZQ~9Kxs;t;EPs(C#mbbX>l)$W?p${{DSg&3qqcp|g
zn$CrJsYNrwXT3;V9CkteaGutw?E>f2G}f<FH2oiZ!!3Jl)1)rXO^v>MGkexJTs_=p
zCy{V)&VS)bMlHRo8uDA&Vjq}tJ188jcJJQXYV~Cn<L@Qf!4A1w7&jhg*u%^sr67|3
zZlmqi-WBKnZMm?8%W}8Gt5caz?X|XQv?lv3z7rVA_|Q16x6^s9ykEtJnJw4E1a=7o
zuF$jF=k>~RuTHaR{>)e0W!t+_4xdzs{=HDatX9of(B-s7L-B`=hx-@1zIz@$XY$WV
z2E(+QPTK`lY^PXgC|RwR^x47d;n0$nDY9DP-OeYAcj_HrPf!xyd$V%$X{Tdd%zs5M
z=yoSNp0(R|XsN;lYX+v;$%jO|l@H%lG~3j(Tsb~Id;j@YKW_e$F%;l2Iric9X;b+R
zMqY~!b#MGEu~C&hE$g)Gi+z;=?8jnnr+nY9_J?6^*d?dk&8zQUZ#b>dUJ>C^lC)L#
z@$&^|m)&gdm3+l9(ZZ&l^*Lu~WLNFQj_F5>K7<>DXUv_}-o>VCl5#YHA$?y-@x%5X
z&lFyTt=T0qO{V(y$KVW((3kS|RwhYbcKda2kJuk5k`t73VntFS<JaouPlBD+@yD4n
z7R1^3O5Bc`&41!z<{ynYYLc><XZikCFj<HfD!+P}xGnkeOY?wlvpD?B&XmrXc*VT=
z>!Il2FUh5T(c+mhRx{4?sPCQ3@-C?DTJJ|T-P*U}feem`r?+LEyms;Ls)SAfi~mxe
zf-P<|?BzVn_L2Gcr|C%!RyR$ztetdb-giF}p*^Z1|KCSGjnSQ{)4e@lbG{p|ul%hV
z=f01p{NJ&1pPFO#dalA>&#PHhdxM20hzJyUYeq>)@l3ecICIroo@2INZeJPA&h%yF
z^0#}H&bQo>CYdJZwE0T&M34C^J)@Ezp4-d3e)q0}oc!1L*E%tMW<6TUAusB>TC{nU
zP|MASzyGe-9sK58#;lF+n@-$#-zRc&-rG51^Jf^HQCVPGarwnnrQncT9#<9C`N-7z
zrrfQIQQkgNUSlD{^nKq~tQLQ}xN3Fwrd<BV7QCVCQW31hQOgfj?Pd#lYoijJcRgNo
z5BFESf7=h|y>k!Rl6TGF#;-?7*VA6lt~q}w#3S@JXKDKufq={v9v63|7j8YTXJ9E<
zKP8{PCG@jP?i=N_YiFf5G<*{?{d(ZS0=?e`zjih1FMJcRB=gQZ;Xn4ah7TXBr9_H%
z`T4GEzuVW({N_;1%NGy%v{?2T9Tk;WbA)H7VBwlsV#dv@mTut{^gCO3cb3;o&B>;7
zS1p_LRbkVt*c&sXwq|a15Et|9w$Bp&73Y?}Mwh{4Lf)#=YeatSz2oyT_MWwu&_##d
zu9cfSZ*ZAyZOL8vq4-8%;87>nF5hM6cg=p++2z{4uzA8y9$~e*t7l%E`?V)|$~_b7
zO%fknD`v~w{&eTtK2tvR`zk)MQ4fwZXKGwX<jiBK3-w*U=F&2!GJ_wA$s0Ovswe1f
zSr?koc79>blEz+EcaE=>R&Pbl#U=i=O0mANfBnzZmu^P+tGzXn*YEmb?8<aLZpoHw
zJ(+A`i)StS?{fauo3Pbf?w=dWi?&^#`1bZfA;vdHCap8}c$#))`;*PF#S#1FUk|!m
zJ7wP8Xy?p5Q7<pu4cmV09(NhH$HO0Sm$;spa?HORzifSGSa)$RPfEx_*1xYdO9kI(
zkGy>NN^Tpg$=3;fTW_q|u$3+C>aRPWR;H^dRYaOwl{Md3*BEk{-&<X4F0X|s$I}nn
z?NXF?-8k~eC_Z`m0@c)CRr#Fho%WL#aDOTFurIYx`0>Z}QQ*&yP9Lml=igf%Q#-e&
zaaLa42G5&}k_R^VFm=^`FWmLv@xr)UZzW#8llrzPeS7e=)b%$`-#$P6!}{O0uixpa
zXBM#3nLKXZxKrSo$m}^X$84e(Y&+VUZ|9S*p3G5KS#I;^>*uRqpPqgGa($6D_r`yp
zU&n9N+r8JhFuU)Z+=g=x-A+ua(a(?ncjCGKkte}>H1l7Cn{oeL@XBvjdVtORlcC$w
zH?lsz?YjKMr0EQ&ZvNb3%UH>ObDCOjGRO4SUji=#Ggh|MoljvteA<R#-I@NmE9|)6
zv&4n}_$l_=HGOVd(h+lA=f!h(89y~P6X3C8e8ThL?9J`>jkeb@%Ki%6p0U~~{%)-A
z{XZY-9^LiR-!t2Pa=-j~J@vcFdpDkS44rUj*~P}Udt0{OWma32`K6P4VcM6PX^i4I
zbvx}<7B84qs2RTYLBsL%w##=9D)3Jz_-@j3D1^Uemf1HZFOFZSz3&>|nnZc=%+~5H
zKKa3I`#z=!kIORVX_Ig5xN;?Z$+uOj3wPDMTYc@wF0X(O7Awpo3Lh=ISH`D)PBTvI
z(Slv4ysmM5`ZuF<7U$Q)W(khPmuCF1GrVRIcyV_8#08?4a>bV9`evV(-tqN4{{}aq
z_}*{ZW4~tG2rb<HpEqec=lfR)EE7aL-qfRZHmAJNS+`J(fq@;%nvs;uV$khRM{Qmf
z-L{zZ|F6i4l+_+fRiE9MHBUD@Gwsqg>$fvYCT*HK_ui*n79yOU9h#GTCrnEXm&=Gx
zo}aUyS>d4bw(aWCvtMme5&H4ru6RS8-Z^{O|5nxOlV)aGTKlGitz0_k>B5R=myc2B
z?y;=ro7cT~&yA^BTh|?#9lrj*hTgTHKT4(ZI$iFaFwr+N@DDM%RdVd#_xgh$%>P?8
z+t&*$k5mn=h!m@o4AnZ%$2To?pJ3vSHLG_`Nz}N)b}v-v)TTX)6n{N<aKJ9+$l2>f
zp)O0Oef$2(PxM>$y0_+gv-htHuDtzkh4xgl{jXdDpKZKy_JNkxbgkTm@S@-y`>zW+
z1b09Cx-Q_RmrGQPMAf7fU5`vIMP+#heC}{xbEzgV{$Y7tl#3|SHhsH;{&gE2-So4j
zsx_X;3z?aIB-i-el3Eki%n+k>hkR1w7adIb^=i$7{nmSDY?AQLOO8}Hy!?@mo94Q|
zX3y?xN4A<6_k2F9c52efA8W%t6f9l!va#aL{jgNeeODC?EaTgrF4I~%hf8<$E{=SY
z3&x2y&2z5hM|_)D_s{oTTgrteZsC(uSZY^Htm{pBa6NIc^52)Yjk44pfB(nuJ8$x{
z)hidc2Ma!5>Y^wWQyQ~s(WNsN1MYcQuUzv|UE^&~42$^xk1thhe*Jv%B7eF3Jz1gk
z6?GX~j-9c(oAXL5YRRX)m#!{1TK~zyf9}KDgLChknxQ`Dbdc-HOULFdGKyO*EqUy<
z3{O<|&K+OG$`@R?7gC}9`{}hh#?2qs-HQCQjY*xMA>rQMndKUL80?yl-j&Yp-@=<<
zT~xZg{6TK|gSY=0J0$oHpI^`ZAjs~?R2z}oTh9bMNGS+=796<5=u(i&%5xvruDDjD
zyh_I2u|T@Q_fDl=&yAK-NA~|ID*E^F@XwnUy+vMo@12%umCgQoI(uhK+0@hOwM@q|
zLbWTh<7yX)3mg6xR+!~E&7_|%Mqr=0^`{FSrKaDvan|&nIPuJO_U-J@hE&7vLZM9)
zpFid6>~Tyq{t<IR^@WC(g2ew*vuzp<>v&zRv1T^7y6)(~%M3wnp^>L+i!u!=x*1q1
z{`I5=ol?5q70~s0O_#`x!nq6g2ZX8$3$9<BqgwjGAj;u@+A5R649TmS1}9g%Qhp(`
zFqvsSQ-N{}9}g1~V@JQJbghX5v(f4)1_}btOB>skupSiO7n#rWt&jh}%a808){Is^
zIPPh6U$&ZP%%>XfVD{_##;;QtIp<za?b*eBzmbPs??p+AB1cD*M?%fo#+V1vFRgxW
zZ!bLiDU$WocWXhLbF40DaUC<7Hz+uzOp@f6JY1T>QtKdgM26om<JW1OTMeSGSLJK{
z5WC-af1%-{>J7Df`|kaD$R3+-Bel74y4sgn;da8iIA1a4MEt5$G>&7AiQf4^jd9J~
zAHs6mLa#<$5ZEo%bBjq@<%MR|l%3(>r*H1B6y{MneYj2d{L$!zjRu}9?hhJDSmVOu
zn^_)lupBT7oRxCGs)uWhQNoEN^?S8Hd>%4S=6ma)nqk-$E4O{c*Sv}MjiMPZsYfoG
zu-fGSW58V--dQ`nI}*7#zP;PuCH_7Bzwu|LxNG-WvMXn6OmKMGZ1mjfz!Ig1hH96t
znbwmzxzZPhFHByv&@k}9rt)i1#ya+CCwxAIE!BL@e8fI1w#2Qawn>e{YzssD<BeJe
zuBc2^+&NcZ(O!Oy31$sii|ikow<j?k`6j}$Xr=X%hb+flBuGzv@kv0YJ8D_fw__(Z
zo$;1wT*b<Bxc|Juu0DMi{)J(Zy8=}X9#Cxz=+X%MvpaW-v0B@Ig_Ar_)~@<<U3ghg
zrcX~z>@md@o6yzoJj9ZpR<60^o-G-lt<uL-b0DpC=Q4(ON?aTVtD3L9Uc72*LgpIt
z4N|L*WwKU<F|!D`Ke6B~VSU0Us8n<O&c%IAC;LA0S-oJ4^Ih~jzG~$>#jF>W2l@q^
z(@WW+#MghE=-gD!$~kXgebLWXtERegu8f@7$^F5Uy^MGDk^`<Ey!ZY6sTv-6*tJ2P
zLF``2qZ6VnoTsYJ-8r}=Xh|jCAD^qHFO*dZF7`zxcCu)k&54jO6*qctxbM8ODC36i
zSu>gU94i#KpmjlHX3g``Hf9O_ggy1YlPgMIE&Rm%PtDU_#v+(o=9GE^_kY2>%q<L$
z<5_i|tYhk5c(li*RphkC(g0i5Mct8%&-(eUiYi_RxVlSu9;2z}-hj%ruKQS*ue&~>
zK`^w)<81LqVHP<DhrFYHPCFR=a+kNr?dr`~`1uQ)t<%!fU0b*!ykZ^dmWpYG9(!W&
z^3V^HO-?hLqgg(_&ge`mjBE^KTDe?-@55V;$=Y&Tf?L)dtTSz`3n}!N;AkJp(<%RB
zf6&vzKfcK<e`~SG=^9Vnq)#kI3?{0+2-qgPl4X{N!y^HPK-Li1&G|h0mHIYZU~ZbP
z`a;?};ojzrr3G2et5W3WU!BdmhN+IPE@{b;qoyj~RX?T8o}Rgh)kfi|kLryNLLHG;
z9sZxc$Qxj@$)jn3NrqKmXky;B)`H`wS5B(gux$}Tm%^lt^^*ncjU04ZBR!;iB_bJm
z7`a<&GCvpe6mJfd4BTOSh{65B3X7=o;u91<aqVGW@;WC}zrjj3zK2WY)SDLxKk8DB
zX)1(FSK(X~God`mekGSerm}L$Qx3rp73TVltdY|qj1&4c2v5?|TGDQF<Al_M7up)y
zKD=vo8Yxdb+_JRrT%$#!3-b=H#3Zg&PI1#*&h{)maI!BoWuk6~VuW0S7_+(N+QV0v
zKG`kfn6suYEW~or=N*lg_+uOxSIHgCj{YQZ^!bw16ArJvqU2f5vFFa&pcI|!rKPd-
zsQm{^i6cR46=IThD|wxiYc^A|t^W8%KK8qDN#eU(d3&7Ad%Z5HZOz@qD01*seV$`K
zdyQ~dT@zP;oJnHE-YNsG*`8+iG<cu9>9@<)SZR>^%lr1Jh5H{#ESk1|;<JY~QAZBm
zmhZ1?WLFDIR1-0qsc-vgfvdk*=A~+<%RUFIH1wEqcw^pa{#h@P6|MH5C0R6l`jps%
z@^Xn$I)1Fb89yl5J}l^&!|m+BzA7Mf6_>O8)rHf0E=GN@NDz6=>M~RB{)eSYPb_0I
zmU*k@C&sj)R-~cTu2gLCm#Kk&xr?Ndc+#9iKh)1v=jB}X;((^z>&+`!qWzToJM^BH
zd&f0?$~}-6d|dRn-Liz!{Z<pg7Bkr1U%GkeyoeyLQ;!>~mbZ&1?C;e%{O$H1&Xm>D
z=SjYe-J0oC<~&y_E4AhL^5^0YZyxU#zn9p)vpFK=*!=oGHDx82W?t0zGf&gL&aSrp
z&diG*l{Lq1p1gnFPv39DbY`<7n~sL%e2AXw%vfx_@YYwcz5S;ro@BUlecO*l&X80K
zucS3g=ATw+oXnCu<+aU&E$0N@%{X@;Gtu2SwbWed5Kq{he>GF)zt>}7dr*2=XTt5J
z4__?b++S~NxvQY1eCu_IfN5!W-5>5eB-?(&YP)(<NsB$-#;rdLJC^Os|DwS8h<B@6
zNqJ1*sx_ac-;*@o<ifL)+3f1Zc`1(F)h%CRe{MZ~ZPgv#*6?E+R=hm*i!<!E`Q(EN
z7epn#-;LQL#iWpUTj{)Y*@XoYdJ=c7`^B^@Z`Y5Cx+do~1KnPG$5-b9`3!2fI%QKf
zJTh^7F?W>)-$QxnvIB*VZ&W%Z)H#eeZ+mq7b=!Wr&}FyYluPH*s(4)sr#ed&C<inC
z?8(_BJ4LPFP-)4jB^iS6!=fuXq#k~=(5TfcdoV|Fm2u69{~L8Uj@<wJ$*L)5<}KL?
z?K%dZ_qa`*EhTCl@8)@1XPL&+pu68*%?i4AMq^%KuGfjr4r@v$ywOzo9*}c><EJ?>
z`}T2}q_x$Zjt%Djv}WBApG6ISJ_%l1((ZG@XO{Ea2|rD`=KC|L9SQuvsA2tN6LXeY
zT>RFD?83^IO#>s9@^62*tY-X!|5e#5jRfy$K^MB7v}L}F;BGgzi+;0tPr>C>W~(Jh
z8fE27|GD0+JDZXDuA^zuv?9@|A-5uDDTp6EbtKm*A<Opk<`VPLX$}lOdV)d?<}On6
zRL|P^#MCG9(UN~}#bO&I8V?8-ikOyNuD*As_~TN?{Tss=njODiyBF#%^WxzD@CVT@
zk~%LH>;C?H^0tuQ;#2Fj8Qs^{+C1KKqp-hYjZi{z*eA>8D?Oi03)Zese1CPT%2(Cv
z`Bte5UU6;Dc%l9)II3((ezu9E!e_szDM5YA!3LQd?W*qop7@6Cj_F%<$!9Zqx@I1D
z>;C7QwYS)5?d$t`Ue21ef%}e*zzUvVjsIsubQpEc&$$2j`Ss~>$K!lC>ICF+GgTEX
z-8{3|#M)@lvJH11@an1Lt#^I;PW{Kz@4pY!`nm*jdnP6*e$c<2!nf#1jy2=fdHTEO
zNtbw>%Kjg!pTg*VwygNT+w33H^!FXeF_`Loxo3;)tJUvfRQM*xyD-YW-*eJPI@I{Y
zqHV2evYA`g>00daGE=I4Vs`7`0a4#we<ZU%_La`;jhtDfQc$&9mh*d5^R#{MW+h9X
z`KR#k*gtu}oZxL{W_(eJGx%;iWSsV0V`^DUdF6pZ;aKkoAO3LFxd*RC&Ca(unebsl
zO5P+NE(u;HN6p|Bza2zE-<i+&W|AG;l3SX(zn1?PS3aBV8M(!CPfkw!W^}5c{8Ze(
zH?mir20CB5qI!7Ndzp|c=8|dRT!on_Y(_oX?A@-{Sy{F$HPvL;dvdbX)GD84%-kjI
z+w=ZwZaaS2>6X}w<#%7?uQ1L_sBUgqrXI<DBSq)*&F62Wzr1AMKJnz|;}vci8wJhQ
zdG|U#Jau$lS@Lt|`zH_Xe{TDl=h<{Cufslh!BaiYT1GGE4hj8o;N-0h5;*~jwI)q}
zJyY=EX^jsTP9MG=o4)G$#cZBvv0&pjUmuF<zj3~6B)VR`IfG%(Q6^?Jw$$_|Pqil>
zvSixW;c#PKrSe_F?K`)AIVXMS-C3^yfg1(xI!_)o2Wd@?eO%{0slYdJ`$M;^j*FAR
zmg#mKI92_=TI6;5`_}@O8|U9|f4lvreT_zp%>(zgZAk{RP28?8(<%;QoLqFH(eK)~
z^WUae-CHa_;cijQmc*7>ey7YXZQ{`Qe(i4pkFpc@w~1m5mv7Dg6H(sx!+efak2>Fm
zi4{hxdRE=_EIlDHbMO4M=k~1h_Fo?+pBwU7(lJQ2i`}2Wt%E13^=)-o`ISRUnj^zy
zZ@OvRa9g~qGG`y-+AC6*)Gxcd{NlG?y!mtV^uYVO1x+Q|osD;>AI<QpKC5{2dfs<Y
ze*Q1>ilwi`9#qxq=wh1uPVQdbHCv&=<5%yQy_Egnd-?J6s}biP|6dmsxBgDj%-QST
z=IOueQqFs|V6Q#b{eAWRe~sRs(A|=p*Ht0aA0DP)anES!T8Wb9rtdWO)&G8Y_xbks
zeivpw7ZCNH>TyuvZkN<s_SIsqKkK^0p19$vuJP&6cb$NORUt2S{`%=KW#5;Enx0ST
z%BCCFnM*q`%+}p-ZqMapW1*OeGnbto9$(qBsWV-A!-fOqUpD>spL$C9><hn??{nPd
ztF=1&W!OzRCip=-@{wG@l&)tEGlgH?nX)T=&69$|cT9H8k`(aheO>X(j$8K7p`v}P
z#ntHxA}TDNd|Ma#=IGto69p^Ewn%Q0YTj6saA)PC?+?4$UDf+yAIuE&GfCV3NYXR1
z$$C+nXt@8KwJgD#+u0kQUa7eA?CI9sd;jgZdvETfH9usWi#<-Uw9ffGL;B8}V>UXE
zl?6(VYVX{8tu$2h*N3O4kH&7;xM<$X3gIVDU#V`>ceW7_T7PAJsL}t2XZh=Mo?8Vp
zeSKv#>u&7c14}0OF|GO*!?LHQQSM>XDW-af<MK-#OSy04UDt|xd~Y>#z9YNTw9>B6
z3Rm~3Ir$2u?e$(g%dB|O57o@;w;8u}ZjxeSbYqq0Jn%MW>P0nMxy6qz_x44Eq%u9s
zX%l5QU%-&HH83-zZ#(Plw4TzCy!xy&>1WTq486TY>g^xv|9ft(uQgavrZ25|AbRoT
zaR1I<6*t=Yx4+~6`)p5n)%MORQ|*+dA5(U_<xH=bS9tKac>ck{OVZ5~ECo8(uX@^i
zvoF)(r>Mh@SUb5Vl`s4BP1KLeFXg&(Xo5z?2@}ciM*>@asJZCQbC?pj+xzM(!Brf!
zdpZyOSpUmt=Wn$a_iY*fhWe{LaDUD7_NLxl)i>wne3VjueLGTeo$=Ope_s_EojGxQ
z(!qCpwW{22%h#<g5n|6V5Gg5{bm`}|^?ugx-uf5cTVLy7o|Un?XhuhaaCYCyZ|1^Q
zD=ygm%h~3@vMI&SV6UQ=t{KDr-P$Lu+s{7Jh(CC$^8JR8?pZQxEn9unnNuI}O8lsj
z-=sV7&cuxwZw@}<5UQDa>&4HtfeL94e-`;@&u{2`>N$61*SV$H6VvyLZ$A5O;h%Z;
z;;N3TKNml~JblW&?OdN-PMvA7E1ctanW_4P&C|~REVs}0hd*nvi!@EWlU7w6k*RfP
zo@Vd85Tj|Xw*}J<9SB%<SK04IMxgoJb?M2jW#xaEQaVEVf-2rW$SOa1v(L>+EKT>;
z-pf~ej?eU*_ObuW!{)O#OQ(KSp1h`~Qfh0#g^Ry<7p+~oTQB{RW_s1$DUUR7%ex-`
znO~s!`%K{B%ICWlT+9_NmpHmC`awbUtxq>ot#{~K$?*kz>`B=E^O?Y#y&rsT-;<es
zDE6~n2WS3_vIObt92a&cZ#?UzcJt%r&+{IY^=yAVapOr}bGE&P4j*n!S@Kcs;5*~O
zbK7_AVNbd*#JA?=%*`6Vovu1BJP;~iF5|mqzvG8`sbAfy^CK0t&Be=a70-_LuzUBG
z>srq)*^PmJUu7P+SJ->Hu42aGUyE<p=lp&0Mmqm`-tKZeh2F09rFPA6O!4!XD&OvW
zlRkB2_020Wf+oMtnw2rWldoBwzJ3DR^XwHrCohigt9&eL9&{#E_g8|5{`#J&CYOJx
z%FR-8@^L?uU%EiD^SR!w#x0dM=bg<u{&@QW{{C4mXYWSeH{RK0p4q=qlJB#l-M!Bl
z)1EamRBtdbPr2}NinJJ8`kch6?caoE{y(62wJ>mM(Dlr#V&N~+MN6mgcs`3;c=zPY
zs#x~bIqIv*tG7*OznvWJ{r>*OyL$8Pu3mq>qF;A$c2z~&yxDDc`o+K7HpDmkxwx&#
zUAJ1w*sXlU31+KhcjO#?Pxzi^npD{<{%v-5eJ`WJA2r*$DQkUysLnRs-MeLR*3BKh
zYLAxMp6#B<x8&(V;eF*CpYq@FnoehVnbLe|O$*=c(;k^OcUSox%d@>)yIbp>vg*z!
zwfee0^YmliJp8i#`4t`c4-rPm)1C!B3OZOA&@_E1_lv&Xq;82bg%9s-=9hZPCQuSS
zsqe+49_Ikv>rou@%ng^ljw$+n`{|k8Wy#BSOWps*m8+D=TW-+T&v83Zqpv_kQF6|q
zZAF`{qkY+VAI?roz8p0Bq3zCZ8#7PKNW4F|EqhbPao$^NUc{x%?XI@Fahrd}TEk?f
z6qWRC9EUF+-u3pdq1hJEmr5`CWZtMQR*raMFL3ABIm^HInLWg3wbzMTycOa7-oyLA
z`-h!{=k4S9x7NLQqx<DX>fR1>YqvRveCM60oaVgXY{2)m8y-(7`o#S~db&iIG~f4k
zI#y*|!3@sDd#<Fgud3g@=(XSXP3NxYFaEx?cS0_=+1;;IkFLaIM)mKNed||vIqB?g
zXJyS^$Cl5F(j2X(bgYd(yPEOhjZG!L=en*to~4!CShJ?4Z}soq*sbboZ*g&Ky>M51
z#x9%LUB}{1_|81Guu^u1w92(xYG-4;<kptF=kVPA>#*>}^)ddrygH|ySIxFw-lUnY
za*yG}wx3=Bb1qE`YfGtl@?X5keBy7Z*G7kbtuve4Tm6vVcXEx;4K>{>w-rj?&EVgz
zmb<x$?V;z?vJT#<9}oUVTR!!sj%&RK69dC576t}!v|W&?#rb(Di6x181(l`22lH+l
z@a+Aq&G95b+T+eT>l}^?jIOhDkKR%`P;|q9rzz>OVPLe8$}aDJbyI}ZOQ*j~;1>Dm
zvhTY|<NMRQ<u|jRx>zyiu6V`_FDLW%*<sH`&#l{ZI)iEZw!4<MLU_Wbhrdq<RkT^O
zosFyJ;H_=FR~Q%PEm~2sjdAIzKI?WbM$@&WJhvoH&pIh3?|M;j$N#Ha&dpg+s^`9c
zeZFb9kX+Yvrmb7%ZS(H*SFB;@xVJUMY=P|>mTfJe+kWkgS#f)P_wD@e{_)QQPrNcT
zHqn2w=4G{Qh`!%KjZ@igZSQ1Wo4@i{ZEE9E9_O}*l}D0e{eItj_Tc7HgWoLv*JOeY
zb4f;eG`udn?8&k0qTuI#Ww%t{KIJPDs@TGw34QxDhiChfo9ZuLZaF?>-P3c%EvNj%
zy9!Tp`aBTN?J4ERD2nDN+}~*NO~GqZMwSY9meGslA6^($C_H36w?-we>CfxFS4wT&
zm+yQkbV{3*x&D?x%_J}8+_k9}ekjdznsfB!7oBIEhhMOrf6kK|e_VF@=KeyfQ?I(e
zpZWHgEofPK*1Z)6!nXFsneaz-1U?hk|H<u6w$KsFjpy>rrzIr(u{WCXNYnn2ZmsVf
z4zDk2{>L`+u}K<yJ65m!=U-Z7_OlxYKFVyj+{R;mrtg~U<3pCOk3ALED2?s@ajtAO
z*A1uLkG<Y}u=~xhGk1w;)OC&9O!o`k)|T|#=nIuFxM8;=R^m*}JCo;AwNA8pK3;I_
zhPLDLdIdhdQ?t@FeX6!=|E}3vB)jZ!`L|cRyhoS!FsmPS{DO9{Wkp}Kr3xbhgDMl|
zF=C*^my?;KS5TSTZ<}}6fTy*5Zj(nFgKMtEIWYz23w$pF7C2a!h~`+SX-#fgapUa7
zs@{2PilUyZzj(m$eszC;a7Arp&3T#76J3&5PfV0Lw4r6|_R#Lgnc`_&{ExmjZp&@i
zG-G;X<douyY{7YftqYII&HbS_Q*qH-J)ZmV2B+N5GtIMD<ZV#FX*OwtXVm`kBZZv5
z9PP4CEHs>aGNt)kazonjs~RC2Vw|6@(aM^)!|=+|DIANAnK)XVD4#gz*;JMm`?7M!
zD%W@ZFPh%YsN%`GD>?rVTky4l9_OyyS5w$30)NT;m+dQ;@4NV$S*jyj@{7DrrO<&x
zVv@|E2PSpy50cEf<Y;-DFL7(r&BU`gnF@P9?>hc<f9S>7pBDEFmL_$7y0fH0`R2_V
z9xwcM$)iqFO^m)Ha6*WI!QT>lrp`^w%+o8V+-jYjf7@fy{lD5$9~qZy5_)Sf^UVQ^
zw+9R7NZvone}ium_xghiPfWX#yl<Ls)HSxB@1sNiCQP0pdN%3&jLswP(n?GBuHLof
zeBOHdf2E%ykJwDFDVq0Tk67`+)yZW+ZXYN4_ca~fTU!=2<+Yd2G*fG<nqm`6E1Rmr
z@21U(Er@)g^U&W$_Y_ZDnrZ*0y?ZM|Q*?Nq``!();hA~j)S^|9Q=YrZUR`wJshq>#
zsE~f0Rb6WSGjxp3omvsMEa_O<StmBf1rJ%CeGNGO{$={kY1JR<Cy07ZE~<S0vhsbS
z@9m=-F5V6DFca5I{~-C4M_}!>H99N`Hu_p(OEtT@b-F*f^vyi+c#EgYz67InE|I4j
z=3W*^|2m1;A~IZQU8GvkL{mxa>tBUdEZC^fpt}A6^Mj*vLT#9oP98{zJ;4xY+@C6S
zb;mWE)%?$=1a8$>>{awRX1(_j-AQlG39MM@s@1$>#STSL!)I?SpQ#2_ubF3W!fky;
zId_^^_ujoN=Ox##S`@{k8Wi{Q&kRcklg_@049aFdxdT?&-An$E9<X}RjPr|r1oED1
zyrVSTbkf1+kL7}tziRz^_>R$B*iQbY<P3#<zE`Do=Db=G@w9F?Q<-6R!%l_xH=9mW
za^F7G{{L@y{dxZzdl<_O3wJw;q{&FMF-crqe=O_a8V}+4!!o^A4Ud%8J60??s4n(U
zCaitOl|4pj#qYn|`6Rk!@w39S!VBWH9=UIOBC4+VbD65*4A)7|1Je|H_TBDfTHnnu
z=bBGxe@A^PE6>NXHSI1NM9<H634L;~>H5C%!m{d8$+}&;EN!{%=gj$c|L)n7FK3#+
zI<!Vf(eiQGnnw%HSynqU+f3z~>NwM~V@Zxfx1-xNjin2?kM5buDUgzE@L-OTny&oe
z{R*|MYh(iy-fiueZL;c;=?d)?;#@W!@^usLG|4Uc@NpH(oQk89mL1x8UnL>ppP0pl
zyo>7u7&zz5Xg+mKW?`7k_bl=MoV%Zesx4vRv~iYIh@QA^k!cM>W_RQ%;~P`H<*DSX
z;_OOW&%8XVC|77wllKia_bVrD6;5ikFIG`dOE49Tx~MbFr{R$|J6Ce&1O=IdCSkMa
z&5KqFbp4;7zUryJ!z1A)sY812%%a}jEIDOUZML30wDZ_R*(Wa@{;tpKT(_8a*UeY^
zO!@z<*57I5+_`asl*58ImVeq~I@1pLh5Yv57Vo$^W3QA(`{(amseC2!Gwv2_6Z$%7
z?Zg9{-IjEozV;y0|NmFRN`^2a{W*u5^cb#3y}o6+Fs5Pe2e#uI+rRzN;`?`kz0a*Q
zR`KB?!<$<sW<Qv6->GuX_X}wi$<LN5J+ExM|46A-pMUYfUWZ_-0yet^9G@gKJ|AUf
z<=8K{Kv0JF>(3dTu6%yWn73rJ*X=l)A^lnQa6T*7pSP)jhwrUcUEw`tLNeR@8w$+_
z>ZWM^2;X44Ql~)ds_+|U$1JW%+?S6`sC|59V#<HlSw+>wRTErFOBANt_^Q86s@x#H
zJmHMO8^x3Vd7kWW6OUQhyl6I$vx#cr3-5X7PD+;DJ!hv~B;fN{V!BL$j)6=>p#k?P
zcFFU7MKZ-3Y<?cvcfa_2!j<O_<{i+ulFVgug<T_j)}`&cnCenf{y*6KY{$AstGUj^
zwhEu+G5aYiBRD}P`-AI-bj3Cvk0!%+6Q&;d$8&h+AI^ON9KqiMHl>8jICyHY&q?2-
ziQIQ~em}OV%WJdD{_Cz2w|#SMFY@k5jN05B!prbgC#I9-OYy4k1q-<gW1a*`d42SM
z*B{_9TW9*+>7t)r$Sl+8-4yBMR#TX>Qtr>G%bzAkK7Fh*$FhpgQR>tNoh1&DGZuNj
zO)fsr=a%etfBD{>f$w?L*4U(#A9U}Kdaqa}wcTP)hGW>H*234@-^Vg|Pjm>8+f`uK
zETSM2Q}_QutY5;%Gx|A>&*xN0RxUQ&9Kz-KXnE|V-d!64J2*Iw*`Lc}d=Y!Y@7LB9
z!FFG_eDk=W#<+4u)i0iV6|)QLe)2a=c%vA;=d<Mur`NL%7@V4Pe8w)77v7G}i`7^)
zS)CoM62o?V6q(Bqc)fU^ySMFPca!H4Qnp-r1*aK3Dh`}``0?}32#0^p%RI90UwfPU
zxy?LG%KktDTe%y<pR<SFo#9#}Q;;mpm62eRo58mG@`H7|{~s!jb2WWtf6FQSW01|q
zx4*L|KihgOx1m+?zUai_t##>o6LeiOSJ@^<nm=e*ygNBT;ax|=h3IZY{)~cj&W1a}
z76KdRtS`GIwRZdRzsD1@rS6ozmgcDZ$hx!CzJz_l{Eu9Jb>IG2x4X_Yyg5JT{<V*7
zan~*RO7G3QE!y3!(eLo_PVBbC#dl2-lKxETGF|ikozm0QFAL9~?TxD6Z@tJ>=~;HT
zu}@!1;LEaL*NaWp+4!V$rb^uxoyjj!`+n6@Esu{mJB&=ivVQcRSp9LMgwm^7VdiIV
zcTMbVVbJ`&w?EAKBm12b!tETId8@d%bNH-Y+*J~5&TZVXDXB7~xpt}5b^a&5$1~>%
zZ~iKnt6t{%g-<N`Q<6&OCe4)$s=hi3{<piPO-ea`Y%X)(tHdMhhiVz^T>TV(p3Him
zsLm3)=D5a}L?NMl6%K1^%a}A-qP(@aFRrOr#MP8CLrn2(@P}rt^9+uTKhnNVyZq27
z|BjzP)VY@#OnuALzGPd=zLvUN*6PN%QhAoFaE9f<7k0m=GI>^S$Yn~JT*IDdy+iPI
z**E?LdCpgE>tDZap1yti?IVYu=m<~VTrpc{X5$5(@HZOgr6+7YIlo&X$to>k-{M^_
zW|SImJolALK2yh~$nmJK{(sP$^^^XHyGUm4VZEZ7qkmeX?fOPNw*Rw=C6-Lt_hmDC
zXqbe``YO{j!C%rd#MLj~NS}Z1e^p`G8NZc_&QB9u(cu*`<1F)?n2N~jOKt2d7983q
zG-bgGG4_x~ORHZ$@1D;)c=AD?=yFEsU0d6Vw)?bKzVSb@_^z>>cI#diosLtJnC}Zl
z?XHSo)%5MVqUNSD=hg1@6An)HJ6jmNdYOH>dznUY-OY2;7*q5Xp6skq_748MG`7=K
z)zMY;$a}_)G?sJ^apwuujgvykwk9`ky)Y}OX}0)|ZH`iNRW37p-s{QpOa7>q<P=kl
z@`!NW?K{=#yMki;m`gsqT+T7W<QL-&PK#(AM(Yc=1^?z|W&Mtt;%xh_zm6gH>H5U;
zFLR=~m?aiH`*CyDlG&TPCx1TOpKjjgdn=>W^la&?=K^=7dfwUc8J6=lMd{9acV9+1
z`Rne+=78mFYnSux-Q9F(e&w6*3Kw{fiygfvs%YgM{_5JVeJn-}9UXrTZ`|q4Efjc>
z_0+PpRiZI0-g?~ecfK5&;nDeES)4@L#1n@vNQ<cP@BVbJ^!fkD!0oBRx@`CUAGlr-
z*&*S>dQ7R#UB20U-!z3T+nWWCyXxI_Wa4I5AJ8>hxc!S`yq<#4KeK1MLznih=Q-Jb
zUFnsL$K1a5+XY=~d|Y*2O~|rrlT)-XT%hJ*eUsyO;oS3zE^Aco9-8&3`iNX{Y4>6!
z+2Z%E)16jpgr}<S`Ft>?&8$dameUkjrG#sH6SjVGoz`T#@4K4!nh*YJB7t^0{wO|a
zV0*Fl<L7@L8jl^AS8gt;aVKonoyOR=dmO5L7)3+%mCYN|9zIP7cI9y33%tlWV_i^^
zX1hD*v9-Km`#Tf5x6E+WWZqkFKJ6TH`ppQjx3QOBNo#+Ox^6sMC^I~zcSW9+RwHBe
zj<fg67pz(?KEY{je&^NIUy^q;ZU1k}bEe|JeD5cI+1Uk-tL39UUQo`~J;ZNxyXxt(
z)wUDfJX~AZUEn`E)~!Bc)1({AY8ULf$EGJ5%JgK#)ulYw?)_}B@0Jo-a!PcyqIh)S
zE>XSdf*bc|+?gG6bBc=)k5|`~nAxl=CU4!x&~u6FiF>F)0%zKSU%K-odX8Dlwk~*?
zy65+K#pCNYFf%B#x49qXjt-IBqn~Fg^4L~_V{5*z!s4ffTQ_d;`t-eb3A0tr=FrsT
z8A)8Z+wT3GyUm?{`9?lhJN+B=#{b{W_<J)kDt4{;y**N5GiRKuFgt$Zl4*3cd#9{Q
zjq;j2?vA&=3l6#Lsr9Vxcu@P^%-d*>%97jmy8L!w2}Q}wR;JZ1U(7|1N$>ykVRp9l
z9>yo<<}Z&AbBGmCaJcECGi%YruD`Q3+i-r!W7%|ci@fQp$^QaW;w;wA`m%SwD6i)}
zqw4FgoPOkfn74MCQk+s+diZ?ivgl-OmNg5!UoAiU;BO#9;`wjP)vx4gR4<8G{OWf*
zU{}^|AH1|<eZ|(dEq~Ky+X}nBusC^4@YThWb#o00yS4A7iwCZ}9u(Ks=42YM()~*1
zfrz41bsuHdHd#Ry$M=(6XQbDDR=Dt`Z>HBbr<xm6+@f<gYric$yzDBc#LqN4@$)<6
z<R-9JB|QG+`gewip<dYi3y#V&&DX|?ZH-&KFE={+BkTD@*FPPvUurIKuW*bN(>f(6
zeStCZQb2UaVdc|uQ}<ljE!(^((ja&D1*WgMA;$X_Nl*QD#<!qh=ho)NNh-OydKrH<
zt*}p=JoVM;m$&B1Z)4bVvtjwXpxtaDjN6K?yDqp~ysa?b<<$J@T`$>nwmC0(?^Ea|
z{O*P)OPS*wsaHjvz7vFQ++k=k+^29@P5cJylkbxl40K<xTzSNBBW^_<yMdp?$=n&-
z2ktk{lsjl~gR9f&RdxJ3JKsCU<e%Ga2!1x};_}7LPK+F3N15KpO)m^_%Da{QW5;p7
zDV(vq1soGzL_`Dyc%}3(F7uk<u=Q`_+nwKT>MozPQg6T1<#me~wuBgSEf5yAnr+5h
z)XjQX*EBjwRa#+h&x~!!6IOPy@JWkJjR=r;l$I^MB`F(u-S6<+qqD_!Wn~2mawI#o
z^A<LqmHfby^}>KTclIj>QI8H2*&l(kN+qotE(&k;>sWXER!G|XOI^RyZ~c@kU%EiZ
ztm>V|*(Zz5gB0J@MLp@3jh{7Rx`v;!mE*1^{Rl4Bk3ta-_+Lua{3!bO^W7h#KNWSt
zak2O3#>d|4Grw?mo%P;bmd4z&MGCuSEc7+so4qMI=*0%T33vCon!FJE^hBs)wZqv)
zh5Nf+@AHqouFdwxjj5McPg&@0ul5-^+qy-Qk~-e-@38q^7r0Wk_0O7qk*KYbENc^X
znxu&O)m>gu!+*oHY+jRD(*NeK&+6P6t=>slC;qy1r|kE>D^(T0Uthic;qlF{XK%jb
z+<0QE<L{i%kp5kFrBhS01An~T{oVcjoh@^BwTG<HuwKQ|)}=K~{<g%M)lueY+h6bL
zoA>sy`YZSC{nxcRr1$-}klJ%o?Du1bC1)4EpZNDk5>Lcr*TA*Q8%{@5FJ1XqOLqN7
zC7skv+evkjx<9^zez;Zj(DUfk)~P&k`!DrH@9y&3_hGuGDo;M&)GxWuE}flz`t;}1
z@lFBDU(a6s-`09B_xp2s@BiJOxz$?o{FeO9b8dNEs=XZW)2!k%+hyOJ8*i7)Y<gBF
zW&EYvUfCpXZr?h--L{99?JbdO{NllJ!!Y4k8OuA>1^4{5G<a{MKM2|VB0_aqT5^tO
zlkT<T>C5KqJ;rn~`>udTpiF2t!^8}`<#vSu*S1WYvel^Mn&gWbranWbMK7)IO@95E
zZ?%+1f9=9s%9`gGC$LSNB(8d-<ci(PIr|?;&N&jdBf0!@$1V-o18UU)kzQB+A8q#h
zsmQ8)NtsQn-f=<Nf6)l_1KsL+#|?OVG+gH=PSAhG9uasj`liv3@)B3sH%$D?UT8#q
zkV=s=spflhR9IMVZ&l=(EpcyO+a*;*CvE;a=aA49Gp+?2iWp{c)M!6^*v<9$m_@%m
zUm(LJrM?&6Id)vq`?+^w$eE6vjICD%yVwtgzFPNemrzWWfx+3$YDdN7<^|8T2>A8u
z&8)v)-c7LR*+1WL*V+v)7QOh^oN-y^;)>5qdxDG)A3Eo_I{MY>pxnw2-~RgN$2KR|
z-)Q*z;A7QBp`F`r-n#Se?YDPtm`=+G1io^5V#|B^#^GZQca)7ZIIFn>)z0@crEK`!
zC}#VE|Dnvr^-AqBq5u05)^5(a!cwOADSqF+3ws~FD_?u-a*0;Q-DZEKO)OfAe+a7h
zu<iIQIMe3O&SQ-K#1c&-_tu+V41YR1YWhdd>+h}Bef#(0pur=t+hU8S1nz9jN+|w%
znl0k?G=IlA8w%$fihpzU`4?wZfgPqxjwz%_MVt#|*n8mH^DdQR)4uU?2hUp_AU^k~
zpy9bIVG|cl?!0;T^_732tRZU`icFdHdr#fhe@`#mj=j$Pc(-cNAL)>tGP}0r&iH4$
z;Pn&ZZ9=v6C4Vm5Eo^@@eY5L+hGpIrxApYC%$CklnN^g`zIktK$5vh6o5kB?OjbJU
zbsV{PHLmBYz=r$l56oF{e_KMz#8r>>oIUj+i)ZsX?}`8A0#}L{*=Mae8qjdVKJ0F7
z^0C)9PEGrHmT3i-0Pl`J{(aY%tvc{zi@3+0{hOzkJGmLZT>WDDao(-j7W)~xrF7~7
zQul67$v?r7zLt@1!OKPG?`6r^m8@{z%KZFTaZV${Tb6G>gRcopdT{%-!`7v|H$-dQ
ztN$~h4t~vQ@12z<$H0(12XjMkT7FS(B50NNUEA#9+a5*tziMwN3S!9Z+GaNWitE-r
zvFqh6!}r8pzg0e6WNE77lYm2#EISx9A`AcAzkK&|UE>1XpVtz1>IfNMzI*xd<;!<3
zH}9Ojr}FQY{e5v_++kbayf`{3G<Ks_MDZk>dr!K(%f7sQa`E8aC!TwEW_ER-*8BPG
z;`VxvdvTkds9(Dlx+x`m%^LIUjOish@$xcjW>w8S^L%yg_S_pa^F&_z-YxNr3oV^q
z?i#z5o&8bd;V0YQr3HtGd)`yaw`_2YUE9^|dvD8{i3;;BY`*>_XU?CHExKDO4~ubp
zIj<AH=~?9ED*-K`3p(mN3ua4mrk%XOR{wcY>b<AkM)}d#R&jm0Xu%jZ#rq?B-Ltow
zB1-l=RC}*?`caHo6|a42{;k<z9}<<iukX=*^irxa-9#<Uu6loh^qcM#Q?}nt3EqBp
z*-G&>p;v74tP_rGIxtIr;_tMt%T`#O-4Orj_4PlUfzMZEbgv65otJ-F$l>2qd(p2E
zrJ*LJu8Xx^&CTyFvWyp1UH!?lSusX6Up@c-@2{JGPPVtN{xn}d?(gxFj!g2FcX;J(
zs@xoY3Y@?Bo6m*!s6$w7Btv6mWkG?1kN><)q5E{Li?<kmKK|lK!vejVTu;`l=*qJ@
z9~HLl*oPH5*ErVMI=<RAd(zokd@4ysGv}yYR`Fi`(!$gK(#4M8?)hcA8F?0WHZ5J~
z^Ywb6Q_r0%s+=FcgvM^1sJ4Xh=WKn;r%e(kR|`+-4J`VyoJBhG$N{Gr!mIAJ?A5=u
z?kvxx50{^~o|fS}8K(LC#5Tn&4!2K^PQOk(ymmWlW}nE0bvrjIp6*kAJ2S`HFJkM8
z=>{Q}OKz|2`<LO6&|+`*S?0q5)+XC_#fD!FU*0g=iqy>7E_3Mk=F3{Xav5#`i}_Sk
zKW7+5)E%^9(3zp@FjvLo&ifm^KenAZ{mCYNk8|aZnHAHgYY1uZnzUHx_)UCwEHo}J
za)o9oGsg**IH#2xeV<OBXn8|s)=}jumJcu9v;5q0^3vfFm3?x{+NGQhJ1h>{qva!(
za?t9%*!1EnE;FZ@y)w69&V2f3f!)08r6&uQXWrUyR4n9)sJGs!UvrunD>H?*x#%94
zy8cNfH}8)t>!!W275Lpz7kc~ao|CJ&-HP9;cD(cPvz(!65_@h!=w@Tvl!mQy%yWXD
zaZg+8zrcI)d;#-7jwxBsLKeusc8x1q!mcKL`SNAXKi&&9BG31o&*>{tlJ}XM{JJnQ
zzJIcJ#K8uo9Ft7*)QhP?*G{Zjv)k;XxpbKBW}d3aj6H&1wVfRnPrU2Fb6)H0zWTqi
z4nG{G)cm=8@%v_X_y2X@5~jSW4B6Hv({U_cojc&7WUoS?X64kr!2G}KC)FG7IpF=G
z|HndY{|%eoO$(KbxR-Z+Guw$j?`B`VeDUS?2+8OdS&LP6POs@tHoD1}P*zn{^*^Vi
z%KrDi*_VGSvrIi(S6ks0FWc~4aDj%b!}Y(Hf3xHXwH$5qWpkWW%PhKo{@<!9t|{{v
zH?Vcu*xGS3%&Tpl{DNoU`MRa+nFVSte6VNo2tH-YB5x<hVL9#awX({~Td%YFJo=KD
zl~K=~`Ad71$KMmG+$wf|mrwCN9wl({Q(EE7mtIxAQl3iJJTF?Eo;2a;b4w4+_V!r|
z54?1ntfYL<?8O%`v4B7aM!zXvbEaO3sVMkkXuDaxC*t3il-Z)`o88k-mM`J^*dP1k
zTuFbJ>E0hkU&BMDG?t!xKYvawujV!RDSy>@CZ#VC`PrnM!=K{F${kT2eCu_yL0VcS
z_cLQ>#&@4SPZ3d+oH#S$_ldd&&vUzEF8bOp*)YrD@)wnq{||yb7p5fY{X6c~^Xl8@
zi3}o*>?h{Mi=Te?$!}vr-rVb}D<eY$&8BHTdAR7||HJE}Q=UE&nqMM#Bq1X7c*nG8
zxlgArR_>i<-}nFRoR{xacl$m{_#1!T+TfqpmRald8})=VyQ5;R<TI)^B~~s~;gKs(
zc*WdSd34?0gFA)Sy#8a`c~C~=N~>~dzIy%22eakoRIxTK@a;MOydvS6{rcIanSR-i
z?hD6h+^W{yG4;Xq(xa9V_gCzn{8env_Sn4}pG~;rBlh*x%eu)~Z(h1@_{Nfu@#DDr
zLauFbmiswp?%wXJEoJd{%d#)K+v8^OeBP7!X|~+MJ+_ltx4cuBEjCqd)&1D!<U8jQ
z9a$e;zp(6v;qF7S4wftdpG$xCzvj~6%h|WWyJXissej>LWn!-jX~wVr{4*<>bN|QH
zFPZ`z`={IdVGg_Gl)X5STPxn{>84Zv!xkJ~x8~~WZoksTx`v`8gTfyd4xay3zIbKT
z*N}~D{>7!rO$r7^CIWBYdpx@E?rrM7xNisE_xxfkdow+z`M-e5)OnnhD?6{N{_awF
zvS{UY>4<LqXLSeOd|&PJ@%*;bV!6+=ihX}gz2N6xuiz~DA?}*DXwqcE7p^yhLe3f|
z&yCx1VL$(BPJY>SYMaE3T~A2v{I6Z||EC#8<G&Ye+z%4V{_kVSYRTL#-EiDxMwrpf
zg{$UYI(+zWJcsA$?}e{KkH)h;Q8nND`rRZ`COeZ0jV@)nZDLkh+v_@{WP1<r1^t=U
zp1g2*&0_V(yzasmZf5Hn=qvA%a6IVHChIy;zQAB%u<x>$64E>NyjZtxnPtb{*|R4`
z9`yNqu~T&E4%WI^2Yl;}Rb;wloZTjD95Tsgd1pt@kHBcbs|*(oev4pv{Dpn>+}P)T
z+79{c`d1q<_w0t(ezy!FiZ^jPSKZ=e>=K+6yI_&+(<$yVU;UWwVr_NQu_Z25@F4%>
z_q)~|R!G{gp5LdxVTM{Z$IQTYMQ1c#P2At`Q%FvH{~~*ry15!@xm7I}RtAZ;Ygv3K
zS+h{0?uN-%wv3&DSxyrUKTm$YE$pEBp0hVseqe7pc<IX)%e9y0GCVrVZo+n6rOmq3
zvT;{fuEc+pzb}rTJt}6~ynIbEcS1&5e%|*Snd8?~lc!5~hMn^7X$g(ka%*wBmRpUa
zpwS)MdEsA!^jd#>b$Q0>Q+Fo%8`r!e+d8M`EJ|+3ofLjrWv_d5Lf%c44QC}5^}Fv*
z<-NpwVA-m-pRx`bwOEB+*{gWJ^>X_P&gGo>@+BvDy_{y8{#YgYxGQpDyYYOlPR-sz
ziI^vU#FBQkIa|&0-BT04>B+sChCq(eB`yDRgV+3D=KlYj>%ECTv+Clmb(fz~4{v%O
zcG^`uD*LD4(k<^K6)s&76`g6+z&N{BeZmE^tbc`Ur-JhTJ>kA%XLNSf`FZ;<b}n`A
zlVWE*Kk3`K#n<zS^((`+-fmNU(`9NNV!88-W1`9~PTQ?fmA_J@78*?Mzklt0#MGs`
zd{0>#U942;f3lzFf6p<4Rp+MdJpQZICx>bE!>)&FN}+{v(#@abTpkA>OKC2wV@->V
zH%#tcI+fGLckjG*$G*wy`b1babne<W&Fy}W66X}Vj_q$+d1tXkTob)IEuH=728*v-
z>_t}T3Z+#EwlDYF7jw>aM;+_r7n85q$G>xa9W&+hsTtG0ggj+PI>wp#RoH9Z#943G
zX_)w`MD=oRk8n>qaIr&ZCG&+k6OQZ5jb}I{7yJ{QBOoX<(=0{xsYic!vZ=V!)9V%~
z5te?NCo5mzpIDZ@Zl-$CT$P0)(!ty(mq+k?pS0cH{_jtfm7n+;XC4&bla2YzW8lJa
z`BB@0j)k`uCSFMEdZz2p>^V99{9Dc3kR1~)GEX`-<<-(9o?o4O4zJl^bTBXFLhs5q
z=TF3X&tGeP*Z0b^przI8mjre<_{?4r66KYwu5*0NGutAul>yu5OuhDAdRF4vm_ipj
zxn~_0ixV^syKE@ysx9ncH*MvWS9hq~;k}B}wX)}xapL{Sl^udwzm(**q;Ie|(;;4U
zDPY#Qh^xt>9xlxr&9feQC`zy{U}5AJv&uTMO5;rMs$-jl_L|5AF1tL#&p$TyiNR~e
zl__)j7xes$%R5wFKIw9Sb-nNAC0zDPOl_mywR#9j-InIvzs$eFqx`0Hu$+MX!}aW2
zlKFmX#fENQ#J?yyDW>q|g2Ll7W~xSQesu7oq@62U#kHUB5{<8G9@?3G$Xh@6L6hkm
z$+q9=UB}kRv0Rr6U%Y2$<oxTYA+ujRnlNokjXCqAwR*by9<<n=Nt5T>`dDIvkj3xz
zD3N)>OQ$a>Sk9wgzu;BB<<X0==Wj6V>NA#;*m?5aY6kZAB3TwyX3lm!lMjFSprf|&
zV1ZA63dh;=w_Nun&b(;aeo6Gb5dXnH6S!=X9J($m&yHF>BW+z#8qd8~2Y-7{H8;1<
z4_JKNw}fYJl=aig?a~ofZTUURrw2cn_<L1fd#TIK^vP+r?rvRSc7mZlTx{Q=^s;})
zlP)Cuyjr$Ng~8GwX5DdDmgzZHc~`2>H1=S55fIVB-EU~QT78?kSNXTd!;(5P&sI*>
zzh^kxs90(GqC*OW2N~iFVxBuK?XtR*`ZLc?Kxf;OWfLzwYv(?kthLKfDnh=K<GlRr
zFAV<-7JGMJWZI|9?%(YiBYxu0+@J*uc*L1}j`VvoOsl*1!TN6v)6{yGV2xXmtB>9L
zH+4zP<%qewt<%bHrmV{6TeHFV8u#^+d%x@46_}+j5YO|iPxySVo&J+`ewGCv9p;}j
z46lm0`ruJ+=WPD<`B8~)Z(jU3Q{=wvAKtaej(jH$B<;AG_mkttuK5b3+Z7At+V?*A
zXj1v)<&C?$4|-Lu5>Vvd7hvJH<A2+HeHTrSgMT~LCkE&-Xe_o@P^*2caamSJaT+6o
z^CZ8%JC}{0sDF1XnR1)k=8JG>&Z?5-Qr8RY@(r&~`Rl?N5O}HNqu(takHekJCLc}N
zxbjOoEA>82UA)&+`^%ddkIZh(Id?1T{G>^IclXE~Uwipv=e)_zU*~YF%@&qOFyxXk
zuyOM^Rd}F?D|hiD_IamXraRBFwfd~}y(N3Ar4-*4j%ZHhZHl)8*+P<@8ZA1(oRKK<
zW2d|Oms>e)>en(Ee&+wM>@o}5%kHPZ_``JD)Ev(X??X<>Z_h0Z{F=@d5n8re!0gCE
zz00BZ&U`IA`EOVCPT$&dk3a89{Q2mU=gj=u6*jk5Z=K9;cV}Tv#K&o$8+DxfCVosx
zkGRyyy;bkx`U#FtoR)Su8(fYQDUWaIY5!pL-P5~_C1ZW!O=b2qQC!d5S{@$FYL}TI
zTBg5m^}mb#LXm6s-1L9;sVgVWbj8tA-5*@PZ?iv~wrR7bT88jthK$^QYjT_=Ma#ZM
zFE}N=c3z>Bg;Vuep9k;v{m!>#)}0~Yu<!QA&ux_vdh9!tju%Q?%uLNmn`S%Nx$~gj
zHf;^&-~ay4T$~@-Y<Nr~xcAfC8q-AHshL;jD^9Jyy-Do#y3fz<PWUBTGNWR{@h+o;
zIpI66IXc?bX|L>?yMJ@y>+PkM@m+VqCGJ$jtyy@6Niy<~vUx+L^**;qeoL;T`c;dk
zD`xE7o0_hcB6CjgP^YW4v*E1?lMQVW9;$UstGw+x=}3s|opqth|Lklvxw=o#e9{SZ
zqra*zwQMi=TRsh2bAkP>3xi5!)I<d{lRG^HlTAK3uUVMT+@#dY5I0$W#l3}+e*!+u
zJ@$ZYi_NYr-t9}?&gffJdLx$8M{%l8?z<<oMN-qZzx-vD-|)@5?YPyWK(6)I)N>Br
znym9;R%Peo#QSHrZTmHO_1q_S|M8X`wLT<0$FrtpRhMaF$)UL>l53q0J1^<1*}iYp
zL60S~m*y~Whj!+iiYRpTYk0lYB=8;2*Nd)YJ3^*wo&0@Tu5&_}m&L=`I|Mu>@~>X3
z(JsDo^53s6V{c1-zYh<t?3?m2BG|-PMRJZp(%e&qeoHOOW^B@~oO|)Z4zqoJDIB_5
zuVg-~v`ZGRypT6bd<vI_<w1t;ON$=n-uKA3GXGcA`zhshs|qb&1-Ob-7pYdK_ptU(
zmTuZ&@87p<-S&%bmX*3MJFWg+y#C_HKGr44&1cOQm-m^x^{VGRyr=nsZ1SJT*=Bnm
z`&`-jRjfbx>hpSbdDTNK^Gr2#Rd=^$8+{G$lw0y(8J8HZ@TTYq7iavKSa?CXcJHO9
z>IL^_7Vsv_46X0jQ2TD(&AHms*4JKW<2hun;~uZlx_e@#BvZGfHQWAjDVwgtw|GNz
zwkqYlcw3aEHoI!F?WR~3{nPd{cI3_Do^X-d{B>+ZmUGd$xhzcuO9Phe%s-{=`*KND
zx=pnCiNhDq^?WX{JCx3TMQQW0bT8HKliGA&rOgyc*gSVLYu?fW-&5w^e{fo5HTSfb
z_)T5G9i98SPcMpTO18I|u{7(G?B-4DdSs1%nC2WmbC09g>|?L^_R34&`|es4&XHq2
zeq`l&$%pPAc|PQ1PJ1i4kE`uykAi4tl!ni<gl{4-{!bb<E_HgkRM)Y3eXvoWqJ}Qx
zN;AO~hsBculJu8-zI?${#PVl3>#q;WAAhk++?is%%2MTa-W$2+p%rcO9`l<2`}BN5
zX2}+Xlhf<0t<V2hSdrmi5h@bd>*unXlV`=B{=T_uBx)L`{p~AFzT=x%cz^rTg@;!5
zbQ%_Ez2;aopF_=_YsGs%izPf3A3b;uhKS7kw&;AatZXY^il*Ae?^7I}9IrDims2@j
zm*qdhj&t4nP_emAyUe%B-M87BIAN*wx269V2u@~*S}}c<@O(}kW?hcW`}t<i-`A_t
z^+sE4-p^0{@{{t;K7Vh+E3Iymbg-)9xaWyJQ~P5U(YMWibS|Bk!IJp%+segdg-JZs
z5jy{jo^6|d+kTtRvm<jp{yXNrKWn1|*Iu6AD;^dJUirr|*F>lAc#?xcWxBrm!*%99
zBD>%I71|P*pBkOAF?Yh2ox)GQok_hvp*ZRX-<^NE)tWW<6#2g%>SXwuA5^heXPe5r
zE3eOPOV)4fn*Jqg!}<F3vla_Ek2Syi{nlTA@fDNs$EXW8BUjAY-><m!uuK?F-BBJ#
z&Ps*E4R_2o^(ty9SuaWyU$aQ~&c@>R<=?|(_6V$2ynLzt{{f8?bJ_2l$hV%#(V>-|
z5fZRZq)9&h`uq7BXDk9{Epw{c@%^-6a!X2J-p5%AHMg}*)|$UMC-o<%z%tzZ#?ig{
zb1(A#4lVQGGM#B#WF%p}LcZeS$Ii`X9z@?3>CoA1k*p-4`akDp(W~5i<(Q-<RWZ5A
zVF^1Mr|k}wem`}R8~0;1xst>!b{zZvD9hAHN|oOfJUb!%>u<gmYold4#j|&R5}#Wx
z|1otNdsljFyZ>|RO}WZDyB|!GsIHFbS^32^{_)1--ny-^^EdxE7#8~{^G5E}L*ddt
zXHEIbvG=d?`?f!)I+`r5%l1q?)wiS5WA8?e<!|@@Xss<W;+UlW#jvsb2EXvT+kbg>
zsn=wy*qNT;+OBA@@<z|cX{%&g{@vJMQ&$l@^&VH}bB<ht+9kQqXZZ5AF-F%Vu`QH2
zJ8|w;F}o=`FaA#6s`hoC%(UHa8Bb>{J3H6d(|y4$52eR#f=5qHbP)G^ADDC0`+m!=
z?(hJ%U5etG?rh(@l1q+T2OM?Gs?0B+Z+r0W#CvP&UOKpMo3kV8=3E_tBv$+2wueGm
zt}~;in6d>3GYZ6?x_h;B)2Z2eLk`@1B3F=iwEPVF#;oIQzhggp?#R#I_Wbms%5%Gp
zK8?GXa%gVLwnug$*FRho<#{h$XSrA9%dKSRfOoo+%j-iX1wWiW)#TVkFM~4wH5KZj
z?EB369{0{G=aG3-CYc_2LG8Re*8{^|Q48~m2lu9IJzXfi{puyopx297rH&T9Fk`Fv
z{Kz75;f}LcZ#;GmuUn(_<Cyp7?Xg##nXm3mpQynUKmS#Y<@Q}ue#*+UKE2&0QnPZM
zt>^^vnbz0Y&oC)ndNpZ}*7W5YKR5=23*VkD<CXJ$l6jBn^w{m0{&IF(;)3JM#rZ>R
zuWAeXJj+R+^gAbEevU@l^B=8hLaW#U%oXOnJfh?Icjfh;zRKZR++8PKwj7?@&6~h|
z=T_o9PT%Ps*47@~XOHY+ytViU=jv0dOAF5&DNmaChp&fe!lp2@MaJU4HpNfwthB!0
z;8j1r_loWb<?8AqyZ0aVePVh;Bi>@?jRR|Df8aH#^Dla@E3W1qn6+co8Sj)+yc4c|
zv_A0hUd*)%6Q42jv+Xx!UB0f6yK{%v(fjWUcc?~+s-4}v@XDVPb9no@s@CO|PSXhx
zxBi^H-#KAVwEIW1-yEwy2=Bc9+m-c;i1!}7xhr*lIu|;hKJHxQe}~<F&w_?$pEJKU
z*7~^5xqWf&3dZZxPW12D=MopIB$?Ev^5l8kC-2yDp}fO&x5ap)y^b+FysOHboP3yh
zUZ?4N^>;OFAFrD~J+NTM^tS%VTNraz8k+t2x~DGw#MM`OeH>qUN3Z0M-~CHJCh*q9
zl@lW`wlK^~+;wu=@dayk|5};9^H9Hpu?xdBkNFnvM}Fvs_H9opD|IUCy=z$)`}ZOH
z{I34?bsW|yrM`B{SDP>YvM;Wv)!Ny{A-qrRbkf$O4O<#^9(`)Mj7e6vPrO2dr@G{8
zY-qf9<D%6+{1z0qKYmj1>HDq~M!dyG)ITJoEor>F!*N!PeXLYyKjT%2S)I&VpV&zm
zop`-sTGUdRdu^w+3pR&Zofi7kZ=hw$Xk7BjBC*8VMC)39)T3S92|F&`aZg<3`F{42
zi4`R$O1An3yKTAMWzv5s!&~lYzhv{Z>UGR!EAx-MH7Juks_uFstl^;?ThkQ5=v!4*
zocCv$a?U)u%luv4RRy18yy>q3)-p}rK6m0#6_amG%h_1g?zq_UiY+3!+R-ff#lxDT
zcZ(b{cE5ZlaEpmgWz~)*R&@cdYkbpUL&YLwrw7Py-;wa~%KGU$zNNFx&z#-C!&G|k
z&weYZvkXt;%7rBQ1Gkj_%iK{=Tzylwu-|M$wrqyB*`mcP3~L<bdA3{Jsd(yVoOW46
z^!msBPp+^3$?u%Ovu4q<?S>ljno}<vieV{_lS{m;U+^fYx+yUH*Q!GcV<ybq;2D_f
zb>{B^AN7*kJ1!`n_`2=(p;raQ?XC;%Y&$x2g{sE3C_f*mEtmZJ>kjv<Sgbr@`_bKt
zcWLGKbcYv5buY`j{c!e<k2CfMR-8O_*5v2}vHf@6Nl5zZhk31gox9WLT;!&82XizI
z#M$omytd;V$J~>)XKPRBSj=4Xsm`QmPSdtUR*w{Tgm~t)6`0GEA9gT^{vCFg@kXWb
zv=fo@IF<ML`mB5Gw)NG#2tRkGYYIx@Nit`@T5iq1wCB|9Os~TRf`=EJzGyn@QPk7P
z^YvpNbFKB@K38BQsXkd>tm)RmKU2zEtfp5KSslFRblSo#PvL@L$GusXqw}o;LY;pc
z%`Rd#S!`Z**dzW~c!tx)?-%T4vTq$|&szL&%7@mqrXDK{!YqB?^Dpf3x8rN}XX%_N
zB64F<@hYR~X1vGK*bm>~{_sNadXR`^hM3K^B}zfZnsz;!rZVsPfuumut0}Q@2M@{g
zMVDT1y;iuk-B(_1rGEJ*=2z|4m%mMJkmCyEG(D>=C*l9&ZTX3wwCL0trfqGL>RR<5
z9Qu0EZz1E7MekgC_MBNXy`NRv?WFnTClSITCdZ~OS$X8g68Dy#ha%6mI`&=)v$`25
zrm1^*#jPbB&sKD}?e;Wr@Yb5@m&|%sGJD0QV;75A+^iByw1aNzc6+ICR>lOYGtCj=
zIXhXptD4<Cb4{1PoRy-VdpCJb{_Ghe(07LEjZ}c`i`AD;o%ro8d{18e<nr2!tIMht
z)i)eG$@{1LhWWzT8JewKt5TldUKDfgsba&#j&AN^Z_i09t4qzBj^5$s%aYTSzqHEa
z?_3>@oHYdz^G@85&tm-jOK9rU<twL1P1c)PzJ{lkedPg%s|QxS%aRgq`}50S<Im-5
z{q#c`+Cm&em@Z_-Tr$s}zprBIrFkkls=R}?J*j)Fb@!RL(oD%IVZqy_<q|&}jx^mX
zyKFBbqr)DNJ4KHY9<I^58KhlWz;69*-{}a})CJp?z1$Wp`}ZOTQ^$^@-Sd+jyXP7j
zM7_++{jXry?i3T$G)-d1L?M-H{4b5Wo?YXp4tm_PL4fy#YTn<>6Nk=h?(edkd^hrm
z(?lh^a#i=&ys{@4qmMj&5fK+?eO1L`-If&wPHNj%d$gpQ?#w&D93mUZmOTCALn)J#
z7N-3zZaxdOc-vl<o^(@xFLQWy-@1t6IOe2{Mcbx-HC;DFV#Akr+Y|%;x_KWm%2JeR
z=X~VR#<$?^t8Z-^`*@Q7wzgk<7hhly+v>=-X&Hay#yP8YUuXF&FDr9GFi&FNO!dSW
zRhl!ed{SPRz30}d-DeI~cyG#onY(Y(Rjd6PVx1M40<LGI%Ua`ElM?o>I(^yVlvGL^
zb9?K{IqO(FpZrdb4z<+p=Ds7DeL-z?_>9ZCaZRtU1zy+IoV7vzRj7M|%i<&N>_Qp8
zg;hjEKh>Y_@H6n!<KB|SjOhKoyIxxfwuc^Zjc58ZW4>s#-b|CO3}1%0QkIwMEVZ#y
zQa9<{Q}?f{{5ePJfPBTj?TezWUDquaZdiTg(b=-iD`)rV>mF0R+<kh_M=cA<+~m!y
zY14kM@0M5p^(xOGTqnQxK=E>B_n^4uDIMMQPfR`hOl?AI0v~RDf5UiR;-OmhsJ4^b
zf)7n|ek^G_={D`_q4RCeA8pHZHLH2u+jh=JQ|n_<=8WaM!oM{Y1ZSWAGpF<@(_>S<
zr8b)`SKII&lzQ1Bbo=0cM%0OEUNz2F)?5q>B?_1q&SmChmgp5!?v=cqcl*TGx$%an
zToX=3#k}7qqV2#c6Mb&i>l1BDbuR5{G*D_667EtyGofh9%Kv+xpJ|l|63^~kRJY;8
z&N;v5=AU@-?^W=Bv+hX6$p31It}~ZP3NsgNT=sF&*ZRJ5d(EFrTEAT>TF3j-=b!%d
z%9mA@<!3x$^}Nycv}SKp^^%m5r<MEO$A4;>Smfy~#O>y-)_ErE^&G*-pun)~O=5qz
zyS*h3CZ6|Zjh}c^XYDDk4L5rZMCy4tbvI4la;8G@>`YVL>6K>N+21`3&EK#n>gH8J
zo9btgVZ{!j#+t9EriP|f{@u3LyyCCQ47Ob-Dto!+zpdLDn|`z@z;jvKI?=AAxYWv|
z^Q)&D?`0G@9DGjv?%}{Qtlk-(Z`Z!w-Ck}U9=`ZvPSwW`btZFr_3e7ptglCGJjtRz
z<;>Z$EmIZFM@|%te{t^Tq{a_{yc46=#J^2lyJY6AIV-i@9Xz^b`DDfvZQLsG<x$Q-
zE;WsuH+P<AFLkf}=ePIYv2F9FFHMp1{a<N6EB2q&u0L<n{?t7X{IS_hK`dKK<@1$A
zOsk*TC*Swl5Gnp@?*rBT$~w2a%|aX}zb>^{9yE!2<BEVJqb<j)nD_SA2OY_rW^Boj
zlxG}iw<x!E-S+vD7;mgwai4ov(p%AQy+=bmpI4^aCT8D^JDIt0#S5l$l3Mc378c5m
zd*W8hulyIzdGtQZ|D^}!EMT>(TPVF%Pb>0~{`~sRx9j)qUuelIb!zGl_LOs#_u{;b
zE-vHVaAZxfkjvXkHw`*x99YLH8qI#QjWeX9?R90sxy$X{A9Fr^{PpYE<qW5`C)EN=
zE6ka4UVV?+|F>w}{RiJ~?%pf0|9wo5kK4wd7w5P|g#^Z|lviDqvGo6I`Gx!u3thd;
z&OfnV;yu%~vYuahv3Bd{`gK#%&+nFsjj!1=_uM=AcmE7`&0&%YU-tFe`^D`i&)${T
zetz+MCjaOScU{wGwn#jyx)tg+-!0Z-M@{u-zUgac*}PAysWoqIFxpwMUXSIV%g?pE
z$JGQ>1ZNf{9g=K0ys9CB&v4>%%lbnn#6Mr{66<97AE@W2a(F@B*;6`)R+{b*c^PkJ
z-5~TvDRE`5rBy+TnhlSX{@aQF?w_0??z6c={Ns1osXB@be>pdEZ(aV7a|eUs!DqtC
z6ShBEpK+mOlBn)u)stPf-iyd2tSIP<WL&V<`JN|F<&p${wey)yOKl~$uE;th-?3Gi
zTesL&_F7QVJ>}LMi=5YA4H<IT=3flaK3pyBoT73)!}`jE$bUvT2A#nP(vw#*dOzQ?
zU}nmbg-uq8N8OwlnhzdldUw=Yh3(3`4G!@!-D@<QufM8_`ng4G=gEk+2ex7bX&jdo
zIa#WG8z(TAebi=VW;km;VXej%$&OZ)0N)5{#^MQcRQ7OqZCWC&5w^pyd(9887jwcV
zL|S{Xy;Ne+PMpe=wQ|R52d%XJ4dR>zb8DEnx>Qsy{Myi{60xMmm`5)2e}DJC{b}>h
z9<Ka9{d~S+-j0CkQ+mA~SpmInYSBjwe@&a3DAhBOhc7OSvoVzEhume(+yCD&)qe9_
z#v1Io)K(*Fg=3I4t6a~&SQgzS*7XNd&OXw)d#LuiQst>rsxQBb3M7m7<}Nwt-YJ;c
zzG{QT5l8;aoQYyzzP&u|dBQp>>zhNk-ZSx&*?CG6^(4FWytg(lFj;s-v6x>nVZ!h3
z{p%jz>@o^U%>1I8#w9VqDr<qJ(YFhK#6R}@V%waO#GKc#ZsB3+g3~UJ#T%H#CW?pL
zeetJp>C{OA1v5n@uf6%e{ZZBXmB-BwcTMk^uj*&W@|q&ql5)J(SjB6$TI~AII@=DJ
z6pBvV_BO<=cZGs{XVU!8E2a0ir^??rnjCz6!JMEgfiuj`A3MI$jOj5?b%$23k)?A%
z;`-}lL0dIfo1ESE@M&15@eRT4s#;9<A}6+Fu9vnclg!LH!pVAYMzcxMK8;QGQ&?2j
zFF2$8O7BCE=t<6Xycgr7=Y<(v;IC@yTX4r}B5O(VrZn@W9d-9ZS=4+!-zc>E?<L7J
zW2N`!h96JZg%U!KZ&qq?GH!`toT?NWV!olOI@u|<>V4L?4UHvR*&{_?UyNN^x-p?s
z^nF(upVP0ZGiLj?bKQL|EO_vueW#bPlK)eeeSCGLS~WWB;+qvM1sy+eg_itoxomLr
z+5^)&9l>80&g#9M5HYvIq114_(}#3}J(qGqPnSxGm3}d`2)SG)#aH@;RYw1q(x2O$
z5B{khRl2$|`|VL<CPlGZib}o@Stmw{M^`>6=U%He!|X9T&yv`z1rGJhPfIy(``=Is
z%(z`}?W)LAHq9%KWXcV5*Bg9G{&j4cemaNXf)f!buY+8l?srlwHlJq`^RMIbI{BxQ
zo>uO+)TzG`>p1C5mdnCfzd9H>->_(GntO2XEzY=CEDdI%-;z7RH+w7*I3?|vbRuqB
zq>Ebkm(@u^w{2OSue(%7+xmt*xg_<=Ec1uON9}|6j$F9z$vr)BtAkhDzvzl1=W;r>
z9+qS@T=Uj(?p-COrUjvKd=3XH=kDAX5`0o9WoNK}bnJU&ofq*=a-ItgNU`}_Y+bNw
zgVZ(GC(Mg2FBL7kcAjq<W7nkxb6;=lKJ;i>V}qn0Czn7{!3>H0@eIHB<+0YBu3bGT
ze}{d<Klz8(-W&HW(5%QdSraQ`JtKyxkICPpK<35OgomuBjKhvdGG7lUp13ciK>oOf
z`@*MEv%XqabWgYGo+;yXLQaSCw(!ch@VIY_vJFdn7^-L9cI?cKbJv`e-4(L=(e-6Q
z9uur)PhE6q=KN)j{cRasQ}bi{K0ng<uuqopXZo}Ui3_e}t>`UXcs$FfuhGYJZ&uFD
z3$M+;T#E{F=eTe1QDs5QbzZ3{zg~Q~wSL3aZ9g2RUJRW7YB4uEul(GFaf?rWIB?*K
zmhsoSJ0~wb`CfLydAGUGeiXhsBT&ZQn6_p|^W8f)+#7a&dNcbZ?~b1f6J=eR|4zIy
zgCm%6hjrj>`BdL^A-dCi1N}YqgR&+syc~T}*KEg)mv^M|dJb}*yStOU>GE5?bL$E&
zD8H2n_HVwj^qEcE_FC@gfqRa~omV_s{PM_p=fn?Y1uv{@9&IXK`%omOWchmQIJp-o
zaxs~<GmqVV*`c{}jq>4r@4O3(_xRqlo^jWl!{$t4x8~Br4ykiItZUY1PMZ37XU^+>
z0sSvq_zXNIJLGS=%E$Zjv+^8MN5<4(>%H2oci+ddr*HZ7`6QqH+T0C1M<>l=QgC<Q
zVJKCzyd(e2+OurC^rpEjxR~Q!|BE|KC2VOz&UB%Cd9?-+S6#t1LKmuI*>xf^k0jPG
zN&IZIVawX^o<~V{TAGPcM5k`e-?^rTI2bQPn=!O2*-k$A@<ZWQv-?k;F+}vAEApGH
zJV&fYb#rgZQMNpv#WTDfNVgwz_<84VR8)Pz(f1Rz0yWNEwW(n{#r69Aq{IaeSog*?
zyRAKAa6V^-wvDPvuYHb3Cg*{@x6<VIb2Ha>2iWR3EOnK5aH6ImQ^`R+x-tKF0AF5c
z-|d7<M?0Uo{afNASPCO}s^Z*FzFVHSI4o4`pM7c8f<uW#@BWITwl&j}mV}gQFfgdj
z#oSq)nO9trn3JPdP<hrivHZ40(fz;L8w%q!Q&Vr9{8qL-ue3b#&6hi;k7d5OlQ;i*
zzjyb9vs+zWd7RpG-nYIwosC(5!7=jOvFoqi9uwl^VQW5^kY>P~(>?h+yZzfeXVo{Y
zczP~Sty^vWvrV_e*NeS;;`MG%&-ZQHj=nA`41YR3ytiWK_eZm3e>|Um<mFTm`xCo#
zT-5TPtcf|Za8pK#)%{zu!k)&coGiJiqdikaX}<ocRf3s;Q+#hdNewKXc{;Lk;r&P7
zbz?W}idhn>`!zo@)OBV3l&$~5PS2cUl6uu{$E=gLza8InGX2^0Pf3AOg(J7OzCUyQ
zS>8nP=}K#luB;33JZ5-}BTnaYq?ypB9Vb_BI`FQjvAd*5x7+9c+S1m=i}Ehre4~&X
zq-W{gbhha7bH>0AAIg-(J*G{ph}TP*c;#hC-x2ni=k6^(dv$eZ)%5Epwe&X?h4ycA
z`N8aZ=}#F;OXjrhC(GDk+><8yuS++YIW^PG;nc6P6F;V0S>yO)M%};2dmmp{1wHLP
zw&&cFq*?b*WwG3UrFMGtlj}zMcQ&o+?%XqVSJ>7i^P_!BxBFKZm!G-3C!>;ihw6OA
z^#>#_NdMWX+G+Ht<CIKTXr!jV?MMDEnKVMXuTIt3(Ajjne^&p-pI1Zeb~gR%Vv2a@
z)+I0cHi@mEigo=1dx?JQjcZcXmZhqST@NTtx~eO^AWc(B&-N_$N(Bj(qY-<wxgSic
z(eitI`F~aYj6MG@KYVR3zxQ|f>iv6tj0%ojN}5^kot?l`S6~ruQqEp!$~Dz)=j`*J
z9!Y8U9??7_d-KMccGY$<H9O&bjedUu(k|RsnDqAXD~0(E`}rG1POI&maZ)()=}VpU
znV<3mb&Th*8Tc!;{o1EByC~?~3ZDMQtCy|()SarlcHx&*%&Scd)|rK8d01oxc)aWW
zvq__{F6r(`oweB?SM7><)ML~7ojEq~#<mY{Zf*{CTi;MPFW5cfi1dWyr$^T-xF?)y
z-lNqZtoN>mrEB4`#-J&ls-8S=y1OU+Zj(=0lu|TRZ2F~oRwwqIN2-5aPt}utf0Jv~
zHQ&^_&nlng!pb=}><-_$@0@t&q=FlhZ>_z&WcoefAM^Ajj$I2|`$Ii)si^PbjU9_#
zJYOq+^?a>NR?VF$Nle_09<1REx0d!sH1IG;GUf+2+V)<(GD~MQ7aNP3c*v>Ly{#?F
zellG-`@|&nT*J`@$s=0x&mL(N@v)asY;nnM-!W12Q<KK>JvR)5Sb7UiG+s`fb<}Cj
z2{yM9GwpCrWseBct3i+MyQ*eKHYy~XS#Wao7d3syIa9A*Gnsq!Qc0k5f1`kdJm>xC
z+fNovT-wVLH1Amc=UtY}TJxAUo;$Zap|>X7%;1Dd-z6R8%p*3D%^dSQXPjlarSVbs
z(0t*%3+I;1Ih;K!;`SkrJ5GNN^S7%XfA43v=U!{r<-5PU&ZSxBKCCL|UeR$u=<<bz
z2r-Le1?%UDzkhi&;LV?TEmLPntSZTAmT<9NudI6i_(iSe^_pw#lJgB;MK`b{?38dn
zux*RMeL>ekkB9GDTYjo--O$&TU2x-J<Ywk2^S61pm>!tI*|)-RlD8ZGf)tISPapsO
z=5JS5&z`M+N_O6hD}08pfADVdkeJSXqA=i*laj;|HJ5cMCKr_A{CTG6S=(6e<FGrv
z<JnY$?O~z!RzyawJ~@Xe?y1gX4e`rOKZTd&FI)C4%H}`U4#sUNxAv*r6cgRh&!8%N
zqmzXrahF%Nuj5Qx2Zw1(#DXk1<+9|SaIRn%6<l?SvCYE5#?sc}SHkLsjS_R79Chj1
z`=k8+(dxrnJ4Cvi6b_dsh<*9+wb^B2>Br(L33pXX{`mzvat6DuiL8vY=h`eA<5;#v
zlx2eUgIe3Ze+=>J3i%1^Y`1Gj<XYAA$Q92F`t2yM-EwtS@9XdUkGfvpR6aiGtK!nP
zrc0ErG99%)k-4JpHTS1oPCO5zC2DtnH~3m$`*+Vrn}e&^R6E}`D|s@s2A%J`I&sp1
ztKB(~isuXzF8>h<^N>D2o$I{rQlZ9eKb)&{BhMb%s^s}eDSuK*Lr|$oT5!xsKgWkw
zR&tGY)w+p&7hZjn@@UPvA1QNOIm+OiZY)>!@y(iRYBsO@9dP}7nEP^`2EP)^8Hu|j
zzT_H|cxUwpU0_ZRaQT1FNcNKd4rlI&`5xyPmEVd5c$~^!`q&|LlGD9k?g^h(c|2cn
zWO`{2LsEe5^B<`V|9K9dP-f=Y@#;cb=x$p!Yo;et^B%9>CRmq}@WwiZiD$v<2Biy=
zwjK7moxsE)rk=!SWm8zV`&XKRPDg2noY!rp(<@>QX|deVXJ$~J%A(3XEhps6EbYe4
zYV7A&&bf;^Pr2Z<^;EW5^PBUmA$z}BH?4ggCoER#zuc5HdD9!FC%pXA{ZE?OxG3NH
zbS$D?GH<5Wg2sneN>6Z{(&l3pY%95_<t#m8Me|dU)TmX_2P&2>PyNC*y^cFg=bnaa
zIg`q|KqkXY%?pD%8;is=O!XGBF^b(@v0%$GgEK{HCnYC~uQ_pO^PX)9Gbd^M@-V)9
zxbIYT*V5LY>)Oi$RG)8<Nc(VvX<Ea{wxFXk*$P`<m+Jnt^bLOUdSk(J!v+nh$c-tB
zBBe4vif)Zr^v0O!$(6lZTV`F^H^pUUm%@Vw?`IZnoYQ~A*DCtb?C_&^InFefC|%Te
zuFfc#Xu$u4%lAaiS)I@`b4*g1vOhJrs;`MXP`qUS;&8Qxsz#2k^#-nHYKCqrBBt$W
zIuo*CkJT!!6=GpGGg7Y0tUC5d%GNOFGQUpY%bC86D?9l^ekTa+-8X4+_NToI3<NR@
zmy2IW-+ulGYZrHjO5xrlxizO#O%s3fKNXP-3(FVy!?4UG;m!w>uLV-o``ZJ|6eoV~
zPg-B|@lort72bvA6Pss=W!?^K3selPXkfkaVAG33?1sOx3wH4@n%{jwD0-Qc?ez)E
zHmBB_CQM@HopdsEr&dmp{z(t(UVE_v6VtzNY%z<=ygC2LYu@RhJ7a9N3H^GpO!8XL
zy1gZ3Y^6Rg?-km!o;|93(d>6{@~hrS0m4Bmvp%obsTIh|`nLH^e8tH}TsMTDm7i_6
zq;$C5*DmthB`y&oe%={V!cR+uukzAMGq5c*%u=ap4iZ~`dyhq<#O(N#%-tb7d9^mq
zDErIQ@o(C+i)*!dS2Wi!Z!J+|G<>Vgayw4sr;C>8Zzr=}vk5+Dy_D1ww#ypna+f$}
zujEcDEo66Ls*8`)Du1MF)w6C^THyQl?+yh=TwUQ36E=N!Wvu?w?)UL;YWF{_)ZKb~
zGS6!f!8S?T<C31Ief#{bSSLNGyydg*i^$r~r<IPny7RNz{9d}x=*K^!r0dTY9Ag#!
z&a_GKT<TfoL(fvTnEZ=wI8);<99Fos%Hz#Roo<^WGUj(AdLH?=B_zE1W&dbZ=Wfmm
z;TlDiswq*6mwSc@mx(JXKM-ojt9u|Ta^;N2(iNAjFE5nM3iw&Y9jMdTKEZxvYSk{2
zIZ4ysPJ4Vy`f%x~>ciHKjH_iPKAG>bI`u%^YDHh`D-IJR(-X3<pE&$=Q_^XPECY*K
z^R*=pN?*{u(f+;r?1KFX*=?PPsb`Fjez6c-b?lY%;$wo-tXFgM_6MtUZ>wE;e!=7R
zWen?BSS)T`Y7%WzNjo3c^e^J$?~M{Q#zOl0HnzMrJ0m({%~?B-jZ)%kK5m+@ojag1
zWm~cC`>+M=ZyRo=y!Pl)Pe@8LzL}Yt^6aLnNB2`#8_nmtSM|>Ix%VO5^yRC&_5Z#-
zJsrlp!Q<Fz;h;9jk|RZBYyR2nDfv0?jj_s2zF(3Bmf_EuTc%zQtGyH%bS+CW@RojU
zu4#Bo&YQ@k;#^V68CGrqoXc<A{u4FnCacw<qp{7m7Ju%VH`o2S;_1?v>A$mX?lieS
zum9Q_W1mS3EB0+&?!2bYu5Et$`FXON<J~l0pOQ?NvrB_%m&>8^?j=Wr9FLYnPB^Hy
zYKn-Y>ZPx<m}Gj?cFnl2>rkOLJ7SO1f8A>(3|SgpFK0Hz>8`%ve(mSmo@LLL+bA!x
zn>F*+J<DjLABNtaBQ~~uF0%EHmdcA;Q1GJlO-b76YgG=`o43k^T$_<9cfs2xud-#@
zqX`WYu6V5YChs51a^!Y6^9AO<3;+ABO+Aw#oUPL5|Kl{LuF03fLdo+u=UnFq|0%|#
z65GA@TEXir455$njTlu^`5tjqo)6T2o>_Z0RP?;H)ZLdK4}RQtX>Nr6Pqlw?t~KTQ
zd98g3CDIvFd#3QLIklngW0b4DfDenrO^^3`8axzjdZsOu5fsl5S|A$}mT}>gYtw_y
zj}cqG)&^gQTls0$niWY(>>-n9Ni}5z7rfHW>JAIa_%O3A()RGbLtEM}eG)q3+Z1_1
zR8ah`W%bkY`?c*HrE8b#{oZh}<&d;i-S4;C<#yD|bpKau*>&gDxtW2{E7yz8HoY(H
zr||Fa+yd`}Nx>Bcz3&7+g<oA>`*Gs|zX^IQZnKWMKf1TYoAtfwjmW7k3+B6J?L5TW
zEn)laZH#-`TffrmGWV*<l9dgqrJEGzGrc@{j=Ao#76-?YgLiBkq-*-7J(HX{t)(VN
zTPI1tYm#A?=cc*VR>$gfULW((XcsuPfAREbWp^@m{8C$ZeScy{`o$#=u2yl_tV|Ym
zTcUK1Q}t%Xag(nJ(+jriUN)0qNl4i1cso8mHM=^0|3;3BkybIgxAsrVjx0|8cBjQP
zbo;w#lLb9X1MY9PusyL&E-(M|r>dPFl!OjxC|<mf-f?cLf|Hx|w~vwCjO!H`R~-mA
zJ)>!UfWW2cKR&#;8y~m#?JvLUi=%a(Z#tzO&ywqOH_)HAdwJ#B-hO!#>D!ZERa&*W
zKD4w`Prmu+?X}H0kp>bcrljxwz#gLfG*apO;iWF$zc|hGP%-_w$I8z3j`;C3ug={?
zon?%POsl-Mt^Q`?>G6mAY<>jim1E0;ju}V4$Vg1`pUs}$ySw8!Klev{t6-VLyzhyN
zJ0JGFe&*!2mes@S&d*DN!jpx<uHI%-ouYhc>-YD~TI=_mRd3JVIO&0x%C)P@6g$4z
zS2;>}y|$gzRexdjCIhDnwGKYH)=383eM&#?W&Srjn=bQr>Fo0B@xlrclYh=lSbH$?
z2(PzNk=WebT8itk7l`fCoZcG7@$mU-=Dm^+v^($p=zEhEe>v`3_1DwamA7x)yr4BT
zRnT-xrLu(aoPBzea#b#O3x1W(DdraVB_XnUwS~&t7mFm<h-p?YOmuDx+2(k}nWtG~
z?eTTG83h$3r{f;<-kx*wc7y4ppDb$JY^NmEGAx)_kMBRKen+kE5Xaj+f?QDne{Mzi
zJYZUVdq?~KwtsWqU6^khlErrMe05+C<HY8bNwN1tH&h#l#B=MIo7ko0n1*He1f2ZI
zCE^!f*nN-TXG4nbO6!X=wV!U`Z3{SZK=ZA1&_zy-6OmD=H_jg2bhAICy}EnioC850
zSQmSVCqI3;>?EI&#l^-2TN1O_*BqRopKg3%)AFCX_6ENcIhlWCU)g=l!b?BvzFE+U
zMcN0stghy2u28&~x+?QQRt8T{neV-pfY693nvx96GZ`YEb1zxB-!yp_!>1=p<~*Jk
zRk+hfzfm|*u=gl?3}dFAfsu(pNOEcDA*=QWQ?4`2{JKk_Jo0khyKc4lpY61BcWP8F
zi)ry%w@`oah0k-tjm!Km#C7-eT^8bJ2vA?6+q*+=vEr!-=el#ux?{Y<-d_j^yw$ie
zFjvmnr+fZER@e2{PHRr6%IJ04JLBnzjXZ}+mt0Vh3s$jUJaBW<XPYK_o)h7HX+mux
z*}O;JAMLiA`$F=Aao*wkj*}NKo&Cgp$35e^nCMj2J0jiJHBaf!^ZK|skzL73wD54@
zha_1ehY1X3HeMmma{PDybaI~bt%qa5zyGN&i*_jG)LovS@aq44Hy3;7telq#Qun-%
zW=Ls?a4dfq@vBzw=D`yarPCj`Uredo{X4puqw%IM<BlaVyIea9j4pGfIBl|w32Fb@
zZyNOOb;6szvW^rjfqEt`Ua#}E{PCi7cbu;IuUYz2r|aC&m}LzNZc`unwLiUd`1|?0
zOcHyZ?O~t$f>nTTn!)lpT=$$#O74#M`S83%%jDxC&aAW4^^RE<O?A7ezi!z91u0i&
z{RmFwgK`XR2b07YW=*+f{ggXMl4(|Phz#rJv&B4{jURHHpC7+|4Ljre^3~EaAHJ{<
z+R4at_mIps2?JqUMXp_~buxQitX=MK$mC)_>#=HkQMOx0`+V0NfAI7^W9xMO2M${2
zE-!XGyXJUH*p}tTTV}mH&T{SK5~ZWxIs-2L3@N;QX_jQROp(8<#N`9d9t-LpdrmyS
zc1=OB$je65ZsE3Tm)mO|`g_PV-S2l=&+WD_<#xvGL<crDyDOoxJ-=-2biJl2?$wNS
zh>y}syL4;sG2Yki0a=V(k~7w>lf1uh)@@<Y@bt*XTy4*F1*#K1FTN`u=@M?)r^Y7O
zb7bBV%bMFEnM&Q#>CI0}j?LL^d^vQlxYv~f8XUV{Gw*+&qU*3ZG0Nbcl;@B8hYsDJ
z&(OO*HT{;!Wv*4v6terzpEs>hh%damT>tY$zq~sV5&R#|?+tKMOBdUIYQZhf!g((q
zoa>v$X~G`5?fYK?3$As$`VJbnT|BbP_|K_I;kT=K6+SxO5zc21I6kNE$ew+7QqE<c
z4SlN4_U9Z!`i(?^Tx*prcN?saPt$9Zl<)LvRC$+o>RWh)jnxf{ms9yCCq?g>wf55P
zTW><s1139tzVZE?<b`j?_8ctBcoG-wWZCG`$s4fn(2JviY}<{l@-lEG9^JmoM&P*i
z*(Y36uC}epd=!6tSDm#}<jjg)cXxf{IB#HWdPFF~%W1Q~_S7&5FZHg&Ol>+3JZz?`
zpHkJc*?0cX1h?pSV!yxiMJ9yoE&T2#TE3-a_A>h!Zp%a0$!xOPz0&law5Y@SqAe{-
zZ}&3(5B+-b)65*{qtUtkFL=49@-2y}c*(PU?Yod$O<iBYpUve;+mf)<BVqD&cf}nu
zzE(}1?mbysJo~(*`N7{&To)%s+}xZoRZK*$Gcr&sMQd@d+9#VM3q6l;%2g#;&7Rq~
zkaK#h^DpL3CAXzXcZzdw@sz!AdHkki-Ro6BLDg$Hj31{x^JKU<PvU>(7TtT=8@61v
z44zln{6$^ZB(MJ0T*LVOquqA=)3i%@WR9e-y38cdIZe?1;fZ^zXMR0-xcSv4e#i3L
zA}`+k`8RFZr)&HIUirTwbS|CTnh|iNB+glNO>}P*V`9;fT?^t?vq+tCa15Jb^my+*
zfiu@i7bHYyI*XKTyC}42+W*RRU#5n6$R9Xmx_R2Vh?)jd-T4Xr28`R@r6pd>m~i@F
zQrz86cC&>ah40;T*WW7ceEy;N-Az9}a<9(VYxcrt?XwdSEll$tH|i`;Ss_v*<tVW0
zlIxyg?y6^#ifT*LKecVFPn@)-_01ETo44z&wyq6c=iXFuigl_@#G}~qc|vdZ?0H=L
z@7CS<-bM*8zX|FpaNgWm@s3&VP~%mLy(@&{Y>(Xu`~Rt1x@uL=@%wyJ&dJSn^C>?j
z*ZsjJ>*3byJ-6rodv@5mTkOcbf3<P9rC*Eun$a6%AQR_s>swCYt=RUB-<-P*KKd?r
zAmuVwRARN=mOn-A*VY)dI9y=k$g9rT^e^Mp#h)s3eixh%S^WOTwPo=Nv)I2f&x=~M
zY?l8l?a6!md~QA8u~bv7Fv{j4=ch<%4;i@)zL|~kdygJtG3Z>aCS4I4c3q-uh0&z6
z%x3pTM;=86T;uxqhDGOgtKZ8<#|*PHwn%T!Tix|!+TjGnw@ck6cIjMF=L}R+{&_RJ
zF>>;u!hkDRk4&oQ`@>x-@0PReOH*X@Wq0)r{cBRbeNK4PGVe+!S8wj)M8@`?`#i7l
zFL|=oc=DaE;rX8)KR1=#b(p<Eq}S{2yr`8A>r<Roh-|VqQha1K`vGs-wz8sGA2(a;
zo{nALFP{0--ss5dtVjk1t&0AaNA&+5mh!S{Q8?sw@%1+D8Shpdwt1(V6KXD0D^(=6
zdG+5w*7cez?jJR~(JB`s8U6W7=u_*=7(3?7fOFF%%4Z~n6lSU)ZR>oq_RPXxGgaFU
zJMetx`%uGLvg5+df-k)LCPnq;7(QrPl6OTpw*Q=!#J3%HQ>=Cxt$a48AY8lKC^RFi
zXjxy};S(;deHJIyIIeBXW_kN@e*%}er}u=PvnFchNo}^A8Kzvw>G1yN*6l%Mx09Rf
z@5qV2$?lJ@erxD@xNym}fL1q#G@Ji#)-$HQvsRC|v+D1w=r5{POYK=13!`TrJa|ZV
z#=5pQ$<Iw6&HLVXVfChvnT`_LtC<}criNPWewWDR_qX7<;KPbQ9V>VF#`$mOv+Gnu
ztXaqzFPu7M*J_zZ?UHB0SQE+?i8ed+ONdBhA8GbwTK&UUYHzst#kDuLTI@XAz_xs1
zuK(2+hYs_v6HHjy!pHJ+!5m+Mz1b&^`#ktqA#}JX?~_%2h=5tY$g%YcXKQ9SWUZ>q
z5pkQ%AEWT~!^Q|}l}ooICTweWntfnn$lp2#E3?}xK9$Uh+5O^P@mK#TyI21S@+xDx
z`659$y!YGUcVCz5KkIy9mR~C_b-V8LjG8lT>DQ<8=d~4yF3mm~b^2pa{D<VEq)vHx
zOZMgdM(ouUo7f%yd?`95KI<I+=d2k=qjq0-v~Jq_eFohtnKOj0tFPyO^z!M#bE~@N
z<~n};ay>15b%8{B`)cQog;QiYOAEFgoxON|oyC#GGJ#WKA9RXEN&a`Ph`Uj(^Dm^T
zW%|j+%(7p+GPfHz&YRul`}8emp~<4>$Mmb!6B7dxo|{PRes<xU+4`H0U*%l+m>m7_
zqH6QKLt;EUV)IvtH=nfWuvmRKbWzF2cXE811+U%~_zGV;(xZ7S#MdwOa>yMqwViYL
zH!wbNxITM{cN9ya*vrXQp<z09=cN0N{(CK?CRellfaS01JI?brB;5#lb|&EIp3*4R
zHkbOte_w{3%yYh9Z5tQ4hAV>E_x5AH`H5Xl8mi*<cVlAKZ#s4A>u>k<e-?=e^>a*p
zYf-4t8$A2^TJwXJvN;|5N(>Gk4!&rzYmb6vi{`K5!zN{m4hJmX8~fpAr1D|o12Q`v
zJ3LQHNih8w7`H={rC_!f+qvN4sOQ2=*SGGIJ0QwYyHoD(SB7VqAAe5O)Msb?m+l<!
z=tXgMcH!>|j=h3@vMV2kMT_a~p0sAcGV{!9oOxV@wG~TE@-DoHJsExR*mRkwr`3<`
zJbJ#qcm8+JU-yO5hq&v)-{&9MbV1#Eb8fVE=lQQMZ+mcgJ?Ux+IIAAUUd~@-C|!EK
z;K@(9%b%{69;v!nA$xxH<mBEk74I;SMnSs=p&XC9XYFQu<rBbgo@=4$W*MILy-O2n
zGre2C{ZpIrlVQ`NHokw_C!Ma%c&vEy)rBT5epy!L+{lKM?S9Kd&nHUEU)^iUbzeKw
zr6ICFB)w(szjgd9x8|M+w3jIH`u*BWHfnB-g`J&m-2VcB2Ub2|B|==UQ^WFt^t3Nm
zO)fI{_-#+oJAJ#y^>3~Q_wT-adDr(}TNthO`ZR9X{N`ifmw)Hm?Pd4**~!VeShcNI
z4M?azDiFqaC+c!pgyn*ND^wi66@5PWO)J?T*nR%tfaF`}Rou62=-ECYB;cInzHnu`
zfXIF7e-Z>V_?bQlO+KT2_C}@QCIy*)Pe0tv{Pgg{RmTJDPL^6zq#y2gddRSubvo~o
zq*kVs54+iO7KO(!?&`^YXFIunTeV*BmJe4_4hi4;B)#Cm(l!4T&b=$^E^hSfb8R~=
z#cg%q{OxDo+1RYSY-MUTUvCz!+xBwH)hRJ51{!U4k1XA`*uG!8{6$jN@r?Bk9b1|c
zV^+FM(U7oin*ZV3UhkC!zJE&k3$|MIW-xyGeo@xyQTL1Bdh0}szdJHty#5hW-?V$u
z#np@AJjJ%Yy2B%N{lhMI7B<N`@z&V~J-I&@Zj&(J?rr(Gh$mS#-YQF<NwV|#556y3
zW^We%{V-PH^<uwU?b96c{K9S~c%(N+tDmoacv59ruCRY$lhKD4)kPD<&wV_td@*fJ
z5YGv#-{)_+E;U}6dANW3iT9l6!mlpBVS3_9t`T!SR}QnU+HrNKx!1yGAMq|d>vp#N
zq|m8~Cg#i+*4qPKn$6dLzLEX)mXPmiE0i~0-N!CF-@|>^+c{h6e&|e|8UNem)VG?W
zSF=PP8+oelZ?xLI*+c)S-j{^$NA()Zzt_KUD2TcCGJa)lob{^M;P@KdbBpE*pW@oz
z%X9Ml_0~x>aoVvbcEo&nI`MJ)^v>%k>nA;OXIWbO*ZPu+_Z8twY2WJg-U)8aJ2ESj
z?~A0Kct_6Wy`F9DwTDj~nQkq;?cKK*w`4vugwL+oduIFNU)yi)-SFK;;bC*#fvss-
z>F;mz6(1D2Jujzf_v8fI*>O9TPoDj3ccQ?R=)(Dv)7B`-zghOT!RGe;XKs(aupHQG
zo4-Bh<D!)_{7)1mJTbJ6e7kOgd-lG#q+fMgZ20E4q!)|b?D0PnHq&zEPw!7cix&LN
zJ0RONYu){nn-Q#a*1t=d)@;3hB}+rbDf_p5?jCouzPG&0j~S&NtlF7)-Ts#Bb-Dd#
zjv1dVU14QWI%C82<+ln|Y(%54cCGbcII(Pv=%Qf#Y}=?0SF$bI8G;s^Up!-DAM^9y
z^?hG9{<y&6bj&L5wClOg2ev$TeS`DHZ=HFsKX6r@nb+m}tjl*nXRl?-KMlUXi<+IP
z$<N~5IL`jpb2@RnUO4f~lu2p-GCY%GmiZrb3fed!FFo0gt98}?cug0hdm(~aPfp$I
zj9<=d8NEr@y;Zs8!{xhEOi!{M{8o4PTmAigZ=S!-ZHwQV)t?rz_wa|1KesgMo~D_l
zUBBS>OU)|$vS@km`%jWKLhVN;$8L3BlzZ&_*{X*b3!mqt&-&A+e(93jht!g-pP#*7
zdDK*Tb5=t5vi4~Clk<1j+lYOC^WV<$-;al16?Yz7TpRN2O4Jlqp+!57?XR_|s=g4G
zVZQwE)BbyN>n!Xl>widfyEpOAvtInW|M7mk({5Id)iZZ}5p4+xz4l^?<$JzN=`+hM
z(|nB#O1}3P+E<kq{d)EG_7i)1IoWxa&Xs&odUb$HZ5jIlnVKK#pBz43&UP-!IWG5L
zz2xK7o4+oeeekE1zxeCg$pHzDX|tkFzRkVx`=sf6<)iT?zh14DUSg@O{?eyV^3Q6a
zJ#7btHl8w*x>LQRci+CYaPCOnw%>IIEn@cOU7711N?($i*!|h<-0OoME<cWX9KgE$
z>e-YBRVp$%5n{6>Cmf$_8GAOoyd`0s(3j6Ek2yTO-Oji5K>u65t1tN{r{10N+04HE
z$N8L(yV)mpRhP|VyY}IH@HCCiz{CT(lb>&%RN`H9Pl4f8MzWFZhO#@kuBES;?<)$w
z3+4Yc_XpRXfGhKEem!Qa_Gx0Gfd1|amY;USPp<m>>c!iK2lw?~Jumq1>&xdI%=rag
zaTk_uQcTT^-eYfP`OEXd)16!Wq$)ptvfj5sT>t)DWoe58%PMBPmOA?SY585>L!Jj7
z|Jw2I!!+5-!y9EC>+bx{`joj=D#Dj()(k$e$|T>O*&p}*cW<pI{UWS3xqHj3n5QKS
zYI&EJReV@&^`>9%fUx}|jWuUNca-=Fs{L6uJ!Lk7NKJR6aoMunS+3U)$}-;Nxe{p3
z9bnXScV6JiqndkmO_-tS&$4W#)6vU2zm)UWO;HOJ^*Ug5ZsN<D;umW?&#+#-u>aDZ
zL*6qbREv4i)wO2vZFHS+Pq&v>i1k?f+?wgZZmjML4KGB<%-+1I_}q?;uc6_0&iDOT
zJ=x@a&ead69sHCv3YK`U>dm!LnKB{3|M2d#Ka<|E9Apk*yBJwhH*FsOgY)ui>DAW%
zYyN#L_%Ww`nRWf*`8y(o9@mz}*ggxkzH)NOtEU@`AJ%Q&w140Ag%v&KCCB`_Dyx-i
z&G#mz?TYm_lzFk>wB-EPQAMx9I$rp$xo;=nXS_7Wu<-ne#BHjJ{F1U<+?Dliac?z$
zWmEUdJh}RkowY|v>#}y{_GcIVUX)qEUUDV;<|dB3+>|{(y13YL*Ij7bQ?;XR_R*tm
zef%kN=Uz2s2yK~oy;dSRYo~PWtL^&~J)V_qEp1oRiWiCDTyRuH_eU@110(miN6Gm@
zAEN>do7M`3mcEJm%Vy}bSM2B7vR4-QO{FjS`ZuPp&NWc|t@b2J@9rFT&G~n}fBRzc
z@>B8kRc6n=Sji`Qh*%t6)z_F+UM<hl#W7dmPj-}Rwo>q%2*-O}$3=Np&3w%K&feAP
z$+~{?-^`v>NBc7Gx)?;%rn0v!OteT{eEIsW^{a0`Dp+TtyR!fLx})n&*FW;e&}~XD
zSLh1Mv<;VjWP2gu;IRindnWu265DhrLP>b0KjVXn;2@2^oc0{^?q2%)Tz~%CxtCv_
zim;FoxasS)iDA8DvDQ^fvAZVgJ^vXn{isaPije4i({}xw?U&N;etRdFlr{Z`tbFie
zMQnWff%DS^Uj5iuyOv*uf3ba|Y*Bp7iq#^2eLwp0r3Wthz#M00WuCc8p1X8`jpl+9
zVYRGxZboIX_pVL&7ZxvD*EDSr<5juJtY7z!d}#<`GW;F?^k46t)~uAZtEA_$OT;X2
zV>0>Ly=mG)=7NrMr+l7j-_5&v=AHQdutUu~p&I<pEGM)C@-wM#x-Gw_!t6&;twp?f
zn7IAzx3;HqFCA<>b?#X9e)p!lhk;4;;q#re8|Kfx&}c1tTswcR{ez;=_KB-FyJr2=
zN){H@zs>ei)`~&E<7B?34ZlC%cBL=dwt6@JYHoOZWB=*JPhGji+OowfKW1k!J}y|1
zY!f`^-porc_DAXk?7d!|x8m`OmsyE+!jtsN&aa&jecS8(9KVH861P9zEL4+bn0i6G
z?CC}}m;RcN`70-XX#8s&ns7w$5u5#mytm4ha}JyKbStbr<$9@YKi{0kVQV+5@rf=w
zE;`TKi#;addHe%kQ;EM7Wo75Y1Ll|Wr@xH}Se7LF)aX3h;R7`Zle0D!eXW1`dCQ|S
zH@`~W*jTJ|(cex^MqS>Y&)((mSFMo9r_(uOOIF9M?k;+G<=x5&>32W5vnOnL_w~vS
zo-04T?~~el=`+`pbw>FO0XHrm<>Ks;S@cng@9|Nsjm3v~bf-rA-n{2^;r@r|(SMo@
ze<l<po_VdGq;^@lvz#Yh@%7b`!o$20drQO=`m{I3_X<ri68U2LK=ZD;)HVar>{X)c
zh5xU;%4Dwi;m6gJ&-s^!Ru=~`H(plTs>wSkKjFdmbyED3#DgXOy+3hVs8b^7tB@sI
z-TKFOwmnE)u;B3Ym~-g|<=!rB&P~X&mfX8!>sp7_t}9v#QhrZ3=W*1paZmX(=M%FR
zPqLCeb0y@_<ot)5^262Rb<VMVO4Z8j{&d+(z9J_-<8-%#VEGOn{nFEaUjArz);io$
zdT@bCd}zfo=V$lVrqyrx{*z&X+V6F)F>_C@xa}T1^Sa61N~NstkL+z#X6egq@hklB
z;@7?~x7bBJuUdEAk;w}Gv@_+=L58M2lbvUN@AG(b?n2;OS5?Co_A?*dRiA5G(!F}I
z=9PQT*`~;>Xq|uPkl~&BsdJO(ojiMk*(z^8-&*DqTZ0-FIGZ>7t}V!0%XVk|CjZ#b
zBbS(Do~Cq{A7xj4x1_54`i}Pg+bbXJc<vT`%G!g?pt*c&x3rh$>WT4R<_JA_HZ}QY
zWaZ1LOEdEt9pel3te(|+$x2%1jaiYd&5M{Gro)-n_Vu{uFMrXYsC9E!<VPcYJAL1L
z$(z?jHZlu8Eq;^Osw<vxCg9<=quei6Op2RPvfeP~IIrmUC(FWaozJvk+*>QKa9Pjx
zZO6CCSswiTCE$?~k5A~)ty((|DtBLqwF;<`*70iYc;LG2KAZYQr>({rvvclCm)?26
z5cNCXv60cr!(eSr_Q4*B>EBa!NUoRVYhHAF^TiEi9G*-v#u_nY31Q52N$Xt8x@O;2
zJESs4bZOJUFU*=2ebdgCJpbKcbR<34`?&58CyfO?J7v10j&skywQgto&4+n0TXgU3
z+Ada9YUS4cXXZubul!%y1gmZa)h_Ac&PaMMay{-IpCIQEk-2`dL5I}eU-f=tHl5q*
z>2;sbb=#6PTK^sM`^7QU(bF<Bk3BH@n$@90GdCNURY*#D82ijvWSjPD8F$ZK-o|xP
z>UZ!)d%es3s~_Oa%p$_Tz`((fv~GLU!i<aOFUv777*;VbfJAdsi}Ul6N;7j(^m8-w
zN{aHq%M`QoAD@^Ax~F6&vxkz=_08fe?2qRh-c$BCr95rJ<Gt)6j^5t7vy;0*JWg#h
z`cS{W>dS0j&w0K@>O9ASHt*gA0&#b16zytje&1hiKZQH8{L_~r&DZ;4rf#woUvGBw
zQP{k?+4JY_5y+o)cAaj1UiHVfH&5T6d#HZDc=-09KN`E2iFsG*uTI<Cc5Kn~qraY{
zTs6x!oWFkC-)&Pr@6@<Hd)Zsp!0W#8Us8k1)z$a^Je$8R@3h~6{Z4mIWhqBr)V)=7
zxjXc7*Xix=O%iUF?cCAwEcB{PNz(Nk*ZXr$9N(uawpSy2#Xhwai*D=XxnAsC^``3L
z8khJj=9}KDC546w{nMHCm2KbFq)<`wyHA!(kLAC6-TR{HqLsxTSFLi{{MP)o+()hK
zkIVh#?+M$<_AH!~6uc!i^8OQb_55wQ+{)|9E(rXq&bYO^FYBAbjPI#`cM4oT`pECv
z>6n^^P1}TT`*lf2p5FH2>8F&-X7g2f8VZzEruokOvS?Znr^AZ>p_7^Cia3h<-aWix
z^`|J|EmKc#VwL#3E}rR@`l^bHA)-@+=7wI}^rG7}v}CS{>-@xbU%oGUtY_w0|N6jx
z4tw=S%05bUm#6NY+j#N4nFFuN&#6vE*K^lzPu)7F!*mlz!<>#ZXNiY84EGxN&7vQO
zU)|K;8QiP?dSC7?UVf&!6J?jZe$*?){jd3X`1a4MtLN{lFE{=F?)mrpb$a%D{+kG{
z-}TQoSl>J61M??d(b#=|=e@kU<<D+6G4-^M@(*n4bG+YpCN5Sx&(mJ7W%bm1=R}U|
zz(aRdYUP*S)Kh3(^ZxX<m4%Hf)R)R$DrJmWs8zSat?x&2ur9AuSJpDNzkfDgiCr^M
zv2o$m$M3h9PJC0ld5XchZMtQ@UY`~F{XBktmBcIFI(tja@JCwvf6ecI|1AICk9TM1
z>))@huTy%k_<ByYbL^aehYZ!}he{>}8y<LP$}`nE_LS(FmO8&XhVFLr9~*hRl>YE#
z=Zjxv!prLq?C;?}aBrJwK~|s7topoDw?gK3v?$EI)a7{0Z&RW=pZD4KiMEICo7{5$
zWMqH({G`7EQ9rNi>g-#}|4QpWW6F6Eg>yC&E<fQHXE0^-`7fK2Wn^u+@ac&;|CU9r
zcVsBwepA9Xck17od1afTd{^A~t&_T4LCSUB+6MM>jDl%X7tM-$n(t5|c75s`zjWb>
zPsP0a%T5<v^!Erkmu6h3c+Y%mPs8fjKfe}<+`Hjqdx8HV*Zw)P`3jd<_HnPeF#mp+
zivOSE7A6%v^?%q~RBRUR|NWfTW!jq{-R3=w6Aez?Kd^ZFhg5!FHhG~k=8BM6`;Yyf
z&)VbK%kR}W|Bq??M~;~>PwmB|ryMy^A>6+_tuyMJHt+OpQr#OIUr4E3f4eK=y@y%+
zjJw$vy>6_3wj=ypqTzH_A63r_R~SxCys@lydfLp!uCx1u6yBcGTeIn1)q_127GDec
z{DZgmP7U4WE7_qPSz0tl=$u52NC8`f!9Ica0sN63h3byV8Piv!G#DiuQ4b5+bl~Q^
z&-@X=diM`Wc`j#bG-=#x@KN2!_g>z0=}UTXwY!wwvh5RUpUlO0wez?Bw18Z`x0`bw
zF>Kjv+|Vt=JyrYR)q}2OfugTps~VWDiz{!k<w|w*x9H5eee1ILHKA=$ORU-ZBG=E9
zd%ED1%=S5z*K-nulsFnMT{><0)<`*GqujOoVtXUR%Y$-e-ssUVmp^`)HUDPCqfPM+
zYHPdu5}0>A3ffWHCOdoiG^;xCb(4hNvtIGM*;FIwcr`IS;NUmoi`*yY^Q|$q<Gs6R
z#q;XGUo55>S1WFb1~P>d9)4%(-+BCt`<M08*2VN0FJ1Xa>*<n2^S2U-KC`b(<c-|&
z`sXsOSL@%!+D!SY8??}c>8oqxTh|V&+s&7y-t6AgcjnO2<N(p@31J<#mo>}AXnyGs
zy&Zap(a^=&e#>e_2Zx*XD>lhCHm{O>&n>Scvs}O5@XP1IX93faYKnfPDQj)fY*}mO
z;$-_deE-6KCng2<ep6_h{lMaUj-#*0E<YCaTTWm9rK%;c-TKIVV{cWZo?M>lg^Haj
z)_#$k2}>F`cDH#3Hm36UPkevPfg`F_qe825GIPL<H1*`4@pU!qX;+rdzgN?|xAt;l
zX#Ct;r|z0BnZdYa=Sz)L?uU1BrtI7nVt1+8Ay6f>FVx~j-S^cMYnT^UH0o9=z2lBa
z)N9$pGLiS|n`8ZXj19Br%u`!X=d^jx)D1miM!wHh?3%9@wlU#Iak+`+wsujch!_>w
zHPHdZw{*KS12TVeJF#R0<gEVp$a;b9jieX9b}&5g_<lBGcE>@sB_iyMTaM-i>!p-m
zY>Z@`<euAjEA8mY^C8nabC+2AWqt8edAv$v;gki<?yGwYKEBv<;T^BT(VLa6?tf!0
zYS^_kov7eiGy9El$RW|1AlU=c&y+`r9JS?e-{K$h{6gIxuVbrK{vW8j;xjir@%uWp
zmH^Qg<saBZn^kvC|E9bx>4?X6o7@xj1*haz{f!7}w!9U0{^*y`uK{mvM79>ko@Rf{
z%Iqb?zlJfQ^PRzgiQATmEK$zCo4&<y&zDLjRW`15dbiEP#O9=S&$gOUCVsMhN6c(>
z;pxVn>=$l7_PhN%>Zk9<|DOZxCvCbK_%?0wORf6Q_ft-uo80`Y>Aggd5Ub+i^;-I3
z+&f<ehuRj0)`YS>TFiV$a%*Ak!#fqzKY8o9{w{7<{5r(p<M*eY(PisGgUUAS|I%3K
z%RT+*{FO6T?|pvfF*}1TZ;j42R>8TldbRsjb#Fa$LE!J{hQ)4*3_ru4Dx0yZsX6S@
z`gKqsX_aES+_%(@z4?2xu6Q%GdC0mfJkz_3<tyKpGHq^yD@t2_z2Z|=PLF73<Kuog
z-#jmN>+QJ1Ie%@Bzc0VjDqFt0H1t}zWB;rWzw)-KSic<O0|DU{T*vihDBryieV3th
z#}f8m-zKiE`m?+6--AQ#{geDIoc$T@<ghUDMRLi#;^hVJAC*qG-x{iI%HnXLP+BYd
zR@FlGP<gSxGP8NUD;#)s>{_!t(+;I~hTaX5Q!NvsZ)~#V{Ti~>!tVAp?Q3WEUh}`F
zKWSMG(^1z|EB_wxu=%-4BW!MP57#Vf;ijhzp&C!$I2_1W-OLs6$R<2VYsF%(xm5=@
z@x5aAujFvf{n`4XaQn^9RAuX)=!1TD?p%3#f5{J*w=&C)d-y9d$o$?jduoAPQpkbH
ztb2N|PV;$wK{V@4!&6`0S?9LA`29^pOyS1#(=*LYuduydBpxX|fqTZUxZLu!=cmSe
z)JTx~aW?G9)7?7?IQcBJ)LYfcS!!+u@-E)S6JgR8m}7g3YhrDSs#Lye9RG@SZ*3G4
zD$hr+I~;dRY)#Vd#nZL9zcY7#eVNj8kNKEviMqV_)iTZJT2EHjC*|7iUd8j<&rr!|
zZmP3^$EwUnX8r+nO7_e0ULIWbrbuSX(nkq(0o(j}k0%N1IHp%*d8se>p87k=_v{yC
z2B&97F8eOr#XE7skwX(L3<d24j0An&dIa#Lxotn>p?XvC$!_-MGVbJ@TUT6kE-%q4
z+rX$2=@!g+tmyrj`F(o}75HDf+I(Im^!V|cgM#L#3dI;)U;pu)yg2N-Z}7xZwi~zp
z@JyNiRc;1@LIyuW$}xF4=kt%=%)g<(;lLEvl-njI=L4E9)-3Wrw`JC2<D=akmv=E1
z8oZZ|`XAe6|6J~w)g<fUlN|x+?_x@y-&5}9stdUE_?f0oN&o7LOfuh|9}duoC{q#3
zn(?LT(a{5&7uGoJsM5V=`R`P(dDf0;j8(pg?vt7<H<~KR`a4T}TULF>{H&Vo=ZB}W
z8g_Ty=vS6|R3ovZ_m6yo6l2HcFOuv&mj#vkFW*i#->h&+{Ok3`hxe=3&RBKi%VEv~
z{IhoNZ|zjy7J7B_&471d%q0RTGW_z(n0s?yuZ+~a-%&Jc!vRLcf4vndvuu=n7ra_<
zSNYZ--%|a{Ia?N)Dw%Y8znvu`^>mL@X5XLC&Ww+nkKEj^p_{d@D=hqch5aVq8$#j#
zLelLOYI05-S8U##JJChi>z9{n(`#1KPR;t+Kdozm^nNP-;gx@=cZ~mK^pA*_wF%{g
zs?W<KMB7(=_%K)M*3S<we1sa3j!OxsvmBXr{%hX4J%M*VFDNk(Qd>4}+2;u!A)MPD
z&(1Au_E5Y1Yh9k)tB(Az<JmjX|0avATyePRM(mrP%Q6~OY_r#1l;YdBp&@9x$E(0K
zQ%~j;AAi06((;EfNelGbI*zXqbh+|)!_?*3lae^AeyRs^q<Ltcw7-^XE?qQ_JtwoN
z<;>h?%VkeoJ`=n=gOMk6;uTNM!cPu+W(3@EHrU9ika(?q{g#OS)D>Y5gm(u^ZI%^Q
z@M&wEJmuI+>0Q%`ip$<UN|0V^TcDiv)v2aEvnKTNoy0$LYVN5#sHl;-xY#pvUr5;V
zop#~oeP>rVXDP^k-`V2zbb-NC<-e8x6qAhSzPEUE<kF_YJKC;1D_kPYePiP3N#~9P
zZWlS5eK7A%XZFgs9!~nlU2e~PkvFk$<Ceo4h0aHI)Gq!R`GRkyPd$5f@$Iswd)Jf+
zPgddHCBI4d&&l&&rceL5{pWr;*IO5EvxT+ozbL0v`lfP;xLV+b+wWWFic5=Vy*#*5
z=IhtgcV%66b&StW@7|UhRo@{UkoHDy-ZbxR$3;(B^g23C7UI2mVR}<l+T)e3F_Eoz
zKWn#1{)q41H2Kl;+`H4WJ%20}kq*o`dQr*c@pM6(x{DW?&Zs%bpVZIG-~Z&1vU_9U
z!7iqNofkbhF8C$2&zN}e;Imf8HO*YEF%u$q5AXW4VB6s+=Kj_&y%1)h_*to&RxH{m
zV`aEy-b03ilQabUpI?ZHGJh+zf62V8g-_B9W_8YHStGMD%KGG?du~_7jx$PMPM9-M
z!&mKW--VQr%^yxG#=1Sfl(<s9e!0k=1k*S7@Aj*_T)gnvVm={WxAzYBR?En|H2*ev
z1;bTUPP?*@r0onWcPFOpRkK>&b!no|C%w0U)vG?u(%cck#=P{t`vJC@!5mjtsg%9F
zTmHFp^PMoE<$<c6KN|i>F?4<Mi1idX(BUTX@v^^jg2s)%N(Su(*Y{5^j*DPB;2gPF
zykGcvQbm<$QpPWVZ;3CPomBQt5*A-2?Y(uUUuF62oYhPDzAd@AfZsio<wy8ivoDg@
zSH!!N=@q>{SZ3mSCB1#xXOHb}GXmZRn*}8{Se<IP8?8F;bovUb1>)<buPLaAYJFeP
z%{S>1XN`A2{=U892Hd4jHtsna|8nzU`8N*C4)graR6MXcE_UGOg=d)wZL6(RPA%(u
z;Bfnb>`jAU(+#ucF1yLW`pr77^tA%({k}72S^iHw!q~!RrSbjn#;|t(jPK$CRjYC|
zCOj=(#?;BaigUH&bK`~6-@f|v_s`p>{-62fPaZv1<GS;)<6-^2<ugkruiE)?QclLo
zS^bw6yq<n{nbvQWYA!?OQ`t3jcP@3ciWQygooE*>lNS`$-F(Y9T1mPl*1Jo`?}+WD
z_ZQ^lgU#M+91sh*AODVzby>N}4cVIu9C_4~1SI(k7da^1DBEIDC2--6!Cvl`wcg7G
zR!GUcWBLAb-4xMhrhK*y$HI!mBc=rYIagHazt8sen?<K3m>=65U$V@4=j#dGnO8sU
zvb351tYc2p^Z66xj0Ko<IC6ia&baNIn3{1`Pin4khLH?2(;;Oa9_N1-XPHQOGpIQK
zWw^VV({RDJGiqF{YfjvE3!nOU`Jq3aU%SmVuBx2ywuZ55*Cp0R50w)dc&`NO@(ME)
zZBg%BvZDNCu*KuPr!2ZUn)UBePWxr5WgU_AIk~|0mbL=hhO|eaoOe$#e^~D*acYqr
z+dtFr+BEk3Szk+yx#G?~GYRxuxW)AGlRzP<Pq$)hJ=@=vvTtYoR>YFFvRmriIrB}a
zPiofG$BEyad#K7j)Qjzt&#Dh=f{r|qxFjB7D0wBqra9uox<XCCxy`Ny^8)4{@;}q^
zf9Bi+SsS!IGm1P2%X6@8i}&EZ?)fnBfL*c8)+5RN*AJy6pSgX^b?wiin%vSmSIuo&
z_@-9*ZH%L(V_w!$uWu%y`|iv=ELVCZ%~VTj%GJ#8ZR#(4o?HBP{`ETLMx?pK%!SuC
zc&qlgSI=88CnWOsBA4}_Z~AnfE!?tY@_pB{3W?4PF=7g@bKYcx@6y~7!T;T0?Y~uX
zWoIQSbgropx*JfCcUAq?lr#FLpJ-ic|J{(BX5BVx`NSVv4V)EDybI7W50l9|ystE4
zHCxQDrw>kS`s^^*B51GF{WE*yM1^x3jTD7<o)QW<IKMO9ZDs3;v?HrpLJcgc-5N{Y
z8f=t0{2*e}SBHhKc+_s(|G?H^_ji(o`x>Fzby4%3%vq(*?x}wxJhktWQ%u*?DWY0^
zfBj@{JNhT;#T_=^rMhtS2eHnq>6>qH-L3w{_9$JKL&dr+Q9Ws0Ucmv*j9q^gu6XxF
z;_hW>E}2~o9s!#2LE5Vq`gby}PxzVXu(*ur(MF?tF=|rt6+%x1oZ4w~FD5g^X|{e{
zK!Jd=k=gs55{3<LW9+Ph9t(Ldce04x^-y7F(2BI?wBW}v+yCv<(QkM-dtFV*;rqKT
zzF}x=W0!L7{_)~Xq?!Bqsj*8B$W1pp?OXfU>twQw&#VW97BQTA++^5HWPL+x*}K}7
zEZ%!ARi$tHc@6>QtVO^3Sa=`R`jv{;?OOkDgL90z@xJ384&io}SX#G+7H;8eo1G9W
zmHE=Xm&sw>jPl!8SJkMLug-jL+hG#ommRA5=4QRr+sN3*54MH48k%emHSOP0aQgU3
z<2j6<6<pq)j5SJIH`i2nUgh8Fofpo$dZ?^(d}oUd`-Jxa#dohyYc9NhSZv}8zXwLw
zujjTrtrBW_6g|Ot^`cb)#ys<Nzt|eOKDGH|RGDyO&Sj&3=U(Oe)x|mb9-b7=Z4S1-
z_wePy>F-Ze{C{|6|A{5NCwB)j=xpjyvv7aNCnaRX@j-i?^Xn@Yw*P)|-|-`R>ZF%5
zp3c^N;qY2pzmL;&8}}a3te>6Co*Pe9c%NTf_hGM}wxde=M_B>;eOp%q_AYIBsU2A|
z_ok!7Jp+D+)7`Jvt=zVE$%>*?i&M&&%|7Rz4^C+h^f;bbCG*lrI%fH$tSx&D4m*~(
zr4_fBX&-->c4A4%)ibZc<<{@itV~gv?YSWOcwBz|y}+D#U)Dd_v`>H4B>!{88o#+C
zPwm?MMzj3w?47$zTCRI?d7qEF*W%t9E#f%uc<jn$eamg@DlSNt*`%HQc(_8NYUbnV
z9*6dBwk|wyHO9(hLhcsV2P;pV3n}Af*DZMcarNv;i8_1DD&IfzYbiF=jl34zWxH!?
zsK<?GCsuntyUV~`G%r;^><o+hx=9A}vOk}Z;fuE7%HQ6;_nZ3?c80mnk2CW&AHT%b
zuiDJEVT<jbE&)Rc9)s@dxfgF;C}8OAHGA+{C^m*A)bM8y)4o4*|E|tcyEoZ4KeFnY
z{-QaHmCoorGT5`>O!!$bpAC&R2c9l-da+~9q0$*Q|B3hs7kXb`IPtIPp1tbk$z5%h
zGB=MVsNIvzW~{1c770I{ulhko{lc4%Cd^OQ-Z}B(P~VReys<wdCR`JIbnnROnnw2-
z!s+vszt8vH^D@CNedf0dnwMPtmbuhUa6j8Kv1{h^zaFcnzn1VTSQn=}o$czy@&F0f
zOE0X#KRlUS&3omI##VJ6yJI~&(pPP8Z~P*9CyxE#pT{R^g<r*;e{;-SrgmNMalPbK
zXT6rb_6?QY-Ojf>?s{mb?49K&lg<j(t@|9kf?0Kode0-3*VXQURq22E|F5((IWx1N
zZh_$MRU0k4Z~n3?<+pIXBygxq?wK0<qVw#F4_RAT_R7nzj*sL0a_I3z<#h||DouCk
zo{;=HXJ57d#k=8KW+(=(wDRi=FTOl&L;W}FP~ZPNuS{w;XGn<T8ASAV8?9e-Pe)?f
zucucZ-0k*b$~bg$(t%HgmNLE-uWoM7`g1z<U%r@GqS$nkxLvLVr8oa;xA3~@9XtGb
zvW@&hM)w;t4A(D|%an|oeeY}Q(LD*ma}{3vI=toj8MX4GvQwnAC&)+M*fD!u`l~z3
zcI_9_VeheDdP`p{+fn=D_x-cur|+3oDsgMdG3k@;Z<9YoX|A9CQSPYp=4}So?p4pK
z;`VkfOslV0cy-}Td223-#Cys%tmoUG#p@=V6}5hB#b;E|e=}jpDWM*-&%H_k6)(?a
zt=HnPi!d+UIcdkL#R6$Nvn*JizW8@}y74^`=KKFQS4%!wXtgpW<5I<o-~D%HGdC?U
zU0s*4K7_}^MLBK`zsu!}ysvjxuvXa{g!1{vyGQnw&&-Z`k*{|u>vd!bUoqRy@;bAd
z_hhxo-rxS5&nBhUcJb<w*a8DJoA~TU>LP`=#rIxzFj{}o!1I@3$HtP)H#!g5uI%}z
zDdlFpBbVX$gU?HCFFoJUxol#z*<7EHZlzbf{gxTMx%VGNHidkBv!nV<LvpTRiOr>X
z3@&Xl$IsZdY-#r@UTfgy@$l0<29C{&OQ&imuev<b_*`!Jd&Bg+V4Wq~-e+Y0Q~AG(
zb*Tf>;@DjCsb4H7>W6&et3Js7RbbDIGoPazpRYN5K)g6f-gAYO^5m&}4J#_v?KL~|
ziLF=B_n!GLDgDORZ1;sX_^>H{pC00H(t7HeshKw}cK)C4{`H&FpN{S8zxD2zJZXKx
z)PB`Czrw}qpOxn+X|u!~kN0FXIv|<PbpE5)20vvZ+u4l;*SG9?V6V09<!mX5y>c$^
zy|Q<)|7;4V?OG{)MC-y)3$*~_d;1qXm}xpcu<T~DvBZV@k0)-KZd9P{Q?+UPBK4|o
zrfVt=?a8&asW{X<UpvL_eelfw?Rzi8rYrdziIt4WwzX>8c>CVjV-ml4^ct_<>HE8>
zID2Zqs^c%kb*etC>smi6>F3uOm#tFnyzB^J{v9E;l$H7P2bT+r4t}}PopO7<-+$ec
zA42YB8Gld~ey>pWGHY=`?)I;CiI4Ovr?|=4GkD(<PdLhU=TXs|oq<8VHOp?Q*9fF5
z-(Fh(#wx?+qUhJNRXd~>Tzr3LUWlged{3#OmZd_??%ZDLu6J*)oov&|_ueVkcj*xW
zxx}q6f4=nI`fPr=>q@oN_t`mSK8!qZaEcFG#u>JxEw?XiyvWr5<lc<eQii>3@t#fJ
z4ZfAg3*T2hr>~&+{gs!KbM0e;c!ragu77dhZ#JK>WW(7*&-P5oeKGTrd1u@W1$Ft`
zk4x-=F8oPcC9s0sHFe6&@?w{ulV4;U{FANbUEOdX$2Vt5<KC?Aso~#v?~0jxjaO_s
zS*5Hm7})<Oe8Q5*f{g<4vYd~SznjmrVpp4A>bdsOj4O9NUS12{x-%>KcFH8d6sy&f
zQ!9QnO?uqj6+g?Mg#B@L+9@lGeM`Qw@^mei3T<=nN_uv8LE`%ZJfZT7pS{ox2s~(Q
zcSnqW#x#+s$M2o}=b&QZy}-yskz4uWv`DAvsvnsrYb10VL^Iopr+?YSzm(-eV?587
zefhuMUzjdG=TB&LSKR#6_D?~l4SnPPuRLaJVRxo#YSqLEdqsRUmo5xTEx4NbZ+g{?
zV?49xTdh95>n2}RvCEY$Zdb&%yVf3le&XWaPOGVJ#X{C?IzPE~UwG@L?Heqf{d(G|
z*Q9*JGhW*H^CTmOmvJwBFPEyy{ZwbX%Aa2<%D+K*R<&xxBN2t&tDbTcsLhy_Ra~=k
zsuUZ~1pn*ITonR}{zYMGkE6HFPRacet#we(;LY|OQ@eND7S;WjCUM{C^8=oWGdnJa
zW_LXi)4jdn%<m0-k8+-#pUBj3dC88`F%1*DH8eje>^yeQL_hKP-%lc|*S~y`G;M;9
zSH=79Zc=IMe;=t;yf<@t_0Hyk_^+<|5{Gh6UJ6cs@kV&wvmAlFs>cr}Dt!OqWbbxt
zTGS!A2Fo342Zh%#sOo(!m?q0v9pTYybm&CV-Tizke%Bg*i<!9puFlJ467?G=c*=RQ
zsZIU9Q1_*-zQxWbQd{Hedr!*j%RlvM;}%WkW5UIXOD`|ZRuj7Ce7>{JH1y6B1D=id
zWHRO_h?>YAUUu!=1&0q;N{U(%8|9NHE~^PB-D(*2a{IrK^=3a;-74FjsrF(i<C>6Z
z+FvK_>bn>5JZ8z|l4rMSx@Rn#%(}OoeT(!29@X5iO)UK(^1h4j%@0pczqMyVUOd~@
zbx-av)vcMees-M2d;g1nV=UHp2V}%mtXhBmS$z7Nh&sEllUIs_rtC>pS$fbgKwx9;
ztjzm&=Be69F5DBx*2O&|J*4Q@!^f9@Put$Sd3J+UMg7Geg}JJN{gN>TJXTq2LYby=
zOkFkq-NN3F4U5YxF0Wf9^l9rY=L?rrzVr86T$H?2eg3F{z-B!=bKThgx0bVg`qER>
za$$D*DWi|<g~yhCh<wJR@tUJydLe_pGJ^wyULHHczFy`ZVax#wh0^D9#Oqk7DZN-w
zaXjC9<_>n7XI?gQg9Sq3%M2bU&bt<PaG~~%TVB`RSO0wYnbk)_bB@ft`ku6us#((}
zatQ66`SMO)&C*+6n|4fGWN^+bX?wbTL6aNb-N+>CnzcrYd=_Z!Iuqfx!fE=~KTD1!
zc)T(EpcMVP@5T|myEkv&*jbx9p?GIjhNDL9flG&WpTE7eiv5PX!pVcvQ;rn`by=(r
z)qSz(glpK;Wv%h6oaf!rTqd^s`J6CDsVb8_nW}3X7df#n`qQ)2{oMQ{!Aq^%xr5Gc
z_J~mEVvcWFlr#Om6XTKVHOlQxp?h_#?YRF;J$3K8c2(F(<BG-0p6{tX_@XRCB=l}i
z%PGHq;sGd=;OXLry;h1cF!%>DFbFX)Fytalg6HI?>lIYKwaG4iY&PlsPi=vp%u9RD
z%yobD$}9X<*W-^qG0!*d-DZ4p>f&Tam6XDEB@w$n5$pf|E;Dx!V$i&4T=weQ;gxAR
zTp1>EcVCE0-AR1D{C)jxTQ8-FqDkKk#3E<v2u<|Aac`Ep_r~956>r~esNK2m^yJm4
zC-3d6`<y5K@6Q3fX-&04t!E;1*12k3*UmWObufIMxde~iG|z(%?iZ+b8|{@gJl8cT
z-OxW(?S|K}P_2m2ju}%Y-F@Pz8KJd)-K00Cyf?L;3E$(xU_Sr!sw;n=god%aiCM?e
ze8_Z4yk}s-Z>3YMCyvE6mVSs%PAZ&a{9<xoC9lo&r$!BeRri#pYm2pYuUb<i*rpS?
zHZ{(v+h^L9+J}|9d{VBis+;Eecgl%hD|cjbola4G^}O_y_Z%PQZ9YeHKQErOzF4wz
zQO4@kMxN3x<=Jys^l!9EWvOfqx-%`)Xnp%C?=YLk;Y#5FhWeFLJ}qi^nYCeA#+im)
znQIuX?}?Gx;rCGeO!+~*rtbfiwjAH<?QZ;kfB12~aR0&fs1<^(7nDD6uk*kAjpN1i
z&sVY?n*;dco##xq{9|=CRa1Fp-_6QT{DQYz-5y_^^}O}O>tpsGon%f&X#5eMe^^<;
zU_LXuZ{n8yDF#zcFFJGl%>CxVz2XzkRB9I2zbUaUzAdln>S^)e;iVNbD&us-4jg#s
zJL%}BWfFZi-o-bTr>wfhtU3FmXx{?0A_kv;uB!ziOFp?hIV{NdjA@6q@q^`Ou3OYz
z^}OqPBJo3>y){qv<tZn1_9j0PI~IAs_;T*C1GjTZx9@9aV%R058vSuc>`9Il7d|yQ
znWlZ-E%S@@PK0&h$xyZ8hh|(1x3d2JyFPjI_b!%rmwBBc&(;~Rz52d;dr0II!@OH7
z+qmqyKJDqLZ|j}W_3+(n^Q>40mIsdngZ73TsNV3oC++uvBqP!J3?(ZzyxPdW@oUDC
zX(u9{^4sXP#BFbWymx*d-=XvE>Eip}$hL~Jr_bl>fB5jro0R_#{>WHJXMX(kjh(lC
zM}q2!Eggrgnq~+{8s2!$z06$G=yQ|0<_VLl(Ff!DkG*ko$eeYq@(b&%%ow31sgpiV
zIeT<cyt<KjBx9%bmB}{m=d1YX?|7D}dc(f3L-_zlk-EUm(n+Uv7_9jJ?tT3E@ZZVF
z^(LS87@Rz$(fIYtcmCRGDQp|qMHLM`g$C)Zwrr}g+4JM)^!bPO{_Q?I`EjxMozEU2
z8$QT9vEq2PTaj!31BQPGnl8Ka`Rnn0=VuVT`eD_SSxx)j&6T};s4R=`+&RB<Rj2OD
z&zUFt=KVvDIZ^MAyX9O}K6ID!lqWA!OAQB89n<dbDZQ6wE!SX4Yj`G6;=`?c?P*ca
z`$AsFqymoJ{o$FCdKD~>9_7tqI<g`&;*`J(#iAEXo@{HQz8(7II*Ds_xxgF+DSm$|
zXNRc_xAM2Lwb<ydb?XlKwCQpZW3c~W>3Qh~%3PPfw$PkleK>9P&8r4!GsP7<d6vKP
zIuamv@j&Cxf-_gGM7?U*91U*ov1&CCTP_zRagwVffNyP_`PA$yZr61FhTUXcUZiWZ
zf2Pq^u6{qeHu=8qcCrbZYgN9d&%1u*Q+Ni$8>Uwa_UP7Led6x^Gf}eZvQJyoe}3+X
zdLHxQSlU-CNRXO-<M|p<84jT@dM{n$I@#8od4J37$4+J2sQ*z9()?v7oLwR6y6qg3
zh?mN~G$qRd36H`9`xf3;_u2V$%Jli0<>p^MBXC3W&tfl!Nv4|*Ykr+@EG>OecPs0W
zD=}h^v_DF?tPr&PJw>2z=Dp2Z0=F+Lk5X3saQg+*8S8*sGd=yhOSXDUcI_5_$}{WI
z3hB4&J~oHV@hoZKyKrg4f+M*qE0#}qz9I3kz?z45a<BP&zPcyiA05aR*fm8Wa>7>5
z7Pe)rau!KzTUswVId9+8IE^nns5wtz^ENpS!y8o#n*J*~SWPUF?NhT=&g$aGmsp!L
z<N4DwM_$Z-S8HQY9J0i_VVmL2?~WV&CKuf}6rZKDxoi?s#d){MO&KaYFPK=&Ppd@n
z)#`kCd-Td>m4Yw1KEhXzb;t+&l3fz;?7@|ag^Ri!eJ57%*tRG#^fDQoKX_YP@BWz^
z@iXE@clO`^tn#_~cK*EEGYb40f42WHcy&f};jZRQ9Bm55(|M&j*0#Lw*dfd2HSwo=
zg2FGK$^A07v*)R6TsX$F<h{^0znxDW%zG9t8rIx9$FgD;W6#A|ERoE4SzE*UWM|H7
zO)zipxNx3p?_AX#RkK26QWWM0bVqG&cx!q$iS@#vxkn!498mME-y$8;abG}b+Lnkw
ztqQ-#0rO1wbefm4Ul#3&(}_1fb<*Kuqt(wzYoY~W>Mmt$Na=35#(L~-(l%9(GTtx7
zXKs0{d*3E2cHzo_#zST-H}vcs9xi24E`IoCJO4W_rAYSO7a2sgz1M4IZ78f<arwOe
z%TJqM6_{`Oo!zoLYKms@+4&0($}LcuoRj4wGf%Fk+WgWp{#ydUA-%~Gkt&RjuU=Vy
z>gc=rUlB#Nt^eD8DBe8FmnGQe*v2O;J1P3alxs4ZwHD{{FtL^hhRbj-vOMXsCPTjD
z+K0l2o$_x#E$&QjQPy~NnP<agjpv?<G7BCa`p>{Ot4mW;c8%`EY7v8^FAPQJ12lU-
z-CPrx<8&+eJqQ1v8@x=5ayNLaPO^M+>Q3APJKj|<ON;6nj=Y%M{y-)7V9jAi#ole3
zSFA0VtfMJBuZiz!m_Wm%?XG=IZ|B|kchO9kles9kcUAOiUEW*r2MksSH0?jFBE5<&
znf2x_t_QWh&FiK=bhlj*TYpL~<N4a}2|FJBoSwDzIbYJg0KUueq9tl;JTA_t6--)t
zE#b_8cd^U=tTSbsee~ejmA(6p3Fl7lc)s)X;#<>BxEWvGz;jaJMc;u%)+H@F{+|Br
z`62J4!DnXCTv?@>4U-zY(>z-WSM=8Q-I}=2qV?%PTffy$PBE;~u6h&pXTdU$O<p^C
zCn=pYh?414+~UqT^ZN}mgUJo+8zYliip+d&H6P>Rv+ELQ)=})bs(7jV$)obO=Io4I
zGBTmZ*Rjr+c6-Y7?dKf5v%-GIeUy5;iRW6(5z}<h6DfZ;_SK~_9=>tqfnZ{~b$+z&
z3KyoR1G7#z9F5}l=W$$|=2pCj)90c6yXz8H0(%a=2=U=;o_6{Q<9@}OfG(8<8Z#O%
zNvXG%<z(B4@Ax-Ox+h@z?u6C*lK$Dx^jA~T)txx;=eBo#j*CUVeLKv5llR0k1H0UZ
zzxSut@k>8U^LL!_{Nyh8XTrZ`dB3{2&*@6Sn`_KPf7GJ{-}rVryCkl;!N>hEWJyd?
zfn53RsVcjDgKTDGC_GwF&RTtCmR<DBZ&~Vx8#kr|32WVMc(sm0<bW9eiB_{@G1=JF
z7TjTO8z;Zd&I|Iens!cK;ZlkYpV6<|p^GvY7b_a8ewySY=saIMa1ukB{D~=_Jbo-z
z5KFtdBHc&oYFnXcw7uBpSEufMX$$+g>g~SN#rB?xH=7(ZIo$bI$@=`-%bxoGU5!d!
zV0T;0`UzLpY3rIr=!?8t@pg4up<%(c)ZByVYOAlA#mq@HUAjJQ?fQkM{tF*9ta=@2
zBR2b{QK)P4TjSg$hrA>FPs*Lk!#A0GMfk=}tXsA3SK3`8sodlg^Dj?LPA6V*%=~bx
zAm_}kvxVBFO`AinE18A(aMu^q|2FvGsebp`vg<se2k&b|Hc8G{=Ck(3{nbq|5j^HM
z!ZuE_|5yH`-0}SVzfb=)-nBP*rm%CF-DNHIjlFKijx3yYZt5nDwU2JO2dFEpIA{KY
z;at&AUA766r{Aba`||OR?;1a=HNWoFzTNOq`1_A-x_OLsU(42i_lnR-oq9~=+!oQ+
z;8~C4({F23FmH&PpZWKLM*R1jwVCJBj9*@!mcQhR^0sBwX4kX>ugp19o33*vO)T@|
z`#GzwXPn48*}nZQqjTZ$>4twgZ~OXnZu^wKeS7U0;guU%Uetf-U~yag?u6~EeEA)<
z(^zZ5A1%Be;6J~AigdWQ5VwA3|17?<FB9X{zrCDzTjfEajgIxZ3AM9?&75}IRbNcM
zF!`H>l*ioi%)8GSzrL;e^m}_w-CxgC7fFX}|JGd&*tRS7yovOc=O-sET{c;p+x*1T
z<t?|4In0`JE{lhqdGp>9Cx5+vD<;LP_+iYt!Sc`flx^D2uXnELYLE?_#wDgM$$D;c
zQI5jlA3GxwassoD?Ui)Zdu1Xs_u^*rH2bq@Qq?ClWSKv2XK|jYk`z5h<C(+dWe=w~
zJk_*#u2Z9T$<trx!qb>#3nrCF-|r~Qh+n>*eeQ<~msykc2xn^Lx7G1}by+e+dn042
zUP2GogU%a0Jl(k#z6Qdd`4-<@*0fK>>{yo!&t}z_+b$1lTuTq%5x6zWuebD@=q%r8
zN3~g1)p^@evOBC+tf;Jtn9d&2cYH~5k8ksQnY%}v)lXc05TMA{!+ueZ`z)8uyzN%f
z=5Luwt{7)3-%UJnH>+BwXkIPj?J4(lR+ae7e&Du2b-$Y5evSh<+E?W+pR-w3W%**k
zvQr1PF8ktTGcAbS$Agh)!@+=rd0&%6YZQMypK)zv!Hwq^%D=JCN`JN{{o9hPSJ5Zp
z0ym~-vrK-_KTBCwIPFR47jJXnr&p)!{h0Icf;{W7uR*^KaBlx1qswEbppboQ)fWQ^
z<@wDVt&18H=gyE?b6l@b<;V7wEAuY}oDcPj7Y|yKJ9XB(sLj?*e)<zP{{Q-A`Iqf?
z{VxA{cyaT_<;G$!PfjbCwZ~uW?)KXf_cIb~?(eEd6w12#?Y+y9h&9Cvt$uPj*|pC&
zukhluz*m2THHrLxtOdol)CzSjzx-9&^H=Vb8Z*WC8EvPg{k2z}ZzW_FlDs%jl(W&I
z?Kz`#`NTU>-U&NT-9EoQ<n_PDZn5oc3lbg5*KjJwWgdMeHUEeV?@@-dyNjddEps-w
zR?+Fno}k$Cb;jArw~jsB_vK>75ofkk-ABPH!4)$s%Rcb^Zt48DQN;Dx^ajSc+&)r=
z`lfuGF{Q3CSoa{Oz@8n>k3U#xYWZAgIoGwd!;5{nnZ(sx*%=ZY=O*Qe-r=zKEoBHy
zZBkh}_tC=3hc4)`eU`F#9@UbP61-@Jf^fA-SZ4CFiMFryRwb;fuC?3t;l1F)!%yNe
zl4r?f*2*>1Nei0Zd2npn`ZJr&S8RWoJMUiC#KhctDh8oRLe_@c^*OGKHybaxacocO
zEuX6B1?f%`Lu`J0F1>ZYeWK*f{mIw<z4gsFmVCa-sbl@zSD%flIp0UEJIgHogmLbJ
zi)oi53{8R~GEdBV*0I}lLP{z-V@0lWwT^$(^<%H<z4W&FtYuEQez>BEKPdgMef8FA
zgTpW0OucNtmGb*l?!4e;L6(#zCx_xi#oS5ROeMTsjK_Z6v@j~*ubVaTR^!ci!O7RE
zZ>;e<UG3NHynVHs>h+|^uM1t)vcAkt%=MbYx9e;o``$Bi#b(b`+?YSJH2L7&dz$G+
zjvMQjt1nt4DU_nUlJU9Q%-W2Lvv+>tox9`u#1BoPTI+X2opnsAHNV=Q+jGj(YK!|t
zb0+IWYuqm~U(bF0qSagF*Sd3Ib9T;N<h`~nox35TT=JUQAHKK~zqjt2aJ)Cgf7_zy
z%_Ymv?0jW<$ZZPen}QR3(^57tzP54O<>0tcR%T6%j>Nq`NsBsuL`iJF%(TtF{CdFj
z&#juv%RaozahvXW_TWX`?TeVs)+vj8VmU7$vHy{$*q#S<cTPRtn>oesmT>g<%>1S&
za$7u~h2EV0s8RmZ<S!o8lQpiIpGxSy@qA{)(gvp8hh9J4Cw1wmlGPg%h8Nq@cPtN!
z4SqH8WWtq;`Rg~%IXg?u{+h)Rvsb-A=Pzw!>j`})*|mqCZAzK@V~c{Yx!0dfluF25
z$gb+fT2py#;ey!f)2gi+SFa6YowxX{HAC*H^lJYzELmK(Pcx%RBOctG$?3K?_Tkm4
zD-A2U_dI(yIq>F`O55;>G8W6P8Rt1#PS|y2Gs{fg%hRgA@~R3uh*usHmD#*Y_v@{m
zEbaw*U%p(Dp1NzvzM`zk@UynrK0N``TiN&TulxS))7PwoITCFrd=ev~wG$X#-Qmtz
zEdT$&nvNTu!DT!WIh|$Ql@C^Z4qcJ|XOp%_*oq+jZN6@ui?e)QSYP1bI^41;C;4u<
zF<)@OwzXGR^Sn~Dbh>iDfw?aA%&Vz;H#qKIHdkY3+)BGUGfJEK`I+yBE-*=JR!LCH
z=(5Q>mK^;#LEc~d%rWV?9cfc{bGj-|UiiW9U5fDj7aWuBf3{+}|5Tv%#6`I*o61eD
zTcsYg<h$pd@@xK-t^WS?6q%_^7y2jM({^}1^H|%9yR0|7&u_b28)@2-y~h0E?5hio
zS%k(b|2@?r#8Ulb`Pbih!TXO~$=!bc(m{vChXgKe7Fa3zYkm0!52>f3adlOaOY)_c
z{Hplrx?x}ThI5AZf4LU?yYQgr-4E`w|LmpaNIqM+^x<iN(+X3M{SFc_ezDYWzr;<R
zMVVLhU96jnq&{*BUQoFI?DCgZuDYH1J%Jzhb8<yQo4tw?|7W|kX2zZC3!V1AJ;fK$
zbdjl5n9H|mX~5HpxuJhm?)+FVfuF6pf6*0jnS*)9ZueY?*stYkdh|M{;upT(8j=#N
z&Aa9_^3GZEWs<;$x&wc^o@BM^g^69P{UIj5^?9Jn^kSxX%as~;u9uutPo6HNuA%!k
zB>u3eQutk)O3}rkwJc|~rWAElRKL#*-t(<mqHEWj+b5U)?=d&3lF@lBBz5kIs4wgD
zMdI!ErcS!Bai`b+1sYs>YR@cY9J!MH=<NpnDSfLh`(DxI$=$ksb&c*vUH3f;wtGK)
z!YrTE#CfK7`l5zsF9e&NR|F{;%vRDo>eX62QDjd*<L70wvT8IwG5g=Y(D+VsVd9LG
z2i=#F&6jU~=(g)G<D|u`d2xA@H|^iFJ+{`5`GVJ9A!UtM8(j-5Z`K-1_s$GtVzpvz
zHmVP*nR-@v#a+g&y!T6_q-^)j%Y3n@`qPu&x2`xu8y$&Fe^vYE?u|#8@2|Di7JKPw
zt7mNewZXGtz4x}Z!0Eq~y1Aw>2p#njR{7u+{kxiH&O#;|9+oRVSLLh|IuoMSQ&-%W
zxAa))!t5C#hp(?py`t$FcSf!1k9d~IRjuU6t+Tjq?Yq)cxV2F|E43h?t5{%qlJ6Ui
z_Qg*W%hpEt`)`lqcV9B`=-+BLCEoq)IS2NIKd$@{AMsCKpNZ2hPOEZ_#>5ux4Zk&n
zS58}UO?y*{-~%>$uYC`$9<@Agbn(usBN+#m)XluEIxq6fnHVP(>3z!2{NGMJb9iQ|
z`mX$w0m&5$>#V~v-&<R*QK?mu{uiQgC-!38lBG8`e*CmltVFZIC-2jt`9AB4BG;-<
z)~va)SL!kI;rO+Sw@wIR{m&SavN7-BcIlgvUd{0fUmr}~^3`5;&U~46dB1bt_z!)a
z?_YORd)vF}g;mG>oY^>KS8jj1a;>_i@g9Z9+W7mA=YDRw^j2i5+wAAhzjw@*{rb)L
zFWc&tdmht**j7zsy%kw2q*gMsVxiFAKYQM9GFa8$I#KMLcV97c?8)TcvUwY1uihzC
zR+6b(J@N45_kX!j2X^auqim<jGceRIU|<kM8`v#KEGkYd0*&q3{w=@l*0=xn`WaU1
z{ezTVzcI-T-fvai`TEVzZ5xYwFW<I~e7bn)#IxNlS}LNqU;nDNPuOR#d8+KvyS<ma
zbtcX^n83ipcHm4y|B2n(?f=%kexBp=xhqfBFC#Afa?iBgPo65t#$Q;wy!mafd&>TZ
znCUlvy86z`dv9~Q$^QQ2$=qJ|F049nvZZd(<|M=RQ%jb;tVvFe5-XmhayfOcPUfTu
zIr}tD&010!cO`SKXywsvpG#J<=P#{VG*xGD-d9cqquDtfzg4I1KX$aGPrEX7Mf}&V
zN~h0zMokoMJebh;<LoA5&N&aO3rv@ByEutV;(xyRQBAV)>`9Xko~++%>+$XX+l2r5
z?e6t=?<#yqOsy2=+`FnV?gnq<_vdStrCQy-;L4sEdV0D3>R;E_oO-qB32WR^QQM}t
zITLJi-c&i(`<~8ozx(dX$;gdo)T>{GE#J<VW3ltZf}>qm9DYrjcUjv=*Q+d4SNw+1
zT!E<G%dB@6$WJ$sXO8XG^xXKRXxg+TtGr(@G|Vb&`TgNBv+CS0IW<*V_ujo}QL+8M
z(64{*9@yWLmw9`bU*W)c_LKVT4OyP-kCXPDNZS%!W+i)Vs-C57t$oeTuU2<w<>mi1
z*i~7_T`oWIdGzErHmgsvDx3^l74h@_!atXE{`X9;zZUTCl+OPt)9Y^q)a}^&_3w+c
z<^OrbQs=ursfbx_y#C3>muEk0zkP9X@Zu-GZJarkA9ru@IqtBuYfkKBo4LVv54_Y2
z$eA_$>+*?fzVW@VS{%J<+SM@r6Ib1T?X|bMWB>0Z!-4}x*R${6V^vqqux9QB%^sy3
zvzg1k{#bPS-@B%QJqP8T6K=0?-xjCve}~01k+v|sV}}~9Ki$gqJauDC$@XgI2ln^g
ze)UX0X+5=INx-Zd63Y3PH!aF?D0%zw;_au8xF+?ikl8%@WzG)%32|q;KC(|aBgk<q
zaAI(ri1j3u$az;iFRgu%bBn#Vfb}Y4;gqd&r0hQ@O;4%3+a7o3Nd7fXmgChYJ%8`g
zSeS0HAv3b+z~L3^E){ceEt+w*%Uhr-L7<O`#Y=DVucp|IhsqXC=?PvSvywX~R%H4v
ziA5XcJZHYD#iJ2bR?U1>@(Lfbn{&?6?!Axp3cUDUwM*|y^#N;+BM<H0w69^aNxnZx
zyk`lY^PAK6*7>Kf-pE<-{_fS74|197SmZtRD)~*X|49#>JFWB*L!@{Fqw+PcfS?&o
zGRrM37q5_V%nDFVvs|gqT{JT;Jf+(~l*vmjvc65^`P&0`Sau2jYp!t+To;mfhFk3M
z<taX!UQU^2ah6es@k!LR3;Y|sOm75KI67+bR+k-LD`%_Je%UmD=_&i%t9yO4#qTs)
zM$JiIAI?9wO=@9bO2WMW;WX0=D;_TrnN=A3!=b-1^kP^fv-{7Sdw1qN`}6-<!{t*_
zyXMZmeg8qcyWQ&ve3dy~aw47|!lv`z)cq_O^Y%;Cu>;FDcda`f?4I$jCWbfrctC8U
zV8;v7S&7rdFX)FGyja57c4)_kw)Eo5GP#-DuB+DyOkKbFa?HPWP4)*x9$#5~?3ikq
z?Dx<6vVY!*MYEq|CwX7Fel=fq&q>$L^Srg$H@@dGUhbC=+MoOCmfOyIwQ4ga$4{R8
zi23ZrD{FEVU#?<t<C;C;rbum=h_QjlztG4hvA+u6mvR~16E+rGeZyAr&(vpI&Kz^*
zzUFZztkf*An8CdFV1-Mt*L}w~!q@zlJ-KST@XO7u^O$cuy;<tJ+I80Az@kktXI@ND
z<gIsm^K*I0wiYp+9G}lEbs;|b4haWtYM%So-na8(<KBCwq2?0rEFZ9ME15nu?aIrW
zi-RJPd%j$Vzw&v_nuU^06C~<%6CWOJ3x2U;1^;sghLXK6Qj(J&e^}nUSonO@d!ET9
zujTc(|Eo6fInW`tUq0LTLwc3#>4w6Coh@PK*Imwj!FNy2;9Tg6q+N%^YD@p9Rn~v{
zwbR7Q`gGN<uX`>R?>hPPZ{eX95k}nusxQm@iYFYbtU9Xqy{yVC^U|6{>(1V)+<GR>
zV5PxLrO&E6Vhw&5-=2Q<Z^M~u#g|gE1lU*~Tz`Gy;wjbK{Ah{7>f3vH%M}{64+L(J
zuUT+?x~t{EizSy=o>pa@F;}yX@6SZvkNTqFC;s;3KUm?<p2iZ#yo~*ime(Kdb4JWu
zlU08_;t8+|4Cj4dq>_{#(_lQm_{g~hm)g&*z03M=UbOAQrl-@+d`jsQVtl-=EorVf
z`}@BBN%8mOWgDw!$jGVY*IWMk-u!p+lP3@Ep4`nBw0FgU|39WoeUK(?^w@E8>!C$&
z5_U3Nb>8g|r(xm8s{6Tf*Phalq~61tE5%CY_-;1jHeuN2oc_*Yk%G9v@y013chcvH
z{<Qqo<6onCXnT5J-t$jN$zJI`JC&EqK2)?^>+bKc@3-I7pG9HmK6`z4-hO-K&YY(3
z8?t}uW__3Y&svwa>3DvP!^Ky3ALh@!eEH)0yO%FJuK&Jc^ULdJ1LiFW`!Mg>>7SCi
zcja>V&&Tz)-L_t=zCWM8`?28X<sZLaz5mhtMZc!SlZxlxAM*WpvV8LK#&?&KrY+#u
zb>U#GTbJ!SJ1LuYe_4-JZ&($s9pV>k;j?hsmsYM74tLcU_dCqq%qk(hvpvo{U<;4<
z+tvm1roQ~a{I%1R=U}g>T&qI=^ril1XA9g&IC<OQ<jI?F9&cK)ci{#}4e5tI+!tN9
zEy)x9>mb~Hb5m2Kj`jD<zbX1Hbq^=!2{gWT=3(?%&At6W*aWea<~RJDowhA_YN0SO
zp1sR&b>xDt^_){$B-ee=*di@eCqI3qI!Cpl*Rz9*;#<4gBt^6=KR<bOJi)Nv#-7b<
zZuNn<mIe^X;#C`S=nTW;Q#QKx6*YglLlc+qo-2;pJVDTWnN0QdzE=;AZ~1@Wjf9lx
zm9qy;POBe^x^%wUZMAWgYSfmTyle9|+_=0;qx}ra+sz(a|E({r$T(rpn-{%(X8Fd&
z`J&0IIWp`5{++(FPUB111I|_RF1$@ji#@EvV<u<zO}WJ2y;haQF;(uCLr3<x&)A=2
zD}0af0+a5{zOOv7C-iRIJaPN8+$=-G-G}n}w?-N){#|oGc?Z{4yGOS_cQqTD=+|gW
zl6b*Zy)Jgagrxp`9OCIy=7`@(c;6(kX4S&X3Z`qh8#t^Ir5clDbdI<(N3oq=`}(ru
z!GkM2WV*imT;LIIemgw$aD(Lf%GWkpa(ZnOZQf;`d}(_|;!noOx+Fe^&xhyOa&E}s
zFIX+=kg9dW@z&!ts`Fkq<#y^CYdtdPZM-jZ{u{&X#1%a=EzWGX|1)@_4Rh`ht#F+M
z?0mE1I;AIk4_KLW+G)`RhApO-xr@9ELbiW#ovAJ*7Tjv~VySd)gy#PTX7`v^oH)ib
z-`vdq^I5r{S^YV0kF0)>9yj-K!)=>I(|wd*Ue$F_6kXkEaQBKxUemQ0r~ZSN*kr2$
zgO-1`-E{NDv>!Q(_`=%uW-L;Yuw3{ug<;0_rbA&&dYf<Z+_9OlL^FYVhrf%><izuL
z<2Sa&UXo;;UbI0{ZLbo?I;PlVseB$gy`3D^sC`q4z8Q1iS-<VhO}9;Ntb6_{PKI~o
z<s08WtX#QgiNXd4lbbj1-jduZu%tm;^h2z4%jsh;W_C{GZ-4yl?7M5`iFZC6PI@S`
zKv1$vn00!@0l5Ux>L;v`iq{V{G4>{3xz&}yy?N5Cw@+%?KCfUgWT{#&vC~8Nsl@TZ
zD?g3~Zc6`uVoRs|H9bRRiM0iPf?hbTuHve3+{W4CU%gDwocAnW`7Ftr>2~Rp+w{Cy
zSLHZKF3oCYUoENoe7)4#oI9O&Os^m7U%GwS?5f55FYg#!*e>fHJ#EXPr|KL2yC_dP
zH|5r(J*oE#dcC?+z9wu|)RX*m$6r3~F`wc_o`Yw~BKPIrKK?4GVd}M%`Ik+3<{b4|
ztA2oe&ZE}UH^H_U>OKb-9(`dI`Ak*dyUqE32Osq}81FRPvnR>s*Q!0asfr6cb8o%B
zrqz4LSK-CUjWHV+CGG4`*pTx)^t;kpy(dll)0kS**WECmcA3|u`{lvN$lKokg6~fM
z?fvK1#-&{+wh0~Q<U6tAra7~COt6r2%&)Zlhg_Meg|5Y}+AQa}M3VD||L%rkQe6__
z3M-z49z7x^_;_<Z2k%u&#?Jp@4M$qJ)f+Y)49QLwsFRyG-Bf}x-FwUQr&({+_ZhA$
z(rAn3(!D<auHR~_hqLxR7BZZla$<tZ^$?>;eT6z)oPuxPPU^ci^*X0Po)*XbMA1pJ
zqqn***cbO9f$tsPp&-viq8tJ|PfS|t%3Qr``A&5P_)NFlb=2UDb875bW54vxB6E86
z!e0OEV$Uz0(i5jIcEYMzvB+6$)x6k^-(Hl*th+R04$HaQtxA8kwdYOWdS#34Ay&f&
z9;dsmJ^F04{*tEe46y?pEio-+x29D2=fz!qIPV9aX|qDj>bZt>cWV>Yd~nE0s#6vF
z^s{x=rX0?xZkx1smi4c7&-u-`rF-&L@l%hqGeecaem+SO*MGv{xMjXz?a@Nk&wbxJ
zX6xrx6dstq=<=soAC<NlFYs52*);vlN5{ia|D%MPuYP}E*Lwa??&Jou{8F3l=@ZSb
z<Q-VVa9b<AWXnmbBf4BduUXIiSaj;4O2{pNjJO@F^8Gh<C2&Xy#Tl*j(HGX9Rpnl0
z;p}&+ZMWm|b$bFb%sx7cHT)~>bxP1;GTWiMK=*r8z<1ftEz%WNr|t5I4eu=4RDScF
zXk~Q8okwZeeqWBBOO5kysSocHEWh8<DQ3vbm{ZK4K5OSf*DxUuVdGhX>jje6TF&g`
z{kY>}-_hqWZ<vfHv7F>p4%?r7V$+Vp&u-uN<Xa;DcR|#=(zAQ-)h^f03O={*#(qJ8
zDF+_Zx8C#Gz3BbA=jlh^EG#*C`cqA(LDS}ZEjc6Z|IgQ~YTx7%QJXBg?cHkajGWo4
z&UDr6)sjCTZI>Qecj}mwuC3|cmCwap!|&WT+BCoL7puI&R3?54-Gcx9o8Pnlsf$vx
zNz1w^_9OD}oboM=$xC#+vLZAeT)gI^QNDGm!1kcePi-E)D6g)I(73>vZRl<B<=8Qs
zt5x%5&WLZdY<a{JFxBlz=VyzguD_d0KXqR9zPqyPnvC&9{dY;l&P(*y?s_J->}Tor
zY=!cx;$N#{(wSXWPWXO8^#9G|Pi0G+3wtcyDQyt_{OXVIk&P+KPdw{wtKHpsm+|GC
z4_ny{Og!hF{W+<(E3lAX`<C1Bm=cC3Uz3>QlPj!l$dyzrTxjm%<E9n#VzT+k?vxtG
z<MKLI*-N+1x}+QBY?$n{EX`~~+n$-eYj<nEd~s8uWyv;XC5z>XDL;2;cw4O#R=XtC
zv)AzY9o57W`&Q0h$h&af;*1p+RgYa0uHUnD4)f_RRu+t>uHK4GzBbiZ`HbDOCnwkL
z3;3C_MLS@Je8V07rrcT6RZ>h%S4t<99dcu{y0vPtZ}rmXP}T`wl*@jm9KU-}PcC_Z
z&z~=8wpX_QczUC8*Rnr1yYel*w%=^~_~@F=XD)ZiXVZELPU~Jfp{29t=aF?`#wS;$
z6nKPxzuA0#g87fT(+n5!{hs!1`K)4}P03TQnLS^v!#??I#li0et(G3kk3Bh+C%S0Q
z@$j-OH#KBZ=d*5>XSq?n(DV}@L)Nv2tq){=%WnMpL2?u0KACLa1<d?U{oAGAaD10L
z9#Hf+;=+05%mc+0GyQLg<Q+WtH))^8X`W?AEgbT0CGRMm{ziU(<?m0^50@Wzf4}I>
z$L>0{X_*F#RvlJs<7oTxaraY}Nms>-qtYLXKB;i=>#MiAmujsWRQYC3q_fOYpEujX
z!_O}C-+e>gMX$9*DCUi;^rpS>E7=w$-`hCj-J=^vPdt`No`3LvwB?nxwvt6Z<V0(>
zeLf*3@#_8kl%Jcj0{2`^Fz4&3)?xatzw>;Q!sTx}{x3@HdFcP>koDbZt5dhF5|>VF
zQ@-B6=l3o?^{MaQtkl(McHq9})z|Xuo6^3ZC*QyOt#;*;C_lQQ)kN-@aFytkBR%t(
zOU|^d;Oy5n4)=Sw^-cNuy)!)DZ`rcXRzE5zNo#%Uf>WnER&*VgkbA!W+LqgrzjSu+
z-RDo<xqsnTS3}OCjat*5&QNoV^W&P|n|7wjSVm{^wQc*O&5ph12&)xWHE(;QB>Yig
zPLS`W1B>K>1a7oWVEShLMvvjggzXL651(tg8q2eE_Vuzr1qP9Z{oiso{(F~S<<PZY
z#li4s{g&$o)`uPXS~au3kcq2HeBD;{c(=4Y%k0`MR=9~Yf0b2~_~jO3^<}HN;;T!O
zg;*ujvwr^eF8-}*JyRt1(2pt8>~_D;4ciqUe_+}a1yT8{ya(M%Wn;JKsTw~y-@d`>
z{<&#Wos)kT#TI`uwP)IE?>#-V;&Qu%%G?=SdT#Yy2!FH6Oy1I6uC8&Fs9D0zGur9b
zlB6BWa*b!%UU+^m{7~Pk84N3b1<v{+ZFT>9_096#m-)Xfm4E56_?A#b_FC0^kEN>X
zl`rYdSKfNWKi|SY>chhWbyj)%Vlp1v-)T2~c41TgaT%vs3oKjie^Z`Un9?77vTljz
zk@6Rv-DR_v@GVblE}vB)<&(QKTe;<;hh*}pBT<VRj{VRLwqsh`n!3dBghJHig(j8G
zZI_>vo;fggkpu@ztQ{ANr2f(OYRk6XRu>J7dGY0kPGt8NxsI<dPoC0F`lRjXStqEd
zoGrCfc>jCv#fLMSo6aw5%bI2OI_`*Dz=M<zcI@AHLs@pMk1(9XWjcEs_tR>je=}80
zwiK-2#df|V<gZ@u)`urJ*S@NKk;5FHlGXP+Q}ke`!iJ15Y5^6zUoZ8W-Z&D<8XFjO
zUvSAabETfCxsUkNK7O9Zbz-h*k66#@X)^l7J7-=_E$vzSOtI3R#~`pzVSnh!%`!VA
zr@vab`_dx5O;&9__AQ<l8aN+**qOSB_4L_3N6pWdChFhx7cuy`d+W+Y)%~wRW49Pv
z-FtNM`LCw1ibtv%&g;yjw|9M(>A!Ge;Wo3Wi(lRTym+qKwc<tTX$>jM4k<Cca%K%(
zw9g>BmGwr^t93tT-YYQKy>Vk2TkFwHmjou)ec^oexnaNkCi^$fx&KX9-F3=!nbr?O
zrhb3j*Q%dO4hrAUGf4k5L04b$?1P%x!?(nKx|MNe_uW5rb?^Esdn0?V+pqFIrFZpl
z@wXqXyHfh&R~&D+ujd}Vr6GFJ4coq&`p06yI{%%HpWbxJE>K_=SMi1i507wd?ryw&
zdfUemt$m>#{1+l;&DXzNY}K%9|D{h--?`J1C+U57pnP7k)-mx(Pxd_b50fT!i!3;Q
z`Hxh%-LaCU%vpxY#&R($Jwg+DC#_<BsvvjzGxwq3lB=wTSD!f-k$2S6Gu=4nm%?%9
zn>KTW-~GH>!D3$SvFcCGjvB86vGp$d4(5h__}i0_cJS%;3kzbJTTZ|C@H_w0>5lRz
zTkdlX!L>%|h2doita3K$+?K}<T2{H#DRf6_ZGRnQ*%qBLz1Vo_j`kHFL}a<t>o%tp
z=bhNd)}Eoa{q3elKekH;Z#umxMf$^yCeFNB$;UaYw<OHG@!<cqKi7}0m-Fv`wEj`e
zsjgJj*`fi>zN*u2Wu*4@_AHeR{W0g-)vtSA->R<+`h4=neS6Ecy6aPZ>J?Q>{PFpb
zW#RvI#k3=S2Yl;w%J=O%v;N_$jrX{?&2OBVsI|6oLNV`Zg>p%e*x1M2%1<|W{or)p
z>3m+HQA^`so7fzc27}8CJ-NKye`9v0DsXtMl1*sjEnIygeERi9Q;k5blaA|u95hm_
zJ!V$%=R=KY+T2E~vh$PYNS-`?=JKh=%isL|vmdJqs<fVwdMtbI&zkM^uS)mk1($u8
zx@UFw(L`Nyag&J`q|3w(J(G-k&v<%X*1adsMdsfye|od$;W>`a-`V7I`|kwic}?`X
ze`U_v&ebxTYZgd9<Fx%8leF}*aiyk*vks5$!>Uz>4_vq<r1NfP`%wuy&b$+%cA;h~
zzZ}$Fwurs?;ECl-_Rroe$}Ds2ux;KU_o#8p^0|G55|6VSkFV|2@RU2ZGwZTO&5Yj-
zTie}3@>WF`@d<zFz5PB~|GfA5tskTw9qj+l`b*s=Vy3H){tx?r`Ocj$?5mIeUTB!|
z<+6;E7~>m@sXLxunj~3R#Sy)3zgl-mNlUoN!*hL#(;mKb*wC?Z!@SiTxmKH|OWaV<
zs1ELUy+=E5$0q$h`Zo=?YQ~qJv-_DJ^7O>J2=|#~vtD)1ZQFA%xS6jnW2U5ptfuj_
z9*a=k=%Ziut+{#Q8uPczHL~vBKbA}Xm}Xqqwjgy<+qvkg%>SgM4Kg#<ZsJ^?aKgvw
zknGI^nTtE#Z`ZUHdCKS<60xxH<;2tR?vH(E-F`i%M67Cl-;*o$=F{WWJqft5?4w=1
ziuC)lPTJf{ovoCQZYmJJHR&5iLsFd3!xWF2lBCU3((lw)NJT%eJ16`w^G>KhZTZR5
z@fpXC9Qu^?vUHxsRlNi6?uv(M@4D9Dap31>38{%D%2nD&eI{JzsQ=cxZpOuP^Q@~k
z{C!sSsNz=DqaVj!OnNBbS$OP=H2=EZH#xueyx+JuZ%zL}!@?Pd6Ic$5PWInu+JAm^
zg3qd%wa=`-)cP(wvAZk${+4G~H>brVR{gTK-u&Uh1NoD>g>Fj6)}^n$`E`xy?tO1>
zC5pQ=9G{uGStqP{-gMcSPpbuXO}y#6A=-(1!vn@0d0*}`C(h?9tP)=QX1iMIT~Fcr
zOCNlBe5v<WLP%<i&N^99o={hV?DOyZh2I)nl35^~^=ayY50Bk<&#`v4ajN9>yUW4f
zI;AA8W>K1#u0hu;Z?9sz^5-vVt9u)Gbe_m8o8GV5SG9S=o`u&;Cfzt!_A}AYLB!hp
z-g8q~o`05ZjYnCHf4W`Yf7;2C%USu`W960FuUpKybc_3UR;)SLCj4uwtjManyZJeG
zW?W3uXqkFu`&!v!`Ik?!Ob(low|LKWhQ$#J76q=h`E+>mtM`-m916Y|pI^-1&#>v^
z3$sPPpPjy`^81NzM8?~l!Bf_xxa`R4$t<;;G~<lml*IG1r*$1o53arV@~{=>HSrV~
zvF^YrHzx^{DL>pYsjR|WNs8$~><sO=7zUp?;&SyjfAg0`8cBSgSkcR9(=sjG`2X(z
z>A%bQkAHYSE8=dFS}nt^BO>!HHl?}q)F##3H~DV7_0!XUYwFLh9lCXC=l$qg-+o_X
zdsv(tBk}RVjZf3OH7EYPR~ssR-|2#f`eH-%tV7#heom`!WBqKnJKuHJ*X-g&2B*b1
zOn*!B3-(M}?s6k(2cL_s*yf)730>=3)7MG$)a`Q#(OOo2Mp-}TvBLeIKZW*5x;b0v
zPx>Nb{hTFyht@RzTqmj0KLTy$DYdGXujH*LuUYQYbS6>dW6FVPH9vnfS8qGjx1&{x
zH~ZdmU*+HD4I4rmy!B20d~}WoxO_kHSn9N0Ot0MolX=YfjOz?rm*0Obx;)%_%R7Vk
zl}}86eOW2>_0g`06W+AS=!v@C>)$<5;EmBdZhyg``<ae@ALTY%=-yT+XLmZ4W2D6G
zeg8%KiI<m3cHNxyzkb8B|MIi8xMbfw5Eu0F!^$xCZ8m4cUN4<EV~hW*9aoRuZ<Wkl
zUn{XYw|S=c>>kG{?(d`;I?a{0v8?#K)QlnZpS$^odt$F^rG4K&D7e2+%Gq6AV(W#8
zD>Xxx92c2=)%)|Od4(AcUMmc3rY@PK9@HBf?z`Dj>RZp5$!pcr+@^F$%jM15T_JHZ
zb$i64kI(;wr1);x9=-LF<i5|-`J6cK{*rTS`n@CMQ&6w*K6%52%?Dqb+)%VxTlSu>
z_3qgXD{JPQUl-_6_VY#jl9>?^PZWRi#JAY3D_n2w@oSRgqH?}_;Zc*EzZETJ&|0N=
za$E4tzmrdvxY)`0uvi#y9u@7kPwQdb6l+#d*7Ne=_Ucq0p2D-DEaAJ$PpzJuACRfL
z;zwj~gk@=u%IyEkOI&?Q7Fn#dEc4|TSnWEwV8h0>#$6dcm04Z8Z*=a-Eu0m1yM(Ww
zNAs$v(xa^PlcH>2N^{<>ymo~nVR1zCRonEH-s-Gt&s@Jf@#Pwi?7{~Nc5Pl|X1&n8
zsnpy+>rhA0zl}ADSzFc#H-4Ouoh~Ce>t6Sfj7#i~4P$g#t}EG=%U<8TyZz3CrfuJL
z@6~-Owry$mS_^TZhBe2h9*&y!Yni{#&mQ+VQ7j!k**9c<{n@@;<43OX$2DDd)`W>^
zwNDXj-#fqk-0bkKwVs!6&Iu^wxqI+;qR`h_Df4aZUTtW+%x&DXfJ0YE{KMX@r?z~W
zRF!c`YNph?OY+?@FI3EWBDh@&E=WZxwgn!)bj(FQ*f4mryQ{TDxcvnendL`gUnX8s
z>57}7_s&{5>G#_wKd)HxYER5owwe+4?&r2od3PN1kF`x!|6rBcd2YYb=d~TNRZ8=_
zI&x=b2A|=%6`Y<ibEe3d(!IZP;!XNB+%r#aPi&1c2sGkzac9$=7Z%l=ob)~1ELY&f
z%8Z$!p*uZ!LRfmM^}G^JdNF-I6}S7!?JJu3KP)!Y2!EfX&3A%BOp4=EWzX~*TaPFd
z$mwmk%U^2|F8FZo?yMxYqhY5x6VDmHGcT<3eHUJPPxjmEHP<(<e9@yc)jCD(Xqe@r
z#Xqtvd08A&XHBu5T)^5I*30i)6`~~7HhIcVeF4KMnHn)l)tYWS4%^Qqf4pgOt@cXa
z+^oYDC(l)VZt`cEd*{e?|FC;P&HKJhJX*b0ch%xq2a6Z;>nUxV_++)x!e>`5y*5#K
z@n+&)ha*$+9y1BPpUfZ;|L{TZ`fjm1+dgc1bJy&I=Z@8eQ+!QtO!^}mlq+s@rrhtS
zn%s8YZHHInGQTnnUA^FQb3^1j9m7ZlFAMIR2wm@;<<i?v<Y&(^`x2fIZhT<bzMGlB
zyH^CRyxJx;Yi*xWl+310Vy&GWQBLb#X8wIC$M(qBZrayo$86b0+b86e&$|Dpp?cMQ
zZPk1C))ZN95a^9R)4yuvbvyI9>K9gQmbq~$N1&AXEyt%@!nU(@zNCC`SZ;q+*T>h$
z-?--Dgso?1@6F?=u4P-}GyO*s`-^`wq9R>R>`AyUtlauAN+zy(^I4g#$Ikv|LY>FI
zcsAHjRDyxwbpQhc`YENwsU@WadIgn7WBwN1cANBnzQ191tf)hKOU~1GS^nX>w2zkw
zy+78c6*OsgPzVPHpGSnkfkW*Y^St>>)))Gh{e3-?ku6^2?WuR0guI#3s;a7f?XIp+
zTBmpa&-Fj;7E>}6pTD1Gr2AN7+RvR8TX_#{oio2uUrqf{>9)JiKW4>tZ5G%6U+VY&
zPh`ycr4{<!I-=f{`jc~ZFFd(u%E4u(5C8w0{%lUIZ}GW*u6w+_XI?m6GyAEdWcte#
zp{F<9e$<6b4b`iSKO$Wf-lgEXc~ZN`<j%@z>$f?^otPQHwp8aa@84}+n~wU_sF<WF
zX{RO4W=Wm$boNY*YoU_rUyA+vy?5SpD|8YzILpAJ|Cz_%HK1eduh55^c~6xJ>GK#(
z|FV2$@Vo7WyAJha_wGq=(_Li|dCq0V(@6q6X-><&7tUL%aK`7zmhUyQy?>RfnJLJu
zb=ZILv(4i9p4%>cIOEMcedV8Tic_N1W=c)@DBmjiS^59Z@SW;eu8(f*{`da$_J6P6
z-{1G|^=|(AbNyLrE9N=fpU$s3cL#5SM_^jwG!tjr&4R{HvScqbUw?mp#nBfD24+4@
ziv-RFZ@10~J3MdRYRw-RRr9-Dmx(`Z&D?q9K5L~{gxK8aJ9##nbcG+$m}|bf;&!cw
zn$Zd84+YOz=U*~X6VpGnr!FcbRPNNh$GIDt47M<YsAw(q|Dyh9-Cp@ei}ozk+&=lF
zmfqirsX|w4o~`13XmO5{(<_Ff&cVKU)tNA(sYm`5X^K^s?wD60-dP*gSs=SaTXWN#
z7A?gvK|_n>BD-};I}WO3Oz=MQRqebwOPx{V`hWAf#eQ$$kvkXpPVM~s`B^F+PwZ1v
zCsu8rwvwY`--L-Zp^e`oby5Q+%u#i1+rB8q`_WMzd(SwtFS8<lyND#p38#8S9kJhA
zU;XuQ`|9~|^P4#RySMsGsx;nVF;^#*C8KWdgwwwo`Od81dOx+U^rZf>q<``)8Cp|a
zB-p+e?Oc>RWhehLjmKNq3#|h0G~BnX_PjpxeDI~<??rrB)|+Sf?vi&hTQTX=qi1C`
zJ_1SU;(i<Mo+_zikhqvs{jjF{v+7KZW{FQqo2q9%{}^=X<mE)IEi?8M9$IxJ%wt}0
zfq&vW(WCZR-dmWHnpw9Usi?Ur_ipaY1#<;_7rc1E-|Y1_MMT{8(V{egzYi2nZgHC}
zZq&KvYM0Qa$Y-K~Le|>)GPa*IldkyGeEt0Nsek_Zb$oi~R~4VzmYgT@BGKg5sc$D2
zSIXaUY!c4>de&y?X8z*IOLw{lR3*LDj^s-I*i@1^o9UXO%f)^p9ovt^ii@=Zvoxk!
zKkQiV=J@%zVZwDr&eKj>UtP0;vekKKh9A8@>-o{z2_c_2J}jv_Iax7w)_uXP^Cno`
z*r>03VZBN4OfyHf9)WY8YWssi87C^qKe0QfHEk7dn@XV;Z|Pp;Z7G*`?0(Yq%`0ef
zc(jqY@eL8VY2I=jPs<B;iX9X@ec|KDI~|KoC_Oc?UAjGMv;Dc>UYWJt$2{y@uU%(Q
zm$)}chIv!tp{e&yDYHfkKAk4y<-06Vr+cOPx<@8c9xeU8_4^}*S;trvbAqa(Vl4h=
zDzg19Nho@|Qf8KIV4S4)tJQDAW?IkizONn}_-h}xuBq|zy1bwHveKRW$FA``Z=D&k
zKP_V3q0{O|(z2M|3)TB)^4TlS?0mTEapFV2Y=$QrrM@NmuPfD1chZzgTK!fo=YZW|
zx6Qh{EmT%X_h=q?VqGOYK|p<XLVStB(@Bwy4lGN*^_^(;`2JLC&Q6YLOIQ<@d+_X2
zy*8DfaSyN5mBwTjugE1D9g~?}FAI9fTQsw&^$_=O!Gm2qTdp@H8tfD>-@aB{M@}u~
z<2u!t_X_v-8wx%16Rg%bU){q!x!*E#!^DF5d0CIQDwR*=c-EZoMrGIB&pSoqH#$Fm
zC~vN9bHx7MaUDNv<!Hs;@7I3S&OZMASIWs(cHcWr&w06}U)3&kpL|`S;IZI;O|MrO
zoICt*cUtw4x0fUL-h5diFyl#s=YfR^*S|!cczxUE{HKpg{axA}J3CLjkA1hWML<kn
z^zoG^3VE7*4%`X{Qe{-4ye~0MG+iL9`~BXFExIS)F8O}#Q%LjEgNN6oR^4hh^7<kC
zv8}fD?SJP(Wv_W;=6Emqc6^n_%}?1c4{yq8cW-cw+@!LVSMNvx!^b22U$Xagb9baq
z((rcJ)R-{WU2>@fQ?dBvUx@*tYq&lwh~VdI5mAYlvBN@f{yc`Vowaiqg*3K1-<i*|
zS<3E0VpUd5!qt>h-^7pYuXOyquXr-E#)ITX^+9bfjc$wD{Zxp2@?2Wrl5In?O82+c
z1?>mi3cb`#4;lGLMJ)ThVFUApMc(f&CPz)+c)VoGk$z>rC(TvqGfkE(u~+z==hEe1
zcfs-Z&AUfUBYzaW%JAK^P~+s$TTu=PqMm)Vt%bUQ#tWxEXkn0cO<|PMQ4ZT8+jg<|
zR@J7)Gp|maN}m!s?;1mebgT4AN7KBmeocG<T`P~hS2YqimB-GRuK43)<a@)%^>1Ut
zQ_g)zX!E^mHoG%8?$~`1?Icdgqx@SopZKYe?6LM-Uqs$Lb)A39|4h7L{r+b|MWvg*
z?Ck@|OjqJ>Z_bFD$GiUuvx4iH@VS$VPMl9Nl&<s4Z@<|kzDGdfVzs@VYbC?itA59K
zo~zC{o}_))LTUPL5s%UdXO^4oEm(F;bxT3T${+1KB|D<G$u26KlyRs1*-~Dgw3P{g
z57Ko_Q*4Fm8VWCe+p}5u`CQ-Vid(;Yiw%-5Uaz}$d-J)CJVItgc3*FP3iRCVdwO2z
z=C7=ejaDh?$UoFgJ}$>3qf;r<)bLNEq(|I@-7n^(Wk{vXwDkI5o%4N%FKtR<-Kf(&
zQSIS{opU+57EN*$xL3GCNB&gT9@&)ara86QMY}jWyygjO9<q6MCgkczX@#w4cX0oB
z{N!7uOQ*%zBS%{+7OKejPx~})zR%634eg9-t|`lI@})LB%TKzN8Gf^Y<E`mLo#08u
z3%A`A|DSkqe^8a+i>*@?%62uz9Z2GS8rZmCUd7p&AwSwIWmTPK^!?frIeUX_P)^oz
zTU{%&E!A1<5l?6LEaI;gw%YCSL(9Z6<CjU^UAf&+e$tk+JNs_N`8%5=oD-QbeX{yD
zqZPLMGVHhN%6%<Q^9{K0gFE-?*~VBmM_=m$oA!7gk3PDT>8*ggwKaR4%M8WbqK6@=
zCjU1dzBqr?oGn{9+q-w$=q<gy(%HwJyY=fU{sRkQCrcEiW!XQ|Jby&@Q^3PAh4~lC
zdVN+MGFCjgX6nHYuXwz?F9bX(UTfOn`D0>S{VT`iOH&J{ocg=$wb0cD`H6EcL^U$I
zg!pQ%d$l{F>Y;o3iF>ndr0J}YEI;pVQ>>d%n-wj(`^UV+_xjFfZ|?W9f1T3MYM~Ot
zxmaj-_qy;4O&MWI4W$pf|65!(bC8Yw?y%~|X@<<e_08`7t=H<7JruRB&61gQt)cFa
z*JZAqyUcyH!qSDZGQ8h!|FV6{``T6gpT#Bm_jm;^FqYeP^7<;C6shI%%uiEaw%8~=
ziJ9djf5c?!LY=OLo>PrW>lTI1`*`r;xl>u%Q9pmBZ+MfE;~e~Ux&3TczWhhADO+*`
z)LB*wM5h#Y7afa!t;6MI7yRI>&JQ)#qrXyj*lp-Kl_kx6dkQDlxup{-pYv?FIYIKY
zcS-NmXHC}_ub&i~tS!rz5j~eddQF)^%Z^*(OYclD4&P;SMY-sQiFxKr{phD(KfZCS
zO04YZeENLL(ItG-j!9OyEH^!~#@6#(is6A&wX2Jd?YS1prkb&T=`^mAD#H&Aw;n30
zKl1XroAiNq=S&Snu|tM$o^O!m*x8V_Y)1E#*V|Ge&xS7xYGGBGVi?Y>z_ZoTs9+24
z^~s@o=Zkb{33mKe>P$>I)gBhZ+pyiF%lO@?uC4b?Lsb7avGqOio9{J$``YmH5&|Lm
zN|)Kof7)?ds@}Ep_i(gZcRebZaqYF8FNztGe}9dLf2~k1p=z>G;VXAt_kZ_Y4Q+3X
zZIAig$viH!U3)_9{_8!)XO(nADh(HOOq2Wc!#sNazq8)r_0_X`IwmhIeBpQeVU(}Z
z<B$iAcKt=x`$FdWC0F}1eR3ANCwtCZs_nSM{%7`48`A7&Kh(M2IgS6lM#f5yrIN8J
zKf)GQ<=s4e{mW_TU#&Jf=CLXJ)lPkv?(y=M>(&dZes%xsZY*;2s7$)abUvSbPUMqk
z3qAE`oiUM0vM64E|L0w!iD!x{bk{DMS@!p_-r2I1y@HDln)ThAd*}92<rDV0Ecw3c
zZ}$e=pIZ84HWT|S2eY;xZf`so!f(YHEYM2jY1tabe#2>%h)Lvxy*CP)Z!?vKUea%A
z%u3qqwa#%i(=68CD%?&hBIQr*a<!RWcji}$WXJOb6_2-MaT{lZ9*SRF&$vpQ>osG`
zughV6^7A#%xSZSUpY`kU=56g+=PEDFTpQpR-1h0ymmMz+w>?j<H8N$d4`Ps)U47=_
z^3_7IzQNap)b=m_>G|*6@h`>4^<=iO`%5$lf1De#ROFH5m*|%)Erve|rPM^drxhme
zcy#59+6zgs14}<;>U7_}!I)w;rFu!s+Ngf>uj&sTX0Lem;pL2Vdkr*BH0QoLv|{<}
zwkiBiGDL4HOnLYD`FBV4H=Ba><_B+=I&{P;Htf515pVc9zV#8eg}-VTWkfmc{Ux3x
zQSNonp-m__;8xjzwy$#kPARn|7rZOjt#MSvXpPsDg7)Pro|?uQth~1@>ePF$$<{lz
zCq9_|yNGxF3|VUibKSM`s;=B-|NH)vez#8KF2BpuSIgL$o|c^T^v|MM+ELLNTdlUX
z$6qznN;AnWlbLaF>8p;4gjW-0bGtf)S?JZ|F$UjTZ7o~CsPp0JyqcS0HSVSpKIY73
z`>XO_a6^fEEdPxr7Pq6qHlo+=B*mEgxWusf|MlwYfBJ&12$aY0bUQ154;N((ULtvD
z_bsiNx*Hzf{xBs-{<KAxO1gAcg{!rrjoIc0FWHvQv35JGb^Jn#e_QaICR?9nc_*i>
zsucFMOX(IWQeHKsK)Jj>e!=tOO<M0&+k57S3+<1uUhnzSaZ_I2Jma?O`+wM{tQM8K
zd+x^R9e?-E^JfloY3*n_>ZW?rV3)#|LS6>j3y!V*(U<dDKF&ziSrm2renMtNy7M`u
zpxqC*ExJ)Itp3|fJ(1DYEq$ep)T`ACk2~41Jz1bpH(&JW^MyN>NgkHybGBu=bHZ=^
z$#W;pAKCE4(m!}3|8I>2Vq4-ApRY(@oqw>a@H*Ek5h+EM?(8Vn=i9z5C}*zZwiQ~*
z^2sNLJ&V15N3eVB<OK<0j1f-z8h@RAvO|ASS*+Cjhe{dDo1^Efn!B}e)0AD076cu(
z%kOu(su3K=uyVh2rS$`rsJgpGuSB<$-nrWosCVm9_}W84yv0W|cG%U;IPFy$SK5El
zWs{X`>Y~W2r<PBeJU8HBxMo@8)CK-;{misB><e)$@hX{>=Ut`db~xf7Z;N%GhK2Xh
zn}MC}k=xnVuCe~ZX~y3Ez-89$l3&*=^-R~Ta9YB=Sj+R<vdD`IE;FwC6A-E3rzJT1
zyw!n{N^esKrH?|Z#UfqU9rbpUUlzWfZf(SH<mzd^lp>}jCyP_+zxq8}=@T+tRd<Qh
z4}lG9S1Is!d@Ma2H{spSUwq4-O`YCSx2l~XtwXLXOygVTirX(Qw6t{cwDoOdnCH1>
z*H?yV+n;p4E?p|XARQr+cW%|@HcLyDbpl*&FJ5k5VUoOPg_^T$O`4+Q^`vWewq|^9
z65PBxWFosvO|f0x^10nt+00)|c=(mGS7_hf{pU9AW-?-(IQv^VkDB0{oa2ewH)|q<
zd3I{-t$CU5xTX1ye(<I>_XH*ji1x0MzIr5ZZM^-*Pux?JzU=s9ZeH(r|DWKg8i%uw
zE{EPx*>CqVEyHNPfbN!83raPDO%^<LY&)DKH{bDU<_dNJb1|=Tx%vD2^!b`E%Id88
zZs@0(qP+GoU*Fuqu5S{?CT$--9?9aK9Q4R_fz;t1&KHIcF3$|B@hf0&%okX+S=amB
z)v2qa-fs``P>k-d+9S`<b|5lTT;tI5w4@-7-8RjyJQnV4S-0(@<@euSw}1M5%h+0*
zt#0|+{BPeiF%D5?-op>x9O9TzHKmA|Z#h%j=F{vFhZxpxTP62L@`AP0-`%@vrgfF)
z-!t-0eeo_R(kW;6HqDs)AoE8FN*_*K`FW#2`QxWopYGZpiN4~IetcK=El=a1$J@Wf
z?#|lQ^0%?>skqL+N;x&x##PH#72lekV)6XJ?O%@+cbo3`>|vNLFmd<UI_Y><W1*he
zj2vv%YZ{{&a(`yORG#u9%X)42>!{K@IvzqX=Bx6<S-X2|y0vsy>3Ve+MT$4S75TjX
zdWHVNT+v4bUnXom9C`Soa>d<}Z*ezPa+ugYc&A<?SyuOAKkuPkzaxGwcU-yWk{|o@
zYrTK}XxpUi(|9^L`H9smk#i!wVdtD@=q@!rz{7Fu%fDDtuNO1lUU8Y4*EHjG?~bf3
zt?_z={K|@(73MmA{j1XDxk0@un@73m*F2Yke{N@Y9>`G0m@hiTG_YP!hvUBMyo+i!
zAu44{^qA5lw;Z$0NtOHjwX(?|?D;kMbm0d|Gk=7d7G&o+beeMo7%G~1|NL|^k2f}S
zX--M!%4u&}4?o;nQ~KBT$MTNpL7&gRIhlG;_`oiuI?XSpkFLL;a(@21!s~6{)SGuR
ziFLC~C~TN}TItzUmZ#xY?pZE-cFtB?IaK$;-p96`N0;t$&zW%j<lFn^U%v}1`M#g~
z&5S7<j&FTj8kyJq`SN8^&9_;OJR2;ZUi2~l`ugQGmZx9tpZoXowfgn`ACpQ>E_zqe
z^8Njyo0iXGbDz)7iBwEEXfDr_QC<~WFg@g@(!yM~)sJo-C|I-fdCj8vF}#QUtyJrL
zs*7JvUw<M0tsx)lngy>-wk$F4uf4u7Mk*viA?9E9J)IlJTSIjgKD=;8CC=jcm(|Da
zTbeWMH13F)IB&w*!mpQKE?yX2J}quf+*afLl^<{1cfM>YzVhC`kK1-+?672MKk{(S
z>V4u$Qafe`t6z$WHT<<}cZ}WaPr7q=+)!)mYTEhe?t!1tPZ9%GFDVF_?%zK9vvE>{
z=;lZF*S9=g$ai(R^6Jeuw$!YgsVw_TvPvXlvxx4CM&mUXo=^W+R?8H)wC3?L^No`e
zFS-6axMPu~RA1}uU5sDutYg&3e_EsS+CCsCzQU`1CR4WhjEDEqt8%;7t1h*<)nR#i
z^P+H_lhfk3i_0BrI(iS9D&F@#?tZ57-DPuU{}XHzQ_ej98say1!s5pKi3iUr8cF={
zn$e>@seDq+lqEfd3oku1m2oWI!l<<Rg{S`+)0Bm!lf;<Me}45lan<DO&sF|B?>#on
ztfcPr;^j{#z3r8gSBb2xmyAzYSe)GSjO|2)qPy7g<qKGB)V3TFPu<#+nKCWJOJl12
zf?3k9EEX-}UR>!_G4It>>pVI24JKx@mdTXlaH_R7azx7nzf9#jwroz>Z-tp3a+m2n
zTe>1lO*Up~;uYJ9<tr8}|D|MlefiBThgO7dwXa;%u=3Fj{qW_p53RG&ntnrI+s@c4
zxtE?MnraJjM<?&HRDJYVSKaGMLeM_-RdMPet5@$hD0|p)AHVX+rl)J&K1bEw_9%W?
z>%42rzMakb-3D^2;wstnwPK3vrQf-)iaz#ZoyxnJCoc7O%uCAKr*pkZ^!OwWc7Y|k
zrmo3Txo)&D&!|XTefRbct4#mj|9R}bs``}$CKsc&R7x&?%n~&1-mV9ty?uLED&Fg|
zzu43xBza8F^W?)R{M&0yZ|xTS_$|@<UL22jtZ=xghQyxI<Gh>y=bzR5_e{b&c>7wr
zr~MBf?>JLyDqA{Z!OC8j=Tn$xiD_x>41242d`-%q8;5E-9i^+6UYSyr7rivuBR=?_
zz{ALh58FOmv`+pWf6&FiY~MdEhW&D9l1rtwcs3n8Sru|k*J%3>i7l@<Ug=!D-y;}v
zZgJf!jvtHvpJe;d5xdv*c9HG5YirpvL+ZCq{r8Bap=8<iWzW`yuXs4YXi509+5C6n
z#8xUE=(UyqkddXIn{oH3)z1lUXM|MsWU7`$Tw<TPXC;${=^@!$R^P*4STQn%wSQ5&
zztJr`YU^CZ7yGa8+@rj*Hr`@#^2&^tzHe?_+c|l;hK0wXxcP5fwXd#<?K!q|$G1AS
z(+7J0$|i;dFUVS?)c@?x3mfgynC)JL?`K?{c;f!lMrWCSuhds_8GM-<cv(-r@2kVh
z_fH<kzmdQ8B~T%&GDNv*uEX0sk2@>Y&*4u_JaH-Pjg_XEqHCItAp3(!)whni`L3!y
zV#M1s`()|al_@jkt#aPxus(U}v4=9I(~o3qbeeJIywGCP11i&Ww>^6AY&`d(aIuY;
zd+oG9s|V$LnHQI<>^?es)`44_>kWU_2cVqumUwf{O-BU=2K^=m1}U`dfW@Ur1x5K;
zsmUe9dIgnNL3;wtChh;d-eJ<~#Zx>=Ht)Ut_LpDv*{8{~w`a~0U%tEi`7a5t78Ns*
zm7fmxy?*}x?=xlwMxiMw>UZD1+S=zL)O_$vf<ZjP^wf=lfm?E3Et?Xka_Q_gjcmc^
zm4U}gqn=#7cu{D+=Oe4Ql)})HUiK+^zDG{mto<)F-Tjpx<MdT&`*gco*J#z6>V@Cl
zv1ZB7*x0AtTQ1nYF4cUjayI<ep+z_1UcSG&Yvtvhz(|pwi!{AwURQh^+j=KV`CDJz
zUd^sIKizj`yjt|6?e>ni^p`RA-`MJAom;={g7E^Cdo#TYclsDNztw*^t<Gpg0Q1e1
zqh7IHtE1v;XI@VY%zet_$zh+eQ&;s*sDEBc=o2wDd-IiR7KcXpADMso*U#gvcajcw
zRs`py%7uOm@;g#~<HWA=na?~6BV8SyCP_}6y=zL)!Tmaqb^l(J?YZal_>I#v;g9A!
zavUo^y$b#EuKu2l{al&OMt(zGrboKh0)x|pFXl9UH9EwnwB)4A8iv0?X+~@xCFEt7
zdVkb&S#j}l{(Sqtr%zw6w^Mx4B0Je?l6>~eaE-(^`P4x1ZYAri`EUE5`0n{3u>Ohh
zP9Mi-3oPwxZ=JcXFe_Cx&F#XW6?^}*L=>jw*=mNLWpnAspKmNODQ#hXsB-VcA4de1
zYt1TBoV>+GFf?}7>B`NWQ+Aww<+7ym?zRP;AB0aZ-Kh}Y=e7D5&#ZZ~*&7sY9Aiu0
z+PHJ3{)UH_ElxkGR6Bp}oO%-9p}S5E)<;vPJQMY(*7Sd|&UTS}N8;NZXUww`md;`R
z9&-CzlIm;43JuTm|FX@mq%vN4#hB`N(9zag+@+VZrhZbqWlhDdY2Ey;!SCNC-fOhe
ze=Ngd+HXE7Gt03iupud8O*wOn$ZX#^>Uz!&c~*BeAJ~_9>Z;tUrgKrto-S+7o~6G@
zZQ@0y37<Cjp0x7Ym}UN>V)xl~RtHx9ICQ{dvyD~lcd=#4K9drZnm#O7I_v&S?aUn)
zJyxyr8hYZdzc^j`v(9aWrN2jF(~F~Pc(1f>obiv7qgd;;@t?|b9*t}V+z+ja)VtiD
z#P+v!fn&4S)6-kxvX@Hz%imSY_&><LAzZR2Q1ozY@A1yXb7h_+=v-%0FVwjtps)Nt
z@Rti$$Tr2+%zZjW36C>soE=ibPVz;0eQjS+%c<_fzD}y-2y@}Ibwv}@6+gQ+p1$@o
zH=yL=W(8xv4G|`(@0cvDl2%rPt_j<e(laqOuw|A(m)q1c(}V*LADZi08dIBK>++{E
z_Q^Ggj|UC3#pD_EH@|9I|KL!@8@m+7!|Au<-z6KQZj)S--&y&^`+MW2lf@ywxOBzD
z=eT{)$e5A0{pzlaO)8UAFX?y}cYczRnW?D1d0Euu3fslZ7e6x>re;Jl6}tUXS3hti
zMeGkp(TgpX9F|Ny-3Ph0q?@)Z&Dz0pZw0&mk*)pH%oX&m$Hv`ZVLPYxPoi;)vg}D0
zu0l;V@8rqPK9o%Tr{td8Fw;~zB4as|oNVItw>w0#WqL0>zj;GVpDD2X_@jwGy#9DD
zemH3d>)L&D=Vp{FfAszN1rv_L1}`qP{HtVHBDgsF>W8#Dc3Wo`{@Fh1cBH_M8y05{
z$=ln_oB#J{QVQ$kO<|k6a%49ztN7trb=YUk<b5|Rp71<Yk(8Vvr}&!V;*O(Qjd^=L
z4&LYv{Zgzfof)RJ;gHmXWyV{A4wu*W29z)0Z8ZNnsk(0Z#Sc6sg6^elub;To>^M>%
zxOuC_*E8OSIRDApK5^rhFEZvgjkz_oC^+WC+$XQKmbe>#{2`zuUz<E<*2F)R-;~<6
zCa(GNF51EA_1&J*4VR9t+2p@PykuE#Zk(XNdEx%MUcFDYb;u-dQrIoC#WCSprMJrB
zjOdW9t3NE<`0m2tlkAU<p8o&u-OtX7u#OoqT87iRcdT5J$;z@+fAK~S?J2*a^k)0y
zr0mrbicolTt7)6Ub%BHf+jS;$-hMe-ZFTU19Z`O(F3in8qIK1qvzYfH$H((4WZqX8
zv7EZ#WXarbq*C2<C73hqsLVUp2S2Y&-lk~BuT~rw_qN6B-H|nWFGsIZlG}Cv#Wh{g
z#fR3dlyehYmGI1uz2Dj|;KipmdqkP$7@zsoo-?gXdVBH97Dt}j3|#XCcswplT`VZ+
zX2ShdM=p97d&cE;=^njyHZ%AVS6j@~eW$Ya^y+g)irND5zSpPyn^raP$%e9+ge@nR
zxSK21cBm}%aXa{Vlg_Eh49A#*b5xEe*WWj}x_7Z5*LK-6OPuYpO;Zo|9yEHm@1W#V
zy$YXcQx%j?_xn9tT=uN`?&<@FU38moEp95jF>eQ(<gR}Uj|PZ0+pdw-WiC2d;CX&Q
zWGMHszyoWX{O5%=WKRz<-*Kpaw*>Q|_lI10HkldR=rlela_mRtfjq@oieII!h#qIl
zSeqy@t$3?WKygV%3)`gyIZPo}@@|wkY+!0+IkfJ@$<&KaILpqd@a($edg;TuoF%qR
z>63U(E-aKeeu+h9o-&W!rIu}5#Cz2X-j`oUm@W~<RXK6hvv;2px1J4ZFk;<h|L*Lr
z{l_AeE2S(GL^ql=-n{x=_p{#91<hqyb>it4GMKwP(ko7fq@8qmpkz8%DCUFhlnq@L
z`*-!MZ#w6)?ZjKZr_&fR+P8@un0ZBZrLc5y`zMBjX~hvo1x0%lADXPV9u$z^^XJ1i
z(R&_k5z=J~_9{PQ4ZHeb`yYp3_w~wKo^_f2cyEw)A<F39hF8L&n~!SD;9jGy^TY7r
zu6=7}L_5xJkqdm;^55;*?AulLocz-z|Gb$ndwIrQ;W>^)_v0!)7;8A_X4*KVoPYDk
z=zN#O#a|P*UcRJpLM2x3VfO2f7m}}SaXVWqw&H$hLEX1h>97+|Q<wZ~zOQQ&W0ClB
z{&|lYX6HMzUn(}fu>A0DYjR0tGL!Z;AJNoZO6kG(ziM*Uu0Nm6y)603R@ob3Vi6U>
zA9$*}dFtMF6q|e5Ub4L@ru_HYsivPi6Knl9FWh>)ZrSEld!|iayF|lt(#g(ge=S!$
zoOn9ZyYH^SH1=PUd3-->Gp=&=T+Xy<dGos5%j?pnu{yHIZIExf_UGZ%dqVTdejf8E
zaqqO7{NhRDE5_BLS2u3_pEyswVZB<CM%=Xwm4?qDON)zw8@LpvXZx7%G!TDn5r1%!
zNq)jFuWN@Y6&<n{Nd253K7HYjZ8sKmPl-)@lE){r?!d>X2?@(0ud%i-yn7_{#=bMX
zT{|`E3--hxtd@~}dz?4YoV{c2pNQ!nnPk$>-%9v=f8V>yf8=iOxxabsm8pew4;I}M
zFN+CWI@O%<Sm=^U5qtF&PYZUoX|9=Mp`mho$D2n@*BH}&oLZ>#rJOfYBdL4t!fRQs
zd?{M)oBt{4&RWHME}Ny~MnRSIo&KAzPAv7&n&QpA|Ii_QZLulGd21K?T(zvZm(Y@I
zwKQ_sGnv`OCI{J`PrZLHHBM4=qu1*d8Lx5|H)nSHK6(=5k$zzM<aMhID=!L~1bR97
z3o<nK9pE`ySo7`2owxiPcKTX7S3B>wKQsBbljN;idIt9x+w&~`^fYmtVx4z+ri$&X
zRSb0oA%#1q9Z|U;B~h$-!CIwxlK_kDmIr@*lP>V{9+lvc`Rl^o5|s8fSN5r5XnCho
zPUDgj(^qWs?L4IQZoi&KfRSpUO3)1ZUGlef?MOWy+2EJkJj;59-}a1@)WTVh&rhyC
zKIi_tZIcVTPG#&mR(MtZ^@BZ!y;9;iYCN|uF7!Wo`NZ~@Vpp@7t_YhX*;-w=;3GPr
z{70<NBO!O)%a?lCrdF`Oi(&d&(BXOAs6O_}Czn0*{SyD}cfZ6GBVd=Ja?W$d!b@eB
z)s9PkcT{_?{zT-!o#|nZrXM`I;nkG_OV(FjC5t9ZdjEaGi@i4<{9(KDn9pLtzEjqX
zYz&XLKaXhGk|Pyy=dp_7DwQYaADs_5pB1LMdWJTGiDtJB<FCxi!6GWJ_xwA$L28}N
zsnhc^RfMiexhCBHu;1knb1G9Y|G~=gMQgiHFRW~v%q_>bA#{(C*h<qvM#YSC6%(Fl
zCAQv-h(CMbW6$f!`q$#0#H)O$|LR)z&2`RvWxie9A8N8pqR(mR&V8~haKpj3an={?
zn_k!6yRLaIt6cS>l8j)1!TaOalulfidu;me*Y4umCXch@=azpJT>h@qA|m>oTHwQ|
zWZUFL{@Y(Nc^(Zoykli|@RK)d*nDr_JCLtGZ-4c#+%IoGtDn!=q*;AnU5X^v)w^q>
zC#<%tI9N8nwy67>w~6k|DGD!Sv$+$*Dq}7DGpzd9-_#s%5|FZuUMb%)MUlT~&wI!9
zqEEIq>^Ww^?X3EG_o+k7jwa>e&7DHuxSIbfojV}1?!toyH^f_Af_N(R5=B;U?B@Eg
z$V0ef&&mWIhvuSL@twRn$3C)KE(opY{5s+EL<uQv?;}=vlM^SJoQ-Xsc}mS<%f`zY
zayec9_GnGqG5OE$rBm6rI!Cm-eBG|n&K<h<v9Rj|jSsHbq4O3kelN$!`k4D`{(?rs
z^_7fs#4`T)7*@6Mg@|tH5)X^G+GxzsuuNF?;FZ3sN#^|v<R9Nk))(7T|E{u0?9Fo_
zzivUhP)#NyrgoR_+coA3N|bF6n#F&M;epfdwvBvCCvKHp?ZJIiRjW&-L6WmJ@e1?b
z8BA}(%%eUu=<04bcZ0oq`qq@?{>oWTLuRvzN!>E*pPAbx{w*bd*UILdbE44~#|-wi
z=r>Cq>*`F5pFg4FjD6Q6myX*LgQn^=`O3W9v0o`QI4wd^>$R+v(63oRYvN{m6z^er
z)m9%KE<I!7%cQQx)tc)HEB?;TzI(ZM>3fEgp0lfFy!~>x`sC(K(#t=e^Y$03V6GD?
zS@!#?*;hlYDL<6|&a#!eEm*kpOx&~1KQBB3Dy{QQw*FP*4cjy?$t-12!HWxx`l~`t
zB~CGjOt^dL2mb~J1^w!e!7V?sTl_U|E;{terrYhWMzwShXFx@B;c@Q!vTaAtKU{bt
z?(%Im=e>s(+s_veF+CgI=Q8Ej{h3;?Se-u>cQ>qf`L)b3kh{5V(<*tHx8Iur`2x1R
zc&I#cwMgVu-sd~d+WB`B2o$f?THJl(Y-C)*ubG#>HP&fJe7_ahX~{HEZ|?mA*VgJJ
zvfZ2A*>Hz>(d1uw3rdBTl|9cpCekdk_s^=o7Ip@uw<UO21{^yg{im&c*R!XmZ^a1<
zM+QqZ{s=Yw>^sp!@;d+Ne#2?I-uCG1*PEkf7}{GMd?{6{-DyW(%=cx|%m2K&Sbk^I
zzAWAyycVfZ;&rn;e<}HG{B>q_(erf~bM~7Smu%OP_4~qeVf(9#({oxs|C@8TsYZ39
z^_C0&@|Fe5-ZhrZ+A%kdKl!!aHLciU^|E_iOSdPyR>)3eGdZToD79>^0<+VeCkr3V
zC^<BdOLP70Y2QytFF9yhe|Ku;Me*7^t!E7luigh1Yh0GfIapd~8M^tY?aZqY2GZB3
zNH4t=&&QU$I4@JE&PTJwKcg&Sp_b0&%M5%zUs*eDifLI$S^xNI(*ExE_T{EF(|n^Q
zPHg&Cv*ggll}~#vJN-%aFMF%v*B;4W5*x=F_Vv87;Gg@ZhxdJ4lDp65yK18EYj00Z
zuP-;Bv2uj2VNz*{tYNG<kaaa+&LrvSB0D6?9t2h=Tn$RvC7c?Os%@}0&1>S#6mKWS
zbq=A;r!5+HPSCR}X;^5n+%mNz%P8n}!onY%#cC4Q*|+B|GSgbOl<$MUEoMat<zFqz
z>PAsQw+cVbi+y(WJO2@Gsho+)wT<obgxA$9sR%qe<={bvP@^wSk!`7>RSMhr%I5^1
zvp6a->*FrQqCHN+jvqCTp5o+5O?8>>wfuIC#r7pnN=&lyre=GkuwF|{D*kWx)P3q|
z-G9!Hzb^kRcY$N+g%x27<{8)oNQ6I@*!)PU{=nQ`)hyBVeYI<nH^c~SIv66AEAAn#
z;XLP<|Hh=1M|7kjdJ8QV&PkdS*1b&WQ{b(u$9I*+=C7XoI9cM}u9=VRT9UnL&dxUR
z{_*;wnA)3<^8Y^UUN5&rVDYE;{r`TwKEA*H&sX{1JJxMnBKPcXk#p<ogUUamWG`QR
z+^+tm`TDC@Gp6@HZg=G85LnF5te++DXYc)j_63X08yFt$?p<7c{MC(ZQZ~XY_T}58
zZb_)V=6bAE)8?`C^4;~B-Z!M;^*eU#Ub8ywzuL+N9=g#B)E$Z?)fx9R$MN2i`(NuW
zbEd2R+v3P0hWmH#6o2H<&~s)**_(e(F3ya*McSoXA9Ze$zS+3wg@Tq!$lTnIe6Kd=
zG0ZF1o@}dqZHmT&Bq`BZn`EB)tG`cQ_<~RA+v~+qT}LgK`t@82S#|YFK*2keKv$6m
zC$j4p9$PsW{y8NYq;;z+U7|rKPh2YXuGXetM;)~@M_z35u3xh@*!AzKElabfC&r3o
zq{}L%2)jp1?rrIcj4OFLMQB3(k2@Eh-3d7JeU@M3g}ke0D-I;?e$8{c_YT7g$Bbsj
zk9Rk2S!hwQ{iws&_T@L6+g%G1lQj0Y?A&=+=ybvAFHW~!J~W%##;X4Jui@*f0R>_&
zCW`+Rs`j7L^*FGS@$?~8)<ppuub-P%@yABt{}N5jW=1tbDehJKxJ5%^UK=g)Ts~9t
z@xh%nGY@TFy~xp8|A5g??wO*|MQ<B~Z1=WXhL|W8Uz$~U?)kKmH?hU@ygRJ_H#~YR
zD*ih~au-|o=@c`8ZEv}yID6&i9o1VjUEJhXOZ=~8S=_=0UA7<nV&K5O@W#}V{F^1E
zhC3F%D>&JuHbZE32gkfT{+@%Hg^r??JC-{<ZMg8>KYQoHDyd`z%Nfz1omSrWc${>a
z@7ayJw~de8oZVdbsPo>+2DT^m?_&a%gjGG?b~(}GPRxoEhdxbCeb*3MHznRl>dn2=
z*VhT{&1jul=B4ehHaYG+&xM36rfj|43p3wt68!yn+l)_>cxSsM_r6=THGRoxt6r0)
zji1xL*$H2l%3ayu{&m8ZMV!JVGhgV;`gW}2V_e0IGHVu@W4Yg)nN3SM3?i<5JM1KB
z!y>V2)7=XVrSFv9J^UNo_j1MEs4z==SJguKHZz5K;X@nKPxl(nO1PxR!FG-J%7OI2
ziM7?ID_tI#HYXb>X0o3Oa4S8*Q@m<BpO@Enzig>{hi{AbR%da&=(+JQ`P*9kYk~pS
z*b;uPO8t6!y5_!`37YPW?yr}u+^19L^y{3tnzwDXS9dmdv-Fn@Wv{buzcu)?)#1ge
zJu?-1{rBk@SIVFJ_g2BmxaNRU%C_KlvNz_6OYhZQcQ?O$ddmyh*L+qx7939gT9+Vs
zQ1>)D-}*_>pE5JsS2w)-m~~j{z#~KXiyf;X^QRj&t+A}QJimH=O3ao$V&R+Y8t$)3
z^El7lsv(z<QdT)_by@6<U%W-@BvuJW%ubtjwEWk*o8RsC+|E3g_{l8gh?uLA?LGbj
zTedmfsbA$G8FQZ{%SEVp@y{>fkwGu^i0x^1kGbFS-T5A`;V%7m#gPKjdi>_tm2<7r
zEfG_5mNZb}lRdko{Qr%AWpNkpKI*J#=U!LcaDUxl^`6IGZk?OVGt{};+%-&<i?_yh
zpVt)1yek@4{!u#a{2%T#&7IfW)cz_fX>2lET>Mk#=;hlBZS(s7NOHBkWah43xAC1?
z&L^F-_9Y54oaZ`JCMOD13hv@O_gL9K{+(e5-yU80*)HW(%-K_Q-*0NwG&V4(Pi#$8
z`7WdR%Cc6j{7vKUJ^wFF__S~Pl|$T8!rR{P{aBpW9#F6Tu5Q{4wQIYwA|AJ1)-|(u
zlhK~LhWCW?%5&<TGA>`gU2N{SXZKHA@b0SzlRNGm`WfSLJz8yH@Ye6b-c|=*2fpH%
zyZG$3eOcPyoC>*&12$b^nR|_Kd#|_6OKtD^hq)74y~Hkbp3Zq1bktOwNo|I8Xz6Ws
znczhxNps?Ra~L@;M@`$YsoXp8>+yI~u5W$3sc)8Q$eD139pJt*^`WNJyWp>l6@UL)
z+d1k!ztFOw&*!kuhyBGut70W?Wu5S?IqK(7y4BHg<05r8jwxP^Zhc*^Z!_|LnVB22
z?!fZ%2^@Kg^hC1K*Pp9O$mNhdvTJ+v`>zugMlZINtC(=^?}iU4k}+aCt_JekK5@=}
zu%DGfNsQ&p`jEV5$-cr8{qt^LD0uOu_3KpDz^PR#uEyurF?0u6RZsq#aqvm_-16uD
z6+hqOzifT~``ORi{yM0Jn>%=w9l9_hBTXj3{L8XCj@*APT=}%fIOXx(F21a^x_YnA
z7au>K5b0<r%j5sdaPGrEjj3fuSD5d-SQ)y%^XB4v2Nvd5{7||*?QLeR?Bk2|N^5Ih
zOq~AdSi!4XN8a{c&+4{MbIkm`>(UNko9X^XR!j6N9yYjHvTB!u)J3<W1{)?tMZb=C
z8GYl#zQZfZk5%;Kw@4Idc(Y%A^se)q&Hnnlpq^ii^L)iawyo&T7WejJ*|AMgmPL9(
z#GC^QZr3fl+_i1(^c~{+@{(*;vZm-{YkVx<Z4_%4Rqb)&zSldkpHA79^S}4}(q%ro
z|G$Gxv>o5KOj#AaFWI}3?lqTgU%Qd{RrZX_1;KM2(!@?W$nLtXz2trWtsoZ0Ya0S5
z${60BmSwl-?Ayl&wBmY`j-UDeM<b{+QRm!=$|K&-w>t*T=ka6jdjGv!&34cED&;pK
zNvRcFdlcihc&_d`U*zU$_^Rn~#LE4=8l3m;zb?CQ%VT%1+#ic6uYYbYsZ5v>YiJ?A
z`&m)7&hImaI{0>e>znU%WbMl{Y?G#&N=2S8{AKoi4f9v_7s(2Vb3Jc=)zW^p_`$=&
zkJ}IKFxK#PoO?`spO0MVwA&$HSE!aQ*s+P>P5a&FFMN864u%|Y+QRoJc)CinUqjo*
z^Qp~8dEaoI-?us_ZPrvav6$vonP2O=r<MKfoEEY*@70N08yT%`xJaLz&A(#XPj}bj
zLcTlPOtr3Py4K2`6FD|{!cPX%)~`nx<U5KlR!conS-9)H68pzX`RzC6ZCP($c)#$H
zq0hDoww;+4hh8!K%@Urmfx$j+Q&rp6Gj?igQn$@zwcvkwMApuK_3E78u@_eR<$SPS
zpwHZu<fq*!r%^Sn!oqN#cd}&^i-1goow)Go10R^y{Ym&!dcUer*=^Nh;WNyA?HB%Z
zu2%h&W^DStWa9)kDZdqqB_$NBPkh$>VJCg(!ur^Z!~+*6PFdjT_NJ;{^51Rw!}`Y`
zDm;84a&V=c>jkGa6YU*OLzWtFYbn^Du#%l=)N@0)=(LGRfVk?s(|5zHLsIm!BsZUr
zH?g=Ic}^$8pht%J`Q`@?^>X6B-iZ4unYm#pYrs=`PTR7WAG!_+>$b0FNeZq_5aFtP
zDp|}d)!B4YEY)Dr9`)_M{;OHzWGCd@`15;x!`bGTWxp=_r><-5wDL65Oj*iwzQ}pe
z_5+Jg=&*>o)%9Mw_u0Eij#tNj;-NiKH~SxLd|_;7XTQbosn4@}(<+R%-Ca~3WVSu%
zS3z~jlKwY~Rt4HT=eqny>Tl<bOFPdis6Pl_;k?nTD!r-7pW$78mBK35nR(e(cVEWu
ztFHU?_x0uN{{0_y`W|y>%=W$AzB*YsPi$^P9^V|XwIMH+%T5POp0U3F)s}NlbOLtD
zTyqe8;WM=^$Y%4A%~KvYB*vtsRc_iY_Rz1DrQ1{cdh?-dzsO6MPJ2Ii+wxsETrmD%
zQ<C5Eqq)bTLl`=a^gE_@bvp}oxHn(C^<XB;#mEnyf-AkQ#jN7hY*DPZ_*$YrTgTb(
z&>fpuuMTexmOt~^bMs}D_q&@FkBj;n23>uvvaoRNce$^Ee|Gy``xxiAiA%|PvB~qw
zH_PAune6F(mHR?!^lRG-(?h>pSm*eEC-=8(9e&MeDz?8`CM{ZPpkH!v&sGD;V@l>%
zIX{}T{_Eqp!tpMBVV|sonB95pO}sk34If2r#WWjpowv$4f7(4c?R$yLtfhaMdgA8a
zIJ(TEV*jtXRtpbozV*3nY3r*U$29XrUuD_co7b`2Fms94L=)BP8c$A_v>trEUtZW$
z==aPOT4qslLAk9V()yvftacC2hVn$tui88Ffp+4f?j0uH6C9QoUhfI%znEw1mMYG~
z{P*z}lgn4utjnKY|NY6+*Xif)^L@{sXZ!cz+1cCA`}=?2oHIjp^XAXdg}xt?>@RD~
z%Zd0Fmip2`<@P3~*-?d&%TG(JeSTiC;jXEle6CmH;sfg&cSqfFoKqb1#PRdZ>k`NI
zvV6`ghz#BMD!TMr$nou&)jB0I>9WT+crRn#>2~JB?4=UF%jHZ@HZWJ@92MbNy}!G7
z$s|`p^@=~MKTJQgYrE1{;jUHXi&y9EE1s}j;@h6k{N?{FUOJSwZ@j`8Bm45Z#Lu`b
zu4Yz0zMOK|{&}&LMLg3iiQ1g{<FA_fDqd@Jag~2-`YrOZkU!B#*4M?My2bgH{u`Mi
zDeY6|OZL8elaM>Ph~aqQuPgK3MC^B4BD{X1a{a0GkFGBbwCb!n(amwcoh5sL>@?;m
z#lp6@@;7}vi?wz}Kk9hv9CQ0cXq;g0-e{xzr{89XUh$Y)CbzTPJ=x^w9Es-noIl<u
z@W;%sRSUTE)K6!D73c0>d;H7m3f1_6_s`2^&w3@=VBp&Dta6d9-t%7JWwWmD<ym0x
zAwGJdr*&@f-pw}>P6)P2F4xg`bvpF$pGlKrKFq$VwdU@Pkcw+Jg9<j5zH2_cd`)TG
zzExEVwok|`kU1&8^5v0_whoKR&ZVq-8)u=hqOX58%j4qe44#HVKhk@eGtcWMZMz(?
z)hypvW8>t~{=(vkzoU#!1w4+swnut}$n~##Kcy|Y|7f#*)XJ8_dyGT(8oWE1I_KIK
zKdUPFxmDJ4>L$&R`W|}pEpuex1Er;Ld*mM7_IYvQ6G#3E&E@%v^0wwZlCN`ERlX{D
z%EIr9N*A-u6;G1>`6^(CeqhwJAAYCo_TREwByq&~VxUsp)5w_X%d+phT%LF6&XJDp
zmvQm=h8M!!)SAzh95Ua}m{GU?F-LrbmxQL`o5Wj8Iq{JvJXhHkU$06{lnDP(cKplY
zz24KN8HBKXNj=ix+mdB_@vd)6^L{b5IbH|MtCq*ja-UVK{5N%x)dBW9)27;Kh}ZAf
z9&zZ)U%#js@ipN$Wz8$+USc%;;&yK0wDqAqr74Ts|5QcJes}J)Ywyjc>09>Qe!OL0
z;>M`>qRO>e+#Wn<qi0^tZn~l;Q`h)qh3p@f{^C2+UR_xHd{;g1)hMeES9;B5x>dHz
zxJN$}d?cQtoIO43<Z<DpuWALi#aHe0J6OEQ>)i@2mC4?AJK1s`>BJT!nrn!>mOWUp
zqcGv#yVZr+H@&!Tq{ck*4s(}Q-`BP1zS$47g$GlYf7f@9W?-0A#K<6ww(y`NwYWsD
zpz`Y8+WOmOn>7CHw`a}1|2HrzMa^&f?Q7d#$z3muny<EP{o9;s`Qz<NRZgTSPt?*p
z`t9S#^8KHg8Y&j6Sih`%cQr4$lZCCB(LjRdS*o^`b>-LF-)7fnbVcRJ_qiCJKfZHC
z+2XyCW_!eL>rWP!j=orDxqJ1e)vqhRd^&p0e%r(O`HMbh3+@#yjdW4|80d5Arihk%
z@kC$q1;^q{^iOmC5f1HUns@E9)v4}`S)%0^HRStUTbJf<+HG}HBK)a|*X55%`&PKj
za{E~l7WP>~yQ^s4+0UC+nD02FGdte@Q=?V^ll{-58|L^Nnb5Ury7I^8PAj$_jk$BK
zch=V=v(+xKtG{pFy=>Nuhxv8JddqIsRIH6VHD8+R;H#`@p<6HPf4w_t#`IUuHD-5L
z+Ff1mx^c#;_w@{SuYBJWc0cXshr=$@=lgE@xnoVqTrF+4)X(12SASluH2Xz-_rWz<
z?KdpHKB-d5``T~)_s)^rI`h-r+AkbS*2(F1)kO5Md{GMS&s#p(<&3uCq~^{85AE9D
zM|hrj%Awj7((Gy{X?fn|qv85fOxjlY%O-#FvXh!7x^-pTMUmgrS7b@t*<R_(Tu@*w
zVl4Ak&S!=FDXqUJ-oKu*Jd9f-l1ngbeTZ*la#ye9=OxZ-rO(QSE6>=u*x2yB>vE;p
z4@B-P?!11x<IsF<L;w6wPD{R;HXPBs)BR85vr_BJ;O~p7%uYUkwR?ts+RNio99OyW
zRGuxGrL<@Ere6xHN+R^SD#Obb%!%xNFr)6D(vuRugtVB@n<4w{cd#ZHRQmncsbhMg
zP2R;YsJ`@Nam3MpqPRmvuP?4Q4t#o3Wqsz<yqqVGU)Wgwzpu{z^51#(-}`0c{%-NU
zyTJW<wfgc!aX!xi<-PW5FF5AP!|z|f8Oqtz9bJ7^e(?{-(5Y9IPo0+h(jlcj`HkVx
z`=at)pO#fHD}U~YvQPWDB<9TH)4VCO>}B_MZ#ufi<yz+(AvX3KA_eDordb;tS2`pr
zIrZ_2+4)LR+9x9tbMJONWU6C4&gu|6k@520a|wye(~mhFU_Es-MTFNSr2a&@v7wjQ
zf}LO9Og}vN%a;d#?!LVE@8fD_iP`!4DrL0p*M5%(Id&n_uq)xZ27`P;;U5{v3%p`1
z5|zF-yVfj}d87Da)<;_lTU)!Wg8$xGyZm?{wz_xm`bB>$O>f@oXAEVC>0Efio@vVL
znmS(TfJg>LmNy)Wd$(8bU;6v`^89a%$HF-tO_ezOg7L91Yl)t;4@=RWjEcFTHw8EX
zjx)UTy5rVhRKxtw#%0dJ_+X~~`=7WN&T1)0Tx}29aGv4tW6@9VUNCID_xs~n$6vQ^
zo4?$>`0(HP{^!dQ9rv7k{gZXgyrVfvdJC%fJL@Vrcf?-Ed9`Op?Z-vp2lwAEtN!xZ
z{nu9gdf5l-=U)HwdiM1nuW#=!uU_?T`~L&#_fLLbAHP>AVtu^q3ib8z!Yn_2@2cjk
zwa|JVIPsv??umP3GPq~E8=cL2dQRZ)h2v`R2im7sdcPOCQQg>EqW5Lh3x#Ey4$5Xt
zET~vHZ|{@zw4dv*>|Q_XQ+@dPfA6OMkJ|ftm*#)|uW#h*e&%1<oj>c-{Z;Are?8qF
z{C;2dsrM_>tLuKsU)?P~`_u1NH}}Q=n_BgKm1g~dd9pvA#?NNfIQ@Rl1(&*mk8gcV
zQ{V}x+ExDL@<GXSTM9+*^RHihZpogPb~%@?XAAt^#cz1FvgTg*3r?<L-N&_(Sx<Pb
z>1+w$yfJmTam4?*JBkI}&o8p@D=>evMfuv%py_va?A}=T>)jh0Tl<Fkn2gXr@<*br
z{{LCDD0bOx&wX#)-V6VUZ@K@UongVR^?l!OJ2>pDFI$|e^Z)#d{kz^<3#V|*{k}N;
z?)R1h$2@u(Eg!boY30A-6Zxko#nAsmv_UC)qAx2$*rjNu?liq+bMu&v2!}5BW>w|S
zJ@tKY#G#&2<-@zRE1qprT>U62BsZW`k9TXLM4fF->A&J%V%sEdG&9cp{iAe`^xikF
zAJ2a%XaDz4t6o0!)4_><cDL8dbFfA{H~*PYcXws^;;J}7xdT%~q>A+G9qkLNcnX8A
z?5>KscOcri%f}_Gc}ei|$caXG62qrYeK7B<viRTb+1{J)$4tm<QJ!~A*kW&qLqpbt
zFE=zEe=(e`lMwxC@q>92?p*Dhf4qmeV0)*ARm>9U+Kc^hX0j_c?GcN*<Ns~dYF5wv
z<;IRh9_f=`xh@tuaCjlBzl@3AhSG=eH!eTgY~KEx{e1tuy}mDRNABUg%-MK;_3mX$
z7cF|HFsWg?%k!k?lO~F&bh!OLwEW5k<$#{q%L>a~brO@0_5Sq=;T1Gtx_|gYozf4E
zZ|`gPcCWwKb3fH$L%`&+>G3svdct<6t5)Bx%gN6@v9NEK?w<vozkifX;9z=Eko?WV
zODjzw`sGVEvkGqU-3mdCGp6>smF%0WdmxhentNNX|0|*Un?#xyiFst65L9ncnYMO?
zT-eVZ|M&kNzdd;K<HegV{}soaKmR)0aAuBq>+9!Rv>2mSNxurXzAASAbREXaRklnk
zeT)Lcx_t%aR#Z#3@QFx0mXoPJCb{OnU59=_nrLmzqqUdJ9+<yA?%w^<Aw*-963?U?
z9wAc~rJFTu?w#^@(GJltpWEJBH4@Axdc1M#aFy(Rz|eANUK>lgPfk`~=ejwZx__BI
z2BZ`(j<)`>b>8>nzt2AIJyKk|)>J>}#k$E)XNagOI5*8}Jexg3)?m4j)q`)3tN6Zn
zJ-?cCle2weW$2|-6BI;OGA?wwT+iwhzPPcU^Kx6fE#vCom0eA-oP8e!4@CAJF`IXT
z*C(lU#u1gL-?gLMY#XCu12m<cC`8|vH0G2mo31?Bd3A%3?9mPH<z1y~*C?&+Xnpbg
z!pdjKy^Q?(&WnA1UXapiuiasO@^z(j*QdL}#{|xM27VKqCcbuO>9R|{Qx7(7H!5&!
zTO5#i?^2NQ7ej4>iK4l(>Vj*OC#`1rzDC=Eqi@>hhFaU1d2YO}*RJS#`nXxj6gRe%
zcbqP0VGgs(&a-TN<!WcX{PNLM<LPaak9sT#S!CA6^E*!ASg>LH!xg_i-rRlobMw^4
z<uN|*c&d1hEYVrlp?Tu!#Kln!v!c&#y7jS5_w(mRYb|a)KU8D4Xl9y1J>TW{h3oI#
z<WA}F&WQElWa&6^;H8#8o!bx5Yr5|qA7NI1dUaK+b5&1n<06h}|75HWKU;sDsl#=3
z+kxA&i_T=^>bYhsbUplPvf8djtYyN@%nprb2MTqiFS>c{Nww5#c&D)Xtffa2lTF;s
z5B(bT7hm%8`v)jX9X2eftgio{7NE22cF<}4Gl`tq?GG3DHc8K&bH3ir_C|Fn8~dxT
zsonEWOYhssxMb5w7ayg&7JZKw#Th=dH@YV8YO3-2z_zcNOl+U+Om{xDY1iB>vd~^~
zp}qJ{j+{V$hv!SQ+_@)wQg@irQSN?Jtiol}$s(b%lFC!=F8K9L<ig2BM)Tj7DuU9A
z)7hh4m9M3z1v2+8lhUof8Pq?o<2Fz0kJLx{^Obct`64;Lq|M_OpS<Rf^Lvfwui0OG
zk2P7!eYo<QqYksR>Q{Y*<}Z_0B@1l)=#X~mn$TU*PbRSow!HcL=`Po-zg2Vj*DpOL
zqrJv-|Mrc4%uex~i~Hiy=_K2m5qfshuCU@2^Ewspo$lk<?02^};X;C{*Rq`=<`&ku
zi=|E<$z=~c=_6J#ch&XRpPIMd%(aX4S?o05l7lHJI-Ys`g5M1~hyDh>H}x!G+tkug
zHfjB2aqSbH?h*MCoV(qgCck^IE-y8d{ai+V$YhBNW?RIA{x{BX@pG>ex%hjT^!;@&
z+UD@F{(E~oew|p)i*<UlT{NUuzit1<UOK~jk#9{~zuD9)E7co!HJ;evmwz+r-V^Uf
z_8T6oV-51#qS%nCc{XFB+toF@cGf8~*0>*;`yi(xo!NEKB)P^T&0EeLI~3wzwu?#N
z@uE7B<4e+Z-nh3@#q`B*r9PGog}<I<&*sQj{x0#Y-JkT#nfEqs`m|s{eQvJsswb~n
z^4eH<@@&t1ba2}w$fF-O_1fe$`<`Vh3YJfvXwY3YJ;7n`QtiYjx4Au4x4YSV*FSu}
zF6`pMQzrwIHgaVo?31flZyX#uWucoa=U1Lpfv=SvWTV!lp8gSBCp%5Jf=h$_<BGj)
z8?wHrhTaY+=~m8Jbu8>@kK$kb)$L2WW^$UGTP-#9l<XS$+~S>iU;b2n338sSTM)>Q
zt$FA{W6gSp0!!Ae-KUop)?BKbdF^w~z7^IV1m?3?tq#fD-<2^#^rK99%Zu-u{OW9L
zYRi6HzIbnTbGU4nk2>#*ckhq5OsEe}nsoN42a~iuSLSM_rVR`ai)Sc0Bz<Y=I?^xh
zo_wM4*Rhw2b_gw2v6|zZ5F_$FmAi22Maj8SFB&*;1YX^H^3@AxyO{<Te4=_?LXTbg
zQ5xpa(2`#!?DX{eY@PY#yY{PJythQJ`r<<g#)V=62QE&`s8e?EQdrH&EW;7Pox#mk
zt=Gz*5*#D=%jBee2j~3Q(@ZTcS5|nf<UA?TE9S(gEq$glKb>_=tkpAtO$SWN<Lac(
zs&&sgdD69VzSor_Q<-IJ^Iz3$)X2&Fn-RV5TE5P|g<YRi`49V_d%>?G-*nOU!`gKl
zU7B;5yA!pZvhu{)b=?g$?VG)E^4wj|ugU%3Zm8%m-y`>JqTD?x+2d*#-=$`T#s@n&
z-gHx7Jo@)mN`zCB>fP%n%9?I0;<)0~mDj`d;q&A0<0|+6oeIyE{#yF$dDFB{m7DmZ
z1-qt+i*GpR7<RaxvDec~wrA6eGV@(`C-|J(^FH~EsLUJdsBqOU-Id)McFT(Q)FoXD
zDt*AXt-Qm_B**`*pJ4UTF#X&-<=<=d-1N=f%m4b$e=+S)xaVAc+q-qolec@zwxr7k
z%Cv9O`#7t}!tteGZq}BMlafzg3FZ2}tL@YOwqu!`IsqoL9-sPsV8N-*3ie69?f2v!
zEO?hE@mlK0F6{)l1H#Hj546Q}bM3YK_i}l2@Gd12t&>7KK8Ty1&$!a@XeZ0PLyNn(
z<mKkd&w2NDzWhJ#^_k_<92x8if}d(Ezo_`ZQl4Sup_@NfKQ4dH@E~=^WDmt{UY~wf
z6cv2wTJN9ybL#V_FLy6i{uxvE^!f4q4;DX;|8f22!`sYxR@34iFN<IP-tR^4zk}~D
zNVJDB{duas{yX3O2f}|&`}5UVTi&p@uUL9-#{Qj0b}N5<lk%Qt{nzB*oh{96CM*p5
zJ?_+5S=rfExX$<(ep2WkuXwy2OXKfdPhxq}tz=|BoV&75+$`<Gx%-7jHgxnh?AbkO
z`<<ule!6PO&!^pHXwEOpyKmk+Rp$RC<70Y;ogWe$<x>``H@I7bF&A;HO|SZJOSO9O
z7GEamY8gi9T!G%=8}io=&5fASyMNC5FzupsQg0hPCVbkqNv+fBb<h!s#0iH^Y5n(i
z^ksOSl@ew0%ja8{RXyt@qZ5kHwlyf(PVs-jQTEohc!|~lA61R1Q`UY^R@=0x+i;zh
zbnLvxYmGBQSC=d7pJHBjxYM#>bwf<3f}x~A*2YDL5;h6EV|eML;hueI@l#DHJMT-Y
zC*D}<xb3@4TdT+cU2aK+H=Doe{bPRp{h?ymY<`;;!SbFb-nhmz$ZOVJ;5|Fv#lL0Q
z+`L7BA^Eaj+MkwiIhAznioDVO#iUf=dDyd<1(}-v9=6Lb+L4{paq7b)?a$68U*617
zcULg)$w)VA<Js0crEhhK)`kASS?NY*O+3+|R{lqIW!NKoTqPame)N2D!=PY7*@D~*
zAIGNi>sZ#xZkF=9qq>6s!=t-LW}kb+azyS+Y%-?}Q@Lr7CSTgDZ9M&kE{}iAbL%K{
zuI#Ow_+ggA(wb{8XZ=mq?r;}6y5UId>Q!<fD*~qY7%<P-B9q6g%6p<W>*ejehm|Kq
zzPNrbJE3bymAYZeyua`FZqL8*YD(Qaxh3{Y`x6TfZt^%>+4$>;{=Mt*iv(w1QBLR$
zZ(q*tWwYs3$-kZ4OYi3=PVL_O>(is@{L{tTe?C2W^3A8eH>dwEEwtOe$3jnEKd$#h
z{`bEQPVfI+Zm9p1_WlIx-sWp1bGyZF-;cF>{b=SrCzYA0#aq<#6Hdh4e!*C`BenE@
zWZjFT!~gGu3Oo$|K7Vfa{~Nph6v@8$Z)IU?ZS!qHi|abyzozSab(hpumF+8kmHcgA
z-L<>-?)mL2={{WcN~~>DP7H^KcJ`dYoeXiUXBua)g)Ee2tuj|w{9Hs|^UU!bN7h_z
zy~A-{amDjn8OxTMZMiJtX+Lv8<lLP8`3qW?70BO9z3jQ_*^Y|}w~o(z8)#|qZb3cY
zs_Q=vFn^MtSC)~NFY#IK`OnjB>66t=QdLcJt)8+!>#%j1Bj&mOq0`=u{QOV-haMa3
zUHYee$C>KxqjS{lJDo1*Ra|@(|6sR(gY%lWWA*yH-%c(M`m@+FxWU*-@bPr5&QINu
z9U_xv9s1G8wCnw;zBPflS<hB=f0_OMB-2?wo|2e~2G_8&*&!U|KXe{)C~jiv@eL^2
zd-`a~k=bUs1_nj8D?`2=(Of+Ju7bg{Ki9N{ru3|PD9GveYGeP|su>pSa<3#O?{VD_
z-B>1&8m?D-;qlxo8E@XUi+j&j|NWa7T-f#1ntl1Hf_5fZ#S2eb({$W^>4q!6oL*@7
z_M!77j|W8;wNKS1TECN6-7LMZI(ttNi|1^|Xq82?kM^H%FVbW-a*LRvvzqzxq)w-;
zX4jgUyN@*{AKG9!S;aXntF`Cy->bIfzj+FncrV*}ZrClIEwbd_4xXv^Oq?as+FvKk
z?^pelE7N{qV)Qv<)x#_JL*HJWzhu)9)2}zXJhn*soO;M!c0lvuJ$30t*F1X`<?v`s
zs@gtp_n+=r)1-ap*GnD>p3wZ!)8(CuJ;Sc}R!gZYW61@o3@T52U-a}|K4QWXc-iZ1
z506};zJ7kr;Z<V)qZZG)H+6YIj*j@|bAA%Je^_QjaG%?<^f!-{iOh|?-x>{$s!raL
z$h9r;Q^&azH*?;V>urpZ%4d{FcyYF7ndstostJ1KD<Xdc8GWC;Tr#;qe%D5OhwNSk
z8JiDsDkf}l6PHYz6)@q<$w>^`oNn(|Y5004N_EGxsO#<(u`4PYtc9W<t%&D5b>vHj
z9`DDE%G&FvxGZt}v#3FqzbrVDOHq=m@pv24mun{9mlki?!QJn#oLcP@Fx~KJ-t&W-
zGuks$roTL`XB3mNZBO@O)`HLLQoAgi{+R53TXDYH@37s94>L?={7c{oTKp!W*x-g!
zW3R)M{zD<R+Dz26Pd(U>T63scQC3mP%-t!eldazDpSDfz+kU3+q1%`5|9|(#ztY<Q
zH&$=GIazN1st*BwIag=hZA@Ie>UGcG*vvPX-`G#cPs{n3JkR8;<ZfXF;fY<Q2^ASx
zS*tFmF9<)&m2p35ZPKd;o3H&m)_7^bm*&dXx4(V#T*XqoYjNh1Y7zG726FSw9Oo^z
zd)vHGYU9?ztRIbYW-MX2%JS-UzU`ycfBOy#Ha6TnzQ+3I_kDk|=SKcIJBvp-`-`}?
zZQW7NqqmgB=U!YBbXITnzmN-;KCrY`s%{Ee{M936yM|cz%5P0~k4@ZtQ?4mDQ6Nuy
z_QXXm#W%cNdpb8{b&>iEy#>9DUjO`N>wYerx#U*H%&<a*?<OB=UneG{vd;?OlvL=8
zTg~t~aLwfmr<MJw(zU`T!>%?LFN@mXX5Hlc-DWqhj3wuamEYZpzMo+<of0m0Ejq=k
z{a@ivmmQyT|0W-ZSF~Z@m??Ivswg*tElc8-_}{NB3aral{`{-%;s5x@9-YM-cTD^?
zAw%}&#Y1mv89q4c?_$!rciV%7UozX*SD4@E{eNzONHe)<EvwlQd4ENJ-4`FZcIox?
zVw*kfj#TD$Y}|Uic>86y#MomlFCGTFKhBN2e(K1-%}J><_UutSJU4c2s+7Oj*V5wJ
z^wq65Ts%aVmTH#<UXKjz*mbWriRG8^|E}xIiE%<L55KGk|Mc+Xq6prKptz-9lRi|O
zIHlM4Zu8mG7fNTvT%58iF?PLl@3(2X9Cp2z4tr`&owwGtH}a#@4XyJ%e#V}=&gysu
zJ7ns;udLn@EfH>+!{uxL;hu-I({J9-nK9SeHoaOM&k#4wIItw7Gfw3Gf~%&tt{;+m
zdA$2)#qZn4_-6kvxvtXiNS(uW0jp}h4%-FZ{h`;>q_>@nk>>q=?i)Y<<;{~1FIG0{
z-rX^oW&M(}m-kc5pE-!THJ<(cK5kFNM&o~3>FJxrP4~w|?ccYl?r-g7;d8U6$49&V
zPyGAq*srf|m+g7NzU2J5KL3joaz6ik^weBG&SmzON6*dM-Pu3A<Zkfc_doB?|8(>E
z`akSba%S7!dcS1jcD^%0v0bJLf9~oj#ZH<s(@l8cTc`CFd+z7VlU{tXTAIzi`RS1=
zjo__$j2qUypVJlj_uwiGWk$92noAOQn3cNsJYTt~wLWqG`sYv2?9w{Me|yV2t>^dF
zPns*PkkY)veo02B#%4ZkN1-sgxm|&L@#^KasmXZ<PCmcrYd7=6qZGS3<@`vsRLjkU
zk!RdeJ}&xInsE2L!7de(<%>=|sdX)`TyuKDXTF^(ZM(cbEhyf8ch9`1u8LZhUfqjY
zU;8=dpqWEKo$tiPE0<1n-2HG#O1HU;N!zNuanAjn>E@ZcYih(c-3`-qT$&%R(|Dpe
z<9o+mmf%<0zhpV^^VBSzHfPF%%!OZju5ANX7-gLk7d)!?`)fn?s$z|G4;0>pGM=0t
z#?x@q_NiI3VfPI;^FSRL(`)m(&q%$q&^{qi|J&9w<k;G~ah|)jY8l^s^uI`Ep;OA{
z9rcIBrgz2t`twvzZ??dtr5X{F{`NewXsM|<nRVp`qj#a@>wg!&AB*a3x0-zJSE0_v
zs`#VtTzDRS`B#=+@Ugowvh`qW<8*`gti|&V?wT~~$38ZNWjn8L-kPdYJI}<NZ|OsR
zP9c*c-xzj0SCXthb^oHr*S9N@M7Tqrm59Bssi=EzaJxON=$E=6tM<P78~fUK^{z~B
z(9Pej^i$_nWVrf^!*6%qZZ7<ATvzDg?j7|zdfv$^^~#C9iS&MZ=)RWT-Jeh2D9=3*
z{KDJ(SM=r3pVu6^k`<LNzLMnF`PI3^J}PAQkN#Y}Y=1Vb+wS>0^nJbgQq8l41riqO
z=ds()7yiS}`<7X_-?Njoh9P5?_VQ9Dd(Wq{Ha$qxnBVl-a-!VzK3VnBKayYm{M@Ux
zVbS#;6J3A5J^N#FdhQqLIj_<d^&hc0otezHrSnsR&V`L96y&#kwd^`EF>spEGmX!h
zt*ds{t!a~%&f)vEG3nq9p+(y^n$26=)S&wNhkt+d#pU(3Kd&c!UQ_yS%jde{uGZv)
zNXZM#t(+GpwZy8%KVr~iYhEw&EV3i|=<h%gAErgqH#^_>n!oPjhh^&*1z!4g)mYNX
zI;xtZ+P+Qn>ZTI~N=DaB`0b-#SX-TacVWfcy>_o_tY+VdJU73~!)E?E<B}C3`;uz3
zwd}jNZ09{&#K0Eerp(ti(br&JRf~A?;nyl%8dv!CGz%%*2rp;!km1_i9yH^d_|XFY
zPi3-&0rPkiOJ(|cANksUIa?T+^f@tq_PL8E{@gg6v+b)+fqK8ZR`a>nnrrMASLvH*
z%Dmn5CMe<NqH{Y+7qZ^qt_fxf+xP#hQT7alR40#DE3@avHcvSF=v(B@t^N`Q_WDup
zG`BCBT=T>6R>8xkb*<*7KfGr+to>NC`Y+!v4^`ucw-tNOAB>oGC*juBO&2u`iW(J{
zIc@u)elyDBq_XPv2_Bgnw5|AdXR*HCuzFkDvxTt{a!Ok#vdhPZ>bi%1(E0Vs^}3Mk
z*~`l|Z3>*q&6qT;WM;|x+HY+=3il-P<5F&ZOZZS@v8Si6f3feT+Xg#@HW$tJn5Xnu
zTOi+~B8bnjEulU8d$fGpQZGXd?JlWer-H1GzU?!2{J!!$Q0uu&werM|T{pVr<$0DX
z|Nn4R>(S@T6M|e3JPPi5s@y9M7P20A@ceRWlZTf{?a|dz>TATd?7ACpe9f!A`C@&W
zJPqHA&5ql2)ajHI<9un!<({7>+<&ZW>=|GdV-&6PB$wmtZ!6bqr3XT}7kmRwe+ir>
z8o~X0Bku;L)@2*=7YAFgIX|xyNGeJExOC?88LmzuFN5{vbgt`o>PzlAH0Qk<`$SLG
zB@0#@KFDgjXUabYdx=YH);B!Xahx;X?CZ^?)~<`&_OWF2u2(&J`!46A&Yx~NANQ(p
zI=8hxGtd$9d6NER$Lc&8Y1Xo6=2sKzUzpj5-CVwTPLEY`SMJG=$%Zm)RyP*EJ-GMo
zo#rFgc{a5e+&j!ro|+)uC*$x`Z<}n6{_b^c&p+QuWPLtqadtx91s|@T2cGhYI9VUb
z{&<)>+&wz;sr@FFqUl>>Y_7Ggj+|wDe(Eo;^?sf{uC~=yQ^VJ4*-XC4DxvT0!o;As
z>`jKr?)ks-u6z`YP5yjj3!}CKr=g5z#nTUW|GqZ6d46;IIW5C;`M<rm_nf;nx8F_p
zV!RNmU;UHBy$|P{-kx6V9rM^A=UmtM4PTh6V^s^bzh+rhxB1YA2`MrYLXPmv;gwDI
z);iqYwRFDd=68k0IX-+Jx4d7l-N;?XC3ycixyS{pw+GGrs^EWZYw8h|$l2WztqYH|
zCVlWvagdQoj<u1#q-B<^v)a8o%F1L`{F%s{JBQSDx3AMa-g+kW-=<@?uO-i(ktuxp
zLGiZ>tdGJXl5f1(yH>jO?j>H4W>zta?Y}pzxi0STzK!qo>IBmddAC&GUhTD;>#&;T
zvw`vNklm7>Pu<=1KX#q(m(b@KTnS%KUQmu&s<UmuvaLQT9MAb?Iy9Ic|1LK*?A=O-
zyzLz_op~OgZq&rj(RH}C^4$f2FI#hJzSnNd?AP{N5_2}B&tmJ0Mb{U;*z$d$_}eXf
zUmlB<T%W;P_IK9C_cJcqC0wovj$63&T>p$Vhg(lf()`+TFHgR5=S=rSpN>cV3t9LV
zDO~9PoHS`t_oK$izN$7m!z~qs|1Q<Yw~CG6TdLyl{bB9LdnR|!cV{zRXjHCuNiR0v
z718OaskuIhiPtyV_)k~=eMRQOZ?b)jj@^B6FT-W)|Cy;RmNKhZ?nkcbEitUEsC%D%
zOzzP&z7wx2o33_0vfJ|a?Dkg|F5i1U!!_z_=j_XjkqauXUTvM#)9U<~CI0x5+IxR)
zpWj_yz5Dm}&1dEI@0@k1xb|Ma_CoIuiP@|=TeUxKyd85>u~d57YHN}Ix|Npe9>2)1
zIz8Prj5+x5^FVf0|DL_el~R69`PR~BW^HwIijDu<Dqqc+OZPHPiOqSTRiNN)y78pD
z=;_A_KV<l)sm^X#*k*rl$=Ziyr~hzW<&iVjeG`7cZRWfaAD;T>-3wJ^oz-!7>t&rE
z{&(G{ze_#Md0`jp->I`Fbi14`J7TqKs<-AA$(5U4$$YFboH^l?!@UQIKMqy%b|fpB
zR^Qlv*lp80xo?#cU*&(zn7`*#dof>d<-9kd<r&8-@&gUrN*>2fo_*`mmZ;ggpJ|nK
zeVDzBqpMve_6)0P<PuI_yP__wd)KFg`0v>kx+QLN?bkD!JhPL7Po2KFx*|H5r6MZ$
zNuusDh0gkgI}W5S);_GhR+#^@r?dR>&AXHxO(uu>tM=^A_EWNL<aqP!*|HkX*RSu-
z&e+Sd!EcAm{u7qk1+mXX=I(dlop@rI;8Kwj&r=poo&3XUe)!LZPX{l((=*N$Tv2Ix
z{bFV5q29PFYa&V{TkJ);=lblvx-=wo+KFqLoTi`GHp%q5E?fLPSZ-Pdzwk-E_0<=7
zkBapgolENq^j6n8P&bv=KET(FE1Tcgi-pml{U*z0=>?rSYod89{WX^^Wz-9juV%4z
zTkW>&LiWsL$73neZ;H1pO1^Ti;kZ|QcV2Z#v4cjK#EJYX0v&nt4R;uKPt-cC6L;!w
zBYPE>zsn-w+U|1~#VihQXpxW({odCgn5%Mr4ePQ`4!0j1ah*Qp{0lRk?y?DWQ=Ukx
zH0H`mM&7D5wGjR>iD_}cj5O)wTWfT;oXifCRGpr@KEBNUmD*0rX%i&O|0+}&rDfHf
zSkyV|-r8+1rl}vEEGxFccfy6|TGqRA*<GDh__@2-|N6+S+-6f39xPv9skSTPYT9Yv
z=p(b`<&?Lq-^b26>0u?Ca-Mj&(RH!4JuID>8;pZ~{9E|L$zlV~Cy{wVMsf_{44cH1
zC0_W=v8i9DDN^*}Uei{d->V)xcxXN&SJ-*uV^e{1{5Sru4|rPIo;h#*iDPP>LiPLA
zw;k|#*|dGV_qIBp7ymb|boP6~^XjCu>m)8`0j4sx=!^c(ee};*dj^M9W|`|4u2}BK
z6}&__>%>z2eS3eH$IYIe+xK4C@L^+6#wpuxpHA`y1s$w3o4fY@vUQ(0&pz^s-tVgO
zm$UaFW6IxSCl=q#_u1UkV%%H0;^@<3`=c)=F1%yGa8}yn-!F|RoxNv7CGL0&F&|qW
zV63h2e!@LBgZ`?M+Q(A<SL$|4q{T+F8GjYqo^wv{!N&A1)nnhEbu}(sGW|?*?USH|
zxh1KR`)?!^DLxfdKhjgTK;@|N+ubMMBpp8PegA~u5$?Npo(hTe&TsQ&H`=Dqu#fHO
z{`7TyS(1D7%`~s`u9&I%SlxK$(Jh+~S3WhZ4|&9Ns=L$f^_pGmhKC)@1y}toxUAUn
z<=yAXz^-Y>uf+*TM#pioPQ03^YNx+WZB?$|;^rR;yOmRJY;&DwKBwuN+rin793n4m
z)i?c<<7z+c08@mC(@7E5h<~k>a*+?@R4-aj^=_HQDE^^bO44h7OTx~Lnr@9Jwd+qk
z&)?+e@=@%S$48GT54HDrGVL_9_}N*1k;yum=ZciFOVyrDZF6+`#f5tBIC$;fWqp>3
z+r9FEl;`17a|F3R=S!=$awVuf54@0D9a>yux8=?!hJ=2xY|}Ma>J@LhFL8Pb8LgF3
zD{`FXSvbk9bADr{>8&G-a-M2QVg5=&dOzIF)FdxXp0)X==Z?gd{W%%8ZijDuyD)Rn
zB;R)@*8l2cUM%_T@`XI<#RiuwCTeWW-?~7;u-W?5zK<$LR2Tny?@&EubE(v8^{b9G
z5n_-3WHnyoe<E75K;BLN%!5PyPsGc=#`tUxTzxfk2J3=63*O7s@$J3xeG($iW~OB?
z?BZg6nK%ECkIPk2wOO9|%O{s`6ouTq*!z0J+{A95ctzJGD^`X6Fy%C#+tq*ApXI~n
zwTvR$yhI;xPhhmocTh8FTqDH&F}bU4PxH@q7mJ<mZ>0aambv!aPg~tn7y894lVpWE
zr_PNjlv&1ip;F@Z`Kt!I-=F+{Xkv=o-k;{`udY5)u9NzBK=GH=6Qe%EY)&5k8=G^z
zRu;Y8az$0e^zFr5_Z^{6Dt7JoSQ7Yn|LV)SOs5x@i%3hyE%Ck($|~2H8}XpBX+vW2
z;)-KJEwh#ST`H$u_)^mNa^;~*_3`(obHw^jjj?mR@$3D}#cP>vKY#s6og-_0KU@Fw
zJy9-u|IcpGmp{7S;oqa|t^OwLH}2fIb6q^6=I-(B92KG`w&l**#qZ7}D%3D}*9Q}Q
z$u+l`o%cNKeq@!QvfGJsx9HrH3)U>*UD|W}jjOe0e#(s`hm2s(+ONw>A7&)AeHJ*a
z&FQHt{Oj6>rDCs{k4;`~^l#&{$_)(Xit|N3NIUDy4tI(OdTVKup<s69LH7QcT;&OD
zx1|m&Sj4}f*UBkOEp=f=jKxMbCKWTWV^buT&nzxf?2najv$U=H9@hTF($dz>{+@l^
z<azSTf9Dq%2bsr3ykDaA{Heg@lXKLcmm4RxWEABexU@yUJoA?1B6ZdHvc#K^l~FgP
z6n+U^E`GnMmif=GPltOyIy^n1(ZgVVsx<xJ!j4dFq243T@!Stuw!f@-9OJZYQHOre
zOqVS?e=U}=-1j1fB_;Ty<ee0ITOWgtS^rMD_=J?nJzam;zIMl!@>HWx{-^!LXaApU
zJ#`~7h0kfXi0;3AbN@BQEtw*h;TfeAd&%R>;{(tBc{SVqc&6x46`H~Fca7egD-JiV
z9bFpjEZMZCedac|ja~ifsn>!QZhREI-X>3}aYNLJ9nAfkFKVRE$Pts#Fq+f1W}9lJ
zhGwn+vzb$<@g>J*=kFejP1~nDn;07=d-wM>PrI+|Q}sG^WpeAp+%C^}@ZsK%RPo?t
zFKbQz%4(dQ)Bo!k*M{!Q=wBxk<o(t6Ui1B&<XIBC<?6y?v4KWS4yTs{x2=*<Iw+l9
z!TbMI$vTJpg!s?az4B}JsdY`7dOB47`++$Z4obLpea#Gex6~(t;mh7ja>=2ow*#hb
zd+>6KQkUkO-khU$@6<kT5}2GTHC0&o{f322K@+C^xX6-F`0b(UtThg@ezWdet6crp
zbknvfyS?{5ZHSAo+ghgPchWAp$VTfIi~jm;N-w3|G<S<T`-nU|BK$B}Av0+C+-OcW
zONWU)rK?r#OBZJaPda>4daH9~VYL32Yne*&*(Sel%+o(-8mYJQL30q#^-araFL7#r
zv{5+!e&I&d1v2NeO%s+qEUUPXax`sr@_eS)!#5b_Zds#Map}~_2Xm~J`doNs`HuO5
zbioR?sULH$G@m{&=ioAqwx2TUi)>rw+?-n1A=!RTR`0&uzoX6Rx?9xLcAmUFp+vVQ
zbFSOdGuKp?-gM>TWm?*`(28@x%+%ns-*b%0OMBIO*UXK*dGdtpiTN_eF8klRZdBe^
zA35vtd3Tvs)$ZLFC1w1Yjfy#>j<XposgiiheXqTNi+@D~_lge<QAP{))~@!*uPV>K
z%X>3_(aimRX%^@0<4@Nv6ixLEQhB=2bVZ5nA%QM0jw}1zT3*zw6ra@cwo)(h!$*(o
z>YYa?@+1euFR$10idek;ogc&94Mx46qx=F-?=ew(5@i&8xMsl>fA{x6cWf?QZvI@p
z-2M0Q^?Y|Oo!fKl(m6qQ<Jk<Cyg%|@3t==}5|F9-JxnpZI_&|^@2TgveSO)KRvp|w
zeQuoeL(@j<>K7Lt`fa{t*Q#OR_*Q0Go!aJk{O>m{Qr^p1_Bh~CLFW5=Y)75$X6!m7
zAZfjO`iusK*X{Yussig96}m2b{2Dk#pkP^XLtmd-mcGxW)bPbV3FR}i7AEWHyv$zF
zALX(l+Mn;4-!>;D(?bf@kzV09wAP=Bmg=(e=(LJ9nq0N;{X>@`2B#x-^E992KNa72
zPRq1>t$tWH=am}cj(t0tH@P)DU9)+9R86{M&aU8Um4a29Q+~B(Km69Ca>()_=d^pv
z@;tn~PNr?zU*<Y{r98{U2OngrOK-|pUS-(L>|b_EcKL*dVOz64_#SWA(Yg2Zw)H39
zmOSbf{PJ(v8oL9P=L{$3HyoU2b^6)$BH@zNrg7ZUPF?3bdUr(`@7lbl%K{9HG$bme
zYxb^}OWO8T{jQPz{f**#q;0SCo%)&0!za;kckj`4S{btSzE)MD^^;6mlDqD9wViok
z9{W=9L3KlsmQ2Ld6ImfsCnfX#tXFuNvhLnN(Sv8QOT-iYvCfwA(DhuhyoI-q>2W;s
z@i_)2D-XT*oZhT`&bW{5mVzgb{etdZk7;WPmT{PPaJesHv%IoHCGbTJ8%u_}kkQgJ
zyOk!#MVUlh-22VsPVc*;;$NF3mpl;`yX(K=ieZ?{TAlKpbKlRE&=HINv&FY{k*Q5%
zaCRLB&+k^<%Zu3``Gzf*PmpL4Uy>wyZN+KNyK7W6jxJ32_^H95?d^1x<i6cAd{4gh
z>ZwruENQN^<^9|`o07*%lRM7;KNUM&Gik1Z&Do5_#paWyTCV!8_Vo6-(`jL5)m44f
zyVzLfnp~b!++lV;=8VPHXM2}z@;WD0@Y6u({K}l%zISPy5i^YpW|Wmb-Ey$MsP02^
z+0&CEaVg<Vb1Ip?|IM{XoSpmc{Hd8PanqhT?tXpe!YSR(T;V%^<*z#4`j@ca_(r4N
z{pW?tglapgrTX2!+?|obxaO)(?#q8cCyt!Hed1N@fdwVK|K@qUKdi38)x6+%>0Qm_
zqAdj`@>5MW+&?0@N4R3=-Ol^6e~U`~ybgR5p|pZwomPc*+v2mKZXSETg=FVN1jr_@
zu-!4CG=9+w+py!iUi@=2+g9zr!sfw0mE9j5)~imuqmu2wJeSpO#&^RT1v<}Je?IV<
zY~Hul<6XE!jrFPZU6b}``56c<QHbQ)c6Z|m1EsZIE{xIHFJ4IgIU@06_Pg~3+4F<m
z<npPx@1J=wea6CemPOW|-Ytl@)S#N);FDC|#kSVbx%OHxqt(^UOs$g}ChiW@wmfl+
z(Oi^gKX>)SiCHF*`|qoKIQTy?S-Qcd$bH|9@KfiQ#DD#dx%514f=AgBfs&Wek0hM_
z&ZzeKw;*Ab_~DaDDi*m~)lUm=lr2^>Q(U(B=Ui*?zsU*RjLAQ~h*|Bj59Ib`|8Ba}
ze8E=5-3Rr<i>zZ!o-aACv+M8Frp~r5bB4K1pL)OgICpxn?Fl${|J$;coWezQCwrc(
z6}K>(;&*X!URd8bnL^$i3peFSthGVjH6OR`(!H~WKdv??_|5(2=3DJpqI6!*XnlNg
z*+Z{Msev)AT*U&LU3+=VQ|A_X?BaRZUDOpX5F{DsmA0bn*Sj}!ChcFooZb7g$z$#L
zeRm>V3-yjh_P%zw)e&epMa=lho7InNcRvkNw~RE@S+sJ8=kB0`ec{V4y;&c)!J9+M
zyroL|#O^&R^)<;W7C&TvxsZF~tA)bv-vv1xX>e7ZbSUDqZTCFgm6kFu%>vfMN~M1I
zyx@fAi_IIIUkH4uzk6&;+bRR?ceg$)aos7lNPBDBX=$b0hm&tDoP6xR|7`Vj{>k5u
ztSw4T*1ol0>@fet#1iR+2XooHyOVD&*tz;i^qK|BMK7GNkbbgkcDRgf7lVVO1J4on
zGULgfWz!_SPYbO(I+Oo-=;o6zSI=MjA}PJR`uQZM@(HPI)<MY(@it5T$o<b#@_kbp
zu*qmq(w5dU{hO8^+VLPu--2P+5#FbFOD6fUFXrKw_``ZtJ6!Tn<lCVAR>y>AzTSH~
z^^1zZE$4f(vI|aCy+3Zw{xU!R{*vGJ^XDlBw`{%r@wPMP?u86*m{L5HEtC~qb)5nq
z#WG&mb71Q2Znp9ROnSLS7j;EjEk5-u$YEylX1~o+)jq2;C*;;iBlC^LvipP@W7-oH
zDr58Nf4{wcKli=Ft>|f@1*?sN4N@0}Ts!oBQI=5UJi#-;RkyZ1KE#=xINRjds$c&P
zg^Qn?`Z-m`$Y*JP=KT%XQRX+c9Q(Y$@3&T{vsmP87QZ_SRc0?=B(vM9bL|V3b3BW>
zG<XzPv!w2vv}uVvd+(jXfj%+k3{EzN#Q_(Swk)XdD*dA{VahYk1t%2aRJDGvKaTOW
zVz$qjFO%!K|FBc$ivo^YB8TIunM&h6+sxK!{;M|s+2_aoFA9U!@ZNmgx#R4G+xwMI
zn57zuD*Io`WN2w*j<EbaYtr4c&Gqqnk1Kq(Tl;3_f^GTnHzsB1Y@VCwyl2CVLxn%j
zgv>nsSk5_kk5bcx84V!{jh#;xthQ|3bLHaR%@vJO2WzjGFJ!Yi!+&c*&%~>~J(kkP
zZXBJWT6WK0%(ZJb|AkE&*2&f;Va1bzr)8<^F;z3@+_Chv^2)&XPfQuK-JbG#O<du!
z>hi<8qBctU!a=tl>v=XlHry7qT;@;Wik{f!AKsbIE`16s&Nlj=eWi>;#J_Kv*p^d8
z0t+;v)`zg}KbtMImOn$|fus7rxU2<r9T(3q`6V?ZYh9I}^yq?iL%+1u!@Qt-?u(yG
z|J*(4>~qJ{2Oe0hzG&YvyFXR)deF<yX4Yr_X=s04=I8!X!opB#!Izhfzxt1-TiO)Q
zdURrf2iqda4g-tdh0YC6`D={+uecJk=i8aTlc#yiYW{NhXR&$I*6*701^tZ=);^xg
zZP{(;{VZu!<@@;==1DSB{`nY0R9H1#%{(r<Jj${84Wq$3{$D3!_0*KLa?8B#^Au*S
zbyIpU<!PT(YH{)BaF@J0caAPv7wT0V?qHk19J2AaRPd5F6K;z87Q8)^n!D^y^12@q
zY$u*c*QE#9q#If!DY(=NwB4<FvvybOgws7jyq?)d&PkqnnUJfM_`+j)P^t7vk)rnG
z)_%#*_3G1I!!nHK7HjT28EnOM_eR@AW3T5LvU!UOax*%7_O0j@<lL(oGDSi=VTs&w
z728Q4luy3pmfYzRCZ09ZDc*3a&C2rJ`!X3H>|I0E!YbVE@uw_)&6DBqdb{Xcp}A5r
z9pbl^JvZ8Ea9ed{yG2d%lc%c^!yhOvzt$3-;_xJKMwk%etlPq|r7ND5uGnYwZr9J{
z$JXs<^lv_(k$2+ojgxo(NIjE3)^PgbZo%UjAze}LI7AZPC9~ZQFkJ4b<#=&X3Tw5Z
zVk)!1Qn43@W(J#RN-XVp<5#(9-SoYoS0{EKpTX1ByHR(-+!vSU=%2B9x}jj6ggDbH
z-Y1LY7m2e~x^F29i9MQo)~@`^u8@~q(Z$00KR@J6z8BNIXnp$2hc9ndR(-hr@8HRw
z4?hMPZ}{dSA88fr<vxeCX_a|h-mFEp)h<^2XwE)ScF1ON#wzD48(uGcZlQW^R`0@V
zOD7BelU~rh>*VJczNL{%z8_*Y)P8Nr=WeC8e@E?uxm%v->qV|!Gjn~miuOil-i3eL
zCQd4wxGq{j`I!F0?)b^URWmwXo3iVBBwu)>(=ISS?)C!avXwtm#Sf=!XKPnkdE;Rp
z<8`<HKKo<V?A)?t)|-oMTTFby!a3~9F0*Z4z*f7R*ZEb}s+(<>FS|NADpamx6W5Gq
zG}(EksdZYm>bc3qTcY-FaA~rY;hr_kWuAK>$MelR>m03vZ!Ns=?Fq}Z$kolqo@;U~
zFy(y8y+~_~LuRH}PHf2e8KSnUTi0d(eOwavXaB{@jaxqJT-sVvtv!d`{84;V<J97i
zuZdw2rWcEX;@0wSdf2Xg>XOb;1Ie!D!=}P{Z9XZ#&KFq4ZQY&~x+`VH+Kuye_G`)<
zFL<)|=dI0>+gP3l9b|c-aAlhOjSTaE`wynvk~-8RT~PPv?7<f+Tv=+qyV`GYZWHla
z8zPt+!uaELfa@RE5Wz`W^OSBaiaLMr@ZJmR+NVtaOy06*m21d?BgbW~_48ECIcsRL
z-N@O|@a~H4-U-^VOO7zeXxNlL{Vdh8u*PUr!n5nDZsEs*8v@1O_9U7tDhhOc>RZgv
zop!1yn76C$@ynKzZfh<Uv#u$eb&}D0bFrZET7m2<wRZKs|L0xauim~ssq6iPnW~#>
zuI!CDej{DmO87=%g7sCC=K?JX-{M6j3YUg#{Mu<yvi{JX#bTeW<XP9HZeOHWpkZ?(
z_pxQrGK&)*lvYS=Qr);B!(!7TJt;qzFrBnIj~ko(Hgs>+e&^+%G-ZzLzmmFwUuF_!
ze{;VvCSMP8n#Edq_hj2=R@ZFD3tMk)WiWY_qp!6vq_mk`ZN_1(8D(OOa{FcWRX$ce
zcWs-&Wvw&Da#kr@XW0Kb-X(H^<?eD}x9yhEdp!2>y_%N3EVD?vJyia3{(HkK$K$N8
z)CWz!{%)Q8w9LPK+scZxZylZ@e^o_X^ekJ?k!JDxOI|uOywFk9H_1;pbogDkXL{q2
z#uC2GOv_9i59Y|Vp4sQ49%mVQ<F{OJlh2)3?aA4_iNC+<?ABaRc(kS}=a$>Hzf)(V
zZLm(?qHVp7*(BrKtUvY11x)8HMP?|S7O3syyy4)I6Pxeyf6^`c%3U?V)8xfAFL-?-
z(sJpO%F-(f6Rx_<jsLi;)%o6Lch9*lGm@4F89uCEo3}*T!n{c)z%6yXp_hrf;p_!7
z%Ge+C9p;EWF3;WdWZHRIi<GqtUjuf`+HA&RnPT_nK+d()UK@if8K;!ZCtk+BIN?~-
zx8mQl<h|3Q)a|p^6o=)qD$5w0v-6*uxVBMwIy*~BeR{6#RjrjOI(Iabq^5b^yLaZv
zwkb#Ql-tg+A1(WNxHyYTcTd9=d80pOml`&?T;bi(6p(v<o$Ikz+0M&+z5C|tdTnyv
z)3)rXNV>twe_31d?#&OM{Pyn?{r8Q08+Y8BV;1W0@MXr77c>6l-`VwWN3Nlf!}r#p
zhPi=$(w45=JyMsKG0)!4`i$%N6C)k(zq-+Bn;VofN?prxP6|$Go166F<>qI(3pc6o
zd=Yq(|1G=k>*2#Lns1gXPj=}#7U45LwIlCQSzM~7)j3P8{1?w%Yc`etGj2_olGnL)
z#?E=2Yz;3WO9YD@+!k-!yi~NQaPNlr3tu~5K9(=I`CwO<DNpmHDWB%cq?lUnb~OC<
zXZrUm97}X>b1VLR{qSPrJF`hb*-O5f&ao3Hu<+Q@7`NN&q0+zqWfxy3yUm^Z^4zYJ
zJt@B~PEBa$lM#BPw|v{1Bma%_d=qkgRGykj=}7kNIk&yzm?5XjobA>5_hjBLS7%@T
z{Jmej&(su#;~YiF3!*)D<qJ${WBV3n<lHl-q%Jy8-QVR>wv63Xwp%Jor>^Uh2(*=d
zR{ZS-%ZFH-{ByhkQ>u8wE<I6xBRYd6J!F%}1`Pw|-6_d46nfU&S|>Ky=b5!}1J4nI
z!(R$|?D`sJBn25(n8jV-<eIr`X6|#J4UQ9?C;fZY?JM^2N}aLe&xL91J}%z7`c$5E
zy*a`+Bf?ex&;@BDW1F*{+wY_%XDl>&%Hv|VXI|RX_5)hqR(Zc)z|}D2GRyx3rf2;0
ztA2jH9_uYyI*l>-%zxorhQ>oT6h55dd23#{gnfgC#-ZSY+cJzqWA!%wdpI>Eli@MP
z0ZC({J=%<3$zR`wH*cB78+bfm!n}eu{T`X!3i9$RuQM6VK3-9=tA56V11l!moZl^_
zzy00!bKm-^-q*F%%U?>~)n++)=A>sofAqC26Xz9sc4pD+fS1#H4px0#$z(NeaY}#M
ztaBDg#$0u;6{1@8b~hGo@?Nm<TdCQ>49z{V-^<H7A3bCCW6(41|5lzPt^ew$*O50t
zj%Vg5`8)dly|(VO+_wDdj^EyT#oYgAx<V@WN&L+xTwV*7ah_vevD0Z;Xs6+;Z#{FS
zu4r*`k1M+?duQd=<g@dB#8>CnS=riDwOVZdep~OU%T!(|?Rz0R0>f6CY%`ye`C?tz
zzIQV&xqg4tI$xKe@Q+5d%;e?s87oe@y-Mg|-niHI$W6CJ3chDF9lk~!v(<5XWTtTa
zQTtj4o;yB&);{Rfvgp;kJ=^@)ztiu3U+mr%9sWA!n#+v<-qTGhuS6}%Qp#9*nc>T<
zdYLco4_;;QO@AOzyK_}y^S7`azD<wXB(@}ocCWPh&RG6W@z%z>@0p!f%+7KuE4q;N
zHM)1vD((5@hbR1xd2)!Cf49bk7XRoE-g9l1{S1v$xFmJp%{sn0x3gXM{+48loYhtC
zc7;ncT_)DzMZnpldXJZRZ56pv2ecGQLd&m(D4h12EVyIyMvco}0Zy^cbr{z!f1%E|
z{#kE>66>cu$9@RQ-c7skhQEEG;b-aN&%HuI3I*Sl{?%XA{_GNi1lJb%g9~SzIV|3K
zMnwDl9*)SF%@wn5yjv`_AoI*G_pr*cNj6gAALVZz?-AOXtT^SW?4_HpBhEW*b!ZEX
zoNcn{Y+m%q#ZkwDR!4t5=5mKCeFM`9iNKr_^M$om<|@^sOjj3=)jIR}!{*jx;hD|N
zPRfc7M#XlDrwt8bF1S`K*e7)D`I8?m=>n0CD`Zbzf3f|gW^|{>p_r`7)Mfdle-by9
z7Mau?S@7**kN&1tiBr!%YkVwe`BlW1FM89}%q<<;lcLL%w=mznd_tkp$St)fI;JhN
zw$*3ywTYH~Uel%;nf5cUJO4uN`cyB*%~wuZFPpZt-=_SyipZbuGP%O;8690o=JS%B
z|J9lVHGbv4vHHlKhx;b0FX2C*GAB;<QlCLvO4hd>r754cT}!=Ir@i8a3D4<+x;f$p
z=K9aru9{h^%NAMKx==_|d3$7$K`V=6^s2Sjm(KfHQ<whT=txG$)CXxP0jKXZ%kBTW
zWZfgL{N#D2yQ_p#daiMW`yGGnu_q&E#jjhNQl+i`TOFMKG%WX+d_LnJ!}Y~qZYkSN
zZIkJ`md%v+;+^x9OI`&67e3`_CaAVsY1Qr75%+B7`L`U(dz)oU))w--<N7s^iJ#5A
zC^^8V?u7KtNAJ(sIqsZT9B6HsqSGE1@^k5}<>6(937iXAwT*jTY)a@p*0NOfsR5&p
z%0js;O(}JWeHpp)l#d3dT=suCapfBKolMs!wm1sDIGi|1a#H%iMh2<htd^`H^LX~o
ztG+lr<@rqU*E1@k=ATb6%c_ks`FvQ~`fekigy5#OqvylExSd(N`l17C^6&n?9I=%y
zW==~lE&8Tb`G6t8e^#Wb-Lt2Q{Ib7z&RxzkgD2o;**~saqYu%`cdoOyu_~W@eZowZ
zcN>Gh^c%9MNp4bmlyxahYIj3s-VLqW)A~}37rOaQZv66Lxw5mON1&-z<J(KBJ~ue>
zayJz$_e+%V%KWMLG5ky5CBeJPUQ6HFDSx@td)D!VOAbC{&3y7{r@rvI+n>YN-(Qp7
z{CV}H7aD@QH?4EL$;Ixl(d3U`l4+TSip-|7+^qUXW!{Ruo`03)iqi4YO5wBZ7f!ud
z#dS37MiAGEH_0<sXO|mInskw2slZxk9;pu*(u&nD&T{WKZ}e@)C9#Ir6GZH9oL{Xo
zVSV+>8C!Mqn7_|V|8>62kFDPMV(yKFM;!b&yjEqqvAlkMn6&=FrLIpVzdAhQ`_i`$
z9=~RO{ATf~#~)1_w|{%MU;RqX4v+mmZ|(4tI=A?VT$1}VLzX>ljpb>!?UVYIdklB}
zUMBgEYmU?HWs{n3H%qRa$mixA;P1uX5PUI|^^`cH>cX1Cc7obh+PO*&FnqguaDU&u
zy_Ldw22X;DDvAV-ExfwxTBo=^=hK(JUd+4F`CjvAx;AGse{b71-s^2TC9$vj7S*oJ
zohu)zXCV6h2;cmy;2BQWy|(UMIQirpjvcEXbL~D5#wxx|y0}^5gq*qHpKaSYD^5KW
z{<Zz`$#;A6`kEEkXBH?gkou&`eR<c^t&yjKBi>(@cz5}Rj!}5=Kijs8O4VQ6G!w1~
z&bhVrr)z=hnxifj&nB6~noB<_$o-XK=&iF~!Cm=qz%;4V=DfPrm5~iOy8|xk-8JZ)
zue$E=gg1`om-}4al)55)?pB{e<~Lg2oSU`%T0-mDZ%<YQ=+BjU+iP*{yGzG`ncI@B
z8BY1Gxcd9O;5Dz+J(F(Sb}UemJRRx#irXnJE5c0mccaJB_ABp0_#URF&hj~25q=}A
z%P2^<@~`6jt$Qag{CO*Gwe{w0*O%mS?RVZc({J<b5~VJO-KL*>&KJ+T=X+|kcHqq~
zwa(|ARKh;b%XVZu$+yGJJ$F%yr*P7d+%unKHac2~PB2`$$wi{xV!^+OJF8c2K9+iU
z#WKH(drn(l-My*1TCDL@ME=vgi}zkD2w<D@<lgj|F>{(`ugPL!d8)B&@^7;%j)n#;
z^O6_7FH@>eeEi_0<Uzrf)b0No876MCVHNtGlR3MtQ1)$lartKP+-0-t&WHRJYxeKn
zB;j5u{q}jtQngtDE#C`Qik_eM#&w|s+isrN|2t>asim5EEl-*k_(gKFmTK_ELxndQ
zU%tq?cx;A|$c0?4<r;inmb-nv)wg?!#X>_i_tSwJ!>w1=y$QX#qBJ@CpwvX`)I;kJ
zOyXJfZ;sNg+}TCDZhl}qx?h}c<qLBrZn?!#rpM|}a+qnKVeeXB^LPJ2b(y<TQtNZy
zrLSm`TpY<K`f8zE$C;uZt7f^Z@C{#BX7TLOrVk90eRVX{<d?6%bj{jYfB(ya4E+I9
z6!v@Xb1FIzxP+a_!T3>>kD6`BG2ZnTzf?uJZ}_!J$l#a_U&TaC-Dd$?R>wyC4Det+
zc7HuXuVdWeO2Hh){fjG&s`owZRgBxx8@|Z+ft5w5Y=XgshHp))dVcavl~LL8y)Wy-
zI=>B%WnXMIlz+>5*+|{Po7YLpSaHT7g+pc2B3?Q#d}unQTyp7Qt!<0sf2zq(T+oqc
zvh4g%HA%r&uEB>}bsq0|6mn`g%hE;Z?~QUD8=^%f6*Zho(z<%ggRlR}?WuekGY`8+
zNuKDO*2m)J_crtB{1V$K;fqBrg&$`1pW4XWpDR{S{^&zL1LwDJMyAaxZi*FgJ=b|J
z@FF)gmwTcc!|eyr;>Rs7Moh~%zSsBTO%5*m-oWYe&ITletJ`%=oo2x(#&d>k<DKh?
ziyn#`_v<<3BE2&+WyAUA9p{#H$3ES9ICbx$ht+vk7w?X$e!r{QK4?zyth-lpH6F8v
z{qwqI5n|Xkd5-(ulJgF1z6|?jx2xPycT&p`-Mn6Q)s>X6PRCiSUtCj<+Nmiea$344
z9(B;)DZgWx)v>Ivc{6L@dPPWmIIXdBLFUw_@l`Xuicf3_-MsP8j>zpNxtHhXy!o=^
z@S(6(tBZGYKG;~N^H+4k>~|Ik&HMCtcTcXl^mIMXZ2lybUpEqegs~h@4sb}>^yG!R
z`iu1ntbR9&?U>xVcONh@O(^dUE&aH{@mf^2WaeHa_LG}-ar+)>JN$@E!!qaC$Ga-x
z@+*HW%jKy2o>`+YGc<;`iF1{~G3j5|ZhvICD9E36>51I$PEAXLIg4s%af$qYDmlYd
zCpb}hkNNgh_odV`3ax#fmm6Cxcq3Z=r(w;dufj&!#{_skc}5GJc(`PZr;W2wL}bof
zbKTz?&$Xw|71I6WyF*aFdPlX}7UhE((Y&*MZ@WAt@yA2o5VLs-`wr{t`ZaAkwtM5T
za?bsnasgM;E}koPdg(c3hw;6TodzDO5;{Kay?@5}4cDY)KC*e=53ygCIaT}3IL=4y
zR8jQH{{IROCFa|9Kk#@OB`M%D-HmsSzslL4T9amM(s%2g#^IdF|6l#0|Mw@GX0`+e
z#&YhQ=}{7<y)mlxw@Ulgx9n1jc*GTUi{8q)70K}9s`Vxfq1awFzSCK83eS^H{5ajR
zVbiwEw{jh}&m&xSyY`4(+Zq=iwC|<sfi#)dd6v10nwzhln0A{>T_G&t<MpsFzdmf=
z&c3(fbFlfp+a`h`u67Zvzjj{nxvHCDa(4#5l(*Po{@<)~b{lPN_;A2(-hnf>o*KMj
zYj?aEKGP>CW_y)d+l#qVCN{R4<@N5hJ)^*z?xJru%W`J>(>Lobzh$c^b3M0ywM}es
z*K^i*%}TDdeD~|a7N*37Ct4dHD6E@4sqS#3Oz*V{l_NbHwp<BZ%hh(kY{8@u=amA+
z8leha(#-Sk8_D!noINOd@>uJQMOPFo)i&KTU{LM8sWEx4-`eRfo?S_+k=?etFGjZ6
zNv)8pl7DJq!3Eb>58nLHu>J8?;qTXy_fMWYm~y9BL)uWvp=6r$*{Hdp2Q*wyD#ocS
zd_1+x@Jca9*=pH*rrnoMmhZn%d?>(o<6buZ6uwy}g(FkHO#E<2N_*zHbLUO;|Gs5*
z>)Ph@f96b=V<(mfGjy&rb8_oHd-srXgY3VOlA5XyS`6p+^;fW*cpUF^BT`)X^g_{#
zdl~zR86^2Fmiim09B^Kc`Z(yh;9QFzZ=WRm|MNg}n;e7G4#O&z59RJ$e@@=J8Oc!d
zVbjUX1I7z31cl~s&M`9NO8czvJksz|WsiXAYnyz<yOZW@e9Gq+dwa*t+-p`^COe;p
zmTC!{;Mg`J$jPx(r&0EZwadz$=5u=^wu@@S_x4^?uV-<;z4So5R=n9UmLKO&AMiWj
zmpLQJ@9DotpV@EqQo3aCCr_+y`}N_&oFmbPek*oO-OaTBt@K-a-3XN{Zx7e|uU;eg
zdN)fRN8*m~3LcTg7Yg})#~PJ?->{**`9$0HX>pcn2APHzZrtX-=~37ho%i`q*yoEG
zm#Tg~7hV5p_3N+)|1?goIGrdM=vKMyX?-%+NmWjN9ra(fJd^gWm3f}Kit&tPyYXc9
z++F87maPa}_q_XK#LDTut1s&AwB9sR|7OsJ^4V9agXb?#?d3XjGKp)`G%j1y#<NZm
z8<)$Z7?|J8Jzl4gulcs!O#6`{=VhOLueIw^t#3})$uDAf+gz|pY=;E9r_!xHG1qf3
z4bm@W^$Rq7Z8*OCVX2Vjo}iZhwVr$Lz1;c2;*VIT)H~(<ObI8}$uIhSanY@#^%I;`
z^pEpzP2;)e)W%iYJo)pQU31H?T;jHv#F!A8s`B2jsnvu%Xekd@UF!V(?n!<puYc80
zl>4+$-r8#)M+>X6l|ZPnSAn+oE}IawuQkWGU(J-`V@qg}PV4^@c3<LL^|k(YygrW}
z^Y7M+`<Umj%`j6;{zR-z74MICQB!L;53RZx@?lo?%8!1hc`kakZCmKuJHaCHsx9-)
z!nP*I1;tTowq(g{Dv?-~$k`XRw0Nq}!SyMghkci_8&9|Cot0aDs4$}7K$VOPiz@Hb
zCH$X5D&`eUxy#P|Phf9HNv`$`exA}hxs~pZg}S~dU)+3D;Y@4w{@;J^%YX6O>LU1O
z#ozz6h5tY7yYSSYb>fz<2?w5aR>z&&+&O8_jFi($#ry^0)Y914mSk3iJj=~pS!^mT
z(i-w-`Ha(9r!-Gm$(;3%`n~YcoWqJ@GFqt)i9v23k~Mr}TXQ$1WX@ZoExNV;T9`>e
z7*i7SO0Bc?v2z)IMqk`JFSl~F4V$c<>d8NcbZ-^aukvkObNcQxvkMy^I5Nx2moJ~N
zulLiZX@9ju>a6wm_uV+Z^Fc}fFEi^yCl%e|6uj?z)jXp5E<lB2#y0Nw$p;<YN(z}M
zHD6J+O!#<a{`sl9c-wZR{d0B{6E|f&vC?vmQtYFG4@+K@m-!#M_y1k|?9<;0XD&*$
zcxCgXc6~{?W6g(K8PXd2&+b)Ix{@(vQec7VlvJ4wUXq9SZmd<~jo%&S)OS&~izzBE
zV$r!rYgU#N1Yf^=?g>Bpz6P<F-3F@<D5uog*cTqoyVK`&#wBgeTf6y@ZINA9J9;lJ
zTz#(4hyUZ^&nLqp3stQYmoO)>Zf`ccv}NzY)u&U=2JR~fxx%hIEivrEwC?X4&Kxmz
zmW{mlq$B#;!r%pW-|u_9E#{B@?+e#FHgp)=xoI$C?Te{>T51*=Y@bpV$Vf31s+g6i
zUOBjF)9!D2R$((|%ndEeoO<-f?8o!#tSo9n+@q}|FKnCnZKKCK1;-T{RRSNbJ)9c(
z{aftbO?PfH&)yc~c|~Ghj)mxfU2eTIy3VPckq+`}x|OKy@c7=m%bqOjruJz2-!GbQ
zH{#bHFV_EuZBF`qh|B!uzFC;Nw6JPF&)b?WzaFtht-Y{)ZtC_4tN6Cv>kiqp%s?>X
z&Znl60p(HoqCfV&|C3^UW%5s%X;)eb&5A58{hb&TWuc-`|Jo{X-K}FwUvE@lxK_|(
zChV6ZBptn2vPqn$#LsWtd%pAh8P{86rv?`v<Y42vETXVuUMG*Z#@__RnA3am?#6O0
z;_U0UHqc?XGuw01<w7a;q#&{IqJA^QcIz3Fr=-1k`go61C`;Z$BNmn51^3OX#FvO|
zG~CjE=3U60G~*rpjbiCiC8`o_OpEPac<sqf?c@BUlN|o|>{THlP0m0+qi?HcDu1ft
zYWptubZN(;{0g-N3FXd)e3nV6vWh`Q@|$(}8&9w-eNyYu5o8v7`&hkc?^B)wW@{q@
zc7N-NxxLAI0^{lF6N4`Iyx`b>fhmtwap}h_fqB+C@n60!c4snfKV5l@kK1hZ;k-wF
zd;W--9=OGjIk}qU$FkxCf$dZN#7^U2Z!<CoY1uee+DG8s&d2V1CbF4Xh|I~DcPO{a
z>x|Nz$r<x{-P+bNw}(%Tuv}np?Vs%Je6GtU5377wY?YrZ_n|hr$TDZ9g5K8a5%n<_
zF66&#*uvj+oc~J9s^Bd%9<IKgX0~=B?|1cW!Ft;JJG_isb{>=BNmefUelI2Ho<=rv
z(&7_u3Ljp(sPbQ7(b;Db?3WkcIanW;x9FB+|FR!DgdZ1AaG#`Ncr1<oanh<Ox@pWO
zPMp{@t%O6OGqkwaNa|3UsmSKa$n0|CR{>GJ*H}eN)4C?U_Yf3W)vS?cmM)t&<ySJZ
zhr_Yfmu&uBmPh%PeVC`_!j?KOLolRS;G?}&kg)X`i#*<a`Bkyn?G1N2l$(5?IiI`r
zD5%!hqQcmxDo}K5U&W)&8McqCE7*3|Z+N0LBYj@0?9tM~Yo9cCUq6v?E~AF8c;$iK
z>7OEd+9FLqX&p6`^sn3bJN3;z$5|`3f4Qr>VfQAMUiIk<*83^<>hS*M%>0)jP<1MT
zm20Mv>74g3rq7mic6#PjQ7?KgLgm5_Z~H8%Pg;4=OcQ?Vb-Gx{NEGlEaLm6N;>%ys
zeRb1i?-j0v)oYrve#Mlmd34wN?Ywl~na@n#_I=N;(B7mNZSwWT|78<@X2>sVIelkd
zu;h2aD=mSu6fddu3eDU#qv_6yTUR!%z4(y1>1ObmvIf79RoRUDde|niI=;Oj*15N>
zQ^C(yvCeY|Xa6rFrz)|^SIWC3YM#3!9IvxlP;C(#6tv4}z9`dLuaZ+8%GxbX8(s*;
zh_D1RvGlzYJ+|^z|FMsIU0x)9pZC^s@1)aezL!n5C{7h~$@h7$^<1#k>kMb%m(xl|
zra1eC1tcvOn;}%oS$L)6$0v>E=_~8b?|8TJ%Hj(-XBK=s#Xlz{;9K!|)jvM!PeYZY
z-!Uw0e8PYBn9svGM=}C?46X<?g)fwv=%l+)^kZ^5d-!|<=ESHKcibk;(K@wNXxsaW
z1yNezVv40D71lvQP5<YX9y#^TP~c`K<E68*ca0Qw?D@gb<Yydu`1pFYiF;nIeGnA#
zTm6P@H*?u!FRR7(7TnxB+33%Q8=JHv4o4pDee-gSNLg-Azn5nGi4Ai-&zw`N?e(}Y
z>(`@8=O#Aodfr`mV&+vY)k|}7p56VXaA4no1+x<T!+38`$c>cUePmzpB>vdNcU-4l
zN{+Dj5`JGga;nWd_0#_nUYuY~s;X!c0iAax@ygff<sI(|{#dTSzH<$}itoyw@5_9-
z@bwy(*IciizH8p<D=RBkeRG<(JWOY<K-L7i$}|Z^d*1dLhI5$K+xM4qHX7N6UznM$
zno*n@;rGAs-w#8kGap#~@6-77v%jKy$)9_<+dpae{X3u}vp%hIMRR@o%1>?C>l-*&
z!x^o`w}0N+a5n$>#wS*#_UptyJk^@b9mv0VX2)*t(#y*(|KD^%j_vTLFPGQ$ad1e?
z><VlMx{*-wCYNjbyCwe(8$RapA8Y(Bu6D5Yn!A2TVRzn&t4(_XpXxWfVY=6KF6EZD
zmxgnr)WYfAnz9iOLQ;Q)S@`BC7kByE?s#t`@Me2(TBlO1;HyiqWj_wx%UCn}*wtOC
z_bYtk^t_(7@NK!j?B+VVbz$k|rG_CbvsIWZZ$I1YYt|I8wElhEn;5BwLM93Jj<F5#
z^+yD6-?_{4(WFK)@x|4%FDkca9{y!@EiG4E#y8Mb<m}x^TY6(kuS-5iytj4LogF^k
zo?GskFTdaF-qffPGoFyP=90jJj>q<U?fd$oG+f;(R&SnB{-;N)r#Eh1)tB4$j(f&#
zgQF^iFW0o>zVK7O^LuLY-MJyDZTn`jM||L&V*M~FmOVez*V=pezo&P)ZtoQR*C)bU
zZm6(!@@}0I5nG>q$rfyvykvIA|L(R!Zyk-VG<DCAopb%*+m#wD3)__W>RyGcJ!&#L
zcJbUy;l;0gY@?IbCiG}N4^gR|@}pQ$Ph`gRFOMeOseQ0B^V#9X%;2?eRa~dV_LoL(
z6YBnRZ`DyA-4}N<oDNr-N-mqCzQr-sMsssz^Ffo{uD4HYhn<}$-J=nk<jnZwIG1Nl
z>bfv(2Qz*l{$1Yhra7#PnV;_?vanf-d-L`sJRfq^OeU9~IUaRxW>D5A`Ri6L@`Wy2
zXZ%f8-75U)$V!(3MT{?cEp|@YT_f{q^D4m?!C##3SM`Q%erqRC6&0|{=M2-T-m@i^
zwM&`PgD*<Hcl*YZ!(ZYpx8BI~l?%&lIrT{f=jLucQxw&i`BU&#NgwyZ5<g|bjpApH
z-niG6`e{l0k-JeVC!c7avy!RyF=tN|`?jz7FHIizS}ELYjI?x?zBldNN{@*??$c|o
zL{(&29`8Re#ptSv;krj}|8_iP?+jcYX}rRAPkxV;ER#`skxv;@%d?_JJ*&z>*<Dhb
zb$!k)(ouUlA<6EwX<qQjM<w&@CcgcjYxZj5DcO`q)A<gS*0nxd5c=YY>cP3ZJ-6QN
z{S#aJvf!3;rB<8Le~!CTZ$7F{InJ?uj`G)4thvXV@?Hzvj7gh3`^~zrnX@knF5ba3
z;r66;S(h&F?ek)@IN-9Y>Z!E>|M432CHdzxzw3oQoGJBKX6c?wU-!(hE%LId<LR*t
z)b+e`_C%4cz&qA{0XNZ2s+X!&cWayH>u+<McYoWwJv(~#@y~r_cls3H`L=12iTl#r
z_aE04?aF`RkjX3Z`TAF#1FZ8DJWj2>b7|kq^fvvdb3AiGzH>33d%pM__bk3oj&gTC
zXXGtB$#6XLdiDkWt@*Cm@xIT#GR{78rfrWDTk+g5g?rCrw&d`56&d{%jf#-EnRtlF
zTcLL6ozTBO7nVOQD2dgbUv!(1`>N@;>_05!u3sb{+0A^J6E#cW)Z!UanYw2u{F&W1
zZO@_U>-^Osv-M-vel8NUx-+HN^Z9l;xeeF;Jb%5$`Ok$nsS68VDt)Nl8|FLb*S^9h
zT;DF0)J<|=|NJYeP|8a7FlWf8<Pt&CE6#nHQ?5;nm)28^>b;xqwA-*LSG;G9;&g|c
z)wPx%m!5Oaz9H#<`rzSyx7*zY-8?VF!)`uHcw#TQZq3A{v-?izOps@t^ENQD>*c-%
z`{Zr;e{M?fMz6B1Np&e(d!%L4#Le5Tnw&{5i|v;5UGn^#%A^Dp9=`dfj#fw9Fzz_k
z<n?fYZ%?PqipZLS>m{leot$~$V)bl+RYrj`4ZSwGX)#ZYR4ne**jZ_)H~(-&*wbxm
z6h&W43Cx|ZX*Gj$le^!Sj9u6I#Xo=iw%sUiMzZ{}RSCut|Ct<4S0oyH&vIFI<DT^^
z#YZ!wN-~-_X6`&+6D_mO>GKVTV~GN4AGrTj3qD^wgCXumkWWPsYv0F?gF7<+C@p)@
zno&`lS^aKn?9<2A=agn>7`6V;70uLDDCCPyJr$+3?9_?(EwdyywfL@`*prjPEg~_?
zNG2$N@o>c6BB584ZXfW|`ncTiH`C72zrQ@TEn5{OaHQ@@%|(G17Kh3oFD>~#i^+ZN
zp+bhALQA#6cb<HGbiuJD&y!i({3Tmw7RYLE)MP!rPA2^YOWSQdGl9eFEegYHl;hZx
z6QvlPz9&DinbN&wje}XJ_lDc1OfjqeDH&K_Q!UOip0%`S*Y5q2wm;UKF!0_K5Ni1<
z>~3DBxX0r%_kP{1Yt!7A@{6C{x>=C8svvr%+4X5F+wZPBuBH0Qp&&p*%k`^C&(6gC
zOzo>31T;Ds-0fv<c*fs)_wE{p!nRjjK4lMe<&s`53S(Qls4r!r<V=p{Il8Yqu1bDA
z@W!7<AgTYHcl*iC%4gTU?n*IxE^_F#Ug&;JF`pfs4|na^Gfy^_(_i#JeCnN;$ybbS
zCR)r~y+7c@sdY}VWxeT6Gi55xcU|`_{Bd2O_2tV0o&R1{{Fs=1<M=G*xVh?wd3<XF
zTN+jEJ<iOy>-<IGctkBj)1@5~AGjXW3%((1l_U4Ld&lb|Ec#(`MKUY8=atTSmczDF
zXMtgn;hq<7?PV1?mA3f?nIz1pVC7k_?3g=~v1?{a-_n=^y*DCbmUIWaT`=R=!j@+3
zHxhFVX1rb{W$=ATq3Q0<8H(ph&t)&&TNE5uEWboL@jQ=YpL_J?_zdo&wyldhlk>0N
zbJuc9nyL7DHK$wBjXNLCeDJ$`OzG%i=heA;OV@FnE195vlKtL|b&<|}6`9rYE+@RN
zomjKh@UWSaQD*kGyWd-#L#OQtWv~?4nUb^R`tjwz*<bco|K2}m{=2vGEloljG$+ko
zVzq=N@y($!Tk9(GCsQ7!ls;YhW=pyAEiLVBZO?Lx{crisxiFirXnNfpiKVCG9(%?`
zM-;HhSDIu$`u#E3PyC8Pvh3lWxx06NtY<*I@S8_R=}09j1H)<o1_lMRbGJ+Lic1oc
za#G`y^NUhb5=#>G3M#jT=l0)n6Zm&-y@cx2oREUJeWIM9qAy(otI7lQ<+WTVZcgXl
zaP(W$?re^(Pxq}i-!nB!FY2A8B(SFZ+05_a^A6qJ9bSL-{{+b}w&(dpYu3bgU*Z0-
zR_vzObN$KBCokU+^fmDG*=vVRKi98o{2twsZL+FK=6l47T`G1PG)|pNSsTikxhpSc
zv7xWyw5^xKTtYRq*Mv-+S+PjvPO4Y3-WrBPg~#&$_N556?%^-FzGUK>f~}!T)-Mm-
zdYDIL`@0`v{gXTE7x@Hn@8&(e>)NJG4^uvFw#^9iKXFVtwUDu0H%#GEOqjGl)#VMT
zX>6s9hZH&vY3yU&eN<@8qx_)#OR}eVYp7k`v~7t$t9|VMy7KDc@6TUJ-u`kXXQRe5
z^`y@^lOE5yc*!pyhC4UFUtD-Wc(unbkwTOC-HSTX6pYv+-HuKA9<*9|NxP-g?w%+n
zCUM`y>ETOE&dEHu(Y<BW^ow`HWDgu|IK<L>Q086#1k<SEl=rUN4r}=@dii8i()V7S
z6Zx}T!oOV6SsY&-<-#c&6*<SYPohK0_|pFq2hK@X24B<s?IE_p_s-u>a*^7+tt-ro
zIn3X@=+l}g<}F;Ev|Q8Ox{pEW$IZe^;ae06`8j@kRg1Sc#4zK;AEu{XQ<tu=sbmTK
zw0%<O^1P<`8z&s|^S@J6>lAD5I`N%nJlBIHff<cG+Dgq1W>;4C8|XbQ{1KjU@~6m)
zLP6OoeS_I<&(zLUA6((mX?&x5kz=3BKM$4}cU%w5m5CNuFk9=}(KkCSWi_1>I48bl
zDQ>#O-F@+h^y`z8CsZo*df%50edyUJ+>_6myXM@?^u_|I2a;MFJe<u77gQwNJtgin
z{eq)t;i)ey_qO^TxiaIV=|q7&Z7<dsEza@I>{_>3X3D)nWvhchrze`de7fH4)n?H>
z8Qhb#?7tq(x{;8tZ2PVC_Nw1?-mfl3@7T~3Wt~~lx=V=FWa`F8`xcx#rrfZ8?tfv9
z8kwIm?`NNF+qzh;mPf0SalOc$JNxo~AL%*J`CLJB_TJoerN3E{Cm-@ZnSahfN<`<s
zLSGt(j8%ZS(X_WmJh)Upu^Z+_?scAVrTF8Of?DI73w&dxmZb#W@#TM&rW^dkdxq}4
zz(t$8+SJ&e6|zrTw)0HRthPJvm$Ii`?2FvTvggWbkFyixBxUA!W^3QRzmVtm_bXHV
zpRYfBs_vAnwB1gNi8HT8<z@V-D>^r|;=vConQu&qKHnR5g)U$D<VCPt;l|Ao-o{I<
zGwvi@op;Vep~3On#KVVfDA?qlb-a};^Hy^~H~Zlgz3<jtms<9Gm+nel0Y3IKTNl2l
z7rMWC?T1%i_Z9A~*zhNOZB;qn=i+5WJ#~B5>A6-M`Sj=4N57tRwOm$z$|f(^lC}H6
ztRSfvu7zd0AKd(N$KO44UAeU1OOe%o<6dNxEc>h2!`i%M&)(|aRi)L%U!R!@?7gz8
z=(MJx*Y(RWTkEw?))-5PUyd@LG2^ku%&=oiaz1$Yz0t4AKblkEn)CmhY3|DU{d1&?
z{>$z6o^XHTxg`b3OZ=m@?Y2B#wP9KOwkhe}eDV9765hJ#ENW5kPJDcE?N;@3U*9{)
zt}sly<6F6Z0b9*N9lz?Q|D5@sJYI3o^4jxlpJqMU;{VcUng6cC%IkN0eOi?9UC#ga
z!=K0b_3bYGJjpcACZuS?yvo#{{vDalOEzB9xhnZ~edT|%#bW#ixFX-`DSo`0D)Gr(
z!DQ7%Nxo^jyP0g?cI@DLYB-nO)vV!zIp3p=DNAOqdF<%cx8glp`6+2@UCz2a{J~3R
zzfI<|+E{<u`1OQODQu-7Ym7SIYJGirvFBY^%96+IhkyUf*z@v!$m-)S%F2^=``ozs
z(cpXa)#QRT*?oMgziItp^jE1qa_sH>&r802-9P`*IY(8Oy8rB`#dc@@l5Pzi1_mQN
z1_l|_VmrT}Br~rhwWy#dwIsC&RAfiJF221(@c+C0Ow-Tso@{$`qkQM=FymKOHqN~=
z`N+wbDSqpvrZRU=INPNZI$_J&&oAoV>&dY=1o1E5Xn#UQuKTY1w^r8pN&558|F`@x
z;ao)Arh}=6K55Ne-ot<LW!Jg9n-7-1`0+y3Qadbr-n~0vPnJKPJfHo;=UF}Zl0Q$J
zQc~yKogBF_>QG9M;Vv7iS)Y?UA63MKo2D1~Tzb0df#|}@xR5Pg-Fs}Tf^z4)T%NVp
z>$9|zw^5jglI_Nblb(66g~HEY%D%dW?d3iHM_+BDx2Lbw(3i~Lo_4f1%j<L3N73{T
z)xO@#-1nr4EZv#(ePNwlx<QVc_OzB0w%(6I1CLF)Kjl|#q5l1IU3(T~p8Fv&OaF7F
z;H2+2TKn&&D$kK&{<E1?X_3SZt)jNe&Xb-Mo?P{#FD=t)brbW9Vxzue`|J00oc~u>
z`0d}PS9d>j9Jue-dE|%nDd(Rmm3Qsmde{D)DgHlk^QoSx)#97mxkOIhV@<KJ^iL1<
zuv_BLk#>z~uk|-pmL&J2kea%WKeu;pzWniMWzDbKyY*98g6hsDUU;%gW7C8wqDJzH
ze>*GM=4)=N@$kNAG}p^3|8<Sp$@xt^9`2u?R_DzZpX6@H`rqabN4~~2!(LA9bQ@7)
ztJ>F7QaQJ9{qy<!W*dXF_QGVDlUp;)Hs0KF?9jGrJ2DD;C8A|do0M}NV7n<i{Yzqc
z{iPM!JlV<F$8woEZ|W>g_1qUCQzka?qx6}kMB@kpZHEo&dl_F!p8bB-X~LV#^rN44
zS)^#*U6LSs%Q{bZ4-4<U#2R_e11mF`CRj_%^80n+?Hk7K%U}1I%Gyq_TD#?@#?dbc
zj#Hg)ZC_z@u=99P)!at8mIb1jH*GHO(%MtITJEH(>Thv=V>P*&x4p`OBD2bl9^qPc
zAY{XjIeL+25~Jk~@K|=I9W9!gcILa<|7Fege(e9P<o>A2`RrY=_0rOhZj(|DJrhX2
zWV80s4gE+n{?a)P{6;GCp87lN*t9Rsb31G7vGz(v$v>e#!kWc|E}zR>(dj1tnyay?
z<B*W2l%v}g#|g)Kt#7YkoBM2Oey7CT9)_DgHWrq+ZRVLi+a>S{huGX_**i`2tmi&D
z#Os;(c<BX)67MGNk7B1g#CIvLU)uX>;j69nZ+Liv`$hEsJ`T#vuUb;|R^I!fS5!~e
zwto+cS3az2s(RaV_e-AADu#sAy|SiSEY{3caaK|y=N*+>SHHa2*R{T#FaLXHDYtOs
zyXei%hdxD4YzR?azwTMHee)v6EaUR!T-w?~DS2{*Zo>8%zh)XJGVNn@pJV)I?}I%L
zJlc1bSokVB<QqEHzpGtxbI$|sX&Q{2n>^%n>*^m!8!i7ZVZtf}rm&dh(^m7JRK8tt
zu#6|8vuj<^>KB`TJb&!Nen~-yd6!e(LmA76Z7#8!JPhnNaei;QXyR1H(y8uwTEuMr
zGvjB>yAuz;mE7=CO*^eyyMp7+)q=U(mIwE_Ce2`Km%4Mp$-}45=)})YOc@87ULDQv
zxAc&@%;r5Y@~mQpsf+jY=jWb1m~V1-R`H2Tk7HKJ?D^K8ETOLu*ul82D>3Q);TvL)
ztIPXJcWw}1Y<jgc{mPmXvm77oOg|%c=hueKKkglWnb-Y_NBlzQopeW!B_Ybn2_7vx
zi``}gyf}Aa8_(kj7T&KU9r)KVA6iu6Jz*w)=VbMar?t#8EnmG2snGI&{^j0<Yjx3|
zfA)Gzj;`V>-1^LN-RA6hsrMHMZ(rl{Kf$yAsz#R6^q9g1o)%UMjz~R)*O4c$d!L;0
z%By0MTbktRJI7X6Ri53EkhVH!;)&+6^=n>s>g4UtnJo7(p}x^&fv?EC)~SbfRctym
zUn+Oy9JynR%b0C>RPuH;*6(<rq*8va=#!1O<EiaBe;2HN7`uLlLALab>NGBimfDgS
z<xf44y77})qnq>BC>q2#YbY8WX)f##+45AgHD+?_9eJPZstbF$e|=N5<T<@w{_-BZ
z>g}7~#IFk!FTbgm<-qtwv`BWtt2GNkqyLsIFx3;|Da+xTFhRUoT*7C9h3d|LXJQ`9
zm;^oL9!n*yoW5B)YH7KTuT~&u%l)p>YZ0~~Gw#Z}@88qsXCPW;d?hZ1UEx~dg*egL
zs9$pnj&AuP{gI_eY|)e#E#Em8IF)>0o%`T-L)RLap4Xb~dx}o3D!Im-zfJZ|&)M6n
z^W}9`RqeG_+@-kssZjexj-YQUA34qn&rXeO<-B!vlh|jL;2%@cv)?MGx%Q=Y#jMl0
zl+9uG<mhT~7bBK;d}d;P9!G6uV)$=eh`VHM_I3J;9|wHTp3pwDR#&&W_;cTZ<yKM-
z|8}UccJbE*ZR%9r=cQ%;<otvW$vR3$WfC;J+A`Cuqcf7aJtZD^WQKTt<8nP@lPJ^s
zT2w~Qcb~wjJC1I=`LCYv8%;P+$#&^@q^P(}<C}fCAEJ+(G3sIYZqOc}yorzdP)NAz
z%u`Vvl1a}m1-S*rviiR3-s5}2)Ns4`y)3WpYV(dRhEvzhhKO1lwrqX+hI4jK?wW6#
z^yP0gp8qXo#`0SESgvPnhP;l(JPn@t!VeN|1^Mc#e|yWb`pU6LjV-L@8G%Mt*Nbf?
zL{0BroMdhK*3!A$@yy&5zU)mM{_zPnAK9-lj!X_Pjx4+09```@v}?vou?58u+F~pE
zTNnZ_U+@xd%rySS{-M2f6{Gx-`48A*!aAR4TV7`0esbow<Rb=MK^9^U4#%CC&9d{c
zW43<pPj1d50^5a@EW%H3>pVI4@9f&tL_dotui)g&JiR-~6LhBSPL*D6p%?mQe<_zw
z|FJ!3dEv!#4YTg&|LEVfPIT6;(2P^Q3)cm-?ph-<tLfq~2Ei{UA58gtbt;nv*V@fl
zPb&8Y$821?X_xkd{Meupy@o$7F<l80-n>40Dd;PkUf|hV(OiwoSj{Rj%$gp2eQn6L
zJ}+M9%T5_vrn`!6JLBuy8fO>qJACqUZdX3rz&G=`c)tJsI*H@^<Kt>9_V1|@m$HjX
z7TB7><=X$cW}^7_ol6-T*Vg~yI-4)zf8c_JeDuV(5zC!t?O~b}#pARsue_>8@WQ2M
z`g2}>yt1ugd6MkZo=-Q|u3ye_D{!|+>!SB1!4^AN$|vlu(@GXS;%wkE_mp#lS4QP)
zD`uV$<>LL44^yLbc#jl_ZQQN2J9(dHoLlr{NrBC=y1kc#T-d^E*rS_R3{Tmf6z2A*
z*AZ0o)%bLxpZCtG*DqvOq{zmyn!NNr<91@hg1Pfz&F8;3nYJPIf|%>=Gs`*Fq#gP2
zanhX6NvcJ@lULm_e$Q8H5|)0{Z|a3azqvb$X3X%{X)9pae*V!r!9Cw)cyH*Z=$tvZ
zxM<;$r;}yG7r&P<mu7c}h;O>G!Xbm1Q9XpWWzM}DCyp$$V@+S8TJ*(P)&1Prj_7G;
zyJmX?PjXFP%F#b-p>MNNHN*F3FShtbEHU1+X}h)2$~krJ4MEda-oCTzqt-d!&U0xE
z&lk?SsjxCCX1Q`~@^8PZpPZjbg;prMwb_3tOGvGG*{MTs6pOaWy!ifR?LALTU7g>{
znIG-qTC)2=G4tF*MczHPg_f5c{n?|pUf4^n?NI$Tu0H-(ANrU5TCk?Md+(QL62JHK
zT4Zm18j#){&E>YbI_1XaTRd57%MUMlKi5V5(TC?(E7%vUZ1Hn@$9i`|=9ZIteX7|?
zH|gE@{%Z1u^1>A+N~<Hbdq2M-<R4(Q_ri+&qZ2FdES|13)%wJWTE@Bm^weIQkNdJ*
z+<NnxfTwCXJ6ByZ+Ro)<9{DzBQ!W25p6EL@JR8fKr?!Nxxok9hhK9msw-vsdWB14~
zJ=`_>%$9WXFK<&;y0^FR+&1-?5PDAQN>b02|F%(!ivIt<T-|AOI(W|Yg>lT;-c1K(
z^PJzrPP}iZ$8URepNot=!=<IqY@_<`Gv!KWh1}S?pq@>2o85t*({?OhR{v^eiM0h+
z+YitFJ8LG&H99!iH(YtgaAR4uiGQl>Dz);C*|$pf1iyP;ZL#q{ipAuY+jx%uJMu{K
zv&>i4E5*O`CQjQn`%Ixv8hh8Qx6jweI9o1wSGuCCU6AKVXs2q%{n-_^se8{YU$9Tz
zFd*l=@6T<X&;6Bb%Gm|QmX(Li*nKo5QNw!uvc2^krIVXHbzClbSEw9hlj%IEeQ8(2
z%~?fVy*3yAsLWVbUL3pY_RS^SudeJpd-2r2$+c-KU)kO-kP?XB+q(O;f0obt_Tt&=
zl1uIVtJthJ+x_@0c6`+``@b$9?NNIe&yU48eXwF+i2cLBAd1<;$j>X*E2w;1`?l!G
ziHSGr?Ob(_3%<B!R-K+!I;~&qd!O~;t9}{#Y@WP%btX08BCiRjAnz6i6HDD$f_1$1
zP4^G(e`Ee}vW5LCY1WcryCv4gOFgVv0;Yn&%&Akqdd%5Z`)_&k^q)4`v)?>$oi#Og
z--*q?0%X=t`WagGq2yP^`-v4{Yt2gQDzA1e@1I{&{o%{U%l8lM-n91f&0T9>xow%6
zvEHbV?SK7L(@@Q@(yz~R?pc-o|Nj5TtN$HW|2yu{xV@&K|Ldw%lg-wj+Pl{^R@YTV
z|JvJK=N?5o@&0kGYl+V4X<a5UDRH8#2abuaIy2kq>?@txdCrqV)bcm)TD!_=`iywh
z%ALy{u1#OPB+uxp4ZF<M`<a*2J}YI;S`)b5#Ng|qOZ96feOq-Rz53P8yK6pu3R3B{
zm@GR>Z=yngTcXh|;SawzYF$bROUY03SkAfEd$a2%y;~Kb>D_;tfAd}R`h2T)=Jd}=
zbJH5Xcdz;^6u`0fv|Y;QcfYgdiNx+Wz2wcF?6k@UPnXRMf9kYfeVN5igY#h)IoEc-
zzdrrmYo+`KcJsoZ>nGLrd3Kemoo04^miq0@DyFizZ+cZLMI)!XmU156Adr4}bA4sC
zkp1tEPj1S`@A-FFF?87`8;ink3t7vy-+ZpxR}kcLguk-$|D4>gn}rkAdH<iRNqyi`
zoN!Odjq{(i_bi`A%h>bxy!I_WblzCQ*#DM}t42H98Ve?!`_mf^{p9(Pr8H|>+p=Xh
z&RPED{lD{oxqhS6k7tjX6y&DQHg{QF*AT*2fAP24>iz5=B7=&SW*pL=A9_0S>Aqiz
z-UZiIPS+EdvwC{u+iMoN!T()(uh<?-<Zgb*l(+Qz=_Na-t>4kD?z)Y|aLN^-Q~oCy
zeRr&P(UR!tOfV{Y@ipu2BbDFD+fJ%%^LQlivEz&2^u|XG^POLF%Uz5Rw}@Wf#V1fz
zS!eb%$g}X=;TJ`Ey}HfHmdbrgO@2K-f7WC3ZI+a**&^=tDz1}z`M;ZJ3QwwO=WyNc
zy?NQ!`xjhF;?Hq1E>XRhng9OhN&e&S<L4dy|LM__r^Pe0FK}k%^FJ*Ma$9@gB<~{I
ze3zN3rks^-RWrAShjJ|nG>P2S(s@ZGbK}f+N7H>cUmW-MwC#GdIb+XubMI%@BWFIk
z({}!O;LPdueiPX9r2gsa@brI;_x~Dy|JD9~j{m<}|GjR%YX7{TUjENoXFv3B(lUOq
z?DU#FnOrk&?TU>2mXyEkT(`)P#-CfX5^4{e$~23Pe`T*FaWeJab)BQ;rEJA37phIO
z^q8>!()`b*m&3dnxLmBAy$=3Qa6Gv=<iu01FtrKyf@9=f^Vm<Hy2ICON0wPQ=N=~}
zX8z_i5$1nbHY|{_VeIr)+WpLiA>z=Ab<a0^@=GZ7sSHWcR<W0kcxc41@U_WhO`fyg
z-^cH<ss3nHSNrGH6OpP~_c?+ei<Hx|k35R8J(=omJB#)Bo`p-@Y(FU_&-2(=u>Ulx
z`~E=h-p`9N19N6g-}7n3@?)-(I%fO|JtMW`p2~tXN4Tez^uE*IysR!{&O*%te-_An
z*%jH`@+toOs&8I(r+v92W5Z3?`2A{4^Ko`@*r)Nx)XUkoJtcT;^j8&0!;LK3yfI<N
zZ+xs-xBKq0vs?|cpIgPRY%iU;UHZ9Vn%Oh+?VhoZxFS=`BNxUC{rk1jFYMzaHL3j(
zAzy8}#T)E`jN)c2TK)R8guBB2o<QHA_0LZ~v6^hv_xa&6#$5*v|CQVD>f`4h%O6jF
z@896N_&<}zmPh;7ea`w?|1W%tc=(ZP*KexLTRf?1#gXmmbJg4a>rc4N_)d;n|8Lx>
ztAGFgE#DEw%w$pSbx@Zh!^wBQw8W*XyDRiF{gP%Jt32h9@viw^_2gy?vCasQo9#7i
z8Edp&97u{?;kn-@jLUCkLzTwX$*XnJBYU~Lcu%)8B<UUHc;Z-j^T3gP=Ug_=^St_N
zf<@`6f@3P)S|X=b)NKp*^q$}m$mns@t>FpNQMuDsKd76`J=3t)qmJQ7iS7AiU1CLR
zyJs)Tk`6f1e?-H{CGeIciwDoAQ*HIf!aa*yH_5$D%G~@d!h<`%P~_3X3f@OjOYf!z
zo(=eYYTD|u=BXRCy)VRF*cZW><dqwt5Oed_!rcdqK6RW`{8sO;x$MG1qusraFYd|c
zNn2DWm7KC;#qZh`{O(s;^X3}V1>C8e_wUEEFF87V`!?SUYHYaZu$XIlYnEe=M)g9m
z1c}?Prtxf0X;r^?%|Smvy<sxzSw3E`TN!DxD^Gk8D1N{mwEt)>pF*R0+J|RSo%0Xp
zSk(Pa%38emKU=6YkFnaE%cU2(ua|O)M5lhuu-SUT?$|@NWn!<3rk-EVosq0`sq2Bj
zrVrQG29`$6Ir?$o`cg&vSr2Du82NKd-MBI~zp3KqqsMb*@4S#|Y~;aWQr<M_Jgd{9
zT}uLaN(~~)xY#1^^$G0l<VbjT?bTuas1OF{yO-|s><?b;8>XYywpZPGj?K%&$VYxp
z3Z1*%A3f)3<12N!7CFIqqvP3GZVMSzKW>W>*WA;P$o5!PqLi`8^W!GgFW<D<8TYZe
zomepCQE5Uf%UtyZcM75>m8VM<1hX-fZPjb&^!$=~#_O`}{NT@S7c-Vb9(%j&xIX8$
zXS3EVcKzaXD#Y=%(ibC7(VG_zvD~_Q^7!uzn}+6;_HFO-uWjpFm^x=mM0cpigu6i=
zPTfCl<?;O$-;n0kE@*yQyH}C(GJnMOlMdAx*$MG!BC0R$?z|FzCzAinVZG3^k1oz+
z|2wr}=1h)1=_UqCk0nQc_??hYbn>PHAKM&`gm<hr=CD8Bks2QE#*~<H#>Muvl<F}D
zjSbdGXYE#JK2a!|xpm2MFP{~zx8JGT=&kuyS#;l0=1?+=ECWZdQseKNQo@lZ7EOo_
z>21_m{;XB6<bB{pH@TVO^Z1x$Ik<Y{5B{2YW3xD~YD`VSvh~t)_IOQ_a#L6nG2!ns
z^DA?HUK5-WBT-T_X~ts1E}xq8?~Ff>so7<4$YvSK=wx2Kl296YU-Ch-<j*DLnK^Ce
zA5M6qKWk5d?*i><D_wmT&3=4gn&vc{g_owCd)+O%JHO5C(Tk4T8{>c3R>p4CpQc@Q
zCS~R7z`wa0|Gt{MfmQfzcLI0o-i>be%6{H=o>cuX%;9I_)Hzm>j2E1jvLD<moi5(>
z@84vOU#)HX=PyXvz$3VRx=Q+2D~Fp7##}-9!SlO6%|CK_dVJq>`8&@UmEO60JnwSh
zy<O+L|7{UFy(j4(K0R0SviDE_q^EA#X)ZYxCK3y6t5T+URr9>LDzf`g)YTVnYTkY8
zNz}b@+<b5I@!u<$3#Km&Xn40r>U+Cffa;s;ebS50h5ePC7Aod;Qs(Z<clDw7{afy@
z`Wh6(e6L42@8kTFkB^GYbYuMMYj~UQ2`{7R_i0}eosQpPEtC<=FPz-;#au)0*;S#r
zn-)2|TD(}x(U|$KK){l72Q<73>_sXM8XZ01c}?y50)yh;m)3uMU39rHSJ!;agTG#9
ze)pKTemR$!Fio48t>v%s=?$BmZaH7u(rUNi>(%!L8$!)B{)rru`8RV?bt%iTsVlW&
z*|vm>7D%x$OgzpZ&y(BGu`%iSg#H!sfjbj>9_&k1nXjd@{NfF9_ZTTr`+1y!<^T8>
zItiZ^w)6F9lSnCBIyv^JM?>i8_xofw<Sm@=Uo_75`PE%1N)7Xp4^ElPQ&G=yG=}@q
ztKCayq??Bp9zIon{NnL*Q)Txy9qw~^{Nr87m35M<rx_cqI(g9Z%w-NW&4?(G?*~4!
zrK#Qs6lQeO+sWt}v_&FNaoWwIX;*tqTkBV3NgPjkIm70D?RVJ&Hb%ikBD$-%{vNt`
zB>m~Cjdz$M3dPn~c)z;)O0F|yRhzr;_l{SyH=PSg^JXhbiB&b1teTnTAvwc5xAFI!
zo4#Sjrd=#+E^BX!pBmg9$9OYul9In}hNtp#vtO2{SJ^N)?mWfaaOBdOk25cPnNw@c
zef+p{x4GX2yX^h#J2PyJ{o`-0Nj<n(@_xl5;di3e?k>R#+4K8;A5{4LG;aDIwqSp&
zMVEQPr1+lB{HDBO`s>yWVecH=cN-gIKH9Y^YI9E8-KXbQeNxl@%u~BX$W(^&!8?J;
zE{|89<=Ivztn+q(^QF(1KTeFb<?6V(_6G0O(t^EBGe0j4SjyYee|X9&DVOyOms6*%
z<KF6+5l|LdaFfBKEX8rLT$ac5$lL5EC-3Tu^PjLQf~P`#L*(Wgen%#M{P~z$-hWez
zNnU01?Im`<S*&+7_uZENa^&ul4YQ{&NL@HxPvZNcN0}zkD;QMxLVu=ftL3fwKdpMD
z#L>fF-O?}Hr=*5G|NQv}kJfI*Jgv5)ccpwbr^P+jHeb@};$4%`{>V3eO6Bk1AmtRT
z%_lc2sopog#JlU!@l75dw3uFB=stF7p`Onhm9?jm7B}A1)!(pmqDZxo-0^GA!VNY*
zIoG~LUi9C`$OHUd%BK!}_OO4VxhwSL+m7u1wW_U)E+u>^+`RPcv+z{A<+`!Aem~}z
zc*NBuf@^<X$Z-}yn<YzH85c0?e*EWJ7a3Msw(rdBpRF%f@|@ZHyW)oMTGiz<`HsCZ
zo@=?QU!gr+LR4a1kFwah8o8|-Ubu@#^jCYFK3%!xfMJhb+ruW^%gka`M_P}~t*rBV
zue)e%!n;6@Su!!Ux2q4`VdD`q4iYx}q<p`lMRxM-5Y9xE!v~w1F7_>X&7rD%R<1KW
z{N|roOnfJd&YZrw>+LFmi~}c6t-Uj;PUYKkiCHt2{$>)J`Bx~UeRfWK!@1UtGlQeg
zt6VUe5*Rk^qj2%9aF^yur%o(rtd;puyE`=G|FT(Z_j-ygZoOeSn*Pu3g7pTqPfKsH
zR`D%*$F^*~Q|pmLu3ER!WleQgDrZ&ZTHbc#T@z@=wqR2Ego1F^2`l!!*zoLl*u_Os
z5(y%oHk=OI=J9WG(cUvzA}g**CH!+?G&W;2JHA2X@}q>c5@*ae-0AW;{HQQvnHAsB
z?x-n6tHYg+ce5xzHgh*owbQ<T`ON%&Pt94`d!3thU%2R6w`R4kFw2^bP1fpGe2d=s
zZ4%*Xjz0O#?vvzE<A({&Z`F5}-?y0g?t3BA`}=_tfB)soJ9U2jAK&!b8y|SQe*3CP
zc!~|zM!{CsY^R?x4)W!X8&fR3Cp#DReXc*G{jYU%m9oxl@$2hbD~n3DPn0f_$&Wo?
zwfeq#-|yKM0*sYU9CXv>mp<sgYr>W_XTp=qvp>$*DafmHDS&fjrTWD1I|=DB%r+6z
zr$0?dz5ej;$GeklbgY%#I`r1rUHLMjW%HBEH@Is4+huN&JGkx4=?MN^)07l4BTOUI
z<bT<{_q1X$EkBx)%bF^hFUhZ)7sbu<@-K^N2)q7G(b~J0=T~0xE`9gHFK4la)0gVA
zsv9ylMWv>4F@L)|u_$`=sd&@4Gd)}C?QA5zy*JGXz1ey;T4Lk71wDUeH+cR`SNP>o
z_u~$C$K_W?otJj5oyd~v87`tx`XI;3f7Y}|A5)(&einPp>|E&e_g6uM)W4LoJJ!Fd
zj?(=tCK(mr#TDFIX~x@I+p*qb^W*LNzjxV698F~D=1F19&{RG5rDkWGR^y{>Rq`&j
zN4AN*x?g$J&iK{oE<Z7aS0~%`Uah+N`+(CsgYGL5<q_BC7CR}&H%+>6ThDx{aCP^O
zkfmQ(id0lHCm5NWn>O>WwT4wk&^eBEdq1<Ce~_TL_{q5@9_KB&aVJ<MoKIwOmM!b-
zOPRmjlhH+P=F6WRdyZW;z5jV<o2J#FYX(9_QCfblysaXfqzja}WTxwyzIe9u=)Ie_
zA6E%&DNpm}nrO(pM9|^z7yFwDq9MKeSxTc`TKNC)5j^)|8{5Xos+w8LGR?$mlF}Mg
zQycE)26;U%R<`}-EfV(1A<k;+wId6AQ@5I0tKTYIICsaLS9Q~mPgT#2m(#TAe-YtW
zJK0ryf#>RnyKdwvec8QG&R;_*Z0F)_e$yB|uD-APZY_SR?0swggfBZZt7<j&#J`!+
zEBAlfE3ZZU*Y{lYU|~BX#lBp;XswOVvK)cx&pS6yU%YH_(0ZqRw$>(JyE}B}H2j^!
zUB03$Iy-L4o5Kem+x>m?s*kC^e1^rfjh8oE{9f6UEa$pYKPURd+#Pe~<{17ts$1Qo
zoXTpcs_|_ZcecyBovwkZZ!0*|0+Oa(wL5X4Z`Zm*hu?%v+}&NYabxJs&#qhQ**7Ot
z?w7x4@aVqm_oEfo?kB$H{O5D4ZMl7{gU_xv_MJhtgqF>xJ6)G9EcV-OwclgU+F5O4
zc9GoYjk^LDHMt#Yf5i7?+DZ}S+lr6;`M3oya_yVDV@mL3;rdwlHA~a{U%Z$dkry_*
zPvXW^!6eyf+unLVesSq?VurVi=dK?)Nk30K;mkPQ^f^~VCnY<2OQ-9v#(V6BW#(^9
zkG!mUT7PBp)V{0BAMVVOy}pfiNki<e{rl^k8lJ4QPO;$g(D>LAd@gpvJ?84uf{!KH
z%tCBVpD*3(b^ZBujwi;EHK#ZNcw~6CZvOl7-tM*gj;%d&)w19IQ^Y#ueEZXU{`aLs
zPrP2RT)4O6*}ikPo^~y~dtKjZf%4*JtJh*30xyMb6z-LL^iV-{%J$feOO@6et<VWu
zI9WO3n2)iMNcS2Rlc>i#mUC3ptiHcvN`#rp@A>N+XBD5G>sQ_4QR&M4z<sl&73;*`
z-VR-EBJ0X$i?g=v4e{>j+v)WxB;!<2k?_ZoUpFSdp3$4UO6tHxh9hToTvBprpLC_K
zeZNVyU5Cw+TM`nL&uVWz?y;0;i#KI|yzlNmF3VkeBi}x1W<S_><R^R6pM&q@uKgAW
z^3?lN$J`@peX{%GUEB5B|NY{ApIV$XIYOW1M{UK+9wisnojey5@4pegXVp9Fz{!YJ
z3#am~5!BnPTBmtx_Pw;kulH|l@V)kNNAQm1$Q2uJx=yjW8R#}o@Ah_Y#oDE@r@fOu
zdCZx@d%*Rz*qIWeJ>k-E?+U&?zRP`EQRd#Aj!i=0nx_IMKI{D_{aJRwR^csgKdDW-
zT6XV`!ex)GPaT5R+VM;|cD1oJ!k&lktMD<yy7y1zD&-e??bo}kyf}8@$|l{D51T~Q
znZJm4^Yr`lH_Z81y`trR#oNbnX>)Jx(&0Gz&Fr+-#d~31-A{5e9(<~Q<R`msl2s&E
zL$ywh==($etPZc|^@tGo+30lVweu~fgPKW;9VT{vUcF?`nV`y|hhj@xFW#9l>4}u)
zNtGS-*_{zwJ!kCJ7}R{Y-qO6Ge(qnbxq3mXkI&<}w!*MvN)wCWoVG*37KP$-|1a&m
zcRMB7iFx;_uWQ(sD*9Sq<PuxcZT!_?Y0YMysyCVr_0P}!x>2*Q?pL1X>cx&eR!`dl
z4f}GPj@c|KKKSXz=kTv5J|Db!p}73a<+z_-lkAdw*1TwBYtxQ@Qe0$q%y;&s4QIo(
ze?|M9(7bx!;GqicgPcVPE}S=B-YgF4wV2GsY8N)ctB)ZtPx*|=@yS&auk%K4`P8GY
zvubnijP==5WcIL}2#DWl*e<BEz@c%&u?F3l<;=mV3)PmMGGi)PEPdh2RVUtvOP=3c
z{yh9ztyq1OO=^mMbiy{*HmS&_M)Ro^ZK=zwz6M0zwVE~ejK?*DaIY(zGHI(9nr+y;
z-mktY?ctS}zy#hPo!N1IGxxYpfBNg><dc6+3R^$z44M9eWj&8c@Y&|Nj!l~R({>zF
zWo5gS8<D11fAgfxls_RKuLjJE*?Ylx)8Pg=BU@gtO^>JRPfhDy$9VY>%f!G>@4lQ}
zJ-J}x%EQ5Lbj!^A4fjOL2_8RVGb8kP<jvnozcqCJbgWu^Hg|hN)3M488o{Cx^Iol0
zoe-z0{bIALcM9v77KY@=^wml;Cr4R7Wn8q-aZX0b95G&wyS(NXWz>%cmL@19bvd+8
z4LzqCc4kHTk58}HD~FvCyC}PF?{cGMfqS>=Xs%N5D`92Y=BHO!%(8>um+Kz$g_pb4
zvRbW!LOwAsxA0pNm^Q1Xge|ivrSPxl7p-lNo!+i*44ld&%$Cu@yg;PFw&%q0PtAu8
zN*Ai`+;4YDHK&;=u;fapi-6<t8R{HuX@Uo5TUQkSd-CCtT>q=>nJaEqvvWCbtG;!y
z)A^2J?D`8VayLD8+$y<Y{_^{kb@qGDnVo&HS>jgT=IxKOW+YGBFr}|k_N%qbzia<k
zSyN-<nhW$!ny>B=D_7C|bMaD6@bR<|o#!(a3%&6Bv2QvD%i6e|mO2mb`uFl*6IxKt
zr*!VxMlRN;sX_+cr+UBromHnO@@7h+^>OVBiZ0&`)|zrQr&$O(+~QnYYxJCb=Hj03
z7PbdZaoDqn8z^i%5?CSCXxqN{wq=caHt)PoZ!P?rmc3W1%H4VWslr{!ocEpA`qnkE
zzW-uWn*U{L{3(x`yO&S(Z|J)FfHU3h@8XqhLNDiasDvtn_%s~pz2@_7$L8<M4`lg;
ze^oHgTiSR_f5+!nQzpO3F<x@Z$HGMN`_t>6wP(Cxe(>FPYkK_3IWt3+Z{R%jtL>Gt
z+;r#N4gB7XTN$#XCc6l>O!B$J#rry%_0}`NStYUQt%ZR%WbPQR78S2yVQ<*5eCe%6
zEEnB*x|M5AUU=<ktmJ$y<eugdWly7*nwo4CSu$}wUv3J7Ut6tQxT0o<Cf9EECO*Cm
zEcJJb?Ok3xIDXkGs9MU^aFsNB?3^E0_<d4e7CG`hyWq>QIw&jBJ#EJ{Po?dq=kA|Y
zZeS0reVl%Ycg@TnfgIo7EfPN<oM*epR=-rP<>vWFZ&i`0`d@x_mw$Y1o_~MtpAV1x
zKhEBsu77Wjo$c{=@pFpj-}JvY+x+d~36B&fI%=PhH?dgkHBao8l}yAgyDN*WY}e^u
zzhN*pnZ2@Xs_25d>%_Az*gSpzYuffhYrgC;>P{(mlabQ&`&O*?eW?wW2cF!T7nrXd
zSzJ9k@0j(0P~OXIi*uV-Xjq-n%?-P5+M#`UMJa>#dDET=roG7zU%ZQ3(II%JT6Xr?
z>#H+;HQioL`I=I}Cupeg_@c!HZ?zwlM<n}{O}x{%mRouj@f(La3iV~3`Tj<KQ|_-t
zKOcPg8~xzv<>2)xhmRKAKkIeMBz~C$>r$OX3vOHr-4TAK;<AeGN9~PwPOu%GQ(nUQ
z=tR=N&L3y<B_yBxb$?|0^5LWFTV|Qx*O~mwigoLo+3&AcUVQenu_#aHa(t?u?I*@n
zJQc@gut|$F$cppM2<HiWx_JJspAE|&nM}TSHp}z3sxE8%!h-#KZ+(#bDC2v6|C-NI
zx-Z-x={|L4yM4mpc<YiAH*B4IT>nk|&%oPoq2l`+>5}&P%MSaynS;0dOglf#H0a0z
zT?RLUXF1#b)pk|xER{+w?%DNdNmToyM^iZk4KgoUFE=jvmmHvO!LP3w>$Jb@@~8e|
z*Z#SQ&p73yvuHB^%{iC*xhp15JU{Q;*5|1v98S+;#4Z+}d9mk&t-!sx4ABOgip{!T
z9M^IDAExgUT%{c`^M~ZgZ47tW*8Vhb(b~Z}$4f?c(eyddmK@#QxvZ(1{FE)KvhFxa
z$T3=bZ*|n*=Fj-9*P8odX3uqoIdU1(HF!cr@3F4%Y}94E+^zTF1zWK)Ph;@UZLVLm
zG_QMJwBHj`#9h`qQ*8Ncw!{6~1cJkEuwC>1qr2#FRo&F>40*BX><mhWA2Vp2*=54;
z(b$LCy3yicum4}=)UNC``UcatPRcodZ;$m)p+&wcLobCtI>hiN=Hm0b)L)txkN%T>
zeMd=NfVoj)`;8W@9qY}+ZGYVqtW(>#t0P5c)7!_B#Thiz=a)JjaFIWr_IkyB&f|VB
zQ$nxH`#JuN=~V3r>`V77ZTrp~S8>olDThymFUEo2@J3a`dTznei7s=39W}}Y?<bt9
z56JvH$@aVbQ(nJWm&@ip6O}t=b|JGoT>0?Ni`VCvJ4;P1Hd>@PT}aL3)9%H3HU+lv
zllsohW#4t=fx*m{?*;)^O1oYgCoj!&xsaS1Kkq?fS^u}0r$zj{=Dqr%GmCdiyos9n
z%mb!OTTjl(W4mee=C0144FRXtsC=3lAe+SbuwwGp)gG$nj_)}4O>5T+|22y?@t%nN
zB3tlzJrl=bkIg%xLl)lXK3|YualgJIWsNuIk$>mIC3&0gWiNce{Nu#Tm*Spr6Vf=X
zjL!W%@Z*N#$A6`4%U*wJx|6>;bfe&kl+>?A`9F;0CYWwgi<`^H#r0^J@+$f817H6Y
zJ(v&|J7d9(2=2_peLBVa&Ky{@piWfR;q&VYXET|;W)*WYt49W%ce*!AVbO8En%d1A
zu?0?>A9DU{f2XsM+izBG^V8Tb3QE}r4it$0VeHQixK%b&batfk-rgr4uRol2=B=QD
z`A7be4=byg9{49n?-FFRaP)Y`S>VjB5$mX^p_8q8;L~xF6Bd7p_EZ-Xd+4uUCvdU)
zPjjn@U08RkbDo?;U3RL|yGu80*FL$^wosaJ?W?F0<@@K(I4tGv-yZOF-9>?m##5QR
z-X?sCWpg`XSGeng#R26PO?NN6<&)Q4z9%s7dsW8^p5i9WJ5sm)AMo#$ns$=;$^24#
zjt!bN9A6jY6z*RBEH)(URPZVPjCW$8PRTyyJv-(nMobT#UFx<~`m5BQg)T1k527E>
zb#=TG7us8UluhVC&FL#srcY~lW|{w4`pUMuTjlpXD-B)bn0w--w#7BIqqkpsU*lv+
zSCA6nUiD_nxq$!brBa0pO>8>4^$va#X}_ks>e%ID3^#a|r7ft;KelGYgOY8T#xL!@
zxlFFn-oa9MFu7Vt)@J66VDH1hUfY(2iFtmWuW86wzghFFI9ovA4`FYsa+%h;HucP}
zTUK50b<%y6xS%@maN@Mj2COUZOU?eaGp;Kmne)qLX3;%H2V)z>uFC)IV$a@n*Do};
z(QjXJ^o$Ab6yN@oInG-&rHIj6{$081>O0aEzw+Xvlqz4TUO!;%dZ+bqQckqjC67aE
z8lJ@+7rgtxg6l`;vWj_2C41GCQnFUAuh?)nTcNJ{lU`lvpEt+F*Zc3=viamhkGZoa
zUO4Fx==n{O{m+rv+5!I@&L!`8uI_!{6z|Dp4#ADLryc6uxO>{|#a<7Womf(<;y1Ch
zWGnOOb7`ID3W{#ePm>JEdETJd*_IZ^w5O%2yE5iw?9y*vHG(xKd}){Wx7@KhN{{i{
zE>FG9FYjGoYvn86=ysXEhLd+i?zh7m9=+H5m3H^a#f2UFPTs04vH!Sw$2svesi8X;
z+D!Ygxcq)V;#XI@Qpc)wyfz=7H2h&xv*AmX_xN>>_4ZW1l4+~9&zY#RNv7xD>dWcx
z&lya9va&PL>8jP!|DWvF<Zjoz*Zuv?+11<i;||6A{`cccd?WXf$(frgTy^@s2Pz#u
z8LBNB{zU7p@6owOS=UQ(u$bmGb}nj3*KgUPo*$^{V3-!*cgc<M$~&f?^Q!&{MOz*Y
zySHPljhxAM&V83o`f2V9JZ|{fBIDzyH@up8d$e)_?*{1JO*?cZNvAdUa;)sCbp7~$
zU$_o)c;^)Oo#fSDS<WpHP{ea4`<|{&#MAt$6E7+s-o5td+@+39yxT9#*>?4)itqnZ
zuTNZyyrWW~D>$3y{D&!Pssg2-*3D+)RNlmPb7z2x<&T{+WMrmXW!!t#`@xahtJiFK
zvm^F~VdjSv+iEtRD@!aNT(@p`^L@*~o}FvX^sLM<epobjxsl|oT*dM;#%5>qmbP`(
zE6?0^DWi|`s>6%ub1GlC-rLNMzw9~pZP}9hlPg0*wwCZEl)sSty)iHRkC|rPWZ%an
zPAfZp1&1uEHG5(GL0WHX{u@jA<_QzqSo(q$Z~9&eTmMz{lsNk<yGv`2B>z9qRm=WH
z=As_+%QC0S38AJ-_&81%?o-~qw&-+yM$K>MgmQzx^p86ESJ$q)wZhSsVRO)Or#ew(
zlVt`AKg_<IU-YBC`t!4rKZ0ipE}zMk`aIvyb*~=3N1OFOt9e&dL^M11)yJ;*wX$*Z
zwNvX2KQ9S)uY8;I{&4GJ@!QkG<}JGNNVj0>$1gum-kyB@yno#Mi*wgqx?iH<cI)$#
z$qRo^?u%OUWry{n+NV!r*cF>a=f4XH{HSy7N16GZE3vyHR5wVK*PmM&>K9Ue@5tv}
zSx+RN?UTscS-sBG<9XDJ6BqTA^ebk)^8W6abI|gvj_Z`q>$cUU?C`PNQ?0wN=MKx;
z)wkasbO`%+wfA<*XU{{$_j=i@g^pQA#y{fPYr0_$*J{B7w|Sn<@B7Sngn1RiD#sp$
z;QGlI7koN;#;8{HLHxy&oK1{UXNyc6bt}&O>oQ2|YVw@!|3mVYx)b}BiK|i%dh5uZ
zwCJ)~R4AV`zgI`sT!yJM@u>JkLDLypr8);^Di<>LeVz5?K}yLf1HT_7cJ6WU>96LP
z-)+4<nQ@nX<PPbg65a0h;=K}AWlvdV_QwBtdG%z-pPpG9sy0gd6cjynXSgbUdzl%}
z-zHUCayxLwN>;wO_sP?WgRNpGAK14l&r)NV!*9W9-M3fm3v+i^v5wVMHnZ~YvmUKQ
z?0>xC;w%H01%rQfJjt}#S0MWN(KYE?why(VKK5Lx>B~GC^4!4cUX%OD;<drocHEgL
zddDO?)#~u1yI&T3c3Qr`SDWwF&6L~+dVXdfKmJ}_&a`Fvr6$Lfho^0L@x<JyHR9f@
z%hr{~qWXoq6a&}B{QqWHW_wz&@{Ig?ePPafYL7ng-rH5<vNh!1uX7J$f4o>$6)t?h
zF2LZ(jjG%CJbNzM>weuUb^DW<@h6v-eVNaFm>102lX@$%%1QX7UIE`!y**#{ml^si
z1Xx)41`Ee$PR<YC^wxz*nxEGu?Q)mZd-ak-)lW|4PB$vjVsUN^;7?J0@o2lX@YgSG
z$|ZBZ{&~z^6uQ+x<V&ZlrE;o=zfB7No>^M&w7e5y*(Rh<DDZkya9S$v<Kl@QgZW?S
z2hVlfzu5ER*NYpC`Cq>3&0A9SoTHDudH0ivPwto$TwG~W@q5!RTcPEAvLEIsod|y=
zB!BLzdE56Z;ZrYbC39U|=u-T3cj=Su>`bkby34Ir@2tJc#msrXS?Omazsqug6CYZa
z%-^Lc8k{11w7Fm5bWO#T=Xu^mv6HgJADA*%=OoK-dU5Tf<<iS1BzGHLnjWv+!(3_c
zrtjufYgYE^_r-bVpO%#HIT><1+swv1?Xt+{LtSzw`7O27*A}?D++jR__jh^H*GE@u
zUu~0aJI7M=W&X<g<d1^!VoUPeH(opSF6FeiS<3H>h=Q9xRH`)pO-?a>Tec!Suwc38
zy@h4_W&A_zG~*X#&pP$Sx`grl&T^#%>8A2l-2O$k7_O`4Ke4glTA$T2Z?n__&yB~<
z8ct>OaQZMUC+=_gu3~|$E>;mu7oYh>vk8b@Sk5{%^qS-v#XEnJXG)#1Y~KH3MUrx4
z^`nEl>&~Z1{M_O8{*+CH?_cLHhS!5$?k>JNf8{?NS^f@|ldgBOO__Bq!XvT{U5#uG
zSDDGkX*|<fT1IR_@<XOg@9MoS&oJLOwQpm08;`?+)b|T~4>0}Zm>PcX_7avyeK$1@
zK0C11D{3!aruOVuH7~D+S~C+oBI7Qe^tI9Se{S|J#JTT7(!Xz>!p}F!im~~$d}Pq|
zZJp3?Yi`fMoaTVyq@{aqOj<7O<^MZk5C5Lfhsr&ZY^TrKR@&6m8fBpMsrO=EEpuw<
z+Nv!n;SRez9(a5Ezm2>3%;|RO6;Ti4FJ-wgP5Ero|IO}WEm-FeccZPJU03Hz={l!m
zDW4Tx$0wX>e(IP1^y=hFoqu_oWq&VAdmu7neV%krliW)cf%tBXzOvJL@4XpISStTn
z&-&aOu}-=t?nrdTSJ}QRQtqNYM^ALH7GCbK4t-!Jmp@gA`Ov}5&;HGuR93#baJl6E
z+Z|h?cKaB5*)3`CR-aa)G4b8a7qcgtTx@UkJYnDa_(|kbdDSAj^Gizp{G7!9W3Juv
zKjm|#EacS8KXxxu%gtV9zU+RHo#wx0+|CF)xFRm>>Y<pv(y0#~_W2ndwL6(`qGeN}
zdrOU5$y8>4L4&sas!A!ml4T|78-7&mJ-G78yAKk1S92C0Vt-?;J-7MkT@{U2X6b>9
z?&@!^n*83tl$3nxzhM3AfS9RAYM;A_-pX8e`dG?3fx1K1b{^L@<uf{j9hFM<H@tCX
zZkSF*qLf$JZ#5}yFXpFv|34M4KO*00zVwHs{^eKOHm>Iln0ezQ<K=6g7B~f~oSk}R
z%JasFKQ|Uz<vB#}y14mpywY3w_T?vb%{=n5_qE}~om#3tFKqs+TYclj(VvsKPlXpq
z?1-&yy{Q_zCGJJ`&Xa%pcW%-6T^gibeCy^V*`vIjGQv}zYMit+D6y<=-B&OA^3fxo
zosVqR%zx96VDY>^&GzQg!_De*r3HTmHymbkHZ9J1zxn8EE#vL$eScT}d#K+$+v{bk
z{Y+UGE(VnxNj}ez$U^n7OE2&2%)0lGxpJd|o0gf1MbXvsou#K2me-2kR*Tquj%(NJ
z3FaL=cAwl-^REOHTxTs`yyo_H%XqG|tw)&|UtB#JqnxSg@X7h}^t8wz_pIYB@1&Y9
zb@Pf{*zjUXfBmg%j{aY{zPB6L)YVqDdK8{>R=$1Xq=r7<;SR?cb6!t<%doY5>0{%t
zH2olU{$=}HS>NdXxjT6s=k)^@WOZz(FY}Do(KU2CB5|rftI)?r>v+YH_j6lLWC<qD
zznySrWpl^{`+pvD3OQz}nEJ4%we<CDTzR-+)y2-+tCa8QO8vc39LQ_le<ak&kCCNV
zG5i1f`v3A3f;HPVMVw!MPmnL={AS1V7V8RR?;G|OUP#_~qkNr)%Pp638<y`AP3J3D
z@&~!-{r{`5rnY|4Y?%<P$4d7@o0prfRK6U4%3#G&JC7;8Tc2H3m)Vq~+m-d{%Y&_t
zo^bAXQ6e@gPqg~6%=cu26|a~JwD`oHFJEHLE^@(vvC_BgWa`4lyqD*^dolCZr<v|&
z7)mC;Db1De7MXr??XCi~H?6Y^j0`UH<Y}Et5k0Z(`cB2bl^L&;#B5qNo}IcdP;$p?
z#`;}zE={X#^%mb?TX!w&ZqMiZFZowrnqK_;aN%jcuW5Uhns*i2ZPK1QHT2-_GPkov
z+pU7QR=t1sTJFxq+nS=XsjBQVrc9Sjf5tS~%vwy5yU2R0#+mvamd~H=|6Y0d%hm}|
zUyrYRnX<os&&IOJFMZzLS=2atRbfe9ijc$HNB0GGYO{Upk_xTUuzt+EOZn@^+5Ru1
zW}W}LZlOrP&P{n$XZXLqE-Ku>xM%K~SsmdA&Mn#TAYuEAv(uCUH5Twr&P-k>GvV^)
zSIc()&Wc_Az|7J5t@*)R<H;TM8t?BN4~_}y3|ccYn(fu^17VW?{)l|By`NvBtGTj}
z`9)0s$qMQ3v0u7)<~B__`0ku~?D<dciq9!d=HB70<D=2p7&7Nf{}1KF4V`;r+1A%M
z@>aA?&$wvyE=ya1Bl@j)p{&`d(4G^rJ7@IBO5SY!et*XMGrUH&OP?wPsVW~|btvbv
zg2Z&jkQX-`g!j3Gq<j9Xn6hU5q}0-D_hVBw-;;|A)7&6DH%#<O%cqAcbv@*^<aTfG
zNhmhlc=7JGUD>m8BZcha^cDCVxp$jZo_=yEW&1s29<!^mOfwqt<OFU1?>l62>h-d<
z)8_kbT^aW5!BH2rTNBpY=M}NP9uUhpvFuw=M$?H8A2!}k@XwT<s<GksBAMNqZ#yOQ
zmWQ#OD()`h-L0DK^W@6p$3j7wk5f0zOqIEM<W}z0<+oR*u3x;OZLzF&O^f2AjDLX^
zYS(sIc{8mp<7eEW5-B<*)GPkzhrUqh#YOLT>~o*mK2>*0)nRt+`+@6@AJ?vpTev&!
zvFNMz%z(TloTs)&&pzq4Zlzw&I^|VPi8qB8ZWF#L^KL=0gjR-4_fyvulU(PWK7DZx
z&*S&I^_kx+nx^z!shG_}JnQj-lkToUr*58jU($OqHSp{tr-@ZfyYFTRFZq1(u8idB
zgG(Q)%#i%O^PK;Uo_W>b`FqO)tK}Wu?(LT9QhoYsTBC-Z+q|NcV!`<(Z)RpTO7m}h
zEWhK&8s3TOm$Fv(KbY&VaV~Swmzu9hxdk&Hv>o1+wPVsM;WdkX2<R@Cwb{d;qsSq9
zaz>hKTlwNCS-XC0F=E|zfs3muqVQ^-LZ-mXbwS76{0g2<=XRcWtS?+DwSB+pV<{0M
z#ZOyLa`j|>2;cJ2;Eip_O)e|GAcK8>H!$s#`L^nZ(Z0pnEjJY=)dtx4il5hen0q2l
zj&-lW=?9-=CAh<Fe6PpOIxe5bBq}YZdpmf)L%u58{|)R`m$mnsXlUkJCW`f)xEdY2
z>SuAY^xH=_rtmC&7JQ;P{e&z>1)tChWkxTb-@5FTZ_*C2O|`ql<PzJoajsuuarUiG
zD%=V4IX%ml9lNTuY;9H4tCQke{7;u{J)>bLD8KB`+S+u_t#jS2U7Zz9#r*l4U(?RS
z?Nj}C;fme!dVlz|bN=$H*}?IO`(eOsnNL^WiD<5TBr$clai-Djvp3)C+%er-Zoqrw
zr^B6Vt+N-+Q9IqY@7Vk6)3<s4*89yJ*Vj9b{mV}4jT+mhxOlWP3v~Ox&33HJ`XYSo
zsmERi%g5Ke_asPk=M<LfYrj32(egMVFWuzVgVl$3Z0UMw*K*}*|C8$u920v(=dR8A
zJ)?i|jTZvfLhqKJWB<zkn=8&?-%ri+d25X~Jq-5fT6g_!b;h-KYxkX5!*b=Uk`Ye?
z)28*|OG@uF{b7n1cyRFXk;892-X0Kq+OBgdkRyC$-;sp18dIzHS6Iz>vfJi>-Z#U#
zr-$45Cq4ZpeM{oJP~{|+Y6X3!q<?`sPj2^4VUOoLd@5(%g2Sg42p#t3D}D1`>q<a>
z0k7aGrh48BcM`rVI4W<&f5X%5aJwmw;TwaNc~OTeybedDzvd5ERqe1QTxjRyiu(Hh
zk)iieQvJkld$Juo>$ht~`=R6?8&=CNeIBz$cE;^_dx{FrzKWQaQ24Qx{e55ChG^Gm
zuOmgy1WJCFdD)-ucmCM6GTBofMPs%xJ!|~-sv>c#kZE~AN`jx)&cEfd(zipoJa(`A
zvHfvp^t-|(A>Zd2RNcP1B<|H)PvO$`NV|_(Q$GGo-t3nsb%4qEpqZqHOkc>tHEt3+
zJSVzqIrGn}T((A@bMB$ZT~ivJcTVbVddy?+(I+&%+kWvBrv)?Izl5pv1&ixV)>^;L
zY}Z<y2%WU$k6O8s=3aRDB>UEs;}sGD^`Et$du-Zh;3lYgCMa{|@%9R?309RFPkgty
zzyJ66@^SyNh5Hz9pIyDdcy?r*!%6RZ-#&@Yc(JMVVduTW)0ezGz49U3_FaKJ^S=F1
ztxDXoW1-%TjcW^^JocFL!S&*kIrkZT%1<p=@VKS&5MPDk)2}M49@{zYIx?a5yN8gS
z`-jNPN35@f1J`Kkt-Tx)o8TY0&{pxZ^x@#bDph02oV1xf&!?VniR&{{e)%_5_1Sb`
zu7wt#);bGCY`yy;+4`)<0eKzUd$IesS><TnU+sQgLheN1p4;b{^MlOl(hk_&o3`)S
zuJV(jd4;X>C652Q@m#5_JFx27nx&iBmcCFsxIy;3`=%vH`;;S2&FlFq^-c1aW^U?-
zE~})Byvit_XceXq?&<>{zfZ7XWjy6GSu~Ho*C+d5?xKUn8y+(7PM>w#v0WxR>WBur
zQ7iK-Z643QB@%y5Y{`D%mgsza8MEN2(u~aBSaX&o)9pk0WjgK(Z=b(`JtfU{&%ug`
z%RlJ5J(EzCz2CNM@9bMA1;UsLifse0MM+L~Vu%f6y|uu<xM8;HmCxC?@;-Pf?4Nbd
z<GaSe&wsvuUZv6V{_xG+j~$<$>C^xGnrHV5FUv~qx9duEH@zr5Y@eR0`@18`U`0>f
z(E@YP*qaM8e4?bj8azoVzg~0f#R>bUi;fn>?N9%lbgsG9voq;QfkzLY$CE?O?W=dX
z%#mYz`S#PCMVy7xRlF<gT_+t6JMbp?zs!k^svKLLx6Njl8nCTasUy+p_)2@{58}&;
z=R{qe|G4l)#I)*L83mQ0k6bF}UA^|4dD)2q=Fh28;>Suav>dOMX!~TBAhM-5QQ>xh
ze^<vw=|AsR+0MUn@jTNbQS}>l_WDoDs8X31s%_OU;ZDd-pLy)dioFX>c1gr-nxOkg
zz_KuU>fOJ5Z5Q1iv_|?d&er^wE|Qg<!}_hI^;L$d{*qqN!`@e_Z-lx#v4r>T^NLlO
zvajDVQHJG?1?T(4SEau*>vb}lEdRV});zTtclb|F{B0roAZ$smZ1y|R%YkVUiDfHx
zdHi0X)h<0(Z^zWzYfoi<_P@ydqS)AD!R)<nm0zFke5m+#%D+F!GjFs1U^~Z~oV0(&
zV_px(>5H!0pIWT)!$A4_q-3Kb9@n%kH2eOzvGTU^_XW-MeTUwkzpt-!Xya*lp(hXC
z?r1N&eRy?o&F2FGoY~i+jE(o*6#Dp5S*HBa(Q0Q#nQ0+cxKD^#Ukl=0S?K%X&+0Qa
zxmzD;_nYi~<XdK)A=((vfB1Oi&z~i|2hPuTzjE)e>4XFNCW5K?a*L*yIQRb9k){7&
zWxnO?l3!Mwk5;f|dnCS*U+Vw$(wiULJ=gEAcslQ6NmIdG<yhOr7fOG96LI~${`uvj
z&eFUQbN;T?l6+XfU1hr3y=29|fG5*ce<h#4xV6G_x>4o2O9jP_*ZuADrhOH+a=U)H
z)~fS~j&GyE`GTh(vRY1xahC78WcB=W=4M{kdAgG-wLi~Y@mJU8hs#T~k1H-4dB3=2
z%D;$xe{#XWSpl+VCs|3YY12JxWUpJc;>kyekB@g(?i5_Ybo|(v!tF;-7f7Be{N_<(
z|L%>d|F%P&N`{-9B@E1&kNrIR)OUi&;pLYq``D`+kGEaq?+V{=*;ncHB)!Sk)6YiK
z6?!Z<v)uChm%r*$Tn^nTOj+=P_ri6l#)~C)PBK4y_e4WJ^1#av0rI&K2QM7g`y+A3
z{gLJJJ;&b8jlS@9hH_%!jHj$|85Ofvc6wHCWA|DbUd^OuuuIwH`D4A8Gb%Q|{Ibvf
z_2&zo9DfpL1jUst4qne5RQFInGM?{=(~<eoN@t!{Gfkh$UR7;$HsO(c+YQ@SduHqZ
zGRcnKXLRHAWS5^AH4lXu3S#2d8E#xHel9azVEzrk4U7W6=Im{6YHXAKU74wRnZw~=
zYr&##*DcnvIv>uIIid6*E${VtgFE~GFL3zs!}#yTBB9-^e?R>_x9x%9^z6CQPo=GV
zXC)FOS{B{Xl-KZp>x+Qml5&R)C0sd8fs+mHDNJ}`DC2YG%le42z)%0{r^nAaS8x9F
z>jcj=r{7K4Tygu!-L`!Db5g&K`#oQGcgyLJZ`rlKO#XfU`Q!iBnkCVF|E8WlsMq(m
zBCF%@XTR#{Rs8GQCSMG&ns{T^?wg!XO!bua1a;cFh5fN`ue*`C^lpMwgyG~p2TY6J
zKGRJ+{BGLhf`{UL`<EHBFs-k1T-$R=ctY3|{kPuHZ>)Kq++B9g)J0^*f*`BUYQ8^C
zO~0Hq^QK~9uf)r04(W+oKW~h9Ha%STm|b$(DF%~|W~--LzFxFok8Y;lb1latUM4=?
zO{<QDc=-ify>R8w`F|U3+!lzt(cX3TRZmL$^r|MK--pU}TRn34b9Kdg2A;k^kD9ui
z1w|h$da5lN{iA<)w|8aV$Xspmz-Wri9r-C=@=LyQdDIGTd>1=msZa{f{K@>%;&OjO
z)*Mz^B;)q|cbpf``U>+i-J3RY%<Ma={r0H;n;AZwA2Z%5r!P*g+uJ$4_)q!7GsawX
zy|=a8*3aww>*)JTIVrWoQ2oGNU!~>+&5><S_E^WelwbeuUT*$<qVQ40)mnY8Rc5?t
zVfuMnC@rq;OkGPYFXN`q??l6IL=`YUzHBD)?^?97yl#3x^zBX7f@+hBtnw3Y*)iST
zy}Q}(ZQ_r=CEvE0{#?blLC7IJV_A)F?f(7t9i`u`xXgcS{?$`BpTA@Ko^PLbM`Xvm
zDB}6k%4F5wcVxn^-hJz`?q2e#bx^DS^VP#8di4PfJ&~`U9zEXk<!;vhnf^!a-psi3
zezibRNsr{gyzPHIRA;F68*5cQk$Y!#;O^sBpM0tw$-332eA*wxdWQ4lH@D*syWZJ%
zeRWV)HgGMEENiw*s=BmtwS0+M-HM5#?Q3<;@U%VW(l~Ktufdh;$z?%FWw*9W+VWlR
z?v65jo~jM=Hs@y5nc5ULvAuV8f4+If>iLH}t4@ffx4dz*^Lq8OL0Wdzqq{q_4_|0_
z6nW~%ao4W*t(&Ho7#zIkr77n3c%jwKb4;CSRaYOpj(z|9(ZBNiUW2n`%TMOT_2sU)
zTptnlynb?$M;`lyLRRK~=W^f8dwOf`*Js+%g2&=RmzY1ZYI|^XLf!lqk1W@jhkeu7
z`}*{{o5z>D&XH13*A4r$?w!P$w-NE1)TKk41wJkEeyP9ubKg228>5A)u1__lyu5AT
zUU-S=_!_6(1`hdNd)DNw3e{1Yee=bdqbcIEHeGOFn00Uc5x4xwRt4e<mrb$f*xPfx
z`lj;b>t3hbwr~s1={Pr&=Z>p2&x{~%rC%C);umK-Eqg6znjACTvXNQXO+++cU)m=h
z3r`>I_jjjW5m;>9E&T5I<qUS+iiul13y=Kln%kUZDVL-B@z<nneh#nW%yZ5@v`O6G
z|Md359=<10hPPJkV$`2@GCV1hm#s*wqq*<RL;igmlr%+I?g$1kAFtYSytG`^Z&`pz
zr}jVj0B>d%5e5bZ4u+(4+oRTB?wY(;gn?nI2Lpo`0|P^DYH@yEQfX#Rihe;+etJ=2
zE@+SJU7PIUJ3A)c|Ej$q?CA;3^B4Nhw!4(yiaLJn)~e5|bu4#BcXb_{FhkN!rpbN6
zq%_h0-%HFHgdQX>DK!h<IeXL6nTi)OO3Z)p%5K`+zrHSN&sm{Bjg1z*u7T;ReL~#d
zxSpKc8)4HwPfljj^i6j{Z&n3we(pcNc6Y_UFF%9J_6fe38?Y&1<qol(I@=9qUTw<f
z=L?&9XOl&oX=!k$McU16Q$o*H1fH06eWuQpg9jJ8_uF-D65?9+^8JI#Q$;(^32mDs
zYQ1x<Yv_kL`|NbjwD(Vq39nhLG^4&CfnohDrIkz1O#SP$?fsQyD>v`?%i_KDefir3
zUN_3Wt~=9Z`nYTE>)0uK?mfAADes|jjmhusH|5bwn0j8;^F|xS-xU0I(Rx8{SjTi}
z&MEUZ^M`6_O`O*$RkkJR`Nf~-<^3N`&-aV__x<JX>+bA4aZ(dB)@}9@bID?Uz2x^P
z$r*}!8+LuT%xCj<pOuA$N71?v?_}qz7nG#-POLmNedmu2e`b5Ux_OcDAlt0{2}|Wp
zzv5+A5&5u+k*!hYih`iSm8cwLsoIbtneY#5EtCommiw&BSkU;0&*w=Q_a3_>d9Nw#
z^PcavG?@P}>+XfV&puZTRt1!XF^4z$bDZ?)zLBmPRJK`=mGNzy^-Y6$;Z4h}%R)~`
zmy2<RYe{mb?S80nV3Ov+)hUnPI;L7G6db9$!!aY~;fhU6Qp)c|<GEd5Z(4KWRnPOA
z`VF(q=PDe_4AZoTtde(N|G{%)YAD<1+og;g(FYGy@l82fT**8;>fMdw;?MJACOk4b
zIXmQt#{Az6vkIl`_c96bi8*$ZbO^li4O{Zb?dYRzVQ*%%HtrBTIEOWQ>I3}+V*jE(
z&9ckAoUp9bH|%2=xAB=zN34EbetvoTdXq09YaC=1N*`H-D8--c4Oy{kR(Xwmzs__0
zbBnicn9p5NSIIfy{%NN()j6%xQ%?(>v+McQ_?)Y6vin;_pXbs{``PRIPyGHkTXri$
zLARjiZ^PUx^$izn5;%@Bd~{b^(R}$wR0x-wT~42*%;A-d&krUg?&G+XxFBiGm%|@j
zPr7Tk-~0CUQ`(in)sK{>Y|7cneRlCob54fs%*LY9Gr7{;nNKybFou**>|Q>-IdB8(
zRrzmkGA#IbuDGd$Ydro{vPenGwP~5o(ya;e=Y&|wah?kaN>!EFux7oMz_qh#&A~GY
zSlii3rZET@XfiW*eq(g7-esD!TzkobIajapwe>b+Gx)J>^Vc;J<(<bYviopE?vY92
zuXju{d?0h^|IGxO2@=bAIIRvDv;3WrVIiUWU{23rh95x_TbS5?1__ESQ3>>Wqg=?H
zv|xU3^Tp`;<K^CtDvLKa_%P(|3o**idbnXR!|!_C8~ssn-xyeyPBAgPwbU}&Y{ACO
zRm#$5MK8oWIMT4dJs~?m^GA4hN^lCNlu#M7S&?ngk?0#7{2JSnmrh94yP&~vdz#Y2
zwr2B9yMk6&6mBh#{P@egK+k0!|IDoT7e^VQEZQp`Yu(J;^>FpN13eEc9z53C!R%Du
z`R>8v=?U*m+N;}Kbr;z7Y|^jQxGnj;FTTlhZ&im%9K(~-`*iqH1vZq2m>U(WnEs*k
zL><E+rivRHoea$BtQK1zUZ0t>>R^SqhC;K0{&!95VyVoqj!Ca)PT83+n#R5^Zt2P=
z0$;b@Q)K?WZfa$*&H;AjmkjMIOP5synX9aqnZq#QkU)z2qUsyrdhI^3sj8Egmdy=3
z@<i;4ywrD_-9m4aG|CICxJ+(zv(+mdSaFAS`jV}AF8pzax*1|#_RLu%dr@2?^vZ_h
z4fpq)JZYJAF>n5MIoYnc?7~mw&k87nbDB6S@y15=pHR6lA+4mWbBh1+$pylSJToUe
zzjlC0KJm(n84K_9y>=F#mfkFOUe9)&@~UH^FE5%zi*LHLXWzrn#xonGSSz@^_|FJi
zJ$kTO)I+iD6j$5fe{1(&Y3{I@_HxdOpnNITK64Lly@Vs@dM?B;THLzWZq5>)9WarP
zf1dJ=9e(@PZGW@qj;*7PSjV)e6=|Lq+QcN1=W_gOZ|qcYxc6eWs*JCdv$2RnOMQy`
zT5ZKHgC9Si=*;ldP7`a{AH2EYZy&2p$3L~rhr}1&WS018dc)C1jP1QW%jU@EhgPv&
zTT}MY^t`lV#+e(BtUsKx6EEP<KQVLZN&N!?dxbjJSXexo?#>)J^NLWy=Gm)WBo<t#
zzIAHp>zHr>Z|Uc=CNQN~T@bBm`d|9J^=@r&?ZM?ge(zquzk_MXD&6&_t&eBSkUjo^
zFH_|B=W`q9R;wRc7^t<Sn3ZLwgBnMZIq#V!4^v@Ru1l}aY&>;@p>1QW%JHKMoD+1j
zUK`8~IQ;Rtjkr~T(xU}mAF=<~<@4I|iQW4jzHfeP?Px#9$M-b3?Be%x`oGgJ94$T)
z=<@jKu6d!sH&~N6K7PKCQ@-QEzQ?A2cX12FB{8WptO`9FQS+rCe8Ph4f9D$oj+!!L
zICHB%{+P~pk84M>KuXO|tp^=fFPxs1@Z@B3*u+)A9}J#<+q+^FyT+WNJjX2_^;4E=
zBpnS`GHEh;b!YlSvCl3}Xa1cvthUN~mQcmx^h&QGooVOVWe*>(ek3U|zf3IkgI}KT
zLjN~f6`6MySZ`+0>JepsJS{7n+c+bk^j(b0ewW7m5&>&+E|gDoFt)h)P{D6WMw1(_
z`Hgd8Z*%f_GFGHGzv=9m9LD<a=;fpG`tt4donL0(d@Pw!#G6@C$YhkHrIz@(f4|H0
zc+T&2o6L9iZQR0q?99(p*Uhm>eCs!)FtS#rTk!08DOl&?xv)pUFCjlQxb6J0vz_+t
zmw#7Z`hRO~##QZQ;*V83q|%rUskqng*kPB{Sgh5&bGC%ltL4_WukgRTwP1QPkJTgD
zq-z^4H7aw)P1~^FYQldnxn+-^M%?Gp<#@oc?N;N_&(iyXd9Ezmbn{f|WX7wf=UmVD
zp(Hl%T34=0#rAL3G15s~wwD;MotwGQo-z2s_hlSYims?_=UiaXvUSeY0v%U&;hg0v
zYh)`V(*z9XG=7|VHtx-Zco(jcyi)O{3|9{>pBU~d`Fia!ho4#ER$neInYVM=8P7jF
z&DzQW?*mN?&j+vh{qtethXw{06``uaw^Bdcepa8gbnn}j|M_cRoT=f-xE)WoYyEbW
znJoBDMq1ifyKm>!_>wE4uS8~vDxQy#-!$3D^hrr})gp%)JL{icK3;B@_q#uDfqcx3
zlC`HC&hE4R{WHhUe*XEJr|(KlV_CRv@(I<L2MruA7Cf35Vy0~G<?-pFP2x7oKJnC*
zw|w6EasMz{eE4i&&4DG27W0C(?S9s<oVhLKt$5%`)=S!{0<XBa#HM=2PP}5v)IP!a
z$WgBi+*_+m)T=BKwuPJ*luSKS#3yqzp^EL=s)IM#ckI#mth4YEPsW~8J`Tpu<g{))
ziMp|-<EE_jYRy*@dF(`YKGC!-Whh%>Tf(WrSpI?IE8{guiy#J(xFD0)RSpO4ED$<Z
zV{uC)>EH$yVZRVA$p@zHWlb>}jtz5v>J@9eGrn!qS^0-cmeJyP=Q)m4x%$TW8vhsG
zTDjtM$k|<cnHWWq8Y)>V4n}x$Sqtv^;PR&E*t`u40hLFy<sSUrF0{y?>bst|*2*WV
zmihBto4eU(C+C^6k~p>0#XIy20u0tR$d+a}WviaLsUYht@o0|ZFD1QS%69xroe4ZY
zzEt_04?N`j<dK&pcYnxthOM3roL2lL!P|{x4R-vTwJ<2FH+uQWwy&J(7mBqRzDpXF
zyc3<fMoG}D+-~`#vlCuex*QE_-t;*6TaHTYy{N{CZ!Aw3%E_(Snj|D#Z0UFRIQRN3
zj~q=(oF1}Wp6B{t73b{#+m5c(yKX$~e6QS=)GKOxbv|b}WiYX=`de$V(;#2}cuCRy
zMU`T&cSJW|vOHc_(a<?-)x0Ao7v7q=Y+9MWRgw8AG2PvtSa$6=`fK*S58pn@9M9?3
z`F@(y>d3pEXD)`Tm36MMy{(RoH$1ca$dk6o!ON~IJY@V*@+#=|+@4FVt8;p{Nz_~y
z3tQjPwD^Ead1UpE4OvCIXSm%~W7+-qUK6v>WIO(XnTtZdF5K3-Qlu&^*x^lEjJNKk
zQy0&?i+lLx_ob!5XBIR$MVkvrd}FxY*SsuF_n*L-4T%Y+Q#@BaZd&eh^<rp?YQ`Ud
zbIT4b%46zz5W2SDt%1cKHHnEooXet0Y-R*E<u5lr;JtBEr8^VnCpR<ig*@ibR+p4N
z_(a|6(k@{0(K5W=cs6|N%8fr4xIYkNPW02;rDQkl+{N(aF-GfmfBHMq<?rTP4wZ;y
zf)$UZshfJtXxVJ8vs=O=<C~RLoQ?f1lWBSuJZTFwbl;xc{-XTR?8oVg8GkZ!&yup&
zu339!qV~6+e_#3^Q)qr1-??^=npOUBW3gQ#u2nbqwiR%mc(LT%*6^zCxgTsKC(pGz
zn-G-lYr^4cJj3_ryG~cx<fUnEtiMfJa<sWBN66y)qX$X`VbA6+*mx^t=|{f(uJs3|
zu(@7;ow!<0+34%)ZHZ!)H^QP0Ufi6ss?YY`e$P*nV;0{2@MhIav7P2WcBmKlONC}?
zH55)43C%d0+P`0(`v*heC*cl_`3#qH&aCO~6s%_DvR-+1r|Wka^A@c`Ul-RFxYbYQ
zdz)Ri)^k(Uo~BpbCWZ%&zTGaYp{yxVFD=$=HCuZ2BNoyB=1<aBZK*$DH}k^LyiKWH
z>#VljzwW2j6f<r8qkjLU^#4*qHuDp-Wfy0be%pVHZ?@XTh7EiU>WiecG<Z+k%2D_w
zWGfbAt08(iO}6PH*WHNYm0P&%#Cx5dpP0AH`tR-Y!ex<i4@D*z<#=y6H+7}Tk4Ukc
zO+`_2W?j|VeN<$9;gik-kG3r{=<bk7{2V2E&gReqrRa6*Hux~*WtWJ}|M%tR8{yy8
z-#>m`-v916|FVx~PuyYVF}h}KTE+i*kAaBe^j(LIub&m^XuBu0r+52|Y5)7ngcnE3
zZx2)p7FhG@W$mxv&9e?StUH=;L-D$;^p}ROwUs;@{&Xdq|J=7GetUHmQ{jwkt~{{|
z9!Z63-lw$ahD3Zx&COZSe4W+yyZ<%CgzDz0c3DimtS-T#>lNEB$ht@71|9n)60j#p
zN~bE}N6(F^ISm^%D~{$hPh3;gJl%M;$ioRzotIX|Y&5<rykW<=SB;aiyx(4w*y?V*
z&qP&5Q0C=?$_4hnUPt#=>AHU@%)fl`x~X(!%+Zb0ziX%|m*&bzFsIMxeAiwTp|2@7
z`6qL=<=H~1T#>I{H{Sl<E_6q$Q!pcJ>DuyN_P$}UmQ(7)0{5@=U93>OZ}~Edy_u=P
zJ2EET_A^^*Jj3GSljX(wQ4Y`htnAtDs4~8Nvg7T<$8qnr2%maB@u17|^65!?JlEg2
zUh_QZ+WW(sbBnF6uDktgN$#f2XD7Z`R;E!a9k^}}_ut()ottNuDX#hOeV5rq-m-~J
zvRhtut~)Emd3)`z>Hzsm*WxPnF+{A0&EY$~%<7Eat~)L!T4Hm5UwqH`>w=o*vt43|
zMzZT_GFBc?v57XV%nLeiz9`h#c1G+$W#{vI9LyHQ-_ug|S$egxPw-aT>AuB*{BmYD
zZmLYb?J#j$BTMP*)ab03OOj5Tm+UyIQ_t4@En!m5@1Pf{Qxr@lI#d)j`s`9a`fvTF
zNek|Mp4+cnx+Ejl^n*i=*~dpW7aTw2=RE(&FLnNqN$qd89yzzV?+|mSedb{|<4Nrg
z3g49U*TsHJxe#;bs(#O#%FVL(OZL=OEONemZnnvevI8@2zB2XycUgDe{#5Vx`Iin^
zzo=JpKfe6x`ps)&<D}MTIn6d%<=kv_SN-Lu6or_5eUjFDr=(uKn(02#sPpK7**@VH
z?%vv|sjlNYT`|sMVOPz>B7>^FXPYu@bZj=TgiZYRt()0b{Hwvu>z7YnF?h9<XUF35
z>R-3=U%!19F!SBkkB17w^A5AEHE@`4Lt6Swj-A1e^9j!?x9xlUpzx5RqSxlDTm}rS
zlIE#g_cCt07A`w_{Od_>@iP}~)Aw)-{pvlr|DfY{{>uBTx5cMTa5jBq^7pmO`pwt+
zezS@SbzIBZ9&fED=&`<ByIm`BSFL;Z_V-FX>;Anzebo8QyLG#d&0KeOLGI0Yx3%+c
zI2henwzxfK<<u<?9!Q;7(l%$4*!m@_&D2)pSglj{)2iV$dg*>8I8jj1$CHQOdi&C9
z|N4{8QyX-*T1#c@*<)8+a%4);2Tp^qeeXO)^IF#JaC^ci-FRr@aen1X8qaMkW%>8+
zIrQ>DkjwF61J?+K$O}tZZZol_ojhFS#`~%@=bCh^sm`4=?Khq8`_^Z@uarD_P-sD^
zp6&JI1vjF+Z@x0S+j`eb>$j!eddGFTTXs(u{<AIl_Pf_5ZQHr>?5`~LmKWk&$b9T_
z`{M<F+6q_}%~m-keQ0jy60Wzc4{Z0w?>)aao9VVs;tm&cR<W%y54JMae)%2VmT#1h
zo|vb6AgKS{e&w#WuURMDPDnezx<%i9;nx4pmR?qVuv+c=DtG<=AM!6p{uc-|^>jUa
zhTq{aSJPEbKCA7!dM~Sf6<PH;YMbj@-G_g_SKQ8C^?!c;SH4-<xu<iiS7{oq=!vp=
z``+N<{%>E_S^u`1x38`2&i*NGLd;nv+hSL4e3<s*>f2qvrQTfTIU{@jXrILl@8mC`
z&*g)R^7s|{!tW(pi+?;6XMWY|aP4)DI@#i_Wwp9oj^U+xY_>7Qx-MTXYs6Xb+Q0BF
zYVM0qFg822rG6%Z;q{ZfM)@LJlWwjqdG;tS#oFI1^0EAV20OvMHT8#-pXTJ$90@L-
z+&NEf)AlP;J!(P8jl6T7Ewa1Iyd?3(kzWlfEHAL%m2G&}xbOL=1!5`kv!3_=_@MTF
zQMKwi>+nnaX6WVLIx%<i8}Z{Gm+N>P@7j6R^#%WA@vLyhwx35$cRv%I_T-&S&hOsu
zyM3Ny?$12^w&&YPgYVzp9bPnPi`fKi3qJ3ATjNZ<Lb~&^qdH8U-k7y1IIF;S%e1A2
z{2|B8ip(E<m9?30<JgtmEv!M6A*CMez2OTwT(a~#Wfr+z-_3N#T!2&OgOF!df7>Fq
z*n9ItHftR-dUifhVSA$xo7B!aDc-vo>z^&tTw~^`JoigUyNm?qoC{`K<YzqbGGhAl
z|G?4N{OQkkS#q6Y+;PRkblGgCcSmL>J00VnvtDy~>i<2rG7sl?UViMat@|b2Y8l_X
zB|G?1u4J0-IetgMXMfC71-U(&uD5@+<v1<aK6}=y1Hls}qF)wq{zVDbD`f@-?o}8A
zo<*tUMVTew^TyxWW*0wpE4u$xTOfB8LzU*cb@oeyLSIzu-MugPT)*!6n&~2kn-qnn
zY+z!PV))wO_22gIjPE=SUe|uT>5lx?#gbOFtGWt=)8@I#-`oFp{o?#C*SM`eFP=17
zzbh&9$=Sj$Rg-n~J}o}4uFpTuHUHJw+~7I!B^RIT$N%*%sha41|5<LV>*+sQ`mfJQ
zy>gA6x0ZjwhnKDw-C|>>3;wyg?Wa(k%j-2-X19%Af6`dJ=+Cl@-HWWm1I}%8-N_QM
zdXd(yMeEeq&oi70oT58DP;70Nk-I?TmDID9_b#qhi@zRjxi@=pXz=>C*S}1v-@d3O
zP_guXp+oEClC5vI`OaGwxbfZ<U-pR5(&>q>-!e|0nUbr1e_lvz@b=j?jjRvc@8!&r
z`6ufh|F`1P+1p>feC4mNDxX#N_i=f?pZ~u9?+#m3-7U+1mF4-Rra5MjyL$frDdClq
zOG^*$=hV!)R`+qA<_6JYDZMdDYQ8VBBj<P?>1cePC-##qv1hT_`)#wotU9||+p$$=
zr{3$&g)Ha0m#y1y_{ZO@Xx$B)qaxq!I%&3c#qN74zO&6gUCpeW=`6i|w%YE$>*AjM
z_*&Dw;mG=Jy63e2{&r>$ne+Mk`USl<tA8BdZFD>+Qu)9fouBWocko<LTy=ll`By^w
z<vCdFws|Dq?OSNyc<pxBz887s8h(+|bLC`2R=+4I`gQ;P{iXT;{=7RI@3-&w<&Tam
z@?w*p&FPqA;>mSSc<JL8=PP&q+?97Nvi(i?)tIoFsaq`*%Qk3i-qu@pV*PBUtQG4#
z-prFU<dW9tPJXg`*XjPnue<j+DXL##m2<ewCc(;)mKuFo;Dz2NQ$B_t(z>rq_qcU1
zER8iex~zHL>P7YczTIV?uv`A#o`|&AZ;SSxIQ_{(JTG46zz3&{m022zU46D<YgB$7
zKXBYUGBPba)o%9ISmW{^#`3Q2@eGEcdMBMZgg4JrvCDc~C?YSr_3O6CC#M%R&c6`<
zQ-q<f@JjmaO|y>)SL`{r`;AuiGDCq+-=45nFqPyi`}lj!ZU;Vt4vvHa9&2Xb_Oy}8
z_`d$myU=@cuIBRD8wst;yyJA&=Itz9yD1zsynoK6How<eVks25xaxN9wz~<*@+=dl
zAAP2gKWkSeXBqdDhnv~A{$tc~;bHl;jrHiRo~##pjVIVl5N&kdZJQi&D<ey3>3sD&
zc1F^baV4pCy-SxY(r65e<FfIb!eJliu+M$pbMv1`x1U}x*vexyFI4y6i*vg}dU{tj
z3NJi#fAS1d!%quz9JbtksneGAF-GW5?p~d+?Ov_N+jy3l>|6Hg`-#jg{x`Oz>tuTE
zD=9w_-gNWJ<foiFdls)bwVqWgkm=Pov5O1E+iytiw-k}J>MCDYqGILng>8y3znHk`
znLTf}2*yr|d$#?pPf@ns{=$zx-+bQb$XCwkm1(o=+iyFcr<x5Du5g~Rx~8{(j>FZ=
zJ6FnYO3lhzG<kbj^X>yzr04u!;Mi=uS>jYezghO5aOLCYd*pv;?SDB-M|HNtp7MDj
zS68vEyxknXzOy9y8~euet1W9oK5UqKY<?!^<M5`3`Zr20Cco6LXMX&U`R|TB_bjLA
ztrx6$(<37==k>10SCJ{-1%h(lUgYg-;F580C`}YPuXv2_^H%=ZQ#Ww%q<C$R6>b$2
z^N?J~nKZq}t$KkXFYm056LzY0?;MszXzj~>7^fK^<TXX-z%g5A@9*1oA2=!Ne*NLH
zmG(`uEM?wixPINB?(u#z(-hk+t9MCX`5YRS$D3JonoDVwdCuua!2wd%PrWpzDF>dv
zboIlz%U3;iE%4A<>T&(9Vzt!5cJBEZI#YXXeYnay9x^0NGFcz~Z_@p~o#F{%VzOIS
ztPU;Qm%4@}zC`}7`i!h6yY>ha>)6JxnQmR}Ic0kl`>U7tDvv)o5aQLFlCjFzDQnaH
zi{?_i?W`F!+KV`=yuaDLs(QItvaM-Lcm2IXZ+5Y$Z9P8e=!3e2%cn2%oIQQDVOOy>
zPs*PM&Qhlju>UDexDwr9x$4#09<TUG_b07!d&L=cpnZ1D%o??Q3YH0p^~>r$Cm26?
zz%Fq9;4%HrT86KC7wIp%_&m%rK};c2Y}Vdc(W(V6;<-2-onr;f8E3{d@3Q)KM6^VR
zq4m?|>BU>N7O<Hv%NH_TKS`!J=Ht{g8uFWK<YXsq?CYykwmQbF(l(djizU-9ZI0VP
zdkq>C3Lo4yTl35&fHiX!hfMYonTn^EwYoe_7}cg-lXHE++>pjl&Zp5;b#Reo#Ff7e
zv(_*izE^&`z{0(~{Cj)H>0J!{Vk$Bl)}Qyds(7^g`^N=coV98;r-X!Bud4WJZ<utc
z#DvSRSK`{Dr}IO*Z6<!1bX#P?bjKpURobs?H61-}x$t_ce0pbRb-QfEne|<&HoMN<
zVxOEbk=<95>E_j7m7cNyz0{oLG98LpMV+hrl(+ELJlMpjX&t1o^P2J#7o%zJ(;mDj
z{IZX2qT+qQ`P&yXepYDT_(fkt*>&Tib-rbj%Wp613bWpN|6pUV>mK_B3mk6+$*3_l
z^#wkie13hh@foYYKzl!ph$#zhxBlNh<-h8WbeC5JOVT>?FWMfQ;PqZ4Fwy(s%O};3
z>@?IQ8ys~Tl9GD3r5wG30`@UX{I~Ra@JHMIejm#h&3vBCw^{6;<%hTllhq0W^8=$r
zyk2j=&3mk`;eEux;J*#q6wh&eu+U;kzL&lIf#07=61&dr?yg!{vC<=E%36caWqjx7
zx!!M<OFzE<z>d7&n8qbSCc3hJlNsxr*B4xP6k*zN*y*cor|r4>KZ9mDIp)NgF<#<#
zo3gaf?D{h18Ba84KR*)1yh!6s!IcXRQXE!~kDQQIDB(3(*zwS*@8xgjlLs%nWogS|
zEe;ggzc64cN1ygvWhbr>k+ug$ihI2)vgUd(oT#tF<B@AIVTnNM`Y*x{wHAH#@6Ve&
z|GD{mzF4OIsq)?H7T&Wf@m+N6&<jry*&dMsE&*mnCT)J+wYDOR8H(?gEco^$JUHOx
zx;L*Q_Fwt)Ms~+9`NY0LDbF4I-TK2>i>AC@_WWB*(BU;-trK=GI2@t)a<<LP%5>B7
z$NUf5E{>dCtDaxaf2MlPo==l58!Vn5;<eLp_R;$Z8n5NsP8z@c`E2R?V*!SV^KLV+
zbT9bp*>&T|9-9*ph3qRnWo&SYes<__f%>tJC)U{pItCrFypv&gX`8g7LHX}s-6pk5
zc75rFK8!g@tJ6PM1eE-lR;pfO^!iM8$jnTQen#V7gR`r}#Ls9h5;1A|BWIoyaa3>l
z>)l`7Bp)q{^_{e*eP!O%*+1@be`po_k=p(G4fl3tG4Y>|jC5~_*gRU}BN6?~{+H#7
zZ29z>OI`Qmd?)u#Yzk(#kG^PUd->e8$qI%k`@ijytG&x6YG8Hk_|HI-xo+!g)*szE
zd2ZI`>GuqZeO}4_x-Rl+d4Wt_<F4>Iv)#{oZvL8RdFy^;MTcLg*UiBABNq-NTys7Z
zR%2VY!TQQPXKx;>1>U^oI-+gXZW9w{8NHBkH(|<jJief{#@sMqh1$V2H4|O7*neA~
zJ7c-DM_1vOjrvoL*;d@L2n?(D_*+$bXp4R@OV;@<WgUtaOz$0VEvfBmYvKu8edBOz
zb8*DWSy$zrBpAu(a0=de625JdTp2sBtkoSR(Jj#%N;W+|mbv<^^xfn8w_V+~{ON~~
zdpCuB=6zEMwv<dtoIHWWhiCT6&7VH5e17xzgWFGpvmCjm9;;7rox+w;@rP&oX?eTK
z-_}#^xc|zW?-3_C+dk#%$&}E_qt~?TJ#Na1ehvHGf0Vmw<@LY)i(58vM#`lXp7wO~
zc361&@y>}tLfIZCH${{@e(`SJ>yJ6r=Ur39+OE#?a@#n2@hLa%qebqGwI82tQS(ZD
zG)M7kud2&(lbIJppEZB!Jfqod_w~)h6Xx9^54z(mQ@xjLh_rW6RJPRq(y{u-my<r)
z8FIQj8I|vnH7EU1=~`iOM=7mnu2%Z8tBjuMrR9ueXCfz?vM!$x$@-{YQcdVs%%f=<
z`%g%1s=cHBx@zZBFPl%Hf}VH&9^7ll)3Zmd*d(Xuj70pMTe9J4SAUvWyIU=pm?UtD
z+2qeUrjT_Zwmqz~^k3`6UcJpV;r#7w;`@A5Uo;+i@@)^x^fjrGMr*Z&E0dyMi`>vW
zHAQ#+yt~Vs8o!vFKRV0zT5L;Zu#CP5pH071>$&Z&vvSRBbEmkL&Wsb^#k#((u35@B
z_FmY{UDJb)Rxt}*{w@?+AIZ1hx6*}W#S~UHiH({%nj5Vgo;2RHeUSZbpWHE*pI5|L
zx?8t6E|q6n=4~kS*X5V)i^O#GkKb>(YPHUN_OP%-?|aUL{2t?Q*RO`nj(yz@n#&91
zFURoeXFe;LE66I;9P?>+?2-$=eHR4W51Zn0HLbLK-S^2cjky=DPEohpY`#!s@x5G)
zM^pE9s!E=9=leG+V2Q*3P2CqSWh*ADZR7T4-F2(Pz1l0GVafZgbLMQ_B_rUvicyI9
zv&U?!^>6<;+RlwC{joAQL{n+ChW%C7_jm8bUVT~QT^LZk)sp%2?{D>=r?7QMZ(6+6
z<A;4`e6XQU@S>(E-Q_vDVb|WWuz!1!9NRHtuA=s_z6G4Comm>ZXDz<CB3wY7$x_*E
zp<$PS`y1PScWGh%9;vO7(-ZTS-)L`0VvsnJ=GD#of4$8d(LYCX!`?ROhaRYT;&OL`
z@DYjQf84il9uYV`|7g%32aV%`vqH;4&b>VG?}+f`&F|m&3T%p;IU_|}p2>7_=yS6R
z`+|(sIxjtMkUQJK`_A(6nhJ}~oGaNZdAB`p>%Pu4SKK=*f$b&B>g}Dpc`_g0?Roh;
z?f8K;4y%^%O9vlslabLC+o9LrZT#hlnf~ctR-L`2zy4}9bxuBVOiiZsg=?7Z=|9sI
zvv)^rnUefo!TZQD8JQO|*u0wOy60>;#g)D@jg?1qmir0Q{{_rRR(rfMzgoQ5(qCzH
zFf+{hzuqHV^*QJM^jtqAkZ3D$wCzknj#%_Dukxch&ld7K89K*j)!i3gzVzGN9ZL=d
z=`C>Hx~THNjRiC0`_BC1TBI3fb7Z$Hx6Gm`JLfgdFL2X3DR$bgrfQ<O<x`$@j9-(2
zSH-Ro{P{{|lkuehiE8`1fu&CR=kG4_T={9A-YcHfvR5@{JZajNQ}XGWZbPi-fg?GO
zZQtj-nRQ#k`aFX*Q|qNYYrE!e-?=|ML#Ea(X-SFW0#>brUdR1CmZz?qPQNHE!jh#Q
zTphmk>7}{ld2aKC`WG}vJLI&@UOmHBG>xbHo!4CP>xSkh*_ys7{hs(nah8j#57+T)
z>L21Bc0N}5&J&)N#?M|5=}>&&>hXZ97jte2irw<HzY%@-=V|xEwW+%r{;uNw(kP|U
z{MyTP{WtS~dpEqig3~p%bgs|V)Kzev`ImKGV%M^HafeLb_^Um=z#BG2<%aN`M7wpX
zg}xsQnW8p##n!bGS0Ah1-Px1oUlqz<lbP4%S(cj}Bt2=7oW1Mq)z`GXUw3VGG@N+2
z!<P3~WXj^zNpJQo*;9M;<Fp=)<)7Zjy0<IMY1ikQdps@U0%yp#A0g#($;{_&<%r(D
zd&ggW{!tUJ{3B_TW^z3}cl4b7?%7*Z-`qH|jemMZT+f+_MOtRhSMwg^<35_kRQx&e
zi@!px#39~UM;V{p-nv}o9q+Wu(R#LyiQGO{qZS0pPkQIdyQrOQzmBFth0uqa>E$~X
z6<J#Kt*iKdNn)SE<&D2sR$UY;+u8WC?$7^y-}a{M-+sUQnv;-w94m+Y>SH(bRlWG7
zd+fueht|eQM(c0&W!vE9pK7oBip!>dt)b^bb{<Q4Ta_9u!9}&2!nZUhmll1M|6X^a
z&Ct@a?{M?-$~Okn>z^b`eMsThBpQ2b>g~3_v-<4}&A-X6f3dN_i&^CT^6~@Szi&wF
ztIk|;aHfmdTYm+nn2dWD4o>|ZGh>_X?A=RrzX|nbExHiL_;$jzcb^k$I&S($NbF_)
z!RPO$?BAZ{5%k0PwZb-?7PrRk4a_y+-)CE<+X^Y{V%llNt7KVxYtHQAQ`cR$ZZYqj
zd~-=z-|9t&W^Ib$Z<yCMk9|f**aWUq(JFS`*WTtz&rN;HS}|q2!6&mFoi=rXp9Q@|
z)O-A_KAbrv<ezKR{!w)QgX;mO7~5{&3J5hlz2~6Nbjuqq(J@+GKR9N+*|RG8gZQyW
z7ScR>UF`Q(d=&1<W1n_ZynyBQTc+B>JW&EKVy>T6HEZW<cWl4ou-5Tl^?`PS4E1$g
zdzp=nxm^CcBxAa3cj868oxw>}@*B)$)nz|Uc2A3NTK?_G`t7;x=?o21Tcnrp#~+BF
z^7ilzNx_c~<NV&qZOY{E%a^(0y~%WmSLB{m3`+~!TfE(Ny}jx1{L`$5>aK52yzM;4
zn<FK1z`9`hgX%ZZ_xlg;yslgD(QMA?c**jKbKPH>GoSMFt6IIl%J9+5e|k3?icJHe
zl(OZ&m>QYf%A6dko9Cr!bE7KqQ>6NAA!VC6>DQ{Fau!|Rrhl`%c&*;@B}Th_TD^`h
z;an<{Xi<5=#$9tk4b$;AiwsPn&$|7QvA4Yz!=I&SA9`q-^)=nAxeD3p6Lz^T`MP9P
z)rEzxRBG%Pc)7Pv-1jB#r{jgjIl<GNjiM_IK3{Qb>v)~)K128DJfDx!npG8#CU-8I
zxk6m+`r{p|vTrvn@x5|tlHFz1eY@++%H>bj-kI09Nc3F9cF`?CF9a;DV%ZL#vUo6U
ztEEX#anz2|+?br}FPWZA_$;&c|McpedY4w*IbD3w?a~Jqt!>d=!NuDSbu7NMf0Od%
z<+?6P)BKNZe!(uA;CSiflmiT#56cvZoNy?K)30b+EC0YNW=le-Y2~&(y%M)m-vs9d
z?pr)}JIB%341r$D5Vj~LnV44@D{lOYyLr68zDj8)@8y$8^<~y3wI_DlP1<F(O`Ofu
z?4^c6g5seM6Qoq%zj?Q+)@$El=@`aMY}&^SV}H$anpd@fe^tW7^%s9!**RH$zKtN?
zg)**lM{d;LU%dUU-sIDp8||!5i{BJG|6z%6@~&NC&y(&|xL59+|KY=Pzlyy#r`%!p
z(sDl7J0-Yw$&3~a{w}j)-@YySV>*}PmB-SI8`C0=PBz%s^|LBDP~h>uhZ>*!zB|np
zd8F`2;|jm)-CJg#G~T#!{Bkr|uvp8#pin$+{uI4?8;h2jZJsed{o?(M?YAP;rsW)I
z+7`VoJ!bW?E9>l+^Iqm-IQ)F-R=<$&@E1HBwYRxcvL-Uh^GkjC{p3x2-yVbP^#}E5
z-&(xk?&;~1g*IQiVDKz|+Va#1|6RXK;=8PT{>+&J8$VxT%CzuHl9rkvn!Y7jaBITK
z=?A~C`RqLJ^ejB!Tx)IHrp@2^{~q1u-M!Q)>>uCStELqu;j^W4*~2-$uP`^B^=Vti
ztF5OGZdhV-^$NdtRHjySi)v_AgK&R{ZjbV71xMNblC3R<9!FQz#s4{UEUu*E49kNU
zjaQQ&Oqww9+dk{Io$RIkeMz(4IhM^l{dtPvi+1%xQ>XB(>zj4YjQ5xS9Iy4OK9yNt
zs0}gCoZadt(X{`Zz`|WSWE6q~Hg6XD&$nE~Xr=MYBk$9uGCWWHx`?%*!@1zQ(nm)z
z);TLvHEhHxc5a)wAu@&6YH1yNNrh*iK+m^8Ic~Z89?z>D>sQ8=&fOk*=i|ojek&&Z
zPQ3j@=GBs9(~nzTA9^paT$wGSWM{8R#-hVYGUt>OE>5=A%UF5w#qZe@H!G~>iVA!$
zzk89+uISfGLUK$N+io&?=ze8t`_Je`FR#lit^H4fbri}NcRx4#^v78GjNXlzQ3?w_
zbnV-{(Kh3GTT$+z?@V8$o?S@%s#YmE!9)7{!j4{tJ4Y+cJ(RbY^O!OOcr19kq@=X#
zAhU6Jb$Wu|J2|dpQ!DJcgkqgv{Cd1G@8n;h&vR}yHmvKI5#;#(fWgm7vCcWa?u4yg
zBkdKgsvv(z(Oi9b{)D2f(sl+pPSJZ={drIRu-MRS(4jxePF_7J`?mnQ!OSMd;te<W
zj$Pj|Rc-w==gy@vGqRpOS@T1n=fFA_)yC&_=hPjiO#V<gxmhu~;-c6Fp#x=8UOPBV
zwQ_H0mAY*%bhvN9geeS0GiT3u%q)EFl-9n-C7Kg&)z_cd@4aBbs`rl@wqIKKm2d8Y
zcjDV0RHW4kGO1LHs2;h|>8IOc6Ipq-_2`oCzYb@rJagUG*!IX_-7S8-o=56aqNd%r
z-jgv^>RR33)22T@imcinvq?D1WBCfDg==@H@%$FxJDM|n_5Czn>xnET*-NW;l-yh@
zC6+f~?dhBEZ){!iBsj;}(Q(4tipgJ_YYhIpdDy;k-mAG)v$k#z`j>7ce<&*Bbp9q+
z_49kv{0_}#s@Q)rV0E;>l+VZI;xF{nbofnwD!=MFYrOoz+pcH(t#%5X{d@4ykBKwa
zJ${iq|L&UaV)8Aed)D4?HoScK*|k^FulS}0=q(F>rzPLL>)o+OOJzEDt!DD#+0jsX
z=y%+c<90riLUwG9xV`#R_o@AwhyU^%)$6^=acg7t$rW5`-k}epWq(LsTHM6m#$(7W
zzsP&8nLxvO|BsJfh2&+m`|&z_*Sr(F{n2uLqZ_wdWmxZ2+nKeTpEK?3apujN*Z*~O
zF*IagN$&dX%krc0Ov-`St;t3Q&hHa$a%f?@@2tl9=Zh~7N6z}rgSHC~oRqeFAN2CF
zT(k*)HE;F{M!RR6XSKi2Sef9r^l{gW>$iTK<53TOH1FQ*@{&jK4qSFQpIkTYa&7!~
zvf-PscEH1#!7ffJM}xiG_uXrduaAofeE#`7!v}>~g7ViU=!z|vZ<T18e)q^~`4k4>
zW!22r_Z_HcazCkhyw%gDS1wWi#xBWY7ZawxvJs#3#5<Y0v9mHl^0eH`%))01uerCr
zSjHc_*Yah{jn<dbuIIXnOTN;c%)iINyie@Gq=xdV(|r^tytUr^sq}||Z}+yiZu@x;
zC8xieI9*Yvsxo!GxQ2i7`EP6YNu6~z+xjO$xu1U%r|97aO&7m4f90$DRnpISL%i$5
ziNI}ZnxE7i7nWo)*kRqiO!#@quHz3yO9a}K!o$j*%3Z82X3?1KmKL+=)32qTQ-8M<
zaPStguS^e|$(3-vqVMS4{pmi(5C1inyIuJ4uJ*CdeqZn9tDKw6ulU7%O}m}-W5fFC
z8%{iaEPH;@<f$DxGqiZqHA?(Gz5W#D^X_!vmNkW<oa%;WY8X>W9~`_HsF1q7pie_^
z<;Uw4dmP%oo5WwgT_jm(c6QUfMe9$=M5NRRZ$8YH%vSrM%CfGmaLqAG#W&`Hn{O`M
zo;uh5k=e!frg_FIX4NNeoc(WySG-5^gkAQBr2ZEq_TH<RVk^WHGX1s8JC8W`E&fS;
z6L)E<Yo6O&5!AdlVp)2{C60F&XK%T^c}Zuw`$d`Hi$Oc}FZjP)$d__YBxA9c#`%R|
zb(4>0y}h+-dZdr{s|4P2$NN9J@Ko=XS#2i2<;t{ePNK=jPt08yBYADTl4071FM8Ln
z{Os!EI@B`t!K}>-9i2WhqzZqte)O&(ZAEXJRG;09UjA0W4R^G%?HDH|SbMH`CgA^O
z2g}=BUWRGrw~iXIBnnLQU{ZZ_Y<J*<_}tYTTZ|axJ9;LWa?f4q<Q^dN%HVw6Hr=0l
zBWsPNJosO|j@TU;++=gV@#)O=MdH(It1`tJXR8Z{#JB!1O1@;EVjS|WGsSJCU3{9)
zBW4bk)MLT-`URDugW1=8d)F!Zjmd<qjrFvkezA_<Cf2sB$@iL#e(!$L82YzZZ~o~(
z1%^J|5BxLV+NOKX-I1xfcUR}BZ&q#ldBYfAZryOUj4jNyX?a7?kr2D$u)wOG$lDx=
z&et|O{aUQqXSrI+yf^ai1%uS@FFFt0yPW=Lg6*vWg<u8U_Cvy_@7EX2h<qe(?vpj`
z&8Ka_(LJ^mH90pn%E{LJTNv*rU#ll6t&y_n`HjODwd&vZJM2vl<yGknbNqfrJ7`VG
zC;kUt3RGfjul&6xuNB>qt9E(CnQQ5%c^2F+IW9Qwc*FgSqkQ`>IPyMso!)aKFT94$
z*`$1XMcPxgKTU6=bOg9oe0XdztMk|-*4wJwcIhdX^1K*i)HhFe|8G`r*Y(n_>bZ{Q
zmi?U^w*=FjeA9N^PIu~_<@rZR&h>xawZCU?IH^uNCa_nrTcbT(#C-WLrcUu4O;01<
z6~*hExYld7f-8B`*Xc2NI-F%9YcCize~{zxKKAw}<HrK6A0@>(pY(SMPWQ1W?o74u
zm^J^j*qPw0Ol6OP-5d&XlU=V?Kd*VOTABaqtCVd0#$#QNiaQqY^)~bs{lD?v_-|S1
zuP^h?p1do^eNiX=^gqXYa~0=b{`>HFb^P(XT<vt7pGvEaxCO0guV%Md&1B4c$mSwD
zf1r|G-eeK$<x$^vM9)kNp2k^V^m-TDQ}t(+M$cNyJ|A7A*L?nIj<mF$i^98yvT+|@
zN|pIcPB{H-h3AyxuUq=$9E0ssZa=wyF-Tv~sX5svN%CrFOU+|m-_o72;cK)qqi;;|
z{~c)hF+gtai~8fs?iRM}IdjFbDarrcUxkOC1<pMG>u_*UDWlaFRz<DYrSo^b(%Lyu
zZPkVk4(Y4aRV){8d~#gGxWbL!Mb<f=@y^t{`ETb7zH74iAvrxl`W~PE#{~5dKKu4{
zotJ-DO6z{g&RlS0+oppz6VwXRox@7h<#L|v<9c7TZ1K^|cP#!dZ2xn}oD0xU<KFLi
z<+FE}_+($+YaMfh{v@%5Zeq({G*{uenO|=mb8ph)<7{=O_VY+&%Emb;M)QdX2rX=2
z?b7fxykVWP^Q4{o#KU2_KYuPeH*KPY#+_{!GPYi{`r@|!F!zMG1_=YDyfYg`96#)~
z-tl4YqT1Zx<jqlG@9uH0m{t6yH8dh(zH7dPsMoUPf?X};?!P}|T>EDJsCD~4!BdRv
z4PmPf>|VWtWnP_lvQAmxW2b*6_sUi;uJ5h3Y45Fkm?1EWo#VQ3SmWnqD#BsXPo5Pi
z<hFjP+#9vEVv0q?y!6Us<&AzDIlPz|Q=6yAscvgJ%+I`uum2#wn18CWqkZ2Wql;7g
z`$FYiXYT*4t-h#MqbYq;eaQ*6g>y6y&TMbrvg1`-<h%WOo3d+e8@I4d3OID+rsTq7
z0#lAp4`|}nEzrwKuYY_Yb<V8idb!4}UBxVQWwJWGDK}MJpKRb@OZCWcS;cz3<znEM
zQ-u$`BAe3O+znHo+~rhB=V;bDvetXG%yX8&O#k~8x67-}YQ-;-SeG+*LW}!KHP(rN
z{gU<R9JTRNx8Jd>&<a}pe!Frb-`qvMyzSdrBezLO&wt1A>gdZuH8VQ81LY6#3h_9f
zdDm0ftD2&-T;FP|qfba$ao<nTxHtFWe|#veZIqI_cXk1P#o<3&o^Ros81Y5x#`zyi
z#ts>g6LeG?Hm^3d618_q`oDZp{qB9AUx(gq-sL9H$=!e9h@q#+DTyf##~y`W{I=21
z{k`dHEltHat(<1h>Nwu|n_u;GF#Epg_OBDwcBYz6_h#Pe>(^aa!?wxb!yAF_u+LKr
zwS?^UIk#6_y{djrQRkndc9jw9594c}KJVk)RUUV@Lpqy-Z6Z%`566<#EAn=oGt0_L
zWP6o+=24c3%-LU7E}=%D;jWS8N~f&;W$)f5`{=WNP)GqAS5}A2G_m^Q6|z$2+(j%|
z=d<Kndv$dk4T|GrwzU@zKeDIwyYVhrPI)8!t5*#UZPIxmVz=cdtHL{D?aT4KjfW=w
zOTWluli<~Hu;l-u;OmpqE=nb&PG2y6-DipZfD?LKr<Yt_smx%=@aDh~BUkl&kJIa3
zC9PcjY|5k^jQZWS+*TQ@7BLsy{_|Y-grHO~p9_y<;l8VC+EUN&L_RyQX2$7Q?$!qf
zKbSG}$v-SDeQ$Bs=>vc8^#i{hrmxzzyX*1-{Y~0tjq5*g<t{1Skm;&$dZ!Hg?x+~i
z>8FMLj|5(QChNcvRjL<%H!Du&RC&g#2^&AUacyd_EX;S_tjEjIyJ6;<mGh+dCJPEq
zKbpdFNkjQPQ>g0;$M>NNxULr0sjPcG$NG%W@=W_#k)M1#{vO*=>G()Ne&_Ymr@kNE
z)IL@2x|8{lsN|Sy54JCsTlJ7#F7+Sxi!y$fdKSiCc^wL@LR;m8#9lw;d($hN)}pTA
z_*gXUn9kC4>CFe`8TURAyxSGl)X(>B{sqo!g(7)|>@%C0ed=y!tUMaL!qv(2%!lY1
zsXyZ^FNm{uZ&H}JZMmMQhpel@`*7R$^~+sON{T(&`r@_n-NbncFDEhQyIS1QVce?`
zzwWPil2G=xRp~D4PiixEsj+unT(_2ofkQ9u>DkEKZ%kL2^_BisMmKbc=q)#GK6v}B
z+TN_suTF93oJ`)(aJNWSVPmQ2QOlm+50||%wfW5G`=(m)?dKXDO%A=2vrksvznaCk
zXen=FYkAd*33i9ygnA2KJ|VJv=FKlLg?A5~i(EQsLPhVPy-V-R{q=;ach;ZG+2=J9
zT)lV96MefSzGv|-o_<&Ux$n2E{^@n)>kri`Pc~KV*KP_oTdzrZE$HvvEwT4CXZ)--
z=li9SJ@)MqVXPiLmC^!fiq9?_`_G8F9dZ@VuW7D~3=D^v7#O4&7?8I^CKi|I$H!;p
zWtPOp>lIX%1|G~h<RGy3eK=3WhomD_*$dfMuU!%`RmywelnuVe(iCS#mW3bO|6c8w
zn&wM6v2SN*e^0x|m#{r{54-kMg-D)5A}3ciI~B7V>rUorep#W!W{_TM_R6~0VD6ne
zPE!>3EJ$q<@t?6-uSVWtO6!Lw8o^?dVxsDeEmxjs`YaoNX%!2fyVsngNjr<u6^@7m
z7w|muP<YAHB_ox4;eK3qFZ=C?2cfIj&K-9;vhmDki?-??0uRm?q}`pP8M^fFsyVq9
zzjRxAy`*DxCSLG3E<5FvMvCU;@Va}s*P?@auR7hI5*m9?zHk144Ob&rFBqRYY!{>Z
zDC66%nx03?|5nMh&i;BX+`iR9LNDQt7gNZ>n-(wfu6>YNuKn5mx8N7)>ru;3N9pdb
zy0~lIO{-iB$Nvv`m;dHfe&JSI`Mss)>K>NsmsT%cBNhFz8*MMDLj#-OR9*&#m5vMy
zvY3INnOBlpR8W)(S)p}TIyV2d#izUbo7(Me98+^Dmw%_|z<*-d&D%-0mu1|!BU{tx
z;JxLn+p;|>Q?I=Ey8k|pr{@wE>&`o|GUptEyPxr-w;3P)xgc)BYyS2BD}PN(_t7Z(
zrIzmWSvCDr&z$_sZE4HxRrTHVPq^;9>$xu~`_tvq^8dZkvfb_(hH_2XTpc#$Htzw!
zvoF$ECZ}hw^9T!It@mE2Dc+UQ5D{?Hc+(n}WtEy42fy}l94ne894i#b>2$QOVByR=
zUTpP@;hKpT<gHnC*cRwax)?M~deXAfUg49LYCfEut7+=c5fmKb((9JDCgiL6*6e++
z?oR6#UD$QTO)PTK6%Vs$Ez!y9Da}1%H5ca|IAS|}slzqtg#Lgfo99_c3jUDj+?$ym
zqieU>Xa0=)dmheb+#t7yUGwSlqR@w0r~3ZsNbdc8qHg_+q66Xzsd`#sJo}z?>2W0-
zuz8x}x!P&DP=?04$g1OI>Wedb-c5Lxt?THtf0}Dt@-Io1^D92IPxv7^`QL?|Q%aum
z?|C+J-Td37b0-`&&91vY-E#HD!oBwl&KlSAgnf{k`bb-_X`#yP<)@n-o)4)Cm_B>$
zH@W*y-hMClS?~S+XYI?xe*qy{+aC3JUesa8`J_5ib#r~~4j=uxy?cJVJ^OqA{F#;0
z{#LKsp(p+B{M3CLmG8~DajoLiru1d&Yp!2?)U4CHO3=A$NA-fDrFSmd@=kCmKf)1F
zacDzSd$Hw<5{rM{oLsZk>T^Z?d}RJ9*3I4Z+`bm)aHE=ejZyIo{)Qj?-#dH{wPs7&
ze(t&HjH9em&)mAHl2;eJTQQnp#lw43Z{B?>J}p#=_eEvF^%v!vw$~^+^3LPj#TND1
zae?^MOHb3-cAuJe^7(Nu8`(F1zP|qQ>(%As-QJ(N_Q=%ksVOflzS;N3LTah;4|$Wi
z?WyJ=e#c(s*vKw5pL<YRVofK*((ht(Oa3f~mfIt~qf&2&-{sDvqn}z<Y?>tLof`Sd
zc#+AE%uwATz1!_;Lw{{Pz;Ns1mbpCh{+ua)elqp<-xdq)(DVa`uU?aj{T%senzn7e
z@3(JaGiu_yW~KaDk;Sd!J9*ldX)k8Q&0nHd*|sUOn@?hWZClgTS?eF9-g@74;9<Ik
z;u;2hgZ;dM7mnph_Fd3F-z$=p-`P|1SB#k{KCq-A?c~lIM-^09*dBOXD%-hyeVbyF
z*Q#7U)7dq$)}1})Z^d8U<I{N7bdK*@<&K(TQZmOC4zLQ}ta5&OS0RI=(nPnb<gCV=
zidPyk(pr5@?3$Mr3q-iu@*T|!E-0L%BRTJ?GiRei$;t4kCV>wNCSJ*i*!6@}x+UqP
z>%1nf^(uFHrnrZNSUR&ah6Q?^YkMhv_H#+-6z-@cTlx(8U0Y`Vk==0B?!)iIQ#YqM
z&QRQxyd+flH(!iX(83p4GuYP7NLX;<seyMw5MN6RkM7x1ygwG#%-|4ZnRa+jVYMC~
zQ+`>!dB6iJ-Log{IsO!%bltVI%GM`z&w-Q~`wb@kQMmBiXX&hUY|=iCM^`bK${(vZ
zr{Ka8Uj5|V!sT)rKh-!TmTgfJXUI=f`jx2R<5wWkm7E|hs$X=0!AGEN?sPRnOEzY!
zxylEWH+FaL=5KC1>YQ|j{r%rp5iC<JX0fePaNFRzVBrV%we?pX&3|dIgI$Z&$LiQE
zv(z}=l%E~JNsN={ER+{soN#Dz)2oo%%5PYgbtf_{U|s&oqPdkJdBN^U1$TH#uWmZE
zp<~W+Gk5u_B;8extG?%2WpT?+jhOAE**4?URO=6~B|X#CkBGg0@cZnPIsbTHYhB%z
zQ2a-8@6OzAexVWvt|aYRu@ljU*BzK{-5zh$d~bnIx~<NKV(vSMXA%V_oSDB>HQasU
z>d9B89=kp5--51y|2fy<r=(t7oS>$CZBoD#6Z6z5S3;iqnx(xk;Mnlv;`&1_iML*z
z65`(2(!JqKk=UDAt6N{Rq)Fa>#W}xhNz&QpyS-IXIMOGF`<>)kWhxvN`oaIS0K1`K
zBKyhsxQX%`XEtqBOyCX9nrQg>@gLO-4BdX#d)|dCGSTStkyE*zvq`32=*9Vsk%!-9
z1_qvu5zPK1Dp)&v(T_t-a+a*0*1!KDCawEl>~ZFXw!60{ZV%n2!lvGzz;D{`d->4h
zJfSI<WTYA2PYXWsnIr!3%sYwV95<Z~oxGm^B=PKK)5u`g3`NPa<tYbeYzQ@*RzB0q
zq1-Iw`lUH?X_qdhMXqMuIe+^ypBJlB)7SgVY5S$~qOI|U*VKf46BC{pt`z*i>L-2U
zs=(#t`8HwtZ;DtJp1hv$GXL+}yf?|ozce%5x|Ooz{Z0S6C3&Y-1v465-|LZcdzB-%
zvF&HW%oX{phi0U+Z1d*y^C|c%VJjjXB=LE+*<@wy)hXVgmp5&icY9_<e|)(8+0{K;
zL)$nLyn1w-+g!ufN2de|9pal6IiLHjrDx3M&|_?@>!LO+ooAQ1EK~6Nl5a*%d0P)I
z^PO^K+x*WqMrZfgWESS`E@^yLF?aWj({~pe+g(}gBK7v9*TiBTq4^f_Ov2kVPQ7{8
z`FZ-508@wgpJn)Fth?ZR`k=B#NZ@t7oYqE(y>_2eTm)_uCsdsKX?yg8(}EqWZgsND
zU;g~6^Y_cY?cc-ySIl3Q{QpdeZAtl^Ywh0W&z<4Y%Szh)>&?XVHhs%u_d3+yOL$S@
zcgG;i@XM?}4Y`}DnA&7+bf~u}+Suska#q~!o#n&ddG3Jergx{a=TBmJa$Ljat7b{j
z-(R|myl*cG+O}I*BWS<rKc4C?26F@b6GvwS`ifakn*Qt-+l1@erhhBj`OGgprOSOv
zsN5T?t*csgtbb{1EHT~3NP&ajde4?5^#^x8Fsx5Bl<}#Q>lFSiyP=YQ&9dbD?YZ(F
z*=rj<xBS(8d?WMyyqUhg_rA~jZMQ|Jd{IrqgPV6B89ui>E$bxAth{j9MyZ?Sx82uG
z{F<Y`>geAiC)-ZHU3qJ--lO^&>0<)FnO+=CNV9uyr6bL{xM1=0)Lk9L9=j{rf{v>C
zgxbCku#P!V&mprU_ixUD?>pnH#H03q^|yO2D_&r*oFjVOkB_#3zZ4(0@>wn}>)olJ
z_&83${=rKt{cfL>rAPLKMxBzmys2aP@|cbH?k+$1V~@s!W9$q$b9HZqaK$jqcqioi
zJ$L1fsrA;XoocexmzE!sUX?l7^m@Y$Kl^GcEeC<Gvm=Z1)eH`Qu<})rvdj47-+l4S
zm5K@9xR3E}+!6HTW5cC5_A0iy_m!vIaaUd9VyN`ibkTo7DMgPCp_h8oY$u<p*s?qS
z?b5xIMKxmH&kH*epS`ntPR=~7=VsTo%(~hcd{bO!Qc1pg+mADi7Z^Y2TezjU_iatB
zSfI=Q>551d&)FKu)gN6fp2U8eCFLw|SY=J$e*asyTkl>vrKo83!PC6!do@>IVg*nC
zZTG(SW@4NwW)^X`#aHuo9Q-HmY>@D3)4C~J=hPfi=Ki9;c;DJ<2icn5Ybsnbw|}K@
zM(*Pa;|7`JUk2*_-J9+>8LU71bo;-#raV5gPG^~keO&gSbe+M~-+Le3jIBN7-{ODa
zb2!tNy=#sgZn}Qm>FjFze@nvuEj4RD5`I>=e4@EfjEl(4cT;s6zdc*LNY%IMnQ-IL
zD@($B?~3&OeO-F7YrpX+KK6V13-|n<_Qd4F5@n(PFWE2oa7QM&`iDH+`ht08xysvj
z?k;u?0iSrj8tpqj*YcoQvyFmE`Kc?~%f886o_FTPM6pL1lYZ>^#%XJx++H}@`rB51
z>xh5RGu+;oJWJ%M{KGioOW2Owl~s;uMdDX(Me_&goprvh`fZ7TX|vlT*~4ahceu-v
zIrz1_n|DO3-R)oBSNlz&$nQ>ZkM64-)^Ds1ykxXboNj5zXR_)$uk|fkn`3^_4{TLt
z8l3moRJ41xjn+@*opJoXjRo1KKAcx>=5bngbGZ7(i7mCyKE`b>zg4f=B^&AdEx;g&
z`zwoFhvuZm*^Uz|S2MV7tlw{_B){oyk-eAjF8TFNt+r-7+56ItN@X1k6Me8)^_WeV
zNtl99gyi=*ZFl$XSpU^m^@L-$`X=@%UmBkVr+)4z+nRr|BspQGYiz*XKU!~JvooGa
z%YSa16z*(R{`t(N&exec*UeU3)GOFLbFa&)_1+2-YqNykZ29jsjdhl)fY+;&H(u}V
z%RO9R<@;yfZ1?w_Q=fUBEw=yiGH*p>R{we)4xW1gzb|XH@Vqc&YW{xpUkMX8N3Z<i
z3)Qvn{Fn1ryYyeYzVGaJ_leK57{8vL-dSn;@)A!|w@t;bABI<!224G2p)*U^$dXUt
zPfQr=oPcv*pRmMm+?;ZWE%c#om&b_>=6mi)@3=DIe6iPE-c=i2N<22SU%B(><+Lfk
zUj_v;ZhRqE?DHpK@yU<5OC=u9;s1C<PL;Rl{ncd_lJg`CHuTNO;=3Bq^(eg{{ifyq
zUhUS|msh1%?_AZXd)8NJ{*!ON!nIy9zk8?7$aWz||JFUzYo`*H-?H8Rm${pDVcFcu
zW8eDjJ?vF5Sj5hza(Mrv#&;qHuG~FEatfDBR;~UvBm8Vy$icf0<Ih_LOe;5j{xw8@
zb<w8ON~!(5sl7)Zzg!$D`Pk+|ZrSA$ja>7^@j*P&PixuuXJ3*}b~|shu+Hx8tuu|y
ztDXPu`FBsh=!-dH?y`CH8zLBmX3Xf|nR-L!i+aPVB~?~OvwT7xR=@s!{oC8Cktr6M
zRn0D$I`>Q0O(=;EG7}5l-{Jr7^2FWIYyQ<<+V|wssW|5BdCM37XF}~v&%L?z28R#>
z!yj)326?RgxuX2yg4E=a%=|pPg37x#Z~Jb0^!@*>`O3^*C0SO{_y#lIv9EeYp6ScW
z)lVi|+I*umQ6p>TooickD!)AJGk?Lp>-r9L>rHl%@<ruFlW)&9p3t`@X`_c&cgn=j
zx<mJB|9^V#zkjvYy)S=WKAmOmyme*8_Js4_U3Wh9-+yl2T-!wbTYopM&fCWP``69z
z{|DD?o3r;>?d=Vw_8)fLeZN3nx?*E-!vEj<8UDPsw`sNie@<_9<Mj(S-rim(v1*$o
z^NrQHS2u6ctNL-<%sJ51R+`~w>BVr>+daOW6I^3?-LDnwdzNjsWsS6Sn2CEB<Egy+
zg+I7=+~SM7RPN8%{o=y4^z_;5?ryZX-*foJN1ODkd@m#xxL@XLn)A<RuU2E--#fFm
zA1;hHHDB}M=2WL?sb{|2c)NO5`QJGop9PfWHh-G2S+;A%x^>Uj+&!(>)F&G+?%bH+
zU2}oqdUEJ`(<?{W<NBNnV?SH|_P%)b=I&g^zx!6N+r7y8)%x|fzjg?`pD;JbG^?h~
zskfMyNvl0(|9SJ=<%yjvfepKkrxrI<M%cg4b9=&9QEMJoe}Ahzqukw4<2Aqcu!*jc
z`j>ROsVP%Im7Di-Sj}H;^DXbbxnBS5x4oX(WKZVx12;dfliFs@cjx8%*up9O;->D4
z8j^qhEz<p8ztqH|uG+lBp#8_1V@hjYJ)HObuxjAy%~^-nZCYJlQ$KP4k8h8T#_Qkz
zQ(1WIf$;1V`5#V)UcCFE@sJNkh=Q$%ETe5mt?8C2)ApY<Pfyyor}k&r!BvfSw<_~g
zosDEpI?Bpub!OX9N1OG>Yh$M#Wr$BGoLl?(@zZks&#Rx?|M~eytN!cb+2Y~T^Y8CT
zex9Rw%y&oNx|DO1=6CV^U%m9(gJk_F+Whz5wCqzY?p!7w<$iG8?Znml!uR-}3rkNg
zTG(8%d)xhDL&N)@s`#(DDO4URyUI7sc1_ZRg%_Bvi7W_C=-kl|@tJqc!&NKWZ2YU^
z@}I3?iK*Sks2X>`#WPjwRjPf->X|Ox@-1g|G&be$Un}8bl*ux=g{k(k*_@A39TDqd
zTzEfJJxIIoepQ_Svr-iQmOBgINX^q;>;7YUsHINtt@ATq{rY(C?XKzB-6dbxl$0LY
zOE)&$xLC9O`i;tC^ZreYZD!oEh{0B7H`@+rz4GdvIX|qd%u{5SyxTP6C8zTHmUo=1
zm2`H*JuTmmc3Y4~cd~bCZ0QM+8ETymOK&&NyxU=?y2fWpo&6Tm{3o*%y44qR8?WPQ
z^Zxwu_D1c>dt2XbaPU0ta4dU4)~c_&H1aDq&&vw)-d4WF-*;;4e(gC%AuBlAgr#im
za%P16+Ne+_@!;)r6VEjD>SwdEUrf7ky;kTYYu(v}eLr@-Ib@gJb@I~Xt^&E}A1hPq
z%G{2fVwCykJm1bR$V;tEZ|RcuO*4K89-omK=9!^x`My|b;!bthhvz@<ocW~quYt97
zV$>UPagR(PhZXAECAaL9c&)gd>32qt%d8c8CvzSubl>igN#;z>3MhQ|v$D8n=1j*Q
z+S&1k{0w(*dsZzm*If0+H~%-QGIJ8P>i1NKcRfBSs(ips`uhQXe|xK}nIhQ+Yh8<t
z#mpbXi*0j$w`IqvITDBZ{ltIYYF7U@@zCw-ayC@~TpagpIo>L3PN{nCsO4!nAu2f5
z<GlA}zHOTK+<$)b5Wo58dy(wk%V$k0Yxe{+e7oqo?fBm_R%WL*7Ui$IcE&JBfop}+
zs;hJE-g_ywX!5Se9j+nf*~=7IIJRC+T&%6t!TQI*!uMX`ja_RZBd?hLa`1hpGt>9A
zZHDzfcX#&w=}IS!zs-NM`gkvooeWQi^}U=xo=<C?osQi*uxw@eQHB@YaaCzowVYP#
zC{FX)5iB5b#@&8N(1j#P?!wl0ytY?PEfx8}z<skp%|umP!()bBG)vvm;<wHJ4&=4S
z9{9?wn5r@LjDdtwAan8=H#YkV74}A36djK{^Y$MqiQMRZdxD(Ng#R9YrnE1t4iHj*
z85l9GDb;Y2wz${w%mX{m6e>CPX)JrXdFt)51Ge{fM)68Y{4zNhZqP5WxIf{OnZVq2
zo$GeBNUQvlJN>wUFKwQxw8&<2cNS}n%bZhMf~MP>eCANl^@`<T&M$frx@PIq@b0Nk
zd7929X>3mt<Ty3O$MVh6zBhlXH&&aT-ZIT{V#&9Ew!3eCYFm&Q)e!df!m7~VmURO6
z5|~nZZ*?>8t<MirZdf$&gbkmH+=GMbY^`Ef*-mskm(yl=QRqqG?JecLo4S;Q54!&s
z@Zx-`H1ESzB~QkU%sbBSd$VfqjsFYoH5!^*ad0gy%|3YIij<fb-^6W>f}1)%6uf6;
zsk|$eEvm%Xam6&@hRAhxEe8E7OoBS$#;Y}UCR%fxENN4IeKgALV%Y5DRqkqP@mrh)
zG#3?3ywj*L(OG8k#?EaeS!;Ht96YvI_}-J0D>t0CR0v!X`M}xib>h^j#`nKUo*iwL
zbCRu@D|N+Cj%fnh+u5sLvvVBa&(##lU6H=>xXf?!h{v37{#>`aeJRC6>rB|sO+1Hx
za_xC&ujr#_Jw5V4Z%xi~3%`t-*f$oF1)dfg`Si`cC}Z}xvRBgIID5x}%Pa2hIOX+W
zN9H1?39H{6XPfc;``=IbM$3hTZ*M*L{PACz-u^R8Cwu%iuUq=@Pze9sp7cPTgI8ES
zx6Auf)@*Az@h>yV<lYjSrr3k=SIs+*n;!qua5u#2W|NLyi@t&W=J>f6+%v1$e#_J=
z3TCgkvzB2+)g{BZovqV$RNrL@pV>7_w(6JdmQ@nY+w}jg)2_cMD4)N}Uf{n-?fKn`
zw}Oue8o70JpIXZPcK_|~hE5-Me7k%9lIO%VhYn0N(N?-;cU%0h+3%HWrA!0;{wXf0
zdBz>Ictur)?_NcvAeZR)hdxg3C4T*{MP<({y?4|w{puSRA6;2b@1x$If-YS3pC90R
zJ~Yd@dis=S)@vF%4)4Ai_b#k@C#UoB*tjeHu07H3FHX95?oY#!FRylfY|ot0A+)i3
z@^p{fKU~(A`M%!PoSt%jUv2r<(*_-P>~H$*Hdgw6Icw$xouriVH(8l+G2a8fE_>AC
zpdJ3I@0Llm!~LVb88QvlDBk!cv+MDp_>QUb^Oo$)X%t;_KIPq#OBuQk@0@;h@yLUn
z8`JeFp9}tTVfuJyI<Kcjm)h*mFE>wc-N={!-x-*9;fa*GV9(;vpewbr41e23Y-U(#
zn*Yc7<acIo-!Ix-`^6vWa+IH|lbF5m*2nI3+0D5!5@q^}A7_1>e)hFTMZLSi{Z+P&
zQ*)2k%V|fPzt<PJ-|vah<_`<cUs_N+E$QabCrdWVGky|n`Ja3|b%kNG=)?sVZ^?c?
z-eR>vV^^k4+`1E+7RX=h`^Z*2_4O6btHO~dW_|gy>85boE93O_TpS|l3+Gi{?zVk?
z#z@F8@R0WDjV^oNPLbtV96Uww&*}0_;zpZ$c!Z4CukN(?&M0;w<H#<ztGl${Eotq0
zx#`%BgrIPad#&ENE*oRlB>ogU8YG?mBBzx%@L^r&i#S>DQ!^%(hOPN#&d)e$a^U=K
z@AMlnY78zPE|xK8Z1_~Z{ZB=npJ~dCY12!u-l<CNIQRU~{xx~;H%L9%tmCj~w@-7u
zXPVj~<3{#N@-7W(mNq$pKThvlaQGtQ+binAjBYP3+4x61x5)HYkV+`u@PKbmV(P`h
zu$bhz({h3xbdszWm;Uk(E?j)^@k<r$v<-{be!RO(RN=?eG@jjU(Z4N(gjDajGrHX9
z2=3pk+$1J@WNt@3|BOqS-;eYBUm_fxd_?t&<@Bu;9CC+OUY;MlWs{`+mamPIHyrQR
zTqdZoYWnsJHonWZ^PJVAv=>i|dmt5hEFk%Dwg2O1xxR0?fB%@#Zf=>Ny~&@8^@^Ke
zNtaQ2PMojG{q3wQeXg;|Ih{YV|N7LtO?Q{oI%zfYTKqaDvy51mLkC5guh`0NpE3Pa
zp{t=Q^W@2?jS(iF0s;>#a$9fF8*oIv?%k!ZrLI1&r}l&%i*k9N*Dd(%(637IL(8^p
zWw~2s^_anBf7OHty)`MCyqyQD`YTm0cfaX>GxIv<L6I$)JJiz~j=Y=|Blg)od*@RD
zQ6HV1mXj-vN-DPOw0ie*(wwsBR?$NbR1T=?hi_ssOnsBt8C9@RLN)B-?1*Kx;s0zt
z1<G(Z7hcpoe?fF-X3WhQPdJ-vi%wQo28HGoR)0HtboF-o7=xqzU*^Vimg#kGl5r}x
zS=_#S@vc|Pm>fGTUumB1bn@V7ogry{?pn(Kc_At#x`)c5q*Aoa^=EjzOS$><ibDt&
zf3IudrH^unWrB^{inh#Ro*3G=y0?2#<@~T-g`*l9ujQ_-f9D;q{cA(~jHA16cPTey
zEjZ9WExA3C>*~C>w`+gtl$<&+S?{y^>r)T+34T0xHj3A9*R^n`%ZJwrALLSG`JK{t
z-*9rw@eT8}ZvS_>@~Pw<%RTi4?Cyo9q^GP6d;Rp&Qjf^fwM`YuZEPAfV#R{$Mp`c>
z|4jMQaPe|zDYw1oU#Wz>^$m`zXFofV$ohw8_g=C2_cK=-wy`Up*wCWhn|&^*NX@E@
z?N`X9um`zkqT;jGD2fJiIrpdgr_Mad;Izf`zJrRU+|i|t1tt=wUr4=iyK|wxPR*Qq
zSGB&a!#e+|Czw@@I`~By-_-0D|D~!m<ACY((7MWq(0D(GSzjK8y;SqPynKDq!lzCW
zN=@5Xc|z9x2z+;W_2&6Tfp=PR-AqpNCz*d?JibY(IP)KamD(Pwn^(^(6}v6_IWgky
z;$MQc-@a&@y;4ii)|>0s+OF~Pg{CxvLS@~|qt}u?)lB+!RK>NmufUkqKju{ro9O!P
z=nl1Ge7@2-yA>NWxNl4?bKNic+<%6J?E+@*mHA2vpJj6S7QT+?;;_`|S;5P!+1#;L
zpYy#@;X0R{=?nXq9wjTOtzLKZVx3@iocvcyhTrQ}yzfe$f9Jlv!<4XBz2!-#Z~L4m
zN$6qiHLyAIAw%<r#-sETJ>J`tFQh#F8DjU@<y48*$xQEPrFe()S66M`trGTd_uqmL
z)@hd~Bpko6Q{$+l^waR`Y9&V#_@?B(c{nqft=?<tG)|v_yZ0K^o~vzYIcQL@`Kd%E
z^ZAuQOIO7$`o#L_%GPp@1HNV!Z)SeJ8>IKqXwOfdCz^66UY)g#OP6zwkUY5H{u7^H
zdyW+wrtq5o(KEkuynG&)__DSSS_1og_a?J;E;`{PY~<=c@%Wk3i>AA8U}Cv?OLk=x
zy8?60gBXPx;iJpW-F+&WS6f=TE_1i6-I9Kt!q-7FR`PijH_m1aJoA}-YU~%!#MT3>
zoIMi~kLQ0ps>~~?9`tH^#bT{+-A0aEg*W=0-*frw<!ShOD8iyn*&;OWyBGKI#EOO>
zO-8r3D(aJ&o-k|;Ul_*zr}gk=t*p1rMU~r5`fIJ&d~bi1(EE))nQCwOTwJL9ELbx9
z%!bLQh2`2(o~1}K{dxYYphn17=fonzv)fJFgo-ymE!WGu^y})Cjz?eq=u1t!_owDa
zN5!{)+yxRcA!eM3)tQgtmwC@WvS4q;>*d?thPK~lQ=gYrab||J(tg3Tn7zd_FN%Bp
zli%<t=I~G5kIL&8{eJUj^<9q>9m_PH99jN%`J&(UF5f#je|TSH)qXTRjIEAW&ETbu
zr@+LtMcnT;CaZ7!WBW4ub=-_w1snYCCMg>5i>$d*cw+m8oTm-*cAK->-(MLtf3YA3
z|2zKY@jrhXP4qHYRsQ$=X&3E(EB>(_`Y#(NfBK20aZwRNVfdHNm4ex}+cM7lD)+Zg
zzV=d{rQ_a-4J*Dlx-=iLR_NM$^sdaEA5RwrEP4Oj!l3qI$cD}O+xP4_`%z(E{d(5=
zZwK%E{35k`qi1KO@b6_sC+-?gpXT!3Z0}Mt&q?7GvO?R}MYsfX>|vf8bm82?KiZXh
z=I1Uj|M%qJwv0t7$&xGYY+Cd#I?ez6?D>s~60VWV2S4m`IbUOw+pJ!qkg$D8>J;An
zQLC~zo!jiKK632NdUv$KHgn>aPOpaRk4j?Cr%dW^Ef(4TKz)+6dRD06CYNpR^7^iS
zx!|2~uJvkp@eI9n8}2nngzVL<x)*e@wt9Kcr035M9_=t_|Kp;N_<Gvu`CJEYcgphZ
zNZWtdzU<F^+W_VUNBKhk&`yp9TXT{7**jIkUVif5^~sWB=bGcD=dbQP6vMQ5;RSWw
zD_vb*wwbJ+cu;rdqW8zE%Y!~P_0GB)EG#*3(#a#o-kn=DWm!=2*VvShl;;xl7qwP9
zy4JC(*=gEs_I{A7%D2md$4`BKidx5{sUnr%HXm|%%BJ%|AwS7YU1dRX7n{TT*B$&-
z-|SHbkpk8C9}r?@V3^8>bx}Y;esM`bQGRl2G3cD?vthZ}w+#gTy^AlL!0(%pe5)>c
zL9<?MWJEL@Z}MW1g}0u&&DNFl)Z<S6U#ot*a%1xDSdZ<`nmhf=`{z~r?JDNav!7op
z8`sIO^x#7kmrPfcfc^(2PY?36AOE-Tdh<rF=TSE2bY$e^_BOxdc_`I8N#K$2F)d#W
zKAlfTl%K!!k>E(md$DrKQzxknA|DU*awwciNobv9BUZ*IWOzhi4bxoD2St2NQCC*F
zRS8YIloGR@ms6ELV54~EREFfhG~?c$MvtJSx~v|lJ8vJZXzl;6(zBr@v}%sj@1+}L
z4!DXPUtPZb%ZAS(C)^*fEt{vVG~?Ih{Q2i^{&@WJ$K@x_ik>k3<;tmVoV6rII_a(G
zPT?0WR*uD5(=`H%Z!O$^D<|MUi$tK96W8g8`w23<2|wiWrW{GS`*+UG{<${_nA-0d
z>G}6uw4Zl$nq_Wr3-bi6BNv+{{cm*Ht?12M#Glv6^-Pq@Xl<-&cW=v?UcStiZ{w!f
zge`g1;<xo#@%BXJ*-x{g7x6|~wm43f`K?|Mvh?`Z#UCpL60*20XCG?QTXXD}56iZx
zUy?rd7VdMi4o=j5ef86|J;ilysa6il<n|>e%varY_>bPHvWv4G?m8^J`Yh{R?W{$Q
zXQUtfn(epX-B+tfj&4tHsh_``*EGpTFSYEPce3Da;_D|$*Z0NxYi;U0!*$@Vi*aez
z-JSNw*go^D4$SS+4UIfzdU(IbT)x=2^><7vogcnC+UK=zR%ZHciPXkZcYNe8CY1Jm
zJr^N$)a2Rw%r$?0?LGZdt+I*5i&>WYZ_Tkey&F#{7RG(K`G7B?^+DRo(^IX*i{|@3
z?pkptLd|K@^9jE<T)(|o{pt1lJ#r>pK}zq#OXc;ss-CX8w7zcJpS^!nC9;1kb8v4u
zxh?qi($c3-Hl8YXI{W9;-Xh)hwoEZmgEc?j?DqS7q%>~7>weAq*}luSY&*=N<@rNM
zrGB;JlWl$0QY&_R<}2Uw^_W+FS=aMj4zh_m8XJssMBg?XoFDRZYtx%mzGdN2F1oID
zo|FHGGwpMk{dvb@FCDS%mye&_F4p=l`WyP;M>8T6n9DdB7$(^;Fi2vK$QBfV*VyP4
zRGy9gpMQIo;QzbztkcaMzCDu2ZTxG%T<v^oJCkhO<)pK1jD3n4MpHk8E;E^wCC&2l
ze!0rm)=3_<8>j5q*^t~>e*Cvg|8eF1znrx{|D3MZt5a26CKF#{k)Y+_VsLxWX%mk3
zACJyHyZWgAi`Yqa21Vui7iNdA|KGIkz2UEpN~epA^@j^5$u;tG%E*X2)YST0a6N7~
zT<+xRpyAGBk;m-kB$8?(qO#D@=Lqv63Hc9<oh%!B7B$!@II*T_9{#|)Nr+AVY`M6C
ztD(wArKFRBKkKG+_9WhSe=<YOhk@DGMd9}YZr{x}MRJduB*>_|zJ8xWooUwzY5ko)
zw%2WTd%xLY-8}K`IV}$#O|S6a-0RHfe!css(_z-O^FErp*HnbxW^Fpp=)OREq05hd
zlO9_{G3#W$U)$3Duj}5Lzyt4Uy7nJ$NwPoVBIN4&c>Z+_Z~n#ubq8A4b7UOa{zB{x
z!`b)EGam0z{yFiJInQUEX=mnz=U@2i)ch|nKj$?=%iHOt%O>2|^^ld{ByKa$_1Vd-
zF2DFq_Gg_qE%CYd-1QC@vkx51X(dww_Gs|VQFEBEN#)2KZRPbBj-Ky2mMYz5ZnHbq
z=zZJ#`vLjAHeYiE)@prpoRw5{!ku4)Yg-3*f!HjW58FPhJsbVuf_BB@SG(C_HsxJ$
z_GBrL{<fOMgmF&u&4>5rU)UtX;(yFw{h9-f{;%#ECY)M2>%w0Xivu-t6B?Of*10?I
zKl}Xd(O0<?&JR9Ym=mfjzLoyj6uqQyessW-<|Ql6O%zhvYTRbXZh6FUNv&h^!oJuA
ztN(~QEj$wZ{@|nM7cRc`au%KOXS>19LWiZQ#ogv-Vz%y1cyjCmOU6sjuTy5%a6jUC
z{qwPF(Hw7S(KEMZI~dMlIM%jKz_9n*vTO2ueyydGUBfx%NhE1~2-ahgdX&2Kc~sSn
zQ(UK2X8HbK{idROrm*wXJITctZUq#WcDK!FcZ_<$T6FbIaMgkPUc3>S#%`*NKMJMT
z6a3#lb33c{qhj@^w=>JPxuu)mySXZ}Ri8<0ll5}ZRnIQFU7lmOO7L08k*NWvO*Hpd
zWc^%uu&(8&m&`>Y@q%ZS_as?ZlZECef8C@Rey&%~GN`L+a({>61+NtE2Q2M1?4BYE
zCCm8QJTHiI9GX*hPV)b>hYwa;dx@^CU3J&%kmc81DLNGeuR^y)eUZAnQuOq>KITsv
z`#28?EO%OOSN5*9`s}5SI>m(rOj=U&na@8~vGLclnSZD7+hpxy&pQ27s;u=kiRvd#
zzO(As;%$y!*UipzzpI^a&x~KkV_uxl_1!Lu6gIql-Ql8kQb$A7onyCd3|sZzFYF#?
z6}Bo}Ic+RC*L>d#4`Zcw{Sgy3D4&|4@;Oq)(~vu%+|u^1Wam$<LiYuGa{n=e?6T?E
zSlcjFvg*$FhWp1nU&O7<5;1P<c=EC7&bcYQd*+1;{N6F0O~XuE*G4{}`upLzS>kK;
zWK?$k<!$F%U%l?Df1YQ(Pb7nVQsMj^hqJHRT>h}K+~#CN$6vkXt6T0@xb}HACr{0&
zI_=s0;#BJ7?>{?dUDi@NXsp7%Dpv0GPkpBElZuPnpLQ;`esRrX9`~p14W<I8gFA&6
zUw&@!n0dn1lW_uff4=;1Pkq9j_V4c>DLj7H>(l*8GJKN9_p3}Pi(7j?Kil4NK~>`D
zhR&Y1KW7^qdVYS-*8AH}-nCk^<iPQDnnAjprrV--mhjGq{BV`!eoWM&d5uP#X;O=)
zJnZ<hLSFg0xW7>0^J#kwGWA&ZOx?oI{p#+68>_ckh$T%e*~V|2a%v^dKE2*g-;=ez
zv~7CK!F=2Aww2p9lk}SpHwc<NFlYN7FQ54T{9NZ~Q~SqHc3YVC)pS_Z6um38_c_p4
z^l(n9p4o($WDb!twKj=c_M0p_mhktiUBoAk${Ehzj#`(p+|A$UT{gW`|2Nw~AG6@}
zpnX1(4XKjJyL5^qt_n|IUi<X+`unO6vs&xQre2bnxK>1csi2-uVO7wFr>g`*Zxwc~
zxwxsv)o>b9F?&?>Hdfw3-3@1Vxn0fZ%zGR8fWac~eejXZrPl9XTwLY8dHoN^x$~!U
zJ=+$h{eDxTl!Dxn^!C}O`)zvv%RczV8@pR*mz(*Q{%>9x2VYvqZ9f?_DM~anR{wwc
zhrKJNUw{49fa&Rz^`d91U+<h?YjTL~57&aT)2&5*GnV@A74v4TJ-K-ezgOJz9sCsv
zpOW|!LO)+Eo)){hb=}3&{1>jiSkk!2M{kY5sw>GlZHl$$1KQubyRWhBo2Zt%rrpjd
z<{`ODb-4Hae#~CxwQz0pamS^mhrdirPkyVlI`quMHH&P+lE0~RXE7gcO{-sX`@_iu
z`J`i!T`A3bx2##zJKO#8tCZ%gms_{UU0tQ^{r|_OmsvlyE`7(b$MyOuzOBLAoz|I8
z|B}cb`19jRKb_BdwX7!}m^$s-=(q0aFY9m9JcZ=Xh@9W^WQqRTo-3QmPP?R=oSU=#
z5tHs3Uu%ag`b*3le`_&rQG6csR{zI-$+n#Q>st=h?U79J4|=x#L;3Y>9U+C=x2KnE
z^I61{ClOR<b!m?i@5}Ah!KdoF0++fR-e9!iip{Ba?%B)pdyL=a><d<U5OE^AUp-a7
zwbJI~Gf(c5uV(f!Nyp26{JF2$HNQ<{a&daRP`hW&rB&|iD}AQT-n6=0)~DC*RQTrS
zHLXXb3;*y1@87p|)AD4~N%tmRluYhCHOblH%1m9`%?~z}m7co0E>PCz+>N#}6U(<!
zw=TY%9uQ*g`ry-(Z@TxzRtcTTYH6QSm78M6>$meo;QQEVC%W%FeLuC?FLVR9(^mtx
z^OxV{{gIn>u2A~%%rEPvvFyAe;oVdtV=Q4Dv%Vs)!!zpP>iZ`p7{6?>7M0a{J-cJ^
zp3GNIIfA9<9$xijVUNVC#2&BZ_w!dsyG?(~ZTcyje_dm^xQJKOPXo87n%jkUO<5P~
zP_Xiz@VwPF0!I5zrLQh}#xW;2U*^ohipPfz&e&jdn6=4@Y3_m2Gq%cCFNc;I-%ehB
zaK`6j2mUk8`I*OIlD5U>l79M@ngU;i&_*qdtIq5>p-;j$lpoe-eRI5Jf2V1Mw~bn0
zYR8F8w#81dqH~YC9MoieW_f)}aMsbU|4t`mE_D9+C`JC&m5M0eidFAky{Nsb@orbg
z+5cuKA_eYGZwbHNDaP+F?DwT!&s1#6o}lPYFQew)FZ^}YigU9}Yp<^2FCX~_rSq*%
z@pH)ft?5meQ=qx`(?1<kx5*+_QQ~{Adh!adoV?SWU#04{)4Fv<2aC`BNwHshyE3Ye
zYjWEOJ^7z#%b`D;=-bR-Wnj3Xg|)F(mRX!xl3xUBtVKoV-!>De`@UY`mN>gd&$@i=
z3yhw#@(y0x;&3^39*dh**Uo??Zb7+s;`ckp>YNnQycsg#)xiy=@7kZZe`=1ObbkK5
zzqQ}kyB#wucKbO<Ofw3|KT+xT*mTa`xV=$(RHhr<*C^X>_T=m8`E_dBvlZkWyd8yp
zaK${6yd}tN620Kl+gX`H#j8FBb2-nvaAd(z*{eEgnTkn=mn@hwlUI;|Q{{-qA}+@j
zHw4spR>UyYEz)24A@%!R$tq1=mG~uIX)0Zp4vBCr>e!$&{nUcS32nC|sy42;KhyWz
z5!;2c?u4cB)JCfB+W70-rw;Ez{#y$|z4F4h|F7BArB}au*Pp+?o?SQRZt~CE6=iA`
z={NP5jd<wR=ePcxG%*eey~Vj?hMe#jmy1En{{AO!>OXPgTJhxD$%_RWul~zAtNh1}
zJ5TBMs!Q*taLha~TkYN}rs{&`e6?S@4_GyFWgEU(H<iC)i`eSMBWwC6-wn9lY3!xS
z#aj@ZQodl0V^m?rg7a<<dkWdIjxKD}E9^B0Y%mT9S2VfN%Jl2OJdR$I9hI}+_!X6Z
z-uCE%L;c!9#q1WX^54I-7BZfnx=1>G&Dt*y40@;i-MZ*i-1-a|=RB=DH_kqi?d~=1
zbo+6{GA4CrVR@1^Z|)EG?@9kF?l`@ldQ#E!uTk}*qRXGRJ&f6*xPF>#aohAu&kh&t
z{^sBl{&c7Hsu_{#2@!81(_^QmpZo5%>w1zd_vsJXPg#3-3Yo-Xj^$;%&y<<#*Y(`6
z?fAxB#Xb#ru{YW)FYgiKwAsba(QC3M+UMS1?v42#GkKr*eqo-mwPgM4FqvtqrnPn{
zO8G`y;IVlWxS}q8{?56qrJ{$tHoaebq2~P7wC{)FwC-?R2<D89&(eANQT0csc$L$=
z-&yt!@7}A*{dx3Nb$M%<{E}~5ni5!qw^!yLT=H*kv-;QQ`$=XKGW-9WYnmrN_0q&c
zySa=V)xG~7xT(#!qwS;7zM2ExO=V&iyXIFJ@A9*q%j2&wO({`qO%vPSu4=YDf^Di+
z^N#2~coX){xy1e77hB_160=fm=T7mP)%E<<z7LDb-4mCIx@J$md~NF1+J>{5Og#5@
zRs0Bh=cBqv$NyJdK;@0ewHG?;^A~U#M>nV4KUll!#$_%WcFsn>-<hE{SAREsp0+w_
zTm0);@p~!)_bE*Id}+GfQMsdgJapQ_V()Q^a%Qf-CY5_@)xl4t6AMJGX6|cpU-MbQ
zTxV_7hqb;N?C0zbdjFyIL*dhg(q9+lS9tAOTl9hH&rzoX$7Mv03Kkvyz3$q<ol|rt
zZf!r@C)_@z_@LU=&Fjlz9F@24=KRVR!@$4Ne1d`0%6EPje=ydFzLVef`)Z}FkETIK
zx0I&7o(TVnv$=LlH#j`YOjyM4KOulAGi$-j$^|FCp7nn2!z+E})SJia7O&nMpntCQ
zLQd+=rW5<;zRlRdZ`W>M(XKPYq3U=)>*FowSPWzm>V9<y_Ou;5GjTt6u;gMFwhx{%
zlX)Ftmw%n|@2pek&uWX-MOEj-&K#@zdE21Tvg+662f`cEto7Q{Z|zxf{luKrcU<xU
z*3DcOEOc6DvDiZE{~i%$%3(n%%g-*A6a9M5_Nw=co9y2wTQ#|vr!AlIOf%Hxu$=ch
zRpGvbr&UD)o_9Ajyv^W?J8!w>^XJOlya_KqZawe9=4Zn!d-g|f&d-&}d#?n4(2)Bu
zL62=>%fDN1WIlw7&-lr6W|94W&Ab2CJG^k3+M{(pWWJM4-^1SS88%DOH*c7BZe3`G
z?9KmkCvJaw|NOLAk@znStmnm(kErb{Yu*zm&Au!-hp|8HrswmNh|6zf<<>UTm>KOi
z6O%6J`F?n7NZibI$M~cUIqKYIysG}>?d@-|NB4hIEW5d3i+WkQ%j~N3H&G@%Z#7@;
zvTNA?^^D%{Hy3x?m#tQxyZc${688+5|A|!%E8d;txAFbYk2;XWz`(%31R@w1801j<
z-bsnc*{OLc$lHsU8BldMq^W#Wj$>dDoy>?!H`EmHIN095Ww+fnDg4_%pDFph<$@%x
zE@Nx!a+C1l$2a`k(q(SjN1sbsw@99O(t?&5DiRD+)_nXmr*>BDhT2JM*Z<3FSn%df
z<h&zFjqhH)dj$f&Dkkiy{QBki;pb1+M3^6a_;OFg_NR+<UOj&DQEh&#XnTBW{JrW4
zHY?4xmsVC@Rg16v`C_&6kLUF&>EW)QYA=SoPKk>VKb^I?>6B;mlhxJV#Y(q&sZBn*
z?e4XsDU+tG_6^<cxi2m}_ujOtyCxcK&f2My_QgfCD)M~yt{L{a>AKTrKF_s_e&!qe
z!sypU3(MH)Z}}_Fx{BZax@PUFrFuKoY@aO2*K&V)ZlLx1^zh1^&&p@-*&8)2`0F##
zKYNyY9sF?hd(z(6mGAc-cyaans=)hZPv6|#6tF+*@7kSFV(-uP=SJ&YUH`2tc%A;_
zJ)Y;TEMC3m;5&|an|!`z@6w%K{Qu#e8zR{=_C!XS{M+pt8++}iR>i(UI}eNfd4Bp;
zknQZy)xJA*vU=A)?~kwf{_SJ=`FlS1_F2|`y!+(m<^1{f|K6RIsJd{-rf+iUzI}5{
zZXaD#lfP@xte^n5??OLnxF;Mx`Q5<!>8^^RP)5PNnTzJ_oi8e_!u9j-*>9JsR9HSO
z%Q(*R{O0eZZMmOcZmI~rlDbc4_8e}z==kZSTite<TwTd^(QoIDxjBthdFsAf*QT=y
zTu!~{cV&ip_o`{;F)MS_X76E35LTJ`aWAv!o~*}027muV7goQ&x3_5GoYeIH6<>2c
zJz0N#-XGq8GM^1gp1G*SWzAa`W;5Y=>g9c_R&Q(inmGOZYj26T)u-$yuCrUGFTFd$
zAa~V**cAph0*~sn+*Cbnsx#Y{*Er_&yjkv#pRCE4^XYWaUp}eu`p~)NJHDi!f4MOB
z&T_sb-S1ah3NY7INAAzeJ}@!%u=9`2sg1GcUPrtA<^Ng4eIz~0V4C{T-(olB#D0EL
zc6d(OoINXUT|c`1wva}5wx67Ry<O$!Pj6qVJG`}MJ;`}S_1u}Ck>ARA6VA<S%5+Wh
z-{u>=_FO_+gP!tvzr@;o;rjcuuer|MepKdQY|I^FmzgUr<;I#yr}g?b-tH|4=kMET
zQCF}v_w(sT7MZuA>|;Mpvf6gMgpXCPgws{wc$Uk#=mno@T7z#NxqrH-bN`+Y=h-gZ
zcbo4%+4*Ic=dIN;JF@rrg+2ZKWLeJoN$Q@V>i%+eEG~@EtFLKpIQ6zot^1mm@&?bm
zZZQSl?#O+)Tn)i0XLTnqIA{vhFm+#F8(_xyNVsf!<fX8alNY!1_s99wAKWkLP{nim
zbk?ptzG4m2*?zM`iylx{*r9qZ@%t?G*GyKNrx||#`SX+izWVa@JCE5u>B(2~m)mbK
zdrxg))i?eH(*mvhk9%^(X1=cJjbHycb)MXv-QTy~JK%P7z54xUr<YmmIR5$nE(V@?
z>%>Kkx!fM5#9d44%XE3Ce1l<ywA`lFC0vJn-FDQco_`?k>VCe?#<u#?C(TLUr+<0y
z=A-tHe;xbk%fG!jEBWVFSKZz^Z~MCQqWjfeIB0}ljj`Ie;Hz2VG55`?A1=2|(<}X~
zVEM;;(yds}e$$H#v!5(FdD3%|*!$CEY&-|F8ss0C-LB$2z2s!b{I9>0UN&WX_ASqq
zNJu|=TCD0u?9>kzBX{2WcGdOG%kt7Vv)1jmd&ORs{mqNLyGHm8>!lA|*N(I2JyaIz
zbNb9uXfv~CR?<#|Gl%>y8*E{_%o4Ny0TbW6hm3k`(!Ce;W@mmlmd&V8awOYWY4>U+
zvqz?!-QWK#w^;nWD*W8!)QRiQzhVkwyy_R+_DST2yhp3)2{+HJx#qXUb_5&k^-Vi6
zZ}K#Ybq0%9|Jmj6k3qYB>iX?Jg(42|FpB#;?t0vCgWLM%x7tsicg6glR6KM3L&GWa
z#l0WQ^9@>KcA);*vY%&OhNnnwzfxV!`@QE!$=xj%obSkgdnC4@u(>9!?(nnMd)%9D
z`z(8EmGY5)(&p*@@p9@<t!~~qbShqb|M`Esm1c$cH#6qX?A^Ba(9d<-ybn|q>L}EO
zNozQ@*Q&+OTYh2rvK8yQza;S-xZOSf_{p=Omb<<3mK1GT^-Aev`exlc{hm{k1PyMk
z`}9n<Y}!Gmd`S*brJswgNM~6r%f9h)fmHwfsHEAeGSyW-)K@RuyW(2w!swbgoQ#<V
zvbe8LE@oW)@z0^PC81A>tJ}AB)lW8eUBe~t#O`S4pNzP>R_8xh>U2fOF4<apD<dyl
z<0<Rmio@r3v#o!&b|&M($QiE%o>n{NOf2K=F#lrhQg`2qOU<X{i)n{rS}4Q&f-uhi
z^9mF#+n8K8^Khy3eko17cDc}Kt;?+N+T*JxhweM*>a6@@-hN}o>|bj>?rGHCF>}k+
zC3<03OB<IyWGS)R%j#GB&|&GLWwX<cetIpsp~Rx@(yCvq773H|^FQ5Y3y)Zr`hLl*
ze@xj&8@oj}M%o?-nd+B1<F=-ZS^YxOWfN6eE58_swp65*{anh-cbuEGpmC$kob~Er
z&r0sj6SXQ+Kgui@xqpLZq-jBZ(f#VrJhdxk@qC>9H)!hXz+a7#FWm*+b!hE;)9AhG
zgF)17CYx*d%Qjs4z}c&=EM)Uyy2RepvvbQc56pEk&Yyevnz=c1xk`#;ZSBiCtHSGd
z)8E=$<om+se^0UX#!|7XMUi)Xa`={?R<eE9%-=05=Pf?*@eIA=?r#>o&~rYU$+LP>
zrUzg7^^44<XB->d`V|{L`!0Ms=l9XyH;b(G-#xy?(B!KXVYs4UA|u<IvL_P{9Nf4y
zZtl`m?&f^#Ht!TVHf}bWZ1+h*{ZgsRg_~uYb<WL9Rq8v|`Lj-t@zuksJMAw%<~4O~
zF_^N4PbV>Xx8|#hj>|rJRB5mW3-0Na<>_6!@ZyR!_xk_(Ro3`?;FO)5|M!!{ysvX|
z|5!M^x+I!^(mYy#+u1R9;f-CtcjTxU3%r}f*|lr!*7IWTyHEP^R%>Njnbb}7GI4g?
z+NQq#2V--z_|ZKxElSUx^R;qtNZYt&-np>PoH{Q$+?GVd%V+y$r@g%H5T+4$E^)7H
z{_)AKakmm~7lj^}RJ?25(p$4v)u|tv>s)B`VcWS*7Ny!-Cw~6E5y*35wGf}yTU{^i
zwQ^CCNnvu#lh(AaY3<wcg5$=ggecQh@9LDc&rvqcZkk}OD9`;pZ;$DU=nDVr1l!5E
zS65m4?OMTDcDMS5b_kdM=bP3Nw_C1AZ?QcsoXB5tqUgGT=C6GR>v<P%Fj=`yCG}-+
z@ZL{_Z^{<t?>PCT={QHn1iuNN8qY19_N}pWsn=!C{G~hUw{5$hs{f&Vi^(EKi@Ryl
z9F|w^{`h*?=BKZpt=5;Xy?JrVXQR{GbB~I1PJW%H6tdZ0UEs#^7bp0?yylBI@OtAv
zzM8Ao8`sa_t0~>i_h;XJ=Kb$qA9z2P@6W$H*&ojJ?EfxYZ?w0N{c-rN)raH%`2K8M
z&s<+(_2KyL(g*&3Wq$<6v;TWi^1#3R)q(K8E<Zx$1?!#)JPiLW{IJ@;{Pi~feCt`;
z@2A?^HOg0;?_)c5^DN85RB?Wj^+qZCc1umms$sZr`-tkB?`MTl#J48)yyz5+{~s#d
z`tDf0VdsOXud13P4&L5e745R&yMm>%sv>9a=B&HVR5ke?3QRJ8+N1w9Go@m#b5zuw
z_l{o4rg|R9T`W?2PW{}bG0k96)0Z79v>DIji*tuWJ`(MdNjfFA{&xOqT@PW`O&Yg-
zj)Y0}-06$hzT}-t#HKkb?4NYZ|M&a0czyN9Pw(~rO}aIyxA@D;<xLAO=gacSsoa15
zo=Zl=BfyulNtI7-0;kLNxd#I#|18_O%lD6`=$*s$1vh42UK^PiZ#yYU+;Cd){H<oc
zuT4AtBQ&J)(4%RkS94_jVow#Fm*V;4az=Je__xw8oxQ87ZF`OCxZgKLi?c}<gf*<O
zm>+Q}rqrS3mG8wqJ|$b1wK99lq|bPyg|Pma<>q}q^y-w3?YF`vFPrC>Tf1dNw`$k#
z#d9AhxnJCOe%-{M&a2aJSejNJ-j&|?TW0TOckS>r{z;cvC)`{gZSjF&X8iQZN#{QC
zMyYegdmVRbtN8A%|LoN?n}dsEH)&3>nyRTHDS9(?8TaL%@8`tF%FO6~n|V+>d#14Y
z5!SFh=fh_&eZeC4!0K+uY+bPfw<noy*{V~h%bckH@I}wG$OH4ab{&bE{kv4cb@SQj
zC+<8;RXy;;;;zc#Ibo(n7bE!?^44{keqqVix_sDqum4i^nu(trUM=5Ld-m3M&CHq)
zcH9kd(@*3Gc8KiJOprOD@}tc?_uvM<ZL^hMDu3cnIe22`i*q@R=Kj}Hx8{Bb^EFUs
zkWG1iv-)10r2e5q)?KSVNvWq*@WtDnzOZRgw*A!YZ5uy6ef#>Yl>dwKuXe3+?+z(-
zkahE(lcM6~Aamw6d$H_n--yrlh3iTtmdvbEtC+gJ^uXgKrsmOSj+I5sJizwpsKw5c
zufL{jjotRNCEwOmFGHSBulICotxunmeL<!56%MI|x?)xKkG7uRmyYN-`QC4m`|*RH
z+_E?GEIe?BN$96n*arrS(*nHvSKBYLl!<3JbSjEDQmkm|@7*eI(<QsV=w9T#bZOC=
z*<#x1CxvfFH7?6uxN82=mHp4-<NnN9%FgFwDqFGqT_2a%>q#nI?+z)P?QcJ}@WJf4
zyLj)aoD?)lcd-9^HZ#k3vDnWuJJ%}2WeaM43U67r>igtRD)Y^{=D2>}EAQLRa{K1V
zeScLywl8!)zn}ln;fCas-;5%r8%+>+F30Ssc<76@QU19bdrvOb|EBd+J#tC3T;k6B
z!hO55-B>m;US4nY(#iUTVwC%*`<*X1uKp2MmbUzv&~m%^_nwefTcwwWD*rf;*(~x!
zW$GKJ2RDq^eWotW@T%rmus<p<@$i#w$!dMkE!nQ?Q){=Zjoh;J!?EpOl#dIYWPPVl
z6#1lBReE;d*9lW&4~k7JU0AmDVA>k(8>OM^J=98<u`%|ha<DTxhjc75w6qZWk?h!K
zZCI7{f9dB-{YAFfic4R;>rW28wfz?R#HKI4Q(J{gq)u^41<hjJmUwsbp{<W5Kgtit
zc-Ol<PNSpdliSsk{c<Y$*FA$7t?xA)=@+Y0c)M=a>zQ-*&h%8&R;o;m%xG=5S`fY9
z+4c*ci>7&OpZdh}+J+M!i^UfDZp@r}eY@w)OIt2oyx-)ucA*m6`t29)gjxp{>@_@D
zrtstblNT=n12=otb-tQ4ZP(15hh2{PxIWudwI+Fu|JMa}-+aGze&srS`;6Lkzjc3~
zX|2ClG3!;8kHkX%3v=!)w36#Oy7OY%*{b^+g%2GpoNHtEx6tR1-aNmw@Ta8{8NwfF
z&T{fT5)qc+wb)JV=mQ%U*{h3Ha_&5M=-9?z!0~?OeyJ}fcjl;7{*?RGePTM_VdjKy
z!kMZuI$~U}l$u%1z0Pm${`@D2rT$-X$-k!$=j+MI$<!#?e?DA)$$v}0xuPH8SKE`V
z&&VX$x7MAy-MnJO2QT?|yIojVKP#M;-t+9RVd?2}?{c~yJLGI*-!4D*^<FFETZb?F
zSFq8FoWycQa}o3V`lajlsW>`!&*qqaHKXU9zWwoOraS*TMlCWvTbt^o`NwhV+xf-+
zxC>8a7(c61+$FN=PO0?4OR`q72F)4wcmDr3Ep6+|Q<Wys{hoJPI)kDb^Y7KMOLrKj
zeh6R2&cE&A%)qL~^;`en%9y%8|5Ux0`jQ15Ugr#MoUcCcYWA+{w@X9RKQw%GoV{yS
zemZNP7vHPoYpR;ACDFNj(_ff-WEFqE5p>OKs@z8T@+Z$CS?`$U7k}Ys`pB@^*(YZ4
zfBtvRmEU%mdQJbSTf%Zf+*4w;(DUPyjeQQ+KJxMq3TyAol}~csH$kcOQM=p(p4Uv@
zJRUq#*devG-@16}Z-qG<Onmoi2ZZbAFsQ1rPT#iFH2?S?tK1$l`>g@FR-#kczFTjf
zFzJ9o|E>Q$8&(Ing$GPMb#sbb^x5OBj^3p*!sm8>_;<iS=TN2Qw*Lx-vEfhWoGrZO
zx|Ow(=f@GD)UC?<N{R~#1m-u(Z4-ONdg4<3jm&#?8og^@F?t<N4&|wwy=%|8+Y;Ym
z+@8o3e!CI;J&>_fyF#fe&@kFtuBl=3%Yc(n&9_&c`n6u-L7eu{d6MC!8_u&O+x!;r
zD>(iA=EjHjSRG$GRM>s+|FEm%pm5I9WzT#L{{8*^>-WunWZz^~KI+j7FXt~<l)yHr
z=Z)P1&%>Fwc0F}kXt(`c$&!7GB8zn@bf*WG=-fGUu!~RjYLgtx*W6|P%SCqeuU@^X
zm+!UXqc7q7?mxYECQQ)uJY2SwZ)4;0x0jbZU--)-k6WDKPj>IQgLU6Oq|E$be%C01
zd)|gBtC`8J;`^*tPk+7lM@Y)VQx0>EW>l{c&i|boadBODMA=92#nZl)nY!wR?tFGO
zP(JRW#O-@(=TB_gb3}E^$|xSQiTW445;y9k>q^e+KlyQciq5)^N+l=F<i)1c)OL$I
z1m8F-9HExs`uf+eN2?BTFP>8>wdg`b$W=wr(`mDNBO^ucFVPQre&&d({f85FY4R0&
z<e4{~lgx5^wlGCIds*6Znecxq#)c<-CP%-|3tc#&_3Tj>&KF-UT<h_l?fJs^O;yxY
z*Uhm~{g&cWqD7__T(Gg4cWklti3Z<-rk*EX*vxhAR&UOFD)`1jkh5cN*O$I|vkqOG
zXcqE!c2Y`G@qu$UPrfQEo-MV!Y7Wb$Yk~K^8cjDlI(z5LA4lq^&28LM{_9d|VpYqx
zj6+-3xE<+ry;a!1{J{PXvOcN}SAA3ZW_{m0yX8Upj>wMNXFYe{TJR+QSFe+}O-X*C
zX>MA^;=S|weOm2K+}r8Y7o)sAU_r&P=IyJ3_OM&!yD8r2sAGGzAd~sm)1z7y))IOu
zrn5M97AxLUUC_fW!10w$HtO2uEWY;k$s+gU{>>H&{rFkor<kv|!=%fOipOS6<tX3M
z!u@RGC56|C(ub1@10NVI{oB6A@5-xlr?y3y?%UR-;CJe4%C@!H+qQ3-_TITub%7nD
z@9PuHX$EgLy|Ca{=Zy*}&|oVvI~RDkrt=?Hxc0qn^U}f_A*Ht~E_f)Oi{Y5A`TpA#
z^BcF)!*74x?e=nO?5jm@m6JBMaU9ypGsAIB%NE8IQH7`aW?_f4f_iWD?7td&D(&>D
zkD*uVmMiP<qzA4u6t}#vnB|qB%#O(ySNL0$^ZW04dDVie^U>)7-irl!34Glbm1-5H
zoB#jExZ&4FefzbSH;6OdSipSOqh#Xq3BRk2_^(DU3ck82NxAgLl9&Tr@j6^N^(-;J
z_C8BGcyXrqKACM&K`GUO##`ns3c7bRIf!>fyfuF-SHtU>URh?}{8&8>*l_&Ii`&oK
z_2taIs<;D@%qcrLck}p9nEYm1_=SL8zRRbg3YwM+OKn*Fqr3Ksowi?XRE4CrqiTl0
z;^!vf)4njzT{>^k+e6C&XMa*L6WgjD?d4eKyU4pnfl*dqiKWL*73F=}d5PyI=*h?w
zsPnj8WM39H^)-{TSYoml!<4fAt^f9{{VX}hI_}fwce~?_?|8nCSlZ~*`!hz4A?xyl
z9o6iqlJ@sooqoLxQD$0OQh)c*v4}a=7v)dzo5+?cXubNJSzmSHv$0To|C3&p!adB3
zqM3I}Fu2(*+wgd^tG7s-l1QS0+Vvl+Zdw?zdGyYWa&zD8mm+Ia)vBV)^vm3MBBLey
zloJ;UvS<98l-Yjl2ivck$Mg?7@U4BV^>#(`^ya>`d*oSr+HSC3eJ<~I<7uL8U(Y@(
z34_V9JnM?RUNb#uRI8HK`<vBp`rV`2S??c~|Ck^7OixVSm4S7(GK<N_NjnaOuB?nm
ziM=E6{CaF(4%fxfV7*;C!ee}#w>A1Wo8C~a{x#XUVV6+-wvU&cx5)hpS?(m!V%L4@
z5BJ1(WsAPQdKulhr}cWLh}CI>pj*#375pwv?XZ*Nm+&hN)|>J#=}P{Yj%P8)`Qn!w
z&)DE68g@SYorBNo%4YS&fnL2!4QDgGvy5u^z4&9(YKfx9^9~DWvYd4&KGVVTNOSTb
zTYmRlTim?Vl>hAgD0=8y;V$>nZsn$@KTNtHc6w^s)(h7-CLiOA7TEo2#@c6rHy59t
zZj+QJb^Ume$4QTfF1`By87-XO{?FG^JoG80<Fv4Np~0=rB#+tMi)Qe@k!5q;!1e8z
zdq?vN?&A+dN|bmr>;=l-7F6&onHIXQ^GEB90-wHik6VIkwQRRtHM0Nr<MBp5fr%bJ
zJWArGXcV7*#kTn7BmKV5?7u^vPMHxay1D$(obBtbwF?ypJjfLc4w&a;{J%X<grjm!
zP2h8L;k)lR%N9OvYwId!bF}!zvD#sQ2vbY1ZratXsfU$pI8H5eT-u^E_0u)s%QsV(
zm@9_Ae08kyda3@}8jbRTk3X%iJr;H@mw6SpGD>A<`pj0lL?;%5t*2fYuH2rz>%@nI
zi#?AoPR@1sxNf5JvWMGE<3IYIHk~PU?S@#JW8k+9#r!iwRN}QHe3DqtpIHC7sPpaS
zPW5RIv?VfZxsQdL9oyNtch8ZUl@;|<4`-|lujy`%={8@lU7zD&5g__^_pCSOvt!lw
zlzcmT`|@-D-|0Kvb0n7XtW?vwcH66PamxQAb-$8&Zcp5O!0fx(#v7&&_xbGdo4xdl
ztX_KaPtLjzP6=+4eX`aBT;bL)GOH=$^;&gK^JK#1`b!4aFIj&}{qJOTElhvqFZDeh
z{$+Dx|9(rWzIb2Yphd>POB1ECxS}S8pWW$R+17Aj-pu(AFaBN@bAI*gHs1|vpKrc>
zTH2)PlV@zZQBbe+#SjPIHBNiFbQw9KE%(3Je7|_M#eRduWy;<My`L1#<!I2?&AHY)
zr~b*u6VBbqo1dCan9RMFUCx!!T4rj$;?6@{uVSD2#+%N%`b=o++WzZhD|EDXF|GS!
zQn}*C*`L$JSG-hvRyW!Be0<35uQuLsy4)pKSR<uYvaEl8`N{IW$thjpUR#1MhO+X_
zN|E{YJ++c)zTCrkX7eB0F-^L#`gnT%S*N`PUrg8^b3GL_-NQG(nmyF^3eyX-7aPvS
z+|;j>wJwU>WA&HSENaVQ`y-pg*)}TXcbGH!2Y+L6xYD1a&R8BAsefhDr}_6yP6zg^
zzxlV7ch{?T%bSBAUu>7RTzjDSE3f}X=fx@~6xTZMlUpfgcSVMKz1w>B_+;yg`<K*L
zhg>`3R6Vo*<p<@5U!EK>{B}-snw`uwRo^2nY@1y44nFtdTJcO{)7;#|4~CnJ58dr6
zymiSTX5+t^zc;UTu9mH~R(n19{6WQ8-z+8A=RZ_`x*@Aode;i|e>bbw@J{^r^7y+4
z!nSec_b2S&QoQ}*Pp_0v+-qrHp0^Ga7KeoO@BfOvHm&B_#`EEUHx{ia3@ZPlw&hKv
z%i3pNlMYSp`W$m*cGk|w-@Vg{szQSTE^g49eTI2nOHZKh<<37_Epz!aUI_my)K{|I
z%BS%%^ASgbR7O`8kHxb`X}PnPYiOt~d#0x$VQ@t2J!5cAqDTCaHSCJ<_xmo*zor?v
zeTFjMmmq&H`w~&ba84boqN}@hIQHH9@i;#I@;To6&9CR^Om2H9q_tz3ot&_TS%t%_
z&7#^T^0eZ_CY0~X>zVqBKfh##m;kSC#pfiqhp`4K(<1r;Ys6%wC9JlEJkBwaHF{;|
z&bQxwTY~1ADKFxhz8V@j&ApSLo_Ff$q%>v8PI<0lpDuiB(79nUmG$ki2{H!3D+3&_
zUoRGs5<ZX^xg}+8_G+OissW~F4d<S|!^oZ+ZMW*$?BF+gAJ%EDOz6Gxv?gv%r$$kP
zo4LjI&zq*Uu*uw1U;4)2j<of>Fwa8Q3HqF|3c3-;-`3bN{_&Y0<<}whM%`=E=d>Gk
zoz}+nLN<+h%Gz?Ax;s@?Y+D-}vfN2|qm*{3pU#%bw@eMK48k!t-!@uDtn9Xnd~UWk
z-at2C(w3f>CvKW+ncqLzwr^QY1mAHX7uEL-?=MbbQxP_fjqkUsvFVt-A@af%2eFs!
z<?{Y^G4(yWJ?AaIbFqDwIDhUt#vnVZGnej0lo%;}ma)CQ^5lgrf<6sbHMcX*3ryWV
zZF#?2NU6y-D}R3er2(tTXEXThnQq3TGx3vN>f9Y`H}*8WvSsI3+twE8@Ipk4?_1g&
z78}!tHifUh%zA#-DeOX6%C|Sy-^Kj$IuiKYHekI)se0@bFNuWM@2_Q;RxJIZyy?x#
z&v#hsHfldQ&Bt)=+_#n=TB%DX{GGqce;#AKTCGu@;v-RpH{vSJ>RMOMe7oe3F8jq?
zSKn~vq>42Uc3zw#(aW)Psai~$$7II}mZGQG8p)|AcjkKdHdY_&y3-_J^EK?{@`Sll
zjc*0$7?dV1T5S60ul9oCij(`)FW+u?WMIvC?#YsjgH4uua!YowZ{D2v&ckYox6sKo
zJ5R~)JQyAz)%>~PwC_vFSH0`pcpe>Ko|$W2+_TXw(%o&wv(wY2E3utwW;mg8XYD?p
zJ9o7nyL`Vc^2#z$VO`hvKPULkSga2GXfAm8wriH(cX^SO^>b<-RLL72?|XWkr}e~>
zgbwR9SspuoM!ubO?}BD$&I!?+Epqc0-Q!4cE<a`&nrU`_otg5P`kfpl2DSIvc30?W
z?c&>>o!9cou%KQk{ojP!QNM)t+WQ$Sk4R=ZyxMr#zWJt$4^Jw0TjQf}a6w0#NxGrP
z>ogsi$LBBnn{i9kIlaxB?dGZ#jJB*%d!n9x-R=K&591YkrtJr7+Y+<NdR%vkOUUf(
zJ=)`Ik^X|^MAoG(2i`Ahc2cdBVz+yA+i-G__0No~9MhLU_Uk5E9Bt6g)P2`b@_62c
z!hX(<%UbnjUAYZW`LRsWMlwH_a{X~)EU3FH_Eq;|?oLs+!mGVk9*1rJ{k3yqP>*8#
zv0Bk7-fx0_Ysp+lIoa+VlT_t)M}gDW=<39K?Zr1*cEyTE&3}8PW%K34U7gRiG2X0A
zS-RTTaMPhbk!k<*kFEJr)MV!FvsR)&$4z3t;bMi_gFcnVcD&1J6wy!EXmG!n>+c3z
z(JyZ%^K6aqKQgC0DX5h<#z^bf#;4*tej7>b^(wHCy}97-#VucRpR5qw-Foq&%^XF+
zOhI7|%_*OK-E$RkCAXix6v-RD`sFvn&?Q}qj%)w9t+uDb>q~9OlXKSjQuT3Lubn^j
z-HmT48}l0NH<3EKS6c_)_GBscTzOrRNt(Iu@Up`@U#bMJTzal*g3P~KOS>i8)h{l0
zV|(y#QOuut%wZ=dNnKs3SyyMYPh#%>|Bt)d*)wl+FN=C+n)V|%fBKS%%~}-}FW%mH
z{h;xx`nubfS6_dg+%xy;&BeE`ihMp(Zd%vTKF3*8G~q;Lc9klBRn^mwp2s~~qD<G`
zztGqGyy@LW!F>lA@8>GBvi_SKHh02>ji!lpVLRV!TDNWX#l_8QZt9#an<95S&+lV%
z%Z#U=e`=JhoT7PY?$+gN*6%Lc`;YIoYJ2%i-vc6y0;@i*(ePgSq*$Xq|3%F!_bcD6
zd={=P_)(GV?G(4Yv&?*#$XksP%Pm)$^_Iu!@0v5|_k!1<u`!F)?{7P)e^T|bYO+!9
zk}G$&_Z&XoxT5bt*7EEdN4<jtFI?C&b;be3b^l(RjXq)|vpg}OK~yTxnN2BM;CAGZ
znHl_fd<q&u&Xy`d4Nua9JrXax|5CE`k+td_wvb=?k3NOj=$w@OCKUWvv^ZPZ!2gYK
zf$ePmGieV#EUetP@y*_^)BL}0wNpHFnCI;$%c*Lv5%KEsK@*n-9J{|~_mK#pr>g&E
zEDTcnE3vU?)wSH6_uBaOYE4pZIJ)i2Hp!-h^w)Dj0wtRHpC;}SKN0A!9eiA4$%bgF
ze~+8qNnTv`)b!qjz_T+xB<)@@o%iO3;^$TxR#s|%ScKMo>J0yow05^hO3$QSDur*a
zE=_${=)f_z`#<Y4dyVTRvl}FA(mi*#?9bW%(avMurCLGtlT(kX-dX&_;g8aiwgy?x
zyStirU0<7}{j^??U!N{LHziJ#_uHnMc^U_@bf2lDgdg20bZ7RSZCwu9VRKBJ*ev(D
z3a)i!QOb4IN-16t;kP>A^I0pIo%;EcPT$lC+qLqNTIACu8L5`xmG`{U%nk^5n}3k~
z!ME%%1Ixbsf7L_I%B9Aq?tj1NZNS!kdDq2Tk{!Bdd7PJz{g8BAaKb8%dl%w4y{+~i
zWtV>(V8}Kvr=WC}?H^99-nvu&p4VG@C`XouPJVdkhUwjp&K%3SSw2nokU64u+$l|#
z;pnQ#&aDL}i+xrcm>PKf+lwDcQNeFgoS!8+B<=Zk<&TY@-3<9X>p8!7Stop+<nl8q
z+{AMA$y&b9WsLui^v;i6U46<+^qh0#n)G!ZM>kA;Y?tG)h)=HIUD3B@=J08HFB9sg
zPS=v_eZ1YIY|hNQby~8Yu5Q;aIKSp;o;ruITD8LOQ^HI24O`9yJ(2ZHD7BI`VsyB7
z;gM>0%(=zEMJ`LPublkDXW=TVRGVKdU5|85E5&8bTavu`cHQF*i#M=8Dz%K_$;o@U
z>h$H?iR`f_PY3PY_-yTs4(rm(@)K;?bmUgDO<N#(_KI<o+yo!RR~x=-wya_nzg560
zc<mJHvcqp2P0RW+_Zw_{;Boieh8LddHm|O^uGr+3CHe8TU+rnXi*?fuA2=l$AN#^!
z3in)I1F6Dr!)rA+%`{}oQ@6#Qn5*^oYU8fEx6<mH<<ll?P~F<Q?$q<m8IHR?&)WUb
zBEYNZZbyQQO1<a52bsUQxIRpgJ6Xy%)!P2g;g7B7PhD(VarDgb($zZEv$Xk)BVwlI
zd<>s?_*4ClGeXq|r=P#TeaeEx_wlzM_mwl-zIe=$4s>g9mu3GZD?e+u|DnABit@8d
zN)MIPNF4m&sPprs`X6(PAIH-3%1n<fV+xuw&;H3Hx3}8!UaQqIzKf{2bW43>%cY6^
zst%J<0_r38E9xH(X?(fyAn!?wNu@Izeotd-p3(JXL-X1XMWr^2FW&k!XTP-By0d3?
z^Q|nj{<4(orrQHHmZE~UU$pj!oKSr<?Nou8yLqw6q^9e}e6Q<Wucdu3UVSV{;z;P`
zQ^zKLIbOli6Qt#8^dWWfuVsq-lgwGWoZlFq5Zc|T-(jl0D!7K3HM=M>cG_kI*~Xsz
z)&*@xclMm=<ajAoB)R!huS<+Adu-6UmCxAiCz&%R-@j$B+iA~l-IvNuQZw6M9rwA@
z&e`s*^@d|nL--A!u3x)m{I}e>%8a$GU~lV8yCc?zBV!%-OLurB@t2&-+Lj^1<bG(=
zJno3{G=rV1TuLt=JnlOq?#rFP7q)hPn18-YF}7b;b^pve!`0<8F8&WM{8pKv{mRlr
zWH$e#?MYuBubA9(*kILEjcq$5_jN6n%9=7q(R(rTwT9re=C@|dd$y5je}2G8#x%aN
zBd0Qyl$w7l-s_t9J1;igES#^OJz&c8MV)__IzNy6^DlbmQTysY&+?b+@4LMF%?!T|
z%k%>^b>D<Sg&byTW%GwkbWpyeaBN-b{r@?kdT(V9_?EUTGp|^a@tIAr@;TR*&9U3A
zHhfqatTUZ$RXr=iE^DcbqJ;F76BUmof17Z8QO>F&=LrYRzInW?`Vbdhz*9W++@<ax
zZbo;coTM-8x_i6SHDM-C#Kk0w#q7`f{`~v0^W1?WYLC~=?D!PzxH6;F?4?NSg#HW0
zM$swB$1FdY?v(qa5a7o9N^gsoxgKxj@jpj`zX!isUUbkue~N7To`*5JN|dCvXLZg`
z;E8`Q<L43M+zDn!vp#P8ts&gqw{~@4+&zy!)5;$F_0q|k^l5AMLvfBhA0vWa$|~J_
zA(VFI;j7K%yziR%;!+GJzvr%4vUr-(+h2kAbeWs}xVc8E%~hNe!(vd7)OGB+Opt|-
z)y!kXniUQYUo>e?jAC&UvFa>bab`)OZ%E39yh{w}J080nZR@Z26zv>zO|q^fSM*7p
z3Rm=O;ltGyAxV!utyY>ZzSZbjY!Qp7w!pfbhbQgu$_l$%9B_ndS)ihzm9o*#YW}!6
zCpdMR9P@Yd>MtvEcrsPI^+l`asggd)lT}YH+@38zZ$`txoqe@i1C}?3`~S;YpFQ&w
zuUGV|CXZ(_-+I%S^le`8o#dYR$KvLPg*P>O3U<qyUeWWo82u*d7t<>l$M)y!_3WXB
zC2D8i?mBz_bXnKSA4-}WADMGczKj*Nns)4>-;=u@{aSM0&(58qw@m%O9m_`ty<Ad0
znhRfceipguI4jSgn+444H!CQKZU0t&XWN?{zmm`P-O%JdceBqyYwm`-2lKez&ENG>
zYsSe*rm8w_%D+4&NL<kh|9pt;V#pf-g}+OdG_{#Xt0yY>a;@QfRjU8<EnoP3$H=fN
zRhlnvMrPQ(`FV|pGvoco;}tR0f9{xWv#tBq`%ZVq(gzo{=55*ZuiCis(~qM!pS<n9
zyt)2Jc+a8ZhlR7&{pUMdzwmu{R>pRT-Y0Tv9Csc*^jz^o@5zf3zpik8yTO`azcusk
zxru8&mK?jO_t@v)<G=H?I+ILRRXpBknq%nFdD7M1bEls5xxAuvOiSC2zx@@`C--#L
zV*k|E+Pi{c@gHrBKg`RhJyEE9v*fX6@q2-_1?`eLCifLTx=dkeb1iH?+OW$yf33sy
z&g|0F>u#F9+sG%d)#k0YLJ#|^pzcqHidQMweLV1d+kVUcMtfv8x*v=yeRqY$TFIZc
z%&%wL!_<uSSNB^km@>avv_rjG>o5CBX(OgdD%(Z;*}gh1%QSb8%z1M;De`WL+}Dc*
zQ}*+PSpR95`=?`yTuK$^8sP;tGGY8G8hqCc%kBUEy}5E>`9#x1&25jbacs-_;_|G-
z-^g;#m4lD2S<N?4%FQvl7!?rkEUDF`_IA#VyMCYE94IVrK5?vEDE(H&l-surdP)|p
zvv9idY5tWs58>#wa;23o<KvPqFU#)u&Bqt;!iqbi@v-qI3G-gjHw_JX$3(3bE{sUh
zR?tn*uq!NBT=}fBc#XlYMLs(mH!t|Zrt;O>N+$K(grnhW%x`Y%m(uQCG`H%=<~KnX
zF0SX@Jkw`Yxq8Z<bjyW@>rP8b`kZTh@~_?Da<0bv2ao@nyx6Z&eDN@6&`t?`<=tN4
zMw2`0XYG*cU2=F@(|U8&=B(T|C8iIO?ds0H`pR$QT%#EiKIy<~N6V6w%`$z@HK+MG
z_ZF>~+59ZG-lb4i;_uoWOGP$6ep1M-e&yvh-52G5n$8qScK+rSIjeJDM96*Z^>Bqv
zp>_%jWh@;xAGv+1%~zvvqe+U8<@#-xpT1QzH`;z|QPk~+`Ij=+^%dH@@-9hP6<w-a
z_CsX-;l6on+Y^5{dZ>rEFW>eo`qumhk5ArMR_*1W_&Z~Mmycn&cucshTu!Egb7oB0
z%VWE0r)`zo`}l$Dy>P?O@+m$tjSau~?==3FUn95lT~X0A#@8C@ZvSK+?Y?fD_xH2m
z0ngl~>O*(Ll35cMh04xRd0260$wY@m0cuNMEw~@RB+M<~CU|hq8Z}!1d9RB$Z1o$O
z&1`l(<#{h8x8y;H_m=Kk>7hB3zZ{rx`>WRa=j|EM2L4YJ8vZGG_x$kQmbHif<D`6*
zADlANjl2C%uh5A+dvxvcud8NHyL^e+d&jXmRabXy@R@A*-c+VEu=vg^4|P`?rBjc8
z+E~Vf`!Koxx_!8PiO+%$4fSS)0X|ozZ1~KtD|s_o<X_>#1Fs#bTNx*wd}wc3_3_is
z)9+t=dQuRa*JZDMJ8ibUWzg9LaXVJYcf~%w{Ehh(A9t^xg{5iaui^u#X6KK7-eR&s
z^mJa`p>txI?{&5=H)CY5N#HN2nsV!UjFES}{)ErL5h}mRE*&cCk3F8D<#a)B?ZfU<
zyr+IUl>RC36qLz!-7FmHsdPJGL4AmY+zC;(*X3Q?J|1{_swDD$u7dXTgA7}a3LceQ
zwzTy~<eF34j&_7@;LxZF_<F8MZDXQ=%f+UU-KCEneNhNu`TB5*z|-hwCH}Ia{GF^9
z*XwA!uyENm^`!U>+X?d@p3ZOles{^SP*M4^>$BE7Un^gEwoEHmh9{3v?6d3wX-lyM
zYfjY{3B0`feM;HKdoKNDj%EK!t|T_QEr0d-#~bx)49||1R9h~19<pxx>5wF!peOU@
zE}eDCPja7CwUfib4T`U3d;hST=y`Ef!R!OfV&`U?%O5V;>h@YeY4TcmSLFwMFYZ6x
zH0#;vjPEBduG2g-Z;$3H=gjMGemJ`&OLg)rTm0PrP~7Ep{dcDAIXi#C{F4_a%hxZ_
zFL;!hE^>Q*)6RrH(cDt^Isea{ERfWB?B?RF+hRC{_DEkW-FDbVfK}_to~s8f&P%*#
z%+)Qp{<CWNJI=Ea1xlW+1z+aZAGs+1_qpatEBF7AYC<#l7GGD{u#aocvvtp+cYQSR
z^1W%SW63ILx<2E_3!hX+wvAo^QxaL&`;zQ+Hwe#}5-B%hgVl%aYTezB{-#Bq^V)Of
z!J0!6xAH`)dnWZ8olCHOY?;4NM6^%6m$x|0`^MoVuVrTQcZn3Zus)Kp{d;+O{9i@O
zu+QDDK@9UhO_ba>Z<pG2<+{_ms%F`5OPA<fvF10^Thj+0<?kMst&Tmm_yOCTsh&(i
zxsmPN;miGhoSVF6lW^|T-0vH2^EGQ7T^v+WwAEKq#^%DDi!Xa}RT$@PRFf}u7w<J*
zo@9J+Dr@qFP;blKzd8QAh+cIua7pN7X78g6wjZp5c;0y!I+RSDa6e;4RMHHu$iK&C
zvl+}$J-_vEa-8)gIYS2vUENZvs?^&qc9SkyR$K0^sQmUuBHT!JjakwgaqGI9wI8Lg
z-LqG*xc6X{%l9o#>04W;?m8fln7Z1kwfkJ;t!dh;uFSiwC)O9AC14!=F6^RfN7BOM
z`fHN?k}e9{#5qj%&Ho~FuC(dsreiO+D*L#)T)NS7H!{@m)x50ZD}U%tEpgah%jy08
z!|FGur@Rn~?@WKNM6WJ)7jNAg{+TmH_G_(=mUbvteaRzIRBB&u=@@(Nq-V(Y$MtW%
zHa%Qjag1O8=5~RE`SqnW8xQa1u)DnL#C=!qpS%Y`mL~Te6xeiLc9*)=Iq&4RN!im+
z`F6};2)@3cM&Pc{@<qbmI}G*rv`F($`oDgv?&S@+!dGsbzwEPfQiGyNc*;Wuzq$kc
zKA}^ZcCGrpvADba8-MUZZs)0%mloLTZTaf+IX8Okr_)8#y!M^TU$yF?4&VK`qP!gn
z{f0IR9ItESu5XBW=3Dh(`Blb87EfB|Ea()?E?i-tcH<~>ardLBqS$9A&-=f)`0@Pr
zIec49-DYak-JN#8J5qn;`sN=|i}!rvQG4_!{on?hJ|{8jx9OkCj_}7l^(ni3LRWdE
zn6>BSy>3(4nyNz<zgN+4o2a=@<__o9v?mWPmLHVyysjnq^nK0YHFK{lx+suw+A&!C
zjS4HrbHC$d@@6Tudt(=O_-<!e+#0dr(5ppnBYi?HTKL_Zb4v5kKXyB%m);AT`@h#_
z2VYxNu6E#{akIpUUo-VmRRR(d7O>rKIz7j#qv-j>*a_9{9}9!_t^ZaL&oKG%^vus$
zJnwhc9iJ@|CmX?O`6(hq*lOMimOP1<o}Q~JdD+z?np*Nq{A~VAylr)G((BhZb+%Yk
zCcM+gKlwQ9X6@CZn`S+gQLT@QnQr`rVa8)cp{rRpbRJkUoioy(_HV_pnOr6FUlbKr
zc{6{wTyCgg@&3`?J26L0`poN^E#JEQTXo`9ckT%Rao1i(<|VrY8=O>21l0B}I`k;!
zsF``vey3$IkK7hqobe}uyGbi`gRiq$;`b*ig0nBL-qu=LQDU+_&6h3xS>?>dM*lLl
z&3*pm{6eKghb=$I{%C$HKlR1pIk8(;KW+YSWr>}ig@M|s8*OK%$Se-MvSRaQ?w>lp
zOypvcR*Iimp||DXffE9LaZ9bA|GlF>g~#3h(HDnchq%ml;RXwH&MZw14tI#ml`Mai
zaJ_EDE4Bl?#*fNa%paI+)BK`p`(gLZu&a~IocFIjn``{D<=v`RdDE|6cDx(bnjHIo
zT}G%_cZ>5C<J0cdOkqhAcbyDWzIyoFue*8=)KZd`^WN(F!6sxISe2*5Wl@;s6sgE|
zxbwgb=Ed4fhh+C0oXuo;EoEPfpUM&yZ}GCA%Hw;lnYK;3bT8K2)!DK}ZccefVG;X-
z^%b)WpZlBKsYoq9ywK#%WOI#JjrYd&c`W*QmzE!R*0{#mNWg9N)6z!9>8B&Lw`r{E
zxM93t?ceTIf5rGOs4V2k;N#3{{Icbw#R;#rtUH0fSY10gV-ios_^ZEcQ1V^F*~7K=
z!A`?_oboBkRRYqg;Ty$n#&_rX3LfYe-e~HvFXEZ+Z`Yu+X}4!NO<3R@QPslk7b_^X
zT0-p7mnH5ys*X;#J3ag4vaAUwv)8Xwwp*uk_F?m6clNlNNuGz^bVfMyx9PBWyu5Jj
zpwEHpDW-e*|8~FJ9>-9yEy}E%Gob4KzrXo`&Z&>G88=t``m=NLRy}{cME<Zn$EFMB
zxoA&~S2EmEVi=b^?|tUsW6V|`In-Fw?axH+KHIA=cXncn`hji6&8yv)R6bMiuGr`q
zJ2^YzQi-&%F;{f|dBX*Q(Mt+HiSWMB=9Y+en|}G_CDRaR#p-i8^PWmxO}feUfuZu+
z60?-a4~~DkBRTWz^b_ANd)Xck^v(Y$(&>G`>W9*%pHHlHH9O*_wI=SWSnhi!@^4g8
zSZ~Q<bxrX_&64rUE{PRSa=Y_n!T*?Dr-SECaFN!T-u?R6BQ3ko=(72&KUI4*Hj3@?
ze;{;XPjBL!ii>T09o2Ua2}h_cI%+rb*=OgXX07Xb?tiAYDSv9~Ud%ncw(>&i!`zb#
z{#x42ZL9BI;B+@~U(=ezDL2oE-n+Y|*imk;e^2?9#X${M{}!!1d?s^Uqnu;3QSzeb
zP~qMykD|Qz^VdXa>{FC8JjumaA-hr3Q$2K1(@BF674>IFr(9`YTofa!edXlklcKV*
z%UkapTzfM3@CjattM=WSG-j}de3<;m>!>o{h4Qw><%a~0YRMiv;^X3OkUV|wQLnm1
zZ?gHFb@^U5F&eCWY+>3LFSqW+$`47i*X&v-JfBNsW8U`VOCse&;&m>4T$!}z?p-#q
z{oB^%%z3EO$uOt0be8MHJv(Hk{5;TgQ)pJ;#8(CH=CaGo3TP}^xYK{$L-v!Kzi$*|
zfAaLm0j`;g`IH5NC%>ItX_0h5z^}0U{iCXe4ej3)PdXZ`Qkr7E>Fbq(pBYM=&z@WT
zWzjjFuTlK>rFT-zyV6PX!w&mSelfH1Mcaw{Cso#b_?7&r_)l5vLm#z|aUJhH*e4i%
z_I|v)$DDWNX3Yn}>Z$7%m#*vIeY#ca#k9HSUWvVT+4!*V)4CnDk<V7YwDG^iw(ZVg
z_mkp3bZ=itWqthp{nCWR4*OM0HyXW4_MOt7)&Jz<oRt#7uCbdQOQ$c9T;MZV=J@;*
zsU-m{KB=VwOB}g{nq9yBJ9p8o?evn&YnyxSRv9HcIk4IwOj|WdbY3ZM$Oes@>o#d>
zZqQ-XOq3N|c5~G=wXa!*+w&eeanAizp_-GhdQ*vJZ}~hAr}G=4QgZHp-mV@VYN@>`
z|K2>i`l|EEyUkTr98mN%x#tz1T0T)lSTQazv^XL<(0Gx|+xy2OwQ2<3US!%Vwt0<A
z>75xTg}%OdCHr#HdM?lGmBPCdI{34gH*m__$!$5mvf|Vw%Poth{}U5@dU#vz${Dv?
z8fyzb{=7at|J<(iC(HfV!``nsyZzC-q6snI4d<??I^Lc8Wcyp|v^$0~t?Sxa*gj1Q
z*{~|qVu8ZjU6t!Lt#kh#{k!Brit4{BlO11_>e+t#8KAN@VUEz6d$TSmoyqywwL?>L
zUQ2QAswD?4G_Kv^`1aes@=EY(X2lbZ+8Qng<yL!a-E?uC>EGIOhUu619t(%4tz!5#
zw{z-lb!U-(HM2KMZo0a2hW+<TxwkCuR~I#J5^XN$n(UotslIil$gQ1+Z*Nt;A!MMk
zz<THAkDoPjHkYq^8}>QEW+~r-gHAF`_B}r@-~77o%bZunI-zrvPd#Bi6j}CS7t7mU
zUWEdib`=}k<-K=e-lcatZ(Lorq~K9S_=efrzm_dKYJFrv+>N#8LM&I*S9@&S$oF)e
z%WnUg^%+Hzzs#;#r?h;^oT>iNsmtUfw@sQar5tp4mY&%U)@kO?w7O+|7E3Sc+Aele
zH2M9r%DWqr^`6)4?=_qk==y$>!tq@eSKhAZ&-HVz$vI$Wc)xyrM3AuI*AwS#4`x+Z
z9x1W<_A&72!Y|4`Y-yJYnro9DxkYtloRJB8vc=SITHY16X0!dD3-4u^%N%7F%va<4
zzxd0~%O^iy&X2RN``gd??5M|aoud&6d=_4tx3d(i=HWY`?8YPQr05<{XCM>GXdD0F
zkNvTuHrJTmFEB8gc0{TwFttLYu=SRsgXe~OPfRByZIn@0Gqre_p}?{2*c_ctMV-nn
z%0?C^Bi|G}__2jYsbcXS=Rb3=vNb;_nX{t&9aA}zTtq)#Q_;VBEzeyZ)#Y!T>+$aP
ziRHHq-QO%`_miD6FRWMH{%Pr2vs>FZePkcxhRB;m2%1L3r>V<7ySqL3y(@32#_3(#
zb6zf~SKsnlWa;K6cE<C&_2YWZStfCKF7(RzJv-@aqUQ@O*6)eYp^E0JOH2Z%)y$Av
z)VX6z<*rv82S4SS^|PBYEHvDAx%4%=ltp^x^0=Ds*E9|)eN;IZ6a4y=j%}pIkrqDg
zV~%MT3~vZe^)Zh!Z(I7bEvrhZ^Z4=I*Q&F1y(`r{J6a#_xZK=xx|d-s%PGAhZ#6G{
zFWbbth3mzixXZQj0-`*f^WBvk80JUos+p9ZUK+GOUVZtW2bww$IJ6&ll{x6ni$0Uh
z#FVwuVVc8Fex07^sf${4^-jrtI%{Vcb4qeeM9;R#Ra->A+dOlt{?nJruq@{bOOC;#
zfX2H{UPm{@OC6V&vX2dXTlh^!<y6<5{~sjsci!S&U=$%6y?ASar^8}f$Da=;=v-j`
z)-?Y}!g6_u3&*!C_K!ZQVZE9+tA6VNjwtn$?ILH>E+soH|Iwk+_2A+b|83PeA2og(
z_2&Fu>9K%!%Fhq)EOwrI@S^Xs(xKzK3ya>iwr&ic%JuWdMHPSJz}Y6XcN9~E%NoCZ
zOLJLV$`dd@VVQEDPIS2Tjm6rAyALfhWXRYQySVbg(x>Yz&u8rHdXn^Ua{i}f8+J!U
z#&7pBN}oL2r0w8~<!2M86nE`7m~@;a{Z-3JyRSZP!fHACq_<C6+4oXIP?;ez^-zvM
zC+9Mw{<+fD;WML*c=T;HmrmR}p)`E!`G%j35#jTviaRD8kBQhF;LVwPT_yX1CI9lJ
z(RtpNMdmLm<({>>V9~VM+F#;NOn+k#wf5*nN1b?;X<b{(bx)OgK8<-^P#ZaIY1luN
zi%X)ny}z+kP_nx1*Y+nGGxZ;NS^S(3m%Na3!n^y8(pw+NEBNe=5O8bYSzFL2%eeGy
zw?zLhC+4;reWw^!>}{^D4paTTHzQVCd1ghs?8~eV{ad*|CO%p<WAE%U(?tK=-lLu8
z_KvqHck=^D)r`P4P0q<NQd(S3rX3UeVS8)y>}GKePOtsP-Y@6Ms-M>_`#SBp-QLCf
zx+m{7d!H7z`0U9IWeE#2c`htVI6LiT-kZB=Qg>tCC@*HS@Dux1d0~FJn4>0#0_#q8
zw}LM1>Qg@%^p!4qiLIIx*%tO!sMf47@j7epi!cl3W4$LdOIkxEe>~1woSc`}c)>ue
z`1D1S+q?Gc(aG9XJN<My^Od$uYgY9NhYIUXnLF)*$<G$Ki9yFUKTw^Q(DwG!+RJGh
z_n&!gxQNv(%dzp3_A7QL`wu^kZ8|E=wXUecw)~#GhtB4sl{fb+4m4CUG`qcO!V85N
znm1N^E;JRHcX6G?@h#hKr)@iWf^BtHw_}Hf1WQzO_0;`m_Wk)JsG~fip>ne7@@-eY
zpS_wpfxVmkllZ#pPctP`MC+Tb%uq0$RH>>q^Tdg#ia#56{K}X(QQ$m#)(eZ@@4NeZ
zy*;DC<#((;H0>bQKCAtrtLA@`K2ml!;ERTpjq@SKEQS~7pKsYba~u2LSIk*?x5{oX
zAKen8)wV+P@1%?3ce;X3aXnKKI{49g>&fJq^D=rBls#1D#%|QxtsFZk_3!obbvD(1
zD?a`BTAshJPvZLQvJ0kBRjU_8thmT)sU_twG1^kpGIBcS#FbZc=FZp>vq$xUVfe+E
zDu*W*OA9wMFWuq2XZf1&Q}=U1mdEd}ss8rr?add<e;#gLA3QzxS?or)a2D1Dod@^5
z_UM%FtK0OdzuNKN0tPOLn;BDMuU#!Ot`gaK_p!%U?yJ}NL*75Wo~U=qh9lEU@cP`Z
zX%BBXeztVn+hMZ5dP~!9yX`@mk4`<`b7uK=D~o+U<Rv7vZBM({)J2_(^1HQrdh3~^
zty_&kHqATFc$MQF$Kj7ruJgUPn!OqSe=x9KylYX=)W^&-Z}|V@xES@ZOGYR~GUJu3
z7O(M<g!YR*yf02o`uXGSr%M*g6;w`W|IO@fz3pyl+V-#{joWIaPFBBWk*vdG5AH|j
zesuoeQ~!85vCMDbtmO(8b8=06G{W|G7PAE(Y1@0QW!tf-r;@c!nOys}bi&LxJ6?3H
zJn;7H_RHGOV{Ya?+<S#px{pnZ^I@H}PWFkilbcFc=-V%?{_*k*gHo;gx3urJ-(~LP
zPT#ubbK8Dpu}d4)@$b#wP_<S@HDvw6^7~P@Upjdz@tWp8S`u>o>7E5&^MZ0MGaLRM
zKW_NgK56&z)uQ*M9>)Fh(#y#7-+E)E(Sa9&iDG55BCqDe|J%Ul+G3H}FJ?Gfz$mZd
zNkCWZzMr)VH~YAV8|2#6D)}7x<p05Y_m4foNgw6;%3nTIHdDMO)nB$*|5Btu<hHq2
z=e5XuJu$zksFmBFS4V8C(t<yFR~P*IcjVrw(lrG;SFRPa>e?|Qd|}n5pPP^L<{c}!
zVyq>U{*JpOXqmyI&bzv&W#5_d?zq@_;pu_hULj`YrA%ojn-}?I+<%~BCF8SjOLK}>
zf66Y-qhE!3rGKuR@_b_Og0=6qJU%{YMO2lX=)S3U9kz$ut$Dt($iew{tmFIE<_R^f
zZtl-QnYQ1Okx+he>FE+?!6$QqzrT-F(V2c@eO=$VpDWF)e?6a>@OsL;rS;2rXWcq1
z6MT|WYr$iSo&F2Y-4ya_I=edH*Z1A4SMSa&m3p&>r!1}E_0JXE^Dg>My}N8rqj>Wg
zQ_)9@Pjl>TH!92E)-_F$_%Na9ysgc{aJ%y5K85doI{y|spr%wVSu6d9FY#T{oQlVN
zbK{kEH$C3AadzpgzjqH>mPb}DX3IDpvXW2h;EEFU@0Z_8A3CpRb>np2&9}ezU3*!$
zquk-PZ1Kd|zOUCM->WX?IimE*_MKq&n%brLU*8x_?0%|nxFW*d?%?j~lbmjn8U|MR
z`_4={?o|;La`mFgdQH9Aq0*60Qd<|DssHUzSLg2^UvCrCYIx0ZooG+n&9E@j-5YA`
ze;;3+zH6Cm{tr&py9Wa<n6tKSbz69{t6x)m`;x5nuR;TFM|zZgD)3r;?a^1Qo(k`W
z?{4@{a8^n<<LkEbhF+Axi*HSbC*78+J*C*T^VFJs3>qQos!y)lChXy|PJVZM%Z$*9
z_)W3vxhLG3b!QrjXn${{<}EwTW<SU510s?+#i0weN-y;+TmAXdOHB@C%h_KiuIIac
zRsB-=(HDP`)XR${j$V*G_;z8JeV6Us;3M}cwVYLzMOS78J~}jM;T+c@rU|NQK~fh@
zcJH26x8!b3=fu=}QAMp&$>N5)j6C9!{<!+LpY&u~&!v4y_VDVwD*--bdmnr{V;xk-
zHq%N@>B{Cqy%S&PO|*XXG{{Z&>k`W?Q@_62@#IQqq5sBJJZD@3CpiQ>3cTUmulUdE
z^sC$(nSMvlzFo5|`QxsKm9do{KCgLYt(*Ab>Vl)U94(Jbjaol_UPI-hKcD<BzP{P#
zaV#~QBY92Mgt(aJ-s_8Bah3R|ync5oQm^UMe3=R9H*c10KBC}$O*Z~Izk20@sb5@f
ztA7q#V|8$2!bz!l!iN(AC)ZqQauqzX|9t*(EiHy=d-Aq;Fclao%nF;kLZawuy~I<F
z(`98}{Gz!oKmD;#WOKNE&%wtIb9>z0Zod}9C-B}c=EhFDn^#u8E~(J3*SB3{TPb?I
z_)PlZwzn~SthZhqlL%CwlFfLfF?nnAFOIqiHqO;PQ&)zHvA?ZIbB;gz{l-q#Bk3IT
z+890Mc8Q1^zUfdA=zrHV_tZ35t{4F$zj*btI_wuWrcG8ADG#45CeClYN<=AjQa(S|
zb3u(6E7xXj)1F#CLHK>b6ZNjb>mgbW9LF-3TvFh3PR?5u^Yx+6=6Pi=|D5(%(|qpF
z!M$8&>b5!Tzslq;tZd)yzjmW?R)~1Bp2goc3+k`@EpnM~@xhnl@8?fEaqd@kS8V4(
zwdV(_E%$m?a&8iNs@3(){Hww$9q)pD4|_UO!b0^dlwx9axU7mh7s~Q{6W=2n{!^^n
z*FEMk&(TZk@9(Mk{p;lBldq@ipWnAk#Us`Hme*v?YirH7&CD&ibZPxdhHdrMWm`8M
zoo*df`RUu&*XjD_)Gpat{CRsdYR#^6`J~<}myKLXB(E%Aem<_Y`q!VxdUvsDQazKC
zj{hlnbAHuMmDS?k4?S&ea14F;KFe(SW!niZ8J$_mUs)!9n7mIrFMn0lI@wp70;E^l
z1$NuLNWG(0eJ^vSzV)2${yrV+dw()R`g#BKMOJ?O^`-rI`fksZ&Bm|U-0Jws{C_7e
zSGa%S#-5zV7Z-kX%v$iQvLe5_`qkshj+bUE;QutYEA?W9j>wc64SS{1@a~k|Zf4un
z)VQW_|3Ad{`C{?;roS=sH_Ty4znyt`+S{-vlXoTDXR*3-SZ<HYLDzMnrMhJXjgGH)
zPwl&vrM4=GdB&{77P~v{QzU1k{yWQf(PV;Kd8(40&XX(W?%#Fz@hht(t-MRh@S@el
zM@x8$cjO+>^DkVOb5y?2zUJrM*<$zB8nDgW#(K_U^^VrZ^?UcIawr7daJ!_M$}>l=
zTU7n3N8R19DUVN|bIW@WX*xBj<*?CXQ=K+;{ns}q<&~`OdO9h(y=qRw)-9`N8?3NV
ziVr?yr{cCR#`>1urNt4kDoY>aZapgSYEI+Zy+Kb@-)QA%+nziU>m9nnBXv)*J40{!
z$Ch*HC9X9yFU-61VczK^wxeyV)2yujWd=^<6Pvki{@TBcuV*e0nAWxZW7*yXHS!L*
zYtoiB8U-GBs5|}4<rQ;$wn?9~+FbT*b5u}`C7*v2r|8LsMvpZ?k$(k(8^V3UQx@DT
z_SR#qxbK$kWo7ehyU9%%_H%cpzm`$BZ<?FsAISXtwJ+Q4sgueYXFKgK{q#3mB-Ct9
zU=S;}y5-MFLL$)y2~ypaGQnE2PpEF$J2yy4Fsky3=D(^fjFmrL^zZ+_c)QbiZ~Mx>
zfmyP176d$4_j+w*7t6y{SqXWnN~^C)WK^G-@y*OvMWeQOtIoaj9dEiOzOB2X+?cic
z&6C8Ud9$Wn=Dt5Qdw19wIR#hI{RjGWo%zo0nK!eoe!_<b*Vqmp%uNwLB<~h<Fh1ql
zb?#GVPcJkt-Ijjz$@+J7oA#YE(D3^8ceA;EypN8iu-f~Y=ZgOxE#RLuQPsLJvZ&sE
zjd}k5Mqj~)7DfsAOD~J3uaDnX`Snd_=Kkh+Z;rKgF-%Fd<lDS=<t(wei5K>+xO2np
z;JP~=o?e@Lyi!dfCFEUyo>b7ey>DXrALkUdzVhtArs`&aud)HZVm2~;kyYP&gPWnI
z<gknRyuBOxy{4<VdYGP$h_0!6C^Y?QD%=0&HO$_<MK`q$a5DSZbws@Dv`E>n_t_xp
zLZwBIENg0A`J@`l8xx;Rz5c~t)AZlR<t7I|n6y?1G^^YSGFtP*+4lE~iZdQPf}Q>b
zj_)0vlc!~`7QH5ZWbIiNVIh|-X{T3JZC|>5hA-Q^E87<vc&Tm3XnOSQi)q8+<BR_8
zHU3)TdF^4~ua-x-m%`Q`W$~L)b^2^KU%F1&iaq_E0`9D4NAH~fc1<+o+ncACr<b%>
zhlbxit-YzOz4-qgm-*+}4(sjJzHvp@ry*7O=bYLlBKEoGSS!V!$Hzr1<leq|Pv!T{
ziLxS+0y?)>TW=9rrt~<)#q7DN8fVd($`ao@3w5o2iOlZaU0wd|xW|q4Qg0e}M+Hy5
z9^109eEP&PZtm)a&xh43_Z^Zw=>07A=$E6{`-;L{?T))N?LKvop<LWa^o{QQg>N-H
z^*&j9n{L<c^4q?7frj7JsKjfxnWv|;NkpVBzI3`*_x8FI`{bwWX<lEnXxiTAW_d^V
zeu&;^GfDH9<M!}PvL{a6OyN_pY0`ak$Z^-jrMLbB{nUCqFRkWL(!>=BH&VJU&Nk~2
zueqMupTz#m$y@c>!U&c>Rzh8U)6_(_HU}9^mk5b86tNCIo|BQfQ}io?&$Ri9r~FM%
zPp_LWzd(M$vZ|!t83z9fRxFaeydX2QMt=F6Akj<CO0CR6HIv>?ymRCt=h2m03$`{{
ztrTpZH+h+g=S+33Rl>1nSLqsy1noL~<Q<#yy^E_{HpeQwbX?0nLq*hJYHr%g<Lf$H
zI$OSTl>U=dnBA3-B(+&?!AC*Pt-S6%*UjC!=RJE^aLWDvwr>YC!a~mQpDfhjJy6Q{
z_>tU}XWKHnLuco=9X1U8l08ZB`Oy+?p(opQ!WR2+?3|i(Kw>hhzpRM5XB4Nz-jia_
zTdsa6JKv~y$VabBZ~BRf1+q(v!V+~tH#@KGtT<|#y!q>aXKr0r3m?7h5pvSs>?Xd`
zr+&holZJ}#76v_*T+JS$7AYEQSh+XWw<P@uds~YBmA6c69!KKuEv?KrmBOGodm(?n
z$%zw1PVo=E_^eC1^7nLmf2SGm!S>{!uanmC#@*fCRw&=Ak{$9S_xk5I%S*4bp8Xp>
zBhw;wL8GVF=e27c1FpWzn(=j);*zDgd!Jg_uYF(M;NSbQV~&o90N>MvwP`m5gO2X#
zzQcR;eTzZz0j=W-FNB&pKU#h}%-8ppv*Y;W$B|oDm`^$DUcK{jijj!1_r-bc(|+hJ
za4a?No*nKam2DFqT&1^bM?-L8?A-~c<}QA+<H(MNecOeT#Sbn1sQ=_`kk*Hg4Luts
zUEdjeG^NK^d2#*~>Bu?<11{G19T$sqmdD7fn7>5&>QU2<vh6NODRTmJ9d2YdI!*W0
zd3*A{;ruw}-%YGrqg*!EtMA+=Bk;AFL;q5f%(jAXH`N-u6+*E=A@94sO0eE|AGgO>
zn$h`q?XG#6lk^j&ug>4^@gT-vt%h8&o^5}_l#L6fYVe5Ve=OkKI%#Qj?AnJ5wk^FQ
z;E);qv$S*8XX&T|mm^l?t?*pq?AAW}wcuNaOLNtV-;1T(Q&J3kYbQ4C5cB4{{`r%`
z_3zL5=OOHM^CN?bxYJt2)Xjo_{?t_bEM`$-kN0s)Wm9D>^t0y|xP5f}ZJ{#dJ>o5m
zw)b+Tu{PFxE^f)PGSNJKQrOBhq5j^3h<*;fdfi)*(_*GN95moRvmq>0)>)@s?CCCx
zJuLgSvgv%en08~o<Q!kg>*{mu7UpwwbOp(2l~+6u4d8KERQEn?x?#@-=D9O}wK(m(
zduWD^=x*kGqd1Z7n^&H8z1O^$6}e`W`=iR5lt-WB{!V%<S}tvPzjA`j+5%A#iHzBL
z`$US@x|}SZqJMgi<}78eT@nlode1%tf0R)6KHVqq{HJPRb#^y{S=aX<<%watBNkhS
z)=aoiRP^UxjFR9ij$KwO_VNW;oc|$nsg`j)&raK;GfY3;5*M!J%B^|xc#6myi{Bw-
zD?NCn%?oCk3!S{s(S7}|-Gs9~S9AWQy+12s7T0clhdrmRlIef{*-2Ix?_2SNsJ!(^
zj+A%dp2X7<a{8d<#0MJNn9fZJD314H)_U|hZI0(trMnAxr5C%`9-gJONUBTZ)Ze0m
zTkB4oFpOsK4^w^0`g)^R;*kzJpJcUZbqw|g4@tQOneO;0y>I=q+o?KpYWUeSRie1(
z^c4LxbI&-`D74Ju@QFAFH`C758$;)8m20rDN%^gObkz^3ULJ)N^QHK_HFO%kG91ws
zi&$f>7COsLZc?R7sH(EXqV%7F&$iofn2U2SFUnc;F=FDO^0c!Y=M#2sPO+IV=hlpi
z)7A!EO>FX!nZiEZQs_<G6#g{}#s6)|V3+m!e|G1C*;yPuX73$tpFHhVy6)z+4cQkH
z+Z^7uFz-DWBL2?sYMkv}fnBlU<=X_WKlmt;{PIJA%%TTdgxA(D)2Z7LJn5-qe3Oyv
z`iz6EP75zT-dm=6%1xb{qkM(!juP{(WAnGgujJ?CO13ELxBSj~)Us^*3~Pr{$t+c^
zXOmY1Bo^+pUU;nQ!)<^5=I{D{R;<~%?T6<idtZajx6PKlns+l3@_q-(^;k!}l#iRE
z#@n--+wIlo+k$su!;Yj+Y`Wq;S>xT8$Nq~o_xC(>meCg3xhtdONbsZ(^%G5XC#F{h
zO`jf~F||hcUFAHsclw?xeHwK=OlR(J-uS#MWmEk$>G-GR|6cq^S~Jz?i*m^B3(4O(
z82hVKCv7iy*A)DI{q04H(zbV=<Z}foX_@tgZMZUVUumYFmF;qwuP=G{mIa!Y_!b@C
zby9KPKQUQh0lntkN38zWbUXAh*E;3dFZ~@S=G<&I(Z=<cv<=5?qXsU<hF8-!TCf=2
zb?BT?=W4QV$&8{adsO~R$vyV$*oSzZYqbt;Tg@wN^Z72$6gs!-a#7^AHHU(af7+y4
zU;RSL?bi0(Y~DG4c4<AAII|_ga+`HR>M|Wi>5KP5U-U=FESmYs;izA$k>K*Z@%LW2
z9$uwyl6;kI){L*}KWCOaw0ED{{Ahb_z}d1*8O1TzT{knTxoXK>%kas!{P1Ey+$3Su
z-Y>_x%A1w!&K+i&Zd3hg1M~DJ^TPkAt-HH;2j|gWLhEmcXU+Kky#DX|*f$@as8k*~
zDE{Qw;>q#v*1I0;KbyK+a@BE-@)KN(<~G&`DyfEv-1)NF?5*DS{NVY$Cj~d{l9*e)
z;$QC)*1py+(wr-5Za;T-+`BsD)@lEb#x7Ma?3`*3soB5VJ4?oE{r~rQuYRvt6#M#l
zyt2X@&!YWDt$zAmKQZ@7?*%!9ym&K{;)rM0K0o?ir7xS^G%0v%mFuHMgG7btvd6X^
z=288UpZ84SZ1|M7rI|VFlYe|%!@;h^c4Vquc>V1@uj>z|DJf2P+B(;G{mOJ(uXz~)
zOizXP`u|{bxhv{7rR3mTmiJ6icMao@t~=<QI{EOXM|CT6&a80EikkRjtKm!6RbO`P
zdR2E?=c`CivX}h~&EFFDGD`CeKR)2S^dVx`?T3$FemUS>nO1(hq453x&_DZE?~_>c
z<K*(*8;5lN%qVq9PxiGDoU>c(`jjbN4@z@Z1^!Af=B&9nvpOsAVsFzfO^cnU_NZ^X
z6X~>Lug(QC2Du&k7JA+P<#w8>-RYs@j&%<gZoj56Rno?;&;Lo*b(f|Yev@zHJh)-%
zwfW0~KOX`mmN~9peRac9ug^9)xsDq{k3FlrE7Xy9UpdQ7T4+lXV~v#DvXjm-Q8hEa
zWS=NEzk0iYYyZv@cRXfpd>HgjG1o!yy7iLHJz=E>9>>28-{G;DpG)hj!6K*TR?gKr
z+mg!NeeOt_8pXK#O8fe%E)=+WSW~AiXv-$s91*_nQ4CVyUe)g^b9s|Zd)hZT$Y~#V
zY>}z0Cw#J?JwzZ`;lrNkl`MUX%$6OimN(x$@m0mHF3L-*yghb>l-&6RXIiCZ88eAJ
z;{I)LN%@@k%xw2p3uC_eoa)uxvBpNbX34Gv&t|?#(YKTR-nlR-!|&%>o0^Re|L=E7
znRR*28CiF;KSzudG*snz&uXrXynZL))_y&aa{kCUc?UfYl)dO%H}7QXv6xN2Rtf7}
znYNboY*%9DB_+8@#}6JTS^VY5wf`-W4paJ9$hm5lopci8`law8Y6gES&!x);eL9Zq
z_pXrAX6bp$$ZP%M?BAzm{MV$T7taux8{qU`;#!A(5@QRa(X_eqO?EA-O<&%4dY06e
zAB$6ag%T&Ontrb;W|O3@)9sCN(|-kB-SW85<#}K2&7DRsZ&^9LKF9jSh`VztXQ|}`
zzffbj*B!Ip>lllw2Zk1J3BNI4R%g#?pW}1$uCwRzi#MmqeKaiSuf6z1^)pYaZg;0U
z)5_$=T62a!B`o##8P{pgkl)nR;jroeZ`3k_n3rn}&NWV*a`11-$}G7Q)6O-@JV_7z
zN`=pEt#!YCEyG^zU}eyI4_nE7zh4<^-q8M1u6|FrN#1Yy)uJUeKANqQ9p-Jn<)g`G
z+T>CxGjVpS)uTzpBBrl?CM2ARTjTid!bhvk?-#ILzK|cj`u3IbBE}#29eZRh%e^~m
zadEME?Dhwr?y>QAeP8lm!TWu=4;idJmm8%B)>_Y8+L>Y|eE-6m2Lh>E%>;QuQl@xX
zir)`35AvGvUM+N14!2yA*4q<Ji;XTmc_QF+?d%a2p&o73JYE@F+4j!u{cnVnD|HPo
zEasY>DP>VU;e(>Xo4=|1_T70l{pjDvPyX$<umAIC_x?Nl7wh9&&$R|U|86<s;NQZc
z{ZSA0{|G8d@Jf32Tk!qI-x(r14_#5>bv!spk0&c3N4%#|P|%EtSxx-^iog|%e)R5{
zw|Fntp(b~R*G7R0_|EkIn*Ow`c-i``)1R(7lCAKi@Zjz*Pdb=Q#VUUHisi5x#eSOc
z=tG3orgb~gL$ABWCU4Q%Wz3`!8~V9INa_3)ha*k9mrk5~mSdvP%FoimciaQ6h2G$O
z+a<4ZHQs}zz|l?FH|p>I)bg5u{cqbZ{LnYN+bPI$tjr|h$&!U?XSd({u~geAZOzYu
z^sTr5rA8FbpY}7qeEOFc3*B`zI={)5$?#dUF5CENo$}WS=Fbz~H8N|r^=ZDYTsD*A
z$=rvH&ZjbDd){nVk{Ld`GwW!;#)__1r3Ff1yQ7wemDFc#J^p9r2~qp%i8(jg4?4Iv
z7rp%|`S3Px^_Nn1-vX1SCz4gs_nuo!+%J<NEaag!x&QlAM(@pc7hE--=}`LS|IDKY
zmft>oWp|rk`J2xL#lBac&5~1J$+E5|qG%Zxe}K>N?fl*|a|KV$b^o?0<c49}E~9Rp
zAiW!(ITq~hkIW9{{cuQh%7<HShmO4!mF*KsEzUS1ysvA!2vbVcy^r5kWqt5#J!F5h
zFZI(ZOMYh;S0S@^?_b<o#J}lX!v+5vVqCYYe;@gs+xzBVQo<@}zKxbv4j=xVzWG*l
zkG!nRhW_d^^~ZJ`bvb)#aaz0n^-dFQ$7O{PrH*YKo@+O$Ub|hIWb;#MpV&e*C55kv
zT8EFY%=xh7(2wgDs_W(E|DEc4bCqOuZ}^Oog)8z;PHpjh;uP%Ap0(*M8*@_c9-lI!
zzE0QLjya#Zo0}QFPZVH&9v^!|;LDapGoPuc-cc8ns1CjTZ0d`xt8E`&{lRwW@ZC$y
zM|um`Dl4MxLN+Gax4m3+B5f&`egC-w(?wYsR@59064qk9_fW)L!A#U$*L}^zmD^9=
zU27ctu(4y((#a21brQJNI#y~c31~VTFWtDtY{UK=6<n!$&O(v`k5=&J-?G*%mtDWb
zFXrWvt;`daG9Pkzn>OEmu8sZQXI~#*|35=PEj3-qe-E3ulB<Bokpn-=B8}#n&bgt?
zG{H)RJLCGPE`{TMWlx2b|EO)3i_76#v9Y(rx@N(fx)*F!D<>Hic1?>Y35xzAv1nG;
z@*RmYo1H(;S9y6||NgwaRox38w>L})c&v6<dL>)H$4bWoJ|!O&FK}r0GCotO2y|eN
zJ{TMkWxVdPxQWiK)mJ~rTU(xZ`}wit^M-?epB$e#wQODB&l_BQHydW&OGtg?!I<-G
z!esR&o%0ps>L)pucQ-Pe(}{j>>LH{$xACXP>B9DhnZ2CcA?c<jMxpsWvy=C+Fv!Iu
zn=bg7bT<9Piwh-2ZN@!;4yOg5{Et2<+;e4GNBHWO_VR*jrf4kUn*Yq#@^U+~TBv>a
zL}7C;!Jhh0i682wDfty}&RDqREKgiyDqG+?>xCX>e5=d$OuA=yX6E6uldsrr(va9I
zdzZD#nCYjXV{jc?QoDz{9CyyYfNimwKE|9&CW^j4e)7EWs%Z@iX3N?A{r2?qmq+PB
zjw->4$?dlBhs~Tt{AP)N^wE$~6SXoh$?0Bk)lg;0mMz8)6;)p!<39dZ%<_m+yT*kt
z!RbF<$vjl~bLA0xvxsq$QRdVXgAH<K2NqUZn_8}^tl#jUr=s=nrGp-CN*BA`4tSP3
z?Ujc0S+<*w>n2@zXnA^JZd!bq*S$QW=bHj;<_bUNT9mU|DQ&mI$BPfz$~pe5Wd0+#
z{&0opJKZVD$JWOR+D-T+dLZLUt}KJUZ+LMYWB-XBBe5?FKOc8zJ7xXtkpEq_#nun{
ztcu)h{M7pA+fRRRE?;eicyYMzL+dGujZ>dlYZ>g$o>S4YiG7!3NV$gWuHe;iJa-*u
zmK=I=@8jK1yj9{aWsBk#2KQ%(UAebhb4l{+%Nu@ebMSky_;bjy@8&#LYA?;4aQmr_
zgzYW96A{4*Li;<;7yW&^!9DMF+P7T_4ut}|DSWwoJB|5ElO-AAgX4BCoH^xuF4LY1
z*3UeDeO>*$-#>m&#h<^M*Khvma6f9{S>d13EsrlBKFRQT#(d}2s8BWY7R|#`UI)C}
zYBcHV`U*w%*XLGF4|;j6dv_zB*iD`MTY*wK&r9CC{A#H2q2W^0T#*M$W?PuVO31D`
z^*Y09cl-virsVTG=JIze_fg)HqZZvGw4-~zo7sf8ubYkaFLq2g^YrTB*EN!!dlxsE
zaK4$c>y?}N@-Bs|%*#8?9_JX8{XD7^cku1>(8G7mnthz5HnVZcVeiUr*;1C-_OZs%
zUR)tp<qm)2(w$Z;%G`74$-}hT`EK?9Eq*e*w_kQIcWw8^*xkv8CN&m^T{g_JeEZFK
zXVdEZpGWzZ@V=Q<xAPv~mDlgPqGyB){|h^nDKeME!+7&+ZRs8B+C+0t8YXdEeR55t
zX7gT?%?2q#Z+?7<JzlHJHgo5K#rv1AgthS0+V1#X&xm@wyo2JdXKLFS80K*@Gbmv{
zoIWozFDnsx#=KrZ<(0j^>mDDQXz=U54Xe`6?FzbGk0sS_y6oPxIOEv1Nju+q2&ebE
zoo-OjP;_Q8Vd!hS_^NvTXQ}5W{bGOJ;}y7a<7e5=&F(4}Vry5gTeoW6>AI4C&u+%^
z$3MvoyK?j4O&#r7HS^N129|8{x-|REhnGKAyZ^qJx${=Y&#%71wtrupyzKnrdHmw;
z**aA-uciu~-PC_`QH<`wqAMvUFRl9U|L^{Q=P$1ZJb#(LX!D|zVjng|O%1*DB=zHq
zi+i-DUraHIH-D`)+h<V?=lfY2nq8X~Ds9!6JgwVx+9l!0jA>^le_b^5X{K>kT=?cS
zr_#<pU=N?6>N`nq(yntQtUo)vQ;t??#@n{PUz`#9#D1-Dopro;X7Dub(CWao>YC@c
z_Q$K9J*zbT)b{)Z|MMSQ)HqbX(_?aNR^IBArPe*he?0!2n!RQb+mq(~hjUK7Us|>6
z)Mfr|pMR^aY_GD74NaYObydpd$frk3r(C(%I%CVmoXS~C<ToX$vDt;4pZ+vw?}<If
zBR?9hKgBe?L`1i6YT}Z-g)gn*&)76{f4WsWZQAM3eJ8Z8`UJ)5f7&(iz5mhQlV3%N
z2A1A&+H^ok-%et^|0?mH?Qd9ZWnA;m->+eBJ#X$hxn`2-6N{9o2N!eLMdXR>J+WMT
zwrEWyC-)rjn=gGiXD1zz_;>v4*U$c$+nk;V_xIdq`gqQG#wznjRfZmpAG25OS(niI
zZ-&G2x~S>CW{n%|rM8v6w8~a1dNR2(()U$SY@&VMq^c$k^Oc*gYMlD$&f4vKUS&g3
z>f65SUp}9|>9%LO#samHiK<6kr@p+poOSB@{pY)Q%recY8MRHD*8Vn(d}182$TW%d
z&8Zr>*dG0VpU-|i`I7&<|NokAuYM~_87JE<e8loWUZeZwYVnS*Cm&7Jvy$^?dDNwp
ze){Py&t=^_(QT4BUN?THRj!_Y-rh8Hl9PSB|9`$O3&XM_XNMLou(`VG)Pwk|J#{J5
zL@J&>y1v<WqR!_Kr5lz)>K{+9S$m;u&a2LKqVL$e4_O@+;EMcX{qJV%@~GEuKa1^a
z_u74;b;iG4R{2^pvKP<k78h?=7|Fajc<R?K&3DENX75S5aL!0mfR`hvgvX-cbV;RQ
zUAV)^(?3Gv{@7kT`Y15O{OVQFt98HM{Ym=t=jP3$H(!T84+vK{oXVqqDu02>zrV8o
zYk#TitNQZdV)^>}aeHhlO)aZSe?7Xp`T1mXb@71pw|=kx{&o8A`_Ei=MVvSKQ75_o
z{%)x~`)w=i+v?lC6#HMT`}ynUZt=3G--Fd^-!Fgvnt6>yOM7#Ee_g4;zoH*c#dp2?
zx!c~Ubh+MzxY)m^zcaHGe9?7OwD{rMTv494eeb%>7q{Pu2^14P;2SZ?%D?^5!;6CT
z$r}9+W^`YAn&b2(nPGKtOR!ZB-~NO9_q_bJ*y?oOqS?zLue$fkpFg!lj(OK1p=qDl
zK0Yf9lUeur`1VRe?florH?R43Van>`C$;Kh?x%FK)@eR#|MWZYls3n1g>0{k&yU~M
zP1T+J%K5K{Nk>KS;lwK8)Y4gNj4U>r2Y%z6!1(>snwZ0UX|uw+rNS6PW&6@^v}T$u
z-rSw-;&7LxLo&2Y?!lMT<QYF5MfvaT|6jC&ea0q_X_q5~bo&?m`1{-9mywjtrlbur
z@!?OaOe>6J4lQ1O(eX<P$NwV{%nH1{{}`C`J}X5={Ea*iSTy^3WJt=*p5Kb!eO4&P
ze|dZ2LS|i>?_|b$x%YPuZvVY^M!NKhE4#ElJXL<Mu1+I=G1GR*GilS-B{nH<j1gQH
zE_?RVPnpc?CfRwL*K{Og*DZQh_v9(N1oHv$Ry~$C6HdI^v1Xk-^NP|<68B9`v#$A7
z6U4a8-$mG2<<F!oJr7lcG)yIo)IMpppAqhHUZ}fQXzyGF?=7b$RKy$$U^4&n*ks=!
z%SiDJmK7&gKb7IQ#!`^XxA*v_%{h*#&%fmR{{PqV|K8ol`~QE^cQD%II+xXI(fNDR
z`eL?jiPRPR^6*Y(o7vOSS$?akRL#=v?$eciFtu|o3)jgU;dd(z8l2*e*qCX@>Q-=A
z)Me{4wd<!nN_OqDJW}>zj?RNxCZA0k+4uX1Z9lo}Ur^35soNqOo*l59zCFTlujh+3
zEzCR>Wfp}Eug+{*(N><dzEARTmV~X0@y)D>OKvh0R<+FFt#23edKD>m#o6T?OMzfZ
z=PPBI3G&7-{3h!+_I8}I^ld({$l2uz$F>ut#mvDQ&dheVn0%JEz}sAP&b#AM$0ulR
zisM_Mc#lzjvX*<?!oIwGuNxZ=EM1f6V*XUBLE&iA$tdwFr*F<^5z{+(_n>ZH0>d0O
z6Af+Q95F_(q{IoLToFbV8luk`q%GKQUDYwWShCoGchkqOGu*PbvEKR5wbA>aTL5RL
z;DM-=Jxgp>+^*T!a8BKrp{<+$^wlNF3*<^UgPgY<IV}G~`Nn-g!8aZ~?*pga@e`0(
zcQ5wOo1e4apL=kp`ui*Udwcg){NtJa;pXSh!GCr$9c2E0$Z<lL<;Jcbn-?CIukw0t
z##*<#{>zK2H&@%w_2D@6r2qZ7xD}rbCfl4`aBKG;C9A6Vn76!ZAJtn{-VT~^`jX$G
z#O~S_C*fSxN5z@jeFUQW7HNKwd{8s}fZX=)k`tEvs1>|??!c=r6UwSWb+ebPFx;%>
zP?T6z@a@&tE{S<cyHhuDZk>4PYL9xuG2X5%+dXT)ytpWPsC8xqbByr<<{X|$I|^ny
zNjDg7w@fHvI(zuml87amnO7s-=B-<={3N(BR>s*s<o_y`e#z)15(UeT+CAoFJN~dx
zB#u>Lx2eD2qyrioShAKWnFb1$*!(;6%W^~G!<B;aD}|hGw~8?aus;%izyAN<)%gt7
zE4H|5ec;?sQhy=H;;**Ex%8V{J1(s8Fn_M;@jtRO?96Fpwhi02x9?x2n#q!Ix*@=R
zvM`TERB^Ay%xT#w-91N}CdoFgn9{H#?y1A1O`JJ5l%wK5Dlq-=pY_G<&67>H7!I!C
z*u;|TkXZR9({t0Yz!D+dhb)elxT@#ecinQlQn*X5=;f@k9kc9iJ>Jk5eB-%?M??;j
zmT(4t-!v7a&PdbX)zdnSI;V+w7Vh<1XM8NVhHHzrDW`qmvYxPnq{>NaZZ_r~O>eNh
z(QT*|u9umv<exufW&akLf{k&yMtVzs{4Q~2arLnJcvbY%w|aqFV#k{PKRBG*&?V8B
zdRb`OmBKHge;Z`0{kFWbs8W*u&}P>+uZx}a-K6#MoE?2ChYTj(@@aT_ZuUu*iUmhy
zjw!9^wTSCa31^u0!|d2RfuohIxi54Zz8)_Ly47D7#BgN0yW8yx(=u)?OFZV6xFhBz
zziH>J(`$BWrgQNq9Zp!7COe&(ZNV<T2}iBdrPl4ac1NgL#(_6e{K=7pF|1~5S23$h
zQe5_kePREr7r9fF^Ie2_XA7INfBVIhaq#Br15=V#bLUKb=5Rpf`fAsEJQI#cvvAlm
zJ()4P^ZVk88z1W~ex0<y{#8{v-(TIF4PiZp?y67l`e5z8?upMNhqw0ItRxI;N}af8
z9N<y>pCI3%tkhz$ea(-?-1dmZ<8GQ)1NrVujp<F`eK09;^E(ECU9NYG=W~>9c6=~R
zjqg>|{^R%O&*Nk5ogU1Y8#9H?XxR<sYq}N{r$RakHMU%R+Ro>ZP&#`FLztQD&ZV+b
zjLO`8ov7N(FU#UN(XT2d+@kBllJ$#cuQ}CWx!ZN+){faP)P8!%IDF$YFhASqSfaqm
zYHm2~!X5u?i`ukFF$(2zxp{(Xtc3*9`aIb_TJP1L;rL|#?5tjOzRw45D7J^@NN@D!
zO4z2tJB6j<MQJ8aaI~rExzh|gIuFz^o!*_qSJ0WR`+@WQ{)+nVZy)@9JN@wY@AnVg
zoWQr&tKt-MziVl6+D!?=k20OpW?xm~Gj*BGB6YaR>(4hXr~L~V7+tsde>z)ty)rE}
z@$jsOx|71zN`0JSrt4??&S&h{^Peg5kMH+gUt(t~eLlV-HF1CK;y@?IDTSvhmj|>a
zx!?Zs<B*4mN0vxfgPEYXQLxaY`xo~$KVh!Vcz<eJmz$xLx5o)9wOcv+15|cBJ>X*7
z;6C+7jgMfZOYNn2j@}gCE3#?&?8i18xGNJoUBi6ZffJlondMFX&9YS!3iyTIForFA
z)*IHj|BIBY;v;R*?yS2O$qRHJPmj(Cy<Gjn`AUInh+WtE%O+}(Ns;wF$?JtS9y$K$
z$j11~n#}qy*Z=jJQ@kVNk@UF_G5u;zd1bR$*+No3Z;5ICqIT0=IODnZcaF!`?k;!a
znPu>h@n_bb??(D;)4xnw9op=_Ct<$MGq%p7jmH{RFXWXlQ|bsSp7Z6jYG}OB&Qr%e
z@0p=k?rU{I|J}X&a(DilU$}C+`Qi5I|Gyr+I(<cX`7W`0<zF19$^{oLn0j%2-{QmS
z;Z?s6L|3aO_QZ2MZ7SxAe9E_APMBTE#?4uMeRpbk*1VAUel&AagaTI#S6ui8rKrD8
zj4xk!>px4>ep|=Wz>bz0scbvD=q=&tMj|X9FV`>xwEaDBp-_q?`IWOyMdSAiDm>B`
zvMp*XZtDil;W)9;&0~GTybs$#KVDGVvXY_meNNbir$6KU=62uyc=V*@J?(qe#ZO9)
zUN+gzb9!>gBmGZFN?+`2%oV0*d9<+AUGI5UDY!X_RrHHXg?7-9S-LTjr{B%nbI>oE
zD`hsX+EnY@0>#sF7i!q1p8Rzxxj=W(^Z7q#+eDvPWWg7HS!CnZXDniB*KCh)He>}Q
zt6AMropm-@N8;|v#XtV>G2DqZn*KtB>6qnmv%hksi$Z0OEie#&a-!mu&{K<DyZib0
zf7<;O=$5HxOx@`E;{6QKz-HN#e?;H;Z)bli6P14d-v{o}<GCSnn~zVtnD9PJc%|b}
zyYDYvYHaZAxfgAH_HAv2(r&ejFD8@+RB5c-F+Vr=%wrD&&+=7%0w>QlZ;}t#C{&*2
zD_^o;*~wccZ@r4Fejf4X`>r(Yj1>X9tCr;|GI=}^kN%=5l0TDi;m(8NOUxHbFYnwl
zRY*N0E`fI?y9mRP^I^+0qf<_c?Oncb>h2^~*St$%Pv-o*7a7lX^;q<-P>qXgI9xZm
zNbH?@G)Y)>b!ceaqJ7uTupUw9S*DuV<oS|&`3%nNuw^M5m_LPIlKHytqw9oU8mVQ>
zyS(ny&og6|+B2`bxO>K?UA??gJolcido_bqI`ZOk8I^0_TRU2F7yNjlWzct8g0DnN
z^O{`@M?j;u=Ny9_k7`5SDVScov`LK3R9)e{eZS!MnxJIamEK#|t31x<4`;NtVXL#%
zPCKzyUTV$mP^-O>;_@GqOxLhFp5>jkqo&C9_}kbAYo;pfcyL)+gnJDi>&bPouTNeK
z-4I<h?_*oJL%;h))i>fM%nfI`ZYMv}RJmZF61{GgZ$%Pc#jLA>&H?R*-4E_v-lNu`
zvBPFtOXkYj{~gxPEEVim?p?{HT|G7EM#$G_uf&9@>J4tIOPxa=+f2@?Zj4@1pLEx-
zZfc09&AI7oJX{368opy`z9MvLhH8lGjP%uNTra0zb2AQET;?ud&3tGs^WRH<?jB`m
z*P3k~nz-<r@vo)JkK8gm!`fBuw7EGx+AZBT{q%z#qgiHOq-Vum{UI8%@JhqSa~>TJ
zw(nQ#TCE#;rI>l`gS8(|H~R6bmxTASK8{e%GMeqXAhB`z2jA6q_CD58u)cNK#+f;E
z&pfWP`h59&;?90}(fa;y?qsj03#(&pyxK5F@9yjKuV>Br7yE0ucB?g~%!!~9fkH<E
ziLPRf^B+$bb?}}2QCH%0&2Gi3{~fbi_4@bQ+uEiWY6ynyx}gy(`1$RIAF5L~UUKSC
zT=tqvw`=OgZxXjwc<(vuHv48(uz3oD^DAGYsFj76(z8|c3}SN@T{8M;l29FSPRQfU
zvi*;j%@IklGm$8B{<3}JEwwLCwKlXL%lORd{=C7HtJuid`}R?mrxsn-Q)29NwiuY?
z=IWfN4|wL&{X~8?XF;KM>KE5`*83Vh359A-moAncsW_j$u5QmR&2HZ_Y%VI{%Ieo;
z7EN^1JTsx^p+(E5h->_-=DjewIFEPB)QJj9g0_XncB^D<JbxwbX~VCpR>tdQ$7WSM
zjXh<@v8dEf@^o(8&dUt3f(LEPZ<(%mcihVRclhNMrak)<&u%uWzPzNh#589rr%w{w
zZ?m&my?S!ITLd43>vAY?vjtpy{!ynTfa@!B<{U-)M7E17a<0~F_!U%k*XpT^2ybN6
z&#633!GCHZe($`o>Q~CgqTS#0jwr<46uH*&KB4{km-@s1*}oNs9zGzu(vNS!)SD&R
z+azV?^&V#r(#@Ra_Fp+cdfDsO2W{+3*DT63@_2C6_`|u`Ppg+K>)y0O&N2Lki0rq!
zT)B}amuSCBV!QQg1y>;d1+Iy;;qMAIy?eiA=WhG1cPV>+zu>#@-p)+jqqF}+K0|58
zzD>U!d}Us=ay~w$E^Hp59TDbhX6$fVW8tjOJ$?&vCztPia+|~b?Fz4$t);&l_g<T8
zRJFEYpZ*t~ckbdV!cJzJopes++7NJ2QYbh=aF74t!^JaePDC&kM~BHTklA#FZNgQh
z%z)eo?l=xZ*NCgym6O&TJbuwqGVQXY?ditWQx}%3*VJZ~Y7n35exbtCOoek+froRh
zSjF`Q;md!jV%KGx=u5bs7Mizdzh96^_t_H-mfA0mh?%KgTEbE*?O3;tw|ff5-RcW>
zg&980HGCCm^hLwx2G^xao{f8Amd~;+36%c7<J+VDWbUa}d)P{xpP$m&zED&lOt@BR
z>RM|V&I_}<WK15MZd-O@%Skhl1fJkehfU*eeHM^g+&(?Vc#r9Mu8p5RYMnYB)O@Ro
z{Z_)l_J2P%8cmg7c%So~;%O%~E}oxynhPF=yb7J=zc8Zo>(bn`tcc^!QleL`Iw|_+
zjd{tBpPBcnw8hi7Ry5TrUyEzxdY#SmJ5B5ItISDT*31&S-7nOB_SR>~qh*H2bvSmI
zIVoP5ar~mJaGry3wCl{fY%b+DL#^gA?-lWOS+o77>MAAO0}Pw%9VUND6TW*O{+IfR
ztW$O#g-4Ub%63hA)%4}EOe62#mzD<G`dBUmomq0@2j|1`A9EMK@Xz1$r8%T^%f@3n
zm|Q13|76y!m-g!8p*d?;XU{yYf4y5RUiZR_J#*Fu7rkoScC&8g*)xmx?tWC4FQduM
zd}y!l&UG%0RXP5>w<UudMGiNt)wAlbJ00c}zfwf-(nNl~u9Ss2S6|*b_$m6QwB?LN
z`XBDEV7qminPtI_s$Gsr?(a)&FD~0?AwA)D+wt;i72i1C-J7^$*%A3|54N=1PJf>%
zzWVxi-Nnn|<WDyK>rjz%Z;9=Fa+Yb4|71~RvjyUA-$FKqx&1nmyWx_`^mjeC_VlZr
zoikB}qkPlM7b}+qPER#X+#dLM!m&=i3&)J(@|TyHoxaI(qiB&R_l8U2fk_)@URm-v
z`?T8}xkcYALYGZWofM`jEqGdTl1>os4-Sq-8}WFbl+&6@x`{4*e6v;cG^MR4T{&+i
z*c5t8{2=Fvw~pI7msjp>QZ71l!R7Riu<~@H+YHSPd2e&49iQJ=;=WL*LObj6%$+qt
z_s^vBMM=HZ@|NzOb0|qN)$!wHO_tNkz8(B?t1?q}zD}BLiIzf@!_Lz;Bm5*jUo>{T
z)S<t<Z1Nwin=I1lIzOD^{f{<rXG*_+C)k(y`=+#&=eL;BOHbnjuHBm|vaxBs?N+`&
zl_~KLHf;axP_?)JD060;+>RZJ6VD!U+h@LX_kz_E4_1YRX(}H$FtsvrbKJs>XCk&b
zUC=S;dlm07&G7zrtM@M$rac#%_UK&eDX#CcJC}%8Y0tPnarf>;v4#2J`8yAA#fK+6
z46S->rmP)1(Q*aXeJ10(EDReYfA2b#CVcq(iro+I@WdD#bXGJFd01i^sbi<7Ug^5Z
zL}S_Ea-J4{*56XMrW$@b)be7RardhuoM-1v`s&G*#M<pSi#gnSh1N>-H?5K0_Wa9F
zY~{IZxbvitMXQBVul3t2U6TI~#y<GF;>V1plJelX6Bn*9oV2+mdN`%VWaq-#ANzlJ
zOu8(ytc=nAVmqs9#+^q`yY_T3y8fu>O-w#_x@b;Mc%eCu1drS02eA$RejKrtEX@lz
z>B%Qn>AUT~n~B!_k4kL4J;eE<8JO8zu6Gx4z1YksXmk1m!`+7B6*&s)9HpZDH7%Id
za^}kX`&F?uPDk$lzw7&dRz06p8M}V7)T@85-+zC(`$MADpTGJ0{(XI4_xbAj{hvPU
z*)#V+iT{(5=ouBA%b#3j=ucY6^08yH;M(JAXFZ-8cAc5zsJM6gquVU0e3tWD*=5*x
zq6Me<uq*8}IS}9K%I2)>zF=>vRHtfcx*PM`75~e>E0+YcZ*}LX)e%rv{V!=@(<QmE
zDYAQgpO|#&{nRgp3U5l*wwT&%W!^f$F(t+6)ECa;+)q|Tdt>s{yh_jJMLX?OuPf4B
zYjo`)Gt)G-O^cVk|In{w$68&<H1GM79+!KobqqK7|D42B$Z1@8Wr>D=IIGvr)k>46
zg*=tIvCE}H{mHJLf@KD`_)EW-o1L`CStO#&@z*!IN#(o8+XVART8BLtZt8^DuDbq`
z_nV@dduGU#3sdhU31)v&o_8p0|G@}l!@F8W(>?1{IKI5ywL^eu;;K!DkJWs-9sl3T
zVs68)YpWuyq?rmeIxnX@lG^q0?IF&MP6h95+#i|FIIff>bcVy~=`_cl#QIIvtKY_l
ze&4w8#KPYfR9{QpnRi2!cdB96%@anuPnZ<&7qdsZe=5sRxn1i2>}HSck(XlE_Itg)
zyr>~(*6tm@4+=cHn4+GmCZC-W>r%qE@#3tUok6B+YClac-sk3|zeFlk<zbv3pYg>-
zK9gOS$(ajY=IRYPzrt6D>ow0yN0miQAIdiG`Qcbl_4m!zqQ9%t+A}RrFPeR+V1|)N
zf2jW>D>sH@A!FvQOY$w<4}Hq7NT~21{~B*|_(9Oc#~CxPc-uT}6%#Yp&HAqKf!Amc
zud8Q3Ur&Ey?Eb0ieAlJ9WVTHGY`KbW>U#49!rR2yLs~NA=ZI(DKOX4RGS_+g)$5f$
zCJWk`W**nH{Sp2;EA-mTNzthS(*nOd`)zD`Oyy`t`O{y&+SCqQ|1Wi-SLWOS7b}VQ
zrjk_+s_nvWEZSmAepugM7RJlvTD@|@yemuGSQ~kcd!7saSJ3gU?1j^J&rOF67j5!j
zKj*yF;&o2`<{6JPMQ`3%7R4_sEH-D+tXC486{j>Tj{TPI-P6H0xyrWPmYIEJyK4CK
z_}It~EUntF4ZVui=zcNd^qa?VqhTW#+u^t6uQ#pV_1&c)^TM%)d}rokle6A^2ywc9
zVxtVZ1KYjd92(zF?Z2*Ycgo}0`89Uj8hn9w>o><Sn%s^MWDYgBxa4wj;$=fwA?Ejb
zM~_HtefjRPV#(tdOK!M$HoxXwao<B)iA$#?N`CRb*}lv!l0StixOE#^9AggIoD^4>
z+B=bT=7Q)KEctUS(gYVay|mn+KjrzwlFKO)1(TY)F6eN*e=c>zVe^#2P3tfCyS49<
z*}t%Kvsv&r&BX;AhhHRc8^s)RIeCsnRk(4v8<*?4ZHd8E*4F=O=CG`3Fts&vFa7q+
zGRnA-A$;d~(|de77U^_s7hgSPP3Lu1$wXeAJB>$o`gXPDn;IVS{Ie?M=-NFyQl3p|
z-aX;dW`m8(m;QM3;_vCRoA*?$U-aH^(qWrJcNVQ*&DiW5@$l!ViippRi{$k`Zu>YZ
zWUYw3`(8uW%cifmGnuD!Z(4C&;pl^kYucjB%ML{ZyErDjh_^9Y-l+f0D5yNqWlxmA
z$`*enEA;^1rFt1J&s}R^xcx?q?`wy0uH(enJpI#`Y)~p-tkyar*dz8SKhW;nnY<Ng
z3_p@*9XOuEB;U=s#md)^Eg@QMp`W|Rj-GESK3tb8IPaVMbKiKNBm20zwVz4b$%Ufr
zvc4C8UHS7+bc?5BfZC<n;~YjOM7ystIVGLHb3(RMBD93l$%iX1#jSnTyT8{H{yhC%
zWwFDD?|)&@kN+{UvHR-(|9G|kVf+tcnR-oz+KuT6dk$)Hi3zq@eo=kYD$uH3xj)MH
z@%O9S-%kwxn7txyk*e+YFc!lN`HP>hzu)<>G(zH<dw=ykzn@!X8ZpbP>y;05nBx?j
zB;~Pq`QmF2Eq!VO+Wvn?cvXGs#QF4%W|Llq&#H|3@mc7b(wuOmBXPP-i{}2{axQWG
zoN1YsQ`l!0FPT}rOk~NqTO~fMyepgg`jgY&?z|$9@3U9j!^U@KzaxvU)X%Akk6X^1
zxNym1)d8OCa+9piJnR&G^tnXmSiQ*I!s+i`a@*`N*Ed?)<bT3CbCXl+3hCcZlX*Ml
z_+EN8d1+Ic?t(p*g5@gjqEGjnV|ZdP)Be;Awb?!$tek=pTxD(>y(XNWv#^o#r1GI@
zX=`u3pUAw?&0BQJ^b_w@U3*jyuTD~XwEE%tT`uv3o1*n3OxSj94)fCQlw4UU5Zs>`
zm@+>vWdq;Bf5+qeHovesp3(6lt?AIO-x2<Ye&2BT?$k2dh`+uudQIE(KHDGmbDAZ7
zRBX^#-@kp;+bti$*UggR$aITg?W~hvuUgP#$-kgDK=6i3b*+bjyYb@WE_=CWb1c_M
zf7JM<mbc2+qlYO|uy9-EC!YOJSfhm;!>?<eoR^`z{eeUOkuC1&pBW@fLRP(&nYzt|
z^?}T(OD%lrH?w1k6V`d88CJOSIv4X?y47`Vja0Kz-HC7(ha;IRn)w?a{QI$K$~?87
zr8?~fnWq@f-IcI<<QL!;A^Mk9yk&~@zmmidtJjL!zqX!VIVmo1i=z3pM$yNYwBDCB
zY+3Q)|AME5f2Qv_mi^~5TgBE(E`i%#F=e)H*c-*o%DYB%@2Zxjs%55~GMfSd-Ywp-
z^k`*G`qv+Er|K>~%q&q)|9;Pm@v$z;*<br=98bLx2)l83&6GbsQvU4z7_9OxBOvIg
z+T=CskGh<9dlowL#&qYGjbgj}4rjdnb<0(E(h4uZTa1D1b|Dsq`z`B?>ONilp>01c
zBA@a4jb)23=+1A;nRjiQz38l<fAVV=W<9lzIvTff_qJ;%zUpo3)w;QDs$ShQ7t0e2
z3b&GzqxVfe^08CA`QhJtX7BITHZDE6OY>^z^n$p+g{B)r%K{|x+rRtF;V>2`TP~e+
zbK$jZReKnW{HDj`^|*FaXuOJMaLAasMx*w~$9GTc#GYSHnOSqlVvc-P{K6&DAI=my
zdy5922v4cA57_FSV(!E!_FiPgZ}<KH){iHSNhc}`TsRnY>w4Ilg};ivzF4<a&SLXY
z!<0!IFIglQq#stS-RR7h`}d1W%wFCz39ZdDLM|&gEh~&n%8dK4S>DqxbK}IC>5B?Q
z0$GyXi{A=*i*f$)Qsk6fAS1%)EA}N~K@CsKd(|S>75n3L8XhdH-1%iyldQjA=!>6G
zpVzkM_&q6;=!?~v@MppLn5W{#GyR+R=5T(Ah_jCPzW>wW=gu!zeBCE1Y$~zs#gg7U
z$#qdhO+1S^_wCPId3X8e=}IQr-?Z8{2Sv7Oym|1Wrta@9uamdDN=`=>N!j(?@wj7n
z!-`v(Yg2(t_Y}#Je$B#FM_mHG2H%k~d+1zt=}EyalaocJH-x9hc`3|zYs>Im-@wLj
zVVw<6$o0ETMWx*96HB>H*Tzjh_k(GJ|N0}biT!n+3+CDe7o;z-yTkQGQi^?><DUt+
z44k}nwOo%|i<NestGU(NYW=?9$<79s1K0Ie3%)5^CL#Oj;wP!Nuod32o$I@nMjr65
zbG(10cm`*WxMJKw)n1Jk9Ud>D7S5U%a7=mr`-ywMn~F?xKW}YxVSn)4z5Q(EVdd`=
z&F`I*yD!YU*Z6mtzTTrWk5kR3m8W@_Iy!Dtbz#cj+0)wg)#*?0#X5=4hi9x>HqrlL
zpR4gP88(?i1-rf1?&zDp?!lz{bN_yQ`dK+~TjA`PcIpjtmUPOVl=xecZE&<Rb@KfD
z=!8eU9Lr2Q|Mgvb|2jqa(Rc5|Oy={x$*ox^V*S0wG2rZh+#peja;v)5Z6YS!J09(L
z(0|lvag56HrYZAQ&Qc2s-f<>!{Z;$rvp42dZO{AUDzEj2@ATItr3XSE6*&J9-`K^p
znMGN=;mFdA3^&8ob2hwj4qftx>&T29Px#cLMXvfXF}LMKS={`!jbpO2M3b9QzR|wd
ztd0hUsxL@iS(G-jlChPmvG)j1FZWWvf<$lEHkqZ>&cgkCx|w!@GP5NOlQl%umZu8_
zuFjrm)b{&>+3dyg`lr_)V4pNM&X#ZHI*EgoKdfgjw*C3`eO)qxO{(w;)9m{O0?~~f
zXLNQ?i0l8=IDMJn{{Lr#gCpd5%0z1&WvV`jq~1TV;qK)5a~FC#&gxkA$!Yr<C1w|4
zZg0uin|K+gm37_my3^+7s-LhjF@0B}(wDt4T`?W&GZ+^BHnLOMyo~F6ns9vYq4Ks>
zXCEG(t?+qu<g_zonMWT_3g5gk+bO#vYwM(ItxtEPO38`XrM!8gtFveQLq3!1kG5~#
zzWw{&MaKohtbH7OZvRnE{>}d2VBk#;eU?2NKmC+QzQmj?;8ww$dtF*0&|&(f#aim$
ztVGz~cU9k3x-whJme<OZXPfCo)vt>C9(iZ4dnaRXWBtb*-sfG{x9)aGPc&tb`QrK@
z{~>olBwwn5Mz;UF6&_-T`#1Lg5a+t|{rHE)UaQVN{!rt2U-46shpc{kh~ceczqBsu
z7Cf$hZ@);OFvF(s&+COHQymX+m6*D2?lvrn7IEjboN~P0s{Ze*ko(t?zS(TiTks;w
z?pn9)jiy&;IwDsIY%{a&x;IPwVr$Z-8||IWmx^=06|mjo$kqBOcc<^K)3f(Z_YNGM
z+&6Ja#*w*}r2(S%&#w5vn3g~7Vs87YM)q=sV&nVD=YRgTK67#N@r$0<-yA+Q@j-~6
z?*U$}*^TPkHYrKQu}<{jX9#|*utwsf-cgwypH|y!uwMP;nfU8VbtOi#T{R!n?(B)1
zw^!lq{Byj`QF6QVPfB{P$XpsLx^8dP*Jme<*v+`Klr+|<NGNs&Pe~Lnv{ea=bhBQu
zRdMllwUzb^`&i%Hd$J_!Zr?<iQ2&`N295Vle*fsPJuRw!`?iHLQ6Js=lRnRwJ|it|
z`t!9$6K6&kHr{!-{Ku)Hy7y=Q{E6Gu8Ncfw=T1pW{k4A>r#4;Vzf&jsAweYMaahi6
z&1LK5?r1wN*?C8^xzlh@0ejm0nTZqM-V(l7wC~iRq?Db0o)M=vi};<({IK9izsa4)
zby62?eq{OIwY+JXD;ap-ZKFY=<WrA3@{3(1t+vT<zgH|ws+m7gV#(7j9kFFuW+#m=
zyKg*c7yW(l?CuRGZ@MQ&-TKqq(3vt{wv1Pq*{oBDbKZ|7nKtGNqh|RF>z9cHoRgAl
z(K)VYYs)+9xm%ywwI^#fG^qT{?ekK+wsG|#Rfem#9rtXMNmzStm-_Sg|G%y;esO$u
zuR&_V%Ojafy6t9c4_-9IhOwydh05P+R(}_y&)K)jz<vF1?V781j8BJkb1N+F5UkGG
zraSfNv(3g4_x#s+G|gWiYFZ||L;cO7jE-L#e;+a@IE8Um>OQMu*bo&GdrZjV(TWvY
z3sSBbH><eZV_(7Pa6|0gk%DKN*(c42JG?B?qiOAT?(>>k)vY8f|GLgdGRZJ&Zenmd
zt9<L4PskqA&G&b0citI%j7?&87V9&`2r*N}m%CO)PW4Dkw`od9l)fc!Fl0r}M~4t$
zh4w}ECG*uw5>`$A^5NUEm=nKQ&F{o1=q++^o_S-|k6g=@&&>-0&K@}|z$ex0&gbE~
z#J_CKimq63SEY!A535eh$@Vg|lV&krlvDD8V@K>3)(M9h*8eO}^L?h>eV}TEUZ;b-
z)$d7#-&ALpO7-oSc476t{Y&o^q$qCMcC5j+Bu`2Bo8oN`y?a~kOj$Fp$td8M^&{Qa
zSEp3p2zX{B^ijd&#QPV1lm0yKm5f@rJN)7aC(~JqH_|MgNhI7BzL+O#6}SAs!)a$P
z_?)$fV&N70k}EFclM*Q4x?*3i+Mz!SHe?wsxa}b&!rt|)c!I?(Z^rjp4h>I&cw8j)
zpRzM?EV^^PFJu08gRPs@bhS6iOV$Qk>R$ZQEi9Q`H?yF3DQ{oUREx-q-xlkrdq$j4
zXquQ*%e1&lVZBmuwBh;n*F((`S&Iyd7jPQvkre3iwwlYl;#nr=L;jg2oazUJC0n>!
z+JzICpU${i;#&T7{i^D7@2pc7pFFFzS^dz?%mW%8D~`l1P|=i3d3;DpKKjIxfI`3U
zXVyxR6HX>=()*N_oOs)#=jaT^*_%GUeqhph)JiP=Sh0Ciafha0-ft$on?ItaFIi|M
zu`J0lHis=PzW1ZG+_w_f<QX{=cUs6;2pxMmS(_){E^f;9$fs|ZuW&!SwaP(Q-!HDV
z-p<mtvedBh`>QvP?Dq=K%<4!8)_Z*Uex+ZD6~kj8=^awROY~n(7hP1@I8%WCV&B!z
zb=wS&aP1dZ;yLN)(K=ble@RAGA2b$S*`DDR>wRXG`$YHK<sGY}TwAuJ32+|fu#%B+
zl=Qj%%i{9e&nafBeY*||ww~eKP_xA%cJ`-9N3QTqT*-a>{7jzugl5OPGS?Cl@*aFo
zIKrJ>_NZQ5<=LB?<{twc`hUMySY<lnz@yn0qL~z}>yE@f{_w~9=ANcBy_f8(ls5UV
znAAD(et-0wHA#D4g@}GTQNO3!Z{?|{-D?$&{7U+}O-W8_tH?Ir#b4I{R!}SHKD1?H
zKj+n#OXqk7&n{ZK<;TCGTSo8gCR|K9CKW$}$4i_m)XammHB4#Z^o6q~oV&0>wD&LD
zjb9z&)eD~ANtw91#3*)(rdno0U0@koVEvKXhZdb*RdQifxxJOB;i=MS*+m^Yzgiz^
zee5poYH#uNFo)c{X{&patKWw%aXnanEhA{fJ)a4oGgL0`iuus}Y}q!e^f?>nF?IKf
z7I0=H-Z>oZyKeu*D{9PZmXv<-<_JwYv*hxXJfpmafhLagd9L-b>G_<|T~!cd8OU}j
z+WPVgmi;N;=e^qdGpRd<o$Kaq;R#=Y6f_D=i@I{J8|*!C_H09}r0=5l&-st=bLa?4
z=18f?-3VzEpJvl6FFn(8mXmb;33si#9#Iv?-psb}^SpnvHTzPzcYy}0i~!4#{j*Hg
z?L3)s_)Nc6`kSD&52lK&S(~}}(66GC40m_%=zJ-wh?DI;bA!F2!aLTgV)I_#)qghh
zZgni>%31Yq4R81bNjZ~j<*V91{+)VK(w9^8+*t0e`x(CH#~1xjIM4K6U<23A^oBJO
z7Az$nA1FHLPB>L!z4YA;f19<x5;)#y=>-+rJmP<}&U4LtrNXea8)Tye`q&btnm^Za
zxx~pJRMK{{`@p2M67G|eUpJcge^pEfOJr5c+G4aoJJc(Fajt^#i>K|=UeEhg68cpB
z=B{mrCWovJ>dc=xMZRYLj<VbZ3px2y^Dl0H84@rvlw0||o$rbrPIEu3F1^SW6SrVi
zl3R3zxz@)irWs`$%mQz0I4ge6R#sd$#OdCaj@{-j+AsVqliJ*}x<DuL^q*Y$l*xNe
zPImprZ+7j7O3b<$huT$?-kS+N6<S#B_+m<E|F?4oq>Vq9bz4ik*?;Nw=|`1ezsvr8
ztGZ?`VI6ejT#&@YLg9qg2#eX?cX_3j&b%b+dPXSl)QfAf>!-Jzx}w1NJLlZ0HQts5
zydj|tH>Aa`uhHGz*L$qqt7+!iD-HkWh2(O`IP}Nx75IdeXE;61`oyG`Y<;l*vQ@?P
z%R5iMmc6|q|8wQ$V&jn2?%v0WqOOZgQn}J{RHDsG(<(94@Q*;X*&^k)Htrkc1CRF1
zSGe=q?a(vj$aNEz`drWsSE$Wwd2~KIHFx=(nyR=BGm<NUQ@yr`6!^){my=m>Z}W8%
z&2|5K^ArMRF5Hv%R>CMqIy=TR<Ls(k2^y>a%u+kBBl5!IO{RC}?t1CYm}TUw<>MPE
zzGv>@iFHTVEJPU>U+-8Ko4(+<Smc)-ckeB(QgjMg{Z4tOLVeAasy>4kVQ1THrikiv
z&YQcRVWm8C^k3CT73U>4!#eoeGoEhkNN!R~R`BZ!IkPV~#E?PmMQLCz>v@~gVO#zN
zT|dpB$Tn@7>)yCcjzVF6FRL1aCmjqv<I&Sprn{+ffs@HeZuS|iJCt1;dc7GJ{6BOv
zFSbVGRJ7{N1NZi9m1WPd;d!Z|d_VH|e3kQ&y?R}#UxcTh3*h=`u{6NP_SyUCuawIZ
z7J0G#dTDg2ESzb3#-}_Dm#DpU<@XMiI&$%y>)jgt_-Y%^gfkO&Up>2k+vLRZh$F`y
z`d?A$(oZ#YOj3x^wc%6ch+nGrXhNj7Ln&W>;tSOm&$#Apj9jhr@Sw$+CoacWyq>e>
zcWm%ib4oD2+<L9%_hJ{{kGEIn-C~XqXgT0pzUp3b=$$2Z&E`&?p6s&r;psggc01>6
zekuFaKWAb>{jRsddyXo^b+^BCb@5!K<h4w~M^m3?cX8?FcB#5~26hT1JxS3GJ_eJ7
z-8Yw+f0xkzd^bTLgi-%-LG6p<GnksLIhkLqdj7;xDa(UVa>hMXk-45_f}tPQ1Ya_3
zfBZEo^=|!70S#7;n$A=&&Baw;e805t${KbRzj2Jbc3tG>7r(~c>5FU6i5xk${QVb`
z>k<pwf;0<zs~e=hE$m@fRmsb3{n}55;T_kWUeQ1OpY$fXZCa7xeEfq$d1?dCFDCV?
z3TpKhTl`xVTKwK~@N@W_7mkk|j#b~>$MK}FdUE%Ye&gGxPu%#o@tGO>^?P}TKIf%=
zs0?C%W;kDqm96Y*$KqM(Ti+O;n|=G4g;l1EcJU^5$MstU*+0)sJ@EeG)IIlYrM7G-
zF?kkSetzj+m(w}g4(>11taB1C3SKhrTKmjRb*Jc)Rr`;!)kWp4+o>6<n$fm=h0aqU
zZn>GqT=%5By6yPLT{t53#TjPq+g9qAqk5{`#iu`rxiQyaxAaB!i)ZxCEq$2!UPi<)
zVByh(v<=CIPc&B?Xm`8L6=$(_Mbrsf<MhDC*#}d0EUjV@TO?*1ssG^8-w8XpeE-<F
zZDR|QnHz5@CVnyAPkwq(P0x{iEbg%!!W%Yn2`V?)u`XD@NocZirY=YHZ-vYqXN!9F
zXq*vU#3)npQbX!|ew&Z724hUIb0+%<QALJ%p4Q7A7|&3>uWFHSaOJZT3dt`X|MWTO
zBU3Takn`n2?^92D16`*bJ9cot|HGgY6|;|sKk`k9(eWx!U!^y>cfqbX(-ot&B#bZf
z`F@NNV|D+?A#Lswv^`&MZR$O)m8z{TZngA_bN$nLH(PKAkJx&f;!qj!Yne}TJaZW)
zH%~QtTW>7(Ab*kmo1Lqz_53mub~)UOo$@p*XX1CUOM2(p>{y~^inVewZ4jN8qB6PT
z29wNf)9*K89A`*8Ymk+RnJ|YX>BtJ_;?kTmv+pigJu!^!R-faHmA(7ce7vEvmPt=m
z=kI2}Wm+=F51&4)9)2lbhrgw%FTGG9w59vBTXdAq3ga)+Cv8^kbGhVm=<$SY@z)gA
z@;ugM`+n%sxlfDar(NKySiP{Z-$zSuUPb-X+zZe6TDR(_Z`%2jX|a*`A`Rb))iG-M
zX1!A<99r$h6a3)weZEsO4Yz)>4G8>n<?W6=1to_Tr5(6(jVXgI=&<0E&u1T8np&n8
zdZXf7fT+pb=BJe!mkS@79H>@%vRy-GM!}Jb4{H-H6^fi=Sht5E;DwBn+7+J2nQpVs
z=x2!+1+mQ9v(aPat3#_rxb>Z`JU=3Apt|k3{?&53g+B|`t&9E!8r)}!wLDjHVo^i*
zl+8Xu8=qzNv%c8OVe>WdZQDy*)n6x4Vmuhjj+n1Jwz6k)^?e3yrQHiPMc9m7(k3sK
zDUqpDwrSOz(80K3&S4Rc+9Z?c#qqjj+wbWtm&oruG<|VIOW}o$x{^z?L#HZm=$k$K
zS9|{7u5DA&i#c0GelN*7d_^hx&=kwkB`Q*#!jp@YH&#bPg>|g&yYQ^)|F3@;Z@J>^
zJZpD)-Foz!>tXCt&G%PKN*#qfHGDK?FSy+!yw2ohhsTD}2OXAI#b$3^Xr*Lt?X@kY
zd4}ZN6+4tZ@A;%~l6C*t6P;o#FGY0s&h<F9rosLHT!!PCN3sQ3+k<4Ev#Qr0TkXNK
zwCm%Kr>Yk_X2$H%EjgewQFPJ0;9@J$@?fr(C7Pd<j=z2L_Ucjj*-sDU_;G7(b$WGZ
zm4N+s2eVh7PFY==t1!Xt{$;;oM%^u*dp#VEFOp1h_s{0L88l(L#lhJJwQq?}Dq_nQ
z7n482zum7Uf8LJdRd<zw-qbb}E!q2>|7yvW7sAc*S1NM8U;Od3M9n&%S1@GH*^XW3
zk6+sHyXlo<Lu_qDvYzng1d+r3{tG?pnhst5cAGhQy|v-~jDwvAR=NgyTnJaW>-W7!
zdU~^N_ty=joNLx^_j`6?o7R1%(_0S*m7dyh`)cOzi<WMZ;*mji31U63eT0jGS`&qG
zOKxaA*GoL!pFBk=SMqh58=J?~tx>L19UY|fk}N70$9(8pby@RP(W}y@CMLUQNPMsT
zv|8~(RwsX-@tZ4R0)1c3l!nYtIjA>rr~i75y>pA-M7;g5_4x@#v!LSq6Hl)>$w=S7
z?UbAumhTjPeA>hdCk~&P*xRu9z_)^^qRnqKeQdNBP2Rk}Pos=+`AQZwp}(7z!&IL)
zRl3AX{c(URa`lZgmBsQZ6MJNvlA0MjeKv*0eRs&P*0kFg#;|FH>Xy2{IahP`7u7DA
z&Az@MZ^hDe2e|lJ>S}*3XNXtfI_w?6IP=_P^?BA$JWSp+uv(OD5Qu0y=$;U%rhhK(
z@6VsNCHVY5KGJgNc6#l-^g`ZrRi-OhCl$(9EaZs%D0edDd|Pdv&$7KUWS*Q*<#*d4
zp?sj0-`-=3{lu#Fw`>~A)-T{xj9vSv?p^QNxfXM}e@{MqY?I^}JIDJOyW@h4!*5q_
zk)OLx`;2-cqgvp9y%}HoE6b!$et73_^6eHbk5^CEZgwloFj}#C;kp^j4eVAwF0MZ$
z`M;^Tz02y!p3`58Lgcq@?GZQ<z{}q!7QXkN{Korze|3NCoM0IyFiDs*#(raSlSHt>
zgbab?J*DTAX3NREkeC0u-Y#!nQnkk0lv5pz3*Q}0I(^#ef7uS!xa<w;M;K(EzPvyG
zPu-s{<sa_n&;OIXejVH2g6(rXqnVh$#2@lw{{Amvo5cR_>?$Hp-(IXgl*iX4Ru+6q
z?Fo;-rg`O;w?vn)E%x=jA;=Ryd1_?dag)O}T(4MLUzKhBx7y|}!+MuvzK5MyH`nx}
zdkXJ%b(P-db9>oJ-<JHgi&p|%kN4i+zdWXM<8{>uZsi%r%9vl?p2GF@*vFPkp|1^@
z&$h(M-<|d0)uElUv_!c)Zw8b+P}=yEot@RAkiFYuZ_To@E0(uDrC*iYv-RtPy=hky
z|DCa$ebP+h#K(>0B~}-6zFx6Dv66ZDOC^cYkRvY9tS!e`@7Wc;{J6*`t$FI%btm)^
z9W6FIVToMCKK13*$+y4F>#z&B6L^zrL5HEW^@pru%YsiB8*OjPJY9Kc+UsTS#5OAx
zE)%~pZL!w+Wl!g4Iwx&;t8I2Ds3x;PS@cuZv5#&gTefLA3w+v@=)C<`%9gqJRF0Y+
zubg~Mk<CQQTZ}Q|Uw`_<;)lLmEX;G?%sgr-z4=fXThhm;;o;8NcE`P<ZJycj^UQiB
z;@T!ER%O{yX!UraXZyAjdQ#C`sY^@et=#RprFx6#{@wReJ-<E`n<ckthgOSHRho+)
z_k|}5O{*uz=I5mvC(V1m&2;PAO`rZHMjy6madYvTY!a(~{e=F)D~q=Awe_y)yeQkT
zj=w&wMIlk$XUWXepEh;QEH+lz4VJU?Hl6PN$hvE{(c+IxhgYg{KfCB2wP)upqZIZ{
zGEt$Px1K0CDgQh$W%CRFhDoo=V_fgNU2vp#C0FZ9KLyFn3Yw;uh4%1Ebo^nN{lfp`
z@s{G9-jh$r_|MjeRVh8I%agk*;Kc5isxz-zgf!}lZsm15T^eKI)h}A0G3CH9&YPQ)
ze<=3E>^5D}ciUG(aq*jyS<@z*5bgZ2Ln7{*i9kfz<aBP&Q|>x5tU`+0#YCUw<hoD0
za^wEf?K_Ufn!Bj3{lz%9W14L%%hluYQ^M{9)oMm%{Wv{4ZhPBw=eP;XuKgQlBp&|t
zU{#1>WS)5RX5G#ilczbkmiq9g$0mGoUUa5we#p@h>3!AAeJb}8LtR#hOyyy{{#5G3
z)R4uAb>He!LOnZYyYj^(Fi-fy5c+*xNiXLq_aj{G=d4S(T9}W$Ji(dC#H;5~VAp%f
zA^x<@I>oPMeKAiyA5EBgTj_PASX}HSW}zuH7D5|(l|4ER<*6K7AYI|Xw9V#J?VKkT
zckgDrmHSxX*=3h@X*Juv<)?23xQ70lq4TD1Wy*X#mCIG9U5_Q)WRBN8;+=U{<>tjo
zN!OVH#TWK+s+}#0s4QOk$lQKU-Pier96TbEr|oaNGB11TA|t!n^16?|o<8~V_4IW0
z_46_hy}r-5<@zj}>VL=9+?@T}aJpO5^6ZTQo4K8(ZqyjGCV&0XXLE6$^yBlp7N*@c
zn{xH_TI;N|cN%L`W6oV@vR}D%mf=d*s9SG@b5=d&DV`^7=hd;t!HeVk#~b%zWlscK
zs1|!QXJoCmDtx_e;;wrizs+qwcGIKJlu4m`?ZxnA<tpYXE)VX`p3%Id+-IYx?uj2i
ziVvh6b+<J9Q2PCs{N}8vYhLBuep{a&>f3eDJMXcGn$@D)K4129vCZL`@#X`E{37dh
zCH8M_9b^+wj)<C&@!;fhVZO)*H!K6x9~HG8=`=j8zGc<A>VHW_uNQM|o?^NvP+DYG
z>>3M~f6hWb+HM!E>FtTo+O+dpf~L*GX(DVcA9rsSmoW10wRTy_%EltXDkY-U{8WS~
z<l2HCE3_w`vhXrlclFzq*kCr7SBy%0aTm6F_I;9gFnQBjk!9D{6z#fxA!*sif-{AJ
z?5m2M&r~W*SpR%)mb-!o^Y<dJGi!hF#%0I~x2<QfExXR8y)4`*zVt%s1m%@4wkzG%
zvv#a1egFSM`#M_*rsNzq$u^yRpSkYM-Z$ZUVZ&*oriU#NI<kT40_VKWPq)cFG+FXN
z%!yOit(xy_4&Nn{m?p#Xb`jInXS`3_wY@5z`}S+Fbz2;}`{na*r$y5_9_G%Tx2D}t
zttYedWOv~GB+VyLGA|nU%=pfFjOXC&1*d<fwEREFSHbYUQ~vdt|I0tKd~=s?n9MHQ
z@XcMW-OluF{iB!0!8>$!zhcgvsl;^hV$p4JZy{lsx*KksoO&LHYh7QgNxpo(@=w?j
zE|=)~E;DUjhc&YG>giAH-nHDTi}>>>$%lRYzt6(e_MEHlIQjh9(5XCM%)_tx`|F^o
zcdv3q_-tMKXWhNmVO7!5Tehjr-MXsTtK=r%tT)l&7dy%iWu5)Td#STH`leOr_XZ;s
z*`%ozOR}RrtT}UNuVd0$XSQsn9h+?C^@KckygS_@`@s>9S#Iq=!x=-Gf9{R`ym3b6
zg_z`teJ1H^XKvQ`8nY&7(F&)E(za=Vo0sf5YrB8Vw4+<!$(%heqH&}B?VD(Jd7W}j
zgH&CQe(q`AC$9T=x}-f@eN8K<DUVh1&4j*Hw-jCSp1-ed+-P@hnQ?_K(<Q#A2ism8
z?3!UdW7SswHTOJpS=n|(HP}{l$9npExB4sPMw)+p^1|H5dbh{isW*S6E3`&lf4HVl
zzr?JX%Rt?2QndjGyRfovxrKiDwW^5Y_p|vo^liEPE_3_V_U<=Up61re1m8#aaNqlX
z#nko)&m8;PhYp!3RM_8V`d{$zQ|s<ibGv11%I7w3ynm+Vm9^nt_2<FocfPc@uYWsd
zo^J4#!zmA1pPaXqX8HVlE+5O!%Fh>5SG@>m`Z4=)eE<A5iFxxTM<q{NHUHY>c~eTa
z-@JO@w_oA^OuOkDsvpE3pA%g&`Q1yGruWxwtIzWboU-T{m*EMq2CL=qSKgUFpJpMN
zyftj<oz2gmFXwpF^YF1v;Qd?KZ%%0++9fsD-bUxtVXehM8?%pIaTj~L&H3W=+mX6@
zYi>_ldQPjaN#~Rl;{x7V@8>T(emW>mQ9J$ZLrm&)_8?VXy>Q;Axy#%<+7!5z4zuma
zOG`->++F#5!*-{Lrfs2yt3RI4v{=1r6I0vfcUhI8jQ8tTbjN)?o?}_Mk4aU`!g<MC
zfzyuGkyHOJDcmR9{3~;b>Mw6!uGlw<R$CtbcMcG?|9z3OeTwd)%&;ZqGmhL2aDLZU
zaxF?iV#R{b{t^5pXG`a>Cxvp|<31Cs&%ab}sa@Tr#&glvue>_6tu?f@{^Qk9UDvNt
zUVrvvzsb0w`u~nw9TVrntHoS#K8jcWmYoz3D`dQSdC3whQTv1$Mkh3+7ie*BEqs%9
z?uy*99DZFZ8Hx1u-$H)0_Dx$7{p|VHmTQZn-CX=8rKCyadH;^g=}Ng7S>nAt?s6~F
zRg>SF^_wyTE!QY_X<PN1J)Nc7+G_UI%J-zq3XP|}sz-P2d3r#c&0y7)JJZ|*A}4ai
zJw40!eO7gMu{lTXA^j))+SBqL>sRd032nI$`@b+I)#9qbB=vhqIqw-~*42dRpSYsX
z7TI$(^u1x2*!1Q5uV}>W|9QT1$Go>^|L=&}cy*cX*O@;Xcb@EQ|I1{+v0UA*b(Y8R
zeGX@nB`+4A{;>EyXVctG%qwrjZmDK7Rw?iKofW=x)*T5Y(~PZpS$t)S{`hU2)njr(
zu{*18vC!Q`l{%s^%+K8}2Bn2D$Xsli{CnD!RhH@RRHFZ-Mw%b^e4a7N@uRP$u836c
zlLHG)CHOu1Z}93%^gmwx*5lK+pWn~N+tybXeXRL(ygXfh-q!=iw#3h9`?2<o)ZBC}
zulT$252yZ|eWbFqs`858%>2jtg{n#&@y|D^y*=aNyPUJPhd-y8@x+dnyS*1L6-fUG
zHEB34Ql@p-DOsDp+h)RD4i5>97pg`E=k1qD?#?^+xLYgTUU18+W3w*KZK~jRvGL!$
z@w9J5aGO2T`;E-gxrD5uAM_vC)3x!^_XDb72^ZF!^~>M%rP<8qweiC*SFXhx>ZE>X
zza~)Q{4VazYTgr%4dQ<#><V}4Z+!Oq#!M6GX}P-6d|RD9&dZ<7Wx4!dO~1LMoKViG
z?&t4iom*c9iFto#3v4vrt57Ykb3P)W{BhlRhu}}UH<_$s($n(MPq;pBZ=T_{d8<}#
z3}12jQI!=}f@^}Cqf3mq%&odb?q(aDdEKUNwOIH6`;0a-fx{o$&IIn0H+p6sTFJ{^
z{`dHiqTmUS-P;!U^*@$hDCw$xGxc6*jqhE%sECH|Iub9Xp5^V7dLvm-vSsUDf&cyy
z_fP)+J>|kP-TMkGjt`%<F10Y9xKQW0;JoyY7cMJ)HB1uxG&S*n(0jed5|SNGVa_uS
zXl!Vy6VsWx=Kx3l$+SiZ-#qon`*%Lx9J18tUB|_Fr&89PV${++9=!O${mK0&UG^G_
zx_n}@5Yc7Gmh@rzlv21#*Snze(bB}1skaLg)jm|@iTHm?I`qyt?EaTx>(&{8b_v~X
zy{Q|QPHAZN`k|jH`0Z|ovc@B>=^_tTSie2nys65evvZ@{fAQo!-OrP^$T;s`>u9sA
zlqbM#^X0c6moD8hn}wN4Fm0ymod#pKvVf>F1uk;JXB>Q=G+uR`dndL@E^=<M^rSZ1
z9df&O&wcLv)_SpZUFw43iRT;V1aX~bx7>DIe}4QNnR$DE@pX!E^rhdowcjtX|IfJv
z@v8*4DCg#`xP0UKtL2W<c`nCs3f2jH{S=jZe!_~otM+=mh~-soKD_P76oKQ0bG+O4
zCzoeO-mtzm*{SV>^kh9}iGwT?!kYw^$JKOYmvpcla1VUIr4n0s>dD#@4VSkyFzU;6
zoqMstz$f(#UtI3n`DcQZtRKyY+I{rC_%VeKH9|Uyf~k_1kKb9m#O~n5r5kdmeXws!
znh{^=`ot~&Aomwzo{Q1@cP%-0_?p_Cm8HeMXH=<uGB<TTv5d27*R;*0UMFQIXU#H~
zn4+n5?X+gwiuv5#(##zX=V%q(F1}%DyiE7hlWYqvqX~V9aUXqt>|VPxseF5Xq^c2j
z2gmz4eECzC$WO{XygSs__P+d_WBY1rE57&FnwIFdE1nJL5lPySw)@!9nZDez`rQlS
zm6!3v<i22X+$=m}QLnIVqL<~wKE7Gs*Y>YWeR=de^9-LYe!)LNulsKGyLd45gIns1
zck_%+JymoL`BBKc<<##dZ@)kP=%MR#UnA|JraRwe;f_TwrJ_DPUn-n@)bE5&h-;bC
zvv-fPL|!(ZwRzU$rn~jgy#+^qIUi^YwVFIzZ0@qk<qvt^NPD*Zb@SbQKrBWvuQ_gu
z)z%qx*Od=nY?x!LHNW1_Qv7OGN3G`s8M#wR?uHkvcU$vi?K&{qUt%`T@s}n)HLpnh
z%<QZ%pSOBPO~d=nL!r)HGa3#Se33Y0&?>Rf`u~C|5d-Cl2IfZ^w>FF3u2xRBJN%aA
z{U*IYY2FvoyA68Sm<wMV+8+1$M+ocDX`4Hby;qC5t|VhW_jhca&i?qDru!opZic*+
zn<WvpY3{~v-<Ir(n_OZ)<M?}*Hg{9KTkhpo|K5-k$cqv!yk2aT)^zDvRZO|(_B5@x
z|5bzXmS34QtNfdj)TSGDK2x?Wa$fGwlcKz$_eHGuO%n;j=mU+lvz7-PTDi^3i!C^@
z@|&7W;D&9zN>PU+?fy?$I_Kb3(~5$Ktv>=3T)&;%=krcpXLCBUQrYsW9naHcgFIKS
zE!w5O_Q^%jBX`u9OFcf-1=ybyJRB|jKcw_%Rk5tj4KuD8`I-D}ucFmH`_xJD_MA<&
zF5Av2{VhfJmyE*NAm4(Ed)@`TzH+nGU(T27)t+SnGp}#t2zS~rSK{ZPjDHcX>Z!-B
zsc2Mm=%ojD$CeqY@wi|AadV5!q886^yWs1|FLGQ;#3##oHm~WwFKAxUs#Fx@e`Q~q
zZ0MSaiMKecCv<$dCgk@)SES+dcAp<g!nKQJrbyZ8<W2c?=*^BLYaF(Rwrp)&v_`pB
zNQNbC{q+CW(mN%;-L89CzE+EWs`-lIsvnCVybwKqVd)Lyne2}*Bt3LKDH)s8w$iEQ
z!AT9<RWVP^k|%|)nfl_Jpv7(})s0f+-M5Q&t-GOl|4D+!EyMRpnLndMtG1muB5?7F
z<CHa<Lpd%rvMt?KlpbqtHo<3Yi<hIlxkKOKpot|5bYAjBFD~2}n<X7<_sp(uMdP%2
zQgtO#RW?Smj3Vuh3bL=S@^LjzG|A_#|2)C(X8+nR-C6wg^NL>;pI<0f&K`D7wo+6u
zW%t(yVcbhiuAGXP9j?E;KL7mF76Im0?7P%oPQR!UvNKs?p<nklkD{G6R)0)6e}1ug
zw`TdQ!uTI^n>;HbmfW$Mu=e4h{NFXFH5$w3KMrrY{q@h+Tdys0pGLnvuyuXapQQVH
z>#ToXK6$%AZd>es8H-IP8QjmyUKGjqz0JXsTAQ)c`2FG&$8{N4wKmOMTsYflc@g(Q
zi;xrI3({DQohd8%w?byM-ZhEU1;QDtGZ<vqZZd`_)cb^027H#V`1AeSw=3VxBfmLn
zPf$(Nem-$w)r!Tpb=DbWih7HCE1OkLF3c6R=`yUGeML!M=dL4YGEL(2v`I|C|8DGg
zxa8h1A&bsq7A#>KZ+x&2weSp*;lKVyy3~0A1M5?FBZkE%FaGIUpZst+>$#10rP-ge
zrX2gq^!;|WpG^5X*SVrP=51`br-}mmFH0XdaDn&c39InDe6Oiy$M)I?%gLN*5B7TT
zi1`)!lC})-?}d+K1^fa`b#6^s_sa6v>?Ir4=)Suz!aCt)7Kh(HZ@cUL4ZI6~O#k61
zBA{gaO}1Mojh*{(YFhkHsRfL4CqJkaRjR8vskx?^MOH7vdMEdj#Rj50hk7EqKN~G9
z^k{Q<bJ0w6ey-8#e7?9%>t3kN5!k?Psi(Vi?eW<y-=-gAwBdLa%FSwdT=CPsC!GD+
zuI?QhE*SMKGR&&Ym~8y^frI6w*MSe}8p<o&En2^a+1adloOY<CYSp9YDE2ckmmfS>
z#Atq+Hz@h5!Kq1K*j7p}jecrlp0U6E-l3~)E2g??O%U&1HuJ=f6&>91mPyiVy_^@t
zoP844&*_*mpJ#%SHD92st<@vJ#1E!Rk4!t;swv9%c?CDSiQwTYoNS_pS5`*&&O3L0
zC3kXd#MfH49RaIcX6vig-3traUB2>}rBdLuqV=0u=ZM~lST<Ari07&^j8mVsoO@&!
zbw~U`t<JN1W?|F#To&B={HH3m^9*-`G@l7$+eXfXEq<KV2XeiCJiT_hSGXs5{kD}?
zZrwB8zv`W(`l~6$lM{QCvz6Sg{D|dcotrJNMeFtA?d9yj*$dhF1gzvg@Yy}!?vQU#
zVA4<Yd~Le&NOrJ`lL)_TmYTrx3eI?;ms~yj`<e9hpNq`D=N#If71_a+pDJ~}Frwv4
zajJ1y@!8yscF*S~X>n>QGjiQ1`hVnhW#cv-q4S0JTZ<Z5D;SNR<_C(kpU87-zI=Q+
zJG*nKpNsu8S09gF$?8Hr=7KkWP9E95s${K-l+R|@N^3rz<+?MMb(>vqT5vaAD|5@0
zsmh|Wo|ZDPY>c_S&~zsE%Gn2k^-OwOl->#IXYEKn{Yy$!Wc$+>@3d7Ip6C^SXW4(x
zwzdAhZkOz_BmWj~KbB!wxT1mOT+65Ircb7my7MG9a-FeI+GPCTAOCS-p$K*1&Sg*L
zUND~2H%nyQk%q6qyn9;Jc_#bMu-$KyQ~sr}FRAB^|8vu~Q<Qt>X>_|X-`E#s@zN~n
z@ROGIH$}76@{JR&NM(v}&s-_MpQU|$*ZW!ZX>MDN-ea|pyp^`|%(}T}XJp&Rx+@eX
za<Q6}X&IGBxXJlic`Z2BUnDtW&xHod+$AX%=6`yZwerb%ax%y46xa4+%jSD(AkMxa
zN2kP5%AzoH&ZDlYU31%|U5?CLV$`6}V6-z;D*SQms-vHm9+WPdwr<NgCjT~0?Y-46
zR`x7@9b#bf>%*+P9kHv$Cr?Q`5EEOy?px;H?T0*{3aUBo4DhLI-I1y?aW#wbC&kZa
zjSt;?we%N@vu_q#&Bg$4&rP#j1d1=@OUSJ``cN_I{edePy}nbs-2eKnJj2ZvU43B2
zsW9`VbBd1BHB8-VXO_=dZRlaUkSR%6a87ZG{>gUd-6pf1N3ym^rA;w5>$H4)_c(X{
z;o=3|H49n%+ft5|d=cyqou#0as3Db*G^^CrZyMj4%xP*fHgWt=36a(`sXW7_;vlB7
zJm+oa^EUw*^Rg}}SRObdw?edsZ4>WR&0TscbMx*pUTvr`3`&}v(9im1Pub3z7oxTc
zzw@cgxw%Qf({JZOsZix2wx=zVwkVd0XLc^jJD>LHjGI^F^UXRDl`<3W|H$pzxl=P`
z?dxM)#ri&vQk;)S_m;<19Wc7e>&_sjxpOA_dq1N+S6(ksbMo2zCbZxHpGy9ZbrTXj
zyeHk1{jpQ_P^VMd#7CC{_1$N@+#K2@V|8rW+p><T&sx<-u55Q^@#^uLEW$DCEBo5&
zbIT(?DPKBJesR4Y`|G@_v~7#nw(d4};Wi9@ZGO-pm{s~H{~N*HH`}70a8$;9Y>{=(
zZ*bW+@j%H_!|le?cF8Kd@+(e^Gu-pf=EpLrh_$C5E^B0LU&^`beA{E!fJNtRntD1z
zndJ|ETOlQO;?1>P&x@rG9k#hNNm6|t^FHqXw^LWouitMt-O<ua<?TY7$zlsbb*?Uc
zJ2!E?P~^hov!>dqvTt);MYoIStgW0En`_0fEkD|^|K^rOF;hZsrmcARM67T5sy(th
zo-oPU{Bx3#-jL_?Y0F-#3DFZwV&kv6JU`j9N&oq>X{j?+U4402^rT{SCcfJuH1lNX
z47SG_$8yekc*jmXW49sw^`WT3hjQFJjwT;UEDvuqkCk}tw6!zMLx^!*lPharr#oAB
z=1HkbEGe&hFVv~<*eSnXb}T1gR%O&r@jE>J>oY?O7MMpGozBVG|FZi1qIdgUy<3*^
zTrgia?eF977xqf;Pc}Lu;d5-)3F(&;#TEqozS!?@asu<SC6*l=k-I#!iX;TBWjt3N
zjSJXWDAjQ65cATF>S;z38x1GbH17GPyYwdW45ib{m#d^1{5~}4`GhFul$L8UZ};id
zTsB$#>&3^%*%BwE=02U??<wxB`}z8D(00dPA1B}c|Lyy~&YUw^Y!5|^tGCWwaOcPM
zcs0KjyQA1A?b=r@k*2`lKSgt5@IQ@}t<xe_@Rw+_EVo?W7hzxMrWJQ3F;n-5gyx}x
z6F$4;{WVx<zI@7*Y0A}WK32%Evt3O-b$I*a14YF#&KvnNkC>F4VzBi8FsmwX8PjUZ
zZAGp>l?@Ng@zws=?0Ctz)PL<G*G0A0%`Xa1tJqUM-QQz%2j8-Pe%#{uoI)xW?r+<9
z`_}s9xqqv6Mem;%_w|vtVaCD-Udb!prSWdvY!>9#vCqExbXb(h+nZ-(XQi(=zoT$&
zvE1hgvWC@v>?-tQ+kb=zSFeA0=4R6#j-%xZcpt5QQQ%>y6)2Ie*|6=}nT03%HDn%z
z-WGiF+KlDrE@sE52~S?%oyc;m?nla>(3~R6^PAY#m#yErSS>Ya&RK_m%lz`Q?E~~Y
zmz<jL#ib%~Z9<acCWfzPKYY=h6jXjlEyq(tK&;)>?&Zht`L5-9xB9|f9bf)5DJ4tv
zZH-~jdaaV^yB#Zz)%Wa+7TVQcW)=O`MPd)v!WerViCs60%P$=F3Hef$vPJ9$>+g%7
zo1Cg9+FgoxrX~E$|8h>BIg`9|&$2e9&-^P*9&Iptbb`6Bv@J{WNtgcqe7l&G)1qqe
z`?@y$l<_@npLT%%b&AWyinGs)R>*GMV1L0=NpIiLRKa7bT&@Y-P~4Q(!0UG`PU%Ig
z1pB3lyB2O(uUKn%?&9+I+j#EWxZqg1aajj@+tg`MS>cshhIw+<(eHlvUE8@m=VywZ
zo7uY0kFzs&@6O%M&VF2O$F@y}R1eSZcSxJ<r(N-OirE9>Hw&*V5!-lQvC;L$n<=hm
z>Jqk``*&dW{_~sMTqlR6-}@~+=iRGMj>>YJ<^iTE);bM4u3g?D9h@|CN=?cN4yU{&
z3YODZ)errdUw(M`4i(wxkZ&TMXEaOWjx$=hmcD*@kn!G|myypKR=X8_znj}`bGfU%
zQE;;CDdY3(n}dzsaCxtPq#Yf7xp3mLJ83JFatkN6Z$G==O?*!3<*%job9qI3nU@@8
zXfK`i)4rqpHT%^y7nyf>=sY;8TlCYwIIYoR;$`--yJzayc0@ftRc75?G)qT9&wS;A
z1g4Lw21NxKIjqXYe_I~Bxc7zmZjltn730|7cBYNoN$G;U8E=!=7o@(QwfTOBoecY~
z)GeED)fml5*IPe9`)BdAwG(8P$OjZF-QRT7G9c0DnC8r;n|A$|vQAwnZs%PVke*U~
z&cVK^P$fe6r@((cpU%jo-yd7gI2Ev`d7ZL(h1jp>A5`nJH@<xP>C1wvS(e56p3iO8
zo<1t2%(bdP|L%9k+j+%px{NASb1r{l*&=`V6Z4<XuhZA}zqw&>zv^htqP2grE!S?X
zzr9E>RE)Q5!O@5dR;%@X|Fn<Y_<ho`!fW4sLKK+mH)o`pOc!;3?Hie%yR7Y8-^=uz
z6}4BlNlI5udU|48UDoCg$?hBPZjY4}(X)Q@k%{+Y;>qYuW-C10eq9v&Q=_K)Qbo<?
zm@Fq3Z@v4XMXzicHavJPbX-t@^%%piNz8ZuzExqguPxv3=ZlK+kDI+ywkR*&{<C6N
zf~RhCw(${_Pbc;YPHX=fyE9_S_KF_8Q?KWked@md_ucEm_v^n--N3u+>=t85yGK07
zWMXgaeV>)7;^@z%=EU5kU&itGKF>){uN`hZuP<>aJ#S5!Hh-ImS*7l?Oozj&xlz*{
zGp}&9&DFD$?%Cmfo3k%ulVj<>EN4z-uDYJf4o5$14vW=3UeL+=rQE3Iva_|o9LC#4
zB5E_Q*qw2+yVf^{cj3`s*(kovf;SrbPGkvO{9RglFQj3fQPvT`)GmID^d<|9LkCo~
zPVg)eId<6CSM}y8uKa6L>Le%bR4BY<B)-*OJE)26j>ZND)tK(>241r~xi)xo*}mdh
zpKOwrsaN$XD<E&ml#U`xiB1(g&N2<N`A#fa7uBQK*5-vjaS-I$uXD8Ok}msx<0bim
zt3CEwikH8Vb^N^MPG8%s#ChSSm)-T5RnEm`&S*OIu*~!Jj@cGLt9C_xVON-|efZie
zjwao$EqTe(yN_%$)a|pmQkbN1BIARh^<vv)CzsB8GtW|neXhycMD1S(cL*792X)Ke
zJE#;9^J0te;!CR=f2G<pZZ`Gb^`=ne_m;zkUY~W;E2W!PsVN&w{rv6HZeQ6tt7ZJ!
zuTzED5^wz5kR0@J^W!6zo|O2l3$Z@+u(#*aF}HO4uTk3S4L?GpHy#(f-=`EbJMclI
z)`{N}<TgdU4l$UZzJm4csz1J#yYHo`Hgc3jZr>`(V(1%{$h2jdj<_;U^z21xi?q}?
z^UCaXIq`SOrs#vwPaf;?{EXbjwRG0e8Fz2$<U4g{`?~c%s|{Ev7&7-P+Y#peMXsCX
zoSXFGa^RPfTh4X!^RxPB8|}||_ICH@?vtO>)5X)*$Io3n{ru(i^Zuw!tC@OH`P`ly
zn+bJyj=wpct6}u~`rTEY2@kb(3a=HMQHkWb`<UI#-Tz{}_NGshL}N>N_Z?gEw7va8
z!JA|Yo2k|t9ir_S(_e5s=Q%agibb+$>2-sJ=TzfNS04&bJ5zcoMc#eKi{(G=if!L8
z&m)xacLUe;zLqDu^>0cauUr1T>F=EzLf^PIPW$G3>#o_IpIiSjL|nSP=~uvdp@hU~
zl5RzIZY_mnlfpgoS3Z95ZjyP=4#PL64n9g$*tJM{{plIcy=QJ~tBb11ID9$#j?zSy
z-A`wwq{LXuE-bvus>8fleQW17iD^3<*52lLvmi$I4VSt1E9rgLBE(lLIyh&B=`9Nl
z<&HnjX$)Qq9~#Y?TG1bK`c`I=mHwg6qDm&K8j4;-Pd;CKS#|24_WQFMH>Wo6g#FoJ
zywOMF&20yJp>sv&njh{sbwW<ej4kSj&!d8%L%Rx_WlQ3mStV_)lRU+br}0Q1Un3hc
z>j`t4k>-g6lf|~j{zNprk<m)`Ii79u!Fm47D2uZyy&VAxZ~i&>>21ns+m>G`^witu
zd3H$H%<3Dbl4mxoSbO%|o4;>AExvWc_<-{6B^$Rsk=PwByjU=)MoqPC)@Q3r#%vYV
z?Kjq*aoVPKt@i3M*Si0|HNq~2DLq!*>ua`SWdN6os+(VR&nAgW)u$B-_$Bx5W!MoK
z`MgF+d-v>#-#)4r`>kcXm{{bb^KIWY<8Sw3Uuz#Ya42(L_5+q3LfLt%LabR?@+;Su
zmmYt<^ZTtgi;sMjx*z+wGI#U)FqO)?yUiRI>}I~+cTVR@Si$uhd;0!ptXy0hD}2uT
zl3JU^q4?*APVMvHOTDLVQ`CKHYwoWQ=|fDa3G<VyXPgOL@k6Y3?f1Zi+|Rx}u|B=#
zi&Ud$?0N&`s|?mz;g^hNy|5SGc;noj@2v})z1MD<)?WNm&$>@9Rjx?YnR(~Ek7mp6
zo6Y;a(JI&T^ycm>a#_djE@teoUgKL(d&qH(4P(5E{rd@1a!;r!t5o>jKANVzyt6b&
zSEHDVD_r2-wzDl;<7RWMu~oaXFKfnH_BA!94>dPgWpUMdNR`gf-^JwjN+)NR<KfR+
z7abFkX7W8CagbLa<E!&Tohdg8PVp6<N-F2`<?>&*CMQ+F$b|Xe%@Y#k%DetNm>rTj
zK|0~amJg1+57zDJUOp#addu`5_qIDt*}GITka4<Tpii~j_5Rlh;_iA(xl+o?*>l{Q
z>enxJ7V}ek+;L>Dl<vB;r5rX*hoYLMyWR9r>lPDrt*~E{<zXCW|J5iU!1DC@6VnyH
zOg>R<B<8PEuhIGB-jSdU<)$m!TAD3mdVbE-_;{>r{pZ9PiJiT>>O?2TX~d=ZHnlxW
zIhhmiwZ=^1*R~j4Hme(TZ!%vBsb{V8PMe_P>+qvOV(-hTE7G21?YY(SZ(GLorE-QV
zTtA<^x6QkDWzWsld65z<9cOMVlK-3(b}xu8!)JqK-#IS9Jl)0IN;6b`%$ymd;PGtA
z9fhRV%V*`KY&ufV&A%)4VUFA)Tantyev$G2|E*TvZyI>L^S0{t)qB_v&fZpVu5H<^
zEh<YyKelfBm2_&;LYACR{?F?xtbRr~pLD3LzwcnF+-37e>g74BCOOrK9c=aI%+4E5
z{;Oe?IZJE)y4gK->^nqyekH21ghhp1ndkM`aY0Jcp|0fyE%|+m)gRygr)`yWBVpkQ
z5w-c3(&SFayZ!R%?={qxn5pM^+l6`h^<5vXUzqSYbybL)|8<Gi6Y3ckycg=pf4Iil
z=LU=P!&ys?K3%_NkLdEAwZ1y(YXm>3iZ?dhF=+37B=@stEz6?KEd{#ie=j!2oN?t>
z*tCM(c`DD2!iypdRY#}XQkUz@sa@6e-gDKC9X|>R-M_x?e}Ba5&g`~+8P%P0JipA>
zpTu@9Em85nquHkm6tY7mE$0p4oAYkh+u$QD&J`6k;k(Lg!ltovTg-C%Jax^Mzd_cQ
z>#a4;KDlvY-Ut4mY9)yS*G};X&g{(j^4M_oq?mta)+Ner**TT7qv=W3!?w=7YqiDi
zE}gO3xKj9<m2Z|*&*a#Rt(zCN2eU1l`*q>Qdq+Ina?|{Ku3yOEIqrA%c%jkRXqSzW
z!T;x5rfm4LV6v?Cf(YKKPsfd&>#d#C`o1KsQ0*~D&|dwFdoPFMhJy@;@5o7cKK<<b
z#eCkJ7hm3<Jo@?M>dDj3_s8$wUGe!{6A%BtWp{4mOx@C!{B4uo&6!%d;v2rV%s2Zo
zd1dA~DceP_3QrtfdGAWeQtQPD^@secEzhpMUimotY1*_k7wbF~{0~HKmzMTtHfk()
z$bA=Tv3q8Md9<pOLu~y1luaH*%p80t+cNIepSdx$-sg+r0*0W~nR^dzU_9Ec(doyT
zedOfRX$Nma1RlJY_qE92l&;yOQ{AePaa;BtzU&cnz?OX$&q<YQLZ|flt{kl1qyD}p
z;Iv;{W<>}i*K$wC@)<Xi9y920-!%J@GOv4wZ)jcZ<rNFEw;y^x`|ryuf_mbIN`?RP
z34RaWbR^@@h5eP0?_9UHM6%TL%k^Yes7*N|ai=S<PHnZ;?C0|nDy7(!N^<l2l@8sT
z_WG!g(c0BEe-Ct}p1QU4cef&|hQKE|8=<q73WZ5eZm0Bby(T}org8H#z85y9Mc!L!
zU*4D$#h5sw&{w|uMrON&&D(&^eUE3S?Ytp==;K1GO8%!ZW$eAb7+p^Gueh{8P36DR
zwCn)K_q<^&b-YWpQ_gxnZD`(lBRI(N>XO$+oe~{fFH|~j`wM7h_;UPQbai7fpRctE
zU&SlGBNy2DcrQGWbe^_b(?w_3-9oF<PR0(MW;@R(7DD@uHhym5YYHr><n61LnG_d$
z&_nW+wP<p?*!cv`nVxf7dnYyZY<e<LwY+9cx>3RI_3^))O{O`#SXEKR!sfBJTZ5_F
zW=D%1OP-9##O;y0p4f@a>^Z8LWm5LE#B>R3Zo1e)X|d^E>KfaUHY)B5n^84sr{<of
zGaifhE*V}fY1G*vqic8N_r=ftBD)*ePH#Rm@4OSkdIz6-6CU}*=d&wLWO#0ulFfTN
z?6K?Y(!G}Do*r*~Hk?^;bo0@sCb8?Pe-k%y?l06y{$ncBb)kuW!uhA{=MJCr5D?K;
z30*P!$HvNp6?e0O-4)%VU3Gc$t%Ux?#Cho4nY&gr)7*FM&*h#kx9LBgcxeChc=?|`
zJar;VH(ozH=Uakpzm><S4X1UTf6ICAku@{knJ9gyXNC2Y&g0uwygg7~XukQtJNJ5#
znm&%s&h6Ls#BNYb`5d@;pGX;ZLCJY(u8*4-&n<U6-ItQcFu8{D<A)cE`+rY}&~2C-
zZeVYGXWzvKUmi3B{Is4X?(X9_V=8C%IctyEiZ2)bJlPVxF=Xno3Hg(%4(0Sr5lJ+8
z#>nP>*wgE;OIzQT)&)0r9ck{r=`@8$jKf~QiT8>0f?2B%x$oZG5VZ8^<!jIPm9uv7
zExdYJG1B(v_m0ek2X|fEH{puX`kA5allBHmR&w0+5V~^am+s^|@l&Nu-G>d2vq}^x
zKVBiydC<!6SL2tCQ>oJ#r$2Q27?!%RgJHEnmGQ#oLVis$H($sY3fwdkT(?4H5wnEp
zw{25bhHhuiwDSFazEN9!YpLDbXt9^)BVPJ6oqOB0dV#pumU(??DV)WNw|yz!a%)<@
z%l5ldX7A!!d8)9)kj-+5<dKwl8YRDfu^lULSUxwqz}i}6|CSSJ|E)`tE_6O+F!VdB
zbiVv#lp}}k9Q$`YZlcUqd(;)h4W$gk^O-idUba2r<MrqC{r%tNKienYiF$vttp9Cm
z_m(q1V?tjrug|Hz_waMho~OH|ckxIZQJ-ijs+9FB+V)D-nnN$|9GYk$?XE7tFVy@s
zwtumCH&5#qE$6*XZ`@CbXs5=m<nw*|@72L&zQ;s0TIJ>*{pOexIIrPvLvg>HU2u=J
z?`y4f{GpFtJ8LIpeCJI*9lKekrzw5MfA+J@(Q6f*)i)RV+&XcIZFlG@|7DC#$7UT6
zt7lK<{C#wNU<Om}#KRHg0ftW%p5>iNJYQj{bj(LOZ%b6q_PP&AUVOJXS}$(?Cg%Ju
zw^TH5*0JwGqP~-a%lyhN6m6g3K5cHp)fL;#)E;G7r@H^UzV6(q>wZ(WD*X7pg<WI+
zBv#`iR<p{@yyi`4^j*z!)1~X~zRp%hj@AjwSL^2-2|e}K>8DerBtwMEhHE#T@!p$n
zT4Iy3_VfCEE6q=z_xr88!tDKdZ|UZB79t@H4ChX5IjAs?Z+_JE7nu*HNOmh<EZDYz
zKRAQ$l-o1iy%o;_7dd3yOXhTtSe=r0MKN^Kb<1aE)hY+K2kP%$c+%s~_XEzWxBmQ4
z@g*>AU#a8L(=*?2d0unqjo4~-;LOc;i?Tl}@G~qvBp-3Rai{*NnTomw#(F|od_4}<
z?iaoP6;%a4%Y0V7lEd(+Z&+tjb48P6<^Lb=-W)X++5G6?QbvD|$od6yb~Wa$kThd*
z(#a}`(q7lP)4BS+#vPSt*9E1AU%sB6e=g3ZUV8htD!KcL4}PDN4coK7dD$`9$%cFS
zt#{oQI>%J4A8$D=aG~Bwy%x1YXL9uqt1NU~U6uIdYDHJF^tU%ZwD$g#zxeaV*_Zsw
z)B|c~pO==r%TRc?e5+K|-J3HPzDrT&XjpREt=uQGWk*5P$@gazw}ifxYd$F7cFDxp
zgvUao$ze;g@XmJG`Y+o=zSeEg7F3)YEuz)x>Tym?GoSZ&*R-qA5>ZixG3#=oRf=+7
z$wV&yqomC9#Y(00+Y2LgrpJE2i|W0fpEO+P^}3<p;o%Pw?CUamW^dm1v)ECK?dCN3
z{nvS%U6?aGi&tK`+^1U`k$!G2XUN2Z4h#!?OvD2cBRQU{DsNY<X-ra6-k*B>mFE$r
zhkw#-MB9G82x+M?N)x{k{a#Y7Vxr@gHR4KUT-JZK>IUn775`qf`yF@H_SN#8mQl{u
zfm5z-YQM9xbnc<IOuGekOnq26`GjL@lkJ7n58)54nThzgv+!rloH+aZjES@7r@Q4v
z8Od?3F>I@OEMBsKqcY_fTh7U<lR2ySRrkb4i?%)IsB`aCEM4gv$|bzb$1dSco&Bxl
zg?6*EMEA72JT3hBP~!1=X~qy<_K9;pUH-6SE5j!B&<WzJ@+Qn$xW6*=0_)|N`I|)o
zWHQg!IW50<%Js?TQ~v1-@<fU`CnT26X5&lRC6>Fp^sL=lrk}e*gw`}PM*Y6JqUq{1
z6Q0Wx!e&l3c(YJi<AL1?S&lcWq8_!z`R<h4GG|w^a-#9u#t#CAC*8ZVT{lnSQAFs~
zDZZ_D%`dw@QQUlKp`m=6RDQqY>R!7Y)z<8NZ?jyEY|qVA=GYJ=zFS@X=oW3pcMDpL
zzv_u|ZT3;f*?qpfS}!$Nbgpki@b;z!zHhIIm$F`Bo6+Wf<o3<AH+ElPExfQ#)~<55
z!^iv2j_h7jnQ<ZQXv6P(b-jA2R|_>QzHP8&-YNF2PVksy&I!fBDHbi=i<R9blqV#t
zd)n6eYI;VN$uG+tEQ>O#uAETKT$v!^J4fb7?jrY$!V-n1^U*S^z0<nx%3B_BRcXG{
zxo7UBknn=LB56%dMvFNQAOFPs{H)iVC(C~;Rcgf_TWIRUrd}Opp29NO=c0gl{+GS>
zyJI>6w*S5uJ+W3WI_VgTwD8A2XUYmJWJ_l@h_3j|-x01OD|6%X>-palgWcWdX~|CZ
zNG)j<4LNl1lAF`T{HN@Xo}V{#TkiF?=KF~P-)2_D$kO`@Jn~LQTq-`sn3^A*elzF+
z)6C4n*K=l?XBldWaZNOmoxm*nex3K;57sT_CTYn_*bIeEOK{|zFywvv`N4sE47yu+
z&e;VV+I7U>#ikUU3zwZVPAs&YefL8OV|uatjxGDQ{@wmQ&epnGy8npgZS_3m^^YEw
zZdvlcBFTHX(VAyFo^V*EY+0;x!G%G#r^@NuTL}kt@jwa5&WE0f&iyQ>B;r&Jw4Szi
zOPfY-2$gzSvqqC?5ubm3>&N};e52>f3LH&TtaD7sbY?By(ZYJ|$N$J~z4&k2&A+dg
zw&mpQ_p>f_V&}g7dEfPWx7c2<JTvKH#_vndO`8`wN2ML)&AFWAEkCElu3~$s8IQ}J
zl3jU<iwtFDmx|248g$Ibulcc|py=ep2etDO4f$AA80|OwJan!sDsc1hLpy@Bw9QTk
z|F*2;c$~ZHLe`bnqLclKGEQIFB<ZJeDlD*IMzXf??U|MC+)vtNw?5dtcV^j+`%^bv
zFbjJB=F`LrD|=&%7Kf~!yef{<KWFI#z0<5!NA_z!c$k_a@$+br_T#vN_s`!*2(sBB
zWcP2zxwg-DJQUva{rUEXw@tz7zKHLqlb#PhJ8z3f4Lx!_(CCBM7vEhc`+1)&dN##t
z@+<~MtEWjT*IoCVD$={bY=+dc1t*+eeOSFhX{w@OP)yC7)`I~W3oU2gzwu^nno{fK
ze}yID&ay|kesrYe++q51Z^^_(zm~45PEB6=b6(qz%e!2*mTx||X~l$N)An$F(AzEH
z<I%Wo<=hQBkC^gjobUcxw8=?6$aAjmH~Gay2?AY)CL!h@n$4`9GO5^4ub8z&-eC3(
zqn|FhS2vc19I5xWQ!_kjlgGOD@xD7#N-w86HXitKX2aBcHo@b|*1S$+pI6D|a{TS_
z=F;k1r+~Q6LLS){7A!cdt;c$5!gFzT@$}`B#nadS`}1e*!$+Aj<XZ9<=SI!YOV0>h
zeJJWgu1EExzL~+_4q2~Uw|-8A#E*$OA%9%sEKb&ZU;O^uzh9qz27VEGTN*IISL~;~
zOG1gVj;fcyi+7C||EA1x@@aToeY=z2wQk{(ohOv*k`CsDPIVBy@zn3gEs4d`7iQ;f
z@s@jh-{$A_^DF;;+5Ya(Y{h%NG7_%pSG)f>AG<QKwqC<!|Cc$(8&=q?m~gAi{#SI+
zU*A~^ybd-0JY%0G`dr9QE8=f|#^kDN9`XKSkC+T6e0RO$X!5|Z*W~zuJ+AWwZ<Jp&
zwlEY-Ip|e->bb%>i!S+$Oa8n<E{0lsu{To1_WwJZ|EKq$2Y1DB^*pnkYYPlSrM53A
zQa=(Ou&umL-t|_S>O`lq&b?f@%$IU!ax44xSX9JCiyo-E(=PldFN)E6cczcQ-)lay
z>m&|o{Nh)5XK?=UBAq=;&WKO(o1?r#P4todh4t5;Uu3w()7xWs%qMi+`g|q9T9v9#
zA`V^$Z#K5|$sDScnQR?yDQCC!%gS};r!#kU%s75=U8%BmohEZo-R37V*iSP*58^!|
z^2k_jhr|=Eb5Tl+oYu$H6xwx#%CC2?Fh8W|S+T!t(v?CxWmOr|Ss{$EbIz5_atRI*
zS|I(1SH|^3qwp&AhI;Rb{#z%$@Rz&3qLhoF<*h<r(pDDb!@{iT`hh=7E*@l!<?sB<
z!SFa!N>K1XkKn(l9S%A#O;Ts;pXy(7?zYgedqEcQuauuz+lj0@b-{XL+?&&n^^Kcn
z9S(YA*%zz&*yoFq`=$+XuBN{xacX3lF->o8efTqH-ly(Oe>TMVE~{kx;u>Lp+sr=3
zT!5Rybkm~Wv4uZFZci7QVjp`hC;r&~Px^+dF1p-h4!OPT#Is9nrAss)th=nGzN$z4
zJNK~!O*xKO*3goTQJcf=yTr3D;xF7VFXE4C81Meu1&6-pE#i|*Z<FvA?LPGA*V))>
zN+F8(4Hcrki|v1Se&QVa%(ARACp3P2@@A|%!kN*(G5c_UP5Q%<uk};a@Ak&JTnmv2
zwf%9uY}rJeNs}Jk+Qu~fm6p@lgh%|1?who%e+hc$E}5+UUHixEYhU!2r|jX+pLR__
zXOjNj-QO#N?tYft8En{EktFp|_N+zg!_AWRvy7i6OPXbVVBvGTTgP^J+W)4-+S}y*
z^&B{O_WrKdN4s)w{`~QB`|ppJ>ptJ}V*PO0mGj9O)^%rgb26U)=ht#zrc}N%=beq)
z`8S>M>{GH=>c6Af7;V|OT|K@2Z%!hY{kf|70{45h`FJfHL;tj1>RH=5HR;j^FP9G=
zCri05<6HAx@ZtscJMVX8><-B1diU!0=F%9Ru7?vho%f4w+t~A|iP`r^-y9)heXri6
z6~*8GUYqT~E|Z(~{pQWn=KAOUy|7;%9Jl&~nYZe+{{{c%>nDHa^_gdIIDJ;(uWw&}
z?hM^|fb-}nB{d^M_A?p6)|tYb8vVx&rm?@9wcpk-Zu^=gFCKf8aF*^<zPT;NiqWd#
z+oV@6uS7V_Rx<=&-gWycb6n2OYoAwoaBmGynfE+k#YEYq&6~gag`Rm}?|47dD&EFx
zze9Yp{oFlw?Q;399`ZDv#d$6ys{HI_!ICv$U6<-Ft=T!d@Vll>?*;!%QM>JOKA*P7
zo#1%-yf8rU(&}BSrESBEpS*NyUVU=syWX#B{);RAi(l~hQkT%`8ns>CR*6FMK8QWg
z>508uCUVsNyIzKS+$+BVrETwIn15+)eB86Wt?b!n#_2C_em0-->B5^OC3ltuC4bQn
znKzMT-lCA3e`aKaO?%<MlIgN#?!~)~r>}5_e<<s-<*H8Ax!uUp!D%g4zdig#=i+7A
z_x|td&25p~@bRXL{@YDi`_!~L-mky><ufM}lg+e%^0+e(4sB4pWuKUuH+Axotwu8{
zd7f1)Dtd7uR!MJa?*9nRBL!upcXTg=t;zn%$`X2V`n6}Tk20<PlD=4f@6;C$mVDIZ
zG26>%X#4p`MvZoR-u_)&eZi&Q60|+9MmKBQr>M`FJ&);si*a7;WVx<C1%W~$eD9+K
zTg7iw{d{Cmr*5*^wd{0@<*anhv`G(TOeEYz*pqf1Jb&%Q^>f!0sxBo~2iWCAXoRdi
z$H+db@QYdWw2XufuG~4kXGB8v(xi%_&IPFRe*S!FlWoj1*L^YiSGO`;nZItj_CBF{
z(AkL+RqLh2^TI7wryRC8DBzZ)m2-W!Lr%uM17Q<t^`~5zI#ZZs{r|N~6ztQKrs=hF
z9JnY{(^sh~oKavCdU3VjtoDObBm+Jep5tb1Ywc`WdE~=m7QX4pv8R_ruU<80ZD4}O
zqReY1cP3c8;%&Gdx@ngoCzEf0^fZfCmWIpIgcyHv9JhCP%_Ok#?TgyCZMFvvUQ#$w
z-#qQ;-IFgaoWFQ7q<<ZgN`#)mtf`OJb}ZR1y6gQS{`>|e`-~TQf9D-nm>CPY503F%
z=BL9aU(SEO;^OZcIm?f4)$qPM-SCfV(x)F+7O2`aPF*TJBR|;0T$AHsxXIR_Got?*
zWIrj-5%&yTm-zbPllv+E>#OhIyKC0><ad2NSJ|HD0q;(nN={3!-t&6z<85~{?-xG0
zbK~Ys%RKqkMH;hnJ+DldBtLud`?^4W23CP38pmyIcYl91XJ(noA_k^br-gF+S24J9
z+?l@nzC`%)s)Rt^bzP6LW-UA(Y`c5b-W$KlB6U7}VSTqkwy5FXrq90)KWTq_`QwM`
z+jhR};h#kpJ?;w&|G%`tyfQFWyxiGA*lYc#|5N+F*ZtSu|Nr0os~y{{wexQY2*|JU
zWzm)`zxHwY<=Zz6^v$<$X6P+!ShjH?(^`Ee&%4uOZyd|%bl|Ey6MN+0l8@{6yOeL%
zDL2ym9k$<rWxagn#R`LYbN(E^{o)66`}vC(Gonh3-`4$Qy+4b+cHWzF3|SKt*qL>9
z_-I|ZlJ>LYZ0zR+v!C5K;?&r8ZPVnv`s>pB`lg>)CVlIA!MeSnc7puP>LuG6nU<II
zGPirSt|+Lwey>>i47=UG$kN$We0Arf7R~<??-c6)n!QQw;hl*wTxGF!r*l>F68`#a
z*FJe_p8VJFTLu?SuUD)2U9d55@0$dDe~qqQ=l#9i_vPllXb?GkC`0mZE^F=q1@$G$
zzjkEq-I_eju*gbxe~J2GHkbTQw-$K2dvjRx?_GTNz53ccakpX`U-hT15;5E-_4)c<
z1%9>-T5~@B{`SYcSFZML?q-n<#`dd}OP*~n71>a2yGq&1^Iz^Xl@z5anc%<;&bMn=
zb8pVIIy}33%9Kmpcl7woi}(J{KN`O7+Vxej9}BkB<vbL%PrLkP#S7i3hR1J7&td00
zutLD?yDWoyV4LisZ&O7soZjBK=h3C73#$}PZqX`pKDh8xQA_>)h&9VDi?5IW-z_bj
zmGtN%S99P8NBNh@J*}qaB76Vx?sZ+b>=pZ(!X++Wxs0z(nc*j<rpc@M<-v>_Y@d(V
z%huT3k(Zk*`)0qrmCU@=&Tn7bd9w3de(<RRmfh^nXSvKTyZ3Lt|5t~T>#v(LE5BS;
z&-QisfAy*N*Y7*v+miO@=G<j_qI@Q^H#U7cdexF;`9JfEv%mKHFJvz-w9Q$hF72^<
z`Q>R65l@SIx>9#V{BSJOJ;tlK%x25p2Kg_mZKlSb_t+A8$6$%o`WegT9f{U-mp%XP
zl8M;KJpzJqul_uG`jp{kX?kGVucY@;Y`d%9$21<wPye>tO7?-9BdeKPfkM;Ox;sYp
z@%O)8pFR2B>rBQ<7tNOcvHCB69bf;g#BSpB$$JFeCZ1uEQA|7EYW($C`CNJS_@2)t
zFSXUuuZg?(9JP>`;lUrp9e(+6#K}!7wBkaqyk%2V6t$?IuW;o2zGdQ98lIai5%t;3
z8F_!ri>%~?&yTDMGS}UoAy}RjweYl{+JjvWIkGlwIsCshQ11cnWRuvlVOeFH15{20
zpI!Vy)ns<;GJhA9SC_QENlbis>d7yG;y<s?XD@DCTxgvuvHQO^`@8kMx5`<xLvojQ
zvrph&Vls1Q*7pl7`Rmr&ZZcdSJpZiP&u4vme{aiQwaWj#l~CWiYfCLpH=hZVl(1UN
zw_xYT9jsF}9o};Al-Zof`6dZd^IX}znl;j%7_DFQn&pU@_@3sN^QmUfrD8nJd)_RP
zmS3G)!+((NMVS93)!1;^Cn9T_y)~D(`0bsk@ZHUx-LBeHqV#Tg+3ZElyE6{&GRs?~
zBmC0cmP>NN`vro=S?@(xnMnG?6^2jz?R4I>`S`4NbA@C#Oh{dpmy+3bROL?VWg%Xn
zg3~oTVe$@37CoqVUiQHD;mjP47YCdATo+d9>rGqezTxdOIi>gR;vb9^3-%bz7F(UV
zz*l<FJiGdL>^9YV)9bCQ|NeORAfuw<&qM$7Oh0;VKMG{&xbA<6;n3}w1#jp4n!a!y
zzg^vrf-moCUhp2AKjW=$hS6I7<;$PT-gmc`;%Cb2nOogg|4%Ym_R+D6MFpNh>wbwo
zsC|_A&oTUek=ft0r3cUKnDL}xODDsMEqDKY{~NGBJNHQA_MO|SBeokVMffh2n=BC6
zdL(Emud3Xagl8H~=eJzhZtCc$>GP^1VXsr!^z$nVrY~T9FyGH7f}vHQUadw$ciA1E
zqa~q1fvb1ExZUr6h0&$p@{;G*4@+PF*vd5f-qTcv`Ii}|zf)PM|IsVE{So7>wbP^=
zg8ihNWgjM<X6E1CywKHg$)T+UrNXzokFq>`G-Dpe^`x@U#qVyGKWbd~?Tgld<pHy<
zN7z46(2pxydF}PK`A6pee7gV0*20^HFRcrcwYKb8BvWH!ZC`6`V^RCN?El?FTmRnh
zi)%949nB}V2du9Ww~5Pp^oje2&XwQ7-x8V6b4VR@F1~xJ``_%%Z(82`6_%Fzr}Bz9
zvM@bOt7o2)fB)n1_x6tx74G?z6#x1tQ^($7ewyv8;GyLY1q5U#pKaJG5o<faWP0B1
z=1TK`)yI_mw1RdQJ<-<rV7Ri~>)_fCeqP@XW_36=aEP~^KeKt>uie^5qW?bb33JfD
z9I&;Z*5<ECq{Er_^S0l;>wAj-rpkol-<RvHsg8<RwSTXuROn%Wn(w#foKz6V3%KPy
zq3mufZ|mL3(z6q^W_eDrDDypZz;V^?44ws3FKp?1!XkQ<ximv)-9r_IbODyY<-C&{
zi;{fg`KIoY+aP<6qdd;=!mHPPIxGx_HoJMu%}<Tc>s3_wxm{`L>7|mE&4NFVTzO#1
z&GodQTieJpNW=coqy^$7J@L~eKP7%Xp_Xdc9o62>aaO_A>BbqIShd0{$_9!$vi(kK
zzkKZLZ+?rv9(}=hg@DaOx6S7b_UP}bjfrPn_`K-{m&V2HX}c!Q6y5o@E!N@j)#bZS
zzJJ#+DMODpVX>(p3y<mw{t2dHJe-rhC!gcw?m5%Fp>wt1|Lkc!SHrh^+PUsgY$<zY
z^=QhKhFw_`K3sQQENwmadGn2~bN>APoX3yZq->SXee+uQUP$<nT^j@^*tY93%HH$1
ze5+siXt{Zj*P6eEOIROOxW;%aHS}9QCrMTy?4cva4?D)Kb*d|3Q<ueWUH<sj{dsbA
zHkMNR?%TH;*B1PFcK2ob;^x1bm7mYM>h$2vWBx8TZASi*c%Ew?!d|%h9Df<++`jRx
zPFEO9WU_~&@rrZi+fVFT%--+T<)&S0t-6G(@Z*v<Qx_>Mj9mAOrSYkt;+^Eu53y^#
zjE;W)V*gT?^XsQC=eK@lZOdIVcavDa)vIM{CSS4^Y`hhCoqM&=p&3_Vr$#NG^25-(
ziZO2!`&Ny|r*_1AKhM|KADb?=s9*Hej5jaC1FcTQoD@^t^Zn5hug@|@N(&woZxw$Y
zUc9wAIcA1uZCAnX&GCvKjB7+bCrZqjWsp+H)y4eb&H-I!y9sX>-QJQVzKA_e@NQni
zPW8Rvx0^Eyr~f>f_-bxu`=UD<Xa62tzVOTWTdebryk}r5S{RadG(NbLP4nB`tLX>R
z<xY!R6kK6Z+*bd0QH1)gJ=zkF{%)>m=U!I+lhypz^H<&{ZY{GvIPJjmgJNentUoBO
zTr3{fy?tvozr4k97trZo^Ve#~9qY&s?<?9Wd#dJ_z(k`^mt?2hn5S1wgZl%jgX(#r
zR_aYrn3Y_}Y`8+IzHnaDp4&!y%c5pP&ol{F4@j<;d+~Vd(}!WF(ysLs-<kURZ87`&
z<C{!sq;A}LWjg=u1GAJoC4GrI)f>6JcS_Gbyu6joXpgO}d4Rya-+q@`JapI3)_*uB
zaH4J&^O}eyuPs*FiL~76WiYsQ(b%$dOVqUK{ekA1Mxs~hR;LMlT^?*WH^#rT#_;=o
zbN96H?pHx#S6^;WD-%3DCGX!h|7x9lYpXedliK=r^)Jxe;+MhU)>Qk~tX3-O#NAWD
z2^za)4D=Zo<hnL@AM)$-?=57P{eQDGNcD8;&C3qEHum-Rc+O993HZDA;%U<~<C2Kh
z1Am%Vs~1E$A6~on)zPKD`)+yKgl)g6J;(jytd)uRe-9mfA-;vj<GcQWy-qi0ZBPGS
z$RM=0>z@3-1>Un7jLl;Wdn(K3FY#9W_WY=9+}_nr6BxG^E@}xbWd9y=H6Z!VBIn8}
zsl~x=sdJY8WXiMIUa6!}u+eI%e(cJhhn(Jg`*K5wUv8!3)rG4v)EtkS@-UdVZdt4U
zHabIno5F&1CoC<VPjBuhh!!<(a+>~h4nM#7!Ac`nsfP2*W*Akz;O3gVNa8@NMUd94
ztkcbrJ?=j&{;k<}Th8UU@VuEtZQO-#c~qLs1t$guZapJ*af?U(k6IDO8g_+K64&PV
z>&3GdpXz=ZlsPA|syRn%+44n)B~HyMaNs>+AiCfXmr}*F$GsJE{M967=KZ?Yq_c>P
z!}4{2sQYw}BIAcsQ&xNuTy!-pkpEbN%!k5x_aCoKlb%>`GNW19@1sKB6%kG?{-at^
zPKC`(f+@KYPc1H)`b-QoyeaoJ!{8SOlhu{jv&Xk?`+FckY(kU0+{)j<jp0VZYo<-U
zQx^I2pvKQ%2Mx59zMt8Yq8GyO^Ecl&@6`)5XNh|;9AxA^s&TBoz+#vA`E^3<8)Yt>
z+IVToE;Gg(`4i6zrbXoH^SCqf6xZo9opn3?d7H7=*4*bk84KF3UT>UhVPLA;bMlPO
zA~o$FUg;S%hhHw$vaFdeGxeyinR_LNz+SH<UwAnTKFxc?=E(MLJIlm|*#|bwnsq_+
zNTY6eacP9Fd`8vDy5&2ZCp2uZ+f&&0U=oY4uEqSqKP$M{7@SsbH=9~>s5|qiTuL9q
zwXZW29{vo<Dp{W;@b-0PlBdE6hMZlG-YwFZdM@nD!&mM8D>+-s^wO078HMe!X|ZdU
zlid7Y^3JUZmf9KYDsh1V{w|8oj1T%RxtwIu^tM_1cuUCo&mRS*a~x}!IAQ7(|L-#t
z7aiAfW7Ifm%Xwq&I<E<mS$p4c^xnT4V64EzD|}@BKHZ{VhqY0uUIG6?b87?+hezCb
zGpjqxlhO42|818X{$J$^lm4-sVLI<V?hbKP$%40ACc3O`nZmoevMa`$%{(f5*1XiB
z$%Qk7zcv_M&SUp%ow{JfbpB0_UwnEW-ZT@>2#l7#uxsMdjgt+Q%kF7?w<@WsyW&|$
zUINQMt{In@%)iLKar-(wX`6hZGxM?^C0eTMVyav!H9wdwkH5E}e-`Ucrmj;8Rs5`n
z(_eYiIm~?Ruy94;f!8ZehA6L2>r86Q;p=!`<a?D(vrGCw??KtPXW<noO}3L*di_$~
zGXDDB#kXT$v%vZlDWW2+3ze4zZIVk9Tw~WGzqs6X6Ps8RW2uwS2G4-xD6Rx<9aV-K
zQ_|MEIxp?|*wgup;nzVYnbmEq->m#znqD(okl5F4eMSC`a73R;T#>}xm}wsZn-?z+
zIO$bU@GhZX_D8>!UHjI~o{*5E?Q_cF_+c6TYX;?-bD7zUPHtLxY<9a;8N;i|!3t(q
zq8sK$iDlLD96NvH<|dx>^^1QTW8LFo&%{!*V#bVvGrc5dFsny4sp>TR)R_3@e$=!}
zN5Z-71HIN1TAV04t?0dYVaWcP?WLQh*<{~37{l&=*6i<>hhIKwIkI!vmo7ikWp(kX
z(2BlC=TldgC~IYTM7mZi-4HtEjcWL`fL$@->7{lSM-RMAd3CqmT0dcL&07_&^^t##
zM5^}g(w=rZvgB~vO~LX->a*uIq(0a_L$YS;v6(wL8VxHG@7$X!p{vLsRvI-=_aUE}
z*@gl>&U>!htg|1LE-ZXK!Aar|SM1-V(f4GOzRq1@<a~bj@4T5U7F?_c9Zb5vGfp~X
zy@dDc^Jz7yIudD@RW~v0-mCkYuW4CSbH>^qhU-PIGCTXtWSSvj;Lo5O^Vdq`%%e7+
z71Km^G#Q)CXj#PH6d0oycsYzig@gauzE50F<aIiqZ|3GdD^a)S*QBi+4{j-(Iq$VZ
z^7q7(PCn0$+W2qmn|xPxQirfCPb#y#XpQRcb-^`#s#6X++-Wft*z`Q$ghHHI313~q
z-uc%XegE8zHoyGgz`Qx{8}vk2`3l{QlXtGY=2o;$zcylXlYi2`Q!LpwI-Bmk*u03%
zQ9MZK4{I>H!$QRu&Tk_9%Y6fQYYTJgDp=-)yFGN4b?&O*{rxWDSCv_I%4=6$Q~s^j
z97~S~d;gvH@^(pE|DVjLb!{uF)~+%4ey6?lxkmkhI+qpN{{r;$B$9T@_gdykeiK!Z
zy0Bm5b11*p^7(I-3RLB$<t5$x`JiU$loQ=QD$JD6O7va&p1M(I%B5a+Etk35|GYY2
z@$PZxrYPM_MMklrtF^k~SDZZ)rJu3#)jgN1`#y#>t?b&AWR;-$I^<QHOz?$0r?<V5
zdc(H8b@htRJ}Xw<%)8CfCS|X$`|`BW>0KqF9rM*T35n@)s^k_|`h|7+v?o1$l4tFn
zeOIS)LD!2LB5yufOc$s*`un`Y?V__gRHbT`u57z-Q$vO6jPst0p@$iNxE<KWb6sdk
z;;V84i9`*SIqwoL&yw=nvYb8jK<QP}9pbBRU+xYJTJ`_$bP>5lANg0SPG7Wm^S150
zjZ!%bi>>+le2Y45tri|^E9|Q(jR})j8>^Hh9y8A>J+nxBD^G8nYvJ-AEo%;DeQv*K
zCl<oR>{Xx~)%dSn=-t%C7FoIdAJV0E$<EsGY*y5@qHShD$x{<}ZL4*iH@#MO?<s1|
z{Pf^uvSskbDH-fBn`-1zHy{0UaG(BlpM_oro(g%rZe*G>L#rTRvrx-|TXGyOvX)1l
zB|7a4{hx4p`o^-?KQa^dRV~?9*Y@~uf`pz;(dsYLCkEY^&fomN>6WZPJnzc07q(6G
zmZ)?3w$EPf_G+)+y^d=)UlKR&3-3rwe0+kJ=dRHM&zOYuGhW~NU{J--b=V^@mrM56
zFVoW{54bLO-A%k8$HafYXZ^JmG1j`-dithw*PdQ}x>bFL`L$PqbIqP4tNLtC+Hm_6
zb4SntcZrwGJD!QoVe-25S?y=|-kzx?-!E#aa|<WN?P=clcI|fkPiLmAa6NN*;qLNT
zt-|{`*}h56Yh|`r`Q`SC{o${|H^en8?bGrLx_f)p!jSMJpQoAY`2C)5d3=^Fb<Jm!
z?aL=s*m3ATimgm>QQA`KzrFPR+Z8g$l>Td)O!L2ZcJ88O<>_a$_)qtXNJS;PO^dzO
zH8*-KpYo%S@+ntKH!{Ut+;l}%OTILfd1f@Hos8_pBz+#S)P)tBr5<TpEee}en?3pI
zw^;d^-}gNJF;O@1-G`PLs$D6UiuxLqFNpk}qW@#^EfvXwGZ+=$zIJz<k^Gi3dsW(@
z2O@z&oA*qe;xOrXM9p-Kp0g__SlX;oTe&PdbWPOrGqY4*rJZx;;65+BR4@63YvD7`
zFFudgY&m{&@#f;5gB(wmN*9Oz(DwK>dqt$y<aWm`_REX5PWW=h#a4;oRG1*|(gtm#
zBU0};?g&`VP<XyDZryV=3*EBK8@<j&u6*J$?X;8Ag!*eSOVUyz7ccjfD&c(k)A{UX
zHQukjm*w1&i<gG@vNP@tuV;F$QgY+h90~7=YenZawbqC)KEN(0edt#A`u+XVaZSr&
zVx!7SeAp&F2r(;_x&M8!zvk2J@0g@cKkQ$={NvN*j71sSRL<{SU>=^I`fiV!bKBg{
z9bb=MoE3Jqc?0to!$+}7YZ@oyHFPu^_4>ZC`ncAZUo66J+WXsGe9FZfjcne2Y)Pe+
z43bf5SGbJCj}?Ai`S{B@Q^PqI`@U`u)#&~wonQDyRFrkW&X-N^w=is;Z|n20{Cz`d
z{wk-}1)*=<_zI*rlQeEfiwJ1GKYIPw3*iu#?GHa2R2=%l%3P%8W$`*f#*XXEod?|~
zw`l+1o4N75Vr@ot+WnBuzO<iLw|<@TYR93y9=D|y*Digov$134`bE#B7Q09boYs+c
z$)Eg_x#C*l#*(`Q8`4F#^N9QtyS&k6x)Gbl1$~3!ZNXPhDrqXRC2_sF&h*YA%3EV{
z<<#8|!u*%H+$=b??$+hWrMWH%<$K?{b1=`ayReYmFehb#yWfK<v8aiu)!iwjpN?@C
z-8*|lG&0Os^5p`-gnFCGk6U8OZ?1_vva3S)hWu(x_V*sq7uo;pI@Dm*<Lu?NboTj4
zN12$L3Z!p;u;1V^Ra0u;;yAM%QZ8awC+3OWmauTX6=YbbXP!{i>LK_}()nk`D&Y${
z4l0ULv)?5i;Fp^*L-wM}+QX|_4m0sCKgy(RzTjJY+}cSmZx)%J<DOz7pfK^Q_KYt%
zR_i|8T6oJ*KtX8Enq?eC4I9luXPrGLb1-Us|5j7sjuRUMoK+V%Xz(ZQc)hNxLbt_p
zpM&t1km|IftpSr4P1+tlXGLmV+l1Gws=*A*A08#gN_Qj{G*mrkPV?~<a+sMrY5Lxc
z_fz=48W~+{eq~>;$QjqR{n_;y=WVVA-50wj|7S^~gyKA|t#-E(3J%9q?dE<w;n{*k
zhx6CWsG6d=n)C6!^_NU;t$1{1^>qFE|LxcJg?sDszxh^CCZ1iq_vUdssr1D*%qsfn
zhku_l&!0E%)U_AB7jNf8I^8?zn>ugh6}P{)xty#MUAK6+#D)I0W1Vf8_WIy8ZQ(rv
zec=f^Jf<9}USVK-JUGkQ`1|*{TWvote^`7zD`Reqsr{xq>)$<_P;!;I#Wa$C+V{?u
z0AuqlRn5y&*KYJ(`CH9%@|}dN0~HxxDpx0NI~-^3z!v=_C!FnR$EGx^pvRvkeeSlt
zw&jQ?r=aV@n=`Lv@rgxkn{WG2!tz4fo>q;UvxN(9I7PU!>+{XCfA7A0aXeq#f&T~X
zExxyjJao=|$$d%i^x|Wh|5;ZmewuGq*k>a6uy~_3Tiu?ZNfZ8a1x(<Y^Zvtet;~!+
z`j;6QJQ`ju5a(Z4o3Cnl^Sk!apu<)&juUF~h5mo|cy?VO>xRx|qq37r7Kc{7E?vL#
z@_e&*&pG=x#Xpy*zNEZnah9T3-Q&yeR;PZOJin;EUpVjb<+m@>UIs3o_3`z=+oDS*
zCFeCY?kP3jZ|md`^x&nSL%72JUF~aMd=co#zr6Uhd%>DGA+xQ@N28th%v*Hd`||ed
z>tCL_V{@CaCssIbyTwX(c9TN!Jf69I8#!l&o<AXV@TdJr=61J;@V2d!3jVm*DLPvn
zzpSr$P+<P8gFniJ-^SZJY!`?&ea!KNg`Yu^!LNX;#QNB+b^Ibn9m{%C`5b?x+9p=#
zMo8A|FrU}MXtm;Hi_vQlKdEiq2kT=QCQQf`vF(q0>vf|(zr4i$w}s=$cdJjW<Fky@
z2wu*^GS9YFBU(dd(qc~E4yz5F)d#E+S4}dVZ)YXs@KNIJIS)&>X@{EUv)wk{*fsB~
z$mTBwmja(>2z3M|x|qzYDPJsZ-*@%@xmo^;k015x`naIz0Jl!6>+Q}r>$d%B3^Z$f
zC_Qgo<jUI>$AScJDJ?htkiV5}fzGd~`b$b<3Z-rwy{I5up7pk0OVj(ipv=|97AFnY
zIDVH%Jh{H?<EKl9!vbyj4K}9TIlW!FZQZ<yukNW>-M9b!`QvW$FwMCt#te%a_8jEe
ztR?!n)2ixK_0gM)R~i)j3>2QRaM{mE6(Ww$INvfBmmXNPK19$bMW^JEO3CBpD-XV8
z?rffr`s~SrRr}aie*e)s=}WcX-Rb}4*nW9*v0#@@(sPI6-l=aTUcLGl=Rc>RD)@qL
zSh_{Rw2RvcqIkrzuCI7`s3h&+1Cb9Gf*0S}7T!PUq6J%_ebv_5kFSEVVnyFE_qCr}
z)oszM-|W`*?%~e<l~bkCz8qV3c6xSJ8Ef{c8dl5RRpD1voSK!_vhMMIIlbZybHVQ7
zO`2t_TUd(<Kbe}u9~1K6^0NA25a5;Vu<mA~Q%>`XH)`=WxIWAhi(OgYxLb6$iX`V@
z<z?TvcU}B3<I3zK`nSY1uC_H)hOFfMU*p)iA%4%VyYKgZkCcD!*}ICdhQVUe6ke9q
z0#V1f*VbLR)e$<0eNwZ2QorK6g?v1^$98a@V)s3>aP36KtzX$Lvak8J_())syM4=F
zkAoirn&Wa0A8_f|S(l<%IA3YH%>spTQ)Vf(UE1?Jil1`*&^XoadM`FRT}XcOTZss^
ztp;1WeY3dsKP+R86Igl5Bxp~p2{ZFnvEnt$XPYR$YgoVC_|i+Y$%%G0Kl`&~vghnQ
zy!iX!`QP~e@pPK~_|(5R{B-X}`?yIg{^z&pZ##U>q1%Sj?)*AE$LD*tExVdlqMK~b
z;J)utU5@m@i2XtPI%mo!o-^rU`u_69%2<|)o=F>xE_&w*?9^dUv*Oz#`Yk8kg6nLm
z%$}Wx*|ns4&G&9yd@d(N|B2e+Ux(I)_Zr?guB@={^@kNzMjw{$mHepQT^iRu)67=S
zry}O<oTPJQVYgSPB>F^H?zkg4ZJ)H+`Z|Wm6)&2E)?Y08$M|}o-=h6%xwgJw5MAJC
z_R{`+iKzRR$QA$F{9<^lpKo-EVDk%0n!qPy;I|-=L+Dc0TgG*XT!$3aE#7r-%a@|9
z^KS33eC~CUiPeK=-NT4h(*;741X-m2?D?YYu`9peh;Xg%0UOC>@;y_Wf_x{xvf_4@
ze8u>$$+0tQ;^sKHw=U~{UF7?>J~1Py<D02o-A<QhKYl)MdldNTu<^G!^YUx=$mRvs
z$NY%?|JaAW>FeGIwZ+GdTle(o{rYj}|CLYsnl9O|Ro!y6H{kMwH_D~1Gxx6hazg5$
zfF5tm{kUIS?rX$us=Lw|v~-u>qD72hAr`tbQVtwR>pT2`^VWp6liLCcXU#l(Q?paH
z?wrN%mR$Wg*CaKrC<pD{wZHti4^O^R)78wgovwPv7S<P77HyU_y?vD<CYsH<=DhU;
zN7>bjm|A`XxJ$SFT9_XEMn5h#&coYyWzn5a(JPD|<;r?q{}X%o$WzUiH<#Z&qxvha
zUNX@yWxASxV%beQ=7JwWkCN<4-{_v>kNDnp-PPCabl>8yPlE4m;eQ{v`sa@GQg*!k
zi@i^Td*?8Ozqq+%g2a0x_qU6y1a`H(crbm{4Ckc}wxu6?eB*XY(D|~BW*_owd0ySg
z>(maJbM*ZG!=~x!aaq4M&x}boFxf1;YWdp-(-~Gf2=w{zJ8vod^*@%SG%8devG3v@
zo*EHd#b+f)R;*iXIm1KnIH!&QuThp$`ML$?1$T1GC)DtZXl*=S-!XehT7JaJ?WrI7
z^D8d&D0)})3+$Ni^r^)w)o@R{`*JSzjLK#T_Kmvchw@jew)HGJy4}BR*Oe!ZYM1;@
z)NbhBcWIl=wz%0hGPl(vYuP%#GCUOFnfRdLVK{@3q+d#>;$5%E{fjGvkBDpU&^PgB
z`XmyneYkSjr3n)RC*KWzVkD`{8=x>PBfxu_PGGiP*NPye={+}J$s04YomNwDH?>>2
z_2lE<!8Mg8k-n~T{xqMHe!Md&z(BQ5F`9w>q_MHsW~TRNX1=vr@=eCOd&ZHKM#|R@
zSwyF4&WOtY%u=`N=aC-w8+ST0SXLB=1uF6}bT8S#dhqSz&@RO*4dyfScniCZyUy7o
z6V$FQ*}(rRe{T4@UCB)xdrjBweDq$0X^z)16SjMYO;kAC<^}(i-NLbW<xM`GI~Pop
zN*yO}4Xde1tJJT}@yZbB<(%s(RX@#CAgX8gnbzH>6=hx2&$#HExOyrfVZwstGiDWB
zl9<u|n!EqNOO_W|elO~6YoA6Z?rwklw=m)SKl5|RYbS}Tyc1dSc1q9sV=G=(KHcz!
z!A-`IO=g)L&!uctpDmF>iYs2c_tF=ytt^k7p`e&(&b2VWac)_O;HG=;WP8J&hMey>
z`9Na5?T@Ii?ZN-AsIoWPd1R^Yx&5N;?w=)(>JBA3CRH-|z3Kf_ud40nz;ecE!L&<a
z%a%tRIsTp9ey5-4v=7yOH~MB)U*`#wZcCs3^7E4Gv0I}|3nzF>?61}>=={K5pfK^+
zlM7lG%iLeD6+Zd2Z}qgT7en@%oe;gt&SU)LRnQvwIhMDqBb+aP+9_1<pJ$%J&F0v?
zdHi4bZJi^gPk+lC+@5GuvN-Kq4hz#whW6ye7QA)A>i1Z_1aH-!Z!9x?^ERt5M;vlz
zwrNzJxZXE=f@Zu`(2V@WKXlHpxv$T;?wr53L~hTM2Uot$o%dx;`>T7)`X}bZDktB*
zyieq8W8sDT_&0l$ns1i&NCo{3a0*_%%kfvz(~hm{Up8}IZ}jk%RhbiV@!;p@9Qkz(
zp-UYy=iL`GpR!<0-C?DtwH)hB1s0WaK5>33yk0v*MDvP6wa==aM!yZu%4aD_9{8#{
zCCtk@spCV9WyTaf@sH<h(*kYl_c=TF>+k=@kzp)+&CH_ft%5ysb4Fa<AGH?;wunzR
zIGKOrg0JFzwnVq2zW#7k<!0`qB?4Bv-q&ff{XZVNX;va<ilO-Y%2TB+JH^8p-D>`w
zVr_LWE9d=dGIbW)x2c*!VJy{Ell3augPt5(=1}G6A`<Yv^^xP|ggvdlHYWcy%zJR>
zVB~YgUfUnDg*Gx;pIEc&(5wFU*{nPd{(Z2NVE&l<v-OjRg;&Hh%??`;+uxnJ9}0pb
zLmLujJzO_WUy@ONsz_ByfcblKmMyEqS7yfFlhv7WhNHXi<@vRn*-H#AY^VzO_1t#%
zUk6j(9U4^&Wfw}UNb=sYKIM9zc;ds5^6IAK+jlSaUuCMb-C2A?twv#^>tCgUH{5d*
zwZ0XZFFV$kEFkmx@_!ABS1aT9ma;N;KcBCE@F@2;rEBLkw|IWOz%cvw?fo0q8`_=a
z_EuayMe)TgQ>`^Id$J_AbL8Gm63=wnEglh8yW07K)7gVdbvDR&tv6VIW$mwxEB)Ub
z@q2J-U3W<)M{(ha^^GaKHm_N1O?o`89aw9>AdT-@^qVWE4`vy%P2V@?#H?EiVt2l-
ze_=EC^{Yg+f@!I-vFtXvRnu)kL_8VQFEl*(rlmKn*)xjgtwD1WD^I`MvP9YFMlI`0
zj>-#DZC?eXe5+|~K6asK+ls9@3x6G5+`rwK^MHZsYb~D74{F}e{IQGk>RwAR>2CX$
zq>YpR#GRBVwOMxkXKvW%FF9?2bHfj_h@AQL@8Z|9JDx>2E#OEJ3U-=RAFzJfa_1_U
z(?<(>H#^+*m$W*!b#@^8y~zyU{v<gYrfwDUUGi1P#3cH1*4ol55kFn5AAYN!VY=XV
z_3u;9n|Yt8d|$Zb-sbt|{{1q`li>O(S+ZB4V7<bb8T&F8|4)B8g@2~=iHU2TF8<QF
z|H<dV!f;nxo#hKT<mS!Uu~;nV?T@#=CqI^dR9EcCn_%O&i-XPWnnk!_dX!k`(MuQD
zW52EHuD7sd7L<AaCSkGcijuwCEwgs>9}yKf+4o^dXSTrXtrhDhOnG%6n|b~8w+k5D
zO`6YL<vBd<rP<1olvP)+yb6w9BjMwGBt)8}g7ui??$heqz8U{&JC?jP<fcyiyBk6l
z@0L1CWwq1<JYw~-VqL9pDWFe1W`>vd@_mfbUSi#w0@^w5v~@0PJ^ocy(|?cmDp|q9
zJjHe;vn#uW*n&+Ly9X>2jNEY`U2JuAbe$>tjSVcTcAed+cEu#psmwrp)}`B1xpow;
zJ!H<#USO<RFt6i6WtLRvjH6cjwYDdpeCX=>d-vjPpYIy#d|LNcD^(%?8I$+NZJX?l
za9U2xHnn-Ed*}ItW&Lw57_m2A+xvjQ>PWbU<n37ZjP9QtTdTX1U;S#^@_vQN)H+$~
z?+a6=9s9G&^vG<jIfvLo&aaGC)K9nn{rhpV-lgP;%X!~8-E@py=96-8<y-dhy-IuH
zH7=Jv*T4La&sJ%}j;m^Rf#Dy2*KKL8T@@@hKj8lSd9MF&RzBj=3S(U_V#4tA(J>i~
zhAY$W&#o`hjQz!aQ}%FK;9rh}b)gZPdiP7JKaE{i##9^oQ+v5$&c_OdgglP&0~UgF
zlIEISi|qQ#f9GBO_0C_pOa4lAK1*3pWfseoD(RHdx=$q|*1B=mp>z6<Px*E-PK|t)
zSoG`Tzt1jC-Al6U&ip=@xb8UTj}5b&<y0RE9+7`;{`pbg_1g`KOa}2WyWhP^EW5zo
z&b?IV_KbLq){oz>2q@lhJL|bsYGPmSQRV0>v+|;5&sY9+aV78WC$G*LN}W0WAnU~Q
zv&L7<uW{-)8J%9eI@C_gRbnN7^`|c-3omXyJo)-<iwARW%D(q$T7SlSSH9w`M(bOV
z9J`miE&J5Fe|ma>=c9jB6$TH@Uml+Nt4LOB<Abd9M47^8e=be@?XsqSNBfIQRqacJ
z=5H`rcXPVJlTOCBl48C^a{RO2K4vUu__b`~h4-tjywhtCUy<V!(AO9*vCg91XR54w
zoZI^NeZQW+P`-6}(RI1EaqG;^Nhl==c**bhEXn&a(nU4@i>h>E0q3rauB`{Mv)O;1
z3P_mZ@AD;pmE%WCQ-kN(fAZJ=v#9u4^x;=|ea+X}7ZZxocvksXJ#_pQzFjq%Nz#=?
zRo|nuCF5|#PGzl$b9((>o;+>E!=hfrU30o>PWXXsEOu{l3?E3HaW*Lokhj(6Nxz%m
zTfpfOFwJ<YCqur}iqO58<wjN)CvBRzaoW!q@qFfIjW0@!Y<3=+t^b)fB>IS5x4hYE
z&!r7@7nC~p<^-p2-okddv+!rC;>uRu$Im&G77Je}nA0)+tLee8fQkbd%sfghdI9P8
z57)crTsi+B#^u2my9K<A8l|n%gih=dpZHebvz5S%!j)!0vKiMGJr<V>PFk!O=U*Em
zFir4l#PidsoDy=?(`=3?tT1NU_w4G^V|!VdE`HX&`qSt7g4SsdTUIU5UY9B`<tKx)
zLmkhGuNU5Vx-T;9V%3OKsN}XglYir+xm<RJPEqX4Ez4?m?9oj;U=p|UagBvsx<<UF
zl=M_aE;)0@KBKyuhn5HKDeCI)69~Mc>A)zu{{!cWfNxRPZ%^BLbkTbk!D0=q8E0H`
zT%DJ{h}`cj*I}lnm$3HLR1uEoSM^f)jd$A1U&&;&3)cMo_51$+bCNQSlbjb^@yWgH
zm7yu-$CEc>N$91mjQf{x`RMd;M^1|Q`@Y`!z(JGfBoXso`7g?b_mkQE=7}epURV5Q
zv)~A;z4&brfjos;W$F2;-V0k6SLFXVdqT3#gYAVamt<b|j6DtAEPGyV(GXj~(iFuf
z(fT=ywcg=osmr1To~dz1_k68v6J7A;BKJlQ0j0J4C5INOhQ{3e8}|9nJtf9nGe20q
zIxdhHYySGhe3Kdb_gy)_FBGABk25}_a(nxWU1$BB-df(1n0K%5pKX=wG|djh_I&%@
z6?>!0_n4?((L3G#j3-3Rx}9NFO{934$1l6HV%|$ni*`R&Wp^?Op5xoSnvq4WDg4n*
zY3@qrNv`YlIa=oma|bLwy(yxtaiMLt+gy(4Y?}+p7?~fQZ(EXHSHFGLl4of)-pq#D
zNvj)`7l+q(={?>0b-rEQ->cjHh)$co;-A@S{>vA){kxUV_Upj0ng%V6HNC%-H<;+v
zU$~-tC+tA-vBv`bH?J*lzQFJJLRmYI_tmXS6}ulavsamw@fCje+aNl3zTCV;-zRSI
z3*vrwX!)~_$sGl3Zv$6N>p3-LV)UdhkyiQ-mo#d*2`=Azz<2h#D*>5Z(@&PfJ(dkS
zy7kcWUo-D+WEEL8xu%5AZ2IQUe?LEFKBI8<@>97x>-Q|+F^Z|rHMf6TZ()`5`k1BB
z^a;0a3Ey|rVXl>YA=@o-)yBVZk6ciO@|-(?4zBl@?sEDaUbE-uW1dK!CJFBoHO#S!
z`x#GjOTXMHwKR(Df^6gA4_>R!>Zo1i;)x4*BKqkd)7(jmr7nJLxyA06t7Q=^UUfq~
zn>}S-&dwD-!lxX2d;9I<m;xI$o)hVFR@Qec+|?tq$LB^TZ}-&+Jr^Dw*(R%C%%JgK
z!EyHzX=B~r#+yHP{PVeO`uF3?i^gh_SC;mFh<<YY@6uaSmA7(aEOdP^qw0lk%>DOl
zbE4nAiaT+$?b-dPBF}&ecIBxh8h*1Aq-<B~9oT+oZs3<V_h}iM56@2Xx$htTYM!im
zjjurE*2669t;|brTS`51;(M`4{wTZr`E&mF`S|_r@4H)HF40~7|5!bz<TRhhPuCw^
zsxa4a*RG$eYbrQGv`nP#I@%`%_ti!PJnb<yjIuPjdH3^Psjf<9*ObETx3YK4=t)kw
z#o&Mci*(O>wN?F0E$^Kw&i_p3?%P#)OxdmYrNG3c4tq?GO;6Y%GG(*U^P*>oMJE?1
zAI`}250o<S68frg>`(TGo98E~tNba>R#{<ct;D|bSotpgDKnY_x|z7re6tV#`T5{+
zOz+1>2V6w6EgAO5n=KD|E^PkRG3WCv@eV6j)18NWDz1q7Y~?(2ENzE|U%`yTqfz~5
zP8EJ`keXP$v+K3a-i=q+2K;A;KeuB?@Fu@f3uDpyHj@@KzIb(dvttPt=lv>`2igH9
z?mr_ulNoL}R`_no@A<=GEc=Ds_o8Ke_!M)`$TiQB^_j(3m(S<ZR)4?R@B6eBo6Opu
z{Cc=uz-&s@G{)W=%hx+xb$Ajz$GM}loLM~L8tcs)7w1@?J!{1rV6K(@ETws2gn8@S
z-m?olDvgf*$+_akK0D#`+gUyvh2<{jXPt5ln6u*XP1}dBgpOU?)$S3dnDXfKK86!Z
zxIBzlZu*-EC(Nqm+mt4JE=~9Hncn<q|D969|7>pUSh*--&7YR7$J?w6986_SGrV%2
zeql%I{aw6IWG^tOJAFO+dnUKb#}yxp%xznnp419{$Y6=C6K;vPUwqH|WzXTskIU=r
zekBAXwZ43KAjL8bGzIx<SES?O)hjMlFI=NDD~EyYxJyc<YC!%%nTM;4R3}EQimEo%
zU~FSsEya~}W25Gq6=`LACW|F+nHy|bX{H(&sJMKd&HTiPCi73PT3r#q_@QHm)azvx
z^LjVs^euatbI1JP0~6s7Yjvs=lBE|!=U!cOX-nS4f**H9W<8DMy0$$%t|Zhvv+BQK
zjd!iylv($UChT(%W!f$;)^{eQ@zIA8hZA#og;w5J<M>KU?uLy2;%R{^n_|A$vVH5y
zPEG!5a_LDXk3!v6Syxe`8_%nFCHeO+s+x02t*vz0);z(3M%rzG=1Ufxna(d;p4`1A
zgX5LM)O-Aww*1@n%;AYbUoCIY;;ffX3ahyL-xT)Fj&DC~@SL@?c+0NznYU{GXE`^|
zSU#mJ{CPrWyrI6u{-uRUf9oW<InE?q>@HufzC7RWziCvch{~m{_2(z^&*msz{;HaD
zmrLKlpp8k&Z>;9+$e49EEx12ex@yYXKR3)5vK5(f*h+8A5zGIbTvJ%_<?wNHnMd<n
zyFY4N3Tzg6<H6^pA*}rU_%1)e@FU-&S;8mXy~xMY`MRqtf6B9qD`s+NeaLkYkdC~Z
zc{aWzl<UAM173aROMNMGH7)j~JYOAf#-L$?{L2PY=?O6>oz&kSy!3V{)6JGgVs#(I
zk9oUh-c**^kh!!rN~egYQg>P8R3G0()~xb8i?+wC&Yz-rlkfT8W|5l`?5}qSF^H=i
zFV-{a>{9r$vDt&Y=aX!{>%BWqO9OXS1y$EnxW9a3)W<RL^UP<SRo`wlPq>+p+?d;_
zf2eLlV6n`a-r%I@DYy5DEe~1i_NV9Ps*Py}cO8uL?Vi}Dlqt2^E~{6Mt@KSL%e-CJ
zzsl~-%U*xulb!m#-7^e$O1<8?skhtDd$ZqC+NC~_iT_djbc>RO_bZ-k=}I?oWB71+
zW#xxOYi`WY%sIAq<=w7ejr5s1!ZoSpN$zaTUDMyTub1$PU0Z&1uCJX;|Ml0?=AF~c
zoV(IoThptmJ!(c$*@xPc%_p=T&utBsySk4_pqXXkWarY}9}f@zYv0dz|NZ>`ElIxK
zl9sv`6_fWLu8m*fvQDtk^meQMUn$ldQktFXni};Z_lgM~SFyYz{ccfp_yi+=>pbS5
z(g$IRTjJd}S(>|7U;mPNvU77i!?G6H>O3VrrB!RDRasRw*+ea{5)N3zymIBcpcU_o
z<<xKP;Pfft)m;_R@zAFzVA-4N2dq!embp=S^?G&K4xTv?W)n}Xnx5Fa!_QNzXTh?S
zR^t0LLwe@C|DdhBXO-nwfjvPTmo5K$mwk0vey0Cbm#F&cR73A|pG^8zNPOjI-O;@8
zzWMW4`;0rjF)loP?Bv%+PfbG>uX>bg-%(#!yma01&z^Onil4Oa@qA3=THOCh)kk;H
z(mJaJR*my#X>aECe5&hgQOfId;%(R}pTY;3L6Lu$G;`nbH7L#d(p3{ZXXpDc{uyN|
zdQJf>-Zrv{4VwgWQ`_1&Cggb(rtgV5U>2#Ns;Pa|_4DO(o?DFnvNWxaD^J`U6!rhp
zs<?BW{`%~G{5#_{j+h<&Iw6pQDea!0jZ4UNW`Se(&g`hxk?4Dp6utiW^#egYyVo}T
zn=!qBH@A2FO%D&<)dw!AJ`agq#k9S4&hzhC^X&t!I<AT4*d9^p5vE`rUA5p=!U>Jy
zz`Gw>#cY=*y)(HLm^Der(1vZAhPA|$1rfVi_vn?bc$ZmL6KUGP*Yz{k%}jss&5rF2
zPv)mAy28QrGV>*)cT$mP(Ydbd87rS<E|_KVq@qnZFG9#ljV-0C<L`|VC*4F=<<AaW
z@ua=^dS}Se|Et%BO(}5tsiywZx9pLdQLEjgmxs<aGcH>eX)IoL`*hvUmA&uh9eE;j
z;Ea^5gDt0=&)xMi8sBU?mnD9USE`PEkx8u175P5KGKB-Y8cQneriS}1y%o0VXRO`v
zzfBIay1M?AC%;m2t~l(dtKG8dr*x)>tUG53&$=+15LWinXDv^-zG^wwDz3kEg<=1f
zQ1L6v8a*vjV+GxH%%6sRnOiCQ=C$Ab$d-Lkvv@f_y?n>NpFh_pJT6;u$z8|N{EZ<m
zE=*av+A#6J4cVTf2~(eO{9Kp5%U_(Oe?f=Y;bU8lFdsRWo^RAN=~Z4(OGf)|=P=>m
z=w+{E5C6H9<nwdKytv0(!^G`B)g-&W*dAuw|Bc(vf3~VQ&yn{UTh;2$DWA~#e)8u^
zsqKC14nI~_yinPEpz-uQ*Z4)>IVFl-JqvT@TUDB&dnIt)QGUNeS8usY<kM7Yyt~%C
z!#5-#sO|HU3W>0D53YyVUddH0+4%XyBAq-%(<^q-<qe&hTkoBCaGv*W`_TmjUU`lk
z$7<$G`DT@ypApWQwZ`n0(A?0^Z_Kn?`(~Yyzu;n<5xtB%Qpio)((H8gY$m-E;z`$i
zADGxSrTzZ6>i1;HLKpY4-JC3Q%c8lzFaDBf&34oFd3@su`PhqY@0*|ddcSc{=<MCT
zZ<2A#!}vRoeeQfdv;IAw)II)$X&NW$4ZI({_3n65|1$kJ_vfm;Or^mZ$xqz;zNvkz
zoOzjd9$#1Xa)J96zbvmMESF&VTI{pJkyGsawakCNt}##Q?JlkNZWl8udm3`AVc)0K
zl?T5uEHmto<xJe*St$LITaNk2W7Q{rEUYU2{@pvBJAhS3y=?D>khovJo}Ql0;q#mQ
zU-Hb~rJwgiY<CD-Yp|8^=Jqeo50*|`uDFJ6o%H>j8=Ehz_H(Mth(EZ}E&8C3=7T0D
z@wcHBiEcY|{acSc|NH1rcfMU>@8s_%esNBUQ=YcCLwC*lf+~qcf^EGo`Zuj;+F-LH
zab@vp9f$0KJK?|PtPXzkLFUEYFsapQ)|M{mw>vLP-ZocHQSQ!TE1lh98U6cw3;9EA
zn${$HL^!Svb(mG)rOB}3!qzqc>Ah3Ap9;=g_BH28l!nCOt$706Vr%)eR_jI^tE5O2
z3!VR-xvs=Qeo?a)Kf8fO;^U;rc1pi>Cu^UdwCH8!>4x}r27#5!?Q9?TS&JCv=WI87
zq?ff&#^=A5LXCVAYqj5TIqd+B{g#!lQsz84v+bNnbMg}DGmn4C-4{Kb9IK`(om}U@
z@J?Fj?1jeL)yHn@Ce^S9d^kSgCab^$wz`(K1l?CLHD=QM^H|*rtG>C|UY>if?a?I%
zjnkIyJ9_?v`5v9R>&j1M&d2J^))Kj#tW2+btlXV_@@mz0c==eJowV~Ff9kZzC0rct
z>zs9erRIuVKl;Z}d`8d2TYkG*l6Co>@*R0!Z&mv}TyQdP<0JM9uVk#=A9!KmadDqy
z#ul|{L0|t(na<pjvB4v6fnV`VUBMo=e92jD6WU5Pc2}gk$1g})F3zBS>|$Ko?jq+~
z$#X;#)Ss7$W?ED(E#KC%?Q}xJ{u!V0Uc3zH;!fl$W)S<`xFY{DkLWR{!r=a6YuHN6
zy9_;-uLxfl_vGbS6X~At&8#=NxyzF`A1K?Y9C3K*4pAOSffL~`=Xk9sd*D>DO`2b7
z)xlEp=eldm-)`OZRW3bvhBep87Jar4^%gTuf79Fh)jq_2@lx@5OFtEz<<5I?^30`@
zIVJPg6kaObG~?BJ%g8K)>2G7r{I6L=+DH1FXRZldwCl<-N#R~r$r|mix07~M1O!PR
z+T5LVYKFtwm(p>&Cn#xjPd{7ZVQ|4N@7Kk(n!56Pnpb?(`WTS*FxrKK$>PEmqeS%@
z%e|ZnWmX8j5>~rs=_2tUb){UZK#~jVySsdOlV56m4oUtuO-m<uj=9N`_1jB-#;MPF
zd#8nUvit5y7X81nG9Q|6dMeBEWZG&=tBW5Gy_r?N^FY!}!5K2g_D-6cq+qpMd1Hs4
zTeioPvX>`W9>uxMv^x2jNx$&qpGM^+?}Q$jUdqzSlCYhz=R&5<wFAbCncK_W_gTwt
zHr?@OGjmRd6vvT*K-q1slkTa6pSzcN=hfWv&N5F^m5;XG@~a3CD=yu9;@Z<}R*_km
z`yy;ie3hO|xFo#srpF<-rQT;Ad|xp4=8oACe<JH{D2G>0yS+_T$n{)nwBNFInh!LX
zjk84-oPM__aYgPq*}Fy`W?kpCweOHxqAp|G{3FzLww=m~58oO8+3#9-VnX1m%Pjp}
z?EjqK-Y-d?wj@<>Q@X`5r$r}bt>e~uYLk9(euMFpoT#N)Q#TvlPf?xV<36uNTuwYw
zI{1_F{}(YU+kd*`WS;z6zwZz45200WE(xEV!`Y)geda5T?qzRV-#2c5cvH5<;>5kR
zZ|6@aKRdzsPWIZ6+%<Q<Cx_?$(2Z5m&tCkZ#vts~QSpyU^_B~SIA-Tff3{Xt?eF#*
zv2*>iRZlKBV3>V9#3t_JHjf|{X_lStlQdsljmccuf39T3<>V~|P1|yG<PWdlGW@oS
z*-EP>Io@xX)h^DqGJ|!s-WO{5jy@~1o2|Zo$5t_&!nLNWm(M-EG`cuyN`Y&BvAIO8
ztXsn)t{C@SD|gNL|E62-_;D4vHzkV|d~KI4nPFj&e(WX3SH}j6Td!9NFMMCw5EC*}
zBVgf<%;ICr<zKgPHm!`C{r+{8<gdMJCKpW-H4`nGqsO`?C#J<qCL)pFG&O${yDG!B
z#r3zD+xdFV*+<re=8F7!e6nK8k2T)M8!p$)O%WFU8_i+1F^u<W(W`XRDMF7m_uTn2
z<yc!w`Ocq~y3*S}Z+QK9bCcz=Yx{EYD}|o%CgnCg-S^^S&7CsW>}v6xUnk5Pw{5gF
zvtij_DyzNH_V2BE$woPq%q#pa8Esslw90mVN7Lu>lT|_UZMf=Kl7sEO-tXBbn-EpX
z|Ki^&r?;F-`F-4df-h=S@49bOm#lbc&u7gm@o8J4T>Cb#UEEeO*H>JkopEA&dBfuR
zQr~||9OuqXxVn1T+h-4XBDU`9UAfgEGqvW<ieCQ(Q<uF=uT9MRCHvidj$!<f=fCsM
zNj(*|o&75PWxpwZc;?0vA2NTPW?xga<a@eldd`H3X6sG4U;2-(<m(RnQ!U)@yJL?3
z{7JS8HkA0rzCQY;E3WJMi^LVh|1Cdxy>$3$&=lA6u2r_QG@j{M<jlWkHK#1!*LL<w
z=P`}h%dc-<vgf4}hw6`SsV|}qFgiD$P?kM*JteK7-!J$2jt6sC1AI9CHvO%Cv+nTD
z%l8Yn6g4~wT3+vX!Pu?!ihNUCX@JDj0RKBh0S)_P-^%}2-^Y1+>B}wiBra$wv~9W^
zt)0hJwKX?gyRt-g*GhY~MF(~F{k*YjcG^>Ot-UvQzEWdr`?$5RHrDw=_jS+eR#CH#
z+e_9;FOD$!Y7m=X`@^K0>*9T>>yN`vSuE)jcooGrStL&Ces%Zjg$EzMb2F7oP88<3
zQ}B3>rio0~>lY<CCyqbud9<fzi*9)&N7j@%k%oG8ag}jD{FO8kKYr-k`{~KTPc~no
zr!ePmZRk13>Lq=b^W%oc7a|yxS{wo{b1w3_x8VPlX$Kc9j#Nl!J<S=qW{$?COLvd$
zl&F1V>ZQNvVd$pfhTnmY)UG!2{XB9)+mWZRolRQx`rf*~m*nm<uFO%{lz!Vd-F35}
zg~|iIf?b;0>KfNgJA~HmnU%2HW8!X)t;Y<mFj=0xd!IK|-E6vaYqY^MjV*VIZP)4v
z__(NSi`~O|UZ`~StoYQqx`C$E=hfVdbk05ca;t5(YEyueQdFW?$_<z4$Dg^X^K#p*
zFz{?y&!ctZ;4~NE!;2q%NKOiwGFjoJoy=a#s`4+1|NmtCIDGu^Wam}0<+^s(@7cy7
zKV{yNz3wxeRC6>XwRbQ7Ve0Va;9tXcuT!|H*mhWGmbR(Blnqbaw8QPg$=8qklGZGc
z+0~p-Ip>q1hmmd(NA)M2(@st-&s*}MzigkTv_Ag-$Novpvzy+%s$Tkf(S%PcJ>M~G
zjF_{_SJv(k&pQ(t2ATFRA3|rEemJo!`RB%*O$Rj^eUHi<m5zy-me=q@;7F@5r_Gt;
zeRo}z4L7BTZ?yYzcB4x9iWQySjBPhR>a8oc77**Ki81y#sQmE2$E!?AscgLZ$r@}1
z`943jH1@DMUvQsO^-Ow(!WI^uof-^N-44xpyUM40W5<+7CyYXmxBU}uUj3?Gk8|OJ
znt~b2C3vs)D>(hVl*aKU$!)=+yddG`hr#FP*&hCXsN%}ZlesUl4*h&8Hr1wzedau!
zAcadR^Ot*{J99+SA&BK~;GM+kqtCT_u7<YrPnmi|WSjq-WuG`NGZ||&&zNdbf86_o
z6pKz@#=cp-8XBH2b63w~TfX>O!>@MUecg7Np5Ir>*Dl($^h5YosgL$bo7M>iiKcYF
zWHRbeTBc{>@~m0t@An_q`D%D_uSTyt!O+0<^k&_yM-Sc4tGOD^`1A4UX8($ex>fc1
zY%hdnriFX{YB>94&i=ZepUS^zB}JJqRw*u+D9m{G)&1`a9)ABc_3WWX@)mVlt*>aF
z-E;Bx$1jI}w*M_Z{J5N5U7o+6!HG?wk^Ol7y}5N3RyXXe7sWO$<}?3WaqW&zzv-P%
zZyxjK`|~&VZrqw>wdC{Z6%(_xSJdx0F4JMO)XyL->~D5M;pQ$!?gt%vEmmH#2|uLO
zobf43f0>IG*Rr`g%qD9tSM$B|c7N*T6$LWu!mRw$1#a*hO-x8)|Dk{4{hI6UCg-<3
zUUD{=_tdg`Y_HVMO~1%}xuPIcY_;qA(7*3?iSD(wwZAp>Y>0crp(c?vne$g2oqF0P
z)>qi)WEbB(wS=!GeWkNJcD`qpb^If{<l{Nr{^KVeZ+vidLvPc)K5nDeFAjHy@18zm
z($dc>1DGxuM>@}CIV^rl_?C+EPH$bu-Zv>LH7Bj8xgc`O{$0~*+Xdn>+nsMW%}$RN
zkFh;Eujucd$Yfjlg)>dgep@8br(9}!>T<>OcRN=dp3PGd*)%hFlFllJ*_jO~8Ea;!
z|9ZHKzvL3j%76zNzO(95=Z5km$t9UuUK6Zjc)x>pO33GrTtZi8@9J8Va(lr8#+~A)
z+g(2@MK9~+b-OK9>&qY1=a&{E6>`um>Q(V7mb16NpEX{%gy)Ro6xFNDp=Y!gr7qK(
z&$4B9_#b!vT;}7vEe4zS&&X+>`%#=@uj$MMmWswPiWAnYRH_hnle_uIsEnnHN%YSK
zH<2Sf;S8n+)C3YTTN0xu{an}>*2GyGFh_ssCij)Me7~4oIV-Y`VS-Y$!iF$r$pFa(
zF7jcIv_ENaKb~t+wEWhEun?vxzqymnb3eOz`rwgHi;MDa7c733u<wXd&{@v~zdY}7
z+@F-9_SJiD>)B)CXYOWfTBDl#l0Qva@lfl;qrEOt=`6uwUo#Y~q~m$`JeAg(Jd$0b
z&*FW}?&j8b#|N7h7!}RpKCImGXVZqvhCK|W2UC}B(_9$*Eka@S)62CvzrR;mn=3Bl
zk^kj+I&E#SNmu%h12LUpYlEchN>+un)kH+_Yn5ile0y})B4@|5DANgV&#`Fc{s^_N
z`n&YKDF1}{H}=%Bm>HNB^Q%eC|7f+qAym{nXvUE{n>5NJT^r8&wVH9-KQ-=u>Afd5
zol(Y4SYp}r1QCWe3uml}`IS4XY~uBzzl}`u6NLU5TMN(M?-Ed`vYO*pV^znS{+4%>
zE?jz~%{Py?q{2N{G=6sIo9e??S6j8X%zh&Gf9v-y-@gkRg+ICpJ`KvB6k=06#X$4L
z+R2f3&gFh)xx{VPE5u_r+r#jOiI<U5SarMm$t_!DbCqu0Y2{x3H!Y}dE%UOA=KsY5
zyqQ@<7#J8h7?Rd)kD4~SXy<cA28Qd*3=E143=Fxc#rb(jrI|S?`bmk&*{OLc`g!?z
zsZh3FLFL+D-|RaE0(*al+nhKU*Wr8Pu@jf?<!Mf{#dckA3hL46&lQX`x>T|Ic6|KF
z?EILjmkXJav-jPrHh!#K^S9`~?f(@jlKwy2XYs6dn|S--SA`V!pWAkLuKRF|Pks5V
zzKwft=52h>G5<t#^DMq4Z!fgl7<AfsN~Kp%Nj3iTVujAaUk9z)432F|NbU7c6Q0kO
z8pYB7cTQM{lilQ%e<zie?>m1l$?*HFZQX18ZMLiuyMN?$Ue0|vRbD}TPob5q-zzq>
zJ!`u8=iZx1EDt3v3g=CnB`|58uc>Lq$qB+fGu7|LICm*_-CDRQto=i|Q}wQ62eXfc
zc-g(%pl|2Dz{&nyceUzI_m1uZ(ofbe>%SXfJMY4^z9+^~uP2<mxbuQb?X3ip5*ZJp
ztK3R0*@jhI<^FO%m$qc-Ez#RnF(+W&zdYAzb;?)75=AVM8xCtM&N{P}{dRZGpO8Bb
zHDe?0B)xa5^16I>)&Z}7^-lr>qe>N+8=Ehz;xmbBP~*zxE3|Vp)ru9@Ej+m}{)pY}
zKgx^SO?S)*`?{3#c~Ze*wff$ylpp8%cDbqZwYX`>vbi35`Qf(6>T5?-bq`Hm`u_aV
zN1J|cSUPJ#Px``AIkWFu7}f`=Th5!qb*et_<delS?C)L*Ob9<W^;FabjoAlO+5WMi
zrV{f_-vid>F)%!T$jG3KJ(ZLd8yOfHAkxX(y|vZ1k6kqXwcnmKZ)K%}nMkU&XZ)1t
zT+zs~lDpfco}M&$j{BvfPAVFTOq^m2s;k$X|85!oxMq`a{_ieUkCSD$FRSmm6`|C4
z^X|>NH)r0Qc|XVPxV_Eq%Gar8e$PX9m0EZ{FEu-RsYv}+w94bvC9hw8__+9N#{P&q
zQ*S;Em9?$?^W?SekMr*rO<rwMH8t$0&8#KnnQ=O4ABsYjpFC6f@c-ZX2XmLlAGG%0
z-^cg7bk^bNPZw!Sw$gsqFXwwYNvzlHa_U~4%NI3HrG1E%RsCEUcv<<X^3Mz&ldJC|
z=T0jPeDdqG)BkUI)A-eo=2)D5Ciy43e$KVjS$zDTM0Qs(?RWPSm7TM~ecI`qMRn`n
zi{1PqwBP=rp5CNiTIcmb{?|3wvtQ)DkpB6$|IM19J7GT>m4cW3`L^T4=Mta8fg<0!
zRSOo2@bO$dE`IWd)m(qApEqjuo%z)H|Dle)-rw`bj^<2!nt5}9!QqoliYv}vz5nX>
zy~P}L^A7K3o_FK@wCU{ckG*8ttt%f{KmDbW|FM@Ev-{L;mdu)V;Id;0Gw<Q+%5PkQ
zlvE?!Zra@4uaz*-_SNcR-K~dvlz)A$zhwQj)@uLBQ%Qc=Uh^ys<auYvF4in5n|J1t
z8vm)1NmouTcE4$2B{}a;yuD1%xBd1v{?9*rUB4`2#wVwsxMz`}vn><vy`4IJ>feYq
z<E<LOKh{@$xlr?^L+<ZFow`QNzOs!6pDOwLuihnd!f9c=Y}g$8DihD;ft%KJa|%da
zUpzZY<<9GiFUlGOKC7Pee>wSK`H%ab9aFv@uRQhYN~Qg+Uz6i}55NB*F1II>vno2|
zuy;jb-R183GpkZ3$zMP18TRJ{|B>bwrH1~$U+v9_yXrab@RaHIb{}tF-|zn|ZeLB=
zk7JdbX$;#oeb@WWTz^Vsbx?lc*Q6UVKU?l4KXbXWwd41;<n^sD)HF9gQSw*b%^eta
z@pWj_|LZqxuAODAf3(-A_gz<Nh~D$!JKwgLR(#49DE51N(O9f}gGj>8Gn0O@EU(+P
z;=j!22J^)X@*C|hOkZ*8S@Qe`lhqF&-?8Z7?WAefB)90b<Q+5E!Bt_l$D={iHR^1#
zlrV=wM2PE@Cm-ggKJAO$cz52jyBf#R9<9(=d?VkkjrFRP;}O;*j`fa_L5F8^^))X4
zH2s#S{iXIzH_pf`SGe>1-Sj=j<}SUH|N6(}X?^y!7035;mHt`1uCM-ULtp*fOCQ(E
z-}{*FB>R8a>c{tO7CgScrR2}|#=ghJ>8nz|w{AAhu>W#yR`cK5j1BwWOTBq7Z*b%O
zR-SMD{1Q1Y=9;qqK7JwL{|(a{_I3#y_Ve?9%goSUE0ObI?pL<oCMp*5$~gO$zvkep
zXOn-NV7)8D`141tU;LIU9n2nA3Rwu0E&BdHw9bL=_M+MLZ|ycdlK*7VI4`8TWRCCq
z7cE}*Rg>3RyP3}AJX~R+dnz*M`xz;TiZw63%Wsqm(*3kXPIPhRyqGZMfbLat|Jb*7
zPhX(0Q17r*>sRy7g~`dy|7_j3L^a-(U;Gx>qVHZ|X4I|y=4p<EZL@OEj8OIKnI>$!
zhFZ%6O{GLH95<THu)jlY!#_3cX&-*ttZlpav2@#k@aNI)Uu?E*IP!VF)TV!>Qu*?G
zna?u++gTwr|8?8m^Jh2jztFzEj>G<Ux6P_H^)-x3pHJD(a4$)|pi*%8mzK^$%<_DV
z=Tl?vrhN_N_c-=fHa+Y(Yee+t)U2|eEe%?loBn@!d9E_Pez)Y?P*EPq2+mUuwNnMN
z8#-4A#~jfAS+vbVUC_+Edr`yxDN|R-NPgb4>4a+WS(hKXygskAZTr!*jqmHpx7#-)
z&Cn6s5#P}EGG$hH=7*OrPRAzY%hXExc2)-a&Xd%d9XRiKYURvx!5c&_UsS!3raVPM
z+2lwS_oY=I_bYF>5)?IagGzah(}!|?-(8CTo=gAx`t{!G=Ew5izVW-|-`~?xsrGS8
zX>e}hb`#4Vw)YPDPhhFL_5ORiw?yvE*Twr?Qs<{W-n61C({|UKnC}PVRuvw9`=EMF
zU32HFFDrf8Hz*zt-)mGiv7xo9((H|`_v+WXBK|yn-u>vV!2e<s|DXNIHxw$PuK(Tq
zaQFRM-q%4}8?Igd@Zsp|#pdk4tB<o^(%jJI5V3S}U}&FvrBQpY&L8blaiKb=3t#2F
zklj1!q39gGuTy58FVDDmV7v1qfxQ(H-~G4Gn{!*+HF}Qo=jgEB8P`@s`7OV>TTbB9
zwEwZwnx63Nt@-oq=jX%o-PPR}Pp@7dKj+Zu1l?S>{2q;oeQp+~Qj2D~?ai6Nw^(JD
z-}@gAIzMV>+N^zKcS^FRFsxyxx$fotx`j7?r!=tsxR6>l`P@R+O}r0X6Hg1+{o*vc
z6&e_l*)U6Oa!BAFjm?ok_l|BbJ<hr6h2*RUonPk1iEL7FN+_R};GL^~q^Bj9cWr2a
z&9icY+X?ZDBaVkZ?UX3{CdzSvb8d)biD<3G2BYN($&+5R*3Q>g*IdJ$P{Nw6=GfTq
zC|NF6)m&4k#dNa!QK6@vv!-51DzxrbOW2o|e534Q31|G`y@5WhMO$@KR_AVbsJ*=~
zFH^#`+M`tJZd~f))i1QpI+nyQf7$e_-ng#a`M|PZsYmx0Ucc}rpsdDL=-NurmYlbS
z)o%Zc+{#%cjyz5cZO-A)E3(_Vr8mb<FG?}F<nV$EqV+!SOL|2;e>YCMwsUXw9lLdV
zO?kHN>!{wH9zSbcX<or})>^fe(>%3?o0I(Xdoo<#-{R$2n_lHVg|nKY+jQsQ<kY~B
z(6(o$vew%*^<}rl{oFFMS=DM?;9Ez(2S>sz{w{G^dLcnyHtx~8D|@GI|IM7qXEIAV
zWXgjb>P;J*f(=%_&tT_Ek#)R%Rdi+ah9>n3i*=*7u(enH`XTeL-B|D$i(L4V)f=9A
z3;7y-x_VHmr%JqB@SJ%S%jM#4hd;cpea12Gk*C}Gt1rGCY|LleDyLx(z2QQlk(R`U
zH}e|rO|4jWVE)OJNgq#L=~fkb9wEQtL!VHuUw(vO@PXT`RigQqE|_g$nf_&p39Fc<
z!>kssu3e0;Go!r)vy{SmST-L?-XNMCKHHaP)vS9bjuiZUD!89#mZpr>%Z!-)w-uN1
z?~*nB*PpW^$I1PjZTz($H?zr>+x*+kFVKIpzqo$8O!X`K=g*b=5*~<Vs$b<$eavx%
zRnB5Vxy$RelJ2`N{<7D;nbn`@HTAksZPt#Bj-l+cP8zL0`+7@G^)*i`Kd~2<)5ScB
z+tqmD{lBh$zI;~fbHR1rxHL{b6qY~DwS1`>_rx!^W;}B>Pd~pZbK<d8KRUFE`0E4X
zqG}fTAO32;G|-&gpk?3rRdMp)bp!vbzk4j_p+MiW0<&|Mr|8Vfu{)W!iIYR|M?s*@
zG)uXJg`(a<(PnOjs<WL|7<0F|DW>1FdsKJX<7TW)e7oSfUChZBWt@I1%wE4UsZ8p0
z)!y%ZysN*=s@7o57G*R%9w*o5V6W}?r~jF;fx(q?*Ur4U?Nqh5Ox{-Nxo7ClvYpRQ
zxA{6O`N+gzB|2I7Y2hD_++!ImO6)zi0{MNVBg^DphR8n<G&{6+tMe(_Ex&CVjgQ=#
zaCOp~mW6qH&(3$?cRt^?=)%R^wx=`tFV-6VdG#^e|DQ#T(C+miKll9nG5O)+<BiYP
zXiFM>eGr&7<u<3Gu3O34X^)ai^sM+T#n~0Lw%4$l33)E=oV9(H%j%~`RkXFsCtfnI
zIpZ&~)pHkz?b0-seV6t(6<F+R)~zzvp5mpri#<!S<itZmj&$91kx!n4h2C#GF}u;{
z%(e$U^V6n#U7q&Xc=mmf>nm^cc)1<hv*v@se$5k=jISs9JqbU)Wy1@{OUqvB1?&6C
zOn4MD^X`IP?wAQnwQdC-4h#)(zGHJZzANY6<b&BpKXwJJZaFmJXf6L;n`McqLCcHp
z%vYYFps2X^wD=Crd*>Ej-{c>6qI>f6C6hn4|6Wo$@51Ya=lPyb{&IKctMh&-xt3pr
z?g^g@jGu8}nUzK0_sz_Ub^8uDMCw#F?>M#h+MlZzkDU_zwCMN2u&yNx50pw}tRh|g
zj02`s9g;PTXxE<C+I{@EwaAxG=LEtGyf!Rz3FqEfns!f9%<7Mn%kt;1{=2O(nJzl(
z!wo0SX%f5q|13>j@36PU>e}>7ZeDZO*m<kDEd@?5T5(l+^^BXlj~BgSzcJ@#j+t=G
z*I&MA`InZiF<LHqUHz2gg7troo!+#B+s!ay;zaXEr~4aa8<cY<oS$&C#xl!H`;+FG
zpqC~FHm}Vyw(3VctzCTWj`(KNv^%+#YgdMCZolH%`0_@Lc3YDD>h>nSmwf(<Hp-RH
zU1?^v;r7ihbLVjW(Y58CU+JG({ABr!qh>dA&T*gknx^-9+VQVV#q-3y<Kw5ZhqL61
z-!Na0pZQVy`6BzR(^EIbFz5<QIewaZ;#6CAwIl5d?Dijcp0wV0f#y@qci}(s&-3i*
z4|o1C(R5c`arZ(V-H+9CewFN-b8+9smnP}5TjTP!{*?X9K1CvJ?)e4Fa-?p&u|Iom
z_V1-TGY;_{J^Nc!u1#Zd<IG7LANO5S@|%0(9*<e|z5KG!Ei;c@TddsleTQJb`ctFa
zNjp3aOcLupANx$``X%G$tbMwB*0>og`Ve)Dd4>Apyn6Y!d#?(cr*co&<K%bwIq#u|
z#qzR=ul63(KGbr#+?mt+RqmgsAHMSE`~TZyxFK!Z`u%<Xi@tng+27Cp?NUZx(BBuE
zV~qFSEPUC@5y#gbl*G87du>nS;hwbL3n$9T@2%ZjZ%|eCgRR~DY~;rv=f}+|j&c#z
zuZ}PJdH43=>E}gG9$<<)JHv0D#ozn&zn`5w_<Hh0bH2Mz|2cPXZ8UdxSD!yid#*|4
z>-7qi?>`<%PcPw@T>s=~+Lr0})yhRJIVQi@cI5JwE8F=_@puYvNcJ*VVIcKU%duHj
zpFMy5rOF1CIFSYa*?E-qT-f?9>Ti0s#7~W#D{2<*><a%LVD%y0hFQ33iCK71?+LEM
zk84=spWd{2%Q};vzvXVzIW<-Oww+(Er5D)$d6yd)=bT@D^~PcU&gAUyxA}!G(vG_P
z66z&0_|Dkh6J3%z?a9simt$?X5BW3gE}tsVeqZ|h7CEN_hc2&Gw|;(c`WMgQ+PIL#
zt`6-#k4)y-a#6;8?uO;FWDbZd(hZ4u-^PE?aII~)tdJ?EnSeC^7S;rN*-h7W-Y(VI
zHKoBS=%K^@9rkN}I+^q(bu-sTi<!>l+~Zkw;M{>1PA&aEN;YuRYqwlo71@7o-ac20
zIokz}bn@<GbkR3&e>a0Y+HxPq@i$w(?3uPX%H8t<&(^GevFEp5c5c)-edo@uo6{KX
zP1sm}-TZ&pt(#GgxuR}AyjW(bxa$vJTGr9Mo8^9%&dxh$dOjn#q(h-7c2?u_H@Bru
zJDv(xdH(3m=l9W1qmB7zU;GzpwQpJGo6g?3_rETFYE#>OJu;zF`((#Q(~6E>$LFh_
z?BcKgkQVyu&6i7D7dJIuum0#?anvVFd%I(zm-$p#!=*Eh+&i>6;%nmcDepJm*tB%r
z2fe~$7w^3C*tB#(O(^fjgAXe<%J@!>oOb`_-|~zDT6OZlE$)Bb@$Z*Dm@j{)G1u*6
z&Zph$4P$!b3-*P6KUXd)QMcOq$oZdTwFXO$E|f8NFLT{+%Nv{bQjZ-^pQ*P$W+8r>
z^?@;$vqU4~#`Cg2*6ci=yURZH^ZI#Zfy*>KCKc5j{XAjH=4U1+J|wtZpH(*h=(pFq
zFS%ItT~Fw)`l6`wbm9)@<NTU?PCq+npr7~gm6C!{ZdG-D+|4V0>{<@1+&{PaDU-5o
zV)<^tNorYK%In_zJCWIHzb1Ii=BGE(CGHjLP3^x^GVSjDy$yT!-A`vVKiPh*Fd<@o
zhGKSF-5swyzQ_As?`(Cty{gRO(#AEjQ|w<qD%+L1Ht(`{r$EM;4nE!k(ZK-%K|$qt
zlWJy8n(X%6|7()3`nHk)rH(|^&2Qe92!EZ}dt-^zTc1naPoKJ*Ihf>}Dy<ZsaX@Qk
z^S$5S`=8zP5ZpA|C$mkt;?V+~?oGQZz3oG%Z&r+dG)qi4-=@^ir)3|@WM+-%ERH(e
zzKrnoq2H&4RrH#>Rs=>Z5AF5;#&qAaqvH1URIdNIKPT-D5dAsHto>|H<GZ5U*)9@M
z^Totc&F?JGoAy|{azfG4S1H>fPKMvitzT)dvc$&w_3EUgm&dmXs3hIEJFo6~3+vA9
zO$)UnpY!`BCM;jgo4Z`9BR#9!<L$Azb9wr!Q_VeR>x#YH^L*3B;xjikMqAii`nltP
z_1n7=Yc8&}|H1gCd&#G~EtZMCGbfm6U$YM9TqbrvBSUymsQCYiJ^x?b%y@sc`{K!N
z;UDGytA!pM@R;et<+oYx_rDhwKjutaHv8gjt*=4P9~A8HJ@_ahDIzC#Ps9}CP5G&M
zyIk%*{FOQR(}hff{7-jM&bjzyH>U3uoV~#1_fw;@ni~>Su6KXD_bGN-x@Tp1ncKhK
z&6{s{|ClJ_q2ijeW#6yK=RPgEw&(YRteCX!suVq=vjMqj3-_ORE5@PO{!uUT#oSwp
zPp+)23UhvVS~>q@%lk4H>4VSzyfd2~e!1DpTlniaKc=*YrkY#gt+$r)evjAx=Xizr
zqT}NY%s1c7cGZ92y3GB|V*_dBE7ouPG<LWD`=Q^ipx?Sq%;lNy<KFMr&eY!MxcB(6
zd{VWr+(Q1JVpo^$dZMyazTePsy=ncm+f$GG@2lKX|K-)!lNT?Zemo)IMU0fJ_6^mZ
zY>R&zoBZCMSCikL((3&2nD|w<Ev<KN|6SCz&E)jM^%lRB6r?{KUuGMzv+wr24Pse`
z4~raMw?|K}ZsX$BN1nFNull}I)wO%q#qg5(?!wCF&6(uZdh|QB7RwZDNwBiqrJ$;M
z!X@X;7Ky4rpBG6%^1qZHmxnybFgSNgN|Dt(FyZ~lg8Vx34^DH#jvCKRW;$2Fx#)}9
z-LK3Hnp^p1-6~9K&pq_q*Urntc9(Jco_V#+M^n@9-aVXf<+T0>k(^^GafxP}YAuB<
zJ%7ts*z0apgjX$J(rVB8{bk&Obc=tT&rg=-9d_hBIg7`Txw`Jh=he-!ex0W+T=(fU
ze*P(YEab3{qrcF(-4iEzXw`D>75~w4wJ0QD&wH``F^zqEt0aPI<o5LBZAyN0uKu*c
z2Y20hmpeDVQa{I?@@8An@3Td9`eEx2KlZ<%tNm>K(qzjm314;3KfAt(FX~+FcFUT-
zcG8Os%~T%n^xJW)DK&nuExF$G?pDi!>eh#x|993z%obdGaPogS9geRIPo3S1D@x;+
zoqW=_i_1DSPJ?mj<YFza0uS}IE+;s+%U=ec=bHEVX3H1mnew%JUuz2)6}rBbeE+49
z^YTZ(CD#kM*=!3h|9JbSs!ws{A-7M<BcH#n{`cMaPPw~Ac-OmC(XZVE>!l3W>YmOQ
zmHy$IZuDbu!@-StvtzyQ<y$Psv%G)j@Vk#mrdK!Iaxz_e-R*U2?zT^I^G$cDWn`K*
zF|XbH@@Z=QpC6GQQfp^qnQVIaL+j)-+sow>Bbkpf|J=RUT(|3R?UEVB8t)Iho0RzD
zvHqH`rqkDjS*t8~k+;3Vv3u6+C1pZojwN%?S{|P8D8ywt^IE>elOwoaFW~t#Q+N*l
z=7N~%rwvnQ%YM$2o1mKMbRaN+zc)ibqg`r!!w2!TU#hn=<ut9hczc<r#i7lwR;KGZ
zA2PhwcKRqw{+p}Cyxx5OI9ZA{wrjI8Xk_!%R?kt;yvUO>OD6czFALkF2|ogE9bUvT
zao#yG2|)qwU6J{Z|B7F2@3pIG5qszGce>ryK<@(YfO+CJk;`6`dZ`O7&FM{@oM5|1
zvt-+{mWaP+ZEC~6n+SepduM6%D)sio>%7jL^Cn1?S|4Arv&wK*@SiU!PlRX9`5&;X
zP_Q>4t8q!k&ZQ0N>B48$9u4a|$A3nJAx%v6me>@(vwFL_Hh%~`!)bGMLDIe;+h_i_
z<VtqsZGLnmV3Ekn4em`9E2ICckL|7Sa1hX)=k@2~tR_*mx8Hs8+0OErMYd@hJm-$z
zEU~}i(8Rj8-|eR)bZictd#vko`Nv9&Hb32t#;?)E1_w4e{E#}@et+5qz3Nr3@A@BQ
z|J?az&E`s(u5(7;HMUHDds}4d(x+ao>4uyKFH8%2dF1SD<<iKa!sW$%N1tps7yG|d
zbxBW)_iC&2>w-V8E4`RpS{riSp#9)Zjo(IH|KH!3#IwHJO7w?{$(@%>O26K{2yMxb
zHt5bdAAjIUocoEFjPoU*6qe{Gin81<oOSt*`(>5WYXh#GeX)GaJ|O{~oFsw26@MNZ
z+PiJPE5bWFv1@<k`91mTBK{b*tq<I`>Wz?@e^6&e*|d($Hs_wL53%SoUzQvx-gN!v
zoQ8Q{Joc|husrC;`K;^P?c2A%L}gz1SmYTSBww2FfS>dGC-Et_szTeRyzSrl>g;6e
z883JETk3z*IXwHW!yTrzHy-q=$*(<PcBf|l96L*SGd{Dgi)GWVtzGw~H@N2e$I8z}
zjzuq$Z{{}oi0%^ee6{O}-n59r-46~OYA_3X`t|rj!Bul=dNjB2$Tx=;&AqqvSIe4x
zT2gDz$2QEY{_8*C{ggFwVsFmmnWp}Ef0^C8Q1+Zp$NKlSr!(F6{l8GrKes#TId^;X
z>-C|hiUV5T?8;Zt;XUmx%QyF(Ro9>NlQ$fNFITL(o2PZXdUbu9x<di~oZ=<5wLksm
zIe9<7#sBu!hl(F8(=X4O)tIw=+SAKFI`8kPwY9Reu(LdN+xqYEfK9HCO;2tq?>p8!
zH(UHh)d^Xny~%M?HB4u)&AvFhS)6_S$2F7hba<8=++J>ZsB-z!Yq?%K?&b4+>yNXy
zule}xEaRNBl6&gR7q}Yf=d}yY*_ye8fj!|^vU=7M%}W+SjQgcEE!bB#o_oH$QT&U_
zn#Ueoro1*0+XE|1?#S5xJ0Csap9fnn-+J#Ad+U8RRtL^1v@ZzdvUzGhv3S#L)h&*1
z(|>;6XT583V^+akoh^|c4AiX7?>*7ot@6I^*_vm|`y`j`TP|{@w&_rWQOy3X@D%~`
zv)eU##Zy<^%irR~A+79o<3mBOfpBIm&yuzuNyT5T^e!v;x|;1-kbC~DMTe4aME-UC
z+OPkiW?8*w=(`vt+q(x2@UE7d;kPy-<y`jPb3a?IKJ<C{_gTEywZqHyuXuIsXSjP0
zlhqr;CtmeA+e2#4MLOS3_6Rn+qx@yd-<MBq)e2=_?)cZ@7Wg~p#hlzfg8x$<3;gdi
z`10b)Q-KQ=r`vWum?_E8CR3yQVdjDhCsmfzmacGTF`j*2u<l~bp@`_GMSe3E=gbVx
z?94Q+G&^^}@^phmjr92m1q&U^&vM0z^2@KcSD&9ACue6q`=XtM&DH}iHG}U)K4d&R
zy}8!-%e&^vM@>2}4%}SexX0q}D;f1uD-8^nJbAhyPdEB_R}KG>!}lNWTHYF`z4UBG
zzER*ub*|LV!@7cd6vcc5&aw7RZ0BbA^Ye%kV|^9(2KC$1Pe{E!TXi)#!#nF|T1iLa
z+Ct3+6RA61x|T)0mUeS@2)&UychTv&i0JtX@5LttG|k^;vPzBX%b)k%(O=&2TO7Lf
zl4I-Hgh<<#vo~*DdbGlS6Z=Ddj@eeNso4p+(Na&3v`I9&6{d)sX(`XVSS0AnWm|OR
zbZp1E3=5fK&zfGE&D^|L|5{AaDc!eCvMte-Oq1SjN?`Lnd32N8;w?IY!c&;GaXy@L
zs_f3PQ=4)#MatT&7bbkTW)P4#$;svH4bD^F)py)*v{_voYT)!$fpf>xN9&e4zT|tW
zlfIW{<ptrB6&bl*u9F26KXF}oJEc6+h;{P^GtG~)J|{(HAFQA3n{dX{ySd|p$A(Rp
zihfLK2)&v;r(mMK?!~F!XZ($On9cJea?207UH2DRs}xI1eR{NzKY#88?XRCt^4tCS
zS#h)3KKr!%g@;r2H~&bF^#0#jHTT;Qn*jg))BV1mm!6i}UH5KcZP0C(n_>xzbuMi>
z7i8qItLGeB@P77(OXk(Z`dqm9q2~S5j|W$ohnK}jE?sMWZmx3m+(kU%x3gPkw%X5~
zX7+DF+RfU9N_*pGboU%{eP4Acr#bBP@9*+<H4gJF{uY_t4+!;$aM@YDa+&Y0Al~ou
z=YM<uDf-Zox0MUn7k2tzs$JL?&N1u5tGCtrTi4Amlj9D(_4(7QKi$VKgl;;=^<;I5
zeAVsN{DQnmx&_hKoJH1FFN^(_bTC??vV_UAxA%39{_!A=6k&_Mi;w>*W}13}ZGovk
zyvUWFY#-D9!qUo%Jv+a<_Z*LH=H6X)VnLTQ$6BB5w`cAanr7NwdSP4kzFk_yCV$#$
zvr{&d&q<f&X#en_ppC=bmc81&ou75x<SEWE%U7|*K3b+cQ8n?}F%GTEF|#&u<QCt)
z=UeiTJGOH5ANjQ0+l!Ug@Lt|IZK>@yeP!P3Ycu9(tBIDY$XqDj65@00T||9C)b{Vm
zj~y;Pna%Chp2X3X=3n`*cyfU@?+GE-4boGa?rj&|RyTox<NP&&*G^|RzbbC~dE(Wg
ztsBav{w(Ed+Qyh(`hH_)grr`V>-nmS@A_PJu5|CUc<dCaB@w<T>D0#O(t#h|^_|(_
zHQDo3GoNS6rr!&-Dg+qhlomv0ZqU^E!#X8YIdAK9)+LQ49*^f&eOOw_?fR~0!lIsM
z`$T5OI(Du4;yYte(zK}WCEU)2g-l!BD~~o#7umF*<z;4Ddw<s7t*_YXHaxrW>CGaa
zQ@bBLklOe;k^g#H3B$DCvJ%@;`jYJo)32!&Kde~d&9!0f+{7(f5<7%-t_!IeUG|mU
zUdy^dDNM^Rbe_x#O*x5WGtMd|opMdsmbgbpZpQ7&6CNymA)&8#?6l$%x3vy#%_Rox
zy(>jaBRtDAHCW$=yj*0M_iu*qOaI3Y4ea{syal#~b(^i)$$#)zv)`#roQvwbPR^9L
zHf5$Pum3#htdl8=_`Xj(cSK;;iD2>NF%H|;RM>=0P+4?Dw2|Sf78^^!F@0%=vKtZH
z3-mMoT~_;W_o+jB+}=Rh@`m>>;+>B+3$o2>YhYDsH`6HUVNYMLc!%wrhOPU-%}(}8
z0(Xmo_%?nqS-e~D(YDD2?Wq&fIhq=-+O)}?oFBArV!+p|Ip&)FOIy}DJ>BgX8LVp^
zabM20l;gqYu>EN#Yi_=An2@T!aO!lO%z2S_H%3?-jqJZ`dd<ftcip;U$M)vGnCSA(
z;-%Hu5ZOi7^UvFE6%IC8>Co5~Y~QJ(;^%+Cb;a_xdb@lZzE9#(HHn_lZ{NGCbI;D=
zz;8@W=}Q8+UM)&@HQedmaj5dULUhZg1F4N`AMZ+e_4~ynzkU7AZH<1-O&v>{w%8qD
z)Ah7iHd}p*)25A8*DaY<ES_xF{$nFi?D#_UZvVv3D}D=pdA_hc!@TZvdDm(s%_Z|U
z6qemi4E(!%>f_A0;Q_YoU#I$BUX_;Iwl+@head^g&%3uynD}3(YO2TurDB1-{qr|=
z&$K-lx<@#7LVS7h-5(QwuoQQSSe)<^NtS%MHNMXL^z$1THKEtL=e~WLRWtS6q^uQ<
ze+~8&S1)pq*p@E(lIym=y!}6|e+ereJZW>?T=8{f%i_A3F-t7BNq5Ptn6OD{&8Dn7
zmE25Iw#I3^YX6`5Q02o9wuK?N8meWv?@Nz2dkKdyMD&T&&sbj*_^-*|G%fJ_dj*^H
zY`vY|H)@D~?7QkH(EoqK0{1I>YG0JgExi(W==Rp%3(p4xD`d$kNyWJCe_wjctnTL9
zw4O%qU)C`>j??y6%zuAHYys~E?So-cO-nVDF3*`@8S50LoW>V-;Bw=1=~WVS3+M0J
z7wh<^{?hK~fNq^b*SB{q>HhFT_4|>aPlspEe^qvP!_wQkQ~%7q*Z*7T%Z2rq?Ju9?
zKK%D+l17qX;90TIH#_9MHBS`WGH<EK<-gAkMBD2sZ+!7P`(4Y2&mzrN7_V)Z`)5(4
zwJi7LTwmRD!gUw7h%U+g+*Pt%@?KrDjQ`@j&(+!Uf7t!rFPq1qZ#Jhe_YWuI{1wjk
z-GZuRMW1$y%u3GPb<wn9;kH}HUoM@r!E!}*h+cr7z^UnxNlAV)wRS~c>kiyfxJdi?
zg##Wd?%MqPm3bw&*G+xbpNO9OM{0GVJDI*Yec0Vru~klY2ivZgL_@*uPX&jcOZ?#v
zyqEYQ!}82VwYMcRCm*vvttG?#ZTe%u74x1>UVq=R_HK3Yf?3|`hyC|jGR<z<)f*{y
z^XMkOl>w3la*CZ(h51Bxb_M)WmyEc4QudeBDv!e&!H(&#f64FL<>~t*EG)`ypN(iy
z&C!H2J|B0iQ`{MMc=EQ!uKcP+)9<X`r*wfM{x>7f-(P&nfhlV*DHv8H&r7llU2~<w
zTRrUP?WC3WmbE$CNp%Tm2A4^Ea9Ya2+vopT=fM2>f0n;A72imBeVfGV=z8z@qn`&K
zu$|s0UAV(}>Y}ceqp|<rT$p42Rc(59e!^OX)2m#K{A{I@;!2JBZtTtq`ttGlzH4O?
zxA--GZd)`b{_>XBuP*re^q4okntQ1z_UHCRclk75oBiD86~Ay+i_=q;mFski_pq(C
zuiLV1&%JO}<G$QPS>dnm-@P*VcJ1=#H?nCN_u8gUskObZRB&f)!$le2c;Dl?eyo>&
z@LRETyw|Ip_HY`<OXY*kS9d?(xzH!+yX`{u^?ge+&v;!4zOC?JUTNd2=?|+nZgcCO
z_I0z{sjV@|nr^)3&)Fnw|H-wg{WC*oop-*X;l#jnr(f$>g+=DH*}Z4>PkSXEo>$L&
zh=+gOt&Y0Y?C)Q-h4Ivv<gz<IN+_G?7uWgqPE2>4df<WE&%XVN4Sm4-*7xVU*vJFd
z))l@#=>D{5T}s!jx^3wx$N3*SePGePDi!+9Y|d4O+gYvbwnmTCcKb*9eRkJ95PSaR
zw}LK<BX><}tYTGio_CcUyE&ijlt)zP`9nYZmTAl?y4(7f)A``MuYWIiary`>S9V^(
zdM<fM%FWfOOBEh!Y?EE>%rQ5y<i+tNd2TQFM8pNLo-CPmRmgok<7|~RGZlSG0*n_5
z#5P`8%iVvARr}~yGn2i%r*v5_XZargTCXO0Z_&2JYu-M*;m35&w{qgT0G+%`uKk?z
zGw#)&td3JiabK)x?q{`sWBS!wZ6ACM)Dle&{O?Vl960k%R{1O6N&R=4)VVS(T%5fU
zd#|mKeY#GT>(j(-{`245QSLqSn{!&;A|v0lAN*>3=}%n)TZ^i<zK*DH-MqxF{BX^g
z;@4}EQw%rkpXPIryCF8cawnUwmYVwA`9f<Xqg9rqMep9U>7Y!>&d}~DUQWwoxi85+
zyHNAD)5qv#SE*I@z9Og2od*`UF`d78U8l&d;`J0c*~G{K3rnv6{VNAes?1MUA3IzV
zwCv6I_p6OhTHm^pd$DxaPSdjMb`Q23N_3yFW@^c%v}vBf-`4o3|NMI4>fBFyj_)LY
z%D%e7+*i13_R-$n^n|3Ts(TddU8D?ErmXUf(D7ci>fF(bFH4q{>s0NM*!-rV>GJZ+
z_cRaX@OjP@x%$YXF<{{olh@0%j!#uco_M|aNNxSw;$!+Js_MTUUH*Y{wZ*#Ny&sLk
zbDvaoi8sY1z7=+oKlef{%<EZ{(4{^9FRFiU_RpQu9y8Zz2{&8V180u);l@Qr`;T6a
zef^#N;-#mWU)3fsP3>CzI&^u=M`PB+4c)uXs`km(>pb0hI%(Yx!&f&xEPOR1=;)WE
zImx~c>mIy$5_&#~Z}EcKAL@E>6BX{59KDxhVrQA&>k!(Q`fZWUw69@?cb!c1uE!Z{
z?*2OYr_tp_XFpc1c6Bgi^RB76DwetDlX@GUSnw;kpV_~|HaIWe_R8a-|LP5w^fuiK
z5Dh5YTBI1FyJe+^v7341?o`pr2;rMw`tIM~`sVU8u8iIDe_fgNT1wUa>ccCG&i}K1
zwRcYb&S{TM_y1e<vrPZaxB2m=_ruP9-~2Y_Y}Vw&13`D9f0QORYI}b_SF3e!!;k+q
zH$O}-oEI`R++JH|mfbn+Q}P>_<eug&lJRaaQaf<)<^z|14~%E}ebZb0up&fv`Q<lr
z<qxh)TDCT*{or-+?obvnZs$d;e`@weH1#^jeNT-FwQ`zM8ewhs*Ouq~;R|juOFa&M
zoXX+%BX^1O`H4KPmi@<eN;~)|{+SVzA;%wbl9{>9W4my!i~ha!>fEcUpSU_*b}pGc
zm21BG{a~KGwXU}NE|qij+z>Pu*ZJ1qyS<cc0o!l?cYmXQziKUJ-EwowI|-d#t0t6G
zAD_4Qm+iz0`m36S*fm$kdClL~^C*A+3)A>_$9tD*$i~f|Sari|{?(Zk*KYF&zI^a~
z)wXwr+~++zxBiur2>$r($A_=oFWUdUU)aCCul`Pdp0R;ip}ij$>$c5jCI_YRM7+<A
zd8DD=_4=t(68EN?PE2=&S7kEa&TZ?mn8kd#XPsV-)&-L~=JU!q&Oz>*Mc(9QRRy2b
z*xqtuvWSby6B(l}MVoSmTp{0SS1imn{C}44{>g_IrjfRubI-Qf$^YO?aBb4Ru}8pe
zM{Q$Zv`EFDZw!K;m>D%U6wXXGK9PFV!tKLSR~Na(g3BahkHjp|;y$1?Y2D=Tu9c~N
zku6-mT@U><FjiG<-4Jczza{O&WYZiS-Ewh@c;zpzesRC=cq5SilT-5Q36U*4`}V&3
zzbt*-%-_-P3*XjD9D3}xbldeu8xC*KmJx`JIb9mMWkyWE$0db%JD=z${tSt5<O)|^
zmKky7#W$&IjE^S25HPgZt6$VJIdG$U&vKi`3ygghGxb&_9{ic_wzs6h^2rm{sb6w}
z=Ka#^UN||{Mn~^-$~T>rlixciD7^pUp{lmg?7y1$+1=?gBXy5#^18iL+2xR==M<S&
z2FgD+>=8ccwm&*3$GB?pxvtq)cD%Ki(^>FHm}O$Wgv-C@;rc&QEpEm>zc2gqU%<Ny
z_txfLwAm=Pa2B^l+Qwe4^y&J^bGT|;r2b|&dtF>pAh5S0i|Z-dSCQjqwdS{K?)|it
z|3`h>ZuOJyteGZW-!|_M-}9r=(35@15rz7<UQ#C0-1e!}blnc$f8bL+$E#0sjGUNO
z>Xl@zGpzqmtFYW)#$2Y5jmk4ZzPsl8^G_*U`S3&bq=WlbB^2bGs8pD<EMxznxH(yK
z8ftGO=m_SVW!(I8&&3z7+d2;gtdp3<KJWC|7ZNQT9r@yyPF}RF{`k+^@aW1G2Gi3S
zffs&mVwftw@Up}IcKZ)Pdo<X;bsjXe7C9%>uQ91>lf~m8wHAigpKP2LC`SIR%epV~
znB7oufm1H4T8*6}U*_Dy&sa3hJknb5{AE<5oZQ0S9X;GNvF$62R~$O9ilOfuYxQjV
z<@?Tw73?~jIE8ucmYV9&2V2$KE?$1A6Y%}ObV)ZmC;uPbY;R|a798{SUiB<7V1AHO
zi14<@mqkxA{hW7xXD+LH>Q^mE=Km7qUFTm#$Q(2>yX9h7lEWBwT|#C13k|D(j=!?h
z`roH#iiVzZ2|GBm<}a5TYna!p;Fsdzn<PtC&kEb|b#1T9G=a%RR@Y8W-?encaSu~T
zHvh$IU7WV+8Laqz&MLj2Yx~Cb+e)1hTeu&dm0;$nP+tFN);ZDW<)>x*WInP**G_)9
zK}^#oc4eTJiN468lBhU?rPe)9d^w6IzH73OkW8<;eN<@6jR)R8=W19TyY*#>qt>&9
z9bQHfqPOPG`C_5g_mNdB*Yz-usXgzqfc+1<Rn~XNo|y44R7LJG*W$~G7fj5m8>dDw
zE9YdsYL5DKLp;b>>%HXHBYckM7Rpu5c8hq$ZOV1&{e=G)cIo_l)%EQAAw5M$UB>s7
z8@7FV+yCZ#;Fqp|b%93@USyPgpvXM!;>spp$=EMU(mn=Pe=Duc4-P1lIahSO@r7dE
zNyie6fRfNzZs8U!BIT2=Dh9vwU@kh<wXt=U&isYy!3~<sYh0Jyx*N8GeTiGbgnesc
z(mU=(DoaS0oGg+&(bd;}c%iCV?~UY|-6;pFY>!5%3;#HDZ)vX1v~>@>4$NH`a<<a&
z^n(SC0m`@5Y!oX^>(HKS+~k(9Gwe(L@%;IR=Sj?!>5Y50x6V;?M&q4^#C)f`-mfaP
z8$6ms3!a^j*WFWiVb9ydSC4o3_N-!_^2|Z)PxShw(S}byJz?sZnH0$=>#ns?=c&T%
zJ1K#o??MBW55JK+S?rs-r2UNaht~fLsn!c4*B%etcrn^w&PVobtgls<tef9>=-rZ?
zU;clTo*Q_{zPr5q{G;!)Znf9%x&AUEy-+xQwX>{Kwa@(Q^Jg}S@f);uR&QDTdzq=K
z%-6lM45Oz1@R%nVT<RKq<PN);n%2E8v4Tf;R&$?uu*lWN>8a9MF;<<hxJ~ztZNH}U
z&?W1p^NtylHVNKi`txdWY5P^PP`CQOzWpV=)7XE1yyaW!7rxlG@|nfass|;UA0|w@
z5_9tjb6abFW@4MwqYXPl-KN>3zAgB<Bs1%y_^n%$o>v&Ne_(l$xUC~<`2x-GmQ|aI
zf1EE}qx|0WwgcA&SHZaRURf{qr)t+~Z<~~~+**H{d)C#O1<}m%o7Gj61C*a<Kl^3t
zyXV;}-d+aj>D6Lo|0=|FwP$9%i+mV=Tgl4rp|wx+`m$}?)32tyQ(e3K^V-y{x(#->
z#l_?QK3r{Y^YgL6O0oBAX0PM^^n~f9B9}s!#jCyj`wv|CqCc;$*^p)b!~6S>-T&{j
zzkaV<(_gnej_d!*#s8ib_xqLgpTFn-{4W0Uce_tjzNw{pSYM@>qD|aX^{Z3){+xOx
z(Vr8L{5<;4g(bX4t}i_+8FDIL+xXyhZ5E#1x*a^-def%fn11X2mRY~bE4KHTU2a%v
zAtRLVrJ>^g>zna~7WKB)zq2JST>o`&%1qfm`hT*Ywsv3cn0{))GJW?8c6yI@9Xpi0
z%lgOs|Hji~ccs4ge%vhh=(c-P<7ee;-QlRYA?Hol=}kxGM5j7(N*W26pSX06rA4~s
zpJeve4E~5GDXEWdOD{`ni0VIfyz>}??y=4#DI5Z_Cb@yP4Z^ibqZaK9Sbq4$j5Us#
zoK-HWzlE+yPB>$6aCXxRgLx0D#WudqX;PkS%Jbhjx@UzzO=VzQIM>YhQn75s6?>mn
zc(<-U!CjVrXwkPVNs0HS@1CRcZ0+~VJs;=I|FJ=^d~Ffi0p$~_ZvxJLZpzD<apie(
zjR=nb>jwV-kG7`?-ix}~759GReEsU%_K9oCHk=Re{<y{K^VUwi*Pe-Ct2yrFtFj);
zHM?;+ruF45g_@hK{a4+e+=|(AqN8mVqr6qz^S9I6@BiIU{^_qD$CWTej)UII>+fVn
z$<DsGxg>j249m{ux-KEx?=6D!7pF7aJren<^|@41g5<L8C7&Blyqa@+-5R&aFV^@q
zJ(bbUHsWVGGG|>vYD%f?QklG-#3NtDc6^TvzNBrnftypRw_Ll#xK;Fu_C@tgt$fG#
z-IY^zF?(tob!k;tzMRID*Bkaq34OjK_gB<G@=3eMzxdCJOblO^Nk5ZTeH8YFdG{m!
z!cA9??(?jS4=g-8l~+JzfzY|sQ|@hTwrVcElZujbW_Dewt-Y{Gc+WJ&hozA#<}PPA
zS(M++bC}uq5Ub&-M|DTC@Bg#m)Xm<S<1E}#?Vf0Gs4jb^!jEV3$_3w^5v`owoz9Ty
zy{-RZr@Khe{M8TkZQ?x~aCN<m%j1NfrxHA!P9OYiC-?Z*fg7{<7oIA(5_~)O$F2?Q
zjW#^ya9OS>`SIL8F@8O(B|%MfA$uivTrXLbW|3d>cgo{7ujg8M{!uU7>$~K3%YKcx
zz-PT|XVER5G@E?=dppdwH_33bX+;)#Ju&cDR2y^ZcYNK-n+8v2G#cLJSv||?;y*LH
z#jE>oh<B`gn6#<L>&nMF7Yx;zOa#82yzjL#>EB`Ppq>!cUAJxSXng0kIc$B{)9RdX
znZM_$d0VB{<Z14i%z1Ct;~CpB0+y@@VXd2URZ8akjfSHVRh(~m)Q|Ffxn9}!f09$`
z*R!WKTrll^JFk6}=xVQ{bu*JBElh0IaKF?1v^)R(7lu4bbMuZjekZR!l#a4}@hE&o
zOT`lYGqLX->J`(z94HK&v3{zkO@VLP-YAjWuUb3huO|0xkc{{pemtQlWm581?n_0n
zJ*$dr9_?`ZExc>HiFn32*9Y?^{r>lM#-}YB=XK-HpIB(ac2{P7`ko1*-NoycJt@-r
zG51l!@266-E;6xZDT(&!<~LammxkoO-7TN_GJ4O2U0z~pqCPwU+nBGY9tqp(as1{L
zKK+dyFG~-0CT}pmus}1?v2VvB!!I6R1=n&_AG<Se;Y5e<Fp&<W!wai#_&f?dvvBb(
z*N$K5H+R@A%}(5TNv|<dwCU>p^W}>+PTRF+_4mk_^%m>wcKFVebe^>QxsS5Tf$EF1
z&V9ZA#3a@!;3)gguBP|%uDC9kr@mo};ELe(iIFZoH*+SaRIc*-Bp3ej;{BotyN;`T
zuXrw7vH$Vi&L0_ap<xCmEN>;ZJzDzU`|B-CuL3`;+5GhIg2H!fT9GVLOTXQCwcEYB
zE?Vl=-l(_}4=esZTV3^O<*aS0$5S5ZN=F&hsAsn)&5)UQ?8|4d`L|WCOyxSj%=OZ^
zV(0Z2w-l=WFZ_QpjQ3yF{Dnp)fdxypyfje!rlxzEr+4d?JC{V&rKS~IC;Lc$5BO|X
z_vZK6!q;0okJKITn7(O+)}qbAZ|&=Met%R^{r~y=m*N4IuRaRgUAW3@wy+JOQOsvn
zf5*0(Wz`;mJ45XZihPA0y_qSot4BCDj9;^&{`JxBhco`32`|)Jwf11R-v7z>zAiIl
z=PFupMnUM^do%SV@Ab+|7cR?Av`8!7S>ru%ir+yqGoziin%462*zhJinAl<&(5T_I
z?Q^GBap$+(&g-A2T)lnxMr*f;e%^062hKjmVBW)xdCliu&uf&HyS}IY#qsBH+cR$m
zp6i;rz}v95=tgzIqdiFy-KUk0zRzBI_+n{W$i<o~b!$?K=Sx}nZThM2sp6V%VWGS8
zpv*h7dAYJm8Cp_LrzNlUe$TV<@Vo6d+v|B-Y~TMe-L>y%7?-uq8RbrPv%t)S0X~{q
zN7wMGPrLQG`N!)S%g?;r*z)d$?R%kewWX=y8XScWWS5>T)^?68R+cJy%DDcgt#yvU
z#kcO8r{DYh?_1F}{)2v-?oA2Q5!-!TI!fI2Q`MA|+GUdyzu3l2<}YFJ=wvKda(t8a
zy+xg(l8$SpnU_t;FK~OIpp?I7+Om1c%*^eaCppX{?T$=Ub)C5X>+aLxF+4Rb;*k>f
z&ld|9NMABFs#A9kY~Xe_^gpAUd1CSQmGOre^^dCT^t;@;p>dj)ck463<z9|2mZ`70
zdX4QP`x^tcNyVF1{EYp_mnh7n8t`Gc-uqkKlRxH#G3Lgw^mc!|A*^#X=4bX+8AFTx
zQ`gC=>j)ixS$%oZ)50&mxBNL(sLtlpU^RCR)8hNdQQID!SYn>4lDj4Nlf0|_qt1$e
zX|6YqT5PReS+Q02Mr4}#!&Td~B^G<n(g@qKUVdIxV|u^^$+e}g?6Q8^Ou6ou_PHqg
z;zBmT7k}TgU5r1TQ`BrJnQvcRS0Xb1|I`q3Pq{*q?Ul2pEMoTK*|M%<de`9~^}f34
zv#hLNgnu(JU;IgH4_lH^;X~uhZ5cfAsnf$N{%_PUw)nh3W!H%biffFOBYlzt?)To%
zlY6KUu;bv3vh1KUE-(C3j^8dWmVbNU>tl=82g4JW+M9KpzLj}7*1_QUKb;dbi9O0;
zo${?Foo<J(Ie1t~9pjxp>-GgM+fx^;x95iJQ_Xc-v)fL2`4vH{=`N=y?hd_ulGR;B
z*XOlU`?bK%ZjZbFTDCmC_B3yq&5kpBy)Rsz>u_=Eg{L>J8DH74eg4tf(&;7tD|E8%
z-*SE>wZ70lMdC|O)BLpu8X|+@*!4_(x65DC{S%m&=Al}%X3MoL-{b9TrFIBS6Ks8d
zJ%z!^W!=p?H+J;hT5_*BRxsaY!UGZcOCs`S%XZv8_3Qe%&(6QxTq>&VE4I!3E^l+U
ztIPJjnoj=JmT3Q1s|x-EO3#*7lfS3?*^`OuSFYDghBf+mdo(`WPCq*1$)z@yohe$i
zhBCjd%1kbgzhI~G{@}3=siYep7jU{PITg0SS0gs@^r8<zdKYt_o20MkU|oA?#*1yS
z1-dd5Z)a7lSjM_y&BOki^Pinm6|?(s+eq6o{ix}Wv?+d0md^R{^8a$?@O)YHzI&y{
z+7*7RhSS~|Ejz^bKVz=I3hrq+eIM=ew{ftZwYrz8ZJV@XPWt;FT4z#Rx;|z8UL5@;
z*0Ln#)7q~ycAuNyFLLnAw!YexGnP6}iA|5F{`}*y-D;Ki*$R1;*{wg0&7Z3DC)ri}
z-<reA+Vje@Z>){Bv-zO6F~`zyZimocrY{!v>I$Wk<Il=wZ&)xT+3=zD*;$*<J>5Jt
z^Uj{yGUX@C*U!hDC<~9czmzR%32%Dd+>2*zPXF_3WL7@)=UU|o@zdUVT9zFlQQJ7v
zCVaa2VR`A38Dcq#3-;XHCHcx}^TWE1bJOJ%Ux@`Th!5YlWLMlSCHLApa}=E2UHSG*
zy>iWUW5hF^=fdY!OfnJKZs!rR_4&nIH+`cP6|=y}^CV*u4#hYv+5Uw0hh=ZVe7^Sd
z^osVHGPcXLWoqq4t_u#9-~M3#r)+l9Tm$vCZ(moZ3;+7QeEApuQ2(-H@pV624%Ke&
z|FQf3T)~Oy$KBWSxt-^m_ulT|{_k<}b8G59wAndbN)R|Ce)!>sn5ttkhgG&ndEb6m
zaNxqtBAvNfuOeSsm~7f-yXD4~U%3ko<|kKPF`K5cqgz2HCn%AxRywKAxxA~h@uw`~
z=H?&14qw|X!@M;vajxuTo48l-gPBoJZ^P;n7yHhhxF<bV@!adh;vOyc7KS>_KBKAV
zAszDf_^tYBcUL>`UGOMZ5#_A;KKbo2_2|gb@J3yZ%X?QQrs^F}_TgP7t=DO`jDbVo
zapsZptCxhD1|IwompA#v8w=ix?$M8JUY%VvyHKRRIJB}|TGZs|zN=Qpf+Fs2-S;s3
zgmQS5Z@S05+>3kKJp-m~W^MGY$Y?Y?Dwnu)%3B$sQmIyFncCYMtF+#wO@8XSAh$(y
z@>g}O1v3TiyCoeD*miyU{+FICKR<5%U%20J{ccYlxm@qBTx&h!o%hVY=j!}3=(S+W
zjVGHnsy-?X?3eJ#5I4D6Udqoepm%(?g09k*Z?pF{=l`m;SHCXRlc%;u-{AJr-x3Zh
z=f7t^e&{i$QD?=KRV6=#kN75W2P$v7f424Oy_l7v8+aD25NWd)JKfrJO@M2rxcc&|
z-<pz6Omc8aG7D5Sdf9BVd%@w`nFn?$PSz5zeX_#4k;}tI@wwCO?f$k61?&99SZ^&3
z(crzVB4>8!U<vn0+nbHT=EoTGuOBrNlw?v*vd-YOdb01!mCDRQ_MT_k6Xq@anmhf@
zqjL+7{os%A{WU8<-XZ_Mk{TC-aMu%iq*6F?>U39zvdA30dVImbkCQgH8YDMWIhJdQ
ztn2?iJt+C`xythAH+JbX>~&#C*SjuTvU%H6;X|IU6_h`o`1hsh=FcPMZD&P3_ug0W
zEjqR0;EZ6dE!~0FSFY=dzOY&Ez_hH8AIH>PJ(Qx{br|cUnj4LKFKjseN6gD;LdP$y
zqdlp-+RWJ}qCb9F<#u4fqwKm$@wR!Fx|KGGyVgs%9zS}3E9Qs+&mOU(-hEG<{FeRk
zJDR!b>Bh4M)Vh9KMhom%vFDopB`Mu{$7(;vtRM-clL1UN>lSdkONjP%6kM4SE!Hp2
zSvb30-O=b`D3kTcTBca;Xg~I->)dL3uIbV*BEDZcDLiS-hpE**KTd!1KBcr(?`l-o
z`^m-jZ9Y#_-SPu`4@;((3jP-`>3BDjM}=GV(QoVYO-<(_?0>v^x&7JZh{LxZoRoGC
z^NGH)`=k)R;CqMnQ8h7Z^(>Z)@V`7Z?{aq1y%(o)6c+HD`?D;er8e!k_ZOxYR~s7N
zwVb&)S!vd(m#N(gswRmZ*1pt!aN9|T$FGAuEIu{AKa-&OFL&nB9V#Crq%XIhS!cAE
zL1Jg#E)T)=tV_lHzPKE%59nctyS(wm(ih>s#k@bCJ|<Jyt17ec^pvu8@%NSzeV%iL
zYB;A(Ino<f?7nzL@;^f^5l64bFSKSibY<;2!Y!;VBP=hd-u!>r6b7who{XGf;(V+h
zrbt~7ot}0wc1hkGjwt3}(`R?w@6NKFB>Y6&Wc`BVW0kYcTx3(9vuo3ih_H_O*@vnY
zZ$0qCwd14rCmZ2N;jbEdm`lB1<;J@n@>i+jy|v#>&EmS-iD|iVZ8K$W9qEzroaY)f
zzv!!ft?H2$ZlN7nbFA!G_D=Yr*P)p{qq;cvpqNqWj(-A2*cN85IQy*fH;<a3{-n-x
zQ}(tzpC&#<(Yp0utjN)?-|i<)JoPvA@f%tHFY^u`-=_BRtmN8b#*d=j#Jag(47Xmi
z?!i+dk85kw#c#?ey9u6Kf9oh$-zUkg&qli^^l#%>-QrboKg3_&e(I?WE6P6|_tTDd
z)^_JU>1}FodgFJ#KgDf#<-#mWMAaic%vk5Oignq=sUZS$SvVqvl?#n)p4?15VD>a#
z{JoNyllmq`RhO#SdLgF`yXu>Iq^w-_H*Vyd^?<9AqbSn7YvQ(|^>tG;+vl6Pxd=uc
z;$+EodYNWl8j;-EA(L`U=Gw)Ow@Y><EV<Crzb-oF!><UH+dT|Eo4ppOR34t#9b2+u
zmyX(L!=-vzA5Q+8zcy9YZf=9(EN{NqUv?(GSB{+PclG80w>4W9CrRhaaTsxFb4^y5
zACqtGC+zjlg(aOmo#(GymP8o8i%rT@Gp#n?^0eEHb{QWII4=!Qt#tQlz1SJLN=JYB
zsghmI%=Qw&DeB30XE!vjEPucKsAqSovHX{PCz=cY`WgI_yVm%-Kgvn|#-(&MyCwgb
zTwN7Ko;+eKo~SG^=}yI_J25->Dyr9i`PJyvY}@v?%RMCf=T|+g<1Ne5oVQFnniLYd
zG&8nW?{wPR$9hSt=DjuCd+(O~dQR#6|MzMY%D#8$c=%t;FGS~lkHAK`rv0oorc0Wq
zYggMZk#bxUIAg<2-c>h)zRF#xsekM!tH7o-=g4WMlH+@iGC7u%Ccb13__HC&aL3a2
zuRM<$;#DpDe(!r`H;Gs5O#cFIo60}3?8*G{4<a}APBPCtmoA`w;PXY!qKXw=&E2b#
z|4d0LT4kNl*y2*N_o8O(l$^`;Pp_%Y%}JJxd2y>!=T(2`-aFlOVUrTuW^H%l5t*;>
zXszHKe}yv}G=tb~C~xQ68`qj(tCLcvv}%Lz!~J?9saGyrWG86KOO)GO?ppM}Y}pMa
zsoO7D3cJh8lM_$a-~0RSb;V=<V~blCPgBy6GmwofTFaaC{71N~%AP*8J-c*Ex?TGx
zS}2;W4Nt$#7W>=7!}@yRE$NkKg0G|{@;<B0mNn>6V*UKEae-K~cT;)0Vw0v$o8xY|
zpO@#ZUH(GQz(2=LKS(=jrrqQs@omd=e>*&@v|fAs`J!pJZdJUAIka<~a=BysE-v;M
z{T=LKdGj32rS}MMzR%%Y%e}f}XQN#G{v;0hKTgkHn=V;3v;JFKQy<^*yJjnYJMQ+`
z_HA+R)VsGU3f@aN-+y;Gzsg4N@At5|OZeaSF8gsXSEt}LQ%O%!hGY1=s6dwp?UVjD
zI1g(J=V@q7*C;z}eMT`_Kud6WlH!hShhC>z1b(Sv&0n)Lq)9<<(c=RLgP;2CSv!sE
zEccm}5qG#|aOrl+i$xi|75*Ztp%Gl-p7kMB_Ni}*glw{&`5UPhp*Mx&^m|TvUS?5W
zEIf7f+a(9?+FAyQ@~u6kK0SuBbqCks4+gXMe#`ZFrg&@J%NmDi(;MB+9jX2Dcw_e0
zg%dim-}-%wK4+0zxbEY<kORA~H?QGyQ@b$NVU`carQ1h4LtnKxc&8WN?lh=*!B_eD
z{LO<GuZiuvvFQKT{fp}NM%*~Q?$72nnQG(r*B^Am_7|_wH@PC0q(14M#wxGrF*`N%
zx#FEZE(?y!T$S~oL9NpE(w&c@PoL!qSS4LtzA#oY&3PjKl8!vhkO;4s8xbeDxR@C4
zJd-lmxoFAuA8k#m)*lI6q|je#&@Ix-ldt*xlJab`vya*;lkFXU&6oDQI_2?lyR&H_
z^Eh@0-WNz-GQ-KoO>&j;A{Dj+riq6FwPg3^#I3lWT)pPV<*n_X40%mI6#5F!vgcoN
zpK<=}C*PI-Pnh%k#hm@T7PsF&S!8v-JNi`YEZqZcQ4!&;K}$X2`I6g;rpBJ*RO-6(
zO5yf%PuBG-@01<Pp1yhUr}JE&{&wD29{p1HJ>!p^{%<<{@1-;;GpwxjUNRy5#j;s?
zc58QUX6aj2sK)S|V}jf2q)jsE;*otPgKtS^zpB{$IC!zUQC7Y1iz)gGmPkygKKaeN
zu+jZnT;KM>>0BFJKF%xhd;031)?Vin?@K-#x>s#7o0Zh*GI3@5hI*mqa}}PagBEf9
zZO9Gzv+ZyrLx{DKx~0m8Yft)@AIRf+keK_F&-Px$++OAT$Bt_2a9lCmd4JLNG|Re<
z-XevI0rK9@dk=lBGiaU86Z2!^`~P1On2wih{wg?Ui{*<Sw-T3^?6^61+bp~9dF{JG
zmA5@!*x<kG@Yy(B{U2pV{@#!=Rebd}o<&jfPeRsnZ`o;YYotEJyp{-L{E*?m{p+fG
z?)ScgHD$-Vq*cNe<<~#oaq+>QIce{wShjtWx_c|q@{UFCGci9)p|{b2yF8{h&e*m7
zSoL!D<gMDN34K3>&e<-%^0shlk?o~`rwJ1-YqGhde@iV5TQvEZnqcddqe{Pv7gRPe
zun7M6^rXYM{`9St<;_m-CgsP;ZqO}Hj`Wt?cG*9i^~ItZ*_xD%cMlzzueLK*qS&~K
zQ<?QKucG6&DeL||OPTMzYVB36#Q6P@=N9fQ`L87#e_P_u`5$k#MYC)?`TZNyXU{^Z
zAChbv4(vMg;?kS<X-B4<Dfm(K|Lnol&DYhd^~>YrXC7fIk9}8iLSg&m8B(dGOHL}T
zK3pT0R($8z5&wGq(6!t36$E;+PUQJ+-gwNiZ28A^N?h;XKi{P{<1C+xw+r8ws>vk>
zZ~E<4yS-9>D|=4IhO3&<aq=s&U-UE2T3=`Jj5Vu}lbQRC=iT~Zr=qXX=MEiE5d9eS
zsy%O2VPyZ5>l>x5HTFqde0*)k&(aI;YaS}gf9Ltz*vjBK&trC_n5@L{9HY+b@uvB!
zzew`EU)r=c_o)ZFck1dBH?spPTKkqvUM<9YN&U*X&C~UHJ-beQt%^Thw??s3+<?vT
z|DHc8k3Xp#bLY=F+VJP)4<6-TGRCR>r})|amp|OId6wDY<f&;PI~Rq8Z@I&2yJktp
zmOhhB>ki7ExoEkme9!k?&P5kKC{J6P=l<{eL))lpdlahL-6HIl$FJd&X*jvteEu8n
zNUwa`puCIEGp?=L)paa+^UeG9)6)7soivP!f31JvYv$slO#h`ihckSl8mwn72)3y_
z!C<|WJ1*h;<W<ww*DP~decJ!ttJ{{cFFgCUUlQT?u+2;F=gt8Bcbglpy*^ktw`cwQ
z!&zQ$)!(eV@ZeI<-&U(@p^HkqFXjbatu|K{U)VJ*X#1B&qvciyqQh;s&60l3^t4Zq
zVY{d2_Fw1!{rK_H-1^kk{`p64vxgtx?W>O0aa(DTGiPa2!7as-;OV(9r(RNOdT>u{
zg1Xh5nPCjG44&n!;r7y~J#s8jYLY`*<>``FKYzq6J3Q;`-dA~c-;BF_w68ADd@3Pz
zvwiV`9l7~gebT=sZxOTDy~9ZA-iOe~5~4>c9!ayyTkg4WvcW9l<D1vHPDk5=7BnmL
z#_r?2x_he@^X<QxhU>m$T-RCjZLRmMqu;i<y<B>?eBtpmZ*IK`DvDcQGIhOZ%Y6Ok
zB}ab?tvx?IN2crrpMB?&!rst{_H!2TuAj?uyuj(pqgBUP9*0hA|6G>yws!uSp!`oU
zyBdq?UfHvqm*iPL!;CRvzKit1ldm>?XZgpPz5n^18&T=Lo4uq`gJ!w%309l0ktypE
zD5~4qGi{sy1$`yi8>{(#oV^ygDOQl@{lfh^Zau=Av_os2<d?~}zRP^!V_W6U-eR+7
znXGh4yG{JF%Eu?{s(!6JvES>Stp268v&_CWKT~{DJ|~~a%rZ0l8RBbmS}W$oHH{sO
zZ|?ERB!wN45s}_{{`Og;yho4z)mY6*R-2jifPvdB{9T1X=o^Q;H9uaeeb#%opDoOM
zkNJM<xU`bwHxfw;-19i4G+Vb=M7R77zIk`y;m?ZMFDi?Ir`)&`c=GinEBlARyMxzv
zOKmi^NVEJDFCyyqbdhppLb|SJ*@kaQQ;(>c`X8LM!^Nq?W@hih3)64Oe!jtVYD3sM
zhP5@T4(^;C(93r>D&v7%@~qEAA7hQ?8=JiO_ImMjcl|zzg9|4u?F{!{v@yd=DU_9Y
zCfD~>zuc8eB))Blu2Xnt$G*2&xcSQ5*mmU)y*9T>*sJQ?r>9&G%&oSFFA{50S@>F?
zLu}RJ@E^0Tin7h;i4)o)YVsle<Hq1?`y&jRD-|y*&SRa^cFgfafMIX6it$vQTS-4_
zs&DMN`cc%)#Ew@csP?1p%Q9cd#I*%)!?oT<%3qulSmG1;@zKl7Mb+E(yK}Ov?>cGZ
z&n)?8wHniE#RAvw7ke@yHb0D)_-LY_;hM*ABI=ZkhE^{ZgYMi-3;%MizpR@4n1ywf
zEKAPr>aS6&I7`ZQZ7y;2e!BlF+v}}z64}QO#8owKIxYCdMSs5MLq^VJMn^eIB$@i<
z*hNaFDrKy8Y54oSL)9;^NiT1U)bC$qhc_(Wcw%;p)Q;6Ltl>XD<jtNFr}y-2!vBlQ
zg05HhoKDxDz4MRgk*C>`^Gf{cpOrp1;Cg;?^(mW$^{SumeYmc5rhQ}D9e&R6nXCfG
z!ehl+7aY~xn7K%J-{~n0^(${E2QAq(p>$#5wZ;4M_V#T1w11JG;Hu3MCl)Q8AQtui
z&+D?V(9>IP)qVP{UY`-5V6gjHZiK{|CyVoTe^J@iw59U0^^%|tVaD%Ey{)5itCm)s
z_Epx85>C=zI&D+Qv^VqD6vtSc{m3<AjrmXhM?ck{?tNCG9w2A?@x#s!{mi>=%Kx3V
zYP*iuhtsVtUK4Mb^nCky&3^ym0&kv`n=%^jtbOqHc8*_bjHe@;)~kFiRv(s=Yz<~1
zk+FVK%N{Uv&pEQy&ywB3{HlbIwB(f&jI5Qr<}98x<Ngx9DTnU9VKOdw8sbpHd$Qqq
zR!_)*%d3u_QcMWib7RrxXj>Upk3*t4T+fu)DyM`Tmq>lV!&dcs_j+IX+?MHAs}?R6
zv|Aw(a^6X<$<O3r#{|2k6+8F7)IPsCzVb$V7MtUi`x;EH99(H-OGH>+J)F$2MYHw8
zJ!hqgSqmny{SFatTU{@6X!rZ3CRx53qcbH-xkQszY>|lJW$v50@$~aW5*ZVi=ROsG
zFnzUMOZi%xtW4XYee<@Zb}Q_U_)&3{sq1#-<;%;nj4$^#xXk;q;o`F9`_D|zKG$u#
z#<7s$Ub>m-Yvb7;Ld}%6T}*TN5)*oXXWIU-+ijm%Irjgr`*i%_<Ku^y$N&9!Qr<~4
zyE5s-a)X5{yw}yAN?ld@(R<~Y*#Q>n52bdsPMBv`_sRE5nW5w37nvJ)zhrxfGOlr)
z_FP$W%dP6ZG_U`G-skTv$_&<j&Qj#0V4`4`bj~I*x%WgwFhf(?k!`D%+pm_7`7~W3
z&9uL0%jsD=TmM~_kUM|1F~Th%Ecp3P)!^$FbT)f^<;_@EAz#15XWRY<K68~;u{y9C
zv)?#d))Vu!Ie=MWgI@cC3vQfB8=D)7LO%cea`NZP$$S;jUmtU;?__t7T5cU(5t+30
zraFW2oUJ=j&*`>3pP_Nn)>i)Xle9{<qwltAS+0pcvhb;T#BId}#@zo7=iR2cyuQWg
z7aIEDn1aEBcgLdA!hc;bYEQh{5ovjLvedsxf6sFsTqw9*J7M<4Z~ph?_uAa3-u(aX
z!+v(_%Zn0ryN1?e#LQTG`DB|`LT7r!WZO~|lWMNE%Er@WZ?3l=-W<LldxegOe38gw
z&5NHKZ#m8`nQs^VbiHJyx9SsBD_Px8^H*9`TPHp{e#9g85l^&rID5&uk{Z+JUb!I!
zU5mpcEstL}<lUJgrO|o&g`w07NwF|L?Neq^NsW7yEJ9e$ES%YK_JYl1+4`)TeT<16
zJL8u&u=KoIv^;e4GoPznk@q&PTXA@Hl%j&A>iOf0K^0QvJNTw7iA$SYX3AXO(eifZ
zrJM-~{#RczZnIRl>LTkHbZ^(m>*1c2x^}`BpS~0LW^mFl;kDoN+-B7!n~pNMl>A#c
zQ=<28`>wzhZ|2BNG+C(5$+OR`X`PVTv&E%c_wwD`TcR^d?mXL9f9;w4LHRw0!hg+;
zVgIq}r<Y1lmDkt(no=uP`IIfpZVR%|e0k!Tgl3-6g(L1&5~uFI+;;ccvSK&J-eqA~
z(>Y(6Gf7A-b64(I==$lt{e;HYYuT-aKlXmAmff(L$(G;7^oh~jy~pDodKV^Gr22>T
ztG-hb;0WU=-CdkvaB=mq)U~YXF5fQge;)BBJiM2wIwSA)@`c%I3(qSsoWFZpwQ4c5
z*a5TERkhqA4WAQl-D>jhll-^q{oaMQF8wqy`_DXG+V*#uvsz^2ZZ-Su=R>#U9(40?
z3%mb!#p87S_^?M$ms<NCiW1=n^1R(UqhnkBQU&>4uCvY+otl4GIlbHH?Swt+lulmT
zc8V$S`{}v*o0@x49G1D=$-nMkFX&ubx6z+Dzir1dj(FoqyNn;?B#ABI^`5=EDtKkJ
z>X~V|r%D%xv+(>?;GMF|N|K{>%|~sIy;~a0q*ILIXU#kvd{4RS`lZdK>m<Y{cW;wT
zbY-uf9-?XXQEJ&~VIGGBQMcm)^9*lK*gx@f-?nWx<-c^v7a9A`GFN-?f3o}c^<6o0
z`1V&<|M(QCvB7WY=|rt9f2_`Q-`=uCzd?GJ^W)e@Y1)i;JwLOZICMMb-_^?&E)i{s
ztuHRzxBvgJJWjx)LF<vu$ER++QV)C>dwccNuiJjF+|QDje%qle^|q(w?(-Gj?(K={
zRx_!!UzPpsYkB<g$JN1hH{N#z=}+c)qV)9aONR?_f6DZVgukSmUz5DpUFuHfh1N&D
zlb%k#J5Ri_Ftca=v|?=mgG+)xx4nJtaPa1tgC9>v9&pK0aa_r=Y(~M+$DOk?C;8@9
zWxFWLEEiJWKgZPSZ%4I`&YBsmr;J2;rm|dCxw+v&h3L^M3VT;scXs*-s6XLje(ZYT
zyl3x)EvKW3j=fZC*3>^)5ZREho;POBx{%w9obKgaH$<7kv#UIAL~sbGyf`$+G+y-Q
zBqc*F@%6l$pY==nNZHPua_D$xb<d7<kxI+Awt8wfym;mGrOMB8>7}$qAEK(~7~J39
z7|qVaSFk#v`c%jchwX2!t+-LrU)AHb-~i($ONlK#oAl0JeBH#{bp2Y(RF4A9Ba@%b
z$=afKTEi}s{fVVhr)15(eY2P@#GOtGOnYH^uG_G^kgKsWYlqi^n^F-zhd;fPTF9i7
zzxDX*o$Fum%*}Z6gJsGpk@efob~(Rs<1!C8air>}>CWbJTI=dl&YLU@X}BA|sx*8-
zwc5jZd8-w4zD$(pI#a(;`|p-&?q6)ox1_GHWth78Yklok`oi(5s-dkmQR|P9gsym+
zlTRFLsH%v%Pw(s_b1EWUp7?#GNGmu;(zcC@cg-V10bkxLe9af#b{Sijaq28Jeb}D=
z{D9oN=?^=FO|R@Q;7VLrr!w!};SFEjF(z01`f-QpPO`=-hBtCnQ>$+p@U9DVyjyJE
zt@`r6?n8ZFxj#{spZ>j`FJNnYXLG%%%))!#y}5^1_k3x)o3`?E-$Aok(NA9l)-Kd~
zIk`MYvOkQ!qX%@nkly>3cVA~t`Sm%t;&)AI{&mSsSJ|I-9%?<ydU?Ytxi2}BdUwu|
ziP-t%-r=pQ#VxtcbGMwi?&Njy+xC*Uf~T!(Wc1T>%2p+*o!+_fM&r~C9OaGj;YYN4
zB;*P%G=}dJQG78qV85^FGMS7lZeEXeIhU@0$rE&~(oak<zhqZf_-Mzy3o#4(J1jzz
zCbOy}GHc9?^ts3~IjiMG(6sp4hMXC?TF+Y+iTunGRc4Z%qI>*a2y6c%4bkS<;Pnq}
z4=##daM5(Z&Ff`f58Yn=yiYi&^{CK?O63y^j6<$I@-;a3V8#ML$A_B1&F}0OHOo6E
z`)hb>$+#_1e<dAq>A<vFsmDLA^+j{s-6&GE?(C{Z7q}utwgk;!ySG8WNc#Fb@!Z8v
zR<yfDP1<;PU(!4G1&*zb$8U6s-aoT?n}C$yK_%tiJx9gv={#32`pNujN$-@9*mUmf
zx9saD23b1`3$9E^Jn$r8mzHMJwIwUonXG4H(VYM8&s_b$e_adu;yJDQ)A_gQv7fHq
za@ngSzp+wMM)_^!48G+m0tLJavSMAsS4c^<ICL%(@JI`|xA(jFsgN1|J6taPI3>Gt
zZ+l8|1C#wF`ED&?{-hAiYci$b4D)OYp6@J;d{yz%s>6Oab7Nutt8a(CbY!o5aBrH1
zXQVaL#MFhaPfikT6Hm_m=9b^RZQYd9KkXOGPiorOq{}q>d*`ps)3j5h_RoEMETGYw
zXKUA^v)``0zLfTtpRZ)kK9OmMo-=bAHpQ1jY?1$|_I|~#2cOdS7uKX)&9FTGYWIh$
zGdJDZV($`U@Iv%jp-)Bpf=>2d8nyh&uM1yY=6kk%ry8$u_S4+&XBBvEao(GA!&ve9
zNj6XCVp|UPrP9nZzkDzd7s%(n5>Rg2`{1ESVeb1!^>Throf~4mo_6o)H&^mGurBe&
z<o?7Nclb{~dA};&t|?Jd>E7ARnNe4F->TSPfAv{&r0zO%hRtVW8qY9tyt01(aAIh~
zmYsiFCj5z=!u8<#>D2+&!r^O0BegfCys6zWYswufH{pd2inT&5Ub7uOT4i0F8Yh_f
zbMDI1@|PO^T)paMz4(_|`9{qy%S*i0_mdu9yZ&SO%sK6jZ&yCqnO4d7dF#|)mrt}x
zM|}7HRK1{NhloM$enyj5Q31C(UYQ?E+5AtT>!Zl5ySndkrk`AX;QwzAfA?~Am#^zj
zi!8i-{XNgFolCT}?<$}5KFMCnR}%8&_?o+W`JVT_s@=|f*lPWg+bydPuC586QOf_v
zabHM)z_V)JjFbEsEZo1_SUgvSuaxSo($eWY^X<i?%I0HJcx&`{*Vx{Sziu#XZ|a%4
z(8D}y>%ymh_^=`IgwVH>@|RUEo6nnMx`AcVYR6X&TTNF@Jvrg(MNv!l#aI6~rsZVt
z{%(G;>+aRPuaA}IzHkWRFUjY9wyJmYtAy3RDpv9Ggk~R{bu-mosrGW@`eS!^w?0k&
zJ%x>FmT3pe<<#w^{88QhXS-&*KDt*{w8xe)J$p`SQF;OAWvf{_H#Z&Y7JN}|+A}Y`
zg8Ary)2+dFUmof0@(W(IzHuhQ^^()-j-55T)9?B{;NNxX!(zcIc}|IJmh)dNB8<=1
zJYQOu^~h3B@XyZcA5yy9FD-M}r|#==h<V{chcM4&%p1-~pFPn(;h|{Up=+1lC>RQr
z)tDMxJM){Lw@`64|B_16ruM_%1XxwoSh}R<9!p+xtan1h^Rsa}E4J-fx>4D;oZafr
zs*k+|XP!h{_~4|^W*mJeMa6?})<dHgZv+3%zIg9a*@?d!{?}gSUs@Ny9{t@wRGHJd
z^N+;ET<wK>tfs#{v5fH(b9dGD<JXi~w{`3_4xXCz?%w{nUv?LZTOWHfp}wfD|DHLY
z!f(&WUCTpeFxnoxQ+?9o0?%d*v%^bvUt;7ty0y!XtG2#DG|r^N=-A<n`zO!6`sU;n
zZi6`r8&2N%A(B7gz(Ud34X0}U7b=xsarjt%T9_|Lgj*o{@4_Vioxh^4?fv0rpb@Kj
zWr6F0f79lky0|$f>x6mOb|%K9`?eiCx~R3{#O8I0|8MT(o4tG0>8CT+34NFq7k?w7
zkfGw^3l;{RH(z`wpHEolox#$0O>ldvXX=L+vsT)QFwCCvJ9O6#P3bF3C)lv*d#qZ$
zODLl=z5ayhPQ$>dwGWEqOIVFQzgx)qfd5qCt}~NEH<kq?du)ld)tF<*J@1rN_o9s}
zqBm{0lc-&%VE5HKFj=S7ZN>Hvi)yd7{r<JH>gKim&&2-P*WIf48l=!YG00hOi;&m4
zH;;PlcD88A^=0$@H}0Fues9WGx9QnkRk~|?R~$cCGr@+xvw$c3;199g6M|Rd2tQ5q
zviH27?tI{sy>V#SwmiY*t?BD7svPs_o^d3}UU|(;$A++s+}nauD>4>+U3SK<>cqQQ
zT6;w1NSt25Q@4NG|DAUqZHdqczO=0OkM?<wcL(>sm~&))zm@h{ma7K>PgcF&>+dCG
zuxWz5*AqLP5B0GVSDTe~|73nF|Gf7hceKYZ4VLYqldiwI&K3C3XXV@lCtNRNL_4$J
z$ZoUVeSEKsOI6A1+}g)gl^vGK_jIqX^zDu4ys+h8RpX|dvyM$mvpFM|ZvA}WTE%^@
zNkTuS&GS9@k$dgI!sd<3V|*2hct!4nb#0q&<g&8!)9e2x;R^d?<S#B==cykU_&|F9
z%R<*X|JY;_)8|f)Sbh1Xbli<qsfV|pdhwxdjoo{{oW$qP?=)Xszx%y?;rE5-I%em1
zyjg1E^laVIdmrZVPMiGe|7WwbZ(AfdpJebYntE1jhvih!4@+Kp91@VJ;fR%G^lZ3a
z8<*Ii+w%NqnXz4hdW~P<p`4%T9#iT+@4fS(#!RMudHmMoXAfRJ7KmU}RQc2(kS|_-
z*mIWNhw1lbT{^VvVTEdLxc0&$x6f~x6y4jIUV7u@Blpf@S0CT$sr&cy`P>(giSC)J
zKlnOsStL^0HCM@cxgOW*s(E{_Sy-LjdNxo&RO+lEN8;tG{!YWW2eV_eT^30sIBd5*
zkT(BHY4FATvNK%4nXJ4SlQ!o6-4P~#h{ITe=jjh`fsG+~saFIyh!{?sQ!(@0%8aU(
zPjbmU2i-Qka?hLec&-}b-?vle&F1FKG~Sr?XV&Z3pB)nwLTdQ^IL(}s+v;7<E?)mc
zimOgOY5Ilq`>zepi7e}y!jW--f9Kui%ew0%e)|24n>8ooe#>v^q6-ItrY*ENGhu4m
z|6bn6qq9oyrprXAb{)5>JA8^cC(!su>gi3D9lRe_vL(j<YgeBWAo8GB{)fsv-DDlr
zvyKNuuXfv2FTHfI{dae3lirqKlPNs9!7`g0|GeC}v3QfaRSC<Qg`Im97F<X@S!p5j
zIlI}(=oa77g_`kVuh?gX%v9IV`Eiw7WkEnB_k<Jti>IFno|^4=PT%WP;*2*liau^Q
zKZAd__)BZ;Z+WUS=0;w(<eDb!qPSG)rd9ZlV}AC1wLB?miiW=&G6O?G%O+O4E-;<H
z)<s-2;L*|g!Vo!~<x(Pxgl;TV4!n2v(>zVynxJJopRa^(ynR;TxxyZiRq>{O9J%Z*
z<2aX`S!F*}y<B0v<ExKXtK7DRL@hcM`h1zlj=;)?Ps-|Mccw1j-|M61d*EEgrIfNY
z#g54@^*2@3u*NPA5U9K>;%FY(`^GtT+O;_z8gm||=}(Jg`TerCCP<|6tMc=_Bi4a`
zzJ4g&lP8eNbJ=A52VIx`dpGZ`I~M*@XJwnztj2;R>JdEblbyDui>Cj!tNrt1^^fLK
zyUQI3c|}Ia?-aj1_1#qR?(@A>KKe%=yB(XpOd;|hSAcIxQpiP*_c;n%R<PW-<Qe+(
zHEWNe$>bG>IZAhxAFL=6IcE}*P&q^UXw?qp$mb^7-WU646(nq|Yj~=pnXTcu^1Ji4
zzR0`spAN-HTX!3DUrkZUo-s4ehp%b2-_nZp($UKcmEL3@NOOG9QuOmf0rRxLhLCd;
zIry5jPikJX*;;wR!*a^e6+hG28y;D9rOah1kxP_JEjh3%kR|xD$nA{{{1Tnc_06xB
z9=Uud!)zhzR8~>m%C)?qHWr-AKMBpU*chDl)6}h1<!9-Z7>zw_2c14icy)+#saVg|
zePzwIf8J7ICQXIY$NF@Ib}&>Nd8$y(ck{-j$numn?>`Gxe_ElM#?Mv%V9%M$Wnn98
zWW1HHXj**=V%Tdu`xV>9qthe<VuM(u{Yzb6?>Xv}dfRYjMt!u})u|h11)UZ2n(Vmn
zAd}-><<3XO0?#Fu%hZ4TGCTiR;g3fvFRI_j+56*-&bDj8$6Gx9Zh0#aTJ>+mNf~4R
zeK$CbON4cTCV$dAobsso#Uh`{ue-_=*_FTkyAyt>^2K}0mrv?jpD)RE|DgUnr|0^;
zT}D2^7dQ3>AG6)FK}e|9VfpG^Z|(^y$<LCm+<8WAb;jxI%vyE7wx?EctV-;)5KUz$
zzO1$)Fzw#zqVgYa1^$07U4LI*@8B_A$)lf}w-)Z&bn(zjnJ9r-{}e24M7?A<H?eD0
za@KU?XCbztvt&4~sW`6L$3M&P`^2MH`c0n{&dv|q+pYEQ74Ow|>aSd4PRpgtUL`-Z
z=jz^P9!n=F6wG6;w)Fna^g7bt_xrj+>%_9NyI4#GZg&-*`xy6fs_6UY$DZCfk@aPs
ziJ-RD0fRqFwq;L^&B<NC9&N?4L7T~c<@{6g6uiTdl`W<*C+X^cEb&k~*(7@2oL!$U
z&V74^%Y>xl+g(yi(;a^BR~&MWxUpl^<eN+j<#!0kPD`J$xGi=5+pyJkvnDRumFu8#
zAa9SaVDbv16p;xoMru9(e#+J@kbN30rNmaUHC{;nZvExn8w$4mw@;j!cx-|3W2N&K
zk839Q7Q_gN*}J`w-fmv`ey3H3m%Q+PtDNN3p{uqfyR&c1%U`UR*`lpp;IVNNe{f^O
zrPN>BQ^UA!u{p6^NiAzGVEhoa(`ECStk4*)0yblo!`G&*vv$h;e1>;t-1%t-rXLUV
zI+-$MZokn|_w81hl~Z-J+O8^1YMXI&k)%*~utH2;=G?}DZQB}Vb4jSNZS%dfFQKq<
zL)42Ct+Gc_SDCH~IrJm#+CgsalZu?N?V(la1?Mh&Q}k#n;{1H+-s}@m{mZKy=ejRf
zQ22P*qG(6<m3vp>vgP)iU-tFb=fm^kW#1_5W0@9xaB4%Rv|4)~!?G_?hxVHUMWh@k
zIq^R_W<oG;;W1CyM@L`g8t^W2ZPop<>=A4K(q$4Gz3tNyZmgKLXfNN@Rc^j}9hQT(
zIUiEn-@C^xb6Um5u&u{(8^4!4<j!Z?64U9IzpDI0ah`9>(LYg~nww9oNfUk)HP7q7
zRs+BOvpyc*d*|)j^H|unu6RTJmtQ|0c5lz;i|OE=xcy$^?E<}-J^?%JwrOs2SXlnJ
z>_Y*6;-Y85-a)Icu2Xm)P*mUD@bR+B>CAf<+RNvf1w7hjbLvEkwZYS8Nq_X-MLlVo
zwb<Cbrs9gpz0)dd#bz447uu@(bymY#&uyh!W#T`^oU7n{)VBYSa)X(EZgR+)wm9qj
zAAfV1offmKdB*d{I<k-TUoV$N`!PEiKH2*p%FA+R-@CrQ+UCcy{mSe2Tm5^--#_2(
zp5p<D(5VX+obvhb)Gltv+x<ON_8J^aMe_tBLUrPsQce7xtteRa$Tww;p=Q~|q;yfu
z)t!w_9t&UVCGdZ_Eqx~Yi}&J)-FtT_&s^w|z9i`9wpG9M{9_$Y9*W=5^1D|_>g*O_
zttGSMazh_wt^ToOMNr8))l<bfmv+7X?&n@2cg#FuYQ{9fmiRV3W(mFN+Ad$7YVV4g
zeB#`VN#YBvS0=BtteUj-qF;%Qsl<i*kL7qo)nCQEv@6ndICHaAUC-g@qeJ12X@76t
zS#4^lE@i}G_CkHKoI^J6&X3cMXGLaqyt@z?+n8_l!SL_7+K0MtCe|}mbkEqerL}(j
z+tj>&HGDbU?7>mix;u|QRDMw@S(vm+Z0QD9_t05W9<QFb;A{H__FMOs?+}{b5`K;I
zZSlPKT+hoc&W-%doM>^i{8aY4w@1P|Sa-BO-M014f*;w7%QL?igg2VMn&Lch1MAXi
zxf+$DC2M$1Uw-=ixWMq^bGv|^jx8sy-qtwS_ax52SfC};ZPRk@y0Cqbj++t^+7Hf?
z_|njJ^u6W3((;vkH!92$pRf2UAeW`Km7(gAp`fq-(ZdbSXN8}6sWh-jWf!<OJ{I|L
z_U#tA=4U4g7W|S-kd&5wxtoQx{_@YC?;C4wnp(#zt@!hMo9#cvjC(nI;tkjFOJ6hI
zRA!emr}9DGIv$R0E}yyXSEp`SUi<EfH`5w(k3YSRwmYVp|6fw}Eiv$H^V%QZIcBfl
z+pzM6!j=bHBiF=C=*j5N`svD8C1A>Ys>e+^MC0xUxqn)>ZaTX?D0L{mYtLmRGP@=3
z!Y(~O-@B~=N6zZZHet4&sS%dfkZ+y6`oU|zv(klIBTJLkd@?WlJMCHX-*u+CyoD1*
zzh0W_8qNN0-7=wi|F{EbU-U~p>}=|ih+FIUf~9PQ!}pSaRiC>}Gh`RpvZu``HDBP-
z^0IH!!wTMA3%K^|el7Pp<6&^p(cqVCjG|Xp9Q-73*Ktmio(7MHv6<JKw&+9C<QMYI
zyzJI%D5U>uQP)3_y>-7oT|6c(>S6oCU#9%~seqqK0;_Yqr0(_PPugT;+d9vYd85;}
ztsUQHixya3tBFy%r~3MjZiS)HERUE#=?NXjnYTY@UgemlaO#J*Nk#-`l)Glw)Qf(z
zqtqrVAJ<n`S!0m+D|_LNv#U<ut%$!Xqy2^P?eayhPAN(1s;?3*_;^$4uocJVGtw^l
zle<ms_pW?qwJXK{(8E;zp46f_zY<nnSDasWn637ARY_4nO;L{6Pv_i#3)VTW<e9F$
z@QN1R{dU$Y?KKPQI~BX^k4cF7pFTco@sH1(K0$vjre$`|{;<z}p6i$OTO9r;_wMQ6
z@@7Zb^tbza3-yn>C5CXR-nQNtbnC^ULm@u0FA7x88eBj1@9M4J;*r%VQa2giZ~5?H
zXGV6t?&`ek?6?Na6WWV(pFK=wN?u*%v|IgK_E}T6uc~3omi&8B?j-wb#<>Z_cKUj&
zw^lp5f0$Oe{^O;HtGtUMEt%IQ-e2c@<^S>gEwlI6i@kq0@92Bp|NlSUYn1y}AZ9MT
zWBv48ftgOeyNXwPJ-K__E?g&T!k+z^zXcYTxjwgVH2nR3L6E{^`;~SNE#vD=Z`7OK
z*!|M(M8frnJnIYPo6p*MpL+f3{5fMC`*-=5Cz}}`sJ453qUi0<^R;o7vF*Z-Ov=u$
zcFVWBpD6mOt3G1q-Ndh^tam3&+AyJEeRR3C;Iy2OMb|_o$E*BOdKIb1v)kKG;s1Uc
z@z;|juO_`*n;kB{&(7{<_0LcD4{w^b?|)Vd1l8{;)P4Oa{P!>WWBbCGig<;ikA~F>
zY5)FjBYf%6m-;oLne!)Q?a{DVDl#d(|L^j7TlUYIyMNZ)`S;&k`Sj#p*ix%wyLnGf
zZJX$-mLgRt`-gu^pVXPefTl`A&vKm$4UQptl~PMrtSWH%cSt%@C-rPv!KC?7OV=50
zp0wcZZPm#!?(3H{Tt9Kn`N!ISpV)Gqyqv4G%~!OzoU>Iiz{HwceznCLu_FvJ_6wEQ
zCbL+H|7$Csa;CLDqGazM7p948t5%twZ+7sIjcAUwXV|;9^(ouw#RoKg-mQrA-~LbF
zyWznsDUT-Ed(#s1zL}ZrtXt@EC3x2VwwEI7Iry&UJlMAK@HHmeO@f&r=idrG+Ow0L
zDNK5wkMxnXZ66aJEdO)3#XeMtE#vo@k}#+CH$~CEC*HG~^El|vZ2unuEBFeWbQ;Z$
zE>iY;_UGZ1Q~4hG29a$WH<#S8*06q@8W|)j!TY&E!8X%Zfxqm~RbQsIQ?Ba*WG&tw
zb849-$}-(1_-Ts9Qojb%McvljlWtU~F*2COXJ3*~@=)iV@uuaJU)cR8IlYNr)OPPV
z<aBQPoJ)b~qH1a08{V_LKGd|ur6rqpb3@o_*XP@g?D${gaZ<E&W`WZco4rdtlK$vv
zPUU-XW%05lYTW`7+#dpGS+h30^gR<LvCSi+e3R>bQ(^1773<HmZ2oy{@v(m*f=_2o
zpRsIy!Y#SC(U<a!uf-h=b4_@iqcn9FtLh1_ZAH1-tg_pr=T3^)_`;~}X|3vcca3Jl
zl4Uc3<WGh+9Y}a>5Voy%Yx2ISheO<+bFf)iT)Ve$Tio?a970nbzttBNJwAKs*HFWY
z>~YP@xwSsKu}jK|d{|%V$ME*}Fa3%C|Fr#^qNrxWC?|05Q`sNauSZ)%c$XP>=v44C
z<{WgF<yRALRe3C1BDO_h=RCgo*E*i0&cD{k%+KmQ&zGfcUd{&T635!+qZeIPFt%^p
zWB%_qPjuD15L1bU>xHL}Byaw(#z}KgIiK(IH8&MEt-EwFAg@AW#qu>Wr;6u>cRf$k
z=-(;jAr{+Kc`PBd-|+8)zQodi2}?l-gbJPIx^$h>b&AE*(6Gs$nN&<UiqC|rzR;U{
zc7c0?=X%ZME(;VG9!gn9-rA@iY-O|KjO^1tzqUlW^2P-B&e4xrbGbrciQ$BVEBtH1
z4%xWAIOZATmvQx!OtweRm8bJklP`U`P<fE^di961mKifFrLJgSJEXLdMLNT{%DK8d
zfKOO8D>U7p-uG%@Z^l=SAffL!w7+CA7e~&HShjYnnd#hB2Txt$^)UFev%EHl>CNO%
zOLl3^_|?ii+3d?H_E0x--r7v{Sp^e~BTaruu9jHER1_7Lu{?9LO-cRRWqO|<DV^LM
zwTu1c1Ey(<j))ZIY`wf^Yqm*x!OYH%RTtm3f4BN8p!LgG+KBs!m#67-uPX|xOD<jR
zubkX`{_UfB(W>tHN>BcV3wP_be*g91=fRIB&%IvEAlDb{k}uk6@kov@QFp4Ta(fi-
zk;d76P47PPo84mkFOPcLo%Xagi+Cmm21Ql|24y_A-5DWnyQ>X}&Ax3QQu}@VjtT6y
zw+MPlG_(EMuq>7P^{qpP>@<#Qd@I#e^LCqb_v`)lUS+c^crQ15J}EwL`Ta$d@Q;55
zf3vH!i$cVfzh;^$ywqWHi$Cvq?KyfkbY>m!GGFgz6V4~L`DeSPt=*wzPCwehv^6$3
zube%r>!9NL#Vbs9wdrU_Uza*#Bv87zmwDZkvOAn>b3}Nn-)$9qCAp*ZY`}3VZ>G(<
z=l?IzD%)y*=vnA~ONPj|Uzgr^=Wy`++50lm`c6`+IX9ktKkU2hSJCEQyY~Iw)6;M*
zU|())jqr|7^?diao?b9vd%5%Qn(xtpQ@rzX-)9^C@N(0;oGS7|WWAuCB44fUqq@xp
zCJ707?a=YoIrT}VX|Af}KK^ezYk20(JNNLwsTY46=P%!qe^&ptS;nL(dq1*26ZGB1
zKH1E5UTKET#;V18&k7#!nmX0#kz$VDVMFUiX@$sjuMLFXOT3I=k_c7r31d{zxlnLm
zZrG0eBkMVH-mQN>{X>(9%C@B%+PR%yHl5FIQ9XKW(mg}#(_0TVS)a3Mx@9n}a$2C_
z&R4H3ePyQ`ot&w$$L~$?<jXO~0<xGbpWaZ8Jf7NZ=6QMJ(}dO>kHpxbmYO-Xdk<Ho
znk_lD=JBzc;tyA;%!@ywzT*C&JeBe%E6&Zib}7l@R)0&&)ti#FTWVJu>`!1nz9rg2
zbooy855fyCXq5$g<oj#U`tti(em&icNP(@ZcYG>8#QNoW^CkT^D$5@pdUWyo%p)c3
z5?|csZ$Eay@??0D#LKne+c&uWYQ1vI(&Wy?wJDhrDo?v~{QCPplo+UdtlRW&cCz{W
z;EewasOj^k!o*Xc^r=7~eH!CQpVn-=UlM&!i(NBqZLJOH3VicA%4b@S%I??u?@xWR
zrBG@a`{Wbu&*xOX+p6~A@4sKyzl1$mq2m|Ms-^DLn8r9?YF@a7ZSv*}Chxm@BtC{%
zTFgFc@ALAbpqc0)^DR-1jj~>Muarp0e6s5DTAY1i)27n32X&YO&2L#e@X9<s_rfVY
ziEEKcvvVu|v4?Iv{Fh^P_}^y?DO;~kO4`lL`gZnyOS5?fQe}6&m9GdFaL?8d0;kWv
zzT5s3ZT_=s*Y7<Y4c89r$Zf5;y602<H$?ipw{4Ne^gFliz51D8Dk<qN9{3=5kK2wG
ziz!ud-)FN<6PXZjC^a%EaN2T#H##RiT7?{W>ipqL1y^;L+xzc-Y?jq#*4^CZIC;sN
zsrCl_8JElrGK0l8@%5^P<!{+;$rQ12Q;^4<_OqF0Y3>EgDyK_j-5$v*Z&hswEIpJV
z>TrnZEZd#T*8J8Vrj2KRRqbs^U$X4hv_)&Ss9rj4w_b3Xh_rWA`x~9>Y~1fGK67Xt
zj(8U7)_yXye%@t;BF)KjIuE@*VrOo7HkD_o*@WOe+exJ{+cGAb$VT&pooExerpkVz
z{pMrqHQ{N_S!b;B=G2O<^Lq5twWj5l=^M8q_r6zWGIe#^mi+bbh?qC$g8A*~T%WnO
zU0-(B$*OQpHIuy{*V-g@(f1engJ;ym|9Nn!X&P(b?k??m)fk6*YmL8W`ii9VbmVF_
zdHRHRINtxY$F%L2N_<D+lI>CV4vD=K50YGdp}>9mq@{@yrf6@nu+4e+F~Q@}-;}@R
z$Mfpk7XD>MO`q*<9(R+N7#QRUq)$^^>2r;sXC^x|eQw2)K20F$^ZC5ucNanF^C9;1
znF>jtQXgY1E#{s*zwFBoj@MidrK8p^IKa0wFH4K9eNW$_OE080t;vbaHaP8YrPqva
zN6@W8^(~tMP2TLh?zSTRf!H-?+1EOpXUuH=H?O*J?H@d;PEXp*%4%<3U!1dtBXi1z
zwAc6f&2N4>efHDqSMNS6F-1B5TqgR-_ra<EH|w>hIA4}n@?325tz6eYy`5Y4uK#>6
z+^A@#-l7A`D|!n!3tzmpd1ub8qp7&C<@BZ_i*)=IZbVLa{5xU(>EjPxzGV5frsv-K
zpOs#}ul?DS+pOk!Q@TDu?&1<_gUsM3k?qHXR-50tEyK7bBvMo5-Qi~@GMklmFiv{9
zi_iGs!gOmHS+9mguUal@Ikd1!@$R_HRi699wDIfTuYZ~1Cb%8hCX%vLH!$v7X77e2
z*CT?gQ_^>uMHC#L=^h|_%;>z4mRfkN?edwAgVZdATd#N4W);mkE#Z}`uw0~C<@Ju7
zi)xux+ho>E;MH8?%{QTc^YZeD^=I17%qYEM@mnco>XFagKRCWdU+I0)Cv$b?<)|ng
z%ioO?HvIX}Xm@j8=#2Ocd!29TE$MoENBBo)K!&LGii-BS8He8de#SmsY>Q6Et<adC
z(hr$_opyXFUN+@&LE^^;uYHnsIr98kd_Fq)#hfSFhCN@xPDkHR`0JGQm__Q{3%^Y!
zJd=uC#g@0bSJ+5Qs<4mze|F>S`GFWksDAu4*`v%14Es3oSMlbEB)T>9V%}{tk=pCw
z0w<eQjy!v_C|Z!YHbQp2@vJh|q!Q^M=LJi(XLGo6sia!h@AvlFwnRg&jrVi&;(+PT
z=M`5})cVTpyZ6^{-*Zh5=EtdQmp;vDo;Pv6_q2Bjf7<+-vW>!@Zhm%qu4=y8<?YFT
zes!)XbFga;oRqSGec>r4b7Af^98EE+n^ZjGZhARS5{R4P6@6$)$h63HOE{a-d}m&s
zT&uV9j!@c(S6fPSSXfsxzHn+d9RG0h>WDS7)JpOvoJ~1=Nqxf2l^4zT|5zB8!<G5)
z1lK-G(aKNV$y`g5TUv@XEn02AUvJXS_1!<0Kb_vcx#7X`oBLMourUAe;NQ!APcJp;
znLhZwGVP`wtK$T&G#}qLvCcZLF7~81vQJsV@M&I4+>PBE;?5|z+wXj0=BdQ2BrkYA
zy=_YU=RY$mzAU+>eCgq(>iddY`m%H1C9e`H5xH!<&;8xOBe{m(+|Ez7&1hcHm*KlP
zJfX#>NN+*3*-;JOxRu#nlR`x89M^q0zU|$tKkxkRguLjwYv^5eD&gYqsQ){8_|Gdh
z-6>wX#QjlQ!o3sXstZG3+uc}Ya^uBQzFAtllAC*WaXnejTl%(Y_QuKg@3+6%cW_R6
z3#Z`HDd~M#9qsztABVK4gwI-%ksIsz-6terk%io%xxQMgn|G}BSQB)pq1>aRR*-L7
z!w#Q=bC>-P7YWKy-?8yx_p9S4e_gFQ-e8vQ)th>27W4Mq8guToiAVie8zdg(_{`kg
zqUDvb;^k;7$*%Rh1_e9Y`-7IHbSNfO7aaU9epT|4ftgDuPjteiC9_MnFOjPbl6~PC
zb9P6g_+u5WLc6R2NgwUChB1#M1FLMOf3DudSi>~ML`ikCMIo<cgTwm9wvP&TnVSXb
zB;I$&y<48YeDCa|smu7DJ$!e0`?Gno=B_F@m3u+v&Zf#TNzIsPUNXf?b8QW720t&-
zF5cx<!fnRIe&FGW&u_G|6yqM&uTT{75pYsVx6HkKu5MND)jd6j-rv8t_4AQCO)O`1
zR3vj&>GqkoKd7&tC8@Qe=2gq5SqXbS?z^J6zWCwt4WBK~NdD?@a$2qZ|NFUx{|@!+
zb)QkTP-u~9<;F$)SC{?#+7)BJ=J$;cpT3@+7Ag_U?Oq=uyJDe?xv$WkXrpAS&zq!d
z>z*x2Omhk1nRv$f(S?r&x~DJP{Zkx!zarFX``wfpo2swJ<329FzrW1m_`R$D4&KO_
zcJEHh$6rrZ<S4XH-<0ojR&4D~_e{~-hnyF$+q%T@&`xL51eu_Yb$-3;-JWpCPrMg;
zNBqzICvjrG?LB;-{dalesm1k|8?~bP{!#r$J~IQuArAbdfF)8X5OOf@wuQjn*V-LV
z95^@bEECWXV7A@Tcbm<3H)~Q!^pZ9QZ)I>P@YJGyzq8l2B|Bns0@v_u^Etn#GXGiO
zxs!jN&tCu7dSc@ygMDWmEdx0Wj6dyqbW`lu^c<nNlXtG0*Lx#JcIO<Q^~Zh``c8{h
zkUyB^T6ClFN@(ZFBaHfsR~YP4$&9+P&TPUmmnl=t`U;kAdF+>wx_E`{<!>LJ&C_0J
z))KwRM&_;e$pexM+a^5tIQ_>vWwF!SIBrL#7)O47BN$Sr@kLc;Unbwi5XWgbKi_^<
zn!7*#jQyRuD)Vj*J6@*f>rQgP_kYO$t#2(#&|>~k*|GC&-y)4uD%-bdR^FY~!_G1(
zQiMTNzj2R}Nx;5kXA}8Y%e*umUNYIH&@ISWljiYr{i*L=r`sK}OqFc)n*Ud~gn2GL
zYrk#Xfg_yOkJz6u`dng7&P`kD#jU7#w{c^~+n0V9nT4yQuD30jsdxB=;TP}Orhhkg
zAAi;^5@4OUg=^s<p%SK_OGHa@{x(NUbzL%DQs**T(L0OJf*uzlwq3o(J85Ik<ntFf
zV@_ElE2*!aAl~PZdu-;CB^TOKZZxP(db?xI!DF6AOA4<<dcHGQ>NEG+B_{#P?+Kr+
ztxhof{QPR)-B04H(<3~&UOy6_$Uph2=bH6rZe<$0-ck6?b4RYv#T5I7f8mAqJSUye
z*ZXkJyjSgVw%I~;jptAD6?TSQnW%fe@q5$`>A0lRM}>5YSqh@pdEAgZ%NO{obFa*t
z?T7h2{~k&xyS)0e;zfa7n`_O@!`Cl&S`lM^^Y?6i_RqK0t}B#Z6Da&>-Tc2ByzH-V
zi90>DdSzDsMlrkEK<9Qt_e)L#S=Phq&9g5$p7EP$Zz`bKC!%<H@w0Uq`tv1U_pC_z
z_1D^W*WFEwtZmjF#Szz~V_4)A-#jS0?Xgg<TF+Abg{ev2;~i;p661e*dvo`lbyK`D
z)2ilv#g*-Mc3HQ)<jd0Bt)@Ti&Azzp(l+0|8oY}=t$pNv*_w<)GH(vsR0k|C`lIS|
z@r~AVHU3Rewu!Zghu?Ih7+qfVqVsUy<u$8T>~A{0Bk^(R)7@{&FC4a8ai70Q-s#^d
z<+tqRZ~0$;iYzO1oP5<gfBS^xesX5Z61&&#bj~!rf1q~tx@^zx7Vid02kR7p`LbN|
zdrwI2Q`);ZMdQc!C;wvJ{8uoY`(Jz``$~;3XdQFaCxr^_%nS@~@#j|~q>lO45Z`=o
zehn8m*(j7$oSWb1%KPMkRi1gqEnR`d@*d2M)7;DiXNh=t75@9nr+IVIqir{m0%db%
z&a3=<@66*llW+Hj#~(9SVopu0ncG~nNFd?alhBi!b$il5`L$JVe$R~@*_pn}^p9;m
znd21}t?(X{VOKc5Dr!G@gz>&>VB(j)C7FRcPdUsI+Niy?utj^RY`K%RwCmfM+uF^)
zhj49Gyff+Q!;JltdFC)Ccyr3tx4ySa+L_h8;g-_Ule5zK7kqMF=>PCTX>rF=u1!g+
z*UL|T`RM)AM|Z!rZ~xr!;IhJoQq?DhU$_3h_&;2OeVIwa{Pr2I-)VF$@+r!8K6!JE
zt|UK)%4ZD*t$oZzo*A-EnZ+}l8|Mmn?J()pJ(1+XG~Y7l-|{beAAQoBuuFcT-1LM0
zZJi{xGEVh+nBaFU%6rX^Hg9gv#W(G@X&pSmX?=}Xl>LM3sizNBUw)dXwmE2N>x2o{
z5_B$oIJGQeI;U-Kw(}*Q_f6ggUxH_w{$1UD+_F_9V5>n?Yd|9BthSm9Tvm+#9M@b@
zy7ZZ6S|+n)`JA5|Dj7PrvtF~Ej97W{d4`l;>Kwy~lf9p`UJjXEsHUm8MN#tGlFk&<
z>7q9*JljnAth`UkE_)Ny?z>&UMbGBOqc%PxhkrYE&2RW~^p#}Tq(i%YL_WFu<e$p5
z@U*uk;AW`C9kXSZr+=}&U@!XISN-IpM@-k9FJ~Clo>cq7@^nrO+oWt)*_)rF_WV6$
z`bj8SZ(7Do<%Ziuu7BPtoZS`pYoe|Eob89pLD~4#%WnI27w3%J-+6g?nf|Q-JL|S=
z4}Z`1Y-@Dv!&ecD)sDp4|4e-QC&2rT?9$gOZvR=>zUJ-04LQtu%hV5)i15tk$#Y{j
zv`_ta!(oX<P>WChtlf+D)}*a5Uexn)d%nrbYXWg426r519o}{8LEZ<B#MtfKo?Krq
z6rZ$oT)(hT`nc(1p4DgLqoRH+ZFX8=9QtG5rxp1-O3gVg%Z3D%`Nplgk-If-dhMIn
ziFa;K3-8$fF5+T~<&E~rZwvgM{_vi$=w|3SU%8a6Rfm2ZYP%_TGG$rlMd5bY<&lv=
z^{oAchmXC!RDS#Yg59+N`{h~gxBjW_-y(l!tNohO&u<=O^?f(LdUvZ$>8A~bywN#l
zdA(NuV9SdxjrERFiD5d!a7(fI$D4p3IWFfuh`yYw>U{9O|GWO9|JYW(e6+vA*28t-
ze<sv=*Xx+@oN8wVhUMjq3`*Ds*ea6qQ&JJt?%Ue8Wp~UrJ*c;5bw9WFO<(kuKNIit
zq}xbGW?9=#RF(Dgdo#84*M{9Ug_6x~I&ad=EGao>cY5EEfA`&Qs^472<iNyopnuvN
z&!TqqiK;>xB3!Lbp$h{lUdYJ5+jsvC_j1QMtg{zK3Os*k!*fae+_y{f<5*_<?_JBz
zKX-0Q<=nRC;yXW=ygvE)?DA;;`4;Npji1d<Ou8|Xb$+u(q~3x}liB}0I@nw}OJ~l<
zihZZTGY#adA12LQvh(rr!b!g?XB@fN%>L(Yji~=;mCj9#o1<DcH%>l~f6~a~uZ<_W
zpHxTF&#y*3=Vk4S{VJH}HCTUKKEJ7A+Q;ipe}_t(U8OJHQ7q!O<$GX}-o2kMD@D?F
z{@5~EXIi4jlG`sUFSao#pAyiFTYIiO{BlBPtjvb+qxTmjIn}2wy2tqUXL13r$V_YX
zdneluKdgA({_tG?;=ktlauy#xbX}1Sd@K5|kg0-gXH42D!?UYaoNhg2!G9@L>VSV>
zPRPEh4+&fLTi>xSjI(-o{7&tMy5|Yy9T9u)+O?FMzq?ZVa7W}OujL0#X0qP9GJ6+u
zlfM1B{-b|Nss!u!8Wt>53g*31)cIffbX;ty2G9E2;&oqE)IMyz_A}*E_s0L+Yc(8>
z9!fhPF7<#r*)aM18P{GBWAUp|$0r?Il(?pU|Hgze$#b8*0>7OLs3_wN=HxDBn^(y#
zU_ZO_xSd3n%Cbui_bmV9x-4(%ny=dvGdr|hciWU0mYwpUr#6+h9eN%Zrt7`_%cAZ4
z-`Wq~ef;s<?#Gjxw?AH7UVS)uR#{>86_y2i-~KiKeLMeZ=kCSf0+&;t7reh~_%C0>
zDTXhVFYfPMmd4Mf`T@+#A9OvQ@4nvuSl-qHZ=0JBPhPH4{6O5PTJmQiPw2PF76uc_
zxEJP1cIN&4#IoPUu(q-*e%`EoHiz}kzgd$ib2^-zy?TxL59zY!DzU5qe+~<*c)aJ^
zVxIrE><bcixc#=z+kZ>Cul>D$+wbFxn`_NJ#4)MHo?kxSA>)^Mvi{94J5rr~Eq@po
z`TC@Jw8zYOzvUv2R(|SbpHi^z?knjZM{7UD=>D0*RsVVI&JV_0KNyGokS>0>JnP}|
zH6MzL6Aw7+{W((I*E&CvD?gM=_{s8ThoZ9{>W2O3-1uSs{FABw-`E~rly<0gdBfkn
z1$O_>MSO{7eYKtC>(6@0Zo6tN@!Ds$M;ARiSn<t8_ZLfd-R0}v_v|VRxS#dyKeaGH
z&gb(-(J;w+wp2!u332yt{*hiKzdBW9PMYP4xCLr+3|UqD*T;(pOuyVX`RV4Ash9UV
z&SKinnR~*T<*Ke+`ahc&b9Y@~TB&<t&Fnpz-+LB{Pe^;Rhpln%{3q)thuTOl%bYaL
zcWK=WR#DSc&)=zNUubriToU0f^J@2V8Mj9MqlYb+6=f_HSL7Ezw~Dl!o>=zqN$2LK
z^_CfHd%|Kezr?ihPKouiz0eSr>2v@8mrFOZ98%xq9rtUnus&I`%j<H&vzR!CdW*Cb
z>w}W@=SaJ)ioPeM&KkhC;!bhw`{^n@)tYN2Fs}01d*!di?_Z1E?f13KU$>z0zP114
ztDCl8{k|zx#3}ZL!+gft7d_9eI5OJC>8dSwe0Gw8a#ie)`Hf7|ITx7oiq}2SS$I|E
zOYWsVk0dYga91}et?|8}6>gY)^5^Q$TU5F-p1+=Muy{rr=aL^hQPw4=15+l6KRc-O
z`s?Xa406B!Nha(QnGmN@bDHgN;;z**#qACxoj5+Z-+HFF-;9F|>V8Z;kCOLC{NH?4
zXzSeuw!a5WK5g!~@m__uDbXj!FZZE~WdC7{GshptiMbTdlG*WZ3df^t{b=8`#94bA
zIyX!E6`SRYbfjza<X?@lT=_O6n}1DD@GQl7OD-lay=>h0@ZpmzYu{Qs*67D>Ec&+u
z9Na#HHHbg>b2F!BDW}Yt>K~%7_jWf<@^Vc%^d;v(!>!h1_qhKEpJln;z|5ELmMrAo
z9Otn$HKMk3jrSDWdQPPjw@@!ju?J2!1Dx5;M?aZyh()uidgdYZdskVuy1sesSunMq
zFW}iiPMf|9i)tJHWWJCL{Ujl={kvhAx6ad7=agrN9u=P>p?HofGiS;>g}pY85xzC2
zb5HfwoXy?pe(ug*&b{aBws7Umoy~OVt;50dJ}1xd^1PXQZ;JI@o-1$vw<d%}$hu!R
z^p3f`K;fQoVN$ACK;jRl|EJDms+jI6m#=^O$Re`6>A<J;3^V>;YdSKut2pE2PQk}d
zYX08HO)A@aaZ--8(Jr<{PY*nBQSEdHFlD$MKWkY;ms;iisE!j&Mj{@~OSOb}?}@}7
zvX7|WcV^D)-SUrTFS>b~>;D3ob*c0H51OXSo%0CwG#5x<^IOQi^?^wP_xp#-U0H&%
zn@<U3)OgkZNuK&-!OVx+VQT~VR^|LV{<zq1no;ViOAR;J{^=?Py_9^oq42QF^|sXk
z?3S|}4Kn4{><d!lb`UI*tNnj9{{OcdZ>tl{xQ(yeEwT&X({lK6`=yx9<^$@|>jX<u
z7ijTn-MLeDxBkVPn1)q{vkvR;GiL04XT)*&=7E_k!SbdLynmc`_s>1FY-#b2S9^_{
z%NBU)G&ZpvmRK=;$$}kL$pMRxRmB#m>NQ2aI4obYWx-ty?+M#itXl3Xe95biIcWO1
zj_04_;&qp5>0jazy<Dxpxpy;L>$7`ld;ALZWDDOFKa42Z^hD|a%Pa2_-yc}JFAE7Q
zF{-@4uamW?ca^HB?fwtO!RI+YdrorEUnSE%Lpws-<;jl13|2?4OSe6hJniEA<u>io
z6J`17q;>mj?W&wfU8}$Ni+3yL&o2nPxK1lW?Lbqx&xEUw<kHv7d+>DM!oC&h;g-Hz
zR$t_4tjxQ3%}{e;{lzI4HmzSK`lQcy_Uy|iv|b$P{JmPxQ;DZ*s=mL3x9}W>+?$&^
z+f+RN`yMfK*^;=`CvYOiS>2EQ^EN5W;0iHu`<duBWpU`7_U?u`xwhqkX_8i}E_7Zx
z6|yDiCd=QIx9bz8?T%f0EIP8`d}xHe=>AyI1*=c6?QQmoJZe_EpE<VT=$tm&jgQ}a
z6t8_}+4Yxo)x$HNUq<cmWZq`j+bwbX?^orU>?LLeOJt*#PTAsHt#(^}b?Ss~zv3=(
zIR+mH5xbK*>ra#2gHQ`$H+O-0zRN1dG+BeSdDH6NRZo<k-+z8#NZBhV`#+&mcBjWl
z=_t!D+rPWBE_QqUuSYLG8*gPiq_96u$<%Mp%K44AcwP(sGF;oMdfMjnL;m+RCua89
zx0&t;e>36x9j2^@pRZJz_&&0Hd-rqRT=tI^b3(tKZsqss?7LFv$x!TR-xW1g@ydpe
z$1b_58-+w)4HwmV<~Ys#&|)VIo<P_9&>gnxG7sF_u6b3AHEfqQ-)4rXhZW|<nSVEo
zG>SBE+q^7f@9L)u%(#su)mPW-JZ0RxUTp8jMW$x%sn?F?rW;H$darb{Vd8Y{t06kC
znq5A8+@3#wH(T}e?GJywWa3)!cCy05dxdu8lTPYC{nl7(?{4(e&G7rg#Rbftb$Cxi
zeO!K-VanH;pDn)>-dFHh$-udhr!|C6N%r1yzNCV;4PLyT1ikfC9=teJ_UA_A(TDb7
z34-Trp6mJ~-3gv?s7fF<xiwqIjiD=v?}SeK&O?!$F5Em<X0llK*xtE(z*ojDqQOzd
zFvNnxNpkL=n(Fq-+Ubh-Id||ZKC#p1lK&O?A9{`T=1KE8Q_3dBTzbdJ=<-_h)`K63
zp-Uv{{3a;PWMB48E4gDb?^Mr%##uXh*(#1$a!AGe-=N0cwj)W}BkjC`)CcK;(pKq<
z+rAfXoGf_c<f}hP3<)3O&r32X7yanxtXDXw(j&=vLMHui$fWp%MK|A@%wX3%vxz}q
zR#NWyN>v$l@suZ3XHIV5_#^R~-{L1<x2FP!(49HTJ<VRdF={f$eHKhs-zl#ce6~=z
zUD^EBQ|s`^RvQj^0iDjpQ5}z;KH=)-n7&+zZO79N7jub@pGhaDzgr~oN>Xl*zWS5Y
z8Sx1jQFk66P5ijKMO60yud~FH>F>1W=hr>|X6Vs-b7k4xM<0`)`^VS*efQ*Rd3^m>
z^|J|qh2dLIuica}Ni@5#G3e&mNj5QlVtL9(y^q;4epuHoSRwbX;@<1;d#_GfDf;Z`
zyjS({E$=G>cS-phrft~%Vg05L^ACEf6viJ?l;3=@-EL`8&kNU=6BCuDy=^KqJ$XB_
zF>FJ^d$$cNF>_zmGIS*UG0Nw3>dswZ^kIqrhPAum>OU;KBIx;miI4k#a6@#nEvx)m
zLl)nFV=|Wa1b^u6VA4&SQ&ZI`sQmX;#>XOlkxzb|K~1M}0)H<$Vs;_?+1dEH92-m?
zd1<5_kYJWO?qd;}vEc1az8wP9fyay<xV>|%n$x_uSTD<Ia+lk=*cnG&NiCH7l=}V9
z`57&~i!^o~dCIWiaJ|tCJ?^88r>{mtNpl=OF5y`CPvYMEdij{n>Fif7<{0~3YL&O$
z_v_v5kK517KTi2FiAkz`=_-9Ef3-uMlQwNzr?q5h%a!(+i+e(jGc11Uur#&wezUHW
z{!jgTF^-zaalr>IMcxR+JZ07P{nK-7hWXX^^Yi9<mfTT`U$og#_GW?FL77q^8J7B4
z>kG~*a#?Y3-@VCg-!A&)!PWcye0+Xha`XNeEfd<&dO)N8FlWVS_eaYVuD*RNt#oN^
zWltVgEI(J$`@FqJ))sBa*pQML@-8T0T7u8Q;uY-unSQ1pjQgJ}{<kz*sq^00;Bnju
z`I-M?L>!K%yKtLHzt-rn?{&S<WYp4hu$x2p!p}*cC0h13zy4{&Yrpsu+YctyNhU5^
zg-Rx#ZfIY$Va6PR5Js^(I-*M|`VP#m^lIiQf2jFRBW%Z|^*YWIb#}NO;51#dX5Nx2
zF7qAxk8JoR{v?3?RG`5913%{|w)ZXnIaNs^BBet~dDUz)Yw?3$gah}wJGvCg#eR2`
z<XSh)f%n4PitYu9^Mwy4{AFUwJyq<lurz3O&&-L+m#g2Mw@C4sxWp_YDduEipoLlM
zDc`R1?%@j<#cVwu_pf`^GVxdad=DR{=Qe+28pOJ#)fRlNFF8F;L?*(;Z$ewZoB0PN
zbnp5YHkSohFATfEVI8BR&lIpY{llakt$ROToPF}GTuFMMMI>8FpTV6Q3$}K1F7moP
ziT&sERlKWoZnm9zRo=}ieW7dnhv}<q)<t#Km+rf1G-E!iz_q`Bc5$5w$lB9lsw-hW
z-I?3oCVpv3XNhiq-JDxin=UV3G1b((nQt~<>5lfLrIlND+p#;H*`i_TpLo|nd8^#I
zRrj|ZZ<uHn+xRg)dUZ+1mW-ygyLBZTJ#JrW47Oe}Sv%%Y*2x2BvPyE*!oOaqxSbN@
zZ26ldNoCVCXSc&&7iA@Ei76?$+P%hGsO-lz)759aE{CP=&~X*p!+BV!?exSC4d<>-
zo4HSEPTJL(VrLGoo_BD68ry@Dw~s&FmvO#UbWU?x;g45;zx}L~n!}v4Y&}PPb9CvO
zQ*#WzxvJW2vfX*MZw60dV`jVi_P&WiZNKt%>rI_g&Odi$Zgp>-%-UV0%&BK;OAlZB
zCUw{1nCn@V?B38#Z*+90PP@16YO?mMySw))r>Gp`ky$h+$GoRCXQ{y?L(d!45*Nx|
zl)P5j^fT~kY~+3GN$*>`Kg<2P+Tna$Pqd2R<6*^hYjvx`vILII*`jmbojp3~%G&w)
z1+Uk}9=}o8zPtR$trYV!-#s_J+LWTX>V|E}63*tlzm`wz7KOz=+;!NtWYMylc|YXi
zSprLJd=IDID?ODG5o(tHZeje|i!X0@U)pNT&AMz+`uDrX%}$iOmVf;0?jfg)>$Yb%
z>}Wr?_23fc`}f`p%q&Z}y>Vx8c<^M?n(Ozr9$gyzT_od$f6mq2nOm>j{k@G%>1Niw
zjLR3?Ys)XL&eL1vHe;=;oS)$N$#L;_cPR!7>^*Vkq{q1e?}+MxsqBXL|1U4P6nNnB
zS@osL;#;CuzVWvCvo>p+k%|>-T#fFBM*Si-4wHgvS5tj2y~6H*z!eu4hlhmUp1klB
z`_1r=%Pn^Hn3h)r#+4rv)6@6Xso9vwlbW&lM&*k?9@1Yw<(Zm@T&(I^cT8ulRpz88
zqTlB|aTeGh5^j0BOt*QzX#M=UcYz_NPaJ+%D0x@p>g=oUmx^#?KeM-A%pr5iEaFUK
zqtRBs&Boa^y$*JXCqDnY*;12a^-XD>%k3??0e(>mvrUwx4N@AjgXgzx6nxk=SNmhe
zxoHa=Y%_e{F4)I>rOz}e<o-uJ!yVPP*}mByjeEKE%gdEklV7W?3=&#CeHZgjr`%W9
zu1$N=xn)b+o(by>qvfYrD?aSm_@C?Fei7-E*{6=F+U*RNN}P4ZK*Zwg*_6<Y9H$iI
z(_bCW;pa6!FEI5|K=m2XEyw3Q=S{hCw`bx5rIT3~ZA-lq@@#{m&Mt1?-m*@#f9=(r
z$7}O-O^PJL3{Mqs+pnlGIQS}(oA2tg33q;I=CT<@h{;^>ov+{5;`d-y?NlqN*{j#u
zFV($m(tCK#^=NMP+uQtOf45nc3uHdKyCE#6Z|U{)Qe~ZECeJMI&TEWrzSg<u{pza|
zoiyj(Z57a3Qd+R~-2qcRMeXcRvztm65_u0h{F_=I$Etat>wM4^_laKTR_KU|{@Cbl
zn>jTy(eZzg#CoQ;$&C+I{#e_Zr!;X@fDe~Lo8v|EfY)qImK{BR78md2*skqVaXajR
z<65?VYgTE!T4U6|xvxU{Zc}t_ks3p=!vaTMv%YkGos~XaF0J>McSr8G$ozD(U(5O6
zdA=`2-75o|HqA9(FWarAz3?i>%!U^_X?L8r7u<Ay-m9S-Bdes+R$@ItQQ`Muql{=i
zqw^6Tro0a*lY2X-w6k5zG*>fRxMttFXE996jisY+J#b>2mLbe*;&^yw;G+<UDc41E
zez{$7z21K`X7j0eNj@J}L@m)Va5Y}^n|W!lm9%DT*g0YQlDPhR`(+;;%xagn`1sE5
z;qHk$&fWg7TXlmCC$FwSdsMLXuQz{Kp1k>ZDQ(J;m-SEI>{qJE7MpU}zig(<qr5l%
zMz#i%{g!+_w?X5MgyqR6iC)KqrwRCKo{#KLy6Jq_A?u$+Uy`8N$;DQh2UOqlR~Y|t
z5S<%g9Ao^_JRr(?f9m9%KgNqI8p8s2Y5hp)(%y90L_~9iv?IUR@;JsFRrlf=^*a{w
z)TCb3md@3PRX-S+KQ&x8j3dmuDlt4)+c8@=<m0BcM8!)BZ<#8emU3w~=?P90(>W?N
zx&LDA++z!x4@9puu~Te|)wdP<*vI~P+G!09!Qz)3;?rg%Uvd&=xu`eKH%+zs);H#t
zX-0F-%`Tl@)?(sl6tVYM!QQCZ*FzrHiEyk6m#{8f_@d@cis-g~3EinzQdXYVReX8E
zx$xD3d^wf_4}ve+E62V$oF8lZ_FX*lrrZrCUct)So=v?Iu_ezoI(qj(zGt(lOMU<B
zewg>6YwE(4TjMsIygFmLafc<>rX*W)u~*M#PPnzp{e4egvi1CSMT6~q0aYJ&PjG6#
z#+Rw<vV$)*du`#42sc~Vi`yDc2Gy2U+*%M5CYGd-z47nI-!~Ut>7BeL&;6p7M{42B
zmuDr8c11P@v0YtIc2)oSv9^@Cr*HHuTWb2NSnto7^PffLTIzk*-;rBuk^T15rln;a
z(rYUUI_EcR=DF;=TqELZoy!ho{@na2FK0PU?o5-8+s=4hAm{MHS&UPrNMACQ`StYM
z?$m8tMIxI^KSuV~uI0V9vEX71yV<eh>;BBR#Je}SQH4+PD4*-B9p{v-ZqEx@yXJmW
zO2f4YbK7_2|2}P#qWS6gL&e&oYvkT<T=VgS@KWae9)H7^1y0&4a=~t+PwC4m!U|#v
z+B-{ipJ@Nf+Q_UFylB}xKf$*@!ruCIg#6I6n#HqxZdsbmm%}EqmKGmeCmub&EZb=5
zDy~ycIuhm{uze!4_5Q3J=g?>+9<4Z~QtN|p=Q8A{t})vw_xVZmQ^$bKx573y+|GLx
zaWUkNzuM*n9xMgRjM7bm6B@f}Tw;$e;pN(zE6%JVe`2b}+IsO1k<2=Gr@!@+eOkEv
z`?q83@AZBwTU-7?!=G{gjX!y}FTIT1ophy1G4`6IPNSM!O^ETQzgDwWnLLg>bxZK=
zi@X1Rq*T--?T|U~WeRV}@~Ft|KE7q{UVJ)AkJd2nbn)9d?Tget$#?wy+x**PIhHMt
zczx&XIhDzt3FY4<`M1tay}8BgYwX4F*(v(p_i|2nH!=NmfUDhu;Hj6dWiGvvb*CfQ
za)XUz)#PoK*_sDdN0@iMo#~tNI9T-V=CVb*1>27uyZ*^?%l)}i*kc|2?oKn#`zd*1
z2~YO1_N~Wu*XKWO?ysF5X>&F3j8)Y0n9#@C&X$5tC!R^UZjqQ>+?9P{$EkRG$t=(C
z#v9xHKFr#frsT9XN_n5>1QF{KO9O(LZgM<vIGFGtB<$LvgYD-G<MwObk)NFHQ+Ir_
z=);wh4ea!%2JhOHk#nWs#`bytdW#P17x}(&(t_6O2`9g7TlHzyj~mzAjvlc*|8}S8
zN5PYe{N~Sj`8X);?-~F3Qv0SiS=!fzY0vt6`FXnAkv)&N7|hSScxLl=$^K~B^0lvA
zto2(T9hKF%D`8PQU1jlNmuxGMlExO(ClWVyEOZH!78OxDz0v>r%FdEod&@K~Y3||q
zsKl@<WbTD`%Y9;MH*MUd`r@R}3bncEYaVnNEzsWd>BUZFMkjak`KG7Y;&!&oJAXqX
z-2a0qzi}Vyg2mOTJgL(&jiP-&*G7xJJtB4ZZ3(wa6NCDznQLP;<z39Jzw1@6+28&5
z<ImK+7XnXj`dzW6`qi~r7c9eO>Ia_cxb#+a>#Gej895#~d|_}scJ|M<HzwPZ=k8qb
zdRpur(Vg~ISLbi$VN()Li~Yc`Kvy@GWnJ$vvFVAnO3}Ce=BO@=d)WG>qWJ7qCQ%lH
z%D%|QnH!B$o&LmaTeivVT;7d6T<P=wdYqJ3+nK!eQffx;!TDJ-vYj2%Uhe5qny0-n
zyK9MF+<(8b1*#YC`E9$Fv+A1Ga{=`y3mh&Bh^31NnA9+{-84A4?~9+z@3@ovdUGeA
zH3*N}HY={;+<8XV4O)>0LK7Aojk~aR_6nAx^9|g~pUh96XS_(JYD%BfL;b%d{L5FL
z@L!zGy&_ZO$4cj!JB90%Mg2ujZs4j+E4I1SruW<O*{w76t9Q4A&VD2Joilq`{m#-A
z=ijugJ(`!)lwYHAtFF&<f`{c1@7N205%v3KTOC<wdsM;w-)=kS*;jjRdCuu@y{E@~
zE&AxzEYqgvnXX+X$2->xx762Pe0bR;px=MO(sj>uG|#->y6DKq$`=OtQ4_o6p2}`L
z=E`ku-<nex!E{f>>)iVHiV6SAYp=QeSb1%>yj8D{dMR6xHgjElij%qfD_&1mYk&3P
zyIoFq3Y1ptzozoKi0AQlv!fRltj+c`&pP{7lIM<*%YL&Dci$Y;Juv0tAJfDSyaqpl
z+7tipag*0g{1d%kVb%2)x@*3#F)2D|e>gQTY|nbF49~YNn`g}0v-HS>2^&6}th}b7
z&h9)z-{{Yyz%y$<X~yV%+|_R>KCk|mbl_jlCdSyAJC@ka;0;(9@>wqK&}@?khm$iW
zA9?dlVBVCAtBa>@FzLBltD4g=^U;zW-Y$Avr#Zd<>^ioCgEv0Jyt2Qm|C^&yRH&OK
zchMJ-^shxXS?2tzKC^oAiOC9AO_UmMSX%rsu=|tvyTZcG&QeNNY141^P#)e~?Y!+t
z4WC=o(@vjwed4(2lKgLnZa#FMwEdy}?cDvz5r4lt=+f*nU<|yVwOV9)|FrFMa~O&)
zcW?Rre0lAeYr7TICnfdn=sP{-qL5#_knxm58T&pKK7Ke~&i~Ml!m^JalWUk;^B&&s
zmzLhj=WuGtF1_IC%lC%bE6kl@w%IiLL7c@UwfRYYBGqbJ_Ak`US>&4OB<e9kTE*xS
zqi*}P%9V5N_4!*~+hrf&u?}6`BeL|(X0GD1QYI|HzKz#E8qHAR_;FjAJ)?7@yW)$u
zv`@1iA71x#*`}k{W`0(Gusqv7dWV_xU*?)6v&E9k^)K&Yxp~FC@pMSIR6=rXaQLaa
zIYNIg%v@i!`|#q6{)g{=e0}j=!5(X?SN8u_ncuRnDL-^?PgCW+?`gW3t*4K2-s?9u
zP~p%xe$_#-=YERXzS8D{R$C&(ty`GZvRs*_-?rJ{yLyjIw3>2H$N{k(o~%pRqJk_k
zJrl2WyjXi>N!;Isn`c}6W>^2S$Rwh7y4|iy!!>~{k&kmTDs=A{9p~o%@JnVF@58$u
z{fw0wdLhmR3wSr4629=qj&XVrkKT&Kk{YW^7PfAVI<!cRJ$xslP~0lk?C$4FjO}Yb
z{`mMh+<%^3<-eNOv-5pgS5DSA^ZMog3lCGTOcocm=Qd<koL!%+6D%VtobP+!RGK!M
zZ|TuPN^Q;I{IiewcO1C>LPwiz@`9Nx>bDARSXTzVxoI76g~2yg(C%PpL-bTOCaI%W
zPU~wgOELMmQO+*F;aQNRdEYFBo8IM*S3i~waP>RJ{@$;vbL&>cCygNs=2S@MxC^QG
zmlV(Zb7StM?1b3eomZY|R@J6^^oHy%=H42z-?+pui($X|JGISUSX0+p$YyFkuHal#
z@V!xDuJ(zzdAs6e=ln6SnY7EcZtwQL&u*BmsZmorD9ZV6;)+w!2W!}724{DQ=)SC)
z5NT-otSvsdf0yqL3+p4>+h(TPb6ZSk*rfM5@}>6byvTzqtk#9^cX(&uc~GKk>649&
zyC+F5{LFH5&E(tzm%P{I?DW5N#Ua_6|DMaqBmHi>-^|;6%C2DMr&XqV0&V;myz(9|
z^5Xkff81h)=&mCc92G&!T8{bFXm2T4cWwo@{bRnRS;o`$bsc}zBGP{}KQz~kZ+e8j
zlGDz)3xh*ko}~ZmubA|vH1pt&>6%uYmx^Sp8=t)E^Lpa0F0f<0vqInck4y)TS3gww
zdinM7pm*oLHX6_W;wcpn-(OyTWVV2|z`xr^t0e+<OfTS1-F@vz`8l51TffWvn&3Cv
zwRg^j-4;_+o@!ms4q5k5cm2yN-JkZoXmi-hJoRzx_WfF?)~Jf|Ol@ABD&luIW)d5#
zU=-s4MY&Jeiv)Y0r>zetp3=*>&9o-a=8kp$^{$7ya}6dGihao5v$;Ekl`ZmF{N{%b
zw&y*XdMD~uuaMmKKgoIjoNc#Fw3^-6IX%AZ@&TEq!~^qAZ<&>Hvr0BJ<f7o3jgC<d
zlegczws47Ty|MhZL;rs~xO?$jKuN;dzenm1F0(zqa_Rd;ohi}0))|j7w@Rlor1IJu
zzCBquhv%chj+e1_r#@bqJG+RLHA*wftTMy$M7~%pkKn%L>Ap-C6xQf&y`&&jtkUf&
zaZhoZ$bu_dc0~LtRA0I#YWM6vrj8lP4ZdHcT%EQuO=oXf^;T=E7{`w*E!!S^&TiqB
zQ{MkWa<_y;&#t8Zf3J7!nS52@{QMNpEl!t(es1kmyCTq+CAneiqQ5!b{@+CuzDu)S
zUr{^DiS_l97KeP@!i!3G)-?<KEt**A+vL4EYeJOU#ydtA)_c}uPR&Z49=0p6Ak#F;
zd+q(0Ra1ZO3RqgG#QHt^*vwr;>B{FAu9)5Dajo>{;Yzye!Xu@gwBeu2l~rZI@>^bQ
z{p_I~n=O#B^!2j|D^x6PuV$!z&6>AsM_;MU%bFD`3^oD&YjZe-Px2NjJqlT&z9G$1
zYpRn$v&HIF*ZNfFp7@|OV_nAndsBQ_7*Z{*8eOg&I}`oma`#!5ClgjYzZFrnPV&ID
zC2GgT>$=iJc0SG$G(2NpzAZ{;-QJs~99GQc*AtS3lD7Ir9#PCcboWPp&f(I3i|ZOx
z>R#AbpDpFRJo)<~-`v+V#^UV%9_1GJWe0nfTg>U<@8>JK|8|Z{GDrKK2Y(fr57!&7
zRN&3zee*7SZDWz)`;up8vi5J`ZC^ik%CZlAZ7aSl6TJ|#|E<kt=Lgz}**!n+<izfq
zGbcKC^_ED7qrsb#b3Pu_P8Zzwpt3WH%`n1pe<53DuVK1CEWg|O%y|ZfWA<__kbAJd
zuUU$(E5yPxQt#cIq759GnonhS3vFw-W1jYC!QLNH&(@@#5vt;Saqds%+I!P%*D_d?
zb7gH^bF^|xcKX^m8EY?26O8WKXe9e&!KG!UCX0C_7I1B2w$66@5%Dg4#+uZ*SMEhx
z3OF?OUE9Mo*-CZWiZ81?He8CBD{yO>_wxI{ZmKhU{c`g2|Ehm?H|Nj)AD;U5z{CYC
zhSxa4WdF=z|0y>0>(>|G1s^GWSpQ+2rnmccA4#jTmqKd<+^?^nTw)&KcGC1$DBonA
z_+^|gHcEb8mV5Kr;mTQSrpf-C|0-kUo1d#1R^R%S`HuC)E}#EZ$={3h5B%MJ_VL{!
zf%4MIe?f%{b7B?eO<lgNN99hIm+l{fZQYBdPIilSdTa>{Z!mN)<C<e0adqvKd2tCX
zX#%sCws0<3@sKZsL+n7RZ>h-=2A7)T!`}B6=(uxgP2bM2Ju`wwHhb#7taZzImiwNW
z?XhItruwCZzh~zh*le>lAa0T8)0#D2x+~W$a1Iv>db!+T<Ah+%%Uw&mq`u~)GV5%d
z#<p^&S@>S7(xrt<RODWGyyyBJ!f^A(%Ahr(SC?9SE!oaIT_e9C%&EddlbLzt1?KK0
z`HQFht^2|`SIu`;tLe(AwE`^6<taUBa&gyVckD~vA9K2L-6=Qm`sUNyPkj!WTQzSx
z^Yn^+Oe?oZp0rz`p|of9pLvzj>{c`xebBe$*jchYU41+2w^Lj5=l=h`|KE1z^%|Fx
zm#TKZ-p6OdeC2Lr?4~&}leuFS9g4a(edaEy8&yr&N280Uhiqo;zPeS}a2Dr_{jm>U
zC7(A)QizL|&%Rc-qeUWa@@lE0ADz>!k3C7+aL)C5YiyvY$*xt>U6ZsA8?4?_)EO4+
z6tZGIm)M3&JSz@ujO_Z#zFkD%>fueNrkTz?bxPV$r1{>wkgbn<%Iq?|&KwZeyRC38
z_;RJ$kqvK>&k2c(vnPcf-hVb%@ovQOEt*$Dqt2bUTw0sA)olHKJ#)Ru+t2;~Yrkho
zU+D3xYwmhoQ`uq7{dOJG?yVd0^jDm9x}~vTZPX-3z00cNqATx+1n;V|(NtAkkTQA3
zlZk%cK6D18RV;C4n`G_8Z)94wtGFQZx`O{_hAsT>-dJgI_IWMp^9qiLeLi8=x`!p9
z$F|*zzGk=S9k)?gg9=a968GxRWLZ<^D^GVew&dtfU%Kk{$t_Z$bNqL4Tlr2ZH4!=b
zKm34%g|zzzYdMZd&mXwO=fC@RO-}fPnRfrmc}r{rzC|2cyZ+J&)vnFAJUDd^cKiu^
zB`lhh)qZ!e$NVjPOhUWfB|YVrI&3kMb;iCf#sfY-|C#1FF8?5YBiH1k&hGLzk7vAo
z{)hhzU-Kll1J8=DKbrkuYZk9}+_KiM$GFVyu%;BA?cT*KslIiYmx^<&ven%)p~<p0
zzl3yNT(+&_sHXdB-?d@q8l(KCS~wlvEp&3>rrBNDN4I?Fw!X*BxB0!Z=bnVCkF|@N
zTF-5jD!<s0lA<!>u*MhVU3{yyb?dENf5xHc_cjrwTn82JJ09oWv80@7toSK<!p2nf
zUdx;{sn@ltniW^c=FYpv@}zg39D6Cl;Yqm*3o`B$Og*Y*=KH8K$@aln0rt>Mhcf1N
zJztTd={ieqZvI5=MK}IG{4+(JXZa%EqbX0lD?bLtp4L{Fv18e$9q;x86t?T@^MvQV
z42t40^L#p8b<d>4M*U-v1%0>gmiY6DU$@aZG1d5`*s_U1CnaWOaTRRNxHr>-N$;_i
z7;o^LIdQK{tXE6MGRx{X^rQ%1a(z;}<=7F8&VXy@!xpi<TYWS1Ope6%!VlZ|_pR^!
z*dKboY2S<^zItu7uO@y>QuU5~{nYF0_bk)+Z7Pc&<=lDlZ1uFR2Mc>V)p!33Y_G5U
z93(oA>#-bPQTU~4!PkoRq$zTxoqK+vTqC7ma(zgik8wkl@`uEm=V#u1dstpa(CV~K
z=r>RHg;KS1`=(?sSrw6+yY8{GoyM;RcTULX%YRnfKIg;Q{Z{>VryZR&N9X69wMS;%
z{5<noNpHi%-`$P-OV_Pm{c_O~m9=GMA)D7u3q986bBsr9zBO;g=O-If4~d>=*`2Y&
z>&`CACd;E;nunqSwLh=kb8SZRGw!3SCa<rEO*A<?bzYXM&m6&&#;VsbLhjf7`nI!v
zxXozbZ@OzmLG+!-12Uy*HEy8|AFKard{tW`Jfl&0M_C%Dn%9|xOY5eU#B)uUUX*tH
zdO*;w|NV@ehy2(0u9?SBR8q~j`fP3L`|`NVO;;~ho>(NpndcaCMz5}oBTeY8?TyOs
zWjpGP?i{UHoUP7h@Za5OrQ4iHi{%XW=Tt3CudM7)HRcg};Pm>?f1T?|`KKQi7Cf1y
z5_sj?86VkXiM%I0OT6{i9jp)M>DYzl&ybueSn}dkT*0b)`#o2DoF3c1PpduhX|~<s
zW!!eW7R3`UK62WpKY#s!f~lE7OJmHtLKN#5H<@Jdc+S3}ueR#$`y(DH&%C4jxRv$3
zn`m!YsJds0<wDbo6M_zJ`qgow=h~}HRh22vtDZJ;PUPIOX{Oep%8~=+_O_>s=M;yS
zeOx?U-E)cD{H^mRoK2LRwarp7J6k8IbZ?Ks*4%Ah58hdpmVVtKbZ_ir1K+;_*Pd>F
z(I6R@sFxd2U;S?P4`DSCk#1SpqGOeR<RxWyzCFeBC+FlHR_^xFrW~2gf~RY>WzU8`
zoEWJt6Lm68i+R=QT&?NGQ8V`}3pslJvy}a2R)sJw_0@Bx9Aj!?ToKY9q9qdO6ZhOF
zEp_pa3;rM7gwH&FRVN{5UcUU^2hpi5Z*L!aB+7DkhvwCtOcT=nU0bLc%Ni80c}-`X
zYz_lkU;LRzf3E&aJ6&M!_4n$5tr7{PySiKsT)f(9nx7ZA;c~6QDV8k@Ix<-r{!KRE
z`uuvn1n-d(7k66tO?PuhP?q!mYr&VcesV}k*~u%1lcuebxN^=+vf}Wki_OPw{rQ?V
zL+;bzoo|i5U1>g&>oh$#w3F*j&4%J;R;BgfIbTz?<URDYli1Ugtob(V-EO|@NJCoA
zsz6T#`=2LU%YQ$f{P5$+!qru0no>mD^V@zOUi@})qG_@F>=l~T!cj_TM}Ob>$I!o*
zHE#8e&wFo8tMp8ale)IF^c?4^>SZPjRvwZO_k*VP9;_<8YP?&jXN~BDpvoL>_vI^=
z{+IRi`g%Qb?aIn|{~B|ri7i+&{lIkB9`CIoCo5VmMeM!H>6IK>Xthbi$alq~xhxvY
z)>o6B@3IchuIAe)#<BNF(Cw$@UY;VU<w2q!ZBKOO2nRg*dLVm^U#v_v%Z8nj>a#Ns
zlxcl@FMB&lA@#WR<mks;n|H9hE;-B^TgE))=7c9f9=GkgZ${3}lkL{#lelwC>*P~|
ze}5*=Z(`auJ%YdRR?6Y^rt2eq|DPA}UsvtgGqv1<M@p79dpq0j<ybbq=cjI#zDxS-
z@3T*v{Nagt^Y30-?Bi9pa)15(y)SOwG|rsRiEpPY*Qo0}`BwW|V8ziqB^irk#w+J7
z4zq<b)^#1ScyVz5^62#JxT5B%^Y=vT-nRctc;<&qDohE7`r<$OKZ#Vdi`d**DR3rE
zX(jiGAJ5JuB;MM0rtni3v*4`Df3D~Vzv^3F@c89+h1JprYGw!T7vHIA8E}~^sr{ne
z;nu%-sk1BAAKa7asQBqoXy(@Hj;)g2cX&6JzP)p&N_rjpr=*9^ZChQV6Ibh{FzKG2
z=N|h`BXDcW-9pKgX}+6Md|vHnx}|8Uv-rmY$;dKYci~@Nrnj%IYnoQFH(T*%Nzl65
z^V+3h@x{-j<?VNwhj0H-+$^xeiRDz-xv0sjBO0H-D|yBc;J5I0|GW4(($`8#H{WGj
zclXtuV=;eA^-{C=x;T@Hipy@lc(ip_%aRprwx4QLgu5hp7j-i)&v1O#=(T>`M)mB~
z>UTSCe7f@LeOHTBcXZVAi__;87_3~Z&c2&nKSF|izg?=3MP|do6PEWnCw-6(V@@-+
z_;YVXW5->NIV^QcQa8^u_7*9f{zyc*r$Qs|Qp&=(zV|UI5{W{`>Z;Br`Cob<zuJJ6
z^+vyJzz3J&1$9g_G#fOhK3L@XK;&Naq}@lWJ>My<n4Zd87``H^sk&^dWWV5gg*`Xs
z<??e)+j=d6$-*a(zjx^^CC1u`bNuvgop!xe|I)hp{&ddG(;DyVh50(Xm)I(HY=!Ix
zlf+L26P>1<l-T55&+EE#;f2e)cTLO6SaHWs-6Uj9Fq^N3S!QFK)zO)k`9h|zyJl;9
zcg8t0wx-nc=RQ<eXwE!&NAVilYuyja#U;+QZk()A&eFoTTTn8zbOX!s1AT_40tCbY
ziz3gR^uI7+V&SQaOP#+a{0{At@|^y*#%glqLN`G(ft8+#s;Q-M8LK-wcCko^T-_Np
zcaD&%_3EofzlJ>g$=Z4@Q9zPgx!L}Y<o~@gb>}6Y>UHbSSG>EPnJbp}qT70gxTBXf
zJ_JAiq@>X4ow|TAB&U{V$9@;aSN@+xWxwxNcxrI?k)b~KYc7e?o4I0qQjB$%n0S>u
z>s%mWP@>Isfkk1(#VmeF)*l{i@xR^)U6b<XmRhtz$7oejW@MWBjFZU;6E;u%5hB1=
z(z$V)!2$1GF1vCrCwzEt^>#_u8HEMM0v3sHvz&5U<yEBdu1^O(+L^|jXt+2{(=|cd
z)<oMf;+5(@oi**f?_UPpe{as#xAy(FQ}4dNdG_$VX6m{xvtl#1SzG<OclEm7*2B5C
zZ~drye)r<Vg8wOJgu9i#@J`O&bV&G*O6%T*k9b)B<f&T6ujQPc6nH4#_pkJc?r7@|
zZwyT89_kj<UCwSV?(E<B`efPji{~{&A|wSqOUyS|>^aY{w{O=I%LKRhUoUx<vd8wd
z-1qP_xZl(AJ)VPI-e~#l;`0YML}y)9zGnYL?>}!Pi`dJ3tBp6<F5Ao$-<n+zv1zG4
z&x)AcWt=ZxIU6)&6v$24R+=g_`RD$Qm!HfU_j`5MU-`kaVcA6qrs(<mW}p1k-{kb}
zc)zsy<>((bUw%5sbl}Rf7aD8}KUn>7p4BwT|B?Ow%^Cq=d1_m)e$8KV;oMe-LPneZ
zhre#;DjiyG(EL-$V}sVov=3LK)R)|no3Lt`<g<M@H$7BxbTH)&j6AX?bF)_%`<jha
z$9WEab&OcXHbv&}u^X$;6lFEYN^STh{;uHWx@BKmZvIgEkk0tRV4F-+qUnj%M`r8`
zbmP!u4*mYS#M&);e)+egQp*z?{w=$-^XS=2r=0IP<R!cPN#Ze3uWR?6Vf}00$CYlJ
zvpr+P+s^$~uvF-nwyaJ`uJ?%TdWn~1La%pbcBQSE&K4BB|NFws$JH&KM<=mne%n}h
z%>0hWX~k<YLOLDMJ<9G2PKy}w%!-XqP<-mX+JayFpn>nf2rZ^lCyka>d=g*4XLIO_
z^@&Q|C4cX3TFf0DRoJxjvDN$ak|Bp@aArS#Xi#+XSE^61=7-DcyO*!DY)@WseDk!z
z)vc|wvnDQDbtuv@Gtai#qF{-Bs?W;PpLN#=hGyCBpR!o}_40=oUwmyBKhxAGe<%Kr
zeaP39O?!5<+!dR3%0BT$v;47&cF&^Hv$x-bU%t1EE9R<Ipym6?^S8R~u)7p`LDJ*$
zI)47Sk5zOpP4!(j_hQ~h-DZ79L!A!0y$?Er6Kns8#O(K(cIS)By{7AyD@>w~HHIw+
zWvaf;X??=*%VACb6cai3)s|B(ZcQ_6{d8Hq<H*a)r^+<jvgg=YD~HRzs9$v@gQ2=3
z*>%JGxrSfLju`YUkocW5DI+|1pO@xw9jkV&y?mE@WZBO()oe|1=BR&q(um8BePTyN
zIP>HcsaAqZ&SY8LD3+hTG(+9Hi|<o*(gxL^*QPv5y?<rbIksiW$D_g&%eE|$t3SO~
z>(WjURzF{1p^mqU=gRkS&z$S0e=AgbPk}B|@@|JE+O-WC@n5^dew7}X#31wLeXT_P
z`#C*zQhgi4e=S_R>(+7m{<!%)j_>6A`3hnS_kY}WE9~yyzy*6hEcYzCD)unE-n{g?
zq5p&{2HzeXS~f{~>B_PuKFc}L8@P%${@0%o%5q8F{-%6sRP3+JJ5v@c)KT8L@nfid
zk3N&nMbp>evMFYLKP!J{)NlEpw&!zI{%_uMw}eWbK6$t6Pm|z>|5j}e({=w@8=sDH
zt~bwneM0;9$<&D~F&R@<MIGyrm-Bwq{ibwoQBUaO&?i;L{*-zZho<ggTWD73QZCwf
z;^Gpe=@oPSPW<s}UTL?r-V@%{h1q%Tq7`Br8Y<7khu`~PwCs=mmd<03mt`cR3aBy%
zHcdCYo6xIy`;Ufp^F7Hmor$;Go`xkA-I$lVtY}mGu_pQV^|Q}}1zuPlTWR^-Yqbu$
zZjifs?46b!XYXCJm#9qA3SY=@@W-**kaF?u)AE)rJ-<VEQu%>%Gh`j}qq$B+?KiET
z)ce!*nXK$2nZ=D6o~_zH!Yf3&KASCaJX>MP>k+KPRm%2oV_#T+^rox?zG$a;MeF;P
zx^?YsJa$t)Qgxe;Y{{gqV^UV?|BqhcJ>4NXwKD1Kyo^MJaFfUn%R;ZrkiWTM+N^TL
z+pn9`6qkRG747}8VXlr(=*sJJmpptUQ+0Iv?ga;qwVe{XX|bE<`BAy$KcY+StHiyC
z)A#(;_R%EjY)1O&2m6=l+H2Vzp7hM=hfn&|PIKnH%Bj{h#&Zj=?CU;xwNyUOYV(n$
zYnY=1x!g`nDU@IAE#Vlkz%%fy(@g8dPG>_lRKAe8e8B(j4Nh_IFV5$hGM^N8ADX%R
z<e{54k5s6gkul<)BYLjCX{kln)F%^CRF*P2F10D2+~6b~`H(R>@w3uN+4Q-R=Vc<F
zoxHyJY^%`msfROmyRAz*Z7%ZK=5fjCGEafnE!<Vc#r<|4k4!k~xobhe-gnt&T3bWa
zGau9k?Tbi>%bvJ)b=K9RE=;R~1H{taJv)Cf!I(Q>^U|w)@6UPv<ShDgL}SaB^vA9B
zrpr{dx;%EIiJVetSouguTCQ8hNZ<2IS;((9-ErBi7tdH<JR_%>aesk!_RiThp&}(0
z1y&#Bw$sYkEylQV{+<_AUi|aBl{gmXb*|@`wqoXoaNUx9O;)+qk9UQZ1#Db#S4yDV
zsc>!JB&$cy%B?oOt=bX2>Ok(rsb&X4Sr<qY+`Mw}(fbyM<Ibw56Qq7ke4aD^cj6mM
z`AMQ)DdH^o6-T=R3ly#0l!`WmJ^YxnAgImPM{?IG54mCuM&Zw^&lvp8VG{dz{HVg|
zbPp@LO?y~<CbURC-W)uA)#KPVQ#(@<1(mOK?MZGuHp9nJD?Ox`=lHfz&kGBzrXN;&
zdL`-M${cCeOA{<#J)QC>wJY4AaK_!s-5X|^@87ocv&PJZob6^QtyZSq20z`dPs){E
zUpklT%Lk`0IqNMc4|$$Pu3u-r$mu4tbI6XCKGXltoztt$lB)!k{TAV}oyYAU=KkY{
z@&Vrn8;z?|RJUcb1zNQlw1r9fhsk<-)vN7aARuwLDL#T%mDyRG!$*H*_t%FCH!K_1
zT{Mkz-Q>-2^KeUpP0?zb^7@;()|<2{FFd|7S>a~%5%(zW;O~#wx{@Wk-TC&0&fJk2
z7jp1^?BvDUIL#kDjQV!jqN`O?x#oF-@*-}xryHleIo!nD)!G=DCaEW8d)@oaKII0D
z_v-t1n7--g&s_2*xy9di-ovezFFo2^w<0-qii~WbkmK=OCpp&MpHG%ln<f-}mzeVJ
z<+I7gEL+WQ{V)7|^<IHZO}){b<GI%#SIzh_qvLKMhk?$U#m(pEPW~jNaoudrM}9{;
z>E_4D95=jQ$+XTrGi6h|k8*-oDW8|%RcZYdi_!!(9ZWQ53RM={!n13x&pNf1fZ)xV
zjDe=RnV6S}HATkW`*|g8zh^F!Ny<8*yLYm<+3IwsWzE!I#`)mg^L<OMyqa}=W?`n{
zj2h9qx9`<&-v77kN7?TSkE}M|U8!@+bj9@&ap7%AJhSz+noJY7P0YH@8qIR+u^ZdF
zt&0wys7UI_KO&Ury4d8$QTDfc<dP3G9gN|t_jwq2^^Wup1^Jn?5*k8sLmbxjEp@b9
zpZQ|qPSuZp^VS-~PCK0beD@8-@MjAS>slu!9XKv}_gKmW^XZ#fm!$kT%i$@!x@xI^
z#Kxe!yx*+$3wLf4yL2aN<>AOX%Nyr4o6KQ7XXIgibnPTp*R{8H-n+WVu-g6Y-jkuT
zr$#$II<ufM?4y?IVf#rxTKkVF_q|fS))Z>6hb8m)n&jJwhp)dV^B0>DcIdc>(1v-B
z+ziZb&#WoWxXi$EhX3%}yALn^sOXSB`S|eL$?|=gxh$LtHj{Grp4D?4vOT`g`M~VO
z$DdR!JZ=4Gs{BSiVF{K*yL~6jq%W*IY;K_Stnb&|jOE?SZ%hk#eIq>Lv5)9%Ns|ei
z8E@wsc6r>dI#E8W-RYi0Ov9ck#l(w}x@AFP3y%357UF)vP*66ht#sBC=X962`JdM8
zil3u3H}2ex#FA6GZ<nmL_?)m}Pf^8Yg@^+St~#_cszp>d%GfXKyS@HSN!q;FUBAy3
z_X%sgJ?^^5@|VN8od?V#uBK|g;n-h)cF)ZN+s^ol`6<<z*&SxSbYZ4I)a*x=1r0WP
zIU>yVpH^UMl3F*@sHZda_^frWrntv*WEutqeY1HpMX@yQrt~y-fzQS2uFt0GMEsf}
z-@}*^dE@!S`g1Z_)<-zc^a|ARmHl{YSF$^7QhbEep~=z?)0!vCCopZ^pf167Wm)Fi
zyOm#7FnznIY&<dLBGb1!SCk?@BtDhdUNpV2!b3PDL3euY0!Piw=`vge=_{9T&V7{q
z`Hj%6S<@fBwJ)w0HH<uWCUdgQ^z6A^iz+G=%44U#Nw)YgCsscr>(1Hcd*6csk`FJf
z+OA~xnl)_Vq2KMivu;^d{Lb29FZ18vmaR;$d;a$OJpE?{1Ijl{%ISSycSCxwRCf+X
zkja*ZEal8S&D%HJ>Wl0B=B6&6r7+X?Xx?n8*IzjNn>2kxj9bpI3hQ4^kc->8{Nabc
z1<&tt&V1JHe)#(0@2;!r_)c95*fwjn^rG(?9vR_ontS=ej=zsHUL(;_mh&?$JzZzh
zkN)!Z_4oExHa}c(T>joZs~gU2wWS3czJK|9j<KfszTa%0*^vg3b9evU{B3Rjx9<sY
zGX2~8Cu~?eUqJ9nt&CvwTlo+PZYi0^LM$cL7B-194(j)IJiOoiVSbF(oY3Q|7@|*4
zEd9%%;+F6JUs&z<!G9I`KQ0&WUk)$WV0LfEhs__0suGL-?|-hyvp`>=;#hI=vL8iD
zo6I)-(eToHS!Ubi?7-aYTrVRM*f6h{qe^n^qZPmEzFjtmOtm?2Fj3tz@v7;9#_!Cr
zlMgma)yw&X3ufdr7_SPR!r{f$l<;zXMVZ;WEf*8bv(x<goz#~6IjXa!ac@Et>!Usc
z-im;p)?%Jteg`~-pIJP+P#>^A?fQa;slf+W%30?weW5cW+vZjCrPN>ZBa_tAd{cHv
zo_MEp=5luW#-?)(HLhI=9v$mS9oB1`iR^jV7<N(rdHzqaEzFmzgF<uUr(Mmy68Zf8
zqo+-hYMjqzesft~m1AG>$lrcp`ECW<S5Fz&J&Z|T%(yJ3CcZlOPyJ3A3rD-Z+*wB=
z6(;>seD2@zGR=jlnfIJWK^IShmBPPnam~ls3E4lw%QnXwe6Rkx_TyL9Z?WP15&_+Y
zjaktG-#0ki|2g~fk#(DO7d^T2xNiErJGJ8JtDjElli)fV9wr@Uk$-dR)C6%G!vf)w
zTGlnY3!8QSYwo_waCN$yu>Sqj!>8UUJks1ZVcnt00naqH+_^T3P0%`Z*OQOxp|-w#
zno7Prp~gp8K7VD}p5Qf;i7V2UXS>cp4>g_=p=2Ma@5jRT9$wtMpTFGi#hgoS%S&f;
ztA%j89X)ko>6FO5nVf-)#^s?h^7k`bR;BgiGVot0Yde0N-F?H0y>f5+1G40$zs#^Q
zsF|3vIcsgwyp?V~F*BS@Jr@+r_uRp^Woee~<=tHeW))VlT{GUHe?8xaw=^fuck%1R
z(}O-FuAXSJW73hEY&|v1i=WJAWVfHze5mT`wrIHynYZ%uA9U8{oRrlFba>0q@ThuA
z?U#jJg;R_7H%JC<sri(c-{HHjYWx1(=5G>Q_S|Lb;XkG>&$sg5Bc>bNvAnas7EE6|
z^V*B|bqtqlwk-Cow7JH#H6!;aUoGdO1qOSf=T$5EAHTQG;-ToulgnqVmgD`ue8ufB
zo5qUUwd{w4V)@@WbUw(cyu;@5_Mo62PxR%W10t6nUtzfP?eL+#7jk=k{XX~O>cx!d
zZ~C1+g)dlF*fsN~)h@Zab9bBXdA9cBgS@i2g);+Y7jj+sA$vv7Lw{bARiT_kMdH1!
zn=O^*PJe0~*W_>}(Dkg-uDIEG5A=>!vZ}0kv7s%$t${h=tn!@?b~ypYAAaSWvYC~f
zbxre^WaedUUnTaG)sth6iDuONOpw}fz0cB4W<JmTKHW*d%Y3Xi?YEXIO32^N-~0Oc
z`@bEk^KPw(_r0-^_aCdczSRQ7T~X(jsjbsiI<Fe=DyC=pvIp-roZ7MU>_L%~q{L7A
zlb<ws{5d`MX~o)|1!9Mz`h2**xte{Qexm>8rTInQ*S$}fI6s!d*t%o#)ty=I6lEC?
z?%e%RP?-1F>F7V@ho=UKIPt#-6W+rqwl9B0+>J?2Pj@`%-_-nPj&I}!nI)_49CzI4
zS^xEk&&&0y+qD-&R+Q#We>1~8Wk*=z{r-hd){3l2yL;i`ZebnE_bF4Oxqj9vY@cnp
zy0}Co#bU*_+RginA8j*QmQbXpuMujUt>F1GU+u;PvD9Rpb3Ov{EXK#w7*AK~aIyZH
zrf6rktVmaA=cm<LZ0E}3KgVA@BPbr>V9#B^Jni~(CPS8Yv1`sv^mM*eC}7#ezy9HU
ziK^Zfw{JH7e^0hNNz1#J8L-jw<*%MAe>2WCbo!rMWhaz=`0j%H*=64runO*c+^ry!
zoY`sJrLtx1*Y%dyHS$<C-xFJ1t-4svaEEH<nJrZl^S@6qT>L%1U0>rk|Jm=8I0d%d
zwZ3n3m3#N21q`MCzjKN&@ZBx&%l3HI(OJ6_eGAlYEn|D<Akq+W^8UXcaf}JQQ!IZS
z>)|ZiH*x6#yHj;cTkC{avx@F)yZY1gQ`Ye<I&4`@Qyx9ub@F;mVJJ^x<jK9)j)dP<
z`Z(<azv#(ZDRrCDv$NCGt<5DD+?x4v-JX=wwzsCJyFFKBz9k#6GWBhmpOt3tGLd}E
zi6^aWTtq|Fv=Y`Hc71d%ZDuD|!}rs!Y8&=zNt>qiUyMA_Qp_%w6}@+6XP?35#HrmC
zN=Hm@bX?uzZ>P2H!!*m4E+6V5PjY<Ue$Lx%iM2uS>tDWiLOd%kzv}z?%Yi+G*SW`V
z-@0RxtE)G-@uglkCDMJ?>$=^}58Br1yS9aXTcT}kwt0zQS@g6c?kBHi@?Q>f|GK6z
z{3*}8X$CWPpV)rw>-E%=yPhoDUpViI%ai>#Kb0SymUS+T>&(MvFN=znMlbvGeUfXX
zCMR>rrN$Y*I*$rJd|@~7SdhMb?;joE>otaa>$T5GY;W<~+caIN?&Jz_iRJygW_Jsh
z-Z6^!+Hx}9H#1FR!HT|~RgLSFoBB$`E^1b3yg4Jfv{vkyxiia&-~Sl{yqQ@<7#J8h
z7?Rd)kCI^Vk#}QYU`S<PV30vQx+6KUC_P_4K0Y%qvm`!Vub{HK-~Y_X&i?QXp&ieH
z7??`W@0oOEQPZLjg_Y}=1y7yy_vzHv_tMc|>pD_YxK#A%bFCMtN+Mb*&%~aHPt{O(
zc{R}C#UmyLRQpZm*0OA7XJ9y~%)lUx&Hkj)%$$_eBE5pjw~@K|x6K6pt&2anOFm~|
z--XosOeqnQwnc9+;S5W@A;7|xd(kj`<`)+$$AB;FZ}Z<wf7^G3TQjhaDP5NB%!zKD
zd$RB6RX?0q<7*eY|M%AiP3LC@ym?@g>hzg4{imSi%?m##$;znZFTVc7Cr_@pZu^xd
z>+MfIynXmE^N-KEmg2Kg4QAx0_?b>u>SAj?SgQBF@{~yArkuk?u3|>&n|03z>AgE~
za=E97@3a`fACbmdCKo5IdD(T<M1JNZCe4#d)3cwX|M8m;==Rxqn(d@1XCDft?MW|8
z+3{fNtmie&UK)p1Fi8uAsCD&pye!#x_4XX!<t^(SqkUHh1W7Lq4cX(ha+yMeX4u|K
z{n8;FT1J{Gs-BvOdl&9ZsucOiI#Xrx{dM>K&)3z|f4ltiDZjg5qrYQ2R~Fx8my6%e
ziFkgMnYsUo2ruIc<->a(ND7yn?d!O-vv%qx)|pv5laiK1Y?BZ^8*FT&_TA(*Q|7`T
zqo1i(j=N4iZd*A+rY5}q!Ry%ych_E(vS+vxd2U5oi;%O!lQ-pN*OLw0CbO@b?xHVw
zaz}zo&UNE2n=akH*|XFouT&^>QeT4Fu5GiFx&!Bbn9_5lY@bVlV|_zK%n3>1WzP#I
z?`307opS#H_tm~D>=Vk4voxPzu)PrNYsu<!B1x_@=E@(_!gC5?EKeHJ_jLPx&GD?Q
za8GzUV?p<%psR+KKbHNIz1hCwL-d;+;kN72jkN!8FFv+^9=p9{m-oy~i}iG~gp@Tj
zo6;;yl#<i!I;>Busj@Qf@LQRr!OZ?iOT;$TkLS14s$+h&HAbt2*JqtwAs{b4W2yvC
ze>-DK&W;~a+ZBvV_IW)pnVj(8O4Sb0<*|%O>AbET%4^(fu3XudzUEJ2=DOtdzTEfY
z^tPnGU%K$+mhE!ya@Wr_O<AwJrhTvJ*8KHT`M)(iTzn|)_=}k(#SEr8-5E{J^FA*B
zz%*^5-|M*_?>#%O<A0(qJcge^rbwP~j?$C-S<k;*++I5=reJCQtjfyQ%auNrHaH|2
z9!=cD-6E{<+)J6s>Cr3R)kY7_CNMS^OlA{X9L+Gr$;NAY-=^2wQg_}?dbC<0!eG^j
zjmgcbd5cri*mkr<Zw%FuJ+@I@dF3+3%wzM;1%+r?eab$|dreB@s*clk=j+y*^ItD3
zzISl<wBloHjb82Mp1Esp>*5PDFZ|J*zR=D(c3Rk^raJAbKicoKZEoM&X8W+qR!YJ#
zIy>-?Y4qyAnC2kM2t(Ug+XIh7PH37e`+RjpO8@SfSgGp;U!UuR*ME$8s}o=?KKt{Q
z&0lUTtY7%*MrUpO2a}MzYd-p^Q4tZkpOQD!NxfjP*?%BiSv2jy)R((6%Pxnm%u|fg
zTbjWgVQcck{t|E59dozNe?>O^H6~_T_XL%0xt3<MJo4JRkk@9Hx6EkG*72Tvt)b=c
zHpe4>oEP%3e=wiPleR@`+lQ&quU{{bUYz~H?6TU@iw~9w9O<<>**i%=UM^+cH{sy6
zY3;|>xqVmlGBtnp=otUEIJbok%XTl7SrPl}>S5tM%bXM*KTqr5+0}ny?^>$~tPzD_
z{HZ&CUYhDws?dAj>e-@+Jg57v&Q!l~qHmX$-<!}mN5drQw{6-e`Br~Ih5q!a-Y35U
zBreXaTRQW+*MUhd|L6QVpEg-qa;@zHyUN4=Zd@wbJwZ1#gMD^;Ty<f!+Q-h-vJ<u6
z_{2Cj<U~|Hy4s<-_y7yP`wgebs-l{K3F(r@-JB*L&uCx#t>>-gvR%3}!o6nmZSc>2
zaGP`Xo5u?s*KYl3wmbjAnY-OywtuS<iZ|NdX%0W${Cv^d&wDg(thYK)C(1Cp`(=1z
z<$<FK{0)u2Z!%Qd=yMr}CpJ8+HJG*Yhm}O~)Vuu8oepi@nD=q7#yy3-+(p)f(q%K>
z%U%zEyLlbg>nSm<{kyap^aUO;$>lpgb?R!dm-c9$qT1n6cJ;T(nV>$Vgp+%CMQ&^|
z4^m%LEwAEX_{&8{jDew0J!oh56!#ZQp?=qyS2mfjh#n9+_w?@a8~++t=E(00`K!sc
z?#9Oa`60i{UNE!nW?r{p?@^t-=R8vvd}nsu@L77>FC`fcncnk8mhn>snO84=RasKO
zmhU(5`tc(j#j`^C*R0GuwPw}E^YbKZ9XfvA-*Rulm0$Ur*50yyP`qyXg_h4h`*tkP
z%qrtdG-qGDKjr0grra!jejC~9rOn3~Ehj8{xajw?xl$dk=3TeBuCVC!s^e$p9Gv~w
z@&6S@<y$GOY|{*$mrRR{GOm_5x2>#JA-DMJzUfuMduBZ9-o$iv>4tawjX6pGH0Ff-
z+xh5`&f@6P*BH&?dG5#*HI#%nbgWwMyUS@d_vEE9GtN1-OU9gtz1x&<{_KWeo0z^p
zRogrRl^VwAYiHX!OG1jH<eV?OdM);%%PWpC|IVb-Mn`9Tee<_!@!L>`O8wWdH@Edo
zU90hYhg*~Kv(s9ueKuS%6`%B?%;(IqiuD#h5|&pQNpO|2sZ1^s_Bar<x42hVBj@hw
zKSs<cDy+uQRW{y|!haRcn%jtWPQG?>x#{VUlaF2;jd6Xz+cNR~t5v&{&SpsSY?}7)
zpog<|P)uUpte2;glNq*O=f3vmww1w?D&OpVT8oZ3x9cu{#5YSI;*l5Q1F28GHMc`U
zqpZx|$#JRQ{MFdi&+R&^v9?8p?Wt18ES3pMQ#V-rl18oTS4C}8_TgY)D3oDf5XV;6
zC#R+B6;$q(yq)*>*w?x7h7;sHn2ZE-x)&%sP>OQjEtpij-RQEK0Z)}r-<p>}D#p%L
zYxVv({_U-cJa2h;_l`-ca<y|*s-E3>-)@<_UB3R$*FRovN>?A%2zGCopshLOe41td
zwMTz?zt1f_rnk9f^^?oH68`^Eul{^@w)yi9U)i^La8Eq2^px>Y?wL!cna=c?wp8!N
z)7{^7o_ldWjTD<ZB`QOW`>foetCJtwZ3tavwkN?TRWRIN@&If0%A0NZH)q*%hpk~f
zpyK&0a+!Zl=rX}g7xo=JC+RPAd}(`0w%nyP4eZ&|j`bYh=n}wi%V?1Vci1zX=#A_*
zSDbivgY|OjuKEu*?q73~Y%6Hch|J^g(Ve?7H*AxJ_T(EURO5cA`8&*XsT11w^}~mR
zyP^vkHEe>``aJFa{otsQxMo53k_+E?TY3eaSw7K<YUY_d-M&`7?*H-5?DvNqdyjuy
zmh-*l(YpX=%Y)X_wg%m7Ykjy%$4m9lgp<5G)-!lFah~kHwW=>E?t{idDVuQl&MkMY
zoPRP&$9vZ4q}hvC??`J5{rEBKQ~y$*q=l<4KdVS?T4HyPWA4(<nl<a!e|*3F>E%DF
zLOVMRb|y87|M^xZ7x&L(|DVdj&vHskc8LtT4xcp>uYY=K<KY8kXOCX}bKT&_htGeG
zF-&=|$J+XYU8hLnTTPj|6@O~m84K?(y32O@=bKp{#99OX2nIw~SvNd<vs`T3i7T;Z
z*ByOX_<91<x@oS*(t0!aqHfPVJpFa_k=L&t=Xh3K;MMOwW9X%~zl^b|vC~aY%>G<{
z)6v~WYb=W_ckhz2-upB6$(Lu&21QjrAO5N`E3*54T7R=*?&+?hU8;{<HQYa*w@X`i
z`rQ9JrfUn0SUyaxNSqVM+Zb|Y>IJEumy*AK2>8_;?(krE$-{5GfGvQN<G;wO7%tb7
z6=K{jjoYr9>i??M3D;iJ(O9lp>L|$c>AvK1Z`nhPE_=_*DT+RLB<sIrfwe|~Pjanu
z;fof7FrVt6>=o;oo~%mTcSFx*(c1^tMfU5x3Exv<vU^9uw<B#Vz1op?rb*S!v;4F*
z_x<~sK6AO2uqU3|qaip!@~^hQ@~aEWo9C|;3HUZgP03c+FZjvL<;p?}TqZSW1WbLa
z+~H{Bd((GXSM8EXPc(wU!`VF@YpvTvj(oNYau3J|UTt*c!lPr$&lz5t(IYR+VIRnL
zS4a2gx+QI`)jZu#%{R`FJKVJD;7S?2zK0H_Pg(eKwcZ(JUZ^@5{WMvA&q>7-E*+b{
zy=U`si2QJT)1>D&mdWNGVdD!un3-^1g4eCe*O<fK?(^ETekLxa?Bg@ps`5?vx?F;*
zHop;$=a#dM;QpJ(&fQ$Cbu`&m_l5aphFKB8%kFnKv8`GW!j*EwM#HzY_3*Aoek)fz
z^wf&ux?+2Nf!kr<{qw?uN(~kUOuiCe)qSR6(xZS2k&TzGuBrOdd4J34^jih*x3hkD
zxa(WoT@I}vyB?`8=1Hyp4zQF2ugHCE$8>l@L;R-og<BR(Y`ZHKnWw|8QdYzF|G?>_
z$>PzAt!~VB2|ILc>x5q26Rm4DvDfvO9h)-$y3iV-6`O=xw-)vkBo^PBT;I>v{`G}Y
za$Z!k#afjaVN4~$XBRZG3gl0)^!ng0u-m>wEo6P=x??MjZjzdHpgw=6SOJ4rH|y7@
z-Z7R1-XAm6?)kr*W^^-B=e1!^Q|GZM%}yqqRYJf1e4nH)dnRRV?S<xfp<innj_{Z*
znZ~eU?d-s`jeG1n=BnIpsAcxP*>_9DC~WS8wEFgJpOyCnd_~#+wrB92O$ly(=d>gt
zRWv|!RRPPNWhG|ilQty_SY^6)D(!4C*?D92*;oU1%`3UB3OrHCtq;u<R!a)0N~}J(
z*U><hajDxi{_@GkN)5IMhDI+jUGn;!;Gr{l{}xzXxtQDW)={3LjP133h!R7m!Ojgm
zhg$yXY!>pL#A22+uVH0U%yZK}(~or;9F1F`<ZNi=#naO8u)@Ij+p~Sw!_*=iSgUv!
zebe@Okkowd*p`e71{H}nWj?n_?yuT9$HnDu<)1T`J+{d5b{Stwx^Z;oq{6$6Y$~%J
ztTpS{xaZaVS*PxDv=`dS-23&>=*)})^-wEAi$x~B*}ESLct!eaPu>2jxjDI{IJUf;
z#W;Mi_K9~XR~%RT_!?TY+cQKprT>8EqOe8}$0rJ{wKo}}oBr?T>ozXidv^N--<7c&
zrq*bQ_L!=k3*D2EdTL%P(=NlMU2UBcPRw4wxb*XXjlKz*QU}sMX`Y>8VYsfZI4-r|
zjS&0Xlqk9B6Lwkax6YaR*E>pF;_}VT#pm~3c)vQ9f7fH#<=68P<bHGnq_{dw|Ie_A
zbBP-7>^9rkciH|*PVL~kr^fR3cFQ~N_E$^AHRLWUaBr?z*~mV{v(MZ8@2^efwM>5l
z_@q@W5)w9T<9u`FYQQ4Nx{SEnl~S+lX80Up3USFcnh=sWvGt48xrtji9Tv`+wY|LV
zuh9AG?7EYAQ;p>MB34Ye|52o(tns~<`Grj`HsM-}JC`3m68wl$hx<3TFUyh3CQE{6
zNcD0aG=42E@MYDxvKfW9qx=*0ojY(yTJE5W-T_^=jxzh=H+l_sr%a2oyQ8H(SA6H>
zxpui4c`h5zB^~ekWEAtU*Js<eEys7?(wn50o3qgLqmTbGUUlchPgM;w?=>wob2oUU
z!Pu!^S>?gYZ0hxM^+`KPwcT(2)OYJ|)mc9|ImXZU>h?CNv&Me*r8W{*wRZ(*vX`&g
zYwhOYu{d8;u&dT$%7&=U{^^gm1U1YR5o%f`%+tZ-kd)#tdu@l*wAMv0Rec|~-reB2
z#OLeLe8=OxJtEOpCrIVh${07ct$oM!Csb|EQr?8UtGMdrlQ%q>a^u%}2_B&*{}VRK
z>aqKL%SUa1Y?EI1?4}X}gF*)bgFLndNM>G1YEeN^Y6*D2;i&EHvfDehzW>E_t#W~h
z@@3CkpBIImH<^5LPTE=B>_;zCS4Q!uItgWWg;Z`_TlKT~T>cz=>)%Wb3>>G5CcXTa
zWh}&*lauqt+H67k!QbWg|GoXwo}=0oHD|xC>&2AUJ|UYQT(yhLJ^J(Xi=QtdKkT|A
zzba>QZqxt2^B+9@JYE0%!}<0s`Q2_$K5V)*J@isas-e`}xpN<0&Wh*!VIDC(bc0s6
zbf9VEM$S0(tIK%Sor;xPk~CLTvTRlJGM+k-(nyx|_u_lq!lMH_6&n9vf9l8LdQ;_e
z3`^y<)3dA&Ob`4JF1RFB(5!KXpzDPY_7+9<MR{k%j_*D@>#YXowA^XS14GX@vF&a*
zHQ~JWDC}U%#Qg1^$``#q?b)-od0n(YoLcF&rswT}fnrHUypxnzk2Lv4E<2c8w4id^
z)=rk5E!_=H9~c$ZPl`%duMlaPJBi(T&O441*BJUL<#b#FI_tMas$SyAw2)f6x=8%U
z$6dL%yp9x3c)OxBNWr!vNBO6Q@2r%m>ZQ70l>hn9)4keU|ES<o@ygj(Z*MzU^ffp1
z+0KZ_1-G@>6)xJX%vzXuc$Zn~%-3#b6Z^OLy?WraNLDkavuRP$Jf_;L6tOxfLEQw2
zud^Z^p1te!MsRxOhjn+lmDWw(8eq%RYj}Y>&7QZca%W(E{^}I}|0~koPr6#VN$`GF
zpLFl0(gM-gzklz}{_%DG{XPHwz4iZZE6w`BT_M3~(X|^>GG}*dSD0*yIxr=<@Or}?
z0q)fcS8dX4oN)QU-V@i|_<KL=X>QuOLi%y&_dbr;nd@B&Cx@nPWIh<O_FhT<nQ4*g
zWe3(dZLPbn$GEco&><r;l`}IvdROK(zHG`bN~lW<OSs!Cw0?Ij=LUyaS+9I+#A;Ss
zyvq$V_uMFyZ2F#avf%$m5yojeTB`o9E#@&^jek6OzsgmcvteiV<gHqH^5Dht8zpt3
zd$stwk2V$d)$6Y7{<Q5!oXo4$4}_-kePEM#e4$Fz&$N>9++2^Rr~FNW{@L%oyq)O>
zugSw#51M`}M#nKub@^=4aDRbF!SRzBEU&gOvU>2uvu{W+U7IWThX1UX$;J1J#r2mh
z5O7$^5!b)w;51H?8|er8ei%CBvUGP$*reI8N7Rd3YvmKeWjkiMUVr!Md4ByoR?k^X
zdrS{RFtu(FH>>E3dh~kYo6hX7#+?b1&Rc6nF#N4&Qnk2byQXc!yj`qXuCs31Ofg7o
ze32}sHzSbYd0(<fq@ML((T~e#q}#InT6yfWm&)}oz7tk)+zUEw9vT`Zd&1V>s>hS9
zGd!O?|H<r{f7;AH@V%aE^E9rE3rx$KyXuP7!*p-UY!M6Iz<V=``;=SRiPN8=mI%e|
zKF-P1+Z-C&l(EM61>5I);ZJ?19pcjEcgPI#JUIV!v_bgQDdAJU{4?7rXz?Y;qoTv$
z3)74hF{_w*&zY<+7BGrQp62z+)J^(Jn4M#Bc`xrP-9?r&y$Y@vMXq)6J;wR*Pr{3S
z{*)avPI65uIvIb_LzhF>P>1t&S4V~+-`Cj!mR5D2x37+mJ9>Zr&)>g)tY2UElk<w^
z7YX5>&Du>|W<__JrtKH|nb;J<;=~=J?Q6GbuUEk`59c>6y3Mg+*E5pNNhp1A(G#fM
z)XdS~!xnMd^gQFN?Hn5uc5`J<+@`%iYZtRg#5@y&jwbcDfdT6zFPJd=SmCr?>Hgx#
zc2gH=m#}pcE(qVPy>0Tls;qD$<BPXOQB!ww8)c^a`SF<b>&nFsWSQHZp1B?3v5zt3
z#KM9L4^vk*_iC{03P0MGUOqddh3kevz`0Vk9;vy#39=EEi_5=WTXdn{XWz!$h^4F4
zI3;@z$TA=EyCe}_))Nz>Vr|InFi-v9&v1oD_ZRKbo1WpBQ2JtjPzR&nQsXTT1XoVX
zkP_>t+sdQ<LVZp8w0~<RMJI@JDmm#K%NG0MSJYcLL%C64MM{i^WI*{0ria-=Nd*fX
z0vaFfm}O=>^|fEIn1;04;_S6dEE$bl2M#n;JfGk5eAiEtfX{J0XE@&|Z@7>fy2dNw
z-~Cv&^R>bo#7|8y3%Dt{y7t3-PL>B7^JmwKC?+O9IN@^C&*fqjkM7fK2WHI)jGjw=
zwjE1oO>E@-{nqtqPs|ez!KQyJDurIPpW1I#)2qd|Z~2+sw^R71{QTv^cUsu}h|2!8
zn|GJVPi{D3e&CA3nvG{mKg7Fn#5{Vx!BmU6OJqT<o0gQd!5_&A|C4$N90D#E)Kx@#
z4)aPdcQJiX6qr<Xn$bt)qve__cK!`k4=r!4wMcpV_uT~LvmSfbZ04<azJudd@v1;i
z<=W*dW?bX+<nAb$$8cR|;lp<u>=T}Eko@~nYf<<HJC_MFG?_%Y${nm9+^Cv!&MN;<
ziOK|<=DcG(e-3hdwf|L~@XqYODTk%Y`<DNeJ)iOGZo1U!&%11zOZ79iTr}(mzqp=t
z!{a;dTUVy%1<UhwJF@#{Ij8fKGuquMo>K38Io{$?L(n=M^~ns9a$l6Bih35@?y;5J
z^7+!iCkk8h8V^SnoN!vM`bF`ehT%Wf0Glh~jUvn+9J-x9Jp9A_`Wyep_LVYHYj?eh
zetY4dquuny3(FjS*Xuqxv;JW4bOi>n=>M@3?!-06DxWQj4!bV1^Yf4OsV;W|9bG4E
z<w@G|yW#O-iD_<p4bHi8yIcQ>zS^^8TZ!8#F6T=h1m`k(aZ25cYM%0Tum8eW|Fna=
z6aQCn$tUc~WKsOGPR?I$iW%S28mAiG4OXf>_Y$72dbKle|BOkiSl+fUFG%C`Wlk_*
z`SRqsN1BF=hj8%USl87{@{T=J|M1g*yV<C9q536`BheAPF-LTd7aDFlF2Q_grtCMy
z%}-0!@9q^S(OP`y-|VB0Ixf6@<(r<jhH>kXze;6Kd8;#CR3&cfsF-15w`}Es$Ij~%
z<5cWY7!QOOg&hcFS(~H%$zAi=W1T+D<{$PQkGiM${!wdARMc1*vE#<g)1TH@PMEz(
zwUGUJnW~G|O}(BkLQLTu(Jqr79SdnP_AzHy(3)exvE}Lxt{#gn|K^LFe$$y5MFKM)
zW?Yd~Wxm+$klCA)xag>JrPIa(`5c0a)e2^vZQHZpf}g%*g{i2Im1=ZSi>G(VWY!-i
zSKgd|jZbs4sHfKC-XBvRa|s-lO8T$yV{4vamr)3l)|v-zas~gic;8=VaI{S9=BK`j
zsiE6WDzH5Ee6h?&H7JoGV!ffEtLvFbZquqVxC^(l*GsCgHBQOs*x&fL>G$rAIU+~?
z^p!ME<b1f~q{NCVnO%HA%askji=JGNz+=LgyMa~xwuFeGv-q<&{~qdaDPNnETqE>%
z^O>$f-p0)y$7B0XrWh$0&kI=pIp6d2Lz9|}NB1{BaQ{*lFy-FK7Nbfh5k2m+i7K2=
zON%yGEpHM}s@q#|x7X68V|DAwgBuhxX4ubUxjH{}iOOc@&4KDKmt`!PplYP9Gn?(h
zx~7Ub*W|W@UwX!S^pEAyH-f2op8uvud*5F&>8;$7MRB2$JFhg~6rSf3`^<bspZz6`
z%!3!gmPps1c;&YD{l-fXN-~Rsqr%!x%S4^F&^{|6zIMy~n&01Ey*+QwIOoID&*J}&
zrY+5St#)m)Wm8bpx+vLTTcg7&s`a%yPKrG#>wjG$!?)r%&+^hOk>{*smv8AbY_Ps1
zaD;11{4dWb@r^;Z8|DelXJMUMu$Nu^t;W776Dm?(9WAZh(z;{unWM`Uv?t5YXG*%S
z_waO?n9gaV<1GbOjj9$r6wa)-NOb&}dQNS=2^;IdAh(~sSLL232<)G9X{nyxk0j2z
z+5dZYcpH2+_#k#Un0fuQ2QImL|9+Fqlz4Ab`26vw-74!_dybv_-sPAvOXB{~k2}PE
z&bp&uy}qemxq&xf>YL-fl81#~37$+BdNV&G!emS8s^gC5IUbvANqzE1vdb+iOiJRr
zPtTpVU)zfQzUitG{{66Fs?|kdcAqW!c7?~j{#yE>>(7PE4Sc$j1@0VP{Zq29cv}UB
zb;2bX$N3+{;~i$7R5pA0cOhF#Per)&@`M{!SFgOZ5&b>u;>E+O@2F@zv0C+td+}3N
zb;qZRCFC=gKb^sAykuH!l%~Wi#m>_e>0B{pAEx(p_2&pDZ(49F=vwo#7iIG|z7AgU
zBc$z$@YFq?ubLz`ZI|lW@SuC=Pvah?IXQ9Lf6QSleYi5hhf|DcR>>LXeGgSPYPN(t
z7TDk3lYiY~X}7+A)47I_E9pH;r(Klsw{13D`YK@U(^WHjpDH(hpU;|~uz>mZof)T=
zPVmq-Ij*hkU~te!vV8r@UJZjx#l0E&(-U^o*1F6qY+Pq~Hj?FgS5eiY4;N?5IrjJA
zLG>Mb$~L_Y3C>!zVb-^c!Dqr3Z&)Yuu6TOtiN%vvs_Et#XP@ou*muu4fa70{$K@~{
zMmv*p@~XWn?c*gjuXc=!5zaAj*d*jDIP2_HbBm&u$O(TdlJ*`v`24(h*PDmo^?P{I
zZFzhDUVj)q{ku8;LS?;<5SPfuB{i3W7ya3196!nX1kX!Tg})!;Ok`ODb<f5`r0fzA
zKfRabPVuJs<vBk)Zhg~ylUSRZvgzJ}U1g8iikECpm{Yht=Jjny*O*S;n))M*_fpOl
z%5P+9-Bx?#>ORX~b@NS*Gs<j~sFs}MX|Kkk8@?tw>H2p=@&CzlPn~~gFL^BG#MDW_
zOMDtWidOjNyFHNCIKO)tlS=dLB?lD#UERGsYK!L8CHoSL#G}$&gUh)l%bJ}r_4#F#
z`zv?zJeKAR_0Ztt9&5SgIg6V1>|u$%D4r^z>UF8)ja8fZ=joeUg9L@6Jv;8ms<1rp
zZ~S|RJNjMLL#?O{JpWB=?rF+6DT^PKi1Teaefq)C1oI;)@v}~yyEpxa{rkL|RyDp~
zqYmiwt|*gSA@M`~_SW71vhL09{v^;U|9)S^HsgOzXI^|xcKEz!*%_(4C#6}P0bV_C
zTk|ISt8P^}Yk!FQlggsr(kCjv8<^kS{(SJ=Ep79V)g@;N&oK7Sx%l%Dw^Y%mh+QY{
z#DA_lv1Ousag<k<;$D&U^_8Vx)s8i77Ty}PDSDZ}(R0pgW=%X<8Memm@dJ(MwYe*A
z8yj<V7_=A9Q$MPvwfZcp?mJi2Ym1m>asI2jcR}TK#_czs($9v?NnTLkH^ZxAMTO`5
z3vQM!J1;K?bj|&7@Y;p>+`KO;M1-eSZ!$=D{Ap*vf)~FHg8~-E1{Kx{)&4%qVbtM0
zH6g6CXl;W?ZQz%W7t^={H?6Q;_Vvo01v>G)_U)SYp1)PouF0^o-2dR+%-fc2jU3v4
zl7prkO$^`mHN5TB0+w6utC!^$i24P3$JaPA+fLK^(Rl5LfmwP**LTg|JJ&7OHlM}l
z({_<RQhej~kZXc<PxrQLSQqBusPlAXmZjsJB}}W<th)60^WSGx!fFE74Nk=!`M2iw
z@xo~vudme7OuqeFIqvn_&=m?7IkrtXDV?xz-Kyu3Vf)0J%)cDiz4))*JtwEC366PA
ze1ATeD%>vOR7{WEnRkXEJjvCj{MiNR>XVaf)*M~4Q|Zo@A37>pCzS8xHv9KKyTdd6
z?4om-W%J^)P6o<oyS6`+K54dJU~a}$Pp$bnE*H)!JMcxz%Kzk=@#5s;B=z!y`Hht+
zmrgm@*4|sSyu0Q2EBWIOdAlD?Hk|PH&c}LbU8ZTmTTdtl{|w~2vhe(hRnLzlith~l
zr+lP$PiH@CvbpEIq@#YDj#ni`F3)Z@_%=s%+otOtUaDP-wXCK!pLkNR`_5;^hFMwH
z4!mC0B0aa_VY0bIVo|L@8&kx>oz09!3yhv$f0@zP#m6AZykzg!^I?r$q7Q@@W>5WI
zCcB%r$ok#%$kLS!OZDgPj7;1fpe<_t@#Wf+yX+R$PFIwF@jxx^Z%o=U0Rf#{DbK6N
zDpF&^+OJ+ZB%u3~N%X)Wk?O0CoND{0wE69y7PR?As`r_Y-DTIG?AWv~Uqe3Mr{ZEU
z*P#!|-)4%W3C>VF`TTJ}9mD#hJdw*m)#oprI8&f6xz5)zty?|p-VL84E?L|YWu1}_
zvmD!BKcnPm^rkw`)Z(ezBsc$@Cbh6w+{%+p(_^z&+Z(g99eQ)E40C2xSzKe8u;`NS
z8JP;XQ$HJiy)rvF!C?8sBP~a#7-YVg@Ti!#p!nZxey2_Kw+w<z{(ec#s9D0g%fFfN
zk+%7X2o}xTvUgOK_sSfw(5~QF+|#?|z)FUI+AoS3wS`7<Hx}}{YfTGY=&|=o^X2@N
zA&n{<w*LBlU7tPTf$Ew+-X~eU%=~5`_w>QJdfRh$YlPS%*;;4rfBDJHygG9V(@oWP
z=bLuF5cn%S|L#fl^U4)1{12MzSmwW+c#r2rK8vf-n?o53GBVEm{CxC?Wxj%Fcg^WA
zXI0ma4^@7=GOF<8WZ`{!RA5T!51U=nedU~j3llGeURvaB5Ts!+El5aO(r0SR_RMB>
zsnivD-)5daSHFKju;{VF9BmUSpBD2tRK7o*W4P(VzVHL`=iVoNVSn?)F(Op(OTjk7
zw+DWC37k1MnVn^QyU>ic{f&FG?%v|Id?RI5d(my~mFYb<Gg872?q&Cnj!HJWd2O9r
z`gtqkX--?(p8gg1H}SrG%H`1b2%Fa*R_9${blUG(|FN3w*|)g-_U5QpJ|gEne|(l@
z-u2S_iIk=U#}Nw+S<m|{mmfQ<O0x)&Xzu&9T|>{%WY&!(|Knt?MC!C}f3Z@Cb8pfy
z#@`27g^!*+W20%a#p2n|N8WEzpRm=nR4mb!Iu`u-$&Lb3eckC{eg8zuSFDI&&#d_W
zfQRLvz;TW&=blZU4^C%%d;Y=BFpj_i>)0E~C!gI7kPTcemVY|X^x&7uOi#nZ+K+`b
zY9y?yVwXLdy(cF2KZ|_Ns@r|5Is0e$ozGOCurSiqwIU{I>r~SNH<EQ{T{W8~ERh|h
z<vyicy{dnrT$&Xdvpw6JYqwU-DzeG)oH@C6X5x=&Pqv?2IPLaxk-3@T(XDI~nP2VR
zUjO^!S)R%MH3vfEbf$h(?hXh@->u`{VQ=>#s_4*{KYKLJKjnDtb-*q{*}zdkS+zMP
zcWL0}O$k#>4s`CVs#krz@1wz1L7PYOt(u-c(}+FS|7z3PFr_xp;2H*I={5KL8BfpV
zwb-kpReNe<_DqRA2amqq*i&1XWOO{+?EfdD8PO>Zr8OL$ZT2;MrvG|d#K)Bmc2d28
zg8Ls9Yd#hz7dmv3$-ni(@s;dp>~7aiD$A^ny&lF`clfJV?2i{sW&!I~Ju%oO7`-`q
z+p^8?u1l}ID9$JH`S+ov{jUC(7h1c8tQL+=iF>-yYfJeY);N20r=?R8PCl)ibyeHv
zcGr|UilyBifv5gx#xXL*oS*4qrE6&F@agAA9`8?$48GA1%Csjr$@=>J2x-^6+7*9P
z_Q;d3KVH7+7BMSf|FQI&^1kbfZ|=JNt0cMm+|rd>H|>&Kx$WL3=A+8H#F|eRnOt2s
zf1^`ya)+mV{pp;|E=#TbUL9MrV?(K0_PgVEPON^hs&xivQblv8j+>|GylFd4bT&O*
zE$Fb_>57rPh#UjY?+x$29@{PI*K#3R^T%-?&ObU=uLg$SJm|KzVoiZjBy+x8$5q27
zk2;Cy!;uq0;`nE-Ty8cs&E!^VpSh`x*-du=0f7Tt)6dCeui~!V&F%fcil6&p-Wv6&
z_|u2~v~N{0dm3t#Q6crCw><R!#qA0GC9|WOb(N-VSm$#-(O`1?*6M^`clq9m>Yr=m
zzj&KbqfP7=pQ?NQ<*1XP6}z$&oAwC)Jh);fi?2f9+(+yxeb<=N%0)T8dv)&klDa<j
z&Awd^j(P_v%T_1YUQG52F6-e<6kTp<#W-(<B-174zaGaMvV$*NV76fVIp@G6=4}RS
z<q_v!``psBo!q?jO4jn3A)TiWPMWoA`tHZyZpz9k@yceujpx3&`q!18>+UgzF^A-E
z<gQ;8FX$o5SNePQ6RUYep~9~ZZ#Zf5JdImfr+2O1UnTu{9osLwp1068Mq;_nOApg^
zQkJKSJr}p$3Vxgaue_q<&eIcZTPhMFm~PMUtd!KUZE-a!k(pIu?elHMO26u+H}SXf
z8dU$CSZ`bS_Q?L_VmvNiQj;!b&1N`k)qG>ORUiB1`^P?p2)?@TRQ--%{`YFDR~_zg
zzqPZ^|2mN*?V9$z$cVpa+v_zCURS@9Wna_%QtpdY`!w&w^&D62zOC@;;xkRK5pb>A
zI`uGX;Hztw?c};&HuhHdlwOFlJ@ijvMmE2WN{79varn2-oz5jjPfetzXx7%H1}y9G
zDl}eVspXgE9F_X>sEx%(FXv;r(HqKC@3&mZY<j^V6=(Q0@N{~G?TtT9?-~zGem}+0
zgfCm9Pu;O_hg16fXFCHY|C!Qc?yC^{dfB`=yHz#CPQO^0&9Gwb7suY8i{3A75l`86
zt@deRmHkI4?Z}X}zf5ngbnk0@Ipy}BKS!BXcO71DtFFLvW5&lRwrLlR-u~jb>$c?M
z8IP_tmGC&^uvkx<&pQ7%OF;ec)`=%xzJFuB>y`hrEh6<RcQZb56nJp{kHdDC#7yVo
z*WC{=8rZOff7Io?m~dKn%fz4?`)2Z<f5pkS;pg{2wVQvE=UJVy`oD1Ma@*xwOXV00
zKg)7jEZXv{eui$$4!c?W>QcJg4^`f<>9*Jey-i_0+Z?Uc`^Ptk`;3Bg*y`1Lmv>28
zUQ-F!X}RmkM(@5AQqo5rWv$-6<;60AeM)`-dl%hyl>ObNH$ykHeABD2SI4?l4lu=h
zNDhh&RVg%?!(S#HA+U?-{ymYmi&Ol}OZS~V#~ZZDXx;2Dm)={P)Oylh@F*>!=dE(}
zPJc=BDc{qM>}+`O{ZnN|+Tw!#w^uxqqNo1&^t9k<MYG>RbI<JblHN5L?#z2kGatX%
z{3BrR_5-hrCu|nJ5X`<Om*=4SM9xc6>nC0MK0h<g=c#Y*jPGlHesZe)xX3Ov-C5;n
z-Rit~4?i#b<IgS@>Y*BD!f>y_{OzUH6|s+Zot0hiDr`nsz3!1XvAZX;^>P=T*c)Y^
z`Qb=X!TLNIx6)QAm$}yqjUO&NTq7l=er)b`x99BBcUPZYxNgISW65R*R;5>Yrf%<F
zza}SlUUpSV$Uc$BH!fURR42uBW%+!zdAp-UtLKUzQCwb>p)L9Nw&ai8E#*lfPi+^;
z^!VK3l)K|znd`pYU8D2qZJCXwi?*IuDKE&7KDk4wftz2g?7%TUqb*&jvo1K@3tntK
z!*Gg$Qt6iKJyUDaS!_3#wOjY-eyK{CaE5KcubeCGPh~z$>2%wE<AZSI>tEjrd*9wp
zTwU3|Hf-aLH;?l+w08Y8F}TAmx%+0+`mjk~RZCiKM?X^Xj<z~g>aG|5n)j>mP0rxt
zkAe<~{+bnUmZaQ~tG4)c`1R(p(8Tt}+b%g$%B>t*8>64D%m01e_V$vZY2Ucl3r|@4
zc;U>CiBk)A=-pQ0UB0UMpJ@9=nN*{hQPo+0d++f*v&(<2SanOcRz_mp{KH!9RW?5*
z=K03xnf(7Hb?o*P=7WX5)~<b=xVqrOd!d>|H|B}x|83ipJMGG!fN9s??$hplvFzU6
zrnQ?b9>hHqWMIp!RLe=~73ni<DV$pwCSBeBX<3O^l|E}l{)6>*Q&OXy3-)Po?=udM
zJ2qG1!=)VGoAP!$Ltd>3lRY_^XVbf`eCLu|EVK8-T+%NoVfc82MSMkqQ12w>ile*V
zExN>Zx_Qst&8wulb}liFPMyvB?x(cEOO56^&gF?F+sgXQc3k<@y<*eXMm?S@94oRV
zUOI?hmASCK`3ZaPtbOzLM%!=R)Ub*_&(M9Y&d=>G6PC4BGb^>#RrIGcd}oqkKYm~~
ztI4<2iL1DMRU_6t4{Sd!@#g3D^78WMp|+D>%$MhDKfNrA_3l+aJ5xFBi#`k)OP0D?
z?Msz=y(46ewClw!@?qx=H%>fsbcyo1>vA^S3$oA1O;LQyVQ_{0Jo7G>ibof>{`Yjg
zbo<fwW$)}Sp825_(OanI{`S1_$$qQrtS(cZ9Ayb!^X|d6tgTnGF1=J)P$J>i^E-2%
zPjTj>KO*Won2*%$v2HYYZdfvVMq66Mwc{MsM{Zb(1z*m~So!h2-If=x*p@pyVb8zM
zXd)xB?A}J(TIY7fLyzAySDm#G>~p;M>!?Y@{yB>n^yXaq(X7tt@+td))biz*Cw;fM
z!WqK8JnnYG)rH03g8Ld-P52If3a(HSlzeuze^nv3Q+g0{Yo*PP3b}P3tDeg}u3TXA
z=yqwIN<Gu2qcdl<a8}+uXe7To`=3burtZ6$yn9^R%J`2?o*Vvbwb7SvmVt}sap>AS
z+Qy^1u>H+(j!G@H7bhNUvd`V&e#7^#?ysGHT8mT9Cl%dUzs*bQ=H`DY?o!3wm6fk8
z4{)91{#PdW-s#_^YrLsVD~vkp(p&#MJ;k8aWoRxRYFQHf`D10}`r7Zt`IS3QhE0s*
zxixp|24SmLyvMZP%{H}rcq>L=<*i-({8z(dQ$s$QJ*!##HE!CvA8|K#z51B2WBSpL
z^9(+&THvm*<eKH=<BB$M8+$^Ocz4PLbj|$~q^N)Sg7{}6fpQMd3l9~pT*}aUv`44*
zh-pZ0k_}VS)%E^oocz`bzn!=Ejryrcp-csz`g*S|-kq}ET>MTPvo-Hr^+iR^^A%s-
zJYNy@(?z@gr-=F5@KbI-{`D<lzj`WK;=`7^fjJC50_D;F3fHf>wM+K!ev!V-4^PgT
z$?W*yLE6K&ybu3hzw_4fb$QXGi>s85uRU_y{C!Q;u@GgU(wQH>tx|2i=yz@1Gl{=P
zs?MLA=cBd1%&dOvsx|gq8tyyJo<969^Y^yKFOn?p*Vq?jUsegrzkPOvXi4#-6DHfX
zyu4Sk>wMkww|?Fk{43{2S6cm@_^zQqed+yOvkP7HYo`V!%)fFVNx7!dPk-(z<$sZ`
zw_D04>`4pBv(nynad)m%-u?qjAGY@Q-8n7%DN*(R>F*C8O>f`l_Tcc<BC}PwXToR7
zz6qFYrgeAYrDmDbqx1bFl4dWkl#+PF`E>t&vDjSA{|n@K3-2%dA@I$ox4Yhb&f?+#
z>2+tKPOsU2U25H&gJ+&zkLz{hKCe~ocIZm8|ILqYSP%N0-NiY*Z{OTalQ)D_{rvQ%
z?r(vZpV+efd52jh2ziws{rvRiucMJKp2*MhWJ)aZ{&eWZm%X8Og;SY#&)Ch8rp#x1
z<!Ri%F#qD)Yj67OvXn9Q6ymw->T#%i&DG=2EMu*BRL-r-*MGlPpM&S$HJ6@?TdvJm
z_U+?>ysu%FyKjYEI{diw@@w^bcXDop{L|}udQj%zvxD(`-wUGr&fZe~YGO6-B#*7k
z^T>X?*3>tb@~d>_8&AoUT$BAu*5wVKA-}+ue$Aid^VaS^_~h%MKaRmxm8S3b_MNEx
zt+!erTD^2h-Rr+;72i)+|6+gnV+FfgPsNNqA*>}&tsXch{VLP`WhKpa_vN{R%{Iq&
z&fOrrefRUjminvwUrFp=m-Fw6(Z9fxrit$@`<;{jG&uXzvN!PPH`LcwelQRJXl8i4
zFUmebv~GF*C6VKX9ah{g%^q%?@qo44cT&8Sy;DPd&|;xh-Pem(DQ{jhdqtssfA7TF
z?H#)|AJ4k<_e@jX(t7LjSsgt~AMKepXM+b%4A*0p#e1IJZTRG*RduUeEhYQ?`A3i9
zr~eNM4f(alCilU`zu&WO&Aq%|jm0c?JIkG4r5C@fKKP8e=!D3z=@ChXreCao`Li@7
z_Gi7LoPf)er<H6WyFO1jwSHStY3z3E={&D0Z-noC5xFw1`AI>7w9cY;|GC6JZ<TYq
zcU|hv>Zbh(HRm_i&S?4j>*uypD=)eF#-0DnH0}4JXRS2_2Ltp?u5gE*zO}xd;i7nn
zwc_-9C%Cgq{wA)s^=#o1tJZ4I_jx4Ea(q^D?Ai`J_hZvdd3P{zX>K_5YjgZs?_<4<
zCKn|B+1~TXl*-`Ve077o(ub(UXZN$)@LjE*edR^iimTEYXVgS*wQl(%H-mrQ?$?z(
zs}p2r{PvDN_)Bi~fu@5cme*M4TQ=!`an$-+_tfg&-_@d9u7vsjGXEEDtF}XM>&x<|
z^9vgGeW{cCRG#qsc}e)BUwyMCx-aCObjXhT;lK84l@<?nd6|_2^W1yy8o*|8e{O#C
zhaO3vHFXg)UtNBET0o-5V4;7Ozz?IB{_l)8epSo%d;F?y;<UVP66)HY9F@O*G&WkK
zZ?TnUwd@qHtAAeW+Xt*!dE|AXn1-!b)P9E3Y+wJQZNZs&`I~wI8v}!$7z6e#K)H!|
znQ5uTC3*#wb0Z$+f%f36U#@UTK9Aixqls67N5u8^7Ker$UaR%D16cHQ=jQ5dS}}2o
zaN-T-x2E4xb}#nm6iQXktUGe;?njTicfa4gc>ad|b@Bb@*ST=Dw%tr+YZc69%sO{(
zip||aZ~lBq{nWE}a_ZV6Y1udG|8M#{{rPj_Ki_S4>+n2T5wbMo4o9TQ$&)8fF4AjE
z-5}PgFf%QCWyGngZkuHFk4SAv%%0e6=lWPBQhR6e>8HDlrZzpD)G1qK+#}v<a&4vG
zoD)};YMAw8Z!0)0byDaZ@4Wl(p8BkBVLbX-bMfI6aV68>Z=C;DwKVB?-iwdX)3g6~
zCa!X~{^ZZo)9rnh_1M+t*quMGW`1(Ff4<oJ>D~70?zbP)4xHet7xrc1)py;?J}-Nx
zn0xe8?KH1tn`Ql{x*R`g>Yx9U?Luz#k>{L;_jg|QS@!K?{_p!*T>F|&?y2q9zqMj^
z=JI>ZizH+=KA3vbYw5+L!Yb7*lCKmuOFHlE4p<O8)ogPfcZ{Tl@r9K_OC>LBKA34+
z9zVz2wA{mPF<0l5?E&{ar^?nfPm#Xiq55D0r`3+D5qCCz4^{n?^Tgrk+P)==JU(kR
zA6~e}ex3g6P`xi=U$r$qJ8Wb=Y@D|v)-%*md->k?PhKq(|7*Iw$T&Durq*ZYl3(55
z6j`rrl)HYw_Wo2$nF~@a9~iH4aV_cH_i6q!=IbB-TxFk^Jwr{uL-XE-1qCx=j5o7B
zYjk|yowV*%oBE|W*=OxKs!z;0`I+HP<7e^DN8Ww^!Mp5)`-^FzshdUDs%_w%kn)s|
zDOrnsecY+FhaRqKohmA{VA@*qEn6==*fV!SW5D+}211<ESZ4XXx+o;SqS<pz_Q#8s
zn+|Z4JG+$h^KmJ!udR1@*tLJ9p!Ubm{|*;-3*0P<Puf}DUQjBx;|r^uz|T{19l4(T
z;pSW4EZN6&|C5f+-VL|7+WrP#l@N^1(B70Hl{2$+s%!2dr}eqk4>LBj@0pj{ATK0)
zyR30`Z^zDgoWAi7_OYmz?NC0SE8P^tsCsRd=q83N<CCmY0uti=Ur!9Xtob;vxZ|~G
zj={`TeIn9{NnW8c$rg{2<xhI$B{^qKY|xjO==*Y4%AGDLqZsDpjY%!bn0$|%ZC{x+
z;r4qYc`KHQ=QqyIa9Z_B=?}-Ysw;BIDOWF@5XiKPlnpTOX55fl<+SK#IscRi?@p#G
z9q90O^oZj%s%>Gu?I$8<sB`{&$o%E|#de&Y?stn}f2NqD=4}gKNsgY$NppHKOs0IX
zHCUXndydZiBHsMY6Ji!!O_Gj>FQ^<llF=(vdL(q($&#4F$kZ!!OHO>wQtlG0H1~4b
zr5n!rV&X1)v%5<z_8;as{xTuyW!nAOawW63nO9r&M6tbf`cotEIWVW^Ytr-AUTfyP
z>wI<9dc$d*ki*HcN3wW$P89{b(0ku_L~T#LVAF|Z76Lo|uui)8@nBkxr=+y^4Ci9u
z4Nnz6u-b?|P0^^;nA5o4(Qn=Z&3P+VT$;Y^5_@jNj1>*;vInYTeofwAS$9BirSiE6
ziN80yJNU$|sQbM6;*Whh`WNY~S*iJZ;^cDStC`7FkqZjex2&wV7u)%AN^#zV6Jb*u
ze_oe;6Xx+ce&&Uq=jD5@o!L3>kwe;xqdWL7&c7iY<sZDq+W5xQW$((|QhQrHwpCAb
zG+X+#JbGeYq1Y9N+27mkZ;8IYWD&tN`FctG`HjyXEDAmQ&1U@uMN{(v8`Fo3?XtaW
zi8gm{^W8t~+xoEj=e<YFGk46q!1iEbaq6Tknte0xu0AGlw_h;#?atqh9#v(NE;nn>
zlx6w-eZ#w_>g}snZcnnW{-tHzSATfdGr1d!jK5^e?%_^nxH@~sSy}T>XW#CaI{Tpf
zme*Tne2BWRY;XC2Wtsdr%F7@A-GB76Nha^SjYp4n_ZP2vRr1?PNcli<%!gk;c6fw*
zIQQ?#)v%{gt7Ogha(>(#aD?&R6NQyEQi@Y+H*a&@>m0pV^L%k-`-dbiFX12_bDgO#
z*x$SQh;h7Wm^)$m_Li#NDGnL=?;Jn6<v6CzWQq0Rx$9f}W%FZI>)G=+TF*H#p+0~?
zs=sUY(tuq-&UYS_w_Ts6t6%CY>osjs$K#f~hIyy_{C@ig#CYEB`6+QreBY#(Z@2%~
zIPh2H_3YNKm9rKH|8`E*FMYBkyZVdB-G^J(gjCcX^G>N+y*jr3Lk9o9Ui)O5k`pf?
z-tKsJyw&kZUf-P~x<~)<qpsI1<Yb+_mxX~Lhabo0(6ZE`;>`R!y@JZE;ko&b+ywr;
zi#POLV!W>@*~4D3BV_5Sl1riCTWeOdXylv`u-;f+yE}V_iPt~>|8Dh>>DSFR_GT7k
z@+sa+dp<Kgt}M->^?v=|m;DEiTez$%_>kBeb9}bMQ;E7W5fTp*p0J<OjOlvgckKGa
zw)%f<fd*2%FP_TS74&j)rmCr2-uR%exTvT|^M}~dHgC1{tQXu}g;))*Gu1h&TC^yg
zeeox>Nx?#E{uG&XWmm4#Pt~sPJn~fN(UbsFgLAFh9-Pvwzf>N1W__dP49mXF$9Nf|
zChxs4BPNfxe(6&7X6_k3<&&2_|59pL)*xrvw&qF1<KRoWH#Yh0+m~E;OmebL>#UQJ
zTdu#CE@Rzs%D}`hv~`-xr~cp?Ma4J;v+BuDST?4lL`Hr+RCeyV%JrW0qAxfupJM;*
zH`8;%N1NA&ef=_|6&*M7zOvT7SKR#aa{Bz9Ba!E`=LM9c$b}hkiv$V0%8C?vJ@0n;
zURObeiLVQ7_pmJ#kt|K##<!sBgZP&8z%?flvwtLcdBz<sNt$ynanhA@u2Jb(HD%kx
z7V4io?0D$MR{bYmXCAekyu-26=E!EHGvy%?&8BG{fsYkg@Aj9>nsbZg)Qm@#6Mk6s
zt1b(9nU$}xEmGnA%qv;quUA|z*1u!7L-?~%sqOpDnwPuI8znDwubQ`6JgJD|sogH!
zufadgrf4UbE#-1Neo|_o-&+3N8hpwgntPv#To$-|+0DCKY}PvQd!g$T9aE?75H0+(
zNW0SebMK?<pXKe_Hf%ops!vGSQEvKo?c|Ln<qN`o^Pbfe70o=`{@69NVc%=n(?^dj
zeQ{_05A}b&9hLd7ZMU2YDiShbn&J0w&&(;zYdG)ZKR@{B;C}U}y>DxFe0WeTVfVw4
z`>NVs&hjr_cbG$3&nt@x929ohEOPhzx}7b{Y-LwFq`lj-D>p1Yw9ZHA>&obsh5zsU
z_-66PjCIRmCZ*P|AEmUk7lyHZ{+O^MV|n>+pA-9*Io#8k$b04CfA6f_8h+iHZND;0
zGz}c@7;W;r?t4SdA$Zc$PP62RnS1vAHp}GUo%q=D&5PdpZPkm<Zk-$PbZ>c7h<#3v
zbI9~3>f#?P(>r4$e?3dj+m&+F_$9;Hg|+NYuKfM)q}jLS(9D+`zn1ORRCuvd>X);9
z#9A+5YvzvZh(JS8p^EQ(VZsYiJNIoVu=iwkwGzCow1#Q*g+`Gp6PfD22rV%`#Azkr
zdt&SKiqBbRuSb75zx%IQ)86}y|DB~@_ICa0C`b^y;h3>bJT(0BmxFtjExN^7xmw}u
z%G0;_vR{2E+^;8IJSS?q%V*(V2Ai#&3d?WFIz;E*3gldq#hkWWD`&>n4LQu3yEVf$
zCxtIio1eh_=G2#(dCSAo%r`&N`qTDFPX1cbaqSxKg{(J9@1E-2eDi{|`lT8A*4IuS
z6a4mcr*e4ZtiW2Ihv{x}H!E(kezj>%->VIrGt;)VykGW!ZC&ZKf9+E$+S|2{{a#z}
zvUI-UsjHGncQ((h%ly6P`r3`(6V!@rEH3U<*)xTA=Z`tTxtH<+<lUbYUYK~YXwI|D
z`CQGrr3{u%^QoVGYqG<_caoFlb$+ycX!qxN!j{Ru4}R6m)!h6w=u83kLs_4~ZofV8
zU3M?o%sK9bze{Z~UDFiu=eBXs^LW%!uT7)VuaJ>}A&VKaJ)WDGor=6Azjl&g_F)5o
z*7E;d%{-BBCZuIAboR7nk&^OgbJBF0cz#=lE~h8o+5PWtZWKB_rRu_mkM~}_oR_}g
z{@%K@_dyGaX5<!y#EA*L72YGEr*$T*JJqOptC_g==~IWZetzI+=SuAM(?0RBXR8_S
z&jZT&LPGLdFCDJjxwvxb^B~I)Pb`YmSw+?g#bq7MeyP7ep!m$e><w#~*6Arsb<fth
z<hgl^szsWl?@QiYaVnh2d)7%dr~mM3*!Q#QwEvH9&5OR?I(M1#4tH*W6YDHJKNs`w
zzm@79Y;%!U=2FtCO7_te-|_g`UG|v0@_$qH4$NA;>8a|bw%G?<oS7r~T0>sUxZcxa
z&K#=b_eQI;!hebK{f)ZJTdxGx9&>!ZJK)TBORLA_lSIPIHwf&?T;Y9FBG>jvwWlK2
zyhHOp21)F1ahW{hpcoUM_~U>pPhM%um@Iy$d~?NO$Cu8c6W@geaDA*7h`Af)6Ce8K
z^?chIZnb^6hxMA@&o5Qqj~Z1ysX0-7JPZs`#taNnXd4Q^QI(vZn+vX=u13Y@-*ywK
zzrH-;2>+CTNZ-q^MX%1~wwN?$Rq2}pL42GtjZ0Td-DBwb$>Y?<#235opLsLsj_UMD
zbF5hX_|3L{E>BOdGgc`*qV~Q`zVCeN`NLD>`^9a}90~fc<h)<<`TY-%udmXNcFz$w
z%HJ7rH|5RM)ADtRm!;3$`((m(v+4dvg|6!g$Bo{tjb587w07oeJ@cDt57(VOV%0aP
zr!r9@HBN1jL8#5%ds3k+N%KBWICXLF`Q#_3cPjmw_RMGcm#_T)CR{E)WYrN?r2B1?
zwC`K%AGd<8-*nbFB>FkXEO+aXNxs#W``^30d$9fDgZ__4XV-Nfbk}_LaIVLq3E!3-
zaeq4LoaUh(^}<6B-{0}BJm<UW{hlRPx%L!n{TOy9w%X7-v0vrQ55M`A%*$8rJ8D?_
z|HHzFn>sd8RrWS#uP^$UF0{Mm?{A0r$%l4CoobKUb?oZplhNOq{)totU$WZyags&+
z?>BcRuD$<pe^m4#H6i^YPmN1gYP=NRc&4D%N&N1$ZC7Vi|I_6cf7jJ+^Kp}gp}BO|
z2jj>c3%HlQxYsWx6K;Q@HEOT7;@P-IpXyz9ePl8_X~r$MQ9jN{=|#?Zog8}ur58E&
zQ8(fYL3HGee+N4jZ2p^*_`6fkG5z<^L*M+h6z9I3n#*l(taRc8o4_rHB{N^I-y8i-
z?}t(AfjDo`=IzVtd+xk^`t;|6?Uz5cR-4($KYgY8_U_fE?-w7uA{)<h?mj>FquUps
zd}8WY{Q30dg^J5Ggu_qq-;0m!)m!%N^~a+xuez68?7MZ?VrNagsYIk?`{K`+`xh^?
zwy?FIe`UpslNlL$^LzE%-d%nA^h#~H)!(yAJU3777hV#+h0$0;#($Za;8FYRtqL=I
z+CrBI-29n#we3(l^Tn*YFE>1nziHFO#3{fabMDSw@4qU=GdLtUzWmX6$gTfbV13Yu
zI=#rwSj{%$%|+kBY?$Y8nB8felx_XFmqV-}MCQ%BIR@=5bA#@Faxgu0m~YpQ7i+}1
zm!F<fx~*W_(tOeX%TBh5n=owg6%tE{dhWRD?VAqX#TQQAa8kK*zKNaTTF4rwX|79y
zb{zY#>8taf19^Ka>NJjY9%TK`-`msUvOIv{nFYgI57!xKaW6iXE!^b&{OZcQWec`P
z)iFHE`5-n&dzRnrH;%G9uS!Vp{<~h`l&%!8@PJHFtYFuf(%YK+(_*)|C~cjm*VbgT
z#$WH^_n!61Kc@!0R^r;aVo{r%R>Ot|_LC=MGbhzWCOdqc)EBOM_GHWP&Z0>=%OfwX
zKbG<G&+myQJN4e)EPbf;<=TaF+iSl??AZQy`kFbD-47c^xUGJwRd@T}s}oVh(;K%p
zZ9U=YlC6Gkx}BBdIiKq18_Ia&(=Tbxu{mUIlhn_s{(14&TioJ}9F|;(+U@tG8AYdV
z%vc$AdD<PmgHL+){g|!NnBTWXdET$M9z~na3JX&M+t&rHT<>(tu#vT;PfFE8>Wq_B
z(qq-r2^LPt7G^&#Bs~<7IAizValLuqvE4@=)D#ui`YqaN-o9(1aP#tGTxWX}A~)2(
z-P7=?_TioxGtIj9*0Rt3{pDolO^!nmTXW`3W8PG*^!3YIB{l~Q&L;7vv7%917M$u`
z@jgtJhw)W##Np+sn%DRIJSE3F=al^n!2?yjM#j6BDY?Fh^2si()p{=EHK#?0JuHEp
zk^lCDr~5Zew^Y6=74TKAr6Qa!Aa0Y_>|KFt!#@4w=KktnqnnnQAr^G&rN@yq%&XV!
z^A=rgEOjjL^0mZ(``@<~|6%jHeX4wI_H0R8sdWp!aoTBEu*hqPT)r3ZLu6u}Vb%Gx
zSh3G3x(oF0YBHP?zAxuyF=5|6Ex{Cau?Meo>t7gkXbZXeGdx)O)=#&yu{$YQ^7*Tk
zUE7WK>c=q^e_r+0r()VcR+pY@&jUAPH1FcO(%m$@L|D1ygKNL9h5CfZ)6rW__@DH&
z?_5yN*m6v1f%V3iW$Q~rc2^$jyZL+dXS>}eH(9)`|8Ki;nI-F_oWHiFM<17Nxxuoh
zeDd06Wuvk+lGaDq<{YmOb!!p7$(!SI?{}ojUyi&GXWp)mj;$@Nk6&yuOJ)AT@#2Kz
zlhnC>#u_?vA3s!PDXsp*u_-z|j8UY!D(gXMuY>arC!L*p3NGlM;bjqyu&^%XD`70X
za(Ba{S?WP?JL~hTgC!Jib{~JsozwGW|19ka<(`!fPi|~G`6;PIz>i-eTR;1;O4seT
zBEb&g!IBdev8A}@R9WtMbNX;}p40qGZ@M{{%$`r+ndAD|gzJIZOjiMyQ<v;hMH4Ll
zpUhK~4SVrSsq@hc{gjvY3;tizy?N`$ag9sMrx*o^H3dj5db{EM4cns+_N_Eax4N)U
z<;%~&8F@lq?oamC+F<Y^h2K_K=R{;}(T79r+g><IsY>2)Pd9)2+wUcV#%h%-bqWIa
z+1U1(vecyhyzXVMFBh1<=GF;2zP|~ZGvsc3To`D%!Cx+j;iK376+SOC7)}0!%N|&2
z;rrmzCvCTa!`Y^#i`VM1bY-f^@y<3$&%S+Z_7ro^EuGTleauYLI<MJOFMoJ=&C6ph
zTN7s8I%soN+#u}1SxLcyw#$7!_jDhe;XgC=;r=O8BM+UQpd(tc%J6JD%RY_1rBlRT
z&Yr{d=+h1#)}P8dcHOsReap9M-tvoTAD{ZP?@YXwwa}@svF&xFyD#?-%cS&2^SS~~
zG>4R*n()|WZBBsEl#ZqI_p`;aZOdSs(DP#Pmqm6?)AxEGSa~?JoS{qX%)up#j!P`M
z7x5+JoU(5CtHg8mUvC;tUwLox`w2Uy<(=IU82n#Caq+9`hp#SMtW{ESs_WgGyjM=M
zRv&+;P(An0i;brk?wk@bKi$#5|FUll_g70p2ieUVzgr3=?q0K?FHCf)P-r>3M&O(>
z)1&XoRysBqWF6o*v&M0A*zVA?l6U+swS=rLGS$~LJSnsK-kt(oIce2=(J<B3=6e^d
z`Ets<nDO`45T-&F_0_@q5}m*7xzf8h<j(fOh)V&LT+WQ==kZQToFw3V{`|LtAqS^3
zPhF_$TO<B}vt&Y-)-GPrBHM_MGuaq-TTCqTejE|Wo))vUY_hMwjxs@&Sd)&xsqBqQ
ztM632j1XF%P?edX;C08<XCu4S(<<-aKPQ$xish|PI20{D`O2lq4M!#yuQd)WS8hFO
z^KrxUH?P*7sGMgUb=ZH`w{ICwvhpq*P2&rml7Dv92an*D%hq`LDSCe0wM)C=a1g(y
zZ2<eXi|rR5{QdIf>(3J_BXvHid)=|<e0L=2`wl_X_afoW*B%sK^77YrGx~e8snI^l
z?)jdTYgbPfJ2fpNqrL9Sm9mgW9se@luzr`?7i#6SaOFbPClQCsA}%?4x(ChPCsg<C
zg|@`^%q8lPTl-y=jiO9N47U0^AG~p4I;VS?RZ#9?uatatQ^U9GWp*rF`S1dF#|`lb
zO@-~Vn0|h<$Yne&dry-2W@1*kPg<yt&5g@WOOh8Pxf(k@R$S=fwz|2abIrGnD;$rp
zg|C@W`C`WMZj%)4g^wQX(_T2SeYWY@_P0WRa`=5NY+YLHcH;-fquZ}8_d2UtI%b`@
z$ot`+v5(Ptv)zC1`@~9~T{AUKjr}IG)XYhFZ<4y=z8S9ksXZ&=X4JgJb8Y;&Z{9a6
zOWVoiS3K`@f^GgH{zV0vVY6H0?%GE0ve$i{6qz%1NwDgU{|i0z?#(E*be>t}^*#K_
z+?w~_uJc)aU;cB+)cW&fSA+%EF@@%QDowamaLre}>%G`no`CbW<hOrSFUb4%BJTY3
zM~r(zxuhfBHtw(da_mC!p$B&=PffOdH^rUfd)klH{8P6UxO#f%zddzd-sH_YsecPx
zALxo!751#xcv;&L5_RWf>CC^Ztt;j3b3WEta_@b(Q^@(NO=Z2|+c-ij6;^(XKKop0
z$*GUddrZ$SS|{~*wVy+#Y2NnPCRy!aJsjI!ZZ&Di->}$vo{E9-j#t|kwz^K_v^l>w
zzwN{2KV>U4f~z!EO_5?(s^6rt?l+U#1c7I>g_nOy5&YKZ^Xp;I!YlE2XXfjFS-SLd
zMRz{a_P&~vJU6p6PRE<Pp7eA#ziq;+k5$gw>~!-g@4Y*D^Uv|*AoJhnW-SUmF1r0?
zjcM%ssxx8sMRS*}%wp4ac4eDx&v+%oep<!l^QpVE=KucEJTq_JvD%+K3Ds-W|LYuo
zw7==lYK2+Vj&TAL=7=TaN2~9OIp&huy~8Q}tp0*TF0sQ7+fI2I<i63->TI~F(cfk6
ztDJPMfcMkpy}v`;uc*`uta-A#s%YVgDb^e32At0d=qy=PXr<yNT0HHpTt;!YZdAh(
zp7Yn8Pu=s7EW7BJ_$d0=D}mMij_dNLdoEqNUs1=p=WSOT=elVTCI{a9yZe0B|F*s6
zvsS(NQ;*t<*;*~RE`ytaVU;G14rgjbYI12wevw{5<=v?0{M#o)>%Om_v4(rXof9sz
zYBj=IxmdPcX4&1@yS4e<p|DOv%Pq^7S;U+>vFX*X{om&pFR^eA>YBUccYu<3=N!vo
zz56?Ze!qG1<;C^p`Kel7x_tN27nvAMUo>x%xu}2sk%O;)T)k&!9ddQowCm<=d+WYF
zm%sV5H$lE7O!f4Uxf&r`8*0yR?7MOMboSN+&q?}cH;H*3da@{JYvLZAsSn*&1-*Z3
z`u)qNRjWd^wxq>uHr{>p&XuP0O?&dn=UwhC>yHfo!E<f?_U&00>w<P!+V|bQ+wBy)
z{kzzSBE|K$(w8s#$KZ4-$mhn&RW36#<{f@+9hjY9;(2w^Bhxz*tRhbu1#91(#I$dH
z_Pz_cD`n)=AKmNN^~Cj(&D;(Bt8Dg7zr}F+_}Rn3zj>xi*!=m&pY4|)KlyO?<3s=V
z_Wx>k9e=P$SSv3t#_!?lxbG%?u9fQ9p_A^-Ha&h<w>&leh1;XU(yVUf;@@1Q40^IV
z??=5zO}xSLGd`?!$AqOb4@{rT_4af(ckZj75033oo}jd4QuM~Mj02N8|Eu;TFSvB4
zK6-V1_a~nj-1)qM^WMK*%E~SxTlZl5qaSfgyccJ!K3mJAZOdok&3N4BDT7g>_~b>&
z-=6uM^w}(3*Z#n$EA!y%FKtg(rCl;<5mVUGGI{321tDtQN{fFkDrJkjw{nVs++{H<
zQ%~`Nb5nJe^WD>vx%=gd&HUz|T~ieuJOn1VTv6|`xa&4m<a3JGHKpJSpC|eR9?d`X
z^@yq2q^gQ75+_{v`1HIpC#hUnbVB`1<Kro;d_v8==DurH9T%TGWMuMnBge5Rtb#j&
zRyBOS_sOaI#4JI58?Cq#MwuFiCOw<H|H#+gnWty%Kl6}fn&tgJscV0#oeQ@S`xasJ
z;%8XrhOX<cH=K9TzH#QC_|Gqu8y{sGFt680$eP@_%WeOP>9&5Wr2g>q1$kf2TE5@m
z$tOEUkL)c^&kIy?aBTRKbT9bQ-j$Vy&DXC#el6e3VacZu#*Y&cuFPaxAJxFHbUU|G
zo&AiqePZg&tKIBEd+vYix~^)G_QLj{w!`zhhYWSTcDyqd$A+&u;ne@}N0da6zl7^#
zMZ=ZbbB+ox;^ba8O}es8J66)Iv$?G<{!~<o;}hF&rPj(<-(AtUCAl<1@kN5JpQy|M
z-u}>36BkEEqx&C|G=&aSNJLDw4k+BwSfQZs$y?Vuw_;}32HUJdTnz48Wb+Sr?=EYQ
z=AZ6-@pnLqK4aa%gBKsRo7>B(FW)b-zxIE2(XVHJ?!I|w=&(JuK$xwb_ffrOWLvZF
zqKtb-R~Ej%BfG)vuz>ZC+iKR9iDoZc-zTWNFI9TKdGe-+-6xN#DV|Z@xn}FaD@<F1
zj-4p`vf$)4-(3qAycJ+kG!)wHC~)On#D&wH8|P2b`_)*mZ*_{~=QBPry6X?yY$%El
zot(g5d#PW-RO4()#NNb=6IVCAv2H$U^}6Wlvy~bt=jN&N%5}2yHea1?EN{)j?a=1G
z{o{h?n>`oRnRaWeN!`3W>`sto^HbX^%VQPvk858~T%uaIcg{6y`9sPRS=qT}8T_$S
zQiwgrczfD>&d06`!#t~nGna3@RCP_C<<@FnT_gW1xzaq2KfYWG;%OIhXI9#4;<}~H
z{oz!t1)+LJ&4hgKNZj>4*0MkGgP3DJqtVw%Cnnsy`|{N8PYN|3Tq=5+7Opwp@-&CV
z$bWg~n;xOBKV&ZKZpu5q-}=j@{6!@vCMSOQsM66^bu0ZsMuN1%iDU`yg{()JnD0*c
z#atPCs)ko_rt~(UgR(AfnSNjS%3&z|Uh&<{vZhDB)&6b$do=uJX7vTW`Hf9$#iT=2
zDtMK@#=XB-9DLqb^7W=YuRojZFZaE!;B3C~&gqN6=9NJLxv>*+MEaK6v4qLVoIEyd
z6RSk^jU2s&<~4!#dH#j7e=m#s?Y^X&N94UL(~1S+GBZDlg$bugH{~@6K6*Ai!dZ69
z)mJvVDokr_zn3+w2+f)48LD=pTe8};L}figxooFxLk5rcqY&NhHG6n?R!^T0?6bi-
zj5Sv9_$(zpi9WYK1wO%#>_n#~<{x}-ujTwl=6dPvcm2hG`PVGDBJ@05`{IsR|F)pD
z4WCaRcowi?%Yve`_Yanx+9YnxQZ>uKnx&DgR?$={(}$;)cbe?=Dz&xe@-0~AXF0nj
zS8OWl*#6;~JEPZ~-W|UZ@_#n0ve}`de|qwyTCJyl9Tgj;_qJWw(O{gv;8%maR(lJh
z>WLud9lM)?%-5=#D4F>={dQ01EGn!E?Xb9!XKGQrTgaUMlI!K3=Dj&{cwZ~1?ElIC
z_qTJ&%KiCw80=cbr$^e<OR_#OoA~-W@5;5N$;JC(#p17LMYgWD=92sTQ}0Zp;DHX|
zO-f6eMW-B2v5~QL?9_j!JyGhyeX$#?xrezYc0XH^k=^?!#QX8I<;<;#Ypw`*USK%M
zRI{&h+PRd(S8Z-@8gBjQe|q!8lBCyFT$}d^89uNu?pfO<H?z#*eoWEh!;|l}Z0C(}
zdv7hg{_KTKfwvN}n%JhgPD>HmQsm`pEV6rE)2yFS=DW6>JTbeoOy~IqS@&R*Uo5*@
zKiE!tkslzi=*N#cg448A(<|FqoNK@KNWO`8{$u2D@|x$#Bk#(Vbno=jTKd%1&P7ex
z-`6#f_v(rd^^5gxi~7&Cn2>ALaB&GIr(k43n}$}aY`Wo7U!I-{H@2Gd5AOZGocxRH
zPyW7Tt8>_5TBNrrKdNZsTHyHk<VDWi7JuLVxqI^XllJ{*mg}qzbzPMB{=zw}xzFy-
zyZ+@j%VGZc=g!>}HTxToUv$}bMy3J7#JP``%nIEk#5Z@f)6(rCTwCI}WG|nIF3@c~
z_F>bp-kG;pUQT7{v(Q-m$kbd<@%N|JS0P7&jWv&7F4+^=mbUF*#!r6t7}@n#d7os=
zO6C*xN?g7!qvb|W=f{*iwm}=sEV<_Qh5tIdjB&m1%r@zTH;-tki_A#<s?)#}cU7q)
zsb^6r$I7+$Id_~{+Is0k<nus_MXI^2FXRrLiJ59Kk6ol9chB0tQTg-#HbvztIIL>C
z;`v|M#DPg*e@m^6Xi4<%%Fgvdzj=(d%s1v)=hwmfVMg|BwL&58X^l2N{e3z<exF`A
z+2HKn&PAsU_EeO9P=0dabVe7qUib&WX@6ISA9spYF`jrKThMBG>LGdG$6qZqR1}(-
z*#iy>KWvbm&)msY{`Ok#0txF)%TG(Z($X;d@XX`jliN?1+7^~v4b$DGbZpTXlU+I?
zg@TJp9NN^9AD8T#viajYY5nzQ6#v<<znV0?g(L3Egm+RqN;SXl+!*?*Lw?<kFLPF$
zjQX<Xb)uT@%1wd=CWe3IQ<iN0ym+$z^ZPpLTXk|iUtZq+dhWui7n9=!7ac$JSt4a#
zo5X&PZ3#bXHIK@(Ok1}t>dvA4iu<&*d*?0GY%n-iCRFMjzgXX0qQjS=`P+p<s~b;Q
z^m(lGoM*~><0I#jcat(By;>ynCk3t1C^kJD^Nsbvn&4CM$2Q)3HuJ5}hs5TN^Q>jj
zpUtHWWNP!Ande(AJyv+=*IC8~u6nB;^*46^&to`u?9utM=?@R{IoP<}(6!5ns9X|N
z@T$X8*(=6HD5qZW;0?y#?;P#w#4Bt~dQ+<3-p&yB?T#^j{Z(Sgyx9DxThqHA$G+Sa
zIH`Ee^~G=OYUeb|rfk3Pnr+&KPti)Lmlvl8J&sxW*Y@}a(Pt8~cKH=W9JwtP^75N%
zagY7NLgB*8k+;ORKh`g~+g!tD-^^3ALUz@W?D>0_nlCqDUS`O*_y4RMwVe(tD*I1y
zTL+~6+~l)2eAyQEB{!@ZxBbbxc6+|w);ZgX8}BMG)fGtd-u5z6vcJ2l!L+#jTb}Nh
zkn4d3_ZluUNS_pB5D>ilZ{NZ7*0(yH+?R14lT|!$m(Oa)p4)eL|Ge>e*y-}e(#8E8
zZ>DrmAG>X1in;gqmEY=R7S1nh*u7Ty_MWvKLBA#jyPy00_OgZJcXQAGtf(#Y`cmmF
zr+66{nvF0g!ol+lX_+~xi3OQ@1(j!|vhyGB__({Cb)%-j&gU8O^KUU&DopoXxASza
z*z7Gg4waT}ak+Wt#H3a3Lgf?x-<zqZ87TBNr8s;GTbXjF@!^MiET1s${`ceG=Z8ys
zT*5jJcSodb^;x3Pf5Y?O;;j}n;(KPwY`DDV#<ZfX>u&Bg&;NfW?^@GerByb`8+Qn2
z#^o^dUv0`)o4n+Vxem|dWqDqLZ9aKjd)7#v-?Zo1)-#*E4zmRAyUD=GTkwl}zi2xD
zL=AzAW%uecQl#de4teqYvW@qXRhpd_T#~Qdc1qJerd_sJlfCVQ+S%||(Fb3bYE4gj
zpu9)wkAA58YLUq&zn)#*-T&}>dj0;i<2mnKrDxojZMa^<b=T2$)&9KKliU}5|CD^P
z+q7<{a4PGY%I=dYUX`Jm*9t||<@Nj2c<MHKIJg;2E|vH-)nl?`^rN7|5lt^9?p(=q
zM81#xt-*&YcHbQ<6c4MeZ)uZSus1Dk!L+7+2Jia!_o`}@mi`D=UUh5P#l_qf3;}tZ
z)?TU_{|cIy87yKxbj#h<b92ATpVrWOQzowHyWv})xw`7!_7+yH)Q5+<a~?}9_|9|O
zb&<wreWg{-Yi$}nu${SkN{7!oB8$u5VVgL^=dG*<=Zinxc;mqSE7n04i3d+}Szf-M
z&RkKlQBkK(`cUo`#!%-6WeW~h%-N#0O{nz7WX+qmrpVUqciuMl;#8(T=EW<Hy6)Al
z{H{{V`)2kE|F!n_9enSGgvRd5<TJ1;5@irwxb1u2g?1ZZck5cE8+Q)<xATza*>AN^
zQ<}r~5o4I-v+ZB3=59IhL?c=I;*)^spYL(}+gFv5Zjd55Sv0thA>r`;C#p7ko8L>%
zy!d(c@#8n`qEa&UGtWIIP%cotyZ=T~#*(#D4zYC13P?PzAe`T%zgOb2BJ201Yg{9`
z+i$tgP{=cLeJXsQhw=V`6_3k<F9fj(wYn6(F)c0np`L$hrqitAl3Wgt-ESP!cs^ZM
z*uuK$ko`W<)hB=LSaU>S{?B{uGG{hv9azM=xF=-2slei`&UqhnZfh3LcsFCmhBH;7
zkDBBX7KqHS=RWYo`~CbcUk!ddw)gO<XK-RuKk2RJ$fJBMJJ714y>#1V7U?+m?07cG
z`yGsPjxLhn)$u-<ukL(P@kcRB>AA!}!_~zTyv3}KxOmlWXiaTd<g_?S#VJ{1rQ?6Q
zbGEDpn9Dd<sm(fKtN2cVS<qE1@l5u+%Lle3|7n<e=c$p}?t_<<^SVOZ_JrAlS^r#g
zhp}Fm@gei!jf!i2HYKgPb1hrpr_j80g%eC8gByPcwEe6(>i9K-`Gi)D+CQC>vKzi9
z-CPrK?}}^i_W8+wBo^uJ<nC;^RKLh;R%7<Jg5A>{^zYBNQYg1DT>Ftz-R#JQE6prI
z?Gsr(_g+#H+h@wS{*co8C(ZV6*Ur17ar3bM^>F!Pan3Sl_SSS-F8L%@%iQ+J&*7qm
z_RLUI_TFDb$C4zk28++=TI6!oGj$z<*xK!VT791U=Xs6uU+UCk9^H|sx#+at7Ga&K
z_n5C28?2YKnV)jIRhey8>X*;Px*RKe9&C8Bt!?)luhy1zyoDL-9L0<Mdn;oXZFqf;
zQHM8i>fM#X=4!b!0?c@Sc^tT}<sq4n)U$c%n%xXMbDHkxaB*oSh_49ScG6p6M$wIw
zHI-?J5|3n*M4lZvrL<A(Pu}SR+>w13uUJ$c_{Ze$!R)r{JdYPAcjRg#wNoO?U9K)M
zb(Jj13<wl{c#Z4k<Sp^t6<LA}J8ri6BwbsRnPeHq6tj#qqGuD=8I}+FEJaVtmRsIo
zF&B7oMCQA?@vWsie->&fuho)yqrn!i>!;iH00owNTiz?44m+;rvNS_H&U|5IQ_5m_
zL+j6~9-CJxzA%{BbVK)Yb?$>QgQR&43+hS)w;X;{v_Z4j=mkgfxk}v~b?2@uUAxFE
zTm9|JFwLu1{zRy^tTxK$nx2-vChn^Ls+jOkOFl~$?>o6Bj^|CH>ZX5T-rXsG0*~>(
zdhAi9dF`6&{`SO#E8A4oI6m**Cv*G2UEN!5I}a4(2^<&YeG#?keSf4@LVDs^+f;{X
zO#SXld(Kp?Ir}uphr2$a?!+3wb)9T1BGWhh3QS>ATJ2D6|2!dy&#X6NKXd2A{X7{f
zC0^<->lW0KT02`|)l*iMz`_nS@!fAq+V-3ixRAQURKM`)@7#hPHziBcrU~~pMNd)n
zI;2&7=En8oFAr?yQ}~u(=&;kqcV%*jp?pYagT9l+tLRy5+@d#bED(N{Dd5$(<G{oZ
z4FyW_K3AA0RCYHTEe~8j`Cr5jXE~FD*WVmenCNbk!B_Pp`9{)7AN7x|&YPJZW$*`>
zT&c@X&^f9-Rb4nT%yi1!pSmyNY(o-68+N45>@g4wiZWfPB~~sP{n^@3LA=}JSeAW*
z=G5t`_rtbm9q~;q<Gv{o^o2_}r><Ysq-Bd~%5j&DD|$;s_iD8t63G?5l+Nbj$ivFM
zcxQaGd+z79iYfo!{b&xEoqoXNic`;|OAQJVQri?R7A%NsFm>M}bhSt5hwYL%QB8&q
z4;640@;!CB_CZA0Qtc~O8K3F0?+e_;u8Uq;b!?ey^2!*iwp$;rw|TLIJzIBg<4dkN
zbEns|`rh8Vu;AU)O0J_4)^=@4@-si)*?9QTw4{S~yiIDSCpLz)9Z57*)n9tUno;-X
z_6zqH&9=?wy!Y_wb$5M+%0p^5-uu4jS(RKkbwlR9^QUj;&;0ynW^v!uGp93j-yiuO
zahdu2j-6HYuBt!RZ`5GPd!!Wbas8?84RvRa*seXa>Q*x&@2}h+WttaeDrp?rc*pFj
z=}(P-2ZcI@6JEZ$?&_RZ(9bt<#nV*oe$$-S8?-Z&8v-)BZC~Aa$gdK6y2X7}t$X3`
zg{O5QmN@m^;@;)v$kuyhgGBkwlFm<Y(+&j3<!!vW+W5A_v{!!8A<ymDHOlfC7Cdda
z*Xhq*aB0a)cJ@P|-{QiyTVK4kXIDVv!{EtEpA5cR7ML7y_d4PJx8yNH_{4vc(pR^w
zulmF59FvvMaQpK4`Ez-c&!vi&%wV70t-tfkAG1q7=~sdUnKpl!duBFQwwKk5sAZKU
z+?>hXYMl`&2dB)uV?0;8U+RogUd!bT_tVvUoVLZhkWDH0_Vdk`_2%mKG4pnY^3D6M
zEOsj8BJ<&zH@`~)p9PeMEAd@4xxMHvo8#sFFx%VLd%bK=_8F8M@Y@h+y7+3-?8{2&
zTDq%sco-M2l+sez)iQ@mWJ<HtviKFc(p|MXPPUyjxY8UEwYfTSz2fJhJ5$*Ya#XtC
zGhH40yE`;LclmjqZL&X?A5#Cf=;}L%7W)+sg=S7<JYOmj6hCEgS>lO;><8sX6_i#@
zH!+IJU7xpPOR<k}<az$sW$qo{rakYl^1JnML0U_Hz?p}8R{Y^|lGWgUtt+afnYm--
zEZIjl7VYi~ogDD=`LxWxq1_ohzbvi=wQ*YWo(*$f>$<lr&gjOZ^%=L{u6QBbeW%Yi
zHCyCH=9jOpXG~$We(x#SZ=adHQ~qd&z(MPIb1c-7&%I69q#%6#iOlWpCHiarKT7%-
z@$P5#+rqEAb<1Te_gkAiGrZ*(xP9hU*NwMqQ!FpfJGo*#V>Ay}^DXf!+Y^75%uRmQ
z@TueBv}wPl&wU*dp;stoKHGPG&#Kk$TrJlu+3<7X6W*4vxm~w<Sby(c#C~Vy8H-8Z
zT=pc33)@fl{lG=3S)=d6zTM1Q7O&{l{L;(v-(_{0`}$|Be<ia!Go(IT&pEY!sebaw
zLYLGVg*U{lzDd08dvdA&%$6In3%7J{3)7KlKNr~kq?6%8bmX$jKbKp)bAPjZ#<g7C
z!!uVeUaBwi<HPr(y1H)`HDo7WZh5KK`D*!*Wl!2axw=$@cE@b|yGDA>y51X>^KM>9
zWDp6RmC-kKs@0Pqb-`U%nE2mZuU&ZcL|*j^<_S;daeFN}SM)lgu{HPixn&Qs9-Ot^
z?6c;kc(Fji_mgX6_U(`4iArtan?BQDAw6~G;S~FBU0cgL+aH9QYE^%K!||1kyJ6nO
zgHrjQtT=6wXJ0>cf^kjM%JVB88Sa~wuwKjR)mbJ*`-}4Io81L%`q*Puy*2QtY}<QO
z=2@A`f&5^he;$F0`=i3IwTKwDy?wTFcVg~^-Hx{|q;y&yH%YC3&vQjl-=XqW+O2J0
z;$~kId^&R$Ylha(+kM*)-dh-Q_{E;)Evjj)n-`uayLVIR%g43)_kB`1Za%;C_UxkR
z@;;~6WW1U#<H6sjd)NKa<$azW&gps2WRDc6BzSn0^T#(|khe*1*nckA`|SPfrW;F{
z=3cV8x&8XDKTUi&OIIdlY*`z>rm?W_@g<Ras?|FuZTQ*#v3d>LlvOX5WHGQOv08TS
z{3L#Loz35;Po8i7@Ob&^`RDxd5AB~@yKCQ$Uk@_k-|cwDdE{NiEspbXD@)HW+aC}y
z$M3<1E4$^=VwoHtNY0(kb7!q?PU`+Os`Dj^eTo=<w0{2ApW46bzfDSm-l8unlMa`P
z9GJK|dgENf3C_|_Q*_O)ekhv}r^PTk`NF$(U;18!-Z{^BXD8E)b?^DCVwn0$`Tbg-
zo(uA@?^_-6KfJ0a_G?w=KE4|-qg=MXExf*(H~!>{(DGWB@0Tp!p15$3?Zu|B<uPx2
z%_kY2Gbz#HU+<Z?CByde-U|yflcpR!x4Z0Ab#zwuL(YfWXG#aYj-24UEydG+)|rmr
zRHGl9hdcL`{|~9`JKnsI?@sgVck830wjI29*S%TfLhQqfUUSVAh51=e#MS0*l#kzN
z(Js)h(mA1)GpL&XZrS16byM%3<?`RSE7p9MgSo6*#`f4<#qkWYBz2EfYV)O7mS(-M
zN9_Vy%nvAtXJ=qoF3!Lp%fP^pn_8TomsFaWlcJvt?gFN#=A{-TLS|{sM#SeovJj|$
z9vpFfD${n8tnY7c<f(c&^UJo%UDzG1D6+G&@eSK-Zy)YezwYKA^Xu?s+8uS*^Ex}%
zw=?<ws%#z`8`bUj`+AQ&YtQmGd&G_O7FQmbB$l~8b3@8=`8(aWBwu!X)$0`V_Oy$M
z`RAnO?e;EG%YyT!are<G)*2V1U8}A>>x>Y*KR^G8TH-$cMOUL#CIy^pU1B6;b2cN!
z{C>1zh>Y#jYsni=Tw~f8)wm-^IpX5_GyOsKDgLuvb)%>5E<GaNvMeQNwQI3aq56Dz
zoBf|xU;nw*d`I?Gjz5_eGcPo(&78DJ<@lRB%+FY^%U`K7j$U}O>132{O7S9zKdg^+
z76z%<-Cid=ZCOTeY~%BK&f3h0A!@$ap`5vb&jThUPyU<ppND07j&|+N3AzTEJKW?i
zRlJgTWoi7WlZPdpHM@CE{9>+KS;q^f=;R9DobA9PoYnOyZpo&q`4?IyitG`6@3G~9
zQljF_ZkNK9Pc=H8tn-}qh;@>Z;>rlaqmwu6HxG1M8(wN6`kZYFSH`Iz^YD<@g>E*p
z8dQF@9Bj-e3S236P=7*g7w3sN<>7o6n7G3eZ&<4&PMDD8%Pk<y>Bn5yCAcr{MJbPo
zhR<WG9bv8)%a-<ezFF_e<>T=9oU+`txyvr!c;75%c~W#|#?74zzZU4t`D@f29Ohf{
zQbCMk<~AdTjxCd{&a&=NpT2fxQ^1UBX$6**{C#oPk4C90|GY0TMZQ9OYKwxFtzzh_
zX-j<{?b)|?pQYZDvt3>r7DsN|b8*Fn*j2#~*9&h<>%23!<B8-?;m`fnLLo~GRbqBU
zzRudz6Lcb5&fwD_4~+>ap7Rx#{?xOdvaJ3<eC54`7N@J8?)z(~#?aG#b(!JbCn3My
zEq+`lD7aoaATKS6<vF{KoAc}xF29v;1rs#;v$@hkZZ*2r-3i-z@@k#;@)O2;XPnh~
zaQWp^pUx9P!Y?nRaXYl9SXtZDR0~hJ;ij4JStCuoX{qY7xNR!8_8sXyT)U97{r3X9
z|1T$AUOq!mlcRds$2PAYeC9KDxt=igRocosHTja<-Adv8w_jJU4QHs^U3O=_)YO9-
zPA!6K3m&ZDa5M;4H2A})z3WGW<dxm^5`Aj-*4~%o+qHN1@xba!(tOAIHeKV|mYdhN
zKUB0VT5Y~u>%4^z-o6pwyC5Kvl%1Jze|KrF@#FKoLA$KC-#hzw?j@PVQ!D3HI!un-
zt>gA@;`Q&hlHcFvuzcA0=yP(#vWK4!HGWunfA`1u#y@XoPqaMqTUgObO{qKJ@P_lJ
zM1B9{X9XQv7j`gUhy9xsHNX7#7AZW5t~+`1zx4Sx7rnDYSe?q<epw|dn&oc~R9OB>
zYu*mo9l0Cc`4lpGY1Ji3f6uz(YwmQUr^x932Z!zFe$Fd4miabUtn=k7%_S+f4{-;q
zeAMJH?TYk@f2$vx6f)cGdTXa*S|eGu`$zr)yS5)UcT4lQ&--Wll24v}`#EVx{sR~J
zE>HK+dwuR_o%a5G{oZX?GY_{d^|`j=NMUU|FZVyU<?jMkuPqc5-M+oiOeVDH<K6y-
z#z#}@PEF*>=9(9GJ;^Zjz}Mw>b97?Q=on<bKYWH|--b}buY0z*O2wq7=m^irG2nmc
zDA%K|{QmoKvu91OqIi!azpk%XY&dW6K6ANfr|xMNcQ%#WFw>gx&MmI`QE%VJSoz1N
zr>=bRtE7iJ)aGne=@j$JUrc_No{RhT&8x+Li~ZC?)~fm+>Ir2Z+BO8Mv~6VXo4fGD
z<HOFTnPpD83*Y`|eV1^|>+)Hz?ds<Jd+nw?V7zf5x7_B9)WYgcr|S=1@gAF8wm&~O
zkXN+Ob=~rHXN9M1)Yoaa*YoLuLx+mz^d#Z-1Jk$;U47x^=s4@a$4j4;O6GjdaNJ<)
zJ=<c_OpXruO{Q14jxn#8bj;A|%Dakh@)FgLbV?Ndsy;O`U41_GzO}uE)OEF*^osiX
z+rH0!_V32-_oZ#ME1rv;bw4h&wmo;n2g5BB7MfbWpSVfv((l#g^LkdFy7A3pdrtUT
zp0o@5zW<5a&Xrd!w1(+*qDf25oEo+%%|BQ8bjubvwijME$^ThkmvoTLZF@SK@a26g
z*VTnNu$hK1-<)`Sa?$GZiFP84y`CXk5}*84|Fp1!J+A90OMm^%70GKFSgIM9$eG+r
ze=^N;+8U*G{dXsGl)Id{`rYZc?a$Lfa~OBUOq}tt$|?TTUVR-u<yzGk>!)^~dn#<s
zsD|uZbL1n-;+NNp`g61#&z)4AmlOQMdU?db#K`q=p{q<1G?#rTU)gNe5-_LhdE=&b
z-ksAb!@tgHerK;1csp$K-(KnIVLy+Z{;p6{;FIuc@ozUTOSVg?&HU3f?cRuPuK6g&
z^yg-@$7}2RPMhYi920)*;TW=~G=e2kPPy^xwZK!gf1V%O*?Fz)ba$iu-S?93KAsV@
z_}*^%TET3})J4U%8Pf%8_glJtnpq`jaO6pUu1<BRO=;G@tv+^>0u^Q6Gfe(1)79fs
zwqk0>{EuDzOIREHo9@rP@pQu>#Y5$*B)BCT%nvHn=rMiQ(TtY}U#9rVVDZ_Ub2S`O
zw$`KVpPjYobl5R71_rw)n5W8vYi86_<=@u+Ex&zY;)D0Uv^PB7%Wkwx<M!maDyOpa
zHmRKdaBSKa70bz-;q4AC!A-7AF$`NyWPIHpANut>yThq@ci!$6-zVA4vTHRMtXjP~
z-evmp<MlUd=le$lZoV6MtV?bFvo*K+`NUs7>3h3Ra^I~=LD{L@rBm<UGrc%FeEolc
z*t;8FFt0wXbm~UBnYMWG3UO1Nx$hkwuHL<;Pi^y-w))eHJU=h$lUh+Y`PxsFS$f@`
zlc&2{ot|A9VlZu^PS&XvQDT8nYZmXxh}gP9;t%(RQ(SVh&X+NAg=(Z9o|_qZZn4Tt
zz1gWpC#jrz-n}Vnfm@)NrdiPY4@OrsLRO|ujNIy@cEj=Cz7YM0kCy9CHQC24IeS-U
z|HSv_9zO5;F^^e~CD3lgj6c`bh*uU$FD)%moh9#g>Zi;KRW6xYkM}oEW*rjic--)R
zpV#W>Ydni0qweTkj-Gbr@==9ZXC8(!=|A}26q*?v#woJq;aS<)chvvb+6n6VewOqW
z-+A?lbwyc)osjB{F5hVk#}BsIi==KypKL8*x%$G?8mkLa_0*p>os0_Qs`Xku>*j&=
zAAVZentPjFNp}6oC6V=QW~W|Yr;CW-*0xPAYQpaEEwU_9;OYOpE#|{Q@%~i9pTC%S
zs^c~+-YvAFPGD}R<m!mB&Mn73`hBuG*}X)|yCPtt<Oe~8t5ZDfe8o~@pPL)syuUER
z)5&h}eEW@Cua-<RTd7mXbHC6eh4Dc*>z_4Qe|-%LV>erF303`CWOX)t&9gm;fA%D2
zrtQ_wx0|{2v-D%}lJ4o#bM;q!+UE6q)xpW48%%so7ypY{%yGqV*N1m+9=(0><Hr+|
zomP8(Jba>MY5S+3Xk}Fne|^4s)A`WK^IeR!wcMM(Z#g6Jzm(<vy>q8d?ydXc*TMex
z$%a*zw*LHF*7@jI1ygfT^o{fPm{xDP(ol3W#6a`w`@pmseWPuc?Cm!^TW1nCU+=m3
z8Y73b&&{9q{D1fU&6_8eUu0E$J^j<O=*#1i7yTDsmjAXg=JgeOt?taa-D`sE{{B2;
zFC4Qvdz<fa`6Vh3M0=$UyPS{<tTCCdKU-wRi`qDIgLS@^n(1jjXO}QJPd>T7OZ?ua
z`)PrS5}ud5`!4pE{cunge0Cr|vV_6pXM{ulvC?4PfF}M$(h^e`JufyUwPY_(GGY$t
zz4eP%Agki!zv7c!oW^qT)dKJ21LTBy9@ktdV3{Mfu5h8%xoj1`Dd*AzuV^+Dl}>4r
zm~;4q&x4mz)0lN8y7E^Ri@$w$X~KbDlNdvbR3sdBrs(X-p5?lC|91CH*%4ve|J=SO
zJ6rdgL(7I;H-FCwvt+t${j1=|WzV9zZ*?VKygz+@cvQ2%r|8SWKO%OAcc<Ciwv>yN
z+gJO3+Ri)ea<Wr5OD>jd`n#(wu5aakLxzg4ug>m2%KZ3wetr7iKil80nSX!pruti@
z`-{15FR1%}?B7rJ&(B|n|Cr|C!^6Ev-D~k|85VPn$r^uolKLLbn!j=O)3>@4WGj+6
zb3$FdDy?52vy%IC&9sL}r(SWer4()d{O$3JzlOX|+7B129BVIWd~?n{V#4Ezj~y30
z{;OfPOrQC&rq|obf92C2zUDUjEqP4LtG6ptl7EqhQtabfB~>+_zCGsOW2D2zvm@-v
zqV-H~WI|*ZI`ZwF996ApWm418_$#?9&`F(>^~I|#Yo4hvB$%CzoW?x)%r$F&Yip-9
zc{k6WUVV7=#lTN>U%oy1@JRf~0=KK_OfhxAORq*P`tk7159NX>k?-_aPtH4YI>$2D
zcITguA09oi2sp!7{%QK;#r@$YmPE9z7CCX})8Cu7|Cbh(Y?WMl@#WQ%M|U4q<~H8A
z?%=AueG`?Y+xMP3nswQX{ZW7T;_r)B$0t45wf#MRe_fURu039T=j`V6-<uz!^8TKD
z-VD3l_J?cQ6`S>QSTD!au!hB&FVMTwbw4yT?9XeaFxP-->R(R(`lw*N{rl(anhoDS
zOaFTw{qOnqKm8f`@1O6#ARqg>=epJ7t>^N7%<uWX^J#t2zva*BrT(QK{lCW5)^zW8
zy>)#SK0k~m#%KLZU3u#7*YYoK*30~gcdrr4uG%L*_um#)-S5w0j^2u|J^p)D-T!~q
zugjy(uD$;zZBfBP;R=QQZ~ZUtn)&qT-k%wo9w+L>QWyTn*Vk7QJv>!&?#{gyRrMWA
z-~V2_`}1K_l;zKj&yM^qm@~8F(G}hRu83XIpKLW^a=yKtt$2p3^QX|X>fa}Gr`_h4
zbGV~(fx&3r)eToHCO9yEk~{F~naTDu#-GhsXy1HuO>c7A{DVsb&Tp6>F5bR;`ul`9
z+4*zkH+0z8O3jT?d#`uSZi}yfu@^JL!YAS{=ctPAPSw^3F<i;=eO1Mu{gX?+zi;1N
zU%T~p`|BP1CvVK0awT)3xk60uE!#io@~KJoxBklgFS^Su&+M~)ZsOiOFOPEeNZY**
zj=XSxg@ulN;#0A;0Xl{(l3}K%ubB4EDEYnP{A}Y{J?fuT`r<D6SFxwP-lX;8y=<P?
zeBIecH$8kMeWHwS@htVynGbGtbT>Ko->c_2?$I^<@AUs%PZn^w2yY1eq~=*=I@_1M
z=B&>qnK$Jjn|a=R_`6|e?u9jXwwo$1%sjean$zn9mVzS_wqISmIF&bRVnw0v>+_R&
zqfL3=Un%d+n3c-p?vV7~TWTqzU906f>(cYrOb<DIEvqqoqE%w0yiIwZ@|hOVnGP@I
zOzf`MT-+bFpn>y~)U(jZO;w#o4;<SXXxyQByD!d3nnOrc&~Xpn^oJD<OpME_Ci`FJ
zJf3#7-+{Ly>_ioZ+rBl{2N$qExmmF5SNf%$Yp3sGKP1R##rR9A>FxATzNlC$Z?B{;
zy1PDyI&8dQE2dnx;Z{@L{l&i`r}Q4SUf5~4&wX8^{4titm&GrvdZqSr&bd!L8y@eu
zbF$&chGU2IXJ-5kQ~!L;?^()}3)R`ns_%+kI`OJ>ou_7;@=6olAAba6x3Rukf6Z2S
zz1ghamuLDXIm>1FmI&{Xo5g12An}0NPx)T?-YAZyWWfj8Dk8f4sh@p*CI;PVJAK!U
z^OsKb-xu+GI)AH-1wNj6l%y%}Z)5U~K$&d2*$lg%NlG32A@fmk$LdEHq6B^((!KsR
zyFO~hJ-z&@2OlnQ^_f}6?{DAX@w~RaZNYgf{b^^a0yng~=zRE*zGuI6va3G(FW2?!
zZ+qq4R1930-)P9uvZzSP{#23w;p2Za`2rlmZ)zM~dzIOg^@Z2`-DwYQPw02Qouz!b
zI%sk6Cnd3CE}=~KlRSf>qSRNNtyuPE#nY0z3RY3q^p*BseYnl(dexK*j;HTlTc%*p
z;?SCR{e#l$Ail1mOM5!(%q-vboT!~7C95hlHzUmNl4S3Sola+kzQk~Q`Q7&HJnv%|
zzP9;Mivmxp{l4q+QgI*Vt$qEn&*0X%j(>B`O?$(#Hbwdq(~7HmPs~V))$H=@uF6-E
zR_B~nGv(;~Nh<d?t`wFy+q=bS;ZkYmUs5(|9ClluuWb|*X>^<Hu4CqteaG@d_+Gn5
zZJ#<0Y>Ye`qqM~^UgEA<RlwyMk!X!1-xu{Zx(jydFF7jKu`RGss&wT6UW4??+xeT9
zTll}bZC$eF#~%5kZJ(uEEI1yzR2jaJUDj~ZX$rH3gUgTWbvX=8*N^G%o^k0zV7%&{
zFUq@9Vtrde)lPM?zr8kFV|lN|>Ln4kT@+KFuKIp!*DI~1JZiBXwnaJDz8=zO+5hId
zN?y8gtcwlDv`5P}Y6~u0x70C^_lqfKe(E_Mqub}1OP6i_a!vRA{JmQeAEe3c-O#8r
z&D^+X%Bd=^rIYSW$=>aBOl-w9mC#=sQUjemAOD(XEFU#Zcjb}DU#nb8gjoB2J-l>Z
zS~D*5&nbp8D>cgwao+V_W)<3OcdvZLo|rJ<WxrM1ufE+sY0d5FK5B;&9gq4J#ca@A
zU0|*iVy~~ZIdvPW*H@|Uv$yN`_%!}{9p1Nqb<3WgM;s0?`De4p6fDd-WI1(8_p&lu
zuP%1yc}fQ#<o(s#7yCqm`QFkEUKwhYf^)-F7xhiDjy*SP1<Rb(HpxaT3a@-8?K;VJ
zF=gX}_y}W3t3Arvs*8dc#20%yO59rbDCdl9{emS+1z*m#(K}cpDYC#Zf0@>W`<cn^
z#nYs79?fPBTEo;kS90gwBa5~rt_^StU9lnbm#c}Ehx)Y8HQPIGsJrNdU%t9|Z_CPW
znI{x~uznCWxe$}n{-R(?!Ljw<*W1SQ8_vn-d#%%_DsSRBGwyD=*Zc>|F0}OTPBD+1
zl|S*Z^tLF5?B_{~?Pfj8nO3=Ex}aX_A?a30rXJ%tQ~B4t`uaU^_j5hnZE_0U6HBvQ
zSb0CUoy`tdaH!eKmVb+}i@n>rC987yb$)x^dB5PC&HC&f%>dpP?>-gg$iJ)dx@X<p
zy(f^nG?ahwi|iS~4Y4l50p>AB)OojD&DX68-uUI-(xa@qTW=oIdSyK0A)Drj*KMCA
z(*E7IROj5;X2fwX`9qhx_?rB_tOl)bTq}-UIWCjo@Zbb<D2q$+hV^k94Vem4Ip6<F
zoaSg>amDv+`K!z4RXKL$bl&OXV_)6YvF}9twxY#xh4shYeSG{%^P1j0nJJSsKg@ot
zQ^&WH>F>d9VY>vg<TbWssfw?Ee({03#0$wh!HZ6^jZ)07{W3EfxOjKY`h2WC<-Ww-
zkoAK6|E{^X?RC3$NPKl-T>QGm|Ie=1MKAmIA@yyfzy{yVdl}R@ZuWA^6<POleZ47D
zdx^p0_9orrG~JvV%v-G@o?f)eX;cv0^vY@#mlb<z%iPs(U!T~`oH}#m3Uk@%=4EG%
z)6Y)zvFdZ2&s57CyX+Ca-GTi9JYo}@?#=k8?WoUrFtBcKTy@^;bNgQL38b@Y7p;75
zC#pAh{tc@K7beOVy^(lUd{k_z!F=nU&-L|B?lrfZ`KZ#Ezr}sF&0F_=FV3o8aXWM!
zO1blezaQIuy?;G>{=5Z84%WXtxc~S3|Ih0s`M>|(`!N64v%Z&$*35PdWtx2D(23{2
zJum%t`MtRBd6__>MTU~j^IE|}Vfy(!@uz02l*rP1q{-UzwmNYG<8p@hBFDoFM^_#E
zDwcj-@a&1j)Ag0VXr^UOz1Y0w$loh-Zg0qH*;z8XIcjIbIgKqR!nuxrbTL|XzTu~_
znBdZu$b5$k9jlVc&Qr@byg0l5Z`m`3gNANxU9xQ=;@5sZS>GkRuk|tS+G*x@djGDJ
zj|qIPE4=35fnz^EY}1<FeQ)*#sX%>k30Y6W33E<Q)ZGzwIi*yeKioNX*~u#$9tv-x
zc-b8JU2i0<-zrk~sQ+kfpq<FY$E($kDE@l(@#|&t6HSY6FFLa0Mq)|mTHSNe1(&nT
z-?iBs{!z~={_DWvZyJ89`c9opiR4{8f5k`M2`oGzGZPNk?5pf*w{clFJ^76Ejl4n;
ze*3AF7lV(y{LVht!Q0>*|GHHTD;4bD&PrH4wQ>G}hZ^QtMXydARQ{9v?(zx#*^DzY
z*ldpNzWn*3AZxF$xKb6*yg4V-b?RPC_;N>sudM%;!8Rqe==>k2&v(DrG-tCK`(?*Z
zPQHiY-rw=~I$y`f=A8m-Ah$yhd;1a>hW4vGt9KmmSfAj!cTK=dzmxZ}7}>o`j=pk@
zOgXVx_|>E>yFN>upUiWAi}3l&*2kRWTEaa<azb7OUvJpvCbvz0uHA+Siykj}pxxA`
z;HoY?#oSihX2n#F=tUxJ6CYnZD_E$=nI^YQ^5;9>DSnrvty^BUPfIQ-c)(uuYldV_
zR>J3v&#noXPsyAqlb|j7`@E{g^;=obn&xnIoc&Ryu~_g-fZS=#%G)dghJTjm9ofkI
zHcD)pW^7@KmEWoz8N4aim!w&C=&-&$aQ)^lyJyqd{A;q<jw^(1@<@tMV=O*c;wJy0
z>sMgHi<s~&tDf%7T$^LGEc$NE^`<r74rI5e7O&DWVXplrlKt{VPncYV&T9?XYn!Bm
ztKYe6aW&n$H)Zpg$My_8Z+%az?qu;fCfB80nAzC)pybxs7`5cXKb<DuxioXiE3pNg
zy+6BO*ml^x3*PnkTUPViWujZoI2i6ZtG@1(IDeV82`9UuWOuZiGl%(H9&rX^{k@Hv
z8*?H~1TUU*&9T*|bs5VSC6lfx$9Kn0d(Bo*w<12#^WM50L2qrI6mH+vD6{dG-u#8x
z9L~RgI(eKH(=c>VTFY~9jpsej-G1AXR&-YwEqyNk=aswuPwnRirdQ?7`~7Nrq2G-K
zSI+Jic^m!De1W@thn9ww^X<mP_jXCkBqeUQHN2)R@qA0f_b_K`xAe2EcWyQ1>0C%K
zn(FFPa$GS&Ov=$t<jIOH;lHHKJg3*Zjg)RE$h)`UMf>E-le-VEp8UAubbXjl!4<)7
zp{$UJF^xT|rt`40*f5lESLo*#nBH65>G63^{oT{At4_Y!dwu=>>aW&||Mfp*mNS+p
zxc;fgE}r{lpl*85PA8UsbFO=D_@*~Ib=vd=g3pi1J?FOa@NR15EIQ!-z*EFFhnG$H
zQs>$aIicqj8bjVLYTshk$oM?#Y|j>h3Cb&YzMcHrZu->mGW&tUhnFS&QF$XfyIDx?
z?;P>SpBMa0F9fN7U*YGU{*+lz|L*U%ukY{w_wKg&{jxXBEfJ^m6j-L7j`%2$DgAxD
z?ca`VN>?}fe-)Eu*Sh2=`Tdp0(|s1V(thrKakGs>=8uMqdB?@6ThyQS{fpajtB`w5
z$&J3Z6;BU(`6(ybbogdP*e_)-x_oELk^WUz-~JJ9ls}ev`<@re0!?)pJwYw5h3$-4
zi;7b&Z<Wwn{qT=mx4r|5xUa7(`<$<nKh3+&6DD$Q<y6skS9%3_7|WS{3f%tsV?k5n
zmJL_BrwVE|?{W<@k~`{SD|zgp-Hi>4V{adMALMjPp-su>=#P&la)Jt;?3+G=pRqoW
zea?o@N!sroaCb=b7O<;WZ`<v`q&xH7zPgY$-CJunnnbGgq@2FoVEv|h2KzBte~q-5
zXUdDbJ~UfwU$sa`I#@QAu_8u<zwqSx)5WqipK78$zqM3ddRywZ=&~9K+wR_NIrmm=
z7S`IAtn2L>$-y3C_4+C6ydDSsHyj}hChv~Fd!*d2`huY;f#*eq<EL83G)BjzcC*qo
z?^MW^=Wa8&y!v^=@j{*xsu$iz?VIbso62gvAXKYQQFZx?$lSt@{<>1RFPHG!a+lnn
zv*6#i2>1EhvX8es+q&e-6W^BNXv5XteWyNa(x1Mq*hjmHgTdJ~a4L6y!&#|li>s;@
z`DH#f^Lgr8qBbpEZe-B7Y{%i&I7S!Nx@`&qdEBR*gBNz_=~+JbJHe@{%5ICp1c{sd
z0mrvlTbJo=?dmmEeYP*i%g@?oL&LE@Zxmy%Z~1hu^u0UtMb9aYN9zjOEhUycx0<zK
zTkFL+d|$d3c!xMI{V>V;&?njZ9G`7E(o__LZr0vd%ErEAP4wNn9o!vv9UK<5w`fk3
zZTQAAyZNTj-7^R393M;e>TQ&4s69Nv$~)ro65AIBuOHf5ZIaDpUB5oUrS0X7cd4~S
zlILX-cItgE_MUmb@WnROF86z_7mWLlypuitcJ&;7r#%~N4<|0~PJd>ps<Fi}$m>JZ
z1B0>?+m#QO9`^mPeWz)WcC}N-g$bKa?{~S(m9wOM)2{9AbFCi>{oVHb_}5vhH_7Im
z_q-~q)G7b;&BFzI10B{c`f$B9$8gC_r|7yzF1HVDo*gRhq^xUD`Zwd*^3rhMYu)9g
z!psf_`l}23&)hhiS=8(Q-C<`PyMGDe0;9hS$`*zVnQW^Tm#D36+%_ZPSX}eg$>(^U
zZnNUmpS102xJ=-gy{6$ISrZ!;txeo@V83nPjh-nF0);vS<#m+R4m=R&Sa2nH&CB^K
zWhO9B59OSszxIM<o`u^T4vsr5%eEMZa5Q#v=11pvtgSAMXP19<b@G?XCwQeNt@{$j
zA2|E=M0wtv(gF!5mRSqLI=p)?pSrL~?`W8BZYvYV;!q}&DclPflwzmwGwfayk?R(@
zD6gU8TA-zArn8*W{P}kbH;GsGF_r5D@oQ+^?2rl$4E+!rxJGvpv(+2po82#X;-)f`
zF=lJNdwM-^ecT35JJFL<(^4z_XMUQM5v#X!`h@3Ezhd@RZjEwRG7OFPQTx)wBBiy%
zakj3yS*V4^r?4Om$1mG6Bl*<3S&!}c-@BSCWBQ?#weLT>%6_}>y6ne<i<ka!UU9pb
zmTPWxnlU(wGulzQf^&w!1hp8?Q(iNUgq9p;a0+Id)#w>iG+lea_65)KrW**mR%C`=
zoHF6yaVE|Ank`>>|EI1qJ$w70ZfBOSGQ+P~%mSPBE`|xU^%a!1U32i#H|u?|<MEX0
zisd_B3Qm{*-I1SgKSsyeg4KTK=JR*%AK|>R>DG;X?Z(9-4J{n8DGN;01({M<=N(*o
z@g-lgaqGY2{S$7#*r6H}?Q-Z$`v$(14wE)4K4!n>_sf$vWe@tXcsdAa1WBmfdbocR
z|JQBD9eyiqyBe>$M4+=q<V{J|EdQ_D4lF72U&fR%i`VKw$!V*k+bi#?yl+ch;}_f2
zE_@^R?d{0T*E#db`O;q=O}>2U(ld+uJ9e%3x;=Hqk&`YqQ=Y8dp4-lQmeFVt>z&0-
zR+GfIa}^pimdb6hY+jO?Bf4z)+IMqvB@ca^&9d5azsLSsh32mzjn`&%erPWVUmjHJ
z9VjDO&a?T>%*NR^yX=@&8b6#pIU!?xp}9ZX5rO>^)P-0kZ@shlf!v43Y)YYBlHr1O
zjvxO7GtX6L+ot)V<xz3XcD|$kC!e};d-iheGuz4=YVMh*c{^+kN<2|$AgXpV$nDIe
z$}206UUT~6x%ji+s+wbq-^(q$njKZLNlrIyRg2FY1^x>*i&tAMn8MBSXYF6k+h4DD
ztFUikU;LoZB0y2qT)H$Qg4K5F=WXn(<sLa4?BB8Uz~U$TYYty<_ImiDqvXCJ`&r&a
z^FA!$u|M?sw3@Z>%}HmEyFdN2?1_HHVrKXBeQ|5vMg%*iuCSORAZ04GBRSaheMiZ3
zzK_}WjTY^>5_H;3na$+!PPKFFU&KE;r=&G7>RGL5*_s|U`Q27G_1dM1I>L>;Q(Tr6
zF6Y$c`q=9IU1oBZ!_8f)&pe#VFIj42G^$?bvpxIQ#iAzqm|rn-Z)wWZ&r2p=%ynP)
zWYha;1%Vv-kLQHCaI&&^zSwtX`qf`;ytW5*j+{O^?Mxxd($!+`CfwYlx#tC=n1I;A
z_lAqN&zt_$JM(qP#gr=Ml;<z`)azIBT{B7k%p=sub>B@e=>5mqJ7Nv$PVbi$zQ4$M
zqWYEe?ry07k+<(wm3Sz;c$s`SSBo!ts*!oCjE7dHqkzy{iAk!r8Wj@1^*VlNOz8af
z>yYDK`8D$93EPgW`#o3vPRH^WQ+myvo-L1SnlaO_c<)P@FW)|^Sw|H&Nk_LGExe!0
zaGd{idCw-TtBfbD6z_AL)Y!_Y{qX<Y2GMfEvW82~ckFgJ86-QQgsDl-<CtEiw1V|)
zM`?v>=`FG|&b+$NIW_1*^g{{5NZA6O)_P-=iK0o&Dhq#aZ;F0$ZO{8TJ0#rp-(6yQ
zeyPI8s2x`=_g-pTc1r4!C123f7Y;ru5e6)qtAE@!W;*n&n^VH!I5VG$-G>0?9UT+T
z{1(3TCim<=<HDXC?f(*0{KngE9l!D|H*LFtfb+IIw|2>w@2?$KSJm#YeYs$k)c@bg
z^A^^09qaeMet)%b$es6(Ww*;@*qmLG|0R0KO_}VL-hhPo!dtI$p1=5VzWu%X@ry?}
zUnnhTnNyRmvh2~_pxEu(UCxRW3s0;GWLq@j_X&^d@A(&nORf1byF6QW?%!{h+-A->
z;F$PrqvuYSW`#q~K1w=lnz!}i%&DoTcHVs$?qRO_MtdTE%BD3221Ywiaz{<&waQze
z_}I_cbc)fnNnboIj)ZJ%xTcxqpDefb(BxgLnsz1~e^X{xNuOTq_y5++rD?~sRL{L}
zc8y7~lFV4jt6-%wZ`ah2$o%Q599K?n3ie6=sWM@E<UQsOPr_!LzpP{|#1dKAv|`ol
zyXrH<IPRXTEX-b>V<g9RR;hAF*Ys)aE7nZ1a?@>yFxY#^UT^YLU(56~nJqpu3v~6*
z&-#35-Ph8a_a~e>^mf6m-}Td%ypS*W5MLu6{ODwiYTe$?zcZ$Hi0QQ7FZO@?ImN*v
z+t511LhNnY|JTa<KRkW$m{q4T{N(M6FCQM&Kl$;+qmv^2_vQ$Dx-w6?G;gNjJ=2+v
zN7FxU=2a>><1X5-)A_>a{h!0#=_M{FE1A!(Td+=dcT3}TKTqv|b!R?l+9#>1W~sR5
z+dY*leY5b*Ed#4PM`xe8#hE(o-nQRUnr8Xwzkau_CuHi6qs2$^ZGJ9fsz2MFczx>9
zvlT2cxiROD$$iV4vvPl&q>9Z(|Ge-XZEmaJ2@=95TaCE(>iLEpz7=Da_+*F0DGSf+
zI~UX!Y_WCsUU}i|0!iiuNlBrziAB%4BQ4y7luetA7QE(Jrt{v?R`c)##gIK085g^(
zkXWdpv+mE96*g^pKc^%xWvu^qtZLh<<ie(vsXdI|Z|d``UzYB7vWuTQ!EyV_G{em+
zwq_)jG|pH(@j}v(vw?rqG;V*?^|}(j^u>b%k4ze$>IOf~UbD_?_N@(xiitcPiadGw
zCzKwCU!QVWcFT`^zHW|=i)$vTYOHI@zE;$GE%W~VjS5Ut#J-+<o2M{;de^Oq99z>L
zR;T^4T{_{1VwPLfKZi|XQ{A@ciXJ^*&hugIsi<c&9)!0wN-XlQmy9Sr%yRNcYp&+8
z*bPq>9-8|_>(xaYv1B$?u65n#8E+kaces3iuKyV&^CLbPj?5z5jRDQyc@v&J?^(oa
zvd&vKdz!?DTSa#s9#7vP;Kux&>v-Q2wc=YlIUOHL6m8=_vR8WR@tO<sBwwuDoEjl1
z5mglT;SN_FS4V)2VBLhNDY6r-ejM1fwx>-?uGYeS_l`r|=g#%<t#?abzR{^8>y=`T
zyoh6Kz|z76jRyPXE;+<sx%oxi>U$yczE`Oi@f2t(3h{n8`Tgu;^)qjnSGnn(OK|-k
zXrm=FKS}+fa$Q_P&bKu?SD$+NR#xu%(#w%?hL*4LehF%Jyi^tWbot0675f0zwE-N8
z@7BK2eYGa}*a07hty?0v7aB1b9ti07_!*eV91_WK)OpU+xJTboqF%4vvb8VJ`0AAh
zS#M{(yQNVjdGzq^AGhLnuF<ugCtkEMhxdF*@3RLpALM>EELdzUa&K-}V&k1@r4K6&
zk1fc^wcvMIzC*_TAy4q6ONvLB|Idjx*f}?rJt40$Dev%77Tp&SsRjXSR!PhK)>vep
zaQA4ZtFm>^xh~0@vaSnyn7ugk=e5mnPY>&HpKwWM$KuwNbCS-5%CY!HIX3iL?Aa1#
z#<%~N)tto*;%4tP?<)BoEWcm-TkXhXkJ{65igE8*YZa>_W_@Z___k2=+y{<{e_pg)
zwt8{w+~VE)`!!peBpwI9Ub6cn=j{9*qXILnGG(U8>#W7*A8=ghaJRSc&nLZ24zV-(
z7#*AZ0_z(1?yde@d~Kum&xu-V)(CxK*dFK}_AC8I&%Zy$HEE|mNS>T}=i>E3XU`jj
zYYHdN=6+=+aF+31Q*sRZ%jySz&voT8pYQsX&wR#s>LF*3+<kkW#OSrjKRm|y%}aoJ
zL2m7DzYmAzu6>ke!M672`h7Zo+;RgisPCDrbE@R6n)h~Jc9ET`m-&v~i_bjlI{hU>
zYK2;K`Q2Wl+2(gD*ZqI@w#-WXzUYm_3oA_5Bs2HE`TM_j_y3~JB5x-NcKvW|J^3Vh
z`_1hq7fat_5lwG?uye;cyR!GzPbU;!x+wm9>8%ZlM=hrWr960AwP2Q(JWE{ek_FAv
zgw#2|&Pwm;h|b!nyX&Ru9<>|`vqp`M12qZa_p;`n<h%Iy<C{-h{)^_y&i{D$Ubo13
zd$TipjXH#5^X7ETZ`@t?<Kq<Fyuyi^OZhC`?`fXj{#^O}DMM%39Sn!vRZb^;EqZpZ
zw&bwr`Lo|w`JC!G`|y8cQ?c#y^y1!V!Jl(AZd?%D8y_|${-;$<slfE6QfBYjwYMj{
z*p-{Qr-Sd|U8${%JzKXqa<cDKDUxZAe;wU?SLj--d~Em{5BoF4c@2WnUvo{@%3cqc
z{4jUhgvU2F=qbNXI;zL_)A23q2U*tnN35bwzv!r(+57YEzRN~i{`-09zU#lRFYWlc
zy^T)_Px5<RdU>Mc*mj!}M~)mRekK?(vp0{4<ydmA@MKxpcjkQWq|y&BVt%f%?@Ruy
z&o`~E{oh%}UoFh`v}R$+lHA~D+hryRWF#C_wBO*xe#_uQ=b!SD_tox9C$7!g_N>mV
zuQ_nWHig9@>m=@dQ~I-IVRoZOy3#&d#rDlB3l<(<AdqMISn<^5zb}+!wRz@rcD&kM
zWO@1t-<w{$7oFB|kFNDb#=7x%cE}lQNi*n;xBQy2>z>L&xecO|jY1c#mO0U^@$cV*
z+YevgKhz{;wd&!nGa^S6Q?0%(x^QVv+9u5_o{c4Ye<+_f?x}1S&3shnAmL%cn|a}~
zE|=!@$>F7|B=eVDkA1M!v~=!iox-Yl2Y*>;2iL7sGAZHN)8*}>zfA1gg!1n$l6r?8
z|NF4;l=LpA^uVX{8(($hNmcvUx^%XSeEQVrcGu;C?3zZonWsH>CLBK9pMPHeoPqn=
z`~I8x8AVd=Utzx2I8Rl`Qavqn=Y#g1owrwsu%8dO&Ad-};!pE?jC;Z#<X`;D{AcNz
zTT{Nc%>T~qBlhK6&><e)1>zcM3zl-<;%@yYbH?)@x9gF$Jd+<E_?x&<`%<fM&HuWR
zs>;$I|7wfs3P0t2ncjT7At-fO?)HZ)Ru9h!*nHtUsw=2<dzq!HyE0$WzKwn+x;<fY
zIKMK9?e==t@TktM@Ay>v=~M21Hl8P|V-UZBS4PxsrH1?b#H$BhrZ=iKJjyz{`k@MI
zunpTmF@B~`HU&Sp4b1)Oj&eo4QQI-uoT=bScSpe#cV{NQmD?PRIlgBcl+gZg{n?6-
zvit}AqW1B8{XFla*5sc~ALr$L`Sa%Qix<<MJU`rh`Ql6dlaF7$eDLP3_2Yo=A72QW
zPo2{=Juk^*;dMU8r?GlMHWyC5IyP^z_~}EDhEsT#eOzMeTNP(;#`KDusP5K~%Gu1%
z<z-(tPk571tT;K*QXnX7-@G-Kl~kJNHiqR&8!Qa2Fo@51Q6khFHQ~F3gwK9SiHJpc
z<|S`x-sp0su^m~P(9ObVSHK!A(R03SjW|aNi}C|`#oLR1-`sGt>Vea<4QG!&`WbP#
zs;4>m;L{0L1z!E!qIyGTeV|0@#YJ<T3O{g}w`bwAIgO65wbEpZw|)+bdKRh8&ldC|
z`&dO<)s0PlQv`dBM4voLy30LP^7#9Hp@_(&kPnZQt)0@n41=AH%}6>Y5~}YT_~lZ>
z(b6jn;;|o!?i`x@?%kSMI~8g_yjO8_-p>BZr_tcx9wCzlv(k+`#d+Nt3O|26Fk$W^
zl`7r1ojoDGY!j^l5+V+)+TX#VR`)V9>IWC!g^vxBixnzc=eL$^-FYA(xv8?MCfblK
z>-p2;ix*Fx{CM)?8GK7Zg-z7rJ_ehF@QLk+`}3~gi(Gfhp7|;}bfmN8cYHc`sf+Q=
zeujwho5y-{=J_p~wsJv6yzH|B=ND{wyiD=@&9nOR*SwVTEPQUg)?meKR<or)BVOEo
zcyL;e>)#6dh?F(=;_bH{j9#$r?&o9YZu+VIG4%3fd)@VB|CF<(dwxqzOQ;R*_~<3~
z_jZn!&*Sn;yT>cfObtwn5m^*`(M~8sdx7JQoub<_fBVH<jIcj_;B((|Hi1ckJu^(*
zEQCU;zP$KQBT`_Ik-RxtwN7v%>yhGbld84XgiYvKe<Nwzw$iTeI}BD_-5>W^CA334
zZ?6T{Iv>_l$7@OMYVw7)3%Aa6?n-!l#*{6___(F*_B?Z+H!YEJDarTEPcGMZ@k++|
z<Tek^w=C<uR>=15^o+e?JyZ3)_U38Z&1KIhE8YKo*m<?g^ttmC&hNcxcfoANylVc9
z?+d;>uyCz9Ru*?kc5d!%zo3#IFW8bF9^S`Rew%T<nZWHCpJrXt+17E=|1S5PRnM&x
zzvgaO8+Wz$T(Ek;<vG7pJec=QDx3Ls*P?>-J7@pSPMi6uBIvl;F?;p(J-UI{W8dv$
zxBvJkz<bjAzq``=PsC22cQcvs><w!^HNNjM>^hevQ-3H~ZF#>r^rV=^28Gkhw|u>2
zQQVUv5xeF()73p^oOiXR_DDyqdB_v#Fs1s4gl^i#zjZ$^zp!~&DXLewdeQAo4hbgB
z8$Ldst{NTPl+z!)MM7$|MKp^o!^NjBHeFu!$h5#^ismgzv4dZ86Q20b4AnV%E#vGJ
z1CD2^O5s}Wayys0EK;f5-^u^C@#4%rhkHHZ$0n_tmbdTg0%;b`^h>>;w6@KAEu6b+
z@{6r{39*@CWj)C{9-n4?W@78@_gn9$cTZMs?h(OuvndO?9PhZythrY<J;h+wgw1P9
z(mpM${j%!V4IYgqA<qA5$7a|#{bsxN>fBm~#C>`4-k+miZ8~&-Gh~73HSP7joU4xo
zA5eLdl)C8Pwlinkzx5h#I`?kI{e7F6A~I$~r`tB{{kvz=mVo@vXAb_1-X;ImT+Nd0
zVm{Li%by*88%i2XJF0Ha-S>u_O<7>ktW=Jxk>?D=g!TRI^xs=nYB%vw$dj9au4mUY
zY_q@l=Grv(`X7~_l}xhgn*J=TcDVR{)?0t6mO?3sJt@z<4K{Kv`j{FaAt>A&u*6Y9
z@y~}3F0y&|E7g}+TOHis>b|}x>B<W+hp(4TD=v?V{QPKA<A&2L?>kmcd;8{4n9oD;
z0GkPVH-Ff@xV37__w;w4yp*aAKJc%LzVWfIqHns1*e%m}Q=dN4{*c>$=uQ1uof}NM
zEH^s-GB00sc}nR1N3q9ubgY+}k-)cZg1Y85pDO!XXRp})UYp-~xB1<f-CMpbTAH@z
z#mpa<RO>#?^u1>Hbc?b7{)<yBPt8$cUVh?&&b~y>qvj`+FP>WJc=cRMeq-5M$NYM0
zZT0WVKOEh(cU!>G`I$wWvrlc>F7R>Lo_0C&N;gjKi%TA{KS(;o%pCFf**Tl|z#X|~
zHqVMnoSP8wcxp@9NrS_xRvmFC|6k}@;wIDc>Z^>~3iq|AWxA$+IioiD;+nd<kN<XB
z{;Cx>DP8N%HIH%5ylu?k>sbp{)Hx_DFkdro33u6n^^F^)Pj6mwz{@Xt@tUow|4wBe
zZH(4=ZoXzxLg*>!s#{!9`^^q?FR{7Na+^)$%<}A;9cfHKX)7HgKF_>AN7m5ys^*1d
ze>JvRs@;ovc6d?8<FyT2^EU4=FXBEig=@d)r|1gqO{-HIwlVZGU*)<hb9wE8iw0Yo
zyjN?*+B46RIbGHfVxUm3H;wh4t7qf6y%F=8mA@{Y<JMFwH-FK+$HDP$)gERy&Yk&h
z#Z+lcli8`ZPfpdgu9^Ndv&H_l`t%y_1h$|vN0RTno%F{~;P<bmrEeY`@;sf^Gl`{r
z`7y<59|Z-i{o0idZ#d}n&(C)M*1+D$IqORwq&9Z=t-WLQ^X$iy2B9;11KTItZrilm
zTj7tJ<L9c44344t)nb}Q<ASsqpT>Fg&sSLBVY6>*W?SX0kf{@AG0XkD6g6%C)TNm^
z_d1_NwI|p3uDq}P_STbVl^;j6&Nl`hP_S&1`(yQI=5?>2nui;Tqqgzv%>VK6k*$)Z
zPgmm(uBq+0t1aa$f>ksG)8;HOh*;iQY@unj)2-oB$duQQYwP3Jo69`2U2~6Pn)tNJ
z=NlT&r!jvMlQI$uye0E#UXH6q*ChSwNuiUS?B5)JXSeFaRObn~X7e^bTX*KdDg)I^
z|7GX>bIAQadGY`H=NSj<s&-7gYqFbfV*C8F_rGPirOE2-4o%vyE@GQ#ZKm(yNku!F
zwb#ThS^o9DR^bL~hc_)%NfGnxXZ$m=`qQ~v`XcWvk0;sYpRcUot?Ee*aCo8f>Iqxy
zvSo!&H!s)dP*-{qs#uiRwe_myx1J5z8w7K&A5*9bX^i@PaP3a@xt3RMZeDEZ_W4%v
z31Qx83oiMss=3(lMWcjCr=%kOTEX{eEpO*1JN*hfKFccT$I*x1qS<c*hpFAkVplTR
zzJTlArKzFkJteMBo3-xhu0z4=llrwvrmt1ZdvWOWTHED~o9FCOoq23?@ZV?RIc)iR
z?{L%z<v1?uo|1a^jK;6l!bw+Vo+)Jt7K;jee|*!muNH0V3j<`QT#mi+JkgG6T2k?B
z!5=$+rEHpa=En2_Ck+!9o>eM+7yaij%LRV5uKYP`jpUB>EeEYT`4-K{D}C^=U{~D(
zuPX&1X9df|KTg^`@kP?T&2zfu7+A>5ue_-KyzH6Y8eOjLf_9gAe~wj$eZT!Ka%u9O
zIsa;;c(+_EdF!uvPUTq&+k<<*`u~~i*>m;Gb1!wzxb3%QG3_uewhCI~`8yy)=0fhq
zJ5x5FRJ2{F)XKJTPWck+6G3{bt!A1$DeLf<;5IL8s*~yy!=wEZMPfVB{JtG<)qAp1
z%=5hY)X<f?Zu8%Ic>KhXw@=o8V&A{IYLVXI+XcGM!es&<D=#>?V<yM1JN9`28cz8O
zi`e{rR&NdHik|(iiuLQMN5>!Tb~t9)s<cw+*^*PgWo?Z&Km5P_?d-IB&rAL0mGUio
zF+;TSw$k4-dots1Rd#Q8Hra5bx`V6FVq-|6AisYh%Z?6i&BevqyRJ7sOh3$<)Ts39
zmqETy$*ze?1(gvNi#<ygtm0j}<u%*JsY0Jazbw1*FRt>pSAM?gl=xqDQ+yq^Mg9zK
z)9SBWu<6CrHv!k*%~>=}zSdx2ZA80fz{%qbo2;j$ZP+I<{mH{%uT81(`sanEEdwf|
z0t>5o!?wH**c5u_Mb;u|wq$?J{W1cR3cY3;^%Sw3WaVe<XkI?k;P$kN=wD|VlS-Mj
zPi|1Mp0Ogq;>iw8okg8829NUM>mn|{n=|<gPs7P2EqpvzgN<{AD+8r2BpBq((Yq<a
z8JxZ7tAU00Hp$|--!BGq9a^){CHBzDtG`{$or2$95RzeWvQcx5+i*mz*mbGuB7xif
zf9o2)>js>AQdoR-?}EAiv*wBWu-%*9y6x5MNq$#8y{HyDXWb?5BB;%|`ox(d!bPqp
zA2G%ntyx>Iqp{{fk7&=n$|;6o{`Yr8{<)KPQn@}w>2|Q8zM50#ykq@A0(K8`b;?TY
zmd)ds(tNzka?dH%06sbEr>hcnf4Gr3UAO7&Cf7H-jQY!cf|k#>DRWiXB3yn<(Yn(-
zW$%j`Q|3Z_wY{HDtPXdxQ)1*-Ra!D<)jD-iS)qFmKF|I8B#n3PVwp!0zRNH2wd|RA
zsO`goB{x;S+T755?Dcv2uf~0jE7vMosq9$4^@xLIVW)r6ldxlc9IInKM6F=Fc)r)R
zEPrL8)w_Ls-|p{zsdk0$<ra=QojGq-JBoPMc21J-7HZoa_Ik#3zby+-+fPy6@a$4-
zNrX;tiGW9v$9m6e*ZYoK{Mxa&HT>wFIPEvPAHFf~>uoBrIlJ=BBkgsY%=I<a?wxvk
z&-V1)(eAQq655!1)X!bKe$Hg-g{B<c+27PwIn<O_)tM|Z>1LGg6}Zc8vCl}iP{HG@
z%6+BuuAC2dzpsx>Xk6oKCup3rSMbXbrne;?OB}8q^nN|zgX7AdJ`a=q3M~^`19*J}
ziY*qfCGOrc)6x8F;{T~GE#~!lor~P~M69gbw@-66SGoToGjOTv+{I}bv+Qje*)*g0
zGI)bi9xRaDDblXbVKaU1lFzdio>^|Mn*Myo?e9f5PNquVbnL%(L*U~iO|y>ox;9~V
zKO8l9l~#7=UPRo4yvfHuS(nb7?)BWstYC&@2!9RNkIuD93wwCJ*wsx~`$S4^kA;k=
zsPw9U*lo>Oagpt_^%ux|7A`$-refXelXqK>+>KssdGHmp;90|I!44(oZiESUd|fX)
z<42IJ)r1hK74vvQ7RNbxcFXS!ny)aQeP-b^W1f?o@n4S>o%1OCdUnZ5{eww6|JE#!
z=6bXI)w@Mn`nNxAys#?OKyl?Yk-gU+zHIs+<F`^RZ~cjeBPEjezCKFZZ6@(lD=gv3
z4jv7*S^Gm`0yr;9{B`r)__}dpS&qugHzyn(3Vo5$c-Bz*=i=0`1*})g4QggqeG=LB
z{olqt56aigm1p8MdVg@wnP~@?&U?Jy_Wu9!*ZCdYs(oy)*=?*fx;&Xq|Jjk5t3B`D
zw5^9uX{F`f{#cw+VkG<a)L)OzeG+f?{`EM!T;lDnzaD{oWxu{Dn~Eo?EUjpWe;dHM
zlhJ0|)x)nB1ZLzNy)n<G+Wpw4CvD$TxBN~IvlDo#QFyy#t^Vvl&yR+y4u9j=S-Erl
zDUQvz0=3i_T+gvYs4TKJJDja{By7)z{|THA{kSZ)p9%A}@zB{5l{xKcjk0Wrbfam6
zM6VCO@}^0<RxP)QHr--*{Qfkf`*}uZ&dNIJ*?eqUvM$?aUyAp=rtO)@g7)9!exAC&
zIiqyy+If$?kM(b^+{kslZsXaEU2m9GZ(qEZ<o+mo!uI7C!oMEm4T#8<pSPguW6b<I
z_wcsF^ZPE!pAVIM6EZs>Y<p$t%HyA|@%Uf(b=|tms4Bxdq=7BcZxh?KQllL^#f@t|
zcL%1+ynlD<@R=2|1v{g4xs}}S+!DK@z46cdb9Qla>-YQ$mI(^ld;6%9dzkNpbi-qA
zz2VR9KE7tT@!M<D+Ju=GzMk!V9VPs_g?){j+w{}Ys_li%3)5yeh`(JtyHw==$Nu^f
zA?Ahr^Y7cK&e8bS8mzZ!-5--*J>nY_TvsTvKh-Y?3|hcZb<}Fs6E|@|^CywYySS$}
z+T51-qMz`6!JHpr8p_|&wmY~_c~f@!=f#S(RaH4BJ7%nY9dmZ0Y0>PxyS6IHb!dku
zeQbX1{K&oA=!wE-QLBsG87~jo8S2Q~30ttZ_F3NR;)e5gvhJqME?sS0pQdu{+u5wt
z3uh}IsdAVdzVc>K+^2XAt^KPe6^TB4v%LRvr}LyrL*2RE3!fV5X{&FQ{gko7WI<3^
z_C^m+UVom|qPxB;EfSfkF-;><{jRC;)$eA@F1`+5|Bqc``PnCWuQrNW*{j$n>Di0t
z#7){L^jr5}b+WYj59Rr*q>60*#+>=qW16@9OIIK3hU~@7!jJt9c6~I-zhUSke=H?2
zYws&5tJc2xr*BSMzUPah_rnK&Gp=2|_4aR_+xEL*P19{T?gg38;V28582mf0v{t<9
z`uc~q(bpxe{XyRXr`jeGb)ScU!BGRp=Jb;M{G8;B#7xjtT}z{?^B?aJ{BJ+M>8{9x
zn!+vpa$U|`@~<|}-CH7T-Lbd&ZW^=Wv==kP_xeqlv!iW)b-IU_lIqQy+ZeBD2Om~^
z{#W|a@{~I3f6srKe$G7e@@J^S<2h?3&gz{o`1;4x_Wy%D)|RS^Rqm#}DV#f*|GnKF
z<!)0|^C{|voG;qiJf#lWObXVwvW!gibcrbsed6jCJAH$O@1{8wg>#<7otrd6d)AfH
z*A=6uv26bky075Vna`Q8Qs<;Sy?wFwyNkF*o%S)&rOuCg=O5AjmLYI%euS0RqA9H=
z(E;<cv+O&SZfst}v-iiw4{|G|D>LW+5Ij>XpUL+>X;x+Bq@8i!PMmH%6&X0gX5O3?
z`kdtfU7xh$#Vxr{=l?WI{iyuWBGN<6L~qfgvn=zTX86T_dVa?Hv^k@z@&O_3O$B1{
z`ReapTtE5Z^3^Yok8(EJ@09=L^q1*dMu%-+vy`k>N2;d|PsrL>-j`GM1xc*0Sj9M3
z!)bMP*ltGkL_^uN!UYQ_3)_FOSZ{9pee#rB8rlANb^m@&zrFjWz1m_{Nr7(h(<a_^
z%j@zww?97lHpOb5k9+*bT!&z(X1zaaQw`!&JYTH074x3P7~8me<BX^4vWunGP0^k1
z;GpBIA10r(p)t^x*<c$}uzOG+cd){O_LX|>hI&#-Ur%mINPNJ?)5JP=yZ<Ggq=Vdd
zL^Iwptugn$cz^E)xp?~qpUW!CY>WPFu9$H9xcwbdDK3o%mu2))8_S<A_FV8*E@MkR
z@3*N6JG{OgRk_5<VDxvjXGAAo$koq@Ld6G89_T#8yS4gR&mNPUopom)t=+W5!)hvX
z4Aabz30FgA^`CrgFkf(A*{A7y3=NY$YH6DDY%7?e_p>(mI=}DPMx)Jh0@s~i=N>;h
zo_)UAU4J8~ik;#6Yp3#RB|kR3F{Syw>1^j|%kJ(L&<x7h);#$n*R<q&Mr*D%&J=aJ
zs(omVId8n6wJVo);O!}{XVzxCiCZ7{dP+~G-)4@v|0{hzn}+ZtCNT9c36Xvh(Rb5Q
z^H771=EDHFAgL>}8{X@kiVeBFR#!c2`XcUKlU8>7%%0@YW%_mggo)?MF2v59^YCl_
z;q{-pxKsYVpT)NF(p=y5`<-HWZ!y|sJkeTyZcXX6m-oIXX|LEPz2cU;Nl^3`(|yz9
zPGsg<oOot(diSGyiFdwEo1oAoW9%~Z@qFWDHqI#lJ}brNO6P81mSN14yK?wPV{Ms#
z$2^6^8=tu47ew_f({_Jz{%BU7cDuL%Q_6u=kJT9)8XH5Oto}TI&Ao>ur4#yj_B_5L
zFo$9Lfv=JwF7`T1qTaoGtM2#;pNlh?c50_2>jAOy&am4H%xs(%-;&^dF14ll{O30d
zujx-}c=&$p=Z`Paeq=t<OWXYV;`+m@S5{Y++Db+|Sra_*>od8Y4H=>u$67C*jfz@Z
zqc(lt%roi1-@oM**-H0GbHBc0H9gcy&?126pX}pFKLt}}sjPVDK5Jvd5{<ma?AQJo
zer|R8wW~<3W!r<7PSH$LQ?8bBOwy`cbldJ`MIxiqF_$L}1zjti?z8yG(<pK_cM8`t
z$@de*C+jp!w+x@Xf76NCvbXndw3_*S-_fvO<qv+}xt_k9YG2}^k+?QD@|t<_)XVRG
zW&0_n{HQeCEvdK8?Qr&qCVBPCC+`**N(yh;pzt$3%<#FxY-T;Rn75JvHJWJ(8#m|}
z+^7<n`64^uyupnJjCyRYJO{QroLl0Ob?E7dIj5Xd@3VHsE2xOxk;=JNIqy^V_I%c*
z2aGwm?rCkQ>U*<e^SQ+VH*A_F`3js$nV6DRkgQ#8vvbd^rfs(_Ud*=ioau4zPvv#B
z`}+;m8Ist)MYXauOMk68RLk!*MZE3F>`ODg_|>T}Nog!J7W0`^ozT$n`ycCtG%2V1
z8PWImG2YmIFUoe~A#YJ}{$Kx|nXE5x*8Y1%bZv5OXKYB_nt-N;;Ij3`oBTw>Ru*&}
ziJK}=^<Zk(!F5~pgPfMmklH5O`60Nd&Tn7HiZv;%yaqQPUf#EJmRYRM<ugUO{+ds-
ziY^_OUbU_;NjAi_&2&4LsAP(|Z`$%*CKll>Z8KNzGS9E_T7Pus#<Ph69krqrGK?A-
zhZUwzT$LfX*xG5)rneS6v(I!buVlA~I{Pr8HduOXaMo#|<xixzX5ZM>bof{qr~k_S
z=Qa%O+ou+^E7!Lt=Iv>7m7N*)ChM@(nhPiTr}D67?c#3dd&TEEFDWlly-hM&)byLu
ziyP*$hKskGy03n7>Xzd4zen>PKe;{S9s6$c`s&Aj=54rf&q8VPmv8H@d#&ZY^dZ<h
zX2tiwbCx{14$to1d(k5la$oBF0*A>{+1WX#)_v^>J*oYPCA%el?T7!(^{VAZ18!f|
zztM5=s@I%;Re?t<!~Xx6*8Hn=<%gv#y`R^AKKkU?T)up@+Ki7g_FucPlH;WDw!}CO
z3yYkWA0~X7Z}HKCgG=e8mxxT<l8TI_rFF~ShK86HX-R#3msXLjCBL=L%lt9ZuZ=p1
zjiruj7FNBPEuz@nEnZWvD<_pdKT<~Jyv+Uo%jBd*R`*;|71xeA^jQCM;bf%`MhVR<
z$v;E(o7<#_wMTEr?=yR_=t9+z^FrsIc6K_a-3YKZj??-&vr)|Pwx(u~O8>!PvyjIc
z&k8S2@jB1U7JcA+$j7a%tex*0wTm|G`2Ff$?YvvICf|(~-<v#<bG0zX3yz~D;TzcH
zOs4g3XyV>yk}=QCL}t^MBh{-@bG;i{ZXJ1XudG(&iO2jmldny<rYaNp=v$uItTWFy
zTkq^UcGRD{{Hd$XovaUwk3M}BKl$d;->GG$W%;Vyuhmyy>V3j;>*wqKcat0w9J_tj
z$m{+!NIQL3r%~dip8M16%`8(Fuh06JXBMq-@`^~Xgi`fU)$K32_a5lTOt0Lk_U*IB
zRpa0P^<0!UaZi{fs_80tlyQ&p93O-1b(4}#Wr$y4yWjV43ujEv=cQae5~l7>rYc2~
zpS~}BsmcF&*J|I^Q*6h0TMK+n2F_73SKRB-^0Z}J3B#fy4|9>S_#>fmYt&3aW?mGn
zKB%OnyZ83)(5?FECT0v-#jdMlLzuYPn+s*OMNd2McG_gV{Ozi#9?84sTvN8^KfyjR
zXO&ayN+m9Zqe13^%iovnoLjf`&fnkdeEV13iT12#yL3J;Z{hKs#p~PWFJBz5uGLk#
zd>YSvTa!zU&Z=KeiSysBVit3_esZTZ$L-xBv$fUDzNSgEvQ8*sPl%IWTlud2nqaAh
z{EmII>VmQ*_BdSiZ}`u5OESEGAtTkYK26|}n9rAmtj?>qnxzVKosB%M!`k7qDzU!O
z_K!t4=ck%CyFMSSc(SYcdzIFk7S+4#R(IoC9J|B4UJ1_f)URH%`IeBvHpaNqmQFSb
zqGxTF#Ju<rKZQ|g-^aCnUs%4hncd4eUNhr)G-t?NS1a%S;Ff@G8*Of|2keaaeE-cw
zp;zsy2AXem_)|C5#MjK5`>@_oBI$HPzhd;G`kCUZ)wd)}$~(Fs|1JNrpvM|NJ2IY6
zD?3xYrhDCoO*0QN9_e&WQwxl{8>IB^gVO=ggVQ)_<X=3?{KlA?*1YG8qO((z-a?1D
z8|S|e(^uG~vrN3Bf7RZV(gsIf%IMEIv-wtoUblPnJ<o~1k|y^!2(<Wra&6imrf_NT
zxob8i7xpZk#H`J6EM+?no2|=yi`BWIbHv|nSdzwb%h+wg9>0dAZy(9r{;|qG)>Jyw
zlU<?B)%8i*m;R<ylMVZQ-aQN7togJ1^S{{jfzywqZtNATXcaHD?vB{RsNMSF?Q6|v
z7bn-rYaVc8)!)hQ_4WFXb?xRY>$I=LRm&gJxxV$*8Y?}{4QCoI-F>pMFkNA(ZH02A
zWye)R=lvoETW*(17M$Q`%yGE-ebd{8o4HjA_Wu?V>*$X=QdV&JsKNSA{d3RnQF`n#
z_h44hgYzyY7JQv8_%^DL(>qT=!eHz7EwlgBT`k$NF5`-h-sF|<-8>y~cV^prb=4^3
z?O34Ja$c?>@xJ#_{)7s-3p&yrww9-k@07Z_c*DN1gBCe#!Ig^@Z+7@svR*#<AgAEN
zbDgqiyJ97gtIXd`ck6XubGNHr!``<vcHWQLNtNd{v{$&>O<!hM`pS9R=GVCy-y|}o
zaZ0$iPf$12+VQ1k-p?og%%9GkIjeNqt~!$E-Q|ht`nCd0{GSy(r+z>2Y^F~B)9YPp
zeeP*<`-g>QGTXP>rBDC)`xwhbeuZ+5T~V5R{?5~GS3J7WSRB=T!t;Q<rKRL?KN->b
z8qJr+|G#=Yn7@AQ6}=jz3miE{x<$rvvLCDUcHasJui1L;@rR11?eb4*3>V18C#))%
ze%r|R?K~M5Tk#ZSkp%m%Czq+~NgT<UyX(zvleE;`X;XHV#j7Qre0a{MAvR;(3c*`R
zj1kvG)uSsWXvE}%7vGsaW7A9*Z^y)Gii|0Wt;uh@is!%iw)fhZ-=Q~;WS-s`nqF+V
zTiW*+m*xKLXY`h3N`8Ia^NVXy`6qeQW4l~lG>5k+Ffb%F;W!+mq$n{twIH#mIJHQx
zpz^Bi-|*WWllFfO|1zQ4|JxA@#p><Vr(4em85qA2deCTWZ29;q*Xmx;l#|*g8`_`N
z?_c#QZ{_|RJEN2P9`8MQBdENzw6wIg{5Pw$_08X<j}0V0u6ZKOZg_rG%A5~L-EYq<
zy4aGx=jFb*>VsvUZ!YrCQx~oNT=n_<8vBQDnDsyR9Q`wE`Oh4#zY#|lzmzh0=Ravu
z@1+$j^`F;tO<I#8`ejGQsgxtfKIep}R*Eh4+?pWy+^|1#>gJ?*8#SUgsI0Cq)VBD;
zz2Os++^h3u3|yrrF2B3A<HT|up5vdh;yxIpoGh6pF8bxfC#^${r%W#{vp%&v*dg5P
z#$SQhkN4hooZm1pr|6_{oQr6WM)cW5i=HI@wRp0<!6{NG;^NZPv-~dq39_B7lz8ch
z)85_BSif;HvNoK!e(lNUEJN>2-eObN=<hnWC~MJI>&EquSSRwR#jFa?G~{>RVZ#*`
zSpSQs`MUCl+pm^&q!~P!@pboKfAzfu-<RKecb~7X?oL$l2lc>bH%o(_NUmM<=61H+
z+O?fWRaSlN&N#w9xrdv<Q2sEJN@P%L;_4?acN{+EdFt>cCb6b^E1jd;b~MS(YOj$J
zo&HqpLCK6MR~hE<+|GF{Ykf*I=8tnhY|F82Yd7vroZ9ZOZkp7Z+;4{*7mEKo&%~~A
zfcsCp`Pux6i<_#Hk}fd(-|m+GFGxwdciEm<Pc~KrP2O+Xn|Jz&`M%zc?b1y*Zd_cF
z*|uZFS)Rtl&t2X4x6aIH(fzSzLd(*39IFqCf8gmbSW~}i^X=P7<?G*Xe`ogo=H1!9
zuice@ce~Lx=%(!Rqb94OOmnSy4_fhdTJaj*I`--Pqb=2up*m52-vydHEv&cmu8dA7
zm0en#r=xAl=J(u%Y4T(StMxWHA<Ap@eU4YoI`|^GR5(FvxvQ&k%hwNi-H{W|R|Klc
z%n-a_H;?nA$&2#ulLXH$SbRRsf@RX<sNEBeY<p;!Si(44H0qsu=F7~ePF=-+TO57m
z!ks1W-ah;4@U*-Q=?aBs&nBPaOSpS?c2D1v=Hox?KeJBaj>|Y=d|x_XwtkwjD__PU
zyQsw{bfb1wn>;g~cXU}r!?fmwH*-w%xhD8Mbe+^%7?ksJ$r0J70vBF{iY>mnciv|1
za=-dFU$>t#K4xZC@^8=X>E~IrXPq}Ww{rf=n#%I>d3Wyy&;Kpem#}d6@3i*h>6`y)
zCSA6XS!~AqFnj%+)9N?AJ~fLL_h)L@<N9KacIU*B9EIkT8*#b`6IkZ9t+rCjFS&9+
zwpZ2UBYTQpTB32>W(Kv@`xDY{Ov>STGr5taUGs4`fAyh#jIR?+9gn2&XvKYWWq&%m
zea77-k1lVzYL<B82ouARquXO=g|GHa$QP7rkd>-+bSv7Dd})j5AAg4*PMdEpYv<pg
zxuQNKty^HTuJ4m=(^usk+~gG=d8@+CIrrw;-5p1H%k1ZU?YC!<eIVvN_1Whvv-PuT
z*KC`<ccSynfQ(b@X0|s91I4bNEqVARvu?6@_yK<YHzl|CSUMhFAK|t1qKH)6r8Sek
zojGdbnQX{&=$(PV%54z~A_E;16&{!{GJlfl&<S<fKjU-ivh$`30<|qZ=g+MBbfU6F
zC{D*I<XiNr#Rm$fPTPEtqx8X1clN~_XYzAJ`u?-D43G+Tb~18oG@YlW95IcvKPgUN
z_S}zcr@az>eVe7Ga)c++PHYu#?W7e+2~0&|M_;tuQMt-u-?q3i^6BM(Pf}LumpC7!
z+?lq`ZQ(W3MitfC-2t0cm`;2nC3krLv{`FsvR=*kdsHeq-8Cb<X1kbxrS+6&B??lP
zHs_T_v!1>+NtRnS>tEXXH){9REnz88_~LH1&YXG5?rG{*j5e?ae#-mJfA_3CYwodw
zc}WLT_@40RWQn@Q{m5Z<mc0<vxS^*~N;e_%YS5=>yIG5QUToT%y8gm6EsGt?m!@sr
zGvUs`BU#*hs(AuAQx5BNsj#inD&DYq%H(Jx7G4|GdD#yRC~AEwI_92q!Y6>oo_Y7e
zS3=pz(QYl9ADv<MRdLw*!L(f0cXESuX4j{<Sp{EHV#2%R@*|s4#J_}<O#IYn>({<y
zj(~pKKJJ9gO?wr$G(O;}NQydl(55*0qVa0kcL^J3bhKPOSo88FCtro2D7U})&tsR5
zPZ6KDF0J{gKnqVKpTnN_7F&YdCiQOncj~hDtRKCy4`069vhl%*?>m+T#x(45iS5iu
zWQ@L7V0xtH8%M^biSj{{dM{O;39LF;cAC3<(P`;licJfvRDULF8f-qxWudLUV*7^=
zy#-S%%!)2<h>za8e2>mz@9OFk%jcRdHuMM)2;r32-y5^|EAztu>035u7tffgydih>
zx~qHbA1>7sc`TEAi?eNiO1+}Ld*zvn(^lP3VcHws6{wpKESGwtxM@~&nR=ooQ<>}a
znHnqRL~3rgEt)5?NMV`OqP2O?g#1m!HuGIPR-~AzKmBX}WTB@4GFrEG1k6$6)j6y3
zDI@&41B2*qG1Hvyr3seW68l~DOaGWRCBVCt@1f$cmgvU{9OveGv_+V%)bx0GYND4L
z^FpoAfW~mI8wpwke|G&oZhrTAEc=uFcho=J_y5VuenIx;Pc^N`c}uz5rZ~28?ve1$
zd3UGszJ1vY<6N~3Z-kO;mvcv4kXF;+_{Lze<3WO!kK@nd4d*+m8`ETRe56Hm1ZFoC
zu^Al5FqkM|X4${{O~M(mpE73-2HG88v0Yr{*vVGKBWarbUUwL{&F0671@=Tc^RSh4
zK6!D<Nk-i@^Q~XRjk5L)_tnyueB9rv*=~5?*yn3+dfS>8cv|$Pt&0*DyCWveA}!6r
zJ4fMbAu~_Km1)k|`5MiEub0lsn%lZ_%UUV^y|bBuSr_uWP}-n#e@ACmPV&672e;jp
zSn6qTr941ZT;qrR^99Tolv%GY+7SDj?VUG+&AN$9(cLD;zs*fmy3anVQdL=XQU>$!
zEV)h7&vKm2x?yqEyJ_AM;h?%L20xM)thL|_c==SwtL?H*uTNL$??nc`PsH?GaZsKd
z?b%y(r;cyq*Jab<FZp`?N-9^ha!J@9-6=OA=?g=e>yC*(_vPt}HU3+-Cw_V1@eRC>
z7vvrgH@^MtG0Qq<nMFTxI%Rjss!W%B^JRhaY^m?h%M8{Zlm0Jj@kPKSzPdo}t4Y>b
z%>bvJ9R&xXcKcmedh|p5$sZ+b%N9Q5ng216PieB)p2)Sk9J!)4+}OgrqG9Rr<G0s+
z-`QBf>-56-ht{356Qs7kD0XI;r^gz{-EzF~_%ppPpA1vh-h9lUs=r~6z@{I6rT!d@
z2#S1E_IyG0{nWkDB`+I3G0#eC_k7c?_S3&Bg=-(nh5b63_q<;>XyrMkO%$wJGGp<K
z^_HFDJu)^?_NlTDlvG1k?%e!TW&U!*Ra%*sZrs)ujWiSuE1BbyZ+GmQuBS*;qR*eh
zJOz`^?#vBb_q}EA)^#)Mf5~Khzx=}d+?B5D$5O->&t7>Z%CyoVx9;(oxrZ#Wmmcf-
zVo=_i*sR98=6Ut&mEo>jTmqX9O)<=>iM4Hb#`5%1MwOuZs_)lUT`_X2***WWO7_WX
zxq@=}<)<TOh5Xp%%OaHTy2hpWkE>YZ!XFB4B6^<}dgMoKkDBp|d!pR04Q0twGhAbG
zU$*4Ma;vPfdb8_UP|hl*_u5MH`h1OUS8>$5X;STLRNKtg&C7GeU{!ZotAxhQgI+G(
zFLrk=Yf!!rFSIF_^?z>1K8MxDl{0qCJz8qM-EXE|YRT<9zR$a|RoFhRe>>rHgu$T`
z&g#xrLZ^q`bz}=+<?^dyjj}uOG|l2yqc5k}`OV)_+g)T{{1ynfwN7rg?^Br&sj{mF
zR?RHmb9&X=15+gLv?rKp?sPw3Qhbuno*_L``_is=55kM%X9mdlDdahHMJ`r7w8ZhG
zUdIcSqZ^ygNG3Z)Iy+Y@3mEOpU9x$$=rMD*18rJ!U0ZTpa=P!m)YR!NOQ=aqkc;+=
zec2Rdm=Un>*SE{9>+j{gcw-_OnUd<*^=Es^wM*3{9Q^$=dA>~ZWn15#k+*jJ?%ogQ
zvkfYvAKm|@pK+F>S8EUBCtHaVXIg5?d<-Tx&*FR?qLyd<CT&uWTGmBnwKsZRPA9IF
ze%Kbhd|Be9hT7ZRzPFcdn<m22W$(pv`>)i>9+oYQzaqoT|9{%VBqo1Q;JkQ!th)WW
z$|4DCmGpSFZw((3?WV1htrPURr+47fuJ8IcRu*WTJg1`Gzeh>*azJ)hm{yk+>%AFK
zN<w#w5^lSA^Q?XK@mWe~W0s*uOnX$MaMrJ{M`lNw?|j>??p3lpCoy;aHRD$PO-6wR
z`o7Z61s`nA?To0aTYcGKU#y*Pde?{ZuRN7ZSIfBe)wi`h-nW%Y_*BqLWqT&e8^wHe
zVJ~@ldNh(coE~*pbN_so%(i3a%5;Ah=U>OJTx=H!jeNOwveC&?TBqFhw9d8KVsq`^
zLGcdRw77@LeoO0~T6Bj!-l}^3W3u=ivBfI_lp@WiZk1_%VA{61@B8<U_3p=iy#IIZ
zVPyZlNA~RYa<cQkH7Ty`Rbt?6e8sbQqV9|9_wD~xY*~K1KqWjw#r(!0X<Z?^Eqfyl
z9drB6WmnSh^;T7`5{I|IWG~?pm;7H&Ik|}ArS0YP$c-s!EPE4|$cL_*yJW9S15a}&
z*GFy6Za>e-YV)5NnkzjDle;VZY2S=^t^ND?7KzM=XRvqleZKE%TDi&0-=E*~r4{A3
zwv>EZKYwkHp$*I4g(Y))f+y~DpHx&^`&T_-p2!Q=Q%k2Mhe$1~ye-MPJ8)N_(OD^_
zrrZOmhM@-?e=NUPx{h0~<%^irzT|w*xP8pq3!iT(zrugMtlz)t@VBmMyRCQIf4vdC
z#pz+<oc<P028D0^{^f7??Oi<o{fhs4nHESEC*&Tf6bmWUVtUSH+j8XCrDU(e>D*@e
ziFTH49<Lboah%V5+WFvoYUr*PLQ`b^G2XiSgemN(>zjRi{v|Gn45@$JFPiq3+%9as
zt8u1fmY;ZzllP%hfp*Hx%g;zIopE8GAUE?R?as!(rfjRPbFni=PktG4EN?@Q#1qd=
zfpG~OQfyl4fphLZP%&}1Aik`*IeROsG%urirCMa`9F7H3BGe4ro<$rDd39%L?ybF#
z@9LVZTot+V>nl;i9CLlWqszmE=bejN>aqLP)GcQ5jOXrpn);f?IkOv1+1I^s;t}Zw
ziCw$cj>s_<s=i}c6}0YllYjQjcULSs^FudkZhfy7c_u%a@$9)<r`eQzr#mvgRK0!W
z3+vn5YriCSZfgI%<1n9qRqeJfd~AP8ybCt3Nntw~6Z9n9u~O@z`LY#8QoLMS8?Pq3
z=3S&NBCu@5D!Zr$QZc6wl~sFMc6CK?hi=N~(Q&=hDzNVnw?W%njl~jS7jDbGU-aPO
zR7(lnU=!!}Yo~7EJ;*1$#dYh;H@dfD@>WJzb*=Jo*u1KRxm&C4=H{-23)flLOkld!
z!6$doZBfz22fI%GY&;(0a`v8rq1V}2GqO(|7hR=YE4}YR&a+=fcy%jtE6OC=q)eQ@
zC`rXOb};1neA2ky@NvzY#U8U7wN_}yyXuRC_PPixQh(PaY;~aX^GcoO&kNfW+k-k;
zC-xm@-1Wv~iOkX27U~Rl^OXIzSavpx+>Nx$-kWDO^8oLT#*-agHt81>K6+0Ki3xQ&
zd5fVdV`1v?#S!UkX}fP-{5aoZhHs0&lmw581(J-Lo%gx!Ut3bKb!MZ9@s<TryKeV7
zL<z|*7i(ra7ce*RqEo&Ln{LdNi_4NeSt}`?3yUzeIs76p#AsD>lwtSPd!c87?{3YS
z5SJ)iefzM=ThE`?R||t3q;uwE%nQ?1+<j!`l-<9-ITz&q?(q2F!u?XRs=G~ambbDg
z*AlmHc7ZybhqgWEP&4V0{`;kBN7CH0re;;VvQe`_i{j_6cvhiSx^$bf{5ge>+-|=u
zlZ-ww73FQaklL}vcj8Y&hW?}*mOYcEEG!FS)mA8Z#l|l0*XRFx@7`S;_ph#9J?+{m
z*A~-ruYx;lt~Es-TD8Pw`z9UR*S?2BH0Fmj-+I4DI@TvP?@r9o?y3t}3oKUK?NsMe
zJaL?1&-d*7@5%Mg|0eeP@p%;7o@&v)jAP5%wSBuEZ(VdI|L~%s4eJlhFZpo!`1}(s
z?tkyS{MTnv70YLGb5Y)%xXq@Axb9W()UUV|5n*pN(b}y%(oUt=(ZC?=ZR3q^h953V
zE}eN!%kJX0l}jdsMm;c#aCJI=PAHqLEWtfw-qOmtR_n!`os0T!%xKb$Jm8t4czK<r
z|Mg|;hu*6&Y&b3RcJ2DBv-P92%a!+M3jDPd>$J<^3)h{Xp=&%n<@tw%=Wh&OD@xV1
z9@Y5q<Nv{^hMCiSo@?}TI4)}Iu(~o^*~Z4=m-L^{|4N>JSy29s^|$W@scA+LY%<!P
zpLFq`{kl#3$B)19)w}<yYX4zb#A&fcZ&}<@ZE2o8Vy_p!EGVh@mH7OEs8yY5irA0!
zm)u@WxGVhX)x4#veR}q2c~7Y0nX9c}f3@;f)SBMM?^g-U51g{lyW5b*Anw511BW|R
z-P5_&O1_D)sylr-{GOHH$C6+cvolkz__bc$dG#Zb)7tjXZKV>Esb6~-xeD9Ne+2cg
zN`&cc(%R*ERPVfO^M<MuCuX}%KdG_j5qIFWsy`d+KW*$cDDStgxnX(haKC&RU*Dm<
z_dMTctS{g4n^V3se@AKa_xXN){on20eS0`tdCd{|S33?j-)*j2@%8u9A0q49IKK1w
zCGMA<Ul+9aTi>suj=#)XZcJnR`}*VW4^MtbZ1??8{Qk>dzyA#WZEV)+7HoCDDy~^`
zJFcs-uvm0=sha4wI@^Q)W##5DUW<zJ%!%0Q`!;y(j_D?s9<CE{<eNDmpHVWD$tlMC
zLF?n2WoK`=70o|&=fjq@<pEp&@6QNH@Oa^WhQp`i8RxXf<C9H8LiOsCi+4x`M~Z&j
zeZl=|+z#ehGs}#**C{SG{cY58V5isTz$veoZ*SQu^i@wlyzs!ujEAqpcAxj=%Co(~
z^3cri&Kbo(*=t|fN?!UZ>+IPotMo$4wPXK==3}O2y_b8o>||KF<mllID&cFGo}HTA
zeo!wul6%Xfsr<}eM4zs(FAf)M=5NdET|Hm^RpXo{)jyxvZ>)?8T`&JJY@J$GamJ$j
zl8Gq^dY*lu6XinX1!`W*m6dN*Pk;EXeeV9Rhwk<-7x`DupY-F4uwH}MO6jRT_egwH
zZ?dxfSHZPy5kqQce*DSaIN#*=-rLW4uWhM(-rls-H!kE!#*qqvX?r-Av|T+Dci_^B
zjUv+)Dosf(wS2zRVnM(*o42>jCM;{q&8)w9<mD>y36`~Ajf^($jjhkVc0h1{_xWdr
zk|qh$XJ7kK6%ntn`BaRU?mpi)$0RP9w8tm>n*8U)vHBb#7G1A4F71{xyj+(PelWLP
z@cz2rgy+pX=DN6buNH85+4M(-a+}TVS3ATvt+VMD!*1PgVe*lAp7r-Sq^q+<UVT0m
zUmyAPqMYdD%R6L+AB2^ydg*KFURpnS>(w=9UY}*@J`?-5=TNHWH}5mwuE*EkO**8<
zcmCJ%1#A=7r@Z0eW)gc-9l&&-JKQm*^0*u8@<S5b(=_6bsVMI|9-*xBbILSpU!^q_
z2Y&M~B-M%P)@=~wTgbKOp`Y<(-Xl%b;oMhEjFg^zeKTFt+)>QOe!krNFMhx6df$7p
zW;1arT4XA4{(bpwSz(#nGuyrd%g!s0T>5ThxFppxE$iexxMvQtRc%*z$0fc}>5EMJ
zSARaA`ngaj@HDsA+M@F^TMFg9Hrl;hG0k57wfCc))B0XnN0@lEZIiEyzOdExm!v@T
zPMb*I>UA3Nk76{tvu^%%5z0tS$=Q4Lj(<wm#-eBMS5?3DSYRL4F1qLTGP^ZxW_@{8
zH`i2_Uo^cRy)y8xM6Zlv&Uy8Nm72wC`ahI}B`G)DSgqcpvF1u$!e5hHHS97!gY(nZ
zmrEtxP_(hL`XiF?Yp)%D))bwt#aiBbQ{8Q5Z@a(wObmDVk<<I)&pEcg;!EvaSbXMQ
z^(ndkTbNw;C^`ghW?E<_I<Zj4QgXG&wn}woS-zw1ZOZx&KfZt5XYR88iyvk_`df4Q
znVz?YfdWSuC#TOYMUQ!2<?IK7pXD{~+s)%>UJ#}==jyhdH}7fbHMEy{|9G@)e@FfX
zQ8}4Dy;C-G!|xqF%r!;g&(t69qV{}~T%#x9r<;|%iX$^ur(4hLYV_$Pq00Y+exJzU
zjne7km6B}`<#T;0cT34<MXxyj&WXbNKR&-B_BnTrL;4N%S<U;GXFlIpq>=fF#o9e|
zucFLyp0{n6m!1rf37w!Bn9w6#Gcilg*rjq}j9Nv_&-tI{=oJXPil38u;lS0-<$VRb
zS-)L0N&|ydO|4T*R|yqYah(<OvVo`ZN?YKhUw5Y2L>xQD`dq{G#V%8kfEf#BJF4qc
zYTayP<6X)X<r3ad*dE(ZsxqOY`vu$S2V1^YEG$jV*?hWe#R^}MhneCIdattX2by?m
z8Fbe(@7ls<E&X4b@3w5~M#kQWvemt>G|s;Wk}7QD<gZA0I=kfT1SPlq=CR)ty<XhQ
zF4_L+rqf)dg~>`DjmHZuHhj17I@-<KyZyh*oxe^7-QNy*PgR~5aCCvg!X-*GUbJ;b
zpGw&MT>QGHojU)*BbTqdQJAsm^qe^yj|_OH?P%}F^^%ul=1bP8oU*m^4e!T`X|<uO
zFW7c5+lYBy53zsug{fG1vFF6}llhPC8CxB96Or>>^k!0al*{}J`ZIpGWc?HUVl4bo
z<m5xy!qrhW@}1qCEtih`j<V`%UhMQdI#S@KNV@W@(vxO}va1fy(NsG3Wa%R=7M;ez
z39IfeeLdlCxE3GJ>+c_*?X*$a<@2C}IZ1n6(_#BLi4h;X`%*8kzCYEyIm-1z`9{vT
zf9?-nHJy;JnP!}kP{#Q8;u6uykd-;w6Tj@c#<5am{;rr1OO-{t-%YAm!#OwX-gKre
zZ<#;Qa)(9tilj|cemmXwt@pAgNy-ZqKdp`S3cSx})?W4g*#AS9=Zh@9d8;aTdisOs
z-!Ay*aZG91BCh>*-nr@<Rtp#WUc5)|PxXn<MfyuG$8LC%D9-brhh0bV)x9n*|E#($
z(YaUheSe!B^sGIiK1*-)>R`DpbE)sgOFzWzT7CTbvMVbiAMaTe=JxPjzOZTdK6`mr
z!LHbYtZw&sEbd#Kd9h4)a%k(()B1XUex2D^lQY?u<?9j6w2#5!T)8VZMXlD$63P4_
z{AJ_!s^9GH?0=gdE3e|n$ZGh*J8jC5ANlEjo;{iLxK4BB71my<nSK6Y6IN92oMkib
zwc38kPMc)==|1~jn|A8$ZkPXFRazuISD`uPAKR*e30$AHu^+s-d~;oYm&d*D-(EW8
zw69~<czgTRwEMGvp6yu0|0^a-D!l2?nw8(qozA;9`|6&wdv3pSHG}wnyP9OKiw+IR
z)Dnu__2T`s0JnRkzrJQFvi~wV`me=h(XLxpuRhma{cM(#MQO+0e@mNwUHJ9Sul~8g
zo4NDk<}3X$_7UpLzsJqIr@TBk>ZXV3g08&R%LBp;U5hWpT;n|3^+bxpPi%2bNci&C
z{L`l-b9p9<q(psZxyZkdW8vo1KU=!nZ7+z4Z9Q`DmeNl?&ILzq-ZD?%EVR6JdGg7v
zt?H7_$6Yob4!iZ2f6>yX;Vb@UaqqXRNZ3(0iE~X3$32b)$ETC~-}CdA+1htMG8YIf
zoSMRGp0ihH@5~OHRds2O9a^zgnNHr1TIc)m*WG(*E<4No(dwGFCy$)6RO>%Jsmew?
zP}Z8??ChtCvswCL+AB8H+{!vQov)dZ>(-`c2c&-QaQygd?aL?TXP%Z#d_S#l#kbkI
zXNw))UOT-jD*J257E_Dw#wQ<5)BB#KdE?!NX_|jcGH;aql-YhO{qK{6xm!g_?X@>g
z;xCb?nI`(Jtm#wX--J|qezVf88-De@Q`h?RE6w+Q?zAwDC#&yTSuz>MoRHUZVhM@t
z`x?ysEq3<pW3~?Wq>s<{;C+8~e%7^Txn90$CF{#~d|tU-{M|blxp|WFK7YD>dVa@s
zqq!LyH%KpDVxlc6v(_Q@zLxN!M{+4M#s2oa{V_%HSndCfHDdo4WS2gTU4L(N!ZjY3
zkbUAMbE|K^{53aZ{rA^XmV_?8*qeU6(kX^<lg>_$7v{#3Hytrho6E51_l4bTZ{N-?
zQ$3jaYR5j=RqIyB-4L6&q5Q>itCHQ@<L|%Jd3=>~hV#K_k>>YN`GvXnwr-cG?*81w
zzNJW7ddk^}_ROcwZ7yF^JMX2vcZKAt_$K2;m!3cUzV_Ys=dmB94gasoTV3{h&sC{C
z_kMi-kotSi-d5go`Ei#HfBy6*=f_|E+;4{~rRN=HkZt+)@NwdQhA$rLb9>bDN;V#o
z{`1#HI_dnf+*yzHUH5JK)cE7eT8%G@t=n|hoj&S&;p>zqUs4+8>?#px+g|4I{_VtV
z;U{%eEQE}FpD><~`m$`ly#cqB%4(Jcj0bK;6)l|i-|1ED>H@FT;TuZpoo}-#@439{
z=}P_&vkVq(_S3m}SLD{CZ{dq?rcOMczSg%`VQ1L9w)zc5N{_ZX+w%UuoTJe?ZTZ7`
zOWxqAHz%6$aPRSDoA_~ap_bv~s9B{GKbUM=lI0z<vZ331+m?cP8oCpHJ!Oks`1f}Q
zugt`}r%U3E7g=6fd`(pR;q}~yo-<`rW_f$cPRv_UDrCOW;J5g?tmb*UqRr)9LRlmp
zEZL>;&wFo2lZQ@SuK#W`zTG@bOQhRo&#|_hUV7l*M&=2>3T54b|NLeC_Cs(&@CNp~
z8P6YE?wvXL*v~ySbD#75xM^IdUp@1Pk!GS#@aMG7hdq<qo9-&TKhLDUbInJdot|^7
zrU-9dw?ZpynQQo*b&m2k%XDUyKRNFt{MX3ltg?XdPK{66Gj2~_chlyRSW}me?BAaD
zfIY|ZBX?y!c|UE*MAb)9NxM{U>5G*-73lL{G<lACpvS^1+fOWfU2YfGc0kwl>60ld
zH!0ovk-OvSzlWk4pTgh1XRm+1&uH_R8?hpSv*!lB=U-slARs$S)jO~9&7~_b;cI3E
z+N-{_PQGmsXK*;+PRgpRy|K?OT)%kjX4aCY&riG(vtz$&yzk$vSG!+rGPg3^^om_S
zZo^#eJ-_(Gxa)J(yRU5Rw3=43G|B0?*o=?2YxP<+eU|^KdiVAJrI`yogN!F^NqW_3
zmtGagH_fq(^L9(a#~``q`=4z8e=O5WZMv|}9^>1`|F*eKSN{E-Pe<g~!MVT6`gaz5
zZ+Td(_RMzvw~S{c1zF{tN9SmFAC1{~{=G>!v+Hviro<a2AB#fn#OSUS^oz-G-@fYP
zW|4&7&x2IDF58<f`mcBHljv%j`4!VXTrQg$>-X!xlO=tbx7PlZM_s@$ceDAY%j^sc
z3#1qr6tLYp2428Wl30|UT2ic6P`NeYb>3|Yv48KED@<Tj**<YjSzT{q*~E=g`vQ-1
z3YA}sRbCt*l*)aPS7qvr%P)7I+5Bem+lQ{^-hH;s>lzfqD)r>g&$V*?zWwt0Yc`)e
zPj#4bdz@Nqpj6VMSNtZw<LkYB5_1-MPJ5rR<zB&;e~<oJZ@D8-;u|q-QG?B7i_^jn
zoaa195xAt|xK3JZ&w?YRfm5DHKIK@RdCahX(-dBj-nZ$VOhP7&^B<@`ay!G@5x&N>
zGxnWYVc1$#r$U*^r}y@Aq$-4WpEbO1VwV4~bU}S^(7#8!ZM?2?7;ll`StOwQ_UZn7
z+44`Tjepui*GTaT*m%h<zoBlqtmi_|vnNsu^p5^o8<QV!Tcx%yW13fWM$z)Pte`_5
zKWnhPnHsV8f(n<1Ur<4p{KT$zR!KY;!k;{t_nYOoAy=18UrlDpl-3hBnZ9Xv34fY&
zQT>RqN`K=arM^b>HDxU)XBe>Ed?u;P_^IqwPjf@diCE!xVMp?MEEDh4hPj!uzK@8i
z>{!#^QMjsS`S+U=M+F~izg^7!g>kLi6-MJO4i|~8AkG7E$7iNX&6?1APr_N%(<WWx
z;J>rBTn`WA9Jlaf&{tiNz$#PIUc+-x+L2|s&ZCRQD<uwYcj}zWRAYTEj>EM5#bNf8
zAFN9s2rRy)C}-dN!M}Ufew()5;)fi;hmExt9)9TXy3;dj+LNH;uH5y<EP^g%pEedr
z;rPUq`@z^zB6PWVfI#4*&pq$7B&RsIEj{sL>H~%oJ&wg2jc#v$zj)FCHevM{vw51@
zSWLG~{rc`;+0B9r&+ln`eXOLguHfXp;_2Uf^_sYkYk&CMY$dl`uut;G)io35nt$+_
zGS~g<y^j@_%yQj2E(J-4>}w8k>~ov6=4J8D-0mcy#>2PmuBip9%-AXL>EbmRv$H!-
z1Q|*EFihjQ>$tUZzUPJ`A`RMsm+}%;b?jbu(nH4UGsn89sS(?}v!~r_(UEJGe6FP0
z!uh&nMZ_bG+M>e}>l-&!#igI*=Kpjrw|L%>McET(KmEg!Ab0c?%X)^%hOSf3#)Mu@
zWi8#gMc(*oefX1e5mUN9Pb>Z<chcVNSlvz2zRgaiY{%Rf?HZq-EfkW^3B1+EwY%0+
zu`K*pT&h@Sz+bU%f`UacRw69sXSz%Z;thNq=Up&pv})fwW6hGa=a*_I8XfBtPuL=R
zT2!*VR*+kc@zJ-wzRI@}5BIg@ADEo<naAR9&Rn+(<_Vhx%u-&oDr`I1Wzq1bStRfx
zZ>mHTPy0y+mPL8VQ`Wfpi}U_u-ZRDb{E}n&%S6|2`1*V4*ZJJ9)4xA_D<Agf{G5CZ
zk*<gKJ&BWT4_f!{kPG<}=c#Mh6goA<){CLCdYgfwmWi*Q@qB}f%G3%ukEZFoD<+A?
zUFN-bJgrvzF3XCq%jTx<tXvqXp?%NZ)$-6ri#zMCMH!iRPZv?GN@9<yU;gStSDli!
zno8H*^V}($4lt(#-tpaNkTcOG@o=eGiC}ziuk}Ojg`wBkzKG?hamYuNs9bxoBr0&m
zM)rjf1x#-xmOCc*=N$Z#vp*x-$KvkH=ouTCz6mkrWfZ2$8@6qV&pCQAJJH}n!}?u|
zrUb8(s-025@$lFS<>TCfcQ>$24&)3!>&5=$?%^M*IsBOkvArx$JJOXa?N-m*=2G^R
zOMpl3{HuF6^bY05dTU+obre-Mc++b1QEv6N-=!+*a_?CC_cHO_Ty;NW?~79tGpub+
zFw0p#S$nwa$YaMvHeZ8ElD_-0N7&D+dUWB=+R4*5|4h_NJTEp~;%QaoE>1zIYgf0M
zHN0PBc_olBKQ}aX|Ku4H>sHU5)42EPmYH|8#G~)7UHs8Uz2njj=e62h{lQO6h21k&
zdK^6%v7K?6kS&*Fnq!93!{$s0g^Iwa*z_W=LmAddt{neo&Gu1ol3*-4(J1%u)xA}Q
zH(pFK%t&4|MWY}!THDcit+=uJ<W`Zkb36-H+ztreqP1Q_GhxT~BP{FH|9m=7y7-A!
zylb{gMeoCPhu-!b2q@h?jX9^#D4csroRxU;S<5MHc?+8Rm-6)Pvz@q4%BbnBeoIWc
z+sl`VfA1_WD4Q)EUwkoswr#HdiN6JBZ?Ou8B^)$Z#rje3V3;z)3F&Q7%MGJ-=I&m7
zy7TclvB^KDuYBy6UVbj6ve>-%9q-M+>v!7L%@ICzRAf*2%7og(`+Sb&#^&Bu3Ui-g
zcY^6x0mt*2Z9m@JyQ7zG-hG*&>>cOw!`Uyj3g4d2=YDs!;)TxS*{^Tkl<9jPb5?Bg
z{+cDvY~AEeZCJ)urTxq$tYX<m={-(+Tlc^HFy-;LgO-naCq2!#SknAYW%?WKH^<9s
ztBbdnEOXeqV^;02qVh_qT}HFxoQoVv;!9S9h&Y9d=e9fzxEH3sz<+N1zM4r6tnu3?
zy!aB9ayKshj%D%lPxmbK7OKcx`SZK=_4||A^NiQLWwn2{IsQ(*!@s{v3^KoeJFI89
zB>BGbDZA<|_9C9{75Xh~_kNyrX*=H;rulx2`t4-@e}dgpuGn+9_dmFoGSyXVO=)>$
z(0R+ipYyK#UHtva6nVaf3;x&{o9tCvvHaZH%`>dJQ_p^{@1Au1t8Diy<~#OwU3{9a
zW^Dc}xUkSV;C}hP-_Jv8o5bQfCuZG~W=h_edeDNmc*&kF!@q_d6Il*tJTo?&FnMdQ
zoV56DPq&k)f-W}~FKcVIiTeCW&d2yd($T6(wQE#_G+(@twXx@&6`#290na~n)CK_q
z0|NsSh+tq~P{h_CNJ%V7)Q^wP%*!l^kJl@xWJbF$P0vyHw+Ax=gCGY3gECG73W`#5
z@)J|^z?Yl$h6d&@wh*X0zh2^^7q`{Qmvi&t%jOp~zFXwo*j!SsJvU|N1D5-YeL0u&
zLZ0rwpU^HaDd+nq2ZPUNpU*sRoV>5-eX~xV$E1m_HlLaA&t~vg7JYNay%tl}_=o>p
z3~RYsES#L<F4s%m?C5$PZC-i8uKKZm<c5}?wMEsx|CM(%t(S{&T=~_lc7`ACJGT>C
zYiCbebIV72)yzx5uWj#E-<z^)o!VsW54U&SbMh_L6nQZzOXH<6GgsE(B0udFlDQR|
z+3qcv`7o%HttfCqXJOG<_Dz8;wds|sB{d^lx35vKT&tBTw9Uci?GfiqUKg5df`6K=
zd(dSU>ajCxc1-cblCDLe7fp-zpSz^dW7oL($crk5J-h4XE}g&c&bxbz;TMFzcs^Nl
z@y%|wjZUh88Ub%FyLHt^th;*lesA-a<@QV5l|s9=X)O?xnisHy?PTcb2P>~?JQUM%
z<G#T3^EI#g-Q6BDrZ}yVPM`BowC336#7kQDe|}gN9CQ0elxF1O-w#aYJy@w${Ugq%
zA<**d`}BIYlz$VJIc`y@Z@H*bt5P?ksrc_N<=f|ea{7wdFZuky=xoAflYH@3>uXF$
zJLU(f#U-p;bnJLoW|%x*@ImhDs$Gk=tnhug@DuBrmYRi|44MLWhIup_m1!&foMj%d
z+xBprO;iFyTk8YPs~$#OUn7FHZ=O)he*N0jcR_pQ7Mijh`SL$~`;YA>J|=KX)0ozC
z?_bMziK>~Kt{>f?b@9}kiK6Rgy!vZlEpjz>2gjy5!9%(KXDuldT5{Upgu=ev&Or^+
zg)9Y{`6M4~D?V=`bZ)ms+@S{#-u~w1?dyI2%k<7$nG@48KU_bY!+4INY>%_~ygccz
zYGIns_;z$@zdbierK85+;o*$g&EfW4Z#OO5RnnaA$(7j7U;csn&o1_UGXtj|Dqr?H
zvVT7JXSYP}&c%iY=4Btb;5*ehM$C-m`g1FXsxW4$fWv{e)sD>YIk!9RgS#}_sn-#c
z5+{3W{=c?-Px$dYHz%9AmaLF9K3ZcPnR}m)H(PI#xUu$bOWwD~OqR_}|Hk#uqUri1
zxvk4{na;G|{CU!&^YfIOKfgUb{XlpB<3;klX7&+h<e2B5N$+-LdtUqR;~Go*KI;#c
zRG-bed#~`3?>}bLoV?1p%Egh1fuWEcvuU57TacNPT2zdjkxM5BX5TgtX}$kfo2B*y
zoA1kCMiOrnv!@H3*mcPyK*IUNx2=oaruC?(pWZ(|=jNs-E|u2L?`X&Ve74*1_Vnf7
zf3~F^5Iu9<vcQ*{>yvcU6_wkE|2%wWx6`qIk)3zcJJYHi|38WDearZlN!8-iLk^!S
zQ(rnuc}$)0Xu4XeiSw(NrA?Y49GymiSEn?Fc$mJtGp9yDb-`shi!70+s<T9cLSFD)
zTqPFN|8+A<@*#<1FRXt}R`@*I_S?-j*Ir$3+uxKm!>q0J7Moke%^BWT0;U<xDqHvd
z!{H-`R%vqmI-kAzHTQa!-rz+H-;<M+PM_Xjeb;}*As5XRL1o|8*iNXa=`lPrXOhSM
zmW|1+E8~?f@t@d|u5s}MkImy|nND^7m^l^yCmhU+ulu;|?4!!9(QE4RKIZMNi+gzX
za?$39-1dl>Zy&rn%zLhEd(67~A8+U1*|tlTNBYRyq`PKq%Vf69l<#+S@>5#cxh(R#
zVB)OQb%jzhQjacDQ{Q;z&N|hH8*kLSdC{9Iwtq{kQ;CA8cVCO^?v%wPI;WExtu89P
z_;ow!m-Ds<mR`~S4k+|%O*H2bcpBxh<LMHnR2G$Kw>GXi{yn(-FT*O?V~JU*2Ucu#
zbDAsn;|=fk{I^?=FDqR)$+A;s`n7TntIWuvO|grFnGc+MakJ#sB+FxBY0GQ*)=CCs
ztmSAnli}QA_2j+T&pY}@-`U+cQL6FQGJFD06T^uOM@?I|9e0)Zp~2?qaLZN5I=?Gl
zfQ_RqdBy9xhWH6AA6Px>?(!YXF8_?yvvgXU#v#Yaz@TElz#xrQ55SXOVsWlsLFHSi
zzy6OczJ32EYWJ2u)71C$Cgm-wwk&_#u+x>>_zsV98UMl)zH_b_cTV0c>&5?Z|NZK|
z&vT7hr60IiPZc=1`R~3zcCzh8ot@8HXP#5}Y;)+b$;4R!ibB4o{w-2GIy!+zC&w+1
z(cuVvQe(g&csNDKcxp$-d2Sx}N3%}59PxRvSbF}_j%*(>pX#(_&(#ZkTmy9c&#;89
zsY{QmPtLaH+Z-%s80lxRfx%ktv$URw!NSx{NuP=>-*0IV(LSaU7bqGmS-rvK^cnY{
zc}(Y4#AsNbxpd{dY`)NyJqjgtF`G;tC|b^+^S`j{iR_=Mk`K2(-mX8x#!?p+7PfMk
zd-T_tg5vWXUp%Te{9T}%aptcu^V;+I`G+*WPLJ8poO-DCTGBy(mlNV^XC7DbVPj_G
z`cUAW^iMvS#qE<MN9l>$T23#?!=E|BpZ$E*^~WiXw@kfPL;PG%Ok8jA0ls|}?{>>B
zZ_u%tAg}x6xX`9-MRV0B%lTZcDwa1NJkY-)=!x!!xHm^OR7gDi)xRPlrQ~2kJbP*h
z&lL8nyBYsDOp98cWj5EX$BVK0?P(X)g>J@kj2@<Cy;}bAN_nc9gXbC6soq-GgX3R4
zy2&f)IzNa_l_zJlv+^7dmengS9(Z)X!^YO8YV-e(PyRgl@qRPUho-_aa}6^Otgk&C
zc|T#zy6#lpFMoeDS95;pdnVGP$9Z=lL$Dbq<AUm^3=`zPpIErNC_-!RnQJF=W-*jV
zUAptMO=yEalDc?I^}T?N8ZyH7+1-;i|GL)4xjRvC&(;OkA6$G8ZQQgi;8Xm+LoQW?
z@1`0*GO>}gc=BL{sKniCFAq*U&bwqbdx%u5Rqum`3-0b^O@5uM(5<vSWm6l|P5o(t
z>ukR8ZFo~T$%UcLS^4Oi!w>yaH7g!v1Zio72d<nNB=~sOiJdLU+6Q+W^l>c-31oab
z+hFA$(d*v)z8eyj&0#6LdC-ziVSSi^<->z(6!%Nc4nAr#d%BtlM_X!;lvVNjs76Q2
z#ewCq)4PjjZakI5lHB-7WLfzA(~<_qjFsNS_X=spsWb~HMZGp`zm(y6{Zz}8tlYD^
zv_$G=C05+7e!JjDo8y%?EFn9--<n<QE3txu>CL*}>%qy7y1Er2S3c}e*<|@>y|{se
zjOkVONC)LWi6SZH19oq8d0NjM{dhb2!P|AS7_MDdBpp!6U$$jR3Ul4_lK&5`mzUn@
z`kKsGHM>A&?w*xx0aqDXdW4&Px1Q5g+Hu<TK>7C%X7QEJV{$`M)_qh{?x=9OJf$;%
zBf{qWv*)&RURW;PCOhNT;zag<n;r$Tbl)6U#PCo5jMRfojhZJ*X1(OPJmZM~huE2x
z6}bV<0;_aa2cBTrZ@9yDZUvLh|5=e*u3<VK^OiBsu-;tgtySyH;MnrwURs*-#SM~W
zZ>|+Sj@Y?DR53kpfx)BQE91P}n4jle<7^Gk%G5KuCb8j;NHqKTxqmkWM|I_04{hD`
z`a?(T<_znt-^H`1$Cj++<-cJQeMQot-8n+;r1@o5+iAhlQY+si1b%L0x}`Y3Enrrq
z7PoU<u%!NlR~;`{{L&3y%;Btmt2-k@Quo!Imo{r3Sx>rotI3~#ZjoTr(U<mfr7q3l
z>2flQuAXr6&-rQJv?k8q+u-fJE9{x`vUQ<9`Vv_#KVM@X<Ph-D$>Y++Sq{?EqIFzY
zO)lG5Z0QXN;xpW{{;5>kxqt1!L0|lzm@OCj<9ctRLgFcb29exZ4Y%#Y-kmsj(|wY?
zvq#n&XD-P%j2oAyGR6D|6x;CY+tLvIwZ9G=yAqWtmY>+K(Gq!!=Oe>G3%kN9vtKt9
z*PrQ;3SP0)$5?-<(4pyVS<3#8OV&-&kiT%cE7bbr>uY6qlV1J1Z}T`XVAi>`K*N0>
zAFxenc01@IX6$JyZB{8+`bcj7oVQLZSYjLQ-2HJarjAp@VBNFsILG_;jyu(rCK}rD
za35ICGO75al|kuF>)leNixPyZFSBgW-?S~#oS7y5@`<P>#f8^jZi}l4-BK9w_>m)P
zMFV&3$5|?${m)##;Lbf)Kx+fbS4Fq;%5786K0MhOt8sI`v7Y2b?{x?Mex2l~$Ru}c
ztFY?>ZX2ZrhE25z;uYdCbDUmxXY4twap-yT_vi8oIWKhPmZTip^uAvFMpRw>+H3N&
ztqX7J=-s;P{W;8llZW^1e<}aPs~27UxA<Px_1}5k*7<9$hbI5M8vKC2jh#bu!{Q9L
z4MN|A=3bLwF)^5AuxP^i{UTFyqA$IAo>SaB^+)ZS7>`*(Q+DJ<waIQU+hC=(uu<uP
z)rXMgQb*2Rj}ij4Pns&5sfNi!g*D_|bh#>dCi3-;=;s~0r@n<te7w_S_e^lJ_KUk>
zw}Y><&5q`Juwi@ttG1O@wTwzXuG?Qf#j|+5u62i83e&ICeA~*-U)Zb{5h(dCFZ7*F
z;L%4>n^(RPQ`q}fP;7@`_d&O(CTz_!j!opg{qWeud)e2c`nhi(iaF_|)>xeu`@iIL
z@U|VLr^MXX1_ZFw^PK0;N?ulX@!%ib{H2OVbtW&kse0PA?W%x?kkjSa51%m!^Pa0*
zDYkc#r%K=^k6UYRD$m;U^5}d2iw}J7=e+qaZ_(D5Ru?C4)wx{%@%P*x)qDT%z4zbj
zb?q8Y?E_!VUuIC~eKdoyf7<6)`#U^8`@c20ZSmk;g6n@-8@0_rl8@&{JMEhj_5J>Q
zJGI?RQ`0v7b*en`H>&bY<av$#A9=nlb>9BmFCn34#sQ6~|2|c-{pOPF`JZWg<9o~3
zP$4msJ4#*|4cEhbws8r?`_ANACV%c;z0JK!+pU@}{`_Du5}x{dtJ?Zq_l?xPFIjRz
zCns&;^PevFemKR|D6FrQzyI!Y#pBmMF4xQGn^?ZQdNKT;TU>79<U22xa<{F1Ub>Mz
z?NHRDDj&Ho-^<F%<fi;P*YEkR{t2h>!{+__MW1F?E?g%k`)l3J+K->E8nbug|KK~j
zxvleE+_yIFKaz{19i_iaIGy|B^n2EAr~3XVB}nhM&HiU4KS%1$m~4TYF@}3~Wp8>J
z9OyRn&Wp&pwZ{W<?^nEH_#!j+*kkUy$DcL)W@0hfa`;~3vE_>%C9S)>ZrASX1>N6P
zT3(5kxyrlo@UOk)jUS6oZ!k45v$L+cx$hP0?3KUEern9ytdMX}vTu%T&hEz**MIHY
zUi0|xyZ@(c-C6hEnfG5DwN>wJ^7HUNK?Vku76t}MT+OOvP@~HBcF^q;+uql>%2!O7
zyRp@G6LZC};G-6AB(ppY@%g2d{S1(b%(^XA^6?t$W9N^K&&|(GpSyKebkJ(u(`=Ij
znpS$HY^~BQT_5*-Uq<_!`FnqEu6z}7r9b2Ik!5vndSs-^PF%dQMQzK@<=eNFdFanL
z=bUcSc`|PG-s^X=-){A&cRCp@#cH?lrD$pMO7;UP%a(;R{Mi4Wb;jOsj?er>kB(ny
zZGULOarOr1pS5cPB`S^>xOvWLxnj`q_~7OlGxo_JS>v^3tLmvHkNLAcs_gB39(-J0
z*jTBy(d~NhhlEp(t{Zpw&fk~5egEa1T+enMw9x&$A%C5*&-{)1<l>{JFq)qb<yHQX
z7}02M>a2A@=S63JBJbgz#}_2k4A0)XZT#=&$Jp~0ufE&Q`SWRGeT`m&&GTCymG92+
zi=B1N_Rws(2W2r*`;Kz)2A0X)7Sz^oie6Vd)A76CL$%hhSCJ1(!+7haU*EOu*80m)
z^@rZ8?pSbTQGn`E_V2bk^w-N;XYT#yS;=esWz)a*xTxig=F_r&JuX_It?uPx-X(mS
zbJInu|5r{wtme6)%P#-hlk4m1`A-}wnzzJ7N!LAkQEhO|*!WAMB(JfIJMX^*0bxfT
z8W;*h%<ws|`-x!ohfDrzlAo_h7G>_5d)m!GE%?^Qqj3S{5^9q1a+`M-y}4XymX*F=
zPtxp_YuF2)<X7nun<okRea(<zGnR^T+nKXe^{IYD%ZIdStap+QT(<Dpalq9?jJd)8
zWl7dlyRaFTdi3VbsjID9ZE{#>`_0$c(JcQ8=A`p!b*?zbwdchtt!XLF8$;P`&6H~Q
z{(rwYdGYt#h3~&lF5h1kv9w6{t6AsSh2D<7fwQyMnD>c(e;%yGe6z%>_QLIHlV8s?
z&%7D4&hxLf_6K*rYuC3gcqlu6-jBr&E1$PCp1)FQHK%f7%;nNQ-U?n-XXEU@`<~zE
z7r8Q~-f`(Cwl8Xo5(+CHG3{g(trpIT-N*ZeiLtHo@vY3G@gJ7)FZOx7mg%pg^uHvx
zDJ7dX>ArH?vUy9C!JpYt4bNVDxnl8tzh(QP#xz-(EZ#+t?brWYdL$lq<5}xlv;A*A
zpJv?s=3{!b{?F8Pu}?bc8O|v4?s%!z_11BBapCHTfdWE1l>7WIRdKaEb2<3%;KRh_
zwI^mP-rb)itEJjnz2Q;r)4KSb_6=-#xs7?9N|Q1#MXg`4^iq7OpX=;CkF>8m-0s~o
z4@bG&4Qyrzzra_bwPy0O^A%46eu%e!{=@d)iR)j({tQF*jwed1y=K~~DJUOLlxX4N
zyWF`VX?wQv+r{-S*^TEfX|u{Vy1CEs%l6w*bBp=2&L5FcHqV&0ZEEQyhNF*;v?*G#
zt>Un{&G^u+bWsI^?d}YR%PY9cy;gpZl8}_LIMH^zbwTiyHnu{g!(7c8uO=i4?C5nm
ze`7v#(QU<9Do3L{b@gW7;9BSGQ@%iyC1iKQy}jHuQA{>oG1pJb(ph-m9LI(#zb~>y
zOgs(?Y!xQHZ?FH(VNm$~O;3T@tcKNTyA(~|S~8~k%-P}i=D_u&LiZ*WmZrFi8i!{X
z&4}~**mFWMmRlv)Kxk@-w)(;ah30=RYLx8MzHh>!x%*Gh`P&+&T{bTKIw#dZS+Xvn
z!NYpr(KiC?8y6`QdieP$GBU4y$u7gCYUC<D^TRaD>4uJzBL(85wh43Hn{>sZpmWJV
z({Fw<yZ)q#X@sT}eemf>x2k)qRq)1Yr((nbxAnJw8RiP@{y*`~zwPT+u01;KMcW+<
zW|Pg)-nYXt#582$CWme*;SLcnb6F&{p~sN1ZQ(+}vwIUCbnWvqioK-pr*X&3wvs0?
zpJ#V9wufoBWKIyD%5c3fV^gBD<&PK4&O9?Nh#cL${=3h0*Uh#P8LO^d(&O5yuf?MO
zd-B<8M<!M!-R)na+5!wh?Hdac4{Tw-tSD66yFoqRx7%Zu%T`TA25NKe1sv+=X+FZi
z!}{lV?z*iLQ%&BsH9vc5ePB%<lg!u4yzXVci@*6i-7wqfd3pQ-uEHc;C4v8n+zm3f
zB_7XYU{$*15bXG<L1n?MNW*-Q%8k(uTORk+q%4r$diG`fuLsAKBraT%oEo_(Ebiks
zF{{{9KMxglW^LrFI$`|yR=0T1mC|EBcsqM{{XD<wV|c^@?fV+HTzB;EjJi0jdP3AW
zE{3)_0;<6q-j~K6oAP>xx7Bg08}4srOsvWXxZIF#%4;$uO#i`^$t!b@Z3&Y}SaHX5
zaq-_|7v~P&ipyD2r|Mrlyi&aA&b81e<zII!6BYg5Eld&gPgazebZ2UM`l+27E3H_5
zCLY+Tk+tOfGtMt^Sv!oY&-hea{1PUSc~a|i^7?H~0?O-oS<@aJ(@8UL$zwVFn_Z*$
zOZV)0i+@vJT9p-N`EI%MH-$;@@SP0Z3zM6>wI*J>6_EO{b*eyhs=yQWYc9*&x4bgn
z7sGkp%5v$pm&g0IGD)*0olllnVfaln@CmE<_IQ6yM~ky;43RGEeT@fh^Q8qa-#vFo
zINPqReQTBbRoAOtzAm38C3)XAYj}R*o2#!F6Kmh03v;-8w>h|c(>uRs$s%*Ms2frb
zR_P1HSoizhH*=o-=iqNvCj*|d0*`Ap)N61Zk(oW?p+=xsP*zgsuNWEC62Ic}B09R=
zi>-?S?mn1zdE=WSt|tqm*d(;|LwUUC-U+#)GO=k!I1kr0A35O(2U?1PmCt1ANKG|Y
ze6MqZZQ9J92~NxMFG?{O*@iz+sJLI>DE-*kdaF`>!eawXZno{qOcy4FGtX>%&Ey&x
zwX$cCg;%P|Rh3y;y+P$)6jN$fq&RGExS@SaacZCGu|+jDKcWM6x_iYQiQcg7f=HZn
z%$k>b!q)Vz6cQI!<;igr5sQDLm7~zBvM7S%;3uCGfiLDBD_ePbp_Mq_r;TZC^Q3R<
zxUPO05h1s~Bc->dzIn?2%<Agj<^iI5svlc~KE%75u<#3hIWpmxu~%(hhqLesPdmpO
ztchIu7cHmp=j=MhpVn}+^Td5m5$7MR8H<-zY>bJBTa&_MGxuYQRA<Ytt`j^5Ix=rx
zxpw(m+L9B(M=dp{Jo&gOubAoi&h&}%Z%!;onj(;@+kbhRkp0KD8F4LYzh!>+Khb{`
zDV7=c*EP*STFAF)=7ILTPqt_uQZ5sleMW=fN}J~#rOd9bdO_<2I#X7@X1Zy)G)3t6
z<rSNETbDiZG&-^(vD}J3=lHUlSId;NJ0%j!<KOPTm+bS7)#1be@fkN(*JU;FZFq9b
z)k>p%#;1oHZvEaJ_B-MFt=(*@tcxF<J7ekM8@}xDq7VU=j;kxK1e(tXl&IXWXGTEl
zKhG;ZyU+jbO}@LNZbFZ`>!%Ovr1pN>_wnVA!#_{{F1HA<FTefkH1pr5_FKMubbR`F
zul;HHWap##_XPgEbKbjjd(egHt{0|PMc21Z;5eP1a^V|e^W7GfcoP+d*)58-*FIid
z8ReU__sTy3ZWXf+cP(Ei*tKa$@GM?&Sgp5o?YeytGuN+8ZDfDG)_HI3ij`>_wuIJP
zvR?AvbIycQQayj}s7k7-3jB=u7*M*(;X|*K{#q8HITu8)pJMPfYMqvJXiDU*q$9oW
zJwL1M4?fOXdt`OG|Gc>jc3}arNBO_^ZohgkT==2T>RhF_%f&M98~$xCRIz#V(XfB&
z>cd8B?rQjRUu%pz^L?iO^I5;xWS@Tt-oM-|Vn%;%@+n!Thk5osFVy(z$_hUuF|>DA
z88uH`_aRe6{GX1C)UlJh{oR+V=l5*Bmp>_eXYahH+IzSD{iAce__Uh$pN|V-KDFu;
zt#UurV*8qLzL)Mpo1>n(8_oXIN;}U=)|R+*Ywm|h@?pEq-;`I*6SI2$Binl#*EM_j
zPfGWGsqyajJZyjD?}O$^x>MF=PCNLQcVWoxmlaE+wmtY8TCLYm{djxL#Xo=fW?Ft!
z@kmN~WK@}TTjBPZ)?<G<#U@WQ_H#OAyf@%&x61$hi{I=&BbngWtFp)_JRxx3hc5lf
zlj2tEBJP?py?AD_#KFAVP0-jr=`YV8v1++53nc@WEw%Vo_3q-MRd3ELo;oc<KP`UV
z<mO+tOT(5p#zw?x%y@8jYO?jS{B+x7-na>A{xxjrKFelbU3*`@f63!tOJyCitz54k
zO>&kIoql?C<;+J+Kb>wl`^m2LvaFrDCun25wy@XBGivukCZEp|GrMV%|Mri|W%hWd
zg6^D;8JoCy)_J_ys<QFGNA{Qe{}}3J#Gab%y1s6Tb&AUkm%DM^`CG4a?)vlAX}iN`
zgP+ymcXHci>rRXa{HwlVZ}?rIg`aOp?v2Vky-xhwqdPm7>dSw;yFR?9VbA-OMeP$a
zF4g^VHe>NmKE=2@R`AAqj*n`4YnZHK1)bEMiK?zM{m8_TUHH+%=3uLl#Kebx%&sfC
zEGd=ZQE_%E+#bAbiHd@87k8M@b+%ZuQrXj;jE7GgiM%$$y;6)tplX?4LA>j(|DGDo
zd#09!o{-jjw<UJbj$o&|>o+)U{`{?WqAve|JDK91;xX}lm8z)<ZXf0^lWu&JKK)JQ
zzUY9JbF;271zs*U-P9{8p|O7M+ui5g8dXg~zVmSWZ+UBQ?(XDIxhKxw^!zz*PtT@{
zv1ZQaOZ5DncFzsZ`J5d5hAS$28gsD3=IQZiml~J9Qp}J&TrXH<KX*b^TE)&JwuG-W
zEZcs)tGGUU`3~!QhkA~7bxv77<4yb*;rDM2?LBt2?5f<I;1cF}=bV^LxBseLV>RLI
zt(PyCZ-2e^e42ZqN$mGir>Cdu%j^z}m=+stq3saWUTeoVZ+oZvW6y+c)r%EtxNmRj
zNS|bKQ&V@RwZzLD(~_k>^rqiCzqcp7aM{~=n{!^D+i<tO%-1d}xwf%-PpQWIQv0L3
zHfz2<za-?$qBZjzC#L(KYS9os`e>ug)uym*0?V)GX|F!S|8;M3j_b}{59ZkanKduF
zb9q!rs<-X+9{$tY*V=QNZ(H?GN^aem$gInjrShh;%hdHd_5V(+sP#?H%suiuTS3qB
zoV{y$&-`PoiUl6J#>>7<{&2x=bMUmpTZ-<2oNiCvF8?gY=>BJcV;SQ%=A0vw<~>TA
z|5o(ST?ZZEqthmOTJPE<7-VZ{AaCBIny($R^GmDH;sz&8g%c6^yf(k1w%X5-`x{p1
z&`@pPJ*B97QH~i~N~f4yOwHzF&JUZdZ}htd2=t3A&Q0#w7CVbUwr5N1wx5d+KQgg7
z`X<asx_kA8%6EZh?ewhQeUR%@VhR1T=HlDQ_g<FGGdFL)U_CiCqr36CTgUu80^y%7
zEZ*JXf4E$$V$DmjS^0OPs{-s^I|hCas_hi^@i@6?*OAAqr9Z-**B()0D%4$OlH8uY
zG_dT08pGn<a>pyoG^>(keimg{ioK?=xii_f;LwGl=8jjl4gOuwI(qo*oYkeDa(4fB
zTK}rA(=4>#oAvahT;J1IpUhp->bs=h?r(|x*T214Z}M&OrXTx#QEY!s$>-qC6z!9L
z8eX<Oi_+?soj#9!(xrzlr9;1pgj|hUxWHu9Qm)MQJ?slEY+QLo@JU+THZJ?5m}&Ma
z|M0o*Ynm;PAucT&v5@(CVBL4CqU}@OoDXZ9_Is1--_C>e*R{M~8ooGOx`3a5`qEEN
z4hqDY85sX;Fl60#Ao1&*|B26!-to0!Re8HjOvR*gxo6BVwd}WSQjB?R3#EDfzq?m(
zBl@eV@wQ*@^L)3dIV5LQm~@>nd~3v`6}R#AiVd4j_NX7?XuQ_@EYQa`FG9<Fy`qG4
zW$KMe%Zp!H9~ZOVT&8YzwqNvfiQsPr&$RNV=O^a8dG|f3{Au7_7N%3ut9l;Hy(XJ`
z=Hc~DbszhpDSuz_-|YRPE3x-`{Gl7R#=_-FH_Zft*dBF9Rz^sQ>|eOmu<(9&XRv!&
z^0O)CHa6FO_g%d$@9(_u>(a{{zxwMX4!U*f{@lG@=ymve<NsVYH~I#>G4|!jX==<*
zDsr@Fs$LtmdV!T_>rQ9856bO7Cmwgcylc+J$5(F#ou4uHhqFuk0)r(xZcXHQ$-&Rt
zKX;kwIlr%LtV}FR%?_Vlo~B!~cbe(5uU*GD7F;))@I~<amTwo^w{Ja~U#%y_+~-$w
z`Lm|Zje8OuPq{aWAKQKDyzXzO)h~KKd3@V##B}m@m-v*>tL{mG?pLO;^ZLD5zr%0N
z+T+jUPZ?e6_g!Svo5gWIA^PX_;yUxLimgg%@ed>BO^sZ-$Xn#jM)M^<61$Cc>|fsv
zy!lYQ%luZ};<tA5w?+TD__}vj^}JVoYaUlGleaxDyYEr>h3PL1KED0Z%T;|z%SSRN
zwEnL>>Y&luuKQbaSQ!{%#TXcLaSj^Ar<LX<mt^MW#V3}O6lErrmZXA~eD00N&A)9X
z@NZsxVL?NbU+nVCTeSt#a#vp5%Wykji{^!V7TrLxz%CJuQ+?u3_P_TyY4-KmiK7Pf
z8-4G6zVoqSkM$>+cf!+*JGdpK)}`=;7)M;1<GMg)2Fvm(0$GQjayf}^{CU$-<ygwk
zKc9+@p4C~Nt)=RlrX6`^O5DwZywP$0=G?t>Xhp!uAEH+i4_(h`3pW2!rg>#jN>fp#
z@cm`^`Y)LyTNO8o31sy=JAG(F<gc=>S!SI4!VfGt<cu<VwNj3h9M(HrGHY=n2Sdb)
zoYg<I3<X+*D?a~vB~`cB`|Qkw50z(I0zW)nB{kz|-h=6(UOQ*BYW+Q_yzxwko506C
zCR}%!wcPGz_@7~&eW-0V%apSFs|+Tr>Nsw*B&;OM_T>p9lYZ&uW5u04(H@aUx=Z>m
zWqG&WbXs<Gmb*q;xcIy2ic=3BwN}gS3y$yGx%ZUGyZLdOGuU=apPG3sRjY5No7t@W
zkA9Y{=jAPkkzQpwHO>04>U`Z3>*N2$P1ybWw}1Vf|3&{F8s9neSkmj@3@*RVA7zd`
z-YC66UXOQIJZtvR#hf-xY0EAM#oa#;?3?CUs_M)a?d>68aVeoiX7S0CqUJl7_ime-
za<O9HbII#dw|1_nDfoNr<D1A9F3)rS6YVCdHgJ2VYG$%u=M#;&def|Awy+-S^fh@i
zWiu~VJeqvcF#WA*M)KpfV8ezwed`|Ukfa^fYd35!ve~=SlCkHK?-o6$#a}XIRF}=}
zOqr#9_UyK9p*v#RJvcvddVDy%yZrily=*~YLmT&s0)LLZ%qkMSuVU2oe=~fnY)Rms
zd1<Sxf=bfD6UJg}zkfOwHe9l?Jr{P){KmIu25bEzCQi<?XtPaNHm%~!wv@BQ`$Tdq
zV!2;^JZ6z6w6-hs(&QCojURW+XFOr3oK(mecfFm_X-!>$Y5uGSnT~gJkIc5zF<pHB
z&r0?8-|PIpCHu!c>SonSF52L%Re7J=Yx$PXTXwx@H&`g8r!f0aj#>6+%aVrW-m@yW
z!h=`L?Jt@Yu=kT_$dp`J+b?4A=hs@u89myxW3I|fr@ubelee6_(kd~HXQQX&oa6kP
z4(|{)wFzCc<~d7VwLHJHMZqrBS}FcO({sFK(hE21?>G?V&}nM@K+U(p^VS24tX0N(
z5|vk;&YTx=jN9$8^6k{+?LYNPzixkds5|bkSLONMpjIc-@^2?jY5kOPwzh~`5S-+s
zrOB;m#h-dVaHYZ5Vx`cNb%!2#IrJW0w*D-qh~K?*hus}-x9!|g+JEC%#JX9L3$5R7
zd0Bn(m3R2ehnb6~W(T}=X?lHfL+#0oA8X@Yo&I%u%f>0reovg2ty;c!<IL*gAuk>Z
zrnl~$I<@WT5_PX%&ifg^XcRwNSJ-P*aW1(d;!N&xpA&bF_t)1cq%i5nRV=Q*t6O*c
zU{tL3>UZZB`f6*%9_*O#y?p+%mIc`{c@{5HmD2AYws^f@QpI+wE2rmpHcu;;*VX?p
zVa4tTZ#it9i*7pMpTXc=C|@tMt1s60`W&<OI=mCqLt`u3Tz0>nv7^AZIJ~;WH{nk1
z6Gq9NfDW-kJvD3PHvJdNcq$}kyPmOCN$oWk-+{+mAAVP|t_wb(w`tuYhPBoCcfQ@<
zQ*`J-Y~8uW!`pJ>s-ErMQf5)Q;L_af`@D0PuV&Xex5Y@}g}RJd{AW4ah_7u~olDa<
zZ1dVzxO?N`C1*HUb}tQHw1oF-<wrlmIh?K15oaGA+xWfe*z>qTn~SCQll_)1d2PwA
zsabw?MeM<XMOxSRuiaa|dGpch>-WA7cwUfxzehpWV5`351s&l#`=)AskC_&<Q|L$d
zr71Vlw;eq_ed}}W_1o8ZUC1zOI{r^@$M%PLrRSREck=D<%zs>eX2<{cP9Nsq;hT5v
zA1i9HExhUWon>YW3}4<eV64T<hppgAhOt0n{<Uw*?wD<QP;bk6?4ISDzUZFEXXY9&
zj=XE#rK5i9#KwMAb>r6`6K~wj=ro-D#(RTm`JSo;wY{~Q*77s3cx<p&QJs8qZ*AY&
zJRuDcE{BBy@fAAf;_d(6{ugOBv31h#<-w6xZt6_F+Gr8AWU}_o|2lQMzDLMR?+%?B
z8+Y~5&CB}p-r86HdNXs!j!BP}hNLPk`xN!;X%gR5SKZ4y!yo?tlfUBg8}Bur^B-+l
zk;<pP+BI@%X_#1b_2yM`x>aWCzD`x0?2=Mk5#GH;<J7FK6?<(z=hzs=tE)Qvig<pr
zLd8o||I)846|Ky;(@B=*_cup{l}0{0WwRo@d(94!l|tfoewnPj>^V<Mb!z54J1I^D
zce|%en^O%H1C~X^=}zXn<oR8>@9gZ#xVW-;idz|;e*0W>@b8s=U&GH;8`K|s_MPc}
zxlk{@w|>&(Dwp$qU9Z<@ajX0}dAw7_Kv{0eGxMo6v3e;JSCps;JG=?<bAO~G9lu7b
zNJUR&+vKp-&m&nEoX+~{9JXiOsUovm(o#!I`q-9-fB77})9C%>S4QVUa_`Ac|Li*L
z^s5!Sj(nWm+5O|u`}O{l9_Rb@?YI5=?ltqFRj%!xk)A4he&_8u^J%5#2ho2!8kVKl
z3Z0KXA@aPZsC)Z`nw@JVrZp^|V|42LX3yTcW!fhnNj<x)vwO?c1dq*5^Tal93OzUB
z_LLI01G+QQkFrNbn%tYSzmD;WMZ9R~FT;R!vHyOq@_2spNzc4pPj3f1D_7No9^xwF
z_EYUKU-QiK+L@QnpWV#r@0w-kRMg=tqxj=fZ4|H4cV82s$3>Ao{BJL3?ASg%=7;Gd
z?wVgOE-vm~?Q?L_Nmbp8Ce0gHGzLD{a4A{!)J%`hGI7QxOJ|;FU$iH%T60V2@kfh9
zvUWaj)#s{A_U?DFYJC~tygZ>`m1QA^A=|fN;rFsnS1tK&Ffk!c=TwpxcWvbK;K;*Q
zj%^bD!8euFzEga)#D;sfcTaj564n`YF72lKflmQ7UF#OSzbN{Df5e6P{qi5roBxPE
z*8l7&%m0|=-8}#OHoquaFZ2J2v(`sZo1^v(k|LEowJxVl?3@*HbJ4Wc%O`)RFI_n`
zEa*VP;ZH3S?=<JzJrGem6r5#s{_Ff1a{l4JS{FU5f0P!#j612`fTuDlM(?t>W|qqK
zHm>tKpZ?NX+qz3@`i6g({;0)jE-()2i<`0QhM>%+oj!>x@)K@cR%&`0=<`Wcz-ph6
zPb6#oLT#=%k2l}Bs=6mIKKbY&V_#_`bl~QL)oauZ8EPkn9`KdWp7>G4DA$e4Eq|Kc
zXRCXM)2FGh8>p84zqeBA1&49T&J(KtJ0Ab|TfIc;?7s{l*$&1(_ELRcm?Z+LjxclA
zKl@UCX#b0Px&J38tG~Napyu)H>||}d>7phKlJ+)re`o!>;PUAGeHXFzrzWW?)5JC&
zPx|(J`3C;KKkq--zdZg?ef^?JMs9{{yQlo#A@m_Ub}8$X)<=RlZ3c6n?Rc=<nK`Yc
z^}&9rvd)`H7a15I`C11kF|Jpt5MU5{S=6GvjeRcz%gghZ^?#n9|APN7yTJ$l*bDLt
zCcb<>g~8|RDMSCnr5|3LnSJqKdR4=-bC0uDW>rP3eD<((ma*u|?#)*Eq0X5{OUhQQ
zoSk#*z>nFrAA_sTet6++oEY{s^rT9}nu46O-AbXwRXz3YzqYS6GtYm1FZl*@O4Q8q
zuG>5BGRMuF(b=DUZ}x|e>^p;+AKp`8ytQTK^|x`a7f$+mVD-PgXTN?g{1Jbsoq@sp
z3imZ9!7RStx!wI*OAcBVDn&8Q(z^2Z_FkL)^VB0(b8RqsSH;b%edg$7?He&{^M5{R
z_!#G<z>y;?8{)R;?xhv2{|k03Kb2}aF>ke;(C<ZC{TY^9Id44vaM`TlzVJ5Bhkh%j
z6>}QB4LR^_Tf{Y9?{?Pdho7~|NJhwboqP0R_2vB!_+8J0#GG;pYdFeP`83G$#y^K|
zYZv@Kx|HQ*T56<$4y(@Mgv><^%T?<A)imOG+CJW6`Obet*xJm%yQ^~Uy@fMwnoiyp
z`SS3;eM+;E?<{wSo7pvc&Az6*3vSk`6NL)n4Y|`NKHK=RL*XZ1*~4bnP`@QXom08l
zoRwziGC0K>r5@BsG-!V47pre)QL8@9`A(U}ypA@5>gwnD@p~-(Mi+h5vb6s7E?dKf
zb>c?rj}cn+<_~5XC{5z&oIT5TwZQfFFB$hqb!OK*@(*XQYOgz#&foc3I5dB+gGS-E
zKSys~y#D;adj07dS%=)JSwAtAajN<4Y46x)`|H;eo62gwL#0WlCcoHNHsS08rT<$+
zcE)z|youkPn5?Z}HJL$8>S%OC?bJO}<QFEWCff?Kg^JXF>yMb)Tz};Kym$Y9{+;}=
zzGeTv?HwmxbUb+^bxlH!p+sM$<FpCO4MEZOvchpEPcOc{{-e*OX>t$tPun9<*n48K
z#G=Rh|DLTsGrOYX&$a3`<y&7|4gddm$LA)+hpWXlq%H1^tI#ia-7~Mc|I0q{+WL~R
zCwnjKPWkfe?a$W!RW}bUdb~fr=JPA-|4SE%KmWDxLibvoB{MGHl<Rx3<yBV1icHhq
z#NADd7ECYa-4s71UJw^~QOn}qaml8|7dQ0pzu@)vV&okALz?^dO#66GuE4*X_wj9J
znMn(8{4Y;wtZC_4)bVegvuDbp5*K$%`P3+@x5C#mH?J*WN@uZ>y;5^z^%K(%GM2It
z|Aeh047HnfGAao;#)wtKJ^Z>RLW3=EAA^vBK}fI8w5y9)q!zr1>T*?07s^mrkT2S`
zJL=u3Xq}Mld^!296OO5V2-@0`Ia_P<^0jVGr%yKd+jP73S#z2kRx<h5&t%$pNpGT&
z8e^~YgEu7;I#0GVIF~B!yHQ;C##;3;&yoZECNj=)OMF!KX!E5Vn5*g|S?tsM@yhR2
zR_nDFl(;aPv&mH@OgQ<#qG58n(#}^N6{hXHVPB-KDgEtzSzooha&6_p2BEJCU5g*?
z{;Pj)cWlOtqH1>Y+7H|6&R(0%dHum%#v79)zkU0cb=9f4@>gK0{prK+6E5<sRIRe}
zoyB&1HA|uSk=JHBw)Gow@NW^eTJg0c?Z&HD_K7=8nqFsKc#x^~XaBJyue#=JQ?AG}
zn9K3)q4}lOX;b`<&;7nlJgV;Bb&1|>8}@(Qq~m$8>U^r?v6EN1BUcqw?{7US@v3sO
z#Lp9-ve&yZyLPvIv{|bjF17XCveH1^(%#)Z67Jj6tbKRyNnE^tYvujJZF87k-@7Ll
zY1p&w`wuTayFD$<HyLzQK63tHkJ!-q;OxoQ=Ii_X&jtGRJH%aNH<~8X7r(crwyLaY
z{g#eH=g<4?|1BoJs7Amsd-_qM#=|-#g8h;27yXqvm)Uw|e@$D{zdF96^3;9te#W0g
zSFK>3&{w}wduA}NxBTD6@>D%v)gQC;vbif~`u>zwusExK_H#+sDfu6)UuLa--Pu0R
zQSaKUAh+{>lvsYcOA8B1PVr6b-SX43!pffGvRy>SZq4is=KFd7efe$Mm;TLBE#vu&
zbo<G_tQ(spR@z<MmiT2}MbPp0>y8yqJbY5r<yZOptquRL{4IR>?*~)8%kTC3I?hZ^
z|8>&%_Y?2GPrQG-yj16!e@7~2dC{IdUnU+&z0~})+a!F`L6+$zjC)(oF?&SK$a(6S
z(zv|yWx|@Zb{zj=uDxGV_^NjLwGS&#Hn6<DVW`gP#%i}|M_balMx&UX*~hQl7yHoK
zzQ8d_H(6urMZWLT+vGn4FX(Jt#Jy=wc=+mNIcYBvk5qZ{@rR#P@7SYvzr}6A?2Q}u
z9$k@k@k^_+*P$a)S8ly{meeRerSihDTO}(FCEd8KxavoM{^ICk>4K{ks^40|;4W@u
z6P9bnSN~$7iuAIEd-Fp=BTH}Ces5jg(rl*582g0z@C{?m4fX827u}QC?v%{&vvY7X
zDSYVhNZjq|#l`ON-gb#Wvr}$qwMYh8Jb0+h+;n=v)|JL>*RA^xU08bIz=RByzN{O)
z$4*CGdjC!=b3@{?`?C993*I`Oc=*!OHiMqcFXmje4}ZB;Wd5J;`&Z|&Zc)#B&~R$~
zx{r}da{2VbyQj{W7PK%lBXWT%$5z&w7p|W!6y8@*;%*g-t*iD;PdD*X6Mq+0zP8<F
zZOWmqAx39KJ~z!PeCyYEZB<L+#kneFO9hppKS^Aj!831V*#?i*C3(vOR_%YtSkok}
zGw<!)rYjcO95vY=8Na_^5Y70o&xvD~ra0paj}2RRXX$COS^Lb&m?Lt<{KYTDoSUWv
zVJ06dVjkHsY`$5inz%feL9Fe@^C{K`k1jmi$bR6!c{^9OHz(dCZeL;eb}kD`i0*NP
zgA+3D)~H(6b>IBpxX$L;?GjOot*vHn<hfqVUG<Q?^s3Pk#sha}{g~~L<NvPCW8)sZ
z&)Jp^FF##a`aA8A@*2ZE#$4669{ip*KXBDTtBVzaU-+7p#Xe+6Ts&y!cJpm*f%=`?
zU(ZS<dH?1LsXSV;Z&iwwD`(;1bxGSMPP7kYSkoxT_`AmHOH{-5Vw2uG>{d(;7bcn+
zy4DGMY>22^lX~%mai>(ob?Nne7K=aHmAtqxwQ|Ex=ezw6&skq&x|Uu3L9H@WuY8JI
zgVbar{f$Xm{L~U}=%kn)UGV?W$%P*{QVtlF?wEJ|;5q}LcYR*nYtGe8vo1do5_4NI
zIKySt+l9NCX0?562%gf~bMJTX9Y^2wO5ZiV##p2n>TA_Mn{nLtasN^NCtnwD(#%WU
z(aLOR`m=U{>H>{i<*CUwN&h;-tTm!6F2qdd*LITFu25mw@BH^!bKCXAita@l-(Cz|
zHOX?#ES-%JJbPXpnbr1w-ZqZ*`C4bE<m|k`n>KBAr~fw5Co4OZ?jA^}@Rn6D@!@yc
z^5e<E!rf_+)vWJLoW-ZBZkjt+UE@mk9?5jZgUgN_dlluze%nyxhUZ0&Ni(W!wzu)t
z%-kN;p!{pyfrVY{-|y|odfuDXlqUZrMyf23|AT_wn!-AXDb2cu$q&n}d0gHj^W(p6
z`YbciTb}VAmadLFqmCAyxq3EnN9m019Fqzb_HQ~H=J8u8pk&Tf;ae<!^^WB%mUj7V
zY$<>G<vv~U8-=TW`Efspay<L>H?MPEu0`0MTU(F1=|o>%rh7H(>g%HabDXVLpT3tX
zt`n2)`{~1P;|uvm{94WiyPiI;S;<vBNmWwzddF17Sf08Y)<-6r{_e7C;P7H;QVo8Y
zsQTsXX2*!c;(WtWcL{T$&iiahR%tWTFZU)CvYs~GoAos`Y=S~(8}r>llO+|cH&#su
z^?ac5lriIN;Z3(tzr);j%-q)Sa(yvqd3RUkJ)eru!D!hFb2+wf%?`ifx}M)v_Nu`D
zkhG%*&Mlv~&F+o<sy9;KBP$kUzi&VBbG1zRr1;M^k9~sH-2Bk-TQ-%W_1)`pCuGXz
z*-Qzzc%pg#i-`-Piqlq@$xE&JuyUc%aW-3<v!Bx%-fX^qYvRIJ_Qo&XnW(c}o_lTM
z!d;JdHagoJQNMd`?>U~U*V@}&#lOGuK<9V6oiU5U|8M?0e3!oMxuCOkcj8)KCQh!`
z3hU&zxfb7jR&~%OG$yux+qC`fInGSKC*S>9`vF&Q$}R6Nb7lujQP6r(*u3WE=ZNc!
zl51u>`{3qxX{lMIt=R9i+a;~uFMKfjnq<~p&O>&$G}9s*-KQmSm9AK0xqgP+L+zZo
zg?)i8Y1;o3rJ7}J7GD!QI=_rfF@M)XmTk<14-9tvmH%|{pU5_&M?&2#Ni`umq@_OX
zI`&iG#MvK*?j;v)iFhKBHQE0t!%r>CqDAl3tyzrSgO*KAJiO+@i`N$dnzJRsB0Fo#
z4n;fIKYMw+#cZXG`gY;BzBwy+Y%d!hyD;Bv&V4IBk;V+ic{=);Jl6yl9$b3XW5HHN
z$<W!kSIz{8|Jbm)Ui^{YXIu4Eu7?jS%2$k?(z$fQ?hmngE1rb;=pSWhvCH^hnv=Kd
zZMVg<8+RsT-<`R0`*9ufA4)SNb*z>ZPmF*3A-AS=RnW@!r_8<GgFdo~+uBxM{;|4u
z>b0*6A4#uth?4qYczV~g!a_TR>e<b#YcsyQVUzm*^L+g>^HuYvd7Ir{IQ!!5_w(lO
zvH1J$NoC5tLzY|L>&o-*l&r|z!)o;-OV?5U980%Sw5mc^>V<RpA>3*{j-8Bo9GkV8
zuP$wq3Ay#kQ99kZ&+^KbDcp*S41Q~iownL2*ZHMKx$Dc}?iuI9GV`{Gi0rew@La2?
zLWXh18oMW-i#mepM75q@|Hv7>HKQ#rZ`PsqmlZ<twWWWA<RpTUL?&|9t@552E4E?5
z#XB5#(zEvRwCAnRkYjZ)*?n%=6G{JxK|H54Huh{jy0LFf)X_&3k)a#zUs%TaKk$H{
z)!qFz|NqVCXS`!#c60gdj|E3_^;JW%BN<y~A4@!ZQZ+Ac<+Iloq9?w$9u?;0K33`3
z7~{1}G$>~A!iQfKomwwkeD}on(=XmLANHHBbF-PJIA4GDM9aVLeuv+mH%Fa^@$j~_
z)0bFknNHT6ZFWEZQr6^r$*Gr@|M&RKv9D9YV%4WfEX#c-@k}|Bu57rl^I56jw|)IW
zJL6w#x+PBt7TtC;be6*5`Nbc8H_EfxFFNsoS<uq)kK*6?fkIZ=YM&mxQ+7TY@Y#Dp
zm`>MS*X7e^Ht{l5tUTW|XRqu^q1XQwpX@!MJWpa0%W2gOpI<k%KWr*#DpZoFU7n|v
z#P)A*yzrCE)vS4}ab=49e|OD_Rk@bBHJX|4Se>k|qsE&3Tdf`iNZy?Ed2{H7nY<C}
zem)g1PF=rl{epKHtD|jv->iGT|Hw?X^+uD`7ga8Fmy3V3zK$`*_-vGU&z0B@dulH5
zhU?1*`5gXJ6uawz>igRMf4`S6-_HK%*JbhTkB<AF&#V9Q-QCadZRqi($>(MtP@bi7
zWcg&4eG@+^N>(~wUTtAM-@|3iqLSw;CQ4V^zVl_D%eg$VWtH0Ps))zO%a^sB`fGR1
z<#$%o;TT^T`RuAZwY3*_O<Hc+af+kp$Gh(DdCj{%yl;4V^tkR`C*$8QyT#`|?qMxE
z<nr`F+QIwxYYRWjQ|kI9mTYVq@axR7y~544hcdPN{(6~wo>lc$Qi9ECYK?`#mFO+&
z)LGX3Da&0elB0NOM$9h<#@?EUJx0G*Hg59>(MYSYVLcYUbi>nE&2M^BwjT?5@gQmM
zrPi6D65j6)1U<dOna~ofze<9$Y0`^#;j<OeU72sU2zLed2<gbaj~0jzI%Bz{y7QB_
za*zr8sdIrxmUh|oSRCDMp|EDQeAPo~-IN(if+sxRG^gf;slfc)AFr35Jzbl^vqpVI
zRo$2BuNp%8#hd+>KK%V{O$XclaA&QYnG@PlfAr5)tlF_{#s;(XoW=%^`V`K^O%3LM
zWWvlhah=o&;f$^P275LaBu46QvO3!+&KDK&%ld`bj$fiy2NM2Y_9@Ns=TYu*x!TyP
z$iHWU{Ga2yyw+-*n6zAdZS0Zb3O61JKA4-RYIfzxUVWps+D~_DT+5<+X7#uR`kR)8
zcx;Jz*%^5zWX>P`AJ?AhE}6)`^n#Sj{_xnl)y|=fll$BpiWAHCJ>+T&WpBz~yHekt
z>1?R-S*{x*HVXy2m?o~<bb9r>#}EEh@0{Yr>X0K9{V`G^E~6&0rS?YPJD$x)?M)uN
z|LgI7ch5{?iD+J_pV{6PeJfc)S9n^5rJmD&rM>j{WihW^&!_o53i_SQyW6)Vu|j!I
z^6~5C8M?kFp0)a!Ontc{u<$kKF@4YU-K>Ij&c&Pm$87&Ba&>`C+Tnw~-=CQAer4aV
zF-J<hYc~hqrFU=sCC;oZh^TiqQ9Js{>eH&LH8Ib$90m0sGKgJqQ1^*A{K%YD<PPiJ
zue$49qq=XLm>;!De6Q;wz6|w^*7K%tUpduivwSOmM*NG5J}(YA8s2ryw&szk-M!Lg
zOVLuXYtkuulA^ktbyW)NW?Y|arEn&bca?2_&lbO{{eSo#-Mrx&eRmK0nR)wm3rI&K
zDs67Mm@B(&#%}YsO_v*@-cI^!svVW2{<mQEmoF*bg^&IbOWrNDDYM%=ul3g7u&nJf
z<!Wx+Y1=7MZt-`Qlwt_i3qwEkj^Ln`uFS{Yw{eOcK3^=t^sHfKR@2!WJH1nOhd;<z
zzYTi1Cgsuk3mhAi&%{ZwFZ_N+nr$V=@eeL{XG+XflVNzMX0Yyl;x*~M`o8kW;PcEe
zDmn3H%ecy?E>u*I&fj<;=Fwi)(=FT9b<1x`in^z9PWstxxf|`fHtcNQy72HJ#s1fw
zTdNA({3geIW?eop%DU#A%k1UyJ?o}yb}V4GKQUEU{<in&$S)_YeebKyH@L;acsJ|w
zfq2m<Z#CVrJuyBP7rSd`vWG?9o_|7Ig-3byhKvU;?_a(87`XA#@`%QM(Z3A018-=h
zEn(|DKjm`p<lQ&#2blaS+vocCtgGy!+FiVk*{=6DtPwBi=JUFq$CGj+Zlkb#(TAX~
zCM}bvubyd8B=Af1W1$S+e@>TIZ*Ju-v6;?qK5fgxj~YI+r$pUpUoEThYhUw~^>vee
zEj?26Af`p2*maq(R{8WL++EV?U(HQaxE}lEd7WXl7dLHk{rz`Fk!8@bZIVl+)DBvF
zE_3JZSiI}1&^F^QQ<Sy`OT6@q^ob7bX=iXdyg4+M$KzVw3@_DHsg0G@SEovBShcEM
zd;LTwpDH&&5%(D?EnB<x7CX7;-?a0z`?BTtRQ0=am)+SL(rxV<_)~B~z&VkpwzIqL
zrBvqmG8&|AQ8!T!e%|HqBRg`!#nsz>Ugej{u>bet@sW*s0X*#$U%nT0wzaFK<-{EP
z-s$@^()qP=;kQ?B>i@l)$i1ZThuGu`R)08dvq?;SDcq@Rp8D0XP;Jl7l-bAX*B)Yz
zXywdiVCtS2&l2`b>hEK{Xx8u_TfcK3RQYkW)cH1#a&XP}i!G69CI(MVUQNDrZ_Vs#
zkF9q)I>h99*&i&p@VsT$<Ewc#9Wmld^Uj_;Te9{`>Rs;H2aiq`oH-?5tLMLopvl|g
z&D%D2Jb!tcF-c~RpopHAc+lzf4e8-03XQD%EDeP>&5mN~UR<(va>)JQAOT^qH@c6W
zw0Fv`5B>Bkt(<q8xP(rDSElEtnR3ec9PTm?ugnuLtZMFUa1?XfSaL$k@xhF4Kb12|
zd2<9WzJHi$zK`|&?oLftF4x14`5qs+Q+z&C{r8p*Y5iljng85n*#FmEkYoAf*-4MX
zU+vIaCwV|`(&V2ZyQ3b?uyQSxVXaK!Gf@1o+x5+l(0$*-la6n^)xLLK-tlSu@<n!f
z7n}ID>egqhdn1`~!{kbPRVkzM&Y5zrSdDWwa$S0I!?UAV>cEcl6AUUnU3s6vcs#lq
z)IXK&xcuS`>#feX@TaQFTrS0Jlyg`<N2|I2?yDCrx1(dr&b{QVvN)f3dCIvh#!t3y
z<Uf8yUazw{SW9MZi~Qx#^A~fsii9q+TVr6uAa;>UHqtOug+tM5?bRm3s~;*{lU}`f
z*s&=!(^GRfcfpEhGJ6wV{*vClFNr;(MDXa6$fa%U6-R%)=03$&+FYk&zwr3Vu*ZcR
zTwbwnPBg~psPwvZP0ZO7A<50_r#&<5!pev_=LB?&I6Hf#Z%o-X>!`jNYeLU^UVjBm
zS(CH62A{2FpS}^86m;z3w`)Hb)Vt%8oUhE^eOk4Vw|kmy=hbVIFZbqT?A>;?gn`N0
zc$YQfYB94Mmbo$u=4`#pDfuuWckkK>6V7?*=g<G+@Ok6i)-V>PWgotC?`f{G(~mh4
zWp-Wf<U8x~i~Ch=x9D}>*6{w$t{e9x%<>rL*M6l(E3d}C<4EV9ntfs$+p6xS(sRpS
zy;IvJ+R(<Bl=^RLuIt%fC9XfV>b*!$RO8XxzTiN?4f9mKyYhBL3lFxoiREtFUBI*Q
z=J`!??w<9MO<>&r=;f1t?vvK6kbmcLsO8RIjY-dLs+xXDNWLK1W|sO(_3wR^RNdBh
zWm)Fs{u#d>oo~N>`<>S#_Ju|BC%ulDG)pUY-Q5=%JO0&&{*UN-V=}dgZ~4hhC+se<
zc)Swg6D=+C<y*cuFG@=I?<1D|YYd&_K5ng>Dy#J6_J?=M2T$8o<W2A_j9jk3RmRgU
z5^?L>PY%Vi+>4vPmW54KkgT}A>7vBz6DLe{7+S75AFUTVxrf7I+0<-5zRkR8{J|0S
zw|6Kp**y8p{_IzH#M@udJsVTi^Cx}I@4Gk0X8E+Of2|LCY~Wdc|78_F>&=T{Ybvg-
zneU%1=BB{iwoG6mcmA9%tG0TxGmEYFmnHH~Ugz7h_1)}>KBvP82ZSC7EUdl%By7ot
zS*0h0UQ}<dFHBLYvbwSUvAOQ7m!H+nF8=D5dwW(&bEMee*Y&>9(GrnUHcq+mpi|rC
z$1}@3!zoF(w!F{rw)$G6{rYs^W^>+IX6^69j?UZ{EzS3_f`8Ix|E0gqt#}tV^`ji?
zijbLmj{OMnNuI#<|H}5KWm^ubaPge|n;ux-Hz&U2!dCXn{|`IgE7jr9U90wgg0TIH
ztFxY%AF?{xV6CvagWu{`<GS*GzXXHpSr7VxcJ6deQCW1E$@N}sZ7+vMOmUcYf|lSu
z7U2_%UYz?8B;VedXK-3AvsE%hCiod=+S&yc0h=ri*{prJFUM$u$dXmcGyVU%x~#a-
z%djK(?y;JQQrSJ<LM#)f%arUowEKP-)3dVP>;tC-j~+bRxNi~DUiEMKPAu1CPR?$s
zP%Wumu=hxQ)tnD}f{P?OCi=JRJ$Jfiv+<cVT#H&HI(EsuGi8=Zc|P~(tMtD{J2iFE
zKkWT*>&fX|-_IYhim;h;=ft6{#o}yxdFM`g^5szevPW%dvu5X2MZHW3EEIEGkvd00
zG4p)C*+%E9N&S5qg<QdNM8w|-_8&Xrk}X%6dAcEU&&9K%8L6vIxlT>ASrmPz&2&<`
z;_Z0>VSUUx$JahzkeT{s(*c3VEuk;gf8NrNyD+P~M4LGy{r1c74?8MYKg*Rg)?VAr
z=5qehx18jC7sO8pX*}oVdldQF)Qvf6`qV&|jbS$;%leNVUHyDLUkTHmo=w+7Ck44J
zIm)%4>E*1(<gjU7Vqdo>#qWLHoNn&L&BrL$Hg|W2>EiCM6FltX&iz(Xle16Z**oC{
zGq=%);$87O)`Z!o9DTh?C!P7!#TCb!&&>Q<lUQcGp4Gg+sb0I!?c&+XhuxIk_sM+@
zyy|lQ-qXT&%Wkf1KBTl|(xSrFoi*l1HfPr;XDwJ*u;Ai>l=V-188i;>vg(=kHRr#-
zU|>_x?N;LnmsbB+b}H*#&URH_5wll^Se&ZGw%K)D;1X}U)h5Hr+tKgq!Z~}wmQQT?
zMwg#0t$en`-$1_nht)IYKLKH;`_4QKIMd_#KzQa%<@$B3yt~fs2&(_v!f4w&=W^+^
z6b0*sU|r`OrD=BGzwc=24AoWNTAy=~En|=R_NhM8<0EeO?{DO3PW4sG={>Tc_i*;^
z_lA=nxUQLXwc9Pw=fKMF?bBPh?Avy)5og(5a`i(=xRcVV%_S>3-%Z)bQds^eufc~u
z)yM42v?&+G=30F-+V^gevuAtg%<2<~?rVLYIexo(c;;H$Z!TXfCGYjj-O|`{(M4zB
z0gamZD^q99zkWJ1EJ?~v?5|}vL*{G-6V7!rCVtz*s=4_k%ZAetl4f0!Z|t`fKG-!~
zvP#$~_^hQ?9{<M8-0Njqm&I^TUSB%R&+Gmp-@>%G68#|U-d<*#i+-YWZ|KGSX`d2v
zZv)e=Q+Ioc7AwEmzIyM)c6M9lYcoaaHMIBKi@Be{Z_U?Xq?}&-a_!9x9Q!?1Ug&M!
z&inR9vPje2r1y(9KYsG!P0u7D*W-cJGjuqaUi&gz*x6bAd!|xZS5^1r>P=4OUx(PY
zNL;+N{Qty{rg|EjU!G6e{P}iZ<I$A~&6Z`)B96pqzGHHmF6y>$Yk|pp`<$oo*#Z)r
z`?t0}-+0kNP&P{Jx>A?+!O|0l&hDOPWg+tAwD#^pDH*%Id~4FLws@oTzl(F$KmL|d
zCW|)x^AAs3>7Ui@U9j%Jo{Q|o?v^|G&p4kxGUc#pkhS;GMap7}tNraFpPiVJ^)2pZ
z_J(g7w=O+ndi6&1VFh<dYh;S&4QD>Dr(E;;Tg^|{7`cRO`c!|~P9o;4_o^$W&Zume
z-Il%g`Q1xzH6_pX+;Q7HX=|`r<tL9R6}NUcZdKY49_Ai-UM@W8dY!z9uQX@MT5gZ}
zo9v(1ZZ_r1-<~whTk!cd%Ve>Qb?rZ&TQj|i-Q(3~`()MbpH(}yUbm=u&>k7`xccJM
zbZP#e!;`kCd)(k`iE;Z`^Sr9#mCuB<)ZfR~xH{NH*#DWg-($DF?%iqC+S4B{`_Qx2
zJX=|p_y2~cC;iwLy|<8MW_Jt=<gkoC_d7?j|EQ(q>zOWoNe$OI_*rE$zvNDw!oer|
zWR^-m$(xG|4dt3Ao90HH@HC5FXtzV@V!+3>lN;EXSPq)xmCkid&Pu=5^?!9r-}EwR
z_U4nJ7p%6<-P!gr;jXQN(e+8+Tf}~wZ`j2l+`tyCUN%Mf{*Rn3mMS(fe%G1qH1Hhx
z*On=EEa`W{KCugNJO(<GE;j_LY?Pn6qnc$Ozplu;HzE)BJihJfbdO#1Zl80<1%o>=
zQ!VdXRO)};FFxySW9gJhz7uNW{a#zU&HVk~)|dAukL@jvmYZ`yAw8<lp>g}A<c_uB
z2TjGyE-m&w`^L=o$Nqh+3_GNj8>p{r=<o3ho?*QC@!P}Ozb)e}kG-PpRp{&Zaz}l$
zg%jVkU4j$t?vZZs*|^Lz<JgI?TV0u#p1+dYa?<OA&f6Q&+nm16@!mWkxMBXJOc$ZR
z&zs|?A3vbEKFFa&W~W9DQ|hOO=B>7eGfp2AygZ{Xd~3-2>;CKbcxzN8tXi$U^UTca
zztdN_SK?>Iw(tbgolfP_>C6s#FQ2>JP~&fAKhf|)YX6G`9O-qzF|mw`?`&Y&8uMn0
z#F@!I)=jS3(3_n9n{QqXYoO8T%chs}m+MA5tJD?yZ^&!6aj9)Kdd2MU?6t|WEv4IK
z(z0V;#yPImkLS)RWuNZTn=`}acH$d><F9x5i(a<M>)l~JS@xr%+tJen0Xn5N8AWqf
z=FE8-`Sz(?<MQZ^!?rtx^ENT%p9#}ub=u1=S}SkXbt8Ul%eD}K(|PGZp^rAHl*L6g
zuec{FBas=pwC0dcWTuw!rx_XXk5i16M3lrj*GHOOcE5jW-Rb<OLyTMj_nGbXd1e)@
z&Qe<Y^}_D(oK?sB-n}zSpBt$AY}I4a?I+Z3d*~KlkzV&zFKUX`;bY%q{XMJ<-EV)X
zc=vSqy-St4x3y+}kPXbQajm<^cPH3otBJw0p9yuc_W~l1cv~#KykNI*v_I2R%ivDQ
zHCYzM%Cieo_9a&v&0EMG7IwgB`J@>;JN9k~llbAW=*gaoyLW2MO!GdrVN0ZyV*8pc
z3Qt3dLp5D@pX}GXx81<$IBSB|OrvXk>-+mnyToMTl_t*IV6mli<t>X&&5&PaO!=z>
zoOJy9&mVapl3<znEPqBP&)jPt<T#xt_MVM!h$}uDDl+TUTgSc?{{yo(vAnmxZIHR`
ztMnW1?P574$$W>-)n@G%nzn53R*tZuxH#{*YCQUDxqd#*DfXDFZlJ23aZ1AFb>6lv
zH|Om_*5Q|VxdYy}*R({P{JS}9B~$5*kVifD&KoS$PP_Br)XA#e-C@h_Y8XXCt<?!z
zVcM>4v3&EoiSG^PJfGmUCc->;dv4mrue_2@Wrr4>>zd~G-Oz1%)g4xiR`IUP)d|Zi
zg2Lo~*(u-n`O3KJYEz5Vrx~5;UosCgsE0q2wV5?F^~*d5#X04(`o5T4m^@>n!g;pz
z9t&^#Z&TheYv1{Jd*9)jtG(_%ueGA0xO2C)9kP(#_4eUq$7{TCZ;rA)>;A~!5H&X;
z^T*{&j~}!yzxyY7e(xF8)z9uNTYl`k*T<<o-|Vi(vIhOnyB<3``gzgiod>=iEUJB4
z^5^qZv$IoYGyckaSS21hWBDfD*iBX82lCSYR6AK06@0&TV7KPgKi%xImbdp$$WMRp
zmiw=a>4fT=kIohRT`jfy<nw1Y&u1F2&ix-0cluACX2Rj#l7rhr53AmNyUFq6Q&x>h
zzZUJxTvPA3F@4s`(7YYnJ?occwm#R5-LY1G_hi2tZ<E6}9<43jZF*^jwa0d$hd(T~
zd7NrL%^tMzwYH1yhHs&KYF5TaoFC|#Ja;L`%i+zcICpj7%QstYzI$|6`itVxduL^`
znH2)(7;`3Xv~qnrlY39bsU4T|a<5%oubQ)SO}Acpp9x>O@TYy3?gd=?)%C7m6JM1_
z?ui9eFXPVcwmtlkwebAsh5cUbvlm}qKVN^=rTZHl3(cQSUAW0RI@ihJD-ZLvzGDVy
zc`bag;TN|2ZSLHzx%;Y=WWe#SG9Aj+>*jnu;<&J|>^k%A%Nn2d&O7$u%>FM&Hiy@K
z)7WYlziXd?>E@eBkEcIBp079QegC<re-ob_l2~_9M(U>KZN@K}N`GsLk85^psd?ZZ
zrJpDL$?y1!rBY{?2b;f8d7d7~k-F=&1;@4Hw;k3k4_s}}v$rfJLB4ys%Ish<seK!!
zpK)EH{WM#uaF4e>&+(lsVh?mbnP@Lkc=_W~)$g_@mp`Xc4)BJz<$bxTGAlTA@9k5X
zmt?Fof?c1?KOD&~=f2(XLcj&ayTZYbl&vCH?V7WlW0za|KevC+gS33E7WV`O&M0<&
zFtvO}Oq9j<JC6cSyqqD_zhkMp>{JE6<^$6<7qY%t^KXB_^tA68`62r@WK3A^c`3DR
zLhk#}{eeE#fxhLpB%3CBmxpcm^3^B4@0v+inC#iYW{x=xHSOJRzpXTFjL_ZKa#*n>
zX{B0J<>vqVrTU9IYAuS=gFjt7Xd}?V_Ev00RPDOOOt$q;_8Dt+<=!qc?@IWcVqG;=
zjH}Gb=C5!^ZOg{|(yt9yrl0??sOsal-Iw=s=00iorRRKPVdjw)>%7DzIeuxn?s$Id
z3rB^a>glb`-((;6x4Nx&JbCU_YGdLWN%@JE{<c|Fz6X{h$sZEi@r#SY%3po`InU#c
zyZrvnF0nFy)L(xf?p?6U@<VqNj$OOllu|Tl<7tM<fQP!b*;Z{8_!tt)q<vV{d(K{q
z{^$t?qIy4H6n~3e8R+o8=8Cnx2cxQeQq!?D=fdB<nqE+GKw53Om-+rVAB2PW7+v>S
z)%SU_s-2p|*V-4cN9#zS;o4I<R#}ZD?sw-(G}xTI_S$6e8&|7NZlMJ!e>d-x*g9vc
zLmjLC=97&(R=sYu`tj%U={5VJ7OnpD=kt__KkoFz7%kh>U%Bt?^2a&yWjnT2on=^L
zG2`^6J!e!Mqa!M225tCSbME^4zwTzXe;&*K`*C!--HZv}_^T||rTlU%3`#8XI&$O2
zntyXGj>eQGYjS^l^HO-@q|Bvt;<uviyZ$~uS$uiA`pMPe`se)hCaw3=KgZZSt?vEC
zAC9kHOKmmbx_YkfUQKON>Hi<?PySrJZGK$++r5`presfUZtE0hR$DkhGeI%5__=YL
zc(CiP)wevKOuw|}wa#RrXNy{eX4TZbabMmTF?&;DuNqI*hqvqJ&VKT4R^xnm^(FdA
zJ-?#o=PryE=xu&J%jx!0`+L16vxD{4uB>g3e%JHa?xdy#OZ2jUMC$^xw<kp&@pbIZ
z4qhag?HOSoGW&QY`=xi&*0^z$?Rl*GVd3TTYZlJ+pI>*X@;lSJCl5X<bQFHptGc#t
z{ob_~Kin@1;;4wbD=2+?mS53TK_2yR={)1T$%i*Q>0M!U_0^+<$9<n~>R<SqyYa)C
z`A?R=-63AIclUgccfE<%SF2{;h@ViwZ@qZ;I!(Q{C09aUzf&?}|Np@C$!z@w<>=#G
z)4Sj4>aI;|nX~53!mn?SulsFoU!kSW*sJeZw~Sl()^>-C!>T8^uS-6A$Lh#(SH`E5
z>-G|xTZXJE8w}=X1?!Z)nE)DGWLlDXygqT>q7(HA9bd2L-jdP2;J<o~Q~SqF9F2lp
z`?hUXl#1&=r`K2UM0w{;i^^@!yFNyK^~qWD<UNnl@pXkOO6S{2<v%FO)joYo<8J1b
z2j9P)`<u(iR(sn}_s6zfVZ}R+Y%t#RN@}{f&pt)Rs-OM7y0a#)IW51Y-Qd92Z~Nx{
zVpdtaS@W2&^+6ejg&+NQvnIaadc>(?ID4i;|EV=Q=h-DV7u>fy!{;!0F3<D3YPaUB
z)hKk>oTR<qY{q@}b;o8^+s%$V?k1&K`^YK2m5J}t<!61{0+^=uO;3%gEG}mcPGA>V
zn!3OFTgKzm8S4x`+L@hscXftU3=0S6nXS!LrxX7zT;{R;;y06vsttt|8J651AC~P^
z$n!g`m-kEeZ9~-hXD5u$-DVfcmbz0F_3mQwtP^(aMZ2HP&eFFtJG!&XA|h}8<*6M<
z;sT==eO|R|_lg{`)i1fvh9BJ5vt!oX%r{|niOZdi`c-e(`il8?s^{+otF>=G5B52|
z>&SFn!Js;;w%Us&YbX8Rc}8nn!2{mzI{ByWXZYIR`D^lcZ2Z4@je(?llzy$~k+V~u
z?4B0EcHm8s!J+B1*FU@BvvK#4-95%<*vb;->ng8GT|Q;WdFdA39^(lw{_&mavwk|c
zszdwz*L3r_2ciOQv%h$)lKr~4tyO%Uduard<-JLlCPjQ*Dxq*;QQI|_dy99<9Ia$D
z{nlG6&l|Xc!**?N!)>3JAu&^*vhVvCBCZ}0zTw&0N0T+(z07w1DtVQ$rO?!9&HfLP
zY~`IbMHgT0cp|}k^tqIevccR}8OGelH<>Iu>!HJ~#I}^-<GN6VyYCNaq{}{OIxX0{
zy2@>5B+E6G{Y8Aqbw+cnQ!W;*s!HJv`{wn-bB94|VBa;}c1P(T)5lS<-%@loozd9R
zTrf?Rn|1k7k+bXXab;-+_AfI_h`T+pG~r>z)2p9X3D)`Z9W{Bv`&cYydisXhY?}^t
z_~po1y^x%r7_`N1&aMhmcR}@yhtJIvm0b8-|6JcbyZj;>26o<{BfEQACcpcTYIyF0
z<@Jo0M?}&-=FMKT(c9|Sr#JsHw%PP<JGgcBaZcGZEvv4_(_H&B`0N8z@AWdzVGf)V
zd~Eq%zNWiNJm$7ch)$WDdH2^+-`n4J`<?sw=aKZ|Wj)6H<(cYrW%uODy}o7y+^evD
zaqNiM2JIT>+gckfX6!T7Eb++__OtR?bZ=3J*5~!xmj0dYpKqni*XDD*ihG&%+>FIb
zo=#ZrrsSL~HSM92n1H`l(iEGck{ZvXe<!F~Jg{|ge^t}){^8uSso!_U`(3$t%Z6*Q
z;BNETm&H!{UMkJ>-D5M|Y$vCYxarCZp(meNaK>mZzwB(OlkfXZ)Lwha-k#$|8^2oI
z7d1WY{wCwz)Mggrz`Kg<SDiQZw<pQ$-rU2W_kEB4kF%46;)0rWcE5V8cYm%&-HMW%
zTzB6rdq2xyS8WhqvJ(sU$9R*QKmV@ZCG%6c@Wo%QR4pU((4FNmazPoLo}N!#s)U(q
zc05gf5}*IcEp4SsZSc4GTc60K?7f@4Fva)V8;0py3m5&Jy!?CJ=6R<Bm}{=CI6QZ^
zRpFcDPZNBPuR3$Ft<9Bf>g@Op-(UHZzYk*Ot$S;l`}zv=!-rOH)=k;xo%r|bVR3cV
ztDa&{d#|5bd;GiOhcDN6u0Mb2p6R+zFAnqS&wsAJ<$14XZqW43Rcf=DIqzvrn>BCq
zxBkArVYd_SRNCB~W+<jB%3W3Qm?y5whs$m5AB)+Gt6Y9L_I(dF+C7)QB5zx4+F51w
z<&0-MybeloX>g}4spJUf*(LIo>)%A<9gf;1cl+P6XeRFBJKgvtb;`#TD^?rjn`tk$
zSFoHG!x=e4t-nO(F&nF6`MPV2M^m*Gqn3)j;a~mNNZ0D(?9bOvn4EiA`6SV;+Hk3W
zf#8#X8T$Tw5>vOz-o2VS|J;%Os0TVZcX(KrsW)6m__28JzOMI&)_$De7|<(szUk2K
zHD_`rUGC*dlg+>MuI#vhMO<9f%GDzFw^N>e*)lb3x}V`0D?$0S4}GOlU!^X3EG6;u
zo=v$)_I~Zxm)p41SG;WZtX{bJOY)=~wr8`{?JBF<Zr9C!c`5VHj?LR&CP*3IDd;H9
zepiz|H!@32#_o-=(3dZ2^?}XqoW(DjO{Py-$ac-#Wn;>RwIzAGuQ4aykBHIfo#fAU
zL6^fjDzW&+wFh4$778q0E5rZNIWod_xpnvTs;9dJ=KgV<eM<T}i+fzrB4%^5<<pWS
z__y5u&Z?Eq;J}=u)bF>YY)_QolJ^r+P6=<AQ_bJtvoM?g$Gik%gS(N8|MzU(v&_Nc
z&AS&LBmzH0J;<`!{J^6kVE6Mk0uBtzvVJ&D$Seyu<j^2;`nAz<X-?fz{@LsErgfz3
zJP^@%#P`#a8%G>lDo!dg8<ako(%H4!>aO~A@s79Jx6LOSH>u6tvgHGJaH#X`I<Z(;
zmnS^(Q)D_DC95VxJg8U{D8u>P@Wb4~llpDWr}_dqe`am`<iuyO<&=uUgL#$82i%W4
zf9&(#C+`1aVt1v@POZ(Hk|ICu-kTSBa(bnuU$HIY6$Z|I_uh-VbXj=VA**;v<YVtw
z9|Wo$pBW}@Zcf+cy)Sa?``lCsUd?{4y{iP2_vRPs$y)uNRkWwKdB>z+zd2JrKbkFL
zwPkkUC1>O3Z`#bJW(B3Pw7#2dktw<8V$Jb1HW6vN#M;{HtWzFlKKmH2bzoBB;R4&Z
z?$XbtQ`i2v!Jc@YM|A2V3#SFIOQR~q*9UMqFF0&^IwJa($>#Jc68^OoTLP@Y*4pXp
zX}Qek@<84$@W#HpLKdOcce9r|<lkR$<X!FQ=((Q{lvrJFZ@a#eK`rk2C%^Z*Vvec`
zY!JU?d-CR{)0VrY#<E-sd8WBA^pqX5^WRf~&$_Cwp5i&O;`qO**6+G1l@_^8kYZ)8
zSrRM#lHv3v!`%z~r*l7@*ZTQx!RhTzeMjBdP3K2NFIqO;vF6v^@9X#3TKa$3QuC?p
zO36dkgpl8J&DSk{ocX%%Y{?<ZHET{k-oi95bfeV=H@B%**kiA+`gfyrSu5{?QyK#8
zxl1g5Jr0WJd}Q_Sg_w*+pKKqWe#OF`@NUIdKCy0E%hMY^^`7~BqcP2i`Qw((hsmX$
z&z(vx<!+f>5zel#=FCkwZH8ldLEE$zF+OKJcTu8x@_{>ci>L3f{{H2|#(<4?#h8UZ
z2%lfW9H*;ne3@^DsqEie8B4}5_x_`8ayyosaY0a?f#J{|1_qqx1Sc01=oM7HwapE`
z?Y8;;Ptjcuo8L%BCoEV}_{wg&g~`(?Dsvnzefjj`$Hb>w*D87Mo5Zt2=HKtRGixud
zQ`xVo;wxP2C+&S}uI$-!=Wh3<ZD0F&v$*`L<@=5wYPstFOULJL<M~I+N=*v)3a)-{
zxjXuHnDwkPN%a<9Yxmwg7AO1f`;lD|hOb4v7hQO@Ia|zSvSG=#pl5yCx3LwPY}<AB
zpvl~0Yi@7-^HHTM_%!cfjnZIyuE}e43-b+l_nLGyx!mgzN`JIWxpL+?wK|I}caH25
zD3EnO)U75H_U@ZSN86`+5{5i~=GC}K$ltH(*>!DAwwU^d#jjl-cS;*uvc&yjw3+-@
zD_ZOi@8Qhv$J{GCd-HlGXP@75S<JR~^|y}7@b!!AR_BI3<%q2+mbvYF`Nn(S;AL*v
z^*=8BeR}tG+4mQZ9=$#Jxm^7CbJNvx_p2)O{*AWxktsLgoWWAiA}%yF{Kf*ccXQ{?
zUH-QvZ|2{<2lfa3y}i6Z@%Qsvl^@q;vF$${y>wqrabeKCL%qkjZda^1(Iy`EpzZLd
zxa)OBrOhgHzy0+%`|{`SvTOT&=Qe+OXVAFm`sspMrH8ovW=i=Qo%t`3_Uu@%^Mifs
zr1_sVpFFZ7yXpJkDXc{e!h0AFSZQYec~@Q4U0l`8I^~#o;F4>ZO7|x%&iR()s6S83
z&uZD~q92nN&RVj0dU0B3udx0%bxm$jm(t}eoyT-~7fXx9tKMvyTz-mO<D10&3ONIJ
z@p;QWPSKy(vNTEPgXV0XJ(rFvgtA?0E&h1?X5sd~uM2-~pL|_^_7;Iw3jrZ#MRVV~
zaR=&>jjz=^_s9K+t1_Hzus3+VZv@Api=Q`({&KoE`=xGV#aq{h2f{ah<7!zUziD!T
zz|&hl3q>X!nUZog@1-uY{T?PmmH(lK&pVaBsa{?Zo*zG<T&D4x29xA^^EbYK7wAXZ
z9`EK}py17`=w|%qj_-`Cr#e~0RMuE-&%N?{a^=fw*Dk)y{Ql?BQOi5Kw(LFLKmT9G
zb)7#OtF`Ojbj$b7{PS`8pNkXh`JVKvKRP~7yZ+57d7*Rn7T!I1td@tFKPO^Gx#z9@
zIVRTMx0!Y%aj(;{-;%OBhW~dIZ~fY1`@=Y5RyTeOf6(;6@92w1i#BiFdNrL{o8_L0
z=s~yGgH@ttS%*GsXqlKe`@q`eb(7)_&Goyw>VMAOJ}1YBgjBOlQM#wu49+|=|HyB>
zXa_snnj2poC9cj4$>@w-nx^w$??c)5Z(1g7es9dNLQz)nm=<$Oyt`snYSwyr#!oA!
z`lugKD9<U$Um3V&qV%^$<@UZ*?HR}B|8+OndhFeqU4<7lI&>lycJTlCwViiL;c~}c
z`L`L5u;smCTO04NZ1byYVjX)_Hae{HT(@eA??=u0(4VIjCQkkJrfNl+=lU=qF`g_j
z9U-?XYL^b}m*l)uam}QlUs6IlaptSigvbzqkWRjRM}E&;)pR5?rP0N*@3F=?-iN<9
zPtR0v_*ecgRN`*SG!u?Z=9}d1D*pNHZm^bxbLqb;vX7)TJBr?n?&69S=%~B(w#%Gd
zkn4)Ujn!-?7~@qk->oxfWC=g?>P6qq3mLO6El&ICdA)lv%Z_dAV$o|YzS^DGxhyq1
z=)7L$(NxK#gQ@GJV{WxMY_|STw?n|oihr5og;0%bg%7DN+q2xh<-TUIIKoupaBJ_&
zznp7Q3)Q3>JzugJ7XLPW<Y&K@@p^li*19zrQp~#RBNsJzJ}dU>T>E0RM^?aQw=0^J
zi+ie?_UQgxtmbj`(SMy+t0ymA8lSQzbB)SpQI_(*{DEvHpEO=+A7gs<{@dRap&gso
zrR?t#S2?Px8aCl>-JghLpEvSuu@iRGy_h)dnR8NkFF$vJ-rFjPk8up^gV_YW#E5%-
z77SRpn$xtfQN~!$>ByFQE+0krROy7ZE!)y~+_X0LIg9zf%7izUl~m(iGtQ3Hl>RC?
zqf<fV?}j4TpMO`Cs!zOKn|AlV^_I^T%4UAy?i;wPtXFva;kn{)<@2;F0x2vKZxqr5
z=dbc~)_lY2;p)6$<ATD?4|bnf{&riayibJ9x5-ELr)^l(^g_+?X}Ei~MiYC&aUoZS
zf8B{|XHR_J*wj>ZCfW1RF=Jl2S1&e7pVN7u+Wo;>=JlE0;QO=L@?_3rg>n5;U-R%C
zN0`AL7bEHKiyF4Gu8`9CpjXIraKq-jnuNES8cPIwxUF~s_7<jdYAD)!%wf8_{6o;x
zRmS}h$x5e^pJ=}QTDnZ@fjWmxP}j<|kL-_<gf=(UpVk*!Q#Rwh4EMD)|Kn~vH0!;)
zZi~geRs{(?&jYhoJvfwk_{l=gn#!5;|Mgwmw%NgDwf)@!vy`n2Dd}Nb)-rIJ?Vi!J
zy~?wyZA<ULyj;7}%mSCqe3o2YH~I4^&y}}$7iHdHzvlk%4*QEDyY9_Kk8aJ4KN-0o
zb?b|-(}Z_V{rgA4!Rl|+FITlIjci|LE!}p;)h6}RU-5wc(;5+l>!unB=p-C|^<i`Q
zfvZ_vmY+*6o_U`lCKkh&b9>+8CwtBtFie#5ag_Q~;@-0Vf28d!H4UwIKV0tEpT2Oy
z)5kgG-eHBMM!`C_mQ4Dz^UsQzkp`SIKemS1A7yjcst}MV(P4c(&)_Og;FI*ZbM+UP
zpK!jgTSslD+R|QDW9}>)*1%TbQ1*zm{Phc%4MO{r{vG^dxZzUoLzx$1%Q?GjJ_v1C
zZlZK_fd;c+{)Vaur)&RA9x9dcT-$kn>SC3tS|=ZWQDb_wD`AhC)hFI`zxgx%-oMf>
z$rZI^-=SS<F8lv2lCt^n_+4__^%JgZm5zK<VM;65!dKmQbe*AHBTw$vzxy)IyFc9!
z5X;bDc+|jAbLj!^3rb2|{flSJ<T$cmQp4kpEY>}i6Bt-HRvAaw<vnUNcsW^Y<}sba
zygg_2esG9qa44|<)@U(ccvZSE_?PgV-#a%&*G?<cKR4~*Zc)y|3HQ8{ms!UoZ~r88
zJ9B?!X<1QK%+VJwkHl<oSkrm<I+uB9)U~|L8w5`HzuA0GWUou+z6d?HgiA+u8E@E;
zzi9T);~#g%>K?fGWTK{3h{(gsZnb~Y{w;VC#q~Rkb@p6^d1amkVXJOx$^A&&fBW*Z
zO*?y@S4_Gs!sVWQtDHIWSM!!x9}av?5prMWzV7`ER#j65-fsS?b>&N=Z6u~Wd_ARI
zW`lE??dF41{Z34Kd9-d8+nJ4Zjjo-62IgN(O!u5+-m7p^)2*XhD%JhIJWoVVjIM!;
zjF7^C8EZDZWVzS5Gx_zGFMqXVB_8zX7H+)PqqO1nFP+pozO9*`Y)|iXEKi=cu#`#T
z;3J0Tt&MdT9sXMSUf7wmWQ)XW<vY{gnq|rLX;s8Lnwnd3C@81FP0zwffzi~%t}Uz}
z@VN0Ip3JT<A=y`Bn)l1hoo8pC^}nrfg>|#P%bb-fn}VKQPPCYM{$=_`*7>WKaV1Xu
zY9H{oTel)$<w~Xa)W7pn{&MS9XslYfC`tA2&*FcZFEq8EbNL@v`Ty^l`h~3hJ39Zx
zRsKJ`X8*lMao646X7-%vY^y!<<Q8M5eCvTIC9YPbuuopTF56Cav8$b0?KEkj9qZ48
z)W5B_qcfjgS~kJTtEXX)QuT@dCl}qRczW!y!rRr$M6Rr7Klt^=y9_CjihvWWmjVqY
z9L!o4aeLZ9zeC|IPOdu|w@iKXpv3H=65kK?yIC6z<W46VhfL72O9~L|&r;J1iY-~C
z7S^WXs=Bo8!{<{?zZb9?A8!cI?J8>AeNpFdwVw@7t)1$(se%g56I&LCFnupOw{mJ=
zm?+PN=f{6+osiWsYiVjljZo0Ch;=u3ZY!u>SQ%=kxaG~E&0V}4nN=K#R+l~H&%Er?
zEL~6-oEK;Hz9Ig6aAQ>KqAF9-8SAo6t2XPb=wi+}IU`d%;lPslzihdVgmWcU&X8sL
z@Z#cPag{^H-Ns6%^*>Y}n6A-VXf7;v;PG)jlXEY$7uy?sVd{E&i~V;<hG&tN>HIA|
z!F`uXCYh9%Ib>Fb3uY{G6u7%!?dHet-k9^%|Jb;3`|4T6^1MHTR_H_*COtb8dc`?n
zm04oo-aBt6WHNG}^<Q+j`S6(opC;?=d;WIqoRdQ76V@?AegE>ra^2$Z$Meto-`iux
z9w1P-d8w=StP7{v9!L~8iTx4I*nB`u(Y`|OZlKzy9oH2KLN6?v@@MJ8Sv|}F<&Ux+
zH+Y(LKClru-g_|X<?q5tx;K=Ko=q%1{x4qdzN7l$ImdYp*6=dD%NNRsdS|+6(#8DE
z8RtEtggGnf_ON>V%r^OuQ1WLY@AWx53}>i(NpoNLuc)ZqbE`_=q$eq!liBN!-maWd
zm+*B5XS1W`S?#c%b3eb7r?n<56nK^3Td3_kp=I~x19J`cNZ(3Pc3Z7}=1f1!cRP~;
zgJ&$FlRropMf+G*rTlp9Z@?kT`=lgegNj(571M5wnTPTnn64FR>`Bk_p1ADJ!IQ4L
z_#O)FX&1<!ooKdacBHqA1)J!}nesQjUf#X$hOu(0SN1WEj>OwsmDkMzEX$G$df#TL
zFJ9JB&uo+Nv}5&?pi_a8^5?^*1U%d{|NK*X{_vY3l5>31zJ=wn3hmjc#1+1F-L9W6
zGTs+2Nf-SQ?!u{O9a?+g(uFR+6~|pxJm6Efb6fWC@w(5Ce1$6+B@VEDlTWM8_#d@~
z_2B!NY<D(2VB3DQM(CPqkks?~wr!iYO)+#hGeI<Ss?`d$r_W}ckO{EPu{@jjOza9*
zCwrv-%D{cg->O%HKe-oUBCOlxEqC_ljTg;t<1&x@yJ4%obLtk06Ry$0JMS)=`fW<d
zvlELoGNx`7JJchT5pv+dy8nFJ^tG=4dSA!Eb@2Ul^?N7YWjJwOTXpaGIk)N0Hf?^f
zH0R4LE@r(q8^f<PAOBvz{6Y8LiX(rQ{(Y&czUF<~%J;gB#~N-J2dsP0Vq)3x#_jpP
z&(V8V&)%CeWpkDOL$jjId5@STe^E+&BDLPP!O%$Q*t;Z;9ZUkNEYpRSMjNs=%BZQo
zujtA=arc|Y1eLYk^8y1e-)g+x{(o^u=MiI>y-VNAFJHNziFID{g`~V6o+cK2g<)&A
zi;Ju8EI)kXmX$|vjjm_2e#?)aM_0N!2dyw_-+kuagzG`}i$jVWn(j8t>&r7(*0a+3
zmvFvWOZ(J0&v$-#>Uu0qFT>*f-}9FxB;IQD-Hnvwy|$2fIqR{{cX#AB?%6!$Y|Ao5
zbES4Yx369y)2G#09hW>Jy)0mY{`&XtmrZ%eIxFb(?@ifDcXyrK!fqyV>sImAt1<SA
zCp<Xvz1`?c;@uOKmwdhEs1@-Xxg?Y(c|6M9^SaKQ+0z?>efBeXoY@=2!E@vulR;(n
zHUE?q+nV%`nwzfXj@l>~Dcn8l#Px{>LN0&WV?3`YZJjaap%{m>wwvAWyuY;A*Sy$g
zQTOj%>gt90Di7s<dOwJ}xg$N<bNfuG=GTvRO2jVMdn{9;d8?CBjuacun!v<!NjcJc
zo%gx+|F(D_^xQeasN%wR;r>a*GCZd&18wejmM_VVEPrjl?)*XeHOH!Z>mLhD_MCff
z%e@udPg&o7aFqSt`l>F7-Fx@D<reo#om##xTYjhS=Ff+jk54{4SI4*Vdf=%a&xG~}
z<~hwivMTa!cz&D=cT$1@_ez(a3fC@v7Cvs}xa-3Si#DfEh1+B5taKCHXI6bXzxG&v
zndco{`^F@%I@_w>kA8eT`FeUw$m&04$FG|GWRVqoa@)10X=aC$__L+L{^y=*U!CBm
zG-1YcpIHf7Zf17fA(Q$I=k2bzn>;0-^=DwrI*}Qs(@eCiB;N1uvYc1>>eG+xlWd{4
z){B)KjLDjPGAQ0hux6Fr{jg4Jy_wauXPzEZXb`Zvsb}fB_>3!yNn>ZU(eg_Q5s7i9
zpHJ&=(hHfC-CdAaa__;Wn}%{pCdwOjNKTld^Z1a3V_)-@NOyrsza3|uo-J&!;%+c-
zt<<S`HECtM#oA5fl6DU^@2NPO+9@bf>9||2?#J>Tho;R^?i^=5YA5WRIb%8JuLL1u
z#g5-M|9mnreAW9{^I~;LUEQB=kDi=;T^!y0cvg~MebJv^FMht<cyDd+4L$X5f_l2C
zESC>(E4iv(UeFvRv1-wld_k*u-ghQlXT3YeFru*h?_<#}yEjp%o=ji-nfrE1m6u<9
z-*JBJM}aeJln!m0YVgr5c7ykqr3McfZ3R0Y-DbEs?|)3{q|Xa@4=^ohN%Q#kR3zhx
z=7ha}85FMX4DqNnPc5CfbLtJ**M`>_cE-hMcW68aw6XL3-5QbbuZ`#9&lMuQy%%|e
zYQv_nZ@I*tvDL{SXpcVI>8lJk+1-CJ>^wig%Q16Bw)LJr-?p($f9@e-q_U>K>fOWR
z0txq8W&Rnzw$FJ}8TR*=ea&WNNmp|wx!h#|Z|=V7zwldRar%XYmzYh}8m_n={=Xvj
z+$!aUxyH-h+*Q=rpV?n_Qf>1JekZ5D-OE0hI7*y6cX0AyTRp+WGa>^u6fOqXUu|r*
zmECzn@v>-56GQ0hf)qn@z8Z&cvjgA$N!-08m;0Qf;+VEtSn~OsrDd6u7k+H1>)NBg
zFY>&(dqu*m>b;yx-<@MIxpn{fN?V)B%;j4GW<6&8w7Jc{Uz2+$xA5NW`sL3Gn(Ffu
zm3m{XtLrlC?w3oQ`*->MhsmA#(woK3HB}V`H%xt3nxP%IvYy{uYNBPs&kROIb3vDj
zZn-&6*v@r_Ixk{kw&-2Xx-qIt^#6{?RKqNfe|I*CEQ!(h<IVa;^!=KTy&iq?QIGDo
zHva29|IM{_n~!xhYwxVzdRF^I+c%^reaSz=&!F^v!MvLCruWgeb5Cz}_@}IQGjH?x
zZ8y_@vwgpL=8M%8rw<+b?bMGZS@x~XewtYxs=QIfys7yr>k`4JleNd!*~RPsj@avL
zsvK35?dKG`Eq?RGb*nS4>qLrv%{=Bde@DKt{LMpcXS#Ol#AgPCb$4^DZWec(IbVE<
zxToQ&<s!Tj-=92nV+o6-Th}qk*)0psr>zLN)|71<cTiWP-X-SiQCGJ8M$7erzCLVt
zo~0eSTKe;AZKM5WnSSx9vxNWLPrM#jaCU{8@9AZ!UwBn4*5(-I8_hA3^!sc)$Ih(y
zsqm!5MLoMc>u##-uQ`5Fzq0Oj%ApgTcT*1K7$xqT>N6uIi_1XMM_KHfQhZ3rpT_%(
z_H4dfEbL~s<V4TOLje)pVcgD{OEdR>_qe=WOzYCJZ2|oO28XjJu<ZN&I&$}JC4Yf}
zd7p)Y?!U`;l>5zYe`ego;@>;D9UAU-s_pJrzu;v~)&JG+d8UTwn>hyV6yfU$pLa9d
z-qIm5YT2~V&XuXG@gfF?w_X2!dfMB~wG+>pOkU8<9n<0Utcq(v;O#%v;e4}mIh^BW
zocVav^_be4J+FS(pB0P}%<$Oq>+8&zn3E;t-^%9Ry}Re{x(9Y*4O6!Tw0@NC{o0;&
zAz(`P?j=9{FI44=9x+;K8ZAFR)ICD_!#}SEd#1<DQyKnG)%>*8{YT<d!EblIGRm)G
zsR%FU_%A7G{z)~=YuU|dr4LsWlq~F!xEjU1M{v#GSyvZ(UC>EebwTF3{<Iq{YXZet
zTM`}Xr_Ps;H0Rm;f1?-o?zt@co-b!$%x+i}v{dfLj=mt%h)l0(Kg3rF>2D3XQ1$is
z)-0RZPv@F`oqshuE@s_N<It>QPW_KWHTw>0#>*X7ycsS0)aq)tD3kflTX)z3pGL?>
z9{ef%+Du<tWKWA}YOVF1FD%)*LRT3p9gA0en4Y%hi|PA1&7!(*E^A85o9zzE-CCr(
z`cK~RH0zi0yXUIZ1X%6yE_XbA{>QI<vKRBuPS%<IxN_$AEc?Z?Mc1=zUVUzTj<1le
zU(N2D;+iq{R@fc8Y}ocAak=H0!zu?pZrQl+J>TmhZf@=m$HKigU7Ys(*hB6${N-Ec
z?ELyr>SnR`q+e#4>G6Rz36smd9dP8`;9RI1@!sjbS@|Uv{bH-5pQh#ba7I769241I
zS02Bf*MDo(2Jd4Q7Y|rvZVwf#*uxh6N9z1k(bD+kAI^omjbk?9Sv0TP^~uL<?|_pb
z$ELVB>vMZgQG4+{skR_aZcaGIAv6E_GmA`rM)Y<aNuN|aW2+|T#`P~t{x{sW7O#01
zv%!J;|LocOo!2hpd9%Lrz(XyLHL^=8g4nipyuDR8d%0h-<~Fw{i%Vj%60;8Jt>1L_
zsxapyF1;PIn)DfRUoFes#PvK~^qg%`u;1xP$>yv*rk8lP#z}ww@V=PebL9f%9lP_N
zp657dztDYFR{!=JPOm1UZL7>S*%fcF_LH|6FR#}cq4kY<FHc?mbG63Ltxi}@eREZ#
z<l7aztjh|*%C1%Z^kgsTzwUHgNJaSBPv-lRpT637tLDvjNl}@D%mqIUizW$9e)FUG
zdv2unlHadhoJkNo=oi*Hf16v#sT<C6s%z$%OSLX%zje9!&}H>om(_nRFWJ^zv1|M6
zdM!WYFkQKi(*0k`xNHUMO+N;|IJunt=W_oq%l(V|Evp`_?3~{?FJt22^;dX*@BUFe
zTb@Iqs6dl*`t|J>&&`V2`)<vjB;~^^Le*{<2v6BRPtoQ{rEY}({q7{TWBsdtPLJ*B
z`%ovUX?8I)LLgMXwPRTzmpIF;D1|3oj9&BJJbloZCK|0Qdtvr`uI8EhA_aVkn}2F9
zs}U<)^UUdZl<eWqqKt3H6z^L+c^y{s??nH?u<s}BpDAnHI-*g>_;u>Dyjo+qtIWBf
zwhhVO3f}p51}jhh&%~en{73i%_FbzY?y4W!SGqn=Kgi@KU&hx>7jMPqyxmh1eSeCi
z-t&et-vfI$U0#{V@7k9WwRL)hQ;gms<NveyYOUD5@qNi{@+@bseb;SzbJIuhvzgac
z?dyux&ip3ue0u$l4+~Egn|(+qxUlWs)KxL_T&_v@M+!wdINW;4aQ^3{P_B>OY_;Ou
z^Owh1_{QYQ>K@;_>f9?!>ui%ggO^(iH>}!xxO$Pmbz5~WuE*!X8>}?aCLj2^!YFyM
z;~kHKF?(zZERJxy_8pM_{YOEu=lLh52^{>fYH`2+EU8`9HCtUdT&^iwM*jPDJ@>d3
zduKlV-7?YZ_QFMzT?{8SD;_%Ed(4=}ez)eeu%#8n_K%GHo|^`rthSXp=g-bITRm|3
z^fdN0oXHN;*q$DIeaw+}r-$X7IWvrek6iEnyXpsDan>~J1CwUFKmWZ<+J4XN^;x_L
zD_#F=(W&E^A^qvC-hr|PR!2?~*?BRG+a6h%*rfL?`p4w#E*`jAwPWq;GiSuLVzkyh
zyjCD1t~p0&Lh+wjHadcaO+R-|j@#pPc8@vxLg8-LYZCl5ziUmlf8J?3XXUA~J5T59
z?&$TG*&r$XKr#0`PhZd-m7N)aM>tBHx_|#?uK2w`^;`3m&o|_MZRmRvR&>$!)U@nb
zYtI(tw&*^6xps%P?pG#z=kQqB8<8eHHEPFxWy!}dI|XjIJ*)I|zry~bHw^^dJvq9D
zbDc?7%8|vNgtl!nc@Uz!bNiw1?ipw5Z|e7V#Z2(#&^-G;;FI`4amSoVj$2X$YF~Yp
zC^C|=UVA>>=z2pjZ|&jNQF|?RB`FrPm~$@U{HJbrUm!@TLegiE%ayog6N+zYuKIhz
zTV@7Z#r=#4L5&$=*Os5;`;qp?VanVYfxg-OZ~r{KdNt$!u5UMexqoiHXL0AM!u*F(
z6H8|lRvfb}xbF2h(~4;phf8)zlg)*j?Z^A{jHkb2j@ltu@!*ZD+#6B54NH&Z6+AvC
zq}u;!yFqC3^ZLEZ+-!FTr=_i#yD@Re@6$6nC;hqpbIqSzMJ=7gq=kNJyE|Tmt#_TA
z<eSvleK>ETxK^6kK90H9dMxsn@8a01F5f#VSjQ#)$h%!XT4!^_m#=!=w|%>m>5u2d
zN<8;8D|l+McSz*xaQ{y|cy#^JCm)+FJAU@AziP){`RdI(t7`V@-a~DB6JOtWqT;bw
zY!0(f5$kSuxhd~XeJ*@E$1rKfS^4aiH3!q|rxuk;o$tDTGufs6Pl)}S&9`^vY5n_H
zu=cCm^XC%##b*4zx^MOT^9O$FE|@*N?%<+_Wj%Ej*&j}d^|Wlh)3LDWaH;-`{1Z7j
z({`GjPJRA<TX>Q1-U}%|g>D7^7pdBJ>Vkd$zH9bVrp<bHFlFz=8@X#%Kke?Y5}l<R
z6*T+m=krmv-044x*DcMJt98zIlxbpo$F#{#xY255QDETXYro<S-z=8;^7;Vd<5^p5
zViLNNl4Xy2EI9S)i(FNy__QL!GUM_yPO7a;8$xw_7hPQxZn|&Q6o2_kyZ*GdZV=aR
zpZe%l>zxIUo|_z7Tlv%Rj?&4#(<kOm+4xhe{eNxtL-E|K|J$?-Zl?V?74KL7?lZ@i
zBx6_iig#^)zVFmtRWZT(*xG4cO|$o#N3L&X$v62V{Wz-r%%7M`^}R87_uF>{yT5vP
zCB)Es%iE*d+pN2<OTYB3zd!5CwddPHYVxD=UA)#^HG9LQ`!Bm-S(*LhuimeO+X4l6
zm4EdJ%zZ4j?o3hJ`$cc}@_ne0sG8-s%&j-D&V6c41Ycpo^~(8SSAK6Uo&I&det%^>
z|D<N_KJLX{PmV70cw(+)qWACLuKNEyR+g89?npFze({Gh-S_HM$6(7_V!k`RmR`E9
zb+WZ}+xFeNXHVYB%DFpt@74alZ+G6i$}9KHd#7*Sspc>y^&OJN;?9vqrYF}|AI{m{
zarc+Ri%aH;0<6)BB|Dg$7Cl~g@1v;q;}>m5!>c4uF5bRg>sB*sluJtKoraj6<NsTZ
z^!27i&N&@8<7=xFo2sYH*BuX1+9Ib{FS%XT<xyq0?ogJnPpB2!Q-`N=9q-TVOSq7H
zv;5k0>8;7Odu};;JvW>AmF=_WC8ox5n|B-Q=6^l^;bdfW?!)71@w*m$bNi+H<G0%q
z`J$_Ce{zq+JN}8})_wmU?dtXwKTfi~WMyEuF2ukfh4Yl}V!eXOqtGM0-^CwP)W}%8
zZCV<K8OMnY=X`H3@D$f^+<4G{WtLTRj!KZi${Y7C{NJbiHR+_jZ;Z$cdls|G?;qYh
z+-s=*<lVQk@r$z$I!Z~z9#vR7gZqMF<y_-=2VUq{yq!B?<EiUWIzry({Nm^KemH;r
zi5+7Rvzw>TVdW)S=L2R&Bt)(^zpkYmXriC9P_e7yMA1^+#2~HHYXUBPsk%DL$nji`
zk;<|ePooMAmfhR5VUzdSPtU$vi5EG}Q2c&X&~bt#caY)g{vA{LowQ%(?2IWqaW`>m
zj@A?AjNtBnmF2&~mK1ECHf?Q|!@5l};^sk*vliYuf5gi}m?OC9YS4aT<sVz)cNuLx
z)jQeM{rMBS9shrSGm_fBU#5P?uOE7E1pkDD9i7nZ@@QwnvkT^5Z|&0M{4`P9QoK9r
z4cmGTj~$bWx2lF0Z)l&k?TJ~n=mU#D3BkQ`<`bRRj6e48-_r52mGk0E^QPOK8>>3*
zuW$W$e|d0`<G-&De%qP&&zxYQGWq3)4HsSpGj%U#iL+$1T6Lyv`j_lO>Bl+#m-K9~
zbo$}VKhtlfValBrzyAdeyt60BwAk{`GTNzegXsg4hWVD5p2R*$jU^ibub59b*Ul0)
z;Zbhu+i2-Y?mT6C?o9Z>Jy%;cHC3eLZo!Sm4F?WzbLO@x$_mALyyQAj`=R~3-LzlL
z7k2b}9a6|i@R_)Har1(WLi*dbZ8Th+eDT73iyI0Hq8%&c4o#2udSCy!B`rZ%)VxIJ
zfZIj`iO$z6o~=0_Y^<<2e(rba%O(jAC$;o-dd@f(J;jP=n%>P@KXN{tsroCn+}c9;
z*W!?sQ5sfnm8QBrv1VFz=vnJs1;yG)sSotOORiA9!mn8wnf2E2+wF;89q*`S^p@B3
zd|#}3d6MM%9lnlwKMW(HZ~2<Wxrb_J?C#l}xY|PA&0g_+VPNLL$XV-73Ux$yELBwd
zF+1eM5k>ZvJ<rw!PE0+tX7UrB#dTpf#BRha5lfcIZ|_+*C+eZrPRT`m4><J{_Nlm~
zI(%wBy5g14idNm$lRH{l7EMZ0|K`5Pa<l2l9h_wuiF)rjiZ{F{d9dQ;2SbG$*EY-+
z7Lz!=#nd}-vYl+~MaS;I<v|f0Maw?kyT~eRxwGSJkJoA5*;k&JIbF<~Y87F_Uz67A
zk?d3U*QLfv-F45QLyv4&JNIOzExf;VY3P<a?6%^QKk#@<iQTzq%3HqX^(y}lEaCsX
zmQMeALO8)8<(>EbxF2g;-k2|295{J%ftAD?%RhUpWU9+6&is7tKCk}W`TKo+dVj)x
zeN@r%QO~{;R4eK{iJ|-9%4*9AbNNn&PT<<n(zUBJBVRE;wBYcD+X-dr2jsQpEWO09
z%N_k$xNQ5i7cPGp*Y$4QHRIX3_tRE1X7B&nH>)=9Z9?+x9LdlOzIz2CFE7O3HYzzW
zdv$rHvxwNdI`49i7n7{2cXkyT?OV_~x4+I&yU-;}@AvMB52rUR6_a@IHK+ISa_L{c
zr(C+Lp_R7s!IC+?@AgQutJyqWRu!jhqb2zGO#^3ZYSR8g)8}5jD{8V*^!Luim7m=>
z^1O}iumqgtk+}Kqd0DsIgJUcwkGyQsf80Imfmz9hltbUlwP&R4h+yL{;(pT3U35z|
z*f=raeeq)d<LafI*PpZ&vfd3nwd>VlcJ4Fs!U3NaZMktbwPj&@`3?D!H5tAZcOO@Z
zRnOPIu(kKh1=hP;1Y52gaNNoq*v`<*>%{jvVtoMLC(hqLTJoQNE@IuYA?MjG$?FGJ
z9V=bD<dwkNUkj3NO?<e7-{_7AGpE4p6+HK|q;8+#HC}pYZqTP`iYsp$A6^r&g?paC
z)2J7U^Ni0|6k2_~x;N<C_U*xp<@b`WPMrJoitUN{;fddEKdS9cxcsd5kw<=<=4^KF
zzhVc^9G^9P;f4Rd`F`HAek_^a^GmWgaMz_SiQG>ou3kLx<G*yyqSms1^Bu}(yvt#K
zf9!GFCI3SrI(s*}>V&-Jtmufzv-s=Bc!O*E+MGM$GwmkJST`0F&*`~(DfGILpZ3WM
zf8`H8mHQhddF%4M{le?b%jX~4`=0^zJn`xB`}eqLGcYi$VqlQLSwWPhB<dAZUafsy
zbldIHi+cN`Yf8T{OA2pLxxI1mnxNwobKJM?J38rcjq2(h3KlAY%?!=mdWAn5&t=b1
zx4vsDeuja$p=<N+tBF%ng(SX!KrNf~n=fxauK#!1;!)<ozmqNfPge+j{?lN4x8-8j
z@81XC&6O>ilAHIbVyD*4fA8+?<FA+7yje7TeZ|D3Ip_2%C*@xIV4z*OW1HNM{r}nL
z-K=Lg|HeK^J@cgSj+yzJY;+#$>@7~8n4WDmS8vs(Q$I^iJu<zc9XVrJq^EC}b@>z1
zd12XKZMB<xBi3Cxzv#^4l9hE+&82@FJ=8S!Bwv#Q<2f^?jK`m>PELDuOUixf5#!SQ
zlJ<koBda8zM|Lf)DU&T^GEU6j%<I40b;kqYEK%{xt1afHhaYX(+moJdE^U`M-9~@G
zSCdoMW*a;&KekEzkF0t@@YfO*eV;4a7mN1W?LGBOrei}w`oWv^`)kc?f4#hU(cV99
zzr_MM)k~YT{GM^0>;Lgs=gjmyCbv&)TphN4mC+p4KlA^zoxgu!?PCiq!PL(SE!zc|
zl3fh1`^&A)Hc#`83-&NI={R<S&wKOz!_43QJbV}Tc&CQ9_{Sh+wl(6*|ER>Kr0rJm
zvuE6R<-gR-*(Nc^FM99F+LnKAF-!H9Qw{gu-`Ob~`njOXB=UH@z-r&dq@#=zBwrTr
z*_bxI*MHo!FFt02^S7A~s%NY81ix>X8{ZN6z3gNA^Zg&Lv@YH8AuT-q=H&2iU#8Yp
zrrw`zaK1h8qlDX<eESL8<zHyK);>Ka-uZvd`Bh7Mf9RZ^#CK+XyXV2|J?B4l37=Tn
zP@(R1Xi-9bc;Z3#9e0}2Kcv?bv`5MBt^E4!$<xi{3}=JayuLVhy88P6n(MlEel%I3
zd?2v!t4D1h!_nl++uzT#wf`wP|69H2d3ml4o-_1T7o1$_%<!c1c-f8D@qK+alsKoe
zY9IFBaqV&sBd=D<7NrGYm!Ip;-#24lZB<p(x68Y~U%s9{Z(nucD$c|MAOEU&Pp?x8
zFZrz;C93^E@#d+0^<Vz|(6nY=RNv*jZM*mz_UbpX@gHQwIIi!l+&BMh-R$E#<;Chw
zUYGvy%5vA|4U+fD@2aekPvSqgkF)Y*FrU!W-&I@h{ZL)|e-Yc`pX=|HF>F<MAGzSL
z%E@(qv~*YTu2Zu6{`JoF4SO2Xq`o){oA{N<J4M&BWH978&*NqO#x_gygqWqn&BiYh
z4tGC4-^(lVgq`n1p#CF<o!c9m{#;=EnZ;3*&&>LBBInGorveN2Hl}fX+AfxI(Dv_v
zy^L9!C;EL)bZ?l`_~qU4ThbZJ6zn&yG~}7F;^K85$A9Nq_Gqr({_y#~w5p|Vq81eI
zJGr?--1Yq8dH-{?o!-Cw>aDs#aaMtYRxbN3-48(q8F^e2ruX?Vl<4R1{yL~|?O$lj
zI-X@L7mi0a)>Uw?k)3N%b#cMksWZZx=a~PwxM2TQOO@!HjUwi!6Ps){95s>DKg_*s
ze`nJhq04_|7aZKio6>Fjqm=Vp5Kr6Y`mLuP=ub$W*`Cck>G|i?daQX)WyS2Xn(S^i
z<#Mzwe8I9_A^MEttrP6d(-$*dZWPyAyNP)f=S`u?Og5H@_X3tPd|V(I&+EKxsryEz
z_)I&E<-ccVUii(sCOk4wORw|tj-JCR|C*mW++7rMN%?G8@t*Mb;-<Qk&BvF0DW2DI
zJ%wrMh7;?}eVxxsXDoB9zx`;B<re=#U)OjqtYSWE^5VGen)V0P%x6t9x}C4_f7>1y
z`}gb@sqG=xf8B16ZhV)!%rW}R_7k608_aKZ{H=L*UC{n1GRZgh-7`DO^2hyP*n_3N
zO(wqGma*)>?MwRJ-utyG*1vH3ckK6H@8^MsJ<jI0nf97r@NwKGc24ztdZgisRK4vJ
zZuI8_e-eIPyD4Jp>-=R3(WjSj=v)3Q`nxT--k9~K(T_zf?U}b*vz?ZuF)w?vxa}bO
zA^w!RMyz@()10&RzFzEDf1APfjlAOhuRGnPwz$69e}T95%7lOo0n55KXe@ud;mwtx
zdk)5ozX~r1tWK5FniTVC#hD_>tW6W%<u6mXt>wel-NYF=P2``N&SJGFhyJE_yYi$w
zZnGKav9z9D<fXhk?>pP9%nRGprNk8@{SxOLdwJ>X&3g^YwH)j>s%A|LwOskhPMu>~
zlHAuVffIDSp35vg9XS2wl3QQRgD2=Z)i3zU#1|o=v|P`8YVy%)=CdMC+HEI1xAAfk
zEZqLc@$XrY6mOsU6P44>?=&t+eRSuxkK?wM<L#F5Eulfb9NgvB9o)mPEUUN#6cSNw
z@(GQe*+=^i@uo>7TwRmY{dW&2159SK&!6<+*z?MHPwS%AruQjUS4g+S?YFAAByjn{
z&V-k%IHt!2&APE}c`I9P;qfl@+ZspYy6>{wz4EA4_uiZZ^*8yp9F@;#75?mgb5C$~
zWyy8_T_wxn9`5$LkoZn$@+#STcbT?K@QzPeBjx<bVWPqQ#G8i%cRqXY`SYAq&Fg|W
z)1K<2C_KErF#ZFto~K=UM~Xt@J}&cCo|w%>lMiN2y*+D#q)tXaIFEwyYq64pH?5lO
z_51n~Zp_~ysZ;;++1KvBm*?NxV?Ddh!t(b@QG??GWubYiE~zj6v>^MR&Hm%PSEk(B
z%xdAGIN?lS(AjFm)oOnaeq{gl=3J3Ny?Mw*y_;Om-4aS0*Zs2U`LsrO&-3qYT_!2n
zvY{`<HrW3E8#ZBWstRYvw?nJgpHE(^aQoVZj*PGVN@o^im>V?v%NSd<d_KLl;NQ7}
z=RaGhZ$5oi<-mE_lTy-~bPx1~^t?FAdi!&{?R_ov&Cd<~71fI^@0dARMS*MaLx<0C
zhkrOripO(ZnA^?f`Y>!k^vR|>o~+W@7uSSGzB4UhwqstFVPA4S<JwxC?^1p2ALenX
zl^Jt-^uM(@l9Zizl-DT!?wZ?atQXAUr89E{y-JMaO<r@EWL@CT`KhS*og*{rd)n#~
ztLDyd6t_Ic@It4@uF>12?upelwX3f)%?uUlpSSUJZ}M)bSeqt0(Kvf*JpYHyIoId!
zySQNO(ugUa6CcQ#O7rF46nhXg#ffL-5k1Ab41eban|V%N+`O{BbjN$&3;eS^V|%K;
z9#TCKCa{+K(>~`HUz^!ZY>K^~Rhe;H?m<RV`@Mc6r)6b-jovTJtzI%+<cj=~whVIz
zUT?qY+68N#&AqXz>@VL&uB{Ok-4h(AAG-9mWV4)={U+U(JzljsO_B|3W`A|sHZ^z7
zq}B<_%?%TGb;NqhotgEs;L!6x<&NYT9Ctt1*6)*j;kIC#cs%c}>w;Gn$d@JPh6YQm
zo4tvJXZGf`4)$3RSK9LLpS;qW)|<!jB0u-x!acipu*7oDt8I^XRm{-4AWYb3=aRo`
zu0P*;ZNgp8cXl7-%w99DQ;5DZ@v};|lh*&srRr<#5_WzOo2_v|thnL#tYoG-hl(%l
zb48!HZ#%c^T=Bl1O<HfwKHKb$Oh58D`nJuFWNFv#vu!IAJ5_nsHmdBFdBA&jjk}I*
zUP#LW<)iPN#q#g2i9TzWH^Zd6)FP*%V$sbHK^w1~V&|H|yNhAdO@}>a79F?YoBmIr
z<b2LG;s0AFE=xC9I3anW&vT<Kvv+=G_MgSYF#lje#ebb^XRDfPt_e+VbF5#{X47zv
zX943aqbnOHByh7WOgp?_E$ipsX^*>;9^A_`nf2B8ae0`^JK5teRMKA;ELKXBuoez9
z@zgVxahtfImZvN7;fB-9-#T?S&8eNW!CP$k-GiGMrkvd+(YwE6*VT%?)-^9vMNT?}
z1tjNK9p!3%SrYOg#V|3jCG|Ud+Shk2AG7-o?mrePnPr<0vVw=hcWG#SLb#RxyDc0d
z;+HkfcRgwdTwAc4F>U7ZQ%?2<uP$ATv`Ls3xbUr|oVb|9BkfnG4nMiG`P3F$9nZSC
zOZA?Jg--JM`hZ8kBIoCg9}f2H+I`O#7cSt`^jNWS8E5K6kDe4ILtBymzH9dJpOqK(
z-R%4|HD)nGuy}+Dv&q`~WtSr(KCJ9IVHOo-{x#Y9%>NA!KO5*i?$F%4AVIW&Iq~qK
z(5cIF;tEqTk~T2awQ>pvXmTC6w%~#Awv(GHMIWYhN|l|s@bRp{5w{Z?7FU0lIK>;b
z?$D%@4RHsj3BH*0iEUjnuaIydw}EjtGxLpAI_5_Y{{8LBd9RY~NwmsM(Y(?f^7raD
zY~Q_md;XDooiZ9XRy5t^G82}6cy1E&#jL2b;6);?=iM!~E@oYOm{re7Fu4CA*Kg^t
zN!dk}k2kUk&sW$X{MF~y494F6sQtfw>i22xSIS-V!QR~FwsZg8<m*=+ntr>KHkqL(
zUHCvojiSoo|I1$eG}RBkxkpU&sMfQSHC@6sM?XF`UaX<1Hp6m45ySe&KHW=sB@%o8
z&-iKo;BD2sPrJ+Czmi|hGQBl(ZX?I^#5qjrXEqfb?eZ0xuBxV;W<KR0!?#6KI<wX(
z<~oUN@Z8p;?4ULG@CNUB&2A#ql^=c@>`gq{rS4haZtoU3v59%(#Kw&>TJsJoIaSsw
ze^SU%s@#~c^3046N?eJP1fRK2W15&;<-^Q7Q={NR{d%J_^E+&v3TC!F&Nn)so3OmV
zcWa|7^J#VM!ih0V8h_;Pvff#-WTDrgj9E43{ThBB;$ZRJ(Qr`e3X@5`#^X;Hr=MVZ
zW7{!z&zhi!{U?2O|N4Xo_FmBreP24=!&D%9wt?$Jkq!JF6J6U>`B{V1t~{7<P^j)~
z0;h|L$RUoCGtMrIcDxp8wx6@4`bpa?**dmuJ6~V@Q`jTEXZO5)1z)(LeO`&#FG}0<
z`{UxDJdKwBe%^a|{(E2jwd;i~FUk(=ZJMrZsCiKISL#u<o*%aF-~In}{doVq9mm+k
zOiMaG3kkO;Rq@nkhHbxQzNKy6>uc<~yqgdEi5+RX>6CK9%%&?aV%;H`XM)?s6!~uW
z_KKfXo>g|>op6{$jIf1OMYBwm=;0`aYwkB~nvdV+WeitgO0eY1SSr$V+pWv%vDvpD
z6CD~ieb5ltakb;I+5CO(6ML-RL`EF=#Z~AXFpKjTYa&zp#`-zatq(ht7pN!by-+@J
zh((<J&5eYtC10XWuuQI~xXBo_!S!I;o;{CjmbTx1;{36U?~{Ik_pv0OP1`5*2weE#
zw%opXLaC$Hs;@8p$Q<imQypkOD`t-TkLrYix$!-nl?980<l>qZBu8xY<rmSNG3nAg
z@jq;f(xzO=TH<>`_FKp)%ZOvMPEUxikP5o{Myo~C@0VGI&2PpP`){h4=ajSxJ?z??
z+M4FbBjUg&pIg+^e|U1TX4ck@Q>&LWatU7joFldHkK)TpjcpSm%^SBBa+W8od~)Qp
zZmsl5&5qM%{|`uY+<2&{S17YSV#gwLb9Qw`o@vWJPki1h+q3?G?EgC-e^~mc?Jhr|
z^gK6tiJF$J?B9x4?^c}2zhkbW6IAERq@Z`Zd12j(U9;v+yZLO%lSLNGrQhg0f4Dr_
zgSlCPcitp3#%JP=qKkAjuRm$2uv?w=vwM}~wG~gwV^&>R!WghJJL&VjskU2IWlKMw
zP*Iqp7s@^9h{kt2zgMm|lH=D_?t5}+pUUR0eNlPhkwM4a^L2BXyPwwT_tCM`xxVP+
zlVXv2bDwLwg)WC{y4~^AjZ@S-t;4Jzn!Tblw|2n<)m03tp5LxKOFIy!_%Fro<BCI1
z^X`0IUle2ZxoURG+W24xp*dQ&WiFJ9C+IC#mO4A*@8bz?Wp{M=eE-V(C-gMS$2I#Z
zbv2kb*8~>J`Y}|5UFV9Q)s`8PGNXUCFvq5XOr{H4-X3APzGP;+)T`u~A=_UoFkDyD
z=T`ZD!sz>P=GffZCmCdqWz782ySS0vO0x9!X@iv?XPlVnBq#nz^>nt~b{n>n+<X6S
zYwdB|R-B?dJC6NZRq5%KewJE^lUYO$7rba*dvtkAn$)2U0iW00+A>AXa_))DOYd`5
znJNgs<a_?dy5q{#{$Cxei?7U^kvKcg!jQ>BdRIjhXI1_q-Yo^2yB~>!pJ#q^%RJ$W
zU%u_Vve}Gtwma>b-oIZc**yKZVim{!mJ1(^dl-A(U0dyJAd#hF;wGjTGuwa09gd*i
zFAsFR-hX$k_2d|x4=*p4h8d)G87|lBHBX!^TFFtO#URk|kN-*{gRt7<!eB|YS?3<_
z+3={WcQS`Y-Sw4jy1KKPmv{H5IK>qnd6#rk=|}d%<-2nxhp@8AoU&Lo$soNv@cgRT
z+dheIPChPe^Wl>Q#~P{i7Z%Nb8rdOt%8G45f>AM3liL^WEwjBZTubB=He~+IE`LE`
zx<d4-9cQ!@lI9#<ta$VK=L$uBCXG9<u7<R|niX7~r(1hMaWlWF#W|&<=>al@4E%OH
z-<Wt_ue<n1!1(BgC;d%tCSL#aW~wK%LFFlKB`zx|m)n(W_L><^8|8~usLoVLJb0^G
zQJU=y%gZp62Tiw6PFUM0ny_uUxv<Kw(CmcX<sX{2DH_yH(Y^eG|B&``8UBXG_X#$x
zMJ-12w3?D^d|n4dKJ2klh<~(c&F#$iGhQNJ7JgfNcWRfe;B3i-+upx6n8=f(sl|M2
zrQqe2imL+yMZ#E|LljQC&0eeB^RSRPrQ@CopK@**8_Sz#76<wEI&xUHw}vLMyuMl5
zaZq)UKL6sWCPCa+S1;JdUBb7H>Blx{K~ujxz8Uwv9d*m_XEc~mQOfE2=VMEx>v6sf
z%7zvO(^g8dt~;J|=uOu3T}$_z`tYivLT&DnTw$(E-L&wTH-vc<4lejGjd>l%-HVeB
za&d|FPfBTVJvf=Q&AeBrFvIETZIQ`ZD*|jv9iHuPJ|1>OP`5|4DPB;CCq91a)`wTh
z0~zOS2>L6$phD^7_e+dc%eEYzGsn(Vh&w+;;)PA}$12`)e5_Vy7j~uTok%)xYVVvv
zkp-oHtpyIrY?WASd1Uj{Zd)GyX&Y4cl@{)}I{8bGVa`QeB?Aiw#;|S%;UnuE`I8xa
zS$>(nEA0*4{$)yB$kR|a#a)b@pVgkK*abgj{1;c)8`ZO>VW-0!TcNwVo=s7cn$A<y
zxZ`F6&xKP09EzSsOx#605)T<;E!Oc$h&vcB&2nduIU@J$?gmC12K%H34cjjG2kQ1P
ze-n|Kbf<X1`VYODU*>;M^-(Tq%`AJOb^4`9f~qpVUY7mM4yWy&aemKEvdBC;a<eD*
z=DUIwv5z%X_9)s%TAU6jQ#o+@1oQMcNxvLABz{ag7j}AvS^YM7xteCvcj}*6{_*e$
z?GGw;dwcUi#z$@20uO!}KEB_x`6ad;V0_)oyk*%k*5yYYnoq9Uk@BVEtAqD-(~mP4
z5|jAl3=Xb&u=G}eazewp^9E*JJls3duL@msa8*8g*lx|mC7=2w-yWNA+ir<qTUTsE
z_=;HW7b$1M6<)c_U~`=zBQ?+K+NR|pGG-|(CVHA1KPS&v5HoYJFKa{LogJ&y)n8uc
zS!n)J;LwEyoRb1urd-@|U~5E3x2w!iktny{rOT=|PWGR%vf#v}Dw`Ki8`ip;MNO-p
zRH$)5a*1`^wXpl5{z9jAWqaQAPr0yJW8<nhy2cUD4NDn|j5`bK7ainP%!*#P-Yn9w
zz0jv1OW8(`-#Vw$K=<tABYv@7Rb3g&`(kgYa2g!i$7gTq+2rN%*?>>jBBjLjrog0~
z;gPHk=|R4W?)hGvEzSM(*Sy{*c5A1Z@;EPNSs)`l$?;Q+Mnr&u<f=K2dozwT%APpd
zvg3=W#*$Z7B5So%F1&A89Muv0p;h|Ef0kzN9UU&shv#sz)U2%5ye84*{bIMECQIdq
z^aoD={v^D2QvG7{f8X<Sjz?AWJfC-H$nKDmQw!b{Y2o}=SxaigEc1l?j|El=TSQpi
z-nq2aBOz|dizYYe<cWVJ+82DDF8ZUl)9g#b`nbPERVvxK@4Qb(MA$xDbHbsA`}S4F
zunFRBQX8I2h_Pp~=xlBgWoeQPDO9U)y^*|QRv~9{66enu9HPtlHiWQ0FmOH+8zC3T
z)gRaD<lDLF@hv_vE19PkUYn=CkV}&6)>$TQ7xCm2lhUFG{}wNmx)>C+tRryWDVLvG
zhd+gyeR_Vec1@J6&c;^@dsn&es2vTyBYNP^sfav*rqt$zQrkZKiMJ2Fqpa}kPtlFO
zS&0s@PmT(TM7W+(6j#`@&SLg6&G(xfo}W%<`TErO-qicDGuP&&1wZ_0`1|36x7^Kq
zKl8&k%zuA%dV_MI;9Qyg^)uJpk6G`1@BD19iz<88{AEqNKB-S5t3IPd_3JL?c}rjZ
z&GA{|;BLxsS}-TD?<H4-)w$OX#2lwQmE&8Xq~AYPzP;hO5v%9!6Gam<`ED4B9~IWP
zyEIk*iM6M9f_oijtwr%CmsNk8*_-Oh6d&<rSVn~^Je19J{PRWaU&GuRiS=h@seKE}
zv^UATwebBC(<#o`Iu=t7|69nB!+D~)x$M@QL$hK%R_bkgmw5kTv&RdM%3bvj-yPJg
z&z<}H)@`0SpD%WX{4R9Y&A5MPV$+@TN5bBfPMxwb%0<b@_h{ggD;&?<17)Vajl46_
zZX4Ii?ULIj-@Uaa?XvFchmYU>Tz|B>iYetFYr)-?x4nTfwRd}X4*Zs%uN3%?)heoE
z@i!mN4W`F$GY4(Hv{B`tjazJ<>~Wh%2aRSVEZL~>+IXhpo^yuFeLfYQd$&sV`uEjJ
z`}LjU%VjGc9D6d;({F3~?TM0xVjm_qcQeRtIJ-jk%9_?cDYN&?U)gqslW{TMQ5&ur
z$&!K@DtXGTZ3%|$O`T;)44ba-x(k2QIe5+exWjrYb_>`24Ys;nS-LY8_qFxARPc0{
zAG*KEM(^T=S;e2W9oQznoqK+Hi>u?04ABlf?^Clf6&GG%sXk{|aL<!NmHVVX#DkBn
zcCztL;!baCykzs~#M+g!&P)8fTb;Lg=d=q<t4%)Vci&j_=W#*f&P%!zgQRm#=<PXc
zyrcA)8UNk7FBiOf*f+GD%;i|XULvjaXXVPDUVr{2-6|C|`g-uyI@LvScTRLp=<hh$
zc(eN+d)U<{5@+H##lN$v3jXDn`1wQN(fqSZD!F$4EUZ2wVaK}oR}hO$KuJPV$drV@
z?N1^Xh8#T_6I9Ze^2kb$i|e?C<CQN*&O3B9o}c#m$CuO@#~);znlZyl(f6s>MK!-b
zhm}<kQfaHXLbyJ~+4hybbz`f$BRTm;j@*kRIbJ0`1wr?!2N!kXt+@O{zx3H~O_UZ-
z3=({_D1bjRT_;u8NJxHn;_Nj?rpGo27d>v6lYGPUd76ZVnEP9X<i+<Dn(pq}6&qH4
zeWCuF8>yNBmEvj6t~nm+EYB^TyKdX6#;w0uBDC{`#1F@X8ixZU*cPZ+iZ{CMaGj_u
z_&%%c1WU~Sy>^x_vXcVVaWFP4d#0tdl8Jd^MQ`&P=Orvl)Z|)4j<VFP4U$#KY@T*`
zRnneBBj(e5a*ofI31ux0T2q@QQ1bis36Vb+mAx8H%1m0K=r3A-S!Ty8H61|(=VTAj
z^j_EYJBNbj-ss*^#rglb^!9Z-5=>?sbM3KY^O^q2WrY{}!oZcqM`b^_?g-~|?clxh
zY;wcfMNSM!;uF^$V4fkf*!JBF(K;)c8*i8FjSk;(`)=ANDdF$OB-JJ^^!vO<bmLYJ
z5t{`TS^=#gOBcr-Iyo)H$GJU&KX+y3eVZFWd+VkeZV#=FQu6TrZZ%=gpPPs8Zj^g>
z=gYqW&TsYlO1D3UNH>W_|Ip$4Ce&WgxjE=V0MGFTD~Hp&t(5}0H{RnsyjWi%bdl-z
zxEr>Q7wX^s%5rb%tK8G`VnlY;dddm<Z=YD2xrODd(d+EZyE?lzyv?mk3V*Y9^`)v)
zTUeF0h@TH+agSI1;Ca2zcDjjNZ?EG5$xt8HIn`R<rd{%oN!>3bANXS>W5*pW+bqFD
z6-O^Ie(u?>U3t6rhU491KW^Dd*Y>GTI``<T?Xiw-16J{JFHVb2Z8fn8CYvru9M}=y
z<{SRFYyCs67Z?6bEca4~Jjrd8Q(&z6(A!wy+}$~=%vpMm6<oh8^_=0l(qz;BUnbn)
z$?>S%yn1re#cB7X7=Bj^R=j!Nv5R3r`CloY*np=z9odFeQZ{miVlJVwf0iFPqIlX?
zS#iVSFYoMM$of@IeH8aI;cN3^)-_)&4oCmGSF+1zQ{)Vv<vl(&57tdl&uOtg_U5zr
z<_5{b{0_{!Qs1v_ofs;pk?HVYMvzAS=bYx3o6dgUwsqbjwe<#>GPlb=1g?snJMBcu
z3y}j;#rKGO==-qnV*SO<kJ-)~<&gg|yW-K7t`A?8dH;OaeB;T5zey}64=g`ixV!(n
z{jzfP9G39o3=0{*ai7v-pQ0mww0-ye<Np<6_VvHNTl_`!<EFL-6~^a0YZhIsS4?eS
zNiq1A{PuvH55pn53Cs=&jI3=}zFVCAbgbaZhN$qj+TYe6Ra)6KRV9)+sg_?L>(1n)
zr0x5n4x3h%i!Gn@w)1au44Wad=+xY;M^+VYtgzYm_+o_L+L)OZU&^$0Pgws`m^+el
zO6QBpoHCJT=FI0aavby;Obp&|Y>N75Tc^CZSU{nI%T#tP^P}e%R-bD9&yo_>!J1N7
zd|f7%Yu%?EPn2UmwoMV3$f9}nT!o|S?L~Is`yaf~@)J_<>0@<h_1M-Hv}_WCNyEZ$
z0i!_0C*9ls?XCDdZ)Uo5qsz40(_TL06nmq)ilum^!o%zcwkywP_OyuEoLbQCJGD8S
zEkt3qXo}t9y*DI;CZvW(%;0R|{%H8%ihAKm-rG~2F23Y?=5t{6tu-C0vK<N9**lW8
zEbqvj)>52y;OGv{8`3(Wt3EZA&1KxD^xnrZM`iVbZpI#skQ#qx5gGM$3!Gg<XD^6t
z`1Wc`%!8hlH#Da<Pg$6IsEyfkjdsWB=a)4Wxop~(9a1FCA=9mVex}u@nnhE3Bz74H
z8Sp5c+dkWPC2xj>g4m<dt!4+FE;#OTc45JeR%tPl2|L`?1!E?9t~!7Di%a~yBQYsr
z>)xx19yz&i*F3?O1(L@+Jxa|a{wI9yGV}BjQ$3sR+SQ|bLD(g9L8L*Ttn-=m&QFbm
zTy4ECduc!FWSkgL$o8kRwJS7AFjiLidKgo$lgt{2^j?K@MoF9O!g)F@@h6(O6GawH
z(Kzyg-AE_!ro?lX4|8T6z475m)Ft1y8LfTH5iY^ad)<0tPVpUH9JnIRXLDw!cWV=q
z^o2(oTA07xk6c>tc<qC$d~3=R(i|SM%{sY3b<?)_O%u(JmnWXu``L(t<&WRdJG>eO
ziTQr@p{glL9~D~GXq<3qVrWll;k9-u-p;7l@^sy+U$2g^ik7U@6;z$Zwz_t~+2fy0
z7gqdza{J|We&(`S8}F~OT5_S!!%QvCWcDMMlg*}8H(ajtc9*qjZQS9)7Nq00!gtTt
zIje+JeKNC~mTf#OB71DDM#N<kBktb^Bg}dtZnh@w&r^yxzTm`5{Yr;lp<7m&cFbD+
zb74?p-sS799Kvi&2@h)6-tTJs`Qzt|vV$zmPZkKPyl2d`VcD~{lPPh{giKzyCwa-@
zs=2F+_O37A@*%{fr*_%SL!I-w=AK>rQ9Sh8nu2NTzcGa$NNOur5cP3W@Lkw6<FQ}n
zgF7laT2mGnUToN2a3wp=<pf*ER)Yx#PsCc8SL`*rbt}Mn=kJ*PWqjES-bJR}u-#K;
zc&1PzA^+&tKkJ`Y9eKF^Nd@Qo^$))B-k72oaoz0y=k*W%r(fS;E@P_xYfsGEa)H&3
zHy6ieO?(ogwrY`t+pI}Kc`HJuiYbOp{LEy!%PME7S(b11!_0#M!3P9auP}UVHgT)?
z4Svm-(+X;Lop<{<nbiCK-f>%Co2cnW{;TCT>k4llJN)u}q{1^6E1L%!WA+#rbR|x?
zWqsfP=eob5{EgAej-IWWrfO8R$!XH*3!OU@>pNySeq4O{Yf4|i>6Y5dzZv$mc<lH1
zRm<gKEgm*mw9J~j@4%Y_p7!?n`<DDURQI~%yk!2b<Y}9CnDthbMs{DnV_Oy0_*ChB
zS#N#s4DmDhwsKFDtk0zMZ{PScXs*k%mxqgwicj!PTJ+$Q*RGDFv<FQ;J{^7Fyol@V
zjN@HXCv;xVJ<+x+)>E%#9ZTtvdb@7F{Z}?BTCX~6cU!RI_x%N)-g6&a6123wHB;ep
zneZA3XJ;N>=UqAlN%!w;U%R2AQGX!==LLz`zg9?>$t1Eb(~je5727vMv6VG1f?;Ft
z^KWOT&YLK-LSiaoUJ;*R{zl1*Z+e!h#``}^{9Bsz@yf!VhbJw%vhwo});kZ^Zg@E}
z;A2y<mR#`jWA#_JgiSe{FTAyWS9?abTm64sm8J8Rx#!=1XFKQLr#E+Bo}7K%;)gun
ze(tipzn&%kes*tOWqJMf!gBfdS(2V^yEKf~9e#07d*QKvC-Z;Abnw<(<;zPlQ>of=
zv*F&X?!`ZY1eh}7T)w}1Yd0bO+czF#*2y7{_P7@*I-Ko%u-=X(h~?tigJwOZcNKR&
zxN-2X{q=*7*IHNnS#Gr=)9%W_f9uj+I1`k(taQC)c4waJO=PKgWS*s{y!z!ICX=~`
z_D*c)T(gn&i_E&kE#cB@?u*;7^BSK%@}%!pl+^YoC(fOGCBxX_mN>WFJ@S>o?0Ylx
zmdd*(7)V^SI1*CS<tui}AyP)`)19;pA{_^q-?qEgc)4A>&MUcC+kmOm$4X9pii`Fg
zi@^NfQ$!>>1J3X8WLQ6Uw{uTyc2M>0Cl1`NUFUG~vz_Rd$gy4=KTn(8<lx$>2WfxV
zGD_vX-I{r8(yCjc9|R>lR)&2~<XIhRo~wFjncAB&t_!AL&gq4+Z(1RxBDU0b+l#v!
zyk9l{=9<cxo$~pXz_D{bnckJ2ooX0bw5+G|*RIM#Z%@8q)@gjRYJ&9fR-2$W#&tn^
zEefkGf2ovgV}7@uWux9-5#~iaelw+)b$%30`Jxd&_g~Qxy&8R`*)uHdMFQ7w=^Rd-
z^>o^_<sYg#xne_WP8Ml!UG$D`+tzxz;hp3A&h7o*zRACTU$?#d|Hs37@BTf$Y|b=y
zmRQbBCUff?CT~@aQVCiy&(|a1WKP%T7$5i7E>|Ruwccv))O*pww<znF%7%Cwhv_N_
z&nx|&Kl*CYere&(AKBqk(=Pl!(e-QAQkTq6|LvdL`&P81zUY-=dFj<im4<+>o+M7T
zvoS{u=f;GsnN(r6_U}W#@=0bEua_IWZuoMp-Qmdrp^)b_lZCZpycw7NKeIo2YM4oT
z{_e#dE>APADbG9MDEWA%N#Hy63Tv@-zAyF}9^~qua&x)E(wkS-l<t<@V!qqAATL6A
z^}M`QeGJpnpOvl<e|)9oNm|f+h1et6HtI|+dn{JRgq}WSJa>(eYiR^`=rgGe({~sP
zmaxv<-DG;l^2aF)$*R}Nmfy;+c3(VFIAzE8XL|40+$StKX>h-_QhMe)so6j7&zpGb
zNcQC1J5gUl@-9_<+4J{>>*6i!$ENP)vAyJad)|b~)sAH)-m-nOr@CKRr`hvgc*oV+
zZ34nmlQw5%K4RgTzpiug3bv06f39krv--HS_DLJ3ef73ocQ3tletlFroX=HlN^p<F
zeHo9OH_261mp;yW(OGq|*n7Rzu3gXV%=a5gl>XVLa??!cz#O~3e<~+W7TmS!rm@w5
zEWwo~4f~XWZB6VY+KwwPm0?UNoLlLr%~8Bg`@qS9Lv7-pe0(E)eXklk-|^G&ZaH^x
zQj=@4?lYU2X`And%&~}iS<Y~xxahx?>9xl8BMnyhdaO~JetTMF9ZgMdpZ`==vCC@h
z?$_aS4t)4BA>hE*U7PMNR^b0R&-zg4R+n6kWzpI@)`#$y{^ygu=*hfl^2}!^TAiQG
z%80sN^(fH%>-l#d_A~U=&ngQSU=bG<ZdD9;a#N-A;*C>6CPfm<_t?z8J7v!fgB3Qb
zj$2J!k(jD4Wb^zrkH3F;m7cECR$go01+&bAi@#h8Q2&+?<yG_K5wmc4wv%;R(D}_P
z{EtOXJFL7sTD4`{^@X{e`#Kj#-{{)@posT|h}n%rT0ce3*F+T8tUM(0xF)!?sB6KF
zX@56e-14_=>AWpdKPRtmN}RnTlTSKTW1IO-QIn6CN<W@(^`3N6=2pqc+~D0>y?!sg
zixpKEoOtuM;KaAG=D*MCKFWSG={gWIVWOx}w{-gCf2Zq9|LE7UBsE6gG^}=wel3{7
ze9v01KioFqxyZjpvubf=(MdDY0|gsa%sQ^fnsQ;@E`9!aJNtcKdi^~YRh6CgPC4m&
z;qGsx8?>&U?5mp|HSPB&9#4s;{5`QJm&-DLm6i_9(2Hw-=jTwGynny#x8MIK-?(1$
z-7BYg;rH6CwplB}XM0b3wc6lign$IwAttft+J8&$Rjh8$E8W4+<@dDv#ne=(^F2Cy
zy$!o$W?2bVdTe2^v9bQzu(v0D#&M=n<^8Pr_id~Hy}A44%kt&#=g9`24;Iv!@ya0O
zbFIIuy20+3sh5vQt(I9jRpE%BugE^Vl39)&drB(%D<uD@c{)s*-^5VA(e%ozxU!rt
zH%-Dfx?axvUHsym$M<-ZWQ}hMT!kl-p6{qV+0nMX`?SY&hGc`NecfD}f2w(OmA()z
zH|Fwq^5fj99e?iqQ7nr29>3qR?%SW2zo)0```2Ab=m^M~5d1Yj*-LB1O@)MVj&kXs
z*<C6=`5(TjCq>`>8-85k^0EI%>(h(ha~};(5mq-!cE54mP|GVls>PzA-hKT!riA<3
ze&3Q5D{FkW*zK$<U(lB-1*b`Q;wk@%PapMow9QIboUK+RHPT|5`5jiBUaooT-8QYZ
z-*Jy`?~7%=O#h-kuCjJs^2>R1>5X{;uZ=9ewn!`8o$;Idy0*p9;|nM6npNj(_ehNM
zLqmMpNmYrSUAvvbr!n>K5?H)#@&}<lo%~*dO7Uq6XU;z`y{5~(w27(siS09Y@c^HS
z=^vUG1Xu7k_UmMb?7bLi%Idk~nnz9cgZgaut|@nwcbwj7d{_8qrOi>7!(tcb*e3=s
zPSsqr@XemvtRM1!$9b3MKjxcLQ2wi)MfPr>u<%5ctxsBR>{7lz>Gsy<(tx}zg@(H)
z%@z3J7OOGW)9h+{YDwjjw>f_c8kej*B3<O0VjatT@oRG2X0^3?&dKq6$~0$kcwf-o
zJ<D`)*6D4<FTAGxyM3&`W=dR=`G!MP(-!{Jatze;b)1~QSfmtaroVB@)q{KUxK7(X
zYu{G&qd!pATIT-GdeqgoepZ_fX0tFbg!3>k$l+XlTUnBkpQl$)xi{=?-fc6Heb<BM
zsEKd67;!@AO%hwsg5u4(FX9_2U$iL*WV}4_%xN-{=gq5Kb{FE3{kJ)LZK|7O@>cH|
z_hB{u{hz<j?YC)*UmyS1u39-LL@YgAQcJz4F^x~3dtP2anb>@{;~OrxrXHz!{9yk6
zhi|^T*)3UH%O8Gf;S%5AjKgy;Xr1c4=QQcbQf*!}&JNvN%LiVW;yO7Zva+&!V<OWl
zUWqGQXA_%x`-1<;tGk|Lw}j+#D_*=Yqi697$HGv>D^fdJQ$wn|9$#zL%leX5*&U{>
z8TR(u(p#L1uTJ~4`_GId1G`4q$_4VB<;Qu=+WF7jKHQzw$aFGMQvd&seLiCQWAx(U
z_x`SwW2}{0?<??j=k}$KwL8~uJoKjaMwM#N_BC8@<PYg>VPEt%dYzZz=4;Q~|EHfk
zD-|o^y7I|2v(%i!bGO(p`>b&wKzFv&cI(p0zxNh?5kGJ#;mDy~Cw^%sY95vmNlFub
zT|G-JXoYoAdf>C*8G9S1UfZ;;`@hU#c9vJ$Hr-R@cxs~KcOdJAa!Si9CaJ<DO;Rrl
zt|(meIOrb}^`<8H80YlrxSK7Pw$Htv`o}Gz-1*9`x&4NDH*%&GzkcEEQD*IOd$HlI
z8tGf@1!+A?yu+ugbGB-%a{Z`#u5rUYwy4ejHg05Bx)k<Dv@P?&^8I>+?VmX7kH5W=
zDz*0gp|<x049tveFWzK{=QRhc;^|$J!B_3@_Q(OV43>q{UZ352#H}+WLZNZx7O!h7
z+*FGjZzwi@uvh<~{%PS&nX|<W-LsDhC+O?>J>D$;=yS2z+df|J|I?&?mE5tLb!1wl
zo?ThZ!i;yOlP4DDXX%6=3gvv6RdxNzuItbAPPSwQz3n_G6XDMu@!_MN_M16Nthhf%
zNl2|ad68}D6}f;k_u#S(x45@A26SH0u9{|Ych--`%>7Gh*o@!(xRRY?xJGd5_Kw$E
zn(n8I7g%lKs4PzW=(u(6lQj=-H|oxJ3Q?*~vvZbO*HOmLwfK5lzV2+k?)V9JYL3oe
zJFDm+B+|kwbt>2*O;Ma{|CRXn`$}dARA+pWF;xHf)ceP&tjPQwzTTIc1vwWiE&Hlu
zxifr*x}D=Kewzv#!`9!8%31$?k4Mx`<qEn{n9-cUq4cbE{@%`vRkv5Oy}fr`de`M$
zO`DIeH@#N5D0y1b=2S=X!zS;Pzs|Xr__WuCSL0i*x3BXu&bPi1#(P|v?LP3n{dq<D
z$Pe@Gwsl*kt~)%F=M(RX=(=`ahEDOToQgi}u}RlWZKbC>Tn}06l#^0!7v*6->z@C&
zM{RQ_7F_=Jc6-W=xIO>9yWSsO%f$U5f8F!*2f1g;KA&zkEB@7I@9v}tiOw?eU!2cm
z8o%SNS^aL!_l`uzF1JPQ=Ua+gqdurFOFZ!E$<Cae@4tTdnD|j{zkzP<;@RJRO!$5G
zW?^K~@dE;J(pC2B*5!X;aju%lsV%a%C!}lg;k%F9s|3QWn=EJ7X05T?92aV<JFnx-
zfjR$0X4%_zb*t<vs}3x$Tp|5;#Y@AfVw<+uUNSTJ5O#4tYB6<vr&1)3JOjg#P6h@^
zT*Xuh_%znP#kY5C-2Z#M!`qhuyF7f}Jh`;mdROMTqM-e^3f0biy;W$d<?1AKUS#EQ
z{?k_d|G#hF&EV0%^7Wz0+wAIjv%6gwyN@RA-^jp!<7)fE_}|YLo`2l){XCQ0^M@)=
zUK&<!{_scgz5Gu7Z+tgAH$^OcSTb$%V)1tOzl+7)-QQg9*~~pp)sXv#Z2zRAGFF@C
zRDa&P*K^jHn;9mWpOl_17UX{3t#Wpz_;Js7PZNdGtE)dnPTI+>KY!(V&G7k~lJ<BA
z&rhFOHEF$AqD^YtF}stBG2xB#l+^+)!p`q4k!p=xS7+z>tlQwx%h@HfR;mR`-2Y?}
z>}wZSTfyzSF0Am~-PLAXYqGA~O#V<Vb-y)J=y8kx``Ud6B){H}WoYJCmOu6>=w5Q7
zSyWr$1f9)$*D=iqcwBVB``54ZeL=#XR2R*(TqNJRy+-6ip`q--E1TqOLpK}kn|o$Q
zef30^J>h*;{O=E26fZAaxL{v5_tl+Sd25dBJd^0<t>4@D#l&RIotD}n`@e4wzkKn;
zf4O?SUG@KWGXw-0LcSNN-O7KrgJZG7R*8L2<%~KmDm~zqW0wD=sGn&Naz3oeTkif(
zPaDqVt8TIu<VbwpTrug&t(8}UbholziT3JSQGBdGwEFV}`{m24ep{7$u=u5Ma$K3W
z(M8<jp8TGk&5l2F`rRe%^Kz&4)IY1+w_UtPt;x^jU-E*#246nE*72`Cmj2`ZS>7+z
z3LWRJe4m@Fw*TT}CBDyd(k*Sueog)qy*|s4N3Bjwe(Qae>hAcf;&00xn*#-wU3pS3
z^Xp~cmV!ku^7zi*-VoXEb0NOl_riV2xe0P>l+Ur1TvOa^t5w}!T^;zKKS1@&;dl@I
zsOdjsL~fSmmWodlf7Ec@yvR-ei+=Fm(~5P4zoxhMRTZhsm$9@x(0=@$#iPFh7Lu)V
z=KXy+?X&Cs?nVDBI30veuhUPxK7Duj*_7+?A2`p*UVAX#?EA4RoS}zin?FnYt$Ue)
z@!e(p-FXZ@T9bVk=K0Lc4KGld;5zf$$vs<i!mF)K_xha6Ki|JcC;4z?0bkqk3x0Fk
z*1eMBj@`b0zyJ9eFKj%6%=Sn$UFE;=^TQF*-Uq_78#%v6#GE;9lX|ixYGGrt!%?QG
zMb{R`{nR<5V(>tH!(x`p?6=((Y??WJk+Z?GpOZdI%=&Cu#a{egEXTb~uXnY8a5H-i
zQy%AsEIX-EBRStHo}B_$D(5t}N_sv#+A1>bW_JeT?&C{Mnm=wXWlTPQPu+06lu(;N
zi}j&z2B`-3yEz5;W;|TWK5KtY<V?n|<p+LQaK2#p9MQJZJ~?sDa?gMtGH24y9MJv!
zce{_`#;Y?-zb{Fi?b`pg-d^FxyY9d17DUe8dVGK7v*x7RXMXorr;0~4X`XktEO~t6
z=6pexsD8cI_3OXev1zZCc>d<^e1H2syBeF?>Tlr;ufCjT_uIOLLtFEc>%{O2RX#S1
zpU?JRv@<&}J!7eiPEL=}1RplO>SbT|7_tkVJ7}N2#^Bpxr3b$>Ug!wdeA3?>I_>jM
zLuqx-D|QMxie<^oj2%rUGap&rF8{9kVy<A>4VS~*KbN2Q$uWaN;9O(jfzxLbd5=d5
zb;^H=Y+ajU;*|d<!hL=EgN;Y!fA(d#nokffb&<HkTpJK%u|jfQmF4>xJ4$@57&;HV
zemvdWLwVMZLT1~||4n%s_vlvH1{d~7tG|@7FS*h@U--gI)pre7zn*?PJMX&DFKx?T
zmH%s|Ka78C@n`k4hx<bh^Os5gzb$+G|F+aW*NgtlUvw{zW6wRo#_KH(bMO0pSSFM7
zXEAqTi{SffLHl^-&Wh2moTc_sYHNCP5c?zb1zY!O-sk1{lEvDxDpx$i)S`RJ>5f{K
z#EV(xd;DfcOq~6ZC7@1rib>PrH8Xq;{pR9h$oNuz;e}Q2Kcjyvr$w)q?AwqWq<Xkq
zCX+dvVSn`6Ehj%`ISDT>VPoSjYH*+NXxUYczqu!t6>utMm96e^U7qc}%u;8^RQYp$
zuT;$EBu`%7;B~A&`h<|e%{PbZj5YpdO0R1=5*EIA_q>Xa9&I@Sx0lE5x>VR6|KR1f
zuz4E<?3%NiqYl0f)8Htby6E4f<Ig_IvP_8j#I&dCveq{Z)4<x??HidaZf2RBp5Ntq
zr1dkK+;v}n_e9|p2Iq=CoZotEk`~j7yw49Gik@G8T)Sgk{=74-vK{jl)ZV*z^#^11
z_kZqUtRK9E91|v7Oy^Nvq>&)UVk4jxFh%i}>9MeGksSteP2BfaUn^X6;N`Ws#Xhxq
zdqr7f;`%N&NT_}|*ygapDJ7xu(6W8~iH-t(YBo!syg1W+Q|OnPtH_lEHck_to%7wb
zBQp4H>O^@q?rYFcQabl;&x!{e^X0xroKaM3Sf3onJd-i~sf2}!PQ03dr%B;XvDC)f
z90iWK{x&_@1&2(Sb}+1C^sfBz)T!y=)ey#irCND!J)brGOj&FrxwM8)Y#Dd$rlf<H
z{jTSJ*gkb<!(G#V>mqh9H(q~mrR`*KUw!7kheTozW!+geneohnFEUwI|4j5?WIp5*
zG=0VG#$&b|7Vlr)ey}0?J+t%9drZ9^$8X<h*>RDleBQ>w&GE*0TO7T2hY3b)4&c3>
zu{-rQ(`nZa|2zckcO-3AS+VGw&DTddOy8DH6ufQGxxDb=N98kOS0qIo{U;^cs`KPY
z-&$yJW5Eu`eODuVp6oa6WQ?5Ua?eEB(o%k&&G9>}Ghc}r)ChcKn$sqtCc(arPqvCn
zqWD(O%*t|^mg$EL92t@<;x-<AyG6hFcE;Py^RCHWWjOM_gMlNDY5oEA13FwuAt^Sc
zMh+aCSp!Y89^?x=WZpKXkfrliCR^6wWGDHstd1?R`{Nt>m{f$ac<i$jjQlbLuWH=(
zvy|L+-~N94eT}Cf+m>w=xKQ9K?J4+c?g^E{-dV-D1#^^5l%H;U5iDPQ@w$%VWG{Km
zhZEZ$3#gQsYJJ}P!+YYQI62eeZK8<**$-|co|z@(oIdrmcEFB1{OSwWe>~0NqHR7k
zb5ia?KSPzMd~WT43(_qIOjTG|T}oTlFXMYKk<IQyP{t0yUn>~xPQIJH;9~IUH>*NF
zEI9q%@bMMFwX?i<Bh7ob_g(kO(46etdrE^VPnQ3Y1doRJPo1Z637ndz56+6^RbOD=
znEx+V{?Ke02{X^vb_e|qwE0b6B9YSZWy67@7X}Bjs*-bL1=jPa`)$vb{MyiZSz;^0
ziol$2y~<O)+iPSijDCGt-oHG*ZSiXJeE+#>2l*X*8@m*Hw<(>SRJ6qSr-<Vt;Z9rU
zvhsO`Enm#KUapS1Y_`qxsC|ywPN9E0k4<bi{nJ+Jk=~4xhab;AWn`}2eMzQL;|$k?
zyA57(Q`M#f^)lFeN{Gtb@uKAVhqeDEu&mv=#G*`o&8%=2ON;+o_9gv$dfaYDu1#-Z
zVEEI`D&H#Yp9>f;95nh_@#e-(rZD5jTjng8y61#R(xn>BO}`BSE+4kP@Jqn_?e)O-
z$$azJf4|sQ$Nc9{FDo0%InJuNKF4eig^Mb)zu<pzhW&VjR!)0MZsX^~X+4wQ{QQv2
zIAtC;gVJAqF%zEy=OfM;T-~dm*=eS(zHOV5>){hW&3~RrX=s~uJM(Db%r|%DXW!BH
zXnrx_Po9HE;gjb|VqGks)V_pRtNou?nd!wFUCDn)Zcgi$f=w)YEF(7YT;E$#<aa7^
zK1Xk<c$HYfRQ)S4OPRm@`*itbVXOSAtN$c7+GbrpEUsU7`p17U#Unlkj!H;zJ$bNy
ze)pMUsd6sqni*{@bIgOpPfYo&a(e3Bk9&L4eM7DVlqV>!&-FcjWmeq(e?QX1>-RHy
z9Q=8XEnWN{!~eUp8`L%xd$8Gwz1y*JCRe6d28Z}erSLDG4l?As8=F27UQt%@qxD4D
zk4MHY%kCw;Yfy4tTD(+yZHvO=8S|BzQco4L{hPfw+u!o%bC=V6cI64D4jk&dv-nMv
z%3&+3uBCT=vueNp{Gso$-y54f#{;!e-@CprSZiSFF!TJgOR^m~j{o;enOGF($dwQ*
z<SM9g#do)F-$bLUKU}=8yv-8mS$1q%s7=C}{KX2d1N<F${~u*Id6+}R@oPce=f)4~
z&nvt;IMLzK&J`aoGHv8@V3?w`PmHO@LpIdFO;d4VrIM1zeV*?XE>aw!iypAZMI8J#
z+f8Ce<Dt2=#%jUFI?CJlTtYmzc680U&Hve5>e<h~fB)7^o^aLRfN#DS_X3_OwG*3f
z_kZ~F>bU&6e`Q}^etGoc$)~?ppZ?T*t>FGwB}v@VjC+rmT-PMcBk?ZNJe9K84kSN*
z@|nd(-Kuf1&K~8Ur)!#@b)MZTs&~|8$<s}~3@JvQiVNHWCM|Q|iEzKOP~+$Ut#d9F
zz4hO=1+_k3s}+!w;vxUz>BqBtR_9+-mDD7=E)|<|TT#{{ZQ0f}K~t1It(!5a&S4|N
z{hm5c%c>=o8l4%b=e6V$gp&Ba&FtAB-e~G@@lA_fxn^u<s9LZy^ThI%!guGT-9EJT
z@P6NuoPW>DZSZpP$~s-Kc-r|5leb!aTVA4DGC5O$i>WB0?q{;JvFsE*!Jug6htC5x
z%++GwrN!c6czN!^)@nPOzYmX>C*9SY$d_0h<TE?tMv<}-tNy2I5&vK{4}+A+V&}Ji
z)}3dvo16cLqPD?@LmO`Dn=++-I$?VBW}{Wyl9Nr#FM1tK&fVB?h4)1;=a*RjHAQbV
zS)0FAF7)}lL)qhE>ix~)sceVNxs)0B3axZ-amssp)o-J|(2WW6R=oC~nP#}c<w*01
zo4NgSD(}SXy%1x0a^|x`wXHL6PTA4w`ub<p#S~w&y{4fnCcTsndLk_}BYIgwna}?k
zw^!-2xA1p$q(8dDUcX%5EF;?YBcrwO(feL!E*^`FzBcpW&zncvKW~=rb4`2s>x1f}
zcz^wyhq+hn-ki8Kta@eKqy~v6J02)Lyyj=y%wE&L_VCXieR1c|_nDKYF7#RaLzOWg
zXu_T6hbJp9Jbm)u(wat&6`C3wSSQ;k>Cb35Su7Nm8gcHi`I6_y|JiJRQnps5zTVQN
z_V=^npZz^5ZkB#-o3r)x-1%KDQ!a0v*|`0o?fEIzolfnc%S*m6XKwH~Y%xEib;pTW
z^*gPq3V-Y_6*ilZFprU~Qaak~!u5&IgU`qJZnEK+Jh5%&g-+hwO^(xVn6vGhrxY07
zwq^h3w!dqCm7UfUEv$%tYh3kWwO#3aLG94Fy`f5HWyNZ{gWp_jvwD-a*U57(Pf)7X
z%!+L*O-xo)nR&z?GRTN|ojA{Lr&y@W!LwU!^b3nGKUn@Na#^-1-?WdJ7q(8yUB&L*
zn-%@1>bdKtSFL7KKVMDiKBfKeNuAqK;nH<l^N&suZEFZ}|F=5v>e^8EPKnIm%>Is&
zCp?=aJ)W;vW1XdcTyWluS5v2`zRkAo^mW)O7`2{bk<gE@S*v25LRACiD_mvm*!kk}
z3s0Zz>zVb`FRy-_J%#b%Hnv~2CEpI5=f2~7@NcKm<EQJkd4yc*6R&vqUE7Q6g50j@
z!7(cjHis!jtX&$$7I4<~=9+`o#Kd=&iY|L=zWvSOQ(PiJJ-4qe;Ly1qvS0@9ww3mQ
zn;c|)^Hbl}#P7dVd#LRHzRuL>O(~zBtg-t!OQy^7eARQaTUQRQEL*l|v6t(anBEOF
zEIr2j+w{(aPFk_Hfp<>&HHT~6@85_rvcEB6)BCKy{>CJ0BQdA@Zci><IT$7>G<S-t
zp-Psiheid5Q`O&9`mIYM&bD1-dUv&<uy6VKjeYOTj)mM4I%@2nb-`g<=*wGoQq%e5
zm`-(BK2SSi<B_DU&hhAvfPb+*i)z!MIA&4Sf5kd4m?umT-NS3x%_}Fd#`N6QTT?@8
zR&NVQbTf?z{o3!)TqKpo-x+mv(;CK{Yxft%eY`V8U+MhwL%R>kKG^^3p94#{5x*LD
zs8pJF!Az?gOXWM>y@-FZ>NLx9j~BUpi!ZZr@>S}^rWL&CK00x!=XOg!%eI#Io992}
z$o#W>@Ufs!Y;9NJmc>eZb8la%pPIMf=COMk2GLKqx*5qB+`gjN>87euxq<WMmJiD+
z&Ya@h^62BONaMQmvyUgtNL*Mb=wAHLM{YKImu_3ok9mF1YOG!?{`IQmg84K%r)NFN
zd3}Y4ZaNCLrQg(<tIk?+FL(KqTe};BK3-Ni-D1A#(#ly)f%}|24c2^^`b0}JMZo=g
zd!^Ncw7qwyUoez^5nrWR#{6|*Q123PO+_n(U18p{D-EYj{#kJ=PES8iCVT3QTRT6`
z%68|vW1~Am)%8_zQO}1L+w00)8(A+3H}7f`+kC1xL)wb1WY*4Cs%6K;W(cieYb*0+
z|M+b(!<4%RG!<O_@@>wLd~x8|PnN1DdY28@OP^SjdrCCSb2)ra?uN3>#XUx)GY-#Z
zFVSt@5?It~SifRU#^0E^X4}_gT@JdyZy%o>yz`>$q0O9&Q{QsyoY2!L{LWsg&+;*4
z152jl+I0V%mmW(ZSBQR?x-Dpv*G#voVYiPe%NlIGXyhucxHkHdmEk<zRWHr`_hy8|
z{CJYKy4vs#|CT1x0s$%A=EkVs>#p65t$Ls<RVFXT^|_%v%W(duMb8#hDBdW$T`MlT
zd{uSo{<9Nid9b+}I~2~U`h2GJM*h(^8VU#ggxQ$B`u18Rch2eC6L%$@_0K5GG!<l9
z_rapawTf%H%p7i=lB1WRKSZ2}e{f30`~auW%<KrGO?|W4rbV5#H0Vh1@13pv_|6wD
z?GxYRw!9DC#2}Venlk-eA9qF7`M*lXh5u}*(Of=j|HrPGuUC0xHe{6CsQ=rvD9wdm
zPrCEVP8;3mooiS8m%iDb)%@Cf?u}p9<?1dOD_t_XqvyIH;$Gz<u7{sfrY!w;Y_rSj
zB%jjg);oGRXHQJo9wl+6rF*q=#VRHaA-!^e?$#aa*uD3QKB-lknDtbiSJhER_TjIp
zDF>(b?OYb(BIYS0EWP1h;@fuKmPspDTTMN+FTTem!d;My-^(FAv6A(&*s9MBwI43|
zO!;TFYx?t6C6j40UE*b8uilz^z@TcuZdQ@6s-m-=FEREycub&`<wfh&{vh+0_TS%G
z-<mA9I&@b@RSC0BCo`*y!gNOq*TY*s8#F|#zqodMlj~P0ci%bfMGNKG`428mmeQ_0
z^M3ZPZL$GZ&oiuim%71V^{-6k-K!pR^R`|6RWCYC_x-*Kt;<miCO5*iMxNeLZuNN8
zng><)_GUl6`>RPITJpStLge}V<x>Cet$lo7x6MgzUo{hdb~gW+^6=+L#ZP=|VwjhG
zH)Wh|E}Q!(@~z(zw%fA;_N}oM;#sNpM(E}=mc57G@?K&5U1GV%X4>z4hXrQH^;&FQ
zyqno7cH##{_Q{(fOHNJdO1#Xn{>!9;^Vkf04fad2r*aqiOWBIGrp^;<?%>vIusZo8
zeeQehU8WKBZ&GFEJ+9^4wD^O6x5&P-S+k$s;Bu5+d-#U?4Kp`6cgJ}}mMxW^n<RF+
zFUUzP&DSVc!g4@GYm!p(x#9?Be;o<&pXQNn=8p|;X=FUI+Gb+7&{s#qxWjYfxy8B7
zQ|{}tY!iKDozk%SUQ*TBo~l>d1zn1NR|y47)?4;xrqIV90gm-sa^ly&k3ReT;-;J3
z+doR~d$a$eW8G5TlAfz&zB70HdNS{+&CwIf_N?PDHa1~Z_P*6&eMTmWHIBR0AY`t1
zpj_XnJ^8%+y8JipFq!mSOn!1@@sE{HCox*yUGuo5;@c<w`hLxs#qB=Rmdgbu1~?bA
z&z@mY>bg}nVN&SCbqo$W>noQC`8zA^5zx-#-oq1opT*)p*0~(Fr{@=WO;3q!2wbk=
zYS49Ff8D<#rVW!%%xCP6C^CG#c>7mQwz=gWmhtKw==||u;h8_S-&F6|rA?IGd~MsU
z4?><!2~U2%kL!=yze!|Ch~Z<Iy8Rmqt^R%cl=1nl+zjjR%=zc<3CA0|#opV0gF)H$
zdg#XVnd;&E0WNhtjzO=td(3J0?cr1%yZ_slV|(h>xIfD2_<C&ZX5U?G*J7MEp3B+i
zvNm|@#v2P>xt~!C6<Ohb+;-=l9|dJ~xAqvW{A9lR-3<QxJGo1jE$_RRRk5}-xpc#h
z1G)iAS8jC7opSrZt>vz3Zg4(h*Yb~D{OZx)-P2!+RtEKLRXcR#`|6FImVI@qxo67+
z7?$sve{JW+<_63D3@f+y&+e}MHt(NN#_b%%Hof=q1@>Ye-RCtPU3u+P!j`VRx`(!>
zv0nYhvrcwh)Zq<Zc(lG=X{qL_Kl?1@p}x&b4>5<YfudVysOoQ<HRD;|v|jFxo;NG^
zT-Y`7tBRXJPen(&K(^VP3u@o0ReDXY7}d{EooC_qlza8=&BbeWa~x`sHNLf=^O60O
zTsfAB@~cgn_Z5Fm;L))zx8l!QD7SlE#DP54j~knoDo_42>1oX#9~%k9-%os(yCf^G
z-kuxZ*!b^gz_}^w+0-LGRU~}X`rW?w)=It?oqM<45YRN8W-DN;c-}4Ttm=N_GeKRp
z9aCSMu<#tNk&y}0)hyyr;H+O1rD_=`;+MHbU(IHXo_*=Gyl|hhtUvX|IHP9DrapRk
z=!5H$1ar5r-&LyILiVqF{!CqRT;_t3!xaW$>18Z0D^9BUJEbpr*v!sxxl-bF3d6~D
z5(iVmJ-J?N+^^bd^LyVHfv+uo{|)$So~?BK#W^STnPJPELj4J|Gi=R%=XBP0oh*4}
zcKPPDjBAqLI_0J`iKKO0=r|Fgt)AICZT|#)7a!d%-p+|0x}P0ZfBw-fc5^$+>#+Q+
z>h2q>xT<paCa~u|bUDA|$$=l&LZ3#zf3#@TgG=`$FRq>>|LRkIVVd#DPZ_EebrGgw
zTeroXTUPR5k3cx{iu>7DXZ%WK{AxYlROC$D6)FFJo!{mDL^WPLP#nw}wlikk+?3a=
zHxwMpwk*AEw05~z*2_78vkx3jzUmYAJ1F)=_qpcF|2e<NOf~z*qBNyQ-dk~t4v*)W
zdruEmJZ<>fpZ7MuXZyC}6W6j&>tje-A~@%(^1eGa=0Dr<fRQ8PMSjDv#&@f0+BW_$
zeEo)Hy6x=;$Fu8QVs^SSD>{{4Ejs->eOK&Tv&vUJmOm!0QoOd>^W*xO!+z?5qMJDL
z_-1@RVVKUN?CQzY$LyDCvnb2p!|kW$t5PEmoO$tDR;>A2kswpc4)@3{Q9i;S6{ktR
zEZy?*S-e!)l5HzyZT}K{I*4J;d-nBr?pyzgoAPnr994hIy8)*!{!3<?n#Um`RWV0x
zyUe3`Mb0@dAO0=*{-~Gfy`SHW_jeAbOTFl`IA{Mn=grUUNwpEBPZn89>KwV5s%J1S
z*!skhX$MbOJ=*-1@B0>kYbC$GG;2Mpc<Ldo$MLT#-0AwujQfHY(-ICZIkHfu?s1FV
z<F4Xh+qmHKrPm$n&#_ICx%BJb)YocT{!jWYCbROp*ag|9Tg`LdU9`XTQSR^Jx$iI5
zzuGBwI`&rfxvdh;r>>V)T)Y&Wx_i#Ti!NuF7XSTn=9iSyV~+{nd?JDiXUpAtwSB?q
zcduGoD}Far@&x^QduVO+=Jt$m%T?v4<F2SY6=Z*$b$^18`dh9&PVMjNcS%gsUn00r
z=-y;yui6h{Y##!{XYP_0V-kE(?^gY1V?$&5+0)S_E;IBGG=w=j9*|Pl73?MaiD%)J
z^;-}9u6w5vR55M2%PJGw(~&REugb8yZLP6>Ei1<+J{9fz+Dl|Lj(n_}lq$Q4TjKVd
z>7ibhKb$XI{LW>0eW!c=d%>j|9J2Z?uH`eBS1i#wBDi&5^^Qvi&L~JNc$l;P#mgD8
zv({?~z0S1}el2~CJzMSClUI+NtCrnbUUTZ>xdl^pKdPJI_v%5_{nCGOHoteT{&&5!
zYOCU|uM;_gk{uq0mvgaIUYz(`qI611NY)*%3mf+?J|#52>%oLL=kM7iHx68ulD#Ir
zxs?Bvy;|3nk3qF+W(#HBC~dks>var&e3a5Ow}wPF9V3m6EHd#Yw(8BEl&+YwaBtl6
zT{VUZUvI{o`yg_Ea-PYet_u=}3aj|<c|YICJ3rM!F>6D~m&M|$JaaB4zD{}Z*H(Jj
zhNq3qTpBa39Z^@lcHAY_<iLkd+0zp;H2t5tMd)d-n6Tk)^TnY3Tb|x9>)3S2!7^~~
zEzVEx!nsuURp?6Hd%U?cCa8ILt^2FYz1vt~`YweoUD~@TF4M0gwj_AlOi%S!VXqE0
z|M<S~+=BmM=eGWR^{Rej_ucr{N!mv)<roS*U-;tf714>k)5Bh?R@q<ty7-O!(`R9>
zd+IOTjaoXn>;2-1)gdJ=adS4#fBE#}BB@BJ><#m6i_$Lcp8N3ViBIg|6^}HRKmJ(!
z?r7xaRCD%EXYQWSc%=6*bKay~%;BQjca$<o7MHK|2#ARaj^*lL-Ltjqy`SHg>$B}H
z_8<Aq{{NMm*@r*;_fu{hvz=1#kGsYu%f{fG>{bi+NVyB0cXKb>MrZwH{`u&^53}TZ
zR}S|&o27gTGb?PF?Z=ZK%YHiSv*8DoWn3S!zQ^$j#q#ujpK;-3=+7>uh7+1EeG{(y
zW_xmU!r@nkb{|{qUbdD)?B=}d>tC>KTdURceCB)~wb_aLY=m@mCuHkp>t54YYB1-A
z)b6$6A^RTnb#nhc(%_yq&0_bupWlvLZ8JIXJMu~{gXxQC=3Hx=OAHBRYnFIdsf%o#
zV%J^4-N_KRe%Za9UGgo@pHB43*<06oa^>~)zaAUtzy9^~fC`^}|BL14o*uou?w{G}
z?VhiS_twbY@-q0<dQ-t<#<_0e11voI*bWGP*9h3Qt|oZiE)SdPqOJd*Uwv#J`D#O5
z{I*~9;Sc|3fB8OjvAxef8_i$0_a$$g`}An)izmq&Z*erW@P60nD7s#MpTjS><x-2s
zUygMX{(Xp-zEnH4W1Z=<o4@S?yqQ@<7#J8h7?Rd)kMjKO`SQOR14D`&BLmKrJ}Ids
zsmUdvdGy-c^4r@cefa)|E9SRldyta0->tOW`;Om!e9H6H-m*u+)|tE4g)j9yk>)co
zYSN~)vtR%JcZMg9W5NQLn?;kpg*{i9=8?d_^NhFoV8UEk*?0doZIoxVIr;Ng+=<Cb
zQm!_)ldOg9cRY|j|9f`-wVMia&un_}XHmj=^ZB;-EB5{TV`;tb!JCHXnTMR}jy^6i
zYCE;&!M`6D7Y9!3yIEi{OYCwFf4h#9|D`nvb(5B~#=B%rI&Jj#pM>L)i!-$@R~~ub
z+z@|{rKV|V^_$cp(bUW)UkQKy1>J#%*u^z@796)*7HITk^XEP821W1E4<7x{m2Nq;
z@6*H5DJ?Hc?<KdtY*9aaN51g$Zv(&c=PPd{Z@N=3Y3a+18NJp0yH@SD*~xV&MP%-3
zzW)-cb!OJz&L^!qwIV#ZVL7{$`$^Rj*S*&BKh3c+5z(*u<SBIbgnGZ+$wfcE@K^~Q
zi2j-)^!upB*<-KDkCoo+&J;ZQD*WK_$$=uTx36pqIHML=bned_S!ZkIvOD(wzJ7RG
z@Zs|5gZAI<?YXDK(>0I%Wd)PLsdfBMm^b&-J+HEy`Qmzedmod*6s6C?p)aQXc&RbN
z_p{T~D)#%bt|IeR|FCm9#QjZmU3q$^eVF~(TYFSYLN71a>)ziWS@!e9{9~-zA0MeJ
zPCk3^_uI<(?)^@Iw)dIlymxafoFsl>;p2aGQ!anM9K7wU-Q6VbA011T%{;kNeC+jZ
zzj?f5s>t1!U6Rr1)t(2F%@)}4&a=5_y1<~jX$Ir|e`|I;$l+?{VbYRjo!s!z;`w!P
zo5!`BZ#ybF4zdJ3HRii-!Tm_?^kS6<o3?J{mh*SJY%y=G;esoxHJ&txa4L2D{?oSk
z(IIy$*2W1>-Wcxx*sL_~VDP!3`kwWTGV<L)?12-OR$6K8xzi@NOs2|ruWVp_g3sih
z=M6Fm`5Nc`RLo&I$23p0Zi)l*b%p?@nM;Gq-m14s%%0UItp7pavAP_?m#Q<9|Fi%2
zzw?Lik-DOF`*S*kglj6b66KXIZLmIQa(aRFg`!DD8cfCwCoXIFZw&sy(kjl&no&>{
z{Q7drqc>M4t6$Om*j|-fbF^<IpJLK^52KBOd%b^{c5Ib+F0hPo#r*a)9!I^!R6`im
z&7aG-N(yh<eM$G^idES^CjVMI?{N9uS^pF#q>5PnKmR_(-uuMMo9?FkemT=mY<rzy
zvvY!CVCY)$C#(GYE?XaC@1O9ERhY3*lkv7Zx9H`U-yVONl|EN*gZbwlpS}I3lun-H
zYP-?XW%;_OrwVI+_P)(53thW#?aBaN|3wLwFT|KH3Nvd36f^wky)u9H(zf(75)2~o
z9my;kI$5j=ol6CMJXPLuEIo4gdE$(tHIrf_U3HdSJR{bdH*1E6uvw5vl7)NCl=sd*
zt@xUsyCf`}5%*DDrakOs|G%mF+7H5|LkxJYde5-=Et{43lW+em{m-v6mfX8k{`>1x
zdF>rPwqAO%W`~EU(NlgIwc6io^VV<PzBo{1!LlQq%8fqyt?O<-O&6RYnPs+^Nj>D+
zyV<oW(T=kcH(A;%ha8m8HgOfxJT&S4*@I7<#WgmRy-j@hhQIknti?X5{3}@u-{vlz
zto<i*D(kWWvDW9(Q!jS(nS5ImWcBg$#w@Y@OjT)LUI<EB-ufi5DAUyCLh%1N<p&Pk
zN}87#;^<nl^XLfyCL?*Tg}YOwf5dM47@wfNSM~Aze*Y;S%e7b}zSh3+UsZPXK!0+|
zg~^k>7K?qjJkKn<m2ufojuVG;A8c%5KWZSc%JFN@cZH}^LX$gJ^LT2<a@1QYDh5wo
zP%ue4VWw}_{dJR$9NZ=IuV~vW>D*`QgpN$v#q+OdD%WYHg|BTpSz}r1cY0|~T+V%p
zecdLfX)h*yxoqjAsC6pvQhvCnQc5ge{Z6mmwLy>Df(|$&*hag4UF`KU`d56!@mUl6
zKb+S5)O}Pmc8mWMp`cXHiJQ$c53#;q*_b8fvw63%oW$?x7g@qic!r#5JIKnfxBW)s
ztVdc6)0W9E)NR_-;JVTJK=j!r$C49r>x@pWFybhYNy*&gG3TLo)wAc8H~xLuo$uhd
z`s@$QocT|<u5FX#|9j~DY1XpNjZ=<ID0gZ9P}m>He_HYNI@QdF4in!gmmaHWb$&a)
zc)<;Y&)pA_B-|1rh5qF2&8|9I9wd8prGjARCHK&p2ST6JBW6aP4sw)t&WUB-$DaAZ
zQA%E5$IGuDa-@zXM)JO7wfc36-Dzq{k<HwOh-upK#f&-n?W{_+=NIpPQP%Zz*NqQ8
zPbNJHT+4mCXWERU!pgUoXLY~guiByWZsYcJdG<&3e^g`nKD_IAnjn1O%<@8(7tb?P
zr)Vc#<(|+Ote`b(g@v#F^2rMg<k}nd<Xkf}P%~JW>3XH*pVGw}TXZ^fI4*o-+rWD~
zsQyv9<@61lPT|+1(%&DM!+k=$t}l#NVr?C-zXE6GwW9M`!3zYwSo|wk%dOJ+IN|An
zq905xr;Dp+oh>Ziu5*h)LT}fKi~TAOtQxg$CR~jFfBbv(@7=N7UeDYWxMSrGpF8op
z#o^zyyVEQty4mvySTHLHvo2&;N`GOUtRABD=%?oC#zPE!*GnJ2fAVa~wQuGej?!L7
z7C+r|#BzUVrEjX$UH8y=%a)1sdW7x!Fxi0ZQNZFe*1Ohzl8ka?|Hm@7?vz2*`~%&>
zhv#Zl_=krbzL%sYX4);fnNvNGaq*`RbK8?o^Mf4cC#|ZS*890w!~D}d_355fb2s=4
z9m-XIpLbC|>)W+po#dWHGBX=Kvq=5XwOqDTB1rs~Noirj@pTvV4^LK@tHxTxyWQ*3
z@tIr>FCL{#_5HHAseh~e+Ix36ZdIH63gx`~?tk#@`!{#?KgxM4ygycW!}AOC87|kV
z%&E?Z-&}L3nd6#H>G6e2PwFndqq$!6-u5ku-ogpLY<<_S`;^zlcYkHo@|sx@PBrtD
zKZX3R_5Sv7m*;6a&cm925<ar5V%+I5W!B^Q607o*P9JT0n$-PtmG+L{;3+Trv`#n2
zSRMMdO>OU+OMj+b*Q^eD8|Art<4q+lQ+w<AkEZZ`jtu%?erd7Ex%EwAXRn7(vE5do
zSb6KhT#Y5$F6Jhg?>%>qnX_9|$@87I{UX;Z_ahHgawrKE?yLV(me?-4`uw*Sll}_-
zlMUy8x@k+T_(rBP3||TluG)U-#%XB-{sVIy4m;&(Y~1)?FpA-87yni(#=F+7^BTpz
z9So7_T_nvtr6NV*U@hmm`Tmbqyr`&MU%e?Z_n*OI<td^el5NY5*>-K(^CFR5$jtXk
z_OIT(LCrZcmI+^JXHvfK?Cmji#)o1nz3lSsBgM>Hx4sN=Rxr^%c_>I???1*0?wdDz
z-cDP!F3agkxs90MgS!^X(m$`M;L)14*z@YkTc4A;S4O2zTlAH~Jmf;TZ#6UTA}+Bh
zuiyM~lF;4o?SJFjr#qUPOv=q{|1WH++UVKbmKeft%JHd}qt9+#hijHLJDxn-$8BSg
ztt9ncO{qS_b=8dE<nlPa+#<Qa<0}^*$~d|4`x{MWS1~uc-!BDxiY7d+lW<$1KXInr
zqiOLULaG?0em|L<!1yBJ<mSWItFPHzpEZB&!fT2VcDv6V5NLYHo-kpNlzWa%tK!$`
zG7}2KLMGJqES5gp^mrEc{g40d&946v|L@bJ6XJo^zD^l;(%IeR+0NX^uhDpDKfQVN
z6zl0(>RW>2Zh0jw7P>!yYuYW_i4I-|Ce@x$-F^0w%rxVpuK&-RKPh-yaJ?gwXSKM!
z#>L5z%fr4c>*lRdlGm!*ka(>@`{nAQDN^^ZT03rh#cjJ+SGV+Ho$I`YS#H_iUh>cL
z6@3=5LcQ)=O>yyM<zV*xE6x7Cxt(wJb^5255fzhOdjI@#wD*^G)$=z!SEs)^bJ9p!
zI%wgP)Pq)=yANp@&uzNLP%N_Q$|LzFEev<(Fa#(VZHU~yH`d5SGed#-F(2#q&?nN~
zijLxM-d;Sd!+fP_$I34oyzJDi5*A-d5|5R-vx-~0D5Lt6FH_{=n|GSpDh-y-6O3Fl
z(Q$ri+2d0?)fO{*sMU3RS}89tdfC9Mwe`-$gAy`3R-D)p+I_p_(6ZJ_r_)<+o9=#O
zTl@Q8#p%P-7&rgbJS9Fss)6k>?-$R#GjDGfEjxYQEW^y~N|N^ezJ$B`j(QnoHtPzk
zcxL5Pc04QVl6Yy8iHh!4Po>~X)hAPrSQOvBbx`W;+lt-nyYJhuOFOPD61l{A^TVg3
z+xw=Ah6(x|(&!fwnC5wax2ElH?B2Rr*U#QPbtdC!!=1$M74_u@%udMNzW=`<VTO79
zigMd&Plb2>xp6K3gXAykFT0M&9eI7X@tDb39p{-ci{{-;jc1-Uarc6mYaE33zo>X$
zaj4k-d&|3TMz<uQ+XUDh%P#x0pLmv5y#D^4^c~kk*WP70AD5%!`D4GsT+5RBGx-in
z-Z5$!N7+C6u5dPC;X84glJgA$j7#P}`*y^%YR%OPvVSHRxwMw5KhPIrERVb*s&Kse
zZ92QHi$^}Qf=B+oFQG@p7|$>AT%K)ObfBB3*+p;Si-OD>0q;VORq`EEU;mB8aM$N|
z2W+SJt((R>>yo6x9odz66ZDU#+q9T|RorJKv*Ts)a}H(po9*#tT_&yDy24gHy>VXO
zu~dI;oY)Hi&XaGaWHJ7i{8$*e%%?b_`QVzw1qUzc7grn1Jo0DZu8;fP96NXKPu`oq
zn~dFOZp%J*ew)LM<`wFjd2`t>ehZZP9XVxvhLTL(n^gyIOxET$`jc6DIrd56*L&)c
z?awq^+S_hk{7_J7`7QCG^*rCS4N7x;(qjEB(%Ek@Chka0jX4~^&U_%?%-rw4-)yjZ
zH&I`u+iBgy+?mlUr!oX?`g&pi>ME@tiMhFNUmQALz@N;+(owshB0K6$Pl9Q8m{F7x
zvq(T#&5DAUuSbP=y083F=5%n04Vt3v>T+>g-$ucrT0vHE4sYj63|8ye7bV`>KX1`Y
z>GQjGgft`t9xJ+7zVwaZ9j;$%9%gK3oj-B%`t`@&e8^_E{i3_2BrlwEt(5blds>>)
z_itS*S#fnw^V3^**D3EV><-8`zxs-!-)9Q{(RWinTwOgs>G9g&d>hH7n^xSqV{Q0-
z#!-gkL!Ac>7yhp>d#G-8W%jr1ql=C9MDJ>U^kh@m#VKD?W3^SJv$FR)bqXf)pSd-s
zBx;64UxGF#uSZ_#G!5hXX1g>)8lTFDYSo16em(mj<m=v769RNgSD#xt|1Z-$#?P-b
zvY%d@EO^P0=ZVsvs>d7~Iyb)5>2;QT66X};_ogIe=ie<e(%ePv>q;FFXR33(wLUy1
z%eL&SrVvwww5o52LfyKZcaAQ)*VXX0A)Mi<W*6g<A5GuxyT5Q1f9}2R;#^(6SRZ4S
z?hdE-k@wpI8+R!0?a)Z}s7aV&rTv5VZRd6OV`_G?|2`}|qNymkaiNHy*X)Pp1{PQP
zcPQ+d(f9EOQ=Va5;*z>qUk+NWcbNHrkBPI|Qin^g_ws{DvA+WsvW2~km>BjT;k2!0
zs`0=2%Nzn-kHjQXl)}@G9yOU>`}D=igH~qSE~Nafd|vS(Y}V|ZR=)zw1p{9O{_y(Z
ze{W_)6z9_f(--XXuQon#mtyY<pJXD<en5X#<)6(m|I5^3xr#O|nzd@fI!@oi4i=uJ
z-$gV^bW2Y;&RwywY0t;HJJp|`MX+5h-+fL%>~V4Ug(Fw^8UG#K&VQqvHRjvDE!Pfc
z%vDodAiH7R!ft2xTBVbHFCy2<omsw)>r0s5{MjKNUWC{`Nx%HLubhRc)ld7O*mahv
z<~KN|9r)a>yMFn@>(a;l&o+0=SJT)3wYKSiaqGt9)aYF?pO<hcaBP~r?d$qgQ!mzD
z*!OYO{_s+USKHn-3b(BlT51)1FYn{pknBshedBrZw_hmvvQ$TV&)px_pT3PtKVH4-
z?eEg?dGk7_^sO~x+4>>k!jbcV!RKCx2x%$U#I)!iXk&Ix;!={@zSP6nqI%1m<b7K#
zk1gCNy5`RP^71>(duDBqbB>?8U2fLQ=Zm)AVaol%5c<N5Z`GQv<tMLP^fftlVXBhZ
ziTcAc{-<A4tBgEn_xWaHR@+K7zKA3jrWxA{1+JLPj0unY>z>ZLro{cIsgCarZ4tvQ
zi;V7`3(ddmyD_lzZOH93qj!h0xcfyT?XE?fS}@D_1gqY<CgsC?JwG_DpB;3a#5D2D
zod-{r>Dah4GnIE;pLNW4w|2&HPZ|AJ)7I`?7`-)egF=VEo|v`s&rQyh6j8q~X;vp0
znQ0Q>_Q|s3w9TrpF!M`|?Z>|x?NfZ*lsHM%V?Em@zwf-tOMM^j5X)(vKdCA6Mu5k~
z4IGogoTt~nmh!vd==eXiW}0vDUX#lkA1UQINQ7+A3wx?{yzuJrw_0mTgq}akn_Dy2
zNBp}0x8&W;4KEY6yqcN0@r)j)ibMKDJI1`VwXu2H8uwOypB45+Ekyjlytwk~y+$!f
z-$fX6Pw%(&K9)P%{*}Oy7u%-pKa=!%`eU0Di#!hsn-^zay6`k=f_vn)PM0$RrS?3U
zeep&?b6z)yTC$2Q(m1ns*9yks)iGy(D18cBlV0ExsbLf16nL7$imRk;Yb5Iw2O*sU
zT>RJUtLC<8C;IK;yW8-{AtLU9P$pCNsYQYlX607@bP>4v@z+0T8~?I17dNtW9|`}k
zLfL8Mw!L)^CN^h>JYT-+oBNr>Jtt0=A3j{JAOH3*6aV!s4>zz?yjlEhP4rV|1D>j!
z3`y1{%cOs}{Y<aFXKA%TMxXD~^^|<yq_wL{7ui}~U9%}R^i1sYb@#J=_<y)vBRA`C
zt?0K~Cy(WPDEaW@WN@WN!o_DrW^NwNToc$s()Z}I-9Krg>S(>c)qmIiuTSU8zj)98
zW;@@`7ZFCX^A~QOa<9yG)6blelXF9NYaUL#vA8(o$@Om&CY`T%u-Lv;=5GJz?h>i?
zenSh+LaE<@N_P&`DZXi7xc@l&wA3O0l}vl~sfSHgH(&br)T@C1Hr~sHdFC;h+?#RN
zdhN>`XAa9BE?fpPI{zxE-2b@1F*kC-hY2yl1``U^cCaaK=dw*c^!rUpTrZnscf>6=
z<qtQ$TwT3#+Gn-TIxi-lm#FN@Ei75ad3a+uW4mAEyUUihjRKjOPFUXXdGhS|=G0pS
zX>xu{7u=an|Ln@=_qjN4%e$$Id3Fb0)8KtBQCsv}{6*Q38R8df&Wb;O$HS4eqD@SH
z?#o$+#Q*awytcL3WSXIOgMY&j#)8)EdzJ=#_|^Ya;#Ys{nLfE^T8nS*W_oq`){fBP
z?%kIgd}XvP{hvu}Uw5%XSe|d$`<ycE8&%rhwFEwg2U?vyTDWwN<F1e^trr*Y?%3pG
za>~+of$T|!ZeE4hqKPR6ho*T<xpC{tqnM>RTjm)u-n%}}D6y8$@N&+cbCVsKYq?rw
z_t;w8vAp-YFu(r&kLzlgBE2nUPOU2DUN>%>|DS)#*nY~%ZUf=od(i>>4Rf>?tf=#T
zFIkt>C;rF8GTtimzi(=ixMdW_x1@7(g=H-7|4*D&a$^2}TecN@ZY0h9_gH?H^gJ2W
zDHav`>v@d7JWKVJ6O?d2VeQEDVVOq7H8n2R>tB``1q9lBoRgzdQnqJCcj&>gS9^Vq
zsa~;OX3Jr&k@u#=RIAQ%-eil6{ZcXM$#?p!A3sfuIOV<MvYBGv6y1y;5ye8E6WCU5
zHVZoKKJ!x1i{4YgsY;(DxexG}-Dcc0t<?K{YDivvw4~^R$FlM=wV!JyH=SuIeapzm
zru53^e73)jlCAdg4dHEB52d{y+_F|$HC5a^Oj=(icTYyn<D-krzTG&toB5){PLl=G
z`o3$OJ-{3;eZ2a!l!b-WpKsFK-sP>U58j(r7k1{&(#!v*W+ie==Irj7qj7MC$M=sO
zcbcy|NG-mu@;fZb;-*dM=lrdAHvigW?xz<kF#o#ux}d$&bUJ?7?=+E_^!BT5-LsQi
zPB*$rOnpnTYjbzMKl_!bHG+RuxPX-ASKZrP@!@h|kxy=}UGZ^xxQ$>Mqq(5N^8bH%
zj+h^ne{pqnhvSY<lQsHkr@IE+7hJw!@3SA?x$a3D9lgCb>Fl1e{c2d5ZfNY}!y?Dk
z_>E^yzA5qL^8ES>d2`<;Mzl{a+^Ao+;rp|%=a;w`>~fmp!p+t7PAHJ0L}k)k^<efD
zduAM+b97<B$-pE0y#hS5w)Xt~ILqsJr!H3npN5Rsgikt(xjc^>RaWl(Sbq0W!OV&u
zkqIJOB0eii$1R<1b7YU4%x9Ur?k(b_D^+rwt#7Z~9sT0xno8d%ovW99eQ^D)TE0M-
z_l}d#z4WXeUaq{pRKxx2VcAJ{GVGl_t1o$3e|=VcXW{X(GP8Y^>mG2`9hrVu{Qj=q
z@K;{ak3&Uk6xjDn4)_w;!m<Bs<mp-aVwczbW-8lI{H@WjjPLu6cZyX7zQVmKz5ItP
zxm>&+t#38^Fd-oO*M!#pizZrM@R0nGam)PMWhvV=n``$!*l;SS&hATnmvFU@%+1Na
zJ=gvHSo-v~eo#QQq7dsV8-+Czyw62+msD;&nJS*NgE84Y{!CrM?@Y0-Ih%H5om=g9
znK5m4QhH{gqIl8Hj+J)q?y7t@c5ZiVue|&vXoso)g6U6$3s}CI8nv%@*TWQC`Y%oA
z+f?CWYk!?Pz_lYM(eSMApU<b*vldm9zSLjz_<Csm_i3}HW!wMP{mF9w-?Y0`ceyt6
zeSTr{@#O8@x`wH)%X|Jx|JwO?&9u`8w`yOhzr(oj!}{6c_y2K+P5SZv==QtkPX6aB
zH~V+|{*UL+j@8fm_xk@sy9qZx9sZqiY|7Gf#(OFipH4r{esNRmH}5pwH!u13SDvaB
zP&7Jw@BTI0v&CuoF>@Idb<Y-W>OQ(O^w&AQg-_==zRpn>mvlPdw)>pMiS5VPn5~o=
zZmxN1#>{HUb>`BxEjBI<s;{y|eqLL=OCrM6UY47qROsQ8Eqkx*oh^7>qgMC!S(S#J
zaY<+HFYteGhCi!eQTK8=?pjV>&bPN-ZTuSd%eM4+mr~d>pNq5kt9MshKh>Go{z2mW
z-?Q`An@@T9c=_Rj1s}IartUxTX6o7hk?I?n_gtQ9AD<+6sc7vbmC*kY(l2zc%`Uz!
zr7PeS_FIVU-+s-c-pv<O;sYK=9$(|Td#_EX?))(S`l;0i)^4lc-*Kj~?ES9BKb9#c
z@0!)#|9dFz;DkqQ50c-$;Mp`=tj<s8tLic~>3>?!p52rF^wqUswL+n(|BU5}6#u<)
zyvuvx&3u9X9UiB=4CkAttkiEPzxrjq!1twU6L+unt4-P;ZIs+T>%b;W+twY~cT}GC
zJX*S@nXB}>*xQC{o6BE>D0sgyvHTU``DbHHz4p}UZ>qO$d+WASOkHJ8;5PYZZa2Fm
zqJJ5xZ`pR~!1Io^S9dS$Q;1eRcI{nc@r2ye*J(?Qlu~qq=g(enQ}`M0;|s5^ZBt{M
zXMDTyS3=2e0do#*#&-elIjs$wcKGf7+I;BoYl|4(l@8*s<a~Yg!?fo&$7QH>go*|A
z+}wUmB>2$uL_P~<zn%Ht7lmG1xHM+#CUJ`e{vLsW8EFOYHy@tyn<39?VawmmC9@=d
z-nOpX9=~+w(~_X6hW6e|Qf`-cc~zXY@ycU9IBm<O6#|>hlDIyu`pMw@oaOGtBif&$
zm+jji&$|1>d^uMytJdtjQ`zb=U)`2TT7U4LvzLePG_eVJ4>clA@+ltZ=JPqQok4WF
zNs5ZS#|52vGq1~rR4hBC|MrMOYSX)9wlD|VHI_HDK2Pauh@MfjYR^rF_mgTaZ7noD
zxocs1-M1C2+Y>d@#6uRYJ2zwce6Iex)uQ$juFiM;xkhe@`{a{%>}HB5-rXPkDJY6z
zRsPb}_o-i=JZ#lh?n!y1Q7Jk>OSiA*fAje>Mqb;(Ciy6)Xr^y0C}w)9I@v6<Dr!Q3
zS4{Q;FUzZHuY<eacx#`ris3E!uQQWJjQ#p`zXK0)8SK)+lPf+iys>`!wYt}CfqxP<
z>Z+CdXee=J`kTw9&G6Y7w0uwDZsC%fpU<9sZ#FOA?)SWxwc-<hT;>rJ5DnxMm(VD9
zB7S)8%by>9mLGn8ew*3;`?qS$WZuZ}3;Jx`xXFH>PtWv4eW!OAteKbl&Aj>z^S_t&
zztb*TUhraY2%jf#_)qSXyS-}@znVVl=aTq5i)HUMV}}D3dM;sAg~xJw9A8iFVb{pI
z9`ai1Nc+}(fs*If`JR{-@U4+&>w!IN2b6zwJQ8G0|K<6y{ETS6LxAOx50l~wwe!y(
zyUZrN=l<P=vFlE+NVxA@zwhrhn=Lxa)21(*T>JTv{jd9V`vnekr}r}ad%XMKXK}WM
zznKM+M>o$q@QnR{^PFy$wi#?Z?Y7C5OaD4wp4ly}-SbPtl>1b`ajO^QOI=f!>6}gR
zINa{#a=1;fBbTdq+ubEDQr~1-US@IKpR_zYr91YMq{%|nGWR?8o1A7fTs*Pj-nPx{
z2~~<LTXrvW&ipE*<XI^ZSbX?fdHmb=d+eC1PHP{3y6#UzR}|+%mWEr^pT35i3|Q$d
zUUAk^jjfxh*8i@0!%o+0DHHkhFYS@&OZqP(!l8CUDPhU=Ct|7Jx3R45-5nHZ`nGUZ
zv1$J1%`GbVdY6+H=3F!2m|o6&i6Qi3?(1LPLAkektLGQ<ZfDfp_R=DyMLlj=pkt?V
zXKpBWbk5t$x9;DZW%F;(vVDzn)LJt$PhEcZHtOh;)o~d+wYuGI$~+5|jQ4-#UAuAl
zX^F}mJyWMd1<BnB_sGt@vu5*w`2jP+XIcrY_FYgcc=sod)YCKkrygvXb<y}u;9bQ?
zyTh$z{1QPCcYeP))}MDHk#QwshfDY`(WB?nN_bbkY;In8@5h7CCf4az0hRI18${!#
z9q?^V)L3zU>hI-$E6;>wu3IDJt-kRPzv_qj&vCKEH}}MDH1M6;bj>a_R5-#bJhau?
z-cqD)nzz8xrG3UCrFqLV{@6Hd)A(b-f7Lu8!S9mBpDA04j~@xVB5!m=WmQVnimo#y
z*P=_Sc)muK==nYP@Gt$*hvN2RwNQaPaq~K@&6{hE=}4_KwO&8@Wqk1FifVED@{{+1
z-FJ8hf99Gl(=G7dGU$JRb-dPJ{yLd=-+wP>ICS25!ka_F+q4y~T3%}W@~*z_`m`$x
zUMLCuUaa&|PN&AiSLg83ZLDqcza8K5Dx;n4pHnsOTdP%DwJf6L=0w+py(?^3XSed$
z%N?$he;4dz3@Z!bv!CA__r$XA+Yv?oeW5=lGp$&~^5yHKlkqB_7*vE5yCT!yU%g#^
zoVT4vYT0A`#5WGld_|`oN&fUx|FojS(MRzf>lA-p(AVqJc=Y+H{k=#1eujA`Bocbu
z62q>qOZdjkbJcX)QTJCXqQy2kEY;VOh@Q7FJI2MV{#{W5w|%^&sD8DP|Dr=PzI}Rd
zJAU(j_gS^O=A7HHZr_PCtIqzNvX3&wJ>I^PJAbI`YInZx#LJc&9@#kmh)i6k$hdA^
ze#VxPeTs~kH|IG2$UI}6qPV^6UyWYt`O7DYwQo&%=@WG&;{IFt7^TI6by<<UA1*6x
z7Ob1LDPY<Z0q>i}8<i)BNj9FyQhs=S+DWyJ-n^!;*d^byrsqy9x!1q`*xEf4rR<AS
z4#|7%%bXMSW6tD@yZZJprg8K%)yMzYJNLtrquZD2KhKa7-E;HU){W{~_w%1_U{U@j
zd0isEEKdJhdq`R9OS^l=PWN9~u9F`&UG(h=-Cpk7Z*EuqJ^I%6#o?yc8gDGuv|hUI
zyQ@;VxL(6J|7hZ?@|}`5JCeN4+uhSI+q=bS?#4$f@(K^`R~@min=5YgZpGJ|zpo2i
zxyN+iuHMA5Z@2h(4{xjT+2XN&|Cgi3`2~Nl>Rw+bb4>C3{du(|cOrE*IO?yx-Oc*z
zmfL~o<pN)K|2}en`ObM67PkGjkL=&xotITyesBKsSLUA|?rpN$pf17D_T`t=%vmbg
zvisB+HOj117*AjNzV9U4zO5U#8nkhrwyRLOvGbvM(YfY*IXdqvX4n?Karb<#)q6<q
z_Y#)x&+gw`tNup7VE#KlIc0wRjp6Mt&%M~edN*$Ir5zUyubR#fO}VALPjJml<97WA
zoM-1mzBoDA)IG>Xy;1Y_kw;rCPcKNDe)jIBB5Sn=-Nv!ApWJ23p6a=C`U8XAmx@mA
z>D@Lxw=A$b-ZwA*ZRF~MF^-$wPD|=smT+>-ExjhOy*vE9-cFMZJ5wVc81;QY=q2MQ
zp)F;?so%9@;%dIE537GB+^7}&WB<e5NB#b^JuaNR?fEuamS?(&)0q-is%7P!EiL;~
z_C0r{<ErCar}oWd==+ly^F)0S^YR6!m#ob)ys6|I?6~AYeeRBJh8DTWn{x`~bf-Me
zT5vZZs=#S~;i6}k*It*u=$kb+$nk_-+0%uJQ;IE~9Vq%g)n6z4)Sd~GxKw0~g0{wQ
z+|T6~71yzSuR-BQmi#Tv%fwBW%`pyT6#2Zw*<jb3{WmsOel!X>wMUXQQ0tvz<91W2
z<v(XXK74ViZ+Ksw#reg_9fpAsXX8GLaxUJ|E3nc3QnLudq|yl;wFx%$8xDs$?z^(<
zI(O0a#^sjJ4@|e5es_b?-pi{t&+>d;yw)~bvgTHd&iy>jtap`cmGu)|U)`H(DZj+i
z%KUfKz2i!yZijBWT~A@SlTe#$$D#eV<Q+qpsdRSQyH#`6KRbBZP1)7(MR<l3%jQQ)
zu}?pq+`4tEvXZjk%~LMSsdb7K`5sI^!&EC4#9u3s+LU-hLu`dq$(2{pkV#Sg$5Po3
z-(5CNvG_4f)b#MRMb8dDpJpgOO<0ec|JvHk`M+jQQxQD!V4CV%muptuk2h!~`|K#+
zGylkr@`Z+%XQf(Myomb#(vgSb&y`*do|BO(OT7FqZTt1fbX~@}KNVlKrC3(ETx9>T
z?@8A&#aago#enyTOC~HidR4Dw#s1IYPTkiX*6Plmd{(z||AVYBCyQL~buD72g{DYx
z?9l7h(OW<9%;AsUKXJ31ZvPnI-I|l7GHC~Q_&#Qa&tg0`8b1Dbw^AbJ*3RCQjj}&v
zJjGqwnUuNDERr#}ppu$&@WReq<L{mVU#711Vr850>~meoN!N-4jwQk;&;I`66=!ho
zTD`Mz{4(X(uYU29FGOawpO3j&KhM|BS!lme5vyUP;|8CnTP7xCt*Y48RyT2LuW{Uu
zY=tfEi(jyr=bT&im3z&#nHJ@z>`rNS)xZ3I>%aWpT|%FX&b!T$e(@;x%4M|~uN@}G
z3i5ie)_z{t+2|<KsN}Bubn|PTDOSgO#CP<1eq}Pev|>SbmC$;IqxDCRYO5?<ae_DD
zk=7Es-!m^iJ*nB&7q{3#`@pJz>(hhp8m*mr<HkWhlh{dm_q<+qRW2w>`?2)PT271X
zMe(oB-dw}v`6_tVGfQV_HD>3KJMz58c<1eKQdl5iV0ERo@P^gxgHu8z=O3v%u=3AW
zSE=GsUXk3%Q)2_CJBQ|5avMCKvFn%ZH^ZCPO`a=m)L7W-yX>aQ+11mPr~dK$pefwh
z9QyI`oe3*8<xI_8WiGJZ;CRPu?T?S|yp3v#{;=8Pc);N&I~D#3)Fc#kMi%ibS}R|4
z=8D_x-(PEaJda2#U7Z`%<l=d7azKpSJLXnZo6pIn+uf?}{}Nm9J=;oE@6g`mTUEU5
zeoYc?5pVMlUtu;|t;>0WWXyzPJG@&g0}Iu!d5QF#QRi6M`2F4~lfomZ3nEk^FE5+H
zu`KQR0s-qsR?$`y-?NKKG;FD{YEwPB#yi1*=fRFcA@?NJzP<FQ+!Ww)Y@%P!s_o+I
zySb9zc`Kg%YjdcYYyDrzMTd55UdyWUxa&an8E%E`dl~qWY!+p+cuvsX$zb+lO84q>
z6|B=P8ub-;oq0QX$KhG&7yK(dX9@6Z+L$%H&TIWo(Wh;yGg|~zkD4yjv^*YAJFQ@%
ziBwny=dGm%_05e-wo0wqF|B-+y=~!1TlO~QE*@vCDFt_W*@T%aOS;4o<5;J5`FUT-
z>3Q(K*J4es)~}Om9)CZ0;AEG~(}d%bXBWkV@0!cA`0z$uZ=bTa=`&Uzl%4eAq{$5j
z>nYE~pXDVl*!J&~%Kj|9J1aA7D(u-@zAy+Ms$iAQjJ7LD;mTv0oF=q!&fe<!5*vwk
z?-#``dy}<by3V22lJfyAO`_5aLgAUp{Z$h`ORQC!kaD%=Xw`(LPd{u}GV_d8>>ML`
zW#=0eQ9oKeY8ute7Zn?bCZF07KHK_k&f`j!Q`<a(?#ep4+n>8+V%GfpOuszy{AW^!
z>`I(1=lZ>B+<ig)a79^u?(0V9`wnL&^-C;sVco>dyM*Vh-8vbDkmcN7mtU976*%oU
zuj0{!j`qLS=VWH~ta`fiuCM5+u&0-;tfY-!P2p=0^4i(A{dn?&Esx~{&*k2m|Kq5u
z{AZOWk0)7kIeu;E{_^kS<m<ZMPR$n2pUuCe#U@Ra<@=EZ^Tb_$CCHYTNniT6Wv0Dl
zv>(GIsmGpui{`kzGhN=nF5;F{=C!eniN{h=Z?kB)y~eVnBB!o<=E)0hm2Wu7wu4P|
z=61&1y!x*Ex!X+>l)^*wBSm78oPraLnx68l;Vz!l93ohzQE9N`TE>gdR<|}?KXj*W
z(u$5h7QfVwty1|jYoWyg!HFGCobR^erp&*fIkj-l!O7Z3V`3JR9a)#V@r8}&W-H0l
zHny|0qL=PG?l1lC+C+^O*}HDn<DN;`TnPTWEjD?sTyN34h-Y;n0@a)mzf0uo^^Q7h
zZ@aP6*UY=|*v9FNM&C|0EGRNa*!fV><IXmLS?51B_4g)rvwJt?ciUEfbhKuUh?}uI
z$kozW`nh|g?#0Nfr{)M-+NN=6Zpd@L*lXbtF}>*Zr35{V){SpcG$)93|MY24WIoHN
z;x*xPQFf(P)`OxM#~0TLCrjxqU;5X#^v}0eznn`Qxlby&Q{SX<MfDtcmZTzjjwRdF
zNn+DAMm~okSBJ<AR~>Jx&~W~Hg)`jht(O0;YleIJnx?-B@XFdS|FgGl-r3)a19dO1
zc{+JYQ0ww_n$xcB+;sKz+lh}0PtNAAnl<lq$e~v!=WO<x<r{nJ^;?e1%Tp~G#0{rt
zygwhj$@nN2W2yd2-IyYVNp@Q78+kjzi~|#Y#T_{+yX}-(sor%3M_KJ(8B-^HQ9ti@
z`t#Pmmx5k0d!8!oG%4Dp<hL^HlV8hQlaR2=Svl{%Dt+g1S?}Vn=e7G|X|8n}zc|;`
z<cC7h%&&bac6LsYy?*R_h*HhN7nhI3O-pFG;URPNe`Lq9eJ#27z4*(fvHGlTy`f)F
z?5pH%ZNO~YX&dq9Uf673p4#H$7W=uhtR;5c;&eFdoAW*QYt{C?KZ#6}HioB{z7Bg>
z=>H&oXWG#svyM#(Qom=;nS19>v61+_qE98u{=F=4Dc>Aa$<=go-F}l}i>uch>n)1B
zGFfux8D3!~_mw-2RZi%0n`h0}YWu@hV_`P;nL833zjv2aNL=c@w>-~-Kd+Vd?X*c3
zG(H)}CK@(r-nlP3;ZWlGho?<CE%g#wc5zk)SsgEDcPpKK-sSmcmk#kKHnRQ;rIRmr
z#HC;6j9u6kzUU?QvM>7>HYA#`1%9gee6xGq)`u5%DBP<kyJadHA*;`Kyd(U*%>OcN
zztxsXYt<6n<yc=|w&U8^#KrI<#iXuV?r=vF+a(rVu5HyDx>fx0QVcmeZ^&N|epv9s
zOJDNDbnTLtKVIx&`6tNd!_stl%0ZTe%sN896*HD}$UTY@%9(1iZ_=|VNf$QH++@~!
zU}>9&PxbVLiaZB7Ob(o{-S&T0RK(51{ZB8==sq1~F!O+((x0HWJWRP~8`LlUJU_Xl
zs?JgEvdVGZO@<r7)s40b3;wp-bMoky2Wd`i|K4fp7zb({E38`k!eiIZV{dp~9Bx=R
zP2z~%0nf@azs0JXgZ5~2dG7oA<)!76x$_=6ZeFgb@Ktk>wac+8DYr_4vxRSdUVa}p
zW6zVoS^Yr<5ffj3;oJB?;{lfv@9&7@>o1o@s7FpHwiCOyAfV3S&Wpusr-(>TIFYL1
ze2<~K{kY85ruk>%7J6?t`BS}Rp~Nyq$vHM_9JE@N|CD+@!R-06CtuJ0exvcW^Dm>9
zbxmjYBhE~&M=^KQ);4$v@7m{nA}Gqp#WCbej<bBe!f{u7hQozlRUh<SUw>~VyHgLx
z%E@6le$S7|XBlruT+<wA;rc4kz`FgpFK5@K&HYa}@2~4V7x+DeTSffdYxbpg=DjUy
z?B929;_Y;eFS;uarLB+VT-jfJHKD72Pp{#<XTqP~`kP1uyxcDRYC}Zx{eskcOc&K3
zCPZzTwc*FwDIDKVd=LHZ@qlZu=HrW>oI^71=M`NG*yxr&Eg`N*Z&CKN&ftYf)vi^k
z&6*M$IulGq(iR=hG+VvCh4lzyhGmZf!_Sv`mnLQ1HQBvMM88GiX>-imCDNCfVnTP8
zDKFZ6;MHZtNahnNzV3%}cy>g@xGgH`v`&kj)BAGb*P8FUb!YRl=1qScTdEi9l9Ur|
z6>A}J{&3sd{H2rQ)PuKsMHK{Hn)mhFbCvKOKlY$$`#GEzaP`iL-L~H6ZPhO3OTTst
zN(j~QWWQZzGly&Q?#CNEZ!UiLd-|s9s<Wr;br6Z@NHl2@mEa24`ysusN{;o>y{7l^
z0p+g8GPs#$?s?UB`eS##=G`qjZygo6Z1nKUu^+Ra-@BfdYtvB_zwt?4!0Bx+?_cgL
zj8VO~Cj0;1D{;z`{_%<|5UkoaYegZ;*V3P5pI>K`?0-=@y?*)vE&GRp|8`urtYrG`
zZsn(BW%JzT<c7B!f1R&fFi$Nj^ts2En})mUTR#L^*K9jiRunY<{=>a{dNzn{IR47)
z_VG({f`XMcJ4}>Jy%Y|;Tp3bx*XCu%f={{Y^-pqa{dpo)|0-u_ZJ5$l@!6~2DoQf#
z>Yv5_cuMe>#df?uuU=+xnU&u0TFr3Rm5-9;ZU?W*FZcXYv!|$$#bByM74!YjiE_WM
z{wh7tt+V&p&D4FtcK0gFFMN3R^hZy-B0vAfvkwy@f2w>>s@wOVlc!zeu$$WQ71ggw
z^HSUweejGrGyURZB`eQEL61Cje;u8gu*sF_#`?S}lX<@mUb=cWuc)(Y<BIkt9GdLP
z%^9`X?RHbE3lmPaKjoYEO6+8Y%m%@ht#>pP_Wlel%-6lMXHr7jjn+%AwMyC+d${Mk
zVQt*=`-Yj&{tJw+GE|D4A0A|#wIx`PJx`DCie}%Rq$rod|G$*D^faz;HjAtde5v-(
zadx})aeK+%OLzDyhRzN3x0AlKX^lzW%PR99is}!KSf9D{`HcMHoO6MDEAz|x__SUd
z-ZT!;?&JHO@p5~vna64QpSvpGyU2-01~PU3mR<X4#-3mA9D^c!R&|PSp1c%ku<|GO
z8R5Ch8n#?L8eX1t+v4f<f`-|@eD_V2EOOIk`Sa_!i^Ix8JSG#IIVa~lt9b9DT&H1v
zZ+9Bgra}vucxJA@IXowFf>wV08YBHA>x7@q>+QKh?$-m>Wv>_c&h+1x^Y58yKU0KE
z6wjn)-Vv<4aYp9N!`Iad_*buIsgHjcRk<hXbV=#4OPd7s>!WV3N_!)J<C*Orri;lZ
zzfEc=mFbr~vbbh#s>WnxA5V#d1&5DsygtG6?SZACOX7dL<ew)~T%7$vt;~$$y!;|h
zftGdO9vIG?aaK3XFvnz9;l>q#TaxcEi}IeA&sn|9chf9o9k+W6xxW4mdHHIsWCF_{
zZnlq&8xr4VJdAEzb=c#onbOWg|DGB1u9-b}?samb)?Lf%3*vHogco@!@0zM)dGOS7
z{<W?NcMO6{LzA|Y#)}{Sc+bvsQ*dJaS#QTbkB(W#YW)8o<HWpzD}1Z>>isEc{Y(F7
z)EnN7_X$tjRr>AM+26~j{Ek|#>3-Vtsc0noRO9E$?{7s^Ol&B<acxJ2b6iijkmA1U
zFPUDx&#u&ImihOxBQdHXovV2Dv<Ke}<y21no?#Nb$@beMj+{6CEWsBTKI~ihg(rCZ
zmE!@{IzDsT^q+1yeT66ea&bWC`(>U=vWgY6s=I5o?(P)XT#{{3<g(<I%d=13o2|;H
zuGDT2(x}S3{aGL|aZ1kf%f_AU{~q3Z=zV&w;Y)5c1+O2s&2Hz&TJW^En5gg{O(<hk
zKeoNj`;PUFzVjaOGn-<MXY|~k<e&6n`+imFA3Kdr?ies;v^X$F_)2v=n<8Cy+~$FD
z>TI_i#d{(GO5&Or&V0G?bF%uQ8&`gM#65iXxKd}QB-@hi<rCLzVcQ|zr<E7+Vb2A_
z&U?qaPc0RayCA=^T8Go;w4y*7gZDfWxBV5$zZcdUHJtk((ClYp?CWRx@4EZGu20=U
z%#Q-{kA>DXKKyrX_VvTfbDf#F3MKcsEK^B)-Q9dt@afBsksX#wn@VPN$8iU$JbuM%
zabd!@Q|`($&7E8)^!(9Sw)x8Se{24qICfM*SY_f;Ps_%d35BgTnjgG;-1ym(cKtC;
zU>5S@ICimPnr5|^q^j~eo((F;IqO!oMrB{={X6pucYj5i+>wjyEHb=CcNQBdByC^J
zQ$CNY)ZzAR4mIIzh0X;wUKb}$Ne&LY_MAa?;m@>+9|svaSvq@sZ%)ivA*W?D$2BG=
z_|N`EXPe^<5C62*nw89b^ewbT<mur9HExfEN^d32&`$7o;h*p#|B0@Tgj~>bA#cX=
zm_@6P|2vqzWX5jZOE=SUZmEi-n4JyG(B`Q>6n97Ht>SluNgua5e7PKQ#-aRV<1RN9
z)sqY7GtPfHqpI~%vcmUM$=^#VqQ!pK#vVvI{P4qzw+Bx@e0MtBK{MHINwetw(@7e=
zPcGbe?{@M2)MLsoV}tj6EA!Hc(bQTTR(WYb_S@AbvSq}UhO(*HEo){j37Mo_z@zqO
z=hAIXS3>8>EZ@$s>dd3QhTS_X)}<6qSGGO)T_U65*^cWGKYt!N^(FLOhR57RJ^hyi
zq6+q&=JHic+@_n!(`n-QszCAUSN-M=wJlp6MNA(5y?;lgisSULv;N*U&5mf4Z_i_y
z|M%ou>1Yv~8Li23f2`PqTXJMlJ3LOeb$C_txo+yuwsBpt@c06a(>9^U_FjH1x|l;j
zb2rDA>I1E@PcAF^&G^R<`|0Hpn?*hIuZ5kSzCFxt`@&DtUp`p3N9l6nMb);_J-1hx
z`v`i@v+1|~W<TlQl&OaIJ&#NC#qY1Qm*5K&%J(`X;qIAyuz9a}{{5Rr)m57B9OW<X
zW4C|1|Ide_`|B3B%@I2!du`#luP&Eu8G~4Nc6J|VPH0^r5UD@0xGkZPN7`Vs{e+In
zZ7YAph8<B|z<lcDv^gQHmm^=?y!O(@C;2d+%k>Fihu#?qH#Y42&yTuwZawd@MV6ur
z4A(0d802xCKAV<bR8o`(Iwkw9ZFcePZJX}@)h>8E)A^;#q*T?qm8JQ?H+^ff)$KZO
zKk0k?aG^(l)8TeK$6H~x|K6vID|mcZ*gn6sc<o6SB@P|2--q56Ij*17f4qAB?e;Uv
z7?;0gZf7$rmhAoY<m{16$G6;lT@oI4QelpdvYFKJCD&u$Z+*C5x5#MOla5aY3VgQ9
z<19WV8g#CFx_-@$z!$=oOD0=%uE-R6=6^^-Eli+gqv&RX2in@1(Kd58B)I7K`GriL
z%~B@QCKt}D=<ir&#T8;PF~RGsozjzyiMR6F|Fu+_JbG1^+<M^nw;SPERwXlfe6*!L
zPRo#8GM78N*>LNAxmLd1wI;y}>~^OxzUNTjdiOv;PoyDff8c}_arw<Evs(mqBt9~#
z`L=vPr^8Z<X{?4{ue@O1!yxc0MEB+|>&Kl>YkP#-TQ?hSwB^=VYjCXlSKSq9H&3@s
zwS}Sgi;a?2-TrvHc}@Qtl?p?j8P7{ZqPub|*pEHfHPJiFB|2!%H~n0#8QMP!PPD0C
z?o{~CReaL(`IGwo?`IF{|89=wzqj{ox7|vCB}NO?EWMJlUtElTImPPz(Y3Z|$2olD
zpIqSNb$FNSws~Ups@zrImmJ(F%cghQqk={15L1=Fj>MJn-G>}jG%rfLx8(bmh!3I}
z3-)b(xxDeI@$Y~wul}A+@e!2haSlk>yLiE_S6_wW<}?&stVm5|ZD}a}WPGP%jYHuY
zLk+H}zplPn&#^&6yVG=0%5;f!GFd0A`AQuxMjlAIoKx^>r>>L!%HtJx*yCgmeb?+?
zym?wu+57{k-3$Vkr{DPAeL6$%n6EXL<@?Es5{#Oxt^CYQ-#Zshyuae5YG+r3$Ft~r
zD+3p-DP%icDbBVfZNuz}c{3NTX*_Ur$>CXlbLK1xU+&U%d2^49Br8{Ue&^9E3KR6r
zmL6O8>!Oyz_SNxQF1fxxwLYzH{<(Wflg`fRPwt+5=o{0D62=NnmBpI3)dWj#rdBZ)
z@x@$lxt%ew{#*ptUY41HZ0j6+eVv{eI6s=cI#ZTI`Ff;s^Hr6%@)wd+g!|`lB?>8(
zPBYfqB(Yp|_ho~iw+en7W{lf(7M!tE)i3$AM`4@k#<nxbAGdsF-I8d={xDglLGwY1
z$Kx4pDtw8vpImq(<ej;QjjuYc<zo09vBLhB^_*gUADm{i@vYdg^4lJ_Wh;FX6Dkf%
zR4x4b)jDC0^OpIOHDp|;<(m}F6XzBa>R&6dBlD+2kc-H*Lz+jI9(lmOVrSr#O;f+_
zx|{n+_?-I+_rL(FHnmbUCEG0)n~kruF3`vhQcksdbNufqzSsw42fw{Yn)dnLu}FuY
z1hxVZrB@LfRW&#cc_~j=E7R-enCjYX)VXs~CHF%`={ydTMGu@<g|1JVqogjo-JyT^
zvR)C7ldVn3RywCjLoTj$adp%UnKVbi#z$%PtQGGwUZ|EZ$`qVsy}%arxVEzN&%?jB
z`SbfuT%6rp9?x{O?87^j9LCCtp4%TxEhskm_-;>t^0)hMUmDF@7j@ytmGI0%^PZVr
zQR04`{qo0lmT9x5D9US{3-j9Sw7dP>ngwxM{xe^EIsM|QRl)MmjC5C%qW#8m<#l#v
zOqRZPDD(8a*DIysXR-H~uGr>lX?`$!#xrBRIS;R7+@8$&reB}aUoF9F*4&v4-X?5U
zeQda-dwBn>^wBI0_DEZPd8OYSgInwi?te8ntfF_I<?V^C<EJ-rg{dr*D4OD?C303}
znc9v83Kk1i-r1Az@y3=mn=em#E9RV^QD(GS?_AC4$iE!wx|grs^ky)2oKehK#B`3y
zqvp}&6J42$JG!6sK49lDvVQwLL7l~yb&(LuBy$<5zg)XqE0!CmzFS;$!Mo$2l}Cr4
zfScXFj1_J6PGTmTwlYjxzV~0Gaq7ZjO-euJ{L?HC%sy*j5^M1ChqdaCGIMp|n&&SL
zd+}a&xFqsxQs{)c3v;w|M18kh+x)myT;pNtE6&@8Wm>9Jdvc^%jte}D__jE=`dI1I
zo-9TK-uDg1DyI2LHz@M_7F_erJE_FtO#Gb-2VHf1ITwoZ6&8B$cxdvrWY(-mi@E$O
zt^9f%v#w1Dl8$t~C=(Vba%D#hM~s+-g81PRUCT6|KlJ)+^ZE|M%aEoEA5%pH9~>3<
z{Wa8u(_{I5tK;(D>hJwesQdHuZ2MnZ!_Atuv7ZlhG2K|PB(+UYJ#f*Vo+$Ng@i$c~
zW&FD8!v5+l4|aH0q{(>X*4Lw__O4wj7Sf)7a^-hn{j>}V;U#l6rJj<$F0)i?>hywz
zUqi2)Rf`qh*ddj5Wzi~`rS3<zn>@Ybp?zG5XUp7kGv-!b;L+!CPF|9~k!w<#-Tq6O
zWnQvw_QjJHuIBtM)i5vFgxkS?p=@qB*V@n0%LOY=9}ZY_N#mAt%bVy2K_}ihwM#QB
zj0{<#qjhQ$qs=y^<6Sa5OhSI%jynV!iX*c&yLOx}_kVhJ^DDi^7ug#fcSU?qf26aU
zVbQs*A%_;tD4E&tWjn)zxm_P7Pf==bd|G+p)aA=Xdjh$1(r(V3?YhpXCLpQUFjDn^
zeTT^74o8mGdkm}-S^o=NUUs5o#?2#-4m^&KE@qP9O|i?6IWBxJK3cjldNPlp=B{tY
zSC>i2u3LIP!SRsi3ElqnhUbJ&UEj7#a)(6ANmCx>sr7>U#KNjocNWBE^sIPldLUA=
z(W0?5drkSQwcn~%7f${BVb{%^tT@q^-#fDnw`_Smw}$(ass9<Cjw@NkS~`0K#dFk*
zD$W1zJm7!%=GN8mCjPs3UGG>a5&W~S_=vFCVW#T~wK>ks=skAzndOY$2IW0$7v3(3
zpY-)#XhI#|a;N*VRf`f1?h2aIqd4J+MT^Cm(o7a*jkE|ojT5y!=7r*-KiMS9n>H#b
z)e7!fT2sp>;ue{(^uVFOlEZrnj^vzf<~9GJ?E9yo)#<zRmJJsfJ7ixROU|<7_$vSZ
z0*_RJgzrT?H@4|-nDx~!ePN3&>07LOV2@%|g4Kp&lc!ft&Et-B4p;i}ay?5!wsWV8
zD{B<%CG*vF3%ard`}XxPPiIlQu|%by!Aek7xy-M58rK|ykB^l%8ZbU_e4)+3<FW5m
zszc3dA*qI$cTekv*L|winehGA-P3Q^{dr+>=+A67^$Y5rsy!KA-vd_Xc^{Hz*l8`m
zf1yeBhG$Fnnmc<X4zKZk;INM2P;5nn%Tv|J^=}!!9PqPWQnQj>*~Mvz`_<(3zO=|K
zIWHM}6Rl&#1T&?C=3PE<)WV_M_e=j0kq`SC_y6;(>d4V{U17yysV%<M#bI)}+sajw
z5<K&2>h<qjn2>ost^LK<+Ev{3iuP-~kM@Uk`E0FLi$5x{@k0L88j;A|B~^)HJ4|F!
zG}b0XItL3qsEai9J-sHHVFFvn?+vMm%W8Z6X+6-M<?YSB_?<!GrHeZ?H_5%xY}&1M
z>DYALqoN1)n4Qvg$PSshDrc5;#Iw|C|93xCozl{2uz%7e!FS1SiT=MjSp^c9W`(8n
zZ!TLY=&|Det*QGwCk8oLeE8<QWgTx~hU1)tOFgf7thcK)3g2G#eoc(I5vS|yh;MQa
z^GxM`Ot8C~yLV^g`Rj7Jvv#V#=XFtWmz=xqQFF(mNeri6&a?}8cJfN_qo5NDTbV`0
zZPS-LSeO#oy=2|>qNa-DGctr0Zca9d*v|RpN@-Hsj>&g5j@ibfvMy5Dk$S|~`kJP7
zg27y_^>d=SvTy6~9DMhw&7-+7@Z~f&-K`T_JD;C;IoaX5_s<_C8a|Q7SJ>z{hbgn!
zlpT;UJMAc)UVrI=Z>h9##`pgXzXh9C?vE1|*J60{iNVk$S2*J7hJ-B<w(CUf*BOc)
zaGvj^vYa=@%lymQ9}kO}y00Ye^EAp)?Vp|@u;j#x|K3`OdVjqG6kkj~&|uw_c7yX|
zS*DIj(oC;An~iK1N!{72)bh~zaZuThhh=K1>$u%K0&AYV+q`Fj-h?YwnylOY<uva9
z(xFvrnQne1<l(j13wuLX_f`J3Ev$6X+iyDU<R1s?B}?v|H9J1-NPK{ARIB{vPq+KT
zRhR9UYA5H~%-DROVy42A+3VYN=0z?Io_u26vs}y0#VV`iCM}qF*DooUeQW;bQfakJ
zLGhREf8)MxNaXX-WLv2qsZq^)d(II-t{IBF%2ByKGjr3QPRMUw5+fM7;;Qc5kkpC(
z+kXfeH1AH`-En?F%GaY!UAvF3nX7YgTa1(C{+gnVo@Y+0xh_rJ=v37C(YRZ;`0OQ@
zr9HK$+V|+2M0ARGvv0jAm$b$HU|GhK=*|g=drwcjX!<L{&x$=US$0>*gY&W%S4%VI
zu_USFEH$h@7S4S<+49hG&eAmsX^Ywxy-kXmcT*?tbb3Rv`T~bHD+?IkCoX&4UY|AF
z)Av^Z@0vAFHn_WsStvzZ+_+hBU)9}r+KV69PI>h(bz*|rw`2Uf*ITc*j$J&3Thr&O
z&~v8?x6N7h-hHXZSyj7RXGNM(q0Wc&tIdfQ_cxYgi8_RQTlDDgy*ZO^M6dtc<@&KI
zetnAn_Bnr@{>B@%?0w9ib=>&uxid<uy$T&KZf9<p(!TKejYq~miqGsmx%|V*!-C5t
zp8a^DJ^g&<*LE?3fE$mSk{dra`YXs!7N6NPqihXll?v}-UfFU(wubjymEA`dZTb?h
z^T@Lfv22CO5rL680tLOHR@`2f!%oUQUSY)N>F{>Xmz~mfFLzzpyYT8C$t}5$J7@Sw
z^j>Q_`NE$q@qm<kySQ3R=^Me{`On_ueY<8}ed|F|q|&Ny7w7%?HGSd2x-hi^FK;@F
z2>s)~v^&IQMYr9w#~r^s0)rk^U7Hj2ta8a;7f*+kE7mcTRR=#*K6zwq7uRu-{<9G>
z`Gs2F%qCskAaH+H)`K>Y32ZMXGi+{ORv5RXH?_ajdQMkLQC7KW1Q++39v92@`wd5q
z&R`QzOo(l=h*ilFWy@}!u77m%^}sCd4Ux@Lw{0_--E?4eX{>9n%Z)`L>lRH(N^zd{
z?nIMT!R^z_d}q68PR`!Kzkbf^Rj1c{ood~;e40|rh0nd4lLRl%h~mrPoAmPW?&Z_-
z1Vg2tZn(9>v+8Bo#!_3AO!*XviBm6j7GxBzoc8YS`->fOn?Iadocid;%~>m2-uW#1
zJLd%hvlGXZlo}x;hTj%nH8@nSX}A7#P7e;L+j!ucP{%&KV>~Jq5`nL^r$>D#Gssw7
zwY*f<Xtn0jll?nS&aeD==2zHTuS=&Kt_M8)G(90S@zdX_0@Gj1i-qhs!FAxbf5yqp
zqPtTc9^^XtnEyTdZ+ZJ|T{?GlV@x-9c+Hd2VGljJxuvvlYS7~68&>_PJhMTof7UdP
z4Oxd)r7l{wNau{rly4X2{c_^}w&lgf<@Vb?vRfGaSo-r@h5ECI8!H~1FDZS0Uo!Ay
z&)nWk_s*V(myz4^yYzo^=hO4-^EXE9{ChIn^Yq~h_f6e4d|E#5)sNd6S0|qc{ZoI&
zKE<=K`mE`bfc5fD8)F$ZM~A-a_biA%byoPVz<1}C_FGvWEFueyPVe5Z?2p>=OI{2{
z*H$nqpPqkbwxGnle^+i@WS$q*{BXCaVmim3PwH2H1aWIjoB1H<kYSOaaQ+kx?#REV
z)zdoWP0_E6dR6)R$Fyzzp-jh~WbF69XTfI`_Ni7^plkns54&!S|H9mJJ~Sn#yt^>t
z*2a}V4UzL2+okq!Yh`uqtf)LQqbvQwjFN!8o7a^JMSPPAjjxPi%RXQ6C`pg&`vx|P
zqS%K^JO3Z@s5z?CQSKU-`OvI$`k{}D8GCgKMGUgL7prVI*jeIJ$@eoecRAN-mTrzY
zs@p<ydp__^yKi+`S>EvNz7}JBf7OYRoRxR?`cJ-lJ~Nxq<5aHKHoKD?oljm*U(s>h
z%JAq`x8OZ(>-Pja_;>kHLU%~g9Ol$HTGFduezcxH!@YV#eayEKy$q4o(CtZjCQBWY
zG|c5JuGW02dtV!$GJB_yLRH`Nh(71JQaZNJ9?jNEk(%-|uktDX^8ltDW)9*y=Mog9
zUh>*#WggvKv2Np=TQYM0>Ox-M)A^QmYhL*~Y1e}0s`$)n+B?&%d}rC~n9bg*@a0h8
zipgK<Y*$G2uY3`7wJN|R{q|;S)90I8tWCp%PQ9MkvY%Z&y>a^Hw&}HJk51(EzqNm&
z#=QeOCo<=~xtVcz-rZU0+n-ImJInOpwJ-UvuH8BGe?n1Qsogu>jT_Y#epxNKE~kIq
z#*JaK(%)YGQ76XwMPk{HjA*%7qe`{J&gZu+URid3^v&IEyr}w(&YyScn>OFI`C8ll
z=iAr4>0;cTM;~uzPrZ8ip2TnSH5+QL?YMRI%ms_y>s$S+g5$1dJ{43F{ki+o>-Vc?
z8}XMvxiQc7Ulo7<A|sFM{wC%Il8zceM~%F-)^C}gX7cg+*4J^plddv$Howv8GG+e!
zZjR-dUr#F%?j1XK;;)^6!I_Uo>h67*fA;+5pOM%8EYY$!@PFoC<EVwFxQ~6kepWxg
z`RBRA>AZiYnQS=l-{@cXb?(~F`L4Y0k2}}vneX3U^f~m?&(F{8e(D}5o_yuy0e9hb
z>hWEAy{WHce>y0hRj(5M*}l>EwA}ekS6!2HT=$7vpHf-gz`wWn|GBidCmHh=t*tkE
z`*n4t!sUNcviSdNHS6`ZiMu5Vz19r9s1_f+=YfKl9Mk+JM&Irtjb$@6*II9As8auz
zz5HiEX;NZ!dUf?~p_8^Bl<yut{70|yb!hGES!^3iHTf6axYQ$*c+A6DPUWPS)4#d<
zO8?#W-KfTU$2V;I&Yhcg22W2A-f(-vtXI)*KjsU6SZUAWm?)Y4Nx%C=ciXk4PrTOg
z{1@^{NU>28GCAp(ykBtBM?LPlFZbSCq4%XRTR!2uOR|;IcjcKL+s@sToxdP|!>s=c
zrL;Sp<>NVc%u2OnO$zp3Qa!Nk;0Mzc!S+2G8}ID+@apnX3D&iC-Pg<JoP8S}eeT$~
zW7mG2^ZWiaY`wR6OnLF_Td&{kx_bN09SN(l^SW7<Q`g6frn@|~4wFsl6;S`7{xql7
zeMjqdm+ad&E4J?CeC0IvY`FCL?Xst1<%51z)g~vW7bow2o?{h#``on8bJ^tYi+QX(
zFUoX#=9<Uxl7jxvuS9orq~7NF?=nvzuPTK*USf4zz$BJ8>ptz@yz|CW@0&jv`|te9
z{OEgYn|toF=y}hW_pvX$SyQ|Cc-%sXPe<l#dd^UD?)lG|*Lwu(UmCA3&%bxi<2@61
z^0oB6zn6W<n_4reezNmEYip7B`+ZeET3^~1a6Hp8^8l~T2C3GIA<B-SvfLG(cTH}I
z?>0T^<D`AMOIu|9r5~%-ZH)N4<gRY3p1IxW$(7DQ&(8k$mgwcqSFN0J*+ew{r~A+E
z!UgU8a}V{fo+(j{PE#`E`m*5JRqbEV;oGk5jxF%}ICtyRg49EAW>4jjm*+XP)T&%7
zW1Z#Z)~N{#ikI4_Y`587YMFU&_s6q-Mt|8+M_nJUY4Y9A%D`}xpMgOJ*Qje&Vp*bI
zLFLr&+eNp{1Ztm$FF411bft^+J7?>hyECr@MlUaW)oJT#)z!v4(Ob}ra|1)h$+JK1
z?`C*ErG`^JhcQCu+`QN~dT|q1pWZ${{kaa)x`Z+@=Ic6%3e2CDEePb=oc#YprK_K7
zq5e&)t51Hs`1+CO{~wQa!3yFFSkw*gII4BYm<#iol+SVLn$waP^eV_nLTH+}Q<jsZ
z_^d3o9Yu4h{8qf19v?8*%z5gxS*dSV#E1sDEQl)Pjov$POUCi<tdFyuM0c)Z{85+p
zAvNbJ!;H_?YOLlS&u?>ZF)y9g>k_wtXGvCy|Le{w+w|yTQ_qJS`=NWn?Unheh?2bJ
z=R!6=J#=DGE9cH{>;LbZ)4sg^od18T>i_N!1pZ_d9C)vEP<UHjNvy)-p2L#<M?BUs
z?mgbO@5zljQ4ce<E*$K8eCL9-)Ugd(*A=H`iz@8du5+n-s=!SV_UAq?TQ3#uR8fDj
z`syF+vmz`h56@j=6qmX4^vb#T)0^g%O+VNC*hMn5YtLb3DIvA~VB_4AUzv`tI;{~u
zy@a=7U3S2(vS~-tVm?LdncZ2da@arLZjZax;m<#h|NI%6&3vft2+QZ4?(1B;yH-5u
z6)byNy7iOf-&M@BQk#!H{`hFh0}Zi@aWCcLwEhO%6mo9b-cq>iaKR!4?`168CM@K1
zygx;A=iwbk0(d*N8VMSm(Z0^+EMFdRt3T0%^~l?!VvD>^>2OCcz5eh1H?<3A<l2wy
zb@#7!T<tTJ_1ERk(QCR>ySK2KA28keoR8n?CI22j%Uf@y=bxTbyeA@;WsAsK$M$2n
zW*OP@j3yWB$ji<Adn<i)vo7Oh{`Gtkt!EFti|;$fpn0+7+mv+E#p~^F+P?FctWg^H
z%I;oP+hv(~jJ=+VC#$NTXp`pIb1PnTUHyx9j-tE&3j2zzI(UX7@8F{Rja7TBy$%OC
z-j6aCHI6)<&1J&&(<uFIaGt>Ru6CA3|7BV8^b36a^i5k>r|$4ie$pzv?DB+lQ%<a6
zox5#@^umJgOz+}WFW(<}a?_5~2Zf729!r>X`%&(}-%btFEj?Bx8XbAW%gmsBq^rI(
zJuor2$9LZ`G3%g3QzCAk`M~I%m*b~!fAaMw;(JX0WZr#dZ2ea1*!6&l!0f1Bt4_?A
zcSSVX@uBU?)IjcEF(>Z)$te3}-t^J)^tCBDw&y2pGG*JQHLZHf`=hPtr8Bgit`#~j
z*?ua(Q{1d8Y1(f7jek4yUO%|OQF*)jMV#lcJGWLJTlaOV=ls2IG?j~k*RQ!2y!gs{
zuQ@-Dyh>BKur~A@&+FHA3)UVqF;y?&GZ6H1X`J`&?a>`KcCeMJB)ysBcPB`F^Lzo_
zZQe=;y=+byrk%R)(YEo%m&iJvWwvwP{5Vv4ch#@&JTIo+n|JwC=rN@ff#?GrcQ|$4
zTe>>0+v4KWt!gNF<o52XR}A0O)!p0tWrOi{>t=zyeG3o$Se&i#_jH$Tu-dCdZ3nkF
z1Z_O!I{U{G#a-(U-VfNr5NDtJI7Kw#gyDquekU$Y2=ScRv{(0qN}=y_msxUCYPKfy
zJa$SwIkSRaWz*YYWfy_JQjf!b=Cv=<T^RcLO@5Hr(#e6XvJLB&wK*)d$<xc*np524
zYr0QUdG+jvtvU(v^S4eruCd0fFEeLF%kq^q)6V@ATNHFTl&#A}$YA-glv4k=14dIF
zc+MUx+PvRie@0vdgNplU{x#S7eO^sU^R;&~3n>gwHqx%NIoi~4adoV##RJ_<5pQmv
zRA+y3x-XM`x@3R}pS+CJZa1fsyZMX%bK85L*sI~`^}b;RlTytp*RaJ(vqc1U_|3ev
zKJd_f)yWC+f*TpSb(e2naeU984ZlLwrOrPr{Nbb!^8Wgitk@L~J{0s;E{mC2etBVS
z`3;@8zcwjeQy1`A=HxJ5YH*v<udtbIU5n}o`-+#nC->^bN3$K$THA8<^P1NwXKtr0
z_uR04R^aKjs^V|+Yv=MwZU6VjykzcUw`J93SG#7edd9^4F|u~?_S=hY?ko9+R`B2K
zG;1nhWnfSf!&C6*CuJpr&Z&$D%)f0WQ1^ZPgGuZsSLiIcd6*$r@0z7+v`HrSk;7(7
z8Xdfs&**jGRC;=Z<J0}}B`%#?WS2|tDrJ7eetXHgzViFB`;|*Q&e_lVV`rJlS-?1X
zyJo>jBeqhPxG<B*Lr*Mhq+};WMy|~++dAdRj~72bvh1%@_^dj?SU^=>bB%)jYNn~3
zEKxmfk+EVbeVg6POph2Qx`tkx6mZVlQ&oGXMDH%ko$Dm_D}_v`TrS?0x-_-t7Q1Z?
z`|E~3S_|x^XIdve5mx^3>5GZo{P}Zc|J<}9g0D0`<C<^DdG4~)J2)~!pI(?9&@8E^
zc<xGYxY0??U0FRV8#hXnI4|9?^6<Lq*PDZ7-h6x1W$yOMG@osE)`B%`EUHO7D>W)>
zoU{8@9Nn_-mE4r>^PR@M4CyIy=l=irp*3%BrD^r|Z+~BBxO}+W$Wt?QicNB@L;8$@
zV-I!DpW?L)n;w(CeR7Sd&&^4ekFR%Z`)PVfJ=>3a+MHLB(fb0fPTqX9jd^ow=hqBw
zJ*jES-Cl{C&PeWfptCQ~IK6jCx6Fo&1*@kCPdo8*SJTCemP(PPnuwZtl5=X+jUD4P
zA7?BP4?LOsLUe-WN0BRW)^nZOQqNgTE_}m%VsnE^=Ph$Vr}|SZdjvM^<KejD)VH|z
zrf5@3pDRl{<H=K2dQmJ&;$05wpVrLin7m6wNvV6&8RkO<nSvkJh*Vi`xphQCKguJc
z?xE$)k9vj&zN_BfnsV()<(=I*GXoBmWIbMS-I$}z`r}K*mw^Qg8O*mH9uZ>*{;Xag
zGv`)wZCRAZvbX0eKHSq|H*fhkp-SiAj@7%r3C`SeBe;^;Vugx;(Z!I6s>c_$8UHBY
z%~owLb8cDI!8><hO3(Qk{}WfFt<4TE^IFOB|6Hd;tMYWqTK$hr^Yo50JA7~6D>Y%y
zPP5x?e>Ml)nJc0&J@r+>1f#&GC9<<)A7v|S&|Bo2EthBIp%Q&CCGD-Equ~A0p4N#m
z<)uZz*RE&mcvseb)G6Y*7-MCXZfMQnB+r?z=2qR9bkLteWSx*+e2r7plqCy#ey^Ui
zG`T2U#`@R9JN1w5E!!{k_ePn%+w7hBdx~YaJFa_WIl2lbHX3N>uUT|+=4rEMtfCFO
z1xwCYt=spN_n_ihX-lJ{3ZbGde*3KNSI63ap7i6K#@)r<cg<$cdSvuFPy6>Wr*f-Y
zoxW<XqiIh!yt=Sw&b+kKB~w1yCkK^?&*y4qf4=b63-Md5Pp`@8{Wb5r!S?(8q>T@6
z*t)FR7_#JT&?~tpxvsNXeZKtG3)my)Eb!I)8tE=yV(^GN|C99DVx62nhktZE)0rD`
z^3v`%S4)=Owkp3jQG8<e=~~0e^MNVZ2lq-H-)(Zj_^r~NQ?sgmhyVE(SSy>ts(EyA
z)u#?qn;F-$J3aR}ZT=U($$Osdq@34_54x@jNa22&aKHY+39Elu$F}$Fef;t7x_>gt
z-rJ&bBRy;Ddfpsfvh33dyW5Y<^29=8SM_~;;1;ZtTX=E9`zu*|zAK$%xi-Ch$Ly}`
zs;##D`W(Lc{Vkg|8kQtlK3EhQ!;yUWcR=sUsaLG>kDLlx{q!^++m{>zuAL3;Z&w;O
z9ceV{*}a}I^?Er^Vl{)!bmPY9vYwSpc2bvIUb-w;Q{NujtGrD**OzgXUiN|D`?D83
zxN?~3*!{KZuHLJ^HEqfJ)OUgV_pfA~J$=XWV_&Y!cysK@l;gqKzm7*uHZ$~zxmSPr
zagqPg_`fr9nzUY+O0b3X?`rtsy7qhWZ=u$W3p{>Q=)|({@7%d{Pui>hez*S|^7~m)
zbt`V^{M8HIoOxlkl<7L-j0-vU_t(D9ig(L1-OyV;<zQLA@%puVe0=u;<~?(GBII#u
z6Hk`If7Zx`J&X_D3e8h^yV`e(s`j2k&n$D(owgYK5=L#NACR26s*;s~p;r{o4dS5E
zx}X4DUPtHOHWLAr*SFYjcIYg5d6=P8@0z8fv`Hp2sJv!$^e#E$ro=k2D2e6od+Q}0
z;PSeR^%eW+CFlNrlD%~P;?tua*FQF%7O3~~hspAojjW4HyY7XkL|^(CSY%Prw`@_=
z^*3oNFI;@sz1Xm(wm;3g>)c8anWrVL+<{XM^oXcFP1vx)wbLNZWYtQ|V;xhct`Jq4
z!|f^}9K**}=D$|^SiZo-jI^JVTteE8ZLBpp{k=qX@qE>_`l0vUS^QeFO6KM4&BisB
z*858GT_QI&U7NdN<=qYMz01z;@bL&0-6FhD{Bk#Ufb#jTzbAZaGw=JPn?GmI4V|cE
z5{$fTSC>Bc(RW4W&*3HeHtHYwQ!JL#{%LcQgT<VkRTp1pOkX?ASFh}LrGag;>+_cl
zx)*e2{w*tPTK?W|*?WKcJ-+N5c4jxGtT#F+z9zVeuQPqlyict+79?+dpmuuNrzQ74
zX>uRSSA6#F<%<66bEfE68}GKOUAcNi!e?IQW!{XXFNM!Zhdt?grM`EDBSYqbn#E=3
zq+Oq}wmw?8EvqkbS=#F^J~rl#ty5k+{$qUP%F%2I7yWlyX;b)mq~<oY-3c&poamPt
z>iV{Oj^2VNlIdKJ7cM!f<QBQCTBG&De8ZLNmaJNz?D9U7adq!qQ5LQqZ$X{pEdr)`
zw>6d|S|lyj{$bF$Im%<^qMZV+JrXK<t`nyp%U}<mEtBgiEfy5x>e#j@yWnH<gWVx|
zvlbngdvYGf+n!YErLyz86E_*##d_@0U}4OVy_I+*j6v<4yNrazNAcfJwkXcr(jS<=
zH(p>N_hP%R35A`q_Z$QtMeo{{cdm1ZKt$FgYp2K8Z5MqtY|<+&$za;58Y;K6aib}#
z$y3|+22GC+&(d=<3lm;z@UiK7b>hy{V8`D6NpqiBG23kSD)KJ89UQTLlOAK~t>~m0
zru$6!4JwtlW}j<6&U4p@;Yrl*x+zsNQdC2|Czgvb%RQKLa+N~%n^~nhau;6azw2*&
zG_1tN*5X4{q>#sFDd*a>?blvf2i|Xbam#Ead&h-5IWaf4+3y<TV%3V6CC^94{9=qr
zQ;OX8??|+ORlNV#&!WsFx}1*>PfhsAVQXQ{AHPt4{*SULCHpq!YqPN)y)aWMLeg1|
zXQ^V&L2XTM4f));(@SKXx)<lp%&wPnzjV(#VbX)8r|0S~U+?0vVA;m0yJB0HMYuJd
zS+cTd(Tfj?8j8U!2RjdJVfpd6k8$z7yZdvtHi_NgWt6xtU3@_P#la=~FLloRJ%2&|
zOzU=|1Meai30I~1Tu6I+@PB<#Ma#o~o0X6Fw%LBjf4s8Y*MjR?&*Xh8_6XhFa*=KK
z@>bqUBB$msofQ<=v#;ye{t1g39<|E%toJzhsc@?9;@5p=xAdI<EFkNqxog+G=b>Mi
zJhq9vdunm(Xd_=w=a;yvD!0~ud^-8hv6EfTSk_736u$JJC~&>#l8<ah`2J6bDfy7H
zYj;1V9>a9E^jY6OwfD<BbFZKIVJ-K;j4!F;Vy_Kv7Hv&kdgiA2SN=n6?}Gow@U6Xb
zW_8pH#qSxLGb_G-Sn=L=t!{%>?27Bs9{WB!T*{vN#eV;@IZW#8uOkHFCUC7fV7=q=
z)d>l%dtNqeT{10uMUKK5!-IvFoi3?AeOb96A(6%TziG&6S+=HxkboVb2AtFNTr1d~
zD^8W(!DDmb(*EYm^NPEqpUcSx)jnKeBkz{1Fvlg}(1$y-{Ga7z9G|@NXKq}`p4$m~
zDnsu`1>IkEWxHnUA+4Wg%l~b&Om+Dpef__x!~ZOvdZ{(hBBt-RM*s7?$FPFU|8Z0C
zx$Xb%yM%JDep_E_y`l8A|A7i|7VC)GZ*Oi|ANt&+v~`I_dN=D@%^ivt=d7~!s$8ux
zX~o}i{)~%Uc}cF0x8|~_@YJC-u@!apMJy3wV34%N)5I<+EiTb3s61=^w&=D;(f_X^
zn}f6%&a>#8+#W6-W+>V|tvpmaS}*$d#3T_3mNpd~hUUWzlPa}rFYI-jr*qfV_`rka
zX?tETIi%IeVsQEL-OKlFEt2H#?frFjw};X^?{{;L+pM2ddg!!db!5xMY1PaBeLN@_
z-H{ZoHaqvIU%$WK-ph|K2bXPq`i6J9Qo7;(rz<s#W}MNIOPkC2|1bZH;$KY9YtEnh
z+_n6}1|1j4u+9_weAkwqh!9xwdX-+Kzy_7(bW!flF(D={axyQfUt9HSDF$Wcou~?(
zqVy=pZ{~zL!LaDhD;~{Xz1v9VOzFwl>bsRrn(It?<F)?X@3hds6{26?@|^UZJhifB
z+I_X9CnjFld|q(*!Qi7TuYb+esE|8RaJD%l$IQm;fk_GT+ev!$kF5XN2t`g@vL}a4
z=S%O(pIdKydhx8c<L4CD%%a21GuFTI6__TSa%ooV&+z{r-|0mBso3`8<)63wo0-|>
ze>{5sO6U$R%QfecTTiT3S+%Z=b-Vh<KW0Kdt!|oJcF>qKXa4i-i_+;5#)q_z^+o9Y
z6FYa~wY~iO8=o(!>}PB`yM5;Gtm*BMLa`TOt840=O{}`tGH`BVKPK~yVTq+z1^3lE
zw{I$kmrgpCc4GhIqoN-shqJS@r|Pa|_&H6rUOiC7?|j4A6RVf5Nl0J!r`zSy``6iK
z>EBsyX<jloIae||&i`s}^6#W(@xJW^%g!)<i0k@gY+rWf^W=-q)z5yueDV46v!BHm
zpN}^=|MW$1=XrTPzNCF=4)qOJuCvxK-mLUlvipy*f8(8*zTa9Z|8rgU>Nr%w=@cQZ
z86V}mD`!_&QDsHN59gxO#bJ$#j5p6Gh;9>8<(AZwHH^>+3gUXyH|e~?5n%y?8yEkC
z-T5%%uA1UOrvk3{8MEb$SXi5vCQK4noFV16dWPZY)8*mMr{~+pJkBU9t*qSm<Kxqx
zx1E`}mxXxQ6^I4IEtc>O<7}OE{>IN)^QOw23G18Dl6h9p)FArJ+7myoFbEs0OG(*2
zqx;Lp^NDOcPNI5UbH%40Xq|MBxka`+<Ip05bZx&AYs+|AG?}_nA3WT&KyD6aE0a^(
z#jCQ{_pEux@>nxmW47ZCRl5yy78FdlvgFayo98+2u03`4j84;?%VJmKTPHnk%HuP;
z`gAhq@4Ry|N4=KMZInOCw`l*)`XifE{5MI>j4V3mz}6rYpqzc&?OVgsh9}+6xSoit
zGi75JD@eZX&}0#<zI4s3_VVZrGc68G7k#s0kN2vzuPe?i=`J}p@9a&_=hyCCZJ2JU
zWY=Z*iAPQA-IMqPU+=|niTAh8Te3aV^0edB57Q+NpM1T6f2zj0MEjE-XMb(JIw?@f
z>*PJ=)4kD!XZar-Z&dQvjMLe1X0BKE%!~d~TuI86yXGyDo0VwE{*(Xa(Vw^HpS#EY
z{@(n(cK>@HEKS_E@-VNLbZ577`Q#fh?tM|_KfXTwz5T)ZrtZ!0=k)As4jy>qelz6w
z=S3Sn9B2#?dK)=o*`sq2R#Ih2Gvjs@-rB$L?bG!Z|Mhf=Mb7haZ0LWwj>&)X&qF8J
z4<A{*c0z_}z?DRIr5hVVC8s^;T$U3W{-$rU6x$K&9ro!7G8Syg<%{-kdIvT?Wil4N
z*QK(}thF-k=u#s`i=RK&+sDPt*;}*!$Hza@jpO<6goP@mpP!%aaPGC}G2!!t>)L-i
z?4PF|bS=it-ty<^{c~h4uQ8Xei`=uHD{kNa#vlLGbPTMjdcInAgv{@bT=Q<iv<1D>
zR4gC(9kN=xEJ0%G5(ZY!f1U0Uk2ROwGDtf5P{eYL#gvn`SFCw-t}W$ig2W%!g5B0x
z9KO8W)wA2|^f?arggQRZVw5i~4Q6Xn2s|!f$g!q!!b*XZYrU?^WbZEbS884%BE)l_
zOUEoj;7EY+vk1Yd#zxt(%QG*m$=VrtgxzfE<E&f#Tq~@E=lF#@opExS;gnLwu*65^
za}M0SQj_8FK49$%iOBu_U+(;wQKm8Lws<_l;uAAhufJyV$nU3e;i)&T9|=A<qRi-@
z@A;*pvCO6}_J~0Ij_<w}@4GmU8frXOs9mifw36ZMx&W?lM?c5i#eXj_u^xY@kjr;&
zfvCvRI-&BpCknnA^xZ8>WvJJ7jGp7k|5%3SqAvdwM=l4>6!#5{%%@+!<GEqLq2;vY
zs@y+?J8#}f@tilj?_F-<{9n#5>k4mfV~(Ixk>_WPIWD}CKQ>-Z)T-omXj53SyFtl$
z?dA;UW(&=&RZ)>A&zy75;G9zH{lzub&1S)lta~nY^IazGX4A--7j;R0>E%u0-?pw;
zeLQVZ&O*lTjtkbD3=~^janL1c(KNFScaEOh`iPGwMj~zMx>ogF3hbRdE<A1}@2*_E
z^?S9kW4h9{2WxgODsE9+9Tv@Y=A5G7^@p$AO`gjymta^_dTpOvOjS&}<dOMHZ%j#i
z#(z-L-XQml?Xx8c42n))6sG-sp=S5}CRc4Do6!_M0f}4x^bB~edUhO`@k7eIXVH||
zk~3Hro!hUi*iz~{k6%(=O#e=x^dpONR_u=w{ne&PZ?@<Etrj(_MV`;d;z-Aig-z<J
zr%v?xiug*tQ2+hnX_HdGk?1;^GiqP^|GICzU$f;(!;X*%7j~&lJsc?)v9>bZ@_E%K
zUx|t@ca6jstpE7+1;<y3$UV<@R?W!|va?&TBAmxeQ{l}1qS<}ZSToW@at`J>Pq5m@
zz_2_pZ-LEwd-p|8HcQ@}efHi%ajQflzWZ+@<?L4qu<n+3f8rf<CA=#8_kqv1%Tlst
zD`)@anxKA0;H7=kY{#W1uWnFG+}Hj5*uN4PU%{WJ<~7}Xup;&NUK>>(g?%!sOLk_n
zUv4)O-*J7Ns`K$C&$-r>2kwaGb{Q(&s_?k~vT{kni%B}onT89R_kJ|hn)FIqFy@BQ
zuYYD!7;ju*csko@w&B^>mKjG(SlN0a!#({zS}k1`lyGDpZ@wk#GXcl+DZ+0R7^ND5
z*Sx)xm%FETR_nC>gY9|^4G-*-y}iYvBITmyiGBLf!<4#Y?ZjUydTTotXk5K|N9x0?
zH`BM<$H!>=)H*%UeVRcNBd73%D}4nY?G<9uefP3&`Z>utKs5R1V@{*?f2`l-wrL;#
zsgaW#W3QC4_+gW3aY?$0k42LGhgD~vYjgx^@=C=&UGChvF^aFv?$MjV{f3=Km8OQj
z<@&PR&sb95W<7(GW>v_NidP%kmsrFmU(7qd-9U7IwQ+UZqI6-YS2>F(w1#eBb@6`Z
zEjR7rHQ9w_$725bPp&T#i42zc^Xz%|>d)Pux2MZqDYR^|*dW;Kki5_S!hua&-FURS
z-m=J?zxBZFxY>ix&N?h=hEHDz9(nnX!$<a<(h-p*nHuv#9wpjnueuw|b7uOthou}m
z>Ws1K8}3b5EKyuy?mbheI=fH8!6#dQsnd0v^}J<o)WpkoF6F#xw&awX&a6ony4)2%
zG3G91<(_Kl^ZwA>kkYV?Y2DAe)6dVyWD~Fxtm+fh_}q7L?TX7YwoMUP7~OYz*_s_U
zD|Y!NUJozUxor^nK_l{g#)^F3+S-4&XK%iFIa}?1eSJ~Y9jWBA6D)U^?=ev_^;LYp
zz2w(Qm#0Tp?&5lUdxOW7tHrSbjMvVFWFD@3QFTnPk%4=@KrZJyanB|D8>eh4@K@WX
z6SU=Uh^)Gv>du4jcbPW7NSU?ngx-yUt7k7P6ENGmXj}WX)&gHmmt^*}DTNbeEd2W@
zvPmrK?ExvdRoDN-9j+*-ipYq+8Y}y*g!lbqahHt?kD7F(?XA!L)mj&I&9UXLk2$yf
z=_l`N{Fe6fMHQ)gE3Pu*Y+ahZ?W0+nG<){rw{9$@ek)(P%>HyND!b!cc+^wJpW@43
z#FqUtW<TM<5_isD?eydO?rU%5PSM-&>;8l^*6YCq|Ko%Bq?VUv$M1dk{etXT^ZFT4
zM-FZMbHDzjZ<Mo6$n=^zjuqLrYgg1Rc=7XqXZ%Co`iN|)mUAWkqKfjNTk57)W<L8K
zy6e7*X;<$3<z|mBi`4A-yi2BO^M?g)c>zg3kGe57y^}1~dH=%a>jkq<hr{Blckbs|
z+3?t2YyQezN{%0D|5s%#{vfeJrM=fDID13dsf>-EnAcBR9eecY)}z`gMO^D_8yH;f
ztcr*iEnr{6pcWCboy9+Q(!Peb|N6IH+2S3tJfH2)!h7sr&u>s$^vixyrnKkEP?1in
z^(W4+j9SC$(0onZX%?@ehS<WpR%)h`PxJnAUd2_uc-g%W`C>zl0~=--RbDz#8eO=v
zy`F#b?_((?YhOP(DEXpFe#O>_Ydw;E!oqD1h?yOkAt1v#BZ=jqS67H_L+$0Jdpuli
zwcYFQ-dxx8COn+W^U?WW(di##f|Ac9-_g^X>?kl#Cw=*Kk;-au<wEnOze`p<&pqK3
zCbn>Ur@+6c$6hn`y?8gjc<=HIH6xGLl{{t4)~7$*|JxGw=je-!*2T8%7h;+BeV;G)
zOxa?#|MV}a1?;O|Gbfy%6;!Bqil=_Z+*=!$t~q&Wp4IMoJls`h_c`9GDZVg$tDe`b
z%piM-cX_UNPDs1F-X*gBjN6n`nU}qktkb{mpC`0Tca}i!^v~5_@3LgLYkfXoXLNLJ
zNHXW|2$M>dZF7Vp6F!_?DJYfHdDU5b=|SCFI&7{QVZ8c_6i%84ujx50HOcZs@S1yN
z)~6>*1<11=RX1|7>G`|xGxOprZo<FMhi%nq^1QU^hMCOif_oq4cDghy&@t#Zbm0Np
zZ(9MT8+$nzcD4N0C|u_FW%HA#Oi$c3e0F_}ZJN_+zHGjWD~q^-&n`9Rr=M;73MRaB
z{Jv}IF7XSx0fG7<=cX?Ud@x6De$D#*|5xqv_y6*J{>GrY;)+W$^7$6;OsuZ1;JUZZ
z_T|$z;z8cO3{q7eW;bq+o$%}n|2#D>h0S-qPA<?94p5#w>t|i{1s>sKpK{MBNvD1s
zbUOHD|5Z;;^9^|d?V%irGg*0r?%!4kJE}j$|88K!a>XC>8vA-(k~Z`!h?_<G<fYHe
zzdUiGsDy9nT7lojzoX9nzG+#qzoA*y?e-?`<x8i05t3tbmTnDOb1>ke(D~XxfeG$+
zT04V{9OvFLShIb3_Lb5P^TeL)WKNSv<DIkFDj;*S=;SuR!o#;6y3P7hHg9bC-cfmF
z((+xRL8a#}#9d9u-K{EeVM_$hdCxaDtB<g?KJ8D=c$MO-eCmqmyU_VkyL~g?Tzubt
zvDj~#%#0X5#;D`I)7GYF$i)85U1<3-c!l*#S+0-wE@x!5X$6Idb{*o>5e;Mr3{R4G
z&DOcB)bg{I`Ncu6Um>#Vs-+~Fj(m=p%96>q_^NNq=^Tf>SI+K`KeTb__tRWIT9@q;
z+vTD)-<f?)`4ds)4W1c$_OKc=>LzGJ?eDoLI`_w|wrz8n9>x?_Uz15IZO(s{5v7;c
zvf^aNvNGw}b1i-!e3$+%^tyH2v_&;s*ZU+aJf7`MdS-E5q@UNRry(xT$m(b6yp{hh
zJy-Hw#KLcNA<}r$YcY$cN)@51tG3414vW9LZS;3a$j^@0*nPX^Y%Ep}KFiPd<4wce
z2L<moNOAvWzRCP^$;x#r%jV2=OAGO@cK<Z(Z;JFpy-6=JW%Mewluq5*<8#Dj?qMGh
zm&wepx->orXLOYJ|JtGS&_6mtQ1)sn=R4jC=1<+CwE}i2eyV1(r%e9o`m*c;PiEXy
zCEuy<_uekD*_B<L*1CN`^3ImO$t$$3U+oMK>O8p6lGRMdzsB*fGS~iRZw$oSGtQgn
zWbtk~EIYkjxoP`_)SIDuKZ;mMh&O2oZed>)uzK+Wh1b~=GWx3)7R~G4HzO#LO*?ni
zv}H-wJZf^^b(5cOW2-dh$>3Y?k|X*4lXG{Jzsz1CI>SPvxap&Gsix0k-GjXBkzLlt
zXD?Ug*XsPRy*45D`M0)9?;>Bk-n3|2L++K;_dN}Ki$6y(eamB7vZ$p%=YqfWG_m&=
zBUf*nxav>xrjBoK=2?c-)ZG2~SM+F8sx@!I1Y4dhX6!qrSp8nEwQTX4rp^PxM}qh6
zP38|g`KB)Kd&s$6SMwsTn?9&);3@EKQd@O>l1;(9YSpN#&!>EP^gr>Ich9whi%Q;3
zc9+OGm$qxE-RzI&J)g??-(a4)Epu|h>r)esB&}QJlwt7v@AdjWN1x6ve=eRr+3=DN
z%a6A&H>*atw`HG*yL4cOsny;K7mxn8p7!A5=acWVI9^=W`*yASxBiYj;g8o>R8P5=
z6qL;@<(q$Y+2ZR#TX?OmJv;Mp#*FfKnG5Fb0fo}lp0CZ9m$AS4FJk&$X8X)-dq3aP
zjAQ+s>0Wuee;rrkBNM~*nmRA8&Nz3P>sxDO;=>Og0(wK%me+7H#BW^~Rw60(s<ho>
zdiFYlv%gvlH~4K(wP3e-GGop4Jxk25CozYf4anCjiN9?4UN_=>@E7w0{$=~kT-9wo
z_xep~Uf%U0XaD&d>=*Z4cmBEWp>mjDl*>uq6_48#EzM>;EvkQPd{tcanqR@Bne%gs
z0zch&e{tE-!2PigYHmLZv={qz|CL?+?{A;J9{kUMIwi40fk~^9lY!xvGy{Vyu9ZW@
z<(X-q;jOumxy8442>x3a->9~iacW1&qixgsmc8@Iwhs57b42)c+NHn{ITt6PB(4Vx
z3sS#6-Cr)QpgCbu?WdQ`x=lC2-`MTu-m9|RTs;19_Qb->ikhj#nMa)pY}M+uBey;J
znE5H~!=yQ@i&h^kN<H~<_V(q5e=6P8wEgUg7OR~6X{#TylPxL9GMb-_d+jw9U-7AH
zP5gtEt}VSZ%|LT%YM4eQTXU7~=V!B5K3f_lX`bdX#nUS-{H*qF-PRbPv=d9x=Be;r
zE?qdyA)sp8*VCq2VI7s5Uk2UdUaPXI;^&0I?Uhfi^3Qv})9i!l*(<wJ7R*R*^Iy~u
z&b#?@Rieu#r#l}_o`24oX|$JRHCvLS+Q}#L&8NToX|H$QKBo3prj5dfmzlQfT_(2c
zXED$EF0Xz18SDQ8+im{8iHq$x<F`$fzq2T=h_ihf=e?jflkD3C>eIi^oW#8`hxNcm
zu9NGZIDP$Q+Gq7(cR{-16IqL;Kks+l_u3|Qb89s3_wW5n!XDHtRrtlmyjhTY_9F3X
zkM8Ta&2c~ez;{bcmd=mrNip1y_nl9B((~u|$K|O9Tb3jn&F%ejX!eIhNxMBq*`?~2
zojsIU|B(MLtFX?We1j8QX*@e!b7xz0%+f#n@xaBH_}X6uKUMesEc*HHmG%qHC-Hk{
zzc`btF(W1{=j21#(zf93Iz=%WUB6Ag_7v@FFcAv6VbaT^FQ$A*zJk$CqJ3Y6a=Fi(
z*<xPHv)|t<yng=PvUBb;OfH{lSpM8gR9Q(u=~xTfN5{tGP?1dSlu17(q_hh2d({Vh
z63EXlX>TZFYB4)<xX?Ryl~9e9Pt@UuU!*oidt19zE#*J){&vN+nwL=}Vs<tMkIgQA
z_Mf+$>+nGpQ_~s2_1W>vN;_m%Br|b6@yT!LVe0;v{IzV4`pt_o|LD0Iuw1k5@L`y<
zd3Q+Ywlz5>OZjK6Q;`wrP2L<dTcRULCF{_S?KN7O7sSGrOv*oyk#|mQmsQC*_d13t
zA$$&XZrZy${`0(&nq9p1Jk#zxb@BQ2^LT_gbOPND_vyS_VD;sYr8d{R`#+X@ubp~K
z>EL(U&QPU?I~1!v&U4)K?1<K;C(~+J=UVLC`@`WveDbHJJ!&=|`()pJyyzowPg_Rt
zs|{DY8>finA)^}3plx^5o_MRC)L(W=wDQ1QzCWHZ@BgbVWItQOA5|ChZSSg-cRtmZ
zwB#B6zA<SE6{+^Je!s%jw6#?6^8?p{t@=L;xzC5PYAJu86Fu*0p7#mggOWMoTXhoU
z#jhwyRoLpfKKpQY;jIZr>Ulrrq_22(!O`Qudppzry;mlEzO#gF_XM4<oqLj-7<Rb#
zD&C*EuTZYOkICeofv(~w-!ndMPVm0HdF9%t++9zKj>}ffJ{48*WLsN#MO;Jm-OGlX
zen#D}$Pt|<5Gx<6A$PB@dEKMJP7h`U*5ATUZY6H*-aP$D*jmeXMk#Nryp%0>Hw!5B
zteJ7nFs^8NkA%06P$+|kz=2=qx6fFvyeYCX$JI!Ud70#D1-`vL*X;z}KWm98_U7He
ze5<8LxF@J3ME$^oUI)Vqr_!cgyYa<A*UKr^uqEGaQcPky>&3l74o9{nZ`!oY<niRm
zss$^a-B6vkBdBld-Fjw*bMF?MI-afeaK4@9!ZUOJ{CIaaQ-Q%qW>#8r0Hc-hPFBtf
zuRbxY*{HqY-fiBie4Fwow}i58{@8IUh`s5x|7=r(dqurhy*@8H*lXe&S8M&V<I_IB
z|6kvxe0wEbrS+?9(w<-M-?uY{Eig-J(fN2|$C_&~#;291T%62Tbx7-g<>hM&wku1;
zUwp`@lWcZaDtz^{9qCVY@CP2ay!USUrIv>w3CWF<7|!kv{jznr@3g4U)GuW>{3Y%m
zH-E{P*tK(7()NYV?lb<JwPa5Hd-cTSnzy`<R4wuJiR3sfpA%9n;dlRxgXXL)tFCFj
zd@?I*qX7TK0{z6p+jTh_AK30RSst4df9ntr|AnU#HV4}-O#V`ka#S)U>y`AMfQEX;
z+WQ|DJe_&u!4jQsPfVU%p4{_6ic6<J#WpCcUv!I#X36Yz7B>8kWzR8XK1<(jcWPZ|
zT<Jv7uz62~&nvn~-3of|{qkD>V$<(;en)Z76b-!>c>BBOIuXVfGjtoS-}2`_exgXT
zQ>UtFRuQA~qi>bB(rf3wj;uQV;A3XhasG~;?2UiF2!2|*ncu#=rhB%5FQd@4-fL3Z
zmVMA$Bw)uFpmbStjk46$JCo+~UN<m2H}$&8tA-hm_oS8Y5u5i&(EUK-jojTU-><#p
zxJk}R=+<quh4a2%ixc{yCboC0e*L<LRFyWz*r*ksRK7i3Et#qD_Ck8zB$M>Zvn&_Z
zm())R{_|b^&u8VitajN90yTv%=ENM6bx^*ps$PG5zwmaJ;01f++rJAgt`c*Ismsx+
z-4*}x%teb;=gX>^<IYC1GrsEkHBVIZd;8lhSzGu-Z@DrW7d#Q0bad-UqsM{*eKFVG
zFL^kFgQ>neOg?J+j-B^jZQbqlLZ)y2!nEph@4^h(Cwkp?OrQA7skz82pMP1&{wb~I
zdXEFH-;0eD;X5e6Sbwm<;!ekdg>PPV>uw4+$P-<%*v@akhEqivPoyp}-C~)X#Iigm
zFXUmoL-6%mA^Be4^?l}9AKDe+a{Vt?*zRK*^$ZDb%-mvQzeTGU%FcKCaaEVw=%#MW
z<-c~zPv>(f8CKX{e7)`Jgoc10s##+Dv@`glqa9Aad|6?3$N#F{@45eZCm%XAp`o0A
z>-3LTqK@x~$(U5^lQCh{6-(apb~|2PjI3sEvn>$1)4KEfs!NjP0v$gjr7m{JDo$p|
zug(8#a?~%O;mU=HnbY*R$^?Y@-W<x|S<|W)^?6R@vkgq&66XiKDbjg)Cw%8rwmt2#
zJO#Y9#p>60i@)G_&m0_J$-FtCuVT{a^|LSJw)AZ}JXMrcI9WtS(W370g-z9*CP$>D
zpH{u>o0q3~Gb3Y~vRCHH)-4yipLr#kKYM8NY@%|dq0E7EbEQ(R?KR&0QETD3ueD0|
zzP9|cxN_{_QmJiw9CLQAnBD8K?d17cJGhRjNvq{tu?&y+a`I_jGQ-pRUk+T1-7WKL
zuF|4~7Y#W7Clq`;`f~lw3`XYZ6E?D?b;$pjxnP>+y@e-JO>E2##7!zz)7)_M&#}E0
z66ae}r0U}jyjER&qV4dMy7zih7OZ1D@Nk_j&k6Po`;^Uh>~2xC;ksj4v&>%a_F+c<
zjB^DQ^YTybo4vqbr>11c^c{Z#|9@Gw`q}q6QjZI^9NVfq`_8}hPM6#MIn2KGbK_!3
z-NRqgeT@45v>4reZZ7>t9<|NJm7yY5z{$W+q>N`qvMezNwAy=XWOV**3$eQM>mMla
zPujN4Y%fEz;e*JOJ1J@zw^)4344BOYGCH^2Jh8~Z%X5$8|KIbRJ11$J+`jB_yNmdz
zI~98OEv?kdufP8<758a^Y8S7*(zKMCb2DWoUY^qCZC3MmzKrbTPLJ!8^ruNy7JvG6
zR^Z<spS<ZkH7Q;yDoOl0VlTPOCih&tdhudRmndgb<-DhpSQ#I#4mr_tK}AsV><*7B
z7XyF#XxJ~kdFf8t>nZBoPNF+?PyX0<b6?ldMW1<8JAR(AG5`MTZ{()~OFaU%ZC*ZM
z>4_Q#xfvk^f-Ol?gHEzNnRGtyx~6eROWbmviQ2Wl8`qxxzN7cJ!(p8nBK&IJV)yDr
z1O;^Fdt4~?%lmtK|N8SyC*{*8^NY`~lb03zF?G#~m?JT%x?Z0`^g@ayz2%%Hp80u5
z=MTs6!@^|~&$wpKy}122%h{>9-cwoBy&3Oah>_ShMfHKCV*1oW@6T>7Eq<!=yf9_j
zpEmRD3*=7s^&Og_<@#@lp()p{XNRO^Go=iD#VlhDjMUCC>y&&6mYezeg61{X9KLl&
zh3Bz0u8y#g7x;GMLYuO|7u7%WSNYrvZMRV>uvREmYz|%c=)|?s1t+8I*EI!jEp<y#
zbFop7S!1K*clcSK`KoOzZCGn<_D{;H3O^arndli1AQMt^?Af8!olR+VJH>qh;%=@_
z57~I&$Ez7O;dQU9j6b}M@R*q1_x<cW)}j`jj>;nb>T{WEX8g5_2nv0}=U`kr?Qz+W
z9ljsgj{GdGd9?rU&HA?$Ulmn*T(truJ}gXQcRQ3TC;4yH+o<ROBM%WzMIKAF{TnAd
zD+oO%SrI#l)97RNtp_1dA4UJqKc~+4W2V;LgH>|Ld6)DS+%%I}a=5lC{c`^eop=+@
z!-_A{Tf^Thd(P8dwYS(^fpf;)mW7jY(+UDI=S60{Q0I)@SbOyT?V_i*86MTgZvMk=
z;o)n0VIF_x#w$Gf?sMntoN0S$Lz46#!8hTouVaE)n9DPMO&6bU=Ww(0);#-7N&Bw!
z&zh4xV^a9zB;{2ukKK2LweH-rcZUBuySVt6c{lf1mF#X03~m?M)cWu1^Ubf%hfm%-
zd$z1j(8(Z8r)44f)0h3arupsN?aQH2QxsVDq?lJf%(M9{J|Sb?-#V5#507LDRxY`8
zDp=pcx8KK0k$-Z!#d68sb`4eqovYK%P3d0N@=H=-Q>-M%oD%1!FM5qd+}2B3KM6hi
zByaXL3DwGDOd56*1dTOp4l19Y#yD3~P+Wi0(uupHL`o7Jx8KPBpXnp)67y~Y;}bCk
zZT|pO1!bXWPqfuCkHtiboj2o{*81{=xJL#<QQKkG=?602^jJCF3R!l5V{*dA?^6$6
zs8f2vr62S8!RiN{(U}aJeCs9eR>t-7toQE`;5T{N?$x-PU+D4IlWLatq%13hj#VDv
z6MOo0;i5fvRZdwea~UiWbUA-;(;n-PY2{JV$`o$!yjl<-^5K~k$3~?o>;7vzseQV(
z!72L<|BtN~IW2BYw&!#>EV^BQn^z;Iq4e(UyBU1Do=gzjIjc4`(QV#I^W}Ph{xg>x
zv{@FNU6L#swyZ7Uf{$n0v8z+Lt{Kj}u;ZN5KGxY^g)eJX%w-9ASoXRn>df~wd%AL$
zZi;5z{p`(B_GMch#dh2+PjM-6z8muGqs){h#l?lr$C%Q3%^QXIqu*?q+#9sN!167Z
zeeX%n>$k(R7}KrGH_SBF2$+<vYq}`Z;g1kk&+ES``zHo$|C1)kXtI$ZJj}0s)e;$p
z)cEc1m=3#z8$S1BSvJ>G>-w?@pCVZ&Z=D#mF3*Q0ap5;jHiz{ZRZl}0uIR28D4ILJ
zmM`z0#owB5am8*EOrHBYMuvCaV<@|G>W;&$MY@YWZaH{s-Mp<eQfrEi3cr{=X~NF0
zvm4jh*V?W8?zrP>dFcb$*UPL`Seq0#3Vi3d>A5W>!*AAc$%8%qC2T=W2?h<^L6Ulf
z6IotZ<_CDY9GoI@=ur05O#<m|6YpQ)@ZXzQ>iue-O)=l{sz{kvZ8pvOWqTVUgW8_+
zpVax`{QE`j3BFT~Rr?FH*1t}V&)s<M9pC$Z8;;rE7d-zoFv8IGU2o=}sauz6|1_M^
z$@9T?p38s6?Qy~{z8i3D<<Go7Gdbt8Pj(vPB9G*Sym<?@_jQKyE<Uv`z(Q7jy2adE
zIb{W{J+U!QN=uCtgyOHaw-~#`e}DMy&d!T@=afFhobHI^PX4fS3iEsUm0tTSmh#T=
zd)yMb#V_Dykdc(A=Z!PVtu$XM9ElIQ^7RS(BvWINIg=umW;qzyZexDbt2poS{HRd7
z<~4mEt+JNwGP1g8!p<3bV4=I`<tZnZdD!mR?)cNHDqzijHHE7pt&$PK*BWgN_k2}1
z>3gY@b~)4f!n-wF%Wq3}K08rzC75weRo$yM3RmrQ7%%6YV@Y_oY*N@#PH)z`w;cAG
zF7+w@+S}b!ad**D@uI6ulVqK~?Kvi=`8{`ASdX^&LHWAAj$|DH(O(Q|mcLxGYl4$(
zvn8HxdpKX`L$R~x`q_uqFmGkCRa+hy!Z?RX?$HzBO{a2l-)1l0D9*Rm>sgnLQEYp#
z#<CwTSvD74HAq-@?Qn67XeY}g39j&I|DCq=h!k+Se6g0%kTBeIp@>_<Tx8MTR#jG^
zlB%NXzlG9ozbtW`AEOZ*5gPOSexJF*)w|R6`=0NuvVC<wPN|pWb(Esovz+bAWkR^7
zitf^RQpIxdPN(s?+p5>|X0CoDA|CUg-M}fFiAP63?CT7!`n%f_#osSkeIrfDm#Mz>
zVTHtdWjncVT*sA<Jb0G4=hL=~%lZw8`!36t{VZEA?=0}rUnq=4a>+)+9<Q<&%x@De
zwmJOiI>@*o^tUbBmbB!j(~qlqe@X6<=e<;N=8OEs+_qgsX1BgIw;yW#_x`-TfBk+<
zyJZh&I-dOPzVYq1mqp)~aB1qt>pd$kId=SP(WX<OZbz6WPip=UaFI)Y-RXvRDF*s(
zR#(?@lt@LUZ;21SW5?xQ_<EwowB+M8Heb&lObh?ywtbJZz@`1SzTOp)<Ce5omSW9j
zzIA(Un~7LQ=HuCa70<HmYj2$C>$1a1k?HP_5Z_Jz9)v$SeA|XqvHShnAKM#+chA?|
zxO-bduVLo)`$p^k95^(s^t|Z?6B+Y-Hio~#p9}M1wtTseelm|uc=P&Q+)~1)O>254
zRe7xaE&6i0{BMKga_*HWT(gU$cWZ1<3Gliz^XCh(!uvPBiPip|?Q@2e`8N-Dc8SHi
zUx#9{S2C{+*d|!Fcb9qJtKTC36}h6z?}<I%V!F-ruRUr@je&uIfeAz~Ffgd&8ePlH
ztjNqO){l?R%*!l^kJl@xWJVjLTPYQ2m%+loP|3x>phCcy#DapHRK0@AyJ5HU9-9f&
zUJvJ)#D245ZOk@bakfnkug<=cI(sxix?88mVZqXgN86OPs!Tni@yqdVZ(U^jqLkD3
zL^QhWuCmSPcrs_EWpUaH=NZ2D@AI#(Y`XNIVA7&3Hjh`h7esDSIsP!RL`ddP#MJDw
z;X7OH|2J%&yji~O%V%YuC9aOMcZJM~T$dssBO~Lpwd#?kl*SM4>1;+zIoFDCbZU9&
z1<dZ~V|82>%2+rjblW9~;|I78Z9K3fWLulD<K~p>s?)U-*q-%9iny{$sj|jzD>Hxh
z^OfqsOYMh@XSjb}e|dGqpO;yGPCxnfScBo$mT!g4w`TZvE!vc$`C*o{w`Igsjg83-
zpE|Quxs_I$?z*K{+Mg$sd%kyeD?_WJ{4vEd#eVEO1`$Qvod?vfG|yU>6ua)B<iaZ%
zfy)w#-Bg}rY*3y0!}m^K@r?sp?bs5g7{@6VYO<_2Gt;TjEL^ivSvzg*v(u**F`wFT
zWJ_7}OvVdY&CkP1T$?m5929*cC>yZxvGkQs;XXQF<`vI-vUR_UK{7|AR_uk(yBfVi
z?LTR*{~??kuDa*{AJMJadY;P1pG;h3*pQxAyy@-^HMYn{$yvrN-N$kTShkw4Utjk7
zSm2fH`M(w~FjG5OyXcN*o920=D;mOGNuA#$0}qL-?G)fS)?~Tx>YU`yDMfM9Tmofp
z{*74r;_K^x$3LE*z8P9mZrp1h6JIx{H}3kyLlJ)+67>%~v=!ZYrE8A#(!-1`hkd4M
zbQ{%tm=GfPLAy}x#;GqnT{#R(_63IL*GlYDZnV}n-4z}>`6YWght&SinBXU2TlYSn
zyhHiNY)y@qo!w2nZ|7|KcJ@{A{eXE|CPrH(Y*ts9Sdh4rC3x!AJ##~Bo-ypW+aNl1
z;}L_CJLYj{O6W-Xa*4d=(Bqw{{_{Yl_agpDOXq!$on%(wvwqdC-yRQ2y$v{jBn5h_
z-I^m5r96G+s+3zNvt8zfWO^3!vKT&_waC>t_R+SD!CN~%tyo~_!J8zuj!RHg%3PcO
z_6Co4E=~`tX1a;r(drDjzHQ>+vyQVoT&GM4owKn?nEjYhZtrRj{hG>Zxo_J|OXSyb
zykR=@_|%K!g+glE0&ZJ=x|<n#>v4?ejw?U*n11-_Joo6njE5Xzkrs3QJTs_U&zP|;
z=xP5>AD5|*v@eOo*!}aa{TILD?wrDy3;X<=Pfs}!nYHZt-U${w*;#CT58wY>YX8uA
z|LoS&mma=#Jz#P6-(Bf-<pyC>Jz|5cmOoJB|Mh>%lXIuHttp8<a;2m+a;5RDRolEL
ziCQqNdVHYw-i@ypRz%-jcI$JO+wn!4?Ow>e%6PD0o=IKT<+)2Xetp8`xGr?-sn?zp
za`a5=4;H-CZA;o_Cf5BoMf`5VNo(Gil|8<)7xS+D>Rf&3?ism`KC`uZty9y2KW`WJ
z`n-y{q)>VlhsH1W>+kLS7M59im&e!4DYdcttNE|!Yo*!F-KDpx$_uN6E}G|*-+%XZ
zURnA1ck%b{_SRbc&0l11Rb|`!^2?jEaWeV40x$jhdGFuO`~SI73%uV4^sXneGcb5d
zFfb?)DyfQc!MhxC^KZKe{aY7rSYQ|6q<U-G#6<!VtXZ}d8wwqFd*vL>!L~7K-HNp*
zW7EnrBQ-zWx8Cd>wB*f^!u4+--nuM4@$}s3bEl`LeUq%Iul)4*$=WAQk%pGutwlwe
ztuqgvp7e3*44=o%2aPSRJw0|J=V?M!fyG=O{$=b1dTYWabVW~my~)9;ph>j(;H4K#
zlTspgp6XCxjGS`IBEc*3_?#=J_}HqetKYk3wzzKEz_v|9#<jRW>W&wKF{@6b;%D9$
zss*uAjKq%}^RSY*VzV`O-koJrw3yQ#uDYhs_t>q(an`e<i*+ZK?oy2VTEF@IQq8{N
zWt%4VIvxD8_Wv!Rmqr><`TIVs&p)#4=7m)^-aOd3N6=GCEOeT|<eOE>>Vmgze@rTv
zn=Sl}=ZVm|N2}-S`A>d)efjbHbNBvcn=$+`&EhE4?hU*5z;yEEw?X-@uVs8Mv0f+6
zrnFs&qk=75yHi@nAi^VvH#Ym&hAV7czB?PYGL*~|)^cSxbdTG_#8s(&QETOfIr}EO
znH8&?%o8SDsAj<RY0e!_KE0Ocmm*6QMT^g!aDB>R80DoJq`z%b@`0<f<k!yNV%{Qf
zWL<)JlZ2@4%?0B2-0u>0#Ch)f^y$K}Yf9-$eH-7;o)x>wz0jgaE&pS2=%JIp=eI13
z5Ng<XKHp%;u?^GmTDPpt*rM>*arv{B4~xXCB@%9^iD<U|dBJ?Uy0lHtcH*70Yn`)W
zj^;1@dj9%#kDuM?qEjs=Yt1_Nr%FbQ?}h5D7#WwdUSeUJ${udGS9D{Y4|99p*OLp@
zoSM7z$gCKj!}}J``lKPn{O{tyD7kHazp1*3tyN%~|EJSg<bU7sf0G_GFPCHvU-tG?
z;PZ^XhwFOQy)<B!*OBAQdU^O+qKR~c5X*w_sgFv$rg?AYJlT-g;u)r(v}lq@ss8=>
z=0CPF#~pE5meIuFE8bdeqm;BP<dW*i3tcsqO(*Ri%nd6os+y(RwvhRkl=tj{#cS`@
zEuEh@$!JsC?j6nC%gbXb4oFQ3ICn5im9dfaPM4I>dd~}&f9v<T={~>p=j5!JYvZHi
zA6Y)T{x)uX%<hSI?pSPDp7H;AY`Om_am{7?fd|a{Ijw%>rm(a~Z+Eizq4Rh7w11L&
zTy|)RnO@iu_RvSQR7GW5l-|?18w|ZKD;|6BV)gcW5AT^J2?S0KDq4TkEX(TL%+f7Y
zrQaU^)V%i9q_uXjx8<?@TmMHZ@eA}F|FH1Tgk`_vi*gTn<wc8i{GA&3<gJvW{skSk
zWlVjuWjZ~Tr>(zvtgYzU)h(O<b!@VpB*nH;L-1MaquDCLS*J62b`|l(x6W=nE>#o1
z$nM|ULc@zGLJ{hXo>vk*K19^_M(vw>^hi?3g4r9UI<VX=<c(LIDjMsWsX297Sg~q^
z)*0ofZ#L;i+P$Q7`cG_LbY$Dy+V^_v{G0`OEc-U`rifOpIGy|c_k>^j=EX?`vPW^P
z-)m;D$EMDf$!b|XThOb^7R8I!t#8TJHL~yLpI07{-Re0}Xjuh^OHR4Qk`0DRGldy7
zs=w^`$i6aY@3s%J8eW^(X1LsX*e%7{`e^U*q!u2Tpfu^^jPp0|-|-Q=wKO>E&Z!5Q
zlTy#!I&oxQ5nJH$6c_(<{_6sbr*-~UIQsspfNxXz^_7Na_v>w!&pH0=`_8-0vzBG9
zf114aYqoJj#$0=?vh82zn}3nD6bZQTQBBpDr#kV-otCJxExK#Y9cJI2Rk-+Oi$ikk
zdWPU`ozGiZr=Hh#pQv-$+J@JomCv2QP-5d@yU&69mmgT?d@enB&F32%e9kE;sNHVe
z9$0Vv_t&3i8k2UlIDFyd%Qc*<v#e~6T-(`0=c867R*PLJvYQ**|ElP^Vcz`O?dhLu
zUpV(l2f7D7`9E8;J#B)y)3XaE8wz)?y}#&Z|NpsmXZySSGp=sPT(*<-nzqb30o4vp
z-klTWU*}0q(kXJhr{4WOOK0P>$m1g7|1!Q-*wj_%$=Uw(IQ`=Os-wCbIS;1yt%$h8
z`RV0yLy@Va8$MiT_{Xp~HZ?l1!*bfE89s-6)>iH9X#I7xo1=N1_L6_!r1>t)5Y7^_
zaQ?MZXlo+ha$kEbv%7VhGq>-IHpt<eb-E>uFRSkD+Cu^THT$wk!t#&XL<LM-yfb&=
z6TkL$qt)^{hi^=gcdf`4u)LL-|8erCiV)$8syxT_HY_}~^<bF#FZmZ)`se#*vn-TQ
zkLPf8oOdYc@|RclCPf4umv!P%*7_rMt!Ldjlf8{c>iC7zn_a~uFQ`mkCa3Z4d#u8{
zQ!zy^t;Bxj#PWQ5BPO!n&73zr{CL^>&S$!Rzt()aBDUfs=cYLS57lLB>@$iFe>kCa
z=W)fC14dI1p4wToZU6k|+g;cAZtKr3yT9&>)xqU6(m%~NsxAES=fjKJeCGW(uB@KW
zzSQZ-@sqRn2>;*<WGeI7nZO|_!m#q$J@*%SvyQ)9*D3fYby4>ev0!fD>-V!hi5dw>
zEZZSyd{D@KS;3a+tsU|+#Fsp(oZ98-aU_m$^;=Uu!}}7Vjln$4AKez)=dQ7||9IW{
zdH8POvp-kAHTZnIJYoJ$xnK3t-@>yF*Ri5j&|Bs5oLE>H7_RU#Feo!HFyy8d=jSDr
zX6B^mC+FuDWagw673)KLB+1D|6?z4gOT+Jj_l;kVFU*ijSv+mRE`PxZiLH}!58hgI
zf@w`_B8N%orW;;M+=4pqF8u$yZ%RsZ*&MYQay*^Kf4{qa-1-;Kzh5O^Evxh`yqYii
zwq5FqS>X2|_H0GtMH4&za|z2{^@^=Nbm+^UvnGq?bMMd=uv-u)WVGja&{a{*X4f!Q
z$918snX}BdU7WE@VO3Nnw~trqOi`~{3Kd^pUDdrN#k+EAc0$&ZlzGje37r4LRHf1q
z%)0aJnZrYMy{=5y>@{Wf42Gr!&SA^yH_whbAv)n&>~nXS<5NFx7CC)yVs@qemPzLx
zzcxL7Yo_`dnRkzN>(5_z`KJ8!&Gz|r|K_nc`1dz`nx{RpJCy%(V~~o<y%RCAd2b%d
zZ?w2^i#@e0fA6U^(Ht90Zd4VyMT&1Z$k4oW!vSxvz4IK_nS{))V&><V64Y(9n8oPz
zrVIhCjbc;o@$i-lrSEQjo$GTzWBDGZRY8$Wr)n9swzQr)A(d&Ey*0v2Og6wTG5uan
zvYNwc*?G|yc_*%LVh`V#|Ds`4V{X9d^(S<D<hTxU=l4%PBjGg7EBwpemk*3g`)*GN
ze>CriFK_tv_ztF!RF+5T|J{zxJJ7s=^<|!KFq>q4?JMP$)8}#o3f5g;xoA=NquuFo
zr@ow03HhUa@a>%luj8?Q;w1j>i<t0gznr!WzwnIqz~$Z3pFd2x<Q1l_n$M?_ziraX
z#*|%C_t;Jd$=N$~rt(_OmWd0m7YP1&vFLQc%{6U_x>L3Mk9?Ib=4q}>f8=NWBDZ3S
znCS=6CdtO{lCod*AFF(*T7Is7`phZWt{l_l_647KVO+x3{+3Cw`&Qe8L(5*CNSN8L
z_>0v}tFzj}GW1r{<YTt4{9ehOWtsSIqp{tmV+TyOS|_rt(9AiY?DF>G=aP=YAI0AD
z+!Hiho$BuSz2fwolUuAeuFU)tv*zLvozrd$FV^_aS4#5Dyv)9=+~oGOhC}o9+YU7M
z+CNPGzh%#xRoi1rj#wMjZ%F@jL$0Eh=i9fP(y`9BBC@(yPnNPTJG!iH^0lVwo9iA_
zA5^QJ`lH17wfFO=1<8zF+jLe6>zeP?z2B6!`S$tAw!V*il4G)K6Y|_Nzq20li^;#$
z;NrBvRcrqHDyjdOEz3+ltt$Lu*zkInNX!jeseswJTS~r4yB+TC6WCp$G2uyo{*vB@
z8?`LAc^_lB6Qq_QQ!ONN!YIey@A*r?{W%Lgjn8^-V_haV)nP}u+aYm9tMZ+Tf;NlV
zEw4~lSmM=twxvdlao&*y59dvDs{1YP;4Zw-`)a~n-aDTvMJsB~oauka_vgmfcjp*i
z71il7UOzlPy`0_X{Z(t@{lEO~`F)GMoVz6A_uG}BD^;GqD?H*o>#e(O_n(Eo{WjJA
ztURUaoc^hE-gCdz3P-M;TQK#)LeY&Id!)9`e!tjY7uWH_x^=T>D+X4p?&Mi{u;Zsm
z<R6xo&rF0iZp_*A-1%>;pHi%Gbc|h_r?{K83h$o3t~#<jF;>NaYg@NWbX-;`crkMM
z&woNw78<{gf7YD6ke#Dsf`&l-W8spCXK#HClrSzo-{C3K=l|@S_U=8r&o`<&o_RIv
zgIiLK$BnRk)+~AJF4-Edotbtd_|@%|#Y(B(i%*3mbmz9eF~9iH{9D7y({594Zfl&k
zY-M`lws~7ZTs&jrjk^~s{`fIt{^uu27q1n1&whM|C-7Oy3E8Hw@1}oCJ7aA&?*6rF
zdf@&Kp`4bt+#L3u)t_{<LPlm;K8O4tv@L-rU0w)A^D!_S&?P(`lbn;7mkt__iFzG;
z+e7I8xp+f%`4s(aJ%$e-T0Pfu-*oei(*v=*$+~@?`j&3Ab)2?kmf(Y>Kkl!umb>J!
zsWIkVV5tb}C7WH<zdp`>Cz(63`}6ksyVY$HHYVKVSL{}uUo?&P<m@SI#n<kBEjQbC
zqHvO)vE6L%O}j7Kzk2uX&AUmbEtR>|Ce3JhGtJd=SHnpcqg^*{%t$-g)N}lD%ri;p
ze$MzMo@$)Ek6nUJPL9aQ$;r#xH<M%LMF-OfnUe%LP5k}p?B2?{o6MW25V^!ANpj{T
z*8XXBJ~wX|Y!OPFf5c|G&8GaKnME_aSa+Hf{n(e!8t}=j=F$s~Al<3C{S`HbjS~Og
zPRze#l9WH)utRvxigkQ}i{#w5hQ+w9eOWtazyG2Q*M9Z$GTARb+jqHpe!sSFYk^yY
z_LZ4ce<$j`Wmvr}>Bz=Bi+P(LJTu{(DQVGNY|WHn{m}dj&l!i)!9_3Q{}uhqtNC+y
z_hWhcni~6%rgak^noKVdG8AZPjheUJX2SH-Q$o`={+O2TxyI(`nVN93(6%<6RKp+1
z2O<wXU7H&%w8{0+6LTw-`|sa=x!d_#j6eHO;J3F^?tlKFA7Wsn<-WmV!^2yNC!cV0
zKRM>sz$VY`IVB}|*4ZNhCatUYGNr#e@R?Km)z4p2YPK3ha%WQ?@t&M|eQw*FbB|m+
z<T}<V83oO~E^BPGYq9snx;5{%El%dxoAWl|E_bs0+AA5`SpUZ!ebC+NuY4*wC28lo
zjJ|a1RvF{VM%q!omMx9n@@CewyNgm2qS#!!BY)g{FS_#Td{$rYiA)mg^=H;7_+I_}
zZCfs5^h(8BX@91bGH>_pFSoktbJm|j_|h@fsI50L__wNm6gcv6O2fQ7&YL0*{l{ba
zj_V#=l*vB3;>?t3r4biioC@7>sU-Th%)bsB*1p{R3YYbEH!R41!I=J=WyQ}A5wa$X
z^|G@WzJ4}YGHGj<;E&G%4sNGsXZZUSz1(WO<dWdY6rJaiix)=R+|HnpS#rX%f1~k%
zx6D=AJ@X~3_$r@mmA@^0v_-e5^4qr@j@eA&EK52TsV3A;a#x&bFe#|z?aEt5CSJnj
zcV&%EE_FV|R5|0wJeA_A(^`lBCTTFpi`$4zI>s0rW-{9$o%NUXwCJ_9Qf+Hb%~FqH
z^U7VC82N?e{4u=`Uv=_bCwNYOC{`)#dh4Vk=Rw|tRSJx~oV_kgQbDuDe|`wQx;o*&
zjfU3|PcCcjPoFhY+%;}@PlM#-R&UJ?!-WfOC6uQ*fB9wha$niQWig@06f!$JWmDI8
z{k$H2`1Pc_bGkmNJfHaFW5jV6)h}LYlT|vUV!kLGdhAsZD*jpNm0!*Jm_F}&?5lMD
z#$1kOp2xf0tGeaowd)!i9lx&fe7{S}L+VWL#HlP@f(01{9}*T^pEIl3-s(}ZaLe{d
zJDr~~Xy{a@F-AWLo^&^$V39@0%7um3Yuug%Ejt{i-<2m`H|cEE1+^*$p7Mm1Gv&|x
zm|tP>YX2+#Z?PJV0yEu8*e0?)o2J7YEI3nQm+k`x)lLafAt7$gK!GPSCU2PF(AKT6
zxq-p+WzWt+mWPKFSBK0jG+=k);o)U2<aetwi4(eD^7(aDvu)pT$0_Y=x}{jSx$T!0
zy{q@ExMTF|RmS>_UaSHMx@-58{oW;4P*p6&KI8GuUG5X)%#02!7g=x0l*RS4<do6W
ztA}r$`2F}XpWgRA=BgQ`F=>{{<;83_9FG(kdMeG};CMaZa-UpMPhfKO{Fo&=4Nl4d
z3)V5rQ)X$r&#*&3@qtM{v#fuNo@~}+mveza0l6#gMmPQp_}Sqh){}G3aKd{vzju$$
zHu1b+H(`ErHiNCT#aVxbdec$aEgvQ=i7Yzp>~`R7;#{TqXJ@PsQ;(|K<Wsa;^yC@U
z<-J_29+@9?m+$trE7YxD9%1TQpWL!cYdh~n^@+i=Hdb%oyJnP{^n8L+%H-5Yra~6M
zLk_}{uXboWFq{8q{g-9ed_;Jc{!wX53Cv>D;N<JK(R((-#odM>H^Mi}<wB2WkHDS%
z4%V^->~d$W)-l~KIl(H%rdYvi@UE_F^18InZ>s|@Kl`Kn@_qAj<>U<<OOkzNI0bxW
z{LV0aQKd@w>mNKH=G+aQan8VgL0it<WjoTgyjuU@U!cR&^=<|2lUgQ~w|O$p$}%-(
z)h-wLEUaU;Wwvu~&4O#}|F(Fj>M)z1zMx)zmN7Q3qJ!@fdpnoXEC!F+jeVaurx|eF
zy)s`<;GoIY<E<xVzTjnZw_e}1vwNxUqwavVI|3J;PQLW%#H{t%XRnv~Jd52O$<M^9
zwUkfv-^ZITf3{C9zq-fS_}k6BEbDWp@_dePjr-o0X1He4>dit77U?W*mLVG445v15
zck;bv(rw*#uXOhz)}uzMyZP^F7VLJ4XGp)EIVqFn(|UL2`uq1kX8oL~yt;2g*h*;*
zEsk01c1up1wB_}L+~Cip1-k<_?8@B{DlD?Pw)y0bu8cf07mm^bfzM2;MpM-MLV0%m
zUUxZS@-N1>>02}&&tX~|bhOqdX<J)Ebjo_Ahf_tjhhH$NKAy@aSk@XD>i#tBoE%e{
zwyX2}Lz$twE&e`Of8Ea@#^b~r!EYi-HFj>>ZCW0rsH92F6%aA0ImCUWAVHg<{gkfC
z72&?w?0jBo4e!#$pA`4ckNxsQ*G6x_fv6|kNj4n};TzTj#Kaz9(dQK^yl?t=m%)1G
zwKj7P&k_pEpT7O7*`bsN_Oh?+53Dmic_TJIPfo$iDD24ZgYOP<dn@s*v}yAVeHFV!
zr}y8{S8k0rPBVYlAX&F`=G+h6R(CBV?;BPbUrRShs@)R0==iZ-UP)11+4hqwYGNLL
z^k+G6qP9@zGfR~CONq(uvqM%YlqQwbT78|$vCXM9^_a!gNfsN{dL3WCu>J$nFXaVO
zuiWT}`r$M~Yy07(UwlHPp?S_l99tKBa%piba4K8BUA`cA-R2j@358X0uWDbe7g;vx
z-m!o~j}o2vrmAn@FyDLhyQafO<EKZ2>+VO@Hr&?PbGuY@MGV*R(i68Q3p2jtStC4c
z4d2pGqaK6SREJ|Rp)VA5-duT+Xxhlx9k(h<>flzzCa$>#n*$UT-z=DAln_1jq10uk
zGhgrR`(5|qAX{o^+1|SL=(UB`7mpm9e>L%D)5%I9v1^A;`Dcfn=T!38TiSf{L65Ut
z^#7MeEl!)3d{+sOc{XK7NtS;N*V+e__Noz%H~$D1<+Mk5FP;6ML2@Q5ql&EgnjNtM
zxhg!KJJw&e{4v)cw0p*tji!kk<af4vPME&(@!}1>A_A|^G7HBZmGfy+<tkAORWB^b
z_#@`>aKazm<${OIc6MY+rIoN*Pb~F0%COqsrmxWUrcRxSl3dWoYsZXr7D~4&o4%;x
zZFT*`#Fcg7Yn!*z{aru2Zm!L^dQpVukk_xDja}+bo2CYob@9J{$Gl8v(lsxg`BleH
z<p?Mz#B5%|{`ddI@3*wCo9K$CwpV2{FMN0An$fY=>~{0A)l$KnQ<)zqN>9H%v2nH1
z>*{--MQ0^Q@y@gLWQg_6>Q&#TR;tRX&S8{TtoSM{RO@PN>7Rs24<<ETw+L!Ty)^Th
z!_Kz!^K%-?uAf_bIb`|XXFL}#o+^*%URC@|ao$-6w;jp+dJU{{n`d{Ok3L_UDtkqz
z;KI|7cW$n3wrr`ZDXL^!{X_S;q;S@DC!PkWBDQz@8q5B*{H}f_$UR+p3+pkqm%snM
z-Sv6>-2$oUwO`k|dT&t*JyT@&;{DeNsr-q}r|;eSck$wCPXk`IoD1*ye>ETc_wHQE
zt^4<HSBvhM^^M)JVuSzhc3w6$oB8MDww#%&!ZdBysuMwSA5sMJmHH|dt$gX!Jp1a5
z(3`xcc7#p-|LymU&}kJ_p_hMcD!Jq2w<No>>$Al6i+L$?moL8d<H4)h?fs^)J2Xv_
zBwQ}NV6^>pu{dAoRi%{N{0Dotm)1(VCwSWEGz+mgCQn=8^N4TF!gCi49MV+$_b%gD
z_Mp7`p<BT02)UX6-?|mW>rUW3G%dtPTw1E|Z@llPu3YE2GX7UNH|cM163vK-J<Fig
zs5v{fY;j}V7M`34i(icFc2%!Fcuu~`RjGA1Zl(F^-&%I{ytC{=l}+`Yw|%wldsTQq
z%A?KksN%QczC}xARyI%hdSGqWrM42an^A?A7%F#ZdQ3T$JL49Qk^k4_n!-0WT@YE#
z@>XNsgr-^C$6M!yCASo>o}?-2kk^%d>2>qT&OcXGqI$oEt@~^@W47F)f`z|TXLelV
zQxH3PM{#=RwE3@X&q~OP&OYuJ`H_`hJv50YDj?(etphVU_NZBFZ{9Oqd|~y!bFY$j
zEiVkazeW6;Q}80mwJ}H27PV`d-P<g%D)ehYhmBdkV#$$EJMJA57G{|4<KGz1nv<8e
z%52f{1v46VW*p7g_s7chZn(ipzg>NtNnswF1Affv(RF##+Og}~g+IF4slm+I+txPk
zTei;Vh|HAz3z;PyWH0&6-pZxD{F#Z}JNcgay6=~dwr}q5;9c+j`;^1B&l_%4z9@TF
zx2{Ys)QbJ;xw_I<`dj0Sw-?HCF-@<0{_A{?S9y~sSLqztQ<n<umN6)=YA)LIoMAgp
z-<SP$_lwUf<#J6k+#{KCNMBEO>ZB^8#!0)E^W5Q{?C_=T60^P9gn-}0J3GPzk~h{L
z&#yS;<R_|I^Sbufd8TcC8a`7Vcdhi9ve)3ymD$->ez7y}_>{Z#%Rk4rY!6;r$n0x4
z{BV1L#@%e&_Pf9H9~o3IwjVSv{PC1kW*T3+G)LU#bS4*_t~nev6*bNBB?nyAKRWT^
z-j7PDAAd!AG(2ZMIe)hE%Zt9h_b&do?qP7ayzxpKheJe^&gG@y&mS;Hh}LzsB!tg7
z`jaESL3%^yrYi}b|NOCMoOAp3c_;Np^F<f_xOBc?i$F!)J%`n?;%gVw@4r_6!T#Xt
zF7Aiy`R?sp+qZ2mXM4t|aK`4%&35MBA9h#XSi1F&zv(-R-un+etuqR@s4Wz1&|#1J
zJzL`K{wWvt9e(j&{m4H~)Dgba@1{n9_6!Vnz7x|q&CCWZ7I<4*U4Pqc(u4p1L^`%?
zSI8CGG}p&$anGdEl$(!bZ+?m_o3mz3s>349L>?v?8<j$nU+=>E>zK~Ar&t@8?|-a6
z(bHzt?$xVbUk$x_`{2jd%lGr}U+z4iZCEq0V~^kRl^W&E>Ypo$^xFCtw}0Q({5NTz
z#^ueQtt$R}xcK<t<M#gjeD~&cKUlh=%f{nK>xr(PJaK$kg6H4eojvWSjzsS=-@8+i
zOt>!H+@tYY;oRp%eXqBiSY7@7U2bmfUZ3@sY-XeshIVSL=uXgSdS#>M%5?vgx8kP+
z`FmbXf7$t)JPl_rpQ*9>#l5}XGi&2aF5Ib%Vx6vZW|PB#<g+$ATC5#wEOR$0cs`C~
z48Qy*W=f{)b78?Vr<3M%Mv4ahKi_4sJKRUo$II5DU*E;xa9!(Fg&j8j>I~~dmQ8+M
z=qoN1xHR4J%NIMIS9az9;#k+J6ox%XV({;B4R~@>X@}0K{tugVW^FFsZ7%re!9Cl~
zxt<eKlMdaOIDMI~-O6sI%i`xYC9T=Fe5=OX*{%P=xW2B<I%e>sbA{IBGc^nMUGJ`(
zHJ`Ombk9@E*~h<DPV2kcvbSx1k=bI6OP3?&rDlefuRA|M>cQK0y=yEki*Gjh-!WO^
zf9QFe^Ro|sSzNK}#N$XS%O$g2<eDGsIPu76?VM=l1t)LT$QwL}xwdx2K8+9UFMqsE
z(!284LD~7zlwAw;SEzscdFbEH88tPLDqM$Lqf86KuKG?Adv$UC%Ug!Ahc})G_nz@E
z^MhH{@7J%JFaDd)|Ly;$M^``Jt!AtV$rm<c|0McTMReE0<*#lXsw`1??ql~g$t?So
zgvT#|v?ryJS6C-Z{M>Xx|I(%tnWd+u^PN$B9=Q3?w1o@zsBiKrc)mT6^W&z@=0dI=
zXBzkq9P#NknxXs5;oFWoF1_57!+3Q%yw<Jdntq<;eZp;_Ia$d9A*}mq)EcfOq+Vuf
z6=z-ZbBR)&!1dCZeY2w!7G!pv7MPuzaPm+nC;$2>yaiikIuvaFvDm@Ec=_7}68}ZR
zVlPbgmc141ZL5Du@=u&cf#=2kiWBKCS?{o=eg1NG{h}kGEPog|S=7=F$Y|)7Ty8j6
zai}&(nde)|=I`%p>x;j<`}*SM!^zK&7i<;b`nuPM=kWiRe}7#4P;2&r{o-GK!GxvX
zAHQpV@#Nu${^k6??AQJJnt#xK#nGkm412v7)XSv3p7&Sa=zq4ok_q4IUf$pB&cXF9
zSE@c}Ua0L!38mjj^E+8N7*AHR{P(-8ec)c)1@3lzhBONsp5I@5lqRM9yYbs2N_SP%
znJ15beAoP2%f9~9%gWL(-x9<>^p%7OtnO`6XZ*&_nGttI<95=FyNk{wvZ)#ReN;IY
z_{^uf?MVwuY25YCS>@@^dD1pXKJIxVU@vK&Iqk#sxs{Vst?&PN*dL$&cze*FwSu9s
zUELuueDbyINuO@F$JeK~eO+O?re_!bkL~-Wo~UJicV2PR$;RFV?u%E=l=3*>e*A~m
zloS@u6)p98S9)*MN~?K(OLX#;y?mefm$m=%ru_|DgbEk^HWCRx!PdrU9Nk(PQLXU9
z&GN(-?u)Bk%w#9j+~hr`Fk`{g^aIMS_7eXX{_tB~;e7C-Bs_R_isDp;PMxFnIy)W(
zsch+E44bU#*jLlq@}mEjZ_GjsX6*;6D&8wg&u(X%wr#<Rjr`3&iwilk9EEhc+HP=n
zBnjTz{L8t<j-ig1M_K$p*n;rFNi2sIO@gmkI~+c2ykMPW;dIX^KPdsf#<K@>GrT%i
z2E3lhVA$t9A%$s&h>_tV|D;P(L=*V0w0IqP`b1`?^}Us1n+>_jnR$OV&$_sX`Fw_|
z!W;ddpHrUX1WVM2iY#UId=>HQug8659ly=XtlXPq&vvhR_w{S+0dC**hxLjIIgNEM
z+Q&!qOGjR;-R8?Y`4Q7m-cR>+I*$b}VEFNU&51Yq9b2^{niqsMx}2Y_y>emX0Re^$
z(Gt=HzvUhXy4~VG_la%6ja)ff+gqu7`#X6=ohK~jUUX39;Y|09k6(y0PLkH)kybvP
z5s+okyx@Cf$?UrOM^z_2>^LD*U{&*EXQ$J;V(w0DSr(=*)e?L!&Yty|Qm9*HV7XT9
z3CF~hQAJuwPHz=i&U62mDRLm^vs+2tt-oHixi=U83jT0`zs|a1+O!il)HhUlHFnv4
z_z@xW<<RfGZoTbq-#*~@S`zc(OGK;f%88a27R@q^oO{mrVYGqY_QDu@3*EmPo=YDt
zE0DOq=(mBP-~|Z*m-AabD^#TH*!;*VvHtJrD~5ly{=V9?M|O{(al}N%(|2VPz8ESn
zzDS*9+Nof@aMJ6RFS4o&O<8^((`f88dgHi`Ct<Jh*9I0({#|R1u|0ewkP>W`wY9*>
zw?{2wo0@VBll4vS-##BaUVW2Z&Uc`2PS2$$SuL*)t(z2@88=_)!R7NCYCe4ID2P?u
zSLL=ea(k1_5#{G>J0~+auMyOLut4?esrM`9ul{*hd!OE=jBnp`d{5ukPAT7@Q$6!U
z=AMHF6<3yT`+K83-7iSx>Sa5n)yDb%!fqK0*)&8l%rRbaPFrcR@&~1ge95+ls`bkS
zubh-Gw|AaC{Y$Cq=KFWo-7NLZx}+c2zRKm&=KCKM*mfS>Gvn~4i`x&hWS`ozwQ07^
zUZv2YlrQ!*<t-)B&5mJSq95%e!xJC(uFqKSHf1XB;)Ukj>sNhwpY%R-BKOjDe$9M+
z3y#KKsPhWae0cwEnSQs{A$H~8yxx(rj4LWFr6w+U#}v8t?+LYKiPt~vEZguow9=Sk
z-BTUyngd7eR?M<{ymEQymDqQ$u3fvfv7~uvsq5yB*O9*t#qGb=mLfWl-E-3B>&F}B
zpWbmMbK8XNw!Z31+WB+l%1GY*+Pi6Kgmsnjvq&4kHL7PH?Qwj~sooN~FJ0>9><LYC
z)m<gyudQ`rm!7crSNtni5!dC-4rM3mW2^H0K6Wm)+;!s7n<MY`zS);o7j?|IQS9*Y
zat7U*y;5w2ie5YVlieGata(_zKJL$_*BSp`Jbf+R&Yth4AGg=G;`6JM4_|yZ>VMoU
zby;Q9?J1q!2hFC&E$CwS#;CE{{qg>H&2Iin4tyz*Tl}uaO!}7K3mF*}&x!3@|A>kt
zq;<SGWaK|1<#CP5$*|i~1y6j9t9ZA9x&7mPamH@~J{b|qGjtX+ww`wRCEk50N{i+8
zzU|q{0fG8T{O*|>7K8~1t~SvSy&LtTo^giT^66@^Nzxr#&Ru#VF?-3!=4+;mJQHWX
zTF?98+!6uNq}7bt>s0jhY)o~YY20euelza2nf;3*=F9orUl)80>zyIpcf-V>xYy;{
z!_@rKZVv13&u?Zu+2MG5L$-IA>jsCZA?B^Z!s*jLE;6c!$!lp(T(Lj-d#~Y1gSLbm
zMRuptS@&;Tb!_A^vYW%M-(P?4`=QOL?BBS0<{CG$X_l{f|IJdL!Jbp2Wp+t)lO1P!
z<-z>c<#q)P8cyG36Be;AWeqM4vOM|X^O+uxsAo?NuBDawJyVOCxyGidaOrHzg=|rC
zJ&x35iM<huR6E$}`C?yA*i#O3^}KemGU2^>$*zSHZZm)Jjbh}ko%V08SyvwW+ZTz_
zF&D3VUbZd0XMIDg?lqs;jNNjkpQC0gxkQRRef#U@ynC77LnEES(gRy>re2)F^jV>G
z+T85Zvl(3*MCwDHM`zi@^B>aKGT&@MwA-{->pt#NY6w2x5ZAI`)@NV&#3?y<KhAKe
z+bG>~O^)Tj-2|(gZJ%UPq-NGWIp}`%gvCD>ubP+UXBEopodbVL3;dPLVEs@my4-3a
z^9QY!(~`W-_`I@MeSF)Yt$gcyJZh{T`OcafwWRf)t=u8M8>vQ1LvESmgk6*IOTPW&
zZe)|;0j29NxMgSGX<&_Oi*>m(tGimZy#0u_)3(2B-X!`ysngzcC`T()a*AoZz1*W|
zLN&j?N&hiBuv|a+PJ&*=>eeMwSOq#6q!>5GO<A#$<;ev09=0In^*ZG%?*w)|cM$n(
z#QJ*f?Y^eRSEhZqed+%~#mA==Bm;wIG_INwus@?e+_HOTafd|8MH2~=H#!rRO<$2Z
zNA$(2qX%79JY=*8ILWX_Y6<Idtu!Xy!>dlPzhKBuThz*6I`QD~Jv&-vx;xIhmdM(%
zY^~-ktJywB_T)X(J}0j5O1auJ=E%);dxc{CIli?|Ij}DG)W5WfDldQEk1LtJR|k4c
z-@BxLvVE`1JP&W#?K(F)7p&R7#Yw^T>*w_se#<?my7hkdv$tlu!*`r)l$zC@P&8Gf
z@^)gopJdhAZ064olo#;5Q2w(0bHjb}#q7ITbUJf3Osh=$-t_K;)%q(>59NQqJd5qE
z$$QIy#JkgykEpI$l(KX2BbhTSw_4_?WoW4HwJ(_+Chuf8F(FFuQo>p}8N0>a%xder
zCr&FmeC*7DtOm`zyDV$eypN0O|BH+{>@jC&3>W8v4<3GUZ|jPsYPO2^IKPPM$YGw5
z;eYSXvn~BKCk<|k%2YO=G=JQY`sbvK+J<R6Hf&ICcAt{!sC;<hx~2?6mAmmlA6ECj
zoD=O_ee!=<sQBjvOy4F32OQrbwlqcIh4%VcoLaRK62Z5uCBCKel-rfnhJ~Amx*um>
zu~p~u3Hf4v)%{+&VQps_%l5oKo7nI@XIt~3rsoH)s@R3z$WzPSJL~whYuA1oJv*40
z%AnrLv($UxF4@c9#NIUu25$c8`+KI82v?DiR}j<2dhLdbW=fl+zeKUdu5C`)Di;->
zdmwksA&;dQreXODTW?5R&0bl+>U;F}#BD8IP3n?vl^5i=%ZiHljI1iEDk2n@&SU1j
z+;CxjkoshH{<iy%^vq{2+mq~{^C5MXeZ73;?h9u2wOxIexDVIe_PZrwx_U~jaXz0-
z!xO)0d8T`pezdOro3uaI<Ba-qWrtnK9tTu2B5w(uku={{za+6KY{Hbt$2){pZ1$GB
z{k^0iulVu0vi+xWS3i6--|mJ;!m0!Dwv8MSQG5Sx^L=yE?-oy|-}BFc?N&W0E1XZ4
z7nCa{O!vRi<kv7!>W*E(m8o&B!#)?VuglBZcPsbz0;!5^v-fm;-V(PVsB!Mel-Ey!
zOiNOZPP=>P4X4)K+MdfEYbNfn^Y4-F5i-m>SM|{FtHz4JmFzE{1-MQMOZcMW7CC3W
z=|{-|%Ox^rv&$L_LTwZ>quJ&g$TpQZ{o3cY{9(7&j47_6k`b5I^P3sp{jq9Sr^xdK
z3q^e`1zrB+iuymyJMh?Cx9@U{oxk}aA-Bob7Kl6Vm;dT7CpEX6?L^b@TZWw%A9jb=
zZ(M7#ynEe&uwL66+)n%Ct-fEaTRQXf3!8NbfgKl9JEH<`e$J83O}1cb+wWPDxFkgO
z&HIEqdV5^1J(7{I$&e5HkbP0&ti#dkJ1=B0*2wK@Dzv(k%*La8A<r`8V}#^W1F1q$
z=80vZi*tKKEUo?>-P*^%ZYb3$8oN$FcEz5g<cwpL3yvr(_Q=SVxU6Hhc*atdxqglv
zi3O4wxkitUvoCt$du#RkeX_N`c_U`AR?kyCvf}fpO(&;WbN>3t8T47<L`uT+i53TZ
z8V~Q#E6t8$ztSYSwm5Y9$ByG$j|W^;O8)1V*2b*6x#o_|De)b*d0zR<Vz4nx>~*v{
zzePOqbT!|zmaWl;*G68A6!ciK!^L@Z>-W^Iif5WB(Ou$m|C(*uel<J5EU_)$M=P7R
zxvoG`X+E<V>y^FYW?xHw$VNx7YVCR#w7~nK>bDK%g%egUj%H3<d#CudS-bwNVgu(_
z7cP3p*mnoM3oJMyS8ih2B-#4ZTb})a-JOFcxeC88yvVq364OZ~gTi%}m#Ku$tP+WJ
zEvVG-&~7)oIpLg`mPpsh0|NJS7S^VF7EhYWbasw_y!F<|EpOXHSG51WR$+SMCyV*x
zNlpJA@nqfmE47?G<+8|z)49!mcKCd|vZiY0j!7~;T2+4!O_vms@A1?T6xhVOKj%Z!
z(mM06c`s^N^M57se*CN$&lWW0Y0-ovR*&oD=JQ?Fh$v((+Igq!>QT*O>Dn$4kN!01
zIBbY^P<bVhCe~sxSy|xz2CJ&S(obHWm>&9kYLV>Djjq1$;@MWaUXOLXyzgni<cWqy
zlrGE+PYTz#HAiNm#9Plk({uMcxaJpg7`%uvdwt;DtgE`I)d~kE<`pGv)KI>=`{5+E
zP5*hT4>7Jx`M$Vq$xY?$oV#wevD_=P2o$khb8(Ky)`ke_PTOTA<>ieb5_1cL81v3r
zJ$?Rt&24}Fy1K9LJ`^Zu-YGsk&G$*ug_4dx;dgqgG#BkS5U{QL(c-k@EvCvF9nJ~|
zZQZ;gU(fD1lhuW_3yL%yvK3y>m_9iuF`sAor*+0#8Vf}l9?LkoZu^;){eFAs9owuQ
zEus?*&R*<h4f?XkV{%<Vub)}j?YFjn;%-WR`ThIBGv{~ahi#X&3ZCjK6Z$my%LA1|
z38i8yt7h;t=>}MyDL%dFK|{6igLBI+|5bJ4;#L(c`=HmJX<g~689QxZtNk~}t{{m+
zo;R*tIuvZa$E|YaG?UEZ{qL)ie4Qrqip<+)6DG5<sk+H1VySWQWdok|lCtJ)ysIP5
z*~bcB%d3lcW;t<6#6&OW6*3VPw~XV%rE1?Pe19W<ZH|)j|2xLNcAtMfH|;XN=GqO;
zT3sh6hZa7+Ilt(Npi)dw(@Tasy!(pYech%qHRq<>$J|@T`L_K#Bh9t2MlGaM+I8*b
z>}@(P48C3QVsO}*zWwg9)79^~|C<=4HfOF+p0KyB_`|QW7yljn`0>Ep4YtpxPe0{8
z=h;KWvV9L1{t?}~pLhCW@x1*ew+`=@UHm%XhjG#Fs^YNpB~{+bVy*Aq+u2{eY0Jju
zEo*{!4X^RtV-hWGkP=?y{9^8c(>A#W|H_8<dM&r~`(t{4-%ADeyFc#Lo{iP~F;V3I
z1)GZE&1J4v;%8**mzwMJ|CllH{(4`Zb1K_CE?k&#^pVI*y_?I<UAx0>=bkrh%O~rr
zw@!U1G!&k3CGzIaL>Vb>&X^eo&Mw@Qe@|=E17EHU*B6UzSRA8qT(s<g(BnT1b38ir
z4a}6boe7ow?9jDZ_{7NzMlTx{KeOUY5<O-bpzk31WJAEKY#-aXVyWCw!4Lh+wzkil
z^kli>dxqkgGkg2Bv(_sXC(J9l(roSa{@>RnYuv>Pk3AE*kfAwgN8jS4xNy@y3dx;j
zN2(rHlms4pJa3Jd*U=?MZu=fs(QezYWd7;CHcej#>Diul9yVrf>DTl6QEu*Wz9{1j
z%RK2vtmZb3QM!Bgcd+Kp<!e&c%AZ+Ry(YBWzQnp>lFC85)Y!Lg{(s`GxBT^T|F^T|
zm7%R|pZR6QS$7!j%ar85<tE7|b%T*zU;4U*z)_AFcPhIc9WeBhS$x8;ell->L1}hD
z*kkoqzgOB`_$kAjec|?zgN%lG<)4E*ioH@&zEA$Lr?2}K->RJ+$(_p+SY}ADw)?*n
zH<-^I6ZSl$x^dg`?jkooed`LfV`n{XE%%W!*?1*uk&&RozdLHF+}6=gZr`drrak4A
z*O8y@4hJVM)2sM?wP3Z+5e0iUF+Gm;s!u<kSdicoGi9@a{OjFs_&T@pzPu-E88z*L
z)I^nuqDPOX*-hHVCK0+b!kv4^WusG*uAOR%%eY{acVw$(Df^tK?X#y{x_;(gD(B-T
z4_D@hZH{mVe{nziqjrpX(W$>j)@KMftczuSH|@R~cVqR&d|lVAdgr-L<**f9)tR;U
zbgF|n`?(h%wiRo)_cb26Et1%_Zpn@#yu3SSF8n*aAXiCgs@OD>&t*-Ej(s{QYWZ;e
zgq^o<H2mB(DQ@C{HRts1mX=@AWbZIw5xG`eE;7aYz^w%aR?LRMPZgsV>#n&JFm3gQ
zeMKzu7u;C)=IGmyTT>VOnRT&iu0qhPn&z*q3zE-xwn??#31iNin&PzUdu9IA<lul8
zt9uz|@0O@pEpXxPv<sKN%Z9FgeK%z8CMWC3PS+ltT)R$>eSK{1m9H-srN7(uee1Nn
zg-V^%if*gwetDo?W<KHL>?zMzE}ZjCHt+SdypM@TDi^g1zr4JyWkq&jlxyRn3Y&{F
z_5W^NAyRpDip|CY0-tAbsU#ZAn)zDuoSEB$HE-7ay*=&5?>nZ87nhxMUG?1VR?c&l
z)hz;FUs;{K%d+5>_IYK|D`70%1;Ne-qc=I0OU;Z;D&AH0|HI*f2VW?82JtL^A|ArR
z^{UyH%a$kg&z{elPI{Hydt{Q~|3$;D@9Y8T%n<QQ;y#sgcC7Yxcydm)?dG@6iI+m3
zZ7C^?++@h7=k#;By6xG=b8A|rD2u-l{BCXZUu;(UOob_3@7`QtP5r1lU&&V?ZC1~j
zcejhUkDgPT{pju4g2kCfr8^zJxe9NY`7!9T0{6XjTgA9e=Po|8YVAF*2B9@(ECn<3
zF6O<PR&IX1*Y4=@+tvFMX6luMDdfJM7Q%CU(_hQ(*G6kKW=#K*cPp=KM^m7@(W1jW
zS6Z$%G9C#qzN0d6uT|-eXQ#INTO@sV*?aRQ+Y`RpR-VQQE7|l+CA?K%Oz2hRm5cD*
zBEddY@#EPGOHMel9+f=R?af`?@;^u<RjD9y+kwPV_GgVbF3smA7fyKbA;4_GwtK2P
zr#7tV7LzfuOKF@DDI&wYu<~`s)1Mw<QJ+@SdmaCllDGY_#gorkY)6jG40(KIveuWY
zfp1ODAJNEJc_r5IxK_wr^Dj^9x2>INy{dG3@CzHyInou%tEH~pGO>z(*cUQSW{==}
z8!5Ye|3ly3Quw^A{+De`eMQ#W0|&R)&+-;%zIx`LOx{CbU6Zd~Q75`i`-OZ{u<$>B
zZuj)?FK^Ze&in9g_oQ3X7j4&nCEw0y?Nz_iVZEDVSdWY!Ys90y3)R^;7Tr(Wv1(dl
z<h9Ee)SOeUUuSus7Q*pf;Kl*T8SbJJTf7S1ZEb6mdV4iSwR^_0&Tg(RLJ2=)pY?2f
z>EPwBaJEc%|IMk6r}`bY#_04nXeziZxO1;ccJ>{6A1>*eH%s?qUoeinC*a7u^ZfN(
z_r9_vQd8zETOEIMj+$<c+v9o`<*Z%jOJ)kiZCu9iEUxtFvuX*MJM+G6`xm|`b^X_W
zMQlr-?>~9FZss+eITpobUW#h6B?57~GnyrjvrUM55YK9PQGCsXzC5Yq**VwNva*~|
z)Stge!6Zqd@WwR8H+=!WW`(oOUsG<re?iGE!@L_oi<GDCI<s?@oI#=9e9hj^I&+sU
z@pIa~uWn7_nMc|x{0AOft@rtv{BEh`eQCQrzuqa<zY)D@)M^~Eaf1BHg80{RUhTV$
zv~^B><=o74*XijB$I0&#pTB!*>H2o<Tjv5^0lTRdKH+jK{nG?>?7lS5nJ#Lw&GAFf
zj((-u6+T%rUvqJNoYG}hwJrR^;TcUk-#^^``(X0A*kiJ<_B9!wZZ6{7^Vq&f{+-ya
z-A8l&yxe@I?dr^jpI$Cl{!iulA^SqRN7|<H%r|Ggdpv7j*shOrc7!Hz$0(b-8;gDI
z|Hd^{!(s1wZ5A_0bH)U=kh3@Dd$xLP*k7{Kw8Y@{q%CQYSLandxW@5L?Z@|e{#!YZ
zq!{j12&?Q;S$g{i3v0&YjsJaiYwcj>-ZTATOp}Ai!p9{)I+Y!EhAiH9?lj{@mSe`6
zH}qz87=8H0EM#^hwQ<@*FZ&yua^*61uf?z3Q(wO(`Xlpn#cjR{K1WTSoqV4#<IYu;
zNU^P-ci-GU|0K)LmcLC`H$Ld|y}i*mH+J?Ej%#8|S~p87=H;EJepB&#+Ukn+d={5>
z6;G@AF`@Y%k5xe3wQ}Eo|GwLWtm)t|l0LgY@BY~j@q(-=z7nn~+_83cAJ5HHT^gv`
ze%#)2#VxMaZld><SgmF5^*!5Wn)Rab(u(MP+&Z2SKC0yo_5bWO_x!kA!}b5q)<2as
ziGIP?v#jz~=y4tGx|0`sqv_A--AAwKwqE7QmGTNQIsA^f)9~hvdh;i_v(DKYxBl<j
z^7p0Vk}dg{x)lEwF?r`#+?wN>So88ou3v4o#|8Jgr6q=cy*qd5Ev#=k5d1ayz0P;D
z<FB7RTHpIsUxih2;&$N%=6CjqYjt@Z>)0+9v)^pPb1Ua?bVljg+kgIhTmJkRKCP(S
zN$^a4bK=#_mD0A8KkwjCyRYvY$$MCEYwyhW)8BQMy5vRpET6g}(BjoMcA+Kl-^w=b
z3VBmEaqE}N)i3_%Rb~nN+Uc70;px&<>GjXPNAYhLy|!cdW#{mRtFC_h-?3-k+!LXG
z5x$)&mC=$%;+@Xz=8aku$Gl9vtgwsMcbmDvOGz7vrKy6ee;3tv&gq|LRd9P##Zs$~
zPUcA$zIS)mg@x28`M3Q`;A-Ss<vBA**2^a|Q+@M^;>Rg}?8OcmOg+3$V&9s|NjG*B
zcd}fKV>+ynF0m*#igoUpHJ)pjgPlHyh_q){u3+$6wOE|}@v}2CeMAeJKm2($YwOE1
zmsEGQW_;AunIHPS@^9~a#hR+iA(2uQ-d?Io-s!(`78JaGdhp}L)fYcEZ(qEe{e0XW
ztA={M_&qfrzdbnn;>X*`=K0&-yeX@j*>A#ia8l&QPX|{okA8NPtDEhqlC<d*=@+>_
z?rQ)0R8ms&;gxQU<ranr&V9dT>0h26%-_ki=C#q>z`F;mn9J(dsNdB&lFc1${^@CU
zFH8I8+lA@#D*j)6$Upn!vxMBBJbR<YytIkQg)T?tuAA6#aAM}1uQ`?~m3-lH5*8CV
z`w|}ATmQD>Y+_7N>9JkQve(+(-7Ee}q+jl;@vQCNns%5xjWY=6IkvC+szI2y(Vsih
zVi$cWSn+A~r(<`o9XfTtWXr^LN$XFgzdHPF#ior5VjXO5gzoMB(xra?LPx|dSBca+
zn@`*nDzCg$w`0q^w%g}&zVVdYX<OFNI<GBJ?`HqW+kdADwfRN-TWPs@$<1I}Grc68
z^Xs+*9O9gnaPme_@5fb__g>lHS2A6WrDE0O-rm@oM=ysRYUa&YfArX`mHd8-*S~qR
zb>G}4)0sq0G&tXOOgxa%z9xz_P=1qfr(@y)4Fy^8^ZMW4i2oA2H~0IlM_1~y1b(P!
z*=q!QMXvMH-5FJ6_d<8m*V?kXY-)G7I?6jDLm$oQmpGAqexs<#rgu9<1D_v^+#|sq
z`E9z<d_y5c?Ib%dLG523Hy)Vs+=sn9`OM}*7gll6MQ_|^-`G)jYT<&)T-gkRxf2ik
zi(jkMHhD&uTC1%|$Gh*&-OprZTzDbW5IIecu`}*e!@mWRBI^{=<4*a%SQ2!=F!Stz
zcXd_YYs@RACwG2}>77?q;wzgxZTalGE1FKvjal!Q|5~c8npy0wX&;{ngVKxH_tf7R
ztXsSP<L;U1xi^*A51nEDT44HM+SF~cUX)DDN>$DEi@UcYaJ_a|p;rEs`$pP1#e4Qd
zwsEdLV_kONMBo38YHO81%ll74=S>}C)ndvnNk3(J!aB`v9ruw_E5sr`tX$n+&XxE2
zz0tSnpBgo$^KMn*dE)rC^^^dMlui1-W2^Srs#f|MZaVoSS%mk5TSU31@oe2S=9(KK
zuE#Byq7u~q<A!OZq4|rWVQH-M);XvP2d`QXoFH<4xr*C6CNZ_J^!CH`AI>SQaA-^4
z$eB4&Rm`%D%Ou4sc)5*&j|w~E@#UH}H=jSg>vsO$-dpzHrt{qAo41M2^{VeqInJ=0
zV7`=h2H`Ca=E#TMXxZGS<1p#)gO3M4E$j+n_iYoJ`NQ?*+V_8_`S(VbEc__=QEQU1
zgl+xTypozP@6P^f)bU$6DYs-h%btYt?&LFziYx!DfB7urh{N>_9dB+i<exWencAx(
zu6jiHQcF|B&F0CC2j@kyCn{(v-rm0B?zT$-6GieXmiA7u(*N3#WcBFw>NiG5_g>A=
zc`skSjrGt=mjad)mRk2qu`K7mfB*WkSa+4*5tYLpalSvdsAO>Z&UIeMo3-dctm=)K
z7GjfkD1PeO$mKWLTfgtisV5cJjOKCQ(CXfyYsnp2v-O(JS+VqGVY_PT7P=jpwfj|E
zwvgPGG)K`5v(9W@cIdxuxTuoSja%ENwPYW<bm7ULjU9jLIH%ozWN2vPV$0<te64@M
zlw83RS`W1=_h#+hzpRJ9ug2j(*r$j!u|GXyrX6)ut$ZHvOyiQmFO#@=Ity6*<kR?W
zKVp@V`p8n6vD9t0qIaK@N?7|Fj=#Cj3=3HeR;SM46?W6SI&r%2iZdUNM{Hcyn8vc8
z@`~`g&1pfOGQOOe8T%}-{Hc$a#<Rffk9@keYh3%F`27RR?aNza_lSRr;JhODvqql%
zc<G;sGfgk^&zD{FrF)iE$i$fKQ@{T|WO#K>xW{rORnE3qiXu-s3~wfB?o^q$U}}>>
zk=9Bj$rjf0a|Akamd{!k>}%JvROd&5`6L^|d6q8TJW@xDw=GmGJATV)v61yHR(UDc
zr!j&%+!_|&SSt2)#?zmQ@oPmc-*}h2$>8q(`~3grhOb=BE&a8=r~lRbzY5>9&Tfem
z>dD`EE_9-W>BdtJTISEUXL-x_`)&M+Ch0X_m)}Z$m(Kkw(u%R}K--c!F76vMJ{K)r
z;6K&B<NSeZt{Y7>PD)y}Pg$_PZPi)(1M@n({k|V%_FZu=e7@hCqH~I~k7b4hs+mq_
zUgX$NGwt|Zjct)<kE+aFR@1YpB>kYzsy>Oi*2_Q3vG^@7&g+pfke@%LNPo}T<d0U$
zGerzSkNEYLc(DGyeCK@G`wgAhx(^<IUbLot@|HO!D{}pGZOu*Fua!M(Fp|Dhb4prK
z>Yi)NsYCA+=T)vwm*Z~<IDPo@hCgB_AAhV;oaVykzV7b!q}?|~bPfy8y0E}KEH1=!
z*^jR(C44L|SWZ6Pt=+A#vvNjE7Egc07xi|Dxa;>auKDMrNnQ5jz3_EP)|dFxj(0M+
zCs-*yvMGw)u<H`X{CfvdKP(Y7(=^)oE9i9N{#<W%t7orw=)L4nytDSWQS>XDh5O#t
zaa}oi;=qJk?q!c3p1HP4d$)UZbe--q(-(IaJ)Sl7-G<f5EKW;geyrtqaZK*L<b#4m
zYvo-Ft{LuZS;HMsU31N`FFnyDe8+)RyClQkPUb3{x~Z`8!>boRt|vb*s(BEouxPW!
z3AN{&l^pLW?M(@(Kd<$s>Akg^=!yixn+7{>TdbTabNpE4)X$YXLEFo>a&G;z<k7?o
zRyBdbnM-GcCr_P}nCU&WvBpY3HmGB5mdea)9HPon)$S9ox5@dH8c$mm{Gq>oOMcI-
zFwuj?^)ZPGFMq6=5N3OAW?Y(JLjRhHAJVqj%q~jYVlh27{A|s<rR#Lx*v`Bd=3FSH
z9cj98rHu03j1yURuEYiY^!d~=*>vX@_jRu(sJ(Fuuxm~X)h|hsxHN}V<DG@0&SilW
zo>D!1^TVqQQs#=iJQ>RFJmc;=uU-$mZj-}*48EPa;r8g`<^3!bPl6Y1+U6UtvTUjL
za$VU6uDj#)H*hImwhePJY-6kZAF(q;AoTo;oa})3-1isERwO)i*Oa;1)t4hEs3mGU
zC0cJqgC)<66-8Cmhw|sG{UB4F@Z(O#vC5YH4+G7nyxsckK#<nQ;GjUwty`C`-VkET
z)VTCrTH)Q@_46aL{tG8BH!J=;?d>k#YagG#3*+$@yn1P&Q`nAOnY~%9xh9jk&SXSb
zeopI>ddSJsaQ$^bSZqRI<(ErcITj}mN#~m{IXqc)?c-$UwCo+cg;80uTg2ACIQ(ei
zv_B61T(bNYorTQT3PM;?&uL8(&^FU}`!)KJ)=8b?bE6Y87WPLvtrmE{e5uhpwjA%s
z3n7NlR~AfVvNdj(PUW^LQ}b6pWb`3}L)hoI{EiC+>>YmQm)uWigdGn(`c&uOj+H${
z-c#ncIK1sT->R{BZK`_qpAVOegV!XUnp=G7TZVM-Jfm!n!$H4Nil60Xo&A$zpTW2=
zul3WPoU3M)VQ-h85lY>7y^y)AH>fuIdEJM3T|brXMx?8KjcdC0p@LoF?aigNze4XX
zWOP3Lee3JyEqfPDd|sTn$Y{Ce2Dj%kILmYw{%&B`2^LA#edLrSnWA{IS?1#fkxIKw
zX*WyU#6Kx{b2E8}@H<_d&a`HQ&o91}R<iBA-(G0{?+Z?NxldPplF7ks#){^$x%W9X
zR&71@W#{H|54OyoWGeG`;UeLf<W@6-RTJi4NdC2D#<v?UEO)x<KWvh9D4oK(o;TLZ
za?|P7;J1IXvl-v0O_}v)>YK{`&;@p}yUn(+_glX4zWS^_bW6;>gIgD#mtL9mQh{ml
z-I6)WW3R8?I_d7RvmY6=7M9<Bqc(fBT=lQz%(B~}l5^&(H0ZMH`dF?nX{^65x8hgj
z?4Z{{9d&w)yIuxL8XHP;*V<)jcg@Lv#JYXLqWur+7fyLHb>DLRCsn^%9KOCynBVvD
z;n^xP?w4y)Q(`5)9+;d`GwIK47AARbb6(Zo?-{3xUo^EZ6#laR|Ah7}X+OEv1!RYr
zp9oZ2|I9+~`m*T`yVve0yy-iAwTH#I%m10!1s+5#sG42wwfx1l|CP#dd%d53w_`~*
zRXwr#?vvg1D>J7pUmB7V_)sk~GST5#2fOv7Eb+%C@wH*=qgR}lySmRx#n0@>v(`+H
z$bXMpH6QeDd}Dk|$@t-uY3$~Szvt{;R%86B#_a8iWd@TQw|n0aE}iw%;>q7<$K=Y@
zl_c)n&!{&saJew4)<u_rZLR0!Mh(FmO!L=sn~UmJo)dj#w%cSuMdXnWo0wL6zfQ>3
z*z$C<;l>%)e!k(^w0&;DQ&mOZ)l7M*^Vy!fpLjg}-9pdT-COtin!KH@=3cu~)YomD
z`-O^7u~Vi0L{IQL-O4NQJveVc?A?;nUlyk=?ep-}F4_A1*+iSQll@-q@wNZ<_z$zj
zDUmgcU$4HnX+h$|PnlNNUiDZuTz$z9@#1O3ydAIfyM0tYI2u*u32&Vl>btBp^2~}g
zD`iEuhKEetS$cD2SMCB&-N?C_uWfgSE0xRiMQL-~U#9Fn-N^a1&+)b8vd0e3vkANY
zQz+p^g-!9v$ZflBZJlTPI5yJg0CQ1=#q-o>u68CJ-V()6vV^C`PP_4Mg3-U$w!XhV
zmpt4pt$tebmQuKh-c13=Pt(3AIZrJ;{ZMzw)X9rCe~GAEE53#0uk6ul_oWmM-_e;|
zYEo5R^C7L|$CKsFhcCW1XFnhJ$4F|WM@>+MX7g!_x?9pyv(Bqeny7L^{PD}EOVSm`
zIXRZ!^?EQp$K-tXDlgUW%Y9E7chA}Kc<19c7wQgrsd1ff^l;R!pIfZpGP!&8&KXy<
zS`|JiO;>uf_RSo7`=2vE7u}P2FTZ!=rRr@>S65nU2_Nsy{XFH3vU%Fp!~Rao3vVwx
zAa!Ni!|eBhYZ^B!tBv1w{;W_$TuZK!>-G6d(og%&Jo;6Yb@|D8Hwy0VIy9B5cAG!D
z!Zr2IyIv{_OXO~~sNVVJ-`4N9c+=#W4f5T}euw|_dW)COJ|p?X;c8fgsI=w3tvq|G
zUf+6oG5qS;uyEOoQmLye3NnurxwqZWxzDsw#;N@Ot@vxcc7AV?lK*+REC1Pdr<Cc9
zADhw94-qpJLT8nFi9YDo{AsEE(s-|k%$d;F1{&GVAAP$cGC$X1=YjL*(v12Xr@Gl?
z&M!={Hk)_ssj8gz`Pr#ff7W0A)ll(HXWh@1pEp(-+8&<K)uOP~f7=JaOJyJASaJ$?
zuCl$OzvtJx+Y7#beO%b}HSu%K#mrBW4t~-2+O^I{Ed8{#VYk}nG?U)+%xwyrTG_0=
zt@CbN&G}(+Z$P@Y`zq_8g3Ou(k>aqP$2vE{?|x*udyO%8PoPg#!|kS9t2Z9=kzSs~
zU1VH(Y~|iFx2w1O-lfBEEG76r@;5f=)eAT6E=s()dez=p6|#{Gj|xLmc#jpYp8H2n
z@owRoS68N<H@>94<LJc1Cc!(*C(kWT`z;cB`i4aCn$%Y>F0B$>@1GSldHR74&kYAR
zsq(Ds<>@-jctYvMzr*JDZS#V^yCs|Zi8(bS9?w{RzLWLIYQKLWEpL7;X<jw6O8;<8
z_mSD>*UmS}2s^vp(jp_TOyKtH^CE|xp3h$KucT#SmWtC_HUFyOFKsdRT~c1{WK6wM
zsTa6^(o>~kr_1Frs=4o47)w}=$~@yd^PWTQ-^(AG@}3;uB5fY4U#N`{y{Lb2eXhpy
zQrq=q<z;&M`pP#$LZ+l!U;dGAy}~cdT4bt3da0qmdT2@9`AxZbzYJuzbD3;O2#(>{
zw9xSVw1u?>Y)mO^#%}BkC)mpBPyRWuWP+r|QVZd5-3kUq)6aXn^b3*&jQRDv{dOL{
z946lAagJquwVj>*RQA;Y+PVo2yU$#2lkyhox6psy(4FaAm{W0X-iC?Ze&57Q?zy?I
z-oNR?-{Tg)`U}5kRNYv(RCLL<u4xR<P9A<J@BjXE{jRCIuguPyw(3lXQ?vAhy-A{n
zn&)ifn*3XAUqG3I)ynIkejST4I%l=4yr~s<N+_%|&hysYlc`Bfm15W5G)+{$*VFrA
z=Jd?KWnT~74hnU)e#Eu&tEWW!wnLxdT28!-j6e9G%X?m7kwd{HF4?0$q<!w>U)g=X
zLahF=Y+`uR8P~@4&zsDpG?mvbe&87<%6xCi^zVk-7~On+cd<w=dv7i}BfXK?@6YUI
zGw*ZA_MT(zUCs3PtL6KogX)u3P1w)*RzGq=iE{E3VN=aH7A{Lm4_oK)8qABabXh*Z
zZt{uqn#WA!ulr6CYfng8z4+Fz-Ba>R!>Xo><QXx|>i1Et=3ksC^Xi&P!(<kLHJPto
z{g~U%exbfPj$bt~GpehX`Hbzn0^Rvvvlm_6=^A{}>DxlBIeGak@vG<N^6^Z&ak}}g
zf>VhR^Ta#Wa}}BSG^!@~{eI}eKC>t`$l&nK49D3)f*qMv*QUhq&Ix5QVk~HyImPQ^
zc&UnMaX<jG(DnG6R)@=ZElVtBG+UI<`&)eXXxTJZ!=z{>*}8JRC%;0^u-^?{D_FlJ
z;8>HH-@`uZm0f{09|Rw|ZGLGkdF$`=yM2$sj?3<13wWsc;XB{WO*efGKKE?VSsh}S
zH9242?#N=TLno7eF7>-zn59q`&+@x}|L#qHinW;MSIEwN9X|1`g{euK<XmnM;g$>6
z8aL|lX+M8fqRSWcdTI27MyJK)4m-k5Ct5l<{7tmop)B|zg<CA?#MC7c&f=GhbuNE?
zuAa{~Z`+KXDKpMhHbf<=Zl5x1R^z*i4Lz6liBGUHyl5F(Zu=z4ahlRKyPEL5CAZ2~
zCLi^<Z&&#{>3^`>tykxt%dF}?vb*m~w{O~Xr_^b?*9*5i*KbG*WnwB_Gp}m*exv)s
zy+;IjPtD-{aoDhWTD0dBj^4Aqc3rOh%*wl_%EbEe+s}BjPdvso)%5(OUE+(TNnLW(
zD@lAG`2Weo)5>!;CN?&2$>+0UEtuFO@=f==ddIe?30JpY>T<U9s`h$(?%;a+<YUZj
zPYMK0x2)H`-SwzPXHMerw5;#4{D(b`YahEUwj{!l{od=v%D)Q3-}rLrOubw*t18>+
zhauYn#>0G<-b^=J!T0cO<Du<FP6=mZKds3)zHqsmEQ^Cx^{kE!0<v;v^(wlfh4i2P
z+L9@LokL^s1~#`D0t>Er=Qpj){?yKMHL*Q}@yEpDg&XAZFRyOjwQ<s{TNjtT(BgGF
z9G+Muw4n9a+Xp+1k_BI1655jLS7E>9M)>Rxak6_^Mg3<VO6hO<5gr>5_I!tqT~fe_
zB)7(9U4=FOCZ6vKwld(K@a<Wp@m!vX3~QEOJ8AW5&(}3wdvus~i$0uxZ_E9e4<^5S
z={2wUb6f0#$Y8z=cMlk8bMAj0r?=$qoAnPnRoR|YONwi64n4=37JcfEP}~+HPLcUf
zPLv(t4S&60x`{^cwgY?4ToqmVT}C$dW~;{*|M_K>-XFKCxt2;rZ`<=N=>8IciU7X;
zzLVXFyE99biw+r9ww;aPZF^L2kj@}dwm<vc4{na$+-H~gE;G#CvUy*$mF{wlC^!G(
z;zvt=PP^^ergh)Ma@P9dO!Mk?{q1Tuv;DJX`^0=cbcB75^Ua;yE?Gw<c&7{6GC6<U
zr++wHg6G)5a<{z7FH3JZ^5=^*HMkc2JGJ}p_0O{#C2yM^+@W|}c&Ts9`m7y$bu;Qs
z%-`84imR>@lll88x8uJ_D%0jo4~v?Nj5(&S<yq4B^6$6Vg}c(MbAC>1(NSmEv`R4R
zTq?tvJvx)plvd~+*nXd9;Y7wX&X6y6uJ?aD#5G}!#mNnaClr4;`Qy2>jKAExM`35m
zr%jh!tiNS8x3Jig895Ihlvfr$5tG|+?~~!<vL-=8-R%-Ff%D#<-f<+!>5Wphv6=Og
z%jc4o=86}+SRVZJkBXW2=^(MJw++*bN-i1C_g72M_2c?-{rnTTuOUlWHa==@YBl0)
zZ~t<&?yrXX|J9*(D_42`U0HG0z)GUwoO}7?zb)tNf@TYDah<o|c;oqvY4*2G_BqtC
zzna)t{v=w=f|Ic_Mr3x9$ByFVvZc~9O15dd`?^A)bzWHIhF@6>JEU(!=ACk0u|_J?
zo1JrQt=df&*M|1PJhA^i#fE=8d#kbM)0$$pZkrWy-?^{UIx$WUIC6*exlOh72H}=<
zd@tgP#dcTk*zPiK>b4Dz2hDazX}+$QoAv+NqInkSEua6`>uxzP@2I8Nm5mxs*Y!@_
zistnZI<1~wx~3uX-&DP+oM$6%URj}fB#Y5U<m;as>#WlpgI-VlVt9_l==8E&p{kls
zE$KJ=)>f?Ii94sAlGYgMaVBKr?K8g0Gw1q9P55fJ-(tbRhmTa$f@^)AFYzl7+F`eB
z;~^uhjv(%ayWuf@o4)kdElOUYp_Rog`Q*;s%0_kfIe+=LU1YO!`dwMv)Uu_pDz7yp
z_IiTAA6K0d-xSZAUens(*M4ko(oWu`a?W;*TNv&v7yg|2{lUW470G*zy(cc-HG^F#
zHz8typT)YY2lwx8Qug>UrKEMKS7b|YTm1QgEsoQ>GSVv6u6p-1`o^}e9{2d(-kP4$
zXxYa-KhUgw>3Y}I-#t>F9Qd;=e&r{rIlI{X*mqq!>d+K-_mi%)nat6X{I2Zj@z)qx
z76krgY-LeRx#iWkU3iJ#DRqa1TS}+j+uHIYwDR)uS4Xz?sN8Lmj@FUbnBv$v+va1+
zB((_Jd9U`a;5fNy*{|-{FB-G^+J(XwR|YN(-@8vR=wFAH`_4lq7yQH4O?$P^@k8p@
zb=yN$9J=*}HB2kWNONnL^Q3l(<kPF)oRVInr(ko*E%B!1<|DVf3$GR4y=SxWi&%i#
z8GYuriz5<xHNUY2h98-FVC%)}#zqt7DSfVr4`qAbA@M@SX-b>G`?4FK-)g$Pn-=+Q
z)xBNf(>@(|T>9(5?6YATmh3lIzwj_v>;B|O?VZ~CbL#XMlOH>Zaz)E6eY}Fdta4*U
z&>3-C?RQ5buf(VA+!D^-b7l2yy?E0PY`Y(rN7`t0ub4YK&nT%`dbi$OVcRRIit}Am
z^kywrWpG+%p(K8C*9*V?@(X5;_g_VsW!YD|zcYSs6U@6YaAUEL)1BhmXCfx2OW5|L
ziZ6&>arh`>>n}g4fP+i#b7;?dacI+Fk&@<34rfie&-V!Z)DF*ku-4Z|n0sAL(%WzR
z^B*eRt1tWU<mblwvzKU@UYs4acA3{P$2;{#?B_Q2UzL7W{6}r}(w|M<Rwb{~8w&r4
zPGG&8d)?*Rl(pOa6FQ6MS}uG(;cL(#wr9lx5qsMuZ>{=RH*s}x+nWa0A56<!jE<}k
z>aKXXXmO+Wwwtpz{8jpXS8f4kdE>pdhm3!>Zj&{g!d|_tH%&4>?E3}{)$>Qr{nOw7
zVfy0v|FZAbOb*}4!q>;>aqafB+9NG*cA1o|xcW_O>lJ>%V&9syk5#ApMeV$Qs>~I8
z)HvgmTDn-{Vg3}OO|SSkCJBV?Y>W(1ej!(VomJoLD9>GYze9)rUYvZ`dELZ~`5r|k
z2mTv~pZ)f0uiO7GE4r3DZTHQt>R)(~J9A&SX|m)(`Mq@?Z=L$~+G=iXwd)+^w%pZ!
zg=J!nFW{_Z^R0TkVEyU7AHp;C?0U8>XUiqm-(5x5?&<%~y>al}`zuHLGOyomy+6l1
z^Gw=)HF5RbhmY?ty|PX!Z_&|ntG6vm-?8$k`|j1ky|NNHZ|=AS-*&kn!F4HbqUmSf
zvZ+_YuUjr|D2O@nL2_52ka<s!#0Qz&{SWIWN1l@t(C)u(`hJ<4(t_k0+g@K3V_7^W
z>$s42`i6FE-_Umpg!yBuUp`5`a3+vt(~3?Fwv$HHb8j)%xJ`Am5TDn$@Q=Bn5$~->
z8E+k5^R?SNzuWvh%(A^ItX)px#^19su0>g2vu8)Bwngafe!?xGdT_4h&+ozirf2;t
zyKddJfAJUTl6AqqYx{R|eU+-cb2?{QM$13O2kE8pR%VB$2Yf0$9N+e9S4p|{+Pl~O
z20Zz!Hb+o3>a7W%_B@t8;U~Oux4f5z=8Cs3-+n>GZ0b_Wn;z;(v(kcIM=ZM9wX!Gw
z%Em`p2g6^Tvfq||%-iP(kC~F1?eviF1y{DR_N1}0amKJQO_=Nzz4%wm{HJEEQUa>;
zH!adzVPK+KF>$hD#XNHf56_hzC4T3!znplm^qfWL&zRlo)2tuFZ(01+^4QA03lnyB
zM}FH`)i!(m;^-wi7-v5SFJS*;<7aO+M=wopollJQON%QGo6bp!FKnHgT5a63qR(!#
zjQ^`I?iGs<FW$hxcPB&Os<-3s$f+NX=qCCZS1p*kVfQ|n-t9hTZe>aRIDSrNQBe4d
z@Si6iN8f)O6O*?n;gGV7U%@p_yTw-+WV@{&Y}$AJ`*-$DCAPoJQa<eWd&;-uaI(hL
z<zgODVKG|*vnIdTdLTi;&-Cc;Ia2#gYvzkPH`Ik)*?OYAv`}-?T1L%zx(m+apOpF=
zJ(<be@&Bd=JsC_9;;e_VnP0c`GYiRtTa_-%jV_$6zfnYWp2D&k<`#}B#dQbE7_UZ#
zREOA9{<ycZ>Go0G__eL_3{B|^j)eSPziP3=vdn-5hh+BNH=SGTq8pp?QJ~z_)pE^w
z&26Wci+=3;dgGq<{jjF;H(|$XGY;_IVwk6^-{$dh`Mz~kMk_xq&IpriN!<Rq-=J>K
z?!X84tD>2N&#LSw`P6>*vfq<rasHbJ%)edhJ7Kz~T>133V#knBpNO?z8bd=5{^m5~
zJN~S8$%O!p=~k(l4-(8Ib2sqKi<zR9eQ8Q)=pA<d6BAuc(y|{WGV$wfy>_C)Uun7V
z5)<VJ`<Srn8i8{dEYv?0Omf#e_sB@GT;;-_TmNp_nU=(Fau<2MNjPrmyMrfMr*7k0
z!2ezAdaF@eN><1fr4wc+4}Q;+(ee@szqIoD5|6}}n>J|$@9uhZ*Y)&Ul?CAwB4hbe
zGxff-F1i1?Q}svw3-PvdM`|oPS0vB4G}EB5|I+Gj6H|rb!c|+Af7#N<KV{(>u^kT!
zq^=j5P03+!^A{=Z)JqYXSG4eiM=R${&h(e8_qQ?>&XFuEKO=Ir{LKUDHqpTDtmww%
ze3|pk->0tIcC69lHD{4?l1<IWSNd^Ydw%b^H&Z6s_m;`dH1UkmWrtQxj?{LpuUOLj
z_WaV&4eYv_OE-qM?Uj%JpBdLBzv%bg$^U<Tcv!OffB*lRuO5e1{JzLvQuz9dyu6*u
z-`{`N@?UM%t$bhjT8@$F@4xo7FY505u5sluuq)BIrNn$pbKP{O-(Pd>j%Hok$h~IQ
zyv;Ax=*+6*_n))ii^hu;f4&?3>)xBe{&9U~sJP&YSmnUEVkVb%9Y68nT5kPOE$cT+
zqhET;`#HW6?U1`=@apsjmMbZb4b$XTxr9CUu)JsK&$O6-A|Lmf<U>&kZVy~uY3y!E
zPMg!Fld$=V)>i*125i@>o04xw$L8cb+H|u;^ipQzu2;o6%v+rz9cG_f`s9&niSbFJ
znRh(hKc>#yaVTEQCR6B!d+?oeHAmB`vtP|E*=`xqaJY2EZjEAzo$YT`oVg$VYx)uA
z++Qcz^hBz!<dH?|C4=_JwLTGSi|(~Y`@S|>d^l2e&b8F_teNR=PaRIod%W6U`S#zn
zOb<W2T)mv#es8s0*<R-5+KaXsuGjdx`-X8lN8)$K{GcR{vb|dB7sB_}e&cy3Gxc~)
z&|39A>7(VxScBFmg$K!Ye`cM_skQdX2`-M1+YH9H7BDVLTU9K(_oIC0>nk4vMJ^`1
zTwnL3XYrgZYA5XW+?n%b@uj}<+bsUFo9|~XeZDO}c}<RC{D#vl2iDic{k%2RZ9!cW
z<L+mLAtK9eP29ov$>&|U<&8J{n)@?dcQ7Aa-+IIU&Tq7902-569xJgjFbMK75WEHe
zbP8v3Y7ywV&86YFpo2I6t&1-#;5y-!da&@@(qmyd1)FtWobJ*)940Z(A#lpsX-ce<
zx)$^PeQ*8h>L#HpcfTku=r2Dn+h5MFFaF{7@9_F__X|!fN&I}f#q)IVxi4Jnik-ga
z?Bfx?$GRpoE^FWI=m<T%>BWCOGrjx9bI)k8ipraLoKw>?c&1G}^Eqg(QOBY!8(Px>
zS!_;E-R7_)WLm_!B_H>kO!?IKbe5#a>ePfHw~Mx{s}CssiAw!BYvDsF4ZWQSQbCgn
z1KTp*R`RYfdh4~hEcNu9)3O50<twHiimmwm@vrZee^1l?{`z+Jyf*)b)rWWvPdHh<
zD&<sp?t=V}Z(=q@&s-Jkx^C(kzgsKreOc6)CB5Ng_}Y`Z1S@<b!rY4*Up`rp(BN=J
zH=xn-D&rC_=dfq0G7<^vbS87AwM9&qJFM`SU*_{P1LwPapYI;nYR6=7O7gwLvUrYw
z%&9kfZtnHEARQ%`ZQ9R$S|*_DxS!VcR!)Ycyz?f%U|Ox5%%`V3e<t%OwtbFA=Syrg
zuzh2BH~ilUg<}evLaYwoPi3CIA~Hh0^7#A0-6tMiZSSwxTanMR;lqpcJ^L8=?!3FW
zt+-cGWlP^mTg5*Yc6_yY6(qY-CiLh1P+wP<_h-2B|BEg!OV)YzSg+==@78;H7r)Kt
zI&+@&;idS4Y0_7kT7N%0UmyEpZHoD%7_&*I{Wj&Ooc1fa>aotMGgIZ*{i^s|3xvhQ
zcPDPy81$&Kpk8TR(XNE|B?oWaVEXWUx71Ijb-lYktm~cDUGOpX!WF(>S}|9XZodsx
z6zbS`<W8z;?r%|}#HcCj`pc#?J@{n2th(wv=b8UMVp;AhA2~hqdDiqy_7_<pM^(gB
zeT<b(OQv{jUe#l@d|i&nI<Ds$dWz3OIOQ&@@#`^9486EeVD;n8k1v{Ejl8>Dz5eXw
z5aTo*F@s~@bA))zzHaW^e)P(&N3Z+ti=EjLdnPO{^{BARckTamx(DqXem$CWTVs}#
z+9k;|@rSHcXP2$*{vkDa>QP_c-RCpgrkq%j`SXNG<|+9ZoSu_>K0ZoMUu`GzGRb6#
zfSHxRUGXmp#<vyUIegTfdcUspV1Dz$3!y(w{OvsV$xyb!j%~M9_{GBb%!!TV{!ukA
z^|@B+Dm`-W3eNrhy|m=szgrVrxOHPsu`xunJ&)L~t9n)O#c!=Z(Zi7ju5pHce&7BY
zE_<oA`1xM%FQ!~q++FK)y53$sF5MukDl`A>t3}^?RMz|}EK{mmGizy`_%AsPmHHP|
zK}t*SZPpb1VbpWVfT3^w(^o%U*4+C3WY@0sYHZ(M1kN#dHJx|%p+G_RPbWVnI<`4k
zo#dJ$7-95MpeX6%RF8ev_}<-g5_MUvEO$k+OsaV8ehH7co_U7G8OG0+G_Lwxu<e4*
znHY=U^suFAX4kBFtyFee-@CGY#g*fW%F6m@Z7q!BE31r}8ne~1?E8$>jm^(~^?&`P
zwYj=iRb**XiD=v6^IU%xXCD9mP42SAd(Bflol``fZZBDFzyG8Eg{Vh=$~3InoDL~k
zf3yGLyy`?mP1m`kiFP6@vsPd3$g-#rSN{I$AG?o<?NOPtu4m8kJ;{3~^4##a@a1c1
zJ>^0k_ODF@3xZFFJxH5pEc;z!_O*W}`hyQnG&|L)=8<Jl>z+5Q$0KLT3iCJnlFx^6
zZq9wfx%MclxTpI%fA;4U&FcIWQpaU{9u+K|xOtiL2jR2>YR_h0<xbI^<M3?zzvSMU
zoPCb`eUGvhKmW1b{{^4Wu8+5Lm#uv;`BBlW);`DFxHa20&oqDcKe^(4JnG3OwF~~`
zKWAlNm>|Hwpi1Cu<J6p_qS9i$g371i5A$xD3H*D%{J|{7E#c7_K|B&X6%o&>as$@$
zZpeB2AcaXc&@6hEh=<n3=r4`mq^dX7E>ZFBx}3sn_U1Ut5y6v>KknZBzHhnmr^`P#
zZ(qFAW5=eNl4(UxUDS3+PQE-xHQUarbKaM}6Cuy7mBX^#|NWRd$HubK>d^V?Pkb!(
zHf9v%&Jd3JS~c^cw9xU$hg^pr&*<R2CX?uuDejW9{`-rIi!U!NZBtEbO1UMl{aK3I
z^koMo<hI-qoIBAazesWCM!{`gs-~`66VQ1%>Q<H0`}=qF#IsyysEU7`qC0KpMb7Qj
ziifplT=Wt(J@9<hjPCC>QFALa8m>n?_scobp5T7w%&D-Xz%38Mv^A$~{j&4i&Mw{4
zKjMz$f4deYwEpl1)%yq6^~AV{@1J-6(aY|eU!LAv{rs`q!Ql5#UPVc)HRJHxTYb%^
z)Ma|>giPHpd*x#o)XVqA=}$a!>(ueBGyg`X@t<n$e-&_rQQ?r#(V31BDo0L!ep%u%
ztyOvDvxtlL&hE6|e5=l`)==eh_jTu_nL>Uw4m<}NMYvR()^blzHa^s%5TDFDPvQ8*
zlZ9J)s~lTBPPPQhRM{f4+=h8IOUco~`$aQ(PrQi!<fR>_^o?KPz#_*j)1^(kZwTtn
zd|D{m%K39gze7Af6T7Kkm(B~LbK$f2IOBwPOLC5$p6K;+Q^eHw*EU<8bPeK5Z9KZB
zCOxch-lr*XwYQiLC}}V0&Yz(<lbM0rs_O8PCE>9%awqnG;gp?x^lE{A(T@ws9WpQW
zmmfbFYklHzLr4C^8DIVh&$rtl-zTy6WaX&<|4Hmy3V&2Qzvgjg|LSkS>mS|bPtUKP
z)9aaN+3C!6#Juh40_MV5Dg{QbxHWQ2{~5FMt^OWyTBZ5l1gm|26wYdudPp?A4f;@W
z-tNp%kAlNz^!!>kHnuwN&-BUAmTeT|E<CZ#@YAjo$;sRc?}$3RvXnkiEqJ!Il>5rT
z)oq7w9lO9`nEQH5zmUj%vFY9uS?BsczWj4e)!Y&<X}+By$*VLS7&D$c{H#0OV$*z;
zeOvtN5-u@$eR!{7e!zUwiH|9^pS~$(+}q(<c_*Rp&V?(_xnfS#?)vdqi939!-QJKA
zgLf`cQ_pg{oe+Ecrnlg=o$g$X9kTbQ>CNq5l7Ffzpi?Kv??ub6%kK_EicapB<JA&w
zF=Ymm>V<V*c}+C-wI1D9P<8Xg1B(Vnh6n3~(lXf{dHSuzuJ=FOaV<buVD6lqr70GZ
z|1F(AT~y_}g7@65MiDRX2E6B}(0L;LbnB(naqT%fwuZIkzEi*bf0pOe_J4^=f6Zln
z>d5Z9z1@1EiK~pvz55&19$jk1d34F)S-a}OzL~xGX+CpO@|`b{feB~gl}?+*%wHV&
zV=v$S*lj$vx-GM|Y_XsH_tUHAKW)}1q`Y1FdGqJU8PAX1nJ2%cvbWUX+~QAH+cjJt
zPx$1re2+i(^xl0ROYcbJzG;z~=RK|9)`}H-q`CgwTl~-Kzs}abhWwMFoqA6+E;;+@
z;)!=Tvgdcth->cr)4TlAK1R>()cY5_e_wt2bo#y3KW?A@*Y>i{uSZ*wKgmGi&a$Lh
zhwXN<CWk{OzB=O_^R9@8ea89E>#d%iW2-J)@pgevQT^QQf>(mOaw{yP7fgGf<bTNT
zfR=~2tKQE=ruI49vP`jCzB)_Tm^JS53cvY$^X^%k6VF_5o-Vv^{hJ(jxhpsFZcbg3
z9Gx=rhS^JQ8{S#UMYDD=?LEu4UG8nkLmS>N!M~Qhxipd8dt1wcUI*<hPjoFeZ2l9r
zJ6DyJp-Q6Ag)t|u`gSXSPvP(E#k*EUiC^8YivNAZBdgfJsTSYMUH@&V4ti^QKXFm!
zbK_rzBJwA%taAAN@1*mxT#m`lN<GXpycPbbylK4uC~MKwcagcN>OU8VK0g#P#k+ag
zm5nQ&s;ysn=W6-XaE2{`rvlmJudv5nOB4`^H;yb=zx{q-i`(SK+5Qm=5137TFt6;T
z!IPNVOzZ!0U&*~Ma`D~4d;3ejE>PxpG^yr|xy+QN4;Oc<x32#@+lH^UWVdT3>%W6r
z+`pwPm8;?Si*`m<ho?|1GaCa#HXj3nCZU=lw>Y^dv!En3Pp_bIZFnH4NnUq-{exNT
zksWJOkH$Sac$n*W^yX!r6LuWfr67>;GRJVD$J8Z{I9&h#ey4G2+MF$S4}VFBc=GYx
zkB__GuTU;4F8%fWNz4)jUY~PD6T;T8zR;`={%F#E^7RiDi=^UE)2N)H({c0veBq9M
zcEHQPYZH&$!hq1u*E3k-*bYXmo}_wm*S4)~Dv68MOxf1sy;5hplczAt`nbKjF1-p&
zNsvfiS|K!P?bI~2=Tb(~R`J~6dL!nr$x`p^jXytT=z2}g3XGKT361Pz+R}M3RN#li
zsUxD>E5B#W_Bz4)xJ|b<s!*o<=ZaNlpBCK7T`jQsZj1SwXZm+vTW6H9-R(N}C}zzx
zU)HyKX2)DzbmCF%x!v`5CskS-oL8)^=%0ODcI{20xVk-2DxbG^|J=Q~+kQFY;pN<1
zp8_*fW#8R9nPhKb@V73;cEkAvOr0(stZ#VycW+c{IOH(<wBRR)1)OsqdPPhV^I)?r
zQ;#$YJ-qFJ7H>tI<Yvp`%qI^zRNrBnnH)50;f8y$)6dP2bnP~8*rUm{?AjKQjazn}
z>Uqq(J*+!4w^3$otIM^38@GBS`>N_q7G<ZDa6Vc0gx{g>lw;1au<sM1%x*nXIvcxZ
z%Y$PJ(pQ#rzV9uczEUG^`yRo5i`eitUw$cPC`oOY!pHy9EG;^*IA%9@uf(S<XII`<
zoc(iyqd>yHoYj?6@62{Nv1NtfZo%u)#;#m*xRdjHua*nW{&TJVdx^j#@sq~MCH2+U
zr4(425-TmG&0Y8}c`LLVIq&Q{^y6O3#KWT9BI!L(Z~fZoDe?9?Z}O((9$`PV?`chc
zuE&@^oYA>^?$>!*@sY1{Cn|59w)dn$f%}EkKfb%n3S^g0dm<)O!nsN1;~Bq@+|{@G
zctl<so^F}8r$y7*<Jg)byJp#~HeuI3_x|#d#p<#OyuT8^<v7-q?%lC#-yHqCykj~x
zlaGAxTpG%COyK>+ls7kSEpxh>ILAVZXY#`Z&6dJyPpz7D?i{sEk`Hj5u&~X0$;u$t
zS;ab244aL7KXP0T+3`d&a$2D8501Vghm>LqHy56d51*?i9cj{GtbX?1Gv2<3F3|xg
zi#8N&J+a|X{oPFMS35T@d#)ecCl|d`e#4v%elizNTF+x%&wcs<XPrx&aq#-<H-dcb
zsLydO`Np*9dAj)fHj~2F^Cuit6#6V(a_jcWy))A%=d*p>>-4BX>p|z%1xFRFzpY+u
zJ2j_|Bh^#!iSs7CAIB<`7T)lSym9&Zho@O3Ulj9pZ(0#m{&1gMP-|Di<QM!~C9Gw)
z&-vB8@rRIbzkFrj;f(9aZm&NWFBK4v$;;Z;sNZ@1;?6@^+8aF=|2jKIRIK_D`=S>U
zE*w&rsWV-(=T6d^kj%yZ7<WEYJg{Z<jBu5IGfp3g(Y+t1e{YUj`1I+|PoBML-+eQE
z`zvn=*+=)U6|(E*o+}SxU&VZZ|H%97)8VWS+7z?D*J%ZL`<Be-J=k(#<}N1Nu1EXq
z>zlsVI5fNcXRm8Mu>Hk!m#yAEn3by3baNcGZ*+5xnq>US%<gE*4s$2@ixmmtaaW#l
zar>5DF;)>a{pKO^Mt9Afi&IxGI@reH=j8W-{b=(8uJ&_va>2dxetF$_w061BOXh&p
zDN?4#%WuBZY|Xi8X8rQv^{agEcFO*_%UP%`vitCqivDVr<ySgGJ#~*>*3b=D`7inU
zE7z)PKXx(KX|nBgxi}$Y_ieAs*K}`|{Nfj#_V(YaPra-D#+k+Uwlx3k+0Z(%Zb#gU
z%?Gx}iC5{VT6{|}^$%Foc7wOS{QCm?UHLw{tJN-D`oH+vm*bDDc2@p=R#o^)N&Uv$
zfX9<`uM53b3*L5UUz7H<U2Oes-U)GczB%3J&Erz}RVUtF-nKBRLd5z4TS5gpU*o@N
z$M3eqohn!GpSwW#x9{`!3eEE*Z64<BOS^vh+qLLBUz0@@+<(g`XGN>CS3f;;;9a)j
zySXnOX|{%m94cP=!pp<_=)L2o<IUH&w(8xGvb*Z^Sl%HdklRA*`Kc95>$mlMJNRPr
zil&e?(x0~YYrXT-yZgyVs8?=ko7Fy}&d+AnFS@Pk-0mOT`1u2`g7xIxhd1pC5NfJt
zMD25&JRq9QAkDz=CxY;WXX$yRdIgnNZEhFcJ~rw7uP)7>j8D26Tuv3{%uRizvSrTV
zuGDPh^tV&ixV9ab;KIUWA>knO_7nTt{5R8c%g^%|?6|P#?VFWRQ*{N4U(S2^@}>2U
zj@USx`se$4m?nBWoY$(PxyV)Jlkm6XW6e_w)bCxqr)=iE*;h_CoOQNL@BE#U7oTj|
z8_Bs%%*Z!FBhPhCTK0@HTnDfBa{m8(-yprHr+8m-x~F2&i!+-|p1V#_tFG?0i8a0-
zKgD$>_x<#XQop#4O;*v(=(uzH_Wk?&Ph7sOAu?(0;@=t*b0$7}^E`b2Muph)K%F8^
zW2c<L$1mKjoRvFs_qMUa^TwY$G$t?bxEwL7ZOgAIACpAgi$Blc{_HvJvyMNr;_8J*
z)w(CCKAyDqqV-3c^Er(j%?(zvg}c^BUG6c<{1tckv3`<q(tgj0@nQ?J0v~fe+0*mr
z!s_yf$qt8StZcjK#bW+EQzPL&_qSu!pMM`+Y5)89%Qw?EhuhD8WB9|c`@>f^lZMS-
zcj^4F5z|+WWO&+b;_>)c%e7VKuNFjXyYRYJj`iqlUp1-CE=AH$Go5-CrO&(O`|Uz*
z^{MYJI;~NEloJkeupPL#xiVyf0-N0#_ajoTeYYi+H>K{>U@>sp_^2RCTd_4!;lWad
zYJr7p=><JAd<s7WF`PbP=q+v`+7Z9zQh=e9ewWRx>8%b9-5P?53w57%IIeDM*RA9<
z&(amRGmANyX+bHox%cz>t_2CryF*3RaKsA~Ycdv1dX`;rFQXvQ>dTdB(=Y0lOqZ<w
z_xin(yB<s5@yl(-G8=cVh&XtM%QRpDdzNond(Nth?+(V+et&nDQ|OggziP*)1wEEJ
zF*+`KLJ!LLkL|IjF0ZR%TFw4u=K)vEUFj=(-bJ!pw~GJZz!0S%$$dq2&8+WCHQ$^K
z^{3mNpZ<yEhM?t>EWYpp7XA|%;hRpZU!RyMpSf1wVxGzFU2+#6&)#!H{dla^g-@CJ
z`7@{3ZF*?+%b{oyr$j<-<LeZ|exc=UZ)7Z4eteyn95roMYUI|Q($hP#X1<u_d9`Rw
zbl+;RmC-4C(-yH9But#ns2kmt^nB_1>)*K^N!f=+EV;1u$H}a@SI!FW{<|Y@`?Xsy
zGQM>je_VAcIseX!SvO)$<?6Dpb<JOM&GT+dzn{yj7vEgN{9bOfOWzrJ{_>6ey(uRB
zk5=4x<74=H&ckJ&jPyiix$@>@S)Fl6y3=y}?!?f3$z5Ge0kiHl?z+pvyf^Sbsc>R>
z%H7b#{f>)HusifeEWUYl^Bt+pYH}yuncSb5utz7T*SP10k!PwP>m^l%;8$z<jP^a2
z-dVfm)jEEOme1D?t_olKQ?UB<XBL;4ET(eDU8GgD0=fR%%x<jED;6-*=s0Ym5m-5a
z<3q$+A)$uFDKZ@1Y}0v;T6l%C6r~I3B=PO{wEm#OyfSQw!Z+cGpCw$9x-P4B**0Df
zdg0%AL?_mrRj=#0#)V)_k(QW0n|l^?&R)6hj0?lJkOO&@F<pYptqjEsVR}h@0t~T}
z)Yj=F=-coYI_ONZxv^n}`sqpfi7!*zq%OS4)eDnZT0d{vY0(#L?ma1Me~W4EU}Wsg
zvT>B1q?739>UDvskVWFTv;=pF#KS4Sm7ed=YS_e-?fXRU)rB3)`1>7iwM(lBU3stA
ztk|@zx5>_{X$Q|j(GQw;rI?)=ErT1%m0gx?k&SRKa(y=4rIwLLnmgjAeL~Kx{2NBC
zch6K7G#@!|+4fuCp2dQzzcXK8IiL8|a$XKY8GA&N<+?Tp7e*PePfSVe*NhtD*fy(f
zV6k?}kSh{Bw2oh{pJ_+pGrb>HUD;LM5<jEn>&x{%WHbKE@=J13ft>Hz<4=v+owZxI
zuer@sUuM~N`M}hR><^oqVwnmXy(hi&-@o5-@0RutYwvc?S-;)?-Zj26B6oHyZ8>Xl
z+uUK^*4<6athZjcB`_Fl@F;pQ?e>mxN3lpPC8>1|v)}YZFk3X{gg7tNU_96FWX^m!
zZ2{l+jpZg+iZb`I{awEBt=58XFCD%+PPm|Kx-*|ykNf+4)&B49z0XW8)?CPmKccB0
zb8+qlhsmpF_|01DwZ-iAHNk?SO(o8Z;l7r}n=F|uL?R}tv-W0|o)YE1ygN<W=-r~b
zBC3IcjJ)<88*Y|PcRx_*AY;RIcWLX}e}(eBhdeG7?%a0uN(*P(BVTF%V~+D%WLb{K
zvSeRam~i;ho~@w<9?er%PtD1n?{TWM`tj11rRypuEPs2~_TBBdmi)R??iiff{rTA4
z%2cJFOnQ;C(s&PTIp3`}_1e|UdyO_PosKPLl%2rD&b0ro@BY_5uNEqvFWy)9T=PRy
z&Su3Oy&A6*X1?7jsFWbor!qs%eD_1Aas&I9iTztx-W||gcUdp}L=opE!3h$_)4Pgx
z)Xtjg_~6h4kD81awsZBxJ*qRTR{!6(`&YD;m_lzr`NdZLl9>maU!JMIRU9!_RWtCy
z%-?I;i!^>+yqd-PZ(aX=k%$0p?*ggBVqLpnJNbLxGB<HVG0gwM$m1RGhA~Pw!CQ6h
zY3_e+Zx(I3axNyC!?pX6Z$NqD#3z#`UNT>l^w9IYs;XbZ&B~TfOQll6{?^`KHT79`
zQ!v-(<`b9g7Vaq(-6buvN@c<3eEt9<q4(Px3+_ZFo&UR)!}@$<f0(Ra&8_XmL9PWY
zr&CtxJv%I}$tN$hS?$)A3-+&7*UVh}#PPYwG55Wj4=le~<1lspGCj8Vq{91FG6Ck=
z+ZP9DZ<uVi;j>0h%oUEJC^lV1hH%q|jt|ln*d9E^{y6vUG=_`18Fu1x`JU*BhbH!Z
z3tsPQemiO3)wa^x6S$8ho6op&d0l0q)O^{U2REm`b;~$#v25|u|FQcR-V5|rZrE(F
zAarI#V#{BfciSRFuFhRB;nY#3UF_R})3{>w4V0H`n)OerIrAK&%`u0<yC*jNy~eAx
zN93`0uA%CMD`f{88OnDo*7B4sU3P8T;m7Z)9`G?dG+WT1F;A@2RKRRk(2?#wk9WIU
z*x7&0kV~1-+^nBIv$=V(*<l%(9{ZA6YJ0AR6l}>fD}MOMaB{M`)7_a38}$z|t=1`g
zu!!fbOYMiqZ{jykt<Z4(GxZ>E^Iy}KI%3=rmC@R&?{cSzC+J^3bIo_%xpk*KG>RI#
z4>p-FM4e$O3c4v{>vpfA+tW45H))-cU}1V(f9~WZkL&~@!)Jew5L!_mqbE8^XK9Cj
zDSNr0>H*^t?tM8cy&l8_d^2mc%MM<kbzMp6-VV{#Z;}!v-ZEb2=<{}8`&+a}>QeFk
zvkW%-WcIv`<q<Uc?^xI{hb`VftK#@QhCDtGqo%VL10T2T-?drZK;^_Fr4EPHX7^VW
zFW23+ce836_pNDv#HRN7am{qkeLTxa<3RW84DqKjT{_~&!cLpnmai<6y6*6MZi)G?
ziyK;s^qOr>?P{v&UCrKeU~;tWmAw18T#MAZti2`dH|Uo<y|O;{TzPfD(x+AKvpJeh
zF@N3B@;B*kspzlSfjK9t{&6+#-^{gq$&o+j_j`CQKJ((E*}<Rhsy3eDWBipf^U7+q
zohm=Qjm}N#XWKhz8`}c!o+}DAdE(6J|7N9^a#$AleYoynpDJl9FEc|-MZhfdVWjzn
z-B&7B3#Tb<+8=Hit$)r@KB=y1!?W)aiL>{42^-#FzTG%ern}Glhn2#EWQT-=PhAx%
z`3Lrizw)s;zgsSl<3o$%;R!qK4VIg8dp&=)f+c0k0!=HiQ#na<LP|pZ>F?gPOiao?
zmuK%G{#D^B+h@$2tQPoc;RFdD-}_hpou2vs@#*QmPne%Ov+!Gj>>=ScyVYlTZ!+$V
zvUvB`o#k(*5$p0Vzo*q%bIrDI+S_zJzGnu%g3qp7yB$v7IlkfqL&If-0H(`Uzu(60
ztNizCySZ}AWs!fYS({|_Tm6seJ6K=JJ=%3+e^TX(OG^$!cfGTn<hS<l<Oc<!%+G5d
z@nkbynxXmk;{@f+jfd~4zyJKb)p!lt!9bG_hnccCo~_{!2zWO!jdL6S^L^)+JgD5z
zWcp#x1d)e!g|jB_zAYX8_rZ>mg8uRYf8RI!ZeM@MHuKB%pC6v_DC{|IY;m%n;Y9oV
z*bgbcoBSOsmT_+mcw)Rhz4dd<huQ1n#TAZtFS)UFR!gbSJh3Ir&qK3>_;}VCc`o5K
z5cIIS#rw?mn?2Lvx?AZ7ydxtm=5_HXi2HwkxZyubGM{{#bL&^Z-xI|SS*$*+$Mat1
z-3+m2OU_fb9}9P1{<7@Mj0Z+Sm1iHkVVEJ6r)yWi!D-L)uKmcP8M5JrMQ&$TI_Oqc
zS5JAJZm<5-dqSj|t^EpZ!2>mqP0~(1Z~Xq)e{*rhh3(AV(I4`&x1Bn(`o*rPv)bnd
z6gI|23Qjg{(-doQez`S#zh?A2hK6TX!b6-dvU2=VP<eG%aQ4C(iX1C4&!-vppLK~V
zxUr+q&~ll^%@~n#ClxJSmV`qYj)g0m)Lwm=c_llLRl0{gLp14{`hh4uokM{p!KLCB
zYNsNrreFCTxbr}l%a?~wZ?2B_tN*HBXIoqNjqm94-)3@_tN6FJy<c4a@;CDr1J8ep
z-Bwl#&faU;?w#xv-?PiuKJ@81g;4eWKd08s**Tw8d&=%&d%d8qiqWt58KrL2XwC_I
zzUs@L11&9G8dp;G><gUW+Q=rw`TW;pU7?SD7u)t|L@tR_`MX<#^Rl(2#G;LtUvQdv
zzj*V~A=hB~!vu?*xaWMXHgavvv$%G|pUSW}oLC(gzhjxc+nH1)mLGHY7sgGk{2}^4
z^*F;(_QYoPM5gWB@0wTD9&AzT5Ie~<Z-c<Pc`WjY>#{4gOfI~9&HeKAihif(9^N}`
zO}@w-3+ve<!dl?u(3XDo%rrK;jhdg<o)P@C=Xs0PZ1xqOtP=A%*BKqwzqwnm`Rl|9
zi?|rm-mS8|TqrJ{Zfp<|^;>B7o7Id@t}y(x<_fTDU#Ji?CHxM<y_Kp;I?C5FmVc?p
zRsOc<{DU>KU$5hyZ{o8=X4_l?orbCc^|zl^Y8%%dU)#uV$tF0Mk1apiXlCNRBT63o
zJ^u3K3h({E%C_>&-)Ogz_m_I3Sf=&{v$G_uU^HEMC0r!+#nm^P#24tP^{>y_ziM;O
zdC|DahMEhnBn+PhZ0Xy0eDRG=QTx}EMLe8TmkD<75I;3boju(vwZM6S1g}9Tm-AyO
zn~HxL`>xOQZ`GSMD`C_88?Do=H-Eb3rNb)`Wq9G!fxiqJ7qd@lyt$@KN%P{3RfX&A
zCaGJlsyX8CJ2SX(P1dF=zQog?)_-}@w!`yJ^vm^^H}t%`vt(~zO<aRYUB&V(6_SBp
z3<Q{sC+2xaXMOVE`nG!2Et|8SP2??}x6Hq4Sa`C)O6<y%LJl_3LxnlIAt$3Z#BS_b
zJmJB;M|}nJSdz<}H-{t&&DgCuGdbh^{f3t-dhNL7Zq_fk<S_ANR4B{S+GeSj*Tve*
zu8VyW&u~BZ>r<6+q6)Ll)I*`+(yy}wl%=LlyrL|^C>Pqt=-+U%!v2MqEAOdDw#Lgr
zE|pyowW5|<`$Du|zFar+-o;|68qNJ;MVitM7Yj5JXU@oG4r=)NK6&Z}ek0}HQ1%_l
zvv#g_v^%x1?R($Vvw<>;?o>5=y~xmas9NA|MY-WQcWYUbMt<wM^paAeooYKD%(Fb<
z5O(-<-Srzy<*XWpM;55bZs-e6lR6=~<{Q)MJ+tP-@Nc!)nsJL|edH>AKGQX}oHmY6
z^{z`famOB?w99Y$LyZ|e>V1hq$B(l3HZfYTxQXie)mpANGke|i^=3uW7svBD9ahXy
z=DxG#-;U<Rf?Qv^T!mbmf)aS|Trd&2{H>bx-kYyKkKR0eS=QlR;f{<`y7QA%zfb65
ztbXe7Y-PrTr?WMiQxv%rG{ffKE>S(FE0=WK{f(}M&_XReZ><|w?DmRO9Ag!IzxtEM
z8>2X*kA`!b3MYx0guaMy<z)M<pd4|&@-4sZx65srd-EB02)_`T5-~4cA#G)t$Y-Wz
zF`b9IazgdjP0McyNYV0JA^%P1K**1k3RdcTk$z3V9LImoZoYIcqdhb*<<pZ72IAW%
z?qH7V%fB8sOP_zfy=1?7GWU`y=|chf?WT>#eW%V0%4AC~`&2h^nfizHbH&H6@mwuh
z-m$;(!LJty+B-iSSTFzN+{p*8_VeA}zh91t|M|K5_xk6)YH9zb_tn~J4MSN&v%u>$
zH(qRJI96oSe(xbeV8nt~3xw`&(V69P#CqCF=5<LXuIrj7RNZyHb$F|;xQfh^X%p1`
znLIQ#U-L<%>-^F<7D0jgt26j*byDj%s%==VS?#I+b)^22M9k?Wd&&<^u&k+iQTcVh
zpZUJBD=g(<8>}};YRpmnSgRjeyM{SlOT+o;dDhd5FYNjHsIo_<L2QS&+%f60?LwTl
zm#9u<Va_jPORD3nY3fer?mWZ$E&Ej7B8zFOJa%mMzmr_eyw)(mfwjqP)dR5^g&7+j
z6!Fe1N%49g_+bgFQ(*K}HsJ-<$&Qh%M_+xNS{thA9sJE**W#6_>=Blt8qa51toBRy
z3Citm`K`6)(^J9Uo2Rg@6XjiRw7p04k*mR~hE@~zYVj4zHYG;uKhp5Ov-n2lZT}y^
zPiE&S|6|y{?Bm)4GK`HE&NB-glACU~_n@)FH$S#LS8H-xv;W=K`WU*u^TVv0u^+Vb
zPscS(sGTaNZ_wkdmT#Z($@x}q>ZN;k(zh{3Z#?#X!^~%HuXZ|ni%i%T#5|jAPN4jJ
za|X9HZ+*XK=pA4A^yT>iQ^BOaW-bA&U9K)^pX3iXTb_3;p8u!u*=6|zLA`@*jmP6A
ztjKPxIn|dDtrwcdUVrQ7tbaMZ%eJ1ow%~z-b!vk&Yc-Ea5dY^ar&Xq3URSaDE6!nh
zc<k`%kEPEw)<u<-#4HItbLP{%f4MAM4u6+=!s)inFnXzuj1|`xg|pm_^Nlq;?xZ~1
z8gkAcWyL+)CnuNjZSMDYws^(@150C3QI*fS1s1_aH?5xT*3+(J{hP&GKKbOeGG7m)
z_qPo~^-M~xHQTM8bt!#*p#RlC>DAnuTUIu!+ZIik=zF;Rx>-$oyW$<G&TF3XN?fO2
zbh8&szH(GNFXpRR%eoVVR_*<pXB}Vv=B%4ee^l9yQqzTo0rCF3^W0muEZyT6zM<8#
za!pIeymAhSD;ekK2e10}$6kh8Z0nu^t&Hn?gN`2;pStf%KF=+=6`TQ))=sQT&6(Hj
z37W`%RDbQBxa(gIcRw@jIVzQx-*BK%`D!muo4~s2ZAD?_TKT=3Ty_7;%Vvvy46x=&
z+Od3<V}77`iH*#Ii;a`DJhu8gp76<#`<L+HVC|r#k8DDB{gttwGs%jjrMa&p#$x}~
zrA<<IJ@)pnS-9~C_Fehyzp+Ynt(5Je)Y_0@yUM%P&7n-(3T@Ku!NzOOa;dp~O_g~X
zHgm0Cj`Is6rXF2=sY$OG|MSlEn0w6UeFQH@@P4gbu6Bl9@j5=f9~chuYkb`LYS{|k
zy$8C5`sb=@U6fexW?Ri1rxh{h9=>_nzrJpnSc%D*-#KDBldosGF06WGqjBa=M-Ef<
zi<e5}?^o=xI=!ns#I;TL($(-iv2O}<)u*m*DbjYm<Es#UGWm$&hHXOk7n<A*4@o?5
zH&AhE8S}>jpI!E<FE+E?eCd>6+nt2}7TFF_?<eg0k(hC4+A+p_^>y`sGM|}>i7m{$
z-nHM<XshyEwq;7f+M)r|qXX>@7+F0iVz6zCV_h~i{qhHf^*>p<em-9QY=K+VhBF^n
zCmcNP)-@q6o7M0wkNcXL!mR7AUu!r1bH(Z1`U5SY?_a<2&Jll>G1H|;?%mELwYwa9
zz8s#S<$1f)xv6qG=bF#mP3v2JmvG12;l1{}Ui8LCLC0KAX;<^;&jGjdI$L!^-dt5b
zTfTU`md^EX_1L4ACM88oP0}x%zUP5*S>Jsx!DUWrehXs)t3HaGt+*e(%k}jxt@>Q)
z$hOki+zMCzX1>#P@7Iw1zBW_cxaXBf^twD-78m`F=79aLz297r%3kDI5N@lW!#e4~
zX6|JEX3-7?#l4{$`>fmUiAGin3Oue$(9iO4&CC1xr?Pl`Q03goE9d?Fd2IcbU)!3_
zoL{+3mdReUJUn7zT&?#9r47ke>uhB1y}QoNEBp7(>yU?48%<U^{h#o>>rT_c6oGsD
zgz9)Dqc@vN)yghi|GIF|5=Hmf*VEKrOjCG&=Y5^Z-s`vJ3YPvWTW89)J=*SYd?;%I
z=S;pctM#^QoBAc-*uHbVYjy7a@I4uKdS^&M&Sl=p#h=_wGlFmDEN%bQB-8kD&Gx69
zQ(oUar)R>&bLIPy2k+Y)j(%C-b3JTNoVr2il0{J;PF&d*`82;gP$qi85vk;<%RWgr
z&s_CRv_kjDc7~0Cwf-)LraU{Ypm25BYJK4iy@y<$>SR0T$2EEADaF={Co4+dT=hs!
zTlZAMzK~N4H)h>*^m=uNZ)s7)+&M4(S4`lTvFS{3diUp*X4`a2W^sPsm$ExZs#o?r
zU;O$1b0&UUFo#zld$q)@RqH?BWL<yoR{!S*4IAWSYGm)VJz<`IZSkAf8+&R_yq@v+
z^XhWVzgG3jD(l-Nn!3JCUfdSL%2mSG#{1&$Y?jlahTC@@`M&sV{^X#{?vUEuooDAt
zNWaydT;*+hS<0z@e`{at;mOy1ugba2xbZ%%TH1U=;aU6W?BdkJ?FToUn$sjH;g$I%
zu`Nvb-*nb@i&`5m#;fkTyX~&jjw=r>{=T))J=}4q<&~(+%1On2|AeM<WJ?=}Ep*|o
znE$j&Z-wrOH~B)V8<!SuJa{ohg<;O;%crle{}aA{?r-t^`{vD!i<=i`R3)vt(mUaH
zckGL+b!&8b1%&Tp3(WWzJL`S`$3~y7gC8bum0Trd-tv2)?{>Z%+e>W;S2m>{DeH^$
zpZ#k8;rdJt_TVYmJ@+QuxtY~&YBPg#-_jd>nbA25leJmOv^8%<8yd<b-}x(gRMG6F
zwSY!jLTEorW*_S}!8-PE<v9hBEky~ef<2q-`tGk>zHfWq5tFpT7v1@EYj-cmTF@l&
zvS((#&87GY9R+`G{#f~c{__2C^Y+%Ymj7&j8C;`z>f+qV<!8^O_nv#4_WVcT;_u(X
z-j}c1p8T`XI(~BT@99$4uC#jQo<DP7<DI8UA%>qGyfhYRIcWSf-KI>c@T076z3M`p
zq^;aD1n)9Fl&)VdVEb3h#q{BJ<ym*?h1(v>8pzZOx7{y4uwkRYosM45?nFnosTZ3s
zf6X_T#4J4bnBe1s$)RioM?`y8I41V!=Z7%9y0~`z51B)OGvBW(xi!IdP1x1llQ<Zb
z$o>#pHDg)r%|hPZ>gvLcug|(l|J-c;{n4WT@8V)g-aWXnuld6NCI9>W$=^S8&NOF^
z{l4ix-e}&P)ZDx{`ER0)nY`R={`<4}<)hwbS$vtd|J_`f$i4RutT!{Qw%B&6Pw~{_
zXVnGqJugnK>zEhO@$dir{{O6~^Jh}EKIZS)85rJ55WcM}Gp{5y2ef1_A~*lBnb5y=
z@s4lmCe&_yGQBqQx&zmfO_}FzsQ5{5zq?yOAft2A&449dL4KE#{#Un)sGi<b{86rq
zpM8#?%cYLbhaMhIZ>#EDxBgx|&$&#W9ZCmv6k{$=5wdhW&e|8QGNVQLy{eVq(Zx${
zdM!Sg@rO@0jOD2dXP?j}H6Ibn7mB_G?<!Y{SavPia%HJXU`s|E$4bFxF&S%CJ~;I`
zZcjzwo{*?VH@E_{R4yeHA2UsSprfy$EVR^Od5@52RovHQ6Ow#|7hMQ?A$n+qK$jiQ
zW(z)vy~-NvM5{MXp1f~sRpaBIrWXDeET29-d|>zT1(k`(=U*~EoqFClZeDZit>PDd
z8FuXtn%7Znn$bFK^;fz0=YO}k_OHtNq8~DKM(k^&g-N%q&fNbTlhm^6{g-6N%C-$o
z+|!R4@Vx$Wv&4AUn)oaKLTwL3+DA_O@y<!*2=AGS$o>~Tmv|#?YfSCkB=<AqiEqfF
z6=LUl=iffg|3olt>LS-2Kb~LBEcw)bc{2az)0<beKM2nj+P5sIfLmgD?JmK}hOPbb
z_I`qK+_M(UIJF}sg6Ry`A;vj|3mDsUp1pq_93gh%i_nAP#vLu!D{kocp4nh@SpRwV
z<(08VTbArdxwUrLOjp1E8&<d^XwUFxTk)i<_Pk!b+jniL^;xp5TN(rx3-CmpH+=R$
zc4d&*B&~>@j9MG6TyZ-ir~5}}laBEg9ZhcrcdrH20U91Ym)(W=XRJ~_w90JXrCkA+
z9|m-W+)ws&%4#y@wo|duxN4x+wP0TI12cs?sj4}>3=8BuCJAw#RBHTj=-VdeHwTX-
zW`EX~dYpdik5r-5E+uc7`&)CEzs`^q<C@8P_S+K`!Hq_b9`0ch=UjDm;i0MLW<IYJ
zn^GOQ{CefPaO>j}T6gMoTvBml2u)jY<`H)VUvGT-;ty9DdhZ|jsvC3v&{xx#{jIMh
z*1c~y)XT{2)?PWuCvbw~k=x;u44On4Z~mDo`ecf>glVo@#3>{5_x}I?eU2>obNS|1
zk+NUaQm<z(706-We;)EudcoJ*(IqYawk$sTo_&G%hLU3I3>WT5sZRNne+)loU-`AY
z?8Nd@SN~)g?!HmRdhLI&`u>C&MfJC*+kaZS`say!@6CHJZJgY<eTlI8+#Jt%%a^Nl
zR~7|@dfVUpe<02M#CCx%w%cViuXvtX*|%t(lFr-352{NvEoPcs3*pRo^Yw6A%>K%+
zLbBQ_LA&=nJfWm0=u#NJSTv6LY{G>G)s~v0O`JOz;v@<rZkTM5&ePeNb8gGlpqVpb
z&$9Qih)&EFc&>U!S}D{*eFeiS;Vy}HR`d1Q4ixW7<!bXx$`GyC^dxQbRGI9il#?B-
z`I#P<Egbi{2TIws-bg;URpiX3$H&CX-z981wpF7vFl)*ov6s7FOq=w;n!|bOPHmsi
z@=1@aSBU!>DIR|)lpuHYDffoUQ`XH}Va1l{b<%fn%JmXS(T}GTN+mZ6y$XoBn|zeh
z(<8`Mbmoe@q>XAq=||*C))wq$T^)F;#JSKhdAV<A{qIccu(nFEwH$s6rZHAnI4o|R
z+mj(2w&aw_QhsTcgWGN}cnD=2w#ezJaQ*&b+5{dQ<J7GS>l!r{Uifn}H>`3S|Fweb
z+ixuxj_ej;J;!l}TU0D!{h|9TPi@uT%~s@}d*#jSjgsz_XHKyQb((Ere|%)wqq1^4
zHuXHcXJx{__bs{dP|_p9_4E4veU5c64%bTusGt1X>%BtQMt{+ihibJKZu{K6d**Uv
zv);<Q7fuY_OdM{@cpPVL+Lop0^Yyo~_Z#K?_IFR+RQtF;e4)iV6Z<5N@0}OVK3MzY
zs;NPj@BbUeT=@1rDOtX|rYh?R<BdB~3}?!|1x^T<!|LLd_~2o``{IkyI~sZYjP;f*
zY@T$#u<(4~R@eD~^85d-3tC@h*re>{o3B#o_x<ebzU+>jTWVLT?4KSYm#|QJ&&T@_
z2YWhyGxyX)OU``T^6<wyxeHTf9%ih(Hs$oO!dylDsoQL|7*iO(x4l@B6%{V><U-Ra
z_tzW!%r~vgpTH%kv(ctWTR`VwSP_fR>1P?ek|D;+8Ry*BIFP;IgW9Rv@7h+cz8Tzb
zT6e>~Ove?Q4=*)XBcIwLY&@6OhyRiK1wMzb9_tsxsBkUcE%Hbv=i;M-+Z<PCU-(p8
zZ5|kUa@h$J-}AG!#cX)FBQNV~-|TOW%iiXCpYtiNmY5yAefGQ8Y1jSK8$`nj9z8E?
z**Z<cz;V%8rFW`N(uHmv{PyJTktN&i+Sr%6y|w+y^keh8lyW<}1Csk{&*b|}U?})5
zs_@5(_rr(yD?SB3?!Rbg|D58_erIam+>&^9n>)7|`M;MPI9$elC%3VA#?ScG3_C9s
z3*5{RO%af2GFG|wRczjQJ^P&SkYp8>3BvQfY&$*2_t1yqye-S;N51$bX|d<Z+pGW1
zByGQcEPeX!ziIytH*LRv<A2ym<Ndemrk^j<p2>D7prAB2Zuhy6*WHoqSM_<_bL|?E
zM2sEe8(R|J{?V9in|?{<^P^wWg;_4Md8s}79C}*fq&M5m!uv~Vj`>7H|N7QEcWd6h
zd17tly_y$g{zqNo`Fi`xjPih($fr_Vi~eSbC5uIuf7?5|`fWxrUoYD;{%K-m`Ilwm
zXV#e-9o<#_IK22<v}9aAdxov#g8i<!s;(PamhC;KH{(tFs)Ug53%2HK?p`T(aH9YB
zYsne5*Cx-sy7{O<*0T+p%ijH3+Q;V0EAwy1{?PyRFE!6>JU#DPbo;J%6Td7-j$L}?
z`#&bs2E*>FHx)`*85l$a3Gb!KEY8Wy%T6uQE2!KX{x<KnnaJPu%Xbvi-_R6MeqDF=
z0NWbRZLHb5lMJ_sIx1WcN-dn~(YWN%io<dl>o=<3R@A&5G-b(8jWiZdjfv0W=2gFI
zkH7Hq_hfs%`yErf5A&Zl(p!6i^*Z;jeQB8o`Qy*_FA^_V^D3;nH1Xxti{bY#Y<loz
znzX9s<M2HprLDy&maEyS|Nmvb9bfC4e(96Y`O>u}o1IQ-oZ7ld!}HTIvsvn#om}sA
z3^k{IjrI}oRhzv1QIv=C&P!8PtrAnc-j;JvXK%`^{Y!#Q^jDblFS^gYXGzz|ZQF~}
zW^GYO%b2_Dz&Q=wnKAML=Yo<e+*VK1s^?#=A-pWjOm`8(s|1GWlJx;MnflX~{^*!J
z|9_c`!Gj#1o}zs>XIoWPH%(ue8xgr};_a=65-rYJ=Qk_Q?N?FJ?6h?<x_j>68iSCP
zYYwJntzGAGY-5>@%ZIxXawj&l8qEo6`+Dc2h^uVlwzaJ>*7nn6Pk#P+Cw`;IYTeVz
zKY3-S#$NDS9~@`B@3Fvzdr>n|lv9?OakQSuw2ZH-sGlYCzohEV=bO9b#RVU3-g@AB
z$94(HoV%{+|L=c0QTRP!L;ckbqucK)-imoIyI#YwYR`G=1@V7A-O)O$9493=r&jRB
zQGVw8Vo41ZrEfUb-rBXa_wk(Qz8@96ifIWuxujeag1#S{`R2j4f5%d$So5ss2vnc?
zyC7U9@zs~ZYpy0;jd<5kq`1&FeVd`-!_4;Q^Iot?MijD#8+PzITs>g6^6Gq>ttPic
z4r%gz+jeS#S9n}0qh2uk+y&Pjajl;{%dhS)!&yfa0sn)S`!9I;NHf-YZ8hc<S{Tp2
zX|H1K?U}uc7C2X(?eVx@;W&ThTeJD=Hotw9AXq8z;`86IQweg5T$KurUz(<P-t6|X
z<8G#kk5tQF&19cq?5P*CHr&?lLDW~dQl+ac4)<Hax8|xpxRbME-sQ-?>6!82)-mEU
zwsngNC~}<K$t|wsIIsBamN&`o3j*au)@0B4e2?v`sZps@^3n~u3<Vo&_U$eDAazjf
z@RALWgs*q*PGI^vYvygK%c9!S`y8_N3LcA-Sgp_h;=}HLRvOo970$SM@7i&P**V`c
z^D4);R33TL^qG+h_C>I~*C=ykUDnX~RAhN%@U6@}&GPjQ8%tiSe9i2swx!r4MNE5d
zu|rk+qpuqCgViPrJa1XL?wZQ2EBEsGHwUefnR`Ec(anRsx7k(dcs(U|x9>bJEx+^~
zOIE<$dyK23qRqFR&#q946z!;~S+lEpy7aYKwjY8E11<_*SsfGeKCz&#q{d2Cj{j)U
z5~<gxUoDDHPIgL+|Ke@w6}#E#-p;5Gu3rKSCWlN|B=Pg{KiMa4&(Cgoes0U=tvM5}
zi2K=WoPOcPGk%_01-|-YIck#ermtmOlg@Nh|JqU^JzI6z0geejBY5?H$ZRoC;8`Lm
z^<dHcUvkqpzgty#r>V?#I%rmPHMVfqaXsM`TekPgZ?2J=#rgN?UZI=!U&QZQ9_g{}
zTW)QBUDaX365FkwQa8U|YY+Zw)4nJ2*37*xLv?@rf9komr(iaJpn7F*<iS#Xk)2yM
z=9oTv&FOPj@6?r2*KKu2Y>!(6)k@YITwa<{#GhVm@$sBmUD&HOf#VzIyyJX#z;Nx!
zHBZutngbXX>V7dUidmh+b@i6Gu*juDPj9W8edlhM@8s`(mWO!n{5`X<C-cjhCAZ%Q
zn~0oj_|#xh%VYiU*FKRiGe2&wUi5M6svk0@iL2)u?P<@ua##PoTrks)-=&}Xenb^W
zevkbjBeJZfyXRf5T*-7t^{8{_ckYeYD)B=9_^LUv3EdCN$_h67Nt!1+J@Y?r5&ly9
zW9Qvlhuih<mVaLEueEpHi>B&)f0-Ue<q~s|Hy;mY%zC1_+g+gl(+=k^e)jU;(00LQ
z<S^cp=44<<RU*9TJ~y?bD8D?lC>yjz>u%)h{M#o4|F7GhG_htvi-*<BDi@<!&fM<T
zr8*xg7~YEEZC-F<=@!GC-UZXQU2*>R{hVI>?*y5je6HQEnibFed1gB&wm)vsdHMTw
zlKa&am&x?&EBml^a-KVXF@BT6oyQx^XMT%Y#63;6c++j}C%)(R82*V|JlobSe1>tC
z(w_$5X-gG)Soki*>7R@2s<GE|nV5XvUFB?qUVww9aHB%cr?~e=yT#`hOiSiVQsw=~
z)1F}G(xkZXO7|SwM}Ox1|Ki<e$luJe*mu{_z!v3_kC%_G4%bM@bQ7Ah*uulJXimee
zxb>TkSN!#rF?K4~c<^G`r#z#XOD_Fx$;tk1_NDPj&nXMDc7gOuE7{I$x^$eYdad03
zhsqM&7tcO<cD-Nv|D*ib-R0Be|5e>{{;*Qju$Duz_vE^1dz;P(b?IlG;YpC?%HMxg
zNnA8Bq<;5}#~=Q6x$bBe?(=TeU#Q07V!?G`8i$BlfP_G2WZ$LaGM9b{$3v{k1ecf#
z7#){cJVl0sMa;2I)x9csW%k-4wbpWptQjgDM_1WsidBm>noi(qIdO8EK!jG8;x3Pw
zx<5D=w_Z}$tYp-kmb6lj_ua;jDN@@6Z`U1N=+J!Jmh=0mxEU;Sn$u2w5}DUObyo+k
zdg=-5PYiFAob&Dfa;;^!dQ4-AWYePl3(A7k6LNi={hBv?S=lGBcjcLHRWFkz*eYK+
z`?<umY&v6i{1E>qS^IXc{i+LhuwLWXw_iP`cK>c>*8Q5je`S|hs3-oHx%=&S<heut
zR;b?V^}2BQ&XdE%r-jV?x14D`8zbTKrl9b2T-2G=!%Y?O-5RQD3l_fGuz6)c;G`AJ
zd-NuxH$ID9u#@#rd@RoelM}lxf86@^$F9@Mw?4gm>+>#$d7Q6`YH}_2y(_56wS1?$
z+o3CKM)V`TV(*-WX|W5Ia$3!<3KkCy@||&=^K(wb^#7te+1ze_DM)Mbn#AW3<8X;#
zU(K}S`z|3{q$bHS<!>}l6!mS_IUjT4)0vhES%LE{XRH)9|BHPeZE0OFt@Z!ShlcZ`
z8a<p&&$)Rf@^FmLS{+ZP(=oTtl%C%5dH01$ySK<jW%21QpLh0)$+I(Q=StMdc0?qf
z&wUq@Znf!inAo$PlT%yTc5ay2J#FWv<k-xO>uhGfe0gT(*_`Cqn`Ys=&MrM0<M%b-
zPDIHz;j=N}Z*R^Fm@@6{jBh5lD-v&qO_{a#@b~X$-lcjnHB?12&HFcTu~^Dlu>g@=
zkDKY4o|hQguedUty>PKrP%Y!3f*9NHV^8l(G#sAV%`j`>V(#MPW;59ty{wisZ<rWE
zn{{P9s^cvR%GJWR>|VC1K11N&`LjEYe(FBTa_IkShB@^cXXdW)_d9-_JG$ti*S~PL
z<!>)|mA_cIbJr&BeV4fQRplDTXP=pRHfHOYqcd%dM3*L3^WC0pmwaRQ)XU!AzeF<d
z_idS{`@UOt`jR;{lWwfjJk`m5_EfRZyO)yR!}`8>SuaaFXJ|Tm)|(5(j0@A9(qt#h
z<eXXVaI0KMU)FwF@ZNBK_T7<<MUN7-<>lUJct!F4R9~hRFLdkW_L5`wgXY(-U;9Ah
z>6FF$m~3h{ugyEZ@6P5WPvWzbOFm^zRAmfYc=g&Um)Pv`iCvRSr)1rW*`B=Y)V<Q#
z8&^HK{y9+lxVBXO`#*Ip+mD_rDL)<YNw&V8^U1koAHS*TZwT6{ZTjuXKIhwYSEIWe
z|E5Oh)p)RI{l3&#xBgb=ofT94cH46?cQplw6y-K?)FwPV#j4tJ@AT1g+XAu|D06+E
zbTnh>@+bYXdt>IXSlc<ymsDDG{-Rj1;`Wk0H<5`l?Tc<*jH&za`|Iwr>Hq&eZ7-kg
z|6onmo-d|{3_m@rb7*<bZ{hbyQR;t>ok3LY=8y)%MLr5A=L)=Qw|u<k=_!9XfsXCj
z#pWHq_fLEw{m4}<JVPd_Swuthv620%<7$5s*I!)0lgr%qx9V>A^fmuXs`oQWud1DP
zhVe??>-2|l+rC^|zDn{}`F)+e{f>1-?$_t<nz&SFp|zgw28(so8yn|lp1m)ymoL(4
zk&chDhFIB@GgcojSn>tE6YWppU*R`##{{GMx2)VPx);jVdd!G_cQfRud(lfZ$>$u0
z!oTjHIYp9BXzIjmH}o&6oe*Y{W!tuMmG90rlUue)sfVYSt`|GyUf_FKc)^ATO-no2
zG{a1Jve@0Trfc4pysDFB!^*Vy-+Yd<To1j^oS(ene#YsI8buDDJ;gfywxn|k{!m~G
zjX8Y#rEFE}ugP|QLVY(hTNljbjXPp!$<vlQPsQ9ru30&}_tHMGsL69~AA9<M!`UgZ
zXV$D&TYhAT-pZ0$IK_2BarM+c$=-L_YG$r^Zu#cNExrq<Tr2L1zLh!Y_{(|jHIaR5
zkIEWLwtb)6<}Tm0`gU@wz=w|3SFT@k%G27vPWMRlFI({IXY+-1aq?x;c_w^nm5kq8
zx;e4LV{)j$JC}R?zm^%4I0d;x@cWsii;AnX$?rVyvR^3rY@BM=p1+fn&d=@qEaea}
zebZ&tLtPz4-&5>&Mmubhtm%u=Q|kCp$)%~ibk|kYl-H*(zbSvg5*VFce&a%dRqVf@
z$$u7H|Ke9Z<=(DWIrdzN?lW$Fa+nzW!Q}KNq1xCpn<h+5pQfnn$GS=8^l8Osf69HP
zo)x~u5`6i0C6~Pw*WtbK1)uLS3B^>cx}M$N%<)|Pxv)%&xXh$mGJHXE&%9l5#pF$a
z!$$ANX&-kTbFMWx8Qm*1rM~UmLKV?+c@L@QFCC{G;yodfyUu3n?(-SNpHG$CzIw61
z{9NJ*yVZ;OU)@*I44?k({HtxT|EArH^Wpa5^V*yv!<B!PS+0e%o!hCjF?-DckEMpz
z*Xys=o)U~xIW(a?kn4FC?}Y1uO8tVV$7k#|m~gV?u%haYKd!|W<oCbj_w8spd6P#+
zLvQETbMNaGJpT0CO3(l5$Nm(PbE(t!z6=sG(&EtFaPUB9Nb@}p>kncATE}GAD|g5r
z-p%qq(bm2D<(c1;Yc;wJIgKjSB?O*N(fgTu{^V;v#SQaWE%!Jxy_>yn%S-m?bCV`1
zetSDHy77U=!$YrT<T_4TF;nV(zW7z%i-{rISeCi2dbgN4_~(VUlW!NlU+42K)m_i`
zWAp}v-5W%zuKMu&%-;RSXa#4y<ih4-UjuJSIlsNXTq}RsuY3E^Hlrj6>aNaWVPNp#
zCcGJ?AU#vBpt3jYcHV6_f!gQcJa5>8HXN~f7tFcCK|#7x&|ENzIafjANLNgk^yJ;$
zcbBG`eb`^#79O}M`?Kq#f@f#mzESjlxc=%@`|jw81(`n|sXe{a=~Ezl(EaSBIr@5s
zir<S&^SbVqQ_L>@T)wV(_Z;VwYbQ<k<Q}IHn<Qg#&g=Z?9xcVb&8I@!jvICaX+Li8
zTq#rR<oUW%U0q$?{F>x66Sfmm7~5y8_BWrfF-XL81&>f@R$xK0^Ox^?_)c7nI-zU8
zUB1`zrrGK=J^drg{C6I@y>6a?%z<CaJr(6D=6v$q+B@^+t;+PkTb)6FZcn*o^Fq+6
z%IRtu!~I#e_4gdRWVD0({l4|<9zT8l`swu9>*p)+e|V+5vqr@2WSUp(m#-PKcJ%qm
zhwgd9Bd4#EFFfaw7K>Fx!Un-BBJU2LncX;T>$=3_j?(XT_!J&Eb8(99J3kxF9F?bL
z3)QFWZhl>S=AahWy`q@dzzbF}n@gsz7TKIAQhct%_o)SAs?(<}p3x6gF5Y@L@o0$0
zs!75zC*>>{r%t}Jz|6klk;09qN+)O6cphBinzGWT^Lr`#^i`2Jw(Sw^|FPpz!Pn>I
zc^#rM6V{((o|MdI{jjJ<Hs~?S#B5%V`-(ATnYQP%Hwpg!)$aH|U98e~ipRzK*P|b9
z|9-=8QjEvLM;06QoJia7Lw29mP2Dy<qju@EXg|SXy@$^a%sO!Yh}FrzH#eKRC}^$b
z5`RA<b7#9?cKyfp2^PmcZTkE1{c=gR=Nz6DszTe3O*TFLfBPY`|L@;xeiU$-UjNR0
z!@l|cz48|-LJl>aKWbf5SKH42aZ8zH-fPw82ftU!m<Ji^g+__WJfFAZkjcEqA3m~#
z?RwyQ{ISr4KT{_P{OC5jHve#reDJZiFS`OQc#OYtSgBuI5V~oSd&7#@X^CsxJ+FPg
zoVC@XFRMoJ*OrTWUAOIuyyUr0bW;_RYPXe4OhCe{SYc+T#ElVOIMXhsEUOi*W8UgM
zS^QM+tkXfqBM-La1uj`s8(FnGcFxLg{8e_7&hynKsZZ6qXMQ={rLwlCJmAENH-F7?
zv%3=(hkQJDMETUN{`;q$g?gDJvePE0@NKnHd)j&P*s4Xf4?fxbf6#J!v)(O#zb?%#
z6StuKhN72(C)y>NE2yknqqQ@!k3IMUbCN>!5vyGek`BDlcYZi1EPi-x{;tcWN28Oy
zgeIE3;ECU%SSmKj>hk;r=6?d5*qrqvp8itWHUBJMy0z>4cfF$4VYk1}nSI?acGB@}
zr;I+D97}%iu=2IZ@upybB%UpXXIsKgpRZupJ=x>^uKle(SI=#GKlNzSooHWsonz{r
z_Uo1(ntnh|^yHQIReYA|n)TTqb1!bYq!PAm<pizRd2?kwT<2X{-Mg>0N$;$V$&a;R
zHlGsOqK&=?e)69F#Up`BZM*30Pi>N&*ZyS-IU9d??!IT?>ROMPfjJwy8N6Q!osa7~
zF=48``}*g$Z>9E^{!4$WXMW?{##ukBi=OQ_y}jh83+ptM80&}^Vj`ArYW_UXe6j4E
z(Z?^WLjTxNNAcbi-!*&0%D`YK$iSdRU;}nZVsUn6Ub<dECHO!j3!Z=T;vIA3=PcN`
z-giIi4MykLcST=cTgY7?-E<%z$MRyDcbm%kvt9qbD?j~iv3r{}Gh>cdjmN|qkEf<J
z|4M!y-7h9Mz3q3n;q)+-rq`Bx&PHx|{7=V1c5fT^)c0F&ywf@3cRuako02lV)3WXS
zcQiN+{~rvVn!bW(+UA@o8B-l4)LL~-_?-nJ*KJ`{Te|5Cm+IM!FR!kyj-HpD7qEIt
z<H^dFYswqAbQbB~udA#7`cePE&9>u){SP1YcTX1X2$|MBCEFuH?NV)n$Kt?Lr<uRb
zzAIMTet<{EeW|mfK+2PREwioe+&`T&R8M|BT6?7U)8d<JK3!Uy^}hFa&H3*cI*q9t
z{`|@mjQg{9hl2cb<payFt+6$E8{JzJ$mwQdy5~w&??RCs2N{}sHwY}1@V9Ms$vpAx
zr`$V>gata&4cl5HyLul^=&WwMcl3_S7N>36J8m5l=}~&Bd;G?7%@s#lO&^ynPukKJ
zbtX#Jto13&6pl_uwau+FnY^@ZCcR+NR({MfedGH%4V&iW2F%X4*<`Tqc4x-(H?Eq-
zY!jDWlB|2Ly(7Z6>C*|&ZFbzu)3?VP&Yxk#7g2Jt{LCGZcP)1p<|RuhpICHh`LC7_
z%Z#k0BGWu{?}#Y%a%!ejWj~v-f?sEOP=sW+U?ki1LlIT+>jQruJXl$Is^!bG4N?By
zj%Un|mMJXgI&s8bt~}ht-_m%G_9+9y9c#6_xROJksVqKz?Kam%!3Xu0HD2=b>Wg1p
zos_F;>D;;6aGj;7q}vtQWlN>6Mq9PcHjcU`lP$*SSabVL?7=IpF^}ez7I>drGwF=f
z$x2nre3fOBB-WSLJwN&2f%MW#@pJyjD&I4C9`~xr`oY^u&No?n(^P9>)gJ#!4Kh0S
zd5_SV34*TkmL7WNotMb+;?Iq%8#n_6ulugZF}o17+p$Rhdbs?3{k+5e+q=ud<1a*?
z|F6Dw+JuN3Jgp*TJjdIXpJe%C|8Vgn(f=<G_BHJl%rF&D>)B$oEOx28apMyEYa5Pr
zeph(pZs6*tdyHY5MadL}KbK;|;~LE+O*_tAU^{KLW_OJ2gI}4q?nd~=um>optf{Jw
zVKGb0nrd#lEn&rG_njSm`llzQ?p<2?`Rk3UZow4Sti#sJyr(VLzS>mG^kdCE-6{VV
zcmJ06>RQu2ucT(tEjfwb{=GL1c`YhWUHJKa<;8>>w`He&)Bh@Oow!qEqHNj3V+>}k
zvro^q++eY6zQ)RcsTQ}F$O!3_ItL#qJnZY=A>mu&y*KVg-JU|tH5@{-lsu2vnlmc(
z+oo;W^{0c+Vxp4{_w!Qk&c4aHZy!I<-lEd=JH+F)oyY#$)*7>7rWWvZd{z1K@#MxV
zJAR*Sx~q-aYf3j+2HdaOwo@!UR9Plsm9u9}UE~V3!mdg`-B`EZ1*cQ5SBFM)&%d)P
zVQ2oSU!R?}dl~3<yq$b%cDvX2j~!o^tnK_J(qY+f#B+9aZRyGllaDy<+Y-0rllNZd
z`gc37dF>bI&1kDMwlm&$*}Q$j()ks8d4d)9@4s`i>w=w9#xhoUi32~Lwc4JL^HMoI
zZ??ht<8gNbtv56r^y=PmeA%3vv7yot%hU38&d<{-l}TU1mR}%H_17}&)Ish&%KKs~
zZye4z{_r6Gde5&PcNdlSR!Tl)-?3Wpk-^F1dn^6kysRp_!20pm4ee=~R~D(Q4&L=7
z$yf6B?9!<RQztI3xjOOt?%LOE_u@|-Qc*E?oUMAOoJUq~=f(X$-45^nxM+I78B;x$
z8*w~$Zyb+nXxrmifB8UNL%3~-<l<LLwr~C$f2FpHPwuMiuEo-)&b?jk<>8<DDx$;g
z*OEpV&6$^66(qk2>0G=QST`}?x#Q)-zf+ywNM2#Tn;NYXbmV_(;yII9+bSOOXzo$G
zEirW(ciHu#Ew@b8Ov;jJ+jzmhpxH?GQS}l_)!C<&9?y!jd)MsGc2j)y&z!d_{Qjs;
z2rGEYTYU3)^g_>F_ojQP|KPV<Fq!qs@`-WBwmz6GRCH$!>)x2N&t9K2SY7+Wv8ZUR
zQr?+-o~x`y-{Vnh3HSTg4=rS6U~m^;U{EAfOMsfQOT+Ky-!>DdyB=SdA(ygv+Jqgi
z5A&o%JV=?naf`MUb9ABvlkVJ{bwVpAh6t^H@qeGPYvjbYCVa2hovl9Y`~CG}pH;KH
zeawH^yPrf_k7Z0-Xkhbvg<3)A#**fX7IysS60}yYee}Aw@#D{<7K`@FC+>5sXpiDL
z@qv#!a_SNuwn#~qos(2mJmY3ZB~D_{*IvnEptvNl&3j?<gR85<<u?Yc@LW5wah-wc
zXH5ytwg=CD956Z4Vzz4A3#p*Uussf}mfDpYdpT7&Y<69FJNaf<%$mlM=l7;t^m)I|
zJ{Z2%*!)qSwx-Uzv(8;pOB**7%{czqUp{Zr%Y5_8_tW3k&t-AgFUEQ_R?GF=b=@=8
zUc%xQ!aMKWzi~)@<Bi+5*p}{I9+vuwl~GJe+W(x!=Q(B>2^$`<U23|t-fe<6>(gzw
z4%sp-y}ICpM(3FuK3Of3><hdK+pM-~U)$E6o!jH!y?T$^s*u2jGqHkRCekw}nqEpe
zrm=4oZ`6W0htAEp8P(sgMDDy-h_8#*#Y0oy7)LGGlrH_`mAnrx&pUIQyB5`%2e+uD
zD295zkLI6#GVxB!o@eD-V!{jleiRODSk>bo<7*$h(Y@gO*|w7MWtz=8xiwkJE#CQN
z96bIiQ};aiZ~0EuXYJP(ullpWn-%u;zW6yU`}>}lNsq+aMZ#DgE6q8OWSPbC{F`de
zKMVfolefH6=Dkl5k1N|axo2<6p2>SYPBORd{5DDcQ0j-PKj%DL759B^tY@Un!?*fp
zHl;m(9dq>s!*$-c2S$9KBWKTd{B1CY#jiQNMN~@8Y<)<v)zz4S$tujfu68Xi)GPE`
zmoE!GxsrqJP1c#xNm?sQw`bLN6+U{r@v%9_bK@817-X;OzSvcyevr}i>>}+*8NO!O
zb;i?;CRV(4xn6lrKH#{{X*R{nsTMgeN?c{M!{^1SuL$aky1G)t?Ics)P1~5Inv*7<
z5xB{I`Sxl>Stcvqm;)s>b#?bD-7J$!6DL(Kvzqoc%k^cf&hK?!%<P<xf4jcn!t_e@
zElaEo_HR$G$>HB)$5LJV%I$XVwzjHAzdU=_%g$YKQ$^JOZj}2<_k(43ESvc^zwG0W
zv7WauVRe(x{#)C&#r&^4v-qMiOOpE4&K;%a-)xxljdzFSO}4G9jV&%tT6?l<x&E)+
zsU%tXoL#^!gw=m%rHjI=ty_h*_5EFOsdsshxHzlH&FkEm$rUTS`bs?|8%0y+Jlmvv
zm@TsH?CHxttsYIksd35YQ`6gqOg~?Rni8qQ;)+q_!Jew=*)~f%{2e%EW=t+D6cXIm
z=_qWcx#PzlSqJv!gUeT`Zx7yXv6kt0+Sx|}Ip@3AU9J9n#dmHF)3&GcleRWTY&pfg
zG`nhE?$-O$e?9iBmRl)1rCN1`Z|Ll}Pjg*12>CCmm2;ceep2(uX?@v4*K3Qvub2{|
zUu=D7l6h}$)Lg$Aeli{Rj;jTUmtM0!b0+7H=dxWd)|y4wg@?Y13FFnvRA~R(c<Y2>
z&tc`fb9&CNc9wO2f1Pgrb#`>D`PJ-$@^iX7Cw4B-y7y2)_eET}!KM@GyI%Xr#n<eg
zs^_cwQ(F1FS$5v>Wt%T^cPl;HXyzlC`@XE%U>9HeU){XfytZAley`x3rhjbmQ{#Yo
z(ZwD&*Tl#jUZTD4;i6;rn8d`6i7Iqy9c}G2F`AmEly%0cM$qg2%-fS|Gd@XfUbU$E
zO9TIR?t5#>S++c%z3#Q=QIU`LE<EvGbGBve7M)qFn_p(UG!JCHnzsJM>RIA9^H^+S
z3&StGNxTvw%6is!m+Hd>{B|}vUz3VHmc873d)~}t4(&T%HtU|4w{&WIg>QV*#;ZMV
zr?=EfY-y@j5pRxFdGh$tqqixRGIE7!Z)#`mJ@V&A>$T(Oe$)y6{_s2aV3?fiF5hb!
z-=tIuyT1K6=k$Kt`?)uCWtYAzj#<X*_$Ptm<?c@xgVOJA4erjbe)%7@d{63O$m*3~
zVE7%tz@SZ_d@su^E=|lSE-6jP%-1WZJZf{h?6$?E_y4#`{y1bR2X1=2BzbP(dzHS)
z-!kKilFBFL$;<P)I*AE&JrP)vn(JqmQJ=g&XEhfC=e?BO%hRp+H@0{$4A8hDdn--+
z{rwubc^vcIC-L_)%cUmiRahmi7djvR;o&;#d$-cs3pe>4J*$+w`|;e`vYiidPNvFi
zY`Fi)z;BvCf9jp+uw(!3|3CEMZu%RGQxzO<GliDNsXfZb&YpM7+idQ+&pQ4;OHLgT
z`epRYHE_;Fft_2wJ~=r#+<4~FdH%dQ-7{MX7tUBeQ(j+K@RLZCcwF0MXFrb$LF>Ig
zDm<7OF6caoW}4>zeBSw3mYrKuug&`TELrF5@|?LHFWM?6#b&9*Uf12=o$sW$+0A;Q
zlE~&XcZvHe+@y?7yGra}ef3n`_+NmjjNXp_UrqQb7!CYHIKS*D{`HGH-n^k*=~vf+
zulJb>UbvdKKb&3qM7OoxX|6+u<?a&w`s#WU+dn^Fe3<@tbNOUlw*O~V+3XU{lo5<I
zU9fo5N+Xj8oc#^eH3z$0@6Xt_)$|Jg(eSthrA+Z(mIbTq`nl(*^GQ*o+Xr%)61<*m
zoOxn~Jk#l=%x3+;+hWwSw>{GFtYq`nj5{F~!&Kd6&B(&N<I6^N@#_!HNHMD=&#5{5
zFy-)sqs4Q$j+_xIWLSMrNB?w?;c4T(hG$BT7<Ff#W^4}Q<&VB3^X}{<<sD1ee=|Fr
zK6OiHUhTuWV^ynLKZtLcCtnrB^hCpN`iI)J2U!d6heq!c+<sxM`kS-u_Zw^u%$oD_
zgw%nB%-e)+GCdRXX7+rzNMJ(KBKE4AYu85q%qiz$IeBSL-sO-_Ib45q)DJM_x6F@q
zyv|^!eeKhs)!yG(Dr9G`U%#I5k~z~`o$2N0T4F7g^}mWw?(SB8UgeN}B$#i<<vJrZ
z%Qy1xUiTbcdDi)TTkXkIw<T7#f7d7+d?r1iYu??g>+9}*Kl7^k>&MMb4<55}@0?!X
zn>Xh$)5Js14x1)1G2dl6bkC33<>vO=7oXp~SNi>m+SDIzHhl};>-7Cdc>VjD*u<{A
zH-h)%@Nw-pefn@u${Z#pgIJ5L;?@7#f>*!Yv3q&9$lCUVU1neZPMs2eD!RU_sYLT%
zdx(#=s`sa<SG=A46;^07SFO2b!{2o@FT~v7kz~fomfs6pYmfdcSW*?bL!oBc{W}-_
z%Kp`ph-tt0{&>OEK$#_XPJiK0TV(0QdTA<4{N%Sa%Oe8c|K4-w!{$Y)2j*Pd9qM^I
zspw`Rhtum&O~dZT8=6J(ZKs@ORn)sYNBG74*5Y1;?H(&O_B%a`tC;w-u_IUTzILj9
zM`S;ne1lwB{9Zeo*0z5s-47N$JAQg23-{s+_f%{>3T|ZuudKav)9W*T>Nd8e{Ruip
z{qM(b)QCU#U{~V`{l<m~&rhoyE{-~+`IE)<^z~@{Smm56mJ3@dS=^uPJFlw2_+x{@
z*49_06%|fik0t(n3z(d-Ilbh^mrTt`g~Ib)M2=|R3}@<0*}EuuqkLz;bdK0yMjp-s
zJW`V*ytZV;IBRS*oymH6>U6DnZI7Fbe}3UPcjOBrdsOTRlP)Lo1+_m!a>U<U{MP&X
z_05mZ?=NeAzWjZ^f1jOC|9QQByE%KUX3mq@zc0a`kzqeG8@rfkz=U%OwH)V;Jd=re
z7nS&8`P)USTTfs4+FG4`*HZNu)6tX5^XFt0Uz7{6Ho99EnQiu1zx(6;?OXoIo^;(~
z)%VAM-(se$;Pb|?KPkx@4_#wC%5+R~Rk8x3weUr8f99PJ3iQPyr=2*NA(D7J;AVPZ
zm2p&+;2pm5iMoe#chq-YnH=Xivsvl?*H3RhsNPVk<nlR|mc3Z!#50DoQs?g42$j2>
z$rSTf77*UP=X$zk{ILu}j^vpQwcq<EGMRi4kK?-aSbm4{5AHj1yQ^*#x?Kz9cos0>
z80V{i87toz1W%VZ`!8K%-Hz#P59A)S#C&2{*U<4Gt4S~VXr)9(M+Q^FtLc?ZX>y0U
zr{q4X4k}(JzHZOfEfq#xjmMKG1$^TSaGrOzUEg%GXw1I=H>vA8Jx*Wp-z~cA!Y7gZ
z-m9xpUoGG3r5&~4bq*u@`rVE?S0!Hlc=PzDzPorq`nfvGUknlxUxd^aEO_v{!z1N#
zCO?140izp&=hX_rFaKK-(ZN^EW-?ofouMpD;{V<q{xOoumFwr+H2Em*vF@gc(#myq
z_q}#hp8HyEF>U+t`TqSg#94ICJYw|DOA?CESbafjz20hrCf2L%S<5E`8zk~YoZnf!
z@%e?1msZ$);xO4)W4Lyk_~nZSSf8=keYf55=+JkkwS6ZU!n^ejer3ttJ%i=Vjh4ts
zD;>PgGauntpTxi~c<8h^|9sx$?9H}Y4CERcrt8htaCn@|aN}~X{T0JKWnLR*eDsP<
z2<v>txATamdY^Ic0VR9cH*a?D*1voA@87u_FVELVu6o|O`+Xl{xGu-v36Y0q&A1Ws
zimCgnml><t6gdNH2?xLZPguUx1?gUxvfJyDm<#)?oY1=9zt_s%-jzOC%UA8?df?{5
zi`(Au-a5T>iDq8>+PNN=(htwiF*Mp(@$J)}vp-o><*eiMKA&M`?Rk7}d7;?v!WAX5
zI~_9C7VB#~Yf7KBeBz<&QGzx9Q|`Xb4>f4|Z9Vm8jov%27KTqt_|6>czBh+!pY8QW
zEcRN7ml_`GPw8O4AF!))y6%e?8G8S&m!}GKt$Dt~?|+ujot^9aOZKu{o&RW&)U|6b
zowS>r-O6OYd+RKk$97?TzB_+zUPr~LTUVJlx)-jzR{PR|F)Mpz?D<1;n%*|ai3-k{
zpb#DS`<|-WyoSxT-J2g5oeG?FEK^uBp=nY&TgM-fKR!;YIuo_6A8zB}Hs8L=VT<4<
zqlKkw)HE`dY(LHyk;NhU^?Clzzi)G!?w@&i`QnRMo-<j0U*9?wJa37i)ZX9;ny=eq
zW(iGS{N2yo!XV*UL8v^hp!ubS)xE#$8y3g2iyrlj|9J4i0YjHR=Z;=r%Wg@CdXV|?
z;#%=V`l*cX;y7BYyF5*oDs`E1UAcT9`(4j7w)W<He>VRsH!nZ<_uY!|k&XAKGj4%f
zLtMSZ>%8oaEA;R?FzxwY@a5m(pARn{J^GV<xoC1qq+?E`PEqb*?b)#cc0zNF1p*(m
zTm1E_*uy=~RBc`V$_ooh`b;?wyj!@9(^>szT-b`r8{uhHbFZxJF-w?QR^<3zanH78
zx0PkXeG5c|?61WAxP8vMJVt%@#>WrWf4Us}sdI&7!sF}md?g<i`l((z!|FI?mHW<w
zn3CBl$3D~_(AD&pbhNr&aN+7y4<XL~hT*@ZuAKS(*x4jREWxVXYvTk)*~J=Z3CFVD
z--}ac(yrm!uGntPuY2j9V4XW>#s9g7to2o-B;<a?*culG6iac$UrLt`$(SJ$dERpA
z*HDFMjeMr%#visFC|0i5^_IOI^uI+>K$N$#xJXH|EA-fVjS~Iqrz2%vec>+P+}3_b
zJkpS5k2ANJ#q<;GIgtqqr@PmO96fzuZcO2(O(6>Q>vXRbZOQMu=l6k2Iw>anWM9?U
zMO&B7W50FyTKtxKoB1Cau?H`B88fY=FFk%sn%S-?KI(PTzlyy1cU5BNxx&OH!R~SA
z<sRtOeJ<qZ+8yMaJ!ggENlnwEw~~35-7uP&H0R=*iSFBlt$jaF;9hjV!uLQ$@jurW
z*N@q#zb|gk<lb=6cAHkQDJ%P~qrYw{v1XY}FI%&9F1!A}@=f1E(w0Xo((QQE{%N9-
z+q1-LLZ6J71H`zLIaimL%;uf$Z8@itC&Hd*NvUwnlfS`&dw-kMlvhN|pQ`cbLB+0#
z3l6k)`Cnx}+`IVbe#@&%FIX8S%y}QW<->gWWRI&xiaZA5DgLuEzgpW^*8Tl=_38P^
zyNniG%=p>gC3s-(qpbR(SV?!gLfL1|jc>0tH2$4mHIc`#<KMeC;i7D5hYRG6F9=Rs
zIepzpU8hTn4qVgpxLc|pmna?g>zDb&i(eMiEwJA(HM=!xcEc4moyygEY^OpErsTT@
zXw5oobkk#{i=y>{iAqZ^L`yp7$lj{D)y4O9f%8W58>YE@OQmy8?wnrdwC<o`+_u2N
zXjS&Wcl~{x{bw_l{ePjs;;eXj*6+75Zx`fRHt#pK%1b}}dwZNu?N5e2u?G>ApL>?S
zt)A}T<}X$qmKgUm#oMazR;lf}4T<m5_O`#ROMl*<U!Q(wN6XTZt`25Rb~WzER>x$M
zNq!9v-$i-2zjIQYC8sfS+ry@X`T@`8?=|QNkD3+4lrEOe?e$}|f@QE`YHIqLR~Pm$
zyq`Ti-Ei518lQ8kIn0(bnAJA)Hf&w4>?cv2uC+#f-Q8!~s;(-pI{HL?+QroW&Q}BH
zwpUJ<@!j6;qZ-ubVcFngV%(PNGjZwbZ<oV<oegz)J=3A4*thQaXO(36i&IsKH_OH_
zMeTUDR<K4kNT}DN?bZDSN2cD>yJGR`OMSo4c9~hP?oBCAo*#TZD0D@Jx9Lr%Us|jI
z|26Gdmj>-W>A551Awx6!n}=K~jlXNTo+*EqE)Ma?SF1L7%J{mi>h7;uxkU@Cwi~T{
zdZ%ag)<-8K`ni|X{EFfC&Ik?QJa{l}t0X_)wn>Y=TfT7c5?Wp1o|WXbHTlM+qWB9-
z^^TrCwEO5GF#)$D-#*^a&`Ld&{IIiR_HD^YH(Y*PTXx~}Sz|laaA_09j$F&5hvy!;
zcy!^b6Jk%pzAn&I%hJ}d4!C(zN#f?-@=c!2yBjz0R!-5c<PusG&U!C@!_FPE-o$A$
z@=7}@xH4<BsLc*}7<+Ki^%R|lON{<?JoW#vFr3pvtXfjz^{V?t;tZGe#qHaX)PEr9
z|HOzl!eYG-N?G@OEM0XnIQd5PLhqAdn^=~fYGRasuJxE->xjXOwn^>>d|td|FWGv%
zu+P(&U0e6C!12ZHJ=3|ABUXeun#}t1%53R;^~Hi`zVBbOXjZe=kx7Ry+867c{4f93
z=6>zI|Bv5QZ0QJhX0R1;)`^#HYLeD#oqx<|Ub=IAhLYi7p6-yg$}gr};TI=_{Jt>R
z*~y8ov0Kby#e=u4?hE<09$d%aH#^<DAzM)5evPO6>#Y+-^<$^5dGKFse)2MjlK&#M
zMSCt(KeqL`e|Bc4_cg~|GuEiiJU-{|$BOMD3?V#Dg&S5r>J06=r2kfN))vMe@AbTG
zCwa5~n1ASZg6E2)hi;GURM$OHY-zl>v2gYhRkg);4DZxkKR)ZuD!~=)3nE^HmhqHZ
zGj3(kner$#_bv0jm(c~$%`ZhZ&bfZ*swV&Pk8ivsZ3CIEKiRpv)nDk$9uaL})0T53
zljVMhbTdELENZ5c&32ECuTsJ4;F4uu-g6pg>0Vm1(pd3c)^uI(=+$p#CFXneZ9o2W
z_p6@<YcH=Z<<a236|i>h)H$;gL}t%#GJXC0g-Y{Ik#>u4_cC8Or`p*Gf&R6(c|}*T
zZ{ELgZo2j3Yr59<yB<f0-I=x3{N0?bj~jSiUtJw=?EJ5}2j-PC9<C_W-theHfw&UJ
z+wYmaZIZsxAA6wenCykJV|Opal{wvh*|hC8Z|;8KTY2JJc+)rBKgwoZ9ecq{=Fq=9
z^DSlnZu~4{-jaUzLfP$wZ}S_rUFUrpslDZ{@A40Oq;JJ>o7npY>zwuvs?+|_CHiuv
z>fSvUSR;xVuWySHnXkMfivP>AbBeC9g&IBFGp4bp$Vr{qcXQ`_`AhHpoMi&ny18!K
zc5>?3NiDCQ2GpO(VKMs}bEl{0sNt@qxxd%VS6TJV&T%!nZB)Sy;hHsp4Ve`i)5O^|
z&Q$eX6Z$qS=dCf@?kh&d?+Y{EzP)~H%G?XO8DH<$*<SY$+;!-nqx>T|drs}HzVm$k
zb+yG$R=f#lVOv|b?czM~T#e&Jhe8?OL|t~3K0Ha?G-czA&8nTfXSc_#Sj)6&%7?3m
zZ2xu4OAWVpv25PI?1Nbb3TF+EE)B10dK$lw*Xq1-eU#0!71vMXc<APA(A$31TG{00
zMHThw1yOoNbAx>6YVoRl{(D!kZ<&I~QESnEVtXv3{8F+OS*|~^nrn9G+Qi!DYP<fN
z<vbM7y4g^QAwJ~RnV)tWR`dPW`<Oa4o_oO^jn|DnB_HN4KC}CEskq!i>6}oxmwWDr
znA?Zm>*{yRo8YyqW98%>9_NY}k8Ad_Y&t%1r{;q+uH~XWef-4{J4LvfXB*68{4FC@
za_5rg;z<jPyxcz)TZy^0GD<!BqR~39=jC=&i!}`ix=Rff7|n91jNbF9iCO!yk`8a`
zYKy;Gr{AcHT{~9dxX|3m^69obnP7=85v(l=$NXoo=S*dLA<x2d*IO&*`-h7cx{SXZ
zT(eRwPGDVWg;Lg|IPS`s(&l$-`kvhU_CVtIwkH=A)=b(P)|l+xB(iAz2i5Qw7kMWf
zSjMcvq0sbosz{Qt3-1k{FVm;aUU}krbwSt%h6blShu(KqgzUYzweng+Ops0Li>k*7
zdlPqT*i?B!XZf+Edh?h)wy$^~9x*9=e**t%p>r37-|jw|5L}!sxOeF+>C{P@&-s$3
zB<_lvU2v7LNLea|`<l8yP@Ky}c3EHXncZtcobq<Pkd-l5xRN^|;^T^WcOo}jITR7Z
z$rT$YIn&-*L1Vp^=>h)r0gTGEZ&oy{;EYnvzPj2VS}QBN^yRCAZnw;4>NT#)GW`1T
zKjZ&M<+O7(hn=c8o8nf!ifG{3^-z%QugBgE-}B>ENAYkK@3H?=nXrHJLUj!}wZ&m8
zPrNyNImcI0hxu@-{pS<ULrykso$)1W`f{ezdqSVFxJ4OosM)DGgt+DFe`#(KRV&um
z!FEe0<W>Bu@`*-0;X=E@16_miUq6@p_$KVgPM+({O3qyJFXn12UBGl?)~yD<4Uto4
zZ<3r77TK5;(5YbYd)n*E%5xjH2Gma9`>Z&~?TeV@;ho!3)aE6=2$`*}=q>4zCz!Z+
zg-n0jPMMb_Uo<-A^_S0QF7a0@|0e74;i%w-uga@-n@`EMbojW*XqDQJQyWe;XRp>i
z#3(;`%60zt7t=IDwtC9N%)J|!_*b6i#}-RrErY$E4=t3vc5Q)O)zt_~QLR1vN%K|K
zRS7FjEdH`NEy1gfJ!8f8le;q5e0x8c7IB{JQrrFINyt*QB^zA~Cca`!-~a1}<le<1
z1|s{`FkW2md`+V4nx1N!b7jEU!n{wdI+j<f*tQ;<*7d_Zv~jwh@767ML%g!}mhPVY
zss0%g^T!#>)pq-zG}e{Acp|ue+teJF!bG>KsB01H^|oC#e3~)0G9zC!tS4%>$*h+T
zLNZ0)`RfK5RbDl?CVgo7v|~IM`+xplp_(M8ea)AD{;j_s&YRoM;&=JPV*4YmwR>M^
zTu)1+O=u{?rI-8>d)Ke!)z+z8%p9x!W{H6Lm$2kFcbzXXmjAl{JM?nsr>8nG;pJ@8
z7hgE|N|7bpKS3t*sP{YRs^?!;`@N2zZegf7N!}_*W$mt(e-9pCc&P5hE;~bK;!XCa
zhq7y}BuqnUF6!`_?Fn7l?zKMPlIzoWjgz0&yDzk>|7R0e+UfMO>s7kXiJxk%Vwa`o
z|IgcTRHW}uvC4EYG1I4C#h>h1yIoL2Ld}(Rx@Tgr*Nru6H>K%nzWa8``{eRn=VpI%
z5tUx$n7_)yIj2V^clHM_0glpTiZ8WRseU#&vT2XR-rD{N(hd1Og$yAq>wFb$*)v7j
z4o>hoZXGAV^L)b@10KGv#<_o@?{D}OlXLmeUHi3vWV;tlad5xPtta(wndiiuX`Srb
z{a;i}{`5oRcc*3S?IZ4O>bJ{&XolE_Ft{;jnCs<*`YyU@^Gt%1Ns3p~eeSW@=O0+T
zNVNYX%*er2aBrU2;@ufVttaB%`gVwZEZ!>cF4%&>;K+<G&O8~7m)K*E7vJqTFsuA-
z?nd7itdY_GmYr>Tm3)BBZTGjUM=zwV_s?0nK5**F12W8U3|+Yz&WGw<Z8t_PXv&O!
z`6gM*P<zITE35bY4SD~4hSfo>8Mi{t@*b7Y)(vW3-o7pW`}sBD_m9c1)s)#Hy&%+1
z`S_YYrK(>GRhFFDDPw#8ZhhpLYx@^C)b!k(va;++6<-a*9ND$&*RA^<nrXcF)`@8!
zB=<hh*s~}2&j+jhmW$S~Xl<$b<+lEEPycK0D@z2}jy;GFY=7m-ae8*z{f7TiFE-V9
z-b}pl?#2xX2d@x$tM-i#vrJebrXF4Uh==`Z-eE_poi@jx^ruU{RA}b%44*dhk#KCZ
zP3Qv?`O6VZ85e$KN9L-Q=(>l@JOAh8$&<%}-IGidowjfqcJXM>%r=k~(7V4%>BH~I
zSqFtxf0Q1)D`UbhbMc_L%G9}&vhT_LJ+^DXN=t<a8zO31V%mkCs;Sl2vYrzVRn=@(
z_n)K2^+#{<@%_`HuRjnwtHS;(fB(TrzTagM1=9a1mPv2%Quw+)@v{FbF$IT3N}a!*
z@@C%%sXn!J>8|F-qES)o{?oEqdzNMJ7TxE2Au3go@}jhj&qZ?f?2oPOhK9d7O&`sD
zIK4uR|J(`>Yo0f?nF4Q?S6NO<^-svqd8)YFg=6Zh)ppNXEhL2n81IJ21}vL1J;O!g
z0N2N7Qx1N-qCbDd_LPLAjLjZF`wp+kT6CGA;_y|Cj1Ru`87Cu!|NlkX=hAO{zw{vs
z14A`01A{VwS&fQhLo?XICNlxhO>Y@?C){)u3mcdWCnUB`&OLU?>;;cbYa)k<Yvgs0
zC2m0*_b&Wj>%R9!*qbfqmhrchJh3g`Q~j>buG#)wzFd>_6DKJ_pCm<HHH|ME_r!aa
zD@n9HzbDxfy7A%;A6=gF`fZGVV-A{#esGjfRTT4A3U>87mB4!1R{x?_yM~unbe5oN
zL*+uq!lp%&j(xtjr}A^8NR&j->eK|TgC}j+S0AvdcoOwdgu6l_eowPu!Bp`XoV=W;
z4R5!!Jgns1Vf1$PT@j7x2Y7s>!w(spnY&t2FDgFosc@F++{@du^|+ohCaN0nE{}hg
zzxZSR_Q&_t<?CfD9sIkMo(P8<9Zco^+_<PE$R}mdy!@Pp{Sj|+a`{us^4Ff)Ay}bg
zyy)AL9;W^+2N{}KqaH}Q#`7x#N`3O(*f^D;Yn7<cG6|#COqncCcDQvF=<t+lpDSa&
zeoLYu(63TcBQTOpYh}>{?%AtmteGgbIqdPGEr%FYOWy1-ik`(dVavf{p;)2*qK6NP
zzG=t=+}p^T^)a-7dv9o$&Du8~dnBDt1ihTI&zv`A&9B7TC#rTAiy{x4eXj4qcxn^F
zB8~bbDf|hoW~z7BW_Bq&-s=CB^WiST*Ol3IAN7K!e3ALT?u5AEUK3@nf4oK3#?uZN
z^1i<i^8T~s%74L$KV6Rn{8FBAmVN7kJGDO!E-&6cRfk_iy!T0xwxrplhharGJ@mE<
zUH0g)|Gv-E?s!t5-tKdHQ%=Qw_$L0WV)NJ1Ri|H_URW8r=V7D6?H^xmP5*ad^|xdn
zkA0h8UuQaHHPzH>OW+k_CGTGXe^}(F=A4MsRGq@cooDJI9LOrYIl8nz&7;RAtYPmd
zi5Z&;zL-0R?r!8#T#>!_ROpNE+bhyP%!`<;FST#S@=a%E_RK2k@|mf!Lrg8D@Xq2D
z-~8|Gx_8?<Jv}vTvFK&%Z8^z)jf-}a6>OJ|waS`hQfcuoM8|T&r`X<yhP)NOm7S;m
z_dRPmt9NPH_L{)|xBJwuxGPOtd*fKhY3p5YTyu|ezlvBoO|MP1f$68_t@HwW$?aPT
z_g*v%@Yr@@g{!XF+RdT)MLg1PGKJ#3A6LEW+WB+o9q|RSJC<!_)Z}PvInusLHtS<}
z=d6?`p)Yr2JFMyEvAku=wXZ~Ko*B>Wx$S&K0<81RezmW9azjsoxnPk*W=Qy5Em0k@
zug6y}$_e(J6*y_5uEE)Lf<LOizT9t>A0rrkBj`{66>m{V>BTmk47zRd9--Mk-5<VS
z5=hmMk8h7`p7gHxLNn(jmkrA0%vRRAhR2UzdL!^|ru^=e7c3llw@>Ol;M;!r%{zy*
zwN=T_o@a$!F>kypqoKNP_1lS|6IGtibLmen5x2<bd%}OW-|hGGrSEs9#H=j)wQ_Z|
z$^@xhmlv<7F*KQWaYsRT!#w#rKmJ~Hly){hnbEmR<Xqe0pZo@D`pG_iM}HVgv+PPR
z+iS<>cHN_UlgM1wiIx&O%F3FY7H?@3^!aSEz-jsG1K9z)&fS^&###3N1X0%5YgISu
z&rPkWJ#KGq_0mg1)W>)cN9m;#H+yazTCpZ>!^>^yTW7D}>aBH~<k}gzCpS~ycuA7;
z9=R)11Sb93kQVl3*Mq;#^Uk=1f415&S$X4|Rp(DM&3?7@QuMEC!ClQQ@2XzKRjqxn
z+Ue%)U4DLN*SUSJyI(E0U2o5KebjkhudE}%o;(Z;*$NmXWJ+p5YF<ieUUFt?v3`7f
zW?p7Ve7s&k<=e>Dc{1BY|D9j1u!Lzh_nKoHCvRzB*j|vLEtnMPwnT}SC9%!=@Xe*B
z#xj#-)|xy16RmBqbCTEfzw~~>oVho>FR;B`zo;!YlmF!5!^J<(rTYJT`}=ymW%cT!
zn-P^|p(l>54Du{K7r#|0{^Vxylj(1!#J?y@zEbq`NB8-8{~PbGRoOo+%zV!T|4o;2
zdyDUQ1{xppTAV#kr)6r))wO1Q`=_nVIbe1F%+JurOEO(dm+k#o;!(Z)?$UR&l6-cD
zU0an_x$t#Z=p~t*nWrlLT>f0MTFgyCMowby&nc&`Y2NMWynbnIN#gTpw)oOjMXMz5
z*YDowcP;r;(5@|$7Wt&^(bN4Es`^&PE5bv)`1<LHRm&_k*%uvt9+G?3;Q59_izB?O
zpJ)Eh)+(xUi0Vwc*?1sgR@W-8;D3|uSN~LR?wR~y(aDAPeou9N`(69@`?oLISG^SH
z>)lrGY2xm0mo(+@(u`SkiRZZ;_`bwn&aQtKu>0}U`0Yw%wgzQIMMfS+dUJZWJW%#X
zIqe$!!Rcm<z31kKQ{z_IB<i$u6a*x_)+wJAen=;E>%*kPxq=@!H;PHyov=z;G%IL!
z6pKA;ecR(3N>R5%4|%=|JJdRRM^RXq>UJvu*+rkfzKxE{$ei8zSo>qk+o;dGPKWO}
zctG-IN3GMx92M~&>7}}reI1)>-gf3K)mgs3AnrwN;K_7@4O>oe{IPp3W;1icze_zL
zKUI1bEq$r;c<c5%VZz#Pv`f<~vO{?FCG79yMrEE)?0?RgFF!qfXP(#ABhSS-#dD)Q
z<D>#lZ#C-|yK-K*u25G_weGLd!)w-B$?sS5ZF{gZ=5v(u4>!g`JMxya^4wpq(sR&S
zn>Q{ZbXxl1zn48%eq~W&_bgUknEWVI^YsqB!bO@Pjz=<hnXeyMy>;qh(}>>e;0J6G
z-7=H(_`@34Df$G2<cY}ma$b}A%TllNBk8gDo`T>@n(gZzu#0_b++O=8!IUZT&N|-f
zc0n#ji&+@+80P-;KG9NGKJknMccAN`36D1TTs$d$_ma?T(I;(5rGX6-Gxx;l*cKQx
ze1Egx<<cX3FLDptmt5d9{PT4E{~43{c0KJn(r>5oJ762<{%el4_j;8Y4$hU>@tnhS
zPtDppUHy-BSFFD9WLI#YqQjdWcURUxj}_^+HcXtMx}c$_rZe49=(e@t%KZ~JeYm(?
zZR_D>ksqe#JgK*1E6CE}Xr8UCFJ_qXp@9GSO~r(?Vk4V(p#h5b-ug`6t#GpK>Y|r>
zZmlWVlf8GY^i1z;O%|=IHdU(68P6|plt}jy2^7(~G4t&U_IVp^?Yr}*&3CyQWTUiU
z+Ny=&eNEkWWLNFGA|)+TDd{No;EAW?-5*cxw(E9RZ@wRU@6M9@ckkRuU9u}|^|9ZA
z8`$!<^6lPn@z&W!;SM8(iFI2l&L%hX6i-W?`TL2)Mn%0h)A#?CW&gZN`-$=Yg+blv
zTe|ONPSWt$esS*h@IA-#`+r@Za@14*wk^wwC3edr-R^wg51hkr)Of{H_MFqD;i4Dc
z?bO@0;^yh9a~@4)%<_2=ah%znJ%9I@+iv;s#wKO1(=;33(8V#c{5V^m?_u<rTm0id
z&6)?rPYyi1oN`Y7ddkb<y6JnucJBWE`~9Twv(FOC_USt1T=z1bt9o0z<0s$!c^7l4
z+txIBIowvs^JX}G*)#v#$qm6%6OEld%QB_znD+0=3EdSj4WgG%UK7vAZuh#Vs%#b)
zU}GC-rfYj(&y(qkHWj6}Ph4lrd;3y?&YREAi~h`W`)}TP{&DCEVJ4mTwm;<jvs<H8
z<sVGB{GdfxX2u!0vU_gke@-utt>DirS#kQsnfiZQKCJjKZ%WT(h312W%bq@Y^J=;B
zrTH%Y_A~$5?7FjAk^TNdM$YfsdQx^9&;4R}^c_dR-qY(vou<af?Y#aWhvPLv<nCR)
znu%Mo6$5h&PyGxKXv*u{<vLB4p?872=G27VMW)jGEj~}2mAmx3+jF6^r%fRjmdNRT
z+5Y|7funJU>=svc`-Si7y{$RpX28=4b<aHVRQ!5sS}SypfADy-DE>v8!Az|kchXCC
z3q9<6Hc{^w->z^bE-t5=3*Cf{%+Z=O;kwj=tr0KIwW>T9JZAOZM%mNoiEg0koCK+L
z90#W8q-@{HF=N*Pb*}$0%$^gH`xK4yI>Rdrmi4qgVov%!ebEe_NVYQ*ESRj)9taDi
ze7fh5drYyO<?@Br4-C_K*Lk^dOkHyA`st-Fw5D&neOdGA0g-m2E1E%{rp9f4vwHUI
z+q>_r&M{Hma%}(iqk$WWP1fm)G~Y7*r(wQAnM+?#ETV1Gt|@A7uZv&FoD&#$wax2m
z*kS8yjwiV}`xh_zSTA<?_%=zOg7=H%^5$O4xF|S<|Hp!0tIxL=?zR6J?^5=PscG-G
zc@0Xzi+sdRZb-f`X}d*Wp~ed3Cu=tt%<RA6S3A)!p!TtSz4k<nGMjXx*>4NkuD{hZ
zSy-N7KI!)E@bYl+C95yK6*_Od>Fez9`+F<@N>9GtH?1yNZT4l^D<XS&HvP5V{5Hkx
zk85#zpR1{Lh0k541!0n}0+@cZ9AGqh#wPnFAU&EXssDNC((8-{n$vrW<d^ofmhId5
zF+yZQmaDICkL_#iEGCOE?~5*fmfM~Cb$jJZ^HndTU+(knSnhmZ=u}i_TT7YD@8Sc`
zh3vb}1<VuJ80eb#=Hp)Dzb<)igS#iDw|wx~`O}X(U*@Sym3Xf~$;GEx3$>n_E!pDs
zV~yO;0JiQq6Yt!pQeAm;@%3X<Hcz;%GxzAF+pl`0PXAl%Fo`2qAYc1o#-jr{+Qp$t
z3Y=_jdoD$IEZot)N+hX0qAc(5^r*?q>z|w4S}=#Nw(pYk=aoz5cP*UF%$6*B?2aer
z-?k;$E8XY+JF@LzMV(IYnVaV~KgfLl;+5%5;cW;1O*o#Uo#h@|6kqD|YgN+H2bZq=
z`D{OV_ASfLC->j_V$1t9?%i{n4GXrHy!e`{q2<>5;+cP~*iyBV>L(qqc|ZKUsOR^d
z?Vod)z8UE#*YNfEu<N#H-uQd)fNtggx7WqZ-|Ma4XJ@40n^(VMZ*}os0lxM&tFJ+O
zY*t;qnfHNf-z3pPlcvW`{vGo0@iFUI36mWc4*&X<Y%^g&VZNcsk&Ws-yBt5r#m#Gt
zSRc?FyYp{V%hS1~D|VciteK{1^6i*>rLQr2{ricIt?ykjbB<jopY>r~OYrBN-vS?H
zr|ifP$WNJiA>94>7hBV*DZ5hK?|*o|`^$^2gHzXg-8cIk_~2Z|f&Gp*A9T0$PCa#S
z(+vJ(4Vgs?)+BPU&PeU@dRb-tXHMn0tv7OJf4Y#LpK)pVb>8=TH<*8|xTg_u`6~Ah
z#yfUmF9lWGD+RmWf0<im<XSM@<Qnsa>jy&XuiF)SJ8Tq_d!Aji+8{<?MM?jeT&FuO
z_qk=6&zeasKk=U{bkULz@wpdDCgp6l?)bP<;l>UBSt5?wpRS(c{`uk1p^mRi{hJu~
zYVbuJ;4E_d@QCf|+L-rNku0~Js^_YhbfmqR!r%BLalQOCFRhhtITi*^7TR;}w~(~v
zQm0_%>?kI0A?Z6Mm3{xu|5*L(#B{?I3F2}7iKi8(73}@tVElB053|at$iz+RJ3>#p
zS<H9yva2;-SHI3#Y)?dHgNj31w99XyS@Zu++#h=FZoEt1_wW42_vutsBrK0pHgNbe
zt$Du7lMU)7_2yhZe1sK#tXWiOD^#oPvteVowA9h725et<Etg}_`uJFFna}IDJD2ZV
zU?3>!b8}68_`-EkGq-kKUUpEdQTmVB8NuvRoA<5qI40KrdD}Mm&;7**1%CehU8eY8
zO1#i(C%d`F*PF>mMKl~@S@QO}?ACMg-!nqLhP<En;g0IOus0Lym;5T3{$*j{?<q<D
zo18eU)!1G+y;g|(q5AIZZYP0@|9hhSEjJyNoa$ZJFLtb>_r6%&-8#oDTBr0o-_^TG
zW!WiR?DyFCA=vSi%C8TJ)pNsB*5=5W?p(3J^!3aJi;k={HVe!yJ$2pb?<#rg%3Hgu
zYgYtVCtQ5?C?WgaR`%Zsy`{AUqAO0{$%)#&e?!jnt#{OKO?7y8`uj<)kDp2$a$>gn
z3wtbh^`N3~L%&GETSm!4RgqsOwkqFdG<#a*B6EB7dZWc>|A@OE{_a+?;=ZBGmxB^Q
z**0tk^7f{)zPhIJ@AC8GVqzVWpPw%eJC;<sir@YJti0DPr`ZyeZpSXtT_wJI%Gc#v
zwJ!X>75gbT+_o#tTYCTVWC>OuyIuMje;=D|v)iTropb+vp#a@KueP75-g>OA;BD2v
zb;qlZ{bxb#i99Sl`DddH1H<_u1_pW5v6>X*o=8$+aVn@6V*9q}vDu{me?=nB^Lt6o
znte8Pb<i%0$m8F9N<KfdyuI04bAGq$<OyeHD2Yzm<o@~-^WE$_lVi&tH#2aY`jld}
z^3>ebMiV_2TzrvlB6Y#I?AyB+hwr_%d766o`!Y%W+cncZR~_P;=2><2`@XJycPfwZ
zt$w=e-1F<Yzh9l+|L3;cpU=G3`=7nx&0jSs_0Kf%t3`}+BTr9mz51~JpY*Squclvq
zzFMCXwQWzs^sk#%O*UJ9N;adqZmxOGH1Ro0LvN~8-rOLTkiO@s=C(vv)APY*tFw;T
zZ`-3cnJG@MlJmwg%X}r7{Ht589?H1M;Ad*Gh9Tr^f}Z)wIp#VmEl+z_?Dk<`^gGPd
zFgKES@8gPXS>dMr$<y>14o_1}jojLju~}Juse$p=oksJ-S`UQTpJKeaZ57ww1+n^{
zi_T4Io4eY5b?Cg#jg>p2Rs{Ax-0Y&+b>%SY8Qm0am5Pb+E4OEEjW{Io%FWdKVQP%Z
z(>;N{A>vmbmDZK+i~BTTFC*J?Rr@{b8vZVP@bu&HDf)#{ioZ8%ZF;imfqJ<8;WJKb
zUveI}_Bb<1K6VXScU404>qU<_7p{lb?EUOxcB1j)*G+8Gu7!IZ4m~Vx<Jcr$STU8!
zep7&L)#>+TWuGLi`_I)^mCMNgtEl;r_3PWyl=g%3t$*4{@;znVY^k6Bd6$-_kLl8{
z%A232<?yestoqDsW4=3P?I)#RUiU9-|65|_sehfr%(*-@YK>9dl<U43duKK2)bogD
z&kFc%@BGsHVddN_uLbs9TP;#};@qmxxlZ0?e>Se2EaIX5gT+7Y)1<`(=`7t2z3ge?
zjXs|&j&d%{@cMH9?iv2oMbpmr|KMR^Irv7P;fL=%lM4ZX;++S+Stos7^l-ATuJ)nA
z^mKLINy`%5y}GYQy>r_p(Z{+&f#b{KwyU1^KJ?s;U3@m<wdtaJVGB;Drb)8BSlV9n
zLGq`-l;*eZ-pyO&V5XtLSsgt!#((15gB$jwq#g~}9$Cfvt!v@mRbi=Of&XXecdNKA
z;k&i%-1;zG`*qnHJj*Mq-_ADX(Rk6lO`uIxJG5xtK@~=;PaT<Zx~qB~=S;q>bzZ{#
zz=2|kmb;B-*PLRoQwf?gf1=`34aGG~fA>D~JT__CRc(XM+=~01t=j4(=QjqPIlZU%
zap2+Zn={_ly0g5z_29mc#-8M_Of&l~YUq5bpY*fG@r*Q+pwa8f#(l|$W^Gfu@%-ZJ
zJ(>CsUN5y}>3F?L@8;2^>2pGN$85dE@nwmR*q_Ua=A1s&x+Ts{dsn}jZE-rANy_N(
zJfDb!8Iuwke2P?R6psmgX|+^Q(3o^Y(W<Yt^Sk5DcMlkLf2h5(#q+M2M&M$FzUGa_
zLRlTkb&Egt{k^rkwoxQU@w&>DgEw5hamCF#)Np_I#-}{-DhV7mQUBVuUk|<3bK#(8
z&-{(eq8^`{)L(ql-o|v~-MWKSjXTOt?J;{YpE)n}o{rQN-n&~?8UL7GBg;`6ch6+S
z)bKr-twC~o?ClwuMN|x;9Q^O?t*Wf}^zG;uRlB%*XTAq*s(keH;q2z{<3E&QRm^Q(
zY`J`dlP%)f)!e?Ss;z3V%-g0!2BohNP?J{T*x)JZA}8Q6!SAukdW${!`4w&j^%eHD
zwRW}Lix-M#eh%vWF8@F&V)K(syVs5S`3HQ?glpt4`0w!iYSSBqEvu$w{QnreInN<N
zWSY{tNi#S%&G}nWR`-XkUCej)%x5kR9WvL}MCxADXL#puXYywL1QzLeS6-SPoPBjc
z`U)vt=DQ4^;|^|Vlvz=iG~qG-^X2UNe*E`j{y%>5MU>A?&9gkDSuXGhyV3$RCJWAG
z3$8|s#yq}b=w}}2a86|>%aoS4hn_q)xU}wx{)K|xJmx211+yHEK37*?-+BK^27kPE
zhyH<*ct?gx_Lh8!R{Pw#sp1K8EOzeed22QunzZ=)d!CfbS2t}u^5*WtgVxR*ms2wL
z*4h4jD4!o!!rM?<-aYf`6Z@$P{v~l~S!|zTC%5-MV|?0b?UL5HYK#2qxu3L8e=c|=
z>PM}}m;3CBl1lx0{cnB<T$#!CM|x}Yghl0P%oPj=y_navFfEvIsBiY}z^H~dN{P?U
zvItn73f^>K;fAW|DTxnur~YFS_Hd|TZF6Ayc=L8cO=Ye2O67wA_7em{R!-@6`Ohu=
zW9f{&=eJe$s^4N4ZaC1T8_?_cT)4$;Q}2P}YG(f)UVWmsOS2^^_+fD5)ap;OUteLH
zcxS6Xj7s*x#|?7FEU)IQK3H~q-O2C%2foO-NeBwDCOus6+v)oXj~nYkqgF4`SY>Tc
zSRTr5^t^Y=_M)pyf|qq$@=x+K#aHy4X<&^#m-^z`%%4xWuC0*xCCt#|tHxOvrf`t|
zY~jhKgW;E-xgK0MIXcC-!+J)7Wg4HJC-d=}?uIORzqfqr{xE;Ndvedow`NNN&P6i(
zdlvV#isOx2k*8UrgUrTfUR+%T3)EdD!?I&U*CmMBNM`UFFaOUOU$Z0pi8)`(o=#1b
z2EIc_qw`JuA8!4ZV?OcqmWaae_LK{(Oa{`i1%;awlMm<4-+1{+-`l-v{=36V{3agC
z?O<^{b~-dDqhBXRyx<;#;oOT?oYPYn7=2j7oI@tvym9qpY)(Q(z?B16&bPbi-2L+B
z{NnGbC3^$7zrJ9da3c0tBhxpr`h!dR^PWT}d*!@P)VZ+FZ(87u=}A^8TU*Qest+Gi
zSbcZK+_>LtXCBRr@a5KhzBwgy%d$=0mlm8$u2()Nl)9*tZLK@2NwLAi2F;{57dY=+
zt$yI_{jK+);gUOvuYYDm7BtQ~8guyA$M`L+i;rA(Syy4Zu;@N(VE=^;?du)~o^CJO
z#o!Zgf_LSVd~4>-`T+;@)w-^G7U!~kNT{s(xSJ{ITXSe`?zhc%HoY<D-Zyod)-nTy
zzK6n5jTUtY-*2t6^?4$m>MysCd)LATimeB4uQd$O=cpH7aQ9<w(3*<tp)bV>d4n?)
z0(|R^1fQ`Fd$ze);K6CR>Xrb7K4p9J74|EhXjD`u?Jl_+8~O6!yU(+VJLKxD?6|Ay
zt{%$2lFgUa$XX=!(n{0)Sx0j6(>CtZ%fDu+eA4M*tnZI~F^%(Eih@F`Vqs%KrpUiU
zJu`95@azAg-#%HebL)n?vkwJHF-G|Rw<(>zyVhnNv(mvhy^X2oBkMk1ee!A3_0^{%
za@(fH|Jt$qwvC^;a@DWijOA+kRo5<S^1A;=EX3$+kEL#OjN*%`t`qOxz1#Ohmo;<K
zbV2TbSDTL-T#VSCd}PAm(`lut`5FmM=MIYgJ>#+bi}I;{j?~wg*DStFI`#K=(iGQw
znSGrfXQu7>v?e)xe(4{@*mKE@aU7?cc5}`Q7Co4|h2g@ij4S*V20CuP&1O7)RsPXv
zfA#Ihdu(^Ey^*Kx`tPdEdx1YJZPIhMKiu}gVYcj|r-8Xur#d#fpNto-jFJ)PKbj{s
z!DeGntmm}O^CuQh`)0lC>NQ54J6^}^)g&&p<lOtT>@G8xYo?abTc!TbpJa?H<>Y1x
zZne!+=6mORr>}kO$~`M*iCsIKQhj>cI)lG%yC-N^US9k-je|4UMp}@k((JgemC+_^
zFLS#K;X7yfK5V_|u>XB@@l=h-sphGr;cRA7r>3V?-d&!O@FsJnCx`m#cZZzz?_l*k
z^GvUNXXdXfY!6ykvsSA~Y?EX@aWHA`*~v=p&a}4tYn5}*`|czBYsDw&(=My!_f}{b
zcuthl*}LLRWV!Nc@rX%v5yf|y{2jvI`v`mfTD|?zM2#6@PEU{Wc-@rBU7UBGWwP34
zuFonf)@M0eus+>)Xo<ucmjjd1w%rkAym3$NSvbqgjBcOVA7t;J39WY4Nxd}Fh~cvR
z>J#j2`drd&ON1IVu7AotQ4r5FJ#NA0;?&<E(drSempCvQHuWwuw_d&UlmD@}n~u|-
z9tsp!I{f~_Bfs>iAC_K8dBQBg?UNX~L-q=<wxkKuZ3gDPPNf?gpY30BpyAM(jM^&+
z_D4>9Y0$d4u#t23+ymTv-)>Bq<2O;`Y=zb~;iG!NANH~AWQwnJWtEk@8vVtzd&c3n
zXH_K(*!JJKZeP)`PvY?`%`;Mt&F`&PIKF&*WVB_;pHG(_t1{*)m|02R`oFEq<C;>K
z$BD<vxzj=~Ke1rkeeQ@rS%;R(Bxz^GmIyEP_RNY0oR2*xGdCMlb{x*K%a)iqd5Mo#
z;OeA215Y3B;ER4ID;%d+9lgl8<=e6=u}uekyE<pz<XYNwLt@j+sT&qAeAiG}x9`;i
zm%w{MITajYYQ|<Fp7!ZKoZJ=uer*!H=W<dgQ10OK!u3nHoPTa`*nQgHCu)<e+${}y
zOpOvPxZ>`eIVyH4L3qEY*jxh%nYOhN-&`&nO5$yvs;NKmUWHPQZLEULwPK$dRym;-
z^D`UR>P^0EkFuV2XuF~z_r0)H!Q1D13El8CecJsm#J(ls>%=&1m0h{fCrdUxJSHc1
z_}5$=t~FC9Z}_lrLFN5hGaTKw^S>`&oUkr=Azy^JSn3@8kIfvpcf$NnZ@PE8T2q*N
zeS6#@kG_XGOJ?m@$faay`eBN8f#UX<Bb+81^Wvs$thvwe*q=2(^PjSFl2Cqg7W2mf
z`H9(g>VMh_2u4p2zIph@p*KsTY^_79`dfoK4lwgHtN;6OomaT`!R5uXuYEiCtZhf}
zMCqS3p&HM!Ys+I9nf}^kZG1ju%1zO%y^FSZ-xoN>cTCbvEcMj(SnqGsCf#G4W6NXP
zu{ZB?xy+qbhBz<(hi`QFCfIhnUTutO|LUpfx~SFCAv@4kJbzOEKZT_F11}z2`&?Pw
zIX8H}xWT8|vsou!U$nTSboYL?EUVXKgPAq|AG}$*qN8~J&ea~}&KHWVU3=uq`a<IQ
z8*ScAv!e>X?px|wc35xOz4X6VCgmup&YyMSe3`Jj>w<-!kL0Zj<Nd9qtg`>x_x)2&
ztZF;9xbdt}#!5S@lJH4gQ^M!JRSPOA2~GVj6<g+C_O^7wUe<EK6=_>Euf5K3HhWrQ
z9I|*ROODOPZ(afOes6e^wrQ?pXY$k3t-Wy{T$hGQJ&~NoT$?T55!(2^ccx^90Z-t*
zn|F>e{ntA7TCO~%b^V@gWuIA=TzFizE3V_atDbPRhr-2^T!-@y<h*>Ma7K0+$BzWw
zgvWWFiL#t#d-=C0BtL9ZzJ0J+-(<OvOYaw7jYpDQsd>lCTHf8~m0()vyeRtM@<RQh
ziIcDK$lW;g`u)9`stW4edrYsN5KNwNGI%C;%=|~Id~#p>?@_g!a%qLOmghSKPX@Oo
zJGD-_9b%f*wZuDcw%UfCJ2$_SfBAAm?)J?PN!!%?7ZS~>7q19kKmPks!Tnd9*ZwTl
zxm3aPY~KF|l^fj`Mt*eHUwke6Wgp{)d0ub+%B1?7Nq5?K>_p*e%~jKOa%(J@>39BH
z6Wg417X>DqyL~h0DT5@_h4NW;fp>%=o(K7Mnp>@A`}c0!=F-3G8IR?>U|)K<>vwZt
zH>3adZ_JbJ{yOD+srZs+FndRS9jA5PyVw3f`Y#-ly*C`nim$y;w10imR7T(ZCAux?
zQ?GnKeaq#R3XkojeC1asieH>cdokTqeuA59!%I(>3<KqoLn|jFZVLFjyt(J&^V=UK
zgckijANjY;Qd=T$<>qHLSx-F9UU59P>h{5N{ZDt~_1e5!cIH~*RxKkY*2U2~(_6)t
zzBt{;GUHTL<>m0C{VgI#3(qv)6uBR{)!6HF&TPJlq(|K99|e2+PBrkh=ww9hzVI_S
zBl+pd1VNYW=ev5FoUPWc<noJ1dYcuxX7P+0QRjMd*R`<rv$8(Y-w?ok=fV#2$rqJH
zWV>T$^*^~X+akKz_EceU%G<W@`#<mTJ!2^F_Usbw8NzClYF9lAJE{NAHaY*=Y16r#
z2RCPFzlglNQEcP;j)kQ~p?8ZI*{}Y2s<qNM{6kgtkLMMW6nztJ%Kkak622kUvc0#@
zZOQzvrq0W{=N<n0WY61W8dol!<JHXMwmh?D;Y^+*4;l?Oa45WxD13ROfBLeoZw$6}
ztY|Y9k{ADRcb<-3<T0(U|0~uQdF(oFboPJHrHc>tE51CEVn4M+$^2jPr9G^CcRqzj
z+_Ig)eZN5Gu!mLGq?=Z89iN|`5?0=K?6Jh$KpllwT}9oKoqOevvPR~}=Dlalymp&|
z|AB1j@&Xol??vn%0@wZ4c(DEV--@ELbs80a3J<??dLd9zvHju1V#CAke&&KtKAv)D
zuD!eAqCj4jj`_;Sdr5YeErZs_?^bs{Abes$y20`{mMM$Unk>V9Zsh*`gqPLyKkL>b
zPnOlNrYw3nD=U3Rws6Dy7t@UowEnzn>5;JSR*B7#oOI^{vwHU|+m%qP_R7$wwd9^>
z=wYT6Idk<MEfh;#&OS44d;6yUT^keF6VEL1{jiGt!wl2@BSvhC(nGFH-1jN5<@oWm
zJ=4r=CHm(w9{h3gum8?&(YbTw=lJvQ{xbbQhlrnPWqH+~M?XyLet&%M<;RIrGPlz;
zco-IL_#Q2PPdJfj_ruq_SDpK^(3a)U<Vzf1=55TpyjojyY2VjXDN|4IcPUgys_0Hg
z|G4*EZZuQ)@jYFx<y9-V%zYMLwv7CnvgGP%BZ0*8LhakQe)_Xt`FmKnu{fMbZR*$O
zjiMV`Kg-+9wb*g*P|~{I!XwG<j7uB%r~gytQNLMH__FN1#^u-9%fx=mUd^e#yX#Br
z{>f@{uX3;NIIwuCy1RPCi!WVWt<jYpL5ctWE?0cOnP=6ht#wB6K+<x9Aj^GCmlZZx
zKYhC9*1F^OTMicT*(&#lHSNjyqS27v<G1vrkXCBYm3yz7K5x62T9fd5_brbug%=B=
z_eb3Di<`kd>5pm@({kC(?)N80+RjUKbH2utowM=L<|W#aQVL$i(ZLHBHtyX0;eL%D
z*MGBi)>r-aj&-Nm3050CukVi!|7@uidExQ5{_7EQk7!CH`v=Ia+O?`{jq!$xdtMXt
zDtN>`RHw-ENpF6x({Z6<-}X#3KY`?<e_VFP)Tb=`$D#Mf{FhUI=9&$$Y^ypB);Fa)
zF7IJCoTUEMr{-UXz01EP2RD?*TKxF=UBF#zxw8oG*NOkk*<${mw%+u<Nb9xEoc48p
zcO5=H)#Y#Lo_|-9lACYqSVgO-HHnvGb{|>Xa)a6U)8566ig9L(TJyMf+}#q;w0QpN
zJu<Op%9^YH3B2h#eN*G&@`y4^x!=!coqnuScj((n!9Ug(Jz_m~rgaDjnl040_&Is|
z+^mz8ISb=hgx5cqF-<_HdHeNG8e6!hc>YoDx&3!T(Zl;}tcM-=U!<@#xBZIP^Pb!8
z;Iwb?dKve_bUiN#pMLsfski?g`OMWpsxvOk+cWt@@aiphe{HVUbUeTLk9<d1vt4!b
zd5P__8fQ#am{@ru&^~d~)Bs))-@H>jUshgU>g@7Yer>;P$S)SbtCIQYx@G?_q$Ymb
zEqbF&XqV>8jg}Th+{`wtVa{Kx@1Br;{dUTJkuSx}yWQ`s*tVtdmbYQ;^2cU}>tfHE
zxq8kwa(iA<fB5pYiqM6>)|f0_9XCb0?t}QNFzva#3rt#f9ZYw<uJr8f*0!a2t0$!w
zD(yPsmFn&E?fVjso<z5cxtq=$H9TkN_UT0IW0whS=lM8eG|Kg(ttOOqtymEqW^i<I
ze|_iab2(>@{52BN-ryGV=D&<xeV)P>R)!yk8WoOjTd2B8dCRJs92<9?4c^x-r!VOq
zXJnuJUez$)TI<0~X&b@tsnuV$Oug;mVETCF)oU5)2mXC{c-TcoIBQ*|@Q*INq$|f;
zjzr40RA^jWmTY}J;$>fpNomd#3C0e!f(s2R*319*v|XkxyvCr?<iho~+l&&s6fRaS
z;#ss-)>hlSYXkrPzZXxRYDq7Znfowo{?1jp@9*tmn<s5*=zH{&CCj^*bw5i*7c+Le
z;z;w%nsfhG%*kcT)4O%@*Pm7OPusX_{m#dR8DBG2INUesKbG9sex&c$ED_z=p}M)p
zW!bGurmvBXedpm4`0U)#>3s`3FX>gKPA}+u*=e2j*3r9I{oD$MVAil-6PUyrpKmrj
zyFGr@>y&lIub;_>ByJ8UULkZ~_Q`GQ?1L+F-e0}x_tVLpvDPO44M(HZKJ}cN8pc^}
zp~{}KF0IN5H)nY%xMYP%1RviKCjC<0ZO(NCO}l5E|JDEZ+!Q_K717_;GJTcxzO-eP
zai!;n?OfN&4@vk&e`i?!Y4HcaiHBDoO>;F0cT#=#>kZ#LPS%>``%kC!zG3+k(7bZ3
z*r&FjK;?z8+FSIBc10Kmz0l5VpOLj>g6!gl|29pxUlPogwWzIh@59#>+q8nep4;Oa
zb|=Zz^;1RB(q>Mza!2t`(~2iwxv@h3g^=N_c}ab$nz?)5on9m3w74Z*d=|%kw@0FN
zGO-?OOz-Q@4d_>qO`bm0qIgfCLQM5-?yTxXUY91`aWhxm6Qd%Zn%uw|?`FoZJJD~d
z!S8npUn;IR8g)M~^mrJV!<%gM-|4XHO!EtcM-!Jwx7lq-4i=Q&bs?17zr$$r`X^~R
zrJL7&UTUSrsk>69=(5<Bjn_>I*H8bhe}`@Ak16^aI5OUU-TsO%+Tru=cUcUT3Q~K{
ztlgu#ZQ+wXjSuT9i<HYANa<9r`Z$d_;MJ^{+(pG#E4bozCM_&mx~n{lSJUZEOX|;@
zV=oK#zS4RBtmM{d;hRh{aYxp2ZHO>B-lQG)@XB2_RjZZG+|zg&ERWw{Uh=R`?9JYN
z@pddrszdH2ZaBE7afR6p)l=cT^LpfcICp5c#Bw<q>wRN9ym*<K;EpdI%{|?9Q(aal
z-CWLn^oubkYbT50$(<aG5lU_of*d>EUEF5+lg*_1LHJ_r3)?L9Q-9n~_`t`q<l!Zj
z^_!+ubaAV-sIyc~*mi%1aa=rOzH#j@lV#DRrw{j>-#z=Nk6eIZ%lz-JdN$p7bm;QQ
zS8Xh>{o3@TCYsmA+eIzE%>6yY|6qyX1DAZ)@3%TH&-VM-^rF=>Vb{CrH8HCM^E%ZM
z{}+8KJbyZ_W7{FdF5NSnzqZ?RyMNi+r1!o#p#0k>k2%w?S3X~8c_~1;t3&lp^~d@%
zqQOU;UZz-@-%Pn*e0^7iX_$2Ha+84X%F?H7^gf=uW#u3B&PV-w%mX>e>1neM{^)+$
zZhl<&RL<q8Vj*96%(kE5TK7t6*45DeXF}WkTe6EHel&jSVG8`PSIAy;vA`|UzVGjq
z`uF$j`)Bp*5=ZLG=Nu}VGg$jpae9XqDmUy3jPY@0OZm~wJ@cQa(5^MBg1&F`2neZ|
zyZl<~!y^w*ER`_W?{8G=y~F+4qIa_j?ssjuzi+qs9rm+(%>H~T{;>SJv98+mv^q1-
zLQ$^|3x2rlp0Cg#CY;&ICT3(*VWD$z*@s-^)g{iqo=*v~mt<?1x-NBk(y#0JcHh4&
z&6szR`@^pJK9i0d@9zER>OQ|M*rln=aEW~MfxADSn4Ns7C41HX(A;x2womzm8q_*&
zpK-3VHd|_xA$!mHaN^~C`B6WZd4<#e{ZiTb$*jpCB=x@L>@wGR_oltwR(#~J+V!A=
z4{C4z{nu!{ne*w_%zq!kc)O21`KK6QUG#U&mW7hFwaZnuypX#5MBh$o-jl}-m5!fc
zH$CUusrOa4=~c<9481+OqTSQp-?dep_IcSwHsL4!dU}Vg<%)N0-|JnT6p{CDk?`MN
z{e?f%eJ9S^XSCsWtHv#*H?JhWc5^4!O<$Lmx!?rz_HX+0XLc-H#lib9QsZENZgO<+
z%m+sP`3XN;=Lk4zW%vY!n)533SgqLVdingVvw??C7&tG^*KZOplGpT_oO;h`$p?SC
zMM_Meoz15g{MMH*sSo@pSaC|5DMyXp<>c4CeQMq_JbFWt^|x%lu{O+B*XFnT5o@)T
ze0IIdp86>DWt8u4-sT#2$hs?5USTrd`X5yWPXo49YJR^EGIQtW#ld&qXUqvakoRV7
z^>*i}AIkZU>RMO?GCKaTn6k5~^Gnd9i+6u6pEBXQ>7R?UKKb8q481NU+{LwgdG5SR
zv;Ehf3bt=uJmYKgkI;GXhjlq0@t@H9I@xu<^8PRD)&8QbyF9#ZU5=|N0|Ubx1_lKN
z28P_!;{3d%(#)I`ebm{`{QTk)&>=gu@1t*9ZTe9DkL&*7d&fOz&tSScPtQMdx>yz8
z`Ae6UU%0z@`s~-)LaI9~wp}l4xU=ui`}b#Fw5vuI`kY@ln}5QI#TPS7q|WxZeOgxj
z?d6B<4?S(tGEcT07oHaO(IoBYyz&X|kG0M2aL&uksd~SuCi2MU)u(P(Zrf{pr*hlp
zGuHc)?y-lZtu#+G*E#vgGUS_<*jaP4Wv*u54;AcMA;!w>tUvF0WMF0BthCUOqmfa0
zIUSptPUcTu(RIu-WZIf3u9sb{)@{-WWW8$Ce|e_()O(isD*dZgtL&SiThlau(NBd5
zt)Eq9o1U6bv_j+b<~b)O_4~hke*Z?0((WEFHF>#BbCw=h_3_h-yfYj{59aEg?mGM0
zebK#^(43f)vkqK-ox%3^G5_b+H!ZxEfApDHZ(Hro%4_p^hm7}%SE~{(F5y`&Xt10?
z=<&*OxjFwoUk?27?)u{Ldh35bPTy-|m%nH}?Ow!Lk;rphT5L`}8+M!sl5%6L2ocY1
zkeIXVUhW*fO}8)I{;F1Za7C?t=d_!PwDzt@h}(H$quT5@jDLiMCUMSo>s}(15cj@K
zRCPm-@2|Ky(?X}H$lUtec5nW@dGqGYZJ+P&e}4O;k~unRIj@aQpUSEbzxOde+P`VF
zP5FVt8HbEzf^QbhTI#&}>!f2Z6@Bd&9Nd#|__Qm}+1O*5Aq>ry#iuhTY&v!I(k-z#
z*P}mPef@CNV)paGLtWSRc)tJE#kl+9!+-D2UF&{suv2Xw%dPp-%^yGf_Bo+CS@=TT
z87;OT;m~`!Jr_c^d8oxrnKCo{;ET|iGA2v%`7XaMtKj~zZBKp2#(SR^I4YUcn4VYb
zZrLk$ZneUvE&lo^kC|-VTl-#gL!#9Ez4w$-^ydjL{&mIn`ti=1Nh*#mN0j6LPq)|n
zFK%TMJ)y-dc}`Wt&W;7*nJmUu3=brp6}*hyRJf%<l6w}X+^1Vd7#%8DZ#9P>{@D0V
zy|C)7>t+turq8U7&lF4x`K~U>(zv0crM9AO-KOXj>?<~;J(z3w%y;vl<noI$S_LQf
zuUb`;pZ)sVH?sxzSR)N@&q_&7aof37cHfWU9cTB4^QbV)j|u(U!tLUb+AUP#TESf6
zmKn<SV~2HCtH6<(npn|`Gja=cH)v!ma1xjy&|3P*;mns>zOHR~%=N7+R;+)_Rd*ya
zLiDzb?xR|!uE*X|_iZbUK5TkvB6mDcsr2Cy;a>|{+~u~e>OE)TEtK+2R5*U(UsW9+
zgIm=qa_WV<b}%Q}rc6Ju%yzmBtHGkf*Ux=Qu&(&nG|i&(xpBak?2xyA<7}2MIB?#9
zMRxLXVYwMK7pCjJzgxsMx9oej+R3iSr}Jhh1heujs5Uc;?wC{X`01GzZby@O%9i{~
zShl3ZzkYrH{5O^*O9k?dt#|MWFpS|zpL{Vu!!_e;`sUERt>x9xKfL`kS@`BB7RxU(
zG%cTc_GaqAyjW+G$VHQCcR5*JbXLz^>3A^V<~bXw#Z|ih7nC{3OTKmRK0Y=6P*!;5
z;}%!e@UMZpz8KB0Xcdn=7AJbvYyI)2$Onw<zqf=nm-r>f=J=d6QdnY;xzpgY>SmcM
zn>VxYRvzBb_2e4IS?_&46*|3oiHWQg5e4~-4B~Nf4qZ@JX<1zFeZrx2g5C4I%-u?}
z51;qsJfi3ob3v#qyj-z!{mk!|4IZ9hntJA4+vblI-z^`=`8g<+#s6XXu~$y(>DE_o
zTz}+b&lAnbKDLVM7Pn*MqK})lGUS??n7m&Wk=eH45`#+L`}H?<*Xc9subXqneJXoe
zP^73~0n_i}r4l+;JA4XF+m7su7qJNNIN2ak`tkwqIs*@}4@$ci9@Ku?rM!kGbGBlC
z#=U<_mUJ1vO8fKK?D^%pr^QdKexBj=$K->9qH86e(ZsNmlQaT&=DT}G_}VTx+x^JW
zgJ+iD9#y*u{}Z&YnCMuE&erYxq<Q6l)5Zypr7AD5FZI1v$oGxYLQbJ^&tq4%GgH2)
z>M`5C($zh?wUni(?D0W~hXH%uR=;m_Du~=;xF*~1htM3>+l}RuQm?x>pS`I)AtIu5
zkDU4bBU~a+EU$N4H-49U(aI)V?JD%EK>fxyJ~f#|acdLw4)&{arLkX75k2EDhasV7
zoy#_D#)(Io9&&Y^S!KBRx8X+yW~K@6nG*g-F?0twEKpYUI$5!LPm^QI%;T#HFND9C
z->ewlq^{<2dBIFIqa@vfO+qY(4piH2QCD8IStC=<iP>PS<+a!?RYEe>Yod~wofB$W
zmwfK~lg(JhBcSJ2oBVkFtjXdl-rIg#|M$DWE``65jLe7YznH&J^jZAcWVdglv(L|H
z+plZS$I5<T{@(KYd-zi`HqjrmJv}@cwHhawoHsQ8$p3hedO*W+20QJ7eO!m*PELC1
zaM)@>8W%%DAw#{3?jMDMh7AkmeVqT(VKvA3t?^tra<!}<@3^no>o!$4|F>k_FVl)S
zS|3C|)V{Z085OH}d}8EPHpcIBQ=F%+{NJmwhksw-<qz{W-2MHo@6n>ASGinu>z$K}
z4}Nmmu(SV|fJXPM`K+tOSTk(?Pc;pxzGuF7X?4DZi0X-NzpuLqd)oGG;d@tk^J%z1
zWEMY*?Mi7Db}PM;%09=}xL;t7_Sy3BT1L)?q5yB_`_)eiQ`8vrl{j{vey~z@vD@*;
zvud)gKU>!OSU4`x$*-C}ZNs}|x2~wXw@Ke}!TURhPTrgqhwjepSQWGH$&cesFAL<k
z{;o+_Y<96IOHE~V!u{PJz6RAl=)C_jX`cSyi)`;-`dnk0lQ>h|@LYEj>!IqmqITC$
zKXf(uv%mRaeeb+))#B&d>LqPo{{G9`$}(+*fa%oG@Aaq5H=Ca}pKShf_LsBs|LkjO
z=d*k$SZY!AOTBY<D1XVkuO~Dr7Bs9#a6Z^@mW}s7#F78u?jA+PdW#DRpYq-C(4TeQ
z!$P9y!uDm#w@&mW6;He6|GeYno`{SkL6sXDSgXz*G7C~U(-NzfmM38NL03Sx|CE;E
z?;_W|GH+NTzNshjY+~MaU{A;dsoVAsnb>>eHgCEjrZ49hQ1C;UrFn(cQ;A6rCU5xm
z=fL(7RlV~`2VTz-Kkp{?m)l^=`-n`Z-1oh+m_@`c>YiI}Z4~paKxmeRL-JkLLd(u{
zhk*K0=d}_S(qem6_deX9q1q^4bN11e^aU@J?e{N8Z1Vl!u{`FtYWV8ZbF+k-bxzk#
zE}yj1dG^i~s$XuZ2)_8!dQM^kqvR)5D|uV_jE}l+-@543$G<r=Aw#M7*ei?4m%4&C
zM4cAWRhrw;veY(N;P<`PwfV;{?l9%uf6%D%J^KL<gM~gK7tS|oN{ZiJywC5!!lb>E
z-%hg3a&Q#e_cOKam*k%GkNO=?#Gi=QxxT-=zx={JC(aE=?g}Z!b$3tk>s^&{txEdn
zh6KypgH;Ew&O9_-plj-}nq|pL99Xuo&X>|z)fzZizVGDw;Et=aq<-&7e?4=_YK4`x
z4jrKz?Nq0<yxx@<T&}jkI%c|7=aHqnoGzOjCh?Z4?G~SYtLg6MXDxn=3KJ)EtY|;~
z%gQQ5HsXa**Oz_&oOk?x!Czdz>Ci)l+pICs1tIH}@XIcJP|WoCc*;}-k?qz!bvZ#6
zjmk`=@t49_cT}(V?)~mA$J57m-5!_*YQ(uIFf8u~u$X2OJSlMgQ5VO>-5FY!Hk{Ya
zzT(@`X7RW^jr~>oj{dLZnH!R1lI*<8$_r-gsmMDo)Ec(td7<#?TvoPOl_C?o*?QL<
zxD|2Z?<M!9M`Z;&eSU8?%gEmOeR}QzuB=OJq0)?X_xjFe^8Z-5_)?Y{*X%-BVc*m|
z<?W#}SB2fq`&j<NP5pTOQhSzU-jI9U@kO$?tGDhh{(s`%#A6#o`7U)?DrLyLI8}7v
z!LtQoe;t_xUnv+qWc$h=ydXMj;vQa^B-;$GeBoZbp607c+ZQR7-mP#sm&80{cbDnr
zANePBFK<^V`?%=pA0ZCb!#~#R$vmFWWSeHXc*ESxNi_#eJGXG(wpi1g|2ih4<_PP&
zzpvdn_B{LhHanzT{j-+V`Y$j08P#{29r_aDedyiK)gR=ib4gz3);8g+&-m4_=#8ex
zyq~9X1hSd4jQHOai+^dClA5;P%;S7y)U~f`MOX4(UlZBAUMY9#v{KdN+N{;aD_^f+
zKUaG0<JDEXHdhO+#nzUkRr$N}be&<|5dFtI|6YdP6zPa{HZ1$aqT=suI2Kz`{@h$m
zZhf@3k;Lp2%j=KQ&lyJQ#$KDW=Jwt4zqd;Fez+RuCL8+6y>_wb*)4BxEIA!}Wp?fj
zmfi)^-5PU^i+!ENmXyoQIg(n+=xn95Y0G`n(%JXcCkU&pxwk^#ht0m{PtGp(<mz)y
z__3^J_Ub#gZ!xL=%PQ<#xK{U;(t@+K|4OylnrBaqK3`w=bJDKxv;_+?^0h8+2&^gK
zn(SxdVVyALZ@_j>E!~_F?quF&*L@mo-<+xld~j~k7q5VYseAfogt)q9a3^<8FlkMb
zb4qo1YjW<5#-a_EdM2)2Dk9*SKYs(;W~JySdvk@EI5#Mi@ofL(-B<1HwtoqGn{@4g
zEi>3dgUfDL1XX!XI~TF=!@@f{9LihoG<$tX<zGEvNzIv{(=|Sur);Yi-TN%Kk+Iq5
zk+y-hzf#2Unprlt&csG57K8}go6i*Xaq+UL+J78Zn^`$-D!X6pyFWEv#$!w3#I3Iw
zBOkAntgG3#<*>t#i#O%t-@NHPb8k|<!1mHh4i8r7)a<*y_5AmokjKKV)@K*J75q7~
z@$lK4+)GdMu1ppy{q1VA>Co;d4WF}<m-{jb|Jr;kEZe?Qaf#;%uZ91n=r3Z~m6#F9
z^5%MJ%(JNv!?^=v<Zla1T^n#lensrF#E>&`9jlHdm3IiUEjnAz@JjD)<Edq7pZ_J#
zzaFL<dtpsjvk;TPH38GA;6OQ*?H7aGs!}#&xqtcKwZeJhgO0W8z08|9Cnu~;tUrE#
z!_%Okb?2)hU87elwM_O}mG)$f&^6!p5-W|J@-}w4@TSCT^08*$H(BSkd_~kZk!i2j
zt{1Jod)dH=|F_k=U57KIqV^tLbo|}2EgnBBoT~X>N${7y4ff4_bE+`#rgD2~wso_^
zm8sk6DiSjDYAue0^8fSw@xS<E{-gdkb)S~)exZ5K&h?iIv-6Mg_iJ`5O>=zh^jPwz
zG8gw+i?nFri#MKFM^y)SKi{+Pv*_C|F})lgFWfov?|bRzn3B&mq2}^e_AGuGbyfYQ
z&W>I#pNlVjYcKt%zSs2LC!^?F@4kE8OH$4(el+`Ciq)lW#{O@Zk}IT+dOoQ2l8`!*
zY_R<?r*=cZ7ulbEQb*71J;CgCLGAP<!`tqH*%gUj@9FwYmt5^MQ>1U!t~IvG%ek8r
z_%_E)PA=Zs=js={;uDY0J!iv78}prGB{JOHWQ|{4*pfQIZA+3x9^<uxY@1#Ou9~v>
zY30^!W=rkr+!q_n@^rqhIKeV)M#R0;JuFS#R%aEMj5V|$Ti-c%b+XGVVO87TD^9)o
zqyE<8#JoC*ln1f*y#g(Jj=NlC*eAc_^u)v2n&Ot)Rev24pY!d>H&H0$+oR%@-kovm
z+uy=@+2`1QZr-t(^V5=0mUeMAqg6^aM}osXC_9MVb2-`6`au56l|;FW@I@bf&$0}j
z#v|$}`yn`iIV#jAI`UnxhQi^K3zqll<`@T-#g~Y_eDiaajHra;uiAZwUGD38$37`e
zi)=mfJhpoh_Zi=VC%bygwKrHBSROx6mfPOG@1h%ry36+4eeXVOaB$5MsPI@hMXT}r
zo2e(BZu!z`6UC}4yiCBwsPVb2<-UC@Rup>fEM!ZXetTta&>8pR56dpaZG1c<tUo(@
z=9wjYlaJWcn+x?-UHDRw{Jif&xq0t#?+3?KC5~y-3M>20O8)*sQ)>VHlB)uY9^aJa
zZh4W#Tp>4oMb#~3vv$dO{9cl?PbjD5mz>pSx%%G3heg0m_(O%*^bJi~Pm^WiUQ0?f
zythqfm8h8E#&!Aq?b`aQ%c6BEF5K7~ntbs_ubuuhxw#DoBQ<XJvZeKKicC?IKI_BR
z6&oIVpX1RHrDYSXxsLs0sxs@Jyi}N5J~FZIxyj$xe|2Z=ZsY!Hr|0#+OG$V};K6J=
zVLq29o!b`1-#XM}&6s5@pTYm?$|kj|zZ8-)w)lxfg$KKO<=#8(;xIE(LcH`w*poPk
z)D`FdOw{&lUoQI5V^fa#k$vA*^gnaS?fdatVoUO-9D_ia12V$5z2;dss(+Q}Y(9~+
zsC`S+EpG<F){yD8XE(DfPpR=`U+twP|9R?^eXC!(->Pb`{G;f;-#xB7`Q?%-xm)}T
z9Hyq(9@Pmjvt<6M*syP<=l(|wpTu~-*;pw4<1&6!%9HZ@k`Vi}_ttN8H=UZf|Nq<7
zY29~jOPR{HD=>JuusWv}zJHxnU=@37vg(1zGxD0Pre`i^-w0W9Y5ALJD}BOpr#?Po
z(bbjGd0aE$<Nm!#Mz--fY)hi&XivzvCAjiT1NX{#)}8Va2I29kh3{AEar}M8bK%RJ
z5^pCVlU`1t$mF|525SPAd=+U?+h>-b=a?9O-DqExQ<3NL%$?7FepO7quXx@5@0ZCI
ze-6&{tF%qoG*#<yL~zcF6)&}RJo~VdS93zbuFWS_AN|^sZ}Gx?j%Cb(;3Y46@7Mj#
z<^Rdf{V3Fg(X^Vc?H)^Rtj?~Z%3D^(pFC=GjY;991RGOu(?tF|hq7NBTK4v2cH;}h
z*&DX+n(NH38!RHrRc<}2E_aJ^*3R1x`CYAlEmBzFta>u>Tg+zR49C4{C*JOU*1+;G
z;+M4UW$sq9T{@dn0yoCRTfJiH|M|f&?1p;K|II(zJ}QTPyAhzD>$b>4%1Ldlxo1oM
zSJ%sv?IdKk%u6ZZ@S6PHcE9V+M}Z&Ma(~}5KPVTyaNUa4rHrq*-rc=@<yE4&;a*KY
zUn|Ef$)zb<PSq5*c(Z@Fq$;zP&G5`mH~IMo7;G{poj<RcdZOgcjyA@~wC+PPQ{_%=
z3AnFwR&4X?efL7&ob9r7{^lM(`~UH&78?DVWzLpNeABJsVB7C^-+QsFd9bTT^f70F
zg|<IkeoHxC%sp{d@ND)YJ&twXKbG7SF6}9{VevO>*%-NYgCv`5`|`sv3Aax6<kx0t
zvan?33$Br~%e}cESfIwwHf7m_13Pon7P-WWJ?%8u%5}9{A-?p=A{}3y*I&-9h*S2}
zJ|k#!O<mt_>8(8zUtX2zowlL2aJi(lse9^V<+Bday|F$_>Sfy7g3T4J`+PG#-LC5h
zJe0`Re9|!Y^{G$lQ@hvw$jGi}Z#{f_^LLHHV3Fv&7jN6d9=G-T*%`|35WX!n;rs1p
zdh-@f5H0k(X*K<NklW_jYkZF%P%O&r*!OLA#m<K*#vQlUE4;QnC4bS)w~g&pamb9O
zWcddI0oM*JNsg8HcI!IZ+|@f4TzUS|MDWhzevQH_Nw-X{xL12+zPy$3*m>5(U(Z5L
zGkK~A3Ylff>X`b>Y1sP7Ir+=hjd%X`F|V<by0A36+2DufN?9|`w-q;MajIAIT=iJJ
zYmu(ZGF^@)iAiSj9<r;aT)1(tovA%{>#FD}5fggC4tX0%cYgeJe2$S+<tgQ2;U&kK
zRxotAeVfpn(qX83P&H$^Yu52ews%}PujlkXaCd!o{eWg<UWfbTwJJ3)X0x9CJ7?J~
zPoED}+6y^f1!PvQFPnEiSpVDpyTR+fmzpkD&kJ|$-+uMEy~W(xcD0Z*haWyn@ZF?3
zcT23$ti()VPj3qs#;>{TE=l<-*EIZ^b}WM}?qx>oUjAjPGm=fDR~=}5{^;nv6KkJZ
z2C%E#+H|SrUb&0tniB?U;U_Jxu<n?e!FbK7tT#jSA=4qbPTz-9KG!YIRla&&_p#mn
zeT+@=GuJKKvelX+NWT2Kn4bBH84W>m^!_|F)Vor&)nwa)Ysv>C6<fDSTlBBJ{LX8I
zeX&o0_+IU!`x)QNILVUir}lAgvtj$jh)VaFH?sa+%eazyeXYY${dY<>AAY7?dUojY
z4dv<ceWyG$e7CPzV&RK}v*N2uca$Beap%eRS-kpCRQQDc<<H-Rx<sFkX1SDl%t80?
zgv@7onFlRJ-PbmsfAnM5w#hlw9;ULdxI|BfZ<@roKv2+RNqzJ@{WI>l=Qp{zYHwzF
z@_YZ{&;+in%v0QDUKm<!n*582f9}bRChe9oH>UA9H1;j><C@N6dbGEt#P8IFt#93H
zCtSRLjCpl&wnT#5t!r`}#`ou(xf;s2TWtUL*cJO0$Cj}t1-yDIwUgbbsrg9jj>$q^
zx98{UN=)RMD-c~08gWPLuIO#mT{W*F<F}L_Gf(;P)hr~?(n2JWW6x!i$ZMSDS3|=-
zt>EK#%zjZ(;LK{>^I?VC^qr3aCBLezS+d>a7@wE0pG3wJ#w&Y|<!=9{<#X;r|HVry
z*1n2mU@Mq*N1{<)HtlG_?trx}3&g}zLOFz_m)lIKIL^LB^!=-+E7>-$WxDfX#r$=r
zoUbQ-i8y)ujHc`c5s^z5B$}4^YEBYbXp{OteHr(ih$XeId-|8UnLnKvAgVEGb|Kdi
z$(BuJ@5HCSc9_zY9h|RJ7`wvMODq4C$?>Ngla9Hq`mwA$OkP@ZZ_UE^t20(v?{3gG
zJgZT9SK%%T`;}Aoqs#T<TlDAg3-5`~v+x!_+h@uiRO$0ks`lU2H($c<W$p>>E8m${
zHdRYp*@5RrmVtwH^ZC}6P3{L@e9@M(R!C+3b5z0b?XTtyF6NOo6T=r|o)Gx5?ZlVa
z`<mM4z4%#K{d?xRo}M?+=}Ic^XTC|kYw6{E;HLPycM~E{`!6}ZTR%R7JCyh9BTL7<
z74Q1bOfa)+bq})^QabB2k#}LXK&bz-`sJtPx&$?ppC(+)Z$7o0&9b(aPx3ft<)Y$l
zQRA;07N2U*+;rCAs#BTzB-5+zv(-=RlfS&}r2I<3o!?VUE+2P%{4{Azk8@twhJO9a
zZyQtOs?E=vu5G${{R4k`eSQ0H%aYD~x&HOjAN^zh+a&o{h<9F1_M8mX=DR7H&-(8-
zd|se>e2a=e(?xNiu+tOrpYd?*xn`zY_hrw~zT9h>UD;8wQ&+AiPHw&1$Rho2@vBCs
zTi4&;NZj)E@z;OHrn$RL6lH#IF?WOY$G;06U5_#PmHRT(r|9z54C8kylWJ{$3&~8J
zayNgi&+l5Lvlm-EU%F_E7xCVzyt?H0nI|#L4l@q0iCGF?3wfG#I&ZGp<5^}u6FJtZ
zP0iT)BsO=J)<UICe^MsB*jM-|+JEx)3X4~5;_qE1Ue}S-$&pzZV7x^2EZ?>7I_WP{
zEjRi$gekpgw$IYBDqB?8*T(O0{MNIJqIO!ct5^MQ`<FaF{-(*HgX+&)lN1t?CB&s4
z%FS0(WjSHGy`0lcQ`I2&*kq1b7hA-CUuS)MT;SQw7S@Wj-<-@N&-`Xt>^k*qAlC_z
zbDAGlJ$Siz$8W#W9804fH6FaZBc-u;OXq@fk57Exu(B_4)?D}NKKEj~pX+PP?@#|I
zdh46wer3;3O6z|7<l*ICygSIdG|?_q&SgsJ1mCZ-AHOsTeZpk_GVK1uTQ5?JpSxO}
zpOvV(KG`9`MoH`3<?_isftB$KGS_|KcwMyZZR(t|e{&Wpeb>?rulsOej&zj7jnXHT
zpQlCHh>K2{nRPwtm3;aR*UfUX_xVldX0_V3d1YK*!oC*|b)rR*zu7T=zOTLh(VW}b
z^ZD+dvI(~N-@9&N>)Q`cmVBw2tzTaL?+(As`-*94C13SsvzPr(x;>ZkQ|IN@;&f%R
zH;R@WjwUm|NPX`-R=Vdv7aMo+fl_5@xzM6Ht%iJlCyRp(%S20CY#dx8mG8fMXx^4`
zp)w?2D$rYM_4+Gs%##<r(_FM}@r!;PcfGSxoI>ARE?!#LQzI-nODIq~_t}h>eOjkI
zQw~ZVH<^-Lt;o1WU|!a`KABqzi;uDVx@A_GQ?={phkff#7YbZHf8gDTmw9LJY%kt%
z{mFqiiQdN5g^I_V_RAbOaXn0ZmCVd*dj5g&NeO=i!jE1)wJ6rj@3Q@)*yDSO=B&(^
znxx<>!+55<g74ANxx6=y$m(2Cx+bWr9XX+3|LIE_Paig(wYR@tyYtpz!SMD6f%3<>
zTVEXxzjR5e;(krx>>o$&KXxv<f8xf(2xh5{t4^WIt5!+f*{qpVqwC<m_e;k8=iLp-
z^N)$0-#TN?&aJ$UR5MGvmIu2%eZG5=h3wRD_2M9f>kF1l)ZEWDf98Xg4=10T)%!;L
zXXM1UFBLK$Sbo^GvLxn5qx|=q9)BcuKF@BCl<h297<AaDn$1r@X`)|<&D6v%yS(;4
zd}Vb>?)KlP8dZkl=lLgpSYgD<l`YE|6Fc|F&O_niGvDlLGduK|E$EEclJ3kN6~})S
zt`+xJy}zLxAfOzatfYR`Sohzu<5pqSMPl#o@XW3%j$t_Bt)6q1d6|Uj<4>9=*Z+BP
zM?LyX_c77_E8XUGjQnT5$ZzfTY<{@^_HCuyJ2uQWcD>B#5@XL*QG7XNR{nR5i_IOW
zmo}DXuIsFvc-AS;F)O96>5|f{#hQn`{!Nqa&e-fa!}i+glMX&U>$%^HK1!Q(PeAl`
z)sow48xvyhHi~_V{Jq5gi`OOpjD%|*bqraH!+LL<xLnEDmeV~+m(SZ`Zhqby(QfPJ
z*xlQFr$(Ip9QL`HU&B}UR;%FjW7f}m68O%}_GDRC{^}9emX7uk$Kzl1=KPxE&9Jx7
zW1mju>GrP<fz36RCqC+CrWXn|&pI|;ZtlFTimT%%w`8!+W)r$u7_~8l*XVVd+6&jU
z=l=fs>akB%M{LfbWZOCU-N%-F*GmlCbwW1h_^V}S5>9sQt=`+@{rb@6iP0JlJ=<NX
zer2m%`s}SdC6y<PRYxyWM159bPOL@rEWy&ZLL6@uHl-dG?%n6nfAo#UmrYx(pPc=(
zW$KQnJ5!@KaEH%Zl5_QU{VmzaznDw8cC{+ZEKjqZ+WJmZ>H4FRS!)w!?((f^wOllR
z`^v;Edkl9M#_!)zK6m;t*(=&1b7t9RrT%_#Tj$e}{bh{u{n0LRd(E{z?E5giaOW8z
zn-`A9AMz|;c4onb9oOD{Uw34-q<7G?IDUgek96`mL_A&|?Jhatepqa|`AyS(x+0;O
zY$w(|R{2;_dyDf?{x^~LMh|@!SRbp5@Y{EL1>cg6Sdm8)HnnC=yF6R`hjUM0yXcA&
zauSV_ZXVzNx|+)FyK*gZO9_|Qhvvh358Z#_^Yi^D&F_5w>%RPa^W%&1pJ)1pmABYW
z9yVvb5x04&ZIZ;F_lZrPl6xKnvA+GPW25G@p2K<bbLokBy9J#l=xDz9m{(N1anB95
z?>{4*e_XqMu$=4cRoUcP-@Q9FiQLXNxhdlJ_25a*iXZ3uAD;Ype81=FjwEiMeLu5;
z^4UI}5KOn(_eVHojiAV<_IA@}{mUDE=<+X?Kc@OiveaO9(yJZ8`xWCm$`wCveZrf6
z>vyI38E=d5eL3%*&wXEabIw(lxm*r28Rr|m>Jxv?ul=U|fWbL&=Utr)ha;cuWqzS4
zRQ-peJI;oE`ThO}_Z_B)C2Jl0TOVn(-Rn_Dc=zk9&ldU{Gvb^R1>0v|FR1i;@mY$;
z%OWJsdFoDu#cLj}=y9HA`sD6u@ra`E!yn%WX{l`Z%`2h$qo7gZ(DCZ(FQ-4czn{Li
z-+ey+xqiM%MRA88Yih#RzHYv-f5ViAx8E)CdGvMHqrH>=oZa$s(!GD$cfM7n3-CYr
zzsEcO&k<SoiKlh0`BwaRzW;;z*KN%e-)hQ}iw}PkTQP0>%$3y=>~j16oUmAA5MaGL
zP4R9-is&V=d6lczmfhy}zVf=iXZHG^eM(z<?k%kRKWX3H9q%KjTYYSI;j}Z+4_sv~
z`cXpl?&&3;pE7^kA|1W%W>C%S4MjTpq;~T1ztUcCcz4~5Qb~?S$NotCNVgM+wy9ao
zcC5DP_}RqR!$*um3TKIY_*!Yy`SY*6*6OG|Ybp-!%3nS2lapw}s_w!n$wiA-99;Ki
z_JXf#U)MbNX4+a+_v_)0xtFf}zWvXmdD+Aqr}=Z`=Nz_oXO+79mwRmoTj<m;>{b59
z!d<7O&8<>$h_3qd?)v%V8%#>xbT-7@7T$g6=lc2me0+xwKi=HDUERIC?)tnm%^NQl
zr0*&XbKL&*`<KT*4;sEWa4t4X^xuY$%vJ|IUffY{iM_md@%?kxzdZjwvHM$idKG5{
z@4@-}_pXYpe`@cT{U%@BvUQ&KY=M27-#M{|$wp|eNp4py$?mtGUuVg#XjQ!>aMA6F
zAKxAG3%PzlH$=W^rocS;dW$NPMKgO0%awMu<q7?5pJdvrZ@o%}@8+Sy-;d`Xl&msg
z3;O+I-N_Z!J7xad_uRZEah38}u02zqO<ugYe%@U9+83*?Z<VT_k~Cj5u<q*0V3|)7
zk4EhEUo7ltTEacM{~^D|W&VD3S&{i~mK|Yvp<HZuGEH{n%&mp*o_v|!{`t&`wP#kG
z)0RB;#w$$s(>hs!3)#C0%S!$|z0Cjqj12#^p8ubw`_%>>=+}|iH1}omidp|OHceum
zIQ5Ufrd3J1twTBfG<Q@T5D@ypuk@PH+2caLZ<t)UGRFhCnNv)5_p09w<6^wE=(^p!
ze~*8B_{ej2&y2>Or;a_e@qVoJIxWUbYwLyjx{_}datY_k?>Y-+zVz4=`FvvQ!j4Ox
z*Ul~wS)hC7PtAvqAHF!RuKs1MarE!fycVG+%Es$bSocn{ef6eorm5WQJz7%n$u5l#
z&z?H!cj>BrdDx%ABXOtl`Bk^A`=Q*aYwhMHJ+)3|V&=5c&B<@A?E74NuJ3yDOxGm)
zZ-&v~LX&-q-dumbAS|pdXVLC<&TH))a$<5nnw^<N7c*RA)@?{zTR)vsLGRFe7Zdi}
z#Z%t1?fF|&QzRibZw|x8A4<}nUryhw{Bce044x46<N4u>9-XgaXMR+9e1<}M&g*|4
z+uz;hm-)djd^q)-Q<zJ|oz>ClU$}B>e?4Em_`{3O2X9V4@7|wcp<BQ{IqirDk9XTi
zv$?w-tor_bmfQA=zUKRcA1G&EzukVjZhL?JpS$@sCZdi@Ek8_YTioA%PKSNovk(6n
zQ4gHB!z%HORe^!wRXP48SjoAG*{R?YC;k@SHrurS`T7Hv=FY1ozEpWz{ry~c>bz|0
zmCHNlZk+q=u7#YOtD{&_*OQNjr=9!y|6iFn1LuSVIooS%%Z-<xIU?k#Bi8-*P}0Vl
zbLZ^j{+$0-E%<rMliTjb^TLw!DmI?}_DLh|!`tfzPp6;1SvPGxcj49*H(pO)zwch%
z-%nq)%l18Z!>qq~%Gn>h{+ntzdn1o7e!4mRvr_aXgE`kjV?P+AB+X2BJ-W!`?5Y()
zkx{GCn=(U+YJV4mepKq6#60h_NI>WH<ZE^IF-L8VZ+mw1bLqMM#j4>KnpBmhbgX34
zJoO=L$>ulPWV};&HRLNlG9J?ivP(-1?f9Z4sLCT>^>p>Bjz?NOrv%n#zW8XgD{sTy
z{|xqg;Wq15uaP)C|M`Wk`kt;yueIIkKXvMOKXO&MRLK26=UmYN#uKvf?N{6-M8g{j
z870)sV`81BJgDDsRC|Y}{vn3+nyC0p5!15MD!Z$ebvo2HXfZOa>7FtD(?^?CVr(1j
z4*B0ri(6jEx?|cer-NU&uh|)<_sUD<S2%0PZrw$De(pWjxJ*au=FiRPN$1Wrf8Jkb
z!}EQ={hj|0U;McH&X{e!<EeR<EzYJ_R4I4qsG41txg7V(Ml$_nOw7yYS8U{$em+y<
zx8y)U<-v#l88)ywJr+^8G)w7v_-~dM4d)ly7Tw;QUMMtmsf!Tfujh<K58muKCu}!q
zaa7u7tA~o0w%=)O+|RDIi$QMplHEnmx^z~TP5k&GD&)vH_svg@yki@DOrk13{5Dz=
zQ02$u-MdHV!L#gXXCqm!bFh4LI`A#e$WZ&H(k@4>5J_#zq+`z_54tR6(0#o`$RHw&
zbAq{A5K}Od;1nl;m%d_?=dc%v+*ti2iBaUXsmuFEHWrFMJ0^9vEtx(&C&}iqe7eTs
zAOAfTeo)r;%2@Jb+68BsX-cA}t5&v^D9gWEB(UoBh4$}hpGrUUE^jy$7H;#@mBlFb
z(T~+hXKVJIS#4T6DedjwK>iIEOAhJT<e%A-Jh86x!|CNAYb44H#5wgpp6Xw;W^v2h
z(62rzZ?1Y@S*yR-oB364n1cDXf{CnBMT*i6_8!yHuVfs1&NH8PXP8yp$;m%w=$_Vo
zv_<fC-Q!CuCOLm#-V`9d^0j3ByRG3jWtsSbW_+q%z`3G(jbHliH+)sQzPqtmc?Xns
zSy>b~bzER5sk&Qb!hGU!YQS2p^9{~Yk&LH4t;%7Pbh^k~QJA@KQoENy;L7Y<7p8{o
zaPVHJpuER$b`#s4Ju-_Wo;f_*a_h&O&c4TG-FJ%<TINWEEvbyvl#xhsHJYwlxz%Cc
zGtZN~Vb8e(z0UT$sn(v<(zrExvnG3YYg@<p8~1L1J{-&%9l|8h(~;$1xJAyRw)0Zl
zB@W>oCfp0A?@BQbR9vJfz?R8wWD%T{cVMG>_tC(v4j022(}m{6e`sQV``GR9`%PJj
zM?){k{b`!%nB*zqqPbRSX^hbaI~D`miz|3`eO|**s<xZ)=XtaH$0F_)%UuYOe*4zb
z{Q2+QhqtRQZ~x0_zWgRbi}1bKNk;9xnj4mX`SIk=oNM>9-EJQ{w&ayrR8Qdlh|9OK
zEWP*Iq%W75YG+=MazOFP{4)!r&0@cQVSZK3%w(tfe%H+N4#r11Ih<Q1l{_mNqi^og
z-hIY+j<^B)_3bY{EAE!<*fFW5MDESf?1bYgUh7}I=;B}b-|!LFzQoujUaw7>0UR&c
ze{EyvIMMsz!EFwS?u=$%pGSL`FZ1tGm~@6C&XL7t*>4r?h-;R=oPDJ){rknaXxh^`
z3%>5okz>2=Z_oA5;w#_g{hUviY1Yj;ee2pxbH;5dF%0Jxy<hsE<W9kYWio4cS8$)1
z(W`Kd%dUHsMur^6vaKFzVhmHx#IqJnJQ#IIPKKkaVfl_P5=mdUAK4tYcaS%z)T}$Z
zEI#RP`PNT*x&nW9Cg?L<>-sZQbXD$R;RVz8EGf)N{OWGb5E;L-Chfz8dpXAz-SqKz
zX0n65O6SM@Y{nx7mWw3ik{%~4Kd!*^WK)5Kk9R~~Q;)kSr<E;-O!)Fg?@jL?*yB*0
zs<>q8hWCALx#|iWdp@{3DnI_abjACL(;xNfR9<Jg$MxBzUh?LQh5Hy<KJ?c*KS(Nx
zlDw3|_fLJxc9oq$fAa<ZZ<?ubN;e{w!SsTvxmshwHt&f7^WGE`NH$-V)c??TbFxUu
z72#Chu*5j^lTo`GdR4boEsRdQ{%PB+Lkx9nae6$-35`rq5mNmx#pMp)3FDB<QLjm!
zwpT~6=UZfi-lNwoi(Mxvc|KeDppeZi@x+q3^JV5V+|>0j{WM!+Wn-1Y{o5J5GNFr}
z2ArP!*HtY^uIBs87k?X@cLg_U^J+&ui0-)<d5E=d>8Xgz8yU2hI*Tdn&oo^q{pt4!
z5rZ$MbXA_{{E%JB!DpRdK7F2f^YKMa>q<iGPhB>zGL!k&uvd6Xz?#noUcXAsTJE}k
zy;-+MgKe3v3B%Hfy~&eeSw)_{xIfwK#v_FtN^^C&W-#1OusAkPVwZCMi=Bo}=KFlj
zP1*l>oMqD4xN5=@Zq>y*d5W_%x+**kWg7BYr~UCuIe9(mVD@9Xdl^p{F8A{Nd^OGV
zrE~<R_&xEvJNH~+yE$+E^5&TmO9C4;d3wJT<RoNlvR^7*yhK;wIfqJl=A1L4hB`+s
zzI0u$HhYq}R^<Me>7wyQERi~zWe<C0F0CoZ-?!a(p8H4BSv_XE5~|cDY0OQ(u&mm4
zrRai~Q(9ih@5<*bw|IKOG-$d^rTvGmxnXB+OxyffciS4r-o^RrD@+Uu4Cj;wT>Qs1
z=i(x^?;8uX<W67Xl}UJA#`e|fVfeu?hdB-L8YfP@uGM<sQ+adYYW@dVMsEI7a+Ni1
z2o|#P)|e$UuHn%TQ$Ljv^=q}DW!l-R`ZGOzKR4bHJ+)xnH8<_#9b6UeB`>0mpPn{J
z>cAoniId;A@qe>_^S3~v&cgD?mwyI-c9j47dn8$Z#&>c5M++A8+;LNHX-!v}mg0A4
zC&O$1U#H#Ir>!xRDCY@TZL{EO%$k%Nm$%EVbjWPpv|fJKvbCnt_l}Fns=jaGpY5Jt
zd9d%T??KtO9Sok+P4uV9ainip)|NT%V@&UI^<`bzXB-aAFg<l4LQ~8}|B6?kftK0#
zeN){mc$RkYJd`ezY5Sh0kQe@!!G7YJ&HGkvXxjHL?%w{7Ya$jdUHh~ubYbSsOsz`~
zJFaZIA@$^*)s#sM>kgV|xt<BB*&n(tTKV+Smdu%*KV|N0-16#pqN8GyqJFVl^9;oR
zV;=5#r)E97$W^$pqPCQ~K0wG|8`F`VQ)}jWnsA-^YCdh%`J2%nrfYZoy2Pc_B(KGF
z``eEVN8hsMUG!R5@I^PYnImhByVLGB{Ev^iRcE;@i{8|{^Yr2W-0CY{I=nA6eeji4
zy5jb=r_XQQPC0n+;qk+dn-4$!yPq%N(F^+>x-Lg+o1bRbGv9O(E{G_dW3F|W<M92v
z)s0V5;{zI+m+zC<X#Qqt$n`jux_#;EWK^pg<xUkEs=f8T8F<iY2k#dnHTSC3mtIOY
za^<yOJ(XYl`4G3&M@Hs1-JR3kt=oL>(R+@985OY=x8EPg6`Xz{yn3<qnafshTjqXb
z{`KbSj8xNq=er+;J~lnJA!jP{$LJZ!TV)$|Pg;?c;l9BA!rxsAb1!<`$_<g?zWmNX
zklk$Nj$=O~0_PcA%(iCzTJ$%kqy5V#uPEsf+x00Y*1j(hO5av{x3juT`+zk=)xq-?
zvk!Lh94~m!yKdsMdncEFzI*<qY|yWN#a;jT{QW<21<hSoG40n~^=OVOotL&=v<#eh
z{>=ei!4LelOj^-b^V}Y?Us>^Y%E_x=j=T5Vn&@G^cXROnj=l@Cp1QUbubb0$Bz1p6
z=8c=`LCsm0S$4fnc2zhP!@xbIgDY9!-n#bsx=FbQ+WQtueU@02W?mB3A-zF<kI~`x
zypq!_cUChpewmsd{^`z#J3`T2cQ+n?o)Z{axpVjCVpg9Zf5U4#oGk^G2t2(m8#v8W
zzx>~qU+3@hEDS1W^?vyF-yiYwWlGj7&P?WTYmIjDow0Gva-$p5gbrN0J?*-FtZ~P|
zZERDH_MNI$u-Z0TL}Ih%;*gN+r@IfnO?|DM$kDw*f+^v^nKbsvAEVZC9;khP_~Ffy
zg+IQ%_@Q89YiX$-e*Me&+!Ky-lU1(PD^<Mong91I&u)endLLHs9prv$eE(h1gGl2;
z*>^UC31kR_@4b3){X*fO=Q=g@C1v-P3eLB@B$D%;>*L?1A8`wUzWd5$yI+{-SEE$E
z{bk>?OM<CJ0++L;51jsgs4PP6z@i2-o<mxnKQn~g>0V>-{MefXbLZx5cbvN@J*CW)
z=kOfU*Vm3!E`BqiFZ{urd3!JaeSh_h#6}I}&K92vrDYOT4fgT-!{Yyamj0Tmsy~&x
zAXvjL(O=%u*C=x7Ztu(A8rQAanh<K+HBs=jZpP31%P!t{c1Gdskw1oIKg>LSo>X=X
zICcN%X>VzP-VCSz{p`n04ePh`OHSFg#vu9j?KjPLazZjqyc`}dyY1mQ(>RlDFTdL_
zexuYAe*|Vs<LYN@>fneuaE;ZxVBtplWwvTPHxEzrkl3=*e5e1)-%k1G|Ce`aHW=oW
zr(fFq<GtEV9gi-lJ&qUN|1*l3`bfU!Qrh1OlcwgKJCW+HxX{6E^UKxd57(Zp2yspp
zV`*F{SJl_)wCPZq-Lc*P&oyq2lkPsM>t9&Xu>R~hciZPrpS%&M-OBsHeZQjOl64zS
zHc0Q|@4tG@%w*bfo})J!lxo<R?DpCgG(Xq%HcWH7u)NrPEo=GAbd^t)eH+!XKJ%pW
z?>7^^@wv?Vn{L^cv^D?UO%O2M|K=z+--Kf-6YqQE{W0nK<kYrPCssp$>+F_wv#;zm
zFOo3PK9TmZp`c>jkAq9NCtmv#`F>s5pOf*TtSef0uI(~ReX>l|-@EbH#{F_E4LhF9
zx)G7FQebf%clGq&x)VOVi(92@Vp#s&=;Wn6n`CEC*OO=1d8xZF`%<j+gIbTGn~&G)
z#l@DHoxc67=m;}Q7*nI+8+H~~p}#&_{tc^VoMoT7>$7fL&1d79zpv7b_6gNWS}dO9
z*e$!1?HF%jPt_Fv1W)$;GySISy_&f4>-|ny^I%u5SLe1{T+ZKjtI$RJir+R<zl&aT
zvU&LasLtVSzM;Uh>MgVHQp1R^H+m+SG)OaV;CBsu^y$9(QL`fFBj2vORhys6TCz-P
zvxZ8c+~({Ly>85hugOn-EPMIK0Tw>LyNjbwX<R(NMAe;7tYTNwFJJYig~FRMjgB1t
zY+%9eoVEPwS5vo|#JlCnX&XA0mu~HGUU|ks=-a;Q`4M?MCQ%&aTiqT{Y`Rl>Av)vl
zj&4te>4ysViYhcNHA@`2|3!aSN6FQflP4Z5Ei4Y4Wc=jiS?2D<g*IMW_p5I2(qwS7
zKK%DbfPE2bZu%tIy>nN39MpE&aqQ~(`7bv)mnW-yPAdOB`*g3vX~q>#nG^mmp1kbZ
zg_ddUk1p9R>=I^Qw&8HvHKt#!p5N}bTnxD#e@6O8<t)8lZ@*kPY<0qL)AAP!4hkl3
zDn9d!^+C(V&vEZoyo&z$Wk<AScUSa_3l{^W4Q5rBo1FQ*ppnPuQe5w+JH<cL`;}W8
zubJ*@te>$#f3|MI<D)qYUni8Y3))|OzHyJB=MCjqD<<pT)8BM)*^-&ZS8iBb_Hp{X
z7d<U~SxiO3TMsuc4z|u;n%R8qh)nCgi)W)MId*?{xI2}v`h&K>^rX9bpFgB=O#e7T
z;8Mm!-NeYVWiytG@%#vVdusZ;rS2&@8(TLVej>N8vbADW{@PCs>kT6B9$k5kkymGG
z@1MqdpLR_4O3<BEKiQc(`Psd@@6}r61t#e*O_?2RzeQN}xl5YEBcICKw=Evt<|^i&
zXxiVY;J)Q%MP%$lP7e7i^7=gDH+}a0$vk+uPB@Th`opjTKI$!EOqVAcJPnoa*Wh$z
z4v|~9ZN(0oGpg1{g*zE)eIqyil5st7PUECQ(?6>pY89CcndORq*4p3uyQ92nzv-f9
z2Ad^)isvyb^4+zvvut)u);rC5zlnQT<-!jOa~#{b%3kEV+Dz4|DI1>cJaYFi+q|8>
z-l|>QBH+RI_u`BDGsR_H>b{@p{$?|w@QmyIBi<Eas>^xJUYc6?8CwSR{F__(F*+qK
zCdX?&gMG^H2NmxRKXi#Y)Votm{DV&3i8;PJOJ=j|>eKiBSZ;i}V8Lg3e*g1*etqiY
zvfdvJw0^70+wBV68PS-ZxN8<Kdz@W^V1upoeQWz$+aJu6srC(VW!ri6&YV59uX9;$
zoc7(AUp{&J+AA}7-?jy($-P=r|Dhy!a^1JH_St#8*R;RAytD7dAMIz?zXWGoU=RFs
zXvu?r+NoD_JXXBqJkqvCYPTF~m7{F)iFoPCKi4!rt@^N=`;7a%4;!ot)HZs!YVa?4
zd6`fAuf<-Q8LF3Fx6ixybNyLO&F8_Fv=0jVuV<h0^V~}<uN#XlyL3(bpkwycxs>sQ
zW9aebTbJGCzkjR0QC%*v&-Q1@9ZQ*%1vh8AelS0*#eFgPc*O+9#q}`<n9_p9^V(m%
z5%ti1^ybCt&5`S>t?ewQ+qTK`oj>=W>-y~aket1GY$CFrLN+={@4n|fI(|8O@0?9K
zw}NYW@7$aGDw9v%lk=GRv&cy)+h1s$@?@P^Vs(1Q`YRu&R=-F-lFZY!q-#>Ajr9i(
zKC>%F@{PA`ynQ=eZvVoifno8wDbwzxuTMF4ZM9c#R*6qS?{?)w(tIZ)Y~1JcZTV2;
z%^neQ^6DC&Yermo57_J5T}ytmYzuzZdvo$56W%ii6Vhf`e_1-eWv5Jy&Vj|!JKyKl
zew$&trav+=cl8>L%|^}#?4|~-NEFn}`(U9cWl-rLHLsa9Xt_gE<h6s-Pr6%#e+i$z
zlQBE?=)n^aYG&%mQP=OUiQ0Jaz5D&}bL{gY({IYMyA}RgmnESh`ZBO@+ZsKUP;W0S
zKlbapFE9KcVcD}+cHP!HrjdJA=sSwG6}fDVzQ1>_M0*mu{Gkc6``F*TTct1ei2VYi
zDl1DpTh_^U)w_2aU3tg1Eb`m`SY7Vuh$+9`G}eE-S)8MNYjS0yqK(zFE8C;^&&1>>
zN7h^U3F<7o{U_;&Xj*9E&b@z^MMkEd%-Ox>S_I?5vo?WWsuPk9^0~R5$_uSocA&{R
zLL{f_s>rH}i(!6FI!|IYXT~O8VPM~}WGREK*ROSYJ8KWg-C)s<_|nHEExJ(e_q6#;
zdy>mGcRpo`Xw#cJ(K>1G>-e)(2SVID?j;;iy!WbS>NI}yy+@s=E9KoT=Dy5y<a;Tn
z-h)V;r)(J&_tMkf|Bjq{X30Upm3LU4X#4D%x_L3TmS>zfbBNKMd-uN`J^$Tdp0rM_
z+Gz(*<J{;BQ@NYGedz`rwdETpr9Yfqn%OQk{rkIP^S!$H9oruUzJDszZXmsSLRjn4
z5(jnh$d;WFsvGP$dSdtw9KE7j=&?-mY02wc-WLhGrak6uSdq!OYZF7zv(66JscX*O
zkQCiF!<vzKqQ+~tXOFf#Id)ar(n^}+s@=QQKlY@%^ypvNdN+1w^}CZXJ0?ocn`5D6
zG&ybiSu^%kQ=+E&XMSzJ#ZyuL<?hRSFE2ivnH;&wK9@mMp-_4MZHd*DTuy#LvrMOy
z1p7v=o^-Tm=B*3S4>tablb*nKylk&z(XWQ9>@RxOPh;p#+!}Pd^hI@6L8zs~SI65-
zXRSUn9<~>7HBbDp(eKK|kN<xAv$yZ?Eq>OUar#1-j<MbUr5pJ9?#s!_&u#91#x}QO
z<+q=8oIl!TN<FySz>=w=6DhiJZROm&jeGmulec&p6dUTl@c6#f=4a2*)u(m{1W(w<
zCowZFOnj5nQoXpPEFZL+mrI}Hy&?HLwtC0kDa;b}bzh&`=Vr}!xttKU;C@_Oc%)p)
z(W`tDj9X2EKbJ={SARWw+A+c<JWFr#QZbv8<w9pNSC<6{H%Z-|I7jAElT?Gafse%F
zMNw+!H|iYgeXzafr>}<Hd6y{DrT;A6ZtJNM-miF<(f;Eft&pz!Pp`j-n)a)vHu%n^
z_w#jC3Qlk65>S#$-1+%MVE%T-#eIePN9}*`=$%%rD)wee5!%sMac8$|#Mv|F?tVTN
z8_K>`RF7FQ`Pzls%k`x+^7a=LESBUi+HP=nuF@~7+l#8-Ti)(Yo*)?d{G!3PNS@W*
z9;YX)F=!9m74+JLU1z4<tToox<mT!b&B{1-f>}9v+SSn8jm%QVULLH=7XD>!8eadp
z-TybwRY9(;9<GmB+qyjuUyV|Zdhw!F>c+%lRXdVoJ<c_LXftjz{l2aLUDyVe%q<Io
zUQ0Z175&ql6yxj1!a1k-9`_dK$-YmM|LQ-U=VfNzoOFisqU)lRUdh*!s&`&?l(*nF
z<dphqbmxT9U2gTa93lb+E7L<>HC&q7s=c^eK&$b@N1v!Q?n=&Y?q0jL%RjGldtSem
z-mS3n%ska{n+`i}XplSEXpqwW&ExpoqzUY^-><Gr2$?Z$Ro+8Ko|IMWxA$GYoG7ch
z)48l@>svPGkDuqr-dkb&YnooK`PyzRne<#&=d#l$Pn<K-;<?#>I;ZDWUPs8qoHw)F
zv#(yd9<}VT%-y@}&W#8E9S`nW{QjhI=>ELUb&KMjm~A|v`}A|}LoFrt@|3?*{OWsz
zF0Py7$ouG<lX==rk<BIRiXB%^+i^1g=$3O0EWF)^&dk<iTea|`iQe>eK}#&|tePIe
z!nSOE%!OGKz1p_@vI|~%?NavR1*;$KlS&O%Ie$t?Xl`|H*9#FAWpA52trJ@_SETA&
zyL)i|pR!_d*8=|h#0STt60*xKPc;xR+wtJg@ns6UMOk;YY8}l`(f%FDt6{=@eXYO;
z2batX@)Z#-E>+HNmae&b_wVJUO!oivCppU6E67T}v`gC`Q1M~$j}#3z^9Otpq3^3a
z*PEpC-_G24(a*lI>PzK`HTIGTyXzOJq)c)-{Zc1s_1T-9%<{|EY>hrP?aG?EwHmoU
zO1ABqVs=@s<uK>Q>#ExpRj+w`@zsHOk6HdL+QqQ%s!iuQtCKDf``3g$m9IQBebtM+
zVAjb?T(2IS!uelhSJ8{?(qoeR&sTS+tz5N^&3xXr_maInSNqPl_cp&U-`>`D!S0@S
zQMEgl^vy5l+zK~*-B7QhAH6&}wy(bYpZQvr9EWAE?^m7u;uE}KrSFccRc^Ig`b<pt
zSG<W(zPw`Pm(HD=ibJQL(NKK)wUOm?cBP%j<Lsv_*CT$^@g%G=*u8ANn<T@`_qVo~
z8t8A-T70QMs{Ah>w~uY+`E@s&4PRTXlA0QF{mPlRX;*EYGTv@oSF`J?TxLnov6%<c
zysm1-r<oUBU7^*M_{vU9I&_^*-iila+bU(7Cce7v!NVJ{ZH~m>_bY54*6vZxzI)sE
z#gX}&PexbOH|)$#E-{+0Fvl)%`H9qHYHc;$?g2Whn_jCZzOw5$WpLhW<DpM}kF;1f
z%LTRU3Hh8C@LGfQbja4$dA&!XC(ioVx^0(*pY&4pO;hfd<&~{y?Dvm(Z+Ot8FS6sd
z+`j8=cbP6<=iTsVb^0f%Ym>W;yJ~!9gol5A`~Q<wb71kzo>Z>a(UEH+44Iy8U%j@v
zeo1k|$@Y}rx||`~KHXsOx&8gp>;+Q=MdR)tKj8d0;PJeO1K)y<EiSrSawh!Zq<cFW
zXEN`&X85;MHt44L>m2FtGkZV&Wa><NBW0idTyk;ovMt(++W73|ePnrNkUE9w@)yS)
zCwLD`2@Y%4IIbZhkrR0INZ|d(KqH2&Qx`s+7u;7rW#y#ySbH(au<u`+6%yWm@4H`n
ztGc|RZMK+l+sT%cySM%pUFS}j_37+sjrRpX&3gk+%z9L?`n2DMTk8bYa;MMEU9+m|
zMedE*9WEPQ&YQ&A@88FNR_L1A=JM^Iwr$%c^Wh4&zti59kD>oqem}lDSEpj3-ktlm
z?R?jD_(<D5ubC;mWS{Z8);xFLIQ8r-`&r47y|Zdur^F<isO0*ortNvW`16i464R9K
zGUTe3T{^Kk&wZP9+_^&$EvJk>o36>=npfJ(d7@44_4Q>1k~+%ylX9k3+i$3za_Dcw
z@iRN+gO;<-mg;`i%^<Kv?^}N8E`bP#U7v#*?zMVv&sWe*xNfk0$G11TYBw-&J~_>_
zoHu0E70XO*#qZuR3b~1g5~eCQM7Q5(QSSd}v-#G6TimAi9k%)?Ur##hwW0jV-KeEI
zxvogrt@G>MQ1oHWM-JPbH0fzs%lo!6WIF6klvZ}T?!qoPb@!L4o01N{Z#=Pn{gZRo
z9w@(CIw7Ye^U~oBFI$xgzIHBny7Elo27_xHHY)_Y*YNkB;oU8nr*S`M^XsbQ>6+$Z
z$1|>buIt!UdXW8m@0UphAB&AA9E*$#5TBcrXQcR@eP7v?@P&o0OZS?|X#HQdJ*Oe~
zqpNQBi)Ds;UwnJueU|B)@O1M_J)M&M1?xq0cV<6UjrBgxGFkb{>8%%9R=>Zk%Eue8
zyumg$|39mY>PexKyX+m$Ule7S9<<C#@9IizH_`iCPd7h*aAF~Qf28uN^gB074;)hL
z?RBc&@^b#t2mYKa4w|0Z=S<sqdX0;F7Gtc+-QIZ4HM1AD+&-=p=b^RmOls-M#UVQi
zRQ=VpVx;2(W3F2KdzYOvOFc$9-y=rCvcUF{&fMibe9Hr_%yO#`FbXcwf6B1FE92Jf
z)6)zJkKgs!biw`cMg0e<sr#Nd)NeU;vE3n0XKkA2(+xTr3fC^L4U*RJ?ei{~Ti^1q
zQnO8}KB>>-a=`7+e?`{2XdZUXPe{7+{y??##Z~#=8_hrQyi`{HerChb-q!px1>PNJ
z*T2os_580Jdg*k*e$9;QHM<|a|5dku&sMiJlka32Yv%*k;Hi5nH66ZBRp?6Jm9Lkx
zvg79$ku^)#o_JRsY{vWS`YzeK%35y156o8WPIlkWrj=SA=c%q`b&aX(eE$7*1=9oT
zR(V&+)f_TvdNwik(-W(yXY^DfwPjZ`9A#x{KK+qbbpHbX6yK7SjFayjoUmEzbibBf
zapIe4b47w}&NOXExVh)<yu<I+j_$cy?)BL)=3wQL1*>nLxe=-KbXBQ>k4&Ck%vati
zmtQeWxqfb<ZC;59_mU-Vx;Bfj9O2bv_Wk>A)A?f)?5c~Zm2;0Do+4e`{<-G<+Hjra
zHXUik@{*0`lJ=W<pZI#FW_xSg-WTFBt3<TBzP)<2@XC=7#o-UG|3f>)MgDjAp%fMd
zh9VvY^!r6oPH{=jPb?}*tSr_ms5~3yoB!BMVDIa29y9ivE7mM~xzu#RqLq_&I9|Ic
z@^K-zvOq?r%I0YvQ<qGVa{XW3{%cc8<z`3!tBQ?BepcnD$<?y?_g~+C-tH4e>#>`$
zJ%>KDES_~Z^xz`hb9#S@pYt$9z7h4`&Zc*6|L;1t`nr~@Vu_tmTpb@-jU%5t;bDt>
zXVE#yvL!KSR#2h@(|PWdJO+wO65G5N$}ayoZHkgnP};7)3Ex=7H4S)It4-LSD0N%n
zdc=YSR*U}%oeev7Yw;g8WnniX{ff3z&CB<i&5+lbZ4h{_EOt(Ur@r!JtB`DGkv9=t
zyDW9eGF4m;UH<l`a5~%7_P{wUf*M=%d1qfYSnsX&fpg8DtIv<mHu&*XZO8uVh%>Sa
zmVawg{_gyPl`Ev@T-7zZF7b6sR{Y4f$>W><Yue7Y;m6F^-kel*hLtVaQ}}_!x%2L=
ze*feyzO}!n-{jA~y_`G$4!3<o+}-<gtSWx}*|ID0pK)oDkHRD$&29X%bA*`;*tdso
zejOSrZ{Hb`7&qPLTl1s+4>ne(YF#Z>`aR1%Z7r|w@l*SSem}qbjW_T0hl$yn<rpjH
z9eT6;+ZEf365n^eOgWOg!)D&u&f5v)whC9`<R`J~?Ug**V*NGPM6qA}vR2p;mov#}
z9|CT?yfUTW@0$=ilf+Wa=?|6#J~?N-C;dZbO!F>2-k9cvq34#GU72CCobjgfO2fPp
z8&nVF#!8sPeK>ViOw92D>(Y|^9<G9mfz}W19$U6`)AMZeq?0~DJd3(sY+SE9^Y3$q
zw)0%G3om(g#2chqoK{n>u1<=!oxSI!i>;Piiq8_&+`ms3N(VpBopbd{y`b{W9XoqY
z^K9i-X}Gpw=IOw>U%!{8=Ucz}cH4Bmu<pXtj0eBxdst3#$e(et)?8oRa;5k`70vgW
z+g2`$k6k~@Y_rp@1Q-1Um%YC2iZ=0nIPt-RORkcarQ9Obj)x!LqWAl7JO9=HdD%0Z
z67ELD%$fh6fzzn^?$2{Kg1nU)C;y6ic=m#q%-ieS=?(RgAx)_ctJX+({%hIxYIdFc
zvaLaT^E~YxF0Inaxax9PUN!gavL}%_Gq0rvp8Tbv;LiW9F7lGR*VM`n1zTtQI((?;
z)??mFpH5%8_r_>rxn8sG-OroP#J!9?-I(iP*=fCN=gD<klTThhmi4p3UG~I^O6FB-
zF0?C(-)VX1k~}R$Hb?Yd#QXaJue=K7RWj?$9a*MqDS1`?v3=96w%X!~-3f2cY5v*#
zgzIruQeNb;!jwgwrK_$<tqJL5k6dx|-l8>Ac2EATteC&;=@z})&(ElxGc!4oppx-R
zamvkjosgdg)_7e};mpkp`*An&(uRUa>s{xQmy6Gmy6t-EUO(UDB`2**kNd^6cj~y_
zIh4n5_`307*#)-(w(JD<tEc20S0DRia6*prafLWbQqRZVuV3;Q>6O{WSw(GI^Xh&0
zP8qgJ=Jz_k_B+V=9^Ss+bi;Gy8_Y6IOScFsi>OElcwaeWdLf7HZ{7W7Jp-jiwSvsd
za-Z<>isqlMOaF7Du5<d)(RFe<Cj$eo90LRB#Hm~yM@=Q?=cQ$)m*nT?=oM7Xjf^h7
zZ6;QCeZ9kD_DQ`*3g^^Do?Wpy@_44z+hy~5%hHTjO>5KWaPt+?akzD@>d*b}G7Soh
zlZqxk^-1bvIQP}s{6$aAzPkVKkLuf`E=}s5|832hpN+;lRo-jOy0_`5YmJ??^7KVk
zUi0o=d-CYd+1p2t{yZwZX<zCSd7sWnZ*JP2b`3p{7-SrECXHQ_Ym!R)vOE=Up+ntX
zCuUvPBx1UDr$*>*^?QLw-+a27d^W}N^Y=ALsvVQ$o-g@d^L551uJgO}uOIKKUBsHb
z@+d3Ul+SZjXBM+^G0x3qbQf~vKl69a6Q$EP>ij~cezsa@6kJ?%ehHJAr&d>&ms!<B
zku5e+ZBs>NE@|Dw!@uW_`kGLc%<#8qyH_%7+x%^F%D3R!H5D@jSDo0kweMQm^$#`o
z=jME!efCG=n#W(Kzh3?1)8ng8&)e7jDzsGouw_j|<@u!=Tm9Em{tkcV7uU35YRZRt
z9;FQ|cjnz&sPcB_>)mgHrm)Z3o4!ESdGh(ROuwm0&;CYn98Z6EqxWLbGRu8cUta~y
zpUfkn#Uj1o=Iz=!nneP>JJowHO;cF8%s(qZKw2ofihXz1fqRZmc2*pyO~~^+DQn#%
z?p5@?A+JSO#AJP=$l>d5Oa5f^Y;o!8`or|%#)_ys#&=R$E;1&@K}^dU+73K^*22mt
zpk9!&@*{t|6mzwsRtV3(MLDzBYR*ZVTA<U!qgr}=^^)4pUzb#bah-I#@`00)+uXdb
z!QA|bLnU9tJ=0qpthP+*U5YbaX*j*VmZ6*LDZ4Dt{r!8Lr3=gh7a9B!^<a;Gz3fpn
z$0OUD-9{U>oJe}OlHDUKWoDPH_q)t{1}6IgFV?sUAD$lKaWd%0{=5Iq{y7_1l(#We
zU=csV;UD31bu;!w9-q5-dy1=F=cH0=;V)aZOK;z~JLdR$j|-X7FG8=+)StAl<66pj
zzAYzTKT$}T<i(g5H<8~Y-*K8s!70Y$Tp>M%uRqLbHTrS>S<T1my8p!U<Jl($ifbIQ
zjC1<s<#hDZ;W-jh8?MZ;$V~8LQfFrQY!(pk;=9e&XEP5!FMnESt!}Bixh+jymwAf(
z<von@;am3o4K8*+eQxKfl{0u2@0eUU=gi>)NB%O&inz=Z3wslHWa{4w%o1k>7K=96
z{(C8Q?u7Wo7a0``)UL4H_~rO%mSn)IHz{ZNA1+j!;nW*sSJ-@N>RSDUf?91A{LFjV
zzP&Yf+nXV<DuDU7Y4iTPo5>TlXnkohdmcSK=s|+<i{kq%mhwl^ZXdJWH@9@T%J0KY
z1{1$5v`)CP`NMqa^SeIr@E0wedbD<*&pEdRdEHSxFZ7MGFEehPC)`|7*?Di7xlq(v
z?FZMU>~fRt*y;0Z-mJqWY`^BYGv8RhC!hJx)~(q~Q$I}K;pH<oo3*KkqxD+XmCnZ}
z%y<>N(+@qA{jSIOb(_=Cn#L;Tn<4j}i@7TL{j8rUy42Sw_8jwa*OZUV>r!MxPaON7
z!pb7P<h3$KjGotuyh+Q8|1K2@5V6|6;#t9iexIW=4(qlal1iT-^0?{R%Up}p>4&x-
zmMpR1;+mbws<3BcjaKXq4ig@m<606&Bv$%Xb=Qg?ov~gjNBaGZhHGbM|4^!vPTv!^
zXJ^Il>9aX!Pf|L!BxBVFo35o|RxF<`=4{B$NxEC88gN6X;ogCB9dbVFWBuk@s}^@2
z4ULwsI=JlA&9vo=`}_WfGI376EXa6!?ep2*DIRipl2NYTBV8LyMVZ77+!MR$`1z65
z@>#-+X;GGIOIAovy`Exx#{721<~=WzFI|YAxHV_S>pfcUt}5MM8>4C)d^qgvLG3;F
z_#W$fe6pT=<)*Ut>{;)MuDxa#_U>G=fb$mjGDpT%&+WVGtRLH5<>uP`sNtC3ynps3
zGPhQ}7kFdr*SP#U|EBvE3l2`**qCj?rafs+zv1g=0s4w7rXS=Anp2<s*`e;UN$G{U
zM-OUlZ2j@#|B0d(jtkyg*`AcYsW~acN#xNV#k(t;-&A<2URP$>S-1UP$3(*o6D8dp
z0-Upsi<sTns@AS8>AoRS-ytY}N6L-UD{f3(rJuj9u*A~&&5wM>6B$yy%=Igkn~PMU
z`krpT&3&V7+4;}iHnWxsnfm1!+-oYlpf}k#-@<9RoBWod-1HXR0>{hIeKCLLrQ6kR
zi!YB_B<}rb#)VF^nx&lcB6{2;IkY#Vw?$lkXdrc5rGfL<+GG6jylbyEusr)`CfGi4
zf2^E8%kLH2Ed#xM<gXlG<UjxAYEhxO2Fu5jSJ*Gm3lHMbkh|_97Nf}f_ffWJPVSP_
znujMA9IJcBwr{82!6jaqTQd${JX14c>1X9BYu0%m5)}V5SK@-v?Lr<k{yqENUjB8b
zXRpA@8`me_m*xn6@oRR{1r44Tj_p-f9P@blR5$rf+S8}L)jo9Yt>m@ge>k$wm)|Uj
zasTzK@Kw^Pe0kl@lUXHf!j>w6y%krvQr^Yz6s}gi#pk`ZT-=y%wQ+`;g-M`;klJ_W
z<aIh;91ESEJ5*@)R`we-{M3<Keqv#Gp;xe3;=9KiReNSG-<|M#%R;lP=7$CI70vUv
z3Afqt@ZPy?_M_3pmVL(I2Q@DQyVR0c=GO_Uh36Ycx;#$Ft^fFAL)Q1%zq{V@OE#<3
zP58g}=3(s@yKWv)`@FPE%R_bJwZjR^6AajAycKZ%W~Ke^UDk(-`@FfPme%ZfC;Hy&
zarx3m?<2KT*0!$nlm1(${;BrGb+#E7nV8wjmu!tq=6<xT=2zG|md?!9aG`~1j3>C8
z{r9t7Tq#hx{EnICpTb>+vWAutnJ0s*pIHA~b1>eBO<y)@g8)zCqw{y-kG}PP(Rc9r
zMTPZiZyKMBkYtNrXZQH6kAR)6d#nzNLC{~m$FVPNSa(^iu(Z3l<U#z8+T%$*Pa3bU
zSy&x0dsXM_G{5|bx$C#h@e8^7%jxvF)#swtZ;;GcuzbR$>~FW_xnh<s`0B29kHsqI
z!};au;<GQQX)!+yn5<U!h2eZ`m)iYo?vynt0$e>dnRDlrMt{3<x61bT{;B>84hrb6
z^_=@!F#E~7>-=+AmG1BOe&PS44=LAf?@7F08s59yH*2R{)6qvKt$*Ywf63>n7xnV}
z^<qZzN#Pk@2VOn?-8yYWd7y=EnfAx;#goLoyldq?`%2IFieKJLpVzsuTatg7<o^DB
z*nCo$d+6pzCXu&SW<97^e(M+erhFlLyx-q*mwgkQe=|>#-D}Hd)*@6N^-bBmUV8EB
z<(7Wi<8s!zZEWpVWt%g1X4w{B^?A0pO(k8f_6zv)byZ3E?=?7|;%W7QZ}F+d#djag
zI{EpcxA~%3P1|?7{|--U6`qw4sMWfZcWdOG&$c0rdf79CKG>tS?7qo2|FsZcU|3+z
zfcMJ8<kFNxy@JZE(!cX>ANyJUSM+)X!^wz6Z%Z_S81<%EW=iY$HXS)_c0$TAP<^JU
z>n0ncZD}v+?|-lT{y<i~Z}U1gfzwa!ey_X#vZJ=<|EKwz%`*=bA533=-Ddq|-&3nC
zs{@anG@WnD?XT|sW|7AC&|Q1i-Q0Y6bAI}V``_PunzcE8hepx1XY(t=rdZ!NlO^|F
zZL)9Zn+TEIS-VzNh-@qg7YjZ6$VUIw4!`agAGKFE&9uXQ6(9Y&-06k?*L^;pb-P)2
zPf0kvW8b+;Q`>&Z{R`nZ9AJM(F?Pd>?>5@oeo3CUUmiM9`0A^#v##5$T)ZS_k?$Vw
z&3mJEcd=g2j{7v}xx(_4|F85Osu~%m%70(<Z1=aRx6~iLoU3qQcE#z&ub#USr$2nU
z|K9#Cy}G*6kK3>3*U$2o_|r4_+p5}>^*&v(Gt>46Ro!i^GFTWoef}c;7?a4_n^Ppy
zpLdAb>*^gYcd44A>k_NGe9iZSP?4KOMxL7@ILa=rc|6T}|LHt~=`UP@l>}>KQw#Uy
zPKZ3P^TVV~UzVNmeqqn>RQIN!@SM#S!mQobYJ{14(<Za9`5$b#WV3eh32~d-J~LIP
zTYlD=$naqH?H#weEDb&x`DUds&8(XEemdjqzX$G#Sxz@PHa{%qxmkcf`qAr!vfGPd
z6`mEGew`5<a*?k_>1<`orG6E+_<vl}*mk5bCtQB!F>`9&JLw0FH<{TIw>9=}FqvM>
zu5zoW(LQueQ!byx()}OrWpsq!+k3BW$EOG_j`qg0Vbx*H=J9|2KIJastlIDSdP1$q
z`smbSqUqn0TV$Q|XGlCsU|j!4!9;7ytnw)<wwjr0ocr1yX41k}V|h#Twc2A_(fyvR
zwQ+im55BXP#~-cF-r-<$HE*rRl@*mMOEXq8tBO3Y-k+tQ@@~gP4|ydCw#{L>9T!(!
zI~I3!;(-OzD^4G{dROrG>v@`w=WmKWcd9GD;^?cU)XX|(tBKJ|vqUCo3TMtMsNn5t
zso#FR@a(7ao=SH!V;Ow4nRj%5+O^Kx(B3jqypzLG^!1cAe_1@2{!hDQlm1%kFVB8~
zFP>b_O2y-@?|$Q9WP1AG;<QInK1sHdL(V;szHaw3f7*-QoN4Ej1h!vcSatOKlpPK`
zLl0XUNw;S%d9y}-E0gqzk0&-=o2ALn+M#jikMUG#2dkz>_J5~xbqM<I<J;Ajzs<F9
zU*8qA{pq=U6Z)nXdo206WcOkL#imx@k6tAnJaY2tIs2D?IaSuX;wIOl&t4*t!ObUg
z8D(1p#o1Yek3a9<A{k~A_x`4D+?_?0MIBNJm!&r>jGNQwa{0=M^Sa*?W^S?d_#t*?
z#@kEQ9M0nE;>VAxZ`rw~E8cO_6O%=Ln|q$hgfUEttvSrexx?ey8q4VAq8?`JCcUnh
zS{U7AwBd!s&$ByE`SRSce7sY1=}rDOIrp|}9cVakzE`SF_tKtpjd@B(xPJ+VbaD93
zmu=R}-*fYIHTMt3H8*pd<&-#DgjOaeUen$$Zz=D%ly$+~{;NV)3|6PT_LgpB4UKsl
zxU6Aoga1kf^QEP$m7;%(9XoK2bz7?Rt&4KEBxF1vXo~N<^;3M6ZP}iEde?GYFL*DL
zT*ALt+uX8Zm(-^eK?eS4+oT(A8WNisPfQP9d+Oqrdk>^J{9dfuQgo@7ZRRS|)gRj4
zH(pOD+%@OR4QW0}4fCWUYhOQGw?Ofr+x+C)ZYh<n53YFEN1WDw8YIb*pxM0i^S(Aw
zf#{=ME?1VH-1u#C;c@Hhea}w`DR-vb*}%l*<DJ5?=BgOi(qi364XZ2G*PrINY5J`U
z)oV7pr|?3m;cQU+cXy*d92r$JdK)=U_%Qv_I_Ppz_|1lE&t$6@eh6Q4Uc`P;eR`)$
zW2U^*zLJHS#+`2ER&F;mSWlb`SmpFF$=JBGgTHD;il5{uJGX`;ZV7X_vO3S;&>QnC
za_-&!!M90h;Tg9#r<FE~HcT#STXOJSZr8#+GE2NHr<+XZTFl>k^0kfl$5mQd@*eYz
z<YzZ%PX7O&<EYSf-3YA>g0fd%9$}5-ILlWZIJ+Rd`Z%Y;ocX(zHg*Z~y^!Bhp|W`?
zpY5cCUtxb054-4U8uB^btY7tde*@FpTdDJ2W^Lm&5$Kw>ZE|1qF69EQM^Q$zL=LIN
zG|#sB6Im2)a`VhfSF@MLx^m@~gfv8bz3|Y1S#HU_>-ma*4%stL`)3!u>el5+^<vi@
z&gxC_d%zhtJ4&tU|D#XoyVoDwFf(cA!<hx*j=y%ZMmoAaVSjT<k<<6#Mgf1J6>GC1
zAH`Iv_pb2Uq||Awb$8)*;oq_?hA$*GG-t@V?SA*W=dq5n)xwe!rs59@l;6GhTp+#a
z+T1_d{z^t%iNy;Zw}0Mz`NNx2+)Qicy~|CMz0mBn!ZPbm1INU;H8znO6MrvS$-~OE
z=;`zS{P&k_vC3Iiw93KF<oettv!kZ36FmR6?()_bmE|p;5*FDdna`Q-^)L6FsKP$e
zk_Lsf5~rgbg$*J?9D7^X){9JQU@;K7n6*2^PpG0Lf6AKd@cCgDjGlS3Y#cY~Khkl&
z9rb1Aa!r8<Ke6{=uV-8>?t1?9(alZI_X~=B_E4|cAS}GdD_e4gNRaC11P!);i75wp
zsuVBi*s1+=_`Pm}pW}+(pQnX5A5s^U%>M9(q0^=CL-ET;$6RlHN_bqmq|b5oG26d(
zH`el{d0WRh&omP%DEX<niY4{~=c=do^cM3q_x(H4!WVl!a7M)^jpOx~{B<tGKhKa5
z*sZ6#x_FPB*pu$tHetaFe=~o6&(E0p>CdUvseCG@rSus1R63&HoLErH;$acMy;oqd
zW6qbZO*3Y-u`oro$y+H}zDVP-j^Rr=H_g$!*iNf`$A`M~t6w{syiGswi^OELUK8%R
znpV8T$yqu~yQaEw|DDT~8<c1I-MXA+*YQ>GhRL+LlCr9KjciNbmfqQLYtn+SQ<4)-
z&bn8m@_f?o8{8Z1kJ#7MeLt=J`FMNzd%d?>XAd>nbsTHie=zTiw$8LC${RACp3-H}
z&{%z<EC2gjrIsBsOqCm+_HX83KXJh3(8U&83G;_83-V`~%n|v?mgK5y+*(pMcN*)?
znv5o<4k4?cFYjdMGE5EKm?v~@)|~r}l8qA=Et;bkW$#{i%CR|(bI;D&7n_8?oN>)>
z(r6Gen4~7U?Vj(kWYG=NPM!!^$7h`(<}mZjCb`_1-1mbzWb;dTcgXM^=}z6=V;vUk
z)U9G-Z?Ko0XVZ3N|MxY^OI|ws)>6~`oVzomxqY3AjHAcDrOWLSzARj!xV-ze$fEMs
zkrTyr+9e&H?dxh(Ha`A3#YR{{k?(!#hAT%l-i|mCkUO2vbp3|auhP!l49<_(f49}Y
zI&|f`uoAh$!G~<_72a&vTFk5IAhoiA<>MY>pO5wNflFJjzI?2Zo%2)Hch%Pg7uN5o
z4?YyedUmSCx5LX1&cBi~@zL^oyxWYJ9)5ly7jXWBoY2(0{%7yVFZs$*GUb`f3YSIp
zF>dqYYJdFrbvIh2y3p!(U8PKgt@rz~&AGjH$A8Aw_g$YW`0&k6Zq-%qQ-WXd+%0`-
zcSXL8`<bJT%Lc2dosW!4qd%;7HMN+?EPkZWBKqh_Ubnou@bHa1cV?*+YrWgKwaDMn
z<!8sl8ci48+noo)!+-m^G1b&6Ijxfao7n#{)MNL>m#_5hgt-R)N`E)6E;ZxG%E^z9
z?beu;vo=fHYMy*fjro=1k0jewL;c#-&diycaPW-$i6im-JXO5^dT(cHOxt_;!<Ef*
zo+dKq>}5+|w)T0CSg^>vb1%(W*Kgn2qujVsZ`$FmMbodl$~7^T@z2d;Oq24O&T_f6
zNI`Rhz3ul|RmRo#EJbc+D$921EwnlMk?}=>u5E&Dz_W(sCU+_?8i)RI^br(ue}1F-
z_uAT09v`U#%Pq2hXv^5y2rZwZJ#Wqg1@p+pM`v7llMX7L;M~2}Z{zJLQ>P{vuIs#e
z^O4@atp{fATPU(%?%a9vc6DExBla`xs!wi>S2y#{Yz?m5J=IZ_9Pc?#Eu8+|s`Yxt
z9NDfLi_6N7*ewvTvHi`+AlH5M!r}wQ=X~FvxnNb_)X~uw%6Rh6!NzvAg68MBr*6y@
zHY|-wzbx3(ZoZ}>BG4)G9&?YmjFnqo;h{M5ocbSPEsIOmT%YvWf$M=lU%y1}W1HP<
z2^N*y=l50Lo8Kp0F11D{L}!};|2$5f9aB?<A0Ibz*86hf$I9gfxnEoqEzAm@cAC{R
z&A7FhX>kX8Q)c$5!|grJJQp1oOMc^>reqb;zUutNV=AX~T9;{jX*&AnrqK)e?>C=s
zUuIY4aM|M3o_goAGADTN#B#0YPCR@5%2U-`ksa=~LEGo7k@m~|zv|gti<^u>K`#Br
zqxV|7X!_P~@nYL^P3rZcNKc!Ev3WbDDI9gw-CX|tk9GdJJ@rd|Za=@Fw`Kq0_y2nO
z-#xg#a5kSu#4D+(OvV9TJ@+~orj;spPgvF>;rYetrNhhHoyu|wEJC8USeYVjZPuP%
zUhwAGJMKB!eh)Qk7?MsI8Tx;CFHu->&7te$_PfvP_sqGcV67Zfq++BcaN_qBWBWLz
zdYf>Ed%OGNPlj$6kUjo9X8+91YWcNZ^B1?oz1K;8aj&IQ=7wwZLgmwE&T`Mm*s(aU
z@@nRvs@bR6?uJ}+m5Muc`JkH0sw=F5@$cr&axhNiew}q<Q~XPBrIOQk;+`$q`TT_I
z+(xhe^<4#Kvhg2${uVF!ZD6U^u4J+Oz0OYWr!}+A+BNU#-XIZ^n#WMN*(XkRPHJjx
zZ>ImhjpyF1cIb+^#X9lE-aD)6<?Kv@Z%$qItK>kgiT>hkK_^A0w0?P6@U-$T)4^@J
zv&3w-$zRs|#~W9oVs}B}xWVb}<vZROIJkUod*Sr&Sh4n<OQ-*}Wt?8Q#>V84TiMai
z8&WMjeWyxJPh{LFxT<RPDT&}-odt?~TT|IGXS62%*nRNfNAZxRLbLZWetdJomE87R
z4gVu{{$~IA^XJs|v&Y_ME;%Q8b*At3;1_FV?Vb`*m!Kprr)+Qbj;ZzFgEOshC0o|b
z$hg`5G-A)uOf@$xv&@!Ni}KU&9}e8se!+PAT-&mogGHJipM4FR?wN%fH<}*Gntvj3
zxoKoUzMFS$-NT~2r5bs6H@07x>*VOQJ@;(m%&ysiJ%V9Z_U&U>_w(zWh0adf-|{TE
z*J|VSnW_4vh5wHEJ|~m+sokwEJHr?y^>ZzE<h^4Yd`i_XzKUECdfLU;AOF&6xzOBm
z(R+V0o_ev|LUm^Fnu~@dG0UR3pNY=%)|KtN7@jOQ{S5C)tHfJ|B6hnqKXt@v?d!Jj
zeRPJyn_<E1cYB&QPF}R;>Dr=Imp}Yp66v^Iv}@7k8EvyO<I3k7o1K0#?;Q7craz^H
z+39=-^FAIc<gA^$N7(0Oc<w^)U%O@Ri-vOjyJNUqKi2EY=_Nhpp&#Y{+zWYY|L<J=
z>E>NpwbJidGo2ESt9*#j)jY6e$<mbH2k-iE)pob-S{5z;!?nMpm2)zi@~vB6&Dl6q
zWzSvy&K>ltEO44y=G?dJpS1qnFx&Lvx=+Zy?b#cmjO%s%rhof6q1L>@M{SwJQsens
zWi~I!dK$}6x>)9G?p^ic@6)bw{5`$s)fI8CuuTn&t*^Y#IXp@}!k8+__I%#*7fI)I
z-i0fC38+`hS-4-M^xn@!SD)-h9dxj;^!gpb!@yvp!oZ-2=jM`>)RNR>(A6btqq6hw
z925P!Z+}wOVuhIjEl(9#ceO^}sJgLEH+n^?dgHEy9Zw3%mGn-2QmoW|vH$y>$_a<t
zQ&e9tP1<pI=I?#a@6Egz{O#qRAJ3b=D?O_`%YRSJCf`M?Vrz>2X^nfInx7xsd^ET$
zWXf-^oNc_-|K5CPZ+?D$p8Te6-SqT5dPUPdWX}_Q%GVuvc=6q&iD5_kS`%-X<sLme
zp))ozgtz<Co{U9qB9(h1UToZP!btA4;ryk!a^|iR9|rC{cjT5&&bOr}%ym}XY)unb
zvv`*DE%kWmxTk?-XT0Y*_gB2%{O{+J>@(g;N&NFZrbVkf__{E|uiMQ3S9qKA24!Bw
z*2Kx3QesSRjc2$&`I8ZSpu*1j`BXVW?Xz96VL1zOPw6#v$Di{*wAftT{r$bVioG!g
zHD6NZ#dohdv6Qpd>F)$n<KBb?S@~*Th32mkxBI=a>(nImU%xeVvR?n0^?Xm)hcv~`
zxEjun@7{j&yw~u8`@|2+_NjWWmwmb^HLpSW(=qj%w~ZcW*>E&n&Ds#NF2tD4nEgq3
z*3y^?xufA1+v4AN$3^FClu(`?9KY_*@s+!xbROxf%Ff=F7P>oZ3G4jqIN9zUAE$^<
zTG2UeLQ~t6C)*mlp0q3voNfBGK(21>f&*{w9`bRz^WG&^IqdL-wUyI;z3F;C-Q;pI
zd%b)>*qxWnKMv?f%)U5jLGm@<1?Sg!6d6dL*>Pmk)r7F=mW@?h8`qrOG26;$#`U!)
zgmkWd6Wqg>*ZE=YV_miqt-d#=pAI-U`-Q4ZsCob6-;z~br;b{mH*<`6;;ZthDx*2+
zue6QAS%-sHvzJ$%o!KCIwLoT(PJ`zGd5#U)uiMsI7P`JuHCcVLYt~Yw$7?hrN@6=&
zj{dd~E}YWne@Z)pcd7VNKAwmYwWvL=8EP$oJ}(5*0{3MaItYH~Jk1c{S#C08ufksQ
zJ)DU*14<lTJ-gWF{roVCdEi#bqvu^e7~NmL#8qapZr`Tv4HtIQv$w5#Ef9J<{mb#s
zGt-?pKTQo+<vFF@ETp==Y*A)~P+8vnb}y-&LY#*=Z&$ptGq{?pAGhJ~{$FqIm(8&7
zxTbY!*T&qEvk&>^ZPxI7z*n(g`D3RL2j<4Iqw87sFI*w+aN-45+=`Vf7n^dYs29k^
z<vi4Of4QvbK>GE-Yek<nB}sI&y??OAZqhuX=d;31H{D6>U=9qmd3;^4U~0w@p~dF)
z&Jzl17!^XaS^{1_(q0zsw1|y)tFMXs-CfTnEfX?Gytu1joB5)fo8ld9?yO|`uzK&B
zNB=Wjk4`?$wK(JYlG?MUIRegZ-s@{{bdM?1Wk*xr8O`}eeQ)qLacAiqKGi0=av4wT
zgDDnS+3%vaya-khk4UlP6uNS%S#zpOz>2Q2%|~SpADMnAx7*Cy?Z|}ogoz$cJBp9K
z_T##$6_P7=<JJome(uOQ*_!sR-o{;QoXs1Y5%{^$zDsS2P@BV6smPZeCqFke$+0q~
zsKk43UZb(@)+IHiPZrt2a*MW0>@-{YrLv-y|K|4C6F*}Y{FwH>_H^#QBkBLH@cd)w
z@LlE``psSI4)1H$#tkQ;Z|CW6?pd-=Q%fT<H!4d%%cihNgC$v)+pg|#>y_76&b*!X
z!1L#Wn`#0pN=k(ldtzqJ-Z$qlFYCevffP;4RLhHg%oAL_Ph8?UAkchL>u>yqwkjU+
zj_>hKy~nQR&J;TMxr(zgtpA5^W#-PiiI*Q&O66ANT05u-{9E_GYpbnA<-SMjyrb;7
zRh_P+ioJDi%3a{<+1otlbwl=DivvHyKRN!q-+5bQ(ZR*%kL#a}xU??w#gEV0#+z=6
zb}04iwOh<?e5=6q<5$-Ant7AIxJ%U(*Zf*6d3w`p+1|bN|DT@edF$oqoc=ujtjD?8
z7M__OnDhJk{LfZ2ez`H#<e#8_`t!6u&tCU>1n_59eZ72r{ulB3!sTA7r%Hv2?!JgT
zdQ5M|i>{3~vRdZ;R9bb5>r02>rSJug4~h=C&-4v!+xE%!(c?=qGn?m%PW`~|dM=gM
ztapWRuH)RDwTH4Y#RG(5f5)ZTdAzn_eHtq*pr_?>%IUd);x^I#v{_tk+EYW$n{HlR
zIJewt`TQA2{dZl{n3Pg6h5cNuOs-;iQMk*6M-^I}_466B_MVMX?0z_J;?x9*U&0I=
z7nMtsR+b0tm~;1b{mN76`z&kCKS($RKc6<^&dme!L}I4;9__F-+%n&1!>2&CEvp!B
z1~7KF9KD};TE8nG-zU|J`CMb>&G|;Wx{oKRzSXpzvcutX<E9QPF0NI<+aGZ7NiLpz
z#kJ~4c;Ce{Yr@!9v;BVX;Og`3@B33zx16~cdgL-k#v4x`xwX}wKVEKK<X5Vb!@#rP
zZvLv+=c2jMd{T<P<DSRouA8^l+k1}a?|GKfe)VnayYpE==wwF7F&*xe1#4G+JR*11
zVmrIgD=rSXs^gLG<2D3Ln#a6p!i=4#Y8Z^}Z=2m{n0xV47BiP&;xv|3GZ!dK*%dSM
z=7UWsY2VJ|?VLZSAm^~rq$`D1-#5-EI>zL^+HpZK!_MYeH&)DU(L6lK%R+qjy#gJM
zRDao5DH40byjZr>pBFaY$hGZCg`WP47td#Jwb{luk?B>F>y*kX^^ULa?z>~%{5898
zt>4zw<^c*@Pc`R#U9#3B=7dU6Tf+822cL$x*#ev=g|Gh(E^Ut!oqaClWZuua6L@7A
z6YY2BndcoZ%;1wd@mBa&S6-97p~TUSjS}@Mj!K@LdNudO96c?el`a45K27vEdnEIC
z+R>@672cjHS6Og;j^WJqgH=ACe~X`rpOklDq21GM#x{#8ypFg}C~r2H82ia(x&z<k
zw8BGCPck=#)E)BsUAyt7%j=%ts;?_e6qhSkuj*KsA*1l}nd??&ha<l=%6D&_XFj!6
z#%Z<n`wP=2W^dtn_IA5#K-?>j$+M3=xBW74(xc;V6K;ejzgBXd6(!2#nffy(s_f;9
zle4*gyI=qL^oj7){qH*-^XT7IP-k1hZLw*WW8jzLdcB$JHM#Y?65dD8tXjxe@I!N>
zagf^jJI-2b0_`@dt>L-B|3XK1hVZ85$y!UF>~%~0m9X#AX#@7NUd%iH%dcLvvUo1P
zeBz~rn!)a#NAjM|w?6-JO3>14hVzbX$mGvGalBwk_5;;9x{r3OT~R%ChWkDb*H)i~
zlvjU39xvd}VqeuO*z0=!YV><w*H4SL<SlMH$CLER_=%?IUfrjWG8;Eq8y-HSw0s7y
z*<7gyDatG6>(5`?7P)}s^?f~^N#-$gL%zy39(p%3nq}|K1ARO6GGte&U0IfFx;w*3
zUbub6;++1zCNs;$33VaeSsUvYy*e)}`OipU!imi<?fx`$oo6dF6c)46D^c^?ZeIJl
zX=c&wZ!_wiH{P9nm08z4T%-R&XYFf_uLpbY1wB5qk|(Y7!Sd7X>t4U8+R!TA=_$5Z
z{8jg~9*eIPnfKP6X?r?}{Z&oV1b4Y0zjw33`d|I`o$ct$Dl7dgNXxx>g7vfarMnxp
zPs!OcY4*BF$CX4sn(S7XW3@oqr1F2olV?32Lf)Uw;jvt0Vda^5W~N&7Q-Qhe2a|O>
z12%7)cD>T)en#Y$E4+ONB?{dBGgT~FtiFG}knQ^WPZ;$wW(RBS*?976%zMinMqII8
zqT&1QwDk0Cu!v2RJ+)gaXW@p`JO8iaDzsbl!c)fix90X)J1-k7k+f=PJ9JV=g@fsA
z&7D0RyYjAIGFUh1$ozv^`M1~u=6k&?5=oWZYBGI#K>oXu=5IWc&+UAyYHpBr-sqX*
zQPHdBQ@`iW-K!S6a>>`41jo`FpLWdNE4f;4S&)X>yT8)w^!}E7Kj=Nx=J4Xh><KQW
zEoz$2{QVYf)0C-<UnKX|=cl@B_UgysZVn-;lW#?RKmH`F`SF4|vI_HpH!7OVSr>PS
zYugS@t;z{9mt(s&&wA;}z*lnfQ3C(ht!G?xX65MbW{fj0xw1s1Ygy>LQ<dAkr#+Qa
zzIcj3@PLkUQ~YV}xwCc8ul(0tc~AD%rHg70PcIP;Hjl2j8(Y2o_2W#}x3L+!?qxdg
zhppn?l2}q6QFZUD`l{bAS9pI>+0Hii$+T#>0EW$1R2ComdG(nG-yg@+v}^V&E*+m!
z`{&E%JqaJ5y6x|tyHo4pYV)qmk)nqDHq3MLzdndi6DaM_*e|%#dY?qV|0@?dFa9@n
z7o9unqU39vYfj$<f3?lL!YX2I<!m-{+e3%DVfQ9G+*NsFcQKUd{)=ziyB6e&lpJ^a
zKIfBt#)`-ZyX5SuzokFBHfQtldP|!>3s-Np>XheDu{?Ogi|Z#lbH<i$jH@$tyy?{Y
z$Bx=1$$PMMzLW|BgLo$cgB;#2Nts?j<<r>e^4n(9{@c%IdVI!mid1K1>F%}L->plw
zUOU_3+ciI<xia#6s!nFfURNef$?ZLUzxF*d1EbKCrCa9CEe=axHc|5d(~ccGe%xh0
zaQxAil>hpNx4(=y=VfW*^JI;e`bwQ`N8j1V#h-fE{o&@~<4OAS^}D}3+9aeu&$iyO
z<$sO(IlZM8lTz)3JNHbBw43jg8hEne*NclwPApgIQtQqNJfR`<vSgn4)Q<Gcd%9Me
z%%9pXw=!Kk((cmz&q4LtOa7VluRg6~>U!$5>(sPo>yKu{JxPw7)pfOK-Z?#&m@ebL
z8JlMGuC_Vvb#=XFS=APg%_=_WQ+1xTw*2pV6x7x!^V~J&sq4z!f1-|AwAFGhJyxhH
z?5e_3%BjR|E7OrVE&fIP(>GSSpCmuJ^oN86PK)(de&b`(y>OA<+RPV=u5Z$4^uA~@
z|J-9IzFGW>GHs&yTr?ji)kv<CfB1e?!@=}S&dD71r*E(7I36l8UC=JL_n||nwSkUh
zv!}d1f8Oz;IKipE9!^}N_j!rT0iJLnj>OlQYTS95a#K%lnsixXZtrGSrO8_~r1u|~
z@Z+WC-`HTej^^luUpnXBq<{Us`Dx5PX1<kn{mVa2efi~{;GaP8tFE7Js_b>RHmm5%
z6P|fnxIS032yXlsT9cTT%w%)AJ9W1E`k(BfIkToE$1dBYlQL(@#Uq-A`*%Hvdzqvj
zE`CRIwR8WaP7Chyb+(or-|DPxR2Tnvcl@n8ligN@oi2R|vCE7rEoMLIE%I%&ULk)|
z^{dV_)5Sj;V^?TSTy=HtX_*q&*a_34SthY@v0UG(*DpNd&GO{sso6VQ1A^TaBpwUj
z5qFzsmP5A36G1_V^uoxl`S)ebSYMt!J}-0C`JTh)P5i}X>TGY^n(z3<zA<FpY<c<a
z>+SWHRyV}t^;NU<eOF&^ue!cTB(#rta%V-cu(-IwzN@KGO|MRhM=D*qxm4%UsYPy!
zy;pCNGYRGQ72N8u(fs(96OVeTzq|-kQePr*$~)p3r``-Dy=j3vXZT#YJ<oLIZKVy*
zj3qie;~JzEMBXf0zFfb}{()6WSx#>5+{Et>>kSrr7jEq6mQZ7AV}HEoWVg18>ZS^|
z{V@+-=s)(-P&}x#N^oAg4P!1#)Sf_f@5I`7w$FBP2N-OW&`s=hEWGfmvt#q@ib$>m
zlMnpY;-|gbcX5C4M&&gd+g6?YG}+W+o_&PwWdq&CvrDEuF;6`|t9Zg{S3_aOApRFC
z&y;*r(Ob~A|BKL!b5GB1HsVjni+E9IGdVSsTZTJfy=HrtkzYCsm*Lt)E5c9ZFr8sC
z-PU{AP+;}4&s{FOt}LuCgs0kbm#3dDo^`I=(r5F_nw>LFFS^d}8+@a~IbK+1hUYEL
zW1lN8tj~0K-*C}D)_PSAN7D`N4}xEwm(H2G>HiA7eLCGT&+g9ExKX=MJ(Mfh^~;-|
zT%PNur?z}e$Zb5p(s;WjvPb!jLc=Tdy9a~?ZDOY!4gT@=r7P>6<M|g9-@mV{o9L;P
zQhW5%*DQ8Hhsvej7Fl>E<n}6MUo<Z%KcARX9Kc*yet-Lt6Fn>`Ig|7q_LR>k_T!wU
zUH)PZ>sOKXz`QHMf36xoJ<{co8)NO0%rhz5?5TjsvOtBsx?1~}x-le6b@)I3%Vs*~
zm9J;eQomgXa+WXN@vXY;uS%{0+uCdL4_-uWobZ-u)pWrwJ+2FtyFI3zTleLC+5S0`
zE~H<!-Yzd^<zIGdZ~pe^XWdKzneOWo*j;`^n!3BaIwjP{!6F&v{=WR7pMece!dsOk
zJ3P5(i>~+}z4i$Ej2jZ?q}FVXaI8Nb+4flKis(oG>1$e8w@B{18dDaYGJ97&tGU>+
zdAytL+#7VVtxjCKl&HO_c=yS5dw4D`;(V%mVA7`WZ@Z73WGRUJ#l51@nUVMEq3Z_s
z6`Lk%$W5)>wj#x((S5HN<DVCOHRlrJx6GF5Xi%x)&~15Kc;WqT>jlf-^}l9ZyD>C2
zgG=A5b(z)aZq2%vYqQjN8owR5ZT&vo`H_F<bF=IxdqP7V3Z*Yxoz5G`$}M7HbTV7h
z)Iz|%YVWJ954q;I+5ftpaCFke)RTQ~Ed3?cj+alyolpMV@aBKvf|c*|zOXBBO%$=V
z_S(iYTV40Z<%p><SEqS#A78_J^p|OQ-=~jP|3`ad8vcuCnGw0|&O?_w4JU&<ww%%u
z$$4Y5Al&Fv#v`@}B}Zn{wJF=SXx%^Zg7LI#&D`ak2Wlth+@9&pJl&1C!*Fxfy57&0
z5sTNR-oBUi_SO6u=byi0J7&AMuY2|uCh2XD^cFaFY^&HRa{1^Fp|#t1WHU=uH&rzX
z&1iUOBD*+MBk+}2a!F@r_ZO)%=@NI3E6sbqU+P8=gK*?3x2Z49<5MKx_P_h_^-hTw
zV}F6K<c6CU^F5`ue!cD5(r(&2J*lN^UDNT7Y<vBNwLJk&s}H$v**Nh#gJi<`70>Iq
zTFegKkJu-DNqDQT;@*{8gf88decSNm?6v(ITXtF8&icBY@mt#cYwb_$I1LznUFLEY
znH|!$I&{_V%z}RcAwIhnJknaXiQ%7?cTkjZ$*%=GO;7rgOD>0O2?)IFD;_!ZoN;{V
z(|ua5>s%V|+IZ?sDluYYTJbf3vFTCPRlhig?O}(PxiB04{~+W1tTXkbgX!0|tv_E0
z9ed8!v^DW6o4~HCiH{C*b?o7^`X(ITS{J^a;jmS%j^g#6yHCw`et2xYJ1j8!azt*`
zOaEd|+k}R{rx!$tZ~vRUFzS+0d`njEmcM2pzrVe0Up$Mq^vlxc+(*9j7SH;3bXSK1
zLw-k*-to*ioIOt&uAN!8+_|rzfp51D<I0$00c&<dB$#^z9p_rTu{+AZL-zi?Rrx!T
zQ#oJquc%bs%=14qO1I=!qEqn+iPf3Ud_)-U^}0pc>^syTHDxDv+wb?^_~Z8eH{9`m
zxsNrcm8<c^rC0kjzRijIo_pt0lv*X@o3)Rc8gvzfzJ7RW%y^@FhyO(Okgpxz(z;)I
zu(r+Mu#rz(!Mx4>kF9R<J)RArj8hhRs~%Nr+0(mx!+ahWJK^p3>x64RZ*^@;Vv^YN
z=UH|hdt}|@LuVM4ZE`dC^DNu9;k8I`w^vl<>peAsw_YERj!>{u`mggxVq)I2%omz3
z?cBG1IeT4@=N5BDhSH&mzM!`Sa=&tKy2{Eee|Jkien)V51gq+sdlE0)R&>5uD*E|v
zUxj2{w_5wHGe_@DR!^y5xFo!O;f>QDtds6se`w5p)7dk$&&gp!PXl9%m4Vw9jX;MT
zSKggW{J~oFkWsrZ?#cB`rO7A6R~F0mhU}a0f3pYo?maid`ny>SJc_h@Q_uVFT{hJ#
zMS%ZUCfgO4^55I$uKKQVf7{25uN<Z_?h7Ah_N{xIqgc(5(Z*49K!&|mYz{L+K&Z~L
zNS8MX_3H&6zt4PjT}6s{`Go9{?bm}@Unl+C(`A;Y7hZTa<89g6G&U#y_kPB2Ov2hW
z=6i*2D7KrQ@{!f}GTVf=c{}rpq(rt#X60B<yA$C2)81i)w&Np3?rpB8AF*;IDf72f
zr+u<-k`Iutxqj!x&flsAS!(%8$x=6CD+9s<zuI`OdBw|iBatay=tPvVxl5Sf^P3H^
zT2fENyDz;867Q`y3>QvrS;xrJa*WYUQSjN;f9s^LU##^iVp0?+WVM+eKIKS*wB=TZ
zRre10q@50v_Iv9x!8r0r!tu7PH{R-UnS4x$KJa&%S@(_wg^$<_Pj1%P&nWuPC`BVq
zJZPWQ-TQ9o7kC2Qr}iDpiICcV!$4VB;t2D9{d~r+jK|oGo6Wwqoi&)WEWgvsXwkEF
zNvDa0F|SluN}^hO*VQ~pY0Ui?IO#rHNt?tz+nUl%)!#0cNwjf=Gf5jSi0`oSXBBWa
z{<q1rM*G#OXl9Xh(vl6FXLqOB2w(nGb!P9%;@pOd8~j$Y8P4LEv2yM5Rn`vr?u-AZ
z>1zIDiawn7hI9RLw(G^#M(rOM<|!q6Oq$ilS|K6Cr6b7nttnCLi|DRh9EqMQj?Z9y
z_|fu(nQ6g6FG*jH;G(smU76dYuI%}KkzIGSxTTKsh1LacA8W0<Jnhy@w)q^1TY3X8
zho18HstV}(#?59o(QE$V*5^Ho-o<5`*m2)HJaN}7Bh6CDXvPoII5zdiG3@<jDVQ;P
zQMa7At<V48ml}6B@U%PovbeULcx1DAx_;~OCr(^jCpOR5OncVQ+Z>u6?wn_;5Ik$&
zrGVG-GrzK#skHLma7~+H8mi-wl~{Ca#t&xR)mxlIjy(&@RjxEMpAk95^viPDk7tsS
zIIAMFc3$xPrMT!@^UV0wNiY4Rn6f55*))e$RHKFK`XAo4E=2{*X{@mZ3-$-39$f#z
zGWprDt3Nh5@|?cP+?#%Sc7^1&?d{j(p0(;#sU1`}V(G+?e9*z+<qBup+5M(fM|Hig
z+^V+cj^1whN__A9Ptqw&6D}WP?md1(`B?A?ha+M;uBm8nzIn#N{Yc=nV4v|^{$KOw
zUG1K0sn3_Fz28=&YfpyB<fr0^O77j<$Bzi{)v8vkc;}cl(c?n?=8DA@jl7l>KPPlO
z4Lp1(*n5@g3}LgS!M6+-EasjQY;<+v;ft%kx95LX{<Z7B_6tqJsE{iHVwo2f1?BVK
z-@Ea2vigQSu5Z6AzZ=ij@Z#a>;ERjbZg9*nWIwC%cx9w<D@(4;(Hy&5pMPx$OWPKf
zblAo_P}XFH?&sDHcZv30DTQ7|OH10gq*`{^8P0I??%TlacGX~|K!V@q@}DeIyeBnn
z+}dHhc3*<z)GPxB`QJWP7cBO5o-{Y?TjtnjJKeW0+NNmwx5sW@jlZlo+%(}uA$zCu
z!Q=OopE<ZLy#D>b)ygT6otyuyvE0RE`#nP1Rd~YPNj)M*3zu_#iej29usAb6!q=l)
z`04%bi$O6>8at9R*9QK{czpcsnt;P*-`wKb=S}%!=G)_OaNe4j2>xgLwi#C3Ry`MX
z%z2e)*P2VJrrZ5qK4CD}KOy0SdUv6f*XAuz+q(P;ofEtzSDjeW&MtLG<o|1{Z#%y>
z&Tx3FJY~)LcOug7qAi&1y&5%s)$QN&ttR{Fd;Qk=N`AI=6@P5j+~VnN>nhe*vvarV
z*4VtWjrnF%#lt=e^y@xYJTHmEC)!>|Vxy+rH{PbhJ@@(wCS`^$-paY)n)TItdzXhP
zS8n#Z^f{~aSYYm2JBL*D#QHZudp3OGw6zu6yZ+eEM~^;fn^df_5r1{Qu32sEf3MUs
zW-qq6F|CiL_Qk9TNO<EQo;vFUo3G_ehN+BFRSb&HWIl$MiD&T!Y^}P|Fz0gi2I1`1
z<;p#0>#|(BR(HOUeIk*&iOIY%M!J2CK&1`OUa6uTja6AoW?eXvyI}sc=<t80Tkln6
zty5J$xruSN;V#RRbgowh5w?pIn^~^en;xh+-2CeUQ>oQTk+hR*XP0Wvi-@f~^v`I0
z^R|f}pRFkqpRp@WRrpbM<N4sJ6E3^V3y}Y}rTNN^ozZ+f$u~sb&gWd!$CbKfvUhMw
zMO*Je7s>Mu7e6yGS<bmuox*)zLtejITmPV2ikI&MCNt)i?5$td^#$&D(601#`bSgg
zAQpzkIzC~a)v19D?dt^XH8g^M=c->||1<N`<WCo#&E@shJ^1m4pmdk#_7xRN%9txN
zPxjQ^Fgqw;e*W~UoeuuOj;psF3#xJNo7|DPPTM%JF-T-$K#d9yo5Hjyw=-@o2%BH{
zXo6$|!%6ltB`pjGXSk`q*>lm;)i)@kM`)X?pj;il(_iNs+Mnw$NKUI)iF~$d&;6E8
zsZ+&#bK7nP?cT&_c-Z<jYpuM+R<4z&#e;t5S4~#hQGDX=XMs&U?HB)Vmi>K*e-q2q
zsump<n+B(rnK$l~_j7Z$#F)woMZE~j^>_TUrT7k`;GVt7kG>z=)w#Pv=^gWt6&IE`
z);*PRP|lEe*Vyep;q<&UB7b@g+}ag&__K@kgnaMM=`rlpB~86w{JQ?xP1I@ho)&K=
zmwG8>OXg;~Eum%FeTV0<#7nH_d%eNh+cNFXt=jVmEJkNvv9<IC1S+Y@TC7Vk)crlJ
z&0g8s%hI9fX~ChRS{J8#o$l*=5F9(<{Kl6?78jztuPyzPCGwk7MDzaqMEf@>YE!Q9
z@HO0vT#&-rsC}ctO85EC3+(Jsg@OAE);FoXX8y%{w*4#X*$pc-3)3cL@ZY;Ud5`Y9
zggtg&-hNtd?(1D-!LqhVd(!l%t0yxTDNo~#(mprOWcwNeKcP9F+jf0AGJWgX#?60S
zN>{vpX1;O~{}Kz+L)YZ^r*!_w<M!z|oO{D+?t^Rjl`8`s_MWt<c(UudMaAB{x?lNc
zyw$(<c<Sws=9shMZ(d-Y^X|T{Z!So@Ik~xbV_JjLx}_)E%hfNcJ>su#dGai>vHh9?
zW5K3PyW3xHUdOhJSN;xbN>xI}Q@JmmJ0%wO86W+nt1RxK(7XA|`=Ex6d=9Uz^n&gL
z+~J7&{h<Da!2EBf40{{$7&v~Z1cbecOy~Cqvz(f9>89w@P$tuzZc<$<7bx)ldtAmK
z94EKvLdv$|=4~M-xJ=%}KQECHXydBVk954hCDEw=nA~3PCktNcD|`I3%Qd$-bBkwM
zWc7KD0_Nqq3;9khF5l*NTl{+FnaNfMp4fg8_IX*wwRiaxxfNmon~XzL<}*KYds#SP
ze@K(b!Vr~|=|5j3n~As{HL`qtQQ`NC=auUYB^%FFs`zlV$CiJ4f=%m<pnnGn440>9
zvDuzT$z%97vr??z@x^yPzW|m6_Z!dK7$tjp+X_5QnK<v5dUUz3{;S#@PZf8wrxkUn
zndap0h|IfdyZgRVo$f&%r^Qc=Wn<K`SxQ^Es?`&YzW&Wn6~MZkF{Fga?ECZYwamSL
zPh80fp1k&f-fsSFvtm9z{=iV1)_7BH?M6-^fvF}>V)_LpIs2S_z*4%QJ=(6W|Hj$S
z$`sSnpI0BX`La>gB>z~Z@4NnYv$B^?C{?>vs(ORh;+2%Hm*m3ll4Y8kGs<to-VgaX
zC#Pjr>6CL3f@b{E>$$SmPUra^@iNKiOsUBoo!2eQ$9^>Qg=l7+IJhd~{f`$<e%w8{
zdvkC;yAJ;w=FY(T-SzzQSL(EjE&9O1vvnC)+{ZcEULLL=QcWbd7SC(Y^}f!aspGiZ
z`NpbMw!F!^etP_L<YmiC|M~N0`GEqL%2gpoGe0UP)X29l^;>fBsaIR1aq)hp^f^qj
zoPRV^558lN@nV^stZ#AiZuREhj~z>X<h_6U`)_l`{}0oHSEoDF3TyplU(bJEcAl)<
z{>_~Q9zvGWmOkFH$R+qittETaVIj|?D*wHa%{Ldm*)DNbIU#f2K@|lx?c7F(r#-SM
zci;Fee`WEH`J0*alf4cRdk@uUzHa%W>-$hQOYW@Qml#Dxakp)J%OXrW)xNyBX87)n
z)N}2QwSMw3#<>@^CtN#I`}=Uwy%%pdySeAqe3Z8CKU%%ZF>Q~=>Y7upm=!}M!?sWT
z=(Qzh`Ystu-34omwmULkJaoBRVp(&jkcM1n<h@5smsyi!YnFdzSkxYwnA-Zh^^^3>
zFQONnt(+o{2`jP85nUj2!E}X}_Wj2PmaJ6IwCv+9`4M<Z;%UzA@QSNqimTMOuAB0F
zSK74692x5aWEj*pPVe^Q|H31gn9CL&Q+)fl)xvX4T)+I8LT0U1^SC(a_Tm>uPo0y#
z>brEa+p0b4`KEFmYv-<2SMK-sD}8g*N@ZWX=cAqZ2M#|EyTH1$=as}W?lV=w$_-oJ
z6nxqizdq;vOzs<zHnuqz7W}!B{>{;ZH@d|2g;%oiujFcv>nFDEzWFNn{yuB($S_NJ
zrN9|4Qh)r3j^SOf%7Vvefsn?pl0yb_9sfUGvNLV!`!&f^8cLoN9gn%s?vcuu-1Q*w
z{8XphR(rAKEAG9P75na*yLq;(l(FB13+x}JOq+hgb*(^_t84Vys0N1x*&j{Yn4?eF
zEu6l%`SRoPi~8*U|NawbUgv)N_xt;DbKXVpJ$hiDv%RO+t)|>{M@hebLGs<&-D<I?
zFMl-1-P^eTw(Tp0H^TbK;@{=-9v(iZzr2H6?nSBd&$W&-6c#&w{qgnn0ckDXzWWcY
zwwN#5`6w{ODI|CKx5$cZGtwv7hP}9GXD=Ty?^Wp2oSPs2<aAF`pDk_`WPSN0|2yY(
z$uorQ8owF@&1N}c^637}cl!2nbLP6)sjn%Ekhm59U}D;PL*)tFmfb#^R7#o!78acg
z{=M$*`$FH6>Z;fm>(<{A4ijd)e@U|MQ%~&n1yk;RW7~H0*>`tlGlsVpEi!vAPnonl
zg>^YsY0b9j*DhyjhA(wnFhzA%!w3CKx1M`wpPP8T&sXmC%MZ6_9Xe1XFjsbS#2v%h
zXr&JgGnTzRD*P<mdac*rV^7XhUgR$<3tX~!N!j;OndPoRjk~P)<_a^c=Hhyi&DF3(
zOytm_!`UUL<|==xX;+;8$3?i4*SFM{{o>`5trg2Q9@knFukP3GcU#W?d)vFWqSx25
zT+cFSJb!%U`pz7+4_V?4ud_U#HnSOa=lgu=P5pH+mPcgqKB2F{cXd^6&NDKeUC+AA
zG=Ia#*v!pwXC9c#O}hKw%cjWvy{7}6i+8?$Co|=%Tv65eotjtUv+cfLv9>fc^}V{X
z_S8Y!>96ioWjd}uoN#KJ%=4ClRU&aWV>~8QPiFom_*vl0$|;2tr!S4-E(=?+Yx|Zn
z7kj;q+rC_N{_*AiTf(c?Kfg2I^R$Mp;JKsEQsxvNJmK)ghDZ9xPR89<89mcxEm2c%
zowC^IVYl*5Vb>bQTZ+-U`WJe;&O0<Y%;iz+x+#py*JxYsk}>IeTH$!!LjS0)+Cw|p
zWc8^>mrb%#d-9Cu_SX>gqxUbKt~kjNabcs{)fwt0I}Yk<JehjpUmh#Nt=aRBnZGmD
zU!k*wRch+#NYVS>PS^@Pc(~+%aM^*D%pCsqPcnZu{zzSW!8vwo;GCEp7408-PE};B
zD|F|LUHew&uK)9ATOM%e-^zV|X?oqR>4lQ9O_EHf6dy<)E@b2Vbj+Md`T(EqiQ@bk
zmBmL3IHm7a6;`}|s<Ui??aQ-=^Z!IzYc6@{(6U$M(`V+^mc8rtK3M-EKlFyo&QB4)
zCHJTM{T0|D&cf?5*>u}Yj<>Pd?uWtx?h8KLd9bp%`uw$<5_`&B*59eHKYwW%$DG#3
z5^EY3>^(hW+M5&l+PV8Q?U<fgxShGmJ+Jlt9*+5}HBHY?f3<6SWOw}f#?GTR#iiC1
z+pK#jQ2MTDeeQNP{#$wu?_84)eZ0A&Q2Rqw`nQf-mD7J*Ir7!HyY*kfTF&n;EcO*M
zcNJ~B{50&^w)59Sm$H@42%WRESykl!`=;~PgXdiPv5f28ZSI1oxPY!Zzi(dE**|lk
zM;4cD?@C)qo!6<4C;W7}dD%82J^6Kqzf)y)UF0JpujR8AFw9)MZqw!CJ$vNT%`Fz^
zufH5}?zisLEZ!<1nJoFqKPvzCe!N+<zB<oJX+}B6H%6vAE5o*3@sED)>s<a>InK>x
z@##5d*7W8bGZU?@i{Jb6?&H$!(xLh%IQ%~(>DJl0c|4z2bxr6H+tal!=3FPjXQp5O
zV0%PzX6V!9&)3Sd_IY3a%Fbqf>dBPj2Kp*;Ci!1fDo$nnco}`~`22l(4#zKi{J7lS
zc`LvBLl^tXUyeH~|8#QfyH?_Hw7`jf*<t2`k#^5Y6%#kk_<H4U?yC<!gPpsAr>hsv
z@=Xwbu>XR0-#KQ6AKe*3{+Dwq_Z^(OE_LdY?yTdl4xD^=vhn_2hj$_`7FLUGvo`O)
z>igmIyY{;;mOoz1e1<99vRv8IvHed}P?CzeLUD+ui2BT)le*4%x2!b8w}no=y46&e
zZDlh53a!5{!y@^Ximvjmzvf?i#Q$-Me|Nxht-~)LN-i}&rm|z2#G4x{66PHhtx|fc
z-Szsl_LsTN70(%~w$?7K4t6)K;A}eiQ0<Ilo#FHCQI`8xn3}E(Gnu)$PV@5PA0-S=
zJ=`3oK0KJ#7?~i%t3Nrx|9chJ)7|{r>sEW2>ReCWGLhl@(aXR5?8Aj`KlFcHaQ$Iy
z_lsKLBWvPCXMOiQT>Bs`yo9N<uRMIq@&2;O`EQ=3iq5^dC`hd0LeBBpJ#9}vd|)-c
z|Gwk-!|f8HU-WOZ|Ng&oLZck}pVj^OjbUrMD#DUJY)Q|)=__z<)}7x<-x72GEuDMB
zw_<~^eGvEc%cefDt=h5@=O$|O{C%%*?(NTCx4uiSnEz9zGTQb<f32Au_v<6|k9qlb
z8*RFNX*2&F^~m{0LarA(h(~Q?KXhYtB)96dN4i0`T6V_99Q}4JU3=QU{m-<&EX-VM
z_E+f3>-vq%b3SY7D&L8n`yt%@gyM#K@0%p&?zp@_@xc1d#m2dYOp|^rnlR~JNbA8w
ztB%wY%3_Xtgu0yDv_DC4`+aoc_Kg;IyOW>y%wdhQT>hCO3#>h^9Cf+yXb0Ecxl4Yw
zeN?d6Q*0siVQT9^Gmi%*jryiHcCU|IY4fa&XXdOAsR|G5|6cWp<!5mCeT{oR)6+fW
zF@O2~pEr^J$+On8ZBC(&h-KUNEeHH}?Oph-JT%uJpnpo-)T!qT7S4L~k4Ks7<c|ei
z-4jo-{oQ<UA+yeUfA@dB7wdkRb7wvH`bc+2%Gc$3o^dx`Ht7{yu$Z<u$1!tPuSBn&
zt=FV0Qki#|B027@`*GAc|Hg(zV%z_n@vt)6zGJKY)Y^pE*S|h^K3%`&>z}mg>yGXJ
z^=fK&<h`3xGinMaPTN;??BcuiE9<^popUnF)%D-iaQ=r+y1HJa>*voAaA0pQnYmzV
zz{`j>(K}Ap<*WK^{0`qr-T8mn(@kHd{8z8m{cHYl)}vUyll8yPS*X;eYC2w3cyMjE
z{@puo9~2iY?eWwW-8GRZcg})$m%qQ-6*Qy4jB~DT2sgv5&}(Z{!)>zP&NSS-ZT_+4
z^E#s?C#>m8b-6zI^B&bqo?nhfRp$Dhul?L#bnAuk{LId-+1kHVw|p#XyLG8hpGlqT
z8}GB#(IH2F&7GF8p?-&UgXR>;^?Zl6n*1v>xWHeVdGhQ&<8$A>OK&tY<lA@naJTEM
z2RH8qes{Ry`@LhYnN;hc@Ehf8cDwC&uSgEKc=M~^-t{ftK3t7WwYs}^F3ayU{@src
zeV=<$_usm#8E)TCZCO7xaZ$xB-X#kEy5j0~TwAR#Bk$N_t}?NHfm(C)%V`yhDz+|K
z9Tq*K(>M3)QU0?&In_e_S8lVtdG>?JT29YIHs_LwrlHEF!z^={-}E2lOxs&fcEaS}
z9PzE!C7d7p&cFYO^@?q!VpBeI-6@{G-y{n~e*FHE{k;8o{OkA>Q@-Ede%tk3nt9db
z)J@mcIVmO2V(&9Ah?dPLW#46_;BiFXCvwWShmVgZP2V80|KJTt<_oJc6`uy5)?F91
z-|uwEk@cThcCp3=wcog%#~^6EvBOV(W%-T^qVr!o+Q@O~ZBYfcdP4>8-i>$I&t3^h
zo3k{`U(agp%dd>3-5++m?vuBj`}NFgmjhhlYghf`T-uwi{34(KrT(;f^`qO?{mT6D
zXHL?C^HPi-(q3#@x6!s{pVp5&{jY1k8`rLHyx`?^`N`*{D%Z+aegEEgK02&iDWc$q
zMn=wSyZEVAyDkLX;jIpsT2}Jpl*ZP-k2bpNs8;_f^DO?=lP|m|`*Pctb&CrpzCLWT
zT1TPh*y<OXmu>A`e*TBH&YF~`mPzORc&@B_+;jNuK85l_*(w(_!$gj5TT^2iqqcZD
zU$Wcf*Jn50oxZn@d;1xohI7oB-gW(rKX(?2Rk*fnD^;7(UtcEw*W`2j=Uq8*N4yTm
z_AkxzNlQKD{XLh(%t|4at!8fUBumxG*~trDi6p<=k$ak>I9ci3|BWgdz8;wuJ}<Cy
zdM2D8u<pf+5`JOLJ2Q*RQf6=J)C`V0=U{3qlYVe7=OQcH-?9;o;nK28XGl)-*ZQb<
z^owU<l<p*x_2~zn^*&}?^gZs#(J6D3S=|r)jOBa9xy$=Rb5ni$tKE-%cb02xULOAA
zKBI3_re(|9Sr*=9=ePV{`qbKOnRDU#+v{ex3eRqzQ?Wd<BXH8%-Md!)*4-z>TdaK`
zZBu1=tkjB?$Bs*K%KPyf_UfHxP}((PMt07Po4Ve=XDF8(%3E?y;rKoCcD2>IzgO@(
zK2&p9)_1UE)vmntm4On<Ud@><7w?8|dKH%-WcGT)48Nvh3<4(?ZthKQo@#pao?iIU
zaMMH8v1_lT2ZnFGb3^&gnwYb>TQzG;9~dvX>$&suYHquPYmrA@-wR!S>B9q8^W0r~
zWaj00%v$>)Z&R0XP3e`kEoTd+?z$ruw#eM>K((9*=l{FvZ<HK#dw#6Dc5ro{g7o48
z%bxHYzV~Ra$ec@CIo1S7lx`7SpA-7mZ1qIZT@#H&?0NP-E?RPAs(qot#<EfkfrdX{
zt4-b<s>o~Wy2L0|I!`!z)}{4VCH<wiWcLR2&Gavwsoa#Ax}$u{?`H@0^&I|F@aNsv
zhy53Ce*73cmFb{5=ZTM-9`Cep6E)iOT0b*R$h6|ghKBg-U5AU}Sa&AH#4IjOP|vS>
zqWFWY{MYN3HxEvf3fJ9!=kc}Z+?_M5mc7<J{Q0Vk(EgA9FT#b_8LF)M=+3k9r<d{l
z2{r3i=kjz;ZcSwQk=n}`_)}lne|drxbLvc&1N)tKu5C<D*k{abvF<-B>Z+oagMNBK
z5)2G`!U?P@DoxTWsJv>EUHsT=(*3{M0{*!ZcP-pe_oS%v)tu8QZ%&@eO?!08CoA7O
zP*a5SWRGT$_k?YwcK7r5zdP2<z<F}k>MK{~ZZq<3c38ao;tO%9nuB&R@&AthIBxTF
z>4V4HCG}_5%=}z+C@y!>m$v@%k0vh`e^a{k=Cz-%mL;aEFMs}c^W@FJ-#)f&E{_RO
zJ^e#gf7Mwjw#{wouNN;)ja_@QW?#<iZO=Yip1wYNRbE8Uw9v^Wm7!c$)#Fr}USALA
z=Usn#$&M$|aZFk-&64hZzUq9++~Qi^pB;BUd_Or$J7f0k(5R`WYnD33-Cq|M>}>8*
z+IzjDdZK>G^$)w6^ol3yR352Y|EXx+6>Y(d)^Xf3O6P^W_6_>%c(`Wnl-m>Aq6E8~
znE!VE`=f2XIqy|gsCxFr<v*jgz0Ujfb=QipO}*3K-r{L`uKYEo_-_d3-!Iky%jVC1
ztEL~WBlza=#lU?j@{jxL_wSpv|KI7WulMh({eSpL$HD%z3AWE=476H(S&S@qpSk>O
z#cP@4d-j}uy=qCQdBse%n_pRVt{UkVr!cLa_U4~j=8gQw-3&7YGw166$ai4i;PeqY
zl$8_79K^~Lk<zraDLrT7R3|f~ip+@|2lZ|rRpnKG*2cDXq6%C6Y^BU;p?l{s?6rTk
zXlB>4c{8_r&b{}9*FVteudP^aTnb0Up#^)HXD``)vWwf8BVcEnnagtNI}Hy$9DDg?
z;;a<&=|Z-5yxlk#y-ixsaz5ARlG^^}zV208K8x>g<of<z>+e?lc$>$Rc9zrM%qtyt
z`|K<J_+I04P(XNSvF^@iPI{j{UCTLjC+TH@tlfuYj3-<44DNp~^LE$KS{-hxq5t6M
zR>kwKS0!H^4LfDncfXPU4`cIvyX(GdFZFGIt)g!qk~_C3WzA`^#9QS&=cc)Cy7iH7
z%guG>^8&?+?>$LX6aTa-=hfQj=1q^cz2v+%;qg9Qtxn#+T+Igiu*{$h++rd>1OjG<
zwca>$wfF(U6)hW?C@$9Ttj<ptP0_hA+ehEk{f$hO&L^Qt#jV9bK8~8(W;gj)-?DI;
zlxFPkqBissW5>=E&Wx4Z-_$f)?l!X&&3kGZB%G1^L+_@>?4MFS>^enf@5Qk-nTiU%
zFuOG2=k3!!cZXl^(CKmg+mo&Sk?BN#nrc(dTvp+q^?}!Sc?IXhrmnmjB~qT9qv!K^
z@)3i_-Uhc<Y<T`T;6svRsg_34v}5fDr)}a_Dy#0lCiKx|<3x|Tp7^P^XX-k=ZM*(Z
z!z`GGw^D*3zj>nZ%r?1=N}A!iD<*X-aJx-Q5j!pMk)`j!|C!>af|hozRXVq2>8>kl
z`XbEYKehZ3ne+Gr&ph**y^6~G38v3BI6sq$xsk}AeU33p?^BS8C+DVny?wh*R%v8A
zFzkPQPm$r6)rz0?xAr`XJn$*#^NkXNh7x@SmEQ{U63r`~FqCc!%HcK<aG2yL%^tJW
zHn#W8?iX(wYZVLU9$xT8Oj`HfTluW_oBK;o+xJR{J4!s-aHh6<ztzcus$YN1O)U6%
z`umY-saK~(%Ix^zZNKcX$=mr6kAxORG5MM>aeYhRkxJUkdYI$3_G#Bm8b4g47oBJP
zT^AGfG=kxpL67{~i8krC<~eO<VVqMH!{Nd%BJgvQ@4ge=dv0#}y=Ujds#Bs7TLm^$
zFRf$FsybJo@v<l4!+P=MAAe@n+`7NKxZw4cvJkrmb_VyAX4Lojvn4Dz{zpx)_>%yG
z$bA`(W7FhfeC$)J*xwxb**|%eWB4Ck&ub!<ZvroUY*Fg<czIQ8$JUTW@e79BmzVHJ
zwY6<~cr1xKM8kl6ovn~r*G+wCfr&lY$zR^GD$kSMopkQtIo^|pEmYaA1~)Bf6Z(1P
z!YR2xZTr&bcHN3uTTbxLI4<y9eZk@s`HzO&@$zoZKK_erlFg||+bsN7GJcEp1tFPl
zcdXpQEPQ@2WvKK_wEok$JhwUej(>T>-DZj88A~`P)(dVfGm}&*d3^ZdiJMox&zUM?
zqMA@29rj(s-&6fwXO&gC&^Ez+7hXl)ULqkqpV_CH|FK)&$EUXXT<m&#mu(k+;m|V8
zv%NB5wu)~P<K~P9{EJ@bX-3(xFLD;PXm4Z`R#+?R_I{n+pD**$*!L^%UHNHBcXuYk
z!uYr*ccBYKGuU~~T>n|$WZH9KjhKy~jC|rk7L&)xx0uvkCzwgOUNhMdl_kV<#OcGN
zN!v0GcrM(jwCuplcEi#)|8!QfcG+4O=>D+f6@PH4p??>P+wAs_T3gf4t`gam9{E+E
z@yPvB<>Ozb-<an6$sx)sDK~qo+<SdCnS$^6^(&d$yZo#wAGWTQtdO{{VDidY+z%Fg
z<SzJI7?RfdEy_w+{N9OWVT~W7s<-;`2Fbqg;CgQpn?CWb-E>BY1l5ODOue&{=cTiy
zzMSKKx3{_ENu<Rr*_~qEr3(7O3O?!YvU}RUT4#Ds`n~h6#a709A>U=KpLu<pWpHHD
z;w@TSH$LfTa?PFo;<=_lU&gXV(Ut6*Ih{je5AUzc+?+18!tvmnmnR;*o}{bTGH3Ol
z6ES66=G#|y&V4Mg@#FR>OA5j{ZKS!F%O^bjQhQLr&Q-PL^G230TsN9Tl<!+LiZ|ps
zS(inMN>*H3kd`289y(L8e%2~>Z^;`ce5bkSm|kRj>2@cr<(kCDR|gpcS-8D_IDGFh
zSrWN@$Mv1j7go9bamc!E<ES+~m+|&4roCLbr?>fNrhj`konQW7)FGY?J(82!tHPHh
zaW*l_-_(CvENR2^dHL}Si@tRK`zQB{?7Z;c)||Af7q&GwW>qe~VSnJ_!JKDbcsFjo
z60_~{jABEh-%TlwPDXN}FLLY{<Y#6oR~PRr6PvO6`RDfqS5KDlh*%x2`=RW7_O+A`
zkFB1ApVLwEfESG)1FP8N>z6Pv>q;~Fa%q2RKePJJqHTstp6qz=M86^T)v+6EZZ$4i
zyK3K#2^Z~8Za7%GPUYd|iwUXnWq+(X6n2ZT`agCL->-FLepBod_8sZ=+^Gu`*|VD`
zzdz!$e5t*BS^H+&j%JB|TPOFs(mm;m=Z09G`dmD*t?NVZ3FX#jNmhp?@2JUl?yGn%
za3?qP5&w(_`wf0nU)@x?X=)j-zx{!v@b4Mx8t$0pMH^^{++EDM-_cw~Cbsb!AMe~P
zH764IKc!9MbA0@*$0owFe&u`D2mIF~`BeS?Ja8>zI_w|$$c1NH*z^Cqns;9c1|G_o
zVf0$3WYa-`volQN=UiuQs*EWy=?V>P&WrY6W4_#Qw-&2Q#D);h<o5W4eL~h1SM|6p
zPbglRmwWKRvz4-s=Nz3fyWCxAX0PP>Z%lKwB0er-ePWX~UG%Hq43(pdGCoGaZ<Fru
zcB~cbiJaH<&2h?SM}sBbnN&_~d;Bl+oZ-B0l514hb$-Mjdm~!mCHiGWsEFp3ojlyB
zUE8cHMSILM-?;2t{_LjR#MegWzipJ+wcS6~OJZs6JafNOar;(W)Rz3QyNc;UC;L9J
zZPxRI99r$!t=Yw=?>gDM%TD7@qZHGp-;22ZS*yP6(fKMS*~)c<`SB+gZkPHZZu_3=
z8uQ;5FI*8{&d0I$s@!}wE~8^7jBI{g%u-;FF|W`#JU={CNo@f`pEc`*$9e~K{O+&s
zf3o`I$IV>z4o3q*AFQ9hf8!5_SB~mJ+5h+#ZqBQFE?i$e<?!;ATa!&cmxXM4uv&pb
zGthEIjfw5egO}&lu>SA-lzZPcDN0wu_O$UI*2tr(Gnpjxr$u*3lrjZ9H8m_|o_M<G
z)1HT_GkhvVoLBu>-LyYeJ2^MzIgi8tH<t6_d0zG2-n%{VD$~o8G3TQ1#Idbky={VK
zQkP3;S8$qiF7G9KHHZH-GxARSbzf#Uck;UptDe~I@y>Hpwf=T2l;1S|>7s{QKh4_4
z5I%q6zrN1KqtmYDb{_lWz@F5pULx|sYu4|&9XyVF>VfisJS%G+PV0K$_4n8&o8UgD
zn<}SN9twS9Ki%^CyzYvtru&1suW8!~=FVz*_r&e@4BrI{xSb#0d!z5g8|Avxp!9G1
z_l|@WX@;H8R)xxIi-`B`KAtzpdXAuf!zvShsWWF!b+*s`%qpm{%JhBoZKeIDU&D>k
zm2T`3<&~;gIU_Y!peQoRCQLV=AnCly`rEsX6)Ak_k(l~<!DHs+L{*M68-vdmu8HM(
zs`!@ek8(Z}<E)o`tN(C#6dg*bl-&LArn$<W1B{_JIGsecsGI(J^3O))HE%`GgC!Po
z?r&s#GH-b>?_6W&?`+f0e+#T$-EmGgqkLt^ZQe~Y`2Bdl%Pe0JS>5IK@zkw^W`iqp
z+WWtC=Wb6>U}%joXkAgjYj9%r?6o2Jzu%c!tYHp)b&~s4ufeCZ?A-HL3(ucWWqq6W
zcBAGbOK1M0U+vlN%?kN?EB*3>w7<H$xF0KSvTG^quYN4hFRS?WZ<(g7w5qbDEQf2g
zljEQD&#cm}vd%C%oaFteVvbnFqRyGy_chs>Xt0>ywb5^xDji}|{;en>b$Q|14fi;%
zXDTjh)QNnhe^NnnowDH@+oFXJJ*T&&UCof?F_PHNd&8S)GyA6nJ67|{Hz!!yhJBl%
zaAU2)OIh|OGmqCtU$NO)8r2yue!gket<UHAo}_>1xG-N&ZsLvQ3yw3E#ECMO9C*5T
z_k6=YYg~TI?qt@OCbwa;^TdGdOz#s6Kk=5DoniC7T9)NE^WSsR(C>yOyboL(Z=Q>q
zVlBbG>g}CZzP~$+?iW?AxoCDu-)aeaB=5|N1?9_FFRn6sWBjl+w#$Q4>uurNCH{sI
z>K%zijaiyJ3@cp?lCsi%y9!m5yn0v?A+_wr+Qha6F<&QjTV~u?v&)=4f6t!o>kBMC
zPwM`$Ovv}nSI)VMkFUEsS3+u|h%o<KrihJ`#Gj{2Xm4-2{wZ_n(@%`Mx_m=LMZE5R
zaQeE2tB-&8B9)r?TY8&rJu6wkD>PeF`{uNi@{?}<isznvxDtFJ<mbAlSr2c2nmWO?
zw4x=zEN;07&s3Z6#T5=YjxE=xb#rZGl{mN2B)s|I2d%}cWc?@BaX3_&HuT5Z-fp?W
z_e7$Db&*@WJ?~!gnb#U33ph{C{d)Y;6aQ-}eyjF}zHq-JT;&q_zw8xv#W(g{|9<wY
zu(Q7Du;Tx9<EtnCvKqbLDLMD@i}dub>6_=sI<M;ya@rct7s_VwN;SCa=>wlzMw(r$
z6{YMeIuc@7^ci<8Ra>!GOzHUh+Jkiuv_6;}T>9m-w`BC8cPkG1YHL&!9xDFyLPS7v
z`phZzY@aLE@FYsyZDvqdb!(aU!|4}z*I!s5z0x6Ym*BD^R?=CEHpRu)w(5MmdOU2^
znd_cggQe%*u0FN&ZiQWv)psk7PwCUj98(0upB8&HIh(ew^!v_!e%>m3f34EF6Q3P*
zdgL)T>cQcPp1;+0E%yIjHLkcF#B`&`k=6BWlFn;J4yC=DzH0xwa+1-h>g2L!$pn^7
zf0*tD1wVcCda119E6X(|5Bc{n%xhiz@<+)tR)>yRm1hp^s!iV}{@Lr!B%RljSw*=c
zwKaq_ijS(X2Q9eowav!)iQFH%sTIuItC^~IJ>1&D*)hvIcA@*fHNS#l8Mjy~r~f*n
zl{|AgLv-l%*iPdWQlXcnZ=HE{Ro8UJFUyZd59l1xjuBX*D!C#<&uyZ!_mYAwUxZ~>
zbn^O}3i&DiS-y1ZLh~7+{@13}p7#5$u6=K->*VCLqq8mLQk*@G9N409_2$v{e@#5|
z=RMBWQcLzI*mvjD71j*ze-oCd?bR!eKA2e}HlO{tb44}RUVatk606Vxz7-2ZTGVxS
zHLq1*liOG3{Y%JZ!}~L08;<+=ubEr@VV}u_|Mj_nAxqf4-drdh_I&#P_irPYXWW=0
zmGH>)pz;S!=V?rRd|aQ7g=}0Zt@xqnxuEO&4YHMOlAc>%Ppv;7vSo&CblU}cxerSw
z=2YpnuKM9zzG6!Er;96#4)@G1Fgp0@Lq%|Sx#g~a|9w;Uo#JtQ^(Q)7U8^lP;qETm
z*f)2y-*-QbD6PL;vfcmbng6XGPHQf%&JI|}+7oe#+o)tilX9scSFhZZBaP|NB0S~|
zdwyy0?<wW`Iq$mF$v(ltt4x8qU&{58OZet&U*%U>pkOI{t^D|bhx2Ef|FZeBbFy{p
z6!Sv;ax2rScd8Em{Vhu_1#YQvFM0PN>jt}?tnKN`o4+4s-__svXnEh2CtG=*l!kK(
zmYBRU7Of54I(^2<%C1X!v8xU=f8LT|d`@UuV;1{v$DIy6sc)0GXPFy|bFry?y}4U)
zS>4A&AIhY7-mPY94l!xD-w|*|-l4`NeEueF-rVpsyKkpvDXspZ6U16HG4zx~r5CgE
z@(0gfPDtkN?YQI8WWI2&e^~g`J>PTRY<(sEBdDk+XXh%m39T=aId0!-uL$n^llbSu
z*YMBl_sNJyTG?Cw{8du(_1Wyt`ul(W`g8T?&zI);``Z5RwX7~KDy{mYzy92QtN;I|
z+RopV#}{_@<jUUIwGa2b%Cp<?cGl^<)!(1B&T@)nJYy`D7SYY8;*vAfGSs2W{q4jA
zwl!@5;&a4ha{jN}^(We0<!!X`kFukCKd0RbS&}+ODR_41T!)PJf{*=oU2ymEyZ`#+
zr>B!HpA0&#aqwEmww|kJ(yDK|y4N=sipnlHu<8HXtLNX}-}ir^_0?_fX02FRYB-6P
z*`&(co7YO>^r_E5_m4~nIPfX>$=pTz-T7o*KK*@1i+xkat{=|ZE>GSpQFeCDQl8Ar
zgzGz2TJ@E0n#lEb<$_HI-6UkQSZ`eBJ~bik#KFr7H&<s*m|I)x%wTit8Ef|GrqkLt
zkGNN|wfYs#U9uru`SzsA&zen-8vEEBnx5Cr{^Bq1^!9^6lHsPI`fpz4&+JN8)e^pD
zt?A3*+<Cl3wpo8^hLuHX$@-&uiK_dLFMZkdykq^ui4{5_?(>&vf4ltepun@*CV8)w
zTXvb;-}}Ov|J%vB)aLh%CYQPo1ScJ`62G+Y(r=B(1=Sbd#<R2d{ppc;<p1i8-?At7
z{~l@2J=(hQ(L2`Q38|8L0b9SEd-&J4<)pZKVlNx#v2*e-uKqgp*Ev(~{4eIeg_BYr
zE|A&5AAiVfKD(vFx>T=rhl9-gTb*7$IQiLgb>z9+(3JOcFMj!a-raad@k=$!{@g9|
zW_Le1a9HQH(xHWK!nH~`e8Snw%Xk9ywkK9yU+iqQqp9e^8n;OP^!INZd7@XxKKQ1<
zA$MXM$Nq&(A2OD|GTb*?)S<(<X6?RB3uL9Yt3K1Ode3vE&Sja*)_=BgucHOlt(|zV
z&3w&<&)fH|@3e5A8luay@zKVj7sV@=)g7*0yZ`1c`KIWI-rVrgEh+#1roZ``9((lS
zQ`?fDro1Ce>RU7yKRWEEoO9w^V`1OiD<3|1Rh$>u^}&5!N3{43_V?O4TDuJ|a*2ib
zHmzu1wEftfefQJ71!6CMXK~`V#k_O>u{^OCg$nLb-H+ATU+vtIb=a@(w?U!gn<RnA
zf^Tl=W`ES5>)$!d#xaTa^22k@+x|sGNUDBca`^rAvgfj8D!YHbah&%yhA$>tYsR9S
zgmTUGr)^gpIdUNNy!4#=OniBEQ)QA)Za&pHX=XXgrJWV4@`@`z`)_0TD*G=ku(is#
zcuDJ|q&zzw_5`OKsh;D@*pf|bXU;jBBVwrg?Wlro+Vj@?0dC!M<gC0mdQF|9l=!-A
z_vCNI&%RIFdQ&{hSfw`ZvuNz&-lZ+=2k(AK`EyohS^e(%C-)fx?GJ_Stm;sI^G>JD
z!pN?8`k@1NXIfvMv}mUPQ{AkPJ*!riUH<*1Q&Qo5?zgt%TW>Uk9XlN<Xni#4!;WVO
zH-qi|<hc~ITj@&7lr!Owny|wBCv#Vo_cNPmCP_<dJ}~!QIr2quht8aDg<Uyw(w%!B
zI~3-4PEVXF9awL4;*E{fr}wopSMI)=Sl@HfQ~zm%e8R30?oTV_-7h{i+t7a7?Rop|
z_e}4m2L5bSI`E(AAM@g>`LQ#Kgx+Xh-XF0;l&^U4><GIhp~o^mNqm-5&~9n@xA?rz
zUR!&9^Y6t+=YM_w`6<7`of<oi<#$Vs-u|C(J*6Vm_D=}Mw>rakvsa~jR}XH~@t^or
zG_F3ZQ|M_!t*d<VnVtU{6Tiqv2r}Q@YU#0X7uVfG7vp66+pgPRXIGj&{oJ7!lhq?C
z{TwrYYR|9?_@BT&|K}C%e@vf03MVVpZ26J5^xadL<-vAhleB|OTXbUiJ8qcPZF5!d
zU-2;b8gm8bilBl!l5=kT?C}4Q{q58Bi2uU>h2@S}2-)vYU)0F=al-sF6Xk6d>7Cj#
zr|#GGs=l>PZ=KJq)?_|2?fN2Xh1T2;85ci2vChAH)JC@V%f6|p>IYLU_TJgh=Q(Zt
zp80GqPOVYx+#n(Rw(5$EP5*cMn@cY`r+pQ4;t{xXaPy1VtM~GMdt=eW>2&steP`f-
ze<n|wlcu;ls%Jo*O)$9p^8+&n14FJP1A`KtJ<4f`$tC$km3jr0M<e3%Z<`6!e_yU}
zi~V-1Qpw%fjbgrcmz=(3;`(^uZKlJERZl%rn#kmN^lMw~g4*8NO?M|warx^xJ&F05
z`0Xnn|J{H8?#qmr`ij4gPg>72Sa|cK>#3H9lIdBFe%`a*+&sDY$IB;%k*7Yb_>q@?
zV)OF*HPxTqyxg3BBJ2DK)yqK>rrg~aGmSMyt?lBX;)m<)IVU}yn}4#^K&QQZ)s!wN
zy`w3UG$SXRRa@<|^hTO<1><?1g-#yHo?lWPo!{i8;&v+LI{UMTqK(QSlc%PO<gZLK
z?Z3Vzg~`XOFMYmnn9^nqi#;i6`oXqE8$*l|qw=}DH}16Uxv*zdMc$5#o32lOt>D$Z
zC0wtq`69PCx017-O=adHR%?&a=*e?y&AR4YU(WpNQ`vNni63Kq|356-zJ;CfWlMUB
z==!=}1=}L)%D2^2fBbhg$?1Wy3EL4v)eN~id7N`qN@|i@Y$Feze9=0i(|X;K4V;1A
z8U0SDn1nT+-=6hGXi^{dwmaS)Cp(wsxb8`8a=hi?I<Gm=d)D)k*_&t2E;UIya4XJk
z`2@pP6?`)<?@gKiX!+mP`I!rzo4m4lwc=Xsmah2ENA6@SR{Bw^)%W_}=kl1@vmIZp
zm0tDWP{R(x+Y{H%jkeQ_nx^x2KhGcWS@vu%9?W{Ncg?3MIg%T5nD;I+Y(MmUs&3+}
z$3Jgvt_pSRN`0cCopfd54BOV%Kk|?BBzk!^Y+A}He8}~fND`Z}k+P-kHqEUu(_ELU
zweRbBZ1E~wPh#?ukk<<KwK`(w&bar>{bWvB5~{vd)AI5<hAu9HC1(z@ZVF<s+_*dI
z@8ccJB6mNEyjaP=yyKzC^Zg4Y6EqAL2-+x0&1m*ydcedPTs}QBJTpMQJftu(v*@(z
zs);5cs%rDU`7pSPd3bc*`FBd_gH#4nUBb%LW4wVp6QUN}kXh7wM(Dlz+xe_|A7e~*
zF+4uZI#Db2l=Lo#sp8wFKG08T%QCqooBX_+`F!!2DMDwx1V8ldzoZiHDX7cHnx)2b
z$?}1V7Nb<w76yq^)+c!99TH~Z?U^)bW!vPl0uJtc4>x%2GFz}vz3Q!F>#c8&zSX@u
zgD*}ppJUA#aQjIOo6bS=IQJcuDj^RyGnuq19Xykld$&Y-N_Ni;-?h8^&9;VTpI^9@
z{U~qtov>=5!%Xg-Azd$nx<r1jJUeg4#4<k4BX*aWKA9Yf%C2De{W727-sO&*g*>tI
z52sw%t6{cgnLYE`gE^~BynY?MxAB)<d-{Hh(!lLuTrARZ3zto^Sl7EH%E{-1FwYI)
zg3`$y>#T&1uGsiB(Nj5EvU<98uiLEmEJrUgH*=bn`K!ld+`gT?P@J#uRNmj~k_CS+
ze|_~v=<!SA<BCCnnU_zsPBN8HSXCz46c^Lnwz_9Zs)1;tZJwF&*-tu3daJ~QXZP&c
zzS-r8r}&|_?GGauKl5;Goi6Pn%k)l4;lo~$oEC56+AE#cT%Wbae5sprsD|m_Zb`}b
zYrzkUi|h_<^If$5!qM2QuRk0Qtd(BxFaLV+M!7`OH-UYeS;v+;L_MfbFGyJw70vj4
z#eJWi`0VoPjpEI}-TYP`t>t%T$+??wC*6L=blv+8MQl@U=<b~rUw>oUn_un4_q#tH
zK7OF8^6S4pkItr*mVVV+5#B9gVZ@Vk{i0tWpYoRz(+p?NV++rH$o%1sVT;la-roB~
zv(KqB$~}pcnWi3b`6u^>Z@=YZKSkYszV+VS<8>SnS1yORe{a<O#T;)PSMGjn;>|bQ
zpUvwGB<tT7)cfpnpB|9B!QGsfV;OJvkGw*WPXdC+9<JP^VlAUqdFk!1zS$)r`=nn@
zQr&RG>eP?ZVaL<$*V)aRS8ub|=6A{0k8c;<HB6S!C=i?Vl}qi_R5`BW?<>FXPqN!n
z`*>5Xj|acxV!2~>5hp%<`ttVXj0T2xix>>#&)oRB#qeBWr5k_pw^!}m<*U2DC*QGp
z@zJ5oQBc2X!*}<He}A)%F|w_eSzn@Uy=H!5F)wRUQGdm5^^?+%PW@eaOkBG2^tEj_
z%hPww{2kRJqSg4d>SFYhf>ZZJ@*1N{%y(K^RyuB5;FYc9BPl=g?sop_H13{jN163@
zHnS>h?Ns!=qjbepOf1q@{HpQ(K+&Fdp`Ee<Vt)(WiqFoPxg#+w)BM9PRi%lpD<#gf
zN?j0k-^;U!;mRt(bLWaJ1d?}ntu$p%;VP*vb&(IcvFuKOs%zbs!^SVeD)Kouhjj^m
zkkKs8dQdOuv(KV;t44BlLiFETS}CfQ{ffp3C8fEy+e_+n3wJkPSSFg|m}qn^%Ke|P
zmg0WLXcvD6r6YDPeyN>kC_VF4ZK(i<;q3F(zNe2qm3eIRQg)p}+ruB7pG%DE>SC|;
ze)(AT=8d_)>_v4`=JxHeo3XBXXZF^mhgHwK4L$aCO4X(|ho>93mbl+9h>&V;%-#Ls
z!PfgaIh!Y%C)~RuQo2~q<h{kjr-j#+_pCN*?M(^${BrmIG?o}=1+8mlTocpH%O%Cn
z=rYfDo)^i-T=21{>BrgYlTWf7p0{(l*u0SQO|g$>^{$n&t2%f<V9%6UP3JB@+`Y<b
zkwC|For&+(%FWu`9&^6Xbj{(W_Jd;Yw`PakJEuL__O$o!RR{AHF$cZoo^<NSGFFa_
z=J9(f9OJ(A$}#?3R^PwJxvaL_HeZ6RZ_dp_FZbO0<#e-Vp_kmIZ?;<|1-Sotz-Ap|
zvy<VI<S$+=yPjF8_G0G}&eh#a`^d<#_37nlOrPv6*fy_knev~*v8l`XYT93~6;EB1
z8!jAgN))WVeP^fr=6`ek@S-*$_I5SBZeeF&5EW%$P{G%PC`!ytEzd8?)+?x-8Xld0
z`<PJO_4N`*_?HBAdBuD=+Q2`{sx0e@Z%xAEIbv-JYfenvV!HM8JH4d>j{mCD%PQ6H
zE~}c5TJ-Jq&N|~_HvaGL>!a^<ws;>F->x}5EQj^F_y@i8lk@b?JvQHLyd$V`<<Y$S
zhkwrAelPw!|J?mUkLMj;e@BB;)BcmsQ+6AkX`2t{Y`gl3;q}*T8(N>eHtld;w}n-0
z>83MWs=lhi`7<7Vef{0$xlpLbspCe^<!?5+7yP|hq#Jo{U$<4!_4&f{gyUMp<UJPp
z<Yaj)Pf!*;_<x7lyY`JyCt}rjZbe^P{yMnb=k1@(b8gnMzmxkvH*|mQOl2km=Kjqy
zZyZYg^W*p5ufJYBf4w?B&%SQQ48}UG1igMI?UyzovitMo&!%}E>rsq0-F-3RyXVX2
z*G?6@Y1!FszI5ZC4fn34Ut6+%r$elrWpm`WFB10`PV~=spT#=;L!hT!aeDB+qXL|o
zZ>nUa=H)6+;3#%n*U4bIuVKOB6oG@EJ73OquGbf0mwfoXd{d0;1jC)$H~PN6Tjssm
z`uT<*{l6cIF7LlA8vor%@R#=^+3krBR6aafezoSFjIryvQj31+yT>zy+2+LD+;Nnp
zI6W}eY4y9*zl)pu*L9o}ULo~2Gj7g7--)Syxf{5oN<3Phb%ySGll*1zr%B1PjAuAS
z$o|V{vfS=>MNwSxT9UGp{8^T;GcKGh2i;l2yM1hmSM*CI%wo1Snz+&TSaaofv+~O&
zY>fuZ2^WvQ+Vp>c;aAovr#Z79t)1{P;L=n1(35-G&(F<mR$A8eINA2X0tc;~9vX`n
zIXo*xKmCljbo^87y!1W1iyB)z9o}gqHur}r26IT(iMA~-w&3LYHE%z|v$y$o<PNV@
z6%VqJe%>6o;oyA_2KISeX_aBeCRd!3JhW!7*z|(KM#i<9pLuL3`f}>2hrMKQo}s(*
zOOLBRYwlfg_*&$`#5>zW#3=As=)J0&^R)J=%<!A&R=3*ZiO5z?nMKJa3Bhj;<rXZz
zV*F80HpBY^cjn)z=ju=HXZx#T)%?GB!kpzHTh9m0)tE3NT4$pyOZYYEc^jIfCh_)k
z+vJ=Iym9`){%`DGB4ZmL+^}XkC3fjlLAIy!F4q$(+ClFwBwu27UdfiB?p7O|xJ+Z>
zqs(QKZRfft8>qJ0Y~q>EZ({q_wdp?3+$^?=Fop7oMpG`{lVgiMrFdehV3<s${rg{r
zE19>samlr4pQ)|-^0%AQz+pxT|1TA;=iHGW#MiBl*xoM|e6NQ&s#^DY&FQVh+fG(G
zUG|Pjjq8vLv3gp?_bTG_6ybunI|&;sI42&SU>3hq?bE8mf*&8;;dPV#{G!1}=wNN;
zcdvQLkG3pya$mrAn!WtxC%+t%%TGToQ<dep%y9W|jXkTeo&3RN8#V;KD86Ko7<p_t
z<Lx|={!<54b@{R~tT&(YetUIBBD2kTuNC~9zhahTIo-d#uRcJsG%EZ`#mm*dqgNc5
zdsOeQ?px(I>i#UH$_E!J9^bfR^<j<dyQ=^7!ewjJo_yYQX~MrARX0&nkIb}dAzkwi
zD+XT-cq`c;;vHznqviLE>3H$WZ1cmM649O9let@0&tldt<hz-q$#d9MSc6k|8n;24
zi1hLKtnSN~7}}J)IOX`zbq3EdTaPKrZl*PO1}suKae1D%Lcc)Uq`13okvEbq?D@@p
z^|I{dUyd@}p$FI3{u9y3WBQSI>gww0Gw06`kC=7n(Y9r&&gXysj4NmGnZp>eXsThi
zO|sZ)R&(aH{~XRM<cdh>l)O}b!!G|WORi&sr^|<j2eV>2cJ#3&+)<N=y>9VxTln0l
z^&!=zh8CN)o0*HBPTiWDsA(XTc*64Znk2UCR(&-yS1nnv@b25F)A5m?UOwFZbm}A%
zCsCc~e<k;ePJEgu`Db70_auSa<{$6L{fcvVT5zLwp>xQr-+mYQPp|l5bAkJEivFGZ
zJ1e-Sq($Fp(s=jpL)IMixien|@@s9EntJPM`l7u*8Bh4X&SS_*Q#Aix!d4N*5<WMS
zEq_lr@22#eYmv%HDoVGatAzU>U$nWGnkCG({&q|pTk}rQ*s#V}r&m@<z2@H*ZWp;_
z7ho%~rmpt4;o6D(*WCBZf46aLv;2LL|84Hn6l=M#)uwMv{a4SMI!AEs&x`9eZ51**
zecjpn{De~mvAd5vtcp%FC@i#+zx42eZ%O2xQj48B9$ZfhW0Lkye3t!q#gT$j+}fpw
z*=p|HUSgzo_*cj7_h(P2rRMBaEh+2kV*2*R!#L{k)P$s^Z&-|e%ru^p<zvuO@cNp5
z{Pe8>J|#yBc7;p*+;{bJ=EpM8^}DkV+`sxc#fiu4*0qe7^+GwaD_?7`l03I4tkgo}
zh2XTg5t$i}lU~ea-a651A9JW|W^L2X6qi%A&7T_2dcCof+~>A#y$;J(Sq9T(KR2FS
z!Mr^3W{I-X%54{4%{(oUadp9-+{c$#gMZ139+>K;a^COEb@9@3+jygNH)tmAZRw3(
z<j1q#rbzfi#+2O#Cl5CVl}$03uj8@)K*7o5=_czgKG;;U=&(?+lFK%UiTf25^vw)k
z`Fs+5S23e7`l(T_kNMS^D_?T)axw9LS-f!C^n{r2T5lZ}8_oEm|A>t@&EPjTYAqfY
zW3}oU2Ll76Gy{V?o?1L3CCyZ?pz^Kc?Y!F--|ogcn($9D+qUfG0)A<Q-PQ$@)G}^~
z7|+ZVU#Dmwlv?N%C^gaRmF}na#eABtl1|P`cwYK9;iSs>zkc!)<L&0wN8b4`!}F-v
zb<WANmd^=Y{$%;2W0KK(IOEUvo!F$YUG#p+tUZ;rpB^*q`{(!0$j#0m)ML^HceO4f
z_Jl=}XVV!9rx&^g=}B~Quhg90mBHXKBW>d|29++}e$S{7mFHS%P5~#oq6EMBZuSad
zboW+kTsXs6^xUOYCp<-#Ze6D>=GyW+H89g@sg8+jOO{#owM$XQc4@Q}al8HwGwfcm
z#7g+jy~Lj^_UUEnJjGL1Zm*11U6XWD-{<_veAelLYt2?!*7%DSKR+kC|8{r2q4vb(
zmH8i;FGo(aa0u`^Wqx8QbNsBS))6lgW*rX8e5Y{ZX=C1u!y$G#I-9~~wD%sp`fz4>
z_jREwvoGxkbm3UPYsEIc9X}<X@@_x7>E5)MJdV&Od{^d7+Wq03{d~PePp=;R^!MxW
z^5w=%^F3Q+h2PIe5pCUj@8N`#?s1}*cK9(DUex{S|8CY(<{j$Ob7qP@*t7Yjj#!9h
zQEA=JGAG7=N1_U>jDN)Mttxd*WtvwNFUs%Z#a6My<XzVbj*N<nD<ov2S{V`@g{L+7
z7o98>`PtQ3;-_-<re@%-S(E4GEI;zP^Xb`>hlQ&yYHEC%bG$0`-2GPjlW(j16okx7
zBP7c6d*uTg)vrD2snJp4KJiHY+0j+9_IxaUTh<Fi#=Y6<ejw|u*byGDAF|(`7p&0v
z$hdHYw$|R~e7bd7rw$%hpL5%PuXOu|-Ohh~6y6B#UFB^e?0rJ``pm$T7p$AbOy6ui
z#eXQQcEygyb8{wHwX)PE@(2c0o(P>Hw$-QXM%o086!-TXE0oIB)M78Fw0=?OJ+f<=
zQ%>gtFX_|Ew+g8F3dGJ}JsH7tsX(&Zs_{i}hiY|`>6WX!2du2uUVF>vQ>ehMb?1Y$
zcqM0E%B2$%(kF0<IWNszD!S_Icd_en1~w^EmPhir*tD+H|0Zx@!M6RJ!U=}{sUnxA
znKQK=wo|i_&sckJ&N}8#&5jZa)P(umB!%Cw@Md<-OR!Kr{^G^u6IRi^Eo#Tpc{iQ2
zX*%70qV)))Yu7$Cb02rz2YR;;NxVPvq)h%`)4{UG{CjVloAf0&;@FY&hiWSO?_CeN
z?)X@~_iC?lgN9|wqPL5}9`J{on|V5<t;%3snq{Zt%yN02l8L8)ojdb^V(zJYPwrUq
zw(sbzV2r%I@kT)g2czTU)&rpuCs#78eR9Cv``J9loP%OJa!)NyoN(%`@ZER2W(7{@
zlyfjo{o=#(^?rNq=d&}<%3s!FmN;-tTmO{Hl@!U(GLKV|#8-Q}*Z19=%kt)M{M+9%
z;`r}HFMc$Ag+{hZfQ{$^gR4jW<jB;Q&ia%u(WuDQcvVGhL%`IgZ24)=pQuF4mALX?
zo#8i5SFWWo9TWOKEKE<Y&=dZB#8>rMnez&k)6P5pH2$dO+#kmrEqQGDLz5XUTvG0P
z+G7sX-qI+3*k9Ox;Go3UiC-_PW?inzJX*Kj@`+N>epS{Tbyr(_lJiWR43*6L;?EQ&
z*L`Q;D-NvYFnx88UG_+b{xg5wZ&e-VMJF8z=|6fRMY!m^>JH(|L)X77iT(WHgcj?>
zzAG0ei)m@kd*k{3|J|eUZ}i+Wv($SJ?D*W_6|dL+HE_q*hnqIas5$FbOG~fZv|V*i
zNoDGs{l_9Vs{VR<T5i>DY35zWkM|kukzHgn*HZTDX<McEcj|MkCSG26Vz=Oq`!nu^
zesmF<Hz7ArSmQR!B!=JV_mkY8Y<|0OfmzX-Bn4Jw|A4%OBD?Z7-sf`JDa+7se4FG8
zU3UvJ7c+sH-!B3um$4?i<^H1nbX)uWoAH%yymH6d=4w>`x#z?Xz9*Y&!~T^I*sq@T
z691ycoyR4!aDk5VeTJDE?$0z@dseRDEBhk%42>7I*Q(k}vl}+X@N^vdaml&elDEkF
zhThia=YG9#OgnKhB>4KA(5$P$52~KdS!KL)-8ScL@l(D9tFIi^=-Ib;zO8ic*2A0L
zb4Vy}%;(viQ@^~#XMxl8nteO}{rLCjxiiPwJ-<KfOSv%Nw>s~Og&V}ByXG1cI((Tf
zBir$9`Y|bv*;B#|w%&N4nR8%4^^DuBljX$?^AhfSy~CE?EA=$oHs^t7g`3olMc1qs
zta!z@?(+t<8Mhp^oRhZ=3N)@y&6a*PfmKDI;z1$*t;LtW3LO6E9dN?w;oY<IR;DMK
ze-AK}Vs+Ekl$kf{LY&c*nK#)jJ<opMDbBLwV8hGuz*lRMOlH1_abG+kJ6P@3Y|mZh
zZHo-<&u105=bU_ny_e(5*23_sIX-uLOAjt&`&hs9TJcVc<@`MfiAP`Mv46SSF{7)6
z`6%1&)9PF&vh=p_GJ3aqOZa6rt+iNNnmFn69gDvc>TdhYkn;&VA@gUyPFB>mWs=oL
zvV&gC@j1?NzRzA~h3J<jJz<5<!taHDH9vfLzwRH+kNee*$2)%)tze5>ZY2HmiQydw
z<H%p?2hO~Sw+=7<_x<ACq#rN;?tc3A`03Z>!s7i4?{>b+%g>+JEXmbon{{QuS4G9%
zUnk-$8}=UTooy~J`6J=>&4Rmq-<AJebL&03&b%=9#oDz^)ps+3_bA5xm>2zRja0IM
zR{N`CR+BD!yzQ~hp7XZB&(PLFv+CV%?Fz-I6By3u8eS`!b2Ro~n8n{GTXy<w>5K}O
z;d^&aYn#UHO8ZU4|03VBNeL-Ro!yfBAx48umdR&>qr8;9t=sjzio5Kl8ag}k>sYIE
zz3`|_oAl^GAMXU-=DaHm5waqSBr9ey1TJa0bn%bErgQHX{$!AS@Rf_}>XZis!smGJ
zJW{C<{>QQVq06-u9&r!$N*4(ywe~MK@K!pkG1J0!hm$dvwZZLoFRYh%K4R{hTa&Zt
zbjYrmm)OlR_g_8htF+2?Vd$lp+Ywu>F6)bFTx9Yt^V%uVe@OMrl4hr?nv2hW^;>`6
zYX9jIZ|jvRsuvtg|6^<Zv{)tK*5c0J*B>~{`Eu!W%91@(majD2U0D9!|3}uPH1|xi
z;`(VOh0Pc5ov+$#k2W{5ebo*VEpY~hbvgK(M7f#8$)F~Y?cd_t+a~RQz24#NY~`z7
zJ#$TJdw<W_8B!P&|HvYF_w{{+e<V6uRE~+9RMyaz>i_@!_EC1uI<LOBclPYbx)r6=
zc(g8gW5j~nPrm#;ZQq{H-0wPvm%mml^`J_^OS#I40r|(;`sdEQXC`^{q!#b8%{?~v
zZq^#L{I^j~H+Jij=vRKUSzGMbNg1ojJr^tatLB_#@>6p>(IM_G$*bgN^y0zhp2|pu
zxrZvGDpG`&r^prbw<`8V?0L{qdoDuiqQERQ9j2B&4Ta0iJs(>Z-aV-lz2r=(r-A<?
z6J?XGM?Fdo_g=3|pX~Z1wNR$$uR`jt=xtt28D1Ld>9(Ag3Qbm6UJ_z^e5?3Ch^=(+
zxi62WOYOaSFuh;3<IsVMiX)pM-+XTC+ppJTz`bbE%Z54YDvmunDtz_y?8~S3+<w7P
zH)F0Ae_Wt~)!E(0E~?B>694q?(Md_0mA%TXi=><G=)atjc|~0)Z*Gq1gN7Ai@AkM9
z6<JR8crow2{&J!ATR;4CZX7Q?o&51LZ*-%F`ja!3zmNZBF8^}-;ES^lcVDlzWs<)-
z(KXyr%H8R6$n)k$6EAL>+I3wgNwc+lZ`}L+T2pRZH?6dKe}9jh?EdP~AG;iHoO|)&
z=<Md%b?4KCg*Kk~tiFyZlX+S75u*v4*_ig8Vt;dRZu3J{!RBXCs&kcpW|(vz44PdX
zr<ZB<wEDoh>5bFpe%6sa@Ll}kt3?}kDhb}+&s$Lzr~GV@f7|)5(W@I1ueFM>O1vv!
z<Z}Kd%6D!`>b9lw(X|)3SZ12Dod2N5##FqAM_^j|)mzP-lNFTA_DDN4s~ogHuu^B~
z#H;!TmY6UYXB+rbC+)p@V4dj==_AaJpIw{04%Teq*(6zceAC6#;d~Et8LCY_G0#t1
z^B~mNoZ;u^?s;zeoQo%jo&6_MKKb6?zfF7gPWo_Q#RT`D?QOe!@3pkfDJ|Jh^>cTV
zR=Zlq%DL6P>I*Z)E?menxWULIBM|VcQRth3dv$#M%kS1Z6nvIUWS+esq_}C?lxbTv
z{WP0@DjOYp^>xdB>+3O2p3~Nf*EEX<ojcjBGmky)Z1e4{>R#Fx1$X2Lu+DsaYfkHA
z#?BWqKG8Flf8cEMmMD?fxbWG6^*URB`|(LQPLsHxf9ueUb1i{}*`E|XT{xDLef{U`
z&CEWxnZ(aB&tJ;&tm?hcbGJDY?SmYbTXVj=^3}=ha{nc>hTKQqdrq7<?kVt7uVVR>
zruxk(;;a7`uD)-)H7enOqw)3b=bS7oD~%W55#8i^c}rIE!qR-^RSyrPKY4HSIh8y8
zTTIu^`hCTL*NP0?7#tq6D(vt-cZqfNi8WS7Z(U`t_w=brGl=Rwk=Ao)$F@`t7T2XM
zL23#-i@e1-v)Qh9bR?bldDP*sg!7(br(T&bKjdC?>hK*W`M9?4S^J+_{$2g@aNp<4
zkNsLdC@Q62tkV5(Sbsw#=boGubrv5N>6>1f{?JzHg}M49-kzYs|8+b<0zbTtRq*gw
zR_%{_b^A$&8cTYPP;;Hynda10>SA>U%bWK%A2=U(jw!z_P<EY(VwYcXk?UdB*OPVB
zro?QV;#}>{@MnJW<jaR2moIO)P};ZdYsK@A@7}Fr)%tR!GUv$6A4%@}Z|Ls7@i%h+
zjg@<TXx1D0+zf4Kc8*tZThsS&zS0+&^(P)?xRlMeobPQg&r8DI%3u4y{5OAm_pRvL
zr5$gx^3l%EpU(yVTy!b<`O2D)JFM6){BhZ*@%2XSw>Qu4%GPY0y?@8ct&+<(y6o;v
zee`H?>BI{g&t+^$<$jwtFG4kE*P^4F-b$SM-R0D=_gE-XRNjNzwSvdpOSrbhb3WeQ
zXtH#{0mFzJKMy&2Buh;As1$sk(_`Zjb-%k?rbH#r=r@YbuinbW^?6ct#AAIGXV)DE
zbDLNG6)KU;z26pl(qzR)t=UUICUMCbD`&irto;8=fcNQfMyaY(PpsbE@0kB{b8gWo
zqZFp&uAe4-kf>jy^MG^jB1ezoio$ao+ATT{8^k?IS>itRvhewXsV`R@ES-JDV#eI&
zsW)>qUR-y4b|!+~-{dXRsUu4BMOF&^nY8|o;nna+p=7)BjHmk>M7J&d;-uMff?Z^d
zv~j;)f+ueubIs(lzh=BSm9azrj>GnxtTQ1jotA3?*)Iqz`E_e+Pw!K?{q_~*U*gWb
zUsP`AIRCN#kJs!n7t3tV+<CV+FG=LuDb2&;>z__Pf2_OoPLr$ctC`D=zuMloQ}?-6
znr7XrpTF-UWcOY%&nca-tnilCg(Ff&yDx~hByg}C?D-~Awa4<T!FMy&>&HCIMIRm5
zJoU)#c#fR)YTlC<DhYf@xMFC)SL*A+<aEFBw7}U0n`QI9AAI!Wals>Y&9w9DCFGkp
z!sXdr+H6XU4zlD;+N9EJd(3jipBZOggbFP0+j_2j&!NnI2LsQf#De7XFqe5sdrAx?
zo++JZRWmwu=C;&_i&qnZLs&OIkDD5K_uv|yy{D`4-m$$Y*RGlSIQy<y-7(F@(`8p~
zaoew`_=rVWqPbdfgTf4}u%p2ek!qsd3DZ_e{e71B@g~oNkM9!=OY9eh|9-SW%4e&)
zpX$8)$@g9Q`WG9mdBnQVAXRtAjoF$^wj2FUv1sqOC>j=iXxG<QnI<QERXH_R+{<`)
zIVq`K&}G{8WkuP~tY)5HYig)o^td)QKFYaq(>?EB*UtW#eMEpO=ycD_*Voo3@=X3G
z{_@&k%_*j05vJ}hM3)N5vDvJ7wMi{(z3Y5~hQ-?=e(a1nB|ckEoa4Z9%_E*=|NlEW
zo?H9S<>FSpEv7t6HT=Z_#m>wuy|{YU&9uGxPkC85jPnBw_8;6WRPaH5)x6EAQ;NJ6
z_GG0l`P^N1+Jy7}tw-LcYHnLuSX$cM+^oQ(eR%R`^RB&Cw;wLIdi=3sV%L=3)TxVq
zD>S{}km=}+Z#a98K`CX{r1$&V<-=1CT;H0wVe()9{<en_HMRHmbur6}nLe5SsrOIi
z+H!@mIz{vSTNZek2<(o}D{7W_?%z_Kld$JklD8H6j>YqW7MlGoo%(y>qR85ZZrQ?R
zk36pIxsm>4ckQO)=*r$Nvkv!1X5Q}gC>8(xZ{msbISNjS$Byj@GCZGU+!P)<efsZ1
z-{pL}jvp1<d3Q@RpOuz?Ky=U{CgB%$Q+D4u74vcKYS}42cP+mZVYTK?X<7N4<1N4J
zT55QjuM}-E=vbE_@nc0Bw~5fbEB`rPI7m#AY!R94DzQ#LW?|g61&Qb4Sj=Qr<uP&W
z=MlOd@szLKSWGP}o9+2K!J~JTI4@7ktek#z{iO7axs`>js!tzw9a+HZSMs8B=cQc-
z)}}7*->TPmi-U(Ju<6w7=)bpkmQ=>yW}mLq=j<aZeQI&*xq}r-t2fNy5#!Gm_v%nP
z<P^SUY2J74MDu;e=Vkqm7fZe%z?#)^?e>!pm3`BB+7gS;Y;fZVk^HxeJHqWylFGbg
zA$uA+k90F`iI95~F>661V_qk>!jf~xRoGfT<Q+R8yv*>qv!=KKZ}HWlAI~oyocDn7
zq4CD9X45M@Zgm_P46CRAc-{4IQeSP_JENl=#<^Ftj8zJbH1!vj@8NKYKh9ca8t}qA
zbAdqm!=>wPUH`dhZ;;IDQ}uIt8}B+46t8uEe*DHH#~nrP%QO=&=qt`LYS%wj#x={@
zEY+ptl%n_B)pg$T9}J$jPHNHd-&Fr!e${-#d@Z%ur|-(Qc>IvPv!4B~^_}%Uf9XFj
zlRtNM`USQnXD??S+{b&Y{)~FLfUZOQId$1Xy5>K;_wbvROA6K6dWCzInJ@ISZMmp>
zy=eA+m){o>J)^G#G%re5XIZkpn`d*_r0XY3&b?cp5d7x;LYWW$^tb-F9^8Fd@|o10
zcT+CgKA*Fz$T#NE<!L!uRY|Ek+Z!dd=D%t!yd$w)qW8$<o<l|3Z~57oUVD8aH{|o8
zp9dr!9lD}$Fz4sGHP#%=*RGvNOOswv6&LAZbj2k4ft7$Ej}qe&MbXq(J<q3pHfOq-
zb#9sA>Uf91r(3_O`q?GrevQiwO>5OKb(Gq7+gu{Ny?1`lwz{ObUJP9_MX@FS_4aCB
za&Pkf8FsiUqIZM${La$3>8gy^8qU1*VraSAA=CQkl*~=0TNl<}*7z>lH9<n<^z1vS
z%lYr#y7g<W@y`Eh3Ibb8rhMJ}Vb_PPMrOy{b{ZcIzpXOKf4-Idt5)@S4-W`SU9q-P
zRlak9Ln*58)~f5D)OmUDG}L|D@^8(;Naxi|>~pW}IlpWDq9@7gcO7D#6p+aK|Dav>
z)hV+t<Q%)2oh++WY0U3%ZMqJV=jX@?1)nkwUUq+=E_ZciSCr4fco(5NPZ`*xA2j(~
z({?f7nr5}oC3W32;mm^z4pb<$$@nd{Nd4(hwOLAGMzyK|SDxsrV2h%?Hhz!2V`9YH
zU3N@o^L!>@Ti^YhC#1O3O5qqs@`aQm4+H0<^ryWl&78k<OP|>5bjO^(8xJ34Q84pL
z-L`j=e^lzPol9Sue0uac`x}=d|0#v<-uw40yt(_0yP4*yEB~Co8SI^Z!FJZK6wmO!
z9QALjgQvAzY2G#?S20s2>DW?}*e|VjdTZPEoycsy_D?Za-ShG41L;As7mp@5b@w$J
zoCsr>|H<Ofu08DE*$TrAjxJW{{yAf5hQy^cEE^K$wea-D$+1Xx96Xx2Il+jLL-3JR
z+RaIZfr|{TTfZ~tU3WxqljysfS#Eds@86j^H`8$S^W!2HSiG__qC52?8I<Qgx0gF<
zf9}k#7yMeXTY`@X9XXVn&93^rVbRyW-gl*|?Qe-J;@q%t=EkM1ro}UUv82v8>b-Gp
z+fG-pO`5$%9}1G>RCg%y+%oLjEXn!ULQ`mo7K7B2cP0ks8$%AQ;a!zd>TyMatM%&&
zmgCc%#h(i9v8;%Uf3N-DMC5nahZ&~VoL`)GD-~RNY*{*2^z5({)+C{$rd5WDr(7Oo
zNW2VKYVb5ILzKDv$j#t63XKyTCG?&d*0*dGX;<)F#WW?&W5;impch){y2eK=({@z_
zOf~Y<vtIil;KD(P#g|PU?~o0b@I2hM>?h;e!s}s;k?-C1&z~bVXV<D5oZVhMZ{BTn
zdH-x@<eFIDw`R3k+Pk&ci_doE=9<3QQ#xUm^@7qZyNZ8l`k62K@%OY~&}+H9Ki)r{
z{CknO0LP-+N(DdO{S#PWATy1pOWpk3R;PEzR;}mxl0LhqAUj}1%D!@wM$O5e6J#E}
zG2}P8khJwq;B5IM^QEF`r~YjZ@|dfCcXtWHu2SyZn~q<-Yw^7In<Mil+fy3)fgu4c
zD-?Jbmbq%*Zn1ah*)=m>e^17*DXVw8J&M_Bv36cl1=qIcjqFzZt)dHqZSK#r^j*DM
zD}Gk<DYu-E&IMhkuWV`Fx+2m1An)9zkCNhlu9bG!DU@gY=Je_t&KzOu_f1R=v!0t?
z#kAzg-8V7)8QT5dUL?BOwyto|ywj8M?99CS4m+1hPp|ng^&Kr5pBUe+U3>6a*#GJL
zg4bFbrd#konKU7BCR;*<;^FKc=_UfFXQi-KG@g}N%2&y~;JWOuLpSH$?sz<X&PyS$
z556+5cQtdFWF62wU#8i*WB%q?q1N>!dtM7Dea=73Yg2n|C9|N<LdoBAav!iXsJ^ac
zFgf0~HqL=JJ^$~qLk4Q6EqMRl5w+P6$sBjTDb&8fB|rJf&X)Hl*9dmDZ_C>3dR?!z
zYJU2qm{-5`;(P8Y?M(4rpBdA?sK6{MhwaI&Ne|ZAHXiidpStp5(64M6qo;r39Wy^4
zV_h8cb6ts_sQt7(4$S?Dr&6+(hOBrnM{(JrlfKEPHpj*$pFHgTA>T7Kd*9-^eJ-V{
z=f9s6p4jv5PEt<%tcQ)WE??eWW%_2`ytz~S7i7y^y}$a8K~?6`G`UW#3BRjF%_r;j
zc1!Lxo4N7)_Tzu=zIWd*cSo|8*`Im#uFjC6Yo%{`<Na1`V$9dpcD&1G)9c}WD?%-I
z`xluBcjy0l^0WAp^3O(=+E4RSo_}5)UK@E!OYd{#ALVV56Xvt0ERR>qob6%1c5(R8
z35{0AW}M4x>o1>s{G4#tfdg-Xo63)rOmmLvds@?#D0Vbx+kpc|m%OQYf6`UH;9J^C
z+2#9k1G(#`&9d34;JhjN+p0}2jBJ4?!oC@A*`D*MWybO653Rx@K6BL0Oj$qmvG|hh
zJZh)1AL&cH=jICwHCg{u;7D$oRmv7&E#Kz$71_F*<6IebT5dm6$+oXIZb9a<*C`Hj
zqk;pM+>k!UzV71GYLWYHN-2q~*_{r|kGRjpl*VMo{(1cAYK=_$(LIa)JyM%KCw|Lu
zo8NDrJUDv#a?+_x8}5kW?zRs;TMj&lu3UX<O|Pd}pOe((m$!@T#q`(iSR`=0Ior!=
z*23t=5ubaW-)yb^%pCIRqtgBvJbUFg)i>CA%l-LsWN(w?!iSUA9qA10H{3tZi`^@=
z^wcejO|M_|tGS9cSl<Y=f2CU`B0cr^WB>L4ZfrQUP{XR@_<Xg~eO?<c{azm#t-^Ni
zg+%maS^r0Tf&pLjZ%i;tnzi}y^yAe}9ux~Tm+`b~CeJUd-n#dw3hTCmQlEm}Xo~;y
zmXVp%KC%1s+YicJPD%BO{<Y6vMn!IxYkI^sdFotyv4TBkSYID6-*#{Ib`_4iP~KA#
z5%*csdD~xQ_^aw<W@sP$_FBi%&F{3e_f<)*KKHaEv-|@%FPUhuwJdxzan?hDBU<0z
z8NTP%ver6X^qHwa#V~7y?c-{@rc%a_ZH`x+r{-OE)0{4N=dY2^$78nEc6GPE{Q4rl
zJe}SB)h3^r!T-&7=zP|`t2Q%!->XNWdtPmb3e-=S#w2n3SC#$0MJdlKT2*=i86(YZ
zRPXi+x_`MNT;=60ew~XG*{d%EOg52g=XvgBs@}vN{N-_sRr}F`IEGC@8=h>`Jizlt
z@=ZCXaonDkXA$w6j#xYA=9|W{J#v|5=XgX?fltIye2-I@V^Hj8Yu}6J)A>Zg&kL>Q
zdzSd<S+yZ|cIK29%VP4@%j-P3ed1%-nI#MFF$Y~OIW5)lD!f!I-FoYyq@`IWOYgKl
z)~ZyCJzMR4y@dUKN%ZrQ{(GJwjURR9U0+`*w$4GUs6Rw^#;?>y#e*`P+bw*K=DG;v
zKbaaH8Msj+Kk1mlwB!kDuNYDvsI3ck^#0G%EbLa<kj|RC#@PGdo{t7*XD;t_6{_V|
zoF_ab`*cpHA-luM$7k0`WaQ1+v}oVzHQV@Kb!<1C{waIwL}tfTS;tc4%+~uJd%;v;
zk(}nLVHWtb=*|P}3cuI@ty&wdj>f9QM4z~Hb;l2tJzoP}@uVH-J!G*bPwo3!CkrO&
z#h+E99Wy$XYpd_r+0nZ(*JkE|o+A^_F^Rsk?VU7p(T&)1PP@L{Tk+_O_eO8sF00>-
zfx-I4v&2=Wr-~V_U^}$XA%xBOa?hi`j}}~Az$78vxqyS|<&|^qCAaGaY~ftzmHNHT
zRN?5WU!QrGZ|U31aoPHb_|q9*{wI7|{rX)8yXy&ooBV23tWIs0!%thSe|_nBpJvMB
zmy65lo?QFvx~^10Wx8$E`8~!CcU`*Aererxs`t(H*zP?`wfFB0`?JbA-nHhk%jehc
z+w;%!-Phc%xB17q2+{ZE@liU`eNVq-u1x(~uXRB?)~Y2v@oLG;54;^hZ=*eTdEcr3
z@cib<?r?SeKE8hzc9oZ_y7wh{1uj~5BG=kz&8)}&4INb&zpb69vhWC-y@=0;!@Lm<
zGbfm_X`I~Z&M)q}C~HUM4#zKFR~KlzbOaYQ@qNr?4oc~_?%wRHw)Xfxt&ZpE)~ug?
zuIJ^@sIrp~oXZ~bx<%)?urF)P-5!=VpC|m-F0*r;LVx>j)>n_NHGb{r{>I-{cAHmc
zQ{~1NQ_R-BQ(G}>>!~|jtF$8T@Es~yum9nWs(9*;Ih%z}Oo|L&U$T0F!s((34VR8p
zu>V>$;dxzbNb$osX3O5Av7xgzs5wqxi8ov5amC<{v7@i3hwm4YkgXvnE?QT6O#HQv
zF>u%Q>5&)Gv?3NQS$gYWNSNtVvw!?8Pp-BtU!Jen5%%-u-{QYH`S~j5^##pt_J_7r
zWGsHAbk%O+r%6w9SLeB}tg4IF$xfOWw)~S=fqC&h#nh}TGCP}<)*aW$=l%MRA9dw{
zCfn!tf?Ny?J<1FWa(GrA<Q8P=6;$4p%Fe%S@o9HG>-xV6FOyb#M!kvSeNtd+p4;p@
z`@t*M-37dk(==v_M+$k|>I{6c|2~hW=as{Lm+mpPn_lR3Imh$-?}BfZKWqMed;MaP
ztBG()iQr|QO)Y_TYWZCTQ5P?+thcG~Q>)zgIA`aiCtrR%dCKwc^DLk6DK$%!&U^T5
zH#ysFsvzun_-n$14>i6`3O7&iE_ZaevFpT6mBeXJji%_FKa!AeZIZ9pNgIFHoeJfw
zr>Ciiq(tdGy{fjnZO8k|Ij1Y;tqeY!=cC%2A|N_jf%Ce~-KiV0pBSfh3w^NC&k*Y{
zSjd(n$Q6~hZ|MfkSsi81%LR2O++Dc!$HY^ia@~ogQTy~FynaroxyR{w-E_%9*{6|*
zrfDQs9&%ahlem<5P3N?Rgyz`=o~<{1oB~AePu=~@G$Ol?C!lci74@(~_jJBCUQ1-2
zHesdx-^agfX4F{B|5Nty<=+a22iL0udVkDIo6^1^o$-6*qdjq(6mOUP;IKPpWEJ`J
zL1Xj52lBcT@4T1Y`}_L-z4K#gtI9v_JFc<s9_O;~@aeU;=l}m<WBb42J#W%10fXp-
zbH$D=hJ`xo<}Q46`=6>M|Fv0(4Y?ccG1nGLe_AThJnjA_k8>?7>@$DmZ@RmOJ9~-i
z18=n_YYzXoqr7<k^xb~_mUDKR#Y?4~=B?ndH0Jr?trfdGrp$(w_1JobnF{lZCag$0
zrS#Cnk6lh_#)h7n_PvS>BCP)yuX@O(ovZbIX1S9|&ps}Gg2i&BVwIg|fAa23Rk*+w
ze6a6Hk!z)EWXOs+PPa~+$gvCX4xDjRhfj5_=#}+M4<rgix;i~0GF?}`J`kTE$z!)g
z*J{m=6(KE?re!>qd-kT8NsVcm=d44WPo-AbC2V}1S-UbfWLlMk>&jw#jee^aCpzM)
zJdV08TN6FovWe$y6|?u>c#VkyhZZC!vA-~Tq7$<uWWkrL@YMK826|5>=o~QHFe9>M
zl7a6@CL=)yt(MRek2U%;eKrXw?XtV_ZL;xGyT@(ondKSh^yi$HDd;_UWM(*n$=e0Z
z#kLL)USDq(@!D_W^Ykvu*(Uz={im15*Oxxqny_M#1829zPL1GsU3x0*)$=Z8{A>%;
z=AZRmQDrNyz?EAJice%j&%d;~-}Lob>z%K+H!S?sr*F2Djbp(>>3VVF(?6fvEx5Bu
z=Ujg4>t5@hp4PX|T-?{cjD6!J-cZHwMHlRzE#NoV`k<Y)YG0R^n5&w-?NL>}i`sH(
zH{L6<cPKSo<}i6tXEgPC$2o?jvI|@r+BKRg1SPDvxuRz#7(O+rD>?IJ^TmLx$yZV)
zE-V*1c}8UJV&yLtHM@2j`%6r1@A$qt=RBiV?5w;+i@E0;?9!2)_HU`t#G+NRqF6(w
zHwFoYzJ4LDI9<o*E}Q!d`6{Wk3tel<Y|NKBYz_!-+`LMrf_>ALcj{|ccuRHbie}ix
zZaS|pTX*7Sv9QS9l^$X%&PMK9&1LdSy`)$9t{LA{9-p$;+r0ki%A0>N=x1E{a9&We
z2xBU5J*($UUek$+3&cH=6BsVV9E?0S^UmArWmkW070nBOHSZ1krk7J{mPO5VZ=cut
zT;c1)%yv2H;@Fywjq2=S?Oj|e<;&;ID@=%x{S?7(6dO?cBO&0Nme!k4foNW{FW&;C
zxHjr*+}-CYtaN^!?e9Z@W`0id@(<iQRoV8$sWhbN#jS-liVt}vwDMcb3e5S!T)?5$
zd_dI1w{2CXr0~@V-?#kr&$^?{s`z87l;~lRz-Py<uh9^fo^asnpRU>NFK?HHl@yCG
zUiN6}%CPF%))_m~O_^gubb&07zwldUBcp{(H7Y;515a&|{u;sd@kw*g(o1@K!oCzp
z2R8aT9F&-|)35T#4S}OP@oN?5Jm%$WxS6gs<5dK6gT{u1Q_S+GitT$n?YV{l?}kep
z+iqFazC3qi?!(67IRR%5a@>8zHic1Mp*crM^60u{3qQ48Y6wtsoTfO7)zrq+ny<9=
zLizFw%0cryr{!i$W)OJSq-VjK&-Ob}Dv#;XUT(%G3$|<UL`N?5Yie04^l8=J=UJY6
z)ykGGHp|-ja2ebBzO#0(to%+Jgb2$Yn_|oIxLVh!t@>w==-aU8+=0(l3Ot*o6E)FB
z@$>|JgNLhDu5_w8{kf@UonPtSdqMjqYwu~Dv^ro~**T5YnaAJTP6^)VnQGhcD4$nb
zM`P)Xysjy)avuG*d&XYyi~GY5w~lOEyBLv4E3O!tNeA-DrfN9v*E(&yHT}EX=B`V7
z99KS@Br}&WR+Ra*&Ak-~y-CNm`mQPCopzb`41=UemF)dPIujF$0-CnFHy;rf>Y8+*
z><}yKp3t2NjSH+cS$ynJYI@YqwUa5nU-r}5*|iVZ8}gc082@6r5~8b6@5mINP*b|f
zY$30=<@ueDzw+4LS`r%gb{U_Dd#Tdaxz&+1e(RiN_!fjSPImNdtLnUUGvVOJ>cA+e
zd7u1(5<Hn#RDW_*w$)hNDZTf8?=`Ch|78~b5|&#lEW6}ZkotmS^9z=}KldW&=#lUx
z?mKIjmL1sh-(D^$+sWE}(JbAkg4{3OADdevzBDH=_QFq{u*UeilfIf-s#)#{;BE5~
z>)lXSSo!h%YxB$eeSRu-+ghsFv#v0O8EPE<Vs?kKN&88e>($sL2i6M<Djl`XI3H26
z;E0spoieY>&%CAGzD$@HXT5Fn9k~tvz4|tv&fBs`P(rht`OJ3#SEeYTWCIyFsf#u$
zU(cSGP<If%w`<wLz>Ti|Y?+029ZK{z+1?~q<+kUG?Pj|@J6<)P5S)4S?V^W=W>#<h
zm?=BwLgzyN35VA2bXa>ef1A7Ji)Bk!t$uOr)iedp_zM%<wWnL(f24f>PqE1EIO{9h
z?@AcyFt1#@zvbbQg8tj)ezk9-d#_1&d`!RN)oG~1INP_jGk21#-%}=b7m3I2x7}aW
z{1%Q13qLCH)MD}>$$c6@YO&9w*}9_J%U^wcb7Z#c`P^fR0|Jcy+FyQLZ(A@$Y40ch
zzn87T<+lZ%bzj_m>)Wx+l^1UL{Em#4x_5=+$-mRVtz4g2_<#1zk()p7hq}Ie%BT91
z3wDLA*83ox6Bm{<Z;#r3af>;VuXBA7O6%Ue|K0Q3f5qzSOW#lR`0(oQ0-ny#dqo}}
z+5LU>^x*gRRxZtYw8CLU9_K9an7rSowL)%u%5tb}OA|crI?v<Ef%ygB>eq=n746x|
z9QEUEh{k3A6Vlpi-~RUt|MoBH{C9f`oozoGS(ZdNy*K(kYeI=w^t61JU9b1<%DB^8
z);5LtzT&OVtLFI{Fq-Z^X3@3v!K2GZW_`POcx`^;)&KGj<RljU3DsL8#qe<b`RsVb
ztXl!C@Be-CULCoz;8$gf-qWX<ul*J^ICm;u+oQGRJZD|y*C&e^QqKo&xcsMWdFD+0
z!#8*(Q_J^>+Mldu`)wd~Hv73+V%u2}k+m}Kjh~+SUw+Ogd~-x>P4#EBy4P~aZIjI=
zTu4etF1xre;@!e9og)7kCuh$IkI$BSVz*GxB)$1R+M129XbW#Y83u;<T>P6+3bNCa
z^YhX&(?Mrs+SY>>Zv6ipyx`;6fL&fCZ@%39`o(YVva(54ua3;SQM<SA@#6p$m5(!(
zLYp=%dj7e5|6NuGCKZj-g}1AhX9{<+h;<+RcTaWmc|Co<f7un&Tx^7EDx^NI@ma>H
z@Al@aQO~oQiYNQ;+)h9KvnW_)bLGjtIJtdNa(iv8Qo@VR-7B7$uJf$i=InIt8E3rY
z^uB#t=DIJz(I9r}>LzwZZ?V&RG$LoDR!UCuoX2UJCOPf1$;=mw;va(VepFxh;McF&
z=T-GL8Q4Dbp2s-pV%mXM@AK{4YdQnieGa@}U{H!l?Av)u=VyDtLD7Qx#u?Ju-|wZA
zdrnN>(Ye3XRmd-hkKtVR3~`%%Po6f!et2YiLFJ@H&3VQGg+nX9+IoDx*>jwE*)iGk
z#S7jf^q1EBo2MQrAZ8rVp%Iz8Wc|f6FPC44n0NX7{2y-j<Hdfi;Sj&tkU8lnWB3)W
zD|a1T_j6Y|p1-zPtYQ0an+HE$_`G;lGSxM8-twzinH#y3QYPD$E?lwisZ+i1=PC8q
z>`$FFI+>;;@+K=^f959b|F5ohn;-nxpWjz+_4h-b%aTP$pLpEzR`ZdXqq<?b!CLoU
zbqfxx5?tPWbkz}N8*dlRXuZ!G{@>4V?y-B*b@Y|@vlF2+mmKQ<)MU;!Ph8zIh1b`}
zAt$on$7S}G3Wk=>Jl;KedFjV1&3x0;WzKafd%t_@nyKMZ`&y*Y=WvI2P{q9O%%>V<
zw(1>Px<o$u-nllxvkosb-S>EIN@%;I<;(fu*@=X^ueJX_=V^=8Hj3NN8+<UItw3nf
z&Idu#GiT41HZxoBCF5Gd#rWFfof^LLwm<oJ^Ce&R!FSD^C(cb0Kj_q#wI;$bZ$q8%
zw|1GMlK<a$Z>rUw(08$E`e&PE+J^Iu4tneQI@TTUR_d(uPc+Qxy58Vh%&hM%`Q_#Z
z>!`etOjdzrv!j21{aDAFVXo{wQzTKT!nyp*vU{NuKg^hFd3nXGH%u31G#z`#dx1Y^
z6H}(fO{pcuKHPH0q^G5L&TPs2#4q=IzR~*N$)WP+BQiG%sm?CwWqpzO!&Eg;%f7N{
zEsMj~U!no*qB88c6Pfvfd2g0gd9qF4-0|Jvo%^yS`PP~SYMxxlZaGX={pWIb_gryj
zHu^EK`Q_<toLUX%(=_#$o_MvA&2EGFXYmc33*M_Mq`2~}F^p8ryz|<4o)Y(r8Nco4
z#m8NJ!@64O{QEOWYRQ+LxOm*$T)Cc8Tt)n4_Qa6O1s_z?Z*QMI+o(V;BeZ_jdZQb^
zRvhi)QlGMZ-N^?nN4_}E&Esa1a+d%1zB0d1@-c(^J%@X&{R^JgT73Uy*0p=GM8T2l
zt8bi&xMOc0I=&)q{=vf=R$W;byQk;W^`l2scT^SRi^r`?+rN{!F#h~U{=P|kCFdFa
zF3#}`6W-u)aOvef?#Xe-m~78+Enx7Tv#DosTJVn>3u=Tv+ea*Ld&B)!<953Jr;?Ks
zdRF|uk+k{F8->-&xQe?X_N#82bx}Cb_t<M@@08!STX&s2d28Qp(YBqtqBD0~`_U}g
z?)0kgY2t%xK?*-Ar2?&7{+#M}3jDT5?<2El^W|R$)WcbCooBt!RFTphH>0tfNu*{`
zRz&I%@yt`n?R5o5olVasoX#`5sC6o8*Zn0-JfE0*w>G-V`*S5u=GhhS!uHv+wbN#a
zSd^#ie$D(%MaVKDMSao9qjm9FTeqdjF7UN5O<Hdz!)R6HctO}^u3aw&U%O~y0tah#
zll|M%b6;(9bK_FzQ@i2eGW{asZO3niOstwZuL>n=%FVWl+jUU>)29$=7P<YJU3*rD
zvx<u>_Hb>`i8)~B8foII7*iB=z*TO2(7J^N1q&ytM6JKjH?JeW#P{&bj7P={=dI6P
zZ@kelNk4}#dt<UsVoJgCl;kH|22+g|*IGS(bbOo6N0aIQ?zw#|S#^QAEVf~Fe@5$S
z5g8pR1~xmdaEYb_uVa~u$`^#q@{!px$!dY)(z}{JmS5mE+`eM@M7CXxZR$0yaltD+
z-W{5>Ote9~p6{u)gu<*u!L#$rS!VgXO}<dx^eZa5_?^?6<z9=MQoE8%c}rNkmc@Kq
zd1&S#Ms|lcQQo$1-y~{rzdxj+8ggdB3<GiNMVC+TE?j)YOzE#yaLSs?-}+YXxnTUZ
zQ8vhePin)0B`2oI^k|0gUf#sCeBJf$+AO<!m1oXYc&6Ha%0che<od{U2E3E6Z*Qx!
zZmHee^m)zmzrUVcdcE3vvW!#P%Imw$r+vJ*(J}D#SNUIGPn4*-y7zKT(S7;7d`r(M
z$phVLGH>}qciy<C^hak>{fCV{S)q@9tFlcn=>M5w+Uz?oA+4D4`J}T9i~QDXu5S4n
z`tiUuPfPR4x%JN`PLaIkC^zG2<h^qai!Bov4LWTeaV+ta|FG3urio`|;JiC0d`~A|
zDw8@Vziz|F8GEP96SVwxTj@>PtVM5X-gEBazUtiE(ZaZU+b1pG4l(VdwmeBS0j>1g
z>{>7Cb{x6<f-(2WhlO%>-)>w#BVBD5CRN3;`Tio&KU<Z#|4!beb4hrsli7j|ty5at
zWae|nvVK@xv-9QG*~#nncF(`Zdi=Tky?Oh%<L1wu`(G&LUsdJTXSD@?zP<Un+nfLD
zjPeNWqLir<PcnU5`8fC6*BzIl`#(qSHx<7bKd&jRHoEGQXq$!W!zr?n8BKG0AJ%)j
zE4A0L8a?vTvp$uxfV=N=s8;FAp7cEq{jQH(&v<J+O#Gs`n>|L(E;X+ErAk@S%%(}p
z*D^obowez|`MwA9&&^0*ZvSUxPUo}GNp}wks!LjV@_oE>r>Fhr`QxWMuFgMj^8a(a
zuk)8|(kV{KeS6yPU%AbPO??t_mhZFfNC<vuj5>Kq;9TwHubstuM*NHT7ijPBUhQ(`
zX3O;K5Au@nI;VS!T#f%px+RE4Ig7J7oSBupYIl_6VIiH@fr&Fetj*JOn7A~npgZsU
z!ezzV=d&)%2n$PBzjbcfMz4dllF8q?R(`+#{hFlxpYG+?ngZX~+wHcpwf_6z*u;iV
zp;S$u)6BK(+L9sb%<f0@_rB8R&+WXrz0Ax!UWnW7+=-yyokbki_smY;R1&h$<YNby
z@%EQ%UmsCldiAq}%=yIszn=0IhBU>g8(Q4+b=={)zJBx7bh9b(TRP5eIP{P=y2y!>
zGeXQ)>9?h~U2^ObzS$E#@qD$uHsL_;f7O$ZYIOgd%21uc$t?3=SIkre9f|1yn>$@(
zU%37}TqKv~v;FrE({;M8asEehB@!c*PfR)WD>89i$iGaX=8Z3Pi?1+vuCQEu)&Btp
z+sDOCa};K>{mea^v_e{7l1d?Wm3NJ<LGD76$IlJ3oo<`OxbHAH8@1T`ouTx#kf4gW
zcedIF+w~OeTej#<toK>QmMT5huwGq-{nodaRau?4%~-mP{f+C{qxui7w|+bwXnN!6
z;_%O*V(aak-yVA<-N7+c=lG^i23fM1;@PEIvDT}DWXomsPJb$H-k#%GP?)>?`NB7C
zUYr)$MWJqKujZ-*?R;oC^H=gF#o0&RiONjv`tVE7ZqpmDDf(gu>>V|jwmey2bs#&<
zDqx+kXjaVmj@hS^l9jEVzud&~?x2+aRqhuoOz-$t)y`qi`u}S~sMXgEkMk-Hc3*Mc
zcV)u%5>21zpIT-2Z^<l64=MLox{(^$@|shkjknC{q*I|~Jg1rFr|5Y<-;_*yYH{}a
zUpCF%Cpzb=O75B4xuDp>p?&(|#bT<{_Qj~5N`7b1Cdzv)u~BlR`sG9^HO>Cib|=9!
z>vxkUpH0nAeAm8biKu4y>j!tFHpXA*Jsp0-Zuc{zliQ_dNk+Kd)M`D`f34^D8}}VE
zj(-fdHrRRS8`I@7rp~vALKR-ycUBb&rO!XGdv1IA99``POtF`fSh==-+54<8=vHX9
z#ZuQ+e_in#jT@(l-3y)O&Z5}&!7g?Frq4ZlSU$|o+qtUfz^dX0nLqUBH*HD|^vD%m
zAnC#)SJnCbu+SkvKZ`4#C)xV0%{(}(KR7(rxVbSZ^wpznArsGQZauxm!Cg0of7erK
ziIA=A-#3T}oM>JWqrGf{>c!)}(P7LJ&+cDzWgm;2XxY9dP0o$NkyAc2r%3Xg=~^uN
z>fj-_GwLk*Yubc)iyZ1Q??3Rl;MfwW{qIWfI`^<+S5y|3np}CEyQqglD4De|=u6bU
zKAH8WoVP_Uv;X}p>p<X(mSxg8sVeslsqifpbr9i_tm53ydbB}MLuTXjUG5w_Gu-W7
zUXXbDwRXbRRJ}>(_inS=l&PQ?6zrWAc==_m1oMW;9DFOk7hPbwZeGdv$g+dC$LI3V
z*Q@3CHgcX?aWuze;&ZXb4Z^Ie7W(YikymtwS61*0XF<^UbLyTRYmY>5&pjQlZ$EE-
zJgfS0dB)Y*rsq2r^Kdd8m*?a9yX)!XfSkq+g{A91SiDMKZtt<?F2goC=674Gat^Fv
zHr+F|%$FtFv}eZJEcMLk45jPOl&vj&`gle5)SBEUwu;BZLOmX3eaT#5ZhF+*YUY_M
zr%q;VT(T(3m*eh}O$F)x7cR5kZJB8j5UQeb<8?dR;>?r>Dv2sDK5Won72Bw?*LJ$D
z(PqIJU3=SS@|#b|Z%CCn$u|2{+8_Ow_f8#Hx!B;a*XNKm3qGCNAEg^yH#gzrwL*d1
z+8hI)*DD2%&rC?&d(Peb-Rd*TZ%z+sZs3UGfBAuNtwc?xs&|zCl>~=(9^bX3X0Lm6
zV9Rlq^=9YJR#naQdbw5Jpy~4Z^Jn#@OIJoUb4rVTxxLlyR+P`WKi6+QJ0_^GEYU2w
z)z~hJ&BuSml<o6NmGm86iR(CjHmhpRdb;u7C5;Wi6{gE{Z<`;;WS$!;6?O2+o>T32
z?w#7DyKk9x-?=bRlU1koT%Nr5Ma8v+J5M;@-TicP`AJ!}#?`5}OP5x%{?DB%;(Nb&
z#s*{E>z|Z(zg~Qpxb4x0t_fGaTg?u99{%RyzI9(8uZ+C1`qiUD4}Y3WR%O{T^>Aik
zV^8`qquR@|D(^RM-_!H#fp20WgA(go-?h&RPHEM;udBHmoxr%_im!u$l-wk?{-2+A
zz2{Vp{+YeFsP~3FU$;{774Nb&&aG~j)0bwPD!lZ=M!LME;Z%^sO~nw84JKQ?DmLAC
z(D?NMzkXERE4`fb-BRcBvYD8x%4e>a)EoO~W7|^Cvfno(9v{hFx!q0FM&yWT+Aj@_
zADaTArkF@&SU4|CWP4`+KHhG_@5Ag1P72mke*G}_qQ=rsTQm-LZ<z8*nInb2jN$%-
zIgSP^M6Vxk+i7i_zR4=#=WGLKOD|9H)C~+}k>2O88{ND6wBeo3j++eMocYdt`1dLQ
z_$CdJX`C%r#b+1In|(5$$2lPWY@)!4)4x@!zn`AaegD8t%MQL}m3gg&O`UTzj|8fT
zX%rq;mU+H8eg|8a1IMI8S)Wewm<s+?xRJ%$KjUjd;F(&3^WriK75+>~W@=c_o;2ga
zERmeW0!=yM5%JE7Yg{>Y{&#S_`O4B?V)c#977lDrT7NtC>H8^Z>|401WbvYP8b^|6
zKMb@!Q1C_SWyf2S>Dyjk`mS{N-EX^DuY}fb5xG1w$iYoGE%+MalBe~2=lNpZJr6p$
ztWHO~d*OBW#k2SAKeBV}$E7v17!TaF@8NqVzo%_q!P=T%zt`2gijti2m1|BVS7M|7
z);6|PzcWuPJHXYiyvul2|H2*GnIA$Fel_V<{<V8_i}`trSi=2{%9CPMPCew^HoH<;
zyy~|O)69ia1k2Kcew^InKYvEM7|Rj{A2H6>hV@e)%s!u|rkVeqC9>4#MN^aS!K1GP
z&oHWOiB4mksAi;itNoJGEANIH`Hl8Di}kK+JY_anQumc7;@N^MgTvk@#J+8sI^*R!
zfhAGF>%*JhXoN=oK9zQ(uKT9X<xL*9I<l@$<73;PZ+QRq7r(SuZlSx~Lk>6nFg~9j
zD83@K<l?4;<??;!>+C9(`%^D4aGWwY$0-nM-W$v^;fDmXM*P9H<!j!}HWJ^kz;s(?
z=&6wVp{F@bc72^<XtL1c&Y!mC1zw$eht(H;TWjpJRZJo_@`vexu7K^SG7bMX@s&wr
z9Nif<Bj?WxgEjZVKWsPk>E%DWd7`YRDF^r2Z#%LSZd@^lZI@Qu$?7kxD_z9aQO(%0
zllkGX3+?TOr<b2P?P@$DJ<K&)+BrpdRry2Zn;A{*nzv#Zdfa5<FI_k+6QbwR)NB60
zKls&dwWErWze;CJJ#}|k9A}E%yiY4a)<$y#oN@kOxVqEbWMkE(qNtZy4!ggtH^0&;
zwCtkR(P=CDXUI>vIc-+W`kI32?H{u`gR{5G#ISzg7rwE$&S8od=R=k~6GK<Zi>_QS
zCscTKh~0~GyH%!D*12##zK|iO_9dh5+*fb=(x7(1kY}MczW;Ivy&-W))y-qlv2=&D
ztbL++`b*57pNgIp{G8R{U<vCam1Vrwg?m=!GwPUKS2y0^pTc@=hoZF;qd-BAowfd?
z$VGBJtXyj=6U%ImREp|1zI5OYpX)bIpM8_x=1Cl?mo<IbI;15h9DDL3N|;&7r*-b>
z!>gsH^5pTSW^&XE8ci|}IJi>T@b)yP1Oo?-nM^xsUvBo!D|l)*d-~I$9zMP_hYwd-
zLeDcUJ#?~vay-9~BE!_?@c$pDAJ(7!^X%!x;pdEZtSOj$Ys$8;51F54uAF}Cf#^I=
z8>L%wD#a^L-&rM6xsu6n%@O8xlJ4i$+;cZJic?>_+4`&K>ghdKI3onKcAiL{Hp_!O
zW2e=LllKFs1Tww;yv055^0T(G)#2uQ;<<ygvu}Ni+FSRvr}c2P)Uqe`b01nP|LkTe
z^fYo?p7wuxaXUVidig7?SEpOaJ-wSQA6nAfqV(WLQg_sTt;iKzmJTOmmK5|dy=_?`
za7ALm>C2&|QU<#hT{<Xa_hQ~W+f6GIx0nU*ndaTL@J5U7f!QsOS$KJ?>K;G&e)-lD
z5u3Xj&B-Uq;xaC}b%u3`UTyrMT_DRmC*qUF%t<#HY&;}I=Ik@S5|R4FVZkB}w+Z{4
zY7<|{&RUUh%GXrO@BBr%`!aujFPyCQJmPHj9F~ibxvT~UqjsCE-1KQ(sO`L?M?#nq
zs&6QrG4on{Mc|~}qZ;3tR)5=mNLC%vyJn`nXtzjmb$r<GqtDNLjCEC>mT;bZKi|Q*
zGXnd5EaTq0R%)r?w);!DbFZfF-L|^@>ixLnn)(Yai}R<-`yP6~CjH{(${5eQ;0dBF
z$EQ5z`;{*rzp_pL6hoZ#N}<mj8LiJ5n^b;V^J-=vWcYJhC3@?<x=SlpP2F~N>XT(h
zv(mrk1Wo>TX(xlTTAkRftd9%DG#|;n(sy8bRU5#S6*_BXYP0*CH3#-hyDq(B#_M>|
z#FEuE&u+bEY2<nTiDipzi?C-)+yN{7ytA#Lt3Gfpi_&BLBJEXwIqIEQbj6p+Z+6tk
zl+RIE%NtNqbk)QC?dI~Y&73!L&kAatVKCC3!Df=K7A{z4{XA&)oA+mS?s#t%_`=}t
zp?w~lGuV`lY*}~oWaOmxt0&#On0Cp2&Xe-DE?a}c?r<-ceJR7ZZRI8p1La*u%VT{N
z&!`>#BArp0m1_6n+3o#%tbTpFzt47t>%{;?^C|k@r5{Nh7C2MLWgoPoGxz*cgOWAw
zb`Lpxm3HbC%B_86{&Iov{G=uQ-=_TS=LsxaSXdgk)5hp*ms_^zvcA-q`B~EwZYb|-
zTm0>FQkelG*CXvud<^1-HlO(S+cFsI^iKTn{HfC2Vx0n~&WVRUoM*Wv*?6wOsBL@V
zQ5&5(t$lXMm0mj(oipaf&Hg;&W3zW+V_=xY!|PwQ+i!bLxGM2HJ8_E7(NC3U^Uik4
zKUgVg%bWFcLeaMaE-T(ztnz)`x#{H!b;h!a1HNCLJ~+2fSYTmUahZ{6g2n5$V;-M9
zw&=Y+w)S(%hsW#EUiM#I`#iJ#r<}FO>l5<+$7%v3-!0PKl4!l>IG_EzlCLu&Tm`JT
zugs9vwBERU^MYeDC0m#8`~62}*NYg9n4JE1_iQIs#K@o2J9T>PZmU#*+-LIowN{qW
zj4ckwQ}QI1wWslZU)#dxWw1lB`BePBOMW%KuINt;U3!u8*U9s&k{a=D8{gfiSibb<
z&Ew_O0XL$ah&%}Xuh=3aaUd;0Z355Mg{*8#AACzWV7JcYrd!c`+4uY*zJ&)WBm<2k
znzwft-Rp_rc(w7Aan@?~W?f;Qx07$1%Lqh%pUnHj#yIV&-<(zKOsls?tL(lRGk0h3
zW3T$Koc9kySi;YE)~yP@^rX-3)FDo_{}(ndk9lw<bn&6BU%PFs5(=w6?U<z?;lJfK
z`ze=Wkslcz=j}*WF|s}|ll2ngyy@;<o}76)pF>NfCRJ(OiJRuQJMZkOOFAJZD=RlQ
zt7Qtrq!kpr6JPPwFZZJDTEFRQoLAjG5oG`BCuf@P-lm{MpKSMB`Wq>}Gw|NFMnUO>
zX-7|$y!I(9jXI)`uKq=dLE=v9&6oW0@%4YE3Q3l3y`2;Drtv=8#veaZ<L4<q6SQhL
zDP`NAuCc{Q{qRzb<f)on36Djhw?6GrC^=BeyUtRp`QglO(-`^BM5)ZUKK0uJ{|(=7
z$?cHSFt^|KbpI67o-h1m3>i}|<o@HG{W<4yykx-+?bdg#^V{@gg4DguGJa1fR_~QF
zOLt%T?hH4}zB9Mie$Qg?Ef4w6Fkd9`@)yVCgXh9^%>G=i3TuB>p(Uk%L8x0ix28_N
zWt(kk_j&ntAHnb|J1>ZTFL?XV^=!7l-}fhyt{y+!#p_i(HN|CV|5bx4k_9USR;~24
zm)s)BYb{rj^}TqT+|eWbHj8I9MDKM<KkHCGr)$Bi$5Z%%{e2HPSu$K+RTi;x?V+gs
zv-AsJUkdtdv~%&R1f!2@e=|6o@m?48?NY^p`SOdWUp}>Z$xP`FDIL06*Li;L{xDzt
z0FU&$zD<hzW;68Mn^n-J@9i<&XkU!gq+;_a?AduCrNJTQY-NJWFUAChzLni8`uj~T
z-@>}Z#g4Xly(wN5Qrtf$lsUb7)n?>iq?_KbQtDDxeeg25kcT|J#)3v&f808!aYdWX
ze6d$%tzUbVaN6bhS8kSFJ}mL`)+5a`%M)DsjGi$rwApKaM16T}(B|mPpPemt9X4i`
zkewU2a`~;Yh?~n!6$kTirN%#9{hvqSfvldvTK&(p2X!<bOu2gWli4}tH`7_CE#g|U
zCM^73g|B+-^=iJgQVTopDy&l5rQMt6&hanMyjr4G`BsRa_{(Dx4GttkeZ6*hu55gW
z+EW3R)yoqSc2`e%tk}CZ)Ka#t`)8iT?r*cV1yzZcT-(z+f5JSs1B|~Enf{(@+34Im
zDLeK-waBq#=F06;FWPn<{rd3i*M}Ju6_=+Z{Jxp(yKaV2&D@aNeyX3RnwtI9UR7Dd
zc)l>m$oDI|p04<dh+7}h=k3~dbH8Hz1&vp;45q5=G|FCUQ#D0gAVc@_8ohX@3)fx+
znS@VZ$*D@Ywo~)U+G{nYx!&pf4hsIbnXaC=k?q*jOvcsaY^D5VCs#aMu>aBTo675)
zrHnpZ+02&p<Xjeu<LRDQ6SEzTU$vyBzF3kw<Hq(~MY8@^8rubhkDX<^YjL#xwR@oN
z@9bYe{zAvZ%v;@Vzg{c3#WlHgrQg-ER3p)~*>hslANt(C7VIPZ`C3NNG)v*X2hz@7
zzo9o_`KmU(+S8R1vzNJkTJ_USn1wSd^rLU^IjfZ(%y-`xHXhK@_!!Uka_j8Rq7jc9
z7e#rb^4_YNe04ux#1@Wx>-p(Y66ZgZ@D^I{EE2l3LVDXjb=G+tQTtWbaj&WS%Xanl
ze2(3>)>U<1Tl{|d<`w$$O-pS*U#U97W`At<s#*MOGmkH^VR&q+?5i`^Y~9bcyYIe4
zf3Ed@w)b6oW=yZ+p`s^in_sv&dvCJ5^<hF;t^JJGt-+g4uB^IWG*xU-c!y%{Q*V!d
z;;4(;erMc}_`}4&5WvpBpp0j6TR~1@Nm_nUu3kZ9Z>VqnZ3CXYzrzLI9yAk^jxCoE
zSa7(@>~2@CW8>2eiX1#wmkH}`dgAF7{{MI2zmDYHN0&J#bX<A-__6!BhrbWM?SG-|
zA1KxH&UnhS=Q3Yq)_G5RXRxbBe^2p_z|^Hb%hDfydh~X8N8P={S?wQqdnZkJD9jZq
z_C-Qx)1k%Ut7Xk66gN)L%9NbWrek~JLQ<Bctx(qK;1g5XYPPLV6;9C!6l$Ha_;Z@r
z47WpCtec-ixGXy|<;7BgoWMnCP9YBEIp?36_3VvV%`{2H{zmgL6~?$JUcwzyP8o?`
zsp$3pbAqSr*=@b7t*g9ZHZi4d$k6<{?PllwN0vt~J=~h%8zd|Da$9<|$y!6bIc`n%
zW#6JU%PrcwHPq9S!Fa<bn|X(|;{Mh|sF=?eH;;ceef~4K3z>p}c7<zG)|UUSxfov=
zr!~Vc<Ur7axyx$)Y3wyWXtI2R<5>gst2>^Uc``LC&1ZC-(Ol2;>U_fg_LpmC3U7{{
zcWdj$D!2RBH{EIxsBKs}>BfVd$$YA>6ngr11W#q2Z`t;9;zIdrjk`S_3a$yb=@{T0
zvvpcUx7ml=(Mj9xec7iXYknnn+DVb-Yw2u9%--DOb-e!e`7@E0sAa{H`!4qczu$9#
z=ip6`kNf6pU-<F+fNAUEWnw3KSSPLK6`23^%iKSO`kWiHJ$rUu?bF;EI%(CSC6<@}
zdtZ*%+R@2!fA__lc~a&X2j)qLzX=TZzx?Z&3x7_nk-M#|T<<b<wn{krr(I1`?H*iw
z@obis;&D!1&!|{l{X2!CYCAHUHZGnlv$1JU?)1x_b~l%<T5MT7x%G0wl4bf+doog<
zTwBi>Et_ERwMO%)wHnX9cbYrysOMU}KKr^Zx9NYuRgY|6KcCWtdk>nbhB{wlD+`tJ
zODjM3a$k1CvAbUzT+SG*KAo<Wyzzy1zM8;dmHRPQEe=ObaJYO!|8+%-+n4JO*~;Nx
zjaE(P7G3I|*}@=IWB+gI4jwmKF*6VO-soSMjb+O>F>bpmv-v^kgMGJc*WZ5j`sB7-
z0v|6Psjg>4%{;Pl`sz7i3=ATH3=E3+GEZemMt+`NLFLn!|M|BqHvPA)XI+2L$?V#+
z$;+mHYnp!8d-j&u*SB!a`f^K2`bA3TwyhIY*Y3OWmHX5F`)4Lh@#rj?6l?Q<@BE8A
zp-vgT_QNyJ^R(Yfn=XDl{&;%efyqt%{?7BJT-15=lhOLrpM-<Q&)=Q9Husy_*=v<1
z@l)RXJooweo2-L3+2fXQa{nxsTYgjM*TzY|Pp@4YIZtoq^Rufqo!a?)W5&#-l_&qG
zczW;exwPcQtx4z8LWQPeN{K6flNONPC{m~Wv%hHS@0kiyem+&|Th?`o_0P(x>92LX
zo}JOZF;(VjY3OcMBlf>;Ig-nZf0n%xk1;**$>f3SL*2@q9?tK}Op}h=Jm%z3h?xI}
zqoQriD}MWc(@ymzThIM)uRrPj=85~s&qw-amn)a;)brYxGtWb>$z-N$@tkdsp7Pr6
zY*L?lOi{lw;F{0xgKO=dx7JvGcC7jtwKvylzo>r5W|@eXr9anZah!SfFZ$~i<Fqns
zahq#S`{#0tS^LJ$tLgt_vheBjwXCP(CWPKQ6Yo}dSIot(-I2SOchb$)igmM=s{Gt_
z)$;GpdFvgs)83rg`>U+*(cYg=pPc=Dx&J-iHi?=Qi!ZS8PhmHSRBz}Ok#l$4dDY~d
z_+9IHAMUi5M<w6Z@t@^h<-N3g)lK#r&Vh&S>jd3MY-&{a*4-4l#&Pzf%S+B&R${JX
zJbvQwf@ftF3bP)odv#svPv$pwE@W^zz;@krX1~Or_scTFD{fjv%Wu$pG3nnI>oW^}
zmrN_Z@N&*?MgHjg#~M4oCdf%{yjc~whI^p`ztNWmzi;TLXYR8(aGdvVmRWb*jPs8&
zB&XVZ`J?kG=l%ZQl~4SW_hoK*Z{vPeK=$Rz?^3>p7N-8r`?%u)yW8TDU()Wnw}P}S
zdM6c>U*A^EzO6mW_2eVQz1ixMRgO8$IoF%9f%jO^+8wDcd!{DjwI0++SX3x-=*S|K
zhIZ}>rvG9)+I~ue<ok*^L|&RI{%L0X(WUG{-<U2K%Y4yVzeCEEm;cw%dAoO8zvF(^
zzJNQ&W?J)Mi#nmHuMI1j9*EuWYMeUfY*PKXRVu&sI_--H@oI8lkBlvn-*aNp<;#!E
zPT81FcYfA$d}}S|;yZ$S7?wXUQj$3JnT@qSU3pqV<)W!lhPl6GUr6U4$qTQu%h&xm
zwR*~${5JMkR;f1fJa?-aT71mj3rU&nPCk~fjwiCPaQTu@Av2MWlZ!v(dm3|W<GGY7
zcJz*OltFlv+4BVMqj`->SO0h*<-*V{9<HcAXSQJRm$-8quC4FC`YGwJ`V{Sz({Aos
z8u|bJ6PX3e@}?NQd8;9CY{%1nwzd18`j~eMxJCXlV4cuc5K~uE`*fZwE9cv1Y&-tW
zP^(GtnP~T5hs~D>Zr8=QSM63S5m@l5vyI{YtWU2aMNht1_@|RiwN2E@<@W_0|6~^4
zpURvGto0@FUR@vJ44283-d<FHLHf~su`Ui5=d&FTbatP8QXP|+nDK;pdEt`VZ@AO7
zH~8&{(rh>$y)SKvUc>9IDQhieoSV8|FJfAnsD*lFQn=s;OW)_A2c7nRiS2!08FeHy
zWP)nUukA4r*#(b#delA~5UZQEwsD8>q4oDyrp_=5xp{EH*-J6X>;+cw><Rnbe`w#j
zyk(aDgpIdVVh_%*^JI3hDpFY1aMB_zc%7j0+<wNsnY-1!(q1waR|#}5Z`y6#@>=4<
zVatT_?~B8j8?7H)jg~iA_FL?u`~PU!_AgtEK6>~s7Sr2Uc<aBDl3>Mi5eXJmo3dM9
zILmXgF1l*Yj=DbM=&=bwaWD2iewPvZ{_NE=3a5mAocZuBWtj)#)qN9>d9gb>oBgvc
zHGR{$?P#JjXQzF6PS{Sq&9C;hOFe&H6Y!Y*`TiSn8`jUBGEec_zYhZS_Bp+ZyJuYz
z@Mv3-F!Q_F?j_%oF8382{wTjgw_x+7Wx7E<qK1!__;UPDdMB>>dvDW<H41NnRb!an
zDlrMz7cg0#S#nD8RnDymu^YE2I9n8Cyt}N`<-DEalZG~T`jR70ADWdVUgkAqnm2P3
z_q2sC#ZUfg+W2$kLV2k(ZRT#(H|B8^aErcdIC}0{bK>r^TZ=1;zW#jl>d&7ymwwk&
zK9Zdu7gxK_%650j1yf5`$wMYGi=*2VY<yNvs{3Tq-u87?+>(a)J%{FhWZd8r@lfEO
zw3(3B=dG5ebIc|jsA-g5UKhc`Qt5kGqe@)&-}6s@9vkvsnlS%K<*aDW(mkBZcoaU(
z3;W#oS#9m32?k!tg{dEovDu3rW|q*?lI%NB$0hqsSb9N&@$`ao9jWUA+;R+LzVRu`
z?h(0qaDC_H+uLmK@-A_>#Xqr0ZPu2=>`4I!o<5usXv9-%nHh9?PQu~Ww|rhY2-t63
z?zoyoZjT20Ub%FaX1?6r^S2f3-5_hC6g|;+h2mWGW0@NakL5FWJreQS)?l%7wOFQ1
z(znwu+1n22$NPnzSi_t!$9S)kPqY2m@Lexk#g294dC$>R*54cKzy4O`)?HWmmgR4`
z#klpjv-wSPiJce1*gF}jc4^dHc)Mixzklc09ClpHF?*&szt{81`7aHT7Ya8w_&#}W
zB*63`yko9R7$Xm7SoQf@(@P$UcC|NLUv1Rnu*y$8(2b?nUWh}i&Zzy~1F2;UpMx?O
z{~ThL-{yNM>Q`=<=)XC;-<Y<WDphd!btj}otX|PHH<Yov^+#WZfE4@t$qkXd&!moO
z^8evdRIgg(@#VmS`48KcwkJ&O+H|2|6<_4R)xQq@TzccygKIY;r-ayN+}dDz^T7;%
zWqZl2B97oV6+h3QjFzAmMYDf*2uJc>QfcrFJfxqwLbLz!)NTP8Mm;^}RlEz?Id11j
zF5H_I80ldCVSnJP-ESr}o18Mz=2M$&x#L_`*TSPq3MW6h?inJ|@Iqa`tUP{}RQjP4
za;@2kXQkO{BFZ*5Ty&e0{%mgEt$nO(vh`<O<ZWTg)Nw0)`G4B8D1$BE1GZdy_aUag
zebd$(67QJ4u88=t;#hFpI*T>2=bj6&Jl#^UgZ=o|Fx5<Pqlb&z!vlqut#(S)F${N!
ztl21kxyDW@X#*>hpO<SL+nK^CFH-cb-P?WHxJBH3{dvE>#O|k-7CjZbRt_75cf@e)
z{?Qn^Ex|CXiQmCy>+dXeo3#_OCx`uzEY^7ZSWLZ2iM4{Sb)JWK(i49f-Nr`(4@{Da
zTbn}9U2{=0etqd+((Jb%m}O2>+;McOetdu>A$IMCFInYH*Au63`*g6~|Et?Osqtlq
zMqTNLfTN5H9{VgdyCmSEA+1`s_vV6Cyw1j*1@FJu7QWxY`b1{_o_~MNS^unhx<GE$
zp0EBto*xdooZWlDH+{n5>&x@c_uY&AchfM-%Dh%-SLU|VHR{`#G9G(gJrldMWas?#
z>_vOR`g|{$Ov-6m#P(X}m4BIkpU+#}2ES!5tQM-dNfw>2ytM3B<%Wz!x&|Gwcf)ra
zWlf$qoz=}*;7h~m=&ic)dPn=if8YDpou>HeaPv7UkBAjjTedM@>iQP{)_&ro-k$!+
zHB$boPAh-Qc$XY?vPj2rhNb+XCwIj~I~JJgxf(>O&QSMyHCePQ{lnMkf8-YEv8|JN
z6VCHO&g%Tyhn3Bi2i*?bdiV7SgU`)~U(Gr1CNTI^xlB3s&#1-zUG+)H?rn{aZk(U~
zx5aAGyXnh6M|S!C)YrUGr)lN9`_uK=9=}+0l~o?I-r=>q`Oy8{1ktFd;&TbAle13V
zDs!LlB4=$($MhwMQQOX#>}hW2|E?>RdGDRHt}(xZ?D^_l?lT%(HoK_*Uz9odaE9>Y
z$$A?~6HM0|CDu5;6#TK9;kp%Lf8gP*){33g*Xz&lIiFsk8(^-zzB}ws(ca?AnQhm0
zPR&=$zI$rH3BiwRrCWEbpLe$T!OYqSo}<zaz0BVV%n9UX<5#RGeDn9CGLuSypu~<9
z3tStmUwB>lc4z-rp$#4}Nj&B~$;+*6|6FL>`r+RB^z0ckrJnnp`SP#vVUG6d&X0*-
zzAM--%bO~_qjJV#cb*H*`{%!#oW3(rd+YOCCtuj+&FYt1Sl^KQP0UGue&8mr78zyR
zgvejnHnxo(i}=nhzV<WF*^B4bRqjF?wrexH8xpI_pFchQcOiE)>w`dtR4<9EzwZZg
zygDqGwWBah)9pw|M6hbYN3Oz}kP|f<51M<Y+fG@sywO2iYyxk}r%5$Ct>(*bysE?{
z<{-8>CG6}|&HCv#4)Nz1YCHP;v~)B*W72T>;A36BWqd!PepWhFz7Z+DV|e7P?GuBw
z3PQY_I2@N8IoQ!*!_f9(-Bx|yS$qeVM6$GSeH3MxUQshGEj93ve2UJ?AH3NjY^5vt
zT|`&yH{SBzc)x~4+I8+O6UA9FS7J4OZTl{y{ponbqJ6b*ayHjrs@92%a{GV!aDA4N
zgRSWDJ4+upJSlDBYP!YJ6qO*crEs6b`*-j5|5#nyEH3x;ON*K8shJ19T~Og|3p2?4
zp6ohd`n*XE9y6obXBpNi+Pq@74tI=MedE_#hSK^aC$>H`lPqzZ<nX|VN6=5l`&Z*m
zw)KH?1?PDvO!*L{|IR!*JvhjXYu8cF?8p<A*>gX>-?e99YmeSFxubJ)RhHLlgzA^S
zcDU-gD`BcbE?eK@Kf4O0=5uTHo178Q<dU4uKmC72^DkyL)_U1srByu*j>{gLc6+s&
zRs5>msRmWm^Tr46J@}M5$8*~Snfd2d{H>TN_SEeaV@}=%?~hU!Y66dLxn(!|=YeTH
zc01oFJvWwEGwJe~ogCRO-nu<fVL7|GBt5}A>lO2){F#lpZJ7f6R_7PVXN0e0;GQeo
zd|=O-KN2SU4OT9ao^)=b{(2?OLm3aumpb1S5VzIpx!18lzPWw2OK<Pn#n+ctA5TwD
zU%uX6w)WRI6@kq&H_Uw`-~N@~|M8n2{}aS)P2>aEUX;}QT6v9m@rPqYT5g4TbNQA!
zy}f>Q4`;b`kM;8%dqX~SXPGtCs%ZJ1(|7&$Kb*n3Zd#%J^yhM`EHx}sm1C9%UvE9!
zJ-NftTlnObgY~~SwV!Q!l6EKA==jlh1~<wA_x_#K7xwUIL58i4$)vZRZf<>*<a_5@
z<s+-c+g^8~m@1yy=vu}a@O*urUuZPbaAt>ih0LNSZTA{|R2Uv+Y|G24HppjOu#iV=
z&&h*pKj<=@iJ4`wrOH^g{^jEGzO$Q61FtrPMDJQx+>z%wEnz3)`$!*=vfndy&$W1?
z)F0M4KV?g>yPd&>=Axk1-3;kT8FGR@PA{BOJpW$p6B$Ql+ZoFWEmm{~wJCE1T`0Ss
z_`iCiD9i8ire}LUt3Tfn+b;d&%7pBg%B5c}H40f)huxT0d}+$ndH>#e{<UlU%3gHz
zo6W|!FL^ut3^v$E-{k*fF7xpF)J?OjcV%z=y*k?cl|uKWaQ+b163)fFoKaziPkiiT
zi)9skDrx+D(&B9==bn34(3HT(82n?+&ZUCOU*=9#bYe0u{CLdc*|ylj$t%w%oD1er
z%RPKzS5e^I_Zd%>r-hd2W`A+;-B5b-cFC90K$VvDOBP4nxZ!jst&scV?UtwCRwX<8
zoloIxtW@~QQ?Th%%md!meXCt1t}gvqSaO>2SlgnIc?nrkKO~&fxysCpFShRN-4ve6
zJ!7^0iErVo3p^EGunX8HHEK25P5l$#^8HSDZhVe4gS)5AHxDW9pK+1?OG=X$$S3D+
zzMf!F_-3(AcjC>^n@%BCtcNN~SyxW}=H|U$Bs{&P_IN7SUm2ZwHkV5E_Qn1!`uFke
z^2Pk>@#pOK?*CEp>D!mr&C5%^PT*Qy?*Hmd%h@IG&8)ecr*SV(d7YOS-E&y0TY2Ly
zjncmGGY95vH>{Y=&Ah`uAi{%%TSqN^W5F5LJEj|1yL3Nx8^6~7n4uF<eB=Dwjk|7U
ztA4o?Z@O;D|1}#X9u((cTsdd&Sr3<~I^Q(T7+rh(!)#8+(_gn1ypOwGKTG|h*sgr9
z|7>YjBl^C@9(VkGu>OP8mgS%F6@I7j2hCVe%@wM9b>qsl+O@jXZk%_|Ev%0Z_3c;P
z#1gjlREyL+xvrfyN;C2UuW8y<1RjlAub`&$n7#O1pisrCZyV?RsPsEpJAH%D^}C8u
z6MwxtZk|5B-(OGRfPAU6aBiiM*187UD?G*4rI)31U;fsb=6A8;(n;<nt6!>KTRIO;
zdZgbrJIu6n(Jz@_XLrv2P&CO`quV6z?fw}$iawFQIKyrvT0Tz6f4<&Y|66&vx|mf|
z?z{`zJQeEGLS_8R%FD{W$GzhE<?u2re+QR?;*`AN|E<O~QuA&Wm(P#>*t3@J&Ecir
zpMH7#uiN?gF^4Ipn~YAEh}Avp^q#ru&CS>ZyIYx(Tz%i>vRS?1vE6fTXQj^?H{XBJ
zOTHW_{dQ{!Q`gs1Hjg5H-Pb!5m@4#jtz>#O_iqoz)6$oiqy1R)r+8Jcz3;I;XV$&v
zqT20Qv(uuqr`<@|`1*9=q61B<v}8^n&2#4}jTTw-NOGRWQdS=QXFB^u7+x1QPx%$F
z@gaw?yf)tkzbXIHUi=IB`FLA|S99qW-OyU+7(v@Nb>9y>SohhK`Q6dq<@pS4^Y(47
zVQ;Md`S#PRCx`dG%m{f}x&QfsG=rxGT#Sn^RpkgwcKCdwwa>q2rtB=?s|OZM(oJ$M
z%zac{)y)+Bq+~MhQ=P^AsZwDQVk;_w)HN?fmB=5ISsv<|X|(mBS$gg1j4KfwD_?!8
zI&;D6>eTOTN1_Y1M5(U5xGp$oz0tn^7C%cWtNsa|5f(Fv-gU+Ff7UtaEsVW8uc#<b
zz7V-6>=*x!b=g+(N6WOQF6huuEq1xO*I7K^<xRKSyEAWvyz|+py0h?^#oWN?sS6)l
z=gPi&pSADZ*46Wzc>Sl^O4pa}e^|>fvG>}eFQVd%F*DZ}26unBvY^RLkpG^;o=d+Q
z#JOxHJUwt^g{<{Ym(A(FZ5TH$x?8;KeoDg1-4p9p2X^h_;D5iZXyfjwdyeQvCYp15
zDG2V{ApiVhYS_B9_tzV|sO#p+37nd9s3}R{MaSK{-$ni^ByL}suq?|c+xz9S6^Fx?
zyGpgs+i1SUx*&2^<LA2n=Y*}#Pi{9*ewbS2d2-cs-WI*Sb#*V*gTL?I#?$Av^WpZ(
zJ12k3_grYt7|m|zm3{kTN2Os*EyMI=vr~2&cXzS8U<>&=*UA0w*}s?n@i5nY*dc%0
zeop@e4gq%8PQliDekBvUR<U&5`Et+3>%`-89=0#}6d6{l&3u&}UMkJF(s9=*-rLLk
zchB%E?|s5MFH-dUiF=*iPi)vP9Coy?Tfb<Img!lJ3wb~8NJTtanL0lxbM1v`2h8jf
zF4}k&*S(#dYA1Hx?vV84&usG(ZgG3?zFObebU;I2*<S9(PN}Q=lA6`Z{od_Au{xOR
zTIYJJnagI}I(&FZ*u1ciM9%CNn=Vh%eVM&+lZn@hbq1$OUGM8URL0%0Udy=Cx_qn2
zhnCLwX@VEx-<g&EnDuneg55?heRw!?TBanbXhi8~u=+N&oRCUujI8SV^Xm1fw5yD5
z^}Ty<?^r3fSzvGW|0`Qxuzl#4x@Web?aP*lp|_53t!J6HEot>}?}f8J1@&ca=J<8f
z>Sxv0mn+V>MBnsgxybfydtP4tuHt2l8kJAi$npg<ZggO{WtSjqc=hB=i*<9ZaGr9?
zT-PsIck|)S-;4LMrW`#xZx#EZ-TlEv2f9{VbUwFfUyWCML9%3=_htLKyK5wqCAY3#
z>TR}mZppf{9nsORX5U(uow_G8Px_R><s4Nn+f?I^?O7cCR`=hkWm(Lsb2@b0zejng
z^+E2x*RIR=-J9>R=2lJaT=&lVhkftYo8FRowR!P+r9~?*=J(H-{^H|u^{dCL-<NAE
zKK{>yI#k`n>8@iV!oXnX!@wYmXQ;Zc1hnDI=5^8S9asPV6_NPKzH+0BdgSf571!pf
z^=*C~sos~JTW-Csoq6JdGyWo)lNaQyJ<k7SuiN}J&mTB7sc2~DUdpwc9HG?M%sl6J
z>n+vm^Y8z++SkE6O)RHIZqt<GfoDD?e=75Awl=GKy!X~k)#W#f<{sZ{?RRfa)!(}k
z|9&&iykq!jqG+U-)3zkfZ7~N@4oSwEsQr2TKk?k`>juxymOrt1s?*s1)9AEj|K^f(
z^;4T!KmJ|uB=ua){3F~I$2fg2_jD^BJ$Ej_pyK>A9o8>RrkzPYCWxz?Dmuj2sqMFD
zj@}LDY3FSvc5Pmq=)?TiF#T6>*bD!fy*-yD7qZUOFxjK2JLA}bxQ}lP6TDqgQ||mZ
z@gr7DEGuck(m<QXk<(thT>j`B%eyPZR~}3#6f3Y5I9KVH?&G{_+oJjNZ9mPayHIX@
zVA|)IF){uBZRVfcYVE8n^+6}T-28{5UBF=*+k}ZJo6p%UsSxsiI6>Lyqgws%nrHL>
zRh0d@{ByZ{UpYrimeT~?X@yNCtN2{*8L)3Gx$5#y*&ue#rq3p)q8>l8@n&s*nY=Q8
zrn2+il`}%M>wCJHG-4GuY!=?s@#FiQ`G)WGKUcU~etvA?acY9-J0<Rq-SWp2*jUfI
zv%H(axqAN(?Hl4Bns*qhJhngR8FPenf8+Y?pG3+$Bd3^nUOO<aJtgu}(~8y;vWuJQ
zA5VD`@B8Po|Mkh+#l`>ir{~|F|MzKCyxz9|;Xi8XetOo2P8Q8kvk3BFc&d`P<-vw?
z`Z-qpfhA5Bb0g;*ldRm4Y$+V1^iZJHlG8YB3EzdupC0hJde{bVHw0V|nYOT7)u*as
zr$q6Ky>(Cbsu|dJUj8(3&E`oqDXBt279M-w|J`)r`_;sE_dg&0tIfxB{@c@(zrJtN
z_t#(2FXRa5u9~-R<IxbaznaesKA+9L5dXC|YuPL=>79?*D?Bt8YD=k?aP7WY(zS`@
zh0CKR2K9ymOuCIJuVkJ&v#NJKU(?y1J6*w`@KkJb{hp+mNA8r`q*r`?Rpzlzz5SEO
z$5WCSN2c7l<CSANn@R5p%a$42m;5>Rd%upKZ(Ht$=K%}F8Rh*PPxmwg?+6y)vua3p
z>K9sN)?Vc}L9$Y{v9(Lho8eQ{*&Pj<&lWi!ELyOBwc;DWB?}99=d^!4_8^)udPk>&
zL~uZMQ}1g1f+Gy7jX&RpYBBtJ_25dqmeiku6@9@gcp}8-y-MZ2AgWU$xL0tF-Me{n
zeLhW++_5^9amMO2DHEAVlZ8LsEo48h_VUV}b1O2>y{I|9WRGF~l_eFAJByFXZdxuO
z{9XNu^r~&YS?3!6*VEo%-+TGc-uR1qEZ9=N+VQn)l3K{LTU3h2E`#&moXs2(@+Fu1
zr(YNTFPow9s41n_W5UxDI**<-*=TclR&Kbg?Y86?yX)$oc~M0Nt6669Tb{d6CiUWA
zz~<@6>z*q(s_e>b6e!Q1wK%_g4fC0!bLKTOMjw-l-0-tN?cUM?hK!^Y6~fQEKbNQP
zpEtLT@!r)Qy?1g8Ud;Ltp4@(`?4g><LGC+^@lygt>~}4Tm15KiEc1~$yv(X#^9N@$
z-Sp!rT>CsHe|cc@_rQ)!J(ZZIy1<TCMVzY`JN65dh!<SwO*-_}i6iR|XW^Wv=dO|`
zmj7pXrB<yG<2>ubO1I^T{9I?`4sgmAS1h%#JX_hwb-I*qPU8DF&3sadXBj8!A9b=@
z*N~}yBKXIT6TeN;XE7*Dskd@0u6(e!D9T&Y<^jWJ9lpEkiUgILQeV242sU42T>8l7
z-^UX#wZw!SWiCn_m{b?>@8ZGJ4+<`n31sf8V3g@eD3R(9uU~Nc(2~l6?@F^6zQ0J=
z^DCJ>>)<Zoi}SzAWz1{pD^h;Gb_oMx7*nCr4mnAitp$~GJT2Rt_4#ZXjpi=D$$V)$
z^WH*Buev3x`}wXnt!wRcQNJfS%Sit_^CVdn5tCP<??3;zyN|uAy(Nudws`UVa_(s^
z%1zVUGMPUtbd;3HGuCLfoO5i=(l2WFZkN<rE7|@Mn8PvaoL5Ig-|Z~HBmaV@&3d*;
zW4caxdt9sNBjtdL+1DTVeQCdS;jx^}mdA%&=6Bq^v&V8@E+2#ayoU!f`0uT^oh96D
z7*Mxuu?%CbP{^J~%0aI_1ndoY*!bzz(pxMC<TXA>%n{0GVg8WtAuEBO^8-_wxP^P<
z%(9gGA0lq)&6~4C^ZjGy2M6U<{roPQ9+F*9|Fq}))c6Gp?`;e1Ep3-QC&utStK(LB
z)=&T2EFp{4e9wNCF56JuxJzI87gNKtCNC+$wzKTvmtMwyEEk#DZ8k&xvHOkPH683h
zcN%3mT8&vYO>nwnp8BWJu_ci8*`bQKh1^P)ML9VCEZe!hbz_puM-2z&^@lTS{usNI
zz3jcrmF+lZ?yJpnZi-fJomNokQj;y7Xn5wy>$$ojKKqRfO_?Sg5qQ2$L%M%YgI==V
z<R9kG_-;RDuv{x}Y<<4<r=@HSCUQJcZn1W8=hCw@OXjZ@j6Hl&GGAfW<s++9Jq*g2
zsx=Nwcb*%#GWzAct!#&b7Y4Q+7P~O#?sS2kjRC)_8MYPKKj>*>Hi+n2yfyl+*dMuq
z`HPA<UT24{UL&N@v#>HLW7?Z+(|)Dpg$Hvg4X^*4BIx|!i09jbvWp7!rs*6wlJvsz
zE$_Y0tgM{3Dk3ZnSu7NLXV}4L(UN%}hWU|))sE==#D>Xi8vmD`FxK_rXk5;tl+toI
zW0j$JkiwJD75*3W9|Sx~Q5Ev#uWos?%*B^$oluY0iPVn9<m{NIGLx^&I`QeGz~j{?
zpZ@lqu-E#`fdoDF3BHjBx|*K7<`UZVZr{mWO8-_Cd|Ul|-Lc(v_p4^iyK})+E=|DT
z&xu6G?MzEb_85HPik_Tg8qmEUH0#1*?<EtX`;YN-`X(l~+zY$W6gcbK-Ce2D2WKfx
zWV|x5M${_ph=NI5-4m1PEUMYNgtv07|5~zt`37&j&lO_JmD*3dKk&U~0js3@{PX8s
z5_t18cwg=kxG1&8<8+Jk<clIxy%|of;JTK;*>U6HjGK!NB*^SY<(amMN8*p?CI{8q
z*#i9Kh80Iv2p>o|wbb9%$T8%?Ox}#h1tksb?ShJ3^9?0C+=cf|+qqTf?G%L%6;a1H
zpJ{PENIx?9Y^h<o<}~N&(yB3vf>lp!CbbK8v#3TKn6$NQ@3~Wgkx5a)6WF4C<RX~d
z&+jp_)ix9J^Oo_5l62yG$RsfHvc*J|H&1&!w67(9GLe|r_~~Yf-N|*4?T6Ek7yQ)q
ztPbBPr5x>6&(hTxZ1}sykNN%E-Ix0dk|TbrUSCmov4U&YBpsoiB*vwOX5SM1IV-Vc
zVcpd-8}1C=g9g02pX7dOc+=~nwt3}@DaULzTxF%&8UKhj@Si$4S4vrD!O6bQHzPu&
z6cjoP&v!Fxw$$!$T6gKjo5IeQx)b;wa30KIj;UnmNn>#CTe3uHrBRXc0gc82|269?
zyglSzZ8^1O!3)U+FSwKgWEzE(gf_5#(Ar>8!|ISdA$sBMOhb34&|uw`ocTGYi*Gt_
zoou{Zu+G$EbB&&F)~>1U3b{>!mWg)?cRQ{<{k)gwP15b757d0NdwQiW=f2EV%H-P_
zq<$-8dBg4YrEe6YwkluvpVZLDV!e1t)`m6{eYTi{)vqiB3LSZu{=BwUt4_U-D>Gri
zW#9hf30oIt1?UGYpRm@l%y?t`^M7x5)_!IZytY;INv5p7$cpZF5006n^Q)Yhu=}FM
z!YiUmzcV<Zh2wT!k$jQz_GA;c)VdV==udyE^Frbaj4!=*biT;EE<(R0=g^_O8{7`v
zSmbeCYYDr|HHi~KePJ9sIX_KN<vc6+YVr1Ob+^L{fB)n7>dbEvdUM^kgRP+<-zH?;
zIaqnHi%+yWTCsHJ0<}MG(;5v8Dv|^4YdGt;ygiwHW!@R@RPK;8x3Eh-8_Lw2CM;{Z
zSeH1rYXU=i?9#`V4Zd_2y}CZ_&|c3MNm7@RTdK2XNbAm8V6dn4%ye;ct>DSOU!BWU
z?$s^XEtqfe@xJQva-A97D%_LR95TvZn)n@De>(Zvlj4saDW7LgOp9(j+`jM6{uzN!
z7i_<A(PPJXUD*|}(X+FJRiD>{z07f0a_OB}E+>1#V?~kvIfb9D+<CIuS;fY|c*@H^
zCo=mPUmLQzS9UjUiRIjovr<rRMtE%f<#5rKQ0uKP6D&_{yd`+D{aQre;*g^r|CcSy
zWV?DGLHCMwPjA(Nf~>VO87%joz4U-T@e#+8X^Cucn#v!<8>b!$^!E0u<w#yuX_oHm
zy@Fv+!KPzTcOOsvUd^}mR^95XuHXZ=4nFpiTIAQ2Yq51zgoeML!;j*|TCamnUzkr?
zznFMAQ*n~Pv07R2TON#Myf!)A#h2sjMc6qR4}?1{zIA(l|0!?o?YW&_!p*<k{lb3g
z>n^Lb!$RktHJn{}^Ge4d1Lf+Yxq>s+&V2n;;0?1`L<8^ihwB;irLsF>Dtq20mEO4O
zv0ci%W}#iDah&D;`kHG3l1JiiuR0-U`gOV0?_Y09+)wZ0KYd{$n?c<wqazjJ_e%1l
z8xtjj4Bl>h;$-9V#N=gJqRVm{^}8=yUUD5<D$g#((6o2zOrr%acS)_f#G~cMY@lRv
zWQLGz@Q=?7eRJIH8Z?8}1}cZRhX1+1!0|e?@eGF`YuJIL4;?lBeQZMg7FkW=%r-Sz
ze-fFaCW-pwtoDodh&tf8iYIe|?sd1Om@C0KGo6hWt}5eEuPL_9IeYYr;jRb=4Tsgv
z%if<9-e!1pd;5b4d+N%1-pq-4xh#tHG#68euiI>wo004Fqt@n3H4Vs)J{nsTYV^T6
zblap8T(f!(ToM2Byd_y}{<S-&51-k>>6N)IBgp9cG0FSN3G6YN?1d&eq5iC*3AVQ8
zP6-79DeOXPuH0#>C{p^@k@El2TL~vi7Hhp-#{>eN7TzkVP{@b~HAww@$uQtssqiM9
zIp+j#Pp#~l(~(qGP}%!N+lfDR+LS%Ds<)dToqk=ruPN|GX2+3L4K_)J4%5>@*PlMV
z-G1)R{c-hn)~*Z7rCQ$Y*eG{Pd-L?guk4u<%UqL}#yDSj{NZ)4aC$^i;Sa8V_qM%W
zcSBrZj$!$Sbv=^>u5R`4ePDLb@${yh`$BWe61pv3ajn()b9&jLK>w=6r>}kLS#QWJ
z(){O9<RWI(qGd_-y`R<AS!9I%mYBISOu@$YqGYq}l9FSezDXUmiR((vHpy5z<Akq+
zZyF=F_f5;J^NAVTx127XcI0?lSr6}Vxfi?IGD1vt@B|*)D3z^ynf0(7U$emj-xU+e
zoy8rRo1~q5IoGhoxw6MT5P$yO=fv(O={fUftyBE6?)M_o?kzo8Pj`JY`><8bMCN+$
z+1%bQug<rg2~jF;y>Ynp$4aXvk(89`MQ>hSi5F!oJI{UJ|E50ktb3wmH3{cUJ?18E
z?D?=-DD8`p^Qo2W3fvtJW^yq*tYk`mx-MApS;s!F<1Y>b^}NtnGe=8mE7LoZh+0Oz
ztVYFkAD-wO5}10Tsr}q$)k|+VjdmAW%{shZ{NVM{-Dz>5WeT~oW7eiD6*M}z`>ovN
zvz8C0-O<_dV9Ut`0xq}WrWP8^XQ&dBRy*t+xJCHtuYU2#n_qV>?LO16T~?!odC@N4
z*Ad0bVooxL9e=m%t)FtyvG<OyHj)$O1qNE&ZN91J*~1(%X&qm<b)=QAgY?r6uTq|x
zL{uw1RZaT-<Z;76L+OB=K(}q|UwWVHTk?6H>xP~!_1Euw3AxmMJM5BZ>6f@&>`Ufx
z-1q9+Sy{T9wV2bH<Nuw5D_1xzTzcHtQZ8dxY5C{%vi|lG?j{jiPJiunjXUE~YMk+H
z);_Db`7`VOw*B00#ip;}qWv-7r+mZ84NE^41t>FbWN=8xShD`nvx$#q2~PW6{{H>L
zdj<I~LJFkzeK;icbV957>CHti_eoXl>=F7<+ERAOdH=bKCyu_@GyCR>fV-<Nas9n1
zephk%VTB%n`BDt?O27Q8Ue>y6-cFW#x1U6be&Kx}Ev(tWvF%)BRYjGo%i+dX*>Bgz
zT?y)&dLmrs%I@~6sxJ@rPY_w*R&knVhcgpHQfJ-WcPpgXV;h`U-kBH4Z(FtY>g0}|
zeO6bTY8Or`PHYMNe$0B#qRBoEnOcipD5iKb>{;k&mGxad)H-O%y<J>7V$}=Ta<(_i
z3;gZv+7f7R-#Re6bk>C2vpdzz?k6-y-G8*oy1?J(`DXU-yC&UtxTC?CoA}|MXz``X
zGcz4thLpY9aoVOV`blWx?@2FCTTIsPIj~P5Q1|nEx8)Zu>KFbJ<eBlp+V0;g+q?}2
zB2Rt(n!YAEI{L1Zvd<a59825nlSAdVP58GfYya(ywMY5?cMIHJ=NVTnV#<0cf$4YO
ztTTqM!c6|PZ>vbi{<6{R)Jxw|?S%Ua9&Gd0yPUFiJJ&Vg;A4+?9}2qgZc-N#R@-!|
z@ol^Dv`sN3g-OeF#U}F<lzveC{ekbpUfYyg6W{z7$~~dve*DUlsxJ3`mwdLJ+%{2z
zO+TP#%BqQaMmK%ic3k_LpR|xcIZ8&We)oczEANI*T_tosV}kBtCGp7gvIDPFH)hF-
zzMrGBi6K};;QZtHHUjmNiX@rTJNhjTPg6)+a@@t+k(Yg=(LuARcH8%UU$}Cik@%~*
zB94#tJu<3Tc}(g2zPtw0=*J&}@^6J7T>Rr`_p0nWLQ@ytzIn)dPvFP-7c1jc*rUU0
za?70ZR$kk%fAxl20(V@hmovTja_z(Zs}pOB^?rD<9rL@et@ftN!~BqCbw8&%RZqQ8
z@p7fUQm4#I38OW)<X4_rZZ#);^JdkYw)CWl_r#s%TJJg}KlKDdeyUiA4m(%Hw6q^=
z{mCD--gdU%56xRr{zqPLR;(k_=Gh(*?o&H-d&+M-(cdpqdH-$g#keenXVtd<mnN;O
zSAKD9=W})?t@i!<{@Ko-{LcU936oV4x{D9bKBq5UIlunb!!MsMw||z`vCn>TQvKhP
zPoExzIj!i_s*Zc3H%lh^zf6$rja$x}jdSwe1?0XfSbbKu?(o^0K2h(Vtr2ufFLuu=
zc8|_|_d+`F+_HPs=IOj<1;zhaP=_5ar@PIpW@lg!B5?P5adKi#VnJdu=<fBU5wZD?
zkBQb^Uq9m(zlvbz>$@zK1`if+-z?<4y}SFEXVeZh!$oeFBA)OVI(vn6{rf)8`j6O3
zli9D1iabBJ_j%pi>ZiruE>C}5e?~4vXNu_N-Ae;@#&{;`-8|lNT-xxrK%CFHn=$F^
z%GYPlsohcW|LvQ@N87o-Z4rDE7_s(7&>NRUn?<Ha>Qz|HT+`zhDYCX}kAYIx3?Jj%
zqGMApS)N}Swr$eMihZ6>7K#06T0i+!W#|fv>sA}Ta^JOi+U~Q;^zk&?(5gcL>3;cZ
zUvB<grO$WuXH#_G{Mc?EjU7_*a<2O>dPko;qIuuU>9c!HrmFVDr6*kHTsPvlIBmUa
zt^MtF$!o)k?(Wzed;V^B<2=#!{AU5&VeyN%95SA${Y}K~@8{FLCjW1r{qyhL<+o2;
z9tK-#U-6S#8*@Zk)co!0btztwuUvizMo#rQV=iU+o<oi?i}5~}D$ntoDMmkE3;O-P
z-yF~u|1SUeeEYu@<<_#tEa%wQ?b-j+-ypI}bhDwqg{#4;Ex$gznp7$4zDF}UQ+TOr
z+MKT!s)O6>f82bxGxD~#%ZI3AKR2H}D{@}`>cgj3dQZvk`lOKi&&J`O(1x4*Ussw7
z$-ZCe6L98gkY1%;RO;hLZ@O&v``nRL`Cb0##FDHJrXO^-2Ffgav2ghp^O){C-%l~K
z@Ezny&Slw9kj2Nnx+!ImtUs5a;)c4*D*L8OZWK~mwT|8K!VItNoH-RgjJ5sKJ-_`e
zH(q)9jPeUv4JF6PmM5P&e%zvd>qWM*$fuq?-)8&q8|M|B6y865+40})6WwMB89aZs
zg^R(!{QCo0XX~Ih^Y$*glqR+PvX7F@+tXIX^-}V+Zj4L^G!9&>*?mpo?ALH+t3`Si
zzk?sY(NIu6aCud7hSAEEZ+A*-TsgQP+mXBQ&|2GxYV}WI3nFLPT3bt7mhRjgywk%Y
zHKOa$$;~1cBF}F4!FJ<k<5Jf>iQKu{k~|+C)?w;>`%^JxKi4vrd(UPm7MyG>T%O(d
zB6mjI#;G;hM&8F&KR(alH|2><cKCEsaZTVfiH<FcJhW!IPt14SG|NcDGUKG+8HvhT
zQ9;$1wcIUpj+{RBgfn*Giuy}lEV-^On)foJ`x`fX7F@Ky{@<S`TjzR99M*7}FR`{$
zBV*66K&ckCV8xr9_6wp~%&zZ9S@L$l=e!>izO?9mjZ-}IV^;DP?cAVw2GJ>p9Q-4<
ziqyJVeP?=f>a_K%upr&Y*3?rbB{TN6M0ULMoRa&)&%mhV$^_Px4!T-mImdgSbhD)1
z%vx-+;KS2=mV(2@&)8&z^Cg4Q51X;6?%UugvvkdMmdk3N!oNCS;61!mY}$jJw{D!S
zIee|~OhPt)`xm+I;;wx8txKo#2Z`pN&2>3+{8aHAP7w><-5aEGzTKQ#?snH(BRAyb
z_hw<|)!!XoPYX-p`K`hB_>{|x0KJ={C!{+LzO0>Be92(*CDwOw8|5v#7QFs(na!8Y
z&mpO!Y{rBs#@hr8^<(bYC`Tk_3h$nKe)*IW5#lE&H9eig`>}7A+1F!Bw_iT<H`|DR
zH)GDD@Z`6<1B=4Dr9)JFN|{3vF1o+b=U^<{_xVKLiCMwXmSI;{$E>Pnbarj4Sy+B(
zcFDvqB|#C~TSGIr*7v`dQ+p;-X~)@{j}F{f=kxEHI3uIU)&2uh_KFFp`-CLAzw+3o
zq<Y+9?_=4CMvU6-)i*WkHh0BU?w?Zj(4M15+;b~KOl92iGu9jLZQXh$<jvCsEXBnV
z`__Eqd7k|D<!auYy+*lDZ@<4%k+IpO>E5eJ+XNrDY7{ZYxAyLN@bmBK|9k%Oz1z<}
zPyd)|`?aIdIvXzBNmSW;S7Pzm9h)Ur<q90R8?a5wD>K{gv!nfkZwnvR^=^z!{}Q1h
zQ5S7qeaFtLr`B@GE;j>-Y45`?oD+-{(LUpSi^cgx-gV1~S5}>N{qRKh-rnS+nmfa|
z(xzRy^7QVe=hn|2zL>j2^x^OKZc$%USij|7ny0wDXZKo1QO(?EhgiksR^>i1Tau`E
z-tqGd)t(bVa+jwtWvecd(Y|6|!FXfQA4}KuZyi|Ac~|}l_40pev0VOe=)q5ksRyj1
z)+#?Qcj?~hzAa1iG3zbE0Q)x4qWi_OI>fJQ=kH<seXwHMmhJ`9Z<zDm3D=!!|6%#n
zGQZW)(_fcr72jSrQTAY~gJi;zIcMe0$*|8oTj%?sC0skxp}&Kn%r5%>p;AZ21>N_q
z{r^=e+3M#vHM_|B%<JFx-ZVNfU2g7-l&)$0|Grv%9cSE4{x`QD_O=Sv{Qmz%k@w7H
z-fP8rEc+WW+Wu(E-u)5ky*GKE_R_MM`lnycUd7*BXUbB4N{Kb|$}6U;>8Fj{y8i`U
zR-R+X<r4I1lHmJ)9pa)dybelSc+fE+c~@Q6#EoZO)u!;9iDzz3lnr;<TVgfMN$^P<
zzj;?_>4R@Rx29wiKWr=e?DASyv?jG}*QIIu7uubbuiLk;@Jq^acdoU1;$MW4w>vHr
zn%p9FcGFGSXw{n7SFfdBWLg(}J}I(xdST^$rH^U4oTtC1=1;qG@#>>8Q4^=l7h--s
z-LLUPde-MBLV`Zci{tIDiWGR}sc|YK9C{Ymb+uI9vi^^dzrjy^)XMwHO3CeMd<+b+
z`uOJzOF`$JZ<Wd{zHRnxcO9$QJH8ceNy5u7zpV<pyK38;jM~1nM_y`3O;b|rG<Ds;
zkQsUTW&Qo{3{Bf}pRQ2*=wTrzcds^~|4xi-?Th)Wa@{Jg`)kEi4=N=*YT!w}9=-A3
zzQ3zByYp4<5j|Kmb;959_4mI#Jiq@$%Fz>+lWmmjcBd=$U*9lO<xFgO!toSQk4+p-
zZZ>kNc><o34zSHvJ>$)EL*!HHgNdx-Ew(B?E_oc24Z9gw^%Hj7@@44LmZ&s;$1S#t
z^YhztP9IDQ=eW*V(qzfUdCgFqvv6^Tx*pTCxqfEHmi|<m@l)+`rOuAyDR$Fy9xFr%
zg-`Nycix`MT*~WVcI?BcL<953&$iFpZpC63F0<~DNBP033j2puosYfLc~UMZfA{e?
zaOL9<tG3^k+2*&(cCjgRzhgeA?0S}G*|J%WkFMNYaNTi->5Ox+C(kTWcHaB;#ld95
zON+v#Y|>A5{oZ6_a`V`mL$S<V=Fu}Zlp0QMWWT1{lzON#gU>QVSy&=d=bFc?Rt4Mg
zcau)$6fv?qNV<LGYlJ_;WwDeb|GK?WmhJiO?aLo`PiA&Kd3>djR-4t_KJi^alO}Iw
z+Ols-=>F*N!(VSQJ<;fBI#Q@}@{nu4i$gcFk}#u<c7nV>lvU@q6L*h^dRH>MkYkNA
z3Vp5q&EVF#T}%E8?|dM5+5Lh0GDG38>*xBrL=Jj?;60G1exGHFL(hjx-=wY>bj+Bu
zO7McXy7bJOjU_eVIZY>CiLtM8F4R1uS0VK?#X(Iebt-H1lZrnNYf2pMHU8mwY>{%D
z>BFspLUnG_J7$e-jwR0(wlS1?{pQ}xeZomU@%Bl{xm)L#EIFz?xptD*6)V=u%x?pC
zF<f&BG2>>7l6&f`b7!uBgXsMHC({F$b<W$%uw%io;)h*puhvd;P`uTc`XlXszG`>M
z)o3N5jswL%f)m1h#g=b=wKObYYuK5uGc(%5&nRzsKW*V&r^ppeZ~fv!*Ynq0vDkH>
zmC5C+nDxiiQ$KK(rOp(RHN9iwyo2$>uA?<kUm|3yi`-ne`U=l_xLF$c3k!YhdVYFE
zi=F?ayu1mEzNjS@GTzNHUZ}8?OV?y;RME6Rt~Bj;*}`)?`TeXj91=WhU7s7S{`P&Q
zQL|HQo5>Y9&bt{in}j6-?Ec?fe0NhVb9rp)yMw_>>%!LUoX?c|@ZB$l>XSm<X^XdL
z?TQN8IzejXg)$`$#ajW+VZqgmix$6pd1rUxDV>0ac1ri-Tiyj-lI$px)OvfZPse+q
z)Qt@eKl<#hX4x-pVw2n9(`?5vYl(*j*Zv3IAxjxw*)%SdV0f{0a~vz*Swlye;+p}l
z*8877qP*G0i$ibfjolARlIA-uY5HU^`=D<CUzMc4&AaBwJPr@opNO)V$IbY4rt@yf
zR~;VJkOxnL3oI_XPy2St;EIQ$q?Qol+khnjyO`RRZqVtx5w=w0o!~sBMXnZUniBe=
zbHjCdUaqmWy`i6Au=LLnD>kwC4=$1o69r^M9(Q$?Dol*XT5wx!<B>~Sg0}0PuFesE
zqWoWCO6N}F89pl}Ru-u5@vvJOa>6i9W%6E~oHK4~x$N5Bo?=>Tw2gIX7;BEAcE<Vn
zPP;d)6}dhmw4>_xs`;vJAMZu6uHJbiY)VIK&RP}S=`(%Se7et?r60FvN9;z9Go=E*
zUPSsv+zP(Q!QsyH>7e*4afwG0wEtJXyXP1YTOn|gQPJT4q&3a#&xFg*CW^k({M5-a
z!}r*O3-2VW+7G1b-CVQHOp<ACafbGR#uukGKC;LwZ9AzIpb*QEzci`C`@*vuPj_G8
zv`n>Xbo#vDMAMv9vkL(#MZzlD-QP0Hzlmg?{&wL<(_N0}ulAB&1^x<UPu5OY;T?Xa
z@rKJy=b48TQX>DJu2n6b^!z|Y%4Fq(kB@5z8a_*YcioS3X4{HKmm@tT5AZ7cUTJ;R
zczlu9eC1oJ^3sNlPTp6p>)9o~{c&<@3WMApd39~ZK<3(-g`v$=+yTAE(j4;c8Z5ax
zZG&6jv9e?yqcyJE^=zv474Vv7H;TD@l$VHSh+h|I%I05jx;mWYolQ#f<nHq4hc8e3
zG&5~Nn37{l>%&Qp*^|;|m`}bqwYj1Hc>3bm>I>3MJ3hY=;4z+hN{MH}ZJQ_4bWVO>
zU|qUNyC`#U@aFpG6B4EdwhFiJlg|)uJ*f9?Q=zNok(<ilOmkJ{%~+fuz-p|bdP}fZ
zup_f;;$+{x#;1-fGW|9Niw`bh$vYj~<8+m+Rk4Frp!<*5W6Qs@Pk)~Hxvs)i?q8AF
zFW$4#cWQ-O6gzq4R1><k9DDaP;%^vhkj5OQ!u3H7;=gv(%hmMQso5LnALaae?ANo~
zdb%Y-O^&|%b+lOKi%y@s)VAob#L1Ox^LiT88Ol^NZY3C)e*3Wgj5LGU(&N+L>-Duw
z{`j=D*z8~HxlIl;#8xz&ZeOwF)#v42IgP;!4*r-vYrW<E>a|=EH7oXQo47x|&D>$d
z#jm^yLH&EA<Q-}l{#U0cH?{Ec7*;Qcd@z}<m3!m*W8sUNd|J()C$P8(ME7!7MF)k}
zt%+)UKYzLR>!XVP&i0FzwS<V*6&y;iy>Rc`MNLNK7umlS&0=&~#g%==ra&c7Q)`FI
zr(1Of6SSha&M?N@eK&(w_Hp;;6!(prCmKB6I(PQs&3}`2cq}eEvto(-JNt=#Q<ux1
zUAk|N)0fJr3#D$`8y04rZjO4p=6l4n&pwkbbLpJ+(wgaU?)2?;|8pJY{F2qb^52B7
zIQX>j`qai(Z;W<UUq1FR>F4!xbLXF$nJ=HmEYG1f|NN}I7XKbCiQHfx#CGbbwd=1r
zpLOPMky7;t-ExjQa<h?G)^0wv)z8JNeXcMjEfDA1wo4<(RHt2g+1jomW+TxL?z--`
z_dn6%d&2U%`)YB^id)}{lD=$eaVy_-e}(l$Zof@Scdb~`=f7vF*Cxgi<4IbQSDI=&
z7J0E>l*n3ATBwn5Y1v)23011xJ*#r2Z88#@7L%&Clz~yX#v%NvxZcHEU5-cE8s{IM
zB$Dvh(X2tX-~JMVl1<T%PpRu!d@aLvI<0qj#*=a8uUw;tb;>%QkOwj!d;jiy_V}Tq
zv4W`Hf&Q|<KV4~Q&zZH4ar9^Tci-Cb_@Yr{c3aD$w5(vSLdRW37P&KvJ&)RSG%?-x
zowDxQEca;}g)HARWt_0(@7H87nIzxZVWPO~X`(>T`V@^da_c+u<jiKWWr%$Gu+<~R
zFsgIfmWf3o9aHz#^9B6;zbW0|-lJNndpj@c&7HgdY@vAB&joP{w8XdDZT}f;^!u6j
z$tW|fXs<o*MMGs?-Va@z8!A@&|J|FCiidY(<{sMGbyBmozN`7%)q+pcu4Vn5Su^8^
z`h<5eQCk<=`G#@noRD&|F|pKJ^0fHmVUvR<9DSOdo?$iCsnMZ{)$h)Eyh*#fCZZ^y
z*nINo#iyBbnT#jz3bW1KV`3%QbW`Ej*1{KR3w*N^PAgR~oL+TyO~Q@xlseuwZIa!y
zq%Y~*dNv`B^V8w)e=TP`k<r*VWA7Hn+-u+M!z3H#iVDwtk$vIVo^w+V_MKf_obdCk
zOwG|*I%|!uZ&@|}MgP|1i}k+I;i=E(vVJ!IeO6Sp=UA>pYJ};m+hO+}ecq9fpcnJF
zsbx!ej9P5ykBT23*`K$+&lLWzR<=d1Lgb^{wXFw_2+#iU;|@cO_XG2c?oCnaxvo4}
zo4zh4d*RG)k*Vt&Z=Q~vTfaGci>A2s-1)J)cirCdr!0d*>e}_$O>B*kx-F-5+8RIZ
z+@|<!mCM1#x~?BA?+$!vX4HOEu{zJTBIkyd&W4CtSLWv~o_A3B@@h7{>L-WW`PnNk
zGIh^r`7IIA7_#=RZpV%krlf6_hcf~<nC@R6DR}qdjbmpr;yzDpbLIBCJnh`);MhxU
zGT|&QlDQsE5<IqC>ekU|#&?ojlD6wEyxDYJTk?<F>ni@F8>KRN7oRJtPt&}1jalGO
z$g(^R;a?M(_9<{J`m%7Hy7kt*#jVwwzOJ=8R-AcA>WkT~qQ52LG0gw<!k@aC?_p0;
z-T2^H#g8Ld4R^B2LdqU#*BQJCe&4Uunz!3F=Q+1l*yYA;>eG8AT#C65b*|xiR?|J@
zQzVa8bN*J5wFgq$*0I|^i;l6{BPD)1x9GHnirx<go`{vN8x|~GWz2j}<fW{OZhBGU
zH<9kZ%r)^<triOwA6c|{X%vUu@mJGN%@D{tV#f7u8l$v9GSl<5%?x{43_1)QaxG1}
zrE9iwO)~dT4*eCiS8Nj_|0Vt_6PA78)@=}fG1tz_>Qp$3O6i5hW5@GkdW_gkFLF_R
zB#<Aa`>8!%VL_9D@kX&NM<(0v-LLcGXPJqORP6J`?bDx!r!PLa!h8Pe>USSFf2Ms{
z<sRm6v@!3$=3H5u=-|5#nK!X8-e`E2x@`KN<;!C2YkQ?rSZ~GH?`Jw<BYsuoXHmz~
z?Gw4uwnrwdsQbpD*7NMAs@1&TT}@L|xkE)$j1C;1VOU`k5HU5;zPRO-MfI-#7F%EZ
z{7^srdcy0t@@kg4Ui~ZU&0mQ>k#5h=ymoQk*;~G`EAw)KWgm%nguS1=l&jJs`qbm1
z`}eklpMT21`gVifJn^I9I-(Az4>Vu7u-@)Q*QKv>5-+={8uv2<e^pJ3JD?ZyCSsM0
z%xz<d>x>JcWhZQR3i!=wC$&MfxOMv`mW-Xdm|Jw~4;f6JCvAMX#d*@vyZhI?T>Wo<
zy8hb#ay47NUVrC(;fEFLt*0E9S#7q?wbPXeUj26IgUp=0dF?m9e4FZ>G?jN!qDZJg
zl4_fn>?)-&=|7RXkHx>JJrL*dH1Xn={p-7}mu0*-smOiyl-8N!UpC+A<Omf^lC*ku
z^wol&5uy8U9NZeUad~g}wr^Koo_zT9=*J&Ro^r0M{rviDO3A#fy-T!`ELL4G%&?1p
zTdMUVak^7tM||0Vz_tHvbiVc&@7!aPJzK7JMht)d`u69GZ=ZgBIgH`P(zAJydsNQl
z{faPFkM84~)g{U<5`IZaauWj|=S0r~pO+Xo-VaZUtj^{7_}3n_gSyZ?$yS<~f#DDj
z1A{i6MXf1`C5igZzKPkXKAFWO#d;+bC3C}kix)Wv?0p_yGE?S+>eS*qojyHL*24$#
z-gY|4K3>D2mk_ja%KzGGi8lSfkbL9Mao=BGKWp)Q16Kt{;F(~#I>va%38^`|Pb+jM
z&Nn)7&8Ah9U$W*?j_iA5kH~2sU;KUgPEPE0!r?!<{Xfd~e--|ge_nXol{&%pS=(6o
z?;i`PSFPJ<XQPxl{Yd>yrOWf?%}ZDmo$N0!%(bIx&+f?&%L-43$4jZ|NnE~Z{O^F$
z{*MyE*~WJ(T-)q7*=BPn*E*d{u6yvl>8M&odf0|kgNh&9zGzzVe9-X@So7@Gy&N~0
z!XS4!wgpODOll9cc@3{zjlFyz_?6X@vzOHk3MShgu26V&J%s80;v>@&>XZI0V3xQc
zwkTrD5eJEP#l6=u*F6?=bggC${TawVzn!hbDoU#{bsFQI%4Hi4&pVgX9ib<B?NO5)
zOLwd0<#U&$EzchhI>h+SvAk!#$Tdf;w#0KTPd^-Fp2OL;R+6dTXxf@4*3;gXqppeB
zZj$v0FyC3$u<Mgdtlt@7v79Z_mQ7eb)6DJXCv{f4W*Ot0hQ-$PH5;>c9VxI?FSk{<
zOv(DMwC|l(&^?u#ayP%_{d7tzXUr0trK}k}_jdZ4n@N*rZ|yp4@b8FaOTWUygElEI
zz4;_>Zu@2R#Hw%h>sK<z&ls*Pln%>H=A8ES(1aeJZl2RS^$IS999i+XY$tEbW}~mR
z$-DhF@VQ<-qG48KQoGy4UHx@RpPy^1{`RTC6V|VOb*bn1iPU3BPom|Yv<j=*vrN8F
z6cJ@DblGCrQIqzXd8bytT5>qmU}fmWbC0WRY-B(4tV<Vi3H>XiA5z|EP?f#k=k$yU
z=STd$%U_-RnAU3JB&*1>Ry*Wks+{hjzmvX}?pn8SRs6*2hqmj!x!Lo-f4Q&dS<&6_
zjD1e;MWb9Zuivbhd;0p!n%5@JoqWXgw`Tdwu68;&>0xwhx=r7&whhPDa;>=do5S{B
zjKDvgg=v9*Pp$V~z32PX=k3lvdqN&Wc}#dPtAVeklACL<W!xQ4%MDX5e_V9%d1KAe
zAHhzVY+1)`nM(e;%Qb%5a_Pyo@a<`DI)n7Tpye@Zk2Tj0urn~oOE56#6Q9R?e8POe
z`79!`c(#W?-Szb|CIyRzJYDf=j=54|JFi%mgWuCmCxcCCy=>E*<MO@!*Y1Aa;OJzx
zh+R5uSM{$Sza-Y3FiVqsXt_G#o6n7DM@oIayZXMGV<M{hwJ$W~w2{}mh`pz0&kEVH
zPO|=o(JrNvc6CcG&MVxO|1Hq-e`bVd@aub#tn2nG$k&~J_vXFdl6(Ea37V(=<j=Zt
zt;9-o-rgOtx3~K_JjgYY@+@?nxADnMt~nFVyqh-vp}W{Q{~K-1YnR&o=99VDyFc#C
z$=<iDd~Z_LtXey@`1yV7i#2<{+?grc6mov|{_b~k4#a1OGAY#EYBUYo5yh;o7+w~%
z**PZIg2zvtJt|D+c|s~%)*;~wIiDvTJ9#eYNUXql-b37rIR9+xSso~;-v5z#>jbVn
z2l|q_C(PWxqcH#K=|gOFH%whJUmuy4_G@F=+yJihXvLr?`@rAQ0q-tO%Ac~_q51rW
zC0E&IAM{IFpLU;VQ@1wH+qNW`lZ{6O61UX)NvzM@*(+>iW!dpV+vwki=nwM8RXD=W
z^>2MU@neMCEzJe}?e2n;qB|D;IeFM#n3LoD-(8!+_bbJeI;V@R3s;gzlX)9p?CYiw
z?#AnqFRk||>22oJ&l;!setR&f*FO6=Pc^WH!Q;4e!y7w)PKU4~GtZQnRJyd-2TnRN
z=ZOr%{3pMa^j7vf|0Av;cJ|NirTYuS5({|qypm2Z9pul+<eM2J?3bx!Vf<_TkNL%?
z6q8TQ2#@SJHBqNN;pEm6%XNg`OmOq$d%<+=tg#GVK(}{WmRJ4ab?=m%DtNP%=k|Jj
zcxWzBs=|@DX-oJ9Nmk?fmmXb{uKAu!wb|6wl#%_g{RuC7hRaQX;wKxAam`&m#a5)D
z@$tzgKGqXwuU~QfAnT#Ue|9eR<upj(JS4)!-yl@$(bZ*^`EO-uxogtANv|e~Hr#QZ
zvvG>Uk4)7T-Yi~Go+k{S?3?!V=N2^1eKLVXbpg{og)>2}vrg?OToL)@z$Z4Q4uM%-
zbvzk!LM>B7{Ea)bx)xlXSklz6G{n*<M6S5ucw^tm3T9QNH|^@D<Ry-)PWZL5?=*W<
zxYFhb)r-2<7p+>rdD|$esa<iJyUX^7mKEpre7!T%ec|4wDZ(BrUkP<>5&iZ0=_SFR
z+BHe{Z?8+Q|LVe*Br|zOf@#Hj`&n+1w?p(lXuS-4;U0f|ow@zPb@EvUbvNpmR7<Cb
zdimDyo&2lpc(|})y2X~*${G*bw_CQK+<b3_x|QjMp4Uz3V)h5zLXRtXvsejiKK0Yc
z=R(AjbAj_ZID#CS#9}UNs@ry@`ftpIzBw)XOI9@*OkU#sQ(=p9`LfeLBChjhhI;B>
zUl#Xk{ub@8DIAhTXFHuY<b7bdWqw>NZ%a_f)mTTrJ3l{fW$zVR-MaC;zH`Q{ZOgwO
zElGTny)CZZPPFPx{`^xc*SUF19}7Na_$$6Dx;54HtM;cU(<8Y`^wLe8Lr#iqT6p7t
z;py2ut8Ou8T3SgneQ64D3b745Bq~s_-Z{3u;ZpE~CaZ6q!GV*$cCFEVd4GXs*B+72
ziHmq&J8qn$woUz%uSc@&I?jyDKU`PSGcvrdH@#1Js>*EARHfr4bkdHwzWR-D@{Y-&
zk8Ab>Z@iKh5ol<>@>=ZHFeg2Cg+m&w3TDCHUEik_MJf3u&)}c8VLhYT!MVG>uDBWO
zb;0z;=lWApJ)#*pUHi;mPTrEbOF43TJKGJjM?UjDth}EZ5**qX%u{a~>YH?dYs%qc
zt2>SwES|Mtm8H-rtEjg>_g-9Z{o<DF7QvR7SK7KSXaAmHbaRd7saa+}zr1x(71{Q_
z=c9W>!i-)~Z%v(?4=tHf{Y7{0KHB*{>YU^wJ(Zi)k9SPeRknT4WcK`A@9u(U`o6_K
zs%!hM^2#rexVvY*;U|^V-`&q-pWI_M^I*Y3?t45_QvTjpJo)0ZcQ0H0B(F?eR%ia=
z>%Gmp%Ir?^g+DKww^yk+HtXTHW`_l#zQHpX9$KCL%qNu_wfNrkSBn~i>n9cO_-yti
zN!G~g_Q~Fy8xz7q4_{Jn3*6}RiK&`t$;LePit3q3pN+p>%92WtzU%p^Nqe2`jL(mf
z=1<>MQGR)%-JVpPOvdmcofw`~zuVp=$+Vv?`!ANocu(njglUlTq(uT6&A!P@-LGWS
z)eSdp-#S?%V#|uF99PUbekVRy|7C5^-(Op|*Y}#(v6rN*eRfDWH26_@UxegBnLDN%
z5AriCPv3Xpwac+BfBEd$=X|r88qB=<l!P>w!h$uqnvWJADtI<0{_oP2ja)(+aVE=U
z-)wa`+UO&DSI+u@$l|9n<0cj@^;mQ35z9k%&ANb(`(mHZH%>`(@7`9)_EyBoHT}x;
zcVa6(htw{6X{M*^a$*0Sqibc>6ewLP{o@j3z3j`YKMH~SlU|%p-Zg*j8u{aUPhFh+
zk8frE^kqDC?EyzGp0bmEd|y<tvbP|S&3rmj?c}iUt5@e2&Qz<^T7Kc(w|_3K^6QU$
z_gvgOdAV$E`kRNEKR=!2;Gg<<7dLOUs8jIAniWc?zB`}GS^GlmK$utkXQuC}#~$>{
zuHMJ(Qd}-NXYIW83UiCB9(!I}5_11}^{QDx)>BQ78=ReRGO9m3WzVtx^gWKf_GODK
zE+0LS?Xs-o^oLc`K0E%G;F%l8c3xrX!dWxxm&qG)F3iwk?l=1BljN*2@yM~2%wKdh
z0zDo3cL=vc&Hayd;8_AgmqiyN149oB1A`t>je&r~k_^whw0v+|Ao#T3AqSDW-?j6!
zx}6riyUSb9=oLRxQXt&7HBfEaid;jrCI8=jVN6w0yXI?L{LZrYd~L~Gm-R|MPyEz=
ztN0u}9=9whS$Cq*?e7c9C3dFtE%bg@D`l2ZSlpERUPwm3Zr0of`w~->w(pRh(kRI-
zJNx54!P7e1Jp>k*v)PuNk_wn}W3^V$A5VjYM~<@3KWCj0QnKU2F}{DU&G$BK-X3=O
zWSsWvCmSwqa6fkO?Y)C;-{-rTU6RjR{nGlIfl5fOt8LBCoU2N$!A|n4XPhlOA}-?G
z6&&-Gw;^4UJNwlS=LsjPb*>xnn;V^NSmeB8ugi|!r@>!$%Es(}^No2$NdC%>Yti0;
zQ!RZXrxY?wz4t~|Bw)saX{Wn*&Lqq3kJdU9#aD2TZ>@>NzG&m4d5eptrk7g%dL`|C
zV+WJ){(JW?-D#=OHe#F~sI_=`L`r$+?U<B(<=?8_FGvl3x<w~f<yVhMT&(KXzhxy)
zpE9}ohAcKM@3q{xw{YqDOIzy~u}zPj(4o^E*K*Y2A$QryN9L&AC<X=w1||@}z`&qE
zC|2X+GxIV_;^XxSDw)ylwu{%DvF<n{1H%s%1_mWmb29TvQi}?TQcF^c^pQ;Hope9z
zwt>j8_g_WYzbw+$Q2hFiZFk1xO{`%WCgRP3JxTK|Zl!oyPuu-v;y0=4O(z2%M|fRx
z6=$n|KEGt&eO4R0GyD6d>I9fuOjFHLzb^EW`A$S&PQe`CWp9|$j_sSU#*A;%%Tlv*
z%Wj(Lm~(u;A;GI^x7cXgx1$dNt^^*OfB(YLa?|&T3uU$BRkA%SGEI^fU(_g>Xy-QV
zLcMxiiq84gph`aZhtkaTdgARp-f}A4A>Pk7obleW;_u(?>3@#vJBB_Eb~<<FN|@G?
z^KMgjpHjG=yD?*KgytJ&>%ZHku8R4^_u|okHMw(E{uht@;hppN!`}N#uAH2qYPN2@
zd6n*Jvo$Gtb2@_MZ%<YIEZd#(W>0<5ntG?+ed5#NQzlQjll%A6mH_?~Eum7GBWsld
zcg*>au6^=-$@UX<iRLa!GfT32oEA>bKKW(Q+`_8|8a`;b2ZitbcI3t^AKuA~><ZcZ
zUCoUjW$tbGv(@=y){lKQY!51WB1?DYetY>o$jCy*@ZiH4Z6DT|pSO2-D4=*~Ve{iT
zWy^OyoFH^qG4*NBJ9UFc1wspqXU$D}ot3{!^`-CB^A!b&*NYFtNC*jvFJaDqXun9;
z!}*%U?j-b65!dlN^qe5e!0>Am-ei!RpIeZblUk%#Q2EyOZP8=1N&o+fM4adMigf*W
zMs0R<c%^<^^yD4KlF#3qcQ)^52#>ClP`O5scTlpmp8bWr$82wwKJI2<3|f+N-eP*7
zs$3_FRIgk8!ix-X6F!%>|NrsJV%7zf<?-^ZCYp;fT{g#V+Rvj_{OjxLhv%+w7fsO1
z-<)Ble`59A>Ff8^ZT<X8b?1!WPt%@dIywECc<f~n<5W+_=GMT6_5a%w3fFv=we;eW
zI(#~3W}2hm(v#Oryv2`vU%onNYT$kKi%fB%Djt)zB&dE`tNSr$(lNuiAJQKQ`i61;
ztlj0M<~r-xtJGEdTv^Zdgdcrt<dvp!;^a{=_e6^+zVT}pS*)?+c{xeVVXmjk=U2N+
zP8P1RiBrgZ^x{;N+;ZceIg|9J1^R4`*=JM#|JT=x_J6vA|5yBfa-7jJS~cAy{%C9H
z;dRvq<Ymshd~*1<$&yW8EH3A#Nw)3}cl1mBc<<%a{S9;Mmlk?#X7s#No++2IS!Vyf
zooV;Cd3=6u%3E;5@5NV#-+Ee;4Nf&{JABBfnk2UVa;VTc){2ltR=Z{fxZSApwQp0L
zt02DAigl7whtRCpJ9;kzjeOZHE}49>=a?dq^{YE|*6$x)+Z2xlG1;Wr-@g$3G0s^r
z^-8d6^_OKQnmiw-f4RR}V{$HEN6oy;3bW7rH8@ptQ`zO<{09Y!##|2Ri~m>EmzY_7
zx&OyTA&}`S*Z*Vzcg1fd4t|$flHNOLEqjtw@$r1Q^8W|RFCLt|c(Q!CWMyua=LM<K
zuaio9rd(~fJhNl#e?x{NH_ZLg*UHr^c=ucAo@41``*hH9@ma+QZmVCtI8eFkl-ie)
zP@VABxRMT|r2)To*UveZcB1NdU|i1Br#r6vHc(pd_DiB$Q(ODRB@z>ouZTLH$@YDu
zaQ<Zf7K?b@jS9TqH{ay?dS~|Qd8@A6zZ+C@)@^dzZlQBa*;zdHFn(l-e{j9T>g%y8
z?%#zb-m?xcNiMs1R_|oDkFE2ecTC&~>iQ3lM(n*fb*k1vdl|V?^4r<u>YFEuHvfN?
z&MeGn<ym{BpVdGu|3BB2RaMfelPg4nQi>+@nq0n}o>f|L#QQ-&zjW22har!W6U<i_
zP4-)-5)m*t;;x5McI;&xZ{v%e!pm7#v~qd9X3Ke;cu*{iRbva&tSPy#*PabCNmtmp
zk7*n8L(ScW?9MU&&HUECogVet{vrcU%e772Usl}@IJ`pU$?WSPhrSiBuibk+P)N=_
zJaWR_TVG|Q+?Oxj5+S;69{W!F^pF*TJ7i*~cAiuJQOT$mG-a|x*W{yI|6&4#ju?6_
zU&3(zrMTyfc#aq45{^Z(qQ#%M^H2VFZDzi6L_%4`_0+36hVCUB9zT73wNYckOpcCI
z(q7wE++AbpqB#9TNBE^>Nt53TCtUVsF_<v#`iELS<A?PHW@ZvUWCQfQ)fJRXy>wIA
zj^;#49A(>-=P~JQTcfy!wuaS)wtsE)`V665Vm<a&3~k=xU(fd~Xq|0%A+uZf<o*Sf
zjd98RwXYs>{PQ?@<KDf0m41zHjRHCnj(f~7dLDU6LphTzW?oH0{+WNg3)$9J75w^k
z_u|JFJ#Qw;etYoa#S`A&KZCZ`OuVb5Kizt9TYA;YmD}${@I-kmH%RZ8wBp0xIKRg)
z8&W)c*J}LoJ5}FcKI{GCOy~LQr(KAvU$KBuW^vYj9j>=L;tuU5XWCb*{z%?Z&i;g9
zowu5UMgDYg&G|p}e34pzT{wkDmEq^^)USIu8XHqn|E;bK-B1t}`s3=lSGDu`Kk#SW
zQmEgj8S5aU)-9E^hiB)fCDJc@*;{t^7^KW{fBE&~_4=cUn(lqf&t{y@l=*c>@%oAT
zLWj9_$~VYsE&a-I>RZ&Jbe<Q?6PWLAl{3E=QGLd%?kCF($K(YjfBtTkKc85%CED+q
zp6OQ`w!4eszDPv$n;w<CHB0f^1si^Wc02vX{fl3|z2~}Z5%bOK3?ZlPJ+0Vq_5LS*
z_xEn<?TaTjFAn6Di|e)eKIg{E*6Rt8%-f}(nR?hyb6xrV(XM-6<*t?N*Olz^<LkRG
z-}mS6;>}V~H=f<Ts@=}KVOhJ_oqfFv?y@@kynB=5u#?)R6Yu!8?2uPAc<H#%QTcj!
zzz3J3GF9%i?`FKan^-7tclzPE5Bti`d;45^qTF_M(_V{+m{vx{`)7Z@KO+5)`%d#c
z-}x@VLW~jxeT*UR(+=#qs%~;lb0_2Phx6zBs;{musVOW`YQ6QMFT7Ct;IiWF{*QiH
zF$6fwo&0yZ@@}IujJDT~HeR#T`1|?An>Sz1Xq|sv_0EiKj!d;fgFPc7!*}r~xfAYq
zg~wSs9kNw${m^(w`oq7Oi<)0;ZrQoK<=%le%KKzLY&VegSYO;Q&AmI7$GNXhbhgZk
z!qxF7Sh$`=+wBO>_xES`TD&wllz)P#o~kVSl2ywdc(%TO*qNmLBai=BMK^0v;j3j<
z)3mB*^3OQW{y$|k%Re^Hj=dd^6p}j@-7mk_vP!}<W0&+Lvqjm5yWRxz)$INhrI6=g
zzwD#?t>BmsvIUM)`5R;Y`7i!^_+q5<`qz!`c=q2ebda5}eoLafv+(cd``B0;%oKmA
zvwOU(IBhWh^2=%ZQ_t@W*{o47x^bq&xkY+2YgYcSvM^u0<iNbFgTEGL*tLAx>lOIW
z%}S<9Gk8IWh~8|guR>vy)BPv+2Tt3hA+tbVe(lG9OLanGzVBK3|168gwN(44FqYZR
z-LnoIs4rb{N<CYY<5gmN=IK=n93DHp-&b*^j7{jT*X5P78aKqtS~1lyr}@5Tt-mD1
z!dB)Z@O1LFkOQ3SJNPt>GR|8iBr$2uFJXK5e0%q5lQM@#`cX_Qd)GbNvU&-#SdJ>6
zO1!&+-D`$4NAYkq+aHt9DHKV&MLQmr%IGTP$ho;J_NxQix76CN3sf0CY$)oT^e8?0
zUQEjai`0W_lYD+IP-U3VEbxVidzqKSug!ceJT5xn>Pu?2F=qdC3{1Hwsxez@^3;5*
z7ZYRFy|<7$QTp{##0Ku<CfgnnMjtlQ_}nYp+y!S}U#pq$blopi{~h<s6*!{g)hA2n
zTLs@(@m68;&pPF(-Lo^aHY;A8tCFR2<r;_aY6dr@A0B^0n_kOIHd(Bsw7#b}c_rVH
z;2Tf38|d!6s2NsyRVd@-EU$=Jn{VmP;oN$lTqke!#e+SSOLbyGcP-9d95$<1`qI+<
zC(;k?Y>khavBoTB$({sz-$%D&4NY6G8%D3$usHof6aT*dI?Em$uFA3XWZbV>{(W9x
zQDbn#Y8i#ZDMva>`iiF)nI_FjQ(=jp_5HBITFaOG+J@TCHmEzUIl8WF?L<vu&$d1K
z|Fo9dt~WZVcH8PnuHnVB*iIMi8)oaaAHMRc+Km5E&7NINfyW+Zn)4qKy~OG5dh4-U
z$<)*ni#(++?PE=xq~<zhO$Pg-o;-_PNmnm9PRz(MY7)**KmFq%<B`OFR^Lv@ds-a1
z@21#u;)a2%se9!y!NUoiwJ#p_PvU9FoFulVg)^vw!)Sd~oKA9v<3^>BzRW`k&uTw~
zf0}f>%WK)S*^Uklq0<DCw;j3XP``Iog;TL}!d=&ZFB5bt7IbaD#(v7+%B|LYzV>f4
zlkQKtz4Y|;GQ-7>9@;XP>aN(w=33>PJT+5!i|mFkOzD9f{tAk-jXqmsr4}%L+M2Dp
z_27XpdEUanjdH2ktk<ul3cfPxySLPMjkTF&&(+575xP=hEBO-)H*>7Ku-Z*{hxP%Z
z=>lo%?Kd#-t>NJ2`z*vK+OUH+@|lqQ<w?JCzUddFU2!|Z)^fZ`=j4>VYmS9!+onWD
z*WXbt3$8hP_xknY)f&x<!lN2o-!EKR{rm2$)7>8?&SJ7sNMHD>z$hsE5;x1z`&%X3
zjv0JZbb1gKGK+t?t;g4nkE>+V*D~&%l)`q7@$afB#%CW1W!<f@y|b9HQY5hK>CFYd
z?oG{lk+ikv<*%)#Vy~~?kT7)my>xndp`MgaB%i{qn9bS|M;9^Ki6}4IWAV@DJ(qjj
zu8C<ynJ;%w`CPxx<l^=2&lg{;{5E&%m1y0Hc)QI^kHTE$?tQu1aqTf>t#3_}<zB9e
z<kF44xKXdaR&X72@;X`NPSzD{UnVnNvzj)kCR3+3tRnsVlOG!2)gxy~A8zkd2;lsD
z!#OBaZ`E_#&W{e7?uH*FZ_nDb_VkL{2quHa&9=e!%o>&or<{KhcF%Wyu=wZ1_VABf
zcb>`BU;KWfX^sNh=hY_com1QYSKn*&ad(qmp5bz7<#UJW=97;tbaRf`{AP2YT*mvx
z)~XtZUw<3hR;%XjxnN~@=)w~RoxD>vzaM5-TrKwu*?KSh*sl;xp42IqHQDA}yp&mX
zu4msv7tQT$+-=kPx2(>tm@NEQVdmN<$<%L>HeJ^GF5gQI{nNS0!?tX)@K61Ero+rR
zQ!BnN^DH<&cNrV&jSKf~vMKj`O68fi_{j3>`_(_~&i=BtKT2Ztxy?~$7pUFYy;`fc
z=~?Rq^;6{sm)_ktb(>_8*o-ru=M*_P=$0qd`R8$NC|IjAE%UJ2?Tu-BgxqhJ7jT5J
zEL!5-w_>#l`{Q>%_4*3`DK=S#?a;PPz9M{nL(`Gd#<sGGfnDrRjUrBb=Gt;)&EC0<
zCyWn$t)F<~@V+9?Q114q`CB=4n^v4!=*e|jn(I)2)t-`9{tMZflgb<lS{N%jX8x%w
zn7Z7sts>I*xQfi2oju3u4(`1pus7@UOTF5nv$k4WO}DJsCc-=2G0esB&gxmZ=bYzE
z|K*?Z!sK}d|J>87Iyd`B8%&T8K3((j+KNB7P6?Ubn3u6irT-~o!JaK4HlNyUHwAaH
zvk2Z$xZWlo5YGNmi*Kf#OKs`$k_NTxJ8ikjU*1-qf8x8{rb}{ygCAG3?&ji5hlSR*
z??1elFlSEOiI8huJqM4Jzk2a*-ql#<4?2rYURM5>nH&8eW}*c1!j<JkURC8`v%ml4
zTEiQ{Z+y$^|C!mnpLYecY}ER@L{aEo(0X65SNuyGuiRlO_MPL-Q@N=B-pp4_KPP|p
zG`+DZTSs-XZ_mGrMlrT$n^SC#rTCw3fAsd!oF7ZV7hOJ{%d^>HFIQ5LLSfj1bDDQm
zKQC(d`NaJGg_H`}M#&|KB0QIKzVZJ1^^9ePm~)%)f(vhsHVP}Mht7VPJhNl#Wy{=|
zQA=iB^?8-GDr9rznVk8P{;oOtepjW`e3oqI6J`%~u&w`c!!jZF+&3SY)j^Gkw-&A3
zx#}`+%qQipHK_+T<)>aeUbs3!f8NyF0Zg;l6W{I$KizoYL`9@f)|(mZ<?~kB)!f^&
zb8%A5ysTp}rIi;pGi)mVP#AUYz>fnHb{94Ln{apYkzfg%g5DznkDQMr9<2yVj(oN-
zV#dMdN6Rw4xaY(lS#xC1;>p2l+YUe8Atv44RVtLjpTj;et&aQnI>Q|duD7zk#H=dW
z(AC3Rxkb^d=I4XdXy5tyOJ056x-0Jf_YEu0onP%0Z?Z0hDKk!QdaU2xx4V!2-FAEt
z2X{|+#)f0Jd|sJn+7v7~vR!}Lp-jy!7yl(`$ej*&Aa-9vbIKb=`%R&DVw(cpYrYA&
zPN=Va+B^TmsVBQ;o~*AgJ2v5;yP1}j=C-FYj@tK+mV|uDxxME3m08>^q1&f?_L*Y+
zz|X`h^H$`8f1G#groVbu+jJqJI#*9~Y2fpf)Az_NnpFS$+-?<%os&iCm;Dl+yR)q5
z%ZaQ&jW=Ohfm7Zt;@cYYmwn}-Wub4=mvCL5wO`*(_j%{?m@nno`|s~F`t57cwBp1y
zZ^v@gXEEj%wjbCS+MHj0WtHRJTgKU2&oddlTKWB!*fWd0$JTUkT>tsRvheS|%^Gr?
zSGVa{$FADAVO{-dNw;tF4w!XC*nc`TF~udnp}Y7@cd5pc=L>pwJ=cm{<)s|6{!RYM
z^#xnDM(9dk<P$E4?C*cq+_bNM=P8}e_~lxr6VtyWo}Q)T=sCG!Zo;lJhn=sldS>PC
zniHJ+aQTW!dGn9lcz7#F;Ks#FJ;jcdH`f07@4%!HwCq|=@usgX{q?`ib{{K9G{3&=
zmZs8`^jn5W>pZt4r_Sn`y>0)ly}8C(YemHtZ;4J=V|({*>#>NO`g=~nOiAkNubguB
zoT@&hvubCBopGg`THy6$O*Rja6)mMVymz{Hgs1k)B>k8rHrcXEas6b!&PS(BCoMO~
zm}1u0)h7JwoNC;KrEGy$&S^>rlydND-?!MAr{C%J^4H5R%&HgX1al{tUVimlq3_(1
z-Pb0q{QACJYwo$0?QEJE_Gi22Fl7bYIgz>8JTUIV8na-(Y?iG@a^_~Q=xeyCA|Jat
zX8M#k%b;fyjV}9o{+U#z+mt-%M*obuv&yMe@m8sRo7e7FbnTz{_WJ8Ru~8o-?o0P_
zUQU_hD9a-*YQT0h%d;y((dYE)_M9o-`nZZ@pFGj>w!hHgx;W#=wWl}YOfm%L#Q2H-
zuyZ}dlbZeY_9}b#Pdl_W^K?}PzuJ*(y!_UQpKmUm$__q}eRgKbyj?Y)&TV`4GW>Py
z$AEjMdxb8rvYt};a_!`^b#5O&Yh*rH)_UZ8vyN$<nV-b<t<U}lmX&`@zG${_`KGkF
zhF8x={7&-pEvt?3KBe)uBrPO$#`{8b-`B_0&DO739G~+#eaqT4@~bs{R^Qk;`2y4b
zP}z(?w>O(i-pVX`{h8@%v-byMU*meggqDUVwV>+s@6%)dZAhOiSuWe+C^%*M`<SeP
zV`2*2wVxMheD5^SKe7MAEzUiP%`UBbterajX1K~{K3j8=MWn==NrwO0huTkyp6i7>
znWB@KJD>B^A1{*+T_R?mqj=%S=Sj{Ir{fHM?U=ZJ!3RDo#+usaZRP$J*AwJ-I&>w^
zk8u7u$?rqh<_Yg>u5z5+esjrnlh5jo=hFLhWc~J(eLIyp`)0y)tIn^lFZHfo_IZAL
z_>IiXiEEdiIPuRSZ&Az6<>zv1dlKr*CFY+y=yJ&Rk=XJ3z1LUT^zi8|uNIBBKQvXp
zwB~-A<oz|<%#K89{-0VFu|@3d#{RzCsoPc72^H;J@;QCp_9NwdpG<@noe1Xp|L6Pk
z{a>>G*2FyK_ndh@HRI;ouU}q2PPZ+Ln!LMm_LAjZzt37-pZNZY)zy_-_k8eKZtCf`
zKWn*7=5p7^b6K2zpSe1<N_XqI;){ASM1Q)jG|`?~bYgzMQk(8IC;XSnFRQry_IV)x
zT8Vw#VHt5rdGG&AEWLZLzx3H(=UVx{0u0`pIonr=?7DV$D*K!Ao1f#??wrPSEb{N$
z@4wf7W?_GHp!NB#>;IQ;Jtg%$Thl13)Bnvy@wst_i)@p>%s-L6M&M=Qy2UDC(<^^W
zUQwZFQ2r<0_i!@D=?nkA&kuTTAH?=3nKLHbUwFld4h{Xu0$O}^n(>q67hNxj*jBbq
zE@X||_ejk<!W$}us@3~yCgg-Lr8aHe)!4Ag^B`Z|<`rCfg_e2Wi?1=U_3XaxamQ5c
z?2ZSEPsg!rUZl0)t<;1?ov$mh^IpH5{%z4F&+z*j1L6+7F}<H*Zt(v6<^1c)&r+k`
zP5Y61PW4{a@#eU{skx<=9NFt8-IlETJ)KR0|HaaMhKs*D#&Ndw>^J|~;=ALwfyl3}
zqetu)sBM;+bV;``=GUcTrpE6ceY5iX%w1GiRpHfSV3MyUU>^Htx!$*_4A&>`FqvC3
zBUv?Y={AuHyLst{1h!0Bk#lTUTg@S+bKw=$#ZEt~RQDgWTwFZs!(5^8)lDLw879k3
zda1=;^tegz6%(%%x8uXutc>F42i?Us>i$TsTb=0lQYn3ANyolt>olexDGN_@c-Ip*
zjVooljNN9ILk-)r*nKJmt4hCjy>yBU)zVf<3%y?XL5$`3!jGa3udJqe#eQ#-e%(^G
zdR}QuHRpr4TIZMZULU{xx~e2+t=xvEM$dCH?KZGqDD<m!e|9Ewg6}hrZ85^0Z!^!&
znDdbRWNV!6<x7{|U%lRO^_G^z9GPQH>py+8$yIRgm!50>W!rPf4K~*e-%P(G(_^S9
z61w(g`U|1k;w#s-HGf&WPi|iPn|PV2?UxPfFR)Iz+4?P@{+7M8?5u#^ye(}l>>bU!
zwqJPD(8H4Ws72d2sV^ipb^FYNr5-EI{xRRI*?eDr_7;gK#r=HMv!}X-%Kv`&^s~d0
zh>nHX8%vfk3*4W1Rd$o;^ElVl*Zo8G?5<||&v|H~wehJd*LtUf&)+ihbIH85E7xhU
z#|bafo3~Tu1iPR6UA^+Xuh%%;Z`{-9#a(wg{mjLO+f!~I&o@mxzTW7genwn}wa=CB
z3q3-tvso10K0P`?d%eQGFK#iB^E{0$#dZet9XS8(+c(SS@oz+LA34<b_*r^I=jvMZ
zqMxBp4Hp!AH1_Zo;$aNCx>aDhxci~_1E;$V?t1ZQ)zcJBk2}3v^R_(DU#LI*mHW;#
z&bUbmNACZ9Tw><@|Iv))H)3X8`|MDb)O9^w;{7h}2K7DX{=B;vY|deLsp40y($fWx
zT$L6ZTfSW9q+MNEzJE2Ni2ItA*MEt<p2RjsJVZ@#)e`Hwkx9>%lrY%k$N2L|+<RMe
z^X_}o&kLs1|DD=!ODW;_r73gRXIrlOA8kLav_OQz_h87TQ~}}UpKCX#nI>&JrEi$A
zdac(sJJ~bK7V}+NR$D6GZ&7z=V`+Lqc%1y~BE#y#Gs?X*&DJU8N^ZP<D!hM=A@jG!
z%DYLYo729zuAQbWzASN<$mCeo;`N7>+`fJaeB5#RYstpdyH5u1pMJ6J!CRjHU-lM0
zD*GF{!td8L`PQEbR^it=v_jV1HGjLSb85QS)|<N``4i7tSTdDv-4K(gZnu^H>8@!Z
z-{P!N)8$t@5NBH#^N;JyMx_~*OK-}Z@hrA``G~)&T<%$sl3+_-^7WYvcd9d=p0U0E
zb^6sZ$$#>hg?fydc02NR+&`DG?d2^CM=jlj@k0LG4jZjYjBFM-u`R#mvm;kg-ul@M
zn@9GhHFLI!?`qL}S}pDBfAX8`mZJT+{>qCoZ+h-g5ourVx@w)^_v!Lx-d7iTsueIl
zG4noq{obSLmvSO?ccjNZ3pn*!>*4NHr!$jYt*BL#_<4(?>g?4Me2GsdUOBdU(r$zD
z-O|$09}?34X>UK9obUBZ^MCF2g0~Z%nfY@(+UzECIw;$*IGtI|rs|FxlkEE2e))0B
z&Xj(hADy>){k7aw)74XF#d2LYJvaZxdI$fC^{?2<4O>j}%G{H7E9N}dP$J#X_WGcG
z_y3O%E@tf6az|>?v|IVS0n6EP3XOj~&OUgp?C-)?o6?rZM15)ecGB`hZeH{KiVd^h
zFV4?=AEmwReAbs+{YiTdCjGXWcR^v-!|fZpv~H~A>*niH>RxvvvpDL8uv}PBoq50g
zr{;tcbB=jG+^}kMVd!HWHzvC!g2_3upKhO#pEl7}+^YP?*ShPHGkyrQz7}ZBF4ikO
z*=+mgnyEvYti`XJi<28JE^a+$*44Ata?h2u3@xQU`lsESDeSQP^V{B8XYFR5RP%o&
zdOh=)m(7ai<EhSPa-;H}l<id9{$a0-==?KE+K-RrZcdx&n;hf)qwet(KI>&~D(Ys7
z9PEAh?vJbbr(fONcQ?%Yb8NrY=DlwJm|9uI5)bh|Z?*gP^Y*6x)K>G*hsLWPCKj!K
zaC)hZLb0cd)O)5=jVtdM$4$=WD$|~&`sPlfHkY$k<*W1Vvl6u~M%_(RP>j4<c#r*=
ziff^TO~g~zT{{|*wiMV}dpT7p$N%vVp7l_X$HL*SSh<<yqh(f2>jE-&X-!*wsB6l<
z5AQ1ezj%`J|Lu$R#E{8%(gl7APWtm_@#N;m-`kb{e|WLx=eP2i+!{(d_1mZFxCP#e
z{BnC!#!7!Lt*rqvrRl3*6n*w%oYEB)vQDzd_i)DT_qhkP1bx3A;hrxq9pJUO@zIUa
zqGpSEO6ez_R~-H@MRtP9mPpR%1~v)t!=4kwZT+_to{O7f#CGa<##fiX!-qL1-JZ8C
zXI`?^D`(e6_3CGDesEt*nf>~3Y|uetj&z|tEyqJoo%ZFo%G{+M6RMx~PbK!@1cqGU
zfMA=Yu8)s~ip1Sw-oA@#aZZjvB=gtnuX^{&W^6pPSTo`X$BntNKR!)qx$r{4D1Q08
zbNBzn-dtPlug#~*y8DA&L7kz0rl5nYq_CN;Z0oD4n{&=6&p2MAaXqwU+1ivFJNnx;
z2<+ujlg|*^r5LU=Z?jMLk#n<(O{Gpr?5>#O{z0TBqwD5`<*uSpAum`Z?>2aficOz>
zMEdZJNaL4NTnuJEbve8<x$Dl%gEdMI*$;{o?^1AG<>>wMY$T7Loj^iLZIn;jsy9a6
zc1>H94I8Eh-T4u6=HsHTpH$@8Kh9)&_Mn!Rsbrn~iez2uvcSbJ7*07P9=epiMeRZF
zg-Xp=HVc-$xL)!4KLhIW03O!V#Fv5$430hw47v;q47sVr`FTmDnK>!?$kX~MsRgNd
zDXDqMm1&7NIZ27h*~Orvgk#<p-8K{Y|8BX%TmB{QMEoW#`|cQAx^B8jxc_7|<HFmo
zE#!Dzoy@Ykt_UuX?bYWmSzqX1w)=;(jzd6DOnmiKpWsdwvF@Yq^8Yh@;H>`s?Wn!n
zUM-_I&VMgVo`*)S;ktL`#`W1IyC3z>Q|s^dyYabdb8gq^)zfTi|9m;A{NuT#_3lS+
zOvOu&#(j{EyC!{)WBJSae|NY4YnmITtN$={^UB#<bYH!Ck#Y4(_O^&MyS8QjNIKYM
zx+gm_DzsF4Hpg8x%>~7qGcEo^>(@Vw)b>gKw=nn8npl%R^J6c5s41+SZ8m*ZbW+sX
z(^VgIo=e9atl8Ye{r~PJ?NfJb_T*mbt^6olQy=^M&YtMUe@-X8+&sC<HL|1Zl*?_A
ztEzSSVYfARGfEyjA{M##-V%eCrBS)OYpax>=XmU$XutpQ-|ABvGQS+MVZQb4x4FEL
zUbX+t@1?&ty<2r>pUIOBpXn<fv?b|G|8iwtjWVlUs(xkH>o2zZ=gMuoD}QPBhN7su
zOHwD+-;F8D4lp*fw7QhM?KUq*=hCLRvZC5$)8_pB^KJIg&-wc+|J{B0y?*}5hiqL5
z5^Bv8+mbI&o}#@{C23Xt-6g&i9RAnum7ewue!MvUwNd-SzP?RHqD>zEQlqAwHrXw<
z>S%|7dX|@EeB&?i(2IIv8y`H?QiwQow#T(4NF*a>>4JXa3HP-xY%dPj+wGwIV8g!H
zH71L1L}f-r&C`FqYfnOPz^pFzDyIFJ;oG>^uJF6Q`HAbqlZH#r#Y-3oe|w?*GxgeK
zVOa%N8_zdas&}3{St9(qBI$S26dBbS!JIqK=G1Q&t$bK^B8y?d7T>+ko^8Ax;nZ?H
z=wRFBo^W&5;P4e6;*vidd)rjOT%q>r)3NyqZ=Y-{_S})pV{(T*xhQG@ljZ3y@0H<2
zTZCtv-}_5bxh1T8;_}FgXRe!unZJ4W*nRr7fV+)1ezxAu2sM}7eydN5Z|woU*5i?(
z?=xAaENMO1l;K_M!_vV0XIhQ1^bNnsVhxUpF+Gdru5bU##Ch!c?6TEu)$)7$BNSCi
zclO!ztNpuhar(rE+^M3qPyfyNZhyS8_@ZUsy!fRrP9I3#sK5M;_J`9e-aptHAaq)Z
zecHqosqvnwiRq@o((@V*cYmwo`rNrCxhCH5?MYSPHO%L3X-{d)6xf)(Z|~aKG8Tbr
zn1mNS&78-xG-+D*iqp$=&T8#3oAgTd-|xuJg5hfK%~B^WeVdT@W{2l4M=!&FA0FgP
z6i*6X7M)qEka+v$pO38P4%sEhh)i-VjJkTYEVevJNcQVGmk-<0gLVpUixRuK>RZFF
zcCLMMgVh%bSTkHze<QlzXR~g=j;6}AQr6Q9r<0Bf`70f)S`er<_sieL%A-tPCslP_
z&nqrkk?~rfD)TCTiG1Ll<jY?pUcK4q{eDNdjN;Tv-iPXYZaKY~Hg&E>o<*d~*}r#s
zA18gSaI(~|OqJXGbB=9Ur0qhb?yyo>-<hqmiznEg5fY7Ez_&!{!kzE8wON)o?Bd;U
z-*w}LJGSrU@3?dOg1(>z>pq6vJ<7swHr!scch&A`jp`bgQco^zWjKBD@ssZJlaGHm
zd$_JYw?c1f{i!YbjO#?r6BvW9cYi24@$T}?g<m)%4Hx+;cDzg1+M0N`b6V_DbB483
zTdsc-6WQ}L+fmWurrF1G0oQ3CCv5NB`XDho^JwjS$;lr>-xoX#KaioQ#H!5ut1P+A
znwjBBneijL<@~u{&5gSE#0lIvW6*oWIPizT=S3ev!&A9`F?qaNzL2lz6wAe&FSUuS
z31N39u(`gv@7Y)M<l=(2kAyZ{w(Gmf^zz|~xi`!<FMO)YAj2qIb-P(-y-<V1rLJ6m
z?|_?%idJez?#I-q&#+kZ+BdpoX`8l4+E1;8H_l&^(XpTJBwf)j$F%I+XS)!gmItZ|
z*{v70t#n;@OwHrYHJvBfPrYnrI@wM45psH?uIJ1w>vZY}@5Rdxc~ut}`KPd3tXYs5
z8B;vD)t~cV>D+SFHJ16CpD3sXY1gsxu{|hQ%CPCtcJ5hAtMA2W%H&R1)1?*vfxp2_
zfp6CXFXq1@N-HK`;9eAS;^X7a)l&@K9+fItz2et~re{LGt}-oUKX&iXFOAmDzm88F
zYBNvFXTHT}6LCXK`P=30vne4fydTZkP&qMYm)W+KWoI^uCmCnx+*9Vv>0|uJ|6=`W
z@21uJcdC93uv+FJ=IL&5t+T%>OX6n4n?=GVzG@2-v~Rd4-Me7S8(t7{Y5(E|-zzWF
zs?J^6_-Fco`ob@()~(-orKMxStsPURaEXKkXmEx`RjoR`>&)Xs3H!ze=_fafIAnd>
z_lt4Cs<@jE?|98im{h7>KQXXx{<OX`oD*hE{XhM4(>w`2J|p8*Ze_>n9KKnvnbmjn
zgK*ak)@e&OOJ>jR^PkZ$WBZwn791zzFFLVJe75uQeeLOUznAuHiZILEJXgC(@T1lz
z#)QUmOAh!w_Smj;t1<LhYrN9T&Aa>iLN%fmznpxW=Zm@W#Cuu~MZza&J`Jp>47+%L
z!#h=RjSVI<WPT){eZPlY-j<j1T!F&=7f!#Fo=e6ad|tX$OYflJ>ML3S-;^K7aJ9Z?
zyu@-w=)?)r@{KFw8^j#9nMa-XvC-K&!{>$H;YTys=kp!-9mjW|Y47`7Cdn@T+jV#E
zeC=C!;RxRXp98;4&P!^U-_SkGIALbt_B)RcI$gRkyQ+2WoyLb>`;9_Bd<pu=G^1nj
zf?D3{{@u$LId*UFJy!6Q)$#P+4f@SF-k%w2-dY~MXR&ssB-;U&Ki6hwY?|zG^P@$V
z=BeeZY2p*KQ;uy?znF4oyFlgqolX0iY*J1t%D?1%%4r>|$se5C=+z}Xd!4u96QiA;
zoGMqU5_<!eIf#7Uu}Y9(`z-YrA3aRNrM+9`=_M{QpE_IL$2xM!B<3uJom;ZLo>5%#
zR%FS-+waYM3cXHr>Q0DO=M#%7Tob>hX6kCj8B(EVT4UC?RBm6jW?|H-P09s@k=xA-
zi;Oak_g+@|8FBUNzMtE#z1=7yWA7cYBikxBB6zbvO2m|`iOHV6en!qWIXYDrR7@|@
z-^AkeQ*4>zQK?6zkEU45Z*y=Exuq|p(dSe7jXhSqT&v&&zs_ggC&89iH?&QUp7S^$
zcTH5ovdps&++<&^lN9+~d&cm`3sHOjk897*xv-ms_5AWI&Yr4Mvfo8-?Aj76VJCS>
zdYkuM#tUsxca&U=wQk*8^kNG8<+$q${(VU1OxdPZ@@m72lTX6xlUkgLzjmI!r>NE-
zufMEd+vk*^wbB8{-!Rz<)&+ccws_5>2}>s(;7$ua*rT{%^Ss%2zs5XR#va8l^s@9x
z-V2iy>(%-hvCOJ3Ob>Mbuk)5)dMoM7MDeqH@uDW)N7*}^%8Irex}|xhvY{-GL(|o1
z$HuFPYxLhsrR-SMeX;3+yxXcOv9P8We=F>6v@eXDB%Cl=R_0~F^Sud65?3yBe!23e
zx6Ui+l?#`5U66NJpnN2x`0}n*vrD7&HswYg%}Sbaqg;2jh5M}E5{J&teKLL5ibtQX
z7M2{hcRMchUFC&l=Ru`A_mlpWH~m#v7-uG+eC*=+`+K-gmAXtRx*fb~?wNT{4JGUu
z3r+T%cl3x@_^H3$)2wbq%FW%!y!Pqc<c{6!et%trkcyq^hP98`oP3Y3(0X=sgV%An
zEt4;N<hu5|dQ<R`O?GZdB3oBFE;&8*c<l1rGFHaQrDY0F1RhT`2$RsLFPbH=uz9jq
zwBNSH@@o|SF&r&ORS`<HW4-q4-`?kQCx7-xDNak2s$eZs$(mU#aN)~`b6Z#Nekh(b
z`R0;Dp^Ni4|1aoDe72w|D$C=Np3E#iwhQIUOl!AJv7c$G?z*k+5o2kqXv2o}hbQoc
zGQ2L9bDha4q1QO;-iBL(cUCfmWwn3SSQPv*Sma8g_3;hH$IkCf(Caz-L$Z|fjsLq!
z*3Xj9#Gdu)I#`#M?tc4VzLa$QecRM~6Y69anf)%CRO4!|;vKB#d0Qp&K*0qEv1*%w
z3HHldiX3=NCT{pUvwsU)?<%2PocEN<#2!WEwk(@);KS@i?^v>TX|2&yzvOkmZ)tBr
z(fM7xi&EEZc8YZ}P}u*>U}n-=)ud;_tDet3A1Athd(ivWMpCa=q*|yvc&T2HaY5OW
z+3)>=?YBkvIlq2PcH*&2a9F$|u$RkW)1z58n3XQAi_lVOEi|xNk&(T5#lE7|tLHa2
z-)>Yk`Q5Z)+s$1;YL;_*l}oSb{ft=Qplx?OIo9XqUH4t>&C9#lmR~={R+!`c*j3TM
z!h3bk@m-30Sp>X7bJG4V_B{OFr23Oa^3!nk_iT=vtUm2HouKr@H*&!`pA(iZ7Q0&+
zO=ypl<(RB`k=cyPo%u!VQPZWuEZ<fxaB{yQUladg-_)8*{I&TTvOZ_O;<j5Q5oK}1
zpvBPUgxdVG<=2vId#%@=XbPAe;%XP&_N|Chv@TR@)%(@%6U0M8%9VGyZ+#xpH$95=
zntfH^W4Fz()@M&Heflonxnt($r`Oj1cJG_&b$7<*jJ=wRn$LyotE)aG^Q2c!{rtRl
zcFvl~TkBT%PRrwyeyzLZ&(!9-B~MGEWX<mMZ+g34W`oYO?XRyUGVjxxX1}-2Qs%?W
z<vbD2&%ZV@)iUSC@0aEKG5teBSfcYkx!KuQzpO7f+cxiFzR-JnS2^DE(=+G&TV?it
zD)Z);wnNe1w@qxS%?_>TPkOdn_pTw!mvmoqhN?G0ueIdXu>YCAUf}@y^QO`=ol3TM
zSB~y_u;AFN297_rInnYPCS41*^gg%C_vFL>=MPR-xHD&d{~hVsR!=1a94z{FNW6DS
z;yFF3y8mg5t>+sy&OCps*~Lq4EHYa=r|CH3?!wxIF82cs4DWrAct2(C?SM2ViJDnE
ztS!zhTk9wLRIc}4*yrzYvi;=_RhH+99-NUckX=-1Xy949@6gPf&(qSLO<5NFeA4dj
zif)IaHWfYG-oZQ0i&*42O?EY3du`R8`d96Fda~PAEq?t|XX9$)vWjQn`d6FR1k5*`
zQMhLA>boEBvI`Z8iaqR(7ZP$>uzOwcmVo!`@^doWUg>P?m}9|b-MX!1?rHmawua=5
z@9Yn|b_N7q%k-Y)&v1Rm3=dz80Nx2kYk6h`mj@S5<ucbV(J+?ZX>ixr{*~y*1sm1=
zC{!yv+Qm@I5Wg_8c-M>c8|QeW&hhZw@=<7)x0)FDEnV74;p+TjTUw*;OlOr`{Nc>k
z_b$^qLNA(?aR+`~CaU}A!p?-7ja65D@7#aZw|HKHN#VDZE7X$aJN9PVzf=_5b#R$}
z+k`EJH|kCWOuy>qaroM8-kpb^&vj@0*OAjvkR!Z(HFst4GhTiLi+LfxydAF}a=v8i
zVqj&!Atg{Hk)ZzjW!wAPEyoH%KEIavQ+8E+$6>F|y2X#aU77SiS2O8yHBT(-2}K>t
z|6+6ZIe5JfnqjQ6@OCo8>WUMdYVWp($Gku8vB5y3)WVI!YP!>7k2tp3Z*HG`c}2GN
zr0K$|#Y*nx3sldF81Ayas>uCsJFDD_n|WP6aWAAZ9&$F{2#Ea_oNl$r=k9?E>F&v`
ztNu81^?XoyvHh>;JMKphqq{FnzH`2nef>t(zOECJ59Up_dwsd$y59+%H-*O*7_qPU
z692>~B4T#)ltZ)GpJ^Np2$A^l_;p?5?_hrRdwCK*j~C1?UwH4Hppm-9a`pqiz8o}s
zetX%07nA=sm9zA(lysS#JV#SPBwvapYVod!*7oJ4s-fF7YPTxOEZ8I|C|f4}jg>R3
zRa8H0-})!_bb2o+rE8_14VyP%Gw-r4&&p31<_J#-S?VeI=vrRN;+=ceW_CJ69Gzz&
z>18-|yL#Z>3f3O;3q55Y&MaSTR5baBrDSitE~5tTt=HF|Pkb0SPv-s7#-v{E60H*(
zSBrgrzf!BnqQ+*&|3?M3D-O>5b^F}j!@}Q=y=nP%+mT`Ut0RjwcWgbd@rBo)V6{&c
zTNwVmygzq?38$#2UH8Lj=NB?8yKQ$zc1xTKf3bM4$DDvEQ@_5NY<Bg#!^OssbGpJS
zlHZpflkQr!HE%KZ#yhMMCoEsjV(V~TGUu_XyR6ljc)s@&9;+7|=d<5r@NAV`)~Ykk
zJ*+KXLjJvNxE&Jl;6?9j-gj>&EWY{9P|!QSV42Hwdya`8Iww6`)@r9))crtHxAain
z)4mm3<W<=htU14Xg}t$%$n+y|yT!indkFlIwN!d}xM+X%qx-WaJ>n0$<$q&$$lsd{
zC7ipK_BrtMKT&w9=<z<{3-hEk=+{l%;p5J-oX@~ec#erd75A7C()f{HLFJphuZyJJ
zHyQkh_rJJIX&;-7fZL|pXNMxr&6<=kJK6Kfq$xErCX4T~NTu*InuzgEc=Yf%`>pFY
z)Nk*(qWbz$FPrN5d4H1x%~(sqQ}1rtWVHFyClkxc|G(_#@6~iax<_xGY+v`!Rdc2s
zEi%6u|77v%M>ow6Klh)fwtm&oyPNjxiBi39Q~&Yo=KOi}pOq~4YE9bi8hdtfVPUY(
z>Z3eb>Z_IJTZ;aB|DXF+&1c<fKl`5)?9*EIp=jrdX+Kx3dFDUQXWCVrlbcRfZH*I)
zoHoU{V!PL;pL?PLC;mDq{B_M5HqY8{{z+Gj<VD4QzK9By=PTWMQz`!1(M$C)XYx;_
znjV+?wchROCW+^(@6_Ari5-=BmK-8hdg0WTU0>#ha=%;i{YO%)-|@uRn_Vq+r#WW6
zc)ntmzZdi0vYGl{y#LsF)HUwUUtK8pg>!mRRNRZ_zqZ%ix86|v!7zT>&!bx!R@(ds
z>A9x;r!eTi;mpX(OZY1?<Jal)+x2#}R;bkd5Ai)7@%hE0_@f!76_ZSA>KZmCO=o0!
z5Mrqx7aQ78*t}$oafJR0fj^sfNvT}0T5vzsc*!GSy}w$gU-O*io3wh*vR#p}2ku-j
zXNWqtIW_d)>+eT{OmANQyy%*z|7pR$e|GM;{9gR@tD>3beHxqnS0`DXU;h5*Pld|%
z;s)8d@m23lI6AGQ&Sd|6<2Pm2fg>GE7XH6-IjvK7Mu>g*uC(5FW%$*asfP=uEidnW
zRAARATbSX!uVqs6ljpZ<Do?%-3&@%i`?xvke^f|m+kW#cChPBon_izCZm-SJon)yU
zzB*}*{F&9YKfbqT^6@`6Q2y~`34@H>e#b=(5<xosjQPvVzm(bTU*s;iWqaH?^DmA(
zz6<U?{KNL4gok&%;LPmLPedQyIQc6nMlU}6^P?R<?614-y>;P4wnL@Eqo)dztMl6@
zmtTF=o@Fbazv7qkMCGeh;dl7Hlt&y(H9VErb!PGO)30{T;CIQKx0m-oW%x%PzKn;A
zzwbZ${AW|dr`@~^udWI`llgX;eL+XsHlErQ$6jYXT<~*G+s|6>^NFi3?a#_q&!6eG
zgFjKl(bTs19{0}QIr*$_=RDucG~v;vA4@WK)oGpzzfv&wNomoSPxIp}eM3I3{g>x0
zXgTNLwTnkPXY6fdU)6APOZns)tD}ciH<j04SYHtta@B+1^rEU4n*?Ww>l!s%Th=R2
z@{hl^444oYc>Paw@J`hS`8%&j->3~2|5;Qrm2uf>ulLt3ugvv$Gv}bN@9%>D=>;qL
z*D>nf(cAZ@;K#GlvR(Cm9v{s7_E}$@=kwKzx3~X(A9tAf>u;0CO~3Q&ZvOwO^2@;5
z@@{?cgS}Nhv%md%(EgV{-|uYq;qv$PbG%Npzu)j|_M5K{H&)J({quaaxx62rz1)HA
z&EfKX-{bdLZur}6`}_I7jekEr`|$MRzmMy`9gKc)D6#Cz!w|D~e?x4~_T8H=C%4!7
zBL98)J=L`z-d%louv4Rx|L^^q{O$R7oPHemXJ>Oz?zZE;bNA%-{$o(JlaraB(EaS}
z!QK7mzHet=ZZEsHOm42sp8NLq>}@wa;Jbft%3iwzl{OWu`U?*KV)fskE8(}Jj?LDJ
zL+)R}muF`$>fb!MKL5VVzTY=}KJK2sIiAnI-stGhlm6~WXOb%Yzt{6HoKDaGcK`2>
z#Q*Nm-|zm@T(|$<&woE2Jb54?x97fiuAKZIdHIArWqE#ew~o(mU?}@|b@O(U)_=SH
z&6+DyYf+~v=J)>}hj7iG#chRLcPpPBYGrEQv1Hq;mj^p<xE(MQsfhcmpWyc@Y3jw!
zsq3{|c^f{TesE)t=CltQyLB5U&J<m}IxDAa{k;v{shsHrmB9kCHS-mFA1j^s$I<uR
z_RkaXqcyh1Epq#^+jgz`y8TzyUajT7u2;qOef^%Ac#6UP-w}b^FGWu96z+K?7$B~q
zePMa<XO0!3MQhs{m)B45G))jIKXA`~(&dLQ*T3iA6mBoO=hx2<cl&pns9z~(n=Sgw
z#&FA5U(O@C^X)deo)s}X+#I`epX;LVZX@R<_Z`lC-OqN<`=4%i75i&}{}m!}0#UU(
zmpt-5E&X+D?!<&zvCkY~wUK??XWecs3hb&4T06ZUf<d^yL2zRQ-#n*uvFr%-D*roi
zycU7ik6J{Ap46P87j{RG&GG2#6#lgThh>(1^Eu7q{KSP_XE#s1PQzW7wr9MBcm8}(
z{g>MDEO6_ts^B<><qdCh(;hxN{4{>;>rm5ViS~j$by6;IN31tW{$P}!d~}95YlX{$
zwsX6EE^{4;YCCA_;TBw@{`_sm-dlB#ZvDDrv+}OmO6E5OPEldsQ?|zRPY9RQj<HVX
z5te--?i*aN#YXX&aR%$gt@p0<++vq^bYMGSzvj7e)^kyV_!BMj=DsvzzUk8+dU^|U
zeg53}+CBz4H?(8on)+*-eXn|-eJrA&WW2lG|Cj%~o^H=cnta;3AHIupy4RflI_dhE
z6E7z`7r7;^BG>j{V!=KCd4HL`HgnAKKffW_=Vyb`v{Fm<E^B#Fp6N>;|63QCtzoSD
z?9Zn8HCw0exl#I|L3NGF-o0ASr1m!|Jv*IRH~kDltwY5=%}Fu~W7e&klr?FO2X9Lf
z*N5j<wO$;*`MEgX<Zte6*^L6+zR9I|!B-DeR(@*PCbQw}=E!|}l3$p7Rk$&Iwa)9S
zM@yIvt%%|fku9s7ws-5o<%_B#@-<c;+;w{X$0n{B8ms5+IGSB5=VV!E)f8iR^7`eg
zJ7m^Y{aF6~+N`JZH@$wO*X-KRb$<SggU=opE^}D*aaDZQiY*eRNw>2bs@%@|wg3LS
zyV&Jc)~vgZo_~av^L6;FFuD0vP~etf5X*V_B+Yf*bB}v&^;x%&`@rcHbvzFZ=3TYr
z7iDN&x3S0AKK<3{pLrKHrp7h>ked9fdUD9Z=6P*T;%a|p{haXRa_YqX_Y#W}ttS7@
zu9)*}uGoU>##e%SjNcib`F?X}ypra|!(M_{cfV|(Tk<{a<YrmT<)>b4%~*1=ZhPBL
zrlV)&v?SZ7pJw`2@$2<L&s)o<B_<ydxoEv$_TDdd18==|PfR}eHrlsQO?+jB7Hi=S
zy-OQ-7YV%c`NF~7nElH9jC=6vfc4>S#{{#L6@G=;<Y!&WifdzdT@;n_de@7kVNd)M
z9&)pq2fmS1)O##5hxz5_hxLC-f7ndDt!($+H(95hOUnLzsr0&Qez}%Lq1qCM<M;hu
zW0-Sj_X&n6`${{!G}KIP^QIo^7oAfO`0v}yZl*_9=2Wz9OU=CHX}mzO%^<K=t-Q;L
zkypyVa#4QCk5~~eLwD(=J6xX1UFuMp&;MrW;kj4c_>xY{blZK|$v)kAUeml+GG9(h
zXU_4MA3OiBMD@Qvyk{7N7$42c{IL4Dy_~@7CR>B&cPnh811uZmTJk>B>s#z#|C85u
zcUIcs-8J{R=iW@}@VI^U##P1#^1dH~&wNp0mEw7Hc+ZZx(>@=vfBEI3%$lCH^Ovl;
zFMhRTP52`DIYD#Jh5fm6BekJ(ALl*&hE9irh59km)3aEeQs(yyt`xRn&buNhuxPeS
z$fwdzx(|XsEpMrRk@oPrUXO&ryMzA|gH;#((z>?WUbUXnD_HS}(AL1C57@av?2pLg
zpOq;IZkVx~>7NPHg>#l+>#zDO-+wmPI7;v3hNo4&r*0+BnX|6e*Vk#ME%WTMze%(1
zr>+*NcoS+D{pN4O^Yzx1uRa}dXqowV@3E{oiYL-<a;?v5NJ=UF8Sikl?ZD)9>7Q>&
z_Mc{aD9n0Xda}%JxjO}&DLEHkA9k7X{al{1NSooV!}|k$C%kc*`p|pMj0+)7`o#{O
zmv`E0a{Rw=IPYdbe6p_X(W+EIS>JZ&B{}n2pUu4N|8-^2W&XIr``>qbR-ENleXE1p
zf8Fz|Z*68z+V<2hbH)T8;RLa!ogTehj<FBw+t!C4eEr+A%D%Rt%krMhgYGF|#a*j2
z_13j3bf;ggsoQx@zj1<{_q)sWPt7ZTeR$A#(E86s<pVZ`i<kUM)4pW&!@2jIv&ET5
z!59C0ivM|Oc4LTX+p2|Astz%&w20`xe)-Xk8PDdw*tVzLE7Vo{k_l^HNfXDkE8R&U
zey0R;B4W3=Syrd|s86e4HxIehp}j!-hr9{%4EI|a55%r%I6S`c^mVA|;g>C*yS=Au
z+L6$@)av`ICEs7=*2Qwvd1OalC}KJ{F(s^y>DHZgyC*%jrhAz)KeG6q`TvQ@PR-&s
z$2T2P{4g_ejhnNr)4LCLvFsms`Qwx>m>&Olke~fH`};WAIR~`%R(v`VBbh#J=f=|&
z=LHg7uI4V&zZWDHdHEtw+o2tgZ62=n-u1maUT1-k!X&%DXT2TF6%K!%+PJvolaJx@
zUmNc?7TL{OcbrwZscPBA(ErD*T|dt?`Swiw{)SicKg&%0_AGqsDYX^RrxNn7GsP`!
z`FLhEU(GAtH9=*pO?o{3_Sec=ewpW6{5|b=ggNq}&*{LONv%b0MX_w$hUsF7>FLj}
zXYsmwY-P)7RGt&M@XRc=kap46QQo^^&Ku9TB{?bm$jODORqd-&w!|$;WlvZ&>y6aw
zz{O6=g&X5kpK9&YT^=0UcR+vUWHsC1PiH^uY^V)lSmpOR%Y0|lTCuP1=KrsWT(|C;
zc)_8w|9nI_?*Du}|MV_4u~+Bo|9|^gERnEdVs+!smh7ucyREL+yH-vPIDcqKc6e6#
zVW(G8hb|sov6|z_o{9Aw+Lc;TDV~=yRu=BO6W~;QX48@daudC(KEIfiC2Xl25T%(M
zdpPR)GsdT1Ppw@4W=C7brH@5Xz3c8Doc`=p)4r;^7Mfw{y(PPsIy;n3ci1?guYa-f
zm9pf+!d9B`duz|Ge`Rr|Lu_pvb1uudGYdo?pAL{%EvSB6Ty%%S-hU3dtEN=2-!tNy
zBrsul=^1yA?k`+gzAGMlS}7neUClM?d!M1my||8S<Iho@FV>X>ai7vWcj0gIa`x1$
z=hrxReUd_-KHT+OZmY(pwN+&w4g@kSJNmPz$#m@}!<&7nE_Oy+E(m>f_GR!-?+xPl
z^EFMey>xHz6R~^Wem!Jaf9hw!UIrJfs_&XxXTFQNJ!M{O2jkV3_7w(K-ZCq^<aldZ
z_)p+z;r59Mq9&^ZS^KZ%Y+CcLJ0dno=Wf&V%deRF7J68UtaxGID7Kt&SwDZ<f*sm#
zW*<9pEj+<|PTu0|mIia}stHYk%Rl8fc3xYuqbl;~_R_rF2X0sR+WOx69Lsv&>hMoC
z(bqz{r&d|cNjlOt@!LtBRE>|TI<>5BH0kQhwVv9Rb>h$OT{>b7kDn&$@aCI6%rkbV
zm*wd!oVnch^ua&BQ*7l^OE`sYvOM;QWIgw(^}n54$HJ*MlI3})OxUP>#^Jn7Q_9l`
z;jf~-+?#ao@2;0P;PRuIgJ0b?xvt&Vg7?9S#?D!WJ-e<?w_%y^rPA?_{t4ArM&5T>
z=B*PCexvmN^fb2T%<P3%oeL`udF?+Cvwiv`n}a<3HIe7VpT3x-7Z7}N{)X+#ob`HZ
zX32=3|FFbK`{92rp-{O6R~DzP+_LASKI@03&nYpD7KMRpE}VEDf7O*~lGq=aryFuk
z<|-y!>g9cBwpr}t9*rqqiaWQr7+Yj`UYITR*n7%E?F4c0Ew+=r=6E|yem0q@;+$YM
zPeSv;PVNl{%I3c^%$gfq@!*xvVab9%sjH2SVyknyUN8q;D_0lx`{sEy_{EAJtlcFc
z_S<9^*(!yu%8JZ)e6!@XrE8*DZ(n?`ShfrAo@YzDuj@9(gnoThoVa0ytV5^VlypsD
z?$DV(I_}GKm3{d%-+62CPn(yevp7n(nVEDQ{<A1o>A*L&sZ5W&&2|Nqsoq(0^S@nb
z-i<#jvffvxMIV&TI<2yy)X+eGS%#SQg{;*|j((?qeofnvxAN?P-gTM`8TWG7ly1yz
zyT_`!i+Sof=H7zTh3^)a`(*C9k@jJAlgPByUzHd#<8v8|bw5YF{1Kz@=qQ_jOa7fx
zUsmkB#p?4&)I;^UpYP`q=cievOSkm@%X%3u&A@SYS#<244EBXPV}&Y>Y!YQ09=^_d
zFr%`s=~1}!feDpSIVtC6mnl4clvMjNWSRPGEymN#wOekv@i+ai65hdPAiH|Ccg*%p
z`)=m0)mpJ5INIhuL&DBAciLW_Z1Xx+c5ZE^@2jZQ%4s{K8|US$GEsl!EPgvL_V*&$
zmY}5S$EN<~q1O)egh$)oi}~wTd4-kXOLv(-&dt{$&)lU~Y5x7PBZleWIwmEN%Ke-Q
z1!pg3dbmC5&Qs{RnN-To>wfUX^t%q3Q_FcKRbA)3pflgS@xbRihKQeHtqZ>t-92#U
z?1u@xhaZ+pGhB_FvZ>>_G^0ykm`y(WhxK=ICF}B61WYa7wW;v>MZ3K9>)!pCv+Gr4
zwQKEOCGAz|Z$*_w7IK>g#7qhH*UpO8)@x)e-R<db7P6__ATRWHjd8;X&0P8I;p=B-
z#NVCy?dmbEn9N<VES&NA4B~kg^`e9CmLI=xX5TB8CexdS9DmX-=Uiy5+#>%hbh_k;
zV+sdcmo?7IXAwA@RQPzqLaWt3@9z4tX0MVLx8K^(jRy;rV$Vw(UZ}mw_bjc&sqJ(&
z$T?TPt_%*e&0hQC!5z;f`TTx;_fqBW$<9lAVKr^hqMfU@D#%~FRkf&M;nq62%gg4u
zMO**-@b2!z-SV3cm*4#TcyYblo=4mK<t|#>;z$uJ3*J+~QNri+^!9=h58K_wyBvK#
zv8<Y~I?~j$t~@`xKKz|cjdQG?;jY7*R)}Af;k_i2u;2UttNX7NXUAt;SYZ&#_5c1}
z=|}ekcO`c}Jn%Ge>g3%lahl$`3`=zQUKTZ;Wy!h}^vGr7D-)}nSw7amX_w}z%~yNh
z>%ZVLlW%9)P1k}Q{r|)-{g0>*c)OT;;XKQ*WpidLwdZV+(r(?xwCjfVHt7yg=B{<#
z8>a`X5!kQ3cH1ZBN1Jx{=FeIf!CWZ&<526>FZ(2w;=k?+cw!uTIa+Po`i*j(zaH<n
z{AN-S|9;o!Gi;Z?a7fJGZN2V+P1Z`!_KxUayR3CDe|#_WeSUG-y-%#`-ssq8u1o*B
zW5=|=cVnK<|2c{K@bqUvm#X`^PpjX3HPJdQVy2wA^N+ypB{7%(+=*zm{W2%&&x+iC
zG4t)$Z>qW#^S{D&dT>ge+4URlrE}LP%b8sN)tPFsZeg9t^t##S%cuUc_KLf5Bk)j7
z?5fOb`)8fr&vtOy=||heV$wdI5fkU1l`XreApKWz{r0Ph4`okX*)^$BV0CJTht7rm
zS#2j~n*}}GnVwbj(6-NU!}OR2)8npt=P@~TtdKc;`RUwBVcV%KZPhDc>tr@Pwe4Y?
zxKI7m-j<bH7H#|#xMm;c@g?u03|5`XtN1CTDjM`L>!NDK8|Mo>LUnS783I`(o^H<h
zp^%@;;xF>Jnd<?k+Al3phd=KM75DGn<LJ9>Nl9mQ?47G8MX&h$$dZegld?BL#QWP~
z-++^hzoo6uwRMXaCcN|erM@82;K<b%Suf-k+%Pu%5@l-e>{?NYfKiy#lgeF-#J5|<
zX{oJY@LuP2eOC1%E786Ut<sApa=bG=H`($>wj_^h(wX-X|0?+M^tP>Te_QPrZM-Ae
z&%XES)W%worf&6%Qi(1Kp@uaVTOL1o?xps5pNT<3=}~ThgsEjyv$uUUC=dKsv!Ehx
z`<9%adzuS2+OzfTahf9A@4fA#@oyi=J^$V*cr?s9mM7gSb0ML+Rj4)X!_7^zA4X_*
z-Jfc}V0}pSnU<CCmOVOp52v*29x+!x#pKfav-k*`;o&5v#ob#Td~mtBXGbVsLe|t%
zJHI-sDJwkwlh>4B;xfa!U$={G`5&JPtl{=WwmVO3KVtIklJfQPx(6(mx-0^>TAW>)
zf7NKhb2%w>4f9gYO@7SlMYsQrTmFKNdH%~T%gvj%K8(1}^DVFK4bOASIY07dm^*%8
zU{6RXHD}I=xHe<@tPKw?x0!$Q+~aK{?xya?=2qHV?YpFS+VX5E<LL^`b95JSwXK)k
zap_6^#oXr?6na>+RPM|^{A`|@z0AMox0_=h+c@c|JM40^JQ~~ZxVOoor@KaKb#F;F
z6VFo4b|!@f+`mq%%71oUSvdL4Uv7<Qmv8P{u{-%vz{=e7^X8Y&NjxpP-G9T*DO%H`
zeT<HN%4qG*I<CvW)Ojh;PUBuvhsKLzA8uRe@YG2q&0(oY>4{1B!n^*vq5rdM8@PR#
z)+%X-*PT0XXzlYSj;>t2PyRhy{q%6aEU`GoZ@%2A9&2p^OJ4Lziylpi>Mcq;vGu6^
zsv8$>*q2!qxCk9)f5D-1;t50Cx1P?}wKBVY+L}E-u8}G8QNXn1ri@iXvU+WA-+#vF
z$M;MY%Gpg|?^eq@CCPqDH%~68r`1yL+ZTaW#)WbX+jbN#<EULP%hh=;zI*n!%CjqO
zXC&WS;2m1L{Or~CCybKZcar2PMQ(>Q)#jYC2|dyrqm)?p>18gTkVA%~G}~mubKF%A
z>jQd(bnCLupK$#(ZO@L0ya5y1GJ>pA&Trarx+J5vH=yKqdvaFgge4sHW!rZYOS<r+
z6<Mb|xqsU`DE;4Mi9%P2lRLC-tP@<qrm@>;(w^q}9P_fKU5<a`Z~KNBxT$&8&-mW`
z*0#YoWMj(%`HjIB0~)7(`p~UwrXwerV;gmd!QoZ-JJv%?GiNF#p36P3<73X9>0M$z
zWs@`BtXRQm<nigr!^T~CUFGg49DG$JO!#@f{8YGX#$V2C#rnB>*Q|BnF`kd~e|2m~
zS8<e7Q@{T7Q0s}ZeQXa5ZqC0J8kB7Lj8p&m<(ii{Tx;%Xw@p9%<ox4D&(43%idh?8
zE5Ub6+u?PlO~A_k6*CKhr!v&{zN;)SNLUhQahBEQMr5ni4aZ}trzh0-%_};^YvTET
z&ZF~Rwu`jPcrv}nZe3n1J8NUW<Zm2)0To6%*-`64pX?|oSFTfYP+e8k!Mtb&&yS_Y
z=UG0<Xo*?Xv&M1xigf|kT6i0BXT{FsIa#s$*w6P%O`2C;KVD_o#OfGbo6{Ar{%rm!
z+asBd=Aq#yq^`xioDp)4Cq?SU68^`>8jfEo>|pav_bDnVY7kF)tKjsF<({w6oav$Z
zHQbwT?mpGX9Isp5V3)Z!>ArYPz#-1ih6zoZZ=cA$a(IK+Cwq-2k0;!z`tI-F&mUiB
z;mUsh`|soG>^FZeK3u+BqWsOzv=gVBV%5Tas$TMAs;)?JNc?mD@AvnHbF|s`a}{#@
zc_+`#X7Tq6dm-D9Q&v<R+P7{}^e1}{=Z#H@E2b*yH`Ol;Fkjbkf3L&6ZBBD9>K3pa
z&d80Dk6`AD%oDf#X>3>esQsmX@e_$h4u4|PKL~a7Wv+O)h1rmSGryC!^sC01doiK5
z>u&OIGighmm6H1|KhA$b(FaF)dp@P<C*wG$<W&p5&$%@H$JUZ*8|@4odCs+MKH0GG
z!cBAj6UGw`xt$k(d&Y3lhOZ*#XE;;r|Ga$h<V%cS)9a6nOG>t^$x>VKSYb~OckF4|
zJnknc?^iiIsDG>Au<nwc#CG0<iDJ5b`ah)j1SeRXXSrfvcI(QT>=$PrU6EO&WFfXu
z&C5E|(CbV7#daZgk4st#uWTomM6I}IBDSP+<?HiDW0@<D^1I3DJbzuVcvV8z<4yfv
zUb^lnb8gXkCt}F`V)BxWI*wfnnnM1zHizu2**mrFTZP}v<asUq1vO?VO?@gGUN3T(
z>k_cccV7+1Jx%uqn#Z;U7R$Q*lT=R4;OSg9W0x^Ysa#)D&%tS7YL}S(Dk9n*o$0wK
zxqVlhew9@%V~<#0act@PlAV1%ldtUmu&zwtb551tx=Gw>jQ4kI3Rc|`n11BvKAl5z
zH_ZFLY)Pe(QviRrw3QTtx7$%Ur33dF8GmhC)4_NzDy&p-(u@Z6tVtZviKbsW>=s(|
zGWO|t`kp@5D)P#(OUCBXU6s&{lRXWrmxx7(Ptan@N#3wal3`amt3XLrSg+`}#MeQ`
zLYn3Iw^Z=n|G?Aje$xELqg*q0k*f-e8@;7}-3qo9xnAt=D4<X&enVRHUR9KW<5FMV
z)0<D7UK#kb-_a|^asBCAoMKB4Sjpr+E8ZOy|4?n;hFde|R<k}!JkB-eN{H64)o(Ul
zE56pxl6T*K@?@@Q4OikzIyWxvPP6{>>YPp8w!?=+@BWXyc+fRmZ2Q$uQM;?TUIdt0
zxqfZ?`C{oZ$0f^`1+QHHIctVr;6lZSD-o%06Q+tQTgUyGvGP*)jO*uOPJ3SLZ`>T^
zQ#@f)nbC}SvU3)T|81Y^q0svv`CRh{jtDUsA-7ziuWxzyb&dCl9M0T(!}j>jHvJt!
zYuFVsKTEbbpRnmX;?AM6YVDi2HRAqHep$Mj>|U_g`pCE0It6Ok(Lw?Rypz9{XdPxy
z^qzg|hQ8FD4{?X83(gzqH7D*X3Hha1AKXw~r`*J!7T5f-<p!@ykCMZ&rX@^MCe}n;
z+^}iZq^%x2o*z~E4xV~p;wRK0bY;n^IS1;JpJ&Ov2@v8i-h1M;=Dtf$ZUr%_tPRav
z@5#J$+m)lgHkmKI;{9)r3ICVP9CKM%mOH0~?dV+M{U&2_kxas$)QtB9)$7#t>zsTS
zvo3VHk!NB2`)rrT!ABW3?h7^TB#t;;{_^3&U4Hk78}olzq+16nu9;LV&yv5~QKm$C
z@oS-N9?y@d)dy{9H`{yZd1;BxC6nB%(bE&MTBq{g(|oZ1NVuxfISaXtw99fG{6fJC
zRX;ys%gyad%InihnVojkSJ6Lr0(-aT&&(Oy^jdHGznvv7WLfTa$oB58l0ska-&L0a
zGAC^7<~^SMdB&mAekPCO3N>!e&b4(0#-?WKb1i-v(XZX{==R6JU{>R&8w~2N*!W%w
zzbbS1sm|m@F1AsNnhu;=8C+(PbWCH1VdU}&b9whY+0pT;#bA1VK<RV&>W3P+?$VKK
z+Fq*5mRvr@yJ1fGPd1<T6>ZyP^Dl<pd3ZK<ZOxkWZ_&r6J`<jMS$9TczCx!V>#4>5
zKJ(5=s2#7IY{nH9=wi6SXxWe00+vtZyPm{OwfJyVmVfrAZYj0~k@-_xMe;kiCRD#p
zd?omq@q_*9nyg1FUgep6UZ9h)>fEm=*N<xJ{1VDD_T(*&v8@hUy`WfYSJR%oRiB?$
zR9e3}{YmNHrJn~*y;u4@LG0$rImKTuFVG4tS6|b<dUNQ~UCUaEO-t|3R++eV)uayZ
zeRo%?MW_0=CkF}IAC8&6cjdX|m&|uMdGeZEIJo}XxpS@4R3~xzW=9v~e!sNw(wqsb
zoLaS8_@3$CulO~~qidT(;p1>2<;#ku`%Y|FwDN`2vF!M^%3E)Or>@qOxL98QaoIx4
z$XVtILFZDW{?2Z@^Lf*w2O?X}G)68Ecg|mx%C;?F;j$vR2l=T}x0Ih>7Z_#!TOi&{
z*e*16+l9_Mzdk<FGL1Oh@VHL$Zrh(j;oMTI1mCUiTjj9rM#!{TyssR7UR>gu#TH-u
z_>dQ`r|;ySo3FkSEm1rua6U-=Rqqb3nf+(BwqE;w(D=?euZ!vYidVjJb!>SW@PG0=
zYu8P;S9kSUY*(-oQ7xTj9_^#Qt|RYwS?;kV8yi!y7;f$S8S_f;jNVHw*E}6Y&q;n4
zGuszgO}w}M@1kigH;bMf@|j|MKE-mf;>jsN*2i~>3b%zUR7p(C@II8WO7*R4?wX}4
zLO<WTeCAu3@2)AZ=Wes3%gak)?2ShoOwBg5&RwzQkdxB>6(=2>{vVUzc*SS-VB5x3
zJKkRMH*|R!CZM@Yv$}!1z`yrzM{L$UcXmbgiV73Ind;}S6{lu#Zn~YslJbkMOd#(6
z$%nf-wMDiZ+Y@kN+uf3>H9=kCN%_}&mQ9sNpUANGPu}6$XpIibZyE-3XUu-EUBl7k
z+GJg~Q&B&TeE)S~-KL4N&t%>E-2D08m)i=}Q=e8PU!68<+wY9cLZ@R=!&)cr+G4$b
z(ZkhCuGQpTOPhDc_}es(ZR~u$uNM3%vul&$?a1I~c`281$a=z;;@fN={z%@Clx%59
zeQ>EKS32N%>rtblapw1JS8=4>>e>;t#v@H(-@eeS2VK$Kymxx0|I59+G(jO`$CQ|v
z;;R_6UzwfXc`q=3QM$w7cj31}9(yj%zh$Z;yV@^yTm9|K&!_za4HrG>Jy;qPUH)-#
z(5|46OuzHH;@98P*DTHns5p2&F)C+ahpBkkgtd{rB6bsYw*BM~eQ(REvL;PER@6~g
zH9>jtsiQNtpWZhseV0<hR=<Bs61l2nWD9P&ahPzH6l_0qKX9vCbHxugKG&_YHwTGl
zT-BWA6koVV;?b9FJ9I4+e0>f5-kC08Z&tl<(mUh(y#uuqssg;W7)GtV_~e_}{Ph-W
zN9w0`&y$Qd(7Ku#yC*Yd)r@rZw`SK07GE;B@TI`-+?>TzC1oWa&-R|X{E#nuaDi9_
z>sejD_d;$OSCk%}y`Z}+bVk_r6|J*3MytyG|H6^xdNA0qR&!bVvA$WhdfI+lt-=oO
zul<$wmC-0;qN@2`gUaj&zXf(#u+0qh?3pH`BY07tW6xb36+5$)PaL|9r)bRlBQ-H7
zLw?`y?8QonQ}ib|&2o0~?$R+gb9&(NX<^ErJ%P(a9%qQF&F*)N_dNPdDLzNh>cr|-
zk9Vro?UXZ_JM9bSn~c8epToI~Up#5K|NdsY*1Be4?}nZeA%P0I-)DX0I(4z?@Bi1I
zI!ZHFhOP1mnWD~WKHqG9X3Xh}JQ}Y(I&bpHFDct7a^>p2ZA{u6(;wOXnKY~2&G5?h
zYV**RlfTun%TG%cUXs7)y(qTN=e+AI;k%i4>!Uv@p4q^_qG|Ht^4rZbCxxDy(X2N6
z>Wp10rfcymbea9+Oa5tr-5Snk`X^U>^ZD1ov4W?Ucg_QgISW?))R_O-mZx1xV!dXI
zqqc)OOTN}t`)--PM~&TO#nS={YRx%T|5^KJBkzeLAKpsw9NT(SF32a;)H-*kYGH1A
z@|HGMiNbX(%A2*k7p(YdU8gtAweIf2MJukdUtFX2B}3yA@0VXY9G(ayTnp2QpFTA^
zY7TF0QDDIHu&csG9!-7Ue&@b^DY$FLE|$cgBV9L&ww{}R?vm^0_T6*;78ZOuakuSI
zg2vlc4u&^(r~aDD*SYb!KKnsK-CbF-mp=;Le)6`=#XRyvb^m5=);&8P?YnZ}PmQRe
zV%ED2@08X3mEylkZe~8T?5NAH6Y?`}nBCVYU$iBB_9YX|*7?i6=H(lB$!LC^V!pS}
zZQ+@7%=;~u7sWm~eR1mY<2|o*o6D^AZaZvg^y2^g_)mY-1+K%)w|YO`%=TWSymY%t
z)4ffnEWL#i_s^AGZ0q=`jQ>lG@u4FJ^A64HJ-aP<?X<SS`rz5KZ{P4p`EYrG`6bhm
z6I1r6z5kjzv;XwO2{TqdDL?4^f1T0N{Xc5v_p)6%uiKctForAFOxe2bp90sl9c@<@
zKTEyysilAZvY#7%>WG?4v<q9jcz@#gG~SC7|1MURyI%cn&E`i;>6a2eYHpY*ks;}_
z`gT)p=Cq^64jiFTAJ{i!cej@EnOuyp*`HS1^0PRZqviC^qbFupiwkm_O#0n&!;0T;
z$%aFcdz3?}CRDU6&9vA#BTsdHRAKwe9mWbi8*7X`YN{TY-8*Ek{e*gya%0=O^p(B=
zv$t{0O)~p-<U8YO@#-(-3tBhXeqArH!Szl4LhhAYPX%*6sdHPmqwi};<ffmdZhfJQ
zuM#Y-oxY=Fwa~<B_UodpTfZbdS>s~4_7nFyQ5Tcve0jc`wp41x%wA%6g8#Sty*X*_
z@BJ?-sRiiO{@(7UJ8kRg4D+^$WdfI+l-6w$Dlbf$YPHLWbsMjlu_EV>x<yXAZ(ZNM
z?b7R4E^Sstk8^Lv?A`6Q$gJOnh0jRjJy$U2_ulx+E=xG{AMc$cRyJdONNUJ7*K;m!
z+2_k$m?j%u#5rZDgx{JQUbjAL#pu*H6m@p-BzyV&D7gPMf0b15_EY_ZVFjyZ|6S3T
z6Or^nTI9?9@AuX&5B?pXCdziFbmo%}LGe91_6H_E^FKE4e?o%$uJnDCH;=kJJ7s*?
zER{1ho`svM|IMP%+0#$ow<}W5xbDkW`h3liw?^?i_b+|+<vuli@5CpQ>n<gpo4mrQ
zUQVNY^HW*z-yYxMpUaBN#qRv-p!tIPPf+2Hy&d{~E0)eUy(nsh{h`9Z`~6uV86Tt-
zYi0i2_x67>(V<^I;el=A1kYXFIR?ipA|J#qXnHFWetyG-chlE9OuVAF?Q?1K!?OFA
zFDw;o+We*O>kM}x=@Q+zoijwl%!;1bzT&YFD$;N9^ZZ^lzwK*M)Vivdab5SCj%d~;
zF^ey6TJ75PzJr(dUj5(FE%y|D{>pxT@$lqly$=@FOP^Nmb6J(wq{*c0+-5sZzAKZX
zk3TE>hpN=$k_Ah+&rNpSsIz+G^*k$?WmbpvCvQ8SUwY&ZugOkhnRf+8=I`2}vh7;#
z-KRg^hW#=6+*356r{Rfd-PG$UYg0-$X5`$y_?&%h?8K6_Y#cJ;Y^LU(qVI(K{_dJ5
z{wwX@q8+F5Pi5_u*>-nV$;554cdndzr;xd2wL<&k*>de4HFjE@693jyqPpd$$Idy+
zPTsR;$bQjcF7Q|@W!H}Sqk&KR9B;6-y<xNV7TkNW_QuHxwd-$HWZaURnD}dBXp~dl
zwO;4V|Fn;7JsVcNWS6hPsdIZ9jx{|v+?Ok~R-h*@Nun*3_s30-BZsBUPkFXGK6am(
zx8>&guDS%}>KE<nk^+`T^<NU1DInZ)_p6xsu~W<%x0SzGB&oeWn;<vmM@zSKpGU=c
zUfUTbzb?Q0snUvXbt+?WdCQ3vsaj7an&xoHY~GsX=xTb;dzzZxB#Sqy))Ez=!rni)
z{}?*=TZelqymd1_m7ITmrBTe()tQd7T0(r9Pa7RIjbxjbvLq(R^ZKOpm<<z;YGsT4
zIyuv4bJ&J3@X`+cZEDA7Wf$oi--&hU&A3;~E8E;weI_??!rqQU`P}P#Ib{ESSfik<
zm}TrH^0YP2)+KXt&Iae5nmyr9Vk7uPZhd8c!#ORqu0*0KIau(zgx=@<T|4<I5>Br)
zX54Xq#{)4-8J8IUn9pCfTi!qY=<TA#)q)WY?5&4Av~2!)u}}LFF)#9yddu0RG7(wg
zkqJo~6Ia$d>z>}TqEUh+E?<jZ(2e8%RmQC?4sF{OuK%RDw8uVqW!JwIlXU$5#@ylE
z!Xn{S_oDxqceqM*<t#zdl(^+*CYoEerTSQ2448NC=hMWCtCxNH;rGgH*2>wpB$Mu)
z`|*3{9g$gVY&_fEZ~PQu%yvMnFZEBzgKHV@e=G_7ASk%)g8tsdx^0t%lcsP^m8g{3
z>0~`)@>eE~xY)^AMz$7qc2@U%O*e*IOt4VfrzqW(XU?D!@0;XeH&10fU!tvpno6qu
zm+r;IYSwqo@%2qSbv*gIq3x!L+H9-htG_&2=b(K&E-Nj^yw^oy^QX`GpVK&Jy}ZD7
z>tFuDgM2exZT)hRO;;3GDEwI*YbhFdqU7449EQ8Ag0t4oT3kLqfHzatAaCw;g^-xV
zN;_tA8GcNb*rlcZy6QHs)Unt<Q;tswmxu^2s5|~TvoMFN{Axt$z3myPvF?j@+xf;N
zKM~uexO{ERO6F<W_iN^~E{M9qCs&-fGQeN$;?;y~=1RY~#)E4OO=}r1#osN6?J`_7
zb!v_C>wlq3!&hJ278iX*U+YC{SCRb2JI^alTR5K5du6<1W}}tZPPZ1f3qj%CN%x9p
z%c@v!x31u1U(PjQ`reYgvuu7#vo){^Nvhuye(?Tu=*41L_FEncI+NB<y7hMc9HE)T
zRhJkNOr+Bn2c<86_p@}4*9^~w{9`gZ^Fnmr?fKard01jn5O2Pg_F64BF^y-*j_=;2
z91r;-ef85nPW}~Jra%5W^~TfcN59=V3S9JzRl~A2tohxs_akqO-}+U%6!t1h{#Kt;
zZnpD5%#@{bCA~gRS$tsDdCS_#>??OLzLW4^c~`&C%i+3!jGD|rV~2H~CvQp4W>}@T
z{`lpTY5m;$8n?&p(Onq+Go@*QrJR|hQYNe8hFw9k`ZG)qeX`2BJx}<7qE5Q;(-(`r
zc}CpwXGk@;TrKz7KK0<%+U4{8Z?Vm?4f9=En)<UNY3XZ?e_y=Sm+-AI`+M0r`h}aW
z%gW`azuGvlf1J9q+i>%;Q!y^Kr%$La7oR9;ec%6po5pMHu$-1n{jcwDbu2vMr7Yt+
z`MTj*Uvt@u^2_CaZGX`wwSna=uWU=!o~SE3m;K?r{nf~5N2;sCG@tAxw~7ODqM!SG
zcGTv%<yn34uWIVn>uPrP7sDQ~yb@a5bMm|Ag%hS~_mbz=C3X1}O;}aLRG%j=6@7Ni
z_lR#Fr#p2|_`FCWyDR3`1U8RO!&OCfoD3UJ82_<XSdzQ9<KSEOEWY%kpMu2t#j<wK
z&bv3w@5rnj%eH&|P}Dv6KfHB5uTjIJqnRDEr0c(m)p6X~xc5N9mU(#$1rn*fjz8LE
zR>-zZ^KCfqw{wSlY*4B1ab2F>8SY0XKb?2&`gV(}-(HDJzm>EW`*fh+nbYTNYhgG0
zS<@OxmGtK;l*4rS=Wdrf!=t)vZ^EkT_n{IDVZ3|N_t(vt`%j_sG>hK;SKnoC8-7&J
z-eN9N+a-3+@z9>t-Sf6f`3s*tmK+rL=y71f;{~lN4!3NLjQl^-GF9JGDT;+%tLesN
z-OC~j(OXt+;-1>SZ29v^lW!cgJ}1<1Y}<-wO1tW<UOZg%b<0=Rds8OA?wO?c;p(53
zHG3)>#7!^nYx}Fi+W7mJ?0t=I{NL~IvHYdFIO3heb<M>oGRN8NWn|>{RI5I=KG`pQ
z)7EUG^SixySJq7TkDAI}sVwSx_vQavAtAx)QmZO&rWE$I#;mRXm9#@s!SVFnZPm};
zHLFiGoGC1RdQw_?)|;LJVRpu^cND6ozpm+AqriHq`~2d<Gq113&i&=I$~@!IBe^Et
z)bACW+9$RBa{YZ<KEY@Dqg=kTX%||omi@TjBv!hgKVyNV+UCdqHU*sQ(X{VP(mi?L
z?<2jy&DrU%>iHGs?)1`F8>5sWwQki-lehEDCHbR&y^-KQ{&>QTL-87-jCEi5#2Ve_
z{9!gaZXVp$*cDVXS%2vgcGkT-%tE=BV>kT`Y~3Y&_s^930esmvqJpPves)V^_F0oG
z8-2YKTN5w5QhikuwD_rmC$p+M*Wm+gkKZg<ddU3BSFr%o{lUH>TAmxvZgzWAd1Bhp
z)Q_1b&PCXM4Y<83vE*#zzs|b1dtc1At!A7P^w_m#^_Nxe4?ekbclEP<QFcrE4j<QF
zVYW+S1@F0EYehn3#JDo%i0%Eb@K)(EyUi=6dPV4pe2|*>?fI(~$H`wlPrL1~q9AsG
zk^6NM^F>w5qIxX<uHy-LZ@uAqjG}XS{ptMTbf)C43adE^&J#0PH}5-WcJ+3IWA8no
zHJ<aYmu%DMl8k2LcK)r;;O(0E+O(-_3s(uh*Uop>SAWQQpULv#<;B;^Q~9Th^n_bR
zMO`&rHuac>Zfn=$(>u4WoNoCt_UpoPrzINC%wNpOQ_3rndmzQqb@z7e2a^|WuQWRQ
zp6k_n-$>s`ORp`vbJ$M!dAGjhnPjwFUuMD4CF+YKkG{FvW8B+NuNiP+{|Wts?g@4b
zyVyfgX8Lr`K2*dt<MD?{Ooqz(hVkd67`sXX8M&Gl$!>_4-#lab^FxQXSlG0Fdc}4|
zQ+WG@iyV37akF=d-c9f*I<h%W<3jWFtcJ;MUahllUu(|K`TAp-&89bMtfEJp=QZ)Y
zs;J(6s9QK?!vpz!E)xrWCEi@P??hC~tt7n#;WkHHTQ7v15n8s=HqOJhYT{MPQ=9&W
zF0tDmR-EG0$k^5ElJeF>T;_CM{mwI@f&A-yv>bj)ZFdw_Rqk$$QU7&N@L^l}ANi^a
z3C9<1)V?=wg@pHZEr0c&t9q|1PuXI)^BbSF<vW9V;oVIOmFM?rc33eA>?#hlHTt&M
zM@HibGi&}LkxscanU%2)>3XZVRDM@(-S=eA%FV0PYM*vArT%tzaSk!rxap<LHKpFQ
zl~xznLPRFc319I(>*-(Co|%ue3uIPJ2oGpif1)+{%fEX$^VlV?$AqSC=_%gcSDfB9
zMN72s`vsHzwjbgm>a~w;KUn%yByz$x3A0z1Wu~rI^xW|wC-LjVu67yE-L7#<{ARjc
zTjwajm)^cdw&1{N>#|M%-o1}ze>El1?JnQ8V@4krt-JeT!nrBCWe@*6@@cuS)KTa4
zrt8kC+~s87w|VvNReT=Sf}EcwSbx8M;Mu!3671(?U&MT}-&p=ZeD`+a1&VJ1W__J2
za8_Du&vU<tAC4S0sqxx>W6F0S{V6l`#6)I_cw7?d`)|GG^mVz82kYi87Jd_`Wf-l(
ztiRj*b*ztR*!~ssw>mrO9Oi9$^=BDdRj=oUErm62PR;4zKhdM|O8>CrGVN*Vm(tJk
z+<3C=AItoZ&ub1GnBuU1;;LB*Rwep;Q%kOI+`}Gw)yzfKpZnAso1Mik*EcPc$=mhv
z&g091g`cj;-Z8%HHNi)<Sz?oTQ25#Vw}aGb)BcBk&8=D=?ega#gZb>L`)#YDxi-i@
zyI%0?+}X67JE!;Bzp1F1V{9G&)^aVsGi%HB{fQGEzFU^(lj|=2>UVaCjKlJiU!NsM
zG8a#pv*z04O_yqKmaf0`_t~D-01?xGWxl6Udp~Z;7h%lbbyUsn$J1Xy=N@{Smdo@d
zo@qHS*FB}_UGu)5H+^DKR<8}yYD;J?$ZA~up>5%tvn;7LN_&|F!Z$y0+impxRp(kg
z7xO*-E3XAh);V47cbU7nA@;<LtHEkpOn9vVc!Sm@Hf+BeeqgTDoBcP<SN%V?PS9CQ
zuI2jff<LE<Enc*!ZF}X?_qz4*DfXK)@0H$<OEp=Wb=O$jqfqaBXPv<5qn8A@6nmN<
zwAyqWGfT+c_SVSV!aHTLvPHjSpZJ@A=FoG?@_1!!9VHg+U=7i@pS5#(rTLqgl~1n)
zTzs_fn92Oup3hG%=Y8V5YZ6=bZ}Kbt<8nV!5=~OwB^!C#&K=$RtwKO4VwIds<eg(p
z&PQ(Fm@#RI?FSbd+4k#GvRzhOJh!Ip!BnZF^=*MVyI8-3U2-;&oUo6fdi?~eL+=td
zzgn|o{pA|Dwsl)p6$S5!{<drG_e;@V?p-<7;L^BT$7JK<3DH5%7xHy~I=$$zfzas~
z)!ka3R9_v=PM*?SuJy`k_L;%}EwKv|$|hc0t#;Bv@MXN_@3qP|xqlm$=g)Wd(0(3$
zc23jYwpV+$<oZmx`Sx7u<j#QlXD59#^pjWZS$(CYK4kBQ%dx4KwXU~JWB&U?l}D_8
z+v8g49W!q1U-)zLw(r~c6UEMbtJ4r_*c7?{uis_+ltB5Xzq=;thkJeB@K0LE?fJyR
zGlaXm{QEuT6v{^(k-dK=@yP_!vj)retP+!a*?d;A!L0DD@zt-#Rz6<7d&9T(Ei#EQ
zyN(zizPjJdJN^?xcY>z%`xVElw34SeFH@f#etP5H3#U~~)Z?@2Zn1wqI_u~5gvjzQ
zT@ps+Hy2H*GvD!YGRu(@UU8=+;(vbdK6pJ;qC);`&PAiwk2&X*iyRC~y>g_u(l_z@
z#BDJzUTh2gqWbwk;qsPc%jE@K4b&OhIvkS2l+}u)6!`D><}Q)Vji`yfu+hdRZe6&i
zony38M*p1nzp{=K4PPH>_H6s#HOcX8lvz>X@<x}b%JF{d7x;1c|NEXNx#l~^#}3}W
zvb?OmJ9~4_uZVNrzvR)TWe=*BY|MGX{Cnr?c^~$d96x2WZoOs4XPFHWuUVO2ayIOf
z-R`o^{XxxPlbJfo|HR(fmYH)qd;1nl$vd@S(Yq6i+&*kuqj^X5=gfVlHeLG>B`Ou`
z{JzL#d1w~*=UWS!uj@_{Vw`C+Rr&e)=+}2E{SLjDu!=R_cF8mEy<eTr{yM&nH*&w|
zRsIJO=2qLS8(+3XneUr&BYASnyW;u|t#>)0HBn!g_^on(ewr<>850@(VAqT@I~U$$
zt-F=eY4_^rp@3z%jR6Lwz3=Mef9}tJp>d)AT-+RU!`7q=%f5WRE8fW6eVeIZlfGTD
zhRVIni|c+&nfz7gQuv*<OLE$8ertcZfvv3nW?Xj&Cu9A!n3;drosO<|7LWQYvTaJf
zN36tTm93{9+uY+geLtqH$!ksIewklVl?<h6C(iAh6r?-t|2l;~dQI+(;RmJ*OKhH^
zS5sGh>!)lrzq-RMwIfx@oM{g{*DUbt()^^LFjpt{$ztA4qrIG*M>Jd)oYME3wM%Ge
z!49h(o0MFem%OQ7uKW1zj)(=vBP=yvU7cw;G2qwp@9VpdMt|KUe)vS=<!|YqZ$5Om
z)hzMr)9Tstos6&QMyYl!o;pv&A?TQl`}DgrXY7~Qb*<?uQ(ByK@-DqqBIn{>HoZC`
z)0DBv-)=HP=yy>sKGh2sB6o<|%xcw`8hL?*<AKt*eI0taR(a;V%cDxJ=-%VqzEaL~
z^$QWVKDGs%jb@dZy-~|=|2gw)7wcN%wU#_@FYM>6j(I%&>7M8f4tG1x=U?d-mEafN
z!5aQH@zK1u**z;-mO4um#qVAD$?)i_N&EV?OuTSpkGw@8cctYlw?lbb8sEN9Zu4tA
zl_uezu76M?Dc^9W(rdpP1sTx?&oKD>-gx`PF@?+vcC5ixVfzm+KI(tX<b%5Ap@p;W
zZIRvSb?3%~{k}mbo+<Kqw)V80ICgUL*5CV@ZZ7>{SX!nr`=)np<-!N|;$}xB9XwR^
z%A_Zzruup6{rBcwj&9tSH&0h>Zqe_&_iV9tLT-F)Xn_`Ay_J>aSJ^evi~&7*@=QDH
zZR2(=>xurF)ni#w{Z4n~t}i}w`3|;pyk28DH{`7(_y5P%yLcxzKAO8bbmEh1*%~`~
zw?^j9wY>FBFXynSMA%*V{`)iLZMZ7KbHQ)Hp8t~`9g`QnJ9ByDoUd8;V$G+X=VIvf
zFAONj+Zem-(5}~y^3JD49W1}e5p1wsYU+$HT2gxFmTaE+A@P5A>%?a|1x5THrsNvv
zbicJQ&DmWSl6GviU$nr)U+(MT_V+%sbB$v?JpDy$@WIea-C3nmwdC7Zv~FCz%At2|
zz_SOE3;(2iElpbO&*{^>;%sz$c+A}mpW4l`51*2XcTPW4(3hU-yRFV<PwbwgwbzaP
z6?vl_j-Fh=c=*EP)m}SAjJM`@f9syV%;fBkmDk^V+HyV9_x6enE#K^K9oTyDvBWw<
zpN9sgW85uwp7zL`>Ap#A_MQ4$xx5-;6CED=uC}?y<GH!}y2#=WXSQ^weF(d!?<|zU
zn*F9HV6}xKJ8y@F$-!ebXTGON@E4e<et+Q{`=!_Z`uERVUf1m#47O-J`}J$l!5dMk
z((e)yWj#+W3W<7S`-4Az_SFS8S2?%dJiJ9ITylbEK=IVwn#cFw_L}P@=yCBtc=dMk
zM;!fb<wy80FOs|cWP{|~MQOL@d>6ZWWQ#;n-pRsW)3V<_s{FUr!}Rush_ZJVKD9DQ
zb=th)jcL%m5q#2)fxq>o?e3yE)?1ZVW{C)V_K<ogqWpTR)|z~&oU#v3&cA!+7?;X7
z^HxG&$a;ggs*J~?25up?C&HZf-oKRCP#c#j5%$u^pn#d{(`JjEycUauO=k-pR`5F!
zw>Zjj)!H5v)9WYWGZME4%dYOzQ1+U<*ZZ~Nnx}i#8|IaycBsYXyehOYyq{hYQORXm
z`Ymqjp4HE9Y_15YI5hjli$;;M`P$nrMnq*SS4y6_YTIgF#niLsR$NFsv*=cjmhuZ<
zpJUd7)`~^1%{sEKHWvgHekfV7I`R9SxZWFEFU@T;cIG<A?i9Xu+po&W9^US@uKp!v
zWmi@*J?T@4U%yIn*~E#4M_z|~=TZ;J;#n)DI^S>UOU9j_e3!?pmXp&x&icX5L&D{V
z^lUzfY_50rrMov?|7zCo?Ze_7URK-=1;UQ{&1-xg@`^AX&bT%?WUj2tMx7Pi(;D5B
z3T7*-JFQ9)w%NL+C8s@l*L{}rENg$ef7-M6^LM|W?7}m3_AFl5q;@IdNRYR?toTor
zJ661P8&|2@Zkw`v5`XRbTK>dyUqTySuj^E~r+Z^h`^-fa71kfJ^LK^pFu$EMy;N<s
zp5hxh7N@B>LQ0dKEWE$t@fW$|ukT7u&9gW)OW`B$7L%jhGi6-1d2W~8$@!sR%bF}c
zohuD34pZY2XS&?Y&x|W#-tx{i;8T9J_`QuR_m=WA&C|Z3__E~5!=5kv;YUjvy)N&t
zp1<dXgo^f)KB+(7J))-EaZsM}<7B_Q?w!`0#wtUen#D5@d1X5|7Fo|+pOKWa)%c=h
z*G5q*H~Ev%*Z&@fJ^b>vbHg;AB?lK>QDu@>idNs6zUt01uSwISCH>vf7YCh4zcu-e
zPp88Z#~D6`QN=DRxzBK2nJ>QGqV=0?$k|7M;qBd7j8|vmmY?@hFXO+?d(Nj#&|cqJ
z&9hA<$8YiCg?-mIyPn_qYr^9XK1Ys9$8KD`W0{}M)2?jQsceiftJ~Hb`ILGzm-YYu
z+QR7b-p&&1)|(z!aP;j|sX0nd`)36<-AlCl|LyoW^-||uI@>vd-%l6)P;J~5x9^zH
z3Nt@V&;Ca}J&P7wFX}g3wAbtP-?wTe%MZm)OL<-SAg?0g=-H(rCGzVR@s!<s*co?d
z{r6DWgUZIuvR3Cl*YjMCKF75w`1R84l2n)b(^=N*bA^Pe@BVvi$srl1_KVxSqY}5*
z_{=Q|y~}n=>WgdKvtYY`DXXO>S?^o*lzne?piZpVOK1Ccp{lz#)Yfb|W|8v3BdjKB
z@7d=+Q#ab|Dri32^I*@a$;?@^(q?ggN!ofSW}@e`iQQ?-ep#>9pZbPxbLwH8R|4j4
z!7~2Mq3b6ue8sPOq0O2_t4AW%_jpBq#9GaQd$G1p<P#G=d%b7v*^@tS%GC+YWioO{
zlUiq=a_(8U%_Y8FaD(7gk<@dilURR8#m>9^??BM+*5<``B)QU`H0}R*-C+I)sef&I
zGTCM*Ut=hX+NLz!`wv^j3c1)Ld|wjc-f%P>D(Ox$(JW*7$kp*<<-ASyu6*iJ&zS5p
zW-SVS&#)$Qk4T+I^u^hH(~l-`S?@c3wLtjd^d;u2Ek80n@GyOO-00B*^>;FlO@+di
zepzZ#UpRNszb$h`_pH_UGtX;=%fbSUnU`4ADj&X{ktB0RW0f4ozxz7N3^$cIo0|HV
zFBXl>HfZ>v;uvk)onGCk7<tW>N3qsb!Yi?-K6_S>INt^9$tw#Zc^nVOYD&AE`qFkm
zs%l?ik$O^DW!8Jsh%2Wb*u*={{{F|>XfMnBqspf?KC|WaTy*h3)>`R#9Ba9@&uDEZ
zo_}o0ZIzutyJ~x^m#wQRzuUdHL(t*&ROLvnkCNItj5=R-e4X@FZI!XunatT+t=$qh
zbW<zWFVWezG)`>#>&$&;w3Im4`H94B((ixQuXC{^J~DoxcR-u@H<{_L^%i@lnC`uO
zR`y`m(U{h)Et@k~AKevL-){M#>_XbAb@9!WQ;Mv&E|f{yb^F1}4cU&958V+|6#IE+
z^L}CBhTEollDBmRuS~yq`sRg6ielb}kN3Y-eC@jI6YuY~2|xO8T66GUJ@#|LA--=v
zmRa)W&)T}wH+IdI%6XeyErogK@vraR9hFwFs4D8_#Oj@2>ohMJewn{$!^G+4R#$tE
zpL~&58hZ9})aIGTY8shLi%hl(J+?i6c`C#7{ty@QJ<U#%r_#1)i=1&OmuA-A93Gq4
z6teL01BU~vwZF_=9Hx_VgPp~{m2;PN*x@HjvyM-3^KW<(#@17v6&=>RWnM9})9mP1
zCLz~8zSwY~%1*!FdotfFfskD7#D_I??s}iMv}NtFN#uxkZ<7f(C@&JckjdbFWP0){
zIq5AbuV*<wXZpWa%iZJno2V%=k8Ttm_J3G&cIH~emV<4V16SoQc#){SvtquirahCz
zZKbZ0Csytaa{9RJLQ2nyiv~BOer|QNFS%qYH}CmZo!XH3_utOnGxb=Q#-+TVc9$wC
z%lmVJt&+5swVceGmb7Bsg{!m8OHRyOz*}PZ{gFr3Zk<#feT4~?B7)O-V!bWjOrFlj
z7{zzTQ2GV8oO8<NXZ@{bH>Y=RI2?H0Xx5Df85e&YUnXpJ%CbV1Gt1Pt{7^u@9v4sN
zgI6kVu0Lzi-KklumijD=@v-&nAMZcPtvtDvW1$4!-vcswc}3iFlAr5HwlLoou#P;#
zS-L2+<ADF--b*hxJvne|&VqT5D<oHKDDIEH%MkZ#G0zeyl{UAZYivJerTlzUHf?s^
zfk_>T%Rad+JaD(nzm#EW*1Y8xbpz{k0t<f%{ujRc_Sa>-h+UHTU)?9miuAg@E}Zwu
zgd?myVb6|Wt_`yuE}WKF@%huT4!6L={8fKMPVO%Hw?4*Ib92-byE#Y8Z}HD#-g5no
zcfD&5pYyY1;awu)%B^Ywe9;Zft`{%)t^clI_%lhl;l2Envw=qYC42wb?01~h^M*-J
z{P>cOSszR9e9@CFQiy8*btF8@@4kUiC7*8Zy4o7g`D$kl2FApcc4{@x^X+t4u!C>T
zi6leaZr_K-VsjQ;o}~EJ=3EQAJU>(2?z7R352vO4`@ZOm{XMzdM~@FnHeB8BlC*Q)
z>zK+9_3bmcUkmctc20l!aEB#Rd8GcbpK}G7K1?!{^)wPz6l!C8V|H0C(QU=mugfkz
z3T_OqKd}FMC1=~A6_M7@TN2q;sw~?4dgCQCNolrK4YkJ%ZnvGfAnmp$Zd&s9@+<9e
z6(<T>vV1(*Yl@CdU9mOe&S8n{;x^-gb$wag*L|ZHZZJ+iU31Ke?Fnnklp8uslj2{h
zo?9fUJa-1GyOvyeh2;CXDLXeCrrP{qxnx~adH$|Yjk4Y&Cs*ZQ-QOH4Q&_vdNpStR
z=q?o1TX5z*tIpf5Lw!$=1o=;nv(#xbxou`%G(U2g#N!ub3Dv(3F?$_#b?<sSOZMZ5
zBmC!BbhenMzhNq8d@?J*NTrU?{F&ml;JJy;!uCb4x37Cx+FID8(amrnqbJk*Zty8h
zei5IO#*Y+CrcFFj+ub&4#yUst6>5zw;u5w-D;e5K{<BLM%2z$)wKcoTBa{8By3vT|
zh`CcOyVE<JWjdY7mh&_!EEeg<6yN$#_OAO*XT#MQA=?a>*esXdZ0_(uK>OV8{OQY2
za(?YNE8})rX!1+X^b}Q9wS}iYzwTP9aG*h{@Y;H_RTDfd<<nnf^3OQ?N@@D{eg2ap
zD=W8p>22ItXgO2lir90B)s_bi6s>KVdgJ>w%cvtOw%1J#^uNTLH|^TZD_j3Cbe&!I
zXwAZ`#j2}bq;)x&%Z5y2n#1In@8Om>ap~m=DW^W1<=N97a%X<TD($NKC#v#qx~JdT
zU!rdRQswooCn_5b742T*#Qti&pzwtozm9R5-TZOm?B2vpJ5r4$pP!un<h1+Q{rsDl
zci+%pI$e8Oa;m|0kxOi%am`0GL~k*!Jg|4x+z+qVUxfZ)5E9NhzCnH8Vix08KG!R}
zTUt5tHh-L=Iwk70+0B=CrSJJ%cV81y#QGtX|L<InWny+5A-%fi*o8UbWCd5vUBm6Z
zrLf$Eujz_C=Oy2s&;yZ~{X+R0*-lQB>aIL6XT?+3bGCXumwn4GNcX+lCMy=oH{rUv
zxyp~^L-EGH4euBjzDO25cj(Q_cRkrXN%Q2_Ke{|`m95^hi>nKpT@L2<bUTRDG^lCM
z4!iob>Z8PyPKnx*_(^@I6`fr#EYsyV`GBEADQ?HUlu0E=eYS7gyK$yd;-oTPJA3)_
zY<7x_oM)ZSnV2ya`f%>L_w!VM2AA)FG8y@&YO`0=>^!pM{hi`7^?VCGJS|Ee@$3@d
zx{`id`Rla5cNP_kt!-ZO;cRsK`3DI$D_Wyt;_V*SXsqcj_P>!(XnQ1hr^7MUy!}ab
zhq#j)PB4^aP56F&`ke1A&ypwg$4nC3w`@TxV^mOilHFmprHvIAZ%K-6->l;B<0WsY
zxs!yHip1)q0=Keh)xXW3pFN#;{j;u8bSYod)4LC{q<zlqTK=^{Yqxpl8Lu`s?H%`9
zJAVE)uw0T8C;sz?WR}881FI?GTnbNjIA1TUy_!7j;6kl=`LEOGY&u)jtFr7>HnXT_
z#+&piBgQndGz+`%%=fpXO4h%;nmR9S#hrHDfE&g4Cp}V_XY)&AYu3?SCw9xWEuPx6
zVG*Cin*AI3cNt05T5Y|W7POGlkg4OHH@AuU^_*94z4z3AJ-^zd%#PJekj*x<tZ`n!
zy(9kO8}Ik_wM#GB^<z4RlgIDonOvonuU}L&eRysp)%M_&q&8boAlo?=ewX~Y&c5ZI
zEtj{31&GXa`X1!IBEa;JTXR{HM03#x#)aR~u3zSQ<@R^;35h!^gbE)z&wl?QjyvFF
zr}dHv$2vn?CIsp{Je|F7S#)=c%?6ddU+xP2e0)4Ds&vs$ufn!!x2^N;EdDuf=h4gA
zNtP`Ja|^gP8(!Y-KC#f{aq@~HM>W}`=B;v7o93x?NtRho;Mn{o>hG2{uG>o$)XX9p
zPpfWl+xz8u^W<Z$84jBBt&V&wtC)RV^1Q%?W#Z+0kKfErJCYXEwJ7U&{=%g>7hjkM
z9@DQrWNP+!=6qAp-#VtRj|H#an0DK6>&Bqzk5>wMOn<y^WnQ|dgGOiN^I0K`CNlQ(
z;#&F_etWExbzR~Duk7SUmhDz*SH3-xwKx6yRpfHa4*fjIyil%Z(SBEZcJd!f5fFRr
zePE999uDE$t6SWjKFQp<X3sqT<>GJH-W90)UsljIL*n+9FH<wJ;%3g14E}noqG8^L
zwDv1;xi1R7e0a~h=BAO#TR;CJM^4N<=<sz{OtFc<a>v*`%lBs-Un$1txu{^dZGv8)
ztelR-qT@zei!3+p)|5^0`;ad?(|Ats*2Qfzf+sFssdpmbbM$?^WsXO)ySk$V>z0^1
zbWgh8*SBD`Ue>(s)Tq_g!HZv<Ip!H9Yun_?D6J_|e^l*kMAH9>YjO;3+?Zrpt#pp5
zEV(bWx1RsJ)|b_bH4}2ybISiapnLm>&(Z5sDz$3;ROc5K<pq7WpQjl(U;j`V3-{KC
ze78*hA2)7of7q?%_q^#?bH(2fzr}Os&w5$dv;9?vTk1m>$+_K=TIL&Q6xE73S;)tU
zzF6iQ=NldK)-snx^^lK2Oq~Mj=4U+y@Aed3RR}!ztS(Am632<R4?CB>h}-10i9f`>
z{_K)}&iaN&w=+EC<Lk7Z{juevdRE_B$L)7n=DoF3*X0ye_nrMrW0T+Ji?Md*H@!V3
zZdMXL$6FTvO8LxwwkXSLvzwmpyW30Jb2$UNv)XF!y>FMPypnlb_K?6eX|a9Z_bmO~
z7%qOYyRdfU!a1jAcyIQq5&k?=E9B}TeaSpczPzl1-#vfHBzn~TlbCrzZn6D~V5wj(
z39pB32SZ&2M1SVF86Mg??M-rp<VL3_9$O#1OPiQ^zf|_Y+tSo#^F$6S_PkZk&F^kq
zzC8Mn|L+~rPktrMPT4-quY1evIhEOS`qF-uDjr~EeWM*-{)Y9mbhwekwp6||GA(=)
zqCHoKSaY-~n9tzIls$QayW3jZaJSy{ii>h42V1k}?YFbJS^x9d1B>53rzaLR3x%9N
zGW*ZF_jysb%6~6!m*-!wq*f)V#GTo2!Icj`Ig3jFoX-$8v;Opa`=_(Z!hB@<48&G=
zJpV1PC!v3Nv-x@bw)<6yw)?}~{+~YF>Bo@zQr~TUfr-HFqknP~kFDKe#8bsrTXEmV
z`^@pZpF3g-N_I@#9`d1|bNauX8!y~;m1&>R<Z|bKQQ(=`sRlXjYEl!X#Z}EZa(SNr
zMY+k#wg+k^C2?8n{j^f6Rmga2$`x1r(Rj(v#Ud<PF%rcM)s9)V&+Sgt=WhR#wtH2<
zuBCyqcHUQW51ZN$tgN2ne`AY|wifrx-7Nk_4Q(gaHT*Bu5kH~4Fd}7x|1<3^bFL|^
z=Lq|<+3Q4t)~k$Db2h&Bk)6tIam`@M=9&HP8vZR}*vQ^*r@X!K!`ydVAKny5oe%$N
zwsn8t*2XD**B>`Et;`AjzjIZ7M7FG?%>B=AHZU^Hw7t>Jk=I?e@AvL3_uy~2uU^>|
z{fY_R{BXjLx<H-ur(7Rm7)|yYbKgu%U=lm>vhl>qi;edSUT>4HIp2Q&U$1ek!8eU^
z&xL1&6StULIWAM~caP7iKTf*h(wx6Dny)7;dfUBw$qe1F@*|oHJjG`2p1J7@ck4mR
z+s87c#r8NlOuTe*Y3sskE1a^|m|B)@)X3&=+?k>5^u_R9a`88|a(k&)XEz$|Is0l(
zbDZl#mDDd&F1el1yenmK*k5$V<7;<0lVexUkX%&H`?#}b$;%&)xc&*Mz4BeK;wYbP
z)>Zq18)I}@w<g+p{5e=1pc-H##Qmj5DZbmkZV#XP$>15My`$oPncgzm{xiF{D%54y
zliggNv-ce+mQ~(*V8_+J8_&mTq(5i-o+j6OyQ-OY<>aXkbXJt!<3FDL-D3eObK0eK
zwK4yfrd8#v6S}f4<MrEVwzaclCUnbHUkE>~`rLF0vz}v?w)NwAH6HCE%in!*SQ@y|
zXHIq8vCyQns4q*McW;m6>8zXn_RqPs`9+qGf2elY9eM1*k$555bi?{@AzRrdOMYvc
zw`Bbk_epbnm%Ove`^PM_r<(1nflK2jHf8RGvrAlkG6Iu}zu(Ex3A!3lI>+|s72jDl
z`)hPnPRThR{gD2q?Cy)1Ss^pmxIL&yjC<Sm*tPBdj0b^}@AS8ydaWdRuq(tkRc$g~
zj<utNz-0sZgX<1oZkZ8sSN2hgt<9Vxe!B8ggp@;i6wSXaOPhad@fkDLZC9>ZAKm&S
zZqK#Ql$^RFw^^&6q@BtwT=G+%?ak^FN6s=9$^R<+CbaZna94b?^s`gn7!G8_#{H?y
znfYDFr=sk`{Pp*0EF90CIan{Z=T|}3uQ_j?$NT-^m=L`8x9``5uU9W<JF|4&k)57m
z4>|)+^UP6m+ccqQpO^5#GmlSRY=0ciu730Q-^YI+%lj`{vn2R;c6p9$g<JIAx#>Am
zUN#+=+x(<u&79Z$He4abTTiq|Z#WR%YVl6Y%*bKJAz$&?M{^WQO3aQYMhnfBwBkFo
zaO)bc+8WC}iu)ICU3$1NsA;)~R--aQWt(C65lKrqL#^Wx{_pgqubAyC6p_nZ`r~9M
zU(mnVpP1Bst&`6zhzRb?Ipu0pWb(P^Hj7{J(iO`VZ9E-i#Gm)yDyO%KRW|#+%rVCK
zY#(Ou3OW4v^`zwgmk*)eo_$C??wjQJ$NZ*>`W3~!AIj!ioM+bBd)8@}Zb{_n)n~I`
zDm-3%?Na-PuP6O~uZXyxq|4j!UoZP*PSVC{pLWKc?wfKX`mDvm7k(-+OoGSRjxqBt
z6%{t{UZ@or<acSUp<=@a(*+D7|F_EWHavf*@+`k=cG9U&TIt-^0?+U+dLbs)sy4q}
z#jdO6#77~k?{5A3au@IZEaEt^uB9=A<Dix8Go}51S3gy{eUjnID;GANFUNxznH_{1
zx4W<3uFS;qaAL`W&Eb~2uIvfEA9S24=|I1I|2pp<^Y>4*Z=S}j^l$0*bxeO}wEkVA
zdUsELa!<~Vu3i7n?%tZq{ZBi7o4%CD2XURE!gYqvL_7ED)E}KE+jQce=l&mo?9VHm
z%THBZD487AWBF#wL082aUl(f}lKuN@{_o?m-%UeqlwDNjUKf1W%lW{ID>E)C1zmZ5
zad)D;`oEd_tab<1pTBjELs#L!uRfPUAM!j67KD~nA2s|FoLirmuPv=%t30D+_rp2m
z)f@h5zQ6W=)+UDZ<pKX5Y*F^I5dInA_5WwfJ$L5D-@036HaA=l&^olr-E!Z#!h}P{
zNdn0hEZ<J<Ing7qM0X3*&Wcy6VdbaZs|HQJ_{Qx6hh<2!;^EN!f&PnrylIoRc)M+z
zsQl;FS=ZdFt52`<`Sa6v_obxl+j7tMt$fSJlapN>d;CV(v$|tvIGEn9ik_`=A<xa!
zVXw$Fr}ciD!3QpKJvL5$>Bw?ktoHZAvoAsCC{F1<{owg}3!{~M^Z&hi@%HxL@)P>A
z1Cma~vxvTS3AJ2w)b(Kb9=0i_-;2^rLa*8yFIUSpPP1ULOYmN%yrHYe_x~P-h(6od
z%fFe1<v**ubLi}yMQoZY9zP9TCH~Y(?8f2R{~xb%&Plhg)7O2-cYp4jcl#@arKI;s
z{JXk!=4I7*c{d+nX>aH1=qYR~UnMvfzCRJFapxjO<72JBKJ^6NOP@W;p7byNC9<vM
z!E6;hi+B9LZftZjD?GlgZNmFoGB@KEP5*o($1`bRT+Y;;x;uKxcP&f4Znl$k#|`C#
ziVW3!b-iwXNe0#e(N&$7?tOS&$Hn6CJZ^zdr{+P&NiWm9-#)nO63G0ZG|V+<Z8-Nt
zYfklKlgZncR6V}!=c3HINYd8T_2--mjpuq7yz+{!Pz`O-d6jhRpmgwDFNWEN__jTm
z>ZE8ExiDZ}rS2q?Cw@f-_Sb9{?Rv@oZ0VD!nHzMcBpa%COn>Kkrm5+=%zxhn%$BUL
zrTh-=2=|_znY89i*z}skUM+F_852IR#=kbH+kMrfO}6!($9_rC4EcHAbeh=8-+tJo
ztHe5Uf$Deu9a~rLYLTs&{zSVXVNnxvgQ7d@;r#83&m67Je{?Z5`$$>e=|^fBq7#^P
zcvy|AE+#I_F;3595_!F{D|%tmqU)Ud_8isNG<nY)tt?LO3eGKcg~$I*dZDmp@!!iy
znX^t@@ix%(i?uLJkV?4wP($On@TA?15+B7MW+)_S?Mx|rz<b}NLYlAr(kt=zcS4E|
zD_xE_o}(hXe^>jp%xhXKa)}IE>Q(gD%+;HI<Z-rp;>SJ%U9sOq&D*O!sp|{gjQsUR
zva<iI;r&Is9ahfV@ZjwCBgS_B?P?CbN&IolXXWpRGwXjJnw|51>72@*eJc$-I~qKa
zmj@re*EX+XvWxA-cR%)o%@Ca?`P^q;d*77BuXoR5@3np3`gB4apYpBVS5@~4mhCWB
z>V5uP=BvArI8)P8{Ts2rbfVN`1lG*TxYL<@@s6C4;_O?Cjn2hxo0pzEQ{&isE>~VN
zFRuCJlVt--**{;p6Lz{VV^V~;cAw6g)9(}JhaV{A58kLAcH%<In>pHHKW=mL>o0G3
z!1qYs<Su{wsf0V{q8%<v=-lJbvdiAKO5>1&?1fgx*9>>IdmY<*dW(y|DYclE#k(H*
ze%aC?5+uBL`M=(MM?!B4-+$a%u>H+R`Hx8r{MC<k3(Sr=)McnSb;6!qA<u8UG7?xB
zK7C`hM$}cF;Cjt_zx6LoIXQ9J<IYyrmb^<HlbmK1pP$EfKlJ#O^o84())qVE?rmGv
zca!CuVcV^OeFe|geX^R(C^p66`j*v8wHl8+5;%FO)w4hQP^Ftw;k!3)_9&e;>XWmO
zo9?wvv$Fj468VgYb1h<nc)OTCP3fx)lYilpb7X-hZ`(zsDQcJbiqk%SeX}S+?W)TJ
z2bl{2-$M5+Za(bU>AvUq_xJbT$nUG({{P#9H$OM;pa1`5^^uPE@$cr#oJgPcZl%Gr
z11o%9Kdg#dl+t?m`H!g{4`#AzJ(v8q;cLP!164_%o_Uq*|26Nb|0@11P_^oH^AjGe
zdF(X{W1^Lg+8Qo<AAD6|)7G+xXNBd>mpo5hbSn@2{`F9A1pnkW9d6|tw#weV<tJ3N
z!Mx^D^wiWm&$b!s1nqPSE<Juzx&P*u$`^^Ja}w_JC)%o3GB4Y<dWFDS4W4-oHaDI+
zn<R!G-XUZ&uR(3ciGpn&UjMF?bUJd}dKdI6bZeIF;>O~T+M1&q|391lH{M?=K4rx$
z%Z@#DKeLzJ@m%!F`TfEWIoJ4&%T_ekef)axcXRoAf2H%A<oWK)u;_nS`1#F)yT@k~
zzpXdXSekOR%vE%bRDJH3@VO$a$21bWR`(}7WlR74;rp>)i)$9%5mHu=S~cU!&9`go
zzHfK?JF7YHVli)WkHW$HGi&c{JJ0-e_LFnlf)4d|vu^S@uvx3=xzM%^5`p&pT5L;y
z%{8gqu-s8DV(rb%tj<N&%jdKmt2r9K{gOzH=Ry~b{p&S9KF`^Es9|44iI;HlpC4xy
zO_=j1{E-UJ&*KZ`)o5ldT7O+9-a_Do*Max!>+(1>+XOd>bQ|?O4vF4Ai}&Acqn{QQ
zv)*_du)gxd?}k`a<U-~CQv%U7Qoh$sqeORq^l8qV;JAos;<dL$DVn(~f`2Y_?x?)R
zbT>VC`Jv)cWwV#x%siCeMrcfU`DN7siJRU}IF|==^~Qxy$@NgZb+yK+v4(Z$w`JZv
zOZwcdKF!iHezvINWMN4A$%RGC`%dL^O=gntmCBo*vD<-9YRcp3N^ytxKb_PP$msWV
z`{`GCF~=1ym!zDEN~jDzeZj|aYF+EH-#e9`7F+z5xU>9E-;|PFvke5-7^UiEE)aIo
z%qv`T?diIR%wzYMJ&o-ar97U}a#3~r-lPgkADx}=i?a_O5&ZJEC;ZA`QLEy90dK7{
z-#10AY&kk*-<>b>mDnw3?tFI7bm<}CeHNOQ%AeMpc)q&m*;Afu3x_+w+s-SU-}5NV
z*7x)0wW8m$6oVfcyC+TLthnlX)8TvP(~PI9KYoqPyRFNc{%dhk+$@H#GxWHe%FTXn
z`?>1j88NH!m1<c*l`EDwly<0YOn!cMO3=Aa45`O=3C_LJks@?XvG3;EO3BYH;j`55
zmI_W?6}NT^=k8UO``y2Vh2GzHc$NF#8xOO7J^2=5IA{LtU@INb4IA#4exA89ddY0J
zi887dyB|HCP_c57Zh%<P(&K4rhC-L$b?dZVs=U#9<Ko$OOBy@gFDk5l?y2<q%|3JG
z+9i+gJn@q$=b4{$<w&6Gx5ou9yjS!}m#w(G``QIYzCv~1Gff-~EA`hMN_Lw(cWHA4
zyQlvBaIPOu{{3Xo?_ad#*~7reI=4P96Z^U7iRC75{Vjgk7kn>IF4}i($+5$yG(I($
z>t30bE;|2`$xm+UH`h+6yxl0r$$4V$jES;_OJrw=Ssq!ZJY&J?dE8U0y&10Nd{IsI
zx6E34XXSO(M{Dz@><W0<Wb|Xj(-qa){`~izHU-LbU#xar{_NZ~bIrtCAMKyKa$%MI
zrpL?ia@#)fLOt6<?$Yam{;<cn&wTTqwY|??&g#Rrrps5%6`Ze^KD+1>`O_eXasKH|
zYwi|wZ&bHr{=~>`kQnGA_~YIFV~3N@+b(`I-Q(cQ3pH~^R1eRu-6*nj?!Bzypf9#F
z75^HqpI0;YeUa_<=L~Xp*Ji~<?g~9F9Xz${LS2=W!|glbVGL}y_CNk=6Y_UvyV6-c
z9g({%t|@$P=e-ZODYSBp=ds0E?K9(2{@k6`Vwk#lZqW8CxfPYB>z|$HnkwM4tYEi(
zsR+k(;lk!WDPB7LoW74ryRWEtbxJQ`TNocuyIDqS{(?4R52r~FC;XkTI#c~U?~6q*
zd_S|@dG|=X@6?{M3WGjN$@|OWGOw@ie16<irL0C$>QVEt_mfkDqmSO``YD?GChE?@
z6SIGP=$fVYHaYyS?WxlYI|8(8CY|U>TyWRGUashC=Iy@F3AXjC%?fT6or+kwBtUS<
zog+aTcll0M+Nd`FQDKH|`%|5&pF8K=+jenkp^R~o=b6yYR<<uAEdATRRc>7LMD^kQ
z8n?@A>{EYl%+<dZ@zx-?@OJJ$%joO(CuptnZ#`GNxA&y$;&t`kVnh!lUC(s;e?jhM
zn0430zJU1is(sR}((ldcD%0Oh`M+RUlKEo8x`nSrm+bNXvu)yZgWx?gr)DU*>ur5K
zCt_Rc0oEFhZ;#!Zd73WGY|qoW_jJ~g-@HXKZ0wV-Px7)`ernCiiPtAS$}L}d_Mq>^
zJ(rz~Po0lqN&OfTopvK`!3w=uvTd`}Ow=5uf349Ivwd?`Oz`-fYfE!I<}s{Qs6K1G
zfGMMnJ3hKZzpv~HcVcUr$?Wv|YZ|UR4K4Kke2gP&Qsd=@8yh;q424vKW?C#w3=`sC
zoMUls{r)o94b1-6lk9fQdU`thY@-Xu{Er;BpX}H&RXpTQY1FspuP-+X7ft^fn_N2c
z_|KzmmUGI&ukt0|pQf_Mgt>Rd!JC_T-hNDqt9o@$W#5X3*ZWUaty(u@smuxE1uj_|
zT9TK~V0+Fm*Wliv%Q-o_pVgl!$~QGFywkDhsOGuriw&GoIuCP3pEvwa%(iAy*W`C>
z>y0zDb+o?<?r@*O+H$nhB4d+``1TpMrDskGy!MJi$C~K{XY1|K<oS#KJQc`_)u~cl
zbNQ94l+gA~GM0fa)u#Lt%2?F&W(%9Eb>>?2mwX}jZ~DGl*e0^9w13A&!S*RrdS|jO
zJaOrNcd|iWlYvE4)vW6_d>YklN8=s}i`0E!pRM_N`MNja=CU5;FYl;UCoQ)X6)j=(
zaa?yr)q1z}t$!}ooR6PY1+M;GG51YfL)(EFujZ{WoU*!OU)QNJGu1ygYl{2+^N8Mw
z>x#T^$>)LaueOy3_Z93_Tyw+y<@4H1m06h*UU^~qTaDBho=PtNe|24s)p4G?iyr)O
zR4!t;?2&%kMxgSD?=01d>V1qA9h>5~yY5{%>LsgZyEsg$;m+ObhqN4S@6xpUC3pAU
zgx1iR=c?-#FIQH0$fv!0+RY=YHPT&M=VX1_|5o+9^-7BliLb(;lV4d%vY6eKnPn#C
zJ-Pb4*zt20l`WpSE|Z-)@8U5f1HU6Xj9aR2?}`y^wB5T}Wu@wJKT)Nmpd)Jqw|aQk
z{F`#+oHf(JaCWxT@0p9fW$q{z^f=Kky!Lf#c=$8s3)1%j)TQnz3LU$jvm@!_sgE~b
zZ;IddHebZ%Uv3L;$F7A{wXM^_C3nT-y;$h*g7<0O>ZheoeyM4&XKY*LcJ*1C_~}hi
z(^l{9Wqr6}|B9?^zV79F5-;v^u~`0}Eq%{Zab5Qct2^`WGd^bjQOu~k=;OOzHyQUt
zv)NtfvA7ht=!MU*9}Uw4K2#Vjw7oF>(e5(d+!Y>ucW=%3Enn`Ob35?9ZcO@&2lM`^
z-V0vsdG*M(O;d6&#%HJ=@!F|!{!(I1rpR{f>6L<o*Dlxk<t|pSo_#%I={v2~CvEcs
zf^}}0EczqH>n-Y-{JQX9MEsdJ(VsgO+)2%qym3o(52McKSARbqJbCcr@#Z&w|Go70
z{pEkHV0&Bg&1;TJP8zz||9|-6?Cizyn<mHK-)C9#{j+Dt@>jjDJ{qby-_`Q&yZ9#M
z<uRSDfr&pSSpS|J#kep!w4cTD7qiT!scW@wdgg4Z4}IkQqUT_Rg5G@5q$4p4OCOp!
z|8k3eU%~rl%TL9M9~)NZez7?8J+>)vosF}l(T*qc-tkQ4XPEWIX|9vt-3@%}n-qV(
zo@f22<BQOV3Qg-xQpI|U)zY-H8KQizuU1;<cEfTC&vwo5qoI7JT~CEh{+@Hv;nUd<
zKMishCm$4Awo>(ymbA2ijD%Oiq#0V72|VnX=dZdPSo2!4Y-h~I1qMMkYRt95uU4+u
zzU+g}h3d{}5BE6kpQ5r#J;wHBV(UYe{cb|>2Qtou94z)-wbAMJpMa$%w(^e(*`KB!
zx0&5_QS?oe(_72X&x<b1p6$GKeKku|IMcR6oo64fJAHuRJ^!QK$-y%mkN;SH_k_+L
zAFW-XtKX+d?7no%sq%cV{mkB@9JY7E^EeB;+E{BVT^eo|m@pmw;@aohBy9a7phJb-
z?EQnu^SbMAt1SuN-n`-AoaQ{cZ#}=0o=4xl`AsZ1<z_K&-M@|Lw=O@KuJluU;<=`+
z4xeRCJkn)7D=Cp*X)-^xJX2xu<)W~4I}GNx{;bhq_#`sn>RO`}F8?*HgzFYOn#E(h
zPHdZ=aL?QGVT+{$7-F)7QZ^qtUt{|?=lR~M9c#od3q5(PsPMA;-_6b9_wI%KTwA5G
zMCQRlLk|r_)7t(yp*(*oeVo5DUDf*`_wQ$QxvcC1#>>^&nsYxhFWNe#axYV-TeN+=
z$m-~jj7`QT?my*ybVlI%_8sCC$7X3P_2!liu(}|f8Ikq+_qVV+R&QK<52PtF&UQVs
zwj};UQsd0b$qws<dpC*B_VAt3<oWrWnb9}#>_1l>YD?I+Z9Q4^S$0><-5YD3Gdk7B
z>K%Tv=H0vgj9-u97&fL}b`}t`|99(Xk?l<5S?BGymgvt~`!wXBPpa3QjO$V+0?{W~
zH*jYdb8d0DKi#ZVqj!z{;+X8U5e`jkF#)oF9|?&+KmJB3_T-MgcV=Gysg=L0lkwEQ
ziSMsXxN#>=@uQ?}VyESisEHgBp00vd*0ME+nuNWW$ep<J{z}JG#?{+{qLin7mp^*3
zmTg~loA2Y_COf$29CKn?JMFdLKdIFU6K~~hIBI7S)vg}I^2s67$^FxZ%S#S62L3lV
zdvT`42~z>5^1FJw7BB2B-PNpQG2@Etr`HFZu555Pq+wDj#PagqydUmXvb`eal9H{{
zS{N=${O><6^x!oklj_Q3lh<E0dRZU&Tc$<tKJmi9(o((C_&{&yu16h<rZ=sNDpOD|
zm|bD3$n>`8*wMMwr=D?a_|5<9($rP$PW$gquMqN*c{XqN3TK`vQ#d<~dQNCD>sYxh
zy<seVedm9b)vI#fPI0_zpuNFadC!#;_HXyMorx>?w2qrExUsuenq4_Zs(r^FzZXUp
zm4!2whb}&9s<Z0FHGv(UBV~6p<sDu)yY0lv{zHrEnaw)?l^)jm`*ZO|?|PGIvBxK#
z+4zL}#oV+rvrTTh&D}H6@RF+XoZicCx6COJy4^SN;>=Ce;vL6+rRC2$uXn6+5_50(
z%aE9xuBvxJGcTA<I~aLq_o-})L(}&9PuV1HedN2re2$}6YmGh~n74oaMZOwwmy2CT
zeUJOwT&lYBYsT}B7w7C2_#Rm(x%roohv&;M!J7<Ur<F%WUe8wjVHKh!%cpBwb?@Tq
z$d|rTO>^h+*j|ooygOy4f~sUtabxwtqxIhz=H_qh`X-c{*Z3t;!E_bl&rLqQCLUoc
zDhqr#3ucS|teDNW*!*x&sPYpz?d*9=qgBq`d#Gi7GAYvMl)uM>DRI*l2Uh64c``Lx
zcb>1|_sNo-*W(SRuAKi~@!nL~H(i!8dZ(p%vce^QJgKh>wRq0b5EhmHgFo%Vsyz-%
z&lVhi*|oZ*f3u+U2aWH49~aM9sJYZU_3m!*sDnHGOik2nGR-Yd3;vw)P1&dKwAF0!
z?QXW)mYj)hy|Y*P(2jO<^Ir@u2V~c>_xgr5Zr3>!SNnWkb<?zTnM{G+^Pe<1f*xC&
zIqhzI%oFaVm76g4!zb~p52PPm+H7tpA6zrNDez?Dxzwv)=WUP_Ren5E%ixMy>dtpI
zp%+g}y<(WR@ZMJD^6<4mH<Du)%g=o<!}|%}B|jNSC3(ig-iWIAB@b8sQoQQ-!vAca
zh8NepkhpW&79|&tzgAj*T9B3X<n!{A7dd^-=GvWmpVjp+PI-&y9v687R`2k4b3-oI
zL^j#<?yiqanv)&UrDm;K@NN1}lY=uHRLtM6@Lqn8|Ma4Y%1^uOLpJb*pUmxBb@eq<
zwSk<t#HZ88w3aqrvzB4#JexJiQefs%HCyKys;t~@Z7aeiZ4$fZdoB2zVQ|C>BjrE^
z)wV{?#`i*3_!Qk&9q4%Exzs84;DS??k5+GPd$#1xlD=n`i`|y18^z^c+`x0*@$X?n
zje|wbXWoXY|M!?DyjQgUpL<hZ*5S!-K0JB+vOaGEM`=icmX3~F&w@Nv2Pr|;DPE;9
zqG!tbw2!o26>Tk>wfe_L=|`4JHpodCS}^{J-WAJobG~j+PoQk>2EpeW&O7}MlzSq_
zFZ8?B_I>9^`{HBw?W;GwZgU9cSvK#c+|@@X<-@igxUlm5^wU{;Gj?CUtQD!T=b;g2
z#Qs0schn3Q%rH8)%I#M0w;z&aF>(F{Extbsraansw0WKW!5_R4Wnc7f$L7`EE|3&E
z+qU@X{n@=vHOf;3E|eEK+>V&|U{meFC#Ca~?Jt!bY}0aGnOPJ%@Ah2>)%s0gGF-an
zmo_Z-bBJ|&DALM*bhGy)t2%K5#}~(rt^aj0y!uNpciY^l{1-dD$|csA-A`CxJ#Dsg
z&N^QI^hK{7`1KmgoUZdQSfq3)=XNbN_Ux}zn{aujxN?<%VATTQs&~GIwwKu3MJG+1
z&@_c7GQsQeEYAZGMH_aX<(PTRr&Bs*-W#3v%O8HfdGXYK>bc1iH#r|txFfIk{>e<E
zCEr(_aL(#t@!B$DYU%SUrsu+*W;DvU-{IriH~n$bd*NK^oYfNNLpMAA&707-w&23;
zq{vutnfO1`DkSIrX;h9^yR~f2hh?)qY?kr&`s{VGX||2Y8Fib)-BP!6%x8Bpdw=9T
zsPcc~X3teqK3dH2GTmFXEpy9l--HeP`<IwD`NU`}pElR|Ozc)4zK4;o4Kg!#Ja}mp
zl+OBHs$hxs23?+}GYh38tz}m|de-RYeqH(MOo>xFE?jfB%%3KC-FV0AxECe6BSTIm
z&CxN8-Q{rj$YiS(yd9!hzwY#J*2$T+?(xNKp`VxC&y-Aju}nIW)$saEs~1NXCvJ@>
zToG+<G~vjd4;+D~d;?FJY@b@IX!6R>yCC&}6#u{SEz)21<ZyU8O;^Z$Z62`9<J3HZ
zI@Tm#)fY)KvrKLX{c3CRZ8cIe-<BdBnqjVEvW5Hem6qzoqMO>!F3eSI>YSO=F*{Fd
z(KLr}PLIuX8yyAS)Y(3~-ocq1Es@~iDY)&5lJTnTxs&7rB5rInioL7C;&yFmcf=20
z=XL!LxSk4g7=@i(^LAG7+k=l*6&zRkaZ$Z6{F0sD!dE}zbGQ6gE3B5*{JGKGb1jei
z>@(W>b1K$nCq{6&a7mt6u_!_^?(ALe=Tlyo)My*N*rU&RrpTo1)9PbO7jJugb%oVE
zC8o2gTQ7xg{ARjL!KiEd-96iEwClg!U(_w?>9y_rF~wOmYegm>{ZXiEex&gIi3x|)
zT}z9%?$JAT@@VX&em8~pXT!CGOctDY`c$^M=*O(MYG(5fEUWZ2`63oH?YyP&(%bCx
zyfcDor!Q~vVDqcL{$}=V(ZhB(-U>?vx+-7I>h^h_IDNsAG=;!WmyD^aza{Tc{O^+E
z5h!tVx$fh6c87SKHYg>z^*ogIb3M@a;PBc@*ZNoeT(YOdc1B^8?B`=`CftW-*KOWg
zedvMlxhcn8e5)_A9Eubbet9K!P26Iw+T;|IQ=z*XR<^WOE#1fZtzwOKf9vecX;=K(
zquv_bI)41LH%rB5jlhyi;%rZAj&AOm&U(rqz{z={;;n~%ccV-`%rD~o|LTJWugvY5
zkcHuEo;90p03Tlw{i-?JL)}es4zs|Ptd;ep7td{-`kCiO;~BTRJIxa=3C2av*1x};
z|1V$g(V2R?W-5GDs<_5E`GfFgPNAvu)z;78R#g_^n%5aA8JT$2?857xtL7AGsrJ0#
zVV0WAZ}ma7qNi`VXu!I{9LAC(S$7g!gag;FNZa&)%cW<3%dRBT-J5Smo&5is#qd-4
zDOQ#PT{V6==8}6K{BiyH+GEmQ1%cFS4F!uC;;+8%xm@?|?(+XmF}JSny41dQqTuWV
zg%9s-)~EYM%sBVy;-*XQ*cvCdzcbEUT(W#;Fz?CtbDEbaZ$7VfMC)3Zd)xh#{g-*G
z49knIi7EPr={7!nQ@iO}NxI!Z5%rcuQP0oL-SF$P|8uJ+PbB>XmM;-oxbXVsGi5CL
z<yZ8lub;lOX@yyC-szOcWwlc-{w_Zf$92LfSjBahQ^Tvf#_en~lglRGzw`2!?%Nr6
z8z1~#wp?uWL8d=$pMOVNeQDOL-2CC}w9Nt)+4t+W)+k(?x3A_Hi$*n@*UDB;gI&#B
zpWpIaRupc%cU?;O*7Aq9-Ibc7YGr;q{9RhHa_(=x&EMY7=iaIBGp9=Z;RK($WThMB
zXHGs6SRPTNI9a;Vz0qv_qUjssLtf23vt;!ID{CFuqH`jF7i_b0DyMF8nquOqlXA=c
z>76BiVvcgiPkguLedzg5-Bwp({clXu^11hhYxCr96<K-OZqMzmtTNukkP*70<ht|>
z|IIfO?e~ZnY}5%|m~<%p(URbfkJEbVPGl<wPh2_G^NT2Z^vdf(=|_W%PgTqiT`)y{
zw)6R|w<D*njHwWN(7S(|6H5%^$#kyXYm%`yA`H%??<ih)>8(eGTJgeXeO2i(uWA<D
z>T7g3Dt&m;L6NHgSL`}s{>{+6d~J_b>h0;iAwRUDFUeN;{9OLE`i}K=jmQw)tGOGz
zH<nl_oqxgqJ1fUNIyzOcb>p?q+84ztGq|}7)U3bj-D$u3`#@2?1?$U{INLWC6EvnT
zY1>@PFDhSVva~#r?-pC7+Oxx-ebkNJRkml;O_KZAwYuh@S;(Xn>mR93OlRH6;32nl
zzCgd8Is?}$o~5p`)50y>uD;1IKi2fhz|Xfpd2`N#m5m>F{IHJq?pm6D{a^2k>)$_2
zds&+9{d!rS$D+^sA|BnE{FhZAQ-E)}>LmrcPm7Q5Jv@6m%h!WVepb@U<4#{}Qe}VA
zaP4lxiP$|0FVFap8f^7xfBstK<#Uzi+}hBX)^BF2cHa4|+M+8rZ+Wi$8Zl>y^|=!-
zgG$&h-=4bKXugr_ly$WSY#DiXu%#8HAD?mct%LgH|DAhV_W$=U4gYobSmBfXzt_)b
zkZ0TAc;VATi<(5UEgqI$DX04<y?t}3=7NC4gycpE9X175<2(CnclW(pw~viMQ~sd0
z4wG?hXnA<}^^e*w(w6r-zq}KBxO-xU`Mg&xbzJHuhm@}T-@UVL_7?Xh+Y4d=pSLzu
zp1bo@c!y7=<b!S28~LZ-4CQ@UlP=}Y5@|Z;fymWE!g=8$UhRo8nJ!sP=MO(p(Q)Qz
zR&DBRzq@v8LDFT(qcIhU`&LOQ=-hc}`oOG5Q1^G1_e%MOn|~x?^Pl~Zy}lwy;aqkr
zdrPH(O}ExPw*|qQ%I?bsbEhqu(U9Qt@$FJMeo59C-M4&ak1m>{zl&#Gg{z;&iWwZQ
zdQMF85UzZsdfe*Z0?pX)@U_>h@6N8Cn-QsV@K0aIDvql8!Qb+4bew!;{UX6Q`qiq8
zpH+7RY_zPhcgm_+lwEi3y2!X{vBiuB+P|Jya4Y$3Reiw2J&*5_rh0jZx{bn#lIwmp
z-@~prHFoW4db)LM&o+aY@SLAqyxVeK^32rgkkmNxc<J;FE7QL&6MyIVF6|GW`oF#v
ztA6M%%h<m*{HCwr;VX}&w>5Uj$l4r|n<moV^2YVC`ou%&|Bv5^*<`-<zC~(qOaSXe
zl{I>~kx?IiPYEsNdZt=3U+`OM#D!N`em)%wj_$I%U%38R?Zs*8Nrxx)eVoLu(Z8!}
zzQgj1UG+P@Swzi`6wi-(^x)#7wH`0G&E;rb5M}U|k0a6fVgHU#37VTf^jM~<p1bxU
z?akG;mnS|5K6h-_xN=pec}3|D>-e)CcSENx*pZvn@psXZ?~6|-l|59QbpPbMNg=ka
z3LEz<Ji6-IE4ga90Q>e|>24p~)Vb=8uKgewem{6~+qov^y5`p}tET@>TT*fIMNqp=
z(ZvZ{FG~1*-oH`tN5179#~-ErHS5pBT0G9VT08loJEy>DLBCbriyywox>Glw?^^Aj
zxc$8j?Z5J4=Wl0Uf9&rY=ZwIwTvpGu_;Pu8p6q+9bwYG!x2vI8ZL#O$a~k^JjX&|8
z{`g`;yrS`mI;E@bSKbN#ZwZR_X_Sf#_IeQ=cQ(;?rt|~%$ba>U{dEm29%UUnlS1$C
zoblyL+z|5Qz{<_+7b++J_-HBlAXX;tP_NLES&o}!uCLzFGwo8yOaJ1Pd`C5(*&My$
z<iG04y0*~Sre_}fIGnX;+x3(nCjW`;PFvcx_2ypx)@ha4u;*83dgE(fnKEC2S@#4@
z(u6CeOOF?9x6*okKET$pVL{HK5+|XjJX0TYZj#z^LP>6a*5;t4GNBG@Y^?OBeXe-t
zp1w**D<stG*`$Jg{|)!H&Y5oDE)lxzsqDKSv4%~H5AQzw(t7QV<7e}euWyh4)~6=+
zRsCf3q{TB5)Ah<a=P!7<IOj_15`M-@Czf(tKj<7G5PBf_KI;Oj^~<h)5_6E?;(F({
zbHg5;b*rmb3vaIq(bNhwy8FDj|KXQw`+mPF+1Bo{HSvJ-zU3`UCI{Qr<*`KT)aRCa
zm9#3EA7c5-8sYWJ;-S{0A1seT{>gUR=kMtJYi<%I{bH)n&JvSg2N?lb=9ZlBc~2U+
z70$@ZoQe>6XJO<j;LS0ATCT9F?>nW;*SaY!JKsFpG)Ge9Enh14mvk3hovqw8vYpSb
z-dMzP=UAjs*w)tun)hXXy0LU`Wr?2ca%73v^|zZ!O?z^fN*s8;o>5xYcs5Dt*W;2S
z$GW=?ozM}LYyB@1;Qhn5Yya<=oNp{PRO^U8@9Eo>zclvBl%~)IWv`!kI|KGqMVxgz
zk(=tZ!|slgp$CseQ<ZYT<7F(dM%5pSt6qCtRpk?Nm5A6NV9njWFmFpn!1YU_XD!3z
z0y^YWX7N3qDq!liO~m)Y%e2oPhZ|I5_cyOI;Ai?T=%B8APCxQq^0nhC>hiA_Tzwb&
zwf$(V{;^-z7P!4QzjIRTy;BUU-0qftzkFFTYWefGBIPS>-={my4ZI-tqV434C$F`e
ztR5R{i1EjHzG6)ZFm3t0#I-AO?+&NS-}k5+F1U8+))xJlM>Kz`^2jARJ?WJ<oVDRq
zPR?Zulhr?EMCaX}GyNCyt*z(fx4$a!-SEw3joQO|`)gZo>s{QrWB=;73o&2KcV619
z;NoP&BV80e$5wQPI-lp(8@6-je>J-}Z)>%3z@Hx0>ZIq)#~m3Jiy1X}O3V*MFZ|@C
zt*2mn*yo2VkGf=yc=xkQ2|Aq~dt5YM=G@|$9lcd&oseLO<CNeN=eBW{-eNi?Vb{4s
z{cP)<%Q_DNf7>-q)^>3(h`4!pf~#BJ@vciRewxoKQok&_Xj))u9>eEde(lrzg9GpT
zUr?RC{yqP<nCV7J8rBS_Rd49H9d?bKofDFK`;v%K)fQ3X={A90g@I?{m(JpuQges9
z{4u+#=l^$8x6b|OWz8P%m=}32=cl{8nrZl!b!ic?-=h=aS|7RnXn&XdM#t0VU{I&8
zd3TbX#B_nKt7kvk<O!IZD0<=ZKz&yuJFBc&%8Lh&(|2mv)-L(?r+lwbMG{M8>#ei~
zcIMVC#Wp6tYF;?MF6`|Pn7ct~!;+P<{hUwpAKp8ye(gc?j}KW65yp2e^kk|vJ;+&p
z<Hn(M-oEOX<J!wOk1G6~U|)EoN<Z#P!6ugv#twapqXam7mM?Z!kG{!U_+)kTf8Uk&
zmfo)4@-1+!m+9v!x0C0#+|6K^P*6~y^N?%BN7aW+D?A)uPg|+DIsXLz!@k7u=|`gt
zHtBO*VXboz4rNYTvE9Kn;KT=!!~UHoEt7m0UW8Tp-aW-`8Ok8Kv)J)3GponmT{~P(
zORe3K@wEHXsv~zquibihNw~$@S#I-*gn*-8mhH%W<aF#*M251uj*I=LM7ApN7mD*P
zTZy0A;kR~a0%xPVc>&vs#j_j*_WG^l&b_>|_ww``W^3$9mzf#z-oJ7>D425rk6>WH
zUE$e}nx47I%9<`R6BJW)t8~jYvaDNrD`;xV)DzP~{o2-4_3fViOerrR%tr0DYPZk^
zA=8duueesFMkSR$j`7&IyZ6cZ3_bB53f9jL^cQ*9PGj)Q^C{F&FY22<BSk#_!q&v&
zd40W68=imN{btvy<r)(IA2NR5@sp|O%8%uTRVr-`Jm2c@*YWKI-DMdo6fcO^_$D|;
zeJc!aXtqwAIB)u8sV9MUt`)w^wq9!6CziFXVcGfRs?WNQ-MQ8Mv7<p%zxnZzmQ<bm
zth-N-a4l?H$<`2>c(&kk_N-TPdfv&jy>O5-+^+J$%lc7fVf1ERu`;hsmRtGOUA!*O
zA2j=ggloCUnn!kl`d7?1FZg%lS?l>?E7!yypMUAjvfN;xP_H*L{Ngd5ThA8%k`emv
z5TJHYKs|buPbXW@5~*^DgDHvq`fofJTU=A94rSIeFX3VE{C-)P@$JqRaaBuKa2+&j
zQoDLF#4tBobLU&Pvh#IwPJZgI)GrKi|25^{v6D>N>;BAH6~2CT;mp3$rhmySqP)qz
zkM)9Xrnwj%Iq~p0%Qf2?FX5isvOH|H?WOP2m+!i?S&YlDK;o0$+}>;!<uAg@Vz0c|
zqxh$(UU{cGwP5bO1&Y$)mo!gZT&SR*@~1($c;yO#_Z~kSPik1TymdM6a?a)c0juqv
zU5fAibWOY${UTyZfaQ++Og0DZJh_v6a&K{mccR3%c^4R7<XjP8+c_(rY5(Kt2L3Wr
zBuW?QIkawy;NJZzJ>Z^H#n+^oeY`>Z>Adorto>VKUDn6P{_wQ^!n-U!zPoC&OiRyo
zU-p>QGoL8EUVPyHn`=dX&VFC%6ZG!R-u^Qz?T<fZhd$Jf;hy-1<;H|<e>b?fXeo<5
zP1rQcZ~cMC%VwARw;z3XzJ2%q;xem072nVQ`QH9}@Bc1)hpo%<7#!a^_pdi&l_{HD
zz^7Qx<@M>;q%fc7uMUL$E(`2^@P<v8H9>60i9d7y_VJ}`wf)E}!NRHbbMAW+O<|!I
z^H0>Dids_gh{egVwL&QN`Q8&6+S}$X*5wNQ%C}_SowW;p)(dlYt~l6`pQAKqJ^R~u
z^Jcf5jNg|<+TK<z_pg5P^Je~@cWLq~f7@nFy^*|9`|=9*HBJ#i$~8wKZ%#Z^&#5#e
zmCYc(_*;<a23^id_8%^7emnXup3#ywb>@72<Mc;A+Y9e6U#iWh%h>wh`gOkVou|}H
z9Zqh($fMsXH0MXh#6>+^*FFl(Ek5|dw|Y<5>YLHx(i0vy<UHk%I&HfA+gan{9%;9m
zqTCl&wLg>z)-jv&bzgzR?t3zBCLcc*?)YJ0?fsOuDYepY?fLGP7mgU^C#ZOc{C@V~
z>*x1|`Dx!CeVDy|pY<QEeJ*{P`*Xf*U^;8NX4BTN#vPa9W#jH&nrCTp^U0sb+=nJF
z{yQ@=+TM44?PANTF7qDV6+LjAcfn-8r90-`nQ``$`GTFd-_`RxEZr{eU0ZuC&--V@
z&R$P>k$-DX%9Uv>*d4ZikN=|oud?m#eW(}uD!=Jn?asq0&xBSny7B!nnOnbQ>5_S7
zKR-V>@j~ZXp3?eVYnNaCxT^L+irTM#9h_l{zJFLH5xdHJ@dTBxC6+?Jwm9_eI@_~$
z-}<iZ1H!U0B@aW3IS*!JvPD>n@~%5=`%^?_m-<Q1fKM+vru=@=#x>E^`R>ZR^Is(Q
zrOmbeA$&M+u4C`b{F{?RRo-Vt`n28J@W3p}<#YGPA8j(-4SvbVx<_WK@8dShbZa}d
z#$9#GC4pj(Zx>uUdcXK37H1ZDFPt2sl>2O%v4(qU(+x#wfeOWA%Rh;{>Uu4=adFPM
zwQQ$nO?7?}xqW4^PxsNisviDA@rRub=kpycNITJZX{JED{qK&+9zm<#e>t`3;BoWR
zo9k}N=?Z)n$$0f4ZuXZ|7VMVtwZ^L@_xjB7DpoFD;u3MvZ`<$Yq<KekB6|g_*Ubrg
zK0~Xb>hu`~PP;T;LCq!4Q+Wk*tYRhxw>G|vW4`|OU&Ff@i{>uV*<4g$C}1C}H~n*3
zeg6AJQE}_eB~E-7S;6(IxZfz?UG1-v^X={*+<$W0_B($cr~BLe{j=G={@-!-upi6M
z+Zn1h_MKtf_46LT|ARBPem@lc^*s33bK_s_7e0TA{msr762oknY<6wyZ=v@$ckA0P
zthZZQFZJtr`kGIwrta(C?9JJ;rS(at-{hB@bLy7up5Kvu@z^0wmORI{sjhB}->u?G
zcAlR4fbTfZB-6OvTW_;U^sMlB?q^zZKl1hR?JIW**6LSE`0Q}+W%^Yc`qwA%g2|Nl
ze4YbeuU0WAyZzg-Q^EPfdOJ>whVJ8EYh&iE*Q?vQ?tO~;R~>fIvqdcD3|?I2*mn5M
z*>_7c8AKjGFA}$5T6g;B>?fCYpMHCL2k+bMzkAFUetG(~>pK6P@BE)`+}!q*D{M;h
z+V!tvO!nWCD!6p*o!RM)QUNVYKj&3#k?-DGe<Psx47=4M!y8PNTmDa%+-d71zfh%V
zMv_H*|CRmAGg@vPYc;W$D_<jfL&NxbXmMj1vu)3t<A3-z_I^0mJkdnrOZETcchAMv
zrTOhkku{p<KGFG;>anSd=Y`MJ+<xpNH}8M$t!Dz}{(Jl;+T`V?jVv*TCw*<KKd$oG
z?YP*<wxok>Hy?_y*6(2Q&Hugf)RifRm!ACW{-ZFhC}{EeiE%x<W%y0KLes-|ewOqc
zS76(izn~@R*MxTxB9|tv@DALm)6g!;&}&%mp7)`s_u1tWgvGv|f9m7?*Xd7A+aHb{
zoHoL@T<b&vrGFHyj(by^*HPEWxupN1<I!!wHQ8&g$L{}sR&`BQjk{UxzXSP|J$uW%
z8~^=#SI3>iF1m%^%JlQw;;-5pZ7$BQHFMs7U2@V__nq^S?`J=(VXe9&_U4^uwBTo_
zq^6v23R2qdrrtPmOOkgQ$CABkrwMGBY`FgMrxzUAk?h(|6FvuYpH16+KiX&I=>;>&
zf8;C<HpmtfWzDH-mw!-nt5yE@&6T^t>RR}H>{w>3Ouy{ZTf6M=ROY4gFYq$x7<T?+
zU;gBbBcA{Vf4SJzk2{wh41M_e@%8%p%9d5OKYqRXar^M(!`Jow7gh2btZ!QWO*quf
z;qv#pKDJ3bSv&QMcvtb7S?<g~(i~QoX2!bD|9*z}5drO#X*;qczfV1&?rEK)<P;d7
z9y~cB@Q~H+E_t3vXX`0*eA&btWUVAEB371fFPQkM!>;_>X6w*jc1$nSil2m5UA<Uo
zxBG2aSSouzJI~BZ+_6#yg7=<fv~93*Sf;vHYH7dmjM^Jq+UK^bYyQq!`H(qd(xk<r
zju(w9InGV}I)gpSV8(~zF)k9OOQSv;@J<w&SvY4(iznNkX9fpu86W(zS^KNQ{|`%+
zOR`t#nZDb%rPRh|*6LL8mEtZghIjIncDKn?+SVV4>3!*}!zg*7T58IY+5bC!ys6F;
zm>WOKYumI>i-I<)Za5gQVb4~T7nK)Q$_S>_7@XL;plNS^T3G&i&Pg9DZ@kd`o5^|a
z`zOmsKS~Q__upTh=N4Y1@^oX>rSo?({-*q^_}VX8EvC)&uIJ|2uvaJEePgKbXlaSe
zn4#YqaG_v=QI4CqvYYM-J++Bqa<U;yt_v??IVg5TXodJ`6OK3u#yyFh`i8deZ*9L>
zoAp<AQtBD6*u{Y_EuUo9UGB|1^zvw0Y3b64sBn*Y7o~)XH%;DKSNX+ATKCnmMA@2$
z2d*j2*<cX)ldb<?>fMNKvKayHDWMXZ&!({$`MUgfovQpqVV{xCtR%BJ>#l5@S<&3y
z&(YM*xSUJv*qU9g*?;Fh%{8}wzFl;8QE#zL(AIjXqpKEs+ea?Fm}k4`Qr;d3A<@it
zU+l#UHh8jb+kTHl=*HUoH&Nl8+Vvi#SD!u9Tko60eMjTn3#LTTvPj$0^A=6%JrFR9
zt&qL!Qx|)FMMpy5pXoaKBK*@cWNJ=Klh}SdG&v=0;p87l8nyG>3ob=%N!oBb?dyNB
z-#0%__TRVQ>F&w4t};r(+XBx{nd8*>goo*HV3dSDQ_sEbQ#TeyxX6Z>AKfBqmcu@Q
zYueYC*;9^f-DkLBpUBxyVXsOuKb8M5bVv&nVky1xcIE%rmEXO;Y`d@Ak})qU_5gQ$
z@c+w&(aAy1iZ6J34zuLG$>0e1`pMPO`S6X3hDJY`$m9DO)jTeB$K9I9sJQBFq}w5L
z%|#nL%J&>{P%`K%oN~`kC1R<$!Jic09g+5z`~J41EBjf@72d3>-CTKdfq`3``LsJN
z8;mAyu=Dgh>OD!v{g`9J2czdX3v_M^Jo7pDvecIM=N64NZ{{Zl!=HZo63zT}U(bf@
z$H5O8zpG66;4t0I>`#i&>yUZ|uim6>()Rvre!lku_KF{zBCxerQ``K+_PhD1KaVZp
zN=)Ip9dBqg^SMC@LqM_RMNa{yF1O>SCQWNzDHU-2b)8VK?6H=&);}~iewg7q>v_7w
zy9dA67y`N%DNfRF`m-f@$`O{3Qy<G&E9QN;c*rW{+RH2EOOm6e2zRKh+j}cTL0*+1
zyhremoTbO?Pd`n(A|%!?3%R`Wplxu>aq-wo)vRn{tOpN1zWs+!IxmJldIx7nOMtJS
zW^47sHe=N&Hw&91hD<MHCbL~Jc5sdTo$Bdh@UYxrNB4Y<U2~^gek41upxOCM&!4B|
z=i_B~`{&K)F+BV1<j2jACqK@gC%4}yIw`TsWKL(9M`Otr<F9>h(xop=wRU5W^b4(;
ztfqDA<i048=g$k)1PA@B+RE~HCjSZsb`RN!yk%!ra#g>JGK{_P>-5zWr9S`V4okXh
zRqfse-c0*b=0AVg5{DUKi;J#JaW4I#DduOnm~C;d#-h^8JSQI}XGd&st#B+}&zqt3
z+BfLh?nbE}MK!i7gSw6>?)kKM^><y9W399Hy*an$=I=Lr$=PRYvJx8CNyYiQ8$924
zdeY7M!-X>r+>%{azFhiP#<TT~&)?qHK04#-IRXCQW7XFC8Vrv%Y5(^4*%Ehs_q`K!
zhXWT@<b7F|T=#gfllhXqyd|k6g29KkJ^iY4&D-_OSDsY1nb)4?uV;U7)?jV-MnTTt
zp9dr4QY?>VER`+TKb?EhaR*k9+qW7R70;|}cwEf=EdBS*1cM(}t5X%bu1z`eZf5k^
z&HD3fD&uRfO8w6`EH(L^c5QOQiF421_>@^jIj(x3Z{GJu^q&LgS+hunFLtRlS#_RV
z!OmyDFHvE0+Oz-OU$K&+s)gUHmtU@2c;r~CA6vr@@nAFFJ!!tmCsfXRB&p;YKKgss
zM5aKQLH?U#VSQ?K{R)fEzSov&{8}8YU$v|#Z^P+bC-+VCw3X%Eo)~$>?$a-|zKEt{
z5f1xi+{h7UnacdbzJS%?S=)?hi`<@UyKwu-1=XW#vclfW25o3eu#DErYk%_SW~vrT
zmtUd()9@Qrk29@bO5WS_!oNCr(dqgPHfKuO7j7zH?!GI2cXsh*CcB#}tbfe-yM9y1
zJYlP@!ee(ocy{!)d|EO|%c!)aw?*mLi+K#moOk$>71u|F_H@gqFOTdl+<EWy?3I}Z
zgv?LuGfwPEpRhoC@xjRLs%F&_J3gLSmi$Kgx$31uB4I0=U)L{|xOnH)YoQmSJM=dD
zv&r*sW4YIPzwyCl(K7)}4RSM;8TOwM);*N3RG9wE^m^a&TWiiM-`dBdBwDt&`4eju
z&xQVs<%)cp>`qJ-p0##XYOQPPyz|GN?yh@saM@H@VSz%+I!}W+yYy6L*0?21m;8KF
zto3EIbEob>$Gf$QuIc8AJ`C9z8)7nh^;N6(nRkxPwtTx*ByB|*ccwz+-;SQM3)O-*
zp7@+)qnAEMYSl|6CMT!w3^^Qs%9c25>1~YdjW?0`^~dm``h|r%kN%p)qrGO!ExR?s
z{YGpj<+rQ66q?UhP@i(VGWo$&j<+3mo5U(MOO;ef_vl}L7MpyRccPM<T@aH|TfD&X
zu8=<xP0j0e%<jFec=0g1|4f-1OFqAOdUE>t{=UBblKbpze!lwg^~3DL>-*z#P2P0M
zlux_-*XX#9+eW`Uvty>thOea$N^GcnyJtaoX}qlObNjciXVld!Kl)c-l8r{4!2;>`
zj?>Ox$*!EkP}q}jMev=FltJh+exF*ltorRoxl|ohJvSczI{R*{UeN-+`}4cZ<*GVg
zUJ;X>G`VQ$<>T{<7j=95Wqx2&Y<Agh+gw45rO9R|G*7KEpUx21@M*&BPpKCdTuZqz
z<@369pGN*)OQ(px?QEOdvmwHBg0{a#kl+E$X$xA;#|Ql>INZ-rmAf%l=%m$_P^%aJ
zBLtLIWlf4baD^{{dBxHBukRFYe`n1!-M@SC$8E39{7CuyDOn<7tFA?MoT7uR;4`7;
z6T3qTXBeA#bmg4RS^q`5WcSlY9Xp-E|8#81e}5q1#7klJ+zrVmX6j_?9V`#IYjRHf
z!Q-VG<&iPd`D|YEMFyO#xVFY^dV*8{yT{rv*P92ctXA3l2`EWv6ANo$^fu(<Et8lM
z<7=}l{)l$Kyn8QS9kXpn^7-&c<ATinX<}h#1P{7Bb$57Dwe73c>*OB`B3UXLbt>*>
zIf&nq>f^c~%9GeotK6FT%lMlVzu~o78zJ+L&2w&isV%Gf>6Xg#z~$gM*-6oTeobrr
z)UNKnw50V&(KUljoMzttQa-$tx_%(!fw%R;mLD>o|4(GR%_}DJ;?K%w&+VRv9bT@q
z?rLh)kC3lY8ywq@C8l$5{!Zd^y-=`OX7yM5H4Jxnx_<jzI5*2?DQopH?f5sFrVC|@
zA2NHAqQ|K(mUHyB?q-gSO|E7UXB%gh_*Yua`>JHE^J>yz&0zhot2;Wkh}8NAF!Zd_
z{(76?-{+aTx>nCyusfRN6l25E_9M%A8V;w|n=tT+<=v|-j8@oDCwBE?X1uQ~>xU+Z
zWerRI2bunM+OD-ndcr}c`YorKzD{B_kd8|XzWCuN5BICGoZ5=yN{`wIgBAIGZHe!c
z<}tpuo&Mm;ORnp>y(&+A1J6ggO>CQTA!N<8t?Cwg&&w6^+VQ1tvNmYySRT8^+wyGA
zyMpyQBL46x)bGtI-&B8a{gMxs>?u(kueFxBNifWGI(g`)(d$+D3TO0vA8lPN#Ugj#
zxWVAV*~q>km04?U#CD|e2Cz-q9>6TA<88w#A|G<5KIA9E@mC+%>jio$b5z>4hq+{}
zx!3qXV)h~3c}nNjaoFEpJ=sQln)%c#U)PHKkI@M?wrCIRG+&$lgW=la^(PqDel*@;
zr+s>*R92^+_p2+6ndy87w;!?eY+&ZzVs-D>iOU|B%|5?!l+_K247{J461Zw&F&}r(
zsqESPmAs}-W&4@yVvS=oHeM+I7$RHuZ~glI@5U7tmoy7{jK!-iF!t=b>GkA@tGnHb
z)jxIKvZpLnHCmmo!(<}#)6uyxpm}@P?%QW)eqS)ZDn6g#*DdABXHvK8Z->{<@R-M#
zQ8~-u{I1Ee=Vytgi~Z+pNskD#lHAhk;`FoYTI09xyPx(v*&MrTMy~y?3!2tJCpO(W
zxJSzJw@uA``8%9DFU+oW+G%0Q%J<Iej%(wO*qG~6=YRYW^E~(v@6p@O+J%zhrtQ{Q
z9Z-5BIe2d9ib_$vQ>%YTX<gZ?eA=v~IV*Ncom1yzL1+1^r#>tTm%b4;Z}Yo@yRLo}
zjB!4ZtD)_fbUyF=TtmlnwF$EqoC}XFdn@<)^xw2MYLCnpdmW##A#PP{Vwk1(-sG*H
z4n|ww4A#}W<Z?bse{!qp^Bks{#-wvU7kqg2D?Rd@Y24~{qOq2SUh8J<{VKWY#S-1Z
z33vD2{ce`>#&xf)V8G-r(Z5b|OpJ4A$a|OCcVYR9AARXboFBBe=)C6X7xp@Pk0(=T
zm(12B`;u?Jvd)ZV<)0qR@!g^7;x|*ZKNn_SY0=eJ$q)PPmSSA~bB5IKhnn&!Mvv~-
zC(gXINyxvalD{b+e#csw9|y&i3Ii6mJ&{n|+hrnD!gu=htFpS+Pq=u0<sMy{Vc@e{
z=697rP<#D#mj_mp3iB3qT<17fvBcH7&HKUL5}&Rc6Z?*;en>g4bSUG7?)z=Rr~a?q
z=#gtS>wQ{&`ixTtUrVjq{P)ed-+%9|a4?t<?f#Qjoo#bZ+1W)q48>lpSlso^qtNNu
z9P{&cIP$HR`7QrEWtOWrbJ*>ONTz;ElfD0>i)%M2hW*f5V9<43c}|xG$Be_X0;e>x
zPHs7sSj21Skn$(aD23}|qGp**UXQZ<sijZc?=P5ZUohRlDsh^CsgN<t?`dECBbXLC
zShh0lo4kjuT2fa(R&2$I3l_`WHQvpubeyy2_Y8BNv&*7qehyo17Sn%iTQ6(D+D`jP
zmw8^ij^|?CuYK)yyXws?M}$0=H5+ZH<6&VqmGS@XI``GRpZ-~xwx!Q|6CTfU@bbPZ
zyL8uzPp%H0?;)tu`Xj7&;r347j%%#ki<_C!Or7hMw$40fc;kqhg!S!!^qUq{Uzvo<
zOp~NH*9pDfo&S&N>i?-5e7<e$G_T!v$to-7(suvu+eM5M?JM$%_Q_W67GgZ_I(hHT
z#jjRA`fbiUJ<!J_k9YacrGMXkl>Wi##&}ovguSa_^oP2wy9FgX_T9C&mprn4<-w~g
zFWYbG%X}=`RV-4xmTm7I$yt(1zdu%xT=gu_cJ8z{HfKwjbq(G(_g{I?)hVz!am$*z
zA7|!FUob5;iJiH<!vE9mm$tF$w%$|Zj=v0fY`bG^hKpOqxoKY-Rd!^BHm}ovEB0c}
z&-bo(x<4Dovu&Am+fF`y@k*g%8|uCuTDktdt+15G@7GfNH|}Q@^f6p9vwQAp>GJ&G
z`_d^v|8iuP)?AcaTJvGI+|%o(Ev#$hRrZSaO|1Jrm+zze(M7o_uQtj|_@#C1WAvBk
z>ipvso=Mzl*K%qmvBn0)b_RNvpH2_Dm>p=p$!3xG?tQAiBb9<B?<?26y!N*9cv#kA
z?;^fcydO9EMhUwZpK^4zk!ife891l7$dpksFFbVHhg@~*o7$zTk{mW?<+uDQ$U3C)
z&7pJF<ONMu%h>*`IH1VzUaK)He@<oW0*A!jUk#`B&pved;I8Dqv;I|8MK(VYa=zbU
z^in`%-p#97on868FT5LSmFM2;-{9ACY~{wCPjnk~?|zM!kNhC<>*!Krr<WFda~7_(
zESUVxRreE5mg2^eXRNp8@AcdK)VX?6^T&35PYL%M?A*U5uVAg+{Cfg_?oYPRiUQMG
z=6@6aeBCr}T7F60wbhdZCqImozbB>t>gSyovqRM<{xKJwS?BRPF7}KA_g1kFLG>~B
zABnyCee2$L1J*<TT1~F6e)#dqzikR<tCKhB?@tu{CY^lBAaYUdt-uWX5}|JsUtVMO
z+%>s&>ATSB3*NWKau=VlZC<PL?P~762W#^WHS3Gdm>jWe<2}c>TW;AUH(3Pk{=6q>
zyJf-A{h`u!o8J1(PFR)1+{t1iaXs^;>f9*)y~ZoM)8;g-e5Ld2IYaxQ6Wl3kE({AQ
z+u3g~l=i6%>`^E!Tlj9qS@xIfW{LzqS;gUKHqqzPOVtxkB~mBnGH;Ic)5tg68dPU2
zz0Ubu;>{Ja&ziEm)A3!FXfWfOWs60yczvl=$SU{k*N!gFFxmXz-n(S0mF8VG;#vQe
zC&aE&zj9qyJiW(~d;39yb0_=z0(Y+zJg%CrckuXEVfB@4cRv2`veS_|#lK*$;vMtD
zx0M_jF6REqiLGDUY7=kU#r$X@@5MPg&rJ;4k@c;|;bDQlVn*iqIlGs12v3e#q~zx#
z7Nm4;Z+kqap?=4TyQW@AZ`D?AyKk3z>rIzlRg`X!_53wy6Zqdq{4rR#h*jb2qHLvI
z-W4G}n(Jy*x4X|?)p<{*HuGqMzuFe5n|Wo^|A)kg|Evw+-?4EL^HQsT5(mDC3$p|G
zd8QOaR(bI-?Y~mRKb_^{+J)iiG2u;a9TpGgoPP1Xwcya#2isL+Jj}jGnuj}G56J$>
z*m1&Ml>4lB&V~7R%;a6FO<Q8_bN5UU*YWyn?PYn1qwe{h`;*(BZ{}iH#mL!^onEgv
zW!uqdd2Bb0O|L)Q%_Q44#p0~Pi=8WaSS3YNPWs$Z=3IXCh1rK2`B$>u?wTlJy;b1~
z!%P8ZjkNz^-sk3itxnvRC$>0+Wo`Dc3<DFcd#cS@hNiDH_0vv0bL5fZTz*kkSuglw
zq@aRDP5U3shyDFV;UBu91sepE7M&Jvs`xT*F{3$))PJ$vkNm#bTCbRV{+#d1BLW4f
z%?$ll=fqCV&x)v&=#l=V_1jPIDuWSkvZ}_(pS<(T+5*!2pHAL&&stxMIpX_Yoo{Vb
zS@$fsXGmN7IvBoHn&j}dnV;Y7u=U1Ro!)mWAJ5$^wb`<%>`eB>aGQeFAsy>h3W}9C
z%rSg<RQvm4Y4z7<6aAbgGd4Ld(eihl^6HcDmIsE8%1@g4cU<yWEts_U(`;s*#;g-P
z7uP<1%8(E!p6i(3#kMBEMeD@2yD6SOd=9X*`FcE;-#jCM_g2LZ>m3XmG$NcE3a)=y
ze|`7+E!=l5Oy{_>PEk#`&2~@r#`ABl9((fJ$^ZYVnCewK?kH)QaU{Du5n(Q1I$wE6
z?8M`hYg`W9?+!H$nd4o$*|c=MMxpb>lXL#%_*(w3srgrIJ?RZo3S+_3HwDwJOGIB=
z{CycQIZ^)5K7}J`j1v=2i{86pFgKUE>d=>{j7WCFLr2-?E}CYw;i~`RU&}Zrtc&81
zQP1<17GMl#o)xxAu)tvTx#Yd#`cvO~+}at+<IyQ`L-fo4o_<S~O{MSN-$-KnbZ(K<
z^ap*b>Lfx>pUHKLouJ;o|M+SDx)5U~y&rp$wh8*=KHF-&PU^_I!;c%RxWE6A{I}y}
zYHVGU!Jdbcmwa;UC~0r^Smp3q=2d5$ae3#8LwlT`T1T;8FI;3PIk99?=^eXLBd!e#
zPw0HrOD*hF@MF2#!&7&*E9bt9;HzDFXLP@0t&c3Z=`5d8`QPDFv24Y21??XTW1Vi_
zcV8LQ9aS50e@$fbzW09nb<d|)7&%PPdeM<^&cfUG(tEqcs`Yy}UHw?oRQF=Z+~sfo
zxaL^@7K~F`G>gM6-bU0-hqZ5e!HwqjuHAySjZXFSbl&NZUHtKEg3}G_owwK<Ppo>k
z(U0R|LsW*}&Mix<mtK4E_!gI6YG~k&dpm?4e_s1f`3`fkm7%z**_E&B_u92aJ>B8L
zQ#p0j%~e+}v?MSTCWhZoY0l=F`t9=UN7I}IZM?&!Z$)bya1htEP)$7HrnI9_bIZ@P
zSvx{IgpW9IyqGoB^rYyAb%k?{glDmL>OOrXzfED^@^i~;xX$%9+8k`XUun#8G{C%U
zvG23<6AHe&-M_zc@-BuSoy|u~fAEPl9ozBy_bLzOj}Pvf2HeWXPKj)e*emuewY$5j
z`(OG3(W|!p>@8ahDm2`SHam8=7W;&!D|snpT<2TSse8n@|L$_J?{BC4-8-+(u}xw1
z=`_m~{|Xeeh5ffVxLx3$z58X`84<rNMGX5n9+woeN*Gj&&y3s^xcl$<&o0*{xFx)P
zHpj31mzcN6q!Z>QtK+A3{qBi(;0st#u+t)tWq#aibDt)`n|HqLQ@*nCnuzkdlsM;2
zVHP_~D)v6!#Sodd<K}bs<M;Q-&6D9*TmAA2m(!bFG26ta+a6l+d(QqFCFL#llhWm1
z)>W`Ccjno?`tKW|lM%jo`~vUv3~R;TeG#m;Qo1Rbqoa0RcyeC1XYAP(+|Cm_51e^?
z)cJYf@3j`PuE)z4_dHp*?OB4iKEv$Snwxm0Jh5i|ou8u0aW6g2yrsuY`$M+Vr7ygk
zMfOrPuY>i{OFdLSb-tPZR9C9E$@s*VU0=)erKM+Gy?nKmHR+0*x`B*~_O_;(qIY*b
zKIiOp;mWL#HK(3xtkrBka{IPXOPHI$)1Hd(A3uB^T>7-ch3Rv+alg4!(~5rIggS#a
z5B`=amvisAe$ahqg39%v4N1qJeknX%y7_3U^ZkNK*NtZ)8ssP4<FY;2!EkrS`u`7m
zYy)MN>%M%{b}r?ZpzPc$H#*mzm)NmS)v<u5%J`M@#9gOf+c(O{YMsCSv-rUCME@?w
zjxS<`*2;I(WEfv8*c<-u->0juPy7m#?w_i|JuyIU<Bq%2FEcgWxwh*-n09ruvfZxD
zsU6(9MF;oUcYL|B@aUo$u^+_#|LHan{gN#j^Ze|^uKQQ&&+SoZ|FKPCk9~-a`Z?Pb
zN<SXzi0(}aGkN;gqVbr=7a;}N2J7p`=jeZk-y>oD{GQ)8{)oaEhkxIW-g=l}D(~;R
z?2pBwmKe#kuUc~5Jl^N1LW;-tRS#IRZr-$=(W0gm_HZ)us~z7R{w|tV^X6Kx+UtV{
z?F3~nSMY=jC>&m}YKF=&*^2A0HBEj`fAjdPYpqt&$H4TbtRE*%V5wjDYx~ORshdLm
zH68ZN2(+!^R^9R;W%jL5&a+Mbsy?VZu{{{Yt-i}t=zH^j_5g2Y77+#p1`dX#b=#v(
zui#c#s>;9+eu#lVhk=11H?=rFFR3&$Cq+LquOzjopeVH@wFsG=pOlrFTvDu8Q2EyO
zZ}IJ88~49nzvI+p#+yMMQ`It8uQUo(x%ss?CsW1prL-$^^OHa)UM3wom5ow=-{*hd
zR}jzO7*#ZD=5x;+rX9C;-@bkK_TAgJXN&%v<8pD$x>rqZf}YR1_pI=klUgYn?m2I2
z^rO&qbyLkX_lEO-tq6P~9JT8F<eH6B_G?$g-xd9sl%3titNZAcn(whqQ-dpHCI)9n
z)^{2uYS^F8oS7bQr*6J}#ql-QA6t1Y=j$=qAJ*{v=N7+A&Ha0m`_o0*=KU2}ZYtXu
zuKu|GqNnQobBux?UjEp(D3X)+^LFJ=^X^5yPqBVn@u@Q{_~-hp4^7jqW=;(Msp6k{
zQ)P9=Mh%TWwte1O-F(|TzRy2wv-*+B;-g249Pg)Wu5r0{@90s}|3CQx%Qr1>jd^-B
zLsTd1m+xgk%esH>?LU=xaW_PUf3#Sdw=?uX{6&eC+#gIQ?eEucn86UYTsu45U|;5z
z6Q?=c!uyVVUT*zY^S$*Y9s7o?^_O-ub$V}lEx5<>tT&(b>HAzOO3Mzj$%^(^gf-1A
zY)}qjP`ey0HML|?`elu!+f8~cbQo4IeD|ZyNmBCh?b{Z<%PwrJ^4q*BB%klIrfk&<
zl_QSslclYGvN%r=`D}My;}TQAtKah%ZMXkif4<+J{~Vv5-?<yJFK=JZ?|*N9)n_X!
ztGchx{u=I?@?m)i;}WmUo|g<xOsv`d<Vk!=;jd&Py+=u!Y|Q$zoP<P9G{07wr){w5
zm1h0=9f2FR>$H`$v8b)o_dTUG)6sjm!QRM_W5&CdJ~>s?=-lsJ#P~k#iPD}Q_b)$w
z@j?E0d;a}B^?Q%2^=wx@Slo5du4QuNpUzhuQ(gJ*A7szn^u^0$ck9Zzs$B2iKRU_#
zLGjbvxOJ`TS^vsEdh(ayJ@29k%J%DzH)#Kx-TT^1?})zV_cw~!_tMXOuz7r`{mPUl
zJ9<`3N$uU?bkE95O;q2;^YJE?<2Q4Io=670vWz{_^Y-39n}F2z>gcX$ugHY{DWMCU
z3p<}L$Z2M3TBLXC$+UM93;CLgwXN)|nVag$|4F?lUoTiaUHl>E<CPYBTfVJZccSid
zp}>VjC%QRStm|2yX`sZcVH}iWER&a;>-(~YL9VMJi1GFR-F{q}S!^=<t5qJ@A4-mU
z<1>ZJDwQQ(rO=7d!Fc!GscCaUEEc~P%q=hzeCSXpGxtG4PT|}zna+TRi&ngx@TR7J
zPq2PaRp)#6mjAiQlZ-_?R99#S6!@-o3|R5d`-gK_(X1&aP6ccH)AIA)byR(lxLI6R
z;Jcf?U5Xox4m|LjnUX4+E^O5h*RzCApiU!G@xsB?{NF`{7D#0niplYcNY397owZbo
zg(K3$d7JCOT#57#Mt`22e|S1!$J17!YpSv)pWjYt3QJ%}6g$82USQ4iDHD&}PRJ+=
zIjnwe_Aj@~%k<9f2{m1_dexd)y+Ly-*RBiWx9iSQy~=fj^MvXBS=TPG{&bmMUTLVh
zG2-rtJ$jCzi`SS+rK{+BtSLBrk#|LE?;eGG&Da%_wy#(;QAL==W7V7~3M&&dyeEa5
z8$@@Tu(?jTb1>g))$AotToact$<0=@;ywEK=*f#G<@6)&Jt?(1+9z5v?|xGplhp^2
zeNPRJdCpn3q2aXCh1p8VA1&5TwXqk}(meF^?(Uol=FCXD98N!ntxjiOdDO~zhRoQs
zqD4&I+(Fj$rdr3j$cf4tf*kAq310I*=2dgbL_%;+tKCUfix&3?#v@hM7k)~6GoOu*
z<83z+U?}L!`ki3K^YSm#2G%L@JZ&j#!B$5rH%0Av^yl5rtPN{kiB9+uJIVL+ZlQ)p
zDL#jl&TGHOjR|=g%jC<x|Bq0_lYdMnUOG>^^M1iv$B4))A{#7z{<!Ks<Khmcri4j~
za?RVq!X3&bf6g=)jXIFfrDk|R|Jw1N^NxCUeJGIFQ1te}49=shcJn8CPMrRfFCdY1
z{__CwX?hWVr#bv}-J`>MVS$Uo@vJQG)tY_LWoI6y9xU>*l{v#?_c1D&|FXO3fi;rK
zkCa7%yf4TH9bfRoI4r8TXzSLa)3cfn?bJ26z}tK}EU-qks(*@%tLL<kKogBjtI3b5
z*T?qscP!h_urWKyZT`niaSCT!xoX~BlY6Bh#w2^P^MA^Vb*t~VZJokbJ|#tjMbcxo
zC(okplhX`u=#^?d4PAL*?MfdjotFMb<}Mt~3ra5>$n222VtCk-?~%f~M*?2c4c3cD
z8YLMSoRa*dJY$<<!v<wVlZLPDZijhp@%k=b#8twy_Orl$sf4rd9_37JvSJE8HtXoA
zbD9N5xA44XEt$$E$Fz}+wYo^*jp3uGVKV|7McOxQt9chG+fq_@{fbzBtv0h!h_6fL
z{w$}w)3Y8G?)_-=se95))105X)D8Nwq^JEXJ6pFiHfp=MpZhPS3K6XX_Z@qg_|{MJ
znqa_}5Y(butZ=YoYHR1#wh2oDN`EkzN>0Bc`9}9@$eNeQs}6=e%iXn5GrQ;ZvIR#C
z`Zi0;ScO)IFGw<Gt1kJ}e9?d9@3ohG1Jirsx}<#7Rd?U66?uPDMoYZArsnpIRX(Q;
zm$XDE?wF*!MIw_WzPBT!-Xwbluf$fDcA*;qF8N>IeS1A!wSL~l<g+R3-`%`ls_Z&T
z&dG^;rny9s_0!w?wX9n&b}9<a&$QSdU2L%?x%WV=n~JgE{Q}=B9HtjFcD)f=H@!eR
z;s=+^?JfH4oG&jQ*veyk?R4mw<<8j)(}nePyE5Y9nCs6mT{QgkAoiBL<5EX=`&qVp
z+TCiZd@_}~vwtdY+w3mqa?oAasePgb1JB;e%TCAb6e|(f7g1r`^1u9Y{hcslfp6>M
z+AoJc?#y4i%1dIN=D%Hu_Q94LIQAAE%m~r*wQ1hda$NI;cZ*e6>8x}vZK+lIq21G`
z^}kug{>-$4=jZN+dHHv;yN<EFxSsueHlus*&#USWIn^98!(Kn$fANx;!~U?H^51er
zKXfa`cO*8xUM_a1_v$B>pc_|zxh&TGvN1}hyX&^w(YLFY3tv9<_C|adNAVH$wZ5Ut
zm;agI*6(-JYX9tK{_?vvf9?LKv#)8A4%4r>SG+IquM%9DwqVUpp;=<{-PP8#CZ1lk
zMevQO{(SNMd^am2CMAp1+OS!L8}0m1G56|CP5w-YALYlMzMJy;M$y_^Cu?@4zi+7O
zlH}5VHDjKU$?m(^cNX7ryW?LtQNhg1f2q;>Zcf+fa<^MPPe~{gj%7Vnb?4*MQjL?V
zl=Q`Onpal~c#3UglXTfAdbF&$X2)ae_|;xVx%V}v<mWv67udeKAVXi^RvX8eTPNn3
zuGjyzfThdT$=2<s6-V8V4^{rk3R~}PWH`hWZGA3h#VtFb#U6%ITTcDd|7`rc$<uD>
zq40>X%X`+%Vi&j`Fn#*k%^8!<KR>`x<52Tj;zY)hiAPr`HcXuHYNG8*<=R_rHF0a|
ztk)e_w!F98XWz@0u8)!@U;P>Ue^mqLTCM0~*9vV7r^X&m;I5y1Psi_9q2<j97d_?U
z)NOCfUGu17li6iq{`=b>TuQA>o-B1sW@FyOwDj()k2i~KoGX?x@8=ZDGf&^}o|Ny5
z`uc-oQ?$l+fj!oC_LcH;=hs+R+w`6D^V6G<A@#1HN>l64hlgkT-8a=7cFa9`-u_R)
zmuEbV#eCVC-=F<Gdh_JZmmd|Kcs&IEY5Q+FsM@`Q`+w~71Cifr_CJ&Rp1me>ht#eD
z`BKg0{!M{JMeTJ5_VC=)6U@Fck!zOxg&XX7E7yBVNFR8@miSq+!D~ve#r<g?rc82T
zeSU_Yh5KR2;r+~C<0c3Alq`q|x!Cpa<?PGJORYUtp1!(n*@cTA{omXF`H}2wnpwxI
zb!5jrITnSdhAlpm?!_5oRfriLFx6@{*!p(ns)$({F+Co9ha|0T9<iRe)jdh(chIxL
z65p?8xLa`k{;+@N^5otNrV?Ki-@bX{5p(c-!i~@yx2%gYnf^c67B285H`wyr-D9?<
z1xsJ+c-(emndPaz;YhMWKxRyawrJK1{kw&wN9|-jSt`rR%h_-Gn{;Y>f1&ZNRo<UI
zNU$m92^_zgpn9;U=N`}6Jnp#_i7Qw=TzOY-s+$;oq5FH~SFQD%H7|$!`F-l&!-O-;
zuiU@P^D9uVRAT?}`%|*Sg!|tWf7kUTxI5ptAj_k4G2g<3_sg4!3rlitNZ*&6y6obY
z_nwOn+c^6(>@aDlk!sI>zCYM?XI8&N-uC$%H<DI|%=cAhKK4J0ll#N#^{Tlh{<p&4
zt}$LKRsCZ3|2+pBJhn2QomUms`tU{R(Z|0|<%u|+bvo11AM-$&U*^`o+lNmdxBax?
z_m98ZeEl}fm{M@(sifhdE~Ou>dh0c$cJ5xkp^fqDG`IdGTi3lv_Iqv_WOFPc#>jTU
z^=H*aj@D1J-t82B^1#f0*$$S+zj`OiUSL_7x57{U+X1T?Nv+9_Jy#dlnz|*N<Ed3Q
zFFYBbe5})c=D)WaQ{owtmxeOEGI-eXY3hvPLysRsdYp<qlN{8*Z!kmr+5)T9lcwz9
z+5gx3$0p9=NxvHHgjebRn4bFW+)Ve+PsEP68o7RPyuIC%@3qwT{ZC$q2F+-iE))8M
zG4b!ZiYMNQK1NmU2_eh!7W~}$?2hRV@sgO2GrW#<YHbKoC=C*4-6EW-6L#<Y<x9Vs
z*T`@%Gwo`-|NZ7+88N+|N!OpVe|OmU__g%@h{NCG(j~G3H_s?(-)_Ip>ca#^rII5X
z`wmvLl|J^-{F1RCJfln|WWu)k?T+$h)AP<O{Nejst$970P|@jK%e+sT<&^4VPMdsO
z&b(P~d*m;H4uK={{gt@_tY=Cj{ky(I#GS+NSpIRX_Z9U`ubg(o?6Z@9%)6v)%IwvT
z^Esa{dcJqUKGBDU^IyDp@QC3<0i%S)`+C15uhX6rPc*ok*W_HMBDX2nz%)L;?~&HG
z%#Jgi0#>f}&gMCdKjPPlI-R^bJ!<RS>3_A|&b&6hD*ZISs)^y#q|%9(eueJJbE~{t
zJ!SrjAk)_UzqgBCooVUyH`d>vI4b5c2fvA@!r9rrB@g}1PS&2SD<fc`7AC#ArtjX2
zDS{cUQAgsdIi_rsn^yHC;mG+l5fgkI)kIxxCU|@7I$pY=Rw7;L&!$O}435hN@k%?@
zK2QAVupq@J({01Tg59}a4H#T>JfebM?>LZDm$WVNWvp40<Bq1{*tPGR*%b88`o&Z_
zNy#j-Xy@Cq(&U&+sg97$>FG}Q9S@!>ogb@v#AW*Xwc1<c9fKrH^?sOcxE&JLn$rC7
zc44kon}28cfq)+7N9^~S;_GgT&8uiUvms`Qrzyv_uMNNLCL3~ZlQ((LU$Ni~=QGwY
zanHZff_AI-Cxu;Ev~|{x`E%dJf8brTgvD9N$7$V!C&uRrQuAbPCFI54F-#17VSDC|
z%F0WrD;$4I>b%^t;A07=(TizO>E}AFvd%6MvDRn%f3Zc@s@w9xo(m5e?=-KIaND-^
z;F=wmtV-MKTNclnKOx=j#<s}E$4bJ^AK$`p@+hyW{LSC}N51Zqu4l5F`pG4F-cs*7
zOWjP0XFR$Pd$ZPM>I9SLwRg5p*E(%<{WXKxkq;;D*PJUgs|)F8eA@g#<k_^jU&S7W
zsP7266W`w6vq$A~#YuxR>HZc)n>2ftEl8cq6uQQVL&x^aTaLs2!9k3MArc0>0h{Ok
zzo0aoTVl%Uu32sVy)*1CF)#2qBw4rbj>Fjvr8`T`d~vJ%^6CGp()Hmdw)I^1v{}XN
z-f`UZp`^52oXEx0`d{9=S09QGK6R-k(D3x<OUEvTN>5r>oyl?PN0#%fdhWfv6LkZ8
zf<tC3Xoz;!cqq=lZm;2_b1gC4^DhOopXw9y{wDVPk<Y<A|L=LhJDq3FX?z>|@THra
z(a9q#*LrW_<f)0%`R}4F?R@E!xoqBAQ3bpH44vfXk}IBHS65!=W2-7!*kLBP)B2*n
zOW3WBx0^qo3GA<4^r7Vw_hNzV%wN;e!}opK#3*+2?(K_`j<q)~y*#qpa)T4gcGcnw
zvofQrH_TmKcc+DIf7kQBo8@wE?OnanlFRJQ<r2PKubGpr<(Z#OlHf7rp0zi?Eni&1
zM)LiP=S-ezckF_kKZo?(x)YhZ>Cnf_AI-VZd-MM8dBL;K$}q>cMp~(*-)FVXK7;lr
zFAv^4I=fkZ@#4q92D*Ib;^rqaF|vhxw)Ok;Q|VwwQikz_lO8T<6Kmyo%{IMW;`z-p
ztigWo>yA%*U#r|yS?hRH=xWu~hmHZORO@9+uk1V7_W1Ksvv_O1Yt1(|q(8~Mbw-yf
z;aXAmIfD%@R`+f=`)`-^PHio63k%b)V%o8kRZVx&)uYMhPgNbx-qNZ4?a^h^=Wjjo
z3Rm$~d|hg961R})Q^A4E`M(ZtZandPpCaoFQ)NHpsUkTm*`C+D<P0kCZ~3g<`11X)
zW1dq2cj{=b+Oy}CYdwQc!kxQMc&mD*XMbS{R`L5XZ-aO?!;VgF-Q>oajr;b`+884r
zzv0~MX730=Il13#={M*6ykh9_Yto`yuWp(rN6h|u`p8Uu9jDT+mqnc(iO<4c_UQQL
zE`GB4n)v@^8P$Goj5!ZQzrMR$-$mkv>9**s$Vy))&pQXEY|_k`cqPX7FW;3bVRGCC
z`@2~^ugPmnNa=4$v{1?5y-;y0&HCHRz;5H%uj}~*LT}tSmwKyhi~rJ3f-F%RcBt#8
zc;p*SRy98RP0(Y~#bv7Zf^(zqMt!bgDe|Z<SiELV-L7X=ul)-Jcc?t{47s^xtJcyr
zEen?}y;5=O)1g~WOg~+Hf9ha~!sN0h#h3Hm<#dQL&kvcjVA<tczp`db@6A5%@>_JX
zM(`}&C~uyV-&3x?DNNqg`ognSl<)D%u*;KY@5#NLl{dQ}|D#Ph=XHa*(QWB-CnZg-
zo-+AM-jC%UmY%6va=dKjz2N=Fw**&t`k7WOY}=uqBei*QlWE1IrM0|=d+OI5;@xH8
z_bobo$;#)SeIhqM2xgJJekE(>b*^W|Epg17U0;>X*ZKO*VAJjuOBB3B-M`*du*+G>
zaj{MH^8QWc;vdqS6(2EwcoNj|y}G^hj<)-?=lyJ=wGt{ERl(bi&wJqVH+J>%6L+@7
zu)gM(``@(9YOAE~+F4#{tF+!leeJty|Fogs<csoI)AMJS=r8yv_C5W{xBL(7_8d~%
zmJ2^zBc?2NxqL}W#`+aDH+7z#wOZx5-RaOJy=tY?ds?T?cpJTN;lq8VQ<UCMVJ~D+
z(+aR!FrhO(zc#Ud+x2_A`?J^PYzRs3x3!uzH}UYMPtj(te9{ZVC+=USb>;5je$!a}
zTie;*IIZ1RGk1ogfXbf!-dBN7*K$uTv0g8(y{<G!@9wu*?=Eh?qa>{zBbznt?x}Ca
zD<coi_UXR=Tuff=YPw{hutfP(z19Z@55G>4TVAoI+3#oGk5j${-=2GhTBzAfS$EX+
zq^R2Y4IFD-BX5^K+vuK~8yUiD9+XyEtC<jzt6CU#{plgst0J4yO85H3hI!21C$-l5
z^Iq|~!>^C;{POzWY-hRu4~l<_eNo%{GHlC1(|sQ2PgJcsWW{s7N&Awul-xPfqq};!
z<`-S+o5;g25_pr**Ky)RDTj_pTH%YmKkqTS)*+s%mdRmaVRwsn<-ztQyQ;m_*^d7c
zA})XQarqM(^y$XxXH&%9nP2vl5)V24E#Sz>X|w9)U);SSbfw7WWr;rRY5sc{w$8e<
z^YHAs46j!1s-Eh?JH=l!$lR_Zk8zgFqUw9qlUn}^b;VD0`e87y$!b^2oGg!(ro6}Y
zwjWrt^6_ple<xO^E5U({`)WT)FJm(6(RXBBvrtT{qwjxZVO80uS*d#N*(^DYjtciT
zd9K|2a^GB4&%8AEYwY)@ZDYB%abfT8o0}q@=au#M_{V1jOHW>4BE9VD+37b<&AXZ@
z^^$kBIFrNs+I{Nxy^FueSLbT|+%rea)9?wG@1xsO>wI@_a=LKfTT0RViHGh4zn(Mk
z+NWKd^P|}pE?g+t;>&#AUg+4tv(a0Xa~m#f-o)MXLSNo~!;$(I{0xf6lJ?&8mH)}3
zeB^UhJL8er!4mUM9P-?JtZRGKqZ<J!7iXlFKQ=Wv-}-oR@^<mMdoEtj(l7tGd;OS+
z-QRQXh0iy<cpx?T!4msdo5kPCwNKvaI!k)0Ma$FNkl1hAM6TRiuCxDi6YnC8J+pr(
zm3Nh2{jA?M{aW-+o}^6<((`tdpWogU<+@Aka>@C<C-OIQ7|#0V#&l$!;<U`o8#eyu
z-x9f0X3OzofBx^gw0{5kBP-@f*53bC{;*cj=$Xi#uT3%&Ecf?MmKEmqI>dX|f|a?e
zv%2uPs!r6KZF)xDL0T?rcbvSep2Yli+W7^}2fB_ue5%v_@@jUjRz~TB*Gshw9;saC
znlwizOSEp+ir?W~X&-Gor&q=PTlRgc<7JgFHi7zAb88oz$hh@H{=o8mkz%hlwrc-;
z)XBQLx&L`e=dz8aRo`8AT{V9g+kW}C=k6oYuWBPFx=lHMQ~O@P`8dfh|6JIbE-T+V
zamu+?_v<Xi@)=_JmBMe7T((^|Im+AC>E&p-?9HYHnjy18N^Z$~i}v&p^R^f73$cE^
z*faEP>&oJ*7otwwn)F?NbFSVVy)Cx6{b484XD0YvJhx^-#De6tN2Z3K{@StBJXSfq
z?C#WOC$#c!26xnap2hZJ(aW_LC$FgGOz)j|!21r@t%}SWODDUXOZyq5+7xE?&OW0@
z{MPp1K8**9XT9?Yd^2O#@@qef`l2K6PTlHcCy{?4asD!gbFnJ=r++By>E0{8;M1xP
z7qj=D7r(k`vv1^~@ZVc+oS6NoN>)SsI>YKob{XPZ*4$dZB_lDo^hSxx71?Jtf4%00
zlsug)`h5+D{miWAC)78+o)Iol>-EYeB{uBmAEu01Vf)JS52)<?ZhHKzXm7mB>9+~>
z2loHeet+`i5*K4G{RY42&)58)T|SW#{8wY0>cfi7n}oNqzj*oXZ^BGlr8D-r>o>2S
zWO+7whFzJ(4?TUmjVXV^UNFplrZvA|;=M`#>jPCPCx&=4zL+NVc#p{U{1VShZ;kE+
zhTp>?-6B4?#(A8bxAs(%$k9R>&zWhG3v7LO>+>7MO_=5%(f_>J>|uaQwNdv;%jf01
zE?zIp*PcG|<=TT;m5!VDRvLA8?rc(eH2r6!k6ew|ewjBLB#*4Me(*E+qr|4oJ1bsp
z)_IUH^}NnujsKZq0>!=Mhd#$2`}l>UVD0=Bbz<wj>*raVb_);DyZg>H(1P#Cttrh6
ztb&~u!Ywfyr}3&4K4n|boXhQD@jg-2K0L8()*9IbCypsfJ5BG-sC@XPwM@3wapq$t
z(VaatSC;;BcM&Mxcl`3oo@qL(tJ)HSb(;7UKH2XHmU!N7`0S0e8uzNyCG!9EX0>dK
zDAIoNR)&A|15p#9NjF*R4o_OMZ^7ggH5=VGP9L?7M?c+YE^jJQ!}D~~Isp~2t)=gy
zoaWvO5LZ1Yne})@ty#^cZNHyQww^a-Mam@pw7*O9IVWvD*0p+z45Rjnqq`$c@pA9&
z3;Jc9rF6@&_~7c`9v($sq2R#sz1<UY_D;ON;Gy@Vvr8vA@OP<xyeza=EH8j9dVP+d
z-m!BmJAdS^7faUT^k4W*GdTTcuChe@rW2>1+>^VIA{SY**r4o(-oGW!RYKR~GEKOV
zw%w%jzP1kE{gpX?WAEqw<NY4^kGuT;?{_=a@@&scEwFrMwL4Ks?U6ulsZ*=ub{XBG
z%galaDm`TKc$DEHQ&^U|gWpW%n%uJ)x9^v4EATaU4!<;;P48yig&QvlckgUT6-wXF
zGPO~q$Hq&`R=khLPR;m1vtc@?v-qpM7qxF|=(GChF6O^~x7K_5yxramy{q1a&G!yJ
zEU3<R#Y9!XUTyB?s0u;N6<j(paS9o~9lyvKbjBtcFW$X!*Q2J{7ixa%^v#U&imOye
zbeexEJToR#Bz4{NJ=Z;TzAgz_mwfkud5gMq;JnuIpIfHgnt1-&)%~y6soL%0Xx->_
z{q((zYp-`D`G{p6GdjP#q3V2IbZ}Gqo44JIvLp}O@r~-Avzq<q_CDpN_McOjj@CXf
z<lZ!womb6TM&t9#sF$lYaK2y)@KD@ksN^{9{ey_|w63Ct3l$klZwe+p>nLI_{=I>@
z%Jbv1&vQk-oGWQJj@*Cj$sC8ptQxH^b$cz=bQ~1oiH=f9`Fes+jPtSQR0frUi9H5q
zrd4j}SDXA(rSAlT?+hO20E@qkIm^ng?S5F$vbxyu+3BN~e9TVDRNwO1C~YFg(z>Ve
z|ErdGW|>!;U+$g1U3CxZi>B|66I?yn_{(PZJHMUwP-XX7`^GD?uCeYv*u0*_X4#av
zyRW@uFAvyweot?4&8v<hm5p(mR4>_!=$$l4KgO`P|9M4xr?KW{mbB0oc2~|Rk{Ryz
z;yPm1*{n|IJ6008Sva7ibEVf$Jw5w~CD!#bW1F0hzTfrfThnvCxvH*_orm|$P!YR-
z_UMskGcJGSo5-ss;LX~_+xWLP>rP1Xl+V%u8Is#{UQDXUvD#R)w@B+k_5Sw>p5n_i
zqFXeM&y<)Lrgq_1&;rM^x9yWZ{ZO}INGUx!Q@W5du4OrMg_=H#$fLy_CflxgUbEIY
z)M~drWj)J>{z>2N{QJ&P`#tn|FC)jk^R13&;!6ePQoIY}1G4#hUN`lz1jx1b7R~oi
z?N#R~N%ztfy=!@|^8cKKp0XnztBNEGvb8VO2!&nP_RW<wZ}z^xwJk-xOvWEHHnvO)
z&+5JARh7J}^t{LJ=t!$DrNxPMi%iSvv=%>Fl`DU0?vqJ1p$i&+?#kcLw1U;jUE1O8
z<<IFV-aW5{C+%Y_)3_~E8mw1ewQ9!abgn7)Z4CB%<b8|~;R~GeC3~H3v7PN-(X1Ih
z|ML0!pD^b8SO3`;`M8$x<g3N2XWXeM)0a`)^owhow4>&RXNU6dEPQfGbGx>~ALh-R
z{07pp>1G#g&t`4ked+$OuN+d=0y~xUBIMFVWs4qd`)zW!(IMSQL~W8$(#2$38*!PR
zY|otjUQ!ag7ka2atH{~A&M{vlj=$z=V${>`@n=^nPkH0WFJj(TH&5yM%u~B}^gL1g
zoUx~;WbTDUZPO-yy`@uBso>}QXR3U4c-q%}`Y)VnikHn_TJXC4UfIKqnw#D-@U(B6
zBh<{$)+PCOMkuSjY%QOyw8`V|N!(qRtllYaeHfb0RQ>EhtLWnio3y)*FD+M)mb19T
zdD<?=rHMa5N@9un#1E<Gg=-n_JmBED`hdHCVXs~F&Z{|V*Y8ZpOL%+M*#4r_?1`V6
zxh^}{@XYr7u02hc{YUQ!#>L6%M=M*WSxuO8RW9pCYQfVTuZ`TN-T0_@)+A(>|7n-?
zT0za5_C9$w=eP~8dZlBi)1Ns%Rg_|uSZr`SsxvK@EhXAG@N~!CL$h^z*c?1hZDvTm
zIp=%t4!z2<(w4QHg?rXnU(kOlXmYG8a<gKvL{Er+l*PiQDx3ZPf0s=$6Wb8FeAd<}
z&i8k$yp?dW_d}D)#@*ZE9p&G3RWPzW6Pdyp!PFEllY8~D|F&$^byWv7m>VJ&s(X~4
zV@!I!f|K*Jqvv<-8Ap>OR3F@0**krO#*G&zXC8O3|6uPJ*M8CGV^E>M#FG}D6IG5y
z9cW&3Sz1f_;k=oKs*`71>~3pRnYm-{)9k-_(QO|bic@c9YTtglrPRN`<TQi*LB$(y
z6@2}lEPP|PCqri4mML!A*T)|JZlAtX_?k+0;GbQeV|2O062f^eM@I>y6(lemFqv;)
zba0L1fu)z{blvXIocs8Xaev&IN74pOs&g03)>UErnVcQ`e9ENRtD>e<$JdtfmPGeE
zzB{u&>GHV?r|RprHn{#+{XVX4`)b{NZH|AQv?rXcoTN7Oxk0auqw?j>uhHf6KXUY5
zEtTU@J}>LFHrAq2X8ZZ2YwuMvo8SB>{rN+Zw94W&;u7BB7ldcTU1L9EU=_}=*(PzV
zpKip4)3);icQ>YUCw~2!{ZOXsj(C7?IkRd0^$#kYDOzS4U%%~?RaWkAPPtxwqPKsY
z=9jJ81zvw=yEifRuI;APf0RFb*!u5j_VMCPU5ob$e~z5C$nh<29OJGM$LhQ1nHrt<
zI$5wC>aFm-pIH85(>a6OML+i>z7k5Bo4Bd!HGi<U^&QFk-mg9^vRnAszHlQG)07XP
zB|iOqx2MgWaPn&0kFej*X3Bo@FXKDBV_pZZ^P1f0C#OzUN$x%R-SUsrA?urI-^)^G
z-8ggay1wYK-3Rs8++BE>d#mOXA*aa~-0NT8{b{-9#pZ{_6(8gM!yKo&OVq9_;`?y?
zYerBh|J@fArq!1nnHh|i__@sdaQ64&$MvVq&S2${zgcj)?QhL&Ug<o!1}!^w-~Z;X
z^-LmLN_T}W@hFOjpEaZ8OQra{ubutJSNngQwN`BkU$fyPyKuXts|Ilo7&{#wz0=+J
zUiO~3=VxaAQe(Zm9%Ij^OtLym&8!jG-207v&emQvKJZ}@V_6fIq=|n-V)h03)edqJ
zTii>!lCDXs+1wO8GAF2Ii*lY>dEI%1kmwJyQa{Oi$r&8o;N0G?lXoHZf2yD4_qpvF
zHK&e5&fV%=$mb;b@v6PY<Q*}rj@nl$H}Q7vl<f*!!|Zpj@PMD_%ZRz_GPk*}c{F>T
z8*4<itea?|*;zjm{@oidZMzxwHv6V;B;%2bHU}3-zq@_!>YY1ppI@-MefI7%*{>z%
zA4|7x3=U|^`{@``shLzQ^(}v2?%5^h{v>~rJ8*c;PVvk}h8yKmcK@mBoM;oVt>3z)
z_y5;VUd%Or{;9tel9_tqufNx|Y-{UdHHB4Kmj$e9|Lu#+D*v(FG_hJu)N+1T<%J`w
z3>QZENu~!S2u|GRcD_ea^1kiV=);@#@;+6)oyBb&;Bez(%JwP6^DUaDe>JGv`z5r<
z`B40a%VBTieijCO{F7?FK)>ZlXpw&f3yXDw>ESD{D}JX<if!kcGwrC7Md@*K_Gd!u
zyPhcK%!}s>f2Oma`($ODh_|Sb9-BnEckOyxHnpEMY-zd2R`7PLoe;PC?YS4thb?>y
ze;;^QId5Csd%kzCK8T7GtgZj>bkg+lle-?~9ox5eRr%Y!2@#*vwQ6rI>*w9%ul4&`
zzjvJSB@czER<Xif7gWyX&DOuUw&<F%(4(l+rMs@~@awK>`Z0gr=V%vezkRn|*YD~(
z`%$TS$<lXh*CI2o$>jZ&M_umqH%TEUmWP4ig9!tJ0`BEr+2x5v>7XTESEF<D@9Yr#
z_b%R1MgEbtS$B3rUE~5+Ve6Bs;_*E<#J>ng7==H2XEe=a>XMxI{;%%8(0|Qy-^KIF
zz9pWG_u5kqPoMd)Aa0)It9g@FpZ;8L^Z!6`nD)0nu?MrxhR-?4T6yzA&Ea|bXZ)}E
zG-Xa_n)c7C#V7awca8h==h6A|5Bv8|DBqf<>T}A?W7W<T{gJySEmDfymQ|`9IZZI`
z;1snj>srmUubezNS>3-b^)|aA_otwBx4DieSKZ!FaaBfa?wlQW4Nkr`UDy>fKZ37J
zCAnX!uj94t;_L;%b3VtMKf%6k=8~s9F<uK@^&VW$cdAeNpR+TiRoP_z@42U^O+Q)?
zU=o&QKBs%tL)FQRcV|j};O4rvLF&ug;$_dgSIvm8c&EOtF7xP=72f;4Xvbau9@8bY
z_2W!0zv-&M#zl<Zk7k!`6D*i*{E2PGO?!Qphjq16!lRnZY!cNsFaLe<kFbcGME4@r
zTc7tVDtFwsnfu4_(A_ypew-@$yRkk`BGx;Kb=G>v_nVeIT`F6C`U9V_!TLXZ`KNXF
z?unk?S#|XK^Bh+8gTH4^)V_FXj;4kB)a=&eg6rBvw)_7*{#07_?ey!-@%R6JD=Tz*
zus?g5$&5~=`qrQKvjtvvU%IsV(4AX<q)r&@_|zC<uC89`IaMkDmQ{VE$n<Xo9&b$~
zPWg8WA68GC+O?)drHXl4q{z+rMz?w|cTJC03RCGht1B7zJT-a&Q(ocaT_WC5W!CxW
zWp`fgG<ST>G_x?1W9puL%HK0M4YD)$Ct2nmT-Kn=^|UT%QunWUp1hmZJy=jtZ2ai}
z$BH9sRv%pYPI71Q^2MhF7T4ZpIyiNi>7NBlQ?}eVw>L~D-#g{v{S?-vUw19dp0Rsg
z{R6MZUmKpyeHGs*{6JJqv~KId2VF-jy28IM56eu-Es@)?x;NvrQgmRP-ie@&OFda}
zh8JJ4o>+I5Vb1$?4}?@ViurhJ^ZG^I4{`L#_r2C~u3_zpJ&HFshW}VDyKAF~)XCN-
zRkt^$eEqBRa(CD}v8I41!;H!66%=x`wBGyeomCdKxad{Vuf~nD?quC4$UgI|?4{=2
zGB4-*ul!!$IWhlm+mY7(N%8YGy00td&^n*?Wacv7e_P$yemFN3&HL(VUVh8^aGd+5
zPq$qC$~qdNOY~CL{hPLWP2-G!X>0cI&U0mvFy~~SBdF@|Tbk{A!?&!xeiM1MXNN`~
zx<83G$6V?4n&b0XnA(<9dT_D3v3@XTwSTC#Ei5nXWXh$BC*R2h{M>#}KDMADGXJo^
zn<Y}UH|E}bzxS=oRqY3fhd=W!tUM?6;GD&p>F3%%n)F;_x#E4YE6``RUbf}(kGqs)
zzPSmWS#ptA<6K740z>^XN=IT+Og{fC__sUhQ}5F>*|%vcE@``^?z4PeRK8;A@2RVJ
zmh$|mT601BSWbs<f!&9WgSGd*`M0VpoBL6B^+92Uu6H68Q>3odMXN`@X)G(9ukGh}
zC(EFO_qd|hT7}I^og@6DLw+`u7#5U=bSur^&njH7`=yD1AHSzi&}TzVqYQ>Zrgv{e
zE_kp_D>{GR{}(mq+1~PJ?v!5Rj<|a#rKNOH`HfdiFMBogR$iGi?QX#*ofNCv&3?~&
zRVT5!Y*(GSaGh0kQNe|ivg=rk%d>R;ZExk&kqZ(N`N{G0Qu+>uYP0kQ`lmlV7GiYy
zKX1+JXKO>$!jHFHICMX;OW(Vp@&RY^(gN$bGkLgPZ4YAHmQ%nngL7x^lhpoa9FnuL
zU){R1<^HMQZX53t-xby$-<p=CdMd~!B`ezUu4`Gd(U-Z`W#7)ps(Nv7&#t*XhEw(x
z&RUasv~JIZ{S0@KR$APgZ2i>CS|#w=q|3MWd7k2qs*mUNo_INA!RwD^u18uOo0m5~
zc$ccN<4}PD`^vjrc{v~U7#}<$D5Bw%8P@xk)vJx4@6IaCcXHzWp&2i0va+SKkIzx8
z31PVBw(#~8bM~X}1CJ)3UNqa8;r+iW8`OX7Vm>zeSh`7zag^PKT$$I89`fj_EIpX_
zu!y^`!u58LzYce&VZjf+Q>G=${z<Q|XU}|8_`O%*m|&{Tvb~EPd1Tucy)T?<J@M!}
zqqL&}Ty7_|+w|@yZ4172dtuS;qm_!<F~2@9k*P^!?b`BND8}Q}+~wj&k1aoB7_GK<
z;Zi22>gL(=FO|qneDktairwmb(}(8JYoeEPjlb!9JF$t~b9S3Ahiy(<MBVEo%XJGj
zbH#L<FMTQa>y#K%a>1^^OXjU_3lq-HJ!P7BjJ-*VKf2QPw@h_Y=Iqp!TLoLpg3{MT
zNODKsI``tq5s@W<3+=Bta@MbT)0^@7&=x8G+QWuUv+GVI_{^T|zIJi;nqwNv(pXCs
zFEaTb%6`+G*J<!AulpEpXvAB^!@);SUG;zR^Zpr8%MPm*RX4P@mN`EATq#g5B)raO
zv$=+{)pOr1(oJi99^@SLalNuo@5!9p*K$T-5syu+8yL)aE_Sp>R+#CTGwVo1GkSef
z{o=ek>s#r`4{{G!%03zEMnAJsy<EHg1lw^|)g^z8XEzE}%119LT=nUs_RL$~szcTb
zl+W@!!mZhQ=0NR~*H@QLy&LMgu$Wus_>-WY7T+8$gqFQ`iCwbm0B2u*q(!V#_KkIZ
zo3r0t+quv#&~&zCZjN1VVD18+^Hl{qv@hLReDKXg-OXM%*K%85ymeeeCv9EO0<Krb
zWL6o??P=({^gJf^@>hPwx%cJ8*DAcy)wFW`RrhcH!($<f-8U^;Vwn;&`OYp5OJ0AO
zX*2XT^{qYB7IwTKEyw5|OWYyD8*NL%0?Xa5`<YcrRUbc=f4G0YefQQ$s%Fo2d|Q1x
zCOFjAnqeQ?QdQ>{4)(hn?oQmH$GW6A@Qa?wryUz?I3LH`Z`yNJ;;)d{(|D=Bho?JE
z(EKmqyv&AAi`h`8e!A3LFQvZ@8FOZ4@7u{4XTlTc*VXkbC}m&rBtN~o%#TwH|JQE%
zcJ5A%-ab#h^{X5T+>-Xb6+C_K#+CxbqrQi)WhkvM|C@JvuIb_Sr5bi>(F<eQw}ftE
z<X4m1DrefT#aiswZQDIsl56fd#WF0?+Ek)H<^9Sd=8~)e)7FRi%u@fyyOuZcdyVEH
zW4AM!NspFvOLG<~CtUEEa3ks6o^xeWzF)oide>328$u2*ZNqC$dVk)r-CpcH2QRZ@
z1#4;OxzcA*`~J3N?9a3bebz6xhu=GY^7$EUk$>{6`;uRrh*V}=Wb-a!!L6%(tidO4
zUNgFDxORrw(M7dZ>c`6MPjY{|&(>VmulkGaiFb;)xt%uu??ZbpOgy^I<jdM6?mx|M
z>#lVD`{(az|GBN@qEaz`HpMPqFYB}+|3S*P*<EYC_f0+E9D6&sb?rCTyW;1BZzsp)
zo;9_*<Yv}&{=mg%kFbkr7rPr}GroEG)Vxeox_czr|DH*(ajxN42NngUn!WR8=&Bt%
z$gzCMft8+)Jwlg)1K4;{WGp|N<yG`QDgPsre};x?EK4ZwY0Fa4g|i+kko%F<RlTqE
zR=pQD#}c(=tG<L7{N%6UoW6bUgMOQjObJ&vKG`dAfxY<K>&73gHy+Qqtn<+B%|)r7
zVoE&c)fMjUdMcSat20u#c)I6`<hw@{q@w44TzTksT;=k{DT|kN%F0fcea;@|{3qt!
zDt$&XuY=t@)wMrLL!(YEU_W8N*1vF9WI+C!FK@W^uQ~nDNL^1T$#z-miMz9xd}E&W
z`O5{1Dsf9`quF13PuPZ-Ij9PqKXNkjBbQcSV&R{zb&q%DdR;rJAm389jkDbU-+|No
zQeWKtvNkO5XEw<&-?4lX<Hm#c{@>)}x4msw{4w)u?}UcfGa^<S@1;D9{~<ahv%9VT
zq>j#&w#@G-{p)=XoMzp_BJtu4`!y*?{wVIBk2p^4_*HOg#;-nwylL`2chk=wmTZw_
z|E$rsAWp{d`jZcbJ#RmC543+3^|!6ra>kQNi`w0P5?-<Oy;(fZL4(~<#Ji?n=f0Os
z`0*RNt(?@w9Ay3OthK)ruFGNVRJHwK0w3E+S-<;w_A{zVWxl>Dc=cF+)|ZvspY0Ca
zj(9u4?@MCV0po@|8DsJ9XFH~v_4t^V{!N?xy&!*z^8%UU6FWYHYc1}NyB};B`7u;v
zL1*N(tAFEP+Mca?n!>)s=h2=^o6c^W7_~zwGr+2L{-gQ}EAQRC)@RLnS8-W3^B<3A
za}MU8EUV4E{@*VzX2DynY<JPzo)3Nc*^B?%E3bL$(r@o}=em{Gw&FfPyI(#9fB1NV
z`K1FlaZa-R@K^U}`_ls(1FvQuVmP^jd2-Gbp0(*I+ie?@&-V6Q`t<4LDcc;sFCuCm
zf7LUfc1;4+zFbidVqma|W?)dp-8BJkP{~cq%+o8Vyespz=(gFX{qvc&)=!ufSmC+s
z<yV`>vv>6se_ir(#x39XZp$AAsHALM$RX=_^J2;;hwoC~Q?_^WGbuQ97ERe!KFdev
zVe-a^H+p3ox#vuHz5V?Ee=m;PEKT*5k4@c@^QqErb#T!>uS=}8UrefMN}Tj=WCcIn
z-rZ(X`{&8a#moEW+bNoJd&OOxHC1JC`Idy$swHZ?zSF|m|NohtQ2gd|Ps~(a-36PX
zHfm)Sg~^@O-lkG$6L0>y>zLum=>b<KEYXQP9DT*zeUlFBj91pHuWnD<eCl-cq$^LJ
zc{p?{v8Hyu5dFC(dfr7*-Nbd7ey{WH=FAnJ$-E+Ad$PlVMUj_O-db?&%lgLUF>U&n
zq=O9$RtZLb%v@oX|Kt4hlEtsWMR%{Av^1~4eYMv47tw)sYSZPVqNaK(a)<1f$%tI5
z#r5Cafko<Y(bD%5#e^<AeO><Xbo{YD?^mCmEq~7@zdkO0pY8vbf1aK7-_tU!yzrEl
z#P-C{n)&A46`r$MPun=3oiu9|qtm`W;k!PaeG@**EcsKD+KxHvU)KKqYuT!ndFet<
zjmx(B0;9-1Nu_f_wtt;5Vba{g)5TpcnQUp{>|6LmceQKo$+&x;^A8``C*I5Xz9jVA
z%^4EHJN`@v+GnS1`89N^{%5uQi{F0wV7Y&BDDT>Jv$-xz^xd2N;n$yMukNZY|CAke
zNjii1kBz$d#k2PJ;*N>i$HeW~Q}uUyaGy=P@(;^p8(yU58lCI6RG1->+~lz7dF3sc
zmvMnpHa*qSXVAa;&q-`XZ<W}j$BQ%$*WXbM+po7czHY(GU7l&IdzXdI6RFf)5?OBO
z7BrW~iu=rErIp#Al46&2J)f_A@J`EH9rxw#Z!b;bTz526`^H4w!c~#ItCVe7wYW3A
zyH56OOv>V`o|hV~YNFHiddsQsv!~<#IA44JIdsnX$3544r!^<Jc;x2lIUMmVs^&Tz
zmg^dp`zR~+)U#td*8ddw<#yZ9QTqS$1?8uA^J%bpdVE-!G}|-avYNzX1~G=rp7_b4
z|IMxzFI~;@#c1`Bn7+Ov0dt<lt5)7r{!nzK=bYo@=c)IO6h>T5vJ*S?WeUrm{4ciu
z_?e~mFqX3IIB;Np-1-dBJ|*5lTjtQt$8%?{@)z&#sTBF#(eHU~iPQE~KF@57FK(R8
zDRk{(6>HS|Hu+|i(~o+DZ7oE7OFBblT3?yKF!8!?O!2zS4_-X7ZP4T^d3e*bx`E~D
z?E`fN-w(VA;bpP%zV!V>rqF~xmRpS1#p{$`6l;mxA-<q%<FU3TRc6N}o}EFm`VBlE
zb@V55>2R=~jkXl|uxr(Uny&0^>w>t}1Z)kMJImIw%d<*hn<z8my-R9gyL*~ar@duf
zmQ*U+e5a|$T$+1E=w@~gt+gupA<K(29yFa@F#WWp-_bgTr%6=`Ql`v~dXuD{xj+8R
z^|f-h(cDLS8@>iyinbKk5ahP@C9mvcqxpx|tvZmOX;d;H>Jxwbbg^}zRx(rWMe=y;
zDzI2!nv)>S%=X`QgZ1QT6CFiaPX=$*zfj4S6=9{o7qPiWA;DEDJmJnPTSu`&?r#rG
zKFZI`7Ob=7-?y-LoI8A`@pVOPQ<vzk`w;S$^NXK_ZfwJ*3IzlHwBN~B4yNey*!A{p
z*?KZEq)%UG(uG&LYXV{z@-FsqZZiJGYCqlJL5uj-W#70X@-sKN-8xwK=l#lF1uI{U
zkM0}p2|Orqk^4K9#a1q80q>nduQC^Ik#5(#v3ByxZ_)>rp2=S4aC%Cc#c4y%@+L{i
zZ)SB{?#nT5xZQN@^{lqf4|FRSUtGB)c4hvvoY*v%EcQb?<Q=5kj%W#dQJ!{ZUs~}e
zLGcH{8!kJ$U#pO@troLoQ+M1DwmSFtk_1ilhci=;Own1a%x$ndTct+Yk2BV{d)6)E
zZx_!db?~*e1#o^n_E2NdicinaFYbz1Z+!fJr;aZFyedJz57$e$11;BFoOt%6p#8=Z
zPJi+O_I&Hrlx4`Ar8%!FJ2>c&lZ<;q(Tt6==G_g+&N^he;(@f&^=-8al47S`xEi2v
zL2YS*lt(#R`<;c3Q?A5au3wvYdg<CHR@pb#$L>(BVV;n&xJ&O^>EUUc&M-dRwzG-%
zfAj4P$`8t#S6=XKTW549*Oy^k6o;ju^ebkrD*mtfLKBv3%Q>etsX<ydW3%hNNrpm4
zm4lAG=sGDhn=$iY!!6b2OrcL^J3e+5)qT{)$<4ZF(S?VaA3lBVnp$yAHnTiui}1yQ
z8>_yrEeiL3Z)mPLSvbsn^^!=J{hRi*%v^M*vEhM=d-5T-8dk}8$GGFy&Su@c@-QRI
zW9Ki1c%4tP&S+)?Pte?O!#stNY41T!lP6jclO~xiVH5Qfdoxcv_Db{TKh5l6%^N<P
zkUXaH!c)v4t0CgzZ>{_vo~sJDr^v;sq=q?EUTK&3^SGd>?v_uQv_$iy%BEWt6HWe1
zZ@O8aRjt4|d6ycGN07+7h;vfk*UsHt^21ZfaFb2rjNAil^VMH3dKn#3{`}H{wgVr&
zf8XHM#D4NYS?c0koAg_<0X9dv3J#oY=2p;M_hI7=zJ5!2frT2mCm(D%(tBBtPi8@5
z=39o~@-GY1kH3wO`DdGQ!%o{=qIp$Q!2O$oyuMuxs}0U4&TUNpp`cv4gz-+}L&nAP
zav8q_oPEM~+Ff?$X0gQ9zt8Tlr5{>Q{D<#!3;U~NrOLlO?_D;OS)O<}bJJwExPW7k
zwhe+$0vu;fWPCLH_+Eu4EC2E7%yaQKX$j2E`7-Zhl@8zf?!wJ%Z!IjBd`_ybS$AUk
z)9Ej_G*5UiEm&yB!<h}z`a2S8!??wL*Lyy<))ZfM=SgSc%Tu~;j-M)~M>E*Y>+`MI
z6|k63{jf&TCgJwu%kQo`u+gn}a{t_Albm~>b)}y*=(qaa_h#jmV-tQ@O0C<sOR-t@
z*XzbxS+lnV7AAP#`SY;r@X6baOS3nWNHE?$FUFnzQcg$QcET@K=g*1DUmupd*t7QU
zIiDYM%~}rG@m&1#<5%<@U7dZU&W-=S+i*`?@?^K-wI$nRt)EPCdm>c!R7RuG;QEUV
zSDpLk@B4Q;vBz=7c`=D6tBr+N=354Tx!xhTRHEv@x3`IDJEl+DxbxpasbkEk9c6~Q
zzGh4_Teu?K_+{^*Q!ebUb<6`aO&A|sJO5w7x9!xrp!<f?{-1FC9(BHoZ~vLF6J0kh
zq*^}R7?OFtbE6;6g1R1sZ%f0>5B-rAS}psl-%s0G@=<_D(1~wz_bfVW%W&}hoHw>x
zC(kTY*w=0QyDfVvL&>xoN;QJ33tIekt|()^7tsAp!*|n(8~k@aT$-*H)PJFtZ)Z=#
z3%;zE)8vvOr^-cHUc7pLQb^R3w%}76dTTcN`)b=B|L5>RK1jUyPo2N&=GH55>q<2L
z9^LV3Le-ysk97ZS=XY#9U^2Hlxc=XVu5)u&9}c>=^56NFn&FGfFRwdx%yZMiYkNH#
z?XJE(fBhHFt_Pe;=NoLa51z<gFMs0Yzat*L!nWsgBPZ>@o>Qq&;ceV<*`CX7cg**g
zU2<xVZ+2#EXjV@(TN3Y?nfB?}hk0)5J>3hB-z}5QT2OWQ`MwigZ<o#ZFXNG^U~C`i
zGVAO!BY}tcckW#_2$?$j)~%UaEwT@O*kKqy^}fEEbj%jc&2Og!o9s*Ep8PI5+AiIo
z&*Qs!U;fcvhR0vbbQ^B$lMRUVzZCAM#^%AhV5Ql;vlE!-6}%})K9zrD!t|2j$j~*f
zN_>g}O7{IWerU6U@#jf{53`q4s5pp(+1!XxdHU9B=h7!XlC_%ZlLbxVE{f<cNZoVQ
zow<Hr66@~vqaKrIeOj}t;7jL<R|))eX2J&i$4=&4y`y?muX<UmN=BUdhvxI#R_ii(
zHuK(ootUU_$<5ubCXkmUj8~iai=fkDkNJ<TFs|Yhm(}hzm3ixEuKx3D_lic{9eGp#
z=V~5XW>t{B&G=(Q$AkA)lg;}UzwqL}5Xe?5y~aK@e2#qf>b>nowR3+~=I!|FaGh7H
z@7IeRy2U&Cn;x4<7RQ?`s}_*&v^n<0)id+5v%x2e1qZ)vS(FmCxR@beK_<)oh>dv}
zJ*m!@Tic%f*%?0dkK3BL%Nu`6tjU}!@rzMq6QAm>c_~v8rDAl~oQW23f79tv^2E|q
zl6kQh`!i;(&0)1HcdfriId4=ur(&IXvf}l$=Zoj~KG9h=S2=F8@jSukGs_M5qxm+J
zdia+$>A#NCpR@1EO|hAh+<!hPrb%?jG{$PO9ag#S;&NhbWvAsOadmfV(+*ZH-Y@HQ
znfLyWa@^1J{Xvq~ivP3H_iteG=-;5!|1ssv!ZME!O6w2A1SKkLiaESq^5_B1{d-Pt
zKQSfV{CLu?n1}OL3(xU8vHFRv+40-YlNe9h@@jeINtUs{jA*jUT5(R$+R#eavcG4U
zYtT#+UiYxg_e{B(Et46SAGfoWvwb*k#bxh>$<5`rTn_DNnx7G@QIV_7$m%KduzsOw
z&nrINFNVf-2fQl%%~x=3nW$`>krc2aG^p^|weL3DTUMNTsKXJh`&e$Vx56?<wNl^J
z$L>g4HFFdv^-NiLqG<E2j7uCJ%{N=O*v*)gqa*D({Y=_3;ZNMGtx;^emGPUZbNZgF
z`@pj3n1|Z)*n9G9>%|X*NoIcZy1DCw)d!2+`o;4c%#%0hKHxBLpTIHcvB|+3dIz?+
z)xGoC!rVFe%(*rZyKVlN1=n|qrY+?<CiK&I&d$x1mff9VYZVr#*M3~+e0%4U9}gpU
z-#cho%Wr9MUi5X}yR+wP?tJ0v+|d1|bG84iDRB=k<WAVCa=GZmf$b+&u$X7hW4^<9
zBT7beukWfg4(viZ#EZ*SCC+uFI6BTa`90gj@y9cTZA@MJve;E-Rn4&D`4k*ta?(se
zd`pNj<EP}J{U<K7?tDH&w_=V&SBZ4Z>w|5Yg%9(l3Aj|Y&J&xh*ISlV!KnDmdqJGR
zjNNC9ScKl^I%ml&vuKnJo{|3|;P<r&!cM!=Y&vJXUz+uR`BkG~<i)I+*GucJ?|u0(
za>G&i&r{ZmcNAY_mYVZT(rowJS&C_O_l-r>Oph=Ny*kx;JnGSH)_DS-M4P7O><D<!
zY_a3y!u2z^pZ|4WQrP>-u<E^j7hBGMy0Rm$NJ;g8z4{FemoEFfiVWj}e5U8~4bRUn
z7VOx)?IBC8LA;IAoI?-P4zX)ZIb9x?x2$o|q78~Y&3&@gDQ?`R4e8aTUngG{%Vqf&
z+P}iHBu#&px68?Vp;gDK9{h}5ee0Z6I#ZWyDD&?he1e>&LSh?3_@BS)J?Osf_3@{-
zwBnfj<ktH?cC)Jst)1laC?m+gKcbMm_M?&K>QK&tW5@l=mhC&G*Yxm1s%jxWPiWbi
ztfa)b?Q7Q^yt0@>*3YqK_Z|kOsb{W9M%Of@vb4mi^~QLZK3nlPf-h!9XPijNn);{+
z4vDC?DIu*+=GJYire>JFi8)u_|J|GA%AL!rJ6|_0Kk;s(OV@nW)xY=dO^=@2ef^=w
zyzG|;E+#15xPH*Snd6>!QM*Fhkpd0FBf2GyLY3<uB#Id3Z~pya(TSvhqY7P~!mk_7
zEIqemhRw__=ejciHY^)iK3#5PDl~8`nE$It?X_9qdB*7X!AjfKCrH0%uX$;(b2nSt
zOOfC4L56G8b&Pd14C1(bEH>-N6dFneO#SuwN}Xx{W35{mCH?*V>su>(n*(i52>xa-
zn)y46XZ!KJC)^k^(`9mA?_Ax&GVS1!y9`&hu)Cd2h!30M_?vC7*!5$E9|C*Z+waxs
zeSES&Mc1*yAU8tc?Ub63&p%U+Tsf!xnbpp_a_3ILdFpk?+@2MFD4s3%FjjT$?QOPe
z9?G^A%SAu@d+L`@VRZbFMc<Du%zfCUr=2glTTfg2R@TcG^NON&a^Frl$7;GQRrA-w
zvtQ3HP&N5nu_s@%l)r2HnvV6Kx4FLTKKJ{<mzI~m<y5O)Xx%dWbH9Rfci-U^*F!$o
zU%TSF`&HzsedlgpR{K>|DVBCSJMg!9(2a*lEZ2MIly$71{p4_H)%0)sD%O1DNZ?;7
zda}o{Y3}(AZeRHJE)O`~F;D5vJku=`1g=jps7}_Asggas=ZeN2?^QC7mwjDPeEmet
zz6-kzu6><<@NkJf(@pu$i<Va%za-An#C2XuKYNdWrreI+caxOPf4F)|Kq|V<(Bv~~
zSBq&?=%>EtubKqj%sxI#?)V0Nr|<r587_7cy+2A$y{BF*$gX>Mk&krR53c1kNyans
zy3MyFzm4+Vf4a*!Ks+`ofZyls=KJw)b|_lCyi?cxF`#W#mCa4zE0N4+Kb&N~@$S~e
zwa$WH-)(x&;i=WB@M2Z(wFq%{mcm_Ul5FAvlv_T%fAL~J>Hw1^=ZX9~atsU>RSXR3
zxCfX@DhpEMlQUA2vorJ3^$IHY+TJd^Z87QnFRs2%4w{P#a?>Zh{AM{%?r7MhS!Hk5
z=&H~C_{(4l$L*ZpCDWFqWZ(U_;BW8WO>4CnR2Z6eEt!1o<u={8hE+~?S2NfapR<?w
z`|FX#tPLvZ`fZBdT`#PXZtlB0pLKHdx1{s8Gi{6cF5fij&dcL|{{P?go40S?u4S~3
zvpl>c!SK$Rv`jIPz*$?O-j@AN7dsy@&H8%gvnQ@%zFf;A&dp#x?E7xflVi>4QEOl8
z%(dEAZ>#@I@^h{FtV0T|!YZCo7a}UXW4gGeiDpVYw^eWbZ>*MoV1>aP;V0)jdY)Gn
z&GEFF>uT7bnBVg}Q0CO`xrZy`mRt^;aCgI^=X(xTKXN|3@o(^ac{RoA7naTKO5AF!
z-2TV+Z}eoGus4~L*=oZFi&KeL5{){aD_VDL+LL(2JhQM`rgyVKx5S?MI_Z=jMsX2`
z+?O0)^5@5Tg~OgVQ{q@2&v^JZ$IkIp>+_d3vp4L~F7!=zap-*OdT!HpodfRvFZ*ir
zQjFP7s0h!9v#U{AuUoxkU!>5HtENBGTFTQTo991PNH@5|5~*<ZRAJpt_9WiPueY%C
zOcHTq*&@j({Xo_7)Rd>0Lhg@?BJa6%Nc^jr-}d2p^#jL>j~~of`QBO@UNGIob|A0$
z&V1IRYv*r{WX^qfUm?;Za+XiyN_(cxiCLn(X^~ZvSuYF4Mfe^1%Dn#`)4Jz9Z(811
zc_}TC-dJ+<^v>WrYzH<;7Vj%K#P;#&i&x&SReU8L?Rwv1^QX2`eBB)8s_o74yVi!4
z^p@M#OZ;fJ=jW@JoVVw;x(|olxm$M33ns<Ho=%?9rjQrfFSX|EPQmoESJQh~C;MOi
z)2$FJZ@MF0z<7zm2ZiGwlLgLy-FP;YWfy;A!WRXmLyceWpL={`537k}r8p-~b!PNh
zxjU|jyI5?CLhAz79ds=|A*VHWp0mpGPWwA|8QA08&E0oQxVq))q{_uVb<&>ZSIs~F
zqVk@oyz2>x2DX~H)0;UOEV#ZXJx`217;&Y2p-$GJoM3~lc}y#!bRYPrdpU4$MI5%^
z3S_Vr7Mdng`F>8JR_R>v{|)`^jxx%T`rbv;R1~6${xQF;>9})t=I$M?X~zZU&dxX}
z^jz+W?u2We>tD+4=MX4Z+s9n6f?+qG=SjOsK@JPfZja~E>tM2d)$p!8T(+}G?dE~q
zpLtw1*s>;BC95s0D5>sy{dbz1r#kz)<b_Kdw*S7eSWrIm!}7Az5?qlj%{qDlSDMz<
z$*7ore$b}5r1yJhUCuF1kB<}gACa-_DLy{!d!|^^t{pR#Cs)_J;&)_=s*_`n+@tch
z$ktyihT-uGJ`-<&wtZXD=DwRQH{-;F_}X{M+J{UnHP!1&YI)cEl&C1I>R*3h1>+^t
zx=$bUPCHE9?3bxz`=DDW_QHfD&kq-CC#PM1XS37$((ffMJQi;^-YvdW!}($9yUDj#
zO`Iug>h*~!eRfk-I7heq_qCTy*bd)kzR~#5e6hLFQ}NPS`o2@-@478`Ql!9p;-Rj_
zFB6`Jr5AP^BtCr9TO)KNqikXW=brhj-YGk$pKF?;a7pAjGn2oi%5>R=Q$O!kN*}R&
z{Y~bh-~)aAL$@x-Yv&iuE#?m>>?zu?e#4s`Ul<f0G<CC=_;$^C!@sHW*uQGIMy7?!
z8*Ux6Vf*R(vtiyb<qf-juuZ(HCHiP#pjmpylCO^8jfqT87^OG3>|~j3*;}+F>d8M<
z^94I6{Vd^`<2FU5BF577j8N3Sb)Wg4r`Gmq2K+ILFi>|WaQqN&)g!&+&ePK!m!CSA
z%RDK1?sZiERHxvCn=du}iq3`H&8yv%U2wIlYfIl1lg6fCy$L}E6N9fUcRss(rDY43
z;j-TwZn2;157WI~sB7$1aD#aU>w>TS3pALG1ZN)W@+<p4Vef(eRqL)=?kbxreWhDe
z#XoO*jnGxsmdCO0zRa0!`~2%vKBWbY`mt`|L5cRe^aHrl-(9ZDJrq>9LSkxzb^pcq
z^7&p@Zt36hxKVaZY*qBRFHfQ#+<t3W|Jt(tzQn%Y`E2+9x_x;2bxyc6^Y;e(qCbWI
zbPurf&UxJb*^D#xcOvT%)d2g5My(IWPq3U~n!t3vpG}ALpTy0?pNxrtje#YH8aKQD
zIwO!S^ey&7qSXT1*5m13TbY(<e@R!pwdxR8OM|CrYL=#Sh`#i~TeoGjoTujVTyeW5
zDiD|OASN>W=)>5|jGarT21Yy;{lw^bR%Whzaj5d01Eyl)XD^6bKA3(fI3~62$>q6v
z_1`47Ul;gk={RSjf{Rw;Yt1<v2Gx&M8-uDu<<!MzIL%<`DXpGoY&c~@U+(#tdg<OJ
zOkE-e+wCWN8aS&<8qRKBJ@4VIwiR{C5tj^Svs^VWztetvMY+)O<OtQS4@K#MtmksA
zd_Ojp%;TP8Q}94BrswmOo$2R_MJ7B?TGHtho!8njwRp+lu#N))awj6<E>vH>d+MDe
zn@7x3H4Zjrt0`@=_uIv-gFnk=$~SWFI_16O;<8KpJMP@w|0+u-Lhq`G$fshNz0p<|
zUo`zP&}e(7AiB9S@$<sd=T$e$KJHdv`5~v*`az}TwcF}zlFX(P>s|6zaldX{$8n@;
zgUf-M$0Bkwo=;I`DlfI-WA+gX^iXbHT(aHtzlTDZWTu^oX6YeEw)jh}sdaVSj2rlq
z7s<Uj@U-@FXl_}2qUZzGCr(G&H1wu=AKR17F?+eA;m)@y@1CCPmS6wx)=&NZ{}*fT
zynJihSk`v^^*f*Ew`A2=7M##wG}N5_gu`I&H|0BZOqwfpbH1yVOpOh%JG%Z}`uqEb
zv{^G7r6rT^{D1Oq?(-V83;%t^gBw?=&*|QEEb4?qd~f{aB@W;7?qB>ec_N2Jmzt~S
ziuG#i4m~O=xNJK4x}%QX)BEAt_xTwaQX7PXB^>Qs%mcgL^xN8H>K$%UitpUBO~G~B
z8f%sX$(aumm$Xhl|7gXF9qb3VcgMaB{AQ52`Ov~IClpR!%4yA3Tv#k8UVpO1{NUVt
zxepE!M%+d#a}@6|#6Ej+(f83yo{*$UPKPRuU7P*HKgSz%{kbuz;{I2QS5Lj;LN;i&
zY&AXp^IV?m&5|&k)7R&!%y?C1?J;d`C%fD!od(e-i);=`zJHVU^Hy)mjXU?5G``H@
zQaJm-<{o3`tVegc)@y73asLsu|JQP(Z4Q2qGr7grKX||^QJUN)cwx$U=Dq&E7C$`R
z`2Vze#U3B4@)w!roLw0QV;<f;@kV6UKW4e+?JT`Nq+~giC%$<-GyVP9qaS{B+?WvU
z`uE-W<<FHjR2=_1xm^5jIq!lKC7szP+sl(qF<xS7j`MwA`{*U}MArq3F7JLbIDeYA
zfVKboRPUu?wi}kL_em*z%)`Osf6o2y<K+K;UkWO1jDNV{TJjc!HB~Ko^LKN8?6Zs8
zE||KrVtTk~&D)tvrOuU!@4U|R<viQ}N<$lInX3WMEs8&6Z57deSCq+eZ*E)pZmTfS
zc@N&qlbidl`O`9y4f@AFzb{ZakS^DrF^83DLI1&nd|Ebwa~D6X{D1c2gEJ27ju#!v
z4r{n4o?0^Jh0!I^b$s4pT~pPnH|&r6bZ=@X+x39LTfJJ@`D<S!#5`G?=hSvr-NBHN
zUnP6nUl#LB84geDZeF8{Up{cTsvdIK<@s{<T{dB+bytI<ca<Ei)hf17DqJBM)bZ;U
zd+zm+ouO4x;a5#sRz4SJ*wUnBx5#mCz+G?cGu#i?MW`$D2JQ{3I_%_fv}J2ZyP&+g
z+7-2%w`xCVRn7`c`#D7=Mp7X8l>*b}+t=7Gc?y*JCWK8$2sV<~_HpKC&O@h73KjVh
zV>muXiZowlkt;g?lUI>H_|yEYTsz#{Kh!%tWH=~O`rO@N{pWh#s)x^AzAohyzx!<I
zhBd9*<TO@ms7LNpc<{sK>NS>PVYem6!Zl;AOgpKPyJN-1>5Wrlzi<T~_;7o{!W#-@
z&8&@5VSBG;NKR17GQGX6>Gyu+8Anz{?0A^ESA<*cyWkF^?>;+zbZ(7%w<M(Ih-E;|
zieD;hd(!pTD$5ntglMq5oVAo8_^!H|t<I@a^^<rr!#<y%V|;8flg9Lft6KU^;mrY!
z3IEuAUdD<r&(%E7&==RXg}H2YbKlH{bj`LI4cZGI<!qi}8(U|3+Dq&7@{Ci@U#knN
zPTgt5bvbp`lR0lfHQTZTADljX@KbltORi5fcBz%2*F@j1Ik94*-C@qONUP+?Jy%wH
zFiv1A(PPZsINgZ1vA=ZV{3d4aCo2yv(o^NxlKrnX<j$|)ush2X@33nuJ1G0ubN=lF
zGiHN%md+t-dsff<&7jg+v()IZ2kXR3#{)mv3J0=$@A!81GuN{%Wx6KY=Wy(0<?k;1
zmU{fy(%HsdOU@g;T6WN$QTz}0UBkNavpWuDH%Q2d^WXC-=D(fr!0KbCZ&S{}MOT{z
zPNzyQZmzk#bBlr2_TS-m=XDjYXWFv6HF%>K!|gwJwLV>`ow%O)q}-n<N1^;Rb6e8=
z92iQsCttnbwubw?wq1p))#`{6Ui*%X*EiUEynXN_+1X}`SFE?_+N_l5IV_(~3!Jo*
z>F0N@)i|_Xj3Fy(yV&>489_VBO@4eRtBBz*`8rR6`-0-^Soe)RnLBIOOYP2T=$v!t
z@V>`#AI-1sD&qOLp;=sWWs7#htr|N%#XGYPy!IAP4S!qy+GfSin!Xbcp1i0jJ+f|_
z#ky?2O~*g)i8P28Kb3EM@mZrC$E%h@RUGs9<g%F=bIbRJ-|PE*Wwpkm$Dh_Idf(i*
zl`CETdb;kTJ@32cyz<?^WWeu#fB*aWS3dKWa%@-3I-ipo)A~SVu3xjt9S!@>ybUkR
zo^RK=xn?U%&fGegIdggY+5Ww3zxd(Hl6^O#7Hut(dTZMo9%XjTOTUC`vqs9L*;l6=
z=-Lx^y=?mGt(%^x-K{d}j#W1Q@*^a;!nFOCnwAB-=kYjA*+a7P#UE_btkc>*A^*lB
zwK(?mtSeaTpT180F0ssWRr{`U@qAOfcP1qlf3f^2QN_>IeQ}ldhBFm2?jM~V&JrT*
z_xVm`isAZ<Bd#p-wgkHbo9ORpim3Y1V;(Hnz3IYbW}7*uxDRbO{Ag8$V5FnVb*9PA
z>$2BJ%(=vUhiAe6E?Zj-0WZnc-|9x+_nu8?DE7OkU?$|?5g}@L=Ar3oAyZN3BR{4T
zTugI3wTQD>u))IoN@V((2mgvIK0Qo&67+CO;-3)N{V^NN>NnqY{-M78g?;C$p64>I
z3pe{bKQ|@u*_-+DeZLP+p8W6kLHo-5bN2VYoM->?Q$2e1k>A~qFJ7?UD{=5c+11-A
zKP;DImpqmCf3)7CXttC0ryN(-!iaXJrd|6c1^m=6om=>`;Hs*(*{95%W+vOjUT@f1
z7`gTPqLm68>%LmmOZCjI=Jbe;n<4r2es09{$k<7mO|yHojiP^Lu)pj3Ud5i{>zv7Z
z<3&+s%VO`%-mM|p-yT`;&tY55vEfksbwM$Yse&y=?`~gy{P?o}zn{;)A3r=f{+zVh
zgO;rqzFMhPo}Yf%!s}hp-dD*kI!#`??|CatVrmIAn{vQBELG%~h19H6IqBpRJ}mDI
z;?61w)Yq_!ZFF-rlKNHDTTtux>_DL7&fQu3pPY}%2kEWQdA<MV8+qP)-yGNG@5|GB
zJM-gl@A!s}HwRCyX)6--|Ib?)HFs<MpOybBv;7`kX8TyX;mm4HUa`g%%uV(oA|{{j
zduOi7bC@yj`9a<WHn~3%VaE*x7j2nkHMgI;d&(JZv6gwOg(oh4tZdEuk0YpNn%fnv
zs(*J=>ZSSfm2Mwd8FtgoW?#bvhGViaeSYWLnm?B^EqZe!dlFyOf$0}3x7g{Ju-}V#
z&pmJ2LSBdD&N7>A9*<dHCwzNwKva3k!Oj!+_sI9u+1ajoDL(IIVe4t7bn(nnUNhfM
zeUtt_{A5Y4_NC<FbDvjgH(1NpyqNzru{P_&)RQK{E~>9Jlm8w(`EY~gwe@BC>pDLE
zRPzX*cK@}td}Xe}{C@Sq3C~|dthQD)oUkL^Mlg0s(uByiXltcc%hPUDJ>^(=HhlA$
zSGqH18w;2f#mMm2B+M?(E{U1ma4fG+z*_B@;bh&u*&qKNJ1fJmu7BI)=L(h^4W1NU
zo%UkR(d+sFHyL_QUS^u##i@Sw;<rs@I~F8WDo^{Jz1yZ@r)Qz%tyhn8`PB|Fxyqm2
zv1wh+{^z<H;ccd=wSx7F^5S;P4&d>y?oe~=+uhV4zR2R4>&~X@aaU}MmG(W^d#FBh
z;pvC<QhjxClMmib+x#Kw{goTOIq_eLT(7D9-KU;on;!ivpC`dbY;tJv+8t}ogdP2n
zb!qAi(a9P$J8qk#rR~*U|2FORG>%o*viuG!)D+&dNm!zwwdR08`L$<BCzCsDixU49
zaH^>uO1gO|$4x`|yL-{pN9&&d&Zw{X?|J93?Dd`ZN_1xFvwYrtc7oQI?S47yl5CGW
z7y9~nrRwheK})tpEecg?*4eoBOpR%M%~YQVi*V1m&6a=P%%2}OM>cPc!~L?;o9EV8
z-v6`5b;`cGYow!<JO8*B_?^4A@cY-Vlk@iPmS(6h&WdRG<@V)k%Nvj5J1jkO74{e|
zeDG88o8+~hM>0~kF+^_rIIT{6+SbJ}XQV!U+cC-U|6;8N55qLCs1*mC)atlWnfm6^
z!nXG6teGPHL5_ldwp{sr_-1w7`-71$_O!oH^E6K5n4LPkd8X_}lb-9J|2w?pPjCKw
z@aFNx{|n<ki|fpt`=I=}PPBp7=Uc*@t5*M?bbQC+gO+KZ&i$PnEMK{BOX|}T7H3rt
zF8}p<yGQbWtBzSkVz!?}eGV_5G3D`B{-0k?&;7OdduCZW@7Gn=cjV@E`RPcq-??mi
z?s7$(fmibGO@V$c5^`q8o<$wp%6CJ@ySrr4F(og<XZnY=z6pp<UL|^qZJ}!2s(VFu
zlx93!KfCFvNJwe}>yf}`6;*%TZTLLiSFGRQq!s@p+<>co(?b!*f@qzytv3UAJQZbY
zi(MRV85y9i@~+}A>*=MZtL1f4cTZjODg3wQ0iM<eHtwueKltkTS6H>p_LiDwuJ~c)
zs;uojwX5eGdd;OYRsVV5#$|8!-M%auyYxwn`0QwggQ{9@v+SkrmmJz1aE8;d?s(?8
zYo})~co3>uR2FE=dg*6&?5_(FYaD{M#?`NwaC@y`4D-`<7HQ|_IImlE)J<vTyhpi)
zPQl4<bgVPfuRc^hvEm=g+ZFzQH{YoK(G$;mOz`TfWuKG$q|I+KyVO)}Nr-#>hUr9U
z#Wi`}nk>GUK#{yRK8DM-t&mloAG*|&hmpl^-kuq3lXadNeUA!B+F7>3sMbh%P5gSH
zT5*SELZt=2KjzyU&3JVA!Q6GTZbh$-I2PEnieXOiC5}hsJ4EVzPVF!H<b9N#Rov@=
zz|!COZSnp|4r#o(p}W?&bY77<bT09;{k+pGCoVq7y=xm-=A8ff)UDd<u6o5P2Od|Y
zA83nP+{=(XD{g|B{}j7}tCsgyPuQlN6*uQkQPHoLDa`%VpMCl^37=YYQSYo8_qx+2
zEL--dxy;%z`(<a}?!wiNtmB?UpIgIz(?Wkvmu5p3<G+8p5iAZHR(t6${B`l!wHl8*
z7Lp6RXPv*H!u9AA$A%d9%a1G1`rSR+%Uqv)_fD>vOZb7y*Cc1ZR8#5kkIP&YyT$6t
zgx{W7v1bB9t=#j1W-crF<#S+m*JP8*!0Kbg=L(H?OCRT(FDXAa$(?1V&z8^|*+2ik
zs(+JzV0KtYN1u#*j7{VDYp*6(El53XVDF-tn6Ppq_oDXM78myDy!;{0Kf8OUd3RjW
zv1KorjKzx7Me;k%t!}RF=`Uis-F1d{LNMQwt#=mK#BBAFTi*L{%DqgVcL(-HJ&fYk
zJ!{K;BSlcPc-fb%C&$_(Sgrc`7IIr_9-PdTVRON0k-WnDDbhY#o;^h$>(t+tO}#9q
zwdC~ARW(7SJySj<i2rtaBI*8U)>n?6biaDDZo|LbvmZ7nSH^ZN@A{b-HD$N^#ivJ~
zY%XsWjS~;|p0>#Q?BOjU!lmc?PZw!6>DO<tT6N{1-fUj;D`H)*u9~>Nobg?Ka^<wm
z7o0PfKamzMk2zClaFDk((T`jF!z{%Zk0)+SPp>$fZ`r2h|JijTd-bt-m!!^J6p3EH
z=+O3Q*TN=$%=cmmddIZxEQ8{PGp%bl8LwTq6!3P*JyrWKyN}z?N8V)FHEVrduWz@`
z`jxdV%h*=WyEK>2SJPxsTElL$%Q5e7yl(h+@9D*ty)tJ6U$<SI968H9rqwE!v1a$J
z*9&FhRAsW|stZbecfRxrKOB85(PHb}AG7DHGd6d&`A(9RxqT%&bz5V5&-Vy}Sqr7O
z1UG()u)LEkd{<@0T&I(l52>vGXk&XwcYb`lJO6zVSBZmfEU#P;jO}g|W3TqJ7ZkVf
ztEiBc<2b&tHF0Bhf7X)sA5R1vk&M+5y>HlTVd!Nnn|fL*NqKdDY~8>1%?EEkTrd6W
zyHNFPZJ)^v+nAHG?p05<SvqxH>C=}7OwH{AvnQXk=bu!qaq!E5-^Jn5Mu~@?9F*J7
z8tMI|ASdm@Jn3WW)z_`sr@DXH(gjPc)|-Y(=yKTEvxt4I(3`q>qu;geUj|(9pC9L%
zM9t>WU$*l2U(;lPrcSx@`PXKJ$L)wq7t9eYJ3Zwy%XXFLrP~k86J5K8`{(=ArB$4b
z|8kZtT^V$#)LTLNgtu(H!mLByt(gbT&eRj0nY`EiNbZJ1W-57;EX$7dUcM2}@VtNV
z454mOgRDy-GY=+h*KxE@)%99`y4Phl%fDLbRtK|*+cYF@`Tz6aaXEc7*0erq;g`c)
zyH4y|%yw$c0v6G`Uvf>pmHy%Cchr@O42%ED{7UYy)r{4fy-!JB>p45?>LIcJ%be45
zPk+b?k8RWbd}3|&oCLdb(<=`yyPEcBE#KWo)}LRsGaZP1{6hCldUHaR+P8npPQJg9
zG5^?`@(tp*O8@xqC%;r>O4mB0w1Kt6)_eJ%?=}Z-weLB4e&tWuy>r^{Gp;w-dw%!a
zd-bgq*Tnz4`FG`S=W9oscZ;@77x+IlaEi_6?&S8oeQqmipHF;eV`?p`+Im>waCz!!
z|KmS$>^GL5joh1*-C-y)@87O)e$Lw^Tr=-v8>Ahz%@ez+7@xh~M#<?-*>>LFSK=&J
z)-|*j-afcleg5q5)hFik$r)%|5?NH-y=c9}yl}>nmpWUTt+rWyUHdS?^JT%R<6HmU
zDz^K6WM|IP#62Evw;OXqi{0Kn*%&$DVq(x!M$LJTYSvq3uSvOBDDdg<y5&X_xAdo9
z?0medag9t-&4Mx}b;b)zmA%TV&&8du{OKaWQ2TT5>ABiZmR(;Tx3^|1Yi+=)4+o;F
z-gix2cHLvTm4TT@8Rw+E;n4>^Mjm3!&*ePYXft&SQ$l_<!@s?n3}QzW=iHlhPvE#>
z-U{uk<+35Om~S$(8;iPDZc%+}<uvO-XGdGb^iOQX4E-~b7fjImGMRhI^6ICnchBf-
zz43TO{kP1DPr0+SORI8kM`cR=+|?K^^Fr-uUYo9OcjmRdbrWju2yC5_u0Q3dMNh&i
zKfCjicQ?(MFA+JnLFIh;g2z5aR^f}k_B@~XFld##z0L_`Ho@}`!Z}>d89p`sQCd)8
zct~tY>BRnNS&tpL-WP4&x>{Rf-=?(JdCyY5t$qJW_Rspb;IzY&rsgFFp1=BLv-atV
z-0s(%CpQ(EF22dJ@tAsf`oy)y^{wBRJ8x_Jp3Yq@f66%|d*k|jZ;#JfwP|;C_TR98
zm`JHsyXpz7ckG|+vfI_w-X6%JJ@b~B)0-*{v99M`%f*fBP88g93Rt#Y#%f*Jo)DF#
zON+M(?U}uBAJ6^SEKV%9w<fK)XsdWiz3P{LX2nG>3#O%PmD73WFY*dwEVHTE?B_DI
z>C-FEEoCR)FA6{B{`caC0^tQ;+q8RTT-#O`@VM94;rfe3)7PJ#Ht}qP*WzIB<C)s)
zF2%3Ce?2efpl;OqAKxQS%>P}n>M<L4=Ej#_^A?3fIBj2^cQ;(@^fKm)l@$uCKNigW
zyl2t+GjrT#9$Y53m3hVXM*^jcQC1tbJr;O-wNxf3*dzX=<@=RSA5|NjtG;D@^@v6E
zrJ2pQFSY-ZGU^WBZ$I<@Rr}w1S6U0V2doMH&{FGFn?IrGaW7NW!}ZB84{UpR{d(8q
zB^Nzrc^}>U`1!-gJywe6rHk1D7OAe-XyzTiIDRwtlI;zT_uDTvyE&ul&YA$txQaT-
z2#vTZ&0b!)Njpkb$-aMoA<Ehy<i9RM{1kQjSH5yaIy(D}y;pa~TwLWPD57@pp3>b5
zPrv*zx~3(&v3>uZp0i0dbMJh;xbsWp<+<;})|@m9U)Y^{A=i*~<>K`-4qXtP)OkF!
z@U{2#{xTuXZl+%^*3^Hi%(lIr;ePGr%u=pP?@nI1{-r<T!X&LF%sUOX_{`bAvh=Uj
zns9gCvmrmVex`)HWfi@_CYW>C%;&0G$*z)wqOW=Wb@yi~T@O6Bz1fRtvO)BcZOhcx
z&k|Lge~(9a>#iwJTSWeB*Gjr#l$W)q!*^@UkCu**+-<i+|MBE&nwIhI=-TqpO)|Vv
zI3wsONA|^)d$%8+(f6Kj#VdW2NvpP={<^ilP2o*&ID0xr__d$6w<Ns%lpQW}@4c{o
zEUVwYsZ4h_Ju%+Bd*%i6ieF!1*Ssp1w!LzG^`@Hp=`$T_F6^7eAbj)bcJAsxK1REx
zs%2G=Hr%%Ts?GIi+3|AS{%(<^#+hf%{dd{S=jT4J`rg(W=~M0T_hjeI+atTrS=HFa
zu<Dwwrt@T#*>k*1xEJY!zrMcgW9X*(vnt0^?*C^FK)DM<Wt;CsK}H6K=S&O?y0|CE
z3yLyxGfOhdQj7KD<1_OzOXB183Mxw{T=Y6@Aky~!vj}^cVQa~mIIcLK@`nzAb9fw=
zq`Zxk_Ly8C)v|AI?Cp%C>v8|?*Iz2$$NDCIyZp(?X9CS<yy3dyH&5k~ZqAw$+CG=A
z&eDBw@W!;1NK23FFM0QbbDX~+!OL2=*l63kX9pIpkUVX)Fl5?6*&3r4`<}LWZ0UCs
z_3*ZH`F>18#ENgbQF-B}%Y5ETENX;z9kIA&J!x0Z=DNMiLCU>yKWu((XOFrvw_}ej
z$D~Iq4Cc*${83x~n(sfEwEb`OkNKr!MRaafpRm>RiNXZ4M~@$z5m#zWUiyNk>R)<s
zOVNavl~2mnT!>t&&oa;b&X?}$x~um^<cwo1ub$RVd3a<_fSvcDmjPPsE0fNxyUC9l
zwmWL)Dz0K-VA#pWz@SA`*d`VgC02sgAB217KQ<HC_d0yT2}h$>9QS0Z46Zpg=Ug&1
zD-AlrxXpm6ahsc2d1{dAN*l8i_3tNKiT<RvH-tTUQJUSk&(g0t?%b>SRaJA;?0~4u
z`Q!()RC%6EnUh+wx%u(rf=99wiznK8Z@ZgWWMui%VVbo<eUs3fBOe%6p7^%H-Q>dF
z=^h)^1E)N(nl9kl^43_<bm1IsUsK_j%D9co<{KZ|-lDbX%bYlgww~+>Gg<z`2D2`$
zdmy-H-Sztki|xBj*ethc7f)IITI7!O_B7qy=RUNGwMyi%7OF&L$JA6VDO!DMx%9$W
z{pl6;GlSMPE}rT;!)L{cX?s|*Vqy<GzOkA6^!|LkMeJJL$1Up@Xm$(gnFl(p4Sf2>
zZgEhf&fGno#ih$cZWk%<6fjI!BeaP}_sP%a-JkV8AC(X0t`1>oev@M&@{qys;tYvh
z7cG4~l_!KHDjaya@AG!o**iB}tJ%Ks^B!NXsY>ZVm(r(CUodmYRiiygUh7ZIxO2bX
zT2tDxJjr82mPEQ$7ZYoyky_H<T(4cf9xsazeq`?R-TldrDLO3d?3sE~lTS4VMmQ>G
za3_UyKU(%s?u*|MtuvcvWO2l;+Wzd5c~kbO9iNu_?W*aUb8Cn0T&DZ4Vl`jSYg666
zz}s-o+mn0x_H3IPwTa#B@~V0KH*UXb{_tr1?#-)jYjOthyqK}1WPhJ#rPjB*j$MBr
zYGs)z`!D|Jzd-Ez=@)+s_U~aek5}js&SSDooL7~Rf2&l0=jU_Y18H;mPt08vwQ>d5
zBo5C>bMke16W0g&s{EO3+&QW6%o!su<?OtDtILl43tpDD?p@yUrEyafHUHRD&DYy^
z?NQJ14_CgQ{1Sd9WZI?Y9hYry$Zh6byk*UA)@r5cbADX;vN?XWQO;D4=aF0!lkBB#
zy)DzeayH5Ry2h2L(-$T&%!)5B<3IX>b#KYl9l6dMmRED!C~jw{doNV8^Ho|?b=KwD
z2aAGA_vUM!a+;=A%CS(vXmQSroXkhti>y3S`W%=0T5X-Trqv@mTxZS76)RZy72bY+
z)Ua%)&rv6?GMnU&&d;~*EI44$x?$EQUY1saZG4CNe_i4;d2TrK>)B1K7CXw`Il78h
z*{o>W6ic3)5mk*(Qk1sNy2I}*+oX9-KXcWBXmwe4zUe-jEmko*PyH))w7ls4+@$tN
z|Nl?jC}~wDk|ddaYtPK7TO-9wZ2Q=<Z)WKqetjk|KKqRPrwvn9-rX|Ab=970uRTA$
zQnr-qVLbS%OlbM$hZ<Y6Ss35S$-mq9#QI9;(K$vc|K2Us^{A;nqPeYlWBqzI*C(?&
zSfcs6Z~Jmc$8ApI=-R_`>#NkS#S1^_oOvDQ5MH19egF4aKXu)GF379ZF4B7DRe9-9
z^5QvRGc`4K#csNs7WGDFt>@ua{6TK<*JS4uX&SB(Jg)q%;=v7T2b-^k)-D@#`4+`E
zKA3HLxc}Jn;5BLWLjTM-)hp7s2mZ90d`OnH=JVM{c8O&oFHg5||Cj&x`S1*nwLcfy
z+j#`M)fSchZE5`4@`~S@US6^9r|#{U8To1T<qH3-w@<d~-tk(qwzn*;_e8<_%%3*0
zT1VoJmY!)}&YSY=G~@SO6M|0gom!|jYxlp68SCdh6Fm95`guHRi8tNSZP61Z1_pn2
z27EV5A=M^H`T04iiJ*;rQ$ybS-!>5VJ8%CZH9M7wPAoM&M@$kj6eLm?O*RYFD4Ok^
z{p{Anw<4=D|NlN$7CmX2e6(H2*PlP{?*453{@~24X|w#(#rpXA_!2Fge{{Kdt|(}9
zGA*7Wrn9MX3w!zY`SowO?Hn@;=7(=NoZYvpVRD;q+K&1u@-AD$iZxE}+Pe1GCKkK=
zDccS#37HnTZb>JT+WBHV-B)hPfBR-0G&SpN*mv*;qxv_ePOj2t%5m2hIG$Y-)%s@B
z!Bsg^G-uA6B{2EbtBt#Ng{tZN{S~A)<H6O=dE3^R2rmuXa>_d;#;;LQB4|xpqTQd$
z>bQBabLPj!-mB64^K<W1gBg{nY${2t({3G8+m^~?<@%FZUu3u5mru1B+x6qlHoesO
z^ZV)Qo<*Gr#}2FvVw%bG*K5~V>E6uOcD$do*Ssv-@noBhaPy*b4!!bR1vA#H-rKN4
zS>G@5zw#Z8&c<W4%a*S8xK!ip?qb{ZMbfMDljW_Mt9<U6iEf_p=iZxL`rEoPa$;C=
zBBnm{*w$<kcG<V|fZ~Sc|C8Nnd0C<h)V#J9UDVF1@;mL%-u#+LD7==f>FjaQ=H;R9
zB)e9H?7N-$jqUi^gda?-XOH~9IH&%1T~V#O&%=Fj;>^d7fA}(Q(Wm<_?Y_Lc)>~S(
zYDXqZ^t4H5FGioLZq0jgQ!AxC%)29Ymc^VuTjVZ(%`#mkeQO?TSXgO8)3Z;rq^+a+
z57)9Kigdk;sStG8p!`T6V@vrfXUF2Q4~w?^lb-xTX`Ze4Wd_r0Z)N&5Cha`*{&JqE
zZGN7pQI2%u;zYZQJC{$iEM8ExjVV9mM)u~by1PmW-U#>by>rZzlHfWn9dLHV6}?vm
z3u^vIy7?v*&9q@Ozqjn%t^nZ)N<vO`YTEmcw^Rs6e92iMxjZg^|KZ!UzCkm#x6O;(
z=HTGRzecU<xcCP@W4nv9wWlS>i?#&Mt+h@ziK)@5+}q;5eL;)vrM9T(gDXqUer)~m
z>$An(Z>N{7Tz@O=^2HbWsJSIz-$|Rr%nS@H+zbqwM70l6GLuX63MzZUV*MXmh}526
zzhkkTilZWvobtvfmN$N^%xg3*ty!g2B;8)+@u=sm!CR$&zvHa$d)lk<hbGUju6e)l
zeWBWiKP8|4ewnv6L+#~DlSMO=3>Pakte&&x+Ltef>^G|woc+8uVSP5Mc)Iv=gXrKN
zZmQ=M7QHulSlLy$K*Muw#0QZ>26`ci84^t1#d;zWbRKtU95c?0ygK97Go5NyrNp$U
zh5O!b_6eNG-L>CaDO2`+M8o;VpV(tpuD9u2@!`w~k;0Uj7mAk27|*nQX0fn>_3+XR
zkx%y`j=irF{HXPMySm=)_2EDMuW!+CH9oV+dvdYlG!J8o-``)F)u=D3nw$1sB~h?V
zJWAAMXG9^7@qLE%`|riw_m%(0$5RnBl_fiPa!b!84v|ydVXG84OP&}oTBod1oh8>^
zCTe<fk0h&3_EZ7Qhiz9MS;a1WZXAF9%u=Da;I~N+d5@Hzo}?u8_}}K9l?Ej$zDfK)
zKDjekd+y0=WV|s~Do5P!e*^oxi<83bHyw~IiP`_q{h3_rZKuLi`=wcDm0yZix`>q8
z&5HbcBU|aP`L3<aLNR;WQYTzL{-|Y5<FEgDSF}S-IsW$<%wKo)yg%o+a~_vu&e+cM
zd*EfT)y-<#E8j1EyZ)E_|0L5Oyzq>iib|{-iy33hoH<jzUSx@0@J86e@@CDhd8QH1
zW-YfA<niR!DgJ%_^wq!XTH971c&eHc^Pb`A;m10EYIo@$f3b|;BbhJa^rnN44HsF>
zx{{~1WrK3gUD<gDx^sT*u<8^jW-OezwnsQ=u`p}XKb;v4DI$ipJsBqVuFiflf2wkN
z%8Dar-+o`fcO<X#McSODc~?75+9=*OP}Vekn{|uNJAXHy^=bjh8&%D3%qAu7Z(Vgl
zSjy{Lyt>5iLXjH7j>`|slAcLxA3Sq0J8f1`hMBU{*+)F(hmKzivC3P%@9|1i6KTOv
zmilYuE<dkruRqQabi3_s=EXZ{clXT>aa(bCi?EsMBF1TAG9`a+EZOzMM)K*Z^ylf_
zvC9k6kDXn6?a5Wc^^QT`eO6T-pZQ%iOtJLa;y)_)bWE%i(*KA3&7HV)qg3NZqmxtT
z?U*zDN_W_&YenBr_Nt$%KXY1bc6t7$y<5X(Yzx?Pl0V1k!t0Y!Qy4Si1a;h&JonJ*
zJ^SVT-iMqP`Od6~FN_ZN^Qmup|3b`e)zp0*=VwVwzBXSxDpa@m#;>xy)_?m|(%TpF
zoU3@N^VPKfNJVG%iMY2sY4a!YaoI)8RJ4k@x-r*4g!^?pYEF0EKTlhmg@Hkum)LqS
zGp{5yJ+(-$pz>^3Z2oOCk=pO;cen<4+)6P$d#^=p#`KD{fzOkBjdM7d8mDQ@?sZwE
z^7M-IxBKOup4(E?H^#B~@Ne^om7DkbU~whOc60H1p5;2rVlF;ZSs1f<N}%MS6$&3G
z@%cABJ}5Y+J4yFu(#nTVemt=~GfhNqrI3u!u0=C7ielJjO{$sTHPKmQ=~6w_UZsRe
z#U*Tqc3yBXK6rJ(CeEgYLf=$H&41@Q7xk{SW~ixKdc@(6(oyB7c0ND4QgkFwx@MXM
z*SS8}wO~?)V(pH3^-DMYQ`yw==*4H@iQSz3t@#IcY!Kej)h)enRrp@L453b5C)2tu
zZOr)wD_%Y@dCaZAm1Z&hkj{+1mBxMN?0e7K`>(TWD{Ed{RUZ+>#AUIRGoweiv((cl
z<7bw*jd1g^|0feKm+jD*E$YbrCi-l>K)Q=&_tpiQxVmrmU9>%9TOs<pW!VhlV>A1d
z!Y}H4bv(1bt!>NwG`XhBO3y0{Y?`$XX0|5Dg(g|V>fczP=*NEO_N+&Cj(%T*RJ1g@
zTQXk#+xs(1u6-rP>u&4B)ENH7SrhlCYfoB|+O_z(?$(Ye(`H;gR$;s`{XhRS$9DZ$
zYb8#ag??uGtSsTVY&ysBN9Wr8F0z$RpS*haZGjkJ7kQ&e=Y^T>J4@U;JI&<quPv6J
z|AZ&xEfYJEmfgLPo6-Kz_wYn1qxOO}_JXv@rwirh$m^W*yK~MpPT-`#`>C?W_TTMY
zR=dr@*7m^HS5;zP-KvW@-aelGF~jWNCFWOe7%r96+-|?vUf1$#cSYF=SLZeMciQ!0
zep|>MoO^3UvM%!kF3!x8$+tBE>^j*z_fPd%lsd`4xcAzP>5ts6+Rk9-OS#_Jee!+c
zW*x5^udW6c)^6N-cD^wC;(46Gu5Q-^)h)MjWo;D<P1Wwzs9*X-BP7Q9b}R3D4YkN?
z8Tq#2@4i_y^0KB&AKhMU()`x##^M=CF`0*wU)?gbJJWh%&xXh8%MY{dNSb(YMaUIX
zk!&F|et(VB8x}t=1bjbODgR(CLwrt1h^77#gPZT%J{~<jGvi5ng;dhS=Sz2rtufed
z!+3DBsSW4Pj=jZx$xSH^OC|(<+R--K^cn}d(eV|NRyi>(e?D(!$6Ed6(~4reI?Fpc
zx?8Gt|ID<CFgIK@yV>fqz4`a9w2=F{W;frKt+CpBjA^oj&&*5TeSgW-tgtG-k@wi_
zuv%$#>Xz~=_YQSV-2M39nQgqE?A5=ed9SHGU1Z)J?OQqf(plAWr9snD`{H9gCfI2j
z*H-n2p4f22f1^VEp{6xKFZVwAm^c0X>ym<lNwxjnADcvbe*AiPba8L-yST@E|BUY3
z<$AZT=*hv?EQ>Yu%KewFIUeV&(-UQ?71-HmXwdRuzcS;u&1*Z}t(@NSaOJJNe!I{4
z7!@arYNTpU3z)HfA?M5No3-E9-CEi2tg-Yr-_zMXf9z$dqJMuzYhLVLx98kzMg|6T
z7Gj4ViW2kEQ}qfeTZ8Ur-!>4a`yO9-q1{4RFjkINcZ$iHv}ma?`;sY1PkzkFu$XkA
z|I(T-_4gyUJyy9pL+;JwlKK1I@7v8?5pmbfZ-1w$SNG*DE-zhFFQ^nO{#n(1S#o!e
zUc$OB_d3pAJNTyPo8%_lL*-k%oI3R*wD&5@SUlOi!YGTqGOqGD?=#Dexnai`rw3WS
zYnf!$waa+>b*H?B=o5>?j!Ot%T6mG|WpqKetzBP3*aM&Tp5Kqe*WFdQvvkXI*WTml
zivQy-w+1iso~*w|>}l`KA8uRbx+DvQI3C+Hf3>UK{^&FNmz~!4^!V4mf<1msPu7b?
z8L`FL580<n?+GsLRQuO{!+7E2X)BL(#Rv!Ou<6&mc9mt#<7280cYN1;Q9NSz$HhAS
zMVJ%QV#o6tJeRX0v^w8@KD%jNPsj0`1(pfx+X`%+Oy)|P)%1YtkUig|DATnQHs@T8
z%$<2%wOnGq>^u7{%}Y<;KAL=q*)ybb{bc8V)?1gFFWdjNCou0ek4B`xswMvemKgtj
z(lU9?cQ-lF&ms@bx2x2|E-o_>ciCXzHq+Qf{K|*VD?3*QG8~Amcq==le1Vq6l<7-z
z7ach2<{rxNs`}lYb%xs?nYShVyR^)&ptzzfmw{O;IdQ^?lj=neejaA#RgpVoCscH*
zE-Ai!ZQwkI|7hp2OwuZ|Q{!Y{h*4o+&?c%yT3k{D*)p>=>UHp)ZDRlT)wf33-I%AR
z_rz}5T}{ahr>JF9mhhh3GCiRG+O<tyd#0^VVUBM5|5wg7$Gh%L)nVSr2fXHN?>qP2
zBZ+@+?dMPZe~YCi`%L(|xg~`)HsDbD3zg#^C%v)f=2xqJ!Fu}ooO?RlU*0^pskkdf
z=!>?Xjx*;@Rn61k2im!s!Y8w)Ym2ycZ_=>rRB{Qoe9U?%@)%c4z_iYjN6r)m)h3-y
z*?2Cqta*dObYWc`p2JhGOuba8`gU3Y<Dx|~))t*Pxy4p+ZNav6J2S%s<`pyDe;zTx
ztHa*$!`G^R6OSA{uj9)xf0g9Z8?WaS#26TV?Mirgj&<kdWP?d6g2fp|Wry;QtQHYx
zJ$axt>)Ui|p3hfb@Cu&|=sr2KW7f{iZ^V|HFh(xrSyjOEW8!9imCM149xQ0pyY`;t
zp;)CsV}#y?)QX?aXJ3AC^!#%DI?LTZGM80+>)D;L@{g#7vWg??8nwP|q2(vIrY61M
zOcdR>`R$UjEmKXm&+z}c++Ry;vge#6#S76-yW?2y$4%7!@X6}JG4&M2PFLe7mx=lw
zyJjev{kNFhIOA5^`3dPapRs2Ax7?K=c`+#Dg;#{7Jx6w?!f`=ClO+q-FRhQ*<kFHl
z??KZK{;&B@r;Bf1bHGISo=<T2V~@?gu~~r$aUIrCI@-U|md$TY>2!|o{k>AWXMI87
z#aDs$Pu<-%clp)5TmDGJztBg^$ynxtu7Bp*C|<J*OHGsyDTWz42R=5*XJTt++*P#h
zyQ^=s@0ZKsJV6W0BKz4igUi@|Ub(R9qeAJ-=X_hGz6VdAd8fzl@rK#jeAVmbuMYjJ
zb<9sQ=cAod;|ja%+ZKD5TC6>N(_!BGg~EK1?2j_u{5iC8`or0u%k$GugwHlQy1KII
z;@*upo<SP3b}`g8ziWQEWa)!eqnS-Rc)9%QtILb*+>TzHc*#)b<)g2uCQ-M-Z!h`#
z<@d{zPhY-QcCo#$^zzS_w-ViT66qHz#OLQ12TGa6-QiznVg3G_Ktouo<+5E$D?&2@
z(>7)aF-+O;M&Ms`5Z@F}r>7<X&i+F6LV0ZYCu6R6PEUWIE*d@M!fju^`LTO!{w`j)
zY=ioH^UJr7+%7u5tnJ;2v=vRNhWZNwWItM+`p~6uC%A*{Vm<?}!|Eq9wI<I?vsov_
zZ(C%|8!vRt;;HY_4GXSaKcvsRbyB|C?k*$$&ZeiDmlW(a3&!3wOV@cTas6C>0pr6j
zs^_mBELE8NK4HsCv5sv$?;Bo<8}GjuVr_WqpVX!3Yugw6?Y<fJ@@3S!ZyS>T8v3$-
zc{t<rP35)A3(vfCuDZL6=ln{Ib*s!iRyFtgy*iw;L@<ss*eRvsg5a)Q>sF@ZGJ3uE
zIH9oeS<bnp^>;g`y%1ooa^CgL{H{^Y<z4qrSO%YC?{g@UpS<VAmhYbyIPY3Dx6WQ<
zfw5|!X2<>wk8GX!4L*2&;F$QG?{Iw!d)#pzjf*;A?CX{9&Yd==IZ4BUlhbXN&R^~|
zpLD}Rf@Y;%V2^&ZwCCUYPtEUcT63%J&nV)5&15?*jWgduyZHYGQ7wzT9!@JbG*8x?
zUa~-1qfb-8(|VP_vT!XI56Kn&)-QfA9<h^C4m;FY%(&(zFQ;wz_M3*&E@>z1nzv=U
zh`P}+yYGE}`A?c3+-Sa4+30P~&VRQ8=Cgm@V3{_{==ztFS&a{M-bF55ch`9Px2e15
zw{4%iHPbC*Z`4ZreRoz)b_<r7Gbw$pjoDS!%)2)x8KmqE*}5}qyZ8dDKMr5`57pO(
zx9`7xx-FvAt#A6fjhQRfX)jw|6`AYxctu!o=?-SAm&r17)_rzbJN@2;ynDHEo38JC
zcWs;Q?RP7;TVH#%`0)nwYl)va?^&F77XRyUdC82}Ytr5mkEFH;S_E$0b7P9>+_wKU
zPBZ1-r8<1hi(YJ*`TFd~_h)AxR$Cv=)Zh@i`^M>uR_pVlg-+VKuI=2Iy(G$lLFMs|
zt!W)xEV?^)nLDYlc37_1$snRV?{M4m4ejoS!o@kZ=^UH7DT^&?oqIxC&&=Z7k24h*
zm}c!L*`=7gisfBmy-)jRx#g;sPv>miP%p6Z>r?qJM!F~CKe~&ou1+>l{}fW>U7@&M
zd#1?|>E;z`R^MFDrXNcWc^O*8R<QB9!Ee78-crlH^q8%A{_5rbjF`KYv42~?|F^sO
z|NOy!->+}#aJhG5+sgF^w&Wk4Q<mHnb|E!HxZQW>%l$glPRftw?O$LqL+qMN(Zz=v
zCK)rIvP+4ErA7s8Sn9@dS-kFhipz^?`<FRiGec#Wf8>j~op7HU(Y|))((C5hbsLu)
zx^sSWl4kz1)L@e-5<V@Kdee6KPF~Zdy&_ub{bBZ(AGUwJx83n&w5)QkTwV)<$^QJq
z!KLX>%JbTz*3SNT)W#yG+}Txk(~dg=S<}^&eFCTZbIHplUs0Ws-KX+$hH=Od>x#uK
zG22i7m>II!TQZ#Ig`;QnnsX7wY)4&A_@~7_QU7J`$iMf-4~cJjZ?BvD-X)fBXtDAC
zgeRNk#g>FmP5aw@tGabj#*?p(x1ZS+tESlAOsRFgVH$l`<Xz5Avz5oIJ~J&Z*?&FM
zfq9e7kJ-%Sd?JTip4~hrC$aCm*6qIi)>od#zB?KsvF7`}4G|}e87jmidws)qEDgz9
zF=_J2c{Q5tZ<UIKf?qsYXti2HsM>o%^#ReFSC8<dtiFCD!fwvJgS#A8wp*O2mY8%j
zdxHDBr`f9-G7s}EaQi4@;J8y*|LM{;soBLX5#3E|bQBeDxUhCaos72ATd=dMP&3AN
z(?=&A@9P<z`JETH>Wd59ouIU83X{Rh6%9M0Z+`C-nCs}QbN~1C6$`X4omlc<OWqFF
zEy@pCv@V}LTBj=P;%OW3SCvg+ZmFU6WtVM@3VqFcFR-_%DaK!O+ixyp_UygD&jPW0
z=El<>V%hXwF#nlQ@x6xoX6Rl=>62_?T2dJ@dknrjnRfNoFD=VI8S2jy3?6)U+<WtD
z;!0sPi|HrL*`7vz{v+TjxwBiz-tTCL{-(w+v%*{tZf>pW-Mc|^$@UFbcQ-N3)-rk3
z81?VPl#M^#Z>ybfnxIxb>t`~<W|6hKr$}D9$s$oX+3<#6b?L6twQB!wv8olnun>t^
z+0$IVK{7FrWB<z;3)eYM-Iw{bZ1I|R{O<~aB3YB4ZSW~OZ#ld6xQ#L6{TrJ@^sepo
z)>iQ|J2>ZDPr@gA)L{Yr9ox(9GBGgta56Bc;cRXtB^IaZBh9+jhDGP!G7zadzkb7&
z_B^2w-Rjv}+L_k2y<pv%bIZhcVyFKB<r_2KUikF>`H_#J68s*|t;6SM>s@%A^eg#?
z19yT@n=zBm#Ys&+dh)VkauO_d?K-D-q2)Te<8|p)x9jHf+ZMmR$QzZ%VB7SBNAQO8
z(bsds+_*mIo&F>f9y)Ka{)_OoFYk+viF8CY{Hu@q+vpU_$Fq2I!L;lZ>-Q)r=$Ks&
zst9#VS{|rdaqUt|_PO0vM|jpV#|a!MUi(%{PsVELCexQP!83)K1=WRr?5@^d5H`hF
zT;ulRu1TEg6CAcD-Q99?l30CiSWA~?`Uj?Z=?Q^1rkHBlh&61NGgfF6GM{>?wa#~I
zdkr_cc6?ZbX2HZrPEOWzmG!rNJ)Nz0T2EyqOKNtM+&)i%!~<<-e>8dPT=Sdv@n^J8
zwrXX*Ot!aN{o6fuTl{=e<98J>&1{>Q@Fh4zIp#*~x1(!n9=)1p-V@QMcegLgU8T=a
zHcP?sdn@mSS*LBL<Qn&CGH<-{MpAocYKfZjffxD8{@)u)ml)i1*eILK$@z~ZpVNr-
zt|@DngV3>v4{O&?xjujXr{`-ez6HjAd$_|bnnTX?|EKCWvo#y0O}7^>w+y*3O}g8e
z<^9HvjA=}TK|N<Ueae@;y%e$kZTq$(xx9apgT9nco7(jL!c{N(-txsdf_JaRXna{1
zY#GIT?BvVT<cf!@3_bQ_RB@+Y>v=dY%IL51FCFQfD#saD2ulU%sQIcn{}U8SGizAP
z^G)z)*o#J&7mLptUHp8DH(*lAb|yAk%X;pW6@PTA>VEXP82w_ik*jG|PtHG3v8Oh1
z(L=Kh(r*JUuj>}z{ye9zs^yhqZ-)H>!JIamt8?V5J=twExNlS!@B4n&^Of{1`6V0$
zw`&ummF?W@+7D_PB~)}An)Z@AO?mV3l7=SbTc`6DT$1#cD||Ffvi+~B@sa=UW=yoG
zJ$lQdxA@iMt9ruHE}QJC6K_j~Y5mGM@sANTgSfw~e6@>_fkBf6-}Ze-1}V+U$j?au
z51CC3KA82`Kw$50ZMLcm-mRXOqWQRQn&dc_?`|wzSS_^4wr}fJcc)34rM>>wsvh@y
zWv027U&!P0y*=Me?3&|OzixlA`@{qux6?8wyPOuxJLL0m&5;bD{wCuY-dnFG#YWBO
zITn5~#YECMNa>G*GH2191l7>D2NEV;cMQmgWKMQXmhSCoTru^En8m~`cep&&ICdHD
z4sE)2fLBFU&u^#W%zp>Z%#z!w(jApq^7{O@XGPb4pZJ-#e`09gFQGr@E^|#@>vZ|!
z<NZ9Ls~<V+e>n9-dez+u@!G_g-*Qtue(#!>yWnB==D06C=fW60=lqG&z40f_aDVK*
z+SzOm_D#Na>lW{I#|g=dYZh*rTKDkOvi#b1f!dqSWoOncHfZX3I%Q!yuQ5k?=)cFu
z7QD7t)91aWNX^>4dCwu+OPU!b2UmakCbe3bsn7l#w<i0c%PNPr#5e6U_+j>^`_Z0y
z$BH7J^9tPd@f`kjUza4Fk@$G)?32ye?0GT=e>axAZYvguu92G;_HEtfusg3ie=XUz
z=5MHiYrwyYMH_@Hu4H)6Y`zj;GNtnL+!L1@?_5?sxj*-U-?R24#SKf}ufE%8oKYk6
zA1(TeYE*Bn<78mCB8P8+1RVV!B0niBHMs<Ig~8Uy=>FR~MC-n<Pbia1Vc%rn*=Q&6
znpJIbiLl8`&+<9B+=nM*cFL`u=&9>^_K56{{qHUJcq~y}{xa^F;>MGQ4;TMD*Sk-l
zTt5DP_OE>>B-Y>j5_@ik);8A3#zmnQbB-_5pM3fv>rSz&j$+@fUE|{R{W$&Q>C@BV
zDI1fYFt27+x2#TBy5d{G3=OyMi!X+C*?L~iT`YC-(iD;3ULLL*&z%B8IpU&csT5ZK
z?m9KgbN88jDQhmZ<o%beUywR6zI)Emcc-WB$^UTe*1TIAHzjSd-K4uRsOPv#(~PIg
z-r3VQ=Pg$~HT#{*Oy-TYS`QRLopx=G+8n+6MatdBNs&1+7o!s#%~f~b{nMVRW!4^N
z`aOTn7iI4iH^jecWSVA)^MxLK&$;&GA%o?!&lK*hD*fB2nRU%E!RAeD)z+0$m(1K{
zW-YI={CmRoz>TWiDIeeW=U;lgJ%8Q*fA5|hzu9qMep>Q7??yS9x3j-47V%11)N}Gt
zz{b^^7Cex$DRb-zJ94YD;8@Y311}58oxOt&eBCsO=il3Ro<jLMi(}nadR{JZe5Ror
z^V4|hV-B%JGjd!Gf393oTCqSVETG!+VX@=RS^6o5)!LlHF6~k~XMcT*&T+rVss_=%
zJ@0-@->e%mgVA$VUv^ktvXTRDgN1<Ki7)Jz?piRjPP&+}<%i^k)0+c4cHiLI<?$iz
z%YPxiM#jn7brFpXvt+d;ohF|;yvBHK+K<j==4lU(NaS|h+46I;^*8Us700Gs<ZRAp
zy}iEMXJ+u<zgJJJG^n|GvT;ZI9S`U0#Zzu}usw0I=H*&qzD7l0{--Z>5nZt})YoU6
z%~P1B`}euK*8AQgveD(IKHB&nv0iol&4gPO=0aQiqQ1TB<J=I@>sEf2?ZV=Ved>8P
zl%)z~N?%V@W4$l+;44q+gR})<ADp%ZRP(XV_D$W<P&_Gmu0+PpFFV&ixF>yZW}9-|
ziwE5~3LjU@J@I<x<vn+=iX^lp9K2pRagTo1RjY(l-ZY<`pK{;$E!Ocr{-JKVtTkuT
z9}bQW&W2J+3sXJ@TrhgOnJb0==e!kLGqf&fMwm#8rCNnOo_3+O{YA{$NB1@cJWKe!
z#&m&*Sy0l##|#P=d?xOhXf;*%u}afSwZ>NwS3XRf%&Y9nJ5%`4Mv<9%b#mK}%RXMh
z#CGZf!}fwdEK`@YZLvFJW0I4`;uW|+@+IpG*RYCZ%_=$7@eBTyu8?t`cy^oHHS3M(
z9EG>0IJ~^Waa{Y%rv;CmIXKuTmAG6<7noua>L)5~KexR4(=++`>+an@d*`Hxkbv&%
zAKL19dEzf$YQ8Y7QtuZIzq_Hfan*^A8?RQSEotiyvD}}zKjEVAtVJtxmmW4a-@Qxg
zrQ*|)^Cc@@UuX?@qa=RGS$XHaBLONa)%-69o<6oCG<<m>{{pM#FJW&5pP0NpZuc)S
zBe`U*OI`mtmByL#1(~GQ21Q5QTATFxG=r(mnLtKv?%S0Po4)j|XDUkIjZ^-9;h%=;
z@ix9q+~UDg^0KV0I5<5{)H9#obTTKPcE`m_eIH*xiOx5aeH2pO5q$Y)&F`g#nc7#b
zTb<kJFYT44n5<&utezQYykAx>f3g1`WAXlX3P0bS-2CCAb;-om@4~+xt}yJsQ7^^t
z+^{gQpP{rcTOsSV`ffAplh@X*FPdQ4KY!irXU|tTCx{1Ha(v~O{w|o`b5T^>I*uiY
zXX*{ApSan@IDT(WHQSQ6ej>Yc@}Ufi692hhUaNmMWXv~tv%~FlmbAKK(+nBK&DWPS
z-8*P@@tl0rlHm3iuIH5l`S-8Q^AlbxU#I!1>3Wyb{<IrM+R7L<F;2J@cq+?k$*kbt
zYx;I3xGBwAcsEA%hy1OH8@C=(k?LWa@c-zkdB3ze&NUq0#OY~uV@{D=*ZSKJU;Nx9
zn3H(r-M=o&+XcH7*5?+UWeNMpl>R!*^Yq%+##jBij*EC+E{o!OK6~A3v8i5xDX|7V
z5o+d-)N^Ot-0)0R;m(IyPk8RLAF|royJ$uGnpT^H>rADWGY)lxMKLStZ;M`Lts%04
z?Kyv>p<VM-&XB~EzfVl8)c)Sy`1Mf1X~``wE)*qxXT8X1EPY!{Mp|^+Vt!T$(Qgm`
zFVo|n#dI!E_etuf>!+Ux-C8F*)iN=tX?9a}&02NGU0ZaIZ&2Uzvhd#Po;t^WE2FtL
zUE^|IZ>9LzGIReL&Vqyt?_=AY(j;C!vHZ;x{G)i&a;@8f5#JOhGdTBG>s2f{AakcZ
zwD-@3!-A!;2j(=?YQ${%Hi<oC)uYCznnwz9mfUo3?~GTUy!HOUu4QLR)0o>NU45s#
ztF`8NKU?ZoY8$iUos|h)^CxaSF8{Uk%=NmK@~bD8TJeh{PRJJEJ>KHme6i-;Q*nLG
z2VZBY6(nD`t=p{qzo2ve+{r&8wKvXmZ(shsF#l*5!wc2$3oDBcF2B3lVfH#-&4<CC
zYhTGVyqa6~m93rOt@ZCME%%O96l^l#azAgZY!vr**Uk6*-#FO|b}au?e4!~huhrs?
zv|HQu>J1SumKdr(zAVo3Uek3y_mm5Nj!npQ$oy<jaBAUyGr>(Uy;WK_mM{1a`9dc2
zyWf@Fdu!bd*zaXAf8X0W`AvUM^Ty3jcSgq~%2!k|6rcO0FZwO!&HnpmJJ!3JeBrw2
zAS;!uR2II)`SG3PC%n^y_1$kIN)$0K;8^bQ_EFC9P3Jju4lqb8K3F<upMi3M+BM6A
zkBeRv%EmIx-jyV|rR8Y-#;uo_>vcOGOt@T}c%d^_T;$QA`FjK(%$0};e&uBPt?*WN
z#-7v<u~+|EK8w5Gs%czO;j>{aQ(#Zh*}rGBCrKpm{aLp?;`T50m)lm?WhX1lj$H6I
z(w_CY%=OsNOD|K8d(BNeyMSN*Q11V=W%sHt<erqMFL=BCeRhQ2k_R(vW0*g0J26xK
zlv=4k*8DXGx9O$-`B!)={9VbGeG1zHa#g%0&wsx%E7melEG0GdU+mI9eUe`v8vV`g
z2-_y!6p+jRM6hU1%C@<NTkl`{m9k+0%d3AgpBk{7ogX0ezrgq0)RPXA(`|h(g*Y{5
zTz(q4CwKAt>CMTXycX|PyZ6pOrGNEIS<yXj(?9)ijyAf_XtL`}8^2IU{+YM_j<Gk7
zh1*733husF9Q~mvRKfX8HLF?d1PzTz#$0EUG+mZzuQF!7w2VvM=dx5$Mmq2NwNi)b
zu12!;{ZDBYysR%%)Soe{cbd=r)FT=j)J@sn==2?yewOYf@OP;!zW~><7drlb*na=<
zsZ-kR+5P*}7Lywb8dQ#b$y~K|+OmTovQmtkwO_YJEBNdDUhDMx$endB+@D>2X;A9-
z;=W$y3*~|{+hcy-?ny2X`*$uw(dtgYvGlq*Huo3**x&oZzT?k)-H!WZf4ETF{MFOH
zh|E)DV6dLTz@UM@Q=F2ToL`h!l3xUB^S!mr&X;zdbpNY%TB=OjnM=aAtJ|47mg@V-
zr1$#HNmzUKoul9j!JAXm)Y4~Ec3gY)<No@%zq9g!ru^|JvQX++IrH7CSF2uCm6m>X
z{Pe5+`Tv?9xrV{1i{<vsS-nYDtaa7#lbcKJc8BoKPwDTIQ;83K{d(7q9XXTL`{n+>
zd^p+NUrt?py4FuW)6kh`u1<{#do5bx7d3T#U!Pd%R<C83U9XpIo#i(<Y3sUIW+zW?
z%KE%*#VNO2DKqQLS7(`?zg;tBjlhdd7VY_`Upd`6+pT6FzbeYSUa$Ui_Sd{+*H|LV
zD<Ze8io4GB@Bh|1%ckYwKR3;=U#)NDvVG#a%j@>6nO4kw&qlyTaPv*0e5q76gZ>>y
z7ip*GhU%XE?K^k<Y-QWepJ)DyVsN|i;l!Dm+O_+)Uw^%5kH;r9OG_&)v6G%<pYGe&
z*#3Q`A7B6V`t<etB;{2<Ed03RX~^E}#?p63>Q}7ZHY@bB^6hIum0QofW=l(rpZmOb
z)w%kx&1P=9-oHGnQF(VRbIiZGPme{^x#I=4uHG{(Ki|Bv_M*jt)mvA6-e%;Yn)x$M
z&ZsJwq3v+&i-nUo&;6`gTX*KQqtqTh_mh=Zr+)TiIUX6ht(5PFNaamGzgK>|XC==6
z`*!xRfQg-{z}uXp1`eT()|DT#R;e3aIAX_ZAUm`0eA^kbKWDBoT|251uebcNqp_FN
z)|eh=t)5A%_8tjck;pT--Jf^w@dFpm_?&fApR@4uC7&ymY@eNa^g_HXG)-N__yS6<
zXZh9lFh0rt>b?BbOe@=y^QK-;@9`<Sw08O{6VZvM_OUotg`O4dDV|gtZSppAm7w2w
zH_ulmI7~d(x-3oina_T*dr@A(+7pjh>`G2o7OjhEJQC=(utm+_=lfNa+e7}8s|mzU
z;}kHO>9~GLl*-QQ9Mh75Os+iewA}ufZ^y;#fY2<C^`FBQEKGRfdNS5)>9eePB2O2s
z3SV-i;sV=_2SOjdT$HqJzshq<f9ILmdvdc=>a1SBl46@P&BM&yi%Fngl4V<SxbL&F
zCyu*6n+8w5ciaA@?xBX~J~cl+t<su$EOVt-|NX;HUaI_@eAIPU#S5F7qO^O`3+lKJ
zN<>__s;X$G6rlXlpeP_sQD?RMs<tEiVJ$BtrkVUZr%~&eRl4E9(%!!*cMhi4u4E0A
zRh>WcxXrpf0)lP%2YtTlwk>?tBG9iei{0emo{W%$G`5%ACj6{Yr@4GMxSVG14?Vdn
zi>qdie(w*{NGlVC);jL`vWHvR^tSpNP553mf$L$yR?o)^mwkyh-><f?_rx3ZufqLT
zn7-C_{0)oEUsd(bQ<FEsRDarrN1>e0s`QUaU!9Z|(U7LGy4~W&;ntU3S)#gvuNH3l
zr7Eu;Z&&r_glpQu<27p?0?+PuUH?Y^$&o+2Jnuif>U(U?^7Nt5L7SBH7j`c)+_O&g
zGxKa(@4#?jsx|B4wA!xC{d%oiodj(r+&{OcC)<L7qcHP^>2e3VE#be5KCa4&Ur_q*
z?;6j?6SEIbTD$tI!qxu7b^4!D7u)>0+xwtZRiK5hIO+t0O0>YjHrv<(HWvyHDm;+>
zQ~cu6-$OsX9e7-7yRfrI=<8{hWk>oHECN?ET|4||eP5mt|INZI|JmE@tc`d!pOdes
zTbv@l-MO#6VBP)x&p%$C+Mc>qbEEu=-o_1lhqfGby81%<5{t2O@51Z5BP1B?j98>J
z*b**!o~c{cRaCIcqd$Mw+rn85tEZMcC{pD;BJ9Axn^IxMbKs2uU-uVj0p*txvs#|8
zwclTMct*k9*vLC+3JP7#=d1#xUg#&=he@$cZsspjz4vb~OK|zAzW*nFJpGk_!67}p
zHndubh5f}s_VY8$j~_pN{-9VvOXEF**`YG_Gh<iXjP8k;XsmY6Su@K>tjb4t&Fe*T
zL>oex9DAMS@74@EYQ$bJbpnHo;=-4yTNx(@tFO*0>wJ67yE9yxfhn$L=bpCzntc<5
z_+o`$F&12xSaja>R@zn3R8B2Mv1kMLMLr+CY+#Mxx2W-ME>JOLoOA7O9mDl_o)tH_
zX2f59wxeXl`wmMR9`O@?C*7j<@4T3E;z8~5ZTSWtb}qciajRtSnf1$4_XRaSytd2z
zCy%j8=Q-vOof#*2|IObhnHK!YY;NA<gS@u4_{!G`UCX_bf4z%iaj@d5^q|f{_jgej
zn~WTCj&bUQMYNSia$h{k;&XA;r{AX5PnNSgT2C&};@TRuU2uhnv^-ml{+G}|Ki+$;
zoyWdj)QEigzG-=(e|OT)SnoL+x1t{_h+V93)h~&;epf2k_Cj&6>Me;aC%GQ&S3McJ
z^<BAqpvm3^7v?YisQl1l;`#2Gyr(%mrv155fAN4h>q6TH*F>H#kkvT5@R^Uv=PlY#
zD}%~b7l+7lv$J&BEV$SZ@Nvz-Z2@7t3EnNf#>{8uPV`Iu9`T&N;NiJq0~Li8mD_WK
zqpEv8aqxz9UpZ*P!v2JhPtmoZ{rZe=4Ih52I?$=|JhuCA%w?b1+amNhc_Q={=<jiV
z-*GSb{OLblmRr>QcG*O+T%34@SLK!Lr<;@ZZ4rL8x%$j&e$U4HCXCN@+#FJk&nV;z
zU9_2^?->%?JY#Lh<tO5|TIFtwc6?SidYPxw{b{KNk58#FOIx|`v^_C1N}E=zU1D4I
zn(=YT(;LxVH@M|QR_8t4pxMUcpu^g*`xS@7zjqD{k)Jp+CN{4qeJXS&N&8!N&er2g
zCw<j;($R57iY<O2qftP-Ud}vr`vy_9q@48S++CvO$<Ow!Ygqg$w(r<<x3?2QPyXC=
zYr~<6Utcmmx%w+ES9m+K!g9$p_Am7p9G#yTu8`d{?}l5BOS9#+!bd81EPPGOxF#lK
z<gR3F67yeE{Cm%gt-Iz<o^LWwug`lG!{o2k7sB7BnqEJ_ZLa>Iz2DYc_>bX6)`jbr
z*p)x<<B~tz(BHMS`NN5=ypxZAKlVR(q2B_RJL=2Ba$cOh`FoPR!Habwmh0^gnEY?d
zUbAz_p0A}>8(*$D5L|tEzJ=Bqx#N9RVzN8FsqM@v`^KB{<!pUqz4VlmY*WsuYQz<6
zcpkb*^OpCv;H;_Ba}ABz{8t|rTxvYsyYk%4hedZgOW)o+##US0;8$>8hwFk+^TXMS
zuO*nGuWElfQF(vKs_a`=H!y!$V}6D~m*1~1KzYKF!#%|djBmc-S+G8Ep-zJN2VIGy
zi>_X=KfZHO8*}Nbw|(r34t{Su_n*CUAHT0v^;|iH>C&!K7Bg^qIz<b-Fpg=6iWiK$
zaIUF->4Bbd-dB~1ex4757I$Q<KI6{8wBlB`n}tqvlbS@|nzL`Vmh&j&DKse0dgU(u
z;>Uw?`bJAb#2a2r^;+z(=8v?(rxyhZi`)a8PH-}WJ0G6nzWB-V1M~e#rN2~~a2z*h
zI=^&ngSSNSqfJikS&LP5<L8Qt$6hsEd0yS%UvQ#9-sT^YOm`b}t+zkuI6r@Cro;bV
z%p%;vJ6VjKPMv&EHp70G3Eysp<4LhP`OSI_ji-Nc7W5XER=uh>>uAw<l%8%--FzxR
zJ5Sn0#hbM-xoGji+`Al1e;;!vT<eu9o4qvA%|o~P#y`ho>y8E8P04chrdv9XJZ|@Y
z9J5uLRqN7RR-XFBjrR+KOcdX$9gBGEbK2m`;SC2HcI(T_T-vp%ZM8$%m$)hC4CB5C
zyk*?aevf}r`e)1cf2G#ji3zB0{k2p(>*M3{jZa?Y>KqjC3sWks$gp;~Z9R+W?tI3q
zoQoP3<$t`@>aE;vq#y1unR)S_!Oiyji9QV+N!OfS)T(EGJa%YH65~XcJx^<Hlz0fL
zd^xaZqSTD6S#RQxR_$8j)u9n>80j=Yuu9mQ>xBBIPbW8@c`deQ&5vCxe~AV3%cYB!
z6wV4hEm)lB&i-eEq1|!Wzf*Wbe<+*ZHhEmtbnv5w<+DHL%l1dluAgjE;ho9qq$Lvi
zEPXMb)Z7Qk3gtc3Yi%FTyDM@#W%6wwCH{t%5~0rHDvXaN2V8qJXUbx?+}qRJ*iT+h
zy*$yH>vi?wpfkVE+~Sj2p8e_2%Caub`CqH-!m~d#YxIVyNx%8O%^`UI21zEijywso
z!=-#&kC|-lWL;!_wk!R`^aY~(zPamceR#a|`Oe~ftj9(DcBeP=R*8QU{C4vP`;W54
zGb(Pa%H3hc8v8$OuZ~9XmO~ZGnQmn)w_xfzVdnHct(Mm?Y^K>R8D3%6)UMrX#UGTS
zPnnfYkvhPjz?2oZhnYphdfA)cnP1xLtcrqung-4mIu^+i6I{r}JHu_NO;wxKh31`}
zE?XkPDy=^$J9sT+3veuCei<npbzM7$y&_vLDEW4o%*_&}6_T5F&EYqADZfWOY`$2!
zo2PR-f5K&cqd9%Houxv*g}#1Tv_g8;f=Wx*<G*x%_PBM<{1dxNgF$*-L&bAut6RCd
zjqY!ZFMrV%TNB;%y>b7eO$MRKul}X(T%pp^(s6lD(d#1~we3eW?!0t;BYWDet=gD(
zgJ%chj<ST%#EfH_X@@+fZqCxnV=Dc+>Wal)kC*n`{g<aLS>vca>-fZNy}73{BQ9GU
zJk)XQ?WS{zCGv}J{Nnu@=6Ja3)f~3g6<b86W^ZL!x`z8qr}zpzt2d5ujPG{pewr!t
zXwAx+8J8J;*7*5JGPyolP#-4#g7b+Cm-LH#zs76I=dSfnc<2A5Up+lvNG<Z&Irbdq
ztut3$-L+RPd0YD<N3}iH=2>aW+|JJBd?=@(YHM)1i;MS*hHc4=ZaI#Z$3w3NoH=bh
z`;Ey%V`l%PB&inl6V{9M5;g>UvFlpu+dt#aiIS)(uGy<ZWE3y{4h|FJyItaK*Zn53
zvt&;5f40>Tt8{FHPHStK7QIp~G`{SYdP(?t-Q;82GXAi&Fzi`c|2LdZDntEE{4}pE
zhH5HG3k!>FJ9ZwG2xZ(htySl?^8w~hON>^xxtwFUW1PuR<kEaIZB5597s(>~Xl7ro
z{0JViR^_)=tZnlzoSy3XK-fGk)tNaWV1v+d2bDk57k;=_Y%IZ7y>4TVqg40hvTc*Y
ze@vc!y;-iVwO@LM>?P(GQUYx33wISr_II=TD)7($6aA?rh^hUc<C_`QyUbSVo3kId
z7{<Qi#^lwSK@ajaEj{XGleLv;p~lr`pLa4nwRr4nIrZ_x9)5*_E&N+2tXUmpdV=ld
zmow2XZvXjrG{DW#?T#ytuJS>a^RJq|iFZsrV)Mb%_TJy6(N81hPCH+ifA8(#FJE)G
zrDCU7&eEP_pI+Vk)NJkK+JcvFv(Ab<pFhj=;Z3%hqf<OT?>e_WczQCQsZG$4<T!Wk
z<tP8oSfnR?@m9gL=4U&uFJyng@YPCkLD=lzmg?lR?Y39%&wd*zb)Dy5!~;#`S4(yk
z`nUd>vh2rnuir^~;+c08<QUDCT2{L-yRUDV`rpqo68xK+&1=7Y&)+|H-i%kh*RxHv
zKdDxHIIU`3=n-5Rs%w4kZsyTmroh*4CC-RmNSZnEuf5U^gEa@_XE3fjB3OI-py#(<
zCL^)UmtS(q<zCdVdEK2S_hTbx>w=Pfr(N#)B{KcF-syZ|fx*^1QK40{4BuY(FmHy4
zUY5hY_|sQ8bJtrP%&FY%yR_oPOpE=d+#CI3E%t5y;jNrASv^_l%#GrIu^X&7Z+sS>
z$o?$WVWH3U=nLoOUd?9`w*8mHSSOg*b9Kd`Gkvoceq6>N$Z)Fgw$npCRt{#ha0k~2
z*M?WJbL^*o>CW>kdc3P|t>v@tf4*+_VVdJ;e0pQu`b~1-d8ORdE1xW!K4tbzkGuEO
z(iIyl_dh-B{QA?b&mu|+!GD^hUfeeAdd%r0eOajY)y1>=GZ#$@3cCD+o3+A$f8x<~
zs%vjgTFsR$ZQQZvpt5VgGOuGBjdz?eeJ0nDHl<>d=bi(fYlEbnHFgOvo#nRjo6oui
zt{r7uJ^`Yey^q~75DVp3J)yA2@z~dNnFDjZI(a7u{`p^?JNNY>={HS`teld&S=L`+
zvyAhasd~-y>d~XEmojq>OTP8KBbt4?*#6bFyK_I(=k1bolQobnnz8fIH_6n0Go~&(
z5$Zl^LDW*stXXjZS*pw`^R&+V>ejf<w(GzWix;oL+Kaa66n!{t=Gkmj6L^Nl;#*wA
z*MLT~N$;$C*pGT#__yrHwJnkFk1(uQ%%kGFt?qV{@y@*p|G9!+33i>(=KJ-!M!7&`
z+QL7JBrmSF-z?HS!9!d);O3NzCbH_qYbDj0W(DooCp!6A>Zj71Yf~)t-i}o?j$Oqi
z?|$;UhtIsQWWEorMJIYBnCJVLF?zqfRugu8dq9<?g=O+Q5sSw&1k2}qT=XR9ko?hH
zHQu97^BNX4sNR3EX~V^phN2Iv_RG(ct1FvfIX~}98)J~4W4WK>?uUvBB7#4&!qt|}
z4w!f-Yj$?0a&1R{tZP@)k2#^r)6`p1rS_V%to^|o%z2S3;Y+}s7MCA-9(U&!9#Z<H
zCi8Xk#N=mxP1+2v-g_+2Vp!^@DzsqR?hoNUZtDwPPWu)%_1?z$Vw&rFy0{jbST0u=
zOxh@G^E&ihWoD(;_FLf(-^`lTys<B`|98nh(dTb(sN|PaS2dr$c<9kqTL;;#`<OM>
zvfD9k;15{9^ytdl^w%f2=U))|7XRa_?mg|ts{V&$OS2TReZHkXnEgL$cc1Y2&qnKS
z8qe6Uz&$RL@sjVC`x}=ftx~_Y>Sc1W$p0e~x5W0&xp=tU+FH`4DZNfyIr+ks8vaSk
zbqwd&K7DVy?ANA-KVRqH2;pd36z(NbIfHvzQc?Lu500v3i!Uzdzq)6a{Hj~bR#I1M
zj@R|A+NRaOeJby5_LgnNhj*8hZoOIS7%_Jl??d*G4ED#5R)5`nUUl8W``qX9n+@jO
zyWa8TOL4@y8ifM?|L>XBo!5NdbgKQSkCw*Q;tN|3{Wa$()zkDoP`KVNah9KQ-|z6N
zGRd<0cut(mnDkgLvaRpY?wM`TTHMCl85VyiYd-vi@u9~{@gnb=saHR;EQ|j5+qxvN
zThdjAP0nre*-3d$o7`hHzx%4IxT(!pn9^-=ac!~4DThm$+OKjJs}`PKS=9C@yWi}I
z#^l3iI(NBUs(W*@c*RS<X-O&1RF6NK-q+sW?x&%qtLSEM^N-s$6=O-KO|ma`6<;lg
z{y1^*Q?>ou4pi*h8m0ePa@m}9!l53QybZ6b?6tmhRqj`b@W-p%2V55X(hRf{Zpr-8
zsDAfJRLgIUA2&KSr2OpFezczdb;pnMM+1De%opTS%3t*OMfu*j+-6b2kMFcNd|j;(
z^7#_8_Oi@HvGW90?CCso<$cYf1!re?{8C|XKfn0E4_^+i?AM*|W8N~Xz5ibB(3TFK
zqg=I*ex~hadvv|}*hDtls_e&xh0MP=u6{i&+hV@Hyum!AyQ1xP+imat9-CtibE`Uw
z7r%c{oguaDQ=6GvK~n6M7jlaGyZI9Df7{-3gT-%6wse!(`$Y@hMl)BvkoA9dB>zpp
zrewy-c8_-oAB<Vbtyg)URD9p_Zr!Fu`%fR^3NxN*D{*G?*H0PWYy{Hvx~C<Yha3nm
z-L;J47}MdZxYAq;6}fe@ba(Guw`j_fT_TK3JokjvJn|BSuG&ov{dwVqn{M`$$Ip2d
zdL}*X49rZq%^@SdWXoF(#`DWg*#>I6RBB#bxkX+0_IW{f|MwezR10pp=rm!66+3Tz
zT-EK^y_=SA$~YJ&{{N8eq|krUJ{PS!Tyj8dT5-y0<>ICKrrsO>>^=Hgdg4>J0QMc(
z`{VQvdNZAr+QrOjG>hR^gyGTK9SmA`R&s4BWtUrZDSPS6UAG_qX(_vR=W}~q=EZe6
zu{+lLy_Qws`^s?i@bbFU<>3x%kMmBF-Mi@>2a~mz?%NByq_&*BbJI<0TY0$0v4)qi
zdGda17TH{#z9-V)@RQ6>5oX^nTQu13`o7-6wt62=eyF$l{G+A&K1$k%G4>jBvz)y7
z`RG|zyUd6cfrs38TCVlk9_sRA!cM;ADdi;%x~CqO9d{I7DQCNkspGQr@(Raw^DmlD
zO}qcu@z3=x{urKhZFPl*MLTa5SlpQ>%btAFA|}1C>REBism8yZ0as7$Rco@fKVXv+
zdG;UY#e%&*ckHXlUif>{Vb%bXQ&Xb%^_O+T%}cc39uofWxpFr5lbB;iTVfiw{Jzo_
zt$(fly11xjQP;^+b^&p@Q!77D>^t<WSwbsnw%62KC1o?GiyH}6D@k8A+^!zW;<iC`
z3fu3an(qa7>c_A2)!MF>_(euYK$VGS!{+a2J<>wBukW9ICUMJY`FAzH9ThJZTutZ;
z{nul5zy4YK@5^n~Th8iQ{$+j^BB%HD(#|tEJ0Is>djG(~HTK!OMVGd(yZz(k(tk{v
zmhIc+_ZK)${eJj@Otlq{rDRU~)gpl{m&z@o-W-s-Kjn7vo8IO-oU3KkG`d3B<~=?q
zTF6io(%E6~Eg|C3!N<`V8<IOLLTtiRyA#zNV!gYkvU{7pm2y@8`a<PSVZ`sUn&ypu
zYU}e^{+P+${F=M|$kMHRch*}hwmjIaSJnRThu>YzKjQaRRNwApl3T!jGQ47m_~E@1
z*B#y<xXDts{VV5`yTy8OD^!lQJNA3Ze~#3>`T6^Kp_#kc-iFTnHi`FUwa?j}wu6b~
zpZ@K6VEKUW-ntXlJ$xq3p7vd~_V-@iUw7(eE^L&tdRP74Nacn6Gdt%$cgp^KdbD9R
zFY|LY)yo&u=d?clmQZWjWte~a*Qta1E|~Q;^L%%;(2whWCKNc~c4MSQVAkx-!Wz7V
zpLKLO`QGojyRB>aCdb@1zkeJHg+<pksB_m>SYQ9!Un*^r`=CM2^287ByLQ_xci-D}
z-`qCc`t9U17k~L~_qpm@%l5ffRqMS$=HBMr!jWRjf{ib4PDx@p>tfBcH2&LtX@R9V
z@eWGQjrpu!>^1)==+0=reeLf9HzJ}xx8Jhwti8;CM)LRD*z-x>BOfiv&X1n?BQgBS
z`<?xQMj~a_9RK#NxMqCO;Ktg^eJaQJ9reYY9eLP$sI{Ei>)*QL)rpVaPl(VJKiFXF
z`X=R-(Yw?`8&++5F!_)5>L;~suK5x-McHg0+{!nf_$H<7>715B(QF##yJNEEv#u^^
zWbEDD{+fB&-e<)Hoj<Nct=XGj@=v;Prp(?u*G@zq3rr}Qda-V+@+YSbe#HmA@wdLz
zDqZ<ve62!ojp`iV<%N4Sm%n`J#3yy8dB17t=|5%Lg>DPpZ<xMwx5I&x6Vva_+beSY
zeS^kx;};i%=gLg{RHwDMR87wQg4|}oj-a;xpVRl3@BOO%sO<Hg)Y6Hbs~y*5r$oMV
z%=vrlVDZP_yiIC*FWUW(z5Y@8^CrJHKbPP6Hz~;IxoG9hZLib*{CqC%T77fwVVSV`
zpQnn<U%&49_4&<J4D;&#$=ClnUqAh_=c1V}BvkIPSu`-TI{JP39Qp0d>Gk`X*^?Ia
zZ)}yB;{H5bWWMLK4|UV$v|WqZ7$*Ke_ezM#H_@`chU@+RYBSw^U-9wxx@?Za@n<X-
z^Y^;1lF$ea$XsO0z|ykTt5_`Y(X!`CQ!lNvR=Yjn*TgeH^DeFAigs6>=yhxTy*HK<
z-p&8mHf!4Ce>>`m^D8pm{5`w*H`96!-L#swi)ZS)ZLi2>{iEE#e(m^@N{?w5J%y$A
zzYkU2Z}UaD+;;Qk+6gx6KX_c+v&gCD=C2l4jRow^T8v2-S^sxfSo*J<T5OZ?knPcy
z-7&W|KK(gGF5}K``)sA3pC1G~&<*f=yCZ#f$9L9s?SEuACY`?}7kKmzhi&brKK`Yt
zF_)A&ORKZh{`z<<?skr~+qGXPmAU1k?rP8J3hgg%fAg9zeplPU*<CKKvDx8m(;n?*
zZ`T`qoU-hnU_t)cV-c?#>^~+H&%DYeGhx;49Wsp)iwqW(emK&tC0LUd+q;On;6?JY
zjOo!IgnGT$m#^xYut=w?U(e>IM)9hC{yD;5*!bNR96RFsKKfc)`}T{Q|Lsdz)2aP#
z#+%Nw^*)?)A6|>}Y`XfSYysoh-?x0#79@W2Jmv479D82n>XRD@cbVqIR#<X;SvR%*
z{UVm_vzxtZLgby-z6sd3WZL07pI7xh;<_XM>uKAzh_8P%1SU=Y|L5K7jh44n_jk0F
zwwunI$Yy#gaHr$y60^{}TIR>0UlR(SvUvr|FTbPUY$qqXQ)G#T{LPf#E|vC<n`-Rj
zEmUOgC1-xBEGTAgmkT(z<73s1_n+?W_S$)B!>$=Y3Jd3YFr~S+Zndklwk?g<-gBeG
zAlhu-rK_)Qh0ndXl)E-Ra;NPS*5jJiQaAn{+O_{j3D=^{8uxg=tiEe?Yg3o!o#ssW
zd+bjhc{#`~k-w##{(yN6SMJi=Yn?s+>8(pyz2tc5Yq^^un@V;@$}BfO`f~B++^U@Q
z3nOCYX8pYPP0P2TyCYqrwy^Pap!jO1I<3j)C(V9qv2*9nn|W_bTgxU-x@h}^OFvxd
z9lP{1=Dk64wjSN=Zr8Kx$I}Db7|mH1^*vqkT{@J{hJ7c8!`>Tn!p<F)f4C^+{<6Kh
zn&nGZ>=uq(V|7yKAIm!h-h#(R*PLd!8nb*)S@pe%U#r?@wz4|>zR=rWUOvaU_CsJG
zU)$~0kNKb7559T!XzzB>+GfS@{P(*&ze%d@X{d^SJoo7g-V(<Dia#9nzHK&4D<~5?
zRNLJDX?N_ArWuZ<-<(gZa9dPh|LdOQt0P4=)=ppf1;u3L<?G{Dr3T(o>9`}+VO^c;
zXgWp0;{tzm;F@RRcMg_RM?1KsR%h@t&$I07nt!@-sabPfl)HMtlSA5m_X9Ex@k$qW
z-feD~WK#3`g=L!e(<A<Nt5>&O>h8R^J!Sp3#xK>5YV1A}PS2U05%KWc4#~Xj7h43~
z)Na?FdU@IH?p`I+d=ssCUH7-7x=mXaY@<B&ab9Cz$?^)G>|I*Ff;kLsm#@Cu{6zjm
zfO7QbPqVUl8usrx)*y8B&*kGkyu~VHIP3S>WKIix&Ca;`PrBufQ~R~ne?0fX?T+KD
zrC+=wzg&OvG2p-3=f=%)UzW9;{BD2$!i?K*E-v3b-*#Et+r%eIq8Yz-3C7%f_PlRT
zP0**{s>^Y?^<J7OuRpBf+k5Vb$;~#tIVW8O4{1!k<n{eSWcm)Lm{X?|7GJc;DM`QM
z|Auo$&fWZDf302Qj%d%c5IV@c-Lv6!M&b7l=S$3L=f+1ZTVeTr^TnpgLJKZ)xZMA+
zwD#QNw}z#r@6(Qanm6-EfQFcJ{^gH_>r>Y&zHLk8+hOqev2;AYROnid#JU^TvaI!U
ze)Rkm2>$e7hU0mzTfX-X_as(aeVl(?ZBj<%ZP{;9XYMavsbVF`cVn)~cc-%0e}2;q
z6m@P*DP8yAk)B~{XZP#LGashcq+~5#yYXK5xr1?Wzsn_#t}&8&k`j=j_4(ebg~^=O
z<?gSA-R3RYGr#?H+os<AvrH>5Dhlx{zrK0+_5ZbJ-M5(WeOxK<?Ei{`A9c@7FZ~)e
zwLNlnan|qO8%+N4ez`wwZRG;~l~TRhTXJvZZG4g49v>Q7_tN<9_0Y-t6-^~VP27?z
zyISk_vGH@CKAEEQa>eraOLOYucdRk{uO2e-vE<uOclo_e9e$SP)vsG3W;rsi4b|O$
zcf<OkL)ZKkT~cWHb|~L6`r7ps=hD{1a}}PCnrD!nVZ8TQdQ5ZI{KI+qzazfdKeO?8
zzvjfkqmKJOKKWTKcjo5`$&ynW3t#R(-1TB*SdN<XzTHs|*}W~gjfxCHm#`iD!Y9LW
zNc79sD2vmlZEFOMy79~0kNDoN((>rrNi*SJmigCwn|JJ*lq#vn9>yXiVO`Aep7+kq
zl%MsCsB1h{P0I^h%E-WQg_+>Shm_3X#H1YXvhJl59kXvc2(-Tct<6@{!8)zr&TNI&
zgym~9Z?P?M?&eI=J$vi&y0WWtr*{9Z4G((bbxg7SoukL%ncw$qFJ|@cKmGnAvuK9I
z<Iv7yla)#|?_Aw<Bhkh`?GcyQHam-3?`+Pbo4<ebGpCOECf`HuO{M{l<hHI|ZNMX!
zs@hVtt;r_5H(%zNWk6{3b4RJ<y<bvzxjzPdZl85VOvU+|(exaZ#drT4IrO=3lW~+}
z|GF}XdG~kScXV-_mSQjW{`1l0zmGn@dcA*TLqVMAtE%spe1C6`uU~STZHAL~T7=N)
zUN`fdIpSY$scNmb@IGgzc+hLk#bK9|kDlNPPLSt`dTR2(R^a#7i{C4`_NH60bSTu-
zJH3v*<(#F#y?uMZ+MMK5uj_T+a(46@e{jrlD-5%7?P|$5Sp3Mw;#q3EzWT$(t$U2y
z`I3^?zPs9NX(;*alE{s1zWzypRe6(lvc=E7r1(F<DUzKf<<@V>=L@(iM0%_BD*HZ_
zYc`)UNZ8({{^xE&LsWTUd$q^3kRPSnH~+hT)0d~Sa?4!v!t;UtL3=AVP2c4>&*lGe
zt6dFf_wSXLBsrgCU|?9sNN_PvYDIEtK}lwQ9%wO7?*!ZYLk0qE<^Q`TM;w}<(bCK7
z#I7<S;N^v@NA!<my)jN_-}--_+tjGgSM26@KG~gr`Ni+WhIsqw(YFt}PmyMx|K_BV
z*cP5$uLI3O*Q#A9st~SzCv5sPC(f+Yc=2+%EzT+aY~egIG1D|1t(W>8>RWZ{?xTZp
zCwCo~WcQ){I-g?XH?Pv>zKLdbj!g>h&#(E>=O^CvsimhrGTb)e@+QZRms{^oT{`FZ
z?e!ny-W$mEPBpEzd1R!tENQ9oKclE~w!c2+)u~?4|9|K`YPxUn@-RKh%)qdOi-AEE
z|JtUE)SQA;@WQ6ru-yFF9s>W)t(Vx^#UShE`HT0Z->avWvP*WF1l?Jse%dM9_{Qyo
zY47y%l(hf<O)F<iPHvvk^5%@q=Wk~=ynp!e<NEiLtM?rVdiX@|aM0&Di+vs>ADxyx
zC+7I{d(}GxudaTwdTZP3)2sO>zdrq1d&WA!f3B)tCknb-SD2;nNZma4xk%G&!m`S>
z*`1kOHNl)K8>cS4;8Ps9%1ym5`sOhQ(Hg;n%aVc?=7@Yq?VM_wY5Lx)che+~{rS;}
zF3Y3CKD=2Rb5%{?>Z5Mw$Lm}E9F?n_cYThoYv6-RtB&Su%<2D{ee|@b0c&v3*+eP-
z|J8eZ^X=~6`&0b=L-`{{+jFOzG)21QSuR;_+7+#){QcXX?vqoy9;}SB@k%tY)jurr
zsVTEJHDL+o&L2@h62|+temiNi@446azGt5W)avJ0lnVwfiTN0m8K!4g5I1|$G5@F_
zFMg%N7c^(LYYM$gUOeMeWHO7_=?%e47hT`fax*UR-mfL+`2Na;n$;beZ#rqm^S%5p
z52&o#b>U<u%fs>+mUCk~5)OE8D1CjPuc&{4Ld(3(Y;nQ?;Xgh^c%AdSx93mVS8Gun
zHa)lO-R(V*p@}nD&s^1g<ESNL%CR?Y?wm7)?e|<a9u0XIG$k@>hM~{(MJEDQ^#vR^
z?Ku!=$hhC#XaB-0Th?*SnY+pALf(pN+)h&My2}hVHvFzX|IK6FxssC?7d6*&=3b7U
zwe0-y4@UcJnzvW`eG|-=eNxPFo6Yo@l(`ni{bLty`?}_smF_oB{hzbC?$+{yu?ziH
zM)g!p-{mUEv#jgOueo-!cP+~6dHS$wi~rH0rKR_Zo=L_t|MIl@_0LoL%%tmIdfV(Q
zjc=rEdHyH1>`3{^9fu}MTYZ?#d-q7X(>(*(-|S!1O3dZ;vQpE#p07{KEnmI&Y1#I~
z(7h|}1o>8Rn>EefdSS)^r;aAIU&4z$rI(oBh)jFPdoB3ix%-kIXa7GZ5t(4UbDQG5
zlUEZi_Pke|vp%(VpW~*b8yxEL9({J-P_eQ-KxCb0yK<ZR=c{any90{l^&0Gq>i#%?
zFq$z}^N08TV_!TMz38{JeD*&>&eu5Y-#cER8+(6lRCX#j_VqL8^@|5*@Xj|5xGfye
zEP8?WTus3GyR2XTFNixDaqahNH~sSR_!Ak$9?M$atmB?PVdm~j%>Q16e0Mi=T+ii`
z-P)L+aPV%H&k4QjX|sG%!auhExb%Lx)eRHnWYKVyOF54B-pH^$6j&+y=`eTrgL-2&
zg)g(1u4G^PRe0v8XzkQHHW%hU3wyT0G2f>sq{RM=PPnK9kI2rOeCVgHYQ0kEN|I+_
zkm|s9>MCeYi$3TeprV4J)RNR95MQsL@~v%V`QsfE@Ba=@c*8#_Ej90ZO7WWe7PIZ{
zbl(56_42!$Z>;LFqMCI2G=okb&O3Vkf9-1qhXw}MQ<qOZbN-TcM~G8|t94g^21EO!
z$L-<uc2$$lq=ubZyt(zvs+5^09!1#PKk|91%`d&GUrz$|oH4(xv@<UB(eCBv>xx<G
z>$J~>2kn`fI<K>J&(zF)k<O`sCoBH4WX)MWDd^1Q9WDDS!;X4}b#Z0I98EP6KW#NT
z+;iU1%%EIXwWm&cE>pV~opYI!>pCfP(+v@!e@tukG_-%)tlZ!v`pKkflg_8DGtN#c
z4HYjk6FylrSzPqWiBDR`+)k;-sC9j@o_SZzb)Mp(;Enf=xN36$XqxLeSvyun`sDh$
zX`feJ5k2nDQgcqq=icStnzm|5C3{z|{-HHhHvi}E`JYM{D++`In6z&!jboC1I{j7d
zoTJx$YpYsAH~#oprhNM4<j!|Ze~hL}FKWEqEZ*9aUpM7{^yy1X^HR2!$VI)Fm*w&6
ztZvWUN0o)K%A(%SU!JZ}{CV*BudIn8>p!h&wEpOpJonl4S2vx`eO6lc>Cl7UQO7LS
zy?-)SZ_<<-mz~5bme%>Z2A#Wdx>alUq?c}H8^nqvuV<QSCoH%WZMl2m?UfPB3PVrk
zXnnaXRB%FUv&hV<ZHo*wmoHk=rLx;^+HL;>+RJXQnky6KxTe(k2<Q8&&Y@{x={!E-
zM*Q<^0{x3J()lKtiLTxe!>Fzl6uhxh`_Dq}(A&HTN{@o(%yvH@R_?lo(Zjn?Ztnl@
z?U!$!wx7H2&%-x&<@+-gtSoOm_DEScKS@Eo=We@_x|%S{$7gza>%6}{Hq+BN5Ev6C
z_2~1aUz(c2Z+3<rm~_wKGOzgQN4a|(WsY!uc@k>0Uhjo$-MPj7k_8E$8|0H-a_jDy
zD8~Bk>{F8vi3yzhcQEw|)iFPoubZfr%D%z%(U$yLTaopRk*8{O6C08pYPfa@eo^JI
z&N`^AnPk|1S>!ikR}Q27ra;xYb&aP!TnZBxk7cgNocMNWQ|ZOXDlNBbt1mt+Nl?CX
zO11xf_R_1?ZTub<yh=+=3cfJi_$>R1ui`h`iK>N`Z;MtnD)Jm|m_GeldG85fGplJ@
zRrCK&QSaXPHKphbN3#>d>4_<xrn7s!XX-6ix_`#uz!SqHYeDz@;_n?QWzB0>IIcQA
z`NWl|zPL$C1wYix6wfYPuTT?g!*Pw<L6GtPT_zz0({(DV`Z7#57MNaf6_P1`81}5x
zaQbGY^V)~_=S`@~t;>l>=$Cz%JMa9gLkUd%xz-YM&F-s*)h~Q_B1^pO>aV9_&Wq#Z
zw(orK@1SmJsJdpvtmJeT+kd-CvgNeyDqQ=xtcC9hYZu2Kg-{PIHXD}kFM*Sio;KY$
z^JdXutqQgUeYSreFPwKhLE_sg#<{U)5;W3Jt4wu}S-k9?ctD_@o!26UGV>2vHiZWd
z8k|ezTz9^QL3_sYiL6V%WE)O?VEyaSz9Wfq-s)W3z%L$Pzl-ZEkIL)D=o?Aa8l3y@
zTz|lH!ZqgTAH7}EuKL(#mGiRL9~9L8o~*t~T3ea#@aC0a0S_{{dv|GkD4msJbo$}n
zi^kpZ@t>k6Hd;9@>UNEt5NWngH}ivs<)H&}7wpLX66JV&`Oi65npofGsTyx&6cBZ0
zjGq0_{6Uw{oxN;-qQX|!96WHCL)c4w(b~}C?&p^={g<Em;%T~(tgj9WhyM@$-%OJ}
z{}j6;=TLa8?|i!3gf&wxCPu_G1+9Jf{n3pk*EKSl91C=xTPi81|LWwvee6+=<|Hnw
z_@?X4au<cF=IHc0bTyU**Rbbad-JFHc5@$#K$3P5L!`=u{29p+4@5jA6c^4C73H!0
z@=34pUBdiFT(@^L1@6q8xFsq-EhKz#U(L6=!@=UZMHz}x)ti{A=X!0w#$$Sgr$%M%
ziG}x9EWLQw!8!7ZQ9?G~Q6=_&PAcmYzcov}`+2-LJ#R_(q4m2?NU0oHy`iKft90hk
z?3GvR182lvG5K?QON{94XY6$oLNd;7GGui8Y<OP0;rhuH>!!Kym-d~oc6#1YHbcfL
zHiJz|rmL$l{jqFNj`#di9VKFMnR#B(!;+828$KCdp4=I{v}1D6EjtGn<%S6dlJ+|s
z;#krXaqPqN8J!D~Uz<KI(RuguaE8~~`48rMI^Q#4|1{~@lSDHYz8<C73_6V&PWGRS
zocis4S^96<xOBntKFhMzzGbtfYQ*UrixuT?ewDr9<*^z5uHqasLKd_y&Q@3bdYxgO
zO!?(|XQni~$)CK*CG6P(#)T{~wfPThB7S9@OFpM|Dm5**?$(#H2Sr~qO?s*}@AOB#
zCld^ho#A~DW#Dw6_O<WUUY(c&jT2b4=BY4Woz8f{(sHGS)m^2-X3N&-ocrtWf5k1{
zcY=H6{Qtb#UD~Pc>t~&IsLy6^Ugs4lmZr!<3m)!a*K!ifI5Pc(^BXO$GfXA|KUnUl
zbt#^^byD>7lerq(BSq^456o1E3y(hda3+I^yXoOKLd&g9F0M?O6?9^S+m8zgdl|(Y
zidgw4_~sq5iAmCMm5z&y-Zl4^RdAi}^aJuTGBe(r2ql~j>E-;&SNn_Q$NTjk)Ot6+
zmU?4-_Rn=`33i1=Yo1N4m^yiD?lB9!1LtB-T1Gh)s%vH)WBci)cTuq|ea(>x8Lc`e
zYaW$vkO~yA{dQ~$>wLxdNrE!jNsGLq=GbgDiI-&lbo*wF>T~mB3s^fGHcww-vc)OP
z=uc<ScP42kQ@^Q}8ijYBIbN}vc0<rDQGxOFV{fa-^Fk{peMs(EdcvdTgri|BV`*|g
zV@lS<tW|R_s<enM5L%cV!I$+T_MU~W>LGQ}t4(`+xRT<Te?5A+^mKoYw{BCw)Hao>
zXGc?9!xl4{7|vek)nBl}@s<A(58g8`JflzFUcBt*0@r)I2`ig|7G$rQn(n1Gk!#sj
zm8?!-jWu_wq7*isT*xAC@#sC{DW<mM&=2uPJLdXq;$F=8qI%mQM!y68j}Npk@_f(u
z;vT8-_$CW?RoKCQZw&a9jhq&5$h<IrZdASaBbk@H$#W`-ZaW74nekC&R+-rDLm8XD
zhb>#m)BNnyIc+2T3zs^UE}7Z1Ce){gIqk`b%v9?vZoS37c^_E2WKCDtCYsG;`uFL9
z)3y&keVG16|E6|;;_W?b(v16dM(s<eb}JKj-IUB8TKs^yu)v?gM&^&Z_ou^CI1-oC
zt(4%|FntQ!!ih_lF;3JwTchDO^-%lH**e>7_I6B{nBm$o^T3LRWd_f^pJ|88>}3pQ
zJ27u3)5l<uCf(I%T4x2OYNb8AamKDabGcztpuU!gds~4H<2@~B@7PA>>l2nOW-a?-
zoiiotm&Efp2@QqaFML=H7p+;=#5ikmR_uiGm-`kJKHE7v_?lt0<nM0gH*#7k$3M&w
z=RBYHMBH+{w#a0i^L;+ozi+NJGTJC`#Pe^K=*;Jt!A*56b5^z0>+H^O)YYHyz~R|3
zHZ{K<whH0Dr62b;ygapo@v_p%J<BqtRMt-1;byvGVQiSm)Z+|mTm{n{j$h~NFzR`^
zl|>`e(Cz8D66V>5-v~Y7`fDljpLH?Yy}L^8mPZdV%K0;xN9CS1jB9Q<>Ls=(Y{R|0
zZ2?kqyq_#K*~zHYTKaim#rJ=IzE}v@dU@rlY3w>Q@4FNG!Vn3eeQj@p4y(zf{LR{b
ze&K@|HAQouHhQv{uaZ2UKl%Qf-;!5eZ0P)YA+j!iaqi25{!0Izy4W1P5vg|We~DIH
zz19COk2TLMye7@n%{l4Iq>9CBUOhG9(m339JW`VBZ{OYy?o2c9mp>D)T|4Bct;A`c
zYntxA;`O4#y}U0^rR`+wK6~NA?nRoHWgpltDg7z4<NK^Og$o_pf2B3#f<M~cdeJUF
zTd2CB)_dc9xm^Vf74fTTmIUN5n6QPsYWkDScb)C(Y^_b}E^9do@@pGQ`#L8CyPH2)
z9eHfu=~y18w=Gv6=0qA?;qu>fCn<NHG4GN`-8TLQ#otISjK6T;<|ozGL)B3RDIU|R
zKOBgZ&wd!x6IXOo`s?&9922JOZOX08*mcZqQMky*vJ7rRv3DEZTSp(<x@=)@g4}`R
zTNUB!*Qb2k{&?y0$om!MC8xytUmpBz_r{mG@}maV(`I(YnuW)=e0Zt*!{O-#w^ydq
z>U^xvcQ1)*eCGG;aAf%P3ZLrr2X}WoU+tHADQH<tm3-(V-6zuzdU0`ApQ=*-QyiI6
zXc%!$TW_B`vz5Hw6(-BXwJke825>iS?Dbnv7I!b8Ltf*@rb(%v!Yv~f$j<AWq%--j
zW_+0bLB%`g`9cG-`L^CtzOe0R-G#>wg3Bg9EuT5ns`!FKK<`fP4Y99mAKWs###9@9
zeqrte>Emiw0}GVyEQy>Sb)`7RN553jb7jlhw~ur}!~g89xV2m7YxA9ZPmelDY%t-z
z(wH5?=XRxV7TY{O-+3Es<KJ%(6jys)@F&%2;&pu<Z_}ccO&;|bpY)C^n<N-S%i8w-
zd%OK&@YN3IjO#~OU*x<=<)2yk@z#>`zK8$&DmykOtj)N?H7B4heSLHH{AJq({j!4t
zo*r1Od_-!w)lspu+#PR1FEgdF3I8=Y$a6QuLE2|l{C_Tw%RXO24xIjKyKsXP_gQPk
z#ulf0lbS;}8b@8&_^zv`<)^yGY;DiTjJG@ZCJ1%%TA1FsxJ4r7|ArN7vOZV6sLL=t
z82#;9bVa7zGqy9@{zBEPg<dQnHKB7Xe(vwCnygkV!=&T9@XF+i+J6Idq{I~B_SAm}
zZ_9K%v4my&#(d8Qf6s1oeHJZtX!gn-u9i>!xg3aoU1U=^gQaBF;}a|@zQ0{;o62@K
zGc)(8@chno|FLQ9u8>_%IRs=a8Fc3DoI7jJ+YMiLyj6a@)^pdhnd>GO$?mPLU$-b*
zQRvVT4Utc!&%)LQv>&_HRq!K|F>k>&#`LU*8R`~SL}q$TTbsJh`QzdvJZlQR2_E}>
zK|;t>yGL_c*}IvW<IY@|)hcwg+C+HY^5@%^T$*)fp=RQ$ea-okIE<eQ=Nt}}TJ_1`
zZR+O0O<%$jbY~gg@hjV8(c%3~!<hHn<T-w4(=M5HGRI%Jt|nm<*SBTg;l{&PPgl47
zcW{gklAd{g%8pgqh5dyNt$fR*lWPjhsxwySX)rJ!I$Gv+r2G5(`x+Bps2`kSbeT<e
zmA-qr_raHyPG9+q=llMN+|2p(wdmF(XKhYP{MmQlP?cbmAN#30ReLf!))o8AWqRs*
znk&94VByw2mi-AGnfJeKnNab-_QhQ7BeACwJzf6)V%(HEDRINU)ujj2Yo@1I&QjV_
zC%SO8e}_5OCz0zrs-MsEJs)e4YxHIw=Zv539v|74nf!gVKU{j%Qg(mEcT4vl+O;}5
zzx7+k*JTHE-DlZ2t6DC5s+i%iW~XZOEY0gpjBgA#RP!zumE_UCXSMK{UATtd{I9*q
zTGOY#=1p8G%QrDwOltOm?cFP;WGq;+Tc4%8>w%KIS;dw`rn6HNcgt!zEWSRy$*3%S
z|LfN}Z@=Vx|F(O7YW~WjiFg0zIh60up5)HQ>hsDXvfaG*8DsbD3g0yK`<*+=8~P{Z
zl)TA%(|zvV&fohkJmnQ(PA_>TYHRuN)ZBm1mp{+9+jgq<@pR{kgPZn$@A~)g_~qx%
zm)mbURr`Kwb@8u@%+Ji%ENGSfe^0+ZVDBM*@ih_`_wU?t{H5wMkw+EE&L)BVMN_Z8
zWJ>R3eYX06z#{%wwd^^I9)5dhsOtD=-wdA5TESdh4uLEFSe~@IoX578{paSxk!Sav
z_37EWk(V#I`+3B_DFKG%lXh61TDq67>;IQ?`5WfFzVI?WxcVQ5uV2$-8TAzTu9}rE
z>idg)s-JbvOY-^8xFzY<a^*|Q>W#N@D&M_b8x}T0ktb^5!$s33zE)hfzQg*FeSN%c
z%$Hr-wRd89RLeRxzumfsA$hgy^7>C-^&h;h|Mcbl%;mSW+Zp$5o2K;tesZ-bs|)Az
z^@5Lg-<_)YWd*~7<=fNW+tuE2{BYq@W<l+V$mxG?c|9%Mw0D1pZQsS*we5wo=Qh16
z=3JCib|9MbQ`YTmyHl@A?(@F?w@;k={Qf^5o(13L)_twLUSe}obYAT8xSgLjZ(shl
zsQbw^?eDMNEH~S7$Nk;g-{I3P-`;Q{FHE0VD*EE<LkpiTeak8~`Ch9%gRBtqUIRJ4
zZj<ac)hYkJ9zB}7AzpRXChaXYXF3v295z-ke0rd$+T>}#7NgB=D{jxQQCqRNX~*v8
zToEqO-`w45d5>1*)Ld6c5ZNxehI7qheg>Ds1lCS1>+W-Ex&oQ|`?R;ZM10D6onI#!
z*YRyKr}LcLwXEMWzRca(dTm_-`&WTO`~SsCJY3(brawDB=*~wj-}B)sV(vc@zqLdz
z&R~D9rRly0S{F+vUZ4HZ*n9c|b%_ORZ{}W2`fkw1ZPS00KcITyoRt!fUs?u7rOYjP
zWBe*&*747Y7t|tOZ#L+Rms{DIvf$@tjU7t%rpxu`R9K#}J2&^?&$L{t0v(a^ymT#w
zx-0J*zul@huEvzLH9LRnyB`~O9A}(5x&7Nc-n`fBJD28uW1e1irn2DC139*@4;OH<
zU(Wj$@xrm+ZCdN~)j>CY7aIOL{3A(B{_oeH7yrk^otY>1clWP<Z=dilUYQpC?C-Yh
zUGohuXJ#ozeiFX-C)cWW+UfR-8lf>8-y6q=oamO1I2+iQ`TE25#M`gk(_0+-cHiOf
zPWW82*l)st<n9+IbiJZhT3kNlu-2fMr(pRt!IMd0SEU6^YV69Mw;D;WE?g8Weu^`1
zxwJ9Mgk$N>=a~YQuxz_?Av5KZx6S%XYj@;3*h<{fs=ONW_}p%(FP3RLj!W|2-<keJ
z+>`UqmZe`WeSC88-SWt)?N(inuii86QuH{qsCeV8t0^Z#1om2q+-OLBwE5H=;jJOE
zl>vMD*^e1i+*#LNd~46XIL`bjCYzMw&u)<06uf<|;+~4ClS$@ZpXg-XY$|wH)6oCl
zOeC_QzD-wit-%bvGa<RX85>KSa(tHlyJ+a9_D^!=j*iXQCnsHZe73Lf|IX?=5AO<?
zC(LKH{iC6L#cS@@hqH7~HJ&Q#S`&ZymerdXY}w-eC#+b$vAoTfV{%xN+TbMnf6?&+
zw<g@*vLWDdublHE_5z=?e;-+Rh#f51XsVi~xK{O@-GjY*c5L1icx+1huDH*g%LL!~
zFR|HYvA27>L3)$mf!<|e8&Y|{ehd)cZT_|>v|@qCc3!6oDyod)Qhirj3e4tdMENzD
zmYti=&_2_O>EPo^_7m$YMO|fe?uSpVOY-c|ui|={+3aj!?3;dw{qtoXzuNOT3(Sqr
zGGs+`oXuR%e)#B}%Jr*uP5%6+IOXlxlUAD@%H!py->^L#*89zOW9UXU4zmmMn@-mr
z-IVvc>}{Rn<~hdN=N`CAa;&)=TJzw{`Zv>bEko~CpZT?D-LCG-=kM*c`ulmx#f{A?
z-km$WVEfxSE=D$GDSlcPyEc`UbZT0}oi(dGxpVL8$ap8a#v<cS$Cp*D-lS-CO~3i=
z4x3Cq*>8@Q1a+2qKT%12RF{&yS#a+0=l|Ai{x*5p)TA#0PfB#z*X_S&vaUb*fwPq?
z#}AM1^Wx%XWKEAdIMZuKSZ%KLxf||#ugZ4&8)`n{@RnQIJgu_qpH#9v<Nl+0PN5f4
zc%SM1%KiB9tb0k#XTkm_^L(Q-pYA@_B3CWSq+aoMl8>D2D@}(Wt6l6b`Zzaoy?J>i
zi0jtk!|#?o|EXtla8>2xvu6Zz6EY8TI-1;hqf`C3&_gp~_w?@poStQ~&rj8NC|Xl?
zZM%u}ADer;n@&&4_+k4yVdvhNw)>Avl$H#C`ruweQtH<NgDhu`U&d>*b{|@ms3OI%
zS#oZ<_3W8F5A}GQUf!1KsjX1pUAcDR;Zr}RXFN*Gs#w5R*6?<rX0&m{f{=Qliu97l
zb_Ra@Q3hWR-rIK6UgY`v_`UXd^I3HF{T18u(&TR4@3p6z4<#R1?=ky)ctw|{pV><T
zGyVVek-HX`E4h904n5K^jcabto(=A^8NO{i$=JJc(Y_0nDJrb8vDPbk(%<W+<(5y}
zxvTlk?w}vLHP-UGWcl5)%lP_<VeZKf4KpqXKE35EsD1ICl*}7n@BZ(v%C5bRxO}ba
zT7!>k#7X<8gVLrsSCe#OK72e;Q?}1e-?qe~=>DEV(NAXW68GQ2_AbCCJlN^fo9Iub
zaw0E<w>(<Vx4c;EY_PCfF5fM;TFYzFN@}vVB{nQ`m73qlcl7j*H7{CfS5G#XtNX!6
zHXy8~i|<QeUvY@(M5lGToF8&K9J%)HQ&V;OPqq0AJI^Q0)z6wxFu%XDgfUd@ex=EA
zXOX#^zgx;&=Gx!TbRgLLBa^6&GtYGE333-=6Uw*C9!l9g)5vkthl@|Ex+CLrCU0QL
zh@H6S__uTi2jASbgCSqGtxys-S>&}?Pgub(@z?DyB5f;PEI4?=Y-?lP`+$1p5B~#?
z=YOuXVv1RQ%6QRUkGA}|FJlVpHo5bEIrsXJpsnHaj)TkxR++qZUa~0Wv0s+fiTI|n
z>Pf#AaVyr$y&Bmsntgxghf~6~$A7$beQ>Sw**)R(*X)6ttMyAcL%-jAeluX%Y5sKI
zygeV+z1DQ<uBZ|@yYmbCceZnf8;$km?G`inX?JqwCEs%*;map~-m~eO-<`*EuQ$Y8
znwE5il`HnnV@AH5CvUCR-d+3VLj!vm|GC>|v;02J{b}?@vgO3fV>O+vn=0cT2u|KC
zv%dF6<-M(<6RPH2y7u)NCv%#;*<3cx&+l3?uZwKFDmXv+>Agh_?h_-6n%-<Vz`-T(
zZ&CI=MuiBg2i;-{%-c(z<rZ#}tvA%nbbGR<t?k=>p_NCNBLw-{Tc)1MTETdBOY?+X
z3uo{Ct2amC=JC7FW>_rT{X(m8+o3Sti`#0V)Bb#BtYKU9h57xJmIUTGCoh_sd{Eio
zy?N!%_lYd0FZ#Q@p3`UI;GDGUr@*4^iJPab&y{CiaDl7C{^<Q2uc$Rl$`&Fo8J=_m
z*Blf3u&p`y*3J!Fu|Ym3FXS)RkiEIcWwtfr49V5{(l74#XuG8?Wt(fA@08ei;)=uO
zFomWMH(s^qygcX8y=|3qx3zJPpt<>_he21XPRxB6{>*pk`5n^l9L01}XV(~CTcEx>
z?H^m0m$%fud5ICf8*W<~{MzCfl(jZv#<@kGF7oo{e`N0q&N}w+n}zngZPuMT4z}_c
z9Q+(7d?nW=)^n5ezT{<H%d>2)gpSMW$mA|Rsvr>-S>fY(z2R#~ilx=k$Dw@h@(qr9
zFx5X=%V_E0$aD9z&QvS6`z8M0*DbY_nA|PBS@yP{{C5?X!pVZ1uUn1<n0yx37cbWp
zeZBUjZs~`!C(k)IOO-CwXYLUby1f0^;)^fz_pM%Z{oWNOotX}E^d6~k&ia)Vl-xGY
zexmJp*PRoK7o;RqEZcISb-C*FsXgKvLh5=P2Tlq(?UlN>+3MZtReBOu)yqzQVy`||
zJ?mpeiuL@p2hT?t$?Z@(AO2^hYtiI2DeH1i9JSiFF!=Q6vtdtW9?g|~C^mJ~#nOo@
z_Ulg!aQkq8qo_Iln66Co>MLCf-l}FTmpI)Vbt%l8>*e&rPQJk(--bwJnwTqoyyf$O
zAy+tEe%eEa>~*hJvB{;!l(X(?XOlQ!zGKUa7ivlt)+Rr%uB-UF(BkZ=T@&WG6&_c&
zT<yZS=P2LS^|GlP>z422ng1c`Xt>paBXVI^R=i~}@wcz^w&(PCuwzm+?*dt20}-ya
z(B{3;Drar>t$(@T*A1)0qc44a=d8R|@w!DuSRwej(6=qSa=x&qDc%$1T&jEFT7#N<
z+ve2Drn~bDEF&*%Ip$^E{xeZI|N8EyxehDJBKX%9Y}QKnaEo=#&WiQIbM9YsOzaZi
zovYxQaj=ooWqIc3r+L?WyWg#yVBMsq$gh222A|PmwvtQ#iw+jMmu6Va>oUCe;7!n{
zxj`kH{vGM8zsQ<oxpm{`PaCfJo{Tu$71LaG&^c<t@8_O|>n}&#Uz@$WXm8`TBaHE7
zhkTpNSFGcCbewCl(W-qR>^01nmz^lwmk{eRLq~T;4gdYAN5o5{<+VF_f;WDN^_yrR
zy!uDjD(eLmf)26U-1p68^{+cvQa7h=_A{@TSBn;AK6)p1^qWmd?UOI}<L-FQZLAQ9
zm|a&UB|FbxK|>(>>5W$>y|>+dde@9r=dZi`IE$QmQm)R}W_?}o$noFX54tm`$;v;N
zs$RwMX!V}3aP_Q1A1z)N&$#9}ZO!YgKjLh<=gnNb(q>Y_LG5C>N1qZNE!^-p;r-m%
z+he9ZTg|^`Stg&Oum8&k-7WiP?z+aB=_Vw#bpu!Om5qW&k1`$n_-u0e!nNv){T-P!
z-7B}8o|<8}(t1;W(#~goD(#tWM?;@KbuW=V8q33#-g(e?Ubfh6->LD3dy=P~dHJI^
z=v?-m9eaYpyFQiXRWd|rF17pET$s??`90x$_>2c{*6%E|@VLvq`sKOr3T=KHi+(SA
z7utU+^iR&3^?9>gw11{fjJZ5>x1Rcwisv1xOG8x-8;P$`d6O-h^X0{+NAu1)R4!Wo
zt+Y*BfGwN3??)D2?f$-Js|+1N;;UzwP1|2PKSf|--<yRG4_}O0W%e_4iT~Fs(-$|N
zEy_AGee1fNWldj08s6pPPcSN%EWf|`X2X`gPkXeOuZn2>T9kWw>g{!xRdzSVO*7su
zr<U_zx}kH<DwFcsiW55zw8gS?xov68$cyH>D<E5PQA9W6*wd;NiV|zJ-Tv0FvhuCp
zwDs8bnL6eC8;aY1>iV!ZtoKfT`po8%^&-7_)35r+Jh`+p|K#0MSs(b~cK*7W7oB_R
zc8*Ba<qv_Y=b6rElnxW!@F7Z%e@^A*$A>~#mu)W0&u+hY;$o@oT(>j3=lR8Zikscs
zov#$?z$|R=dSScv+@KqG;_r3rT)%Wzo@F?5Ld1DvO9__H{J;ylxUG(KKeGH*y{3!(
zN?yYAo}bSymYh&cXM1=daDpDM&aSPgGgE$`Uy6{xf7aiQk%2*riQr<j{DRaX(0N39
z1(l%_;=K<Wh#bBDTXP-H$z>r&k8k8zr5p4jD%M=GW5<oVw;X0qQTh7$_L95upQn7b
zR{wtQ4(F5g56}5mG&(Jomk*GLD+(#*hzbjNVSmrIB5q|0v&JsAipyT93a{SJ3%}x%
z9kFnlQg)!B^3^L=n|HGRo$0V($4V)aJp~U;Z$5Kqyd$I@UTBq3e_?iosAaA33xm4t
zuj+i#7lvLxQe0GBb=Neer0R&U$CL9n^v;@H6TdX)%$`ZHwG6Gxf|-0;Kj@~e{oT(b
z&K7#x`b>eQ!?bh%QcK$n?g}$aaXOjRTdlG5)#F<Rfe+4v)}7jP<lCmJ%Qgq^PQSUu
z=VP5cpG*F2g+k+CuRi6vxi7DJ#9s^C(0NTvmwl4UPH&xmta|hGURqW(ihoHGOOy~_
zF{dv$ySPv;S>f-d2Of`2ddkG=YJ}eNqb{4WOtf^o#lXOj&&a?ahq`PkCo?ZQwFu=_
z+SoqF>_f0+f*#yzM{LEa1eOMLC@gDlnvy!(=gfn&@|&^IpWjOhCtuyUxBq*aepAxs
zUp_@zfz>|uw68Q~Ielm1);`T9JTFbBY3atfi))1&(u?PP=sEvzv17zyb1AJqj;T4f
z`xO`DNUolnsrYxATw_#rOhfDGmkpLLnRiL%bf1;h)UlF%^77I;g9OQC|Ad?WX{~u0
z$Z9Wr>0iga?)Xbiz4du3mR+7|XROu|;>A(XdN-i!fzISxc^)6v`r7R4d_SkE;%0Bu
z^`|K&Yvty?`?){#{QevAsG-s(x>8b%iGkrEGXsMZ_E3SY7-<cP1)UgO`+fb6ruGIG
zqht4!a<!7CEWF64d-ED+=rrlPj;lw?{x%-lKmYN8hP+FE5+c7pzEj+nFTd&Q@%D<N
z+#+m`pNh3URdt_xC}iWJLlu*HJmu4ZWKHgeim5%`KDokZ-k#<?PCJ~HS#t{ew}$lQ
zvvsdgT<EN<@jc`-Q`aoXW;U;t3!gob-0JDEGL?DCv~yOyQ<(CnToIcgaLMTOQiB$m
zWQ~~Os@u(vlGx8Uy!)*B#PeUV?efk3pKm^Y`d3Nyf&T$NA(85JOF8!Rz5QI=Ay9N#
zN!{;*c)QAmmi0G(O}jorwk35xo1*>q>jtWfJFma~yP_g+YiYnQCxeATYswc-=>4R~
zdu(OdEYF(C>*dpH=O6sNKqc|qse=YB;+yMTKWARcs+_9m-WI&~(fJ)*c4bAsH~gEV
zEAQ~Q`|&O5+Bx^7u70{@6x^Fo_@7tgRa-RkrTdC!a~%xIyl38%v@a4q+IsO~^6~0!
zRS};H?`~^obA?RHTFl1wx`^W=d&Q(p?<z`SX5`IiGdK9!Q<MGVze&l@Bj>grlP-AX
z^7fdstnQwM2TWdJHv~Nb<(*=Wl(5v?X8O1C@{4fy1G=ku=iPjF;Zm62X^RXlANPBw
zYPl{R{qL^)pzT&yw@C&^(x;T8y>}&6%U{0U95v_3lPg~xUal$nRy5~p{+5;HVgJP|
zE{n!Tyo+7<w(R1$S(|T$zy2wHA=K>SY1cZmi=drfAJqQM&A@O`hk-!`dumEaElEu-
z(JQEY8dY6<`<USW`STyS&Enyh?ULHNdfA*r>s2b+c^c7MGmfuZ<Jfm#q6^D|02zmg
zg@5kuuI7K_z%=Ep*SxY-naM)iw{PFxf8XvvZBc3EuYLAiOw+io)k|*L(y>hNH2V{a
z#Runn<=@+U&d&1TO|Aa4&rLFNHr8+C<z(b0eVj9qTdl&&X<LHfd7&FVTyB&7(r0~c
z`SEXy&Z#*+?K&s*JZD{)d5SyA#YS}2vDpC!&wQG_`m}i9nRQ{Aj?=5|8h3l1Nq-jE
zbo|)GBWp^nS^k~7<T~ZE$We=EHl4%8RYgxHrR#iUox5q?*PHBp#$w-2the#1ops)&
zpTq5Q!aMy4y@c}PZ%e)iS{lzkVw2|md1*vypp|mS1j7k_CvQmquc>@C|4%{Lr^lzm
zpEFnPnPk;>DLNrL#V&TKNoUi<np?`xGb5{$a=%2B8g9P5YqhWB2Nh=Cu;p`Ju$x_6
z_D%1=g}_sO&t&c_xXgKT%Ctg7wt|_LH8j?_GJfja8>sT+`D|$;6?yx$FW1R7n(@|@
zI<ik+FFVWH_R*OK^QF6s6#u9t2`qCHJ7O~Tr{f(T8U0EBuJsu$>AmujY5%p1bjJ%G
zT<3pFf6{V{S~}s1N8dg_$MXy03+z)^xw(ArnW{<N(0U_Svc1=R5l3YtPsbJWn#4-I
z{X3TY7k|{VH~bH8bA^}e)6mWtjVkAEPw`7~<MO+*(`ByrG8^@0IiF4+_upURah6fu
z{^a>d|Bw6ku`l7&4H0;F-%9S<p~=gG60UP(J}G`WZ;qS55#NW`SrrxAmUN}53Lo0f
zd@aiO!8PVb5w{N{M{Q~CKPbOqf|c}oqq4UW*UR#%vQK8$7ftR<SsS`z<$R5D`73|-
zxzF3OL6h~e(C^4|%Ptl<sLeUP;CEr%p?w;$AEGzZNIYHeuOc))@7c*|u70(Tnb$8}
zmr=7<FlBwksVN_`FFd%hBB?22ad!;kQ6`}$I!jo;W=Q<H)P0>TwCl@<M9=gy*YbRw
zZBtmTIZtEAo&8<q)<KiqlG-0Sgm_<ab3Tln&U4UNcq7M_Gnb-WmR*0?WqRVf-nx5p
zS4baes=e0td9twT13Sy;v_cUVjYu{oL5Fg`XFBOF1wm&r9p6cCW_URS{W#ZA#(QXa
zP_<mNQE|9O@a?kuJ3hR4x?2AHy&u!_&&BPj@mEqj8_LOh(s;*Iujv&Z*+tkDH{QSg
zoT+5R>P303EP|ew8%l5cz3|k?czj>$dhjN@D)F=1LJ}APvUvX8sCmMd_iUT_hf4LC
zwOQ$pTb3W*CBL}d@x}%jCf8f8mL+H7rT0Yt)^BhAq>*A8<9KxCYrTvZqeXr_miu*$
z>xGt@#Q%J7_UEg6!2zvxGFIyf6^;tbVX|HMPQq=<E<WA-$=@gOtmEhTmT9}wcN>GR
z<h-fwj!j&@jlMcQ2;1<hH7F!zUjX0YcCHt*rUvGIzpx|o#@e!s%c-`9s*kWcuD*2E
z&quU->$kZVUxeJ7UCrdM@P(Cp&<;nZ>7QPIn8`hBZOZ}K69SuTmR;JtV#egp;rYDF
zwEUW-COtP2mgdSgsVWaV{NkP1JLyhyg>9yHwo6Fd{l-(k`}%0s^xab<m+&vxwSCj&
zb=h+k*v~)m{mv4#dR5T_>WhwU*tMeR?8E2r8^0#mE_x!rZvlf(hG*p;fw`HpeW&WT
zT|KTfG54t27uAP+u4`*^S8Q7+{_UjynaBg*EYeM4CR%=IlnPLrK4p3BQLZAs5cd+M
zS({{M*)DRf-x!&#w)dXKig$*}r?$`4Hf+o(yj3>wx9+~o=~l<Zg4a7AsI0Yg%QR1}
znD1~=wbA#*q-i#uFJ5uZ+#ng?#j)TCv&tXKvzZK;$Fnc5OAEQ4=e^~=@XnwVgF?s8
zP78QqpDS?{>HXMJ5VOWU;`XA}HwEGjNuGP_IKI{zv>&%Ln2=sxe7yQn?f<_Q-@osl
z_rLDXGp7IbU+#RJ*AUOhecjD{=k7ik1=eeU&TG7O72TcvbkCVx=d(0YrWbC_J@@Ii
z^76~ef^}H-ABeqPvEYVz!bN4vlG(P7_54o{%;?y_q1CN%&&&1oM3!~y=KGztXiI7P
z7N&jgt_{;<>0E}e5VKns_gpRA_q}O)!(=tXq@6w+vRGdn7LxK!)1T1q*5iM#y=48d
z?0g&cA8R{AMS^qx<$ju9$*C4Maf;%uq7P#8oPT?6u;`v~z+F4;*^}L;AAjV(&*=4h
zVrEydS_O|p?19dE^LBmvd$#I4Q)272b$5>}yZEVoO=oRKTXBB=dv>w(s%;9Ujhok7
z=dAs5fl-8SqVs~4Roqsu`WHpJ#l;&wT<IYnGOLm^Q1C?Hf}1S=6-<s?{gEATSwbar
zv2N2T<-10qvB82Dn_AaxO<!wpXRF`ZWe=NQH$CXuv&=_Qjm>At={5Rljjmg-Ge^%n
z{<6!VTUN7G=rSXB!Jhi50v{D$b_vZ0V*ICjz?0c+nL=-N$S>dOpS!dZ4hPpV&W?L+
z=Cej&jqqLmOuk3AlFA=z3VF)5U!I|r$A4)<F2~O;*B1UzWs}!S__FMQBloqdLSJq@
z-Fi%-|7KP+uWrp+y^97{e*8(>HTC8H(Dc=5^9<)#D$bs=S#JgFzb!Gos$1pWn}=Vs
zm6^{sH@Nd(N0QY!alz6p>varj^PZGm*>4qik^jWE3;&8wm-1M!FVOZ+y1R69l=m;u
zKCP?MTcZB|x|F@zX7BNGabLgPZ+Co`-E@0;H2=ry3HRRb_@n<J%PdtWPm(X>Zh}qb
zA`2GFRVmTNSAEz1?mxWvx!eVBV-3bv;@9>#XzhL~KUdE7epy4>RMX-W@7KA6i%ZRl
z{TlSf+nqCP^16iT75`TLn%Ej!7`N1fyV#2Pz{EJs+sW)p?|!-D<x{(~eu@d3;iT$k
zivJI?&Qe)t?wXdunmRMvye5Kc!R8p3mp}by6b8>RcbqD>jBnq4VM+hg(w)bmGuRyW
zWd;06e}BOGMWjxkVdS~PMh!Opj;57-j&mInTTXE5+HXmU$XYa?DS1j)$@^zKH9WsI
zpIraokeIm+H_Oh+!moQ+f5@4YRG0P6b-b%I_nut*@>HXZw=dTkC9!VV+VHMo1<zIo
z-#uIRE?V`?DLJt8ZKR*NS@Qbi<ImFlbgnt(9aZGmB*>*Dts&6Z7qYE?lj7eAWqZ}@
zOYN6T6MXnUE@<vPIr)CKce~E!q-);4ko9D(m_YIBA5(n!Udo9FaQmHVn!E62Rlu~i
zoR#+b54)(^=R4@^i@PECviH`mbu26Qv#hwkSo7r$-yIjMDrz3wIP@=gsnN{!XUt!p
z+Pr1W!8gxlzmYy|oa)K@fAL4zSk9NZHof6LWcEZ&d-m$<qHX+UQUce4t$lnZ>cu;p
zTsI;4$E(EIPoGt-V_vs5F6>rEy!@sFf9uB)Pjk*ktlGM3>esEh(Fcy6Z``1(m@{|Q
zmN_$Ou4Rf__ucw(!Y%Uuw?|tl|KB?KWgC0>N^LpkcD<4^$L*WuM?B^=sqa}UVe{_O
z@-tgct>k50sbi-QUK4dEu;D`Sv`sOMcWyH&?C6;BsGsL`weN$6U6zRtc3f{akL%f+
zbggvz3w6uI+pR<T{>(Aj>-#e{Ys-Tz$2W!@Sp4M7vCh!53M+Or+sn#)<)63m{?{+R
zS**2!pE;*|jFkF&>`?paU`Exyv6iXjYk%b}?zv-HyyyLryR6y2J)_-h>VE#aEm@%K
zz2TeSr+mRJ=B6$;C;gd!@lDG0179BsB;5bwlNwpTH^HR0h_QlSR`zCn*@wRe<#o4*
zsQlHh__%N;pLWqE*S%`T1VW{G3h%4gm8_qC_l-f>w4-l6p1m8kVST6Bl~qq!uIyfL
z@U`|Obx%#M6)Bu^#da`o8mUM6aR0g5-_Y7{>gDY@nQqmwf9}PfIC64EsP3-nCwg7U
ze~ldfnQ`&oO1OEsMs4Y-V*!!k5qln`M`~~#W#vwebYvIVxAk0#?b&y%R$QJ>`UO6k
zt*BFF{+FeH;FjzKE@L)@VxKg}3zOZQGAEv1s=>jtK73EYD|N+cj#{>5J7v20PRI$`
zB)YP+{@L}5jg5Cp(uU_ZYdK6rtX|xj+OgAH&GrMQ-ZZtQwK+R#&nfq@%jK(m=w)X#
zQiyhAEK^)~<J~$Hz59Fq{l0m!Vu3nSk#^KE8~*TXr~V#wxxX^8^XKmMZ9jH>7fJhG
zZ<%y;{qL{gYxi2d`6G?m1-<dD@YF3m28M`l3=Fc^I}OkdI%wZQ?aQj$Zkt}z+q=qV
z?qfDmTzIr|@&`BLiK;g*mT&pt)%Dg=s#az~Mvz1!L$j;U+t=*7))&ru6B1g^d^ci8
z$CR}`YtB#eSg^Zl^}2O?uiyMR`|tO+%InWJ&)Ci%E2nbrz~jL7w|#T}ndax;o_+q>
z%{YsBF84lICElJLef#a(vu|_D3eVm&>_6PF^Ut*34=Y%vMjo0wG4NsiKl>{;>(22t
zxBUKKBh@}}az)~YH#Zfy+}GTeUE(SAF>iXMa>aB5b&f+VT}RH(TbaIh-!F+{uY!#v
zs}D}FG~6A~ucUYImaY0Tu19$#PwswD*5C0kuzT*@{gqFD{;3gCIk#6Qcl9D=nThYe
zUMc<>yVss0Z?6VV!5a4OwRXqywjHraxgQ#<F7+#J&Wcsl4>Ne)y6wIwz;2cx{_W`f
z`!Xfp>uhiQUVnJ<^||Rhbt$p)wg+F_61VBb;p7N&{Rh?871yka+c3Rq-)gVDNA$%n
zIOj3EK5cjGsGoiHw>9sr3(uS@%>0$4XMKLfy60sPb6g&EpJv~%Ebf8o-8|)I{}vqm
zVSBvt#es(Y2k%v<?9J-B_=sO@Q>x^)#a_=ZEa;9suNvWd?Vq;U)bKtF1%HKvigl5k
z3TFeox0Ua#oO(U%@`YB;uBRFwl=&V`xpw2DzW$rTE$)8jpPMYwe(~E=q9DsR{&mpi
zU*5bG!P)mYciH(CUVo_^R=T)iPXAKzwmQDj++5w?d(JQPR*v{L<8JKdC$rpn>I@mV
z4;nG@OZx~;PMUUXN9Tqs`WHC5Gox=zy^#7}^w`a~J9|GfneXYA_AP!@`28Zs7RfUQ
zLjI_<bjqe>R%H6FRcvE1y^`an&-a`2R95tfMKiA$T$&NEL|jtrNLi(a?lo^=GmfKw
zj&0FQng6CsbN3#tg=$K%`<6_VUFi^fW8q`Z!flU_==zl%ZHVT%rp<Wkf+EYTn>icL
zD=Pdu@!Mg_&MR|%3h}cn;_Nn`r1se4qN4Vd3XUyx72MV(5iUnt9|+uh<Cd(xbDrt`
zMJryrUb!tMc=b=VZ57vpAKe;fT&=`Rma>Z6+?Vw-b_VMyZU*t%cx@ea?S`!8yn}~}
z=f!+e<LqC5s`$c=79~S}DPP{(lU{dN3*BVfXPjy#HtTW0ndXZ-cmkP!D3q*qxRT`+
zymL<BEot|M`z!1XU)XJ1cllSP)mLuWdCCh;ES&w-h<8u*t0;5M-HbVNqwl@=U08SJ
z$?~Ub$~GKJO^-@us=Fq$ZSSOGS4uA1?A|k-kKMsI(Ly=zjD_9Rj~8d03lg^28T@d1
z*cOici+;bJRLN*{w|mZsX6H-1k_NNi+}io{&Dnq6Z2^xWXFUB;eom!M!7?!U;Nn_I
zi-NH7OtmA8bD0fpL_ZF2?vwRfGm+WnOT#%`4R7Z*{SN}?+AOTUF#JA#g7Mh5%{<2*
zHvFB;w>azHlAr!J0~1axp0a&Ir-K8pMS1eH7ReQIhR^MeuRV6xE04Kg1~YrtYvZ+n
z3Y)LFpZs4NG^bBP;4#Bd&$n$heE$*+Z(P_u@AS;Y$BxHZs_R}1{_)(Qci~k3eUBS8
z0+0SM|1xbO>#H0yy%=TTiW=Ev`?&vl6fpgASg|wP)c9UiJ=1MB!|S{^4)EFDXMB15
zUhU3u9{yRAp0{;Ybqe*Z=&0$?);cZO(aF7V(cR1D;_b)V|L?6Xtf;zl*S5O0?{@9|
z*XoaYE*kK?ymdV1!L=LZdk(x}xc5}OZ);?YfsWk`ExQ|fb`^0o0@?g_o?2~-%c?Hu
zE}ws3Q!k^Wn&hwRTr9~m_<e;6k0sY%l69|naQFEhGrt4*jB64q*<P6|z6+i)-}^`P
zQHPq(Nme<{cKHVuPg`Jnr`@%2eWb32hlbLwhS{=#JTIg9B5yys;qgtz!fx?QCWVVB
zsxwX}&AzXca!B}9W5x?Fb%SG)4Uf;<7h5$oD&_vWDQrL2&RC(u*=)~!vQu;o-<M_9
zLQZ+=(_MKsZa?~Io=@a!t_M=SX1@>aYkWEH2&eo-O=jVgr3ZZl?y-I<ocf3HPCAe7
z^sE!lujOdos94)8)0J`mOwuCz0H+#*_*2UsuKkm;?^;-a`)rrZ6U;mVynd&Nofca;
ztMbxEg-4G)9yzYvlK1z|$Kdw6b$^ch`}y&*{r{|+O<T++os2m3vuyg0zP#<JJzJ0J
zq}}|_wRge7^F^C~x|Z@pM3)J$?BHnm@Unp|OxZri?$zVpSGLFn@0ybS(nR#gE{j(a
zDw((rO6Hv8^iH;jem{X#;V0`>o`&-GEr%G+?cc|&dPDY4aX_I&)`dB@FBCU^I;yE<
zwCBmJzw_ESHGeZr@1678r~Y7#9M9y}tf3<R|DBmUhdtTm+v~l1RV{Bm`nKLhVn+Gj
zBWv$p5X!xN^Y{1n))hL-RwNaA^04UX%=WdZGdic&xR*&r_J8!!9p8_t?p4>UOIp5e
z?hb3OzeirD?b_dz7Hs_{>uKdew*z<YD@iTbZrST^SJagFipO$w!i=YB7pqpJ`IcPX
z#>KI1&y38-Yn&lR*ZLed;<m4Qk4j^#c+&xf0LvT``#srC4{v^YS+qzq=kDi%B`akj
zAOHCCHg58+BdPLx6*vP69ww_7J<vRKmE#QSB`(FU&WFtnc6uyz5s$dx?2@!XR7q-8
z2JgGo5}r|PY`YAagggo)3eL-L9ai`4e#5#walT0Hk45rqo+7_IUMM?q6>k%KF7iud
zdFd*@pM_I<U%!!6e{24VS$WF;1e*+bE{P2q`=lQ#nkN4DD%5fjTq$zhVaijDve!Q}
zw`cRq&xy)6$mGboGsShzvV_$e`5%>X{z<KzqcDF;=>CtUb9U-Yyxaa-#l&Ip1z%sA
zeJd74eU=p~ovYK6{N`h&)&6sOe&7AAAI0=oa9o)Drb1<j`$O3iLhjz~ZO>Zv9$70D
z)Assk#@@sWW)DQ9yx&b|s_c9a@9;)tgH6EFfEkDF?^hHisNNU(z})tT;p?X7DjiA2
zzKZRS4ZdwCkp3aw_gmnmY{HdanN6}<Laz3l(<AD(a4WRfMb&;?s{d-@b7o0vg&URf
zKHO4oryULHRlOSBvzoVJ%bZVZtIK&UF17MTl(YCTM(<zM#$a(?=y|Q?I<<tditE0K
z7ugk@&YIs7E$f+;9{G7yd7Iy|1qti6-Rn@V@Hy|G6r7(dkv~oPcf#7D9UB@=edlI%
z@AP}*@S0KFkL%m5Im-Pzg}?GLPkiml%|HA8<2U6?weolE%v3xge(le?fExdj0~YLY
z`F-=eBsC`F2u}*xxMPLW)O$=qbrUsDK8q~iZMs;_I`yjSq0VFfCj_)IJ$gO){tWxj
z6BpUFctf<e__97sx-DR}W47e=k3Tw;ES}rW+SoC<;tk8>n*5CwMz31!HY7F48CZPw
z&Y7z|!!luSLSDwd>`s^9_1^7I^@R1z*7QG5vPx6_bVjn!;@DA7F85T&%20m0Wamcb
zrewo(3r`#UhKcDP_pCN=xcj{P{TvO3gl@kt9ewrk5rL8MKD9Qd<?4Ak4lmwleErqB
z&6j<)Gydr6-o%|VH>odO)~-D60_#pcjb~ctj!DMk+%sD>)tI^MO-Cl9fmms5j@hMS
z9Gwi|-g$d6=f11-v@a1~aB!J+$YG@~Q*E_mjfJdUGfw(xbB+Jt`n2y#%jGBK6(5V?
zc<JQlQq%jU%<cB;-}1|u*M_ZFz4oC(v64&l&kYu#{K=0WtZ~WSqPB1GhKzYmZKpEs
z-YDDM{@y!CTtuHsG-%3Op>&<7C7Lt09#7xa`grBn2bXQ1oN(KoY_rIyZK=PQ(L7sc
z=OEoZt6n)BI-k>-zt^Jl&u5j=y$0Xwazq+Exm#9V+`q-l&#&Jvety)gU7|gvGmGwT
zaeUcT->~G3@O;<TKMWTCia8+vVp@ohw$JWan|N34H2J2!_UQI4632H}@0Xh=Q=;>2
zZQ#RKk**If-`88Q;6=ho2KO|ngO}{4`FmZQe&wC^zX11Bd(Uj$a^dhPr?SxFChJeS
zf3B>YaxkQH%>$-gD>@eiJ?ytSBGu(^Wx*_uEj*JJSIWp#|JCR@?3na$;=R=c)k`ML
z>)z(4k#IGr-zzv@*7ss{ayWBVTI=fekTq)2r(*R_*w+4(R5CEI{(kSw&xK0$3nZP?
zt7ZvZp1sdN@aK;?E9wf0XMRZE*}FXXg^%(3^2`N=kJ>8OG=Jn@IJ-gGnmO-A<HgW}
zS@F@~XHT!46SHnJ^TO}NOTA5B75#2f?^$YLE_mtA+Q&a5u3U?r=DzZ3|KdAU4N+!a
z4_)eKd|mYalv1d{mzy^1B03A+U8`Go$u(AW@51gqlM47f?z~wr{lNNDssc_MCFW@f
z6)a@CWpa^)=j`84#n;p~`|SPh)TYM$bMNct+jIU0-d%J(P~<rC6bsM97iAu{2j2_J
zO$cvQyYr-I=9l9W`XbwW+Ad1H`7&p3d#}hZzb6MDw%lU6@9&=2v&VwNcf~59gVGGS
zEn6Q<VV?K?%bere*!UhA$WOg@f|KiTW&7HRl5DTJ>q}oYU-Dx<%goo!@%q~=wt%u^
z=d!g-+ln#-%RZc(vHm58mijc4j~2!TKf6jh^}8(!TenpyW}D1<BQIrjKHk=^*&r`u
zx64#RYwf9@Z<Us^TwkK0$n}TK@``_BDO>QgACu3_oxswma)zU`L}JI|l${FFQdzo6
z?T`9OxVqj7NS^iha3XRBSAPk|Z_%U%9sBQ+Ez%BMZTGiy_zUWI9Z#`a@O9GngGo=K
zS7aBbYn044j7##rz{vS;hW@U*d!hpr{(p*mq_)Ov-ka6DIU8<0OmI(sJ$-U*LUGux
z6Ek)@oK#PmH!=O^N7wI1%cn)2dh?9qUcBV{lieG6(nY=>K6qf!-MPA^dy3uPePNrI
ze|lATXmr?=4PHg(jrLu(GQAL}eLJlB?~8p^>AIV?%I&aT!!iAS)H{*drwqI?n#cGU
zQaKNua}RtUT<C3cgZEw*`$Bm>=Nq%ar2E&(W>y>!dopRy`~1B>ioA>X*KX(K`>|5z
z)GKl2SI0Sg-mwT2ey^BPvvcM9#Vh`?sPB_~6|BGf^`j4`eM27ojWpOIn;E=s``(>9
zHPd5#_s=<0T6V17f3L@pmJRbR@84Oh6#k=B>2%w?6_?cc<=pNl>dkjfOn9}YtbWF9
zvmdr49#-jEVLZ{>Hr4G}@wQ#-ztfcPJNF;{ZcQzCe{bTW<$7NubEkMstk_r1G&e);
zvkKSyiW1@13fU7sD@rt<TdN%%-uq^~0BhpvsI^9mw+i*j?0n!i_wC)ykKMjXCuh2s
z+i`d+XR~c-4(#8pSAPG&YV+#PPR||}+8@5ct?u^toyn9F+3JfvBz3Lb>2ZVWVxFpZ
z<;LnhxA~%r;{sZ%Rx8wVq{}RPuOXgxYKNd@`KQMsztekTx9+-I>cy>;Fe%%9=lZ@2
z>o>8V-|64=-lx`#&$j5Vx@l)XA;X_(EK8kOimuzNayd9_ow>vZ4St4%L#}>ok|_^V
zR2aBatb5e96)b<j_;Q~kyOYARyj$O^f}9_D)pC95a&LTG-s<P#Cp5{gudPbq_oKk%
zHD`nD91m?R?#bFv)79!C<fi9te}YHJHh??m?mCOTPm5+T%<C*QZQ$5kR@r}5=Z3Xp
zgJQMIF3yd5aRQ51=ge^Xd22$r!NP=R-r5g2=89ZZxqmZYjkNS{zxl^4#CK>d(GcP?
zv@Xu=bY3_==yji#ThBSyWV2oWo!LK4i0#x(Jdm31evT!M`AWf&liZO_n%g_<zA7|Y
z8Qx~7kan8Y>a61N{`O%7(d_-}6pQS81PVP~dpZ|6yT#d*OC0ai*!%tM_OPDz?B&9f
zqtnFABAn`G3&~U)H?DMS)$rJLz*j?k<sIoJfm_}lx7jsbR@Z)c_l;%0V&jnm!CP+J
z-OB#AT~d0PA4|8|S9jY}4ihsMOx@wN%a&I*>P?$}*`XW9)Xl8+FFM#Mu%hEy(ed-k
z7-mkCi%kx!JKrVpazbk241w<_Sz{}nO<25FeR0e$Kb^3?FRX6*(vQ<P??mVX>ipSN
z{iH|jLg|F$)w+zYUfFK#PhsBV&ii%lp(9&tZS%H8+})kC|9RLX^TaoIrJwywelM3b
zRp(n<<Xbt}i<>>}nJ<6d{{D7c&D^7(x)x>aZrK~H?~_~-cuaSaim+IJKx@Z5SDSAC
zQ+K{LF5{8evf@k7#-kMi%MQOzI<n!8@03fPNA)L8ivDu^_!JEZFJ2ArfVla8)Z~I}
z^%dE5Zg9`=;@W7$<}<A@aD&-4skduB7v=Q_PL4gj`l|Id{TGV)TV3}mRsRf#KQHr6
zFzZvwQuj}@rv3O~<q;SZA*8Hr=-PIP*^n!!kwbFTOAhb6FMO_77ccJen(3T3S14w&
zd4VUt1y8N`x7!yl-cB|#{GF%$IZ3#^bCu&+L8e`-M^=44bx{5?Q|b)qxAFex^*1$X
zbIH2fy~;fPAo}fP-E237y6=CsPk&x-zu&?_uO!N9%aggW!gajavfH+8oyHtH`BiGo
zI=ig=--!b4c2|Ssw{DkUE$n|^cVYgaSr>j)C<$~%-O&+aaAYvgF5!NCyHxo_qzmiz
zF4n~+4$GtWo+(@DW3fp5{8#ZSP8;R*ul2l)R_NIl<}%ONN=@A$V4=rWIRUFc!EGs9
zZ~NU5o8Tp=;q4Yy!JO2t70ffGNZIGDQt2XH-K}B4DfS&xzlW@>5D?4Ok?%1qWfP2>
z9V2*qsYEyXvCk228Lw;ztDJS>t3c=~v6g!wE3Md9y`9^iz1H-gdEmn|&(+%lrnsA3
z+qP<1bF}Xl7B#;ad70PLGg4-pzfk7y|7)`1&5f_uo>E;Ru-E-g#_0}*)t2H`C%cMn
zSV^r_c$J(rz43V#w@1pXGmX=X+iXn~n3q*-yZQgt$Gl6kPVUo*W@@zQihFrtbH<G0
zS2`J+f_APK@5-NXi^(xd+r#zN$M!Fx^+$TQpNm@<Q@UYe`L9<~Kb%}BdFrx9jI~C$
zv7N*M;jbk&U56u<6mLA?v~HQh)31V-4LY;;lpao+HuYC1>n_cztG_hn)%=>Fe@gxL
z;u#ec9cSx*1t0gavFp8d*uW&9LM|(K;!ZWm<WuurO*YC`HjX)V_=NN!Hsz&K8+7#4
zUH+VYdGq1x!;|k^<WJdb*Pk4FG2+VKXNy-{OHA8v?IvfqoKN1WE5Q@jaQ$X`_UFr;
zuFakbw<a^BuWoGE`;j-N^`yDP!lR27IVN)$Fkdg*d4B3Y&GUY%9T(hC{W8TVbk6DH
z8^i<5C03-(jd||&nL{?v`Fu>QU+X84f>ni?8l|T$cg>m~(;GeKy!P9SWt}aO%Hi)i
z`V&r<^Bg(q<Fn($E*Y%@X>)ZJxU+iPF1&l}#xq7XAJa7^l7BKxzq(e<RE~aD%C^R;
zCa0paVp7naJ(rm!wS6ltUo(t89QsY(<2Khtj#bOA@UJbntTC<EM>}z{(u%~=HHX5Y
z3s&5UaE)1fVwt+K#P3dt*#6C?Z(I+vely@<`}gGk!rS?q#dl}d8?R`3_J7LM)}TpF
z8TlLS_G-v!IqhHACvfDj#?mE>*DKZdT|RewKisj$ob~jY<+lYU9QhZjl^y*uI?1Bv
zL&`)cTa}_WCJF8<HlF*#eK)|HLG8d-H7)7J6Ll{*U5%e*g)85kuy~QG^Hs}b!3~DD
z-^`sJvp7lYq4<M;N8c=;GTSw5qV@Ujh2K6O2vcd6c(v-wPu7GbryGTw+0*-eD(2+*
zp7;O2*7v+yl4Z_bRptvP%mjs<%T6$cFL|%E(MvumsaQPVMZm0}6AK()E>r5Wb$Znl
zT=XsN`=f9-j+Z}l69W$wX8cq$_{#ZZ?xnVj2}{dN<(PE?jY|u@cpaOW<hsP*l9}Lv
z8Kq2Wx6Zb&@Q`>T=eTlH?+ugFB}-*<*m;w9H->JNy<)bawJ>I;X>WM20?(PW`gJXt
zc{2>(WY39{I9uIadsu4f-3;jl-%m>Z54a|+JU=z(ctw2KN7L*F_wx&<JuKh&&qrkO
zzwIueF*98=Lv{YFHa}4txj3lc)4VvDk{gl}T@TIRzqjFj`rqt(`y1chS<XK5{K;7_
zIHR`YmDs;4K6kTpQqSXa$Bqe<mESsCv5a@cE9-*-|MNOxvZbT#|84lXr_amleU?i9
zuEWdT-@2l`de-qmjp!=Tx#r7W`plAd=K8gN_qP-uQ>C6w@~bDGo;FS1#7`r;rD2hg
zh2~_Vw-K`?B&HTL%&Bk*V!Wi+y?g_Yl!WSjjr;R*tAD%O3OM+t$t(+;-z;+Mt$|eD
zmrD=X7et+7Tk|beeBaH#3%{G6zkBoEpMO8UdtbR<_3`p&ajU2UY8+Q)Z2H5wL2u?s
zQ%CMiAy>LNnC65j>52ZmFri6oj$i&q!{a^k>rQ0PY7trP?w6`<tvu;N8+&1zi`<57
zkKTS*(RsXJOX2pVj9t!OBqm7CoSI#8PO&OQ>x#jhb+7sI;tTcN7qQOoZpq;(FVyK>
zwtxAHxewZn)+@|wl3HRT&MKKPS;NQGW`eVh#>0uz74)nm1j@^875mw3w(VK)e)&2+
zo~KSXn+;3S6e@i(?LV7jE#q(7_|1C%(%zk08|BR>6*xQGxWpxLKX>xag<Lu|?w7cq
z3$E)vQN{XqvZU-Ef%*#*o$lprDp9vSI<NH0Jk9q7XMRX*==boiViv!9`GIg$%Nl>B
zw~LirwX)SJpSl{&&_4h5r}3iXiPz7_8ksn5E0H_n{_?28#5>oed%qed<azB_q$7Ad
z?!&LS3fYG~vf4dii#?D%WwWTiCEsI-zwujs<@3!*yS!k-yc=SDw&!Fef3`IoDo-p?
z=Bai(#+>aS^X31?TF0c17li$k4{<R`$LD>YDBQ8R;7Jen&n+yvi?5x0c___YDO6VV
z=Yr><CXtI%4f^-ke!6hI!7l&HpAFkT%A9!CeRkgNuaADezw@tKzP@Pt{^D)(?eG7o
z`!M(O<>EIFi=Q7&sCIsrv_?wh+t*(gzm?nPZtvf=|Na@xg;ts#=8J`HXU)jnsv)(`
zsok$XN|ixr=^T-nQ5(3o6^Us)D0ixx@N$~zX_;q{leNm6;}>Rma4wirF2yx7c7<-{
zmj}0H%{Exc_pX|+vv|)ZGueo@Wo>8I_H!Lk*L7R0#Lzvd^U1=6KOUx9T`^uExqHcB
zJE1H8JM28?OP$eh5^>F8mu%5aF+15iu}|$jQ{+6)+{<ABjFKzXvNzA{yq#U+5S4a|
z?d%;t1D&q*#=)vnlUCgozaQD3e62XpoB!zE!s~MnOqpJCir=7Vt?~OWHmA3Rp3t23
z)K=+eU&>dn_NG&*yv^Sa?U;3R&zvrg;A3;XE?t`AR`BialE;&*YNPUwoa$K@%q#Vo
z|4dMrtYCmy@st3^C6_j?o3e4U-Neg5YR^K|uRbn(b>7D@etLu4Yd_m<3(Mvoeq^;y
z?{L;s*F~4xf;a8x{NA6ospgm2E!Ve6PXbms#r@>iQI<P<;_dkXo{dlBRVC&B&b#E0
zTYKKDWTPq1p^2B7n3|q8#524ykx_Eq_iVT9)Mu*~n=Y8N_GMM_bY`gqEDzV+e6zLO
zJ94Y6$TaS&*IJC$&hOfCE6B~DQmC+tVdb<}rW%Zg8rhTPh?u1;Pk3J_us=Yo;7+u~
zshHV+rS26TV2FM4@yJmXqbV$tKeiotz@iwkQSx?g_Abwt`&`6L3f$5gCO+pob@sqh
z=GUrUzW3=ri@xLLR6FG`Pj{A1*N$Ufi<>$>)QkGu(2VP!?zZvEZ(*aYk62rETxE`I
z^*eXHHSi3#%ZnZ}waK4?zF1qmyd~n<w$J~Dsg;8EW&=%=SdGrxTZ|RiO^V*_-sO4N
z$A6nc+!oEXng)}y?Aun}VEK}tsCg~C_0h~a#f4eQuUFplG`>42Z_V1o4$}v(Vl*U*
zPj_AEI%HCDd7XOF`Y%=*PrZ(=`?n*rWS2$g)?fKNZx(r&u7BS6#~?6t&83p~ys+51
zMRg25Qi%meMHr&P!<Qa5I<Nb6`4%sG*54nP*Gzo<M*K-n1AE{$=S`-6=T#lxTad`j
zr?T`)bFcHYds?w+kG|v=wDUCFRQdS(d+%HE+xB_?KKwbpref>QsQmwhIXC8?mD<yx
zYAU<C;Fb9*-=)j8T2xKgX|Za%xOT{_%j*Ptrw3)MRoeYSDpQh`B~jn&(6w1xcCNX@
z9bjI2=7RaZ()8-z*43+56wZ0O>H68&Z(Yr2Wq({0|CjOqX!)|Pg=<PP%DTFkZhw#U
z=4UZ*yyC{T<yBL}D^ZE`6UoOTo6;2|4jo9+K3=!-r0B1nJ?`rtMy?DGZdVmKwEDPS
z_lE2@%Qt+y{m>#)aD!RG*S@KbBkp~kzW$r|8;e(4J}2Bg%5GP6rg6LKif>yIm9^^p
zWP%bE^pZ9OJrH$T$Q1wN#;K%$8cE^)=i0Hq6*e0mULA0xKjEHvmBWNh0@^ow53Tuq
zY)Spz4S8h?woSb2FCXsxe)X%{eO+g!=)OtO*|v~FVr6$uQs!Bgn^T+4EO}{d7*i;9
z>GpcoN%=NPc^f7$F~64*$}&{ce8RNy(pv3q&YgPKtKUj5zBF^y85iHXSBnqD$|R}j
zZ)-pHy({i$Z04=C?>)sD120#x`CPwu<*@OcsoV<1cg$CJ$~MTWo{wwq5G~ZZEB5d4
z=cj2`f`!A`3KHaJEmgj<=X28By`gG<=il@{wsk+>UETIR4_9Tee<o}<<pSPYzfm^(
zd2-Sm+s9{vnEoD1SQ~S8(${OtLSoD}FpFkpY&yO8ZsMV&^b_5+Uzi?TZOq`DoZCKi
z_l&C%ackFy+}K*3(YT_0SHKLXr>XB64R@_JyRH;_<<Z<_CE0<lEAQ#<eaB?0-6DBr
z#^&=!bzkJ_Wu81%yuZermpj4P^@ZF@1@SF+e#$QAH$8sN;K-tjAu~doC#h~bx5w)4
zhN#p~-5bHL0~cl_g?_ub=kRLd4b#r7mdZD~yhBU!<o|DN)zxb1k&kqHml)0LzWK_~
zDn0-H+j;g%)zt=FzbBfrB}&(}HfU#R7oLz%+ou^-Aum(gA^3(pJ$-rl-OH2T<*WZ@
zU(e^y_igv{di%P{s*-)1cQ*Z4F6o;yHR<{Pj$hAC&GyxLUl(rT713Rs|Ll_JH1D{S
zZ_6*Q4ZGX7NcFzS_uRX3BK$4Y=KK|J9G>odVfXoq_PgUrNoUzp4E6m_nXg^CWR3Sl
z?UV^?S2wLmJy;a)7yKriJF?q-Mfj4xvwvT@Z`RtqPRsrHnKSv^%Y`p~n)a;JJMnb!
z6NZg?Zzg}}SrFwKRa8~iu<ef9z8S404i#s$m!3X4$J?tVA~vS#<+t<pDv^4!4`+NS
zO$>6_9(90EYV-H%X#K2C#-$~ul@pdb@^9)}J40rT!dzyyDHEg^m%MwcT5L7put&8-
z>x=oO+KZX_V?w`pU)Z7Uch8PJF*xGq)OBkgUD~q#Pu%7iiB*YK>$NuRjgpE#Bm38c
zW6z7LmlwZV?Rm|aYw1y;Zvj(hdRFfX`n6Q^ug(v5`P8XGAMC9;<JTU0p#3xdndE12
zwLjv2?j4lAx4^YBx<G7>eZ#JQODcF&?k)PhsdnPzg|{C3dV0RqUi<p}Z}T_B9nPv}
zI3v-qC6<FnSh-$I_W03-V&2)a;_O!&Y^Zqk<<MF|wWpc^i_RCdyWH2muW0DMKIHA8
zUZIN_Cr_C6p1KtJBK`Q*JzIr)=Pj`c{rXx{GkE!>-puNCHNUOY^P7}snuovJXSFPO
zYqkDyqoOp83Inl%^*tdXE-trOFP!Q!l-+pZY|&)P#!St2&Hg>?%XbQ|<k8Uz-t%54
zDd-pP#Fe+W*Hu1IEqqp|xF_M_)uaROU3Qgsr3<>v>bi4v^+%(tiw<+?EtGm06)WbR
zqdu>PAtT1)#*Dl7ztjgGKc0R0^uD@Ku_#l0i@jYU4{A?7Z!{L0*><9{e_8$dHoYI~
z{#M6-53#*jyH_QYiDSkG{mwZGpV?ck?*A&&CZ(w_koa+me$T5vZ7caB9`H<@u&~0C
z!`ZCu9K&S2&1MgTeMDVE<|ePpYATWbw)IGIFZa{}riZ+;Jqh727aZ|rdNi%9H6m%-
zhrKz`X(37ppQf=S9@#JOcVSp4yX$#_{nO9B75jFseD;)+jY7)=%9rp@V+h=}w9hW=
zPyYuW74dH7qigIpN_-MgvfAfxY`?msZs6?lytJAlXDryaa;6+Oe5Qk4b>gbpjY+M?
z4>>u%?EBTIQuk?D)q?g(GS^~*<MkXHA2)fGG|q1oe4WVeTbOC)7gOinw2SHS*N2n7
zNGn{4nPn$ewfb}4&+P#wYq{F572cf@<D0U~Ws+mb2J@h=X9{z3&gJe2dBbzhw7lng
z^NxM_Dn=R(OLkYhdYHPyEcHkIHRr6dS#MsRZoRlT{qkg~(6m4;`Haw0yC+AV|2ilB
z{+rTXU;gS{9(pBKMz2rpwESAkzgIE%?%Wx+X8M6WUR;yiclzJTsGJs+vGDe@P1Vmn
zUA?FtsnhpQC3^ODIkm~Q{z2EdKhM?(FWK0`Tw}!gW<t7~44=W?S)V3v+<))OrU$<I
zkF+-b5we~1>z4xSeAzup$G#T4pE^$^|H;ul0Ud+T`Q7FPKSg#da=dfHzT)TY?AZ<i
zHUd)^eCmQuyiPSsFtZ9+QFFX!YhlHv^0I=Of})MpS1c`$Dldxo6})y`#?+`EKb6)m
zV~d*Fc<z$t)|4zWN9F}AalbAlMZQnn`ddCeq&4$t_=NH^-kJ;hDm|Zm{CRtC+VLZ;
z9L2t@im9xYOI}}YC|y*eUg5O)Vv5Z|6JNpD$m8!^>JBGr=!c(KcjNH<)Wrw9yteQd
z1nsTiKJEW3+pzURSdBsavtkz3FV?q3y%v7p<MG^X{!;5)W!tj8ko3yKtHUmaSAL6@
zhEBc&q(#*RW$gb`=6HVV>GNJmC-+$8i-<DM@!7iM=&RzpZkrVI)AECCIGkcuUfj9q
z<l@8AXI$U1ICfRo`~%sB);_7#zunzkU00s2emNm;%F%1Rn<eIl-I>0^bkg+I%u!Yk
zd>3>pi%!f}+L`|?{@IF9!zp|ArU`DJW-7XFb1={SUfVOtf4<dJ7i*uNsJ(MdPlvMa
zN4CjrlFwh*>m<*x_m$r8@!j>yi<|En-zd#Lx~}-tp0)o&Ip*3;6V+JTcu}}~L!Vop
z#k@9~2ZCy+oO)MY$vq*~p*x5BD}VoehJ!CezTB6}vj0%@;?Tm)Ic2s}H5kt22hTQY
z{krb@iWhUf1kRi+*7alQ+G6fc9#X>PUaNAB@7LLITtX-O^d{fL>o3aYb#+bsb2TSz
zEzgQc)zt>kVaHt)Pc?b3*1NYjZuNpq36g83t=TsDBR}gs?~O~WADuV(>uz>#?w`la
zlKm@pn?9Oxl&|gHk~vYOb2=}6336N>yjaJ4lfn7Ej<zkA4NE(lbT|9isFX`*1>et(
z3Nf1b?x*&R-z=Un%Wtilu;}Q$>F@Ww`@ek0|E;aRoi8@1x-2R!vq&hv(`E6xaMwr8
zMOWsYn$x*G-Din6gX)I<{5^)jhbFNdo7l&^fssYKJJQ8al}GiJc;T5N{u+_OR;y-u
ze{^?!wOZ)YyzQ0DU-j9uRaU%Q7nU8K`goGx-7hmwueLR{+P>*ZoOHt@hL(g9t)i;6
zO$+vYFW_I>Fi(z+^SdtVhOSxns^c?X7HuhUJ2E@mo$q9J_O7OvnK_D`Q=UJ1HedDa
z(&v+R{1rRaq7tN<EbuNkaltGF-}f(Puz#v<mG0Zqb|Px+l>aIDrSpQ-qSJS8?|Z&j
zNM<W%meuxcZ*nKz;$yjVXP(`=#T(wVeW^aj<39E7|AMoB3k`Xf_#gK_Aa#S~T8r5%
zE%%f5O-Wo%J{6b#IfSPM+!9_B=V#lr^uxXnzl3g`@-R>0PJGu9eXLuxTChAX?WJW{
zac<+QUUQy99n$HS4}XpnaQQMZI?<=QMXJSh2fxitj;M!x57wJ~a4);^t4J?w=I-nA
zZ^ACw-`cw<UcdEEmFAN<)19=e0t>ZxL!Le9XL&UF>Ktv)Px3)u|EIij3O~r!{$76a
zOtufH`)+=G=k3?II-qV_wd0FGzmk&qufOh5>^M=J?IeGK;p&$b_YKDn&7Sn*f5E&J
z+ZL`0V_{z}9e&X%`PD?8%UTzUB6Rm8`^DI_F1gxK&bX-eySu{6(kE|M)s;PN+#?WF
zd-Yvlihl6S$cPdz2gUy1^(U*na@${u#vMFaSn&SA*|=5gN<0lU`kRh%@|EPiXjSOC
zIr|&`?b)-xiQS#Hc<XY;Wp3K9t$#?I%=)%Bu<gzi_KE9sg>z5%)CtNj6Y($ZUpe#Y
zzGK}fE-Ah}+vA@6X^s&r+5W)H<0|j#OZ#?}tdsiiJiqt!*>C>g_swSCKe68LH*>A)
zlWnrv@qyA6T3=N2BQ8Y#+?LZAy42TY;xVTs8@bXu^3F{A_#{cpz-67VlJk`KL(!2Z
zcAT2xbE~4fkN?mFYr%;%8?Am^)k!y<(kpzIYi`H3-9Kb6zmNX&ce;V^i}mgIoUhgY
zQ~%fJ7Lu?aZi-E^>XT6EcZundH_xv6l;!?Mttpmci&Sd+L`m@((pRU;^du!D@49r6
z`&h%P9UE@?9Nn^gj>3TjO}n%8*0t<;Cj7-$`?2obM(&nVdN-SV@1L}vTQg<zm(WXX
zpXRL)a``gl+A<AOhP1XndnWAZI&<yQuSCWF6E4bK4_K11)T+SkdCW$04Tm|J@)Aeo
z6?;;C@orR`pjo~@EBIUA>Y5b_5)XV&Otk2mVD|XQA6F}V#dn%(lDGRkv3xdnjYG-A
z+O7|JsWSpzx%=5)5sq*!VV*u^Ld>mQLEAge2ydF-yC{2yVeg4I+6lgU<`i6>(^P84
zTUK^;ahE>tWsQDzJ%(Sp&wiPvarue_9+kUtX5Sw3r<ZPdJkDTV@8;sJwo9on>R5CN
z=L@HB$qDMamfn53%v`oR`c;F3>I<>iUO%1o2h7f>+B#*`vJF8umkAv2PCO^|nCs!z
zo}9;<%4?Ti+rXZ@piNhChse>xX_gh5JC7-MP1>a|e#lB}g3095FD)V`o=v?kUA5u!
z&5g|wX%@Yg*POo4wkXJ2M7E;qrp*zy39>1-O7DD$z1!MXq2@HFQLZ~7!!da(qs#Jh
z$F6SN=q4-XC1a$$t~PaD-szp@>$KmT3VxaLE-`t#`i+j2;cR+yg_KI?y0-dso{I=w
zn6JF!sQ=ldCvVrb?c9Gvq{WcwpL)q=#-2pu0@Z~kr;Gy1@-KQ6OcPQu>d9@LXnA;s
zi|}Nj(vvawlkQ4sx3R@3@19ca@buq`khRmwTK6qWdCjJwqWf~SuGRfS^?d&C{N<64
z*PPrEd4=m;>toL+yz7Opy)c*Lu)4o}yZQFI5Yg|4IQrC%8+=&o!`?D)O={)^+vktp
zeLnl{TUh$%<>$VYmFNFo)UEKvZ9`^Z%L(sGhc6u8y`g2d(Cu4W%%k7v{@b`cZqJ3R
zL)+Y97ZzA@IMy{szGw|_<(zluPX6Y_Tk0P#tX@+X`0BQjlT)F!+jO=Y4<=se*thk<
z<;U~(z0EPzza8zmW&YebOzAP_@2%)75nws)5WC|>!qIy+Dz$yrgeL9o_<lI?LG6T-
zI$J(VE{XVbyVupG?#PjKCoYE@B>Ud)G;aJ6AbFZ!NODz1ZDsD>DenqYc9c|H*7q}!
zc`$9)@zVdx&%S*><K9h^6IC5jO(w6pcPbc5Z+`dwz2~f}3C`JtR*%*#)nw&b+#a~?
z_N4ze0yWvM^ej-_;9Ogtw`0Nv9$q#jH;pMQyN+4T)|$g`k@e*M3xDfwX8%~ejB81?
zw8MY-m8nyFR<VU__1<x#PT%alU)|(4vZ>EkNIlI|Q1Xi2!Q66A$z`il-b~JKitTLG
zD^*=H=FH~Z_%-ss)gH}t8}FFx5NZukn|mtGpfNkeGFf(;Kf6wla#zvBRlHJjM3>u6
zU6!6K&~_sJ+Z>M<{@dQ<u4by!<lEh!;$)?zd~yZ%{%iMdy0@$UFD<xMTU_?x)rY^A
zra7g`AIbK4@$bR<nZMF@#(Y*`YBbx`xqRu2>Yy`E9xrdJR`_;Tar?&;8RqrNRKMtG
zWgq(R>1+FjMyokfpQJmdE*Crb^+jXw+r_UsRvu-3yecT-uVUxHtV?Cr1SWyzwm;6C
zI6t@Kx$}GXFx?i|-1cGf>dgy3e%vuXwR?9#(w3C#0bBPZDV>V!7r&6R)!%$=P>8Y3
zU8i<C$t7BPK1nKSn<~!yzQ-`rw(j&_G3&cYDGMCt8u7<0th@5n%JPjaZ`r?+XuG>+
z^X#tA6Z`eirpWcNk;kv*$r^Sc1u1PZO3ia_FaP+QH?1z~`LRzdRr{XIuFBhXRaU<{
z_|PW~JLQM}Y}6<EAKU60abe=~?iWJ5mzWp7Ib+b(eYg0`?+*@Utisn%E?HbC_P4K1
zBXqvtbD{H+(K9~ZDm<1m-AGF>yXtpQ;l{V+bq86?mz!C9t4F)sX2Q2MllSs4Fc@iK
z>{idsPbtkwMcJ*sHY&dOwwX}<_2mba@-KOpvh3v@Z_~%Km-Su#ap}lBx3gc5T`f=$
znpCiiLyY0=3!8uMwsSWqI0W`xo^w38`^meajlXZ(N4${!^zhZye0BTJO;@|-#!Ojr
zt>)~^Ig_XJ>TY}UWcQofC(WPum{gxMkM`a7``gj)DH~It$ObP`Q{A09HKXi+yUF6+
zoC5mWVkVldm(X-stGQnE;(-l|x&%*3ofHWOKHFHUtMYKSo5x%=>%eOz$0xl^*)%Q5
z{Zq}|S7DoM%2isfZQan5^(b#@$mK<gybSBT-%H2kbA+ZmR7s6gPrUkR)trg4ui`$2
zevdG5%WyBv)Vsf__WPX;rT+S_7G-&V>+-&8`+RGfkQiHi;nc{JT#75jE_JUtdfQsd
zJd17qx|T!zvc=1N+_fUF2JD?X(R`8C%T-C!SO4GObpC{O0mu5AH^UlsTfKAZ>Rn>}
zf6-_E1unj;wX5rm9%gSkA@+Zt)%o-H=FH!_x8nch8m9-(1HRTZ{<|i4%24n7p?)7N
zgL|*H>Gc^%%UGx_zOFmf`1i|WH#D9|>%IRp&GV%9HC=rL-N?gP3<U>gs@Gq=d%JxK
zbNT#mo{!#7?^*p*UK`bL`N)H=J;JHc8~Gco(|EtXxoP}b@RGtiuSKj2LtV?-1U4+)
zz9{785rNqe4e?(8N()`%;$j6NF6!zW*bphkz<S*!*Ogl#+VIeU)~$<gT#DYo*nKbi
z!{1{k)<_;+e(Lk&pab$9ybm(Eb&s5!$H8IADRt=Akz1^*3z-s_zcR4iO<J=^HQM>e
z$62p!{6$w^GZy-h<2Q*x^yHK|f13A*Z{5uCug3YF(X|IoQYZ5dMl`!#T$FGus^P2c
z6K2g@XSbP$sk7am^Hgz<pR=u+;X<LcIuUxTI<|{WN7SBPy5i#cn{6-e1Wt=tb~&Q0
z^KDFb%t@w}9WT7+Yvnv!YWwZ;43pIjf@T4}TeTg!8>9B@`gf3#`GloP+iXL{C>{Bw
zeDjXzxN57em=ivsDa-J|E4gcnQf4mg*xBqV|2^c)qp%stff64iCcCmcUbEdyvbV^2
z*NO5i&$5?&Dg7}+Y}WlvcTPGyJbi|f>%u+*(X~4oJyZ`ZW9IlQ_9$%LmX6|Rz3f8s
z=2eSN$|{%3Y+_;4cX5-jh+ZpgTK})+@YijzsjW9`%}o!!$h5b6?&auL_3zPp{eAKW
zuD>*hShQDqvQr!Lo|S>wJJJoA#jY3LKG-~?<g~_`ni#XDJGSy{@)i#?xNW2-<!fzR
z6x!#SG-qx7yxdkRrWK3d^f`QG3Yb`8^C|7gzeFoJB?;Dk7LWM_g){GL6Mi<=?&Ga!
zf#xi}tG}645|j(}o~T>P*mm9P^vt)Zn-)k%>ZMPpxjCzTmhb`w-bs_WXRj8&d0r-g
zuY9`grv=6bW(n@qJ(aegN;|t~FVCfQIyvVg+`fL)$^KH)qIshJZ*{;-nJaVKS2eR-
zSgL&Rp5Vy@#{M;oVkbqnESPnT)%)X5o?hd*@=xBroBAaG!>rPxeBYl1{omy$rMjHg
zI@;%bB8S!AS@VzL#=Cl}x?3ct$>=Uz;p`P^wRPIu%3|N?m)F-YN{Mr*zV+o{+`+Tv
zjm(|Sw~afWmCoFK?{uTk`U}!xjj@+!?QOIBA5>?+J+t(jR4vyBne|gA{k>Rp@|0yH
zXJF%G@lC1j8L>)jYaL@3m~Bg5eD!PM@6LjQa!)&!SaUs${HASWDB8e#b27^TChrwn
zufH{Ay)G}v`K*0S>Z~u7ch)i|m(1O}^UsEYiJ9^CFK+MtVE6w>S6K3g^KE<Id#HSO
zaL+%>!Ia%lQqxe_@_)Lsf=o$#Bu9(PucxOx-_?}es-5Aw&XQMu-ZiD(UC*!ld%dS1
z>;G9N@A+)=mou|uf0)^<f30w`So((@oa++43&z+=cH7q2u*7ybopD{~+qRA+M0SU@
zWQBQTo9?0WPInSwxZP7G#U+{rSp~9bOO@|Y?p6H7Ej2~&x7)q9GTpxy-8t>I-uJR`
zbBZ;u;x*4lW$OjM|7Yxyxtror|6JWzw!_54vS5u<$bp+?KfA7Pus{8<@6Ph}g(-il
z7p$H7%d(bz--#a6H?sp?tr0iny<V~{^=NP9<+IBKzRt=|*xqJs>mcH8{{1MAnOk0F
z-Q->VvOIyMITrrBmwp}C)T!3joY8n-{#w?OIWI-ZYL@Q2_PcFoo8+eH;X0kyYrCam
zE^t_G@F?M0KJVcb*P|s7-n_39pT2f9Gf2yl;M1OYI-+lV^znrWe{O1?iFj%Cvi$Rt
zdy((;KQ$&ysa`y}dbyR|$It2xW)<;UPU$kNd|-d!Pu%}F^?ubArI+46^zIXtzE!zq
z^Nop<CktN+Ipe#nV8($$VZUz|I4Wi3ciHYgGs)RoLLq3~jQL)vY1`}mtxQncykx^a
z=WUNSev3OH`{rY8j<B@D;+b}<K8bZJSJpN-%ui(2xGf_6Jhc0j<J~_^QU6<5q#2YP
zcE~CzKGu%Qh`#=ok9X#K;nfjF<x)<s-cD(%zI(jg;L;qeiPOI6UhmW{;XJjiq)|IA
z{?E5}HGb#vBXgf5Jo=r|wlG4xFw}U{ZS(3467P7qqtvB5%+{v3JXluft+<z+$(+f3
z_J+lGjZPYU5<2vcZ=w6@EPt=YH!E12HXN84Vqx`iX@cx_WqoUQ;p}eP^-~WCUXs0=
zzIa2YG)uxs_JEEu>i{<yg9VEsR{J`#p9v{GWWII6!8Q-$H!Zxgtkm_Q0=B(Am*Z%g
z)B9#_{UZfK$&>|4<iF1<`?7#{uka@}s|U#*(gDu7ud0tNh@InFvAMj@dm~$LUAgf3
zH)}$p-iW1n-&_0E{ZDqj?qY?G)3Z!B9NZZ#-f*i{ihDE5HD-|y<zH4_7S_14+;CMp
zL)43FM*p=herZcQc4U>M@zYG^jcw&7zl0gHCN%S%KjE&YbwJ4>n)#7oZu3ip!q*O;
z&UqZUk(u2Wc-(_4Q{sf-|Ex=gco{aCwe#~G4`wdCQ}o^9-E;P|+o>NU&XwxL$DTX6
z{zhc0@w<egSI;ferZ98g<gh>g=ioZ~8Oe{&Ph9aaLH<bh^^3>7Z45U&etme~w)}s8
z{@F|Vu8rU2E-63Zy!&M58@ojXZd+&_YP436GMe_*tiif{o$c4>I_rM49G<#vG5@u5
zp?rSRCgd(CXq>wL7GM1(wfR#+FIIidczEcR_z|7khYv58NX{sH@+3L3@`#_7cG=RI
z_sYzxP9N$nu$teVJZ0Sqd#mQIW&U}WA8Q_N|C=@6wz^C$iz9(I_k67R&V%0%1hw8t
zev~h0$CZ3~j#!I&Ufj7o3vb+u_#5X`Te|+JO2TukQ%~kjxcNEi_t{?eU%RW%X}z#u
z;=69KBH(ug!&TpCxw%%ZZBj3b&USlB-j$a(j6CJsew&kDLb&AQ+Dk7>ck(Q1pZ1`Z
zA<f(T%+G6&u2_8f@gix-37LI%B7DEy|8$66e3S9$Z)L@bwEl~ie#|L;<$ts8$hKRT
z7O&hmzwlkbkM=LSZ<V(v{IggcT~IQsG)MFu!>RJ_i3cwlUF>x&V~dg~h-ZJ^RF^lU
z<oQg_HFlhRCX-X|?~OPXe}>CP?X3rIy!~XuyRQx(nSJJ))x@WVxYNyTCbP_wZ)*N{
zroL}Yec<||HJ4_-mA!oB%<q?6*8Z<LjOra;2(Q`6)GnWYZZ0>2G;8gWcJmZnHqJHL
z_cVOg{CwFJ{%3!`$BUlN^X?|z4o}w36P3TUEc*G(<H8TvvUauiZ=H8{#Z9}zIbL@K
zpFY^~<<Z~l7eZCma+c1r&at-*X8IZXo7)H$sxQiAzL)T_wq^g36)bmW+}-!kHBYi?
zj@^zK{}=vW)VRCmcDZVrlh}scEep<QntL+ksMo63aeT~ME$Udi<dExZzui~My&g$d
zCQj`z_3l4?aF39P{z4N!-A}r2O71#^ecq5OSJ=!eyx)1ZQM~@g_8-f>I2^y^5Z)QP
zGSKD?`^F6khdbGSEn>55Jj(H`*6s9}yCHWqD-<r2tQ6a&ajI~EhyLl>;|WhECp_C=
z$MQ?@TddZPTgrdWJAR!QTqQo$X}?>zo#*5K`3-$*?y7IF-x$(U{)V;o!16MyZ=wp@
zD)WpA=dO)a{gSTDSzESi+pRviB|Ir=opa-VRxUB*t^3<`TXx38ilC3u<<*C?GNx`>
zJMYTP?=Gfm9%Se3-@5qjz2KSaCu@8Xo?iCe^MF40jmHfk)yhGRTeD>f<_ImWTQ;lf
zwaLjzFTbATj=r(WCxLTe`7VF64eqT%E7o37Sy6G=sZ!)xSk}9=YR9!4o3AEbkK1g0
zU3=!AZ;gL18ojt)(|x<Rx$d6m-#ZVPC(k*gcc~{(=sH8ciR8knXWD9im#QD}(p{`P
z$HBUMlCZaIhWuH<eIdmcv;?kOK3E<<!}j9Vb$<NIh4n6fdA={}$$>JBx4l304m?k}
z#q&1er}#v7hFYo9?zcXuU;K}DOxLl(Zl)4#1_rh}3=EQ}yMf^ypF+_2L2qkcSKSVq
z^q}6BHR_gZLoU}gW52Xn(yC>ry`p6A>-wKxbLJTP#04!9DjE!1)?CZDpB|q)KWFv1
zzd;O+o@I01XV-Q5Fg?Gr^XlI#D>n=8sr~xJzI^`E$vJ`PyW214Tzs<GX0_YF$*ESB
zr_1(t%ICag`Tg|Mrc?gsXFZtB&cC0x@7$&bm0{Dn6K2((=_;~puX3Ecw0QNK|G)PK
z{F&Xp`@{42=EJU&ML%qcnihKN$<w6l?69ey6+F{cr-i0^3Oy;VxX$u2DbQ?<$KI`~
z^QLb76E=VCtUVL<&pMsD&w}@omBplfyR+RE*{gKA`MY?m%UJGjJkqEYl)C6+#I~P%
z=B(>_<I83n`NutK&8EbH4=Woz8{<BdFKSv<xam~)%HJDeKIK{WKX<Lvn(w<gbz4K_
zyeE;m_s@SiYI1VH-mHmYomz#KJoBXP^Sd;r|MZ+1_JLu!i2MtuO%pBk{3gy{@$ljM
zX8*}OU-KpYOc9s-&)wXdFTa_~eU{IupGIpR99%8rpjK)X{P^6)jj2-)#&e2R#Vnny
zwsO<w(74pgPY%0A%@q<&idd$@STd{Tz*V8E{PBBit3JJn{Pg96@2AuE+g_R1)d%Wr
zQeNT0VD0(Zr|E{ixbH0eO<bqt^wLy$w7do9Citz&nPhgeMB-1=-ADQ2Pgiehi{GmC
zLut2!lGMp}*FRm~v_|-k?(Pk1PF>cTyV|w7(RkK%-X4#2XSCy3Hk66U9CiQy^_9ZS
z|ECZB({I<WlgnlOuyDdV-3L`^d$t;=*yX3Zync2y|8j!|k#$)~M_*U|Qmno!VUf_F
zB=$DIJ}P*Ue|zK!S8bOC)34rM)?{gLdS~#{bNyPUPEKEFr)(PfIFirwQc}05se3!O
z?3;sc_C-7Ve7tY6(Y;p}H4e?QJFCvCZ=-o>7vH@DGs3T`+-ASj@GxwDj7?)?XUNTi
z9n+7U|Mu;h{>`VZk-p3`c8MCzx0*3E^a8`-DGf}VnlsYRMq2hRoW{1%<M~aFw(pYy
zv!Z0K`<jO3Tee7X?_pikJTdink=B``5=Gxc-mibPY>vER`lhz3GLFrkJ@@^vWOj1u
zs$`3>z1C}Fl)j|l?IZ8q!8H<#8RTXOe}DJkTJSf$_w&}Qud{k$tgyyvwO!gtqug@~
z?s-OvJ&Uo`SKmHQr{SaMxoeTr{2X`G{PmuquXZ$RmTK^Xl*!B1eDVpOCfoLD(@W>L
zKbdh?-43h0{+3mKqKKKLQ|nXe&a7#x)qaZJ*wF8?UTZ?7>Y9SPt<G#>8}7~QPB;@_
z>3L^T?eyH7W<!Gq%M#A5UK77Pywa#yeEYl2P6~d>CSswJ=dp%Yo^QIbW&e?Q>9%_<
z2mh+B?SC-Q!Dn6M5%!q+8s#hQ!rm**q!<?b)-h>$ETE<<!=~tC^pCl_>Ay&5Sjqy8
zN8dkJ8ahTlGl}k)zv4mYP0fbJg{_Y_-V8qI)W51EQ2Y+pOC@!)>nBgDX1v{85^8d9
z)>YpqkuSk9C(9!JeH)cpzGdy*xM^i{M(aa??E>!_)TM*D*T;oVo_EI6llx8QyV9s9
z8`hL@W=Ax1ZvHdbHh0c48(!Am#`+0@yLOqRdsQ9!Y9zd(LeWS4lk8P-hy5wRo@<_o
zRA&SkGqbUFuVJ*=D_ya3gVuY7J0`0?2UkqLvRXCk#?33LEXyjkD`aSXuzsnd`XVn@
zF(s$8T=5B)Wkjd+gLC^HXvcC~F_2OecyZ3~;htGNO}ts(uTQ^qai{Cg=a-w$?wMHg
z&8_%|c+aAJU#@S;QruT_@f+8}E2m2yF)R-M7jh;{Nu{lM_vB3)4t(jsimQ3sYM9qP
zPSbjQ?9kC|mjAe9?>|4h<Kn9Y`;^$%Uzje${Q3fGL94a%u3e7nRyez4Pu<5G@$zj#
zWX_jo3#L5t4!+;^t2EoVd{J~==$)FiZ*F#o-`N|Okg;^Hc0^V7{wOu!WSN7rnoD*3
zN-k9XQO)J(UBDKeo!%7P;NTeK(B8l>S!%~M_X`rsH5ZhaSZWumX8$zdZMrM};JF=x
zhkw_bA2((k`gq~#yySOB?%un1&po{C!kneN#d`}*9L)S@7|kM{DLbWGM<e}>Y(0l<
z;yH=N#}~3^{OG7WvT^gZTb+K9zWqHPHwm&<a|Am}9JyR$#{7msOvl~o!ql`)^Vp7T
zn3`L`vN@M?>$w04gXJ$orMy3`Pu<s%<z_!o!$cy6pE=Ivv9(U=gfPiK$8X66vibRz
zxr^H8e=hsj;Cu4gwR88+H59V0FPxqhbnfOkq3iY%N1H??mK^jH^Eu5{wcAJ1nt5|V
z<utvp&xsSv8@6>XIH{K2UBkp(&AD`Y*`=eY1rtS&zFV{AS-``D|34>hpR5&c)_CtL
zSDXX)$7|;%OTD_{JK=2F3vs*V%+^x}*DLH|HhX;L<+SDpHon{ylNL#G+f-yPKey?@
zn#^fmU;O)<Y1w&xwuS!t`R2RtACy<v6l*u7%6xjS-_glG*31--KKXgN|9x9)k2ssk
zx(R!#z9;?X5ZlF7-n{zt`}z*H<L{4ud{O^*{{Nqk_w&5}Tl;?h{}2EE$#1{kzA*Of
zS;i|fTaVZ8|FkgH{>I<SGwO{0C4c!>yQgyPLHWaLbrp}zwr?&xrds*r&3s;qXR2qq
z*t2&g?h^j;MSa4=n*Yj<&opnCibWdzzM^+XCit%Fgjc5{i|&2c_TcH&w{uypyL?{p
z%fk0__z6GZ#x0-rD*a`#2)?J{$+E?ax#p_0zH)JKn#2KyDW{m1GF;lu?7Q#Wmt$`e
zOr;NmZ)D>Z_{txep>C1W6qDDrWXHzSKV@v3{g|h)8}HMYD01njrok?*FZ_2BT+5Ev
zPcdeev3q9HSCXF3di5adgo!OI1{2)g{?ppd|Ef8LbK<6BjA~maH~ZgAxvJnS-(UDu
zcUt=cH`&?cf?^T{>#b^<JD=Pwxah^WciZmMs?oCRrzw<fI+15%<DDI6EA#QutAiKx
zc7&XZi43wY?DE@jTq~1j`qVWpd$U)rGx6QNuIge?;ndxxVU^y2D$dJwY>K$DA5BdC
zDjfTzYJsQMfmJH;f+hiv&%HWvCoR>5H75DVTTP>d-A10l5+`0S=aJ!B{6cVnnSer8
zlk=Ase1TV;-#C0(H~nUd;pYb`@eN%~sSmHNR(G$T7$k2m?%><={Olpy1K#(hM+iJ9
zUEwP$Bcj#Du(q$oPNC%cCMMOV8C!LX{J2-he)wDTuRO=Q;>cs+)+2MKtzr7X_|@S{
zYx#Zs#`&jhw3j(X9$zuP&@%rj(<kWz|79<9|50JSwa1ZrS6Z~T^_kDpKknVIV$Ru5
zp7WR#>-&@cJ*+l7Y5(Aq%j(wOb>H^{x^i4_nx4$VC?fD@pH9$>P_wr^xq@4lJyptS
z;_v>Xv}3}mM_GaE7rgavU|XT0m)Ntwj`2*l%#UMSQ>QOVa1`==)A;1GG531Eb*i7{
zm|uANdcrKh#U?!K%UgwOmfkb`BUyBn``GG<m*N~Fl6w=5M^wq2KXo<fmDrK<OIWU^
zZ#=avMqrKT0v_F&e@`X6XJC|V-<`Dc(8f>|ZH7MKb3!*;*dG05pRiQ%qA}|p(W<$n
zrJ6FglW%eICG2&q4q4VDvR75eb%LHlJKNUg<gim*Oy-T58x9ndEpRE_B9p7YB>9^`
z@8NfA$wlSG5-Fjqf3GXrUo<*)E#S9bA!~EB#Suo=8~?f#8y6NOoUi2BBN3wJ@=2q{
z#n-k@&4Ri5hUR-y+s|&Q5-s1OBE%w;*1bxdXdWoR@ap_!|2Nm~9X|N+-Qhx>Nn1S*
z=5evF_}$9<LN|i#;(@p`s<&b^T$9Ast2V_bE#Q-6*m^u<ui{PL=gNU4+oF8F^=y3`
zI`i~I+kfW|EM1gp{dA`ZmvWTUEY0cjV&q>=SlIS)-SKn01w3b0hD|Y<Ds#w?L8JOg
z*ovBN#^?+4S{B*#KK!2{R+QO$=5uNB(-*t0*ZelPviYdF;>=Qo;|#yr{%}<&@EBJ}
zyqhk%S?I@!hn)Wxh3=pGV10&+UhxLriR+o2j|(hGsN1=R=iH^IpMriDN{Q_^@ytHp
zW>m)+mDSDB5;*U7GWSudqc<NV$4%unnbn@uz<ipU;hRRMjP=3uk{cE;dT{xOgz$z%
ztn#f#59x`{e-t=x-QNXb=dPbx!u4$7n)4fU)BeW(@%__~BxQa77{5L1B?aT!tQ;2A
zFPnsvn?zT7Cxq#|$?mGzbkWh|yX1AAmO9?%b$*{&Kg$-Z_wo%E%6%XC;%0t>K~Mfm
z!B1tk*2Jw}IZf+O(ATcZF;gdsD4b{V&~&<d^V5&QZr;d0u939|ESaq()3R8d_HyW*
z7F}^dUXr!pR!@`Iu{MdhW|;>ipDa7gFCbTX)^GOh2X2R5*Z!M!xYmU0`i8=5Pdp=i
z76(*y`-Lr6Xe;12lvxrqRlKz9|JRH2@BiKN`^9bd`v-Zp_$;>9TbE+wojg5B!ftEP
z$^$a08e&#FDN|&s*C=SP?OEukZS!Tvm!@{s>I2T#ef29MHn7_)-TsAX)m9nanT>Tl
zdvxa)Y+S(ls?yX`?5W9WWv@P^drIs2);L5ZzLQj&_j1a$({tus$xySr_aSn^^)sq{
zbqO~aHVesq61*CC*XXUTf8UWiKm2FBJbM4yYT<9*P4Ast?)K=&9$vgD!t~Dh`>P#4
z>+<htoW3ixg@=EK-l{g`c`l3C+l;mg|0($~|2)6j9WCagf+5$Y?5?=%xjCt3|4O~U
zi42>b@x^~({4e3+@K1d~Xgu42<*$0KudTll+nDw3$43RGl2;Ej(o9S8&p3rfE($up
zr`w>{VXwU0C2aEpC1%kJPd2O--f~qfUE{=oAZLZ+{KuATJkNF1w@T^{V@P?7$e{~|
z`j1L&f1ath=lKa0%V&A~ntvurF#Qeju#os6#!~0EO6RY`i{HEED{Q)`nE870wKq#D
z=UTSQI0XNaoBh`@FGz#inpeW@kWB2?cfU$sl<&K%@^H0i^DXuyl}n2Yc(@YhNxZNY
z2{m=x_|U?+xFk(xPxQjoYwQExi)CmkZ7SX}P0oJXv4c|&M9yJ8dn>~8*aL^CvIy?A
zO#yy+mt;2=bw4mZ=oz|ag(DB2?Z)k9j!(OvuG+|4?6kRlVf4HwdlHh|wdUnLu=0%%
z=5Q00FW(Rp8Z$L5&5A!@m2bAFWTQ??h2F8G#Z8^1K5iRzU9T*cS?Ow6b+zlj6qiXN
ztKBtT9lXCOVIt#e1{Lerg_GtM&zJh#py)l(V*2E(j+1x<?82|4&N!sHuE35xT5i|;
zRd3&DI>!i|;%ru$6_jvd(PYNW5_&hj$?Lf*@EWaEh$|9mbe!7|>bljlp)Tl(s(lxe
zv8>N&PGhGT#d5p>C6}AsPNs<*4T_3cGJWg13r5?vFAXm56I;2WW|E=$&#tq*oEkrv
zRTWg?&txz7dm`$I*!8n~YxsXMEr|T;>pvmK%|OCQ{KBPuOJo0N{4l6<UoPnXM)6CC
zc1Ie|x;_@!r=?Azvu#aG8FVJgRx8f3_DL+MzNW-f-lUVhOe;bCRKc#0-FqUhTfdt&
z>F(yIb1q+;7PoDCuc(lVrpe)+neh$F4lKJjY2&&zuXCpO`&!3E`p&Mnx^<8FY{%@{
ze51x19rgIS)U}>QR%%oE*X0)|yUBO<I2ky7O;ermkpEHsOu=*BtBR-mSzcLZ6y$4R
zaHY6Z&iK+i^9hq**vp(!-tuv`)oPde3KbrS{Yq9oGxn=EJX|PU^nA%0fn}?g@w}8O
zYPlDAiKBe?&X*=B*7twDnWW6LF=W%y(&vK5LQ+K+Z@DhC>q(v+zlO$wTAu@MwG#F1
zua9{1OgXenY|-J3+K2sTzSWfNQ2zaaEqGPIN|QsMEZJ{~KeuwwHWYI@vp2D}QLA8D
z(R|J-$I6<so@Som3dx}_)cLgz%~-7Ee{ufIL<P}RAC{-H89W!@e6KQ#TQi9DjC9`C
z2;~RtH9KR|cYQ0{v6{WaqNga~Bj1PntQ#f-ho*H2ZFKm)p-kkw#k5CqER_mYlb&~p
zRyK+L)Yg#GbDF(tNzREh?o&5&Cx!*opJ=r7ao?o9<LE*gpGT4p3N#wq))k(NXzWW)
zym2JNvD*DW$^YHE<)oHKS{-b!)9E;~(e1KS#-5jan;Tv}ox0Pi_|TV|+M8B9zIy1c
zrkL`wIkrExCr3}p)Jig5ynm+TzPy%p$>`(*oY52KBz>H)Q`3{}O?z5_+n?pq21!g}
zM|lI&S}tWwT>gPw<@pvi$zK5<FCPn8Jby{_t8Zm;31v|tPhBUSoql$yy3B{m=k|&U
z-Cmy&xUl()`DF1ZtDby?tuk)!beEjH;M}~peXWk|lK!pjJ-e$<8myTi5!mdW(WPe)
zyr^$0E7zsnd}p2}OB-CW<9>9q=;Z5;DU6q7Rwi%OoUFL4`}7He4cQ?QdEFK^XI7g@
zPIY;_@vwqP>ajml9GDJusa*;*NIa|l=MGEOm*qxf?WQ|)x$@ZM=Ul$?`WvssO52Y8
z)eJHXLK?1?iDgRySk+grV%l(K)^#7wxe1r9eXr^d{MwrGHHrJ;(+IgH7oENb694*q
z<pZTZ@YTF+U2rJdS!Tt>Znm^<$Boi=&p7soReZ-v&LV*;k4{QfRY?AOd1IH{C;vrV
z3b!_@ZkL^S_`7z-%*mmlM(YhrRBr97D$wP(mpYiTquo+7{HVy|jskCs9aR;!Jlk$h
zNU1(K#pmIseJm9RD~rFL-O4j5eZ|JN9Q9r+I@cY2@y^$AX7%R%{bss-ZFl^nb}d}W
zeEM$R>ej3o-_A#@ajZW7^L^lPrsCzZ8Kd8Pf4Mj2>${f+SI_60FRS8z@6VrWpXapi
z-n~fe)Rp6l-aIZ?!z}tD*Yz2P(QbupvMON)j9zJP65f{o61cr{qImAp4Tr+y7hh!0
zbi8K9bm7?YHHWvKUVN*}RLa`UOGT<U;e==QTE52K&p!`23$2)~-8q46&f2Vt2Q-D9
zg<QVKp5R~>i|$pt|7gF1NZ0~{e@@PkX;X{Jj*2aPRA`oc=hDo(PsO%P^VC~sUM)0f
zmR(!Gy3=zuPp*29%Y7xN<c;7boljB8_eAPhebXI&M{8O|dCd@1trP6OxU(?XA>C>5
z6TSHb+f%-L`*io>>T-9Fyzf3Dhq(Ir<5z^MaSERePCWU;a$alrjeDkx7*mUi|LfZS
z-={9#qSNO3O=O3r;)3OoXU|PsaD{j0mPd*nZB-?uZ$q|t27IvfTp-1`t1K*5{eM(S
zh|&CG&bLnX&;K|3)Td_4U31<>{M5+GUw)VO8hhNCKe2Wpf&DylZtb0v5W@4IY!9!H
z*-bf%XDW4O%Y1Iyt-V$nydrebRIk#NeqO0Z%@$ny@Nxe9J+=pm?fMT}FN^xKf>-~N
z?6u~GkC!KRxL*9)a)$d}!;FuQAIGu>?*6q!<JMc2h^OTVf0ZZH&-%1~rl$Y34d?eJ
zrPvj>MDIJe@Y_4PMSFHv)tZ;T-_?1`>;vN-Ym*mB@e7>AzvvYz+5X!b`C;{+^2}Z9
zKb=q9ti59Giz}V>N0Mqww^?@k{<(YmnZe&PX6+Yq@@7ZxY0nkD#MoFQy<11xnya8e
zSUdgh!<6Jaoz0W)RlV$wv#aHd;n*H-lKa%uFWGADCl0}~g1EgY%l(deTASBu)*0NX
zK7VY-rcJ4{w!bmk8q}tJy*=kB`+jfN<82KI!fQ>ArspwkleFeuIhj*oifvJ=;Zdfy
zJKKaS|M==0nGkWral4k{HjVt1-Ub@+n~g3;7hf={?Y))2?|WkB{gW5!?70Ld_AFcM
zKXLk`w(rG{`(_3Hk9}L3VsUfN#o5~Rd<x3>PogybUt8+L6q&!yxr#IAy5_`qKlv#k
zyLQ@f7;lVI6nRju-TLACg7ELNj;{~ccuYBDzT@U=3D;L$Gl`7ctz35EbNKS)&7WQN
zSIhqXc{=*VjifN8enmymHH-D`*=jzDaJeD8^Rj5G|11XgJ2N<!o4CJH(UuKh*8Xoe
zzw70(c}CB@Gx`z?1JmbUOxIvFxy;L(8T<a^!vLi_4kDghL9@2VWH}yV2)g;iY1)Lc
zZAX1p6g^i>bqHc<JbrQG_Ze<ybfgTW)l8W^78iV<@Y8mF+q;dTw<Y-uR#sbZY_~Wq
z!Ma(g+9~yp^2b?HS9yMwPmOPv(c=F&U&Nu<^Q@Uzq=e%AQls?`H>|bzp6h+*>$H=~
zky=;y{yok)@8@klf9pp7j8{6>Jh^tyb2>9^^4h)Ub~xyEl|-5?K3e@ipDATS?v_2e
zhXM~fKA%=B!0FrVy0hjyqe1vD{*8rp^>^F0tYCjoe)HItjpDxY4AZJFZfe}Wul8q>
zY>C~?BP!L>x2r0?oLl$!W&8Y9wLki79?xstbIq=C_sS0sHa0TG-_cH-5_ae2F|B_V
z2mh$^Nv_a5W@==^kn{Xdsw|&l1<QL=<?Z|&FASr-W?Lt&lzS)ery{6oMR?7N@+Gz9
zQ(j4J-GAvJ<3ZzRdtB3PzNvIv+-l)=<y5Jq8{3sx+gl<zzPySmPQH=DXC9lso^$Ix
zvnS_wU5it<x_0a3HQsA8x0iL7zI)2>+5BdO@E^l&$N5WEge9HXS^H49+g<*XkIm1Q
zP3+~#4nO~>*vC#?y_L^Mxm-GP)$4?NU-vE2>u0K)zCGrxX1?6bCp#sbYIcXcWP5T}
zdhdbYV=tchN|jHkc^EeJ@%!#=ub%wgyK%OkWs}^I{#$=NU6dYMXKs{r@5~OeEAIYZ
z;#((peM#}!vuE#2p0)DZ2fs_-XC`>1zl<!@_l|nLe##uSCAyQH_}!-+oHXHL_`TSc
zb?rX<S`05Ie{MP7n3mPE^8THbs!I7E6(-xcg(hutdd(0f^ZI~?t<TIwS$E$WOk?!8
zUv%N=p<v<a{tvAY^BTTQ@P3$hQ$=mt?e(AJEg~=1B;9Z@2>;gP`JI#h>Dr68KM7B6
z*meEfL5sIWo98%xTB^8M*0sdF!oQX8u=A}~Ykmq&oVK&>N3q;AbM{%MrYFo_btB@o
z9osRzl?{BG(k(AWDBRFEu=z}uqgzV+!iGe#S4LA<B+FF;g+CwM<(4&d(hs?wz1Quy
zJ~UkZCUG>6=LhGEt$qU6_WjB{V5@g!roQP#BQ2R<`wNP#cQszK^-Ik-&^J49+p;N!
z?EMcaqc5~gSC_Ouawz+Po$uughtASfo0`R3INcR`qjYO_zcaPGZzQo#dy3oH@Y6Q4
zcP)5&)-*IYo%ciN>gxG%tVL0py%T1I)pM>rCusVl!|jVjr__|NCE1hrB`|d@ebN(U
zvoBt#Fd{a%aASJQx41{`$1Eltx@)V}E7!vL`n}0XfgcYdYNXe5{@pOC#hCT+Mc=-!
zmmg?6J-=6>|JpyEqZfCu-Kthw*R@YNHtwXs|2?Y{?P`ACoo+VKDr!pkx6+#o<rTH@
z{Id`C%NqnHeRgQN_FDY9=8K{%o?P#<)0VEPfA+TM=8I#ypFG>M_P*ZqvwzwO*=OzF
zd^U7KL(%+WmCbYRi#C6W{B`Z+4Ks(I&SAGC<TR75?`-;GCS}jNATLKFqw522%*8VY
zoWyD$E?d2H)obHupYD6kxBbO)^1I(w#WNM>oHH?c-1BN(rS-(Tb<UwB2aJ9TM*cN>
zGiRRGw#P@O6qwz7^N;^rQ^hjgsovUUyH+}UnCw;EV}4XenfG+!VL9uQ-@jPA5!8>k
zwfW1EdpfyG@3uxPJDFsD%a!@O@ZJ4_TYYyWN|*LjPAxocQ#AcThWw8FwwE50KQSlo
z_Y=FkIdro4hP>0K^ObCkor_sq?gbYgH=pY#Y}k@>?7Aa!k)Nts_U0oujUPPknqBgw
z{cuXZVce@@#z&4n|GZ7+<0O-ivZFg5-Mm$~^g*1!G2gwByWFad?_dvn;2ZpO(T<QM
z1$NWfgCkFP7nl|ryMJo&&XV%oE;iro3hO!_=ISSBbk1u%$&}0Hd7u4UY5}iv^&82E
za=Y6x-;N1&FL~VNcjETEm8s5ZVr<{5I*u&RH7q!@L+(LncH8ta$Hw_{9~2zC%;{@j
z@lxq=c+-cPSCcM2{wL&rbvj#Cx8Qm)#RE@$Bc#(`UKaLoIGeg&(NfEYIpVrxT61sn
z{wd-&kM~%l?KoU~<@4DMk#(zr_9nZ;#3q#&cKbYibud52x#vE&>w)CRQvFRE4td|Y
z5vo?&aNVoImDR^tGCOOfdV7b}4deeJY9&1DZ+tZVTef`OW>ufy;GY@Nlb^2^Ugo=A
z`17jhH0Q9DCu?3=F28>7{=xhoi6yR!mlvurHfuF-M!B1=l{*nNdv4Ow{&QSWxA$gc
zy>d{Q-*>*`gG|~ai?4UDv@qtsy?FSEfNRUT9nUqltaS~1@?LgwR-XG(HQT$*m-zqJ
zIyRQ^re2jj-=xOBW&7M{)5wRnieI=zYR1b>*_c0h!OXbT+nrAAn<0MSPuc1>KNu4}
zY^>RQLT}P1mXA!Aw@BVKbeZU1x0W~R`aH&_8w^ulYTZdx;C5Z%xcg?+ZSLKjbB<(b
ztZ-SdRP}9yma)g}f5*@2MrD<=%+`)9F1y#ijl*^E{j_<f#B~3w%&loq;@PqzTFOJ+
zsdl@}jy2b$rEgzcs6X|S)kDKPeyP;6mp?Z?G%Pj!nX_3*b#lh>*&JTa)?^+Ika~HC
zWuI#^^W|m1E^4#hOx<~)`qgu}tyTE}%I6p&#BCov{y6JrR+2?W!5cPL#T2=l_mdyJ
zT@jM~ePZ*?8)_n7Z}mDZ{Qs)tbPr!u`g&LEPltDDwTaJEePL_S#b4o8Gw*umw{C}(
z+gA%m3S>Q6x}xpyl>2V`#P9L<_D27^FvoJ?BUjgLA0BUKt0<oFQ%$#Mg2|6#H-Dy@
z8kjTeacBC&exusOVg~<l&zVfG8`)Nv+nH`!xP#Ae%hu!n_&gN;#5LJow0s`c{ng8t
z-)r&f6;n&sbr^_6#ak(|Rj}|E2(pJw{ITfNY#pNwx0M4wo>TQJn_l7nD<#!dXzJS!
z(UT<-H_Y}qbGGR3set68!KKD}k;nJ%_22VA;#QFNqV=n;l(p{(ysDpcWqSF^?&!ET
zZcn|nU9b74O8&Q8`_8^cp5fVa1+CS;ceE<jXPi5j_uMz))=jO+ZTTUs_5Bl+?s6}D
z&l+mc@y`9?@0WXD)biA`+w=XCR^(^1|Hp5<=kI)-%PBKo^l^Pia+&Pa;2Fcv&Tx1A
zoTgRV#n;Wc`EGwZ^B#^8GufMU#&u7PgLvaNd90Dq+rPu9-+tov1KL}I?y~yF*Bt7r
zD~PaRX_RHYxWHqh&GF>;4GLVfN#9g9F>F<fIo_H6)Oym?%lk}9_y2ji$kTq~K4xLT
zyBzD*JX^UtEaJZ8R4=2Xza9Roi?;U2T@sa%OT1QbMCfh%zT(ESZ$gTWeK-}d_Vt6V
za>jig+CTP|ny}bc?OlFz$${4|3)#+v8`SJciqqM7b88sOjT`G02(~)AXC-!uEct(J
zbEU=WYqcNMLn9T<PQ05FTlC9zyVu=m8@cV@I8|=m<#$C@?^Dm*ZX0=v^7X487VioD
zI(7QY${y}7(~j)lwD&^=-~X~W6G!FmSrcocKAqP5nX51(Zq9nU&-)BR!f!5ql`Wn+
zXWpuX#v;AWEeW>4_6cVWFm!)XT77HHgucAhchaxFSa^6^@VrjDiobtm-g}?9(5*H%
zzWT75q9)gleL;WCIW#Zqt$Z(6GGYF^Y@sTXH1myDgQ8=eRHVL;ubbcV>CwHH7yoK|
z_wU&EetQyU(}e%hS%#<NBO3ebbnBFKr=GdILhruH-Ul4{lla~Cyx?ZdJ$Gx>xp^hw
z=9S8A61S>mv$ct53q4$*+wkLDRj^)DsY2>OyMW@tJ;n*snQu2dv1U8|_2i9L^UwR5
za-E!XaB67#fnb~9C)rEiZkXD%iYt1>omJ10WrW<!R3~rJxbbvtE#K<@qFHY~bH(Xt
zT>iMk`p?h)ncMTkUV2AY=L!Dgon-AC_4oNc-Ba5P<09QoxyVd0-O?~Ed0U#wEDp!Z
zX)cG?U74|bx{b?Mm23vzX6_%hxAv}oF1VgGx}0sc_^bmr1dhagII!u=%u6eG<raJJ
zga&>;w*K>sgR{=%e3a=j&Nn%Jy>@!u`k6P_c5bSw`8z{E?c0oZZ&~^G2J9~Vt@OrW
zqY9s&X85s1yXwA`wMTxhJ27jofV^_&lzF=sP2c_K1MAeY!T!tdHpE1!-xTeLDBd8p
z{K4sGZvtoh7Tz4Nfn!VLjf=_43>2>)&fyMddFXe$gs&#uMJd1b-P=hw#6|zCkqUa5
z_kF?bB^LXN<I?UV{Y|Z$b@zkpN3-Pe=ES9EMBhCPla}st(Qe$qa-hfUVZ-}P34Okd
zyrPFTzGgSst#r6(VgS#7wJX25Vycz}C6-3b6%w=FpJo|z$d0`^dV1XrtH|sd4b{Kq
zo@-z~CXnsjW^jS!{=D*}WUj5OvudwIoDDmjnC#6cIw$qPIkVu7tF;Sto31n*Iehkd
z<fH78gw&quhLgc>Vl}sTddqYi+;jVK;iJ~?yuLR+&gZ*pmV4mb6iLoWXSKh~(bV&r
z*1w?q&LJI>)qjsIx|z17rQ@6B!jpX|LGNZVJ>gl=TWVGC?TpIZb6OTt-fj-qeW0&W
zsP}a4m-UTSNBhs0f95ph*=HlNd4nk1S>uXcQ?8~zZWDI3y3dnMdB*WTe8=G*f!3a@
z-iVyo<@Ni0)q>=Ay=%Uvu2p<tS{C*7XZLEsyw`VkwS3qZw5#RgsV$Q)#h+eP%6+0H
zGwhVO?9?;U-BfdS#4QtEpZtn-<K4>}FE8%O%aY=HYBgJn`Qy?L-%56MzAfJ2rfp{P
z+GSP!$FFX>GPf5*u2TFxar$<T8?Ey`sQhT_jI{APd2Vy^k)(_42j@RMuq5Hyjg5;9
z-y8macQE5puoT;`o0Y!b&I*KnUODB}+anJ?)_3n|h%a6;J?6eb<HG1k4}Yz5xxLU=
zqAt^=X!DlNFL{~jmXqsp`NLP8pYo%y=z(U?rmc*;%&AkCtzNj!a9Mx+DS?Pi@i;pR
z=`A|@w7ae!<B+#2lWlDK&v#g4#byzv+^x)q4qb~dy=+`{rByYmeEVS@p6N?ZI=Ji-
zd$7ewZrRP_YdGHSEd9}AK3}%YJ^y^CtHA!&yl1WbK~@tY1h*%w4+u2&x$?tL{LqGg
z$G@#?J1o6@#BLmqek8|!l}WDiLE@kMPb@3ua-G!gzIZdu^Hsr$NXNYfeui0mDf6%X
zd3M{~@K64{+B=5Z&S?ZJ%l-0n(?^SFj`(efd!K%Idh2Q>M@#Q>y}Omg^528zPCZ;v
zk^3aL;i+2S_sVMr6Kcixo?U;txy1ZX9!Ft2d#sIZMd^n}FAsMAJ>0zg*Apf0ydD2-
z{vPOiZPr+MD|T*iO1twaow;#MkA5gBr(e2Tw!8ab^+Mm*=knffV7Aw5W=e7V8!zj2
z$YN$?X3Vqn6qN%T>vXzBOZM*KaqvEMQ*gS~h8DLCCpKxGKB=VS5j4?mg4FT+$s1pr
zpAt!Z<!{!xO;&UIG0xC^xmNFAUHSdoKK%YE_o@FMZ{D7=+PeIP%++}-g%?Y`2-2~3
z_xg6_^0MFIq3704(|Y^omG=^pY;QS7)mb}2ojUC}FYnpH85Q|zwvM9=@05FL7dR_#
zzO&&hf0jJyk%HkIm)TWQQw|6=JzCT%FM8B@l9Tn3l4t9swLg9;-jetDdB#?^kJ=)u
zcC{}OlN9K_xbA)OH-D9XPaW59+9de$F=K&J=KGrHrdKT`oJ;*SX-hU`mYUC7+tuV=
zD5d|a;@1rONC)nFdo6ih8T)MOH)MXaP4&wgHYGL7e_vi+Hn3>@w)TWZaqF(+&C$)9
zp58k7AY|{fji!1tqxYxU=@`uBi%*iZWo3JIGk8HB!-ol;-`Q5J5(rteypCseG}r96
zj1Q%iKi;ntZg>~Q<jj>+cC}e1AzIns-KxavOX32Vcl7N&eq;6P3(+-s3Mxi3u6}tg
znIXJd!7u+tS;xMuFTc3&@16FFQ;3z<xzgKaahgtb>HMdH3R1>919Nj~7t~c9%b&+)
zYW%<B507Yd_^;r9@#pehUFH0+>hXU2n}6@Wd}lBB=3iz{Tjiq1H-6a7y63w_&Bl68
z<<1{!jEBEHQ~4#gV6!=&y_xaK8Mmh%J2pkS{P`XurI&Z&I?ph^TYG2j?B$DI9cW&9
zc#>@T=Iz?MM0PLoG1=&?vF2ZdUh(0VZ*mf5=vj(g=q}sTy@iE=JJVNwQt$L_-}(51
zPfko`o56mL^?8lC|I_)#{pT;Pe17C$U!cQ|N6B|2-kh;WKPw&>H1D!h<!Wd3LT4pe
z!Ipbd-~0DOKJ2!N(U>$XBKQ$|^sJXXU*z;^Pi|Y{{!&GBL$&OaDc3y0X9(?d$;mro
zyLjTsm=}j<W<{5)9KRoUF8bWGO=SWHex(M9p8V1lD;9OS_JWn*g4HK}Jzc+7J!$<7
zuS?I{rxz|M3_C5vJ)_^9^}_X@@&}qVS2nM-<$3B*)?{`k#I}ohiSH?4wp&MB3ntlB
z9$3R~6t+QTQ-;A8PNNUox!+~^Z+ff6r~Ou?_Ud`wO_^CWcKc?(nZDiY{7%Mm|Bhvv
zz1QnpR`0#kx6f+lvs>CXYitzWPZbDR%V^zmulwoSuFT~ZvzW!!ByV#+7Lng4bDb|U
zqWWzS+uw$|xdl@ss;+;PDdSEH&?vok)gooP@xd+W2fL@AJkPGrchAPs%A+Az?(g;0
z%zGyBZN6(@`s>k}Da%*nm>Y3DjyL=*Gi}oE)mQiqv&}v-uQ@MQ<ow&~_j|G=XL8xK
zGKX25?l93`nHA>H9p5{1Q=O^0PRf%6;Xr5WIqo3^Jb{O!1-q0tOv;_*xZQnfR&eD`
zcbAZJYi}BfKU9uiv3+_P+rf;rSGIZH?sF-wR1sahY)TB*@!c77a!z$maHww9$&~+|
z&?&d?<JP$D_yZPI4OVp?>gUV<-m{x}IJkXVXk63TT={2F%O!UEMQ)h3;cW=3T&Gb#
zPvH4$Ctq4TofdWLm)zD_PjySTR@!A5-;S1?yL9P^;KnJ_9^^fImG$qUThQi>-?M$6
z9<#i3W0m;Tl-%bo%8|Ek>zFeB@KoA0bBe3v+Y`mbvn5tGdcT}+@itPd-)n-w7R}><
zvybfFU96elb2)0g)Axt`$vMf77}_2dCvcppI4WBu&0+2^`~JasyBgnDM<gphTHZc4
z<LrsKH#&b9=DH>;acWO|+G#vz>Jr)ILUX)qvi8qx33I&mDkjY=^zQ6^UhK8gPs(P#
zneuw!Z?*~3GGCXbHf%7v@%M^%nd{g8>;c})EFugH3>*we>$XQ-zT*DXSA>CKo;L%7
zGy?-eZfbFUUQ%ghPKrKkscv#^Vs@%tLFHAO?BK^1+wOnXHhH;r)81Sj+ug=nr|!DR
z&HVCZ$mIjACI0uhBd1T+=wv^B?iXW<=C|$dEvq6X$txPv><lsQ)SavRa!-HB5$mGT
z!cVpDP3By(SX_NrviEa=+@&q<eb)|_cz&<@!e{mVMB%1;OCBc8oGj08_ougK+LW4w
zkwTLt_bv|H6vrrYGIPVLl4qHll=j){e^Oey&;QU>E6-w~BZZULD`y;ubl>B(^3Svs
zy+7ZtIqoar{MUD=Gw1X)S2?#&n)lZnu5fJX={XWGPbTrhgu_Y+4f-e7bgc0H@m#gF
z^T_?C6&mq#{p*%rj<Mr?T&Ywz^@N(M#Mzilhg=V(Jcyp66BF@n)-i`AnI6WRlh)i^
zrSinG`j3zKrrKRxc`I{dSzk6i+rzIjYwJ&AEB@qJKPw+O7k66p6wg{0%(Y+jN2p=s
za?W%Af`!gz+`4d;Stw9G!hEl*7w3V~2mjZ|#_{?6Ilq5rN=2Eem6h#R|F-FGe(H3-
z<X8|Rbga&;_`hDqp~wm9zCY9*!`2;pC-CE^2lJD!l6%Xo-?+|+QITACM6`eY`=7$q
zGRJuS2JX@b$Z=V|P%80*!O|WFCI)en&(}SlY0vp{_wC-Q!^a%rJ{^Coa*laHRu}i<
z^>h8y=S-ex{_B2sWBs4Zf<KiN-?IC^rk#GW>1nX0yQ;U~(Kjk{p2=R_IYmUzC0yZl
zNcPj1@5@eRu|_HFWPhQY)zQG`^mw;{Z_+aFpk-IJ_og?eWPB;+T<*=?a?Zhx%hB~;
zfjGmSww~8q@jpzsHue0O)@J!v^~9l<t_FK~#lA@UPK=R1+;K~F<s7;8gYy;U>ispC
zc53qX6DppIHc57{Sjqbx(l}#oJLzfWO_5`faxN3?xeqG!+W2iz*wtqDcvG;<niZU7
z$J39*X9cq_oYBrbA=I$=-yOS;D_@*{Bj)!Yn<swV%)$?SUyn^z;6Gr)@F!ySpIs+J
zMb5ZNitw|`?k}5rYtj_g4VLn@8=5l>&g#Fk?>1O!Tx)wMMABKNp3yNhq9tZk;LgrV
z3jT+6o(o@IcChu==lruJXCkv}Q|I>CTkZN&YQSXd^2@6=x7#^FZ=>YRC9Opc?fvKX
z$H?@y?dS1tU;OX^*MoIy7gsPpYhUIh!gy{MQ&uf!oqyK*LpLhSD;Sbarq8%!9dTN>
zcjqIW&oy(ue)}$-xKBrI#kt?}56dj`{4RO-n|h$p&3IPHj8k^oStRofRo)2qUNc}a
z=bGES`0;u7{d|8O-Yj_Xzo^8tK{aC9)ym`b2PUp%zA#yG{-LvH7xFRmr)<(xo%}1?
zZo>KdKZ-@t+BsrW{S*Xd>NQt58c$MJiEooUxbBHvkCM?s6~?(c+0U}wZvRpI;e%m>
z(;+eEOG;{Nc0CL;YPfYCOyIw1eCn&@gr5O^4`Y`z&q?|0#P}`ncH`{Aywj<%F?@D>
z`xl!l-L<!stGE2c^X%vAr%xZ`Jekk8-tESxE%8AQiwd~j{AVk0U+mu=TlD4h)t@h~
zUp(+qL6G+m-@bm8+>_xOsyL4rD0<AlV$NiiCucX|x9S=zFD8|$eLj<uHmWebd?z01
z73MHg?|}bhmDAr?9JWRJPSTh&Nuwv<Gt6hY#H2UPNt5^P7j8NHKJNCZzf;&Q7EW9i
zEp~@>er-utcFDFymhGk!-z6HHY^w=WPpn$O++Li!XSJXkll$@|Eu{|L2cMf4Jr20=
zvT5zF4X;ZMG%(vO4?e=NSn*=q0|(wSJD5!Et*jr;3*V3`$`F~$W9jgy@`BR^R>5sC
zmRs#@AMI9G5v%@x<*3+<<2QeH@a$tgx=t&Xg*TTiE3w|DDd4z#Ox(P~RRI=`90&ZC
zC%l?e;;bUVvbcDbQv$mX!z2E~tp{1GPA^R7)Zla3&|=r{Q`vq)po-yx$@)ho{`$Dg
zzGsT;!-GEAxvv@59!{3*P*eQJ_t@ZjtwOFzxub*n>p0yCk-szB&lzz&beLh-#w?n{
zQutaSl;aIs+F5fYAwSJ6H&ef_VPMX%j<Ymu<y`(kQEmd~9|LKv9lw2*X9;M}(w`jp
zOf;J#apm6(-3XV{l38CX)c?+nK4ktcBK5-li5Fg-E#8o5)7vHab?FhudkPaxOl;eI
zD_k2J?BB9IPCk&sv?<)$$z9=#XhzLfnJ+e)k7l+c^V>Z?XWZcL=iX_=W;#QvRYIbm
z@|?IOcZ<xHZOZ(IdFA2~Ll!QvVx9ZeymMj<voq(3DF#kW4FL*=H1^ph&&m{N;?ML7
zd9$;XZ{lySzS%ZR_g3BA(W(2X?)N3rSAx$rUl2Y&S;Om{;oQS5Og^d>2Ae#)rW~Iv
z$L(=(y>c*z)wTzE9Li}2f0S&x=lkc<#i@dOH-1^lxNi20Hxs2D*!Mqa{$4F~>|6cE
z3PWw)<M&G&H_9I0C?hJdPnjp5t&vB^<U#TNrL%d8*t+gn9!@#IwoZXJ@(R;`CXe&t
zrok)=zA+22Nm{ULpO;$~$ZB}*bkH}(Ro(IjWd6($zhF^j(s}SK(~$$uD>RD3|D~iY
z+IDoZ&DOBPYa)DPVtICLET7-H$4~QmRe0ty!_GG^C6{^&h%i47+}Nif{>e+kcG}N4
zfB)w#Ss$(>d#9zZ;Et}z?C-sL!^U0Ygthf0XXCj&Qhj{K3vWLCar@xuJS}g7l$|D9
z&s>_x#&$Ao4+9&E>y+=hYDq6+c^M{L+*kVG@0ZQx0h!w7?!T_y75ZSxCGT;E?NXCy
zUH9Y)e;ZrP#A1s$RiUh%`hpyD|BD8nXmPl|`IFx%MUnd#xxB11qoQke*hxq~6O>-p
z`e=e(OW~JBzwSBK*WIc!^S(E%tr4l1Kf~y_OQJ%?ZLis!j?DMJFbl7^cuet5XT=>m
zqt{IOh9wIRp4lw5tUJp7Uf$L1XFk1EYvJrr*_z2<QM`WZOQv}F`B`Cp+!qCA-aZ!B
z%n@U^&R0}&vV24J(gQ}9wwE6{X!Ccgr|TU#)>78pInfgTH{0smoBj5x;#>LoHg_5u
zU5wqs+1_a_{jZ}Tkja)S#=`MZ>%`kz9(kv?$Q(~mF^}h|aZH}Y<XXF~bl<TxVlkoG
z9T{=YnP)lKo&B+Jk$Fkw+GE#s>~7C{XdU8g$D`76^GE3`IsftrVI><*apz8sc=2+R
z#8Jol+<H}8BlFk1WiU{je&yQb9)}Nn3*wIND!P91!L)!E+Y<%iIq&OLi~1`R-E35s
zxc}yu@QasHn{RnVz4+_yp*^QqxHj^#w4h{EyzA|tx+&e-;o5yBQex}ZHXhw^e%->J
zWAiRP$}(GgX!Em@HuoFWXMP08-n<c(>fQJ}b6ayE_YwR0k9Au_R)3Ls$9t{wIK$hI
z%QsHEu!&J=+v@UL?1|2^7!MTR7J57T{*JdcX4c$#Cq5t8S9v2nJJbKNUF*Zsa@m=)
zM9-w{D~!?j{3^=XcIP$&pQEz(Oy-<?>hYm%nHWowaR9r>dMSn`)2f(lk&<pxUdCEJ
ztO~Yfx|5LGq<7!E!B1Ig$tL@118dur0x`GK1@=syw_{3V;iiL2mOo_iH#X6_Ak>$#
zrn^A(&6SqBB6D7AO)6a6HpAhbl9!sJihT4Z<J5ld9lIiS?)ZJuD9q+uQ4~)cZ(jOk
z-6<aDLzgU-$oEduo)sPJ|7qX-ntAKq{5cnrc}aZYx$P+%cP9tB$DLYd_NC_LJcpz5
zuZ(Uxn5({S+E=scb<Cu${=&ZxmzqpgJCwTYuWCuqgxoKJwq?t>&pqJ3?85h}NHEK&
z!Kr0Q-ACbv2H&1`^Y0E?BUvf@RH|xU$@Z0BD(gFDB`NK4+UIsEEAJui$(71?olbAM
z?d^Ln`eK0Z0;Or^U00qF-{*Me+Z@eje%qydY~|%oO7Itc?7TU3m7d^jPwV;2;xBmu
zYIzp*Wcg-JN|<%T*}cZr=6403e#pt`Cjwn&R6mf7s4_^HH$QV@ng4yKyQ+(>BxrwG
zAr~_9_RI<i|G%8qZca)6vuItbY~-mQ&vw?Oy-3d0mC;CEmOEFAW2)8E#>Ah?wyqXw
zvg*hQT<|MV;Q5aF=`EYL&TsuciBq}veO1*)kz}5LxR0(92SlFoRUH-z=1Sq;v*}>8
zT4da7{=1?4ci1+3kYKFLd$S>Ng8J{7jrYV{UYB-ena9+u-?T<CNp;36fm1@N_7x6A
zJ;(1He}8}V!_O_X`bAz73Qpc})0$*&J+DqdS;>d<Y3Dkz_uZ$G4702gO0#kjxvpl#
zNg3@cSSQWD@?3A@Ck@>dVKZ78CL0{vBUe~0@S*Xs$7ENjHB-{kBaA10pINwKv-g7u
zocWJ8+*vn8H#_Erj%Lv}&W}<)3sR1|GF`iQzR7Z{_nnLnM`q4_JK_72TepPO8LM}k
zZjhe0h%fVf_@7#_WBb{!Nu0R-`*g(okGCEh&r&n)`n{2z_xJh__vb|$Xg{$1;^$m-
z{2Wgu<0`3j>S5(PJAU<BJyYMf=b!Tb8llrE=Rf>RF@3i)Yz50=pXm-Wr#SJn9<AS2
zD*V}K`svS~1$XXzdF%TB7k&4w?@G&sKaP;wal9bc+SJXkMECU8t{L--)O<LC3;u`b
zNW>oSyPSGgze#4fPFMe4?l6@Z`nhI1wtGxY%B?Su+RomxUXb<7ABivLRf8&KK8sXd
z@NEB#itSxBS2yO{+E-sIG?85zc~#0+@X+q3fs)FzR{I^R`zIKirmVMkK``6irxT<1
zhUK5`l$!QGgzKNo^2!jMzDdnX7ya1SZ<6z_E}U<_=%OI)v-ehae6Wn#uXJtGwyW2p
z&U9Sky1mtD9+$M^mM3LSy@#WEm!C7>J(98{vU62w@|5tkO$<@()}e8c7jpys7VqYN
zrXBa>`@U&r40jo>r{7(<HecMy{iyl=O$=-QTr*m`t|7<9vSlTM!^@^EpK?WG6Mpa&
z`5cY2{cwuiIA{8FmYnY7jau!IUu&!G^}n|_d3Ry9w&|LQExNMG>+WYZO_^eNV6A)K
zgOjTk1{@bE+1mHvNbl9=FoBRB)daz<n;O#d3?rYnZgRTvU5@u;wb0csi8)v2G|RMK
zy`Hkouvgsk;+-T`(@T*?jS2TA$^JiPKCSXk^vs1TopybA`D}sP^jQy5E{n+aoxfqa
zU2ftjf41B`vnrBv^5*@OR(*b_$JxN<nD1+^X@!5@F8-feP-$vo-y9KhW~<P);`6np
zfA$}=EU}ZH_d{Gvd;g}=w^x%tz1mdL9m`i;Qu*hk{Jgn5dTbwF=df6;R`c>^3Mo+h
zY3>~ncIfSzgXPy1cG=urb@laaj=o(-0%ipoEaQ~v`MSsK)wkR)f_cri7Ej8S*&<u4
z#;5Y%>3ody!wNA4!&NCO%8Wuc|1tBqs(SrH^_r!gm!~M{E^)tPBk0oj;ezl~PuF#}
zrq{x|&AQ6Dj+8Hvy0tA%I#zm9lBMvO&c;n!xhgmu8*3Auu9;?(zdE(f@3z3N#cg-j
z1a3c-oi2B;%Q5W6949~SN8fAxy02aPHYxpV*fQzMMt9o<YLdPwxE&YaK2*qY@3+{8
zjQ9BuzBB9G==ZfamcPJajrgsEnFn=}sy}9Zn<8lubj$L{<p{>hdE)((m1Y?xcQe08
z{oh}+%is2sNBxO;T3Rd@=T&-5yTn?1!C37t!|n97O6As9cx<bzVno9}8}3|f@lfKd
zR-FllU=icaHN_`a9^8E-zBRIKXVCo(`b>(iww+z}yz5`lG%x8bOIJVb=Czh?+`{Md
z{!dM->G?;TlMcVzzdKc4RVXTdddd6UxrZ44`doS-J&(6w;e+B!{falQdU1qZn=PtR
zzw|?<vQ_DB?T$z7#TyEX!%XL&_6$pipSLIH{=BS{W+uOz&D*xcoi8f$;+xSE?HhWk
z?61`H=>0hvn_p#Yo*gW^i*v76>!JkHnXFG3jhaH<y$;y3S|pd_M%c0jvDF2^hL4(8
ztV`S)BY5Imb8|JTJV)!D-rqCY443awJ1z0~;je@{ZF3Z>D{6(d*)F|RxA~>$&ye3s
z?Y&o@ur$=+e!RcqM#!WFqr@fbZc8sktzvL{u}tmN3!a%DK6Fi=@A$xSYThn6p-*9g
zf4UhOZKr1R{&g-pV|<WdS<d$dmYrN;LQhW5J$4~lvUNkC^m0p9o!M_&&NknF@$CL{
zo#YEn4{~@nZn`TVaQf@akL!7Awq|+du04O`>QkX7Ij@W_XRNq%Fm{s5-rxVHyIhQU
zq<3=B#5{>=mR&z{gZba6@@(*w4()uBx@N~AeWR@Rk9Z}_zSM-WE0`~T_0c3^L&~XL
zUn?(9nZD|m;ST%B>yoBM2eaq4H^y`SX_k2wQNnk9=jq=$5A{|w=NE-nXPusRnCHM7
zu8h{;(j#p*PISKH_|h$RV=_bj&AX!WQk_?cFa_R-?eG4)`eC`#`wX6Yy?@v|6N=_f
zebBqH{&LycIYC~^X|JBFS>;{4N8xbuvkwP5rYdeqHy19oVmy9BZA0$g!^dXNJy-wu
zuHWzH`wxk~-y3>7capEt+Bl!9i$XuYOJhFf*7D}ENA8#1vn0N3%D=j4^Rhb|N~G3p
zTB*x9{RC^}gVz#n2b1r-4e!rduyoURLG_nih3=Lb55zUD%cj2E5PLWMdbVt<>T;Wp
z>8w86WF8;YteLGZAzc(xS)mu6KX23Vo(2z&gtD*B=B2Ma^v_>87ydKwD|=bU*<ZHd
zrN3u+n@3$){r}>GWeNUrkDSijjhVJG_Re)bzPev4-#$5TN5#mCOY2}o^pUe?7F`UU
zXC2dj_WKR{Ir&mbA0=7$HO_805qfUh+GhQ{6JK@9_Qw2Em8kpZ+`KCGYv7l<(36|j
z-+yMht|~PD&919mH#Zjk(Yg>D-eG$!ui0U7)!n%BH|i`ez2f?zH*=Fcb4z`G!_6)m
z#`qmeG|!jqJ|?s4mKei|xgF-N2fc3=Ro@rB{KZdb>xo}(%YEF|%!>;9xlT!H+A6;l
zlNUt!Ctg^4-RlC^j0s-68?@#>UD$bZiJ8;WsV`S;ovC{3t#|YUKGx$$*NSv}s=VuY
zf0FdcSr#9>{U(3CW?cAq(zc55z0><@=d8WvqiLp@+jK|&g7?+4cbS9BRr<^|GPBGQ
zwm$kY?Nf1t*8c0l&lFQW{9m-_&GI<iC0ES~p9pOX`+OvE?zwsf)KN(5fK>--`571_
zJQ*0IaEwBhrX=bWR6dP~F221(wC?-*18V##*^<|e?s{hxeZ8>E_-2Z6Z2E55$i)ji
zZzMTS)Y9K}+2>#NdBzGxkAP)4zSeVJDK2t&aCoQu1BP?npKc$&UN7_ak)=+@&5O~~
zSv$)gZ_IEzXSQu~l6&nf+X~NfhtEzwu{&0E$^EyzC!cmr{I0{t{AiQ)v-a7hJ<6P$
zud}n82kuZi{nU5X62WM_&h7VF0-fF{a0pv}JfvV}apIQJG<(%}v$z89H#1_=IHs&C
zWV*lmoM4SU+pT>iCuF;m4n$f#tV(8fyCz>>Ww&Rs->X|cR}@#+oxk_QcCSL>MYW_4
z`mHl>3Q3gODKp+&z@K<P@1d)o_r-JX^yP#EM1B6-l?2Z(?f6kAeW!(8>QA<H+Ru#7
z4F{gv@Ce=Jj%X2nuz{~q`p(UL&*!;r*W@yKH=+D{S&4QWo8o`QUXN9~|E&3QtL5XQ
z|8^T3)|fw;6!-7%<D;McJn#Noo^Suh<Z*D(rk0NBI?L_PopiFgbA8@qnJII*`&i5O
zH$I#3CG45O`=8r#vR-JOZVIkUcTe&=zWwoxIj-kk_2%C{)|9we;fzqugX63U>WS}o
zEdG`@KTG-j+4~pwjbk=`i;g-m%v<W&QSe0MS1s29>3wenwmv`jy8CqZ=hNNSPnXxv
zo@zAzx$^~{D~8+*I=^PR`So5@O!Hl@CY95Ez+!c9gosUASxuGXQl2Sl74F8Oo6KIj
zvHdAtcdxGEv$jA$)SS#Y^;NZOo26r|-dxhNS?W0F#&x^X4_hzf9Z=qTz<ZjvaoRuM
zc8;xQQr3C~^<C!e_URUDUh_$mhyA)w*h1;cC6AjDXT*1J|53T|ThmhM$_L9%p9zgW
zv#D^axol}h!E=j*^XIZEo7)&3f6~;>mpblxrflN>np3}K7rof-V^@E!cFlyaxfgu$
z466?HNKA^C(9)gCf9PD1^r^LV8%sMr6v(t3n=kz?@<VFk#Kqwm0ZW%HQ14!3z_fXV
zo8aXY#g5l9=S-Mddz_<s!`vhPoemgqx(NFJ5MuiD@PM-A9k<kvhB-}P9(so_{C}fb
zS>a}-_#ohuINKkCNo#Vxu;~}fcya&r#k}Qzbxw9^evXkeJUD^>3-jh9ED83dh8^`k
z{{Fe6WRdR1Rean3F{|F~4GhAH9PR9eY@HKY4C-BctP4D+3i(8v?Tl}Iu=2`@94>o-
z{#vmaD}1|a%Dt*sL|8K?R4A}*P!V9Qw|uYXGG~USiQ6`IM&s)RoZT<i2E5QbDR4?)
zWk$`(#f&AhwQt1pN*-m%-EZ~Qaoux6mLmoHMI7&wYYgA?zx3p9?s?DpvN=QQQsDG&
zY{#~rd%VHc>f)h8C5yRoruQAtYST?Tz9qc<ZSRW(PPzFW{tYdK*%7>38E#)az?boT
ziRv2<Z{02Y+8bi4m{hh*ee2<!+y9N-^u|Gv$_#evD*@F;vJ20p-kAJy!nfsbL(Q%P
zbZ<~N`uxDW3y!j7ciNY%IMlbh<WjzVi||~5V|!OwE4&d1xt7nnT9E0$w^tj~tpltt
z9PDc=F$zswxN>{5>X*!TX70<OI*d$*7Tmv=_uJ~`qVM4=?}~=0vxHRhZrk5H{cFh;
zKKGKKz?%geSGFCyGJ$JGvnTK7`_s;?J15w-SL*kMsFtvf{ke&zW(*AKp+T%U(c9l<
zE#>lB6KpN9b*Wf}sM`8N^R6WN@5(sx*1$0~R&GV=nR_jMS4G-<n=`$A&Mdeqm9~D?
zem?_cpIZrj7gz7_6FGCR#Ob%zT;`6Q&0(B^hU$}N&0-6V5S??y;P=`R6V^h%HYuMA
z7q>KV?%96i&83ek`Ya_cCAOYB$@wdn+b6>0K+}>wOS#6Gt7kk;^u8xJnR{K6<*ZAM
zv(~aLF7)2pZy1|hA<y?>#iH+t@@H3zs##2Od%wX<a%G)~g=A>S77g*$Q~w^<G`#en
zSl}MJ+r_7BVMq1ecx=@UFZJZne&zM`_!Q0e0_E#AZCbHr<yMuQU#6+5-M<wmcBe8>
z;(=Jly2OY4*1u+~J7lr&<8+I}Y`fNk+Qh31)+bK>xidxX+ttjFr`orRSACV9JURC6
z)1=tO{Qpn1rd?Is(0asi`Hu7n7mu9VDCn(K9&t2m`=z&@zwgxSubP=x6E?*^Wzo-n
zX$!@IXMOx6Td-8=$oBn0PAhLs;(Wud^|boG>U{y`m)>9ZYHDR9iFscOGu)&#)qW+%
zv^@_`ZQ+T38!}s5>D!W6&Ub>W&u!;NpT04D)_-%8ySEo*iY$EIQ4|rG^*GSMp+l*I
zQ)ZEw^iC%?CAY_4ZkarLqP4SYUDLVm-OfFm?;p0;dh6lrBUqJuD7*WZ^nLFikHdC-
zDtam;apcr7BmJ4P&-tvKe99`;WHRr=2(45LQSWsj#w>S>+r3h*xLC(~sGe3^%Junb
zbn@IkvTHW>`gXniVNy9Ya&DqpXqJ(bN$9Mu7hL~uDjoE?t1j>SdC#Qp$#rL<dUZIT
zZaRACi;v#i;#sPn^{Wo<UelF(u2uZ1@4ammN!txKiZd^r5-D<gQ@B{AYZc4u><Gnf
zMaAjsSBUS9`_q4cTj=xZ!e_r<h$}2LO{u7Gn$(+r>s91ljVy_ZD$)EIk3SZvFR3s&
zZjxlU(xEtuWtYaBTeEpLH>%H<=lQT{{<4x^vS$)ATf=OcRWn!$x>TL6#N7;x@<@$i
zHaO(){OLz#_RCw3#muPqp-|AeY1@&;JD*A}pOg3M6+3(5Q-ki=vIP>g>+Z-rs1MqH
zb;Z(kj@(a6xePrW-yZuc9KrKR(e=E}l9j#2mTO8n<UgrgQq=ah{4127EUoeIXHE8^
z%8!p+KmKV8R`R-Oq4_;CiA|A(V>;`%Sw|1G$2ab7{~nWMf8b450{52J2D~vRw%$0M
zs^{W){vd1V#fLtD><L9GY({r}Y-3(l@?Ldy6aT6SG4Dhz&SvcDT5-Y3+xT%<7f+>Q
z=#r~<S@x}bFL1%s`J89z_QcNx`F|27IKNnQGv>i@&SsV}4xjdJAM?litXv;Vz0Q!+
zy<^U4kM{GsKNz<y@QkQ>({@heuTp_!<5pLX!xATNecjD{Gu~+Nx><EIqn|3@KeT9S
z%9<UWv$~3#Qg{Csd8`@uRz&@L|4%{xCUyNzDOW3-@@11=Y*d%C(EQ7hzU^R3{G|Px
z&R8aK*j8*SIh^?C!?ofE?N@~DSF7ASvib4j=z{()QtK^c_J0<#3AVPY&#zBAe!Z@u
zcF(rNaw*yFtu-}&*vj6VxNFEElM$7cQp_2g&U<)C<c;RTW}Nm5n^%<2y~h<E5?b_&
ziRlHmkLLHpFOqkz_FZ^<@~b$fW@k>}#79;v3>;Dd@d5KRB?4JKroL4*WR(2><>O?n
zh$zc@k5rqUzEz7|6*y<Xa_RhtE#C}g>}U4e#4-QgZT{~(N`IJ6avZ9^Wn6Ue{r8ZN
z_TzQ3I*Yn~S=M~ClAjl%qw+t)Ew<A8TqLh}K;^5upEBLP9!?8kUVX>kX=`n~_SG(y
zUsjG9D~kN?$4xS<JHTvuH>zy*gM?fAHlEhmleBd1vWwIBCZ;DkwNHOzw#j>P)BTP4
z-fdG$GmO?B_wDg-^Ev7E^@Y3s=V?XrudrU4ckXci^!l9C?Q^BvCoQ$R+E8)v3+Jl8
z8OQt1iq}5Mw6_vrU&ki*JS=3V?AD84SFQN7dduYWnFqd{RAZR(<|NCpYC}d|bzPqa
z-!J&@kp7=|zjA`6*!iHpJ0=OwTV7Ono?#zXtofq7I$?}?FOHb(_#AWonK$E{=QAGP
z-<Ui>FyF%K$gF1?O>gp#zu^#T*`RS?w=RFl)HQ#nX9_s`@hL}y%icAZEgZJIKATVK
zO7VrwKBD|b=4GsYytj4r$+(=*<6hj!dwmLz|H+Y-&ARmU+_II-HzODCP0uL#A%9t8
zi&4aRwGEGpWg;%C)i8Hzf0Dj^a@x`K?1%$KF@L#s{nbCx_qas&Sm*BaPm_La|8Afk
z|Lf7^jt$mg3_&yQtvhu){|IlSj0ES&n!qn>b#DAPaync8fwsw$w1sasddivDMn$f6
z^VMAw+VN!OHLHtydgWWL9e0d6=0C;dG{dV+zDEl9zxVvGG}$&Y)%xqg$zSKaNKx3n
z*YakDd}8onudAF!hur&b&3z)aB=O9<V^+74f7P?R<t#I(+$7ucEsg#0-y4p-Q^gox
zhM$<XW5F-gJ;@P)N1o4jUSnfZe$sy7pRiLQIyaUrz5V7O$1x5~-wP4NH*PBY>V38$
zv^}`sknM{N@%~!<E)Uh&<C5kr4?NOzq$=pbdwca4!k?Lfswdt0*MF^#Ga(|<!QTIN
z^YYBu`l0fd&8|(}esx0j(Tc(iixRF>&+Rgv8JYTS<GD_iH@OoXte9IhO@-5z+i#w$
zp2H>3f9`~;;q6mOJUU%>cFo#X5-{hxaJ}1=l79hD7g)5d`nE=1)I7;#?t4-8%Bsh!
zonP=DxH4bY@8$N|ZNKl?9gwcgl7Ha4&CLE)=({;DzkZkDo~Ez5LhIt6R<CU3K<lWf
zN&A})WD7lOuGtW?m5+PwBgbwgZ<nWYJZvR&ejnUa;JyD3Lt$t8g8sQmr#`>>ud?x)
z_3XW_`Pa{ym9bh*Va@A#ZoKSZxMG;;l$7LGX@Ny52hXOvS8yvHj=J*6@5l?^SHH8Z
z3lol2e$Uutv1iw!KL_{hGP*i#wf5;>7hg>IFpFdA>D9p}m|Ej|B1)df>#m9I{vP_e
z?dHLYYcdR;xBX~l{PAk$hYU%J|A#K^-dGi3@c8k^4Jj7`cWssEZ|DB`<Kw!=-fTWk
zuV}T;?2h+Uc-47~$FZ&C!n}?@D|DAP^}p|0yl9^b%m1q^lde8X^?P!tit$i=E_>h=
z!&|Phi>%hnVAlT_cC7oD+JrTmbc&7cwRWs|wY*RMRmY7*m)A%HH-&sV%d}>bVII?C
z>6JlR9v4%@wRO!Bj5GgiIVYH(!*sGNZ&SoFtGhnZC7*laU+F1%w$FHUe&@&d)2oi|
zwCPId<llYevCrY9i=`h=-f=<iRn;e5@lTA+Z?8AC<=>Z_w(LcKPi;liguvzNHCLsd
z{;ae<W2vU=v81*vc~wiXEeDF7=jl$~I&0y>si~Q59WS>!Ul3D0`N3QH4_E7~Y2Bw)
z3Ja%3maI_CGfht}TBrJuZ~xO0b-jDjG}oz#EuQp9=ksyNCwsG2&-tlSCEfZ`&FppB
zwzqZ{zlE;OD__1lead^MS>?6;_v~-k)k!OwdIcQ$HD&HhrL*hmXR;lAke{(laOSKZ
z-yh#qef&^#+Tv)j2LW&Tgy%gAPqbJr^Lv7XY>id#^*y4yb-x@Cef`+jq%SLO{g$*k
z^*oDDb~7uFtj~J*Z2$A{+q}K||L*^G^qSjup61p2BCj--iiOLE^_*TOInAWB#DJZ>
z;;O*^<wE>HpZCvL`TM-@hkXk7){2WiX}MwaW0R$HrtBYS)J}U_!@?g`tPBi20yvir
zrQ{^$rRx<`9u3dUzilS)?_K=CMH(8Vn<lXR4PY_YFx|wV!BqD`ne+rUCf&I?W|K4~
zgaoZWQGZ|dYtpGnd*5B=P$}#yKmPpQ`SUlA^G~nWt)H$L!Zz)?WJuUEp)ahzmx{d<
zoA&(U%}18MeXm;Unn#~LcRp@!;{0s~?llIAo_@f{6*^txxK2k=<C*!}E^UYrI}j8a
zsi=KehbtvPajQ@(*Vc)er>CZUINP+&rE$7x$d4+m#vQG$woc5yYxZ6V;NXtjb7HGj
z<fJFPxh5){lT+7jNnNyRis+IXI%2YKwUb`kYpYma+%dhPdwm!i>%En0G!>HG-hZtX
zF8lmIl+v|%W`}OvjsLdgu1xqG)7OogBmHNlwtl-VWxM$LA&2wX<)$f~Ykicy9Q$%c
zwQ|pd=41R^S5@7fq%hvy`*)g?Z(m1*A}?Ff_J}2|25qroi*9WRV`IP8F3#O{{G)0|
zxvuuMB=c2F?$f7kadEpfRf9)I=IgI#uWW<9)p1w2`G4s6xcSG|**|*Pb<^1_kDbZ%
zWMX!eGd%y|U7^*om5%I*HU__Qs`aik^lgZqI&;TL<1;-EeiwMR=PzLDEpeI~AoZy`
zET>42x5?k`*1acu>kd9);$Ly5w)~j#@x(`ypBt!eE<B)~Gh=h#*CdvE4`rGPVh+E(
zdDr8e#)7Hqiv$>Xo}6s&UlILBTzyW}fxqo<Rrlu0zK!{_Kib9c<B?;({=J>oCwA$8
zqb}Q@PoLNOnS}dJJzAUi$42kdx`t(*r!<+j{ubr4w0iid*feR0LDKjBFXeM~wjBQM
zI{&rtzR#}~@SZ==lxsU(`pYZFr=g3MBrOjA%TjAK#V0FqyT&>npZSm0dxbSlt}1Qk
zWtrczvhni;_j|^N&2w_qKA5y7f9MyQ8l3&5QmM^!iBV*3*q)6)Kk@R<H1L`Dep%s`
zDs$C79rc>Rg)U+iq7Pf7WB%NfUzG7+?KQ9S+Dm>4CC|}v5&NLsxXUO_RQc-LD<WYD
z$5ZA7v$?8Fzj9V;_Fu85g4cA<A6OE#>&)V`m@Sj%zF+K^EMDtt#s5V8r(ez#gA=!&
zO?sUj&&T`mM$~^FU)k9|)!jTy#Xeg8iV~G<wRhQ*Vsw>TPyTySvvkXfeFdkl9k7}+
z;isHJ^1DRwjqIO3%Vp^3PEq4fS5q{OUTbiCkLKCs6?3hc`QARuc)%fex={4s%bi7w
z3#7hW`x9OBq;J*Z%tH<pA2XS5*%{6k<p`0wGkeX7AdUcqPh!0Vacz8}3U)nAH{5fa
z{<8&7`Frr9)I<Ht+pnmIx?cQxbiw&0rltx(CFL=Khg@TyT;Kfo#tWN<Wk(M;-w5<u
z@J8;1YkK?XJ0Ft@Uw?SKdd_^2*?be_L+>n<K6x%%dU=O8)A|L^qs8l=*x%bPqgi()
zg0b;+P-O76+WkwOc9;FRnjMsp(J!Vpb(42SJ@=={3uX1*hBUrPbQSz?N#L^ZY00xU
z^OrQ5tH&+~4xM(xwrRrOCz^-mfB5$1QO*5%1{0-XH(KS{FF5;P%W;eUDY6wDd%q@@
z`QLueT_X5AqcSLa>%~Pp8OJUpxP~t@wtLCuwt3m%w`|`Mg=fy?Eta!L`lB1Kx4YzF
zIs36{fg1J=>F(OE6Y2yKoX+pFzwDpWJ0a+*$jsLZcO87Sak=&Z*>e|*V!5OXj@^D}
zlg>RaGWPsU_Z&8h!!dq_S;-BDeV)F}>JfL#)5=-(u3D~|<zEAL@xqCj<t_^u7aHD~
z`Fj4PU4|w(As#bCr61j|%m283*F%|@#6S5{O7n`Ht&-#&re6vukx5*3Q|_X*?sw%L
z=epjVu__;z_bd4w?7rCYCCMR|ky+sE@k#9ZJ|}K+@6S0TY~jCmjUxAtv(@i3UubQ)
zKYyi2X7H3n6Y8BmY|?!<UElq7y87dKUfYzIKg_5_HhY^w+C+W^hVAAI3~JcNSyL-Y
zQj78ubK(n%^0QKtL8r8?mCi1{z2oEVI@YXug`0~j=Vi~nm*FP+JV*U`=i`bb^__jI
z6E%f46)xkL#&7@XWBq$QITZ(|O>^cw)0=qW?$M<CyB*3-9{qVSzk0dOQdi&aenwFy
zIVUqrRr61)>|I!G@A`XkY|)9+$Gc+hn><<mcmB7NPkB}4GtY8Qx@bM?a}jIBl7%O;
zj3UEoTpv~3G|P2;JYz%X$<=Ktt_No?N!+tS)MuuNxn*=lL-7yG!26YJ_g^))tbI|p
zrF+vO&9%F)pG`j5l|AXolc2y}lf94I*}k#7u6+_Y`|^Yn`|X1tto||UiLQ;+;_ul9
z{JK=bS**KO&xvnOxwy&Z^7^2CT9JOMcl}?skpKSNeYN$1^)=OXbw%IelrKEedwO(I
zY<bSS+TQ*9{>sd+|Mx|%(KNx$JF3Ad$jy3^x~ubQrIY<%cDsw0gxrg}ojvD%oO~C1
z(*YyTmB*5QELfxQXQxNjD#3dfS+=r2Dr9g|D3NN;U9w%HI$2(RU+a?>KmPo9^MYyL
z`bg#q-^!^bcLYTBXSIlK*~M~7<L88$9saAbe~L~&{V2L7;B~y}`s6=ruSYC2lsfiA
zUc7wGBi36_KRSDPo9qd=wdUjRIn6g7Sw$|ockoVQ`(bIma{_)RW}P?9eYAT?(n+P|
zg|6#gI(r!L-9IJsr0aF-lk#(25u2hf%DlC?&{MRrX!~dXN6*=RS<Kv^y0b^`e`TGF
z{J*N2AB;I^S~CPXE}ctW)w@->LFjZ}#4Vqy2j>!&YQ{I*4t$&|qP_lN*w(16ym`;3
zTs>QPRC?a0J1yd3>lfA^l%KxAl1th)=XKlqC;GyN19qnF{&Z2w<1$05jKdkV7XioH
zy7p_eUQw&Ly+P*hrbWy>{-OFCO#ENX`oj0LoQZeY<Z~PfA5wUdlJ176-MX#AT>01U
z^08jEy#j|91pO8X=?U7$<n&o?&7)G;e9jv7rbni8C$WY{9pZ19`m(C=fxBDBycelo
zmNta0yY{NsZoZFN(R>MI!*?&v_8ne!@2l2M)@yUbRJR*W+@quDyrIdo@Xd9Tc&j^W
z-B!;PI=><DJmWQQUZxLPnnnwk^fu^y+$FH>LKk!HS~Zys)AVAu$j#E~yq<Z^IOKWj
z5#y=P&ptnR#o+#=usVTKBmQ6E3bh~BJZnoYy)sR*<7WM*T_vAh_^NvRSDAL<wepf5
zHtfRHyf2+n)IROe-?Dlh?+neQ6OSs$Y|%e3;Xw0q<yWt2+3(wLa&&Z*<$3!xg}L_(
zSAg63YYSgU*h@>_WjLCf)bXM&d9n6q#)7YB>+W9L()Bd&;rWGDt4z$kE>sattXf?e
zy;LOrw_`?D{sPU3;@5&+-s9_NSlShSuR%)NLA~;y?H8j0?&g@7MNOu9Y77RiS%UQ~
zJY1D$9$LuIGkwpe-6C(QC$vv{bCA0#NZ_xA3SSuayRIp}3MG?T80BmZsI5N!>7ulh
zLD0qO4)5lTf2<{&*RWgHHg5c*dQ4?%-^M@u2{{M5>>CU{kDiqH?RP9<;<H@0__V&g
zM`HX}CQsn?+3pb*@_D6<x6SL?yy-PsC(LiC?Qg%7>nWA7V9MMLv)(MZEI)nDdjTF3
z_v7Nz-PPxR{p=d_w&ltF84>?;C+tqI^qX>ef~tv}!?uhaZa)Kq_v}x6$$QC*i-93<
zqmN14M90_C>+?K=K8l6q=Lt>mzZ<lvqUBZT(f1odT<SJ=-3^S4@w`?owL$st7iC7v
ztwJq_jYBfuNUuL+I8(u3X~v|9v%SPj&);tAie<D@|2}2OqT4E-ou1tWFN7@*6y0z&
zy|Gt;W6qKFPu4!#!`WuJj{k<yLEii3O6J#Zg*@8QWY>M{)yDj#zYl0k<=GUWW0}3U
z;mzOXIUf&A*nO=_dFI)U^7%Tp(eAa^pI6_Xq&iK0(Hmv0{-lW;<@es~|F)N5bGN<6
z-mZ-rxvRO1vSL2;uwCQYkT$(~`U75t(z;kx?f8P^!%{Kp4gNB<6qIjeuNVHpZ(Q`W
zw12{T+jpGq-`}1QJ(K(Ifbf#Vv-jDUrF?M{_kO}25uUbvp26AIjmB>#ZGVs`U>x!I
z>Y?o}EDyaWO|V)U!KoJ^Fte@GqtLRM^{g!Ki%QSiAF`udzVg1AY?djoR*-+z)~WGV
z)ef6(+vIm<h2?g=w_6u2IhHrq_Q%1rzqgi{uc%tE#BX}`)hC<GYgof_)?YIBZYX_P
z{d|7^{kebC&ZPVQ`uoPg&iccff`pu+0EyrCUY^t!IIk)?v&mY^Uhc$nS<9bw$~)uz
z&RG>16-qsMa=LF$&HjmZPTqX@a{A(APoc-|7CzO|7oIo&Q2)f;wk7cCt8^_ZmUZ7E
zey&krs;ro5BD-k!4nEJcfJ+nkx>?vtH?Nr2n)svfZI$_+V`2xZtL_Q^ubdcjPTrIy
z!8S=D#Jxj!Y3gsM(~IrnW>z&Vp00W9bjs0B?q9wwpW8nFzQeNP`yZLt->tltXUL;>
zB)j`|(|z%EY&XAFc5eQ)G4I8xZ&pu*_Sfy&@rH-BkzMeMsa5HBi*0G;Cs}hjc4=&B
zx^d>k&1l`^MRPW_J^2vOve)j_(=|JKUoxLvXuhGU?9TB!Y=;ByvPncLZ*k4}_N}Oc
zrD4ytNi5pB^1TVItf})vt}9+VoG5tB{c4W6)xJ$>69i9H$r%Q?+L|OAtY1>`WunzV
zFZLHk8|4nK|5va=hHu%$gAH>o#T@RMcI%bPMGNnOo;kZ51em@YKhvJ{dz);p_lFQa
zufV`}Ml~y%S3mr=u3+ZRJ*!v$yIj=aC~!G>&XHeH`?}H-g%0PWT-@IJRj4$@ULuQq
zYSPRH9`~L_PyEND_EFaC{jBSPpJuh44f0CA6`gf#t?Zk7W~-Oo?%6ce!u;{4D#bTK
zCnDwhmp|#?E}UwSHN{$;dzM;2;wopgA7Rbyj}7~)>f;l0<9SanaOHNj4{_psUdj74
z#91-JW=g>9Q%2mc-o{M+kXa%;@q2o_$2{IuOJi@#?76I*zxLPJzc)V}`D>BPAtWO9
zjVUxU!cR!b|9r)gXWiEKS-7q(>^tAQXqH*7<syMHGcybMiEdkBw@KFAa@xAqWOi)W
z+ZCR#UhT|iO`R97cEjfilUULp<`b6BwsT!Q)YF)KU+eeU9FbS2F6OLdE1Lc{G${1s
z;;8~I<*e~l-0O~5Dt+t_=RBib7$nJAWyk$1L8s&FSyS^6&!WG2$0d#LpWb#x^OMpo
ziI2x?_LXYy;Lcp#*4iSz;G#gr=i*roFEUrT=k&LJ*PS$L>47hk9xJy@O}F2qz`<Lj
z^z&OVPmf@cM7nCC$RXWYp2GW{v(0yy%0x?8%dq*ecHZ5)m-TPqGtCH>s}c$Kyx%|I
zl(Uh)QOGrOV$r)xA1Zd)NAX1%buce#kzsz6&dB)eT9t9$zYob}x7@Q1JIAGL|GRyE
zef{=c`R``RmXaT*Zt#6v5|X7@IIlJ*f7u}g-Yanmd+vtJSsM}i_zP$A+?lLLH)`9+
z&Ohpu+%9=oLiNEtL-R*Q5gR@4>A2}DTUz)$k(}!B)qi{Nqx&bF!mU2%dL-T0oVxe?
zw56Z#*|4>-OtiVO+p*8k_g4F{eO6x27L@L6-H?3u+A5{R{MkOM%oI+9y_UT8{(hsY
zw#sbJ1p=#+SbhsgUTZjdD&CWG&6AKtSsBZw%Z3Do9#Y8MeeT}hiK%+!yA~UMT5`Sa
zn5tFr)k7>lFXr91K4`#p*o~L@n973VDO;u-Z(L$6vxO((Y4ge%Z5E5v;(l~IsIPx1
z%b%9`WaaEXcK(jxOeF^wK0Ff2yK&8i+kfteu}W>4x4-fUyJ62IW3eAEAD(NJTyR!V
zDVt;NCV@xsuJRWWc1j%Im-R*Gm}L`tpxq(w(tu50c-+3vo3Jze&ZLKm3i~#>u6_K>
zSNq_iGd3Bs_|AGSdML|v{|UR#54q(5uBVJ|d_9vr`{}*&_fA+b+U{B}A+_<=JmHj?
z+rRcc{QG#qt(PZXM4q1T$I|U&Nx03HEeECEZJsHlv#HX2bJjfHP~W>LTUMq0bzSn}
z(We)er=MLapl~oOt;l+s{IrQCi2@?3^|L1aJ-E-sXtI~^wKY2P(pYvd^ovyZt4)1=
z!mmnyRp2`2UaJ%Tn}SSqI-cM9<Fj>F%-wwf&7aJdUHeuN{p-p9@+G-X1pVU$KlYR;
zsdx4zAO5JaQCj%@Tf@?|T;W&l2AhA9<Kz|ykg7VO#&eG~BwTZz-OJ5hr8-y6Uz+35
z6wSO=zb)P&#B^(8)|}=0T6m(Sb@XvOY7##j{CL*n`@Ye#ABrzOxPDvlg>$-ggkxjH
zJ7JLv8wGq)Zne)%y!PUlg?XIzl*GBFb(UR1hh`j@#-|`Mr+(*=pR3CYN^1VSd-CPS
z0qGdwol^g{C6%y5MNf5>DUc{RJd<}8?-^mC^s|g!TfE97vv%D*^UE~GL(ZYW{M?@J
zTNZ>~N_ZwUk9Fem^yI=~5pDO+LH6pG*!m-$<||iTcTX{^JS5NO|GFtW&`2ifnQQbJ
zFWwdj)_+!OL|q=woH2P{hm-t~HMQOu9jDjy><&7(F!wt9`P|;wvYX2}mt52pd;KTD
z>;t#+^HqGijbcnh+7`U4mc23E?62ObV_nk<_j<@(W>uTF=hsi6u=3<9-<Qm+T*Vsb
zd+y9-b4CN}-gm~i7EwnV8)O8^eVIl2CuuXh)#pETuDZs1dw<CV)zw|R6W4!xzE@zf
zt8D*!DIVvaC)nMNn}#(i&fIfJXeR$Hq34snT`q7@-Vm`(e`?O@bw`YRPV9L5bO%dX
zNpX_bD)(LitM7jEa@ywG9xsVMIM42@j`N?UM_KyyK~{zzm&`9|e!p!01Fg60`VzfY
z-)QGK^L!Lrop|2UqU--T{-7N}IcHQI|NMWs^M9SGe5uoco4dScUs~|j^t+k=xqG!u
zwqMKd|K0c4(A^<R<D=TG_I%w}l?y-lZg`iaZn*A8({_pP4SRjVMR?a7oWcM9B%|CB
ziQL_<_dTt-adF3bE49dFk309h&ak=lY1-p%M!wCBp5?VuUW>`JTXXMkHhy$3;~ewp
zo_E)N-$;M$?Qdna$o66JwkbbV3NDw=zmdD2E2OL<&BFS?M?*2UXq{Ew2LtX+dfU;-
zlD1$)eZz&n@BS+~xxBBabN?&V#G>-??~AkX1uN7Xe@{v1`2KscW4&sOTJuGFE5li$
z$7O@(ikkS;uPm)#kN&XjEKA*%GiDxE&-zRE`hIwI@w&vB)g29+_wzYMpIJR2#B`74
z-c0{3Msw;i)GYt{Jhfcxw{^vBart=P*hSVW*YA9~=6q+t8SQn?uk4#Cq<HX4j&1bR
z7Qw2!n=6GK?peI6kmSwbiRd^nA*S~A4zJYB6W{;1`y$%gfmgie33F4%g$IwM&*e{*
z*I%|uUhr`%uldtoe;-~**>k)#Evj@Co6rV>gI^76H>#xnU#iv0TP(Nk-I=pRnp?}u
zzfBWqKKY*kwNo$u-O9j-mw}<%jDbM{d#66F7_@XM`Zef+$^Yy2Gd-?RxVreJ#ar7~
zlJ}2Hw^*yba&G6;Z+SIxY)XoqoUR!hm$uD1`M+*AcLR(3rlq%bzC8Q0*_X-N=G)Kc
zgugAZduo54|7)J9Q>6OMUwGp5mpY<H6|LhwRw#a(-|Fw~e}j8xl=#b<z)k7?{B;SF
zTNCWLRg0%}WKTSKRcK%G(g&w6W`vzk?Oqfa8rIsOG)*sjlZNE^;>b@%Q+Hlc(T>yG
zRFd`k{-Nvx_YRq#y}Uki-U;beUS;QP54iSkS|4<CdC^|4&z6t7e9uTZS${d1%elLG
zX8knJshtfk_rGUZWAMK<J@jtLtn*8L?)X<V^W@Il*<qQ}ZuHeZINc&%9LV;@b*a}*
znJVkE!iCZsF8`U8o>>%gMmuHNCg)|9nq8ra56U^J1q2Oj|FuLLUY;{A)~E0Op3b=c
zQdiE~&);v8Y3kEgzvR2|%x=yeBZFU4v=fils9JbE_qoIJ<}0s`u(_N9zpGH~A-2@}
zVL`6HY^S?Kt*`0idf@RP)N9YtYm;wBtO>Zr$fe^H=<c<KNvLYdDvh&?oxC1|C>rHR
z_g<2m-7>j;uWe`CpOR0HzP`NK->%GNpBtEE7~7!4xx9RF%mmR>swF=HKX1>x<?yno
zFKmV7lOX<&kM``);1)=6$lp+8m}PhIl@#adS*zwT?EGic>+LI(9;5lq@57U?yf6Ab
zz5ciH8UMdGZ{O|}do3NQvgVq;*<{w)D>pRwJ1a<By`t2g$~0NtC{*m7PR5h<`BBDO
zmMw_AU6`zp$2<Gkswa_UCzb`J-Myyad2p%Eq2fzi^I{KO3AbIO`r*Zfhhf`yKl%Jm
zV)4YdKdZUdO4l8~^;XUAeB9j4%E!;u<}cgRQ0afzzFyq!>#<ong2n}Lne(OvKGB|d
zmg!l>A;r%!r5}&w{C}TP)T<G)RjAdT@3rBa^~ZTdd3daX^->lc%9`3>^?Uy7xIZ5+
z<Sg;Z-|Os~d%xLCvMZ5|XLHK8z0PWR!J%5-OYT>xXwOrh+EjZrW!qBcF25T>4~v&e
zznSen^~|bGanmkeQD?hb@Z!N*|3`Tj_k8OViRUU&<6D?3r4XmT+2sF|ORuK!W%4OU
zDAl|xSzp0;EsgU_bUTag1)&GU>#dtNROl`WG7BjU?ys2oF~Viltg}*gGq#u61-{Jx
z%JyOB?bxo=yS(Rpzl&d2S@R{p=9r#HRpJJY<Lb?}jr|Q~*Z*f4A5^&aDdOwrN%cYu
z{4?e@HMM-3G$%4FAo)O@?c6^l|LT~|I#l-tUh?qe<>Pf!4SizwDdNWllegWn*E{W5
z85yG#FSUG)EA*ScO;RgT^gyEQmXgUQ)?apd_9EB0!&Hz}@zME;J2Q4!SLClS{JrgJ
zu<ygqy9BQpmGxXO|5VX;By-JOcV$J(zZ}07UAMXX(e~6)UzUCBQ<~<~9%$f*eeql7
z&*M~UkJ7`>LUj|}4@6C2TOynHz}TnhzL@lloPBPaKE7C|$mVjDLA?H1?YsQX+`Byk
zD=)-m-2cb?>zlxj>mMpYPxLFXS*97Oxl}FL{b-fL=iVX?yT{hk`DQPEYW@0tQEHUu
zDa$i*!X8)7D<u7%r?!2^m*x+@+t=;cpS5J}ryr9~2nXGqbj0_aNbT(1>X$Tg)8Y@m
zID2B%w)iB*T})Rkn9e06-B_=4tyft?wVRQ5!CT>1mmcUBh;kb79y9*3^>x*TgP{|a
zTV6W1{_&%N^er3P=BIAV%YH0;>~Vx1<2DAv)kS+X?apr59puyU`NBJa6t(bGU-!<G
z``^;0SZ6#}LEvnb&fU4UJGQsP<Y<MQ%wy?JWwo%FI5%?2t5+?@?%epWr|s*PXDbXJ
zC?EeVQLMD|%96K#7WntcEeKOR-g|ek2bb)XB~htO3~>icZXF9_Svvj6akYnq`}Qfx
zHh(|-?%M^swcMf8{ny{hE7^1QT&%$6v)68av0FPyCgL!2dkVYSmb0(w>J<Lmdoq*P
z`d#tbxqof;`OAJ<9u|^Zo>i|Mc{QR^+R^feF7MX2@!|Hd?}PP%JeIGrajQG{hs((P
z=(SBvnJhDP=Vllb^CT%u*db=wC2F52a3cTvW)X%dQOZ@TkGtisQn9Z4+*bMjTZTi*
zPLB)qRrjmTT3Fl<DzMo<(Pzbs^%p)K<Bt1q<JplPm%rWH`e%;utYf#b;`qArFBAtf
zUHU9_<JS$L%;=6%NfG8K#`S!R*IF+mZM!#Va!O7aN86+NL-IEqzHPm8aBgD6=>rdM
z=oJ}s=f0el`L9`HdhA)f-G}z<+`m$H!>#&!|0%q=yH%~iGG=<EmwSBJt=oF+*2UQW
zdD#c2+U=YBAi^|eZ}aC^ou2!qQrAwNs#xXn{K_;Vi3NX|c3)43^6zzIeW3QlSm=?b
zkNd9%TTeZukMA5#aTK4uSj%BKG41KWQ2sZUGXHo6o=EBry<{oE@OP(9!)5PpJ0stl
z`Wqj47{}oq`)Sj>4KoGLe?9EtvwG)y#*X+<Rkvsf=0gUPjjO!sg@2Uq(rbOiCo16o
z<-GvwgZ_v9E%z-p>%93WH!;ym=we3Q|BeJfy(77k&M}_O&o?gFwOMgb!u@a_oy<79
zrlkV?|MPWN%d3|!l!%oGSk*qW>uTCu#aUNXDzx_cFp6%QDjoPkPviK!-DNf3-OePx
zkbiJ$zZ^%>rWd7hIlU9koZHvuB>!f~#UDpESMRrw*w)xA^_FkdbM1MWhF|V(j@`H0
z`zOEC6V;iDy|=qXo{Ky0dhfS+DN}jhmDsI!A4OfaG<~~h>bC>d8o&9TZ{E!`>ssUV
z>Li;JowtlKuGa41i?p5_yKvj>T(ib9?|-wUr?7w6o48Z%^~cD+Gh)_#->qBzl|B0N
zWW6<Vt+Pv1{<J?^dh_+RIWC{xP85ynv7OO>cd?dn*6$fz2c$~=Y@C@pZJ+MuiFb^4
zA7<Glc-7~}>$&NrZ5!BC=Ix%UrI#9e=27*wGmh$Yj7BrVBP*YTKF#@`fA2==6`M+)
zId4o;rQ+squdc4XkuSJt9aAKO%97U(9BodA-3}k$67oh$QEr+^VTAe{H<hm$U1|KY
ze=ol**_&3L`*B57rv&$|Ne#O)vtC?k?=6wwu$W+RiRH$eWn3@6xouQkVJUP~+~D%o
zr>dVH{tj(a?^KOzT@qop?AVUpX9_|e^b<~J&T?2jlV9?lfrI#a6LZ^l3$BFsyP9hx
zPhT8+*7VfPd)%8IpYV9O>0)=Am#86=@|8dL&aT_Jw)I`xo>|*YeBGLRH}*a=f8X_;
zn)gZ=SDmk7cSyIo{N1&|tZ>GryWVXUQy9Li_;6f`&wGi%OK+bCU2bZrj4JKZk10q!
zU82i(T-D7a;=KFJXZsRU64r0=kz{5SQhzAQaK37{QOw)-%O{@u5cBM?Z20qnea@$s
zch$^W_Ugl3&A7|vJ}#m!xPM2jdwd|SK+d;oRd~L^jD;7qPTcS*oA#`)azXVD?ffMz
z&g)$AOpa&$oLDQdSbpZ$owGkoI{d6O)9e2?LDLUD)7Ga<Rllt^+xXLjH=7NQ>GxIz
z770}CjZ~Pn@O-7GU*7M`6Pk-k&s+G+2*`}GU2S|?_#2<b=SZt|g(G=lFFIblW1TLk
zUtxDVI-S){Jh=44#LttMzjvBW*sS{EQ^mfrW6VBbj}!xy6|C)+7M)o>`#!(g@y~}1
zcy4Uf2zf2_y>spP%g1@|>8roj^E-cj&qsD2C;Kbf*X|k|`{De!c}2#_m9kGglm2$i
zc&UGjE9VhcUY3Q{^`$8yGyfNT*PZ43CcB_zr$2*Mhbil;4!&vaO{IJ1ebexj$vzcZ
zoxAPL*6WF<;$N4svstiqm`>Udy6N%8e@hyf${ceo9xQ0olgN0y-mmac=!Np#VmdF9
zyqh@p7CjNmaB$+5a(GZ=koM`)ug((9Lw=l7dTZK5?}<L-*>c>E-|%JDi7&gZp5C|p
zdClhV<`${E4DHP>)g6{zA6n);E;}e2z2>FXCe9sF4>VjBSn<V59o{FE+)&=b(S7l9
zP3TmXoJ~IWG7>gFSeC={jG_AJ0S!@x*<OzptnvDja`O6#&I6MEo+edi)7GspXtUuq
zi+CVh{9H!);Hz%s>Um8v+xsP6yxNh(e%M0fT#4QzkCVDnz7?K0xZ<Mt5pM<G;<sfb
zJQt&-?(9GPUqbw?nqlsQ2Jej5>$}U$zT9wL+Ze~ra`*Dv1eG=G7*kmVKB<?zeEWX#
zqK3+a{Z7$G_n-Gae{bJ>o8`wpe;2NL7jaK@!=BqMzh7^8X}SFMiDz6Adv2?^E$pu{
zGxcaYR#;-0kt%I>K<LH02Um7vwoN+!+t?vFpDp-%>6KMX+`E+eyQkRPnAl#|o}_*B
zlYU=!S;+~Osq@%Be@ysnq_^HIt-<%Aw&?EKa(}rOlk6Wfyjys)=Jgea=Y3yKZR?Ya
zp8x)DpUVE9-&^X~x?XSPwAFt$o6E8M;pqdCOq$QbO1JkhedJBuet71M0M@+bz0t)T
zISIP|@)q6S@v53zYvYW@Qx(?Pua?=LoAI_Mm0L}sevP;2Y!=3v-O8`eU3J+0`N69E
z%g^kKYZ5N-RJoT_PF|kM_3^p+!}{dXUl#G~Z)WGuN><BISi9l>#D&|l`k%espLyZ?
z+4jd5(Ko4htgqMp6wJUNK97+B$5A=ydHK1ZqjKKX-Y&ZBvFX9?{Y=X9H!CdnytV1>
z-MsmWEx$!<ioW<MRd;8))fFBVjwU5Hm4l29C#72LGU}7}=NP}9ReG>>(wmp<sV%xf
zD^Bf7O?|poj_tVo_y2Y_rzVwzE<1cUbJwa(k<-NVo5EjP%v^q0eerRAIkxqmzlKhn
zdv^7MlaKGdZ~t(g|KLd*-g`?^_i-(I>ALI0b?+52A(?wjwEo=x&s;jsrq#-S9&7t*
zt=I#nlje#SPJOzXo&S)5&CK-F4QH0mc9mMw{YPo`vQz_q@z+~8(q@M?v7SztCVudC
z=sq9$y|$;+94G2M(wb{Gf%TDVSS;&PwVCXNl5?I;u3zG5dL}G%;`G;3L?v0$SxYK{
zRT%8!e497Fs<AjL{Nhk^<V5{ujaj*?d?&gEPS9Q0EjlIYsp#v>pAQ-<rX9HP<og=0
zZmsj;OKT47a+ZJcDthP411}cjeqG|VKV-V=p0NGvuibpb^Sl02!}kmo>r2%F2cAFh
zX60txTX{S!TVT)GuE{$rytRM)^6Yv0++^Oecga5+!fj*DeqwAsSzqs!_+WMX<D+Z~
z=EbbN>}odAw66F1%pd<2=>J-3Wp*>Ad*xq&WwyH4T)F<=UO%nFh~ZA<z7yx47_$ZM
ztJtf#x<>Q2Q@!lEWiO{Q`gqOCSygf9nR4t>)<;JJ!<=3ozRLRG=$FvKZH{krQkgH8
z%yoJiI*C!OqwL$$&8ry?UuFvMvj2QlX6^a&lWI&)pHu1Sf1bYnCNr0hZAw6T;Uuqw
zlv!>YzGbpl>sh*sOsKW`QSqVfzs0Yo`OF_}tBNa14#>;w`9JlqZB2d6r&ljDZrT4y
z`E%_3`_G|Wt2I~4@2USAUGnGQ=jGR#JhpY6+R}By<Y;JI#V)hX(;;OUQ|r%o&-hcs
z5MRIZ$^Cmv4ByTA{&MLrzQ_8PTJkTrHCVjKEYVXi?BFqN^jNdXqWS8PcaIlKIc!kk
z6q>w8!*|B(Jv{=e)~E}fzZ3Yr;gqBH`sbDx4lt@`u*Xj-Im>yhooQQ;m95*A-!l%+
za!a*oF8Y5W@lnP6|2t2v7TN!L@5J?%Cxvut6YT3fMTHn8Ewmpk)hn1N#u~7<|IbdH
zFg4e0>rM$SunOXe+|}?`R+qus%ur})WPy>@&$o{qzx;aMe0{&nzWU!yygdgWu&8>e
z-VD%{Q+(JZUbEW&`{pH83$j<*p7cCyC~#oP9@Fj5<3F<B@89AxN&osyrK{baqHGql
zo(MXX)ZS9`!#n6r;^TcC-HiW_UF^8FS^O_=$wTMD7*PY=EpzrNd1OpvI3b#tI@vX5
zS_7MEz`RXe;@$IR?X{a<@@I}?@kEKbkVAcO$DVd4Fr_!?O?rCK-aNDLD8Fq*t&vkx
zX;j$Ji0P}&Ej}w%mMWF%khX}0KZScz1wZ?<%Bky>e+WMQ^TS(rb842jBD1h|$(h|b
zJ-&`f-txZd795S-6B!cbJjcpya}QtFxt}x4en`uF{Ff$XnDjmJ?iroSnPR`=J0I_T
z_VlXIx3iThude$v*cjxSvwCjnny$I+{Px;C2EQHn1+Jc+eDS&H6x*pUtPWX9Z;`D{
z<~9A>l#yM^x~*2wSSz$SVUl#0+U%<(iOIglCf@mPGAqsXuR`iV%Vbv_jzzwV4&~iz
zT5OIr?%l~O7d3g!`IJpkl|qckJ9}3DI{0B{Z-czudiRstcFsGvE!xFle%J=?oGOLo
zC&LYcZ7Ny5<WH+zskzNdY_{g?(1fzjhuULvF1fYuc~Td4;9;wQj6$BThFitijhiog
zwGf(HdQey=qHx*feFnF8O^-BPFL~pmjoyThvqcISbEa2x+^JTQo7DGMO*he#@#R9n
zzdKqMOZa<z-sl^ea(K#?lVYOWT^-SVyswN;ir))evLb%&`{$kVuTLu(ZtLA>bMDoo
zWz!8mRi>YAwbc3cqx<s|S+9xZN?FTzR~-;O7&51g!AOQBai>jk{bS#$kMD~bEMEBT
z%AP1asWP9LM^;a}uJB~4Z?)d<PpoRY7asXkW0hIKyIjw}Z))khnGxxF-w!-6c;RLl
z{Zt|1)7-erb6lfr|2lqLAUsv<lm6`x)w2E1Ow6t?VhLRE?#?vTMyaM3GC!9ei&xE@
z@kp;^wdh{y^C4PYxsDnyrp@s)dz$U=adS!NW<%Xy0p_J=(_Pe_Iy))<Su!E#@Gd1L
z#%Uk9_;i1B<XPHvUTgMQ{;J@3@jl_@4D1FWR_pZ}jwnYi`Ixm?O@!@%Ru@zK&jjy3
zT5ck@{v6r8L*x0!MV)gy#HW7@jl3@!rFCfI%**}F+qo}muG4+>bQW(|fwasn?doZq
zciX>KuqK@sDO>$@2XFA{&pEOm-#$!bzWuFdd*GF@DIK?SJjHt!+&Z&o$>|k)UTw?V
zZDc+7*|nD+tqxahW%3nWoNz6G<;RM)?R>>qJjX)QXR_#3mDg>!rPFv!cX}mn=kDKO
z--|YxMkH_cN;AAvdhv7egxlho=VeZO6Pd;Dx79mRW@(y{y!Y45+s~=YkCW8D)0cno
zX|&;7&yb}CrXNntI5z8Hey~L&-(tV5js;QTKezn*%9FnPVX609t#e{u*Xz$}j5lH4
zpTTyHbK7ns7x8PZ73m-R667B)Vy$juaTdKbO(`qkH5cQl=JtbiX0sQr>(&1IY~{rm
z1&hiXOF!tjEoN0pK6A$SQHfTw7QbJY?=OX4ub&@Y{P)HB{jR^+^W$pmtST37-Sp>9
z)4WycF`ZJk+GS;qM3g8Te6N^cB4^XV_pk2L%g`^cE=OOn556(w;0Ke1{QD-{)|Fu`
z%s*K2k72=i?-R%TkN+{>cRnqAiShfoPQH8fb>%X9|9yCOxBdHt#mQS&tYW?~JDANO
z`<nYp*L^!Ys!w#hZB@(Vas50kZl3Ms#ayyQ9FwmlKZ(+M`@44eBu9z8q6~@&cc!#n
zKJ|Cr{Ef=$tg$VH_7eY&-eZnAzjO2E&)V#>*wRnP@(Z7nyIj^BF(Y<?$?>nAHb+ex
ze)3FjSa48<Rj_0h+w9T_=bM)AC|Mz!xNKkZ;^uPp_x@}L_1X9H&e;0ydbs<1ekVT7
z*^JIfGoEi@+Lo|P$4v80<gSKGE7qR%+7_@{<*D$&!q%<F>K?Nx3UvC3Gw3vYU#{Q0
zckhFhdJnT_n8z)<7nGz|!hf@3&)y?Nb9Z&RPHNPfdg$PxzSepBZDyXF6?S&hlHZ#R
zVwaqGR6Vz5d$sV1uRW1_KQvl@i!Sp!TW$YC_)G;ufQ|9giCfQHVJUt8Z)-%K^u6L;
zlN{ovE;4ygReLRb#-@azC(j$cT=wnyBFw3Of-Qh?e`M*UCdH4xbH4V^*vRl%Vcrwz
zCCB*XoTgTWu01W@FE=;!YK^hu?~{u~r^y=KI<?>a)TyG$)B4NG=i4iXs?FY9pW5we
zW99t$hlc(+xv8K37&Sd#{6y#X{G46iANQZ1_wU1>#%n(g35u<~R5HtN=_2;>r}5vK
z)EB=mci+9?EQ@rn!cN&0>5=nQ*BAZxcb0v{nzyI+PAFA*V?QCqqGM6c)X=~y+Lw>!
zIJ`Zq-!$Pyjgwn(!M(4Srp_*n`tnPewfV}s*Fg*wM`k=J$(?hj<z;J})a>9Zj-i*d
zOfAD}#iF0<+s=8rdB-}&PR97vtd;+M`1l7r^yQJ>xXf*`D%bhFg}%1)b64$LDHR;L
z+^g;Bsd(nO0b%0Dc(et7C6rDS{mJ$H_xi$#53fx7H#6qowS68xU9?zNl(JN5H?f$X
zU;ebCd`Ee%z`O$9L&Yk`MD{%}eX+SQGDdIVr?82obHu}r8Y{9bxE6bD;rXmvf-91?
zE6GJqU3ckd)U+e-%fwd|m#m!FyE*=zlHg@aKTr3w$IDbxjFk?it<d_iFf_5UPrXNK
z%8!@&B2#_pww&r({!WJbDD%w3k4y3_1OAj>W0rr#Wj-Z}>AGBHKw!Z6O-Vvg9%nw!
z$zv*$vhkMndVDeUQpBGPLJqc!`)%uV9IiaH{ngyMh<$NL{_4i!3uZOzobRd65Iok!
zo;dMe@nq4LBJ(z^t-Wmi;9x+?bGOYkn`eEqQLlcR@Vz8;PPpatG-18@ZSo~vQk;up
z^=szliv=I6^?CTlQ;RL!EBwIC0}uDOJeRd_n%~>Bq0;Nn{ZG6F`@<Q%GVUy9^057!
zG?O)a!*0uxh?O;rPDeG~<QqQ{_`RT7;m6EfTr!{Iw5lR=!UFknL@oDSKQJ?V;<x#e
zmz^=2Vsg>PVD>7-i+0wVA1S3CaQk|rKjHV?z_p#XHwv7H$#|BavEsp%4SFn>=kz`>
z(m!{RRq*_z)eOCp4!&RACdxli*~iSaQD=FK+JwptO9Kn$EbB>~^R(Nwu2W-6<l#8K
z$EgP__K7DRUJ!ZRQDe@xLu(}uZOAkeWZtpn%-ZYKIoVuBUpJ+E6RLZYX(O0%=)|Tu
ze*AJbesiTbc#18rG2=bOr@+#xVVOPmv7Ct5Vr{iDpTyio_VuwX7qYVssjiqYX~~nb
zo2LHHKgVLfc5d1EDZ<<4CYnFLbu;|vR{Pq2$!}Zkr)^5VnI*MwbLRQ&f7uxKRULe)
z6ww%vHOpx)UxZTBF^^BWeXJ6P6;pW{jW(zE{EK$|7$dMdbwy;S-%-u>;OIsziCYZP
z%Z)8J*|?fE2gK*i5Or3R+fZb;{n5ibU)Pi0%GXvpi}tLDY)YM|T@od!wwU{d^{xXe
zJg#?39C=XCp|+u8j_9OMo0+4PeN?v;ubJ7%qJFX0D)pP(3rEAOqz{{ReRlDDD(o!N
zt8hHOzSdiV)ArtikelwJwQZBuv+eOOySc31bW)Ez%NN7Ldu8q9YX1xClq-8UpUZ6h
ze%P3|fBg^dr}IzOXPv(@uly_1o2&gCu7RRa3mz88v$XLVO_?`CQHRl8W`#qHs-^jZ
zAG3tl-fd-D#%iw0CBIx@`@vgASG_Yjmsupga1!wkxO4XOMXPnsl)qejYdJ^jG2_mE
zTdsdE*z{&E!;ROkds)_S%U@q9zyG+;-sU}yt3C2I$;GNvEStG}>V<gGdBt@nt=QR2
zRc@vz91WIOYMYv3#y-V_Em2mbB>3394Lj!?;S{*0Is16X+W3%5tZ(K%VqjY$oGgDv
zaI;*x@trKu_bZKsj~>;CQ*OTYxYR`E3aekB_=;<1muV-v-#!s;5WO|S^Us=!*ut9!
zSDrq!eeL2}uH6DZq|X~|OWe2Iygb75YHy+J4ZZH0dlr;%S7lb*mHT29WS(<K>S@?p
zy({gjKPacSpV_R)ZseliTzSePFx;p@L~e2}qe5WL=bKkcHuQ59)M&6K&NrIBw`k&)
zoxA7Vi#qVoReR?Fr!)NNeD}pF3+uNi$@~+3$fy17KhHmL*<V~sniHb#CdM~sm-7Am
zdLwMT_+7U9M;>u%IA8TG&P&*_R+}SLEb`D<!|!{m_WaG?l%S@4bx%}Ug3Ifmo3~y>
zuMuwAaat+y@9*e2>$mAR{VKSzPi_@+gIL@Qp?02|lg_MK&7Ll^-=sQUTsM)Go$K1V
z$ZH=<97GFcR8MFhKIv$$KCyCMdaoU8%iH>2i#6ST{NefFe1uzWO3>?sgsIE8*0bGQ
zz5VW=@7u+$R6KB9Es=7bUG(c3j_JD(TuRg~pX$DK!_x=h>YcAsHpeZw6R*5vU*y9b
zp608T7+Ig`>`q&_*|T$A$LHm|UJ1))h91>TEfHV)j(PJYW5d{1*}cJ~<&&OX`B--G
zmVqEkv(VE0nHi6sKK$K3-#^Z4d6Jnbm+Xf8PahOL9+ms6r}pN$DHOM+95FS%nYH&}
z+_!+qoZnX6IqdNBK|sK+_Sv0}4YE$2HLc58yDnQzLM>xyw#aNA|C-sRsyVt-How?@
ze$ip}1xJ>b*goptH6!oH4Ug3Rghyr##^>dOAI|4lbg|A+uzEx9U&p#>8M_aj;j%7K
zE1#k*s<kG&Z&{qZ$BgTz->)|Kv3Ht4%Vd)qQ-aRMB~Sa1ulex#C8q!Tw{LU$b9DV?
z{YPtj)^@zPHz}ZN{Wd9nW>1-B{nM@oWIlH`Dv7b}PGpUlG2=^v-)h!1bqCclg`C$u
zFyh_d{KBQ>R@ye5HBa|!NRa%=-gI7dm-xbkVw=Mf>=`xkj1r^-X1p=pRdZ}At5;~s
z<BS_?X0dI3f3v-GM=|G$hRGp07X-JSS$5}%>av>~zZXZOu3M(oTIt)Za71E<R{ssA
z77ZR{k%X?#N7;^@{E^DPAbbmhROrSqsp$sYp%XSdsNXJiu1V^bhIZuQsr8T3nq0~Q
z4i=<Gx+QAVif=hvVe&Yta<`%V(baF=mYeBJit1<FoBK1TUwB@AdVBfp;@od#KUY3}
zbMx5ENpfYmn+}_8UvuWp!VTJgq9@$BAMRnj%k0A3V-X=o%c4Id=N*1lD0s~&RLaJ5
z!t#F(a&OtbXU<{B+ElF<eL(Vb&tvPvFKoxOUQXP(c+uWRXM_@O-#hwz%7>{o(*+HV
zS<Jm7%A)!<v@Y^+?z}3su3*sxJq`*>Bc1*3ZCO9{A<Ly1UtT7J9-8&?+RE0L_f8UG
zyGoZ|nr8R4?89zb%fCw+!*z1}!a`>IM1C}!#43={w$q^?M^#7W%?Ir}56cwFTy}0-
z`)twu<=h{o9&=s%U9;<<)%q!Xd(%DzE_nTNkHM<Hp>aANz4>Q9{LI^(an2%F&ih4p
zn4|D)hlYcmw!H1mac$fScm27M(6yvNaml|z-3=)kSD4Cr4O!c#goz0#RoZ$;+Ip}`
zeTrHnbon9Q&Lz$F<LiFZD5>bIo|YGRv|ixCE#v6vB`tNyCa>07w$ubOHZp2#{xFLp
z!CX1?-jb<@e&tQ=vsoJZh+!|s<Oyqc99B@VTo4*_)T;4Z#=Plr%NB1t-06KK+bVl%
zN_*XmHP_?UXEW?Be*R|Dzr}~odliVXTLrEBlI~H}uxF7pXYs0NU4!U5QWq^#TRxfw
z3-15-&N}4&r-DcO%A-AB@65J6GB>C>{%fskrhmf|-w*o?O>0g)+GH}RxaHVm-O#Ba
zS0?VBQSy9}fbZ_-Uu#!CoEpbs&2q=DU|wA8v!fy2D~+UBJbyg3iCy{0y63x|S&!j`
z$=N+EIjPwl$K1AQZLF#Lw=;ikIcKx~f0OpibVIcbEaCT9IezQfW-g!k&rh>Nbm0n%
zSSFi<m!dxE?QQ2b_Lj6p{nec7W3f2(P`lgq(v7#RG>`9VJ#luEgOR47?a$S`JU_K8
zPEVYrARH98Rw!-Z@*1N}N@u>FZ&>QimfZG#_D_?8)l7dMmb^|g;gvq{^z~}Nf7hGu
z|9xOxwrZtaEU%!H^@VTzc1f%3sup=VFdRE|>PGQ7v0y2)8<zj29k<lvXaC*u^~9Oy
z%V*u*7IJENP2Za3Wj~(JbE#F=yRu4SS-t<C(l{--s`Ck-eZ7uLFdzK!-jnfw%GnzB
zx0WJzqIoiJ-CH?5ug~^5L;c|bZHu*y5l7RjmnUwFT<GI6`>pi}L!+I(pH5r!n5=AG
z`<aoS=f-U&j$~ca$A?lgC;zx|^J$7c+rgE8tiB0k<#BxRXW6v%>mKKQ>%0=y2fyp;
z&rSNbcAnS78{A7X7!P!?i4|WKnYwavz*?`}-W|;GackE*RYyH9Ie(F5<+F2}XHKa6
z;rs2One>HcE1#K(-LEpv+c@!z@cKmYiSoVC%}WKo<@Y>dQjP1KQRHeGyY}d_M@_e8
z{PnvME6Q9qc~0DN@jFJosTNrkA19j4-SEQV?{l`grRDxCC!X~k&n-4ys6V&I>zTog
zTc48KI`$j1+D!SFwWhGIZ2Ah3x8W{+GJe@TDg4d-u2#%!p4#d=HmS1zQ~DsZ&q{OF
zo0o=KtSxCyE1lj2CgledWCqk`aqFz}Igq{V!i+<PXZ|f?6-t^rQ*7rX#|bfh-~a4N
zzsqHszqE&ux2i+>{pVM_yZU7l3@$1Bm?3t0jZ0gv?Thlnq|!Me<u;z#UzRIR?u}Dd
z-Zyz>&$s1!A8Zs|e0awesn9n%X&bG4<RfSLDCylcJ#+fyyC2VvzF(bfmus#zIo)N6
z&hL4FufE(}e7#5Z|B3pIl`kdd%0KuuIeBx3z9f52T7{60W&GJd&PQ=qx$EOw|6Ue9
ze0Sr)3-{ZnZkuemLz8prBB^y>w?FWFR^Tm>{B+KyUX#quIDe;i)1#g2UU5cjOHW}J
z-h5zj?%6Yoq`37`<}zJTuKf~zfdAQn(_wPrVd-ZX&8Ioc_>)|`Z2!fy-uZoPg+FJC
zWY)afvoY5uXWgwHYrAZ|y0j!yUe3vNJMJ{dye-w2-?4h$_nqfV#J$g~n7ZQ1>-#^X
zkA7-qNZgRMsN!$a!G_9*d;7F~+NYUM`*eO|#*}6OrQOmM-uAZ_^VaRMus(7AnjimH
z=P#?D$g#DrK2Y7T*=AvL)cYnI-SEVtC)cuP?Rg})Dd+CZg<Gt+OG-`TJvNIJhiEmQ
zw*12IlW~r13^V_g(>qeMYS*!>nGwXXb@~}IDHe4Gr6a#pKCRqzEqw(;XSnLE&yy;i
zGFtTq`ijgDlJMWxa$MLjd)h%Oy%|l+v(s$Y-Gr(WK0UZ_Df#ZVwG7Sew*-G|XGybX
zj+?M0`>W5-rYRjOisCCCgsnKUIw1HkU*@uP2L%^i<@eo~_g;q2tuAfDa-K^zhu(xv
za!xEeRwkFWdPniEo04yNnr_vqN+?a<_>uqcX{M{+vX-sAV|{(m&)Kp~4c6CZ8McXc
z%ssVuzveQV6z#rShm1OOmsK!WgcVI^U#K83;{><q&5h0nN}sIE%6%rija&PA@=C^K
zYxTYz-InjpK6i2PvePfh-$=D&o@aRbLu<A9I>Vb@7Y=+1G~WJ@ZTZ<<kpeT<Z9fwq
z%iZ^(qfh4~qvXz)PVv_cTqsk&TB~8kc}&o+|L3m$*VanSYq)LhRZjDmxqj(3J^?--
zKc!8xE@_pT)(GiM-t^aU*8B1|E)&lOFbFF$?afbE6aI4PmDL{1n|`dk$p7A_=`we8
zasspH(UZ%rCR}Bx+_SSs_Zd%DX&<-ooJn^$m==~C{LXMSN$7>n30?`l{zDI}FS4q8
zoIE0wKJ_od|7{XHk*$uhDMsfvNqxI!WU?o{jN_Q=3{P>j182f-GDUV8-?rN5JLkXu
z?%iQ;=YRHo;@t36k@4xR3oKh~bqjKrH_9z#ZQ5~&(b3H;r9$PWY<S2ev6!7*Gd8if
z{G2+YWZC9~&5sM`?qxkyv4~Up!lB?@vf8_nj$OH+74YbgPw^pn4!N_BjZU?mOR`9L
zb^c+~`z04{dhIJaYgNsp>%Q#rywfVb8+HF&J-X55HIK%k=yoC7mc=)f?6j3F-s^;_
zS+Bb={djd;i`C11rRLkIW?wb-OP@bl|NiAu%S~sP-u+D3XYQx`R#L@J<<kMLt)7o8
zDh{2!EnXIS=GgPw^SU?>?-non->^zxyJpp=lOh#7rvqaS|C-~;8YF2H-lW+vX|}0w
ztjjf7%|1rK{YnR18gc_-pS|HpoyC|_z95fX<{a0JWS#c&tK(;Go19)U#qQJ@r=u;K
zEmjoV+Zv(#clM&AS7cLfPr7>6;n!1b2HVq0we!7?FHQJY>!Krk(EG&NDQ=qj+Q}<e
zwr*QzE8rq5b3T*By1&>^t8u!=!|TD<-@k3$6JQbW+F6dXSbV$LyH>eG=C>=?Z25no
zFt>kCN%PH%G7V82Gvz)^VV2n4GttyI?^)S-o{xXk5>IDNx+FC@z$Qy}vzYy(jq_C6
z*T^w_e&YM7;jm=_=jk24`sR1WiLSN2()UN_ugePciybTG)^vs(yIUbypn6L3$iBGi
zsrkj0z8`k)6WX-o<t$<STT5pdOPWjcpA*e}7#H}aJa&Hm+K(ITzl5xopWLaM(z3kY
zcBb5u<$1p{{@!i-W#;(hYW<~v`<tI;TwTr^s#$p1bYAaVt_#O=!=%kwLlV3HY@NQN
zGV`pe>fsN1nRkOORqb24CfX_L{Pvc4OBaXMcrTycGwqAcOtS}GMyj$>)&iPwQ||Cw
za+q7AQt#cFr7iQI*7)m><mh*)d}UAPNTwU6-h1VB`_j6mIj!N0=UaDfzPf60_{5c$
zzs~C2cj%+a1-8u#9l}FQeeWd(e_W9DKeA<O;Z#-c(Cvp#)!S=7_PlxcQ0)|9>F56w
zKd{aEkm8xTZ}-`6DiW?Sp{(<F7-%PY2=}D3`L!-@$vmJv?f8{|mk0FI?34fAn>BCV
zIR}OPVgdPw)Vl6@+PuFsPwbktDNpJvoug-ykKOsW=N(7D))ihRMPJGu-1IxlGuyW-
zf4P7Bjw4I9Z83QIo}uvOOJ?7-=4=XG?^rj_efTKq%HEqFr?J&o|M|VUS^VJn!lJ%k
z^M5FvU*@y6ziYKo{3Mgluf8Q-H&T7ZDs85g`eXateV?MY-Iw|`wQXg#NxSjnkhW!8
zEG}FU&q=Z17N4DTHni{+>+HZAqNW=X*si&9#r$OLS4#aPD|Ioc^m6&(3m5-LXGt2Y
zkq^?9Grr?&duIA7^?Q~g;fyPLujS-0)kg~aRjck_c;LM6_Dj#$6dUYPRvq5g{%+gM
zh0>FB4)4FGqw@TsY0dxO!ovoWW(O~~vf-N{owxG~M==-g`*`k-sBMwoT=hczJ723W
zcHT21Z<9y#(b8o)x19ErKj*HR;P*Z>bb-QR9`m<VML~>tr@k|vHtoKAT7HH}+C`Ug
z*Ui<NmYvJk^<ZPtv{j`7Z+?}}Hnd(`VI?~E^9+fjp$c1?mP(jxSG$z8>DRYx?(6$a
z!nVa*bH(p7X7^KP<9ouGYChHH;wtff|E(UrEjd(YoVNFEk+kf_^DQqk`u_`9#d)86
z{Yaf_w_e|;<#sl2HLSOvI%Ddze)ambTQBX3idep4<z~G{OPW4sn$B6K)F8pfAj?u7
z_GEUc=HuxzzO$~g`}n}{<=T9;*&)lPyr_~<%-tC)<zjnfgPPX;HibXxIULV4YP9Qr
z2U^^@cx`ckLd4=9T_xq4cj-Jbb@s}$7w=R0(D477oWhrL^Vj{kbK`x{C6!woS|#mf
zb9c-5tgTS>@IB9bry&33ihCcvoK8#L%NMcvgYJfoL$^Ke`flSYQ9IJ`dbOZZxvWm}
z+-%dP*|OWxKgJ!){uAHN`+lL*OO>v?j4Mw+o?Jco@O35i2g{rP|NZ&l^1-?<uMaMN
ze3<`zW5t_4srlt!{(iprj&JUPStmdD&H5PXc5mr151;BLPbr={&uJce*qByT>UM25
z>2-cBB5=T6NMklb)YpnBpIJ-`jg<GDdGhHS^ZBXu9>q`DGvxB$b#0!0b<QN;lkYnZ
z*_^ORR=qt@>Hpr2hly=UwS`T^t(-gaPt{N6({)&rxi5PKhqzx>Z_0O<<7@{tUtgIK
zBh=D)>*62Lv!DOO^dx_3`jj@e>V3KAyc2yVj?CLNsn&m@)ADEC2`cXwOP*|;F4TIh
zHsi$ni0unZpIheqzq2cH`Y*}t=XP2s+*`3^P1L@(rgu0lerKHI=geCv@G@02PQuIe
z3X@B0%)@)ij&7zKcA0IMEm&CorYj|5v5amPum7^U(Z}LXy@`J*mlQYu!DP+;;wg{p
zztp*?MV~hfD6y2eI$27H+jXw=*Et4X=I?x6cCPzil%!p>TVkU4v%k*wp5F>oFt`{h
zA=##5SR6KGq2xJ*W!F4bb5EYl-*lqqZPP#RtCqVMzoz{7DU+WfeY#?Ut<Z{+noa*7
ze(v1dl`WOAb-TDtT6(vf`?+vFW6{`yFC$-yOpd8+I?dAKza;3-l_Oz~mU!~5eAXxR
zcF~2eVr8E%zv9gLqwt~UcaroHCaY_@L7A_n>6~o58_>0qC#>oX?;FD@D<AhRysvYt
z;Mk>i1_9OAKRi`4Q9tebY??{*#upQs+f2N5JKqXjmU|j{K%@SxtZCcBw53LIZ(^f6
z-}ubfC7LSy;(LBsl<4Gu)2U)yDSKaB(4DrA^SJm&FDn@fiF5ZPwVaN~HE!pcee1%-
zDccxSE?+Rba4chLt<PM`dj>U!-#gsCa*wg_T-eL(c>*7w^B-5=^FPmE-kQU^6kk^#
z{`e&N@{)p(bWa5j#q6r<t7-$c+zH)o(q(UQ)u->(kqF&phfJ|WeT%M$eP6Ts75_P{
zmodz>3Q5d6RTj;QU|1WW&F3DvjkC>u&Fl4t9`dOuKjPclp{{cG!R_zz_hfB8eKPBx
zrnyCQVSQXw*we-G^DAyWPz+5J<v71DVOyk5#WlY(^EL)J>ha7_zsKPh7j~;CG0b@@
zN5{{YW1T;FE)_^ElIi?wbg6e5Blng`_d43z&5Jcy>@G6v%=0U(@vbb~;=y;Q{ZyXk
z`5Bj9Xz2t^RVX;p^FuDfM6S1TinD(lm*LC9?USebiTbU+=~`vylsK{Y{=RR@iRJq1
z+E2}tJ^c2=A@7OiKJjnNnYCgTN-ul*lkaj6a}c{-W@0cK>!Qkn($=EjnG64~IJY_^
z&av~Ua-F#!Z%RUl?Z)yS6Qi@!D@tlVzxb7w&Qe_|8E$KPocVa1{)H{~zZ;v~T9Ko)
z!tQyDYxvrk7fly#)-}An^O|i-U$@@RbN)`YCh6J-b}{b=?O<JBG2MWh@8P+HVlqC@
z3%LK}2p26B_562q*YXG48?*B69Np%=QsCp!z$2D(JyIFo-2KF{G+biOv`cA!1*3xR
z__|zp$ud>vio<W83zt;(C$gn1{1R*S$Kc2B`~UwbRmiUYu<o9NK;621PD+ROuG}!u
zw`SVE{^|NcK6grIESS;plkXwF%$&|Yr|0_|o*m}5GM#U^TE}emg8M>@D%wZ)hFI%Y
zcP~12JR&zgb_ribZq1F@h4+P?v#^@3w0vft<fHffPwx7Jom}@zHJ2{g{8UfP%roxM
z1n<1xGlFl-s*T-t?q|Ym%_)6a&(=iLX>Ok>+P#L8yRz9~`RQ$wSL&TQ_4bQ|($7h2
z=4_d1wttf76@QPnKQ}HFf0(-Eg!%=puHGFTJxy1wG&WATRJJvEjnOw}@yHw7*!*Ar
zd^p*sbn=Rx@W`ouxkK+56j-J_Tc}YoW8ZEi*QIHkcYUX%o4sf#T^y2<SjQPSSJ{Fu
z?rTh#rqBPFpEuM+=bpK26l!L6Zd3Mq#rr44o8AO3Nj>?Qhx>wQp4&EVzUNNjh9TT{
zds`2zwv;KpY<*zet3>7R7R+t$^d6WC+t)mOT*;!&^yyR#-y_M4#_RuzJL_)F>24MO
zS=5<+X^NzNcIXwE4by+mWp)3Z-xs&nR*v;{jQoc`FF(((X|k4F%0Am8q|ZrpwqN=7
zJ?4`>r`DX4bqtu1&X`qa6eq^%R#P}x{!Q?=rJW(`y%Lp0OReN*^#&xShK8l~uMWO_
z^Wkoe^E>JnUk%w7o9FoYaG&mr=6g&f&sx`4<ytkCPK<rf+Vv>T`B0n0LXAV$mdSn%
ze6#WP#tv(dxOvs5e^zUm+RN>o7+Bk2=@kCdw`A>whsO?>y%ITagmKILFMDzsrx$Q`
z%vdDLX7(p;$I7(B&kLp<S$fejyh?NDt<oUreMznB?kH{)-!g5(Ath;X<(jmzb;~Ry
zY`ZR|GCsPpt*k|F&*blyXB=L%hdCkH>;lX2qHmQ~49`iGc)C2FY3NhGIiOr_<2&o^
zF*#THKiAFsRch~iIC<io_g%)TtS4-k{VR6)xmUMbRyN*t?=813vkukrzxALjKWxRy
z$wy|DUJP*zI<aHj_G#s6U!yk65tDhn?d`QyR~B2HUwrxA-SuHxqjQU%e*HbKtSI{J
zi&NeA?7SugzTJIp%cr_ClP}gy3%S((@9L{A?!BiHylNbdtmVy9d$ajWePrYP*cD=Y
zz7@A;RqfsuIB(6ig^Air)-)P*dv^pr@A&w2+IB8=)3n8BM0e%wusJ@t>gR<kH}kw6
zL|uQL?kxADKgZzLYJs!+&OC46WW8uIDUR{|&PX55Bb@%Lj<4acvNoTz<#Z+6*2y>a
zOy~Y!V98%`Z8NW@!&id^WiKyU3C{dHWA*HN;fo&#%!-;~Dc<35%JFgd0wYm@iqxpk
zhR>?IA9Q@To^f3K&n2E0_b1&>a%J1@S~ibOzP?g=@4pZK&OW^T;>CyczuV`tvE2KZ
ze>~$AW8EUJEejXjSfli=ZP_BxNWaENoky+@m+rpNd?1~3SzD!8<;@*M^6ML#)*TXh
zGGo&tulk)$Z>E_ls_-0f+F<qY_4Qlzrk)=jWu<XtPnmM|b%x(z6`9k~>m`5R->#m_
zVtnWDGPZ*+?aeEXw%oZVKCj^m_v9y`my-{CQCP!#@X7KjgRU=E924En%-f}rQYzSY
z_pn#sym{|EeyVZ4dZ~D|Vo}7&SFZB^Yb9Upcgw1}Hu>t&c@ZwNHt(C->=2*SQ#JM9
zgSe9+VvpX0?M{$dA@#^e{Qt~*CoC=)?^WC@|Nl?*4UXrRi<0Jl@O)X9)gAfgn|gWh
z;qMhypQluQ`rvoHa^}LBf9LrZzC7oVet$`fT3!9@*?C{sZno9UwEa4{vs%TJi~n7B
z9Me=IzUk|>ywY*|y>wC7r9eZbPx6JrJxdPV=5pF9*mgz#&%2MU_pPcfWc=x$G<VAH
zM1||23{Uk>@$hZZepYehQ_a(stsGZuxm@?Tq{}cJIq{%(Rr0a>T5f*#UU=&B#!CK^
zXPI_DW9Qoo_h-BgPFZtKCHBemS+!dYKlFKqNefT5<%v6Z<%nC5$b*Lsf@+_a7@O|C
zY&19OLqXLR^UJEAg_$opEt`4yoYx_CpL2aOYjdl2g_doo_NzL)__?Kx*#E6Tv)6vx
z^6g3LQ-NEXuH?Vx-n=yG{B(=uVk}YOmD`UTkbRSrb60QevO~qChYu&%hjZTid3DD*
z)r&hTCGUAeJbI+G)uFSbO=+*K@QR-3+N<~4#UyrZ{&RSTf0YNHPDZaDkE6{={Y(E&
ztWwsAK7K>+;lZ6koz|N+^L*x6cv?o??y^bb0f`cw525GhNh{b(dh@Q#V@QwomO5jl
zqVww6vJ+DlOx#&{WlQNzyG=#g*96|@c%HiaUq!@!b|2o#_B;JrtC#f5yjjKf`dQ!M
zBAM7XkLKAN<kd4cb)xH!QrxNQx~m-L9=q*ka$>tKBkv*pQ=Xo;Om{4_T=y{SoRia8
z(Zc3Z|LXfclx%v^t1{fS%-iwN{9waPBMCV>sdx5Lb^r9&IiEQf=3yFm?NMConw=MB
z?3WCVs=Tz-hG&tvyxm-xeLr=r{(bm)`8BiXan?0w7c*RzUl_&bW}5!))m0mbI*A9~
zZgX!2pV@b~V;k#F`8DOMyZ_ico$j4*L5tt!wBYmgdXKfMtIubMc<9T#+sv`^{G0!W
zH~3EqnE6oY_ceo>i^}1VyBOwe{`|=_^<yCSi6FB%dM4cK_m#z*S?qqeb?2nR<~Dcw
zc6UtbIli#BXIVk1)#Ys6y}CBRRY%k=Pd8<Mc73PsCSi|R|5v{kRGRp~XK`uVr@LzF
zdZ($Y8vAUJ$gbIaeU{V#=`Z#i({5@_GH`h(f6+j^usX%k=I!e3?eF{j<78!B_y6&=
z7Z!Y4|5x{xeZ}WjpD&)&*n2`;{J?)E-PY!ZA79)|4w*DTioM?c=NGN2uP@(jWPJJH
z@A?n7SM9T|O1k!swYp}<tfzY?Y$`DDUjI2%lzF9Az=vd2frmZC0kYB6%bDaG<%(MO
z>~FQ{tZ-pE@ZL~YQfu-CMjtcn-9Pqh>;7}<WrnQ!^N*3q`afsxi2a`Cut|L4j;j8f
zUkwiKVmeg(k|j%V-~WBv=0BSD;rH7(w#j_1MhX%(c2D*_+<kMZbku{>&nxbJ%fFpd
z9X+dXudDPesjf)f8@qO`_+IhlaNgTlx7hqlS;Y+a|Fc+gFPrl6n?!y1yVzpev<s7S
znR@@kyvlxHxK^g)QLqo|u7LiTvy|T4|8a}qfaC|6%8lDQrcch4sbTcf)QkKcG{HY(
zQMaU-oKo%ICacgn=5^U7+)ep1dqa5c9oG?xh|gDBs`i-QbheM*QRB6oFRkZ$MCY@A
zG1P4AFnaDhr?N2k;FgtrB}TUw_3bL!o|<l6#k);2X1jb{<<>b*x~r8IS*5esKAo-i
zh-=B(69K2qo;YRg?_GV(L6tXn;hf9cD`r}5ntV?7YDjeT1}$^e&u$5I422(}eqT*~
zCHmx2T>bZ01s(+znTg!aA4{Z8PFO70tyT0?E-CKXy=fW~KDH?2omw?xX-4YGCW-YL
zN&997KKyuNLxgUSP<r&Y=KU<YV+?ogdUer6hFdvo=IXg(X;0jjZ*eMl>ATL_ZB>Qa
z<c+b9j<z~Trf8Y{Y>J=ZF6`X;Oyr}Fy2{B;_1>=8p`OhVQ;)n@?#Xa5`n0a!>6N+b
zPiL0<2L-(Qy76LqnfUv8A3|h>{6l^2E?Ua-PUE`o{gjwp84)kHaOnOO&aZtugJp%n
ztw_^XdydVDJ;KB6z4qae+2@_px`kJ3hdw_StFdIxkpx>VZG~fQv%g*Nx*Jn2U->zx
z=hp`{^?4_E@*X?#ah8F@>TBgvuDp!tZ$zv`gIC|*k)@*^no|BbW#uHdEQ>4op68}*
zIjJ)-;GoYT!`4+FPl}#4)p7kT*XGP{N|51cRdCABWhNybYnN?IU(q&ECZF+c(2ZZL
zyO-^mGVw19SKMW-N8ffDRlBHbO*-9o|L)S`%kNGSKExv>`9vx>|JstfODfHD%?;kE
zsa)*8XX_VNqux`zD|5Zw+V||YqoVz<=PJGs@722KSg_0E0ml=rGe?Afn!URn`yoYS
zTl&e({d1L8bMHF+UiCEh2JU4uO(Ih!s_0(o<vspl=Js1HCz==R+rU5dtpdycIf*S3
z-^_`g<Ht88q;~)72Xk7^<~A2={a|~(=9?_Ld!O*sgDd-*su$H~-iry1uGZN(i)-@x
z46iAvZ(U!XyAtKTHLvm~Q(0d}=!TPg`CiY~Gknxsd+3?b>KYCGrx}_WKP}6?KVFq$
z6@E0Yv;9%HvC5Tt-kpylf(_qwv`qf+>G1Q(pqYHL&;w@@I?wT%?dO#Ic3$x6(^Xtc
zZ|;!m`J|9^Z~BkDJ14hW<VdzC)_GmqurKN5{^|qG7tA8f(>>ZsH=KOl5icxg5is{i
zYw&9q=HF~Buir(hX<KzhZBBUldbxUe`|4A>WH*1ip!!+!yzSa0Zsq1@R&_|;S8ASH
z9Q>L0O>f+#?8rZFbv>U6?)o3vX*?~<S8U^q)N70P%{S8c^E9hjF<kmh?0Qzd^)J87
zUe(GL@@(g)DQ?>(SFQe;+uU=ID<(3I`O>u|=8Q-7p1xLW;h88U{Y~a!-mZq`mHAB1
z?zg|4y?&k2g#3Abjb|R$SuknC(zIQ+SC1(Oa5K;CTOK@BQo!}p-VOV>Yw~~3Xlu)R
z{q})M&*CKugj;lP9_C{%eBZf1YWl8dpE*5??d}~u#JBw1gKbreXVg_?yw`jQ`+j|$
zdv$`D_j1q9MYn{^mhJ49&Tnb-at>U1SZC5D=KS4h=bxP9=kbmEu!L!ft<kLN$;Vb~
zyb*rthhTV-YeC45oOMw@Q%#uCH*Hvy`_STvMSOAT|GvyUw>i&UUVVDcj8)5=cUqiW
zrtzSB%c<p0RFt!mXEGlD8tnV-zS`kMQP!82OV4!9dVa0S<nsLtGmfg;S_gCYg;i{P
zcXN(=?v)n~M?cPRH0w*=^^7OS^FYk8_Jj9Z{_QwrxNEJ^W#L7uC!N?}ar&IuC0YI-
zUd*RXa;*O5WWL2|Vd?xcJ6@{454ZK&Jvo?j2gkYnuO}E7P48Knmr|`c$IWe$jOni$
z!PX1@_FL8&w1w;ZTX;71^s56e`xr~ve+2MlzVVyEA75kWR2FdIKu1Qw#MIMYAFqvG
z`SI}f_KPR;<@x*g{!7)?lz#fWmUHuhlO~(qHqDfIp*4H4ob^YQzNbsVV|W-Qd~u9?
zD*svN_|uO(f=2?EZPA=uxvS^nf|qZ;3%-%Bv8mWEzt_^n%AuV<w|-MYnUSO6MDrs%
zUHip+?yl8wQ_8)v@kP??iz_@^{Xa8bS^0)>c19oHzgaP#HkY`5`M|QnGGs&hqbS2%
z+fPd-x2sNl`J}z*-tQd$&#lkuX6%s;QZVlE+LHX{k=^TEc6@G2-f^5y30a#HGFjSu
zp@a8T#mNeupMM2ya`)&`I@H;9N2sDv(pI&~^lk0r8S3iSUS9e3ugUPU>cr^es{DoS
zf3`e&l5yUI^+S7JtC6PBvC_Alu??$=ZytW|tL=mKU$axCH3daQKmNTfEcx^6d2{*t
zMSl<bm#fEbIvdrcvXP;p{%7f(H_GL$D}S?px+VDTP8(YRzhLlL=}_BgWyw*_nF4vG
zw~bZ>PTrl^vt2xL!=j!LyV44;M;4oWP7CeYc>KpP3yY?!KmWX%;kx~F0>i_M^~z~3
z`$Bhph`ZjTDzl|<wYTHl8F{Z=3$<5-doTMs(blZ??jAnA9p|Dg%sLjwE$38eKb_xU
zl<VH*(>Pr*T<y%Cs@<j$3sPt199#XiZ~OH4f(-{JxpyA9lW_h}NTb#fZmrM-_b)!S
zK5bxh@<*RUtM&m88JVr#MsMsS;xnesGcnXZc6-^ZA0L0)JqYqjSNKvsA<(wSa!p0t
z`=$-u;jKrma+iPMdczU^bdujbnbvP}66{2CFNY`Daj)9^&~<A@+788D0~QZ0(G4B#
zKG{<bznyGR>Bm&~kBM9Cp6c6>c=Z=T&a%<-7*alGJhItlc(QzZ^NQY|yn&TGp{KXi
zM5S!X+F9t<<FVeNP-*r&Vcq2G(j`47k~VsEq#O0#dD~R%dde_aKBeyI#Dj{Dly8eC
z&%K>cIn{sm)c<``d4kh7&9?YCK{8%zo$ZU(N4f`3rdA#^D!dXhVf|UD&8eaBa&bYK
zpZq$@ZhW;n!m5(h;1*}-BPUSg=crJ#V)gWe>2FRq-t79jxv*T~x8%8*R~{@8dAoGt
z`xOesGcrZr9;wcLyxPz9puwSxtHOy}QZ!39ESl=uA9vv!uSS6ML(XZ-=C=2Q-kq8}
zHRBL_w&dGrj%l^h)4C;=8z(4EQ=5}oUh<%Mhql*)<4)a6d&L~olpg*}JLC9c(s7=T
zvkjak^I7d?DL&TAAd)G=_}chSN%n(##*IwoUzl#GUiG@@boS9S&N&{BnszPhnEUv^
zktI8Ly|iT{=NhIgowcbWH~*N%r4Lc(Z=MxU&spHWFB7==-Q``fvs54K>ffB2-PtX*
zV(IVbD|gq6n7Y0^wNL+7*wS?>)rmqmlS3AI6&=uw+{N^b%e2ncO~K}3f%j_Ny-#gj
zrFU)LP`*!i>*=(uJ3h5<&{LlG{X@zT;q>F&(?jmJ{#(UbsG(jLbj%?7OmVRLLh}rP
zss|#G23d>s-{htx%z3rq#H5%hJcS~`kKghpue-u$BIfc>BSH93{Olu}Pwcf#_PiT>
zRA%a}$0;1PmzZnwR=iH1c6;*)@8$DvPptoQMV(bNrug!lPktStYR_L~h845-zc+Zo
z@UBK_)xSHZPj<+6uhV^VS<wD<3}3xs-_8ql_4C~)dS|dG_qJcQcP@0XTsrG~_}=?R
zGi+w;Fl9M!c=CDjYUdACg~m_b9WRh8yYABw+3p-H>y~`$^ljNj$H$r-^50cN*caw=
z*&OXDO80J!R?|Pa<%P`M1wI+!LBcWX&5rxuEm8I;x4Ux3GXK`|O|C2Z<_GINSZMm`
zgRQZfS6=rFb=#{fyMD%<eEE6L=1qc!o_!ZF+VcERNAIiRW&X`p%YMn&_wHCAb}TA&
zTlM>GDgWD^D(QT@w2kRSuG;j5=;af>a!cB~g_ZsPARL{&^Ub_ggQG8YU4O@Iy!GkI
zsD`SR2U5?YN)kJt^E`XY-xST#&Qa#5FO&5<YvR#V=Dn(0!Y;3Tm%jewrrqs%<%&%u
z_k8can$<bsu#AU<uBFJT;uz7qoEHfqlb+UYYj64eZkwdZmY2URyI<ecJ7qj``N_&^
zf%;mz78a}aSEYF>f0B=Gm^IDRxVZV_x^0*9rXBX1cx-M?@z#^l20E|!F7K*c@m}Zm
zr==e0cR%D>UwD)j`AjAFQNq4&5znp`eKch|^l+N$gogFDEO}=-cP#&J+kg0u(7hC~
zyJc><N!`{D_W2yUosj<ZddH6FQ?={93o*DV{MWgoqQfh?FDLL{jnz-Cjx4<oLM|aM
z*DD-s`MB(mazx<w<@Q!>k#lb{rZ?WtI41vPowMDE03W{{O@)u**}g5y+wvx)cg-7)
zRo)A0`$~OIK43j?EI9eRyZE;C4zdDz0lPk}KA<;A>`&eaqvSk?cr&g^vl<PRZ~xQ_
zC~w_<^{3q{t0);U3oQ<Fz1xY6Z<Q2hX#HMxt1HaX!DaUi@x>u#msvai?<hXHFmLNN
zk-8n3{|k<q9oEhaH?Q0;zRNX4X4SsU6CQry*5P~h^=eq9x2el<ea1-R=gZ_bm`%^U
zCmQVg?C<Uc$60HImCm(%Y*5YMbS^XG-*sy8X}K2Z+Rv#^7KQXb3!f0ZL+xyn){nEF
zvmc0cs4v|Wzv7MN<fW&K)76X&irAQPw-m8Ga^JbJIKs|#^UF*3o?g<NXqm6_erx}X
zq@C3V+?$2(npwr%>$O&0EWu*@>ROD2<C;l7GUq(Y35>m=HMcx)`pl0kDe2EI-#NLb
zr+>n($Lf10v{?q$x5(|`u~(AaeZxle_Nr$mm)AO;75%ziO}6*U_fzi9&1^oYo97fy
ze&`ThwXVi(+5y3QS4q37XNT9<l<ht*z%b$CO5U&8#_y7T^Zfjl)1J6oX1@3wu`sim
zpGHqA{M630_LWF)w_d%NV^_4##mBb3U9tJep_AM+rTuH3TKW_@EHSB=s9NRTFMUI5
zc~4~`kL(}UO5Xj-<){8HdeD5oWkQDgFAn`#9y?PvtERVeZ+oEqy8Q6M2A#QP6U5go
zKgN_(D0$G>yYtNcH3pVP*$<xMbUQPpc+W=8#~Es8+&7*vI4Sv9GIW21<g~Rq_tz}5
zUKZ68{cve8yU%CSx1Y}5Gc~JqK3BY@@Z{vTuFN{-2C@H?;u_;GaRl40y}an#8P(J(
zH~kac)9OT|`{EN71m=dM=B^N)dqK23O(1<n{+F-kPEWU%nRMW&tm=aIJ-<t~#b|W&
zmj;L^-{<7o^vrjH$m@GtzAubVDF$b3cu~rA<%xWXaGwy%tjtXJH`{jk1^4=9&o9)!
z&KMMwp)C@#T`|02OaF`v?<WzQ^HbG2KdCowI#=v0|IG4L=9O(Lt)<Q9{oKAg^XfjC
zgHLB|2(ElS+oD&_d&T`{&q4*OOYVPP_l)oU#;;#j-SgDko?ex2-t<;-_1gEjZ`)jN
z-+NUR9kYwSZ_B)yul`LmKU?-N`hRTl-q#l1&%cCN%KzwSvk^F*V%2-`Qb5}Dh+^#~
z*0oc!e&_JNbr%f}=Z?EsePRaJ+iR2EG)gBre`ma`70)enf6g8A!+T;qo)=t9y<*yT
z=$u)Z(5e|TC+F!d{VDwVX6LOroPt41-)+!yeE(eVsEo#=Td(<!{m++urXg(5(YWo1
z&ACI_x{`N!K5m;C`1NRKyvXG(J9^fi;t*8%dgHe5V%wQV+b*~zIXqwF8=I2cbM5_#
zgDQT{EG<l@rRQk7ZZpc8yoBe@tn5OYHw!y%eQ&kr=<L1zwtCg4-x>ag|MIV2TrU63
zUS8IOYt6Ct@T$@uc2;%2-*p^Ko}KjZ#$^TNj%vo4hRYhJY|AoLh)@66)pIUUn%B}-
zGv(hhuhXlRTb~HJ_;#hF6w9Kgwu|Mn>fc9t`yCFB<+qcnbGA@@d%S#(m}ElC$xFq>
z-)))y9XN1&BY)(TtJA-+>djIvtZ<%NX0DaVUv+LB-<J2u?H)0!-@9u4)w!ap&{9y$
z?D}Zc;u0^V`bAdm8?Tq7uH5tU0z<KMeZw-hJz>+9>D~Q1?a0R)JKk^j8uHsbuH(g3
zbD^05%dR|GVc_-2bZ<3}xWTJ=4bxTQKHooDBA*$d>VNQEsvzg1H4`Un-cwR^c&6*A
zX=~zl$?eo#o+jnW$+^o;bb9Cp#j8`-Z!X{QOVgyI<7)4^3%5V7oODu6^6=|}tIs4X
z*E?dk`}&_oX2V-XH$Q8d$DG{$w@}t?2Jaj@x$Ay2LW{N+pHxq7emNok?Bl}%X_NN;
z*E#&ap4q19=bh7D&wAg7-7@4#Hq321sGstw>5yI3yBkJTC+_XmEod>@{M0`>p_7Tv
zV5jXJ8Oy#Ei;5l_eBM7%>iGLi2}4)u?|cDz?YE|_kGp?w#raM5KE&VI#Q#422D72;
z4{sYGc}M;WDStd}@V6}7f3&v9>gI#68OzdF773laE_yj`UR5l|_T7tP-pv<V@3UF@
z)z@#={XUwwu)mK#-F>0&?(Jm@uJQAhTdq`DcURW2eow2ihVt*t7M@>w<>%g+vBKML
zIhT_--<_nIV|n$TcFZgLkkb{udQZ}x^u_k`<}KK#`{ZZwl8p1}mzv7zH>KXZ%DU|I
z67dIf>Lfo$=S`4R<2tC{@OO{;owbj=qo;|id=YRx#q{?JGX=pM=M~lW3R~Ay-V3R0
z+Ws@=THocVXH=g&h&$U;RdaI3?)je-g|CTT?)ACHu)Y4r%DV3xF17r-sJo}uN=)=m
zM0s;-|LL{+6WV@wB<_#nK6UAtW@|OK^ADT4p!kM$vjxB2{wflAV1~M+<YXQL8B@*v
z+UGq<77rFKSz61y>4|ZT<m%s7gkMZ`JG9`=8bi%|tH1K044bF9-qQ8j9HxC^pLnLr
z{nOm>DY23r8vdezJs*<`dcJ1FN}L04NK3cxEqnW95r6akqpZaXoz!=W<jWq<-N?{a
zSh!UGYSP-9Y?_vJyRIKQIR6{d*26X*51B}w(W&X)UVc*ZMeOCc`(G}~@pTJ5;VvuP
zIm2-p*R%3lFWx6Ui0jU-ak_SuakoL7kIMw{6Ni?xPCR_<+BJKgI<_hf;|(6?A3f>P
zo%u%po|{zoK@<1aHsxP0)f(Mg+p>dAa&xM`=CqtS_H11f<tH!7UX$|YVZgF1nOQ9c
ze#g?X;@5_5Ja@5hum8fUGgeuJxEI)7*%;2~Ve`_;d^XQZ$#;!U@=sYE&t01Q*5*@{
zbLjf_mrQ2st(X(KZC(8H&B_%Im+dn4=(M{!(>qPZXOq^AIlAjAqBhTX+pYc4Z&~J{
z{cqUH-`x!DbGvnO!re_<g~VO8pQya)OwZbKyj5eyty$r=^=nwZ9`3rTn&9GKID_@E
z7)Nt=L3Tmv%GfzS?>xMgH=(}KFg^Tg_v$?lUmRL<(zdSb-=w&e(b|F%6W86f-nG`F
z`1PW^(7>guL)n$vRtl{TiMXd}(#~zTepTtuM;8}wUK4d>vS9j~&yU_*ybYd`cl!02
zW9qcXuNt*xe;-zUdi*5wSIwsi^LcNMou6lOckY?G8OQv~miN!Eo$s@+fByS_0$=7O
zC_PjEVz<cr=Jd6<y_fCY{M>)p`Sg?h=gS_e`^(w?{r7Wn%6HF6HaF+m%szJV&GC}&
zKl}Y7s_id)yWm(pyO}HdHhZX&52Ma+UEvt@pI@}roWAXSSY7(X?wMO>7tZDt;jmvM
zanLsOqVIEs;IE6=`&3kBtroq%ri%aNtO=|$MSiBvl+ylWf3rm2SN^}r%s)SV+|>E2
z>8a*F&$qtHXs+G=hwbz0I^>tz`>35y?_Yj0FNeQ+H|tGV+pl+9eUBZ#p0Hw*)~$nU
zQrLu!g&%a@DZi)tX}rOo0=G<Fk+oeGhjk>mu8SVr&a|rb>OuEQwQDz;v#_o_Cvf>w
znR#^AkyCQcXaCODQC2r!ZM9mbSoM8qbXeGLNB7^#dK1s=icD_ZQe3!m@~!;E%RhgJ
zdwF(F`N2h&UMuc4z51|oqSVjJYDFogQS66|ZCg6d{NEw5^4Ryc8!nm5tLA-fbm{IB
z%RQ+Td#Y=<>=u1FFK$WqF`gsm%mjM^w&y;I%(O4R|1c-p>Uze`_Jf=!;x}!%(N(ci
z^K&A{zsFH~c1iv_Zu;)L#(dYJ+I*Xe^xWi9o2ss;+wAsQey-YLbCexI!p^+@dRAar
z`H}onFFL>3oNRAc`1<Uxzx$@nd1TkYJ+q+wNKWAdt2HjVe;;-{U+DPb<NQs2|7S6n
z1*<T}r0-gCeVt<R@$09bJ05$#Z_UDpU8m=XM+@owDN%@9v$|Ks_1)FCpVBL?ulByh
zS-L!O`5EEU#b*q|%lvH@YON5j@4NR`NOsTvKkqE6{yx0BoB#dd_<v<Nw~a0|TwG@w
zc5_GX@#v>*8OCo+v{yYjzU7~Z>vHM*9*3J|uC+p;FN^j*c$M-#BFabU^KK>w!#38*
zWm^s|*)V^3Ecf|mI?Jn%ABuKl%XuNAU%%1UTyNXUW3I{OTYMeg%(#6!=>A;!4Z7Et
zeV?wbe(`s<q31)chXx#MQfAqUk}kT=vVG6{<CpvD+k0p4n6)pouWVMxxmxC#+xb)O
z6)Ld(`57+J5hs+STzEJ8T=>tYUIK~F+&s-z-|EPkypmVN++BC(=R4&chBe2ocJXd~
zS{4-Tn!{|oj?L=qmRTu0+v5JuEp`@_xf3*z>yOU6rJDD$SQ;Agl)Gm?aXq*v>LZt*
zPVe`I50k}~3oc$MZsR6sks_nQ;2IUXxUlK}G5uF;uWIBrt?rKNnDW!NitkD)Lr!h4
z&ygE$KE>Wqa@GpDn$C*swnyH`yeK{>DX}vAEtk%9&6x~MkGFn05p)03(}HK89CyYY
zSX009#Isk@dM-7O{!R0GxrAj}u&M0yoP}wTfnf)jmp_tYt8({<5&1Zkb?uqvhXIV9
zpF(#=K2puUdg9govo|Im-qhwj|1{6ZzPFR4++W+O6y|;jxpLrL!qNrY*>O_G&QH>4
z7K=%Xz2O(?&AhdP*-lpL@Qb*)v+m#h8S>#<)^F*ZH+F{W_*p%O-^BY*wch4W@z<ws
ze@wr_{7=>N$Mli|`=x59OLj7;=1z~?xP~irw&;(vAG3}LY~H^8=s%a_`b8V&XD2ax
zPxzdyr%)ahviCUi)lRi1q2IgC%{~6?!putwn>QZnXWuTnd-D?Jqr!X{>{;bMuP^4-
zeY9$qSN5GJyc@Qj(SD~?H9s!uQ(nj;mt}w27N+}8Q4iQWWleUjy3XpV*wkn1)#U3{
z1H+zd4fwNUYRYQ2p4)4LQX;mkX-hk<yV@r>LH1(tnr%(WYdckUZ@y4=CVZc7$!vda
z(Fn;6)uF8{<<4)la$cAo6-xSGHm$kK^O#ZQtmcb_6KAP3KRVs1{Kr;jHutT#GaGMa
zF1Lw2S{OdF<JajO+qaoppS-dCV6eXAdEO6k_eEbb{W`|h%l+0f`J3vu5QQu4&9#S`
z_K3v$Mg(b3%zd(n;Tn6&G9?B{Z(~!Ni;mk?6&*Wn;KsQAmhyxnq3JIksk5vz@|~`F
zq3N?pMBXIJ{WE!$FR~rf@|IXWCG<l>x}~C?PDj8C{?r-&UNrqbx%cGcaHdGjKj%Mv
z7yY$oG8g}yApTZ!j}4#aKjmBRP~NRreu!J_L*H?=&$Ub|KI|7c*DB5zH|^B3lZTlj
zodir&E}gjX-SB|+pL4dXlHs=`xK|uAR%YHc?L&S+!n+$2w;$EfTAbOXktNHvFmrJw
z#}#hA#s{X>;Z@>)7hJb)_I$xE{&!XrcpZ$Gs`<V}7u@c<_;)=D`g!1=Rfo@<sXK}e
zwW-|8H$CBAA6CA|AY5mUtICZ^&7E_mTOXV+Z>gN|LNYx4&a!ml-P!pcznIR85e};S
zJZWS8n#pI5i~MX`P(Cp|%;MG8t<!g(p7dbNnSWE+(jz9`zxCtC{#RX#LV{TH<CCVx
zZCb3B&=>YpGw90e?DuOXObtCHdsX|uwCNI;KN`K*`{(P`i_e?CufHd|hh@rrMf>s(
z>e(D8j#=s)JFAd$h<lyYF4ed{?|9~wi%5L`KEJ>3$Nz)9!LN?ZHC2e(yICWivGYV&
zr07x)tEPMZCl%j)&;D-JgZ8zS-A58n?-ZZo+M`$_Df&`!PGZ5L4pGJ*Hcoyv0$Vg*
zyxrqs_t4h)-aiMO;QMct>oVlUHLLc#vf~Rex0!l3QeaI<fA50z8&0jMI{eY)pUHIp
zF1=&Fx<sa!7I`<%aI%zETrauq&SJ~`&S5v=5<d%z&M3~2I;GbvIcfVR34eDD-bFzh
z#hGNcoo85VH_xMjBXORm2_M^s{`f?m%ljQRo%+NT8s7b-@ussEzwRpI`(3YQbo?)f
zJ(7Of!r{yYnVU~6Ki_{-mG{oUde;A=D(1&N_}ElR|NZ*l?Ze+0{~vt4SSTD?dMy3o
z?{|-P=U1KQ-BFa8<9GB)_1V<&EUDFeyYqKFU3A;M_v5{sx4WNBzVF(UU957=$Vlnx
zR|6x>h9{zNO8y@|UOqVc@c#Wh5jpbJMSniG`>PkIY+-u;^>?mC@?6&K$7gOo!0@(s
ziRsJhdwT26M!%ST(Z|+s@tc)b_RQL~Y3&wWSrgq=HEY|ROu785QR1;gapw&GjAt#=
zCNB1QbIvu{j%m@2k|KdSwsx2M7CfrjFYa?=d#j1@*XEDk&fn{-KdAJALA&Bb%-vgi
z3?A?Qv)IMs@y0DDZ}eqq`8o^Fxi(X=QnV!4&D%%%VCji1cD?6&#V6{wb@Mv07i~RK
z@NlE@Usn%~=`HIX9nJI-dp*hN*X!t3(HrJBt{xTbIQy;r!<#9^ukMz{-m#io(Yq?B
zU+qHC`J4}@b9S_?XiiRJPuD(dUcYZ<f?lh8Pmw{+vv~Q`R8E^Oi|5zXWQCaN{8*a4
zpfoQg-`?O_XQ9#@?yYy6Z(iSZ<4eibp6;S^M$+Yb@3mhEe7{3p)VuXbFWdjb>*CJ$
zR<7uoa@Do6D)Dv9s@}DGvpIfkyI#A(=VEN~fy1G3VFxy--oA2EZ^2%h^Vbf2+2X70
zwRrzjG5O0Tx}Q#K#I9Sd&AIRJQr@!1(dRjjB}|vtdwfIj!S^#)uJ>hHE$Vgu;i8U`
zuYNh*X0^LE$$GnM{B(-{@WvqT$tK1LOG?{cUfsIwaN+bBiBCKJh%{IH+4b)BQIE$z
zy)sz$U*Ze1UF)>|(w@nWZe5Hpe|;qL!&c$jseVh$>sDIMm@W2gx2H7YS;b$+)Mqbp
z2;Rq&eJ=gr?Zr7lKA)%DUYe?4ob46AQZPVv&G*AI7_zUqAI$&R#%^|8^i=DLio?%-
zH1#(<HsQUM$C=tZ<4Lz>oW#|-18dE@k1kg4pZ{0nTQtMsFoz4xk_MjK8?8fCWiD9y
zKlc;<AY7CwXy$8NvnAor@z0;E?jJg?{o>KH)Fnms;c;=+f?4+M)@hesy?va`DzA2w
zcNO#J1#Qx*zbec;>#F|!ST3Jl_$lX?$=`=J`|WM&&8mOBiTw5V@$-)=e&zE2O=h2a
z5w}nN)3F&`?OSGi>~z}_7OXOD9@~+)<6AVJlsG<H`@#77SMT=ToqXcDDP7FM%@1~M
zQ+%iOJZmDKVcd<28F}8v;x(_VUTxx#cIEu$^8VAGveb{wdooeUFD8ZeW>nCGO<g};
z3oqW;nC~yW>FeQhjEOU{or1T|x?r%kFq?UaZR3TYE14yqLX3;zt-ri{F>`kP6A9DM
zj3=?NtdC@L9mAYX?Pl@hN@x18{?tufmS;v6)+)AS@4c!K_w%XETjpb3lXQ3u3S+lV
zuJt{$z5D6c{N<4qXRF)wB;!T%eJdl+zk0jjw!HkBQdynp`g%Pvk*m(H473sxS7?g~
zII8qIwdvQ)QnsRsBDwiX&rTHFG~uw8JXc-ov#?a1;_Qz8i6^d1U;ZWh#oQa6%=t>e
z&)E}eR#^R7{KCeYJ80cy73O=Xlhi&gOW7yWle?xUwo+n`ul6Jdm%cbd8|9e9Wi2b#
zD$ANzHcedZ(7$ZUD~=aB3{z%@{Yj1YU2Y_pc|h-07L)8OGqIE%SEZt~wA;*Pq@Vk<
z+{;jB<NLn~-N}<YnU_oL>4>nLxnb+tIU*j}r$jW<mK^imoieA*T;PyBV_Jh(59g$q
zCEr}uP4dwbb?3=pcII1BlI_G67v(=|s&Q~xNY%S_AzvEH#izPnvh@CzoA3QV_JM+g
z<o8(pcKHRHw|m|EJN1`RMNp7y?9Rep6*a$-e*Bf_zs<Fx(7@@*C#IkXci;98K5;h3
z*x$ZyS^q9F?9R4VzyA1KJG{{}WJ}GiTDiM!l{@9H+?8Idd*ZLxyP3tu9)%0+_*J{@
zvdq@H*F9&BOj&ULsqc$#SFMdSUQaVw*%mmZqgq}5oBf^#Nk(xlZC>4zWW^hjo>$CY
zamxK%?9WYH=Y${pnejZ%O4X$6Vx;N3#*Jyro9{Ch?_v*&?|t*?4#V+^zGKQY2Zd)9
z7tg6)a9ZTekx9oc#cD}kt&2I@mev2h%AY5WN!II`;Mejwobi#(ZUqvn(tR3^Bu)r*
zed|2ou*lc6JAKk|Z8LV;pS<{Czc|w|zWMF7UwY37mf!tt{q$v&_y3z28{TzT7Jo}=
zeLrJ!<K%yF{%-HD1h9YK(d5q8^>ur`-^#CtSMYVGTIqBByWzL=yg>8P!)fb`YL2FU
zk$ifUwf?Bs^zvUCvp=v*s$vpZAa3e<_pnHqhkU@Xxxp&4ch&BnSSjM<na@^tUURk8
z3Z+k%OF!TB<@s@Yjlkv$3_`7Hx;rC<v$rT;i`$#K+4Q4sr@(e2^NU%pwwiJ0CjT&W
zt6kl}YTFuT-Ol)O9+QNH>zS_K+d_3OYq`Dta=n39{r7bS?aa{Co~I74-e#T_(PDD#
z?n#X!2Nc?GXNh@riNw0?sCJm1Z8hOm-`j5fBMTo&O&6J5nScF6hTJbPn{r;C2Z<FH
zcg%7cgj`e~uA2D7cezHZ_m_W+{Wo7b+}ZYFV!WOS$CqBy<_F9lOkB-;uX?K$1XrB#
zc(!v9$M0j8*o6;E%;}#|GJpNUds}}LDbHKI#=iP`R%xEoV#8GJ*@EZ(R8<LoGVV(I
zd?h3`$FG6W`BF!fg_>w)lj@FIdkI$q9gYeq&Ltb<=STfb4wu)Kkq&ll_Yk<65VrT|
z#QBN;E#E9lwtc+hTz<lrd+*&hnWpH58>M|OT#>#`<iPi*;llBo#a4=Lbet8~!`E^8
zh>?5C*R=8}m$eTH3by$+ZaNYiH``EZ)f|U)&!U5G-QCSHBkjIk;0niouV*~CHp7@z
zw0DuAdEcYLkjbxheu-Uh^wE{CrI%w&I}Y7f@?Y>nbn-{N;G6aW-*dheX0rQ6D@iRs
z%U$_=itC4y9BU(T9$!$oQ}D7S&v?Qr;i#7>My)LR`+DEai#OU9zWm_*$1KO5J4L;l
zJL#U8)`Q;5SC)j<mETvhzkhqVg-Hm<am!%w1M3bu9Q2F|`yn0Po+wuHpZ!FxPol!r
zi~1g46_xX1MBJWkHaP1oV&vuZ*I?S=l?fBYf(%ywP?nsdp?;4+z<>FH&H9(RCAubS
zn{1pO^3%sG>rlypb6<08nfo8`NFSW`_uR9L9VQPy^H`~7tkF8Px-6wIO`tIHf!ux@
zx!=n|Z@rRuU?1AV^z+}ZwpII2-h6Yn@@T8F+%I4Kv{DD2l--6E9QqG_ho4&iCW@KA
zc7?O5CHG&kr%rrR9v?PxSL?PBoBI3HTEV=N)>3CbvqmvY|G4Y>x8PImx__r-7Ot}X
zG4tw8sW<1(sFa>Ru(_J8!-p?t?r+vrojK+mOvwx%n*Xy0cr&wzFfcH1FeI(p9`(qv
zzTHZMfni4w1A`0$14C|VaeiJ>X=YA}er|qBX-;afenx&tN`A6lLFHbX?EKqq+wOnW
zP7~Gf$kn)ZQ&%jOIckaY?zIz5^n|uo>zA<V`S$6UiL5-`E*pFJf9?61;?G?@^LB+h
zBuz9fes-qvY~`63tUrHTK3aeFzNqBdD69RaGOvohZZdoR<aX?=+!ue&f4upGwKDkq
zH{ZhTFHg)rA6M&~XEx=J$L(E8mV1|{?!A4;;?l(u>zQk2S9woLxm#ZAJh?^WcI@2}
zm9?vOdGB7d?$${aj;7hZ7boS;{jRFId)YqyqFa-Ab<4LXzTS5#!hh2`=^}USTL(_O
z>U&ap?QsYX-^=Kl?JKP-cm>pj4MXp`EqR;InB{gmY~R~&)^Fx*d*Y@b>3v7fzI;Os
z!%yYI>Pmm!vvYZ`sPjA>w|Cd7Yg;AOxZVHeI@3L+`-?_*^pCJ><(q`Fr`X>Ak{h0%
zf9Y9Y*~E_}p-;bTmYIB6w)MG|c7saNi`JU${U<`NUR>sN`r%xe$b{4D7Jm4jdn?G&
zVvfL%n9%Q;kx%ZMmG`tcELrt$WnN<4x36!R|Fe}Ws{G_>Q|li5MA_%+1)aAUa)uH4
zSqV;zH9H&cc}(fp@bQl}`^MF`SsH!P<i31)|Ml&9lh;>*gy$OAUrF_omS>ow!pM2n
zPBHrEjqjzdf~uAdMy}iH!wtSYx_$b*<lTibC-*7nm;3I@EnVqg^#92H(|KR}x|h8u
zJu7$rl5NNRS$B?@|NnbA_0zNV)8_f>@733z>p03*^wE2Th$$<>#k2ZdYi9Gzotjg)
z@;3*Q|JG|W!oIr(hx@!%*>+fa?{YW8o1e2POfLmbm)$0($@}J^U9QEdlf01+x)K@p
zFY%R7F+bR|Jtg(lwkOr=c6?cMZbw0D)>>mf$v<0M-M7DdC!_E;hB0wk?sb=@KzEU}
zr41rKexxci{MBeXX`4I2{y9s-ietXpbtjhl&MJ}KwbVlNc}>)#94ocRo6k*dF1@?#
zXx{s-ZN|G_{90S(ai!EX{g|@bJMo*lA8qrT{qU(;ZpOMex#*>~JFVZp6nNLA;(cpZ
zzR@g`(!0HDCIxdpX^?xj(BzT8$sLyIX-=gabqUkvD@(qR$=JO`=lsds*y)o!{jRg9
z9XPw9CGnx{t<R1jlV*D``Q(MImYn%Nw)$BTR~PSWam^^UU8gkIg#=kvbQT>p<Jpw5
zRz~q-*WQ^vYW8t^{p)t@+qt7|@}Hug4<BFsS{<<PfzCg*y3#T>>l;!jW{#(?9s2#D
z#E@<8?1H6_T{h-~XV`MjnP}o0uUf;+8y&Syc~Wk1GkcFxg3O#$zUUkthZ`>>K6q}b
z+U>jAX3oUv96aBW8t#>Iul;}Yss8)=y6<^n#Q~9XgR>cHa{oI-vZtpky5Ku$k=8C1
z!4qMcuap)Cce{Ox**;_92i|jkT{=6`KAkJwEFqZpp+viN_2UN(#(%nRp7>(4^R9YB
z+O6rbC65Ch#qQ;1-fhWnZds~#x|)ccORuSP;noW+^=H_&m1SgJbz3;=3va^0^*7$7
z&CuPMf9yK%h566qHO1K&9%gd2-ZamgDBkPhd4I!<o`Nig{tHp|+qK)<xK2NozJ31{
z^UuZoo=#5v3Co|{h?=ubp~%_gkWTZOb=MADPp}g|mese0YsU<?6s!5qU1#5$R>Jor
zPvdjSY0KHUQY$_A>KQCFF0XTET;;f}A^zj~QpGR+LUxxlg)%RF7GhYi+a@}4wb!0&
z5}rqXWPiEp`+K2W(t5{RYu4N}X+Af5Y8$uo#F|yF+PP#s7QVXkUg#9x`kk+$ZyOwN
z5;u6nW-hql)v*^9!uuQlGX7NfZ7kg$&(<n#7Vno*;J&Bjpp52){mX8&Uj8YfduyFf
zVtWJog9@XoOWGeEd9hSv?oBqvyk+Ol{&wnU@lZ%(VZ9bNwQ(v-e(9s?sk%oF7%#~^
zB;~x1$8qb;1KgXZxAPYni)KAozBsD;W|Ms0fAy;T^65uwYts5A2b`B(J5ft&xwVMh
z#x0H8wtP94`1Z+<N=Lmcw|{%s9=+eqdrVTG?9$tHw>LAs?X=j-@PFg&t<U3YOK&Tm
zXB6Y`y?duNbW5)P|8LXx*Z4X;YjZBCbvx&5^!dPn1-tJypZwt?*OkZY#>$fMQHV1-
zMB3nJX!twNU3+!k{o0jpE3i+Mzx1<a?kl+zPUqKr%^!Lyf9t-?`fzl+bpxaHkzE3t
zmn^y4Xj8qw@yY!+ti_Epc)Kqgonez}eoo+4nkHLYP=M)T1^W&Wh2Y-6pbL?Y<&Vyl
zXW_rve2k}GY$8W<rNL+Bg2KwqYqS4sY^`tE6|s?VL%2Qr9CjWBy(!1J-97a-AFSN*
zWNvuEX5J6$a(W)89hPBy!c@`dmN(r@L8?6CX<_#3=vmsD{I?~a?>hJCM$^ahylWeb
zlWsov@P5WY_L)qPnwo;A*cC-zYOC&iqIfsDA;2s#XXCxeOtOV`FArU_4__Z>#wWq)
z`Kt88iNcyFn@tn_51v}GdHykF8{xLXr89%3trVE8Gb^OzQ>$z1@#ixxPwo-dy7ZUP
z^-;&~f+qcjj-3^^eKxyH5?#Jv>a>eo{ekOu_*Vv+yuHZa)|V(}U!VV`{ofDo!-u2l
zCyOcUDm$gk^CaA;mL<&I*K_yE-$v@&r(DUNw!=!j-@j0RnQ?ojxK+#JCl4>{@3!zP
zc<m>Y=f`?b)o=C9Gheesc19no<L?)|V!(UoiY=SZ^eqdw#w<+W{$jX1!C=Aj2c0S}
zIvetndMwl!)-A1UyWilq<(;uXmd1KrB_+0~idxfu*OJd&koMob>!yCh6A{IQMsim_
zn;Rdmz3k%l;K4;v&EwwZOs-xtt=^oRzawIKMG@1~<~r#*zpr<fR2X<Bzu2{5kJ_QQ
z&DSayDBX7PKUH!=-uSa1r&s0f*OG$y?(24?^_j)^%d-~FKe21U(hsej8?IdnPCF&;
z+kZUhwdQ;68S~8;x@v1LeQDYB@?`X`{W(&za~&*IC+H>i={fa^o_2h5{lyGl-Lk_r
zMvE7;GS8E=jCGA)n#^o)vGKLcKl>Niv!0hdQ8x*H`lMo;&uQ+&TRzKJ!<55#+!rq?
z()hM1<#pqa%du(}N)Ix=l{~toX5S$pCjQ8L{@=@Gc^l^B{E6wE|9FMw^2U8rxes?~
zc9?0dVp+W3t8L|<hjXl#I*9yuopvr_{y~TR|0@1|Za1HPvi<ez+1D?hIMtG2`1E!C
zpPH}l4!u!#t~($0I3??N*_@=c>N}Ej)pzhb`|Nv*&n5DX=wW6H&nNucMP(K%q&H7%
zY>qcDX4iZ+WA@z1-vYKw+LD|p%QEwW$O#=Qrh|TSEEul*n5r&+gt_CVOvdE1mPW<<
z6u#VZ{dE0VUmTmjA?Ee}?rSksEt4*-c#ybF@3OV|#%3;Fjzz~-$tdJ;KbX>9)g&u!
zSp2v&*S}G2pVqSUdd*cjf}DZ9`Y+;6w5S#@VOVe~foZeCi51cdR!M7qTzd2`UyeTS
zbe?A&R`q4>(ef%M(pB1z6qV*Una!X6e@D}#k9;5h8Ck?I>=)r$5qBsu^Qfa-oZORz
zmYPjsp-r-4))N2yW-8l+e#^aixPSJPDL)k}N?x|iVO{p@L`>%fwfMf@Z{xL`COH3G
zAv|s6bbFi4dlcj|t|dqCt>~<BIc_DL>T1vER@v)Oq>(n;y=BgqwOcOwd}_O{tbDxn
z+lzq3E(goLI;Y7b7X4D0v0Gr}hmEY6W^=3=ZFcVEI8gI`hqiL6qkr9QOF6c)&;59v
z*G>y|xo`3;Z^@rjq4#qy>l)e>_w5i4-1GLY&UK}DxijmVB$eMub)KGjJec!>rrooH
zFZdRO&DbErx7YT9L9(EE_3R&Wf&!1&U95ky_n_@%g>^RfW~zNmUM=-?&X$dhZ~H4k
z&vZR^-+H6(Nu#=~iGi%vyAWTWhp)>Ow(XpGPgIh3{c8nI$&)+9%zgd&fAQ-$H_lY+
z_jzQ(J?+0o{_S0Ftn&<<&emFl1lnxnSuP&OA8O8@Efw7{S?BW_uN)5!;m(fJ#%9wd
zzV*;<miaVO)#65kh2WDIx#CKZcL`1Wjk5i(`z~phyqTZ5c3wJfV#jU|J(se-Hv4=x
z`y063*ZX*Y?KDHvmYo~+{HULq>bl75^snkgxeS*ja?H4d`QBD->X-lQwdL)$9n!{`
zH<@p-X_^_>UiPba7G$Ke%BWh7<J%er-v0PwAM|<l$@}#cZSN|$^Q%o>AvQVD;sLwa
z<J-HQl=X_9GCk>j$4uiu$Ha+K<T_{Gd@Xp`@-y3+eJOzodv=#{?K!oPNonHpMs~}#
z*^fFqj!!tNv}H@5t?lEMIU7FL+{tvF7r#Cu<8>HIq@c1c{}jW786qL;jBf2p>`2|;
z^5xJ1WzqEQSt@OhJ|(ZYa>~~^u);;>?42EKC%w2hj!c})wtr8iijE4`)&rkaiptFm
z{eDDB81H`-w$WvK@YOT1{U^5Yb3BxqG1Y#h(q_J8{WpGRYF(bKIZ^SC9be3$lbupg
zMwcfVtnstqGA`CCQb^wJ%9nRZQ&n<`OWm1vL%RsexULsVEOU}~Ci1Ipc_h;FL?rNs
zW|YFa+h2r5x9zz)cjN53@JmbOocY)<KR$h4z^bg`-BaaUt{Hn$(+W~6FUIYPShu*^
zgZ)l?8Ati6YsEQdZCIz-IH>wP_Vbri_7nQ=C-Gon{KJczmG`?Jkcyt59(T1^Z`P*!
z=i7qTK7J}K&~!6!jbhc=XGs@gPB*iz`m$}ttH6UdCe;WYIq@W~t8&R=!6T8i$4>Fj
zyK(lFnU{#|4yzI~-($AtN*38(s0}ULbVGbX=duSMUhP!l4O^=3T{z*4?ZV|%l6j#@
zzg922VEa#0q-KqMce?KHcWj%KpR?Uv+5UB-u!O0AW{G-_#|H){_m3(174h8*-e3Ei
zuW-Zv;DShY(MRoUU(9&q=Fjm6JAF#wgXQL(W??#e?3Pp>H*$UU?L&@(^1Bt=!~|52
z+}VA4UQvRuKFii^DVbXirnyP~xb|pgfZ@YaJ_Qmpc|Y%Y|L}~PLAV?1ZuT_S9?fG_
zIx^>8wKYBT{&<V0qLbJEUh!&XkJeYed?aiFbT+X~EW1&^&{6i@Eyj7ZPxwE?F0a@m
z_GL5E$Knigp^X{bLWx5DDLg$v>h1B9RBwN%;AB1@UJwwx=KG)i?ztR7ZytX<&2WgV
zE~z5sKp;=dh7+QiHp}H%ul4`!+Vb&`hh_Vv4Km&>1r^+}S^fPMC$1$wHr*KYW9eH7
zmfm&U2PeBbeeAel`}T3<QNiC8C8GOsa|##K)k--`Twk_%+VW!8zH9enq;*m%4Og7b
zywP>G^x?bX$B%v9{Qhl{=F^hWlEyt!+al!NYMy!K^hzkM`LL$b#eyl@zsdHurdhUa
zU*|k=OJwjHt3rvp9KJ_m)smC8EMFWrTWi8KrQQSlpV^ETZ(3U}@PJ7>;@nHyxZ_*r
z$eIW?W_Vp%qy3I?PW5!x1^IJTg&yxw-}Uivj9Kqb%Zp3$SDtC-IVK&fYn=4hX<O~>
zhlO@?nwOo~wXZAwXnLa~L#}z@1&Oe8VX69FCcnF`&YAs2W&2T?)UeJaaS!}-7)!R=
z#(c;q+48^SRVPQ{lF!i_8Qnuahp{CH%d4n9lT!ZjL?x6l>(VR1tQYqiWqbZcZ(6-|
zjl6TFl%&h2GFFKV5o^=KcmGW=7b~x2OZs8;cbe|(Jzt);|MhFV{JlgyxvU|(aC%bF
z%)&b-PqxfGVLBuEO?2n4sqZcnpS`{B(#qK2E${w*{CTc(=F113`H!{c*R`&{e{jp@
zh{jhviPQRbEWNwzT<D#D5*ZKO3iN8uJq$hc+n)1e{n~ZcP9NWXxYll3O;KCd)W4li
zdrtWN$=%w%+`dyqsQ%$HCc(ZCjSbwDhx9K?FU|K?^wH;k@$Odum-SwOXLWpj3%iny
zqq_tm*B_Di`o3`C1^s5DtCDgpYsK|V9?kizvSas+i>FV1I+JWtclajryB6*<6W=|Y
z_gef{tfhs*)jNEv9f}IpmwsSA(joEa;-^=uS8_}3z4A2t+Y|3KJIp!uzOQu-eHd47
zVm<3S+gA0zT?T2cg~fuC4sKD?H+swUnfp`nuTCMK!xP!N%=cUfeL2haT4b5)x0OrS
zJ~#$l-Pxq#IKh)CEMYr;X=2`Vx7xa;u?1I_%nem!OWeQ0xUST4OI>e@TAqFU-v95U
z6nOVLE7>ZUyiNaj{eDBY@$8<L$8Ll^cb>GQ_aj#em+afy&x8!0v$gNb-FWz1+0$PM
zsyPMxZI>_o>I|Hx6?U!QhOBFMy(5$9R8{f0HyO8XS-7yG?}XKl-;XZtJ@7vz-uScp
z-)Y?+92p{i+~1dx!6)cqzD9SRrKDkXxRDy4S?21$2RiO7J+pmTE>}r@6yJsWymz;*
z^}T&MZub7Ki}sXoi~5+DzuBi`eBkyXuP5E%#;Tj2DU>d_wfDNducCf=#<X(P_3!4t
zwvRc)!*GoGoo7xxYx&NyK3n@$>-`z`FVmQRw6UkGvaLN!oV&=((nG5G$)0N~zCYLC
zU&-;`;Od&XGIbu8zsw1I_R4~qHy^d#wVoiFH_!geucIRSrcHLcWxt%s`KPMU&)>G2
z4PCxAc|7^Y6WFmd)h{?MP48ND+wp?u89Of}>{n1$6+ZuF*`pU*Cmsk{Ww_?h{gO$)
zP3+&?c;6hcle^g@?1uhHlRe*!4!ieF*8C{%DsHd)VTxWt{GZp?KdydoBFIKuu#Wxa
zr3cc_`Th$pc)RJwd+YXhXM3E@{PgV0xgzZ+fA>hOpBFCG<}m-4;!EwYFDV-$FK=j<
zc)2jRT;SdL({m61ysNdX-eNzed5+p8fv#I~Zt#@wE3f^wa2m(&nl3J$@7xwi-j|=P
z(b@j^=1Jqn2P~A%o|oIOEAH3@L3N&{^dn7Pk2@ycQ)f(Y`lqUMbbrY7HTfU5b5B}z
zZtH=^)Bb<y51l7q&mr<kM7%($*0_I;M9AM|{h|Li6pI-woMC0g7kT6HoocJ|Hl+s-
zG4Y)i5EYhvy-aI<l-RC0Io)s6_ei^^gr0I{IK;xM#cTDa<JSL+1ttLwvKJnU^xfQc
z&a%7h$I*|Q7WPl%eQ=|BeQSu{fn-kKOFK_0@wu<zI^g?{7j?|>Jk!?q0wN3y-VqE8
zQrO2FGYu{B^a?89+GH2sJ~8qBSM7pt><!sM**8xfJ8tz%<@Bb-Yr@MSzo=@;akDZy
z3kh;4FswMf^2`18)p0Y#Jx*OyoqFd}v&)$;V2~|U^Defg?)&qL$8{84o!!zkHE-oi
zoLKcnHoS0?(&F%kr<<SO^NhTE^=8r4s`YVl|DO1UANk#ClKODzlUYwvx3(3=c|ZDk
z@Zci7>v1BwW^b3N1wKiAy=qOgzFya+-rH+*r1*l(7On5PEt-8ezp_lz$}XAx|GhOu
zMcQ(=c57)*i@Q@1+@~v&?3W)M!F}el_sqN^qc1o9>$AMj{HJ}+eACM{5mRb5$kgsU
z`RPhd%;TU&or`f{C9;ct3)lXcc_;Gmry|W;n--~-h6?|XX8Nka^h_;$2M1q`QSZGv
z+uuL*s(w#@arfo#$Lr;nJLlL~|Nm1e_4m*6h2>>+hPMBH7|xQbUvPf@KEJc;%G2Yw
zr2nal6HDPT=G(ibL+X;-^}=~e3!|^`-O_v9#?f_evc&ffbMAa$XnSI&Xr+IStLyKM
zxV!+hS^FkxdY+QXoS^J~YEkdzrYj!Wd1o*D{;9TZ`kU;)Iz8!%thOEBReIOuU0J>=
zN2x~aa%kz!HIGXdbGgPI`I&xA@4&1j=T>dwoW3OYWUlstY@y|WeASyf9V0fkn)5EN
z|5+n7_s_#GPo8i7%>S5~-%f;G_(%uG!pX*UXA+KC$XD%{^CfoL7WTUunu<OG`VSHW
zmYOdK(nwgg!Qj%WyIjWB`%W*D^C(S!nYHfmtcg>e6ka}1*_L@P-I7z~XtN>n0spX&
z*=0O)e#|g^n<G`Ho3PdRX7BuEYun#2wB~=*SB^26n=@-$%=hhcMKyQIW^qUgyor@n
z*Y&iI{Wn!5SDCF|K|$xh4iQbMS<!2fh14yMu%3IqY5kooC6Nxl8qKmxD#e$k2<8{P
z*sF6oCeh{cvC4OOy_eRwsTocccy8=qv%TR~#ZCT}B%PmYz8;v_Ti7)3-Kvz$tFsSY
zHWb@r@j3tcPWvx^rkI51M*b`={cpd)_`$uu`D(AMcT7EA!7zPE{!UZI)HMF^X(iXp
z>UB0h3SaoIoxAj!*+r%mZ*HD0<vctwzIUtS{o}uOs`1x9tD09_{3{}Iz2~Ntv)|16
zGk1skLcLSIb0@HQepQ>7z%A<S%dpMk<?T(ewP*BR?>Oi2_>rhjseo+#&jQ1DIq!TP
z9*{|!Cd;UL+THA@kAm)H*(V`Yi7y%)3s%lP^X!e}@6AW=rbIPcml-tNyf5qDf3dcb
zhcoEA4X3QfvFG~B#g_-4;+pY(p6_NBvERw-FLVFPX!%w;Ws2s^nz{Sr_kL{8N}sdr
z!uDl+0$)z7dwy?K?&`EZkNfZBvc(rfPRSOU_VttdoM-M6+D^~8@P6^;!{*N)u8MuG
z^-jB}Jows6l}pP-&OWz&tA6o^f#kkdl3TWxOD^TKw|HDP!KsNS{yS5s%!{i(LY)qp
zOndfG=!Lv|pSH!C#VK1fUYFi^bwWd6!tX5g3qRumq@GqgG;1uKt+gua!x}M%S9%F0
ze3l<p?`?RzO38KCbBUnqsj{L^(*9Jj7Zv>0{P4s4HskfeTGi{~6V*B$o!>>Nw^;7x
zSin*KaG`_4v$z85o%?T0eqY@rDswLC#h(X^SC(HsRIoZ|YHs@93wO?ltarM6ctwdE
zU(2c{11s%KW?fBfPr4VDYpY!S#BFo*qWtQE2NHCyH(59}GN}p0mok`co3SFpdKJg#
zSc$+{?oIQR;)GvS--zWkPQA24Yguldb9C7aHbb6GybB_q-OF3v`L4a}=Bq~YUwf0C
zL*t7X9do>I3LoOk&)ZZc`a|(V+xnbI4;Fk+dbIHzA9J$&WR)AzyJ7`>gjUKjrhi%>
z-M&miFUZj4O|{0Y_<*q44-_xE9ArAj@PU2Kl}-C*-<j>il)dxZt4$8c;#x-zOi1|f
zfPWsBZgE0+BI}Yfzvs$qd~;&rdIKd@j+Q;nyX8xGp2$urXTGDW86$U6v1FcRT|#hR
zTJ~%ODds!-7H*4lHvAlL;kIr=o5Hr+uS?#Vgc^pcdi$*77COuua?a&{%<J?J&&DL5
zz!!2E7tB^`3Y500xtsWwE_uUaw6<NQT4{pgIVJW+3zo?dw==f?^3AelvcBo4n^A0b
z;lq!8>o{~AbIqnJOx@kMYS$5ueD(!O-<+>kwej`6$~B&1?_4c;CP=>2Vb!h0eQ%xe
zdLviLEqT^hS6ucu()D7n+;fdpS?0D8J4*9-7G#9-d{~iq;GG<gX5va)3$KQQ&o7##
zML+bu_(VtW?N-$p(W%X%4;h5@&lOBNG-cbavq3BMk9}L_HQRpjgN(bvhwqdna9%EM
zC_TVf&0EaD$i_c|S>l)oAInCs1zjieI-7S1ZCkj&t~F`$c>`~ji|uLCS0>JG6JK(*
z^ioWrj?eBZY|QNPn!-PGew7`bW>ym1-BK`5>fqXgiN#?l9P%q(>rC1`G1(<!@s!|8
zcWk^gWDft*J2fj!S@(5<xvJDl#aHfAKR2$GjYyB3Cb8z5hJ@YOg#D~hI~!tU?t}>V
zc7N<r%x^k=cEvI&IotFH=Bsz8t+ao!xWRi{*RctOnWyEo@9|0BzIcD-5p|*WwPr5_
ztu)?D^XpPs?6X<0s3>PnY|A5=#RUzrTkUwiO9Td5zFqKj=XXDy=jWJB<(j|mX<E?I
zaYnN(R8HuEdWvLerS-Q3SzG7+%1=119C<J`%)(;V4zKMOWqmiEpEkoQdLxg~(lxKG
zcIR8D`%1sG;Hy2HTzGqVYxbXvlLndXKOL3}<bJIeulsS`NV_HBI?LLxrkxWw4<4v|
z<Wnx1nBdEyFl||MM(Qc?9KR0^A3x3X<!xSa>*)I(fflUFjvs|QE~jPtTz5Zdb#^mT
z!K9>{>n@yBP2wz(D=D0P*6Kjo193aKAghOrFQ?cnv0asa-}-oc37fY^(C$^9o3)B3
zl++%LVOu%-O;_@VWp~YdvINwaH|VNy{rr50pK-kqM@QtL*;d(}F8VV?j`7%9JWS=<
zck{^oE!`KTuev@@vF6d5botxOV86aOk}n@c^h>RA^0>AncIwK@*026py|w8$;j>XL
zdY$Z!52r6yC>--oHLWUr7VGw@Wc8`vcCT|Eu~+-<Jo$EO@Ik9%E6nEg3BKIC`LOw(
z9A$%37Drgm-u(I7UtwJ=qx*w&1CJ9u%9+bjkJYG}E?X8m%h&Z)g21Vbr&i>7hFqBO
z#N+wXxPGzg72STV=j6F7E-qT_KYw{5i%h*q!zMA8)n}ALyqSV>jSuAWF4-=2jXl}2
z<Kzi%Evsmby;Ji=w$D(xc|p3{a_@qj<wE>NZV1lWpEs?$^!Dxc-xqFsR=#={YO&zE
z-5Z<#pR6<;Bn)=!3!3+^S@ps8JGT}-V~>s6>$hy4ZS}FPKB>ZMuKT$8riUjrbw-+H
zRY)<sFI(nU@#D@-6|c+Ja-`c#ISyZ$|Fr&$NDPm?PUp?wS3e(o`Z4!$VEC`Y=cX$i
zjd1v2RP%TD2i5Bz-8Y%F+phX*8LM~HO?h|BRR65yYZ@l?-gRBDeu;3yrUtGJD=MUT
zb}71joRagtYlTk0*4{YIwkNyJtar>zTVSPrp!L3-lDLRQWp`%dzhexc(++T%|503R
zy5i)0GX-_cy^~A$9r(Bl3KyTuwob{tenjUR*SoWy`q>Z8Z?s{*`>*52$x5LuSN7<y
z>iqNbLh|iCW*5te{{9`IE!XD?8+hbg@yS_c|J^{p_hr%IcB8Dk9cG2s1Xh1IGwJrm
z?>>&7&OE+8>C(qf*AkBI^=@LESH4-PwWXeo?Q(XaxzknCg9jY7F3b!_FK%)D`T0S_
zL#7ymhl}orOzVDj#Oz^u)x?Y5j;m^!FWMeCEWP$|3Txa$7c0;G8`>s^&TKrn)IEE_
zq_wl^kIxCa+Ub}cegEdXgIa9-e`j6cJ-x#+y!TgE^NcvowaRbq*hEEFX?1aLJTv)5
z@TS`LlF7OIEy8=hKm4=$c&5|_D@)s^J)PZQkzN0PpFI8H!~NP&zn6?HXJ?kQccv;?
z7W}ZjU-B$KOl7T1^^_^ExoQ?VJiQm7d|>L*ECcObH_{vL?d^Ka_<62^^GmiI!PD0o
zMUzyMB>qdRu4XK*IJhb2_`SVe4-Oxwe-g)Fc(*Qm>FrG$e=O2fHt^e}D(!V@$Fe!A
z%dIlDZRwUc+*7`Icafl~#c{Vjru-#8F0=f6*k7sQ^?X6OQ;ylpl5Ov9tf`*kKBfO_
zTHKN4>-Y3L+kTb#HUHUL20n|=`zAR@ZJqV4LM+GLV#TZ`W4G5&iw-!yvSK#O$eJOs
z&V%pW*20NQ6V^=sv@1Mu!3>rz$vN4peBMm2^Xl0x&v<1&OQki7%IWUI3kwz6d`e20
zSUA?U&B|A07JIWh|B8jAm7eRdvyW_V_%ddf{k*kxf$0Qk^||MCUo3SD%U0WZTJo}k
z^Je?`);(6Q9k~KTgM?pNx!*5QU#`Vn-v9gCS&=`s>+b9d4V5;T7Pb5d+wK-NH;XKL
zQ9u7PY|m|P9J$qdk9&LPR{4;4tMAR<c6?v_-70TU&HKHDvjd)=-<5ONVe$KIz3m#)
zrb`@{R=IhJ=<<gi`rn_2#kJJDiAygRQF>VVy-wf$-&g-#^7mP}nL^&IeYpSi`ivV3
zkDR{u!$HjHFw^#F7OS52MrAG*USGE)!g6cjhMoei_jiP{9>{hEd085`m7O`F5hTcA
zEb~x$Yq*Zl-4Gj<@I?Y~SN0jRIo@=6?JPO7QK+e+V%d+IJ)Ln1#=_3;Yk8KtZrRw<
za;xGtr)u_`=%2PnpFO<4Guk@1ZRUh?8ya*Sj`f$^%I6gP@L5Lf#HTs0*re9}S$=w<
z>B}N^v!tC<Houb=tqIm@@zr+7W=Xof>ty2eMlsjf6^@~NHgU%9?kX%5*qM5IQOnf!
ze|hnzv;$c(e{P&UozvAS(Z<)z^xkhb*O^v&)gLdfUc2HQi~ni4wD7|g)AxONKXKy!
zF#8qV@rOIpm&e5$H97E9e?9S4?|}TN)`~Y<e`xuwb6~u9XbY!p;pXY5W=n*7UpZ!?
zA=&$Y^P$@JQw!LacKK!*A3giRWX``|?C#tVA3Lj`y1U=eoxXTQ_PvLtJ47eGdd9u|
z-$cb`<Ftqsj)(WodDht0eRmDtq==Qgev1v7cGd|UtI<4^es4nlkI$z|GaYZ)O_8|z
zRyy?OsW*4nGW1mH&$<a4TvN*k7x~-s^+jmfEvL+v(?gu+znXHOaW6yh!bdd=doJeP
zcF~^9`OCsd!P#KS#V<^2l@Dy>_xjkXtaa7fI77Iu|BQ@wwHQYhN5zZQSz<>I1>g0{
zQSq@Xo1mwqz3Xsq$RF!PrU}Q-a2&O&ev%ydGC=0`PRsVFg(s)kJ7uYV=hD9-<g;Yn
zrCg3qW@%PtmoNJp56hmCjCd2^clZ8UXVocwJB7-<Cf`jy&eO6%!SE1QqG(90!0KlX
zQDq6K8$PE7fADa>x>ezd^1jHNJQKaNqLk{M%ilL9%RjVryKrL7;R7KqNiQe;YZMi?
zYIbLCyPvy*S!j>cRu>z`-F(&k>*Jc;R^NR4%v9<whs+#@eNDXgj3l<qQP69BSa^BD
zu2AFor<NS5{&tZ&=6-1TJ}t$Jl-=QiruSAY^Qld@xKWmU`R)yg@1|8ho%-}L&hH7;
zT=%v-bXM-{T7AQp6Qvcae{$;tnO~B+B=c7A)a9qYX012abzc5Z>C1vFou@i08utFK
z5c*qGRap4v;g>`5H=N7mC&`{<_;cpY%cA-asZQmY{zX&HocZx?=Pn*U1@T|^odq`T
z;Qestx9~#A%6#7Emd!glmREnQ`4p&fbjvOy={G7q$Mu-Rxtrn^*j(<p==)+;rf9Qp
z*UfZ>J&Si{JKUWX7sY3Ivqm!hS-CS$u7;x_!=@~?s$YhJx2kj>e2A1&+Sj*PMn7CO
znDJ5z*QAO_lP`X+e7n4T*B$$EZ&|FMT2V|gV_07BLA|^QPS>UGO*_gKqn=veE1(^B
z=aH-7G9xqIpjMl1?)>1Am_025JfXEwi)PDptYBFm{C4M-5MT9kvy3(^sr<cKW3uGx
zh60C7OUYSvW|NGn?AYvod753>XLG~$`CZl<D<9Zw7d>1!@2GG8!{|kP0Tb+d?=F^q
zz2<wA)zqw1!!<t^Yt28Wo-DC=RY_&qs}lbw^S&;+^K5bFj2v?<#+~im&!zrJ*q=AO
z_wY@p2*2-JjmkNCwVSP-FVDaKB3YgHxxCN+35vy)ZA|Cyy;GDnSX8uF=wrz|rN1@P
zcdyXTn!n|}kL|Zhw`HW>G_n>gaE!m(6=v_M9bQ-U)px44mD0_h{^7eH`5B(RpMGOv
zQd$4Ix_ybK3*0Ym-+g1L_y1Kk|L;|aJl*c_Z=<N@t406%vx8jz#`>q-<bAcyLh$eX
zN&fGSICK6InOXS9r-LO$bn&W+b5~{u9@yj%dgBGB;i}g&*;sSe|Jl{Ct<Ex{ZR;h)
z<PU2O^=bL9Sr;sI^KYCmPn!O7=HH>W>z^7ilx|+3pq~9RYon%*NVAN#yWRI?^Y7J4
zRbP$W&7}UN^v5yp3#;3lo$H_WzCE}-RHmfqmGr7vjOkewX=PG{b4>XUpWW0u?}Sot
z*Z*yr(LyR~<`_Ay48CzWdf$b=I(=rMj}}Zi`SHu%?n9e}LvoBe{AV@vy{i0}e(>`5
z`;+EKY`XYuZ(FFR<IX3=KPunLo!b08d*<Q)zm3@6E`98|d~LmM+l@e;#LC^LmTs<>
z*!NN<HvMJ`lkZ#M9X?--R4Z=DPiH#4^IVrlg8iMv4vQE2lqb!-xBSmswg~pWGx;Og
z4(31JZgu>aetO>5oz~|=1Xffp?FxRi!dqfj-8YxQz_an{um5@qIx5W)Uw3&oce`AC
zz=6Eg{?iPsUr)Bq+1twTW@*XU{q;TXe|-OVbhrGK$|(Do2cj~JW|F(5eGaSS9oV|H
z)=Ydp`#10MYrkcmEm`<u?mYPjy9e#^61zW?YD>k6M$Tpo|JVLu``k0v7YF>?Wxh!w
z`e)3k?x>tM4<6JrqK+d*)nxX~W?^7p7GPkI!!eGSoLXFxUzDp?P<b{yH~+Soz`u3z
zjtk^f7&lE5ljV{)F+s`KXmPHP$*H&mi6))7!g@w4CxwXVpQyh-agv7DwqTvZ7hX2!
ze6BcNJ+FFk{KVC#`S<(UU6h&8a&isBvKL)VGbVixop%4w6W^K#dzFswxy4acy!yoK
z=Iif0inyN`dz|xN{2uTrtGCL<aoe{&Qy*kcTDCgsD$}JY7fO$|DoG~Cq;?gl?Jeun
z66pGTNpFR(>rLL1DxOi+h0E(cEx6!(<=>g^T`e6Z^Wz!(6Zfa2=1xz`IU1e1dheRd
z$R6?QQVyQe?^>n4@K<HHZ&<~odFcH6EzWBX6;3*LPJjL6FOSz-mrR@4vZG;6w@;y>
z_0s<Ov`22gMKUV_mXudHmhIQl3;uii^NTK(!cV`SdRG1UeDdS*n?G+}QT{PwvQ%2o
zi---+gma%VpPhO=e;bFi)4B;|1xwalzI!fm|C4uXSoRCvjM^0_prfrn`|Gnad(JFT
z+3|(_$*BWV8%wq4n9cs8T&Y_$A^6D8PA^mcN7-!=&terG1xFof-4VpJ(arb5BjbdI
z9;b!Ar;Z+qIz5q9)re*Cx&Z&^zt5l9tp8XyP1!eQjr6gmz-^@pY0sC7Ke=#n^8x$4
zHr4-`v%J^7bw6U?asQu${DbXMcTZ1Kl~G&Nw!tvq0GD^O(W*-(69U#LJz`0I)uyO2
zdHxB@bc44)S8EG6N<?$_<=uGiw0WbZwr^+OL7B=f9oxkcWk=@NIK)Y}i*q0O@x#Pq
z2V3cBZprJRjc-`{!&b@f&uV(_Kl|+4^C$AEiav<H$XgfmIPrAj6-leo%cbH~-P!N*
zcii!a|D74~STr@li+90-sqd0f-la3`mTKO+Yi&)C;l|@k+q~ZNlvnGPeENH9$LGjg
z-TSN8zNp&&eeRy6zcX$m_uNs*5?72b)?egku=}~(N{6L~52T!5uwvI7%XJrTSslz>
zP`37L1S9|MwYSqlrtLCpS@^p4vOaTmDm#aEu~iAr_dR>s8&b0^zTCd{xczV3?HSF9
zdi}q;?7#ev-@H-y!v`M5_-w5O26GpSo33fuHX-Uqb#}(=3g0DpT%NI0FO;@U-~Q<6
zH%{LT%MNEIbX8`@eV^Jpng2ao-eaj7rmqjLON?r{yQI^jbdGYbL2h!dY7*OO*7#|C
zCnQSM>y*8gI_i8>5U#cK=@Z(?^=7N;xqL%krsro?s3znI=LxnY+A~g9ja_;wh56Tp
zxk`sGhy7dJ`fW<q-9RHVU59I@o4RZ#tqr^5-FP?n;LLryc#nRTT`Q)3`^oBg`IEi&
zKW$riTSWWgTgI6g=TBTbTG}+Ve92PxWgPu~0-G!ZC1foeq@<T{n}7VRaO%&}KMP-#
zFF1d0_Phg5`{VC_O(`pR$(ko-rRUCaZuc9h?;2a)Ex8tvePZ3SMDv~Ar{d<!nNrJM
z^j1S|(vIo-?5gK2_gF0X)}Um`Y2U87=BvH8UY-3m{LNY$?PD%=D{q=d&M{f_&s<>k
zYv(5}**s|<=er+jT>V~JpD9~U>%4RBJFEZFD-Q9jf9q-HvNC_Ivi{s#J#)mKF?F|9
z3h&&bcY)pCzoz!>@<`ABP2XPa|J$GV!+n|LlC}32|F`IEz3^KawOET>5zrgV%D}Kr
z5a;wrR$^JAUP0y6h`XR7t^Rww;}ZT!Ofw5U8HljiY$?8UE_*iH+UOhup2lhC1f?Ud
zXq@Vdeo}uwaLGQM>dfs6kA8XdqT>Gd-PT(ECw{-~zTdvSk|UGva3sshN7;NuKJ(Ib
zdJ-%A+?&-?v^LFsV!l!7`Qp#UM*WR@8e^8IH0i1+-CiIQc)+arU{n_`XH)4yE>1^>
zA8Nuug432c86I_=#m_cvnxUwAP3YcLvBxe;A1X51o@I9H*s2GfAuBaCqtf2bDciBk
zb={G)b5D3R_J20>R^IXbq_>Bo5$nb5dCKjUuV3;UReQ{NV$UV%#-;#PQQHXao5GJ)
zGR^dSGDUkDbFYF(hL=gyGNsU-#mt{$**2Hx)_h``;dh;NLBfi^t31OCo=*-hf3e`<
z5fw*~6ea!%Q^MbGpQZTzXHe?uO?!?;Y+y=d@M-eDm(Y80a;A;|quZRYGZ{ZW#VP6q
zJnHS}a``-c|9b{oZ~IM4R(RgB)V_a?;p#iqj>R9srf<8X6LevtvcR<zzvuNa@obml
z^_Q<t3)er++~j{<IQfz7A@-={e?R%?E<AgsXj#&1(<KKLd?MyezJFtyq;{TtPQHzX
z>A7`rdsHWf9a#67^Qp{y3*}#zJNjhK8@O#a#`i!o-0{J)32SOE6(!#(J7E0rmAbys
zgmv!Op6e~0WFve;yET@(iX|%D(f_)#ZjN;K3x%U<x19u-yA4dw-QbY7{I=VR@3fq7
z<%^bXUXd3iSMDY%pD(?6?5$K)%8%mM)oOJ|nog=8^laobo+NTfce>J5VK!|&#^!Y2
zm*TQ4m*efu#Kr3zpSyz3WbN(Xx06>*V;4y>-lW1V&3(2zRPCsG$gL2MX}TZJ$Hqx~
z_MUt(-S@L}kL>FCNAFd3?%kGR>?s#s;O5?2Q@(FUX+wX;%AebOvJP@Ci}>|*$1?pL
za`N%k6ZiHRr|qcSt^M^%$=pq+9o=tB@5>8X$53+pv+0z`i7QSfy%hF+{`zi;-q#tE
zKcpYrIOXZ;@(Ub#XQIoPGmfyt_wJk)=ez0P%XOAQhcBM{*m>?q#Q8Hy-U)`wt)jdA
zrrkgF-RseYSiRk6YhM`7y!uP8Vuje!>&3s!E@#hD{Z+eDXZKd~@5gPQy!I6Q!j!q^
z+gj825=Z`v8r0j!{XcH-XWxt8jSGxtzp6IBT`#!7l`qcznMumdBH7n{)5=yE6l$zu
zOO4w+Pe(0a&)EpYqiOE;J6d$N?sh3|D;N3~S)Q==)IV3%6i)7gwvzLHJW;XuD8;pP
z%CUyCyUw}2wSN_*lg)SMyw#oa^S{a-I97B<^02w#ANDibmiDz?`_#2br`e?F`nl<G
z2lx+8x82QeQnpKtA)oX9vOP;zOuPJ8<;Vh^UHma?PDO_(H?T`jbJGZFzU;?ae(~e7
zD?Sh9P9<L6`<quez5mmjUw7X;{`@nwz_9vz&i?|5_kpi=2OfF4Z_&-GU)w9Ak8XNu
z8y9lz&pnaA>s5wPucBUhC$yT*z5Z&cV93)wZU?{pxc1UiO1^E`#rD4wYkpYD9lZbH
z*6at@KW^8b)6a2Zmffmw5u=uxMYE-Zp9=@BSQGGb$*#4NMVIj=nj6a9*dF$4{shT;
z+lrfZ+?;qj<jzu;qdpUje@*E-G1o(OskaG_s$R|kV}%*=Jdr14Rnya5l;6KuK5d`J
zl%vhRXRNoVyLNm<Evw<}BE`(=OK)oXcCpQy7WMA`@~Z#k)~EhmZisul{x+u<|JDNy
zN+(qAzv>p<CAA^+oz$l17tiWWipkYGsxxyb*Y_KIjXO-ew|e&8HQKu|XY0?D#D5nu
zuB~>h-(EN^A$j-mt0(H`y{jpzy7h)ZWy;}wKcAR<j7(mue=&ITL9N9658|jrv93ov
zQxr1;gB1tP-7(pzm1T)JdIgnJL!+~A8;I0>UoY_GpqYx2bcwk0akuGt3tzKJ9dpxg
z+t@F>wl76xXKvW9`{jN4g?g`N$O%RMI%j!*=c|spG4=lp|ELKEh_y`?nKF4Mi||JO
zR*z{0HD}%L30hx0dh5i|OB=5*4$o)*@_U}|^aFYavW^DrXpa%so|49Q<kV-Q#o;=A
zn=egedo<%@=)&G)C(XAllcOTfXP?`WTb>u|u{Gh)rp(2S+nXM{xAO$Pb6TFt#~k+G
zKV+G73VW>J(wK9%i&x6bIK=SpTx+Y?vM)cI4Y;ipHcvR#y3Mdwd3}%X&o9rvTG;)y
zva_8ZQ`c$JmK`6zI(w7lE5+NlXT9S6#XE2MlS5Hue6On~UKc;um!J3~)Jtu8dia|q
z&ods}4^8^l@Kd?2=8XG}&3<Q6_3E9goZ9n07_503e8PY^$W#1yW2=qyhFMid{>UZT
zui3je^)!=@z$d>oVjSiSA&0{sOtad$M<=L6v*J}==FgpCE9I|x+~VK$`gz+8cW>1R
zSF+4PIAzj>n1eXB_ss1RUTd_|A@*EL&JV`TpCZ-r+U7smzVohtdBW*CuGJhp_b(T>
z7p2MOPOP1fcd~>r>-dv~Mz4~tqZN;)>q+nX?7Zq!PV}x*Tg-H(bFKE0-L<Us=@a>%
zED8@2dDgnDU(uK}(@rV(P}0h!A0!r({0Lups)BdEtF7pEcGaqkzK;`K3nD(pE&1i$
zDQc!5mb853iKX0sgmsRGw|_mD%+#8E-!<;g4T;=1F6KUk&_j+6bDv8ZX8a89n|OMj
zb??d5vrow_%~${C<}ruu?Un~uRiwk6Zge?5o6ouC=oHJdD~xVlF6*>$f5SQNcHHWn
z57z|q9$j|nwqkI7F8{1;b64vfyuccIwXEjcg(``%w~h;zb+4>tn7zY1JYY^p5VOx|
zrS_Tomp(srC!yrZq5ZNOcDIY|%$%zEf62A&|6dq(H>zE{nGqa)>DcF>XMF3=x#XF9
z9$qv(Ol!$1A&xie;&0D<k@<4l45QPx*Xx>m+z@kS?Ky9D!=+2PeCiE~1HNC%aJ_qA
zt)4Gaq1MTz(;HH>Rb$q7U09iMe$Tc!XFkP8t@^*=uC`bY|Gt*FyRFsAOwEoctbV3!
zH9txB&Gb0c>$4ZLd|XkHG0WR=y-UFl&IM<_-(NDze{tFCjal(6_NaMMVxe934n_us
z9%cpxS?s;O-29Z1)Z!Aog38jMgIRYBME1PamV1&Qy+@7rOHzi%%{=MJDZ3}wZfQxH
z^7V7nT3t?0zgg4%RjZu773#67S?A^6i#=&IOxtJs-xs@{(;oA9QPu?MYepfeHB(Bi
zKYX;tLREc($S2Q@wdoJue7ReFqm09R1#3H-{08x&4HgC->`qatY%5-unJhlEi_Oeq
zAy2@$)`e}H>rU3B%u{(>y+CT4@fwc1*)=hL&B7+X-7k3dMl#>O=#OD%&ayscn;Mew
zyn2;k!_FO5OS0A%@4m(Hc3R5@v291c{Z0$j*AG9vI_vLJm4xHoapw!OTa!Y1J0F!g
zgdSh~f5DtRhkPIXQ-9aPcf#|+`pCCiDi?GKY<j(N+qMN}ae=>XO<1EM9J%%1A5lA(
zcS}wxNF^`yd}b|`ldI5U9DIG{v3+M1CxspRWE?T)a8$vUXFC?UcWRyOI?Q`>W6FCi
zHj}v-C5ESt?V9$_Hsr3yl1(9{?X~)oE-^1!{O7`-{A*Q$hq!kOBvg2`%)7rRHY!yn
zmX9y!)`9gi&B_m6m$$4~efq|C^LaLfOHM9T{+M{_XSuwZP`XZG(j4WUZ*TaQ-Me@_
zP0sks_uHpdRLHD#PkSPX8s$Q}e3$=KW?)F3#=sztJ<1ER)06Y_(lXOQtA=d<7T-3T
zw*U9~2gj<NGqsHUZoPY(>9_aU>S+HvCewGkeY-=dRY|csyX(oMDY<j6|Np(0pMk|A
zK;HA#+@02`$0m9_c=+()!`g?87T@meul*UX{@hb#lh>R%N0nAjc2zpH@%tK%#Y-(J
zrRK=VR_lLC3RVk0eXF|a*OS+imoN99UnTDS@UOxuo6kvw%9r*;IHs-_d-&=_M&L8;
ze6#2^uS+%4jP)Z$D<i8Dr#&r=P_GOtoT%X+EO?PQR86eAVD7a-p{p@!e6J0>4zCjO
zmHgV_Et0s`XY$Uf-(t6FxcmE_yx$Xa|CR5=l<>HSN^zm%4xv@bdGU9zI<Ovi+HMoK
zJn6~D|LHfC@<pGCzi0WP_uJCvy3@Yvtj}Jn^xo!A4(#C3kWpQfwLe->aUuV!%D4!Z
zpA+l$iOu%gYqI~<%Fln6Z~ol9*?jZ#^!I7@`}SJ={&==J^wJR(jdkl6*+i>^&#Jo~
zuK(hocW91rmfXD5ts3HqOMcIJ(7Z_GgE<3Jx8w%jlHQVOAL7o{{rLFQ|M~hf`~6kl
z<u1<H`!Ds$+`X0cAK(0$bK&rPd;9A0Z*PA7)UNxjcK!$}L$QewzxG0hdUdBK1`>NF
z{^IkPuEdos`29-jJ@-n<Yn3ZKS#4JzRuNV;>wIkcDeivTQ_=dPen&TF*95GLca1yy
z;rqqFO&|1{y7%v^HLd>mceVKX^Y{Lw);u}bE|uOkoAYSoF4r85x=x#WB6%CHSI^Kq
zRB^kfQgGT-jkDoy;-M=yKNH;k@y*%zbp80fU)37k`%5YmXKrk?ym4gT!QwyFjC(~)
z7jf6Fe^unQ;oSLo`^^~&e|}EMo3^;g#Cz|4js?13o_&4mP+nv4Oz6i>LDisi9)_8h
z4}S^T-a20=rt{zSZWU3BO@CFB0$o#`*8k#Od%C1&#cTGfRdVX7t)}NDuiEDQc#h{n
zdE51YE(d$=_3W*jxBQo(&qpJj#(TS_$xO@KeqxQrWa$M_^%sNw)Xts4W?-t&&?V)X
zvRK7ReL+>mef`5hM}8&pEBox$EiL$UHp*wyD!$7lY|0x_W74%}X&aw(w4KuMGSQ*!
zW<=ZOjEQaGw$0_tU-+ME3X9F0dho`bNuE58Qg6cLDhzb^^!DakySs1RzW%>a^UR-o
zDlb=mf9%#0yDMW;@~7>`vQMAb7ZF~%FUj&@RT*2u`(>9kPjL5MY_NKj9roS*%L3(g
zcFhO2pV*=euelW0eS3G#F5%m&*99jwEKxPyIp<UU8}CgweDqFjm5}9q+OW6!>wNpU
zdvDvu{pR<6f2WAIan_CM-UI57H<)MkEod?4UM;!B`o!~k>FN*cI!70lf8zaQ{W`*g
z%kiqJsP9A_p@=EZ4u9xaDi)OyA*xV!JEC{Z)H;FEA42myU9V&aE@ghSMC($4aq`>6
z^OjYLY*L!oWl_Pm_1+Uh?d%2lYDr?h9p1k`v_<HGmHE$03a7s->9)M#_*ynC#nW~+
zuhvAp4Z<pEywM3yGF{vf46Z4botVb5$~$<GuvFk<x7mz08Wu1`O*PZ|qRqmW|H1xu
zYZh1Bs`X`!Nw)J3hUB$q&SF22GyQU&V}eEWt6irWC*2fQns$eMiSr$6FHh4&iu+RR
zaye=Q_lU<xua@4&)e~jArE#feneFb_XA9<KP2!7vThb6x=(lC%YT;$aJT`UsN<2+q
zv7ffF;pOUGj?K3!O(o<q_wghflt1P0zPF{#EmD<ln)ZrI9BbKsoOW(F(;m^JI?;X6
zDha*mhhN&4d=?8y&bTMOR{XeJ#7>K~d#sMHH&D)Rd7EQ7^TO{Wr;eRJSnhw^E+#9I
zTqmTMc00p?X|XTM)tu>EuYAvMxiI$)kGkE|y&ImLe{S~Tm&!y-9y3D@<3E?voUX2{
z*Se*aTK@R#xesr=tQ;<MW{7$7i(Z&&tH}C&XG+uN<?H@6Jm=zNXULg$q**cI<hDKe
zUXR*KS3bS3VHPH;=UWiGS++*n<LnMztu|w($#(mW+?W5jyK>&K6;C{)dEMvLONYfZ
zmNEGLuhO*He}BSf`ONOm6U%kYwpU74JDf9ZU00M~ETUlUxo_Pb4we^T5f|o2g(=8g
zNSJy2$<_`7w+QYDySIiv2|YCLbXWpcCxg{1`|igoyEpCfVKI3-@u66?XkhghKdG{Q
z2EmEPPKcUbP+xf<rm60jmCq*8^*bZlJo<%JwQVh*%@DXKbw(^_iug*sy~_{24AXGn
z?Gj<TcRM8E2OEpo(Z>lpCasF%ej<1%S6bwWJdd`kh})NEhq&`Usfc-$<~LioN!<Im
zJ;3c|p75gOzf8C6i29`2X6_&>8GLir^KBee{72Y!D%MFGrrgju`{rZqeC7$FQY{|h
zDcxL_{<prI@D~-y-Xc)Wu;c<?cjm<D8d4M1-LjaVX2oq$Ep+(7!-gGaJ`|?w%$g9(
z@O1qFi>UCV2d_0!7N||V$=g?)T3M#_`_w%KziF2rthQ%e{$cIL{N^m%_I;D~UvMkA
zaIENq;it0Y>?Sf+GYwd@Q&*oU73i6IhR>GCVYlwB$FeP~pROi!pWvIqpK@48Q(&F1
zx%-qGjeD*bcGvLgTHpJ=cxCIJ&3vUyy-b&ru9tc&jym>7PPS;XcC)dA=2G@W5_?P^
zA5~0#@NUNL;GTm^Kjw6$m<BQ(>=YKbYW;=xiFV!X#iwiItUhWw-LWcLQO2LcJUzne
zLhIXYR}NH8=FC{1%Bi*G)Ay{6LU)r=XE5+?d7^an^D8|e*4ZLjPcCNEy~)xz`XXaC
zUr}9(L^kuSjd4{`6Xw1+>9w%6`Ji6SghRY0zQ=n->XhGeUD($yU#}tmCv8jWg~Mq!
zw<o1tcY9^fo_;6&kJ-72YI?%Hn(TTBxAxzdb69a|Zua*OvvZTa=yYEy)rmVa`=y85
zLu<o?8SO`&#)bq|t7=4wmUMr(xT~c-z*=$VaeMY}DUKW|p#_qyn~V7lOz_{chwDT1
zhwU~e*?5F3_NTX5pJ?1%*B~%U%V6q`=g;136THFItIaR_joWgztb^^jHz%0gb$u6I
zvtp}Tl3TP<FX&^Z;^}6klgg7r*UGn5s_cE*_p|A|w37McBd`9vzsP<2(XHDi*<9~>
zG9<%fzP|hKyYT)A5v!P^cUxYHo;X`!FZ;dz;IB;?9@*E;c<t8}Z{pEDb1Ih2-dd+^
zK}STp_w~&p+<{4Z7~2eXdOk9(_<n~?bTw0b#gm-ZH>#(GKKNU4{&Q93x+KAbjs@F;
zpT6|9wo58G(pRPAEorhPE^eORUE_`O88p<@s_ZW9;tpfU=id@J^-f2p>}*r}Jmod=
zMxH%<Ph`)WbUe={z<S+~Ir)LxDqZ!ny8`!VCCu0sn(o=G!^eBx=b4Jx^+c6trF@^Z
z%XRIR(hl=#KJ<T2ncqu=6ZgJUaVJWv#E4B13(wI#d&A`?%j*BZPmjMhaXDvaIVDiJ
zZ06%9KXTHhOuKmS#f|Ejljnx6xqM}jpk`3pMV0i5;tS^40#aXtatfHN8Iqi}x&)0y
zW`)WHv8{P_;IYU2B%Zmc4|NZpV&p%Z8Y<M>zdd5Xnv>%5b{u9<ZfGb^&@xhVzxURt
zb6SSQp=5RiAMsNL1=m`>Gl>0=Qa2LjNp5Y(SJ^W?X<m!uDXRz0`BSZ}qx2VgsIfF2
zndtB<v~ls1YQ;UNvEo;Me0==#*D5YC)v(p;Uhm=f^yyXM)-(C(AJjV5P5STg=;Y+f
z>-Yb=zC8MiWzpP)TdQ*3F{fYjFjks<vHI-lga5=PI=}s2Y<*;Laa&+SAQzutc3SFt
zu{WFfpJ%w&eK0VYcSW>!({`rI0um<~`<}{u@Z&qH{NQ$rde8M8$GkQNrC16lnC?hi
ztL;;xC~nRE%*HbD%`Tg5!9~phlTL564zhdGzb<F(3pt)clm4<_eJ5BcmOSx9@}~Fa
zH&m-_wYb{MC8R3aSuLaNIm@ng<KZhoca|j^3#Knoa862ICHmp9p!3a$2jw?+s$a;t
z>b$JXWnS+d6&{27zt3x#&-}PqtR^qed`J4x!-E@Kr$1Q0X>k1N?&JHfco{5KU4HY;
zLQ&1&Qp1=_eEyMU1?p-?v+r(uZ}=*LWvxX}x|4OY#MwXF!qV<ot_`l{+7)bOwc2{V
zVq0SW98Hle?)SHAq+B;WY`oT7ulTZ`Pm#-cm4&7A+GhT1G>+pc<uW#BwaVl;e$P7f
zL9<}XHfAl}CF?U?BR6)<QWib-Bl520w<*yX5sA#stlLDcO(;DTqY%Be$cJP5!A9T9
zJ>O5P_7;#>F*j_7<ASJW#@1aIt{Lp`>pY}4am9`$cQ$@MsPU1}=XlNBV>9DdXEuo0
zf3-Mc_El)D`IhZY><h%Y6GhKIQHz_Znwu;7w&7LUsjIyQKV7V`IU-u|=0sL-&aRKS
z!J^t$$-DDdp9;lwNwQD>T5{vC&bN}cY#!eo9^9y&mN-SOjeCZuuC!_Tok|xA-Z_(3
z-`+LXv_#M)F_iyL*aXoj-K@tA&h09>XmV3NBDyClYQvc|_VJ%Qwd3AQ(0`HsFlNHH
zmA09MUd4+V4cN>-%v=95Fm&@&kCSq2F09>i6^c(Bi?zPSl*`arFzwL;X5SSombTj-
zyRXtav&U|xu*8Qr?!bls&c)dwD`UgHu97M2WQfrW``Mdt(^>oOgNc$849a2^_b1me
zFIb}c$*bvTsrr^bv)pXNQsY_$k6T4@3LBRk+Ho>+kKO@m2F01rw);+;_r*1}^2#->
zR^4E$tg;*Ss?oRhZ0jvvUv~5Mhbv|azou*p+p*?=O7YH#Hn;sgU*YzC7S&{(d}`IL
zAdP&7lLo(~)|v1GO?0`wfcg209S!Mm-K#hjPfN0NbDULuzrw$1xn0<)^`6=fF6Un{
z-mvf1R<Rc`XAcKmlYHr={B=X{%E>RQI+x63d#!XVM$Nil^~zhZ@26FsatY4X^+-Dv
zb-MJ}C7!k3A}7vI|7R|2vhn}ifBzc)`TfxU_p|NZ&*0hTT>Z9rGCY#%d9Y~m!^Zdf
zKl;f|GswRG>Qf0%>ar~*kqfe8Vh_FFSa)Gtl=i*8YZI8PHgGkH@d|#(c4nVD|D1D+
zzUC3`y|qm9SgbRvuHVg_aqvxBx!k@#F(FQ2tz{SEHD7b7vRqm<UE{(f@p=6J_btep
zzVgJ1KU;ixYHlxdi4R&9=e<oMs4HvkHEXeT87oyz?s;dkd*PeYp3{2`_b6^w-Sv}y
zl3brDgByEuzX`vIEXO{}D?idbPF(DGR23T66zQq2rTkFP-uB##yJ79SET-(~IHTJ8
zGo35P<?PC+``n-IPl{M|F_j}r)yHst60=iW$_JJ1z<fpiO^L5ortGp<_FUTfl=?f5
z?R~vh%9Zw=6MR0cUeTAW>TkXT-y&73B|GcgjXan-ORtEC%A5L0xK&OJcr}YLAX{I1
z-m>YD2_i>gcQ6%R<}lw>u;6|3?qdrKrxnyso^q@E0nZjeH<hTLm6KlbysfzY{C>WH
z<K^AAo9h`K+}+2y+pMH|<>zw|FHAOj{SLT%^sHk2(dJXhb6ze`@RN+2Kgp*zgyAT=
z-_%DgNBO>;Sa@$*e%*ON7wfCbWENOmmRY^+!wlAvHqPSN)+TPOSKbu%`K*@pGS8j<
zGCpRqspd`PjjeN4_Hf>pu{i7#vQ1-^x~Y|G#3Yf06V@*0)#voAI*}<A@oCq!J3CHm
zZa%hio5d^k0%b#fi`~nna!(Le_;kud=f;}Gl_H${Q`t^UQCa+ULgZO*1H&p&W#${~
zYh&$d0xV4ymJ2WAT=q?52Jc++);;wVZ5OTnCfquGRP89|pNP4Q4kC+7Qh(V7omPFq
zwm3t1VcY4$;gTIe*@Dk*2&c|8zxH>#IOA7C{^-q#6M5g|_^vW4v0{`lw!gvM)Ntha
zGKQIFIb>vSNxj{6>#B_CqHldw2_OHIs=f}mo2&a~)h)BV_cyY$-V&@~+>oSgvL*P;
z{^z`oQ;c~Qx9Zu|bh_T0Ww2zruC`0zH`$_Za}O5;%*)a7TM(N+H#Yreu3GbA(aQcA
z^ZPc2M=feL(mK)AcYAAcoP6`f@=Y3!Lie9NHH~7{Pxv!$?PHbW@^{1SJ1jW=X0i(`
zGzykp$B=O_a%$hAIhPsEiIgQh+PR5)$+Jbr_gl3J`mM9Rd_(4ky5_=~cl_H!_dLGx
z@ywAO`3nyo5^=nxwK)ACqqxANGm24_7p4YRKNndTb8JfB{mG11e>`!W$&h?i`q`?D
zUHwhdx34;}ll`(6cV)>t--AlmYd7j=?Pt5XQLAFdt7}E)zP?+@dDi@O<bOV^)fxY%
zS?@i1a?L`yyqmMq#LEsI@8nvx_?oJR>o$qdlEtSEKG}WHIMn3pvjrVjo;mgv&3F>9
zV2W>6;_~e>SyxKhwDM0}tqj?7zU+c6o7>#r!f(%Z%QFTPtMzP5choJFaV|H!x7cLm
z#xplrSTvkZ?4Dp<c%b6o2O%l<nus=*CEI=_PwDXaDf%Ii>DjvPjr>0(c<e)D=4>i|
z`Y6%nX0Pbg3*GkXH_cvh#(0W@{p!UmAxgTT^Jd=eidV1-cz0>%VTspw?Ijkv7XRL)
z-B=OZQPhy_xhW=lMFn%{(nSK_ujPCZRsCx?J#4>p>;HrwUJuS)_jr5L==}Pn$yV~S
zH)@s_v^y9x{@$GTd{fI*mlOSGJhW2}Ebv{st!rEJn)%j?uk4($XVtotGpjo$e5`5`
z*|vC+)$}&q$G2)O#z`Gp<GFKY%v0CZ?#)wdIFGc{ZQCRewN>MZ%DY#MtL*mJZ2c;(
z#a5B0B^PtyOSM_iiMMa3$M-GQOU$oy5IMK_=*(3DfkMmFHfE^Knk1W^kf1YZw<L%B
z^>c2Kr%En59!PZ9_K9oa<C=X_)z<L6ZhGkO_u*fbEAsrp%4XYl$feHOVRcr$XBwvn
z<NvDWqzz%W52}=LTzbAk*i7a6zD}hu8QI%WPj<>zq)U3sPC2>5#4X}u(`18I$&AW1
z4Q;#{w>BMVjh`HlsbF|uP57|}%}v=SbUsBgFS`_S#=xT6<;8zrp`e<1=N&F7*8491
zVs>Xn_Y@A<CGVN|{jw&eEwN@7jji3B?vu|JC1qeX>-G1?!V-*S2MRb0mU^>Bth<)T
zsiT~-LUQA@n?+0GKB}Be<kfZa)?KBzG=<%LNeWBIQKr{kAM(yG+q{K8G;hC5gU7_g
zjgDHMYipaYGt8<wqm+JwbH%BBW}7CR-xatqB;=p&_juWt&pOm*Nz2q<l-wne{Oh;X
zdd=nl_qmg1$%hqXUHoA)>5bs?CYOC}ZDrf;U0y74ujB3`sqUxjvsVPT_^{oW@p@0R
zf$+h_tnq?NXCHaE(d}G@%Tq?F3mGRH=5+0R6M2TAZt7*LCC*PiOt3NN`+Vj%E1S*!
zwP#*DXzVPHx3m4bsr`Ot&#c7Ev$0j&o2LEaKg8wl?fq_7V`*J{ms0CK-kP4eY5&&G
z%U^Xdv_kj5J0C~gdm4O+ZrKqo3lFL*&a`fedB0m{iOZCC=Nslrh;h9?V(7Kvt?4S3
z4v*O!2IqHhP3H-bPb<C0sIMV^eDPwI_{53?ZH>!~6V&CCPDrHM1#uUP8_Y6Z|Ec8c
zNuOhSN@h_N+xPrGUVZGz!F>L+2P)WYP8qa4i<mWy?{<=LF8|~ew~P9C)fbiUAHJz9
zf38$*_RekFrJG8{WIV-7Kipnn*^y@-(B^CU%2FVYU*p=!xT60PH%@R{onGDW(lX&q
zFvF|VJZm@Othss1=f8K{_<FU``Pa;4pIu+bpFFIl@!ikFug6F9In%V7$cCjXO<fs*
zr8S55tf<`l=g96ok7F&ZE<Ls|Gu|OKo6CPo#_Wb!JZm$ioN=FU*{`d91Jfm!Bg#K|
zE!Tv5n;M5dbX#|D%YhR;SuVMp|CVU@Yb@R~+xF?J&-MpwKX3K=COzd(`!-JBleesV
z4xFr+TF5b3x#&?wcXhIZecQaIM8S0jgB{klP0lvDW3|}w3PbCW^ltb4xi5ORbQk=U
zoHcu8v%;-~l@FRr#hP=s?3LIPvN(S;>$OP-cYo8CY0jR&U-GKe?H~8^CD|{XZc1Ew
z@oV8<zpd^0`EqNXsZ17%RM~%P!9z_4h7fUuHSgc2E^KdS-*0;$ahv3wo8AW_N^ca@
zHhY~no4_V{b@99}_x2fD6qG)W&||3aT+#T|n_I+WqMT-4#gjFf{j(RYOqvkbCRzRL
z$cf8;ZttJEvY&fyY;sc0?8#XNd{#bEo8KGse8KHl_RJR%LVV`GG#|)UT?jA8_@s9F
zr@z19>B{XK;q%MXOc-_^Xq9-|yye;6o{T2p*^(`mdyZ!Cu9FbZIGvoRuC%l5xaTfg
zKKZ}{cIF><g<MX*v}0HLxARwyZ&Qf4o+BT1`@-&9lVYw&zV-dCsaBEH@WuM4(3IQy
zie1({<@`HT+dCSHR%hP{SMrWv-Sus2^yKV6w+a`o>bdo7yRgI5^`||yD3-MLs6~kL
z+-OUb)lFYE_wBo8tGPip<tzS~xfXMZe#%WdV9Z=w_T9nv@56!{XQL*y1-5Vcbo5M-
z|BuM>_l+{9q3p&}r^;X0UBA9j|M!mw+v1MwQ#DJ2g66$i)+KOro4<C>{VyNG)SW#a
zoE7vp2-)&f_xX(en)(-!Qa?U=eliJ`l`)!AX|Y}1)Z@d0#S8RyooGH;zW(H;3LpM;
zzFM){oQ`+j;d*d@{fbZ#8`Cb=$FurO9`c4oZF#g@g>A<5QiElkc?lmB*!godOmLhN
zeMaWoBAM+fet$~$TKwE>e`IRsoINt!-}mx}{JF8sIa+bvn+<9`w<H{<d`>@|mVCry
zfkXGK+{wS&<Bj88*I4`wIW~KV^u1z-gWqz`Is{jKJFd>ba&vp1&5O5}{x;v0<#c%G
z8}xTmZF%QP=Vvpj)vt8g=S^SM%;Eh+cgs_zJ~!#tk`Wopf8NQIxb=G8)k_=Clrv;b
z{<zEaz-+U7Y0B)6_k1|`VSYp9{e!jD=W`_THI5YeizP4DaJ!YLCcUtCp*8!pwx5@H
zTJK12t&WbE{xWVteN{Q1z``%z{Ph3K4?XfU?pWL|(Soaz>SD4xxcgSlELjzM{hgt(
zP;zLs{+9bMnZLdd-P?a~`R=fPD>+zy-TABAagwb>A*)~PkGSuZQ?rEjdAZ~+;EirK
zN%-J@{GUO<ft%9IuQg=7uHT%i**QP7_1qMzkHNY}@67+Vu;u{o$9sQ;|FG3nKG-{f
zTW;#}?@y*S><cdxjr!&BM6zkd!XK;aC*8BJ{c-jA-;Aa06_2khd+hw1@m_r=$ChcI
zn%7+|Sob+^*G)4G&!F!UZH^h-^7ekWCh+S+k+WBR*6rrYj@_8BEc#jHt)q7xHe46K
zd8sXN<^laUDfQpga&Fg^x;=eAt$4lF$RwWqrP$XUd)t4^RGo2Eh5z@Wz5ChxY~6!*
zY@Dw;eR;_@xrQsp-{dZy6e+vLiOV_HeVcjY$(C0U<tFBLCg^=%+_kCbvV$&Pp5?z~
z+&2!?i2q;7Uuf(1VDhJb4?q5O?vHh_e-kR3dP%DH(YZq=0WlkDCv>n{yvdrl+g#^z
z^H=%zmMmXB{D^NT`=7MsKj)qAk|(SFoizCy`=Vmq%Ny_g8AEq8eNl=`%2Q{X9vEr<
zCA+#l!XW72y`q&RGiS8;p5yb;32={Hzw+<Glor#a<!zrlnAS(>cYL{asz&(9d!2LT
ziQB|q+eb>Bh!H)uX7=h!|K4oBcm6`b-u>x2>(#fl%Q`gjF?X7tG^y@3OKV}xs&x{T
zxSVS%eOlr74Zjj8ul}1)jC$U%$?OYkZjGwGDb9P?&PG7?ZqV_4w<`}UI8wD*cR~N9
zCD&rYgDu+on${*B_0HJAx~?$OeMjEecTb(Guh0HD@!d{U&8_S85+5thb?aC*zf{@#
z2ZQ$9yUKssr?I}f#y*QJ>*KESyG@H^4o+ie?`2=`@%ZmF(Z#)I%hudcxclUlSxaN9
z*xp&ed-QZQxZ~2JGV~ra$=VqO)$n(??3oaA>+#-#UF(zH=D)rDJ7!{i+>C?UC!hZ7
zUovUAa833-(Hk=Uk8<4hm)`A{=#aMIEpUjAQ>!@fbNa!R`7*!m@3ITD&wp3`Y3p;g
z*jKx+bLLK%SSdTXRP^!%&T!tI^L0+av1;rYbN2r`b?j!##UoNRrMsu>`ds*8T~gfb
zZx?NiHvE2-sbBW$&3U~n<$De-+ui*x6`1xrzt7`Yr?zZ^_SbopNugJycM2X^?ptm2
zf1~A`+c)*Jmfzp)t2x=uxPOiJoxh6fb02rr@o!AMlddg2V|w$dm5oPc+1x4&yr(=_
z_WxPA548<-MhjvsYLB{mKg{P744+)R$3M%5-T&cPHh$}<EQwzy9XGsr&GdU-^xsUq
zH^JW>e&sg2vf4fGxY>?xYbS9@aR(dkyE5PB+SP20>f^@_UOD!Xul?zL|GAk#I(LpA
zTe?i--m5#DcV6gPGGBSfS#>v1k8$<$xu0&YJ77|tJEL^l-I813$18Vd?f$^!!pu|u
zdPk2l=dJdpDNb9$bw8}#-8|ve^yRwF`Ttx0#3*IoJF<A&!<*mRb8K(=mdOiD`LV@$
z;jBp&uPns*tTr+q*C^fLDC=afESRIp@#aF!(46%e;o3%5Z@o$1v#7b{ZXy?Z|F&?s
z+YM{}266daH)DNM(G{C@)!?XsOS$^F#GVT&B_}d9^c$>NI5nK!Hrc89nQm9PU}Y2U
z<2rlyoPz@Q4^EM>*l|3d_<7f=ebSSrsPx{>KEq~sa>orP&$z|m<^~f^e)P!=H*IF%
zS@C+$sxqI;?}|;*4;jaX%za{-IV)^h=JQV**C{`oVDoLxyycZ8cT*<B&DwsoiqF^L
z)2?4U^R}J|%gw*pdvfplJ%^bkxQ%ywE?v8=B0<D2c1~}5U$=E~@F|b^U0vT5+P3^;
zuPuwo^{gzmGZ48T8lZf6t!>c^IStPW+oxOozFhTT;yFIo_vt&vxAqyISf7`;{LJEW
zOEa$d^ko(AvWh#ibGO~SY3tHwt;;c6N%O`eN2#jA%w3beXcStlIjXfQYVmnlrq%9U
zH@|<`qQlG^`D)^~E2X|^<__MmCH(&<doriou;%*^{I9>UsjO4S<jnHi5FL@6*6Yez
z+fE3S>-Q$@QvG1lBX)tm@XpP=DH(g7tlW9__u5^-BFp%+!i&r2-Fb9ZCbE69)`jS*
zsXAs0LM`3w)@(LmcfNK1%=3>C$Cp2{E86wEZ@IbLe9z^-uCX~x(qdyf%V#EhGc7wP
zc+<;D<@3uNr-(}*_G(xd@NJ$cYw1*m2+oSE0;?ca-;+JZo&05fTUXTenbfb`!d?5c
zo%N8~^t@Z49`YM*yqqm|^s?N8EjjB~y}Z3)?$WP+7r%WJEj@9%?n<j^b~9#$1ef2K
zExe?5f35fCm)Y;%I?RbGDNwa|^+rY3hJRY6Ym-n(?)930qcLg=?mCA~+Wuoxtl4Jf
z#Ana%U7ssuZhLS`&OJTPPvvhC_b@&=SW~;St|2(~`l3}2&0XinJ*kY><>OhS%=gyV
z>&2tIw-e77{NsBdZhiV$S^3_?HRZ~_)#mE4_A-+XUPzgB`c9Gc^E=xZX6?~<uBq}#
z&gxd=@tJ-dIS$8tb_7|cs=era+c|5#-07K*J*-|wZs+K_+%xf)f7ALoVxRk3p2^v4
zHFdZcKUep}kv}u$TxwnKXYoO<@X{6KX=iyZ32I(vUf}eQx%ruHad>`0h;(S5Re-_#
zYX?(rX#_m=nfb88`Yprb6^Wdpagz_*DtRq!PL~v!Sg5J-d}5Nd(c&$sH4@LJ<?>1D
z`z&0-V5R$iYOvbcg8x=uT2um~8P*zfOO~%br~TcuWf$`_%@vyrw|g9L7TWeyr7f$j
zU;XwW_lXysPML>q{MO*kdEKQUbw<qk|10kvSJu0<XTpqnGp#rL*Y@^&js6zjmHY1h
z@$X?voxd;`3SIpA#$ig)OxgE7k>;;f-)Wr}yW{M%=&i=Pq&!QLZk*r3U3P!3MNs5w
z)%xW3uU7~*{AMcd*brDf|K+|7Pb_@4@I*yiDZSGhHL2sN0n5B>;|#ykKlx6oi}&8S
z?K^9)(u?R*f7(}`J1ZYqb1<ySJ5kFqsy$qI9{;fy@78n5c=OKp-uZ>;{<@4ae_f|t
z`g#AvCb#&fL5m;V>-?28*CIZ&a!SkA7rSPN2rgXU|9sw@1*Jba83nr5Yu|J0z9_OF
z+Vy+bm71xwb8nl!?|Bj6cW3o-<s}Ol*Lt>o(|o^da>tw5>MC~p$|<vE>|r(d_snzF
zmDz^#8XYYjPBdGT*H?JRTe{X}DU)Gx`K^X)7OOo11&>KcEebwlvNA!9wdPROoX=mw
z6Mc^xBwZ8osb-cEU}k1d`Lk5oiX%WSPx!U$l(Vi8*Ese4<abown{!0Vcv4ROw$-cO
ze4n0cu)}K6x$8y0eR?0SQL?zLo3s7YmP@<;q|ZHk>QGsqah1Y?y({k7_&;vkskO0m
zx$IJF_2Rj|7T)<8*M8JT!28*;oz3#j`Rr%;7k^)9@_wG;wc_mcItH113l^XD6|2y*
zS;Vftd)es|AIfed)onZ@yyD~E{`dO3m{t_u^Gfd&@}DVJIsJpU>rcU|V-*(BLd#Cp
zKXwvG2<iEGOLT_jhv_j7ug$EyV|~-*x6R&%7ymP$t{e(skDahqnt?$p4d(*Rg36MN
ze9&P-XW@qp3H)5ekf#x`ZL)7zxz}3xqOgzNsg>oElOhZ}_&nEmG#qp`@n8PG?yfEW
z7aq1LTkd(!U6sRmz{lU;fB*7yIo9do>;Kh#F`M1BN67uT@x<#lZG@kCeyEx3H~rCz
z%$k}H8WoW_WvSaDt{uGmSiPRlPS^E=Ux=&RnIl^xL}#0R;m(@4j-T&Y>PEgvDfh1U
zYEDu)ac%aZHO(gHyRFu4R$9-;cV)MxgDl&AhB=7=A%_=4nU!vnVq1Da_tjms)8dX%
ztn)>lL@?X@4q`sX@IKZsJ1j}!#Qo<#_XOzrUN&8{>y+Bu@2is*-WQcV<Xiu1qtMgr
ziH~ILE{NaFyOgqeW?t!3@!K{lr@c;^7L$9qh;eeo&5+WK|5*4JZJU4Y^UNPcJaGyv
zfB&vm5>JilzIl61)A7^0a+X=Vc(W<v)Jld5gY!mnox1ra#~<0!W<LG2h}4OfSzFSQ
zlo@L5&bG`v{CiPdtjW(eQ~z!IytS=e>cK0&hES&Ylh158WH2NBr;eb*dn5nwlR5S~
z&aR7NO4caQzoa!g?!szg)(4Ap#8P+3v298<YQHI}YT%@Fd+Q6QbmN0M?e}I273iAg
zC~8ig@+jVyO=O}sLxJngb6E={oUiJfUv}m}av5(5)4E+Ac6)xzPUrYnuK04DyYHOJ
zKLKmf7JWI$@Jy8R#Dy<hl{a*}^z06{Cl-AC_~z4_$NuRjkAC*ISIMtyYyJE1=kd+q
zCwKF&fAH}Va}g8E#fC-A40WF#En4y9%%?}a^A@W$)P3A^;<X90-{FaYPHk6y+U)lW
zzxk$eXGTE7Ld8Wk-e#^-PxO6?yxezS>)oj}d&F-m{*LaqJiV%9lhD(jF`pkEbny4&
zUNY~rb%1HZz0;|TT`Sy`mP+gsY<q1s>7Qsghgkhy_j$}4nO<4ncVIr-?Ei6jeaswH
z{d$Y)pU?jMjrY&+V~Ng^eN=JDAdN%i{+m#<wSpCY13%t%ynT6vnC9H+3qG>^&dTNw
zVmbUEG-~;tUjHdGIW|v|n`x0B|8>ikuSr^-ujcOCH%VCHXdr{BY|h!1M@Q%1&#7)u
z3O@d0zH-JEtLvIC<bQed>1Nu-E*0f?|ITLptCFo%n|sfk;_*un{&SPTeck~p?`xjn
zi#-F^9D7!L)hA6dV%I9Yv%7tqd|s6#er+*Jw)>VH(3w?Yl-1DW%-h#7t#vYkp~3p=
zE;G2;oxbX`?_{oQYffflWSxCahS@g!*f!<#Dz0z4OUwm>gcomNS>ABC-_k_->*>n|
z9DA+oSZ1)VEo6x>UwA~NMNj+6kp*#=e8ui<N-Nwvv+<5g>}#tB2l@n}=B;yOsxdjg
zPr;*V%`8j1dvY=wp}+n-j@M6ob1~FF|I`C6v73Qg8CNu~mauLXTl?{M-3bfbv(57|
z-T#L9uRp2$VWCk%=?15R-Ys8(ql7+pmWYWI7fe^teirO#W6YzLG|OzkzssTxxnkZK
zixg6O_yr${$eK?$rfb5M&SdxY#8ob%3(*b-a`tgw+NHPIGq|~H<*b)Nt)h~7D;$>n
z<k@3z;f3XcaBh(kTkfzX>}L89Hf@3BE7b)Y^(!wjY3?!nsz2Li=9>enHLlIhagAB?
zoWrL*sEfyZNoViz6QbKEX&D>xuQECRDmJ9^s*H_O$bxAiEk2vuZiw@~Qn2{N?PzVt
z!++!O@l}k`61+*QB^OTpl!@MQ*3&KFL<Mt+%jps=dEqbZW(H3?0vO!_cn>u$*AFPD
zkH2}~`t^m8F`ZH?CYr6D<-y2R9M^LwJ8;o~_T&vaUak^iwu_I^{c&~DB*g;#EWT##
zjmotiEUowF%+qFCs;>U=;wz#3ArC89{vKbfuAc0dK1IWFlWDdp<LMISWowzPG3lv3
zZkWPwyYI~uhWcwSf}(8ChCJQzOxnV@SE1I_ceNE4<Np9(D>pBXcBNVEmp=C7Gu)28
z;>z5u&(YJXy=Q8|CM`xuor4=$=1YW3XIiP4Rn+mvO6G<F$43)p#%t&NeFU%EoWAnK
z!R{p+xGfoE<=057-gtDn<Z8%+^Hx4fJ6tAPzL;UoQhZCbw_I+HS=j%}3O=)UamYqR
zIx`$+;!#p~JWFfg^~Vkj{OpNanfGqz<NwyX<klRE$tFIL46_f!f7ExK7A-V+n&hpx
zC+7lIe*SpjOHMj_(@oi_7v6keD%_H8#UES9zteGU(gL1aa&8SjwsY_aeoMUY#Gqa4
zhA8ja`nE2~{eR9ymK(7P>{)sKL3_8SQfK?NhqGmvzI~E5;W=P@Fla&J#LEFjGHWi&
z^6l5{uDR%*YgXN0tNW>P+lDCz9K#JYGg(*He0+S|*kCuqaTgK6mu>>rJ)*2-)fzL@
zrrYnUDE+tb@<9us6z?gUY<L^xPTu}p{(Sy{J@)%8-j_U%b6>8%=R||j@`sauMAq~y
zh?~2&?%(6v{^#TO*zOjd*s;LyimrO&?(T{9T{2&H271k$5ae&PA=PtH$*z=zlkM1Z
zBn<qeqc;9%$kwp8+E}i`t#X;qfqOxB;>*g5yEdtm>E7P*k)<Gmt)}f_x{dAu&DIDG
z=KZVM*f04kIUw}mwvsS|TU6i7du&GB9g>^8s(mNsIBVN5T<)HCziRu<*0tU}CnUZy
z+$a@kyBlIvzijR&*12vyyM>lJf1iANCd-K};g6n}FluJ5?D0QW{&KF$9fRGs0)yR{
zC&sefZIt8kC@W;poW6AF`m)4b9fzgX-hR1SJkR;UHt7iW%YL@y;!69y7^J86Wr;WL
zFSB0Dx@Yc8h9}2@>KC45S1~H!_D|9OUaNGF=k2{*J+JS{H#PJ5eSdi^V=6U&zIDHT
zS6^PoDbKH^ale1ByHs;=3HQVoOM~X#{r>M>vCr2RdS4#oZ}-to(z+XB|NVUX_G{<=
zZrCbQ{Nq>be~CQ(f9LLZCqF&<qD-Op;dj3%y+?(*rW-crAG3Y&VXjehgZMV<scFY8
zB-b0CX}dqO?Vst)^l9o+5f-O2-yHrSE!NG?yg#z_`?jZYPFr?sZS$NQtoPtc@XZwy
z*mV>8?`S5sawM+#yz=InmLBuaSxYCsl}diHd8(|Hrzlse)4a$;K1GXWMRDUVr$tn*
zXHHq~ek)pHv3c7(xn10~eT!!==so0o^Y4VDW@oc65AP;2THVg$`DScUmFd@)rg`nC
zY1QLfb7z_)1Z2PESDI(?YFas?ZZBVoY>x2;{=^pz_U-QuRNbg=`<u=4a~s2iJ31_^
z>kmii8M}O7cx*iTN;<m?-~Y%*-zATS#}!2dt1UY8$9L}9)~nuT?92-$dCyKtj@jnO
z5a)P;iT}?<?xWXBbB=zAX-<26R%=m2&5AauEf2DiHeC};sB^ikAs&5ag~Q?el!*M?
zhI3Jjr`@cW<v%?!h`x1}&yJx%#>!3bU++J@e{5|g%n1#btvo)gN<W`!Fd=S@=&zHC
z2|su7tahI+@@j^u=i=G78?}W_{JRo<tMkP{#mz-k&1D`<n!Xck=cqaP{A`PKd3?+F
zmTiy3iY*MSOdI!I%j7)2sZ?Z6O8uO4GuFg}9}H!uu1l1uUH{A3|2W_9gG5%?%oRQy
zI<{*6Yj$jDc5SZaby~38H?qmg^HY+V#PK5atzYl#c=6#!=g<2~mfzfd|I+R0ZcB|@
zCU5_^@Sk<ZL+2prx%bq!U8#26`g+stxi-#f-if=^1tbo?zV$0k{K5K9*Cw)`3OLzX
zCG(}vt8>MgX{Sy2`{QEY?BKQC`_l2_wZJM3xyvr9FW-kbZ(8Yo<O#cON}UgTT<L0u
zKF{t<2RRk<+3X8eO8piHonI%qN@|T`*j|f*H&@$jepsGPKPt98=%CX|N2Z9G53b(c
zzQR|v*uFb`_0<4Pm#UBDHNw#!9CRjay`yPrWXbhe#Mn}2QsAQv;lD&?WF1N9Gu(2^
ztE6_-3=5-$y)D7F{5w9{&sW+SeLTd@!EidG{$n*Cf5TnI-_OnLHWcAXn7{SFeD>&`
zRW~2hDZjh;`Rl{BCB_prs$I%_rQCG=#RVBQz14sAh*U0^^nWu$n`r8Xcb}F|cb;m?
zwfe!Mr;pG2J-hWtwdk<P?1t6s#~4a_o-HXq|Nq;=<UjBJ*#7BP)&Hh(fWP(8kw08+
z3s%&1J3lTtt#*E82;)oROtBr2Dow9-c!Ls_3w>WKpL?ogqn}`Kii*JOlLi(xCB+jS
zuyLL;2s7L@<F(23Jk1NMbPTOIEkb70>158IamVS=Rm(jqmzcVme3YG#^sK=>IO5F8
z*3|wb0TI2To~K{kV>|g}L(5^&^(OaScP-^v-KeaYzGvOK<%&P!e_0D%ap*mHtg)ri
zmFI=?OW9?AlAor!C-z8BT<Cx8gm%E8sTXdkPI)OX>*Gl)o4WswM`QEP$Im$tXKwN=
z*T^}K^F32+*Hi}fkBtXZGuD>~EU126eEF98<e9U6hF8c1dI;F4s9ldd^nJB#w$a)>
z_jelHUAQapmh-U>>nF6w+^XARa`oDoJ(<=okA?kMczbbM_G~+@YggA*Nl9H6({Vh+
z-@okB#}_xZXPe}<Z?WI&qxfh_<DHULYhj)<uRrhKZ*AS^A+|%FC1dxM#CvW&n=8#i
zZHw-R9qe^ESiJB-NAvkNR;Aa9V}i6b!~ADxYwt8%Bq`tDd_Ozm%cGMO7gV{|i#n{@
zU~waB(dB)5TG!4^f4A|(>?OC>svp(b*|s5f5~Gmyo9vof^<`qFn}U|i_;k%^X|4Sg
z=S)qdd9zth{yP0~^N-yZu6mX)YP#7kY9(|!hb>32Y+J3>BoEPm&N;PLI$cyImYN;Y
z(~#QG`}VixH7&s_+bl2swvG76Vb;9=U0$X3$w$cvPF6<`F<p@ITI`-`VP*F#@6Y)e
zb$4wf?e?Z}rLdjZ<rkjd{_5qWly|lck1IDv1+MO>-J&G3<)WBPy7`s)#<Q~Lv+tFX
zl}O!m)w7`Du-k6ip0|JR#eLhDH1)&&c}M;4^1k1_q4IRiTD~x`Ajc)e9^FDtC9yS3
z$$WL9+v+(Tm&MBc;N7skTPY%~JC(iGHmu-rUzPQPX+4W$pI9gu@Gy%?w_f$Dp8GFo
z%9g!>?sxw!*dK9O=l=C8mvX#n4nNj6S3mB*|IVrZ{SVc9RQJ1?d<t-Sy6NWR{}T_b
zxV&b~l75!;z7AVoCmgqy^<8AA8euZ&gocMxPest&h{IQmnCIj*ZVqwgJT-sKG|3Db
zNymt`Zso)|oF+|WCaqlSWRE0;O!fS{yk7L>!rr;cCZ;7?(#{vJAGn+%@~SH%=;D+)
zCTEu=SQy>8yDBPmiPnb2wRx8(=pUcZyDTWwn=va^tdUn{(buW{ug~<IEBo4ahCTaZ
zdiUoEsW(k(A}>g6IB<69-|zFZ(yHFSd-`UjCI3J59h^t2m`*PYT5x~&)l2_Wly4i#
zB&B`mH!`*eIxr=rKHuv=FGrcmg_}YPV<!Y$zuuPfT{)#l^3>e^@SOXbVk11KNs3*1
z@#y}}IU+hc_8Zu5`mxkE_tvC^47ZgU*-evvh!^IxeKNIBH9qXQ<8pj#>I2DU!9b2k
z-mBI*%iBMR`<3$h-<cfy{q6QU%D(Sj>A8ygdVTu6ME=A36SK;n9K5^8BwA4+=ixnF
z&-ZN$CC_Lxyko1Fedn60%NyU_-5K{v{UT=Quc>Mettt1e@Ugv6_~)&mC`;n|GVV+J
z#oym;3`ttvy>d5;RR8hvwD-MpHr*=MUA}`!eVbQ`*G*jm*^dkiXIa$l-#B))X{m%|
z=dmrR%aSY`I)CTpZdrUPxWs+cOR3Kb-1cYo&R@f5VyeE@D8u~bxBPv9cZ<@iw=TYH
zZFD*^+-cKy-n-w5dW9o)=){Le<eh2ko7yML{_T;W$y@$wvz$|uFWhZl;COU6cnQ1P
z+V0>V<~%w)fq8z;@8g6NB07cc$bX6R<6Zglc7Szx-_8&3?*CpIkjEu`GFj;QspkFr
zp8R{Z{P49fhi|1ef2BXErLSx^Ont3Zy?dpVwbd_0ZpE95qDmZdBZ67)Oh3{UX3A8$
zbw=~Kp1I$|OK(~$?`Y)<{LAZdY1PME?YptfX^h{e%=^kby*GciWb-=~<<&2E+D)S0
zI`3BCbvL+QB@rh-*;xBx@U<_Zc9VlG?tki%T6lcgua@&6o+q7-&C|5l8eA)CP(AUT
z%=`t1<+a$SJzeAUk@3asO}e3*LUOV`@w){z9Iq8FI<@=T)Gu4oC2t+Q`TpXpGM%f<
z$)4|KGJl#}Qq{U}yBlZytD@(<m!o#|@JuP&?vR$yY@SpeHqG_sN-m?tZ`ZR;a(;R2
z`{|H75+!-2UrZK+72Rgv|KiQzy_FZQ9KU<A-|y<3|FZtGn(nfHT53DB{o^xR_3yJk
zs@v4^R!a%>nk@J)FSBanOM?||H_|TE&YE-dirRs|t(HgL7A*`>xV!7qjs<_ao~@p`
z&#La2`vcB*jm3QdYP*z|vjxtVw5k99i&>|-`aEN|M`Bq0k7;RFt0c-k{+n0K(6Mjt
z8mU6&!_lA4pPu;iDxb%eZ#DCar-aP?vbpO0`W?&82+AM0BD!0C*VApX>Z@l>ySZ%I
zR(6xrt^1BC+W%Hs=G&W7uG#Q6EYfws&5d#?xg0ZVI~~4u7Bk3M=04@Q!u>9MZQbuf
z8qXN5RRiD7Sbp%L@cOy~%*|`qITQDF?^*6?)h<%KZPVS&9W2r7n9lKNELb7xueosk
z2Z#2hCI|hO2zU!kN)>(XxK(GCXx^{OavGb;UGt2hc;<dC*$~9eH`^;@)i#HpD<3dC
z+UDhW^}>=utvi#~v^aDnTwZiWO!9)_1jB?4M;~uW-RLQP<*AkT+=+AcIJmSf>pRZ>
z=;`8HHf>_5v5CAcA~(-{y72J~JM$@a*9dRp$+m|oHcu{H>moQ!<!Bd+)$KFWl%`1+
z-pxv#y{|OJ#56N2|6)^&>R!dOQP%G)<s;_HE<7foGJDyJ2g&IT#>*AidsePob9FAu
zzw+ZeX@>mX?`%c=w^yGz`L0y`S6ie;-p*{@JsN>euk0_hTN`nDx6~8;kVQ)aY|bx<
zSlK-<cvhXM$Lz<Kg~~0LZg}u9lee?t4v)iCCsrQ=Bi;oc%b1cFimbMuH0s};$~Ns-
zv*Dkq=O%G-RB@h~dWPw3*zr?EEwUmqFHiOOXGyv)R<qVVy=vp;h5z*!H6KQ*U!Ay9
z{gCZ)f8#QVUEeDbwlk#8eReY@#B}P{6+ZWSrQQehmRszz4Vo;nSz>*`t809j7Myk4
zdKH(?`jkDfY*zf=r}{5?qE3DEJ9hTW!)?_Cm1%q%etK=*Gx<`H>#HS~mp(ncKB?MP
z$?Jevn9q~TNz<NoU*53txqJP$qMiQ~RnpH^2}f2i@7(>u@A``yDG}E<xXt@rYmoG5
z$?xC|BALgN4Bm-}d1fZM$vs!;$)6f>XJ=Q!6~(+7|1Pfp#uaDkcS%0`eP!$W-xs<2
zEKimcR|#)R6RGjq{6*#At$U~VPkk$U$=bdAdc0rd|5P4<3D+X_%+%?A<n{B(WZ}vs
zrye)@Cmqk9n$DLNX#R4AZ1mbbIo8v=?uDrL%ja*8E|m|DnbLjSxbSa<vYF_=@{&Jq
zcH7%dTPS>wd4lg!?Y!UTZtM7~Fx-+@uC#2Cit&YIDs!t-*3_u{n!IQF+dCc?{Ff#z
zP1@+kIq7EK=~nLWIC1g(={HL{H{9Wx;@-GR$t(8NqAgbg4!fuv_<3M=n9ssHbCXXq
zovo}WIlSET*SC~2LQ8|DxOE5{nxA=}!BsD(Rh)V5%zyQJ?$fSMtaLoI=-g%J6Oyg^
z=kD*f`p=PKnX@&$$;pEGO1tBs*J}C!H&sHd#5KZlr01<F>@IRIw@WxKQEq7VtyUw-
zlXK7G<y}7N|C=JT&TcW~-ueB8<nrv(`EzIVEkAPgs_L~`)so{9C!Y8HkqEtgHSuCu
zca$6ZkxhOnyQZh!-R$?uX5;^7@`sP-6#J_#m=br_eMZ$@&oc~pA6!fI5|j^EKK#6G
zxlIMfCNqf(`W5d_J=${gkfyZh)E`R%ue>w<sh+m3TvqYIsw1~9-Cmr!XX*}~GxwH=
z{3}RU_Gsy5(?b8In=>p=J=6UWd0=A1GxcW=Ze015@F%$ESc%~qku7Iko^Ac|RF7|t
z((*6i7ae+5o;whJI6?JQz`4>!@p6;d55#r4Za;h(r{&HcCH$J<N%F<s;Om*&7QK<u
zlMQ<wWNYuEb$I%+06)H)A$oh(>{Abq*s|Pvs}0xxZM*aK`|<3W^*nsdtJtK39p~d~
zF4kSU9<gxQr_c-!(HDsf^*^_>Y+omqQj?dmKQAucPsCYp54Uney6C(V7u(3iYuD`Z
zvs$hD)AV^JPaOZs<mE+ka-$w4P8MS_h%r<>TCb(A_R4b6ji~;4w_k*K*68dldim(f
z)xxhbJKw9x-TcR3W%*q*?W3b%ZUk%B%4^2k@0aAwm)$b`O2CTut&5*a@Lj#P@!g_+
z_18hu>}%R*Ch7B(swTeJX>1aedg`zIgN?ci{?shDDYLzhamMZEW8rF%SWAKK*GZ+l
z&--t4ezclxzvb>NncDU#)qk0`e>%4Bc|p8R;-}wtx#bT3o!7idXR`RdB(6#C-IoOM
z@rN!x>=3u3HPcOg^+Tz@H{S#b@a|jnpzlbhyxO)2shd*$VlQ;A(Ukjt$b0bylW)>C
zg`v8ai<sY^mhm@w__1zAq%&u*&Af??2NO1kvHD3p+i}48SL2#Ff!DXVO8gX$uIOFU
zvLRe4zF}@f)5c#mKi2phO=siZwc`4DJN75vE|<0^>^czADLQTAQ_;8-S@w!AL6%BW
z4o+?MGn{ygp=-;ju#(*e)1R(scRzpV<8wvctNXhCv*_RMY-qhRGg*UYjvkACkEnym
zy|l{Dto*yzykyGVWvzI1mDI^)Z>pvl2mEhT&2C{6oHprN<_2BE2RfOmU0XTUCA8%V
zS>BH@@0`Vbuc9uI^<etuKu^6?x3#y+AIsat)FmAg2~6mePXAq4V)INVYmH%)=G{$e
z#kqG%s+w0j*B!bW-D7#px36S(na}avr_Hw*+8qBDvg>l2MAntvue@&`nZY{iY~qS_
zJ1j4jE>*}6{PB<Z>O428I)j@t+43H~T(JJpmg@@)IZgNVsGsi;eO~wc=BJBQOj4n&
z_k~+eO6&Y)?hiAp)Z4!0g3QOf<j0e@2fJ_ve%IRa^qq3@ED7UNw_9ztzqobN?J3*c
z#i_^lPBx!s&@v~-NN%H+#^U?;J680VKlpOwRkhMYGs)+<CX+H-D_4BtGB^0AyT10x
z=PuRx6NCQW%`CX{c=pXLmn8KnYC77}*Y>b3j-8TqF>mAKIW@mDE2DM9LMA)DKD1=w
z&XQ|cUxQ^Iyl!;fQ*&fav?J%VOzwL#-(UK$&g&X``34TJ>8I0VOG4Q4T{g!~ae5N?
zqkpsaN=qFP(>6149=6A|H<{bEt(~FsBzNIU)tPw@UTEDra^WJ=NpshpxW8>mEc>lq
z^)C7Kc#`$2+xdBsj=Ps-&bO1d36YGx=(<~~;$MzDbIsG12$S?HH_pDDySdra==75X
z=0Db^z5BHAxt?2T;gb6H)793>|0FIS$)7!ev2uIlo3-!1p1rWu-0so-46&Yn_Rp3w
zsCO2rEwSIo&=A+Sw7=r5pZPQC2bp`DnJc3dRu{g0yx+CN-IR}Av$H$w*%dwES67}m
zNM|Q|a%F8=a@wZw{^9s*hF@X=v>3IT81FRyXASUXM!LoL%#|>K|11m);k-D{geU+{
z^BL<ERQ5s-0(=+ms34!i-Zg8Tv$=%91wGH(3ckWu*mfP{;E1xiIY%`}VWmafg#Y^%
zYn+<$X5Wiu<$3RV%lYRg`<;06@6-Fu=WQ4lK73=vnpknn(f7pfNvhcvzjf{8=S<*^
zd?ymWmiOn|KVNSf|M}T`=DI_kqqk#FMN7;yRw-fTH4;2Vs@zVQVKcoLm$ry64QVq_
zT$0%4y^y`xZCSb1M5V{t`Ublvb&Dp>IwS2~_(oR5EbiR&-aFmv=kYx2&&yAZdMY6J
z{d-i(rRs<<8~?rkG8{hqJl*xoXYB!(CyOq*i5(BSuGG5x#IXP!!wL6v|F<4_vEtiD
zK^Bd+OXp)2-_1EIvc#@?W?*QN_JngOONA~7-sIRR8nT{y=B2Y@e_tQGvHV0UW2n}F
z`x4y@BCqG?<mk@Yl0N@l{oY+mwwF);^6d7Tj+>J*6@D8v^$VJ=4$69U&FP-^+xUE`
zr9vSGdGn5O)-(j2oSM|iw|Xth>GyMGtY=QFwE6%1Usqhsu3bBJ{`*uIB)<H%O88XC
zZ}Ls+=f<+Xzo(TkN&C_FoV$LvgIIev1aMt9zt7g}7<}}5y#2WoQ*_K!CU@m<i0{=B
zzH>)SYz>3Xl#Tc2x0ksZ<{X>fCRpeln_BksQ^UT=b25G3m8a<*l@>3)()^;rXoY#v
z-=~LVkKKP<YN9iD?$;W*{XdQEj&Bz+h)F6mbA9+e%%Y4h=){Kwg$H?;D)Ux~O$@$%
z_HuCeq>b5awI!{(a=nkQEm*(nx{H4y;|$MLk5~B^etEI;Z`ORpAF>x0ovX7b46CiY
zVtRUqgTl4yFJg@=md`QXxatPi3uTShm!iKswcR`|IOF7*ThgUVt0zxiHsyWQ4|!R+
zu%d61zwPGQ_gZfIw&m<w9jkLgT;yhM>be}b_mhrz{ex+4bzZ);LRL%WGJoPae|5*?
zEw^9r2ix)T`MX5SJFUCcC3fx0m{5bfi8syj1Xk&C`Z&2cm`ju<RW8vgj<`}f<9L~K
zH#1j7g@e*vtLAqH`8MpEb}JxfXCo7TgsdUk#}iXU$^wqE_L=KB91k-r>so6l_p9&k
z6rSK^+hiDTINsvi+0qkg*|$-Op(Xpuoy7NTDUmbVm_4){uYU=QtTQvczGdmf!sDrr
zIh3<3bM`ybsi>Y&pBh~|;qqLC`*+ln3Ou$?%qe@SxAt&$XHOVsg;wz~)@UVPt%Q!<
z?^B!G60M}vj*E)(uf6j%<D#Vj|F!EMc6b$ctm&%Gy*lBMw(1>2KF|I0UR}9zLt>|#
z`qZEs@meXj7MyBcYCZ4o!hH3G@n(n5J6k9$7uXwno$;Meq=?TFcf;x4J6C$`I?}XS
z*0u9i@2$giuNf*gPOFgaw!eG!nP6u7L5r4U{0C)M?DM#o?Y6VJ`D1ml)i&qNoKie9
zkKO#izSs7Z-j|E-4t8cd7WQssQS))&ax}j9T7TPu^WXMgVdt0h|7Ga3<Yn^f^!`SL
zN98AXn}=q-x)&V#{k8tm4AIQmtuwA^b$|YQvogif|8@T@r<J?8^Ow8J#=QA!8b0-a
z=k~>2g(-_{zq~npHJEAX-r4<|9u~iTb#!r$WqzqZ5PK!xo&87tIVH^(mhrsi<k+|U
zuX}-8bYJP3HFpXfT@>PuvIti^_5Sm1>NB=;AL9FYzeWFFGIQIx+(lmnu3mn=a4*Z_
z6Y{ri_B=^DWGa4RqRsJd+b&K2_~`4Ad$)3g-)`-AyzXCf^XiG(36nj(=am<9|B^>7
zIi=?;uTo@WU|?cmV35Rqv`S%#3Fsu92^;ec83?qM+aLAhQ4#9YSmdpuwROt2KyFr3
zXY0tYA~x?%**DxmwZCRbxmbN+<NtpD`T6IJHEZPUC!2>ZDx2{{G%F}*;n@fKM4$3a
z_Owc4o-zAd#?>-+1Ihb$oHjZ~EHakTvPsCjb*$JyL+aQPQ{DnS>sLBOe5*2hRRyA?
zg_iV`y}7d}dG!~umgYx2OKbea6P)=EJ-ieW+xz^BP;1({rHMYC8kZhr?|txj`q4k8
z@wVwaHLOaZvo35C`&+s2b9T33*tJ8J`m@`-7w<DWcjJBR&sQ&H(`<81?p!XBXy4-W
z@_T5M;PZ)xqxu%4pZ&GZV$a)<TK`}6c1^Y)nWLWD=b3$VE4wsz+0+$R&D|2et!JII
z`?Z_n%jR>h?#*lLzR8aouAk~A^bibJQ%Jb_9fpRh>?{x85UteC5ETtpr3_6aW}j(S
z=R|vV&b>9=>*>qFg4Jz}(l&SM=iASB|FE(0hfmy9v8{)ftO%Gqi7S_{eC>^QhBKE2
zn>Dp&`iH&!#<KaPFWXbO#MW~eD?W5=&6GaRxG+Ov@->qKJKwC>e8O_YGSg`e8Mz)4
zjBaf#?)F=I$y$K#l<~Ar%&`sSyTtjzm%YleSw3CEgj<(4*~@9>wD{So@izM6`bU3h
zra#aYSb3>s+twH7xnpCZdp73k&iTAaCq{~QYvH-N_gdHb^9|%P7JqEqR48+aYw7*)
zOxHQ?eA$+bji&Oy9(~xhuWjC!`WhzoNA6qB)!(uC>~`(-uT0gfuf2gY{$@8m`L-)C
z;Mao9RU6VDBz<E>4OgkjWp)~j3=G`((yJLbTm!ui8wfPq|E$edlfj*>!K^N#_F_&{
zNpX_=7tNNhyI5~6@m|;b^Yz&?$6hsmpU}Sh_q*MvMQhf`*<B9b>h{(^SL@1>tX8x3
z-G1w~&*-Z>wk{!US99oW-Gdg==>d6yVlR5yxW3<*vF@vkz^Q2)Z_N^GSyBB;my2=L
z+aA>kQPPt@>2=B?=jC76mNb8ADcrc&_=Df~OAil))HW}FwNqqL>pI@#Rc(`|$FJTw
z!}ff-{?SjG=?|0zVltg>M}B!fQ%_Ix*tOo0bGy|N(`>e=S^ky{)serSV71}c#Xhx*
z9E*D5?|;zoa*A)=Y9Ev7>U4x}b`=YAt(}N^;>l#5-aqv<EY?ERTh9G|Q1Ynv%?j%>
z?VBs|dz|0Lb1&IG{dUtO@v7DA;_P~fXoqX%hdSJ_m0)0K55jr&Xi+KnWUZ|>Z;Nib
zP5S>;r1%p*gJI{^&C~B{-_uHsoFp5Ua#H=|$y`Gn7M3<8C4mQzoQ1-lvhTXSLw)zV
zdHiR196ZZ5t#M&%oH=jazjyQ4;y0Y`KmOm??yOMUl^Pr0%8Mzdd%}gwc63e_m9LlH
zcdPnf->I|PPOS^){k{Kx>ivDczFn30S95%s>*3;xh}=_Jd7C!fxE&q#be8MIO}V$a
z+yzfx`>-alFmMVl@5=8_)~<ON8a!?1zQ9+jyH>AG+kLVtTkQH9uS0R4cj<`bPFtSH
zb~=1^*WvrFF`o^day|+S+Zy#vwqLN{xK2I2{ng2nwan3MHFi@nXMYwH{vTH$5&uWz
z`PzM^y3>}<S(7d-RJl!JV`*I6>g6p{r5^3qoqaWP+loh8kH2>8J=z{#SbBE0pmo;k
zWij3PmzAD=S9a)7&lT1e5O-MDHMwp1^X~f<mkzx7zURRP(|PmKN{w$NJIf2d;HW5;
zejZsB5xYJ6f!2W^>vu?PJiRPSc!_6K<hIbJ8L{ggaWN{dik4xl@p^LI;jOOb_1QYl
zL+{3B-eX$)co$pVwZK_dceI*BO$!a#-t8Ouh|f)@zdL)!#+bD4d%_%e+1d_d$~7KQ
zH9t|{>T>Jl$CJk=Z+<*^^Wv8$Q@=buuUuwj``hqWW!2Z_k8j&QUl#sV_4Dw<qbCbX
ztZKRA_1)jRdh+SizOHlU79Z~ZKE0{$`TTWub-Na=yu5kwW&h*q7e9V^^yI~>KTOw{
zE1u8S>q~ezpHDwS$Xc7bj`c=gM3{?dzLJv3sk?Co8;nJKx6WU@DdQ1OMCa$g4Q@-E
zi=LdUJ!HN@S^3*z*$sg_4u_Up<h{4z>UQ5q_ea%%bvoIFJ0D)P%64$e_@pqg_jORm
zv_o%puvD&=HudD(5w@hKgyp?dMBS6C>>GqOD4O#BsEs}P`c}y1RUM!EAK3}Me<GJ6
zG2@NR?c1lPz0un9>-X`=FJ81yUM#;n{k{4T#pvSJutigf9<N+mb6M%+?J4r<q8C_Q
zBu~c9UTj^s&LR8C7VaH(ll;$I)VyDC;gS-g?=_a-@7t93dapEj7SjAkw&>S2VP)3K
z7k_#FdoN*c629X5mK$4E{C;%1^7e!4=?;ZU9&@=Kp7C_k&p*?`L#GuTJtfP{^J>Qy
zXZxd~?*uHjUOy}T&HmA;sB(#gax&=|QGOREAK5vhR3mW%^Ayz`3_JEMe^=EgG4)Bp
zh8w%Lc}#e^!#Y05qK5lbm-&I1mXy-XDa)3fZ|*ePYf-_Jd_kd{`Ac$e%9jnRKLj(*
zo?)wG{h7}t%w1Z+Yu@LYLt+m!zfQK%&Rev5O=RW?uVc^8%?O?O*`00S2ls1!ua?c?
zmQpO8AmHFRIl$Oe<4@D?d9N>CYTF@fH9_{~{WRCAv)u8U1vRXFqGqj~r^0+9tB7+h
zyLd?Bi)m9mD-O%e5O$FKA`l$E%TP7*Ov^#9b9*(Ie@A?Hv98NpnrFrt#d?PC7ZbOA
zG%b8T=S}XM^GjBo-*ZITQ2%C*P4Y3P3nomlE}?}HyUIUu?wMcI_-kRANpZq$p97b^
z|IxefVatjNw;vZjr`Pp;<h-P0(Dv|b&Q9AMs}$C}%3EF|xxKR3V79b*_5)@64{_}R
zm8+JDtl={}AHb);nswacaJBez({{@Z**jSEj8-Ymcv|{=MQuZ}VAw}C0eR0$XPz@k
z*XQ#&IdL&F%+u1_W~cW$+-6N>jH>qjPj!s1HvCpd5cs#DdV;}})WaDeB5_9fy?*RU
zNz*u(j2acZqtDF}dcoQk<8pdU%%o|{QXjpQR50LRT*lSw6e^r|vHVfg(y-sZf4ArO
zZjad9CC%2Rxb|k(bA{bGoKl)$&U*@X3aE9=yu7*mxq?)z&YQ^^3;yio+W%YIi1UW5
z{wAB>>i!c8*FT7JC{|XTq+-MCx=eWbqUuuu2gTIgJPeJGSuQ*z)4EmqrLv(*jM`i4
zO}0$DXJ=`A%ATih7<RcXBWYJcl9Aur9U<EtMC>_CS(5WE^fGN&cu(<<wMM{Rh7&!X
zWw(3YRyvj?yj7&@`9h7E^R{%yho#;vS)m=J_T>L037OgHZl?EM2pSk~yk@iEz|G$#
z7M$J{tZJ=4uQ~f<-W3oDzLz3%CE(svGf(DY?vvB?lP?~T>-cEi!S_q%N>%lhS>~&a
z)*dcnjynIBJ=>ALcB;9c^2b|#tM`Od7@IoPm9lx7Tv7OWRg&dmkkH!4OSG=;c;{#S
zWwYY$9YHK-BB!^C#D`o|iYxwPyrhsfMtb81kKJcimrX8CJlV6P*lyCpCr3V=yL7D6
za#@a+`T9c*mB;lq@M_7Y8XC?JNShQdvg7C*tKCmqYrOamojd&a6_2g%=?DMCw(vYV
zEWRN|b9r_4rmiQGZwk4HB;62`dB@AHt(F}4M?*i7do`QF!>09tu{*BV7}}<UujV=M
zX~%@*?oCn6|8HbP+}@PB`o}aK0|Q1L?(BD72@+OPH&)$nJ!|kGX~NZ1PQT+{BY5W+
z9u}Wiq^zLAk$bKqzwYnX@KfvG81QUb>yfj=EnKGU;U04axhqrVJr?JYsENLG#UlU8
zW)8JK?=m-BcXv8g5W{`A&o$%0=I~4YnoDPHm}xF2-0)Mu?8l4jYj0m`yod@`OXbV<
zI-j~GeZ!LI*($96n7<i`Fn8!jJzRINC->&ZqxZL(EUaaW+<S1(hQ!xqk%oMe4(<-v
zAgs1l!~YahK>QNReb>cIKPLFB;NS3C+cil|(!{5hi?M@M@9NiGW^b>Uw(-7-V)K-A
zDQQr2DXnvM)ew|5U9tGmv4%-M=J{nMOuT8sA+ua8{ejP&MbirMnpWs6R8m&8b8=7A
zUAiUi!|w}+Y+l8;OlNC<CcC54`+S^aqOHmjt1=^=T~fcQ^744YjnZ0jc?<PFow?sw
zvH#Z-{k`6NjhUy+Qs;J7xJjE%NoQf-nDS%6oJ;BU2_l#Dwm3V;1nu;0{vo41`w)wa
zhtYYPQ(Dht72`G}&nqs`J9=%yvhq1gQy-eX(POhQizxD0>)|OSlKJPU)wgvUW26sl
zat(_)Y}fCt6ftL+kI%iGw!LlX?(TP;5|3Vgs{373s<HXD(BHGylhv2i8`eoi7WF2#
z9ZlPR_?X<ECfR4Ex3m}8S(#0Kn>ERl^_bL$bjj+IJdH9^7j0c@Pb=gpP7>L`w<~hL
z^lJ~D2^RxyMWoDBP}b~r-VtePnial%C-Zs64;E&xHm|6tN#=TdevYV2>&_I30Ov~~
ziCb8^?uLn8a67`Vb&?;K;+D&eYZD!mVmLe{T+9V79!%iyveH-du8qC&?pXZ1uKNlZ
z_jCRp_%d~yQlt!fU53B4(UF3dM9utJYt7#u4!j|(^U#FX_~`p3g`FmsmL1hx{l<!U
zvS8$kS*LtcqPF|$w62M3T(0|GLGoUTLwcZ-gWG3|)|&Fk&UroWruL-wa7bJ@b7evM
ztuxA%Cy)BQ;Ym!`5V>uk<X*!=>Jg7mXfw=gZ?xGK^ZcV+<mtlhV@}7uEDu*?|MtXa
z?(ElVl^G;N*VSYgcJT>adCbwhci!4J=H)B+72+e6SOpRvFYVwFmyA0dBdGuS(vL~U
zuEs7q9qn*?UZuc?>I~lKM!Rq3<!!=?m{&7?H0xQZe6y<U)Z+4USD3Ao%AaoCxpGr~
zahRHY);-5|r|tcEO9Q4I)v7q9+-NCwktgP<PHwhLhN9?`;QMom*7j*MD@HTEp8v)}
z<3g+D>h0Yo!I60xa>}z7f9NRG)p97ySzW|0z0B^1%sF2j;bncXy5B^%M}~^M;C;)!
zt0Rf|jbV<$+X+Ya<h}5aOmsYK{;hC+$1&&3Gk1CH4VH6g$SyoP^Vc);UpXQ7i_S-V
zW&V7|^vU*AzJ-0Et9kEi{N%FD{D=LUgZCp^GYjoEXen-D`LsJ*Zr8nw*00~|v<MvY
zV7t!TWMfpbRZn(hRPXZ0#T$b)N_>tR3aj;pakNBEI-FwkDt-UnLZcrYT}G`_YZ}Yj
z(-wR*xooAFxA*O7rdMZfsa~sja>qPYzE#9AREBx8j^wY7J!Q@Nol?F&*>~mE^B?D@
z-IFc)wZr96`imHrk0t)DH#YOT-8i>daNFYw7Q0^}j}soG9QJq~8#-yqAEVr$(l^Iv
zxjgHece41v^Ods_J*Qrp**Up@vF+_qrsANfrLq@0_v;%q{4?OWsa&_7|HU8Kb;=SR
z2NhnQQaJkI)$APSzwT4cdjEPEEOn@f^R<7wslo%*TNWux=SJ8rt@wPv$HH%8P(!2P
z*1i)mQelg<RBkj(k`vOay5<ld@n~PJy6l%@-5Fc!lD@=7-feI<D=Moz&Jj@Mf9KHO
z;@lOPdTeJ_IBJ~eQH<}ny)0(2MUZ9L#?W@p|0nY-?lY`yXf|EF*_7k!x;ZQ7?~y*;
zQJpMP*-(1$uW!s%o4eu$+uxXVcPgu>zS8NvI@=~&A@A5NGp&{KEo?rErDCVNk<aav
zHSF>8yS5<H^s~8lop``4j+OpBl{@A1rrcxs&gtWGbqnhSZh=z)F)mf?FEdzG4sEi~
z*`aAX@$_*{v1$qa_0GHV&ou0O;CbiTltqlM%?mdl+Vm%E$_$I$nx}Rvy;-$1WK}}<
z8>t@OIkPwO&L~*E=t}tfy08f<+J$Z@+;PmC3%5Vu5dB;clkd8$zjF~Ie~t*RMt6<$
ztg^!o*ROr@w<VJGPSZ)bmIrd558ZEwsS`Jg|5U$a!u5%%M;dN23bTZ%`n@{1SX+B(
z@aphf!?3^H(N4}zoH>g-tdy75Y&*Q}>_qi%JJssuS;)xrWVfGZefo>RTjpcp0`2!d
zZHwQCEd4UG%-*#6-aWoM=Zxb06ip7ineEA4_lvzRe$$P2>rC&joW;C=WB1}IsnuLN
zqIa7n9ylP@lDwfHd;6oG-ujxiZBzwL^N6?>vR{7JF56w7_UVvG`Ki;s5!cUsKF+rC
znb>ZF(k0h6`@E05d7_PVi=dlTry0ALmP@6Tc$nvo$az7fdf7Y{GYtd{n0C(!&fRqO
z1@l|)gZT#?5>qZNP`|0a>CyIz{qA!D*mY#RoLPSd9Oq%LdbfFTp{b+$!(G=uzg!VH
z*PEYpeVo$o3c3EEvp+6(1vNV^sJHR3KCvusZMxgdeHr0fXD@rpm$Te@_x(cK3yX5i
zBf4cLI(Pl3x|~ybe`4pObqaOmH{u(oGm1~J>Tg@Q&db4}a{i;zt8;i(ylnY>f2HSg
zZ|OVRQvWY}t^QkvNB@b*^jg#9vRitNvdvn*_7dZx+n;_tc(}1u-N#I!)=Z&X_MX4j
z&4m2<%B3F99p$RuIdn5R&nfwIHE!jTQ1?Z8{gc;JxXGzMx#x2><^I#)l{f$W`*%L+
zJp=dL2~i@+?p;-l^B0vbezvf(=$z|wwxhX9&!!w+S-MMYad%?k&XoPTWM|)gCleX|
z;EEwbPyEsCEL)arw(l@ioR=S#Dk{9;<Cp921awTw7p)Ix=xFY%5q7*5%>UCgP_ic_
zMA9_X<*agD`K$)F6X&k!8J=6tR{2TcQ^B<?$>R;yzO1(ja&HMPUf|a`<8uG1Q=26g
z?K*pu$=sIFu;AFj&;A=#{G{vNnDEA^os+jQczrGCVb-rXH@xyr%t#jCjn`1xbZ44m
z%KNvAmfesFVlr5<)j~!{h-Hxy|CBRtUjF$}<K$>2zWks{CIkN`A%R;Pd$J#Foc{dL
z7rnFzGO62RRy4Owol*L)PLwf8q~SV)@Ji>tMc%1gyH`%Qb#gO9_ZP`YaR-jH>3ifT
zIY04T`KnZ}y0~3be+%2OpRs#XkFI9@Hbpn^RQPf4RXz#lraPQCdMwy#?G}a7jMZBI
za$fc>=l?!`@48%5ZpUw}QZ5;>f90xwZ*jWi!P+$U$H9!_602@^C?34??sUa3U#0!^
zY8U*?)OMS#xx6-c!>)Y$z29Z}5<f?7e5`VwZPm}&MYpCLy}@Yut9ivg{e^!F>WY#V
z^iMp)vUCl*t<x1Y#U~F>3Gn7j4t{T9`9spky7Yqdsn2o&mv`B5-D$afdfnM$_a6G}
zviFe`@HwFLv#Y0XjzW@?H*4WsA${{Dv%XJya@Tg_rhAu;bJ^>c6!FabD>X-G*{2`+
zGdO&t3cfAU$xFC<?@mU`|BqbRwXak+d{CBf?2tUTi^qFO@g|Ma%C<}sYdk_6dTyL{
zOo-?@xVA6#;bqp835oZ_JH+4QzX|<u{km{j<hshqYgd|vgsk{xd~um7S1HpGJFB;h
z8e8YBP2X!UJMugGvzmH^>1>~-ivCcyoX8aZtTj=i<nBF%-?J_9EcR5?7k%App7`6K
zVE^hBUjyV$zLK3jA$!Yg3Fd{Hk9^}}V_>^5dr`MQtIL~U7j?#uvb(x{tO6z^-eFL?
zb0e=$^~mitIoZq3-DwZGRo$N<mbHD+LCz=a=DVtevu<o?vb)Li?uVNoe+m1UC!aJG
zPE_((mhEXcAXi<eyj?Ih?~sY&x*L6WqAoXt-n=?xU8u)8?`0x4uEwjHY;fj&=b2e#
z&GJ^fH|I)dgLOi9YVkq|K|Suxi8oCbarOL9l`MXL^-=8JNzA(KrzB?S-gonUII-_8
zw_=Wxy@RCi``T~Pyw!#)eHoW*^Z0fkG;#OR$RA-7!(z8*UyZ8!@@eUuZrKNxVmmY=
zSao^AXZv>KCMk*N@&@c#(Wt=W6qDl`<+9aUr!IMWb?ZzY_BlmMx{|Llbw?<?o~yMw
z<-SGR#h?2_J+3gb%ZmRfZwR=iIPHtG)v|`@kU89G>z{AFK6&SAISbY=SF1X!)$ZB9
ze%;il##>m#%K46A-nu>NX}gQtKlQjvN7{>)_$WT<teIaoRmAsci){e&(%O5>bCx72
zZVYBCJHv5K^SrR{U4?H8#4_BDI<^+tIjOBbZM;ULd5QnS9}BkqiM;ysj>LB1Y(d%C
zr)G6L(roL_FukyU&Gy;3?v{I;b*KGe7eAE3YPqXt$@<Slg3pyc9riP5<(cc%x9bb*
z#~YSi6JBi3j;ft0Q0l+&)ED(%)^^LXe_8)?xjx_KdV;{is*BY*?b&k=cvRk&{JZ+V
zZRz{LJ6}KbR-bC$q9Qw2W0mqG^P`)MEAMy}^l&j-=Sb=NzW7;7@0E;ydi^ewsqx*j
zKFz=TGWX!eDeGTOE0mr5LB7A6yXT|aWZsH(uL_x)9GAaddDW`A+vMeE!S=)hI&2T!
zK6Y$5uf4kd=46&hrnCFpc62l-o)GlDH7PsCsO0`6iG{%duWR=xFJ=vAsnq)J>-iyZ
zWq$n3=bx0f^~|=IzV%k)8Z*_y&X?yU)?^&ljNh^$UZ?IPGk<i`hftw!!C~7A`TREd
zZr-FX<)0J!+r7v(!l7H&aMN{RQ{(*W-yY~oR=Nw_*#D5b_JLkm_Jk`ACt?!+9Ay5p
z(Pw$A+1vfAbHkS}`F(Wuskxoe&%DoGxteKLlD)ZjyI)c0GF9)@MT=dWRx)!oN~&CY
z%ND=s;={FE=l;ETAmH$)&qCny%>6ayOY(kH>MZ+}IwNI&1<(DA=*#O}Ph9W5+Bngw
zc15Uw$+4q`=d^yv23T)U&Ohm-D(+u!>SX@!Lznh8<<%%eKl*N<<h)z@`J!&w^xmV@
z{*O~1mc^gUJh#B`m~{qs$`j}1zyCUQ>P<S}lz-&n!Pn+}dXl>)uL%zIyf^ptrs;3Q
zxepvLyYF*8VWoLeeURX<+rNsQ#DAUeKJoDu=RGoy&c5U7oH;Ks<;j!xBK(d&7+Z?o
zoU$^F`4s--kF8J0z0{<G!Bwr9=29%Tzid;poh)=ovOq#{$9<_q_7A%?-%eY9?53TB
zeXac(HoHeXPwPyKtaCo<?OGYzXTs9#XR$Eb<l`H5p-DoFm1Z{bGFK{_4jykf%Px4K
z_DBAo<5OPnzkhM=<H_UYmoHB?4|}jQxO#I*dibnq^J-pau6Z+w=Z^Ewx{mjMImJ8n
z9I#z8d7;UxBOioAJ>)8~zSZpB^m>oK<|XszQ^Ie#f8SBi{PINO_h*k^KK%0L&4<G$
zXB(83#O~2i;GW9<>Asvytdgz4{vEw<Px9JW30P0MALCIPl={S!&!#e~FH!o^tV>c;
z!nN+%)NG5Je|5TbwPeW2tYurLKYK7c?Z+v9ox0adi%c)Xmbk5wWchvXl^d&d$jz*W
z-7=|L?O22sy|OsHVI$A%L<P>~k6VOGSFAgimHO1@$+f@V(jNELzAE@veEs2@Kc}Ys
zPxxolRWs35UM7d}gxj7IPNITUy+`XRPYBOZJNCAR(KUK`RP(+S$9%uW?o)a)^^>`3
z%AtVj`SRIkx0!kIvTT1;K7()0d|T;PSL7Hz_WpjIy~uu%Xy%TKlHKe#@1D_r?fLG1
z(v*u0Ywl%jlA88%&+T28XNIQ!Jn~VYlv!z(M&ORyoTt}yU*g~@-}kDelQ}O_r{kjy
z!!G8+@7)fM+Ify}2hY0ldEZwNF1eY{Zz{<MD5q>m*q$<T?bdVpjNk4BP0aOs<X-w=
zdf+CB`p>Tati1lahwh4BDtKgCLXZ4vLF4AV|JhOJbgU}uR-a;JV3@#<bJC$WGdD%A
zpmHmG>BhmW@+w=qrY)0YlQ?nV%GWSueciO}*@+TN%5!rM3B8;+Wv<SN`uh{7=$tAP
zN;tryvg}Cv_qy{J^-umdef+(<xDNBW2N_eCujia|_;&K<tTb;6E6=`a{gV!B@>QdC
zOf4<zK5Ng^X^d$Sn)75sqthC18+Vfno379H4xD5%H+<Km3CmihW-FR5oWt#FDjf5*
z>Z^6_?z9@m6-twT#Y{5!aj8T9Myby!C!KHQ>$St4oIUL`B|EGk<m|fzbr%^Vt}9#@
z`cU6wrRaKm)6~FN`5y+J$LH_=XDQKl`SboHqj__D-I~87ePNV8&b}ljnAMYS=7f;$
zu=hWwojTfa-qq)tg7-4hC*S6F^{$_=JbPi#|H{;I>F3gxhoyU89teo-+M}hQ_U^XF
zu^VSks?7ZJ!^nqyep~bBi&y3U${q9%Z?QH!*3rEE_3sM`?r&Gmu&DNN3yV%(SoP$?
zLxVn7RpWsBD@=maI9}fT9O*b!iMiSCe%sb3M<kAK;x6lbaeKx41!8f_*WXv$bW`i}
z?0<@;XZHntxbyF1al`iW4D;L%>^48IG|#L#Z{9cI@AJhDIDTkukSqKAe)0S1&Q71_
z%n_ZHt8n<;k+0j|@84tTS+)3MfsxvBl`V&ucq#>UtKNF6>%Zsg?XtU-2Rwf8?^e#(
zzx~c$v#`fjPTH|&dm?A<4&wVhYmw%Ri&x*zzj$Mt^PvQrU4JBws95;jQ>=ct>XFyw
z*Gzuuo0?9{J)PL6bJXH;rj(Y(GsBOscE8{5dL`dDJTbXFaFg}Rxt&oWUEW?7yeF<+
z67~E>%fq{Q*Q>Ik)n8bzsO>0k_<ifh_t<kB%&iv-5=y*YMm?^c@3m_|pWpYJg&`6q
zwQYxHxpjB8?AKOPEZ=CQ^6=^w=jog|E*l#sTo&@1$s{}b#-&vkmWMYvyF6ps$#y@v
zrgQDun~5v0D6MQP<(#4L^x}~d>h^P!6n8G-<Lg@Js<<ulXn0J{&d-f|ROA&FPi5M~
z%A(<zG3{W~`<0!AtFBCL&EOHraGh4d%)&0dlkLH@8C*W4h2A{(86O>y+xY*Dx^m&q
zo3mLT&XxZeZl>}hS5*DlyO7K|HCrcCKRz&XW0aHT1)04mr}!kC)}J-zGJaehe%0)I
zsi(Fv!>@lP9i4)=%#D{gr7w$c+uZj3H?O<<lNaVLF$PPQPky3(eBJD8{pZf`m7h-%
z-<qQEV~(y?=J7x7t6t_@+t$a@YI;%K|HMJNdFO6fHe}vcy&dA3o1*@DQc~tyJ?_rE
zQ+V=y$}Y0Fvo6_kZ*ok-rkzLB%C7V8Il5<s=pF^_9e25AvIk~6C>ljw$#l5Aq3!U7
zli{-upUAFx?RQI!-`{sqkCrSO`*At319w;Xn{E3NZm3sQr{?3l^3aKv#MHOPbnh>!
zJ|C2_z;d@^Zd!7cO|^k{;pw@vwzd7%uya469LZzr%0Fx8>^`emYt5SHmMXmPYfkEt
z=z3xQB6*9uah&7&>$Tau{;v<1)v4TA>2W;bL};3iU*J+@pT#z}!tYJ|w1V~7rI`=n
zE%>GKa$dPjv{wGHPkzVl%%&Vkw($9Xohoh#ZaMU%`1yfJtF|0@mT+vvDU;1ywZ^aQ
z{2KCSh}>aN^7-^X|7-o!y%Rj9Cw@q_xF?>krF-+jBBnJ*{L}BZWje&&?mFa{nZ7!)
z(cnNfb7f56qw<wM6OP~fS#Yc5P`1z;mG{bf`|iCD|D(HcAMav!KcCw-llgX+UKd!B
zwI}TA$<22&+Wh#0)<;(Q-bl;PX=U<uu$ZPIrE8|+?yz*%D$V!>Jt8|Z_dhrr<|^L6
zl2~IptLa>1;1jVcTTb^WKXmh+mDsIOA~SR4SN(6IWz7x6Tb0*p|1Dj<TCRJZ`kf=|
zl|MOJ>E3^I_r(8;i9a<<H(QqIP7Do7vR)GN#NyVWU3^J%lmmTg&hwp_y;rJ;S!-cL
zn~nLTJ+)WjJ^hyP3Ewt4=9zkI?M@D(s15ZC_VJXx?@ODsZF|J^O<PUg7rpj#+gp!z
zlkYac2Xn4*GB9ZCFyOl2r#Qc~C^@w_6?Ci9QK{Q`w=KTK#yf7|pT-b+LgYrf>4c*t
zleP$NnJgx)pC+ECU?4U%L)$xQV%8(gU+=5=^p!MEt}9+EFBDtBcmA*2UX|zb`~LrZ
z<-9RTG=06FaagC4euTApzSOQ=Y3t+E*$;Xbg_zIYwquvrldlK$>(#rn-To!)S?6(V
z-=<A@*BIPc7Qa?Fal6X*lF56Q>zhnekM3F-?U)gIwW({-x{3wzoxZ^#;Vng*E+lkD
z))r|uC`9~mpIfTh-TCYP$4~onR3EGp{<0~hx&70-EvK@3*BmdqDVl0lGh<_0=z;gE
z5^8?r_3oK^bZKQ=NYhr|(+}ROK0Twu&CIla)xVJ9TX7#H^zPq3q5bpG6{op()<ra*
zIsV~`wr=+u-|DLiuT=bhvf^CB#qB+d9-O=3E8`OV&EII-s%WiO)1-s?UU^+ul=L>~
zvWMgmmr0BC953m3@7K8XB{ul8$osQ$ZRyP)lV@+7mipX>#c|?f*G)gpFQ5G7#rMgJ
zzb{XJ|7?;o=c+3+j23U2r>3H6trym?ApTBwMCNN5pC-%vSiiGg?mf|AyR0UL)Gf_j
zvrgoES3{_$rF#A*A5G0SFT0;*G5*V27ir3#XD<??BYtwf)`N_btPhHL)hx}-XLonY
zZ95Tsu`Gur&t>)=-2*YVi!U}ENJ^b{(wZ%bSu@3h?|$*@In(|){${X>SIa;3>F?Rg
z-B0$syCurJ*ece1slW5(DYJ7`4&;4E@zZ;~i>FE9@8|E6H-Gs%zc~BJY3qySj(oZ+
ziXKaDvJ9SQ{b|_-mOF-=<%zvYtUcb{HN`s^_FbLa^K^^$(TAUyYOOd#4)4|Y$Jr;K
zH_3Px+tU)?lS)rx<8QQmZ)%=9H6(sd1>=*aM?<flD$trPSm?`|DC*|AL(d|UQPX4o
zf-j6J7g|ij9-BR!5!*NSd-bE|lT`mX9KP~f`{x812aAP~$BZ&N%YI9$uikZvYi0;X
z?o59kmL=1ceNV6auRBpVF(=eZYqg@dgWSUSfS5B(f-iRl6<p6TW@h;^$yv&y%_yZQ
zzgWumjr)NMR;S-9FLvir{eFGMo!Ci_D_P&2T3)kgyTR;vat@n~_}H(8F-uy$y<_lK
zT220I(3O_DwcR~yy2`Fj-J+^{nz58sMBVGb{*9t<85W%5%)Y(rXi)QIZJs|tUR;84
z7dEl{{QCQ7fMe>VX)nA=wuHQ5u1<(>UE#ryuth0DrE_7PkHtPd*)76br%W?#(bag;
zwMrmUswnK4Vd12AcYM!CIc2TLj*xcq<d?h|-k|JgJ;NZEr%7V!bn$;hC%)A;a>`EH
zo}u|~x2f>;(qog?opjjzaQnZtJ<k&wHt&q$n7%SfrvKU!g^Y69J9&}Z`dfZ}ef@Uv
zTZ47JI~(48*1a%8s9Io;<l5hItb5ljh>5Sg_+`l@&aKxr+;Z%kzxjV@Mo)jtj2|KV
zb%K>&`E}$jwzpgU^5c{Kuh9{2VfI6!@`U-Zy`MVxCpA~!Z#u2<v)ZZYNBoCHkD8jS
z4&8ohdbCC*T7{*TF|1|##P72bRpc2n5`7MISWPv1EGpU6UU$~}Qy-`Ly9v95ebqf!
zCq}y2bRK*>Q~A6btMv`G*-gCa5hf*)lYUM(D=6o`@ppnxQA&dR$FB=E9dx{)trn!p
zD(5EV>fik7@S27L`nP<e3hp&(OWBAqD5YQjHffUCf%bbjm!J06RGx3D`7*mGU`zAv
zAGcQo)rQ@lX{NN~rC;5qqZ_wO6PUYtQT$&$t2tj=CDJBF`Yd2SD&D>-{R2;lNTJ<{
zcTTo8uXe1s&fSnY`MjTFoHdi%lc43h?r(UW>XGvQkV(k5lMAe08NO)Cd&d6vF7M^f
zhVO$--yK=AF4sM6o@=$CKKHfxC;u)sko=l>Y?_<ZfdZM6XYT$ylTv41_+nvaZTMun
zof|j3+&TC035K$;@IG(nj)E@t`&Xl*9R9vNbLY^_MY;>Fw8gYd{h6-AWq+RIY#|$~
z<F>mGrU)4?_$23`n`UNrg7102<gFpWEf@bBj!clrusQ!xT+_KY{N%JrVY3T5XCGlJ
zzoWdPqiy1)9KDTl5h+Hkui7s^lI+)W7U_BEoyS$^tC#(QSuj9NLxXpNbE8FN@ODY1
z@Xx;PA+<bPeZMUXx}tGYvEA=+LeP@8FKa#4zqp#?uFQB`<u0#UxbIhOHT@sPvkmP(
zimWtLF<ZSv<Cc2kiFHTRCf41zZYghlbkcc`>RZRcOeLM0emT_{v-+I>9Z0Eeeso00
z@_$WNKvRxQvBktjCncx;BhtogwXZ%jocT9L;G((Q<TXXs?he&86WSLWXSatvEUy&Y
z8C$`7XMKxVq^Z%_OEG>I`W=ia_FoY->)Wip=CY*riizJVJOewW4C`{HBuqC>FEBft
zBy~38*5=Pib|yldY7$Cp8Rb0b&yy2HgukB?-=9;S@;?2!&EZqB5#0Hc_q=nsGI8xE
z)r_WtMw8S&Rh}?76dAcFPQ)Z8qT<Rm7xe}m)n(k*HY>3%kaxSRuu1X5HE*Wxu{pvA
zBwV7jw@<NlzJD^}Xl2ryQ(lT?ysqb-z2baSa`VBAD^K_yL@Zh%bNz<y&caPsYK59!
zu%!DrpPg%`w$-rC#P+uGxz$#|@}C;HX9~QV_s#d?^7>u3_x=ybcz3+-<%UIS57Y`W
zk4`PAof%kUJv}@5XSs^qnOO^2wjcYMocS-yzt>lG;wh~JgEW@u!A)(KlFBChd0Sd!
z&}~!e!=pMsPE+}8PB!N}{~xDv>myd2WYjgO+7(`W{%POJ1rw}3C={>Cn0+AW^~RZ2
z@8_)K5&SMXdC9H78OB2UoI97Ssnb5$&Eg+_)n?`Om#vFKYlEzP^j^I=uqs0}aJhiV
z3zyD~&W&A_%a2{W^ubFeo#jc+64rO^7L|RC&eng56iUOArDmS~D7dL<k=${&Q<m9B
z-@QFB(_q1R^RsDYq7A0byS`oQygv1OiO0Rb?5CTBXXfl@-1pwjsaU6HN@6C%!74L9
z?pu#0rcYO#le;J+sr1exl^-9^_%yHmV7zc=y6L7hjDKr?%h}9U+BV}ef2na;M^Z+R
za@AkEQ_@};oDCY2bA|d3SRTs?n)Kc`<9Aq`_NDr0mNFv_<KmMCxHHZ5c^>ngGW-12
zeXe=dY1a>&%0X9r&jyuy9<V?0S~7sml8K}2_*c(jqie5^l)t;aMJsG&guNH@hN?#<
zQO$44{j>zn$9}M$GeOGjY5o7J?}X1EeEH<u<dZ9dPtH}JbU#<|(Nwv(*rr7l=O(=q
zJZ-t1Z9|qsc;fDv|1G~>zMHjNch0Lx=^u7BEHam=nUJ~ftd(u`Z$X`_byY8~nC?3E
z$MxEb+cHn><V7qDF5bP%%$<DS`NPR2bKmF1>wI{eabxB3FHf?T82wk~JK3b(!|>8c
zQ*;8`zoe+3eF=MGMb>7`e<&CAnaf?|k38z2fPt~&8hdsI1_3b!T-SV-CsyVp=7Giq
zrbfi)-!T)azwdw0jDJ!=lp=3c`{761JZ9hM4Lr_wZuXMajRHG_%BOEtS+yvo`uvCT
z{gOdTPE38XqiVy}Cx7PO=V`BUU1zuVe{J14<1kM%`_qwEKk25QZTb^)Ip_Sd{7Kh0
zhd-ISf}i*P+vrcvzRos(qMVy|LVwYX@|a2gr+j$**6qJnQQ7ayIoonwJTH~p-Wq%O
z(v%OI#C*LoLOZ8ziwP;ZrqB8Nnp{@gTaKwISGhfS?w_pX{>FIQePTIlcjv$V@obM)
z>u-7S=2GNVQQP88FDoWW3%<9y*;V8^TQ-}QaedUaE4<D7IWy8VE#}-^AZUBJb;S)X
zv!p|-LpGW1UCMesQ+pPtptP2xWKCja6!**~C&};o^WS}0fB%Dhl+@&4H$xZkH|IQb
zW{QL!G<UnA8P50k)ydjpSv~i1j%`nwy5`@Hl1cl17kqlReRFrbxG__|&?4oTM#83<
zDRYZAOcpbAT>k01O?Eo-^xkcKPefI^EO*yg_`i$1wzVX<Ld9}*B&)<Ji_KQ|XK!ux
zetG1qz&u`Wz0|uMvCiHvlNPSb_~^NQ_mbd+yK~mvVq3IO_AHl{>dsRcUw<F}e8EjI
z>P2qNtGwV3IgVydB4vi!79qzjE=oD88`ib`#OgIKiW(*{JZLs;ue%>ue`>YNntWHa
zu1sl_V|9s_N@YDnUn;2m*v6dyVe9H&Pq#j0E;hK&ec;$qCN2Z#CD%94y!L0R99Ps+
ztAh^%LnWEd>G|oOytHz;!H&x{E54R~($C=h&~~cw;Q!;FQa?C<%8%$asXw<Z;Mbl<
zxwG0PiAJxHn|-Tw_VbQ2^+B%NBx2rYU26$UQnlDKQCM+8_k{q*DVhxDi>ny!O2s(x
zy3aAU)<~Z9`B?JgTw`B-Mnlo;OT6EkcYE1|e<-VEIdx-Y|JJE5x^*IVi|_Q=C8d-2
zu=(y$b%)lMwUI2{2O0jz{!WQ*2+BH?kg@k@<HL>o_oMe)-h2}!JK;|Btq1pvS~`xb
z>RU8p$_19Q$M`2|dz){&uxge-=J%Y>+|03A3;48E+#Xz5moa_$mI({;yPU5->`1;^
z;&1Rm>aVqy8>`Jq-VgjOIh|iWC@00A?#f}6IRBgLh4!t?wT1_0D9#FtjWuYvWI6rq
z*4vw}y`J&nf}YR$AW>thzipoyiyumCU^$nu|Ja90*IzPctAp;k)c>q0`!{b&!I#fn
z6NUJEH!a`Z;}K<aIqpNpyP5qiPVZSO5<Z6?vWtmZ+q33~a%)xVssKkxzTW26M|;i}
zKQZi;F%}Ye5PjmJ!UFZfeP6!>WlguS)vtJ`QL?m#bD4T=z@2+jI%hQ&vfZB{GWS^a
z<}GSG3>+f7`&s#!PXF$zNws>kRzb4$Lw<yt^#Wb~uZ&@<7PP*28p|e9&GvdrqCk0R
zz=?w_^PGjIJ()FmZG*6wl>r0q)7Jan9X7Xjuhk6JdHwaf;moLh8UG(uZ=3j@S*^X|
z9_eg3;|0Hd;)h~yuC{%QTAeq(E!Spr-l|q~n6G@%$&F6Cgtm(am@_zEOG=1ZaX_WO
ziLZ59-ol~_>8!%#TP82cHk#%Y8Z6YX$kX}h@z-A&Hih}NuTl%`xHD65_m8g+jNGnj
z9DNYQT=QRBXSOQOPEX(4wMyA%uGC7;Vx1#7QO)GfNwIo2!5gNZRZ^AQJ=b|Y<k))q
z0pm^i=ifXel%uEjyfG{IVY``I=wC|YZxPnjd6mjqKIdjU`L!b`d5h1~qmN}|9Rv2-
z?*8$m@@v@MxVpHN-@mr#2+v%(cjA6eGu340&C(f$-nmu(Ppf~n_T_JBxprfglZoZ0
z%Z)$X_awhlFX;DIJ0&!W=TVxK+<|Wv_l;-0US=XWVPeSg={^3dzTV(EF7(*XVE*?t
z#VK>OuPOikaB*3!aEX?Tn&95>^AGsvKR0|4Xw!MP@l~Xb)j$7yJ9dMu|EJ`itmDf5
zv4<i5hs)xr%6DF}Sj^14GSS}d|KWLtW<vW+U;Qjr?o&T|nr)Zzv6B<I_g*t<pP9Mi
z&<*V`pMLns+SNQ>^jX5UKj*I?&z6elj<;KFrF>K8{nVE``ytA}C+Xc+-`-@4O}wq`
zy0&kB*VP}YI6ftay?R+!=?=GYi}pi1p3mX9z{(bRU$>J}=3ra0iqE;)$?8T9ce<)o
zzD2QC{9gUoAU;5Q^Q%+5GAr|Tf5?fn%jNFlNUm<<SK#!yvb$-i!JC$Y;{NkrZSq<r
zY17FZx1;Xg<rvSu%N)5Tt~~EstC<#i*<ree_Wp&l7v9|M@7JE+^lqo+wIH_OS8r6m
zSjIA6EOM&e6fAnBfX9#H$jlYnYPR#R?OU+F{_xi;(RNbvt4>7yu$vnn-M?>V*a`cF
zw7kw3%lj_P+R4&q^5v`gjwj@3uk!qm_p)Yp<IGc%+y9B|;p$%`!GG>Z^X84Bub*?S
zHMw-d_DqY>k?${DO}E}MUi9oR`;$tQoe8({RZp&7xNqb9Rh$Cr{50=+1eWLqt53dW
zIs5E})`#hWejg8e|9F!w`aZgU+xF{^>RCVSTaRAzsvVQwvWlC5VV4R6&YCwfFD1Xc
zSg)Y+Y*cRXZ8M>N>*5<{$FzqiT`atG?`)>qTH#1P(~q}r7G08dJ$^|=W#KXoIfq+?
z#{b@L=N3@;p)`N;x5I|PGg%ss?t8yEVgAI^pAW~k9oJdXx#V!9%jBN55~9kV)OZi^
z%I^CV_if%pPXG6;(fLN7UOoNCpR#Y^lNPUe6FTl)nz1}O!re$Jr+V+y2hopyueLeO
z`nC4ZHcfF!&Pgrlj>jsLs`n=KsQtWlr#SN+i)s1I+EbHEIaOwU=Q=cRq50oAjHeym
zwYXRMu)F-9tEzo(#>)7ZfCuV71&&zi-kUDGO~dodI`$`4>4jISWIu0}O!jnh)zbJ=
zbwKv3qw7OnqevgSIrIGe`Ts7y`SHu8`u~LiJTHFVeEH<ZtAbbZ=k%6M{(19gPSs7v
zA665tbZ4A!olvOA`;^mvQ-f;AnZ$UJVu!wr1~0p%<;<V{=?P@p_Vl>^<K^@CJf-O6
z<IOkEpNP@o?BPA4F3q>j;KH%Fb$pp!V#eJ;2d^vL@Vd>W#QCV$mai;!;!gAb*MDA_
z|Ho$Tp80e4Nq^;tiDlc#lE2_uwEmOZQ;uGl7QugGvX1S{%*|OV!hNsqdmQ{&O*J$m
zzU0IqAAi2b4qltDvUbevp5V28&Q<xBl@+cgOFf^gPgo|?xa7D`8uwz)_Z)5KkEE(4
z+)qvRHLZOYt9sy^)6QAn#p<6YNX!zw_uRK==Et>i(P1SKLdPmy{&sLmHN_j;TBd27
zxZ=#0FV1R9Tv==v#ISCjzKu`M>8W$+&9h$f(lh7va_DS|2y*6Cv-)~b^^Q*Gi|47n
z!7CzFDwf^R>oD#A&;N@3`5iXTD{DWw$sE`exA4-T`9123(_+t5-4m(f`g(7picrWT
z!<*sfm0E6x|C+k1KKDdz%gjH1uYMFtOJ1;e_2$b99<k7u7fRoKv0A=9-KB(;bC#;k
z=i2Z~6{ZSd5xpJBu2YhKHk=98y0b5Q-PW+Lt0NsQe0Egmc|OZf(ez2Ck2r5BuhrEp
zF--!?Z5Eauik_8Qp|aPeSD|)C{Hg5~mabd}@0Q9~EAL(NH7P)^X2TYtMvcU0vwcD|
zmizc<@E&X3wk!EY>9ks-KNqXkg=~A&bYwy7BddkX-iJ)Knyy-uu{1qo_mw#9{(!Bk
zXKn1zJ}$yIdCSE0vBxvEL@a)#H{qxMxeJ$>j1&*tcyhFR(z5X4K2Zywm8+Losi@_B
z5Yq0o_F{}rzwdP>{Yl2R(<e(@_$&?B4H|P4t|WQY`8IrvzM(B_`FHAt^Co9DKae^k
zzhl7_r2<dQn<<f6?$y=V({ev$oBW*T#izCI>sz_WM$3!x|F>WNeeG3cfwQA#Cc~Xq
zrzUwY7z;ksp2T?NCW{hRrHk?vzF&4(pQQ@U&&|!KU!ASNHb2&P@BH(6&qD<ntFJpR
zNqcwb%2r9+?yLPeeU7r<RYYWr4#{2AQko&cnCyBYpXtD>X?NH{m+5gZrt{veh|vC<
zJ?)2KifQ=FYt2`EKCl?xJs`&OXZwlJW072y7gEx=KWM+c82!<v^G@4o@jV)f(Tdko
z7<n``SgHdUTUw7^*>t~0ZL5B_!Lof8(Uq&2_4y`!HR$;$cR8%*JO7EbtDha$*~xf#
zG27bblX&bNU9#wFd-ZSOeZI@-Pg)j6{?J;TH1&zl9H~zh!V4ygq_`G~_Oae#kDIhY
z`BAyVnNpTh%8g}{dY=o3m;TJu$qZ+@>3J?<i(_$n<?gpP=QgX^^eb<bxZJ53=W-=j
zc-o9O-S}Mr)$A$KDG$>ax;_gY_;!(}ds@u8&EJJ*J-vVLbI{j&pN)Rbta)tvfA!_L
ztu}(+*sV{>$=6#bifw%|t?Nzn3EuV%Lf)kZ-|W7u9sEsRG3-o*(9!-G75m&i?3P-6
zdY9v6#zs3P<4Df+=PVgC<Jq)dNyRg?JQ3e<;_YPd6vnpfmd9cq9Irg3Itm_(nXz6n
zC@U(pnJ;_ZZ~0n=d)s6sstx%670;cUXQFi9v%SWB+r6j{Hl@G+icO6QV?EcSGIjRW
zX))YVccv_U`{Gypy8f5GITtNF<RAa@EZnf0N9M}!okDlED)L3hWij|k?dIBWWkHen
zy}O;4es7S-YEj&Ne|zM`-eu9B{z<q$UE((X&BbWB`$6GOvz?Eh^M3z(f3^PHy5fJ6
zmz9;=yn1?*Z<*{9sgf(NR>$hJaul<4@Uq&Uc$~8*f{&wb^VPlQCd^9Nf5b;OQQpz}
zZNoaf%ZoBKu3pWp*)2K!^wZ?%Z09~Nh3K-wQunr=3tZ*Vpcl<@N?vi5$;{Sk?}hd#
z>@8n?plQ$J+r4wP9*`@WCaZmG^4rP?>yVw>#I`Ijo80l1sX*5J)umwf$n7oFhS$D@
ztUO=x<kaumTRGQ<>A$mjQ24^zopFiKj;EKrn{yujJtq02w|RT`=Eu(eAHB(`YY>$@
zeBZ8U7vCXi0q@-Tnspy-4)p%|n`&Je>Fh6bFk{=}C5%=w*5)&ptjrI2W>S!s{<@($
zjHglc)#~HBUuE8vJAdLROHRiEt_6DP*<6j>Q##vgdq2%#RH!@>snfy9aGPPnro`or
zTrzB0mm2QmM(j{bY?vW8i=lJN)(;<T^O#&;*)EtQ@{5_l!(bVkz;#m&Kf5#f%ck#|
z$=0(pyj{wS;U4q8hmy0_Z(gi?XnlP%@2jxMKeLY7HEYSbr1b7{nDt{*ucz3#xI+sK
zijFW=Yu6Q&ncD9Uy7yS-jNjF_msZ95ht@RO&brmUif!j}xqhY(2EJlR5@)^R=B1TL
zYG%Az9dv}x_QUe5gD1L@q(ybAw;t_qonxLfclF^{`t^eR7jAey)n%NL_?GqdgSe}2
zt@ZL8rsV{4i98i)Ej+P2Y>6eK!v80C-8;U2UGc_wYnbAS6~~WO@!$K)cQ$&1y7`}T
z?dtk5o99QE{QD=rKK}aABR*`C67^Oe$x&C^u$1|Kg4mw?{b5GRc}!wL)7Hek_%`LZ
z@`1KX+nVNS$*p!tN$nCl^fURG#HU!bgHNs6LzfrJx)(UqZrswJ5YA#8&NO#dNq2I)
z<Pm8(?kVa%tNd2YU%z_JGOxa<XA^E5)O0<4^mOWS-8Gk(Hk&rQ*mlZxv4lt2tLv7L
z&#q6XVA~NL|992=GS@EaZL2xIzc^+fdnt7dAKw(E*u68iA8KEJqewjJ&AmOpq8>8N
zHBC_U5ZL`uJM*F|GsC;oUlxM73!Nk#WeyzJ|CX7jhUcEi`k<#PAIxZCc<?b`?v&oI
zs}00weE8eqE<2Yo?)(Xv%~dU0iU)Pm1)ohem@va{MMF#B@y6^2vO*pgKYL&J$d_a#
z<6z)*Enzmx{u<A&<3TfQdUxDYURD}@PJGJ}t#=ou+WvSIC>*x<mx8?0@!*<;ing}b
z>MLSuwUf2>x0e1b3f5t{wNy^#?Qz+4S4v$P#pPNr9WmYF754jy`=<MQS=QS>im*DK
z&-lpLL*{5Y-_F~Y_Z`~*LF@0Q^B>I4IOjCjtU5J;!T*J%?5|sEwKaB0e+gT;N9Q(+
zWaezX?s5U==hAnzrymV`yU+0($I~@0?3y$VT@G>Fn5XdQ;DHM+AFPipyWRNllHZ+g
ziEZb;toUy@gY}cR-}Z#lzh+MI%lYy8wbYD@83~hih5FB`crGKfh12nmShtsR1;c~B
z`+-+;MI2XiTnW=|JpPJ*$!!z12@kERXRN7N9^YH@>xz_=sIqR6=x5f4Sr5+NaIzMd
zz{aicmHq#Nx3f>bd^vma%f|1n%#H0<96xrwPuex3e9d=;Sm)$qzLZ~ci?3{tF?DzB
z{k0@Eo_}`y#4WKK`#NPBv`aWDk0nJO+9MU`s@_(?%0Kx=%q!hlx=*)1&g{-#Taw$r
zu3r@OS;{NI;_$+=cLYp~<mSoPDLR*~|C4^zvPQXear5DqmU1s-uH16nqq8Pm=k77S
zyzKjKd$yhboO5Bz@3kj)Sf|~XZ(X)>@82ZGlZzjlq%QQm@o|~KmmNQDTQ0QuCt=?2
zdF!(2Gre<`YktZGD}M+$7!uOceOUHSd{~tF#Q0ep3+~%Z%9+cwb6O#LN}}yTafP_>
z_%ls2{`z(6A3N)RrsGle{cWW)M69pvugd27dk=lab?Jpw8?P`hFz7QfFvy|q`!7x|
z$}A`;){l?R%*!l^kJl@x^z}RKb;Lnn&-rkXCz~#w-88egU54di_X2?n%?p$aFDJW|
z$$cqt`G3zdqVV^n*sHOju@4vSugrRP$3ro=I9sD*bKj1`p;E^>rS{%l&2`=I?}pzq
zSgP*FJt$PV6Wqtxw(o_&WPK|R-Z;(E7nOO9Wbatd@t?^0_skV>FHPrd8Ji@I=g+^`
z+M8*e@=&)Yu3hTv(@WN^LFbfQ94(_B2Kg8jb6(R9PJ9#B*Jcs#khJNYblth8BNxvo
z&%Gma{ne3`ExG^Xbl&F_e(NvU>&@(4m$&=+uCV>6!;LELFDK+OGccrcFfb@$50B)W
z#Ju#h{G!}M&>VDaXl(Z#Gm+Zw>vx<L%9*@z=E-2m0)-{KB9}@s*`qkRFW$IroRxdh
z<5S+B_r+gLlh5as%U@G|d1rm``Kj+7tp6SVPjlY~w$@{hwu`ksly%?Q-mjc}E@F@V
z_LH(TlOC`6@iOPZ-?Hz<GUqt<FP_E}RdXb+kNIY!qnV25@+S<XcYV`>BCa2357c7z
z;mDlvFzAI!XZ0%+qoo&b_netiUDw0*eM^sn?du0SLME^1ol@I!v-GlYVbN~s?RAfy
z#mFyT=iHjBt8VP4He<Sm+|EgdRApkeWNa|J=dFJAfZl_H*LIwEDL8c**DE)^DHd)w
zRy^_C=;(f9{e51ogTJcx%da;0eBvnQj5g;<2DaU8PUYQPH6PXp=N#CpoWT4;wtC%J
zIliajzv?c#+2%O(^_~3Ndgzn(&5SI`yagZYUb){s=KQn$@TPk+p9Rz~=$)}+{1rVV
z=KZ#SgX!0Tt=|Z~Pns|(<-#9#-kk7xvRVrH6(_}Z@Gg;Gb=U0ddNzGGyA_<_9RU`y
zN8{f=h>j9jJBxdfj_PsOkLFscp}#h4+Ee`N%T4C%4u_h<%qG9J+*UAW#pkv?ll-%0
zcHBIix4UR_io>@c$56*pztqiMi)8#f^e`pmRfp2SX}7kh?46XIc4p4qEBn`ch<(ac
zT(|1(B8eqwYtE|hDlU%`()Lqb>U8be@tX_I6}8(aZS0y}>}x#z>6ex4huP0>a5}A3
zopk5V`yDCTm$uHVUSoA{@#49c>xCwZXZ?G?yt&Wie^!i=Ny_)&rw^|`a&ujD=F)kQ
zrca*_El7LY==9UTd#`QyvbP_jf`3c<{^`7R<HoTp<x3g0opo%_JK8qKNd63(Ct@yP
z(bx8q%e}>~>&s*vu`iyJ4DLz#u8i~jP{nhXCHkG-<v)RQ=fu3f>zT2(ed?OrY_W63
ztEFdKUpyk^?KO3mQMU8vDf{x$zq*x8QJGy8?3%kjY01+iQaL-TcuVF~+>bL{7#<Sq
zu)F_g_Hpld7Bj+lZwj1>tB%b1pqe01UQo;3{rlkcudgcVwzBK3{1|5Rv25?vhw7GJ
zb6rd(JL<1H^t-`4|Lbg#drn-LKi5A|^7F2{del`||K76e4c)6JecD@Txv50bZ0{a6
zlR6WPLm}U;ojEORRbAcL`steaajRqDng)@crC(d@x?fsv-Z^1^<+mi=Ph6qv<QCfe
zL|ZLV?;>A*nwf!N9Vf<W5m?y;&Z{MvDV2H!l}p3C`)`{G?0X%)VRm!MktFk-rHrf*
zDwZN1w^?_!GjTgV@KT-~*%k8h#@4_u`^(#eQg7yMV|>+Z`^0Ad&$JijZ@%yLub&d1
z!hFl|XEFD!(|%2R6Sp^Klm+a2e*LEOw~IXN+S{$q-;3Y>yYue*hQCbbGOism)-e8(
zaoncE?zB~QRoL~|4+ouMjc@WFt5Vxy7FUtE<@BbKwC&9s_$IwM^f<wn`CM-t+rx4%
zJ2mlg4Yg4IzZX1BXG@t|-(=Olsv~=6iqLk)>-Qw4-kEquW8wCXC9+S&UzUGOeqpuY
z!Zo!Yia$=yX|9`g?M1|^CyQA5d*%05+?2bfuAU@uCDHGPfyds|LmPkV2)|n(edX;m
z&jqy?GcO+YT~l)Q1<N-Lt(Sjh*|M#?6?UuS?n&Dn8uvfnXLAZ$!M^L(nuwo`o^SJw
z+T>ksZtSwnS){W2<^<2<8#Ld9FHQ_udfx9v*uhzWY8lfSp8cJ?`2NuZM%fU<V7aOH
zHqCjS{U**`+|s@yZefq$Dv>PH-R6Dfrz|v%Ssdr~ntb?Pb6$7*o)+7KVQ%a{XPiw7
z+17C8lFuHFm-}ySNn+xk-2HWb>Wk0k6%H=myhlbOKEJ!=WtK>Cpmxt>-@TeAW-$C~
z(yefqYMi57t9xk5iZl6d%>-QEJ@VZcwW9FiwyiVXb?;g7$bkQ1!24BqDw~-f=QjKa
zU42X=nKS-{OTfNUtyO~T-)BuUK4{iZx^LN(4Kqr7mWUXpU+Rlr@?J@cLujStZGow)
zJWeGUJt{tMF}$dDo!MdgUtYGW_1Llx37+(B@ohFNPTz22;-b^`vliT1(RAJS!+}NZ
zlXz}ijSqj*Rc{)kUbN=lzEk}yb1J^-c`po_CRh*_s-t)|;Lr5a4}ANo*DYOocy9j0
z&KRqQw#(|zl&Yn<PSIgrcX#9B*@hpsAD1dz7-;Ly&)awJ@wuHx4CKU*N2x1J{&w+S
z^@X0WrLB&gY#r8low=VXx!$QBI2~npd!~~8rajA-FFj&1ueE)SUteyI^X4_mKOI(N
z|A}&v{V6%0Ij=gOvFmg#OV&%~Zx+wr-8o((yJga^%*Mwxm+b>{WCWWQ?>ep+S0KfG
zoXh|I?4&?p-NhDe$5r>+RZBj*p0Khg>TG@9w~gz6>Y8@kQ@WzJw0zEI*TqS{kG1rl
zH|$?+5UBm`(zzRPJ*ThyY;Nk3>(n^4_Lys!*B|Fb?mdRPf;TCiopLwrsJoWQvewF5
zLIL(6Z+<B~KYvZ?wZsC?3-i9&RNqW=aPkb+RZj@gx@yvr@b+kj|H3$D-E$v%j{ZOS
zvM6ew@?nw6pATZw(Jy!U-EniV6cYo(8)gOu1zdG@YGPhVQEDn^tTH$FVApK}fxW-A
z(@q{VR8hO>%)c;F<ED4wZV|I~Cl0rb?jK8XJv|=ZZM#(eKB8~(mNkBtGQK?9Te+BX
zPfh(F!}>)+z6X9@=i;5L_C@>0qmanQf9&E_gl|NYe=1oc`A+<_|Aw`K`w};>Y1JG)
zwkzx&<KnEzF4ec40$=o5_q#G)v3e~z#c-PFWK%`YbB5B#Vl85~mma^;qwfARyZLda
zf8QCwkcQkzAuA4Ue<OJK%Z0#TQBltK2kO`icQxhyb7?FWx|MEF-;kbNFttG^*VbTy
zW%{v*{c0a{y7s)tnozid^>*O`u7g<#fpXoRYfmd*Qc^ANdOfGfszozB{79Xpf7^1a
zyGQhT9xyS!KVo`9_;!iVOT`D~_kY@Fe&ct@JSu+qp=w1!M10r3Eh+1C1-{<woi{za
z$kut%F0p1$$q&;@QrRvwDf%&1MXgG2QH`$u6)`KupZ|Zh^q*7g>QAcJN=(AmxW8Y^
z|9b6v1MA&aXRiEooWEz{H=Y$i>klewH}5vpS%0)mZP{$Lse<iJFHaVl81*Ib^_!iV
zprtUma?@P)-+2d4HaGnAbwBTs+Akt|?k=ZYc-PgK;AVdFm2#;)ygJDWvr_NQyq~vm
zzT+$Y%xnBh_6fahJTf=2<nysrS*zHO6vq7S`EzVTMPIn{J&V?;K<0_ddTNUfrz_Tb
zoYps9_4fabD&EY%EnPl=OPD9_yZ&i)QR1&{(d)iNeiBD*3(9&3y@_ODV0g@pacLN$
ze#tB-097u%VYl-hn+eoj4;MJmoZ=wXw7{P+C?Pxl_JZBr3$8kI9~Q{SOc7q_(YWLh
zSNGrVeEO48Pv<RSkDmT;=FDO~{qiU4r+>YFT7M18!o;63jRtGd7Ra4kK5ZI%gk8$_
zi?Wd?w}t1_8$5aV@1go6`Gy)+UDlNkcz5JT%eeDgQ0vN4l@1aqO}Aoob&R;|mC7ON
zB$YKo<W~EXNyQp>yA_u;%__SSvc@E^LiKAw`hv{tV~I8IqSd~&WKC*cGV_&7;*uxK
z_ddjU{8^sG@3#Ei(}^>kH@<!)B@)v5#^?6ThKan*<+6`My`=QMA6|ZJ+nJkr96!5w
z3>jB9yZj6K#H6*SQz>k+&FTM@KV#O^{onKJ@z2}&{elOz6{c>=+$g?uV_GiT9{Z1V
zqWfF|Pp-U{ay0Vxx9p?$0z}vwbrkpe7zB%Svc)amcg_9(^uLd|x7UR7v|e%3{o_%6
zlX0f1tGyrBy(c%tmz`xx-X8tQ<maTEZJIZ8#Gf;`uVP6!W)od~_S%Y>vb|dswzbaa
zm|1Y^jn*%Zx}`CPSwmI`ySMEASgb3WStHugS-j1k_h$AI;XoTsg?lq59r`77(rxO>
zh3ePL8Oy5Mnr0mh>${OAoqXQdcXQ$<8|{^5o;IO+e*Vqoas^KJW7;=L9Fb;AdvWy;
zU+F*JN0)XcL|RH8dAaALt4Y=2tY8zL>^X9+@)9{hLY3YVo}Pa)TSQoG<NwYb$&t@l
zG!9hi9t$t4+QB$OXXW|VDi)6ekNAc7oqEss;dp?1&DD@#tD>upCWf`1mh!&u)3<zn
zkg?C^x5}@zuXWGQ<JH*p_}U%ql?BtH7vG*1{HT7W!EMj#Z60e+B^^)wnPvOHI49|U
ze8$a{LM1f^JGP!(FnjYk&gP`ok1wk|3wdL`t6ieHnk#O1lKyeUvVO~zhFX@9s&g0d
z>ckm}PfOYP-QzP)de8YapBD1e$vsF@WNSUQ&qVb2Q<mxt^_}kXnzwM>GdR{|`1@F(
zOmEZn?M!Q;R-Bf6ID5y^F0+P1=Tl}CJpR0h>9nd^#IBI=mK`tD7Uyy=@_O^)bxX{(
z-lunae(%5cmeoe2YWKSD3Nde+-LBguwH<g+zJy6CtswKD^&Bnln2x`PI~U5opH{Rw
z@j&YT!+(@cB;~ENE-`tz<u+#l_x9Ik4T3lDrkw~Z+at8`VAO`FIaPZtcQ7}-=-;y6
z%vCLDp?E>&#N*O>H#8TlH_x4SaQ`teyNwTbgq-Oua_5;h@6fv!F>h9?`v@zaj1yXO
z<Y>apZ@klfcJ(d^pYZ0FkX!f#y_qYXPCmMEvV6;%Z|u_*KD0zk-P0tbv~t0o>u2<g
z=Dlp_x!k$y?dP=rjyn!If1an$%zlEuW!{}1d2ha081lc9{P618OMT9W7dE@ECd~M{
zaNF+F6$VAOxvGv;yS!Rslb|NPeJ8)y?%tgn_V&69>Saz%FwuMdbfcG;-32kjd6}DK
z-f&J>Rd-fIu50P5$*s1x!qn}5^?tuK(`@EE!O6j_nkx-%)}t0l&sevcuV7(dIKace
zpn{{S%T3HqjV~(Ai%%{|F9EfC!+rB_TL|p^9ln7x;AFJB=Z5VpTmmZhTpPC;3W--6
z@H9?yGfVCa@zmP7{YCwKMb}y@Kfc%9PDK{)&$7$Uyv+Z6>7?h{$IdtIpOCcPyy?HC
z*U}T7B1@O*sk#UzRw^!0n^L@RWm?nfi!0_$e%<87`ZZ$eYNsxVDOqV|OVc8aZ>>I6
z>-beIdG)RDJndV1?}_)U=L}7;lTw`^6j>zSc;&R{O!oL0m$;WcE%G^+$MN`Amdgk6
zZky#cfxVu`i#(k+Md(bw_94@1ckQ0J_BM}}l-Jh2?S1n_^QW|h$EwCVwR_#GCOuo=
zsI@yQdCHE(edar+zBXcCmtJ<%-{I&aQ8mkj-}{%iHa=T9p+(J8WV%<kO_9jn!sDq4
z*H(UhTAki$u6XZe<RO(KQ73Hq3}pq9B!rt<UT{xcSl)kGsBTKe)RyANLoGQ9+5(X$
z)}D;rJU_$n(R|Ljdo7}(Ycxs&vs#(+KFL<i-^2Inu;G=L>l{oxJhskXqQm@E?OyZY
z$vI~&&hj<>mtabkzhHFvVN&E`yOIMOS46_9*T~;J6#b!ey-9&@sQmKyeEa&{^X;rA
zT-mLvzJJ!VpS4aRGp-qUNNy7s%)DIL@xtolx0b)RD~_)#)OmCKLqMo?xXA6O)^8Fw
zwl0`i8aLVK{P&5+OfO{o@cqEmxKyS2RRxP)cd}616QTa>OOZu0`*xX$U%gm)wD$Dj
zoBDdwM59l{x&9H@*Ld}i$fTJ}HH`bNNl&)9ZfG{Wtzhr=?GrYbu)fsFsuK#BX|Z!n
zP;#H7v+9PMd{T-TYbF{PKQv3tnZE0kqg`ppqSz<1J_@<5HTU7?RuPfxJ^0<vN4+{Z
z_?!EQqudE{LA~*wbyJ+0rFaX)(x-cOADvcu*r!}zy40_WGHgX&^R}%~m>^!2Z@hSy
z;UWuRGoIWNcISkZ+j1v(sn2+o=e{#?LXm~^<wN&4o}G~V`Xy?A+t<yBwh0Y;-h9!2
ze@x}ovtz&Sn!hN_$nQ`1R%vEykn`xJ->tq91$o_5$NzI)cDZj@GwZ&6&3yTElb&0R
zhN-WUE_LjUt$ue#?$Vo7$=^>Z1=d#O@=v?E<;v$xs*9fP%fI2_H6j0FzWh^;rva9l
z?XqSeD%;8|-W^wV{JJ?YFXhOb9R`PA85e$Ry_%ksCs$njbM1_Wci0|DrA*kI_oUrW
z$>DD0+LU?U&1CNi|C!?Byye#8#xI7m7AV~@YKY}={r*$v&PAQ(l(61qL0pxlCp^QO
zC)9>J#fx8a=r+3dgWaku@b!VY8sGeWu3G$8|8ToY5VxjVpYXp!t3K!D@ZVi0XqVpd
z{jp(lqn@>^x!c#TmWtWmxxCJ7v#U|pXzZVPC?=x*qR-aMa;=bR?i_#3`kDot$5uI7
zC8gE9+xO$#OD^vI{Fzf8s$MMGvQ_mnuiT0mi&8EHExgHgVpU3Hl6k<i*viMs^Q8UT
z*^Vb|x%=srVov#tcX`pLUtF#}_{~RT-=@EYb&Fy)%bf6?eevL>-73457J9QEct7Rz
zv4GiAY?5nUf4>}R`;qza9g!pE?)%QJ31oeFUGA7))U9joY=K8UZteY_`9SxrYoMQG
zztZ|ejsFcLl5UyLN@lxpTEF}BYSpS={HP_}{9JEM4@L%te~h>r^|>kW`9<*s#d-zB
zhPe~`{SP?^9DV;+M1Lu}R8Di1aYjJTDOX>M1?ro(1zX*EckM2#O3V9qCl-BtptgIa
z{rkUan{9o3j)yGTwCw2HGtoi1ktNsm1U_6Wr#F3{**6~Js8_CQKdkw}q%6LvM)_vM
zYSEjAZs_UzR4dM#|9MH6&IZrLCoC`VEk3Vw<gx4O9h|>39)5nT@zP4~{N&>=OGBh`
zlodjLZGW<vb9?aHJ(pM$&;9!H<mts(P7WvXc6>Bawi8))=*PFCnfElkZ<Q}R_jKNh
z)ZGn#SPLZ8mj2vp;(9dHo@3%g_D73!lT-M`>bvJgPA)YyJ!`*r>*~iP`<V>3ztP-n
zd~UIPe*5k@cAh#{4^DjN8vg0^d!e^azAfl=Po1{wNZTJlt!WvFQ}-k;-ut40<GijV
z$33m{ZifZ8^4)td^})2zqpa+uhngL?9NzV;?Sj8V<YU$eZt<wG(896aN1l;^VF@F~
zmP~jPI3L^q_6<1bb=W~*@B46@TivZ{OFmv}R?v!g;kbc);gk(|YG)lbNtdZ-*q^-r
z;q)9A*Y?!%w(s}$+>Ctm^W{I)+nbf=Yuvv2q*Z#^j-ziAV!b10il=q%Hi%K0AARsS
z`>92DQmSH;pSN1EJ{DLc%6HGi@XLx-X;Tb?LK~}FS+4z7Fjkh_9HAq(Qd&c4=ZR(q
zra4jz9`*^Xc~JUfU0Z?wPQ&(T!e1u%T1hO~Dkr4>=KSOhYKrO=*`BvJc_oC;zP(m(
zSjsWhY5jvE%k?tdznVWw-*Bbx(A|91>4}SOwlo_qTgF!SCERS@WwG{}^PYX4k1|`|
zu)RsmUa)X;je2m+_tWbCi^Sx*FH03~vRs=cwb%NRzx|p1yeIxLp4*>oH2mLns0MB1
z%6`_?M+uw^3~pLDN8OY2%TkLH(^K^dDz8RW_ut+j`2YU=roFj}mK&$!tlJ^hZMDPs
z-G#V9-X=9xrX_7o-d|=#c3zoy<(Av~ebwn2LDvp{JN4V*0neMmm(F}RURk_^`_sR>
z-{lw2uQ=6`cClYlxNW^faQKtmla^(R?d^*9(>oy@`A%eiob;zxPoKu0Xg5{<pA^M4
zX=C)X)0-IVk|cE1CQqHj>NzPiRqN=amJf@joD$G#F}YHpxn;3tz=2JVDxYP}*zweh
zOT=t-{_`5knH8L`b}jMREE)J=ae0-S%AXfmky<m2c>hnovZj$$?@-W(>R8En)peV-
zckWONnan@g^H`Y5)a^bOv&BxGnlklb_!H+p!q=ZoHp^nXvnfc^d&-n&Tr67quZT~Z
z^(}OF>$ldJICaVJchO5DCq3Wp%5*w*;?gNUbDVC?&)%_6Xj|&MyMpG^m#I|w?l1_S
z#(!X4#W|Cill{4?TXT1MrXG86>U8JcL*dmcQ|#0o3rr<-*q`JtP1xEIvzb}N_`CiK
z&*rBMi&Ga_B(sGkdLC*^e<ir(dtkFdkmc+nvrYZ4C(cgs+Oe(So5e1ntS#Tt-szot
z^<T!u;q;MPB0Cq`H(Z@$y{aIJdpAS#MV>v5YkrunEZxntgw1DZq4Jk$pXTTlv$-j-
z#q9salO&St=akaeko+&Eko6C%sOZ_xvKLjoe`cl2_D}I~J=b`rh<A6Wyk=$9V$aZ9
zp>0=;I~Mg^i198sDl|7rIqtB?sqH7`IxtCis<|>aZuR}lH7EJ~9;q6RM;iN61&lV>
z@17Bz!TZqhZ&B|CRd3B7hC%N*9)EDRd@0@4xc^wj=3`SuTQ;Y)73?|FRW<Wih8F8?
z5831e$KqAQ6SYsJsdQv7T2QFu&uzD^m+$rM%hS3SIL>{kpwOhTYQM{h-h^jju`&gp
z<eo3;lzAT$cGHgg=(*z!iyL%~99s97b^Y@R8qIbF6DF-NiPX}%RQl+1FEiI|mSgw!
z{!A?pdBc%8?cIbEC+*hVzU3sUDP}zP(xleCf6QWkFs$7B`RklNmUUapi@c2XMH#m4
zjDO#<Fk0Gt!h(*Np9&jq2J&yd<oUF0Q{PoRojcd^d^aqa5Pezc@ZK#&VFD``Ox}0f
zvg+cA9S-tqn@<L$Mm%fgYUWH{G*wV)*+TDmAJV!t{lc#w+|v4Yf-2w5nj><zZ-3Hy
zcV%{;!E1*A*R92pd&CZI-C{K3Zd2Y%#q*vCH~FldINXzCxKjB@OY2!nLi7{HG{5-N
z+q?E`x37_{m;F+*E1xAPBj(a<l~x{^Z(DxsS^ewz-JqHe%&Ts(Z5C`v5Rp8y>*d+6
zObs{NlY4&6=o8#tkRfebzOzPI;PR#vCGNuyls)ohE%+h($9C7h68-L{FRs)+ez3e{
zSJI&copk|Lf<37MT5d@jSsU8~BeuO<s$iYK@zw0cs{p<JUz|7Qt(w1DwYnz%Wh(z4
zn}yq5e$TbJlPeXu^{yMI&F#W_?-}Kb=gaj~|KtzrU;bJC@U~~)=Vcsw!q0qrj-H#R
z&1p`%1^?dp$(Q{+?jxVE{rCp^Z(rQs-p_m$b-YC{X%E+(4Ug+)TZJ5PTu?B%d+MIq
z)^3~RjK%L1%u;u|IAvj>LytJeQH!$g&3uzr9SLOHab0=Y?8iq+E~{?Sa*khb?Nr~F
zv1{tIvTEJH{r!8ScDzcwc~5+|ZfLl~iw}_obH547ysP^2ylGD$Pi^lZ!B+7Xbpo4;
zm~(EtQA}=mZeIPvv3_g&{t5+lv8*8W>nGc~eey~w5}L~<@0)$dRQS%t!u=lv9;v?l
zJ>`GSgFCJ&8X7WOY@E^^v1$rl3GSa67FqwwHaIG4dPU)v!3DmE1zqM{(qikH^7sFW
z->v%R>*^@W`l>R9r0w=K8|1$HT6tx`b>%G!uJ;P*{rj-!(yODBy2X9&G%^1TPq^&E
z_xf4?eYu0W8>2*wtU09f9-Vk~V6WyK53Vz{`){la`(yX>V|%~-9!b5V$+o}VE;xR?
z`|Z1Zg7<iz92S%5itSm^Hh-4j*&TcuOrM=QytlrV$v#$e_@n6Y-sInFPb|N*@k^;^
zp>wODO>>Ohx`gfRLW{X;lIOg9f8RjXwY>XwgrJjK+5TNx$8>+cIa2a;yZLR_pXy6o
z-aBlIH}sLt=qZ^hEo<M{tGS};!G`n?^YWJkYuP_ObLD0FhbxzjT;f;%Ph-_-D4kz1
z{TYw@LbuO7Tc7Q^w!gF1CD6Yyr~iw{Le^gW2J^qYJxTV4WmRUMX8hoAdvSF2<*R>n
z4z`*e*?0f&ZvTa4sn_oxwsnqdp7zx|*kr$0(8dl;)v3n<^Hmo-Kl^TG#BqsN9owSY
zmv79T&h@9Ndi}498@9#%*`vFi`^LWp^RSMG$Fg)Pnr&xnzm>7|InNi<dtOz#=7Gm}
zp6--88&VxoBDc*@&R~w<pTj)vJ-TxzG5ERUNZ(%kBf;at4C5K>^RN76IJmKh*JkZn
z8H-DdnT3}Zze?TqKf}$=T~Me(yDo2;{}FrFztTU|>Nsuf?c8n`oUL+NHBEqV>ipFC
zj}PA4SlBR^{qE7Ge`4nYKAGQr9<DC7+L2Xx($U8~!E4QXi?aC3YRVoSa=D-(CUW_(
zZTnVt<_DQ=Tlu>V1~*%sVb+hSI^KCJw%MBH(}jbwX-wbm<`wgwX{_RYZKcAnl6hlq
zYgep%S6-rJ$Kw~XblqweNGeUeIdx6guPbLIs`pga`RC1F@YP}B6s}Dv3fm94|Ezl;
z6+Abjt3CL;UsF;+mJsioU$vqco1IH0oU7KlJKdQrl6PZE<J#RDA3WmDJ-*}iJ86Ey
zwIX(B&X%)GI@Xu7WY@*7dsw9(Za?8S&15g5eNVJiQG)(k*56%xYN`Ks`Td!@YuyLg
zp7L*gGYscy#XXws@cF^}dv)$P;ojYu(-Jcx3>C$mR)z2`I%89?j^+Ns>Dz){2OKn6
ze71ANw(rjyg}0?uTJlS^AIhw_zPvx-=B<nx8I7%L<b-N$jMzM0ue_{$Fw^@@W7a&0
z-nQ`ckM2&-TE05mY%yWuo^s=azf`n@Nl7Qqxx}k0<yOTBcb6zXd=h0={#ATqS45!2
zh4anU*AH!f`-*2reMJ9BenW=?*VjuFt~jAyD0BP$&45{%KmT6bGVAB$l)D%IYhL<$
z@{!2Y*SxZwTRb`3XZ79qx6#z%j(F1ayO*A&9-O6Jrf2gx>5;X+25;j3&bIx9*FT=P
zY^u9%|Ao3=g|n{yx;XEmvExm~+p3)lSodx2%zv%w>A2HF==-Y$_cCktBs;Bf`oU^a
z^84kdEJoGW|52N~XFo4G(Z<NYFoTJKK^glHOG;`^d1gsQacNpwW`$lsWoppDtj7id
zdtYm(y;L-tJwv6M+czOozg3Lu>_UO23&$2$Z2RWnQFQxHt^3By8`k7~{&H{6@{4y4
zoc{dx^_z)&Cj`^^O^cMgCBi=3p6%ScIn^}Wyx{pC%?lenH_XwmJGjlU;?N6;teWH3
ze)^S6xKQGC^MTccTi;gluP_aG9_x`XBi5)>#(k;VnWLIVg7-{$`J}TyK`CeIs*6r9
zb{agC2;Z<)PIFnTPh$L`9OfgLOC9(kGYS)?en{p$&3NuOd!p!MsoVTszHinpJ%4Kc
z12YTtdtyodmoH;D$$3@Q;27^6zAZhSe8PEZPs^P<qaLa+O$uCPJY&vz-fI)ymVf>$
zDP!I9AgR97^1-1~hU!<JNPUS`)c7NF`ryG`46f&_S#4Rpbx#?0rWRdo&%EEI=veu7
zDyy0CxjWi+Z5u?3WIx+<9bEQjdQslR?Ygu1R43f1m^|y%dS$uf8=veOH&o?y-tX!z
zdB8G7G-1Z+`skY-HHyDCOe@d2E19(RxZ;!gbBCvP?tL$|x_0G02GnSLv)sGLjGciY
zUl30;79=Jom*$q{B$j~M*}dU!^B$Xt{awHOfgjh2xEr5TZp3bJGj^D8(yzHJeUtG!
zahbylR8OV3iG@z;I)36=<2Tc9C%?r^+O)(XGh1P!PVBw&#pm~0CC<;g_s{5`<FZ92
zNi}mjFP)0vvP~5i^*2wdnYO3T@5a(q-=fx;Py73R|C={oZ@!fH|L@p3Z*4A{D^oAs
z@d|ajxH^2j-lZ+~uCZ?S+ALFl^`-s3e{TQh=7xreH>EBTQsr41G()A!j?*wzI$PU#
zu20$S*hL>Ia&o3=?45V#=9iMBOPe>J%&RT4IvJ9sCc3`GOt_-JjC0rI-n(Kc)?Gzw
zx8>|SlO3JCF~(?TYw@&?n?kPr%ve<L`rLts1#4Z4Q;&-8zP!ik&%N+XF~)f}bh=W`
zrJa0pefH|7Ps_un-;dv4Z{90mcP^vpgwLtd$DTwd2I*>VvP_Z}tZMN&XV&yLOxxRv
zd+RjK+YVp7Iwmb$HA(67E}bJ@k@r4|`r9kVp3yq?e(D*8I{);wO`8%j4tLL4Ip?pp
zf>K$ywD+SFSA)>otG1;bDU+U=H^ZdIcnN>$%}++6Yc6GlcI0mP^Sxg_E&TNCZb@r*
zvq>Sj+L0ZNeb3`JzRca((H<z0s`R~zeabRT<1qf4KX_|@yUf{8Uo>O=j=MW<y*J}n
z6Vg5*algn)gSOXuts8n48LTm#FLAJRS0P(loM!D72V3v(xzA#1qL2Cfs$RR`LRI!P
zjzyX(r<^v(Jt>sAFL&g{=XpYBj8uC*AG|WvJ6*G^Ri{vRm+7fAq42FCjBl5wTIVeb
z^gqu$v+B+L-I^@sOnKD;xdIk8i+enlv>moyqNyr4rEAsO?(M4rqkK)TbN-Rt_OY1r
zX20pLV(oPvmk+qVa&@ZOmANKd<6ijo*ZJ}LJKgo9Lk>PYdz{}scK_aAJNE2hXj^{Z
zbM(wxmRc5zjPxe#Y(F0GYU>7Xh9_}pPW&-i9{<=g-^}^2M`Giod{^$~$WI3k&J|yh
z|FFAhU5)yh?!dM0T)d{s@ZS8;c-Y#V(adSH<aL8nO@WV#e{D{PX4)!tbe^K8Y^bHd
zse*t75y!aZ1<GIeydWk@xvQpy&AT$UCHT7Ky16}!ae+$;igdjg&79TOWksfRW;<WE
zpYV2-ncr-!haqa0nzCgY#Xm?NOsy`6aXr!aD}-CaWSz1{bN!8oMYB)6{B*@bF)Zqi
zcj#<|td9CAZjv5s4S!TtRz~O7_%kf9dS3D1(x%C-jR&k5cjmom;lFOh&saDi+@t7(
z2$$+f>948%QmJPeinwOJpIxj`_Nd#$mG9>?Q;o)nOco25?22Y7J~R1CarlkJ$4?50
zeoFEw_t+Bf%6RE%Z|e`U<$f)HGi%0T$F8z{$~R)Jri%IPocH0^?gGxzvaR2b%P#y@
z?78`f@GaG|j`dD6c5SFzR;nR#)YK$Q%4)H|ge}YGew%V?p3VHrJ6q4IMqXh5mFaJF
z`dwX<p5zhV*$ehR@8*kS^IuhY=WKS*J-hFg?>((V*1zlc{yac)`-5j2=SzQl<nbwT
zd!d+AUyAdRvx`4`-mB%RAi?5rIN{}^nrVrBB~1_aHz-c853=}h$<(Sj`NCPleXqIh
z_r15O5&a^NtLwJr_v)n^rQg40wDomf+-s9>d!6$<N3{N(iEmr4*dM%jgmL4)IUl_y
zxRgZvyt$*(XwkBjy@yv`(XF?VuGZ}0k(S*oQnmPOc*T=-N5!Rr6&UX`Mu@Mtxpscl
zvU}V7tIj?wc(vmL$Eqg>zbs{8*5hN*^{bm*R^0devsk6cD}IlBpRbBO{VxRs<i)1v
zypff=ti|+X``YH&pTq7i%4eT<C1`)f^Ui6_UmopPoN#aBS<BTmo9$lT`0zqzPez~D
z{^<d$`o6aBQQfm>rXfdq-`CDVdkTKFuxV!)Z%Z_txU)TM!|N4WX3lAuCD2&s7=0pB
zUd!J;?qy~D))xorOU^_cH*B@Bj6Hw+n~JsHrmK&o9yPSsJ?xE<QMQuxI3>83wUI~T
z@H5wt@8*f0{J-6-&K9gV^XQ4+$)X3}U(~#Cm@2$tPEGpL&m}XD|4-z%_$^WHY0}4U
z9c9_@zT}#2l5!4*+T3sV?c$dBJU9Nv_I~MY-<N+^U$jX2$ak1kKf9~#NoCLN$Lk*}
zu2rs7-;}akwW;&&x-DO<Pk)lj&)m>A!$05q&8x#@&dVkkin_5cD*9QrSL9poxrhZ7
z7qUxypT0cuspQF2wqv)7OtpS9IAz$bJl47|L^w!px9$YnA4LaWK2)x5=sTXd`Izm2
zcgg050v26g=(J0ZJt6P%;vIF5b{aBCXDIG@GGVV}db-CysoWixxn6rl=7--Xy3i`X
zpg8^7pQFr=0<@~;e+{o+>b>1;-sByXL3hFouGKHv<zCSg7Bo?$Yw=d63+iu}CTo59
z@KE-A^KQL_bp`7$t_+*8V6*(+hL5-Zb?us*Eva$%{J!FAtF7ZaR{u??kg%Rop|F&5
z%hzqZ!r%W}ScpG(?{<B$$agCa7NM0X?9YFd#+UzYZ<6>~eE0=g>q%~#{DB%_1_o1a
zoFiK)sRe176{$s_ku96-;@cLJ?*G-^@S0yFUFDXaO#Zd4_oDpQy!mmeuXy8gwNN?n
zZY4#|<gO=7DLHrV{rmp<SToCy38Ke$wg-uJtL(a{|Al)&*~zcRH=m!(Eq2-G!pTaf
z&6CbbK0W?qOUEPCxqG<2m6x5|y(gl0Tg0>{SN|P+&H1O?C2!i4n4pR2DhuN?W{GPv
zsHygbSz8y+Tkj!pZuO=|COn+cqL%ueQ&KA>r|O(Pa_(H;KFw=~YR<mSXKFLOUny!H
zetK0(W^L$Mu6f5pu1t8kE8%97OVgbUtEPn3lw~<-FLpfQd}^|D+0z+18E%y!mkd&w
z^z5Ipo^=vD`|{kmujkDlem%Q<_T~8}I4k!SmkHO+@H@XOy`Z!qe7@bhdw+Vw^PgPR
zm;ds0wf*B#Ud{P&@wFCv=RA7gyl0Qi{|ec<T^8K>{`PJ2mx=#)@OJ*cJ@r4nU41xP
zcEXSQmutk9s<^36s66L6^ZCjfmj4TCi>nF+l{S5N_KJ(~zWYjstj8uoO><mROV0kA
z-1S(NX@1K&M}D2;REa(o-{;9eQ(_J@Bp)(*Ful{D^}X?dcau-XpKP~T%q3!<vyS~r
z`G?>GOYX(*`6bu-v)b*?R>?+Vc6;}iGVjEnxIfaZo~L+I!}j~h^_KoTS9V^nUAB<#
zuKIO;F^SJra%B%1!gZyJik$lRV*6AcWKJq*{&Iiszvoi#Z@;^|`e%)>fsI_--<<A+
z{J%D<cFX;E?H;Z0|ApfMw-SSr(%Tb{{7mzd$(!OLU!dH1_|}^1kz0~JnrQ#53c0<*
zKI6%QBNx`>H_eX_`}p<e)$2F+uHZW5UKfyj^?=m5^0zC^q>YbXzY!ud?IM%I)al%-
zc>cWmdm^YaP3?h+mz!?r&wp?K#fm={{~)thV(HWp!E47JKa#%iSFMYkqfT${-zU4S
zTvPjSAkuT|zt7wL{hm8}^}cm&DzhAv!=990z07g+`}X#0s|@}`FNockul6{4#S4Lj
z*KeEl8v6X_F=}u9P@i$|;M0qVn=ehdWRT!@`RB#Njz2rPgLRw>WWW6UwpGwHMOwe%
z*XQQmXx6)N>5RtbE@vq2d;IF2&C%-xt%eJfH+Zo2$z8G7(|wCYNZiz=gYQ|5o%ohF
z$9W&`UQs%ua-Y_g%m4dkNz8jVTh~1G=HGIsvzsda+3(i4uxim1-A(UT_o*-Y8F$Aq
z_Um8Y+{Y@>M-xRY8}{ZtI_h(jdq%d;z5u(^t$chA2YA<K#P=MqRF&zOSbx`Dir41K
z{iwE;PO}aulrnC;w^sP^JBByk&b4}kT#97A;hAy2BGT&IGiA?c;Y|r!v_DOpTlV6`
z>O(SK@#lQJ74%xx8y)Jo({Yb;TJw)xv-FhoGIoR%)_&MI@#+T-UFmFw+Mdinp~=Ys
z=ZY`9U9P2lv&-+}srMWASg^V-yl`h`#gPrmOphh2+}<`fQJc~8(cf=x1yr^Ry=|A}
zHT5V+TYACp<Bxvh^@l&WA2`v%Q0S?)@$-f4N7n4zxKl8u{rU9p^vi*IO(OXjt2tdH
z*L_;D)Jj4`|KYZUM-qOR*xD-p4~_r#>*b%ctXO}0|NA>TtmfpMU3>In$Unxm-7BnG
zZms$4Z2Ud@Xw4E`fzwi1vmHP1cK+qrt9A0zrmuHo7pu$5yxg!fk?D!vY4?BIi!%(o
zmi@XGoqT$lK5M@3&bXgJOmaVB*DKDsyy?+QmxN|jldX+aVSQWW-oBL6z0Mn^uvh5U
z(aSk&^Blegn3j9V9W7yd=zRa@tedy?tzY&{ZO6*4DfdnlF*zTNZPsn<NS>q45qxZg
z^8IZbGKJLzH5Kmv7%m>39k=IujP3hLvsEP;J1m){<1YkFu<#0=HNlAe@(Hzu*;53k
z`=7GOXY8KyC$4jnL)nC4uT!eAtb4`M7sVbA;o_Uq`|MtIPr?73MR(<Y?C&XclVm*9
z*>ia9R?TZl4yL`|cIPl(4p5ifQdLrV{ZZ-VqQxt@KWA|~dvT%Z<r9&%X?1DS9w@DT
zV|Q9!#M-EE!%st#JueqWyP3^Z{c_>&vi>~g#ZgQ3-7L-uiKR-GuDqUoer<yE?=qzi
z%a&Rkp3{2oHrLeenI|^*-#>X}PqXsF-n*s+1y7#UOC2n@+0}bPtnXKy`P?fn!UFfC
z-1JUracvST4K}-V^v3*8Sv?|~xA{&@7oQ(pz3qeO>6kLZ_El%~td`%)Nfg%adV7-T
zUv}zt89m;4OYbG^+<2!#?cAEEy$W_8Wiv$d{ge|<O*)?Mc(cf-^ws{}>`iO8e+=3Y
zD=IY2@!2%p7bl+WUC&}*%ofP_GTo@Cy1#1Q#>=ZqyJWP>9ps!RxH$jGiJi6A;E&6k
z-L1Eit+OpMepEyx@l=Fx9?t*0wuUi4vP=GMz#dNZI)xD1qzSVs<IK4OZmx?p>)j)L
zE<~#7hJ*ivG>5vzhwV>_e~K!Hn6n&YIr!f4w41|f)uooFg%+pJy}WXdTbWn?)H5Zg
zN>zpbYUGBV-e!B^w@`@0v0ktI=(4KkH#nT73$s7pyAm;bmTCXh_rE6^Tz*`-G-ubo
zjwRc=`;@M%5O!yXovTr}X<N<RHFtD-*r)sFbQE1N`0TU$;MwK^8<qOIn_MOuY|(k_
z=9F7~Y|ly8)}$h{8}s6dV{J2Eot?Bm)-!l>VTseX-AeNsyWUOJ`Ts2E<n>3cUoG4c
z!rAJ>6)g8pl~om){_Fq$=B4W-eJ5{Q$i~_Gx#iZ>iBlZ<KA64!%Ef9h`*w^z!*<@F
zPe!x0zTc%YYg>49<C?&P+64=j&rEoh>VM$$V?o;wZBEa0m|H{FvoL*mRVaPUEuYzA
zwFlGb+T-%3c{~4K4Y#*nD?BqQOLw-EWWM8`$+P2gT@S9^oomZ<=Jn6>;UT{6{r<t(
z3VD$l9Se=cP8pwCxJ8ubMdzj&eGFAPk<y>08YFDq?sD*>lGgO-8%3M9Hs_SP<n=wW
z=nFn<bKdUOyw9u8G$!+X3#wV^?E3%ooZJs5ICbYe?$|&7==J4Ws&-ZM?%2NZS8tK=
z{M_2_b8O8vNlk7F-jTdKDt@xs4kf28c|pG?IXS;kTd`Sg?}N|ZGF#Uk{j;QFyZ<Am
z4?cTD_<6$SO<H$<a;i&H))b+(ZlzRJkJ9tflS98~==<~ixqb3rEc=d*Ni6+hud*8c
zIJjw^bu*ebne*U#w*B`_r}Wspn3=6qXQI(Av(9DxgPM?F+q<80uJQz>JMtu5caxrO
zqgEWsccNA2eLLr4C7sU`E{Fbe-B!Imvr@bFM_!MP){n&9_og0qE99AG+~j5x=M~+h
ztP#Fo3FFtmb!mq+*4JhxC{~=8JE?R0_@*zBib@S4qRSg!f6l7gaCd3UYmZM?&i5TX
zFry^-RQCdtcYCypxgVbP*ssr7IQ3w6K>6IN!~KlqP5o^zdF|qFKAgsr6m5EPWmdla
zVttY7JCk}F<~+{4zlZ5R*RS3ad%P}hy>mOsaACj6I)(PvW{1p0-MXrD>;62+T-37d
z;K?_WUdx27mTGfKba<x~HCZD6wDPglTDp;pKAn3W8K(Rd`w+?&a@b1UgeiLZP3@F`
zvmH_Sk8W7aSaX#t#q_&dpPE$dZn@2F;vud=D_hsSV>xzPwtC;}Kncw)<t`3^syfH_
zXq{Y>lxcKwqNKZ!E=R(YrhV6pEDso~Nqlt*JbR(S-EPfGu?CHd9`|#q0jzob3%J8C
zXKs?^C=vTwbbuj5IDhl?t+rDnX52W@_%=E`S4j5us>XxThkfQ7axDm7C;y}F{GF<Q
zRRRAyrhRjmBz8;o^dh^Wu7?p`*_Tf6CuDyPS!#F0QQ{M8vzS@ufp07|on9Zd9V_bo
z?K&sDc$>nOp6Z?;x82Ei-Lh6}e!+MwfN85#%_ni;9bb5--<^6u;MZ|}hqbd3TW_bW
zkdAnoIZyWhOT!7Di9Fr%C-~}4p9q~LGr9gB_dZ6Ay5GqR+ctEaO3RvDUKwgRf6v#N
z)0*4ld2{A57S?G;EEHt+yyUsCJRqAPhNVliXD`$0?x)_o4>qQFJlYh{t7B8OWy;<N
zw}@(2fsM}|{GGZ}dA*g-f$OG`C#UNs@J4z(i80~4V)wMmZKi@DM^@sO)kju750XfU
zX5DkCYnr$9#T%~AS@~8kIp96Da8}cDgB69dwY?@@H?28-rC;q*re>5qyJb8}-xRG4
z78OztxfLvTF5kk?G()Zb(L|1oU6(}mi|iEOxnsr`v$1FGo6nbaPvUQBI;pVlxpBnB
z2!93loj$xG)lP2gM;B{IE(mLhnvwQk%K_=;P{)YG8SA)|%+EPQYo7b35Pm4g(|475
zlj~6f9!_cgrINq6B62VNbm5lJESh<2VZ@X$)!n{Z9!;Fvn{nUx!N$@%j`tVKy*61O
zUC-{9zjbl+{RXS&m$QowE6luW<@=Q{)7iK0{jJw;zO8Zd5q`M1Nn?W2>MIjtzx|ji
z<LZ=iRY~)euQT^U-PhCDs#0oA>h{}zzb0{uqyMJtwuN&n9~?VqcyHg;9lIy5nznN1
zE!EofqK020H*C8pzVpEn@6e|+?pZKYF&E8Rv6y><%qO1<^&tkyyZB@xwF9?gor*52
z`97tl`oycQsDmf!?r>JNE}eR}O0By3N$&P}g{&KV*=r_D40DbNy1d7qA;Vf$`080B
zO&cDmTIWM~r5$H3>+-qY@=W;uQ}yNg<!#%fR^Bi6$Q3`BXeDJb*D}7!rPjTCYt77G
zP2J4(9FjY=w=c81wMpyKRE|`2%}4w?mw&dZ`kdS{Rl;0%OH$9wmor)v<~`fH_u|^=
zk53l`T&x!U6TfKJVdvt8=J_V;dDzk~|Nrsf^wHM*C6O#%J7;J<ST}#G|H5rgb#9b@
z%DLcPy7b%2oDYTy-9MZ>gs!sep0Hy@?jE)53y#ult`WgU!mrD@XujFBY~>wIj)|hY
zd|Lk)O?Lcid~m0RaURRWt1Hwvk9Mr%WlCHBVXDu<h4Rw`j(>2Od@7nNKy=x+nKS*C
z8d#q?!YX2NJa^@HQRTv;mOetqv}<;ssje^mdikaLS3hyRZ6f`x36tWcTG@WDJN@R1
zP3UvC5B?1c_ZD=^@c&yF$;>75XqJwJwg=CeV2AG|yk>ps7o#-J-eEcO@W4z4hYOyS
z4)xi_*Pi+$y=8WZtS*{s!SLb9qq$j%TRwa`w7@u|S0!}&?{ZmAlT#O-HtbK{sql44
zp;H!XZMXa+1A*0xO}6A&eB04v!!2xZr0CeAps$q|ZKCd-w9JZH{^G_;nTWSt=C#L4
z9(!&6?HRtq;e<_7mAYi|U1ry9r&wE!DyP++d>^_jZTXW=F7bC=F8tol_|u%H#cQAA
z>8GbpH)hplRDQYs(*ODk-_CvA)xZ5kA0}`3RvnXJ>al$F65i#WPgBnSxVWx+fzG7v
zZ-pyN_N~5NTF;ti+Vr+4d|lr&ul4Ee(+<kHt>$_sA@(a``_Hvrv$_5x9{TVi<mAGD
zL!a0_OM8TT-Zr1*k(xp8t}PcE?wYnT6s={-O_O%C{yEXvq`kJN@I_n9^K049*vuR1
z-&H-Aak@6ExMRz;IonvQF29@PAEIWTlB8ez$=tF=KXr5EJm+UE`B$1PzCXEZR4#X;
zO(DG8VY5r=b6d*=cNcH$NbXFpUT7^HzF+@UNryw!rHu<csvMaT@>Shz&q{R*gzjT9
zWSi^E#g`MB+<Uoey2(ENi!BQBFIm1=X*aUOr*Ss(DsorOY~X(38NZF?-jv^4_`jY0
zGvRaDuj0L83R^YJyjIu*rYN0%FPNX6<EtPsiHjkz@0*4BrH1a)FVDVw^5^jHy{9kp
zKYzdcy7|GU)$jcTH77^@Y;*c=@bgqtyQpG?$%T)dFTX077n?tIn7?q=-cP5vcHVW~
zUM8pPUM{Av&US9zmFj?d);3pdes=WjUoW4zDz{~Gy1wGYV>x*#ckDYleO66<6Oa<u
zxikLXf<5YKMPDXz-jwU~;$SuYP_3l!MEt_FCA+3<<M-)%EhBI^`APP3?JI^x&55F^
zIev=&PM%Y+JGAqn{kfWgWlYRVPpYNfHuO?2R1paI=fuijqH*Q5yydsng8cU2FU2pK
zHtu8*dc69?ldU^ATUcLptxKE2{B;vIt6t0wi^b<QnlItk`ltF-D)g?!oQtfdjTCZq
zq#Y}`J=ZPeU^yS5RBe9HEG+7*{&s`QvgOimXKNjbH;U-c+HG`x{_L5#p}u-o^!rNc
z6IqT#H5@;;K;eR0!J=b+1^R7Cy$hGtul<&GVE1Q_rK-Q!!`E1I&JE>mTHlfMUMxaJ
zxKvEee9ftd<Wm{}YrZvym|XsTUQaJ%cHXbbETKG)wn;JOHx$l4e)VEWSJwjW%irFx
zEt)9qvf?(wVZnd8LSM^Q{?q6BY3`Y-E9tQ9#m&35+S(;Slje1ZFA&{2r{S@=d0yhl
z?ar?kn_ufw`gN=E3}^X{*K>lZj#wSPy-{<4Z}EeZygrw0UrcW3Q}Auc*eVetm$4u#
z<)(RvEn8%9`FS?62QKDc?5|cgoieLy?a@EJb?&pDd%t-+aNlq!G|XagVM}a`!aK(3
zV+p2$+YAq^=2WWR&91oG=`pi|j?e-vb=D{S85@|apA`Lfc^hV*G_!FX_pzkObN`&$
zq*6a&sm(sY#4}|fqBAu2-iznFFQR!vKaIN}H(*ct(ylz=nYUl>QRX~RouIT(Rm7aB
zKR)YO`N>T>+=Y9#Z)aGL#kMK>?aBKVlfE|o+7%v>xvRXS<U^KtSZ>Toa}no%zx?y>
z@3FPGV{eeXX!pHFgP-$!lwa<PmvwSC3bH>Y;?d@2o7wlC-_JNjYTDkF&Mdbjc0?bs
zV9OIf8hxYUaT5EU)%!o+N1ZOKQvR3B&B?$}rigLa6KtVhN@_uIa$=rdLFHSi=-@lM
ze%98v@|7Gb+w_|8Qu{SqlZOnJsk6A5Q=V-(eQoj9)PP4@Wjxz9r+#Dqn*U|`*ULxa
zZg1lBnQd3Hi~q>9eZOOi$}T?rc~XCKxrt({!sg9WL?)$8`M@DN)ncdW=H`O@P2GKw
zJD+`d7PhE)Z?kPlsrQ9yrHIC$BKM-ObqxHTP2sXP>i;=6?w@sV{{2OpohHecRi3n%
zHbr!@=dqhyM+?JFc1^Z$D`Bk`dblVdsJY|hk#(v%=RK3Iy}6YBAl`m++SVhV%$A>i
zHdQUYC}{u3XP)c4qwXl^ToC<m;zDS}*Xf@x|M=m*{CK_H?+?W$jvp?6k~}fvkJdq#
zu6o^P)>@p$e~QGe^`12Ef{Wipb~XJI*Sm@)<!QD&6jG1(nApauYnS{xX!6cOf7(t6
z2OW~qob)x7>6dU_SW3>K%!sBJ1*cD3mwxs9W^Dc~9a|HBDTQ=%lY>9k9MFE`>fvGc
zmPsWi^wOLqn?=1>&p9)Nm2tz;Q!*38Y;_K5&9f2Rq4nZ=*O>@IY4>QOY2QB<9orZ3
zG{^Ocu6Ol^Yk!LKcbe_;o#@`JvOdV@@KN7;kw2mgJ@*`4q`2R34pZ`@;&bmZtkRNp
z|K6XOq?IOOG&$WuvA?<8w~Vo>r!{4&ebSmqmqnkwmRy|@c`{!+?STvb2dx_S)+--s
zTQ2R$W;twi`QRhAJeJe@wr@1c%~r7#W11^4u^?)d)>HE~&PATh#qK+_6a|?kn|IH-
zbFnehU{OcFS^0ZnlTSYR@yEuly8hqCM_T(VSU(pF-MaB<XL;@aL)S#=`_k*}XZ<bB
z|MvUn=?DCA3k3b^CEZo_XSoQ^XZ|sHdqY*>7e%|@1%KXMKABllSF-fPn?G-(_H2k`
z^Dlm1mHsgP{{B6D5B(R!mrLFGF7I!*_w}MUecscrpKh&KDZm`@CEneB4^KRce%<Dy
zd;fe9UhuuZ^{P{S;ahE{i`l-emjnHyh34z+-lOffY(4MpCQ-wP`N0|=Jrl$ipRkeC
zs@46KRx)+Ys<)fx+t=)|u(jJ|!~1JjPvDJJR$h)PjoR|AmK3O$PWWck`?6H?<O0#l
zO{Xlrv7X$#^6lJ0wj;iQ&J()NMhlp3tnz=Vo8)jUf1$(Ir{4Mjy4%hy^4p~OY2lSx
zeZP%IE++d5Ofd;LJm=vR{mluN7AB`M8T`I-*X(M*fwKA8d#|=`zpC6jJ$q`cR`c_y
z^3be?Q-_yv=L@;pa9&GMKd^1tOaY$$)iKL>i*|2eoG2J!&%Pib;CjSQ<vh-77nqAa
zA6@csJA-z1d}Mq2s>aCh=NFunubA9iq7!O=wn621>voO{Z~6l?xHo;(@d@POl$FbS
z$o401#;n@IF`MtMaw>8>_Q9ct&(D9V+0}hs%tGm_+*kcDGET1G`~PjJ;a69Ov?HIU
zb=^2NOX1ReCdT9`mzx||&0U=R3Z%Rxq-r_RryXLceBoGeu8uuSWsb2PpKVpJ!Hhdi
z0aGle?kkV2a11XLHu%VO+U4ZUv;PA0e|P0yIA}Dle8a3=rd>CtT&`$w3Etu6=^(JB
z_1&t)b*zdLVjVW~irp&+oBFSg!LrVOhrC6`?t(gp{NDPDvqE2p-50dbT;R3B(oQwt
z&Y6u&4`U483UV$NS$v+s(v_L%xRq}s*9YsMcf5&mEy=udGK5Y|=Hg&pvesux$AyJ#
zUeQ}0JXmysm$f&WEB8}a?2OkJqFZ)^oT+iXWSD>3RL^%a_tVp5pAPf=+5VPCw&{S(
z1@+GzaeSSM3j~(0ys!MqD1XasBerFJk#Z&~$3p~Wcs=~HOKG{*;Xh}p`HxPTwzE+C
zi=y?j=v(}@X|pdBr%LIr**d%G>!RlCldA3|FU#8KCVOm)PmYI4Ue1NzfrfK-ty@`k
zacRq<&8_a%`I5ICt?d){Ew1|NcPwH{i@5oj@{57o>*p2))LfjjK()DutN*N}U1)yU
zmYjq99i|6zPM<pdThOi{@X=KUiCGJ)%G@jd^V)H+F5qQuvcIIYv0;51qxTubuWM%}
zr~b28{VC?^A4lnW>*X<ByPorGT3PM*g!S{@R%z*8j%jBW8_D*Zp0Yvd;HG7hD*4yh
z%zm-(bl&6I{ckc(e!g=iV<BI~-glC|Jtv}dO7|{bE$XQ`?Z~f1dfcnMJY>&`o_)%2
zRP|&Co2HQGQByS^QN>-m)*jice0u|5mY~3|jiTq$3|S(c9Cn!a{B@P5>pKyZE3?)J
z>MUYWSYW5HdhWZlRbqT!FD<;Xs=U4?$&PmdtCA+O$yHsS<1D8$GC$OvKcRWSKV@H=
zu`6SirZ}h8OWBjx^Bz_%@$6d?SZ|c`?AZScAwS}!epns<yZl`B+{ORCOI?}wc=3D7
z6MyR4ewe3qsJUCcWR9AxBWP23EKz`AezDk^)Rp|twr)7E<@UF-i`B_l)-x7JhbE~w
zM^v-C6l1H-PdKj|%4_ChnLHy=-ZNKcqk`^a$GYj3ejTsQEchjTo-_SMz{D_R9@i~@
zn;24TRWr8F-E};U{p7)iE@68dd|Gy~)uwIvFgLqz(q-!xJcd*5tbFxlYuW4%3m5Lo
ze3{%?#XoyOTBmr^e}(5Y$G!JTt!6Ayx!~kB*Gtof#k4acIPpu7gLqc+W>M|CaqHaP
z&JHU*e`)Wjt=recwS1fF9ansnE4uoxZfRQM*PX>jZ)Y5wy!^#N4%e?=e>6W1`2Mf@
zN!+UjU3=kDb(UrGcBMppzxsLM-)p)R_4SweV-qf3Us>J$WJ0*tx!J2LYu7K?IM*rY
zwoZi2u`T-~ihpSAX7-)C(l#M?#zU*T(&rl=6~35qQ9$Qy^s2mzTOXBX%DhUl;8<N}
z(Bu^rk|%rb)~b);m&NYhSW*9%-zzNa`sr8OD<^S1-t_(G?DOBm6GNR;Cb_#@Nh;fK
zvh^l!_br9K8h&Y>g?y31-jA=C`$gup-^{SMuJ~<j+?K83ljH6eJl`C1)A+>-+4-sa
zkDs|_9KQO<xm?GbE02F2OM7r?e=R5f+>dc*ckktlsAqXm%N!8@{_vKlsde4jUzUsU
z-|qOPCVVxyBJ@Xq%5L#nck7b%*B2!zFi+jiu5g)mj{7^y=2NjDt5qL%q!y&?T6yJv
zlz{z=X}2;i{AywRxZuT$+QfYx2PS=<y6E@S!$L;WwrWMB+`ad};GaHfD{2k*+(qV$
z3=B7MZ(2#oEK1Hu%u5H)fBH^v%sy<u)B66OXp`)u146eBm1&e1+&aCW`CygAl%zc_
zo;+J+be3=VUsp8iP>sR2&GYW1+aCOW{oV3Ax1~Ba{>hlIC|9@5bPxZscN=3uxxcbR
z+uvz=`-@}s(N9aKycOlMJ*2)#J>x@Dy1j*=v&-WtS<U4OO0AC>F1VI(_klBu^OMD$
z*MzmFrrs=LpSGy|7~6|CteiZ~+05RVFOIETxRC8b*H?)^*UmM2i#>N=k8V<76Y0)h
z{`v69sVW+#?$vc{a`o*GvY(Xf`}kP%9-DV;mz~Dd1n$HoF}prU@m;-FWK+bmoaxkd
zm)&6s-W?|`T70`6KYnDgl7Cxd>^lFfOSa*q`qOH*iB6UZSmykH#j0C#&i}l#MBqzU
z+KgAJO|yAZqO6lWU%xr05WnI>R`R@x%dSrPnp-rk$Om{cvxqP-FmNy=t=k@DesIq;
zIY9;nc^90=fTZS?8Re#B=73gtZH=kUzwIXUKYo6a;&ugA?<{?dONScxp5O3$)SWB2
zajy3QE*4i^)oUUrA0OT(@Wbx+**D$0Ra_1IvJ|GeoI7{s+_}fw*UL?q{rd9x#oY%M
z2fDdG_m+CvD1YHghm88V?aLO2KaQ_vf1={IEptQE^Cwr=uaBE}+f;SBNw@N*CHy8m
zlX<r&Tb7#doj3oO^dpP9iQ<~2GD10%EY5aHyB5BC<|vcel=kx3I`LhRZpNNV<ajwX
z1of&PRc>olH~e$D%XQK*IoGb7*e8xFJgzC$PO|@$E99d6DD6oYhjjl^9x2<3!YAyj
zUv>LRtWJ;H<JmM}nV0d`1#X6Mm*!OMe8u$juF@G}5xvYgC+-HkD0?vZ_Q$u=UmHJv
z^7rP+_Rp)!-EEobFS)$bD!knD?ZAWZLcjhKk7v0ZiPeitzZBY-);3RFvDDb>jzRZF
z-ILc#oIgp}&pb0>(cDJwXG<NKcCiTleEI23T2<-ik59x+KIz|_)%I|O%DK9ijn7V;
z4Q$F;#=E0Q)l^!(yZri_UQ>m|^-Ze;pZ<ODC3$XVZm*m7u7cqFT;8RHYBy3&%rg1g
zn04}qlYF$=_Zx-zvI{y7&fhRyTk7JKvoCK*ZSjn)j0^iw_hHG&x8J{e+PalhJ`i0v
zTPVR%E}`R~UCU=BgBC&8|HYSccQYBD@O@d|t+4d;$=s-b5arYAVKGnaDq61|WpJ1+
zV(IwH_U_k97N@tY+sFEzVdA>>#nu})*|cSxaqQh&bf5FL&~$@khk7I5lwDL|I>r8L
zap=RC{h`yDCe4yxzSvc;<+S{wOR_BUK9~KvSXo?NSJ-v)38TyVK;}>3e&+Wj7?xk*
zSMsWeX4<=g|G3@8qmOp0oPMS+ROf%WqfLMEncMq3)=U@CpUlY{uT}75_iTkbb?q_N
z{<%KN+`@CmLpZn9ab9wj;ytUjUGsd?t|>(v%>S8oFVOg$Ra46L=*{=`hn#)4@&6?6
z2Hp$5Y(6E&iH0n-X?j&IRq<2j^kv1G{TxQ$YVFj8<KE|9<UHPfqUZA46wW7mes?Pr
zU2dq87e2tp+4?0ey;$6_{gusb1JS>S1Ap4RJ*2Sff1TdFV|$m|uc+=(JkNNdaMptj
zyA`u}d@r81>^vi~HpFICw5Ni^x4q>R8@5a;Jb%~olJ$dwEc?q9q&Ki1_giBVk*c^V
z{D>->_W~{<?x`^klfx=nIFIjbzISk^|F%NMX@-n8KAT#q8uzF2x+%L@aXsf{W$)1Z
zF_*D(_T()cN({{x8ZWR0q$@f|y<|A4)bA+4^r1ms@Wsq!JhPn)mPrSi?yTF}Tsr6J
zuC(p16@)t`=5SSPU!cK%aItjaLhefzNe=P}nhqN$zka=4{P_Dk4%Qb^P4@x}A7~$6
zxVM?dK)<r!FjGmp(H<AO8@>e_m`;4Pxn#{C{GIQ>eSzk-jqKCPgv{e_3v5_@g>`$=
z!{mhE&vA`&YiCIGOstSed8ahlm(5-4BxmxOBeN~58`Bc39AAr`mHp*ns~4R8vbo*k
zUHwtV6#aIWPvI^x%-5YmGJae5OV*bylQ%KjC1fW)e-|S|r+>!0%_hCUyZ;v-vpLk?
zo#B}<r*4<szS{fh_S2bWmdXW7WKC0*IU#<f@8Zh~m-Al+*V)Mm&B->X=IuPAYQ1QG
z)4hfAioH2GCJK`|e{Rik^b}2Toboj9NuZleN^`JKb97?LLb)dszNjC0byz*<k^k%S
zE6yj22;5lbCRQ^y^4V$U1Qyete&_igc_a?oNuO@`srf1{-|WBfqcbx$9y`-wwolaT
z=*M)iqdVs+E6nY6WPWz}RpilxxJf@2a^Icx;pTG-?*)gL9&h9jE77?<sj%r*H1otI
z)~0LBtE*mJ`SAI9)a8ng;pz)7oBv;T`slH{F3F$SUOwF9{kS`LvEq9pX~~QgYic#t
zs2^X@>7b!)vEooy$RxKFOLj=OY}%|kbCYwkMQXI`l@(Ldj!v4bw@pSl*!JK?uU*cb
z9Rcf7BxBD^J#G~+Gjd+**9pPX-g@x_Wv+>vqI*^OYD`IW{{xkWJS<!9?V4P%w$_)`
z)ak92f@Jcd7rbn-R}3Oev@V^LnG;aBN@A(imue9s$*Epn`A!`3<%r&GWn2At&-{CL
ztlqDCH)rx|>oqrIvT`a`Nl(`}E$7e_WAT)k{ie@}@MUdVIVZjOns0F0deZ%)e{OQc
z{r@O6-|k?0#grrcCcb;F?>{KQa!=)l=sjC=?eae#pVTf+b5doo_0e}$G{3v1wtH<v
zZe4u)zr26BbFWw3-MIVyJ@fRc;OS>C&Jd7KU-qSRqTa-xT3T@jW;N#@ob}(}=KbHA
zOS^kIC&af~t0Z6a(M$;Fx8gapYvJRal4o-sizoGan;+a7(Pt-6mch|_HTcI9zg`Ie
zdqzcL35JX-t(J$yxOX2c(@34nupwi@ddYPu0m2u;y^?;+v}4*Q^f`^;jl+!fmv=<0
z^%ShkHjlda^u`3O4>J`zLRGJ{zSg<GBsF3EPph1DR~bawa#U~6X-T}V&CtYe9xXd9
znX&lGiVCOX_zn8b#R>23ANp=?zWhf_A6LbuuWLRFYd<MmHN(lIV?o6a+36`#wmWZj
zKYYD;g|<y);`H>tlTSb9Pe0dLY_xZe-F}PTH;!*fUb1~kIM+23|Lt2<GCutLQz@^0
zCP&8Hu2LjTL;l4y#^;mt`M&76=I^_6XI`vT`0?rKJ@rRF8OyAj8QQCqZFm3hhhLAs
zJbCjh?bOzLf<nBD56QYr*0?m$^!gm1T=|y5ns}Aox@A5rN)dYuEBH4zDsg7MtPm)*
zxSJdq?8A5ESA}HP(sZRoe2QK>K5sTXps<P~xNUlW<Q2b;{Myh>^W5Vn{`k3i(zlpH
zRfn~2a5!bxep_xVCov`T|AbwSG*r5Rc6eEyUe)2;E_m(P!=B029dBJ9xFs@7l-<nA
zkaqoX#_61p=zE8h&YnD$w3u1le_HgDjZ1H4Y)&bj^{b`!o`Li&U*15gB3+ir%Y4qc
z=7{@jsok`3`?7m`58uCWpn^lv;6N;I!G#XHM=C~-e+yfOv-a-SiN9nrH$%wpyj|?w
z*chHKHeIu<cRllyvtA@-X;Ec%JwwA<>F>T|>xV~T**KJWH$NzTd2`3E&fxlEUOsLK
zNm-ejBixJ=<&y<ORkj&Ee!f0&j_&2<dn`^V76yO)Q0E~hBCnUhwD?E=B<a&E-(T$H
ze>0OyuHw=J)q?*47QBmlHqV{8+(mF}&0?cF3!a3m`|hvu`qR>gN%_K|i@N+Cc?H}&
zb@j-++|J<VJ=<0<a0xpr{Us}!|N8%1p*h!mgZtL|UOPT*=8HG4zWn*Y)pk9`@_0=*
z=fSovE=h(-D@|`K+;Y}SRY+EDo504K+(8@l-<CAV*SXG%@@1L3r9fD4)8>-URa3(z
zg(&og&XstP9W=EhK6akhB?fcne~*{#u&8obv}1~kT;bYD>J<lSl8jr8r&MzpJGkZC
zTOvOH-+9R;aWM_SS!UZ)Z!X+uS$(;YIm*m$Td&QL-Fz{JQk9zvZeG~NIALm!#D$fg
zllp&0-OD<1(1wG}DkOW=ey%kepT4l*Gn7AnB|F=c>r!B4T1tz`t$RB4`s_QuB}rDF
z)qQfa@m9COp$+G<&l~fXAK>APnEaDd=wnG-*=n{-t!=JLXR*C}&clB48WWQy`_hfp
z4w8Rt1R9^TwH3Bsm^Vvon{LGun`H*Jhu;ZyH_jKdkvZAkynkc0!t>iz+xOcWFqUjo
z{_(Ojd>_li`t9G|I)<yvELmOkVygb{yUyL+89FZ?g>HSYnq6w5)*mUJ3+b*^qU*1e
zPWGu@zc=7%fOg-WUt8Clk`9<`d(qroCFaP{f5$w9Z?j$a=2>BE=zo~aJ*Dws`nk?e
zzDl<r3eEmi=dtGhM^E19?hav%2r1o)C(1iid-q73FZ5lb^xeHag4ssln0fw{6EANI
zU-S9J_AZWRR_2F<c^~4MJ?8J*_;j*G>!Wbp#Rgk$pONEP#W8Jv-i+4Ok<%_ND0I(S
z;VZA&EIT)0*85lYMXncJc~-x6vOq^~?G)ZwyE{%M2lYA}TortuMc1F@{+-p5d0fwx
z=QI>tN$%Sq-Nq-SpM1GZXS?x%wO^+u-`rZ*xVu_vV$|2EBF${~l1-+^ewWzRt=6ga
z@=~}+X|B&D+q_1_!}lCwOmsSxPu5(}+nwmRXLZ8W5Kn#ai`t8<`!gyxq{Mv=G-D3w
znm*+*L*Rzkk7s3XDNpvRdiXDAXH4oRv(hw{1?v_TY`)a9CG!3`tM}J;&ufd`lK#{w
z<yYleZmYHTpC3K`Yn9hU<9AN)GXuj+*DkEsv3>8VtWCQ08@A8YI=)G^{=x;n-r~w{
z%gppd??r75fAe&+8Rw%r=j6U|se9b})0l8(`tnU1XSmE}4Z3=%aidK8!H6B&w;GsI
z3I$o`*q3ej>T~6=kh<HCs1;?O4%)CK&Iy|Qd-dj>v+A=-x9H5R>A$nnX5YTB<2$5p
zY<W}m{?XF4sdBSqFMqpS{;IUF=Igt6KknY_EiPw1BUAaq;qnHXtrHd}zVS;JpH-?U
z%eJ*pYi{~c?=I;F+xC3hmw0t^r~6t?<xAy<zW0V)ReChR(KYAf#|^h7Tc;gdX}spE
zlSBCKYflrGZj}^V6`p3YWoLcu-m2$^dUw7!KhvvvRkZNq&8z*-Eq~mfwV&<pwm7L%
zQ|C>YzwlD;ijC_cE=D9DeH<V)-<EsrEk}c2Ec2${jJkbSqI_B4)EnnZ&UgvmwJnjH
zx-<6kyOx?=w_mT;J21^?x7v}!ZrkihQOgdi%1r9I9(6t9{ecu;iPH&L^X9HN|H|dP
zYS8_1uhn~HW>m)<xV+&O)BCF?yMDhdsk->))gDcc3zZ>%q6GCnyts32f<asN<ZbJ=
zb9{X+y8Mam*(-sM&dI0R-+P%=x91;&YkJk!Z!$)2f6l)AxqqwAN-YT^jvp(JPs+Y|
zI_R<Fx}BCa4hN#ePB-XZXKK!yb*E<MPm8(ttn9sH5BT^=9p8Cr(Y|htz9JJn`zz*a
zeb%!u%`DILzWZRqm)A1WcEu%rl;#iX^!qq{huDIhn(v$%WAE7bKi&5%z-!ggyX=?W
ze#p8rV^i^}eWi!`9Jq^fJpZpw_;g2ow!-PA4AT_$#-|T^E_wuMe7Ro!%lVT0SN8Ld
zxeD6(l75}b&282Zj_UrJda%b=?^Rj*#@dJ5a&zq;PWgCrcln<y+v`|<DHeF<mWRFX
z(b-(RZ5lhT#frrhkIkPjmkVB6<J+3{VS)aO_aEYOCx<Q0K6#uiHv8Glt&`fX$6Qeh
zdSHEMv()32R+1Hq{v3Kbk?*rKpLKS@#-NST{&wA8)!ZGGRF|)LnzOw-HF?i$tGXEW
zd$*>wY}I)Dq`H7t>!`q&39$kbZ|t>JdC}&b7Bh3_y2V0&eH|RP8Zk75{FUC&m=h$+
zWBZ~t-r`SH!pq0M{qyBNym2^S?ml5^(H=#`{(8=LZ|*&}(mSLYd6Y%pwr6(3C*iYS
zG}+6$to$y-^10XRue$eGVy&Xl8V!q#&9i!*?7y3_<8V;q`dr7Tty`lvEI4<N#kqRT
z(d#w6JErXE*}<}FZ*+`ST0=#iM3}@ER@W6LRxqm--Dq7H#2i-naDMLHhaILdwolC?
zr@YK93=F&L%5*Fxa!IP}#k_kwTe2LF@}@gfEfrY3&?d8Gn&IL*#-3LnhAn^bHY&Gm
z33LAC<GaOIaDA>?>eam>b4_oMGW$&ahHmkiBf{%qGh<ro*XS2I+L$X9isW6jHI&-$
zSD^5&H2>~Xzppt@3l=l<sn=!A{1_O!?cbJIyWMPRspcG07tNT?bemzr+@tR%{&aov
zvG)aofs)Mv|Afa32f6NvGV3y&{nuK4`O}OK%sVH|<Z~9d_WIZ9zLzF$bvK0l(!{mD
zAKtmLaHTc#8Oc<eIv?iK-QTJk=1pVpI(6%p*_K1i<-CSriBbOAZ)0wL{TBCg+dk!}
zc{>FETQ{}EUT}PmwwhnQWoOoP76t})J_ZI=?0X?oD@sy}@)C0jit@8klR@WA%?*#v
zzilQ`cYXbX3+!GibW>_?@l-f$EOBl$<CPMZcp$-~8^|ZzDdM4(m+)i%dzr3XH@l2|
z_&Z(do_~n3m)oygzWw_DGy6NHcprW~-&k+$3D)b}pEf4FWS(E&vA(JNiGS$cjE&VB
zo*cfqe*fgF%<Azw11F{YnJK<X%ds!w+$n_<TeUnVJ=wa})L%&Hlvk$rj47v#w5OOj
zKDa(5^Ztx`p+3_0>Sk9(XHG3jmZ}xq%-?!r+o`;Vn_F*9_c|e)*tX`+!@`(Fxz2l5
z?eO6_{j+DrDgm=b=CeF&w#Q6&`joQ%i|}>NRau$M3c524pIr98F?G$3tFI<5FB24~
zFq+p~?$p$$VzTE%x=ZM}wXV-yYYrb^>X7f3Qmhe>_P(KTI_ywwAEVoHPqi-$%-S0a
z+;X!6Q`9ZCm$ivpiU<=?kJw+;rg!BX3#WGaiu85cPx1Wypsl_xA}nmDM%#hBT%NN(
zG%u|0NmQ+N@|k~dL+fKdkrK{Z*@=~pN_XhEru<{y893=X=S}Y44jT*(E#x(J`d;F;
z!zYxjbnB9>XP@uC$ic1izV+kD<Z{0mmk-}~__*oL{rlchy$`*FJ5;BA;)yr-8PKfp
zAg*)51;LN=MExIb5L@(d<vDl#y>U4Ta<A81?B%*8t5n3q>u$8gE4ukyo5`|^&wM0L
zJzHnsxNq~bKLIrktDEO#&2@V`St~&#^0OzyF(#P<Wqi9Y>|kExStDKOb>iWTBNl9*
zz0;hh^v?9uN<DJkpv!bUSB67_liAC^whIGG!W3hV{Y&mG`Eh+!icC9K#1i{US41aG
z^pv}LO{MZ++257XOS|H>G5Ik*m6+ML<Iq0ldy`G)o?rN!=Zf9kFAJOAggmei(7(m{
z$-9X4$n1#|{?&eNu3=4lwW`PA)XRBK&tC7m+RL=*QuC6ZTlYsW#@?%ZqOrW($>Vmm
zllSB;XEww~pMET|Zel@7zVNlrC+6I^lGPo_%6M|Y(`Wtdncw&pKVI;$<d)Qg7g23j
zX7bF;7VYa{{Gcze>14qRlNSr;h1@SXe|Sd?+l_}7TQ@GdKL1_V_4)fR`>xJ%xEZXz
zO>sfp+osLBNoG^#^Y;Ibf45usn25A*?zg+5tjnjCTn(SNdFxKk-ltcY{=Jg?;1=oh
zQtyP;Kc$}7!;jdc-${n=v%Hmlv`RF-`%3Pj4fhfRHa4rj5-fZ1J<3Z)Y)_HX!s!k=
zU+xRm1f5@0@KF2jCB<Xc*D*8wEV=dZQO?TEs#_lRa;<r$&*>uboc+s}j@`{)R^AHR
z`c;lcxY@;SPvvpRS4U+0d37s$m#Q7H-8k*uMo*8pE6)-qWW~*y6_nXg8NsKuY1+O&
z57U~(7fzj%!07XO$1ACwJJuPorS)o+PLi!<+sI|K?&~Ibh2)I&`SxLX>@tyN=g!3K
z-Ee2}yUkB6p5}8jw0h@%d0kU;FE(Oogk%Kox?i>RA9@<Z4_xwlXK<yc=cUKd*<UZt
z`CQl8x%aV5wrJYbZ5!IZ3hkYEW?5<bF&4%$12coZ<i%;S+ZW94F5K`Y?MZ)C_~Y|!
z(c2%tUf6h4=XAlo;@^sQN;72kc4RDja(YIY)4rZp>5otENHf~kb1?d$(V=vnT~n5x
z$n?%?D6dF*_-(Js&BE8J6VlUPy}ZtUdIC#-+5cINQvXe6Enu6z+`jgf<!;9xRu4ii
z%TCx;k9LBO%I+omnpqeaYI$+4mq<@7DM_sWm55uza<d;>2>g2&zi_dR*Nq#VzaLsK
zS#Ha@z4XHCso7#;UItOo+e){p&R59~>ihlPe3I(^CrewJKet;*owbp&tulGc{pC-|
zXWg0v&Zk{%-!-4kO6@tNx@(<h(1j0LQ7qywHm|s^a+<q$o!E5y#ifoH^FuiMf_^nm
zTeMDrFVkz4!igm-0%X#A^Hh41kF1LF=;e6sBz%@7-0?w<)6aUBXQmUoer?R!cRffY
zq*U(L+B6$?mxZMQ5%Ha2u`wmOpO2}0Oi5P@el9f8q_=bS><2C(q7OCg3}xHCW}owP
z{m5fBZQ`;k+BLT<Rc9^nS@n63_o2_lv93;DTo<12)V_G4r7eh~HqGJl-<%Jzep{FA
z7A#7)mJD6FXOWS-;LV%&x|8O-+^djnCCQxWA=H#Q|26}gN6@5WsvOG|vlgWY9lkc*
zBh%9L;ra|&TZ5(X2|FU$IOcJG`E$(lrs71!Sc6uhuppNAAu46AvlcaZz1qvYHhb%w
z^V@IdPWh}RWHeuU;!E9$CGR|DH9wLHI>#M5)lgh>?scU&opqbqe;?P6Uq4^jIPqi5
zJcaCqi)Ou0`W0;O?(#gvH%bY`$6`-!H{+MizQQ_DfA+a8sk<B&EvtFdklyjhWr;z=
zL$~yY`W0F4g0C%}p)PzWh3WRQ-@$sGT(4(@vmDu2Wn}vyG4eHAIPbx=-_N;ZrB0gl
zfZN8_<=ys=7aw0&z06$Wxp3KsYbT{%>Mh*rHrd)@nft=`E{88iYqri=sIH~GOyr7m
zw#1rnZ?;P(Kcrurl3OR)?D96yy6x<}|7CmrH}eZIOo}cwwOQACPE$TJyX_Bap>ufX
zofFe}%}p-F@-4M+e%so2w)NdnE>HcrK2x@xoOk8q<@c|5|8BqiyrXcs&76*#E50wc
zJ`f<>Z=&$L<^!W{`r_|j<WuiEOaHRh=&@7S{w5;noroTDwl7!MGQ+3#x28PgpWNim
zS+d4+`_I15d@H!C560(Re|<au_3YPQzn=Xof4+j*!)`&W^B(U`>$oq14>_JZ=qQZ*
zHdm)<QJi1g9<v6o7v?IJs+PRIf4G>N4jWB271=WHn?du!<t1fbKK)>CH?L4p68<NZ
z{8{KjcKPPUqdi~lwK7$O$p)@lVrE+4?D)NU*7v7-<!2qL{la#G+vd`rh=&f3>J{#Y
z=_$_@+qeJy`}uJ%6OL8gyIj=0aru*n7sX5}dv7y;bCKBf|CL9+U|as~<G%Z~bVY5;
z8J*XP3Op`dT*#iDyXay9&)JF%1>a*6OH$fnS}s`c)an!y%6HooTOyiQ6tLh}yK2_&
zK=wbo_;TZyxob<`I&>&(l9p-vg<bCNg4e9gSXcSe(z@)beElz$+*5N-6kM9rD#yBf
z9sdEhH<OsB+^gWq5=i?P^Et=9pUq?K!nxV0o7XQpS6uP()`m=jH3zD1eX+LxHun;H
z)u%8H>7DxDe_u?LpH;f^`_p65yM!L|?z?uD&F0(YX5Fpso~H}FVjU$^j`f)y|F5a}
z<uaG<wBy!C<~>|c_O;{hTG@zO*<}+J+nV|x`*3O3y>C<Z7j4|S_5Mj4t3Mq(c>b}X
zPMKA?<mJEPW?-n+W?)dl-mXh8$xg{n&PdHE0MAs;mCDS&ZSie)J*&E_qV&|O%s2iD
z9Oyoob9pX9rt}ugWz9JXCxmjdmActHpF3RqzwiCWWqj7w$9$CS_jUKbU-Gr7W^dL1
z+PcW;TSQCh0xyPLTRrPjaM3pHQ@nHcpT6f4H=%y>UE%fDr9JQMt^D0@`RB8L(cXnm
zlttI5itb&`dpoyrhDTJ6`ef1c=t<94@4Ztz>-my<?<A%#$%t0tj@%sPqsFE-&&6v-
zLHzgAvgxX#a+_|R-nH>Q*S>qAF#)<tr?;(e4Ax)U@v`NB`^(aQ5tn4SyibbWzGx<X
zv}@TCv7gR&!`?Wqc>XDqH~y-!L7VOY`JJAk(i^k0W;T0F^h<MFBpMQ^xO&#}`i;A`
zo;tZa_U<}Q#S>ps7F~Ig@-XDwxgS;iZo7iCFV8%BvTK!-W>(>>GtZmeR(dv8PtvmN
zKH{8~>~gyHZir$pbI+uPjmnC@UTgen6BB*fpd{nTAf<X+taSG(=~o>x33FOPf46Nr
zYNqgMfpW_CDclxc`Iff!z4yzLw#nMRU0{ROH{Jt$H#X_q>abz5>7JweU&vNW@Po!|
z(*>7<x-54niGDuuCQUcoJMXE+>CnGFPB7|*tl_pkl~Nt9tIQ|(K%+9)(&=->lqEW{
zos~6hQ$mATtlIAPpYF~){l9(6Rw22onXED<Cf_eC?s@TeUB+s`x+=r}(m93#&sqgS
zjvbuHzG1P?tJ2dJrj|!OUwmN0BA?po>EKZLX`QTdU$ye;MMpmQY}zHdDPxvFs#HLo
zLH?(`{%+rHaz`8bsU-8Rj4oR2Bqwkso+qN_Sj5Hpi?4p9JksB38(PYx^=y{-ZJDzS
ztm=`ccXv(w+_EQVj_J7#c^$%&q-~u8j=fyRc$>-U)Vax$A$m6$FD4b;2;y7oRB5ie
z{i^29b9&i|`7KYjYii0fF!gITN}c8Yw`A37hc)L{nTenEbtvGzRiC6gcjC|eSDNp|
z@9jFdFoJ#ckIw1hPo9-6x|UJRe}C1kDZy$+Kf;Qyozn@v&*hWO(sytx^W~Z8ycH*}
z-u(KWQ%<1ZgSPEK$=a41tClsCF3!v|zUsW7pw+Q_^UTHk7aTnMCnfqD_F7~s-Qtka
zF8gV>f6tG%r*BTT|Ga;3^7KDDcG-44p2Z(|TbsjfvZF|#-tzpQH*AiMQSVYW=B!v)
z>$vXQ1$M6!0tIesQ+}Kg2-&Wx%Kst0ajiPDe_LvhchhRu-(Lc3QrnJxWt)?BT+?IM
z@+OZLagywPEo(Vc_ygChys%?;$VC07b%M6hmY<pa`Ck;`{$X!wrCW1(R_)%p|37bk
zee>+>%iYntKgzlYm>kOGoZ0qglS2NVca2u}yG*Ozyn4d!@w4^6%4(*fVpqAWos68V
zcep<(KPim*YqOL0F2j{x|2rGbcHQMWFLmv&;ipAnTP`d5PyWBH)6T}(YO~z+)c;L2
z*@~$rYok4G*-W(mGI3RL%Vgz%c$Vf%PTP(OM+R*YU!|(H;s;-kjKQSYPLtM3X`kZV
zz4+G;1(B=gxCKI#ukO6{#qv4NrH+Ip3ylOBrDL5EiZsl36dq$eIOo=;c9G~pk-e>t
zZ$8@g(0T{=m!CUU-i`AL&`U_2V&0wNY<YIm8AXqOBDW*8WoAy-n$7p(-oln!D>tvm
zx?DWhd-<;O=Pi>jJ@MTu!(j0AmET<kmhB9J>GwSr{7QJfR%^fF)wP9RRLy%gv3-kt
zafp9zwEE@bgHlbigG{%yl;$$rn|||k%-eIm^)^RjR!v%KvyEly(&iQK&NMaaC;txZ
z_1nI!b#6$yZeF%k_qu4w$(C1EmFBirI=ns~!ol1mZDJqEIM-^`-LFr~OEi1D3RJIh
zte6<Xde*zpDNf4Y;HLOpZuZzM8`rJja823VWUBt<pn>thJ^81d!@83+m$hYxwKEGT
z6?d-=3KZa3DQYHdAYP+nC2utE%=6PbI@%8Lu5<6*_K(ZpPL3V>2d3)fUXhEOq!pwu
zm#vU^x^#Unv-GFJHIvyT)UTJOml($ieetzv;Ol(IvUk=i@w1k0_m-4B-qd(+V}pRR
z`>RdHvo~@wnbjI?-!Zdhiu$_wn^L|A%82&eQfR$u7jkHtdi!$G)Cr9hytyxmMG8-_
zn-)eK5Bb=!?dyTn`ipYec-yRaZ88I9epDCd(k^MRh-=>T>EWZ_$3F*u;^msKcl{~5
zD-r2mw)BPao(ej8%Vp9ur?>2ZqRmW^-G?u3d3EGs)|Ir?3tUWhNprv3tz`b%=xFWL
zxA&&!)v8XPnjm%Ob;;B|iv_KE+zZ#`IozM=t38YTzL($2D;1l(=j`g!U-xrf*51XJ
zxN{bkUAZ%9W}Ity-1RFJHL*F1H*;Oyb+}n;tIYRZ2bye|6%vng<ayUBD{M1o5%YU7
zFXY$dl{UtcMfDs-Zg=ZWE%@?S*QWL6$*(sG?|$TxR=jq;ntA7=xdNA2j^+61|7e;M
zD*B~(%K4*x(<=O91g*WhD)cAB#W*hrtJ=KC)i?K1v0!^*)7zi3woP%K94Q$3Jyc*)
zJ8!OMA-}8<A4fvWfhYVoZhf7_a`;{2Tg8-{Tu#EjFE%|$OlWwS<5R*aEcC5wb3^xs
zGq*(4D^?x&73Rwux$kbF**i^xS<_?xc^RF($nW_#Ox?=)>f0V`?jY^!9MX#u*_O@G
zw0!lUdQ!Xg+Fv|7pCp!8RJ3x}^DDo~^LhB{_~94JrUw6b_LJj(&}Y5=kES~Oi(fh(
zEM<Py;w#=Tzp<Nhcgs$X)oWx<{k>*j`ujyn;vSYjZpkw(F<df}6#D*WT(S(ek5rLu
znpYwHXV%%Xx3@3fZoK|wLQ7OR=kp2YV*9#p_aBwLwxQ_cjk)V)TwA#@Qnj1avukgP
zXN2Vc&Fu>%qXSLnY*uCYD%_@V`1Xu0F@>-sqlO>*7MG}B(Fs4%&^${taozs)l4nkO
z@6vqG*&cd%tEFVly&1l1HX3%lZH-!WIpV=drM7(<HWw_9sq_oBuG*CMe1lldpPwaO
z7Yz^f^?BJFcyjap7hvUM`nBQ86Vo|v1uNfwKF?htFYw^@Z702g>&+R?=2r_jrDip<
z&HBI5=|#FuKIi6_3)qyd#Vpi(*q0$zr5BYyr~Bv!mAqqod%pN{y=B~1{NhE#ohuVB
zRIl)KSi}%vP_S1uVe6X-*EAgG+X}rD-sm(xcGX;N2gQQs9|bG7t@s<X*6H8(*ZtE!
zYGkskkjp-Ex}Z>F`=NgZYgfdU>WkItr-@3+upfUdSk=AzfJH$<TzUF8ood^J7Z$2K
z6ZVP}2SlYva2`xqd$#??jb{_y#(CuU9eDPF;RXM#Ri^URLfV?D>p0C~?634MdE&#7
z5gjHH^=FdS_8^(sxVWpY;?jQ9oLPJJ1f%WhZ`L-UvR75Qp7FnLZu|aB^tII-z7roN
zt-3uiKe1sp-}Z;ApR}v}n;H70&UyCT-A^pHb29ThvrjU0>U*|b@b}>fJFi>Ub*FPK
zn9|6o6Q;=BFLdWxsa~0n_U|>Tnd@~I>|LNcOQ!yFBYP?Dl|-S}PeZ(v!~5EI%ANnX
zQBPut$jW;jx57`)5Z#k<YxkSrV=JPIJ#%d&za`dv3aT$jZ~gznn(6VUZ{>CGeZ-o!
zy-=7b?=dO9-nY%j!J)GFwrI+Ij*jSGeG1%GN*W7f#8U1{zc|m&%%uB6(utX`_Ta&4
z#)Bbm8yjyhRJmmN+!xP^SMA6yai7B~J5e-1%JJgYJ^LFs9NYZ<>5{#wzkm7GA3c)D
z|1N$R=hiomZ+=f_3%lcOl$@=WywtYew|d=FzPS#!j6>ruHF_F-SzwoFA`_Kh(G(eB
zvA1&1xi8NrxIZ{38j$fmFUvsVRNw(kwjb`|oyv0_-M$_e_wndyiOmw(b7sFz|LyJk
z_UnutigyYZ-Vpe{U|)l}{Q3QL|E9#({Hm%gtDG5MYx%$6V{GioAM!71ZDwtMQxa&j
z`sS>rN$=0^kK4chM^nCv%D*JNbzwg)*MFFG?@Em)bDH_#Uw7Dan0No)Zfmu9XFNxd
zAA_xdGvDQ39`E9qc#aj<f8xKn?@(r-=@sWK7yTCBe%j#v-AE~@>c$Dh()SHMPO|>f
z=AMsuCv$V_%dle?gf?ng)be^Il>dv`A6DG6{C4|4)p>hn`W#5wS>>*F{_2)_&$H}K
zoISGcep<tXL)%#QJKWm6|6um?n@{Rddkfy1)3?84WMBwq!P#5L$S*<eEtCfP=Fc$@
z*!x-gP7K4;twnt<OFdRj@e19YwKIf6kv+}aFH*Yq?6RNVW$Qm&40+Rd^vrDY{ChqA
zEA-do`cIxKaBJGh(<?3-Eu6CLkk?wDNk{T;oymVzxv40^@ABo2UChoGCNF+$?9G4d
zo6v1>-K$Q@A8fcx4CcSRt#NfG=iyZ<9|cpMHa+@YF;8#7n~Uz7Y@Bwy_#Jj6VwxOZ
zkfe5-;$7AQ^4*7Q9VK7AHsJa_N6e>W-RVzmJ<2QoEmOFtZpgcB&Fok$RlN=IFES@N
z`{%w_KCw>x#hZs*FP6MvuD;8<NJTM{M}2DGkE-KZ|3amrrMrF4@y(wR@=Y)C%jL!L
zQ4e`co+PV$tACrnG=8dff{pJx<BXaG>sYR~UG8>STe1AO`KDXP*C#DVaQJ9EVcp~P
zuRi|X{<!w*3^uOxrP^V_+Y&!LDNZmr@G32M@x3&&g^T=KC+-$K$#nksPR@7k*YuRL
zV{KMB890W<*xtMNAvXL<)%RP|jgQ*&G)-(Udcm>CbD8qbfK9g(Vizo}UJ#=&)6qCM
zW`k(<mloMAF8j6#{ra*0hxMcy#m?|2@xS+;=AU05#vfmIp=;U8u6`E9)aw14Dk8F5
zpLW(&9{hK!Xio&oiLhl&CpTXz`O6r%SW|nBLjC-wVTYct%@vn6t=zQnz1dH0)YMXU
zu|sbTGXsMe7X$jW@vxmlnI**~`T03|1(kEdqVq2sh}4~5Z*fU(QkPne&4+-M9?8rt
zCK5?=TS7u7PPbUAxKa1^P1lb9=Qbukzf@}Q!aMu7_5F`OYxHcJR_i~%e~CLRU|r^~
zjZ5xq=nCB05bW6{>l>eX{G#9-&Yufzl%+qo`tf9T#9NJ;MNtJBFLl?p=3L<8QS}uG
z^)i|8JTyDX^|MTba;uSpg?O8U+KxV@{puw@T(5))EzOL0{mo4)FyO8-Pj1T5SBx81
zzx=x)gLifHi{_LXZkNMaT{3H%Qr|0Chu*$+?|ZkkXPVrkiJQ)J+Iv58GU0ug`sYaD
ztb1G5=v|()vZ7BbWXamIMs-5x1X|sCPG7S*?NGwD$n^YHkC_+UI;wd1qU$#~+GxHx
ztdp#ydUOVR)7NL5r`?`>GhJhNJa%tS{DR3EPR;?k=l63T6IKuG6Vi2%Hf67$op`lS
zCt+%=LGHC3duKW?n3v~n@Xugg_#Bff!3(_>f91Jk-eJI<epu_k8R>{>rIj;!pKLy0
zT#&v%RX69?^aPeIvz$~#BwTl_i+z<Qk!%nyB0T4?=aaH`Gj4vhoV9kvS(im}=VmTy
z6?~;Qu`BFNoo0zz=gm}em*DD$DlSIO7iUI&n{+nk-z+z)pH<7<0}@pE#E)gaJE6<k
z%zE?c@~4L!Tm+=K4h8mbWivSXIO=jWrHV-GPL+Fd&?z$im$URfd&fRzsXi9Ii5IJD
zjOSLo$?1|US^voR;<cs5YbErZeLh@{{wJ0B*W)wuzrB%doNL}@s}x@A_`(10{_Yi9
zjMWbQeRTh?eBxG#RZ_=Rh6}s2CMj=KpL<~AoSvzccdoCS>AOy4pT%kWy}Nf={r&JR
z>%8T$7jLc|pRIU+MfG|}()<d^^L#9?^f$M-dy4P4*8L^L_^V5{@Bj9!Q%S<t*)kNB
zwXciT1f6Go$^9ZO%jrVtmosVA9!r0=lycoa{b)^g%E>DWwrk81(toPvu`Knh&!g^C
z1=oY^|4a%~vln%9Yd_-bDR0`E@W%97?EmsG<%P>S-gj`EP59Swwr<zL3*UDg_Nn&j
zS@i9sb<Z`PiKR{379X2?BhBvRp38Y!OQaua%$MhWcbbpwt<P@jpAR$R_Z?2JJ3jZD
z?Yh%Er}AeWy0>fTjb6k5`u5NB*W1U<c^<E?A8wYA+uya@Xy#cbcm6GhTV5WXv*G>W
zMGhD47jSMod#YmN`pb_s%YKBqtxB=$oyYpeT4T>c;}>u4ckMsC%U*bH$7QSUn?KC@
z|KQQNryb%i9vu12i<+&CJASq+voSE(3*cO3ots*mpBJB6kqXM#;ko&b&3OLJi(lw$
zf8(Ig;_~*l&TRQFer=Myu$6VzVcyrQZAsd_VbPaVc4ijbsF&CDuJexK;hu10lg6iq
z%3VwRPW-)lRQ_}JJmbV0e}WITJe5B8rD=}lto)mQoQte16`u#aHLbrB_37c4zsD{A
z{Bf8T?N*oW#uc<7J<KcgU{aFgTD8f&(?m~h^3BaYyQ$}cmuD`gs8dwdPLVXDkMEao
z`lsEu3;Mfag_%x|==u4l%2Hl!y=0WWZ0h#vqeqn&w&@&R9rR3Onn}Q<CENCxc<PyQ
zC+NjT#6|DYyJ>rQ&a^ugDU&@9nx({k-c%q^Vx#(bew53}nRRO}UbZ&hIYZ!wNs~&g
zua@47lcwP-?0e5;Co>9XznwgHnO9>|?-kyqoI5A5>`>Yz#v*a=bd>N;VdJ3CtJhz2
zzN_zBW_y`ax2vaWcA?4q>x&k?$z3@|>&}Aht!6!<aZbhp;&B@kxfs$Oc=Fsonmy&*
zf$-It$Buk%(wQ86oLN_X+DX>)Z<{w(xjjhV%EXqxB%!ZBFUMK$zCtKxjq&;5&-czN
zdN2N&qMRLg<g(wn#^rYmiqaUYZtcGk^~&Pc)6eU<i~NpWU!iDy{nCs|J?*33VGGhe
zy`B57{mqWMi`MSE?7OJ()#CXYZ?x9+GfZB$!gb!HJw-gT+b>^z!|+>q^UOtM(*DaY
zU-O7yWRacBzC+Zt|77`+`~z##mnL>!H{n(Jtjl8iPRPe=@&V@S0^OD}|0-_1b-i)Q
zFFj)Vl~oJGnh&1#VYjX*@h#vCTde&-etYrZr+%72$$cv-JKmj}w%=94$uOZj$w#%`
zQ}5BmEQObfU11K_ZqKe*P<^X^_eDF0JnaX&`xncK>ok2(y)!qxuRlNUmWE&LA+F3-
zhiU>oeSIRD5pQ=lX4^XU#B_$nlr(Oy7#mrO-)bvvHvVw_@?44O-IQYQ(!8xl)+KD~
zW(^Q8f03rrwX8ExwSBw2oBNl=o915eXT9FM^W_oVUflyplNEj?Hojb`Y~bN}bXM*0
z%nfU=PrSZ(N0P#Ys}r8QyL>k_{;~1p?3?z+SDyBmUH-9#GwOV-qw>F2ZpNjSVUC_f
z8bv}y)~$jeUe4NXI_o2*TiOUc4`9x1Ic+KEr;)<-an80c=REdlUy@62Zz;PN)MR~g
znZZlZ))a&62(P>ArBB>i)^Ut?#<e^H-Yti7W-v5p9h6wfdj8{*>Y&D*ZIyX4zAr9k
z1Piq<+U}t0Yk4x2(PYV!FRJ#f=YRL#FW2@z@%K~C&!2X?ckDZtmpA?9)wj=QbFb-$
z-=Xp3oP&s1$C1$brV|N#94$g2jPD)n6eew8tZKhm?_JtBJGkJN27@2}qO=Hs0|#Gp
z?YhFB6d}+x>tXWIUPomHmTiYZnR|Y+cK&jdH*#IQUDGOj!3Vcn+B&kncVAlDXRkef
z>&qW5-}ep6j#_Y=PTePwCMe$iQSBC^$+K$SBmZ?H4lF8}aDmV1{?7-i>-asa&lhx5
z1>Y}txG{WI?g9C*mYWp`86|yv58JjSzjN+Ckj$T<e%VKz)!CuYU}_t?g}%p1Pvx^A
zp2aVUtaP2VC2lxtuVtO_t6r>c;x&IG_H(n<*C~h=cUvBud%5h?tG^Re#OrdqUVjoy
zv&?Dw9Hq~9>EHnd4+f(yU1piRZKv{r<BOK*?A%+v(dw4GN897GZ%qE1&#>kf&RKO!
zPAT`Ey5HjaY4vh8tC#1#mrT}34z4`g`&uRZ@Ux9?&#?3EojqwCuj%GG?<dg-->2Jh
zzSwcs=Z=hLOzEX>KPIda4a;z5P$>JzY8ve$dZ9dk_oQJ&#;YciJ(<;>8SBoT$&R`1
z+q**Wl~~8YD~Gjy@|25aFsxXS8ToFqfSqpKmD{gX3)K~uEM9yzPWyY^My{@c_cq5=
zVkG7Sg<tv8<TqQr-L%*E@r+Q<@~a9HY^%$quJg0{KkRJuuD>3$eL5$Dftj60u5QHz
zX%^?DZ}&=F`|mu*$?WHTcD3bAYh>@b3NL2=zBKVmU*b2vTWJ|m>$z9%U#qsX<@45=
zeXLIV*bXjTcXOiL-ix13rLMXzP+@jS(Av0Z&XU@uw&Tmo)0;ULSe<6sqF&&Coa5A{
zuA+&lc6|@R_-y4$aw~2XFl?J|*rjmuFIuzF^?k*%)r<@bE17Y2GIER4({fATQxdg7
z@!4}61nTem8%|)~8tVD!LOV0JyZ#ghDW}KI4=hqvFW$aj_vv>PCM`AJ`>NtvuW>wj
z_x^t0=3>_K{=26?ah$rsR_(iJR?t?b?Tu@vJ{6pN`%6^JLG$GJxmkTI+pn9)E7&Xj
zamY6bsW^1)MqjOihP7f=x|K%PuI2X<0~=ngDP#%CcAhllVqAx0aqrY~kN154tN+@k
z^WOQ6ooilP)w<j8WdgV1E}4|+EhVpK)oDD+OgZ#I$1^ol^wXKv#!K6lC$yT_)*kru
zbH}mBV9o7rYM#$$?^>+zEbZ#1d`<3iCsr+<q+)qV-!?ldPPg>8Gmq>f8_(&iKW5Kq
zd1*33SLa%@CbwPTGJ!WN*IySLFq^QP|J3DsldWAQ)UYniRBn(@K7RV~viYYa?41?s
zwzw_k`r0Yl@Ah~{=+`&i&+BJh`j^$~U%7D3#mtkzVs74cZ*_kg)Nt>+|Mcfw?|rwQ
z-M;(x{PTp*{vUonDLK)+TzvDCX`6Bn|J9klOOScHWyAUDQy$i_Z+P_W%#DimAD7Pi
zZ#&27#?5KnF%riuyV<YlT*y4Y*X`WCuXe_H-4j20kDzVXntu0NwhS`^gD5-BrbIzy
za(-?BWW(0n(1Ur8%|NHCFFWBV6egA={^DQ*la84s%Zaqx$5^>o*c`hT&yem)@x0X;
z@a4Ysl-$U&J=3o`PCGI4`@KDa$HPB-`Th3(WcJ9#-z;{DuV~Iu*=1R?ZBN|el(0DU
z@DE3CoI5$awBhF0FXj<z1otg6mtx5al)N1z$MPiC>EI_<>GlItnN&+ZT##T-)P3ow
zrE|bLR`~?OmPck%VX`;$*7VL}{QjZM%XP|y$T{yfzPMT@n9b)@wJ#`wa|>U#T!2rM
zvKiN8mu=T}Fx>YHXFMi+F)elO%8SRJpHuHO*1fW9tBUff+v;z^BSNOD{LfKgThVaC
z=&|>e=$Acu@dha`ukT)--~Z;{$IOpEA2$B|c>V8PCEW*B=O?=)7&o0$ns)v<=LONz
z`5f!@@4vtHs8lrEHbAzw#$B-X$Mv!|bM;ii|BG%gO5}}xr_!%i^r^(Ex$5j(`9zji
zN43iYHSM+qakw^K-|b-FyMK?e<fSAh*0Y~W?B?p7?%n!gQ_YRsvg*x0jU=zNOz4{?
z-+L_ij+^Fb&t%q`r^(kYZg_6IIq&^EvF+dMH+>N<)PE>!qF!R}C!@+Ex#_0hKPRjH
zy1o>l7?H3`v!Cgv`PNOUxiM`X(<Y9o^A8=FW|{27xaP)I-EaMu?(L}BJ7oj=yO%44
zZ?)W8)$gc0apHoK4AJ!)kE^U=TK2Pj&Wg4my;|qze?(l}xc;jhw(|DAy;Qs<?#2Cs
z6W_bN$_cML@@vJ@f?j^#G6t<*m%21|9LsuWR&wk2=a8@8m8G=mpPfDb@ayruG>>aV
zy3$_~<JUfD{2uUp>D+pWHT_9C`Uwp$1Q#_X=)B4~pruf{+N9q(>&w-PW)qJr4AwgA
zy6t<83AaYml%R5n?m0c6`{E-`FHO_A>nMAJv)e87<lWQXDtEov?)S?3+uX1vZv<u>
z<~`Hb)x)dR_w=uT^n<k1H74eK%GWclHoA$JXq!0MuX@>@_wLCFo&};l$szr_U7s(#
z==18>0bkae>sfy;K5F=<?bzeY<^91sm)OtvHTCMnCC@q9-$&#-&3XUi>yv1y{=W+K
zcGv2cWqjK#GTq`IJ8B!f$f9b`Ts8&<LqP@xMeNhM1(hWk`FZh~d1?821(m(wuk&x4
z3H*Pzzsa@XB%8?2Oal|%XSr`Dtz*2T(qO&CS%70o$+nv>SSJ-N7X5j@+&xG?+VeKQ
zrtiJqA9r6q*j>5wiH*=tnNPaf*?ToVoqW>JSsLe&VB;I9RkZfTstG>%EOIVfcEL*h
zjhtscxP@7EXC433Rd{rt<E%*{vC|7)r93>pNiA}@j$oI&rjC$?>X8`dq8Xx|QxBym
zZQ3+p*2*Zs`k)Pa9AtlncbJ}b5UmX9G~o=<aa}oeqG#02hrGYTLNc4`pW0q_eYkmr
z(Y1rlbHcoG81rww?|%H?MTSz?5=D)j_wMZ5!>!<d#eAW8@cENp)0PXj{TK51-Lkea
z{-VHq(NoK>?>G^jWII!3LsIqy#j54nx<R5svuCZUV3yQb*Cq3~jc@&t=AREsEGFuP
zJE*Ug<qujQ%_JN1CV(Y<@Aa2wx=u|!*3()z&Ei*^g2LfPN~bI4wYYvMePtPSzHr@~
zR1rfiOUaD4w*_S^cC{vF+*mvPu?|<znfMIP7@Kc8d|^t@SN`BXv`A(0)MBrubt&ie
zZJ)HaCHvi6zKYq#wm)T6#WJH*8;-R4Dz*7Nlj)U6zQ^G2uqx8uVP?_Xt{0rS@3#8K
zdsejF+xP9o>?-Ny<?E;Yn<(|jDm`6*b6#?$*T$z(uccN8<Tu>C;dX$HxpU>g{XV%a
zkxou$Jw=+UR*3}sE)Wa%5|3Pb|LH~dpMf1m*D8LFeb2mkzjV<2M8l00hd-NYR4s37
z6<r_nc1ghTty~)xL_{vAREodc%s6jLM`hL%j{_OUezXNmxlj=C>BqduDX)BztE)v7
z&I&c;Zqd8?vSy!KmloHCea~gxZaj|B2yL7-e~(>VbIyq$l7DYVtmt4^>~L+1Z;qpK
zlW3y6($UioZsaq?J<&{(x&C72tFKBkgA^WY?77a<*b=H5omk?L*Yb@`)?iC&Lc+q#
zdT!Tf9UC9+OKUim-VhO$-#e%D?-Qk6FM3RE-!k3%GA&oqL)7N9WZ$NLH{|Bae)n+-
zTCXk4|2pZog|_9Aw(P%mH?Pu9I`Yf5qD14G$;sktHYY`5Vs!2I?%l&Py}s7sf5kqT
zS!th|r`a+;tM%Q?_*vnkz5bH9Joox+*z4Oa%6o0+%ogEwwhy@C9&^Ggwmn*}^Z9P^
zLe~#37BaHE`L%zpk;kEL-wKVMJ?0Pn-6NuBb(c9q{(J75Ye$QhPt0jgJbrieg!Ptt
z+c-9t8E3qD#~?jp=c+KDP}QlTrYlvgTXdLY@;2sgmq`@hbzfNR_;KRY$4l;BF)uaN
z$-Z#q8%I`$<a(YtGfi3Mi!QTGRb^^!wyiMu>Qj)(`p~06_k8AQ#~UYiI6l|R3-e^u
z`fl=A^pJX-a*z<y$s}!|J7-c<wmjKXmSp#-dcoD6(ucLnruwHH^V%Gf7<w)B?p6ja
zfi3gireBluWm+CPb(fBt>qNikxJC1;ri;JN`}g<D!(UyeR<hk$eT*SXwb15Ewdld?
zTWjl2e!Tg!xou8OX5`yt#xbqm%4LoDohmNuy|>7+`%r;W``JemZ61nDoaCd!$g{&i
zC!2R>mFLt{(_Q7&=FZR6?4|eU1%!5bbNl3Kw~4WCxIUpZTX(qzOY-&l&u_i5>dwdo
zE<df1n3>_1c%z}vVO{df_Okuk0&HgXgdWRZW-x2w;#E`cekwECwda_`Bcabr8ieQX
z&5K?qc_DDCTet6G*4CKY3;!ISZ?mjNSLH!i8}}pqz(}3G`*ZgEDm4lc%QcyOOM<O5
z<LigqS99xsis=2X{QvJ!x8eSk`<CyKncyEZ@uAbCmOUbgryaRJWyr*~?=5n?u<72)
zl59J%;0Yfql#3>mJ{EdqyFV%}Cf@Sx^V8ExuXNP@y1m%?b|Syw6pagi+P9UOO^KPA
zuN`c}$1b}0YvY3Bs%{4oL=VjmJ{6#u>-MahN9WnYe;vE$YAK5CIB3}|a9<<wL>%W<
zMZuddmuNRH>0l1Z&SLmvc}_Z@O78Zl1BN@J8d?5q2s!AM{?d_C=<DU@iv33xKFcoE
z5a^%%ELh|}V@)sHNx2hG&r3T@R>{kjbMkqvb^Hi}%&Xod`VB3Ax9;~2o-7#Xy;*{F
z&uptdzaJUd?2g!1TV7e$w)fY(<gJ26Q-qHCzC3N{a7N?mlzka{rpZU|v%P%i{mh4L
z+spVa`QBzs{A^}carSw)xx~c1=ezx8Y2T{VG?RRHvvcv)hGm!SwpM3cxs@})sX8lf
z`-FVm;?Imf7hNyi&fKuu*vI7jZo|Gk{(KeEGLut-68Zd&<XK7>?w;P;`}a>2|1a}@
zPXsUjun$1l<!|sMaoJ>M28KKiocFmDrKYFm#V2Q^CTD}!EKLo)-FF*&Cp*t3{!M|N
z1x#D`*<=>n%;{dRQzTNEcS8in7K=?YmwGgcTmSpb=Ng-{e&QCUuzL&7-QiEqd+_i5
z_V~}=7dfRG)*lbF4CFTP{;@apD&Obuqe?p)qwmV~-gqaoCu+|h)8*ImH{4UKaab){
zaA)zAT<22{CYX8#N#Avdymqg$IhAu!=GMXkQ!e#cE}ZH+>E9W-T((<$N!qK_J0&Cb
zXZEhU&=-Gaqi7cQnL}2$^t-&IpPbov@SpC<d{4Q3`4L}Ry7>2(9jHB~yQ+NEHRgcr
zu>ps_`_KI$E+>4dcCWCQ)>~C}wY6=$P1{c_yvDZgURIy$q=Ge$ik~jAoZkFS_r$-V
zqN$GMQC1fhl&;B~9^ifUj?Aa)8!kra2`^BO5LFQAG2`mX)m6F0!QubZ*P>BWbX~^G
z+oJckSQJL*?3u9V$)Oa5XUnq=R);K>xU<IGM15t>q3wd&uLS@7ihQE1Wy7}eB-gcL
z?r&%JNh(Y1^4R`D$KZX5^V{_^rno2dy119#k$HId?`#2sg8W@#&Q;nISBmVi>ALsE
zo}+g=pVYUOBmB;OCY9@XjM^1q*p4`hD%mR(@E+MJVL6MTKxFFGOYPVA)a)-VwB+z^
z`K`1jUFhB1=T3(mJv`sqZAgBxcT>~impV23et&+aEMU4n@u@@guhoqf9T!u)Id|Ob
z-fcT;@$J@>4x4>v=bmHMn9a0EqbX~8Vz{#O0>x(zDo>7f-`K&e^<Fo2pQ}D^&EHG1
z`#Rg_Uc2e}aLf9#r>^4bFRJc(WBrT$qO9`vdY9K~XBswL@;xjPe`r^Q{+j9y=WNn0
z9N)<zWWA{V3YT*2sy1Q4^HUy*S9pA$qt)SNI5REXW_QJ<m0RuE;&zMv=gr@0F8VK|
z(dpgin59#k{{K&2Zq&Q6X<6pi5Vm*cHNIEIN32gflk+z6?k=xD(P_*}zfDQuXyy_-
zz~7xQ=l8O`X6$|@oA&t?P7tu`)s<6A|5^N(G3vtV>vkO5nePgzwh1)N_qF1`ymQ{M
z!!Ksp961<w;l$(3RkJ+LM5(ZGYm00Q3boj%GdrT}<u{!_ulF6l`@uej-|FTLPo=6I
zd8;pG-H^C8G2lXq_IIBuoy?N+$IcphS1&D*%eDD_jd|0%B9-L5%cQG}R<v8i`(zc?
zzO}h+`nh}F9H-+`&b@n7QGVX-P}8+C-|pCrYHPk;<+`*fXGTEkOgHf@=eYmq-O(|y
z=5V?3_webb%2OZ4qvq+a)*qtESQ!{9aE~b$r4|(Bm!uYhmr;l3f?BKp*2O!nVNOZk
zc1h%S$^qt>>u;M(^8|i7w=WRLc$u<!vS;s-TT(~={eHKiJkoC$zp;RZSbzC>+wZT$
zbBg~zd;Dc@hlA9Nd&d;kda%5Zj83t!I`Ad*!=>tj)3mHJH`+&hd-Zg6{LOC+Z}@s9
z>9pxjSoNmk`wZ5)FMC{8D{~)K*}k*QAmz~v&0NXpL6Lc_la75pRsJkR&FA6#ljSqR
z1SNj`pAbDUOi6Nkd&rwr>%UFm+?jr7gKn1R4YM2nD))0u-@krZ{hf99&)T%jKegyy
zdW^J&BJ0740*g0!CGeY-yg%e2+aGgGu4-49SlXM{j4F={-}Jn!_4}u|O@}qF;o}tz
ztJH4{?rEa7lCKUV7YS^g;n96YN=@bW&%CWaH{7$)S)ZKubE~DpEI;YQ;<ra9OxU);
z%%o_CAzR&3=M5U?-`(xBPrH0yU{%YZ$4+(`+LAvnubd$EMKI~$R))v^bKYEF7yMwe
z_4D=@k}+bB1r_K0KBmR9_Nt}LLgBw>p8fm8a4~)jV^X84607i!$EQ!k27J(VN_%Jd
zef_+xA%-a$3X<mUeohWP%5%f!cV|x3_V?H1<-#8RP1+r6yT&}{oLikj>z^}+L*BNp
z4Pi1&5s%PO@Hf`ox1ihq)PkwYr*h0(k;vGz-|a^EYV+;gZ?$4-@2tBv`!@en>EACt
zu=t*v_@;6q_pxZE-RIADx@fXJ$W$yj=DCsmz^(gD2SqeD&3vWE(<)-d<IZ-8Wwy(+
ztkgEv{S%gdTodMVoN+0KQ2-Zf>93NdT_H2(Pyd_o$Kv;usdt|$9es6OBd%=01G)Li
z_hmDjV$=$1Tf3UxKYZzZuy^C%?n5(V=48Kb-PnKZmH&!|8{0J&IdSb4z58ir^@FQ6
zuVSpYVh=kkY_ohb@5aQ9f7w{X0s~^FZ4LkNetSikg`ZkOJ`;CIwLsg{H-?-7yOVA+
z&P=|uY4Ryk=W=`JmRPy{E)`3r@c!C&{LqJ3u0)ZG8zjH_Dd%iAI{$0E><;6|<Nc>{
zr``T1Ic@2dg>22X=eF>9bKMGjVP(VPlx%)+($au{=r~#PCExd~`k60fRy(0`LVQcu
zr;G7=;uePwnQxzc^!0b``9cTwf0XVO?ciQ@VWQuypcy<nZ+$-Ad(A<9Z5vZqZF0@B
z)hD0JU%z%Ib7Nr3Yo?;>Ggmt;k-Bl<zU2vyRaO~O-|4@(SpLaE?8BDl2h?rW?{-{!
zU-m!yUy~Ud`7Sis$MW6I+;BbGduFYm|K-5ri$5A4lC5yg^!t)M;g7|E5C7X2_szZG
zE%kMssmNRlN4GSWZtiD(E4Of_E!yxZ^Z85On|b#Vnk*HUzszx(a&+s_r%4<9+J8Nm
zSr^oMRCM-wrr+;dXIlO<eEigUyVO>$O%MDO`J!%k<rSPia>AlY?S|m&|GOU<AHN+S
zE8eYnQC4<yTlf`kU#ZJmO&WK;ivPW}A@u3S%{Q%=thiu$$!kw}TJXwznK!{(rGJKp
zUl0GgEq+t{$^&KLPYyHGKUpwA_tTu(lm#yD-W3a{o$AP6+ZQ!Ub62MJ(-*J$XB`Y>
z>agb8yD{dr(ht${*yJ!vv#RD>caK`m{lxLAd-9~aoVz9GE2<@N#fr~Tsf}`0dJx%G
zY3cRHy2f$8-ivoVwfa;3JTBLD(E7EqY~8*t|A{7y|9Z97sjFK23T;hYw@*y^AH%V3
zi~B<UQw!(hcskkp><bs;D2x@kYx(=k8Y!tAeg{v~``%r##dWXL+oq$TOpoO3r`&2P
z`nBko+v<#UOhpD66>HhnvgN8<cON^tGOT>nF4ryL?sN3^&MkN}>)ZoB<0T9CT)rB4
z<l5&|d)IF_DNjsVdFJ-&a@AOe4Zp5@T6XLA7G971NVX5UO=mVut$q;tEA-x@1q-&k
z4O;pv?G5@ct@i3;+i$QjFw_g<yx*s&G%vmcGQGby!aM)Ag}}bw;RTnQR~$%_uh!&Q
z;;`MfJK?ff#@%;Jan1=Ur_!`1YI&L(cK!Q4SJ5?c)7=HL55E$Kd{Q8H-)1KJlfzd}
z?@ym@Bz~&vrmNzV$xB7j{N|b4-0!$4{4L{C!=4LgubudMY@&L<oV{vyuR?yy)h>}o
zvsaV^AGUnNvR-}ir5CeOB5&@x)}f=kDQ`<*i}q64@*r*NnMX`_hwi*`X501Ni#s=%
zy_>S?ncn>){x4e!qr(6GOP?THAH6ed&#V30%vM||*uL^f>6Cib`E!eUjvn20>Gh6j
zuXjzHYG9TZ7PHp)_OzvYM9qS(W_)dUdp(S6`r4(lC!LR4)iZnRTqdmr1-esD<Zbz>
z<TLGc*v@(F!q;5cG`2B)>IvV=n|Iq|D_g~hB%_@HOV!d-4vO7&t9jHm@4+cgtC<x)
z9Kt+(R&SDiX?D|eg?5jI(cN9kN=?>xdqtVIKc4;}E-F1tbEd6w(9WMN2a1b|KJ5!V
z(&+9ub=GR8Zyx1&UQEtc*fg2KlT2$0OSmUqD{f@J<DJ#8N@1zll00qog9elGQ$i=4
z+k42!>ED!4(I-E33sR0NKGzZtecIg87+3c<d$sJ1$D%<@4KEV=jxC+H&QbclX~neg
z(}zzag+JWOB$mHb=-&k6+m%!Nq;5Pkk9qgV$h@gJz0Aj`P`ju~>f+1(f1i?L6|deD
zd>c2fzUueKPoL^^4(cASh>MMxd%u67!83`&{N2;v+v#08*%0LKdF}DF1fi>ICs`hF
zW1hR?tn1?w+8%4S-`d+`qj9dck)!d281o0kV=_l;Qm%(;XMB2dbF<3acRTC7ydD&@
zS)OZ}_R^3|;J?Yi0-eBHGB-Ke*hSaBPfBE&qT?#Z|FutJ564E$rcc&;Q#mJ^AKH-^
zuW%sKDyrwlgY5j(lW%SKpnRS6$;_8qKFkUUJJT;)X)?1!Yk~5+#?-5~&fYw<CF#MX
z25uJ-?v>~BctYa4vKwD@>^mGZ<!98B)$^7LX-z$PWKToYiS^nWkKEe&D>GmkS7*F~
z=9eR~Uq9Hq$zs0M$ms3!Sd+8<;G?Tq>$kLurTl&*Ui<UZdi}qG9e1Ce3XTr^oVJ+v
z+6<4Mit8>u7M;5+^TWX%BF%1F)QxZ5{t~?QxYc9hRbJNbA|8}So#QunBO~mTt57HI
zQQrC`&hC-%gM)XDy^z-GYkRlQ#lJPfA>ZxJCf+ZiFV<d>?%wuZC2_mP#^)~Oy)IL9
zN?2#TYm#-^(x}JCp8e^zq-WleUw=I}S%+ud<(adijg2=h@WK(JJ5o>N>x|+=B4;R8
znI2aEUGVYOqqj-B@{iVA?zgD_|BR#Ab4$#kr;5I19V`knc9c4aPH}Tia5+3tE9bIA
z#`ertmUpXoM5kuXa$8X&c&EKI#@6kin2n{3XGVEV$eI5S!sh&*e<An%!;^8sdTVF!
ztoAyapUFA(=%F7Dmzn!Af=_apSgTsBs$jN0CUDYD-te7N-kK8$EG#!d+eGJ2i}?Gz
zj_*sL#f*-oMY3D(PHho1v-@i!yi9uGiUXI}4NIqOSvSYlH|WfQqVs7N?)U3v97;S^
zCgi9f<apO~)6Lg>bCs1-x9t4grhLbud)37!j+5lNB&3d2TuyK(y<h(Qxuf;NYkgYv
z$MqC=4JSRF`bWv;)HJp!2SqxnCW~KUIZ-&NC3F4%cQF^Pm&RCsIV@<-w(N<brtmk}
z*1t16r-tV$PD;42>(cdo&+0=2=AJ%x_U`HKkFranYjs639&CwZ(=ER$dCSvh@rsLl
z!ul-Csw)nEm~Ez*ApNDxMyR4E+QOk(xVFA@!RaNNjQQg?b!~Wih(W|4`S`a>doRhV
zTsY6p$y^*A?AczJnt5wx(TY?4xt@Oh^7GVQzM3Z&shtrx*ZEMp_yeBaM20V(`U(?{
zG(CS=waz_|ch2LdJQdLoU%WW9&F53f)J<Z|4RW`0rEbW7J{aUT*|+GxU+Y<E^(t|~
z-LsCIm9JI(zTvxg=(PMDAw2mtGv74LsanGB$yGLOh4qZ+zCW=>nZ^e4t7MAO9A};X
z)0lJT_j85EJ8xZj_v_3qb5}=$+$GJ^9t+;rme|>Ldw-Ve{vA`9@-k9Sl;l|KbQje9
zbJb=3JO0w1jW6di3obdJdGGy)E5%!7&%6Kr`~Qu{|M&TN6XG7t4mh{{@0yEK&up(X
z|LeWV>3+lxu}?Ce{>yOcH@?%FaP%af?ta4vOJ1>aXFq-_U2gli)@JJSD>E%;ty)~v
zU@Gf->G-J}mO6Gzo}Y8qZ4^}EFA?wIlKjFoqgChb{7vF-mY%6qpTl+{+<yLr@AIqs
zp8ek~UHko8t@X$Mhh{!J^Ht!BVb!&Vhd#{r;=Ci;Z}#n=?)t^Y|GOUG49kqWu<56%
zeObDpw!>ERy`by=`(@l>Wnfq+fOExLQE4$~fh2gy9X2Sj;RgH31|6LyyWEYem+qSI
z&SG)A<`6B>=HR{MY>N`>q^Rq>pWe@X=qeuVw}?G@`ooxWb0qolPh4(4zJGdt<<TXH
zr_D_#PkV21x%^40_iE<oeHwX_r9UmWHTl`^W>x*X_&+{j>~8lA7pttiX)L@dH$iq|
zkD2GD%c~SqcfQV99vLZgZ;My7)6$S>QR|j`RGKQ(6#C9}%F3I4Wrwcq+2mQV)MwA;
zHJRlx8~**gQnXY3%7jpZs26_I!ZZcH9(^8k(Ee(5n(w<fxt+FCZs%=Jo^^HUtDM_6
z7cB1R-YzR%>L<1E+sEK$MecpQO79sI^==+^WURCNd7z|1SX{<5ckze#g8zP3725MB
zx4b{GD&p_whoL_|9ADjTe}7MX?R0@1hc0=U>bk7vbxF+$`6T#G{?K%lh0j#9UCy$)
zrpAVOz1xxJbvabjSZ(#JsDkA82d+f_h?ib%Zn@HA>zlp<hnsZjRb!&^ql{0?Tywy)
z$p6K}qH58#D=Hs~Iq5v!`u)i@?IWwNF0gl&=-!*=llC%OO|mLrdAE#E%$6&1UH)B%
zmq&$We#qY_@zW$|zRJ`E$1F4)?npcFoSNjFciPC<=S|W4{nr1(|2&)ADYI&4*}~^X
zN^Xa(_IGe<X0SEv??3!x@1&d#MpLm9DgrW__Q*BvVm#8Oe^V+TE?+E|)qR!f>Wfzv
ztN&6KsC^rAvnemca8-lPg|z6))}O3J+vcw1YCO<YVE)&pi^s*yfA0;y%u5yNivNSv
z_zNFj6&5t9G?-cQEXs3D<pRxurYNfqrLtG@)S?;`HH9o)v-iHaa_NSYM6{@=shRij
zIqpSY+V&h0JT?90tGSG|g^7%{3yv&ZXP)BM{rs+LMfZ|)akce1I}9(BoZ6sbpnF4t
zE6Yocqjt)_dy6yQ%)9?rJ6vxE!<y9HFO(X^xMsdidHd<R>WW`dwjSx6=EoA2T2JfI
zTDHjPi|FI%C6Ckn&xC#qnpfkwrpsLHRhjmLAN*d<$_JDVBosfYUwFxUw&#<$=T@>7
zGx9jh^@L)We>>Ugw+J1WT5NazklDhm7ejZ7uKLw;dU4kOc&V$I89gs0f1Nnz!GHXM
zBm1xG_G^P3pYB^+&Bo_6`!mm;l)^LDZ5bC|iJHqh<;?L{NsrPzc<dBes_r~X>$E$6
zMt)PHc#h<R;~w27#qU2-<oa{E>6N$c+O+cuEid<6X<WN!%9h0IDmyfFi^F0T@BY!J
z+4{tH(<Z;@RgUT(J}OOD{&QjD&wgdb>Bpa5vfSn3p8m<Q+3VoHtv=Tx+pLPd6d3lu
z*AY^v3;hvY@a@z(HC>msj-Lkv?&P<a9C%-K*mUFCv@f6EgsU}KdR&;UIl=N)I`8&>
zd{W1RwrPD=xU~LyEf+@&^UCc%gxPlZ$Mz<zJ+S+b!_w$xW$(5yvFmG(xLn$H)Fp{c
z{~?Pv<HAZ;^CQYWd<Gps+mCZBSZXnG*6v2mXOG$f-#qR+8R0Uu*ka0M{qQSt{63TT
zvTu2cWvCpk^lZxG{=7ZpQuMdAytB1dye_z%^mV&-t=fskxt|N?ZLACFto5F|{6BAH
zCQrpx>*wbfUc9yIYvhyQ(UehJz%I>EJFh1_k~zxtsP_z$`4g*U(v&90y)1iv`YJ!y
zqZR}G%11s|?$18(S@6*GED4i+m3Q1Pf9~X5*cbWh%gpT+Uk<*s%*$VQC*hfo@yb1_
zk8~PObH4ks<2z&GhbMu3W|z<S+NkmsO!l;V^Sw~%+q#`crTQEm-8`HABc_JueB}GT
z3yO?1_;%-W+A_?r*`83q+sY=GzN_)!f4g~$xK?JBPI0<eRpe)ICT*E*`=wr1-Le(h
z_r50U$SGQg{;{`sdFJfdhlggaD^2CO_GpC><B7R{c^D5HufM+Ru1G;cY6Sa@7vhTk
z2b6ML(uxvh%UybKAVgNcX-f3{woTHHUL7wvqQ;!*u+QpR<c)c50_|u2{=V};d*kwN
z%ReL?{ovyD_2tBDf$(2bbUzrx@!RydZ$BMeA;y=lEN!{+bMf;7PyaIppo~{Dt^N8W
zn3;h=gM)!V9{XG@=r)C<(#)I`y@JZMq2Aed3_v|4AL*{#U1gI+syK2ME)n6<WSQlh
z7};}8>b=%fRppbjTQ2>-H}OgMjcIbX_Ewno=f}-=OaJio+vDwz+^($95u0zRr7qR@
zjLWWMja@=v<UIBCg0;KVmA|pGPk%1{{=vJ353Fm$4t(qgD%btl=zLAhGr5F2^y-&&
z<`JO^xBR5peKg<B5RSU3BAK%7eyQ8_jJGP5U;Ivde6r!Kl%iqMG}Tp$4We2TnmOIu
zx2~QN@IA+LUe4Jo>%=GZ_iZ&hF*AAbb-CEk?RzFUC2sAx5Oh}M^P-F2c0Dy$`Q@@G
zI!$NR$!q2gU3W8nD2QC=-?nH{N$|{Tk}?I>&-l0xM_c)++Lb!JZH(N}z3q(OR?mkQ
z3?d&+^wqt1#kP;vM>Xw7M^HpLYxz^&TJvi&-*T;4xpRT$uL$iMp8G6H-DJewSAOpf
zo^$fA)1fo>?3~Xptl)RrxtirgIoo{ED`%8mv@Q7Rmz3?OWUXZJs8e1^K!(?Cwz|{h
zy^orgUsaH?)V`s}n}7ZN_Y<cVd|{m=zD8Ya%G>gH|I=0Cg5_=oxX)v6H{i1mEt0Ha
zTJQYHQFd18qI*kR8~eAuv0N5n-FWWnb8Qc9+m7VPpLBofXik4B_~h2?qdnUd=d9E`
zcjo=3w4k)&t|uZ*t(s3a=j*td-1~o2>RfU+v%;m?AeH~de?lG!rT*o4S}t?8?ZL(D
zKH-YAs;Pfl88&j9I(}JIBL7^wQ%Cu{-{(ujoAdIv=&L5}iM$bePU2$P2Rq5K3H$eU
zbu|jB$R+P@G>H(8J1Vp6px(L9<!MVcuC(_H*Qq*kHKfmWw&g~qjp17ov`pNjckeT{
zeRlFdffQ4)e}HtZZU%E#m_jVi`E>7@$~XA3_ZM2)TzI&k`sBjx4_|FzR2Hk;v~kmo
z={FW{xP5K;YOUE<mpUHX?9ew+HuHqmf~6+s61I6}YRF2dUs!f~rbX~!@0yYo727gj
zykcoM#Jr|HBl?%yw4C(6=GmX-Ynp@<J>EEdw~jUMmdIzD&Tj8kNk0Bh^>oLF`b#ls
z#?LMFrhGlgJ;k?t;=KJA^ZaI5tc;l!*S?Wotn|HsPK%Plfz#pNQn}VEv~JmR-Kkf)
z{zi4TclAV_^&d_O8}8#;J@L!sU;{g*(_i<`+C5W!KLcuh)XH*_xy;MJ5MzY%D5K)a
z+@$=R)QXa##N?8E(EY@3qjQUI?-2aAF1~SIy4Opki__+AFZ93uF*feiwL+VX#V>nT
zP1F>cRIrRgY=O?onSZ|9aW{yp6p!9{WTxM96Jc+ahS)dnnvcF?x|uv(T>sxqD`7={
zll-}EHYbk+6qKIvyQCoV`P#zzfZNITr%M(d$(Xb8aPzl7?)rI~RvV`0@0iBf{X@4u
z)#_lvw2uivhdWkpyx`OBwM6pqXCKzYWsz-)Rfdu$B8)9l7^OR-=NZ`YiS$S4uxSNw
z^N4w>U9=K0{C@N02BSQgJ4Mq@^t3)!ko>qJGis$av%5(`joR`V)lY6mcBE)rRXM@3
ztn2tnHvJ3N&6QZsKWTf}v;0NckAyEL{g*#jblT^S(~>zC6)q_8JgR7{)Y4PSJmXn+
z+LiBO?VQw?AOF=^2+gz)nd2UFKgH<lQmMC-SH$qOU-(_8A^LZwkIT0I;ew@oe7D^b
zzdZT);O1q=AAb}otZXVS)k(2D+^l}^@$<tEFFr8nm}keG?X0T4=Dxh&=9Q2B+8tI|
zaw=j%!lN{~U17!VH@Rv}5^N3#|Eaxl_Jx((LTc>gZ56wds<PiFTb{cAwD!|B?wOyK
ztZ!C4-^rdeh0W`8)Y%%%YnpLC)w4`gLt|%5t5Sadm_6_ce@yb-?5$3!Tl0FCp4+2l
zV8*ko@S5dx&gJTJOKmPM%(uRBqwV~R<11euTktUC$Td5YmZcR62^GC(g%9ZS9^<Sn
z-{bxwY<Jb~Z)^TPd~)~a%b&0Rt-ic@`h;$^km~QB-hBBZ|K-}&MF*>obH*<DKC>fP
z?8xQ>#~;26b=x8{EJGE`1upLkU+w52=Bqy0RX*c-spVOYJWqp%#~D^;ZMfFoc7Nl<
zZ@b^``~6#_Nn(rf#72b$Gd^#r*^>Nv@n%UA;hQri?mcy7_L<p^A@f>{4&CT$Uv{l{
zePK+7DesnTpJ!`M{J2lz+uchm(j)GrRr!{kZ!z8)5p>6B;#Nz6jP~QApHEpRExYjX
zLby#w!@@nCVjDAGJ=wd;S@d|4=NWA~e#<$RwKv#Jzo~8MyJ)(X=T@aJ>Dsxehn(+c
zoLR9lF?5EO#g00))I0N8wGKY8vVD<U_H;hy+|q@+;wJlkIq@<yT`;_B*8OEH4;0K|
zWqyTi;Su$CyWG+2+fSJ*CAGZUR1Z%RF;Z-;l0O^rZ;9Q;{uu|<=hwzCe^=K}f1(x^
zFnfbL!@vDP{kBE9(~Rb{&+oR{c<olQyoY{Ew8qp8){k{2bxt>Yb+Rc?VUp<E^_-t9
z56Bj-{#+$GPj%|;z&~aR^{#vWXkMF8^r30TGEbEy@$>F*sZLf^e*W`|#k0?%Z*NWC
z=a)S3>h$E@F6+`eclX6Uy0!W9(z~gthkQRRT5a(2-|yLx|9+`NN-VtaXqwD1=NVmZ
zdcPi>F>C8=KjRldcc=5+We`55!sZ>;8!LVxZNcHJE!+7rTdqfhPAgoY`b#{<x8+*H
z-}J!wuMz}4Tc0>QZ)JWwlkJ?pD-ZLPDav`~B{$CuF=yHLR_D&<(6?QozdKb9wY}mK
z+xuz#vJS&t=j5Lx{N>TE+xOG!k;A+GC&FC26MKJ~tuZ>Xn|<#wKeyXXm!q<!FYfjY
zRov<L(KlP*HOr)xccTUOg=||@ZNA?2+pKi8YfI!r_FZ~!leScDnzYFNn4NOD{x)(<
zYO(7@AFe)9t|^mwpfApAt0iB=(OHwjluei(zmqu@n3GpCW#RKVd^?}86@JpYKX3k?
z%9nxtmFIifnx7QJEQsIUBK4-7FME0mpF#E!Ns*1peJ7a<?bO?kFJ8MzU0AzJJ1XIo
z(h*^~4ZKBDw+J}sz2TnWs$x@=Z+5KkH2<&YhLWI_NB=a6czL<V95sKv@yTah^;c26
z#!j6!S~EXAQZ0QcEp<WA)}qP#TZiS<L#DUp-EDq+IPT)U<9fy^TxQ}z{|!0L_)he4
z{Npy|nv0{Df#r|h;6th9q0%DLG|nFDa4>c`So!7V5p73D6&vYPEkWrI1`f+yVw_a!
zU7XwWR!0ael5tl)>DXsHkFVy)jo)gP5<adnH|PI;Y0~$7{?>lJ?+*l)%`uWaajUB8
z$DbD`FK%u=yvfY_(Dv$|@4Ul)y!h*qQR!PBS22IW6Bo9Prx|&_CAZtIn|1J&h@$6q
zmme#xYu~)HM&{K+!}I@ntJchR<h`A)dqb7sM&8e;%9KZQyM7lW&YM=apyl7)f6G3E
z@@~GGA<ePZuKxTa&fmtx>y~CJRAg4(6x+jkBY3yL#BISk94S+k_}@Qz@+v<rzm_}l
zz4Od7|3X&R`lQz@OiJ#0TeRxv4&S;`SM{{S&X%HQ)jve9^hzzAS06lG_vPuTbw3*a
zcrVa66!TrD_4CSZwcWf)%(e3r6hj$<ICxfD$-jT|{NKy&f8Fut{pyYMWRq8EGt4tm
zx!ry0Hsglk&6`RaDz1O4JHl5jlBqX;{+FtNXE!%xFs2?B&)h6;W4JnO^T8{xq8{}(
zy?$78sHN$?!;IM}|IYpHJb%M9;f~bCYt`3w?ND2O<iD-xgtH<uQZBFg$7$&-<=Dt9
z!R~o^qru|Szj;>Y8LipX9`nDob)jcf)HVaBSb>KQ9XvfbSGi_n9b^xX?AA8AsPeom
z=e$eHgDT(1zq;+G9p7<YZO_+#IdPE!%lXobBh$ja-Fo{iaQDN_uPye?-I9?o^FD)=
ziO!b#_xG%fs$W!p{{ATOaCg__Gn;3&-CQD7-YOe^aB`4>^@WS_6K|XM-H8*~vB{&F
zL-ftY?+JcC%(bUn70fHxeO1z!^&#)s`czKuVD`)!-kM1~#gBtLCRu)4>>>Pn*Y|m~
zqF;hOe&_%4Z({kKwHN*ihD+<Y8Be_Nvdi<A?gpu&AB~<^9S!e%&zx{o=;d0UAEzgL
z+j{V;fYgtkCD)R}f4Kj-P~QILn$~r5b-uv8Q||dS?fiK$)4VI`ocO`b{!@Lda)q1i
z3Y>Mb4c1;ct<}0U^=?m22KSXI_bd2#*0(JBEW%Q-;Qi-HOMSnodqmZY<2IO2-~Y#_
zz5B!>UzYGMZntmV)X$f(yi_6Kd?HL@_mAsaYaAZso_onNtLu}_(f;cSWwA@{D{XFf
z-#EowXG6eVw=MO(TOM2!T)e2n@T}3ayN8mecxM`Cdi#8KXjMB>5}NIP;+r@}nxo#c
zGqS2bRe$hs2!37H9xo>nb!F<_82-4$EK7?_i`IVdJR&z!$9smb-TJ8~BKn@V{jg40
zcj*4P*?x=eerjQxw)<H3X5%1^E612mWKS>MxawrYlC_h#rl}NP72JE<;fUHvflmKv
z#*7^+3!b?CU;2p0Jh;zs(IzM31gTprvS(Jm^fGo}^k#LMqY!CPzjEh!y%$q?>pett
zqE^(m&M`Z!Aae6iy86a4_FG34qFPmdeDdt-6BU}OlzCIUB)a|h+OqXKbyC*rNWSsE
zllV+#-TKUFJ;jf=2y9y;HF3|sfKN-K3pO4J*=J~?<F_r3clC-B{K0dU>z~}{$##AB
zy`@XGXWV~~uTyYs`%(Q5=9BmuR)!ffZ1X6bx#Txz#GSR@r>AyYU^Jc6c<#JVhK-HG
z(p8Ux7oH0h`MB!!-=fO0qJOuh72INXcfXgedH<YN_&(vfqbwy~%5ERrzjoV(t&MAs
z^8HeH8(J9|@|$Vqfj#doZe-aVwIsms&fVRU%lB73jmq3|YyL*>oYsg<uhs3A#a}P5
zJa*#uhk#>SPM`11JQbj(p077gCCB--(2FM~lRH1ooVVC@9$$U=*GZ=*@9x}uM4U}J
z+HUs|g=n9g(7Em5dr$q2ZSE8Lx%EM_rPMydg{RNfSoz;~X|&5`^eUZY&8BtQk<G2_
z4WHjfzxJjFR+EhXCNP%Sc{5$MJs70AVawxpHvhNmwi5_{^R-0kRZYqHIXz;}7o}{L
z46mt7h_KcCyN2mt-_8ZqJN16E9gm%Omv@i*k2{LbxHP7HI^4O>hyAX|ewzll!pV08
zH}Y=n_|14T<#crTYyqyRde%FnE0?BaU%1TDcTQGs=IKbaS(o0J?>hJ7o##zw?fJi$
z9t)kD@y*Gycd^jIj`WfXb8aMW4A44y_)JXI1)1&!uS*i9ivyn}Xy1?b-s^p3Ma%7!
z>+8yz=G$=3J`+=A%zP%~rP;#ne37Y3SMsd;VZdR$vMZr7R#^7U!MwNC%Wh1$e^GGO
zm*|6OS6AkKmXPiXe{oo`YU+X5hUQ7_N9Wp~S<1iE|M^$8#vOmEY(fL~nrxIkUw!R_
zx2^u<n<d*e3rj`|tebEvNcmptoYfbmp3K$0_0~!6;mz<R&)&qZU-sfYpIt|Lis?ni
zLxp~M#a!y<(~LJ;Ot?HFd*htGg)h6-o-D|4TrUuOXPMs|KCew1Ew?UP(iygU+1Jh~
z*SBo+@!9eJ_rx6S$o=8D(XSHze~-F+*(GelwzneH$|a|xPH2bizVEuk|LLj)<ujMR
zdB(JJ@3pM$QyAUf#K!DyOJD9`yjc3yy>ARRPQU;2tH*ESbv-k)ur2#u^B(>4+0|V1
zvwz|1FM79U?v3%C{OeY$!)AHqnvE^)8)aAwqxbLNd3njz=Wm3{nWwA!-rjbaGFNix
zt(=Q8TLRdg>v_)B-=((p_37OyC8f=I$8Vk6m$@K1sy{qw)vokp{`3IOBJOX_U;pjj
zne<=z_rhHj9}Z2e@F}*ejmcmN56iz@o=_sqnHrqTY%44^^?93s{5OLQ`GMseZ#eRH
zJ&aX+ydwEWm&(+FjrmKS{(S4UJ*OkAQY?42w&nLtx2inS-{qf8H2K@lI&%a6wW-e|
z|15KKpZ26pV?D>auGZT+ZF-NVoXWk@9L3xA_B&_M-+i2kzy5MM+<#wvd~4S`&aN*F
zo_ES_AK&Y?_#4^^r2DbavieL644^}9rLd3Elq9AXg9d1V?`PjO5UBeeU${l&w&J%-
z`*bfjMsjPXC~vUg*_4p-`%Q+$qzjs{hi?4eH+gD`q2}w;UldgC_P^i#-tYQ{(tkg6
zXP@K}P5c(KxM<VFjO8B^T(%y2qc`8>`iH>Td#Ap=b@1+!Z?-zuIOb2>(j*nX;d0vH
z!Uq94i&ku`Vs^clbN5<OV8b1WTv?8#TZH|xTmwrgE|=I`+-4FM?jiE1x8SwkwBrvf
z<NMd;<uA!{6wq0;;uxEi7K`Z9dy1B)MJ9=C;=gczx!{LMyvk4QQv0ku`zBfBFYUgZ
z@a?qH=FoJLqTQh<jlSh2cUYgYF#VOB_S-f%sd;AD-Fxx&wzf9MR)5sI`?@=3?e=&7
zcvAk^)O&sYAoulR@0$q^<fg@VCk16}VPy{bDrE59;_Pj|>7F)Hd!>)Q6qv}JI`QC>
zNnKG<VoocnUOalsRj%h*R{L)5`P>MZ*C&p@pV4doe+v7K5}x=ihe|}}z7(ksFZ}21
zJ@re?Wtq^W**=#vwk%oXCC$@2;S}p!>-g}W<|UEG!p%!W5A&MXPCr(>^G%xHvdMa$
z;V&&)yTe$|?6cJW8~1JZnH`36Zfy7@Ys~v_-rI?*g?0D3eVuf2|Hs;Saz)?7RQ{=Z
z*f{QEd~vrmH<PQo=9v8f|La*D@3*|;vcKYUc(<PV!pAAva!VVZnnnEZ56!kuOV?{$
zui*4Q*k5z!`u*pmN+xNEeE1!(B>VvX_7@Rzo@!Q2<=NylsVhAsbVfmk{%zinN5^0A
zqYggg$vCP!U|?VfXJlZ|#F5NWi%a5j@)J{1Q{r>;Q%ZAEL8;Dm!a=_y20SkBe{y-t
zWbnJp`F=pW;0^CW4U>0y3knzAxH)P6@wMB2m`LsQITn}Y_u$T@C7~sJNm@I(Di-O)
zC8?P`dsz59xUP6vu($ribq^%flBe08o2SV+wfIN(F`I)W-8?qeBUnOAk1@o{W+`9S
z=u+UmeaX@2&c<U)54Q;z*>bPB$^O+?#Xoj&5MQoq+uJr4DSLBEtpj1TnzO8*FUi=T
z_F&V0gCA8-xqZIbZmQXE<-B0rJ%vdzJTLx;Z&kOEt6SN{^Lv}wmXL~wuYVV`Z|LXx
z#%|5O_}szpE5<^5X4#_#6C1Pg6;N)R%z|^wv@|a>uec;J2XuHuZg61sZ3mvZ@9PDg
z9OU!fvxPrd!bsvRTXRm2ZgO*JOSgYt|IPAeD(Rd{|JQ!H>HFC1`=iZE-v3saYtr~W
zKEM8KxSG4S#s4K2H)-<x;<;z8rC(S#S8oyLogL3!oL!f)BQ9odV`=9H$&-;6b{s!t
zy7fUr;MKs8itxi}!CUTB-N`v{rS~(>si@;!y_-c`o6lZ++}q!~(K>+TwZ^JD>kLE>
z2|d~+JhQtoPTG6Ts#U)|e;z0l$<%S!?VHUWuC$J)<FClG_Yb-^&u~>(9<Xduj0cDK
zL5JLV$`@xYEs)bn7VKfYzToYOv<9>Cs83PHbj3e!|G4G(>po4V8m&X~Ue14L)T#cQ
z@$SjFC6~8V7>R{ljg4i#GFxrtyg6_BlXqlTcu5~k&GL|*&+;QAYNg|>%4Z_`_BWUN
zT$JVf{8hN-$?>iaN{hCp&sp4XO!~BEO}D7gE1h`<TNf<n+aGo4>dDr28R<6uhsujD
z*#0p7J8xe{eoXY&)K?2wzB@isY_6{Hc)an>%U1s^=V|5Njz2DONL;f}sI)4b{m1Db
zzsi0lJFdS0uM|vVyK4?hz1FRI5M)?#*n2{C$RV!V%1?AR>aafj^uQ-zm2KOpZ5?7Z
z*YfluJ^d0F)n*GnEuV7GDpvB*eIxbyLoVGB_q8Q^1O$6$i~V<bY`Wn4x%uTM7Oz<(
zE2Vtn^UZ_J9sx#c?tEc=dg`r{?WT;N;C7ylnK6kOIT2Z!UB9Zfyt&KzweI}9_1OZw
zZi(pQ^Bw2rO;KcGU^tIEt(7Ggmn5b`Zt7baa=Yucfk5r|aG#s(w*_XWEc7;95^&2-
zWZTjUHX=>}QJFd2TU8ZL?)+1GeB)e;+e>w?JUD&EBfalj&vU-In*U#nt3#N!9)HvA
zA{(;ug6M~XMS;m>^Ys^7|HycAa^)(%g8eaj&%XG`Fk9-OcGY6XM{?51(YJUQE2UkR
z8tWQ_l`SkjA+h3`lz2mSE))N$40+eZ=jZ=n;<>x8deb?MFJImkaJ5ek-Np1SQP@?;
zTflAls-)_Nkq<%_oygk2ATM*UBr$F3p3HeWD&&0gt<)!YK6Pt%zFqKXf}^J1Ij;UQ
z$<0bLGM8qgGS2=J_;Z8malO_zwl&65-5f8t-kH>V5ii^j+wk>`jU}h%yqf}^96bX3
zMYXC^;>xmZdTKZhCcc|!9jLy2jac%em_-IclTFTQr(4Zlb7{~0oXLy={Y<$H=bwvr
z#_gGxc1hE!onPxpg3hbJTdWI~>1-*HoxJDfZi~081Mf9?%2n`BwSHpc`8n|Rld#7}
zbv`--P7V2e=TpG*3YE%QqiY6xAH_@dZrmR%m9g;4n$0e}=~o_{{dK4!VC6>(`!i?P
z^}a4pvf}?cF}9}Te{a%E`8ixOd}=ObyePc>vSs(F|MyC~+8L9y&Z)i(Ia;}R|C^7~
z-}<t@xtufo=;3!gT0Xanbk+Ym8}5w%`TU>p_arYflO|^=QK@Mr;$E|4W^Mm_Ct|%~
z+M1_c#$x>J%PTK#_wuNkSk*k^-S*W<)0bUDy9m;eJ@Tn8BLhPW69WT|c12}kaV}^*
zz(m9R!wLee<#k6xWph>=o|4g=x@z6pD+i-R6q6KOdl?TZYX9FSk$n8_E7pT|Yv149
z{HcuLSjdqVs>uu3(`}i|k14t5`YNPUehxogJK?nLk?zmirYq{`SCrq1X=H!FAsE!y
zzsxWBA%pDS3yl7Ze|I*16Wwx<x$#TtlJ>`4%k%$9v1fkJ4u6$)*=?sl&-AL;t!pRv
zy_~(~ncC}3k7e&vN<`RqwCFbfOt3%Jm&VkRvs$t8jpV(z4}{e2@9_zoagS@}GI{Gu
z^X}(;Wt#VO%dIkd*+l#IUk>EFS}j%{d`&Znaq)GHg*qEo{GU2kDdu`*WAN3wu;;R0
zj9YJZ=snu_IWW)mV*QU>U!J^L@zL5<!#B2Q$<Z5pt3C#qUak-2pRnj=t?fjnu9PK5
zB1OJE5l5{q7#J8Bm_P&r1A_u;ty+?rTac4jl3J`EAD@|*SrQ+wS5V1}HYM=2JN3Fe
zD+7Zv9|MC5F8#>`1#rXk3M%i0zs|dDCi3t6a*NVBk1S!u>A45yEOU6hZ0+`K+}lK=
zFS51hTr?B!67tYm`|wxeH>v7PvT-Ti8-+_)zok1Sc(*_Q_3^{wk8*#?KK|)%zHXBq
zw7I$P;F5>I=dK9MyB2Ae&VKx*;?3s3P<@g4XL)7h<^FO^FJ{Z1u}($gO<U(Gy^DN2
zr%%m$cfWq&ua74g>uUIuGiMxd4Gq^a-ZQDiCp464>E&Z4U4dMCj+ipfoHDggYZlAI
z$SX1D6fPG?p7D~dyHpUkq;2Zf6Fiq!p8L?bus5T2?}MhjNs$MyNGxsnpc%7l`g{Fz
zFJD~!`QrJ<+tZzyemt*PmU&XueC^v{)9jqYSraUU7cHucy=*2i$5F(!I_B9TO$nQ4
zQ_Z*-E1XWm9b6V;wByIu>GRLIPyh1vviWm^h-<5UO@7*TYE8;&#$`<trb<rVSbO4%
z&i(e9d72eJ1mg3ABJ^U@W)$XxKRhTYvv%n>|Jg|vXI39O@c8((gJ;_hYyak8o*Zk;
zyJ=HUywk6bi)H4l^A&YIp(;~(GRt+_A6~uZG0gwkw<IPk-8*Sb*zx=il@(qW<dZJD
zo_%{w_f6AdiQdI_78mzTT{yRTN1|7<{sDojhc;jT;Aef>|6IaN;VRoZeQN~U!nVHF
zyz)n&_SBRkeTxo#dw<h&%lk)xEe~|+zr1*{`$g7#l@^gTX+r$2=LF9i|Jd+`E9^;^
zz_**zn&($0Z|Y3gCsXr&+NLX^i$AUF@Xj?-G!S1b^=$K-7O8J>v069otM#ePd}f)}
z%_zjb>4C7-{k$_#shf?Oy`J^FN#y@IPp9FZU0rn%PyD_dm69+2RJ}Bh>I8^B{qW}Q
zkFUixG9@=>yqe{CUm-VnyHnN2cQ;>u<ggXd5#N<o8N+eV?)K%$5$Qe|-}H6<?)*G$
z(}UnkRy)jB|K5{+Ov5g-Cw02TzK65?cRWaA{HRcJRKfGt%6l)@&7SsKsm$8+lFF)e
z^5NfFCdH&g<v-nAl60TdZ*87h)AMPKySxjFURfPE(DSe};}mCbA(Q2|b(XHmNAnBj
zx2tGWvc^QLy~BR<%hB4Ft#hoSmISAqxH|cF*UM*SGT)4If1XfpG^{H)et%;0{k+{`
z`O+DS*B+AE{%516<Lvcolhu{~r-xWK<S)L(ccj)u@%_ZidEXMMFFd;4{QST7y6Un^
z7jl|)?F^roY;15-E}hABhl7EQU8vW(%gDtwHLG!(h3k%1Ud!y7^F3QjxgAYQJ(75)
zyOw;Y=}upy-EOAGF5JJ`^!C9|>xADYRJJ#JUtyPVlD@s}T#ED8MRP)$%64!aod21r
zuyfzHc?)*uFD+X+eT#5jYF)m_fhA8({~kGeM?8V~_wSRtx&JNXopEDrO|v>{;_-<}
z4IRG|iZ=(xiXHR3>*KU}S&Al8by9)Ou{e<q>Dc9u%oOL8MHRHVP5t!p-GpO-QmXgE
zX1@Nl<<Pe9Jug%@lx|rt`^(?Z-JO@ezIA$hv)4pRSurNvxGhHYqxVu36M?TX?XF*L
z@I6*ch*)C1FOfAqT(E83`t&VpxLnS~uP$s6dU98D{==dO*Q$v;#|y73tc&5Ea89)R
z_|0Fu(vQ_%mr3}<_W!t1rM=_m8NrYpZ0@DCf-hFs_o=_*b9UeN`$l^5$<slTh1usj
z+T<VI)@Yrw-FDXct=l?2u4}v!d87Hp#l5xl>q?!Xwue059g-g(W39hs>$k97yE*SA
zr#)BndV5~fEBWk^lKY#M$mP{-RXKe2>(wjY{&`$y3p2f`v$*n>dJW4T4O>rs<xgnc
z9=qsx&1hx@hGU!z49YkQ*kY9OHS8{^eBJjvc#f+0qz0FQpqv9TOB|k+I<%$m&SKCO
zU}4ggy&a<wq_A>H<3sjW*>6r(X<S+-vfF!icU*{o&dWb_HqWh>e1G`s)%Wl1;)`5T
zKYrNb^z?|&0?EUXhflN0$vs!z#xH!=M$$0e!a`2=FPAxYi}#i&$5wug(%{MR7Eit&
z_;$ZPrS8wG33YXC#ZLn!T{5{<puQz3C#{6n)i66YdxM6<l_kXore0cSyz%0)Z#$Q*
zoe=tNL!L@`M)B#FyeHk)$*NC^uJ&U(c7ti@71zw}t;}<rCaJ6y&EmW6KkbNmkLlZx
zE+Mb?9H-v}YQ#O}n&!<`GL_}f!L7#k-oCnf+y1^!Uf2F}diMi%>`hJnVjr>V!6x^Q
zd%C~g@D>P}=&ctbH7Eal!|a`BuQf6r;R(_|r5|wiE>qm$70bVdH_Y_sXr4CXe{RcR
z?u7<zXZ~MU_Drv~jag>DJGa;GmbLGD&VJsjWBt<A%tJN2V9T_%VIQ9!jWOp=Y<xFk
z5<`F3>YDcn0dvluOj;E9W0^^b@hj)`j<Ln_w`#iipVXFIr)T+L)1|WW>?YGPn36Yj
zy+5dM<ju<X`G<-Wc*;c2RcOa9oZXj~QaRhEXmQ5T)-PA=YNy_j-O#g<OFG0vZs~$s
z^A5e;q#v=-`q+nNcK`jUuYZIjG5FuFec-)1I{2Gw6UVWoORk*TBH{2gsF!`dtccQn
z@5!3m7y0nj9MTC1>3V7QFn(D@@{wk9{*domLUV0ho&W83@j5OMXYQWmvfRHqr#F|c
z>up^Agvjr2Kfl;(mazYDLG4|O+N&nKr(!R4iQ4hCyi_}vKP#ZXb)$~pBp+MpdA@-c
z1fT4B$d+Fc^{lz<kBjW-eGz}<Q_rng%sTOu-U^OTNBOqd%Qvv>zao3tOjzi;!@uNh
z+u9BNqBmA=yS~ctl;4lFl}iJ@A6=}lsBdBPe1F+zHY`1o33DekyuHkFN7-V(;&CO1
zY+I`bVih(Ea;<x7&)y8Os_oAT4XBFpYdzv(Rbig6ONlG=)HbD+22YmwGVF1lrB*rV
z@BOW%GAB(Z9_h$pNbGLE&_37IZ}SFMpLLxqXG2pyKKpb2*hdY%+yne|3v6auuY4bo
z&$I2HW=_vGwP)PvVb33|ylz~(P4c@>TlIr=YYUV2uqHg$*zAwmcrrIwe)0zk14A({
z#(6vN{HUJ{XX+JHo`r6|I~QN*9pJ$yWU7CoeW!QhwX;$Ax#BsR+ZOS1L|NUA$?#HG
zxuxy3{FeP2<F_fh-kkP$S*-n8kEECPD!$+OsJNMbf4trA&o7pq35>Rp5?e7>#@nQ}
zBB-;b%YFGx!`tnSk!O47_{h$YoBxL)Jh&x1!<(1&-Xg8ll0O@r4PW2*_t|{r{CTn$
z=f6)}A*&TMYn92NlR?I2W>0x6<gc$YJ7IZ3@}&&NT5oY5oo*%b^-Jb8Y$y=Dn^yNT
zP&ag<<(yD2i!C!nzqCAAd@I7<vsFJpB%@6w)u->F*6yn6%7g6sdTjf7;_crXFYxb}
znQFXpX?E@W8J=&sH}@E-y4Re#J@tXiB$b=%duE(rnPTO>&3_`djCU{V2m7}5=lvdD
zUcR-3|DK(?=JPF5GbhQ++b6lN#*OoX>)TV(S58kjQTLc>?S%M!mA{HC7I3gWI~6u#
zd27&*i|IE$9}I~6!#~eAw|BYTlNnnX-<^H6@5LcYW%sS0WqmG3XFm1NdiiX^yNUfP
zrrv)2b=S%|vpZ=~54%03*1R<pe;oC^&Tfa8am=#4?mdC_v-F<cj-6x`UfTHKagr2U
zV}GXFw0_Cz3WsJL-7Oa%G>33yd`oD#py0Dsco&0_l3_Em#*%|~R$4xB(liX>SZsMk
zthcp@=Un?@l^%o7J!j<GzPuFg73<p0z0@{Bhe?1f^NXpBebVXFHKn_^>0XvS*i^i{
z?)5&gmaT_&IZeCyrEu~wACI}e*b~)$Dn1ELeDI(lE-#$(;(_IH-1p}mKI!$!eyZa6
z!d>4FGzpu(IQY46*4Zh0>(_th`}_Ot?#J0)`@VLu&NG?xv}p4yS=sm3WL_k!esO9_
zec<LGt|>Z?ydTe(sfv`_m$$Nf-_Kg3uJgV7ICn0rtKsYJ+pw|Q`P^x(0I|q@-gX>|
zJ2&k3^rfP1T8#WAIpsW+M_YCrYnnIVg>$Q*)`6)461~qj4hlU{>Avi;ug+jElYLU0
zwS6_q`w)xw(ju!5ex7haYFa|YbQ#;-o0m?`KE|~sqkZ8yRkqznmnEEB$Gl-lhoiJW
z?E_v0@oj5-`_AgHPP}sM;xPrDIV&%E7u^%Nq;jR*%zXXq7qf2v%n8xj=P2FsB}8nB
zr%So=`MT$(2~ury6&8kEKVWim+bX|Pjuq<ftHT++qV9j-zvMfc>CYiMKdHk<e_YU$
zi2B>5w%?iK%5n#Zl8(-bs#{ee&yA9~MLqk(mM7Vy3+L5L^~!L(vv$wIg_lfTzMHVj
zbJ~}EYd0A@iu5$jOS$Oz;GAC5*(LASTghxlT=#t1w#=lHGx8+NlbT%2X6^Gi_UOll
zw#6$t_@XaXu}FwYe#^RY;kD7irK@Li&Y#MvczsSmrqiT7SCTCiORuB}U-8)9Z=kR+
zhJV7@UY_df$9sD@#W^!(3#ToKynQe7PO{jHj4rRK-{;t8x8?fpKYhRM@6V)yqw)5Y
zrHs|FCEx$WyWDBxQdj$XB<7)`bo%CL5^IWgl`8xy+x0Ih?4QosdfV9gnM&oK&zU`S
z*%sNoZ-e@FPm@hCvwB*lwlJ}DaaI^9ab_nLNN#)`S6*E!_DewcK>s=Ax$2G*?iO6j
zdoL{CcX8_5&bXU*UfzFqjIH|o59w)lt#6%DTDCdW;;!hb>fJXBpGV%j=UIF`b>YDi
z_iHV`U#~wG+?^#;*7kP&f9@Aw!>x~86P>kX`dXPinfYtgzOS)f!Sd0wY?`e48?+gN
zit^;|8mtTq+I$%6$l!&gesXC_BAlmJP<b`{cHV6_f!h1)XPn?y5uW{FscwKJ-vo`k
zMP{D8*BqrSjwQLSTe5b#_!~W0?k>9(`!DLhe$y%>sk!d=HK{h2bG2#d=X<_AxZXW|
zzx*CSNqtj$iRXJvlC*Y69r`>gwYaWej@%?$iO{c3oj30s`1tVR_X5l3AEv!t)iURP
zQRG$DSB($Xyg2#qt9qCGe3=Kww;Sm3PCpS+x^#wMsOO20P}TseT%W}jOBJ}DNG7C4
zN~$mNRG8_idrH!Pce>-+4e!)@Csbxt1bV0K@H0KE-e<LG>(}N9e@xRY!;_Z?DJ?6Q
z8CSQ%V)^3h&lk@>_CAi6^TGVhGnch$v}TshUmck&e7R+U<@8O9A}1T)+SP2_u_(iT
z%FLW1K7ZGxy@!NslvDJd2L~4I`0@0){CW53U+#Y14(T;Er?*X8^I$b2TeGY742|U9
z2d?PcZqGR<VpG?nznxQOx}I5&<+hlL5;phjRevw5$@6VqW%%LCO4EYs(u!Pp_JkX}
z*8{?)y_)P{U#G*qJUjI0#uutGm8Y^?x4q%jd+x;iuYJQst)Obn$d!F}6Fz^KvcPtY
z@A{l~2li>iZID@9c4fWami{fPPh`3M7Dz3Xjg7vf8!jcy+_pks-rhCl_Y>`{n^XH=
zJpGUoq0GBB>w1DlrD$!^sw3YPT{8Q8)3d;1qg49M$?ER+Bd&8QTCT6`G*=OhxMjQ}
zs*F>+$d_aP=FW%d*Cfm)-cfIRKX=KZrR$`omU`MAK74O=YIl&dnrcx`)(&pg*>{gz
zY{{IMxaEby$FI|poSw&*WvsoiCLv&|q<ZxYpM93a3-<TkpDT0t`FUwB+1iTM5U-26
zT}rZXd*t_5c7AWslMcT7;ZnKR?T5M(<Mz~lOtW#~wmiRNU8UIbpikD-6NR#SywCn`
zUADg|Zu6O=Q?{_Z>wRVS`iz9CTJJ^&;p5w#x;rNv(ov9WnJ1y*X@6z?tk-Q%_jTC%
z^mcSEdVPHA-c>4-eO|AvnAZ2E`atK^vo2j{ngXYbsxM#1$aBWxUeB@_1)}N`5}(fs
z4hecBcD~Z1X@a=Jv8<<dCzffyYhCyBj-$$4rKolD?oRhL-|=vRd{(!Q9oLtSbD5dg
zi);73P1%#jFu{y>^&KTob@p7jSttAo{+(Z#xBS@ONlw=eU)6bg^=)AEgSy&(?iQ~T
zOV6(po|T`~<}Y*6OK-tN4zFcQ=Fbm4xVG@)k_l}$wU&vk=w98FoZ}Gw*xESkx?xks
zE3FngnG$z){p|uOyXrWOEEY{+S-fw-wGVtX<+c)UnF<)p<6^YzmMCty82N5Z&WbpZ
z$zGTE{1VqbS2`Z?uQIKL)3N;g;%Qg8ZwYQ!n!aey!uc&Te{;w`xZ$ssuXm&U+Cu9$
z+bi5ZBowUYa6K}4)5e=m`&!oqnNPm3R5S8a!<-kKlQ%juy>`1^cUQ5c+OK$Fz{()I
zZL(J^ycR!UG%nZv*s?>-U;9mw>Zdq{=yI-Ij`!zpjkbwR*Efl~<+0en=^*dyLYI|7
z`$N2(m;?LsX1MS_zaTHhGr45DX~Bn5(S@&nrMY!$9Y6JRqLjOb<B7RllAD;t8<#%W
zF?Bav<owO&rW9<yev6m=vDlk3WuMsoiu+Zkcdnh;yv%^fy~9wPvEx^E<s&wUs84T?
zzwc>XyQWjd^ajtBo$9x~y-m2&_q9fM8*4{=tk>MGy&bX-*WTPI##LCWXnj9*t^LNb
z{!LqdgzbrMEQ>eZ%@deazb!y2TW|SqF^{hWpI@s==Bb4T-@Z6;o#>j3O^J)EZn0Oa
z`4Lz(NzUy_K57&7w8QNyo-7Ouo46Sm)NpklQ*sjX(vi#ByGT7q4HePOSxaslm099&
zvBaS*jeA=RPXTYEkmhV|*D4j!^9Fw$s(Wp3@@bx$np1xIslnlTtLKk@J}$4Q;M#9<
z=U>%7&ybkNy1L^#iWZ68@p<rfQW$q#-PHIA!9NyE&sKiM%^og3{r<tnO^0o_M=?G=
zAM+};`SpRqTRj`<|8{;@z5V%*uex_MkE?2(4U&G<64r9X%{)M)^mWwXZYGyzEA|l0
zw@gRed>+?MT{}Uid{3m;s~u-`kJigvKT-GayVED@8Z{NJJ5`!jWLC7gJDq6qUdbKy
zMePCGB$Z5)Y}NKQuF|{fH}^gLA^2;Sz`9#(a&`Y+w)e}+b<5wsUw<T3efH9e`#+u%
z?J}#WZZc?O{a_aKn&;P?a}Be0o=w=S*q|Ti{EBtwldN}QAI|c|qy;{Y*H)HUztqb=
zF0$ZDXLP`=*%`H&x&MA{wzA|_TQ0u&P1W{u1#9Luo%Y*wchbg<$6GfvyqD11^GcUj
zxa--XmEGA*X&VgUxx`NG58swycy#H>9a1M}PT%<9^O@eGwJn@YkN*4JpDDBA{@nv<
zDsKvUu5X#T?!xH<>@I$jMNPT9V?569oxT0!o1T;wgMCl9enxYyxy$Qg?tF0CnF96y
zA2vQNziJibb?<23`NKQR!?rJz>T+vSU+lhK?39(3YSx_0N)FbWFE1@w5*BiDX8DZL
zuTvKNk@{<PH$PChb-TxM^Yw~vV(+dxmCmQ#XtzOs!IO-Oo2MAR5qVZFev~DSS(we-
zaoxg06*Wx(>lSW}@Vj7Yk<X`WaAi$#%YM!&NBPaWPAw{*@=nA0kuyVnRY3S$<`;s=
z@h7gR=ilYl5-2!+%h2oF>96y%_G{RzxK^k8Pd(Rl&EcAW^uG&ZMJFc5a@k#0zAO4o
z*YcVjL-AFyvb$5F#Lge;3i5b(&2D;Y!i(?stBuMM3isTvzN)cC!KTBP>ubmwmQSfn
ziYLW)ysO%8EMe>LUWnPcwL0bc3dxPG&YK@iSyZ^{*0!GN`ICD~es!+SZJcKydraH2
zFzVf(HYe`TlhYQO$S~e2*(f`4ndiI|eT%DoOXf{<SQ4W=xhG+<0N)O-!yEovzBhO%
zdru=zHMH2J&5^$>ccW?1p*>p;)E$4a`<?$}1#hFK+*t0TTqSnqTO3`Z7v&$W&o@kM
z+ju=BYTnbWd7|FN^UL$~<`*CRsMb`uCH2M^lal=DPYmXooSv(<B(89B+pVt)JR}xx
zeJv{2pVu$>l3~;CEZKxbd)iBv{cSzgrf2_P*?q@oNkOR_&Pv6Hmadrpy|Sh5>z)%I
zst&u{o$JLiGc|WRFaJlGSL;J=w(vZ1GP16Z+o-}(YtGxZ@o)7tzT$!hvilQ`SWR_)
zQc=Pu@VKxj<;0r}?DzWT9#WaMjqld-srH|OPp8g3_|v-LOup;WWfsZjHfW#8*(A*(
zdr7|O?WM~q@;c|g1zb)s*gI)vd<)+vhYej(YnHyB^H=inTGe`H)WYb9A*-$d3j@PV
zE(Qh-T!m3ueo;wLVjgmFbT#ZO==9QkpEZ}Abo_QmY!hcy1heJ@wVP&l&*oj&<<RZw
zaN*L4H0Oy-o~njDwF~wgvx{t>k`le`@|RmOGKCh#f1b^j|0Gejd-t#8KY?j0Wc%`q
zuEdE6y=BqUny6b)Gi%<4<Q*ngFP-{%=<v&vx62J;749rDmMW@oNnJJR&4I-l)w}Nh
zQ~P>(v*F(we)C(47x_j@YVR?bweip_Aq)Mi_~<7xDW27GE!U2@iyn`f7#|jN-qB*l
zwzO1>x-jpl%jHgcarWz#Htm~`6Y~7^-jE9C>|-g6mrH&<ziYbx&(B|<4xe2<UybL5
zewFv-psbhHtGTV$JA3pQs;2Kzm?=7|oc*Asiszwy%5qDZPtD>f?qZm?B*@`LVq3%c
zgTl{5eEF8RCK;Vrdi2a{)f6X9!(fihs#o~dG6y&CzkA`J{l+MDjY*}i)R*-JZLC^T
z&TuR-lZs4zs_d8;YOAd2qqadSYcA`x9b&3=sXE5DxII;jJnx*p=(L>CF=1=Kp2<9I
z6MJkeTdNLDaH_cZrQx@%#@f%anmg@S7MI_M^GV!(-uuK6ziD&s`-%qcc{Xvz;-p&R
zTkMj1gRP!V<ElKLzh;N*@g;x6RZAQ`s;(}(xWn7c@!G9pN0n18kC-T4{kHpJmP~%`
z{{p_%^EO;Oy-{H6r#m4V%{@MQe^Obq?A!ybFAsl47TG6>94~wkz!h0i>J!i5wmKrm
zvVwVI>54}Jcbd#TuX}gGETrJZf%G$3@~f^~jQWuvZGKHv>cv81nTa1&CFB48_<i=c
zc9zb*ReLKPnrhES^od^VvYIUMHSBiN`Zsoye5BW2Zaej$qWjoX<E>{Wh+jF|+i~hv
zFt;H4y=xLGv9o3sNJR+05Mb-wxo&6lG~>lT7MB#MP5pBEz;~x-Ez6%)aKBx$z30ra
zM@mT?AKK=z6>q=FEZ187V(JzCKc2r_n?Kmg$o%1nDqmawg0F{jzbO9=X@x0kEfO-)
zy2>JUS6#c7aVl(;r{MC*8Z%^!UH5$ay3<fFD1FsAPpRY6Hu7#`zT`Mb?Qr;E3xOXK
zjyn1ChVGhL$$ucu{h(P!*RHA=#jjo&cs#lzr=qfOW%!9oqc>%jEwh$LtEXl9ZaclE
zCs*Xt{Y}F9{4XTBI+c!Tc!^h+H7dDFFXHo*F=I|@^qM(cujAj5G|A9qCo&%KioE)4
zepoO>MPs5$V%`0}zkW`CeOmK>Nny1wU*E5b^0{o+1NW58nys#J;Npt(nuNZuiU0c5
zZoa<!xWM?`x5V2`(igQ`cUi~Zx+bq;{4m9Bsl;!+qSGsi=QMxkbu8EIzk4{@BJty=
zY{mzh`D?`A`%Ti|v)C?FxMR+>S=F7tx9@RVZSa5F7yi9z*Q%=T#qayOt>(M_ZE^ia
zZLD54wm%L9cYkhl4(&N4`&4bV`1K8yQ(aHJ>Z(eev5vRtRl#Q8XPNsSb==(kGSchL
zKeSS3x)k?$Z)OGtWiC9u&8);Sl-}muu#0}T4Mb|chu@jnzNE>G)ntiisZg?wK`(Ew
zosW}7(d66L9^9DtmLc>i|E>Htr_1IpiFG>Nwrp=s;FV?HcJ4d=ecs~|_H}yq>)+Oj
zaB6k${VXz7Shz8bLEX|n?S^&7uN-#2Qake`tKxzS_v@J#OCDm4TB~rhdWzL~4L+Gq
zYg+&Q>wUo9Zu_f(_xY)XOFSoMAD(-mYh&j{$s-?^6to_+V4HYx4)eMxWvWN6%{cR1
zO5ADL#KSt%?=0-qS+2fBVkei))H}C|r4oA126)Nd|5Pov-YJ2@QNUoDc(SIDhmDlj
z)9^JFZQc<&5*JJbySz8db7l%Z$6?xfT7SO%oVk6E{ME(Nw*;h5l&<aWT&-k%d`-`q
z>Fb=|Z}m`o?Bp1+{?OSgaraBYJO8Mv3H*BKv1ryV$vsj|`&mC+zk27Ao>J@%jpeO#
zLQ;9&II+v@cjor`eU$q?hji(#<F^le4BWBd{)}k7oBBp2ZpMj?@2XZ$$=)8z?sfmv
zR$cz53uaH9ns2f+=jG&US1O&lxNm*s{q|=Dzs~%37b7OI^KgXQhfm15dhE+>MV+W-
zQN5#_`b)Y?<4*NVxPFk?ysJvYTmR+5#DdMocl9itu~;curK!uN<+W>Z!pS^|!|wk7
zr_Js%|C>`37ZE#SiRBYk!SF}YIS-;=vaOw87o{<2+7y$=K8>o5o0_<r4Yw<CerpJO
z9kz8^(jW6D{y_|(Daj@x^;f1<vVQ5%3|j0Ja^u1}N26`44x3-SkdSe=JEQ8stY`KQ
zw*K9A{o47ptJJq7xALz&xIyrTUv_6qpsB9sv;+IT-nI>QT;!5&X>M^TQE01`^KaW%
zc^{wd68_(>eX@Vc>Scz~PjjP-m7biw^Zm$9fAN}Qb3!6FpIkhp=<H&b+zB^ly-mN7
zzr$<cyGQJfO7ae&-2N-9bXK*P7Dg1R?6NL!WMY4QzP8KY&Y6W9YIFp5u*U8GoNKr)
zRbXRl$uGXEM$7(eIVsYqw)gb)oM(xVGhD<pd%2t)Z-w-1?`d-sDfwSfymXP0?<6Co
z+`=0dbWJL+v#YJn`rG)VCepj^Z~G$a6=$N&Ipz2AYd@X-_@6-jj<nPB`%QBWC!OCX
za#|q&EL+9nko<;Q?JvGvF6F(y;Nuy|19fN%1{nBWZdPMtV0grcr$dqpx&;Nf1(4f+
z-s`Y~z_ItgMVM{3*s5IVV&@k1(v7+jWWa8#dpl*)x;OS}!iN1%vVWwk^K}xud-%Y)
zKl}3cNgn+C@0)7n70X>xlXDyUN>@%4+rXt|pJe2pp2U(ZA9d;K#6-K@JKElKd}!HP
z9`L|gN<QZb<Kj*GZ>&GxabACN#JYsn623A)AC^Q^tGjsKYnqaJn0Min1-Ww!HJ;nd
zpAglt?|ANobxfho*Ir+Wx|y&c#IibzJ@@()QLCP48`ox`O(xZM^Pl{x+gx|!-8(U+
zN3VT?R?mIrxOdU2pO&icL|Laz5Y}?btoNJR?lwE=(P7OSkIwih?rfY}e&Z+Gr~D0n
zgi{3k`~!Hd{=Zxyd8mjp`OkqpiKPY>@8+;=-_l>mrZ$&*mehauUb_j4%!=-#wzlM#
zwY=eCWng&8%fO(HtF@J%l$DISI^%5k?L297f!gQcK2O_YCBGdL|FY04=fK3fF1dPc
zuNUw#H7_XB>@=IcTVZDzi>v&V`!A-KR$NR~J(~Gj<nXq#_F`LOn<d{Ke1Cn~p8tNw
z9PPvW?5yEoJuKI4cdUrCd)TgiQ}AYUU8w(734fhAGP3_!%!T>#cdir>`O|nBv^GO0
zJ=OdB`~3lbpL`Mc|CfU~b>|V+*zj4AftpTkyR;fF1tv?M)npBPG>dgvNb24$#lV#1
zTLY34*zy)dzC6S)t=N6$)23->iY808`OD-!IduKJ)2HimL}T~^ygDQf`j&nE_^az%
zeEipX**(=)l^g8urB9pc#JPLJ-V2Y9iKcNV2JyUX(Nj7osp7dQJljl9GDPcn3csy*
zjf#kV!#~4{@+zkIeQQ*<{QoHGrFk@CMORV9&%_VUgoGDtJ{I;p=4`D}^+6Ufr>egX
zpU!raw-vFOzU*0Ll*dW?-8{R`NltJ3&we@}dP7L7#KhKS_03hMtT%^sCnm?TU;g4K
zVJH%GLvxAjmc-sIbMv;(eHDIp?eeGg9S08H>amnI)hhq&D60L_=B=GN%WuJ5A-wND
z?Yfr}n)9;z<`I5o*@rP_&U037>p!f+qhoVu@dTlQe+efP7xcVMUd0gNWY}1%(eiBP
z)Zh~{r{ri@@+`j~v5q%HdBZtbwM8@MrLFjPW_m+?jJDcKrGQ(lH_tRLwCvm8wD@_7
zUH{j-Yugv@Iy}?--mwEW>N$@D>1idK<~{j5!Rus;*InkzkN+@y;=H_Jf4@He=_Lgp
zg12+o&pG%p=v7^hZq?pBSr^`NKY#G>^2N2)ZyHj+-+B0QNn(Gh?Dj{x8$N&fdC7Cl
zPYaJ{pGy_Wcn<MN*o5Xh2zdR9Z}to!kF<}LKRoyXM0oBh+ayHajrkH_XjeVg!J#Dg
z=O3Ol-NXys)eT`=(@n1YnPOwKcEb4;C2uOrX5EpSpr^>Xeq+hHqQ)C@4lcjBE5R?1
zbCR~v`iI(AK6EPo_pq;Ly}@Op`beP2;D+{;qk%5b=2!C?>z`F7-+drelYZ^yuhyqm
ztUegDomaBlbLUaZlWWX9r!TS;y41|MDdbXP9=f<#&h1Qhi;>uOo}`4*!*f-(X*`ii
z`j#MQcVIi4*ZQxorX63kFfEEt+w=Mi_T7eptgBSzBKGrd$U0LVTJ2G}@ye;&+}kJp
zcT)>mQT<Efjf%(vCTsi567j!>l@hL(e%8%v7E4UfwpsYV@%SUo>{*F27kbX5s5tTT
z9kqyazw^RK^gjE-qMITbUrj<^PI$+cIV;8U`~T2q&uvy0T-d4+#hH_<9^wD%<*L7m
zZ`{kX3U;fpP5mfVbpDu3r^mzga~^XPrG9XCXBbKzb3U-aV}Igfu6^f(d1CMPXGV&4
z#3bxCarBH^IZ@(qQOwz6F@<{;{$Tw0)T+T}UF-b==kjxU_U9Z}WLf9tl(Sj%PU5r7
z%tK4p>??Fz8~EYTj6MI}{?!lvEB));qqm|Zw*<=fWiQLCeD`CsSbZ|%gV?QI#ZlJE
zTl!As>daUB8LRXE@1;L^t8S&N^a#+tXuj>E+E2G6pUH~GO2>O2N1jyno)F&C`2Fzi
zy4ZMkk=x-f^ZHx<wdwpwe{G<D`iS@AH|{T0IAR&Id2j6$oz@low`S4pdnaV2vR_%R
zYx3SY<8Irxl<E7wvA)VKU%m8T*tPh*Z7g5z^v(|YzO?z$l>$qvg5PJpgx$B@wfCx8
zZq~ZXdD~11R^7d7G%NjWq3fIe&6nS3DE>#QxK3y6R{GAuz%ZQ`Pcsr!oFdm-NK4(k
z13b8dOvT?Ezq8cgb=un9aZS2M!?rLwdT%+}wuohtSJsZY1$&Rp%V`%$jovnU-TyXL
zPaWBLugm%DFa7@T`{`!;{<zK_?Zf?Umf>MOEZ3PUf;O*t;J*B&;m!8M(DPenh>7|2
z``0zCZaSQur^RZy|LLYx-dmVYN8Y^r_qTqCy{+}3diz5jk$Q!J*Qch1g>+5mT<5i*
z<kAhdVlT%jJJK38LnGHGc?jH$)V(4yqj7aY*sc$c-A>qS-Lpn@^PMGa4~5;OZ~pw{
z>hZ5>^PJa$UYvr$JG|E4i;uhTu)F)=`o-qw*;zgu|Lt=*NF&kuwtCgA9fx=nUAhc)
zGsHR1DRwRT8?`y}<bohc_1`Znp9?Rn;QP{larWlmAD>cH7asn8KF~|k%{g?+;mhTV
z!_ONqTIJ`I9=>`=ebfC}4(dy$zn`~Hiua=PIpfT%c}I6n`Lp@7LE*U_CV#ATZr_UX
zp4!d%Qs&O=tF`xLZjI`Zer+XjeEXq}jS~)?Q@H0Wea&O{bd|p$`(NeR>i&0R;k%Z0
z=I4^YnX~y<MVu5b{L~@v#{KrvtUsE!b3!s+od0~NpK0!c5FI(;PahcEBPCw^IXHKM
zP{FT+GYgMO%sw8%x1uG9iG2e1S!3<=35J?CBZ?%>FEEUeUZIvS*V@O~*w#Dn??Qcs
z|2x8bF6jl#IZ*R%;RTuY_=6vnH$}8$nXkSbaQERE>3pSxH~U)>HO<Y$L!)f+K5NVj
z*jSxVHA~hh%z&4j{YTO6GaTu5Wvf3Nww$B0^xg7n8J3;j<s>$|X|w(^XMUOeQhEDT
zd!4`6{eJjEYV-RwPOa)|Q#MBESG!-{-t}$ChQQLbtNm|mkf?S2{Nd8B4!*f(B!4ZB
z&RICSk?~dQ^RT5~cWwLgL*|)n;%f0_bHlbi*SqpZ;I84?2|HJm*i_bu#mY}=nK0+N
z#l4tRriqsA{GUq?HpK`p349W9IDE!KVfSSd>#h}T5Uu!hxbbnq22&00<o0cOO?R38
zpV@qDm*P<~kuz4&`!~!9V3$4iA=1VD{I;_ClD7|!K25mv=*5|926JYwx+s~?ehOTO
zvV#lJBjzj4Zt1mX(5v9SC#BMSZ*}y%Rc*5(E!U~UCQH0=RV)hWwpmm6Y-8G)ve3%e
z1>3KjzQw&g2waFtSE=V*6r1p4MPY&19%pgA!nrlQ(hJ;qZm{{wRLt2}&^IehCe2v2
zSn>s*bFyaNUP04cK1aSgtne|j^s<!=-Q`=>Zqj#2<LAF!G7IXCUFK?!>E1K_z%{?7
zuS?#qza_u5E+?IBdsa$-<a;UeoKq8vMe1HmY5BQOH#kwy_S~Tg4hgZB=GhSkue-J^
zd_7xJceTvK>`L9ffJvcQO3QZ0gk9DQmwB&PXH&D2PhoQAL-X~YrKKLP7r9`1+}}g`
zb`ER#j7lf19aFCERlnGkwR`f1PusWa>$in}IXn5f_=fAp%ir%mdSb42ec7Y@6QXh@
zb=R^v&s9CYqvr8n{@%T_cC(KNTcoT0I(F|)%H;#4g(hik3S19X9$V}+L8qs2`(yvZ
zryCOf^UdMu$oDwWSig<$z0s#b24@{3wm41y8<k(i^F1hc^~CtxP3DE{2WEY`_BD5<
z$fsKubjvDV$5)r#Z=d!m`e)r!t&2|2-W{K^Ydy!5V{NB9?;ECV__b^T&ot}fCZ^X5
zC+YFd$=Vd<_IZo_!j2!FRnz3$pP=1UG;7xUn&Zq241Sz=N>0$}ZpbC))zGuhF+a6$
zjztOCpPS`gxr#-kY|p*$PAQ`{<Dn@_l+?|f3@_D{r921uuUvmIxzyv-HW}-T>NScI
zmp;s%nQw7_LhX;I9}llzJm015)Pom_?y0Vd0sRkak8W1&%bTQqt^N0=TNxW8qIT@u
z^-oOAyTw1li`BBuH8M>56LWV>Y0KZ&{!RDq^u2g5T@fIrs{3lyl{;NQhG8#?STm!p
zY`ZpNnL^l>v_|dFD1O79t!BGdwnQ<Q8)W_s)BC?i%*bD7oz_X+Sw{-0oIg$6op7JC
zlmCnFM6MYslkdyfFZ*s^v*-WEho8SEvwit|aZ-xvlnvJFzgGqBp4GuHIceUjTQ^Fk
zv%OR3TJ-Oz$zmsi(3+<{d(~>hrWD+sZTRikq;H-Q8d+0!CMD=DVbS7!#_{9Lrv$&F
z&m0ttjCZueWSm)Z$Klx0C&irx_Z@Nrq&2uV=*e8X7?Us5v_G+x$?^9p(djSs{B0U8
zS_^D9zhJV@p?AxEu66e|y`8pk)jZ~%rq(;2@2@@k(&vl7GW)Y#u0GXy?8e))iVN1K
zJ@=h*@QUcmjGCX*Due4^32ff*^wi<qQ=;9!KW^jNrunZ>aQ+6FL!yEO8cL4*ri*SX
z>350ut}6Lyotxzo7kIg@rQqU)n{yV||Mt55=9h_D%x^gb#jNz7cV$i7k2Rd$_+aan
z%*e`*LPf6@FF*FI+=S)&MS(@8*SnU?@iMn8-+nRY1Y3`##6{ju-OTDn&m$HtT6l&<
zDr%lt?BQu=YhG?ixU(lEb9HaPs@qfiX7*}k&)xbf=Ve(_f4|+`O#vcPMXcFYXW!ZE
z6Z8DhijTZGkF5hQ70KIuRJWO=sd@1947Tap-P=|^&lMNC<`HeT@Yb>^b55NwoIIzm
z$yPMJD`4iD;!VFEYLqUhJ|^YvY4SsSs^`Lam$q*3j#8et&gA~tB}>Y(Cdvz1T;wV7
z<Zoh{u8~^#Zc2ghu1AX&7j%m468w9yaLOWambgqQyOny6=GnWw$P5(8-0i!sCUEb=
zz$FGV^?&}!cYid0YybIma=*@Jy$%t3weWrMF8dk(cE4+W^88Lm&yS#{ZEt&?Wbyp*
zVYS^By=!+q+v9>aTW@~6*;~HE_sQD6<mIaAPd2yD{qp|mJ+{h=SIQ5lPY-7=(Ybbh
zsg=$=mD;B*yrw~uUrLpKPoH&+E!B`^op@T!4mbA4e_y^^-&!%@jjT*bL4?}(ClRq*
z@~@xFEfSU8WNGD}{ru(UpQp1Y)d<X-E48}4MDEp1#Z-q~$(zpJEtKEm;Jf&+sodE)
z{mLq*O<(m$znUfecdvi7H(U5ObJQ+rcIYh;9wr8c#jJQrg5t#7f}GSe@cBWNdIgoe
zAs4eiLvh!`V_rCid-zP>*v@LEk-0l9d)tPTWM!7cH?H?J>2iANwQPb6#XUXI*?fAE
zjm0&~?=dICzu)1W;hSIoP2RQXQd0e#MI}nY8EplND>ohcr?4wc+#skb+ht#w!H&AW
ze9y95IHOb*kE-iT(eq^ItE?3H{hhy+|K69EAH|McN_1Ru@l=8OloTD~RV^0hw8ABO
zk_A)?`F2b>byacN#)h41#f;eV66H#k-meesRO*$Pw(9|3?w2Ef>my8m)(KdcW;J*I
z?l)N+a5&YycK>02^?=pBi%Q-9mu{8Jtc{u{7V}K@>sojJZr{{c_ust-E??rUe>Lrm
zaO3i&o>R+~Dl?tezSh0eD*3v2S4~)}@a?N-uicrW{8md^P+0QJ;-BkZ#@bZvkgk=h
z|7nrpu-__LWU3R_^%Z$Oah2<Dgta`KBBi<D#&f+LTa%fp3iP>Z9Of;uTvMLEIqKPc
z$>fg}Mzu1REY)JF7wfDswvDQr{$vrWZ2s!PjsCm8gz(BPw?CGhva{v;hnV@_jCRVr
zv)?VQu-10R`a0(5{%zT}1+K`<v-;wpP-8D}@l}IZV1Ch)#SXvjsjj-Zw$Xz#H(LF`
zJ+&iSdIUQX>K^sImCLXX>&WJvB=_4l)!(rB?$@K1UQ2c^JEOhy^+i*gm~WzA?6<tj
zzAnd>`O0%eex9JoMEjzn#W7})>u%ViCMP5JA9}j13=EC3c-CJ+l2c}G0cgA9+sNB_
zw=F<h&;(90zda;&M}#|vw_;=D_i1_g4xcx4=Y%a#J(Z^H&E$Esl)3)GKezok?Ne6F
zPL19qyg*|S`@xB6d?z2Cnd$sgr1syJN9zw-KfB;?;b5yb^GO@GpB!`DkIcM$aHi>-
zIg30c)>_Oyt7;`}SKFueTx9QZC7uc1`77n!xIZ{gn&f)&+wb~>x^FoQ+v6{|Dy-z!
zuM{a#ij*j^lH(UYv2Aa}u{pQQlDI3>1v#4nvV<?boRJ=U{0~p-&!a1Us)h@4r*&|Y
zaO%nJ+M@UW-<M1C_EcK_{QT(f>p=E{OWQZEVdb7-l05fw<Qg@8<x-jX9F2C9U7uX$
z-cc$ZBJ{U_=Wz7%dY^lToA0eyd@<(L!8@YUa?4r2?zK~@QFF6Q(U%O1eYIC~0;_9s
z?$Y|{_wNPiC7e8_@ON|0<96>;vPvs-4@<AgvE1rn^R}qwtG;B7G~c}V$99Lz?rc&N
zUZ1x<{8-oG6-}Y$E=kwc{;*O>n)Kt1bZL3@^S02ARxf$$c$2y;-nEK)(v^zkn<l)p
zKlMIV>LNqYwZsq!;|et$!Jj^5h4SA8Qk=iZ1jYxHl+Jzg;C)v3$q)}e8O~~3{<}Hp
zvVNUQ%>H`KjhM93|Et*d3lGe{DDq_N+bp=mJ=tQuujRwlY!QO|itmcHic6+tcyrz4
z`eCUzLymuT&PC=1X9+pJuoF^myk93T;b{F4{-CP%j|IP&wBWG`&n8q9>90srSkc8g
zv23HzHj5%I6KRE>wfc(OyY8K|Z#?AjH!Qa1`MSdO^-T;yJ3Clsn_fE|QMBmYES2JY
zCTA*&iav2EY~h^6B)Q{+`avBvW368Td!@VXO^Rl+dB5nSW<>d|>9JDFrUcp6grE1$
z)~=lBUOG3J$AH;H>V<lk%ac2c;%80}*dw#k;lZmYBTM%Uy^a^zZj^E6aDU{C&2UVX
z@y`FC{eka`()u^+_0C5XO;hU$T@$N)^MsztDe+exy|(8p_Uvce^8M29kcOKbz6%u{
zRJdxmtHXuG*9702b?i*}$7?61tm*6Z-Ff1jt<%Y+Y`fG~I7RhzYZht5-I6`-T3cWc
zvGQS`dG&{b2V9#x3bH*{vj4ocNnUG_?W#ki<~O<*%s!?!WA@S@frdhM$u%(_R)jfU
zZ58;f+TZ1{>Z^xVxG&e9Z$8rR9Rj$`ALs43{%h&#?=#lR`2NWDEzLOnEpp3t>lsPf
zI%|X`#-7#++ZTD`+Q&0*ZoAk;J4!F#QrC03ujtUyCS$(p)dJ$LPgGpJ9x?ZKmH%Pm
z##^UeM#{-JK6gEt-tp(;<Ru%jq%O8ixtz2x?bFS^+_|;$rn>v@H<-_s{iAW#%VkMx
zXYQX^wmzcj&)V>^58Jd}eVKANVv(h)-jk2DUc0nx|EM&*JAQ7u`^T@w-TFt_Jg<uL
zpU|J7eD&du{!{8H8qcnWEGp03s4N)RUU|mRykslS&ei+Y&G64SmOf>Usrw6=oeZn_
z?$xw9`Ty*>p!+ddfmc#VfN!5w#wklzwaYGrPhLIzx=v)dS=O3fzQdgTH}xK$eG~m!
z_s!A9zSDB1C8jdAyW?)3+NIRFp-4oqa8~Bjt}WRI*NM)Ny1PC2q^XNdfP~qUmbXU|
zyd`gVFl?Jv$KJW`tL>Z(w@mKr`W$*$=Y~yeYLKex@}TY-k#+rtwl)^jE}j{EI(%_*
zZ$<7uUbChD)$S+Ut~K>*l&&|+yTA5xQrFl2xvySpRu-iGn)B@A>%TG+jxP<^mznOT
zaQjpL%+#a1tS&R3SXkB>Exhg8uNz0!zA2lv^IMb4U7hm(?5Kq;qqk_G3Nr)4UJg8U
zcUdB6$6zjG-ymqKU+DX++Xe#v*Dc?%l;?J|)V3*(*DoEsA)&n{AVRWvo5az5CQ+#;
zCqG$t@CkUI-`terTPKTbtBtX<xODgLyZ>{)J^1|d_xj(U2K=LcnSG}^cRCca<a^K4
zEvUDuJoxRwT)pXTcXVWY;`h|>igULZZ;5j3E7vHE6yTHjl%(+cwR)#N|F@T)x%{R&
zd-?=tfhW;+USwVJa!=9JgC?wj0_PdSy>=@kMbA8Rdse8^GvRhu&7IEH8|V0WNbF>*
z6A<!$c}^mF!4#{#k0&k9W|`w4;#wZ{B%olS!nSi9rNx!JckbL^c{Pji@0!!4Pt{aE
z-jR89(S1GVt4lBPXY365$Q16sZrv3P%e2*^%2S!M4_@V+t!t+C_hLYx$u|>zp5<&c
z?Z<*X6tG;JExdyL2;0TUE2?{1Hp+O1gdFu*p!#^a%AJYR3QLrao|$gqb!@hb?dQC$
zXLhYmKe|rxaJ4*7?dDS-XC6_L*!7)x<=S;V*VK9cSW3m%Mr*v@G37|%vO@xlQ?DJp
z*b_a`H96lPv*^r;ud%FOx9NP<a=I%U{yJ&eRiCb&GZq^{1%KDu@m-G$FZgflp}Qi9
z?|f&W%!!cOx}x{B^EO=EB>k^PLbm3vtnKl&w?FLLbfu~Ge7|J2ZrNO^_wUYDlq}Wr
zSR9@po|1B9*1bu)ih{Y`FtoHT|Cu2ZWGH*s@sq`a4ZLRg4*TvOfBl1ha@_0kgMZie
z?ti|0uIqjkt^Ln*<_c_?<h?@Y>G4dC*_<-EuDdxbm6O|Mt0rbnW<7TJLBy`&=NlU@
zcKOvPoqX@+cq_>H(X%N2<=KAO@8&OCy?Dt^1DCx#DHT8B%7tgVoA=!`+u%#%kL~+B
z7v^1-Kcw5?ezEHC*(c_&qW*3$oAJYG&d2EaCa+GI*-vqOFI}MJ^;_X))-|(REmtqS
zj1E~nr6<_HGHueP+22;l2TeMu<vw4CDf9A<-OW<&lY8I&e0;)5-QT2ijo{A%jcYeH
z?7J*dy7~8s!t96Ky{9X!gI;gfv&^~{GP{0HdEJ*o39P&H!}2xC_jJ#_agD|P*BaK2
z`G4kpxK{O!llS_)ceOV<^LKtc(UrI#?aW)yUR>CQTp83^o6?fZ9K4%xBTZSh9b#u-
z*doQiAc0M9a(+=NC|5>C=if0CuD!lKVKRH>?X44jt-Nu~Rp@wb(=yM79p*c@8?}4O
zBE1)R1#J^|{8yds@oLxf8>~(5H}S{mTFUU9pR+Td?##XY)gOPK%%149^x>0GwyA<U
z8MY>z&zhI_;E73{kWJe2P4~1m-jgW%_2l*C$(PlaFMm_S{3iXvrX<Nb4vMdZ#EqHv
z@HDyi%dtM+WE2xJOH$;DTj!MxK_QEBywX&HeUFx`a>*@`VcDO%U{jO!yg28n8@UuN
zt4#m2Xv1QkkRO-d-_QtL8>w|VO5_fQ%&DbHb4B~u<Ma<Nj6VAM*6C?`PJNlfdAKEQ
z(VC@3b9|<)nP8I~v)M@^m|^wyv}P^unWn5S7}T>?ZjE>-k{jH7NdL+-rr-k?6>OMf
zEl*6<iJbJLH&aBV^M1?6Rg;d*S~=I_7_UF~I@2v}Uz{7|C)^c|U;1|O&0B{TxK4Le
zC@PbT|M&5ol4X5m;lInP&F%G=+T?d1ZF}vj7`FD;6V-q3(&x@&dB<Zl?@iXzIBw=H
z@x3WB(@n#rLbN~5$*xc~mgw42ymeCcQE%BBC%a#{X+-V~)j#n)J>!kO=)2NV$;$^s
zi<10~M4bD$rts0y%!-|FME0y|`8idbHzqH8gVnFCYwi9&-g@EK+G9@}k6ya?^pRfc
ztPB0Smd|w7;yIkx(Xr}D?$NO5?L6vpB_*G{2wAeubCQSi#Pc_&$E^L@bn<HagjtrS
zT^YGe9<IH5ggcup>bF~%!FDUR`A#7LCoeLoly7I)86`9C+p^2<<{n2g#LACFZch7a
zb4zM+?v5$@jtQURnp4F8*fX2y+|7LU!@=B{oD$NJ?c9P2D<|*;M!k@Y$w<0rn0Cx>
z-~5Ut_T0zLTe3}NJf?2+CTs?8TgEG<xlBht_I;0eb46#unmu2n?O(HKoG_hX8}(}{
zmqC_x)YC~m`3z}>&KK=WwpEv%mXN!D@coSfH?fE}+Hs4#Wsl`uv8^`Wt@ztQdgHgs
z&F?y`-JVEP=hv!*Iz;v@jy*8d{^F|0$0FuF`6<CEIj%punZ!3Gr|5sJI+!!z@AeNe
zx=HaHKb(JczU!I3`IHN#r)8@B&U~%z`{}yl_?d6Xf8FY>%6n~1%Px6GrpS07ia!07
z<ME-V?~Q$~f86~1x&32@_Zr_8X`a><GvYn7cDa|+*0V>u%KAJlqwassVNUrc#_xQU
zKcqK>S#+}4ex0)0lMQDqS}Q)cYQEn}jsK^nDtMQgY`Yn~{rF?^DTQB87+;R5Ir27a
z>S^KbZ3|*rCF&l|X{~6H;<m9(N?oRY=}Ee2zz?aFI`<1?xSh|QWjmhxX#ubJV;9z|
zXL+wJca3J)pk!9c_@lP(#ihjc-$dqQo_yivb|y|vG=9><@YCn!9N(t8NJqK&b)-q}
z#N0Px8)WV?O!i2=&NktD^0#eT+tys15NUMdal%bMjbxX}I(=0cH|Bk|oniK&VEf9H
z=DBk`qkQ^KE8P{kW3TAFaoei237#8we=w1#ykTXYze+@W&BRB?H2h~Z-cDbvT4FJs
zb*+=gms!bA+*U5Wnbhu_(kFh-aMNuTnVW`O{<&#9Ts+IPt+(8{c;Tkx&$aAtX7L8g
zehRF76y2v7)$Lex+|&K2`~BLAPlX5VYW{xwJ@?7|uA|%ZO~NG8w52;eoBUIpC!KMh
zA{*g&c9#1@xt0I7@!poZG(Gyc&T39shkf04HE#sfx2#X}*2tdyS!uV*F~gRsrmeSi
z^Rm{o3#{G7HkpO%+{E20&unnD;g+5}zef06+VN|xpFh0Vb2a<y4yU)L*;oHJlWBhH
zbcE5Z-z+v_Ls*bl_sVLIBaaMwmc%J8%xJF?`qH?0@tcN8LRWT~dP==MRI6Fh?|w2-
zFX!1|gNw|ECVdRcoc_+Opx39Xa$4lM^JS@jUfoE&r}68^HsSRN8hsOFQfAHlFq`8D
zmscgT@a}+x)>jpMt0!IImswmFp0QzS`q_}r4USVd)t^XS+mkq}KEQF8zC#x`@8#W|
za{m;ivlu?C%UI13+g{mdTiE8>WD;n&Q71`0W48X4;~yNR-Z<R2_g{G>SE&4A2lm;f
zN%>dat~`BwkJ-_c+IjpgCl@+dY;E`=uvX#ej{W=JZnp@UUAQ5RFW~jLHxqx!<Ww5?
z{GaFdPNanM*BY0i{qK&d-e>!_p80kE$D0$s{;m<awS3k+<E4|mtz0Wwy2Nv~3)e|}
zDZX@kcGCr?hjVv7*vEG&+;_d&Kku$nUkiWjxG2~7f5P3&#T^+}EEDS=%sw%3(#^f+
zJW@9AGT;{Ut-bE$?7ipkJ@yW>uz&g!KNQDTdZazx)-x-5y3(g*8baL%UTjUu_l%q6
zyk4!w+njBk{Q_^nw`_%4uX9b_Eq{M;Ua#Kb#X3e!T;@^|ckYSj$SKsY74yj%)i3F-
z$`D$<*>ZD-IJ>X)i<RGkzMWL@m~ds&x4P{Ges_D790hFN#wEIc_&)ROj?LdvkH{|R
zUAX6moPqtLuf4ms*M|j1rFB;4TRg~p@O|FCmK!fuM62&+EuU~B{NI&&ezCT<vtRyr
zbdDkI!K1m-9PX#{m+m^(Vs%7$e`}!4#;fTn&vWEEm+e_r&mt2#ojJvwl_y?)?taFt
zlcdZSu0Frw%FXEFzz2<!CS4a!K7Q~*rc6vv_R6y#wq98172W-1S3}P7Q@1>8bziwW
z@npNTK#{#=mgukcIM0i#7ZljcT$$_iUneUZeT7^8d_l*#j0_Chm>3wawi!U}@wEIR
z&{-+DfoHQohvdK3Y&&~!w$N(n=i4qg&5B{l)F|O^73j(7ef#p%qzO+{>z3?uo4-am
zUEEC7%JaqVneS(F|M>a%U-(ZC-CG?`o84xwQ09r=@pYB#hBZ&zVh+sxT)d#pBOrI(
z>P@#ou5XYQ*q2-)W+HdN!rn+yXw^sAhwtT2d^oeSk$v`s59uHDR=Awwy2xto6k8rV
zi|Lx_g%kChQ?}~qPS7}#wKXfmC8M`XQ2ECLz9lEWCB(k8DVdyW93ttpc?ysCqZN-I
zy_}XdUsCJPyBAtdPv)Ae6JNA$s-evx@d~|tzA0a9Tivg}>lQyav5eVuLx+`9(FKJG
zvIYT8yk~hjZ+FN==dC}ximg~SpV6o;r234qf_CBhw|3`^G~TCgT+&p0c&)$z_vGVe
zCoB!Q{<>q??k2UxCLimPxTXixwW_BV?mqDOq()}MBIV|=-V=#2Q{t97{wqtluHLAv
zacs|?OYBxFTINr`?xd@C{;efz+v5N1Z96SjZk+k6wD9=Xrx825w;z=;aLHqc`L1`r
zo^O3Rqy5SY$93O4Sv%K$!{?Z(KhSzy77`ud983%hW-JU0lGvJa1^LC96`*tVf_$^3
z4F&eT4(B<SxcBI8i+4*Uf;xo7ePXQ>#F>`rbd{xaXDv-t*&cW6--3U=|2BC^TYubT
z`6b}4$>)2s&E>^6?ApEe{4=iwg)`22nZ$XvnzX&1)vcShxaNf3gJaitSDw9gIHSVy
zl-uEps%y4$$X|$LR;_c*eXTX&pz?aFmizk^4k<r3J=5bZJ1HdkQC#HV87k3^fhXqP
z7ZhV%q4mV3AbCx`V&BHN_2ubvZ#AzDWT{tLWOA&jUtojKsu!-S*(X>lCr!zII@_i|
z(z?SdagSYHO|bT6#&-#|1rxcwD@-nIGrP;ZCVGB<LsYT8Zm9c(l;tIrt26SBPG3>-
zYkom{k0|SPt1YFh^Cw--`83mT;m+4Zzn(L_oMFhZ-bJ!a<d>^f*FI<6;1l-_9g>pS
z-tZ&I;(DXz)MEh`uVwt2yWpWHpTf^+JPf@XQY8+AZu)FgJ$Z@0(Y#sdXMfz<_|&MY
z<SASGm72=W`)1rb+<*Ch(kGqHw=xUuJI@4^Y?~t#DRn?LXz3ho;XLNd?FGvt^tP1V
z@VDl8bn4;Fb-zxY3gftzKao#7YO<(A+FF?c-xH_V%JlN?=R3bp<dgMs)!4ICt^H-(
z&k1KI@3)Fr7d5}|`j7ZMr=H02w+QWNJ;B%a;m!q#eaY`^5_SF>&#<!XO!!(L$XszW
z^YO6_=hpjvK2-bXww%4*rRn;wR<1-F9bKoHe5*Nzf#FslBZDlq<WriLS(aK<oCqEm
z-TOQGj@u@KKi2iFP5yG3ZyaMDm2S%M@G<bKxNc^{rv6**jC!`4ZS$cXlZ&h~1kT<6
zcXjFdNo;J7Y^(Qu);*tRGilfA-K%%6UcKt|rz6&ORbTtJn!gN4SsG#O;S#oVafrz6
zd+&7Q=5=pfTaf&;bNlr3&s?qS*6&%{dv@*CwY_V3-#>||$akHY9;c*tRAs*J!cF0w
z6}vWV+O%ueuGhYo90kRT_2nyF=cxX?Vl6&-rpBJYxxA}Q&Oh>uI_s>ldy|pYgJO~1
zSF7|~L@HmFOcS3fo*o%@G-BHmrOi96*mu18EoifD#ipYbV&Y3LoKIa^*R^Kes{2p(
zT(M`|@+)>}aB#6fi2d@fOT5xu?L<;%rX_!^GV5F&80YglE|UMr^L^6~KX|02|3KVk
z>T}`3-v3uZtzK5Qve}<e7dG6&=KABrXU~;wrkbxZI)1#b4tKSgeDso+h~Gvpj(<U&
zFLS2&wfrhj`VfEM@9HfL(>^8L`+o0e@WdDV>lbd3`&Gl{%v@8c{%h)vbsJJ`@0C;}
zYIQ6+QS|kLwhrT0>(12`7M-VqrWAQC-{HhoYULSnf7#@kGxrZA#=X$H9CT~HT$iNM
zviE<d_)n@Z5NvObPh`>7etE*0)BoT5i*;MRU;cORKL5SHJN7<0DBnNdO~7$^qO5Y9
z=oRyh%@P~xL!N~4b;KJ^J!CLRd3r1Vvdg;;ncZKKx>P&j>D<CMPj70-UT0l<F5IAC
zw@M$+#D!e);YSlc9^NCQx;A3<k`sEDmCk2;K5^*xv#H$0R?U&xUY}2YX^p>e^fFJI
zoi@v#a)IeeNB%!)@rixAL+*fq<o<}s%g%K#_^UkYy?Lciv4BR(mu)*0{zb~(FWZ&V
z{3}w#yJ1($LI$DjiOynwzIASY-Rr8>Rnjq8+vY}2k)WF}gDBHaPjCHsKA*IIsLw85
z`O0S9p5llTN^8$GUN|BYp%MLo!Rw8s#rmRrg@!c;X8Ag4$;s~hSXQu+@yPtgN*^A!
z-v7>4Iak$M{b4%~!`y8Xue_Id8=0TVT7D~$k((i0>QE|!-9GjW22VCmo%&+Q#V4Kj
zqdV<P;_4cvYX`C{X5-rVcy3VnUwMANKX(7;oL&9draPh5r}4q6?eB{$Pum-dm1NdQ
zUzF=r>GJyeHG=1}PG$2J+3$-quCTw`@$;{l|Ci7GnM=QKsQRuZ`#|8z<LCw1nQGt8
z6<d^E@y`Cc<<)JDJ*(#~nRhPX#Z3(>@r_sSA7+wsDbmsU`piRQllWWn^+z<=X7z7Q
zueGt%Z^^j6F}^%h=Tjl0`eFW!@6J>U`cGha!}oUG_LpDvGugI&o~U(khLwd>n|L78
z(#@-8xMxOQb2=~cc5jJE|0|wz*H@f*os?0#mV1q8?6knh^Aq@{Tr}~2)u}n@$kEVQ
zuE~L}K8A~SNX(mk-sTd=xx^Qa$D<2%+hpS#BziBseip4VS+@0Zj>Sshi$7DRly9BQ
z|JXCU@($PA?N1fn*4XM7a$3e~9buUN*~LyeUa$S!>?E#k#a*YmxdRUrtufyFX40JL
z&rjTPcqKc5@pY(T!$AqIJAAL!?wEJbB0=ex={~))zgKk>ws{?>S=rrx>5z?pYOnUg
zDF<$bvU{>T30)`r+qlexdE3IC2?rUbvDc}-yucVZW%G)r+<<w^6F1n$9CPiO&B$gf
zcKzFQZ5M$l`dUw(eVHC|n3YTJ;qnzC#$WYx7vIp4t2s4E$zS-lucc4$ktMDg555-I
zwTZ12@03_lXy&Qk@^@3maRb50KNoCC>`Q3goqz7}mqpv=zdrPDj+mdmdS=+|^D|e(
z6dW*4>os2*%NP-LXRX<?2XFId#x7g4dC!)4i90ywbbp&&v}k@p=chRb#E!FneRy3a
z?!d20U)4UoFTSzm#MQ9kze3XlE=)V7d`0__<(Z#Lu6eZ13t#E`G{Z~KHIikC@A++|
zYqAe@Ms%L4P`Q=A;6a5>$;JDxM5ayIT2Z&UIO3%N-`7O~8;UM_3x-xs>01=ZcjThd
zr4KjV*4?R!F!FR)4veVYuwt{u`8&3U+S4B&(G{<o(Rkvq!p!N}%&Q%89_(C|sL*oh
z($5A_6}h*(y)pqe8CcqXDd@NM%2%Gde6M}$)(56ROIy<T!-RcqUwN}2%~N9j%N++M
zJAD*-wKk@IqRI?OfA(oP(`G!JDK2{1^}Y6uz7M<>%S4|U%-+Mx&3fY8+J-w-ML%8@
zNbhh;5PevmYHP#(?Y)g$+?SuJjLSc!@F_*bF(>oaEO;V)`OIaR8o&MzQV$|+Ol|JY
zFiyPvI%Qd2_^!$|xe2f17!_?>Prk{XHbHI{vz0Zo-}`4}uBU<@d#-DZ|Kr;vxaRPV
zRb32x>+L4|Q~Dpv@NVz*k4r@M=ALA(cldc#_@M=hjLcbnqX~76e7buWKWsg*&#1~v
zX4Us^KN#3fs|xX-FP_%p#QA1{Q_CT#oi4qMUZ0LERNne0RzdHWtBvl&oo#Cm>^LU3
zj5*@c53%$26z8Z5$$Wf!W8E6h&8lk3?``z8Cw^%>?7xDsQ1-B6OV2)siyOaelGzpW
z?663Ks?aU1%?DSnt=s*^u;@a=#tTzkT^4&D^zUXD!<StB(2qGs@4mCx-)`)7X61d&
z@JBiGe_HH(|H<dY*E>f!*w^Lgq+j`7`<F|7?TPh9?_bGmWpImk?2tZWwEhF5;TfYf
zs*H>>S9hEZEjQ=NnIz8mkWopD)xx<pKdR5O;B|Fn?AceRB(3>^_yU~{*gvp#75w7F
z%bD=yOgMwIk<N-!_D)NxHZOR7Fl+k!f-;*o)+g)(`mX9IDkN0M2^e3DK6vlY`UH!m
zl8#@3`+v!8N^cNM_`FSeQ{{c-dsWg;_SP^JWD0-XyWC%Y-Gm(FId^mJeZIEO`Qn<k
zqZL^p4vMnDn|Kd#{(I86xP^1JShe@-ZAxnnOuD@|H$qFxq*tFMfn&Nk&nKy0F~4+z
z{4<|2GQ8lkne*`y%bxGHjPYj#JDJ-GV^pov=A?1-WICwuP6<1q!!j#O{HB15<@;{g
z{KIEL1(!FZr>8FX@^s~1gRaD*j8(PoCHcf=zjLhLA=tL+*A6G)Mf`8<?RC%TJYbi;
zZ{Xl!wBR&P8kgzH?_K8-It97DEnLs7d1giy_Xh*h>@dC%y=j@rX-^W~emwc{#m*hs
zY%(_vxxMiWJiL02VD{Xv^EtQvcog5`(|VHQU%9$k;VWSUUh6%pA2^Dz+V1eac<eLZ
zgPDcblWsI+@)W7*<Sxo>;cYp3_&~F`pUrl*c{ZCZKm2xJoV>-QYX4!@>jCF=wphLI
zET2&+e^2&LGOw$^75Br(Fa378V5eAk;IkyZ%z7E7tDCd_9(prDulww$e4CyJk}KF&
z<p!SQ)Ay==ccsB;qN?hrl1BM+&-S@alYYz?wfL36N<rZz`%*jJ6m=-;m`<y@GPO^Q
zLuFt7maj){cN_2j<WRD<lfAil`qZOxVJro52hOXX&`+p7VRB=`FAv$}rICu)+e#Y?
zBR5|?yHIa$MNMz=-<jpF)-%3-`7<`5rj_NW$OnUOGn0?#U749S^VbQpzE>xYy!|8P
zukq!-;@qP2hn?TK=Y7aj`>7=)&|&FR+Rr|FmzJ~X$A7o~K0aK2@!rGR+jqZ@b5;L+
zT>ZG+r_Bbvlh`+ynRtXL{;`+%nYVnwRO#*W<3+Zw=zb!+ZELwoY+N7nt!>+vb9<Ow
z5O~`><Nw_<$>)rhHg9ITyQ=HwHs9_`la_I$Sg^MC_0030_eA}Gz@*Lt%dgcsFUU|X
zX<THd!!WJG%)s%<`R2d}+rvYW_G^4vH2asi=l&!9%Z&^!oL8A8oiewDy+WO7a^bB;
z`=i?<ZkUw#-}Rfg%vblAgcb7(hkKLkHNHJNeDd|y{3VO(IDS`3TzB{qs5|Als?N2*
zs@}aHcI+3LBjl7&t8`Vxf!T46&a~FvBNbn^<aNDtJ*zQg(XEh^n(EW$6o{VRSf?1E
zBKc&8uID2Gg(u<~PaouH&y%!I6!w{`Y7)v+!192l_f_~3$MBAp3WnqS6IAo0&(|Jv
z=a6>UzQ}>)*AwwXTjer|{@VEyo&}2+yl|T-{6$PRrF_xvxCFHg*CV>~0+)PvH`_Q?
z>Lusm%^Uk<Dl)5!)fQb;``5UDgULg84!=vDKyid`ti>U-gWeemj{EL2eXjpJt8d3F
zm)X*cAt#jE;&pdM<SsQ0@(Wq<JkxRFY7v*fd_BfPA3W@s5{o)&Y#0{34w+Zme~f>#
z@1YOAkG9-q>i;`K@%O&!J>>-o*Z-T$JN=daj8I9Imgkng?8@)HPSLowtCsT)cVL21
z>z?epo$QATzPIn){^8JxwtIR8rW}W7D+u(9{=8?&$o=x09N$FEd*_|=(<?ItruJ7z
zzq;)t^kn0*J$&qER^)H_8PIUmyGQh8oZk`qFCKf2@au1!ZMbUvgEQ^t=0EQg)BMO0
zC{@wsb4YcfeEFT*aT0A@p0B=T-hNZoFLK{tVW!V>v31D;Jr7&vElk^|^3{9(w(Tzb
z(<H<zZHv7;I=Vy-ct#gol<EI{iJM{NQ5iNr9!LL+v#$p*oz8cXZ+mXY7b>!<dS3hw
zgWSSnUj&wXa;c9Dj?a*MymeVvy2gxXjZ@nb<8B(P?+VcloyPPl^dje%TWqJQ_?Wl7
z`Qb5x=}^@2lU9F>{e-VQ42g4i5uYw{c@IPBd9}~;+RAed9-ddnHsR_ay|9-blHT!N
z@?wsDsu}yXt)wXYxg6J-SppH3mUCx02v1<Kyqvr?U59_m$|INR3R#7lPj3kk(U*_8
zROt03Do$?MqCe7K-156WubMUW_UqT-;o*u}_MZ3WT)qBCYI|+dGnUsYR?8nM+`ez?
z#*bHzeO~+gVWsI@i@lY;vjVnMDNbgWkTPCy%E^8H-E(u+N~<jN_1PV+#J&DfcZu30
z6TZ($d;0ue@7SuWwtwPQ{rNKImp9i;;#0n=<*0o%`VjB^yaO-8I8wC)e=I+G>*h<*
zKmT{x#94n1oOdZ@q3@C1|E(JStk68J+z_J9u%taUanYd!G0j^qUMszgn!hrpS)EOB
zq5u5Sjb-YY;&;Q(huvFP)%P)G(T+zvcWYdx&IuLLk1yb4`En=Z+eM!@9|Z3B?>Sz+
zW4c)um!Y;w){7Ypb=E${TI&0*vbU5sr<)zTzjJ45#)re(vlYU5|F`Tp#Ju}^?dtip
ztCMXjw_Gf|VsUvEv%KG_eN{JSxk@pu;wx#-`S(0jFG6?z`Gn(4t;?0AuGM$MoDw<O
z6*qtDN7gwf&vZ_mv`-;(hSUZJr!Lb!^ZjrA<a+;)Rr18tNy{B4t@KUWAn@VQ;bIN3
zFILslUu{$hG`iIEtD5P(%0;d8q>gW`D-H-Aux_a7aanU}Vv&G(-nLz<4IaIWylrA6
zA$2)o@y6YU=WI@!a8_lTifx$7&Q*C2Y@a^uc(XOg_=wPE#feUpq8HiiO3pmmaFuz2
zZ^-5&*Z+%tWxSyq!I~((l`HWi@A=ZXORIj)D*1cmsC1-Y_|8{)B?S?_&n}qBeRx{C
zH*9y=;h?;di5|vxmrJLwaAIC}?5&>jujKaWFA7UO{5$;d_qt!RWB$L|_iMk-iv35w
zu7AJ!KmTq!&iA|=$G<yT{44nI%8%n|^RI$>>AULPSKo!7e)RA7clX$@^Yy!bvwr=*
zN$1_$UwqI0ZPIyHAJg)CzfO1cZvOAvFIx0lv;9wsd?G*Z&y~>suTv-PU+~ZTw9@@`
z?-%$vS?m=5X+QtZV?U0oV3WQ4&#wuX6n-(T<^NyJNvoI?0#~nIy-rKvj`J_6e@C>W
zuS7MZ#ILZf)NDTdUnoI}<({?rv>$tqvlULRjK8%xydpm8RP^ghx2wOMah~fmKZI?A
z(X(>}S(RRVEa5HcYg|Itgxz~O)!_S`f{yEFOeXJ=SMAW0a#r4L#duHjgH5?x$2WGV
zYv(f~j|;!wv1+o(_bGzm^0!@i4a(&U4&Au0_hogdnd4iwMn55Df!$l`ik3K5F7~tu
zdz^aZY9!<3{CAgLzK`HId%XYht37fP3=*$A|5IEW=CAhpe$C%M*^`1dY*o>1H<kbL
zgdu_DSKFfGk4KB6+-|rX6%SA8^xqzR<X~Tb`Hs659~oDFxp&8ZO<VP9+e=r?@BiO&
z%c4cLH1zl`7CxC7y|PzMo85@M8W^$j)$-_u>OL9czXkR|=O0M_eO+hOf4cZb(|?vm
zrnLf!g%@7mj4^)jSZ|qRxt!xQvtSOT7q(p=*_Ks5-gb1lr9|ci%YdJfSH3Y_`jyl;
z@9@IQ*WbTOy(K+2+{bFt?2?Sam-<_0yBhSaKmDaV@viuzgo}^dX1Pw%O;M;{{B>4L
zdbgNtQrm<JGW&PhD|fsS?0ui}VQpm0JmozLrMAa41u?JIxwMJv?>AQMGKV<r-E03^
z_FO#U*>bm0&P*l$eo2Duz8nAk%nkBZ4zL$1XOD8@cDrfy&xJG8PyFV`Ooh2KcxUg(
zV2-g+xtm?eeo8>D!NGFvzWWF6)$V9goOq<`h_scCr>^az-<u?6eVaRXe&4&Bx41LA
zwI1JF6SZ}YZBqHt{K@C{x#~@qUF)WQXnHd1j<l0nHaZd}SEjej*3#|diS>5OKexa*
zLGSMSBXgye8(q4}to{0;#@>CiFIZ<s#&|zE`Gfi5o08(+Ixcfl5--=+IvH(xu(4Kn
z_1i@s6nPGBezrEJ*wutDo-NDt)NWtD{yCC!0&4d5W(gm7dTZI9(rae=<y%!1r3|cJ
zwO`Ho`17{zv@DCRBl)w=Dz<*wwx{5wLrV00N7G*}?6Z!um2*^FWPW0NQN>kdZK!w7
zQE}@#Mz*C+hT)g4d1nijzV+LxSfycI;2xS-7qIlFr}*~5X4y@W0`9qKi)Fa={J*WK
z-Fju)L*Z)0zZaJY%G!xFmOVH;ck%kiwNH;dpD!qREANM$;l=B%JJJu>{O6E8A7ITY
z6J&SEr^d5f<io66EyW5`r$@G(R!@_05z=$AD>>4uobabZ^`=DB*XwaQKg?u~&6G-F
zsC^e#5Ycc?|3UP<r*5VhyV|=>e3s~){L}0k+k^T*sl$`=?3XW{aN2d_fsH@bifzdD
zi;bCoGS)Zj*0Q|#+%ImKJ6~?he4!%sFyDTGQFMj&5@v=YJ6|n6rtW*}+~4f3Ykuo3
z1ASDCmUo{EiIn&I_+4_QrMPpl@CCaC(WOpXY)?;e_<kUYVUvQ-z1w&9&gZ-L*8P3i
z{de-o#&&aCGAdiy?*E&qSNNsw|JQ@|Z=4jTed=Xyc<d*!K+f9c#H!jK;gvHEH63$*
zIjQSWx5mXR*(F)U+|NV9cP`Ic-e@5l(9i4RacFv3O7M&M?s7^`w{2XW#$5WQI{xZZ
z@jp-Q^x4<_DERPfYS{XJB^5nxr)Tp|IqUY1H{OopOZjdm_RTv&&Ky{qb;~?pH`l$J
zO~$6nuSiJFn7h;9=G1)4fGob)3~hbg^p64m`HtjUPbxoqF@LgrRney2*=Yqr|4#fn
zxcuVDnM<rp#BaxyIQd)1eo1&J@oV0rsf*0w(lc(qGg_qRs=ik6Bgd1T&w|XkbLM(!
z==vO-qjxn<zW2w5)x6c(f3&COx5w_UW)zTkz2eAhk<_q8FK*lDx%bvBzcy85!Ih-s
z1m5}+9|{;FRx~<p4P}y%t1M8t#QZ;I$%+Eu8rj&Vm)1HS43M(8W2AX6c<PqVHIJ9h
zoOHP9efvHBVuv3l`;W+K*+<88-HNYGZDe)-uHgRNZJ(0%rNXX%8kb6#uQH!fW7R$U
z<oB%?rH@bB_)gG^h!f&c;|q;>9B?_yh(CAAi~FU=^7L<?ekiK@b@!>rNfVkhnE6i3
z4ynqReo%Eq*Mt1oAI!Plnkei(vWN5I+}vx*<qcZNVv=$PAD@{fT&Vc{>$}%6m$FQ}
z*s@k^-BBxbX7S6Gx3gp=TB5HoJ^R2bl~8XKZ$I%=@GiOO_m*qvB`mLPdOD}w<_U9z
zYeR?7-hdn5_|H#xHRqa^Bx@Se*MkK;F&}n1DSSDW+U+7QYRuB_y;(?{B`~b-Rav7v
zlgh@8iIW!Z{n8+jtlushvZQmZ<iC`_?f$Rl>)iT$GWn|0XOBl=F+w{hq^;2_E6-o|
z;cETlzT*@6R5zaflI-~Kyq`-6=gz)V$+}l6rmG(Gan~}gy_g`I_4&T@t{10bH+0N&
zDJr~kUP9+uvWJgxpGf$J=asV6b-G^HBE;KPy-k*wv!sMmS~Ba=uO4>Iw%DZLthhT{
zc<mK0*_mdxEP0U^ZPqsPTzUQV8F_E6==rg{wk&b(n<cg2w`tT)z0e6C<2(2^GkBKm
zQFtZbn3i17|F_rn$&?v^%RjM%SAEl3a9BzIq(%N&At&#Pdn=bZ&o}+-yWh@8LT2Gq
z?k&p4-^D5>IzARsdZ&8#W9Q2?v$nr8)ydmF`J)M!bd^Ex=KLiqi>J?=G)KzJ|4;^J
z2UF?NZ7*#0C*S(^xM-cv+rsqYZG4+odwmy~_EN+{)nERl2E*G9EeF1PVUzwl%nNn3
zJGi}s?b3>i-Yy3pdpguiTM_5JNpEf5jinuIs*iNO@I^ceK0MXVB<JwTg9jN_EfT8{
z+VFL1N$Ij_JNa%J@Uooj2+A&P)#B56FAx+u;m^Y2)1uQKl&m-SvZ1+>^NC8-l|cU~
z&TPy1USEmuy}V&3clG@C-LKUA%jYEgRcm?bF*Ek@#V<Y|ZR(p6EN$bvvJ4*|P?wFo
zG(GgkbIqI1D`&X=PKlRUk^Szd3FFV6lz_9oIfDGo+?J<U-^Q*<^GKX*7&+_N%-lN%
zcVuY1+Q_*)o7uFLYqr|vSM3YG_S}|YP2-e`Y2H*YQIW-YTM=K?t4*!Bvow};H%^&;
zy}#-3!Z|t)DL?;e1jw8^_UYtf2Alq-rA^-@GDO0j2X3%X=x^2PTk%;VLQAT@aoOGV
zF&P|gQfWFZH*%((e*a>H+P=&sb97#;Gfm!6{Wr5q+E_mH$<dXw^;l$bmTtHew!re&
zMWz=LN1YBXn0GS5Gwp|3*d-<b-fFh`*pS1e>y{oq5Mh0YZ}XQOtZNw}<~~{A)z75<
z*ibUU=)vX14J#7@r6kyzqojg3pDdn~cUi>sl#kM}8C4<u$0Bp9K1YAs(c6D;*_n0q
z2Ri1+&R3eyDqdLfqO5%`_XEc1Gg5yPwA*hiYgk+#AAG>Qa=S^0UqPenr`BHmkPWx?
zO+WK6{eE-mo!672zc2T+I&E+GeL}VJj{`mIacK*bnyg-)jHo*Bl<(OKmRGW;A5@*X
zDl&K7(#vy_qW%W*{EpbiJGakW=DY)|QNiKrIlpeG?%{}ZZkPF?7+A7wuh+>dTnr|A
zb|)rZdvU+_>t5-|*JZbNKTONJ?dBA9!8xO%>yZ5`soVFzEqLp@MJyoE`uh#e#z=#l
z)U|7#2`f%a`SalA(|Z@$uPya?EP2*6uH_})kC);1_Z(1L_fY=vjz`CjemPoPBcCk#
z<K`bVv6?w&+v4r--#D=T!{(1q*T<XNeQ1^8Yn;AN%9?-f$0PS%z52XTifz?%=Ge{o
z4PRa~`P(aTn)7DJyi@DstMf`{3u~GfTX)uc*AMUZvJWpO`ZXV`nZ0jiw585#@5BI4
z)@363ACGR_#q@od`^SbCOWNiK>-5*H-=G>Yr)!IoTITI$NtSoTv-VWH`xp>sQ=Xt;
zohI)Z|3UHR)v(*UJm2wO-xz-^bQwp+ueCiV7mJD2^R@^2E@apBooRZ^`gClElJMm9
z+k6yVuB8aA;y=4AH)DlnPg<jv)ISZa%!-;LtrusxU#)+nVSBOtLh!ZiUfZ7iTxcQL
zVDNGUPsN@|?^-04YX3?Ztg||t_a!OH|54l3_IFnte|pz_eYEq<#jpj+(Weu6p0!G_
znk7~D=8NggHtRn2RR3gq>IzFqBT2EFQL*bzAKmU(yq~Yx>C?7(evdasIDbp>eRah_
zPceD=sjos#yV7qxe{I3_iD^Z}$31VSt(zvY*5~@&IX-vA8E)UG*|%LnB53te$G7k9
z-PB)H!vEs>y}Jh_rtnw^%E$$;=-jt`wbJH`n@zJt-2B(NmxPGkT)O;G)wD~wqSuuF
z?CH78DcQc*x8m~A;wZJq=QXFD%WeDi|9bZG+V%6z^ZO6y|GUKfxTx%IgJHvCZZTi!
zAffnWo)x0$$zNh?H}3m*_1CrQub=-6ox1*`TI6KzvfK$_l7DvlEqGdH-Wbr4_1pbD
z|MzeG{rvaccfbE$XJv8o|I?$z3!F1b9vFT5G{Mz?EtxO!5#xk)oVEN#fsc6kA|Ef}
z<kEWNu}yy>*XFzcO;Z<TmL0#cOMh*-`*81M{`cSi8ZX~`ZO{MMGt!D~8B-@D`lWxd
z{O_EWlrL~`VphlD<n|B0`wle6i>;i#MDFGD#LmLYJC$#3nL1CSZfcbVi_FAR9Fy+_
zJculO*|KAjtNzXT=cf1`Ib##UD;cm|Sa*Jd+M4x7C#Hq!2p?BY+9s8l_oQNp6UQre
zt!<OLuJ+b%3VE;~zH3sLK+M<Uf%mQKG}b)0zTt1=q7I()7us&>$38eSJN7)53R(Ni
z`uvZ^?HlW_<va@d9rWAr$Cm3E%mJ&T;*Y=G`S0?-ciO9c*6+WwV)-J8YYw4mca!bq
z@0)(P7GC}2hoHpCmddB@J^j%U{sya9WM=nE#6<GnDOk~aaq9H5{O3O0n*a9W#c&A)
zFUE4-cYAmESRVN&dzs_Fwe@X@Mioai*gwAC*jIE<;^Bku&)Cyj-k$%)@lw0(>E1K%
z<Q~Z~7e`NUwh9ipvuTd$@4YW|a`r9IaJ%;CSMQS*Ydy{`k?GcGdf7Mk9rKg*_p^4-
zoS;2b%jJmRJymaG-^?j17g?RTx|OjbEHc$q;gLaK=2vsh#k{feZ7*#)sI_Uw^Pr3w
z9f41KM71a6X2dF(1#n*ty}N*qo7wQlBr)HdTb<{Mj_HbUUj6hU!smx%o#{=xcRV+r
zOw!!na^0CbsU$h!?Mz{15$4csJ5^iGx3iqAc0DkmdTrCE8O@)*txWfuXnp97`B(Mn
zPgUFPGd3vM%fH`SEBbfO|9Lz4?bNcZ{8n^{xYn9<-kHRd`6s(?!KF1^8(zF@3*`K;
z{e9V<v+JXSL|ui8Pcgdh{Moc&Sz_*?&i1RfH)@uawu-)+xAelT8o__2cRnl?6SgoC
zoOH%ZH9V|f%5nDg_lqVU-tYeY``sI|t@1TK^S=J$@O!-Ve);u(pWj6CFTJ5IaeAgO
zm!Z9)vytZMGO>AHDgkPL-IcgzzJB)iV)W7W8w(d(%kZ9FCo#cAq+oV{NYAC1=QbZx
zJnH6XPkQK?G5^fD$BhoY!J4{#-mAN`R_zxo)>XFBaF!Ik-uOs8ymx{0#ifT+U+iU^
zZ2mMs^k7>5qvx~S_q`4{AN|&~FS@+z@|79$1#(XsmemA&J13WM_|^S8RR_;on{T(h
z|MAvjMyV%<Q{OxKwdctEUOUV4y<5|szvs3e^jX!uBXmowmdc+z<?=iuDZlhpJ5I5S
zE@F3HTymKG@T(_3;;)?i=xk*v_+QCq+uXPB4m{bvV)Enml23{2?D}6lQ4K2owxUyS
z`uoUl=iTow{b*d}abDo1-*KNhnf}W{4{R2kX*;;}B-_I&kIKGV)_jkg|LgwK>EB$K
z7$j}lF1rY(bj|Eq-hTKRL-dh@PcAk6n0^29%ti6Fwri$Ityv;dT;e!?iGuY^H@2jf
zK!&9AwePPSH?#cBY&}JKO>p{yt=`9Xmd`c)5$rD8wJA^Qpp0dJnAS|5cg(Bn?ytQY
z{W9yc$tIl=)@|wY_eunOHs|Rx5WFdo9KE=dF|4IoI<o2Wk06i3`&$lG1Z8qJm_2-`
z(AZTxLCob%c&FL2!daeA&(2t6w`GpS+IvYR3Z-klYMM=mlYW&Ia(Akm)_i`Qk2PX3
zha9)3-r#>4S$Tg~-VsN24L<8{cl%^}X5MmQyCPulxA&FManAqq@^YgWF1Verf3NhL
zCleF)?~u;<=CQ%LyjgU=t<amt3-a#qe%-xWeNC0jmHhYf*8g63OD-`sdF#@q2CgrX
zZBajZbBwk;GGDqrH~Fiy(_5z|wfDE|)+tNvoxYsa{Mu#psXF@?WKVf<?B)D(6N9(e
zEZBNqG4F_R`sYoVONHm$uQJ$uP3g+Ah0Ed&)i{2;Z!_1^a__l2E({S}`%^1L?|zj%
zzuoE2F}vofIo~?_U%fx~@^H%X{ic1kcjxTtIij@7<@VMMyVuNd&52}wbKCyqd{Gg;
zQav-#xl(n@FITPdtdb1R%#56~%CV~c#r*mSmts_&o|^0@P-6JHx8dL8qtE3(eU_iQ
zdimUdlRm3I=|2Azt37XzMe57;fTHdvvl!paxUXmUI`7cZSGw=tTW8gMd@<|$g=gmt
z*Vx}Y^z5(h9pBBl$)}HR`|#HG$KJ^{{w<p<DpcDh&k$AC$_RUqvWAK8_wKp9AAWML
zJg7K3qt8b*yndxk%KVB5y*nQ)%pJLA7b#eLD=nD#G(2m6;U;!Y`S@uECi}Xc|GabG
z`lf9Ai5s7;cZrm&>nX9_(;6%(J6W%_Tf#EzYP96^$U{FJk8V~<&N&nFcwy_#mkHP9
z*lz_dXTAMZL;JS+uhm!69(c1Xm1&yXq#v|rEkkSjt_@m>o*s#RY;6x&yv~vRd)Q^s
z;WW)4VGWh9cLewKrmxCcd8T@;UX-At<XI7xkb|!tH_zZJnUHZv^xRDsmE^aYdlMe*
zP@bzDnVKIoWsQK*oz#c_?d2z@EB^U!U-R1Ht<`;vZ^9*)9%}d<N{k6>>@N{wv}oV$
zvb1#1Y_=-fso#&D3wIBEVePax;giX^pha_z8s7Zyxxl!_kFWWbSJbj)i!$C<h8?Z)
zo+8S@C-=14af#N3gNB;dx_54$uKtL9!q;<}siw;!>*ezPq~^X}Z=3Oa_6O~%%^$B`
zYZE`irFho%>Z{7he!-vYldrCgvo<}G>Uf<k+_HPhi-!sphSF&lE`IJ2T=H1yOWncR
zT2-6OmH!^!o40-E#*5p_&N3{S%gx2Bt}Q)#@}@&fH@2Ua5W6k<+c&^1&E}Z*shfu`
zrl!Wm%+gGKuIfDPVWpNH>+(bAmVBJBd!N5WwtU>rf?xX{TJ~4>sMSck*r)QI&u4C{
z*Vi7td`qvci{a-d%?LWBYRR7Rw4?fEhTif?Z?7Aet=qLQyjUWAiqwWRE^}5iyx-3u
ze{4?2%Q>I)k`Bw9^XKX@(wzMC{|Qsk@(Y5ib_Ik59{hg4?xE?wc@_UPyK3HQ`7+d~
z9jg(xKl!=4(c(CRd`{nbretA>_VvGJ+&I8ze31LF=I8eBhFeaFJbBEu+-=tE?&)!>
zlR32IKkaS561jr)mzDc>wmB;!V;G~S6;6oqlW3j4<&?7in>L^8_G;#{|E|5AR@}OE
zi#V^u$?kQfE(c!noR(xb8k^(r!uInV`@2%2X3a5Ip3T~`@<zn(*Efw<{l8q}wvVs3
z>}8aL)_>pE_sye^TOPNnWbfMhE&h4TfmKfXZ2naK|I6Qg{P(MUE0mgr(k<J3L_4LT
zw!2TweX-~a`^U9=>~Fl#EMwZ7dgRTe)|C@8I$vLT<H8coKKX}C#;t2^J2px(bvBkx
zSpP_1uKt&A|NaVHcvVr?9jsel!@u9`L3sYx`Q`zo3j@<D++HaMN>1LLxk>uk<jm8%
z{_!a<x;Y`)*(#E)IoN(?Y|nKWVHuO+A8)Vz;}>L;=)6}~QC!pz=6JUI^E>;Q4rlXT
zJjkd&IcrAl*;PNY{y#65zqhCGY8T^d6L*b`=i4kAgU{S%{$i2wQvPAJa&UCCeuwk&
zKT(%V!k0z7vi#HbcX=AmvJ_ciF)ao+zEo+=+&@=lu&44*H;Z94FmBrPEkC}(F?-*t
zv^%N=zCT`<MlKM&)BSwX#xiFYze{fp>0aTCmE^SI-6pp1%&B`j1(tq4D_i^i%u<o-
zw@&m$uv}UZ)p_&6O~Z9dgkz@qxo)0)V|iM5YR=4cd1X(Wf)2FZe*MpgIf^}QV^q3w
zOKHf#^N$|7_HZtpyU*~PVQ|3aYNPnShc9$Yy~B2@*k|9JhTKW_>;-I!?0)9_m9Y?3
zaLV%*%GkX&@ZX2FPl`+DFaN;yI;HH2+|-);5e-vHUj}wOt`vyXU8$cJJ;VCl`CcA{
z5>xl}cekB#{Pp1&Tc+?Ig<R)((+~9a$??dT$#OCGhAL=fFZMhe(PG4KOyJb(HC%d+
zn;yklUYocrEhx%!m*e+_%83a+pBPv<&qse1_IR?=E1`prZ_bPlciXp5G)cH?|4q#>
z`dHNw`{aMEP74wZWlx{bn>b^QOwhcH;1m@vqgCNAN*t{1O13<c4pxht^CnP4$RsK-
zKW|_8Q{N-|ug$!BjCWR2MB8qm7m>fGI9**8`uX;{#r?~s<&@RCF&AulQOb34@|l|4
z!wXa<O?lh&#pD#X-RHcN`+2{Ej&JV#xis+A$J={L*)^4CnYKNUyD#f@X?@}}@4hPb
zihV*ea!+q+)GN(f7=FaiG;49G$Gj`fKHrbE_s)(z`&Q|>!DY=&haaw)X1yR)dv61O
z2H#9I=d5LC)!!PW-#pIxC;C;jq5G93-nU=>{wEjpb!x|n=^;JLM}uXKSb4W}En1hu
z9B=gC!f(dCXH!H|G@h_eejL}U;uh_auve|v;zGCPnuhy<I_nnP`7uX1Xv4;^7l$qF
zo@F*j1~G8%$YEEVskrFWkEsvRc|OUBb2h2|i+rvi{`_NV*QcJujtP=yPFC={_|FWP
zYV%y9g}KAnhJjV?^2QSn_AdN1bMm|wd2Lbebbl)Bl3(%KwtGRDfq2mh>rd=bYDq8l
zANc=6F!F6_wzYv;*^m3{nnEV&d|RXzk$HUifkH*`1))p0FT9+PYm~`-bACYa8P5kN
zS87d(%(<&}YwOcV+2PZ?>}u!lbH0AFZ1OqR-k&F4xczoqZ6=vI>-_TD&!khQZ+Lj>
zFt>}xEzdyBw8k>211mIgp7pcsf8Fr)S)b8w&2wAi&a=qYa(=Z8U*97;Nj#^yU0ZJU
z$FG@=Wr`h|85iwTuT;O9;;b(g;kjv1UFy=}pSF#x_Kt$0feV;Krj&Zct(H+2*+1cy
z|I?RqALNFwyW~>c_-*dW;~Tzct~W@HSlqLEc6`3=|FrDY-_4iryq|R@cw&&lv=Sk4
z2icTkUSB4$ep2#?X6}f5y5REaV-Jj;ReQ|6mKTzq^R4HIqP|5`q~7e^*Tr)zX0PSH
zu2yKauF*EW-P18^uUX9G#j%GkHhr;Pw>(SN)Iq;Qa@D$^5(m~dzAUFo81}nVbBP?e
zzTM2s{JQzP_4&11*A>~U6AU}Ws=NMR#`Sd%mPoB{jM#E6T4k5h!aXbxo6bDm+kf@=
zn`Fh>>WfuItBk)q?KLo;y!yO^=)ae}q5sRio_X&X+G^OeNYC{`C&Rz}7HZZtSBg?s
z$F8}RJC{|yCzQ7!%rtfVhwxrwDY+76fw^7@x6ZZBw(t@beiIeEL4K08#hVLxbtl_?
z`pB+(wZ7K(4MXhPhLhe&@_dUVRU^N=VJle{zjnUQC#mn^Nz<Ko_$IGZ+rNIZ^;&cP
zy}IvbKI({35q6qi8tQn)VeP}cCl=oM`n`8T@eUuB^tp-K<~v_CWzT9nq&V5n-m#AH
z`)`Jq3Rl?FqMvQ=wEVy3l+3LdZG$Zfm}PB^9jbL-+Q>z07yKqWy+Tr>e#7phwaHIe
zxAFXFw@y6%d3yB0AHC*#KU<wW6K(!yXWXY7m;YZ=UBA6t_{#Kq*A~4ENN<|veJEuK
zf4X?ux_3Ig6|ZNV`&w!|pWD3SNLY4AEXPxZtDkm;&eA`4QtYnMS}Xr;tFGH7d2&pg
zdS&h_y^}u{cB@YG2tVVpk-O`O{+g5B0iJU`V#URBb&o&0-=v!H;o?@kCkgM>+HKs@
zS?}EBE}y(b?9i<3Hy2;MpjMK#pgee2`@~(ppKnSQ6PqB_d?d9$Bz14j4As?*?gF~p
zQk#Fgn5GgL`z0;O<H!8B%R*<~wp{w0(QK}f@SIr}V~THdW>+drPhZuj(!XRu(`u^;
zeVf%E3dUdZe7uG8=s_2?-Pv_h`P7o)`*L^f*K3&m{iGkm()kZf_6httewuZ<;F8x)
z<q5f7>dY^;7k8QLDK}g+XFvPZ%Y|nf!!P<@EMNOB<!JInlg-&Y4P|`gdrkfI_9<x{
zjY!t{`c<Lg{^pCR%yzHBqcnEzU9YS4eB0Hlg`Df|3eJuwQA^yg#UW_rv4l{OMMsnC
zUv&Kx_uJ0%T>Pa3+wCw(F2V4dC-Y3&rdpgYZw`2_`|rh#)*s)GSa)5NXW-*qwo&b1
z)k>W|wR4pJEC2m&pI5Ua?VtOP#9+(sr!Foz?zrow$vPIV6S)(cy0w(v-fp;e(tVTE
z;nm)|=P5~fbj~+Q4NrJcvHjSWk4tR~?Dm-`D)j8jc~oZ6IFqO9%`uJF8xyB+ZN9Eq
zdPCXls-OAx>)X!FV?4Fy*{t^a!tY&t4C{IfxM%R%J-M?}Z?V_n-H*4eTxE7;&IhYW
zt60D9DJwl(<+(k~R^(N+;B1#b!9zW3Zmne4)>FT-=%!cfop&;SUZu^Rb>IT$W4nYG
zUF`mE&*`SwEK}WNqWph}hvkZ$E_-JRE{!;5a#X7>tF-UY$0R342H!P2eRY1<8MLI0
zWA`oc5^YTOdTd?tly?@pY}xVaw%f$6ayS~jnrHj;|EY{E{AmIoPFF3^sF=LT;Ov{P
zw{uH_;$NHW=>AnzD4O^|LGs-9`$vA%a~uBa+^lrb=t7T8$<J%69~Cxh1y7KQV^`7J
zsXTF#X3w_CO25sd{{64z&}e60cg6GZ?gbZRT*c1(zpBoCY39<tX;bv)RL4F)z29Hw
z&+q^LI$h1yCq)Jxv}&>9oAT~(H}AO%u?G#KEY`8R|GBj>azS(BgCin=!nex~Ssprc
zm|OeDt;5{w*Zy`{rfy;)x6E_9w(fr0LfOgO3{fk>ezrR3Z`Aj`|2xR+j9Jzs1&LRT
zYm;q!YhK1oiNCk~y!f&2m&|<q_o`Qv+cf1>_+PhAyCKf$6o31+^?Fa4FRlkp)GN8K
z^<{l<eeHU-)?at~XWn0Nf_aB`N7&PtmscYvFWLTZ>it)_&A$|Q-`ZUbdB0yLRz>Gt
z=&of>3A>Zr+haCe&Aa>CDA6KIEpfiC{zmK5{x8+`Ue!MxYLilYX5pc>l~b-?e3iF;
zr|a~m>hJF@I=x|b|Ba0iz5anL+PmLqrn1}T<@}QIxytv*f2Pn%C2_84vYzgX?wcLl
zFg<d0^}9z0mo^-{UUl~G>FT|c6;?Y7HL^|LJMZd(IVM(p?{<7pn6J3Rdd+w33+j2C
zi<jzIIVap=Uwv2b%Ex(^1n*cEbKR3H+aS!fwd~q0Gq25=)8FeZc|MnAE-&8~p*PQ5
zHLv+e%;H|3)Nqpj!j6brtS2fqufHkzdhU)(rDs<Q@Vi>*y$)je=B4_NadP|Ce)cK$
zW{39M@SFeLclGrDHsMGARPQ+MHk0$Ro^DnDf+hEDS?T%WpEH7e<)i1aEUdhBr}o6h
z>+dGN>kB>?cz;#Vq?m2i5AL*Sd8HX9FsN4a+`D^uRj%f|+bwZ3=gLf4;NfTKxaV8-
z{oAp>&+ps5@!NGfHr4po58vu%cj<c0l3gen+b!~X$&WJY=NkLwSL~i_G~IXdgX4V8
zK{f0b{XgB4kH0m?^|t(x{1ZV3zu%UBxc<A&kGkiNkH3%qb|ZMwq<YV6hb_`u^yb`<
zYpAtrEUbSy_47-G`4$2HKSb3x?D^h1ZU0{;sXED;`Y&spj+ZabzGbOlReh~`Wp(qr
zB(HY@Hwz{e-;2C!b6cAs?gZ<UMUz)N+F|v-t?j4La>)~W9-Evl@rh(lKmGmRi)hV;
z`tKhfdvCx0VNv>5o6A`pyW1B?H+W|4RyN%+ul;=PhmZFEDsFDJD*ONCP}p3bM~4oZ
zOcR;=$N$WC_bW?GPOsQ`)pp0?S}xJ)3%kwE-reBFyoT|O(Z>(_{v7A^Td=x5LvP>h
zYVrA3TdS|#-(P;*zOwv9Gvl__XAeHUaX4wapylI{+giTsL=&DgZu<Is=apKC_4!HC
zmW_c^oFd%Js-A3JduWn~Ib(Q_TC?Qz$A@m!fBF_?elop2eR6r+!)?DmTj~|wp7A4R
z^|SewuZx&JG+sE!r@7B9%6)URy|;ZsaCFeO++_ugKepVt$}+h%{LR0zrJGpza(x8D
z0?!zH`!X}>`(EuY%O5wG@@TE}wB?Y{S-oWyXG7=bYE~bOtqe-6m0wqPh|X{OnX~Wj
z$=wY?$+B&YX?#cfInx(SSfwe(t9N7%PY*MXB;WEo(e7Fb6SI^mW34}R^ge7$+qO9O
zdKlk-HJ!udS)8+viM(BV;U3?n{r`l$uUyh<+;-;X&T6-R+4tI*mMY(RwZS$ovHnQ-
zy;r?!x9*O8$~paam|AJfQpYuBdVCcIT7RG4<=UXv=<;{#)Lk;C6(-0>T^IdSTm9wx
zxe3{hu3h&;zjGvUF1xz4j=OC3hm5Kp5r;P4+4{_WBA>3EoVBZ7-AX>atCh;z%=sB(
zf5)x5zG7F$ubb76?q7Lduk`h`!F!`C{;xUZ9N6A6zu!NX=bp*6r*D}(li1C~UU*%(
z|DWxa$4_D1O%Y-JdnA7QsLf<@)>r785*-@bdu?B##O3zDYkpz(E+$MeaXYBn5gTTE
zBhda=oZ32pr`G%YyH-rJZgj~n+Y{JvZdHU|?&oFp>eu%6&y-`_b}?1Rll@Th+=hd5
zPp}5R>yZBFTDf}0xd)8K_aD3FbLW5eVt@OW-&<wXGKtH)bqm!#?YEk=SaQy(M+UFM
z|0z$f=337c;n5Q&_xib`USsIS%@TVrgmUlYaDA5NkYs;ULB7XOZlX|sXOqiI4X;ZV
zJr-P6=-V0EbJl0t&3V=B@8jI7FJAop*IYjC?c}L#`~Q_3t$y|PTBx7puSZ_(ZI2C4
zWr)ipDjnIh-r~{}kDwQ)Wtb20o`0O9<26^L#z}JF-sP{gwavF{Yp;0nXxsg_a{EhX
z|G)jo_kZroX**rJoabD*9BI;HG0A1Z<B|t@_JY^19!%W+(CqRuvCLOGXExtCXrX9$
z>QT|I16DOs{M|N5_2=6-qm&JqoBKZOJIl*(ZpreHm5VgqZMiBbwy(CGaYIz8m8mw%
z)4-b_?}#oElKSC)Nif#)PR^aWGha*(9b4;HnV|6foz?00`59qH9%sIJdh>!=#3Ko<
zBYz~%PHUCiquaf_S>>CAzw#cpod@r4uW3&*;hQp#Ni8kaasC_CTNnRL_uk5X`quN+
zQ})ly-dA*Dd*!4FuXl?vd1z183{t30vDn4Ur`oX6xM|_hPmz0O6|1jae_F5V+n3<`
zbAE1!-rD9o_pN2=`z<~bQuS`XX}{c1f4E{#DEAAdu*=8S9P}xj%}~nxsC$#y9KPGF
z4NBV=GkUz|lPM_?)OCz{5MACh_tk3tO9_qV3b{6E^xp6BaD2`jP-gKc<7CX2cel=7
zdbDwG_glvw{tc78-Q|53WvMk)SllkT@X4%R;B0i;tAqRZE9Gy~2)O>~i+_3OCbnNU
zlLUDDA56(BVw?0>IjzB;sk(Lh$G@vr*B!M#Iq_~xPWANV(&>Aw8@Dd(T$=0t{YUDI
zq#%t68gp)O7#umtF++Kg-<QmE_Z^GNFD%`+@r=g0l>4fYKdzT<I@$SVck;{V8`t*K
zvga=>yk0(WUD!pXwj%~VB6ex-6iDrLu{QdabKHQ1^N&yaM;7MrB(3#Y>r>^jZV4)s
zC2o*;I;TT#-pm6W>V=IvlRFJ3Xf7*_Plzk=XgaE+tQIfr(N?he{u7n2%h!sPO6Lkm
zpZmGrJ^Ita!~YJy>KENTW9F&r20O|tze;^&;a$vXEj7C>@$H8o_lFnmw#vuuD$$5a
z7s>W5?y_l~@yJ^CEOX49+w;zBF_`sWZRN3B>YdKFkM<iIzHrd{^1eFB>SFG!O>M;m
z7f!a^`DpPZ?@+koCWdyM`IoOuW;EaX?B`;M6<XVvj@xSKX&w?<ldbnD=zHMP$H!ik
z^q#XfD3j)GnKyTxmo(37g98`8uS~c-<E@DOsynm${5mf_u>ANWxbHRBi7lL+Z*<h9
zH_yu5ni=J2t!Qgm<+baCqkF3A?&aKXbyZ$y=yg?`o95PNvi*^WMeVnnJw4l($MJ1x
z*&S;)yX`E)hRh_-aK8`tIzQFkDlvS~XQsL?#VFy%giwoz&T2v*j3yilD*LF)<f1#_
z&a#gzoJ#`)7w5g0e_PFZp|SAqUgLwWR-~@Gw(>+);?H$~(d)LyK7N}r`OUtVti^I%
zT*n?B$k4O+;dlRiB;(E7#y2C@ie>!T-uyww;lrvUFIIKlO6fVC>01=TE-T@-D2~lx
zQ`NFx3fAfC%fEJp?>RMFaJt|$o(tv5kGA$%&zjS?X!1VsS_Vn3zI(a+^V5FjeB9N(
zNKf$2b2G0+H8pQGZ@g>K+I)KRtS=U`c=Mbj@6<|JEpT)C^-toXo|Wa|cMHvqI5@3~
zdu#h<t)LqVd&}0-PK?EW7Tw+V!Ta34KE@RZS8A`geg3(cX=wzDEH@`#YqE0GMa?Wj
z1`S)jw(Ba<HiA=p?%I~uJe|_2;chCG-g-!Ie(B5q94(=|OUf$_a~R#S_{x`HvAOKh
zoULn8nz<}=1d2WgRlC;Ni1bM?Pf2V}v354)Q2yD$Ve4;ZQ*fZp=6sRdk~P<Cs-vFs
zP2HraqPFY)#fA5Mw>K6)y?o;2`P%oE*J}IwdRJ&HE9wjVlR9DkK8-xh*BpN@8QFfF
zV(pXrwaQKDt=-R{+e}wkHW!>b@a%_p`7ho=zOwW37vir*?#vMEiJ9nAK5NZ{s3@bK
zQ{tx7yqRAr-yl?x-TPT{$0Co5Jd;nn`r%dXVjm%}qA0p(LdB_Wm7uTUDmxEm2pJhQ
z8C%Y|Tl;3t5&hZf8!w+YbU^;ZspXNnJ-p^(>b>?iKlhcc<G;24?B%;39`Cxvq?vog
z?qS2G*>YJ=E$*d9&eNZJ*ir5D%G`6WcAM_|VLtcC;|X~anCj=JZ4q7RbN+)_PV9N9
zS?3!cHa^W?VI{F5?&IBcKJP;s0)D>f@m#l2(nr(vvHRV?ONA3YbQZK}a#vim<QC{M
zd1v+_c&d2UsaxlZY}c(@SEs?68X?H(x>s$b@7I<oQkqW#8?P(d_<q&y3SR1B`qSvi
z(Jyz)?^j;0%|CaM<>`V;MyDn(;V)5=?oKFnewV8wec@x>-DD?;Gf$U4C|UeI_v_y0
zweMZ;|7JT@z;)<ec<p=r+V`*beGm5x3C(KavJ0ERzedRAHHR)ABd1oG!vY<Z*;)1v
zFEp=WUu%7T`-_Tc_n(LaPWa4`Je74V@15t?&C|48?pbd=cVtu3)$|o&Qw_axe|&YG
z)wrN%KjZI`<9E4I@3ES!Uwz!^EzjC>g;(sgPb~L;nY3rhqt%;p{-*g<IxV_CT~M_5
z&Y^#NGC7g!9M$Yr9ACQqMEXKCfnEASUqhogWt9JgCL~X?Qw{Rn<(g@G;K{-j#(Qq8
z@IH0^vG3)Nm93TOAzJ-a%ZzV75w^1^zb`AFu&VUS`30wYH=RnK@}$K^FErptkm@@I
zzW(=f*9h<MH@~qZVnct2{}u-YS+VE3AANcrZeeavY~)#DYO9@_+I>gz=^ma+*H)>W
z5;;Nt__8gc3<ONr9{nl!B*jtpco{>6m<-p2B{wZDy7WALIOkjc9V6>6_wBytxBt6+
zz48Cc`TP2w`Tzg&m221Md52zm1ROYfEwZaq&_QVG_3kxWU+-y9nS3K-$`orAU!93n
z5Bz(X|EpX|^D|>|npC{Avckv6DAURN&f-2bk^2u4r$5zrf2qIV|J{fG?7w}VmT<?-
zuFYO-%bSxLKiPIy?kaT4x!q8<=Zj>RoM+A2a@{u5qs+Xy>8D%k{{_ZPd&zJ_vMcQ6
z&6&zJGZRi7SfXR5^=`$AHy6&EaBbas@v`OIS0XWc8a<;JB00^C-X2rT+->x&Eo^Co
z+Jx|lLi39H7gc08{|P#=w#C{~&*G%~o0CCpCLt;e?_2g(^we$Nuk?Afu|Ds`^6om}
z&kSF)g5D;tJz%-<31611{WrZ|!OJJ?O|k!;n37Qc&iJImzdP=e|NNFwzjF8mzwmVS
zfZ6WBl17r9b3~11gf9xoPU)Q7;^<JRb-2BmL*%mmQL9Xe>&DxYxfk?X`Oj;0v?|&Y
z7}ObN!up=!V*2NeMaQQ{RqRi9J*sCnN%E5I^p?D2eunmoGu}(<AISE+|7^0HyYro9
zxlY%^+gI22J>1=E%W!8ei>`dX>m}C<%a$5`ck1*|sr$b<Ct&HrpGzGiC0p}Uo`x;|
zaiZh&rem8~uF8AHsNB<WT|cvC?sIl#t71JXpRDD@f=Y?yQH2s~^v-!)Vk_TV=C$>@
zvv;P4yN43nSBnqV&&)UN4(ps)&-`M~-EVexcTAM2-acQT)tuw^w$e49c=%rWO$rly
zn=_f4(=Nl-^lf&G#iUx%Z{msj*4(-Ov%O@G#JyR)ZO?tbe|Vbs#c+3HeV%>VTepqV
z&GfIX>62e*_2+Wr-r~87O-?<#c%if=!8z#9)gYyZfmeSnTp63C|77wHrfZr<YuJC7
zR(<Hq-qW-AO81K^OJ`4gWSzOGICJh<FUPaX1C|tCyPFvLE_B7!3v>Q7?z#S}=!$B-
zM4#!AuBbV=Unlx)X**{VzVk-VOBXk1bE(2Ng0D4=zjx1BwJgslR>a0*_3k&*wV0*b
zras(~ed&O?@9k?l^Z3m6I^GgoG^f?UJNDMbOyeR+%>_MeGZ+<;tfV}|wmAOVv1H$e
z35BQU9J%Lq`i9A#iboqe9Nw<jGBI=6;w+0-?*E@2+`X7z{h;PjjyJXb2am_e?Y(JR
z@jdVRTRZ!I8>;u5_g^E^lDmcD*2DJ6W)>AcUp?5ns<-UnombxRY`$U4*JgwzJMhIU
z^HQ)&;@zgSA#g)aYJ=`JuL+*zKFcDVR^2>Tbn13=(4wX5S6M6zmfgJnLfaHpPJwfU
z4$locxXnZ6x~NC2cHU#ZU8j8M{YJk(56W*cpV%PSGbgy$WX6a0dwjPi^R`49cL+_L
z>8R~`Q7K2a)i6Y)JmKxU+Rq$sGN<z`v-9ql{^PlI<}95((Z^%5dmRnGMWwi;-}K&l
zW{<W-^Vby1C0<K!2U!1<%W6F;@3(%NOw-b536IzKpDlk}f4b%7?VymXi*=WK1rJ{}
zmA4Sx(^skYf{k~*%1ds=9XbAf<sS@^YqGwt-Jh`WdsSPGL1m@D-Gs@j&ih)3aQ;~y
z)F*bRvE@U-DZi@1<6UV-{+^G$#5Mna^R+F9zC4e)lJ)n}s%h6}`LaFy{E=mCwg1s3
z+1F;Nc6>WkesqPV=hSQVDqk>bT;Kd*?Vd1ohgFBXmwG9$-D%``;)v+&?#lI=dZ$;+
z^ZBxN&)tHPR{cQ%$KHEL8cv(2Cr~KhKh3K__UcEI8K2giKDkIU#kjA}P=P;o!bcYK
z^bHCtdDVp{Pd?&(a9hJ;6Q0m04WEmtW(Sp0<9)*8bBZpc8yn56l-XLpqJ7J(8m^?b
z!JQo|_qbR;obzr;vHZq{mAr2*O<Kc!S@HOriEN6yHeV^W>{@un$Na%bCdSD>s`ywu
z4@rFdXw!D#x90vs?>96(Gj8nmek*h)-TlkN)<~~4T)gK$&swLLA^bGR#BsC8%xA5o
zhe8D}@4oQ6b#nL><3mCR5ADgG(#rWh>_$vSi;z$CIq4!l#iGXMqZ{mUzBImY$nNj1
z(EGU5NT>Jmt37f7eyV=@TkYnae>Nw6RZRWAq|e!V|GaEZ6_xgR&waOgCC~Cxmsj?M
zXFn~@l(ars(R$#glHt*LTY}EStP;5@yXMy<rRGH(R=2-ye7a%PjS{cF7cvV2VkSQ|
z+Q*=ECeiVRMu*Shqjx5R++qIVbm^wU{Ij*MU8YGalnT7aG5zs>#kra(t8IgLR_N_`
z#ki?*_ZyqK2`i(QJl)oR|Jcuxn_LQ+8y5Sh>gh{|HM_Yu+L+j=%y==QG;zn&XDeBi
z9Zx%d-Fw)+X;-5fAJ3JmdwiF09Jqg?sj^s*$5>?XBxB>F0uL&3TXwxQbAMy=DD0|Y
z*UQVibq^dT?!6Hm+h-pi>ef;*OF!Xic(n1No%{PV1KAr))qib>HPKvkAa=9T!!rNw
zKR-Gu1AVn8|37bKEagAHJWJ>NiBN5xC&KyD*;cGz)ehiZsLXxLmrZ%gt9c%)?7B{`
z5?v7SNV`P*(9@?%W%}lq>nmUSRnPW$UOpl7&*FoJnKoEufAl>oJT+&r&hw9M(^Vty
zyvuT|os!s>8j(C*$#i<ts;ZYq{x8|y{oZHJ(~i{G{=$FzlAQkPJ~=#NhKWST&Ixn3
zPvVVjOD?s%ve)TBRj2O0-oQJLLKAy0YYNR4Ju#8-<eKm_<+91IUtT<6A=Q=t>Dms3
zO)IA~3tI?9{b)V1Ch-23n@K;Gx^6MmF5?%;md-RVn;Q6Plb%K1rdY{`kxMskWz2Sq
z%=X*zcY~zs{zma*%3Mwo422%S6EtKZrIwn$eee7)X3|Xaf}KqlE$@cMozsc^9j>H&
zwp4MM<%!pC3w5mY<V+-HedwKD`!id(t~Jp^K$r1`Y`+`B)yw|gS3`F!SoP}RzFFUS
z?#_D0-aB`?=GT_`vTui*-sPNW?_Btzs9gK!W%*>IT>+nFTseN>*Y(qmnN=!{8$I6Z
zuh?)xV_mzd%R<xkbuqJw7ag5msr!%1-K(74A>*TsV5F^TeA&?)Q_(g1SA1aTp4J~6
z_bowXcfsUk+wbry+$^(Ha7kIPbdpnYPy8KKKKEBlSG><NsA_O`t$v#3wR+o$Ph#6*
z9IjR$Xfg>s-~IEP`n~^-6UDFh6e(;vlGz<GAz@XfW4Qd>-)y$C^yWyYZIkXR4J`a`
zu=Vwd&F9`lF5To7|5R0t-^_&nRYdiy|6gw9Jb83=dBv%>td~y)SYN*^{C>l_2NfIc
zlxplY5sKYp;4a?b=Kkj1C)M6o%Ldnq?G+)bH*Q}M=h_v!;E%obr$RyhiIct6GhS#k
z>uNrJbs;V~cI`IVEmpsuwQHT)=p)gXdL>tyRdOwtqSBV2gV|RWoJu$7$(`;Yd+>$T
zyR$crvRph;ZZgMaUVro+v#FBrIh8JkU+rQM*zil+?*xyeulwiKK9<gpcvM98%xFBk
zhI!ulM<-j~EH-`mA+f^l>|_S5CmB}+!yTIz&Q~%r_|42Kyy}C6)sLrt51!oj^-o>>
z_t5i^smfFLv_|E&1S#%2bjF<B=0)+`b6bqn%58tH6l#!rc(P_8gVUd-&T2u*i<#0&
zV(MNBeyTYg^Hgxn-Wn0n;5k1Nw!GCfzS(|DB>bL;fOTNi^Pep~{Yh!Q7ebsf_tZSS
zGN+@{!Fr|Emojgz)m5^|-wOY5wuiimUFI5FrTXe(!odl5H>~N}w)=<F><6U{2RwI2
zoLTDEbFh60pUXDiu)ST+e~2<iX~arwYB|8M>7e4v_>a@StQVU+L)1q4VcPx4|8Exk
z|1AD<zVGY$Xdn5jx61A;%oGfsVAPcNZ2ME4rfb(Ust>6(#ICFenWM;S`6epyRdV&q
zlDF>yt)&~T=D!W=tG~478OLP*$)zss+cl#mv^{m{h`g}lYEEp*7B(Ga=9Qs0o(f-j
zb6Pg;X}7kg@Ppr0e2YpC^89CU$<|W%+#~)|^kanR#4OJl(R<(DOWfl>eZjKTt5@e=
z;=Z`kHPZLY##@%QjJd4=m8BCjKhM4L#5hop<!k!(lb@^)?f717{{JZVlB;v4PF2*I
zI%(4Mr>q`#)=yc&+470wxqe3dtCugA)n}f&y|m(3yRhKog94oIzMfg_z4XhwB~OlB
zcRwdG=Y!xZZr8wou9GYJm9KpiD3KGYTE(_)=7QBcnfZ5T&5?5Am3{C{G(MWQ$~$pK
zF~^Ow7q}iYCM%d+G5+;!!o8JM^H*BSB(^<Db5mOsEji^xw@cZCnY#{55EI-OcuAu;
z@kXllpQfk6nWwwfRb(7}{#tK|v)G9a?t)i4e_ZM`TC&9RZ@!V~HHlyIBo{tjv|8(c
zl!mC>t%+)DuJ}K(2wQUC&!KPf{+}ElZ1H6HHShnG?atzwiOanADJJx(GB&&4s}SSY
zf3#5|$?XT*{5w{&BaVs-PQPHmDtn9T@8sNF4DVw^Yu`;dC4cF{rOW2p`l%J6M~wGR
zc72nzli50|CiuRL<JPrOrR?w7&bs)WugQ}%dvPt;^nC2G`XB#7L~VnAT{(8A^!r+F
z207c1$X5NrLk$wrj3MQ2nUYH-+ua^azkTbFWc;?N>m@`Jqt}N`vI>cm*5>KiS0-zi
z#(Of|ZMBslpW%~kk3Lt?IW74&^Vt{YEUI5+CttR7vrkOq!6c7m$8Oy)`TfwNyjJ9h
zft0Vj<%z(k6SE(iINRD?n0mpo{6~&Mb6~C64Y|!?nw#dPn=)>ac{ahxZDPpUO`hvy
z=JDAzhHiLeFyDt|<#O-cJ`dg`+~u9VEZNw|Y|Y2$t!+xy0k0lf6vj&hXZ!NB|2j~a
z!*hhq@0-s=%Z3>HhhjdPDzXj*FMN};LwMrNgkWpFNnK8jj-k>EWF#_55|}mbn(SJy
z@#-j#ne)@1*LFq6zWsS7Nb4-KRkx-09?Q+KukWx`RuxxYyBx?B^;=^7{-<lrN-PCx
zitlw+x2_J8bKJdi-up$2ds|&THDm^bPMe|SbNHps>K99zg)<LXE<N<?Sgf;mkU(a4
zs=})R8(EJmImgMaZ)dlC>{3|uiQ{Gd;*WNnwr?Lql=mBKQC!twS{NC*V)j$xn_=b5
z7dxeuTRs<Tm0~jZVVdybEw8z$u9wlpWm#)27<yTXQf{4J_NP2RQTm|B_9e-6maA?C
zlrn7#yK<8;+csEZ$~CE_3i4YPFh6`JUM4!xOznol`qj)A?Ik6%G=uMmh}z{h)p%_1
z_;B>Fx!$T)qm60_edjdYb`(yH<Jxye`KwS?yMbSruVU%O(?59Mztgat->0|yO2CRa
zdV3XkU0?8Sx9|Hj=f|3h-;O)Rd~x#6o)Gbj>5=s!=_xAHPbo|8i92+<yJXHHJ#)D!
zKUqY79%;B3?yeOmer%HSW<!;Y4=apVGa}rSyzX~>zM8hykZG%ktEGiosh*_VghVY%
zM)xZm`!4Kf{qilS#HGPV{fTfsf9{G4v*vvHZJ2DU`|@4jEiR>i*HxnOx0BO7Tck>+
z^&erW<-DNXmoDDn+0bxix%J=cs#bGX@#*b;w8YY8=GUefW?S1tJ$RTcli71Va!h&j
z{q56@i((eru@}We^dA-s3yXO@yQG2J_`vSz9~4%9dw74|9#z(TMe%Vb1Ga>Foi}ip
z%jV9@wKeR~kL7p2|6b4FF8!xsQ+3e>_Ws#lD!$bH|N8H@hxo0cd#g6ZXZro($PaXh
z{3jsZ@R{>j)?$xElM7A1`dwTmm~nm9mvvF6KjrYA6!YeL)fE={L|gKVEW;Is=JWy|
z13AInp?{|NOx??Ibmzo3Hif6ZKV<7<SJh5e{$$y}a_ygzt7Cr3Cx+vbzAX_u2i{cq
z<iT9GTl~AL>+jcp_e$n{|IuXAH@^FFvU_gU`&T5rk^MLS?_S}Gx_z6HbUNA!7Oh&n
zE0M2Vz^&AkYei1d6sEm4>B(^>>9P$DXI%_*8O5foPBk)7;ppku&uz4o;Z=xo;tOxn
zRTtKtNSMYT>hQu!HICE0XoX;$x7^}MP0PC$i+byJ*)uFz+FIo_;ac)6Uc*&eKBrBI
z?%!ZAclkmF$&-Kk9*Vp%7tvn&lc{v^H}5SP#{NrhdpaduS`&26yDKjL-VxIYa|D+!
z*8N(MSjyDCRNhcaCr`VVv1G3azsNe(Nx%K~s%1x%90}DwrnFlpFf`!;%iY;Ni>joi
zi&riAXtQ4XYs<CMm%o(X5_%=u-rre}@iKsajh6?1;=JyXWpY^p*3Zv5hb-Iwx-Q|A
z#FV@02j=^K@qV?xPV156$~9NH6)X<C>3QOJtl_|}YVpS%&VlY8XRc(QTYuv8sh<Ur
zOmPn$mbqTie)*xnx~**Yo&Oc3rfaf7(mWNLr*1o9$Dq2?N7(V+e1#PM<a3@Ye_fxh
zsBp7UYDRbAH1F!l_)Z-)!@X8-C%!y<*K5I)fLFc`8_o&epBzzK>n^YOY_d>b>!F5o
z2PYMDol+3wR!U`f+Eb9K$FuI?N{0X5ZTA@1HeZeQa=sMi8gZ)ms9Wukt*?^ath&<C
zvh<(ScGi%|9~wVy{t*8?cv5iD0^aYsp7#`{saZ<iHrsdVV&$9{9d}k}iV3}86Moae
ztU5g_=DkH+s^%4MX-1i^M;-E3zF8Bf5E=H_RVz4Q%VtkGby>E3COrr0RlO^A#2fyZ
z&3Jv+zdZMc<_&Ik>bf_+Y2;Nlt@NG}`%lpA)X5i1WG?V-ycJ)=#;>`D(YoXVZ*0;^
zi$^|p|E)S)V`<v=@u#8j`*otxHz#zy&RTfR^?2sqbxiC{x+2Nxg}yqwuIwn+dfL(=
z_V3O4u$2CbOZ3j`%0^d5+Bw@TimnNZxa0Qpic%}X+8TyO3-(xYEmQGRU+ODzUgnU8
z!4(-cDW}OoJnI)N+BWI6&zaqPp-IUPyyiZ9WhfZ*{?73uize01o+JP2->$vJ^QvY`
zvmLu?DP^|h;y2yqR}1vZ{7vFCbI#76lh3gHD95&qN_|rv?|JxM^yDS^3)<bw>zfw7
zU|d`5@=A23^;MCp6aFrDN?5X5CWGHKFF3KQHktqYQKj61u4A^LRv-6q?N3y@Z1AXT
zMqpRi?So5-J#HU6E-b+?*H%_Etf%Jkqdyzt8WwNoYwnx;ex)eS()~v~uZr3)tzB@z
z^hA-%l!Kb4-*`9L*-bbgFLs}AmA#hq)Dvw^yj(}N#Y|P%>*M{PZCj#ezU}_~ms}2n
zMepL2+36F?{dmVrmk*D=vHkztUOw4%ac1f6I_K)Hx@z-`O~>t7PcWLd&e-Jm?d@NU
z9b0QOKCJ(}ZAE9Y>Aa^*mu)K?`XyWcX5?LZ8dQ6$r{MCP*mvI!EM4FF@cV{?f%i9f
zm+MIUVlB(pbgG*+dvS8|2LB`#TNbH2t^&W;XT)_PUwFUWpnPJ&X6EF58DUlHD*`6n
zJN@EdQdrB$Mbpd{w~BA?zoUCbjLG-C#<58aZ%))lTTJ=xqVaG=qi|J2oTQJZ=ARC`
zFPhAjUn(`$7`?x;`<zJKsav-<e#mo)oMxWHdqiK!MYd%5;r2;V(>~5H6-q1(3l)43
z=uy{OSpI&EN4@9U%3eLa@EKn>*|cwN?Rt=WIepXnK*dW(cFBvq<?RvF$n_Ifa@ZVU
zrF8Y+?!SxgPM+T(>bkFjX;S7<DKV8&Io6!X<x5`FX+JV*eas(vtiX-S=T0M!Dr5I#
zm&iMs*9H0BPF7H6VvkcwnPj&19naq6gKM^bTE!~4ho|t(^Zl)rhH>mBv92GCWcn_@
zznt>?XZ*gKcLL^}UJ-WCCH%xaC1dNOTMS;*tA+Mf_&jFxy?b$0{)_ACoooGBo_Ad_
z-6gd1&FL$OeL=IfT=$y3?)iCc7Y)^8SHJGkxwd|PrQqI*ePyiw*>{%Ke7$<@mx}C~
zpt1}9@BI5Ac&g^l4}Og=@$2g=KYvuNdz~4dW6Hk9K>J9KP$lE3i>LDx4DM%C^+veA
z7d<lh``y0pN;T`2hZ<?UKRNZN_p6&NPLB-jGsUJJw{&58t#_g3O{Qg&=nWN-UlQl!
z-u67VDNC67xvJ*fA=j>N=9SKw2NyeC+7rM3UFH3E7qqfB{@vxVTH0XYkz;1=el;-?
zS=9w6&%X6`{-|8H{x{d%oEom0n)jdgHQ((x_U*#$Q(mi^zIQBg*r)3x|9FRh$+QVY
z!k^iD_CBcJ&b;^2ZF633H`Q>l>Nml2VrTSMop{OHEBg9M<bk5UpEfn~%T778BUbsI
zN~yt>{D6Cr?Gw7n9aEGOGbTFMSp{!&$p28Wbhl*qYd!0W+vZ(m4k**D&}7!1eQxFV
z^xTVwgC?X+<4Dr4i!E?nydrsm{~q}=|2;(!ON=vJg92Y{j&PrnP$A>=f073~r=)}Y
z5tCSFTb8Z^8zNqm`3m=5dL{Zs%7#xk_u!9NcdoD3xc!D>+wVSkzJ}>p?R(#QuYN0A
z8QP?xlqP;^S*!5=P|y1{*I$2m`tP29`@M&+ub+#a^G|>Ol8(%S)BUR}8n2sq2ps<W
zhkwh)$oX&oygmJ2YyDiIcYl6vYq-13LdElTZ|W&SjvK-*b0^<3<}dC|E^w=_J^z08
z!HubxjkDFJb1Ztpv#d2<^uZR<mTlV?ykDdDz@x>1Gnz|QQhdWz{q#aDjX71zIhW2(
zSKmARN<3RwQ)H>rs>OBDk*flv>rSt`ETzSM(B_f4EYmLS>y26ECFzIFcdT_i&-dHn
z(CYgqoo1(|XH|FiOZhs?xfx&brslduY0Q<(c^#H>CP^-QSlRQl+Q6XWNn6H(nu&)E
z?e84u5!?Fw_64hMgTTy&gQ0Vla3@N9vz;8e@M~Rk<JBcnaYjp*>FWnhj2DVYjqP(R
z)x4JR;MD8bOFNRSjTV(znb`l}pXKn%fBKR`N8N5enid+$uC!t5>|;4+KC(`)y*9^a
z`OnnDhx69VZLu%X+~oJldoD94+uau?98)s>PCk*X#<$6B@$S2a{NMKlp1<_)D9hq2
z$2>2b*nKjrBJg+br2_?Fix-<`$OiQvS6JY3ApNw-+(n18UcBJ_E*0H<L0@^+v>DeD
zp4^Y<y?biUl~vXv)x7KNx);qmxKge5vBs}HmIul2Y*T(1zFPLGQHZZ+BlFza)iTGY
zHBGM0&JODjcb<RNB|16rYHj#|=*fD=R92XDN=cWbebBb56FTO6Y)7_}l6~!o7wli+
zZ%uw9zb`Lxa!Konf{(w>EXY{6^we#emD2abYxBjQoG)PrIuX>nEB(i-T4PV~evR<i
z8~mr7>)N8IwTVr8!rcV9)hV0gHl1N|Kc;Z(#joI(xq`uMW<1~1E|nHPJAUSLV}V(M
z=RZkHtth^StGe}EPf7=tCFGpb`yni>RQXB%%iTQ<|Fv54GA9MbIpywhZ4wk)v2QL{
z*}*9vS2xtpKi0V^@0HFuulOsc#eec_HBniuu)EZyamk+iK;=8Hvon{UQr*E49G;ZN
zbl|e(z4XIsTE&vQ<#w|-Z`NR)pm)-QsbyQC-sFY_Q@jgQHg$Gr9BHcX%;Gz=Lf`v_
zQ_n2L$+bGaB1PP{INy8nruNn4lrK(^)5LckUR&aD^Ss{fg&l8<bU*QgdM@0yHef;S
zO8?m|9xMG#g{I$%Qrfh8%Ys`b|4j8m4hAh-`}VWYubKDv`FeA0T^>HgDL(zKgWdP&
zyD#FFcS}X`EWfX!dCDX2!)hD<6CJi0M=O{4_*#hvyYp%6lFM^zx_11|t5>gHhe$06
z;GQ#e))R%~R~n+)5gmsg&wS#a!5Oh)PQq;sIbYkGo;_<8Fua&>vCMMy?cFCFCSCJv
zU$c4X7N4amTa@fp%=T!l7q;23Wb(vGn~GNPPM&`}VrOn~<U4i#xn8TM{qnGWSvGU8
zY_79<t5sY}SdxwT;x4)P3EMvH-?Vg{?bWb5=^-v6PjyzE;|^TpUHBmCNb{esajl+5
zx(fqiHaRi+T`%dnth9K^35AR)D|$?uC9|0#&%4j`O!0Hxa$vTij$M?G0E0;;m+kvp
zpIc5V0!1<>b@;R&SFE0Gc<ye)n`hcw*(u*_Hnh8Xt$y(K-^Yi$U;O<TSn}!e@4t`d
z^WERWwRKhZB{jE8AJ6!0{Bz`Yz_pUd?^my}#vhydQ{?daP305MtZ6wSr!3N$?JfTI
z$mPzMfcIjX{rE0^KHIwS{qyP8_snP4-+i^9^g^S~-niKd${#&6ton5NpMbCW*%vH7
z94A|}eeiW?jOO7pe(yW$>h-eqCn{#%-S_*JeDup4_TpJK79vK5jEDZ0eV4!Z?zjBn
z$CJP3f4l$H=Zq`&f<qkHXEnG)vIErvwq2OpsOq!)xBd<1d6g3<?hMfU9A{*4V9OD%
z-l(N>lbS6w^k4Wq7AiX>BW0OWw&K3q`|#-a{XdS)Ie+d_>_+ZS`(MAl)aL(I>`YkP
zs>>`}OB?TRT=d88`g_UwS3LjxmWh>Yv|j(Laf<1sg|8F8cx|ZaDB?IemFsxuDGM*H
z32Cl1b(xF!HhMRu_2sZ`$eOg7d7`dJ&cZ|+$!o$%OL%Uo)-{!E-hcIi`IneQPn-fK
zJ_y|VaHmJlUj_T3&ne{|c2Qp!EcrdP>kXUNZtE4>v@<8qJI;ChSEFlVTS%2b*!?BU
z%_eCfbEM9{T0JXm=1!TIh41-Q-zV)jrdOclJIU3JeaoB*evO)ilT|(5+&Ea3#-BOq
zx%k&Ld#+cnR!w=eds*J^x|gR82;H<*R7#D^aXNMOTd&kFIR%O0xfQB^4|sgJVidpq
zYV+0pZL6~uFV0Y7{V%cA|Mv8W`p0&B=!?Dn&QQ+mmW<!IO(zBH=1lQY%GH!CIhEBs
z(ZMm}{_d6fwY!xsJzwU%n8D}he{R(4#vJ`lx-Md6V7SfCz#z%Mz>u3-oS&CenwgWL
zUkbhlsjN6PuS~C?a&LHa{%tdny6fu|=CGe?Uc2S!1yRO5y2Y|*9A>j@eV%lJsd1Xd
zY*XJ|Do?q){(Yajc(&^8!fiY=;(aDQulrdsLt?K=;*2GFrZzmC5$m=TwrDPuEq2m=
zU3qlgwx_3-U7mVTaQoGB;;Tb<#u=JVPl^&eAFQ78^XZSGsT?Oy=dV;|i;rt6V{u$r
zulaS&jqWWEpMG=at75y|vHrrACWX+Xv%RUCmI#^M;Shb@`*uQ-;ITU&PqcE?M17tx
zGvi%loP?3)!IyHCA2|N3c&ZoMntl4}tg=1s3Nwww7oDAC$yYMvQat<L`|nTOJ=^=d
z@#Ul~`)czm<F@^LyW3o<$5!Ff9&RI_j<6@ic?>QlYLf+TxV3EJlc@Arwo+Ljohi$6
zR}=H2XLA~g61PMZJ+)F`<7Z{@o2;p>7TV>j%6~$j)A3f@+fN%NbZDw{wlexZ<vX(W
zYtwNBrEcM1>l3WgH#L`iDdm|JBT`}L?-5aa$A3%b57C)fy0@47F5b4|)Fb6dXYSP2
z{4J|%uxD24Q8M?5iVMn?7P-e_{H~_TT<U+N{es*}%>iz^B|8>ASG~~ReDQ8>Me+BQ
z_8jVq558r&{!o7V;g1ytQkU;2gkIh<y_~U+FW>#~YkqlycM>Pg&RMO~;dHhj`D~Bw
zA!oHi%K}`Kryp~g9(k&2fm-32wasU8TV~4}?5X_v%XeC8#GjDD1>93b-?z_y5qxYO
zkHfmn_RlXieR%8D<&lu4=&Uknr}1y0)vwRY*1K`W)#Q7o3iH0FTmJTJQ`%ek@4QF%
zys0IV^1lTg^Dr{~&A;ZZ$GoTK{Ce1~SGSAa-eq2ucH<M9!s%bP%kyuqHEVn^UpafL
zabt%}N1os80xr+@Qx8boIlRCBmsP+$C8Jxfj+m}~SrpOGvNI<7#O8;UY_BV=0vK2h
z?Mm}DO8m)~@r(2A>yTrWs}>fW*v{;D|K&Z#Bc&T^_<uOI9F=%=Wo^*&@L6(F7q_1K
z!R~Z>E*tAxr3F#${M*CXYNpPKtSd?Rab0A?*|^nrC#P?byQILMDR*(f`iEr!466<<
zk?&!=oWt;wXIp-KP3M;Lw{(`I6@K{nH-XzNy84i)?DC1Hm;5OxnYHW5-HU2l?oE<q
zWu5G>dhPL?t^N}OI@?4P0~^F5_xs!l+^Uc%EVugfi8(u_eYg>+C%h?Tx90z+HL+Ju
zWwEX}<+--NGfsc&A+1|$FA6Q~<X<l*pCMcSaf)5oJDb|&zki-RbVg{?uJ0nOi`4=m
zUhZRwc^4nIJX(>}c=zf1L5h!0m$sNY9g}C!T&wIY={luk(apF;99#xA0mm38#^wE7
zcvC#1!mjMeg?Ubgtv4UuyD0BJzxedRyBnU1{^fq)#Mu!cso&RofyH=!oO^&sfJDJr
zf42*by|<V`k{nzUBTZgbCng@b?VHfY5}LYJaq`oEvmHqme@l1Yz4*8Np~SyTSHaAu
z3}HEf6N{pFKBay0R<`yntmd`gW6rmfWZ#~1^0DFZNU^5Q@GgJz2Ti_{U2>{TxKr4V
z9q~B+AikezN(rO42hV|*75clc%zD(^E7<qDG@GA8Xl7K#{AXz@Tc2({yQlm79d^;>
zO!8JsW}R_9Y96GKSDifhliHrSe?$GAy=U2zvoJ$AkEj2%v3<FPxv<`|kj7Q6m#5vD
z+LI=-^3+;Bg|AF)m-ma<PArQk+{5&}nawYLsmh#ZS}S{Ju3Yru>nx`J+b=!D*;YEX
zdJ1bjU0${IWbN1fpBHwduVB=eCDP3oDZbJ9n^BRi#=h%syC$XUdaL;?t4TPs@U-}k
zQwPmulY}zAM#(Cram8202W?d_G)Zr+JDR0%wdJ_d<D(kiHdL@YzV_2%I)6o^%4YR*
z!uoTJHnZ!`ZF}Cj=COOwyP}7A!fQD;FR^ry@3}fNp=D>5I`ev7;~!=pU-Al9h#%hE
z|1{v3;O6Z7!`dw@5?fB4S|2&<`m6h>1-nzI(A3AE%W9Z$6zt`hdB#S11(j2S4(8o9
z;Mx0HyW>m3?hU;vyLlL`7GxH4%t~dQmB`$7Fd)@RP|cf7b^BNKx8}c6C(l{Z+Z=an
z_KELuC*5NY9RB<Ee2yw>R`<<KE^kv*C#DtLE!cQCXIB4B);lwnDet^%IipYga*owJ
zzl6=sKf11EXnf?HnwjO#*1kthAnw0Y1N%Akh^+Qg;wuf0%r%*{vCD_oHE`=XRUNJg
zTi07Yh?2hUtdqR>;*0hxODne}NQ=}t2^MfUpSI=jVJ)5EcG7)Cl&;e>?U%dmY?ib>
zaqXMu1nYe<*FE;K<|P(OsED_HuyEdg_mOMD<^EmlCSAKv1=O;fjb3>w+EZKkAIs9q
z-{(Z9tkKvJRJU3Chv?j}#rJzSkG`ECJfB;|_}BsW&Z*x|>i2|*Y;+A(olx7j^`gaV
zMnxy9@OhD*t@{>d1{`l*^2~IZfUUdc0<mRZ*kWAQuHJM$@RQo(71h^yHhy0#{;_3Y
z(!JBOEIj)+T#em0Z++gopc#9zlk!!Ld~QDR>2}kJ0Iu&ITen<`zN0=V@p+>5!k(iR
zk_sK(-RZ}>7PAK{OKf+x`g5tR$02{)mII=S`qmk_7W;4iypmiX>*c92XQ5vE(e9Fc
zv#P`W-hRK?{97}o=+-UCoKM+zYYV#ne|z)$*PYG%)6s7jWoDf}bqX^BgBS+`gEVTD
zUtW}0pdTNfnU`4-AFo$X*&6Db|JY1m@9%J)4eU1?bQNyi?Pk>fw!!wz!o6Eu`CSz+
zTso2FJW<OtQn2ga_k9cZ%{ja5tg7J8v}b2$oBO<tb<Ww{R&v=&{w4dLy*KwPj%N-J
zvG)IXs>I?;+}8GEp*~BqrBYWnU!3Oo)BE~{-r40GKX*P2(spiAJ=mt~*STi(RKxU8
zJK2}rn<JN;`g+YGR5imRRV(jiSkCFh-HRpVm;I3ZFaNP)!G*ce@Bck9QgZK{JfULk
zamJRJyOwUf7kK;UwbqHRoc;FiFtyyZq<FdS)=8ITUf3u!ZxcVYv?|GCtJ#i=TUVGa
zQM%^pbanQ+03Jo9WC^DyY_9919&EIH^6Ef|LS3FM`@*uzuj2Y_&VS#c)p0(y@51rz
zC(@Q?voAicxcJ|y)7gtIZ`d?((PHECsqS%1)6%vaefq%4e{vYNugC4xiVLR9O{$ii
zc$F)4vA1kI_k8t-?{kWyd>abRoch#jSn7Ve{jT;4tN2Ey6iL-ac8ODuzCYFr{Sn3e
z{7Pb0oYl&sm%41E!x}ZU>fN5!GPSLKtq>^WIG49u$?<AV$}*puQC7-lcC<v^60lvJ
zHb>mbZE}F$qjkG{w|)K-zTB3N`HA+!<|X|+HLK?Sm%q+!@`XqK)r&s{LB4ChdzE>w
z^8Jz~=y-l%OV^CU8+vSJizyvlrWRh`^4qq;R{o9iNqzSv`V(edEKbSac>R0y264l@
z9P#t!TGNs*&&a-T?%bvmp9Q|1oWH7@&q9|^a)LwEq>iOJlMbf5u+rJR`If+oUB;P(
zKO;@oJ`9}cW}CRx${=)exqIWn!=gOLQ}?bn-ui!Xw@p@ucR*n-%lip`+TMni>aKhj
z&(GLh9PrxcmfWq<O}`dLJ`(l!+*M{4sa5F{?Wmk5xshXrh-aHYFL&X+O?9^}rxrZ8
z_T-b2x~x`gAY&Qp*K_v0yjju<LSB6^KlAzc7cXhiCBDD3s=L)cpWG$)L2-U<L{ek+
z-yQ>AqqRN$YfiKA+dP-vA-75NqNsVQ)iU9~b3+Y0(v!-TwEu03`+w*6XOI5;#A%||
zmwvxbj+-I4fj@ugp%f_}!3q8MTmNjnsiG>Dxb4&b+;X2AD`mHQo3QWwycNQ>e(tAb
z{Jz-9?v0ruTsxydSaeR!oii_2YAi?&%we8g<=*b!a{jT?mEt#hRCk_Pn^n>CTV~N4
zkHZDQTT>=YUnJ4KX=<yk$^(s`LHBa<45BZ`A9y<3@ZY|ce;;+bT^F9t`>c;z%ridr
zF210_z)(Mjfk7NgW(MVGy@JZKwb{kDk4<_}{+G*To$ds6l@#l3?<3!42_G#Jy87|;
zu~TW=MMQZ7orMHB4Hz_LUc6er|L+WQHkGGy_LfG9wllHY+S=OQwY_U=+rOw^KJM@J
zAHIfysmjOFcWT^Dit6}fVHKM?d8dTEubjM1S6tX?-`F$Ha=(1}IQjX-pD`}^uEA3S
z_41A^iqd_!cZKN9PY)8J!cS}XE`MDX+ilX@^>o#$+Zx)ZSDn4JNK5*rn&*}L)2^o0
z6Yi^r-t0R6cF~SUVU^d?Cc9oUSrmBotMb=#yW$*vFA=L><9fNu-!(RT>-U_gS9=4_
zYw@PfGcA4-@$crD>$w{P>bEBCoF&HnH;Q@j#rxO8SMQp|(HyinbB&;Hw`A$cj~U%d
z*{<Y;xmtE_QnNCzt<B4SowM}cKUojmm1R>+A00Jz?OH8<-o<id(LwuZi`J^YGXK>)
zfBhyg_GNWH8S48M@f+Cx=$-9z{ppgmt6G<RS`@cjIEB$P_Emd4<Hqf~yp6jjuM)E`
zef3jF^2n>N{iTYxO2W1*esO$r@r(WI(o843`MpNY(0uPd8$s=qiGd~2Qz}buFLAh*
zHS5~xZDLGuE5jD~%+6V5t=|y+DpdDD{F0tmuh}Om{@yFR-CC+HCZ17lf4ArDM6b?&
z2OSN2&rSaP|KA6z+MkzSPycUG{r&MrM;7^`rn$Sl)Vi6bG1#hE*sRn%qpYKoQg!v0
zFQY_CH*?mnuq~gp`u(n4?w(QA>mFzmnRdNtU&_}tUHbfdx2g{Rwd*>^Ay(vj(PjU7
z=?LLa%|+X~685QG7fkr`@$qbr8ogQDBwc+)Q@dSDW?xm^bJ;^->x|UWK8K`ZzE3V*
zmAdA!GtWiNee#-~buKMe;&K)xg+2Oni#dN5>mkk6_C{4ar`3<9t6!|#E5_cG7X0X!
zRQSV<*Wa|~FrNPK;Q96c*0%Q5zkmJJfBxaa?BfcBb$?&J`SW%5=Kkj|kH_z;|N8Ik
z%bV6eG>@51j5kb=UEA$C&u3L?O+mr0XTDv+Uj(IMkL>W8Sacxk$Nrx@|8w&?))=%b
zYP;#yRA*sZ|5JF+!PhoB=Za7MsnE97Xy)<5&CM}B$`#kTSOW~7u47klm?gGE`HykW
zvHuS_raWQ(_j_~3weD%{RTUKyS0fuYafkOl%b%kl(9UKvK`zB3PIvR7Bimo(Ht^oC
zv^^mI#r2Wlla~nzA2eo$`$ngEAH4gxeOGz4yw79ny8m)N+3%lSG&?8o$whtp{hif~
zYKzXyzP)HJKhtI7nu_V)UTplj`u*L1qKi{f*A-?q9GtFX#h7-W^!kzAyQVgLZc03}
zS(@>65~~iw-bYG`1{~EQqN)!jJ-x^yrB$M8rC@QbwDar?Lk|H%{{zOBvKyv#7`yGb
zv+B0UgHFzlg^yowsjN==A*eVpZ1uHTzds_;msEbf{PTx-!)2}`?Gu<)H=Wr2^+c%s
z%S|&M8vR`RXYG;a&qbA+v{tkTPM)P{zWrtzi`K%-MgETsO(nEB=1-cjfa}0=`MR2f
zkLl-y8u$I_G-24Pak=>T6I*|^$jf}cIt@OR*y?f2>1y2Xb!};!`eDJ9x3lifi<p#V
zafQRf@#{ZjPR)=bA5xwwolw61W(fzEcjc_c9VY|7-FrFlzWWXzB_rEK)-7fFoU1*p
zT1y-LOq(ifctA|~c!Fnws(_VqQvG^e9{cP7U#3vugh$gC<^2!7lCabF#F0nlcLh(x
z*`9l2vhZM&?KF?vMs0Dn`t=pBm~UA&U194JTp^YEx~#8E`TN`>hxr1g&z;lBf12yf
z$8%}BtNF7ek~pOH*i5m}O^uT0JhWp$Pej<yD#ag9rDwc<!}X8Jvz9$APRWjWj+p#i
zd3XJj=Tx=LW;ZCBiwA8{J@|0P;R+F7?IXOM-EOj7UK<?EKI~u%5KUN~@h_42zkXoD
z%k6t3t0nGDT7TPWHk0s2>9i=<c?T}7ZusjLu$7;GiY${<(1aa1&l_Hwyza0wu$q-I
zb82?Q9>s;qxgDFB?)h%*^1c+cMojX9x%Us@NsN=c`gZ(~7Z#OTyp}0>`i2{;TIKZ2
zrYIUQU*0Lk9r10E=fzWUEg?KBC#?3>o|WwFRK2T9^!dk&ffr_3?W(L=V&zqro_ytP
zmWUyL#N<X{4kb-_hHdv>_8v}{S)12ofAplafnWRF#4r61Y$`*2ZgF2)^894x&Ye#l
zKG>0HvpeJAf@MFJa0|1wJ@yt0oo3G5GWiM9^t%ZbQ$pg`KiH^nYiUL(-v{ZsiCOb}
zbbp54S!TY-E&6^{Q1|RZRadN&mRy*oIs4tb&DKYr+U?!^VTb(vn-+IYn{giMaCa>9
zng8#l+P5XHOE?(SzP=5$IZ|q1+MU2v+YoACP@~A{rLC(fEFFH!q25@`G-vCz)vXU^
zHq}45v%cClk=OaQ^lO%H`?|A)YOn52zp*vJ@vmFC)F<0F>se;6?G-r9HeENT_dtv4
zgNe6{1-`zL3iK^FKlj0|INnE#D`uFicD;Bhyj5+>o{AdJZEwy_z7fW(G*k6rpJsj0
zmPftW#b49|p1$z>WK#L*$%~(Ydj0m@Q}qotZvSXLUHRXqFPC1pNcS)2KlWI&bbitI
z<ahI4B(B-ZldHZv`p=TZ9-lP-aQIG&3esq8{dpv#`eufRrd`{!Pc!RM-|SOzzf)<v
zpy=@C`mj%B9)9bO^Jq*y`Txn@=f4b={A|@apZ9NFR{e@=sd;h54J`M5P4Hc}d1i&`
zGS|oiX-%F)%cYujUY8w}#e&^sHoAA+P;Ql7Uvn!jOv$!Q_1iqF(_%YLB|P)|*HggH
zG3(OLyJE9%gqd#Z@qS}{aNR@oKl6V#w{zrezpI{Cd_>?UqhM)$;*)|;Ke<<(sNT-m
zuvfEa;_{sl7Y%YIzUPr_zxewbmu&FONeX)!dwZ2G9bNj{Db8p45-}g|FUwnJX%)^~
z)V(pE=}!2nT{A>4G*vyAdH1>L(+2`OckeEV7QAL78+v%rtM98c*cWOt3+_)6Te4lp
zIVOm4_v%-?ersp0V0m&t;hOy+rmHnc3=JOw?>c+`$$fC>%Qu6CSEcq};)v<?-Qtoj
zaWXB*^QrZT6YNsfvB%SxlDBl}zPX!s@lW0!G4XG=r+e+{e{^6ScQxB1g?t{Vl|pTI
zeS-{_PV>CD<Ys8F?zIID%onO&CVWt|;I;Zt@WO+KQ-6c0vy}>G@BAwExwp*zx5Q<#
zx13v}V#!nTT6cj;bYtkm#d`Dkby=6B3G)aA`d`TJE@s>yT_QboGVg4a4fp)>HtkyQ
zm-ob(q%ggy)?weDd9-t%?d3cu$Mdyl(e{1L-|Gw`CpCwijxKq-%;tY{ZL4mr`J}6&
z%Tqpn;iyou%--b3{c7*!jc<ZW&F@%>>^;Zkc0$8ChdV6j#_FZr|4O2Eb9JaHT3xyy
z|Nd^doY}Lx%_i4&8+%A!+9=A-Aaho}*+TB!BDUk@Hn%QUeUI}DGOHI{cwh&!kfutH
zPe!uC?Nc4%^6QyDTY0=aezH4%((#0<bqBr7noFxwHXl3jQvc<(cE?)#`h8pTV~%hC
zyyoaXy(O1r?|!+uYhK5XOK)Wa<{m4*@h5JzGk5T$PrDdrWEh_OGjC$W;+e<tS9xwz
zi0*e!;^mFi6}yqk{99?>_T^1K+Se4wE-4VK7l~Dvl>GIxYW3#LFD5hn=wz2!>o9%t
zcJXhTFPfTcCHOBix4&P=zPzzfujt-fP5la?xm%<D9V(NacD*-%Au&1PHq*3&ceVC0
zRGvNOFiVn^<r(w+)|v5#?5|FAU9oue8Z~9jLece8OqN(py?2$T;N>dOCo7Uf)^3mw
zTsM7D+uq*|4jaO_tzEib#4lRz@$Gox+V-rOX{=jPcCgkp?YcN~t;fT?%iG?3pDE<F
zW9wFqAO22n6@#BX?8%;zad*w~%a4o|PrUv1`SLp_&2FKy@p0GrW|x#ax+1z+D0~j%
zG4VILm-raJalGe?b$QQmYOiC&ZZ3^KuNHbabG&5p4{dBpx+Z(8Y8ChD-M$A5TL0Y2
z%`Ics@_NlP-Bh2m>+jURM?e19dGlS4{DM^Lx7*_6?EJDcYkhLwF6I3l&Aw)-ZfAB)
zBo|LxyW^2yCsvO0lPm7}9j~8$PPgP&>C2aIUNb1qbev@J`OVAE;w+I?2ZYXDme5#m
zI7QFy`B5K}w+9ZbGG<LYtd`<g5}Q%>%=6Qve+vXmrROj1GtJ7p>(|nkcu=6ak<a4j
zqNoW^ru*I3<5<?du(JJ5UCg<c7b@<Szvo&0k^k1obF1F^l~&iw-0fUHtGe8oW51`J
zr^;=U4T0VNY^yf;r{{CusAxDBx;|)uYq`YkKWlyj314~j@zKYny`rjI5$g}|32l{R
zeH1D7bN0D;3uf^?S)KQ$KI)3^>J9H*<DxYA+{DlK%l7Q-H91(4cg)V>Ur^litGb`<
z8#~`|+z8*=+ibS6I3eCLS=`KN`rNxN7d-4Qyw=n)zOnk)db#h$`<@@1?lR%B*T#HK
z{b{l$zkMVwI6c>tiCbZ=&wrJtS7Ui%@Y=;oPk3E^^65kL^wrxH9zAYUyJ8x^{@iy`
zsQF%>t}vb16K1vetvl(`G}rXaqr&)kO837+s`f7mX4oH-W+1je{g}A&8HJ8jnJEqv
zo@E~3I~lb$xcb0UCItm~Z*hiwKl7`t_^TY=6=~j(cQSEJbJ?D>GREfA<^rEHj&m>X
z+O=_y>vzY7*m~DP3s*G0T$OG3h`smJqAy=|8M|NF{qv}>%Khh#`HJjY?K|~MEDy2l
zxYNvVN>RGDHi@zR!;e6PyI)dl7?vs2#p#E?J(lL!zBq%S{JM&jVcR+z51BykMHU>h
z>^|O{!jqN!$tC*?*Wv`Ppt~Kr+zuvJu@&Vqhi}oc)j!?nbSlpNi@1UZw}2w+n}6$$
zs!f^MI6vW<OaJL}rHf)0Uw(6}Bk;@5O&40;_1HE^7XO{rI_1K)e9?PmHHv2&>N|R;
zy6oUBU)*(3v4;Ks7oW&IS1Vf@b+$aeA$MIk{f~?-^OVPhe_u6TKX~U!!mS&Btki1z
z_Nu*o9`-Q3b<sz4$=GzKeD^hrr!rmSxW4LYnBmqtp3RDE4d2aYeROs+Jl?+hhD&_%
zuUT`yCe%!sp%{53Gd6VXmj@?zv}FH%b#g{kw797-SI1|&vYh<vwHI72ZumZ-%sS2H
zciz)If0w5|oNaNu@oRUhNHF7)!=bFtPV%@sOPOh%xH7OL`s#IuipS;4L>@R~DcU8x
zc|0SPTW|K%6`J`wv=+`b`?WE{cbb+>`Q<S6n^NZ)L^O_;T9rOJ!1MIgijY@Fq&s`}
z9QobyuQVw4%Wb~AcVY@EYz5r91|J_-*Cr$={If`GI&tIGd4_7n2t$=JyDV`#d*!;q
zfA@}O)-144i9NLLeT4d1XXme`jXTd?>%L~fdW><?w1p?`ZfglT#+_TLzxawrze#MU
zZ?=0k^CL&r|5tu-u(O-?x_#r03z(oXrL3;&)3Szzg&rT?zV3g2f2q7*{J+Ovj$eOy
z`to%9y?*g?|MCbiZ^<^0$h@|i%SEWdUZ7Lui<8dWt&&~8FIjS`@9^?J^zf>#;<LS0
z+-x)DIhr>M{rO?G%;c+?-}VQ(&L?-r@hIQ<Z1gN-B1g+#rw8In1s}v`I_GHGy>6A;
z_clT#Ey_^!;A?NMsqzVXU&Qn@#5ztoUBA-*&x7OM`%Qk<eoC2OGw1Nl<nn~ZhHG=0
z5~4IZpY+Y>yl(u+{i1Y+@ZKYf6&<#pES*xgPE$A9;8NvOw~DM|0+H+QICvb2&ps$&
zJ6~OLNB5OU>>C|5<bFkazuzFR?adoo&!vy<1s^gj;qaDq+nSvuQR$G!X!KKW>E%P}
zi{9S)7yW2UK@P)<b>6D|nI0Yo`_FnDn=s+8-FA<Sw{r^b*4hgkJn*qN$n(D3G6QzQ
zDJO;QUHy{Rc4%6l`yH{nz6Y9n<cz}||9`z_d~|c^tmlFI;`Gc<IUPExv|Ig>X7;KH
z|H=bCh`y;U`0SOIo5mE9H>2~snPU0Fp1V7vj``Q`eE&4cSZrrM=P$1{`~LBlJiFDn
z*duu1ZT^jH`)&vyciMc$;s5^@)iol`c`|AFd=GAh@8T$bA@k+xJjM;~t2tU&IL^PS
z+S{eE{_YNSITPP24BxK4i924e^Ki}l&)>NB%atFOn{e|<^x=P&9uF<b6S{95Y?3kK
ziVd$V&){hL;j8srafk2wJsX!?*2zEkM<+~z*-WtZ=c<wtiS|PqpM>_6DSmukvi;A7
z*Bfpe-hAPCXu-1m?Pa%AZZ;P@+;+Qj`MsaoEK>~r%?~(#C_HdOc1T0%*7dTkL6e(T
z#RkVLW4<idnCPU}tov}Yu9ek(rj$~(e+j?DeN8_ZP5PvHD)XsMg@gHv!|zO|Ouhbf
zorRg4gV+{^=w%ka?A`~K6k6`#KNCFPb+5nvy6a)34}YxM!ZywL%)W(J_<3K&`jxLw
zod1LQ(p-xv%J=6ny_nH1^I~S0<Mz06ZddC+C6lIR#@(G}@|^7s69=Po=w!*h2K}U;
z<-+l|4sHy{+QGd*-}#PZ)N6TxThF(&E;~|NmEIQ};jZh$Y#({(Y}gB(HJN*!#zsw?
zv+aPkUcry1UmP+A0`^~YWBs?-<~y62!Vdq9zpiBdtV(Fxm(~(z^EuIycj4UMVsGVx
zPRPyPc}Op|t4eK+?G=qx3DqnrVgKf7gsq#u!$17A#f;yJOk}ooPgKiv(cWv#++uu(
zeUo<Ouj+!^f0xeN!g6b|`Q2@o7q3os*lzf<SHNiB$qnCg+E>qt$(Z54#5O&ZHDFrk
z>)eBP6Pd(UTJr5!$Du8~aN_laf43K%Ihp>CQM1jDZ%4z8@);LhFD{bRk(w2_R4&VN
z--7OF)rtysrd`Kna;7uNOZHw2)3bOGtGzwn`KzKql#=u71fSO{GLsHk%wI2EWYTbC
zjiuA+#A`VhLyQW0;(G3w=eqyy{5!pC;;%z02VSmdSYs|L>XNp@xk}}!Z<u%BCVh=R
zH~6Z|R8(}>kB9Uvy<hg??U7dsPx*ZA?F@Q$VeYrnKf2}!yb68&?8F>@KQUk1sylL}
z<uaQNFI;4rs$P{L%&u*H^l_3=^qd1n%eG7vZ2xoQ{jRo`X4!KE_@4bK-Kk=7f9||(
zeqZbMF3St-v-A6qepq$G6e-)L#1<FkkH-Rij?X`vn)c=5+H;!TKY#13ySeR$!ORm=
zAK1y<cX=CIAFU`<_+{UU>KS=b`-NFg-O$+F{Px*|pw5@c6|?-m*X4imdb#D7h@#rU
z7fu)SUe2lKa{2b=*xov^s`ZnFB^hoS?z8>B=5DaZ(tPJbhOT=zM~Ic{1y!!_bZl_f
z&OLvMZ%WdYtm|jX&6Quvm41$?H>!5px>@LKDxY)*r`BBMOm?qxykY$|4JoqT?F;;#
zmd<U`x@bD(_b%4b>C**QmiS+v)pReCH@eDs^@%TnLI&OYJh_;8&dlTwelPzh-ryvY
zS=g5+tD>GTzfdgL^j1(OY?=A*{IxHOpZ8AQTasleZ^qG}%&=W4N_2AeMD@91YTX9~
z(z6#i-H2RO7Pv|#nu$q1$40=Y@K5vy-ai%XCRMj1JI|D_61)9?d)X;Ib(P5GiT56T
zUZB32$KFsb%gFm<;1@B`Dzlk~7e$_QN?7Asz-Ba0bC#shSC3OUoE9@*CMfvsa*<!z
zBeiLrVWTs<cjUh}5p|v!=ig4%nlSa^g0rW$e_-Y9YMYe$CoRPMZ3OGmTUk3d%(`>?
zasA4!Wr3o?&-|_|<<$~AGyl*e4e!n$QYHL}$8Y!EUi7j@qWE>`P0o1k<J)|;pFj0!
z_r}%7+xs?5fABJZw?6dH`9)it*>0`sh;cgnfsM^1f+bSllYdJ($M<PQfqU<N{J%CO
z>8zvj+`7)4{a3$O?D|~ranky?fwz@eIG;<H@w*6q*tFruuQCPmO;VAi%KjdO%e2K-
zYetF5mY4OL&8w<=DsG^ra$c&=DVTS1ZfE7sl+M|8izk)~A8ooA>OMD0xa{D4{kyF_
zrIx+6K^MZ-K6AeC*(X(6DDJ+S{WYcRnRB_lzlzE}VHRUi?OA-<Xh(6-vqq;K=_@U7
zPGDWPHPUgZ$<C~a*%qF+#f{s8?xsAD68Sybao*h&*7Cz|e@E!L&E(DIiOrFY%$r!@
zv;5j@=ZVvzcNcH+zStW4fqT^|m-OEgycX2F>bZ1a?MhwE8?J(<SeETwP<&nPjHT?V
zWqYUmn4_!dW7y7aD`}zb{(6~R*0T*3eI6BZSCiP3H|0dMb*ILEtW=%6d3NQ-tVQz+
zcY2#PsK*MuU;Fv{`g`*3`yc&WVU%~3^UzVXSvmnu5AIxNDxKc*AjqZvoK%otkoXKy
zgQ?z8a)~ajrNN?>jz_=l4H1;md3j`C_p$p=Y>jO5C%stnByk~oa?1jB7R&VsB_}SF
z97~?rIN|W37}-_+tFEfK+H#zh3!m@J?$_h>*4MfG;OaLk>$vYcu1HIeFN;rVIe4Ky
z`ALqzpRVja%~P#b4s$P5?wL0)=+>8oA}{a0ZSA*w$0rgI!lBT*)c&y9+=JYc1*$LJ
zGJ16Q=bHlYH$Qb6vgG$XTXu(2;1-Lb-I{fA4=Q@Q`>W5f+0R|D;28Ik(@BSy)@{3d
zF)NpEMfKv3!fSTbwrMf(|GF6}d@xWjhN+~x>h(&-43Vj-PXd=tn`)#lv-Qkz$H_M?
zo?E`jM{e#pxt~%33u8G2&Y!Jn`k8duH0;deD*frI46UqvQ(3!Abw1o)uxrJ#H4&PV
zcRhL^acKQErYkI+tBa!#WErwXhWhCgrdlY^slK=Lci7+lw7>+{?`b>sDw!_4WqD3U
zhq-<CQ<>0-TW7k6OSXP`WBX9~Or}|ytMjq=Qd!6I5fV#x2_9a*twpx$7@xI9$(}3r
zCae9gZ#a4&ndMDL!k?TqPgifsGR_F_2|W3D?wjp0Wibu&B$s5qxHY4H(dM=<Sql%<
z++U==)Fu7!+Kxt^hTEbE8v}25oC!TFy+ua1!00~LX~)yXZxm!pzEwnSu*-LmUK{?V
zKAA<hp7UQtnVd=MT`$)Y%t5KrwVtov-+p2GMSQJymr0YMR_5AeGk)}VO`axZa&URI
ziH3vB=ktjVYWcR#ZA;|8x7>7UC`Z7T=<1C<N=H5(32~E;Ik4tVkEVrieBT;@jj!bV
z&8-vFIt?9ea~nVC@E5wKUfospXlZoN)IPK9>mkW1jwXjMJ!qU!8zSqm^VTMlC7*qj
z|H$VA%VgKzwNg*q|829v+?G2xZbrL!?>fz3zC7EmbVg~H^2%QmzbRH;dQf+K|C`cT
zm*37WPyXt2;aPED0&9EX1c_B`yYGZPaoYH2e$%%3+asHcE>-Q4y?rk6;UU|EM`umC
z>;9O@CCfjweBYZ>;?47BS?|d?%lHnb95k`FNoYxZJ;CI3PVv#-<;#w*idri^<rk+>
zp6V-BiEryK%v|c?ylJk_ME_-bGq$9fmLzKUe5?2<czSnImWp(6ri;*wHIkRK*RFZ*
z8~v{}LH@3k{=9;N2e+vnFJAk!t>gexcGN1Zy(jOTZt!{QH*uD6_V3j%O&(=)8LcUp
z^ZA(P?VwK|lq{Rp_TI=_xbg0Z(w$rvV%Oe&{DN=ahN-KkuDZE2hjZudXPrHDJ7&+B
z!sj~mX3~OF5|$g@>@mA_adlP4Jn`$#%5M}j>9NYNsO@~@7VUV2eX(!kZ=SR{Z@Je#
z&M|(WYE^SXR=xM+(#129Yi_?`y{sy~sAsOou7p~ffa#}S_bvPK=J&Y?sn&PbRQEK$
zPd)JKOoD0J*Oa(B0XxGt=;&5NbMJhgd{?^haIEVl?bTAoA9&@}nU6hO%ya0me9YzQ
z&Hn2pMUL>l4X=GAb^2ODL(vi+gIq=Sq*>;yH|5I=gx_>u@_d{8eDkT-o1(M=C;Lr%
z@o`Vbabc0r$hu&k4<Dku&o$3)$n;ybL+9ltA?3>}lrKqd43$~rIotBS=Y#7@&m`_C
z-gCX-l<N1ednMa0_^tG;kuPkJ{IyDZ`kZ;zStsAkIc^p9VcXZVxpDPJLX`>+78TY_
zvJcriw<`CAgRRu#om%ob9}oU|x5zchE&P-A^*;{pl%LPAt;m+qc+6>C(I(Aw$8gyl
z@2CVFKDC4w-swlUR%<SpH04~Crrr|mzB|!u#;ayDC`jA4am_v#t*CwNwbH=_&W(%?
z7kwXUrh2EjpWj#c>1?;UzFhvr)-zEn-d|mL;{EG2bI$nxXfSEzJs$qW!?dUN{f$&}
zg=KtGXK`J7_%6HgWXhSl5{;dfH=dob^R*Uhl&)H}YyafG*Q3N$A2B;T$T!QrHAC>j
z-oQe?dr{og^S|$oQ=9r_b>+rvhN^9Rn+o|Y|6j84%IT2Mn%*<*zs!@Me(r#&O*gt#
zY~5G?QrEFL(th@uefG0Mo7?BFnP*zfU20j$r(O2=7XMr}r-#{M+p02+=N@{IbbGHv
zhPJWNidxGx;Wq_5kC{HJH%rjmaO)zo`{o_24j;vH6wjDt+iWZ6NM3GUuJtSX=lisY
zS9i@koo#W*`6yfRqRqZyUvF&_lv;VKqfF;@df)LMtCW*P*Q`D5935@-?Z#`%Cj}Dh
zQfs+G)?CrLwsy|VXVR%{TtEE%XYy1&JM!vF`o(LlJ2p<5@?ovu%ABp24Qp4<lG<0a
zp)2>x&yYQ<L|(D_`_1H$xcVUR>e~;CPx-HWR90qc9eFvuyKljowaborKfWQqb`9S-
z`GdPtQ#1r>O%~prCv3iM+KZn`9-AI$?_2hLyU~(86BVXQOf6V;P4-N<`tP%w>zDTx
zK96b?Hri3&EnV!B#A#h{edm|_1FXGISG%!aU@3cOToNPp)a9q%lJNNDDo?(-ndUtI
zxUQLH`OW+t^B&B4x8(JVJDZ-!N_T}QJiqxk@XMo{e+>iv+)R!${rra0Zn6C}?H6HE
z9scw8e|YBejggH}LyJY+zV6eP+3Dxw|E%Bt|8?fKzgJJ6T>WS3k3^}>p`N}w-siC}
zCRSRn`MD<l<oo>evm2WhR^Pv0BUWBB?ek4JxxL#Lu{HK=ooY4PSiL&rKJO~#Sq=-j
zf1bIt#&PX6?JJ@Q_p@f*d8R&hia~Wo?AJSDb(PoFzNp&0Tes_YjY(M4jGdReCZ64I
zvz}pz@y3eB$?0hiAIb&){%C){_TmzzlIcDlcbG*#{C_g?nu+VAprxH9LBZRU3|3e%
zAKm_l#h<q%@9xf$J)&0@?ungtdDF%3I{7yz9#p>Eme-TxBz5^z#&Ld+>r5KceAOHt
zOw(80v-VZYSxe{5dP=Kbr5)I7WvtD(!&azZiu<4B<;PaNiTV0+(u8$WlUD64x6a$W
zn8Q9i;xAMF-llo;ZTkMP{kN%2d*Z*{ZB1y@WPOP?wO8vNK9SX#@h2wXY|ol|4;*hW
zx~ckqxFa7r%i^PuThT^=wE?QGB2Vs`cfNWprRw^&+TQba-AUI4K5y7QKl}ae^q2QX
ztT^R11ck@VE9p<UsmAd@c9+FAjkT6{4&P6UKcQw?siuEITKx3X719w#A#rzO!cTGh
zFcWxJ$09!U#hTAQ#0{d4EjNDf=7+_sW6vhMyf}B4mt~;30rU0JqsxU|D*v$cbd;Jc
z?zyo)H}iXxRNca|ymba#eaGy!U7V_Zf;UU{*F46$*fs`_5QYCo?!R30=h@SBXJ6`i
z>GXF$aGHHq_WHqF@&;AGrdqYBX6H;w%j;{F|JvOjI``SbfctFXESk&1=HET`<G)PK
zfBTic49~v!9vSSj$olTj+M4^Vt}(B9Q*X6(Eqm-<oR(l29X@Z?ZIPMh)E6$SD^FK@
zWXHGU?e}!?oeM+vamM-mSTiYd>x_s~QiqddHvMrZ-gcE`z0`7^EU!h$?2iQdYWNo~
ziZ=JGZF=do^~d7sTffu)?bq#kGH2e2|Lj6t5i`Edk#66A*xbEp;sjYoF5d*3<b_=~
zN)0%@^v;DW$rM;yyiw&jQ}Io^8KT9qFSh@CS+qt#*>1aqgMq&xlgWX^%XWhMd$!DL
zV*m8|<2%a};z62BTr36$C;x4J==x_8izSCq;JI5n>sL3cT>qJ-%CuEp=7ir$#y<y6
zO|t(sPc`~#hyR~bUgs8WJh&}a_i+b@LWq^<8J~=fdz~MY6ulWPEIN2;TjXuF#EDEV
zPL(@&{rt$yZsf3=&s$ZspCe$0v}O9I9B+STlb|1Zf(8+Dg1**yXZpSrH>oe-4}P?E
zv+wNWHMP4U%!~P@BJU&wEe|ir``-NL^Y1ls2PTVr7WPjPeaG~9`Pu-k4?OQT3orE7
zn{~3&_Wth^(m%D9=gj3<^Z8x|+vSB`<r=pu9y``-6!&lWnJBLR<|zBOIT{r&j2}Gv
z``LZd;p=mE&&*;s&J><&9(%**YT~T)Wg0ow)8jRh1&^A%neP+oTcp9(ys1R-;`KnE
z3CZcn$v<7cE-ljgF@fFt?@H~Rzh_5oKc4v9;?FhS=E6^f0XFLnUv)51_pv_eP*hsz
zT3{8>pjAIp>X4n-7s(p|rMjD=p2wKa&I`2qxAsVPujHk@ZJqur7gyg{yY+R>#3P5_
z)#)7l$W(mrS(Vk_MQ0`7^ljojYCErI(elMFZfgActx@&qkPFX>KAEeLi<ebvnC-6F
zde4&0Ec6VU^=Xes%ePNi()ZPRCg&qN#(B#w``p~Jbn*F?+DRo@KEG@iZk=Sptr*t4
zXERrIdy0&OpVa!zT&q`>8rc?v$!@E#nA~V}v~kgvXn!V?7j4mB)~<1!vufXuGy|I~
zHTeS3<{9(axt{FEI%M@MEB)(-6^S1cqdG2k32tU6|Dpa|qVeVrYnAUm<}R%K^QAS3
z)qc0QdEF|tgBIs{B|LP#Z*~2zX>=gk!cYF-ge}ijPf)uW^3ftGyl%4GimiG)>Yu)Z
zf10rIs8rkOYNtJI7yWqsAEh47IiB3bG2gCLGS1vONAz&{!^EVeWotetZGKy#amc@V
zsj=|6H<u@tTmH^ku<(oJ<o{w9PTuC)`uMmN@7=?ve%&+Q{-fnr<^Gi_{xjqED3pBC
zDsZ3w=Aw04hQhab+l`KKeeU{tN^IVXdF$SbT7ObVNSM56-TsTVyAB^bv-gdZ`<)*w
z3mz^F?I>^NK2UOT@>dBr_rI4)%`C1zd*vBwF3!JLx%hv$htQ4UE#I%^y-4ik`?&7?
z&%Y19&AxLe*n96R=O6PprAi`SZ2Et0cG%It*K@8q8}U57I`3TVOvhle3icP@Qjc8K
zufO`xM_;PTeeKI1+t2y#U6o+OAKSyX^1Ji;?}zvL9kD5x<9P1X*?XbeCw|*h_#@!X
zw34g;HptX{v;4y*@p?rAAIF|cM@vt>Ieu9uB3pNb%C?2-@jSn|_ZTnU^md!!ME}p+
zJG}M_dbsU;aiI8e%>kQFUbCyGmQHyfF*DEVTfl=i{LOcx8$PgZde$>h+o{jcGra7b
z{FW~#bgaMmvsMHhwDP|x?7Z}Ho!53N<Am7w_v><l<v)p7KWzE*a!UBGg*!#h?ce%^
zk;&TOyZ)r>>vi^g6TG!)jn@h_zv$0zAKyNg$goP@?|l5fE3WSYOLpxzx>t4A^+e`x
z5C0zD{6DGd!rNwpm&yh&)FgKuO?>=adwyCk*P75T-yYZ3^ElWnPP+HPJIj@Mb(q}!
z^H-J#gy>ys?>1U(=q1~*S;NavEOnjQB>t+hWG$ofv)wutW}mx0>(c(!>R<LNEz|wl
z@GN4|IX$b#vCmzb7EFGs=YITnu>D01yN{*Gsq6atH2#}NUlg2q%;19m=0(*XuPZM*
zxx9rdp+>5IqD*p(+kB3B2OMgTr3$~0v#|RcF@^V9<~gPhbtQanWs{S(o$;2tn7^I%
zfeOEU(0voJxIej~3@5f5ye^)qp}#w|`w0ufL5)Da{w9Bp#93-(s+(ClEswQXo-sLD
z`Ej|D$Qe%cZ6|JTjxd&A)cslDMBR#KD-0K3D_YoTyE@Iaox@%5p6JiUMf-itL~CC6
z&lhU4ncBU}ZsR2_yLtOxwfGslH%KhbRPt_O)62c~sr!6M;JjP=W``9gt}wTYe<$g`
zWa5oE?X1SLy&meC+ker>kNT^ju#BId|LgbZ443Sdb(v0G^xb@snt$%$t!5V|suxR7
z{NpJgq*|cqI%$=+Cf6!UXYrsLH>#Y%m3mgqsP_-?xmb5nc5ZNT<hh6i4s&y4Cw%%=
z=d!g(O0#rY-cB{<z{&qau8Rd|2sh|?C$um8{^dc{z1QzJMVHKb@^Qh>jEN3bF(y+I
zqBBkE1WaYGtU5LC!wlAPqxi6$Y~8E%vM2Yyyt#gV&7Yn2jJ5JDOA0%?AHH<BST7=Z
z>Z0bvEjM)>C1cIA<iFH2qAr58SU7Q03nv3Zo+9=Y&7eh)CHeU|dIgntBXjd_y9xbU
z7r)V!PoY%(Vp+qtW(H9Y*?8$MvskwB?`%G=pi!7<xNygtcR_s#Kla}@{(Vf`vgnfB
zyLF;Wt}*Y<*?hL!Tz5?G{=PrQ|KvZNb-n9+{L?+xQUi;2Cg{(~+57PG^OG;1NLq`Z
zjhnVz`s}><^J;C6UpIe~b@--#Oy{hpHOI9t<`mAzoR_OU*{Ms{`|_fzYoBDEI+d%u
zBrP(Qd+y7iD_KT`*;(t;d^G;=5GxJ5XErk=rcHNt*z~FOmwqo>lOMV4#?<7J=+3F>
zj{Dzc6{&ANrhk0V!%{EppR1-`?b&<ye0P8LJ%L%0yPsN3-ScSXqpTlOp3OX$CS3Nz
zP~o!L<=4Jkvw}~Hou9pmr{dnDiwAv#_U};Lns~V<H*|N_l8W=!XN3f9SpDSH{CxdO
zpXK$=)z^Ie^}99k%~kcaNopHTWH0>LbT_x+>?Rv?u8G@qXEOYdW}cfmRp`sKm%R6l
zbYIkKRCHfgF<r4@tB&;Ah{(<Me@hB~KKuIg{Bw1c51qF@teRCm`|3%R=d6L=%!_Z#
z$~>sluT%N(-d@xEMVhngxmTEOFPgC7S!<H_YP*>NNAqm2EnWA+$V&WnZrF3JSqFDd
ziF3=|E#T|kB6PAo)B9v`z@ACECCNU`%kRlON~}K~7^=m)N??7YTbA;>1<SfpcduEq
zDfH;f?QM^*sMJn;oMCsotk7IvP(RyZJ7Yvj?$YV?t^0oVq-I|d&&X!HfBk@n?JGO6
zgWQXb*_g6*SnFwWW#zqCp~4XO!Rxs9(I=-m)>rLSX$<PG`nBXwS9;OjmnI2vz3ET1
zx82%ob^FtQ`<v|!Y!dbh#k6l+{>4zuyRpgX&gP39SwCi7N_@BXQU3x7^#p(8zbYvl
zv(Dx=yByd%&+4tMW1WM~wy)1476>fv;JL`LQ<U=zOVN4x(_F1TdJ<f>=3EW1JXcrX
z_2jVsiY)!8pTAG1gxy-cmFeI%je192?aWv5x$o!nZ|&8uyzP^zH~)j&_i3+wKGR&l
zci^%|F3;J|p$C4IZ$6}vIeFop-l{Se-DS_7JT2GRr}Nr0efdfA^ph{Ylqb7QxA-Lb
z#o6}o0*8fy#v#9a4`(0gcG`XN_}`}Y2Nyi3^M018;`ZrE^41MpjNX%l{=R#{e1CPt
zE)FI00&!V$zPW3K<5{{NNl&ohs``^#klu6YAVbN@pJfeFdlM&%q|QBlB>&XDs7*g_
zCM6tKm=XVA!~X*Aji+~B<lpGiVBELiK=zh@uWP-wXx@*x?<3A`$HZ~t7fXlY45cc`
zj?L9`>KIzYD!Cba>g(>?xSSJOvYBfhbAI8@GX;?bOP}`ePTiiMt*DhOUUEiv)|Kqd
z-0|keYo8k`OT5*$emXg<r$JcV?3mc*mBOKEs#b3fiZCYLmz?<GMYE;x1kuO?LNZ*O
z$6S6{ed4s)wbO2|q4eETJSWPQ-nO=x<8d`abt$97+niS_$FGFS%WaD)d-~Y^(FZ?c
zC)FvYlY^eBimqM9*s(0RH}>7c?(O38oS##-PkflNd}GVsJJ&q!E-ez~T6y7$Nvr-6
z7tIZ#?gb$y_MZ1>Fm8D?|6cbdxks}kXD*x1xjs3S=>)^)^_#pt>D)K|Czz?H;=ZXo
zFw8C6zagPMapKHS{-qmClKtOkL_Mx*d-}NJ5p(^FT^A};o~6BsICp46_MV0Ifro#Z
zN11087A0L5GJdk|)}~X!Jo)OopR1c0T&h0)GO_OcLYp1sVf^zS*%=GZ3ock`&gOLC
zT#svchruoh4J%hsh0Yi$<|L=A&gJW>c7FMyRT8Y1QyaoICH6yU!Ea6O6DnGT7v>*N
z{&a1z<f{LrQ}-BdN)z3?ukd8HudVBUEfq_1{<1ZFjB`)Bg*?+r^(?e1J-(*rVB(oo
z(|-HOFY~$F;?Fbdb;rEtTg*3Uw$IKvR`=vLw`Qx&ybp`6a~$qrl``ID7H*R>`Ry5B
z=JaRJnrCfrWRr2=GS_Gjc@XQK_)|0G{0(c1y+IirG7^tv7pdmR7D{i{{t{9BZC_}K
z^iiqA5YOJE+YbM2Zo92=zp-O|r`FUN-1_fjUmS_v6FIZ2_sHd$F&A%mROhmMlwGem
z!#hPk)P0xxwnk&-qq(zB^8BgH>x>pH{ddjK^6+)5>_mnD;|JMuf*4{u&)oUPQPSm^
zu#qX&=j-W$%TsQcr9W8WciwF2GP#P9%U}8BPM%qL@jc_i7d(kx^U`yTGfZ^8J6@H#
zJN4+^=*<hIzeLFVaAMyW|NPjUw7<=Yh3@9fUzrykSNfF{+3`Oz`$zmcuNt?Sk1t#@
z`}G&C%f9<lZPWdoJ-gp@9P};Ii+-lGb@JrK*7&p=MStgJC9F0vsZrj`=Vg6!h4uZ_
zT^>v^Sz>XjFKk4gHdO>9zD#~UC2;1fTK84`Nv~vnFIZX8vvJX^c~y^hztxWDomQoO
zh*4$vva46V^hmYv9a!VO)w<$_EKAVhzP}4xH5Qqtt$w-n-QkVxg@+H^o9dCWY-4kx
z?@u4O>oP)W@3ZwU9C0X)PQDeh>+HAAGR521vaTpweJ=?9Dt>hK{N`%I>+(<DrWOWh
zK3!|~+;hX+SI<w)$yT~>Tk`wgq@>9|st#Y5KOr~eA2VOb%pOr)5syDBH_WK+JnSYU
zSn@pDtov{Tmrcn|<5jno*uMPZFY;qqlhUIXEx%M+kK8LU+__Zd*xA~BqS`l8Lr))X
zeqtDA@oELn-AsW!?i@150>XVY;;X-MuJFA#vAgeUdUtVrw%w!~cbB<D-oC^Za#SpP
z^`~v3Yd?7^UD&wuV&+4S`!Qc`|EaF8nWApJdgAfl2_H_yS?OK>_odgpIY?-CZ16W-
zYw7gkN=`SY&uO`*WVe9xi^_+$7t#VAy)_72?fB<r^zZMo)wX-fqZSqyn2Wo1*I)g>
zU$joOXR5~BVomGn37c2=-@3IZ*!`URi;HLHG3ys@F+9sR_t3rFGfwZ*=PC;is$wht
zzBrcQ!r7@mr5`99o%84B(*J&E{GYzs{qk$lzpuVG%wL4O6y9BUa=YxikLLWLUkY{e
zR^086R4qzYJ|_F=;=#QOXYc8goM$JYQxduTPsfD16(56sJzsay>#e>1`-381Rxf?U
z7Af3pV*e*<r$Cdl;|-&j1v^-GIm>fjzx{N2U$UN3^-Z7e^EiK>3)&~YsqV$s!{3wp
z`2R9hS7eu;=nuL4{3kPSOmbiUhna~>9Op^Dc%W$0p1Z84^1RodEz){r`!%xeZm9fV
z{&n$Q{l7PBuBfWq=D$)mQ%zM=e%j*Q4b8&;<R00svhtg~yD8b6rR5~2*6m-$E-k(~
zqWT^?n7+5Oe=l4<xt=+|o0&y~fq{X8A!Xh6C<c?_;FnAc465u53~~(69q77-dKP+y
zdMTO3CAyh;Y5DrTt|5*tjv<ayLt}$)8wk{VU%%tzW?7Cc!C6wvG8dTSDoFZh)+UKW
zZ)E-DB+vQpyRD^~%7vL``J1-v-W5Iny7-leO%{{x1SHR#q$yK!-*vjn1re65UT&|O
z<G!!B-EE}LVpz(>ydom9aar2B9tET22A_Mx6S7~g=-8*}DD3McvTDv{v%9ymS)>EZ
z!<D2e!Zjx!D$mz#)~u{hm~^VldSR2nyhD5A-q!0KE<P;1d5%~2E@t0PT~5DcoTIh2
zZIJiv-L-tDcU@d>@QEqrmQ3@wHD|8=qtlUlWlNNsea7C9WgBw;f8<uU_eTF5YvqEA
z6NGi@&S`ur^b((<t-GRRg5{$<ttPGCCoqTw|G1NwTU}xB`1T&-oe6Fy+uB<eP72%G
z)U#yqrUk4#H3u_3SjFCN_svg?wq{D2)O$fC_X^X>m$x?foV`0~#@6EKFWx$L1o)Db
zy!+Sde>j(Na^~7?1;Tq~Sg3iQkaA{v*Ysrao7BSJ`AnyKH%0hW{5YDjaN4)|OEkBY
zN{hvBy8NHLf94ne=z<#UrHW20htjrRmSPWRyPBB1=*ic0d)~Frm2|f@wtIKx#oPCO
zFW>rE-k4jo!*yratfvoCY*)^{A6D`C?DUGYBHJ&D)_yq?FnbM4u*FOE|F>`Y?KA2N
zG@Rp8->-MxSw|<L@xf;GbPujcC#ydx6`op?ZSMa|@dIC9Bb&;X-xo5!S?8OSWK4+q
z9d*oBENSw;p6b;PvU=a`dDb0uefA&GRiB^DO8d=McthW<$CmA`Md9|0&mV+K3ieq!
zq<j?Lc{xhx;3tua*EeKjyBBp&s6L=0z;S<tuZg;z%ipjw%w-3?IzK)VIrBk$K@97W
zLvtdo-)YazU)i|x;2o_BSu>MUhCT=NdSoKjZ#6o{^v^l#!P|x#Z9R-@H%cTYCm21S
zQETD+{BR=AVTPW>D!Z=P1y2f{cO+g*E=%QGsCDA@wp&f-W~L}M21-89%$(u8KS1pF
zW}gf{N3EGL)xz&M#EV}QyxUZ0{tGRWX#En`jA3A4h-N_Q;b3Hva1U2kAMW!WzGpA;
zdh2SPJ9B<>kiiw>2Sxs8y>-2GPU>$8((u#O)YUk7{=8<`1%vGum``ODu|9o1{Y917
zYqlw3OP{5vMQTnFnYyf~Rb^SUrbvj?>t|1&FMXx<EVQVQkpYo&lh$pI^4Wa*i7o>J
zg9!rzgBs49o0?ZrR2g58pP5%utXEP|((QNdy!N^Cp1t~hdZ%<WH2a>O^3^?eK6pbY
z!)4E<Gc7f%64LUL(&mYFJYYhz@Yv-ue!L6}4BQM149YkyEXgm3&q*yy%>mhV8f3P&
z*4Z<j50Om+6+Dw-9}C!PGcc?SWnhrOX<Cr0vwx7w+C9goExxgB!)^QXO5cvnK9<{{
zqB7@$(}lzbE#Kq(>jT45^E90T)BEe^xVdVWY_e0!_T8^GB``jm;fwyK_zU};@<06h
z``UeeMeLXNmsZdF@AzMD{{I*87xI2f9sBS<|LjZU!ufK0LpQGRw_De4!7q5E^sq3G
z&XlD=;tmmE*P0H<wm7JKvwvzIvvg&*jV!~9`*8+KO0WL6UU9nq?=Sg3hPsF9mxkI`
zxPDy!_Wsg?zoOafW=mf=Roi@~t+++d`?z~}tFuyr&U)^J0nfiIdo-)wq)FEE;d`Ma
ze;Jls-TUvmThA)HSO51;7oEL(PTghs6pm>#_)kv}(Qs#sI;U>FC26wZhsSd*Z9dFo
zi%hyG+I-JZplRa&&+?7`-|ots%D3+K`e*%HGzu+N`MS-MyvrQZtgXxN`1{2bZc%Yb
z;wvBOK5tR^bz+wFhu*6d&OuB5ai4bGbiq}<X5P(AO%c2I%ekX_<^?U!$}U;)GRCb<
z|MG3c`;H<l`yRG!^<4d<wQZu>gElFqvbJTbCAc1JGVc|gEKnD<<zthiV{!SOKDFPn
zE|2mLRmR5Tc>i?bZl2=4fTdN+-a5dk+$YRDfQfS^lL~`Nj*8TczE!I)*qSn{ZV0~<
zfBUa|#2ZzkWsb(%`*&>9Fm4W7r=9MTRB*w06^E3-^t1@yW48;N12uT|UuxRbJum7T
zQ%L%Xa=y4bWvowatupwW+7+E9$)Db};b7E}Rf3|i$1Sc~vn(liG*#T~tgY@M@i`YI
zh39+Z?&iP#<xz%(<gH$>EuK5i@rv0kIPSbz@4${#U-{fln7>?<#r5jdynT7D-q*Gs
zj^JI<9<DX3aHmT8u3OUUHrPMiSNGyOufE{k%@<zr9pYg6%jC0rm)7D}rS{*<)^hdV
z@)0e4y2N(DB)z+9mc(7m(oC{5)c(Hgtggk9ld@gP?@wIfp0uTF-<_`s^H{Xw@+?m^
z{@l2<FVsuq*jo{2pF84O%2^uWY}?}J_gVA&%dM;zHou&AukdN6ZMkIR#E)7`F*Z7q
z%k?jvlGF8V&)fSpNHX$vSdidsv&9A-H4j6-i$~bT6xr=JG`RV_Deelh?#`5Aas7_^
zMHOBj4xM&Rn>OvL`B&w{SF&Pmm$!B4?_gca^7WeR+I#C6x+W~^J5?jNbka1}rm`Jz
z?S~JX*ve>sMwVsKhu?eK-Y<LDw;+t6uG&S$Z?BhOom-}P!eZm1=_*eh<)S{^I;`op
z<+GZ!%f8d!{`_#A9UGQ1@#7P%sv|~e<${ZZ9GA=%FE$U`8=>g!$yp{H+;x9R^ZnQ>
z>-*p5Ep2&tWZDsye7Dfz?;^>5uQ%$RkI`Rcb+2q%!5jaVE&}`o?F+A%N4;EnmHV8T
zT<smx7pi-<q-W`G@GF?BzQgJ7ak~eik=vH=d|BXEQE+?TBbG00d#=a6+`H}`>ni{6
zpU=2;PMsU;?{;Cait6^?M*T^fuIn8+xOd%!!VN2H+M5)9?W^*y|HIUsRA9H(&azE-
z$8=%e97UBhE$fGU$J^c{c&iKNam`)r`rd;@W&ehMeD3uHCvT?Au<bosepHmxYSr`z
zgCZB+)Y^Sh%mpXkC_S=1qQo|D(?Nr;t>z_PUvKl<!hF+w#vTohGu>T|Gd{5_-+rZm
zu`PPyi9-L$lJgg7?{!v~Q4_yoQQcP!o#+h~8_%CUpxyCGCQ$o2kH%YREtP~h-lsP#
zh`rR6cBPKJS>?;KzSGBE|5{Ofu+VGMxm97#+NOp*`<YfWU%#%pa;tGgFsDnQRZ&Tg
zL+C+SuEr;`|LgqDkeDql<vDLvh)lq{E`{qK0xXMyt&EFbPGVdfrn7!Q$%+cG675pq
zz8^|4_P>0?(*q5@=%4xB!#i0+;KWq+Q_>I4|25rsuAtm6!#Cn*rdj)*H?RBVK9X%x
z_^`Xh`Agcy?Mrq|db;%MROhuX6=Y54upKUVmuH@F^yt=x);UW}8*CR_bE)pPIR9~_
zdY#}-c_u->2L3<C`W8AEJ)CfJ>K*yYe@9+a9GP=Ig*i@gYfgTO6#MS8Yxj6Ynjc<f
z6nMSl;)iY4$9gl=(@TX6I`}4t$vKvCCGM5-oALUt|Mi}vr`2~}mFE@L&HjFPf6(?j
zuUU^XZ#B7}oX)sJBYD+{`4@MG%-c9SDao((+ruU5Z_Y%O%DyiUVZXmE{r0RKpHGFy
zO(}jVD#yr|Q`HmNclJ!X&~)VwQ-zO6GxtsZH%(RRRbJSpr9JPf?z$FF-*<mqhbjM~
zi)R|N89La1WH=s3?Ye68i1R7OoyKW1wgvE*Xzp?r<f(jI`S*jSFSmB5h0)2JS^cK-
zSQ6Ga<jA!wvhiQ*v*e5B+M1Z_0?x|iEFLwgb@!%k63wffd(AOo!BabyJyY%VH|59m
z7tYqdW_ogZ-Mvr#HaEYqsyn`7-nRO;+OMf{`x`j5dDnInKD<#-qt2H-{RP7f*_O~9
zFU190E*zaZlU-gV+GSw?&p)obS9Leav^suW@73zA(Kr3)e1CKGqW9KTikEy2^WRZ+
zuHh<qxaLxn@DYdpJBln#HH*vkUwddOb|UQXyY!vDYF2d@rfhsKB(P8Rr9m6tmWxeu
z^;XZT58dJ$z{C7;{Rz#tmlxK#vN5l#ys%CC@<cJ=>ED>1+*_JZyh%<VbawYM#dVK*
z%%XC3UYd4l@6BcJSt~>S-dB6Ie`fvvy4ZmK7YZGPb}KaYCY%u9N`AG}^4VnuSv|=)
z@#_SG#La(oc+6fCz1O9dDLiv(W&Qt;QhGM5#~qBOgu6Jm&dz1sqxaD7>6%Zx6AxVI
zTX#*2@tj&xzL!Je5%-m=tBgP7zcD(#>*nT^J$pCHtXo;y<+W(Z+U8?dg^p~FSpT}#
zS@X!Dw=2H4JT<R)l_<cpfAQg`^H%;?utQaP*5rcg%Kz;iSJ`EEu{XS4b;<Sll8QF}
z=v(Z{CwBAKEIxeyW!n5e_Hynr&UVE`ool9?=5r65m}AX8SC~!jSHR2kjH(6anZBl<
zocR9DpR$?CS333Bi%w@xS<<mMd6UhH6NhJTsjrv2xLuSf>6dQZrib!3Z<K#K92arg
z$JksdYx}V^Znp2WbM&GPD)2kD&3_&vbnW!sZ70;Fe@*nQNuQj0Z`aqe0Rk&7l(Hqu
zuUlwyN5CfIChNft-34>~|LxpA>l>fj%6_)b-M+Qy`Nt}hb60rtUH4hCF6ndv(}g)d
zIH#;XT6o0$)~(&i>xHxTG$(#JZrW)7M%Bo+;2%#K!@_kz-r+lTA6dwzwczf}qZd!U
zO<t?{lWFsuEgL=G2v>8y`p{e_ziqdz-{C#$EY$)--bTLuXXvR^+{p9b!s)a*OAgHK
zynMDyL#FEb!GzUyul@CwOpX3nQ@=obLQz#|fZX-hi4)Hp4&y$bwzti#?AY{}faR~J
z{cO5W{%rmEd_EJ4^NM@sYkkYv5V??-%U!AQu;QFaMGUD1TV+ysuE#yK-nm%e53})(
z{m)w6dG9@M50!OUH&5hQUI9z_=8W4r1w^Y}iNuS2m}*&?o_0?#KIqK;iuulW1Juq0
zJe!o(!kzcs^w6R3@0)I{=A2?Fl|H?X)o*U_h1tuU1B6ufH+!%5djGyMV&UnNiZ-XO
z-Ag;)*uL9j^M);VXJ|a_5@LVfX~q{DzIfT%M@KsOFKE8{_5H?44fkaSxm9~Abaf0j
zt#8>Iqp7T4!LPOL#!M+j%Xb@A@RxCXb-i%u^kRSOe05QFDVOSnZ7**H=P+owMI7l@
zJ|H)}kYAwnq-^FdMY-p9r<Z)xe-<V;JwIvFw(VCg)lQUJA7k^kfbVBS_aQ+xYq`$_
zk1L)_HTV^NJzy)#)K#DE<}K3m{@~@^Ya)&BZx8y$lRn2WMq&5W)^`<$YSvnxn#ps`
z$2)U%@iKGXqaXRNqz50!z9g<OC8OrohVy&80vB?v*A6(l_q<|Z0?WnPWo%ucZvG<Q
zUW!fJeo6WlU+-eAS9{7Mr+#C6`swMqH`>J?LOm5D)=qsA6SHn!i^S@)%eEdfmGSc0
zt;>0IU$Fh^SCXGn-b{Gx?z#HZgiFx^`{Wd5nHY294#(L#`rbPgeKKW+b&reS2kVLz
zua!LRosOI5IEk^%VP4f5-(FssLm!_1QT)B<{P#-To!@QQTi8qfzj@fe@x$@n!p}`F
zqTiN=t(|xLtM{?Fd|CkkHXGa|%5GE(ES=F@aQ@51y%Nh(W*tvYb*{N^BmP06amS0b
zX`77gJDg>Yw+kO!H;FrwjkznzC4BCzr^~%2@tN>1)N4FrJ*UM^<M8^lcmGq3zBb)8
zTeo8Ghxq;behI5*7p2YJ_W19f=hfa1=A_k|FLr))E&V1>sos~Jmn153O}1YWtdD=P
zKPn*hzh}~GADcbyJGLLaHuD14z00Z`JXYMB4JI@6er5Q;{JJ&#-N!d;o9r9*?yE^W
z_0Dnc#yvZu#1{TK>mdEwd1K|DC&~-=z5m4=FPkqrrR)07nXeAKNYD6ii}&N)v>uK_
z8)`2#uIrl_$){klbmFt;k1yJLo{3P?xN@6ohbA-UWP63Xza##x(u&EK*mXsIJJ*k=
zMj{e#OjX6UP5Nb&SYaFMXvO~hxEY&w?7X>baaP>?>%vv;C$juGob~7D7pJnO53_>e
z%J)A?oBVv+{!42(wF=5RKbFKvmoR)X@DKLhTyD|wuY&n(w)4X$i<*=e%w>=Gg*Vu<
z)D?;B^<<qaogCn&<6o`l=kC#WM%GIy{`S%O1?!v4l#-`!^PB%&ZbrYtgUCgJLXW2O
zJykZ(Ixe9Yc*^CGqy0>SPs~L;@u&Zv=;L{nGWC$cyy%ABADYgFp%!y1%YxRlDZIWW
zC34>Q@sG$|haT`>DfPIwsMT?zctjafx4875HaotFR`M|)>^|t4ZhGA!oK}6CdvEQl
za*me3`5V_uUaB*x+|zVQM8rG2X?0If-p#qavp&z7@j%g5lG*$k-{xDN^MpnIC(b`~
z_9xqV#kosXZ;8(3H+`{M=75L%{WI+rQ<Iw7CKYW{n%A-@b+xfd@%E`R;^&-`f4BFY
z+466@STt^VzV&R7V%*@CQGbtV)o%rfbI+CbZ#Im5Y*;t-`Zkxd>D}@_9n+2TtL|>-
zx_&EX*X1d{7yPlir>^jDmT>ZVx$}C}3vC_Qf3#IKS+H4)xOAMqaO-?ruZ8~llKk7j
zhi(c@oKt*ZxA?;9zy+y`wiNjCNG#V)&0RM6i%)i4K$H5Hvs@j9ViNiyFH*g8c1FxT
z>R$aw(Vx{_UF(fO`%cZ1ZYQ+f%C<S$pSabVuX!VEm70goT1Tsgix0fw_s|q%o|y5o
zW9H+-u@n5B`RCl2H9P)@!VmVVubzMT*CktU+a_DpO*A5=^M&u;S7xlDTC3+~B=-5&
z?PQI+I>~z3eL;bL%?JJBKJJSABw3UpY1LM){6Ko+z8%FjQH@=X*)%S@MsMRymEU<l
z=E~hL{{Ij1PM3JD?l*k&-*#1PYqjs^GO<aI_U-Oh6n>MJ__l@rkD$+zqt~qXkF)T^
z_^Dh_dwaLBeeIQl`<Fbu|KM)60MqP!?Jst3yL0aN0$u)PC%4bAlNFMxP}nm=@x=qS
z74FMewjWM>(f;?hv@FZrPq&&LT;#O>w1R8Jnv$~K)qV><{nH3MnpDVf<n70Wp>DCa
z^=F?=d||)dGoT{>`Q$D2`_|ZAIqg)oZ{A-Qamf;e3rq=1C%!iFZ`-xc;_dorneP-j
z8tN`gwEtpKANx_JKWpXYr;le8EkE=A`sy>`u{T1eIGyX*sB>Jn)XOSqe`=$}r=_jm
z=I*N%bh*2_EnfRp-udrYk!IK3Y@dl(H*!mCc(;^k!oJhtK0B2bRP32BoB8O$`g@mF
zd@$c#v+(?h1c#S*`ujI(U5}K}mwo&|%P{J-O8bIZrrcROZriF}uon3jA7-cZdx7_C
z#j3B%cNTA1{%4|d4*#83-3{TAe74svDlK}JCAoacW`pRhmVegdeG2}sQy<g2{)O`I
z1F}2`X+?{QLaa+;xnAhFRR8;G_32%s#>qD;-dncb=BjS`lm2pk<iFPodoHd2vUs=3
zp}jro*Ur9+y>`R&g29Ktf-bckUmA}EJ}E4mZ~c4!ji6iNnN#;aeca!2=1hgJ)4hGo
zNqTp0SB9?G$0vW>PF&69DQmOIsi$_=qj}W-MHZgQc=5{e)u-!cS*x$^xAtp2YkVMX
zt@}d}hbwVsydU*u*WaJ?gE4>3-h^pi`c&#qx&GhhB)tDxR*TN0Un@(6?Dyn<Jry~1
zTJvfn%gWYApO-P5D+)1q<um*9vkZ?{^IPTj*wxS1R5-e6R#AHYc2g#;M{>s*C)*2N
z6Y>x})4MOK^U)LcinjcRLVx3@)K!Seh^>`#d;O+hnfI?X#@oat%e4D<GIaL0FG+l{
z=4PhSl5f*2YjbbZsQPExSGn5vB>t*mP?zhu#ht?MD!{(umRU6CVN2)R9OshS_VMa!
zx>@%2r~m$8Gu`Q5<R8_B58>Tc4c;vXe^`?i@~Gh3rGjgZR(!3>uzzkFz*g0D<3?mj
zX7%=;v(3vSOan#TLMOP%GYc<Q{I>OI27}0rwHFv3m{?y>l{@*x<DmPteRd+r@8<NV
zERp35zS5s_|8@La6|>22c1o@-PSf90@8X^NM)v<R3(wdc<$ER{Xn0-Hd{ZQCyXdzo
z=be6+{;gB9TNq(wo@B8za^X{>HKJc5_di#zQ$4Wt`OIzQGyAG^K5ml|X?<WnseWpE
z{<HZvJD<jV6`MWjWbPhz|H)gcxKyV`Oi%f|cZF2?yu%jJJ9!?7{50PAZP&Tz`>Vu{
z#1<Y|bp2|jhI0P)8V89jQ!hNa>%X@$Xl71_C>v*S$?44}>nHrW&T(RM|A$*n7u>Dq
zwC2RfEqQy2Q@*m-+C=lE#r4Y#f^&k+9rw*!t=p~s;k#s8`LF7$2O~oY-TmiApI>rD
zXG6-5ii&5gM+}w~*)F*xwe?4+qCDfTIa@0F#quBIzua?b%PrSs>+=Hd`1Ma}N?pBo
z#|zc%Lb@~aWX{FEo{;b>a8|j9&!0UCiC?Vh1w|8rGY?EX@_L$8-}5C&sgKU2Wq2AU
z3hs=(V_eGe;MTGV4z{2h=kI(hz4GuBzu$rnd&FW_8s#Q!ozZ3Fs<JaOUvkpdtX{cA
zjXpmw)NEV*aenxtcdX8L*XA!}+RfAX{N7R}b?-#|sozSrJIBZB1$BLP+OIFSYTlx^
zn>QUjFu(W1y~<RR>#_fCZ7ADhv+2w{@wBYHN1|`J{<4tkmD$WS$=T)4+LhdTxtg`w
zk^-+@|G8BEz_a3b9Cxkc)e=ujqi>EMCpzqmlRfX)Ugz8CTDFNfpyC9BWB=@$JGqYk
z(x+-){<rl=;oNA=T)!74FAv8R{a}8ho6ebW)>?%3Yl%$W!?mwcHQt@PEB5fd_NVd>
z(d#Gff4c2`Rpa^PWo4W1C|*@6-K3YgJ?@Le%xKo054yd%KXi|_ADI7r{mIAq$q^=@
z8>2r&u|-%5PY;RDG8FZcjK4E^iO#9Hg38@nZuc;5+tae(-@$&fR&yKm$T;1nCXLS)
zbZ^vJbL3?~?AJWY6^6a>-_qvG%+%70Ox5d-sGQd%Y_IR}dFu~$-R0Me*UCPf{FdeD
zuJBz)0@tbrg?xPTWKAnyl8PwLlSSt@wEoR$dAmAO`le%aqVZ%e0p)3&8>GDx^3I(2
zT;ntA<4ZyF;slMTx1QD=hZfA2&6Lk6je5+wp6jl`H%q4Xp_^_9iSsVM*khG`B#HgQ
z<SnPCyxU>3rBk>?v_{M1mvT)_DF4;kIn8(GOs`(DHb=pE(OR7qZ4*uyip?!;Xv>a?
z@7S$++?u29LH!5m^I}ipZY6ck_~!h7eWK*QIbI^uxSMQwWR}^<uQC>`c38BqRf<DT
z{P(SmmY+A33o8{D`x*S>w|oCrYEi}1xb@6>3m=!w;N2P(ywlQp(!T!^wyTw+e)=5N
zDu_S0K|lM*O)c||ANlWGKen~3e)sit>Y?IA^N(5QvWmYs@&4+Qf(<{JKOYEKX^=Os
zG5z|5_GQIo%G<5D|5vL2J3srN{@>sJcV<7Hc0phn-+Ld18$1sU<aeERk&|!Wa{hgL
z*VVRp<!7=rZ<zhQyD0ABe&g-eE#?bOxE+=2$`G~Q`JrHi%z4oT;m3FLh&nHMVjO+k
znbkCUTj#|0yZ)d0x7p$KUG1*tj!&YQ<-S*Nxip_%>N6|u`NUgxS7c3ePYB-d%20IJ
zpqnarRPpINH8yAa*k_+T-Pzq;jq*BQbL}oI-<@#e;6i=2z294^1>B5h{t%zN&#~g)
zoDZ%m{&&Uyj(1<Lz`x^o>)fpi=a(Keou0$|?fX;)23xb^;ubrVkElAQaygZ2xF*=g
zsm|Z4yJ5dC-^b;FyKGiGTyi~ep4FS5VtgS9Ox<GX2HH=WZoWVNulDmdfu=<JypPK*
zkIFrE3yVH*I3mq1VBNB3PtTlO^3r;ewd%ysHx>t!mVG!G#-(^-_wAZi{%ql$jzX;Q
zU5XbU7j0Hpm?Jx*`=FeQimY6@8B-$TwizEbhWl;W++|oETz~fS-xV&t)2F?h;5UDA
z{oERfjhoD`vCp@Byi)U=dFL*{q}<o5`-+<_PA!gqpr+qs{ixRFQ+xLxuj+XJ1s9Ba
zbMoQ^&Zj2#ZdX-_m@Ze%xAn@Ah*yl_o0I(%)``BEplkS7UvJ}8X4fy*_Sc&1;8UK~
zvFgLB2P-(9KVLQbrI_9~E^X)9J~`o=>v!;U%>Ve&UA1bb$BcbXR|)w)JX!QvwCck{
zp3ZgZd0Mx3uMMr{E2wO_rIWbPccs~ZwclFnOI-ECE9zwT-;`mIWl}ZCm^^3EFNIBf
zmUqrGX38hnZanFBE|PtlzGv3lXLpx{+^8>{cy9Hh>s;=vE|WMPp7^Z1Lsu@1fAZy?
zHF=Wab5`eWG`e~JrcI{RSIap)|IMxM@!#G3ZkGG{lhTf}GIg)?pKWA+=e#lLz{=*$
zEOu=S#WTDXO-R0ZFEE}hHGbX4HR|>+bBa$%eY4?GTgEHM_x`Vd&GwZ{%crdQ_PpC=
z;q@XGy{>!B=NW&^-}XrVPekt17r$?~q^cM6c9>oGrXJI@+4Dtnclm`s+NF!<{C)gx
z;paE9H=`}>r@vSp`{QW+zaQ_uOk4HrTkz#?W_O$Yu1NIzxhF^H`H4JS>MplS_0krN
zh`qC{A9*W3eJy%OV@3Vky8Uqr3i{MtM7F&2x%gFC_36LBbv$>2S4iB^bJb}HS9y0}
zN7jL}FEpn7IIg|qZ?V$X(#|cvEz?=d<P2<HUthR$YUWde_9tAk7XQESs`~oNlc_Ct
z_3j7$-@|-S$mRYrkJmrlVw)B>Typn6xAB<zOZSDGY9BVN=d0Q*!4|&etH!gnTYeXv
z_&0UFi|gmQE)IbsH{2D@Z+RQl=&K`Grt0&6r$4Cj{LMW@J5=WJ*-BlHUiPnU!>_6T
zp1!|sdrmdLPGw28?SikaWh-xbn9VP-E3CUN-?x3mt?h@eZsDo;XL{vR|Lhp^`)V>7
zuPeBigdT6GEuHT0`ra0n+OJhbZPS|e*|Pm_U{u}Xzx#RP+1tK<u1@_U!QZuZQiB@X
z-Ro~6#6F!8PfC)J{n#KUI(v4mTg4mZliX_`Z!Yw%SyUI<ZW*BeYwHeYwYk4-C;cq9
zN_{okZz=0URi$4$-1E8ucU(Mb{c5l7$JsyD78>X#iY;J1@jOfI`whw6K~H$Kd^F?U
zi9U~iuWEF{qeSA{*J-7Tj<~<Nzd!zXn!uC5pY6BOQlHCMY<SeU!dzHtS++{ANK1#`
z$^&di>R8GxnD(V_PL=ID`dlG<w`Ak|H7A3zq#GFnywhhYGbfr<FE!>WjgX1bR(c&^
zx7>Qe_rf{$ceelXN)F$1SmbO#t8Vc$VQIfP*>dR@T2odZvG^D+@4;KH7h2T*kmHZw
z&#k|oS~ghuofKRB{`aqEvKpEPzP^}v*Z1cwnbQV=9X1l5xeM+kF@JsfajX4>@81OH
z@Ff>X&CDqbOyga$^ub{TDFFjZP4-Lg6ZhGN+nKff{G)Ajc>aus(=W^ZtKk3kai4fg
zlHrpXcjI>yZ(|V66Zw+WuJbtQyULZ>0m0=OJvDoNX58#q{fX=Q`{#`JviM&2MQJ+i
z+;v2CL;JF8c8}jZzw{<G@;sB<@l~rkQ>8NPqT}8>elq|6Z&l>Z40g7ySD1Jfr<hOk
zIc9wN(Yo%#D;>mEC9QB*V(8c(#<<W<`0*;e`#P`J&3t5P7JG9~sz@)}JE!HZRMv+j
zUW_fMZ(&;Lm7uczr?Fq-`^nGuuk^HS`FfjibEV}$Qvseeyrx$I3!~HX<JV7)?my((
zwXR!#!Qy>U!7}d?IF#(x<#A11|5GxpeOK1B$7>nR3$ni!f6`MG@TR=gUwz_?J4rWs
z0u${nocHvX`BU*fQ{e02>i8!WK1H`ZU!R$;UsLsT(NWJ;X038t%wq1kzuw%REwI}z
zET@ZM-}jih<oz<Y;+?~eonP3>=lXpD*QU~s&kVPn)#<vl!6o*K!PdPQY>b;)<=$*g
ze0tHUa{bwxd#45;{;T#$xtjI#y!SuYn5R3eI{o)&z`|ACvd5Pxmww-}R7c>4;I6;_
zJ}v2VvYjHm<Hd)g_a|xAJ!844W4calZgi9b!_JDGFU$CC?Ha7P{$#A3Zxvboa*}M#
z5w*;a{QSLrF~VnsHE!^kc3yh$MQquU!}2AiF6A7Zb#Yhod)01+cpqKa&&+T;JhFJR
zcEur<bd&bUQxug77$W2+NXK5^u6jW6&En#}-CcXKrYXNU+@<N&VJz<QlyCdryRql9
zt~?2SDbklG|1C{KBXkF6cU`5_i~KC>1?%qy-Sgk%oPKh`K|3S%SozqAh0K+A#D&wj
z-l|+?$WdD~X^}P0FO4+oJ=;7T>rU@bnY7~LVuATr4jBE2(92z0(w(hwCoD_nS<3#h
ztQ-G%YHWG4ME(Z7``+5;6096Nt2Mqt?b%V0q9^}uT|0Qnhc$lNvEl<<|1!Me*-U3W
zD`Vuid9FsNbX|&GtNODAnkwam&JRx{2Ua}&>@BQY`*%y_kHzXQFMrD2RXr(P?vuJ$
zN|@T)A6FkYv2!Tg$+&+z$<cM^9_EK~YCm<^m!9bVe)oFv_Q={VTC2qq%-yVtmWlpI
zO?dEqbLv_j5gD;9_aC=^*tLAk4~5)+d3AOve{a4%dvDj#DdB~j7G|f9$mut_OJ6rD
zSf#nRDrUbxf6DKZi>7PYUkqE6SIO13SblA$-|7wX;${C&y>RT!grv$t((OIsx`H2F
zmbBV5ulE$;cYhrx^V4AapR+E3A9R2HEnWA|aPba-jwdUHO(y(}I{n3A!yNw*!`g3)
zCzdV{o;&r5MJump{>i7i&HwuTH8uSBw((^1g)QpVw`FE8J3jleU!S^EVnI=)#;G}c
zvJI<N2j7b<d}iia@&4GJiR~seZ<)?;*~#Cvo5g+9GTrv|=IE`#nX)?HEwir)wtF8b
zdDr9orKaaWEzei`J8NIa?|PAYV}rqxUAEGBFRm<DeY;lai20{Ory3JD*$$?s9?md|
z_|5V2%vy&p#umA=!ZWK48{}d_1x_qbvoedjHS_c1=4IBuoq48*FWeE_+RJ@$kL6T-
z|K5L%c9XTYOKY1;JldWf<m+dvB<dlzG1QFj@!H*u?Rmwk?>RCmm_2KEX{wP|<vX~U
z`A_5{qmtL>a<@%=@qbVJ!ng~HYBri4lI|Wmk4o^X_V{K`PJEIq6%*-ouCT0&k7N5!
z$q&lg>!RDuc1m5ZTlW41v$kh_u~6BiSq-hbPEX19tU1-X+vJ3Lt<iRy*X)nBOx4TR
z?dV+M_bN+CNmRS9eWLGq=DC$o7xxOzcBy9Ou)kha^nUZVZK?5n<#ok}SIoGq`11H~
z+uFHWn<}_sr`2rQBJB1$<DF3-_r#*C#XhXNw{z#rIVGK!ViNNH!})G$w_b6UWJ|Go
zAGEgLuJ9_`IhUs@_dSQ*mzeA~o-0^dZ^rkte=mCDeW6?N?2RzyqxM-x*I#GU$=|w#
zFRk0f<Di&8o6*;;PZN7(4kkOFc*{HW%pz@-`!YW_y584)-L`T5j@l2`gjVaXl+m1#
z@$<W8TEtb2)!LOEa<?M6zGrD1xyE|t3g=XVV)vx??7a0WGR0NSvt3%fXNKZ+w}&?h
z_wZyaWO*jk!TSE{Wz~>&Chd|dk92Q@-{`zutGTzXcyU(KX?=Z;6^9wDiw-5kt@s-i
zAbUj2%~d@m@|ldllANR!TyZb{rR3zzbr5`|{Nw$Sf7O2aD#cRaGR1pJnoe9?H#uG|
zL3ioJr;7IvmGY#E^OaaVyq%u-`(D&<-~PpkH`aZSGOzv4cqz_NUajGSRP)YD>o^%c
z`Z$&UUh#XI6pOAr&umuP=SFsVZZ=P%nf`^(eiZtEYtLE9$C|ACH?O;I-}cQl{Oj?v
z3M)E=mE@0pV-3ib{9U6b?qs*?(f&!l^K%;P4;@f277FFyxg_8v6l?vb@n}`j(N?L1
z&b<~N)3oaTrPRADcmAKsw9u;m<x;Wp37&IbG%zV&Zq~bTQ&#@sg@reonbYJ<xAff;
zTCRKecSiO8eMO6(u1&4{%4c!(y?<Mr^BdNrrl8D&k3-I{QIns<U7f$1r^q(N=G_JT
z&nN45)Yj;?=W`cYocJ==Lp@4f{-n?m{<+7NUlzE&uO{6{d?KgNX@Q-Sek8c><$v){
z&HVNE?ZG0+wH-&x)-vtQjNG68?MCe7-gPS3`wDD+nM4*b?sUG+c7D29O-T3tpxEy}
z_szV%S@qklo_*(aLz%4mPw6(C@@jd_vq7Lzp66Qvmqx?&YdW>_C;sw%x5#4EKda&j
z^PG7ZZyRzSoRBbCsxV2}PPV%?aZS#Gci(3gm#22EeCA+pm;C>@#9i0fFKab}{bqIQ
zME0G0aAw=GSdo1Z3)Ab<T$y{G)#=Bazq=sb!l*jz^#ynTFFlLnubfS87Yi-eQ>_qI
zdDZho-3u><1(y#Am~_4}_+a5vP{p`y@9nNB=e;*BJ^23W`x%c{MO_gMZT#c-q_;1N
z<6i&GXB~ImO)i?Ybi=!qkHz@rpTChTANuHJXMOGGsDE>2Mf&o_f4!0sb*e&6ZR1+u
zwtX8JDw>b%EoG}LOAPsO-CER6FK_>}y4W1K6~9gGKRNYl%kR9Pc*wlM<YQZz)1=dT
zXBNL#iDwf?)VI9);bfu5lPdOF*|WcU<@ap=Y#hA1GVx$Q$EO{i4hVJWOsu@ONAyqc
z(p78u)J2<4%>FI&@;S4H{MmOaIp2MDoTE|l-)~ZU?40uCt5?#6W+=#KRL|MAM_Tj!
zzm0R7H;d<Y2KRltEjzy}z5C1JsXbS}i)WWiKO=VG@LCQ1IDf|M)3fJhJ8@l4I>hR>
z^PAe;Jtv+WnDfW<_wP<?R%z2Z{+fjhUdyM%X)Q3U=xD6?YQ!$*`m&UN%5zcUyN?P|
z+1aPPdEQj>WZirIpE}QH#U;MZ^Vcn&)TXgv*33_-XXaG1rk-CVKd&J<l7U_M-oy7N
zUkgk<?>O<i?D7B4gFpWdXkPa7^YPake!f!Qsr>AY;T+$`Y2oViI%`^dp9xP^vI<(m
zQm|Vh<Hp2jncDdr^^M=>--tP+;_lSERx$GSo!t)>dX)H_*qWrO@v|c8)UoGzLesB4
z<2!b*d#U(0b(5SU58pBg?(v=IU6iC{xw7>5$E5R%4!@i=--k)$dTPUr$IG(b@A}px
z=louH@8fCg@<o*%OdOTIN24pt`V)HQX{KI$vT@aWHW5elmO1lJ9<BcRNB-A(z31vR
z!l#X84sJ-BpH{o=(Ape3DaHr)1B}EC9@IVZxOsJ%wOn4`%tdtpllRZB`dQLww1<H?
zubn?E`+&6Xl3i6c+UC=rOr7U^F7RSl^>UX9bMA=EQ>dHp|E9-pm-9!wFWkGyB<XF}
ztC2TZ-gaZnI|Fv!L$OoTv`&gJ$6eTdi@#d__;3Ed*Qd|_u<Y64XO{gPIS=xzmK^@8
z(|hN__t<G{5vR3+3nEu1*#>|79J%`Zm;LkFf41y*-x)V;Q+kiX^Ix^EG}x;n6WLDQ
z)$KUFT(2+LbBE$K^|u0V{wlsI|EF%1F?$lL24`@=@k?1e3G+3MU;gqUKjp>Z?l&EW
zt0q}0?|m{mPRM@7W#gXOMX%k=n!M+3jhm&YwJ-m}I$zt$X@_kDj_m5Y!E<ZXpOpfi
z^4ClK=HL5$oBze{Gmmauvw&ey`Xi&{>Bqk3*QT~jsF;y>bL(YMEycU<Yrk|@M?d_u
z*!Qoi|91KHo2Anqg~=?^eOgpfSEz8Zw~a$#Zo78NriFL^YOH)Dr17n~)IH$_|BL6s
zcJrq_P101W66O5b!nW?E%7bb5dUw9OtE1u-l&z^hMRJ2@OvY@dL+>;1TP!*Hf9>hN
z-9KvXo?m@(b<5$<l7d_ET+=`LSh=z3t!vp*qVHPpYUVMf6}z;IzwbDF^1E=~{s#GF
z9QsPy2|mtV>~CM4SmW!r{BKN|OwaY#K?3XaX0O_{{nybm<v(^y|C}B9J^!fL;VIV*
zuf`OKY;}$;^J84y^d$K5rKCze4~Hd(xr#D&{{Aeg`aX8<{*LHBb#|%$ujw4$;(Y#`
zE#uMV(!H9K?e#7zcBaTmd2BRz+U{YZ(!^pa{@z1osok1qSN89p^w#do9|>6{(S@&D
z&iAtK6MY>QxLbY4gBcCizn@q%(cR?7SGf(}g&yfYniIzHr;1^E2romTxnDz7rrPTm
z@69`6MOYIf&$TYTAl>R+GiM>&oxmHjJBpv1&Nn&n^-SZE<b8*87+*Ox#vWOE)rxl$
zTj&P9dv;Hz>~-T#&9Qek+;2SJJ}%urbLRx6<6q`%-Sx`u#%A@`A?GC%Bev-Jd_0^Y
z$?v<>`mk+$-M4!ielY);RQfvoPs+;N0#W(vKg{f;T)T5p_uf0teKmx6lh+ShA=WEm
z7iByD>Iv=J>lkb$^`+75g}wWd=pLVxO~EC7UAMoL=~jBLUFj_0zhe1$LEYus4>@GJ
zE7b38de6S5)K2cGeY@V%Q+b~EnphtO8XXDQw_;X((DR<vrY9cfv~_&j(#6HKKUeSz
zv*D_?ywcfLYwta`5N;1R%d-BQAk#(BcKxFlHNSG44?HL&)0A4mv-O&@%k2m6zGvJt
z{}EuGC+Hja(TgvteVG&IhP=g(rV4QUU_PT3y8Zo<%}TO`2Eu)wLOq-Q*L1$%PkFmz
z`qsmF-|hd~2Y53wi7-Rf{DW2w{}f?<Q6$K~&}huSpu>OwTN*)Z@Evrp#m$K&iTWuZ
zqBtY5C{;f<F%N_d^}&kt4AD)FS}QkyFCzm(12Y4I7sxOu-qN^75N&S($WSDc3-WWa
zGfQ+0^%IjzGV}9_^^@~+^}x1(ufx;J%quQQ%*oL!$j`}4u0*yMw3v9ymPc*5{0t0n
zI*_%{P-_{sG(HqYvlqUnAty6AHLp0eSl`({Akx#%9obA!D1ppi0uc-h3}R3kL~UuD
zqzp9^>@?&Xd(h38y?EaWH)aNgDt2@;PN11lkXVwDlbNJffZ{ihJH(GYe}00Afx(5H
zfk71H04Uzl=%kM7j*`lP%)E3gMkFjqk}DKoU|4K|ZiKBCiV=xL={cFjC0LBe$hh}#
zdL;wHJOw5OVW<m0)RxAFRwzb*!vu=~Jtb<_-zzdOe6K(cij`YX3`ou|N(ChhEM|x&
zUS9p2iGjh76Wt$YuA!Kbl3I|KnUjjeh^2BG*Uf|&80OhBfNyL8`2mEtG(NkDVnk|Q
zS#o|}S|+yeyrywY(b<53L2WDKb}x_tAiSk9@C~{lnML_|xv6>B!qg>LZ)Y?c1H%Rp
zbYo7-Fft$#zkY6Faz<ueDh@B{Iq2=4Ai%&-ZH^wYvC62%B<JTAU=NlnFBi8?6J}s2
zb!R|}UPTjhGxE}~gzF-XnYXO?7#MbGphwLMcT@vXQp+HBTB2u`DQ|SvEfiy5V8?Jn
zXc(Fi*wg5nI<EB|ObiUKSkU8EJr~sg&^4Pl(pW`bw519o1A{6PdT1`m$20_cmYo=V
zN8p4I1B1UMx<mdHV49Jen3;zqL}#`4&PtPGV91_>9-=>+Q4LAUFUn2CmcV$`IA2+F
zF))-UpvUT@MW{w(=4E0tAU$bGNT~(`gX&!L!1%WY-2iC$j8T3q%(!^|vK#}0VHE=d
zs15>U6cFChxcn-*86`#eSVAIQ{IJ(bQ3eM8Kn4aOkX9(((zxaestGyy*s^OqZ<Os+
zc?O311?VB!%Eg3|&k7QYic^cQIN{>iU_(&}28P!G=$`P^LN%f|wWPEFiwTK0=iGEu
zU|`U1VqlPhdH_UiX`JGOW<qIFK~a8IYH~?27IUU9|E}*I&A>3Lh!HKP@+PC2Q<93c
zB<ImlI#S8Xz_40?fk6S}0w~_n*t!qZfKpJMo0O9pkEclP%wN*2!Nb5{qzBo?12v3c
zOQX#Z6w~qxN;30GQi}?TQcJJ~@$+LbP9Llo7-IjR$I`qD7$)WCVGEn}m%AqK6=7hQ
z>VckI4{|djM|43^etJ=2E;cjHzbN5)rOd#<y$aooO$sPx6s49IWn%ZrDxP1{Tp1Y{
z4l|+0^#vCcGZKqS@HHPC8rTG<@-i^2bYx(Vg@r5w1H+a^UpEYM@Q3c)n_F*i2r)4H
z@n&F<M=?q^1e;Ms`NajP;HDUsG#IG9|9}uP1H)84bay4CVHj4BUtCg9l%Jehj4ill
zL?|$qaWXJWvO%u{*JolHRRs1V78iXs(YKkw%D`|%3*DHQVhm%-GK(`y^08%eP{6?2
zd~zTT6mMzNu0$~=DKR-aH7^BU<Ta$Jd{vHPU=W?m2;Nx>HHu+NV<vX9pk`tVB?rY_
z&(yXvFwEm*W>A6|1WpJiu48pqUS?iaBGf=E!8L7m(az_L3=G$q85k5%%+u><LCz>p
zBlPp~^HQN~EXJ8{`W~=0kAdO&Lq_n<K$wYJ8bc;xHLk4K$iUD5w}INz+AQLk7#I{;
zAzKX*20AgYVsjtZKqK4+{#2NF3S^)HhJlZma2sfh+rV}=kGn}s3=HxZ1~#$cHqaEe
zf%@^+WREg4Fzn+*_p&MnZUfD68~FXB`j32O28Kf%=mu)@;5N__w}Glp3KiO!85rJT
z7<ii>r-4RzBE{>N@SJLA28QM3jA*HPu`pHxE0Xh5@FYVC79V*x1_p*y2K2fpE*!<Y
z<iw)%e0+J=bZ#xnW_AXKlgf|{zlijA51UEgJ`dJPZB^7ZWgiX(hC&(imf)#)EKW*J
z!`6P;CcW<2O(g~fg%0$x+dBh`A>c9+XEi(X@;CJaHU<VgG4w!6?8ahPZem_$8uo@n
zAt&qXy(|n2IsE8>^m`%}lgd(yiZk=EwRGDwI{gY685pvd(Vg^h8md9LiP@?6;;kn&
zC#sK!fg#Emz2coS1B*$?`MJ4RU9`1Ya$N>D1H&p!bQdKp#bQosMQU;>_8O(WRC>!P
zUIvC{BlJLG*@(p?P!}(;AQMX&YcW5dAfBCpVYxVZoy)!-i$UqBd8tK-*xfX1)9J8d
zW(*8=PteoT!edyB!k?a0+eD)7^Dr<tYM{Go$zLpnfer#o&cNQ|ae2`k-lD+3kko|k
zu6<l=$fbTVI31J}B_^lhY_ZSXZ2svoI|IW4DfDJ;y*4hxN)n6GQ?a(XK?MM;VSrj;
zPB6w|8mMoHFP-W+>i+g%W?&G+C`vElG_Ig1H77qYMGx$G^uF^d=PDORCI*H=c68rH
znWMT7G6YamjL&&aYtuO7I2jmJ4A2wpO-mf6B^KvmNwnT3KM(&CWMEKfL2s5BIO8xV
z8H+J%yY6qzVP#;56=Prk9eDtX4G`Yam>P=9nE15PJaGFpKCz^vC^M<FBo$lBN_f-l
zJIl-%7{0tmZwbjn<1!i+gjig9EIH$XpgaS^p*`p!$2bX>aRu1Aiz|MdWPQoXz;Im%
zy(IJAh|3^s{+lkpe~*hc0|Ub<^pY%RJ1%odQxdUw&ChDn!E6==hHxIpNim=Z0O2i-
zuO8ttsj?&kYx#P8r&1)3JOjg#PV{s!@i`8&Qm{D5^S9^A|7HvfDRSsd>?>^SC<O*A
z%JfrGOHz}u4Rx&NJ+{bFl!4)T1$yDbZ->LIwEUuyqC{*p+T%4%zWZ4j7>@Fzhk9!;
z4#Tn%%dmy|%}%qX5>^HVHH_-IE)s`H`AJ#WGSLCanX5qk{$5e^_|u8UV-nWXsi?Cr
zVu=s~gQPXO{~o5`FsrB(>uAIh1tzUZP6mcw(&*L4{&E~96_;nGVT(bo3>C2gP6mb|
zWpqasH{vj=EHMXLpo5Y%th84LaiDlhqii=0lX5dFGV|~jsw<@e?J`&x7%I6K7*wDJ
zf~YNxDFh5nEGWP_mi_yH-t|Ow1_o~l2DJ7w-vs>5Of14yT5pxhb7BE?qIuDK4C|-k
zH!nH4r~*s=Jn8a6Fq)5n;eal>m%q#*U|>!n)|rgd@1{n9_6!VnzN4EsaWx?mGqbTx
z2s9?KJXT_5U=ZYEU_gy)mDdDJ%+D=IPA$Tg6l)j!%YV+wzyKPSR|Q2f6mMzl{(#@m
z)SRTEQfvizho?|1GaCa#HXj3nCe%0(wWV?EHv&fH7AF^F7L=r7E2&N%5Y1+gW?=Xe
zfu4r`|G{r;dR{4(D3_}BF@Mj_!0=WAJ%a2dIItJV(5wS$W`fR$MQ_^dzIs!kl$C)&
zL=ZiK3KR&KSe%oYmyNYwmXX7FQ<{^3Ayo-IG_}<58=9M1Qj}kwT9l0~k`e@US7)&>
zF!*qzhh~pHeq#&Lu{HYN6yG&_#LB>6D2P6<X=Z}oypqJ?Z0wVP?)R@BTFA=4;4XmP
z;)$^$U?w&vCiO66^-3@>{0?AX0JSqfX%d9DG}<`eH?AzRxHK`RxTG{C6WgeNzw!Oj
zhb#;X)flCbP$YhXE0PV(up~{dtRummJPZuk3h2d~NgRrSDX9gic`2!R$(gBmOZ11O
zC;x1eVPH64gx+M>mxbHFq{L!u<<Q}E>vCK{WyKuy7W|raJci}x7h@}c?yyRHV^v^a
zcvX&Wn*Lhcrh&T_SVB(zcle<c76yhQ9`ukaI*Z4&{KTT7#7b=W<VQ!>$?2R747_p-
z3?M&)5)24$X%xSN&p^<8ET{*G#f{(OoBvt}Ffc4IM~{q;xA7Q>y{&6u>GeB=hk?OH
z1wD_Xy}@l5&bDRVgRS$WR2Ue<JJFk7KY!pet_+JmTMqi^2}v+8><LFV%U_lgxqwAU
z#VMuOmKGRX{`rBKgMlGe61}*ZYl_>fw8Z3+{Gv)MZrj_{^tuJKOhFXA@PA;7$GoD%
z+|=^?qHHWC#>H5zy2io4z$lF#tIJ$*o0yT3W{SnI?W=Z}Xo)j0tjj?+Y^NV?!*Vl=
zu{EbP**?D)<YHjxQAUpkg)}^dVIA8Ei?;CglVM<p&qWWn+ydNY6=bL5T%qtg<A%f^
zCI*H8cJv(kw+D}jIf*5p$z&{HCo89~o+HM<AQFh4BdjLiF%VY=u!+-M$3}#K!OjQ0
z+5dDIZsQ8E6?K=>-DXy^GcX8YB)XX0xQ!}KPRvOxNKD3-=&r1k+@8kAz!0mC?l{TA
zxJ@j@Ry!_qPqLK;4Z`!F*N(d`;x-CAeB|t#n4RjASzH1>w-LQnWbLu$+5vV326+hv
z27OS`3B_9)<*pKKu#ZoeFX)&?bi)%Ex-7aF85nw47#Q@R27{<AjoNpKF+3o#B*QZ=
zEgzfNAah`SD-93_inlZ}-X~yod^~8GLVP@y<QcC!W8HB^28JIj=p~sas;Qt>CUg!O
z-w4<`o`;?jWEmKKZ9+FM;30}Dk<EiHufaC4$iteN_)?I8!O;hO1WVyRPV?X;cx75*
zP7Y{d23uWvhmSkUay|n?;W;L>x->+P3%No-b}AAZOK6^6!L6`Vm4PAr5c&ea3mb?r
zGCv8|>V>~a3OTVn3=AJk(Ay>Zui-Q~yF9Td9h=t!)xKO&5Mp4kiAFEwq8{Tk4ZN-j
z$C?{U&J+1}<QNz%s?hryyT9Tzu%xmeH9k2bH5o^PTV<Q?ML|Xe2GGhi)X~d3BHXwl
zsGuk_H?t(O41WuBN9|n2RV)k)JNXzGw4fOYL~Uub5F^HDa03lX0+?>;w&)2H1A{+1
zdIHdrCdS;P{QR6$tRrIq`%c;{W@cbu;YROxMaU6ja!MxF(L2}u^R%^D7#O5^(H-oh
zM2xYZ{E&{dr?`9Fo^!7m85q=A(1Uop8ZjmpCFZ4LYwu6eDzj7LWMGI<L9ZEJX%J&>
zaY+&O{+<4g?PYhF7#Msw(ff>%Mz{<H^-1s*hwg7HU+rRKV9;bi&lgpu_{}WM%gE13
z!5XqfHLADPaWXJmkwZ@kmF9R21-TY?5mP<=i^x1h1_tXX3=F6hOr9fNV^dO-^TAVQ
z*ovA})A9nBGBPk+VMY(tpk(}}W)>$V<zNkf@{%OylMD<D>lo2pYMqML%+!kH)B^A_
zX)JlS#mmDKw2)v47kb~yD-Exy8L2r1sYTd4uk}iyD@mS#L8=42_6o|vYa}RJL2Fx3
zq+xMw0{>ZmJ4OZuEhhAE{oje#===hl^P855mX5a=7#Q*y(VOOt-6&>4hKKO>@!LdK
zN{TTtFg#>tKwGvqy$7pVIQ;4S`k?l2ZU%;nI_QJbPy4W%gR?Vv<6GgWTY3x(5#P{T
zr&6=AngsPFmcXCzZO!Dppv8Nd=mDjF3dN}0{FKrh{8iDh!fvJ#Z3YImJLpq78rQL#
zg}pU@#r><V2m`}BZ}bVY%S=4Tl_ktcxW+8316CcV<!4}!@I;TeNO9~2VIK-;YgqWB
zij{$(M*!VHeCk-uNy))Jbj{wTkT#K@fnmEjdP+a2gVmtaijvf#yu_S%=xR_b5h(xN
z%D{-1fuY-sfk6UP@k8;J#%VTK%}m3Vy*<{~Ykvx6U=W|j2pS58ngLp7_|FroDd~Cn
zx!CHoM~?OFRw4`xJA%*?x#m2q24&=zq~v4kU7u&#`d&bUfx$ZhJ@)2q!fH~cp#`?#
z?Wmf}zS%4c49o)PDg5a%?B*n=7MJ8>ogRr?5zrgV%D}Kr5Zz6CPGdC-$CRF~M?6y$
zGXsMa2YM*EU&Lxoc4}o=BDSG%iG_CAJ3#$3X7r-q_7$uq<>sg0SQRX^%Xj%-Wd?@i
zY3O4k=dNKj3g75M2z%^=wbBd>T50G$<oJ!<FkIsVXRd?^{0B`s^P>Cky%;aH;-CO*
zk};ONB0Xn$l_Dbp0}~T^0i`K})u_S}6D-Djs+-V*-IzvM9L8W9i;|jLW~af(z`%{+
znwxSsjKMahogeCO!&ZWUp*;vaO<E{mH3r8ttW|~G>QkTzD}Hoy)>>dSr#Leg+l>4+
z!3T4$aWXJy>!2s2^>*0J$uBKRPAyKwHnL-2?6}6Boq<6>3_bD>d0;iHJh3t-F%O%&
z)Q(ASS;fu3uuBEqD4PK6MrG!u<d<VBEtg(cweboA1A{(B>q0RG#i(NNtQ+3eg^K&j
z3AxM+4Cx%`qiTk+Sj|cXRW6_*I;{IW>Rsf^Pct(xfLhh4i@fh9;5M!#GX>jV?(dG9
zi=~(t7~U|Wch#S!;4myTF|VX373(@1Sr4H%kt_@hkGau{1lx2RrezisU~|_q*6rpi
zSQr=%@SqQtUdYC75@@wpd{Jp$d~!)TwsbZ>*IUzrk%8eKBf3v_72q&2B|g6>zMxpI
zpcrEhWDCc7A9+Rwh9!*XS;?UYyJ`7Y{b@gI>!Sot1_n1R^r~xmF%EOeQi~F?b~ev`
zUUZ_3k%3_b6Z$}jaV=J}Qc`ouGfOgxOViRavCZtiS?*nA#?HWyFNkj7uR0tC79=Jo
zm*$q{B$i-nI>>F4KTspgz+mc)?%TpPTn46PR$%Q{RVn{V=H_HzC{skw?3%N1nN^&O
zb+}>;_uNJ1j0_AnF_K39V(dm`7A0qZy8PHi0nHEYnI<R5z##8}UOGNmg4MLtyfUL)
z(3(&z6_I?)&aCS!3=Hmk=>0tVZP*QiwkL5nCslSY+1Jd%z)*`(+eYrjYGit9Nl9u2
zwmenkl9&IEn}MNP8+`y(`~Y^NO0rY(lOcUjEWY*LoWA`XBLhP?#sIJD8LZ|(nwB`t
ztGn2tH;0*l!Hf$%jTE25YF=hZF^-u><Bp&0%4`e__5$d!>U9aLQQ#5C_|yt)`M~vk
z#j@3m3=Auo(Zg-k4eW*$r>EtX;PmJ8yWg^9m>C#EL30K0mOZF#KlK(?^9m}V!`N6N
zp~#|Y&s;Xhas<>>u<!2TFbuQ+FdlS=92VmYz9cT2%*?=$hp`Iw)Dx`66{V)9=0S#9
zv1a_Q)*qtESQ!{9Fk)if3mgU(6y@V+5o@nLw*3Yh14F$qdWjVH4!dEcdGR=s$ol_&
z8Mjy&7#0ekr?%9uILs=>(KBLN`}IjMGXsML2YPC&`i<2nP{{_~pnxR?w6dIJF7q-l
z#2BHMAzc5l8&;W{l%JDY0a|;FeR28y*l1aOCI$vj(S*9sQGu5axy24^9+f0w9ox^7
zaa4K0z`zg=8g@iUxb6Jd%}FgTi3hEaPECo24h~@PF&ne;6_E2Lv!DmxIsvT4mgd2a
z9>Cbz+Hr2)6h$TmhVvMPNeN>$tSq^>BrzTPK(ixz<WpTn28I|W^mapqC|1KNv9GxX
zg%xaq4RwF#T`?4MN>XzRK(#U67V6jT)a&w~Jx+Y+tu0w`9Hu1~6u^zf5(9S8@tV=h
z3=GFGHagYG;4-lopMmBE%TI#l{fc?fi%cm6Tn6GZucAEpy9O%*gEmIR8l;NLywa3J
zd`6yjxP8Twg@IucH~QGmUM(C(f`^gtnR&#JRo8%pf#D_>`slHjJ`OXX3zqSjI$etU
zyf-rggEGeG@d0BTrh<k!@EOU#_j0ouBLl-DMs&~nnd2}LTtnhBQ+`>?8!lD`hL^nP
z6B0WtaF_{N7L7k;p3c~<^qqx)VLC5*X~=Ge$54FkoHc8H&2eVPi4~{|ogAHU7zyg3
z<1;cl^p*$@69dCyR&-Z-yW=pjI5D>%Cl&X)9V7Q2db+F(42`nrIcSzAUL!Me3$Tq#
zF?x#@sxUJ!?BzgrBD+5h^FS-H@%b9LR0CZX3F3qBmd3mw6eCMZGIQ{jXpyEY+YYfa
zFl>=RA2VHr%_Pv?cPyn?{(M2lxr_`9+nCV%vx}mzxCd0wg1YTkOtO&Z2<Kp8U@&7r
zAD60(!Ddo^G1ea0I?d!;%`prNw*nc__KNR_!(vQnUM6Tm9@b$+N57M<i&z;LZu6tN
zsBAYDqsof0pXcEeDm3*mD2SNRjqyK-#hCKUJYyp);ls>2f9e!w1_m(>^a1$H!zjj-
z7bO<po5W;%>|K08gMp!b4*Fh9v*VZsflR~V8jFP!H??pwFytwsyT<whc0;f<2|-5|
zp<lcVO3Wa<r18g3s6ntpnBYei!LDIOUatc(OAGCOT97#)yroh0FD|pdx78vW1UhR7
z{Z3hsAt1b^aT891&~KPUHxvEZSde)jyroh3A1=qCTq28XAjr4qH^+hu1K}-=g*Xj_
b+#?&{&B_K+`GesH1E)6w!z)dG1_lNIlO7JQ

literal 0
HcmV?d00001

diff --git a/pythondeps.toml b/pythondeps.toml
index 7eaaa0fed1..7884ab521d 100644
--- a/pythondeps.toml
+++ b/pythondeps.toml
@@ -19,7 +19,7 @@
 
 [meson]
 # The install key should match the version in python/wheels/
-meson = { accepted = ">=1.5.0", installed = "1.5.0", canary = "meson" }
+meson = { accepted = ">=1.5.0", installed = "1.8.1", canary = "meson" }
 pycotap = { accepted = ">=1.1.0", installed = "1.3.1" }
 
 [docs]
diff --git a/tests/lcitool/mappings.yml b/tests/lcitool/mappings.yml
index 673baf3936..8f0e95e1c5 100644
--- a/tests/lcitool/mappings.yml
+++ b/tests/lcitool/mappings.yml
@@ -8,6 +8,10 @@ mappings:
 
   meson:
     OpenSUSELeap15:
+    # Use Meson from PyPI wherever Rust is enabled
+    Debian:
+    Fedora:
+    Ubuntu:
 
   python3:
     OpenSUSELeap15: python311-base
@@ -72,7 +76,7 @@ mappings:
 pypi_mappings:
   # Request more recent version
   meson:
-    default: meson==1.5.0
+    default: meson==1.8.1
 
   # Drop packages that need devel headers
   python3-numpy:

From 4f04a4eaf0576a5a5a1c347b63d17b4d5244c979 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Thu, 27 Feb 2025 13:36:49 +0100
Subject: [PATCH 1371/2760] rust: use "objects" for Rust executables as well

libqemuutil is not meant be linked as a whole; if modules are enabled, doing
so results in undefined symbols (corresponding to QMP commands) in
rust/qemu-api/rust-qemu-api-integration.

Support for "objects" in Rust executables is available in Meson 1.8.0; use it
to switching to the same dependencies that C targets use: link_with for
libqemuutil, and objects for everything else.

Reported-by: Bernhard Beschow <shentey@gmail.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 docs/devel/rust.rst       |  2 --
 rust/meson.build          |  2 ++
 rust/qemu-api/meson.build | 27 +++++----------------------
 3 files changed, 7 insertions(+), 24 deletions(-)

diff --git a/docs/devel/rust.rst b/docs/devel/rust.rst
index 171d908e0b..11328c05b4 100644
--- a/docs/devel/rust.rst
+++ b/docs/devel/rust.rst
@@ -66,8 +66,6 @@ be run via ``meson test`` or ``make``::
 
    make check-rust
 
-Building Rust code with ``--enable-modules`` is not supported yet.
-
 Supported tools
 '''''''''''''''
 
diff --git a/rust/meson.build b/rust/meson.build
index 1f0dcce7d0..801f4374df 100644
--- a/rust/meson.build
+++ b/rust/meson.build
@@ -14,6 +14,8 @@ quote_rs_native = dependency('quote-1-rs', native: true)
 syn_rs_native = dependency('syn-2-rs', native: true)
 proc_macro2_rs_native = dependency('proc-macro2-1-rs', native: true)
 
+qemuutil_rs = qemuutil.partial_dependency(link_args: true, links: true)
+
 subdir('qemu-api-macros')
 subdir('qemu-api')
 
diff --git a/rust/qemu-api/meson.build b/rust/qemu-api/meson.build
index 1ea86b8bbf..62068352b0 100644
--- a/rust/qemu-api/meson.build
+++ b/rust/qemu-api/meson.build
@@ -35,32 +35,15 @@ _qemu_api_rs = static_library(
   override_options: ['rust_std=2021', 'build.rust_std=2021'],
   rust_abi: 'rust',
   rust_args: _qemu_api_cfg,
-  dependencies: [libc_rs, qemu_api_macros],
+  dependencies: [libc_rs, qemu_api_macros, qemuutil_rs,
+                 qom, hwcore, chardev, migration],
 )
 
 rust.test('rust-qemu-api-tests', _qemu_api_rs,
           suite: ['unit', 'rust'])
 
-qemu_api = declare_dependency(link_with: _qemu_api_rs)
-
-# Rust executables do not support objects, so add an intermediate step.
-rust_qemu_api_objs = static_library(
-    'rust_qemu_api_objs',
-    objects: [libqom.extract_all_objects(recursive: false),
-              libhwcore.extract_all_objects(recursive: false),
-              libchardev.extract_all_objects(recursive: false),
-              libcrypto.extract_all_objects(recursive: false),
-              libauthz.extract_all_objects(recursive: false),
-              libio.extract_all_objects(recursive: false),
-              libmigration.extract_all_objects(recursive: false)])
-rust_qemu_api_deps = declare_dependency(
-    dependencies: [
-      qom_ss.dependencies(),
-      chardev_ss.dependencies(),
-      crypto_ss.dependencies(),
-      authz_ss.dependencies(),
-      io_ss.dependencies()],
-    link_whole: [rust_qemu_api_objs, libqemuutil])
+qemu_api = declare_dependency(link_with: [_qemu_api_rs],
+  dependencies: [qemu_api_macros, qom, hwcore, chardev, migration])
 
 test('rust-qemu-api-integration',
     executable(
@@ -69,7 +52,7 @@ test('rust-qemu-api-integration',
         override_options: ['rust_std=2021', 'build.rust_std=2021'],
         rust_args: ['--test'],
         install: false,
-        dependencies: [qemu_api, qemu_api_macros, rust_qemu_api_deps]),
+        dependencies: [qemu_api]),
     args: [
         '--test', '--test-threads', '1',
         '--format', 'pretty',

From 53de966c3e8e6b9db3a81e8081be8e8275a0c6ee Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 2 May 2025 19:06:43 +0200
Subject: [PATCH 1372/2760] build, dockerfiles: add support for detecting
 rustdoc

rustdoc is effectively a custom version of rustc, and it is necessary to
specify it in order to run doctests from Meson.  Add the relevant configure
option and environment variables.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 configure                                           | 8 ++++++++
 meson.build                                         | 2 ++
 tests/docker/dockerfiles/fedora-rust-nightly.docker | 2 ++
 tests/docker/dockerfiles/ubuntu2204.docker          | 1 +
 tests/lcitool/refresh                               | 3 +++
 5 files changed, 16 insertions(+)

diff --git a/configure b/configure
index 74b3865e51..2b2b3d6597 100755
--- a/configure
+++ b/configure
@@ -209,6 +209,8 @@ for opt do
   ;;
   --rustc=*) RUSTC="$optarg"
   ;;
+  --rustdoc=*) RUSTDOC="$optarg"
+  ;;
   --cpu=*) cpu="$optarg"
   ;;
   --extra-cflags=*)
@@ -323,6 +325,7 @@ pkg_config="${PKG_CONFIG-${cross_prefix}pkg-config}"
 sdl2_config="${SDL2_CONFIG-${cross_prefix}sdl2-config}"
 
 rustc="${RUSTC-rustc}"
+rustdoc="${RUSTDOC-rustdoc}"
 
 check_define() {
 cat > $TMPC <<EOF
@@ -660,6 +663,8 @@ for opt do
   ;;
   --rustc=*)
   ;;
+  --rustdoc=*)
+  ;;
   --make=*)
   ;;
   --install=*)
@@ -890,6 +895,7 @@ Advanced options (experts only):
   --cxx=CXX                use C++ compiler CXX [$cxx]
   --objcc=OBJCC            use Objective-C compiler OBJCC [$objcc]
   --rustc=RUSTC            use Rust compiler RUSTC [$rustc]
+  --rustdoc=RUSTDOC        use rustdoc binary RUSTDOC [$rustdoc]
   --extra-cflags=CFLAGS    append extra C compiler flags CFLAGS
   --extra-cxxflags=CXXFLAGS append extra C++ compiler flags CXXFLAGS
   --extra-objcflags=OBJCFLAGS append extra Objective C compiler flags OBJCFLAGS
@@ -1901,8 +1907,10 @@ if test "$skip_meson" = no; then
   if test "$rust" != disabled; then
     if test "$rust_host_triple" != "$rust_target_triple"; then
       echo "rust = [$(meson_quote $rustc --target "$rust_target_triple")]" >> $cross
+      echo "rustdoc = [$(meson_quote $rustdoc --target "$rust_target_triple")]" >> $cross
     else
       echo "rust = [$(meson_quote $rustc)]" >> $cross
+      echo "rustdoc = [$(meson_quote $rustdoc)]" >> $cross
     fi
   fi
   echo "ar = [$(meson_quote $ar)]" >> $cross
diff --git a/meson.build b/meson.build
index ef994676fe..e85b358d63 100644
--- a/meson.build
+++ b/meson.build
@@ -106,6 +106,7 @@ if have_rust
 endif
 
 if have_rust
+  rustdoc = find_program('rustdoc', required: get_option('rust'))
   bindgen = find_program('bindgen', required: get_option('rust'))
   if not bindgen.found() or bindgen.version().version_compare('<0.60.0')
     if get_option('rust').enabled()
@@ -4757,6 +4758,7 @@ if have_rust
   summary_info += {'Rust target':     config_host['RUST_TARGET_TRIPLE']}
   summary_info += {'rustc':           ' '.join(rustc.cmd_array())}
   summary_info += {'rustc version':   rustc.version()}
+  summary_info += {'rustdoc':         rustdoc}
   summary_info += {'bindgen':         bindgen.full_path()}
   summary_info += {'bindgen version': bindgen.version()}
 endif
diff --git a/tests/docker/dockerfiles/fedora-rust-nightly.docker b/tests/docker/dockerfiles/fedora-rust-nightly.docker
index fe4a6ed48d..4a033309b3 100644
--- a/tests/docker/dockerfiles/fedora-rust-nightly.docker
+++ b/tests/docker/dockerfiles/fedora-rust-nightly.docker
@@ -156,6 +156,7 @@ ENV PYTHON "/usr/bin/python3"
 RUN dnf install -y wget
 ENV RUSTUP_HOME=/usr/local/rustup CARGO_HOME=/usr/local/cargo
 ENV RUSTC=/usr/local/rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/rustc
+ENV RUSTDOC=/usr/local/rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/rustdoc
 ENV CARGO=/usr/local/rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/cargo
 RUN set -eux && \
   rustArch='x86_64-unknown-linux-gnu' && \
@@ -170,6 +171,7 @@ RUN set -eux && \
   /usr/local/cargo/bin/rustup run nightly cargo --version && \
   /usr/local/cargo/bin/rustup run nightly rustc --version && \
   test "$CARGO" = "$(/usr/local/cargo/bin/rustup +nightly which cargo)" && \
+  test "$RUSTDOC" = "$(/usr/local/cargo/bin/rustup +nightly which rustdoc)" && \
   test "$RUSTC" = "$(/usr/local/cargo/bin/rustup +nightly which rustc)"
 ENV PATH=$CARGO_HOME/bin:$PATH
 RUN /usr/local/cargo/bin/rustup run nightly cargo install bindgen-cli
diff --git a/tests/docker/dockerfiles/ubuntu2204.docker b/tests/docker/dockerfiles/ubuntu2204.docker
index 4a1cf2bdff..28a6f93243 100644
--- a/tests/docker/dockerfiles/ubuntu2204.docker
+++ b/tests/docker/dockerfiles/ubuntu2204.docker
@@ -151,6 +151,7 @@ ENV MAKE "/usr/bin/make"
 ENV NINJA "/usr/bin/ninja"
 ENV PYTHON "/usr/bin/python3"
 ENV RUSTC=/usr/bin/rustc-1.77
+ENV RUSTDOC=/usr/bin/rustdoc-1.77
 ENV CARGO_HOME=/usr/local/cargo
 ENV PATH=$CARGO_HOME/bin:$PATH
 RUN DEBIAN_FRONTEND=noninteractive eatmydata \
diff --git a/tests/lcitool/refresh b/tests/lcitool/refresh
index 8474ea822f..d3488b2679 100755
--- a/tests/lcitool/refresh
+++ b/tests/lcitool/refresh
@@ -121,6 +121,7 @@ fedora_rustup_nightly_extras = [
     "RUN dnf install -y wget\n",
     "ENV RUSTUP_HOME=/usr/local/rustup CARGO_HOME=/usr/local/cargo\n",
     "ENV RUSTC=/usr/local/rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/rustc\n",
+    "ENV RUSTDOC=/usr/local/rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/rustdoc\n",
     "ENV CARGO=/usr/local/rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/cargo\n",
     "RUN set -eux && \\\n",
     "  rustArch='x86_64-unknown-linux-gnu' && \\\n",
@@ -135,6 +136,7 @@ fedora_rustup_nightly_extras = [
     "  /usr/local/cargo/bin/rustup run nightly cargo --version && \\\n",
     "  /usr/local/cargo/bin/rustup run nightly rustc --version && \\\n",
     '  test "$CARGO" = "$(/usr/local/cargo/bin/rustup +nightly which cargo)" && \\\n',
+    '  test "$RUSTDOC" = "$(/usr/local/cargo/bin/rustup +nightly which rustdoc)" && \\\n',
     '  test "$RUSTC" = "$(/usr/local/cargo/bin/rustup +nightly which rustc)"\n',
     'ENV PATH=$CARGO_HOME/bin:$PATH\n',
     'RUN /usr/local/cargo/bin/rustup run nightly cargo install bindgen-cli\n',
@@ -143,6 +145,7 @@ fedora_rustup_nightly_extras = [
 
 ubuntu2204_rust_extras = [
     "ENV RUSTC=/usr/bin/rustc-1.77\n",
+    "ENV RUSTDOC=/usr/bin/rustdoc-1.77\n",
     "ENV CARGO_HOME=/usr/local/cargo\n",
     'ENV PATH=$CARGO_HOME/bin:$PATH\n',
     "RUN DEBIAN_FRONTEND=noninteractive eatmydata \\\n",

From f620cadc0c24ae414b46204e57a82f7bf586d2c4 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Sat, 5 Apr 2025 10:33:09 +0200
Subject: [PATCH 1373/2760] rust: add qemu-api doctests to "meson test"

Doctests are weird.  They are essentially integration tests, but they're
"ran" by executing rustdoc --test, which takes a compiler-ish
command line.  This is supported by Meson 1.8.0.

Because they run the linker and need all the .o files, run them in the
build jobs rather than the test jobs.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 .gitlab-ci.d/buildtest-template.yml |  3 ++-
 .gitlab-ci.d/buildtest.yml          | 11 +++--------
 docs/devel/rust.rst                 |  2 ++
 rust/qemu-api/meson.build           |  9 +++++++++
 4 files changed, 16 insertions(+), 9 deletions(-)

diff --git a/.gitlab-ci.d/buildtest-template.yml b/.gitlab-ci.d/buildtest-template.yml
index 118371e377..fea4e8da2f 100644
--- a/.gitlab-ci.d/buildtest-template.yml
+++ b/.gitlab-ci.d/buildtest-template.yml
@@ -76,7 +76,8 @@
       fi
     - section_end buildenv
     - section_start test "Running tests"
-    - $MAKE NINJA=":" $MAKE_CHECK_ARGS
+    # doctests need all the compilation artifacts
+    - $MAKE NINJA=":" MTESTARGS="--no-suite doc" $MAKE_CHECK_ARGS
     - section_end test
 
 .native_test_job_template:
diff --git a/.gitlab-ci.d/buildtest.yml b/.gitlab-ci.d/buildtest.yml
index ca1a9c6f70..d888a60063 100644
--- a/.gitlab-ci.d/buildtest.yml
+++ b/.gitlab-ci.d/buildtest.yml
@@ -41,7 +41,7 @@ build-system-ubuntu:
     IMAGE: ubuntu2204
     CONFIGURE_ARGS: --enable-docs --enable-rust
     TARGETS: alpha-softmmu microblazeel-softmmu mips64el-softmmu
-    MAKE_CHECK_ARGS: check-build
+    MAKE_CHECK_ARGS: check-build check-doc
 
 check-system-ubuntu:
   extends: .native_test_job_template
@@ -115,7 +115,7 @@ build-system-fedora:
     CONFIGURE_ARGS: --disable-gcrypt --enable-nettle --enable-docs --enable-crypto-afalg --enable-rust
     TARGETS: microblaze-softmmu mips-softmmu
       xtensa-softmmu m68k-softmmu riscv32-softmmu ppc-softmmu sparc64-softmmu
-    MAKE_CHECK_ARGS: check-build
+    MAKE_CHECK_ARGS: check-build check-doc
 
 build-system-fedora-rust-nightly:
   extends:
@@ -127,12 +127,7 @@ build-system-fedora-rust-nightly:
     IMAGE: fedora-rust-nightly
     CONFIGURE_ARGS: --disable-docs --enable-rust --enable-strict-rust-lints
     TARGETS: aarch64-softmmu
-    MAKE_CHECK_ARGS: check-build
-  after_script:
-    - source scripts/ci/gitlab-ci-section
-    - section_start test "Running Rust doctests"
-    - cd build
-    - pyvenv/bin/meson devenv -w ../rust ${CARGO-cargo} test --doc -p qemu_api
+    MAKE_CHECK_ARGS: check-build check-doc
 
   allow_failure: true
 
diff --git a/docs/devel/rust.rst b/docs/devel/rust.rst
index 11328c05b4..f66f2bef60 100644
--- a/docs/devel/rust.rst
+++ b/docs/devel/rust.rst
@@ -66,6 +66,8 @@ be run via ``meson test`` or ``make``::
 
    make check-rust
 
+Note that doctests require all ``.o`` files from the build to be available.
+
 Supported tools
 '''''''''''''''
 
diff --git a/rust/qemu-api/meson.build b/rust/qemu-api/meson.build
index 62068352b0..b532281e8c 100644
--- a/rust/qemu-api/meson.build
+++ b/rust/qemu-api/meson.build
@@ -45,6 +45,15 @@ rust.test('rust-qemu-api-tests', _qemu_api_rs,
 qemu_api = declare_dependency(link_with: [_qemu_api_rs],
   dependencies: [qemu_api_macros, qom, hwcore, chardev, migration])
 
+# Doctests are essentially integration tests, so they need the same dependencies.
+# Note that running them requires the object files for C code, so place them
+# in a separate suite that is run by the "build" CI jobs rather than "check".
+rust.doctest('rust-qemu-api-doctests',
+     _qemu_api_rs,
+     protocol: 'rust',
+     dependencies: qemu_api,
+     suite: ['doc', 'rust'])
+
 test('rust-qemu-api-integration',
     executable(
         'rust-qemu-api-integration',

From 18c9f4a1729db1389218983379f6d62a9e550754 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Sat, 5 Apr 2025 12:05:21 +0200
Subject: [PATCH 1374/2760] rust: cell: remove support for running doctests
 with "cargo test --doc"

This is not needed anymore now that tests link with libqemuutil.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/qemu-api/src/cell.rs | 22 +++++++++-------------
 1 file changed, 9 insertions(+), 13 deletions(-)

diff --git a/rust/qemu-api/src/cell.rs b/rust/qemu-api/src/cell.rs
index 05ce09f6cb..27063b049d 100644
--- a/rust/qemu-api/src/cell.rs
+++ b/rust/qemu-api/src/cell.rs
@@ -225,27 +225,23 @@ use crate::bindings;
 
 /// An internal function that is used by doctests.
 pub fn bql_start_test() {
-    if cfg!(MESON) {
-        // SAFETY: integration tests are run with --test-threads=1, while
-        // unit tests and doctests are not multithreaded and do not have
-        // any BQL-protected data.  Just set bql_locked to true.
-        unsafe {
-            bindings::rust_bql_mock_lock();
-        }
+    // SAFETY: integration tests are run with --test-threads=1, while
+    // unit tests and doctests are not multithreaded and do not have
+    // any BQL-protected data.  Just set bql_locked to true.
+    unsafe {
+        bindings::rust_bql_mock_lock();
     }
 }
 
 pub fn bql_locked() -> bool {
     // SAFETY: the function does nothing but return a thread-local bool
-    !cfg!(MESON) || unsafe { bindings::bql_locked() }
+    unsafe { bindings::bql_locked() }
 }
 
 fn bql_block_unlock(increase: bool) {
-    if cfg!(MESON) {
-        // SAFETY: this only adjusts a counter
-        unsafe {
-            bindings::bql_block_unlock(increase);
-        }
+    // SAFETY: this only adjusts a counter
+    unsafe {
+        bindings::bql_block_unlock(increase);
     }
 }
 

From 2409089b87692700deb38fc0b8ac94e31b70ffc3 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Sat, 5 Apr 2025 14:18:17 +0200
Subject: [PATCH 1375/2760] rust: use native Meson support for clippy and
 rustdoc

Meson has support for invoking clippy and rustdoc on all crates (1.7.0 for
clippy, 1.8.0 for rustdoc).  Use it instead of the homegrown version; this
requires disabling the multiple_crate_versions lint (the only one that was
enabled from the "cargo" group)---which was not particularly useful anyway
because all dependencies are converted by hand into Meson subprojects.

rustfmt is still not supported.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/clippy.toml => clippy.toml |  2 +-
 docs/devel/rust.rst             | 10 +++++++---
 meson.build                     |  2 +-
 rust/Cargo.toml                 |  1 -
 rust/meson.build                | 12 ------------
 scripts/rust/rustc_args.py      |  5 +----
 6 files changed, 10 insertions(+), 22 deletions(-)
 rename rust/clippy.toml => clippy.toml (55%)

diff --git a/rust/clippy.toml b/clippy.toml
similarity index 55%
rename from rust/clippy.toml
rename to clippy.toml
index 58a62c0e63..9016172983 100644
--- a/rust/clippy.toml
+++ b/clippy.toml
@@ -1,3 +1,3 @@
-doc-valid-idents = ["PrimeCell", ".."]
+doc-valid-idents = ["IrDA", "PrimeCell", ".."]
 allow-mixed-uninlined-format-args = false
 msrv = "1.77.0"
diff --git a/docs/devel/rust.rst b/docs/devel/rust.rst
index f66f2bef60..34d9c7945b 100644
--- a/docs/devel/rust.rst
+++ b/docs/devel/rust.rst
@@ -37,12 +37,16 @@ output directory (typically ``rust/target/``).  A vanilla invocation
 of Cargo will complain that it cannot find the generated sources,
 which can be fixed in different ways:
 
-* by using special shorthand targets in the QEMU build directory::
+* by using Makefile targets, provided by Meson, that run ``clippy`` or
+  ``rustdoc``:
 
     make clippy
-    make rustfmt
     make rustdoc
 
+A target for ``rustfmt`` is also declared in ``rust/meson.build``:
+
+    make rustfmt
+
 * by invoking ``cargo`` through the Meson `development environment`__
   feature::
 
@@ -50,7 +54,7 @@ which can be fixed in different ways:
     pyvenv/bin/meson devenv -w ../rust cargo fmt
 
   If you are going to use ``cargo`` repeatedly, ``pyvenv/bin/meson devenv``
-  will enter a shell where commands like ``cargo clippy`` just work.
+  will enter a shell where commands like ``cargo fmt`` just work.
 
 __ https://mesonbuild.com/Commands.html#devenv
 
diff --git a/meson.build b/meson.build
index e85b358d63..651bd4f727 100644
--- a/meson.build
+++ b/meson.build
@@ -4404,7 +4404,7 @@ foreach target : target_dirs
                               build_by_default: true,
                               build_always_stale: true)
       rlib = static_library('rust_' + target.underscorify(),
-                            rlib_rs,
+                            structured_sources([], {'.': rlib_rs}),
                             dependencies: target_rust.dependencies(),
                             override_options: ['rust_std=2021', 'build.rust_std=2021'],
                             rust_abi: 'c')
diff --git a/rust/Cargo.toml b/rust/Cargo.toml
index d9faeecb10..a00b8ad0bc 100644
--- a/rust/Cargo.toml
+++ b/rust/Cargo.toml
@@ -63,7 +63,6 @@ ignored_unit_patterns = "deny"
 implicit_clone = "deny"
 macro_use_imports = "deny"
 missing_safety_doc = "deny"
-multiple_crate_versions = "deny"
 mut_mut = "deny"
 needless_bitwise_bool = "deny"
 needless_pass_by_ref_mut = "deny"
diff --git a/rust/meson.build b/rust/meson.build
index 801f4374df..afce62f477 100644
--- a/rust/meson.build
+++ b/rust/meson.build
@@ -24,21 +24,9 @@ subdir('hw')
 cargo = find_program('cargo', required: false)
 
 if cargo.found()
-  run_target('clippy',
-    command: [config_host['MESON'], 'devenv',
-              '--workdir', '@CURRENT_SOURCE_DIR@',
-              cargo, 'clippy', '--tests'],
-    depends: bindings_rs)
-
   run_target('rustfmt',
     command: [config_host['MESON'], 'devenv',
               '--workdir', '@CURRENT_SOURCE_DIR@',
               cargo, 'fmt'],
     depends: bindings_rs)
-
-  run_target('rustdoc',
-    command: [config_host['MESON'], 'devenv',
-              '--workdir', '@CURRENT_SOURCE_DIR@',
-              cargo, 'doc', '--no-deps', '--document-private-items'],
-    depends: bindings_rs)
 endif
diff --git a/scripts/rust/rustc_args.py b/scripts/rust/rustc_args.py
index 2633157df2..63b0748e0d 100644
--- a/scripts/rust/rustc_args.py
+++ b/scripts/rust/rustc_args.py
@@ -104,10 +104,7 @@ def generate_lint_flags(cargo_toml: CargoTOML, strict_lints: bool) -> Iterable[s
             else:
                 raise Exception(f"invalid level {level} for {prefix}{lint}")
 
-            # This may change if QEMU ever invokes clippy-driver or rustdoc by
-            # hand.  For now, check the syntax but do not add non-rustc lints to
-            # the command line.
-            if k == "rust" and not (strict_lints and lint in STRICT_LINTS):
+            if not (strict_lints and lint in STRICT_LINTS):
                 lint_list.append(LintFlag(flags=[flag, prefix + lint], priority=priority))
 
     if strict_lints:

From 0b901459a87a7fdbed36e574aae33e0635a3e9af Mon Sep 17 00:00:00 2001
From: "Xin Li (Intel)" <xin@zytor.com>
Date: Fri, 3 Jan 2025 00:48:25 -0800
Subject: [PATCH 1376/2760] target/i386: Remove FRED dependency on WRMSRNS

WRMSRNS doesn't become a required feature for FERD, and Linux has
removed the dependency, as such remove it from Qemu.

Cc: qemu-stable@nongnu.org
Signed-off-by: Xin Li (Intel) <xin@zytor.com>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Link: https://lore.kernel.org/r/20250103084827.1820007-2-xin@zytor.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index c9bd3444e4..73403505c5 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -1803,10 +1803,6 @@ static FeatureDep feature_dependencies[] = {
         .from = { FEAT_7_1_EAX,             CPUID_7_1_EAX_LKGS },
         .to = { FEAT_7_1_EAX,               CPUID_7_1_EAX_FRED },
     },
-    {
-        .from = { FEAT_7_1_EAX,             CPUID_7_1_EAX_WRMSRNS },
-        .to = { FEAT_7_1_EAX,               CPUID_7_1_EAX_FRED },
-    },
     {
         .from = { FEAT_7_0_EBX,             CPUID_7_0_EBX_SGX },
         .to = { FEAT_7_0_ECX,               CPUID_7_0_ECX_SGX_LC },

From 99216748fd4e2b25dc0a7609e8a4fecea4c3eaf4 Mon Sep 17 00:00:00 2001
From: "Xin Li (Intel)" <xin@zytor.com>
Date: Fri, 3 Jan 2025 00:48:26 -0800
Subject: [PATCH 1377/2760] target/i386: Add a new CPU feature word for
 CPUID.7.1.ECX

The immediate form of MSR access instructions will use this new CPU
feature word.

Signed-off-by: Xin Li (Intel) <xin@zytor.com>
Link: https://lore.kernel.org/r/20250103084827.1820007-3-xin@zytor.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 23 ++++++++++++++++++++++-
 target/i386/cpu.h |  1 +
 2 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 73403505c5..b05f465e2e 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -900,6 +900,7 @@ void x86_cpu_vendor_words2str(char *dst, uint32_t vendor1,
 
 #define TCG_7_1_EAX_FEATURES (CPUID_7_1_EAX_FZRM | CPUID_7_1_EAX_FSRS | \
           CPUID_7_1_EAX_FSRC | CPUID_7_1_EAX_CMPCCXADD)
+#define TCG_7_1_ECX_FEATURES 0
 #define TCG_7_1_EDX_FEATURES 0
 #define TCG_7_2_EDX_FEATURES 0
 #define TCG_APM_FEATURES 0
@@ -1150,6 +1151,25 @@ FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
         },
         .tcg_features = TCG_7_1_EAX_FEATURES,
     },
+    [FEAT_7_1_ECX] = {
+        .type = CPUID_FEATURE_WORD,
+        .feat_names = {
+            NULL, NULL, NULL, NULL,
+            NULL, NULL, NULL, NULL,
+            NULL, NULL, NULL, NULL,
+            NULL, NULL, NULL, NULL,
+            NULL, NULL, NULL, NULL,
+            NULL, NULL, NULL, NULL,
+            NULL, NULL, NULL, NULL,
+            NULL, NULL, NULL, NULL,
+        },
+        .cpuid = {
+            .eax = 7,
+            .needs_ecx = true, .ecx = 1,
+            .reg = R_ECX,
+        },
+        .tcg_features = TCG_7_1_ECX_FEATURES,
+    },
     [FEAT_7_1_EDX] = {
         .type = CPUID_FEATURE_WORD,
         .feat_names = {
@@ -7442,9 +7462,9 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
             *edx = env->features[FEAT_7_0_EDX]; /* Feature flags */
         } else if (count == 1) {
             *eax = env->features[FEAT_7_1_EAX];
+            *ecx = env->features[FEAT_7_1_ECX];
             *edx = env->features[FEAT_7_1_EDX];
             *ebx = 0;
-            *ecx = 0;
         } else if (count == 2) {
             *edx = env->features[FEAT_7_2_EDX];
             *eax = 0;
@@ -8349,6 +8369,7 @@ void x86_cpu_expand_features(X86CPU *cpu, Error **errp)
         x86_cpu_adjust_feat_level(cpu, FEAT_6_EAX);
         x86_cpu_adjust_feat_level(cpu, FEAT_7_0_ECX);
         x86_cpu_adjust_feat_level(cpu, FEAT_7_1_EAX);
+        x86_cpu_adjust_feat_level(cpu, FEAT_7_1_ECX);
         x86_cpu_adjust_feat_level(cpu, FEAT_7_1_EDX);
         x86_cpu_adjust_feat_level(cpu, FEAT_7_2_EDX);
         x86_cpu_adjust_feat_level(cpu, FEAT_8000_0001_EDX);
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index 1146465c8c..0ec1cbd9f4 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -668,6 +668,7 @@ typedef enum FeatureWord {
     FEAT_SGX_12_1_EAX,  /* CPUID[EAX=0x12,ECX=1].EAX (SGX ATTRIBUTES[31:0]) */
     FEAT_XSAVE_XSS_LO,     /* CPUID[EAX=0xd,ECX=1].ECX */
     FEAT_XSAVE_XSS_HI,     /* CPUID[EAX=0xd,ECX=1].EDX */
+    FEAT_7_1_ECX,       /* CPUID[EAX=7,ECX=1].ECX */
     FEAT_7_1_EDX,       /* CPUID[EAX=7,ECX=1].EDX */
     FEAT_7_2_EDX,       /* CPUID[EAX=7,ECX=2].EDX */
     FEAT_24_0_EBX,      /* CPUID[EAX=0x24,ECX=0].EBX */

From 91084f3b44b1da4935eec85b79c1f97d1c140ada Mon Sep 17 00:00:00 2001
From: "Xin Li (Intel)" <xin@zytor.com>
Date: Fri, 3 Jan 2025 00:48:27 -0800
Subject: [PATCH 1378/2760] target/i386: Add the immediate form MSR access
 instruction support

The immediate form of MSR access instructions are primarily motivated by
performance, not code size: by having the MSR number in an immediate, it
is available *much* earlier in the pipeline, which allows the hardware
much more leeway about how a particular MSR is handled.

Signed-off-by: Xin Li (Intel) <xin@zytor.com>
Link: https://lore.kernel.org/r/20250103084827.1820007-4-xin@zytor.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 2 +-
 target/i386/cpu.h | 4 ++++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index b05f465e2e..40aefb38f6 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -1155,7 +1155,7 @@ FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
         .type = CPUID_FEATURE_WORD,
         .feat_names = {
             NULL, NULL, NULL, NULL,
-            NULL, NULL, NULL, NULL,
+            NULL, "msr-imm", NULL, NULL,
             NULL, NULL, NULL, NULL,
             NULL, NULL, NULL, NULL,
             NULL, NULL, NULL, NULL,
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index 0ec1cbd9f4..545851cbde 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -1001,6 +1001,9 @@ uint64_t x86_cpu_get_supported_feature_word(X86CPU *cpu, FeatureWord w);
 /* Linear Address Masking */
 #define CPUID_7_1_EAX_LAM               (1U << 26)
 
+/* The immediate form of MSR access instructions */
+#define CPUID_7_1_ECX_MSR_IMM           (1U << 5)
+
 /* Support for VPDPB[SU,UU,SS]D[,S] */
 #define CPUID_7_1_EDX_AVX_VNNI_INT8     (1U << 4)
 /* AVX NE CONVERT Instructions */
@@ -1024,6 +1027,7 @@ uint64_t x86_cpu_get_supported_feature_word(X86CPU *cpu, FeatureWord w);
 #define CPUID_7_2_EDX_DDPD_U            (1U << 3)
 /* Indicate bit 10 of the IA32_SPEC_CTRL MSR is supported */
 #define CPUID_7_2_EDX_BHI_CTRL          (1U << 4)
+
 /* Do not exhibit MXCSR Configuration Dependent Timing (MCDT) behavior */
 #define CPUID_7_2_EDX_MCDT_NO           (1U << 5)
 

From 34d697f427d853e4cc14bb369b9134fe4b663cda Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 2 Jun 2025 16:38:01 -0700
Subject: [PATCH 1379/2760] meson: use config_base_arch for target libraries
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fixed commit introduced common dependencies for target libraries. Alas,
it wrongly reused the 'target' variable, which was previously set from
another loop.

Thus, some dependencies were missing depending on order of target list,
as found here [1].

The fix is to use the correct config_base_arch instead.
Kudos to Thomas Huth who had this right, before I reimplement it, and
introduce this bug.

[1] https://lore.kernel.org/qemu-devel/c54469ce-0385-4aea-b345-47711e9e61de@linaro.org/

Fixes: 4fb54de823e9 (meson: build target libraries with common dependencies)
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Tested-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/r/20250602233801.2699961-1-pierrick.bouvier@linaro.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 meson.build | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/meson.build b/meson.build
index 651bd4f727..967a10e80b 100644
--- a/meson.build
+++ b/meson.build
@@ -4135,13 +4135,12 @@ common_all = static_library('common',
 target_common_arch_libs = {}
 target_common_system_arch_libs = {}
 foreach target_base_arch, config_base_arch : config_base_arch_mak
-  config_target = config_target_mak[target]
   target_inc = [include_directories('target' / target_base_arch)]
   inc = [common_user_inc + target_inc]
 
-  target_common = common_ss.apply(config_target, strict: false)
-  target_system = system_ss.apply(config_target, strict: false)
-  target_user = user_ss.apply(config_target, strict: false)
+  target_common = common_ss.apply(config_base_arch, strict: false)
+  target_system = system_ss.apply(config_base_arch, strict: false)
+  target_user = user_ss.apply(config_base_arch, strict: false)
   common_deps = []
   system_deps = []
   user_deps = []

From e7f926eb7f5b81c709313974b476ed181c9c76d5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Mon, 2 Jun 2025 19:31:00 +0200
Subject: [PATCH 1380/2760] i386/tdx: Fix build on 32-bit host
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Use PRI formats where required and fix pointer cast.

Cc: Xiaoyao Li <xiaoyao.li@intel.com>
Signed-off-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/r/20250602173101.1052983-2-clg@redhat.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/kvm/tdx.c | 26 +++++++++++++-------------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
index 0a21ae555c..820ca3614e 100644
--- a/target/i386/kvm/tdx.c
+++ b/target/i386/kvm/tdx.c
@@ -284,7 +284,7 @@ static void tdx_post_init_vcpus(void)
 
     hob = tdx_get_hob_entry(tdx_guest);
     CPU_FOREACH(cpu) {
-        tdx_vcpu_ioctl(cpu, KVM_TDX_INIT_VCPU, 0, (void *)hob->address,
+        tdx_vcpu_ioctl(cpu, KVM_TDX_INIT_VCPU, 0, (void *)(uintptr_t)hob->address,
                        &error_fatal);
     }
 }
@@ -339,7 +339,7 @@ static void tdx_finalize_vm(Notifier *notifier, void *unused)
         uint32_t flags;
 
         region = (struct kvm_tdx_init_mem_region) {
-            .source_addr = (uint64_t)entry->mem_ptr,
+            .source_addr = (uintptr_t)entry->mem_ptr,
             .gpa = entry->address,
             .nr_pages = entry->size >> 12,
         };
@@ -893,16 +893,16 @@ static int tdx_check_features(X86ConfidentialGuest *cg, CPUState *cs)
 static int tdx_validate_attributes(TdxGuest *tdx, Error **errp)
 {
     if ((tdx->attributes & ~tdx_caps->supported_attrs)) {
-        error_setg(errp, "Invalid attributes 0x%lx for TDX VM "
-                   "(KVM supported: 0x%llx)", tdx->attributes,
-                   tdx_caps->supported_attrs);
+        error_setg(errp, "Invalid attributes 0x%"PRIx64" for TDX VM "
+                   "(KVM supported: 0x%"PRIx64")", tdx->attributes,
+                   (uint64_t)tdx_caps->supported_attrs);
         return -1;
     }
 
     if (tdx->attributes & ~TDX_SUPPORTED_TD_ATTRS) {
         error_setg(errp, "Some QEMU unsupported TD attribute bits being "
-                    "requested: 0x%lx (QEMU supported: 0x%llx)",
-                    tdx->attributes, TDX_SUPPORTED_TD_ATTRS);
+                    "requested: 0x%"PRIx64" (QEMU supported: 0x%"PRIx64")",
+                    tdx->attributes, (uint64_t)TDX_SUPPORTED_TD_ATTRS);
         return -1;
     }
 
@@ -931,8 +931,8 @@ static int setup_td_xfam(X86CPU *x86cpu, Error **errp)
            env->features[FEAT_XSAVE_XSS_HI];
 
     if (xfam & ~tdx_caps->supported_xfam) {
-        error_setg(errp, "Invalid XFAM 0x%lx for TDX VM (supported: 0x%llx))",
-                   xfam, tdx_caps->supported_xfam);
+        error_setg(errp, "Invalid XFAM 0x%"PRIx64" for TDX VM (supported: 0x%"PRIx64"))",
+                   xfam, (uint64_t)tdx_caps->supported_xfam);
         return -1;
     }
 
@@ -999,14 +999,14 @@ int tdx_pre_create_vcpu(CPUState *cpu, Error **errp)
 
     if (env->tsc_khz && (env->tsc_khz < TDX_MIN_TSC_FREQUENCY_KHZ ||
                          env->tsc_khz > TDX_MAX_TSC_FREQUENCY_KHZ)) {
-        error_setg(errp, "Invalid TSC %ld KHz, must specify cpu_frequency "
+        error_setg(errp, "Invalid TSC %"PRId64" KHz, must specify cpu_frequency "
                          "between [%d, %d] kHz", env->tsc_khz,
                          TDX_MIN_TSC_FREQUENCY_KHZ, TDX_MAX_TSC_FREQUENCY_KHZ);
        return -EINVAL;
     }
 
     if (env->tsc_khz % (25 * 1000)) {
-        error_setg(errp, "Invalid TSC %ld KHz, it must be multiple of 25MHz",
+        error_setg(errp, "Invalid TSC %"PRId64" KHz, it must be multiple of 25MHz",
                    env->tsc_khz);
         return -EINVAL;
     }
@@ -1014,7 +1014,7 @@ int tdx_pre_create_vcpu(CPUState *cpu, Error **errp)
     /* it's safe even env->tsc_khz is 0. KVM uses host's tsc_khz in this case */
     r = kvm_vm_ioctl(kvm_state, KVM_SET_TSC_KHZ, env->tsc_khz);
     if (r < 0) {
-        error_setg_errno(errp, -r, "Unable to set TSC frequency to %ld kHz",
+        error_setg_errno(errp, -r, "Unable to set TSC frequency to %"PRId64" kHz",
                          env->tsc_khz);
         return r;
     }
@@ -1139,7 +1139,7 @@ int tdx_handle_report_fatal_error(X86CPU *cpu, struct kvm_run *run)
     uint64_t gpa = -1ull;
 
     if (error_code & 0xffff) {
-        error_report("TDX: REPORT_FATAL_ERROR: invalid error code: 0x%lx",
+        error_report("TDX: REPORT_FATAL_ERROR: invalid error code: 0x%"PRIx64,
                      error_code);
         return -1;
     }

From 6f1035fc65406c4e72e1dbd76e64924415edd616 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Mon, 2 Jun 2025 19:31:01 +0200
Subject: [PATCH 1381/2760] i386/tdvf: Fix build on 32-bit host
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Use PRI formats where required.

Cc: Isaku Yamahata <isaku.yamahata@intel.com>
Signed-off-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/r/20250602173101.1052983-3-clg@redhat.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/i386/tdvf.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/hw/i386/tdvf.c b/hw/i386/tdvf.c
index bd993ea2f0..645d9d1294 100644
--- a/hw/i386/tdvf.c
+++ b/hw/i386/tdvf.c
@@ -101,16 +101,16 @@ static int tdvf_parse_and_check_section_entry(const TdvfSectionEntry *src,
 
     /* sanity check */
     if (entry->size < entry->data_len) {
-        error_report("Broken metadata RawDataSize 0x%x MemoryDataSize 0x%lx",
+        error_report("Broken metadata RawDataSize 0x%x MemoryDataSize 0x%"PRIx64,
                      entry->data_len, entry->size);
         return -1;
     }
     if (!QEMU_IS_ALIGNED(entry->address, TDVF_ALIGNMENT)) {
-        error_report("MemoryAddress 0x%lx not page aligned", entry->address);
+        error_report("MemoryAddress 0x%"PRIx64" not page aligned", entry->address);
         return -1;
     }
     if (!QEMU_IS_ALIGNED(entry->size, TDVF_ALIGNMENT)) {
-        error_report("MemoryDataSize 0x%lx not page aligned", entry->size);
+        error_report("MemoryDataSize 0x%"PRIx64" not page aligned", entry->size);
         return -1;
     }
 

From 648fe157d33436f042d6b6434b9b88079f67fa33 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Tue, 3 Jun 2025 17:44:54 +0200
Subject: [PATCH 1382/2760] rust: add "bits", a custom bitflags implementation

One common thing that device emulation does is manipulate bitmasks, for example
to check whether two bitmaps have common bits.  One example in the pl011 crate
is the checks for pending interrupts, where an interrupt cause corresponds to
at least one interrupt source from a fixed set.

Unfortunately, this is one case where Rust *can* provide some kind of
abstraction but it does so with a rather Perl-ish There Is More Way To
Do It.  It is not something where a crate like "bilge" helps, because
it only covers the packing of bits in a structure; operations like "are
all bits of Y set in X" almost never make sense for bit-packed structs;
you need something else, there are several crates that do it and of course
we're going to roll our own.

In particular I examined three:

- bitmask (https://docs.rs/bitmask/0.5.0/bitmask/) does not support const
  at all.  This is a showstopper because one of the ugly things in the
  current pl011 code is the ugliness of code that defines interrupt masks
  at compile time:

    pub const E: Self = Self(Self::OE.0 | Self::BE.0 | Self::PE.0 | Self::FE.0);

  or even worse:

    const IRQMASK: [u32; 6] = [
      Interrupt::E.0 | Interrupt::MS.0 | Interrupt::RT.0 | Interrupt::TX.0 | Interrupt::RX.0,
      ...
    }

  You would have to use roughly the same code---"bitmask" only helps with
  defining the struct.

- bitmask_enum (https://docs.rs/bitmask-enum/2.2.5/bitmask_enum/) does not
  have a good separation of "valid" and "invalid" bits, so for example "!x"
  will invert all 16 bits if you choose u16 as the representation -- even if
  you only defined 10 bits.  This makes it easier to introduce subtle bugs
  in comparisons.

- bitflags (https://docs.rs/bitflags/2.6.0/bitflags/) is generally the most
  used such crate and is the one that I took most inspiration from with
  respect to the syntax.  It's a pretty sophisticated implementation,
  with a lot of bells and whistles such as an implementation of "Iter"
  that returns the bits one at a time.

The main thing that all of them lack, however, is a way to simplify the
ugly definitions like the above.  "bitflags" includes const methods that
perform AND/OR/XOR of masks (these are necessary because Rust operator
overloading does not support const yet, and therefore overloaded operators
cannot be used in the definition of a "static" variable), but they become
even more verbose and unmanageable, like

  Interrupt::E.union(Interrupt::MS).union(Interrupt::RT).union(Interrupt::TX).union(Interrupt::RX)

This was the main reason to create "bits", which allows something like

  bits!(Interrupt: E | MS | RT | TX | RX)

and expands it 1) add "Interrupt::" in front of all identifiers 2) convert
operators to the wordy const functions like "union".  It supports boolean
operators "&", "|", "^", "!" and parentheses, with a relatively simple
recursive descent parser that's implemented in qemu_api_macros.

Since I don't remember exactly how the macro was developed, I cannot exclude
that it contains code from "bitflags".  Therefore, I am conservatively leaving
in the MIT and Apache 2.0 licenses from bitflags.  In fact, I think there
would be a benefit in being able to push code back to "bitflags" anyway
whenever applicable, so that the two libraries do not diverge too much,
so that's another reason to use this.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/Cargo.lock                  |   7 +
 rust/Cargo.toml                  |   1 +
 rust/bits/Cargo.toml             |  19 ++
 rust/bits/meson.build            |  16 ++
 rust/bits/src/lib.rs             | 443 +++++++++++++++++++++++++++++++
 rust/meson.build                 |   1 +
 rust/qemu-api-macros/src/bits.rs | 229 ++++++++++++++++
 rust/qemu-api-macros/src/lib.rs  |  12 +
 8 files changed, 728 insertions(+)
 create mode 100644 rust/bits/Cargo.toml
 create mode 100644 rust/bits/meson.build
 create mode 100644 rust/bits/src/lib.rs
 create mode 100644 rust/qemu-api-macros/src/bits.rs

diff --git a/rust/Cargo.lock b/rust/Cargo.lock
index 13d580c693..0dfe0fb6ce 100644
--- a/rust/Cargo.lock
+++ b/rust/Cargo.lock
@@ -31,6 +31,13 @@ dependencies = [
  "syn",
 ]
 
+[[package]]
+name = "bits"
+version = "0.1.0"
+dependencies = [
+ "qemu_api_macros",
+]
+
 [[package]]
 name = "either"
 version = "1.12.0"
diff --git a/rust/Cargo.toml b/rust/Cargo.toml
index a00b8ad0bc..fd4c2fbf84 100644
--- a/rust/Cargo.toml
+++ b/rust/Cargo.toml
@@ -1,6 +1,7 @@
 [workspace]
 resolver = "2"
 members = [
+    "bits",
     "qemu-api-macros",
     "qemu-api",
     "hw/char/pl011",
diff --git a/rust/bits/Cargo.toml b/rust/bits/Cargo.toml
new file mode 100644
index 0000000000..1ff38a4117
--- /dev/null
+++ b/rust/bits/Cargo.toml
@@ -0,0 +1,19 @@
+[package]
+name = "bits"
+version = "0.1.0"
+authors = ["Paolo Bonzini <pbonzini@redhat.com>"]
+description = "const-friendly bit flags"
+resolver = "2"
+publish = false
+
+edition.workspace = true
+homepage.workspace = true
+license.workspace = true
+repository.workspace = true
+rust-version.workspace = true
+
+[dependencies]
+qemu_api_macros = { path = "../qemu-api-macros" }
+
+[lints]
+workspace = true
diff --git a/rust/bits/meson.build b/rust/bits/meson.build
new file mode 100644
index 0000000000..2a41e138c5
--- /dev/null
+++ b/rust/bits/meson.build
@@ -0,0 +1,16 @@
+_bits_rs = static_library(
+  'bits',
+  'src/lib.rs',
+  override_options: ['rust_std=2021', 'build.rust_std=2021'],
+  rust_abi: 'rust',
+  dependencies: [qemu_api_macros],
+)
+
+bits_rs = declare_dependency(link_with: _bits_rs)
+
+rust.test('rust-bits-tests', _bits_rs,
+          suite: ['unit', 'rust'])
+
+rust.doctest('rust-bits-doctests', _bits_rs,
+             dependencies: bits_rs,
+             suite: ['doc', 'rust'])
diff --git a/rust/bits/src/lib.rs b/rust/bits/src/lib.rs
new file mode 100644
index 0000000000..d485d6bd11
--- /dev/null
+++ b/rust/bits/src/lib.rs
@@ -0,0 +1,443 @@
+// SPDX-License-Identifier: MIT or Apache-2.0 or GPL-2.0-or-later
+
+/// # Definition entry point
+///
+/// Define a struct with a single field of type $type.  Include public constants
+/// for each element listed in braces.
+///
+/// The unnamed element at the end, if present, can be used to enlarge the set
+/// of valid bits.  Bits that are valid but not listed are treated normally for
+/// the purpose of arithmetic operations, and are printed with their hexadecimal
+/// value.
+///
+/// The struct implements the following traits: [`BitAnd`](std::ops::BitAnd),
+/// [`BitOr`](std::ops::BitOr), [`BitXor`](std::ops::BitXor),
+/// [`Not`](std::ops::Not), [`Sub`](std::ops::Sub); [`Debug`](std::fmt::Debug),
+/// [`Display`](std::fmt::Display), [`Binary`](std::fmt::Binary),
+/// [`Octal`](std::fmt::Octal), [`LowerHex`](std::fmt::LowerHex),
+/// [`UpperHex`](std::fmt::UpperHex); [`From`]`<type>`/[`Into`]`<type>` where
+/// type is the type specified in the definition.
+///
+/// ## Example
+///
+/// ```
+/// # use bits::bits;
+/// bits! {
+///     pub struct Colors(u8) {
+///         BLACK = 0,
+///         RED = 1,
+///         GREEN = 1 << 1,
+///         BLUE = 1 << 2,
+///         WHITE = (1 << 0) | (1 << 1) | (1 << 2),
+///     }
+/// }
+/// ```
+///
+/// ```
+/// # use bits::bits;
+/// # bits! { pub struct Colors(u8) { BLACK = 0, RED = 1, GREEN = 1 << 1, BLUE = 1 << 2, } }
+///
+/// bits! {
+///     pub struct Colors8(u8) {
+///         BLACK = 0,
+///         RED = 1,
+///         GREEN = 1 << 1,
+///         BLUE = 1 << 2,
+///         WHITE = (1 << 0) | (1 << 1) | (1 << 2),
+///
+///         _ = 255,
+///     }
+/// }
+///
+/// // The previously defined struct ignores bits not explicitly defined.
+/// assert_eq!(
+///     Colors::from(255).into_bits(),
+///     (Colors::RED | Colors::GREEN | Colors::BLUE).into_bits()
+/// );
+///
+/// // Adding "_ = 255" makes it retain other bits as well.
+/// assert_eq!(Colors8::from(255).into_bits(), 255);
+///
+/// // all() does not include the additional bits, valid_bits() does
+/// assert_eq!(Colors8::all().into_bits(), Colors::all().into_bits());
+/// assert_eq!(Colors8::valid_bits().into_bits(), 255);
+/// ```
+///
+/// # Evaluation entry point
+///
+/// Return a constant corresponding to the boolean expression `$expr`.
+/// Identifiers in the expression correspond to values defined for the
+/// type `$type`.  Supported operators are `!` (unary), `-`, `&`, `^`, `|`.
+///
+/// ## Examples
+///
+/// ```
+/// # use bits::bits;
+/// bits! {
+///     pub struct Colors(u8) {
+///         BLACK = 0,
+///         RED = 1,
+///         GREEN = 1 << 1,
+///         BLUE = 1 << 2,
+///         // same as "WHITE = 7",
+///         WHITE = bits!(Self as u8: RED | GREEN | BLUE),
+///     }
+/// }
+///
+/// let rgb = bits! { Colors: RED | GREEN | BLUE };
+/// assert_eq!(rgb, Colors::WHITE);
+/// ```
+#[macro_export]
+macro_rules! bits {
+    {
+        $(#[$struct_meta:meta])*
+        $struct_vis:vis struct $struct_name:ident($field_vis:vis $type:ty) {
+            $($(#[$const_meta:meta])* $const:ident = $val:expr),+
+            $(,_ = $mask:expr)?
+            $(,)?
+        }
+    } => {
+        $(#[$struct_meta])*
+        #[derive(Clone, Copy, PartialEq, Eq)]
+        #[repr(transparent)]
+        $struct_vis struct $struct_name($field_vis $type);
+
+        impl $struct_name {
+            $( #[allow(dead_code)] $(#[$const_meta])*
+                pub const $const: $struct_name = $struct_name($val); )+
+
+            #[doc(hidden)]
+            const VALID__: $type = $( Self::$const.0 )|+ $(|$mask)?;
+
+            #[allow(dead_code)]
+            #[inline(always)]
+            pub const fn empty() -> Self {
+                Self(0)
+            }
+
+            #[allow(dead_code)]
+            #[inline(always)]
+            pub const fn all() -> Self {
+                Self($( Self::$const.0 )|+)
+            }
+
+            #[allow(dead_code)]
+            #[inline(always)]
+            pub const fn valid_bits() -> Self {
+                Self(Self::VALID__)
+            }
+
+            #[allow(dead_code)]
+            #[inline(always)]
+            pub const fn valid(val: $type) -> bool {
+                (val & !Self::VALID__) == 0
+            }
+
+            #[allow(dead_code)]
+            #[inline(always)]
+            pub const fn any_set(self, mask: Self) -> bool {
+                (self.0 & mask.0) != 0
+            }
+
+            #[allow(dead_code)]
+            #[inline(always)]
+            pub const fn all_set(self, mask: Self) -> bool {
+                (self.0 & mask.0) == mask.0
+            }
+
+            #[allow(dead_code)]
+            #[inline(always)]
+            pub const fn none_set(self, mask: Self) -> bool {
+                (self.0 & mask.0) == 0
+            }
+
+            #[allow(dead_code)]
+            #[inline(always)]
+            pub const fn from_bits(value: $type) -> Self {
+                $struct_name(value)
+            }
+
+            #[allow(dead_code)]
+            #[inline(always)]
+            pub const fn into_bits(self) -> $type {
+                self.0
+            }
+
+            #[allow(dead_code)]
+            #[inline(always)]
+            pub fn set(&mut self, rhs: Self) {
+                self.0 |= rhs.0;
+            }
+
+            #[allow(dead_code)]
+            #[inline(always)]
+            pub fn clear(&mut self, rhs: Self) {
+                self.0 &= !rhs.0;
+            }
+
+            #[allow(dead_code)]
+            #[inline(always)]
+            pub fn toggle(&mut self, rhs: Self) {
+                self.0 ^= rhs.0;
+            }
+
+            #[allow(dead_code)]
+            #[inline(always)]
+            pub const fn intersection(self, rhs: Self) -> Self {
+                $struct_name(self.0 & rhs.0)
+            }
+
+            #[allow(dead_code)]
+            #[inline(always)]
+            pub const fn difference(self, rhs: Self) -> Self {
+                $struct_name(self.0 & !rhs.0)
+            }
+
+            #[allow(dead_code)]
+            #[inline(always)]
+            pub const fn symmetric_difference(self, rhs: Self) -> Self {
+                $struct_name(self.0 ^ rhs.0)
+            }
+
+            #[allow(dead_code)]
+            #[inline(always)]
+            pub const fn union(self, rhs: Self) -> Self {
+                $struct_name(self.0 | rhs.0)
+            }
+
+            #[allow(dead_code)]
+            #[inline(always)]
+            pub const fn invert(self) -> Self {
+                $struct_name(self.0 ^ Self::VALID__)
+            }
+        }
+
+        impl ::std::fmt::Binary for $struct_name {
+            fn fmt(&self, f: &mut ::std::fmt::Formatter<'_>) -> ::std::fmt::Result {
+                // If no width, use the highest valid bit
+                let width = f.width().unwrap_or((Self::VALID__.ilog2() + 1) as usize);
+                write!(f, "{:0>width$.precision$b}", self.0,
+                       width = width,
+                       precision = f.precision().unwrap_or(width))
+            }
+        }
+
+        impl ::std::fmt::LowerHex for $struct_name {
+            fn fmt(&self, f: &mut ::std::fmt::Formatter<'_>) -> ::std::fmt::Result {
+                <$type as ::std::fmt::LowerHex>::fmt(&self.0, f)
+            }
+        }
+
+        impl ::std::fmt::Octal for $struct_name {
+            fn fmt(&self, f: &mut ::std::fmt::Formatter<'_>) -> ::std::fmt::Result {
+                <$type as ::std::fmt::Octal>::fmt(&self.0, f)
+            }
+        }
+
+        impl ::std::fmt::UpperHex for $struct_name {
+            fn fmt(&self, f: &mut ::std::fmt::Formatter<'_>) -> ::std::fmt::Result {
+                <$type as ::std::fmt::UpperHex>::fmt(&self.0, f)
+            }
+        }
+
+        impl ::std::fmt::Debug for $struct_name {
+            fn fmt(&self, f: &mut ::std::fmt::Formatter<'_>) -> ::std::fmt::Result {
+                write!(f, "{}({})", stringify!($struct_name), self)
+            }
+        }
+
+        impl ::std::fmt::Display for $struct_name {
+            fn fmt(&self, f: &mut ::std::fmt::Formatter<'_>) -> ::std::fmt::Result {
+                use ::std::fmt::Display;
+                let mut first = true;
+                let mut left = self.0;
+                $(if Self::$const.0.is_power_of_two() && (self & Self::$const).0 != 0 {
+                    if first { first = false } else { Display::fmt(&'|', f)?; }
+                    Display::fmt(stringify!($const), f)?;
+                    left -= Self::$const.0;
+                })+
+                if first {
+                    Display::fmt(&'0', f)
+                } else if left != 0 {
+                    write!(f, "|{left:#x}")
+                } else {
+                    Ok(())
+                }
+            }
+        }
+
+        impl ::std::cmp::PartialEq<$type> for $struct_name {
+            fn eq(&self, rhs: &$type) -> bool {
+                self.0 == *rhs
+            }
+        }
+
+        impl ::std::ops::BitAnd<$struct_name> for &$struct_name {
+            type Output = $struct_name;
+            fn bitand(self, rhs: $struct_name) -> Self::Output {
+                $struct_name(self.0 & rhs.0)
+            }
+        }
+
+        impl ::std::ops::BitAndAssign<$struct_name> for $struct_name {
+            fn bitand_assign(&mut self, rhs: $struct_name) {
+                self.0 = self.0 & rhs.0
+            }
+        }
+
+        impl ::std::ops::BitXor<$struct_name> for &$struct_name {
+            type Output = $struct_name;
+            fn bitxor(self, rhs: $struct_name) -> Self::Output {
+                $struct_name(self.0 ^ rhs.0)
+            }
+        }
+
+        impl ::std::ops::BitXorAssign<$struct_name> for $struct_name {
+            fn bitxor_assign(&mut self, rhs: $struct_name) {
+                self.0 = self.0 ^ rhs.0
+            }
+        }
+
+        impl ::std::ops::BitOr<$struct_name> for &$struct_name {
+            type Output = $struct_name;
+            fn bitor(self, rhs: $struct_name) -> Self::Output {
+                $struct_name(self.0 | rhs.0)
+            }
+        }
+
+        impl ::std::ops::BitOrAssign<$struct_name> for $struct_name {
+            fn bitor_assign(&mut self, rhs: $struct_name) {
+                self.0 = self.0 | rhs.0
+            }
+        }
+
+        impl ::std::ops::Sub<$struct_name> for &$struct_name {
+            type Output = $struct_name;
+            fn sub(self, rhs: $struct_name) -> Self::Output {
+                $struct_name(self.0 & !rhs.0)
+            }
+        }
+
+        impl ::std::ops::SubAssign<$struct_name> for $struct_name {
+            fn sub_assign(&mut self, rhs: $struct_name) {
+                self.0 = self.0 - rhs.0
+            }
+        }
+
+        impl ::std::ops::Not for &$struct_name {
+            type Output = $struct_name;
+            fn not(self) -> Self::Output {
+                $struct_name(self.0 ^ $struct_name::VALID__)
+            }
+        }
+
+        impl ::std::ops::BitAnd<$struct_name> for $struct_name {
+            type Output = Self;
+            fn bitand(self, rhs: Self) -> Self::Output {
+                $struct_name(self.0 & rhs.0)
+            }
+        }
+
+        impl ::std::ops::BitXor<$struct_name> for $struct_name {
+            type Output = Self;
+            fn bitxor(self, rhs: Self) -> Self::Output {
+                $struct_name(self.0 ^ rhs.0)
+            }
+        }
+
+        impl ::std::ops::BitOr<$struct_name> for $struct_name {
+            type Output = Self;
+            fn bitor(self, rhs: Self) -> Self::Output {
+                $struct_name(self.0 | rhs.0)
+            }
+        }
+
+        impl ::std::ops::Sub<$struct_name> for $struct_name {
+            type Output = Self;
+            fn sub(self, rhs: Self) -> Self::Output {
+                $struct_name(self.0 & !rhs.0)
+            }
+        }
+
+        impl ::std::ops::Not for $struct_name {
+            type Output = Self;
+            fn not(self) -> Self::Output {
+                $struct_name(self.0 ^ Self::VALID__)
+            }
+        }
+
+        impl From<$struct_name> for $type {
+            fn from(x: $struct_name) -> $type {
+                x.0
+            }
+        }
+
+        impl From<$type> for $struct_name {
+            fn from(x: $type) -> Self {
+                $struct_name(x & Self::VALID__)
+            }
+        }
+    };
+
+    { $type:ty: $expr:expr } => {
+        ::qemu_api_macros::bits_const_internal! { $type @ ($expr) }
+    };
+
+    { $type:ty as $int_type:ty: $expr:expr } => {
+        (::qemu_api_macros::bits_const_internal! { $type @ ($expr) }.into_bits()) as $int_type
+    };
+}
+
+#[cfg(test)]
+mod test {
+    bits! {
+        pub struct InterruptMask(u32) {
+            OE = 1 << 10,
+            BE = 1 << 9,
+            PE = 1 << 8,
+            FE = 1 << 7,
+            RT = 1 << 6,
+            TX = 1 << 5,
+            RX = 1 << 4,
+            DSR = 1 << 3,
+            DCD = 1 << 2,
+            CTS = 1 << 1,
+            RI = 1 << 0,
+
+            E = bits!(Self as u32: OE | BE | PE | FE),
+            MS = bits!(Self as u32: RI | DSR | DCD | CTS),
+        }
+    }
+
+    #[test]
+    pub fn test_not() {
+        assert_eq!(
+            !InterruptMask::from(InterruptMask::RT.0),
+            InterruptMask::E | InterruptMask::MS | InterruptMask::TX | InterruptMask::RX
+        );
+    }
+
+    #[test]
+    pub fn test_and() {
+        assert_eq!(
+            InterruptMask::from(0),
+            InterruptMask::MS & InterruptMask::OE
+        )
+    }
+
+    #[test]
+    pub fn test_or() {
+        assert_eq!(
+            InterruptMask::E,
+            InterruptMask::OE | InterruptMask::BE | InterruptMask::PE | InterruptMask::FE
+        );
+    }
+
+    #[test]
+    pub fn test_xor() {
+        assert_eq!(
+            InterruptMask::E ^ InterruptMask::BE,
+            InterruptMask::OE | InterruptMask::PE | InterruptMask::FE
+        );
+    }
+}
diff --git a/rust/meson.build b/rust/meson.build
index afce62f477..b1b3315be9 100644
--- a/rust/meson.build
+++ b/rust/meson.build
@@ -17,6 +17,7 @@ proc_macro2_rs_native = dependency('proc-macro2-1-rs', native: true)
 qemuutil_rs = qemuutil.partial_dependency(link_args: true, links: true)
 
 subdir('qemu-api-macros')
+subdir('bits')
 subdir('qemu-api')
 
 subdir('hw')
diff --git a/rust/qemu-api-macros/src/bits.rs b/rust/qemu-api-macros/src/bits.rs
new file mode 100644
index 0000000000..5ba84757ee
--- /dev/null
+++ b/rust/qemu-api-macros/src/bits.rs
@@ -0,0 +1,229 @@
+// SPDX-License-Identifier: MIT or Apache-2.0 or GPL-2.0-or-later
+
+// shadowing is useful together with "if let"
+#![allow(clippy::shadow_unrelated)]
+
+use proc_macro2::{
+    Delimiter, Group, Ident, Punct, Spacing, Span, TokenStream, TokenTree, TokenTree as TT,
+};
+
+use crate::utils::MacroError;
+
+pub struct BitsConstInternal {
+    typ: TokenTree,
+}
+
+fn paren(ts: TokenStream) -> TokenTree {
+    TT::Group(Group::new(Delimiter::Parenthesis, ts))
+}
+
+fn ident(s: &'static str) -> TokenTree {
+    TT::Ident(Ident::new(s, Span::call_site()))
+}
+
+fn punct(ch: char) -> TokenTree {
+    TT::Punct(Punct::new(ch, Spacing::Alone))
+}
+
+/// Implements a recursive-descent parser that translates Boolean expressions on
+/// bitmasks to invocations of `const` functions defined by the `bits!` macro.
+impl BitsConstInternal {
+    // primary ::= '(' or ')'
+    //           | ident
+    //           | '!' ident
+    fn parse_primary(
+        &self,
+        tok: TokenTree,
+        it: &mut dyn Iterator<Item = TokenTree>,
+        out: &mut TokenStream,
+    ) -> Result<Option<TokenTree>, MacroError> {
+        let next = match tok {
+            TT::Group(ref g) => {
+                if g.delimiter() != Delimiter::Parenthesis && g.delimiter() != Delimiter::None {
+                    return Err(MacroError::Message("expected parenthesis".into(), g.span()));
+                }
+                let mut stream = g.stream().into_iter();
+                let Some(first_tok) = stream.next() else {
+                    return Err(MacroError::Message(
+                        "expected operand, found ')'".into(),
+                        g.span(),
+                    ));
+                };
+                let mut output = TokenStream::new();
+                // start from the lowest precedence
+                let next = self.parse_or(first_tok, &mut stream, &mut output)?;
+                if let Some(tok) = next {
+                    return Err(MacroError::Message(
+                        format!("unexpected token {tok}"),
+                        tok.span(),
+                    ));
+                }
+                out.extend(Some(paren(output)));
+                it.next()
+            }
+            TT::Ident(_) => {
+                let mut output = TokenStream::new();
+                output.extend([
+                    self.typ.clone(),
+                    TT::Punct(Punct::new(':', Spacing::Joint)),
+                    TT::Punct(Punct::new(':', Spacing::Joint)),
+                    tok,
+                ]);
+                out.extend(Some(paren(output)));
+                it.next()
+            }
+            TT::Punct(ref p) => {
+                if p.as_char() != '!' {
+                    return Err(MacroError::Message("expected operand".into(), p.span()));
+                }
+                let Some(rhs_tok) = it.next() else {
+                    return Err(MacroError::Message(
+                        "expected operand at end of input".into(),
+                        p.span(),
+                    ));
+                };
+                let next = self.parse_primary(rhs_tok, it, out)?;
+                out.extend([punct('.'), ident("invert"), paren(TokenStream::new())]);
+                next
+            }
+            _ => {
+                return Err(MacroError::Message("unexpected literal".into(), tok.span()));
+            }
+        };
+        Ok(next)
+    }
+
+    fn parse_binop<
+        F: Fn(
+            &Self,
+            TokenTree,
+            &mut dyn Iterator<Item = TokenTree>,
+            &mut TokenStream,
+        ) -> Result<Option<TokenTree>, MacroError>,
+    >(
+        &self,
+        tok: TokenTree,
+        it: &mut dyn Iterator<Item = TokenTree>,
+        out: &mut TokenStream,
+        ch: char,
+        f: F,
+        method: &'static str,
+    ) -> Result<Option<TokenTree>, MacroError> {
+        let mut next = f(self, tok, it, out)?;
+        while next.is_some() {
+            let op = next.as_ref().unwrap();
+            let TT::Punct(ref p) = op else { break };
+            if p.as_char() != ch {
+                break;
+            }
+
+            let Some(rhs_tok) = it.next() else {
+                return Err(MacroError::Message(
+                    "expected operand at end of input".into(),
+                    p.span(),
+                ));
+            };
+            let mut rhs = TokenStream::new();
+            next = f(self, rhs_tok, it, &mut rhs)?;
+            out.extend([punct('.'), ident(method), paren(rhs)]);
+        }
+        Ok(next)
+    }
+
+    // sub ::= primary ('-' primary)*
+    pub fn parse_sub(
+        &self,
+        tok: TokenTree,
+        it: &mut dyn Iterator<Item = TokenTree>,
+        out: &mut TokenStream,
+    ) -> Result<Option<TokenTree>, MacroError> {
+        self.parse_binop(tok, it, out, '-', Self::parse_primary, "difference")
+    }
+
+    // and ::= sub ('&' sub)*
+    fn parse_and(
+        &self,
+        tok: TokenTree,
+        it: &mut dyn Iterator<Item = TokenTree>,
+        out: &mut TokenStream,
+    ) -> Result<Option<TokenTree>, MacroError> {
+        self.parse_binop(tok, it, out, '&', Self::parse_sub, "intersection")
+    }
+
+    // xor ::= and ('&' and)*
+    fn parse_xor(
+        &self,
+        tok: TokenTree,
+        it: &mut dyn Iterator<Item = TokenTree>,
+        out: &mut TokenStream,
+    ) -> Result<Option<TokenTree>, MacroError> {
+        self.parse_binop(tok, it, out, '^', Self::parse_and, "symmetric_difference")
+    }
+
+    // or ::= xor ('|' xor)*
+    pub fn parse_or(
+        &self,
+        tok: TokenTree,
+        it: &mut dyn Iterator<Item = TokenTree>,
+        out: &mut TokenStream,
+    ) -> Result<Option<TokenTree>, MacroError> {
+        self.parse_binop(tok, it, out, '|', Self::parse_xor, "union")
+    }
+
+    pub fn parse(
+        it: &mut dyn Iterator<Item = TokenTree>,
+    ) -> Result<proc_macro2::TokenStream, MacroError> {
+        let mut pos = Span::call_site();
+        let mut typ = proc_macro2::TokenStream::new();
+
+        // Gobble everything up to an `@` sign, which is followed by a
+        // parenthesized expression; that is, all token trees except the
+        // last two form the type.
+        let next = loop {
+            let tok = it.next();
+            if let Some(ref t) = tok {
+                pos = t.span();
+            }
+            match tok {
+                None => break None,
+                Some(TT::Punct(ref p)) if p.as_char() == '@' => {
+                    let tok = it.next();
+                    if let Some(ref t) = tok {
+                        pos = t.span();
+                    }
+                    break tok;
+                }
+                Some(x) => typ.extend(Some(x)),
+            }
+        };
+
+        let Some(tok) = next else {
+            return Err(MacroError::Message(
+                "expected expression, do not call this macro directly".into(),
+                pos,
+            ));
+        };
+        let TT::Group(ref _group) = tok else {
+            return Err(MacroError::Message(
+                "expected parenthesis, do not call this macro directly".into(),
+                tok.span(),
+            ));
+        };
+        let mut out = TokenStream::new();
+        let state = Self {
+            typ: TT::Group(Group::new(Delimiter::None, typ)),
+        };
+
+        let next = state.parse_primary(tok, it, &mut out)?;
+
+        // A parenthesized expression is a single production of the grammar,
+        // so the input must have reached the last token.
+        if let Some(tok) = next {
+            return Err(MacroError::Message(
+                format!("unexpected token {tok}"),
+                tok.span(),
+            ));
+        }
+        Ok(out)
+    }
+}
diff --git a/rust/qemu-api-macros/src/lib.rs b/rust/qemu-api-macros/src/lib.rs
index f97449bb30..ceb79f09f9 100644
--- a/rust/qemu-api-macros/src/lib.rs
+++ b/rust/qemu-api-macros/src/lib.rs
@@ -12,6 +12,9 @@ use syn::{
 mod utils;
 use utils::MacroError;
 
+mod bits;
+use bits::BitsConstInternal;
+
 fn get_fields<'a>(
     input: &'a DeriveInput,
     msg: &str,
@@ -219,3 +222,12 @@ pub fn derive_tryinto(input: TokenStream) -> TokenStream {
 
     TokenStream::from(expanded)
 }
+
+#[proc_macro]
+pub fn bits_const_internal(ts: TokenStream) -> TokenStream {
+    let ts = proc_macro2::TokenStream::from(ts);
+    let mut it = ts.into_iter();
+
+    let expanded = BitsConstInternal::parse(&mut it).unwrap_or_else(Into::into);
+    TokenStream::from(expanded)
+}

From 9c8ff2a1ed51b52ac64b80d35bdbd239b7b5d8e5 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Tue, 3 Jun 2025 17:45:05 +0200
Subject: [PATCH 1383/2760] rust: pl011: use the bits macro

This avoids the repeated ".0" when using the Interrupt struct.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/Cargo.lock                     |  1 +
 rust/hw/char/pl011/Cargo.toml       |  1 +
 rust/hw/char/pl011/meson.build      |  1 +
 rust/hw/char/pl011/src/device.rs    | 51 ++++++++++++++---------------
 rust/hw/char/pl011/src/registers.rs | 39 ++++++++++++----------
 5 files changed, 49 insertions(+), 44 deletions(-)

diff --git a/rust/Cargo.lock b/rust/Cargo.lock
index 0dfe0fb6ce..bccfe855a7 100644
--- a/rust/Cargo.lock
+++ b/rust/Cargo.lock
@@ -73,6 +73,7 @@ version = "0.1.0"
 dependencies = [
  "bilge",
  "bilge-impl",
+ "bits",
  "qemu_api",
  "qemu_api_macros",
 ]
diff --git a/rust/hw/char/pl011/Cargo.toml b/rust/hw/char/pl011/Cargo.toml
index a1f431ab4a..003ef9613d 100644
--- a/rust/hw/char/pl011/Cargo.toml
+++ b/rust/hw/char/pl011/Cargo.toml
@@ -18,6 +18,7 @@ crate-type = ["staticlib"]
 [dependencies]
 bilge = { version = "0.2.0" }
 bilge-impl = { version = "0.2.0" }
+bits = { path = "../../../bits" }
 qemu_api = { path = "../../../qemu-api" }
 qemu_api_macros = { path = "../../../qemu-api-macros" }
 
diff --git a/rust/hw/char/pl011/meson.build b/rust/hw/char/pl011/meson.build
index 494b6c123c..2a1be329ab 100644
--- a/rust/hw/char/pl011/meson.build
+++ b/rust/hw/char/pl011/meson.build
@@ -6,6 +6,7 @@ _libpl011_rs = static_library(
   dependencies: [
     bilge_rs,
     bilge_impl_rs,
+    bits_rs,
     qemu_api,
     qemu_api_macros,
   ],
diff --git a/rust/hw/char/pl011/src/device.rs b/rust/hw/char/pl011/src/device.rs
index bd5cee0464..0501fa5be9 100644
--- a/rust/hw/char/pl011/src/device.rs
+++ b/rust/hw/char/pl011/src/device.rs
@@ -85,8 +85,8 @@ pub struct PL011Registers {
     #[doc(alias = "cr")]
     pub control: registers::Control,
     pub dmacr: u32,
-    pub int_enabled: u32,
-    pub int_level: u32,
+    pub int_enabled: Interrupt,
+    pub int_level: Interrupt,
     pub read_fifo: Fifo,
     pub ilpr: u32,
     pub ibrd: u32,
@@ -199,9 +199,9 @@ impl PL011Registers {
             LCR_H => u32::from(self.line_control),
             CR => u32::from(self.control),
             FLS => self.ifl,
-            IMSC => self.int_enabled,
-            RIS => self.int_level,
-            MIS => self.int_level & self.int_enabled,
+            IMSC => u32::from(self.int_enabled),
+            RIS => u32::from(self.int_level),
+            MIS => u32::from(self.int_level & self.int_enabled),
             ICR => {
                 // "The UARTICR Register is the interrupt clear register and is write-only"
                 // Source: ARM DDI 0183G 3.3.13 Interrupt Clear Register, UARTICR
@@ -263,13 +263,13 @@ impl PL011Registers {
                 self.set_read_trigger();
             }
             IMSC => {
-                self.int_enabled = value;
+                self.int_enabled = Interrupt::from(value);
                 return true;
             }
             RIS => {}
             MIS => {}
             ICR => {
-                self.int_level &= !value;
+                self.int_level &= !Interrupt::from(value);
                 return true;
             }
             DMACR => {
@@ -295,7 +295,7 @@ impl PL011Registers {
             self.flags.set_receive_fifo_empty(true);
         }
         if self.read_count + 1 == self.read_trigger {
-            self.int_level &= !Interrupt::RX.0;
+            self.int_level &= !Interrupt::RX;
         }
         self.receive_status_error_clear.set_from_data(c);
         *update = true;
@@ -305,7 +305,7 @@ impl PL011Registers {
     fn write_data_register(&mut self, value: u32) -> bool {
         // interrupts always checked
         let _ = self.loopback_tx(value.into());
-        self.int_level |= Interrupt::TX.0;
+        self.int_level |= Interrupt::TX;
         true
     }
 
@@ -361,19 +361,19 @@ impl PL011Registers {
         // Change interrupts based on updated FR
         let mut il = self.int_level;
 
-        il &= !Interrupt::MS.0;
+        il &= !Interrupt::MS;
 
         if self.flags.data_set_ready() {
-            il |= Interrupt::DSR.0;
+            il |= Interrupt::DSR;
         }
         if self.flags.data_carrier_detect() {
-            il |= Interrupt::DCD.0;
+            il |= Interrupt::DCD;
         }
         if self.flags.clear_to_send() {
-            il |= Interrupt::CTS.0;
+            il |= Interrupt::CTS;
         }
         if self.flags.ring_indicator() {
-            il |= Interrupt::RI.0;
+            il |= Interrupt::RI;
         }
         self.int_level = il;
         true
@@ -391,8 +391,8 @@ impl PL011Registers {
         self.line_control.reset();
         self.receive_status_error_clear.reset();
         self.dmacr = 0;
-        self.int_enabled = 0;
-        self.int_level = 0;
+        self.int_enabled = 0.into();
+        self.int_level = 0.into();
         self.ilpr = 0;
         self.ibrd = 0;
         self.fbrd = 0;
@@ -451,7 +451,7 @@ impl PL011Registers {
         }
 
         if self.read_count == self.read_trigger {
-            self.int_level |= Interrupt::RX.0;
+            self.int_level |= Interrupt::RX;
             return true;
         }
         false
@@ -632,7 +632,7 @@ impl PL011State {
         let regs = self.regs.borrow();
         let flags = regs.int_level & regs.int_enabled;
         for (irq, i) in self.interrupts.iter().zip(IRQMASK) {
-            irq.set(flags & i != 0);
+            irq.set(flags.any_set(i));
         }
     }
 
@@ -642,14 +642,13 @@ impl PL011State {
 }
 
 /// Which bits in the interrupt status matter for each outbound IRQ line ?
-const IRQMASK: [u32; 6] = [
-    /* combined IRQ */
-    Interrupt::E.0 | Interrupt::MS.0 | Interrupt::RT.0 | Interrupt::TX.0 | Interrupt::RX.0,
-    Interrupt::RX.0,
-    Interrupt::TX.0,
-    Interrupt::RT.0,
-    Interrupt::MS.0,
-    Interrupt::E.0,
+const IRQMASK: [Interrupt; 6] = [
+    Interrupt::all(),
+    Interrupt::RX,
+    Interrupt::TX,
+    Interrupt::RT,
+    Interrupt::MS,
+    Interrupt::E,
 ];
 
 /// # Safety
diff --git a/rust/hw/char/pl011/src/registers.rs b/rust/hw/char/pl011/src/registers.rs
index 690feb6378..7ececd39f8 100644
--- a/rust/hw/char/pl011/src/registers.rs
+++ b/rust/hw/char/pl011/src/registers.rs
@@ -9,7 +9,8 @@
 // https://developer.arm.com/documentation/ddi0183/latest/
 
 use bilge::prelude::*;
-use qemu_api::impl_vmstate_bitsized;
+use bits::bits;
+use qemu_api::{impl_vmstate_bitsized, impl_vmstate_forward};
 
 /// Offset of each register from the base memory address of the device.
 #[doc(alias = "offset")]
@@ -326,22 +327,24 @@ impl Default for Control {
     }
 }
 
-/// Interrupt status bits in UARTRIS, UARTMIS, UARTIMSC
-pub struct Interrupt(pub u32);
+bits! {
+    /// Interrupt status bits in UARTRIS, UARTMIS, UARTIMSC
+    #[derive(Default)]
+    pub struct Interrupt(u32) {
+        OE = 1 << 10,
+        BE = 1 << 9,
+        PE = 1 << 8,
+        FE = 1 << 7,
+        RT = 1 << 6,
+        TX = 1 << 5,
+        RX = 1 << 4,
+        DSR = 1 << 3,
+        DCD = 1 << 2,
+        CTS = 1 << 1,
+        RI = 1 << 0,
 
-impl Interrupt {
-    pub const OE: Self = Self(1 << 10);
-    pub const BE: Self = Self(1 << 9);
-    pub const PE: Self = Self(1 << 8);
-    pub const FE: Self = Self(1 << 7);
-    pub const RT: Self = Self(1 << 6);
-    pub const TX: Self = Self(1 << 5);
-    pub const RX: Self = Self(1 << 4);
-    pub const DSR: Self = Self(1 << 3);
-    pub const DCD: Self = Self(1 << 2);
-    pub const CTS: Self = Self(1 << 1);
-    pub const RI: Self = Self(1 << 0);
-
-    pub const E: Self = Self(Self::OE.0 | Self::BE.0 | Self::PE.0 | Self::FE.0);
-    pub const MS: Self = Self(Self::RI.0 | Self::DSR.0 | Self::DCD.0 | Self::CTS.0);
+        E = bits!(Self as u32: OE | BE | PE | FE),
+        MS = bits!(Self as u32: RI | DSR | DCD | CTS),
+    }
 }
+impl_vmstate_forward!(Interrupt);

From 214518614c1ce7eb7a002452cd43a7597f90d543 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Tue, 13 May 2025 13:04:41 +0200
Subject: [PATCH 1384/2760] rust: qemu-api-macros: add from_bits and into_bits
 to #[derive(TryInto)]

These const functions make it possible to use enums easily together
with the bitfield-struct crate.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/qemu-api-macros/src/lib.rs | 48 ++++++++++++++++++++++++++-------
 1 file changed, 38 insertions(+), 10 deletions(-)

diff --git a/rust/qemu-api-macros/src/lib.rs b/rust/qemu-api-macros/src/lib.rs
index ceb79f09f9..103470785e 100644
--- a/rust/qemu-api-macros/src/lib.rs
+++ b/rust/qemu-api-macros/src/lib.rs
@@ -193,23 +193,51 @@ fn get_variants(input: &DeriveInput) -> Result<&Punctuated<Variant, Comma>, Macr
 }
 
 #[rustfmt::skip::macros(quote)]
-fn derive_tryinto_or_error(input: DeriveInput) -> Result<proc_macro2::TokenStream, MacroError> {
-    let repr = get_repr_uN(&input, "#[derive(TryInto)]")?;
-
-    let name = &input.ident;
-    let variants = get_variants(&input)?;
+fn derive_tryinto_body(
+    name: &Ident,
+    variants: &Punctuated<Variant, Comma>,
+    repr: &Path,
+) -> Result<proc_macro2::TokenStream, MacroError> {
     let discriminants: Vec<&Ident> = variants.iter().map(|f| &f.ident).collect();
 
     Ok(quote! {
+        #(const #discriminants: #repr = #name::#discriminants as #repr;)*;
+        match value {
+            #(#discriminants => Ok(#name::#discriminants),)*
+            _ => Err(value),
+        }
+    })
+}
+
+#[rustfmt::skip::macros(quote)]
+fn derive_tryinto_or_error(input: DeriveInput) -> Result<proc_macro2::TokenStream, MacroError> {
+    let repr = get_repr_uN(&input, "#[derive(TryInto)]")?;
+    let name = &input.ident;
+    let body = derive_tryinto_body(name, get_variants(&input)?, &repr)?;
+    let errmsg = format!("invalid value for {name}");
+
+    Ok(quote! {
+        impl #name {
+            #[allow(dead_code)]
+            pub const fn into_bits(self) -> #repr {
+                self as #repr
+            }
+
+            #[allow(dead_code)]
+            pub const fn from_bits(value: #repr) -> Self {
+                match ({
+                    #body
+                }) {
+                    Ok(x) => x,
+                    Err(_) => panic!(#errmsg)
+                }
+            }
+        }
         impl core::convert::TryFrom<#repr> for #name {
             type Error = #repr;
 
             fn try_from(value: #repr) -> Result<Self, Self::Error> {
-                #(const #discriminants: #repr = #name::#discriminants as #repr;)*;
-                match value {
-                    #(#discriminants => Ok(Self::#discriminants),)*
-                    _ => Err(value),
-                }
+                #body
             }
         }
     })

From f1bf3be14bd5d6e6a2cfbbe64cdd4d58a8595d68 Mon Sep 17 00:00:00 2001
From: Fiona Ebner <f.ebner@proxmox.com>
Date: Fri, 30 May 2025 17:10:38 +0200
Subject: [PATCH 1385/2760] block: remove outdated comments about AioContext
 locking

AioContext locking was removed in commit b49f4755c7 ("block: remove
AioContext locking").

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20250530151125.955508-2-f.ebner@proxmox.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block.c | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/block.c b/block.c
index f222e1a50a..a5399888ba 100644
--- a/block.c
+++ b/block.c
@@ -4359,8 +4359,6 @@ bdrv_recurse_has_child(BlockDriverState *bs, BlockDriverState *child)
  * bs_queue, or the existing bs_queue being used.
  *
  * bs is drained here and undrained by bdrv_reopen_queue_free().
- *
- * To be called with bs->aio_context locked.
  */
 static BlockReopenQueue * GRAPH_RDLOCK
 bdrv_reopen_queue_child(BlockReopenQueue *bs_queue, BlockDriverState *bs,
@@ -4519,7 +4517,6 @@ bdrv_reopen_queue_child(BlockReopenQueue *bs_queue, BlockDriverState *bs,
     return bs_queue;
 }
 
-/* To be called with bs->aio_context locked */
 BlockReopenQueue *bdrv_reopen_queue(BlockReopenQueue *bs_queue,
                                     BlockDriverState *bs,
                                     QDict *options, bool keep_old_opts)
@@ -7278,10 +7275,6 @@ bool bdrv_op_blocker_is_empty(BlockDriverState *bs)
     return true;
 }
 
-/*
- * Must not be called while holding the lock of an AioContext other than the
- * current one.
- */
 void bdrv_img_create(const char *filename, const char *fmt,
                      const char *base_filename, const char *base_fmt,
                      char *options, uint64_t img_size, int flags, bool quiet,

From e1d681b3e1d8256047dbfc6d2c796028b9694eaf Mon Sep 17 00:00:00 2001
From: Fiona Ebner <f.ebner@proxmox.com>
Date: Fri, 30 May 2025 17:10:39 +0200
Subject: [PATCH 1386/2760] block: move drain outside of read-locked
 bdrv_reopen_queue_child()

This is in preparation to mark bdrv_drained_begin() as GRAPH_UNLOCKED.

More granular draining is not trivially possible, because
bdrv_reopen_queue_child() can recursively call itself.

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20250530151125.955508-3-f.ebner@proxmox.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block.c | 19 +++++++++++--------
 1 file changed, 11 insertions(+), 8 deletions(-)

diff --git a/block.c b/block.c
index a5399888ba..3065d5c91e 100644
--- a/block.c
+++ b/block.c
@@ -4358,7 +4358,7 @@ bdrv_recurse_has_child(BlockDriverState *bs, BlockDriverState *child)
  * returns a pointer to bs_queue, which is either the newly allocated
  * bs_queue, or the existing bs_queue being used.
  *
- * bs is drained here and undrained by bdrv_reopen_queue_free().
+ * bs must be drained.
  */
 static BlockReopenQueue * GRAPH_RDLOCK
 bdrv_reopen_queue_child(BlockReopenQueue *bs_queue, BlockDriverState *bs,
@@ -4377,12 +4377,7 @@ bdrv_reopen_queue_child(BlockReopenQueue *bs_queue, BlockDriverState *bs,
 
     GLOBAL_STATE_CODE();
 
-    /*
-     * Strictly speaking, draining is illegal under GRAPH_RDLOCK. We know that
-     * we've been called with bdrv_graph_rdlock_main_loop(), though, so it's ok
-     * in practice.
-     */
-    bdrv_drained_begin(bs);
+    assert(bs->quiesce_counter > 0);
 
     if (bs_queue == NULL) {
         bs_queue = g_new0(BlockReopenQueue, 1);
@@ -4522,6 +4517,12 @@ BlockReopenQueue *bdrv_reopen_queue(BlockReopenQueue *bs_queue,
                                     QDict *options, bool keep_old_opts)
 {
     GLOBAL_STATE_CODE();
+
+    if (bs_queue == NULL) {
+        /* Paired with bdrv_drain_all_end() in bdrv_reopen_queue_free(). */
+        bdrv_drain_all_begin();
+    }
+
     GRAPH_RDLOCK_GUARD_MAINLOOP();
 
     return bdrv_reopen_queue_child(bs_queue, bs, options, NULL, 0, false,
@@ -4534,12 +4535,14 @@ void bdrv_reopen_queue_free(BlockReopenQueue *bs_queue)
     if (bs_queue) {
         BlockReopenQueueEntry *bs_entry, *next;
         QTAILQ_FOREACH_SAFE(bs_entry, bs_queue, entry, next) {
-            bdrv_drained_end(bs_entry->state.bs);
             qobject_unref(bs_entry->state.explicit_options);
             qobject_unref(bs_entry->state.options);
             g_free(bs_entry);
         }
         g_free(bs_queue);
+
+        /* Paired with bdrv_drain_all_begin() in bdrv_reopen_queue(). */
+        bdrv_drain_all_end();
     }
 }
 

From d4c5f8c980f1073356d2f18d51dc68d42bebb59d Mon Sep 17 00:00:00 2001
From: Fiona Ebner <f.ebner@proxmox.com>
Date: Fri, 30 May 2025 17:10:40 +0200
Subject: [PATCH 1387/2760] block/snapshot: move drain outside of read-locked
 bdrv_snapshot_delete()

This is in preparation to mark bdrv_drained_begin() as GRAPH_UNLOCKED.

More granular draining is not trivially possible, because
bdrv_snapshot_delete() can recursively call itself.

The return value of bdrv_all_delete_snapshot() changes from -1 to
-errno propagated from failed sub-calls. This is fine for the existing
callers of bdrv_all_delete_snapshot().

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20250530151125.955508-4-f.ebner@proxmox.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/snapshot.c | 26 +++++++++++++++-----------
 blockdev.c       | 25 +++++++++++++++++--------
 qemu-img.c       |  2 ++
 3 files changed, 34 insertions(+), 19 deletions(-)

diff --git a/block/snapshot.c b/block/snapshot.c
index 22567f1fb9..9f300a78bd 100644
--- a/block/snapshot.c
+++ b/block/snapshot.c
@@ -327,7 +327,7 @@ int bdrv_snapshot_goto(BlockDriverState *bs,
 
 /**
  * Delete an internal snapshot by @snapshot_id and @name.
- * @bs: block device used in the operation
+ * @bs: block device used in the operation, must be drained
  * @snapshot_id: unique snapshot ID, or NULL
  * @name: snapshot name, or NULL
  * @errp: location to store error
@@ -358,6 +358,8 @@ int bdrv_snapshot_delete(BlockDriverState *bs,
 
     GLOBAL_STATE_CODE();
 
+    assert(bs->quiesce_counter > 0);
+
     if (!drv) {
         error_setg(errp, "Device '%s' has no medium",
                    bdrv_get_device_name(bs));
@@ -368,9 +370,6 @@ int bdrv_snapshot_delete(BlockDriverState *bs,
         return -EINVAL;
     }
 
-    /* drain all pending i/o before deleting snapshot */
-    bdrv_drained_begin(bs);
-
     if (drv->bdrv_snapshot_delete) {
         ret = drv->bdrv_snapshot_delete(bs, snapshot_id, name, errp);
     } else if (fallback_bs) {
@@ -382,7 +381,6 @@ int bdrv_snapshot_delete(BlockDriverState *bs,
         ret = -ENOTSUP;
     }
 
-    bdrv_drained_end(bs);
     return ret;
 }
 
@@ -571,19 +569,22 @@ int bdrv_all_delete_snapshot(const char *name,
     ERRP_GUARD();
     g_autoptr(GList) bdrvs = NULL;
     GList *iterbdrvs;
+    int ret = 0;
 
     GLOBAL_STATE_CODE();
-    GRAPH_RDLOCK_GUARD_MAINLOOP();
 
-    if (bdrv_all_get_snapshot_devices(has_devices, devices, &bdrvs, errp) < 0) {
-        return -1;
+    bdrv_drain_all_begin();
+    bdrv_graph_rdlock_main_loop();
+
+    ret = bdrv_all_get_snapshot_devices(has_devices, devices, &bdrvs, errp);
+    if (ret < 0) {
+        goto out;
     }
 
     iterbdrvs = bdrvs;
     while (iterbdrvs) {
         BlockDriverState *bs = iterbdrvs->data;
         QEMUSnapshotInfo sn1, *snapshot = &sn1;
-        int ret = 0;
 
         if ((devices || bdrv_all_snapshots_includes_bs(bs)) &&
             bdrv_snapshot_find(bs, snapshot, name) >= 0)
@@ -594,13 +595,16 @@ int bdrv_all_delete_snapshot(const char *name,
         if (ret < 0) {
             error_prepend(errp, "Could not delete snapshot '%s' on '%s': ",
                           name, bdrv_get_device_or_node_name(bs));
-            return -1;
+            goto out;
         }
 
         iterbdrvs = iterbdrvs->next;
     }
 
-    return 0;
+out:
+    bdrv_graph_rdunlock_main_loop();
+    bdrv_drain_all_end();
+    return ret;
 }
 
 
diff --git a/blockdev.c b/blockdev.c
index 21443b4514..3982f9776b 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -1132,39 +1132,41 @@ SnapshotInfo *qmp_blockdev_snapshot_delete_internal_sync(const char *device,
     int ret;
 
     GLOBAL_STATE_CODE();
-    GRAPH_RDLOCK_GUARD_MAINLOOP();
+
+    bdrv_drain_all_begin();
+    bdrv_graph_rdlock_main_loop();
 
     bs = qmp_get_root_bs(device, errp);
     if (!bs) {
-        return NULL;
+        goto error;
     }
 
     if (!id && !name) {
         error_setg(errp, "Name or id must be provided");
-        return NULL;
+        goto error;
     }
 
     if (bdrv_op_is_blocked(bs, BLOCK_OP_TYPE_INTERNAL_SNAPSHOT_DELETE, errp)) {
-        return NULL;
+        goto error;
     }
 
     ret = bdrv_snapshot_find_by_id_and_name(bs, id, name, &sn, &local_err);
     if (local_err) {
         error_propagate(errp, local_err);
-        return NULL;
+        goto error;
     }
     if (!ret) {
         error_setg(errp,
                    "Snapshot with id '%s' and name '%s' does not exist on "
                    "device '%s'",
                    STR_OR_NULL(id), STR_OR_NULL(name), device);
-        return NULL;
+        goto error;
     }
 
     bdrv_snapshot_delete(bs, id, name, &local_err);
     if (local_err) {
         error_propagate(errp, local_err);
-        return NULL;
+        goto error;
     }
 
     info = g_new0(SnapshotInfo, 1);
@@ -1180,6 +1182,9 @@ SnapshotInfo *qmp_blockdev_snapshot_delete_internal_sync(const char *device,
         info->has_icount = true;
     }
 
+error:
+    bdrv_graph_rdunlock_main_loop();
+    bdrv_drain_all_end();
     return info;
 }
 
@@ -1295,12 +1300,14 @@ static void internal_snapshot_abort(void *opaque)
     Error *local_error = NULL;
 
     GLOBAL_STATE_CODE();
-    GRAPH_RDLOCK_GUARD_MAINLOOP();
 
     if (!state->created) {
         return;
     }
 
+    bdrv_drain_all_begin();
+    bdrv_graph_rdlock_main_loop();
+
     if (bdrv_snapshot_delete(bs, sn->id_str, sn->name, &local_error) < 0) {
         error_reportf_err(local_error,
                           "Failed to delete snapshot with id '%s' and "
@@ -1308,6 +1315,8 @@ static void internal_snapshot_abort(void *opaque)
                           sn->id_str, sn->name,
                           bdrv_get_device_name(bs));
     }
+    bdrv_graph_rdunlock_main_loop();
+    bdrv_drain_all_end();
 }
 
 static void internal_snapshot_clean(void *opaque)
diff --git a/qemu-img.c b/qemu-img.c
index 139eeb5039..e75707180d 100644
--- a/qemu-img.c
+++ b/qemu-img.c
@@ -3505,6 +3505,7 @@ static int img_snapshot(int argc, char **argv)
         break;
 
     case SNAPSHOT_DELETE:
+        bdrv_drain_all_begin();
         bdrv_graph_rdlock_main_loop();
         ret = bdrv_snapshot_find(bs, &sn, snapshot_name);
         if (ret < 0) {
@@ -3520,6 +3521,7 @@ static int img_snapshot(int argc, char **argv)
             }
         }
         bdrv_graph_rdunlock_main_loop();
+        bdrv_drain_all_end();
         break;
     }
 

From 841998e08650f5b4476fa2d1eb84a592ab405f51 Mon Sep 17 00:00:00 2001
From: Fiona Ebner <f.ebner@proxmox.com>
Date: Fri, 30 May 2025 17:10:41 +0200
Subject: [PATCH 1388/2760] block: move drain outside of read-locked
 bdrv_inactivate_recurse()

This is in preparation to mark bdrv_drained_begin() as GRAPH_UNLOCKED.

More granular draining is not trivially possible, because
bdrv_inactivate_recurse() can recursively call itself.

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20250530151125.955508-5-f.ebner@proxmox.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block.c | 25 ++++++++++++++++++-------
 1 file changed, 18 insertions(+), 7 deletions(-)

diff --git a/block.c b/block.c
index 3065d5c91e..fa55dfba68 100644
--- a/block.c
+++ b/block.c
@@ -6989,6 +6989,8 @@ bdrv_inactivate_recurse(BlockDriverState *bs, bool top_level)
 
     GLOBAL_STATE_CODE();
 
+    assert(bs->quiesce_counter > 0);
+
     if (!bs->drv) {
         return -ENOMEDIUM;
     }
@@ -7032,9 +7034,7 @@ bdrv_inactivate_recurse(BlockDriverState *bs, bool top_level)
         return -EPERM;
     }
 
-    bdrv_drained_begin(bs);
     bs->open_flags |= BDRV_O_INACTIVE;
-    bdrv_drained_end(bs);
 
     /*
      * Update permissions, they may differ for inactive nodes.
@@ -7059,20 +7059,26 @@ int bdrv_inactivate(BlockDriverState *bs, Error **errp)
     int ret;
 
     GLOBAL_STATE_CODE();
-    GRAPH_RDLOCK_GUARD_MAINLOOP();
+
+    bdrv_drain_all_begin();
+    bdrv_graph_rdlock_main_loop();
 
     if (bdrv_has_bds_parent(bs, true)) {
         error_setg(errp, "Node has active parent node");
-        return -EPERM;
+        ret = -EPERM;
+        goto out;
     }
 
     ret = bdrv_inactivate_recurse(bs, true);
     if (ret < 0) {
         error_setg_errno(errp, -ret, "Failed to inactivate node");
-        return ret;
+        goto out;
     }
 
-    return 0;
+out:
+    bdrv_graph_rdunlock_main_loop();
+    bdrv_drain_all_end();
+    return ret;
 }
 
 int bdrv_inactivate_all(void)
@@ -7082,7 +7088,9 @@ int bdrv_inactivate_all(void)
     int ret = 0;
 
     GLOBAL_STATE_CODE();
-    GRAPH_RDLOCK_GUARD_MAINLOOP();
+
+    bdrv_drain_all_begin();
+    bdrv_graph_rdlock_main_loop();
 
     for (bs = bdrv_first(&it); bs; bs = bdrv_next(&it)) {
         /* Nodes with BDS parents are covered by recursion from the last
@@ -7098,6 +7106,9 @@ int bdrv_inactivate_all(void)
         }
     }
 
+    bdrv_graph_rdunlock_main_loop();
+    bdrv_drain_all_end();
+
     return ret;
 }
 

From 3758733959af93b5eb3283659d868ad5b24152b4 Mon Sep 17 00:00:00 2001
From: Fiona Ebner <f.ebner@proxmox.com>
Date: Fri, 30 May 2025 17:10:42 +0200
Subject: [PATCH 1389/2760] block: mark bdrv_parent_change_aio_context()
 GRAPH_RDLOCK

This is a small step in preparation to mark bdrv_drained_begin() as
GRAPH_UNLOCKED. More concretely, it allows marking the
change_aio_ctx() callback GRAPH_RDLOCK_PTR, which is the next step.

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20250530151125.955508-6-f.ebner@proxmox.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/block.c b/block.c
index fa55dfba68..7207978e53 100644
--- a/block.c
+++ b/block.c
@@ -7575,10 +7575,10 @@ typedef struct BdrvStateSetAioContext {
     BlockDriverState *bs;
 } BdrvStateSetAioContext;
 
-static bool bdrv_parent_change_aio_context(BdrvChild *c, AioContext *ctx,
-                                           GHashTable *visited,
-                                           Transaction *tran,
-                                           Error **errp)
+static bool GRAPH_RDLOCK
+bdrv_parent_change_aio_context(BdrvChild *c, AioContext *ctx,
+                               GHashTable *visited, Transaction *tran,
+                               Error **errp)
 {
     GLOBAL_STATE_CODE();
     if (g_hash_table_contains(visited, c)) {

From 844d550d09ac29ff2b1b49069587ae6a989df31d Mon Sep 17 00:00:00 2001
From: Fiona Ebner <f.ebner@proxmox.com>
Date: Fri, 30 May 2025 17:10:43 +0200
Subject: [PATCH 1390/2760] block: mark change_aio_ctx() callback and instances
 as GRAPH_RDLOCK(_PTR)

This is a small step in preparation to mark bdrv_drained_begin() as
GRAPH_UNLOCKED. More concretely, it is in preparation to move the
drain out of bdrv_change_aio_context() and marking that function as
GRAPH_RDLOCK.

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20250530151125.955508-7-f.ebner@proxmox.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block.c                          | 7 ++++---
 block/block-backend.c            | 6 +++---
 blockjob.c                       | 6 +++---
 include/block/block_int-common.h | 6 +++---
 4 files changed, 13 insertions(+), 12 deletions(-)

diff --git a/block.c b/block.c
index 7207978e53..01144c895e 100644
--- a/block.c
+++ b/block.c
@@ -1226,9 +1226,10 @@ static int bdrv_child_cb_inactivate(BdrvChild *child)
     return 0;
 }
 
-static bool bdrv_child_cb_change_aio_ctx(BdrvChild *child, AioContext *ctx,
-                                         GHashTable *visited, Transaction *tran,
-                                         Error **errp)
+static bool GRAPH_RDLOCK
+bdrv_child_cb_change_aio_ctx(BdrvChild *child, AioContext *ctx,
+                             GHashTable *visited, Transaction *tran,
+                             Error **errp)
 {
     BlockDriverState *bs = child->opaque;
     return bdrv_change_aio_context(bs, ctx, visited, tran, errp);
diff --git a/block/block-backend.c b/block/block-backend.c
index a402db13f2..6a6949edeb 100644
--- a/block/block-backend.c
+++ b/block/block-backend.c
@@ -136,9 +136,9 @@ static void blk_root_drained_end(BdrvChild *child);
 static void blk_root_change_media(BdrvChild *child, bool load);
 static void blk_root_resize(BdrvChild *child);
 
-static bool blk_root_change_aio_ctx(BdrvChild *child, AioContext *ctx,
-                                    GHashTable *visited, Transaction *tran,
-                                    Error **errp);
+static bool GRAPH_RDLOCK
+blk_root_change_aio_ctx(BdrvChild *child, AioContext *ctx, GHashTable *visited,
+                        Transaction *tran, Error **errp);
 
 static char *blk_root_get_parent_desc(BdrvChild *child)
 {
diff --git a/blockjob.c b/blockjob.c
index 32007f31a9..34185d7715 100644
--- a/blockjob.c
+++ b/blockjob.c
@@ -144,9 +144,9 @@ static TransactionActionDrv change_child_job_context = {
     .clean = g_free,
 };
 
-static bool child_job_change_aio_ctx(BdrvChild *c, AioContext *ctx,
-                                     GHashTable *visited, Transaction *tran,
-                                     Error **errp)
+static bool GRAPH_RDLOCK
+child_job_change_aio_ctx(BdrvChild *c, AioContext *ctx, GHashTable *visited,
+                         Transaction *tran, Error **errp)
 {
     BlockJob *job = c->opaque;
     BdrvStateChildJobContext *s;
diff --git a/include/block/block_int-common.h b/include/block/block_int-common.h
index 2982dd3118..37466c7841 100644
--- a/include/block/block_int-common.h
+++ b/include/block/block_int-common.h
@@ -983,9 +983,9 @@ struct BdrvChildClass {
                            bool backing_mask_protocol,
                            Error **errp);
 
-    bool (*change_aio_ctx)(BdrvChild *child, AioContext *ctx,
-                           GHashTable *visited, Transaction *tran,
-                           Error **errp);
+    bool GRAPH_RDLOCK_PTR (*change_aio_ctx)(BdrvChild *child, AioContext *ctx,
+                                            GHashTable *visited,
+                                            Transaction *tran, Error **errp);
 
     /*
      * I/O API functions. These functions are thread-safe.

From 469422c45b3a816eaf36e7edc895c81e0f3d38bb Mon Sep 17 00:00:00 2001
From: Fiona Ebner <f.ebner@proxmox.com>
Date: Fri, 30 May 2025 17:10:44 +0200
Subject: [PATCH 1391/2760] block: mark bdrv_child_change_aio_context()
 GRAPH_RDLOCK

This is a small step in preparation to mark bdrv_drained_begin() as
GRAPH_UNLOCKED. More concretely, it is in preparation to move the
drain out of bdrv_change_aio_context() and marking that function as
GRAPH_RDLOCK.

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20250530151125.955508-8-f.ebner@proxmox.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 include/block/block-global-state.h | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/include/block/block-global-state.h b/include/block/block-global-state.h
index 9be34b3c99..aad160956a 100644
--- a/include/block/block-global-state.h
+++ b/include/block/block-global-state.h
@@ -274,9 +274,10 @@ int bdrv_debug_remove_breakpoint(BlockDriverState *bs, const char *tag);
 int bdrv_debug_resume(BlockDriverState *bs, const char *tag);
 bool bdrv_debug_is_suspended(BlockDriverState *bs, const char *tag);
 
-bool bdrv_child_change_aio_context(BdrvChild *c, AioContext *ctx,
-                                   GHashTable *visited, Transaction *tran,
-                                   Error **errp);
+bool GRAPH_RDLOCK
+bdrv_child_change_aio_context(BdrvChild *c, AioContext *ctx,
+                              GHashTable *visited, Transaction *tran,
+                              Error **errp);
 int bdrv_try_change_aio_context(BlockDriverState *bs, AioContext *ctx,
                                 BdrvChild *ignore_child, Error **errp);
 

From 91ba0e1c382bd4a4b9c6a200f8a175d6ff30ab99 Mon Sep 17 00:00:00 2001
From: Fiona Ebner <f.ebner@proxmox.com>
Date: Fri, 30 May 2025 17:10:45 +0200
Subject: [PATCH 1392/2760] block: move drain outside of
 bdrv_change_aio_context() and mark GRAPH_RDLOCK

This is in preparation to mark bdrv_drained_begin() as GRAPH_UNLOCKED.

Note that even if bdrv_drained_begin() were already marked as
GRAPH_UNLOCKED, TSA would not complain about the instance in
bdrv_change_aio_context() before this change, because it is preceded
by a bdrv_graph_rdunlock_main_loop() call. It is not correct to
release the lock here, and in case the caller holds a write lock, it
wouldn't actually release the lock.

In combination with block-stream, there is a deadlock that can happen
because of this [0]. In particular, it can happen that
main thread              IO thread
1. acquires write lock
                         in blk_co_do_preadv_part():
                         2. have non-zero blk->in_flight
                         3. try to acquire read lock
4. begin drain

Steps 3 and 4 might be switched. Draining will poll and get stuck,
because it will see the non-zero in_flight counter. But the IO thread
will not make any progress either, because it cannot acquire the read
lock.

After this change, all paths to bdrv_change_aio_context() drain:
bdrv_change_aio_context() is called by:
1. bdrv_child_cb_change_aio_ctx() which is only called via the
   change_aio_ctx() callback, see below.
2. bdrv_child_change_aio_context(), see below.
3. bdrv_try_change_aio_context(), where a drained section is
   introduced.

The change_aio_ctx() callback is called by:
1. bdrv_attach_child_common_abort(), where a drained section is
   introduced.
2. bdrv_attach_child_common(), where a drained section is introduced.
3. bdrv_parent_change_aio_context(), see below.

bdrv_child_change_aio_context() is called by:
1. bdrv_change_aio_context(), i.e. recursive, so being in a drained
   section is invariant.
2. child_job_change_aio_ctx(), which is only called via the
   change_aio_ctx() callback, see above.

bdrv_parent_change_aio_context() is called by:
1. bdrv_change_aio_context(), i.e. recursive, so being in a drained
   section is invariant.

This resolves all code paths. Note that bdrv_attach_child_common()
and bdrv_attach_child_common_abort() hold the graph write lock and
callers of bdrv_try_change_aio_context() might too, so they are not
actually allowed to drain either. This will be addressed in the
following commits.

More granular draining is not trivially possible, because
bdrv_change_aio_context() can recursively call itself e.g. via
bdrv_child_change_aio_context().

[0]: https://lore.kernel.org/qemu-devel/73839c04-7616-407e-b057-80ca69e63f51@virtuozzo.com/

Reported-by: Andrey Drobyshev <andrey.drobyshev@virtuozzo.com>
Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20250530151125.955508-9-f.ebner@proxmox.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block.c                          | 57 +++++++++++++++++++++++---------
 include/block/block_int-common.h | 12 +++++++
 2 files changed, 53 insertions(+), 16 deletions(-)

diff --git a/block.c b/block.c
index 01144c895e..6f42c0f1ab 100644
--- a/block.c
+++ b/block.c
@@ -106,9 +106,9 @@ static void bdrv_reopen_abort(BDRVReopenState *reopen_state);
 
 static bool bdrv_backing_overridden(BlockDriverState *bs);
 
-static bool bdrv_change_aio_context(BlockDriverState *bs, AioContext *ctx,
-                                    GHashTable *visited, Transaction *tran,
-                                    Error **errp);
+static bool GRAPH_RDLOCK
+bdrv_change_aio_context(BlockDriverState *bs, AioContext *ctx,
+                        GHashTable *visited, Transaction *tran, Error **errp);
 
 /* If non-zero, use only whitelisted block drivers */
 static int use_bdrv_whitelist;
@@ -3040,8 +3040,10 @@ static void GRAPH_WRLOCK bdrv_attach_child_common_abort(void *opaque)
 
         /* No need to visit `child`, because it has been detached already */
         visited = g_hash_table_new(NULL, NULL);
+        bdrv_drain_all_begin();
         ret = s->child->klass->change_aio_ctx(s->child, s->old_parent_ctx,
                                               visited, tran, &error_abort);
+        bdrv_drain_all_end();
         g_hash_table_destroy(visited);
 
         /* transaction is supposed to always succeed */
@@ -3122,9 +3124,11 @@ bdrv_attach_child_common(BlockDriverState *child_bs,
             bool ret_child;
 
             g_hash_table_add(visited, new_child);
+            bdrv_drain_all_begin();
             ret_child = child_class->change_aio_ctx(new_child, child_ctx,
                                                     visited, aio_ctx_tran,
                                                     NULL);
+            bdrv_drain_all_end();
             if (ret_child == true) {
                 error_free(local_err);
                 ret = 0;
@@ -7576,6 +7580,17 @@ typedef struct BdrvStateSetAioContext {
     BlockDriverState *bs;
 } BdrvStateSetAioContext;
 
+/*
+ * Changes the AioContext of @child to @ctx and recursively for the associated
+ * block nodes and all their children and parents. Returns true if the change is
+ * possible and the transaction @tran can be continued. Returns false and sets
+ * @errp if not and the transaction must be aborted.
+ *
+ * @visited will accumulate all visited BdrvChild objects. The caller is
+ * responsible for freeing the list afterwards.
+ *
+ * Must be called with the affected block nodes drained.
+ */
 static bool GRAPH_RDLOCK
 bdrv_parent_change_aio_context(BdrvChild *c, AioContext *ctx,
                                GHashTable *visited, Transaction *tran,
@@ -7604,6 +7619,17 @@ bdrv_parent_change_aio_context(BdrvChild *c, AioContext *ctx,
     return true;
 }
 
+/*
+ * Changes the AioContext of @c->bs to @ctx and recursively for all its children
+ * and parents. Returns true if the change is possible and the transaction @tran
+ * can be continued. Returns false and sets @errp if not and the transaction
+ * must be aborted.
+ *
+ * @visited will accumulate all visited BdrvChild objects. The caller is
+ * responsible for freeing the list afterwards.
+ *
+ * Must be called with the affected block nodes drained.
+ */
 bool bdrv_child_change_aio_context(BdrvChild *c, AioContext *ctx,
                                    GHashTable *visited, Transaction *tran,
                                    Error **errp)
@@ -7619,10 +7645,6 @@ bool bdrv_child_change_aio_context(BdrvChild *c, AioContext *ctx,
 static void bdrv_set_aio_context_clean(void *opaque)
 {
     BdrvStateSetAioContext *state = (BdrvStateSetAioContext *) opaque;
-    BlockDriverState *bs = (BlockDriverState *) state->bs;
-
-    /* Paired with bdrv_drained_begin in bdrv_change_aio_context() */
-    bdrv_drained_end(bs);
 
     g_free(state);
 }
@@ -7650,10 +7672,12 @@ static TransactionActionDrv set_aio_context = {
  *
  * @visited will accumulate all visited BdrvChild objects. The caller is
  * responsible for freeing the list afterwards.
+ *
+ * @bs must be drained.
  */
-static bool bdrv_change_aio_context(BlockDriverState *bs, AioContext *ctx,
-                                    GHashTable *visited, Transaction *tran,
-                                    Error **errp)
+static bool GRAPH_RDLOCK
+bdrv_change_aio_context(BlockDriverState *bs, AioContext *ctx,
+                        GHashTable *visited, Transaction *tran, Error **errp)
 {
     BdrvChild *c;
     BdrvStateSetAioContext *state;
@@ -7664,21 +7688,17 @@ static bool bdrv_change_aio_context(BlockDriverState *bs, AioContext *ctx,
         return true;
     }
 
-    bdrv_graph_rdlock_main_loop();
     QLIST_FOREACH(c, &bs->parents, next_parent) {
         if (!bdrv_parent_change_aio_context(c, ctx, visited, tran, errp)) {
-            bdrv_graph_rdunlock_main_loop();
             return false;
         }
     }
 
     QLIST_FOREACH(c, &bs->children, next) {
         if (!bdrv_child_change_aio_context(c, ctx, visited, tran, errp)) {
-            bdrv_graph_rdunlock_main_loop();
             return false;
         }
     }
-    bdrv_graph_rdunlock_main_loop();
 
     state = g_new(BdrvStateSetAioContext, 1);
     *state = (BdrvStateSetAioContext) {
@@ -7686,8 +7706,7 @@ static bool bdrv_change_aio_context(BlockDriverState *bs, AioContext *ctx,
         .bs = bs,
     };
 
-    /* Paired with bdrv_drained_end in bdrv_set_aio_context_clean() */
-    bdrv_drained_begin(bs);
+    assert(bs->quiesce_counter > 0);
 
     tran_add(tran, &set_aio_context, state);
 
@@ -7720,6 +7739,8 @@ int bdrv_try_change_aio_context(BlockDriverState *bs, AioContext *ctx,
     if (ignore_child) {
         g_hash_table_add(visited, ignore_child);
     }
+    bdrv_drain_all_begin();
+    bdrv_graph_rdlock_main_loop();
     ret = bdrv_change_aio_context(bs, ctx, visited, tran, errp);
     g_hash_table_destroy(visited);
 
@@ -7733,10 +7754,14 @@ int bdrv_try_change_aio_context(BlockDriverState *bs, AioContext *ctx,
     if (!ret) {
         /* Just run clean() callbacks. No AioContext changed. */
         tran_abort(tran);
+        bdrv_graph_rdunlock_main_loop();
+        bdrv_drain_all_end();
         return -EPERM;
     }
 
     tran_commit(tran);
+    bdrv_graph_rdunlock_main_loop();
+    bdrv_drain_all_end();
     return 0;
 }
 
diff --git a/include/block/block_int-common.h b/include/block/block_int-common.h
index 37466c7841..168f703fa1 100644
--- a/include/block/block_int-common.h
+++ b/include/block/block_int-common.h
@@ -983,6 +983,18 @@ struct BdrvChildClass {
                            bool backing_mask_protocol,
                            Error **errp);
 
+    /*
+     * Notifies the parent that the child is trying to change its AioContext.
+     * The parent may in turn change the AioContext of other nodes in the same
+     * transaction. Returns true if the change is possible and the transaction
+     * can be continued. Returns false and sets @errp if not and the transaction
+     * must be aborted.
+     *
+     * @visited will accumulate all visited BdrvChild objects. The caller is
+     * responsible for freeing the list afterwards.
+     *
+     * Must be called with the affected block nodes drained.
+     */
     bool GRAPH_RDLOCK_PTR (*change_aio_ctx)(BdrvChild *child, AioContext *ctx,
                                             GHashTable *visited,
                                             Transaction *tran, Error **errp);

From a1ea8eb5912256c0b2be16fae5d3786aebc80cb1 Mon Sep 17 00:00:00 2001
From: Fiona Ebner <f.ebner@proxmox.com>
Date: Fri, 30 May 2025 17:10:46 +0200
Subject: [PATCH 1393/2760] block: move drain outside of
 bdrv_try_change_aio_context()

This is part of resolving the deadlock mentioned in commit "block:
move draining out of bdrv_change_aio_context() and mark GRAPH_RDLOCK".

Convert the function to a _locked() version that has to be called with
the graph lock held and add a convenience wrapper that has to be
called with the graph unlocked, which drains and takes the lock
itself. Since bdrv_try_change_aio_context() is global state code, the
wrapper is too.

Callers are adapted to use the appropriate variant, depending on
whether the caller already holds the lock. In the
test_set_aio_context() unit test, prior drains can be removed, because
draining already happens inside the new wrapper.

Note that bdrv_attach_child_common_abort(), bdrv_attach_child_common()
and bdrv_root_unref_child() hold the graph lock and are not actually
allowed to drain either. This will be addressed in the following
commits.

Functions like qmp_blockdev_mirror() query the nodes to act on before
draining and locking. In theory, draining could invalidate those nodes.
This kind of issue is not addressed by these commits.

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20250530151125.955508-10-f.ebner@proxmox.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block.c                            | 58 ++++++++++++++++++++++--------
 blockdev.c                         | 15 +++++---
 include/block/block-global-state.h |  8 +++--
 tests/unit/test-bdrv-drain.c       |  4 ---
 4 files changed, 59 insertions(+), 26 deletions(-)

diff --git a/block.c b/block.c
index 6f42c0f1ab..3aaacabf7f 100644
--- a/block.c
+++ b/block.c
@@ -3028,7 +3028,10 @@ static void GRAPH_WRLOCK bdrv_attach_child_common_abort(void *opaque)
     bdrv_replace_child_noperm(s->child, NULL);
 
     if (bdrv_get_aio_context(bs) != s->old_child_ctx) {
-        bdrv_try_change_aio_context(bs, s->old_child_ctx, NULL, &error_abort);
+        bdrv_drain_all_begin();
+        bdrv_try_change_aio_context_locked(bs, s->old_child_ctx, NULL,
+                                           &error_abort);
+        bdrv_drain_all_end();
     }
 
     if (bdrv_child_get_parent_aio_context(s->child) != s->old_parent_ctx) {
@@ -3115,8 +3118,10 @@ bdrv_attach_child_common(BlockDriverState *child_bs,
     parent_ctx = bdrv_child_get_parent_aio_context(new_child);
     if (child_ctx != parent_ctx) {
         Error *local_err = NULL;
-        int ret = bdrv_try_change_aio_context(child_bs, parent_ctx, NULL,
-                                              &local_err);
+        bdrv_drain_all_begin();
+        int ret = bdrv_try_change_aio_context_locked(child_bs, parent_ctx, NULL,
+                                                     &local_err);
+        bdrv_drain_all_end();
 
         if (ret < 0 && child_class->change_aio_ctx) {
             Transaction *aio_ctx_tran = tran_new();
@@ -3319,8 +3324,10 @@ void bdrv_root_unref_child(BdrvChild *child)
          * When the parent requiring a non-default AioContext is removed, the
          * node moves back to the main AioContext
          */
-        bdrv_try_change_aio_context(child_bs, qemu_get_aio_context(), NULL,
-                                    NULL);
+        bdrv_drain_all_begin();
+        bdrv_try_change_aio_context_locked(child_bs, qemu_get_aio_context(),
+                                           NULL, NULL);
+        bdrv_drain_all_end();
     }
 
     bdrv_schedule_unref(child_bs);
@@ -7719,9 +7726,13 @@ bdrv_change_aio_context(BlockDriverState *bs, AioContext *ctx,
  *
  * If ignore_child is not NULL, that child (and its subgraph) will not
  * be touched.
+ *
+ * Called with the graph lock held.
+ *
+ * Called while all bs are drained.
  */
-int bdrv_try_change_aio_context(BlockDriverState *bs, AioContext *ctx,
-                                BdrvChild *ignore_child, Error **errp)
+int bdrv_try_change_aio_context_locked(BlockDriverState *bs, AioContext *ctx,
+                                       BdrvChild *ignore_child, Error **errp)
 {
     Transaction *tran;
     GHashTable *visited;
@@ -7730,17 +7741,15 @@ int bdrv_try_change_aio_context(BlockDriverState *bs, AioContext *ctx,
 
     /*
      * Recursion phase: go through all nodes of the graph.
-     * Take care of checking that all nodes support changing AioContext
-     * and drain them, building a linear list of callbacks to run if everything
-     * is successful (the transaction itself).
+     * Take care of checking that all nodes support changing AioContext,
+     * building a linear list of callbacks to run if everything is successful
+     * (the transaction itself).
      */
     tran = tran_new();
     visited = g_hash_table_new(NULL, NULL);
     if (ignore_child) {
         g_hash_table_add(visited, ignore_child);
     }
-    bdrv_drain_all_begin();
-    bdrv_graph_rdlock_main_loop();
     ret = bdrv_change_aio_context(bs, ctx, visited, tran, errp);
     g_hash_table_destroy(visited);
 
@@ -7754,15 +7763,34 @@ int bdrv_try_change_aio_context(BlockDriverState *bs, AioContext *ctx,
     if (!ret) {
         /* Just run clean() callbacks. No AioContext changed. */
         tran_abort(tran);
-        bdrv_graph_rdunlock_main_loop();
-        bdrv_drain_all_end();
         return -EPERM;
     }
 
     tran_commit(tran);
+    return 0;
+}
+
+/*
+ * Change bs's and recursively all of its parents' and children's AioContext
+ * to the given new context, returning an error if that isn't possible.
+ *
+ * If ignore_child is not NULL, that child (and its subgraph) will not
+ * be touched.
+ */
+int bdrv_try_change_aio_context(BlockDriverState *bs, AioContext *ctx,
+                                BdrvChild *ignore_child, Error **errp)
+{
+    int ret;
+
+    GLOBAL_STATE_CODE();
+
+    bdrv_drain_all_begin();
+    bdrv_graph_rdlock_main_loop();
+    ret = bdrv_try_change_aio_context_locked(bs, ctx, ignore_child, errp);
     bdrv_graph_rdunlock_main_loop();
     bdrv_drain_all_end();
-    return 0;
+
+    return ret;
 }
 
 void bdrv_add_aio_context_notifier(BlockDriverState *bs,
diff --git a/blockdev.c b/blockdev.c
index 3982f9776b..750beba41f 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -3601,12 +3601,13 @@ void qmp_x_blockdev_set_iothread(const char *node_name, StrOrNull *iothread,
     AioContext *new_context;
     BlockDriverState *bs;
 
-    GRAPH_RDLOCK_GUARD_MAINLOOP();
+    bdrv_drain_all_begin();
+    bdrv_graph_rdlock_main_loop();
 
     bs = bdrv_find_node(node_name);
     if (!bs) {
         error_setg(errp, "Failed to find node with node-name='%s'", node_name);
-        return;
+        goto out;
     }
 
     /* Protects against accidents. */
@@ -3614,14 +3615,14 @@ void qmp_x_blockdev_set_iothread(const char *node_name, StrOrNull *iothread,
         error_setg(errp, "Node %s is associated with a BlockBackend and could "
                          "be in use (use force=true to override this check)",
                          node_name);
-        return;
+        goto out;
     }
 
     if (iothread->type == QTYPE_QSTRING) {
         IOThread *obj = iothread_by_id(iothread->u.s);
         if (!obj) {
             error_setg(errp, "Cannot find iothread %s", iothread->u.s);
-            return;
+            goto out;
         }
 
         new_context = iothread_get_aio_context(obj);
@@ -3629,7 +3630,11 @@ void qmp_x_blockdev_set_iothread(const char *node_name, StrOrNull *iothread,
         new_context = qemu_get_aio_context();
     }
 
-    bdrv_try_change_aio_context(bs, new_context, NULL, errp);
+    bdrv_try_change_aio_context_locked(bs, new_context, NULL, errp);
+
+out:
+    bdrv_graph_rdunlock_main_loop();
+    bdrv_drain_all_end();
 }
 
 QemuOptsList qemu_common_drive_opts = {
diff --git a/include/block/block-global-state.h b/include/block/block-global-state.h
index aad160956a..91f249b5ad 100644
--- a/include/block/block-global-state.h
+++ b/include/block/block-global-state.h
@@ -278,8 +278,12 @@ bool GRAPH_RDLOCK
 bdrv_child_change_aio_context(BdrvChild *c, AioContext *ctx,
                               GHashTable *visited, Transaction *tran,
                               Error **errp);
-int bdrv_try_change_aio_context(BlockDriverState *bs, AioContext *ctx,
-                                BdrvChild *ignore_child, Error **errp);
+int GRAPH_UNLOCKED
+bdrv_try_change_aio_context(BlockDriverState *bs, AioContext *ctx,
+                            BdrvChild *ignore_child, Error **errp);
+int GRAPH_RDLOCK
+bdrv_try_change_aio_context_locked(BlockDriverState *bs, AioContext *ctx,
+                                   BdrvChild *ignore_child, Error **errp);
 
 int GRAPH_RDLOCK bdrv_probe_blocksizes(BlockDriverState *bs, BlockSizes *bsz);
 int bdrv_probe_geometry(BlockDriverState *bs, HDGeometry *geo);
diff --git a/tests/unit/test-bdrv-drain.c b/tests/unit/test-bdrv-drain.c
index 290cd2a70e..3185f3f429 100644
--- a/tests/unit/test-bdrv-drain.c
+++ b/tests/unit/test-bdrv-drain.c
@@ -1396,14 +1396,10 @@ static void test_set_aio_context(void)
     bs = bdrv_new_open_driver(&bdrv_test, "test-node", BDRV_O_RDWR,
                               &error_abort);
 
-    bdrv_drained_begin(bs);
     bdrv_try_change_aio_context(bs, ctx_a, NULL, &error_abort);
-    bdrv_drained_end(bs);
 
-    bdrv_drained_begin(bs);
     bdrv_try_change_aio_context(bs, ctx_b, NULL, &error_abort);
     bdrv_try_change_aio_context(bs, qemu_get_aio_context(), NULL, &error_abort);
-    bdrv_drained_end(bs);
 
     bdrv_unref(bs);
     iothread_join(a);

From 2b833595aa21679145cfe67ba720113b165c19ef Mon Sep 17 00:00:00 2001
From: Fiona Ebner <f.ebner@proxmox.com>
Date: Fri, 30 May 2025 17:10:47 +0200
Subject: [PATCH 1394/2760] block: move drain outside of
 bdrv_attach_child_common(_abort)()

This is part of resolving the deadlock mentioned in commit "block:
move draining out of bdrv_change_aio_context() and mark GRAPH_RDLOCK".

The function bdrv_attach_child_common_abort() is used only as the
abort callback in bdrv_attach_child_common_drv transactions, so the
tran_finalize() calls of such transactions need to be in drained
sections too.

All code paths are covered:
The bdrv_attach_child_common_drv transactions are only used in
bdrv_attach_child_common(), so it is enough to check callers of
bdrv_attach_child_common() following the transactions.

bdrv_attach_child_common() is called by:
1. bdrv_attach_child_noperm(), which does not finalize the
   transaction yet.
2. bdrv_root_attach_child(), where a drained section is introduced.

bdrv_attach_child_noperm() is called by:
1. bdrv_attach_child(), where a drained section is introduced.
2. bdrv_set_file_or_backing_noperm(), which does not finalize the
   transaction yet.
3. bdrv_append(), where a drained section is introduced.

bdrv_set_file_or_backing_noperm() is called by:
1. bdrv_set_backing_hd_drained(), where a drained section is
   introduced.
2. bdrv_reopen_parse_file_or_backing(), which does not finalize the
   transaction yet. Draining the old child bs currently happens under
   the graph lock there. This is replaced with an assertion, because
   the drain will be moved further up to the caller.

bdrv_reopen_parse_file_or_backing() is called by:
1. bdrv_reopen_prepare(), which does not finalize the transaction yet.

bdrv_reopen_prepare() is called by:
1. bdrv_reopen_multiple(), which does finalize the transaction. It is
   called after bdrv_reopen_queue(), which starts a drained section.
   The drained section ends, when bdrv_reopen_queue_free() is called
   at the end of bdrv_reopen_multiple().

This resolves all code paths.

The functions bdrv_set_backing_hd_drained(), bdrv_attach_child() and
bdrv_root_attach_child() run under the graph lock, so they are not
actually allowed to drain. This will be addressed in the following
commits.

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Message-ID: <20250530151125.955508-11-f.ebner@proxmox.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block.c | 40 ++++++++++++++++++++++++----------------
 1 file changed, 24 insertions(+), 16 deletions(-)

diff --git a/block.c b/block.c
index 3aaacabf7f..46eb2fe449 100644
--- a/block.c
+++ b/block.c
@@ -3028,10 +3028,8 @@ static void GRAPH_WRLOCK bdrv_attach_child_common_abort(void *opaque)
     bdrv_replace_child_noperm(s->child, NULL);
 
     if (bdrv_get_aio_context(bs) != s->old_child_ctx) {
-        bdrv_drain_all_begin();
         bdrv_try_change_aio_context_locked(bs, s->old_child_ctx, NULL,
                                            &error_abort);
-        bdrv_drain_all_end();
     }
 
     if (bdrv_child_get_parent_aio_context(s->child) != s->old_parent_ctx) {
@@ -3043,10 +3041,8 @@ static void GRAPH_WRLOCK bdrv_attach_child_common_abort(void *opaque)
 
         /* No need to visit `child`, because it has been detached already */
         visited = g_hash_table_new(NULL, NULL);
-        bdrv_drain_all_begin();
         ret = s->child->klass->change_aio_ctx(s->child, s->old_parent_ctx,
                                               visited, tran, &error_abort);
-        bdrv_drain_all_end();
         g_hash_table_destroy(visited);
 
         /* transaction is supposed to always succeed */
@@ -3075,6 +3071,9 @@ static TransactionActionDrv bdrv_attach_child_common_drv = {
  *
  * Both @parent_bs and @child_bs can move to a different AioContext in this
  * function.
+ *
+ * All block nodes must be drained before this function is called until after
+ * the transaction is finalized.
  */
 static BdrvChild * GRAPH_WRLOCK
 bdrv_attach_child_common(BlockDriverState *child_bs,
@@ -3118,10 +3117,8 @@ bdrv_attach_child_common(BlockDriverState *child_bs,
     parent_ctx = bdrv_child_get_parent_aio_context(new_child);
     if (child_ctx != parent_ctx) {
         Error *local_err = NULL;
-        bdrv_drain_all_begin();
         int ret = bdrv_try_change_aio_context_locked(child_bs, parent_ctx, NULL,
                                                      &local_err);
-        bdrv_drain_all_end();
 
         if (ret < 0 && child_class->change_aio_ctx) {
             Transaction *aio_ctx_tran = tran_new();
@@ -3129,11 +3126,9 @@ bdrv_attach_child_common(BlockDriverState *child_bs,
             bool ret_child;
 
             g_hash_table_add(visited, new_child);
-            bdrv_drain_all_begin();
             ret_child = child_class->change_aio_ctx(new_child, child_ctx,
                                                     visited, aio_ctx_tran,
                                                     NULL);
-            bdrv_drain_all_end();
             if (ret_child == true) {
                 error_free(local_err);
                 ret = 0;
@@ -3189,6 +3184,9 @@ bdrv_attach_child_common(BlockDriverState *child_bs,
  *
  * After calling this function, the transaction @tran may only be completed
  * while holding a writer lock for the graph.
+ *
+ * All block nodes must be drained before this function is called until after
+ * the transaction is finalized.
  */
 static BdrvChild * GRAPH_WRLOCK
 bdrv_attach_child_noperm(BlockDriverState *parent_bs,
@@ -3244,6 +3242,7 @@ BdrvChild *bdrv_root_attach_child(BlockDriverState *child_bs,
 
     GLOBAL_STATE_CODE();
 
+    bdrv_drain_all_begin();
     child = bdrv_attach_child_common(child_bs, child_name, child_class,
                                    child_role, perm, shared_perm, opaque,
                                    tran, errp);
@@ -3256,6 +3255,7 @@ BdrvChild *bdrv_root_attach_child(BlockDriverState *child_bs,
 
 out:
     tran_finalize(tran, ret);
+    bdrv_drain_all_end();
 
     bdrv_schedule_unref(child_bs);
 
@@ -3283,6 +3283,7 @@ BdrvChild *bdrv_attach_child(BlockDriverState *parent_bs,
 
     GLOBAL_STATE_CODE();
 
+    bdrv_drain_all_begin();
     child = bdrv_attach_child_noperm(parent_bs, child_bs, child_name,
                                      child_class, child_role, tran, errp);
     if (!child) {
@@ -3297,6 +3298,7 @@ BdrvChild *bdrv_attach_child(BlockDriverState *parent_bs,
 
 out:
     tran_finalize(tran, ret);
+    bdrv_drain_all_end();
 
     bdrv_schedule_unref(child_bs);
 
@@ -3465,6 +3467,9 @@ static BdrvChildRole bdrv_backing_role(BlockDriverState *bs)
  *
  * After calling this function, the transaction @tran may only be completed
  * while holding a writer lock for the graph.
+ *
+ * All block nodes must be drained before this function is called until after
+ * the transaction is finalized.
  */
 static int GRAPH_WRLOCK
 bdrv_set_file_or_backing_noperm(BlockDriverState *parent_bs,
@@ -3573,6 +3578,7 @@ int bdrv_set_backing_hd_drained(BlockDriverState *bs,
         assert(bs->backing->bs->quiesce_counter > 0);
     }
 
+    bdrv_drain_all_begin();
     ret = bdrv_set_file_or_backing_noperm(bs, backing_hd, true, tran, errp);
     if (ret < 0) {
         goto out;
@@ -3581,6 +3587,7 @@ int bdrv_set_backing_hd_drained(BlockDriverState *bs,
     ret = bdrv_refresh_perms(bs, tran, errp);
 out:
     tran_finalize(tran, ret);
+    bdrv_drain_all_end();
     return ret;
 }
 
@@ -4721,6 +4728,9 @@ int bdrv_reopen_set_read_only(BlockDriverState *bs, bool read_only,
  * Return 0 on success, otherwise return < 0 and set @errp.
  *
  * @reopen_state->bs can move to a different AioContext in this function.
+ *
+ * All block nodes must be drained before this function is called until after
+ * the transaction is finalized.
  */
 static int GRAPH_UNLOCKED
 bdrv_reopen_parse_file_or_backing(BDRVReopenState *reopen_state,
@@ -4814,7 +4824,7 @@ bdrv_reopen_parse_file_or_backing(BDRVReopenState *reopen_state,
 
     if (old_child_bs) {
         bdrv_ref(old_child_bs);
-        bdrv_drained_begin(old_child_bs);
+        assert(old_child_bs->quiesce_counter > 0);
     }
 
     bdrv_graph_rdunlock_main_loop();
@@ -4826,7 +4836,6 @@ bdrv_reopen_parse_file_or_backing(BDRVReopenState *reopen_state,
     bdrv_graph_wrunlock();
 
     if (old_child_bs) {
-        bdrv_drained_end(old_child_bs);
         bdrv_unref(old_child_bs);
     }
 
@@ -4855,6 +4864,9 @@ out_rdlock:
  *
  * After calling this function, the transaction @change_child_tran may only be
  * completed while holding a writer lock for the graph.
+ *
+ * All block nodes must be drained before this function is called until after
+ * the transaction is finalized.
  */
 static int GRAPH_UNLOCKED
 bdrv_reopen_prepare(BDRVReopenState *reopen_state, BlockReopenQueue *queue,
@@ -5501,9 +5513,7 @@ int bdrv_append(BlockDriverState *bs_new, BlockDriverState *bs_top,
     assert(!bs_new->backing);
     bdrv_graph_rdunlock_main_loop();
 
-    bdrv_drained_begin(bs_top);
-    bdrv_drained_begin(bs_new);
-
+    bdrv_drain_all_begin();
     bdrv_graph_wrlock();
 
     child = bdrv_attach_child_noperm(bs_new, bs_top, "backing",
@@ -5525,9 +5535,7 @@ out:
 
     bdrv_refresh_limits(bs_top, NULL, NULL);
     bdrv_graph_wrunlock();
-
-    bdrv_drained_end(bs_top);
-    bdrv_drained_end(bs_new);
+    bdrv_drain_all_end();
 
     return ret;
 }

From e66dbda11eab2b4a091d470f3508a4d6ca60eaf5 Mon Sep 17 00:00:00 2001
From: Fiona Ebner <f.ebner@proxmox.com>
Date: Fri, 30 May 2025 17:10:48 +0200
Subject: [PATCH 1395/2760] block: move drain outside of
 bdrv_set_backing_hd_drained()

This is part of resolving the deadlock mentioned in commit "block:
move draining out of bdrv_change_aio_context() and mark GRAPH_RDLOCK".

The function bdrv_set_backing_hd_drained() holds the graph lock, so it
is not allowed to drain. It is called by:
1. bdrv_set_backing_hd(), where a drained section is introduced,
   replacing the previously present bs-specific drains.
2. stream_prepare(), where a drained section is introduced replacing
   the previously present bs-specific drains.

The drain_bs variable in bdrv_set_backing_hd_drained() is now
superfluous and thus dropped.

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Message-ID: <20250530151125.955508-12-f.ebner@proxmox.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block.c        | 16 +++-------------
 block/stream.c |  6 ++----
 2 files changed, 5 insertions(+), 17 deletions(-)

diff --git a/block.c b/block.c
index 46eb2fe449..e53a88e1b6 100644
--- a/block.c
+++ b/block.c
@@ -3562,8 +3562,7 @@ out:
  * Both @bs and @backing_hd can move to a different AioContext in this
  * function.
  *
- * If a backing child is already present (i.e. we're detaching a node), that
- * child node must be drained.
+ * All block nodes must be drained.
  */
 int bdrv_set_backing_hd_drained(BlockDriverState *bs,
                                 BlockDriverState *backing_hd,
@@ -3578,7 +3577,6 @@ int bdrv_set_backing_hd_drained(BlockDriverState *bs,
         assert(bs->backing->bs->quiesce_counter > 0);
     }
 
-    bdrv_drain_all_begin();
     ret = bdrv_set_file_or_backing_noperm(bs, backing_hd, true, tran, errp);
     if (ret < 0) {
         goto out;
@@ -3587,28 +3585,20 @@ int bdrv_set_backing_hd_drained(BlockDriverState *bs,
     ret = bdrv_refresh_perms(bs, tran, errp);
 out:
     tran_finalize(tran, ret);
-    bdrv_drain_all_end();
     return ret;
 }
 
 int bdrv_set_backing_hd(BlockDriverState *bs, BlockDriverState *backing_hd,
                         Error **errp)
 {
-    BlockDriverState *drain_bs;
     int ret;
     GLOBAL_STATE_CODE();
 
-    bdrv_graph_rdlock_main_loop();
-    drain_bs = bs->backing ? bs->backing->bs : bs;
-    bdrv_graph_rdunlock_main_loop();
-
-    bdrv_ref(drain_bs);
-    bdrv_drained_begin(drain_bs);
+    bdrv_drain_all_begin();
     bdrv_graph_wrlock();
     ret = bdrv_set_backing_hd_drained(bs, backing_hd, errp);
     bdrv_graph_wrunlock();
-    bdrv_drained_end(drain_bs);
-    bdrv_unref(drain_bs);
+    bdrv_drain_all_end();
 
     return ret;
 }
diff --git a/block/stream.c b/block/stream.c
index 999d9e56d4..6ba49cffd3 100644
--- a/block/stream.c
+++ b/block/stream.c
@@ -80,11 +80,10 @@ static int stream_prepare(Job *job)
      * may end up working with the wrong base node (or it might even have gone
      * away by the time we want to use it).
      */
-    bdrv_drained_begin(unfiltered_bs);
     if (unfiltered_bs_cow) {
         bdrv_ref(unfiltered_bs_cow);
-        bdrv_drained_begin(unfiltered_bs_cow);
     }
+    bdrv_drain_all_begin();
 
     bdrv_graph_rdlock_main_loop();
     base = bdrv_filter_or_cow_bs(s->above_base);
@@ -123,11 +122,10 @@ static int stream_prepare(Job *job)
     }
 
 out:
+    bdrv_drain_all_end();
     if (unfiltered_bs_cow) {
-        bdrv_drained_end(unfiltered_bs_cow);
         bdrv_unref(unfiltered_bs_cow);
     }
-    bdrv_drained_end(unfiltered_bs);
     return ret;
 }
 

From ffdcd081f52544f065020c780a6c522dace6b0af Mon Sep 17 00:00:00 2001
From: Fiona Ebner <f.ebner@proxmox.com>
Date: Fri, 30 May 2025 17:10:49 +0200
Subject: [PATCH 1396/2760] block: move drain outside of
 bdrv_root_attach_child()

This is part of resolving the deadlock mentioned in commit "block:
move draining out of bdrv_change_aio_context() and mark GRAPH_RDLOCK".

The function bdrv_root_attach_child() runs under the graph lock, so it
is not allowed to drain. It is called by:
1. blk_insert_bs(), where a drained section is introduced.
2. block_job_add_bdrv(), which holds the graph lock itself.

block_job_add_bdrv() is called by:
1. mirror_start_job()
2. stream_start()
3. commit_start()
4. backup_job_create()
5. block_job_create()
6. In the test_blockjob_common_drain_node() unit test

In all callers, a drained section is introduced.

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20250530151125.955508-13-f.ebner@proxmox.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block.c                      | 4 ++--
 block/backup.c               | 2 ++
 block/block-backend.c        | 2 ++
 block/commit.c               | 4 ++++
 block/mirror.c               | 5 +++++
 block/stream.c               | 4 ++++
 blockjob.c                   | 4 ++++
 include/block/blockjob.h     | 2 ++
 tests/unit/test-bdrv-drain.c | 2 ++
 9 files changed, 27 insertions(+), 2 deletions(-)

diff --git a/block.c b/block.c
index e53a88e1b6..17c34dc240 100644
--- a/block.c
+++ b/block.c
@@ -3228,6 +3228,8 @@ bdrv_attach_child_noperm(BlockDriverState *parent_bs,
  *
  * On failure NULL is returned, errp is set and the reference to
  * child_bs is also dropped.
+ *
+ * All block nodes must be drained.
  */
 BdrvChild *bdrv_root_attach_child(BlockDriverState *child_bs,
                                   const char *child_name,
@@ -3242,7 +3244,6 @@ BdrvChild *bdrv_root_attach_child(BlockDriverState *child_bs,
 
     GLOBAL_STATE_CODE();
 
-    bdrv_drain_all_begin();
     child = bdrv_attach_child_common(child_bs, child_name, child_class,
                                    child_role, perm, shared_perm, opaque,
                                    tran, errp);
@@ -3255,7 +3256,6 @@ BdrvChild *bdrv_root_attach_child(BlockDriverState *child_bs,
 
 out:
     tran_finalize(tran, ret);
-    bdrv_drain_all_end();
 
     bdrv_schedule_unref(child_bs);
 
diff --git a/block/backup.c b/block/backup.c
index 0151e84395..909027c17a 100644
--- a/block/backup.c
+++ b/block/backup.c
@@ -498,10 +498,12 @@ BlockJob *backup_job_create(const char *job_id, BlockDriverState *bs,
     block_copy_set_speed(bcs, speed);
 
     /* Required permissions are taken by copy-before-write filter target */
+    bdrv_drain_all_begin();
     bdrv_graph_wrlock();
     block_job_add_bdrv(&job->common, "target", target, 0, BLK_PERM_ALL,
                        &error_abort);
     bdrv_graph_wrunlock();
+    bdrv_drain_all_end();
 
     return &job->common;
 
diff --git a/block/block-backend.c b/block/block-backend.c
index 6a6949edeb..24cae3cb55 100644
--- a/block/block-backend.c
+++ b/block/block-backend.c
@@ -904,6 +904,7 @@ int blk_insert_bs(BlockBackend *blk, BlockDriverState *bs, Error **errp)
 
     GLOBAL_STATE_CODE();
     bdrv_ref(bs);
+    bdrv_drain_all_begin();
     bdrv_graph_wrlock();
 
     if ((bs->open_flags & BDRV_O_INACTIVE) && blk_can_inactivate(blk)) {
@@ -919,6 +920,7 @@ int blk_insert_bs(BlockBackend *blk, BlockDriverState *bs, Error **errp)
                                        BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY,
                                        perm, shared_perm, blk, errp);
     bdrv_graph_wrunlock();
+    bdrv_drain_all_end();
     if (blk->root == NULL) {
         return -EPERM;
     }
diff --git a/block/commit.c b/block/commit.c
index 7cc8c0f0df..6c4b736ff8 100644
--- a/block/commit.c
+++ b/block/commit.c
@@ -392,6 +392,7 @@ void commit_start(const char *job_id, BlockDriverState *bs,
      * this is the responsibility of the interface (i.e. whoever calls
      * commit_start()).
      */
+    bdrv_drain_all_begin();
     bdrv_graph_wrlock();
     s->base_overlay = bdrv_find_overlay(top, base);
     assert(s->base_overlay);
@@ -424,18 +425,21 @@ void commit_start(const char *job_id, BlockDriverState *bs,
                                  iter_shared_perms, errp);
         if (ret < 0) {
             bdrv_graph_wrunlock();
+            bdrv_drain_all_end();
             goto fail;
         }
     }
 
     if (bdrv_freeze_backing_chain(commit_top_bs, base, errp) < 0) {
         bdrv_graph_wrunlock();
+        bdrv_drain_all_end();
         goto fail;
     }
     s->chain_frozen = true;
 
     ret = block_job_add_bdrv(&s->common, "base", base, 0, BLK_PERM_ALL, errp);
     bdrv_graph_wrunlock();
+    bdrv_drain_all_end();
 
     if (ret < 0) {
         goto fail;
diff --git a/block/mirror.c b/block/mirror.c
index c2c5099c95..6e8caf4b49 100644
--- a/block/mirror.c
+++ b/block/mirror.c
@@ -2014,6 +2014,7 @@ static BlockJob *mirror_start_job(
      */
     bdrv_disable_dirty_bitmap(s->dirty_bitmap);
 
+    bdrv_drain_all_begin();
     bdrv_graph_wrlock();
     ret = block_job_add_bdrv(&s->common, "source", bs, 0,
                              BLK_PERM_WRITE_UNCHANGED | BLK_PERM_WRITE |
@@ -2021,6 +2022,7 @@ static BlockJob *mirror_start_job(
                              errp);
     if (ret < 0) {
         bdrv_graph_wrunlock();
+        bdrv_drain_all_end();
         goto fail;
     }
 
@@ -2066,16 +2068,19 @@ static BlockJob *mirror_start_job(
                                      iter_shared_perms, errp);
             if (ret < 0) {
                 bdrv_graph_wrunlock();
+                bdrv_drain_all_end();
                 goto fail;
             }
         }
 
         if (bdrv_freeze_backing_chain(mirror_top_bs, target, errp) < 0) {
             bdrv_graph_wrunlock();
+            bdrv_drain_all_end();
             goto fail;
         }
     }
     bdrv_graph_wrunlock();
+    bdrv_drain_all_end();
 
     QTAILQ_INIT(&s->ops_in_flight);
 
diff --git a/block/stream.c b/block/stream.c
index 6ba49cffd3..f5441f27f4 100644
--- a/block/stream.c
+++ b/block/stream.c
@@ -371,10 +371,12 @@ void stream_start(const char *job_id, BlockDriverState *bs,
      * already have our own plans. Also don't allow resize as the image size is
      * queried only at the job start and then cached.
      */
+    bdrv_drain_all_begin();
     bdrv_graph_wrlock();
     if (block_job_add_bdrv(&s->common, "active node", bs, 0,
                            basic_flags | BLK_PERM_WRITE, errp)) {
         bdrv_graph_wrunlock();
+        bdrv_drain_all_end();
         goto fail;
     }
 
@@ -395,10 +397,12 @@ void stream_start(const char *job_id, BlockDriverState *bs,
                                  basic_flags, errp);
         if (ret < 0) {
             bdrv_graph_wrunlock();
+            bdrv_drain_all_end();
             goto fail;
         }
     }
     bdrv_graph_wrunlock();
+    bdrv_drain_all_end();
 
     s->base_overlay = base_overlay;
     s->above_base = above_base;
diff --git a/blockjob.c b/blockjob.c
index 34185d7715..44991e3ff7 100644
--- a/blockjob.c
+++ b/blockjob.c
@@ -496,6 +496,7 @@ void *block_job_create(const char *job_id, const BlockJobDriver *driver,
     int ret;
     GLOBAL_STATE_CODE();
 
+    bdrv_drain_all_begin();
     bdrv_graph_wrlock();
 
     if (job_id == NULL && !(flags & JOB_INTERNAL)) {
@@ -506,6 +507,7 @@ void *block_job_create(const char *job_id, const BlockJobDriver *driver,
                      flags, cb, opaque, errp);
     if (job == NULL) {
         bdrv_graph_wrunlock();
+        bdrv_drain_all_end();
         return NULL;
     }
 
@@ -544,10 +546,12 @@ void *block_job_create(const char *job_id, const BlockJobDriver *driver,
     }
 
     bdrv_graph_wrunlock();
+    bdrv_drain_all_end();
     return job;
 
 fail:
     bdrv_graph_wrunlock();
+    bdrv_drain_all_end();
     job_early_fail(&job->job);
     return NULL;
 }
diff --git a/include/block/blockjob.h b/include/block/blockjob.h
index 7061ab7201..990f3e179a 100644
--- a/include/block/blockjob.h
+++ b/include/block/blockjob.h
@@ -137,6 +137,8 @@ BlockJob *block_job_get_locked(const char *id);
  * Add @bs to the list of BlockDriverState that are involved in
  * @job. This means that all operations will be blocked on @bs while
  * @job exists.
+ *
+ * All block nodes must be drained.
  */
 int GRAPH_WRLOCK
 block_job_add_bdrv(BlockJob *job, const char *name, BlockDriverState *bs,
diff --git a/tests/unit/test-bdrv-drain.c b/tests/unit/test-bdrv-drain.c
index 3185f3f429..4f3057844b 100644
--- a/tests/unit/test-bdrv-drain.c
+++ b/tests/unit/test-bdrv-drain.c
@@ -772,9 +772,11 @@ static void test_blockjob_common_drain_node(enum drain_type drain_type,
     tjob->bs = src;
     job = &tjob->common;
 
+    bdrv_drain_all_begin();
     bdrv_graph_wrlock();
     block_job_add_bdrv(job, "target", target, 0, BLK_PERM_ALL, &error_abort);
     bdrv_graph_wrunlock();
+    bdrv_drain_all_end();
 
     switch (result) {
     case TEST_JOB_SUCCESS:

From 77f3965ba7fed5b35212171a1e41c20c05a7ef11 Mon Sep 17 00:00:00 2001
From: Fiona Ebner <f.ebner@proxmox.com>
Date: Fri, 30 May 2025 17:10:50 +0200
Subject: [PATCH 1397/2760] block: move drain outside of bdrv_attach_child()

This is part of resolving the deadlock mentioned in commit "block:
move draining out of bdrv_change_aio_context() and mark GRAPH_RDLOCK".

The function bdrv_attach_child() runs under the graph lock, so it is
not allowed to drain. It is called by:
1. replication_start()
2. quorum_add_child()
3. bdrv_open_child_common()
4. Throughout test-bdrv-graph-mod.c and test-bdrv-drain.c unit tests.

In all callers, a drained section is introduced.

The function quorum_add_child() runs under the graph lock, so it is
not actually allowed to drain. This will be addressed by the following
commit.

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20250530151125.955508-14-f.ebner@proxmox.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block.c                          |  6 ++++--
 block/quorum.c                   |  2 ++
 block/replication.c              |  5 +++++
 tests/unit/test-bdrv-drain.c     | 14 ++++++++++++++
 tests/unit/test-bdrv-graph-mod.c | 10 ++++++++++
 5 files changed, 35 insertions(+), 2 deletions(-)

diff --git a/block.c b/block.c
index 17c34dc240..6fc87aa318 100644
--- a/block.c
+++ b/block.c
@@ -3269,6 +3269,8 @@ out:
  *
  * On failure NULL is returned, errp is set and the reference to
  * child_bs is also dropped.
+ *
+ * All block nodes must be drained.
  */
 BdrvChild *bdrv_attach_child(BlockDriverState *parent_bs,
                              BlockDriverState *child_bs,
@@ -3283,7 +3285,6 @@ BdrvChild *bdrv_attach_child(BlockDriverState *parent_bs,
 
     GLOBAL_STATE_CODE();
 
-    bdrv_drain_all_begin();
     child = bdrv_attach_child_noperm(parent_bs, child_bs, child_name,
                                      child_class, child_role, tran, errp);
     if (!child) {
@@ -3298,7 +3299,6 @@ BdrvChild *bdrv_attach_child(BlockDriverState *parent_bs,
 
 out:
     tran_finalize(tran, ret);
-    bdrv_drain_all_end();
 
     bdrv_schedule_unref(child_bs);
 
@@ -3789,10 +3789,12 @@ static BdrvChild *bdrv_open_child_common(const char *filename,
         return NULL;
     }
 
+    bdrv_drain_all_begin();
     bdrv_graph_wrlock();
     child = bdrv_attach_child(parent, bs, bdref_key, child_class, child_role,
                               errp);
     bdrv_graph_wrunlock();
+    bdrv_drain_all_end();
 
     return child;
 }
diff --git a/block/quorum.c b/block/quorum.c
index ed8ce801ee..ea17b0ec13 100644
--- a/block/quorum.c
+++ b/block/quorum.c
@@ -1096,8 +1096,10 @@ quorum_add_child(BlockDriverState *bs, BlockDriverState *child_bs, Error **errp)
     /* We can safely add the child now */
     bdrv_ref(child_bs);
 
+    bdrv_drain_all_begin();
     child = bdrv_attach_child(bs, child_bs, indexstr, &child_of_bds,
                               BDRV_CHILD_DATA, errp);
+    bdrv_drain_all_end();
     if (child == NULL) {
         s->next_child_index--;
         return;
diff --git a/block/replication.c b/block/replication.c
index 07f274de9e..54cbd03e00 100644
--- a/block/replication.c
+++ b/block/replication.c
@@ -540,6 +540,7 @@ static void replication_start(ReplicationState *rs, ReplicationMode mode,
             return;
         }
 
+        bdrv_drain_all_begin();
         bdrv_graph_wrlock();
 
         bdrv_ref(hidden_disk->bs);
@@ -549,6 +550,7 @@ static void replication_start(ReplicationState *rs, ReplicationMode mode,
         if (local_err) {
             error_propagate(errp, local_err);
             bdrv_graph_wrunlock();
+            bdrv_drain_all_end();
             return;
         }
 
@@ -559,6 +561,7 @@ static void replication_start(ReplicationState *rs, ReplicationMode mode,
         if (local_err) {
             error_propagate(errp, local_err);
             bdrv_graph_wrunlock();
+            bdrv_drain_all_end();
             return;
         }
 
@@ -571,12 +574,14 @@ static void replication_start(ReplicationState *rs, ReplicationMode mode,
             !check_top_bs(top_bs, bs)) {
             error_setg(errp, "No top_bs or it is invalid");
             bdrv_graph_wrunlock();
+            bdrv_drain_all_end();
             reopen_backing_file(bs, false, NULL);
             return;
         }
         bdrv_op_block_all(top_bs, s->blocker);
 
         bdrv_graph_wrunlock();
+        bdrv_drain_all_end();
 
         s->backup_job = backup_job_create(
                                 NULL, s->secondary_disk->bs, s->hidden_disk->bs,
diff --git a/tests/unit/test-bdrv-drain.c b/tests/unit/test-bdrv-drain.c
index 4f3057844b..ac76525e5a 100644
--- a/tests/unit/test-bdrv-drain.c
+++ b/tests/unit/test-bdrv-drain.c
@@ -1049,10 +1049,12 @@ static void do_test_delete_by_drain(bool detach_instead_of_delete,
 
     null_bs = bdrv_open("null-co://", NULL, NULL, BDRV_O_RDWR | BDRV_O_PROTOCOL,
                         &error_abort);
+    bdrv_drain_all_begin();
     bdrv_graph_wrlock();
     bdrv_attach_child(bs, null_bs, "null-child", &child_of_bds,
                       BDRV_CHILD_DATA, &error_abort);
     bdrv_graph_wrunlock();
+    bdrv_drain_all_end();
 
     /* This child will be the one to pass to requests through to, and
      * it will stall until a drain occurs */
@@ -1060,21 +1062,25 @@ static void do_test_delete_by_drain(bool detach_instead_of_delete,
                                     &error_abort);
     child_bs->total_sectors = 65536 >> BDRV_SECTOR_BITS;
     /* Takes our reference to child_bs */
+    bdrv_drain_all_begin();
     bdrv_graph_wrlock();
     tts->wait_child = bdrv_attach_child(bs, child_bs, "wait-child",
                                         &child_of_bds,
                                         BDRV_CHILD_DATA | BDRV_CHILD_PRIMARY,
                                         &error_abort);
     bdrv_graph_wrunlock();
+    bdrv_drain_all_end();
 
     /* This child is just there to be deleted
      * (for detach_instead_of_delete == true) */
     null_bs = bdrv_open("null-co://", NULL, NULL, BDRV_O_RDWR | BDRV_O_PROTOCOL,
                         &error_abort);
+    bdrv_drain_all_begin();
     bdrv_graph_wrlock();
     bdrv_attach_child(bs, null_bs, "null-child", &child_of_bds, BDRV_CHILD_DATA,
                       &error_abort);
     bdrv_graph_wrunlock();
+    bdrv_drain_all_end();
 
     blk = blk_new(qemu_get_aio_context(), BLK_PERM_ALL, BLK_PERM_ALL);
     blk_insert_bs(blk, bs, &error_abort);
@@ -1157,6 +1163,7 @@ static void no_coroutine_fn detach_indirect_bh(void *opaque)
 
     bdrv_dec_in_flight(data->child_b->bs);
 
+    bdrv_drain_all_begin();
     bdrv_graph_wrlock();
     bdrv_unref_child(data->parent_b, data->child_b);
 
@@ -1165,6 +1172,7 @@ static void no_coroutine_fn detach_indirect_bh(void *opaque)
                                       &child_of_bds, BDRV_CHILD_DATA,
                                       &error_abort);
     bdrv_graph_wrunlock();
+    bdrv_drain_all_end();
 }
 
 static void coroutine_mixed_fn detach_by_parent_aio_cb(void *opaque, int ret)
@@ -1262,6 +1270,7 @@ static void TSA_NO_TSA test_detach_indirect(bool by_parent_cb)
     /* Set child relationships */
     bdrv_ref(b);
     bdrv_ref(a);
+    bdrv_drain_all_begin();
     bdrv_graph_wrlock();
     child_b = bdrv_attach_child(parent_b, b, "PB-B", &child_of_bds,
                                 BDRV_CHILD_DATA, &error_abort);
@@ -1273,6 +1282,7 @@ static void TSA_NO_TSA test_detach_indirect(bool by_parent_cb)
                       by_parent_cb ? &child_of_bds : &detach_by_driver_cb_class,
                       BDRV_CHILD_DATA, &error_abort);
     bdrv_graph_wrunlock();
+    bdrv_drain_all_end();
 
     g_assert_cmpint(parent_a->refcnt, ==, 1);
     g_assert_cmpint(parent_b->refcnt, ==, 1);
@@ -1685,6 +1695,7 @@ static void test_drop_intermediate_poll(void)
      * Establish the chain last, so the chain links are the first
      * elements in the BDS.parents lists
      */
+    bdrv_drain_all_begin();
     bdrv_graph_wrlock();
     for (i = 0; i < 3; i++) {
         if (i) {
@@ -1694,6 +1705,7 @@ static void test_drop_intermediate_poll(void)
         }
     }
     bdrv_graph_wrunlock();
+    bdrv_drain_all_end();
 
     job = block_job_create("job", &test_simple_job_driver, NULL, job_node,
                            0, BLK_PERM_ALL, 0, 0, NULL, NULL, &error_abort);
@@ -1940,10 +1952,12 @@ static void do_test_replace_child_mid_drain(int old_drain_count,
     new_child_bs->total_sectors = 1;
 
     bdrv_ref(old_child_bs);
+    bdrv_drain_all_begin();
     bdrv_graph_wrlock();
     bdrv_attach_child(parent_bs, old_child_bs, "child", &child_of_bds,
                       BDRV_CHILD_COW, &error_abort);
     bdrv_graph_wrunlock();
+    bdrv_drain_all_end();
     parent_s->setup_completed = true;
 
     for (i = 0; i < old_drain_count; i++) {
diff --git a/tests/unit/test-bdrv-graph-mod.c b/tests/unit/test-bdrv-graph-mod.c
index d743abb4bb..7b03ebe4b0 100644
--- a/tests/unit/test-bdrv-graph-mod.c
+++ b/tests/unit/test-bdrv-graph-mod.c
@@ -137,10 +137,12 @@ static void test_update_perm_tree(void)
 
     blk_insert_bs(root, bs, &error_abort);
 
+    bdrv_drain_all_begin();
     bdrv_graph_wrlock();
     bdrv_attach_child(filter, bs, "child", &child_of_bds,
                       BDRV_CHILD_DATA, &error_abort);
     bdrv_graph_wrunlock();
+    bdrv_drain_all_end();
 
     ret = bdrv_append(filter, bs, NULL);
     g_assert_cmpint(ret, <, 0);
@@ -204,11 +206,13 @@ static void test_should_update_child(void)
 
     bdrv_set_backing_hd(target, bs, &error_abort);
 
+    bdrv_drain_all_begin();
     bdrv_graph_wrlock();
     g_assert(target->backing->bs == bs);
     bdrv_attach_child(filter, target, "target", &child_of_bds,
                       BDRV_CHILD_DATA, &error_abort);
     bdrv_graph_wrunlock();
+    bdrv_drain_all_end();
     bdrv_append(filter, bs, &error_abort);
 
     bdrv_graph_rdlock_main_loop();
@@ -244,6 +248,7 @@ static void test_parallel_exclusive_write(void)
     bdrv_ref(base);
     bdrv_ref(fl1);
 
+    bdrv_drain_all_begin();
     bdrv_graph_wrlock();
     bdrv_attach_child(top, fl1, "backing", &child_of_bds,
                       BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY,
@@ -257,6 +262,7 @@ static void test_parallel_exclusive_write(void)
 
     bdrv_replace_node(fl1, fl2, &error_abort);
     bdrv_graph_wrunlock();
+    bdrv_drain_all_end();
 
     bdrv_drained_end(fl2);
     bdrv_drained_end(fl1);
@@ -363,6 +369,7 @@ static void test_parallel_perm_update(void)
      */
     bdrv_ref(base);
 
+    bdrv_drain_all_begin();
     bdrv_graph_wrlock();
     bdrv_attach_child(top, ws, "file", &child_of_bds, BDRV_CHILD_DATA,
                       &error_abort);
@@ -377,6 +384,7 @@ static void test_parallel_perm_update(void)
                       BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY,
                       &error_abort);
     bdrv_graph_wrunlock();
+    bdrv_drain_all_end();
 
     /* Select fl1 as first child to be active */
     s->selected = c_fl1;
@@ -430,11 +438,13 @@ static void test_append_greedy_filter(void)
     BlockDriverState *base = no_perm_node("base");
     BlockDriverState *fl = exclusive_writer_node("fl1");
 
+    bdrv_drain_all_begin();
     bdrv_graph_wrlock();
     bdrv_attach_child(top, base, "backing", &child_of_bds,
                       BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY,
                       &error_abort);
     bdrv_graph_wrunlock();
+    bdrv_drain_all_end();
 
     bdrv_append(fl, base, &error_abort);
     bdrv_unref(fl);

From 0414930d3adfa89299eaea5ce92accab15d9fba5 Mon Sep 17 00:00:00 2001
From: Fiona Ebner <f.ebner@proxmox.com>
Date: Fri, 30 May 2025 17:10:51 +0200
Subject: [PATCH 1398/2760] block: move drain outside of quorum_add_child()

This is part of resolving the deadlock mentioned in commit "block:
move draining out of bdrv_change_aio_context() and mark GRAPH_RDLOCK".

The quorum_add_child() callback runs under the graph lock, so it is
not allowed to drain. It is only called as the .bdrv_add_child()
callback, which is only called in the bdrv_add_child() function, which
also runs under the graph lock.

The bdrv_add_child() function is called by qmp_x_blockdev_change(),
where a drained section is introduced.

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Message-ID: <20250530151125.955508-15-f.ebner@proxmox.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block.c                          | 10 ++++++++--
 block/quorum.c                   |  2 --
 blockdev.c                       |  2 ++
 include/block/block_int-common.h |  7 +++++++
 4 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/block.c b/block.c
index 6fc87aa318..f6c2f7e208 100644
--- a/block.c
+++ b/block.c
@@ -8220,8 +8220,10 @@ char *bdrv_dirname(BlockDriverState *bs, Error **errp)
 }
 
 /*
- * Hot add/remove a BDS's child. So the user can take a child offline when
- * it is broken and take a new child online
+ * Hot add a BDS's child. Used in combination with bdrv_del_child, so the user
+ * can take a child offline when it is broken and take a new child online.
+ *
+ * All block nodes must be drained.
  */
 void bdrv_add_child(BlockDriverState *parent_bs, BlockDriverState *child_bs,
                     Error **errp)
@@ -8261,6 +8263,10 @@ void bdrv_add_child(BlockDriverState *parent_bs, BlockDriverState *child_bs,
     parent_bs->drv->bdrv_add_child(parent_bs, child_bs, errp);
 }
 
+/*
+ * Hot remove a BDS's child. Used in combination with bdrv_add_child, so the
+ * user can take a child offline when it is broken and take a new child online.
+ */
 void bdrv_del_child(BlockDriverState *parent_bs, BdrvChild *child, Error **errp)
 {
     BdrvChild *tmp;
diff --git a/block/quorum.c b/block/quorum.c
index ea17b0ec13..ed8ce801ee 100644
--- a/block/quorum.c
+++ b/block/quorum.c
@@ -1096,10 +1096,8 @@ quorum_add_child(BlockDriverState *bs, BlockDriverState *child_bs, Error **errp)
     /* We can safely add the child now */
     bdrv_ref(child_bs);
 
-    bdrv_drain_all_begin();
     child = bdrv_attach_child(bs, child_bs, indexstr, &child_of_bds,
                               BDRV_CHILD_DATA, errp);
-    bdrv_drain_all_end();
     if (child == NULL) {
         s->next_child_index--;
         return;
diff --git a/blockdev.c b/blockdev.c
index 750beba41f..bd5ca77619 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -3531,6 +3531,7 @@ void qmp_x_blockdev_change(const char *parent, const char *child,
     BlockDriverState *parent_bs, *new_bs = NULL;
     BdrvChild *p_child;
 
+    bdrv_drain_all_begin();
     bdrv_graph_wrlock();
 
     parent_bs = bdrv_lookup_bs(parent, parent, errp);
@@ -3568,6 +3569,7 @@ void qmp_x_blockdev_change(const char *parent, const char *child,
 
 out:
     bdrv_graph_wrunlock();
+    bdrv_drain_all_end();
 }
 
 BlockJobInfoList *qmp_query_block_jobs(Error **errp)
diff --git a/include/block/block_int-common.h b/include/block/block_int-common.h
index 168f703fa1..f9e742f812 100644
--- a/include/block/block_int-common.h
+++ b/include/block/block_int-common.h
@@ -396,6 +396,13 @@ struct BlockDriver {
     int GRAPH_RDLOCK_PTR (*bdrv_probe_geometry)(
         BlockDriverState *bs, HDGeometry *geo);
 
+    /**
+     * Hot add a BDS's child. Used in combination with bdrv_del_child, so the
+     * user can take a child offline when it is broken and take a new child
+     * online.
+     *
+     * All block nodes must be drained.
+     */
     void GRAPH_WRLOCK_PTR (*bdrv_add_child)(
         BlockDriverState *parent, BlockDriverState *child, Error **errp);
 

From b13f54654546cbc0661d3fe9d25f7543535c2bee Mon Sep 17 00:00:00 2001
From: Fiona Ebner <f.ebner@proxmox.com>
Date: Fri, 30 May 2025 17:10:52 +0200
Subject: [PATCH 1399/2760] block: move drain outside of
 bdrv_root_unref_child()

This is part of resolving the deadlock mentioned in commit "block:
move draining out of bdrv_change_aio_context() and mark GRAPH_RDLOCK".

bdrv_root_unref_child() is called by:
1. blk_remove_bs(), where a drained section is introduced.
2. bdrv_unref_child(), which runs under the graph lock, so the drain
   will be moved further up to its callers.
3. block_job_remove_all_bdrv(), where a drained section is introduced.

For all callers of bdrv_unref_child() and its generated
bdrv_co_unref_child() coroutine variant, a drained section is
introduced, they are not explicilty listed here. The caller
quorum_del_child() holds the graph lock, so it is not actually allowed
to drain. This will be addressed in the next commit.

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Message-ID: <20250530151125.955508-16-f.ebner@proxmox.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block.c                      | 18 ++++++++++++++----
 block/blklogwrites.c         |  4 ++++
 block/blkverify.c            |  2 ++
 block/block-backend.c        |  2 ++
 block/qcow2.c                |  4 ++++
 block/quorum.c               |  6 ++++++
 block/replication.c          |  2 ++
 block/snapshot.c             |  2 ++
 block/vmdk.c                 | 10 ++++++++++
 blockjob.c                   |  2 ++
 tests/unit/test-bdrv-drain.c |  4 ++++
 11 files changed, 52 insertions(+), 4 deletions(-)

diff --git a/block.c b/block.c
index f6c2f7e208..15a8ccb822 100644
--- a/block.c
+++ b/block.c
@@ -1721,12 +1721,14 @@ bdrv_open_driver(BlockDriverState *bs, BlockDriver *drv, const char *node_name,
 open_failed:
     bs->drv = NULL;
 
+    bdrv_drain_all_begin();
     bdrv_graph_wrlock();
     if (bs->file != NULL) {
         bdrv_unref_child(bs, bs->file);
         assert(!bs->file);
     }
     bdrv_graph_wrunlock();
+    bdrv_drain_all_end();
 
     g_free(bs->opaque);
     bs->opaque = NULL;
@@ -3305,7 +3307,11 @@ out:
     return ret < 0 ? NULL : child;
 }
 
-/* Callers must ensure that child->frozen is false. */
+/*
+ * Callers must ensure that child->frozen is false.
+ *
+ * All block nodes must be drained.
+ */
 void bdrv_root_unref_child(BdrvChild *child)
 {
     BlockDriverState *child_bs = child->bs;
@@ -3326,10 +3332,8 @@ void bdrv_root_unref_child(BdrvChild *child)
          * When the parent requiring a non-default AioContext is removed, the
          * node moves back to the main AioContext
          */
-        bdrv_drain_all_begin();
         bdrv_try_change_aio_context_locked(child_bs, qemu_get_aio_context(),
                                            NULL, NULL);
-        bdrv_drain_all_end();
     }
 
     bdrv_schedule_unref(child_bs);
@@ -3402,7 +3406,11 @@ bdrv_unset_inherits_from(BlockDriverState *root, BdrvChild *child,
     }
 }
 
-/* Callers must ensure that child->frozen is false. */
+/*
+ * Callers must ensure that child->frozen is false.
+ *
+ * All block nodes must be drained.
+ */
 void bdrv_unref_child(BlockDriverState *parent, BdrvChild *child)
 {
     GLOBAL_STATE_CODE();
@@ -5172,6 +5180,7 @@ static void bdrv_close(BlockDriverState *bs)
         bs->drv = NULL;
     }
 
+    bdrv_drain_all_begin();
     bdrv_graph_wrlock();
     QLIST_FOREACH_SAFE(child, &bs->children, next, next) {
         bdrv_unref_child(bs, child);
@@ -5180,6 +5189,7 @@ static void bdrv_close(BlockDriverState *bs)
     assert(!bs->backing);
     assert(!bs->file);
     bdrv_graph_wrunlock();
+    bdrv_drain_all_end();
 
     g_free(bs->opaque);
     bs->opaque = NULL;
diff --git a/block/blklogwrites.c b/block/blklogwrites.c
index b0f78c4bc7..70ac76f401 100644
--- a/block/blklogwrites.c
+++ b/block/blklogwrites.c
@@ -281,9 +281,11 @@ static int blk_log_writes_open(BlockDriverState *bs, QDict *options, int flags,
     ret = 0;
 fail_log:
     if (ret < 0) {
+        bdrv_drain_all_begin();
         bdrv_graph_wrlock();
         bdrv_unref_child(bs, s->log_file);
         bdrv_graph_wrunlock();
+        bdrv_drain_all_end();
         s->log_file = NULL;
         qemu_mutex_destroy(&s->mutex);
     }
@@ -296,10 +298,12 @@ static void blk_log_writes_close(BlockDriverState *bs)
 {
     BDRVBlkLogWritesState *s = bs->opaque;
 
+    bdrv_drain_all_begin();
     bdrv_graph_wrlock();
     bdrv_unref_child(bs, s->log_file);
     s->log_file = NULL;
     bdrv_graph_wrunlock();
+    bdrv_drain_all_end();
     qemu_mutex_destroy(&s->mutex);
 }
 
diff --git a/block/blkverify.c b/block/blkverify.c
index db79a36681..3a71f7498c 100644
--- a/block/blkverify.c
+++ b/block/blkverify.c
@@ -151,10 +151,12 @@ static void blkverify_close(BlockDriverState *bs)
 {
     BDRVBlkverifyState *s = bs->opaque;
 
+    bdrv_drain_all_begin();
     bdrv_graph_wrlock();
     bdrv_unref_child(bs, s->test_file);
     s->test_file = NULL;
     bdrv_graph_wrunlock();
+    bdrv_drain_all_end();
 }
 
 static int64_t coroutine_fn GRAPH_RDLOCK
diff --git a/block/block-backend.c b/block/block-backend.c
index 24cae3cb55..68209bb2f7 100644
--- a/block/block-backend.c
+++ b/block/block-backend.c
@@ -889,9 +889,11 @@ void blk_remove_bs(BlockBackend *blk)
     root = blk->root;
     blk->root = NULL;
 
+    bdrv_drain_all_begin();
     bdrv_graph_wrlock();
     bdrv_root_unref_child(root);
     bdrv_graph_wrunlock();
+    bdrv_drain_all_end();
 }
 
 /*
diff --git a/block/qcow2.c b/block/qcow2.c
index 66fba89b41..45451a7ee8 100644
--- a/block/qcow2.c
+++ b/block/qcow2.c
@@ -1895,7 +1895,9 @@ qcow2_do_open(BlockDriverState *bs, QDict *options, int flags,
     g_free(s->image_data_file);
     if (open_data_file && has_data_file(bs)) {
         bdrv_graph_co_rdunlock();
+        bdrv_drain_all_begin();
         bdrv_co_unref_child(bs, s->data_file);
+        bdrv_drain_all_end();
         bdrv_graph_co_rdlock();
         s->data_file = NULL;
     }
@@ -2821,9 +2823,11 @@ qcow2_do_close(BlockDriverState *bs, bool close_data_file)
     if (close_data_file && has_data_file(bs)) {
         GLOBAL_STATE_CODE();
         bdrv_graph_rdunlock_main_loop();
+        bdrv_drain_all_begin();
         bdrv_graph_wrlock();
         bdrv_unref_child(bs, s->data_file);
         bdrv_graph_wrunlock();
+        bdrv_drain_all_end();
         s->data_file = NULL;
         bdrv_graph_rdlock_main_loop();
     }
diff --git a/block/quorum.c b/block/quorum.c
index ed8ce801ee..81407a38ee 100644
--- a/block/quorum.c
+++ b/block/quorum.c
@@ -1037,6 +1037,7 @@ static int quorum_open(BlockDriverState *bs, QDict *options, int flags,
 
 close_exit:
     /* cleanup on error */
+    bdrv_drain_all_begin();
     bdrv_graph_wrlock();
     for (i = 0; i < s->num_children; i++) {
         if (!opened[i]) {
@@ -1045,6 +1046,7 @@ close_exit:
         bdrv_unref_child(bs, s->children[i]);
     }
     bdrv_graph_wrunlock();
+    bdrv_drain_all_end();
     g_free(s->children);
     g_free(opened);
 exit:
@@ -1057,11 +1059,13 @@ static void quorum_close(BlockDriverState *bs)
     BDRVQuorumState *s = bs->opaque;
     int i;
 
+    bdrv_drain_all_begin();
     bdrv_graph_wrlock();
     for (i = 0; i < s->num_children; i++) {
         bdrv_unref_child(bs, s->children[i]);
     }
     bdrv_graph_wrunlock();
+    bdrv_drain_all_end();
 
     g_free(s->children);
 }
@@ -1143,7 +1147,9 @@ quorum_del_child(BlockDriverState *bs, BdrvChild *child, Error **errp)
             (s->num_children - i - 1) * sizeof(BdrvChild *));
     s->children = g_renew(BdrvChild *, s->children, --s->num_children);
 
+    bdrv_drain_all_begin();
     bdrv_unref_child(bs, child);
+    bdrv_drain_all_end();
 
     quorum_refresh_flags(bs);
 }
diff --git a/block/replication.c b/block/replication.c
index 54cbd03e00..0879718854 100644
--- a/block/replication.c
+++ b/block/replication.c
@@ -656,12 +656,14 @@ static void replication_done(void *opaque, int ret)
     if (ret == 0) {
         s->stage = BLOCK_REPLICATION_DONE;
 
+        bdrv_drain_all_begin();
         bdrv_graph_wrlock();
         bdrv_unref_child(bs, s->secondary_disk);
         s->secondary_disk = NULL;
         bdrv_unref_child(bs, s->hidden_disk);
         s->hidden_disk = NULL;
         bdrv_graph_wrunlock();
+        bdrv_drain_all_end();
 
         s->error = 0;
     } else {
diff --git a/block/snapshot.c b/block/snapshot.c
index 9f300a78bd..28c9c43621 100644
--- a/block/snapshot.c
+++ b/block/snapshot.c
@@ -291,9 +291,11 @@ int bdrv_snapshot_goto(BlockDriverState *bs,
         }
 
         /* .bdrv_open() will re-attach it */
+        bdrv_drain_all_begin();
         bdrv_graph_wrlock();
         bdrv_unref_child(bs, fallback);
         bdrv_graph_wrunlock();
+        bdrv_drain_all_end();
 
         ret = bdrv_snapshot_goto(fallback_bs, snapshot_id, errp);
         memset(bs->opaque, 0, drv->instance_size);
diff --git a/block/vmdk.c b/block/vmdk.c
index 9c7ab037e1..89a7250120 100644
--- a/block/vmdk.c
+++ b/block/vmdk.c
@@ -271,6 +271,7 @@ static void vmdk_free_extents(BlockDriverState *bs)
     BDRVVmdkState *s = bs->opaque;
     VmdkExtent *e;
 
+    bdrv_drain_all_begin();
     bdrv_graph_wrlock();
     for (i = 0; i < s->num_extents; i++) {
         e = &s->extents[i];
@@ -283,6 +284,7 @@ static void vmdk_free_extents(BlockDriverState *bs)
         }
     }
     bdrv_graph_wrunlock();
+    bdrv_drain_all_end();
 
     g_free(s->extents);
 }
@@ -1247,9 +1249,11 @@ vmdk_parse_extents(const char *desc, BlockDriverState *bs, QDict *options,
                             0, 0, 0, 0, 0, &extent, errp);
             if (ret < 0) {
                 bdrv_graph_rdunlock_main_loop();
+                bdrv_drain_all_begin();
                 bdrv_graph_wrlock();
                 bdrv_unref_child(bs, extent_file);
                 bdrv_graph_wrunlock();
+                bdrv_drain_all_end();
                 bdrv_graph_rdlock_main_loop();
                 goto out;
             }
@@ -1266,9 +1270,11 @@ vmdk_parse_extents(const char *desc, BlockDriverState *bs, QDict *options,
             g_free(buf);
             if (ret) {
                 bdrv_graph_rdunlock_main_loop();
+                bdrv_drain_all_begin();
                 bdrv_graph_wrlock();
                 bdrv_unref_child(bs, extent_file);
                 bdrv_graph_wrunlock();
+                bdrv_drain_all_end();
                 bdrv_graph_rdlock_main_loop();
                 goto out;
             }
@@ -1277,9 +1283,11 @@ vmdk_parse_extents(const char *desc, BlockDriverState *bs, QDict *options,
             ret = vmdk_open_se_sparse(bs, extent_file, bs->open_flags, errp);
             if (ret) {
                 bdrv_graph_rdunlock_main_loop();
+                bdrv_drain_all_begin();
                 bdrv_graph_wrlock();
                 bdrv_unref_child(bs, extent_file);
                 bdrv_graph_wrunlock();
+                bdrv_drain_all_end();
                 bdrv_graph_rdlock_main_loop();
                 goto out;
             }
@@ -1287,9 +1295,11 @@ vmdk_parse_extents(const char *desc, BlockDriverState *bs, QDict *options,
         } else {
             error_setg(errp, "Unsupported extent type '%s'", type);
             bdrv_graph_rdunlock_main_loop();
+            bdrv_drain_all_begin();
             bdrv_graph_wrlock();
             bdrv_unref_child(bs, extent_file);
             bdrv_graph_wrunlock();
+            bdrv_drain_all_end();
             bdrv_graph_rdlock_main_loop();
             ret = -ENOTSUP;
             goto out;
diff --git a/blockjob.c b/blockjob.c
index 44991e3ff7..e68181a35b 100644
--- a/blockjob.c
+++ b/blockjob.c
@@ -198,6 +198,7 @@ void block_job_remove_all_bdrv(BlockJob *job)
      * one to make sure that such a concurrent access does not attempt
      * to process an already freed BdrvChild.
      */
+    bdrv_drain_all_begin();
     bdrv_graph_wrlock();
     while (job->nodes) {
         GSList *l = job->nodes;
@@ -211,6 +212,7 @@ void block_job_remove_all_bdrv(BlockJob *job)
         g_slist_free_1(l);
     }
     bdrv_graph_wrunlock();
+    bdrv_drain_all_end();
 }
 
 bool block_job_has_bdrv(BlockJob *job, BlockDriverState *bs)
diff --git a/tests/unit/test-bdrv-drain.c b/tests/unit/test-bdrv-drain.c
index ac76525e5a..59c2793725 100644
--- a/tests/unit/test-bdrv-drain.c
+++ b/tests/unit/test-bdrv-drain.c
@@ -955,11 +955,13 @@ static void bdrv_test_top_close(BlockDriverState *bs)
 {
     BdrvChild *c, *next_c;
 
+    bdrv_drain_all_begin();
     bdrv_graph_wrlock();
     QLIST_FOREACH_SAFE(c, &bs->children, next, next_c) {
         bdrv_unref_child(bs, c);
     }
     bdrv_graph_wrunlock();
+    bdrv_drain_all_end();
 }
 
 static int coroutine_fn GRAPH_RDLOCK
@@ -1016,7 +1018,9 @@ static void coroutine_fn test_co_delete_by_drain(void *opaque)
         bdrv_graph_co_rdlock();
         QLIST_FOREACH_SAFE(c, &bs->children, next, next_c) {
             bdrv_graph_co_rdunlock();
+            bdrv_drain_all_begin();
             bdrv_co_unref_child(bs, c);
+            bdrv_drain_all_end();
             bdrv_graph_co_rdlock();
         }
         bdrv_graph_co_rdunlock();

From d75f8ed1d7fc27cf1643e549cd006a68d3bf6ef1 Mon Sep 17 00:00:00 2001
From: Fiona Ebner <f.ebner@proxmox.com>
Date: Fri, 30 May 2025 17:10:53 +0200
Subject: [PATCH 1400/2760] block: move drain outside of quorum_del_child()

The quorum_del_child() callback runs under the graph lock, so it is
not allowed to drain. It is only called as the .bdrv_del_child()
callback, which is only called in the bdrv_del_child() function, which
also runs under the graph lock.

The bdrv_del_child() function is called by qmp_x_blockdev_change().
A drained section was already introduced there by commit "block: move
drain out of quorum_add_child()".

This finally finishes moving out the drain to places that are not
under the graph lock started in "block: move draining out of
bdrv_change_aio_context() and mark GRAPH_RDLOCK".

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Message-ID: <20250530151125.955508-17-f.ebner@proxmox.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block.c                          | 2 ++
 block/quorum.c                   | 2 --
 include/block/block_int-common.h | 7 +++++++
 3 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/block.c b/block.c
index 15a8ccb822..bfd4340b24 100644
--- a/block.c
+++ b/block.c
@@ -8276,6 +8276,8 @@ void bdrv_add_child(BlockDriverState *parent_bs, BlockDriverState *child_bs,
 /*
  * Hot remove a BDS's child. Used in combination with bdrv_add_child, so the
  * user can take a child offline when it is broken and take a new child online.
+ *
+ * All block nodes must be drained.
  */
 void bdrv_del_child(BlockDriverState *parent_bs, BdrvChild *child, Error **errp)
 {
diff --git a/block/quorum.c b/block/quorum.c
index 81407a38ee..cc3bc5f4e7 100644
--- a/block/quorum.c
+++ b/block/quorum.c
@@ -1147,9 +1147,7 @@ quorum_del_child(BlockDriverState *bs, BdrvChild *child, Error **errp)
             (s->num_children - i - 1) * sizeof(BdrvChild *));
     s->children = g_renew(BdrvChild *, s->children, --s->num_children);
 
-    bdrv_drain_all_begin();
     bdrv_unref_child(bs, child);
-    bdrv_drain_all_end();
 
     quorum_refresh_flags(bs);
 }
diff --git a/include/block/block_int-common.h b/include/block/block_int-common.h
index f9e742f812..925a3e7353 100644
--- a/include/block/block_int-common.h
+++ b/include/block/block_int-common.h
@@ -406,6 +406,13 @@ struct BlockDriver {
     void GRAPH_WRLOCK_PTR (*bdrv_add_child)(
         BlockDriverState *parent, BlockDriverState *child, Error **errp);
 
+    /**
+     * Hot remove a BDS's child. Used in combination with bdrv_add_child, so the
+     * user can take a child offline when it is broken and take a new child
+     * online.
+     *
+     * All block nodes must be drained.
+     */
     void GRAPH_WRLOCK_PTR (*bdrv_del_child)(
         BlockDriverState *parent, BdrvChild *child, Error **errp);
 

From 6f101614f95c889399352b8301917c0ac7919ae7 Mon Sep 17 00:00:00 2001
From: Fiona Ebner <f.ebner@proxmox.com>
Date: Fri, 30 May 2025 17:10:54 +0200
Subject: [PATCH 1401/2760] blockdev: drain while unlocked in
 internal_snapshot_action()

This is in preparation to mark bdrv_drained_begin() as GRAPH_UNLOCKED.

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Message-ID: <20250530151125.955508-18-f.ebner@proxmox.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 blockdev.c | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/blockdev.c b/blockdev.c
index bd5ca77619..506755bef1 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -1208,7 +1208,7 @@ static void internal_snapshot_action(BlockdevSnapshotInternal *internal,
     Error *local_err = NULL;
     const char *device;
     const char *name;
-    BlockDriverState *bs;
+    BlockDriverState *bs, *check_bs;
     QEMUSnapshotInfo old_sn, *sn;
     bool ret;
     int64_t rt;
@@ -1216,7 +1216,7 @@ static void internal_snapshot_action(BlockdevSnapshotInternal *internal,
     int ret1;
 
     GLOBAL_STATE_CODE();
-    GRAPH_RDLOCK_GUARD_MAINLOOP();
+    bdrv_graph_rdlock_main_loop();
 
     tran_add(tran, &internal_snapshot_drv, state);
 
@@ -1225,14 +1225,29 @@ static void internal_snapshot_action(BlockdevSnapshotInternal *internal,
 
     bs = qmp_get_root_bs(device, errp);
     if (!bs) {
+        bdrv_graph_rdunlock_main_loop();
         return;
     }
 
     state->bs = bs;
 
+    /* Need to drain while unlocked. */
+    bdrv_graph_rdunlock_main_loop();
     /* Paired with .clean() */
     bdrv_drained_begin(bs);
 
+    GRAPH_RDLOCK_GUARD_MAINLOOP();
+
+    /* Make sure the root bs did not change with the drain. */
+    check_bs = qmp_get_root_bs(device, errp);
+    if (bs != check_bs) {
+        if (check_bs) {
+            error_setg(errp, "Block node of device '%s' unexpectedly changed",
+                       device);
+        } /* else errp is already set */
+        return;
+    }
+
     if (bdrv_op_is_blocked(bs, BLOCK_OP_TYPE_INTERNAL_SNAPSHOT, errp)) {
         return;
     }

From 195a8a946a8681dfe7e8aa8d49db415693db5311 Mon Sep 17 00:00:00 2001
From: Fiona Ebner <f.ebner@proxmox.com>
Date: Fri, 30 May 2025 17:10:55 +0200
Subject: [PATCH 1402/2760] blockdev: drain while unlocked in
 external_snapshot_action()

This is in preparation to mark bdrv_drained_begin() as GRAPH_UNLOCKED.

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Message-ID: <20250530151125.955508-19-f.ebner@proxmox.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 blockdev.c | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/blockdev.c b/blockdev.c
index 506755bef1..2e7fda6780 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -1377,9 +1377,10 @@ static void external_snapshot_action(TransactionAction *action,
     const char *new_image_file;
     ExternalSnapshotState *state = g_new0(ExternalSnapshotState, 1);
     uint64_t perm, shared;
+    BlockDriverState *check_bs;
 
     /* TODO We'll eventually have to take a writer lock in this function */
-    GRAPH_RDLOCK_GUARD_MAINLOOP();
+    bdrv_graph_rdlock_main_loop();
 
     tran_add(tran, &external_snapshot_drv, state);
 
@@ -1412,11 +1413,25 @@ static void external_snapshot_action(TransactionAction *action,
 
     state->old_bs = bdrv_lookup_bs(device, node_name, errp);
     if (!state->old_bs) {
+        bdrv_graph_rdunlock_main_loop();
         return;
     }
 
+    /* Need to drain while unlocked. */
+    bdrv_graph_rdunlock_main_loop();
     /* Paired with .clean() */
     bdrv_drained_begin(state->old_bs);
+    GRAPH_RDLOCK_GUARD_MAINLOOP();
+
+    /* Make sure the associated bs did not change with the drain. */
+    check_bs = bdrv_lookup_bs(device, node_name, errp);
+    if (state->old_bs != check_bs) {
+        if (check_bs) {
+            error_setg(errp, "Block node of device '%s' unexpectedly changed",
+                       device);
+        } /* else errp is already set */
+        return;
+    }
 
     if (!bdrv_is_inserted(state->old_bs)) {
         error_setg(errp, "Device '%s' has no medium",

From fc1d2f3eac7946658b160db0b813b81288fb1778 Mon Sep 17 00:00:00 2001
From: Fiona Ebner <f.ebner@proxmox.com>
Date: Fri, 30 May 2025 17:10:56 +0200
Subject: [PATCH 1403/2760] block: mark bdrv_drained_begin() and friends as
 GRAPH_UNLOCKED

All of bdrv_drain_all_begin(), bdrv_drain_all() and
bdrv_drained_begin() poll and are not allowed to be called with the
block graph lock held. Mark the function as such.

Suggested-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Message-ID: <20250530151125.955508-20-f.ebner@proxmox.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 include/block/block-global-state.h | 4 ++--
 include/block/block-io.h           | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/include/block/block-global-state.h b/include/block/block-global-state.h
index 91f249b5ad..84a2a4ecd5 100644
--- a/include/block/block-global-state.h
+++ b/include/block/block-global-state.h
@@ -192,10 +192,10 @@ int bdrv_inactivate_all(void);
 
 int bdrv_flush_all(void);
 void bdrv_close_all(void);
-void bdrv_drain_all_begin(void);
+void GRAPH_UNLOCKED bdrv_drain_all_begin(void);
 void bdrv_drain_all_begin_nopoll(void);
 void bdrv_drain_all_end(void);
-void bdrv_drain_all(void);
+void GRAPH_UNLOCKED bdrv_drain_all(void);
 
 void bdrv_aio_cancel(BlockAIOCB *acb);
 
diff --git a/include/block/block-io.h b/include/block/block-io.h
index b99cc98d26..4cf83fb367 100644
--- a/include/block/block-io.h
+++ b/include/block/block-io.h
@@ -431,7 +431,7 @@ bdrv_drain_poll(BlockDriverState *bs, BdrvChild *ignore_parent,
  *
  * This function can be recursive.
  */
-void bdrv_drained_begin(BlockDriverState *bs);
+void GRAPH_UNLOCKED bdrv_drained_begin(BlockDriverState *bs);
 
 /**
  * bdrv_do_drained_begin_quiesce:

From ed8c62927e8facebb1e41b417daee3109e398712 Mon Sep 17 00:00:00 2001
From: Fiona Ebner <f.ebner@proxmox.com>
Date: Fri, 30 May 2025 17:10:57 +0200
Subject: [PATCH 1404/2760] iotests/graph-changes-while-io: remove image file
 after test

Suggested-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Message-ID: <20250530151125.955508-21-f.ebner@proxmox.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 tests/qemu-iotests/tests/graph-changes-while-io | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tests/qemu-iotests/tests/graph-changes-while-io b/tests/qemu-iotests/tests/graph-changes-while-io
index 194fda500e..35489e3b5e 100755
--- a/tests/qemu-iotests/tests/graph-changes-while-io
+++ b/tests/qemu-iotests/tests/graph-changes-while-io
@@ -57,6 +57,7 @@ class TestGraphChangesWhileIO(QMPTestCase):
 
     def tearDown(self) -> None:
         self.qsd.stop()
+        os.remove(top)
 
     def test_blockdev_add_while_io(self) -> None:
         # Run qemu-img bench in the background

From 09d98a018e1fd2db0bb73bbe9b4a7110c8ae354f Mon Sep 17 00:00:00 2001
From: Andrey Drobyshev <andrey.drobyshev@virtuozzo.com>
Date: Fri, 30 May 2025 17:10:58 +0200
Subject: [PATCH 1405/2760] iotests/graph-changes-while-io: add test case with
 removal of lower snapshot

This case is catching potential deadlock which takes place when job-dismiss
is issued when I/O requests are processed in a separate iothread.

See https://mail.gnu.org/archive/html/qemu-devel/2025-04/msg04421.html

Signed-off-by: Andrey Drobyshev <andrey.drobyshev@virtuozzo.com>
[FE: re-use top image and rename snap1->mid as suggested by Kevin Wolf
     remove image file after test as suggested by Kevin Wolf
     add type annotation for function argument to make mypy happy]
Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Message-ID: <20250530151125.955508-22-f.ebner@proxmox.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 .../qemu-iotests/tests/graph-changes-while-io | 101 ++++++++++++++++--
 .../tests/graph-changes-while-io.out          |   4 +-
 2 files changed, 96 insertions(+), 9 deletions(-)

diff --git a/tests/qemu-iotests/tests/graph-changes-while-io b/tests/qemu-iotests/tests/graph-changes-while-io
index 35489e3b5e..dca1167b6d 100755
--- a/tests/qemu-iotests/tests/graph-changes-while-io
+++ b/tests/qemu-iotests/tests/graph-changes-while-io
@@ -27,6 +27,7 @@ from iotests import imgfmt, qemu_img, qemu_img_create, qemu_io, \
 
 
 top = os.path.join(iotests.test_dir, 'top.img')
+mid = os.path.join(iotests.test_dir, 'mid.img')
 nbd_sock = os.path.join(iotests.sock_dir, 'nbd.sock')
 
 
@@ -59,6 +60,15 @@ class TestGraphChangesWhileIO(QMPTestCase):
         self.qsd.stop()
         os.remove(top)
 
+    def _wait_for_blockjob(self, status: str) -> None:
+        done = False
+        while not done:
+            for event in self.qsd.get_qmp().get_events(wait=10.0):
+                if event['event'] != 'JOB_STATUS_CHANGE':
+                    continue
+                if event['data']['status'] == status:
+                    done = True
+
     def test_blockdev_add_while_io(self) -> None:
         # Run qemu-img bench in the background
         bench_thr = Thread(target=do_qemu_img_bench)
@@ -117,16 +127,93 @@ class TestGraphChangesWhileIO(QMPTestCase):
                 'device': 'job0',
             })
 
-            cancelled = False
-            while not cancelled:
-                for event in self.qsd.get_qmp().get_events(wait=10.0):
-                    if event['event'] != 'JOB_STATUS_CHANGE':
-                        continue
-                    if event['data']['status'] == 'null':
-                        cancelled = True
+            self._wait_for_blockjob('null')
 
         bench_thr.join()
 
+    def test_remove_lower_snapshot_while_io(self) -> None:
+        # Run qemu-img bench in the background
+        bench_thr = Thread(target=do_qemu_img_bench, args=(100000, ))
+        bench_thr.start()
+
+        # While I/O is performed on 'node0' node, consequently add 2 snapshots
+        # on top of it, then remove (commit) them starting from lower one.
+        while bench_thr.is_alive():
+            # Recreate snapshot images on every iteration
+            qemu_img_create('-f', imgfmt, mid, '1G')
+            qemu_img_create('-f', imgfmt, top, '1G')
+
+            self.qsd.cmd('blockdev-add', {
+                'driver': imgfmt,
+                'node-name': 'mid',
+                'file': {
+                    'driver': 'file',
+                    'filename': mid
+                }
+            })
+
+            self.qsd.cmd('blockdev-snapshot', {
+                'node': 'node0',
+                'overlay': 'mid',
+            })
+
+            self.qsd.cmd('blockdev-add', {
+                'driver': imgfmt,
+                'node-name': 'top',
+                'file': {
+                    'driver': 'file',
+                    'filename': top
+                }
+            })
+
+            self.qsd.cmd('blockdev-snapshot', {
+                'node': 'mid',
+                'overlay': 'top',
+            })
+
+            self.qsd.cmd('block-commit', {
+                'job-id': 'commit-mid',
+                'device': 'top',
+                'top-node': 'mid',
+                'base-node': 'node0',
+                'auto-finalize': True,
+                'auto-dismiss': False,
+            })
+
+            self._wait_for_blockjob('concluded')
+            self.qsd.cmd('job-dismiss', {
+                'id': 'commit-mid',
+            })
+
+            self.qsd.cmd('block-commit', {
+                'job-id': 'commit-top',
+                'device': 'top',
+                'top-node': 'top',
+                'base-node': 'node0',
+                'auto-finalize': True,
+                'auto-dismiss': False,
+            })
+
+            self._wait_for_blockjob('ready')
+            self.qsd.cmd('job-complete', {
+                'id': 'commit-top',
+            })
+
+            self._wait_for_blockjob('concluded')
+            self.qsd.cmd('job-dismiss', {
+                'id': 'commit-top',
+            })
+
+            self.qsd.cmd('blockdev-del', {
+                'node-name': 'mid'
+            })
+            self.qsd.cmd('blockdev-del', {
+                'node-name': 'top'
+            })
+
+        bench_thr.join()
+        os.remove(mid)
+
 if __name__ == '__main__':
     # Format must support raw backing files
     iotests.main(supported_fmts=['qcow', 'qcow2', 'qed'],
diff --git a/tests/qemu-iotests/tests/graph-changes-while-io.out b/tests/qemu-iotests/tests/graph-changes-while-io.out
index fbc63e62f8..8d7e996700 100644
--- a/tests/qemu-iotests/tests/graph-changes-while-io.out
+++ b/tests/qemu-iotests/tests/graph-changes-while-io.out
@@ -1,5 +1,5 @@
-..
+...
 ----------------------------------------------------------------------
-Ran 2 tests
+Ran 3 tests
 
 OK

From b04b7c79c478743d414a684673519431b022c808 Mon Sep 17 00:00:00 2001
From: Fiona Ebner <f.ebner@proxmox.com>
Date: Fri, 30 May 2025 17:10:59 +0200
Subject: [PATCH 1406/2760] block/io: remove duplicate GLOBAL_STATE_CODE() in
 bdrv_do_drained_end()

Both commit ab61335025 ("block: drain from main loop thread in
bdrv_co_yield_to_drain()") and commit d05ab380db ("block: Mark drain
related functions GRAPH_RDLOCK") introduced a GLOBAL_STATE_CODE()
macro in bdrv_do_drained_end(). The assertion of being in the main
thread cannot change here, so keep only the earlier instance.

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Message-ID: <20250530151125.955508-23-f.ebner@proxmox.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/io.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/block/io.c b/block/io.c
index 4fd7768f9c..ac5c7174f6 100644
--- a/block/io.c
+++ b/block/io.c
@@ -413,7 +413,6 @@ static void bdrv_do_drained_end(BlockDriverState *bs, BdrvChild *parent)
     /* At this point, we should be always running in the main loop. */
     GLOBAL_STATE_CODE();
     assert(bs->quiesce_counter > 0);
-    GLOBAL_STATE_CODE();
 
     /* Re-enable things in child-to-parent order */
     old_quiesce_counter = qatomic_fetch_dec(&bs->quiesce_counter);

From 2e887187454e57d04522099d4f04d17137d6e05c Mon Sep 17 00:00:00 2001
From: Stefan Hajnoczi <stefanha@redhat.com>
Date: Thu, 29 May 2025 16:31:47 -0400
Subject: [PATCH 1407/2760] iotests: fix 240

Commit 2e8e18c2e463 ("virtio-scsi: add iothread-vq-mapping parameter")
removed the limitation that virtio-scsi devices must successfully set
the AioContext on their BlockBackends. This was made possible thanks to
the QEMU multi-queue block layer.

This change broke qemu-iotests 240, which checks that adding a
virtio-scsi device with a drive that is already in another AioContext
will fail.

Update the test to take the relaxed behavior into account. I considered
removing this test case entirely, but the code coverage still seems
valuable.

Fixes: 2e8e18c2e463 ("virtio-scsi: add iothread-vq-mapping parameter")
Reported-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Tested-by: Eric Blake <eblake@redhat.com>
Message-ID: <20250529203147.180338-1-stefanha@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 tests/qemu-iotests/240     | 2 --
 tests/qemu-iotests/240.out | 4 +---
 2 files changed, 1 insertion(+), 5 deletions(-)

diff --git a/tests/qemu-iotests/240 b/tests/qemu-iotests/240
index 9b281e1dc0..f8af9ff648 100755
--- a/tests/qemu-iotests/240
+++ b/tests/qemu-iotests/240
@@ -81,8 +81,6 @@ class TestCase(iotests.QMPTestCase):
 
         self.vm.qmp_log('device_del', id='scsi-hd0')
         self.vm.event_wait('DEVICE_DELETED')
-        self.vm.qmp_log('device_add', id='scsi-hd1', driver='scsi-hd', drive='hd0', bus="scsi1.0")
-
         self.vm.qmp_log('device_del', id='scsi-hd1')
         self.vm.event_wait('DEVICE_DELETED')
         self.vm.qmp_log('blockdev-del', node_name='hd0')
diff --git a/tests/qemu-iotests/240.out b/tests/qemu-iotests/240.out
index 89ed25e506..10dcc42e06 100644
--- a/tests/qemu-iotests/240.out
+++ b/tests/qemu-iotests/240.out
@@ -46,10 +46,8 @@
 {"execute": "device_add", "arguments": {"bus": "scsi0.0", "drive": "hd0", "driver": "scsi-hd", "id": "scsi-hd0"}}
 {"return": {}}
 {"execute": "device_add", "arguments": {"bus": "scsi1.0", "drive": "hd0", "driver": "scsi-hd", "id": "scsi-hd1"}}
-{"error": {"class": "GenericError", "desc": "Cannot change iothread of active block backend"}}
-{"execute": "device_del", "arguments": {"id": "scsi-hd0"}}
 {"return": {}}
-{"execute": "device_add", "arguments": {"bus": "scsi1.0", "drive": "hd0", "driver": "scsi-hd", "id": "scsi-hd1"}}
+{"execute": "device_del", "arguments": {"id": "scsi-hd0"}}
 {"return": {}}
 {"execute": "device_del", "arguments": {"id": "scsi-hd1"}}
 {"return": {}}

From eef2dd03f948a512499775043bdc0c5c88d8a2dd Mon Sep 17 00:00:00 2001
From: Fiona Ebner <f.ebner@proxmox.com>
Date: Fri, 23 May 2025 09:02:11 +0200
Subject: [PATCH 1408/2760] hw/core/qdev-properties-system: Add missing return
 in set_drive_helper()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Currently, changing the 'drive' property of e.g. a scsi-hd object will
result in an assertion failure if the aio context of the block node
it's replaced with doesn't match the current aio context:

> bdrv_replace_child_noperm: Assertion `bdrv_get_aio_context(old_bs) ==
> bdrv_get_aio_context(new_bs)' failed.

The problematic scenario is already detected, but a 'return' statement
was missing.

Cc: qemu-stable@nongnu.org
Fixes: d1a58c176a ("qdev: allow setting drive property for realized device")
Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Message-ID: <20250523070211.280498-1-f.ebner@proxmox.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 hw/core/qdev-properties-system.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/core/qdev-properties-system.c b/hw/core/qdev-properties-system.c
index 8e11e6388b..24e145d870 100644
--- a/hw/core/qdev-properties-system.c
+++ b/hw/core/qdev-properties-system.c
@@ -145,6 +145,7 @@ static void set_drive_helper(Object *obj, Visitor *v, const char *name,
         if (ctx != bdrv_get_aio_context(bs)) {
             error_setg(errp, "Different aio context is not supported for new "
                        "node");
+            return;
         }
 
         blk_replace_bs(blk, bs, errp);

From aca0a504522ec2e5d077bf78a2acdb165f1e0ae2 Mon Sep 17 00:00:00 2001
From: Edmund Raile <edmund.raile@protonmail.com>
Date: Mon, 19 May 2025 11:24:23 +0000
Subject: [PATCH 1409/2760] vfio/igd: OpRegion not found fix error typo
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Edmund Raile <edmund.raile@protonmail.com>
Reviewed-by: Tomita Moeko <tomitamoeko@gmail.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/MFFbQoTpea_CK5ELq8oJ-a3Q57wo7ywQlrIqDvdIDKhUuCm59VUz2QzvdojO5r_wb_7SHifU0Kym3loj4eASPhdzYpjtiMCTePzyg1zrroo=@protonmail.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/igd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/vfio/igd.c b/hw/vfio/igd.c
index e7952d15a0..5b6341c5bf 100644
--- a/hw/vfio/igd.c
+++ b/hw/vfio/igd.c
@@ -203,7 +203,7 @@ static bool vfio_pci_igd_opregion_detect(VFIOPCIDevice *vdev,
                     VFIO_REGION_SUBTYPE_INTEL_IGD_OPREGION, opregion);
     if (ret) {
         error_setg_errno(errp, -ret,
-                         "Device does not supports IGD OpRegion feature");
+                         "Device does not support IGD OpRegion feature");
         return false;
     }
 

From 493a06a2eda3346923f2aab760d8280c78039dc7 Mon Sep 17 00:00:00 2001
From: John Levon <john.levon@nutanix.com>
Date: Tue, 20 May 2025 17:25:30 +0100
Subject: [PATCH 1410/2760] vfio: add more VFIOIOMMUClass docs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add some additional doc comments for these class methods.

Signed-off-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250520162530.2194548-1-john.levon@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 include/hw/vfio/vfio-container-base.h | 75 +++++++++++++++++++++++++--
 1 file changed, 72 insertions(+), 3 deletions(-)

diff --git a/include/hw/vfio/vfio-container-base.h b/include/hw/vfio/vfio-container-base.h
index 3d392b0fd8..f9e561cb08 100644
--- a/include/hw/vfio/vfio-container-base.h
+++ b/include/hw/vfio/vfio-container-base.h
@@ -115,13 +115,56 @@ OBJECT_DECLARE_TYPE(VFIOContainerBase, VFIOIOMMUClass, VFIO_IOMMU)
 struct VFIOIOMMUClass {
     ObjectClass parent_class;
 
-    /* basic feature */
+    /**
+     * @setup
+     *
+     * Perform basic setup of the container, including configuring IOMMU
+     * capabilities, IOVA ranges, supported page sizes, etc.
+     *
+     * @bcontainer: #VFIOContainerBase
+     * @errp: pointer to Error*, to store an error if it happens.
+     *
+     * Returns true to indicate success and false for error.
+     */
     bool (*setup)(VFIOContainerBase *bcontainer, Error **errp);
+
+    /**
+     * @listener_begin
+     *
+     * Called at the beginning of an address space update transaction.
+     * See #MemoryListener.
+     *
+     * @bcontainer: #VFIOContainerBase
+     */
     void (*listener_begin)(VFIOContainerBase *bcontainer);
+
+    /**
+     * @listener_commit
+     *
+     * Called at the end of an address space update transaction,
+     * See #MemoryListener.
+     *
+     * @bcontainer: #VFIOContainerBase
+     */
     void (*listener_commit)(VFIOContainerBase *bcontainer);
+
+    /**
+     * @dma_map
+     *
+     * Map an address range into the container.
+     *
+     * @bcontainer: #VFIOContainerBase to use
+     * @iova: start address to map
+     * @size: size of the range to map
+     * @vaddr: process virtual address of mapping
+     * @readonly: true if mapping should be readonly
+     *
+     * Returns 0 to indicate success and -errno otherwise.
+     */
     int (*dma_map)(const VFIOContainerBase *bcontainer,
                    hwaddr iova, ram_addr_t size,
                    void *vaddr, bool readonly);
+
     /**
      * @dma_unmap
      *
@@ -132,12 +175,38 @@ struct VFIOIOMMUClass {
      * @size: size of the range to unmap
      * @iotlb: The IOMMU TLB mapping entry (or NULL)
      * @unmap_all: if set, unmap the entire address space
+     *
+     * Returns 0 to indicate success and -errno otherwise.
      */
     int (*dma_unmap)(const VFIOContainerBase *bcontainer,
                      hwaddr iova, ram_addr_t size,
                      IOMMUTLBEntry *iotlb, bool unmap_all);
+
+
+    /**
+     * @attach_device
+     *
+     * Associate the given device with a container and do some related
+     * initialization of the device context.
+     *
+     * @name: name of the device
+     * @vbasedev: the device
+     * @as: address space to use
+     * @errp: pointer to Error*, to store an error if it happens.
+     *
+     * Returns true to indicate success and false for error.
+     */
     bool (*attach_device)(const char *name, VFIODevice *vbasedev,
                           AddressSpace *as, Error **errp);
+
+    /*
+     * @detach_device
+     *
+     * Detach the given device from its container and clean up any necessary
+     * state.
+     *
+     * @vbasedev: the device to disassociate
+     */
     void (*detach_device)(VFIODevice *vbasedev);
 
     /* migration feature */
@@ -152,7 +221,7 @@ struct VFIOIOMMUClass {
      * @start: indicates whether to start or stop dirty pages tracking
      * @errp: pointer to Error*, to store an error if it happens.
      *
-     * Returns zero to indicate success and negative for error
+     * Returns zero to indicate success and negative for error.
      */
     int (*set_dirty_page_tracking)(const VFIOContainerBase *bcontainer,
                                    bool start, Error **errp);
@@ -167,7 +236,7 @@ struct VFIOIOMMUClass {
      * @size: size of iova range
      * @errp: pointer to Error*, to store an error if it happens.
      *
-     * Returns zero to indicate success and negative for error
+     * Returns zero to indicate success and negative for error.
      */
     int (*query_dirty_bitmap)(const VFIOContainerBase *bcontainer,
                 VFIOBitmap *vbmap, hwaddr iova, hwaddr size, Error **errp);

From 33528f255a710d394ec692de54baebff1f494b5b Mon Sep 17 00:00:00 2001
From: John Levon <john.levon@nutanix.com>
Date: Tue, 20 May 2025 16:03:51 +0100
Subject: [PATCH 1411/2760] vfio: move more cleanup into vfio_pci_put_device()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

All of the cleanup can be done in the same place, and vfio-user will
want to do the same.

Signed-off-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250520150419.2172078-3-john.levon@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/pci.c | 23 ++++++++++++-----------
 1 file changed, 12 insertions(+), 11 deletions(-)

diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index a1bfdfe375..d96b55f80c 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -2854,6 +2854,18 @@ static bool vfio_populate_device(VFIOPCIDevice *vdev, Error **errp)
 
 static void vfio_pci_put_device(VFIOPCIDevice *vdev)
 {
+    vfio_display_finalize(vdev);
+    vfio_bars_finalize(vdev);
+    g_free(vdev->emulated_config_bits);
+    g_free(vdev->rom);
+    /*
+     * XXX Leaking igd_opregion is not an oversight, we can't remove the
+     * fw_cfg entry therefore leaking this allocation seems like the safest
+     * option.
+     *
+     * g_free(vdev->igd_opregion);
+     */
+
     vfio_device_detach(&vdev->vbasedev);
 
     g_free(vdev->vbasedev.name);
@@ -3302,17 +3314,6 @@ static void vfio_instance_finalize(Object *obj)
 {
     VFIOPCIDevice *vdev = VFIO_PCI_BASE(obj);
 
-    vfio_display_finalize(vdev);
-    vfio_bars_finalize(vdev);
-    g_free(vdev->emulated_config_bits);
-    g_free(vdev->rom);
-    /*
-     * XXX Leaking igd_opregion is not an oversight, we can't remove the
-     * fw_cfg entry therefore leaking this allocation seems like the safest
-     * option.
-     *
-     * g_free(vdev->igd_opregion);
-     */
     vfio_pci_put_device(vdev);
 }
 

From 15399459467ff62fff7e28a554f44364fbf4204d Mon Sep 17 00:00:00 2001
From: John Levon <john.levon@nutanix.com>
Date: Tue, 20 May 2025 16:03:52 +0100
Subject: [PATCH 1412/2760] vfio: move config space read into
 vfio_pci_config_setup()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Small cleanup that reduces duplicate code for vfio-user and reduces the
size of vfio_realize(); while we're here, correct that name to
vfio_pci_realize().

Signed-off-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250520150419.2172078-4-john.levon@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/pci.c | 31 ++++++++++++++++---------------
 1 file changed, 16 insertions(+), 15 deletions(-)

diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index d96b55f80c..a873f82aeb 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -3017,6 +3017,19 @@ static bool vfio_pci_config_setup(VFIOPCIDevice *vdev, Error **errp)
 {
     PCIDevice *pdev = &vdev->pdev;
     VFIODevice *vbasedev = &vdev->vbasedev;
+    uint32_t config_space_size;
+    int ret;
+
+    config_space_size = MIN(pci_config_size(&vdev->pdev), vdev->config_size);
+
+    /* Get a copy of config space */
+    ret = vfio_pci_config_space_read(vdev, 0, config_space_size,
+                                     vdev->pdev.config);
+    if (ret < (int)config_space_size) {
+        ret = ret < 0 ? -ret : EFAULT;
+        error_setg_errno(errp, ret, "failed to read device config space");
+        return false;
+    }
 
     /* vfio emulates a lot for us, but some bits need extra love */
     vdev->emulated_config_bits = g_malloc0(vdev->config_size);
@@ -3138,15 +3151,14 @@ static bool vfio_interrupt_setup(VFIOPCIDevice *vdev, Error **errp)
     return true;
 }
 
-static void vfio_realize(PCIDevice *pdev, Error **errp)
+static void vfio_pci_realize(PCIDevice *pdev, Error **errp)
 {
     ERRP_GUARD();
     VFIOPCIDevice *vdev = VFIO_PCI_BASE(pdev);
     VFIODevice *vbasedev = &vdev->vbasedev;
-    int i, ret;
+    int i;
     char uuid[UUID_STR_LEN];
     g_autofree char *name = NULL;
-    uint32_t config_space_size;
 
     if (vbasedev->fd < 0 && !vbasedev->sysfsdev) {
         if (!(~vdev->host.domain || ~vdev->host.bus ||
@@ -3201,17 +3213,6 @@ static void vfio_realize(PCIDevice *pdev, Error **errp)
         goto error;
     }
 
-    config_space_size = MIN(pci_config_size(&vdev->pdev), vdev->config_size);
-
-    /* Get a copy of config space */
-    ret = vfio_pci_config_space_read(vdev, 0, config_space_size,
-                                     vdev->pdev.config);
-    if (ret < (int)config_space_size) {
-        ret = ret < 0 ? -ret : EFAULT;
-        error_setg_errno(errp, ret, "failed to read device config space");
-        goto error;
-    }
-
     if (!vfio_pci_config_setup(vdev, errp)) {
         goto error;
     }
@@ -3515,7 +3516,7 @@ static void vfio_pci_dev_class_init(ObjectClass *klass, const void *data)
     object_class_property_add_str(klass, "fd", NULL, vfio_pci_set_fd);
 #endif
     dc->desc = "VFIO-based PCI device assignment";
-    pdc->realize = vfio_realize;
+    pdc->realize = vfio_pci_realize;
 
     object_class_property_set_description(klass, /* 1.3 */
                                           "host",

From a483ad534734ad0c9e1fea34d959d0e62838b89e Mon Sep 17 00:00:00 2001
From: John Levon <john.levon@nutanix.com>
Date: Tue, 20 May 2025 16:03:53 +0100
Subject: [PATCH 1413/2760] vfio: refactor out IRQ signalling setup
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This makes for a slightly more readable vfio_msix_vector_do_use()
implementation, and we will rely on this shortly.

Signed-off-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250520150419.2172078-5-john.levon@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/pci.c | 35 ++++++++++++++++++++---------------
 1 file changed, 20 insertions(+), 15 deletions(-)

diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index a873f82aeb..b1250d85bf 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -511,6 +511,25 @@ static void vfio_update_kvm_msi_virq(VFIOMSIVector *vector, MSIMessage msg,
     kvm_irqchip_commit_routes(kvm_state);
 }
 
+static void set_irq_signalling(VFIODevice *vbasedev, VFIOMSIVector *vector,
+                               unsigned int nr)
+{
+    Error *err = NULL;
+    int32_t fd;
+
+    if (vector->virq >= 0) {
+        fd = event_notifier_get_fd(&vector->kvm_interrupt);
+    } else {
+        fd = event_notifier_get_fd(&vector->interrupt);
+    }
+
+    if (!vfio_device_irq_set_signaling(vbasedev, VFIO_PCI_MSIX_IRQ_INDEX, nr,
+                                       VFIO_IRQ_SET_ACTION_TRIGGER,
+                                       fd, &err)) {
+        error_reportf_err(err, VFIO_MSG_PREFIX, vbasedev->name);
+    }
+}
+
 static int vfio_msix_vector_do_use(PCIDevice *pdev, unsigned int nr,
                                    MSIMessage *msg, IOHandler *handler)
 {
@@ -583,21 +602,7 @@ static int vfio_msix_vector_do_use(PCIDevice *pdev, unsigned int nr,
                              strerror(-ret));
             }
         } else {
-            Error *err = NULL;
-            int32_t fd;
-
-            if (vector->virq >= 0) {
-                fd = event_notifier_get_fd(&vector->kvm_interrupt);
-            } else {
-                fd = event_notifier_get_fd(&vector->interrupt);
-            }
-
-            if (!vfio_device_irq_set_signaling(&vdev->vbasedev,
-                                        VFIO_PCI_MSIX_IRQ_INDEX, nr,
-                                        VFIO_IRQ_SET_ACTION_TRIGGER, fd,
-                                        &err)) {
-                error_reportf_err(err, VFIO_MSG_PREFIX, vdev->vbasedev.name);
-            }
+            set_irq_signalling(&vdev->vbasedev, vector, nr);
         }
     }
 

From 1c729ca8860a5197da62d1fa68d6085a6ec0acd3 Mon Sep 17 00:00:00 2001
From: Zhenzhong Duan <zhenzhong.duan@intel.com>
Date: Wed, 21 May 2025 19:03:01 +0800
Subject: [PATCH 1414/2760] vfio/iommufd: Add comment emphasizing no movement
 of hiod->realize() call
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The nested IOMMU support needs device and hwpt id which are generated
only after attachment. Hiod encapsulates these information in realize()
and passes to vIOMMU.

Suggested-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250521110301.3313877-1-zhenzhong.duan@intel.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/iommufd.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/hw/vfio/iommufd.c b/hw/vfio/iommufd.c
index af1c7ab10a..6b2696793f 100644
--- a/hw/vfio/iommufd.c
+++ b/hw/vfio/iommufd.c
@@ -592,6 +592,10 @@ found_container:
         goto err_listener_register;
     }
 
+    /*
+     * Do not move this code before attachment! The nested IOMMU support
+     * needs device and hwpt id which are generated only after attachment.
+     */
     if (!vfio_device_hiod_create_and_realize(vbasedev,
                      TYPE_HOST_IOMMU_DEVICE_IOMMUFD_VFIO, errp)) {
         goto err_listener_register;

From 0992ea07dbb58d347c37d31e65d87893280b7f23 Mon Sep 17 00:00:00 2001
From: Tomita Moeko <tomitamoeko@gmail.com>
Date: Thu, 22 May 2025 23:16:36 +0800
Subject: [PATCH 1415/2760] vfio/igd: Fix incorrect error propagation in
 vfio_pci_igd_opregion_detect()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In vfio_pci_igd_opregion_detect(), errp will be set when the device does
not have OpRegion or is hotplugged. This errp will be propagated to
pci_qdev_realize(), which interprets it as failure, causing unexpected
termination on devices without OpRegion like SR-IOV VFs or discrete
GPUs. Fix it by not setting errp in vfio_pci_igd_opregion_detect().

This patch also checks if the device has OpRegion before hotplug status
to prevent unwanted warning messages on non-IGD devices.

Fixes: c0273e77f2d7 ("vfio/igd: Detect IGD device by OpRegion")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2968
Reported-by: Edmund Raile <edmund.raile@protonmail.com>
Link: https://lore.kernel.org/qemu-devel/30044d14-17ec-46e3-b9c3-63d27a5bde27@gmail.com
Tested-by: Edmund Raile <edmund.raile@protonmail.com>
Signed-off-by: Tomita Moeko <tomitamoeko@gmail.com>
Reviewed-by: Alex Williamson <alex.williamson@redhat.com>
Reviewed-by: Corvin Köhne <c.koehne@beckhoff.com>
Link: https://lore.kernel.org/qemu-devel/20250522151636.20001-1-tomitamoeko@gmail.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/igd.c | 22 ++++++++++------------
 1 file changed, 10 insertions(+), 12 deletions(-)

diff --git a/hw/vfio/igd.c b/hw/vfio/igd.c
index 5b6341c5bf..e7a9d1ffc1 100644
--- a/hw/vfio/igd.c
+++ b/hw/vfio/igd.c
@@ -187,23 +187,21 @@ static bool vfio_pci_igd_opregion_init(VFIOPCIDevice *vdev,
 }
 
 static bool vfio_pci_igd_opregion_detect(VFIOPCIDevice *vdev,
-                                         struct vfio_region_info **opregion,
-                                         Error **errp)
+                                         struct vfio_region_info **opregion)
 {
     int ret;
 
-    /* Hotplugging is not supported for opregion access */
-    if (vdev->pdev.qdev.hotplugged) {
-        error_setg(errp, "IGD OpRegion is not supported on hotplugged device");
-        return false;
-    }
-
     ret = vfio_device_get_region_info_type(&vdev->vbasedev,
                     VFIO_REGION_TYPE_PCI_VENDOR_TYPE | PCI_VENDOR_ID_INTEL,
                     VFIO_REGION_SUBTYPE_INTEL_IGD_OPREGION, opregion);
     if (ret) {
-        error_setg_errno(errp, -ret,
-                         "Device does not support IGD OpRegion feature");
+        return false;
+    }
+
+    /* Hotplugging is not supported for opregion access */
+    if (vdev->pdev.qdev.hotplugged) {
+        warn_report("IGD device detected, but OpRegion is not supported "
+                    "on hotplugged device.");
         return false;
     }
 
@@ -524,7 +522,7 @@ static bool vfio_pci_igd_config_quirk(VFIOPCIDevice *vdev, Error **errp)
     }
 
     /* IGD device always comes with OpRegion */
-    if (!vfio_pci_igd_opregion_detect(vdev, &opregion, errp)) {
+    if (!vfio_pci_igd_opregion_detect(vdev, &opregion)) {
         return true;
     }
     info_report("OpRegion detected on Intel display %x.", vdev->device_id);
@@ -695,7 +693,7 @@ static bool vfio_pci_kvmgt_config_quirk(VFIOPCIDevice *vdev, Error **errp)
         return true;
     }
 
-    if (!vfio_pci_igd_opregion_detect(vdev, &opregion, errp)) {
+    if (!vfio_pci_igd_opregion_detect(vdev, &opregion)) {
         /* Should never reach here, KVMGT always emulates OpRegion */
         return false;
     }

From e3353d63e15d0b1109257d55e265a889e8c508f8 Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Mon, 19 May 2025 06:26:43 -0700
Subject: [PATCH 1416/2760] vfio: return mr from vfio_get_xlat_addr
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Modify memory_get_xlat_addr and vfio_get_xlat_addr to return the memory
region that the translated address is found in.  This will be needed by
CPR in a subsequent patch to map blocks using IOMMU_IOAS_MAP_FILE.

Also return the xlat offset, so we can simplify the interface by removing
the out parameters that can be trivially derived from mr and xlat.

Lastly, rename the functions to  to memory_translate_iotlb() and
vfio_translate_iotlb().

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Acked-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: John Levon <john.levon@nutanix.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Link: https://lore.kernel.org/qemu-devel/1747661203-136490-1-git-send-email-steven.sistare@oracle.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/listener.c      | 33 ++++++++++++++++++++++-----------
 hw/virtio/vhost-vdpa.c  |  9 +++++++--
 include/system/memory.h | 19 +++++++++----------
 system/memory.c         | 32 +++++++-------------------------
 4 files changed, 45 insertions(+), 48 deletions(-)

diff --git a/hw/vfio/listener.c b/hw/vfio/listener.c
index bfacb3d8d9..38e3dc82cf 100644
--- a/hw/vfio/listener.c
+++ b/hw/vfio/listener.c
@@ -90,16 +90,17 @@ static bool vfio_listener_skipped_section(MemoryRegionSection *section)
            section->offset_within_address_space & (1ULL << 63);
 }
 
-/* Called with rcu_read_lock held.  */
-static bool vfio_get_xlat_addr(IOMMUTLBEntry *iotlb, void **vaddr,
-                               ram_addr_t *ram_addr, bool *read_only,
-                               Error **errp)
+/*
+ * Called with rcu_read_lock held.
+ * The returned MemoryRegion must not be accessed after calling rcu_read_unlock.
+ */
+static MemoryRegion *vfio_translate_iotlb(IOMMUTLBEntry *iotlb, hwaddr *xlat_p,
+                                          Error **errp)
 {
-    bool ret, mr_has_discard_manager;
+    MemoryRegion *mr;
 
-    ret = memory_get_xlat_addr(iotlb, vaddr, ram_addr, read_only,
-                               &mr_has_discard_manager, errp);
-    if (ret && mr_has_discard_manager) {
+    mr = memory_translate_iotlb(iotlb, xlat_p, errp);
+    if (mr && memory_region_has_ram_discard_manager(mr)) {
         /*
          * Malicious VMs might trigger discarding of IOMMU-mapped memory. The
          * pages will remain pinned inside vfio until unmapped, resulting in a
@@ -118,7 +119,7 @@ static bool vfio_get_xlat_addr(IOMMUTLBEntry *iotlb, void **vaddr,
                          " intended via an IOMMU. It's possible to mitigate "
                          " by setting/adjusting RLIMIT_MEMLOCK.");
     }
-    return ret;
+    return mr;
 }
 
 static void vfio_iommu_map_notify(IOMMUNotifier *n, IOMMUTLBEntry *iotlb)
@@ -126,6 +127,8 @@ static void vfio_iommu_map_notify(IOMMUNotifier *n, IOMMUTLBEntry *iotlb)
     VFIOGuestIOMMU *giommu = container_of(n, VFIOGuestIOMMU, n);
     VFIOContainerBase *bcontainer = giommu->bcontainer;
     hwaddr iova = iotlb->iova + giommu->iommu_offset;
+    MemoryRegion *mr;
+    hwaddr xlat;
     void *vaddr;
     int ret;
     Error *local_err = NULL;
@@ -150,10 +153,14 @@ static void vfio_iommu_map_notify(IOMMUNotifier *n, IOMMUTLBEntry *iotlb)
     if ((iotlb->perm & IOMMU_RW) != IOMMU_NONE) {
         bool read_only;
 
-        if (!vfio_get_xlat_addr(iotlb, &vaddr, NULL, &read_only, &local_err)) {
+        mr = vfio_translate_iotlb(iotlb, &xlat, &local_err);
+        if (!mr) {
             error_report_err(local_err);
             goto out;
         }
+        vaddr = memory_region_get_ram_ptr(mr) + xlat;
+        read_only = !(iotlb->perm & IOMMU_WO) || mr->readonly;
+
         /*
          * vaddr is only valid until rcu_read_unlock(). But after
          * vfio_dma_map has set up the mapping the pages will be
@@ -1010,6 +1017,8 @@ static void vfio_iommu_map_dirty_notify(IOMMUNotifier *n, IOMMUTLBEntry *iotlb)
     ram_addr_t translated_addr;
     Error *local_err = NULL;
     int ret = -EINVAL;
+    MemoryRegion *mr;
+    hwaddr xlat;
 
     trace_vfio_iommu_map_dirty_notify(iova, iova + iotlb->addr_mask);
 
@@ -1021,9 +1030,11 @@ static void vfio_iommu_map_dirty_notify(IOMMUNotifier *n, IOMMUTLBEntry *iotlb)
     }
 
     rcu_read_lock();
-    if (!vfio_get_xlat_addr(iotlb, NULL, &translated_addr, NULL, &local_err)) {
+    mr = vfio_translate_iotlb(iotlb, &xlat, &local_err);
+    if (!mr) {
         goto out_unlock;
     }
+    translated_addr = memory_region_get_ram_addr(mr) + xlat;
 
     ret = vfio_container_query_dirty_bitmap(bcontainer, iova, iotlb->addr_mask + 1,
                                 translated_addr, &local_err);
diff --git a/hw/virtio/vhost-vdpa.c b/hw/virtio/vhost-vdpa.c
index e20da95f30..7061b6e1a3 100644
--- a/hw/virtio/vhost-vdpa.c
+++ b/hw/virtio/vhost-vdpa.c
@@ -209,6 +209,8 @@ static void vhost_vdpa_iommu_map_notify(IOMMUNotifier *n, IOMMUTLBEntry *iotlb)
     int ret;
     Int128 llend;
     Error *local_err = NULL;
+    MemoryRegion *mr;
+    hwaddr xlat;
 
     if (iotlb->target_as != &address_space_memory) {
         error_report("Wrong target AS \"%s\", only system memory is allowed",
@@ -228,11 +230,14 @@ static void vhost_vdpa_iommu_map_notify(IOMMUNotifier *n, IOMMUTLBEntry *iotlb)
     if ((iotlb->perm & IOMMU_RW) != IOMMU_NONE) {
         bool read_only;
 
-        if (!memory_get_xlat_addr(iotlb, &vaddr, NULL, &read_only, NULL,
-                                  &local_err)) {
+        mr = memory_translate_iotlb(iotlb, &xlat, &local_err);
+        if (!mr) {
             error_report_err(local_err);
             return;
         }
+        vaddr = memory_region_get_ram_ptr(mr) + xlat;
+        read_only = !(iotlb->perm & IOMMU_WO) || mr->readonly;
+
         ret = vhost_vdpa_dma_map(s, VHOST_VDPA_GUEST_PA_ASID, iova,
                                  iotlb->addr_mask + 1, vaddr, read_only);
         if (ret) {
diff --git a/include/system/memory.h b/include/system/memory.h
index fc35a0dcad..0848690ea4 100644
--- a/include/system/memory.h
+++ b/include/system/memory.h
@@ -739,21 +739,20 @@ void ram_discard_manager_unregister_listener(RamDiscardManager *rdm,
                                              RamDiscardListener *rdl);
 
 /**
- * memory_get_xlat_addr: Extract addresses from a TLB entry
+ * memory_translate_iotlb: Extract addresses from a TLB entry.
+ *                         Called with rcu_read_lock held.
  *
  * @iotlb: pointer to an #IOMMUTLBEntry
- * @vaddr: virtual address
- * @ram_addr: RAM address
- * @read_only: indicates if writes are allowed
- * @mr_has_discard_manager: indicates memory is controlled by a
- *                          RamDiscardManager
+ * @xlat_p: return the offset of the entry from the start of the returned
+ *          MemoryRegion.
  * @errp: pointer to Error*, to store an error if it happens.
  *
- * Return: true on success, else false setting @errp with error.
+ * Return: On success, return the MemoryRegion containing the @iotlb translated
+ *         addr.  The MemoryRegion must not be accessed after rcu_read_unlock.
+ *         On failure, return NULL, setting @errp with error.
  */
-bool memory_get_xlat_addr(IOMMUTLBEntry *iotlb, void **vaddr,
-                          ram_addr_t *ram_addr, bool *read_only,
-                          bool *mr_has_discard_manager, Error **errp);
+MemoryRegion *memory_translate_iotlb(IOMMUTLBEntry *iotlb, hwaddr *xlat_p,
+                                     Error **errp);
 
 typedef struct CoalescedMemoryRange CoalescedMemoryRange;
 typedef struct MemoryRegionIoeventfd MemoryRegionIoeventfd;
diff --git a/system/memory.c b/system/memory.c
index 63b983efcd..306e9ff9eb 100644
--- a/system/memory.c
+++ b/system/memory.c
@@ -2174,18 +2174,14 @@ void ram_discard_manager_unregister_listener(RamDiscardManager *rdm,
 }
 
 /* Called with rcu_read_lock held.  */
-bool memory_get_xlat_addr(IOMMUTLBEntry *iotlb, void **vaddr,
-                          ram_addr_t *ram_addr, bool *read_only,
-                          bool *mr_has_discard_manager, Error **errp)
+MemoryRegion *memory_translate_iotlb(IOMMUTLBEntry *iotlb, hwaddr *xlat_p,
+                                     Error **errp)
 {
     MemoryRegion *mr;
     hwaddr xlat;
     hwaddr len = iotlb->addr_mask + 1;
     bool writable = iotlb->perm & IOMMU_WO;
 
-    if (mr_has_discard_manager) {
-        *mr_has_discard_manager = false;
-    }
     /*
      * The IOMMU TLB entry we have just covers translation through
      * this IOMMU to its immediate target.  We need to translate
@@ -2195,7 +2191,7 @@ bool memory_get_xlat_addr(IOMMUTLBEntry *iotlb, void **vaddr,
                                  &xlat, &len, writable, MEMTXATTRS_UNSPECIFIED);
     if (!memory_region_is_ram(mr)) {
         error_setg(errp, "iommu map to non memory area %" HWADDR_PRIx "", xlat);
-        return false;
+        return NULL;
     } else if (memory_region_has_ram_discard_manager(mr)) {
         RamDiscardManager *rdm = memory_region_get_ram_discard_manager(mr);
         MemoryRegionSection tmp = {
@@ -2203,9 +2199,6 @@ bool memory_get_xlat_addr(IOMMUTLBEntry *iotlb, void **vaddr,
             .offset_within_region = xlat,
             .size = int128_make64(len),
         };
-        if (mr_has_discard_manager) {
-            *mr_has_discard_manager = true;
-        }
         /*
          * Malicious VMs can map memory into the IOMMU, which is expected
          * to remain discarded. vfio will pin all pages, populating memory.
@@ -2216,7 +2209,7 @@ bool memory_get_xlat_addr(IOMMUTLBEntry *iotlb, void **vaddr,
             error_setg(errp, "iommu map to discarded memory (e.g., unplugged"
                          " via virtio-mem): %" HWADDR_PRIx "",
                          iotlb->translated_addr);
-            return false;
+            return NULL;
         }
     }
 
@@ -2226,22 +2219,11 @@ bool memory_get_xlat_addr(IOMMUTLBEntry *iotlb, void **vaddr,
      */
     if (len & iotlb->addr_mask) {
         error_setg(errp, "iommu has granularity incompatible with target AS");
-        return false;
+        return NULL;
     }
 
-    if (vaddr) {
-        *vaddr = memory_region_get_ram_ptr(mr) + xlat;
-    }
-
-    if (ram_addr) {
-        *ram_addr = memory_region_get_ram_addr(mr) + xlat;
-    }
-
-    if (read_only) {
-        *read_only = !writable || mr->readonly;
-    }
-
-    return true;
+    *xlat_p = xlat;
+    return mr;
 }
 
 void memory_region_set_log(MemoryRegion *mr, bool log, unsigned client)

From 44d0acf834b090c2717934983ac7678a602b2da5 Mon Sep 17 00:00:00 2001
From: John Levon <john.levon@nutanix.com>
Date: Wed, 21 May 2025 22:55:34 +0100
Subject: [PATCH 1417/2760] vfio/container: pass MemoryRegion to DMA operations
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Pass through the MemoryRegion to DMA operation handlers of vfio
containers. The vfio-user container will need this later, to translate
the vaddr into an offset for the dma map vfio-user message; CPR will
also will need this.

Originally-by: John Johnson <john.g.johnson@oracle.com>
Signed-off-by: Jagannathan Raman <jag.raman@oracle.com>
Signed-off-by: Elena Ufimtseva <elena.ufimtseva@oracle.com>
Signed-off-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Steve Sistare <steven.sistare@oracle.com>
Link: https://lore.kernel.org/qemu-devel/20250521215534.2688540-1-john.levon@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/container-base.c              | 4 ++--
 hw/vfio/container.c                   | 3 ++-
 hw/vfio/iommufd.c                     | 3 ++-
 hw/vfio/listener.c                    | 6 +++---
 include/hw/vfio/vfio-container-base.h | 9 +++++----
 5 files changed, 14 insertions(+), 11 deletions(-)

diff --git a/hw/vfio/container-base.c b/hw/vfio/container-base.c
index 1c6ca94b60..d834bd4822 100644
--- a/hw/vfio/container-base.c
+++ b/hw/vfio/container-base.c
@@ -75,12 +75,12 @@ void vfio_address_space_insert(VFIOAddressSpace *space,
 
 int vfio_container_dma_map(VFIOContainerBase *bcontainer,
                            hwaddr iova, ram_addr_t size,
-                           void *vaddr, bool readonly)
+                           void *vaddr, bool readonly, MemoryRegion *mr)
 {
     VFIOIOMMUClass *vioc = VFIO_IOMMU_GET_CLASS(bcontainer);
 
     g_assert(vioc->dma_map);
-    return vioc->dma_map(bcontainer, iova, size, vaddr, readonly);
+    return vioc->dma_map(bcontainer, iova, size, vaddr, readonly, mr);
 }
 
 int vfio_container_dma_unmap(VFIOContainerBase *bcontainer,
diff --git a/hw/vfio/container.c b/hw/vfio/container.c
index a9f0dbaec4..a8c76eb481 100644
--- a/hw/vfio/container.c
+++ b/hw/vfio/container.c
@@ -207,7 +207,8 @@ static int vfio_legacy_dma_unmap(const VFIOContainerBase *bcontainer,
 }
 
 static int vfio_legacy_dma_map(const VFIOContainerBase *bcontainer, hwaddr iova,
-                               ram_addr_t size, void *vaddr, bool readonly)
+                               ram_addr_t size, void *vaddr, bool readonly,
+                               MemoryRegion *mr)
 {
     const VFIOContainer *container = container_of(bcontainer, VFIOContainer,
                                                   bcontainer);
diff --git a/hw/vfio/iommufd.c b/hw/vfio/iommufd.c
index 6b2696793f..46a3b36301 100644
--- a/hw/vfio/iommufd.c
+++ b/hw/vfio/iommufd.c
@@ -34,7 +34,8 @@
             TYPE_HOST_IOMMU_DEVICE_IOMMUFD "-vfio"
 
 static int iommufd_cdev_map(const VFIOContainerBase *bcontainer, hwaddr iova,
-                            ram_addr_t size, void *vaddr, bool readonly)
+                            ram_addr_t size, void *vaddr, bool readonly,
+                            MemoryRegion *mr)
 {
     const VFIOIOMMUFDContainer *container =
         container_of(bcontainer, VFIOIOMMUFDContainer, bcontainer);
diff --git a/hw/vfio/listener.c b/hw/vfio/listener.c
index 38e3dc82cf..7495866123 100644
--- a/hw/vfio/listener.c
+++ b/hw/vfio/listener.c
@@ -170,7 +170,7 @@ static void vfio_iommu_map_notify(IOMMUNotifier *n, IOMMUTLBEntry *iotlb)
          */
         ret = vfio_container_dma_map(bcontainer, iova,
                                      iotlb->addr_mask + 1, vaddr,
-                                     read_only);
+                                     read_only, mr);
         if (ret) {
             error_report("vfio_container_dma_map(%p, 0x%"HWADDR_PRIx", "
                          "0x%"HWADDR_PRIx", %p) = %d (%s)",
@@ -240,7 +240,7 @@ static int vfio_ram_discard_notify_populate(RamDiscardListener *rdl,
         vaddr = memory_region_get_ram_ptr(section->mr) + start;
 
         ret = vfio_container_dma_map(bcontainer, iova, next - start,
-                                     vaddr, section->readonly);
+                                     vaddr, section->readonly, section->mr);
         if (ret) {
             /* Rollback */
             vfio_ram_discard_notify_discard(rdl, section);
@@ -564,7 +564,7 @@ static void vfio_listener_region_add(MemoryListener *listener,
     }
 
     ret = vfio_container_dma_map(bcontainer, iova, int128_get64(llsize),
-                                 vaddr, section->readonly);
+                                 vaddr, section->readonly, section->mr);
     if (ret) {
         error_setg(&err, "vfio_container_dma_map(%p, 0x%"HWADDR_PRIx", "
                    "0x%"HWADDR_PRIx", %p) = %d (%s)",
diff --git a/include/hw/vfio/vfio-container-base.h b/include/hw/vfio/vfio-container-base.h
index f9e561cb08..3feb773e5f 100644
--- a/include/hw/vfio/vfio-container-base.h
+++ b/include/hw/vfio/vfio-container-base.h
@@ -78,7 +78,7 @@ void vfio_address_space_insert(VFIOAddressSpace *space,
 
 int vfio_container_dma_map(VFIOContainerBase *bcontainer,
                            hwaddr iova, ram_addr_t size,
-                           void *vaddr, bool readonly);
+                           void *vaddr, bool readonly, MemoryRegion *mr);
 int vfio_container_dma_unmap(VFIOContainerBase *bcontainer,
                              hwaddr iova, ram_addr_t size,
                              IOMMUTLBEntry *iotlb, bool unmap_all);
@@ -151,20 +151,21 @@ struct VFIOIOMMUClass {
     /**
      * @dma_map
      *
-     * Map an address range into the container.
+     * Map an address range into the container. Note that the memory region is
+     * referenced within an RCU read lock region across this call.
      *
      * @bcontainer: #VFIOContainerBase to use
      * @iova: start address to map
      * @size: size of the range to map
      * @vaddr: process virtual address of mapping
      * @readonly: true if mapping should be readonly
+     * @mr: the memory region for this mapping
      *
      * Returns 0 to indicate success and -errno otherwise.
      */
     int (*dma_map)(const VFIOContainerBase *bcontainer,
                    hwaddr iova, ram_addr_t size,
-                   void *vaddr, bool readonly);
-
+                   void *vaddr, bool readonly, MemoryRegion *mr);
     /**
      * @dma_unmap
      *

From 5c47679cb6e6d07cdc47b611f719df88308673aa Mon Sep 17 00:00:00 2001
From: Zhenzhong Duan <zhenzhong.duan@intel.com>
Date: Wed, 4 Jun 2025 14:21:12 +0800
Subject: [PATCH 1418/2760] backends/iommufd: Add a helper to invalidate
 user-managed HWPT
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This helper passes cache invalidation request from guest to invalidate
stage-1 page table cache in host hardware.

Signed-off-by: Nicolin Chen <nicolinc@nvidia.com>
Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250604062115.4004200-2-zhenzhong.duan@intel.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 backends/iommufd.c       | 36 ++++++++++++++++++++++++++++++++++++
 backends/trace-events    |  1 +
 include/system/iommufd.h |  4 ++++
 3 files changed, 41 insertions(+)

diff --git a/backends/iommufd.c b/backends/iommufd.c
index b73f75cd0b..8bcdb60fe7 100644
--- a/backends/iommufd.c
+++ b/backends/iommufd.c
@@ -311,6 +311,42 @@ bool iommufd_backend_get_device_info(IOMMUFDBackend *be, uint32_t devid,
     return true;
 }
 
+bool iommufd_backend_invalidate_cache(IOMMUFDBackend *be, uint32_t id,
+                                      uint32_t data_type, uint32_t entry_len,
+                                      uint32_t *entry_num, void *data,
+                                      Error **errp)
+{
+    int ret, fd = be->fd;
+    uint32_t total_entries = *entry_num;
+    struct iommu_hwpt_invalidate cache = {
+        .size = sizeof(cache),
+        .hwpt_id = id,
+        .data_type = data_type,
+        .entry_len = entry_len,
+        .entry_num = total_entries,
+        .data_uptr = (uintptr_t)data,
+    };
+
+    ret = ioctl(fd, IOMMU_HWPT_INVALIDATE, &cache);
+    trace_iommufd_backend_invalidate_cache(fd, id, data_type, entry_len,
+                                           total_entries, cache.entry_num,
+                                           (uintptr_t)data, ret ? errno : 0);
+    *entry_num = cache.entry_num;
+
+    if (ret) {
+        error_setg_errno(errp, errno, "IOMMU_HWPT_INVALIDATE failed:"
+                         " total %d entries, processed %d entries",
+                         total_entries, cache.entry_num);
+    } else if (total_entries != cache.entry_num) {
+        error_setg(errp, "IOMMU_HWPT_INVALIDATE succeed but with unprocessed"
+                         " entries: total %d entries, processed %d entries."
+                         " Kernel BUG?!", total_entries, cache.entry_num);
+        return false;
+    }
+
+    return !ret;
+}
+
 static int hiod_iommufd_get_cap(HostIOMMUDevice *hiod, int cap, Error **errp)
 {
     HostIOMMUDeviceCaps *caps = &hiod->caps;
diff --git a/backends/trace-events b/backends/trace-events
index 40811a3162..7278214ea5 100644
--- a/backends/trace-events
+++ b/backends/trace-events
@@ -18,3 +18,4 @@ iommufd_backend_alloc_hwpt(int iommufd, uint32_t dev_id, uint32_t pt_id, uint32_
 iommufd_backend_free_id(int iommufd, uint32_t id, int ret) " iommufd=%d id=%d (%d)"
 iommufd_backend_set_dirty(int iommufd, uint32_t hwpt_id, bool start, int ret) " iommufd=%d hwpt=%u enable=%d (%d)"
 iommufd_backend_get_dirty_bitmap(int iommufd, uint32_t hwpt_id, uint64_t iova, uint64_t size, uint64_t page_size, int ret) " iommufd=%d hwpt=%u iova=0x%"PRIx64" size=0x%"PRIx64" page_size=0x%"PRIx64" (%d)"
+iommufd_backend_invalidate_cache(int iommufd, uint32_t id, uint32_t data_type, uint32_t entry_len, uint32_t entry_num, uint32_t done_num, uint64_t data_ptr, int ret) " iommufd=%d id=%u data_type=%u entry_len=%u entry_num=%u done_num=%u data_ptr=0x%"PRIx64" (%d)"
diff --git a/include/system/iommufd.h b/include/system/iommufd.h
index cbab75bfbf..83ab8e1e4c 100644
--- a/include/system/iommufd.h
+++ b/include/system/iommufd.h
@@ -61,6 +61,10 @@ bool iommufd_backend_get_dirty_bitmap(IOMMUFDBackend *be, uint32_t hwpt_id,
                                       uint64_t iova, ram_addr_t size,
                                       uint64_t page_size, uint64_t *data,
                                       Error **errp);
+bool iommufd_backend_invalidate_cache(IOMMUFDBackend *be, uint32_t id,
+                                      uint32_t data_type, uint32_t entry_len,
+                                      uint32_t *entry_num, void *data,
+                                      Error **errp);
 
 #define TYPE_HOST_IOMMU_DEVICE_IOMMUFD TYPE_HOST_IOMMU_DEVICE "-iommufd"
 #endif

From 98962d62984440a3905e83492c33a854861def0f Mon Sep 17 00:00:00 2001
From: Zhenzhong Duan <zhenzhong.duan@intel.com>
Date: Wed, 4 Jun 2025 14:21:13 +0800
Subject: [PATCH 1419/2760] vfio/iommufd: Add properties and handlers to
 TYPE_HOST_IOMMU_DEVICE_IOMMUFD
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Enhance HostIOMMUDeviceIOMMUFD object with 3 new members, specific
to the iommufd BE + 2 new class functions.

IOMMUFD BE includes IOMMUFD handle, devid and hwpt_id. IOMMUFD handle
and devid are used to allocate/free ioas and hwpt. hwpt_id is used to
re-attach IOMMUFD backed device to its default VFIO sub-system created
hwpt, i.e., when vIOMMU is disabled by guest. These properties are
initialized in hiod::realize() after attachment.

2 new class functions are [at|de]tach_hwpt(). They are used to
attach/detach hwpt. VFIO and VDPA can have different implementions,
so implementation will be in sub-class instead of HostIOMMUDeviceIOMMUFD,
e.g., in HostIOMMUDeviceIOMMUFDVFIO.

Add two wrappers host_iommu_device_iommufd_[at|de]tach_hwpt to wrap the
two functions.

Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250604062115.4004200-3-zhenzhong.duan@intel.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 backends/iommufd.c       | 22 ++++++++++++++++++
 hw/vfio/iommufd.c        |  6 +++++
 include/system/iommufd.h | 50 ++++++++++++++++++++++++++++++++++++++++
 3 files changed, 78 insertions(+)

diff --git a/backends/iommufd.c b/backends/iommufd.c
index 8bcdb60fe7..c2c47abf7e 100644
--- a/backends/iommufd.c
+++ b/backends/iommufd.c
@@ -347,6 +347,26 @@ bool iommufd_backend_invalidate_cache(IOMMUFDBackend *be, uint32_t id,
     return !ret;
 }
 
+bool host_iommu_device_iommufd_attach_hwpt(HostIOMMUDeviceIOMMUFD *idev,
+                                           uint32_t hwpt_id, Error **errp)
+{
+    HostIOMMUDeviceIOMMUFDClass *idevc =
+        HOST_IOMMU_DEVICE_IOMMUFD_GET_CLASS(idev);
+
+    g_assert(idevc->attach_hwpt);
+    return idevc->attach_hwpt(idev, hwpt_id, errp);
+}
+
+bool host_iommu_device_iommufd_detach_hwpt(HostIOMMUDeviceIOMMUFD *idev,
+                                           Error **errp)
+{
+    HostIOMMUDeviceIOMMUFDClass *idevc =
+        HOST_IOMMU_DEVICE_IOMMUFD_GET_CLASS(idev);
+
+    g_assert(idevc->detach_hwpt);
+    return idevc->detach_hwpt(idev, errp);
+}
+
 static int hiod_iommufd_get_cap(HostIOMMUDevice *hiod, int cap, Error **errp)
 {
     HostIOMMUDeviceCaps *caps = &hiod->caps;
@@ -385,6 +405,8 @@ static const TypeInfo types[] = {
     }, {
         .name = TYPE_HOST_IOMMU_DEVICE_IOMMUFD,
         .parent = TYPE_HOST_IOMMU_DEVICE,
+        .instance_size = sizeof(HostIOMMUDeviceIOMMUFD),
+        .class_size = sizeof(HostIOMMUDeviceIOMMUFDClass),
         .class_init = hiod_iommufd_class_init,
         .abstract = true,
     }
diff --git a/hw/vfio/iommufd.c b/hw/vfio/iommufd.c
index 46a3b36301..625b1747a2 100644
--- a/hw/vfio/iommufd.c
+++ b/hw/vfio/iommufd.c
@@ -819,6 +819,7 @@ static bool hiod_iommufd_vfio_realize(HostIOMMUDevice *hiod, void *opaque,
                                       Error **errp)
 {
     VFIODevice *vdev = opaque;
+    HostIOMMUDeviceIOMMUFD *idev;
     HostIOMMUDeviceCaps *caps = &hiod->caps;
     enum iommu_hw_info_type type;
     union {
@@ -838,6 +839,11 @@ static bool hiod_iommufd_vfio_realize(HostIOMMUDevice *hiod, void *opaque,
     caps->type = type;
     caps->hw_caps = hw_caps;
 
+    idev = HOST_IOMMU_DEVICE_IOMMUFD(hiod);
+    idev->iommufd = vdev->iommufd;
+    idev->devid = vdev->devid;
+    idev->hwpt_id = vdev->hwpt->hwpt_id;
+
     return true;
 }
 
diff --git a/include/system/iommufd.h b/include/system/iommufd.h
index 83ab8e1e4c..283861b924 100644
--- a/include/system/iommufd.h
+++ b/include/system/iommufd.h
@@ -67,4 +67,54 @@ bool iommufd_backend_invalidate_cache(IOMMUFDBackend *be, uint32_t id,
                                       Error **errp);
 
 #define TYPE_HOST_IOMMU_DEVICE_IOMMUFD TYPE_HOST_IOMMU_DEVICE "-iommufd"
+OBJECT_DECLARE_TYPE(HostIOMMUDeviceIOMMUFD, HostIOMMUDeviceIOMMUFDClass,
+                    HOST_IOMMU_DEVICE_IOMMUFD)
+
+/* Overload of the host IOMMU device for the iommufd backend */
+struct HostIOMMUDeviceIOMMUFD {
+    HostIOMMUDevice parent_obj;
+
+    IOMMUFDBackend *iommufd;
+    uint32_t devid;
+    uint32_t hwpt_id;
+};
+
+struct HostIOMMUDeviceIOMMUFDClass {
+    HostIOMMUDeviceClass parent_class;
+
+    /**
+     * @attach_hwpt: attach host IOMMU device to IOMMUFD hardware page table.
+     * VFIO and VDPA device can have different implementation.
+     *
+     * Mandatory callback.
+     *
+     * @idev: host IOMMU device backed by IOMMUFD backend.
+     *
+     * @hwpt_id: ID of IOMMUFD hardware page table.
+     *
+     * @errp: pass an Error out when attachment fails.
+     *
+     * Returns: true on success, false on failure.
+     */
+    bool (*attach_hwpt)(HostIOMMUDeviceIOMMUFD *idev, uint32_t hwpt_id,
+                        Error **errp);
+    /**
+     * @detach_hwpt: detach host IOMMU device from IOMMUFD hardware page table.
+     * VFIO and VDPA device can have different implementation.
+     *
+     * Mandatory callback.
+     *
+     * @idev: host IOMMU device backed by IOMMUFD backend.
+     *
+     * @errp: pass an Error out when attachment fails.
+     *
+     * Returns: true on success, false on failure.
+     */
+    bool (*detach_hwpt)(HostIOMMUDeviceIOMMUFD *idev, Error **errp);
+};
+
+bool host_iommu_device_iommufd_attach_hwpt(HostIOMMUDeviceIOMMUFD *idev,
+                                           uint32_t hwpt_id, Error **errp);
+bool host_iommu_device_iommufd_detach_hwpt(HostIOMMUDeviceIOMMUFD *idev,
+                                           Error **errp);
 #endif

From e50a3ead976d23bd1b4fdf50baea8df2303128a5 Mon Sep 17 00:00:00 2001
From: Zhenzhong Duan <zhenzhong.duan@intel.com>
Date: Wed, 4 Jun 2025 14:21:14 +0800
Subject: [PATCH 1420/2760] vfio/iommufd: Implement [at|de]tach_hwpt handlers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Implement [at|de]tach_hwpt handlers in VFIO subsystem. vIOMMU
utilizes them to attach to or detach from hwpt on host side.

Signed-off-by: Yi Liu <yi.l.liu@intel.com>
Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Nicolin Chen <nicolinc@nvidia.com>
Link: https://lore.kernel.org/qemu-devel/20250604062115.4004200-4-zhenzhong.duan@intel.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/iommufd.c | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/hw/vfio/iommufd.c b/hw/vfio/iommufd.c
index 625b1747a2..5903302837 100644
--- a/hw/vfio/iommufd.c
+++ b/hw/vfio/iommufd.c
@@ -815,6 +815,24 @@ static void vfio_iommu_iommufd_class_init(ObjectClass *klass, const void *data)
     vioc->query_dirty_bitmap = iommufd_query_dirty_bitmap;
 };
 
+static bool
+host_iommu_device_iommufd_vfio_attach_hwpt(HostIOMMUDeviceIOMMUFD *idev,
+                                           uint32_t hwpt_id, Error **errp)
+{
+    VFIODevice *vbasedev = HOST_IOMMU_DEVICE(idev)->agent;
+
+    return !iommufd_cdev_attach_ioas_hwpt(vbasedev, hwpt_id, errp);
+}
+
+static bool
+host_iommu_device_iommufd_vfio_detach_hwpt(HostIOMMUDeviceIOMMUFD *idev,
+                                           Error **errp)
+{
+    VFIODevice *vbasedev = HOST_IOMMU_DEVICE(idev)->agent;
+
+    return iommufd_cdev_detach_ioas_hwpt(vbasedev, errp);
+}
+
 static bool hiod_iommufd_vfio_realize(HostIOMMUDevice *hiod, void *opaque,
                                       Error **errp)
 {
@@ -869,10 +887,14 @@ hiod_iommufd_vfio_get_page_size_mask(HostIOMMUDevice *hiod)
 static void hiod_iommufd_vfio_class_init(ObjectClass *oc, const void *data)
 {
     HostIOMMUDeviceClass *hiodc = HOST_IOMMU_DEVICE_CLASS(oc);
+    HostIOMMUDeviceIOMMUFDClass *idevc = HOST_IOMMU_DEVICE_IOMMUFD_CLASS(oc);
 
     hiodc->realize = hiod_iommufd_vfio_realize;
     hiodc->get_iova_ranges = hiod_iommufd_vfio_get_iova_ranges;
     hiodc->get_page_size_mask = hiod_iommufd_vfio_get_page_size_mask;
+
+    idevc->attach_hwpt = host_iommu_device_iommufd_vfio_attach_hwpt;
+    idevc->detach_hwpt = host_iommu_device_iommufd_vfio_detach_hwpt;
 };
 
 static const TypeInfo types[] = {

From 1ab3d93fd24b9ca0f415bb7ef38c4a4e2e9e62ef Mon Sep 17 00:00:00 2001
From: Zhenzhong Duan <zhenzhong.duan@intel.com>
Date: Wed, 4 Jun 2025 14:21:15 +0800
Subject: [PATCH 1421/2760] vfio/iommufd: Save vendor specific device info
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Some device information returned by ioctl(IOMMU_GET_HW_INFO) are vendor
specific. Save them as raw data in a union supporting different vendors,
then vendor IOMMU can query the raw data with its fixed format for
capability directly.

Because IOMMU_GET_HW_INFO is only supported in linux, so declare those
capability related structures with CONFIG_LINUX.

Suggested-by: Eric Auger <eric.auger@redhat.com>
Suggested-by: Nicolin Chen <nicolinc@nvidia.com>
Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: Nicolin Chen <nicolinc@nvidia.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250604062115.4004200-5-zhenzhong.duan@intel.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/iommufd.c                  |  8 +++-----
 include/system/host_iommu_device.h | 15 +++++++++++++++
 2 files changed, 18 insertions(+), 5 deletions(-)

diff --git a/hw/vfio/iommufd.c b/hw/vfio/iommufd.c
index 5903302837..c4bbf36241 100644
--- a/hw/vfio/iommufd.c
+++ b/hw/vfio/iommufd.c
@@ -839,16 +839,14 @@ static bool hiod_iommufd_vfio_realize(HostIOMMUDevice *hiod, void *opaque,
     VFIODevice *vdev = opaque;
     HostIOMMUDeviceIOMMUFD *idev;
     HostIOMMUDeviceCaps *caps = &hiod->caps;
+    VendorCaps *vendor_caps = &caps->vendor_caps;
     enum iommu_hw_info_type type;
-    union {
-        struct iommu_hw_info_vtd vtd;
-    } data;
     uint64_t hw_caps;
 
     hiod->agent = opaque;
 
-    if (!iommufd_backend_get_device_info(vdev->iommufd, vdev->devid,
-                                         &type, &data, sizeof(data),
+    if (!iommufd_backend_get_device_info(vdev->iommufd, vdev->devid, &type,
+                                         vendor_caps, sizeof(*vendor_caps),
                                          &hw_caps, errp)) {
         return false;
     }
diff --git a/include/system/host_iommu_device.h b/include/system/host_iommu_device.h
index 809cced4ba..ab849a4a82 100644
--- a/include/system/host_iommu_device.h
+++ b/include/system/host_iommu_device.h
@@ -14,6 +14,13 @@
 
 #include "qom/object.h"
 #include "qapi/error.h"
+#ifdef CONFIG_LINUX
+#include "linux/iommufd.h"
+
+typedef union VendorCaps {
+    struct iommu_hw_info_vtd vtd;
+    struct iommu_hw_info_arm_smmuv3 smmuv3;
+} VendorCaps;
 
 /**
  * struct HostIOMMUDeviceCaps - Define host IOMMU device capabilities.
@@ -22,11 +29,17 @@
  *
  * @hw_caps: host platform IOMMU capabilities (e.g. on IOMMUFD this represents
  *           the @out_capabilities value returned from IOMMU_GET_HW_INFO ioctl)
+ *
+ * @vendor_caps: host platform IOMMU vendor specific capabilities (e.g. on
+ *               IOMMUFD this represents a user-space buffer filled by kernel
+ *               with host IOMMU @type specific hardware information data)
  */
 typedef struct HostIOMMUDeviceCaps {
     uint32_t type;
     uint64_t hw_caps;
+    VendorCaps vendor_caps;
 } HostIOMMUDeviceCaps;
+#endif
 
 #define TYPE_HOST_IOMMU_DEVICE "host-iommu-device"
 OBJECT_DECLARE_TYPE(HostIOMMUDevice, HostIOMMUDeviceClass, HOST_IOMMU_DEVICE)
@@ -38,7 +51,9 @@ struct HostIOMMUDevice {
     void *agent; /* pointer to agent device, ie. VFIO or VDPA device */
     PCIBus *aliased_bus;
     int aliased_devfn;
+#ifdef CONFIG_LINUX
     HostIOMMUDeviceCaps caps;
+#endif
 };
 
 /**

From 9942c711835f06805e82fbe9d1da98f6ff7b9311 Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Thu, 29 May 2025 12:23:57 -0700
Subject: [PATCH 1422/2760] MAINTAINERS: Add reviewer for CPR
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

CPR is integrated with live migration, and has the same maintainers.
But, add a CPR section to add a reviewer.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/1748546679-154091-2-git-send-email-steven.sistare@oracle.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 MAINTAINERS | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/MAINTAINERS b/MAINTAINERS
index 16af37986a..b189701357 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3032,6 +3032,15 @@ F: include/qemu/co-shared-resource.h
 T: git https://gitlab.com/jsnow/qemu.git jobs
 T: git https://gitlab.com/vsementsov/qemu.git block
 
+CheckPoint and Restart (CPR)
+R: Steve Sistare <steven.sistare@oracle.com>
+S: Supported
+F: hw/vfio/cpr*
+F: include/migration/cpr.h
+F: migration/cpr*
+F: tests/qtest/migration/cpr*
+F: docs/devel/migration/CPR.rst
+
 Compute Express Link
 M: Jonathan Cameron <jonathan.cameron@huawei.com>
 R: Fan Ni <fan.ni@samsung.com>

From 2372f8d94ae27b1b8a1c5704c668baabd48d1c99 Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Thu, 29 May 2025 12:24:03 -0700
Subject: [PATCH 1423/2760] vfio: vfio_find_ram_discard_listener
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Define vfio_find_ram_discard_listener as a subroutine so additional calls to
it may be added in a subsequent patch.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Link: https://lore.kernel.org/qemu-devel/1748546679-154091-8-git-send-email-steven.sistare@oracle.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/listener.c                    | 35 +++++++++++++++++----------
 include/hw/vfio/vfio-container-base.h |  3 +++
 2 files changed, 25 insertions(+), 13 deletions(-)

diff --git a/hw/vfio/listener.c b/hw/vfio/listener.c
index 7495866123..203ed0314e 100644
--- a/hw/vfio/listener.c
+++ b/hw/vfio/listener.c
@@ -456,6 +456,26 @@ static void vfio_device_error_append(VFIODevice *vbasedev, Error **errp)
     }
 }
 
+VFIORamDiscardListener *vfio_find_ram_discard_listener(
+    VFIOContainerBase *bcontainer, MemoryRegionSection *section)
+{
+    VFIORamDiscardListener *vrdl = NULL;
+
+    QLIST_FOREACH(vrdl, &bcontainer->vrdl_list, next) {
+        if (vrdl->mr == section->mr &&
+            vrdl->offset_within_address_space ==
+            section->offset_within_address_space) {
+            break;
+        }
+    }
+
+    if (!vrdl) {
+        hw_error("vfio: Trying to sync missing RAM discard listener");
+        /* does not return */
+    }
+    return vrdl;
+}
+
 static void vfio_listener_region_add(MemoryListener *listener,
                                      MemoryRegionSection *section)
 {
@@ -1086,19 +1106,8 @@ vfio_sync_ram_discard_listener_dirty_bitmap(VFIOContainerBase *bcontainer,
                                             MemoryRegionSection *section)
 {
     RamDiscardManager *rdm = memory_region_get_ram_discard_manager(section->mr);
-    VFIORamDiscardListener *vrdl = NULL;
-
-    QLIST_FOREACH(vrdl, &bcontainer->vrdl_list, next) {
-        if (vrdl->mr == section->mr &&
-            vrdl->offset_within_address_space ==
-            section->offset_within_address_space) {
-            break;
-        }
-    }
-
-    if (!vrdl) {
-        hw_error("vfio: Trying to sync missing RAM discard listener");
-    }
+    VFIORamDiscardListener *vrdl =
+        vfio_find_ram_discard_listener(bcontainer, section);
 
     /*
      * We only want/can synchronize the bitmap for actually mapped parts -
diff --git a/include/hw/vfio/vfio-container-base.h b/include/hw/vfio/vfio-container-base.h
index 3feb773e5f..9d37f86115 100644
--- a/include/hw/vfio/vfio-container-base.h
+++ b/include/hw/vfio/vfio-container-base.h
@@ -253,4 +253,7 @@ struct VFIOIOMMUClass {
     void (*release)(VFIOContainerBase *bcontainer);
 };
 
+VFIORamDiscardListener *vfio_find_ram_discard_listener(
+    VFIOContainerBase *bcontainer, MemoryRegionSection *section);
+
 #endif /* HW_VFIO_VFIO_CONTAINER_BASE_H */

From 3ed34463a2d8ab8aabfa1d612f12b56600c87983 Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Thu, 29 May 2025 12:24:04 -0700
Subject: [PATCH 1424/2760] vfio: move vfio-cpr.h
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Move vfio-cpr.h to include/hw/vfio, because it will need to be included by
other files there.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Link: https://lore.kernel.org/qemu-devel/1748546679-154091-9-git-send-email-steven.sistare@oracle.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 MAINTAINERS                |  1 +
 hw/vfio/container.c        |  2 +-
 hw/vfio/cpr.c              |  2 +-
 hw/vfio/iommufd.c          |  2 +-
 hw/vfio/vfio-cpr.h         | 15 ---------------
 include/hw/vfio/vfio-cpr.h | 18 ++++++++++++++++++
 6 files changed, 22 insertions(+), 18 deletions(-)
 delete mode 100644 hw/vfio/vfio-cpr.h
 create mode 100644 include/hw/vfio/vfio-cpr.h

diff --git a/MAINTAINERS b/MAINTAINERS
index b189701357..aa6763077e 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3036,6 +3036,7 @@ CheckPoint and Restart (CPR)
 R: Steve Sistare <steven.sistare@oracle.com>
 S: Supported
 F: hw/vfio/cpr*
+F: include/hw/vfio/vfio-cpr.h
 F: include/migration/cpr.h
 F: migration/cpr*
 F: tests/qtest/migration/cpr*
diff --git a/hw/vfio/container.c b/hw/vfio/container.c
index a8c76eb481..0f948d0247 100644
--- a/hw/vfio/container.c
+++ b/hw/vfio/container.c
@@ -33,8 +33,8 @@
 #include "qapi/error.h"
 #include "pci.h"
 #include "hw/vfio/vfio-container.h"
+#include "hw/vfio/vfio-cpr.h"
 #include "vfio-helpers.h"
-#include "vfio-cpr.h"
 #include "vfio-listener.h"
 
 #define TYPE_HOST_IOMMU_DEVICE_LEGACY_VFIO TYPE_HOST_IOMMU_DEVICE "-legacy-vfio"
diff --git a/hw/vfio/cpr.c b/hw/vfio/cpr.c
index 3214184f97..0210e76a10 100644
--- a/hw/vfio/cpr.c
+++ b/hw/vfio/cpr.c
@@ -8,9 +8,9 @@
 #include "qemu/osdep.h"
 #include "hw/vfio/vfio-device.h"
 #include "migration/misc.h"
+#include "hw/vfio/vfio-cpr.h"
 #include "qapi/error.h"
 #include "system/runstate.h"
-#include "vfio-cpr.h"
 
 static int vfio_cpr_reboot_notifier(NotifierWithReturn *notifier,
                                     MigrationEvent *e, Error **errp)
diff --git a/hw/vfio/iommufd.c b/hw/vfio/iommufd.c
index c4bbf36241..d3efef71af 100644
--- a/hw/vfio/iommufd.c
+++ b/hw/vfio/iommufd.c
@@ -21,13 +21,13 @@
 #include "qapi/error.h"
 #include "system/iommufd.h"
 #include "hw/qdev-core.h"
+#include "hw/vfio/vfio-cpr.h"
 #include "system/reset.h"
 #include "qemu/cutils.h"
 #include "qemu/chardev_open.h"
 #include "pci.h"
 #include "vfio-iommufd.h"
 #include "vfio-helpers.h"
-#include "vfio-cpr.h"
 #include "vfio-listener.h"
 
 #define TYPE_HOST_IOMMU_DEVICE_IOMMUFD_VFIO             \
diff --git a/hw/vfio/vfio-cpr.h b/hw/vfio/vfio-cpr.h
deleted file mode 100644
index 134b83a624..0000000000
--- a/hw/vfio/vfio-cpr.h
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * VFIO CPR
- *
- * Copyright (c) 2025 Oracle and/or its affiliates.
- *
- * SPDX-License-Identifier: GPL-2.0-or-later
- */
-
-#ifndef HW_VFIO_CPR_H
-#define HW_VFIO_CPR_H
-
-bool vfio_cpr_register_container(VFIOContainerBase *bcontainer, Error **errp);
-void vfio_cpr_unregister_container(VFIOContainerBase *bcontainer);
-
-#endif /* HW_VFIO_CPR_H */
diff --git a/include/hw/vfio/vfio-cpr.h b/include/hw/vfio/vfio-cpr.h
new file mode 100644
index 0000000000..750ea5bcea
--- /dev/null
+++ b/include/hw/vfio/vfio-cpr.h
@@ -0,0 +1,18 @@
+/*
+ * VFIO CPR
+ *
+ * Copyright (c) 2025 Oracle and/or its affiliates.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef HW_VFIO_VFIO_CPR_H
+#define HW_VFIO_VFIO_CPR_H
+
+struct VFIOContainerBase;
+
+bool vfio_cpr_register_container(struct VFIOContainerBase *bcontainer,
+                                 Error **errp);
+void vfio_cpr_unregister_container(struct VFIOContainerBase *bcontainer);
+
+#endif /* HW_VFIO_VFIO_CPR_H */

From dc955052b400572dcfed896532d2b0dcf9d111f5 Mon Sep 17 00:00:00 2001
From: John Snow <jsnow@redhat.com>
Date: Wed, 4 Jun 2025 16:03:49 -0400
Subject: [PATCH 1425/2760] qapi: Add some pylint ignores

This restores the linting baseline in QAPI.

Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Message-id: 20250604200354.459501-2-jsnow@redhat.com
---
 scripts/qapi/backend.py | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/scripts/qapi/backend.py b/scripts/qapi/backend.py
index 14e60aa67a..49ae6ecdd3 100644
--- a/scripts/qapi/backend.py
+++ b/scripts/qapi/backend.py
@@ -13,6 +13,7 @@ from .visit import gen_visit
 
 
 class QAPIBackend(ABC):
+    # pylint: disable=too-few-public-methods
 
     @abstractmethod
     def generate(self,
@@ -36,6 +37,7 @@ class QAPIBackend(ABC):
 
 
 class QAPICBackend(QAPIBackend):
+    # pylint: disable=too-few-public-methods
 
     def generate(self,
                  schema: QAPISchema,

From a738817c1ddb1730cf144e444d367b5d37e4a4dd Mon Sep 17 00:00:00 2001
From: John Snow <jsnow@redhat.com>
Date: Wed, 4 Jun 2025 16:03:50 -0400
Subject: [PATCH 1426/2760] docs/qapidoc: linting fixes

This restores the linting baseline in qapidoc. The order of some imports
change slightly here due to configuring isort a little better:
previously, isort was having difficulty understanding that "compat" and
"qapidoc_legacy" were local modules because docs/sphinx "isn't a python
package". Configuring this manually, isort chooses a different import
ordering, which _is_ intentional here.

Also: extra ignores are added for pylint. The most recent versions of
pylint don't require these ignores, but the oldest versions we support
do, so in the extra ignores go.

Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Message-id: 20250604200354.459501-3-jsnow@redhat.com
---
 docs/sphinx/qapi_domain.py | 25 ++++++++++++++-----------
 docs/sphinx/qapidoc.py     |  5 +++--
 2 files changed, 17 insertions(+), 13 deletions(-)

diff --git a/docs/sphinx/qapi_domain.py b/docs/sphinx/qapi_domain.py
index c94af5719c..ebc46a72c6 100644
--- a/docs/sphinx/qapi_domain.py
+++ b/docs/sphinx/qapi_domain.py
@@ -20,16 +20,6 @@ from typing import (
 
 from docutils import nodes
 from docutils.parsers.rst import directives
-
-from compat import (
-    CompatField,
-    CompatGroupedField,
-    CompatTypedField,
-    KeywordNode,
-    ParserFix,
-    Signature,
-    SpaceNode,
-)
 from sphinx import addnodes
 from sphinx.directives import ObjectDescription
 from sphinx.domains import (
@@ -44,6 +34,16 @@ from sphinx.util import logging
 from sphinx.util.docutils import SphinxDirective
 from sphinx.util.nodes import make_id, make_refnode
 
+from compat import (
+    CompatField,
+    CompatGroupedField,
+    CompatTypedField,
+    KeywordNode,
+    ParserFix,
+    Signature,
+    SpaceNode,
+)
+
 
 if TYPE_CHECKING:
     from typing import (
@@ -56,7 +56,6 @@ if TYPE_CHECKING:
     )
 
     from docutils.nodes import Element, Node
-
     from sphinx.addnodes import desc_signature, pending_xref
     from sphinx.application import Sphinx
     from sphinx.builders import Builder
@@ -168,6 +167,8 @@ class QAPIDescription(ParserFix):
     """
 
     def handle_signature(self, sig: str, signode: desc_signature) -> Signature:
+        # pylint: disable=unused-argument
+
         # Do nothing. The return value here is the "name" of the entity
         # being documented; for QAPI, this is the same as the
         # "signature", which is just a name.
@@ -210,6 +211,8 @@ class QAPIDescription(ParserFix):
     def add_target_and_index(
         self, name: Signature, sig: str, signode: desc_signature
     ) -> None:
+        # pylint: disable=unused-argument
+
         # name is the return value of handle_signature.
         # sig is the original, raw text argument to handle_signature.
         # For QAPI, these are identical, currently.
diff --git a/docs/sphinx/qapidoc.py b/docs/sphinx/qapidoc.py
index 661b2c4ed0..8011ac9efa 100644
--- a/docs/sphinx/qapidoc.py
+++ b/docs/sphinx/qapidoc.py
@@ -27,6 +27,7 @@ https://www.sphinx-doc.org/en/master/development/index.html
 
 from __future__ import annotations
 
+
 __version__ = "2.0"
 
 from contextlib import contextmanager
@@ -56,8 +57,6 @@ from qapi.schema import (
     QAPISchemaVisitor,
 )
 from qapi.source import QAPISourceInfo
-
-from qapidoc_legacy import QAPISchemaGenRSTVisitor  # type: ignore
 from sphinx import addnodes
 from sphinx.directives.code import CodeBlock
 from sphinx.errors import ExtensionError
@@ -65,6 +64,8 @@ from sphinx.util import logging
 from sphinx.util.docutils import SphinxDirective, switch_source_input
 from sphinx.util.nodes import nested_parse_with_titles
 
+from qapidoc_legacy import QAPISchemaGenRSTVisitor  # type: ignore
+
 
 if TYPE_CHECKING:
     from typing import (

From 4b77e5d7b8b6377f7433de886b98bf64a5fcc663 Mon Sep 17 00:00:00 2001
From: John Snow <jsnow@redhat.com>
Date: Wed, 4 Jun 2025 16:03:51 -0400
Subject: [PATCH 1427/2760] python: update missing dependencies from minreqs

We pin all dependencies for the "check-minreqs" test because pip lacks a
dependency resolver that installs "the oldest possible package that
meets dependency criteria". So, in order to test our stated minimum
requirements, we pin all of our dependencies (and their dependencies,
transitively) at the oldest possible versions that still work and pass
tests; proving that our minimum requirements are correct.

(It also ensures no new features accidentally sneak in from developers
on newer platforms.)

A few transitive dependencies were omitted from the pinned dependency
file by accident; as a result, pip's dependency solver can pull in newer
dependencies, which we don't want. This patch corrects the previous
oversight and pins the missing dependencies.

Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Message-id: 20250604200354.459501-4-jsnow@redhat.com
---
 python/tests/minreqs.txt | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/python/tests/minreqs.txt b/python/tests/minreqs.txt
index 6445407ba8..d3d53e0da8 100644
--- a/python/tests/minreqs.txt
+++ b/python/tests/minreqs.txt
@@ -38,10 +38,14 @@ pyflakes==2.5.0
 
 # Transitive mypy dependencies
 mypy-extensions==1.0.0
+tomli==1.1.0
 typing-extensions==4.7.1
 
 # Transitive pylint dependencies
 astroid==2.15.4
+dill==0.2
 lazy-object-proxy==1.4.0
+platformdirs==2.2.0
 toml==0.10.0
+tomlkit==0.10.1
 wrapt==1.14.0

From 65aa0a1780d59ea2b07da6e3626b98eca8b163d1 Mon Sep 17 00:00:00 2001
From: John Snow <jsnow@redhat.com>
Date: Wed, 4 Jun 2025 16:03:52 -0400
Subject: [PATCH 1428/2760] python: add qapi static analysis tests

Update the python tests to also check QAPI and the QAPI Sphinx
extensions. The docs/sphinx/qapidoc_legacy.py file is not included in
these checks, as it is destined for removal soon. mypy is also not
called on the QAPI Sphinx extensions, owing to difficulties supporting
Sphinx 3.x - 8.x while maintaining static type checking support. mypy
*is* called on all of the QAPI tools themselves, though.

flake8, isort and mypy use the tool configuration from the existing
python directory (in setup.cfg). pylint continues to use the special
configuration located in scripts/qapi/ - that configuration is more
permissive. If we wish to unify the two configurations, that's a
separate series and a discussion for a later date.

The list of pylint ignores is also updated, owing again to the wide
window of pylint version support: newer versions require pragmas to
occasionally silence the "too many positional arguments" warning, but
older versions do not have such a warning category and will instead yelp
about an unrecognized option. Silence that warning, too.

As a result of this patch, one would be able to run any of the following
tests locally from the qemu.git/python directory and have it cover the
QAPI tooling as well. All of the following options run the python tests,
static analysis tests, and linter checks; but with different
combinations of dependencies and interpreters.

- "make check-minreqs" Run tests specifically under our oldest supported
  Python and our oldest supported dependencies. This is the test that
  runs on GitLab as "check-python-minreqs". This helps ensure we do not
  regress support on older platforms accidentally.

- "make check-tox" Runs the tests under the newest supported
  dependencies, but under each supported version of Python in turn. At
  time of writing, this is Python 3.8 to 3.13 inclusive. This test helps
  catch bleeding-edge problems before they become problems for developer
  workstations. This is the GitLab test "check-python-tox" and is an
  optionally run, may-fail test due to the unpredictable nature of new
  dependencies being released into the ecosystem that may cause
  regressions.

- "make check-dev" Runs the tests under the newest supported
  dependencies using whatever version of Python the user happens to have
  installed. This is a quick convenience check that does not map to any
  particular GitLab test.

  (Note! check-dev may be busted on Fedora 41 and bleeding edge versions
  of setuptools. That's unrelated to this patch and I'll address it
  separately and soon. Thank you for your patience, --mgmt)

Finally, finally, finally: this means that QAPI tooling will be linted
and type-checked from the GitLab pipelines.

Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Message-id: 20250604200354.459501-5-jsnow@redhat.com
[Edited license choice per review --js]
Signed-off-by: John Snow <jsnow@redhat.com>
---
 python/setup.cfg            |  1 +
 python/tests/minreqs.txt    | 27 +++++++++++++++++++++++++++
 python/tests/qapi-flake8.sh |  6 ++++++
 python/tests/qapi-isort.sh  |  8 ++++++++
 python/tests/qapi-mypy.sh   |  4 ++++
 python/tests/qapi-pylint.sh |  8 ++++++++
 scripts/qapi/pylintrc       |  1 +
 7 files changed, 55 insertions(+)
 create mode 100755 python/tests/qapi-flake8.sh
 create mode 100755 python/tests/qapi-isort.sh
 create mode 100755 python/tests/qapi-mypy.sh
 create mode 100755 python/tests/qapi-pylint.sh

diff --git a/python/setup.cfg b/python/setup.cfg
index c48dff280a..d21304cadd 100644
--- a/python/setup.cfg
+++ b/python/setup.cfg
@@ -46,6 +46,7 @@ devel =
     urwid >= 2.1.2
     urwid-readline >= 0.13
     Pygments >= 2.9.0
+    sphinx >= 3.4.3
 
 # Provides qom-fuse functionality
 fuse =
diff --git a/python/tests/minreqs.txt b/python/tests/minreqs.txt
index d3d53e0da8..cd2e2a81c3 100644
--- a/python/tests/minreqs.txt
+++ b/python/tests/minreqs.txt
@@ -11,6 +11,15 @@
 # When adding new dependencies, pin the very oldest non-yanked version
 # on PyPI that allows the test suite to pass.
 
+# For some reason, the presence of packaging==14.0 below requires us to
+# also pin setuptools to version 70 or below. Otherwise, the
+# installation of the QEMU package itself fails, failing to find
+# setuptools.
+setuptools<=70
+
+# Dependencies for qapidoc/qapi_domain et al
+sphinx==3.4.3
+
 # Dependencies for the TUI addon (Required for successful linting)
 urwid==2.1.2
 urwid-readline==0.13
@@ -49,3 +58,21 @@ platformdirs==2.2.0
 toml==0.10.0
 tomlkit==0.10.1
 wrapt==1.14.0
+
+# Transitive sphinx dependencies
+Jinja2==2.7
+MarkupSafe==1.1.0
+alabaster==0.7.1
+babel==1.3
+docutils==0.12
+imagesize==0.5.0
+packaging==14.0
+pytz==2011b0
+requests==2.5.0
+snowballstemmer==1.1
+sphinxcontrib-applehelp==1.0.0
+sphinxcontrib-devhelp==1.0.0
+sphinxcontrib-htmlhelp==1.0.0
+sphinxcontrib-jsmath==1.0.0
+sphinxcontrib-qthelp==1.0.0
+sphinxcontrib-serializinghtml==1.0.0
diff --git a/python/tests/qapi-flake8.sh b/python/tests/qapi-flake8.sh
new file mode 100755
index 0000000000..c69f9ea2e0
--- /dev/null
+++ b/python/tests/qapi-flake8.sh
@@ -0,0 +1,6 @@
+#!/bin/sh -e
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+python3 -m flake8 ../scripts/qapi/ \
+        ../docs/sphinx/qapidoc.py \
+        ../docs/sphinx/qapi_domain.py
diff --git a/python/tests/qapi-isort.sh b/python/tests/qapi-isort.sh
new file mode 100755
index 0000000000..78dd947f68
--- /dev/null
+++ b/python/tests/qapi-isort.sh
@@ -0,0 +1,8 @@
+#!/bin/sh -e
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+python3 -m isort --sp . -c ../scripts/qapi/
+# Force isort to recognize "compat" as a local module and not third-party
+python3 -m isort --sp . -c -p compat -p qapidoc_legacy \
+        ../docs/sphinx/qapi_domain.py \
+        ../docs/sphinx/qapidoc.py
diff --git a/python/tests/qapi-mypy.sh b/python/tests/qapi-mypy.sh
new file mode 100755
index 0000000000..363dbaf8c0
--- /dev/null
+++ b/python/tests/qapi-mypy.sh
@@ -0,0 +1,4 @@
+#!/bin/sh -e
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+python3 -m mypy ../scripts/qapi
diff --git a/python/tests/qapi-pylint.sh b/python/tests/qapi-pylint.sh
new file mode 100755
index 0000000000..8767d9d2a2
--- /dev/null
+++ b/python/tests/qapi-pylint.sh
@@ -0,0 +1,8 @@
+#!/bin/sh -e
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+SETUPTOOLS_USE_DISTUTILS=stdlib python3 -m pylint \
+                                --rcfile=../scripts/qapi/pylintrc \
+                                ../scripts/qapi/ \
+                                ../docs/sphinx/qapidoc.py \
+                                ../docs/sphinx/qapi_domain.py
diff --git a/scripts/qapi/pylintrc b/scripts/qapi/pylintrc
index d24eece741..e16283ada3 100644
--- a/scripts/qapi/pylintrc
+++ b/scripts/qapi/pylintrc
@@ -19,6 +19,7 @@ disable=consider-using-f-string,
         too-many-instance-attributes,
         too-many-positional-arguments,
         too-many-statements,
+        unknown-option-value,
         useless-option-value,
 
 [REPORTS]

From 781e730556f3621a3f5f83e9b6afdc7d306f0094 Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Wed, 4 Jun 2025 16:03:53 -0400
Subject: [PATCH 1429/2760] python: Drop redundant warn_unused_configs = True

strict = True implies warn_unused_configs = True.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Message-id: 20250604200354.459501-6-jsnow@redhat.com
---
 python/setup.cfg | 1 -
 1 file changed, 1 deletion(-)

diff --git a/python/setup.cfg b/python/setup.cfg
index d21304cadd..d7f5dc7baf 100644
--- a/python/setup.cfg
+++ b/python/setup.cfg
@@ -79,7 +79,6 @@ exclude = __pycache__,
 [mypy]
 strict = True
 python_version = 3.9
-warn_unused_configs = True
 namespace_packages = True
 warn_unused_ignores = False
 

From 678868eee3947fa25e13ccf3abb004c9c418e8a2 Mon Sep 17 00:00:00 2001
From: John Snow <jsnow@redhat.com>
Date: Wed, 4 Jun 2025 16:03:54 -0400
Subject: [PATCH 1430/2760] qapi: delete un-needed python static analysis
 configs

Since the previous commit, python/setup.cfg applies to scripts/qapi/ as
well.  Configuration files in scripts/qapi/ override python/setup.cfg.

scripts/qapi/.flake8 and scripts/qapi/.isort.cfg actually match
python/setup.cfg exactly, and can go.

The differences between scripts/qapi/mypy.ini and python/setup.cfg are
harmless: namespace_packages being set to True is a requirement for the
PEP420 nested package structure of QEMU but not for scripts/qapi, but
has no effect on type checking the QAPI code. warn_unused_ignores is
used in python/ to be able to target a wide variety of mypy versions;
some of which that have added new ignore categories that are not present
in older versions.

Ultimately, scripts/qapi/mypy.ini can be removed without any real change
in behavior to how mypy enforces type safety there.

The pylint config is being left in place because the settings differ
enough from the python/ directory settings that we need a chit-chat on
how to merge them O:-)

Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Message-id: 20250604200354.459501-7-jsnow@redhat.com
---
 scripts/qapi/.flake8    | 3 ---
 scripts/qapi/.isort.cfg | 7 -------
 scripts/qapi/mypy.ini   | 4 ----
 3 files changed, 14 deletions(-)
 delete mode 100644 scripts/qapi/.flake8
 delete mode 100644 scripts/qapi/.isort.cfg
 delete mode 100644 scripts/qapi/mypy.ini

diff --git a/scripts/qapi/.flake8 b/scripts/qapi/.flake8
deleted file mode 100644
index a873ff6730..0000000000
--- a/scripts/qapi/.flake8
+++ /dev/null
@@ -1,3 +0,0 @@
-[flake8]
-# Prefer pylint's bare-except checks to flake8's
-extend-ignore = E722
diff --git a/scripts/qapi/.isort.cfg b/scripts/qapi/.isort.cfg
deleted file mode 100644
index 643caa1fbd..0000000000
--- a/scripts/qapi/.isort.cfg
+++ /dev/null
@@ -1,7 +0,0 @@
-[settings]
-force_grid_wrap=4
-force_sort_within_sections=True
-include_trailing_comma=True
-line_length=72
-lines_after_imports=2
-multi_line_output=3
diff --git a/scripts/qapi/mypy.ini b/scripts/qapi/mypy.ini
deleted file mode 100644
index c9dbcec2db..0000000000
--- a/scripts/qapi/mypy.ini
+++ /dev/null
@@ -1,4 +0,0 @@
-[mypy]
-strict = True
-disallow_untyped_calls = False
-python_version = 3.9

From a95ad49bbfac2a5080c5761688465bdbb1969c24 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Mon, 26 May 2025 12:10:18 +0200
Subject: [PATCH 1431/2760] subprojects: add the anyhow crate

This is a standard replacement for Box<dyn Error> which is more efficient (it only
occcupies one word) and provides a backtrace of the error.  This could be plumbed
into &error_abort in the future.

Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/meson.build                              |  2 ++
 rust/qemu-api/meson.build                     |  2 +-
 scripts/archive-source.sh                     |  2 +-
 scripts/make-release                          |  2 +-
 subprojects/.gitignore                        |  1 +
 subprojects/anyhow-1-rs.wrap                  |  7 ++++
 .../packagefiles/anyhow-1-rs/meson.build      | 33 +++++++++++++++++++
 7 files changed, 46 insertions(+), 3 deletions(-)
 create mode 100644 subprojects/anyhow-1-rs.wrap
 create mode 100644 subprojects/packagefiles/anyhow-1-rs/meson.build

diff --git a/rust/meson.build b/rust/meson.build
index b1b3315be9..f752a06464 100644
--- a/rust/meson.build
+++ b/rust/meson.build
@@ -1,7 +1,9 @@
+subproject('anyhow-1-rs', required: true)
 subproject('bilge-0.2-rs', required: true)
 subproject('bilge-impl-0.2-rs', required: true)
 subproject('libc-0.2-rs', required: true)
 
+anyhow_rs = dependency('anyhow-1-rs')
 bilge_rs = dependency('bilge-0.2-rs')
 bilge_impl_rs = dependency('bilge-impl-0.2-rs')
 libc_rs = dependency('libc-0.2-rs')
diff --git a/rust/qemu-api/meson.build b/rust/qemu-api/meson.build
index b532281e8c..da70720e4c 100644
--- a/rust/qemu-api/meson.build
+++ b/rust/qemu-api/meson.build
@@ -35,7 +35,7 @@ _qemu_api_rs = static_library(
   override_options: ['rust_std=2021', 'build.rust_std=2021'],
   rust_abi: 'rust',
   rust_args: _qemu_api_cfg,
-  dependencies: [libc_rs, qemu_api_macros, qemuutil_rs,
+  dependencies: [anyhow_rs, libc_rs, qemu_api_macros, qemuutil_rs,
                  qom, hwcore, chardev, migration],
 )
 
diff --git a/scripts/archive-source.sh b/scripts/archive-source.sh
index e461c1531e..816062fee9 100755
--- a/scripts/archive-source.sh
+++ b/scripts/archive-source.sh
@@ -27,7 +27,7 @@ sub_file="${sub_tdir}/submodule.tar"
 # in their checkout, because the build environment is completely
 # different to the host OS.
 subprojects="keycodemapdb libvfio-user berkeley-softfloat-3
-  berkeley-testfloat-3 arbitrary-int-1-rs bilge-0.2-rs
+  berkeley-testfloat-3 anyhow-1-rs arbitrary-int-1-rs bilge-0.2-rs
   bilge-impl-0.2-rs either-1-rs itertools-0.11-rs libc-0.2-rs proc-macro2-1-rs
   proc-macro-error-1-rs proc-macro-error-attr-1-rs quote-1-rs
   syn-2-rs unicode-ident-1-rs"
diff --git a/scripts/make-release b/scripts/make-release
index 8c3594a1a4..ea65bdcc0c 100755
--- a/scripts/make-release
+++ b/scripts/make-release
@@ -40,7 +40,7 @@ fi
 
 # Only include wraps that are invoked with subproject()
 SUBPROJECTS="libvfio-user keycodemapdb berkeley-softfloat-3
-  berkeley-testfloat-3 arbitrary-int-1-rs bilge-0.2-rs
+  berkeley-testfloat-3 anyhow-1-rs arbitrary-int-1-rs bilge-0.2-rs
   bilge-impl-0.2-rs either-1-rs itertools-0.11-rs libc-0.2-rs proc-macro2-1-rs
   proc-macro-error-1-rs proc-macro-error-attr-1-rs quote-1-rs
   syn-2-rs unicode-ident-1-rs"
diff --git a/subprojects/.gitignore b/subprojects/.gitignore
index d12d34618c..b9ae507b85 100644
--- a/subprojects/.gitignore
+++ b/subprojects/.gitignore
@@ -6,6 +6,7 @@
 /keycodemapdb
 /libvfio-user
 /slirp
+/anyhow-1.0.98
 /arbitrary-int-1.2.7
 /bilge-0.2.0
 /bilge-impl-0.2.0
diff --git a/subprojects/anyhow-1-rs.wrap b/subprojects/anyhow-1-rs.wrap
new file mode 100644
index 0000000000..a69a3645b4
--- /dev/null
+++ b/subprojects/anyhow-1-rs.wrap
@@ -0,0 +1,7 @@
+[wrap-file]
+directory = anyhow-1.0.98
+source_url = https://crates.io/api/v1/crates/anyhow/1.0.98/download
+source_filename = anyhow-1.0.98.tar.gz
+source_hash = e16d2d3311acee920a9eb8d33b8cbc1787ce4a264e85f964c2404b969bdcd487
+#method = cargo
+patch_directory = anyhow-1-rs
diff --git a/subprojects/packagefiles/anyhow-1-rs/meson.build b/subprojects/packagefiles/anyhow-1-rs/meson.build
new file mode 100644
index 0000000000..348bab98b9
--- /dev/null
+++ b/subprojects/packagefiles/anyhow-1-rs/meson.build
@@ -0,0 +1,33 @@
+project('anyhow-1-rs', 'rust',
+  meson_version: '>=1.5.0',
+  version: '1.0.98',
+  license: 'MIT OR Apache-2.0',
+  default_options: [])
+
+rustc = meson.get_compiler('rust')
+
+rust_args = ['--cap-lints', 'allow']
+rust_args += ['--cfg', 'feature="std"']
+if rustc.version().version_compare('<1.65.0')
+  error('rustc version ' + rustc.version() + ' is unsupported. Please upgrade to at least 1.65.0')
+endif
+rust_args += [ '--cfg', 'std_backtrace' ] # >= 1.65.0
+if rustc.version().version_compare('<1.81.0')
+  rust_args += [ '--cfg', 'anyhow_no_core_error' ]
+endif
+
+_anyhow_rs = static_library(
+  'anyhow',
+  files('src/lib.rs'),
+  gnu_symbol_visibility: 'hidden',
+  override_options: ['rust_std=2018', 'build.rust_std=2018'],
+  rust_abi: 'rust',
+  rust_args: rust_args,
+  dependencies: [],
+)
+
+anyhow_dep = declare_dependency(
+  link_with: _anyhow_rs,
+)
+
+meson.override_dependency('anyhow-1-rs', anyhow_dep)

From bfe0f6b02a4d76bcdc05f50e03667447f6069445 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 23 May 2025 17:59:52 +0200
Subject: [PATCH 1432/2760] subprojects: add the foreign crate

This is a cleaned up and separated version of the patches at
https://lore.kernel.org/all/20240701145853.1394967-4-pbonzini@redhat.com/
https://lore.kernel.org/all/20240701145853.1394967-5-pbonzini@redhat.com/

Its first user will be the Error bindings; for example a QEMU Error ** can be
converted to a Rust Option using

     unsafe { Option::<Error>::from_foreign(c_error) }

Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/meson.build                              |  2 ++
 rust/qemu-api/meson.build                     |  2 +-
 scripts/archive-source.sh                     |  3 ++-
 scripts/make-release                          |  3 ++-
 subprojects/.gitignore                        |  1 +
 subprojects/foreign-0.3-rs.wrap               |  7 +++++
 .../packagefiles/foreign-0.3-rs/meson.build   | 26 +++++++++++++++++++
 7 files changed, 41 insertions(+), 3 deletions(-)
 create mode 100644 subprojects/foreign-0.3-rs.wrap
 create mode 100644 subprojects/packagefiles/foreign-0.3-rs/meson.build

diff --git a/rust/meson.build b/rust/meson.build
index f752a06464..99ae7956cd 100644
--- a/rust/meson.build
+++ b/rust/meson.build
@@ -1,11 +1,13 @@
 subproject('anyhow-1-rs', required: true)
 subproject('bilge-0.2-rs', required: true)
 subproject('bilge-impl-0.2-rs', required: true)
+subproject('foreign-0.3-rs', required: true)
 subproject('libc-0.2-rs', required: true)
 
 anyhow_rs = dependency('anyhow-1-rs')
 bilge_rs = dependency('bilge-0.2-rs')
 bilge_impl_rs = dependency('bilge-impl-0.2-rs')
+foreign_rs = dependency('foreign-0.3-rs')
 libc_rs = dependency('libc-0.2-rs')
 
 subproject('proc-macro2-1-rs', required: true)
diff --git a/rust/qemu-api/meson.build b/rust/qemu-api/meson.build
index da70720e4c..2f0f3b2aae 100644
--- a/rust/qemu-api/meson.build
+++ b/rust/qemu-api/meson.build
@@ -35,7 +35,7 @@ _qemu_api_rs = static_library(
   override_options: ['rust_std=2021', 'build.rust_std=2021'],
   rust_abi: 'rust',
   rust_args: _qemu_api_cfg,
-  dependencies: [anyhow_rs, libc_rs, qemu_api_macros, qemuutil_rs,
+  dependencies: [anyhow_rs, foreign_rs, libc_rs, qemu_api_macros, qemuutil_rs,
                  qom, hwcore, chardev, migration],
 )
 
diff --git a/scripts/archive-source.sh b/scripts/archive-source.sh
index 816062fee9..035828c532 100755
--- a/scripts/archive-source.sh
+++ b/scripts/archive-source.sh
@@ -28,7 +28,8 @@ sub_file="${sub_tdir}/submodule.tar"
 # different to the host OS.
 subprojects="keycodemapdb libvfio-user berkeley-softfloat-3
   berkeley-testfloat-3 anyhow-1-rs arbitrary-int-1-rs bilge-0.2-rs
-  bilge-impl-0.2-rs either-1-rs itertools-0.11-rs libc-0.2-rs proc-macro2-1-rs
+  bilge-impl-0.2-rs either-1-rs foreign-0.3-rs itertools-0.11-rs
+  libc-0.2-rs proc-macro2-1-rs
   proc-macro-error-1-rs proc-macro-error-attr-1-rs quote-1-rs
   syn-2-rs unicode-ident-1-rs"
 sub_deinit=""
diff --git a/scripts/make-release b/scripts/make-release
index ea65bdcc0c..4509a9fabf 100755
--- a/scripts/make-release
+++ b/scripts/make-release
@@ -41,7 +41,8 @@ fi
 # Only include wraps that are invoked with subproject()
 SUBPROJECTS="libvfio-user keycodemapdb berkeley-softfloat-3
   berkeley-testfloat-3 anyhow-1-rs arbitrary-int-1-rs bilge-0.2-rs
-  bilge-impl-0.2-rs either-1-rs itertools-0.11-rs libc-0.2-rs proc-macro2-1-rs
+  bilge-impl-0.2-rs either-1-rs foreign-0.3-rs itertools-0.11-rs
+  libc-0.2-rs proc-macro2-1-rs
   proc-macro-error-1-rs proc-macro-error-attr-1-rs quote-1-rs
   syn-2-rs unicode-ident-1-rs"
 
diff --git a/subprojects/.gitignore b/subprojects/.gitignore
index b9ae507b85..f4281934ce 100644
--- a/subprojects/.gitignore
+++ b/subprojects/.gitignore
@@ -11,6 +11,7 @@
 /bilge-0.2.0
 /bilge-impl-0.2.0
 /either-1.12.0
+/foreign-0.3.1
 /itertools-0.11.0
 /libc-0.2.162
 /proc-macro-error-1.0.4
diff --git a/subprojects/foreign-0.3-rs.wrap b/subprojects/foreign-0.3-rs.wrap
new file mode 100644
index 0000000000..0d218ec2c2
--- /dev/null
+++ b/subprojects/foreign-0.3-rs.wrap
@@ -0,0 +1,7 @@
+[wrap-file]
+directory = foreign-0.3.1
+source_url = https://crates.io/api/v1/crates/foreign/0.3.1/download
+source_filename = foreign-0.3.1.tar.gz
+source_hash = 17ca1b5be8c9d320daf386f1809c7acc0cb09accbae795c2001953fa50585846
+#method = cargo
+patch_directory = foreign-0.3-rs
diff --git a/subprojects/packagefiles/foreign-0.3-rs/meson.build b/subprojects/packagefiles/foreign-0.3-rs/meson.build
new file mode 100644
index 0000000000..0901c02c52
--- /dev/null
+++ b/subprojects/packagefiles/foreign-0.3-rs/meson.build
@@ -0,0 +1,26 @@
+project('foreign-0.3-rs', 'rust',
+  meson_version: '>=1.5.0',
+  version: '0.2.0',
+  license: 'MIT OR Apache-2.0',
+  default_options: [])
+
+subproject('libc-0.2-rs', required: true)
+libc_rs = dependency('libc-0.2-rs')
+
+_foreign_rs = static_library(
+  'foreign',
+  files('src/lib.rs'),
+  gnu_symbol_visibility: 'hidden',
+  override_options: ['rust_std=2021', 'build.rust_std=2021'],
+  rust_abi: 'rust',
+  rust_args: [
+    '--cap-lints', 'allow',
+  ],
+  dependencies: [libc_rs],
+)
+
+foreign_dep = declare_dependency(
+  link_with: _foreign_rs,
+)
+
+meson.override_dependency('foreign-0.3-rs', foreign_dep)

From 8714d366e7e29d3ca8cebc8504e18c4cd7b5cf48 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 23 May 2025 19:41:40 +0200
Subject: [PATCH 1433/2760] util/error: expose Error definition to Rust code

This is used to preserve the file and line in a roundtrip from
C Error to Rust and back to C.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 include/qapi/error-internal.h | 26 ++++++++++++++++++++++++++
 rust/wrapper.h                |  1 +
 util/error.c                  | 10 +---------
 3 files changed, 28 insertions(+), 9 deletions(-)
 create mode 100644 include/qapi/error-internal.h

diff --git a/include/qapi/error-internal.h b/include/qapi/error-internal.h
new file mode 100644
index 0000000000..d5c3904ade
--- /dev/null
+++ b/include/qapi/error-internal.h
@@ -0,0 +1,26 @@
+/*
+ * QEMU Error Objects - struct definition
+ *
+ * Copyright IBM, Corp. 2011
+ * Copyright (C) 2011-2015 Red Hat, Inc.
+ *
+ * Authors:
+ *  Anthony Liguori   <aliguori@us.ibm.com>
+ *  Markus Armbruster <armbru@redhat.com>,
+ *
+ * This work is licensed under the terms of the GNU LGPL, version 2.  See
+ * the COPYING.LIB file in the top-level directory.
+ */
+
+#ifndef QAPI_ERROR_INTERNAL_H
+
+struct Error
+{
+    char *msg;
+    ErrorClass err_class;
+    const char *src, *func;
+    int line;
+    GString *hint;
+};
+
+#endif
diff --git a/rust/wrapper.h b/rust/wrapper.h
index beddd9aab2..6060d3ba1a 100644
--- a/rust/wrapper.h
+++ b/rust/wrapper.h
@@ -60,6 +60,7 @@ typedef enum memory_order {
 #include "hw/qdev-properties-system.h"
 #include "hw/irq.h"
 #include "qapi/error.h"
+#include "qapi/error-internal.h"
 #include "migration/vmstate.h"
 #include "chardev/char-serial.h"
 #include "exec/memattrs.h"
diff --git a/util/error.c b/util/error.c
index 673011b89e..e5bcb7c022 100644
--- a/util/error.c
+++ b/util/error.c
@@ -15,15 +15,7 @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "qemu/error-report.h"
-
-struct Error
-{
-    char *msg;
-    ErrorClass err_class;
-    const char *src, *func;
-    int line;
-    GString *hint;
-};
+#include "qapi/error-internal.h"
 
 Error *error_abort;
 Error *error_fatal;

From 230a4894f45eac5fbd6bea8dc0dd54f84cf6c0fa Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Mon, 26 May 2025 09:25:50 +0200
Subject: [PATCH 1434/2760] util/error: allow non-NUL-terminated err->src

Rust makes the current file available as a statically-allocated string,
but without a NUL terminator.  Allow this by storing an optional maximum
length in the Error.

Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 include/qapi/error-internal.h | 9 ++++++++-
 util/error.c                  | 5 +++--
 2 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/include/qapi/error-internal.h b/include/qapi/error-internal.h
index d5c3904ade..1ec3ceb40f 100644
--- a/include/qapi/error-internal.h
+++ b/include/qapi/error-internal.h
@@ -18,7 +18,14 @@ struct Error
 {
     char *msg;
     ErrorClass err_class;
-    const char *src, *func;
+    const char *func;
+
+    /*
+     * src might be NUL-terminated or not.  If it is, src_len is negative.
+     * If it is not, src_len is the length.
+     */
+    const char *src;
+    int src_len;
     int line;
     GString *hint;
 };
diff --git a/util/error.c b/util/error.c
index e5bcb7c022..3449ecc0b9 100644
--- a/util/error.c
+++ b/util/error.c
@@ -24,8 +24,8 @@ Error *error_warn;
 static void error_handle(Error **errp, Error *err)
 {
     if (errp == &error_abort) {
-        fprintf(stderr, "Unexpected error in %s() at %s:%d:\n",
-                err->func, err->src, err->line);
+        fprintf(stderr, "Unexpected error in %s() at %.*s:%d:\n",
+                err->func, err->src_len, err->src, err->line);
         error_report("%s", error_get_pretty(err));
         if (err->hint) {
             error_printf("%s", err->hint->str);
@@ -67,6 +67,7 @@ static void error_setv(Error **errp,
         g_free(msg);
     }
     err->err_class = err_class;
+    err->src_len = -1;
     err->src = src;
     err->line = line;
     err->func = func;

From e8fb9c91a3ea437bdddd1819e180f36112e41ae1 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Wed, 28 May 2025 14:27:47 +0200
Subject: [PATCH 1435/2760] util/error: make func optional

The function name is not available in Rust, so make it optional.

Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 include/qapi/error-internal.h | 2 ++
 util/error.c                  | 9 +++++++--
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/include/qapi/error-internal.h b/include/qapi/error-internal.h
index 1ec3ceb40f..ff18a2086d 100644
--- a/include/qapi/error-internal.h
+++ b/include/qapi/error-internal.h
@@ -18,6 +18,8 @@ struct Error
 {
     char *msg;
     ErrorClass err_class;
+
+    /* Used for error_abort only, may be NULL. */
     const char *func;
 
     /*
diff --git a/util/error.c b/util/error.c
index 3449ecc0b9..daea2142f3 100644
--- a/util/error.c
+++ b/util/error.c
@@ -24,8 +24,13 @@ Error *error_warn;
 static void error_handle(Error **errp, Error *err)
 {
     if (errp == &error_abort) {
-        fprintf(stderr, "Unexpected error in %s() at %.*s:%d:\n",
-                err->func, err->src_len, err->src, err->line);
+        if (err->func) {
+            fprintf(stderr, "Unexpected error in %s() at %.*s:%d:\n",
+                    err->func, err->src_len, err->src, err->line);
+        } else {
+            fprintf(stderr, "Unexpected error at %.*s:%d:\n",
+		    err->src_len, err->src, err->line);
+        }
         error_report("%s", error_get_pretty(err));
         if (err->hint) {
             error_printf("%s", err->hint->str);

From b4ff3cf34fa09b28a480870b98377bac183833c8 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Tue, 3 Jun 2025 17:45:39 +0200
Subject: [PATCH 1436/2760] rust: qemu-api: add bindings to Error

Provide an implementation of std::error::Error that bridges the Rust
anyhow::Error and std::panic::Location types with QEMU's Error*.

It also has several utility methods, analogous to error_propagate(),
that convert a Result into a return value + Error** pair.  One important
difference is that these propagation methods *panic* if *errp is NULL,
unlike error_propagate() which eats subsequent errors[1].  The reason
for this is that in C you have an error_set*() call at the site where
the error is created, and calls to error_propagate() are relatively rare.

In Rust instead, even though these functions do "propagate" a
qemu_api::Error into a C Error**, there is no error_setg() anywhere that
could check for non-NULL errp and call abort().  error_propagate()'s
behavior of ignoring subsequent errors is generally considered weird,
and there would be a bigger risk of triggering it from Rust code.

[1] This is actually a violation of the preconditions of error_propagate(),
    so it should not happen.  But you never know...

Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 docs/devel/rust.rst        |   5 +
 rust/Cargo.lock            |  17 ++
 rust/Cargo.toml            |   1 +
 rust/qemu-api/Cargo.toml   |   2 +
 rust/qemu-api/meson.build  |   1 +
 rust/qemu-api/src/error.rs | 312 +++++++++++++++++++++++++++++++++++++
 rust/qemu-api/src/lib.rs   |   3 +
 7 files changed, 341 insertions(+)
 create mode 100644 rust/qemu-api/src/error.rs

diff --git a/docs/devel/rust.rst b/docs/devel/rust.rst
index 34d9c7945b..d60d56d0a6 100644
--- a/docs/devel/rust.rst
+++ b/docs/devel/rust.rst
@@ -96,6 +96,11 @@ are missing:
   architecture (VMState).  Right now, VMState lacks type safety because
   it is hard to place the ``VMStateField`` definitions in traits.
 
+* NUL-terminated file names with ``#[track_caller]`` are scheduled for
+  inclusion as ``#![feature(location_file_nul)]``, but it will be a while
+  before QEMU can use them.  For now, there is special code in
+  ``util/error.c`` to support non-NUL-terminated file names.
+
 * associated const equality would be nice to have for some users of
   ``callbacks::FnCall``, but is still experimental.  ``ASSERT_IS_SOME``
   replaces it.
diff --git a/rust/Cargo.lock b/rust/Cargo.lock
index bccfe855a7..b785c718f3 100644
--- a/rust/Cargo.lock
+++ b/rust/Cargo.lock
@@ -2,6 +2,12 @@
 # It is not intended for manual editing.
 version = 3
 
+[[package]]
+name = "anyhow"
+version = "1.0.98"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e16d2d3311acee920a9eb8d33b8cbc1787ce4a264e85f964c2404b969bdcd487"
+
 [[package]]
 name = "arbitrary-int"
 version = "1.2.7"
@@ -44,6 +50,15 @@ version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3dca9240753cf90908d7e4aac30f630662b02aebaa1b58a3cadabdb23385b58b"
 
+[[package]]
+name = "foreign"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "17ca1b5be8c9d320daf386f1809c7acc0cb09accbae795c2001953fa50585846"
+dependencies = [
+ "libc",
+]
+
 [[package]]
 name = "hpet"
 version = "0.1.0"
@@ -114,6 +129,8 @@ dependencies = [
 name = "qemu_api"
 version = "0.1.0"
 dependencies = [
+ "anyhow",
+ "foreign",
  "libc",
  "qemu_api_macros",
 ]
diff --git a/rust/Cargo.toml b/rust/Cargo.toml
index fd4c2fbf84..0868e1b426 100644
--- a/rust/Cargo.toml
+++ b/rust/Cargo.toml
@@ -67,6 +67,7 @@ missing_safety_doc = "deny"
 mut_mut = "deny"
 needless_bitwise_bool = "deny"
 needless_pass_by_ref_mut = "deny"
+needless_update = "deny"
 no_effect_underscore_binding = "deny"
 option_option = "deny"
 or_fun_call = "deny"
diff --git a/rust/qemu-api/Cargo.toml b/rust/qemu-api/Cargo.toml
index c96cf50e7a..db7000dee4 100644
--- a/rust/qemu-api/Cargo.toml
+++ b/rust/qemu-api/Cargo.toml
@@ -15,7 +15,9 @@ rust-version.workspace = true
 
 [dependencies]
 qemu_api_macros = { path = "../qemu-api-macros" }
+anyhow = "~1.0"
 libc = "0.2.162"
+foreign = "~0.3.1"
 
 [features]
 default = ["debug_cell"]
diff --git a/rust/qemu-api/meson.build b/rust/qemu-api/meson.build
index 2f0f3b2aae..cac8595a14 100644
--- a/rust/qemu-api/meson.build
+++ b/rust/qemu-api/meson.build
@@ -19,6 +19,7 @@ _qemu_api_rs = static_library(
       'src/cell.rs',
       'src/chardev.rs',
       'src/errno.rs',
+      'src/error.rs',
       'src/irq.rs',
       'src/memory.rs',
       'src/module.rs',
diff --git a/rust/qemu-api/src/error.rs b/rust/qemu-api/src/error.rs
new file mode 100644
index 0000000000..80157f6ea1
--- /dev/null
+++ b/rust/qemu-api/src/error.rs
@@ -0,0 +1,312 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+//! Error propagation for QEMU Rust code
+//!
+//! This module contains [`Error`], the bridge between Rust errors and
+//! [`Result`](std::result::Result)s and QEMU's C [`Error`](bindings::Error)
+//! struct.
+//!
+//! For FFI code, [`Error`] provides functions to simplify conversion between
+//! the Rust ([`Result<>`](std::result::Result)) and C (`Error**`) conventions:
+//!
+//! * [`ok_or_propagate`](crate::Error::ok_or_propagate),
+//!   [`bool_or_propagate`](crate::Error::bool_or_propagate),
+//!   [`ptr_or_propagate`](crate::Error::ptr_or_propagate) can be used to build
+//!   a C return value while also propagating an error condition
+//!
+//! * [`err_or_else`](crate::Error::err_or_else) and
+//!   [`err_or_unit`](crate::Error::err_or_unit) can be used to build a `Result`
+//!
+//! This module is most commonly used at the boundary between C and Rust code;
+//! other code will usually access it through the
+//! [`qemu_api::Result`](crate::Result) type alias, and will use the
+//! [`std::error::Error`] interface to let C errors participate in Rust's error
+//! handling functionality.
+//!
+//! Rust code can also create use this module to create an error object that
+//! will be passed up to C code, though in most cases this will be done
+//! transparently through the `?` operator.  Errors can be constructed from a
+//! simple error string, from an [`anyhow::Error`] to pass any other Rust error
+//! type up to C code, or from a combination of the two.
+//!
+//! The third case, corresponding to [`Error::with_error`], is the only one that
+//! requires mentioning [`qemu_api::Error`](crate::Error) explicitly.  Similar
+//! to how QEMU's C code handles errno values, the string and the
+//! `anyhow::Error` object will be concatenated with `:` as the separator.
+
+use std::{
+    borrow::Cow,
+    ffi::{c_char, c_int, c_void, CStr},
+    fmt::{self, Display},
+    panic, ptr,
+};
+
+use foreign::{prelude::*, OwnedPointer};
+
+use crate::bindings;
+
+pub type Result<T> = std::result::Result<T, Error>;
+
+#[derive(Debug)]
+pub struct Error {
+    msg: Option<Cow<'static, str>>,
+    /// Appends the print string of the error to the msg if not None
+    cause: Option<anyhow::Error>,
+    file: &'static str,
+    line: u32,
+}
+
+impl std::error::Error for Error {
+    fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {
+        self.cause.as_ref().map(AsRef::as_ref)
+    }
+
+    #[allow(deprecated)]
+    fn description(&self) -> &str {
+        self.msg
+            .as_deref()
+            .or_else(|| self.cause.as_deref().map(std::error::Error::description))
+            .expect("no message nor cause?")
+    }
+}
+
+impl Display for Error {
+    fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
+        let mut prefix = "";
+        if let Some(ref msg) = self.msg {
+            write!(f, "{msg}")?;
+            prefix = ": ";
+        }
+        if let Some(ref cause) = self.cause {
+            write!(f, "{prefix}{cause}")?;
+        } else if prefix.is_empty() {
+            panic!("no message nor cause?");
+        }
+        Ok(())
+    }
+}
+
+impl From<String> for Error {
+    #[track_caller]
+    fn from(msg: String) -> Self {
+        let location = panic::Location::caller();
+        Error {
+            msg: Some(Cow::Owned(msg)),
+            cause: None,
+            file: location.file(),
+            line: location.line(),
+        }
+    }
+}
+
+impl From<&'static str> for Error {
+    #[track_caller]
+    fn from(msg: &'static str) -> Self {
+        let location = panic::Location::caller();
+        Error {
+            msg: Some(Cow::Borrowed(msg)),
+            cause: None,
+            file: location.file(),
+            line: location.line(),
+        }
+    }
+}
+
+impl From<anyhow::Error> for Error {
+    #[track_caller]
+    fn from(error: anyhow::Error) -> Self {
+        let location = panic::Location::caller();
+        Error {
+            msg: None,
+            cause: Some(error),
+            file: location.file(),
+            line: location.line(),
+        }
+    }
+}
+
+impl Error {
+    /// Create a new error, prepending `msg` to the
+    /// description of `cause`
+    #[track_caller]
+    pub fn with_error(msg: impl Into<Cow<'static, str>>, cause: impl Into<anyhow::Error>) -> Self {
+        let location = panic::Location::caller();
+        Error {
+            msg: Some(msg.into()),
+            cause: Some(cause.into()),
+            file: location.file(),
+            line: location.line(),
+        }
+    }
+
+    /// Consume a result, returning `false` if it is an error and
+    /// `true` if it is successful.  The error is propagated into
+    /// `errp` like the C API `error_propagate` would do.
+    ///
+    /// # Safety
+    ///
+    /// `errp` must be a valid argument to `error_propagate`;
+    /// typically it is received from C code and need not be
+    /// checked further at the Rust↔C boundary.
+    pub unsafe fn bool_or_propagate(result: Result<()>, errp: *mut *mut bindings::Error) -> bool {
+        // SAFETY: caller guarantees errp is valid
+        unsafe { Self::ok_or_propagate(result, errp) }.is_some()
+    }
+
+    /// Consume a result, returning a `NULL` pointer if it is an error and
+    /// a C representation of the contents if it is successful.  This is
+    /// similar to the C API `error_propagate`, but it panics if `*errp`
+    /// is not `NULL`.
+    ///
+    /// # Safety
+    ///
+    /// `errp` must be a valid argument to `error_propagate`;
+    /// typically it is received from C code and need not be
+    /// checked further at the Rust↔C boundary.
+    ///
+    /// See [`propagate`](Error::propagate) for more information.
+    #[must_use]
+    pub unsafe fn ptr_or_propagate<T: CloneToForeign>(
+        result: Result<T>,
+        errp: *mut *mut bindings::Error,
+    ) -> *mut T::Foreign {
+        // SAFETY: caller guarantees errp is valid
+        unsafe { Self::ok_or_propagate(result, errp) }.clone_to_foreign_ptr()
+    }
+
+    /// Consume a result in the same way as `self.ok()`, but also propagate
+    /// a possible error into `errp`.  This is similar to the C API
+    /// `error_propagate`, but it panics if `*errp` is not `NULL`.
+    ///
+    /// # Safety
+    ///
+    /// `errp` must be a valid argument to `error_propagate`;
+    /// typically it is received from C code and need not be
+    /// checked further at the Rust↔C boundary.
+    ///
+    /// See [`propagate`](Error::propagate) for more information.
+    pub unsafe fn ok_or_propagate<T>(
+        result: Result<T>,
+        errp: *mut *mut bindings::Error,
+    ) -> Option<T> {
+        result.map_err(|err| unsafe { err.propagate(errp) }).ok()
+    }
+
+    /// Equivalent of the C function `error_propagate`.  Fill `*errp`
+    /// with the information container in `self` if `errp` is not NULL;
+    /// then consume it.
+    ///
+    /// This is similar to the C API `error_propagate`, but it panics if
+    /// `*errp` is not `NULL`.
+    ///
+    /// # Safety
+    ///
+    /// `errp` must be a valid argument to `error_propagate`; it can be
+    /// `NULL` or it can point to any of:
+    /// * `error_abort`
+    /// * `error_fatal`
+    /// * a local variable of (C) type `Error *`
+    ///
+    /// Typically `errp` is received from C code and need not be
+    /// checked further at the Rust↔C boundary.
+    pub unsafe fn propagate(self, errp: *mut *mut bindings::Error) {
+        if errp.is_null() {
+            return;
+        }
+
+        // SAFETY: caller guarantees that errp and *errp are valid
+        unsafe {
+            assert_eq!(*errp, ptr::null_mut());
+            bindings::error_propagate(errp, self.clone_to_foreign_ptr());
+        }
+    }
+
+    /// Convert a C `Error*` into a Rust `Result`, using
+    /// `Ok(())` if `c_error` is NULL.  Free the `Error*`.
+    ///
+    /// # Safety
+    ///
+    /// `c_error` must be `NULL` or valid; typically it was initialized
+    /// with `ptr::null_mut()` and passed by reference to a C function.
+    pub unsafe fn err_or_unit(c_error: *mut bindings::Error) -> Result<()> {
+        // SAFETY: caller guarantees c_error is valid
+        unsafe { Self::err_or_else(c_error, || ()) }
+    }
+
+    /// Convert a C `Error*` into a Rust `Result`, calling `f()` to
+    /// obtain an `Ok` value if `c_error` is NULL.  Free the `Error*`.
+    ///
+    /// # Safety
+    ///
+    /// `c_error` must be `NULL` or point to a valid C [`struct
+    /// Error`](bindings::Error); typically it was initialized with
+    /// `ptr::null_mut()` and passed by reference to a C function.
+    pub unsafe fn err_or_else<T, F: FnOnce() -> T>(
+        c_error: *mut bindings::Error,
+        f: F,
+    ) -> Result<T> {
+        // SAFETY: caller guarantees c_error is valid
+        let err = unsafe { Option::<Self>::from_foreign(c_error) };
+        match err {
+            None => Ok(f()),
+            Some(err) => Err(err),
+        }
+    }
+}
+
+impl FreeForeign for Error {
+    type Foreign = bindings::Error;
+
+    unsafe fn free_foreign(p: *mut bindings::Error) {
+        // SAFETY: caller guarantees p is valid
+        unsafe {
+            bindings::error_free(p);
+        }
+    }
+}
+
+impl CloneToForeign for Error {
+    fn clone_to_foreign(&self) -> OwnedPointer<Self> {
+        // SAFETY: all arguments are controlled by this function
+        unsafe {
+            let err: *mut c_void = libc::malloc(std::mem::size_of::<bindings::Error>());
+            let err: &mut bindings::Error = &mut *err.cast();
+            *err = bindings::Error {
+                msg: format!("{self}").clone_to_foreign_ptr(),
+                err_class: bindings::ERROR_CLASS_GENERIC_ERROR,
+                src_len: self.file.len() as c_int,
+                src: self.file.as_ptr().cast::<c_char>(),
+                line: self.line as c_int,
+                func: ptr::null_mut(),
+                hint: ptr::null_mut(),
+            };
+            OwnedPointer::new(err)
+        }
+    }
+}
+
+impl FromForeign for Error {
+    unsafe fn cloned_from_foreign(c_error: *const bindings::Error) -> Self {
+        // SAFETY: caller guarantees c_error is valid
+        unsafe {
+            let error = &*c_error;
+            let file = if error.src_len < 0 {
+                // NUL-terminated
+                CStr::from_ptr(error.src).to_str()
+            } else {
+                // Can become str::from_utf8 with Rust 1.87.0
+                std::str::from_utf8(std::slice::from_raw_parts(
+                    &*error.src.cast::<u8>(),
+                    error.src_len as usize,
+                ))
+            };
+
+            Error {
+                msg: FromForeign::cloned_from_foreign(error.msg),
+                cause: None,
+                file: file.unwrap(),
+                line: error.line as u32,
+            }
+        }
+    }
+}
diff --git a/rust/qemu-api/src/lib.rs b/rust/qemu-api/src/lib.rs
index 234a94e3c2..93902fc94b 100644
--- a/rust/qemu-api/src/lib.rs
+++ b/rust/qemu-api/src/lib.rs
@@ -19,6 +19,7 @@ pub mod callbacks;
 pub mod cell;
 pub mod chardev;
 pub mod errno;
+pub mod error;
 pub mod irq;
 pub mod memory;
 pub mod module;
@@ -34,6 +35,8 @@ use std::{
     ffi::c_void,
 };
 
+pub use error::{Error, Result};
+
 #[cfg(HAVE_GLIB_WITH_ALIGNED_ALLOC)]
 extern "C" {
     fn g_aligned_alloc0(

From 9a33f49f44453b2914dc2e9be2633c0dfcb9e267 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Thu, 29 May 2025 11:52:00 +0200
Subject: [PATCH 1437/2760] rust: qemu-api: add tests for Error bindings

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/qemu-api/src/error.rs | 104 +++++++++++++++++++++++++++++++++++++
 1 file changed, 104 insertions(+)

diff --git a/rust/qemu-api/src/error.rs b/rust/qemu-api/src/error.rs
index 80157f6ea1..e114fc4178 100644
--- a/rust/qemu-api/src/error.rs
+++ b/rust/qemu-api/src/error.rs
@@ -310,3 +310,107 @@ impl FromForeign for Error {
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use std::ffi::CStr;
+
+    use anyhow::anyhow;
+    use foreign::OwnedPointer;
+
+    use super::*;
+    use crate::{assert_match, bindings};
+
+    #[track_caller]
+    fn error_for_test(msg: &CStr) -> OwnedPointer<Error> {
+        // SAFETY: all arguments are controlled by this function
+        let location = panic::Location::caller();
+        unsafe {
+            let err: *mut c_void = libc::malloc(std::mem::size_of::<bindings::Error>());
+            let err: &mut bindings::Error = &mut *err.cast();
+            *err = bindings::Error {
+                msg: msg.clone_to_foreign_ptr(),
+                err_class: bindings::ERROR_CLASS_GENERIC_ERROR,
+                src_len: location.file().len() as c_int,
+                src: location.file().as_ptr().cast::<c_char>(),
+                line: location.line() as c_int,
+                func: ptr::null_mut(),
+                hint: ptr::null_mut(),
+            };
+            OwnedPointer::new(err)
+        }
+    }
+
+    unsafe fn error_get_pretty<'a>(local_err: *mut bindings::Error) -> &'a CStr {
+        unsafe { CStr::from_ptr(bindings::error_get_pretty(local_err)) }
+    }
+
+    #[test]
+    #[allow(deprecated)]
+    fn test_description() {
+        use std::error::Error;
+
+        assert_eq!(super::Error::from("msg").description(), "msg");
+        assert_eq!(super::Error::from("msg".to_owned()).description(), "msg");
+    }
+
+    #[test]
+    fn test_display() {
+        assert_eq!(&*format!("{}", Error::from("msg")), "msg");
+        assert_eq!(&*format!("{}", Error::from("msg".to_owned())), "msg");
+        assert_eq!(&*format!("{}", Error::from(anyhow!("msg"))), "msg");
+
+        assert_eq!(
+            &*format!("{}", Error::with_error("msg", anyhow!("cause"))),
+            "msg: cause"
+        );
+    }
+
+    #[test]
+    fn test_bool_or_propagate() {
+        unsafe {
+            let mut local_err: *mut bindings::Error = ptr::null_mut();
+
+            assert!(Error::bool_or_propagate(Ok(()), &mut local_err));
+            assert_eq!(local_err, ptr::null_mut());
+
+            let my_err = Error::from("msg");
+            assert!(!Error::bool_or_propagate(Err(my_err), &mut local_err));
+            assert_ne!(local_err, ptr::null_mut());
+            assert_eq!(error_get_pretty(local_err), c"msg");
+            bindings::error_free(local_err);
+        }
+    }
+
+    #[test]
+    fn test_ptr_or_propagate() {
+        unsafe {
+            let mut local_err: *mut bindings::Error = ptr::null_mut();
+
+            let ret = Error::ptr_or_propagate(Ok("abc".to_owned()), &mut local_err);
+            assert_eq!(String::from_foreign(ret), "abc");
+            assert_eq!(local_err, ptr::null_mut());
+
+            let my_err = Error::from("msg");
+            assert_eq!(
+                Error::ptr_or_propagate(Err::<String, _>(my_err), &mut local_err),
+                ptr::null_mut()
+            );
+            assert_ne!(local_err, ptr::null_mut());
+            assert_eq!(error_get_pretty(local_err), c"msg");
+            bindings::error_free(local_err);
+        }
+    }
+
+    #[test]
+    fn test_err_or_unit() {
+        unsafe {
+            let result = Error::err_or_unit(ptr::null_mut());
+            assert_match!(result, Ok(()));
+
+            let err = error_for_test(c"msg");
+            let err = Error::err_or_unit(err.into_inner()).unwrap_err();
+            assert_eq!(&*format!("{err}"), "msg");
+        }
+    }
+}

From 4b66abead9c9c7b637fb87e6bf782a45eee2a621 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 23 May 2025 18:31:29 +0200
Subject: [PATCH 1438/2760] rust: qdev: support returning errors from realize

Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/hw/char/pl011/src/device.rs |  5 +++--
 rust/hw/timer/hpet/src/device.rs |  5 +++--
 rust/qemu-api/src/qdev.rs        | 12 ++++++++----
 3 files changed, 14 insertions(+), 8 deletions(-)

diff --git a/rust/hw/char/pl011/src/device.rs b/rust/hw/char/pl011/src/device.rs
index 0501fa5be9..be8387f6f2 100644
--- a/rust/hw/char/pl011/src/device.rs
+++ b/rust/hw/char/pl011/src/device.rs
@@ -175,7 +175,7 @@ impl DeviceImpl for PL011State {
     fn vmsd() -> Option<&'static VMStateDescription> {
         Some(&device_class::VMSTATE_PL011)
     }
-    const REALIZE: Option<fn(&Self)> = Some(Self::realize);
+    const REALIZE: Option<fn(&Self) -> qemu_api::Result<()>> = Some(Self::realize);
 }
 
 impl ResettablePhasesImpl for PL011State {
@@ -619,9 +619,10 @@ impl PL011State {
         }
     }
 
-    fn realize(&self) {
+    fn realize(&self) -> qemu_api::Result<()> {
         self.char_backend
             .enable_handlers(self, Self::can_receive, Self::receive, Self::event);
+        Ok(())
     }
 
     fn reset_hold(&self, _type: ResetType) {
diff --git a/rust/hw/timer/hpet/src/device.rs b/rust/hw/timer/hpet/src/device.rs
index e3ba62b287..68c82b09b6 100644
--- a/rust/hw/timer/hpet/src/device.rs
+++ b/rust/hw/timer/hpet/src/device.rs
@@ -724,7 +724,7 @@ impl HPETState {
         }
     }
 
-    fn realize(&self) {
+    fn realize(&self) -> qemu_api::Result<()> {
         if self.int_route_cap == 0 {
             // TODO: Add error binding: warn_report()
             println!("Hpet's hpet-intcap property not initialized");
@@ -751,6 +751,7 @@ impl HPETState {
 
         self.init_gpio_in(2, HPETState::handle_legacy_irq);
         self.init_gpio_out(from_ref(&self.pit_enabled));
+        Ok(())
     }
 
     fn reset_hold(&self, _type: ResetType) {
@@ -1042,7 +1043,7 @@ impl DeviceImpl for HPETState {
         Some(&VMSTATE_HPET)
     }
 
-    const REALIZE: Option<fn(&Self)> = Some(Self::realize);
+    const REALIZE: Option<fn(&Self) -> qemu_api::Result<()>> = Some(Self::realize);
 }
 
 impl ResettablePhasesImpl for HPETState {
diff --git a/rust/qemu-api/src/qdev.rs b/rust/qemu-api/src/qdev.rs
index 1279d7a58d..0610959f46 100644
--- a/rust/qemu-api/src/qdev.rs
+++ b/rust/qemu-api/src/qdev.rs
@@ -12,10 +12,11 @@ use std::{
 pub use bindings::{ClockEvent, DeviceClass, Property, ResetType};
 
 use crate::{
-    bindings::{self, qdev_init_gpio_in, qdev_init_gpio_out, Error, ResettableClass},
+    bindings::{self, qdev_init_gpio_in, qdev_init_gpio_out, ResettableClass},
     callbacks::FnCall,
     cell::{bql_locked, Opaque},
     chardev::Chardev,
+    error::{Error, Result},
     irq::InterruptSource,
     prelude::*,
     qom::{ObjectClass, ObjectImpl, Owned},
@@ -108,7 +109,7 @@ pub trait DeviceImpl: ObjectImpl + ResettablePhasesImpl + IsA<DeviceState> {
     ///
     /// If not `None`, the parent class's `realize` method is overridden
     /// with the function pointed to by `REALIZE`.
-    const REALIZE: Option<fn(&Self)> = None;
+    const REALIZE: Option<fn(&Self) -> Result<()>> = None;
 
     /// An array providing the properties that the user can set on the
     /// device.  Not a `const` because referencing statics in constants
@@ -134,10 +135,13 @@ pub trait DeviceImpl: ObjectImpl + ResettablePhasesImpl + IsA<DeviceState> {
 /// readable/writeable from one thread at any time.
 unsafe extern "C" fn rust_realize_fn<T: DeviceImpl>(
     dev: *mut bindings::DeviceState,
-    _errp: *mut *mut Error,
+    errp: *mut *mut bindings::Error,
 ) {
     let state = NonNull::new(dev).unwrap().cast::<T>();
-    T::REALIZE.unwrap()(unsafe { state.as_ref() });
+    let result = T::REALIZE.unwrap()(unsafe { state.as_ref() });
+    unsafe {
+        Error::ok_or_propagate(result, errp);
+    }
 }
 
 unsafe impl InterfaceType for ResettableClass {

From b3bf86b8936dbca8689623d22b8955e071143a5e Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Mon, 26 May 2025 13:52:11 +0200
Subject: [PATCH 1439/2760] rust/hpet: change type of num_timers to usize

Remove the need to convert after every read of the BqlCell.  Because the
vmstate uses a u8 as the size of the VARRAY, this requires switching
the VARRAY to use num_timers_save; which in turn requires ensuring that
the num_timers_save is always there.  For simplicity do this by
removing support for version 1, which QEMU has not been producing for
~15 years.

Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/hw/timer/hpet/src/device.rs | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/rust/hw/timer/hpet/src/device.rs b/rust/hw/timer/hpet/src/device.rs
index 68c82b09b6..a957de1e76 100644
--- a/rust/hw/timer/hpet/src/device.rs
+++ b/rust/hw/timer/hpet/src/device.rs
@@ -12,7 +12,7 @@ use std::{
 use qemu_api::{
     bindings::{
         address_space_memory, address_space_stl_le, qdev_prop_bit, qdev_prop_bool,
-        qdev_prop_uint32, qdev_prop_uint8,
+        qdev_prop_uint32, qdev_prop_usize,
     },
     cell::{BqlCell, BqlRefCell},
     irq::InterruptSource,
@@ -36,9 +36,9 @@ use crate::fw_cfg::HPETFwConfig;
 const HPET_REG_SPACE_LEN: u64 = 0x400; // 1024 bytes
 
 /// Minimum recommended hardware implementation.
-const HPET_MIN_TIMERS: u8 = 3;
+const HPET_MIN_TIMERS: usize = 3;
 /// Maximum timers in each timer block.
-const HPET_MAX_TIMERS: u8 = 32;
+const HPET_MAX_TIMERS: usize = 32;
 
 /// Flags that HPETState.flags supports.
 const HPET_FLAG_MSI_SUPPORT_SHIFT: usize = 0;
@@ -561,8 +561,8 @@ pub struct HPETState {
 
     /// HPET timer array managed by this timer block.
     #[doc(alias = "timer")]
-    timers: [BqlRefCell<HPETTimer>; HPET_MAX_TIMERS as usize],
-    num_timers: BqlCell<u8>,
+    timers: [BqlRefCell<HPETTimer>; HPET_MAX_TIMERS],
+    num_timers: BqlCell<usize>,
     num_timers_save: BqlCell<u8>,
 
     /// Instance id (HPET timer block ID).
@@ -572,7 +572,7 @@ pub struct HPETState {
 impl HPETState {
     // Get num_timers with `usize` type, which is useful to play with array index.
     fn get_num_timers(&self) -> usize {
-        self.num_timers.get().into()
+        self.num_timers.get()
     }
 
     const fn has_msi_flag(&self) -> bool {
@@ -854,7 +854,7 @@ impl HPETState {
          * also added to the migration stream.  Check that it matches the value
          * that was configured.
          */
-        self.num_timers_save.set(self.num_timers.get());
+        self.num_timers_save.set(self.num_timers.get() as u8);
         0
     }
 
@@ -884,7 +884,7 @@ impl HPETState {
     }
 
     fn validate_num_timers(&self, _version_id: u8) -> bool {
-        self.num_timers.get() == self.num_timers_save.get()
+        self.num_timers.get() == self.num_timers_save.get().into()
     }
 }
 
@@ -911,7 +911,7 @@ qemu_api::declare_properties! {
         c"timers",
         HPETState,
         num_timers,
-        unsafe { &qdev_prop_uint8 },
+        unsafe { &qdev_prop_usize },
         u8,
         default = HPET_MIN_TIMERS
     ),
@@ -1016,16 +1016,16 @@ const VALIDATE_TIMERS_NAME: &CStr = c"num_timers must match";
 static VMSTATE_HPET: VMStateDescription = VMStateDescription {
     name: c"hpet".as_ptr(),
     version_id: 2,
-    minimum_version_id: 1,
+    minimum_version_id: 2,
     pre_save: Some(hpet_pre_save),
     post_load: Some(hpet_post_load),
     fields: vmstate_fields! {
         vmstate_of!(HPETState, config),
         vmstate_of!(HPETState, int_status),
         vmstate_of!(HPETState, counter),
-        vmstate_of!(HPETState, num_timers_save).with_version_id(2),
+        vmstate_of!(HPETState, num_timers_save),
         vmstate_validate!(HPETState, VALIDATE_TIMERS_NAME, HPETState::validate_num_timers),
-        vmstate_struct!(HPETState, timers[0 .. num_timers], &VMSTATE_HPET_TIMER, BqlRefCell<HPETTimer>, HPETState::validate_num_timers).with_version_id(0),
+        vmstate_struct!(HPETState, timers[0 .. num_timers_save], &VMSTATE_HPET_TIMER, BqlRefCell<HPETTimer>, HPETState::validate_num_timers).with_version_id(0),
     },
     subsections: vmstate_subsections! {
         VMSTATE_HPET_RTC_IRQ_LEVEL,

From 6e85cfe44c0e0311d6395526a064eb5af761a879 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Thu, 29 May 2025 10:58:28 +0200
Subject: [PATCH 1440/2760] hpet: adjust VMState for consistency with Rust
 version

No functional change intended.

Suggested-by: Zhao Liu <zhao1.liu@intel.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/timer/hpet.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/hw/timer/hpet.c b/hw/timer/hpet.c
index 0fd1337a15..9db027cf76 100644
--- a/hw/timer/hpet.c
+++ b/hw/timer/hpet.c
@@ -328,16 +328,16 @@ static const VMStateDescription vmstate_hpet_timer = {
 static const VMStateDescription vmstate_hpet = {
     .name = "hpet",
     .version_id = 2,
-    .minimum_version_id = 1,
+    .minimum_version_id = 2,
     .pre_save = hpet_pre_save,
     .post_load = hpet_post_load,
     .fields = (const VMStateField[]) {
         VMSTATE_UINT64(config, HPETState),
         VMSTATE_UINT64(isr, HPETState),
         VMSTATE_UINT64(hpet_counter, HPETState),
-        VMSTATE_UINT8_V(num_timers_save, HPETState, 2),
+        VMSTATE_UINT8(num_timers_save, HPETState),
         VMSTATE_VALIDATE("num_timers must match", hpet_validate_num_timers),
-        VMSTATE_STRUCT_VARRAY_UINT8(timer, HPETState, num_timers, 0,
+        VMSTATE_STRUCT_VARRAY_UINT8(timer, HPETState, num_timers_save, 0,
                                     vmstate_hpet_timer, HPETTimer),
         VMSTATE_END_OF_LIST()
     },

From 14b5a799339d2d21826eac5ab1e98d00b1f1f89f Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Mon, 26 May 2025 14:49:13 +0200
Subject: [PATCH 1441/2760] hpet: return errors from realize if properties are
 incorrect

Do not silently adjust num_timers, and fail if intcap is 0.

Reviewed-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/timer/hpet.c | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/hw/timer/hpet.c b/hw/timer/hpet.c
index 9db027cf76..cb48cc151f 100644
--- a/hw/timer/hpet.c
+++ b/hw/timer/hpet.c
@@ -691,8 +691,14 @@ static void hpet_realize(DeviceState *dev, Error **errp)
     int i;
     HPETTimer *timer;
 
+    if (s->num_timers < HPET_MIN_TIMERS || s->num_timers > HPET_MAX_TIMERS) {
+        error_setg(errp, "hpet.num_timers must be between %d and %d",
+                   HPET_MIN_TIMERS, HPET_MAX_TIMERS);
+        return;
+    }
     if (!s->intcap) {
-        warn_report("Hpet's intcap not initialized");
+        error_setg(errp, "hpet.hpet-intcap not initialized");
+        return;
     }
     if (hpet_fw_cfg.count == UINT8_MAX) {
         /* first instance */
@@ -700,7 +706,7 @@ static void hpet_realize(DeviceState *dev, Error **errp)
     }
 
     if (hpet_fw_cfg.count == 8) {
-        error_setg(errp, "Only 8 instances of HPET is allowed");
+        error_setg(errp, "Only 8 instances of HPET are allowed");
         return;
     }
 
@@ -710,11 +716,6 @@ static void hpet_realize(DeviceState *dev, Error **errp)
         sysbus_init_irq(sbd, &s->irqs[i]);
     }
 
-    if (s->num_timers < HPET_MIN_TIMERS) {
-        s->num_timers = HPET_MIN_TIMERS;
-    } else if (s->num_timers > HPET_MAX_TIMERS) {
-        s->num_timers = HPET_MAX_TIMERS;
-    }
     for (i = 0; i < HPET_MAX_TIMERS; i++) {
         timer = &s->timer[i];
         timer->qemu_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, hpet_timer, timer);

From 4d2fec89cb8651ee760ff9296c8d3e2ade4cc063 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 23 May 2025 18:37:55 +0200
Subject: [PATCH 1442/2760] rust/hpet: return errors from realize if properties
 are incorrect

Match the code in hpet.c; this also allows removing the
BqlCell from the num_timers field.

Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/hw/timer/hpet/src/device.rs | 16 +++++++---------
 rust/hw/timer/hpet/src/fw_cfg.rs |  7 +++----
 2 files changed, 10 insertions(+), 13 deletions(-)

diff --git a/rust/hw/timer/hpet/src/device.rs b/rust/hw/timer/hpet/src/device.rs
index a957de1e76..cd439f90b7 100644
--- a/rust/hw/timer/hpet/src/device.rs
+++ b/rust/hw/timer/hpet/src/device.rs
@@ -725,18 +725,16 @@ impl HPETState {
     }
 
     fn realize(&self) -> qemu_api::Result<()> {
+        if self.num_timers.get() < HPET_MIN_TIMERS || self.num_timers.get() > HPET_MAX_TIMERS {
+            Err(format!(
+                "hpet.num_timers must be between {HPET_MIN_TIMERS} and {HPET_MAX_TIMERS}"
+            ))?;
+        }
         if self.int_route_cap == 0 {
-            // TODO: Add error binding: warn_report()
-            println!("Hpet's hpet-intcap property not initialized");
+            Err("hpet.hpet-intcap property not initialized")?;
         }
 
-        self.hpet_id.set(HPETFwConfig::assign_hpet_id());
-
-        if self.num_timers.get() < HPET_MIN_TIMERS {
-            self.num_timers.set(HPET_MIN_TIMERS);
-        } else if self.num_timers.get() > HPET_MAX_TIMERS {
-            self.num_timers.set(HPET_MAX_TIMERS);
-        }
+        self.hpet_id.set(HPETFwConfig::assign_hpet_id()?);
 
         self.init_timer();
         // 64-bit General Capabilities and ID Register; LegacyReplacementRoute.
diff --git a/rust/hw/timer/hpet/src/fw_cfg.rs b/rust/hw/timer/hpet/src/fw_cfg.rs
index 6c10316104..619d662ee1 100644
--- a/rust/hw/timer/hpet/src/fw_cfg.rs
+++ b/rust/hw/timer/hpet/src/fw_cfg.rs
@@ -36,7 +36,7 @@ pub static mut hpet_fw_cfg: HPETFwConfig = HPETFwConfig {
 };
 
 impl HPETFwConfig {
-    pub(crate) fn assign_hpet_id() -> usize {
+    pub(crate) fn assign_hpet_id() -> Result<usize, &'static str> {
         assert!(bql_locked());
         // SAFETY: all accesses go through these methods, which guarantee
         // that the accesses are protected by the BQL.
@@ -48,13 +48,12 @@ impl HPETFwConfig {
         }
 
         if fw_cfg.count == 8 {
-            // TODO: Add error binding: error_setg()
-            panic!("Only 8 instances of HPET is allowed");
+            Err("Only 8 instances of HPET are allowed")?;
         }
 
         let id: usize = fw_cfg.count.into();
         fw_cfg.count += 1;
-        id
+        Ok(id)
     }
 
     pub(crate) fn update_hpet_cfg(hpet_id: usize, timer_block_id: u32, address: u64) {

From 869b0afa4fafb73ba5a3c556b0ef5e5c1a39e717 Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Mon, 26 May 2025 13:54:21 +0200
Subject: [PATCH 1443/2760] rust/hpet: Drop BqlCell wrapper for num_timers

Now that the num_timers field is initialized as a property, someone may
change its default value using qdev_prop_set_uint8(), but the value is
fixed after the Rust code sees it first.  Since there is no need to modify
it after realize(), it is not to be necessary to have a BqlCell wrapper.

Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250520152750.2542612-4-zhao1.liu@intel.com
[Remove .into() as well. - Paolo]
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/hw/timer/hpet/src/device.rs | 27 +++++++++++----------------
 1 file changed, 11 insertions(+), 16 deletions(-)

diff --git a/rust/hw/timer/hpet/src/device.rs b/rust/hw/timer/hpet/src/device.rs
index cd439f90b7..735b2fbef7 100644
--- a/rust/hw/timer/hpet/src/device.rs
+++ b/rust/hw/timer/hpet/src/device.rs
@@ -562,7 +562,7 @@ pub struct HPETState {
     /// HPET timer array managed by this timer block.
     #[doc(alias = "timer")]
     timers: [BqlRefCell<HPETTimer>; HPET_MAX_TIMERS],
-    num_timers: BqlCell<usize>,
+    num_timers: usize,
     num_timers_save: BqlCell<u8>,
 
     /// Instance id (HPET timer block ID).
@@ -570,11 +570,6 @@ pub struct HPETState {
 }
 
 impl HPETState {
-    // Get num_timers with `usize` type, which is useful to play with array index.
-    fn get_num_timers(&self) -> usize {
-        self.num_timers.get()
-    }
-
     const fn has_msi_flag(&self) -> bool {
         self.flags & (1 << HPET_FLAG_MSI_SUPPORT_SHIFT) != 0
     }
@@ -636,7 +631,7 @@ impl HPETState {
             self.hpet_offset
                 .set(ticks_to_ns(self.counter.get()) - CLOCK_VIRTUAL.get_ns());
 
-            for timer in self.timers.iter().take(self.get_num_timers()) {
+            for timer in self.timers.iter().take(self.num_timers) {
                 let mut t = timer.borrow_mut();
 
                 if t.is_int_enabled() && t.is_int_active() {
@@ -648,7 +643,7 @@ impl HPETState {
             // Halt main counter and disable interrupt generation.
             self.counter.set(self.get_ticks());
 
-            for timer in self.timers.iter().take(self.get_num_timers()) {
+            for timer in self.timers.iter().take(self.num_timers) {
                 timer.borrow_mut().del_timer();
             }
         }
@@ -671,7 +666,7 @@ impl HPETState {
         let new_val = val << shift;
         let cleared = new_val & self.int_status.get();
 
-        for (index, timer) in self.timers.iter().take(self.get_num_timers()).enumerate() {
+        for (index, timer) in self.timers.iter().take(self.num_timers).enumerate() {
             if cleared & (1 << index) != 0 {
                 timer.borrow_mut().update_irq(false);
             }
@@ -725,7 +720,7 @@ impl HPETState {
     }
 
     fn realize(&self) -> qemu_api::Result<()> {
-        if self.num_timers.get() < HPET_MIN_TIMERS || self.num_timers.get() > HPET_MAX_TIMERS {
+        if self.num_timers < HPET_MIN_TIMERS || self.num_timers > HPET_MAX_TIMERS {
             Err(format!(
                 "hpet.num_timers must be between {HPET_MIN_TIMERS} and {HPET_MAX_TIMERS}"
             ))?;
@@ -743,7 +738,7 @@ impl HPETState {
             1 << HPET_CAP_COUNT_SIZE_CAP_SHIFT |
             1 << HPET_CAP_LEG_RT_CAP_SHIFT |
             HPET_CAP_VENDER_ID_VALUE << HPET_CAP_VENDER_ID_SHIFT |
-            ((self.get_num_timers() - 1) as u64) << HPET_CAP_NUM_TIM_SHIFT | // indicate the last timer
+            ((self.num_timers - 1) as u64) << HPET_CAP_NUM_TIM_SHIFT | // indicate the last timer
             (HPET_CLK_PERIOD * FS_PER_NS) << HPET_CAP_CNT_CLK_PERIOD_SHIFT, // 10 ns
         );
 
@@ -753,7 +748,7 @@ impl HPETState {
     }
 
     fn reset_hold(&self, _type: ResetType) {
-        for timer in self.timers.iter().take(self.get_num_timers()) {
+        for timer in self.timers.iter().take(self.num_timers) {
             timer.borrow_mut().reset();
         }
 
@@ -781,7 +776,7 @@ impl HPETState {
             GlobalRegister::try_from(addr).map(HPETRegister::Global)
         } else {
             let timer_id: usize = ((addr - 0x100) / 0x20) as usize;
-            if timer_id <= self.get_num_timers() {
+            if timer_id < self.num_timers {
                 // TODO: Add trace point - trace_hpet_ram_[read|write]_timer_id(timer_id)
                 TimerRegister::try_from(addr & 0x18)
                     .map(|reg| HPETRegister::Timer(&self.timers[timer_id], reg))
@@ -852,12 +847,12 @@ impl HPETState {
          * also added to the migration stream.  Check that it matches the value
          * that was configured.
          */
-        self.num_timers_save.set(self.num_timers.get() as u8);
+        self.num_timers_save.set(self.num_timers as u8);
         0
     }
 
     fn post_load(&self, _version_id: u8) -> i32 {
-        for timer in self.timers.iter().take(self.get_num_timers()) {
+        for timer in self.timers.iter().take(self.num_timers) {
             let mut t = timer.borrow_mut();
 
             t.cmp64 = t.calculate_cmp64(t.get_state().counter.get(), t.cmp);
@@ -882,7 +877,7 @@ impl HPETState {
     }
 
     fn validate_num_timers(&self, _version_id: u8) -> bool {
-        self.num_timers.get() == self.num_timers_save.get().into()
+        self.num_timers == self.num_timers_save.get().into()
     }
 }
 

From 9c00ef6248bd6545f262f18f31b15fc681e88972 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Mon, 26 May 2025 16:21:29 +0200
Subject: [PATCH 1444/2760] docs: update Rust module status

error is new; offset_of is gone.

Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 docs/devel/rust.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/devel/rust.rst b/docs/devel/rust.rst
index d60d56d0a6..47e9677fcb 100644
--- a/docs/devel/rust.rst
+++ b/docs/devel/rust.rst
@@ -160,10 +160,10 @@ module           status
 ``callbacks``    complete
 ``cell``         stable
 ``errno``        complete
+``error``        stable
 ``irq``          complete
 ``memory``       stable
 ``module``       complete
-``offset_of``    stable
 ``qdev``         stable
 ``qom``          stable
 ``sysbus``       stable

From bc2a48d647752e4f99247184f5dfe00e67a2de8f Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Thu, 5 Jun 2025 11:12:15 +0200
Subject: [PATCH 1445/2760] rust: make TryFrom macro more resilient

If the enum includes values such as "Ok", "Err", or "Error", the TryInto
macro can cause errors.  Be careful and qualify identifiers with the full
path, or in the case of TryFrom<>::Error do not use the associated type
at all.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/qemu-api-macros/src/lib.rs | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/rust/qemu-api-macros/src/lib.rs b/rust/qemu-api-macros/src/lib.rs
index 103470785e..c18bb4e036 100644
--- a/rust/qemu-api-macros/src/lib.rs
+++ b/rust/qemu-api-macros/src/lib.rs
@@ -203,8 +203,8 @@ fn derive_tryinto_body(
     Ok(quote! {
         #(const #discriminants: #repr = #name::#discriminants as #repr;)*;
         match value {
-            #(#discriminants => Ok(#name::#discriminants),)*
-            _ => Err(value),
+            #(#discriminants => core::result::Result::Ok(#name::#discriminants),)*
+            _ => core::result::Result::Err(value),
         }
     })
 }
@@ -236,7 +236,8 @@ fn derive_tryinto_or_error(input: DeriveInput) -> Result<proc_macro2::TokenStrea
         impl core::convert::TryFrom<#repr> for #name {
             type Error = #repr;
 
-            fn try_from(value: #repr) -> Result<Self, Self::Error> {
+            #[allow(ambiguous_associated_items)]
+            fn try_from(value: #repr) -> Result<Self, #repr> {
                 #body
             }
         }

From 4cdc489eb9c25f76255a550a4a0b19cda3435a76 Mon Sep 17 00:00:00 2001
From: Tom Lendacky <thomas.lendacky@amd.com>
Date: Fri, 28 Mar 2025 15:30:24 -0500
Subject: [PATCH 1446/2760] i386/kvm: Prefault memory on page state change

A page state change is typically followed by an access of the page(s) and
results in another VMEXIT in order to map the page into the nested page
table. Depending on the size of page state change request, this can
generate a number of additional VMEXITs. For example, under SNP, when
Linux is utilizing lazy memory acceptance, memory is typically accepted in
4M chunks. A page state change request is submitted to mark the pages as
private, followed by validation of the memory. Since the guest_memfd
currently only supports 4K pages, each page validation will result in
VMEXIT to map the page, resulting in 1024 additional exits.

When performing a page state change, invoke KVM_PRE_FAULT_MEMORY for the
size of the page state change in order to pre-map the pages and avoid the
additional VMEXITs. This helps speed up boot times.

Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
Link: https://lore.kernel.org/r/f5411c42340bd2f5c14972551edb4e959995e42b.1743193824.git.thomas.lendacky@amd.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 accel/kvm/kvm-all.c   |  2 ++
 include/system/kvm.h  |  1 +
 target/i386/kvm/kvm.c | 31 ++++++++++++++++++++++++++-----
 3 files changed, 29 insertions(+), 5 deletions(-)

diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index 51526d301b..a31778341c 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -99,6 +99,7 @@ bool kvm_allowed;
 bool kvm_readonly_mem_allowed;
 bool kvm_vm_attributes_allowed;
 bool kvm_msi_use_devid;
+bool kvm_pre_fault_memory_supported;
 static bool kvm_has_guest_debug;
 static int kvm_sstep_flags;
 static bool kvm_immediate_exit;
@@ -2745,6 +2746,7 @@ static int kvm_init(MachineState *ms)
         kvm_check_extension(s, KVM_CAP_GUEST_MEMFD) &&
         kvm_check_extension(s, KVM_CAP_USER_MEMORY2) &&
         (kvm_supported_memory_attributes & KVM_MEMORY_ATTRIBUTE_PRIVATE);
+    kvm_pre_fault_memory_supported = kvm_vm_check_extension(s, KVM_CAP_PRE_FAULT_MEMORY);
 
     if (s->kernel_irqchip_split == ON_OFF_AUTO_AUTO) {
         s->kernel_irqchip_split = mc->default_kernel_irqchip_split ? ON_OFF_AUTO_ON : ON_OFF_AUTO_OFF;
diff --git a/include/system/kvm.h b/include/system/kvm.h
index 62ec131d4d..7cc60d26f2 100644
--- a/include/system/kvm.h
+++ b/include/system/kvm.h
@@ -42,6 +42,7 @@ extern bool kvm_gsi_routing_allowed;
 extern bool kvm_gsi_direct_mapping;
 extern bool kvm_readonly_mem_allowed;
 extern bool kvm_msi_use_devid;
+extern bool kvm_pre_fault_memory_supported;
 
 #define kvm_enabled()           (kvm_allowed)
 /**
diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
index a6bc089d02..56a6b9b638 100644
--- a/target/i386/kvm/kvm.c
+++ b/target/i386/kvm/kvm.c
@@ -6018,9 +6018,11 @@ static bool host_supports_vmx(void)
  * because private/shared page tracking is already provided through other
  * means, these 2 use-cases should be treated as being mutually-exclusive.
  */
-static int kvm_handle_hc_map_gpa_range(struct kvm_run *run)
+static int kvm_handle_hc_map_gpa_range(X86CPU *cpu, struct kvm_run *run)
 {
+    struct kvm_pre_fault_memory mem;
     uint64_t gpa, size, attributes;
+    int ret;
 
     if (!machine_require_guest_memfd(current_machine))
         return -EINVAL;
@@ -6031,13 +6033,32 @@ static int kvm_handle_hc_map_gpa_range(struct kvm_run *run)
 
     trace_kvm_hc_map_gpa_range(gpa, size, attributes, run->hypercall.flags);
 
-    return kvm_convert_memory(gpa, size, attributes & KVM_MAP_GPA_RANGE_ENCRYPTED);
+    ret = kvm_convert_memory(gpa, size, attributes & KVM_MAP_GPA_RANGE_ENCRYPTED);
+    if (ret || !kvm_pre_fault_memory_supported) {
+        return ret;
+    }
+
+    /*
+     * Opportunistically pre-fault memory in. Failures are ignored so that any
+     * errors in faulting in the memory will get captured in KVM page fault
+     * path when the guest first accesses the page.
+     */
+    memset(&mem, 0, sizeof(mem));
+    mem.gpa = gpa;
+    mem.size = size;
+    while (mem.size) {
+        if (kvm_vcpu_ioctl(CPU(cpu), KVM_PRE_FAULT_MEMORY, &mem)) {
+            break;
+        }
+    }
+
+    return 0;
 }
 
-static int kvm_handle_hypercall(struct kvm_run *run)
+static int kvm_handle_hypercall(X86CPU *cpu, struct kvm_run *run)
 {
     if (run->hypercall.nr == KVM_HC_MAP_GPA_RANGE)
-        return kvm_handle_hc_map_gpa_range(run);
+        return kvm_handle_hc_map_gpa_range(cpu, run);
 
     return -EINVAL;
 }
@@ -6137,7 +6158,7 @@ int kvm_arch_handle_exit(CPUState *cs, struct kvm_run *run)
         break;
 #endif
     case KVM_EXIT_HYPERCALL:
-        ret = kvm_handle_hypercall(run);
+        ret = kvm_handle_hypercall(cpu, run);
         break;
     case KVM_EXIT_SYSTEM_EVENT:
         switch (run->system_event.type) {

From 6e2d11bf04fb18e60afc8551871d9acb7b56983d Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <akihiko.odaki@daynix.com>
Date: Thu, 29 May 2025 14:45:50 +0900
Subject: [PATCH 1447/2760] futex: Check value after qemu_futex_wait()

futex(2) - Linux manual page
https://man7.org/linux/man-pages/man2/futex.2.html
> Note that a wake-up can also be caused by common futex usage patterns
> in unrelated code that happened to have previously used the futex
> word's memory location (e.g., typical futex-based implementations of
> Pthreads mutexes can cause this under some conditions).  Therefore,
> callers should always conservatively assume that a return value of 0
> can mean a spurious wake-up, and use the futex word's value (i.e.,
> the user-space synchronization scheme) to decide whether to continue
> to block or not.

Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Link: https://lore.kernel.org/r/20250529-event-v5-1-53b285203794@daynix.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 include/qemu/futex.h              |  9 +++++++++
 tests/unit/test-aio-multithread.c |  4 +++-
 util/qemu-thread-posix.c          | 24 ++++++++++++------------
 3 files changed, 24 insertions(+), 13 deletions(-)

diff --git a/include/qemu/futex.h b/include/qemu/futex.h
index 91ae88966e..f577740053 100644
--- a/include/qemu/futex.h
+++ b/include/qemu/futex.h
@@ -24,6 +24,15 @@ static inline void qemu_futex_wake(void *f, int n)
     qemu_futex(f, FUTEX_WAKE, n, NULL, NULL, 0);
 }
 
+/*
+ * Note that a wake-up can also be caused by common futex usage patterns in
+ * unrelated code that happened to have previously used the futex word's
+ * memory location (e.g., typical futex-based implementations of Pthreads
+ * mutexes can cause this under some conditions).  Therefore, callers should
+ * always conservatively assume that it is a spurious wake-up, and use the futex
+ * word's value (i.e., the user-space synchronization scheme) to decide whether
+ * to continue to block or not.
+ */
 static inline void qemu_futex_wait(void *f, unsigned val)
 {
     while (qemu_futex(f, FUTEX_WAIT, (int) val, NULL, NULL, 0)) {
diff --git a/tests/unit/test-aio-multithread.c b/tests/unit/test-aio-multithread.c
index 08d4570ccb..8c2e41545a 100644
--- a/tests/unit/test-aio-multithread.c
+++ b/tests/unit/test-aio-multithread.c
@@ -305,7 +305,9 @@ static void mcs_mutex_lock(void)
     prev = qatomic_xchg(&mutex_head, id);
     if (prev != -1) {
         qatomic_set(&nodes[prev].next, id);
-        qemu_futex_wait(&nodes[id].locked, 1);
+        while (qatomic_read(&nodes[id].locked) == 1) {
+            qemu_futex_wait(&nodes[id].locked, 1);
+        }
     }
 }
 
diff --git a/util/qemu-thread-posix.c b/util/qemu-thread-posix.c
index b2e26e2120..f81fca5c11 100644
--- a/util/qemu-thread-posix.c
+++ b/util/qemu-thread-posix.c
@@ -428,17 +428,17 @@ void qemu_event_wait(QemuEvent *ev)
 
     assert(ev->initialized);
 
-    /*
-     * qemu_event_wait must synchronize with qemu_event_set even if it does
-     * not go down the slow path, so this load-acquire is needed that
-     * synchronizes with the first memory barrier in qemu_event_set().
-     *
-     * If we do go down the slow path, there is no requirement at all: we
-     * might miss a qemu_event_set() here but ultimately the memory barrier in
-     * qemu_futex_wait() will ensure the check is done correctly.
-     */
-    value = qatomic_load_acquire(&ev->value);
-    if (value != EV_SET) {
+    while (true) {
+        /*
+         * qemu_event_wait must synchronize with qemu_event_set even if it does
+         * not go down the slow path, so this load-acquire is needed that
+         * synchronizes with the first memory barrier in qemu_event_set().
+         */
+        value = qatomic_load_acquire(&ev->value);
+        if (value == EV_SET) {
+            break;
+        }
+
         if (value == EV_FREE) {
             /*
              * Leave the event reset and tell qemu_event_set that there are
@@ -452,7 +452,7 @@ void qemu_event_wait(QemuEvent *ev)
              * like the load above.
              */
             if (qatomic_cmpxchg(&ev->value, EV_FREE, EV_BUSY) == EV_SET) {
-                return;
+                break;
             }
         }
 

From 1bc2c495395bfad526b50d84f4db5687ce1d3963 Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <akihiko.odaki@daynix.com>
Date: Thu, 29 May 2025 14:45:51 +0900
Subject: [PATCH 1448/2760] futex: Support Windows

Windows supports futex-like APIs since Windows 8 and Windows Server
2012.

Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Link: https://lore.kernel.org/r/20250529-event-v5-2-53b285203794@daynix.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 include/qemu/futex.h              | 53 ++++++++++++++++++++++++-------
 meson.build                       |  7 ++++
 tests/unit/test-aio-multithread.c |  2 +-
 util/lockcnt.c                    |  2 +-
 util/meson.build                  |  2 +-
 util/qemu-thread-posix.c          |  4 +--
 6 files changed, 53 insertions(+), 17 deletions(-)

diff --git a/include/qemu/futex.h b/include/qemu/futex.h
index f577740053..607613eec8 100644
--- a/include/qemu/futex.h
+++ b/include/qemu/futex.h
@@ -1,5 +1,5 @@
 /*
- * Wrappers around Linux futex syscall
+ * Wrappers around Linux futex syscall and similar
  *
  * Copyright Red Hat, Inc. 2017
  *
@@ -11,28 +11,37 @@
  *
  */
 
+/*
+ * Note that a wake-up can also be caused by common futex usage patterns in
+ * unrelated code that happened to have previously used the futex word's
+ * memory location (e.g., typical futex-based implementations of Pthreads
+ * mutexes can cause this under some conditions).  Therefore, qemu_futex_wait()
+ * callers should always conservatively assume that it is a spurious wake-up,
+ * and use the futex word's value (i.e., the user-space synchronization scheme)
+ * to decide whether to continue to block or not.
+ */
+
 #ifndef QEMU_FUTEX_H
 #define QEMU_FUTEX_H
 
+#define HAVE_FUTEX
+
+#ifdef CONFIG_LINUX
 #include <sys/syscall.h>
 #include <linux/futex.h>
 
 #define qemu_futex(...)              syscall(__NR_futex, __VA_ARGS__)
 
-static inline void qemu_futex_wake(void *f, int n)
+static inline void qemu_futex_wake_all(void *f)
 {
-    qemu_futex(f, FUTEX_WAKE, n, NULL, NULL, 0);
+    qemu_futex(f, FUTEX_WAKE, INT_MAX, NULL, NULL, 0);
+}
+
+static inline void qemu_futex_wake_single(void *f)
+{
+    qemu_futex(f, FUTEX_WAKE, 1, NULL, NULL, 0);
 }
 
-/*
- * Note that a wake-up can also be caused by common futex usage patterns in
- * unrelated code that happened to have previously used the futex word's
- * memory location (e.g., typical futex-based implementations of Pthreads
- * mutexes can cause this under some conditions).  Therefore, callers should
- * always conservatively assume that it is a spurious wake-up, and use the futex
- * word's value (i.e., the user-space synchronization scheme) to decide whether
- * to continue to block or not.
- */
 static inline void qemu_futex_wait(void *f, unsigned val)
 {
     while (qemu_futex(f, FUTEX_WAIT, (int) val, NULL, NULL, 0)) {
@@ -46,5 +55,25 @@ static inline void qemu_futex_wait(void *f, unsigned val)
         }
     }
 }
+#elif defined(CONFIG_WIN32)
+#include <synchapi.h>
+
+static inline void qemu_futex_wake_all(void *f)
+{
+    WakeByAddressAll(f);
+}
+
+static inline void qemu_futex_wake_single(void *f)
+{
+    WakeByAddressSingle(f);
+}
+
+static inline void qemu_futex_wait(void *f, unsigned val)
+{
+    WaitOnAddress(f, &val, sizeof(val), INFINITE);
+}
+#else
+#undef HAVE_FUTEX
+#endif
 
 #endif /* QEMU_FUTEX_H */
diff --git a/meson.build b/meson.build
index 967a10e80b..34729c2a3d 100644
--- a/meson.build
+++ b/meson.build
@@ -838,11 +838,18 @@ emulator_link_args = []
 midl = not_found
 widl = not_found
 pathcch = not_found
+synchronization = not_found
 host_dsosuf = '.so'
 if host_os == 'windows'
   midl = find_program('midl', required: false)
   widl = find_program('widl', required: false)
   pathcch = cc.find_library('pathcch')
+  synchronization = cc.find_library('Synchronization', required: false)
+  if not synchronization.found()
+    # The library name is lowercase on mingw
+    synchronization = cc.find_library('synchronization', required: true)
+  endif
+
   socket = cc.find_library('ws2_32')
   winmm = cc.find_library('winmm')
 
diff --git a/tests/unit/test-aio-multithread.c b/tests/unit/test-aio-multithread.c
index 8c2e41545a..0ead6bf34a 100644
--- a/tests/unit/test-aio-multithread.c
+++ b/tests/unit/test-aio-multithread.c
@@ -330,7 +330,7 @@ static void mcs_mutex_unlock(void)
     /* Wake up the next in line.  */
     next = qatomic_read(&nodes[id].next);
     nodes[next].locked = 0;
-    qemu_futex_wake(&nodes[next].locked, 1);
+    qemu_futex_wake_single(&nodes[next].locked);
 }
 
 static void test_multi_fair_mutex_entry(void *opaque)
diff --git a/util/lockcnt.c b/util/lockcnt.c
index d07c6cc5ce..ca27d8e61a 100644
--- a/util/lockcnt.c
+++ b/util/lockcnt.c
@@ -106,7 +106,7 @@ static bool qemu_lockcnt_cmpxchg_or_wait(QemuLockCnt *lockcnt, int *val,
 static void lockcnt_wake(QemuLockCnt *lockcnt)
 {
     trace_lockcnt_futex_wake(lockcnt);
-    qemu_futex_wake(&lockcnt->count, 1);
+    qemu_futex_wake_single(&lockcnt->count);
 }
 
 void qemu_lockcnt_inc(QemuLockCnt *lockcnt)
diff --git a/util/meson.build b/util/meson.build
index 1adff96ebd..5735f65f19 100644
--- a/util/meson.build
+++ b/util/meson.build
@@ -27,7 +27,7 @@ else
   util_ss.add(files('event_notifier-win32.c'))
   util_ss.add(files('oslib-win32.c'))
   util_ss.add(files('qemu-thread-win32.c'))
-  util_ss.add(winmm, pathcch)
+  util_ss.add(winmm, pathcch, synchronization)
 endif
 util_ss.add(when: linux_io_uring, if_true: files('fdmon-io_uring.c'))
 if glib_has_gslice
diff --git a/util/qemu-thread-posix.c b/util/qemu-thread-posix.c
index f81fca5c11..f80f564e76 100644
--- a/util/qemu-thread-posix.c
+++ b/util/qemu-thread-posix.c
@@ -345,7 +345,7 @@ static inline void qemu_futex_wait(QemuEvent *ev, unsigned val)
 
 /* Valid transitions:
  * - free->set, when setting the event
- * - busy->set, when setting the event, followed by qemu_futex_wake
+ * - busy->set, when setting the event, followed by qemu_futex_wake_all
  * - set->free, when resetting the event
  * - free->busy, when waiting
  *
@@ -400,7 +400,7 @@ void qemu_event_set(QemuEvent *ev)
         smp_mb__after_rmw();
         if (old == EV_BUSY) {
             /* There were waiters, wake them up.  */
-            qemu_futex_wake(ev, INT_MAX);
+            qemu_futex_wake_all(ev);
         }
     }
 }

From 32da70a88780a167affde071fb2410ca2da58eaa Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <akihiko.odaki@daynix.com>
Date: Mon, 26 May 2025 14:29:14 +0900
Subject: [PATCH 1449/2760] qemu-thread: Replace __linux__ with CONFIG_LINUX
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

scripts/checkpatch.pl warns for __linux__ saying "architecture specific
defines should be avoided".

Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/r/20250526-event-v4-4-5b784cc8e1de@daynix.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 include/qemu/thread-posix.h | 2 +-
 util/qemu-thread-posix.c    | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/include/qemu/thread-posix.h b/include/qemu/thread-posix.h
index 5f2f3d1386..c412623a91 100644
--- a/include/qemu/thread-posix.h
+++ b/include/qemu/thread-posix.h
@@ -33,7 +33,7 @@ struct QemuSemaphore {
 };
 
 struct QemuEvent {
-#ifndef __linux__
+#ifndef CONFIG_LINUX
     pthread_mutex_t lock;
     pthread_cond_t cond;
 #endif
diff --git a/util/qemu-thread-posix.c b/util/qemu-thread-posix.c
index f80f564e76..3dc4d30052 100644
--- a/util/qemu-thread-posix.c
+++ b/util/qemu-thread-posix.c
@@ -317,7 +317,7 @@ void qemu_sem_wait(QemuSemaphore *sem)
     qemu_mutex_unlock(&sem->mutex);
 }
 
-#ifdef __linux__
+#ifdef CONFIG_LINUX
 #include "qemu/futex.h"
 #else
 static inline void qemu_futex_wake(QemuEvent *ev, int n)
@@ -363,7 +363,7 @@ static inline void qemu_futex_wait(QemuEvent *ev, unsigned val)
 
 void qemu_event_init(QemuEvent *ev, bool init)
 {
-#ifndef __linux__
+#ifndef CONFIG_LINUX
     pthread_mutex_init(&ev->lock, NULL);
     pthread_cond_init(&ev->cond, NULL);
 #endif
@@ -376,7 +376,7 @@ void qemu_event_destroy(QemuEvent *ev)
 {
     assert(ev->initialized);
     ev->initialized = false;
-#ifndef __linux__
+#ifndef CONFIG_LINUX
     pthread_mutex_destroy(&ev->lock);
     pthread_cond_destroy(&ev->cond);
 #endif

From d1895f4c17fdeee35a9b86099bb64d4ed3333658 Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <akihiko.odaki@daynix.com>
Date: Mon, 26 May 2025 14:29:13 +0900
Subject: [PATCH 1450/2760] qemu-thread: Avoid futex abstraction for non-Linux

qemu-thread used to abstract pthread primitives into futex for the
QemuEvent implementation of POSIX systems other than Linux. However,
this abstraction has one key difference: unlike futex, pthread
primitives require an explicit destruction, and it must be ordered after
wait and wake operations.

It would be easier to perform destruction if a wait operation ensures
the corresponding wake operation finishes as POSIX semaphore does, but
that requires to protect state accesses in qemu_event_set() and
qemu_event_wait() with a mutex. On the other hand, real futex does not
need such a protection but needs complex barrier and atomic operations
to ensure ordering between the two functions.

Add special implementations of qemu_event_set() and qemu_event_wait()
using pthread primitives. qemu_event_wait() will ensure qemu_event_set()
finishes, and these functions will avoid complex barrier and atomic
operations to ensure ordering between them.

Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Tested-by: Phil Dennis-Jordan <phil@philjordan.eu>
Reviewed-by: Phil Dennis-Jordan <phil@philjordan.eu>
Link: https://lore.kernel.org/r/20250526-event-v4-5-5b784cc8e1de@daynix.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 util/qemu-thread-posix.c | 84 +++++++++++++++++++++++++---------------
 1 file changed, 53 insertions(+), 31 deletions(-)

diff --git a/util/qemu-thread-posix.c b/util/qemu-thread-posix.c
index 3dc4d30052..7fafbedbc4 100644
--- a/util/qemu-thread-posix.c
+++ b/util/qemu-thread-posix.c
@@ -319,38 +319,23 @@ void qemu_sem_wait(QemuSemaphore *sem)
 
 #ifdef CONFIG_LINUX
 #include "qemu/futex.h"
-#else
-static inline void qemu_futex_wake(QemuEvent *ev, int n)
-{
-    assert(ev->initialized);
-    pthread_mutex_lock(&ev->lock);
-    if (n == 1) {
-        pthread_cond_signal(&ev->cond);
-    } else {
-        pthread_cond_broadcast(&ev->cond);
-    }
-    pthread_mutex_unlock(&ev->lock);
-}
-
-static inline void qemu_futex_wait(QemuEvent *ev, unsigned val)
-{
-    assert(ev->initialized);
-    pthread_mutex_lock(&ev->lock);
-    if (ev->value == val) {
-        pthread_cond_wait(&ev->cond, &ev->lock);
-    }
-    pthread_mutex_unlock(&ev->lock);
-}
 #endif
 
 /* Valid transitions:
- * - free->set, when setting the event
- * - busy->set, when setting the event, followed by qemu_futex_wake_all
- * - set->free, when resetting the event
- * - free->busy, when waiting
+ * - FREE -> SET (qemu_event_set)
+ * - BUSY -> SET (qemu_event_set)
+ * - SET -> FREE (qemu_event_reset)
+ * - FREE -> BUSY (qemu_event_wait)
  *
- * set->busy does not happen (it can be observed from the outside but
- * it really is set->free->busy).
+ * With futex, the waking and blocking operations follow
+ * BUSY -> SET and FREE -> BUSY, respectively.
+ *
+ * Without futex, BUSY -> SET and FREE -> BUSY never happen. Instead, the waking
+ * operation follows FREE -> SET and the blocking operation will happen in
+ * qemu_event_wait() if the event is not SET.
+ *
+ * SET->BUSY does not happen (it can be observed from the outside but
+ * it really is SET->FREE->BUSY).
  *
  * busy->free provably cannot happen; to enforce it, the set->free transition
  * is done with an OR, which becomes a no-op if the event has concurrently
@@ -386,6 +371,7 @@ void qemu_event_set(QemuEvent *ev)
 {
     assert(ev->initialized);
 
+#ifdef CONFIG_LINUX
     /*
      * Pairs with both qemu_event_reset() and qemu_event_wait().
      *
@@ -403,12 +389,20 @@ void qemu_event_set(QemuEvent *ev)
             qemu_futex_wake_all(ev);
         }
     }
+#else
+    pthread_mutex_lock(&ev->lock);
+    /* Pairs with qemu_event_reset()'s load acquire.  */
+    qatomic_store_release(&ev->value, EV_SET);
+    pthread_cond_broadcast(&ev->cond);
+    pthread_mutex_unlock(&ev->lock);
+#endif
 }
 
 void qemu_event_reset(QemuEvent *ev)
 {
     assert(ev->initialized);
 
+#ifdef CONFIG_LINUX
     /*
      * If there was a concurrent reset (or even reset+wait),
      * do nothing.  Otherwise change EV_SET->EV_FREE.
@@ -420,21 +414,42 @@ void qemu_event_reset(QemuEvent *ev)
      * Pairs with the first memory barrier in qemu_event_set().
      */
     smp_mb__after_rmw();
+#else
+    /*
+     * If futexes are not available, there are no EV_FREE->EV_BUSY
+     * transitions because wakeups are done entirely through the
+     * condition variable.  Since qatomic_set() only writes EV_FREE,
+     * the load seems useless but in reality, the acquire synchronizes
+     * with qemu_event_set()'s store release: if qemu_event_reset()
+     * sees EV_SET here, then the caller will certainly see a
+     * successful condition and skip qemu_event_wait():
+     *
+     * done = 1;                 if (done == 0)
+     * qemu_event_set() {          qemu_event_reset() {
+     *   lock();
+     *   ev->value = EV_SET ----->     load ev->value
+     *                                 ev->value = old value | EV_FREE
+     *   cond_broadcast()
+     *   unlock();                 }
+     * }                           if (done == 0)
+     *                               // qemu_event_wait() not called
+     */
+    qatomic_set(&ev->value, qatomic_load_acquire(&ev->value) | EV_FREE);
+#endif
 }
 
 void qemu_event_wait(QemuEvent *ev)
 {
-    unsigned value;
-
     assert(ev->initialized);
 
+#ifdef CONFIG_LINUX
     while (true) {
         /*
          * qemu_event_wait must synchronize with qemu_event_set even if it does
          * not go down the slow path, so this load-acquire is needed that
          * synchronizes with the first memory barrier in qemu_event_set().
          */
-        value = qatomic_load_acquire(&ev->value);
+        unsigned value = qatomic_load_acquire(&ev->value);
         if (value == EV_SET) {
             break;
         }
@@ -463,6 +478,13 @@ void qemu_event_wait(QemuEvent *ev)
          */
         qemu_futex_wait(ev, EV_BUSY);
     }
+#else
+    pthread_mutex_lock(&ev->lock);
+    while (qatomic_read(&ev->value) != EV_SET) {
+        pthread_cond_wait(&ev->cond, &ev->lock);
+    }
+    pthread_mutex_unlock(&ev->lock);
+#endif
 }
 
 static __thread NotifierList thread_exit;

From 69e10db83ea69cae74b59d27d87cfc61d9dd2b51 Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <akihiko.odaki@daynix.com>
Date: Mon, 26 May 2025 14:29:13 +0900
Subject: [PATCH 1451/2760] qemu-thread: Use futex for QemuEvent on Windows
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Use the futex-based implementation of QemuEvent on Windows to
remove code duplication and remove the overhead of event object
construction and destruction.

Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/r/20250526-event-v4-6-5b784cc8e1de@daynix.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 include/qemu/thread-posix.h |   9 --
 include/qemu/thread-win32.h |   6 --
 include/qemu/thread.h       |  11 ++-
 util/event.c                | 171 ++++++++++++++++++++++++++++++++++++
 util/meson.build            |   1 +
 util/qemu-thread-posix.c    | 170 -----------------------------------
 util/qemu-thread-win32.c    | 129 ---------------------------
 7 files changed, 182 insertions(+), 315 deletions(-)
 create mode 100644 util/event.c

diff --git a/include/qemu/thread-posix.h b/include/qemu/thread-posix.h
index c412623a91..758808b705 100644
--- a/include/qemu/thread-posix.h
+++ b/include/qemu/thread-posix.h
@@ -32,15 +32,6 @@ struct QemuSemaphore {
     unsigned int count;
 };
 
-struct QemuEvent {
-#ifndef CONFIG_LINUX
-    pthread_mutex_t lock;
-    pthread_cond_t cond;
-#endif
-    unsigned value;
-    bool initialized;
-};
-
 struct QemuThread {
     pthread_t thread;
 };
diff --git a/include/qemu/thread-win32.h b/include/qemu/thread-win32.h
index d95af4498f..da9e732299 100644
--- a/include/qemu/thread-win32.h
+++ b/include/qemu/thread-win32.h
@@ -28,12 +28,6 @@ struct QemuSemaphore {
     bool initialized;
 };
 
-struct QemuEvent {
-    int value;
-    HANDLE event;
-    bool initialized;
-};
-
 typedef struct QemuThreadData QemuThreadData;
 struct QemuThread {
     QemuThreadData *data;
diff --git a/include/qemu/thread.h b/include/qemu/thread.h
index 6f800aad31..573f8c9ede 100644
--- a/include/qemu/thread.h
+++ b/include/qemu/thread.h
@@ -3,13 +3,22 @@
 
 #include "qemu/processor.h"
 #include "qemu/atomic.h"
+#include "qemu/futex.h"
 
 typedef struct QemuCond QemuCond;
 typedef struct QemuSemaphore QemuSemaphore;
-typedef struct QemuEvent QemuEvent;
 typedef struct QemuLockCnt QemuLockCnt;
 typedef struct QemuThread QemuThread;
 
+typedef struct QemuEvent {
+#ifndef HAVE_FUTEX
+    pthread_mutex_t lock;
+    pthread_cond_t cond;
+#endif
+    unsigned value;
+    bool initialized;
+} QemuEvent;
+
 #ifdef _WIN32
 #include "qemu/thread-win32.h"
 #else
diff --git a/util/event.c b/util/event.c
new file mode 100644
index 0000000000..5a8141cd0e
--- /dev/null
+++ b/util/event.c
@@ -0,0 +1,171 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#include "qemu/osdep.h"
+#include "qemu/thread.h"
+
+/*
+ * Valid transitions:
+ * - FREE -> SET (qemu_event_set)
+ * - BUSY -> SET (qemu_event_set)
+ * - SET -> FREE (qemu_event_reset)
+ * - FREE -> BUSY (qemu_event_wait)
+ *
+ * With futex, the waking and blocking operations follow
+ * BUSY -> SET and FREE -> BUSY, respectively.
+ *
+ * Without futex, BUSY -> SET and FREE -> BUSY never happen. Instead, the waking
+ * operation follows FREE -> SET and the blocking operation will happen in
+ * qemu_event_wait() if the event is not SET.
+ *
+ * SET->BUSY does not happen (it can be observed from the outside but
+ * it really is SET->FREE->BUSY).
+ *
+ * busy->free provably cannot happen; to enforce it, the set->free transition
+ * is done with an OR, which becomes a no-op if the event has concurrently
+ * transitioned to free or busy.
+ */
+
+#define EV_SET         0
+#define EV_FREE        1
+#define EV_BUSY       -1
+
+void qemu_event_init(QemuEvent *ev, bool init)
+{
+#ifndef HAVE_FUTEX
+    pthread_mutex_init(&ev->lock, NULL);
+    pthread_cond_init(&ev->cond, NULL);
+#endif
+
+    ev->value = (init ? EV_SET : EV_FREE);
+    ev->initialized = true;
+}
+
+void qemu_event_destroy(QemuEvent *ev)
+{
+    assert(ev->initialized);
+    ev->initialized = false;
+#ifndef HAVE_FUTEX
+    pthread_mutex_destroy(&ev->lock);
+    pthread_cond_destroy(&ev->cond);
+#endif
+}
+
+void qemu_event_set(QemuEvent *ev)
+{
+    assert(ev->initialized);
+
+#ifdef HAVE_FUTEX
+    /*
+     * Pairs with both qemu_event_reset() and qemu_event_wait().
+     *
+     * qemu_event_set has release semantics, but because it *loads*
+     * ev->value we need a full memory barrier here.
+     */
+    smp_mb();
+    if (qatomic_read(&ev->value) != EV_SET) {
+        int old = qatomic_xchg(&ev->value, EV_SET);
+
+        /* Pairs with memory barrier in kernel futex_wait system call.  */
+        smp_mb__after_rmw();
+        if (old == EV_BUSY) {
+            /* There were waiters, wake them up.  */
+            qemu_futex_wake_all(ev);
+        }
+    }
+#else
+    pthread_mutex_lock(&ev->lock);
+    /* Pairs with qemu_event_reset()'s load acquire.  */
+    qatomic_store_release(&ev->value, EV_SET);
+    pthread_cond_broadcast(&ev->cond);
+    pthread_mutex_unlock(&ev->lock);
+#endif
+}
+
+void qemu_event_reset(QemuEvent *ev)
+{
+    assert(ev->initialized);
+
+#ifdef HAVE_FUTEX
+    /*
+     * If there was a concurrent reset (or even reset+wait),
+     * do nothing.  Otherwise change EV_SET->EV_FREE.
+     */
+    qatomic_or(&ev->value, EV_FREE);
+
+    /*
+     * Order reset before checking the condition in the caller.
+     * Pairs with the first memory barrier in qemu_event_set().
+     */
+    smp_mb__after_rmw();
+#else
+    /*
+     * If futexes are not available, there are no EV_FREE->EV_BUSY
+     * transitions because wakeups are done entirely through the
+     * condition variable.  Since qatomic_set() only writes EV_FREE,
+     * the load seems useless but in reality, the acquire synchronizes
+     * with qemu_event_set()'s store release: if qemu_event_reset()
+     * sees EV_SET here, then the caller will certainly see a
+     * successful condition and skip qemu_event_wait():
+     *
+     * done = 1;                 if (done == 0)
+     * qemu_event_set() {          qemu_event_reset() {
+     *   lock();
+     *   ev->value = EV_SET ----->     load ev->value
+     *                                 ev->value = old value | EV_FREE
+     *   cond_broadcast()
+     *   unlock();                 }
+     * }                           if (done == 0)
+     *                               // qemu_event_wait() not called
+     */
+    qatomic_set(&ev->value, qatomic_load_acquire(&ev->value) | EV_FREE);
+#endif
+}
+
+void qemu_event_wait(QemuEvent *ev)
+{
+    assert(ev->initialized);
+
+#ifdef HAVE_FUTEX
+    while (true) {
+        /*
+         * qemu_event_wait must synchronize with qemu_event_set even if it does
+         * not go down the slow path, so this load-acquire is needed that
+         * synchronizes with the first memory barrier in qemu_event_set().
+         */
+        unsigned value = qatomic_load_acquire(&ev->value);
+        if (value == EV_SET) {
+            break;
+        }
+
+        if (value == EV_FREE) {
+            /*
+             * Leave the event reset and tell qemu_event_set that there are
+             * waiters.  No need to retry, because there cannot be a concurrent
+             * busy->free transition.  After the CAS, the event will be either
+             * set or busy.
+             *
+             * This cmpxchg doesn't have particular ordering requirements if it
+             * succeeds (moving the store earlier can only cause
+             * qemu_event_set() to issue _more_ wakeups), the failing case needs
+             * acquire semantics like the load above.
+             */
+            if (qatomic_cmpxchg(&ev->value, EV_FREE, EV_BUSY) == EV_SET) {
+                break;
+            }
+        }
+
+        /*
+         * This is the final check for a concurrent set, so it does need
+         * a smp_mb() pairing with the second barrier of qemu_event_set().
+         * The barrier is inside the FUTEX_WAIT system call.
+         */
+        qemu_futex_wait(ev, EV_BUSY);
+    }
+#else
+    pthread_mutex_lock(&ev->lock);
+    while (qatomic_read(&ev->value) != EV_SET) {
+        pthread_cond_wait(&ev->cond, &ev->lock);
+    }
+    pthread_mutex_unlock(&ev->lock);
+#endif
+}
diff --git a/util/meson.build b/util/meson.build
index 5735f65f19..35029380a3 100644
--- a/util/meson.build
+++ b/util/meson.build
@@ -35,6 +35,7 @@ if glib_has_gslice
 endif
 util_ss.add(files('defer-call.c'))
 util_ss.add(files('envlist.c', 'path.c', 'module.c'))
+util_ss.add(files('event.c'))
 util_ss.add(files('host-utils.c'))
 util_ss.add(files('bitmap.c', 'bitops.c'))
 util_ss.add(files('fifo8.c'))
diff --git a/util/qemu-thread-posix.c b/util/qemu-thread-posix.c
index 7fafbedbc4..ba725444ba 100644
--- a/util/qemu-thread-posix.c
+++ b/util/qemu-thread-posix.c
@@ -317,176 +317,6 @@ void qemu_sem_wait(QemuSemaphore *sem)
     qemu_mutex_unlock(&sem->mutex);
 }
 
-#ifdef CONFIG_LINUX
-#include "qemu/futex.h"
-#endif
-
-/* Valid transitions:
- * - FREE -> SET (qemu_event_set)
- * - BUSY -> SET (qemu_event_set)
- * - SET -> FREE (qemu_event_reset)
- * - FREE -> BUSY (qemu_event_wait)
- *
- * With futex, the waking and blocking operations follow
- * BUSY -> SET and FREE -> BUSY, respectively.
- *
- * Without futex, BUSY -> SET and FREE -> BUSY never happen. Instead, the waking
- * operation follows FREE -> SET and the blocking operation will happen in
- * qemu_event_wait() if the event is not SET.
- *
- * SET->BUSY does not happen (it can be observed from the outside but
- * it really is SET->FREE->BUSY).
- *
- * busy->free provably cannot happen; to enforce it, the set->free transition
- * is done with an OR, which becomes a no-op if the event has concurrently
- * transitioned to free or busy.
- */
-
-#define EV_SET         0
-#define EV_FREE        1
-#define EV_BUSY       -1
-
-void qemu_event_init(QemuEvent *ev, bool init)
-{
-#ifndef CONFIG_LINUX
-    pthread_mutex_init(&ev->lock, NULL);
-    pthread_cond_init(&ev->cond, NULL);
-#endif
-
-    ev->value = (init ? EV_SET : EV_FREE);
-    ev->initialized = true;
-}
-
-void qemu_event_destroy(QemuEvent *ev)
-{
-    assert(ev->initialized);
-    ev->initialized = false;
-#ifndef CONFIG_LINUX
-    pthread_mutex_destroy(&ev->lock);
-    pthread_cond_destroy(&ev->cond);
-#endif
-}
-
-void qemu_event_set(QemuEvent *ev)
-{
-    assert(ev->initialized);
-
-#ifdef CONFIG_LINUX
-    /*
-     * Pairs with both qemu_event_reset() and qemu_event_wait().
-     *
-     * qemu_event_set has release semantics, but because it *loads*
-     * ev->value we need a full memory barrier here.
-     */
-    smp_mb();
-    if (qatomic_read(&ev->value) != EV_SET) {
-        int old = qatomic_xchg(&ev->value, EV_SET);
-
-        /* Pairs with memory barrier in kernel futex_wait system call.  */
-        smp_mb__after_rmw();
-        if (old == EV_BUSY) {
-            /* There were waiters, wake them up.  */
-            qemu_futex_wake_all(ev);
-        }
-    }
-#else
-    pthread_mutex_lock(&ev->lock);
-    /* Pairs with qemu_event_reset()'s load acquire.  */
-    qatomic_store_release(&ev->value, EV_SET);
-    pthread_cond_broadcast(&ev->cond);
-    pthread_mutex_unlock(&ev->lock);
-#endif
-}
-
-void qemu_event_reset(QemuEvent *ev)
-{
-    assert(ev->initialized);
-
-#ifdef CONFIG_LINUX
-    /*
-     * If there was a concurrent reset (or even reset+wait),
-     * do nothing.  Otherwise change EV_SET->EV_FREE.
-     */
-    qatomic_or(&ev->value, EV_FREE);
-
-    /*
-     * Order reset before checking the condition in the caller.
-     * Pairs with the first memory barrier in qemu_event_set().
-     */
-    smp_mb__after_rmw();
-#else
-    /*
-     * If futexes are not available, there are no EV_FREE->EV_BUSY
-     * transitions because wakeups are done entirely through the
-     * condition variable.  Since qatomic_set() only writes EV_FREE,
-     * the load seems useless but in reality, the acquire synchronizes
-     * with qemu_event_set()'s store release: if qemu_event_reset()
-     * sees EV_SET here, then the caller will certainly see a
-     * successful condition and skip qemu_event_wait():
-     *
-     * done = 1;                 if (done == 0)
-     * qemu_event_set() {          qemu_event_reset() {
-     *   lock();
-     *   ev->value = EV_SET ----->     load ev->value
-     *                                 ev->value = old value | EV_FREE
-     *   cond_broadcast()
-     *   unlock();                 }
-     * }                           if (done == 0)
-     *                               // qemu_event_wait() not called
-     */
-    qatomic_set(&ev->value, qatomic_load_acquire(&ev->value) | EV_FREE);
-#endif
-}
-
-void qemu_event_wait(QemuEvent *ev)
-{
-    assert(ev->initialized);
-
-#ifdef CONFIG_LINUX
-    while (true) {
-        /*
-         * qemu_event_wait must synchronize with qemu_event_set even if it does
-         * not go down the slow path, so this load-acquire is needed that
-         * synchronizes with the first memory barrier in qemu_event_set().
-         */
-        unsigned value = qatomic_load_acquire(&ev->value);
-        if (value == EV_SET) {
-            break;
-        }
-
-        if (value == EV_FREE) {
-            /*
-             * Leave the event reset and tell qemu_event_set that there are
-             * waiters.  No need to retry, because there cannot be a concurrent
-             * busy->free transition.  After the CAS, the event will be either
-             * set or busy.
-             *
-             * This cmpxchg doesn't have particular ordering requirements if it
-             * succeeds (moving the store earlier can only cause qemu_event_set()
-             * to issue _more_ wakeups), the failing case needs acquire semantics
-             * like the load above.
-             */
-            if (qatomic_cmpxchg(&ev->value, EV_FREE, EV_BUSY) == EV_SET) {
-                break;
-            }
-        }
-
-        /*
-         * This is the final check for a concurrent set, so it does need
-         * a smp_mb() pairing with the second barrier of qemu_event_set().
-         * The barrier is inside the FUTEX_WAIT system call.
-         */
-        qemu_futex_wait(ev, EV_BUSY);
-    }
-#else
-    pthread_mutex_lock(&ev->lock);
-    while (qatomic_read(&ev->value) != EV_SET) {
-        pthread_cond_wait(&ev->cond, &ev->lock);
-    }
-    pthread_mutex_unlock(&ev->lock);
-#endif
-}
-
 static __thread NotifierList thread_exit;
 
 /*
diff --git a/util/qemu-thread-win32.c b/util/qemu-thread-win32.c
index a7fe3cc345..ca2e0b512e 100644
--- a/util/qemu-thread-win32.c
+++ b/util/qemu-thread-win32.c
@@ -231,135 +231,6 @@ void qemu_sem_wait(QemuSemaphore *sem)
     }
 }
 
-/* Wrap a Win32 manual-reset event with a fast userspace path.  The idea
- * is to reset the Win32 event lazily, as part of a test-reset-test-wait
- * sequence.  Such a sequence is, indeed, how QemuEvents are used by
- * RCU and other subsystems!
- *
- * Valid transitions:
- * - free->set, when setting the event
- * - busy->set, when setting the event, followed by SetEvent
- * - set->free, when resetting the event
- * - free->busy, when waiting
- *
- * set->busy does not happen (it can be observed from the outside but
- * it really is set->free->busy).
- *
- * busy->free provably cannot happen; to enforce it, the set->free transition
- * is done with an OR, which becomes a no-op if the event has concurrently
- * transitioned to free or busy (and is faster than cmpxchg).
- */
-
-#define EV_SET         0
-#define EV_FREE        1
-#define EV_BUSY       -1
-
-void qemu_event_init(QemuEvent *ev, bool init)
-{
-    /* Manual reset.  */
-    ev->event = CreateEvent(NULL, TRUE, TRUE, NULL);
-    ev->value = (init ? EV_SET : EV_FREE);
-    ev->initialized = true;
-}
-
-void qemu_event_destroy(QemuEvent *ev)
-{
-    assert(ev->initialized);
-    ev->initialized = false;
-    CloseHandle(ev->event);
-}
-
-void qemu_event_set(QemuEvent *ev)
-{
-    assert(ev->initialized);
-
-    /*
-     * Pairs with both qemu_event_reset() and qemu_event_wait().
-     *
-     * qemu_event_set has release semantics, but because it *loads*
-     * ev->value we need a full memory barrier here.
-     */
-    smp_mb();
-    if (qatomic_read(&ev->value) != EV_SET) {
-        int old = qatomic_xchg(&ev->value, EV_SET);
-
-        /* Pairs with memory barrier after ResetEvent.  */
-        smp_mb__after_rmw();
-        if (old == EV_BUSY) {
-            /* There were waiters, wake them up.  */
-            SetEvent(ev->event);
-        }
-    }
-}
-
-void qemu_event_reset(QemuEvent *ev)
-{
-    assert(ev->initialized);
-
-    /*
-     * If there was a concurrent reset (or even reset+wait),
-     * do nothing.  Otherwise change EV_SET->EV_FREE.
-     */
-    qatomic_or(&ev->value, EV_FREE);
-
-    /*
-     * Order reset before checking the condition in the caller.
-     * Pairs with the first memory barrier in qemu_event_set().
-     */
-    smp_mb__after_rmw();
-}
-
-void qemu_event_wait(QemuEvent *ev)
-{
-    unsigned value;
-
-    assert(ev->initialized);
-
-    /*
-     * qemu_event_wait must synchronize with qemu_event_set even if it does
-     * not go down the slow path, so this load-acquire is needed that
-     * synchronizes with the first memory barrier in qemu_event_set().
-     *
-     * If we do go down the slow path, there is no requirement at all: we
-     * might miss a qemu_event_set() here but ultimately the memory barrier in
-     * qemu_futex_wait() will ensure the check is done correctly.
-     */
-    value = qatomic_load_acquire(&ev->value);
-    if (value != EV_SET) {
-        if (value == EV_FREE) {
-            /*
-             * Here the underlying kernel event is reset, but qemu_event_set is
-             * not yet going to call SetEvent.  However, there will be another
-             * check for EV_SET below when setting EV_BUSY.  At that point it
-             * is safe to call WaitForSingleObject.
-             */
-            ResetEvent(ev->event);
-
-            /*
-             * It is not clear whether ResetEvent provides this barrier; kernel
-             * APIs (KeResetEvent/KeClearEvent) do not.  Better safe than sorry!
-             */
-            smp_mb();
-
-            /*
-             * Leave the event reset and tell qemu_event_set that there are
-             * waiters.  No need to retry, because there cannot be a concurrent
-             * busy->free transition.  After the CAS, the event will be either
-             * set or busy.
-             */
-            if (qatomic_cmpxchg(&ev->value, EV_FREE, EV_BUSY) == EV_SET) {
-                return;
-            }
-        }
-
-        /*
-         * ev->value is now EV_BUSY.  Since we didn't observe EV_SET,
-         * qemu_event_set() must observe EV_BUSY and call SetEvent().
-         */
-        WaitForSingleObject(ev->event, INFINITE);
-    }
-}
-
 struct QemuThreadData {
     /* Passed to win32_start_routine.  */
     void             *(*start_routine)(void *);

From 0a765ca850125e0202c366cb4aab032ac9670870 Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <akihiko.odaki@daynix.com>
Date: Thu, 29 May 2025 14:45:55 +0900
Subject: [PATCH 1452/2760] qemu-thread: Use futex if available for QemuLockCnt

This unlocks the futex-based implementation of QemuLockCnt to Windows.

Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Link: https://lore.kernel.org/r/20250529-event-v5-6-53b285203794@daynix.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 include/qemu/lockcnt.h | 2 +-
 util/lockcnt.c         | 7 ++++---
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/include/qemu/lockcnt.h b/include/qemu/lockcnt.h
index f4b62a3f70..5a2800e3f1 100644
--- a/include/qemu/lockcnt.h
+++ b/include/qemu/lockcnt.h
@@ -17,7 +17,7 @@
 typedef struct QemuLockCnt QemuLockCnt;
 
 struct QemuLockCnt {
-#ifndef CONFIG_LINUX
+#ifndef HAVE_FUTEX
     QemuMutex mutex;
 #endif
     unsigned count;
diff --git a/util/lockcnt.c b/util/lockcnt.c
index ca27d8e61a..92c9f8ceca 100644
--- a/util/lockcnt.c
+++ b/util/lockcnt.c
@@ -12,10 +12,11 @@
 #include "qemu/atomic.h"
 #include "trace.h"
 
-#ifdef CONFIG_LINUX
-#include "qemu/futex.h"
+#ifdef HAVE_FUTEX
 
-/* On Linux, bits 0-1 are a futex-based lock, bits 2-31 are the counter.
+/*
+ * When futex is available, bits 0-1 are a futex-based lock, bits 2-31 are the
+ * counter.
  * For the mutex algorithm see Ulrich Drepper's "Futexes Are Tricky" (ok,
  * this is not the most relaxing citation I could make...).  It is similar
  * to mutex2 in the paper.

From 5e2312f75adcba8cfee343a03343bf298c5bc937 Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <akihiko.odaki@daynix.com>
Date: Thu, 29 May 2025 14:46:01 +0900
Subject: [PATCH 1453/2760] qemu-thread: Document QemuEvent

Document QemuEvent to help choose an appropriate synchronization
primitive.

Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Link: https://lore.kernel.org/r/20250529-event-v5-12-53b285203794@daynix.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 include/qemu/thread.h | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/include/qemu/thread.h b/include/qemu/thread.h
index 573f8c9ede..f0302ed01f 100644
--- a/include/qemu/thread.h
+++ b/include/qemu/thread.h
@@ -10,6 +10,16 @@ typedef struct QemuSemaphore QemuSemaphore;
 typedef struct QemuLockCnt QemuLockCnt;
 typedef struct QemuThread QemuThread;
 
+/*
+ * QemuEvent
+ * =========
+ *
+ * QemuEvent is an implementation of Win32 manual-reset event object.
+ * For details, refer to:
+ * https://learn.microsoft.com/en-us/windows/win32/sync/using-event-objects
+ *
+ * QemuEvent is more lightweight than QemuSemaphore when HAVE_FUTEX is defined.
+ */
 typedef struct QemuEvent {
 #ifndef HAVE_FUTEX
     pthread_mutex_t lock;

From 952691b7a6c93f4f5b9ae9bb178021511374967a Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <akihiko.odaki@daynix.com>
Date: Thu, 29 May 2025 14:45:56 +0900
Subject: [PATCH 1454/2760] migration: Replace QemuSemaphore with QemuEvent
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

pause_event can utilize qemu_event_reset() to discard events.

Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/r/20250529-event-v5-7-53b285203794@daynix.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 migration/migration.c | 21 +++++++++------------
 migration/migration.h |  2 +-
 2 files changed, 10 insertions(+), 13 deletions(-)

diff --git a/migration/migration.c b/migration/migration.c
index 4697732bef..4098870bce 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -1630,7 +1630,7 @@ void migration_cancel(void)
         }
         /* If the migration is paused, kick it out of the pause */
         if (old_state == MIGRATION_STATUS_PRE_SWITCHOVER) {
-            qemu_sem_post(&s->pause_sem);
+            qemu_event_set(&s->pause_event);
         }
         migrate_set_state(&s->state, old_state, MIGRATION_STATUS_CANCELLING);
     } while (s->state != MIGRATION_STATUS_CANCELLING);
@@ -2342,7 +2342,7 @@ void qmp_migrate_continue(MigrationStatus state, Error **errp)
                    MigrationStatus_str(s->state));
         return;
     }
-    qemu_sem_post(&s->pause_sem);
+    qemu_event_set(&s->pause_event);
 }
 
 int migration_rp_wait(MigrationState *s)
@@ -2911,21 +2911,18 @@ static bool migration_switchover_prepare(MigrationState *s)
         return true;
     }
 
-    /* Since leaving this state is not atomic with posting the semaphore
+    /*
+     * Since leaving this state is not atomic with setting the event
      * it's possible that someone could have issued multiple migrate_continue
-     * and the semaphore is incorrectly positive at this point;
-     * the docs say it's undefined to reinit a semaphore that's already
-     * init'd, so use timedwait to eat up any existing posts.
+     * and the event is incorrectly set at this point so reset it.
      */
-    while (qemu_sem_timedwait(&s->pause_sem, 1) == 0) {
-        /* This block intentionally left blank */
-    }
+    qemu_event_reset(&s->pause_event);
 
     /* Update [POSTCOPY_]ACTIVE to PRE_SWITCHOVER */
     migrate_set_state(&s->state, s->state, MIGRATION_STATUS_PRE_SWITCHOVER);
     bql_unlock();
 
-    qemu_sem_wait(&s->pause_sem);
+    qemu_event_wait(&s->pause_event);
 
     bql_lock();
     /*
@@ -4057,7 +4054,7 @@ static void migration_instance_finalize(Object *obj)
     qemu_mutex_destroy(&ms->qemu_file_lock);
     qemu_sem_destroy(&ms->wait_unplug_sem);
     qemu_sem_destroy(&ms->rate_limit_sem);
-    qemu_sem_destroy(&ms->pause_sem);
+    qemu_event_destroy(&ms->pause_event);
     qemu_sem_destroy(&ms->postcopy_pause_sem);
     qemu_sem_destroy(&ms->rp_state.rp_sem);
     qemu_sem_destroy(&ms->rp_state.rp_pong_acks);
@@ -4072,7 +4069,7 @@ static void migration_instance_init(Object *obj)
     ms->state = MIGRATION_STATUS_NONE;
     ms->mbps = -1;
     ms->pages_per_second = -1;
-    qemu_sem_init(&ms->pause_sem, 0);
+    qemu_event_init(&ms->pause_event, false);
     qemu_mutex_init(&ms->error_mutex);
 
     migrate_params_init(&ms->parameters);
diff --git a/migration/migration.h b/migration/migration.h
index d53f7cad84..21aa6a3c8f 100644
--- a/migration/migration.h
+++ b/migration/migration.h
@@ -379,7 +379,7 @@ struct MigrationState {
     QemuSemaphore wait_unplug_sem;
 
     /* Migration is paused due to pause-before-switchover */
-    QemuSemaphore pause_sem;
+    QemuEvent pause_event;
 
     /* The semaphore is used to notify COLO thread that failover is finished */
     QemuSemaphore colo_exit_sem;

From da926a8b9dd67be3432c525a6db998141be444e2 Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <akihiko.odaki@daynix.com>
Date: Thu, 29 May 2025 14:45:57 +0900
Subject: [PATCH 1455/2760] migration/colo: Replace QemuSemaphore with
 QemuEvent
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

colo_exit_sem and colo_incoming_sem represent one-shot events so they
can be converted into QemuEvent, which is more lightweight.

Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/r/20250529-event-v5-8-53b285203794@daynix.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 migration/colo.c      | 20 ++++++++++----------
 migration/migration.h |  6 +++---
 2 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/migration/colo.c b/migration/colo.c
index c976b3ff34..e0f713c837 100644
--- a/migration/colo.c
+++ b/migration/colo.c
@@ -146,7 +146,7 @@ static void secondary_vm_do_failover(void)
         return;
     }
     /* Notify COLO incoming thread that failover work is finished */
-    qemu_sem_post(&mis->colo_incoming_sem);
+    qemu_event_set(&mis->colo_incoming_event);
 
     /* For Secondary VM, jump to incoming co */
     if (mis->colo_incoming_co) {
@@ -195,7 +195,7 @@ static void primary_vm_do_failover(void)
     }
 
     /* Notify COLO thread that failover work is finished */
-    qemu_sem_post(&s->colo_exit_sem);
+    qemu_event_set(&s->colo_exit_event);
 }
 
 COLOMode get_colo_mode(void)
@@ -620,8 +620,8 @@ out:
     }
 
     /* Hope this not to be too long to wait here */
-    qemu_sem_wait(&s->colo_exit_sem);
-    qemu_sem_destroy(&s->colo_exit_sem);
+    qemu_event_wait(&s->colo_exit_event);
+    qemu_event_destroy(&s->colo_exit_event);
 
     /*
      * It is safe to unregister notifier after failover finished.
@@ -651,7 +651,7 @@ void migrate_start_colo_process(MigrationState *s)
     s->colo_delay_timer =  timer_new_ms(QEMU_CLOCK_HOST,
                                 colo_checkpoint_notify_timer, NULL);
 
-    qemu_sem_init(&s->colo_exit_sem, 0);
+    qemu_event_init(&s->colo_exit_event, false);
     colo_process_checkpoint(s);
     bql_lock();
 }
@@ -808,11 +808,11 @@ void colo_shutdown(void)
     case COLO_MODE_PRIMARY:
         s = migrate_get_current();
         qemu_event_set(&s->colo_checkpoint_event);
-        qemu_sem_post(&s->colo_exit_sem);
+        qemu_event_set(&s->colo_exit_event);
         break;
     case COLO_MODE_SECONDARY:
         mis = migration_incoming_get_current();
-        qemu_sem_post(&mis->colo_incoming_sem);
+        qemu_event_set(&mis->colo_incoming_event);
         break;
     default:
         break;
@@ -827,7 +827,7 @@ static void *colo_process_incoming_thread(void *opaque)
     Error *local_err = NULL;
 
     rcu_register_thread();
-    qemu_sem_init(&mis->colo_incoming_sem, 0);
+    qemu_event_init(&mis->colo_incoming_event, false);
 
     migrate_set_state(&mis->state, MIGRATION_STATUS_ACTIVE,
                       MIGRATION_STATUS_COLO);
@@ -923,8 +923,8 @@ out:
     }
 
     /* Hope this not to be too long to loop here */
-    qemu_sem_wait(&mis->colo_incoming_sem);
-    qemu_sem_destroy(&mis->colo_incoming_sem);
+    qemu_event_wait(&mis->colo_incoming_event);
+    qemu_event_destroy(&mis->colo_incoming_event);
 
     rcu_unregister_thread();
     return NULL;
diff --git a/migration/migration.h b/migration/migration.h
index 21aa6a3c8f..aaec471c00 100644
--- a/migration/migration.h
+++ b/migration/migration.h
@@ -186,7 +186,7 @@ struct MigrationIncomingState {
 
     /* The coroutine we should enter (back) after failover */
     Coroutine *colo_incoming_co;
-    QemuSemaphore colo_incoming_sem;
+    QemuEvent colo_incoming_event;
 
     /* Optional load threads pool and its thread exit request flag */
     ThreadPool *load_threads;
@@ -381,8 +381,8 @@ struct MigrationState {
     /* Migration is paused due to pause-before-switchover */
     QemuEvent pause_event;
 
-    /* The semaphore is used to notify COLO thread that failover is finished */
-    QemuSemaphore colo_exit_sem;
+    /* The event is used to notify COLO thread that failover is finished */
+    QemuEvent colo_exit_event;
 
     /* The event is used to notify COLO thread to do checkpoint */
     QemuEvent colo_checkpoint_event;

From d401b7aed83af96fa0e68f46b15446838f6f5e0f Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <akihiko.odaki@daynix.com>
Date: Thu, 29 May 2025 14:45:58 +0900
Subject: [PATCH 1456/2760] migration/postcopy: Replace QemuSemaphore with
 QemuEvent

thread_sync_sem is an one-shot event so it can be converted into
QemuEvent, which is more lightweight.

Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20250529-event-v5-9-53b285203794@daynix.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 migration/migration.h    |  4 ++--
 migration/postcopy-ram.c | 10 +++++-----
 migration/savevm.c       |  2 +-
 3 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/migration/migration.h b/migration/migration.h
index aaec471c00..739289de93 100644
--- a/migration/migration.h
+++ b/migration/migration.h
@@ -98,9 +98,9 @@ struct MigrationIncomingState {
     void (*transport_cleanup)(void *data);
     /*
      * Used to sync thread creations.  Note that we can't create threads in
-     * parallel with this sem.
+     * parallel with this event.
      */
-    QemuSemaphore  thread_sync_sem;
+    QemuEvent  thread_sync_event;
     /*
      * Free at the start of the main state load, set as the main thread finishes
      * loading state.
diff --git a/migration/postcopy-ram.c b/migration/postcopy-ram.c
index 995614b38c..75fd310fb2 100644
--- a/migration/postcopy-ram.c
+++ b/migration/postcopy-ram.c
@@ -90,10 +90,10 @@ void postcopy_thread_create(MigrationIncomingState *mis,
                             QemuThread *thread, const char *name,
                             void *(*fn)(void *), int joinable)
 {
-    qemu_sem_init(&mis->thread_sync_sem, 0);
+    qemu_event_init(&mis->thread_sync_event, false);
     qemu_thread_create(thread, name, fn, mis, joinable);
-    qemu_sem_wait(&mis->thread_sync_sem);
-    qemu_sem_destroy(&mis->thread_sync_sem);
+    qemu_event_wait(&mis->thread_sync_event);
+    qemu_event_destroy(&mis->thread_sync_event);
 }
 
 /* Postcopy needs to detect accesses to pages that haven't yet been copied
@@ -964,7 +964,7 @@ static void *postcopy_ram_fault_thread(void *opaque)
     trace_postcopy_ram_fault_thread_entry();
     rcu_register_thread();
     mis->last_rb = NULL; /* last RAMBlock we sent part of */
-    qemu_sem_post(&mis->thread_sync_sem);
+    qemu_event_set(&mis->thread_sync_event);
 
     struct pollfd *pfd;
     size_t pfd_len = 2 + mis->postcopy_remote_fds->len;
@@ -1716,7 +1716,7 @@ void *postcopy_preempt_thread(void *opaque)
 
     rcu_register_thread();
 
-    qemu_sem_post(&mis->thread_sync_sem);
+    qemu_event_set(&mis->thread_sync_event);
 
     /*
      * The preempt channel is established in asynchronous way.  Wait
diff --git a/migration/savevm.c b/migration/savevm.c
index 006514c3e3..52105dd2f1 100644
--- a/migration/savevm.c
+++ b/migration/savevm.c
@@ -2078,7 +2078,7 @@ static void *postcopy_ram_listen_thread(void *opaque)
 
     migrate_set_state(&mis->state, MIGRATION_STATUS_ACTIVE,
                                    MIGRATION_STATUS_POSTCOPY_ACTIVE);
-    qemu_sem_post(&mis->thread_sync_sem);
+    qemu_event_set(&mis->thread_sync_event);
     trace_postcopy_ram_listen_thread_start();
 
     rcu_register_thread();

From 23aec0d0e80a31d3fc3061e5c83432007502948a Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <akihiko.odaki@daynix.com>
Date: Thu, 29 May 2025 14:45:59 +0900
Subject: [PATCH 1457/2760] hw/display/apple-gfx: Replace QemuSemaphore with
 QemuEvent
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

sem in AppleGFXReadMemoryJob is an one-shot event so it can be converted
into QemuEvent, which is more specialized for such a use case.

Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/r/20250529-event-v5-10-53b285203794@daynix.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/display/apple-gfx.m | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/hw/display/apple-gfx.m b/hw/display/apple-gfx.m
index 8dde1f138d..174d56ae05 100644
--- a/hw/display/apple-gfx.m
+++ b/hw/display/apple-gfx.m
@@ -454,7 +454,7 @@ static void set_cursor_glyph(void *opaque)
 /* ------ DMA (device reading system memory) ------ */
 
 typedef struct AppleGFXReadMemoryJob {
-    QemuSemaphore sem;
+    QemuEvent event;
     hwaddr physical_address;
     uint64_t length;
     void *dst;
@@ -470,7 +470,7 @@ static void apple_gfx_do_read_memory(void *opaque)
                         job->dst, job->length, MEMTXATTRS_UNSPECIFIED);
     job->success = (r == MEMTX_OK);
 
-    qemu_sem_post(&job->sem);
+    qemu_event_set(&job->event);
 }
 
 static bool apple_gfx_read_memory(AppleGFXState *s, hwaddr physical_address,
@@ -483,11 +483,11 @@ static bool apple_gfx_read_memory(AppleGFXState *s, hwaddr physical_address,
     trace_apple_gfx_read_memory(physical_address, length, dst);
 
     /* Performing DMA requires BQL, so do it in a BH. */
-    qemu_sem_init(&job.sem, 0);
+    qemu_event_init(&job.event, 0);
     aio_bh_schedule_oneshot(qemu_get_aio_context(),
                             apple_gfx_do_read_memory, &job);
-    qemu_sem_wait(&job.sem);
-    qemu_sem_destroy(&job.sem);
+    qemu_event_wait(&job.event);
+    qemu_event_destroy(&job.event);
     return job.success;
 }
 

From bc40e4fe6263f2c939ac8455033bfec18c9b3a0a Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Mon, 19 May 2025 15:51:11 +0100
Subject: [PATCH 1458/2760] target/i386: Detect flush-to-zero after rounding

The Intel SDM section 10.2.3.3 on the MXCSR.FTZ bit says that we
flush outputs to zero when we detect underflow, which is after
rounding.  Set the detect_ftz flag accordingly.

This allows us to enable the test in fma.c which checks this
behaviour.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250519145114.2786534-2-peter.maydell@linaro.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/tcg/fpu_helper.c | 8 ++++----
 tests/tcg/x86_64/fma.c       | 5 -----
 2 files changed, 4 insertions(+), 9 deletions(-)

diff --git a/target/i386/tcg/fpu_helper.c b/target/i386/tcg/fpu_helper.c
index 1cbadb1453..9ea67ea76c 100644
--- a/target/i386/tcg/fpu_helper.c
+++ b/target/i386/tcg/fpu_helper.c
@@ -189,13 +189,13 @@ void cpu_init_fp_statuses(CPUX86State *env)
     set_float_default_nan_pattern(0b11000000, &env->mmx_status);
     set_float_default_nan_pattern(0b11000000, &env->sse_status);
     /*
-     * TODO: x86 does flush-to-zero detection after rounding (the SDM
+     * x86 does flush-to-zero detection after rounding (the SDM
      * section 10.2.3.3 on the FTZ bit of MXCSR says that we flush
      * when we detect underflow, which x86 does after rounding).
      */
-    set_float_ftz_detection(float_ftz_before_rounding, &env->fp_status);
-    set_float_ftz_detection(float_ftz_before_rounding, &env->mmx_status);
-    set_float_ftz_detection(float_ftz_before_rounding, &env->sse_status);
+    set_float_ftz_detection(float_ftz_after_rounding, &env->fp_status);
+    set_float_ftz_detection(float_ftz_after_rounding, &env->mmx_status);
+    set_float_ftz_detection(float_ftz_after_rounding, &env->sse_status);
 }
 
 static inline uint8_t save_exception_flags(CPUX86State *env)
diff --git a/tests/tcg/x86_64/fma.c b/tests/tcg/x86_64/fma.c
index 09c622ebc0..46f863005e 100644
--- a/tests/tcg/x86_64/fma.c
+++ b/tests/tcg/x86_64/fma.c
@@ -79,14 +79,9 @@ static testdata tests[] = {
     /*
      * Flushing of denormal outputs to zero should also happen after
      * rounding, so setting FTZ should not affect the result or the flags.
-     * QEMU currently does not emulate this correctly because we do the
-     * flush-to-zero check before rounding, so we incorrectly produce a
-     * zero result and set Underflow as well as Precision.
      */
-#ifdef ENABLE_FAILING_TESTS
     { 0x3fdfffffffffffff, 0x001fffffffffffff, 0x801fffffffffffff, true,
       0x8010000000000000, 0x20 }, /* Enabling FTZ shouldn't change flags */
-#endif
 };
 
 int main(void)

From 397ef415cad11c91318b512ecfaa27679ea7e351 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Mon, 19 May 2025 15:51:12 +0100
Subject: [PATCH 1459/2760] target/i386: Use correct type for
 get_float_exception_flags() values
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The softfloat get_float_exception_flags() function returns 'int', but
in various places in target/i386 we incorrectly store the returned
value into a uint8_t.  This currently has no ill effects because i386
doesn't care about any of the float_flag enum values above 0x40.
However, we want to start using float_flag_input_denormal_used, which
is 0x4000.

Switch to using 'int' so that we can handle all the possible valid
float_flag_* values. This includes changing the return type of
save_exception_flags() and the argument to merge_exception_flags().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250519145114.2786534-3-peter.maydell@linaro.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/ops_sse.h        | 16 +++----
 target/i386/tcg/fpu_helper.c | 82 ++++++++++++++++++------------------
 2 files changed, 49 insertions(+), 49 deletions(-)

diff --git a/target/i386/ops_sse.h b/target/i386/ops_sse.h
index f0aa1894aa..a2e4d48039 100644
--- a/target/i386/ops_sse.h
+++ b/target/i386/ops_sse.h
@@ -842,7 +842,7 @@ int64_t helper_cvttsd2sq(CPUX86State *env, ZMMReg *s)
 
 void glue(helper_rsqrtps, SUFFIX)(CPUX86State *env, ZMMReg *d, ZMMReg *s)
 {
-    uint8_t old_flags = get_float_exception_flags(&env->sse_status);
+    int old_flags = get_float_exception_flags(&env->sse_status);
     int i;
     for (i = 0; i < 2 << SHIFT; i++) {
         d->ZMM_S(i) = float32_div(float32_one,
@@ -855,7 +855,7 @@ void glue(helper_rsqrtps, SUFFIX)(CPUX86State *env, ZMMReg *d, ZMMReg *s)
 #if SHIFT == 1
 void helper_rsqrtss(CPUX86State *env, ZMMReg *d, ZMMReg *v, ZMMReg *s)
 {
-    uint8_t old_flags = get_float_exception_flags(&env->sse_status);
+    int old_flags = get_float_exception_flags(&env->sse_status);
     int i;
     d->ZMM_S(0) = float32_div(float32_one,
                               float32_sqrt(s->ZMM_S(0), &env->sse_status),
@@ -869,7 +869,7 @@ void helper_rsqrtss(CPUX86State *env, ZMMReg *d, ZMMReg *v, ZMMReg *s)
 
 void glue(helper_rcpps, SUFFIX)(CPUX86State *env, ZMMReg *d, ZMMReg *s)
 {
-    uint8_t old_flags = get_float_exception_flags(&env->sse_status);
+    int old_flags = get_float_exception_flags(&env->sse_status);
     int i;
     for (i = 0; i < 2 << SHIFT; i++) {
         d->ZMM_S(i) = float32_div(float32_one, s->ZMM_S(i), &env->sse_status);
@@ -880,7 +880,7 @@ void glue(helper_rcpps, SUFFIX)(CPUX86State *env, ZMMReg *d, ZMMReg *s)
 #if SHIFT == 1
 void helper_rcpss(CPUX86State *env, ZMMReg *d, ZMMReg *v, ZMMReg *s)
 {
-    uint8_t old_flags = get_float_exception_flags(&env->sse_status);
+    int old_flags = get_float_exception_flags(&env->sse_status);
     int i;
     d->ZMM_S(0) = float32_div(float32_one, s->ZMM_S(0), &env->sse_status);
     for (i = 1; i < 2 << SHIFT; i++) {
@@ -1714,7 +1714,7 @@ void glue(helper_phminposuw, SUFFIX)(CPUX86State *env, Reg *d, Reg *s)
 void glue(helper_roundps, SUFFIX)(CPUX86State *env, Reg *d, Reg *s,
                                   uint32_t mode)
 {
-    uint8_t old_flags = get_float_exception_flags(&env->sse_status);
+    int old_flags = get_float_exception_flags(&env->sse_status);
     signed char prev_rounding_mode;
     int i;
 
@@ -1738,7 +1738,7 @@ void glue(helper_roundps, SUFFIX)(CPUX86State *env, Reg *d, Reg *s,
 void glue(helper_roundpd, SUFFIX)(CPUX86State *env, Reg *d, Reg *s,
                                   uint32_t mode)
 {
-    uint8_t old_flags = get_float_exception_flags(&env->sse_status);
+    int old_flags = get_float_exception_flags(&env->sse_status);
     signed char prev_rounding_mode;
     int i;
 
@@ -1763,7 +1763,7 @@ void glue(helper_roundpd, SUFFIX)(CPUX86State *env, Reg *d, Reg *s,
 void glue(helper_roundss, SUFFIX)(CPUX86State *env, Reg *d, Reg *v, Reg *s,
                                   uint32_t mode)
 {
-    uint8_t old_flags = get_float_exception_flags(&env->sse_status);
+    int old_flags = get_float_exception_flags(&env->sse_status);
     signed char prev_rounding_mode;
     int i;
 
@@ -1788,7 +1788,7 @@ void glue(helper_roundss, SUFFIX)(CPUX86State *env, Reg *d, Reg *v, Reg *s,
 void glue(helper_roundsd, SUFFIX)(CPUX86State *env, Reg *d, Reg *v, Reg *s,
                                   uint32_t mode)
 {
-    uint8_t old_flags = get_float_exception_flags(&env->sse_status);
+    int old_flags = get_float_exception_flags(&env->sse_status);
     signed char prev_rounding_mode;
     int i;
 
diff --git a/target/i386/tcg/fpu_helper.c b/target/i386/tcg/fpu_helper.c
index 9ea67ea76c..4732b71812 100644
--- a/target/i386/tcg/fpu_helper.c
+++ b/target/i386/tcg/fpu_helper.c
@@ -198,16 +198,16 @@ void cpu_init_fp_statuses(CPUX86State *env)
     set_float_ftz_detection(float_ftz_after_rounding, &env->sse_status);
 }
 
-static inline uint8_t save_exception_flags(CPUX86State *env)
+static inline int save_exception_flags(CPUX86State *env)
 {
-    uint8_t old_flags = get_float_exception_flags(&env->fp_status);
+    int old_flags = get_float_exception_flags(&env->fp_status);
     set_float_exception_flags(0, &env->fp_status);
     return old_flags;
 }
 
-static void merge_exception_flags(CPUX86State *env, uint8_t old_flags)
+static void merge_exception_flags(CPUX86State *env, int old_flags)
 {
-    uint8_t new_flags = get_float_exception_flags(&env->fp_status);
+    int new_flags = get_float_exception_flags(&env->fp_status);
     float_raise(old_flags, &env->fp_status);
     fpu_set_exception(env,
                       ((new_flags & float_flag_invalid ? FPUS_IE : 0) |
@@ -220,7 +220,7 @@ static void merge_exception_flags(CPUX86State *env, uint8_t old_flags)
 
 static inline floatx80 helper_fdiv(CPUX86State *env, floatx80 a, floatx80 b)
 {
-    uint8_t old_flags = save_exception_flags(env);
+    int old_flags = save_exception_flags(env);
     floatx80 ret = floatx80_div(a, b, &env->fp_status);
     merge_exception_flags(env, old_flags);
     return ret;
@@ -240,7 +240,7 @@ static void fpu_raise_exception(CPUX86State *env, uintptr_t retaddr)
 
 void helper_flds_FT0(CPUX86State *env, uint32_t val)
 {
-    uint8_t old_flags = save_exception_flags(env);
+    int old_flags = save_exception_flags(env);
     union {
         float32 f;
         uint32_t i;
@@ -253,7 +253,7 @@ void helper_flds_FT0(CPUX86State *env, uint32_t val)
 
 void helper_fldl_FT0(CPUX86State *env, uint64_t val)
 {
-    uint8_t old_flags = save_exception_flags(env);
+    int old_flags = save_exception_flags(env);
     union {
         float64 f;
         uint64_t i;
@@ -271,7 +271,7 @@ void helper_fildl_FT0(CPUX86State *env, int32_t val)
 
 void helper_flds_ST0(CPUX86State *env, uint32_t val)
 {
-    uint8_t old_flags = save_exception_flags(env);
+    int old_flags = save_exception_flags(env);
     int new_fpstt;
     union {
         float32 f;
@@ -288,7 +288,7 @@ void helper_flds_ST0(CPUX86State *env, uint32_t val)
 
 void helper_fldl_ST0(CPUX86State *env, uint64_t val)
 {
-    uint8_t old_flags = save_exception_flags(env);
+    int old_flags = save_exception_flags(env);
     int new_fpstt;
     union {
         float64 f;
@@ -338,7 +338,7 @@ void helper_fildll_ST0(CPUX86State *env, int64_t val)
 
 uint32_t helper_fsts_ST0(CPUX86State *env)
 {
-    uint8_t old_flags = save_exception_flags(env);
+    int old_flags = save_exception_flags(env);
     union {
         float32 f;
         uint32_t i;
@@ -351,7 +351,7 @@ uint32_t helper_fsts_ST0(CPUX86State *env)
 
 uint64_t helper_fstl_ST0(CPUX86State *env)
 {
-    uint8_t old_flags = save_exception_flags(env);
+    int old_flags = save_exception_flags(env);
     union {
         float64 f;
         uint64_t i;
@@ -364,7 +364,7 @@ uint64_t helper_fstl_ST0(CPUX86State *env)
 
 int32_t helper_fist_ST0(CPUX86State *env)
 {
-    uint8_t old_flags = save_exception_flags(env);
+    int old_flags = save_exception_flags(env);
     int32_t val;
 
     val = floatx80_to_int32(ST0, &env->fp_status);
@@ -378,7 +378,7 @@ int32_t helper_fist_ST0(CPUX86State *env)
 
 int32_t helper_fistl_ST0(CPUX86State *env)
 {
-    uint8_t old_flags = save_exception_flags(env);
+    int old_flags = save_exception_flags(env);
     int32_t val;
 
     val = floatx80_to_int32(ST0, &env->fp_status);
@@ -391,7 +391,7 @@ int32_t helper_fistl_ST0(CPUX86State *env)
 
 int64_t helper_fistll_ST0(CPUX86State *env)
 {
-    uint8_t old_flags = save_exception_flags(env);
+    int old_flags = save_exception_flags(env);
     int64_t val;
 
     val = floatx80_to_int64(ST0, &env->fp_status);
@@ -404,7 +404,7 @@ int64_t helper_fistll_ST0(CPUX86State *env)
 
 int32_t helper_fistt_ST0(CPUX86State *env)
 {
-    uint8_t old_flags = save_exception_flags(env);
+    int old_flags = save_exception_flags(env);
     int32_t val;
 
     val = floatx80_to_int32_round_to_zero(ST0, &env->fp_status);
@@ -418,7 +418,7 @@ int32_t helper_fistt_ST0(CPUX86State *env)
 
 int32_t helper_fisttl_ST0(CPUX86State *env)
 {
-    uint8_t old_flags = save_exception_flags(env);
+    int old_flags = save_exception_flags(env);
     int32_t val;
 
     val = floatx80_to_int32_round_to_zero(ST0, &env->fp_status);
@@ -431,7 +431,7 @@ int32_t helper_fisttl_ST0(CPUX86State *env)
 
 int64_t helper_fisttll_ST0(CPUX86State *env)
 {
-    uint8_t old_flags = save_exception_flags(env);
+    int old_flags = save_exception_flags(env);
     int64_t val;
 
     val = floatx80_to_int64_round_to_zero(ST0, &env->fp_status);
@@ -527,7 +527,7 @@ static const int fcom_ccval[4] = {0x0100, 0x4000, 0x0000, 0x4500};
 
 void helper_fcom_ST0_FT0(CPUX86State *env)
 {
-    uint8_t old_flags = save_exception_flags(env);
+    int old_flags = save_exception_flags(env);
     FloatRelation ret;
 
     ret = floatx80_compare(ST0, FT0, &env->fp_status);
@@ -537,7 +537,7 @@ void helper_fcom_ST0_FT0(CPUX86State *env)
 
 void helper_fucom_ST0_FT0(CPUX86State *env)
 {
-    uint8_t old_flags = save_exception_flags(env);
+    int old_flags = save_exception_flags(env);
     FloatRelation ret;
 
     ret = floatx80_compare_quiet(ST0, FT0, &env->fp_status);
@@ -549,7 +549,7 @@ static const int fcomi_ccval[4] = {CC_C, CC_Z, 0, CC_Z | CC_P | CC_C};
 
 void helper_fcomi_ST0_FT0(CPUX86State *env)
 {
-    uint8_t old_flags = save_exception_flags(env);
+    int old_flags = save_exception_flags(env);
     int eflags;
     FloatRelation ret;
 
@@ -562,7 +562,7 @@ void helper_fcomi_ST0_FT0(CPUX86State *env)
 
 void helper_fucomi_ST0_FT0(CPUX86State *env)
 {
-    uint8_t old_flags = save_exception_flags(env);
+    int old_flags = save_exception_flags(env);
     int eflags;
     FloatRelation ret;
 
@@ -575,28 +575,28 @@ void helper_fucomi_ST0_FT0(CPUX86State *env)
 
 void helper_fadd_ST0_FT0(CPUX86State *env)
 {
-    uint8_t old_flags = save_exception_flags(env);
+    int old_flags = save_exception_flags(env);
     ST0 = floatx80_add(ST0, FT0, &env->fp_status);
     merge_exception_flags(env, old_flags);
 }
 
 void helper_fmul_ST0_FT0(CPUX86State *env)
 {
-    uint8_t old_flags = save_exception_flags(env);
+    int old_flags = save_exception_flags(env);
     ST0 = floatx80_mul(ST0, FT0, &env->fp_status);
     merge_exception_flags(env, old_flags);
 }
 
 void helper_fsub_ST0_FT0(CPUX86State *env)
 {
-    uint8_t old_flags = save_exception_flags(env);
+    int old_flags = save_exception_flags(env);
     ST0 = floatx80_sub(ST0, FT0, &env->fp_status);
     merge_exception_flags(env, old_flags);
 }
 
 void helper_fsubr_ST0_FT0(CPUX86State *env)
 {
-    uint8_t old_flags = save_exception_flags(env);
+    int old_flags = save_exception_flags(env);
     ST0 = floatx80_sub(FT0, ST0, &env->fp_status);
     merge_exception_flags(env, old_flags);
 }
@@ -615,28 +615,28 @@ void helper_fdivr_ST0_FT0(CPUX86State *env)
 
 void helper_fadd_STN_ST0(CPUX86State *env, int st_index)
 {
-    uint8_t old_flags = save_exception_flags(env);
+    int old_flags = save_exception_flags(env);
     ST(st_index) = floatx80_add(ST(st_index), ST0, &env->fp_status);
     merge_exception_flags(env, old_flags);
 }
 
 void helper_fmul_STN_ST0(CPUX86State *env, int st_index)
 {
-    uint8_t old_flags = save_exception_flags(env);
+    int old_flags = save_exception_flags(env);
     ST(st_index) = floatx80_mul(ST(st_index), ST0, &env->fp_status);
     merge_exception_flags(env, old_flags);
 }
 
 void helper_fsub_STN_ST0(CPUX86State *env, int st_index)
 {
-    uint8_t old_flags = save_exception_flags(env);
+    int old_flags = save_exception_flags(env);
     ST(st_index) = floatx80_sub(ST(st_index), ST0, &env->fp_status);
     merge_exception_flags(env, old_flags);
 }
 
 void helper_fsubr_STN_ST0(CPUX86State *env, int st_index)
 {
-    uint8_t old_flags = save_exception_flags(env);
+    int old_flags = save_exception_flags(env);
     ST(st_index) = floatx80_sub(ST0, ST(st_index), &env->fp_status);
     merge_exception_flags(env, old_flags);
 }
@@ -861,7 +861,7 @@ void helper_fbld_ST0(CPUX86State *env, target_ulong ptr)
 
 void helper_fbst_ST0(CPUX86State *env, target_ulong ptr)
 {
-    uint8_t old_flags = save_exception_flags(env);
+    int old_flags = save_exception_flags(env);
     int v;
     target_ulong mem_ref, mem_end;
     int64_t val;
@@ -1136,7 +1136,7 @@ static const struct f2xm1_data f2xm1_table[65] = {
 
 void helper_f2xm1(CPUX86State *env)
 {
-    uint8_t old_flags = save_exception_flags(env);
+    int old_flags = save_exception_flags(env);
     uint64_t sig = extractFloatx80Frac(ST0);
     int32_t exp = extractFloatx80Exp(ST0);
     bool sign = extractFloatx80Sign(ST0);
@@ -1369,7 +1369,7 @@ static const struct fpatan_data fpatan_table[9] = {
 
 void helper_fpatan(CPUX86State *env)
 {
-    uint8_t old_flags = save_exception_flags(env);
+    int old_flags = save_exception_flags(env);
     uint64_t arg0_sig = extractFloatx80Frac(ST0);
     int32_t arg0_exp = extractFloatx80Exp(ST0);
     bool arg0_sign = extractFloatx80Sign(ST0);
@@ -1808,7 +1808,7 @@ void helper_fpatan(CPUX86State *env)
 
 void helper_fxtract(CPUX86State *env)
 {
-    uint8_t old_flags = save_exception_flags(env);
+    int old_flags = save_exception_flags(env);
     CPU_LDoubleU temp;
 
     temp.d = ST0;
@@ -1857,7 +1857,7 @@ void helper_fxtract(CPUX86State *env)
 
 static void helper_fprem_common(CPUX86State *env, bool mod)
 {
-    uint8_t old_flags = save_exception_flags(env);
+    int old_flags = save_exception_flags(env);
     uint64_t quotient;
     CPU_LDoubleU temp0, temp1;
     int exp0, exp1, expdiff;
@@ -2053,7 +2053,7 @@ static void helper_fyl2x_common(CPUX86State *env, floatx80 arg, int32_t *exp,
 
 void helper_fyl2xp1(CPUX86State *env)
 {
-    uint8_t old_flags = save_exception_flags(env);
+    int old_flags = save_exception_flags(env);
     uint64_t arg0_sig = extractFloatx80Frac(ST0);
     int32_t arg0_exp = extractFloatx80Exp(ST0);
     bool arg0_sign = extractFloatx80Sign(ST0);
@@ -2151,7 +2151,7 @@ void helper_fyl2xp1(CPUX86State *env)
 
 void helper_fyl2x(CPUX86State *env)
 {
-    uint8_t old_flags = save_exception_flags(env);
+    int old_flags = save_exception_flags(env);
     uint64_t arg0_sig = extractFloatx80Frac(ST0);
     int32_t arg0_exp = extractFloatx80Exp(ST0);
     bool arg0_sign = extractFloatx80Sign(ST0);
@@ -2298,7 +2298,7 @@ void helper_fyl2x(CPUX86State *env)
 
 void helper_fsqrt(CPUX86State *env)
 {
-    uint8_t old_flags = save_exception_flags(env);
+    int old_flags = save_exception_flags(env);
     if (floatx80_is_neg(ST0)) {
         env->fpus &= ~0x4700;  /* (C3,C2,C1,C0) <-- 0000 */
         env->fpus |= 0x400;
@@ -2324,14 +2324,14 @@ void helper_fsincos(CPUX86State *env)
 
 void helper_frndint(CPUX86State *env)
 {
-    uint8_t old_flags = save_exception_flags(env);
+    int old_flags = save_exception_flags(env);
     ST0 = floatx80_round_to_int(ST0, &env->fp_status);
     merge_exception_flags(env, old_flags);
 }
 
 void helper_fscale(CPUX86State *env)
 {
-    uint8_t old_flags = save_exception_flags(env);
+    int old_flags = save_exception_flags(env);
     if (floatx80_invalid_encoding(ST1, &env->fp_status) ||
         floatx80_invalid_encoding(ST0, &env->fp_status)) {
         float_raise(float_flag_invalid, &env->fp_status);
@@ -2369,7 +2369,7 @@ void helper_fscale(CPUX86State *env)
     } else {
         int n;
         FloatX80RoundPrec save = env->fp_status.floatx80_rounding_precision;
-        uint8_t save_flags = get_float_exception_flags(&env->fp_status);
+        int save_flags = get_float_exception_flags(&env->fp_status);
         set_float_exception_flags(0, &env->fp_status);
         n = floatx80_to_int32_round_to_zero(ST1, &env->fp_status);
         set_float_exception_flags(save_flags, &env->fp_status);
@@ -3269,7 +3269,7 @@ void update_mxcsr_status(CPUX86State *env)
 
 void update_mxcsr_from_sse_status(CPUX86State *env)
 {
-    uint8_t flags = get_float_exception_flags(&env->sse_status);
+    int flags = get_float_exception_flags(&env->sse_status);
     /*
      * The MXCSR denormal flag has opposite semantics to
      * float_flag_input_denormal_flushed (the softfloat code sets that flag

From 57df511180ae015c4f6fac2a8260649a79e8ead9 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Mon, 19 May 2025 15:51:13 +0100
Subject: [PATCH 1460/2760] target/i386: Wire up MXCSR.DE and FPUS.DE correctly

The x86 DE bit in the FPU and MXCSR status is supposed to be set
when an input denormal is consumed. We didn't previously report
this from softfloat, so the x86 code either simply didn't set
the DE bit or else incorrectly wired it up to denormal_flushed,
depending on which register you looked at.

Now we have input_denormal_used we can wire up these DE bits
with the semantics they are supposed to have.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Link: https://lore.kernel.org/r/20250519145114.2786534-4-peter.maydell@linaro.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/tcg/fpu_helper.c | 11 +++--------
 1 file changed, 3 insertions(+), 8 deletions(-)

diff --git a/target/i386/tcg/fpu_helper.c b/target/i386/tcg/fpu_helper.c
index 4732b71812..b3b23823fd 100644
--- a/target/i386/tcg/fpu_helper.c
+++ b/target/i386/tcg/fpu_helper.c
@@ -215,7 +215,7 @@ static void merge_exception_flags(CPUX86State *env, int old_flags)
                        (new_flags & float_flag_overflow ? FPUS_OE : 0) |
                        (new_flags & float_flag_underflow ? FPUS_UE : 0) |
                        (new_flags & float_flag_inexact ? FPUS_PE : 0) |
-                       (new_flags & float_flag_input_denormal_flushed ? FPUS_DE : 0)));
+                       (new_flags & float_flag_input_denormal_used ? FPUS_DE : 0)));
 }
 
 static inline floatx80 helper_fdiv(CPUX86State *env, floatx80 a, floatx80 b)
@@ -3254,6 +3254,7 @@ void update_mxcsr_status(CPUX86State *env)
 
     /* Set exception flags.  */
     set_float_exception_flags((mxcsr & FPUS_IE ? float_flag_invalid : 0) |
+                              (mxcsr & FPUS_DE ? float_flag_input_denormal_used : 0) |
                               (mxcsr & FPUS_ZE ? float_flag_divbyzero : 0) |
                               (mxcsr & FPUS_OE ? float_flag_overflow : 0) |
                               (mxcsr & FPUS_UE ? float_flag_underflow : 0) |
@@ -3270,14 +3271,8 @@ void update_mxcsr_status(CPUX86State *env)
 void update_mxcsr_from_sse_status(CPUX86State *env)
 {
     int flags = get_float_exception_flags(&env->sse_status);
-    /*
-     * The MXCSR denormal flag has opposite semantics to
-     * float_flag_input_denormal_flushed (the softfloat code sets that flag
-     * only when flushing input denormals to zero, but SSE sets it
-     * only when not flushing them to zero), so is not converted
-     * here.
-     */
     env->mxcsr |= ((flags & float_flag_invalid ? FPUS_IE : 0) |
+                   (flags & float_flag_input_denormal_used ? FPUS_DE : 0) |
                    (flags & float_flag_divbyzero ? FPUS_ZE : 0) |
                    (flags & float_flag_overflow ? FPUS_OE : 0) |
                    (flags & float_flag_underflow ? FPUS_UE : 0) |

From 3f9bdfb0dc8162cbc080c868625336178ddcda56 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Mon, 19 May 2025 15:51:14 +0100
Subject: [PATCH 1461/2760] tests/tcg/x86_64/fma: add test for exact-denormal
 output

Add some fma test cases that check for correct handling of FTZ and
for the flag that indicates that the input denormal was consumed.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250519145114.2786534-5-peter.maydell@linaro.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 tests/tcg/x86_64/fma.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/tests/tcg/x86_64/fma.c b/tests/tcg/x86_64/fma.c
index 46f863005e..34219614c0 100644
--- a/tests/tcg/x86_64/fma.c
+++ b/tests/tcg/x86_64/fma.c
@@ -82,6 +82,18 @@ static testdata tests[] = {
      */
     { 0x3fdfffffffffffff, 0x001fffffffffffff, 0x801fffffffffffff, true,
       0x8010000000000000, 0x20 }, /* Enabling FTZ shouldn't change flags */
+    /*
+     * normal * 0 + a denormal. With FTZ disabled this gives an exact
+     * result (equal to the input denormal) that has consumed the denormal.
+     */
+    { 0x3cc8000000000000, 0x0000000000000000, 0x8008000000000000, false,
+      0x8008000000000000, 0x2 }, /* Denormal */
+    /*
+     * With FTZ enabled, this consumes the denormal, returns zero (because
+     * flushed) and indicates also Underflow and Precision.
+     */
+    { 0x3cc8000000000000, 0x0000000000000000, 0x8008000000000000, true,
+      0x8000000000000000, 0x32 }, /* Precision, Underflow, Denormal */
 };
 
 int main(void)

From 8a1975e4d44b56124dcf37e972e645ba21b3722b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Tue, 3 Jun 2025 12:01:48 +0100
Subject: [PATCH 1462/2760] tests/docker: expose $HOME/.cache/qemu as docker
 volume
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

If you want to run functional tests we should share .cache/qemu so we
don't force containers to continually re-download images. We also move
ccache to use this shared area.

Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250603110204.838117-2-alex.bennee@linaro.org>
---
 tests/docker/Makefile.include | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/tests/docker/Makefile.include b/tests/docker/Makefile.include
index fa1cbb6726..3959d8a028 100644
--- a/tests/docker/Makefile.include
+++ b/tests/docker/Makefile.include
@@ -185,8 +185,10 @@ docker:
 
 docker-help: docker
 
+# Where QEMU caches build artefacts
+DOCKER_QEMU_CACHE_DIR := $$HOME/.cache/qemu
 # Use a global constant ccache directory to speed up repetitive builds
-DOCKER_CCACHE_DIR := $$HOME/.cache/qemu-docker-ccache
+DOCKER_QEMU_CCACHE_DIR := DOCKER_QEMU_CACHE_DIR/docker-ccache
 
 # This rule if for directly running against an arbitrary docker target.
 # It is called by the expanded docker targets (e.g. make
@@ -195,7 +197,7 @@ DOCKER_CCACHE_DIR := $$HOME/.cache/qemu-docker-ccache
 # For example: make docker-run TEST="test-quick" IMAGE="debian:arm64" EXECUTABLE=./aarch64-linux-user/qemu-aarch64
 #
 docker-run: docker-qemu-src
-	@mkdir -p "$(DOCKER_CCACHE_DIR)"
+	@mkdir -p "$(DOCKER_QEMU_CCACHE_DIR)"
 	@if test -z "$(IMAGE)" || test -z "$(TEST)"; \
 		then echo "Invalid target $(IMAGE)/$(TEST)"; exit 1; \
 	fi
@@ -222,8 +224,8 @@ docker-run: docker-qemu-src
 			-e V=$V -e J=$J -e DEBUG=$(DEBUG)		\
 			-e SHOW_ENV=$(SHOW_ENV) 			\
 			$(if $(NOUSER),,				\
-				-e CCACHE_DIR=/var/tmp/ccache 		\
-				-v $(DOCKER_CCACHE_DIR):/var/tmp/ccache:z \
+				-v $(DOCKER_QEMU_CACHE_DIR):$(DOCKER_QEMU_CACHE_DIR) 	\
+				-e CCACHE_DIR=$(DOCKER_QEMU_CCACHE_DIR)	\
 			)						\
 			-v $$(readlink -e $(DOCKER_SRC_COPY)):/var/tmp/qemu:z$(COMMA)ro \
 			$(IMAGE) 					\

From cfd7ebd9b0dc18168cd97f12aeb0782ac0adf869 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Tue, 3 Jun 2025 12:01:49 +0100
Subject: [PATCH 1463/2760] gitlab: disable debug info on CI builds
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Our default build enables debug info which adds hugely to the size of
the builds as well as the size of cached objects. Disable debug info
across the board to save space and reduce pressure on the CI system.
We still have a number of builds which explicitly enable debug and
related extra asserts like --enable-debug-tcg.

Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250603110204.838117-3-alex.bennee@linaro.org>
---
 .gitlab-ci.d/buildtest-template.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.gitlab-ci.d/buildtest-template.yml b/.gitlab-ci.d/buildtest-template.yml
index fea4e8da2f..038c3c9540 100644
--- a/.gitlab-ci.d/buildtest-template.yml
+++ b/.gitlab-ci.d/buildtest-template.yml
@@ -24,6 +24,7 @@
     - ccache --zero-stats
     - section_start configure "Running configure"
     - ../configure --enable-werror --disable-docs --enable-fdt=system
+          --disable-debug-info
           ${TARGETS:+--target-list="$TARGETS"}
           $CONFIGURE_ARGS ||
       { cat config.log meson-logs/meson-log.txt && exit 1; }

From 4f5c81844c3b9185ad1cf80c1e17b05ec22e944a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Tue, 3 Jun 2025 12:01:50 +0100
Subject: [PATCH 1464/2760] tests/tcg: make aarch64 boot.S handle different
 starting modes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Currently the boot.S code assumes everything starts at EL1. This will
break things like the memory test which will barf on unaligned memory
access when run at a higher level.

Adapt the boot code to do some basic verification of the starting mode
and the minimal configuration to move to the lower exception levels.
With this we can run the memory test with:

  -M virt,secure=on
  -M virt,secure=on,virtualization=on
  -M virt,virtualisation=on

If a test needs to be at a particular EL it can use the semihosting
command line to indicate the level we should execute in.

Cc: Julian Armistead <julian.armistead@linaro.org>
Cc: Jim MacArthur <jim.macarthur@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250603110204.838117-4-alex.bennee@linaro.org>
---
 tests/tcg/aarch64/Makefile.softmmu-target |   3 +-
 tests/tcg/aarch64/system/boot.S           | 172 +++++++++++++++++++++-
 2 files changed, 169 insertions(+), 6 deletions(-)

diff --git a/tests/tcg/aarch64/Makefile.softmmu-target b/tests/tcg/aarch64/Makefile.softmmu-target
index 9c52475b7a..f7a7d2b800 100644
--- a/tests/tcg/aarch64/Makefile.softmmu-target
+++ b/tests/tcg/aarch64/Makefile.softmmu-target
@@ -68,7 +68,8 @@ run-plugin-semiconsole-with-%: semiconsole
 
 # vtimer test needs EL2
 QEMU_EL2_MACHINE=-machine virt,virtualization=on,gic-version=2 -cpu cortex-a57 -smp 4
-run-vtimer: QEMU_OPTS=$(QEMU_EL2_MACHINE) $(QEMU_BASE_ARGS) -kernel
+QEMU_EL2_BASE_ARGS=-semihosting-config enable=on,target=native,chardev=output,arg="2"
+run-vtimer: QEMU_OPTS=$(QEMU_EL2_MACHINE) $(QEMU_EL2_BASE_ARGS) -kernel
 
 # Simple Record/Replay Test
 .PHONY: memory-record
diff --git a/tests/tcg/aarch64/system/boot.S b/tests/tcg/aarch64/system/boot.S
index a5df9c173d..8bfa4e4efc 100644
--- a/tests/tcg/aarch64/system/boot.S
+++ b/tests/tcg/aarch64/system/boot.S
@@ -16,6 +16,7 @@
 #define semihosting_call hlt 0xf000
 #define SYS_WRITEC	0x03	/* character to debug channel */
 #define SYS_WRITE0	0x04	/* string to debug channel */
+#define SYS_GET_CMDLINE 0x15	/* get command line */
 #define SYS_EXIT	0x18
 
 	.align	12
@@ -70,21 +71,172 @@ lower_a32_sync:
 lower_a32_irq:
 lower_a32_fiq:
 lower_a32_serror:
+	adr	x1, .unexp_excp
+exit_msg:
 	mov	x0, SYS_WRITE0
-	adr	x1, .error
 	semihosting_call
 	mov	x0, 1 /* EXIT_FAILURE */
 	bl 	_exit
 	/* never returns */
 
 	.section .rodata
-.error:
-	.string "Terminated by exception.\n"
+.unexp_excp:
+	.string "Unexpected exception.\n"
+.high_el_msg:
+	.string "Started in lower EL than requested.\n"
+.unexp_el0:
+	.string "Started in invalid EL.\n"
+
+	.align 8
+.get_cmd:
+	.quad	cmdline
+	.quad	128
 
 	.text
 	.align 4
 	.global __start
 __start:
+	/*
+         * Initialise the stack for whatever EL we are in before
+	 * anything else, we need it to be able to _exit cleanly.
+	 * It's smaller than the stack we pass to the C code but we
+	 * don't need much.
+	 */
+	adrp	x0, system_stack_end
+	add	x0, x0, :lo12:system_stack_end
+	mov	sp, x0
+
+	/*
+	 * The test can set the semihosting command line to the target
+	 * EL needed for the test. However if no semihosting args are set we will
+	 * end up with -kernel/-append data (see semihosting_arg_fallback).
+	 * Keep the normalised target in w11.
+	 */
+	mov	x0, SYS_GET_CMDLINE
+	adr	x1, .get_cmd
+	semihosting_call
+	adrp	x10, cmdline
+	add	x10, x10, :lo12:cmdline
+	ldrb	w11, [x10]
+
+	/* sanity check, normalise char to EL, clamp to 1 if outside range */
+	subs w11, w11, #'0'
+	b.lt el_default
+	cmp  w11, #3
+	b.gt el_default
+	b 1f
+
+el_high:
+	adr	x1, .high_el_msg
+	b	exit_msg
+
+el_default:
+	mov	w11, #1
+
+1:
+	/* Determine current Exception Level */
+	mrs	x0, CurrentEL
+	lsr	x0, x0, #2	  /* CurrentEL[3:2] contains the current EL */
+
+	/* Are we already in a lower EL than we want? */
+	cmp	w11, w0
+	bgt	el_high
+
+	/* Branch based on current EL */
+	cmp	x0, #3
+	b.eq	setup_el3
+	cmp	x0, #2
+	b.eq	setup_el2
+	cmp	x0, #1
+	b.eq	at_testel	     /* Already at EL1, skip transition */
+
+	/* Should not be at EL0 - error out */
+	adr 	x1, .unexp_el0
+	b	exit_msg
+
+setup_el3:
+	/* Ensure we trap if we get anything wrong */
+	adr	x0, vector_table
+	msr	vbar_el3, x0
+
+	/* Does the test want to be at EL3? */
+	cmp	w11, #3
+	beq	at_testel
+
+	/* Configure EL3 to for lower states (EL2 or EL1) */
+	mrs	x0, scr_el3
+	orr	x0, x0, #(1 << 10)    /* RW = 1: EL2/EL1 execution state is AArch64 */
+	orr	x0, x0, #(1 << 0)     /* NS = 1: Non-secure state */
+	msr	scr_el3, x0
+
+	/*
+	 * We need to check if EL2 is actually enabled via ID_AA64PFR0_EL1,
+	 * otherwise we should just jump straight to EL1.
+	 */
+	mrs	x0, id_aa64pfr0_el1
+	ubfx	x0, x0, #8, #4	      /* Extract EL2 field (bits 11:8) */
+	cbz	x0, el2_not_present   /* If field is 0 no EL2 */
+
+
+	/* Prepare SPSR for exception return to EL2 */
+	mov	x0, #0x3c9	      /* DAIF bits and EL2h mode (9) */
+	msr	spsr_el3, x0
+
+	/* Set EL2 entry point */
+	adr	x0, setup_el2
+	msr	elr_el3, x0
+
+	/* Return to EL2 */
+	eret
+
+el2_not_present:
+	/* Initialize SCTLR_EL1 with reset value */
+	msr	sctlr_el1, xzr
+
+	/* Set EL1 entry point */
+	adr	x0, at_testel
+	msr	elr_el3, x0
+
+	/* Prepare SPSR for exception return to EL1h with interrupts masked */
+	mov	x0, #0x3c5	      /* DAIF bits and EL1h mode (5) */
+	msr	spsr_el3, x0
+
+	isb			      /* Synchronization barrier */
+	eret			      /* Jump to EL1 */
+
+setup_el2:
+	/* Ensure we trap if we get anything wrong */
+	adr	x0, vector_table
+	msr	vbar_el2, x0
+
+	/* Does the test want to be at EL2? */
+	cmp	w11, #2
+	beq	at_testel
+
+	/* Configure EL2 to allow transition to EL1 */
+	mrs	x0, hcr_el2
+	orr	x0, x0, #(1 << 31)    /* RW = 1: EL1 execution state is AArch64 */
+	msr	hcr_el2, x0
+
+	/* Initialize SCTLR_EL1 with reset value */
+	msr	sctlr_el1, xzr
+
+	/* Set EL1 entry point */
+	adr	x0, at_testel
+	msr	elr_el2, x0
+
+	/* Prepare SPSR for exception return to EL1 */
+	mov	x0, #(0x5 << 0)	      /* EL1h (SPx), with interrupts disabled */
+	msr	spsr_el2, x0
+
+	/* Return to EL1 */
+	eret
+
+	/*
+	 * At the target EL for the test, usually EL1. Note we still
+	 * set everything up as if we were at EL1.
+	 */
+at_testel:
 	/* Installs a table of exception vectors to catch and handle all
 	   exceptions by terminating the process with a diagnostic.  */
 	adr	x0, vector_table
@@ -100,7 +252,7 @@ __start:
 	 * maps RAM to the first Gb. The stage2 tables have two 2mb
 	 * translation block entries covering a series of adjacent
 	 * 4k pages.
-	*/
+	 */
 
 	/* Stage 1 entry: indexed by IA[38:30] */
 	adr	x1, .				/* phys address */
@@ -198,7 +350,8 @@ __start:
 	orr	x0, x0, #(3 << 16)
 	msr	cpacr_el1, x0
 
-	/* Setup some stack space and enter the test code.
+	/*
+	 * Setup some stack space before we enter the test code.
 	 * Assume everything except the return value is garbage when we
 	 * return, we won't need it.
 	 */
@@ -233,6 +386,11 @@ __sys_outc:
 	ret
 
 	.data
+
+	.align 8
+cmdline:
+	.space 128, 0
+
 	.align	12
 
 	/* Translation table
@@ -246,6 +404,10 @@ ttb_stage2:
 	.space	4096, 0
 
 	.align	12
+system_stack:
+	.space 4096, 0
+system_stack_end:
+
 stack:
 	.space 65536, 0
 stack_end:

From 26b20dc20745d68c7a425326f189ae0ca91bf1d6 Mon Sep 17 00:00:00 2001
From: Nabih Estefan <nabihestefan@google.com>
Date: Tue, 3 Jun 2025 12:01:51 +0100
Subject: [PATCH 1465/2760] tests/qtest: Avoid unaligned access in IGB test
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

  ../tests/qtest/libqos/igb.c:106:5: runtime error: load of misaligned address 0x562040be8e33 for type 'uint32_t', which requires 4 byte alignment

Instead of straight casting the uint8_t array, we can use ldl_le_p and
lduw_l_p to assure the unaligned access works properly against
uint32_t and uint16_t.

Signed-off-by: Nabih Estefan <nabihestefan@google.com>
Reviewed-by: Laurent Vivier <lvivier@redhat.com>
Tested-by: Laurent Vivier <lvivier@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250429155621.2028198-1-nabihestefan@google.com>
[AJB: fix commit message, remove unneeded casts]
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Message-ID: <20250603110204.838117-5-alex.bennee@linaro.org>
---
 tests/qtest/libqos/igb.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/qtest/libqos/igb.c b/tests/qtest/libqos/igb.c
index f40c4ec4cd..ab3ef6f0c3 100644
--- a/tests/qtest/libqos/igb.c
+++ b/tests/qtest/libqos/igb.c
@@ -104,10 +104,10 @@ static void igb_pci_start_hw(QOSGraphObject *obj)
     e1000e_macreg_write(&d->e1000e, E1000_RDT(0), 0);
     e1000e_macreg_write(&d->e1000e, E1000_RDH(0), 0);
     e1000e_macreg_write(&d->e1000e, E1000_RA,
-                        le32_to_cpu(*(uint32_t *)address));
+                        ldl_le_p(address));
     e1000e_macreg_write(&d->e1000e, E1000_RA + 4,
                         E1000_RAH_AV | E1000_RAH_POOL_1 |
-                        le16_to_cpu(*(uint16_t *)(address + 4)));
+                        lduw_le_p(address + 4));
 
     /* Set supported receive descriptor mode */
     e1000e_macreg_write(&d->e1000e,

From 0dd99ef2502be9097afd969aa1071fec57db600a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Tue, 3 Jun 2025 12:01:52 +0100
Subject: [PATCH 1466/2760] contrib/plugins: add a scaling factor to the ips
 arg
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

It's easy to get lost in zeros while setting the numbers of
instructions per second. Add a scaling suffix to make things simpler.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250603110204.838117-6-alex.bennee@linaro.org>
---
 contrib/plugins/ips.c | 34 +++++++++++++++++++++++++++++++++-
 1 file changed, 33 insertions(+), 1 deletion(-)

diff --git a/contrib/plugins/ips.c b/contrib/plugins/ips.c
index e5297dbb01..d067971135 100644
--- a/contrib/plugins/ips.c
+++ b/contrib/plugins/ips.c
@@ -129,6 +129,18 @@ static void plugin_exit(qemu_plugin_id_t id, void *udata)
     qemu_plugin_scoreboard_free(vcpus);
 }
 
+typedef struct {
+    const char *suffix;
+    unsigned long multipler;
+} ScaleEntry;
+
+/* a bit like units.h but not binary */
+static const ScaleEntry scales[] = {
+    { "k", 1000 },
+    { "m", 1000 * 1000 },
+    { "g", 1000 * 1000 * 1000 },
+};
+
 QEMU_PLUGIN_EXPORT int qemu_plugin_install(qemu_plugin_id_t id,
                                            const qemu_info_t *info, int argc,
                                            char **argv)
@@ -137,12 +149,32 @@ QEMU_PLUGIN_EXPORT int qemu_plugin_install(qemu_plugin_id_t id,
         char *opt = argv[i];
         g_auto(GStrv) tokens = g_strsplit(opt, "=", 2);
         if (g_strcmp0(tokens[0], "ips") == 0) {
-            max_insn_per_second = g_ascii_strtoull(tokens[1], NULL, 10);
+            char *endptr = NULL;
+            max_insn_per_second = g_ascii_strtoull(tokens[1], &endptr, 10);
             if (!max_insn_per_second && errno) {
                 fprintf(stderr, "%s: couldn't parse %s (%s)\n",
                         __func__, tokens[1], g_strerror(errno));
                 return -1;
             }
+
+            if (endptr && *endptr != 0) {
+                g_autofree gchar *lower = g_utf8_strdown(endptr, -1);
+                unsigned long scale = 0;
+
+                for (int j = 0; j < G_N_ELEMENTS(scales); j++) {
+                    if (g_strcmp0(lower, scales[j].suffix) == 0) {
+                        scale = scales[j].multipler;
+                        break;
+                    }
+                }
+
+                if (scale) {
+                    max_insn_per_second *= scale;
+                } else {
+                    fprintf(stderr, "bad suffix: %s\n", endptr);
+                    return -1;
+                }
+            }
         } else {
             fprintf(stderr, "option parsing failed: %s\n", opt);
             return -1;

From 002655381f126a9266e0d378ebebbe87cb257a6a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Tue, 3 Jun 2025 12:01:53 +0100
Subject: [PATCH 1467/2760] contrib/plugins: allow setting of instructions per
 quantum
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The default is we update time every 1/10th of a second or so. However
for some cases we might want to update time more frequently. Allow
this to be set via the command line through the ipq argument.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250603110204.838117-7-alex.bennee@linaro.org>
---
 contrib/plugins/ips.c    | 15 ++++++++++++++-
 docs/about/emulation.rst |  4 ++++
 2 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/contrib/plugins/ips.c b/contrib/plugins/ips.c
index d067971135..f110c565bc 100644
--- a/contrib/plugins/ips.c
+++ b/contrib/plugins/ips.c
@@ -145,6 +145,8 @@ QEMU_PLUGIN_EXPORT int qemu_plugin_install(qemu_plugin_id_t id,
                                            const qemu_info_t *info, int argc,
                                            char **argv)
 {
+    bool ipq_set = false;
+
     for (int i = 0; i < argc; i++) {
         char *opt = argv[i];
         g_auto(GStrv) tokens = g_strsplit(opt, "=", 2);
@@ -175,6 +177,14 @@ QEMU_PLUGIN_EXPORT int qemu_plugin_install(qemu_plugin_id_t id,
                     return -1;
                 }
             }
+        } else if (g_strcmp0(tokens[0], "ipq") == 0) {
+            max_insn_per_quantum = g_ascii_strtoull(tokens[1], NULL, 10);
+
+            if (!max_insn_per_quantum) {
+                fprintf(stderr, "bad ipq value: %s\n", tokens[0]);
+                return -1;
+            }
+            ipq_set = true;
         } else {
             fprintf(stderr, "option parsing failed: %s\n", opt);
             return -1;
@@ -182,7 +192,10 @@ QEMU_PLUGIN_EXPORT int qemu_plugin_install(qemu_plugin_id_t id,
     }
 
     vcpus = qemu_plugin_scoreboard_new(sizeof(vCPUTime));
-    max_insn_per_quantum = max_insn_per_second / NUM_TIME_UPDATE_PER_SEC;
+
+    if (!ipq_set) {
+        max_insn_per_quantum = max_insn_per_second / NUM_TIME_UPDATE_PER_SEC;
+    }
 
     if (max_insn_per_quantum == 0) {
         fprintf(stderr, "minimum of %d instructions per second needed\n",
diff --git a/docs/about/emulation.rst b/docs/about/emulation.rst
index a72591ee4d..456d01d5b0 100644
--- a/docs/about/emulation.rst
+++ b/docs/about/emulation.rst
@@ -811,6 +811,10 @@ This plugin can limit the number of Instructions Per Second that are executed::
   * - ips=N
     - Maximum number of instructions per cpu that can be executed in one second.
       The plugin will sleep when the given number of instructions is reached.
+  * - ipq=N
+    - Instructions per quantum. How many instructions before we re-calculate time.
+      The lower the number the more accurate time will be, but the less efficient the plugin.
+      Defaults to ips/10
 
 Other emulation features
 ------------------------

From 7aabb6dbba30f0c2bcedbd5593e1292d4d791244 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Tue, 3 Jun 2025 12:02:00 +0100
Subject: [PATCH 1468/2760] include/exec: fix assert in size_memop
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We can handle larger sized memops now, expand the range of the assert.

Fixes: 4b473e0c60 (tcg: Expand MO_SIZE to 3 bits)
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250603110204.838117-14-alex.bennee@linaro.org>
---
 include/exec/memop.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/exec/memop.h b/include/exec/memop.h
index 407a47d82c..cf7da3362e 100644
--- a/include/exec/memop.h
+++ b/include/exec/memop.h
@@ -162,8 +162,8 @@ static inline unsigned memop_size(MemOp op)
 static inline MemOp size_memop(unsigned size)
 {
 #ifdef CONFIG_DEBUG_TCG
-    /* Power of 2 up to 8.  */
-    assert((size & (size - 1)) == 0 && size >= 1 && size <= 8);
+    /* Power of 2 up to 1024 */
+    assert(is_power_of_2(size) && size >= 1 && size <= (1 << MO_SIZE));
 #endif
     return (MemOp)ctz32(size);
 }

From 46b17eb9e261f28697a6fa5cb09c5fc505ef68ad Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Tue, 3 Jun 2025 12:02:01 +0100
Subject: [PATCH 1469/2760] include/gdbstub: fix include guard in commands.h
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250603110204.838117-15-alex.bennee@linaro.org>
---
 include/gdbstub/commands.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/gdbstub/commands.h b/include/gdbstub/commands.h
index 40f0514fe9..bff3674872 100644
--- a/include/gdbstub/commands.h
+++ b/include/gdbstub/commands.h
@@ -1,5 +1,5 @@
 #ifndef GDBSTUB_COMMANDS_H
-#define GDBSTUB
+#define GDBSTUB_COMMANDS_H
 
 typedef void (*GdbCmdHandler)(GArray *params, void *user_ctx);
 

From 3bb69b1953c1a829152ff5c2599269bc129e05ea Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Tue, 3 Jun 2025 12:02:02 +0100
Subject: [PATCH 1470/2760] gdbstub: assert earlier in handle_read_all_regs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When things go wrong we want to assert on the register that failed to
be able to figure out what went wrong.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250603110204.838117-16-alex.bennee@linaro.org>
---
 gdbstub/gdbstub.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/gdbstub/gdbstub.c b/gdbstub/gdbstub.c
index 565f6b33a9..6023c80d25 100644
--- a/gdbstub/gdbstub.c
+++ b/gdbstub/gdbstub.c
@@ -1343,8 +1343,8 @@ static void handle_read_all_regs(GArray *params, void *user_ctx)
         len += gdb_read_register(gdbserver_state.g_cpu,
                                  gdbserver_state.mem_buf,
                                  reg_id);
+        g_assert(len == gdbserver_state.mem_buf->len);
     }
-    g_assert(len == gdbserver_state.mem_buf->len);
 
     gdb_memtohex(gdbserver_state.str_buf, gdbserver_state.mem_buf->data, len);
     gdb_put_strbuf();

From b2654598b3330aaa58ab0cec2114843bfa96ddaa Mon Sep 17 00:00:00 2001
From: Dominik 'Disconnect3d' Czarnota <dominik.b.czarnota@gmail.com>
Date: Tue, 3 Jun 2025 12:02:03 +0100
Subject: [PATCH 1471/2760] gdbstub: Implement qGDBServerVersion packet
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This commit adds support for the `qGDBServerVersion` packet to the qemu
gdbstub  which could be used by clients to detect the QEMU version
(and, e.g., use a workaround for known bugs).

This packet is not documented/standarized by GDB but it was implemented
by LLDB gdbstub [0] and is helpful for projects like Pwndbg [1].

This has been implemented by Patryk, who I included in Co-authored-by
and who asked me to send the patch.

[0] https://lldb.llvm.org/resources/lldbgdbremote.html#qgdbserverversion
[1] https://github.com/pwndbg/pwndbg/issues/2648

Co-authored-by: Patryk 'patryk4815' Sondej <patryk.sondej@gmail.com>
Signed-off-by: Dominik 'Disconnect3d' Czarnota <dominik.b.czarnota@gmail.com>
Message-Id: <20250403191340.53343-1-dominik.b.czarnota@gmail.com>
[AJB: fix include, checkpatch linewrap]
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250603110204.838117-17-alex.bennee@linaro.org>
---
 gdbstub/gdbstub.c | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/gdbstub/gdbstub.c b/gdbstub/gdbstub.c
index 6023c80d25..def0b7e877 100644
--- a/gdbstub/gdbstub.c
+++ b/gdbstub/gdbstub.c
@@ -28,6 +28,7 @@
 #include "qemu/cutils.h"
 #include "qemu/module.h"
 #include "qemu/error-report.h"
+#include "qemu/target-info.h"
 #include "trace.h"
 #include "exec/gdbstub.h"
 #include "gdbstub/commands.h"
@@ -1597,6 +1598,18 @@ static void handle_query_threads(GArray *params, void *user_ctx)
     gdbserver_state.query_cpu = gdb_next_attached_cpu(gdbserver_state.query_cpu);
 }
 
+static void handle_query_gdb_server_version(GArray *params, void *user_ctx)
+{
+#if defined(CONFIG_USER_ONLY)
+    g_string_printf(gdbserver_state.str_buf, "name:qemu-%s;version:%s;",
+                    target_name(), QEMU_VERSION);
+#else
+    g_string_printf(gdbserver_state.str_buf, "name:qemu-system-%s;version:%s;",
+                    target_name(), QEMU_VERSION);
+#endif
+    gdb_put_strbuf();
+}
+
 static void handle_query_first_threads(GArray *params, void *user_ctx)
 {
     gdbserver_state.query_cpu = gdb_first_attached_cpu();
@@ -1842,6 +1855,10 @@ static const GdbCmdParseEntry gdb_gen_query_table[] = {
         .handler = handle_query_threads,
         .cmd = "sThreadInfo",
     },
+    {
+        .handler = handle_query_gdb_server_version,
+        .cmd = "GDBServerVersion",
+    },
     {
         .handler = handle_query_first_threads,
         .cmd = "fThreadInfo",

From 63070ce368e1a2d430b9022a9db46f1817628efc Mon Sep 17 00:00:00 2001
From: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Date: Tue, 3 Jun 2025 12:02:04 +0100
Subject: [PATCH 1472/2760] gdbstub: update aarch64-core.xml
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Update aarch64-core.xml to include field definitions for PSTATE, which
in gdb is modelled in the cpsr (current program status register)
pseudo-register, named after the actual cpsr register in armv7.

Defining the fields layout of the register allows easy inspection of for
example, the current exception level (EL):

For example. Before booting a Linux guest, EL=2, but after booting and
Ctrl-C'ing in gdb, we get EL=0:

  (gdb) info registers $cpsr
  cpsr           0x20402009          [ SP EL=2 BTYPE=0 PAN C ]
  (gdb) cont
  Continuing.
  ^C
  Thread 2 received signal SIGINT, Interrupt.
  0x0000ffffaaff286c in ?? ()
  (gdb) info registers $cpsr
  cpsr           0x20001000          [ EL=0 BTYPE=0 SSBS C ]

The aarch64-core.xml has been updated to match exactly the version
retrieved from upstream gdb, retrieved in 2025-05-19 from HEAD commit
9f4dc0b137c86f6ff2098cb1ab69442c69d6023d.

Link: https://sourceware.org/git/?p=binutils-gdb.git;a=blob;f=gdb/features/aarch64-core.xml;h=b8046510b9a085d30463d37b3ecc8d435f5fb7a4;hb=HEAD
Signed-off-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Message-Id: <20250519-gdbstub-aarch64-pstate-xml-v1-1-b4dbe87fe7c6@linaro.org>
[AJB: expanded upstream link]
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250603110204.838117-18-alex.bennee@linaro.org>
---
 gdb-xml/aarch64-core.xml | 52 ++++++++++++++++++++++++++++++++++++++--
 1 file changed, 50 insertions(+), 2 deletions(-)

diff --git a/gdb-xml/aarch64-core.xml b/gdb-xml/aarch64-core.xml
index e1e9dc3f91..b8046510b9 100644
--- a/gdb-xml/aarch64-core.xml
+++ b/gdb-xml/aarch64-core.xml
@@ -1,5 +1,5 @@
 <?xml version="1.0"?>
-<!-- Copyright (C) 2009-2012 Free Software Foundation, Inc.
+<!-- Copyright (C) 2009-2025 Free Software Foundation, Inc.
      Contributed by ARM Ltd.
 
      Copying and distribution of this file, with or without modification,
@@ -42,5 +42,53 @@
   <reg name="sp" bitsize="64" type="data_ptr"/>
 
   <reg name="pc" bitsize="64" type="code_ptr"/>
-  <reg name="cpsr" bitsize="32"/>
+
+  <flags id="cpsr_flags" size="4">
+    <!-- Stack Pointer.  -->
+    <field name="SP" start="0" end="0"/>
+
+    <!-- Exception Level.  -->
+    <field name="EL" start="2" end="3"/>
+    <!-- Execution state.  -->
+    <field name="nRW" start="4" end="4"/>
+
+    <!-- FIQ interrupt mask.  -->
+    <field name="F" start="6" end="6"/>
+    <!-- IRQ interrupt mask.  -->
+    <field name="I" start="7" end="7"/>
+    <!-- SError interrupt mask.  -->
+    <field name="A" start="8" end="8"/>
+    <!-- Debug exception mask.  -->
+    <field name="D" start="9" end="9"/>
+
+    <!-- ARMv8.5-A: Branch Target Identification BTYPE.  -->
+    <field name="BTYPE" start="10" end="11"/>
+
+    <!-- ARMv8.0-A: Speculative Store Bypass.  -->
+    <field name="SSBS" start="12" end="12"/>
+
+    <!-- Illegal Execution state.  -->
+    <field name="IL" start="20" end="20"/>
+    <!-- Software Step.  -->
+    <field name="SS" start="21" end="21"/>
+    <!-- ARMv8.1-A: Privileged Access Never.  -->
+    <field name="PAN" start="22" end="22"/>
+    <!-- ARMv8.2-A: User Access Override.  -->
+    <field name="UAO" start="23" end="23"/>
+    <!-- ARMv8.4-A: Data Independent Timing.  -->
+    <field name="DIT" start="24" end="24"/>
+    <!-- ARMv8.5-A: Tag Check Override.  -->
+    <field name="TCO" start="25" end="25"/>
+
+    <!-- Overflow Condition flag.  -->
+    <field name="V" start="28" end="28"/>
+    <!-- Carry Condition flag.  -->
+    <field name="C" start="29" end="29"/>
+    <!-- Zero Condition flag.  -->
+    <field name="Z" start="30" end="30"/>
+    <!-- Negative Condition flag.  -->
+    <field name="N" start="31" end="31"/>
+  </flags>
+  <reg name="cpsr" bitsize="32" type="cpsr_flags"/>
+
 </feature>

From 9c55c03c05c1899521ff0c991b9296633d759890 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Wed, 4 Jun 2025 14:55:01 +0800
Subject: [PATCH 1473/2760] hw/loongarch/virt: Fix big endian support with MCFG
 table

With API build_mcfg(), it is not necessary with parameter structure
AcpiMcfgInfo to convert to little endian since it is directly used
with host native endian.

Here remove endian conversion before calling function build_mcfg().
With this patch, bios-tables-test passes to run on big endian host
machine S390.

Fixes: 735143f10d3e ("hw/loongarch: Add acpi ged support")
Cc: qemu-stable@nongnu.org
Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
Message-Id: <20250604065502.1114098-2-maobibo@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 hw/loongarch/virt-acpi-build.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/loongarch/virt-acpi-build.c b/hw/loongarch/virt-acpi-build.c
index 073b6de75c..2cd2d9d842 100644
--- a/hw/loongarch/virt-acpi-build.c
+++ b/hw/loongarch/virt-acpi-build.c
@@ -575,8 +575,8 @@ static void acpi_build(AcpiBuildTables *tables, MachineState *machine)
     acpi_add_table(table_offsets, tables_blob);
     {
         AcpiMcfgInfo mcfg = {
-           .base = cpu_to_le64(VIRT_PCI_CFG_BASE),
-           .size = cpu_to_le64(VIRT_PCI_CFG_SIZE),
+           .base = VIRT_PCI_CFG_BASE,
+           .size = VIRT_PCI_CFG_SIZE,
         };
         build_mcfg(tables_blob, tables->linker, &mcfg, lvms->oem_id,
                    lvms->oem_table_id);

From 095e6fcf624e9778ca455d3e654bfd7a2f43d653 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Wed, 4 Jun 2025 14:55:02 +0800
Subject: [PATCH 1474/2760] hw/intc/loongarch_pch: Convert to little endian
 with ID register

With PCH ID register, it is defined as union type as follows:
union LoongArchPIC_ID {
    struct {
        uint8_t _reserved_0[3];
        uint8_t id;
        uint8_t version;
        uint8_t _reserved_1;
        uint8_t irq_num;
        uint8_t _reserved_2;
    } QEMU_PACKED desc;
    uint64_t data;
}

And with pch driver in virt machine irq_number is parsed with little
endian method:
  vec_count = ((readq(priv->base) >> 48) & 0xff) + 1

So the value of ID register should be converted to little endian.
With this patch, linux kernel passes to run on S390 big endian host
machine with TCG method.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
Message-Id: <20250604065502.1114098-3-maobibo@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 hw/intc/loongarch_pch_pic.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/intc/loongarch_pch_pic.c b/hw/intc/loongarch_pch_pic.c
index cbba2fc284..ebb33ed0b0 100644
--- a/hw/intc/loongarch_pch_pic.c
+++ b/hw/intc/loongarch_pch_pic.c
@@ -82,7 +82,7 @@ static uint64_t pch_pic_read(void *opaque, hwaddr addr, uint64_t field_mask)
     addr -= offset;
     switch (addr) {
     case PCH_PIC_INT_ID:
-        val = s->id.data;
+        val = cpu_to_le64(s->id.data);
         break;
     case PCH_PIC_INT_MASK:
         val = s->int_mask;

From 1e043baf15241f18a35f050fb2a2beb3fd7c7906 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Thu, 5 Jun 2025 17:28:48 +0800
Subject: [PATCH 1475/2760] hw/intc/loongarch_extioi: Fix typo issue about
 register EXTIOI_COREISR_END

Interrupt controller extioi supports 256 vectors, register EXTIOI_COREISR
records pending interrupt status with bitmap method. Size of EXTIOI_COREISR
is 256 / 8 = 0x20 bytes, EXTIOI_COREISR_END should be EXTIOI_COREISR_START
+ 0x20 rather than 0xB20.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
Message-Id: <20250605092848.1550985-1-maobibo@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 include/hw/intc/loongarch_extioi_common.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/hw/intc/loongarch_extioi_common.h b/include/hw/intc/loongarch_extioi_common.h
index 735bfee80a..dca25ff893 100644
--- a/include/hw/intc/loongarch_extioi_common.h
+++ b/include/hw/intc/loongarch_extioi_common.h
@@ -35,7 +35,7 @@
 #define EXTIOI_ISR_START             (0x700 - APIC_OFFSET)
 #define EXTIOI_ISR_END               (0x720 - APIC_OFFSET)
 #define EXTIOI_COREISR_START         (0x800 - APIC_OFFSET)
-#define EXTIOI_COREISR_END           (0xB20 - APIC_OFFSET)
+#define EXTIOI_COREISR_END           (0x820 - APIC_OFFSET)
 #define EXTIOI_COREMAP_START         (0xC00 - APIC_OFFSET)
 #define EXTIOI_COREMAP_END           (0xD00 - APIC_OFFSET)
 #define EXTIOI_SIZE                  0x800

From 93282c8a890b1d318668d9a0cf82c0af793ae441 Mon Sep 17 00:00:00 2001
From: Qiang Ma <maqianga@uniontech.com>
Date: Tue, 3 Jun 2025 11:18:13 +0800
Subject: [PATCH 1476/2760] hw/loongarch/virt: inform guest of kvm

Commit bab27ea2e3 ("hw/arm/virt: smbios:
inform guest of kvm") fixes the same issue
on arm.

without this patch:
[root@localhost ~]# virt-what
qemu

with this patch:
[root@localhost ~]# virt-what
kvm

Signed-off-by: Qiang Ma <maqianga@uniontech.com>
Reviewed-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
Message-Id: <20250603031813.31794-1-maqianga@uniontech.com>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 hw/loongarch/virt.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/hw/loongarch/virt.c b/hw/loongarch/virt.c
index 1b504047db..a3d449ca8b 100644
--- a/hw/loongarch/virt.c
+++ b/hw/loongarch/virt.c
@@ -136,6 +136,10 @@ static void virt_build_smbios(LoongArchVirtMachineState *lvms)
         return;
     }
 
+    if (kvm_enabled()) {
+        product = "KVM Virtual Machine";
+    }
+
     smbios_set_defaults("QEMU", product, mc->name);
 
     smbios_get_tables(ms, SMBIOS_ENTRY_POINT_TYPE_64,

From e7788da9860c97920c19fa1150806186513ef256 Mon Sep 17 00:00:00 2001
From: Song Gao <gaosong@loongson.cn>
Date: Tue, 3 Jun 2025 10:48:09 +0800
Subject: [PATCH 1477/2760] target/loongarch: add check for fcond

fcond only has 22 types, add a check for fcond.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2972

Signed-off-by: Song Gao <gaosong@loongson.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250603024810.350510-1-gaosong@loongson.cn>
---
 .../loongarch/tcg/insn_trans/trans_fcmp.c.inc | 25 +++++++++++++------
 .../loongarch/tcg/insn_trans/trans_vec.c.inc  | 16 +++++++++---
 2 files changed, 30 insertions(+), 11 deletions(-)

diff --git a/target/loongarch/tcg/insn_trans/trans_fcmp.c.inc b/target/loongarch/tcg/insn_trans/trans_fcmp.c.inc
index 3babf69e4a..6a2c030a6b 100644
--- a/target/loongarch/tcg/insn_trans/trans_fcmp.c.inc
+++ b/target/loongarch/tcg/insn_trans/trans_fcmp.c.inc
@@ -4,10 +4,15 @@
  */
 
 /* bit0(signaling/quiet) bit1(lt) bit2(eq) bit3(un) bit4(neq) */
-static uint32_t get_fcmp_flags(int cond)
+static uint32_t get_fcmp_flags(DisasContext *ctx, int cond)
 {
     uint32_t flags = 0;
 
+    /*check cond , cond =[0-8,10,12] */
+    if ((cond > 8) &&(cond != 10) && (cond != 12)) {
+        return -1;
+    }
+
     if (cond & 0x1) {
         flags |= FCMP_LT;
     }
@@ -26,9 +31,14 @@ static uint32_t get_fcmp_flags(int cond)
 static bool trans_fcmp_cond_s(DisasContext *ctx, arg_fcmp_cond_s *a)
 {
     TCGv var, src1, src2;
-    uint32_t flags;
+    uint32_t flags = get_fcmp_flags(ctx, a->fcond >>1);
     void (*fn)(TCGv, TCGv_env, TCGv, TCGv, TCGv_i32);
 
+    if (flags == -1) {
+        generate_exception(ctx, EXCCODE_INE);
+        return true;
+    }
+
     if (!avail_FP_SP(ctx)) {
         return false;
     }
@@ -39,8 +49,6 @@ static bool trans_fcmp_cond_s(DisasContext *ctx, arg_fcmp_cond_s *a)
     src1 = get_fpr(ctx, a->fj);
     src2 = get_fpr(ctx, a->fk);
     fn = (a->fcond & 1 ? gen_helper_fcmp_s_s : gen_helper_fcmp_c_s);
-    flags = get_fcmp_flags(a->fcond >> 1);
-
     fn(var, tcg_env, src1, src2, tcg_constant_i32(flags));
 
     tcg_gen_st8_tl(var, tcg_env, offsetof(CPULoongArchState, cf[a->cd]));
@@ -50,9 +58,14 @@ static bool trans_fcmp_cond_s(DisasContext *ctx, arg_fcmp_cond_s *a)
 static bool trans_fcmp_cond_d(DisasContext *ctx, arg_fcmp_cond_d *a)
 {
     TCGv var, src1, src2;
-    uint32_t flags;
+    uint32_t flags = get_fcmp_flags(ctx, a->fcond >> 1);
     void (*fn)(TCGv, TCGv_env, TCGv, TCGv, TCGv_i32);
 
+    if (flags == -1) {
+        generate_exception(ctx, EXCCODE_INE);
+        return true;
+    }
+
     if (!avail_FP_DP(ctx)) {
         return false;
     }
@@ -63,8 +76,6 @@ static bool trans_fcmp_cond_d(DisasContext *ctx, arg_fcmp_cond_d *a)
     src1 = get_fpr(ctx, a->fj);
     src2 = get_fpr(ctx, a->fk);
     fn = (a->fcond & 1 ? gen_helper_fcmp_s_d : gen_helper_fcmp_c_d);
-    flags = get_fcmp_flags(a->fcond >> 1);
-
     fn(var, tcg_env, src1, src2, tcg_constant_i32(flags));
 
     tcg_gen_st8_tl(var, tcg_env, offsetof(CPULoongArchState, cf[a->cd]));
diff --git a/target/loongarch/tcg/insn_trans/trans_vec.c.inc b/target/loongarch/tcg/insn_trans/trans_vec.c.inc
index dff92772ad..d6f0560349 100644
--- a/target/loongarch/tcg/insn_trans/trans_vec.c.inc
+++ b/target/loongarch/tcg/insn_trans/trans_vec.c.inc
@@ -4655,19 +4655,23 @@ TRANS(xvslti_du, LASX, do_xcmpi, MO_64, TCG_COND_LTU)
 
 static bool do_vfcmp_cond_s(DisasContext *ctx, arg_vvv_fcond *a, uint32_t sz)
 {
-    uint32_t flags;
+    uint32_t flags = get_fcmp_flags(ctx, a->fcond >> 1);
     void (*fn)(TCGv_env, TCGv_i32, TCGv_i32, TCGv_i32, TCGv_i32, TCGv_i32);
     TCGv_i32 vd = tcg_constant_i32(a->vd);
     TCGv_i32 vj = tcg_constant_i32(a->vj);
     TCGv_i32 vk = tcg_constant_i32(a->vk);
     TCGv_i32 oprsz = tcg_constant_i32(sz);
 
+    if(flags == -1){
+        generate_exception(ctx, EXCCODE_INE);
+        return true;
+    }
+
     if (!check_vec(ctx, sz)) {
         return true;
     }
 
     fn = (a->fcond & 1 ? gen_helper_vfcmp_s_s : gen_helper_vfcmp_c_s);
-    flags = get_fcmp_flags(a->fcond >> 1);
     fn(tcg_env, oprsz, vd, vj, vk, tcg_constant_i32(flags));
 
     return true;
@@ -4675,19 +4679,23 @@ static bool do_vfcmp_cond_s(DisasContext *ctx, arg_vvv_fcond *a, uint32_t sz)
 
 static bool do_vfcmp_cond_d(DisasContext *ctx, arg_vvv_fcond *a, uint32_t sz)
 {
-    uint32_t flags;
+    uint32_t flags = get_fcmp_flags(ctx, a->fcond >> 1);
     void (*fn)(TCGv_env, TCGv_i32, TCGv_i32, TCGv_i32, TCGv_i32, TCGv_i32);
     TCGv_i32 vd = tcg_constant_i32(a->vd);
     TCGv_i32 vj = tcg_constant_i32(a->vj);
     TCGv_i32 vk = tcg_constant_i32(a->vk);
     TCGv_i32 oprsz = tcg_constant_i32(sz);
 
+    if (flags == -1) {
+        generate_exception(ctx, EXCCODE_INE);
+        return true;
+    }
+
     if (!check_vec(ctx, sz)) {
         return true;
     }
 
     fn = (a->fcond & 1 ? gen_helper_vfcmp_s_d : gen_helper_vfcmp_c_d);
-    flags = get_fcmp_flags(a->fcond >> 1);
     fn(tcg_env, oprsz, vd, vj, vk, tcg_constant_i32(flags));
 
     return true;

From 4332a641e220ca969810fac12b25cbf2037f7c3f Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Wed, 30 Apr 2025 17:47:37 +0800
Subject: [PATCH 1478/2760] hw/loongarch/virt: Remove global variables about
 initrd
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Global variables initrd_offset and initrd_size records loading information
about initrd, it can be moved to structure loongarch_boot_info.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20250430094738.1556670-2-maobibo@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 hw/loongarch/boot.c         | 21 ++++++++++-----------
 include/hw/loongarch/boot.h |  2 ++
 2 files changed, 12 insertions(+), 11 deletions(-)

diff --git a/hw/loongarch/boot.c b/hw/loongarch/boot.c
index 9b6292eaa1..a343547acd 100644
--- a/hw/loongarch/boot.c
+++ b/hw/loongarch/boot.c
@@ -38,9 +38,6 @@ struct loongarch_linux_hdr {
 struct memmap_entry *memmap_table;
 unsigned memmap_entries;
 
-ram_addr_t initrd_offset;
-uint64_t initrd_size;
-
 static const unsigned int slave_boot_code[] = {
                   /* Configure reset ebase.                    */
     0x0400302c,   /* csrwr      $t0, LOONGARCH_CSR_EENTRY      */
@@ -121,7 +118,8 @@ static void init_efi_boot_memmap(struct efi_system_table *systab,
     }
 }
 
-static void init_efi_initrd_table(struct efi_system_table *systab,
+static void init_efi_initrd_table(struct loongarch_boot_info *info,
+                                  struct efi_system_table *systab,
                                   void *p, void *start)
 {
     efi_guid_t tbl_guid = LINUX_EFI_INITRD_MEDIA_GUID;
@@ -132,8 +130,8 @@ static void init_efi_initrd_table(struct efi_system_table *systab,
     systab->tables[1].table = (struct efi_configuration_table *)(p - start);
     systab->nr_tables = 2;
 
-    initrd_table->base = initrd_offset;
-    initrd_table->size = initrd_size;
+    initrd_table->base = info->initrd_addr;
+    initrd_table->size = info->initrd_size;
 }
 
 static void init_efi_fdt_table(struct efi_system_table *systab)
@@ -169,7 +167,7 @@ static void init_systab(struct loongarch_boot_info *info, void *p, void *start)
     init_efi_boot_memmap(systab, p, start);
     p += ROUND_UP(sizeof(struct efi_boot_memmap) +
                   sizeof(efi_memory_desc_t) * memmap_entries, 64 * KiB);
-    init_efi_initrd_table(systab, p, start);
+    init_efi_initrd_table(info, systab, p, start);
     p += ROUND_UP(sizeof(struct efi_initrd), 64 * KiB);
     init_efi_fdt_table(systab);
 
@@ -276,8 +274,8 @@ static ram_addr_t alloc_initrd_memory(struct loongarch_boot_info *info,
 
 static int64_t load_kernel_info(struct loongarch_boot_info *info)
 {
-    uint64_t kernel_entry, kernel_low, kernel_high;
-    ssize_t kernel_size;
+    uint64_t kernel_entry, kernel_low, kernel_high, initrd_offset = 0;
+    ssize_t kernel_size, initrd_size;
 
     kernel_size = load_elf(info->kernel_filename, NULL,
                            cpu_loongarch_virt_to_phys, NULL,
@@ -313,8 +311,9 @@ static int64_t load_kernel_info(struct loongarch_boot_info *info)
                          info->initrd_filename);
             exit(1);
         }
-    } else {
-        initrd_size = 0;
+
+        info->initrd_addr = initrd_offset;
+        info->initrd_size = initrd_size;
     }
 
     return kernel_entry;
diff --git a/include/hw/loongarch/boot.h b/include/hw/loongarch/boot.h
index b3b870df1f..27399de99c 100644
--- a/include/hw/loongarch/boot.h
+++ b/include/hw/loongarch/boot.h
@@ -102,6 +102,8 @@ struct loongarch_boot_info {
     const char *kernel_cmdline;
     const char *initrd_filename;
     uint64_t a0, a1, a2;
+    uint64_t initrd_addr;
+    uint64_t initrd_size;
 };
 
 extern struct memmap_entry *memmap_table;

From ffe89c1762d879fd39ba1be853d154677dbfbc7b Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Wed, 30 Apr 2025 17:47:38 +0800
Subject: [PATCH 1479/2760] hw/loongarch/virt: Remove global variables about
 memmap tables

Global variables memmap_table and memmap_entries stores UEFI memory
map table informations. It can be moved into structure
LoongArchVirtMachineState.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
Message-Id: <20250430094738.1556670-3-maobibo@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 hw/loongarch/boot.c         | 31 +++++++++++++++++++------------
 hw/loongarch/virt.c         | 23 ++++++++++++++++-------
 include/hw/loongarch/boot.h |  3 ---
 include/hw/loongarch/virt.h |  2 ++
 4 files changed, 37 insertions(+), 22 deletions(-)

diff --git a/hw/loongarch/boot.c b/hw/loongarch/boot.c
index a343547acd..14d6c52d4e 100644
--- a/hw/loongarch/boot.c
+++ b/hw/loongarch/boot.c
@@ -35,9 +35,6 @@ struct loongarch_linux_hdr {
     uint32_t pe_header_offset;
 } QEMU_PACKED;
 
-struct memmap_entry *memmap_table;
-unsigned memmap_entries;
-
 static const unsigned int slave_boot_code[] = {
                   /* Configure reset ebase.                    */
     0x0400302c,   /* csrwr      $t0, LOONGARCH_CSR_EENTRY      */
@@ -91,12 +88,16 @@ static inline void *guidcpy(void *dst, const void *src)
     return memcpy(dst, src, sizeof(efi_guid_t));
 }
 
-static void init_efi_boot_memmap(struct efi_system_table *systab,
+static void init_efi_boot_memmap(MachineState *ms,
+                                 struct efi_system_table *systab,
                                  void *p, void *start)
 {
     unsigned i;
     struct efi_boot_memmap *boot_memmap = p;
     efi_guid_t tbl_guid = LINUX_EFI_BOOT_MEMMAP_GUID;
+    LoongArchVirtMachineState *lvms = LOONGARCH_VIRT_MACHINE(ms);
+    struct memmap_entry *memmap_table;
+    unsigned int memmap_entries;
 
     /* efi_configuration_table 1 */
     guidcpy(&systab->tables[0].guid, &tbl_guid);
@@ -108,6 +109,8 @@ static void init_efi_boot_memmap(struct efi_system_table *systab,
     boot_memmap->map_size = 0;
 
     efi_memory_desc_t *map = p + sizeof(struct efi_boot_memmap);
+    memmap_table = lvms->memmap_table;
+    memmap_entries = lvms->memmap_entries;
     for (i = 0; i < memmap_entries; i++) {
         map = (void *)boot_memmap + sizeof(*map);
         map[i].type = memmap_table[i].type;
@@ -144,10 +147,12 @@ static void init_efi_fdt_table(struct efi_system_table *systab)
     systab->nr_tables = 3;
 }
 
-static void init_systab(struct loongarch_boot_info *info, void *p, void *start)
+static void init_systab(MachineState *ms,
+                        struct loongarch_boot_info *info, void *p, void *start)
 {
     void *bp_tables_start;
     struct efi_system_table *systab = p;
+    LoongArchVirtMachineState *lvms = LOONGARCH_VIRT_MACHINE(ms);
 
     info->a2 = p - start;
 
@@ -164,9 +169,9 @@ static void init_systab(struct loongarch_boot_info *info, void *p, void *start)
     systab->tables = p;
     bp_tables_start = p;
 
-    init_efi_boot_memmap(systab, p, start);
+    init_efi_boot_memmap(ms, systab, p, start);
     p += ROUND_UP(sizeof(struct efi_boot_memmap) +
-                  sizeof(efi_memory_desc_t) * memmap_entries, 64 * KiB);
+                  sizeof(efi_memory_desc_t) * lvms->memmap_entries, 64 * KiB);
     init_efi_initrd_table(info, systab, p, start);
     p += ROUND_UP(sizeof(struct efi_initrd), 64 * KiB);
     init_efi_fdt_table(systab);
@@ -368,17 +373,19 @@ static void loongarch_firmware_boot(LoongArchVirtMachineState *lvms,
     fw_cfg_add_kernel_info(info, lvms->fw_cfg);
 }
 
-static void init_boot_rom(struct loongarch_boot_info *info, void *p)
+static void init_boot_rom(MachineState *ms,
+                          struct loongarch_boot_info *info, void *p)
 {
     void *start = p;
 
     init_cmdline(info, p, start);
     p += COMMAND_LINE_SIZE;
 
-    init_systab(info, p, start);
+    init_systab(ms, info, p, start);
 }
 
-static void loongarch_direct_kernel_boot(struct loongarch_boot_info *info)
+static void loongarch_direct_kernel_boot(MachineState *ms,
+                                         struct loongarch_boot_info *info)
 {
     void *p, *bp;
     int64_t kernel_addr = VIRT_FLASH0_BASE;
@@ -396,7 +403,7 @@ static void loongarch_direct_kernel_boot(struct loongarch_boot_info *info)
     /* Load cmdline and system tables at [0 - 1 MiB] */
     p = g_malloc0(1 * MiB);
     bp = p;
-    init_boot_rom(info, p);
+    init_boot_rom(ms, info, p);
     rom_add_blob_fixed_as("boot_info", bp, 1 * MiB, 0, &address_space_memory);
 
     /* Load slave boot code at pflash0 . */
@@ -436,6 +443,6 @@ void loongarch_load_kernel(MachineState *ms, struct loongarch_boot_info *info)
     if (lvms->bios_loaded) {
         loongarch_firmware_boot(lvms, info);
     } else {
-        loongarch_direct_kernel_boot(info);
+        loongarch_direct_kernel_boot(ms, info);
     }
 }
diff --git a/hw/loongarch/virt.c b/hw/loongarch/virt.c
index a3d449ca8b..34dfbd13e5 100644
--- a/hw/loongarch/virt.c
+++ b/hw/loongarch/virt.c
@@ -172,8 +172,15 @@ static void virt_powerdown_req(Notifier *notifier, void *opaque)
     acpi_send_event(s->acpi_ged, ACPI_POWER_DOWN_STATUS);
 }
 
-static void memmap_add_entry(uint64_t address, uint64_t length, uint32_t type)
+static void memmap_add_entry(MachineState *ms, uint64_t address,
+                             uint64_t length, uint32_t type)
 {
+    LoongArchVirtMachineState *lvms = LOONGARCH_VIRT_MACHINE(ms);
+    struct memmap_entry *memmap_table;
+    unsigned int memmap_entries;
+
+    memmap_table = lvms->memmap_table;
+    memmap_entries = lvms->memmap_entries;
     /* Ensure there are no duplicate entries. */
     for (unsigned i = 0; i < memmap_entries; i++) {
         assert(memmap_table[i].address != address);
@@ -186,6 +193,8 @@ static void memmap_add_entry(uint64_t address, uint64_t length, uint32_t type)
     memmap_table[memmap_entries].type = cpu_to_le32(type);
     memmap_table[memmap_entries].reserved = 0;
     memmap_entries++;
+    lvms->memmap_table = memmap_table;
+    lvms->memmap_entries = memmap_entries;
 }
 
 static DeviceState *create_acpi_ged(DeviceState *pch_pic,
@@ -623,13 +632,13 @@ static void fw_cfg_add_memory(MachineState *ms)
     }
 
     if (size >= gap) {
-        memmap_add_entry(base, gap, 1);
+        memmap_add_entry(ms, base, gap, 1);
         size -= gap;
         base = VIRT_HIGHMEM_BASE;
     }
 
     if (size) {
-        memmap_add_entry(base, size, 1);
+        memmap_add_entry(ms, base, size, 1);
         base += size;
     }
 
@@ -644,7 +653,7 @@ static void fw_cfg_add_memory(MachineState *ms)
          * lowram:  [base, +(gap - numa_info[0].node_mem))
          * highram: [VIRT_HIGHMEM_BASE, +(ram_size - gap))
          */
-        memmap_add_entry(base, gap - numa_info[0].node_mem, 1);
+        memmap_add_entry(ms, base, gap - numa_info[0].node_mem, 1);
         size = ram_size - gap;
         base = VIRT_HIGHMEM_BASE;
     } else {
@@ -652,7 +661,7 @@ static void fw_cfg_add_memory(MachineState *ms)
     }
 
     if (size) {
-        memmap_add_entry(base, size, 1);
+        memmap_add_entry(ms, base, size, 1);
     }
 }
 
@@ -738,8 +747,8 @@ static void virt_init(MachineState *machine)
     rom_set_fw(lvms->fw_cfg);
     if (lvms->fw_cfg != NULL) {
         fw_cfg_add_file(lvms->fw_cfg, "etc/memmap",
-                        memmap_table,
-                        sizeof(struct memmap_entry) * (memmap_entries));
+                        lvms->memmap_table,
+                        sizeof(struct memmap_entry) * lvms->memmap_entries);
     }
 
     /* Initialize the IO interrupt subsystem */
diff --git a/include/hw/loongarch/boot.h b/include/hw/loongarch/boot.h
index 27399de99c..9819f7fbe3 100644
--- a/include/hw/loongarch/boot.h
+++ b/include/hw/loongarch/boot.h
@@ -106,9 +106,6 @@ struct loongarch_boot_info {
     uint64_t initrd_size;
 };
 
-extern struct memmap_entry *memmap_table;
-extern unsigned memmap_entries;
-
 struct memmap_entry {
     uint64_t address;
     uint64_t length;
diff --git a/include/hw/loongarch/virt.h b/include/hw/loongarch/virt.h
index 2b7d19953f..602feab0f0 100644
--- a/include/hw/loongarch/virt.h
+++ b/include/hw/loongarch/virt.h
@@ -63,6 +63,8 @@ struct LoongArchVirtMachineState {
     struct loongarch_boot_info bootinfo;
     DeviceState *ipi;
     DeviceState *extioi;
+    struct memmap_entry *memmap_table;
+    unsigned int memmap_entries;
 };
 
 #define TYPE_LOONGARCH_VIRT_MACHINE  MACHINE_TYPE_NAME("virt")

From a5844ea5530b664ea70852418fb751d63c15dba5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 24 Jan 2025 18:43:36 +0100
Subject: [PATCH 1480/2760] hw/char/sh_serial: Delete fifo_timeout_timer in
 DeviceUnrealize
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

fifo_timeout_timer is created in the DeviceRealize handler,
not in the instance_init one. For parity, delete it in
DeviceUnrealize, rather than instance_finalize.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20250124175053.74461-2-philmd@linaro.org>
---
 hw/char/sh_serial.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/hw/char/sh_serial.c b/hw/char/sh_serial.c
index 6abd80386f..cdaeac7b70 100644
--- a/hw/char/sh_serial.c
+++ b/hw/char/sh_serial.c
@@ -434,9 +434,9 @@ static void sh_serial_realize(DeviceState *d, Error **errp)
     s->etu = NANOSECONDS_PER_SECOND / 9600;
 }
 
-static void sh_serial_finalize(Object *obj)
+static void sh_serial_unrealize(DeviceState *dev)
 {
-    SHSerialState *s = SH_SERIAL(obj);
+    SHSerialState *s = SH_SERIAL(dev);
 
     timer_del(&s->fifo_timeout_timer);
 }
@@ -445,6 +445,10 @@ static void sh_serial_init(Object *obj)
 {
 }
 
+static void sh_serial_finalize(Object *obj)
+{
+}
+
 static const Property sh_serial_properties[] = {
     DEFINE_PROP_CHR("chardev", SHSerialState, chr),
     DEFINE_PROP_UINT8("features", SHSerialState, feat, 0),
@@ -456,6 +460,7 @@ static void sh_serial_class_init(ObjectClass *oc, const void *data)
 
     device_class_set_props(dc, sh_serial_properties);
     dc->realize = sh_serial_realize;
+    dc->unrealize = sh_serial_unrealize;
     device_class_set_legacy_reset(dc, sh_serial_reset);
     /* Reason: part of SuperH CPU/SoC, needs to be wired up */
     dc->user_creatable = false;

From 65561d9393cfa21eb696bb759122641a569de63a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 24 Jan 2025 18:46:27 +0100
Subject: [PATCH 1481/2760] hw/char/sh_serial: Convert to TypeInfo
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

QOM types are now registered using as TypeInfo via DEFINE_TYPES()
or type_init(). Update TYPE_SH_SERIAL, removing the empty QOM
instance_init/finalize handlers.

This was definitely wrong, because OBJECT_DEFINE_TYPE() is only
for cases where the class needs its own virtual methods or some
other per-class state in its own class struct.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20250124175053.74461-3-philmd@linaro.org>
---
 hw/char/sh_serial.c | 23 +++++++++++------------
 1 file changed, 11 insertions(+), 12 deletions(-)

diff --git a/hw/char/sh_serial.c b/hw/char/sh_serial.c
index cdaeac7b70..30447fa018 100644
--- a/hw/char/sh_serial.c
+++ b/hw/char/sh_serial.c
@@ -78,10 +78,6 @@ struct SHSerialState {
     qemu_irq bri;
 };
 
-typedef struct {} SHSerialStateClass;
-
-OBJECT_DEFINE_TYPE(SHSerialState, sh_serial, SH_SERIAL, SYS_BUS_DEVICE)
-
 static void sh_serial_clear_fifo(SHSerialState *s)
 {
     memset(s->rx_fifo, 0, SH_RX_FIFO_LENGTH);
@@ -441,14 +437,6 @@ static void sh_serial_unrealize(DeviceState *dev)
     timer_del(&s->fifo_timeout_timer);
 }
 
-static void sh_serial_init(Object *obj)
-{
-}
-
-static void sh_serial_finalize(Object *obj)
-{
-}
-
 static const Property sh_serial_properties[] = {
     DEFINE_PROP_CHR("chardev", SHSerialState, chr),
     DEFINE_PROP_UINT8("features", SHSerialState, feat, 0),
@@ -465,3 +453,14 @@ static void sh_serial_class_init(ObjectClass *oc, const void *data)
     /* Reason: part of SuperH CPU/SoC, needs to be wired up */
     dc->user_creatable = false;
 }
+
+static const TypeInfo sh_serial_types[] = {
+    {
+        .name           = TYPE_SH_SERIAL,
+        .parent         = TYPE_SYS_BUS_DEVICE,
+        .instance_size  = sizeof(SHSerialState),
+        .class_init     = sh_serial_class_init,
+    },
+};
+
+DEFINE_TYPES(sh_serial_types)

From 8a486e3902177b1d0faaed6f372909767a019124 Mon Sep 17 00:00:00 2001
From: BALATON Zoltan <balaton@eik.bme.hu>
Date: Sun, 4 May 2025 18:01:27 +0200
Subject: [PATCH 1482/2760] hw/pci-host/raven: Remove is-legacy-prep property
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This was a workaround for the prep machine that was removed 5 years
ago so this is no longer needed.

Fixes: b2ce76a073 (hw/ppc/prep: Remove the deprecated "prep" machine        and the OpenHackware BIOS)
Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <0d41c18a8831bd4c8b0948eda3ef8f60f5a311f3.1746374076.git.balaton@eik.bme.hu>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/pci-host/raven.c | 30 +++++++++++-------------------
 1 file changed, 11 insertions(+), 19 deletions(-)

diff --git a/hw/pci-host/raven.c b/hw/pci-host/raven.c
index 21f7ca65e0..b78a8f32d3 100644
--- a/hw/pci-host/raven.c
+++ b/hw/pci-host/raven.c
@@ -75,7 +75,6 @@ struct PRePPCIState {
     RavenPCIState pci_dev;
 
     int contiguous_map;
-    bool is_legacy_prep;
 };
 
 #define BIOS_SIZE (1 * MiB)
@@ -243,22 +242,18 @@ static void raven_pcihost_realizefn(DeviceState *d, Error **errp)
     MemoryRegion *address_space_mem = get_system_memory();
     int i;
 
-    if (s->is_legacy_prep) {
-        for (i = 0; i < PCI_NUM_PINS; i++) {
-            sysbus_init_irq(dev, &s->pci_irqs[i]);
-        }
-    } else {
-        /* According to PReP specification section 6.1.6 "System Interrupt
-         * Assignments", all PCI interrupts are routed via IRQ 15 */
-        s->or_irq = OR_IRQ(object_new(TYPE_OR_IRQ));
-        object_property_set_int(OBJECT(s->or_irq), "num-lines", PCI_NUM_PINS,
-                                &error_fatal);
-        qdev_realize(DEVICE(s->or_irq), NULL, &error_fatal);
-        sysbus_init_irq(dev, &s->or_irq->out_irq);
+    /*
+     * According to PReP specification section 6.1.6 "System Interrupt
+     * Assignments", all PCI interrupts are routed via IRQ 15
+     */
+    s->or_irq = OR_IRQ(object_new(TYPE_OR_IRQ));
+    object_property_set_int(OBJECT(s->or_irq), "num-lines", PCI_NUM_PINS,
+                            &error_fatal);
+    qdev_realize(DEVICE(s->or_irq), NULL, &error_fatal);
+    sysbus_init_irq(dev, &s->or_irq->out_irq);
 
-        for (i = 0; i < PCI_NUM_PINS; i++) {
-            s->pci_irqs[i] = qdev_get_gpio_in(DEVICE(s->or_irq), i);
-        }
+    for (i = 0; i < PCI_NUM_PINS; i++) {
+        s->pci_irqs[i] = qdev_get_gpio_in(DEVICE(s->or_irq), i);
     }
 
     qdev_init_gpio_in(d, raven_change_gpio, 1);
@@ -426,9 +421,6 @@ static const Property raven_pcihost_properties[] = {
     DEFINE_PROP_UINT32("elf-machine", PREPPCIState, pci_dev.elf_machine,
                        EM_NONE),
     DEFINE_PROP_STRING("bios-name", PREPPCIState, pci_dev.bios_name),
-    /* Temporary workaround until legacy prep machine is removed */
-    DEFINE_PROP_BOOL("is-legacy-prep", PREPPCIState, is_legacy_prep,
-                     false),
 };
 
 static void raven_pcihost_class_init(ObjectClass *klass, const void *data)

From 63151361fdf14e9dcaa463fe06e0b23f51c689eb Mon Sep 17 00:00:00 2001
From: BALATON Zoltan <balaton@eik.bme.hu>
Date: Sun, 4 May 2025 18:01:28 +0200
Subject: [PATCH 1483/2760] hw/pci-host/raven: Revert "raven: Move BIOS loading
 from board code to PCI host"
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This reverts commit d0b25425749d5525b2ba6d9d966d8800a5643b35.

Loading firmware from the PCI host is unusual and raven is only used
by one board so this does not simplify anything but rather complicates
it. Revert to loading firmware from board code as that is the usual
way and also because raven has nothing to do with ROM so it is not a
good place for this.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <4ca4f71bf661923d9a91b7e6776a0e40726e2337.1746374076.git.balaton@eik.bme.hu>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/pci-host/raven.c | 55 ---------------------------------------------
 hw/ppc/prep.c       | 27 ++++++++++++++++++++--
 2 files changed, 25 insertions(+), 57 deletions(-)

diff --git a/hw/pci-host/raven.c b/hw/pci-host/raven.c
index b78a8f32d3..f8c0be5d21 100644
--- a/hw/pci-host/raven.c
+++ b/hw/pci-host/raven.c
@@ -24,7 +24,6 @@
  */
 
 #include "qemu/osdep.h"
-#include "qemu/datadir.h"
 #include "qemu/units.h"
 #include "qemu/log.h"
 #include "qapi/error.h"
@@ -35,9 +34,7 @@
 #include "migration/vmstate.h"
 #include "hw/intc/i8259.h"
 #include "hw/irq.h"
-#include "hw/loader.h"
 #include "hw/or-irq.h"
-#include "elf.h"
 #include "qom/object.h"
 
 #define TYPE_RAVEN_PCI_DEVICE "raven"
@@ -47,10 +44,6 @@ OBJECT_DECLARE_SIMPLE_TYPE(RavenPCIState, RAVEN_PCI_DEVICE)
 
 struct RavenPCIState {
     PCIDevice dev;
-
-    uint32_t elf_machine;
-    char *bios_name;
-    MemoryRegion bios;
 };
 
 typedef struct PRePPCIState PREPPCIState;
@@ -77,8 +70,6 @@ struct PRePPCIState {
     int contiguous_map;
 };
 
-#define BIOS_SIZE (1 * MiB)
-
 #define PCI_IO_BASE_ADDR    0x80000000  /* Physical address on main bus */
 
 static inline uint32_t raven_pci_io_config(hwaddr addr)
@@ -333,48 +324,9 @@ static void raven_pcihost_initfn(Object *obj)
 
 static void raven_realize(PCIDevice *d, Error **errp)
 {
-    RavenPCIState *s = RAVEN_PCI_DEVICE(d);
-    char *filename;
-    int bios_size = -1;
-
     d->config[PCI_CACHE_LINE_SIZE] = 0x08;
     d->config[PCI_LATENCY_TIMER] = 0x10;
     d->config[PCI_CAPABILITY_LIST] = 0x00;
-
-    if (!memory_region_init_rom_nomigrate(&s->bios, OBJECT(s), "bios",
-                                          BIOS_SIZE, errp)) {
-        return;
-    }
-    memory_region_add_subregion(get_system_memory(), (uint32_t)(-BIOS_SIZE),
-                                &s->bios);
-    if (s->bios_name) {
-        filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, s->bios_name);
-        if (filename) {
-            if (s->elf_machine != EM_NONE) {
-                bios_size = load_elf(filename, NULL, NULL, NULL, NULL,
-                                     NULL, NULL, NULL,
-                                     ELFDATA2MSB, s->elf_machine, 0, 0);
-            }
-            if (bios_size < 0) {
-                bios_size = get_image_size(filename);
-                if (bios_size > 0 && bios_size <= BIOS_SIZE) {
-                    hwaddr bios_addr;
-                    bios_size = (bios_size + 0xfff) & ~0xfff;
-                    bios_addr = (uint32_t)(-BIOS_SIZE);
-                    bios_size = load_image_targphys(filename, bios_addr,
-                                                    bios_size);
-                }
-            }
-        }
-        g_free(filename);
-        if (bios_size < 0 || bios_size > BIOS_SIZE) {
-            memory_region_del_subregion(get_system_memory(), &s->bios);
-            error_setg(errp, "Could not load bios image '%s'", s->bios_name);
-            return;
-        }
-    }
-
-    vmstate_register_ram_global(&s->bios);
 }
 
 static const VMStateDescription vmstate_raven = {
@@ -417,19 +369,12 @@ static const TypeInfo raven_info = {
     },
 };
 
-static const Property raven_pcihost_properties[] = {
-    DEFINE_PROP_UINT32("elf-machine", PREPPCIState, pci_dev.elf_machine,
-                       EM_NONE),
-    DEFINE_PROP_STRING("bios-name", PREPPCIState, pci_dev.bios_name),
-};
-
 static void raven_pcihost_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
     set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
     dc->realize = raven_pcihost_realizefn;
-    device_class_set_props(dc, raven_pcihost_properties);
     dc->fw_name = "pci";
 }
 
diff --git a/hw/ppc/prep.c b/hw/ppc/prep.c
index 739526335c..982e40e53e 100644
--- a/hw/ppc/prep.c
+++ b/hw/ppc/prep.c
@@ -35,6 +35,7 @@
 #include "qapi/error.h"
 #include "qemu/error-report.h"
 #include "qemu/log.h"
+#include "qemu/datadir.h"
 #include "hw/loader.h"
 #include "hw/rtc/mc146818rtc.h"
 #include "hw/isa/pc87312.h"
@@ -55,6 +56,8 @@
 #define KERNEL_LOAD_ADDR 0x01000000
 #define INITRD_LOAD_ADDR 0x01800000
 
+#define BIOS_ADDR         0xfff00000
+#define BIOS_SIZE         (1 * MiB)
 #define NVRAM_SIZE        0x2000
 
 static void fw_cfg_boot_set(void *opaque, const char *boot_device,
@@ -241,6 +244,9 @@ static void ibm_40p_init(MachineState *machine)
     ISADevice *isa_dev;
     ISABus *isa_bus;
     void *fw_cfg;
+    MemoryRegion *bios = g_new(MemoryRegion, 1);
+    char *filename;
+    ssize_t bios_size = -1;
     uint32_t kernel_base = 0, initrd_base = 0;
     long kernel_size = 0, initrd_size = 0;
     char boot_device;
@@ -263,10 +269,27 @@ static void ibm_40p_init(MachineState *machine)
     cpu_ppc_tb_init(env, 100UL * 1000UL * 1000UL);
     qemu_register_reset(ppc_prep_reset, cpu);
 
+    /* allocate and load firmware */
+    filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, bios_name);
+    if (!filename) {
+        error_report("Could not find bios image '%s'", bios_name);
+        exit(1);
+    }
+    memory_region_init_rom(bios, NULL, "bios", BIOS_SIZE, &error_fatal);
+    memory_region_add_subregion(get_system_memory(), BIOS_ADDR, bios);
+    bios_size = load_elf(filename, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
+                         ELFDATA2MSB, PPC_ELF_MACHINE, 0, 0);
+    if (bios_size < 0) {
+        bios_size = load_image_targphys(filename, BIOS_ADDR, BIOS_SIZE);
+    }
+    if (bios_size < 0 || bios_size > BIOS_SIZE) {
+        error_report("Could not load bios image '%s'", filename);
+        return;
+    }
+    g_free(filename);
+
     /* PCI host */
     dev = qdev_new("raven-pcihost");
-    qdev_prop_set_string(dev, "bios-name", bios_name);
-    qdev_prop_set_uint32(dev, "elf-machine", PPC_ELF_MACHINE);
     pcihost = SYS_BUS_DEVICE(dev);
     object_property_add_child(qdev_get_machine(), "raven", OBJECT(dev));
     sysbus_realize_and_unref(pcihost, &error_fatal);

From 17612f972f02fcafae2c70aa96c9d2e7a4c6d36d Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Wed, 14 May 2025 16:49:55 +0800
Subject: [PATCH 1484/2760] hw/core/resetcontainer: Consolidate
 OBJECT_DECLARE_SIMPLE_TYPE
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The QOM type of ResettableContainer is defined by
OBJECT_DEFINE_SIMPLE_TYPE_WITH_INTERFACES, which means it doesn't need
the class!

Therefore, use OBJECT_DECLARE_SIMPLE_TYPE to declare the type, then
there's no need for class definition.

Cc: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250514084957.2221975-8-zhao1.liu@intel.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 include/hw/core/resetcontainer.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/hw/core/resetcontainer.h b/include/hw/core/resetcontainer.h
index 23db0c7a88..daeb18c1ea 100644
--- a/include/hw/core/resetcontainer.h
+++ b/include/hw/core/resetcontainer.h
@@ -20,7 +20,7 @@
 #include "qom/object.h"
 
 #define TYPE_RESETTABLE_CONTAINER "resettable-container"
-OBJECT_DECLARE_TYPE(ResettableContainer, ResettableContainerClass, RESETTABLE_CONTAINER)
+OBJECT_DECLARE_SIMPLE_TYPE(ResettableContainer, RESETTABLE_CONTAINER)
 
 /**
  * resettable_container_add: Add a resettable object to the container

From 8cab2354a2ff77c0977ac337a93ad6f645e5086a Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Wed, 14 May 2025 16:49:53 +0800
Subject: [PATCH 1485/2760] hw/hyperv/balloon: Consolidate
 OBJECT_DEFINE_SIMPLE_TYPE_WITH_INTERFACES
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The QOM type of HvBalloon is declared by OBJECT_DECLARE_SIMPLE_TYPE,
which means it doesn't need the class!

Therefore, use OBJECT_DEFINE_SIMPLE_TYPE_WITH_INTERFACES to implement
the type, then there's no need for class definition.

Cc: "Maciej S. Szmigiero" <maciej.szmigiero@oracle.com>
Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Acked-by: Maciej S. Szmigiero <maciej.szmigiero@oracle.com>
Message-ID: <20250514084957.2221975-6-zhao1.liu@intel.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/hyperv/hv-balloon.c | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/hw/hyperv/hv-balloon.c b/hw/hyperv/hv-balloon.c
index 94b0abbd68..6dbcb2d9a2 100644
--- a/hw/hyperv/hv-balloon.c
+++ b/hw/hyperv/hv-balloon.c
@@ -67,10 +67,6 @@
  * these requests
  */
 
-struct HvBalloonClass {
-    VMBusDeviceClass parent_class;
-} HvBalloonClass;
-
 typedef enum State {
     /* not a real state */
     S_NO_CHANGE = 0,
@@ -162,8 +158,9 @@ typedef struct HvBalloon {
     MemoryRegion *mr;
 } HvBalloon;
 
-OBJECT_DEFINE_TYPE_WITH_INTERFACES(HvBalloon, hv_balloon, HV_BALLOON, VMBUS_DEVICE, \
-                                   { TYPE_MEMORY_DEVICE }, { })
+OBJECT_DEFINE_SIMPLE_TYPE_WITH_INTERFACES(HvBalloon, hv_balloon, \
+                                          HV_BALLOON, VMBUS_DEVICE, \
+                                          { TYPE_MEMORY_DEVICE }, { })
 
 #define HV_BALLOON_SET_STATE(hvb, news)             \
     do {                                            \

From ea585b1022f7c1ac6e465aa1fe869de4c20ca943 Mon Sep 17 00:00:00 2001
From: BALATON Zoltan <balaton@eik.bme.hu>
Date: Fri, 23 May 2025 17:02:11 +0200
Subject: [PATCH 1486/2760] hw/ppc/e500: Move clock and TB frequency to machine
 class
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Different machines have different frequencies so make this
configurable in machine class instead of using a hard coded constant.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Acked-by: Bernhard Beschow <shentey@gmail.com>
Message-ID: <431166f96ff12ff3dbc670d40544974415f11305.1748012109.git.balaton@eik.bme.hu>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/ppc/e500.c      | 18 +++++++++---------
 hw/ppc/e500.h      |  4 ++++
 hw/ppc/e500plat.c  |  2 ++
 hw/ppc/mpc8544ds.c |  2 ++
 4 files changed, 17 insertions(+), 9 deletions(-)

diff --git a/hw/ppc/e500.c b/hw/ppc/e500.c
index 809078a2c3..dedd96b057 100644
--- a/hw/ppc/e500.c
+++ b/hw/ppc/e500.c
@@ -79,8 +79,6 @@
 #define MPC85XX_ESDHC_IRQ          72
 #define RTC_REGS_OFFSET            0x68
 
-#define PLATFORM_CLK_FREQ_HZ       (400 * 1000 * 1000)
-
 struct boot_info
 {
     uint32_t dt_base;
@@ -120,7 +118,7 @@ static uint32_t *pci_map_create(void *fdt, uint32_t mpic, int first_slot,
 }
 
 static void dt_serial_create(void *fdt, unsigned long long offset,
-                             const char *soc, const char *mpic,
+                             const char *soc, uint32_t freq, const char *mpic,
                              const char *alias, int idx, bool defcon)
 {
     char *ser;
@@ -131,7 +129,7 @@ static void dt_serial_create(void *fdt, unsigned long long offset,
     qemu_fdt_setprop_string(fdt, ser, "compatible", "ns16550");
     qemu_fdt_setprop_cells(fdt, ser, "reg", offset, 0x100);
     qemu_fdt_setprop_cell(fdt, ser, "cell-index", idx);
-    qemu_fdt_setprop_cell(fdt, ser, "clock-frequency", PLATFORM_CLK_FREQ_HZ);
+    qemu_fdt_setprop_cell(fdt, ser, "clock-frequency", freq);
     qemu_fdt_setprop_cells(fdt, ser, "interrupts", 42, 2);
     qemu_fdt_setprop_phandle(fdt, ser, "interrupt-parent", mpic);
     qemu_fdt_setprop_string(fdt, "/aliases", alias, ser);
@@ -382,8 +380,7 @@ static int ppce500_load_device_tree(PPCE500MachineState *pms,
     int fdt_size;
     void *fdt;
     uint8_t hypercall[16];
-    uint32_t clock_freq = PLATFORM_CLK_FREQ_HZ;
-    uint32_t tb_freq = PLATFORM_CLK_FREQ_HZ;
+    uint32_t clock_freq, tb_freq;
     int i;
     char compatible_sb[] = "fsl,mpc8544-immr\0simple-bus";
     char *soc;
@@ -484,6 +481,9 @@ static int ppce500_load_device_tree(PPCE500MachineState *pms,
         if (kvmppc_get_hasidle(env)) {
             qemu_fdt_setprop(fdt, "/hypervisor", "has-idle", NULL, 0);
         }
+    } else {
+        clock_freq = pmc->clock_freq;
+        tb_freq = pmc->tb_freq;
     }
 
     /* Create CPU nodes */
@@ -564,12 +564,12 @@ static int ppce500_load_device_tree(PPCE500MachineState *pms,
      */
     if (serial_hd(1)) {
         dt_serial_create(fdt, MPC8544_SERIAL1_REGS_OFFSET,
-                         soc, mpic, "serial1", 1, false);
+                         soc, pmc->clock_freq, mpic, "serial1", 1, false);
     }
 
     if (serial_hd(0)) {
         dt_serial_create(fdt, MPC8544_SERIAL0_REGS_OFFSET,
-                         soc, mpic, "serial0", 0, true);
+                         soc, pmc->clock_freq, mpic, "serial0", 0, true);
     }
 
     /* i2c */
@@ -968,7 +968,7 @@ void ppce500_init(MachineState *machine)
         env->spr_cb[SPR_BOOKE_PIR].default_value = cs->cpu_index = i;
         env->mpic_iack = pmc->ccsrbar_base + MPC8544_MPIC_REGS_OFFSET + 0xa0;
 
-        ppc_booke_timers_init(cpu, PLATFORM_CLK_FREQ_HZ, PPC_TIMER_E500);
+        ppc_booke_timers_init(cpu, pmc->tb_freq, PPC_TIMER_E500);
 
         /* Register reset handler */
         if (!i) {
diff --git a/hw/ppc/e500.h b/hw/ppc/e500.h
index 01db102625..00f490519c 100644
--- a/hw/ppc/e500.h
+++ b/hw/ppc/e500.h
@@ -5,6 +5,8 @@
 #include "hw/platform-bus.h"
 #include "qom/object.h"
 
+#define PLATFORM_CLK_FREQ_HZ (400 * 1000 * 1000)
+
 struct PPCE500MachineState {
     /*< private >*/
     MachineState parent_obj;
@@ -37,6 +39,8 @@ struct PPCE500MachineClass {
     hwaddr pci_mmio_base;
     hwaddr pci_mmio_bus_base;
     hwaddr spin_base;
+    uint32_t clock_freq;
+    uint32_t tb_freq;
 };
 
 void ppce500_init(MachineState *machine);
diff --git a/hw/ppc/e500plat.c b/hw/ppc/e500plat.c
index 775b9d8da0..4f1d659e72 100644
--- a/hw/ppc/e500plat.c
+++ b/hw/ppc/e500plat.c
@@ -93,6 +93,8 @@ static void e500plat_machine_class_init(ObjectClass *oc, const void *data)
     pmc->pci_mmio_base = 0xC00000000ULL;
     pmc->pci_mmio_bus_base = 0xE0000000ULL;
     pmc->spin_base = 0xFEF000000ULL;
+    pmc->clock_freq = PLATFORM_CLK_FREQ_HZ;
+    pmc->tb_freq = PLATFORM_CLK_FREQ_HZ;
 
     mc->desc = "generic paravirt e500 platform";
     mc->init = e500plat_init;
diff --git a/hw/ppc/mpc8544ds.c b/hw/ppc/mpc8544ds.c
index 97fb0f35ba..582698559d 100644
--- a/hw/ppc/mpc8544ds.c
+++ b/hw/ppc/mpc8544ds.c
@@ -55,6 +55,8 @@ static void mpc8544ds_machine_class_init(ObjectClass *oc, const void *data)
     pmc->pci_mmio_bus_base = 0xC0000000ULL;
     pmc->pci_pio_base = 0xE1000000ULL;
     pmc->spin_base = 0xEF000000ULL;
+    pmc->clock_freq = PLATFORM_CLK_FREQ_HZ;
+    pmc->tb_freq = PLATFORM_CLK_FREQ_HZ;
 
     mc->desc = "mpc8544ds";
     mc->init = mpc8544ds_init;

From 3c32fa9fb2300bbe435fc417dbb521981e230639 Mon Sep 17 00:00:00 2001
From: BALATON Zoltan <balaton@eik.bme.hu>
Date: Fri, 23 May 2025 17:02:12 +0200
Subject: [PATCH 1487/2760] hw/net/fsl_etsec: Set default MAC address
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Use default MAC address if none is specified by property as done by
most other network interface models.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: Bernhard Beschow <shentey@gmail.com>
Acked-by: Bernhard Beschow <shentey@gmail.com>
Message-ID: <8bd7ca691bd502b5fd761615d9af805e783fba36.1748012109.git.balaton@eik.bme.hu>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/net/fsl_etsec/etsec.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/net/fsl_etsec/etsec.c b/hw/net/fsl_etsec/etsec.c
index d14cb2a101..846f6cbc5d 100644
--- a/hw/net/fsl_etsec/etsec.c
+++ b/hw/net/fsl_etsec/etsec.c
@@ -389,6 +389,7 @@ static void etsec_realize(DeviceState *dev, Error **errp)
 {
     eTSEC        *etsec = ETSEC_COMMON(dev);
 
+    qemu_macaddr_default_if_unset(&etsec->conf.macaddr);
     etsec->nic = qemu_new_nic(&net_etsec_info, &etsec->conf,
                               object_get_typename(OBJECT(dev)), dev->id,
                               &dev->mem_reentrancy_guard, etsec);

From a35391ba87651daeafa02231e842ae28c349cac0 Mon Sep 17 00:00:00 2001
From: Bernhard Beschow <shentey@gmail.com>
Date: Fri, 23 May 2025 17:02:13 +0200
Subject: [PATCH 1488/2760] hw/ppc/e500: Use SysBusDevice API to access
 TYPE_CCSR's internal resources
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Rather than accessing the attributes of TYPE_CCSR directly, use the SysBusDevice
API which exists exactly for that purpose. Furthermore, registering the memory
region with the SysBusDevice API makes it show up in QMP's `info qom-tree`
command.

Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Reviewed-by: BALATON Zoltan <balaton@eik.bme.hu>
[balaton: rebased]
Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Acked-by: Bernhard Beschow <shentey@gmail.com>
Message-ID: <619a58d1f83d2aad5b4feec930d46c64abff0977.1748012109.git.balaton@eik.bme.hu>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/pci-host/ppce500.c | 8 ++++----
 hw/ppc/e500.c         | 8 ++++----
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/hw/pci-host/ppce500.c b/hw/pci-host/ppce500.c
index e97a515d5f..52269b05bb 100644
--- a/hw/pci-host/ppce500.c
+++ b/hw/pci-host/ppce500.c
@@ -16,7 +16,6 @@
 
 #include "qemu/osdep.h"
 #include "hw/irq.h"
-#include "hw/ppc/e500-ccsr.h"
 #include "hw/qdev-properties.h"
 #include "migration/vmstate.h"
 #include "hw/pci/pci_device.h"
@@ -418,11 +417,12 @@ static const VMStateDescription vmstate_ppce500_pci = {
 static void e500_pcihost_bridge_realize(PCIDevice *d, Error **errp)
 {
     PPCE500PCIBridgeState *b = PPC_E500_PCI_BRIDGE(d);
-    PPCE500CCSRState *ccsr = CCSR(
+    SysBusDevice *ccsr = SYS_BUS_DEVICE(
         object_resolve_path_component(qdev_get_machine(), "e500-ccsr"));
+    MemoryRegion *ccsr_space = sysbus_mmio_get_region(ccsr, 0);
 
-    memory_region_init_alias(&b->bar0, OBJECT(ccsr), "e500-pci-bar0", &ccsr->ccsr_space,
-                             0, int128_get64(ccsr->ccsr_space.size));
+    memory_region_init_alias(&b->bar0, OBJECT(ccsr), "e500-pci-bar0",
+                             ccsr_space, 0, int128_get64(ccsr_space->size));
     pci_register_bar(d, 0, PCI_BASE_ADDRESS_SPACE_MEMORY, &b->bar0);
 }
 
diff --git a/hw/ppc/e500.c b/hw/ppc/e500.c
index dedd96b057..6899802bed 100644
--- a/hw/ppc/e500.c
+++ b/hw/ppc/e500.c
@@ -931,7 +931,6 @@ void ppce500_init(MachineState *machine)
     CPUPPCState *firstenv = NULL;
     MemoryRegion *ccsr_addr_space;
     SysBusDevice *s;
-    PPCE500CCSRState *ccsr;
     I2CBus *i2c;
 
     irqs = g_new0(IrqLines, smp_cpus);
@@ -993,10 +992,10 @@ void ppce500_init(MachineState *machine)
     memory_region_add_subregion(address_space_mem, 0, machine->ram);
 
     dev = qdev_new("e500-ccsr");
+    s = SYS_BUS_DEVICE(dev);
     object_property_add_child(OBJECT(machine), "e500-ccsr", OBJECT(dev));
-    sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
-    ccsr = CCSR(dev);
-    ccsr_addr_space = &ccsr->ccsr_space;
+    sysbus_realize_and_unref(s, &error_fatal);
+    ccsr_addr_space = sysbus_mmio_get_region(s, 0);
     memory_region_add_subregion(address_space_mem, pmc->ccsrbar_base,
                                 ccsr_addr_space);
 
@@ -1284,6 +1283,7 @@ static void e500_ccsr_initfn(Object *obj)
     PPCE500CCSRState *ccsr = CCSR(obj);
     memory_region_init(&ccsr->ccsr_space, obj, "e500-ccsr",
                        MPC8544_CCSRBAR_SIZE);
+    sysbus_init_mmio(SYS_BUS_DEVICE(ccsr), &ccsr->ccsr_space);
 }
 
 static const TypeInfo e500_ccsr_info = {

From bebcf2cff4091281ddf67240d5651ed7938ea83a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Fri, 30 May 2025 16:21:18 +0100
Subject: [PATCH 1489/2760] pc-bios: ensure installed ROMs don't have execute
 permissions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We have been inconsistent about whether ROMS stored in git have
execute permission set, and by default meson will preserve source
file permissions when installing files. This has caused periodic
problems in RPM packaging as executable binary files get analysed
by various tools/linters, which can trip up on the ROMs.

Tell meson explicitly that all the ROMs should be without execute
permission when installed.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Helge Deller <deller@gmx.de>
Tested-by: Helge Deller <deller@gmx.de>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250530152118.65030-1-berrange@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 pc-bios/meson.build | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pc-bios/meson.build b/pc-bios/meson.build
index 79bb2e1800..3c41620044 100644
--- a/pc-bios/meson.build
+++ b/pc-bios/meson.build
@@ -88,7 +88,7 @@ blobs = [
 ]
 
 if get_option('install_blobs')
-  install_data(blobs, install_dir: qemu_datadir)
+  install_data(blobs, install_dir: qemu_datadir, install_mode: 'rw-r--r--')
 endif
 
 subdir('descriptors')

From f37efe50d4a234f30cf6dde0bdcf4e75a798a123 Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Date: Sat, 31 May 2025 16:00:25 +0900
Subject: [PATCH 1490/2760] MAINTAINERS: Update Akihiko Odaki's affiliation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

My contract with Daynix Computing Ltd. will expire by the end of May,
2025. As I may contribute to QEMU for my research, use my email address
at the lab.

As I'm the only maintainer of igb and no longer financially supported to
maintain it, change its status to Odd Fixes until someone steps up.

Signed-off-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250531-rsg-v1-1-e0bae1e1d90e@rsg.ci.i.u-tokyo.ac.jp>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 .mailmap    |  3 ++-
 MAINTAINERS | 16 ++++++++--------
 2 files changed, 10 insertions(+), 9 deletions(-)

diff --git a/.mailmap b/.mailmap
index 33fe75400f..e7271852dc 100644
--- a/.mailmap
+++ b/.mailmap
@@ -67,7 +67,8 @@ Andrey Drobyshev <andrey.drobyshev@virtuozzo.com> Andrey Drobyshev via <qemu-blo
 BALATON Zoltan <balaton@eik.bme.hu> BALATON Zoltan via <qemu-ppc@nongnu.org>
 
 # Next, replace old addresses by a more recent one.
-Akihiko Odaki <akihiko.odaki@daynix.com> <akihiko.odaki@gmail.com>
+Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp> <akihiko.odaki@daynix.com>
+Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp> <akihiko.odaki@gmail.com>
 Aleksandar Markovic <aleksandar.qemu.devel@gmail.com> <aleksandar.markovic@mips.com>
 Aleksandar Markovic <aleksandar.qemu.devel@gmail.com> <aleksandar.markovic@imgtec.com>
 Aleksandar Markovic <aleksandar.qemu.devel@gmail.com> <amarkovic@wavecomp.com>
diff --git a/MAINTAINERS b/MAINTAINERS
index aa6763077e..76399ad1e0 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2519,7 +2519,7 @@ F: tests/qtest/fuzz-megasas-test.c
 
 Network packet abstractions
 M: Dmitry Fleytman <dmitry.fleytman@gmail.com>
-R: Akihiko Odaki <akihiko.odaki@daynix.com>
+R: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
 S: Maintained
 F: include/net/eth.h
 F: net/eth.c
@@ -2549,13 +2549,13 @@ F: docs/specs/rocker.rst
 
 e1000x
 M: Dmitry Fleytman <dmitry.fleytman@gmail.com>
-R: Akihiko Odaki <akihiko.odaki@daynix.com>
+R: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
 S: Maintained
 F: hw/net/e1000x*
 
 e1000e
 M: Dmitry Fleytman <dmitry.fleytman@gmail.com>
-R: Akihiko Odaki <akihiko.odaki@daynix.com>
+R: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
 S: Maintained
 F: hw/net/e1000e*
 F: tests/qtest/fuzz-e1000e-test.c
@@ -2563,9 +2563,9 @@ F: tests/qtest/e1000e-test.c
 F: tests/qtest/libqos/e1000e.*
 
 igb
-M: Akihiko Odaki <akihiko.odaki@daynix.com>
+M: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
 R: Sriram Yagnaraman <sriram.yagnaraman@ericsson.com>
-S: Maintained
+S: Odd Fixes
 F: docs/system/devices/igb.rst
 F: hw/net/igb*
 F: tests/functional/test_netdev_ethtool.py
@@ -2910,7 +2910,7 @@ Core Audio framework backend
 M: Gerd Hoffmann <kraxel@redhat.com>
 M: Philippe Mathieu-Daudé <philmd@linaro.org>
 R: Christian Schoenebeck <qemu_oss@crudebyte.com>
-R: Akihiko Odaki <akihiko.odaki@daynix.com>
+R: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
 S: Odd Fixes
 F: audio/coreaudio.m
 
@@ -3211,7 +3211,7 @@ F: tests/functional/test_vnc.py
 Cocoa graphics
 M: Peter Maydell <peter.maydell@linaro.org>
 M: Philippe Mathieu-Daudé <philmd@linaro.org>
-R: Akihiko Odaki <akihiko.odaki@daynix.com>
+R: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
 S: Odd Fixes
 F: ui/cocoa.m
 
@@ -3738,7 +3738,7 @@ F: util/iova-tree.c
 
 elf2dmp
 M: Viktor Prutyanov <viktor.prutyanov@phystech.edu>
-R: Akihiko Odaki <akihiko.odaki@daynix.com>
+R: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
 S: Maintained
 F: contrib/elf2dmp/
 

From ff1bc6f4c5be7315dcd3970f7bff6b4f986db877 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Tue, 3 Jun 2025 20:40:05 +0200
Subject: [PATCH 1491/2760] tests/functional: Add a test for the Arduino UNO
 machine
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Check whether we can run a kernel that prints something to the
serial console.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Message-ID: <20250603184007.24521-1-thuth@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 MAINTAINERS                      |  3 ++-
 tests/functional/meson.build     |  1 +
 tests/functional/test_avr_uno.py | 32 ++++++++++++++++++++++++++++++++
 3 files changed, 35 insertions(+), 1 deletion(-)
 create mode 100755 tests/functional/test_avr_uno.py

diff --git a/MAINTAINERS b/MAINTAINERS
index 76399ad1e0..a6f210dba5 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -219,7 +219,7 @@ S: Maintained
 F: docs/system/target-avr.rst
 F: gdb-xml/avr-cpu.xml
 F: target/avr/
-F: tests/functional/test_avr_mega2560.py
+F: tests/functional/test_avr_*.py
 
 Hexagon TCG CPUs
 M: Brian Cain <brian.cain@oss.qualcomm.com>
@@ -1236,6 +1236,7 @@ Arduino
 M: Philippe Mathieu-Daudé <philmd@linaro.org>
 S: Maintained
 F: hw/avr/arduino.c
+F: tests/functional/test_avr_uno.py
 
 HP-PARISC Machines
 ------------------
diff --git a/tests/functional/meson.build b/tests/functional/meson.build
index 557d59ddf4..e406451cd3 100644
--- a/tests/functional/meson.build
+++ b/tests/functional/meson.build
@@ -150,6 +150,7 @@ tests_arm_linuxuser_thorough = [
 
 tests_avr_system_thorough = [
   'avr_mega2560',
+  'avr_uno',
 ]
 
 tests_hppa_system_quick = [
diff --git a/tests/functional/test_avr_uno.py b/tests/functional/test_avr_uno.py
new file mode 100755
index 0000000000..adb3b73da4
--- /dev/null
+++ b/tests/functional/test_avr_uno.py
@@ -0,0 +1,32 @@
+#!/usr/bin/env python3
+#
+# QEMU AVR Arduino UNO functional test
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+from qemu_test import QemuSystemTest, Asset, wait_for_console_pattern
+
+
+class UnoMachine(QemuSystemTest):
+
+    ASSET_UNO = Asset(
+        ('https://github.com/RahulRNandan/LED_Blink_AVR/raw/'
+         'c6d602cbb974a193/build/main.elf'),
+        '3009a4e2cf5c5b65142f538abdf66d4dc6bc6beab7e552fff9ae314583761b72')
+
+    def test_uno(self):
+        """
+        The binary constantly prints out 'LED Blink'
+        """
+        self.set_machine('arduino-uno')
+        rom_path = self.ASSET_UNO.fetch()
+
+        self.vm.add_args('-bios', rom_path)
+        self.vm.set_console()
+        self.vm.launch()
+
+        wait_for_console_pattern(self, 'LED Blink')
+
+
+if __name__ == '__main__':
+    QemuSystemTest.main()

From 6cfe590c6b7876ba2471a4357274b33072d62214 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 5 Jun 2025 08:20:37 +0200
Subject: [PATCH 1492/2760] accel/hvf: Fix TYPE_HVF_ACCEL instance size
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fixes: c97d6d2cdf9 ("i386: hvf: add code base from Google repo")
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250606164418.98655-7-philmd@linaro.org>
---
 accel/hvf/hvf-accel-ops.c | 1 +
 include/system/hvf_int.h  | 1 +
 2 files changed, 2 insertions(+)

diff --git a/accel/hvf/hvf-accel-ops.c b/accel/hvf/hvf-accel-ops.c
index b8b6116bc8..d60446b85b 100644
--- a/accel/hvf/hvf-accel-ops.c
+++ b/accel/hvf/hvf-accel-ops.c
@@ -366,6 +366,7 @@ static void hvf_accel_class_init(ObjectClass *oc, const void *data)
 static const TypeInfo hvf_accel_type = {
     .name = TYPE_HVF_ACCEL,
     .parent = TYPE_ACCEL,
+    .instance_size = sizeof(HVFState),
     .class_init = hvf_accel_class_init,
 };
 
diff --git a/include/system/hvf_int.h b/include/system/hvf_int.h
index 8c8b84012d..d774e58df9 100644
--- a/include/system/hvf_int.h
+++ b/include/system/hvf_int.h
@@ -44,6 +44,7 @@ typedef struct hvf_vcpu_caps {
 
 struct HVFState {
     AccelState parent;
+
     hvf_slot slots[32];
     int num_slots;
 

From 59a4757bb4d01c9dfb50e872a9d04ad1f1c38049 Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Thu, 5 Jun 2025 21:27:22 +0800
Subject: [PATCH 1493/2760] hw/core/cpu: Move CacheType to general cpu.h
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

I386 has already defined cache types in target/i386/cpu.h.

Move CacheType to hw/core/cpu.h, so that ARM and other architectures
could use it.

Cc: Alireza Sanaee <alireza.sanaee@huawei.com>
Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250605132722.3597593-1-zhao1.liu@intel.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 include/hw/core/cpu.h | 6 ++++++
 target/i386/cpu.h     | 6 ------
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index 1e87f7d393..33296a1c08 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -1126,4 +1126,10 @@ extern const VMStateDescription vmstate_cpu_common;
 #define UNASSIGNED_CPU_INDEX -1
 #define UNASSIGNED_CLUSTER_INDEX -1
 
+enum CacheType {
+    DATA_CACHE,
+    INSTRUCTION_CACHE,
+    UNIFIED_CACHE
+};
+
 #endif
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index 545851cbde..5910dcf74d 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -1773,12 +1773,6 @@ typedef enum TPRAccess {
 
 /* Cache information data structures: */
 
-enum CacheType {
-    DATA_CACHE,
-    INSTRUCTION_CACHE,
-    UNIFIED_CACHE
-};
-
 typedef struct CPUCacheInfo {
     enum CacheType type;
     uint8_t level;

From c7785e243195799749242b5fc741b8fbf1053f82 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 5 Jun 2025 19:56:52 +0200
Subject: [PATCH 1494/2760] hw/gpio/pca9552: Avoid using g_newa()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We have pin_count <= PCA955X_PIN_COUNT_MAX. Having
PCA955X_PIN_COUNT_MAX = 16, it is safe to explicitly
allocate the char buffer on the stack, without g_newa().

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Glenn Miles <milesg@linux.ibm.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-Id: <20250605193540.59874-2-philmd@linaro.org>
---
 hw/gpio/pca9552.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/gpio/pca9552.c b/hw/gpio/pca9552.c
index d65c0a2e90..1e10238b2e 100644
--- a/hw/gpio/pca9552.c
+++ b/hw/gpio/pca9552.c
@@ -76,7 +76,7 @@ static void pca955x_display_pins_status(PCA955xState *s,
         return;
     }
     if (trace_event_get_state_backends(TRACE_PCA955X_GPIO_STATUS)) {
-        char *buf = g_newa(char, k->pin_count + 1);
+        char buf[PCA955X_PIN_COUNT_MAX + 1];
 
         for (i = 0; i < k->pin_count; i++) {
             if (extract32(pins_status, i, 1)) {

From 0ff9cd9a6af54ccaa293e252aa356fb150788099 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 5 Jun 2025 19:54:58 +0200
Subject: [PATCH 1495/2760] backends/tpm: Avoid using g_alloca()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

tpm_emulator_ctrlcmd() is not in hot path.
Use the heap instead of the stack, removing
the g_alloca() call.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-Id: <20250605193540.59874-3-philmd@linaro.org>
---
 backends/tpm/tpm_emulator.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/backends/tpm/tpm_emulator.c b/backends/tpm/tpm_emulator.c
index 43d350e895..4a234ab2c0 100644
--- a/backends/tpm/tpm_emulator.c
+++ b/backends/tpm/tpm_emulator.c
@@ -129,11 +129,11 @@ static int tpm_emulator_ctrlcmd(TPMEmulator *tpm, unsigned long cmd, void *msg,
     CharBackend *dev = &tpm->ctrl_chr;
     uint32_t cmd_no = cpu_to_be32(cmd);
     ssize_t n = sizeof(uint32_t) + msg_len_in;
-    uint8_t *buf = NULL;
     ptm_res res;
 
     WITH_QEMU_LOCK_GUARD(&tpm->mutex) {
-        buf = g_alloca(n);
+        g_autofree uint8_t *buf = g_malloc(n);
+
         memcpy(buf, &cmd_no, sizeof(cmd_no));
         memcpy(buf + sizeof(cmd_no), msg, msg_len_in);
 

From 2f014eabc1acc64c403557f5a51fdb1ba43bbdd1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 5 Jun 2025 21:20:23 +0200
Subject: [PATCH 1496/2760] tests/unit/test-char: Avoid using g_alloca()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Do not use g_alloca(), simply allocate the CharBackend
structure on the stack.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-Id: <20250605193540.59874-4-philmd@linaro.org>
---
 tests/unit/test-char.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/tests/unit/test-char.c b/tests/unit/test-char.c
index 60a843b79d..f30a39f61f 100644
--- a/tests/unit/test-char.c
+++ b/tests/unit/test-char.c
@@ -993,7 +993,7 @@ static void char_udp_test_internal(Chardev *reuse_chr, int sock)
     struct sockaddr_in other;
     SocketIdleData d = { 0, };
     Chardev *chr;
-    CharBackend *be;
+    CharBackend stack_be, *be = &stack_be;
     socklen_t alen = sizeof(other);
     int ret;
     char buf[10];
@@ -1009,7 +1009,6 @@ static void char_udp_test_internal(Chardev *reuse_chr, int sock)
         chr = qemu_chr_new("client", tmp, NULL);
         g_assert_nonnull(chr);
 
-        be = g_alloca(sizeof(CharBackend));
         qemu_chr_fe_init(be, chr, &error_abort);
     }
 

From 61c4c2558df16262db34397cf50a16ad7b725731 Mon Sep 17 00:00:00 2001
From: Zhenzhong Duan <zhenzhong.duan@intel.com>
Date: Fri, 6 Jun 2025 17:24:02 +0800
Subject: [PATCH 1497/2760] hw/virtio/virtio-mem: Fix definition of
 VirtIOMEMClass
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Parent of VirtIOMEMClass is VirtioDeviceClass rather than VirtIODevice.
This isn't catastrophic only because sizeof(VirtIODevice) >
sizeof(VirtioDeviceClass).

Fixes: 910b25766b33 ("virtio-mem: Paravirtualized memory hot(un)plug")
Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250606092406.229833-2-zhenzhong.duan@intel.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 include/hw/virtio/virtio-mem.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/hw/virtio/virtio-mem.h b/include/hw/virtio/virtio-mem.h
index bc4f787772..e0ab31b45a 100644
--- a/include/hw/virtio/virtio-mem.h
+++ b/include/hw/virtio/virtio-mem.h
@@ -134,7 +134,7 @@ struct VirtioMemSystemReset {
 
 struct VirtIOMEMClass {
     /* private */
-    VirtIODevice parent;
+    VirtioDeviceClass parent_class;
 
     /* public */
     void (*fill_device_info)(const VirtIOMEM *vmen, VirtioMEMDeviceInfo *vi);

From 747a7ee3741fa9876583cbbbc8dd8b8b351a199c Mon Sep 17 00:00:00 2001
From: Zhenzhong Duan <zhenzhong.duan@intel.com>
Date: Fri, 6 Jun 2025 17:24:03 +0800
Subject: [PATCH 1498/2760] hw/virtio/virtio-pmem: Fix definition of
 VirtIOPMEMClass
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

VirtIOPMEMClass's parent is VirtioDeviceClass rather than VirtIODevice.
This isn't catastrophic only because sizeof(VirtIODevice) >
sizeof(VirtioDeviceClass).

Fixes: 5f503cd9f388 ("virtio-pmem: add virtio device")
Closes: https://lists.gnu.org/archive/html/qemu-devel/2025-06/msg00586.html
Reported-by: David Hildenbrand <david@redhat.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Message-ID: <20250606092406.229833-3-zhenzhong.duan@intel.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 include/hw/virtio/virtio-pmem.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/hw/virtio/virtio-pmem.h b/include/hw/virtio/virtio-pmem.h
index fc4fd1f7fe..9cce600d0b 100644
--- a/include/hw/virtio/virtio-pmem.h
+++ b/include/hw/virtio/virtio-pmem.h
@@ -36,7 +36,7 @@ struct VirtIOPMEM {
 
 struct VirtIOPMEMClass {
     /* private */
-    VirtIODevice parent;
+    VirtioDeviceClass parent_class;
 
     /* public */
     void (*fill_device_info)(const VirtIOPMEM *pmem, VirtioPMEMDeviceInfo *vi);

From 2f8f01ae3d6b7acae187d700d7358d9bb248a696 Mon Sep 17 00:00:00 2001
From: Zhenzhong Duan <zhenzhong.duan@intel.com>
Date: Fri, 6 Jun 2025 17:24:04 +0800
Subject: [PATCH 1499/2760] hw/gpio/aspeed: Fix definition of AspeedGPIOClass
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

AspeedGPIOClass's parent is SysBusDeviceClass rather than SysBusDevice.
This isn't catastrophic only because sizeof(SysBusDevice) >
sizeof(SysBusDeviceClass).

Fixes: 4b7f956862dc ("hw/gpio: Add basic Aspeed GPIO model for AST2400 and AST2500")
Closes: https://lists.gnu.org/archive/html/qemu-devel/2025-06/msg00586.html
Suggested-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Message-ID: <20250606092406.229833-4-zhenzhong.duan@intel.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 include/hw/gpio/aspeed_gpio.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/hw/gpio/aspeed_gpio.h b/include/hw/gpio/aspeed_gpio.h
index e1e6c54333..e6b2fe71b5 100644
--- a/include/hw/gpio/aspeed_gpio.h
+++ b/include/hw/gpio/aspeed_gpio.h
@@ -70,7 +70,7 @@ typedef struct AspeedGPIOReg {
 } AspeedGPIOReg;
 
 struct AspeedGPIOClass {
-    SysBusDevice parent_obj;
+    SysBusDeviceClass parent_class;
     const GPIOSetProperties *props;
     uint32_t nr_gpio_pins;
     uint32_t nr_gpio_sets;

From 860bb8b925418f3ea55305da2a7387d8318ac00c Mon Sep 17 00:00:00 2001
From: Zhenzhong Duan <zhenzhong.duan@intel.com>
Date: Fri, 6 Jun 2025 17:24:06 +0800
Subject: [PATCH 1500/2760] hw/riscv/riscv-iommu: Remove definition of
 RISCVIOMMU[Pci|Sys]Class
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

RISCVIOMMUPciClass and RISCVIOMMUSysClass are defined with missed
parent class, class_init on them may corrupt their parent class
fields.

It's lucky that parent_realize and parent_phases are not initialized
or used until now, so just remove the definitions. They can be added
back when really necessary.

Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250606092406.229833-6-zhenzhong.duan@intel.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/riscv/riscv-iommu-pci.c | 6 ------
 hw/riscv/riscv-iommu-sys.c | 6 ------
 include/hw/riscv/iommu.h   | 6 ++----
 3 files changed, 2 insertions(+), 16 deletions(-)

diff --git a/hw/riscv/riscv-iommu-pci.c b/hw/riscv/riscv-iommu-pci.c
index 1f44eef74e..cdb4a7a8f0 100644
--- a/hw/riscv/riscv-iommu-pci.c
+++ b/hw/riscv/riscv-iommu-pci.c
@@ -68,12 +68,6 @@ typedef struct RISCVIOMMUStatePci {
     RISCVIOMMUState  iommu;   /* common IOMMU state */
 } RISCVIOMMUStatePci;
 
-struct RISCVIOMMUPciClass {
-    /*< public >*/
-    DeviceRealize parent_realize;
-    ResettablePhases parent_phases;
-};
-
 /* interrupt delivery callback */
 static void riscv_iommu_pci_notify(RISCVIOMMUState *iommu, unsigned vector)
 {
diff --git a/hw/riscv/riscv-iommu-sys.c b/hw/riscv/riscv-iommu-sys.c
index 74e76b94a5..e34d00aef6 100644
--- a/hw/riscv/riscv-iommu-sys.c
+++ b/hw/riscv/riscv-iommu-sys.c
@@ -53,12 +53,6 @@ struct RISCVIOMMUStateSys {
     uint8_t *msix_pba;
 };
 
-struct RISCVIOMMUSysClass {
-    /*< public >*/
-    DeviceRealize parent_realize;
-    ResettablePhases parent_phases;
-};
-
 static uint64_t msix_table_mmio_read(void *opaque, hwaddr addr,
                                      unsigned size)
 {
diff --git a/include/hw/riscv/iommu.h b/include/hw/riscv/iommu.h
index b03339d75c..8a8acfc3f0 100644
--- a/include/hw/riscv/iommu.h
+++ b/include/hw/riscv/iommu.h
@@ -30,14 +30,12 @@ typedef struct RISCVIOMMUState RISCVIOMMUState;
 typedef struct RISCVIOMMUSpace RISCVIOMMUSpace;
 
 #define TYPE_RISCV_IOMMU_PCI "riscv-iommu-pci"
-OBJECT_DECLARE_TYPE(RISCVIOMMUStatePci, RISCVIOMMUPciClass, RISCV_IOMMU_PCI)
+OBJECT_DECLARE_SIMPLE_TYPE(RISCVIOMMUStatePci, RISCV_IOMMU_PCI)
 typedef struct RISCVIOMMUStatePci RISCVIOMMUStatePci;
-typedef struct RISCVIOMMUPciClass RISCVIOMMUPciClass;
 
 #define TYPE_RISCV_IOMMU_SYS "riscv-iommu-device"
-OBJECT_DECLARE_TYPE(RISCVIOMMUStateSys, RISCVIOMMUSysClass, RISCV_IOMMU_SYS)
+OBJECT_DECLARE_SIMPLE_TYPE(RISCVIOMMUStateSys, RISCV_IOMMU_SYS)
 typedef struct RISCVIOMMUStateSys RISCVIOMMUStateSys;
-typedef struct RISCVIOMMUSysClass RISCVIOMMUSysClass;
 
 #define FDT_IRQ_TYPE_EDGE_LOW 1
 

From 3938180c9c58b61b38c7fc304eb48b903c7dfd87 Mon Sep 17 00:00:00 2001
From: Philippe Michaud-Boudreault <philmb3487@proton.me>
Date: Sat, 7 Jun 2025 09:33:01 -0400
Subject: [PATCH 1501/2760] hw/misc/stm32_rcc: Fix stm32_rcc_write() arguments
 order
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The tracing function for the write case incorrectly has
parameters switched around. So order them in the correct way.

Signed-off-by: Philippe Michaud-Boudreault <philmb3487@proton.me>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <HnyjTNqwrfGusE44bnM7kuLuj13Di1VgXN-dXVHMOSnfgCUhoipOVIoVS1WQaKrJxmEDy9XJGdlQj6zVTIdJE0QVlfBhfbcckFFWRRP56uY=@proton.me>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/misc/stm32_rcc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/misc/stm32_rcc.c b/hw/misc/stm32_rcc.c
index 94e8dae441..5815b3efa5 100644
--- a/hw/misc/stm32_rcc.c
+++ b/hw/misc/stm32_rcc.c
@@ -60,7 +60,7 @@ static void stm32_rcc_write(void *opaque, hwaddr addr,
     uint32_t value = val64;
     uint32_t prev_value, new_value, irq_offset;
 
-    trace_stm32_rcc_write(value, addr);
+    trace_stm32_rcc_write(addr, value);
 
     if (addr > STM32_RCC_DCKCFGR2) {
         qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%"HWADDR_PRIx"\n",

From 32e02fd3886c01a5c1c888ecd1e5035f851717a1 Mon Sep 17 00:00:00 2001
From: Soumyajyotii Ssarkar <soumyajyotisarkar23@gmail.com>
Date: Sat, 7 Jun 2025 20:57:12 +0530
Subject: [PATCH 1502/2760] hw/net/i82596: Update datasheet URL
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Change the asset link to one which is working from the PARISC website.

Signed-off-by: Soumyajyotii Ssarkar <soumyajyotisarkar23@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250607152711.108914-2-soumyajyotisarkar23@gmail.com>
[PMD: Split patch in 2]
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/net/i82596.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/net/i82596.c b/hw/net/i82596.c
index 64ed3c8390..fc33a00d49 100644
--- a/hw/net/i82596.c
+++ b/hw/net/i82596.c
@@ -5,7 +5,7 @@
  * This work is licensed under the GNU GPL license version 2 or later.
  *
  * This software was written to be compatible with the specification:
- * https://www.intel.com/assets/pdf/general/82596ca.pdf
+ * https://parisc.docs.kernel.org/en/latest/_downloads/96672be0650d9fc046bbcea40b92482f/82596CA.pdf
  */
 
 #include "qemu/osdep.h"

From fb8449def4a22d8e65e9773c923174ae2c1db893 Mon Sep 17 00:00:00 2001
From: Soumyajyotii Ssarkar <soumyajyotisarkar23@gmail.com>
Date: Sat, 7 Jun 2025 20:57:12 +0530
Subject: [PATCH 1503/2760] hw/net/i82596: Factor configure function out
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Abstract the configure function.

Signed-off-by: Soumyajyotii Ssarkar <soumyajyotisarkar23@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250607152711.108914-2-soumyajyotisarkar23@gmail.com>
[PMD: Split patch in 2]
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/net/i82596.c | 36 +++++++++++++++++++++---------------
 1 file changed, 21 insertions(+), 15 deletions(-)

diff --git a/hw/net/i82596.c b/hw/net/i82596.c
index fc33a00d49..c1ff3e6c56 100644
--- a/hw/net/i82596.c
+++ b/hw/net/i82596.c
@@ -177,6 +177,26 @@ static void set_individual_address(I82596State *s, uint32_t addr)
     trace_i82596_new_mac(nc->info_str);
 }
 
+static void i82596_configure(I82596State *s, uint32_t addr)
+{
+    uint8_t byte_cnt;
+    byte_cnt = get_byte(addr + 8) & 0x0f;
+
+    byte_cnt = MAX(byte_cnt, 4);
+    byte_cnt = MIN(byte_cnt, sizeof(s->config));
+    /* copy byte_cnt max. */
+    address_space_read(&address_space_memory, addr + 8,
+                       MEMTXATTRS_UNSPECIFIED, s->config, byte_cnt);
+    /* config byte according to page 35ff */
+    s->config[2] &= 0x82; /* mask valid bits */
+    s->config[2] |= 0x40;
+    s->config[7]  &= 0xf7; /* clear zero bit */
+    assert(I596_NOCRC_INS == 0); /* do CRC insertion */
+    s->config[10] = MAX(s->config[10], 5); /* min frame length */
+    s->config[12] &= 0x40; /* only full duplex field valid */
+    s->config[13] |= 0x3f; /* set ones in byte 13 */
+}
+
 static void set_multicast_list(I82596State *s, uint32_t addr)
 {
     uint16_t mc_count, i;
@@ -234,7 +254,6 @@ static void command_loop(I82596State *s)
 {
     uint16_t cmd;
     uint16_t status;
-    uint8_t byte_cnt;
 
     DBG(printf("STARTING COMMAND LOOP cmd_p=%08x\n", s->cmd_p));
 
@@ -254,20 +273,7 @@ static void command_loop(I82596State *s)
             set_individual_address(s, s->cmd_p);
             break;
         case CmdConfigure:
-            byte_cnt = get_byte(s->cmd_p + 8) & 0x0f;
-            byte_cnt = MAX(byte_cnt, 4);
-            byte_cnt = MIN(byte_cnt, sizeof(s->config));
-            /* copy byte_cnt max. */
-            address_space_read(&address_space_memory, s->cmd_p + 8,
-                               MEMTXATTRS_UNSPECIFIED, s->config, byte_cnt);
-            /* config byte according to page 35ff */
-            s->config[2] &= 0x82; /* mask valid bits */
-            s->config[2] |= 0x40;
-            s->config[7]  &= 0xf7; /* clear zero bit */
-            assert(I596_NOCRC_INS == 0); /* do CRC insertion */
-            s->config[10] = MAX(s->config[10], 5); /* min frame length */
-            s->config[12] &= 0x40; /* only full duplex field valid */
-            s->config[13] |= 0x3f; /* set ones in byte 13 */
+            i82596_configure(s, s->cmd_p);
             break;
         case CmdTDR:
             /* get signal LINK */

From 832cd70452e25c56309450fb10ff012513a7a410 Mon Sep 17 00:00:00 2001
From: Gerd Hoffmann <kraxel@redhat.com>
Date: Wed, 11 Jun 2025 09:36:41 +0200
Subject: [PATCH 1504/2760] seabios: update submodule to 1.17.0
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

git shortlog rel-1.16.3..rel-1.17.0
-----------------------------------

Andrej Kruták (1):
      Add AHCI Power ON + ICC_ACTIVE into port setup code

Daniel Khodabakhsh (2):
      boot: Force display of the boot menu when boot-menu-wait is a negative number
      usb-hid: Support multiple USB HID devices by storing them in a linked list

Daniel Verkamp (3):
      vbe: Add VBE 2.0+ OemData field to struct vbe_info
      vgasrc: round up save/restore size
      vbe: implement function 09h (get/set palette data)

Daniil Tatianin (1):
      pciinit: don't misalign large BARs

Gerd Hoffmann (6):
      limit address space used for pci devices, part two
      drop obsolete acpi table code
      drop acpi tables and hex includes
      add romfile_loadbool()
      update pci_pad_mem64 handling
      ahci: add controller reset

Igor Mammedov (1):
      fix smbios blob length overflow

Jiaxun Yang (1):
      ahci: Fix hangs due to controller reset

Kevin O'Connor (14):
      vgasrc: Use curmode_g instead of vmode_g when mode is the current video mode
      vgasrc: Rename vgahw_get_linesize() to vgahw_minimum_linelength()
      stdvgamodes: No need to store pelmask in vga_modes[]
      stdvgamodes: Improve naming of dac palette tables
      stdvga: Rename CGA palette functions
      stdvga: Add comments to interface functions in stdvga.c
      stdvga: Rename stdvga_toggle_intensity() to stdvga_set_palette_blinking()
      stdvga: Rework stdvga palette index paging interface functions
      stdvga: Rename stdvga_set_text_block_specifier() to stdvga_set_font_location()
      stdvga: Rename stdvga_set_scan_lines() to stdvga_set_character_height()
      stdvga: Rename stdvga_get_vde() to stdvga_get_vertical_size()
      stdvga: Add stdvga_set_vertical_size() helper function
      stdvgaio: Only read/write one color palette entry at a time
      docs: Note v1.17.0 release

Mark Cave-Ayland (2):
      esp-scsi: terminate DMA transfer when ESP data transfer completes
      esp-scsi: indicate acceptance of MESSAGE IN phase data

Max Tottenham (1):
      Add LBA 64bit support for reads beyond 2TB.

Steven Price (1):
      vgabios: Fix generating modes list for static_functionality

nikolar via SeaBIOS (1):
      kconfig: fix the check-lxdialog.sh to work with gcc 14+

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
 roms/seabios | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/roms/seabios b/roms/seabios
index a6ed6b701f..b52ca86e09 160000
--- a/roms/seabios
+++ b/roms/seabios
@@ -1 +1 @@
-Subproject commit a6ed6b701f0a57db0569ab98b0661c12a6ec3ff8
+Subproject commit b52ca86e094d19b58e2304417787e96b940e39c6

From cba36cf3881e907553ba2de38abd5edf7f952de1 Mon Sep 17 00:00:00 2001
From: Gerd Hoffmann <kraxel@redhat.com>
Date: Wed, 11 Jun 2025 09:43:13 +0200
Subject: [PATCH 1505/2760] seabios: update binaries to 1.17.0

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
 pc-bios/bios-256k.bin             | Bin 262144 -> 262144 bytes
 pc-bios/bios-microvm.bin          | Bin 131072 -> 131072 bytes
 pc-bios/bios.bin                  | Bin 131072 -> 131072 bytes
 pc-bios/vgabios-ati.bin           | Bin 39424 -> 39424 bytes
 pc-bios/vgabios-bochs-display.bin | Bin 28672 -> 28672 bytes
 pc-bios/vgabios-cirrus.bin        | Bin 38912 -> 39424 bytes
 pc-bios/vgabios-qxl.bin           | Bin 39424 -> 39424 bytes
 pc-bios/vgabios-ramfb.bin         | Bin 28672 -> 28672 bytes
 pc-bios/vgabios-stdvga.bin        | Bin 39424 -> 39424 bytes
 pc-bios/vgabios-virtio.bin        | Bin 39424 -> 39424 bytes
 pc-bios/vgabios-vmware.bin        | Bin 39424 -> 39424 bytes
 pc-bios/vgabios.bin               | Bin 38912 -> 38912 bytes
 12 files changed, 0 insertions(+), 0 deletions(-)

diff --git a/pc-bios/bios-256k.bin b/pc-bios/bios-256k.bin
index 48c3707d55d3884c54efa9b3c70ab5c3382139c0..509f3988e49dcf37028a1c88ce9204a0956301d5 100644
GIT binary patch
delta 123208
zcmZo@5CEYijPeTwl<S?D85lM(GcfF8W?(qa%)pSw!oU#D%D|Ao%D^y@m4RUvD+9w*
zRtARmtPBj_SQ!{x*ccdM*cce}*clky*clia*cli$uro01VP|0Y#LmF*pPhk0h=YMa
zmV<#onS+5ror8hFl#_wMmXm=&nxBEegr9-Ii=TlZmY;#4fS;kBp_!k7VH!UJ!%}_*
z26<ryh8zh7hD2Eg24e*V21!K*hC&qvhFK~M3|mzg7$j907~E7D7&=rL81AYvFvMyw
zFqCUBFtlkfFc@nxFcfMsFznQ1V7R8q!0<|wf#J6%0|UDj1A~MX1H(Km28R7w3=EI8
z7#Os)85r8N85p)|*E292)@EQ3)?r}q(P3bis>8rAONW7Bkq!gHQym6|xw;Gt=XDtv
zeDxR@;`A68_UbV(oYP}qkThUmNHkzz*k-`Mu)&al;k6+HL#z=4!#^Vi1|4GthTp~v
z3@IiI3=F0W3>~Hn4EIbK7(C1w7{bgM7!I2=Fl1OTFwC)FU|3ae!N73Yf`K8!l7Zoh
zB?E(u6$68g6$8T~D+UGwYX*iUTLy+JwhRpSY#A72?HCx8?HCw*>=+ml>=+nY?HCx2
z+A%PwI503Ab6{YQa%Nyy?!v$j?aIK==+3|p?ZLn>-GhPQx+ep}JU<48O@0gvJNy_J
z1pOHp`urIfS_2pu>Scl$7^Va<Fqj52Fa(A(Ft9{2Fl>xsU`UB(U^o)Zz#tdHz@Qn!
zz>prpz;GdkfgvoGfk7dTf#G9314BXr0|Q?o1A{>#1H+0$28KJy3=AbH3=H)t3=FL)
z3=Ewq3=FGN7#KFDFfcq!VPN=`!oa|k%D~{9%D}KAje)^9ouQr~Fr9(nM+O6fS{4I?
zZWaT>hAajKgKP!{^K1r&f@}tcTOc}zfniY&1H+*_28K6z3=Dbs3=Dnw3=EaU3=Hdv
z85njHGcdd@W?(p7#=vl~jDg{K83V)HG6sgmat4OQ<qQl@${85mmoqSYFK1xju3}&i
ztzux1uVP@(tg2^V2&-aXNUmaF$gW~wD6V2)SY5@yaJ`Cw;dK=Q!<Q-s2Ht802E}Ry
zhN5Z)hI!Qt44bMM7<N}PFkGo-V0c;0z%a9cfniMp1H;Ki28Ntg28KoL3=BNo3=ETd
z85oxJGB6zKWnj?hV_;D0XJBaUXJ9xmfq~)ZWCn)0Qy3WR>ZdX=giK{%NS(^S@P8@;
zgZOj?2ASy$3^~&o7`{wrVDOy5zz{Wqf#LiN1_p+i3=Bdu85mM$GB8}3$-wYrCIds{
zECz<mSquzwW-&0lpUuFKHJ5=Qe?9|))&d3wj|B`2RSOsxwl8F0*td{@;oL$7hT268
z484mO7+x)6U~pK%z)+vJgn{AN5(WmAr3?%@OBonCmNGCrUCO}Vu#ADBWf=p*sbvfd
z=a(@sXe?)7n7f>TVdHWJhX2bM7@SrxFvP52U?^F^z;JX01B2O01_r;C3=C6OGB7+{
z$-wY$B?CkIDh39o)eH>ms~H#qRx>a(u4Z7kwVHt;Xbl6y;WZ2lT5B2V88)nCV0gZk
zfk9y%1B2~428N1t3=BQ%7#J3<V_<l(j)8%3Jp+ULdIpBb^$ZN<>lqk2*E2AzSkJ()
zYdr%4-v$N-g$)c0_8S-&0yi)))NEj2=-a@+uzCXngXAU#h8LR{7&tdGFihCOz;I>@
z1H+9i3=E8085qL0GB6ZuWnd`VTF=1HxRrsSZz}`Cl&uU5o3}DBoZZU6@MJ3k1M@Zp
z2F`5^3?kbY7^Jo_FsN)}U})LKz|gskfnnk{28L<d7#I$3V_^8Qje)^`I|D=Lb_RxJ
z+Zh<vY-eEDzny_0ZwCWI$qojFwjB%%Jv$f}KJH*(sM^KAuxA$o!=+se3}U+(7+mXj
zGcYvmVPM#`hk=1-F9XBQy$lTd_cAb?+snXkWiJCm^*#oM&V39FQ}!`1EZWDwuxB3w
z!=wES42cIA7``83VAyw<fuZ;$14HFW28Q~R3=B_CF)(PJW?(Qn&A<?Knt>tVGy}uA
z(+mufXBZfi&M+|4oMB*SKg+=I>nsDq<#P-S^^E5k7+TIVFibkn!0_}u1B2QH28J0I
z7#IXDGB7A#Vqnm^#K4eyiGg9lB?gA+mlzn%USeR-xWd4YcZGqW{0alZlq(Dj`ZpOE
zX5C_7Xur$AAb*d6!RbB&L*@ephBXfu80I`=VBmPfz@Yb-fuZ0z1H+aV3=HhA7#Oy{
zW?*>tmZ6^E{(A<7o(~KRt3NU@eEi73u>TVS!|l%u3^rdF82)@=VDS9Lz##OUf#K+P
z1_t3D3=Aqi7#LpuVqlQ|&A=f3mw}=CF9XBOe+&!_{}~u&{AXa;_@99xje(INoQ09W
zl#P+$ng}C<q9`MSwkRV*v?wD(yC@?=fdnJNB?(4``Lgwl40~l68Q#e<GKk1AGJKY2
zWcVe|$Y8F($e^Oa$dIJM$k3p|$Z$@DkwH$Ck-<}yks(5rk>RN-Bf}bXMuyGmj127>
zj12QM7#T!085z_y85tZj85u0J85!KP85x4L85tt985xqa85uIP85uTdGcp|4W@I>~
z!^rSJhmqlPy$&P8T3tqlqq>X?wt9>VPI`<Co_dT7etL`yjQWfWHTsMU2lN>kj_5No
zoX}@vIHS+Va6zAu;fg*Z!wr2#hCBL<3=i}f8J_4fGQ7}dWO$>`$nZg*k>QIzBf}4U
zMutE7j0_A0j0`LWj0_wGj0`*mj0^$>j0_?Mj0_S6j12WM28;{}28;|U28;|E28;|k
z28;{_28;|Q28;|A28;|g28;|228;|Y28;|I28;|o28;{=28;|L28;|528;|b28;{|
z28;|T28;|D28;|j28;{^28;|P28;|928;|f28;|128;|X28;|H28;|n28;|73>X=v
z7%(!-Fkq}_m}9`mu)u(kVTl1F!wLgNhBXF^3>yp>8MYWOGVCy5WY}ZC$Z)`bk>Q8|
zBf|*;Musy6j0_hn85y2fGBOBQF*2xFF)~<KF*5jAF)}1rF*1}`F*0;mF*3}tVr1B0
z#mI2Pijm=l6(hqND@FzeYet3w8%Bl}8%72PTSkTmTV_UvnCZFdjN;Qjs56SxtJpCz
zXxK3_7}zl~nAkBgSlBT#IM^{VxY#i=c-S#A1lTb$Brq^A%wu3+*v7!XaEXC|;UNP9
z11}>3gDN8f!$W2UhBy`mhAI{YhD9t43_DpE7%sCjFg##qV0g>Uz|hFaz>v+wz)-`*
zz%ZGMfnh5b1H&;c28LT)3=FTi80s1Rb1^Wuax*YQa5FIEax*Z@;bvf1&&|Magqwlk
zE;j?iH*N-o79Iu$M_vX7MIi=;6d?wN79j?PwL%OG7ljxYo(VB992I6@xF*cNz$n7N
zpdiA)@K1z+L0FW5AwZUa;h-!7!+%)@hG}vP3@har7!JuXFx--3V9=0fV3;Id&%m%-
zo`K<pJOhKE0t17Z0s}*%0t3Tr1qO!m3JeTy6c`x(C@?SxC^9f;Dl#xEQ)FPcs>s0b
zRFQ$<pCSW8oDu^=o)QB?wGsovDkTPnYf20Z_mvnJUV!+@3=Bt<85piBGcdeUW?=ZE
z%)p?k!oc9I!oU!v!oU!(!oW~nufo7EQH6nFzX}5bhbjYuiYfy`fGPvS6jcU>cd85w
z6EqkY=4mo8m}@aGEY@ORIH|?Ja9xXm;hPo%gNZf+!whW(hG-oIhD;p>hW9!Q3=Fyq
z49j&H7;fq^Fg({~V9?fMV93y8V3@7Pz;Hv4fx%6mfgxF+fnmEo1H&<W28Q|@`V0)p
z1`G@u1`G_R3>X-$889$BHeg`*V8FnTV#vTyZOFi|!jOSsmmvegLqi6JuZ9c^=|&6;
zRYnX9Q;ZlG))+A`uo*KjNEkCPBpWj@+%aZg_+-q$z-q$4AZo(EkY~cc&}hQI&}+iL
zaLa^&;kyX~1D7cS!vs?Xh7+a?^$gr*3=E6S7#KF1F)-XRV_^7g#=yX3&cGmN&cNVn
z&cKjh&cKjm&cM)R&cHC+oPlAJIRnE^a|VX9<_rv1%o!M-n=>$cGiPAnuwY>DvtVF|
zw_so>vS47Sv0z}>V!^<0(t?5Et_1_bCkqCKKNbuOww4SG!IlgR@s<n>MV9pp4EHP<
z7=BqYFbG>QFsNBEFql~}F!)(9FwC)HV34(DU`V%SV34$7V6e1dV2H6{V3=vcz_7-K
zfnkRY1H)$<1_pgw28JG628PA93=ErX85qvnGBAkSF)-BFF)+-vV_;Zq$G~vjj)6hQ
zo`E6Xo`GSKJp;oMdj^Ib_6!UU>+KmB-rF-UFgh?W=s7SjL^v=o<U24h)H*OQY<6H^
zxZuFRaL0jx;gbUc1A`+2gMcFggPbD+gS#UGL#iVKLxm#)Lz^Q5!)!+ehFgvd46IHJ
z44O_14316=3^7g&3<XXM482Ya3<k~&486__46~gX7<M`{FdTPgV0i7!z);WS!oZ;G
z!oc7SYDT*-Fl4(hFr0B=VEE?3z@X{Mz~JJ_z>w?8z_7uUf#HfP1H&U%28REx3=A=D
z3=AjT7#O(R85m^U85kD2Gcc@nXJEMM&cN`<oq@r`gMneS2Lr=)4+aJvPX-2QPX-1v
zPX-2GPX>lfo(v3^JQ*0Gycp^k3cVN@-gz-FeD`8t;PYl+kn?6>(D!Cwu=HkN@b+e4
zi1lG$c;mys@Xd#TLEe{vLD!do!O53_A<&nBA>NmPq1%^%LClYV!NiY&!PSp}A;yn^
zLDrvvVWB?*!xMi7hW-EshNS@v44VQN81@G+Fq{csU{DKUU}y|tU|1Ja&%j_G%)k&7
z%)l@;n1NwkFayKoU<QVd!3+$7Aq)&kAq))GAq)(OAq)(&LKqm<gfK8zg)%Utg)%Ty
zhcYls3uRzf9m>FPGL(VgUMK^@=THU)fiMOJy)Xub&@cvutS|<K)-VQ!Sz!zeJHi+k
z&W15CJPKoA_#DQ-ARf-Z5M3Y6z>pWt!0<7gfgwJEfnj0<1H=9Z28Op03=Djc3=DFS
z3=9R43=IDw85k6z7#OOe7#LPWF)-|oVqka^#lWBz&A?z6&A^Zs&A?C_&A_lYnt|b7
zGy}tzXa)xM7zPIW7zT!b7zT#U7zTztF$@e3V;C4d#4s>$#xgJ@#4<3{uZ(42*c!{g
za4?pE;bANTgH{{^Lu?!a!^}7ah9hwd4Bz7z7<%Fv7*@tJFzkwFU{Fh7U}#BTV3?J_
z!0<YOfq^xVfk7gXfk8fzfx$14fuS~$fnjPQ1H=4828K<E3=De`85k}mGB8*sF);Ke
zGcc@9W?(p<%)sy}nStSbGDAIsTM7e1WC{brrxXSTn^Xpdv{VKLl{5whlQaef|1<`M
z)oBb2XVMuM3^N!QTr(ILLNXW_=4CK2Y|mg|xR$}dAehO(uq%s!p*x#_;a4^T16K|M
zLsbp~15Yjk!<1YGhOfB{3}^Bf7@p)YFjV9-FwDqjVAzt+z;G^~f#F_$Jp)5R0Rux}
z0Rw|#Ap^ssA_j)fMGOoNiy0UqN*EZ{moP9~C}Ch=DP>?#D`jBtC}m*SRm#9{tCWG^
zaVZ1C-%<t!wlW3=w=xEX<T3_^?_~@O3grw8HsuTqYs(oJ_LVa*bXPJktf^#R_*cci
zAX&}8;9t$aaI~6%;XyS6gJ*pW14B*?1H;rB28IJQ3=E4K7#NN=Ffgz*GB8LqGB6l7
zGBDUSGB5--GBBhxGBD&eGBDIPGB8YPWMG)v$iT3%k%8erBLl<bMh1q5jSLJQ8yOh5
zn;00Rniv=in-~~En-~}}niv?qH#0Cuw=ghRw=ggyw=ghNwJ<PDZDC-jU){pMaJPkl
zA-t7=p`n$5p|6#J;dd(ogGw6%gJ&B9Lu?xZLr)t6!_qbehGT6E4A<Kj7~ZroFfg_=
zF!Z)FFl=jQU^vpwz>wO(z|h^nz%ajqf#G}y1H<PI1_q8!1_s$q1_qB#28P^D28QRI
z3=Ai`7#L)`85lIX85p8_80r}sdl(qHdl(oV_AoFA^)fKX^fEA<>1ANJ)yu$O*2lo`
zuAhNHb^-%K+yn-O(g_R<(<U%5Y@fiuaB2br1H(iH2K|W)43QHV7&cC1U~rhkz;J&O
z1B2{j28QCv3=HQdGceqp%)k&ng@K`L3IoHtDGUrOQyCc4r!p}3Pi0^@JguIA;r}!S
z2EpkJ43*Ov80O7nVAwvBf#LH^1_s_)3=C?s7#NCYF)%dEVqo|=n}I=m4g*8OTn2^-
z^B5Rf=QA+0EMQ<*x`2UU!vY3|-3u5Po-AZwn7)XCVd)|UhA)d47%G-9Fl=1H!0=%S
z0|Vbu1_raG3=Hp=GB9{8V_@i8#=yW?znp=gZ8-x2=L!Y}@f8dVek&Ll&aYr#xVwUZ
z;mZmJ2Huqn42mlm80N2JU|747f#L8<1_s|%3=Dr)F)%z?&A{+`H3Ngd8U_Y~H4F@%
zYZw?})-W)ntzlrOSi`_@Z4Cp1$yx>mr?m_W{%aW+V%9P+WUpmls9npzFl{XZ!}7HZ
z4E592F)-X+$G~8-o`FGgBLhRnMh1p=8yOfpH!(0oZDL@Ux`}~d^(F>}OPd%Nm^U*p
zcx`52DA~-wP_vnVp=UD#!_3VL41!x27#3_{V0f~Hf#Jgz1_qO@3=F%rGB8}(%E0h$
zD+7bxHU@^OZ43;zwlOgL+s42kzMX-=XgdSL%<T;I4BNIdFc|D&V3@s&fnn7y28PqS
z7#K`;GcaWDW?-n?&A>2!Hv@y@9tH-}Jq!#9dl?v7_cAbq>|<a^-N(Stw~vA0*ggh^
z>-!iO6!$YQwCrbK__m*cLHqy%gUbO1hNTA>81@`sVBkH-z>ss0f#JtN1_tg!3=A5F
z7#J82GcYI|u4iB{J<Pxmf0%)x>o5buvcn7vCk`_(+&#>|z;Kj-VZ$*72D!5g3@qmu
z7*x(NFjSvoVCX%^z;O2*0|WPY1_sTG3=Afh7#RF7F));0VqjQ!iGktzB?gA$ml+t|
zUuIz7zrw%}euaTy-W3Lh6;~J-zF%QrkiE*lV0V>)f%h5%gLM5h1_qUD3=HqDF);kS
z#=y{Voq^%;bq0o?*BKZ@Z!j<z++bjEzrnx|aD#!N`33{SoEr=bM{Y1MB;90SSa6ep
z;pj~U2FF_r4B@vJ81im0Fx1^*V3>G|fnmul28P487#NCfGccUL&A{;R4g<r)y9^AP
z_ZS%B?=dix-eX|sxW~XyzwjOd!^V3I3_kZ67-H@-Fy!86V5qszz@Ynpfx+zo1H;4z
z3=G>IFfhnJWMJ@p$iVRSAp?WtBL;@jM+^+d9x*V?c+9}C<}m}qjmHcO#ZMR*E<Isj
zc=UvU;olPm2Gyqw3}#Om7<`{HFjPHdU}%2Iz%czO1H+=H3=C(UGBCV)%23bn_bCH|
z#4`p4-)9UAoX;5;_Pt<Wc=?inVdE<XhEJ~;7!JN>U^xGpfkEjF14Hr~28K0n7#P^!
zGB7NC%fP_-j)5WR9RmaVdj^KU_Y4d#-!m|Xeqdmj_JM(6#|H+6{ErL_9UmDOet%?O
zkp0BKaPkua!|P8B3>!W(Fo=I)V0iSUo`HewD+7b=R|W=wZww5<-xwHDzA-SUeP>{>
z_|CxK@|}U9`8xx{`R@!2556-n=>1?|IP-&nf#W9wL;X(%2JT-B3=+Q>7!-doFvR_0
zV3_iYfnoVC1_qYj3=Cqw85q2NGcd&dW?*Rh&A>48Hv_|l-wX_ge={(=`OU!a|2G3e
zY5gAthBbc}7!LnoU=aGtz~Jzgf#J|!28J(x85kt~F)&2^V_;bGkAY#^KL!TP{|pSf
z|1&V0{m;Pg;y(j}5d$NGF$*I@A`2tKO%_H5T~<a0TUJJf2v$ah)vSyR_H2v{&g_f~
z=^~5_bs~%mJ4F~70!0}aCW$gKY!qc=I3dc&P_HG%$PgvQ$WSWA$Z%eak>Rx%BLjyx
zBZI0qBZG}NBZH4PBSW}2BSVfjBSWV+Bf}DLMuvmpj12e085w?yGcu@1Ff!OnFfxQm
zGBR{XGBWIwWMnuY$;fa?l99nrijm>E6eGhwDMkh@X-0+uX-0-tX-0+#(u@p?r5PEv
zNHf+m<jF8H%#>kdI4r}+a8rhn;fo9-1G6k6gOw~J!wgwQhC8y13<h$H3`^t~8QA3+
z84k)bGTfGDWOyad$iSw+$k3+1$e^Lj$nZd!k)cb4kzuY1Bg1hOMuwXzj0`raj10l5
zj12v%j10?F85#blGBU`iF*0bXF)~=FF)~D`)iW~0sxdOut1&XnR%2vXrN+pxLyeK)
zvl=4<lR6`VoH`>zlsY3rwK^liTy;i<pX!VZ!WxVW#u|(a6Ezqaj%YA4{Lx@!;Lv1b
zFwtaW2-jp}NY!LyXw_t7=+k6mSfR<t@L7|Q;g2RGgP0a0gQgZEgR>SRLy#6DLx&b4
z!)awLMg|sbMuv;pj0}dlj0{e?j0|jgj0|s&GBPl9FfqLCV`A8zV8M8RqrUS{H$!(2
zOD9w7ffDA<0G7kuT%7?dogA$vOPD(ySvr{xcV6rcV6hJ1C}!>8`tQJUI6N%4^Kh>X
zSFabN<<AmfNB(Vv|2jXlTq@yk=={_X@c;G8V+;(PH=^U>4|g7XVdKEa(CfnZ-||Ee
zPlJU*J-f#-2S$e1A39HT3A9`)spn|;rBKi8@cPr?(D1O};7$>h&eQzcKkQ;-U|{I{
z@WRoNkzs{EDU0Fl*B&jmONDlUCIdP@yhwLsWav0-`1Z91|F+9cuiv)ZF1f?M?RV#|
z&JQoV9T^#{SX4^Hd&3z!KfJI3D|K!B%fQIMP<rk4mW~@y(Q)yyhe7_(?7X&uz0{C@
z`+;423=9k}1RNO|S`JhwG#}>R-*(*cL#ZVH_QQskUhHz1ZsWwLo_G-yUabd81S~wb
zN?E%(I=K#mL|(r+9NaC{9nH}x(G@Mw5y8?G$<+LqzaxURD@w8>f~_k^q9cGktviq<
ztuuh5E0DSQ5pzcXS2Q><k9S_~Jl7o{(Cfs>96tSw6Qd0G$5O5?59a2F%$7H&e|BPY
z6a=}o^IETizzgU9|NrxEcbx9w%xGMHxZ8oF+e4!HkU+P~M3&|UzdKzfLSv}&TJwQ`
z7cc((|IfdzI=u52|90nygAW7_KIh^5!N09K3`~X|e9po7qtlt?xHAU>1A{}iU3Wc8
z>;Dq<?s}GndUmE#iS9BEw}a2b`M1@x9eggp`LFRDNZo7Z?(!X-#cmv3p3DsonM=iX
zGB_|WH2h*JVFj@`I8Sssv%KbM_{m(#-ssK2D8s-2P7jB6@G~$l@Nb{A07NZ5RK)60
z`onN~j0>X#?~y<M|92iVywuGy)n(!IMi)joUds<9N}Y#W50uC>pZGt0jSHiEJt!c$
z1q=_gUMdmoE)rla;^_9`(fnw6qL``kM7PlE=Z(K(7V<Haa5VmoSjfjv%GvzFK=RV}
zONtkw;|>RRi#jaiW9aQ+0!^<qK4kdu|No0wc8m;`CyJ!IWxx3HGwfhk!OH+Kt@(gJ
zr!z<Ah1X1m2ci#$1$XnhgmLpT^hW;AJ}J_8FkyO?E2CMxLl{3pbR0M$k9A&rVQ0h0
z(0ROD)@C6eL+i;Bv2MxNLcPH(oj*H2ywJB{WN1B5!qzR_db{)$B#WdqR){b#ms$pQ
z9_HW9u!{wh2yJZ{8NOdw!CWG0c;K}x|90kGb|B#tTSkTz93`*2qj_3ym%iA+$iTo5
zJzdw0(WU-U>wyw!{(T(1krx_%bCz>uU*hTw;kw}P`gOxk#^xLUJH;Wv-_6j?(e266
z9R$kXO#dJDIx!v&?mXE1gQ?VXp~50QhTaIqPFWD6^+2h`LJePjhUOo_<$7RY5U-Qx
zsDm#*L#N157hisc*P_io7)x&~te1gl1u<S9i3S<kJ;8w=G)%zQ*$86rZ)56>V(Od;
zVjq0K!M`ntk@G?{IM+A7;pk*h=?qa}F}&1kbCrRCfuY-Es=|Ce2EzmV+vc!4%;#h1
z=4k~9@UK62@F#b-jtc*_99ahb^=G?tR9HIeedaPaH2>fzz2wyVi=%W;^AQek4qu?+
z%g<oLSi)|@R3dJ8;IQF=2HVD&d<+aFV$HT9i})BAUb90*_@^G=-*(_|=fQ<H7Vt4N
zzhG(p@ux&E&C)}llr7CNK&XVh+kxfvbHf9mEO+n`3v+-$H&gQiMo`3en?`W-dNJ~E
zD^~72VfnF$pMP7m3gdUnpT(@bPE48~__q}+LWHB07(ZLygbGjZ^<Ye|KiDnGvxtwO
z^->9cx066~l?X#ATXzsor{Lj*0wD1NC7k@*1H?K7yB#DB2X|gJywvT%)6H<;1vCG)
z1Fa`Z*ccCWo_PJb*M;eSuZzV0<_FCD+Zrn7@iBlR0ZDc1$r4WfZ3m#LL!|!ONR;z2
zUZ_WCc+J)Ph?##|6I3(*c8Q$~4GavsK!Ze`H(rETGBWIP0u{?QqF=gOGBWUQXIQM`
z#n154)`pQ`A;%&<23rOOhK6#U<E$GNfJ#$_hS!21p#$ZDaG?W+2NrKxz{hZ$b-@BY
zh8<bc-+3}-*JphH|G)E8=ZzNyAjZvJw+GEX9+X~)j)SF--VBM}2%gRxFS7ps|KEA6
z^J3?V7xDl9|F=9Qd9jG8{dMP!7il0FNHXfY@xlqjJJxx92Lr=_e}<Q|SyZG$R9L>>
zYrf9#{l4Nc#p|8Moz*OzFJ9>X|Np<f^I+%Y&KEEE{{R24c~0{F_Z!WZ7{1>ED=TH_
ztYxt_1^KA+hcqk5?fjDt?gkrs!1A-?5B^C9I8X3zJMjGmEZH?wm@|~>gX*)+Yn{it
zwG3}t-mR1FcDcvWe1N6%*9%W`P&rV_*6VVQ<u#Y{>xa{~`!I$j8s6@d;@`&5arnS%
zwuawKB}xsynM-*8oi24SJg}RIfq~(*GXJ(h=7Y~fI*oQSgZS)*-@p?5+Z>q=KH%Z}
z(8=V?zpaq*;4>D^W1U7_jLi@DIX}E+-3=-#I+><t`7$aA-?V0A0F9?J>=FP+=8F=m
z>GORVMVU5QPv7RtsNmBNR{$!FI&ZwtvSMWDJeI|f#R%4CcnK5_)-Y3`idd}}8Jdp>
zycX_t(10p?@zHX+k{_ds)_*HThVU@3=q?3_rJ!kqESQPAR3L)at)@@#W7KtCfux=X
zA~n^DkpZC|R9SW2c+p_R$nd{JMFxZ+rbAVyTTSz46le0Ynl9<jXlUFmD&xz~(0Yl#
zMT(Ju0TeNfZ&;Wa7<%`plru6g?CfP^U@$!Jc@>nu&z+BddZRz1biEf#x2b|JKLg{n
zZl)K!4vY+)EGmYV3=dedsFd*WZ>wbL{M}n)$!z(rn8)&CNnG=Z|1Uuk%q_P|d>bm6
z8A{yKx;fik8s5%+&68%`>)^@HP^!}_(+UcM#@{`R3=HLGdZSp<I(z0cGcqvnZ|imT
z<YxeJTNxP`oL)<CI5+?1C_VIgxkKmA*WH~{RQeei7>>0}nSRfoQChnP?D}3874}|{
zsj>_V3_-g@Koy0j6(d7b;}MV#!Nnk`@~jJBY-YXM>7&9joi&hAy*_zA7Xt%B>!o_W
z&V!vdUf6@O%b{*(7O!3&vrZnB&SM=HFaPWO*!+;O+eC%)oMp*ghI(fA*XNr5^Ve}6
zcjo#3|NsBjdfh&I|1g*AbzwZId5(YE9@7?3Wc@t&pQZC$^E3W#9~G8P%hqqDT%Exj
zoz5(V|6hAqUaJGy$b93)+39Nn83XDy7#SEk4|j&BsC4qEbWc&SVPs%v-lO8c$iTo@
zD%Z`xzn+ot!oeThhL^fyR8%@yCOb9%awz@$@-h=B&U$lHH2Alf9DT3=R7Gs=wo&0<
z&$GSPMzFI+g@u2c$kB&jiOCR&>770*93at05K;d1JoO+k9+22$xEM%CfPWj$(I+4w
zk#7F=BK@5qDk31ErywDdZvOQq{hcK$5+I>x2qFG$Hb<X>xIDYNML<s3)m@{)(jB5A
z!g#&2Mnwk1(*&_tx@%N;7{7Oi)T{7le#*QQz|FvL@E5n{ukI2R8ODE|B`Q21mL`ZL
z0@8)1U!l83MWVYzML_dA$fup(yGv9g82@$GsBrX(@N1s${Ml<GhGcMOhzdt{hzd)u
z30LMfc{T=yga5cQFRkQYs0Ufg_$l+`a}frHgFm@7KWhF2rIPLv6%NgFnxDWLeN=cD
ze|GvZbo;2tFoPo1SD`yZMWL6+sMFU0<hyPk6%NLWoxTa37qxv<I68Y9Ky`SCih|~+
z&Z(fbUU!I!jCP0$OXt)B5E&lLU!7AQFn|^=9c6Jaywv=IgTK}6-~a!;Au1Z6nC|B4
zE@J6+;^@xe>9sM`{Mc)vq4^^7063t2aBF_()iLkXQGs~B*M_mPMukK3V5g4?Pq&wV
zwwFwIl>l><Ot+H=vy()3k%)GYM6V9J<`1|5y*7rK|K-_0{{PRNd2%HO*!PS-GrxfY
z;vcu>zs~QP?=^pD9_%(zVSIP+A9trQC{P&xftbZC-6bkKjK{!ij_wi_7RGa6HYnOy
zG$Cw(ZXXpM&4UMja(8-*bi1f<X#P0(gS*pNqMJoU^97hGBj0>Tq4}^vZ;J{jBUoPG
zZ)N@e|9>N>3kYg5$4-wAWi)0wZ!~>MD5GQj17k*ph$v9aei&5AlqhF0WI+q_0#MFB
z0G5Xog`oM>&Ks|N8Y;{fN)*8gLDc}Hh?s87$PgLP>nySpBxZQ&wJJh^5Ca24uY<;m
zVu)cN1-pbnV$OCN(J#4-7#V^)4|iTPJdoBM;%L_PDXmk)*`fJ|Na_1y&KeAzH(mt1
z{r|u72FR7C8!ULr4fwZl{8#B!m^{5dj4?`X15<A><GVLDOr^TL!Ax(OAK2S4?Etm;
zO67Zl8K-lEGb(^u`PVwn^KZY=dE<qY9wP(i5B}{ZIzNG%%r66VLA6P6=e2Hu#!o@P
zE(+ZqER7!nLV^@HPnEhf{}V2=?>r3g<~uu3cWwu$uqxGUsOD!ZlkTn-vHVx0(D|$L
z#*6a^=@RzWJo`bVXXlUC%xujk{zu2fPyZ3lXz3H&d9hod^-_sV^RNFU9Q@lO1uSos
zYIO&&!1zLzw@Rh>w+D(C2XH6{@Rag(M+mguE)nWH(Rnla|HI}3BCq!~SMV^D9*&-F
z5W%Rfz1x6+f#KhYQr6uTpl;B1w$58GK4>#Cw7xA7><wn&-_F+g6I5`&ysbUGDT1-H
zzMHG{WQki?aF;}HA!Daehh$d-W5e(G63%WexBwHHfCqEKPml^GP}^OqgQJ`27^o9=
z7}lcdJlJ`)(?x{^+&1WS{@)cM`@i8=RJmruF9-hi^Pra8FTE1?hF|(6_4zHA_*>6{
z%Jv(eLgW||1E`PB(C{mczhyF5Wjue&TreYszjX;Hhr6h-^ae13+Vsa5Vw_*k?{$%7
z=nYX}d13hf|Nm}eS-oBtSr)LA*#H0kd!0F6=kjl>k!9%o+2NzY?A%+zn#g4M*7ALw
za_id?K9K#rUW}k3>KKzANL%NJ7x(`C|L@v-jOF!B{%s{H%)Km|Uu&V*5%;nRWHzV(
zdhucdsFZPLe$9T|Q3aH^n~!izzY)pkQqKt*9XWL16?5|gc85+Dm4;uO{4Jm{+j9Pf
zUo0iE4Zk=_qF>%*1od?J`CBi5TMeBoDld;QGB9+rsPu{)1*K!d1DyvC{$%FgR>IBL
zd9e8*JOAQyMeGii7iyjx9_X%7(dcCFJa+J(d}ldJrz^w3AM%~9EH6D785|gTotbul
z8hS4-eEk0(sxq9V*O>((y6YpThunFs)0Lq!l%<=!JDkPx8h@)NBLjowLH<_9>1U%D
zCF)<QGlFJip(d3eo5a7(o5k>U^TGekm;W;!6ujK&%g`Ci^70!v6$Uf*Rxx+ls5C#Q
zZ+^jM!@}Qw4<x?rz<-t2kjZ=uAZLKudM^|~&N$Y2z1u}aqtl=>fTh=&1JZG2|M>sE
z65}z!>&?ghH(&qX32r+Z9(W0wROxl*f+%|YVR~mYqg?&r5C8vnm#AoTvUP^BfMh{F
zf9=@o%nDJr7$gq~t#D94b%wI+0JnN|d!6}qfm(ns8bC@AMu<T~vp)R)4+$dvZO+V=
zE-C^ga-cH2M1`gGTL~YiHnpr#spsMEKlJzi|K=0_K^^?&BO;(I2hSask1;SDV`6}{
z97|F=5B55-FpGj(gPkHO{M#y+dP^*rJ4;kpEKO93+|s%Q+CFt&GrW}jiYLu_E4Zo0
z$-ix@lP5pJYYuR?^r_*u&QBbIhL<dV6|r^KyQr|d-q}ziz|2s>*7<>h`Sn|;*Uw;G
z2uK^X1k^S<-Wj4|(A^H|H-mE2bP%J#;y-`uWKcW@Fm-}O__qZxT85|?@VC5T0;SK}
zCC=qa4ZjZYx7-5rkMOtdU}9kC{P802_5c5!E-LjrFSWoa`7VF!e29z%Nan{2LlD*O
z!_UC*y0i1g3ndWuVDnEV{=RZh-UVCN>%`azc2bwrx5GUAtsLOy>*0pSANX7Ufa;1O
zrh^aI7=JV$a_Za;a&cGO|Be|y_!$`794xPuzHWY5@A!I6=Y`fwl}v^Q7+F*_LsWPi
zn|})MxBg;aV90b)VQCR$VCY@L{zCxN&NIB-Ij6OSk%7U%mVt$Vq4d4sB~Xj3*F~kI
z(?vzW@RH%lP9GJ4ZWk4SPM4`J-7Zs1I$cy`3=e>cxE-7f3=EnVI$gj`CK<~T6&C)U
z`s1MT>_h7}kOR7XR74mLGP<Y;FuJHHboxwXaO!2@>~v8PY5pZpy6U*A0|NsSLvxJ^
z4-<c1@xTB7yHP`df16b2t<IYVf3h_HmM`M~^#d{(85q7D<}3Zoc(VBsf3JxkD5)4;
za)1OI|F(LM|D8TlOq@U#yl&1>;Sn_a)@h<*c(OaB$HeeJw~0z`j7dpnj0%V4A^yHA
zAUnYU*_+4MxgH#%a-il&hYXv;>$}}9Dhi-RNEeGihl>gaC>R)Dbj7G}bj&dTwaJ@*
zan^DEcTr(^`4?o6i;4&{DE)Q$s7PFX(CMP00cxEzKj80VQP~G75-&gF-{zviaqt04
zr;CbC^E<|(!`&__I;sr(3=EwvDk|M9DvTGJe{k0O>;#1^s6BH~^J3@c%fG+5sBrL?
zNcDRB-vKu0f#u;^p5_z(yLePCKj@8NW(1X!J_3w8>OuVv%@YS73vkD%sBqrkX?V@o
z&7yMffdIFQiV8O<u6$H9I6ro_^n&93Wd*2*^5ezK7yth^|6t<p`|#)ge~<s*H2C_R
z;eo~@pv(f!!u;DV*)WxGfyW31`S%_=-298B7E-A6I{i5e8tYvMYIwdls{(2rRPr5o
z!P5MIoqt=yl{tJ2hnr9QKO7#`dCl@r5nJc+&r4qOf`(2!yF~apL^xi51`TT;TIdqS
z&(Q1fzmpftaAM3pAfkCO`=m(kgoH4D23DUieukIZ|Ns9F8m{cTwi8s(8(w<BXvWBJ
z%)y-Tm;)zMK&Qbm2X&^#W1wN_&H}j?-CzFy2kjmJkDb3X|MLHT>!lKd)&nIv!JU^o
zFB)EYaoCiRVR6SyK88-&mYIAEizm$FV=z3hcnXN!GjqCgBBL|Y+K1CS5*bZmf9o=W
zVoKn+iwdY!!_s--#S4g#M5l>LZ-@$87DKO#3QK_Dffv2{j0{nctp`elEKO8OdApt2
znvcjt$GzOH%gE4t;y;*kIJo(ZK<D9J9~H(d{^^oQjHV*9Oc)tDA7-iS0%iUk;Htr7
zdP)+b4&$2X6O$M<>p|ljorfc$UNbkJ{@;0{`G`a`$QTQ7KOR)t@0!T~%G@s$%o!P?
zqgoH}w;C}rfV%k{JHgUi3=9r0n9U)sEAj7jQIUF~`~Uy{)&r$J4K*st45ijxE-Fe~
zE-EUe)>#Z$3J7h62VT^lG6RnpAQ@(O;Kf!m@Hj>5fl{vHte`PKP%_Pu>-ABQ+a=1#
zz_5cA)R0#G_y2!1$U%!37#OmodVN$_b}7JRS^xe29|@8L<*m*~y`Wx)6W<E~9Y%&u
zC%)!GES9HA-}TmqsDLzTbvyCB_@)h)x>)+IH$;W6*F{Bxe;e-tPkx5%lLr4Mp77*n
z$YRQ3Fg&>{01_%ZW{eD=;A_2IssL)88=l<7&A{NW15^pVcy9^~72f6_wj~@d94#0b
zprLF5omP-}(Id~u&|ARR4H=ETT_OS+iT>F6<3)q~^!G`OZuOmyc7iI>{}Vbug8>IB
z&ULe>fLd6Qai9s3V9@M>gGg^ofPmqF&Rc2kcYtPPUSxpAL2jkJUBOr)*m)2f@oDe*
zw;gSM!1$UO)N(%DXv>qt&j7+D>@R-1GBUh=dpNlBaI-Z-3HyuJApV!*%!~{S)3+rv
z@-ba<oqjBtF|MB5gOTC2^ezEb28OivohM#Yc`!0`PX-6^hZiT@85z2pK^%x3afh32
zS(5k}7)qo%AK3o?&(BcK2p3|1p$4+#1IW@BSHKe{%#cnIIF-Kr@c;jDXBkk$M;{J;
zvC|F|&YiqBUa;GP2j<vcyl|PmA%*dPejO+Zj_uC4z|X+H{q{~ZP{ds7bx~n@@lT(T
zA?>(}ikbt{F&7ni#?D(W?A)i%Ph}Jp0IewoOEEBY-g+VFKK)24qk8=!kc)c3*-0Zh
z?(mE3|Db~Ge+l!!9~_4}52hV=P+?$t@z#uyVOKoZx=WoWUhH;bWOzBx8RV)Gi5Ktg
zfs%d+|1OtVd<>uoMTVCZ?u-neiL7ItmtQb}=6b-L2`O1dh82vZJi8=j@-gfHWwO`x
zlFbkPbRO<?_;35~KLbOVFhmZt0QZH7J0pYPf!EUf+u3%40%aFCl<vR#|NpofIFvyB
zuEU)NdmUI_2;Tnxzw^Y4Tu>(!9?PZN84LOO8D4C2V`PW`1v>vWCL8`Tfn9Ir@G<Q8
z0h*`Kf9dVc$k55t{ErEeJdbtn0L5nKj~CrwZ<Pw}+5>X!W>EH%cb_hw&Zt;_xbs5i
zsm`1H2Hm_F-uw*BKjq5=cP*L5$FM^gWN6&W+ir{u*&lg2=QViqGjz7KfXHbb-uw)X
zonRgC5oCex8Wol992JdD8<ox+70~#LPPZ(m^ltuLUnjOJ0TiSlLz|BXfNGJKjc$w#
zVW80u(3nE@2a(R3ng>Az{5ntp-`iFa#?R3C>P7JP|Nosk!RCOf(C!cwp3XLqiq2^%
zVf>&@0Vq3lwq<~nPs;(3`wFJZXEBP_vw#fmc2TkD4pFfIH8nazR3y4xR2)DJmu^##
z(+m%EvZz>^sPOlCGcqt_^Qee)H-ZfBo(M9$^LXb~=A9sug;#=2u2JFX%ux~Oj!|K;
zj8Wm~j!_Yij#1$#X8q5i@_I*ijfzNjj*0|xjS7o!j!Hd;wTlW%=QZgP6^`Qa?wJK3
zx5cO^bjPU3SjMO*luC8}?0l_xQ1Wu8kBUfVjEV%PDFt%#Yfq33pvH&hVaaQqGeIus
z+z4{Pe-;&MkRx75yQl~hEB!A~Q2;eXx<gb%G=E6G3JU1_)%mj9MTO@@)W7=w|C^8S
zWSgjnbhD^fvx2-^o7D{tyKZpUSsw3vDS5Fdj2Rqw!r;Jzig9(bsJwXj_5c6ZhdcLy
z0;F>tC_q4VAP04~kBW?SAIM{+pmv>zASi%YR9>wA`u~4(eGO>bSijpvMW)k5#i83p
zMWj0f>`9Bx5EUCxw1Gyox>;13kEnoC#0pSv0m23~5I{X3P{AJpZgz^aUMgj2Jy{|S
zj!7RCp3V>zfzA(|zvALwa{v4PKQ12Jwdgz?uoE=wzDozx{8<Q^qI_|1x?>KbNIhuU
z^2PG6|Nlp|9w-&w<pWBPL7>cV-<grY@a=1h&Z9fIL2cIKo%cR3?H29?4N5R~I<a&I
zvw)`TnR-1$x`RbJ14LRcl`waDv2+JZbOuOta&^7{Isb52aPu3T)=MS2$6Zu3KqDf(
zB`P9e-3%{`zyAN<dAL5J6*Ok?;Dslog5~V|@Ivg?|Nn-!K{dAyG$VB$>%87z%isqp
zc&m0Y2rw}00uejF9+?elqJgGs6M7p!qMgj05B72-@q^}t1Q^QLRT)4%v!lJCpf2r;
z<=6iI@BGpEvGY~N#~xmW`p{0LZsq?MJ8yJHvvjM1w7rP@{r`V=@}JnljekM>Qelus
zUP^$<>mQvTL7e{&LF8d@n06ilJL9G3|NsAkI}g8j4)KT(MDo@SPyk22{0^$w;Tkd)
z@-e)8^6&ruoob+H={&R}0VHzyAE>9jBL&1h4w8jRrYxNPJ(p3IsatcpSRSKp{qn2-
z|93ukaqBOrU@n#Dbx{#{(RB6y|JS_TOqLNGMMuDk19mkZ(Sa0thr26eIx8d=S}fvY
zc<}~Qxi||LezW{nV!uNM6xATdwH_!H+|>dqIG-^xFuYji$jI<ob|*;M@Y0Ld8jK8`
z5}gGcoriW<d#Ug-ywLvl|G(Soz0K7Upvv`@4I{(r&!EX(P!F>6`iuWxr$5MJ6cg_Q
z`RFh>WvPHtmLteIYscxl`HYhF0zd!%fBm@ie+g5k{xKG9a0@g(7Mx(AbF<ev&v)mj
z$n1~+X><4o_O95j98iHR%*4O|?Y6$W?!d^<&7;!E0diplOY7TG*1a$J`58Jhc)EEN
z7V<GP+o&+}&vQ{>-v#2eo-E~WJ|GYY({6s{|Nm|-%fcV^uWD4gWmGI9Kh!@cm2Rj}
zVP_~2>CXJp70X~DUv##VqdQi_GG3(UaObIR&euDGJ1=*OYJg|lE0{V@1$Q0<^>rCu
z*i8SB&nQ!04T&C+U4K9|$0tSxhDcDVc_{*F$Q<4|1zfAYh*W1}=yhP(2_Cu@QF*cT
z^8f#xpoOdqox6KL`EE047~^;|sHrr)m6u^5Xo|m+xf9&DiU1i14KRVu<Dg|Mpt8Y5
zMWxeadUpXMw`qxrPIr!q!43^j2tEO=bpXYN$gTq*H}NntFuZ86XJmNU%)r2~6QsuQ
z(u+fC(@z&L%GMVPbY_cyY6{TMv5SgHr?X7<0iNCvc8+crc8=BqB}Uy$-4!1?ZB)8F
zzF2<mJTLjaNZ#^gsVJy9FVOAr20Y|Z@j}{1g`<cKoFq^6IxD=Gb_q023$5@DH{0qY
z@-r}$s_kIlU|@LR^#>fu!n=NWgVG{s9{0rwJ8*~K@M4fk!vmnX@6O|$*LHvw<-E{_
z`AKls9Z(88!^FVwVwxQz!)x80AO(h(UffolzPXUmFrd3cMTCF*&z+#=BzQJ)x+)_B
z|N2^vZdaDx77Iw((d+g<t<#x>fBUtAk66H2@x|%i|NnP7v$Y;571`A@g^yu}8z?Z@
z?WUU*F)Gw!n5s^|R5pmI(MYD&fJ_Cs_QiBtuwP&Eb-SoYbUJex9_V!DGduu}=kT!L
z#y4|7!yGj#Ec@Q@^E2#ZW~gUi_`I~YMnz`d50C(;4fS~`qJ<9{s_b=9k%6}KLF4w|
zK8_1`6!FDWbw-AGa2Mz@sK>#S#RzGNIfKf83Ux+?=r~Y^1GHHR)V5@4U_9=k0t!E|
z<1Q*(3=E7_^~YUQK(p?w;6V?e<1Q*<3=9k$$5~WBDH___>-A9qb^dq^54@Nm2kAkS
zrggih$h|l%18N1^g4C9Wbi1f1z1S%OYIl~pH~;1@b83Fg-~5}c%&POo3z=X4|1Snl
zs2(Vh?k!Q#?mXUk^YaqJPFc|4*bDJHpoCK*`I>*13#fcB1f>HX8%Bl~pq+iqC;m4c
z0R>%jT>SKdplI9j6QsVBXV;V&d<;9*fabM>I}byu6;Mie(f;%Q|4wEkfijSQGYgVP
z3P|Kor!z-4bL)W;uI6eMh7y+6OQn(!L$@<9Ff<+!U;+(*$H%^0YR$+1uDc8`y?7(7
z#K_R?%mU`WxDV!VKsc9_rdJm;=G7nWy#7Ml8XOi;oyR(EJWJ`kaqtI^M=Adc5s0vJ
z7yGk>*A9)3LE|Hhzd=3vQls4h>I@7|QdTgQ%Iz=$rPDM6Mh5TFx4X80@)M{l@#3fz
zBg1R9CkY+wubG?A{qOt$D!7ApgDM-4#u8<a#(IVqx(194PZGRKU+<a%((4W~tqU~Y
z4jH?It)kKCJiG&>_r-6}DvF~>;d2ipz@h@FWbT4E#~|#BAolUrxBOEMG~1{!@J~6!
zd7<?i|CB=<7fM-L|CfsF@(2J~xesI|hZQ5kOG(g#Imi~nOPw!XcqlS59CrnInBll9
zM`rzl|KOUc^T!K4MMj3se3s+vpdLkMJP$<t!wWIR>0YIb0j4IP<u@hlFHV_&mILkt
ztpG3tb*(sFtWscP=!{VT4PB^!vdD246^<nf`50crexH86l+mC*){>C{9MOE;0-eIm
zFL++O`tbk%>o?6cDl818M%}?8h6mE#cfNRW88kl3qVnQ2sNM15#Sswo<HcSObpuo<
z$Hm9KT>k;o5Y++aYfzmT2x?Y$M{smIi}V(W9Cz8k0`lyR6i@(c292Pwn5uL;i*&ne
zU|Athq6=z?e$fRbjuNR|H)iuO?C=Jutg>Ka=zP`r<HhH*|Np-hc(L1f`sOl5qonPi
zw$?F7EP>g_TMv}5w0<iU+4Tja`6Ea(qXi?w%b%cd1_i9)CD1xZc}50EJLbm=Q+Y;)
z<LsaXcZLT#ZQ2}~e<+lG2RX^Xq?1Kux=%TyssO{g|NnP@nwT$6fCeRwPH!w{6qSDQ
z;=K;osjqjv0NDnb+jvoG&dBi6ZTiM?MoHan9+k$2|LqwVdK>lr|NozTfNd{3xOV*h
z_22`6ZV{F5ml_{|=6N_zabB4IshrWM9u|)dMxb~EIU~cP+gaqeLjVH<C})Wrckp3g
z`2WB2#laU6j0avwy#4<lIktbvLSnn|>3>iqo1>xvitj0)_+I_x|9|i#0}D9BGg!VK
z1<jn52zNV+biQhSbiOlyMYY>m<i$TTuuZ)I3f-V}ta6qS0wp5d9z2~~pb4lKrthX7
ztzcB-$zU;j+o=so=cPK+KU6SE@xKAhRQ`Y^g?rPbDj5|8<YgHdc7g`YdO<xELD}iv
zm5l0cFF@tvhYlANwr+Qwv~Gj6?g*yl!%Q2vI&Zz}eAM~l#bk3vhUSx?u_-zJ?Z;ju
znlmzV9&9~ODzJ-ziGcxZmWRdk?Ujrg^#-8k-%KrVREX?)1F9`OKrH}yQ%Id7_ySZ`
zyauf*dd<266fW=;hL?AI0o4esTHs}dZX7#7EwavAFaAn1GISnVDR_W^p~R@$jidR|
zyP(cnFD`?Gf4tDuVq}PHJy0UJ>&^^52In0<ATu_Bavu8&(AMVH+q&I2vLL?hy!B$9
zG$TW|8wVu8-FmS|nvo%@^*{+<cNs@O=dI2UFKVTyFRWsethagd|9`i$$qN%OZSg|q
z4X8yC{Zi%4|No%O)Oon`dgnP%-|B^<CL=@V(QanNAC@0V)H+|hXxD`LKLS+l>w#Rv
zYXb2<=Zg@1Muyjypw%tNB+%&NvCiwAXCb8;xW7?T{}Ehu2<{32RomdyY;VlS@H(vX
za27-7LGU8tUN@c>ED#TrLKU6`Wim04Lbc8emd>C2+kSRdXn+(p@-Z@WKIjeOd0}D4
z$dLBkMTPGlV+m*HjTgbMVO=5c@Bp}}*ExMhHKUAq5U5RlwA+~l)VTlA{D9H&Ly6{#
zT0KUF=I2bMQXsEtfW3NWR|d$PHcSi*FL;fobJs8`)q^LiSX6eoFfcIe09C#(B0$B{
zaU=nEkiaoevgMz0p!GkjaQ;>*xN8n57lSrVznBQhes0~)65R~V56(89U;_32n0A0B
zQ^0MD&ZA&CP#^xAiwX-<i4LfIR96N&ObTKUxbTTIVr2Nw3(D0m(?M}EOLzMD8b&du
z63OY$YZ!f))Fh{y)-t*<nJk)KUCXGcclbGSe&%_xR05ozMY^38KobkcT~v5lKx=M6
zc`5Y$^h>pjI>N6EQ48>Z7tf{()-lS}TRi{&A5^05e*x+nzSsexKD^inqHZ)FF#r|P
zFBgMm03dA8ddS6h68ITF^FOxv;tULB98L}wUu<N2{jud_Dd#cPYYCufEZ&Zb9ikv6
zSaI5M)*B#UhTzK&cD`U{U@*M&{bN9essMi^!;7W*py6Sj=)-BvwjfmwrE1`%xd#F=
z%mnxuUbKS7{W@hqQpZ_AR{!B;058b^E#F;i;Kk4IB9R@mHd55ai=UzMLh~V(PEnPx
z=>qkP67|~P`8@vZ2D?DzSm%cqLad-h*Uo?c|Nn;xIk7M@z}TNz7#TY6Hb4E>8}PsR
z*I)kjI}8jAmM{2Qu7KK}tqcqf47UIO+cWaFfzp2G&E}JgFs;9tK^0J1qgCiC{??_S
ziQMf`^%9*o7%w+k2RM5M@wZN7U|?9mTp|ma&D`$H7QnyVnI#}2SdgFLML#I*9^vU0
zQE9zhlGE)jkY?%3QYw(v?JksN>C9Hj)=(|NP$Jk+Ey_^g%fH=O;NSyJ#zU_s@o%eQ
z>J(8q_?)xz$BU3-pkam91KlDjrGmRQ%;aOJ-|-rh^B(IlGQ4K*{P`m4$^ZYIFJUhB
zW@cn~Er8%#Gcz)P1|J}c^+9DoVCV6GjC~*nzSm`BSg5gxkD(JZ+a+tUkdGlQ*6^F9
ziAtSl=iP4M&L1!C90QjP9L<LX++II3eB1dVsveYnAUXF~K*oKLLCbX+8M<v%7V$B3
z>zXX&V~B_{ylr{EPN+L%E@=C~jAQ@*JGUMvc>|ro02{E72ed-?$G=kk9e+S(tp5N1
z|6-8X_X`JK$b&mY$2zaS5Pt$%sL$5<>xDiuXgIcnCvg`Gs6o6I)Wo&xJiLOXM6Nd+
zwA|wbA2T=~@@Fs#@iV*-)@5XfFg)<urup%Q-e!0#mkUDl?*av)iY_C=>)W6aTTl}T
zGGcr2%Jk+&Mzwn03@eZ^YjhYHB3{R49ss3r&>jp>I&XOVuT<RdcJmL$GHwt4y(hrS
zKQ2E$_?Y9h2xz6qjf*c1KHxa`nmMiU@c{<T!)eFebU@oVnolsMb-L;Fy6HgHBJ6Zz
zWN;{D1<jswHlJoq>x|O@mDV8N*Yj`x0B*GSGBGlw*_uh0DuVTNet2OG5^4UyQzD$^
zQNo|G7vxMf9Y%&o!`rX@4R7;rJG~1upV;}~#r6aL|92d2IZ$HAzwJkFI5TJ?2NNS`
z)y%ElaHh@=FZ7rg8EoXsCHc1<2*~&bGH5U8kdUa?Tk12kh4~p?FYmYkYEFX^PV*a)
z&cmG|DghZcrtvXkgbMRByqEx*k-2~HIS2pt|Nfn~I)A*_b^x@rxcLZA>$eI={_XE}
zf!a@?(wh<F4HmXi`JJGuc$Xxoo$}%ZsF`nga+ef@_m+W?0bDf}9H<8w^LjVf%w&+6
zE-D<&H7Xno{2idRBmCQIR5&1J|9GJTHJiV6Gb00NEh`7aiJ2fLzSCl4*afcNf4p#H
zWMtsqcA)tPkL8UL`QU(zT9Aq}pk}~Ln3^mGaM@M=nm0IO9!Pqf79&G!1jNBVUi=3+
z@n|=TN*9Aew~0yzTjxvuZ686?(iSI5j6mTSma!eAtz3(d0W?a>zfGg_1^>1KouFCu
zgD_)QA-230_+O&Jl5q>9!41^Bh=T;hj~DgR85kKlTvUW1!37SWA1}`TXJF_SQ2{N>
zd65m8gl19U-(~=sW)|*rQQ_(QVCAAB%-;eYY5DPD*WdsDTMm>Y@NYZN8^F@}<Hg1Q
z3=GXb{+IZ59_#gCW$5rx5$=3taj2N7<B&y&ig2+I$o&~#L9VIasR>#oXZWr21OK)Q
zAPX5Ubn~e2Z{xH)QO6&YAuYns@M5YaBLm~R$XJk?7oq=4R0J|yLE^QVjG$$XJe?mp
z7@LpqycYRiqQaAr1(Hev8{3_u!qfQ@=GR~U7#KQlfrkEH3jYIjBt)X)xZ`6FXS9QK
z7-~)zY-LntyfWRimC-R)j(?knWcEo7W*-%a>`y%1HlPU!mQEYP&KyIQ*N&|xD{TLp
zOs$#6#}FO{auEmz24rjn8P%r&id%*5V3z;I68}q7I6%0Y`9;M=kgYr~rKewQWwfck
z`<DSUgJ=Lsls{hdfX?*+m5?DSJp5}ea2$Na!N2XqF3?ip&L1x}Lezr#rky`tB>ZJy
zXs(uFEVYHs0rIc8AaL-N0RQ$AyFlxeL2X(aRP$icO5p0{*bCXe^<XoYN~1B&0Cn&>
zKfL($hXItfK#Ng9PJ$T$>JE2)cyR|L3z};MjevE2crh8m=h+21grxJsi{?L|rA-Pi
zI(LKGnJ=E+|Np-`Mn$CgwZco#jBWFDfp$h2CW(2|_1YPg>*xJpU~q2!ol<&^f18gA
z)2<6F3=AD7-ht8_^RA053=HoA0yDmXLidCkD0D$BJ8<;?DKD<^Z)Y+*2`-Rc<n8|d
zzr#gE2s)GBdE>=QK1POy8WkZ1{uWTy<=>X0BGeno%)g!O#mzqqp!8oa>|w*g-(C$~
z8UtEIl`)x*q4WOh$lhwM-cSLMO1nP{44uwKuibj9MP57hR?EG%>2gsK>TqW7W&;g=
zb@`|Wb$AP=bvpBPcuS{sI!knTtEP22D`l~UhGkTU@-w{PgE;-A2xu`+JsSgmD;LPZ
z?QC83AkF@4y`d~GJV7pU=jaXP0NHx-H+U5X5C1lIj$W2lQ2(}*MTLJmTepbHi!~t0
zqbnFoOpdv8GIooobbfe|dGG)KwAKUsEuhh;=BIx^6KLQCI2`=j4={srFZ+%>QGSNk
z8O;wqfSQ=#)j0JW%}?2y|FV=Cf!2HkfGawGkm-jE4{*AuuyBSz%f&LmWA2>Hpc1E(
zeMce49K~bqoJ<hAZ+r*U<NPfr85kI#R%MFvGX#J#2MmKe5&();^#J~D?rZ^J85>3U
z85CZ8RRKk-3Mlr4__wn`qH_68NL0Rbn!c)&QMUdsC=|D-Fftr-He-yBeXSFgp()1C
z@M0lY$N;)c;=>F7yP*2~LT9i>RAgG~ffChY&W4PgH(n^8{{O%8!;8e*@Z}rOwPY_3
zp91Ag$hxxdu;3ujz#S6<!*0;ZT>k9_{M&X*%;T$P==|CF<KPeG=7;RN7#SECE<fT3
zVPWe039d~}{$yb24d&?l@M8Z@XktDI@(zx~91e2$OJzoePE!+5^Yg=t*}oaU%L+0;
z;{`hy4qW_ac<DvNJ&;!*E!28g6P2H#`2Z+B!OK13U$T6Gbm1D`h_HaWuOd4^E3XVM
zz3Ag+1UI;Ml!9#gdIP+i475VPMFqT%%SDBy`Skz2Hx}?QSjy^z@iXxEfmWJ1cisT)
z``UiMqx05_x*h-jcOGy3&)-qc2wGMFDq&t2Jp|R9tp`dacj<r{N}wX6@d(IzP`m5p
z5oJb(ogjsVmtJslg9q!uHOH$L9-yT*pmNS-j!5f)QYFh66_yg_|12sH`)fEsNhwB!
z<uy+y*g>z~^KT1aO6#=ibmOV-2xH>k4q8w4;>G+Q3=Exa0=qzKB068Zm;mA)I`~Q;
ztusud?Lk_nn;3YPXy=O;&wns5bht@0KdASxVJz2!)QvA*TmTD$+9Z}Y>bRS0T0|I1
zSvpHvM66js0a3@g7({_v26fv(A<&&uufhYKlWP18YFzNQp7{r!KC)4<tWgo*?>`CZ
z8<>K0fh(d;P>}N|F)}nBQDA`#XF^LX&=j&n##WI08%0J2@HV#Ih(8g{zyI*J{9t5Y
zNNcPXVPPxf=ilZmnSDS5w1J>AhFwLbo0)&x5vTy;576XubA<}X*)=LM(|!6FmFh*h
zoIyU_2dY&-%a-?nmNW5hx9<D|T2A<#0n`c?Y5vPrs=X7mqY^A!`;CDC)b|4kfJ+0=
za2{x(5CeEp`*p%M7Znl4QVY=7K=T8R<{ylbpmqjFvx^D`6GV`$`3DRClmq<r+d$Lc
zAj3ZV|NkFc?g+dV1@ZrY_#kZppngCni%Rp!|6to0zA-R>8CyUM&;mh_DizQ&Kd|tF
zuM7;J4s}U*Zy2a`(F;)~(tPqiL}33{1_lVL=vzJ5gBl>s5TV6i85p`j+Z0?>6u3iF
zRJu!4c$&}uSNx#(3%YacH4kV-p0bMy&-WXKm%vlQ2TDA^jldG|o&Whk3wC#c)(T5r
zEMnim09xXB>A#5zD2jsuf&w~Ug4+}(FFrp2%~T(eXgyF0UR3DH!oa|+qvG29myN&A
z1JsI&W@&!S^78-R|Nj?)5(%iw4UNlQ9rorL6%7XdzN^d(4Bf6Otp`du|NE$DG{4n&
z{j^(vf7>yrN^q>}z++v9fBPX&cp9Dr?+|-Y@3RHe76&zQUf6#I7oG|&w@V!Pw_R>N
z#MJGo!oQv2MblRXhK@rAUa>U%VlPo^_{CPj+VG2|R5(qQfsudPku*@c0+rA*ueFZ3
zsK|iUn<zrG8lKz*+O_rK*=A6akAJF*iVQz^GbSS_&J3Ds>QxLF`KKIexy?WIfa0N!
z5Ebk0QWeA7pacL8Igm1uO)~u3eu26}pj_1X>qXrc1_sbV`d=^9zcMhi9N=$R23iMO
zqoTmT-?Es2fuZ>~6KJuxLWy#37-+#H$BUjXpq)s)VW7C<02|PGuk*O!?RtmTPQ76w
zVE<==)Uc@ZhJjXUaJ+~DagX<g$$%w&K)ipQ$Gdq{nt%Q;;c_n(cI!M>%J<r``N#iK
zv*v&QOATLZXPgA(QDZqqhRD})4PXbgT7jwsP~i{u6oUc-IF*YSelz@^eY&29@nz?U
z7dgBB|A%gq1yz-nEa0}Zw2O*JF+WJ46D%MCs(w39ya)lQ2Gz_VDgw>FnM%09vqB;-
zn?Q^6T~$D<6!^C@fH&T~nEDx<!cAHal-hx^9{+ZRoge;x_z#iYRsRXxWD|j_PlKw5
zsx>?bQ8)>r&ZPMPzenlBZdZlo7YfZk9+Yr5S4c3FG;}*CynYK>jtKH+>uvri2bFwO
ztUG*EOqy#{3>Zo*n{AhXwvF;nJ<#H!B2uE+{F|v%W#Nm3^?VH7qHh-RG4QXsz<ux)
zH^}EcDlC#0i`k*!(FHQ(BV&t?icE<@H;am;iwY<b1*Bb6Sc>_fZBcMt5uzes3EErb
zq9P#qqgeO9$y`WtJL5knQWna9+6$n~8|I*;8_fs)H(&bCT+gB+9HPSVS`=y!RM<s@
zM;NsB!$igK|Mz>+H7YEM#}u!3hk|mkNH8cXgK&6Q^GVPkw#y6syP(#91gIHh@#p{l
z?f@BhW51h$f1873K!%ApKf?=Iup>mAn}0L&w*>$B|GyrTR9mnA{r|ta6f`)_!vIPk
zkW{bolKb!f|Aq%%oAGZ8QBeRN1fat4;`m2!Z;8KU&0kQJYWN@A&4(v0u-=!;!RuLU
zKy@p$4$<g5-0dLKD{>T60qy|p`+afg=KuQtoz6Dkq5vXv;3jAm)?=3fsNx3AP`p?N
z7I8olnFA6z)amTf?Q8=&E}^;FfuV$}^->92bF~LUsmQJp(4g-T&;a8DX-0;Z4onOT
z-N7=wJXb+h8(w-L%M2RQci5@G$RNk?LIBKj0r41KFoQWB;L+(9-<YOfn8~Oj>iPWt
z|9H?0DX5G6TC+P?r}@FZ>HB9hiZaPRpRO>AQJ(4Fv+0hr7<bvRgIX*{J3k$K!~-sR
zUwpd`TI~Uzh<RJ8*2$v+aouN->pZ0x89HCQFuDX8nAEy7-Euagm3{mL<WWx+aQD0u
zwC2hgv`k9jxQhzQi3NP1QGb>fAFu!a-&~`j!cZEQ5f6%C0m<o`W-}@oWj_7?KO(Bz
z+2cj?MbJ39%Zq9-?eL-)OxwK3z6k2)G#}9bMbgXIi__WWFe>Wb2CbYq-p!)YX#t+1
z>zT^OumjXIe_<fW$nf$OGXuj;1uf9HX6KI=1q{=}<}f-+um1!Zr);P;XDG3Stc3(k
zbAxtDf1JK)4x@5?;U@-$$cUHypy{1zGlmk+o#2rr@c6@x7ymynFmxVEvt?i`E68HV
z07W~ByzwUn1{8sFA3z20hlr@xqP@-<5GimuzZD{p*7~iKJ)=yVpW$_ETH`+k3C1#6
zu(4qoeV{;!6$j--o|jvv=geg^s1N%9+O1m30!mC7D?ti`#2Fc4U*>?eF02O~OwPak
zTIX~Y4bTB%pb8eU*r=UDgMp#*;=zY3j0ZdWc{CUp(waFLdwT+z1sE6_AA%Po^$Tc#
zI?Z04A}ZY?DwY?Eg*wk3e9F@KsyCA{tuse}&++y1=`!;e6`8iZpKd>oQA_;Z2k<Io
z=*~OvGR7M(PJWo)Fpp7Ed>x7;XmJUsxA<ZDhIyc+C@7Mkol>Bk>kvW6?rQMBf9H)C
zfgczcUV_@jpwJe89D&NP3*0Zh@xtT-14B31ZwFuS7+wkrfW#;$$9CR$A@%{ZB1hom
zV`x<Jw}7T^LCU6k&u8QnfBzoY`Jh&I=ZzP)-cQe;&nPLrA4L+}@4oS3)q9ZhMe9K=
zz|I>ldQj9r(@{A@kP#Bqp!G_fH(n&Yhb0R+(2&H97k}R}Fm$%dXn|ZP@md<i`Jk-d
z>#XrY_dNqcbUgp|W3L4}f4s0d3(k6mCp$T&n=W7!OgOf~2Q&hD<PxZ3SSqs10aTR8
zfhJW%L>U=gf;L`s9^MI3V|eLB$R7rV&H@eoZETDmI-Pa8oi+HkG4!^uf%-C?&IaAi
z8r=>eASnwlQ=->}ZThkWjPmuz555;T_?)S;TIAph&_NF!&I-qz1z7fjIv_0vN?7-U
z0y{h?@PDyJ#xYQOJSz+;u|%4Wh=7WC(2zUhv2MH0AD{uWUk$&QO3S+4Si18#I)5E}
zCDHlv;7fr(&;Z;?FnKnx^XI{r0{q)f1_pJ4mLb+3Jor)~u=5~Pkbm2mK>lqfKzm&R
zGngd!8D7K-gYt()qm4>vuoGxIE=#Fu^Dm}SwzSS{#n)2JznDu!(>k-2U-O3rWH^I#
z=z?|dfL!#a*JNMofBx23(1spooo)w?gAaIY83aHlV+3TxO7Jsqz4$N02-?g!^YrxN
z3mFwGdO=296atN`y_VepN*6D_TmZ*_@Gb?=G*me#QWAy1ONs4vf)p5Dda>l!booV$
zDqIN({0yA|Ox=@Hru!~pRC3>?1zLO(9S2^O$kBPY^W1S36;QLxDGfAb3+gGeu`u*H
z@Vu})@&AA4Bhc)c154+}7pp)`{%@VdJm58B(|;^tRH^@a9HGSU<cmy@l1rVzJgo;x
zc*8R8f*gK8kdYxW8m#AVaA4=<&WA5jz{>+mgn}~|B>5R$%!8;n@&7d&XwByX#whTT
zJ<$5M!=2ZTv#2ODvoQ2JF{XhUSYY>ohN5_0G#u9hmEA1e4lITzJ0HDx^AFrd0oh(!
zxC1ne{6dr+G+EpE5VV2y#k=YA7c(j-+OdO2`~`R2n9j!lnfN;*$jI<o1+xEu^ThNA
ziy7r)<UvlmB)|yj&D?mg|KI=r(Q(bE{&!wzKEg3wVhN*iq(68Xxm2X{<1Qvm@JKy)
z0rN|9E%00_WOWy~eg`ep>O9+d;>EOckeM0K1R}_G(0JerMv(1d0b$`8VIVsl1*T72
z!YERo)?L7s*8EStObK*A&9xUk-$AYEQW5^`=Q?lgC;%y)1e*WQ2m>F3(`*Ymw1lBF
zy3ry&*f+j3I6N%4^Dwya@Inxx)n+GXhsCZENq&Z2XMq=6pD-}A9w=4g-&V}p8}<Pt
z^x_-X4&ly^o%OeNRDtXOozk%wWHe|<|8TP{=*Sd?Qah005aSv_s<I$vsqk+rW&;QI
ze1u82cC>?(Jo^WltXaedI<p5HD$Q>=x(irZzwx)s29;1yx2AzL^0(HvgT^+uIdg!v
zLV?D}+(0{`Sh`tMm|av@Y$KQ$7|QqqGA4nHX5wdLh>L$6@j~nD|NoswTMv|q?dk!A
zuNSDh0XdT9WgkByL%{!Hmf(zIAU)?m6VC5D?{)jA2z*}BS<3<rs?HZLo_%Ft&~W9d
z?=EHmbv!>WX+9zVPQLJUnLM3WyKBJPzErv=fa)M?!BW-E)1a}r&ZC_dUL>CZ_ZPs<
zhygj{AE-UU&kxF=FCQ{8Fm(5Vbb*FOUi_a5TGiOy3KD>H{W=eU=3&j#R)Vs432%c1
zLy2$a!R`<hj@Qq3=t}W3y!iZxfuZx@jsu`6&*zUA7#I)kFa?R<egqmWVwB<EexX}?
z=l}l<44N-3FBS_21!lYedHF6csNmu;{PtRc@l~fVs2FmduDzU5vi{%c|NmdJzPJS%
zPy;QFl-UJ#H)s*i3s*iy&}#Y@y2t+if2j#7wm_@bB@9n?dVnJjv}&$5TjDq~g9HNu
z#DVr8hj=hH|75Ha-v@GX=ljn~I{$6}t(;>4bwXZq7#;w3v{*WvS@s>M_u^+T{NMVm
zM7Hz83uc67K8QZh_Bqf(%FZ7h&a7$2o!J;(Ks<coAp=9N2czKukWIq-K!JeJ(dDAT
z(&5Z;%$bv+*O?2v+s5$Hi_>2i7>+q}aU6FR0#!t5$DPIg|F1vh%D~VY%LrM<#D2_`
zk)b!1sq=of325Mg<MR?wjOZWz57}AwS}@I$oxgd@zyJT!I@w>Y0na}0fZB<N!-B)Q
zWm!Ncp4=|YFgyU=QDb;=mmn(x!yEo>2l)4Gl#=FWu>4T!=h*y{rSx@%yfi;U{R<-=
zMuy|8Af2G#0c{V1v@1Zo7YDc)8KS?js4$g?W*ABHGrV8{t7ZTlkHWyf5DD&Lbb`)S
z1Lvz?P~Yst!56H}5BNKeb)Go*f~)xff45HSgL!-m`&UZyGkiP9RLZ)4vot@$ZV<sQ
zx9cHiG3)Lv()<je0b$|6flfi7gIzNAfh?QBJw1LUqecCn>3j^3y)!5NzqaXic3=hV
zP<fGf5L5^|gd3jh{Pg1aPX>l=XA8qiodVs#4&W*N&KoZ*lo=VigB=V{c6NcZM1x8a
z(Bxou0Y~TMgO6Fd-3%CSbTfc=HC^vKbnq2x^CSKek>+3QC9KV-|G!RcJ|WOuA7;RK
ztCML5csbY-$b=eLAIG<Yj3qZgUQ+IS@!}x^v~*7awM|Mv884lik>T}@7aQ3a8D5`(
z2Zv1Sf_Z!loxgUx19@@^XpuH())I0!UFU@tjvy<JJxSr;cH!G0#uB^wCkfvUDU_<V
z-Y#Y3-*(`2q|L9A0GofMB0(9SK_)nIfhy=7{}>n;UfTwN=frqq_!(Yka)C2l=Z6>W
z5T}XkIs#hP2U<`1;w(t=#Q)bkFGN7Dn*?4p0<N1ouXP-Lv5yPnnNs<V8_yEzJ3s9J
zr-r!y|Nq;9R+m7=YQEoqZOZ}$X<+BE&a3>}Y}bJHD*otjQDJI+@Td8NL5GV9b8m<W
z^Ns`o28I^~=fPzQNAv0bFF`9bUrc9ZWax5HVO|8%*Zkl;s&dBj|NnQ^gSHodqaz12
zb9bQg<G+KYqPsvd+%Nn=t0)%mgR7IfukCl805wRgz_ono+0GB(C7UAr+guqSG7A6y
z|NnkN^7d<`#%JJloBu$a8qh*K$co%rP>%ZXzhqK}D?{fGu$y{A>Q$H^jxRk2ay);l
zBWTY9DAC8qg66)%Uz~?Zfcj&Gmv(?A`(JoK#Xy%x7+%`39ON()sF*Y;am<2p_&~?|
zxTr8O^oFP~?N|kp;(<zi23JJ&E-Fkmp(Pvv874CP46jwe>Q;l)Jv|F?&>6707!{_L
z+n}~h94PknIY8@&Uv301<ug3FqX#57c`s;a;Kh@_3=EyeJ7QFrz-IjinPvSCbZTIX
z3TQE%X6KI=;{QN_S|Z;1t-hpS*8)(&fvuu{IhBKv;l)GH+KoL8zgLxT1ZOM(xva<V
z(vGhne|~^0zPCK)qQV5R;sYr1Z$gBXj<JFwJJImcjxQk9pdI<G2THj!E`pp`!OqAK
z1zK7UUR<N$#m`{%0yI?z+9#R8z`!5?IyYp4;iVT35B~p;<A||mS-cEs-Mltl)7P$L
zl&oK|fRCY5bj<=j25>0_YTg~|6j1@4C(&J_BGa9tq5x^MNgoA;C+G;HQn6hupa$+T
zW>BYv160JmtOYgc4tI+_04;5DVq6TOJAyg7L{vJ0**m=1noof$5@!DGVx7S}oy7ua
zoz`ic*-UBm$DLUi7=i+`7(&AXGK6IL8D2E8F*0=C+Ofihj{&yR=*VHn+)L+S{%sjz
zpm8@FP~dF81L}i+2OZ+cP@)fMDcpF$upcy;^J5pNso8ns#m9Z%xw?|NwATM6mHgWe
zbbjLBcIq|%PSD!$9noKy85s6|U}Rtj2nVmc{|Va48sGesr9>aHjNrzL4f`MlLc4Ga
zp$6)K4AcY}_>q6x$=CclK}R|6C;^#Q05)&B{CY;|fC(T!&0=L_K<t)ud(ron0lZr>
ziJ9TWzrFweXMkD_8Nr}EgKDav21%!jibb!Bip7f)3&7JNB`Ox+qC8^3^se=c2GSua
zM!n9E1&J^I-2|mZe$Y)Q3=4S{O~1OHv64w((e!`~j4~iPZv$hA_$H7uRw{!^J(t%)
zoj1Y5{x9cE|G9xtUP633C~ixG8){V87)m(59cC<LF+A|vZMwlmMw$9m?-(H4p%q#`
zmt4wVmE&i4VW7;&u;T(d1H+5PUH|{T@CU6%0PT#H0G%q?{6?npaOZ;;mD@nZmVg(<
zq=Tmy*fZ?q_!(YH_PVIBz32u@mp*I&tpzFJ&xiyWd|e5&`sKiD^DKs7$cq2z=Qc93
zE2_L>V2A|m1e4uiCdbdvdb@;mhn^fiLqJ9eNZWj+>EAXoD#$b?^Mck&voPKQ?ab@-
zQBml8&>f;8^CI;Z!*rufjA~~6a{Q3tn%)={p5PbLK;_k))^8;eVHwlq_!)MA3O&t3
zL5w#7UVzR>>Acf<<Hd|C)B83tN=lvWyw=UpdE>=1kf!6^t}HKR&i?;DAY-1~^n;ri
zRV0>y%myu5?2S<o2!6o{Qg-8o=Jx4-H!+&XfY*L@9zFP%t@(jHXmpz8?SX}S4BaAc
zk1U)Xu$fV&{tbB7F@Nh5Py_jQeJQ))ftPndt?&{Rj?RDG?4YhzaK;X}EiNh&0Wab~
z<?;~$!`q-GwVk(K9GVH~&6E^(+jVz<TCm+MDxi@S%^#L0iUoHSfHv5~gYwT-Mn;C$
zzMzwT{!a$Ack3Y=ikaCu*^V(Vbc=xwwP54l=Fe!|4Kk*P^OzGOLpPg4CmX2U`=3ek
zNB16;1)wE(?8VKU>@RDe%}`4={ua=&tX(`Rpa$i)g9@N&tEq=BKe+se6XI!3kf-?=
zz;$Qi5zr!+=(u=IaFx;ghNtszP{s*4eugZr-VznQuorcIL7AZWh(PP@Qo(Lnfd$k1
zw=jyb{p|eoLhkDHRa+R1g3myd*Qf}EzYqZ_KZ>NB50qXEx{D=Rzm>9dOTYdI?j!Yv
zs4(`rvA$S;1(bhE1Ug@K{sQsmgZZV`ryFc#6s^AsGMJ;+MMWUs#hO3h^SA^$Z@gGE
z_y7OSE6p`35)36=y&|CXSkqR52WFa&@IW^Qg4XCB?{?5={vlARl(A+iA4A4%P-1oY
z&%kip9embKL=^aZiI?j^!*-V)I^8w+w{bQ66e$<{uhLsHnUA4<A832~%U;lA&Ch85
zmH<Wu2Jj$XZxCbWj~B`-L6uf-2s4Nyw(|e~-V!#(m+_zl)?j&NWO>j)07$+&U!nCa
ze~Tp(1H-QOa{Qn}Q1)F0g#mx-RZwb+m3VoUfq?<+vidF-W4D$Ar9WPBgA5H(;plZ{
ze6ef}s7D92cEJkp!8IJ9bx2{o!628sVPs%%d#MIGkR?Qg1*D?{q~lnxj|xX`xJs`J
zGvkZ?rQrS;*fAxFyM96(Vg`0dsUS1xyboi>&iYu;mRXKYR~690rQQO@m!Q)xdV?6V
zK+X;a9bHtw_;N33{bvwk79)6_dgqT9b`Xi~e1!;*S3#k+>kGt&tCt{N1s$x{87uSB
zgb{SopciAq&&HCpa>s_Bj3vGeKN}ziuk_XjF?IfUv41%@nDap{XEr?9`Rc{xCE&1T
z?qx9s^A9ii|DW;L%NL*_#-B|kX1$KJHcVyWFF_5;Ua%R}%m4rHEnt3m6r|*AbZ;<I
z7AUBu{sjp$MZN^JjC#T0%k;uyHZ**h>N|hDa01!Rq5|0}#{*jG;|@CAgroI9sl=`s
zpuz4mP%CBeUwE>5ZO5#m0^2rs?+F7#x4XhFfdzaFFJvbE|KEIo1H5ja^VbW#iU0qH
zb-wHk2Kmww)E+v}>8=pfe2nR}A~=aEGBE4|jeEZq26LgQ;x+3&(4fVCe~r!$(-U_v
z>eho2_dihLcKgG?aNG@?xL?aO*Qqd+oDC1o*aMOmlILf5q4o!K#6_o@3S=Y()Ut1W
zqqD=!(K+D7WkFEOy2PwILZkI|iGFu6OIUD*2}sw6-wX`UF*Hyy_u|Q828J;3wu#PL
zFQWhdpU%6Jk#G9(os0(Vz2N;*C8A*&q4J>eoP~iw^H5N)3+w-Y*F0evk@BGOpM`-T
z^hM_n&<vD7=ZhCM7r<TCZX1=(cb}JZzIdU1VY=NeMrjjmuwkVv$DCQ2d%fAfE9k)|
zJiHKu%djzazT5@c76Os@F}-&eqrK9OAE3&wR0o{oL7BisMIZoNjDQQh7ugr5zuUzq
zuUh`&|NqWIh6kE|F_y71UhQ>b>~I$7^%mSE2wDLT+BNqg<i~V_-HZ}URzIeD?Pip+
zl!F+}mUi4(<N|xIx7aQ*xLPKJoES(>0^Ev$xa`^Vxw{!98P81LzMC<bDdYQenLUhB
zOg`VITkK(!W77FPJz@`|ygN5|fe|SD60n6|G9vugzrn(9*IBgiTX}Z+zCDamcB{T2
ze8<9gbpum}vtX~c&@RxKdOJWqe9`d@98N69oQ2qXy@kOi>p^7lzD*a|%cxWD0;(hh
zp_{lJnt!mCzS^0P%*)XDazPX?!!8i9qhTf=!;2%J!tUTMffc+AJ3t$mU$kxe|9>Hf
zWe7SD8nV;#Tc;@KT<e_*Vf+k@FBSYii{*EKs230KgXW1q+x{WDo?p0c`~Uw1Z~cV-
z|6hc>2D_5S@W8I%|NIOuKQM!q5gDEYuYcK*4N9V1JO2OAVl+Iti>ZNuVMiTE===8n
z|Fb}A=D<zE2_T^-+yDOuk9zFl1(jJYDiSXQzk#Nv3{UO=E4aAk|NmYYP$9t(3|2VZ
zZXY9?$y|`;<=g-N@AU@F&dVHpz#ITJV#hj=OfSe-P(IxSI-<DOMMdnzuCLQ8_A$yw
z6n|x42+P<DiZ*c5q((&{{Kc=&pf;_Gibz1OHxpP-=Z_cq+aZDyFP?k_O;)+6Nc6@?
zFu64!5qZ4~GL6C502<6vVS3^Gb^7~#j0*L?LF)>(xu~#%+m59g{M$oRID!H)5KW;P
z6_xN81)u-_@AYHj-|nI!(foq#wPJ8U#wmGzh772aRKj2Qf|W2sl`seF0@>C1<3;^8
zP%4uEiL*4nV0)nlbsG!gG3S@{pi_<^gEF9H$e<yb7yVzr^Ybh()?EY7<FgpvwvJI@
zDK-M1+zj56?gmjJ@}e801T>5%(e{adJ7~Y1OrYV(7d+ek|96giePYKQP~hHP1&VzB
z*5jbP$e<j#iy0COJTI7(zf9*nz$mT$;4^r+GH9|Jj6v&Nx<gb{UQFNk|GzV6<?PvS
ztO{Y%{SPpTF|A)eJ^cWqW<3LF#l9%ZB0h#J#-ISh1K{;;FN`++|Nq|<B>LYJq$1-f
z$PvfCfO=aJJJ=NX8D21fT~s2KcAOQot%89qgMp2KAwwJ_H}4B*KR0MZUIaGR1adRj
z-@2bc6Mi)+A`JX3JO0%F|Gz^Yq-6_uRFl7T*`NRaci4kO7C}X(fJ8vrUwCW+Re`Ms
zN_loY04+uXwJ2XJ9B25!%)qb%v=jV=8b}3boKj@h8ITIlRNsq3Ul<r(`u+L;e<w(d
z;iVTWcR;6Ug140iGVB6dAJ_5!|8ekHHXxfIJIa&uc^Nu4gBpe?`^sOk`~i*c38Wo&
zU}E^te1HXV{Mp+bplPUGuG8-yWRzm`oBrz{<9)`g>9-Csmerfz0`;|6`B)ej4$MzG
z&MM5pz);V$QxQB{|A&*|h1e|yhGVP@e>fQ!AsuNJ28JCVuHmH@-s}GV-yyMxk3ko7
z4*p_+S$qr|c04P1QrLWiX9Z&khvBzQQwJ}8h7Ef`g8bVqKx7X-U;&>E#(CkmBC85$
zsfIcO!*Ny(I7<i4GFUkM!(m44dXU^}Y0&7SSf?mR%WJ+)QG<ni46oTbMM27)ntx@K
z?%b8|ih;rK<c?raEUjJk|Nr6#zThG(4J44b0n+y8Zvl;M9A^b><Nys%bsjf739fed
zx0!?Qrr_=T)bNX|l-Xe;qx<VuEhkIr*%yNpzh(t1JNSU<#qo9j|1SpZ0ckx@s<3MU
zC`P$K&5Xj2pjnj{Q7iw0&ccud>vGR109n8E0|P^(;kSh#UA;CNI_0~VTMm?P+i>x>
z++bv2aDM&X@OC%*3(401|2x^;0>UzCLAvrm)3fzQK!^ArGrY8;6(lxmJ<KD|8Nea8
zh!4~;V<7Ai_QjxmFmQjcykG$N1GFOs?2j6dKR{=6zE}mC!N2ih@(S?$l)flfTW!W<
zkoEW8GcZIL{_i#g>0|uYDTnX~Xw9DU>-W>o9c5Iif70>)e{UGai#uSN=f#zd|NsA&
z@%%62_+Q5I-z;M>$gtA)3=GZ31wa#_w@W7+XMK{u&(M5{AF_~k$AbiZh8NA(7#K8I
zUnTG}>^O0OpCN6rc^E%K+HqFPFn$Jx58#oF9R^|i3@@U<3eCd!8Fpx0<X2@#Tg;ot
z&#*)7B1n^9B0s|}MNm_KA(5Zqg+5p<N8<D;#~7XJonL<W_y7MfW(Mb%D*vFvDaSgm
zcAoF{<Y_%w!nbQH$gNL7UDm^|?J^E1@H1qb1`(ie4|p*Rbn4-uUKuw2ZSG9XM+909
zlt>0-oKpbZ5WxsKO)wz%MbYd3{}~TA9}(zg?>yf8oE>tO8{}mE`hd`kOA7o9ogXxB
z1O&hEfGQQ~{LyltM4W%yk8rSIn)kwjUuZ)m1v(*Pzn~%1#y22$bRO=!+RXquhRXwV
zV*_93gIza4&IV0~y;klH0G+JYda0x;DB~{7>AfW?JYg?x)W7=wpYcQIm)<EVAcHgy
zb#uRn0r}}z=ZzNv?f?Jx?tw^r4-Lq8rohh-9`<6%tN;JO#pa>?pejfNv}#SE^TvyZ
zZJ<v7Ux*@*!JuZ{i@9J$0*yyN=7R>s4mZAHVBldm_=>w%<U)NnQ+E&xbme0V=)44w
zvgSujCAOXCIuGt*SLA2teDERzbd<=q5=qElMDG+8P;%2e6cq46;uXjZ0-X<DnC=H1
zhz!ym9e23bfu-{l%+8l~AVnwsABKh&+*rYXKH!5{e(!^61&td!!<^B1uJba&4Nw1q
z&gskGRODyqoua}6id~QcX1s)k#<qRa6;3kB=%Z+w1<@pprpXtkDSO}a?30Wt`sX{Z
zA#8I0`~QD<SO&VLUoW6Go!>is-$_OrR84pOfHk2zuOFr<1*}QE9(2AB==5oc&JQmP
zKrKU1)g-u!XD%PZj`g5|?96KhhSx^NSyaG-MlLEWjK?}lR5*|ZjW#}lv?M^o9hMi0
zn0uZ69|IMBh%SEP8_-Iv&codqI^7O7pg|p1$QI=8dJ&ZuQ!atVlDl0wI)62v5(omF
zq4WZD>2)LMC?0;Wc;hKC1_rPc$BUp#3=EJ>>Ol`cBbyOX-L4$qUL0s6g8L-~hUN$0
zF`(uj%q2pdA6_&)0Ci<cYhENjV_<lF38WgdA_b&cvL0mjA@D9`R}P5PpD!{n#O+|H
zWng&m={~q=!~xO*syabho?ir6x}u}R2E2Mx4QzOc#;!A<Ih(tn5L@$#fg$XFu}y}C
zB0s~6yDvd45>S?V>B-E%@Z$bc28P$`x?MRM&x<oK)C+`z_hN%RU3C#W1GN*hM#S*a
zixn3c7>+qGEzAJ#1TRtX2s1p{dE>?5w_pQ7>vE4fgATlBcx_;Kpwro*+t~u9H5a1w
z4OlBgThCk2_@o1WOEGBtiAALobQ*z5y#r|ZEqh0>1Zb@tf2$G`1H&=qfVAVzQVdL>
zBR-tcI-TV}47apSXPIsn6`!<DXN7MqDxeyNr9_~+1)TZ1Az9!xXLpMVXn5W5Ql~Rd
zXRrY1<R|_$|F{pn=LV&k&KeaS@Z_$wj|vB9DRVu8w2unUM&DvV{xugw555uw%_Db)
zsPJrb2W{5sby0D6@f5T*?s%_@ig<5`io=WT{r~^-?+Z~82F>&Fga?2^+E<aEAuHg8
z31~>m*#&eOs)|gvE5nQJ;6qwG(z<(8j)6uCkI3u?oniIuAWMl-_Y{>6pyOAXAJv0T
zDCA#!sEDWe1!M6yu$tFQoyQv<GL^Wbb+@R1RzfvDVDIu#Vc}nVqDbh!j|vND!u5aY
zn|&YyUo&-{>uym2ol<|yMTLcB1yiY5^8?1_156z*DlD(LK!X3lDv=`T^mzt``eP1E
z@4KBXjyW(hcRSm3{%rX9zeJLM-^HMSj0#ZlS^ONd#L=SjNAn4X*K(a7LGtnt`S~FE
zW~ls!<`W7XPCTF{v_(UW3JX)6EGUpzf&wy5gVaSs)OES22sEGIczq=x<0DAe(gh?A
zvY&?`E*^SbB)Bbf<3;>yNQ!9%t^NgtvWyZx!wcc(450N2h0_<GV^pno00}*O22%Kv
z0TlWlUP#q}h9N=G)%oegyWao*AyJg71dgIoaEw5rNCXr`KR}1DID0f75otcm6bz0!
z7LfSEU;qC{fKF%y6&>J;0#d<&iu%rD0U2E&o9ok`F)-`^P3pX;UGo2bWOVC+QpsH`
zpurwKM$qXkAk`qvFW)}{Ez{l!QfheVg~>SvhGPtgodqJDpL!h(UI@+rogr@UVo3{l
zv<<YFsQH0g^CQO2i=Bshoef?DwEq7OI!BWM#0l$xs21-r{{MdkM=3{G#&RWohSy@f
z-a3YtKq_R<{{Qb#DioG+3gpVePeF?)Uj~C#Pq3&=x4XnB&2?rUXb%_YNZjd)7Z|1M
zmxK8lz1e=??kxD2l*wQ*P&NXuEph<w3E*ixP|5+xpRbJ|eLC<Q&Wjf*`xqF~I-RA`
zY#EqJ#QC=$2nfsg1hQWebl>3-o|h{a7#RK+Yy2-(`CrVF0V-9(GL)718D9K&QV;6{
zfwy(Ncp(WfOAa!*02+treDQ(>A}9k91Rd_*`QpX<y<l4v!ZK2o!7-cziqNCYM^wTx
zDwRQ_NTBge(4lcJHiLHRe0Xtr8))Hd=c~>eFU~Ca|9=;#+h5=7Y|wZ_f)TPg<>lEf
zNC<Ox|Nr0Ztn=a*Xk7G0;}LjtzMKPToHf1y)x4ne&<FB};S*SLa9;#Z4qrgWCrkn#
z<^xg;P7XVtASZ`^r|ZG#0krhrS)|w5pp!+V^V19Ez5o9=RHrfUw}6gY0<EKnYXWau
z0w2QI{D`rXJ1k?lGC#vhdr;K6fbZ<!04E$~P{IM}_}BzZI3UjVPVm_GiyfWdbi*B%
zaRa2Ak&%Iwq1#1;1)MavyZ1nn21o#$Hd4U?sA(e*ECx;+pq*0>FcXIgO5#x51CAz0
z;@|`&j+dZ$c*uAKG}8a>2CG4h^cTD9!J??Kei@=v0aUPYzh(td%;3}y^5%t;(A2M~
z!q4!c>=8KitAchKf&#O30|NuYUQn9tb&dchrOsC`ns<XXKkEE&ZT@Rg`W$4)=>||S
z()`@Pu>Ni9+fvS*p!C}Mzl4>4yN`-OTBo-ZsP)Wb2$E!J{a?b~oueYsnXS_NfCZdS
zKx=;4A*XPG&Z*|<2A!-3u9MOle=;zYhy;dZ`~jtz>kq;8>C0Bo9tRf{8Bm1>+H)cY
zs_;OJ0C`ZA7nb3x0#4r<puxJMogZFY`~pwM4;KFa-v!z;af*e1+a=JxiWg7Y|Nrm&
z2yU_Vx~NFJIPnSGT$6Z_zIl4^6-Jf%H|>zLeH%0rb))eJJZ+wu32J`AxQ9bKpN4~4
zX$GCgUrYz@b}5nR{PDu{3pkL&GZI08{Ph7S=e(3<VPMz=j?Eu0x;Fp+-+2tQs+66D
z0dz1+H(PfYOY<WI{+4gd3=APV{6Mo?-18w_$WpOgb3plI8)*I_^$R$Y1U+P6*a=c)
zc<IH=6QC8bES(meKVDQ!2e}-yaM42qJRN*#EoA6t;&kt;j5_s`7lDtX<Zq2;W?<+o
z<_XUNt)KbSdE>=PP_6_oxHksvE~-}P_GaPV9;|fmkpSpG2+l*Dfhyh3LWY+*9W^=w
zbqp_cRvL5$njCi&VPtS)01y0h-gsdPweAt<GM|$$(J5=dj%YapTGZP;fdw>I6s+Cl
z;oISR{zcG?|Non-wHf$Z)=d|=#;6&7b|KV_)u25D-tJipyFg?0ogZEl9cN(ZJQM-C
z_vrv=Rm65@*MkoPnolrxI%ynt(g9bFA6|Ug#lX<(`lR#Ii<Pe!7}CDGe)`AA-`YQY
z(lti?`t1urcM049pN<{Y?QNO`b^3=FZ$K^ML-DN#O8L8;O<&|s|Nr0cTW7K9YkmIh
z&c>+rFoMpKNQB!X0k@~b?De5;XZII|)BpcBJlW~({<0TT{<z+8=ybi%dC*YlQs<2q
z)~iAJr}aRoc;}B79Mk{*|L=OI+x3pMvv$$7mu=G%t~1KjfA9hw-KPRM90zo4<%`xi
z|Nk!r34@2QTtF!Tv@!U#)D90&YOw&7!^gm9O@ieFLG9he_ZS#nH|+!|Fue5Q#Zd-^
z&Ip}u*9)C)2H@K!I$f`HhTiCOGwBSo;NRwYqVo{{wwCrL28QXsuQRHPgAD?WGrib*
z7kqoC(zO5oU-C`2yulb--v`Na*Fl#@xL#>KqSDR$!UlA*&B5-_E1e%+c+LI)|7G_-
zP<j-4F=;AzkRn*9+gasBD~NNT(^;kSMlUoy7ft>DAIb);x`B584!<~m5|VP-K+}51
zdYv5uGR{Ekt&ay;d>pbZ(&JC_5uWCse@gt)8Y@K@*-ALNJz1Jxvb=uXda}f7*F6<*
z-}K1a|NnzCKqKE7k5o|mhQ&9*MS#eQiR(b){h%h#kN>4?-QWSN@Xn9mL8TWLX8->m
z0qv{S$HjveoHV|%043+co!3Ce>UKNmbh4=Ing9xX!}Vadw}KAF?mP-H;qRpX|9fjx
zB)}Cw=Znv)dwo<SKv!g{ylDRl>I?C=USVKh*uRR2fuZr=|9S?7I@bN5Wka1cDiR>I
zyQDb4SChP`kNC>KVEDH6Kq;T$0m~W{3H~Vu4nC0UJPO_yCea(B0=kvx#eq{GN0g`-
z{)d~u1WJ)CDlf#r7M5l-dmAu<<{uq)fLC2ffqGHLJ3nx~_~vZD2)bjTL>O!{OyB)4
z3=FS%>R~p-pZfnFbkJ_=fl|5FOBH&carlcMuat=IS~H!GVaEngU~Ik3z|eg5|4UgW
z*oo|4CjS5bdgj4bvdxc}ID-ugzk#mb>djG+=zO`06O{8=R9=*R0U1<!thYu5atB@K
zyU$Czoed5?5U5uL9Y+Ro9_a7}P?5!=@&Yt0-g=;P`hG?R1_qGxOIbmub4VS0E&%dA
z$Yf4P@X3Hp=5NjX|NnoNi;7H#iwaj-cZrH@my3#Qhl>h#my3!V=zxGO7ZrI>Poc|2
zMWMq*MWD+?MX|$0g{QvDMMVvCC<fGEX?BRgM?Qm`%-<>qTD-O*5hAFy7Bn3S+RgOq
zAJ{&j125P>>o&KAsIVM-#Kd_4R0ke>#Ff_gh=GUmg2Rli5Ebr=kD4E`b@`}p9eByk
zd8+vk6Q~07QQ>KR$lvQz&-MNCgRT%2;RCPOKt3(eY52uh=8(nM>!M;4V0dzu6$hxN
z|6<!`P!FK>Kz9pxB&0;{WyQb$|64AVh=Q6m2OkKiGBDUP@Nd7ydBNe}11?DOwey(a
ze^4*68nO%AqSHmix;xmQ`4MBU6Dw#Dhv9*QULO@>&4XQ>9X>1;4xpo_Yu<K#;9v8D
zdnbb`Kj`{P)}7x}_!&S`hBg6#862wMDtZIxfVN|x&HfS@BC7lhFYey})$t0THPPS|
z-qN5t_eJ9oi|JN(8C97&pH5G_%jnOp15)dKWBT^HjGEC#{h%HC%_kT;oHZfK>lOO{
z|A(AfYB~*4x0VX-Isi(2zd@;Q!3_q6*J`j+OP}rsH7O@_M(A|D?ELj&<8N>l5$yc%
zB4fgI>wApS^+Ay73D6-kA6}e)1u7CiLwPSRfY<9E4h!y$U;$UJZ?AxC1D#gYdE>>~
z9#DlHkP!}YYx;Fi+Y02R=(v|NpaYi8Z&V<Q_Fp8v0Vk6dP+y&Yn?KXRhn$@!I(bxH
zSmyu#Zw$I4x0^?$lz-O(&~Ptk@ybik8Jm{JOV~Sqz1Y(6|3CDa(-I&4ZQ)D@A8}4+
zxzDJ`+3TYMTHK*@a=Ph#Mr|K{{_W?WS5UmT_YJg6Ae!mmW6<$ulk-5HE*0BlF^i93
z2dKP)tyNRF&cLwH0kjORg&B0Kt}1B9_hN^I)7Rc-l;*vV2l8X<ffB73^ZKV>z0asv
z4_dMO`Z%ar0xl3ieuS;S<KONe6u`gTO&}m+DJcF0dt+3TgJ1jwpHurnwi}cyK*P!h
zO4whR^#A|=TA|ri2Q*S%FTmdlx|sMIiwYxu%MnoN|KUZ#GLW13TegClgSMa*yP!+r
z>i2(o20G3EdgCbu28Iuy5eok85mJnY8?99W@&Zbj3~z(R0~ksqdM7Y2eEEOy6*p)R
zV5iB&<1QCLO%VqE?P8!aj$Kq(UcCGZnn8pbWi1M_gMaEF(6w)tJ}MmiQw}Pg>Sj^l
ze8E5EV9TizgVx*KF8V4gB^qJP4?gg34;Em&5RkDA6#c)ifSTrDN2VQTO#^KW{{X6^
zj;Ku6c*rPQ&!NW8@M8ZJ28Nvs-~-EgTR;5y|Nq6tJq!%pvY^n1RBQ!*BAfsHDbeV5
z6H%#8vt?i|5pAxMVJPMA?FFd^pUPAOs$<Jon%}X!z6=xIAqO&_543gVz>B1u|NpJQ
zhVnOqmM(YRcu^ns5|sW*IT{Z$a4;~ue#pPgnd#sIPF8q~Gv4TI1)XZlzr9$B@m`}H
zC@f1AkGH=0^B=UNl%e%oiE!tQgD+S>3kX|Z{Q3X?<!aD`FxVf4Cp&MwnEectZw|g@
z>AZRHp+NIVX3+36TeqmjLOzE2jBl#^3_BV@EtmMo|Nlq51h4l8Ywo=DA`z^We|wz(
z|8_sA9q&~68PZz+mvDC8Q2p?qpMmj5_g;{VpbM;jHva-w)Swxs0LZ=@zR94)qaXo(
zbq0nA{_SOKX|3N%N*M3`2RpyfPNhB|FQ7D~8_ezX_@CBXC&f_OnATh;#!%u5iHpu#
zFK#~t`2gw+u^k{M6LJQ~a{&;4bxivI|8-OMTu>;!tOu><fi!k{(|^R*L+^O#JP1DG
z{KdI`P|_|H==|6TJ=Z+$<*t6v<{)sM3hO+!<1r{kZ-Tlmhe74djxQkoFA)ED=hfER
zC8dz7HCiu~WbXiN{Ccr`0(is(++5rMS~F+J$iVQrwi~n-Zu*|bjFQ?HyFjU(t(!+>
z7wC?s7Xix|7{VZH=nlT%0u|C68EoqO3@_L(O?$#9T@OB_@mC+D1Sl2R1vVAb0f!vF
zU2_Sv4j_vuH2j5VAK2v1o4aB_QT%Wj14CHnkIq;8Yc7Z!d?gYT5S-xvGI+*CaOn?P
z5)3(>JP<lVQo+H$&0k>`=uC{ukH805Uw#0()mKCX5@4kuSAd$kBD-FIiunf60PdfQ
z3=H7?uH8H;hL>JA>;#o~{tDo^)yoeUKk#q!mgqdy&C}a4kB{NtLy?0|r8&=XYjkRK
zb9Z}!4*U0M_{CVR(H+Rr9mLa6DZx}K&|S^Z>(6-bAqVFvPW=Fm*F4?+Hr*l@yMs77
z12_yX!88gSe8kcn&Eeeqn4j}j=jqqaIj?qVO!t4vC|2M6Mh8@5c3$l~4W9YwWKrpI
z5U^q9Z)sy;V6b7~Z@I_Dz+l7Fd4a#B1+?k$OX~mst+)AGF0p}}U(MY7oVoLd4Ksf$
z=vKO}U^Y;_-Q^(hVoM`<!~?WHnWy;&R~-jvJ2>cwGtj|*pz{F0P0r~u+)T3d+Th><
z-Q95T0m}<n5D$F3ii!yTdKVRe7u+C`<Di3r4}cG~fSpPCzf^vg3}|^cXpz~AvJ2o|
zKzs-I7*~#$Ei4QSJ7qwNu0TiHuHMeT(3{88c@s2Z-udE%ZR-F3{M+0F4?bY8=ie44
z#0k2v3$zN3qtlJ0(~SeP``$q$t<z1Sp-z}l@^&L=d+VRZ!wd`!pwVm&&~@!KDhh@t
z!EIO21s@{4;r|al67398(XjMU5h(HOu2B*22TyLCFJbCD)EV%hGvW*ABoFQo@QolU
z2cL6r{%Sr|pV=Ak1GKrSv*J%<i3$q?0|$d+^8o?SMHY-9DhjVRf*m6RUJhBR0y=W@
zL$^SuSm&qaQ%s!#-7+fH&Jz5sv78JHoy8I_LqUy59~B-?a0mDDqi&uFoqWybm^w`+
zFo&qfH2(U}%)n6h@ue;&C<ZTdv(&4+5KjSBcA(wPkN|q2nDYPsOCFGkKUxle4{t7I
ze-YXP-Z51VYDs`nH~%gZQ0Rk}48D|Og@^VFr)>-jy%~tGzLNa^|8Y0)CMd8^z`+V;
zNr3!O5A{grkCp@ctur89h|U6um%X5q;R})>3C@oN<lJKB=4Z^EA3zBXl(mr(oB?RG
zA9Q#+=={4Mtl$L40qUBkb!W4H6I+*$3J3W9F`4EAxtCvnPG|t#ej-p0*<ZQ}RN)_k
zrNTKN-f{lzM?q;7BnV21A}?A&!bibL5pg!^+fvca4=-MW=G}k1cmkqcywqWbFRAPN
z@WN;-0|PW<E0X{JZ&drg|NsBaJka7xfzEn2mCibi&N>dz_|L%yEQ~)o-B_BB3m6_a
z?*4&+LEuAY{+G`BAE2YhdP8LYcZUCQV7%LWT)^5zg{S5YI2=W~10*2HgSVThJAkJ%
zjHk1J=d~Q@P7zPA=Py6#=4tBm<LNYMVs=rHY5pN!_oX*a;H5S@Lp=lN;5rtS7othf
zR3O~z@B!-F(@FpTzhq|zWv!M2;D9P+e-Y3HP6$<95cQ?}yN-aiEUW;no|Och2LRoV
zYr6&R?dBx#5N5Z7NayF4+oc?!(~}((UbFQEXvB0oXmq;rbZRvp6?i$9je()_!i%~@
zNUX;&p~d<lMg|6?ShuSM7c-!9NH}1{3<pv%BQSjlKa(;$XqDQFB^}ex@iU3ngE?&-
zAh*LJmIt)e`9*Cfc<AFB|C9ruGs<D7k}K^h0QqhTsIC6`G$<rqTxkX!G5z9f^Z)-Z
zW0@Ejc7iGraC=8~GXv;EKbg)KFN7dWh0Y%@*f+xhqVq%ji=~O6$oJ^XbLp(}>C6-8
z4RtU)0NRsz@S#BCLk5Qb^_@N{GL|kXJayK+UI)5kRCv5W8!atwlz>K%SwI)!bV?p~
zgyg6g6`97<4ZI8tosk@!l{^m3ha8w|R0Lk{2d4~)?f{Wy(2}H5p>C$;2M@Xh>ft5F
zYw%7#Po(t0*ZHyeBvU63D2+(if(wdIy?FsIZ-X=61<?5F(Rfh6wH_#u=ylitO(a(n
zz{63cCthx10fi6vRts?D+H#<j9b6~AW`!&o6le$KQ_yx*{#_lQU<K_BeYp#?_6rh*
zFYaxGh1H9?g#Z7KyMoS|V>s?A0O~e_{Up;Z&>70m`3hY8H6IOlY0JXE(0a0zuk*qS
zsrdi@4d1@hW?^9Ha%66PzzpgRw_f6Jtz`y@FzsWkX8`T@E#dDx*8Gg0@!NqH?EKpf
zFdl2DQQ=`I72E|{xV!^2{r_T0`~Uy1MRtPN5K(Z#32Xx=6413NGBfxXc3cD1?Ke&`
zFud;E3DOHXO=KejL+=U&(DA#l>Sj&c|Noua4Hy|1j@P$?rYk_60a?jhs>8p%9dsM>
z3qw$IsU1|8fp^h@O@9b7z4|2RD$SRhnLx)(fhyP+n%}|6o&z*W+Xfo602$Z$@$!S_
z6O5p%k~-a3y1};fx-o(eqx4j`{NUgNR#16R&v+1Gu{csbI#&r=xXgU;fj}oC|Mux1
z_jEZk9e4p+c*w)RKjkpzVg7Bm4?boE4Q%rqe89}@$ijI8w3AVQ^G2s53uvB^vD1;G
zGf)8JKtKN0?Vy1i&{<uez3L!$P6Ty~VpLf4yQ4X}3s}IHj{EU+2itUuoazqZIrvJt
z`4@9ZKDgF;;RPBj2M<E8oIYQeNv!@uBj~&a7EtG?J5c7}BMHs`7EpQF?ZI>Kp+v)3
z15ju71=Ai-^RM&63$2F#|C@g^mIwrA@XX+2$f!`~XLt$f&US+i0`*YX0on))t_)Z@
z551TRDziZ~n#eA2sI#&#FueGFoPpsbXusS}1{H>S2FN(rqTT=hdz1!&lc7WR3?5J%
z-#GXJ+{^*F4O|8Yt_KgSbUWC9`evObCz?}EurPpI5dS-GHk{P~H3~p^DP%Y3RyM|x
zlGm~sAd53*gPNV^Kx4fhUS!mRW};rsVqjnh$fyTPZvjbfIL5%xa9*SHrXgg)KmcUO
z5uWBBj3uH05MyqD)O8#KwO)B%$ATSe11d!fFLjFC==|`4um1o4*RG)8>ud)NOushh
zc3=UWVBZhoLBbQ}#*Mo`Zmef4;e{IhMV+7F^`dSU6%Oz|%5HFqeX$2Ld;8<X);dV*
z>&2S7|NmcR{Q)(!i$KS3vUI+9F*o}Ee^An6;0I3)^KW<MNV7avQrR8L5D=E31BxdZ
z4St3f=Z`W#2EIW@KD{skO_$Uk18q1tP~vyo0n#hp=B)reAL#M}{_UY02OkM=hOn`8
z`$7_f2{<wQ+zE0yV~KD8#B2|c*(FE8q0;%`1vkjWFQBLKgL*uNJ1>CFkN{nUd7wnT
z^VkkhihEJg4C?#@l#1+102NoD^GjYl1Q~MT|7-3}gKlBaZCK3U(}-Iym9QJ0e3|^^
z|9^1DsQHb^E>I`k@Z^p{kljU9|Nk$xSi}c9E^oSn7?WB(XdE9j*HU5-5S-BpQnU34
zcwlU9HE0m&h1>?vvLw*a68xPJpj((qH}f*Qc-Hv;e>eCjw%2oa3Gjke{J#i40`5<N
z_kksWV_c#2K#3pd)Yoto(3O#apr!Jl)wh%L|NoDTawswCj;RN)M&Mv5RS(Ws2(sM*
zV*85qpew{$50vnCM(}hV+5xt;u<`$Yux;HeDz7I%MgSuIfDioJ1exy;0iC$GEm(~6
zf~^8G4+DQ|KLc!9>Bfsz=+IY5ZFdI84sbB;tOs=xj)SKK)_?*R)CYW#c7%c9btHKA
zf#IbWt5<`j1vrj52rzdRh;+NLfHru$D}YW|Io4S&(fpLLgw^n5r=P%oR?sQ(VZj+Y
zKprVL3=YPKs{j8xf9-fQhnL~SCQy-Zga;CEFJ1rt|G$vw#)9cj#F_N!Z&ZU4>W{S6
z|NJd|pe25wRXZ;}gQgNe#e(3j2v9@!AE>vu;4lNj>s;^-55r3@p00v9k1?&YLL@vm
z;|9q3Q-{FTZ>j_t%e<4JpMhZ)Xj15f)C>lO?l2MXg;8nmA;W`jcTArs!6Yn|G?ka(
z#SO?!bx>D=uEkh*W5M)&5=>h4Z>B(Mo|0V1#aPM+=dpmC2f9!6#f3u*46l8_Yl93g
zy%2>vj|t+sZy?wGJ_vT*<BI?PyWK>NJBa)TE$soZctEVqPdlbg=Vf@IiQ<$<G0+u~
zwxDe;3?=@%m_Y+W2VQg^oL(!*Bm+)i%?DTwFTJ>t0X~09fT0xB?%-i4<;@V&<Y#zM
zcyRh&NhV3H%bEZG?=rpu8Wg((85G+AKB#GTCTJ37NBA*bh8OL1|NrmUGfj#~UFEP1
ze;Ge$tr2K~)bPLyohSeQH$3Jq;pN|U8QgGrA@yXszZ8?0m`CRS|B&TZleRH1EC$_r
z0SdZmDJJRqzMcR7XMi@3W`H)2g7=bw>lwoXFN#5>#1VnllFh&Wl!$cR+Hqh$AHxf|
zOn4T1evGvYw7PkhB8sCy8(d%P&-nizk`oI4H2?d<-(t%II{LCsgpHBERSmSOtWJ!P
zzqMWl)OEhu`2W8He~SQUV;Cs?cYb)WdJ-f``CER07EFUCw_hlL$|cZhI+0y(Kn;v;
zklyYC3=A)?fodCr&I%6D>9XKGx=Pa+7&@F;Ks)dM7juMVn1Moi-F{FT?8US)(CijR
zw*yOa{RzhIV2(~F7RYrT@u1$wanMRqXOMK~QBW=dP0-HW3L1ASQG-|vx~Kbv@&N{h
zj6{&J5g=o4y!cf9|9`|w@Rc4ByBQc>?*{F(Xn+{s4K@!%GITogfM^GvPG^A~_2A~o
z%gYaxodx(?KzH;&4pm|UwcbJbpJ&$!kXPeDV?e2}!<61EV_@jau<4A@*#)Yt!BzGP
z4$z$+?grqEq>yIXH_$p$cM~L$Cm@kSo$eOh?w}iuxti<iO&~Wk2}1121U2QY_cJiO
zuHOkV+VIkghGn2_TqfYw-iu-|#{$Ah196-={+Anox1veGxF+BQH=VCua4Z8IW!7BH
z!%(Tx?F_ou1hmk;^VN&@OF`@MII<Y(cY>05=c^a@mV(FKf9=@qz{l_+uKNFf*XF+p
z{H=H4qoglEXOSD;?iNwm(Etkd$}n)b4laui?U?+Xm*Ita_5c6QukW_rF3~W&w4)oO
zDj1~dFsPN)3u<L;0FBA-0-b^co@;u|VgbqtKC(>G;#nXQE>^))_f7ZaLtM@Or`O3c
zN!A}Ly$8OGs`C@L&Hf?`RD2!<%?!yfGcfEr0~(Fj0u_Qc_cAcNSOc2qI0i}n;EJHc
zJFT%=;EPnLby~NxP@1iiKnYu#Eu%oGcIOAsissH6FBC6;Rv+*OXB-4M`{5o2hRFEW
zJe{|8+<L{!Q2#;=;jj%ad<mJ)0yf_R+5AK2q2_-9ncuVr6x?9*ZC&{oUL3E4`+Ebj
zyOlxiW)P?^6;5le77{82IcRYRAH$332n{!oHK>3zC<&B`q%~FxDJXz7BsudjyhuZ6
zxQ?tLvfEi8%~k{KU<QFwr?hTwp|s|oHRVca%|GMI`FkCgrmf8U`@cjst@)?uYtbEy
z3|zvOU#ws(k$BD3{P1sD<4-{rur*RKd<-ub5Y{Y0wg&93wW1Jr9bgA*aEat&cyS(7
z)<c>MAa_mAm1oivxfaI9@M01|<}@gktdeJvW@mZF%kUz(V)_|*CZGCCHmgb{`L`cT
zJKn;;!NR~$!E~&lf`x%W1YCsn%5d>-KOB&up#?hUeisA7LID;AhBVdx_MNv5KH}rN
zkhT~kV0dW<XfMkPwIooLc%k$1jvt_MO*{#-sGWcNWytg{2Z9Td{h9dxKO^s9u=zG1
z^UZcmU#P&OR3Fy)!tm0I#4^xQ8PI|-$PR1JWeNxQJI;cx2K?3e;sq0EXD7H5u?w`d
zxSHh{gF$F`#xzjUxUiFfq4_XhaK;u*@YG)e_>?NcOPxPnD1y#PKGb|f0y-sNu#k@-
z7&gmpQ~CdYY(2PT3t3kP+S+Y+;2H0;TN@5MyJmRc*_9XF^Fdo)82$Je7$H^E<jv3q
zt>MWXDIkBG$@~9*5$Imiv}RsV=rHZFL8)9oW$KI7iU0q<NbCVGB?h1Jb`?}?l}!Er
zU*Lsz52&PuOg=4C@SZ;LDWgRFu72=I!2$52CS}Y2|6lxMAs^&`0j`V!Eq=%lbU?;*
zkTZ7g08QwC6m<Kjgk;vJ1TYFPFfiVajp)2*`LBep^Mm0feuKtiAko+F7Ako2GdT2y
zsKf;IhNwgY_4=rU^oFPeym0DgVCZdDs0S?p3Q;M59L;m_Kj<=qfFS<u7lIDH5D3WF
z1G3R;2dMci@j~!CXze!WTJ(&|AaU<a3=G{F0vXRi9Mv5R3~`3vtjk4;)4F4}GJxjF
zJcCLFnr%Vnele7ab>4V!Vfp|6jn?tL0r92moi|?0U-AEceY35EFKA(kBIwMr8!x`c
zgIewt!kq^@Z|z{z=4W^jzWo3H#UM4EH(neBC5{^}<X3<$G@T0BAzOA9v_>0LjP@xo
zFmyZkbjLZg9w-5wQ~u&(J7`3zgsoFn1+=%Zjs>*0u1u$)u7s&vt)Z@zqjWm|b4I>;
z9$$Wj=3^y0K^x0IFI~jp%g^w_WcUC7FO3x#7(koU_!(IETR=O&q2cGV@XJCz28Z4l
zm5kut7?p(J7jJsO3*$o~qgQa0^6dt#qFljP%Jp&v0|UcuM&B@RaO)F%PXc66g{cHI
z(YyEqXzmIuXL#wwy?G1_!2ucEAb+3R25J#BpI|h+1i9WCq_X)4&o@U|#u7LF?U7PD
z7#LnK8(#YUnSY<BOy}XtuUk%5vVFgK`9bI5;0#TW8C}~zWhwlgB7w}qpamJb+(B|B
zZU6sw@%~)M$Iw!LvcwMKSc1hb7J|+}0iCMb@KdKuw$T>6|Biuyp<K}L09f`oD@c|B
zd^Yut0Fa>(rJ%li>w%IG!*AUpTP0@kfer{1=msVH5>vP4f6S#Xz%o1#nQvVnneY-N
zh*WUKkC}W78EGJ+E^Gy*I-b|u;OzKX)bPM-!G)mBf84Afhd>S$S`0c5xWV?vLOuot
z(Af}RenvA$|Aeg!)A@QC#p)Mn^E14ZVg=148J>ikNPjmA<ji9(Dj5vDAu1V$2VN}e
z{Qtk@cBxLrZjfG=tqcq=W>5V8e<8;rK8D2`7Vt5EwzX|p0PY6zG4w|KiGMBK<)V^d
z^S|VbLx+n>2Iv}+5S5G<v7P__zkUj9mnzKVt7mwzIu>4qJ<qrfvf#-U1_tnH+z#0X
zG+taQ0u9fB)-#Lj`T&|&I|mxeDBQ}x@NxqSRAH|NWA;f6L(q+itLHE<yjTcog}SJK
zMw42*Sr`~HeuK>I0S(^1c)=R@|9|98&@FwI2kX0QR5&EB7pr&kf=;&SmIa+`(|8bc
zu4(h-|CT2@uS?zsHz10*UV<7TI~fizfNoXtW$27$={(nYzxmkz=Ij3%j|pB64+{>=
zkk{d7c%ixlbUtVX1H*xT|4l)`^4}B`NEzlJNscX`nA3nB)?8oW3Z8CB>8w#H=yl}*
zl|?W50{;K+bp@>{%6QQf03Mg!529RDBw7!YsALrB@H4#Z`u+cZMlgug09r`?;>DZ*
zP~lLz;iVC%)N)aYc_9bUq|q6oqSNc5lJSBUB*3BqTGZVOQt;d#G<4~rV$d0)Vggoi
z%^y4r2fo4^JncCd<mU4k|NnP`_m*~p)499lvCiL;my20In;I5^vI69QY0v}&=-zHn
zZ#_hXh4ugc|Mtz7KtpB<ogpeJ%{3|l45i%7pm9n5mV2OfUA>EnMt6vc4os;k0|NtS
z;23m`x=JJHX0`*2Cj@VSRw0L|us{Q?#0WId16snvzvcq-!B@<k2Rkn}AN=2Z`9Cv{
zig1hy3-lOy#S@A!tuP(hEGp6=Dl9M$)PsHC0@}pwqT;XvbQgLzj|ylwn(?FHZ_w5C
zoiQo`-99P~mOd&Hwffy0-4QI-pzFzRNr$Ki6!S5Aa0o~6Sf1<rC3&le^FL_2@&S?8
z=d?{!Kqp#vyQmm+hp3o9j=X04Ao#1>N5#PK_V=68F)AjCClseYn8qktAJZA4k^s7?
z5fl{6E-DtnAu2W~dMu!NY(QQ@39L>Rm5k01l^kXl6$RlC6%}v@1_gwNWvm88T_0%V
zHbkYM^Tmru(5Ax>m72~MFZ?<{qc9?!uR()e*7e}a73$?W?{$6xoz)DIJjT=OtYZ10
z^zDDp?9*Y5*Vm9*W&ACm<~aX$XV7XBXMup=jN>4?ls7Uk@NYNX1-k3F^TUhcb_UQq
z3}~3^Qi*uyjsKzx7Vt5EF3<t>^g2JhnBNAv{AWjk_*_1Q7jq*2|KG{X$iM);i>vd)
zi!%|^9cM6#dTfn=l@BjL8+Jgh&xG|+A&qpU&KoaMJwd6zgg-drImjtp8$hdoUspp$
z9bVrAwFBqRV3e<C*X3t;5xjwcA@a3raE20y=ehypY-Vu%2Dbc#W(4?P>1dwT+a>bB
z8Ll8z@=#TvA+%j~pe_S*#Q*=VkL?mJWMJ6Q*1*8<VzL*g;M`>{1QTfT0@tuCtp`dq
zc1dV5Fzl!YE6j!{JOB~_3q(N_ih{0~<lipbDXQWH8ctwXtN=P4l6?UKs3dj)<yp}B
zu7H4EAC&-b$^Rm}je#LHqT59!=KF<}3IYra{H^C085nkgMt1m(__uxF-}QilzZul9
z1)b3uw+VDO+a<%3JN|>3qrWo#{|A>p8J#sMIo+b50^RU{L+8PR4+Shw6|o+3VM%9e
z{=rfDraMF>quWO%XGZ`?-yx8`+nq5g8J#gIIo-S<eW1Exx<Lk`Og%&)=xomy%^-y!
z>motgN;Cfd-<<(otK8|MlF{h{(+j%VgkP88gF2((B`3>+Ad5xPSy@4qXY(&4+dFT(
zFwFS>-?{O30TTm5>5kqUm5|Wh8kK->P>A$~sQBz)V5nzkc%jn@s@r#i1|=G6R9x5@
z7#hl?LlLSt7#JE}u(yH|XpD+aWW3@3-WGe%x_VHd_u^doe-NJ$<kCxqCtvJK|Nr0J
z@?ZV!Zc$J{-pvat)OUcCzgV39|Nla;peRVttK;Urdhn3b_sh?|9aJb`>HKc^?fbRw
z*A<T`UT-`HTK&`csq^O!kl8QN)Bpe9#m2(`+Mo@NkFa#mkdfiZ9XX&RC!GBMf9FN$
z9#GJzr4=aI8Nt+mkAHX%n&CXWIK`Wv;f3cKP(nUXZ+W<w6(X|aGy_AUEl3h{tpk7i
zac0owXoUrQ3@QPhLAyW=z8xUmi^M6Q4aN4Li}|2UQZ9(ZvpJwKC{XI=%?8!O;Jd@8
zfU05efa1!v3=A&|ktRrAPhptu_mWZ4U|)+a_*!oUhTaN+&r6Rxs4y@*_}A;B;?o<V
z;sHy_5zu6u-8_BjOGd}QP8OA3SI`0u4#RJqhpkOPPA?7xpV9+f0BAP_v@4IH^FxO-
zV;74`hci>>hXXG_M>%%0v^se6Gjx8u{G#~*W9K38jP}I`(-mGZN@^|cysurO!g26F
zQ|AA(XU?4Iyw_|Cx?hK(M5VWw13c^jHvY`y>8Y<6<waIcW?(qR#;AGY;16a{rPk%5
z!ZUr&D@Musy2+s9YB-n}1R0OJ@qnuMUU#NW7ZrovI00}8+5Cc~lSKt|oPq)a!*LfC
z4Nz)mwo&=R-*OsM<FTl8Gl0%O=14pEf`h*mbZ{eR%`69`)co<Hq7k(JLq!5~TD6ag
z#V#ArV!R(O5*tC?i{|<o6$^%vQc$t2`r|(XgSCr_MyUYktP6!M9~BAEmb{49+@M=b
zpe_KH5+JF|57IbYR1^??-8zYZ;W#rh10%yRXBGyKiD?I4Fduxt1XA4__@DDahcoLj
zXEuh;A05u@&4<AYNCF&KARc_F4L&8>@Fe8ql6#;zR2CIO$XO-eune2Tz_3GskAb1{
zC&*bwAiEeq=Tq`@IJ0zkgN^R+p3eS;QJaxxy73!E?Rw@I6@#?SSf#YiP|)nk_X(gg
zeA&Sl6@c%y&UmqXA~;YpK;5Ly9F-i9FAEqUr~bY;4pQ%;QUq?vn9Tw=oRpLP|KBkY
zl$#EKCM*x{SOsEl0kMyPR{eN0g4)=So4M-2Yqc1ff6DWNr+`2uTIUT&PaLvLtNDjK
ze=BIWW@C*?2Izoh{#MXrYIh6xj`&U&l^8=%sh9wYkh)G6l@M@`s6_=-U4lyPl7QY2
zm6Xm8FZ^af<|CkqB19#oxkjZvfuWSU+eIbB_WyqdhBA>|1)!x?j-ZnB(+UQLmkU8j
zVG7tPPztI8?{5Kn_Iy7BgNBPr4(Jk#+~!vTy)G&hFF>7V4HuPKu!@=)|Np;?;Rao6
zAyFCtKF@3y=*(xZq*pB{5K8MUdwo<&dP7tyK-(WXKfG8q^Z$R)){PQv@TovxwW$!R
za>1M)kg4q43=A2ELBT4qf`K7o2k1nZ7k^U04N1@*J&|1vpz?wP<d5Ybe_Z1Nt;1{p
z^*KPzvKLSL89+UVl6n=N&JvXnkQgW^S^t1;4q^d~#QT5(F9IBRh6i5!0G$Npq9PC<
z3mVAl1Wn84sKoTfN*s4(03Bc4c@t8Nw}R9`j!G&~C}Ux~{953+tAta2az@&5XO?1y
z-dH*CVaA}nbPOG?EcKl?!CPMp54`YR3Mz;}Gmr|P22dC1s<j`CWh{(`U-KVlMi|k2
zn5`p}HSM@78^epvo8XJD3=h2EMY324tRK{f`UTQ|`L*D_pP-VF8x)!MKQC!M%-!M2
zam<yIp|{?bYZqvxhv5P6cEHvHrNYqc+Uv^o;!qz0!!cJbj$U6O@Nr0>e%TUGqo<TD
z?YOHD152;32>1|7!vimRArdUdTtygreMNVPf)<S(cu@uy7G>!5g&YHAc;H1mRJi__
ztJwcuU-4by5ak|F@nf#ypo1X5E7eMvonNybb7o{{KFsvrMa8G{hUN=P7nP7=(7E0r
zoiQpg&>}wOzlln(iwdlOcV7bP(1W(6^0(%IVys3brZ-;tI6I>>10yuToWO<Ei%W|^
z%Rs>=T$RX{L88rF8WHBb@roN5!H3OtxU)c`45D+!;_0_OFq+gSAxtP^WxVXx`Juy|
zt@9@2&@Ir&{R;;yD%gATIXYj0;}Bw;^kQ)E@<9tA&;poV28LdL=owjHgT5~Ut6@3j
zE&;Lubg0k{Yp~3{MR0Gx9U<9y6MXX}#QZ&2R7^kckx@e#BMd=fFE6%&)E|$C0v-9i
ze>(RkM%j7?kPtM9gTm_CYk}j=B9O3h110fdsSS+#LGI~rX6f~21*h*FVAEJ(E_Y^S
z?EJWk4KzszmUsi&vjs7;jFs`4JE;6;18v}gt2hNyVfPDk2pL2Pd*??;*ntgM0aJpc
zf}_`)6MTmt!~v}fr{Dd=C?S)*5E_KeT+F@R+~Cc{5EX$7rwe{&lrT4ktKebk_2%6L
z8cc+!kcG&w8ouq!=7pbv26h3{!s!X086{+1EPxp=!~j1q46NeZg6UH}Gg=se8W}}y
z7-0^Y^LTN10i>WVRqifPi2>g!xM11zzn>Xp!KX1n`oqkopayXBbq4T`4Diw|R?zsu
z!5@5`M={I=?Mi$RvH-Le0#ts@1r-FJ`Pcjw0oibzO@N<4px2KDT!ifatGzoP>H{|x
z#$G>Y915g^8iR-7Qmo9qe$eygz?xRVW!TtufQ}Gs{QdvGJVQAvsIAS_>BgRR+>QI+
z|Fq6L-n8Rx{0t1u#{@wcy17OrM4%kBxHUu&<g$|Kf4?w_TX6J7{BL{=@{}`%hd}CH
z6wm+vKOS`8s%m$QN(^XWb?1*4dCRB!d}Wjd7vZ3x4S1OV+A{q@dp@LkDRlw$Jf?Sl
zWps)Kjb1U7ayHw72D2DSiZLt$>)bjIv{t+IKxr^|(5oAKCRXP`{xugxKwY8Z48r`3
z!p9w0KzBbMe8|;!@c(~%hE9*^OTRLzVLAppN$E5X>KJdZV@kd;dTKx%V+3_fsV1@)
zKs7sfrSprUbEiN3#;9$G6hy7xO1Z$JV+UV|XdcG!1K7gMxzioLGd7AWX=7mM^@f!E
z5Cc2sOuzP>QA-!yx^5R0nHQ7i{Qv*oMMWkux)HPpj*)?(^m?=HnT6AJe=wTYgGyu;
z(6zWR+Bqsbptc0)7zya2&$PzB5lrRmFSug<|9{QFzy0V7*%(ld72Ku|0oBo<!+>67
z&tqVC30m9Kc^q^zAOH5VpO@^E2UQ86^Ug9}%xi_V!Ge9`LG7<xd8T77D*2$rOZ6O}
zhDpJ37nO>57hlg~E-E$gX`MMLb)9p-&6aK!m9$PsbLd!$3TT(13ZfBH(gJD3fEq90
zt?)0BAR>?!j7l$fAr8-rJ)z)JRbzI5k2doLc>yxi*J4)>+TZJ<5(8?pH$SKct#mCB
z*<}Or+AUCa5u3}v@DemV0cv9$e8Jw!aul4)PewuKBuk;HAAwY-fK)$%>~%A|)CpP#
z#?hO>vIBH&qPB|)2dJ418ns~r)qp(weM^|@85p`<|1|$#=5J|cWMC*42DKn$ntw3y
zx7=i4V0c*#Is*F#3xCUL(8AJOkkPdkz3%^8fAF`iWME+Ea<#ExEaBUiu#k_zhN*<>
zCFo4FeW3lQ4YlSB{H@@f*(@sE5}hwz#0CEU-_4`aD|55cnFTb$FUQPa!T`C-0<>jU
zfEm>EZvHP&%nGi+IzPPl83C$<L0fKjser;H9OS0v>HB{%D%Jaj{Qv)&x3d`3%>U2u
z614jnq6oC!=j9^M4#C<2@Mg!1P8XFN@U<5&#4JGu_PSbt&V%6uaX=@?ShjvEG3|B(
z?K{`&j$-MIQITl9U82mtEw-fdC*#c`$!;^tK2Vdmh`-nSf5T7qa`xVO@BghgOZazj
zfZPSzr}EN(iGhLfM{kWvM(454o1d3-*QiJ^)~IAOhp6N*bRO?5QON)azvKluO+=;h
z#fwf0&^Gke10{yt4j{|5x@#>uYg8n<IlDK4th4-HEZ*&F(;e&3dEW36<9+@~hb;dU
zv9w+);onvN26R*gXg=a4sB-QuQITLg#(1Lh){A3}3=A4<FPDQFEwu&Rt|g#Nkcfcj
zeDPv8XwdX9G!$4tjyMGBTBJd{7I7e*AP4cc1cR8R6`i0Hz&m|Z6c~T<H`y~XFj#ii
zgB-};WDHUu)a|1pVci85X;uUs8WHxt;TJo9J7_%&SZ{CO|JGCdt*ngTJAFZG^(4S9
z0xjg10G(eA8x`#QV8c<OdGI0Vc3`js|Jn<eUqJ>YE`Ux4;BN)3;%Pll&)*8FC7NwP
z_fasE@HFlQO#@DE<z*-l*`)#Mhdcw#)$O0j0GV&&-#!_1*dC}C@V`Vwq4Vd9Ei*x*
zDWMgSmWN6Uc7U3YFII(vk_UJ-)EQ9l9s=d6A2S&kUdMI2sAP19sN{6Ab%wDt?(P7s
zVFlYJyh{LN8#Ac45Hu6C66`g5T6Z(Zvb0V&p3XXsF4u|<H@;ps{#`PlQ4e?B|Nmd}
z?*dzJ7G#0UOa_MLw+%0S{(u)~zo-CZ6c-ha7x{tz|GyRl^>kmP1pfaIx=Rt%Io}I9
z+OvMQz8^nB^WzVl@0*{0u)JR+)_Je<mFBI^8!t9EfU4h0_U6L^ub+WtIzaPnpusdx
zP>3YX`Tu_xiyl9N;ei+5r$dTU{uX~wJQgc}REdL_)u6U;45$|q5MX$+^H=AG7md#U
zL95pITfTwzan-x1WPqe20>I;tU=<0@peo6MzvU`u;Gjgsr@KZ4v`Z-Be~C&&cv!D9
zM?eOz9zVm2@6$nZ3KGr#8Ok`r!!qpj_!(Xcb$;z;vn|UkDk%{O56g%KsXGr=#{)Uw
z!H=ca@qhCV#xkM6@UV>fI*@|(U<CrNGrHY4b_HwkGc^B@Di`P$X;qlY$IyDIloc#^
zoJ9q6;fQA``*9YPXf1w*|0XIy0iZHBJS<}=$eeVrIiMZU%|Dn*_&_6wqMfgHJapz`
zc+KAVYR8fnybLd<hd@KF^Tx}=R-jYKK^0ml|1KL)0sx)o^dfXR14G7Hkcnc`85km9
zb9E)&8%&-#8y<M(@XTRD*Ys10ObYcIx<Dr?wjAK^bObFt0v)CDVg_ic`7rogY4CpM
z49Kukj7mf>sQLy?^%@>{k)O-J5FguIqvF9(A_Yp&0dQGRQNZxRFBfz|<~J9W3<3U@
zjQ{`tKS}I73citp@mb=A4Pci{&ro6#6S&^_;#s2RIm!E(=V#6{W7sjhPl-vQUiMl7
zKSPI%isApg|NsAIF#KkDwDY6n#bOcX<^zn)mq7P&GG2TIZl%9|()qLHWC>>nOb_dJ
zZU%<kJGeoe<?o*t-$~#Ho%44i0p!0f9+k@vc7i4?4KIEF7?8oM&(H8;<5bYd=gaxv
zt59B??q*<M2Nn1))=ZqPsmwH~e#cBchFwelfrgi%tJMq-yvVct|9_Vj%7i^=ocl$X
z?f?HfLIQk^Ud&hp9wHFl5#k)+_@WEKlX=O{$iUEC!Qx%^ygR_5+rj0<6*o|3DG_~r
ztvf)i+d=EaVXy#y>r+qz;&x~Kjqf*_9~k_faK@9Lq4hwCO!i@e-VFyl`5FFCxZ=sr
z&>_13#10eaIP{vo*O?JK_1^r0sq~oPr4CUQUw(#`OZ+V}89?h18fWq`Fuur32e}MV
zH#YoYEa3s&6<7TtFdV$2<BvPYJ*C;bH7W(5QIC3t&#RBSsDLiH1C7q*fSO{URPiE0
zAEdBE3p8up>!VW89ikHRLbr{9AxkDWOQ!QCq=N+NNxeAI4$5vkyCn7b8Nllv8;^hr
zOVF0wmrfm^!<Jy&!~a?T`0_LC;7H<Uc=<AofgxD7@r?**r}$ymnC62Q)zu8(I|yEQ
z9h%Oj!DJ|P?I6fUrDq$!`Qccvi;C#3OQ5*bn;xjaq+UN2BHshvdJaBxF-z{nQqb)G
z;TM(apqU+>&Kr$KK=wp~m+f{Q>%81~9x_$WSfcs@G<FBNV5>wbAUI=}0YB)(uvD;q
z&^|J6kO=~<|0~(LZ9xZ#26uk!`~~T5sRaH1AE5~HDA?S_HziCApy@px(D7uj{oV;x
z(<L>TWb0YLQ@alQEgP8`7&b3xs8L~NC}G;Xq2oqxDBHUipsT?;T~q`zSwV>!v?ZF=
z-ie=Kr-KvdeA4e9nL!)nOglhB+DBg`#)4NGrZY1zK(xOB9S*P|v^SLL-G)`Yq0H}k
zLz&+6hB9{?d}FhUf9ipTpY@^qQx9=m;BN&TuwoUXBEa9O3EDB?q5|4MQPBF0zjYa?
zTm=oAZMW$Boz`8z)O?I-17GK-caUYQXWJPVHgJKspp%kcG<f{~-}&Rk#mNi|4kek*
zhuI)La)K<;RBQ)_gusRkowwd~{&=yo9<0u(^VS=i4JFE;eK{{e+d&aqa(9;qXl-y2
zsIs~}k%8g0?1lxMx860>s5mH;3U>YkpF0d*3;sfIG6TZ~j?Pc-c7g`~dP7u7Kq38N
zeKa_+3igJwzX9FN44Ul$pTQ4Tu{~(|2`wg#`jZCy3~9~(SxZ^>9x~u(=yg#kd2w1D
zR4s$fB?BpcG1vV6|In}i{%y_%0o~3z{M#Hj0x~W@QiUXFB<ol}#wP=Qh8I2)K<Qou
zWE_9%98k3eQtfTPzb$~h+d<$(187j?IM@i7;PiZLCbqZ?(BRKc@Dg_Ozo5mIpk<Mu
z%>_t4Wt{{HR<WI+J1s!Y0{e4m6xg3!;L)C!p!yarwIvWz*Ook<enp!p9W*J+GTl*!
zNmDRG4YULm?ma8B>D4++GCJQNK3WTM<gw->3Q$ko?E@`o)ZyO-bF#n-xkc0Cw3)=~
z*+5Dm&i>>F$`m}{7%$ZV9fYR`x)NSB@qU`EqeF=V*nzJ>drO!ZOF)O*F*CkY{R29^
z2$VzM8K(1ScYsZ|gU$;<P>18ii-N`f|2ve(L)MNKgU;LpEt8enwF9(vw7v_}zPQ)N
zz|i>uWWvkBsQ>?Wg8ILm$3X{kbiR18(e3|#(0&tVofiip|NrlHHh3`)B;;)JVj7sX
zc+uzf|3A`dQw5ME&d94x`M@H`t4;rSgGR18>zysSogvFjt4$b6K!=eUL0mQ)<S;jI
zz!|*I16ySBLJdq?ypVJI|GyJ_5bH}}kWjEqx3^ArCI_h9^WueCDFXw<#oZ1Z|BFq)
z1Dr1ekVU~uy<Z5Ff;v+$&CMqS1Hj^)FJ3$;0Uh4v^1s+7L&=bz;RP>fagn!2cd$$I
z5sA(lpyL}$Il%#D?+Y3xh>v|K`3rJLTJswVP=6S-MxnPxMbz*Bc;WQtRmWUZL>Bbc
zsHk+F096tUpI3LgsMLcyc*k5+bQD0{Ts=lm?g0(%n1Cy#UX#0^Ix?-ZM8$xA`>_}8
zph?|Bpks!1>435~=-9m%%DoH>&8Ppr1l@W9Qe>J7E+wQu%OQGQR8(HP*~P%nU7`ZI
zT)woM?S*JA1H-`=%$-Lq4;R(*c7E?=IR<K18Qy;F+WFzdF_-`UJ72$UOY3&Y=V*HX
zItt+B!G|oDAI#)rQQ-_xVR3E#%ToFfeEveIAauXWf6!@MKNy=YGc+IPu&z<zDG@My
zYj^;(q{2mo<@M&~)Big^yvPO_eWUq^1t{P^X96|9skeaLJelJHxf3a|^BDj3AD|0t
zo&Nt156-Xy1^>iu28P}+o()Xznvd`pe%omQs^~9uK6p`6%)oGrMWvB{J7^9~q%%fE
zr}IOHi;BrH7Zp>6&KebiU6!GIpi^v9{{8>&*8Gp7^bo`W;L4@B{!K*Z(SVFdkR`g^
z;AJ;4Dm*(t=D*1HgbvGz?79Ownh8{Dyx7^z!0=KGw50rS=c^a5Z9wVpMZM<#|DD&H
zpEH)|8y;wW1U`<g^TrEZt^fbQ!<C&kUYHnyRem!7pGC(J3O<YOwPby-j|$5!P|@Fc
z<HgTH&@x=1(2R1BbLMw}PI&?M&cTDqoi|>5F!=x9@W0_V&}Okt7L}a=;9%$l^*c(7
z7#NPZsBk3kZwGDP1yz_b;O?49XO4<RXN*cfH;YOq_(0JTl@L%`3u9nteOq558k(`d
zke?w7G@s)U@WQ(tR0s*|Iv36dN{SpW^ud>aRWcbKU_9>D_zyG{Roc+{zf`>Q#*5_!
zU{6hV0*{)oyy$ZRX-4e)Z+;U2IxKJ%$U7H1QA3yC<NyEo*!ot`4V+s*!3(;Tr1=O~
z^UJU<(1C%SpI+Qf0v!ry#!wQ{dE<q&#{d7FSDT+QmV(ZJROV-RZG;@$2Q{FF|8?GY
zaY7&LvM&Aq|M!DtK~`{-ibKx-d*Rs$4p;D*OrXIO2IMHHEC59TM_9%YLw<(WS2}++
zgU^`jyz!!3AGAf%@IRKY|5E@Dd$vv&6`9Tw6%%mSqlSA8BHX`$uCjP($j?v@3-@cS
zpr8W{|5&sh0BuP_j+C7cNkpW~1)pyNj+CSBjsHQB!rz+w|NsBix21BOH(m%rywB(e
zi5OV0eslm?0uEwu@^5@o4?2PdbUs5T=!jTQLlry;>heOX0Nh~o=&ezSfDG;Ycp(Py
zXN1r(7nK;5V=gK_3ZQYcP8SuI&Ki}F<1Q+Gj0`HEWaILp5wv)cMFlkY{0y{K3^Jv-
zlM~brby1OeVI~7UovU8zMFfa7MFrHH-3c1y?R8Nxejx!81Tm~Yj43LhL6hDR6<%=3
z+4<qc4{7jDFBuu|(MuH_2b&+tclfA)&Wx=*@RGg5M}>`l+r^;f2l4@7y)G*Dpl+{L
zKxoECP*U`62hR~JbvR4ZHy@E{s8L~OEwxJnox;m;+!?%^=eV-~sM`+GYYx(@6cC!B
zV+3x*o}2yue>dn7uS1<TUKo7&|NkZE@Dz|C45iY&E-EfBPCzz<NM-%ca5v&-cyXr<
z)LlBxq5?AV<xSAi8PM=KXxViAiz9j9#1o+k3r```@Z^AmrwQ0h{??hGCXtJZ(2MAF
z(7}12#nv&sE-K34I5NESqBIY5vw(|=@;rg#E-JbV3=E)CBYhM)YgAl7lf{roQh*qG
ze+#Job5Tin!Iutd1AhP=Xxi<f5&`a*Y)fKbcrDTmy0_zf8eAH*-4D{G1f3=oEC9L}
zo~cA6EHont<kwHFp!OTjOK|WN3&4&(4b5l-$zEw?0NJbuj>cV5(){uaFV;kXbbyv>
zw@!eh4!CDl<xbyg!X)hwq7u;=g6w{2kSQ)Nc(#Drx~1;?+d@>5K&KjRb5Th?_<)1+
z0{^xWl@!inB|7}ud{k1WOPDfQ)X#^+->I2M@#pCZ$`KN;nL)>7v#2y40p$m9^#oa`
z4jLQnJlw6(?EtE%MY??%K<7(zzW6WLdZ1p3zjYDl+yz&G7k8^bF5z#T!~r`CZL9VF
z|F6$?yK*!iV0p2@>i_?GgyuldSZYT#2WT6TL^pGH0Y^ifU>$$^83x#4+ZERTL5IrO
z?F8N7V|d{6D*kQG65TAVf9CTsq;<NeIQ9Cd*nyWo^ltwDA38V-T09CW*#j6@`L~4$
zg0JZg0x!J^F+AB@4_b7-q!2u14jQ@S=?-S;yz%0}zW@JUhl9JAFPN?W|L<}Wbm(vs
z>~NOs4rT$_(s|>B7R-(kz3x!Zs+l5|<1Q)z4QvdcdwN4aM{j^sg2p;tI2D4M(_$}E
z*%=s+yv!5uvWK04q02|bm4DmCw8k10hyP4v?4U(s43{6JHUDDgZ!>0RVCV&%3kUNx
z=%R7ZZABUow=M?V=5Y+_+kexg&6#BC_ZEQc<8OTkI$CABi%QT7R!77@djV*R-(OHC
zXk#-2!^=Hv3=C=AE-FEwFth=UY=@|rb$)nJ0X3wH4ZH`Lf4c)ynzf5c5Pxe0NW?~k
zf15w(gb5eWRbia1C;3|vKqoF-<KI?q#rVrIM1_OD$)AmZp`nhErSzpI|F$~T&L1|M
zC6YEArQBU^>^1=<d^Sn1Ic%6q4>#1YF_!M_c4p}Y85_<Di7`%)SAz^scKWD*A`28(
zPx8TW#RDosKe2)x2Fh~90wCuxv#4l(=yVq0?Q&za;pA@x?LF^yp6+bHq*vbp(g@nY
z(K-cmz6fZ68n{#scyTimT&jnFY!~PZQHcQM9K+5Kl^jrf?pVOb&`>SGTw2jB-0cNA
z*!5%yhf_Caw<pW%FCb@{De!=t3A(j6M8&E%M8)idL_R3^OWa;+vVv!9%#@kyIT(7~
zz<01)fi&5GvwX~p5_9mBiWz9a2z(Lyi@SNC=1gaeN({)0FIgBE+&~-U4K0t=Yy&Y&
z7!SNKvjEo<0WV(L|NsBLM5Q2OBd8$ZZDe4GjBBn@DPWX50BXIyoCrF3hl9U02UMpw
z)UgNfx2^@>qUOfd8}J)+ke;LsQ;BF+KtRSdkO^lRK*bKv%LY(!3|gcHYlZcTfrFjH
z@FYy679?^UyflHo1$445XeLA!R1o{9aDX%61<=(XpxK(AhL<|!Z@f4N;e$>W;b7oz
z0iDDI(gV6awcC06JxeAjpL4mO)gPT9Dhi;p<w4#x10AOUZa2t)#w;L>P-i<(M-x1}
z?E`A@g9@Y<>lzpsUKc`J!7o0iPj|6mQmvQhbT<GE0d%^Xbb{)pT@yi56}xzi`9asx
zB|)yx63GxX=4W^@2ej<v2RL*iUV|oLLDwxa{C80i=&n&wu&hxL;O~n8ZC$NVkzpt`
zea!_fMkGLovt?L<42TBR93d(^oi|<>?*g9|SufLh<Auhq|NkRFhZcdVx`sOTB>vVD
zpt+M`0sd`nZ2a58*lpNKSsQ*Om52ldWW<3?5~_zp#7@vkNN`*l{s)Hw2WVs)G(-!&
z|62mop#pDU?s8+aQ7JLBF({F=VdZb>0u8W~s7Ta<Mq5Bv!N25XWMIgc2r_$n9Rou|
zcZrI`%b%c`FE=I|<`S=RX&c58JsYOdXQ0zV!14EBEhNrg&$nSIJr5T?2@&Rb-2oTc
z1`(2YSp?es>!Tt7*1urw|Nr%!$6v;Qt|}=}5qKF22|G~agVI*(|B@Q;lJt_&oi4CO
zd%z3XGzNw)cb4WCOwAAe+AwY?5@G0YQ3>dbQK{+N0-4MNB`U~dX6GJo8woV4*x8~2
znyWB8(AlB_sxx<~2J<o0_qwPAytw-Tlpp!~V?bfB7Ze6tYZ(|Kz~dr)JHQbIx-GPM
z$N&GJOEzCrLBv4un7`xy|CeT<gQM%%82MX4hZ;bRBmpgC=)Cd5Ll~MA1v2h}434Q~
zV2FGPnjZp{aE$e(HT>J%S$YG0q&5HIDB}po_+-q_@Vc%Ww9__>2~@x+a)VCL3xT(T
z4NrorjFnknH@EHv#iTR1YEk530OhO@cwyKI+A#97^VW_Fpu1_BwnKDuGB7Y?$e8dm
zyiT;KXDY3OIN)zu^Dovi{(uZK6Mlvl+iSo_=qC|&hZ5Kwr52qad(MFDkp|mSs+JK8
zGAXwPw4|FI9Fe6$pra`Mn1H8vz(>l|zXl7vG679|A9qn<0c8P5y(O_7yt|u)p_B)?
zMg(;w7+n?q`$~X@Qb9Qz)be<_!sP$|ZdZ`^16W=^0<}Xx*N-0WytV_BbY4hWf&5-7
zxXS@l9)K=dc+pk^+LT+>dAQpReBVc&MYo#?=!CLvHv`aEM0c4EG}(3Dc(FDaGzW~D
z=$Jc;bwG1goz9>Vgr(Ejq%+$B)M0eC>8y4DPZX8(f=iPU6MoQ!BAL%1N0e}N-gxoL
z`2YXr6aSm*L3fPC!;XAA-gy;LfaO?%RF;bD+5y@JJDY)l;l<5r28NfQ;q}hLU9Kje
z8^pUy4Z3r6paojzjTc<Wpe48s{M%g_I-Ny2vvojMj(0elfR+iFb`~4(Z#x01xtM#M
znF2aryf_Ftny!AEvngnR(Inu1u}(&f3AnLd2igsLoPV3QDgU-$6VT!I-k@XA4uaEu
z<R{P=W#^9<mLM-2k!bw}_K-G+ckX}ZhbT~VfICW{F`dKURRk}zj3MI`Ww3DyFGKJ+
zMVCA%iTGE61}a20IG_(ySS3w!U{Vyn5)2-UP<jgrluALvx1EnVU%Xg9-NJ!MwjLg4
z>=q#DQjuLtKw)+g6lNt=3=H6{Y&gSgX(A}h8u5hLk8n`4m^~~sV+|y9^gv+&51smM
zXPw?+rmz=Iy`WRx5JC1FbaWXc$i9M3gFe>z<Hc1&aKjlIWXC}~)F2D&gnP%*9O|7M
zkaxg~B$icTCV_g?G;lou<ewHi{y|9teLWyYBPW4f5Knr85-!}6pd=uH@Q)hIKWv8o
z>;E^y)4&gd|Nom&J=FXrpz}B+4SY8Mrvd&J&>%wRVbB;Ei%RE@7XqL=pG;K3`M0|Z
z1!SB6B?!I>(8X;G3=W;Q-uDKZ>;QFu-}h#N?vQ!)eg^{sn^Whl_d7ug<MuJ-ESzrb
z#H1k8`RaXdu*;4)Gx-?a8{UTI3h=S^tK+9vIWbAsgR-WJipMVYFz_gi#Ebq{pdhXk
zHhc>@!@2Xt3*Ud>UGf~I@12`}vzIPyJ`w;=&5dtBr$Tie?Y#Ell;{8d9f!N!behlq
zZ#_`L%fCI$r}O2Dlb|!oj(59(MrPGRL4rX68ShN^p|@1mgYQpN2koEy@xt8`R4sru
z{{H`8D%bFsu|zVIf4iGcK=Uz^unb;PPzSgSRK*Ltmfryyv3l{=1Tw5%D!%IkXygZU
zcF2p&at4Ox6aQa=E;LN*cJl$X(3!g3K%G{WZZ{8bF$ONpc)H8#b)Z9Eoi|>z#(|Pa
z0^~9YNHN9(DaJTDojpKBY^SpesLjum*6Hk%)|u_s`mIDHEaN3)(978*;6;2fC@l*>
z2BJj*VB=vRDHoWOPV0dZA^z>&e*D{med@v4<WuMW{}G)(cZHjRi^PrKJY52+N&EHw
z|9@%tA2c)%3Tb%2gUfM95-RopMHoN$u;9+4oj+cz)Bz12XC#BdYh5V=!*N&8s15_T
zB_z@tq9W4y;svi2$e}!j)5Tnv`06(rLxWLdSIZ1Oh8>)s5p$U`28NfQCdW?D7^dN+
z7jdx+496In`M0x!O41J<&IZSv4H-JKbwFvz*#uOA8lD8-ye`%G|9=)kSa?RGDY)!>
z06N&sMMVNCy#aLg8~9qv&KocGy!l`MA2ikly7S@13|)}BK&@RCh7!=m;&xr|V5<Xv
zt2d}2gj6#$zL5YOc6JPO75Xla6CuY@yn?K;l-xA|R7Cs$UmpTe2nxEFo~5ACz@4C7
z^x%Gsz>BUJ1_my$4?AzXsEe7d=gOp1pQ9qsnXPf$SqG%BGn#{cyPFXBs5OokTRIpR
zIw7M`;C4HUinWW10Dm(mb{cAV82DR$gW89#oE<JIEd1MQIUseHsS!Mc8$j*?W%m~g
zN*EYkf_my;`wcI>coYo^;ih^>5=`rM6G{VBpg%gC&AMDvSUQ}|p;asRWDJO>!H1&l
z1`VG&>wp{gVDle<N_xi<28P#}pbi0Oxid@W5B_aGK(Pcmg$!I1N4A4|LLA{?8IvF}
zB@2q0dKVSY$#gPcHLpSEt$`v-rSry%@1WDJk9UKn0<LO<W2*Ik2|uVLJf;mECfyI3
ztYuLFoh119A1Kwrf*xA=@qp?&2Jrg)7xz6FAgtye%;l`$#N7Ge#Vl=5dN`T}>gBY7
zx?S7Bga031Y}Wk$|G$Y!SjHw$!roQ{>VLZlH6P(gvlV11;pv?Ux}PMi`G;sJb8o1`
zTUGFR&xfHs02b>Q6&C&$(2}G^Py}t@ZvmYGS1t<XC6pL~=?Nuzpt+BF1~BhHi6@x;
zz~2gLBWGL#*=t_}YO1~i9m5ZrPia0c0E(vO7tv|WKP1WpcCj)zF!C=xRLllC(DpTJ
zZ>U1&kN2<rL5g}kmZmlTlqfgZ0a0|KSZfDpc%t*w`?T)||Nbvk*$=w@vh!8_ThO@^
zJ3wQoFCJ<9|L<S=<~3(;r~+8^`~4t2J3uO5w17tLAV;-wyf_D5Sx~C?Vtp<oXz+zg
zj0%h8;gaL8nL2ND9)9`oANcMAkpB`285rs#qFxJvmdt?;r3UAl@;{)+<^i$65!v_#
z)TV!Nx8nc*7jw7&|NkP_1vF|^!umpB&Hw)yLgxGoFT@KGhc0M?1nSj5cU1WDGk`~G
z3{UQG28m{ZMBji!L30;|CwD}d*Ml}af`mb*eZv$Nf)v|=L|^#wGrTBwXJF{<03F$F
zcxeadBElDIA{ZFJdzyM9{=|Zh#d-jmT)FWgniEt&mU47M&fj>ltIeFBVFzeU(2E9F
zkh4oQclE)Aa$Onf89;Lh$65a*@Pl^EF&tz4l)%rx__7ML-*Y-#r3*x}_^!EdAw#eb
ze@i$><s!JS6j-=abJudX5IaOj4BZxvmm;7O5_heKtGove+EUG3``|*SAwp2ipib2>
z)(;@ZzPu0a_z0xgvI+9HZUJ8|3i1VLA;>N>V+MvDY=R67FT}V&AyQ(M*3IzZhr<8=
zi+?2WGwfm#WMJ5#B*4H>|Kb}bXil~H#Q)YyC0_j7nRbD?6fah|g74^SKEU?cbQh-y
z%(Rmr#m8C?l&FKuTM07{bVw4YOZlP@rj2>=mjr%>*Y+7lL2>yz545`vWHV@*={PG$
z4z#>A{&l@vnr&M{sRVl1FdSq3n844#YzV(QX5)<i|6iwOd;^)cCJzz+am~N~l=!AK
zR*N(+m)dsTc;RIaYM{3sC@~1mkg?!rcu|+fz`(y9c^hq#80cga;hl`2%jG&hykMRV
zTJ!!ImTcBRZQWr3(*7QFh0B2#&TRkxH`;<uWCta|60YN{Pe3PNFz_&dc4qDX-~ZdE
z3@ZA;<r!#57<7eGh9k&~Ke-GH-L{}h1Jk-qoj{i>rGDUNh=@w7Z~Vvbp_Dbv@_mU8
z|Muen{M(NOWW<29oC0O-PFs~keulJ8Q?*2XhGVRkK<kP?_s2<ROaiG{23DgBR&$&c
zq=w-`{EkJJKzFEuEj!K%vW($FTBq!lnS2br!OR<&-}MGFZD4!{-aGoDez^lUTX4Pb
zTJit?ix}nq|6df&`2Qc46~PyR?^FV%A^w&^dC)E`rc$F9li5KcrJ4&B7V?1>ODQy4
zFqBGX>;gGTD3^gD<0Xi-zX!C}`K6US1H-N(oZ!u*uR-FOO8@^u7hBiEEcyqM2!u#<
zfbId@1Kyj)z~A8{23l+RLQfSm$@b0g(hdPjeufvXL6y+q9jDCr8Cq|bFm>Jt0IxTC
z;R9M(cjJY=>i_?}Q&iS~#>Uk^>UV?GyQpwPMILiekpSg-#oj3@OF*kTcbI|{%myg{
z*Y+(7MZvQx5{%&akzJsIVMokDK86>5peb7y6&0vBXgMEP+zcWPIyPDbv>xF=so<`N
znS2a8DnWJgmK+9#*Ja?#vB2j@s=W9b%mCWgsB)a4KFrD0Xr~%z3Zq2@l!;&53I@%^
zw5VJFT@~ODs(+gw@PpQ-gI2+UxCdXbfViNU&t9k=B^B_Lol2ucm}{_OiCl&Y$VWZd
z3=9$ArXUY^Ufo57<K+|)28M<j6$u9Z*7wW|3_FB0!WkG|1cBTSIVd(_=JZfMCKbjx
z)2sZL6zUx%K@nZTwF7hp+e^^8@Xi-6?y&s--#yiVpMjy*iLtX4!~jnPG+1%)w}Nia
z?0oTJ2MZ`GbhavlgI0;WSP9~`s)REza2{@W%+KG-4_aal*4i7u*a<d_e;Y$*s|#qu
z#}5|%{;y074B7Puco<)FzOuYflG5D^vZptav2!kn!M{zib5;b%36V@NkwV7K&z+lM
zK!TOboqHk5JefMXK#LNa|Jn1m?^R)7Xn4%S-?~MGfuZ>jPxDXax<%l_CtpqiofQY_
zW_G@K;UfX+owOd{7jFd}Y0&xN#cSsO|GOd1^<eDmoxZ`JNuu5lG)FnL2V`IC1Ag%O
z37uX?Xo&D{1KpV;(&@z0dAj)^QzzK@{M#J=gHFlqJa+IOOJ|9S0%+f6d)EK||G&AY
z@bK}s#)Ae3!GQo;!w-%;j_wi_4a*W0j#`QA5)}^6-U$)w7Sjm+dIp9P9?&Mf*Z25a
z?kY1dWV?W*x3GdjptDGzyM-0x@lGeubezKX8>%gW3=F+3tUm-87&@6iLxRl@_?r(f
zWgbA5aAIjbBx4z(qQl<`>WuU{Gecsy%bBS+m<1A3UBS$~#jG5iTR}n0<vjg#0Fz|>
zb<jfDy<7Mh7?}85Pk}iX_!$_O`CIpbIdk|K7?k*1H-I@i_!$@k`CAu*IaeT@X`rhS
zraJI2Fm$&r;Adbs_<#-MT7CwG7e!3}|MyOH-~~zTL6r)JNbyZi4rCH$wqg1|y)ux=
zhH>lkZGlY54k4h7(47uiCJSC@%k%R0@BjZH?X6^0@c1ocCnz|(E(K**z6=J2mzRJ4
z|KHuBvSfN>5R<xSgivQZX!}98gBWP%MknY9d6DT;gP64H>p>PgO#{u<zKjHEnhQ$g
z-H>$eq9Ov0LQtHk@NX{=IQWc(f4c)8<FRfR6`6xCSU?@rv~D&~x797pp;Y~UiHb;Y
z#!8Tx6Vn(N!vB}3s03%+0`VKuK;2=Pm*0N<{|_!O3@`PzsMOy9IXTM@Qf7d<K#cyN
zeyba(hyc$VfKDKX6d<6E0;p2~k^-G^(%Yf}*1baR|Npe+Jt`pG{v`q#0#=|qL_uD9
zIT_T(a8Z!~-QQw)n7_3d!56V~Q4uMvF9rFe%R#ckMa8xCf2nNq3jrH}^7vhhjEoGR
z#&IY}zM(>qwUqm{C;v7V6<5pSr4ArL&{5=&A!!hgf4hSK_}uqS7nO(?t)Pk&ymzKl
z22zrOdiXC4(ij+Ce*gLZfAcY>m&gA7|Ic3!GO@b`<U)S|Xu&ogluV|A3LeW46%qc{
zY7l=bC|WE(^S74pGBEJ3KL*)9FJgJ3mIZWQ7brV!0S}8G{Ke8aMFrFdI^H@3l$b#+
ztJV$tpj)QEi&5sD;Rl!AA_pI^bk?_kR~dkUwbMn#0i4ESK>N%r_khjdZ&?RQ&n_yU
z<L`YsLF4o;Dj{HH3Eed+36^`nmh!h0^Dr<p@AUz#o-VcRZS8;*Cknl-9H0W!MMYyL
z0~-Sa_#mNr9|nf*sRH2)4Bd0pctFxQ;QqFciq6X>&;(O!0H{cc_}@7f#Av-;x?y@^
zD3h@EN!I`WJ6pjTTSdY_^?nJT;iXQnQJqskB9^To{GgLM%%;x|Wm3)s^~19-%NYLe
z+#?Edk@M@9y<Xos?_d7k_#AX%d3Vb`(2WEu8XzZ4b{=YeRL^+o;1BS85HouxJ7{Z6
zCwsSxiUMRV+@#kXl;$P&*@LS1U!3*Aoi{-nm0k$4{-5p;#w5uBx&XD?Ma5)#Vi=QR
zJ&1SkhXCjpgYF&`5U;yN#enlXe=B(Bfs2YnFUtndwiocCRLu|FH7YutEqg%88oW|g
z6O>aGEZuoZS({x{6lDIpsOU7;sOYfqw}8$!06VOJrTG^pfB#p|x^#$R!a$YPq3*dn
z_2CQ*FYkgRdO@MqITsY#y%2{4gm-=doucz%A-FaK$#;Y0Bjdo=Lv>=)(jB4#x|7=A
zMGnXc7ZnRwJc104k9a8oD*iz?yt(v)!l_;YWJ4!QzoX{4)^Gg%^Zxz+|56w<T?C0U
zuzkI)4xnje7Zr*BTfiAQgMo#Gp|=-QkaiyGeDQ*r6<m0NrpdvF0{q{i@&Yskf>8G2
z0Sj0O2LnTIE2z2ie~SvJ@Tf;J>cw7&8cwhpW(J1;TU0=UO~^`Sft0j5aDl5rpXMV9
zy}h6^ySEi|^5_38Dxk%186Y<3=pk?z^!7UNF);K_b>IdY%L+CYR1krc)xYp$0rf^f
zIonl&zvVmVnAaK=SA`PMh8h)D0sa=yx;0Q;!tl}`bQgz<iU=cUehV~~1v=5Xm*ps^
z8P(~cQUT(2*Qod~{^)d3sp+gyDd~1m0UhW8iV)D&shn<*xQj{wXmqO6Ma87srC!CR
z(?!JsB)|&tYiElJs9oP30#=j*o_IItu2He*E>SV)w%OiYqGHkQqhip#r4OvUL`5O{
zyHRG0iUR0<=H5ASAa@=7&Cwa7qS1N!;BTgbk6AloR6IJ*fv(ypQAz3cQAz1F;qEL^
z$>=UoF{$tNQOW3*IoDmHqQH2s@gL}{lyXiGua`&eHT(B#2mi@;e(d1ryr*5Fq5+lX
z=(wrvqoRS3_F(Kak!So3kuHPk`rHx0bj*Pnw8YZ{Y)i>G&}9b-jGr5SL#*lYQK?tx
zmEn8M`u+03-|`(1ES;aVV^lPt@*EHzT$Z(0#vCfe+ACuR7iT->zz(v-1MIgFK2WpA
z1LV1G9~BQAelvzTzP|Hg2N!<Nd13cl6w@&$xaT~&(LKk}6$A1r%#l$nogYDA*7y_b
zbq)ycHS6>bQB3Of2F-^!nh$U^*Qgk9@VCDI`~QEli;9Ipvx|y}L-!u=j4NY}N)BU<
zN<sG?a00QcQ8D3f-40Tjqhiz02<mZwCbVl*Di~{2Y8XL@uSP|}vIf-3O8EQ#|I0U^
zr5e~%Z#`&PCM@{|U?g8qas?&d3~2HNC1cROJCkk~l>!{87o;WwJULH9>a8b~d~IOK
z7Zk-FkmQ>Jjo}m=F^rUYJ(%#va6OLnD*?75MkS>?<{k?uPoU=zSSsrL*x|v7-wqEJ
z>{*1lyF{fPbe_LQZ;2cz<=Q|kwdt0*N5D=m0{+60a;4xlK)qED_ZLSOXlLe4Xy)kr
z*x|+63C`=VbPLV-tluvl{3+kz#nQ_o50zqP{M`}7{F(zQ!~EYx#i02RTk`=nXtMqR
zN~~Ctbp~TS=m0L{bbSD%G)JX?K)TKZrE4irHxH7oT~um7WiX;h1{J^}-8Cv9;51zU
zI%p7DB!ki?DD8sMa0O_yG`I)`t#s*jQOW6aQSmT5&|RbA(QVV-S)-x>X6|VR7r8Ym
z2H8F;8b+Dd!A0&AL2!}#i=#6{#isMn!Cy=VAF+0Vj=DJxx=yPGT+U`NUIQ&)>6ZBp
zYF+e-$oG1&L&B|$Zzn_j4+e(jUq5Sk4Nt!2Jou2K@gc(x1_toCO*XyZ%#FW5Wkwm_
zt_SQ449)-l*76!&dd+$85p&}skO=1~<`@-?-fH&Fp9g<3H-gU3VJPF-3EH*Z{QGAu
zli^9uQ{6QxCLJQ}9VP9IV0ZX@X8}7zhQBwMv9TUv0naXwwazf(IT{~<_?@S<V^nM)
z<!%}K!Qb-VFTZ9!_?WrzG1&53%swg_y`X;a!Qaf#3V>@j$a2S8Cd1pDx4>41v@>;-
zv@>_tsDQF<MsJBZ$bJQAc+`Ufgc%Va;P3$X6I*yNLc@ax93Jj4=c0uMGq%w93l9wo
z<j|;(`OeZEqGG^!tJjMa%@x1VV+B+Z+VqAoL0tijm4E**+|li$qQQ8xw~)2-Ga_hs
zz(Lde^EW(jEILB!A)({Y{DXtPwHuW7T~s_krN4qhH>5B(VFWb+TvQ~$jRZ><6$SoQ
zP^sRWqmqN1NlF+Y6+i)~Sqv%sCI5mCO-N{VQ3(N=8DP-tqT=K5vgR{bJf?e(3NL6G
zGh>a4!%N4{|Nnzq@=UXTPT!x%q{rAg{aqrHRK1cFKf~+z?iv-I?r;{+!orehYj=TC
zH_-L#?4XV2rPc?3F!QfJ%)k9-XN?Nz3`>sg8WoXV|Ns2!PcWY9E>V%NEKw0DQR%$j
zd9Cx{=Ov)?BAH`U6f_ULew4+S;SK5%hKDmSL`A;NNAy0y16D5fpxft<w}3~im>|8+
zhBFSJUgi;`ajjYWkX|NeT+6?NH=`J2Bx^VWLj?HlEYRv<j&4YQ@P#}t=;B6+MSP$v
z%>Y_6Q_Bw?;o^8v0%54U$c8XvUL^5@&I*0;A{rvV^CAeufGmG{A<hpPhHAD2nZ;1T
zV|ZXOi1p%e!2kc2bHGcZ_*+4{EesF5c*6%CV9aO*IZUODf#F3S&;S465zgL-4-tmn
znty*Nv1tCMRASs6%meK_@APE=4Wh4q_3wWG|Gu_{`Fsok8M8qqJT7HmaO;j1XnrjK
z8nHe6qT$0o&}=z(#$u54ky7yBTr*^S7Go*vjytRj3@;K~z-?y{$Qj+IctJziwxFAF
zN);F8urM&NZeWmL&~{M~*$HBRcGouk3a@A2VJKsNeWv-x|B~aKANaSucp>uP-~Z;n
zCH$=g><kPm82MW=*kPlx-VmE#{Nn}t_eB@?|Njd>`&VrkOL%RV_*-q+85mxsFf%Y@
z>;kz|x|D$-9yZdrmIFK<D3D=k&Cl?Hp_G9k`Xz5YsB6)p0_vW<hyg1oePDQ?VUG%E
zjFN$W%7M<~4SQ5T<ChGj%+2SSI)69s0jp*xVQoIm@|w3{kIHsXJH3Rt`7}pH1jy)R
zB@7Iaoi{)y=CP=huxC_T^E13=&1eP5b(JtMM1kZ$=i70Vu-9iyfXL1T$>x@Tmag4s
zegNu0@szM<tOrTTWSj;`27n~L9p)%u&v*?IX3Y?`;b(YZ2@-Dp&s@Tt;R51og7_Je
zKukFh6Li-Le+%f2m5kLOLCz8ehT|<Npb-@X(7BHB;B}rQp&182vTuqRK(bF57#Q>!
z7#JcO9&?n)X50WtU4%%1`d^?EnWA=sW^`VcX8Z$5Zb3+bis%T4q(z33EkDDH=@3bf
zp>hli3=z9Qb7-%nGc0WR>lt2DL1aM=0-a$U0p17(UUOC=*}G>Bs6(9L12QJCn1R9h
zIJ+Lm2vENsB9#b|GAjlhk_Otf{o)xn=sutSB_ErADAX%A{}8O_@F;!qaxM!4LvO&l
z=3ji}*Z-?by)c=N0c6qirZgrC#yit@r!grC@_-g+fF_|{GZ`LuQOWjy`r9-nsrq+*
z|Np-(g(agKtl(tC+I-^w>x||-;E`{JQm%|6w)_k)b^reVzXN2#3w1V-vQjt0OA!7_
zKQP}6bPAl|$z8Dw3=A(?Z9%0{>w!{*jE5lI@Bct`gYAC_*1_LWfB(<_{{g`n`gZ&b
zFWwe{hSGRmo(3re`*#`_+`mjE#^7U8A{iMNJosC@K>5HQq-%R214BkEh_x2P0teY*
zh)J(^9*2yjH86o=9uy4>GGHbsz8KXV>Olzt6zdE;U|~>Cn1Ry)B>DlA@;SkxpguRq
z<HsSH33TLI7DMkG@H9qnZ;#3zP<c8<1!Sh-fftM>pf!rnti;9NI*EaSfxATobio^B
z(>ao(>Y=HXK^klk$OJ|;u=V&Im3F)ZJQBdjaI8fIbRGml79*xhDvUvK0CPzxFU%D!
zNB;f)pY=bBHKQIJ@Z|-NfM53yJUav0d)V8e0@^_Q!vEjD|J`d;KtdUnpg{I603~uz
zXzT+KT@ZC0EGiub6+apt$iBd1)#c>L4_Y1B<O1HZU&{5`6jV!>K7Oqm5S+0ZWC|<9
z#?JZ=oiAHXlyGNk0f~OdXJCkc%uziBF)u!IZvM?#Iwxa4NcIv)sPje3ffDYFcOZd-
zAOT2;T*v`RC~W+F)}ZqRe#n)+04sddyGI2yq`DJyP7!G51t{D=nXZB9c#Fy-P!Ykv
zz^Hw^MdcX-=;$W~p5rYluRsycz`%LDMFq6Tz=45*^B6R=d#9)@0>yQU%3@F&H~IVT
zKmWEZV9tKfS_H#O8yGu3wwx#tH$0hrlgFwV6cYR`plEe${>f4L`r-rs(tDj3UML$d
zFm$%4d<V^QWglYeodO;q>fNIPS{c#11)T9f^?maJ`4>O*!D>PNINqYNgn@wplmMZ_
zU0DphkVF|^c;H2kA!uR`wEq4D=r)xWm31Ij?$8GfDe|{o0Yy4P76WK)Hp4Dg&;q09
z^_HL%0@AVl-~azF7I=YX5*h21dOiO0Z#(J9zl}wOfAI<a=9&MXx%ct|!=o?1fo|b$
zZT<KEKP0lO^B5T7UzUK5PnqrD3AzjVHh&9fJS_VZTifrn&N-mHJq*WMct8~obLZ=p
z8~jrbf4|)^ho>G?zjVyu0aZdBb9g`}WjejQ_3!`xga0`EN_im0-_2!UcpU?)@eL0&
z|Ng+=BL4#v<4XK3Vn6=>=ifI0RK;6fE#Y*4)a|ctflk!<^&RHKnYj!Mz0LwJBp&?(
zEl79f*aey*?NxRbcp?7i-~WggCzuh{EvF4riQdbzprm9gvS_+=4wF><Y75Z0$uF0H
z?k|KEDi9{PP!U07UpEF0enZd!<NSu5$N5in{@_2scv0|hXAgLEuX7G~w2iouWVJrL
zB&la$;NovpVnixRKr3mW<}^T@0-9EZ7G$86IE>W{BG440z`($e#n`(BT)l_(_JGT(
z&Rd2DUU=w(Qb6+_aKcjHZ`}_mtw85l@wb9*HR}ZrOV%@hw|VtK>V(frk;*Vw5oU-8
z15F}|Fn9^Z04l>kV~ZladsKchFhFgBWCE~FOF$VFl<2b<LpyKw!b{pdJ@7#+5Vv!c
za&kjbd<pA|BufT{UF`P!3_C#U8D8W%fTjqtSTY=D@-bww>;zG}Kr)>-UTn8#U~mRq
z{r;Py^zM#7f}n~>7L>OBmxyG5xP~V?5ACQ2RR=E&x&Qx<11H4h7XqCuD$O=3ANX6q
zL++qsdchUc5oQL4dVbJ3UizT3Z0cX0U}j*j1)WgE-?|sn?PgKo-yQ&(Z(=+6fW`3S
zi~4K^hL^1nnQjl3T?|S53_BbW`59hhvHbtvU<=|iPG6MAWa=9RRTaU)zm2t&1#<8&
zXysn#&0Qewjs}o67MB12)4Ge9(m*}Sa^bXYXSUve{~K7+nt$2xw}FcC25W^<#p#Oq
zO!D=wtN6E9%kXaxmg~IO?W_Qr^5Wp%e*F6*&_*2aHjV8eD&Tv0zdy2c=IPEBki1&t
z0=gz{%7L`jll)T-ab8FRH?tsjQfsC){$yY&7fx&bFHp`4ma*rbe&FJR*Mj`(&o};L
zWME?8pL4+BHPZ&h4rj^w?rNDd&`uQo?cQ?T)e0asPj@v>XN`(TcQE)GZczORx`rDx
z32ehyB4fkE-vTOryK_`{I!}P^`rP%|j32U$ZwCX*Zw62o%JK)ONMVq?z~8iwfq?-$
zvC;X%@Y45horey-;@Srq9I*Y*%v8@%uDlO47Sa66p<HqwXmv*OFNJdceV|R9&A$Z7
zSoeYQ4*&LdhL^s7-SxwapJ6X(lH_#~*lPl%TKwA&rZxWj|GtcM$N%@B*-@5#pxGjj
zRj-Ai?t5m&&+wWX%6VhP&yZ%zz)~iicJW31#b;^F|LV)$zvk<9W=ZSLX4~}#q?iTl
zyW?PWVz2oT7K2^BA2e7Gnv~?<eiXbm1++#b2y}?BLI8ve49*a@=Vy2^%>%ScqnIhJ
zvzjHXGn=jXh(>dbiVP!v|2YQG8nyahxo&3}aIAMnE2MSCsPOP_=jCHzU^w^?JOc;X
zb14B~OMvcQW;~sC+}Y{>|BVOIntyPVF>O52;q98%8SI(XS#8_-vBTTG^JRy(cberd
z{;3DjK=b4LQx9^SC}mHx%u(Sf(NF6PcI$Fc;plMo03DL8)#2=T%-LZ9Xb7siMn$66
z#ljZ64)F!QJ_Cb>vrpPWkYhk@o~}~Fq+KuD&7uOzB{qxr7<L>0CHFfF;A6YG16aBl
zUhqHs_aCIfLEz=b-=IxdkQVBX2mk(q*FwB__u$|E23wGBh7$i5;+&xKG~B_rI=`p@
zw|+|ncijPPG%N+xolo5v7+z~E)=1=M*a^PTndQ<8RsHE_ikM{O4Z`>tI%Unn_!(Yo
zkp<nFvk<fjsq>@eLBmTgUg}NfC}y(d_|5eHf46MH!s))nOfqt9dJGKz%X$8nbA<gj
z1*y&m0!31`8w10_l!epVi<z{H`<Xy10V_e``fi|hnaGRWd;k9bHw9ffkud`#F7C#_
zup4ysL{y~VH)~Uu=}(H8l<K+6`5Bu3vXrxT+pIO1!p9IE_`gJj2ZVzH!ZJ31G#+wg
zU~p?bEYf^L;q~g{tQkp=)pff-lc+lw82A}pT+{)b>;C^gKf?>D7|_W?pjC#TMTajf
zY8e=IfEGT!e0KN${~e&>_~o6upmok+!Od?9UewRlVqkbNQv%f3C>2fX7QK?d&+x|P
zWeI26aaIr;G)-!F;6;KoXxZ0?Ubp{g%|HI~xATJ*cz`-hh6i4_faPxN0tfYh7pBsn
zGt75^Iz@&DUZ_ihE*AX%MT)=mHs~xBThK~{i=axH7jz(-Cu3UUZ*!p%zO=^Q2Q*7X
zGCtXZyQVil9tSPgi+{}@9G1c9z|Zhvj|(VZd3s}1WP*EZRAj<?eN<#Xi|s*2TS-rk
zEoD-uk2CxRzJH`dHW)4qNlZr4kRv#npE*QCq3Q<}It?!bK?-tIBqAdkLEBXu%2ZK}
zXn65n3cPDw{lE*><_C<6KsWA0L@fYOpnY<nBD%iiK#4%(U(iJa<#M1~;n~<27{E>L
z9T)BS8NfFc?79l_Vm^}L9H46oCQE@1){9Y*h>LIjtx@i<%g6zIkdMKO?U2~vYyPdm
z-?EjJfuZ@g`fJf$_AvSB5+EUsQkK>O^(CB!-*$j4fSjfSwssfD?wugwwH(+nEeF8j
zyTOHIOE@cNANx*_u7Kd6K+usq0T}_)`4}>MK*6r-3<`Fc)^8<j9kQUik__L1wuwQe
z=LH}UQKBLf28s<~P;`I}e~@GVt;v#zinP2jU96l*p}s`LAS@s_qa9@8AtwfgU8^1V
z89G0_I3x}-T>x~WR;MiJLaFW?6@kXXps}jgEzPzd5r&em4AA137hO&a49(zV!vem0
zs`-FGq~*~fi*T^rAgf=PN-{9~FHw=mI0~{T5~SgXKw7hH{fz{E28U9<T~8eNK`s+`
z;Ue_^|BFIVP{J?qdGS92R2G0-0lwGkWgn=g`Wj@0m=gm-cb!C(;ce?U8UAKd&`PS)
zB8)$~8M^~n{uc`TFXZ`O$nnDE-@pH$2FdH2FUm|o9c%uU9?-s4P<v&UBy?$HnFAzP
zUQAU2k4#Az-nNcWktjCobx|<@pOW-K*8#j)*8+S_!>&8>{0uJ|#K4YZc7A;cG}W8d
zdZ|<(;~&Uv)s74d5ieCi%M@Hx3|`oSOg-3nq3yvg0agZvwD-F~OQAbY7+(7B_8By>
zZ}`?aM@53aISO>zq>G9S_#p8YyY0cQ(gC%8oSJ_y@wb9%nJlLNB`P`~3|dnFy0Yd)
z(%<Qfl}y5FnvVPoFFrefB2MAuRB$5|qz;7PYBeEh>tjJ`L0;?jQ31{UICQ(HxO9i8
zfVPu>uM6rt(RmAYt4;F}h34N3<r0SfEm=WlElXZ625pjHJh2$Wd#wPv#>d~16?ACu
zLY75*43a;Jc{;&27IlJeEOLFx^#A|=4O>8G1oCgYuwm=7>Gvy{OzJ_pvltC81qFbv
z_<9la2UIeH1T%U-&U<SQ@`^|nQx-!80|N`g4hDul{|zs_Nc;8gfAbNZtp8wfR**Os
zgW;tYe!u?xhbm?S34%^Cdtv$O-~WZ6(!RF>w2R5`o8j%&|NI@Go?mkId6Di$P|@E#
zF$GlrfVPx|sPHg1W`yxG2v5ubiLrn$Y}yMd#I1Ey_JX>z(m5(D#p%sE3&Qvr7)v9-
z2mX`?f)D)RQE9zhYSRm9p#E=u@WJxn^zT(nM)eV(g_U`K|NZxW8S?-C|D6mBoD91d
z3K$q5OD;qH{`=p0yF{^<$GG#>4$y(KFC72=``>xP@KP3&;s5Zk7d*egUf%1lh>xN1
zZ9+0HL+2~VamANF7lVM#t>Vg90t&Qc77Prb0U01A8HYgvHFga34EsR*&ikD&KQHOL
zp$p<P9}(Ea;Ka+&_{+hYm!X)un~U)#BV+R+me+50g5))C?gB|P{+bd6mNsI%$H)hk
z-USkA{Ivii&fCq!*a$KPB=dUb{a8MR#-AWZ7IXKCa5Vk|nN-YLzY8Q`c;Npfa3R}y
z@#T_V|Nn!FJV=2D+KAtIsPo{<9{5pF9H8A}44^}D<~i{*yx3t2>M^D@|6}BD2?bSH
z&HtGATR>g4G|=wm4p3ezW=iW0=IXqV*8G4Yt&>HilxIIE;CI9%E#zZ(&9xsCu;2^s
zTECULHa}ucYyQPlBA5ocCSEeltAx|=_DdJg68j&`M>xQ>wBXf$|6lN2{rA7~aOaN~
z%vb;Yw>-?>tN>DT_@yKx1H-{*EUn+_j(2CXP5)QJWLDqX>7&8|-ZJ#=CrDT8fzsGC
z(6}n-xHbNkY|yHfPmsG%&q5XOw}5s;L!#O6(u;3Dz!Cjgt&>Nk^V5svP*vSLDy70;
zgQr48_*-N_8;Jh?FG=pa@#4wlfB!+%OoZi)l91*K0frL4&J2;)p55L|%|HM1w|x2s
zYQA-|Om$hv$IuO0&CGA@z)||u+C!uCLwAJCYk8;UU#z9~UY-PvbvQG<*mU{df5Y3Y
z2l%HRe$5Ozr0NDVP!6X}*j&cTu&0cdVI?}QM-yl+<7Jpo#>+6bjF;g;H7^5S4KIUU
z4KIUV4KG7s4KKs~6}$|GSMV}iTfxh4dj&7UgB83C6E8t<*Ck#CWGr_9!ncFc&6ju?
z*e>ug%(%qM&;S*y2WgmeftTUP1zrZpix8}Pk(c30H6Ozg9QZR9@i*0c48N-R7#M5#
z7|d$;7;J0!7(8qE7(#3K7?NxF81`2}@TnR;hKn_P40oOQ86G<Eb1}Sf;%9j8#Lw_~
zx@A4nJvGpN0fs+L{0t1v{0uD4{0uzKpzaK)5P@I;XMP6J=@Yw{q<JNvQZml`3`$@j
zCJpE9T@6f9jN3Vym=c&3lJfI&7}6$8(01l$&~@f#0JRJZo%tDzo%tC+t%&V0txPtI
zyoo6(@dcR$squOFDXH71wlS?@G)S8OffGO%UV*O2`VTq_m4SgFFq@YFBnG+-3nsSV
zIPXM8(dmCWm_+J7Er-Yp6f!Wt<Y8i<JGEe9r&mGM6)-R`GD6fULCqE{L=^++0b!WB
znhIV95dj7UH&B>xK=fXNh}AQICzFu`L5>Ao`UNroq<-^!h{Xn)5RD))muy~!Yyk!a
z&@spi{~_Y9Dj;G?AO%QbAoIXxF+<cf`~lr>08#|P6M49JxwyEw^F;X>%$)fdtfs4W
zF+~eHIrB5PIrB4kJM%O6JM%Myfa2@E_~sM53`_zH3=^FpW`Rs-N&^SxoNlHiHqV#x
zLIM%gCIv|{Fn|ZVvi9;aOxX*uS7I+O!<|fC2EHS_46ieJ88osW;?rw-nKFc97V<HG
zcF2K_C<m2oDGT{PQN`28Bw@3qjhCUS4WfEaDlbDwDldb~bO=8+m6su)jhEql3xw~Q
z%F6&r5fE}Bqt*09eN3)?6FLt*nbdLU!mH*-jLi=jEl!oNHh*AxHmT#n;RT?M!3EI$
zPKON-G}wZ!n`J8HF+9+03+nnX@=rN%xI2KQ*Xxhvi4x)Pu;7eoi>CYbGg;Sn9`t_w
zy7hJ`>uv`=eg^)1!Y!9dxH><)*!~}M@$~y<@FvK^!JUUYFEsz+ENATvGI-6^8x-Dp
zvV^%ez?^^IrOq4CFFXJL{~sO}3_4A<yGBL8v-u}mIs1Q=-WksP3<qDybpCv?3sk(`
zI`~SW`4NBT&(04oR)PiU555wCiOc|t9DF4J6KIDD@W2GhpaL8)fmEmf3rql1gEv3s
z@4N-FBRVerrSpGS$Bm=&YUgRt@`g?ul`bC@8E_Tneee}a3A5YlADW-}_x)_WT_@z-
z`3rOg!HXTB!WMK4;Hz#Pl};ZOna+=$ub}1ZOCgZGhZ-yxN|+s9|IoZ}nDL<HiRl+7
zFp0UJD1B>qAo_4HXkgUvK$i%kl?ZbQ54b;7%LAHjVs~h{RQepOrd#%hFX*`81Fg49
zxDP(yVZ6+Eqm$#c+`$JN(>G=?OQ?39cprT@EV%P>w<%2Jw-O$Z%6p6-(mFX_D}$6a
zW-yCPZ=T2`B88+1Y~DS_4;>t@mEekwPh=91fSGi%gbQTSMaC1|42MBVHfAtON*(UJ
z*ewcEatY$BQ;ZkVx*4X&PhyguE}zcKDT$^CY|bgh3teC}D%PEcx;!`<elnE^86If(
zsZc6lcp$C0iid%J>Vd=HkT|^Xi!VPzw*yb}3jtMzAOHU!1|1mDd9CyO^u3dqG`Ph(
z#a{FCFY09Ll%M`#5|c>1NauBa&dzJi&;IalzX3iLWEW^vtcwayZypQiR_GV2Abf%5
z=ghq>HawjyDlgJOvE-t{VR)eP(7{LipvyfQ4>2_GFo0Gl6iao7sIW91VsL=)izK>v
zRF1hYG8(?-gR%r2nt!mB9zNz`Q_myN4Z7O$Q|FBrt$)EMaS4EIZ9XCbZj2QE{r^9h
zfBTKJZeANNeun0gjQrbAf?DvPQzt_H{{Ig-k_2=TM(2$e`#}PX2QL2G1sZDw<sZYp
z|Nn;t^KbtE>B4|-Hv8~m`d`rSrmT$@e?3FzO=LqqykG#E!N9-(zN!v%OeJWlV*BaF
zgP?9;^GU{Cp!%)z!;9;G{{M%VdI@xC$%p8;mkv<Z@^1&b7NG^yx9z;~VhKnKBgkyf
zC?Uvw{Ct1G8GLtxH$OwSZN~IzQ<#+GK<%kVy)G&|ptI(9p!e0i`U|=tve7nW`i&_}
zii{4^e@$W1tq<;GQR%$Szpa3?^MegjiIWX;Ng=3T(fRq`Y5rC<Pz#Yoh1sI>SHn-1
z5{Yu|e<w>M(%!xVO%lEBJZN~k`4G$7*BWnM{$gNYc=PfjXcquTJxH}|Ip@EVCDQ!c
z*<VX`^Bdmoc4z54)OmvQ*30uCW$dq+`M1@xzdQ)?{kd)#6=va15f%Pz-W>efg4vr7
zvG8wqW_fY(H|QJ&5T66Y@8(f?;RL!o_G80OmNKS|Ed1L}LX`7>q+h6k<UZK2fW$xo
zB|hZ>Ag`1JHy;vs@$>ip|F2y@tlc1W#|;11ck`$;9|S9JJ_NSm#gkt!8wEfnyqE}5
zdZ_aQ=daf?Ag!QFX<iHPZ$I#w8^nDAcHjZSOOc=i2hJ|tB`P9a5u6RbnM#ZrelwQ@
zf`Ss{XJ!FV-s5ff$x<rV`QiP`-H@(y+WVKFX^zeh?_REAU|@i#;sL4R?=*Tj9W+YX
zY4j4b#-Q^<2h&T?9VDISI}bApbYA7(=D`6v%NQJ74lFM~T?CNdp`Ph{`9ka$=m===
z2`8XXgai{KSkQ)v-)37dJII$MqMg4RezTOyHXjn`{0Q>N%X>dTTOrRi9})m_IY3%I
z^KUy16R`R<{or&a*ZR&wY26M24r$6xENPuipn&NX>SO{3MCY-E6K3*(8qR^8*E>&x
z&bsRjvEu2~5zyA{n90Y`eDc4gZp%zQh9Z+*e~!-MpO=6JVLREIkF#{%>-JF*`Md;d
zz~U*O?Tr@}gADu6+B1`n;Wcyf$^V@vqT}K%AxFe?9_zf?Eebl6ec=&Leul<hBA)yV
z{8JCMUg|i_KlNbC=@Q=7ZzY^NK|>gw*FP_{<?x(-a0Zjo^dqa7++Au^IJyH0x;;ud
zML<;wOXum%i~MVD3iGeIEDX9bxmyIZ7oMf_GXIiO%=}AkGIxIN{AYOC@LcE3&d=Q@
zD%~|IEYq!5GfA`YsC34tuuP9#&15D6x!AX}12nkbIRkVzM)Ls<OBWT;UbyM&S2Imx
z1>bW#-D?d~6r;-YrE8d+gjKpjez0`2{9tDJ`@or>L0IJPlj*<KFln%AD95PiOjlpa
zw4708`uVj?n#w8xCBdK_VBoC{B`OA;H7X`hw{(`MXmr-7=uDSh$Fzx6LpVf5XZode
zOv?KFC%_TY{6+&*mv&wTZ#!h^W|{Ef5oCh_ODD^8r{-S*rO!Km^=_ZeHIqrTUZC3<
zv|>i2+Zl9fp+vVc4`{-t+gSj#?y?hfPC$u@OgHG(5*HN_(8-4`Dj+Ey!?(?Uh06sy
ze;IyK7Ev+$1m5w)@!GNZuX;IXYq{Ys!%xRuR5(B-+H39Rzt-jAoxeCiYCC@@e&9R=
zl4D|En7(HwlS-1v3eZ*>W|39{4}J#b5EYf3pv5lTEGm}|xPq$y9+l1#6_w_{0VTYh
z|2mI%hN$qo1RbCSI%|vZRHrZ~^)Z8v7z<|U_EC{wJkjaQ0oq^0_@mRA2ejW~y3Z^o
z<$CL8d)Bfqork+kzj*O8bhC9br**rrq;)#8bUQP>NCIt3`@vdvxtrheL@`t6!A}0>
zmu$_)*m|qkJ}>FK5FHl}4&csf-8m{E{M$r9R|7Qs;x7d+XbJ5+&%f<J_9cVfS)i2q
zf6@)e@`T6T-U{7rOfOjefsQ>m)cN86#nuC*=l%z4v>qru4%%e!KNxhb!=BDpoj?8u
zgHB%F*j&rNS+@Fru#DjWQ2qql+WZEzkx0PsB<S3>ZkCQ0TR>G}jfwzhqe$~lP^A9u
zU4H;n`c_+X{@4jRANBGHPz~^7C+Lvw%O^S=j)BjJ>~?0kd;*k2c7hfSfqBLzDhJ<l
z8UE|$X7*NL{Alc=!qQ#La_}9q;RnWpo!$=3hgmG|mM)*ZW;T;W{ZY_PolY0<eNLb=
zqd=>9K}SM?k{xK&Oa-*R4HW1gJ3z6}$)W;I9ul2Dc7l$txqJdNe6W+7fq~)jiJhPo
zQHF;*e}LU&1By{lpmg&zGV`=1xbZU>$Eesao(2^j-6bkKh9Bw`e;9sXJk0nSywU)a
zNKSMf+X-sLL)b1VE<43Q!N8&dHqxUzM}>tuM}<RK2b|HBeN;F&Uv}rHI56Jr%u%s1
zE>UqYE>ZDdyvKMBv;Y#66hXVXKvQJRH7XJgCF&r{K^_KA8`jr=ck_U94QO{D$djEW
zDle5ldCWychVfV@=ss`-W)_uBC(tESD$Fh_ES*lE^r*oM8c=frrAQrS7ZsaMCxLDk
z6$8c}klmUl%%D8x1ls;%!T6%nNv8RT4><lI9SVk0p$+}d3KR?vJS&9Eu7EPvVN20J
zUi=J2vf*K!$2u=|+y0oobuN=)7O13TD3$A-2uh9nI6V0o_6vCPGk~vi`MmVF6AOr!
zeZZi32S@=!sq{Wjsk)y5qy|)weqMUK0W9Oq&kz@Xcwr2~m4AzWc=0nVi~zAfb}q~S
zvA#@qn8$S8?a90U|Cx)qK=%O!3qq<Wz8Aso!1b+Q^C3{(#0QSC7j_`Q?fnv3pm_w4
zS^@s;&U~PLL+rchvGbW^nW8^WubIyz;UC<2uzQAp253g7K}-WQ!}EP3iv|NjcgSUy
z?wK4K3=EwY4nAOEyz$L}hp~hWw8`@I`?T(vA{wA+$q2r*&WT{=|3;AR=;<%!GZ`~w
zf1ED6fJuelMxb19*G2|LhK_@mUv*xX?zezRI{sScY5wg2d`|q^Jy;Y^@o)DKusl`b
z(s{h|#K8w_%<gPE9l%HOy*T<GRDp&I9DF1I^6^K`Pn`mWmpTIkIs-&HBP0w@c6xwH
zO@Yn|1;g8&5h|c%Y0+`<)Bmq$60Zl%d<t})ZvI_grU5#u2~@*?u8;3E5!bx86Wks=
z{&{J4hzie(N1y-yZ$8}c`ZB18*ZjNzl=%<7U<b9%_?MjKI{1()`#=LoFXJJQRP%#+
z&}1tYl-+A`6x69^{MdY%q0>i2pfg5Aq`RbEg@y57Z;gsX=f%%Uj=6|PG=L_Xx$4T~
zK~{ns^djdowDk-=L`UKUXxHUyshyzpM4AVCT|^`eFTL3G545zmMujWC98`=6fXd((
z8lS<N{K3s&$bL$Yc_4FNNPPbP-|%*~i;5dhcgPKvZk8J_et-J^AC##(S?+a)++%TW
z{>@Q(zc=*@IMIiLCjJ~cPj^1wm%zu*0N#E7d1>df&WoLgIv>1PJl$<0lU)4*EK&vk
z{{IIn@4WwcY4Z^WSi#-+#soA{$)eJE8FYqqZ;gt`z6T)vpv6_6mv&xl{%c>R+zZ+S
zW~0(;BCq)lV#@K)OF^e9y;u!e6!g~N^^MM(%?}TB-a7b-tv>tE0md5#A8~fxZGLLs
zYjdcxMunv}23%P)p6k31T4i<2g~g;Ht@*EAnKa0l&Kob1fBgTy6V%@Tp9mTJ_y7Ob
z5}hx<Uu=G8-|NE6Xn5&`{a;Yv{xvT@3p$p{@Y0K&A0gY8L2D*J7oK&7s1)>;s0fRI
z`(?sE{{QdwQ8DRedU5sZ^!w|X6z##m7tndQ^LjUEi&=<D0_cQQ&{9rEt`}3kf=y%V
z{PCg-!sKfH$yCbJ_6c-oE8hYY-|5^7nRM$x$HMf6fX+EO44S%P3GDSzk$Ca$+kfyq
zyrul06Q7&G$A!I={`wz$wjY=WuCY3=b_H-W{9-O=Z}`PnF8rFa;g<q`3%IFt;{Qv~
z@td88K^^}8*3RG+S`45yj11Dw0-Z04G++Gr{r`Xc2Car_4yID34H_M;4BgH=FSdR8
z|G(3fDXrU?tL;Hrrz`tw{THBJ+Z(!|3OgVQyMqN@xPcCAb7krbW#ixO%=Mxgtd$FN
zw&QjOsn^`y1p=M#KQH0m?tpyk%@j}yIo8ea!spBX|I-gHW->78yx8jmiaEjF92K4B
zV;mq|FPK55xu^&qXHfyoRrmU+uxBy!x~Q;#R?02;I$d=MlgjjOi<q1Y>p)q;MMe9V
zi;6x2LOEM+h>AcKBTS1JDEN+890mn_=3*ub_jquZ?iefRRw0JNofo@AL94YvHwtk!
z{9-C8Za(q<aClhr8<);wpompsIC$Je1vG7-1iIy$fq_A!o8iTUPt)s{FiE?B&aLka
zQBguTG5!lA4tIct`bx!{ZB*n+1-o5TxW3<zJn)*m^VCZPP;=;rOI-Znjtijq_UYYA
znF8yBI}dkW>*P`CZV&;@jsM^)vjOdhmSJvAVP;`yPGRO?=<WucykvN(^(6n)L!DO}
z&oW6cFm&cH^B7+0oDA0Wk+Bn^=D;@>Pz5W{dGz2@7RI}s@4I<aJ}-IA+j$VQCd7oh
zIfa{r;ot+%`Ny3#%p8W7>YI0i3}@h<dWbtjMWQo=ndg5q$V|vd^<lxChr2g`<|8r`
zSQr>yfVMJsPc{Jcbh|-I4Z7VddRaO;1tOy34!=0^7&QG^qIaB?C5a!@foCv0uo!ed
z(!vd(Q&R#MJ4Hc^)&r&78@fR=b<HOnre9dbWX+g2J#IOZ)O5AwOy&@_cD;%hKSS#`
z{*LDipxWx&F3^&L&JQo<Jq0b$Q1Ak+$q_CrP1+R!>Jfi<5%d&v)&&2q2a^0vp#2m(
zy+A$xBCzJeFFrr{|NjMORIL%zvt;W03DXw$<p2M)g`m-n-T;la%_kV&zc>pj?6^QB
z^DdC~*Ktt!41>;BZ#$2#P$-Rn7!JDFm4Ex;7t=w8{{Ri#{AfO**!k-HF3{j>=LfK@
z%_ju-x1WHCe0U5x`3Y<R$azo`K&A7`z$cKqOu#w4@lAaQDBrMvrUp4WPj{Y$m877y
zAqQ$v3c8!o?*0G&&ES&sR`a6+oi`4?U;{-tXZC>uj5nY~=|N~w3c81ugYg=?EER#2
zrBa~tt8Tpb@(x^-hJYFeoi|>He8VhD8NNZw(sPEF_)me#Q~nd69z-XoD-)suYE}n8
z3|sLIGAX12>NL%GH{Ej)lS(}UKR;y6;AceT^BNQ;pi_+?H4JDx3LFs4ZxlL@c7hV7
zkBZC!P=>W(Ea9<XDp3O6y5a?z&GzL0U5E&3;=Y*v|NnpR%=b%B3SB7U%Ma>KU+oQG
zVP;kE<p=EmW$CSt<$)e?CIVK`&G6#k+yDPT=P(ot@o)2D>Mh}7?krK^uq;twDdw>R
zmDVjM85kH|_qLqmZvhQHG*mG&@V9_AYNT}wfo9!7Z3HI61KB5d(z;7jn9{5_g4WfR
zD)4V>boK--=3oZxvEb=#EdZUBWbLBDQ!Mb(=Kufy;Dy#F!RHk=*Ql5<l(MFEho~^6
zbqe=7gR}_j0~rK5ih?Q4nypl`JC39Eb_r-057a!60r~p><<~;|+x(b!f!4@@+9@ww
zzJQK);A#8^>Q9v(a_^2&0UdB60-8U5$>{@{)C1X7!rA%b#fvwfeA8LW(d){gdARdN
z^AQD5ay;B%3oa-5TR;c7g@*+<z9|4D$kUz2I-l>10kzo<d|usYGF^8Sla!PrDDfYQ
zY&}rn3~ox4`~(*S>@Sq2C$3_Wa^d~=|Ns9jDlH%rZgzeGUz+0Z96Z8y1Y|6zJpmq_
zzu0-<h2?|){{sR8z&BZU-T;?4pz-_Zca|{8^LCzUJ<yxYQNrH&@<sM^j-^aK(leg@
z{~raKMm)g3?EvF}*P`IH4V@2ORR5Tszm!Q#BduE$v<3vUdP0KVkbfKRwFG_!)O#`y
zck^zUIep7UCTF!RGx-=mZh6rGYLTv&y#qSP>;`!J`tXYq&{*ujZqqx{Wj8V9GX_lW
z-NYorW88d@qw_@C!518*+S6C1GfNqzz4ZXCmMY`^c96Z~tmEsm&;b}|n&#-d%)kA_
z!G|23*BYOJ4k+h5H(hWulN8?#(5-_9SX9Ac2d7(YW-<=${IKf>4+F#dZWfhYe?W}R
z6Hoyc6&9$-kCp?a;yW1_1Q;4$g67KiF*yDGzaPZ<yaYPhe>fOyDX87eF}*Q^S-8IQ
z7HEdL@z5WhH=Vau2y~t(<=A=u=)eEb{~t!bWJQ{BI0_n%;@>9@x|z=rbaucmRsL3G
z(5XG;jK^416bw)DZ)58XxX|#6vs|k6WGRb{K?!H}Nv>WW#tX06j<Kj17@l-{ecSMo
zO-`v0=mhbc5@xs8^&DMppbObHG1{b*WYjy^=<&DoF)}dJOWLUNw;lkU2M0Qlu=B+W
zv)ljwzdXpuz+e->-vT=G+9sL5bw22%!+pY?FJ6d)q(K*Q+7$D*6oE|Ov?(YFdsz$8
zQCebXQ^DT?D)wLIfT}I)mP@6q&4*cD*E2UC=4kz2$+t@vRE4~FapBhg|KIO-{(3FY
z%?winQUgByVaKii|6kgH4QQxi3@8nE>lWwVb`82bzw^Zl&fEY0@3MlJ)OPFt|1R+Z
zubBC_T|%gMe(V2#@Zz}67cWw7{jdMuE#CZy-SA}Rix(?zfilBOP+r?*05QWEq`Csa
zHopZr9Ta?(R_CwI7cb`B`u{)vb)roK{}fQ7?>ycOx`By>e;<oV%cT<i-e8VS5tZ&>
z(9O3R%`Z8^13<@D-2VSR9Bf2)h>Aexix>5gw?KzN@VpjnKFrc7qY@qf>Q!{Ucya3%
z=oq(d8I{+;pm6eQsADWH^>FL0X6cqjn`1NReDPxTP4FBWSQ;|(Ce``kMJq&f7c>gX
zZvOw@`R_GT=kMM+#+RUxmgaiM5(v=k*`N}fWrv3sKf{aOzyJUL`ttfOs9E&D7PNq+
zj4MNgpP%8y70|L42~f#%X@|@rK86?TK!?8GE@3~$3gR*zW0eE#bcEc9*!)JN^Dt<t
zq`Lv!s|6kTxSI#u@ofh6U^|a?*1M<(^s<}<_2)oC5sVi=XA*&K(q>WVylCyCB2wbo
z&7uNoE0w5lFdpk>G`s{_N!1ymBGc^%8mv%gJ_tJJl&_OTCGEHy4<l%G8Tbxf@SV5d
z@ftUd*IPjoG@zk0s9`=T9E=Ckjyv+yGc$BEbut<r=yYW1c4Fyt<N$Z_9YN+b*Qi)9
zmT(<+QLz9GNxVJ+(!j)!)(LhzsE|)P-r_8w0dhS5c6TPjOW!wx`tfO<IpHkLM^wN?
zcqn8p^MNg>TqxtpumFYP1W-|Zd4bF#zIuk<l?)6Y|MPFRRagYNj=EI#;BywuKRdR9
z*7R3|F)-{dNMc}kw(0YPFN}X)EA5<oo}c00i4s1@;0a?1>(09Kpp|^PrX?{j{C~*!
z2W;!k5C1`{q6`nbsQv%{|BGuTj0_F7jDGwK45iGUCmi1SwF4skvK}<v7~J__H%Agb
z1H_H&stlkm#^KHzFLbW||KIo<Bvr~5{c`vJ|No;8zxaO*RIik>z66aH7#>&*YGy*)
zmj5AbOOMjW(5B^s{m%+tUkiSb^Aognwe!Y{<={%GlpS2KzkU~;1e%gO)_SS)RCk0<
z31=4LPEZr`HG3A*PEeS4-gvPC)MIEqX3%-7^TUgpm!N5^$)ItM?q<*sN?NxAQ<~+W
zQXcRTIWH#v|NsB>z0MmiB0(p<f+naIyqfO2lS!QY5~%&s?JzxiCzA=|;pq!@GO6f_
zrL|rv5d>{K-33~HV0lRL8|Sgttl$OhX_ohj(tCYWR6zB0=Z_aZrhnPVWWl(9y6!F}
z+4>k2(2Al?P%FdobMYF`5^$#1OAQY+AF%<4f1@o=5<de7mvX`ap7kZ@xQ(6G+o3@Z
z>I{Ph0|Yv+b)E(-Yr6;Ty@Gc4^K^cA(fkO^1>I0n0b;VKbUt{I_vrusT@tLSkecX4
z!Xwb03&t|`7gIsK?KjOw1ft^(w_Yky1YI#b{oO7m6@L(mpMjx7_}~M9<`Z0<r#cUU
zE)IN|^8f#T=sLyDQ(%#0|Ns9F1ogU@7#NyuSwJU3mI(K{s4#)!1l$yOv0{4iZYC|C
z)&nIP!JUV934)fxLT|I?hs;zQGCUCd5_E{J_nX$+rN5#NA5QBGP)IxOpv3Tjf4e9s
zm3Lk|_>e{O#7?J1eukIdr(fO8q-_`f;{Sh;-D(V=d+z1=I$~7hj=87^vG0n%0Gijn
z^kM?2$#g^``Y@;xZMFp+r^-;m5ADU-?P1cY2bW#TzW@J!IOBj9KSM?^D6if7|NnnR
z0*IRl;+_YaB5*h$D5C_#-w)>VfRiDpiPn0uR2~*&T%d8Vi_Iq`UhD1J;?B>oV+$h#
z!)x=-3$SoI@d7ke+<Lo21Ei%M6wCsU!4*(qod${%{#{EzIzfw3Uvz>RE;pj%K$h<S
zSq@rJ(0qgk#ODy;XLw-@bxiPX0d)q3Cn+nKN)&e(f!5S#e*OR7yY%g@FCP31J4`_$
zCqQaX{09%g9S#o*?v1Et>%5irw)5DI4q*m{7dt^+`QspwG|OY9DxE)G{QCmRxFtfn
zo`4Ji^{qgolZ~JP;_R>g|6gAQwE)Azg1aLmx;Hm~PMZW9Q~)-}5-b8X2Q*p%It+Z*
z0gySM11>@4SpKj7|NliR$e=4AgTjJ45AOh7YY)C6tn*m6vqZN8%L;`O@y-t~N+3>=
z-!%hd1n8)`*LENU3@aQ;A2gqE=nj_XWO~i>!VF~G(HHu^K-X?U^q0zXet2O5(f<sh
zAJiL&j(f?tV|xBRCQ(;VSN=TYzS!lUQHrCz;p}fZ4k_O1{Ah8il$C$mf!AuCFTjJ4
ztp`d(cIANFpbZMs4A9`fiT|(JU#y>gavzf%=Y7xx2?sM-?@a%&k4Zvm=4a6O=;7$N
zm!LbQ`L`c<aRd|#KmM0YSKQAeUw@f@TZKWlgAV_8hR&le8bDo(QV!6W?yDIX7`mKU
zn;-aZT+sQe<x&aL#tobYdqdgYbRO?G@y_sP!$W~m?=EMy4i=SOSMb$AEWNI*pdJld
zH;alYXisJH50z4jE@yU7RrapSnFDkyZ<jMC=vv+`XRh8*mUnJl&fK7$3)?%;Z12$*
z{9p&HdRhJd|Nky#s6IxBJ|>7hW{|!v&?cG?6}ET1q3m5OD$}_SFv-Vpq=6PWg3H%V
z7Zo=C?ZsT(+MO3Jf{vWx;NN}_R9%Bl<bDq_IPG&TsDH%P8^H9Y+eL-vMK&lXfBY|H
zOVcdodaa@gx~RmjM3`AerTGU($+7AE2bh%V4|f;nbURpdSDSR&sB~8wbVu8y9cNH)
z=+04*=v)Cxf`)H9SAfRWx^q-yd^=Zw+Gcwl7#P9Vr0)goz&QAjmGfouN!Ct&!%Lmv
zES>Hgh9^7ydAi*=pc(OnDP%x|ue**Tpz~Jej~9ZE|NoEZcH_vZX9S;M-g)cA|40A-
zLsHCtP~CSFBn{L54OIFbZ#_`r+U>>>-g)cArAPn&NAT}@E>|o9vIab|ee1>fN1#c8
z1Fv1b9|u)oC7j(XD*W3VlwO;FuEm7%oWLpX(+6-y6sg~(07`oEK}oOT_y7Mdxj_3%
z_k%k74J#V>TPyzm|F8NG+}LXV;lSSlN(CSrLG7>3TQA}s{r}%x$I<-YAH-kQkN*FU
zN0PS#xoFn|{$lnQ*&s8YfaJgp+gmS`K%S~U)a}L*)OqU#6UZb)h_QhrVRFwN{{Iis
z2=(TxhoBL*6&)o`AVJWclg?W&u090yU%TBnK-Wbwf=t}-5W4sE#fJC)|GyCX05&9i
zCsf14hoHMJWkE(jJu?|(O&Le?2}Y1-KD;P+IQ`KfCUc<@kT_`fp9dFc#~4Go-gNE5
zO!EBJE-D<LjUx=wpnkme^ytG(ib5MyTi=%OY%qPzvEfAP+Y+V?r>0Li%;a4E;Sb2s
z4m)@l7#K>JK-DyOg#ff8r~;Y*miTs<v6KheYJ2$xw5hvBMF6~iv)e@F^U`h}mF_~G
z?n;5q5)~HE-n(vIokV`n`~weY4gyqlNii}QzHPn4-!d68PnTw$!NuR)588(bUb6!_
z)1>p>=cS;r8gQ!ubW>)C3g`++0r1hmFUtOb69zljp|7KxT~t^Yn?qDM7#a_QPO@`-
zy$YLN!%Hu0!5T}CBXodm?7R<}hxnYd6so_QMFr%jqFtaMKx&^J?!3@>9<&DJMcLc`
z|2vO%Gb{e+{Ah8aM5FV?i{+pe{(%y)T|J<RED)4fb$>u(_ciB>qR;>Tzdkqp?-3>$
z#+lQljxvQY9++Nulu1NXWCw%8m4C+=6m%H`7#M6BK3x7+`f>WoqfFZMZ~y)O9~FJr
z@IdbbhqwR#AAH2qCDiapp_JdD`3Gz1E5idXn*RU)Z+HMyEg$Z@_Tn;#cj@2*9&52;
z(XI{^hAaO%c!Zt0IwTmb`~#Jp&pX9Hv&x4vK!pa_@4Ge>a)WjUT>1B+{@?%qk*x<x
zm<<mcUdX_I<=^zAV@ziC3qN@BGjs=V9A|Z4xbhFw+{|JCw>o!#_%9?uZamyA`URv)
zqzNYH!*J!_i@$&W|BpHx{DK=aJqljK(H+Ec@Bz=U29SdsvK+uOYPv7}YcsyM2vQq;
z_{DwDDnO`Oj)M<)>cP?o2ftVeQV1UP*a}t(n(OQqnFTjiAq&#D0PA~E4N?v3XK{dL
z#IL`o1@$YAEd)()c02IAcnE3)yQr`ne8$te4isjM??5gxywuHh@C8SG=jF841Et{m
zj$ZtJ1x|TlyJ|p@tO6>B8o&Pk4@rpXFOGpq#apjWSpF`NaPH<&>GF~M-{H&9c~J9a
z8so*%7nZ+4r=&DPJCmS3PxBiA&@2t4E#d}p$g%ElF8=LKTn8VpFgvkzJ4|;y!6a0l
z05bW*i+qUv7j`9p><49_7hk{p|NmOK+ntMldjQwLM=Z<%Y~4XT{M#~kI$t(FWCSnn
z1T9<@?R*9<s=-5Voey3x-1-0iwJrbl0<MG4SeOgg(z-pk9MhCNSkkOLxQe-(KQT5x
z{m1#LBY-EZ)1#g%tvie(%{rW~ge9#roR5F|$!>;D4oFk>{^zBju{h+iLZI_#C+K=K
zm2MXm4bBrQm`enA<$#>L5fo(GL3ts%^BQ=ZTsuU?pxafa`G7wE_89P19*q|TxBvg|
z4mIcuVCgK-=&aD`tq=a+c#466p`kMXs`$m{bKndASh_=Xnh)u}So-h(|A@5jE-HNg
z7)zL;OY|X50yVKZ0`wuLIox;wI$x*DS-<5#38;xA{}LRd?{?h*Id3fk=#+z(i$8<L
zx1qVJJD7#Pe%B-MVztf>FFw8iD;L>y2UI0(1No*LG)sHp|7+zJ``-Qk|N5fgf$xVH
z7|Iw*gn}}HK+V;upFjg9;K{D&IB;Rw_y%-c9k|mET9w4Xza4ySC=dTOXLiuQH2*ed
z)`Jh&`L_kLab5s*_3Qb!RrB?hs5mq~`vATj#PCw*hZl~w{{P?cMwo%2p_+}Mly%26
zP@(hlIk-cl&{_Ngymh+7xz|mg`2<TR8)zZJ!3P|?x(p8(I^94^5;!{DK$C9`pc`2P
z7)n@oFfcU8bh@z|X8|Q`2GHeX3=A9$uf^&+f3zInp9&hlIru;rwCcg|WG9ab*aH5k
zE-Kp1H7Y8Q8x|#+Q&c1>nq5>RGC_MBA%ZfEDJn7y3=Dr7T|jh$O!pd<2+#nPi;Bp>
z2cX4AI<0T{TR^R!ZX1>6=llnsvoL<|4pC9){PCg!w0H(|js$4j>_3Z2=POXt$?|9&
zOXs0_$U5JK8WnAZ625L0mF5ThphW>6Kt5&%oh`@hq9VcVqQcVa_5a{QQO*;c?w~WL
zz%v%^Jm3W??ktTZDl8z6GEPweNoZbunGb5P)~IkWl*EG!t%sO;4D6y0FJ6G}x`rHR
zaGVWPBtpY>S0?C?+Zq)Wh7#6Ype70D1zrY*7ymomK-aW|fdiWX6fDrdX6bYTtrB55
z_(Hh(0b_?VUw843@5ev}^0$JDXwbmSi^gaF>p{mz`R%#@N_6u;iH`l_|Nq_9JiXye
zX>U7!@ozto_BIf7_dw@|<_91C7qEo&I)4es$OR=o=@0+^A9wx%Hgx;(7knQ<BWV(^
zm0pOv`TzfQf5vQ(qHph!6gl&}c=6%?|A^+Z|2tna9&un~n10|4lV~7MCyz=mXerjS
z4?98AY~Vz=@j9rnU(Es9*HfZ(9JIve6X?nyH<n&E0Z=mIQRxk2?+oJsr6y355435F
z`88;~h-JFsStdzV&@r1l)9uePN!1H{zu)=SIz)w|*r&G-WQFC4BA#6vK;C`>>Qn}F
zUT=K<pPzwYCxZe5gXYif8Wj%B>y|%jSvt=vz6UKI>g4DQU}-)e(CP4l@mH_c|4xrT
zuh)Uy=GHq6Y~qC?afpe3K>=9-nv6Q}|K)zr9G3tCgTQCV5lXDP7#KJ{Pyc+DNw*%<
zlqui<XD?7rD`5p^x)<h8Kt)Nn^N;2Sf2^Iql-PHEcv1BPTt4XTS^;u1XkhpS!~6gL
z{}=!HU;N{L@t6O_A2K$90$lSQC>lgS%hNeu=)L;?|MfP*1C8Dv7{He^l<<P)y93_;
z|Nj!)VQf4C+KL4pGXd2ajc@LNrYAsyh60^udrMSenx7p2wYYXRFoNg8KD;=071S35
zZ~SU~TVm7e=FrJ@+zosI;c+*P20jjk&R4y4JiWdgmZyq^JH;Chfm$Dpj~G7u|KEI^
z<@HO@8a+^n`<f%9^8@(UTaNB2Djz_Zc8|&zMg|7P>zy?!JccL1$(euZLC~4n{M&g{
zzTfQhQIW6?QQ_&`2XYR7GiX7G<&Pr%T^*o6abjX%c-cR_{ydX}d#8<x<<DA9&=Nz%
z^PM&-%?BJh9S$6KI08zo-8?D>9}0AyZ+y<c@E>$8uE@cM9GpM7eN;FaPd4x{Fm!sH
z==C_$ZKE>%;&~?7`ULR3<|X!)KZ?X5R)sJzFud@53tpS>@*n6_Z}3d-aR+cX>}ud;
zXaKvugmqT~52$kCXg=U@+yNAA44uUXFk)N|)Zz!NfMe+{;P`$FltW9hI$ykqef0l-
zYyE+ei0<k=-PtF)y$^KqsO+i$`IZ&rgzInq{}20LqQU{fq2ayG8v-(JgHplY*Pv_%
zw(qzz*wc;4CqSXz&HSPS<nALfFC9T656_<e|NpxE`!Uc8q!RV83}Mh&BKuKv*Mq_g
zsy!m=B{!%9b5UV&u&z;I;cxW>H4P6m9swmBa5@4FxE}Ak+<C6~!QZszABCl2y^}zP
z_Zc2|-+7|>1at4?0}KodujP7!9MYQqi<YpZ*$T3ha&>+<_=36l1mkN~u&VcvtBTkk
zg6=gv%)iZz$>x8la_5Z~z7N3}L2y?DC=|dgmCLXH|9>s_LKftet2VkN5-kTxL;}Jx
zj6r_+`U;dEz}q#LKuy&6!)c8cp{q(=Kzm&Hw?!}+9%#8;VtMc}CwPSO`$bSU^1=>~
zpIa`KC<X<G)n~MT3|b2|NWkzwv+W1a*c|_q1Fu0XT4>b^+MEk%34}fXwc+`<%cZsc
zE@9>0e)zRz=ZhE99)R7g9?ZY}e|T7ivJgMRi>O!s|L-~jY9Gu4)v!FTK~5C_WnK0c
z0nh&bf4vJ7qV<Qvg1coUK=Zh_`CFEQt|qHy2?z;N;BN&T=h$c+6zrk^xooQQP`9&0
zbF~aZ33s=%0BB=jsnhF<)&nIU8!aM&T|!D<c6+ce9&A3KVtJzYZnr^m1q(x|bnCYg
zaZ9mM;jo~L6p*uyyac&}r}Oh`+vWotuXC<6S_FYK8*~@2FdhSG{!pyc&Cz<Ygst<m
zrC<qb^8uFEuLFZJYC*c&A-Z2P8QumBYaR}Mv33v0>!o(xvKFBA47V$JGp2!5#=iXj
zKjO7I|MuJ923zNi7diW<`(0)di}X4G8tUE&x+r9qxF|ov4p15Lf@2@ZoD%j7RZ)J1
z*Mj`pMEL|57#e=bm-A)Vit;nO`19ib{|Lhahat-4FZ}=CasbROVb2Hx>A5?7|79jS
z3(%xB_(+xJNA}IX6wB55LEUt>Znn-t2A6twf$}oA1^RiZ=7oblSR6W=K=-u0ww-Qq
zg-Jz3f`6MEcR*0aA9sF+jD-^X3@`LvOwYf<WKpjS${Nr{I4Bz&>%81~;>G&A|NnO$
z@BHurv^=64yspF&eDPZ;C;zr)Zcz23*7@Vb{kve_iR=;pC2T=v28I`@FTf?tYxWmw
z9{>OUdJkw^4^&Jyzu^Ec7nT9-f$9oiY52ulqSNpzf~CY3bR=hIj*3jfFQ(2<B|OkB
z!OIJv*>H%<URHho{~xBT^Ak*k3uubqROjK|h6kWt42ue6It_Hyc-!>)t4w0`|4aCG
zIB+mAw0<jL-QmE&%n$&XNpn$Qc`@Va|NjxK|4U?dfX;FPt6<<^WC-Z|32s!eyePl=
z|9|`r1px+z)^DY(I}`*M83GJXLKc(1hyv9q!2;dhpmq~Sw*zE3P26i9uyz)e7q_nd
z|8KMt)C`5xlRH6;Q_vE7kliidp)N-L7XSbM{|98e0Y%FZP_%?kce}=9<Yg<#&+tP2
z8K|xNTDn`fGmImx(~Ym!&0rT}0|Ud0{NJEK{Qr>k*7~Xp4Gat=VrkuRM!P^wj?ND+
z&V2g+Kdm#)==Htn`>!#{)Qf-@E1l}jQPJsk&`CS)z{0@P?W~j5nZefiq2bBDP8Jng
zD+vbB7O9<}+jyG)GS)MJriTw4e89qaqT5?1t<#a`o3jB^Df7WcoV_(F9N_h{hM>g+
zAu24OWmVnII-Q@u-P_g!C9KV7|G%!=2O0rtv{9)CnO({XKJ15o`@e2yoz}O#4hAJ2
zoxfi6{Q?~gbI}*<oB{*G1Kq(ojW#ME9VI;7K?<OgYCA<5Uvq&N-8_w*UJ4GjpxUPN
zTBD1K256Au^*V57eBlf>stsh)aR&n?hRzqwkR4Lehl5{yg<MNq(0t<m3+~&Xxuw<v
z72%yXrmsn7maGR~!)0{vg@7$+3v4O-u1HXU&tnVP{8}mn-pvGBGIa0u|Nk$hp8Ws6
z6I?F5=I^}mdR~Tu6hFfYuP6WiN5DGQI-Q5RGgx+lj<EzU9OZqXf9C)H-Vha;ouC1w
z&Koc8o`*ysf0r{y^AQdmP^tOy!|CbEZZIja)b0BJfBMB6OiD_c;9;oN1EpE5|4Ze%
zU3Ic}LCX+>3{Qf0UcKP_GhOs1lM>_8=@vJc4A?V4E^&T5J^v<?dZgUx|NoD<s4y|6
zfts6Z?{&L5bhxN+_lBqlfqTE5H(u;KhwKXQ@XpIKr$BW<x0^whLO3Y7zp(oa8VYMY
zP$HVq1Tz27^mjLzq!m}40u9iaWGRKi9K!(GM07kNs`Y;fd&W$u=~}m#q_uBI@iTz8
z^>n*g@NW<1;$MF?=)W;c%Z^{5Icv~uWf|+GrWf2|lC+rg>;M1QsMZ4|Tp5Q!dO=wP
zJf#HMp9}7>zhDPh9cPlI6aY1+^Tvzl=?8ByNw9qdx$xrj`?r|XqI^_XIx%*LCGP<F
z2HXl}|K_5?%Ty|r5iZTo@S^77|NqBX6TBfS;38gv+8zjgw<&1oxZ9S6fstWH^Yp~q
zOx8>q-qYvZW|9utxAXu17nkmX+Wt4JWkDvC$aku$c=IzHXVviL2Tk@ee4g-uf0r(p
zSM>Sy%@^11{QutxHnS6K=6}-^Z+?d0j0TWXmQUxt!z69Bd+Y!IyFl|Hoi|>r-}?VQ
zXryVwt_0B9f*UX9Z3V3@$Y5Y#*pTsBhMythy$nCYi--pxPyCpkaED3M+XXZ+|Ni>_
z|A)hZ7e4UiXK4QMzmzw_QI?<K#r6OH|3|(S-3dDXbLRJ-0U2Q+(S!d%MGjc)i;Q!i
zOww!%()fS+-aAYR-nZ`l|Nr{Vi_0MDXGRN1M=7X9HV?E$0W>kG0op_fy4dG1|Mo)x
z{M!!)WVERAGrX8_A8~7siwfV1p5xOs?lP&EFo3Ujb5RjW>nu^x1I>vVyf|?VI#T$e
z_~!rr;2A$~9^!kk<ktWHFY=~0++~uhS6Aa_c)^Wk?Ehns89^fkrp_1@z0MCEE-Ff(
z)UOq~%J9GoZZz|3zzZo%qT>!j+<v(88o2ZWTgUWbBh)lC2BwY}6)})GEC<*@lpN!9
z*?Uav^-0iq#+!G+H(04Lmau2ksPQwr7HR!fBAwP~`>&RPA#_!VK*kD?bA>?TGA}_V
zfIwGim1OUVSL0`B_}x&#y31Y-c8uPcOaK4xI1SRlzWM+E3{b-^gQ13jAz&v+a2IHY
z2l%`_%@>>?mFGb!?```3Kg%OyM=eMhNMskNB?6h^etdEInR`se^@qAMSh`#pYzp~X
zT0wm#5tVWkn*{zA&_GnVpiMwYzD*#1%M=C%hL@*U85nF5OAKFvMkZ_~@V9`@W-S*5
zt<)(5EzfD@Zz%=!UHm|tiTo{-nHd;fZU)`rz@pOSz+uBw!f(UO-`c?iy&3a0li{W5
zHTRkLgoST`j}b#s6g|D*K9iKQ{}Y%5=t9}%7tAaE^0#DiGca_QTJ(lFfD2C0S=jw2
z!0GbGfBqJBE(Qkhuqn9rz2nIApZA$m>kmHwl_?JVt$#Tf7+${PVgMbX4Y7~YhPg!U
z<#y0rDWC}g2d-UKLJSOP%|95+<#t&KGBCUr2hG832T4dmC0KWX>Y{ENm2Q8YfdA&8
zML^#mCDhAsCI$wZf>Qa;3ynuWn`yy?c>VG3|Nq-G@V6wfGBEJB`>-%D*c9=%#;}0h
zfuwNVkN^L>OFg<{U3zO&0(TmNXKgxvyts52Tveoi3u%y#>yLx)s08`=I|uk~zCgw<
zSDy|Sm7uh4Uq8qaw&oL{(mlAtM@S_E?1v04{`Ie3$Zq=o-(kAZLnf>G-VhbbfX*8)
zmR|k;AKY=sJ^25Bd|Ef|wGqwNp=%>N5B>k&`QgQ+L;wF9e(P#c=?9&T+M)uwg!&~P
z2LnTQtx30ew;xA0TX&p5=ON8omtVDBDiH||$k5m4XLxZEl+jF&@Vqntg?yYyXN(F5
z=;UOE%a6Sk4<CHY&K%Fu8>|8MaLh6AxE+fFf6H|FM@*7#Rfqon?{YQlaJDi$+3Bs&
z=`GReEpyD-Lg1LQ3&SyIM+HzYz1aY2jqU)QC|JS@zSXYNSp^&v4qW`}T~t`6*FIu0
zW6YVp<q?x{y*(QP!%G8@+rg7=9FRoE)ck{yzx_FA<lsO<jS34h==g3I6#;0cACzbU
zxH>O@ws7<J{$XWc&<1T}I@s+Bx+w?T6a?AC(`}=|%-(qzw1a9UvpbJ)IB2V&2zWh-
zs|)}3i<TEeLHp_;bD|2MAw2%=Kl#@mpI-5pNfk5-#xs5XV<vqwP-h7=+6NjnX#58n
z=PC1B_`wUjB31@G0o2Q44BDXB`mIjA^-`&1^MAhbwCOBQm{b@qPS<|Iq{F%L38-fz
z@Vat(!V@MDg%TB>&SPno2aB0H&vlD}jDmP``>|49&<?}tlb$fC)w3{{NH>GhTNoPy
zL$|LD|N0Z%rXa<g_dhRr%?XyWW@BJr1YN4A`|tmM(51~USwV${Vu{LY37aPV79CK+
zZ{csb2%;PLTV^vs4_14r05X(Cr7MD?*ZD6fmvgZ(F!Y9~1j6!o{R^YRpbkjKjpqOV
z`CHb3vW}}xTDJkHnqW!mj$i_-1YZFMn(BSwx*ycu-J=59OL444rHg@qVL|g@rVU)3
zx8C(m0bivFy2bD&D1nr4ZQ$s<_3mX2D0^<tQDNzP@nRiVru12FiAvy3HqeG;&<wR&
z+UNYvTW>%&BHjeIlS+<t9&3KaSOQ-6=Je+E_SXNUP}BTa85mY@lq~K11xkuhxBma{
zJP5X@_2kQA%%BZku_j%vrl3>?&h4O73Q_9;%3H_4L3#jm?r5$-w>*o=3+}c5|9A7K
z@Nf6z;$MI6-~$QHgP=feKGD$OGCk%QlaeIprYF!+isO)L0~i??*m_-5%sX4APk+W_
zY2>0}+1Ua<i1v7k3i!xc28IB`OPy0xK!?^IhuodX#K6Gb*#bVCzO!dK({m<I{*#?O
zDmOr<FZY1MZF<aeCZ(uQo;MwbdqbVxbR6srb$-KfkiT^TGw3o&7T7wfmW%)YzrJqx
zt;<EljLSvE^d)GaDgU-oldf1(XcWNn_lg7H{LSOQ-=Z-6-g72#!AzbFjGeFE^*V}x
z7BC2O9-7Yng2~3e^VK`>5G4Op&|QMJL6P#N^)_@oI7CI@%?btnR?yhY3JLy}m5@19
z{_PQ5X|1<QiW_QFL>NkP_}9m%@PH!a$g1gGFPL=ecYqF^Z#`MUx&w5d-@6SHI$ym5
zn+z_JUb8m;W-OIlAy8u48}49u03x+P5T<AaONlsWD)vps!8aR(I$ynOImzD&I%Dp&
z9QeR`NR`WR;s5`aYXATL-v`?4{!)~Qfx+<GOFq!rTQf*{ga?M+e$db<IR2M`d{C>C
z*6nHn3I-PNS_8vNoj+c9@1CCXl1Yv6-1NyWnatur8!3Ojhz3n>90QdP?u-l!FB3tl
z>Pu8C!6tWt2A*Fu?E|OVQqgX3wTx8x^zVX1K^H7pa&+e!KnAd4PE1#Q#bm(?D(oV-
zK#NQH*Wa3+`-;hrY2u3MdtWhWd-aAo^g^zfcn_Lhe(?}gLmg{9P-@y6YVdXiM~Px@
zsLR{VgKw>SR6q+bN;F$fR`TwcGn0?u{XS3+=(Pl7k<zE>Ca;+k)In2k-JrvIgQWP^
zUu*mYYHQc=rX2^}rM80;)D@HLJp7`1dd+Jlb*o39+JQyI@a;ZOM1o>g{Wv&d3uMHD
zYMYN2{{N4730nEzTcaWd4h?V^-rX_%?rSC~sR+>6=mGu~P~W`QMTHHj;>F4x(*@r!
z$ur7NH+;h+%2p0CD|5Qf8zv3GRUo$Yh5!F|7?d(FykI&uz4Z-~QoRNT=-^DlZ`L+j
zK}V#PaJn`B6Da-IeD1&DZO|6O&KMPi&KMPyouE_wz^zJ=7k9UVhcYCZ|NZB0na{+)
z(E6XhWjbhNboM`Re@%u7(!^xw%~8?l%ux|J?xLa~2x=Uh?DSDl>2*;Nd7=OB|Nq_0
zp!Haw*q^|}z_1&%Rkfi;MT3FA6?6=LuZxQ2u1g?imoEALe>W=w=tM&P)>I}22B`7f
zE-Lw;s>2Yp&Jkkl&A*_g705_XN(Gt5$luDv1imv@lYzgL4Z?H_<!@zTVqmCms8MlW
z#ozj!5v;<agTM7NhzZ$(P-4F8gFdWDTX*>X{~g>0{0uL4F8=>NgMovAAv9noNC2sw
zy8jTUs^aOieKC`dq02?Zv%^INysyFwv<HB7*8z6WZdTDBGx-?Oj<bH7Sr2OBg4PiE
zr7iw7laHZ0M<t+B_XCLKFVcDb;``1Yi{67yV0g%w*2(*2CLaU;_8Jwx=Htu<|1+g^
z)~K*`=77&<aRHsi`|99RmQEd&&KICfpll2!Y5dzmRM?t-Db%s<0*zyUHU!E+cO8m=
zYWD8>5EalN0pLRs!O=434=5e-w}Ng80Ik+e(+p8z0}Xg}=cuSKUT?n209ppp2|7^u
z!odgJ%q}V-uO~IssIW4W^7gttSoCftAH&O|44}1?prddZ_**uE2Ec1nSeeURkFkQJ
z8Pb}01y~pu92;s>QdyZwgh1MvOT^NSv;F~{AHn}x1jZD44LTAQEUI#h_1{cB2LIRE
z5K|idfseKBW>HD&Za54&G;c9T9jKIOILgStun45O%SDBC(c78R9o{q9fs;C@d3zY#
zRkCE&0399FX9(&>9O`B{>HzLtGMB{FtAGxrv;rSW3EH5RVE~Hsj5q%wcWUndjoiG}
z1rOlxw_IjmV6X)>ocUWpH$uDworazv0n%Xp=Kue0Q3o%62Ezj{*1r8;|3CUAXwth|
z=BkS?KSPE$NRjZH|NlF0ys-NNS*sxwkdX`${_`5tiG4Yn0aWXnf&wkATNadPV7)GT
zq=dQg!2ka{rh~M-SpaHfXMhHj__rTE_<$uKXeUSl+~2APceq}>+7C&gHx52vX?)D^
zfq~)RV*%9<{}~uKZ-BNxUwp9;G?AzRbLLWz!MU$No2fc)yl8#%|Nl$V|Ddg8uaW!1
zOfRNyhICxj7?^ftLpzn%PJ!&wh>im-)l>!@W^p)!-He~%Mf&Og|05cIgXVDfTPJ~T
z;dXO$4tOCsUHT)FT)hNHi4I7~%Q(=ap83ZA|6kPY{{R2Q*2Vw-zleSL|NlY*(3tjt
z3J%b6M25xx|1UH_5?H_J|Nn(LNCMs<6&gqahOa>9rGxhwl|;cdcd^+pm597{o4(^C
zlQPqqt<&#*WD>8RycIOq0vZo|@oM}3|IM~<K+_N<$_t->rUnj_NWI9t56Utnf`%t|
zfl70*#EZ69|Nk$P@#bgfjriF7`(uerw>Jm>_F&MO06tI;CIvM96V2cJnm^+8eeg5|
za=)E*)Bpcr8Tw}Y4D~O*fyU}SfUgjDQPDd1jwP+LL`4VGqh@%)c?5ZQf$N3U(f|MB
z;xoKK0l4qv|Nk#O&iVg88dMsB+LH@2lE5ytZU!G}#$2kHkqS~d<s>Mjs)X?~M1t0a
zv+n@4($n69_Cma<-}(eJ90NK84dl7kRxg%3`Tu_>h>yA7XXl^){0xmRL6ZA&lK%hS
zpOeJT@Og>hfyE%9T|apk7&b7y+rakjOoJ`2FFylEX<@gi0O%kqTM<xZ+{Vh`%g+!H
z9>%|ol?TMim|YKY;MWuX|1SUuG#?SMVJs1}VJZ=CIZ$f40HnNw?X?b=(fR4!YbE||
zydXjT?bmu)Kqo3Q@UQtNaPYkV=Lb+qiJ15Q|8CG8-xtLv|Nn>7-!Jz4|G(kivlIyL
z);`dZ;|E~3zUesJT>s!_^9iPR5XpV}{{Qc|(R_jpEDaT0x$pn~GZ{NU?o0=j{%<sP
zGECrLFub$_w1wn_-3Dkr0Sy4YFxY^|CGVa=mU!nM2j`N*!Od?JUdWyJ{~vtPF=#xx
z^HDD^{B)?!8!z@wulvHJP~YpKBE9R4BR|873v(cev()j$yEPz_!N+I6WO%XfIOu5b
zpCC00jzccq0`+MlBb$FQmh%J$WGH~n9i4X&Gz_fZ&Cl>!33B{#<8KBAMhE^@(7ABU
zwjddXQud4>Cw_+4QZH2Rfs;=?&v91JX?fuEz@3o;GRfxn|Njv$iXZ*||6+gR|Nj|2
z9{da$8$dEj$N&G&*bQPy9RL4+;f$Gl3=WGyWb+Z8m(suf|IcuMtNnHiruNM-&_Xzv
zI>Q4mKmPpxA2JD}P@mTAq0)J(`O&|$&HxquZ2>Y3whc4+7#K<fS}v8y9e0oc-Qn``
z0jQ?`#m?V;fr){k^YDL_sau@+85(RsI}`a!d5$~CD1(NHK+F8WM?4&N5D0M&a5TK#
z86lE(+(Ckgv0D^$_)%v7N4F^GV580emY3b2HUs~5je}2FK&yNhkMeI1W;*x?d<GWd
zp|ozMwB{cYC46bkKV(W{x{E}*t0Z2tbr%VASBZ2x@mR8zx_7(D^m-`l0G*U#`Loov
z+l!++h$V}$^TUhHyTH2%OEr(Xg03E7=oST?pwt=4(tMPo`4|UyRc7b=&r9oHf)WVW
zgyXIZphgq;I4b__29V3iIT(+jxQc%}S6cH=!Lqz=C$1Nn%l`idoo;lnG@gIE7fV|6
zPv)}Fv~DMkwg;U@VFjUp4O6K^Z|i^1wQ$Wp7+-Vsw%Y&y4?2aNsa&I3^(6~v<%l0k
z^C6Bbre5ei`SZ&`i(6X{l=63rs5Bp9nQrl&Nv6KjS>`2Zt-~=^Pz*5|e(Nldd1(yV
zKZnb;Y0XwLr5@c`;P7%~D7Ec&60me-DK+hOMFgCeM5z`u<QO_%yhz;%u0Bh}j<bP|
ze}D#D7|ZLJ21qc0T73*J3qac{w>vN$e89rLJ(z{@!Y)uOq%~UzlxlYuu(W<FQR&X$
zXnk8E+g!oJQYy~Bo%`TJP}FiT9_)P8`QgR%ZQyD!Smt#J|8|DydOw)N_@cTCMEJJ{
zKoWt&^q?P1%JrQOvKYI)C0;B94b+25-;>~_jo|1E7J0cFG<9~8F|E@>1-9oEl(Yjo
zk9CTu^sWHS1a?<&bVrCZS4c3Fit=wi-+8O^#ful4{{KJj25ONoyyov_c(E2V4C(g8
z((OYD_|zgv{_V%RZB#n%If72A=sXD4v}F@0BSnGRJ)xaXK_^K(`O*BwgMa&lCz}pF
zV(GlxJ?YOs28PB*|Nk>FfU-X`LuvVRo1aXYX){1`<l&%xG~^hMm)eIxhCSQ719Y*_
zK8AnH4B$nloyR{f-NC@b#egbwoK*z67yspI&=~7h{?^5e3=E*I5fcM{D`>A*Z;cAa
z^iw~X6zfYJdv}A{EnowCH#7WWVEDWg!r2YtfR+%0Cq8?3U--|!&|9Ly@p&m|VNx@w
z>GBeEc(^TS;~0M{XsuiCW`tQ_?Vp!oXl~vO&O4>-h6i3KC{6{B+;&1t12y6rf2Dx#
zA8EY?@;}I#^M5gE*Ox{Tc4qJH1OFKyXPm&DX?Ur#x#B+qL+9k0{|pR}%Da6EXwk!g
z&SsE1Ui*NZU+Rj*=?DWwp&mzeyW^DU8NZoi)K1R?&BGoBm9)PO{Qv)A^34DL|AQxk
zBBBmM4nj?vkT!k)Zzf4lCIL_BOjr2B)G+N2lY$7NvTJ(h>a*|v-PtvxEW}9Q!^2C5
zr!V-!bX|r4w4}J9MUDZ4VQdFpW(I>&hUwy0ndP=m`OD<Oy8Rgwvk&9+RV>V_wjX6<
z7G>K0goF7Z>-Ot>%*q_wrFEEJGRio5ID1+tB<JUq6y@jSq!uX@r52}_D5NE3=A=$%
z)MLITQ<|5ZmtUU8preqJnx2?k$&gx-tY4B*l$w}QJe^CNc@n3ibAYEpP_RqD^x5Lf
zZie{<CHnbA>3YSfiAkCH#rg%wnPw&os>N0cP@}*H3o8_t6lLb6TPdg(Pd8v;uA1J)
z!YsSJkd--var;AY=0rw&u(2hHNja&-3TgR83Wce;r3!|6W(tXUDGK>HDXB#YiAAXj
zdHE#@#ia!W`9&qEDGG^sl?u7}MX7pR(;w+ED{q(3XD(#o%+1Zrw^B8*sF>bi$n3yg
zkeq3yS`aY(xFPd$HiHV)oScg71xC!CEIc`hMd_&wMY^fU8O7U=nlZC8v6LrfmQ25F
z!K^s_j0H2t_MaBatXy0M4Ebqk42BH(dDH(oF(<psTFl4LxtNckVlf{>`eHtYu*G}~
zu8a8?OcwJobaC)AoaNwWNaEyY5aHryQ03xhn8U@-@Pvz>;U5=2{9N4abDWtoSVN<n
z`58(M@-c8TFe$`4^D~(4<YVArU@=H@=4Uv+gO7oifx{u!nV*4aCm(|lgMdPbGh{AM
zok2mN2Fli8a4=|vvNahR9Qvk5dNS)rM6BjxczT16Vdg4629>RR3??`D7@BVKF|gj^
zW7v9wk74~yK89;ILH%EFQe*(BKYg8#;ovGhhA&(A7>=ysV{p95$56b5k0E*^AH$VZ
zd<<zf`52}rb}`9J|KrKb!T$anA4APvzUc>jnMJ27cro)Rnd%wp87deV7?~QF7?~<)
z1f`}ZcqEo6I2Yv?7b_T=>KRV=^J13fFwr&COG`E}nqKI|EGBHOXP|4Ko1SE9l$>Z`
zmTF*WlCpi47qgML0BAEK2!otx&Y+Mq{Z1mY9b?>d=_F=ZaV;rOXZ~2)4p32+w$lVO
z53~Eusp<Yn%(9W+K$9=K7*6vsyzI{bWxol>9Ap{NniEw19ex2aE<*Qg5(C5Gj)O1W
z{{R0!HLZKXl>`O`Py?K~<HWneod<gz44Qv(mT~nuhPPfSVeWM_=ihhW<(cURl9&za
zH-UH69eg3t{D8mn(~HGWt_XxX1<DnGa9g2V9tanF3h<4CFE}7v@F}l14!&T4a6w~B
zoj1Vj=(v|&(1VE&c3xk>Uh04F0f#E+)avO|H!+ED8-cbVZ#!!F1A6#?Aj;tb=Nw<3
zn|>mhS+5>^Ml%0C=9U8`951H*18v&=2s&5+vV6MvjYxNnibijZiq4B%&?=Z?sa-Cn
z3@r!vTilr#7;IEad3s|RkGZIDC>S1iEddGy8PK59ffD)b16=&ucvN~_I4(G+cJUZ@
z@Thd0YJO?Z@RPIb{%gL5Uk0Ujj=9vUa2OaKczw_CWW%qVQnA#o5MxFVi@W(SQ)-up
z@kYkijLr?eQutdylN9w%4ZrmGTWUbN`6U`a=MAg^bx=XO$zR<5`~N?<GHdu1!QV0m
zG_vt4nZLCY)S%hN{$dYE8njct;a4$#O9aRSqlRAv*8Hs*poNzDI}AVz&OoQq?f`AC
z2k$sHJPEqJ7SxK_4AKocHoW0iDQIC)MTz}OgXwmu%+m7yfB*mgez)_*YrbywmXoEd
z&Bs|@GdCaSc#-w*|Nob4(<@S$T@^!A1Ux%^R5&_cym$b*U@t^P0JK%@^&`;v%RgQ)
z{GEO;mD#l3A2jguqW{nT|F1uQWL|-XKR1JP)Tr>h_5+#incC%I%xF_w>fqd)&(dwr
zzmL7;K#Adt$Up!8yTASj5@Tol(0M$y3nVV-&cE-#3tNzh?{<L0$?(tr|DCU2Gj+c2
z&1QVL26W{zWEsoh(CF~6;K0tqT@ErfT>LG+85tPL>us3%TR^uAmK)kI^0$C);R4-a
z`-BN}{7$jN!DpaD<wQ7-@o%r@cySuELW4!6`RxCfuNfE^Y&iH^K!<zSaPqfqp8hM1
z*;u9+lxTSQTTX$@wzA<)>-GjU;sp3xdl;u*$Y7Ro>2j86e#qQA5p<@-yO;VP^?dv-
z>p>&XdQ70vMP~s4rWXpo|Nl?zZqNy1VCZm`IPNSG;Owbz+?nO!MSg~tzosuwXO<5>
zR-)hes`JE)tsqw&Y&}qUshdRws>$*we=q0^Sl7-M2Ooe2Dm*%0y}sJ|zeL>s^(p@C
z#T?z$5-%40`u`tvJ>1#<udUKLy#-!&Oqa-DRx&+aq763K0cP-dWP@u(Q4GD=`mJP{
z-|KVJvoo0Y^3;IVl!06^K_hIsNhY%=Bh&P{OlD2S&(l|AGVfx{o1UD-tjoB5`ot_|
zE7`DY28P$H8QIwk3@?0sf|dr#y*T<E>~oc{=`XUFTUpYYA2Loa%4T-RYq-V0(05EN
zZL!9$o(F1+m45ZSP+P3>D?N>$(M5$Rz1u~FNo}#tuXNCeCW~6yV!dB!J3wnX(_R$*
z|Np=5nA#$_Up*Jnc7n}0sJ2+)*OP*dLoEj?IMSL=G(0PKQrLG;twT)qms*FM%&+MR
zIm{BuAho6ZX`K(!3@@eGN_=8q;Gcddt@A?K;k59yu(aT`&coBAbC~7oy_hV27Bi=H
zo=7u1X?d(fA`LvR-ghvKfBPl1^iHY1gKCRq7&bC?oJfmKi%W|~7;r4D^D@}Y0%_ng
zr~3}6b=!$EsC9`=V@PZLRw9_zc_Z!ng*3$<Y2PoVDV}=GnP&JSjq^qt=P8&aYKz&$
z8NiO8{x64F)&=IYwEZCW_Z?STu=8UY|F#2Znm5!I?feMxi{*tn@xJ3~>0Lcidp<HS
zsHJywf#@`+*H0i0oF13UZ0CC=q4iP;<GZxOAg>;Rg<aYXh84UFY2R<8fv0@b($hL)
zm;@k{NZ-NqwB8UV3AJ=kj}(+68$dElY0=Xc=Q8^nYb2&w9x8QD+W~gl0ktl%zaP~W
z{QH=m*2@FBT8E+WAp<kWwdrZSK8%cN3;ukZuA0Z(<qcJzwr~STZNPuEv`(=NAJaTa
zc_2q0q&0)iK1e&9)(LWfgFzao0^?6l>vaqVRcx#vmU$Ye1do{hJ&)O;9@It!1@6HY
z5^3Neu1{$%K(!S_Oav|lN<I)V0k~K!s7u;;BkkY|9=I52T{J`;2V4v^TnQ0lfr}|Z
z^wz@!qSNAD3j7Brr{*^tY5Tw)J*L(rC-W=K@POJP2(?(@7wE9)Xtf1$zgiBIa;6y`
zNP8jq8=SHi>ikOY1f~D9g?hiz!E;}rY!RZu)OSp6q0+Cu2Wksde)YXjOIxV%D-9GU
z32B{Lhf4VQ6%M4S{{R1fej4Wmex(C_$J7?c{%Sc;!2-$-9XHaNk8psJ!*r%XW_`w`
z(~Sz5wd!^Lf+mYWDf<8@b*J&KKa_Uxr9hfz8vpu(X`P4C4!#md?+lhm?{pT~#GKv{
zEDJIs?XZnNxp*4%pv<((uRyuz`-QaT2aIWlp&9jXnrC{42uJA;)ZCHwV$-kx|3N$F
z_|rOX)u(lS02>&e_WvP>-FYjm+f3k7&*ijEHGxm*Y29^y`mU#Ur~T-=pZ5P^-|fE3
zY29i9pVB(b1U^AE9!@{zAlsJS?4iP#b~wGcLWH@D3&JzJ^jZd%57X25w+D!*rFV-6
zwO%S^g(&E(zW~v~grr3lLraJd2a+C8c>ybTy7(4+1n1`yX`C0*c70-IV0fptXu-#{
z!=QW#-v0OU;(t(nJDk>eA-yY@Bdz%rQ^PMt{`TbzX}kVu|Ns9#J<U3pCk=eeVS1W$
zumFTvq?`6)@4x^5H)*9q4l&#`{a^vJwB2i)v=^ZBPd0VI#5>YE1k%&Gy#><vPo}4J
z2lJ%ypGr^b^k7O)>kME6`8${kA{4+i{Z0Y1CO@=DIhY1+ip5RO{m-n#XPwr3kRy$M
z+tD=3AEidqd(SW{D!fheX#VlHj2CnQ)X_A@*GJQuPyPp$i_l_kdO|U?iBRX^G|$(M
z)6@9(F}55i;Yxe4WcspVW*5D*9ko{&7}8$+FK1u?4FQ9S5)}?`@yL?);$=Al1Gp$^
zJy0r;ma%9$Qwg&z<ErTnAnNJ#x)NsbdWEYX{jQ)a)_jBqk&q6jbzV=~0owD>2P$(G
zFf=@3EcM;QsMaC2fFbSRbAdGe?I+VXfA$?vOY7vD!2qV^<}kp^skCk}aKYomsFt>P
z!$;7Rnh31mIpOfE@HJ;z^Qr&S`AV6Ed2S@MUMiL5H`MFmyEa|7lv%tUl&712Ih1In
zz3n@wmewt{<zt%R1#sSD05L2t6tks)W*Hel(u=o%l0)!@OV6C2IHd7!yYa*UBn;Md
z@Bs&?^ylAx08{`QUPuG63@@a?Okf1n1Zf}>qQPO+c{uGw1jqmX|Mk+k#qLZ$UCJz5
ze<vZ0fBlX0wBF|D%nS@^yFsfML8<Ti=k&B*84gf^^<rTKs6%j|l;!h;*YDCmW<k>c
zI3!=Js{~7zu%$Jh`~O-#t@BvNjb|xo2Y>UVd6x>Lz379;mp(}EVt<wZ%BRo-kQSO&
z4>76vjRd%?;z$P_d?1kC<)WgK-r=IcoSxR5qr#DP@T~wSDaNR9^c_`8?`BR1wN-vd
z^0(b&N>A%`l1uA6n0D|bOW#3IL8_MC%>XI`ML<$A=u!qCQ3aT2B0@)6Zxv5k=TDe9
z&-p>s7MQ4KNe9hwvZOU1k^-fjgYQ}Tj;A$0;#W)Wwo31;Q4#Aqnzl=d0aST*3a5i+
zJz4&js;4#o{9md#owI^jKK6A6D00Al<VoY-{w?kMv$XyH?HL%-zCTa1JORqyY0@q#
zEX6{7M?ochdZ#lJsIIJLc`em<G!1+cs2WHR6bvpZA|N?u7EoZMbrw%wUcszdF9wpA
zNN=`Lk>zh|Wdu7zfPufIiZN}69K>zReMi9=2wXusOQko|sDO^~i(mxla^!FGXH461
zci;d2Ad}=asDMPhN|`q3fb8jTRscJ!!&wnbcRDM9qKO$4;%WPAuSzm7*f5ofr|omP
z%D@2DS;Cc`)|jGVFg>f1SxwCV>|_J5-n33<6PV@?Y5M}MGBDUEl(41kbDzGol3797
zM#T%{PahSIQcrMrq^EV4sF;9ED7FBR&NkEkRWeJ)GagTKN^Ab5UHZQ7Xj<owwC^|6
z(mR|zUt2>x3fAIm0khO5&G3Jk;U%^7E*CDjG^l1}RLzcQh6i4=L8_tY>sK*L>I;CQ
zjRjOo9elykcL2m_e!#Dm-o;>}Sk7)EUmpDO5o22Oiv$}+{`MQwcULiM%HB!iym{~i
zD0Jl0!1?q<T0mNs5~v7#Id3{+HM3Yfw_bYpOeThp|Mk+l8rc{={!i;Xu9w~oK9Wi=
zJ*~TuhvDP@bkHShdg)!A>>y5uj|z`odRG?%!^i&(KNZq;f|f9sYU-tTHA#XDFg&^9
zcZpQmP7Y9Cg0Vy(Z6^mC1A`5730oR?;4!W9Tw3!v0dVWB9#lGX>M?vuYd*}R)+xvI
zY4Zb6ir{7_VcPrw)P|H}`Ly}8T8A9#r?k!=YKz!DZDv&KkYoRpW_VkzLyqH<T8A9x
zC$&y9F0e?a9M7lCf@&Rde4o<xF??cRNZZd3A`Ne=rFXHVF&<8HOSAl5`l;_=+INut
zdj3!8;CtIDK{?_sB*b4krKf@B(wiT!r*$4nJNOJ#IkBju@o&46#`zg6hZ3rX!ReVN
z?cf86G|t12d;;?1!Dj+#JHd_sm*pSR)A+ZQsBlACRwo3~0$%fIrDZWdks+w+b5RjU
zdjYx-BMnqrG#?Rwwh&^|4o?@VWmb>dIprn;gI;<UsGi~jwI0)6D1Q9^Kh5#=t2D^%
zvLYYTLSemu<7u5&K`wbw`1$|;j>Bo4uRsa(|22@e__rNSdvWg_sPP1Az{E~JSj#Ld
zD3X-cdY~i->X8>~-%Wp7%d8-yTgwkQhOG0$|LdK{z#~07LF3H3-D{^S)-g*&fedRs
zP-+P(uzRkhbv{iy_>3iu@k<(Lrgm3tEkDD{(}Dl5@9L~&V0g(D#K6#ZukTt~=Npi7
zUV!$JBg*C2w8Lr5Zv@iQj<cvFaPv=}T*s`<6!LNUfjVYYB~a~^-p8Vnwj0v$2Su)n
z1d9zbe+vr}=+f&q)7k5p9T`tg_pE1DvH>dxmEk-+H~Q{=Ueb3X9kghM2Q1#_qQV0z
zWLc!rnjd^fPwTc(0cCD>u+0s(rZ2B&R<Cyjm4n?SlHgv1i{uY*hDcBAb&>o6&X=IF
ztXl(QjEkfQsLk2=B2Du{+QA>7Lfb`!Bh4W_4Rj1%+RXH{?=>orZ2W*Fjqw9mJ4<?6
zw~0zx^Rqu`mLK?ASpTb~ce_Y(Kuc>Dm0*a;kTQU$=R)5Bhz9=kpVAuNfx;j?jk!dH
zCq1p3M+NLR5wPDtM*)fS+~~Un_cKJi&qYOK`o;!k(E$GSEGp?~%#bkXbdd$Qq(+4W
z6aqD}poWf(3do!6|3M-yvOLgGVPF6SKRDTg@&;6g#mghp#T%K`8AYetH!^EEf(%b%
zJOOnTXlp&x=`JcP>1n+t5@4qaz?~|9;#7f#ThmuJG8-^8+?sy3ky)NA1RPPFOfRoZ
zXKZ3ts4x1H)_g<)kwIXI{%~67#k3bcUV+=_C1Pp(+b^c=bZP{RPu_s2eku6@ltepE
zrM(FBV_<*?rX5c23{dDfmEIYk)N={cm3X-Z)b4G5qmj0|1Cr~wTTYgMa^1nS7i>0f
z{{K&NhGo077vEn0|KD-q*@v_jcR^>=ftN6(8D0Vfp9)jji`no0|4%>eqN2vYl(s8!
z`m-ixrFxheP?HL*jxFs)`1}9=8_xTK`micWAPriKOlkX4FEB8GtL)BCX)i26P3~_l
zDq4*EEn%S6NsNjTqAkfcjUhd)*IB`av0SL(_XGYZ2htqUI8Uf8n#S-_gSq2YTJxj&
zZwHx6<QnRK$(FKzJIKi2D##4e-*F<X`N1EMVo(UFg4Xvm{IV*kDc5ZHWyaq!pP`(;
z;g>9b%W8&(Us@%_FE24R{4(cn$zW{wWx?OFli}q-#)e<P{4En1%LN;Lx$?K1Vrcl~
z#@}*-;pKA1hF>B4tqT~_p#IK;1P)u;i<Ec&|EC{wQBiI^@R~inBL?bo2Bx&mPcQ8l
z)3O}W3{R%*0_`AwE!^;siN7_02~=!?1VJ0`(_Z9(!aVY&ClgrK2`&p7ae4h<dSeT-
zXwWH`7SJB)*LxZsf{yUZVu034;GxIY%V26iwb$zz4G$UlTc0wfWhp=$puoWJx*4P~
zy5%;1=b7oRTbP~equxTIRtprhZ~rqeytYZp5`btBU|@JD^8edGrjodp+x#7|aL>d2
zE`zK)1`^Mg(q3@={r~@^9wRJX)E0^}q<z1zf~QmrWR56f+78edyV~L+2FJ7)-qj2Y
zAmRU@sCW8r6Q0Ju?NFI$T0mMx3b+HZ@csY)X%T5rFYkg>upDi;%fQfay5TVsD6pBQ
z|7>NJuHOyrjT{CK_oS!wM(u3)&BH(Ka9ZcT=4Tuw?0V_l4s5Ue)4m@EO|wJzEU)eL
z(z`X%z8_Zr9jwICa=TPC?fY?%K_#MT&2JOaI$t*Ylq~1`ew>+sf6Bqv>|n;!gDodZ
zEI|e`fhv1uh7!@1+iWF*8y>WNo4&M-S&8H9Grja~hS$fYpKoK<uUGv8ns7hu_S!LR
z$3xK7QZI!6fL5QRHJ^|L4b7yzV1}r0eJyWm{-Bh*;h_ttCvZCCHGkTU2Vfl!fB*lV
z#`!r7RPBLAI4=K&Rg)cu(+t0*@o)Rpa=XL@B%hwvo5z^e`7w=u@rfeVv`&k6uixsW
zcej|Wxe3mN2S8EV`77;(3#eNMKK%rw`tpG^#lvZx?_TeK7AUdP7q>I3FfwgF(avne
z$khFEI!h<BK|M4tLlS^g+6%v*|Np0fJKE{rTvY5BOPSLQ52UB{rhb8$lXe)?bO;b>
z_;tUWBW>3vCMJg0QsDLzsQHxMHR;C(28NbPC7fxyHgYmCymWh!7Munuw>l5Q@*2c8
zrnDEgRbN2zntV`tm$L|{gCmx<3&l-LX)kt9zt_pE5`FJEDBzE1fcsl70v|()RQ|M`
zUpp8WKs_|W11~FI{GRZ6!mmG|VH0U^Q13`%U`X2$4Q8(avq2{qroC7IW`j<Ie>pvE
zdTbZ7c)c&UG1PhN;5)Xo&ckWVkL?>yH`xATFXsg{1)5JB07dU>se_<ltrHJGoU|7n
zAY(c|q%}XV=V?fLVF~7fOZJ!gX^=`FJ*~HZ5tN1*({@1IBn(mobrU;?-T5Jne_Q>5
zja=V8rga`mPwRCvfEfQO6;xAv=y;IUd;ltR9VE2F8tkFdAU6ND!w`*!K}9W8)y7l?
zhK?TyT?;`fcX)twf%}>-C#6DMm$n;J<@Fs_TTp)%WVzacGau7BKen7KQHD67Gy?1d
z2<OPZ|NlX1&wosFP+N5VW7>;pk3fyKWALJ(+b)0sq~aXN6pMo;oN1slZAt`QORFt7
z|1quem&KvdH!qu!)fB6N8iM@w+b)2@88jCA;wadjw9XG|i$Dhb0NM3A0AxbTffCWQ
z9iV+`X)n&DFfjBT1~<jee}q~3$>Kt>6r}l?_F@fKh1!C1VE3N;`1+>Bq0&hZb4t7V
z4sT#rTXg0ls5i9eZ0tv95<d*fjA@-m(>kxEb)HXqvGL*m{~d=AfpzYq#i0_8v=_Vn
z{r~@39PaytV9$4no&RWYsPrMoZ7<Xofx`92^mRSVvWdYD|NjSvq~WEs7qZa|u<Abc
zrEqcD3sZ>fC9n!`G^NG9{22ufhBGkNff}QrvGueUt)ObA^PpbZLd2NG^be)XqV+HT
zB*XpC{H7qS^LTn%cLa-GdRMavs8`f^48$}AGmoZ$7pX%=lRy#i;_p*XM*H!<R5-oM
zog=OJNC7lpVqfljlGb?;)D@d;0McxDDZQbdgNc92p|pdKBtSh>cdj)4_3Q`JI1i<D
zzL?(K%Pb=bPTU_rJ(sjb&~gw^^Rs07&R%9ESsxZqo76`I(oWP6U|;}^Uih$pM?I$h
z?PXRr^I>5F4}sW#+h?G{JRr^RTY6e&iHZwY$OE*`1gyjd+^!8sPwN(+9@fWfR}bnd
z)~Muw2FqC_($ji_bvjPG1C6&Ge8B<Y>OwgJAdViC16HX24kX0$rUNuw9_$3_6o3Sr
z-=uYZ;<!+%)bNm{lrIguA0zF>4baJ|=RxIUSBMI8I#-AaQwdwz4xZ`K{mh2S|3C#*
zGbA*fL7|xe56xYVz%6c$>Dm3v%KR(9LAoR16=;wy^ZE3}{mj<jK^|wWbWr1&12mdE
z{Y^i!omzTYZ;gsa+V^9i_C^UeGzLE}dCipuKB*x+?eo&sOVeW}Fl%P@Kt{n1J^(dy
zU06V)J)sV1@4-FCv=`~|pxk{BG=S`sp4J;`kOtafp$THTq`d_dgKyK*tYcIxN;K12
zZ&wPW?U?hCfg$aE8hDq~YmqeY0?ah<O)}FzPGHt$`tfwS!bD~fo*Qut3?O59(_VB;
zcbLd5FK`%~nNFm=SO-dAoyVu=Ph^&;zgeoA*7~iK4V36#=iB@$NwxV`DwP(LmN5z3
zT9^b1zlgM`v>l*T$*+CWf<P)kt%=oO`67@!sDs-1BkhF+#L^Opv|T=+`f<lLP>J{A
zCs@si|F8MeUR?P8|NqOv|7klwH*Tgy*F$HVVBJ*EEJNpUuuD&)bTHHwtoaD4px8id
zQc%gzeAXbX^94wV9h`aC({>~XfZ|R8<h|AdCG2US$<TX@X)j{GgT|$gv#5Z|T2OB#
zt@DN2qBS4WyIks3*wdOHyiaTWU&5K*<pSp2$71N2C!linD5x_GF*kxSt@Fdb1Eo%B
z;EmR4;O*<+{Cfga*0&xgy^*$a0Y9W_1cgm1_%5j*|4R;}cQB_lK4aixVBl}57i4^0
zlGga|6KGPmbpk`$&J&;@+w}=Vg0xjbP3unE2|A7lRMCQjC7`D9w-o*dnb-Uyp<W@a
z`G;FQM_Tg_?NW!=a%s&k+|zb3GB_}$@h?79toNEHO?NfOSkRtW1*mcLhL^yOJ_(vR
z0q;~&`k&t6%=o%G{g^W&!|M`Aop1r_E|Ar)Qot#TzxBsIkmSK1JZT=K(x6s}Fp{bx
zFjbfSr5*gok=Fc-KaKHTn&sybMX1$ao9okFfF|+Nz*evL2l9&Z>su%>4~iBxaCD{h
zhN!T?qS+Rds6dMdrT?XYc6LCfgVN&DASHBATIXTCw1pQEK$*ZC)S+Nv0Flg~Mz4<w
zQ`#<2kf+tZXao7Y^+4JV(BhL)S&%<MRG2`PGQZ~7(44jl9A@AlvkU2+&H`x>;1&?5
z4$w<mcm`yCiDp{k@0ZLB3?(A<S!s>GK_-_l)y1bDXIjPZIwJiz69Y^7F(;;!*FK<u
zZ5~il5fll!X*-=kNwV)CD0Qbb{swKuF6ByVesDjn`2^Ez&|KZ$wB{2EeFs7Q2lZt;
zZ$ZYT(xP8p_yd|}i%vT{J>fmG0po?~6W=q7Fg5&{zWhD2d_AOjk)GBY!Isu}>n&(l
z1$_Ks+6!<c2+Cu(-dY|j)dokuX%sk4OGMLl*?==HXaf?YpnUoHe%gx*ptB6mLIlzf
z6*T08Kakm-SHX3F3@qlNz@q|4gEHMN60kuG7to+Wmx~-bD4+3w3R5{Ywe&7=we&6*
zIaYA-a_|9r8vnLSX`C0pMKpNeL5>g1)|kF)3bRbT17wJ%lSL&Bd{iJPW4xGq8=TQy
zR5(Dvn%?K4!T~Zk4SbSW%cWAbH1J_pX)mlEfE0rENcCI*S7Qhbpz2EQ2iP}Y2d9CH
zZe|wnP>_q<kF@5$jA@e7)2A{^GV)AsoXV_R4?0aR%@9)Efd*b&R8&A?tYGKrq_w`~
zZ*gKwPXnF!n%4ZBKkeXimh?1c&}d4xJ4+h>t_R}9y5R8>g|rvxpynRvAnLSTCg6ww
z9ln_MLgU{5|F4VEUNC?9|Nr&zw3XnK7ezp&@a3xv^$ck*V(<R{pB9xC`Pwf%?Y|3n
z_$Ne#CC&0x9dlaetMr}_6%|OrNl&xPQDLb~09y!|AclDm)PV2-IsG9^8smwy<`XQh
zEz>gIfs6UScR-y+SnNU~cL%6Lou1ZR?*j_vv`$9QP?a2L@bth-W5)EfPIj;*I_YWL
zE-E5m5>(ZD{ZBjiP&AG6M0#4MJ7`?VMMVb0goGSu-o>3IJ*}}sMSy{UgCRYQF+@cs
zP4nu@?f+1$2b(RBcJPHTXto*>z8Y%j9qgE@I6z}&7HQv)gB;A?x|RW~S0U}ipD=K;
z=Wm(FkhV($9NwUF2h(2cz5_}hNHvC9dUuW-D6NJvy#)=O@^3%!Hm&nlTJxh1YW1M@
zfiO#2AZU;-Eg&r@Ej+FH9Zy<VS_bPiP>po>HmF5+1T@BlR0qL=F9s5N%xV1FkHUJd
zXaB$EOnV{u;s5`a2LD0D8~A)ecyl%FFr=>p8f`97@#2Ba1cJtCbpI^pWdP3wFqcTA
zHNRk5@wY?)++gDYNk^x}z5MqZm4Cr2t@*@%Q0|`2GlN;(hwBEUTgb!+8gyb=dk@s)
zY;yn)_`9fZgR5I1NUH~A<cmi)K>kB&W2u150u{wC=S{Dh!7SzE!@~p~H@TGdf)7;s
z#e*tR@wALR;PA=6_5XibWZHfn(8dFQ#<ZQF^I#w~DtIW2DeXn_^t&^dC7r?MD5Zf<
z$Vq##0aOV_rF9+$nZ}Wparqhp!|S=A65K_F$%d^&)P}vp4Kxybj{%fbgsw9%ygWAD
zW+t<ea3n};EJ&YqTE@$33=A(lrWej+makU_NkoGrIMXuzf+WQLLmh$Sth5(h*Z%+S
zxc~~7dEhoZXsQ#Ok$Qbtm_QRN5I1(-NPBSwRKrB3f$A#N|1j4vmw<<4^sj>wh}un1
z?n;Y#xryr^XcUBlfxmUdbh%l~=7yiHf>I*rd?84i4;<i6ub~CF4m`jYPH&yXoXqdT
z!<&{R4=xl>{Q3WX`mb5cCM**`ETh@XhAhz_R{CsaGno*u1NyIn9Ps)@TJsUOQE7*#
z@1D&pS8oAwT<2l1#Y#co3{#?zw(G|YP|qH87hKwl#~|%5T(5!#FF?bDua#h{4%E8D
z>=;@uRdA%eSO_{8ZzpKTQLRJF4wRM=6-gkdsSBC~2T%9DI0{ODpoylm&U^Ln=7Zte
zv|V4A85rKQ9H>x-HlQa3LL9`Ow(AYpLHwZAYO@&9UKoR{JGa82gg@=YnkyieDS(pK
z4u-VWx20TZyS_3rFm&8_&7I!mqW>SleV1nWwU#B#_4V{L{#}m+ie%DuyZ~**O?zPm
zO5vSH!E?yXkNMLKzr7Yt178^mN+~yA$ECeE0vcq7yH5j@X<vK|fVl1<%yov0py=KP
zioO>TSN{Kht(s<euZDYt1AlAef6zpq^a=<57C)$a-lTW1nCGUsy<U+9-d&j%1&e0z
z^m$+!c$_i~yn!+8#j?vFPl5*I(q4duA=7q&@)M|y@S+<e^#a^x1hsTPQB<m!2Hsc<
z&df|{J2(_TF3X#KVJ@>`{k8P8P97CRcYDFd6)Yt_X?sEazrLdz{;Mr=0QLOA2XcU>
zs4qWA<NT4<e1ZpQ(MWn)w}=X;f%xLz-~a#nj&4#_>kxAQ^+`(jU+bm4Pym$!tp`e0
zzE%XahCeVcluAJK?3i9YkC~t4z~8i}=?yEHMe8}zI?tx3b;p3}iEfTGFVHmB!FQl#
z5x>$H&!-)HFOX*WkH3|HF>OC+L@BND@3RU<hEle){ca2l4C!f|IiN{~P8O97Y|psT
z4Bw`8zIevdapD;Zv@;4~fJ81lV@>P4aPS2Oi2m`6JFWA>v&Icfs?R_@K+xn!w*w0(
z$2W+8df%XtlFpl;vR{QI?Zx8h=JT2JWpcsUX#yy`n~x}@?Es}Y(CjT}r~CBzN0`Oy
zo8Ks;bsh%yl||r&ftv~(@NtX<b_}3$q6W0Sq|*j8+jt<o%SVL+JPN6q-sPgg0ctx*
zg4!x7l4-lx85u!!8jDKWi-n-Vru9IH#mgEda2`=h?`i<8-(4Y4ax87P!}Rb4%wk+3
zpdH_7h6i4{PcL7<tXU75=;~;n!T_F6Y-WU(^!#a^M?p?(2Kg84L{Nu#TZsyPTJ}FK
zz4Wg6nF*lq<=^I_0-2CvN!#@uoUh)294Ua}NUuV$BV9nD1uBz34RbC~X(wr4&)>F{
zA#HCFXrcE$P$iw#`7zzXM}?oir42O0844oWGZGjWEDn{H>ZNzP{?JSBo}Q4vz+ic(
zC<P?&3nY*P5eNne`~eB1Km?rh(z{|Aal6fO7qa7YK?BIG2TFM%jw@$P>-_p!JgxaC
zSDIT|^FL1h)`b6QJ3wbsynH^LV-d5iCU|I@v4nF2d&5uARj#aQ2OqP6=6|!lap|RZ
zPXoD2FTJ}zX?pe|X5CE5^`LQ<5EaR^9n4IiY<C7U?Av;PzvbTF*Y2Q@gGO%`sNK}z
zq9O&0XnrPe7=j|&5;Tb2dZ1Li57Y{<Q2}WaQA>x!;>*o{)0&ScfU}Pt2dHp;!E_4L
zgN1ahkAfDkfJ!L-Z5Pthx}90lUYvt^I(z!x#mqAPEGp2>HDg-m4^T8RrFDJ)(afMu
z6blomtr*M&su;!ogM?W@Ed@5||7iywai)c&?F3~&aE&1Wa%MC*=^KDM_lMJ71f0a{
z6d4q!)Klt|qZNz{V5g*kmg+^r77l`%C(w2j%w3C4fZTNqG--SAl>n#%lAhLW4ho$T
zkS|&fl!kyq3zR1&K=MQ{3uu!A1E{0Y;iAF_3LGX#;7q@`gjuovM%s(3pvXm7i>UNK
zbt-sxa|c5$C>1zf09k)DJ*^jfMNOLGtu*i@HIT6xJy3kT5cY)BC=zMA9)RmR&{Z{Q
zFRq*eH3&}pf6bBhV)di{|6lKd)D#-v-Z2066QGs=xDI*Q09nr2c`WUP$$5~4;1SH}
z-<C70u*~paV3;nqf?1xW8FY<}!wP1d`paP7>Ohu-G=K-mz{^5bf!2IL+N^e<qTHdB
z9n^|^d50mr%b7I|e7j8=?0TCtPS8kRDBGJf@D(>{kUMUY(z~45(mOyUYp*L~I%rln
zJ+0T36~tl#7hY+q^`LuB(wcv$l)9yNIfHr>Au25I(z~2NLx`bFAQmTRxQrRZ0wu^$
zuq=0aH|P$V*Mblit_8K~97-p=jQOA51)3&>8UmUafEWVGk)dEim_f#Y4Pi;|4iQjc
z0}V!ovZr^ksJu%vJOED0(<iTFR_5pc1wneJ&-8sOndOARoeG|`i=e(EsF35|esKEl
zmCRoD-7YFZ>1m+LaKK7L(q6QH3Te=wBwM;>HrH$KG~W_ca7DtCp2jGmlBNneB0jD8
z2M2#k?f>bGtC%BHL0L_O2igV%4PT3$05uFj*FJ-Si^=vsL%H$vf2)`kg{(oggNHNH
zL2I};iXEn#tY$V9-k_4!`nH63gUM^o4GJJ8(}w9CtC>p~%cuWa%`77UEB79!?F4NT
z1a)&j&DY%NMr)XL>lM;E52bfGaHK)cZ*v9p@I+J~E&{hAKz%t-$<%iol&nBw-YhC<
z&Hupz*&uyK6d;K*E%v3;vGla=3~*)I3Q1bsu)tJd(@XE30a}IxF&a8=UaumO_CojA
z|No%%ZQ`JOCba;xP-p{JTIVfL427tOfOAM5BCGOm&rx9m3+g}x?R&0)r_K*P0}aQP
zm~em^D3C=|paH6#phH%{DMu~+bADRqtv6uZpo2`)Ktoied>c4G)}=vCy75lyJeCGJ
zHHr(YC(Y^2>-%Y~|4TU_s$Ofa;3zo<Y9E27{z0pVz~i)OpyQ*!rnH_c;ds3{4Sd)Q
z$RVH-`{Y{YP)611^6Qu-CI2v%^V$fM2-zrrCfQ#)GTAurw}>#kw3r^aj#-6q@AR^D
z%(~fmNB{p%d(rvv|Nob>K!cKLFRp+4|Nmtlgk1|7Z*79GuO0aRKkeWPP|0=yTq17x
z{Qv*UREQ+okN^K)Mlz;%xpCMqmspqcwHzpMPcyt^!&GAOvXaq8fWNhPI^TL`>3SQ7
zv>o8Hk0cpE<BOmX><?)#`hWlb|B{6fR9ZAcqO_|UR9d8W@TlmecW(gY6}|NC9pIR4
zKF+j(FRk;}JJ=w8)rtTAK~V`30gbAsz3>4Q#xFdaz|*Yn!13Vy<NyCOhkE{&CWf@;
zV{GXSHYyAy0cp_UQwE$NK&`wDX`P=SI<&w#N`limKfSTpP@)AXR9-xHfRv(F({^0}
zm!hC+rPE%lIQIYlYxNBaK-xhwG$1G2D3pq(b-sl3XTS|KMTWE&!QcP?2SxI)cdw<v
zA;wfH2`XYcKcv0jyfHm+1G5R&6hj7v*C*0m<Q<yczkyjNWXbRU|6fnCX)3X>X(@5A
zX)N^s#rX?!PX>mURsX?kRnRdac@Q?^tN;IBCPCO=?)?A%G7Q3Ibz@+7=>=hbo6f(H
zS(+o|BOgQBi=ea9jW#lCP8Z(BEIhsH12b=Z?4SSt8_t{q)n}lL{16oV%|}GQ<Clm5
zcL`7`?gS0Ag@BrsKA^!P{%v70>0NOWX`T1enxETuT>N*kf<3MCXUoY_&a_>Otqcq=
zk20hke9YANn1LD8RP~cg<2(&w<cX$thN$qRz4*Pi9#jmxOyl2n((+(B|6~^xW>8)L
zaZmA2I+)JoqrzOu4O#dqV0pTTBW)Ms1O|rJd1?InZ-a+Y_}AY6#XJAD7io;IL91}m
z_}AY8jaTw-`vEEstwBR>pk;EPIdaeiBA`}@8xv&2j(@vum_QmM$X}2(Mxavhh0pK*
z|I@o-RQS?6;$#}m%matbhqM>R_fKEDidh;|%0b%ZENK}(L4)NP1)yP}jQ!wty~bfs
zHG2d+kn%$RFsJ|q?Gj6S@p})*uLr@cdXDriXGu_-h$+3xSro(ohfuW)D0p%}H%XsM
zJNQn(@+<%318JQ{L82up%$Das-1^RAX`JuU8>(d(K#O%i6QCc`I$v>IC}mH#u2JDA
zlStde$P8)Efch7(S;}wwz*P%qIuFzoKjxw$!U{6jMTH5xc$|OzK@itRg&DjE3v~Vw
zcs>i<sFwiEouzexhT%Y$S&2<QyOmi&88q1CqQaB*;tQz#!pp!1vh@(S*eKlx4hDtk
z9NU<+E!IQiQxNh75P9^3CIasF@NX~RNbh6lI59nE8?(gp_HE3COz(b7|Fw--sy=lu
z*kF)G&_*QCNIrNc(>2(3BG6*l4zWIl^sWHehF>E5ExC;4l?}f*_*?84%PkvzG4r>`
zGL}n#wj{LNU}*To1iGC#trNVt;^mj$4Zm3UTX+~7ezEem-UBTt0#!&aE&ewA;^lAQ
zXRI$5Z}`Q@-}0BC;TI2o>t3d`T@3z=3@_I*HT)9bZ~4K{@Jo=tbs0!Fn~~w=G$!z>
zCR4_=&co$)4ZocDTND_}<r{v9@weP(X!zyG-|~T>;g=|XYcbret$QF-gblx(`CBhA
zrh(7eetDd+;g<)0OZ{2Ka*?#1?BM;AZv3qq8Nu$md%5A4Cx6Q|#)e;h{4FmSU#c>t
zH&lo)RB-kkRO=FRWO&UEW|T0bcLd0$cYCO`Tmmh5Im!4Mv`6h<dZ&lV%O8wspd&pP
zUb8{$gawN1Z-|3lzf0?^hlEpraoR2h4@QQU+Zoe#F@!NPyj;f!Q=a%YZ5KlkBg4zt
zpt64=BLmna{2iT)X}j2_FfzPsU`#*mAP~AL{kVe!J44zohPjLkX)pSBgGLk`WDQ;x
zLf!H5D!7XaS;)efwu|8dBSZa5H^%g?2$_c8j3sWM9YwV*xA|MAGaxN*=>jcpY54iS
zlrR05gA8NZt}O={8D8=;ra6N4iGd`c;ta<a8D4(J(AshmqLU$Q*M^IX3@@)Tq<O-0
zw$z_Y=b!2zleUZDIwQl&-N>4u%W7cq4?!Wo(035LNuz`Tv}cDAyb0&!WCl=Bbwbvl
zl>7meNCIgG9|?dM4jiC;HK1jCS3m^`FM}570^vii{nK_a7&9@Xi#Ak<+%Izi8w4_v
z4b&NQnEv=XvxQn(+)G(-qyA<7UQnt?JKS=q!o1-Ze|a{jqXMdSMW#ATx7yAeV&sqr
zs@^V@Fu!#DleUZTCKJQU$va=Z+>`c#dn<g|j`eoP+@#@wm&UuMAK1<;$<%yt`t9w^
z)|Pq=KOcbR*FmeL8h`$0C^LPn*7%d_K?z&qPu>TmoN4^q4mO;Tc`euYQ~yDU5Lk&&
z!_N<;)BSfaKW5CEZoCt`kuq^7vz7Fj>kObom+=r>f~xKY4>XGFr7ctmo4#!)b3}a&
zxPXlWPcv-U1(HsS0v9v8cYz96{%ye`Aa3-_w|~I(FGJq}&<Io?!^<-pA+ua*FA_IF
z{3V*U^Zrhlzrev1|FU^IOq<$5KG5cwE<OzgP_3laC8o)cHeGKwvnfv}Y@^o;>5bF3
z?P1oF4dzJib7o50@&7+)8%0{DlSSGN{@GCWbjH2RB62rDrxtZyQ{!h0;ZWmej1k~h
zIFQzSf{|b8z^g~QrW@>KmZ}#36?$C`vNmn}Eo+&|4Qzt>TTU~S3)}efx149Q3F2?*
zX0TByiFs+tZc`7+<TlOxEfP#N@%$~@7+xx{+Z^C;5o0MAx9Q+-dB)7&ww)=h`9OgU
zBY&G1`%6Z4n?w99Tr4&(_**#HY!33bzGp-BY<ee)Gt<k%)6ec@*6_K$9#ltxHqOCU
zlD~Yi{>h{ZFF-rp(mR}GUOxZ@bTeY5`AhC?=pyca^wJjoneMoc*~3QW1_Q%uMH@-}
zmPM?ui_+7MJIlm_2HcK0OE9H3C#(ER%lHP4b;cc_Xno1ZrkB>u_ai|sZQ+;cNB1#1
z`E6!JH(z>ddY7||jYEluO+bmFjcMt<bg;2{3qB>h=7O<5CZu;bOT6@Cg$TTKU<JD>
zbU(Aar8HQuo<VQH2aqa(ms}W@%-sUAq~$;fuMK0VZ`zAR8~^`*`FQ%;{me=(OSglQ
zQhK+uN(p!RF=yE}P?Um7(g*+2JDpWto?-!urZ;=5Fs6Bc!tLdD7Ep(Tm!Su=w9ZF`
zcly8m%(C?^5R*zcK<b-ceq#oWC-E}yx4N;Uy|DWE|NrZEkU6=u7lmv8gNISLLB)hO
z2Z(fL0<Cg52wE8q?!EIbIV6yF@PR;D^9lWibCW?^VA47rK~r0ufjoL?3p0|^_JPuB
z+I|LxeugxUl6p?4fZ>18W|UuPji*5AH$AP>L<QVXVL>ErM+HdxK`lM4(@_PnW(Cxy
zg<H(|A&v7_!@0>|MH(P7PzSVJvhzfGx3@%E=XbSqe#QU}J$^>Hh$MamZg^gJy>GhA
zL1s-wsr?KeJ}-U!45T6<spkS{@jYnlko#rnAJ7&shv{htnN1iSrq4deyqcXC+^OW9
z?t6$?)&$B)+wlUligp8N5<f(RH*Lo!@c3EhWpJGFw=Q7-4TJHfcQ^~aw4FZh5VLtA
zBC#{rK}<~B0h+5%d!Yo;Rca5@1K#Jw2TEBW5&rZJXOWl3eu2VZ$1?^72GI8AOKCeG
zQyxz*L9A?9I^FCrvvR#19|LGNvpNGP);O<~%CsD)luv7ZP!Hl8UP{~X71Wx1G4ay>
z|F1y<B@JnvNBfS07ow<xbf$HhDKWgX{sl^yHjE|gHVP#!FHbY*r7d&_OS5HQU|=j0
z0rlO|(|RW`fW}*PFxW6Kyyi{Q1>Gf|HvPt7W?4p;>E8}B+c73gH$B4aqlEBz&wBK1
zR<%B@`G~;u#YdPenOxUTzjuVWl<C~M>7hrNV<rBr1beNtFzrS9(f|Knp9g7v5xH*q
zsiVx1>b($IPy^#!18BVI!;%00U!MgJ4?4@fRsk!%xpunOF=jJkST6&#8Y3N43NrGy
z>|wBB;&1s1I>@3`kP)nW&00{=bR0AS$}&Cs1#=iv+s5gKUoflJ*R24%rGzW3`I|>t
z^EpP4jdu@2ZG0UD*8XP=Nc*wY10`Xg^}0-Hov%OxO=-;!e#1MMA{#+!K$8?KX`Qb?
z0|sG?uZ6(c_pSk--v%0F4Pbne*8BmKsb#?h*!0|&%)-;_k1=zDw@HGwEMNHua^^AS
z^e$&v8~$?fv|W6l{RE&THr#4mVwXO)T;gwC&I~$$;TvPQJjk#5jO83H2l!h>7+>py
zrX%$jZP@r*{25<1Fx&9+w>U7D^V@Lpw_IVg;p1;<WqO&(45}TRnO`PAdk%fa)an;p
z`q*-yGz8RzYJOOswo3z)p1vQi0xh;?OWPFyDR^ZJVC6q(Q&gv10I0(2;PV7gonl@L
zeFrv4sC9_7F!UWr+W~55sx3}n=sTA7{W$344gM(y)D~TYEXX|n5w!SIZPA5~;B~X%
z3~4W{G(l5-$smhg=z-ag1+_|GHe`{n7?^DjR>K8mn}gZ^G(dWD!0b;THfUWce@Dag
z2gjL3!?HkQrrUx=K%Eq4(U*T2(_jY<EKFcX?{t<(d+~cIsEBkH?K`BlFn|G^H%*w*
zUa*3CVGY$X45jJm4b_qi{H=0K=?&Eq4E(L4)4fkHD=>bUo^yg(F5)U9*l@wL7xvPy
zg`Y1|55g9+%7WYk*){cz0aReKryp|`RCqa$F}=H3qWK?VsSrqiFsLE7%~>YR@Z?Je
zMo>p>`u!8ky7eqeLDxH#N<v)Ma-fty?S<eWNc+WE0Mw6v!35`~y_hP+0J^ydX4ngG
z*WB;*8(8G2b&CZsq`g?T1iW4qX+`QwMQ}&X8GK4e8$&s_4SR`{4afBElg!-pRS@L|
z(hM)Xj)g=ov<)Pxp7x^lAZUINJcV~aty?Ytv`e66GDF%9(6Lu(FFvR-Fr;~>y)XqC
z(s?|Mf7@m7Qk)mRWkH8qfS386`>56-cmCt+IH<9YAp7UzU*0lJ+sO#J4H#5df;*)z
zH4ec&v%nJ+UovV7y+E|=YX#6|esFT;0M*|NjIa4XA<0zA4qgg;5w_O$@N}o=%tkTi
zmP7VbfVa!M{|6orx|H@}&-VZS8y-9Gw{(F@Nfz)%HKVj0JV~GdDbQAbmcB!v&7h#g
z9}H=>An_6*&~klHY20EB8Zx=DY5Ild%=S#1mP{9X!7NtqwGh&v+|Um?WFU=y+mE!)
z-ylw!;els`Y2j%ZUZCNk7k5BqAZSsf;elto&u(ov@a!5$#g&HNTqO?W0u8@eON`5v
z)4UsgGnf0kmTLITU1Hwwo2S$P8YDOPH>ssFoPKQpG7_?_ym;mR|IBGGj!*w}idn_<
zN8hEiJ)mpG(sr$6=4W^*$pQ&+=!6Am{*Zq=18CqTAT1*i>?ZA%(}PblJG!egmDi_r
z-UF30F^uIppp#<`flAy~Wl&+VJz65|;A2p_+wLZk#tGU?u)U50yi$^t5maWaW&|A>
z^POpW<ymGOb<n6d_&AuipiKC>+J=|Eg_Eh=*@ip4+nWX4OcCI3Ju+SA46~7W5)-KW
z`poz;ohkh|=%^UIw1qlh;OaCDdQ1$cjR-y{<~2)tr=LJt=ZBa2(|gV^tJNPaF#!)a
zpGbQ#a~Y_p1}%!MJOVZ%4RmD8WQH_X&}a~7B_3$8g-2TFtJjx63pb~x`M(BxBpNgV
zT_*wZ4NPBcET*os7v^vqDz1U&fFDd3ILoZ8aJ-Z=t@Sp4i|YS0Z-{GNZ%seu20D+y
zPlfSi%=C)0%r;C{|4o-a$E-H}&RJ$Yri%>Ib<Z#>Oy@brEXX)-y4*QtQ|?T?w1paB
zpp^l+)8o!DYbbkyx)N&X-IYvg>D`_zJ!iouk!(-^Pa|*tpT@ua)busym=zeGO+R~%
zS=?@gLWw|H##C^;b}R+8onPxdNl4oTTGiHfNUck3&BumEj3ttg49W;PVi=UD*MUpd
zY13oQGb>N$e#0!|5|O0G&nPC5#IJBLt?}Xi|NrIFnolzFD;-RGm3y9_fdg_JU*FBX
zgMAnK9`?Qb|7fQI0|Ns>AnnzP=@ZX0i%6_EufYH^rTO7Mex-x2wx4JC0B*)j-+P`}
ziiz*S^jnvi&8G8TU=B|@D|-5@*y*zpr_*+oU*KnWdGX&Kh6XN%7tYrI|MRc<^(SrD
z1d#Bqf1f8H-JH}7zE<f)kuB(4UGQy63=9lkUjO~|2fDiHM&E_BJrchd7+%htzW)NV
znn>V8K5#pbM<;FPe^8U?#r@UOe_mkr2W|Ge$n3<pe|pbFW-BI+8PiW(WY%HaIsNNJ
zW)nu^=~|bVEtwuapPqV&S<~*}MFs|g1FxAjG|W9cM=$NanM&fXKXPdSFk3+<>|`9g
z!~i<p!SX?=OoQFUj|?R|X%X^i8556AKXZv$h7TMsH_{dgd`fG6p)p<I0<+e1h0DyL
zTnLHj^_Q6^>&O0QV0an&KP}_jP6mdT`~Rh7RGnmCc)9IgT87*k28New|D|P2Yh++}
zx#VA3M*6Smj#rqaq+~hx8D1XyWq1i(C=@U-r0x31&d>02^RMltSD2kyw;#C4JfE#T
zBZ+~()%OFkGCq*9?eCB_BPf8Hqp<UB(iXn>2p$0xNbhpx0F6|NsHJtAefXH3*6j*f
zju$Eb8lLUEoW{TACR5tM*Gy@QAJdvIgO*hIs7QeKC4xpZxBGIXb=IE;FB(Zd?#ji$
z0P5%IB!U-Ff)1Bq22~5KmrB_|i=bMzGk_+G#lSP!;Gx-0@Pfr&@MxpJX;9`r3{u$I
z09w^o$^#l2Z+^hMi6u?*P#XWXLuvfm&!<_Q0Ih8N1>&ctX|kxKO%K|{EG)@f0$S?P
zUCRI(CWcJxbbd%X_=076^Co7+deBfwI%6nTdRnuKiUjCPf)EuMhV-;<8I`o=-^_J6
zX$OBZrFX`th=GCt<WD50`GRNA52ts#sEDN<e87~>=nA@yg1;5i9RZv07&NuWqLQZi
z2b2>JKHyAGV{~Nz%^V(h!35r8l%B@u0t&fikiBWGw@b?KgvH&H|3M?%EGnR)1T^(2
zqw?A<Jq_%;Uug$lvGg5EPwVzkVF8^H0V>Bpb@stWoZ!<5SinoJLF-LBFZSH(yYYER
z-z|{;Z>KZHa=qRRYWX6KAg3Mv^(QSLEif&JO%BvCOAATk-~J@+#gdu-|EI;svxC-_
zrbV1bDuOP2v^d1ya*qL0W2SW;1~nBAyZ}Wvc&j{k=71gCc4SC<v5g1R{Huqw5m$jZ
zphMr%Ud#irJAc@)ml&o&w^en6gmxH%g78H>h~4=ER2A!`ceMxH1=arB4y3(E1511W
z9lr+C7Yq{GVFK3Y4q`*LzUZZQwL$eo9Y}kj$HTzT@R*}S0;WwCq;!WNSeqc2oeN?^
zS}{yK;H6fbhto0^AdOR%P5>3kka4Q$m$egKicfpOELGq5<_c(mSLd;`&g<YcOT95F
zA!*Hz4}h}@OB(p%Vo+WHO~)Abf?^kGjVb)>s&vrOH?{O`A2trqDvUJdH7YL{K?`j_
zml}YyxBlm!dI;Qy=Sl0l1s>u5eltC-zS9S^4#(O>g@eEO9H?yU23<{@W_hYeJ}m=u
zBXL@W1lSkG;B}X?`@zHQJTE^mg7SIeL(rYmY5N%h7#Pwt&x4Z|N1EorG|Tg~pfu&9
zB9Nx|v*&sm|MvfoMa;c5R-o-fR_STSomdz_m+OFbYaM(pkOsNUIIZ(9blvm8=NxIA
zf73eOr!}5$-~s!kiX$C-#0lfUG|Lmk;%UvtLDLuRf6`dN4Ifp|9nG(wq%|LMNb5ZD
zQUkOK(`^H|xZ(iW2fj`ix_TSBeZL-@S-V9*%f)lVKu16w0L=xZG2Q?TR=9#z#fFGM
z*MNhE$ieHv(_R!!0L28T6iRD63<@#GU`TpecLhh<_v4`Da-gej!J<5AFDyAh!>b2C
zBX{7n<51gORO&%xCU~KEcMRJeP`k5)?F5L*Wk}n_0SfpXpo@~zUR>z=|357}Jq>hG
za#|>8EiafYla`SJju=*ueDe_*u#FsPFGAWu4n#>RpwrsZUhD+L;ES!C3=FRg(q7cZ
zEc*ZdrSpH-wp$fY^KuT@#4Wv$1Pe2fxg8YsC;q<{0T+cV4(Xt6MlAfTte|CxX^ls~
z2^pLRKubu@N}itZGU+V`!yg955>OWcJ|y48cj;rx$x?C949#?r=gjK$RfiZDUYfjt
z9250I0W`7&>MC=U)RwE+FqQb0^Q9S{1a*g-7}5++zAm+4E%61lIk$kiT`~qQ*D%-!
zl@yf=+6a^cr|kr-2D1??34b}2!6u)-rJ2EI5`SwaNU3bY%SMK@7w!v@x-|>M8EjvJ
zTeqMt<H{D0CqFQP#^_#$gG#*Um&;c}%!JHbzXsP#pwar58Ryep{8=zPe-E=+{e-j(
zr{@d|FYR9=Rh{5vRG@r)A?*cY8>p6o%=fW?hh@5gMbbM$RG3>XRYatD=yi!PB&Bs;
z(@X2t1Dz`Ow^R&%;$4^6ThNhrztS!~e=VNop4Ry{?ciIMzN4VM0cz=8;%WT#+kT~Y
zRtuybcV=SvkhXshXpvoKHOp%=&;TOy{c^FieV{n#JEqnpR>}a{EY<vi={0C-P!}`_
z2O8o9pN$4u;`H)jdzvST-7S|&jMTcs-hE8#yq*r)GM8p}J+1Rs!>@+4&QA@O7}7fH
zuYoOMsNin+#Z<<YwhuHTpMK0)2Go6%Jothst@*(LkXDwo=12D6wNK6x=^fsppl$gO
z7rclBB{0yEF=r996;~N&&oMB(jC=`7_Gw{horl2#LoA?!LCbwX!zJrP7(l(3{|qe$
zN{d0Q66UlQrt_!od&z8MA;DzB&foHtv7FO}mA`cc<4b!+o8A1a988d78qy9vVo77X
z1?uJPaOdC$Eiwizc;7W?y2dMJ{rZiJX)msV#u2)M!F4KITJtH!*VY@rM=YjyIE!v*
z0(JaAU6u_kAXdl0^bTi9*jZW+Kq*NCG&sPJ-r+5i*8J#SdS|f8%QVKc7j>X!dh3A_
zwzL;}g&7z?MuMh)pA~|POz(1*cviS!`rcQ}oVpOx(z}91(wafX^gKuaZP#o*#q@G2
zI9W5Kz0iXg#^1^^{p%}cMGbH>@_^cc9Uno?0VU^`Cm7ORya9F9TMv|QroGS>W?*=^
zd%E3gW>tHz>O*Rac6@|b1sa9yI0RyMTzH)hqMsCk_BkJSmSJF6p-`HZ_M#bT5?k7f
zL(`YMW;W)Qg{TARoBrfAv%1TZ6wsLiiX{SR8O7j^iAe{jNO>)X(J^5v;evEbxItG(
z27_|b98hyt<oR^LC(Me9%b9FcOGUv;F(8|>kGZIDgAQ|gEe|@y=4ICO;3v#(j55>b
zKVg=vXG(JepF!KrP;U)Bfp#Hdy%_lX*_VuI;A2(OUi3Bm|Nrs>Blz^$^$ZQ5vuDqM
zhI{rgr@bfw$)z)bkDi^uSZ~qrtAM|C9jIk#od!O5HtmIf1E>fA4S=P+a0anKXGwrZ
zMLK_oroFh?`2YV)HO7Wtr6pz!zbZ=nUlvRce9ElM^t*m~*;8gkmDjER|G%_iOamRH
z8^J#XR4nkQq^EUrr>Av-T4$hDaMSlZWww;?OnXsL|NsAMPz#$!1>D8Fk@kYOaXRla
zW?MDSv=_?AvbVscHA~uytsqBr{(haC)_j;{de$>$6{b6N(<eM*R;}M!2RnKMbarCe
zi=}m-s-oLO<u!9!=V{PhcF;O47L}J?pcSD!&|w77%z7|*S!fcdB-6YBYH!a6@3050
z4w;aaA$FdD;brGzSnCdHhq)Xdc=xy(=p0b>dWM!ul~$lF7@a@Unjf-*HcO{>IBKLh
zrZqoe?>n4kd9fC>VZ@zLZIK$oYXR^8j~Xan#-+u-R5%57&tcH!J19=e@HxW3@NzcP
z?vBIIp4b7kZnG;Np(7{<KnK<3Fr-ia|DIX5KCl)%N?Z!s5kBMp|JPSx#-4}NLZIf>
zvwv_k(?DuofjkP5-z}id!0;qx1yhLzY&-3P*8l(0yh~rD?TP`{+NPie;foq@b#mfA
zsM0t9(hXWx4RZ8Ej=<@EJ}`4L+Dzy8$Q)4ry8(Qpof&BJ;Wz%4HQ+^2ZJ^ae;N}Zx
z=~)Q4hXG!alH3ETOOAqKptY0{W%rU=+QKEE9vX{^TH3-DphN@OHP%@JTB6elUifl5
zZ9k}nOi$zA=3>L!a-bw6&9MGbx|NHFL@9szF&7aDhV%{>8NM{<*T&$Z$=FICffW0w
zh{1NzbWQ=)lK<ICc+wkcZ1@;TSkl~IuLn<P{ZDgGYyQt(x-h*9)aUtrAw5kQeE8J?
znC6$0LF;K)RMNg*NLK=>;oo+k9@IpAaRDsjq9O(=!FfP-*62v2fku5xR6snC3qVWg
zL2DV=K~4a#GnU~4TP%>~oaUO={FkltSX%RM)-v$XZoDlAO4XoRL6nOOFW9D&lmGvJ
zEs=iAMTU<dt@U<k{pHu(Hvdc5L6dVXD!eEm3eHhHYH5o>;o9w@BA}MGc*Vz;`Tsx@
z=-XHrKK_5{`wvuWgEn@)<!@<Z07>kH#9eQQiWsP0`C@YyBrQdNoKd184q8zpk@o#I
zB$(<!hlMqt;7IHIbl?|rTJs};G|mehw+{SbN^5?k09pdTzwbcWi$|a}iQq2EfwUJ_
zK^)L|B;bRbUrzzqx)$u5ivRFqSG(n|d;|?o`GJ<LX0xVszIyZT0Dp@;sQQ`q|3Bz3
zxz1N_R@5`{xAZZ9Rxg5E2s=N5RtY>y<KK2lExn@=a+a=IhuF@KY3{Gjt99}1`3PF0
z_wNMgWS)kf(j}mQrn?LbX*)e0fEw!j+hjls_(1*F7nXNH=TPgVcRNA2ulZZnGk~}(
zY5dz>Sia_OS-_B1-+YK8&GKUDY1r)Ml?w1tunTsAW-$6+f;QVNxC5G{zpa<v<-`JV
zCEw1E7AK0GLG=bCkAT-CS-PmO@b}FJt^Vf`Nb5Y?cP!08ExoG)<cIVQ9~ExU$~^vk
zFG0}&;#r<8IhE#Ip9XS3^KY@zh2ZqY-=hEjwH#=*pfrE0%Kz7|KodC0pi#F2X)g-O
zAxrC^=MaG=a6!rVMQY7|@EJ{3po4q@{)4)m+b^ZP2=4j+e}lp^g|y})Hqb&QHtn!p
zdN<46WgstsMkecD$dvyF9iqo_cL`W*+krHPmp}g@wIx-+3%`0nYgWO>Kcv0*2eJ>e
z2#X`l0d(?%E9k5O#6G%h)t~_hPzT9H1-xu_24sz8cLQkm8E6GCcrFV(;xRpADYH;L
zEY+a)DmO8!rFV!h_km71aghKWs_LS`v+2JY<kVHL*<BON7(V_7sptmvWjaD6KqrAg
zrOeT!So@AaTGDFiogot7mN#g0g@1j0hzbYXjI_=W36V_#YUv#z5^SKx*?t93iQ4!c
zbY2-qRj&wW9~KX2{{o8@sP6bFQ2IQ*xt5Ee#3VhfJCp&W2<#k?Q3jxaXNWbRC5vfr
z36o8XU_03Rj)5k$LC#O>jFA8h3xnOC*4<$M+S>wJkv)CFGG+@#q3I`=F-zCK1=XUR
z$HBI^fX)`{VzBvNY5>mcpi7@Y129r)yAFUFK079Z-2S2iROf(?>Upi3_9AxT|NpNK
z*yxtXwHzps0wv?LfVAMWjQQa84;yPhMeGrt*XKanv6_#-;}v=cY<)1ao;nAzND17L
z0MAu3r|q}`KGa}6$bqc~N+dyR>|dLL#ur{hgBG{89w>d2*7*Z;j_F58On~}1FQR7r
z|DR?HI%9!<Dx_NfegnRJ>~LB}bPWT;OP$*<<BHQV@@ncC7+xyeetCO;!=Fz6mX|lv
zGT!fEV0g)U8!5>ufSQb`$Cw-iEs}*CV{#nqTmjgo&<|-Z?p1;sBA_+>kOb`pO3;WE
z;L|EVMI3mAa9XDZsG;I0kPh0--T5Lttv65rG(!uzIu<%v>nH+B<6P4je=<wg3#K(c
zkWV}KoHdOTyf;M<wE4Qr#YO<M44dg4xYFV&eY?R4qPe+7g@qv<bkQtl8u(;I5tTP-
ztta_gCo+IEaDlIyea-;7X!aOrQQCGtuGW+MEj<jNUJxe(Xt{BE8vlA96_$<@pmp2z
zprJPC873_6ARN%f=3t9=>1o|;>1n;e9%=7ElnY1_%yLKr-%Xp|P{+Xp+J+9jpBCc4
zZjgh(J>A!AY0W<wOXXJxl-Pm{a7Z&e05ViW<;?~`nBrKKH!E05BtULwg4|ULl4&_v
zs*`5;|Ft?~eIK~#$pc$nePJRfGC;RLzhwBIwjZ>58<e(D1^~gu+TjV?^L{b2vT)71
zoR%@+B?H6DAJc39G3zr~UzzSdnOT%cdg}DF$;=w!8*<KiorX1lK#d^K4i=@n>DS7b
z<sftApm~aOA6qV!u%~&cb%>q&2%pmhPi}&?_w#Q%@N)h0vofd8r)AuJ%)szc@(N^x
zF}<Ne*1Oah()tAD_6pFN(X^eypscs=%|`}?p4;G~3~#45RLC%ta`hd8EDe48F>Mz^
z{1zry3sbHzy~{%cJZJJ2<Q6S(&)4E&sW524iAEyGBC#^&m;NO$=WK5HdB2=9&G1yi
kuZD)3pe14#U!L1`R{Hd-=m!iR49xV6jP)%o8U8Q;0707zCjbBd

delta 132181
zcmZo@5CEYijPmvI%nS_MnHd=NGcz!}XJ%md&dk6dz{0?=nuUR34l4u0QdS0r8>|cr
z4_O%)blDgf?ARC>JlPl+y4e^Qmas7}TxVxsc+bwjpw7X-5X!;8kjTNnFr9;eVF?EV
z!*&h^hC>_-3@11k7|w7oFx=y0V0gyKz@R3`z~CUrzz{6RP|uJi$iPr3$iUDc$iOgL
zkbz;9AOl0LC<B9x6az!DJOjgCMFs{bRR#t(RR)GcRR)G*stgRDRT&se)fgBqs4*~b
zs53Bxt1~dLYcMeIYA`U!YA`S;YcMd((O_VZ)@EQZ)n;ID(Pm)ypv}Obr^CQdro+H6
zS%-mPxef!v4xM@ih9f!*3|Dm+7(#U!7|L`R7-s1*Fg(;{V6fI>U`WwpV93^EVA!L_
z!0=U%fx%9nfx%gyfx%m!fuT>Ifx+E?fuYiXf#IhC0|S>K14FhU14E4=1H&mp1_oIp
z1_o7Q28Ik{28Nr)3=CB!3=Atw7#PY;85ka#GB7lnF)*;yn=>#(nKLl#w_sp6Yr()^
zWy!#B-;#kr*ouKc(Tah=$BKdBz7+$5w>1O9WNQY7#nucAkv0qr%WW7Ke%LWE_}Mcs
zMA$PhOt)uXm}}3#aNM4O;if$U!##Tj24)8a24@EbhDDAH3=U2V40SFH3_NZO4By-s
z7?eC27zDf+80sBBgf|1jOm7B;`Q8i+tGyW*HhMEK9P(yhIPJ~AaK)Q};jT9WgQE`v
zgPRWngP#urL$D76Lz52!!&V;#hF3le4BG=47%l`dFkA~{V9*U>VAv4Ez#tUNz#tLK
zz>poxz)%>>z|a!Rz;Hj9f#GQ|1A|ux14BRv14C&DLp?)v2m`~_5C#VMFa`$IFa`#<
zFa`#nFb0P8VGIl(!x$Ji!x<R-!WkH9!x<P-BN!O|MKUmyMKLglM>8;(#WOHGPGDeI
zk;K3dmdwC#BbkB0IE8`1E`@=iCWV3Fc?ttVW-0@NSsDWaM+O5!c?JW6Y9<4NdnN<J
z{!9jjtJ(Do4EZ?>3{^P{3=KI93@tef49jvD7}n%4Fx<;wVECTH!0<nZfx#)4fnjqV
z1A|^Z1A|XK1H-oh1_t#a1_r$%28Pu|3=F!(3=Ag43=Fx&3=G$c85r_Q7#J3oFfi;d
zV_<ky#=wwU&cM)H&cL8h!@v+)!@v+<!@w}5hJm4=zMg@hte%0Pr=EdfQauBMS_1=v
zM*{;xX9EMnlm-TdISmX98=4pxb~Q0D9BE=;IM>9$@VkkDfuos$L7<s|L86&~A)uLo
zp{ALEp|P2Pp|6>NVR|zI!-i%Ch9k`k43aGj46ZE<3|=h^4B;&d3<)g^43#Ym3=>-z
z7+g9T80y1285p{{7#N)T7#Qj&FfhEB%)pR6je((V8Uw?uX$%ZZ(-|24OlM$-n!&)Z
zdL{$I^EnI*2j(&`q|9SrsG7&X&^?cVL2W(*gVO>A2KNOF4AU1dFt9IVV2E1Cz)-l5
zf#Kdl1_rf73=Ecw7#MmMF);jI#K6G4n1P{rF$2To#SHZf#}+d%%wNL5a9{}ogW)m;
zhLU9r3=PW|7*;N0U^u^=f#L3Q28I{Q85q7TXJ8Om!N8!ul7V5<N(P3UH4F?<YZ(}R
zZDL?x*v!DdwwZw;a|;8*+ARzW+qN(;+}pyy@MH@EL(o<RhPhiA7?y2iU|`tBz`(to
zfuR9}cQ7!l+fmQJV6l^d!EGl4!<3y23|DtDFnH}^U^ugjf#J$-28P?a85k7yFfe%T
zVPFW@!@$tBhk@bqUIqq>eGClt`xqEv_AxMI?_*%-*vG(dZ65=J_I?J2zWodgfA%vl
za35e`5In%Zpm~6SLH_^)!{GxA3<nP~FbExDU|4X7f#K_628I>&M;I8+9A#j5e3XG<
z#&HG){u2xgaVHoUdQLDfJOr^%F)%zl&A{;CECa*xa|{ee&oMCkJjcLbe1U<%<^ltQ
z&jkjCUl$k{_%AXr)Ldj>IDLtM;pZg=hV07>44s!57`9wyU=X;%z>s%^f#Kv81_sHi
z3=DEt85qj1GB7;3%D_<n{VD^4&ou^y3D+1HR$XIYICPDHLHIfYL(6prhB?<67#?3|
zU@*SHz~FO(f#K>628NKE3=EMs85ow_WMH^@lYv4176Ze+TMP^uw;33A-ezF<c$<Mi
z>kb2h`yB>`raKG_)9x@ZthvL$@c9k{1J7LshTyvl45@b+7;5h_F!bMLsApJymw{pD
zT?PjJdkhSU_ZS!~?=diV-(z4XyT`!LagTvv={*Jp_6H0M5>FTybe}OW?0e3@;PjG#
z!T1dW!^t-c43FP3FfhMoU~qfS!0_Td14HZw1_r5*3=E&YFff>YV_@j~&cML+lYv3^
zHv@zFUj~Lxe;F7U|1&Un{AXa`VyI_ikYr?JsA6Pfuwr6l;AduJxW&xKFoA`U;Q<RH
z!$%fIh8^sT46i_#laV2gi;<y>n~}knhmj$bhmoO<hmpaUmytn9kdc8yn33V2A|nHj
z5+j3{5+j3)5+g%_5+g&DDkH-lRYrzpEk=fgT8s==v=|wFYB4h0&|ze_U$4W+Ag#;D
zU}DI~kY~uq&}+!ZaNCfPLEDItA<T%8A=QYH;gb;~!$}iHh6^T)3~Nmp8IG7TGFY22
zGWeP?GNhR?G6YyKG89=bGBjH-GEA{xWSD8e$gtRgkzu6;Bg1D4Mg|T`Mg~qRMg}!2
zMg~hOMuv}8j0|knj0{EAj12YV){G2w){G3z){G2RHjE70Z5SDT*f28uv0-Fjuw`Um
zv1Mf7uw`W6v1Mcsuw`Trv1MeCuw`VBv1MdXuw`UWv1Me?uw`V>v1Md1uw`U0v1Mei
zuw`Vhv1Md%uw`U$v1MfNuw`WMv1Mckuw`Tjv1Me4uw`V3v1MdPuw|V7*^5!MzQUG~
zp~jYxp~04sp~aSwp~IGup~seyVS+6q!xURah8ebu40CK585Y<wGAyxWWLRO#$gswi
zkzs=^Bf}P3Mur`>j0}5h85s`PGBO;oWn?&E%gAuXmXYCtEhEDfTSkT(wu}sSY#A9I
z*fKIav1Md<Vav$y#+H%cgDoS&7hA@9h99<!41a7H85rys8CdKX84BDP8Cu*K88)~x
zG8}PdWcc9D$iU*k$ROdt$e`oF$l&0?$PnVe$dKW|$WY_K$S}c!kzt7kBf}04MusyU
zj0_Jv7#RY*7#UK$7#V(eGcqXnFfyq4Ff!=)FfthUFfy3<Ffv&9Ff!QqFfttRsb^$3
z;ls#q#)pyNf)69Z6(2?h7GFjN4qrwF0bfQ25no0I313DA1z$!66<<aM4PQnE17Ajl
zAO;48Nem1Os~8v<PBAbr++tv0U}9uokYZ$DP-0<Vn9st%u$zT};UNnH!w(h)h6)Y_
zhE@&+hDjU@3~k&D3^_au47EHA3{&cP7#OzkFfbhFVPLq;!@%%{hk=2Cmw~~Jmw_RY
zmw_RVmw{m}F9X8{UIvDvybKKYco`VJ^D;1W^D!{I<zrwd5@BH2D#E~URfK`zj|c;U
zk|+a%nJ5E;s2Br-x)=jPuoweFkr)HR1u+H&Z*c~O1aSt2AbAFc<MIp)tO^Va^>Y*$
z7}hH=Fq}|eV0fUwz@Vqdz%WaZfnkdx1H)NG1_o~>28L=S28M1W28Ja{3=AyF3=AU5
z3=E3O3=9Fv3=B2O3=FNx3=DlBz6t|FmI?zytqKFf6cq-BMJfyor&SmjKB+J;FsU*y
zaHujcsHie9*s3xxWUDeTY*l5bXSk@!!0=a<fx%IYfuUKAfnl9G1H&bC28Oj73=DqS
z3=Gja3=Cg%7#N~-85kOL85sI>85q{;GBCW>Wnl2qV_;y>XJ8Q0XJDA2&%m%!pMfFJ
zfPtaefPrD60RzJo0|o{WLk0#nLk5O6Lk0#zBL)V0BL)T^BL;>@BL;@EM)eE~&x{xt
zM2#63^o<!9LW~(0ii{Z;9vd?-d^2WX5HMk2&@f?OXfk17m}0`faNmT1A;Oe_ArI7u
zG-Y6zXv)Cw+LVFepD6<aw;2ONv>5|Kg&6}ww;2Nik2wQ_i#Y>Bi#Y>>v;_l$rUe5-
zkOc!nu>}J|qXh%QR0{@%BlQ*x4A(6f7#><MFfdv&FbG*PFlbsbFc?@eFt}JUFnC)s
zFvM9hFyvY?Fw|QzFdVgHV7O+<!0^(Nf#I_y1B12|1A~(l14Eb<14EV-14FSD1H%?8
z28L5s3=G$-7#Ln!F))N$GcXidGca^nGce4xW?)!r&A@Qfnt?&shJm4eiVXw9JsSpw
z8MX`zJ8c;l?$|OgNZBzk=-DwaSlcl$l-e;ctg~ZaV6tamkg;cA(6wh^@U&-Om}t+y
z@XMZoLE3?VLDPYO!PkL-VS)n#!zTv@20=##24zPE26IOSh6G0jhCD|Gh6YClhBb~1
z47VH^7(O~OF#LC9U@&lEsAuqUVqge&VqnO1VqmCoVqoZTVqlo<#K5rIiGks~69dD2
zCkBRhP7Dkz&I}CJ&I}AG&I}B#&I}Aoof#MoI5RL@ab{q6@65n3#f5?4qYDGWe-{P@
zSyu)IZC3_{KvxEad{+jBNv;eG8(bL}4!ANfTySMzFmz*Jh;?INXmzV+V3_R2z;MKk
zf#JRz0|UQ114EEI14EfR14D~D1H(dh28KKC3=G*G3=C^L7#Q|@FfcfIGBEgfGB8wl
zGBC7yGB8~CWMByKVqi${Vqn<j#lUdPi-F;h7X!mDF9wEmZw7|f-V6-pJ`4;qeHa*y
z`7kit_F-Un>cha0=gYv*TJOui@XwclfzywHLBWrK!P1X`!P}34A;OP=A=8h6p~Ihn
zfhT~0K`elQ!6SfyAuND_AuWJ`p*nzpp*w(qVP*gW!;t_62Ax0#2Dd;4hTuR3hO|Hi
z2FoA@hQmP&44;A+7~+B%7^;IA7~TgnFhqqhFkA>@V7MQ~z`zjBz)+tP&cLuZoPl9u
zI0M7=a0Z6_2nL4s2nL2J5ey6qBN!OgMKCaML@_WVM=>x=h+<$+jAmdkiDqCZk7i()
z5Y51_HJX9pax??O=V%57mKX*G*%$@}=NJZtnivL#J`g{afx$DDfgvuIfuS;%fuS#!
zfniN71H-{s28L^~4D}43V;L9(;}{q$;usiw;}{q+;usie;}{rb$1yN$h+|+l8pptJ
zEslZVPaFe-Lp%dRa6ALUrFaGgn*;`if&>PJc?k>*XA&3~-X<_G{7qnB@K0o5kWXS@
za7<!gC`@8tn4iSJuqlaw;c*fJgEXj<lFY!6kj%i4pUl88CApq~;ZrgL16K+IgG>qo
zLr4k(Luv{G!@Lv*hRZ1o3_nsB7}!%87!*<&7>ZLF81|<!Fq}?hV7Q*j!0<hlfx#h-
zfuTH&fni-51H-j61_rit28PAy3=9X-85l06Gced@Ffh!{U|`so!N9<j$-p3!$-tnW
z$-rQi$-t1B2`c|H85q`NGB9k*WMDX%$-r<qlY!x7CIf?S76Ze?YzBt4*$fOPvKbg2
zWiv25&t_n7%3)v#$zfo4pTodloy)+Gn#;f-pU1$UpU1%9mB+xaERTWVcs>JzP5}dh
za{&WGPyqwOoB{@htpyAWR|*&y_zM{rwiYokbQCi%{48c*sOKnQV5lr%VBjicV2~|k
zV3=FV!0@+}f#GBs1H+>-28Qx-28QY73=Esg85qu%GcepOXJF8*U|`^`WMGh~WMDW`
z$-vNE&A>3Hnt`FChJoRK4Ff}1EdxV&Ed#^aS_X!*wG0gJYZ(|4>lhds>lhfi>KGW7
z)G;uutz%$#UB^(*z){b@FsGh@;b=Vr!^3(8hM)!phU5kY27@LBhQKBUhK0=x411ax
z7``<#Fl4nbFm$vqFnn!cV325KU~p_@V904@VDRf?U?}NiVA$2kz;LOPf#F3b1H-3I
z1_rJ!1_sG41_re*1_qlh28Q4+28OsU28NO@28PBi28JnJ^$ZM)x)>NXbuloU?P6fK
z)5XB>xr>28yqkeRtDAx0WDf(w>mCLMzFr0flU@b}&t3+GlwJmg>RtwhwY>}sx_t}`
zVSNk?DSZqK7y1|&e)KUg$n-NX81*wSB=s{eRQEG5%;{%fSl`dUaIBw!;ch<zL)HWa
zhRG8c7#2=oV6d#8$iNUgk%6IjA_K$1i3|+KCo(YHo5;ZMbs__U;v@zJw@C~PhbA#F
zES=22@N+T)1M3t92J@*54AD~=7*eM)FzlYn!0>7+1H+f83=B)AF)(bJ#=yWcoq^%#
z3<ic@GZ+}GXEHEE%w%Awp2@(lXeI;0)|m_pFK03^D9vJE2${veP`_~&1B3l+1_s7C
z3=H;j7#OC`VPN<;hk@b$90rD(xeN^R=Q1z|&tqWFoX5c6JCA{(bRGl4yZH<ZS_>E$
zY!)yuELp(7aC8v^!@Wfe3{s037)%y3F!(NJV3@m@fnm*J1_qxc3=Bz27#KR2Ffi;|
z!oa||lz~BSDFcJqQU(UMr4029!Alt!HZEmg@L0yc(6fwzVa75BhI`8x7*dxrFsxY4
zz_4>U1H+@`3=C2$7#OryFfbIaU|_hmf`P$#B?CjsN(P3hD;XHRu4G`~S;fE*w~B$`
z;3@_N|J4i(sjC?nx>qwWl&xW4n7xL9VdokKhBs>%7!=krFgUGcU`ScZz)-oio`GS;
zItB*k4Gav6wlOetZD(LuyPbhSW(Na<$qojFt{n^vJ9aQIJlVy-@N_o=1JfP`2CY2|
z3{iU+7^duDV3@R*fnnEP28LUE85orIF)*a<V_<l&kAdO$J_ZKS{R|8<_A@YW9%5jS
zImE!Q>JS6Nu0sqA)`uAwiVia{{6EaVzzgbxZaTuiaO?;J1M^V^2H&F$3~t957*-r(
zVBk8=z_92z1H;ba3=EPd7#K26Ffi;q!NBnK1Ovmr6ATQxCm9%`PBJiLoMK>TJH^28
z{WJpu*I5PzwsQ;&%;y;x)Xp<77@lWfusP4bkaU58LGmI4gZ4!RhPI0g49u4q7%VO`
zFw~b`W?-0nnSo*7Wd??dD+~;muP`t~TxDQ5dzFD9>>2|@$~6XtIoB8%WUn(YXkTYw
zaJtUG5PhA2A^$o9!`tf&48N~4FbLjYV3>V_fx-VK1B2x)28MuJ3=FBa7#J?zVqh@3
z&A{M%n}H$VHUmTKZ3c$C+YAg%w;34b-ezFfaGRl?VZj{+h8K4j7(DJWFeu$;V5q;(
z!0_}w1B25828Q4V3=H=kFfgz@WMEKv$iVR7Ap^s|hYSqtj~Ey(Jz`*Z@Q8t-;4uTk
zg2xODdml3}e0$8m!2N`QA>#=HL(>xmhHXz67%o0xVEFumfx+V`14H6d28L}<85mAJ
zWnj4fl!3wgSv><o`7;KF-e(L9E1xki9C^mTaQhhp!;@zW4C2oj7z~~>Fho3OVEF!=
zfx+<w14Gga28Nd}7#J8|GB8NKWMEK#$-rRwl7YeJB?CkDO9lp+R}2i5uNWBmUNbP*
zzF}av{Dy&n^DP5|{96VFqqhtU-ftNgqTezwynV~S@aHW9184m^1_p_D3=GHLF)%!M
z$H1Wdo`E6!Jp;q8_Y4e99~c<&J}@wx`oO@@^pSyK%0~u<BOe(UB0e!NZ2!c-aN-jK
z!=q0O47{Hi800=PFqnU4VDSIUz>xcyfuZ3u1H<gk3=9`OGcfdgVPLTT#=wyMoq>V-
z2Lpr84+aL2p9~C2KSA;TlYwE|PX>nnKN%Pv{9<76_|3qu_%{PX<{t)z&3_me0{=2F
zRQ_dP`16;6LE;|+!_j{X4EO#qFa-T)V95W^z#ziF$Y8+0$nb)Jks*SSkwJlpk->$D
zk>NTMBZDL}BZC$*Bf~ppMg|5JMg|@hMh0&dMuu4|j0~$;7#V)EFxE57WMyQyz{<$r
z$;QZVi;a=tIU6Ix2R23qU3Nx>WOhb|GImCW%j}E{PuUq6BsmxvbT}9pLOB>2GB_9+
z>Nyx0CUGz_?B-x(ILE=r;Ka$uP|wN8FpZOu;VCC0gD@8(!&ELthKpQ`3}3kz8O*sE
z89KQc876ZxGTh^4Wa!|jXJnYg!^p6ehmqkw4<o}r0Y(NLK}Lopf{YA51sNGQg%}xB
zgcuphg%}xxgc%tGMHm@^6d4&Z6&V?pC^9lwDKRosD={+6QetG-pv1@^tjx&ZqRhw;
zugu7>Q<;(BnldB9XJtkP0To6DbrnVia}`DgClyA92o*+#QWZvq3H2(B3~N;w8BVD%
zGCWsdWZ+a~WYAP)WN=VpWGGT&WLTlb$goL`kztP-BZGxHBf~*;Mur#aj0_?gj0_PP
zj11Wtj0|NOj0~L`j0`h07#RXJ85zno85ve+GBWJbWMsIh$;j|RlaWC|i;<y5i;>}g
z79)eGHX}o)HY39uZAOOrWjc%u2Xq)2&g(ETyw+i4NYG_uury#~_-w$)Fx`-mVU-~x
z!xckDhG&M144y`e3<*Yz40DVa8MYWPGH@C*GH4q!GME`NGPoKuGL#xKGE^BeGR!e%
zWY}TM$Z*`4k>RQ_BZGhmBZIsNBZIXGBSX0fBf|_6MuuG`j0{qyjP(pAri=_Bri={R
zO&J+pnKCjcnK3fxnK3d%nK3dnnlUo;n=vx1H)CYjVaCXC$&8Uf)|`<+&76_J!JLsH
z*qo6e*PM}|&YY29n>i!HPjf~FBMU|bAxlPvaw|rL4l70mYimXZ>uZb*Pd73#oH)V6
zkTwAU85p)NielWyQQs}l?ZDD0(0ZwaxzmZ|a5q<H081xF>&X)4PDhqbro-JHEY=<z
z#jG8I{~cHkhXwaWG4`5pbsp>r{@-$`gwwGj@V~R==h6?y7#X7D4hMH0e&OcN$k6M;
z{NM6MF-zx-*Fp^z3iaPTjyW(gynfU0OQD|Kp-Z6UQt6lI!=d3}^})fNr#nJanEAKA
z*u}=cz|i^PMQ{Kk!wP{?7Q@@GJzH*<3hgq1h*t(MGISg^{Qp{)f7@lJ*KZsDGcYnR
zl-%Io_PO&@=ZhDS0gMb*E-K6=!o6XPoiAQ^g4MgX+%CQPdUMB(sOY%(*u!DLorgQG
ztza)T<llZ^7az#V7m5MX^HUhbm`?joZ%<)V&pg=8(0ZVh@o;drghc>X30LRA&Ks?_
zOFzD5>XeK=9Nc-i^Heu?w<kv@N0+BShX+fS7gO^?{tge;E^o;W54J9Ei4G6;v~Dk!
zv`!C>t{~>-N6Z}oT+xTaA(nTZ?+y^?b>d_Wp3a}jD8v1;l&i~wx%nZp<;Uq}sf>;y
zaCN;70xxX-|Nqaw-F<pTDx-0I{NZi~j&2W$=0gJAE)!XrAN=lgnaBbPNU*m$&o>_k
zcyagN|Ns2kyu&+B@o#sIIQT%|;6onH6a3q}!@y+d!G|22Cpw*3jyrQOFfcfD^L2Z&
zw4N+c@6KdtsAXp=mFV{4a6I@>oPS#>+rei7oF5xcg4Dfc?oRUE(do_6<<H#kkhxU0
z;TIGC)I<E+E_pRRVqjqS(Rhf#fq{ebLZ>s!Yo3Om%%$v&-W-fF3=H6a=ifeI0Vp0X
z9DKpQgO7oMp;VytKnY*3$AA9Chl<!bPrUxHfuDcd^oBG>35ykf{{QbhXn3icW$Ke&
zJ_b;Hl(1QPaFl*M?9}{=we&eC9*@1a`Tzg_)&nI<orjxG{I~pEA~XF$8l!xD=fQ3P
z!vn3CO641W{^{joDB)=Q`J<PQp_H%rhe0vx4g&@ThUOOrhYyDZcNYmT7jbk)@o0Xw
zyiv^5d81pX^-}3eG=01%`atQtTl7IMA46{s(|>jbhQ@~sKmPxJ5$DUuV0ofQ+Mru@
zi!VRJ4u%Q543;N~nL1B29}wtt=IFfen#u4$G{{z7mN0&X-pK#iCq)_$Don3TXEdv4
z2;&E3AyDKW>%9Eprxznb=keCtrBdCpcY664T5p$#^aitZ{_Onl;++>GL+gPOmTu|S
zFFJ2T$HgB`Ypf7qU@o-`?mW!DonaRX0|Ubg79U22?-y1umxvl3crDAnoq3lXNLbs4
zkzoZ#$?NWDp4Qu?FLp38Ffc?PHk@vd!RS<fvh_fTEdM@<-r@_LpBjE~mUCsF<m&a2
zyx{QqWy5dA<{SSz`9bytcT02&cYASk2Y|{7*3KKz{~z``F@kc(#pWMOrRLqDC;Ipp
zdZQRSWkHPAOQlxbqAz^-8Jd3ym+OPYLA*|us|>#U44phzS$z2!Ue}8?|6nY=-Yt3r
zrWwR|eF$Xkq3#X`eg=kKN5;-35QBdkV{ar==PVHW-~$f+ZGnuO7r=!|aPu1uP%byT
z)XQ>}0hH)mR9L!MrXJ|xW9Vd2F+9*+qr$?!Z4di{E<T2C9u@xeJgp$PgFoxJ`M2p<
z^RGYK$+OR)`3FboHK*oZ9Hl#(k8pq!@q#Bl{0ugXCG0j#CE|t$4jUe5uyt(XV_+x|
zYqs6f$H&0%njI>_KlK3rwgaFNabZF)A4BsCmgXOSN<`8uBLqs>(kugnO1Qc`Sb81*
zynYTz6rGp51?pQbmDo4``d`Aqzr9$%@>;2GcK{2FFJ$?tRF;2xu!wO0hjIW<sbF`3
zK<l>>w$4+XH~wEUJn)*Y`GCml-OUv|45bH}PyCOL1C<sBAF(h87<4l=KVSqGKnFW7
zbVqXZdNJ~ED^~72W%;p)pMP7m3gdUnpT(>Sy#Y*`pZK>GD_VXm66D_&t;G1*@@6r6
z^8qH!51ofPFHBd-Voa|;)Xlr4kB_1CWC?$_qd;?|2tz4bw<k|0*WrabK;j2VIQh4G
zh;?#xJ4hT3HayuK!PCuf-~}`PwgauVOV}6>cHVgXy4QvAf3FME|K<nG{M#BNy7(BP
zk=3@|F5%?gb^xk2MDV|jL^&Vh1(51`i1OE5&5xM*w>3ev@^6>e$<V;Su*(4y<2PPx
zbZ2DP<pgF&zg*(Z$iTmyVeuPJeukHey%-r5Zs_A<uw`IiXej47&T7#MDv=l(UJHVR
z4wMVRg$@`VSZveF$8elgqL+_B(UX_qaQF1yY{vBZ!{7e@2L=6$lOV>;UbhF$KOU4`
zh>imn$AP^W63qvAI$2a+WdHyFzw=n<#m*Nm68``HZ+T4eVi89-i%O@CO6SpT78S5)
z=fTd)AhsPu@%0@H3<v%hUeY`vdF%VV=IadK?<*ctybjW3&{@IK`QinSHb~{c&dZ%I
zUT{sX&S8||0{Nozhcv5A@AUaOj8gTG8n5%<ffua&+YWTIv@&?}GhBWFN(slEbQl>p
z8IC&{fMzn&jysur{J_7R^^Ye%L#LBPuLnz~mqYUbj!q|^<4yq&)-y1q9e0XgVM;sh
z6wShN+$rHd|9}4DP6bOF7#I#?n#IHnGOHfhuwD<2PA{M40}7o^0Z3*EpqbVDfWP?%
zXE{sr0fWQM2h71i8Qgij^Hg_^icEKjibA)KiiGCHV+<nMH+h;5vv<m<9Q@7F5y8|Y
zqtg7CzxlL7M+9THd}jo6Z$v%EF$Z?0&imaiDiWF(S`XAYA7fu|%$<?@m^;(tWA4lu
z$J|-CI>K3xxwEx(yE1gTvv*!N_=Dv|<^TWxJ6z1!J1@M*gD^RokMkUJ|DWmfdUNZ^
zN+!dT*(Z5=S-2tL+fZT7P^upaDz}e!UhCE}ylr{6PP*IW9w$rl0hZ2RFI-%vKh9xH
zjqSW(c)L@If16;(<pZzT8h$gCC^Y<LF5&)ny3}en69WUoYkB@{fy@UViF69=W(M(D
z!NUC80+|jz;^7o<=HFJxc<>nuw?U^tmtgZFe$G#?S$BiV?@oc~D{~o@w6r`K8FqpS
z|6Ky$g#V(!ospsQSQbMTBScsPBFyAD{cA3xf)8lQ2qFQ})Oq8D8LE22OPx1f?Dl{e
z3RNWN&dAVwMBue>uY(3yx8bE1f8C}h<}tcx1$ZzrgolAecPT(Dv-MzPK)65!BB<dp
z{d^vyuINv9gnG~nQ0I*o&)laA<}(UQUvy_=_+O$T1Hupkp$c}mPq)u!6la?6K0P9z
z(NGE$_Kj~?m>C$lW$*a#Gqm0=<!C<f|0N&e^!fRWQq0GH^G)BA&nWE_%(C!-4?hFr
zjZPMoZsr#zo}j=nJYe~;gr9#~6;tQ$-Wn@rOB<D9zity1%TJ{fJ6lxx85tOQMOs1C
z$gviY>3Ic=()CWV0lhsc)r<@byFdZj>!QN_g2#iAA?kHP%k7eohAL);62G)=skYyS
zm$F~+q*>2p@Z@JGHQ?VimD!V@p;xCD6f}*0dl(rQ_}hj5|Nq~c!IIWFXH7FB14CNp
zlr^o43=9shxxtmszL%f={r~US`Rk?q|Ns9RkFYSaL7G(4w-hiovs~}wQJHR2$f%x{
zw3my4fuZ$MJs+sS`oaNJJ{;<HX7TFfG3)eEVd*^9aq;rM=4XuEJ}NAn=PXUu*E74m
zKHvP8zmD^`GtdA3|Np<%?e<y!hq+|E3*$-6bNt)(n74qU>*vA$ES=|?pYeC|s7yay
z$SBEpVfxcT#sJVnGDGL#&JYz1kOkdSR2&!?7@GH}xG*v>FqX=7Gw`oxWV~?j2e;v+
z?h+M^PL^p-&A%K<KfgT4#K2&9ptnRtr_)4*f1AnC22eAPXEV5FUeB|=*F><hM1_NY
zo5;~du*_us^*qx%eN=crLQPPidWe_+NURwu1`!hB-^O#a1tcWW&A(oxAH;11aZS4U
z*PHZrmZ(U8gxU~7{M&4fwu87lySsB#Soqib>}BY#QQ_#-5!bxlS);<yU85qv_`N$s
zML_dY=A{5`28M(6zqmDj^_JK&be5<HX#VYllu;av*E&HZRgDS<Sf@&Nj*3KgiHeBk
z*X|k>3C4fjH7Y#4BK(@?dwIk<eN;GL=5<~?_>;Rg#FioRk~|v&!@*zNnQvEeFfbha
z%guN-^Z#=Z28M(GxiznMf=uAh{HIy}QS&UwS=}Kj9E`uZZB#nNyK7VwdPU4Z>~Mwd
z8WojZ5q>bop}R&!rdLEC%t`1DQIXMn)j7R^fq|hrL`6mOR3~T=4T!Cv`KfdI0f@Lj
zcL~UOozowHn#?RJEDna3ntyQcxBC41|G(F#UPT8Kt=)p%ku2Sg9Nn2by*5&sw|ZqX
zG+$&M00+?zZp|CLI`W-5Dw_8@YgAZzWtci+R5&ybb%v<$bVmwkN6K_(3NUBNbO(ws
z2TF81ifB7Z^wx+nXug65@-OaQ9p=op;1K!Cop~D^BEPvAUuPbu2M5UyZp{~(KQs?%
zUhdXWVf=gWFL$S2ca91N<53VZkEJ_Dg@^Gfn9Tu-TE@FzHV=rc31JI#$EfgVUOxDn
zyE9G%6q=fcIzh>{(@mnAMMd++!5`e6ZZgdW6`GGJ^tPzzFfuS$p5SlIWC7<$5EtA$
z>;yHggjz3^c!vddN%j^ob{cd@bwx5Z{Ejc->=u9vFrf)}GB^B$sEA_hl<45<W;n*c
zume=uM#min)6@M*8I75`?WZ@FGCI~jbYNtNhypc=4})r-62&ZrENHo30BYhN1j|Fp
z%mh$H;@wbT#sF0YsxQFB){9vVj0}+xz0M*#L1KoNUaK`9)&Ls?;_ngyW&Im3N+5=T
zg@nOE*3mDI+c7c(cOEu8kk;+vWY+dFt&_*uq4|eM>HA~O8VsE`UVMJ_|9|HVkP}Zg
zSn!k^@NeVzuhJ_~H@&fpF-pF-fN=v;=cjjXY?w-QdV`tXG(WKKIAnOB;TKb>T<53h
zKg$>uKtluP`M2Nb6jABC@#2CNBLn9T{_Q8aLEQN0_?Jvppqc~J@4ep5U>X$cqR<`8
z()cMLBuIhtLa9shf8jEFus=I*yx{d<Wav25eByu0rBdC7YJSEt>F#0?%kM=Bou4{y
zym;phmo8y{&9e_wsCNc_c+CuMMaP30@tqesPjxbPdb1pJ=3qST%;n_o?2&fdnJ-x3
zxU+y$M1XUrv&eC02~a2<ca{MO9Cua#@j7q3nBdOHpyA9JJ$+s|qvdp!3Pv?;!`uH(
z@J~71D{~jr8Rg&3)_Lp2d<#Z~*0&{sy}>LXfuEox^|H%idT9k?XFaHn3+z1Dd99O0
zWk1N=-uVArE_VNIqRLfm9QfNoYcg!~N=$6@O9EOB@VEAZV(ND{i^?$uhL@cT3=B4L
zCCN7NCAl^+rDfeLD!l=Wogym77-HOCZ|!BV>wNTL%J2XGdu7;><n(%3<T@X{w&UNX
z<7d|!&uIAH@^77E>;DoS3`H-(fB*l_c-Z~*T_mZv*NZzJb$)nZ4VHV&e%w(7<nqoN
zQPX3q7+varGcYi896Iodx%mORLnn($!!J($mR$@C4CVX{zgS9S8-8(=_`W>H$iUF>
zi=V&sC?lxO=wwlO32O6z>=8K%s+J88d~;@GER}VzJX9yvdGO#*X8vs@+>D(En;)|C
zFFsfN9MtWe`4Y6!rq`Ki7pSH6LgUl_|3=+4DjJ>ao#8CK&MXjNp--T3ht6xAt_+=_
zEZyNO-Rzdv_*;EI`TZb&tIPC+YDS6rT_9h)lm|5oVCEhF2yWwF?{-nq=rrgIVBz29
z%wl+{`N03?OaB=^2>yC~gnxT5V{a96r;SSUgZkzdY|W?s+pzGr-(X;1;NN!Oze=l5
z9UlY8C7^u&q72=@US|$Sw?0Po<NyDR#{{o8AN${Y{eNdELuW0E;iZ=o7#J9Oow*>2
zEIv+`tYMU^m-zVqKaw}Oz}|fA*z3#+QTO8ml03xMyTDCP-Ck$DU7+!y7gv#$^g4?{
zME8IA{~w~Be_JrKWr&JEiCnjd3S)^13#bmatWn{q<7ln_#@~AO@BjbJC;o#Xq4|gi
zC{cr3_04ZMjxjJCV}iHYN|JlMS(s%(4YW=f75;6NOuZ$R%$+4FES4rJMQ&-`hG_?n
zaTwmte$A6+y%pS`;^g19mC2Kz;WdYI^KXvQr-t7;KXXVJ-nRT*#0F~QysqEbP$S9A
zP{P*vk%Q~?Tj$r$U_E(IerkNv!pHz=zu0s)gT@g+xneSi(O~hPzZDeEy#Y*}U=jXp
z0gRR*DmMHr_ROFJdAr29T&dyLA^sM9F#iaDE2st9dE>>Km;e8Fx~OoxbZ4vwsl3bI
z`kILWR485s$=rBx21GUc@G~&H?(DqrVlRk$4DNvDe@y&+ppFO3UWU$t9fz79@i#o=
z;cr!EWMDY>gN46U4%BwscIn_FHpW}s-5@vjRx)<(1~IxgJ9?OY@G~$t)HnZdD1FrY
z&hhoa&I_%VDwzxqFdo+oQQ>fG{wcuU%FoEakm;hr(jv&f(7T5DhX5#p8UF9w(+Ub0
z2U`Xf28Po2h9^6HR0MikRKRUP7Znx51BTx^OH@R<Yg9x!Yg%2pYg$}7Yg82Wb22b6
zXddsZQQ-jv9YdE-y$a9eN4-V=J4;k73@>$xsDQd~mL@9vJ=Z|x)2G&Nl}v`07(-N4
z7(-M<x=U097(aD}v@$sK+6Z;ls0cLw5Gb8>+|_}Bfr$YTKs72HO#FSm|Nj3+1ks^`
zKUjKA7&<RDKjddT2TC;_bsWw0C;q>j1}Z-u@s)lyJkSk}$zCtUPH=$nZxiYaX>oA?
z+47`0M}<Ss@W0{7?vNfA!?&F}Do`IY{^)d30hM@`hxq$;{QLjEdow7Id-E7OSA!T`
zY~3X)Jl#4f9V~kPSyWzM1+}`mO;ox>%)9GrR784xY#BPH7=i+?`3Gkm$A1=;m)}9g
z)Tju6a?JNG9~GX<&pT^WG&(@8@9<HP?!4aood4h>mc~a6{0t18Au2MRzYabU==M>O
z;XKvtqr$^^vC~Jzq}TsHIG`^->I_lQX+HJ8%ST1}@*|K3eN+s(eN^f#K<)CK;CT7j
z>7(M%%fsFsqGHngle6Bg+egJg^I&&~3d`kRofjKwRHPY7__{+>bSy8{vUP{37%*P!
z4Pj^OytWI}uh9H-@S#9=iHZ#8N6u3Xry9C_R5ZFvR9HAac24O9C71s`DlE-4DlGp?
zXT6jJ^*wI9cv1iC|Nm}qn(Pf{Z2rN--!~gHvI~v|kJnEP4>TSDX$2Pw9S8Zh9cuW=
zRKn4EphS>=?}5Y3KUiv6!OfrM7c7TC<Mj(ct(%L6j0`OYD)|n)U}=89&cChUPdgt2
zXax9hcv$B(%R@zMoyR{fdClAWlCi#sqf3OZLxkh?=eYR8!QHapaaZsEosa?80LJV~
zBAN%YPm1);QUHy}Ht~e<Gj!gHe!2Po|NoHD`kfXG3=D>sUgX;|G8}U-XFTS>$<%3Z
z%t4*0@fc|Sp|e2l#kDX0|AUK7&|vJ#rZ4~hw_YkSXgyG(t^=AaxM+Ckg`qto!(xv%
zK88+Nmo`3z#Q|-642B05hk)2VZPRNT8J(Gy-k*M`k<lbp*_@G~(?vz#xQhy?CBo8q
z;e`N1NTSn3C5xfgMTI4xH$;Wc@W6}X7K{v0k*x<xg)B`}N_o4T*_w~YM900nZ^p>b
zeBwWtb2zy9jX>w&EdE{}71rs&O^l{u9CnNhSt`9gDlEG=7@=*=7e>?PG%@Nhu9|+b
ziBZ#((~gm$^KeAeYv$(D|2uCqACZ8}U>tk#M3<4Fw}KIKT>6gg^zIf$H`|?{ilg(<
z{|Oxo3=FLYD$aGYsDRR0WE^M;CJ;1-;ULl*5+GoBAnkpph{_J|Gz^bFBSW`{%5<Jq
zMk%YP!;Q9Q68RZGxP<-1`4C2i*Ka`$v1V(A680DSLHsYrLDQ=YkTGA-fN$s77t2DX
zC$uug`8^3^WOyyTOMsPuA?<zVi5H>aj11kAL7A}g!;6Jsj11k)AP%&NcevU1NFqN2
zLy1)91Ka=q`5DR?;X>>$eg#kGX=9XDp7!bg|KrXwpxQtBaPW&5Ur+#b-gvRf7c?AS
z%Kl<c@N};>#seXW4xoXB-2w0U8Thx~-l+yoLA@?2OfSw@F*2kbcTrJuU^?caBG1@)
z>xF0-Bf~e4NU18a%0)1h3{0K3UVI3h9@oyOUSAFJcP}_%HKOAVgU1$I4^%K8{K0WJ
zDDAj|3IkIoi^_{u2S$cn2^T=tUjmIPP6%aWh<uqJ1afDI#EZmx;CU1NT{W$I3_H{q
z85myrgfTK44hs(KJk}|q^5XAb(4-Svw}{G%5^Y9?6^x}kyJ}ka7?gL+1a&7QI}bNM
z{?qIH-}c{s28J?Wu-uM$pv=h{HeIoUQKY`<!~g%s-N0eh37UF4+<CCqf#pTYt^fZ!
zPrS(d|NlQCeoMJCbpP@(yl4w$WQYL8G5<Cu8~!qZT_PQP3_E^+<|kgtgfTL7@-+Wr
zf+oW59iZsz{P98_?3Yr(T?!z-YzDdELnvcC!)u|=!<|1n4|RU{KMj%$>zNF1gEDA5
zc=8C`p#R8k&@HRs&Ck&MTfR(i7e^Bx!wzMTeQ__>gfcQ@pXTY@=-|!I(Anq$A}4xy
z^D{Vif^|U0d7IzJ^tz}B1oXP7@C5YwsPOcLsBr86Rs0Mu__RUYv~Cv_f$tYqDhMzz
z@VA~}WMJ6&57gu{;@|dzf7b&J{$|h&OzVICmJOix?IpvLJN`2<FuaKT|Np<?fle0{
zkxmyCiEdHQc(vgHht7is9|~BWDq=n6!XnHDnxc5q4XQeQR3vr;fb=PX^u4X`%ux~P
z1dTiJf;9GqsEF)faNuCDJXpkhjERkv!GVFn$(F%^i=h;uKLVux(ZB!y4MDDm1o5tb
zc()<dJ!sIR8*E(Xt%HyF4G%c<ZekGNVX*uNaSdzZAqD{k29TSc*7r7NFoA~_L_j09
zFM9v|{||1XZSBob;R)?6QQ--LhZblQ{>5WWMuy1f-Js#YMjI7&28M<*=}?3k4hDvX
z7yC6C8ThxwsBlC?8Gh^4G3#w*0F5JEGCcW02Q(nj$_V4u%l`ZS-_7!S{jF|M(6D$n
zFK7^d2T1t~CQ#*T3Kq2miTZck+yNT=>O6G$!MB47B`lqX3=e$2@cmNf#m+;DpA>&K
zoa5L5GWo@czyJU5V&h?8fJM@FP}>$%-p0p58?^$U?y8SUJ*X878u-xw4IOpnsPJ^x
zsOUiIpXT57bz-|_fRZaHtu-GJ0M&ml9fBDdvOkD)-h@<0>%bLKn+d2wdi7%7xBvg0
zJHgc#v@Gpx11ad7rV_@_(Cwna(H)|~)7hp0Qa(*5te&5tbDu#NKWLm5WIEJ!Dxh{L
zc;v-J#iBbz#RinNK+TKp92Ey<7Zna+kSQ!GogpeL3qf^dr;Cb$;q7i06$Q(~{JkNJ
z3=G+aMY=bDtnS_cvbytA=TGJdAZvv?bU>Des0eiWsMLd^ox{>c1=MB{k@ivHDQ0$l
zy`$Slg~Re(=TEReRc{B_97h3=EtW4zWuacv{2=)Y<}lDGU}udA&ubr;C&99g9G!tY
z&Y-Mi$)eKjqQWBWq9RhP@gFqq=At6fT_2(%p$!raQQ-&*0EJDrkBUI&jTce>{{L@2
z!jt`3#2Or${Jo8!ep4UVCEy_K1_vp~*cufU$?HWa%#IwwfjpoJxf7JrTvP-=k|4uf
zR78q6J8!&D{QCd@>-A9AgCnM%0Uk2~p!})Lq9Prl!qN$Lw{@mKDL<o&ii9AjVRz%j
z<1hdJH~;-#qScwB;sBbh0FBOdx~N!mhN#$pMx#J2K2Qy;0*cC)Gr)-s%m&RR$Efgt
z{016eY&}`Z(t5i@xU-~QMWi!Eg$LAdkB)oE{O><#HV`yLaX4TnXlh`W4g&+jLeQl6
z3(l|q|AQJ3y1_^?e|q^CUcCSE|9@2Lfl}dJEuh2-+WPTgegGqb;icCWoriXEgPQQi
zJMVp7+RY7LGScnM(&@p{S<l#8AkytE(&-@rUQ1HQ((NtL=^@c+*m(goe;gLv{6?qs
zQi<+y7ZnXq=Ibp{5ee&Ncv17^|NqXz5v{jNggPI*@CHxtmvVM~cu{)&|9?>V-F!p`
zTJ&}v>%87zd%zb|Z&&RE6+OE^#14?JBwox0H9-%z9w<rZZ2$>(GIu`Mdm?fA`W{B{
z&=;5g|L^?K`LXj=MqVy2LujW`xAOmsoj1CpS-MqEB=R%7@cjAze|Peq*u#x~LHtr-
zaL```P0Ii1{0QRwe+VKEcOC)<+m0W-)1`YErCmTF7Y%OUN5kbf`uG@LJ^}Stpo$ql
z0+&Go2Y0Z5*vCO^s3c3@^r~J)Stci==`(v7b?aYT`v1T4!HYY8L6vr?P_K)M$cv+w
z{{Mf?ZW+N*yzli9P>_J<b`N(~$aGdnEPT+%$MB-gnUSH>S-|j{<-Zd99WtPb@$Wyd
z5rVtcwDU3Sc*e-U@FLfbk>R!MPLQ<Wr57s<85ueyItw^D5ACQk<zskZ`0sz(f4A3r
zo2w;2&91qgj0~?ogCY>rf9|~g;>~A}i6xqy$GTU5D&*F;C9=J)j4!5u{Bszbc49zj
z#}Q;blOH34;qBMToiCBA<w{TvV){OPV;`ereOTw=&g-4$KqKZmBtUvRAx;+Ab)kii
zVTUji14A?@*k3LNHNGS|D>ym}SX$qfvhFSY%g4}}!P6~z05n_6q5`5?FO>>39}wsk
zQHca=>bdy;zh%{r`qwoo-B}+j@76zR{>@x3VR^Syq&w?NmoG!T1z*wmQjTt45lcUj
zqNAV=tI+FRpf>!eZr&51RT!5lnL1AecOKjU9!B!||Nnmkr2QG($)W;x`V^4U`ymk~
zvMT}9toX#pzyNW@OCM0XaVJQP;iVTU28;~74lFytBk`;vDla%LPQTsHC{_PAnU`VV
zonAhMPUcSV3XlkpAD{)f0Jxn7nh)uAQ2~|eEZ~tRP(1*uXL3{wc4&ay@B`G{0>y*K
zE)|d~c$gU&UWEEEGQ0%E)=rQb!%HuE^%)sJQ_IZVE-E~o&LFc`csiXqKt*n+Gf!vr
z^o9wH;`MACpa5}U19i}Jy9+*adwj9{*Lh0vRgt{q%Tf``f29K59&bRMLd${|(mpC2
zMeLx7Hip;ddz}?PZOK>XL4(533h!{U?VALC28L3#9Sj@{3@>8;fRa+F@Gb>Vs}D2}
z|6-0exD#`DF-W1I$pLU8Ki+w52WUmu3p<$K1b2zF@iFW;18T5jc{4J+*4+tGV0h`p
zQoZS(6B!MII?sW|Dt3ap8Q>|+Bt6h_fN%WkOF6n-S$bOxASFbv`~S2~XBPhL*AG5o
z0cXq?cYgo>-|5WOdZ1KfS4%w~!wxr4u-^2Verh740*1LCbP1Zv1~E4a$=ni<xgZz6
zNcWm<HHlGb`pn6U^7S0Q!2!av>qj#m!;UqehIe4+VMrMVa_@`VzyAO4WJVG=1rl&(
zK@!;k7UAf&Zv9`v)m+WOP{PuBpi~lK<aP!IhQ=cTpga{9ANz6-X!00ju;Hc7A1}U3
z>o78OJF|cb))%k991aNQuFmwJDU5mb$2zaSZ~)Drf)ZG2=Z9x0ou3c>=4t-TSSt8J
z9VX$^#r`bewOive&`?I>KTw~!)Z$6XJ^^(GP{%@ZhY=`5o$MGH{7N{Uq^w{pdHY&q
z*Bwv^1?o7xIOoC0(0uy;YnCSo9qf?yJ6M%*eeiBjRR+<|Y{$s(B*D9c3nW+i+VH?@
zp<R1GX1Ie)?*^H1;(zpE!voL^q|<qL2T1n|o1g#xcOFFwGI@{yiwdN~lml^&LD)hd
z_VH#L6$bt(2U_3q8%{aId7<?i|CB=<7fM-L|CfsFDgfEI4`d^k2P4BvNl<GaWQ*aY
z&KEBnw5Q*h$|xbF23m!h&vKj{)RF9r=K&YKogZHCX;0^y#u#9F2egi;g#E<{Cq{<X
zA9jLT#D<r8T~s(;EYf0R=!^jm45)z0pW`kn94?@;e#VdKlczBn)MvOeGITS8*41?j
zbP6}W;CUhb;s5{FZ$RTR45dch!6M)u_lp+{pg~<0l@~wW|Nr0l;l)P~_2b1W5Oo7o
zoq*EAo%f)ok`BDo2?TYqyDK=l-9>t{M2@?xU;%k;M+(Th4c3edoh+s*-R>gYE-P48
z2$bl8`ke=@!97l?T@0Xr@dl}^absivPr8(x`Tzg5z>A%Z)61tb8m0gE1{y(!#0i+q
zqSE>eoLWV8$$)f!1nFjSV`O;w85FFbbYys`^TP`ZO-2TA6%4XaTN7N89cKV_a10NC
zCOd7~9GZV9lz!=U7U|9~na(|fQB^?o?f?HfK%-hOCRi~tbRM7XFoRK4`p1jyR$%wO
z-X#FC@i557B3DL+mp0Q2W-v->biQnS_}`v^A^RYk?i&^chW+f|p8fal2OkK0zuNc|
z)REyl%lTsZwi%2@^{{xf11)|10J6TqquW{JxI+K~11M{W9Cz?xU;s5l4!)3JJn+Kl
z&Hw+%vHeLM65EZ>|ASguH7Y8g_%;E>_p`76|99u8Xn+l6`F<QUiBuxo`K$TS`EF;C
z&H$EfXA$NXJg(DoXEMq%rM{isGm}xVzJkT@f2Vcp+frSSJ_i<6P<N<1SftYlq#m>m
z_`?gixBvflv#7w*0RLM=8VCn9+7vpEcV6y1w-cllT$D<yGcxQ14O4-7z%O_~Zmv-g
z0F7~oF)|!?QIP<pa&Sj>y6!ASUZy8%(`{xk%Bw7NWn}0)*m|H;j(_{H7lkmMz%G!<
zV6$S~rZ>!D)KIwr@^Ln3a_m5f$SxI7QSSk&#?+j_wZm({7nyd`&&*<!tG^B!B|F~j
z#<3IBcIdqI;*TmLL+7EDf(IBFN{qVQIGP{53+lY};u1*s$BX~wj0};W!Ny$<pvDDg
zmgmJzP^M#l@!yt_;q|s|H;ycb=Q?k_n5)Xj05Tes=sRz{Sg6X#5CzU@WgG#Ww>m$(
zsHs<FWB^stpdpOz0Gn<HofmQc|NrlHHh7Wu8bq7CNCVRrFXCQ<YQpH3VXy!H2REgT
zcV6o}-3@Bm34=Uww3}V=gXN79HPE_db8w;**|i5$59onfZ6Zz(uXDZ#2RZbT;Q>%C
zo&I7rqewld`TOF~Cve>%xXTArw}2C}t0N=B>#)wl&Bu7M7&;F^R$G5~@m~e(k5Z`8
zv!FCD1yZWgnZeTelYiUK&I*mr4=*ZY!1?yUi*_GIhP3Z4Dt!MKOF&Jx)>r?b4Rdfm
zc6#+3MkR9<Gf=kbc4q0$km&@iIJ5jvqWPl1hLNH9DO0Ib=Z_bWW?*04*_8ltp$(|+
z7IB<@We%f~*9Oqs7mLa+7X}7~9iVp6i+LcC<46L%Ac148|M{mJfE37(GWc7m;I1Q}
z1o9B%jTsKp9p*Ahg{7M^GISp8c9!S{4Xd(zb5UVoD$(hD@nWed*bPz;J>UW+!GV$C
zKQAcjzDx&&^jvF3hSx{Boh1w}bp~+k1UU&@Jr*iY-!PZahe=s^`oFo1E=+g&rn}5z
z)YSX*3^^0?yjY|J&cq_!&I+9_DjLUKRCrWCYg=7ZcwS8XFn#tsMjhc__Nb+Hzzd1#
zx8^a*)u)4o&skJne0&ZnC0@J&Q6FAB22nSfj~IaB{N>f>pd1Qj9}Wv%JSTyl!SJNv
z?cPF0+k9~bhB8ivi!VAqZf1P_w&ivy=P}l437~l=?halM1FSslIO`0MAVU!UHn8aB
z2RmOdGcXt?UHbkpAY%$>Xl}7BXvr5(bll;zW?PVIhf+20TH^x&8B0M5nrs;v(mG{9
zQpZ_Aj`+jN0A8a2T93T=gC{@3i#H;m#*yeB(6Yb_&4*YzMW2LDzc8Os0+eqUI*;;i
z2d&QC1uDy4Ocw%;pzi$l|Nnom0H|!=Bgn`A=adOCGBiK?*BkJ^`PX0m_A3kw43;1G
zTh4$w^KGEg-}e81dq)1Y-JqiLWAjNyxXw~RMuyJsX^r-wtN2^zfQI7gx5rC#-eCOQ
zXdU3}8N}ZT8ZKPHTq4fD-I*<bf4ehFK*phed<-voLCN<BPwVZH%x+hKG)rfeQh~H?
zSD`dZXSPzdhH4Rp62XRQQHBaH{_V~J2On@U9)CT9e_KA&!Ka*^FJ8zT1$Av(50nb-
z5&`vzUW3x;Ya2#}`q!MDFFSv|=y?49f9FTIL(d5?GQ1W<64)yM>OX;pQ=#Kcft|+!
zGIam*F}(O>&B(CuLLVOkXoRO*_C_xsLwu~^e@h#cI?>L%-NK+z@1y_!Hy;*gJy6Q(
z{`#5W+s+q|1&pEfpn-v70U3TEgH~BHGIZOX>EmPQ*1gip#}E-^c-!)RoltkkT!zjM
zFJh1W|L@#-pyUm7S^$&=4>#Mc>E>hjSIWO58)U?q|Ns9l28k>L5#KKyd?62Rxr5q^
z_K(3M%bmYoY!?6xESK=?%1{TDzH344Tf5G~D_Bb8dc#30AYM!p0B2ABi~^9ULe|rH
z7cojGWPntIRtdaN2IbA${M*@ff*M1R3GGE!r@Jm<RI3-rSP9a!+KQ1O0yO)anRx(|
zra_C24KIEF*zovYsU&DE6Jr^-2mjs^uxYf*2Oo317IEl2bn(@}M;r%VFn1nKYkYiw
zf%9_OaW@^%ByRHw#<Wg1onAK`@Lc+fAO0XmR&X|-W=-pi(*c#lhe7*V__u!mH&3qc
zGcu&vnn{-`g4K6^cyS0M()@#`L^#c(gg--vfuG?8ixne7q~Yz?{)V^tx1HVvny~Bq
z@Irh4|Nk9_TMm>M@^Aam8_wMM;l*KoMuvYUN^kXsGj)D=v6Y{Z!A8DZl7HKQfQ(d-
zLAxzMW6rPZw`9y>;AeQfyaT*F093_*7R4Xyyd02W)5OP+aRj8e-x8D+4nF7L-~PYX
z{eLH@_xI_A=KlZxJC8RX;c5L};mE)JJ$U-B^Ti8pkh^VJ*h=Mhf*K^dBtcp0#fw@#
zMh3%^yQCnzd_HhBQUBw`<9#4wUhnSw1j@WuLA;}_2lzYof+nuFAMIpO0UP{cD<3F;
zSlIYmXE8D`ghHHm1LVAq7K{wLKs7o4_M<P(@PWpD4>TX)vHVb?5EhW}2BhSi1tUY}
zN4TO-yo?OZM|fWI)`w;AGV(LLSZ~3|5E&14D#(xyK1PNP7L_h$hYn^d78U+&A}S>s
zpuh{tPy;D%umD-Y-QlCc1J^SjW@b=^CrC|<1t^5U{skFn3Nq3~g&h(mpilsb)@Sj8
zOtMkwyw&;RMZ>@U|GStwTvXVsTvXWkTR@9*K&o#3{r|t^KuHq+wgbHZEFh6GkYzvq
zm-vGeck!q&9_$iPu{c!B)N#n-VzDU5sTnCCSAd#2krBsSRM;5!w}q&%^|FZbZ{xN+
zQ70Od(Z$GL&+r1YEv(B&g@eIIg)btCf18U6TL6gU4#?O7GGUrIBSV*qickkLD8z(7
zQfvVkH$hU>poURA|27{LHn=}Qn*}>Rb-s9M0v<u-0B8J+Zy@D9=8OyxJ3wgy+PRYH
zoVJWni1GS#;bn}Dd<y*AJS4MEf@X^)7(Y%=SjH%2F4M)w5FYlwL`49E0|PQtnD`l9
zEC)?m9s#Z6`d=*ZzeI%tgu9tvBwhm5aXc?&rf*!vXd_t54Nh^OilXz!3oUNO>Hn57
zN=pYqghAcO&L1!SaWOJ9SIaP#+VOAyH{EbKqZnJ~j~6$%7^hEI&M3mA1WK+yUhLvx
zoSwU!QGt0nL_*r8l8cc6w02|{Xl$hO!wW44p9ef*+WFyy6c-~yud~7nm0h3~+zZY7
z|NnQ#sE9PbR(Po}{rPf61*RRH(>Yf#D%aa`F)}ze|4u1Ax9b8611PMS-ho1ydDlf2
z28MUw$Y2Y|NCEl$o(U-7f*Meu$*IGg*SZ}vS`U=4zL<3H|NqWnja?-m_uhDMTO7QU
zEG**&NY@GzP*Q{rhl1yLJFoF?XEHnqDnRNPUL4yATFI`$2c5(2yz!z)f{~%2Mum@o
zzXep}@o&pf;p+`$=HJft!i9^Gp~FRm-vhKNsR@)x!K;!I>i8Hs@3-DAjeD63TJcoP
z)f*}RQoo23G`?u`+O4-*<h5gOwcKl)E*BNP4rlgmHqa;vOP7xd-}H|w7^UjJf*kwO
z80^KDA|Ru;vo+MSG4Qv7`oJJ{9sX>+p)4=faxyY>xO4P|a)4~m1=(<vf15i;FH0-9
z+3lhNk^l{fzYyRAS04h+5B`Am^nli=uxw&{ZP$6I`O$|?5f#Hrph=A82W*>|>YIPC
zl&XOSv%tBG?Zs6N&>%Kwnun7`g);=QZh=wqQu86^j&RO~UrZ%x4ZoO6>_HZRqWmtX
z&N|R~fWPGx0|Nu&i%#|(ubKE6UaLYC?D!69Z9`fgVA*FNS@ur-9q*X<83OD>|Cgxn
zfH24};CNRK;NRxX77&)9$IQ?0;(`$<XjDKMj*ovk8z}Y|Ui{b&iM*HA(>+!(%GOtb
zRQ4M&G8}U@V~me|tsR!J3?x(o7BXOfEcyTNBJ2*>wVloypmhNys>hrS89Q&hxO^Ji
z(@(nvU#b8dhkIFk8kD<0X)hL3O$UMcZcGdeyFn{Q`L`SJZ`-}2laHak^JnLegFl#?
zAF_i|4#VX~93d=Boj<`{A02i^hTdR~&JQn?*rAF3B;G`S1?2L>pwVX2FQE3|hZoG8
zj0{;!SqvGVp8F1l0~h}pUV4#pALJKsld--N)@I~qXg<Kfzx@DsZA1Laho2!`sKz%U
zEDQ`gL2H)4!zCgw;zdExY<P0VCy;I5u7j6l@ff~swtW-I&%jX0(RzTtFA6m4dH^(d
z>!QNZeD42o7Zn!JhAp?w4+kHBtnujl^y1XE|MmYnkGKBk@8AS2mrwvT-P|5Q+jEk;
zCV<)`pn;mkBOphB%Ep&74H+4Bf)pBFdT~tzJje^0LjtXXcrknH|NpMtE?Y!e50old
zmZ)%)F#l&!u`~s_tA-P_#I;0)<26qwSm5=0{%rwF^=X~foz6TR!A$(yk9WGLuozx?
z@tYNt1qHw>^7ywOfAJc`KXmYwKw4+8NZW(7PG_-Qpp8u+IY%}|h7M<m<_Gm2HjL%^
z(CY2@3r(;%s0Cs9p^m$`rbUFIl%+GKMZ}sF<eECx#UQHlQ+?-;7ss}Os&vq-8^{4K
z-~apne<4V=5wr||p+pokPi4uY!ryb~-~a!XANc!sfg12&PlRT$vG6mzxT4R<(0D|F
z1+s$yT3y6+@h<G+V`w>95@&e8@Y1(~3j9+J@J~H-`N8E!izk5Ew4zh`eEAp}e(IG8
z8y)})9cP^a8YXjKV0g{i@Kd==wZV1)NT5Wf*>(+xQOenDy8^^0;X2OR(Z>fGFJj0r
z0y!c;pK<y`NhY!SKo)+6ms7bx>w93S<j7S}q#koo31H|AQ3)_S@FL^u|NkwwOLa1`
zKzdp985v$Q{{8<Syn$>nXcpP<Tc;^#9vQsPuQ%dP{A=kh7nJ~;|0QP}I$Tr&K(%{_
zO27+w&@AE8=HGux#0*b%-r8}XzJrh9h3&5Y|GT4EnqRZLewxt+vSN`QBLg^C9kLH-
zytr~7oNQU5TMv|q?Fs=6;vZmPU}!!P15Rb?`cTEa9*o&1H4MSaJ)(se88TLZ%nAdU
z1xn7n5q~0^fB)fc;bvlBNNcPXVPPxP;^W`uESY^k12jw)!>-cJ%)jjjgbQBurqf)Z
z0!j=uDmv4v*D@;Ai*|t%5NPQ#Xmew)$x%=p%)gx(lpH!gy>Mm*_4=FtvX$!X1Z|1!
z`~;eseUZup9tlzb34up~K;2+aHNXHaq<LOPuV5@SZhpYg{DV;vyyT(TMMZ?E^GEXo
zw&ou!pv15ZBwWvP+(kv@189K*h^z5h48;Ef=R+4u@HC(N54HIXBd9eBcEk!M@S-Xc
zumdbQe?nE9Vq|1!u2JD(D9Pw`W9f8Jk?A}HR$l>9f4uqRf6!zsSY&=ZBO_>ogbbJ$
z36ek7`4cYP$jHcG_`mbJ;kRxV6_f4|6${P}oWHtDR8*SJ|5yB=`0M+P=1UCUZ@uOL
z$t%04sC>U+c&YVLDNE~t60e>A`57225AFmlXqLQK#MfM-BEnF@z5_BI52`!<m(;6B
z1O)^IbiVAo)$O9<@}m3!sNj|W)k|!g3}A0CHsAg4+WeP|zt0%7$^o3NUcLb(S5Q9f
zbWzcP#BZ+-dvlG74g-JRNoEFyZdaAo1Erk*eN=Rs-)g*m+AYAp?HEKMI3buo5<-1v
zjfx5X_Cug>HarQgZ(c}m1lLkd;GwG-AHf{wh8h(oh7v1K!_=wy5L36S3jcP77qOto
zIK;pGz`-9Z9S55q@;CfsFA;5iz-xHYhNYB^f7`j{hm4&*Dk`rPAUX_B?gH)jda->2
zsF}<^wH}n{7(r35V)!4lDB!q@iVQe_Kw>uCu_}<5<lY2kFqN>pR@)@QzwHzMc4lz%
zyz|qGBnHqR1as%77rcz1WrX}KE0`ESO(JIo{uc0Pz_u6_XOKCJC8{8bsl>Q97&H?m
z@}fSI0W>Pn8w`p;kr&Y*-tpHVy}<%t-+P1j$C`iqFO7N~)*CDW7BmA1x~Q=921|hX
zY9Rix-e6E75_us3;vEMyH=BR{FX3`86?W@9SIYNVvibl2QnBWL|4Rj5b7$-W<>YcL
z#(IW0!*7QFvt3kpczSs>I#0a#x*bwDbcU#aoG4=n+UV?}!XfRVVp9xql?*6ncDsNV
zdT?}}cySA&L8dcAMFARKOeLU`7IOHvGw%Y`U@uz#Gk^vWY+4VL8i4}t!~YNeAu{z#
z{xLAX)x|;8@o#4~JPA?I@{fU`J4VH(`7ytD>FRD*h2|Fu%|9NLa5q;-FqF*dc2Icz
z7PNLBlvGt1OU1zHgn#M*!;_$pX5gQ4Q1RevPB2e}p~R%w7F2FC@J~Gil4jzspK_q(
zP>EdY?GmYlplYF86jTTBuerc|@D(@6qtIYrv2;-Zg|C7%sJ%GpK=Vh&mJ=o7%{3}2
z3?-mYVF9<>KzThxMZvNJqFC}ru_<W&^S?<eq<50>1r+W~nxM9s0LTUP3?){bA3A?Q
zR`oNxsIUl!sBpX%1C<9L6XD`A!l2+SQDHIs|NWkHjS2^N?{26{FsQQw!{K3|!o@|!
z=f$==@O<pb3Oe0R=D*2Qh#R^Y__sMo24rZm@-w`suh0OwMdZJW3aBKMVPH^TFudIf
z3h){g9%lYlhQI&+zXVN-W`uy$dulL(mIkrBc(L{W|Hz%7nG1LcQ>@<2s{q>WCacoR
z$Iy5XG$GV{`M>3f&g+u*!P9(2TrVdwfErW>7#Iw1gQ^H-{?7R652Tnx>MKCT-&F_g
z>&yUcRQ?aH0RMv*Rb@;7NghxKIaLE1g(aXB)j29YojEEIpxK23pk;C{FS55nCL0b&
zfa=;8F%a&H8K7py(bfYcMj5AB`59iTWvl^F@}O~qnyvr;x7Hsh-C+2?)7AhqJ8o;z
z%g6At7c_tzp$Iy9M8)OB>n-4X0Z!(<E-C>pZb1Y<3!5~0L1pJ=h=5LKh>8JN#UhA+
zNoNRXsk-6G9dAJ1m~|GsA>{HxP*b8?6x6bC>U61B;jui?c|r0<F&k(K9$XxQ76`d?
zhNyUS%YxIUDJX4r#;AyZmd!QSs7NrBayNqtb^aF6d8we4)ZH~I3XRA9|Nn2_e4U~3
z83O~ufo>lamF^f7jmCpu;me@2B^VeEFrE{<4_ea>T1?h#+ffg0*O+wssEBmOs7Uay
zxygL+HFM{=&il>aJt52`DlEb^DjeT$HeY7=ep~UQ;_pt-2GAH44$v|o&@M#n5)~Fu
z$^@l&%VV8CBrg=Rf!48iUhgbX0j=iufUW-$*$G}71u9uU+YCPl{_4yC4HSi_fU=T^
z<<VO6ZpQ9F7SI+t%Nw1SrDIeCiuoXmrYw(j{+7I4#OB(3P~`PRn4K^ix?NOsK<mtz
zT~u6zLsUE<`KQ}QMaS^=_nXo&DhAVKWtk-OA;AjD(;+Gf%q}V>!XYXa5XGRaHQ=rD
zE-EI5m%iVS4pFg~o*>I4QXkM6q7u?+ibx_DLCbhh@Ny$)qToO$uLdY3$?Ej-F$4#O
zhh?y^@iV-5sKN+p14e+$?f$p_|M!Ndq<}e1;8`(|ZW$HBZ`R=EZM|COEl~2z04WRR
z>1L@{c@Ya{gEkPp2zvYfzgzQRjn|i8jYM!;tPM2!yxmy{G{`Iv5S*a^vNl@<R6`l>
z0<D1P{P4o%7ifRbh2|rmGkU~3Z~PYp9Ynyt?Zhq{(2&4~7kNKH>k&I|?O^ESV|cM`
z{r~?vnHd@CA%}o;et7X@-~a#LoFy1b1R=wuphG}9KfE}*57zE{SqPe>Vo`aq|Lp(&
zNbW09>b&tHXDz5}Tf!fl;Q(^nd1Xe1=(yL_&=%`WWaT2DW+el22?t1W`d&FE&X5F<
zo*BxF43V#0gEOi@ye?&s_n3Erb{Rp2Y#sLf{~r<64LXjbL_RoU9!OORR266;Ipo+9
zseS+dzdqJ{BxZWSW=6UCwO2svGHk$&kR6~CA70D`i+Jn;?Yi3mYVE)11dBKziIjsy
zT)K;GTECSDG*>$?lyJ2kC}C@^_FyO#*>wXn!FB{R?Ng`B$neq$w1U-HrkCd^$Qj_#
z-1TgrnOldQiXdBFECTafc7i!m!5k0pRP>7uw&{9X7*%xcJ^24WzV!fq>rF-mhS!?S
z5B_xr>vS@8JL@zbV98PdZ@dI|r(bM&FuiUIqde2(2h-<oVccc+2(;?!Xy>Pck9fe1
zz!w)m0tZ_Ulz`Sdsde(GK%5Jj41e)dkr8xq($7=i^7O^WQ`4t!Wwf$aK8ZXT#q#1Z
z3wSb$r`uTqwB!=h)eQh0W8<R2^5Ph1j15#nmd0fq1x3MXh3Nv@7?q6v-2+FDv&RcB
zknzqgFPy-%!wV}gZS%tD6lf@{`G^L%N1}3SddfCNMg46T!JS1Gl}-!r+K8S8K8796
zpujz&z{v3OE;9qeP6aJc->dV-3nrH7TedMeO3VKO%^EdSn=_QyLiVqM*2Q$*c#->K
zy1;fu<@$#|85klXUV=tY8>-D1N<1Nn8Z=7WdE<rF4+e(LV`;VwjAaF&p#;!E0r1=a
zRDSVK1_l%jKfi-oG#?_OUW@iRYe1yHZO#V}iL};lrR*7Z*!US<$EG#@V~}7hlg$7n
zuCR<Rpg{T|2dd_HUhbHFYCEHWdgFJ{27GXfULb>?ouA>wS~*6B*q8aB{a@=Pv_O`f
z>+GMdxPwv5`P9KjER2Ubr}JnqFr+neG4@XJVisUvXnX{!i#w+aXn?}Tvy(@q^WwpW
zEQ|-cbyO^06?64wF{X89@;SYJ(fMk6<qk$grU&1q&)LDKCGPu!0d&v;10>);3%ojS
zys-E&{q7D%NpV>eNzmf6&KoZ{eoW`x$tY9*>N~Q|C7^=k#*3>ELFma5pqbCk8!rxg
zXJB~A$OuxN0cv_f?9zbfSp1!Vp}U<!gMs1T3m(HuK>-k1Q1<M+@uKxRsM{*=61+^J
z+Khp}1+-EIq-^?%os7KVaS;2U&Ih$cJ8!)3{6786PDV*_JrqgM>ebF0FC@QD{{wRV
z?{6UYz_vg`Q_M4nAR{DFK?@u^Z@jqp4VD1pAWl~Q%D~XsE~5o<n#60_=EE8&P6uWD
z&KoagePdvVj_2Qg?6n|hX!$5On;D+$1RXOG6`cdx)dHJhIljXOG&nTpEU4Tp71^}}
zRHn#*S|@8|7#UtBfp;A41gSB+^x`q74PBwZzm1*oN2jw+x3dQSHiq67cF-VJr?Ww~
zvqrar2uR8T%#`SLVV};pn^C_0*ui%K2cI!@7K<Ew0Xo{J!&%{&vjB??qvV0+2M?ML
zI0OU*{x8<Z&;g~vOld}j?qZSVBO<Ne_*)i(hA{ti+jain-*%w$7ii0MNp~1aw;M<2
z--B-@Iu9OvDG<oN?L;8|wlkm^p}@|c2VV;CZ#x+n+IjKdONqeFiwEl=0{q*~1@dn@
z1?o%$W@Lb@`Y#2_4;tMfDviHFgPjyWP2*D4=D$p(pfO>^*HX=YnM*~}I-QkY^M?gw
ztOV&f4c5a0a?hV$lYOoK`CH>bHIlPVw*$w)2Ryc*bXFo3kZ~BKdae{`rO}NS$w#JZ
z>|s=}_zV)vmjVrhzn0wrN*FILod$=!@U95ZQh;($bTCLWG8i6sZMPGo!0^%w%YV}w
z_Ash&DJ1YSbOtbWPga?}ZV#hU{R|_}b}G;bU(IiLIuCd9fY#iwfP%~^4b-~;jg4}#
zF!Va`ykI#9TGGMN?ZDE_qtY9q!t!DnXe8oNXE0Cm5uRw!rYnxl!)eD^RFs+1I(<}_
zz$UPOOkiUGn{em=%ml-eosV9m|NqbR-w>joBYL{{UPhJrCR8QrFdJGAl<<aSICJnb
zypWLuZJYq_Ydsts*m=40;R_}3vgs0`;EXhoieD076(|0`W&<_8A23FNH_?FB+Fk?a
z&=<yF4W)%UKnr<Zq=V-0j(0xn{KV3E<Hfb<FZMDjC{Ex5&2yFr?y><TXz;2GZ%Iam
z*D5<$K>@tuz;w-hjB-+~APXZTK*KJbH(tE__y2!nbn~hIofo2}C+}lau9q+Z8B;3K
z`EeJMCU`y-y#3)N19%7=GzbkI6zl}8hdJAM;zi;~(0Ckp(wqTgu`I~4UI|8q*J1%-
z;Td~C)}0Y&Wazx#`SSCU<|6{&6@s91{`j{Su%$KslP^=~Jly%|#hG6W3@r!hONBc>
zcHY`?4Ww@hXrB5-DEQd5;LgL%r~bdl+XPBF6~dhdJ8$i{1yYm`Qgp+IpCS5ivn}X!
zD~8gTaM0GkMvM4h-}q8*a1-Q39@zL&+umw{ouB~O^@M|;q4UR!`L97c;7V2bw-vMY
zhJ65yqJmm<EeD_uc?GfqboR<(klCP>)rXsHL5FKGl-hx8ff)7?q$(6*lnVd0Vm9y!
zy5B!RUV<9*9i-&&zyJRigLFs79R`PE^Ba!t0v1rVp9?DQ4%b6mdkCzPzZG;a0RJ{;
zj)M<aI$2csw}VH(SfCpj7%$j@b_A922V^jD@-w{15MyMBi+>&Q;==L&|2vO@$0I+0
z#v{Ezhl4;)NPGEJjFBPWe=$pNh8akYi5Me8=ljlkpdAXImvq*0vw$4{S`GPgdiDWE
z#ror*HN`n93ZQ|q?gmh$WzASB*LnH{AIKIL70`NBv0Vp1_WT1i9;(DZIr-&NMh1rN
zevop|fO_YT|I<OMHu$%<gM>h9APi4J2l7rW1Vw2HZ-WIxiEk%pzbnV<XFKMCTzB&&
zLp?+1@f{6b{0uM7zGPrvJicQoNaEm228Lc2b{YQd7rL!?{{PRwp!w7CVzF>gU`7N;
z-bEBt%<&k0do98Et5dl3Eq|*MBLhS0w-V;G|7`mh85kJ4nIWOa{$lB||NmdJz5w;~
zIzcOCWg)%+t>ApIwq6w4N8i8i|Nob&pmL8zr4zi`h$RgaZ|6ZPTAU?1SyYZQGe|Hn
zKwPc}a-aue^H0V)v3(%Fbla$WUeal!vVjpazs~TQ#qfaP+YV=zeIUOX{%`$OBGvif
z#j6(#480I-+z=i0HY%>2?>m2VIJ2f5cV=UF0SSOZ5QT;ZKsE^M0|g31JxKYB4rh*I
z&YYmr2EaQ#4KKYg_`$$%%$bYhxU&$b?n*oEEC#M4k1;T`zAa(xJna0M3v?KT10zFk
z1n5jI&^ZA<Djc7Umw>8>7l-%$|GxtiY_EmWEL|D+o45S?|39tMmEq-T@N_dzG^maZ
z3l8g+J>oNc_aR2v`YtYh2FnknevZvQSxR4L^mFkuyqF=($Z(wX2<VI_(9i`70|NuN
zbq(4v`$9vAks<mUiwaYTXvQLt>MXG815nkG;E^ft>Kbs?0i7%&qSATd;7iu#hy0y~
z4!+`Qe#GCcGqs_Mk72*0AvZt63Z_!l{mR_@4EsO?|E>p|#jN{OxcM1Eg95|D0zg}N
z90Gzf^tkyMUi=f9-f@`GqCTOSj{&@G6SOMDrrX(p6|_n6#fP1sy1*ga@MPzw7m|M%
z7`mN7JLUztgB`$&u{v+OxTnR)&>iexc(St#qy@AO0_@Q43XaZe2cNNYyBjcm=w?{K
zSR&YY8RTBp=12S`BF(?pOIVxF{ePX>d_thRKHPxuQzsK-)$TQR@WME-K8|k(8B1<{
zJIGY3-1*{#FbAlZE)m>y0#xXhf->GYAx4JRJ6?$JF*3Y9(|O|H3$Eq|{M{z44xm#N
zZ|#T!c@n(s;{!CVI*)Z;cu@?p;_#Cc{%se&9bzo8tACR4?T|vLYU{UB(4lm%BW-?_
z1las56$#2n2AQy25LA=z_{YG&@Y*&AyxyS(B;GFw&T*YLUR1J!ohGvD4QP$-Hc)+F
z0$L1q;{R)&7v;Q+46i5c_yyj>c{nVvQ$(fn*bC4>#-N$D&JWK_61qiHz$xuT47k#(
z;I##*h8)-U{YDh@_&(6)BK~c<IiMZeFQyk9Wt6CIJOL_5_*+3Mm0tYi0k585UIbFn
z{NR0uiwbjZhzj$L1OWzy7hxx$wN_^52T&{P<G+KYqPsu~kY0p?mb5M42iFRoudQ~S
z0C~U(?37Z=&JPEF@OYH+^KWB^NN9o%<x&E#ov&wrE}j?L^#wd<`JxNFH>QH6gZ(vA
z=i$y5V7K&!s4zhsap^e7y`@axBn>|LHsFOd)DIRQ6E5uldu0_^9e*q6a2CT$JC=hS
zGz}^y0E&4wu%>$cR?v29u=%S%!o^TEZ$YCN+gwzbY(h&o0y36xgJ#CT%2tDv`9PH&
zgDGn{P$CqNaSjx#tN1~~2`^WJmr)y@-0=q_Xu1s)crUa;lbOfB=KKelQy&WUZV6~H
zYC0=84T!bgE-Bu10+bG*+iPA*3otUgNaki_czui??50&9H;M4@GrXQ;cxlI1kmq>7
z29;VKb5UVp0$cC_6lq`og2PMc7%M1F6Adrz_ySUW4<gK6pW(>E&+y_WA0tClM06Z@
zUE>STy2b^1u$gNH27w(63=A6#FTI$%=l_2khe-N*@-n1#^MckvHXq^H0a^@hcqy&%
z=YRe(R{re=4KFPQ4a|0mf(B;6862{5D^x_K^E~(%L?0Ce&~P54v37eu$km`Jgi^6x
zHlPOYGG<U`2E0J$<v&nU?r^tg18B{u6XRkK-4V>uC8E+1%-;E{BY1k@2}a?1?X*sB
zrnKYEEDQ`m;aLoUp#d39AkQ*@wBOqCSA&nC`3QK&;mf9dkm>f$!~EMS#6XA5g2tg<
z?0d|>(0TOxaZnjvq6?|yZ@gHw9W;Oc0d@@2Y%upg>w%Jr&R6`~PPKk36?~n$ldm4M
z(Dw^71H--#j0_9`Vc>=3pffTe<C>qdl<4k)cHd*b`akS~cIJG+T##{Et=~%2I$!c{
zJNcS_CqKxv5|C*HVAH@gK<AAY%l?4|GQfosq_dWh!N3b@K=Xn&zJT_cfY%MUy<q<c
zI`7g&C5f5g#fokJ|7U>e(2V<k_!wUN(*d<UKzlQLT~sVyl+6TfTIjA(u`oQ@`RfJS
z%<1P(G8#xbbAU&IdP7u<UNAodWp(}*14aghg<JZjOPyk@Q~<U0T5p#`@o$S}YyQnt
zFIVah8iwNE=D_iqcj1n{>6=e6mWV5XT-T@#D)?Mp3w7S?{MGs4#q{aZ?M^ew*DGxV
z#d~R3LyZa>LkZ`%!;GaYh6i4IHq@xFFqD4HV(7fl{DCn5GQv~@%3udxl)q<y92TLh
z__^URW6Al9Qjis_+Kdc4F0eB&ywKeI|No2AY~aP^paUP`K)o25&cmG#UNmk1*;m2}
zs<zUbZPZm5O4u{j^YSyimh5#=VS6zdEMNMtp+<#+p@cu<B*^47TGP%jiYvZ*$G{K?
z+DR(AV;L{#e8v*i9rJkk83Hn%fK-)eO}9A1s37Cu$P3!u!oqk9)Ya<sQBeR*u690n
zv6qo?ddV3^HKzZ()90LFl$2)Y<7e0f8ivt46vTKV;6)W^v*(@88!tr8O}}u4QBvw!
z=h<$K&KobDfh3N1yRy8vGx`7jfDAsq>C9&tRV2jt_!%-lotWMj6@lOvoFHX4UYuV)
z-To}2i9BeF!`aSb2mi4(KVxowU=P~G#_}}*v?f;MYf9hr{<DlS^)J9@TkyAnj>hW-
z&ww}ouP<dcJn-@|=!T&T4Y(C9DiQ%NlECd40mJ{Dzred2I3|IH$661Rly(bugRXXA
z=x$K~jl5`Husl&LxT~O%k6}kVr~tCyWMp{l4+;`kGq=0Fg`u8-ftk6J`536B+3UgB
z$qkx;;@{@QXbo-^7qNj(T>sDf-<6@8S@S}7kIDkj5^2Wb#!kkUpx^>EyDXXcTYUfj
z|KG&}I@1Sr;RPqe!<--w^D%&H%*G=<;CeM4v`%RH+H;H?78ZQ`3|U;gH7b1JFY5n-
zG6QI!`gW;cx9o;)@S)Yx-OduN2TEDGrC)z+KET@fvGdmp#XHmAo?|qsw}I&v3V$Jr
zRkvYxwnXb&sP3bzJ3(Em-VhbW&KEB>+y-T=5`K`0oiAQ21anKTf%Zv*x{;tRAgB+2
ztn+eUhAYS-4)8$@FV_44kK_w<-l%`Eayn?{4K%qY!BE20D*{?!JAE;@<qGP<L)rqM
zg>}ce9W+441Sw^#Y2ahX@aE%ZcyWl0k>R)-sMchNhyn-D%Z;FMzUvO1ZW{dCxEg+n
zlnee>=`E?_W7q*2?ta-1nri+T&EFCPI&vego{52>H;A$G!wZ$g|Nr+!F!qYbcYb&w
zzWD$Dmoq_Y?Z9#z$a1-$gvz4Qou|<Hwv?lrMdc-^jN28@#}8VZec%=-NJ^PIYbAE2
zK!nypgsyhh%Dlb+c4U_byF<&R(jPCGK=!-$hNy6K{&=x)8mLd#E5Z&cVitkdG;;L%
zurdUL3!TRx*Elo2lx1XK0O?@q{P7|mq~maJm`X1Td#{fQ$BQfT|NjT&6p-6W6nAAp
z9H0wvfM7R^3gcnM`<=C*F(HmlSCwv;dKDIjmvtbcgBY_w?)Urm|G&da&>D!|AjT|4
z@V27P4=>EYn~A&g6e2*L?saB->B-2z0Q2G5n_y4B0QvASC<8S7Y%EDDw`%ywSmM_3
zvw^=A)V}Kt0<D+cw-6N0%)NOky)5#E^(Q-Dy-=7BI=BwR1@VOD|NsA5x#4G1iEXcA
ztqoI|+{?Y74j5Q><HG;{n-4I*1Z^^4yz%lVXuH?h=-zOqEKnRy0&UAbz!dos)TnAc
z4r*9{0@iCPB48aB{{PQ-6tXk-#8%LfGB<_R1En&%W`M@V(?G2p6;^nn>W)$2cx?yU
zqZ{&qfuY+?VHYS{y^!eyxr76}ysY!n3!P3#gaw1P5r6^=T-<lMDMa-;Grd-XCQ|U0
z<=4V69wP$}Xz|nzP?q}dr!jreB}QExP~y%5CGI24aCf|xX|7XYC^;J*oUsQa-vp9h
z!pu1R_a#P2o%xdBrkGiGghuP_68-LCmayQAB_Jhv%!~}s@iuUY7x{d;!(~R9dQh%B
z+<6V$m;ogQ6;Pr9otp=mVsuf_0rlQ@27tT(I(?Y;IRnEn<^<4*h|VIN#X6nU2A$a+
zpxw&OE}$|jt<xENG(=jbvtR4C5|OZsqoB+#(Ccgx@S^+&IDdCLgAZc@Eq^)gqM@R3
zmX9B_HBAMyrnLF6NoS0T0yw+J$G&s}>i~B*r-xr=G);N%16=QkhGkp_S2`>V44Q|6
zdR<um2fXG9%eW0H<w0HE&=+^UgDvZP@uK${xSI`{Gk^DaN#~0fHP;vzx@}Z?bJ!V=
zIkPbKdb92V1^W(A2lYkWkLe#SGfGIMfNd&eIp)m9*!gl7Xm24zf%kN!D~$H_+z@#k
za4`lUK<BcBsPKUE^^2p|89>wh(2d&?oz6TFQJpWrO)-c$r@n)Zc4_{>SjNhDv^R{g
zBUqr<TX2^ksJ#Ss$x84#R*(w>8G5~ic7aX+g=p>n{(t(TD~ys%#owp@y}~GE9u85;
z2I}cwVDI&o0JqT~imf4XEXSNB9DBVb!AlJxGK$mvt}-Ue?fnJ{(^8OT4hM!_Z!Yjo
zfE^%*yjb{c`uVGja!ifiroX?+C|{odR$C$(mhlK%_&-I2f6P}{`14*t3;#ctk-}d9
z6uKb0AQt}r3JVn$#-p2<I)Vk^UKeCwkYjjp|0~$FEXSOM*n7Q&cYzK;g=jtcb^6+C
zj5_t;J1PXhcc^%=I5huYEq%39!I77t@nwPqFT*YnvBRN_kKu*<V$gDeT>=w$8FqjU
zg?KS%!~g#aK`g^dpax*)p>BrP-#SG>_ebn}5X#Tc`0{}-KZD_=9U$t(x<?EQVByX~
zI~YK_B4aoF|Nmlnef$6aFOIwdyOPK7z^>r`{0uMOF*7h^ftG@U7J%+}3(Al@oBsdL
zVl+Iti>ZNuVFv?0s5i6m|9`M5aHClWB=l_K|Nr1&on5@3lFvm&;>F89ps6UslRLl)
z&Mg5Q6bdT+7=pnHt-vaG$b)pR-1z^0uQzxx(!mGJ0T3AjkW4?wT<~NZLj!1ZO-1a*
zq(9RIZ!pR`djDZyXg<somSN8iYnIihD1^W8`wZ$nxTuH(bl%(r($)Fnh5kl}n8b@c
ze?Ze|pdF@%rx)H}6lIeBGri*mqeA`V-{2Kppq&veD(s~i{M*5&z+@mAeKjg7;V+JV
z`v1SzkBxu3i;6_^3%1va!2uaQNDfd5f3XCtgc+)YIbauK0|P_n4{&3+`G^EaoTd2%
z+Y1h;Q&<>}Ilr8)ev?r+F#R_;H?q7iy$N1V#bS8dI!1-1*Z_P#0r(IPIfxRG7eY6|
zM<q$Led6DKDZub#uZxPp3xN&)|2xOMKD8qb6neK7P4B(QC>itj7i6IyLy0NaK%Qbh
zaPJCi;I3Z`pcB(o{+FnLG3eZ$?hqA~7duz~|L+Xi=5h8LD=1m9lt>`2wf_Cz@Y0Ke
zE2lHvV$`e$t#s)GuXM>`3<@wj0Pa4$2wDCA|9?}^`j`KvAQc(uAXm-*4eDx2?C1b-
z7#D$3V2M=PaaK^@mVqsUfsKJ7V<t$h>^JE23((w$2y6llRN{bL&Hf8C{|Q+dv+Ga&
z|NlESg0yS~kK6LMg6@LZaS$Z35Gpe5&;S3B@+4smsL9!Spp<8q3usGSFKF0E;W)z&
zW(I~GpaW4~*nw1lMqNdA8GuyOf?CwGe={(=4EXc^|4xt^!%HtN-viCafDhp?Vb}$>
zerx^z|Hr{+#DN@oycsmStm4nh(774Z2u3-W<0ael*xQUUjJDIOZZk?Tx=o*YoAEwl
z()7|hjAcx0cc;I-!zj=6^v-m?yNpt*xhwwv-vQdvtP8pyX7PnKK86iDo)tVPY(B!X
zg0X}Hw3?V<y6;^^IfWy=d<^{R3=GFvK}U~3SZCm37ka06-(}RU2g$vb1`UFWb&7(t
zyyoi^z0k|Y@S3et6r|j#`Bz5i&Rq$wK<h+yTm^;XntA{KFJ1sCSzdqyidTWgTtF*H
zK_{pkX9ey519jy)4;g*~*DhULEhkI(8h&z>vN?dqx1C<U>HOGovZS7MF-Y-35OMGU
z(~E~I{{LSL+Bn#Hpj2Vk7tq3ZZcxJpboW~4jTZ?E!MlZJLCRlyXM6%#UjLneA=2>M
zLXfUrn+=`vUCb>9O89NKdYu{hTkeBrOkck?yxq<IBDv=O|4w$dfUu1JAf2w?8R|hB
zzFKdW9x}YNgI$21;l-+zFt5B}0EOKJ=-O|>USVAfQVZTidGG<t3ki@<KpQDr50onJ
zdI0jtWKim9{tlYAdNF+gsNU!_69s8{2|7h8Llk8H=5GuP5r+S}O+i{2|8>ft_y)9n
zp!4wS*VB{kGb+`WH~jzK8^-Y>A58PSNN@Q6|9=_J|1ysMWi0>AGE_kZx_x6{Xg)3g
zn!deV+H;(BNdiAZ^(B7DhL0T!68ITjc-&-Q&|qDaz|XMbzy*GWw8h^;`5DrVv;G9_
zbNB#h0(=PNXLunGR`@NHpJ9j6MSfL=w8dvZn&d8mG+j*KXV|3(Y7HC!8T#c0$j}oB
z(={G2I@Na`e);*||NqCB89EQY1f8x18bbk%l6Ic$_T*_jS;Du=9OT-kpdQNM*EShW
z0{jdaz90hBQ4e_W>=mfmVB_Bw%G7*Bpyg7DWKc$c0HPls46ec$4>unX=yqiQEf8k!
zJPSEv^S}${deBgCct(f-KSSpS%^Ly1FQ&f&HQbwzh;+VaIZz@Fk_Vfoc`q#ZMHN&M
zHXR6ZY~ve{LqG=%bu)mDp!5J;UBtI58f4^y7kZ$PR^{#hp5_yv(>p7JGU8!w2c1?|
zANE2WWafv?FTGP#Kn7_Z>gIm28g$J0vCbPW7S;X#-@67P@ijakBSV0nAvEm8=a>Kg
zgA2Ld9iYaENb7-0h0Yr<O6ov^5%mx?=OJnYUSxvR2s9o684n((3JZoh`doeED+UH0
zhJ&xTyLm2j$6R1(y<G~rwadHnMDt^&5~E$65N~9H#x}o|NQPyA#z=ansDO_5)I1av
z@FMdi$OQtO4_+|s`2YX4X!8M<&QCDAUQPqap7;;rABNg{5N2+@AgB}e;KlLn|DlRN
zXKOjb9eBC(Tqj)d)4!n8Q!}~+_!)YqsPHg?o6G?(Uc7(?MibZ&&<=p;IPk%(tp`eQ
z7&QxG)Lbbvv*yCgGT%P^?;}PP{cD})5e{(w`~QD<SjJp5O<pifv$stTc+6;ns_D)j
zuqJd@-+vBuwE<X@dVO&78y@g7KqpXZ4pg@Y?lJ+LS+pKh&dvYC!0_7aIExB+Gz-$D
z5n;Rm>eTf5sK|7Os7Q1^coFdu(mLo4QQ@$>P{iEp^#2&BQ~`BEz+=9RZ$L*PbRO<@
z0QHAhx}9wxy(E_IdI!ky7N7%_Lau_=JAt}E-3}a`pPEkz1c9bQUua$h8_xk16#|KJ
zyb!+1zyLY*<k>UOXl*=bX(LOw0|&T|2{I3KT~_l0_U0eVC1RZ~UWh#hb*=eZTR_F0
z%3B78*XO{!c90g(&JU25OIH{eIuErTC=r4>17sJ=ixpQG7$SEt)G{!<r~+Ab94ZU$
zvV!!@0_i)tqNBvB^T&&I&p;NHXzVfom9lq0;h6c6fg$vNu}#J*P^mKW1E`_F1G?3v
zJ`QyF$BZ`&46oNf4Q)Or90oq}1MGRdE8y9)oetnG<cp{)3=GE{m=<P$4;Cp=aS1a#
z*?Hr|lrLZtLHiz#J3D~ty4Qw=|2wN4x}7axTIC^H-+;A3w8eg@XJCkpYCXW;0bMrP
z=?q%wZv#5Wp1mVj0<@@*zg3?J)N2h$JMJvSz?9bQqGFfU=`06gIHh$ugBGWIq;)zg
zd}~p8%)r3FQX<gZqQb(+z|alJu&+70TU54y-48l{D_EfOc;{9AHSf6(zU8h5EdmCe
zC<&gI23=8N`4co`!T>r{ai1>(14FS0|C$S;2VaST5?yDA3eP^!AxOP0DmE{)%E6-%
zAu2Y#E-Jz=96CWK4)E{$2-=Fv6B+;t@ACru3|Rp$q(S3x&Mu(yup#T?yBS{01|3>e
z@9dG*-J)^`Jn1j94|I6n3YHSX?j99TecO4e`BD8o&_P=b4;@OS_kp^(&Hw(F@bvoq
z=U@D(h_mzD>-P{%OeOXpgLZ)yCLC&h#J(5QIat9`$`78wzWAz?t@#0CZ^r-b7L`2=
z3=I20?XVS0rS&4s4;Y&dFm)b(&9xt7`(6-%6l=Mcz!Cnw+u7on12c2y2b=#T(){}l
zfPME1l$rwGF)(xoTXcSCKH>0M5tO%HHvIfwBG13?Vo*Saq98xR3tgy^7tJRWI-Ec&
zdS07!{%rWkR2MA?QRWL$#tv2Xqxl5K>l*<X#UQ~?Z@~%hm;(<(WE|)|4a1Y*Ms(+m
z7s{WYsizZkqYx;#=Yez_c*_7<T2V4x_ywbC{UMN0-&@dF{mYM_L(V?D2rC7}TjwWm
ztmU=;{|||)=Yrt43I@dsG_F92QKFmS#pR!%1+pH^M?{(rGlA}43sC``>&DT|@M7n$
z|NkREXK#aw7;rrUsUAU9Mdz`A`V1Z+eufu(Zy6YNWPoyh$~@329`Lzge?W(|@G*kU
z4FjnLX?{8VE$9&aogk%#mtI`Dz`$^fA+fVSq}Ra!w5{^f3%iN`|Mxl@yf{+}8uD&_
z;MV+z5p=dHXu))C-T(i)KqpCpIG0;NL$6jUFQ&Bq|G$Exlp`!dQ;478wRo?$4rFJW
z_8Cwgqf#g=!w2NX>^Gq0qA#OCO~fC~516J;e90(0{lIHRR!-KV3=EylDxE*3UwF+Z
zUH|Y1h^x`-><8K?0`9gNUV3pFEXvavECAYU<^bM~#nXDAlmn7+Uz>oJM}a$7prYo*
z>?5H2nVhB4Y#Eq9=Yt#w2+Jq|Ipn}=aB1>#Jp%*7|6+~*#VY@cc_76`#!?}EhI;Tq
zAjncg(5O?li;Bz(KZt2^kU1LAU<+8-93m_O5eAJmfQ1zx!U|y-&xOFTZU>6t<IP7@
z!ZLmf@iTyzrGk&qd~x-`f6%F3h3i414V}L_Z@j3VKJWkkU7$`rX!mC05zwhj;K*}q
z0R_3ri+T|4tn=d7l>h%bZ!{i($L`iCkomsGHz1+TqX8KL!u$*`F1~`L4)r<k)bR$C
zIzTs(AnA{K4N4vLu;elI95{LKZ+B(rbQbA#1}BkMFCJ|D|G%L+je)<#4pa)VsJv*b
z{{J7;ylj5NSjrump()JI@Dd~k-hcy2Ld>uvBvXTwgo>IW{xNO_ry%aoj3|&!PEg_6
z`2jVF961C^6Dpk_AW38an2Vl7y1=5KB+~rM!SH|U|5BdTZ}0@7hL%8L4k0BFPX6r&
z0$ze9%~2wr<%JnU6>7vwv%HXph@-|l%L|S})9c?bO4r{y0ZII!8LL52AoUWQ_(3;9
zfP=1e6R4B~t>Ei*jsPbf&?zei85lZTY`(ZR|2HXp4$5SoD?tI<`~Z^LIl(7+fsPvB
z-|nL#lh)}i1r8=~RsiixWCtY}P)7Pt-~50DMOdWMSp&4I9(24eq?$@={K>#nA`%#y
zQ3rBi<qJrz0F`y1#W0{c5Hu?<1*!u<3~5j$7@Bcj7@VN3K}WzH?|kuM3Fr{mgW!a_
zX7>O8T_Gw0&8JwD`L|sHZC7~_-T421=Sy(Q6x_C+4H~6!Q4x8;wr2W{w~Q+FNsa&i
zcRTC6SUC|bG0&I?YQ2IIGAQvM4()sjKGe*h^VkcsHK0v~C9<6#UT}a8@IL@5WFCWj
zG3_}6Lwv+baTW#!a8Ii9!wVhIsKRkjcbSoefuY--qno`uoTd4Z0)NW~W`<CP9e$v4
z^UVxMPqb8Q*A!6B*an*KN&Nz{`sJ7B3=BI#sz7%GoMvDEUFvAi`Qe3AKgj7UhTl31
zM8MPFxywM2&fnTSef>K|o%%#jZUb#72xVqq=q=_6&jKw70$pOXbI$+&@t}rDt1f6u
zr#B1#c4wu74+QwP2Mcgs=yX)+b`~<c)aj_v8K~3k3_2gd(V#QX<hY{<BZC`cnN;VE
z7dMtdth)m`NgG~m=|e<Yj)4|3cTZpeO>+fncX{}B_?~|uKjHuX=4x#Q{+1QfE8a6|
zhR&W1K2eyzwG_00!rMKI0X*8>`QZiEDF)D?X^@rQ{M&<F4?YrTKE>D>pmE#*bc+^f
z5~%$k14HMhUe_ltrha5#Nc-;k=^rD1Ywz?Q?-}*$J7<Hgow)-#*`PF}+uJk?>hKRQ
z+D<Ys#J3(O<?nVjec{mm|G(k4&SKNo`uy92jZtl31ljWA0L&IPxGg1SuMc%QyT4!p
z=|0)%?f$YGR2aG5ap-it0J@I2Q{l#oTcAe&@zw*S;+;QU-0b`R|G(><Zr3~3&e}!S
zUbaj>@qtk;Y=aj+14F3_<WNb_`Mxi*rv3lF7$giHtFi&51}@N!5UCv=pp+sDnoBzd
zUgZjw69lz@J)bf#yl&bFQeb%LMazllHXj+~*g{Y6Z)=%8J?SH(mN;0gB1mn@69$m4
zzV`nA|59N3;*X56{sJQ4Otl_#Qkv_P<|CjR4@E$?_8jaEz0&#Nh4l3Q|6hX6W$$(t
zdXd@-9?S?9>ULIn5dq>H0Ok1`z0l<9+B@C<6QfxD4R8^}-vY|foyU5e9Ro7_AoiGp
z>^TnE59INu`3O(*&p#!;X^oX4jBF(w-JUGXFIir{ZarCIxhp}0pP}=?i#c!q{}0ai
zz|6pqks^ZHQ=EMR+UGJ|{{MgHA<)prfl9V+(R$FhR(R(}@Q~DtO;i8>kAU@9<DuOq
z2T<BP3Of6v6V%;u(CK7R*);(aMmIoa9R}r{LeTIaBPig{bp8L|Tce@?F2*}=d|nM&
zbpUB<<oy9vTp;C6pu^B^H`b`I)Pn}0`R5$=Hn`n*cooQ|7!?JOmR(XD44@-)Us!^M
z%D=T9DCILeU>TzVI?3SR1G&y);BDs$y`X)eEGjQ<oCM{v5-q5xkBY)B@TNe}iJZS-
z)`HHnZT2-_1nrV=*a2QVR^M=)fuR%Jm*V^Y+QReA)qt@?80-R=0Xu#(FuVrsuT%h)
z_W98D)BLS<pv>r^qR@JvLa+13i{9(tE|>T&0niG+4WIz>c*FoYY4v3Y69WTyTJXjC
z&j0^kPdxZSw)p`Qr>lWs{eRFsKVa)PLB_GDyzqj%7gRR%)~FbO!?L$TMd9<(ZdZeY
z4+K;}OPoNi1#6T7l};=wF9hKlL2G%zV~QZ(l(MFEm#8Qmd?wIY0u5VEPDt3^|5XnQ
zo6U^i19en7TvUWXy(-l-(1Gz?E-I=WE-D;dE-GprE-F%8E-LCBpe}fgibj`<ie`t4
zib$7>ie86{iZtAGX?BR|O}}7<hk<67S0qA&mo0@9;{2`lj12XlQ+%WjykO(sc7T6d
zhziTWM@*a-4nF5fYkbbY!+G4DfB*k37Zr|+51Jpab%m%1A9%&id7=3L6X^ck5EYT;
zNBq4$0^ct`?{ZO*KJbDK<lz#18^$vCEJo0_)BwYiyR0}EKzq50elaja#<d<OVedQ)
zo@(yiqasodDl=qS4wOiMF4;QxT%hqe1A{#SXdXg>^SC?6A;(>%7??m^L~z;y4OBp`
z25{x+3>5&Mx8TqjqT<{gY5;15gU-JB#VGl$`52qwfnLxBK{YDYn#a4uJ484fEI-tI
z=q>@@e96PV<{$UL_wL*~nnd_P+qYR5N?3PPi10In1qNhvL5cvIx1g3q!2c2ziHvC?
z{0uLw?t|)o(4D<9prfN+EC8)}xzTvUVS2<jMpY)`H`D9CG5WKw1F2nhZ~E15jGEEg
z+CXjB<`aw^&YF-!xTNj>f5?f?7y3aKfQv~LP^$e6O0|FPF)+MVgPr(nehAdQoX{De
z1DXqekpezLxkRw@!;AOr(<8q#O4qN0OjC$-9`5|`A{sP)cc}A5bll4e|Nj4vjyoI{
z9Ml`Z0<L;bfKG`&2D%KR^Tvz3mjC|)Kz)adn;_@zzYD5AK&>CpkWJjnN&g_t<mNXj
zkfXWJzWDVCl*9O2o`4rV)-fG?&Iy{o3Q2<`s8ar2ET9<)(BR6;`Jlx)$4WRs=Tf|w
z*!cf{gDvD<ai8gGKNuAS__u{I9el*u3%SHV`|$LDAB@`d0{q)~RG=3Rz3BMMz`(yP
zn(5$U(5am3Qb8q5so1UpkR71%54M1>;w}Tj!Uw&4481MPpxf(JLC10|1_?k_fD6*j
zqoBjg4R3ee>U{Cybt=TkC0Z|3+d<}*ylDMaA~gNy4@U9&ZU6rNe|;R(r~zwiexn1v
z5tgO%JpXnF=+@Q@by0qXEWzFq745JW*FYNsKfIXJ1m2?!-j;Nrg#E>?w*UWMD>mC+
z0gcz!3-Y&KVqgGWjKjjn-*Ox@MsVZBj(H%<`CE2?*4Oib4j%6GsaN6I`{@}!Lt1B!
z3K#$OtBt1^7#KcuhNuYeZ!eHyJl1HZ5|9^A!escZ^?!*-?*s;hFaJTu1;|`K?s6T}
zkYV88E(}^e2|Cr{#Vhc|Hz6uq5M!)GL6-1OJp{UC6?CT^=!k+--7G5HE-EbiQx3MA
zDlsu=1s(VyQlb&u{NMxs_Amj)3jrAxqWlamd~bs~1G*q1(vGvHfsXe00IC>|=uEf$
z1zN!lQY3gAw8tJ)!(8fZ{qX1i{};dZF)(zSKIr9RfYhdtlUqtahyAM5r`a+vmxwl3
z%P^Gk_x6I+gOh6RKiF>G*Oy_!I~IV<=LFs0a^OWp^8f$VU_<$v^BKX7h5E1WK?$^!
zqwyH%0QT1pyWE&MTA%*`&9BBuF@Em+e(*g@=Z{8fPym)nA8&p0=RasAF2lhG0-dcd
zK*zP;=5JjF8l^hf`3dTH-DjW*``~kd&Y#UEnHPd4r$G14bsoy75anms0h%Ux@weyy
z|EQPeL90ID`o28{>EqvCEx^CsTWUvvC_h75>;DqY&JU^|{_`_1{^;HdvXS#=w=HOn
z3vA}E0LbaE>v}+IZ9&4IIkE`;?a^#$t+z{x7(f39yBX?(q;4>;*W-U$bF~yhX?=5A
zbF~;li8tI4MaYg2+W~ShE=RyU_A3D5DXpIW|6jN8ZvzM5!3UhI@Vv!%>}Bh}|No&)
zsowM-@t}q2$2wgPg08*-AJ?1O2};=AA}XbPoga7n>E&aHi+dT+`Tsw3IeJ*<u^p*m
z{0uL`>OnaXR3z;v1M$o2r_cYxD8*;n1zvjvZe5BrO+WsJQC&N@2^5oT-8?G0{(#y#
zs%se-!n(mzng?HSfr@F4j1G_?u{Wkm{$-SgoE$u%17rjEyn7MQrW?>z&X9WxF5dvH
z0?1+t4S%t<9c*;x&0R4dleev5U<m8{(fNvh%>|KzuS9|Zf-??*On!GATmeMDO9#*y
z;@7(wx-&TVxA`jU038H%`9UX(3g`-edWOpnIuCY>sDN+qc)<a32&hdgvdafl*f)TN
zeFJVVFuVlK!gceg7+!kOwHs9Cfed0`V7UB%@dN)hZ;8%R-8{V-U3?4&ABr4&F3owK
z+oIE=o4eZ+G+z?X@Qblrr#l#Yl|dj&cMwlQr36zcUpJ46nd8BS9Gs^(12|subo<(L
zi(Kpu;^++EFuc^w-JQwO?akrX`nH7U;3Jmihy0wUI$ytj&UwAlVtV2~MzQ+FHy1!5
zv1%oFvY!XkH9QQeof4M*|NmmjN>E0F6k`h?c!3Tu11%4W3F-||i3sZTQ3(N`f5EX9
zybK@!zU5oF<NyD~Eq#2DMY~)X+~WKUFG1rg0U1W({0uJ|uYs;S2PvrU_E8DRtWgPI
z6kuRrydM|adC&5D318<2!%O@IjmJQuuit^KcIXXJLAQ9q8U}{mW(839bczaSq8qXm
z=HmYg-7YEtLHye<1RZ=K5RefLvXu84C{86_2!MwDK=H$sktbfy&+vlr0s}*LhCoIW
zNY#t0pgG<D)^#GqKHV{U89;f^GpJOc*%q|nj-gZxwEKA9|No8F@xB4^rR<$IUi{kk
z|9`VBXsaCqm@ff3GW5m^QwTL>-~a#auh;Kzb94@Pu@E$<bPN>8Ta_6Yx*dGPyW<>M
z50rq;YkP5V`v3o}w@cVMWuJsjpDE6yQh&yWpP~6!3HZ!`&r27b@Zo1@JOYX@P`Z5C
zdGY^$=(3337?l|QmUE!Hapv^#F*x*2Q2{Ly4hrt|QHkjdQ3-kBxf(pP5)vD=f}@mg
zA862S1!F1K%UKKz4Eq>;!@R*09J>@iv#6kTJuk#tLF@dEFP_oI2R{yO)eZ)Ruz-v?
zpnzHong{vOe1g&NQs+m0gKl1s!sa79-yCHbOFa0u7fS75V0gi7c<K8${(XTmofkWg
zU4GYcsgmvc&C3rukA-FI0+|vEnr?}QpUo_gc?{HF*mVOW=U6}O|Nj@oOaA}gC0xkB
zu%oSkf#F48Jg6zP%UlR1P#gdMKlH$Tja?F&FyS<ax&v^5P>4EF(7EaS+r>IXpLl|<
znPXV|z>}W=Tz9?rRtM@#8lK$o5M+IF6{yU*2tDYEr}NMbD^O19hA9HCDYCBuIcKqo
zH$TIRvP+<KJqIk06|+JF6hARAG}?mXKxd5dx8Gp~&FdfN=3`I^@C@1oilH4K-ix|z
zpc(7?-FytNWX1)OsAqW5vitx49iYzJi?SBbNIJNDn*v&54T`B3moGCgylexVNC4d*
z%)Om~;W$Hpvv0sL2R4@D4jiESo{u~51Um<W_Bsgc`zg-P08UPw$3HJU?yADT@Zeu?
zuZv1V04z5{x~Ot185km_w<$5%)pxL{^tys4^9;Xr9=0|G`KQ<qyv7w=g(qwSO&KwC
ze&}#!>|#;raAxWR?Hzg{mI$gDLHA4?xcH#;693dgoEJKrnY&$7JRn!K#B@4yG#?gW
z{P%iQ=Y7yHwdV1I|CuuXpFMNtOy|93ThQ@u3?%|8y~P~Rac|K5+*_wdC^N}RT-wUO
zaEy&n^Txp+pf&6QT`npD9WE*g)4P?KB<mM$Wneh&#=*oO$avh12XxX;uR9ay9P{2d
z0dV7_`2}d>C}>@e1Or3!$^XqZDu4J}u7H|rJ}M@ljid~qo*7Hp!519-t$RQ%;q5gl
zERe%Ze!S3I4jP?Q;Q;NCa#7KN9BK07g*ZgmpdNfiS+|dhNl6K)!_)Zu$A1O}%k!lI
z;2sZX@|1t^g`$Yp>`)hg108he?d1n)oGvO72>;&L!oYBxnVA7}d?pKMnIy<b%m*JZ
zfmHVf{s)CA>oI3GPzTST!<oJLFh}Rl5ReBPSRkH!3EEW+u6e;L=X60cX)G#+khOB)
z7%bhwz_3GskAZ=I@sA=CkZs^jszQe|ODAZ9CCK;==joqRn6w!Mrpu`^Y1e~p?O{Be
z))}jm))~su`QnA(W(EcgS9b9J5yMNpE#UI!#l_7G496jCP;uG027DK9+VK`}Y0U`P
zRQuxUCI$wL7L_j0vOS367ms%Q|KIuIMRMi;|2x<u_!(aO22CU#-XRZSzb^&l%ww&$
z`CCA%utCLX8EC+(8`LFf{wdGj4mtuKS_XFB_&*s`H9#5=%|GP%Td#xekJ$ruA!sW!
zf2%G?cZ<plQ1rW~#DLGHO5oq#qB0F464KkE0y<+YptnT@w2CS~3|g+Hbbfg8VaNaf
zaiFtOT0Tv;Rb!H>zXEE0ID$@2_;rqf;U#FJT;~+9;c1-^Bf-P5urNBh5$t=A+xfRm
zQ2~umHNO(*ZBYTO@p`cwB0Ci+Y}mH{|NpX{n}MPEheT--cx%Bf&_-*hf%Px;E&^5C
zr5>Ouyxtxa(3u&%5C?RAc%irB|9{XhWQhrQ<ttRv3kQfjAlqR=tRQ<NxEUBSEI^_D
z^DF~H1f(pI1%<zh3J16}Y5<i+93by@g1q~@o(t45XaKdjx<Qw}?A^$~0KSOPr?W&Q
z1SHhyq7uXU2Q((aq5`^r5?=VE7#?^Lbp+hK;)#z14Pmu`VkSl<rZ-yxvW>X&CFJm(
z7l%P*b@LC#5`{7r#-pzVjyp>@<tJyP9j|v~DQ4)+mfOS#IwuA+TGkQF()kiRlxuk4
z#Rj-W#s4lUEM1_HgddDhGh7)UW`K-nKFZb+4BcGZ`4W6qso{Yag?O~@%ah<|*a?am
zhR*k&mvsK^2!`x8F6Qd|xQh$a;W+TZ@Gz*!Tq*?1;vZhj+W^^v3|qcyc;E#OL=kAA
zu@D1GueS(zD$nr1i_eF^x>=4ni!k<ji|!JI7<vaTEXq*d>n*lR3?hCME-v=J*IRs-
zI7E0ITv+`7F<0=yOcsU`X4lv3$6Og1nvXL5cTw@_e4%;6(nTetn5EN2C8RS)CFZ}0
z3UXDE0xq>)tT_a#0wbeA(FHmsWV)^<la!nJAz1v#ma#A%el2j^T^bU$&Y<XtSKP!1
z9y;p?XX(5NjvI(+{}00SNxOA^n*LCoNpkuMO(y>OlQ4-gR>s3_ou4|w**b4R7Mp|O
z_{B;LdG_9X4rs(d%x*gf4m>_+A=UZf#piVl488sm;G6(alLS%2a?D)<WIpJuc(8==
z3r`FSBs*_{j~NFmc%g|QKfO?kNkbVU)IeKmUZ@-d%_&DjfldwCK7EfClWhI^12C_H
zg6tS5NsB;&%ncM|#ZsFX_k+CJ5zGQ#hz~Za>;TwbEXSN#89P6MFG$$|mWYL!SjNhD
z%pJ6ClCAS2B+S6_w#f1UU<K@*AHhi-Vt_2N0<b(suQw<7oM(uFKj2-Qpq2NW%<%Q_
zV6z|XpT0qxNy6*|Tm?6CuQw0)WK4+Ob#NITre1Ge$dYTY-YNU1|I=oYG^>QGKw8%i
zRuK=E5n_O^Z3oM^?w{_f!(>qpYNiyqVFW&CF~$q4{g5KNRJprEB?f#F^pT_g|ASNg
zA<a*gA>dRGI)}|gCC2&nrf%@k;coB&z09Vdi)ov$Gw`qZCvxyT=$Jf~&JV1hLkbW6
z;OjgJwXq)7ph|&U4RvB4WVV^VbvkGeC`KjbII{phgFvr03%Edos0!Z)i%F!-7NB|e
z7q)O2R_0!BHb^9cWt8DEY;2$briR9U|NqO&GL*A|PJ-s@bY@RG?#%t~e_CfYZ`yHZ
ze$bNj>G^t0qV+K<F^1nPzt$!7y8hn{I=<TSLn$AqA=Vr5zwt51N6t{+AUp%wfAHe%
z-v8h!yHeHe8kHE(!6cnOUQ7m^2nZ@S4r%^E4MDfpvoOpNW?&Ftc(HUZq%taX0bLY4
z-Cd8#DI2s_n*nhOaxpfo3@`Nef<`@C50nNk1TE`^9B~Nk#&?IP#2jZ5=4TW>?!*GR
zQ{~_TF4q75?HM|qIF38<FbFU*9CH$2Xg&lE2K5juB^ziq`o*3-P}g~bU1y-r<f#F1
zoe}hm=2A@z*MZyR_Isu;)MwH*WI=>v>$g%a@Y%};Ux;WP#?S_~@bT{HfAyIfMW(D^
zK<q978_2wS`XmD;EnRed;PrgGyTNH!BsQY4Mui8o2($Ehvu#e_^p^%q=Jh!$F`!CU
z^Jq7y7zf`v>jN4O=HGr4bWBoO<KGCTa`qRFrT_oG<^bL05CU#$f$R1VP~8q%S^FaS
z2m`}QQ1a?L4jNkL-+uP<lAZFP>IB}{>s*d#>;?PAgIam53=H)Q@=V8CRN6ty#kyHk
zKusV}bL=>zeG~8E>v^mN+(d~_>s$kAaLoZXmOu#+q#D%lI@Y2xkAZ<f1*PHSvJBpE
z0<RE(HJNlE;?O2jJ*b=YqI>oK|DaHKu_Fh(i!uhX^gk5jRq$CY{4IW<8F3et7|`Og
z<_GniE-C^gBD-urA#e-S@q2cNf#D@+;0I*R!58ekEJwkG$<1Qe5EfMRBamv-!wd{B
zKQS{f)OUj#+np95@APJ{>;N764C)hT{s7G^fp$7DzOV$H_u97!G{NNhr}+mne+y{f
zyIdI5ypd`C!NlKklYxQZWhZEZ{0|oXmg}HxnAITVEGpd+-L)3I?*ChV@VA1t;dZ&&
z*f5sx?E~$zv0*CViU*%Lw+}R%+fZxHz~2fAkIok_f;0aA2OR(<bF<T#1=NJr0hu=e
z)C_IC#NQ&v%)rq3v-!V3F)O&b?ELV8y$Dp%gQlu?senQy9OS0<=>f(}O7-s9|Np<{
z?JNdu?flR1@(2?H14K~@NYMt+oLg;y;kV8$;8u6%7H~fRbYA?67iobYV|!gKK&vYw
z13?8~iAC$T5|eH}(7=~&cLeBeU^V`2t|gs^Kq;2-N0CIgnPnTusYQIfPXBG#>&w}D
zo&L98DB<750dg8>xb~$rXk3WJ64np6-gyjk&im&jjB~(_Xr2Og1Ow>ECWypKK9D<O
zExJo>x?LSWRzX~NGyv=<weA3x)=MSw-3*ZPek>0c3wPJ3@ED$CtpCnG>7eD0B9Mdm
zcfA4aiUf5gUV>J$FkbFuG3pLc;dxQBn1Mlq`Q=Jbo7S}eY`$v=X#UUeb|=J5opZo$
z>U{BH7I?M=8Y-><;I8y-{+2k<X*~z{Tf#tQIDq5Ln~{N`o_||uMdwG5YZ$-tH(4?=
zFj(#eg%5udxNjo_Iy%*Q7g(fO8nkmY?0>^AcK&vL2)p$Ye=BIE5onb!;|0S@ose!=
zCnSg(esYwk_VRoMO$6|-y>R&z<hJn(phY$Ot)N|{^`OSz5zxv?ThOsI3?)2`yFt19
zZ!#}KiO8-VP><*tXjrj(KLf+d+2HQ<WKd5k40OO!ZwuJhFY5M#Mnyv_A}tS<R_y?_
zRbOl=03{Ca%-I=GsDf5+zBs&}f#G#VH^hzIAUA^g5^SAeEJ(Hr?<xV=$_(n5i0x+p
zoubB`*4+%UG_BJOG{4Bx>BiCJTG8Rg*Xzc=>kjBFr4Hx+|6lX(0$X(!l#TD~V_;~0
z+W<bC7&I-N0?IX@V<)3C{{Me12+Gti0y6&BgRWl?0IlcT{~(l~VfTAqeun19A3Fav
zKl@;LuSlXZMunsEm*%a`8!wz9L5Zo7yZNxd>nGs3PSB<^j>VwyLr^vZMdyoIyZ-;*
zRVl&GV0hq#9{5-hkW>H<14DPQ0_b!l&<&m4)u85h45$ZH9}oaK$f5JYi?Znd|06+N
zr;hK4E+a@uL;z&m2Xq!gVD$h0khQ>|xvK6G6`$@J70|$X#QzeNi14spXO4i3CQzqu
z<zDchY4d-EGS2X@jLj1K46lVcKXtR&mSq-|l!%0fWn7Q|EfZ`6E980E1Zv&*vGh9r
z2kqAs0v$^G8Dvl*SYF_DYIh#Tj$dN@49$O~$_2Vv)+#jcF@Uc20t<o;o#W<b@GNCN
z&Z5F3&d&f^5AokbB_K3BEJI3?pW%fh*c^%Gzf7Pt(<MC3e>qA8chp-O@G-n*-C=c}
zm*GWEE;R5uZ@fGRI=!GqMS!7{f7b#~dH}7Me!;bu0WwDg8X<8};Q<|z{fEEhGZ$#5
z5h$zfZ~$F#VD16#ib}K|DB%Px;Ocf@d3_e7mVv+JI2QxM4$$Q`FU0cx|E~uv)&Q;B
zh8*eoBNsFm0lMH1d=aSJt`DF>sT!1^c=v*P!zQ4E3&4vKUdO>!ZCft@jorC9ItL$j
zU;!Dn6J$Op)hR9j&*^tYs2JYvjL-ld2FA0a0p!Lh?*ISqECEeP?E;N3gH(HmgO?H>
zcToYI@5%tp%L_pbVo<$r3mS|p;{bJzL9A>S6_!L$WyiXM9Xto1@xl${e9$>*QoEjj
z9PS3nxuJU)7`k&*6bui%yaFm%LsVjRIDuk>3FLp!e1CI|N(@^GORtMc$i5ayeukZ(
z-XN$W+)%;HP{DG{wI-s=fu-d@1?MsFRdo@s`I{fqceH{g20B_nqa6!D*HU!4>K}Kt
z{QrOdzlESfkh?`e=VU`iVU3QtIx}{<`gVo}cAJ9EKJK;!oqgO{|FQFT^TGekm;ZPA
z#&yOfX&#fj-dUR8SzG*?<(R8819<o=1mxPfM9}$Mt)M~lW33<u3Ur642s9oFWn*CI
zym0UbPe*GiXqxc?=&=9R6h;Pyjtk8X_?u5ObhIXe3d`0kkhF`6!12~JMh1rXV5fM)
z+x4A?EMrty>I`>+I^><#_Z{isWB9zZ^Txp+EH55<{{P?M#MXJ^#dR=?y(5aFBTA(C
zP>A#Elc3-a0nO4f9`F2-#gvgH$q(8J$zynOS1QQ8TRcHU|8WKm=K%k-;|?r-pzR6*
z%?Fq}4<7u<(&5Dpc3izfhZ9?G5hr*Q)QO|{2#?`yu!96UZ@k#%0V;9$r@BaSI=_Ai
zDzbWI*p4v^^oFo8YQ6%E<Y`{$Jaq6EPe(8_h-T>sW&)eq(BaJ3>&yX4G{>D;0-QY!
zcJZwH|NkvyKe`I&j3vkc8(sB2Dgu`ubl0fpC?4;uQPJ2}(8I^DQyo+m)Tpq02A!2A
z01Ap59{>M?8b2NGETH9?FHU&;|KH)x3U;<TZ-={BZ@CnB8P2YJNzjI=7YlkpLs=#K
zyKaCIq9G_DhU^3nSZFYmvK?o0^)iTWc2TKkQUC9v0y+;vK!LwC>;M1%z0C(%7#Ok`
zGb$zd8DIw%mw-Yv)#Lwv%@>^qcLfK#gmk`mp%eldY6Q8xH=nWj2v2v7ib7}09#At0
zoM(DXj@|<e1Acg6k_F1v;PV5|fSd!W$6h$^WMJs5fA{h)NX<vXOD}5XFfbf<0FSI6
zchCTJ*t@}F=9bq=G>^Gl)?qm2a#@$7BjmDPN62M;{%wa|NVr2H2y{(Er^{snr`MNz
zYd-6w9cO3cIp)s9aNL~*G=yz<veTcVx10x@n89PY+v5KJ2j`6X10@<exxlUQ&JQns
z&jy_X<j%vyb<CZg;kdg1XoEu9ad#00hTd{9@E8JYxVKmZq3sA*8ygc>=Z_9I=FU2n
zwBv3ZybR69xZIon3zVKY&c?#_pCRqI8w&$tuOFM{&0UTGp3a>&UOWn_|Np<Yl(BQp
z8gQsFFkJX|@P$CPC=0`df1r}V_WyqdhEk5s5)}=@+piOPo&MYYfAE#H{M`-<P?>l?
z0~)S^yAFWDbtfpA-)(1LczqUn1K11A+2BBBT-4TZ+(8Fq0q9;+1F-ZikAQmDkQZ@5
z|Nr;8F@i?<JLhZxIixp4#b*b24|hf;xFpvB%^^bedxwEUz%z00nZW5uhk?K438?*7
zqY`uQJ#)8<iVx@-MHdx=-f(8n-01<P>;oE%7eHqyz0d=>7~F3t71_0=k*}U%$8(UQ
zt+z8Uyqpg*#Rqg6KPa!gD3}GFd1E>506uc1H^LIMq}cL!o#!#<?+nMBe}LvLBs!db
zfrPtRj&(Ty1lQEyp?Tw3ps~UK44_5F5-&cxASD#%-~T}yzz++&Uf)^&<KP1p&|;9@
z7)FC$mVcctDlTcqnHe>DoteP-$?(#Pmoq^|F)<u>2A#skVEDE(o1-(E=eV-~0|OU>
z;ek$Pk><l1`#}A2Lr`<Z1eA2aTUtQp-CO3U81VP_ftsBmFaC79ya07y1Uf-$!~Qas
z*7G*HfKH|O@V_}kMFiB-0u`$w;8X5hR3th>RAj(?U&BkFPETiuib}8R{|*-wdrR<W
zO1F!OisTRerlp_)!$n2H(nUo9Bqr^mBE#R@4-o|&s-&X%LGl-<vI1KS+In3Ix(`O6
zo}t9G*IA>}MaAL2i;4-l*FVevPiWY8I5R<g-&xGjSq*9gg5BBaEYKMYx{|;F90wsP
zGTJUG3eq7eDlog8K+SZJHw?dl^ADO0^)LE}vZDF02FQJ`-6blZm2fgIm;3`4hz7kT
zKbj9Sb-Sn-I9R%<nA95|bN<J8%=y0tH1;}gywI7!z;KKibX8BaRA)6?XEj%6HD717
z5XiuK&>8)Qx_wkEb_EAHf(F@HUWE9A7Nos65ex45y1dvAVX$=9sA%-YGlH-G(0Q>k
z7OZL!NHRu6!|(t|8e05;+B|8E6+#l4r3pL0r={6|7F2=e&ZTxO0p(Os7wd)h7KVBT
z!;_sob3mEywb@RPQo~CxYNvzpENEhK130rDcL1Gm{U0p7%h%b>{lzA~|NlF;fVDY;
zCdGEtfePqFHsH+4(R!dHAJWr$aWn<q4fq4Hw*u6vzp|Nu;q?hnZ@jx6d=ORVr~eZ`
zy^iJ|DrFlR?OcLgLP~|etuPVDWu8)XpfL`Zjm^JBO1pM}&1(ah*SeX30jxR-blPx*
z219A!4pTt}h8G?n+d=Ii9*AntaY(O&_dS#1XV?i+(0RQ6^ODX(ptje}TKLKJoiAS0
zPGf+m*adRSi=)2(|M%+51)mW9;>G7=XsIU&F?AjjXm=8*VFI4r|FMaIq4TBTr56^{
zKzsaEdVTNoLVM50KQHNgxhn`%ecgCb;QRmo&U%oUhL?I>RAOFmPGev=?xGSC6zrmK
z+(jiJAS4Jxr-EjJLDP+y!3v!*Dmma8g%@m785lHNR8nB;7dXL2*v$fMH-I?>x;)MR
z)D8e2f5QOUp2?!p<se|g%-=GTg@GZ=hK0Z7JsSgq4O8a@{+2#aaMqgt|KIwbzvVF-
z14CClbMs^7hTqKmtydWt7`npQKt*GhgTxE(P;g|6fO^BtKe*~Z?NT04O_tVO&NBVu
zKSrhcrX)~6f!Yh8-R&hH9%#H|`!P_S1POz36aV^SFCsxwN1H(hx$#dq(0ZGH3gmX}
zx25vCTtJ5{f{L^kts6lbR$t7F0_O{km!Pz?6Lc~kxWL^o1-v~0d_NXT=Z6=^&FcUE
z=ilZmc<=!`|F&Qu&I_QOi=EXhoz)!OHY(lWB59q$5)IYDjFSIBi&`1}G#+PQXprgl
zQIY5k{D1I~D5$hM_yE+30&hBLJ|NHuYDS+leA}6$0=m&hz^gMvMaR-dMWDnLlnX3<
zRCG$1IuCUQeCVwB(p?{-qSBqC!ovBgJ4Z!>^HuYy%+7!x-61LpodJIuOH^1G7&sUl
zn-73WG6}{I6@}MZ!PCDo&EWD;rJJGo!G~^vPT|g5&8L_;1-flitlcH}Tk|;?7&_x6
zUZ#UqDf_7Kc!Kx(U4GQfGoh2a`7~3f%!KY56&c3*UyZ;1Gcz#My?<%T3F@F<1|{^#
zrjQ(2A^-`h7Yj}Q|9>gN$-uA!6qYTwOW9w{P5>Vud^7>Na)EzW3@8>_K%-ZhtPBj$
zP=8@RnSr6VfCpkw=Z6<zrvLvRcVz+9Kiw=U_1z94X`Qa1`$)PSB)SDULm4_>fql|)
zo4<86Wc_+)hQ!MS91ILE-kU&DT`1`0Qbei?Moo2lgTSc{boUKM^AA>Vs^b7{`AqB1
zXW0R=7&N_p`2i?})i)o=z5D`n!y0HvNC0wF`)Ba-5>Vnh_y9CNrtsn+NaQeNP*nsZ
z0lMXefBnH1CqNQM!RsK9lcXr<g3bugKA#uDAnL_S2X+S7xl^F6I+H*HaNQv)^(-%b
zoBaRZsP-Rpzi}R@Vif3fQ|XM;=!^pm9Vqm=Fn{QDV`)At04}{ndj0<&cmBY@An>6x
z`%7o^k6sbY&fq@|-8CvAjDMRC3xHzP@<+{Wa4He$4v+wMX-fsVnYsgbI>UH63wU0F
z4pZ&+QQ`31!3gSGUVhNc)70t5(`nKK8cAaO(fmWc?i0AP&%X_v9@>qe=|Q;H;R7Tl
zU$~n5|NoMgoq+)yX5b{z69-NbpoVKFs2<_p^#*kG=L%4g04=bGp1bwJU?SA_EHCQ+
z8-x3^-3}rxw@W#C0~A2_ak2FVXmmShbh`0$8Z{pic)1+he|z!82on8KOelrUa@6QQ
z1R76sQ4s(S^+F3B4p5=Pzug@an<B_bV0tk#lQ=tgP1KW^=@Xfm#OuMFV=<s)4H|$4
z-5|uj{xGO%^I|usK0OSH?YFQ3=ys{ft{EVIP60I%U#$TzWBmsz`Ch#E4x(<nQ~~7&
z(4s`}bu9uD7(kc#%5=VX!3tr5PG9)d4+)fd6;R2f3JUQ&kIp=o&N!dWJn*GPkWCB!
z>v<b^!F_p|USEgK7|@-YprJv3&?X4W5EY&}litV!o$o<|&z6Tum^#mQS|4|Y<Tude
zV$Pss#nS1_<J5c*)FKjLbWve>eGHslB)S7c1e?JlDqP)6%?}>D+{nPdFnuEnlVm+4
zY1o1bix1#SxS)x{!VsD`Bzhe-KoduZ(f|L3Cp-O4yaY9Ic7mD?;6<6>MU*YKOIUY+
zL)kwXqP3KN*9K4sJ_Mx{(9V*bkidFzr4JG)DlGLc7>)k_Kkf!PpMl}H8@PK4cC$>k
zK&Ke!lmVtrf#zcYFFjcp7+O!3@^xN#G06b5;p(M1sI+ioZhio|>{_7p5`SwSGXq1H
zBNKQ*A?Q$-&cn@*`5A8?c)`xU?EvH925<-n?y>>hstTHMd2uDW{{R2iB0E7Gh%ngw
z6QjT-4F|YZDiz$-09q1yjhTVr#g$bI46j>uf=n>H1Zu^+;O+zW6gYY}fCg?L;RM?7
zWB{qDI%j~+Vm;mf+5-zJqCjq72Hkbn0P1DFNT`qg{~wfRI~zguT<d{S35abELAIr@
zf|&hsEok=-=pIIv7kfYp+Few@i$1GBduKqVcHF%Dp!ozNC{06_X>oLe?d{EG>}FBn
z-{zrk`RT!@tf00b<57qcBp~&9JqxHpH}?e{@y85WYwZf|wg?=2z|8H+(&@_5P|w6r
z!4A^HP|DVPLZQ<YGz!4Mza8v>&O-+u32=sjYD5mu-nvkZPFGN(X7T24T>$ELSaiFC
z2fRURRJ!9ix-(e1eR;ZrZMsEHbqDbrd?ha3{EN9H8(fXOcys|YZUP!LT{Jy_ok^_z
zLL=x-6qas(nS&1{I6Xjm4?dJ=IBNhJV(h%}Vgl&A!^5Cv$qSF5|NonRGnNPhXB0H^
zF=R;V@H4yw?S_B`zz)#4dEm-{rSs5>^O2zD33$2;9J#D43=A(`tzcky35uwl3@YH2
zF!d}dFZ8DV|L;-i15T3;-8*<d14*E(OF$hraO2}&H+Y<{+rg%n<puOGeQ=}Vf9KDJ
zv!FZ2ctCaUvnl^UqpKywuVphpR%Y1g@H4zPwjA89=?Mf)G{2n7z`zgykqrmQ)~{I3
zz|eS}K?9Uq!0C<W#e9%CM|eQ9OrlV=)gZOC%Rz&_Jg;NHF10bd)G6|!^TrF~!2kbW
zdxBDG=L*oK$JZvHJ48G{y(o^(4v+{WKtThjAZI#&jQ_z{!V5CHo{u48x(+|X>qVfH
z1D;6)nbh3?N~<q!20)Vdiwh72&x_*$|Np;?1h46j0&N5Wm3SPw|NnQ}LDEk>|8_Ty
zG|R&!WdXq%6F{-FALR7I%b+LcgUaO>7tVpA26VFPf%+1^;|`E*6Wjb1z{9kcAMkGv
z;{YYP5N4KcKOV5_O~4o5w@-$Iuy6px?AIW(GnRparSrxMZBYI3q4|gbsHJ|m^P=IU
zm))Sfx0g!T4Ntyo`11chw9PEC3pD>_cyfn`fG$77i{n23|1W;f2i_nt-H?k(t$rS8
zNa<MXff9p&;0z6rn#W7Q(fGv|+%MY#I_Tn1^AR4<#VMT;96Q8k@-n;#34`yNn7d1W
z7c{x?f^{CKI%+*o64ULf(0ZW6r#n=o*GGjX5Ol_ApyA0E9L|v0><Xjq7!?*sd1S91
zoZ$kpH4kE|8`wI~YPJ&I&IlfeZO=ph{|DRB`Qr6V@aoClh(FDsJ9&3am*Zv<_Xe$K
z0ME>J-gvPWKCS|qgM)Mwc7S>(FEqpcgRY`JP%60V3aBIp59Uo@%E0hCY9~km=nRIA
z>6P3}vX0+aR2WNGLA8Uxf7UyFd<<d18POnT&R+r!oDDwz|9Ae{Az8!A@Io;ZbUY9b
z=<c@HEH7>UgRg>{evO++uin@XwA%ki8mJf22U^&y02*yd0#&%6wuj)Z22gVpbY%aF
z3riRnUgz!vDKNbBg1du(p)-Qxn1cXgT4#kwcyLBF$o8L$!M1bxfQ)6{$<WWhu<HQG
z$a5784BcTO;Dbuj-a~eOy_l)Xz|id{VtAl8kR|PX=c%;!ou78hE8%5$;U0qQWY7Ul
z3ln;$Z{T6l3X%a0EFEt>P?Ea?bawcQNua?=h+}m?juizpAQ(W7^#LCoV|eL>bvw+l
zOc1xu1i4iU;#O<#={mejl3Ewbco|;I2u8Ly@;_+VI_Owdh7$i>%%Gh-2VPjso}SOk
zB%{)NfEAQ@3@^R7Ve|h#q`nt{v=ezVc7iNeuxR>vkje6P|NrmOz5-fHeF?JpXb1Qr
zGIl%AYNj3XYj_!6d<**je@D&qPrOX(AuK93{AK*0Q)gKCw_P$k@M816|Npy0R2m-f
zm+<m$y991}y_mP}|NmX#?~zRfoz3!Mf-Pu0H0X4m&gl#ci$Uknfx<46k4d`TeDeSQ
z86}`?xuCO!!N;kC>jJ|AFJwUZ`G~-4X~Zqo3Eg}QFQh>w3iz_&*H4eJmVt&@cS)l7
z1#}AK3szfjs^Vklt@zXY{||r5S4Plf)b%24jQp+l7#SEE>ctrA`CG4mVn;s=JV@68
zI#PZYC}DU0cyR?fZo=QP5!7G+FZSpF^+7<VFp2C60G%Gx1?n_!S;)ZfvKLe_SacR}
z@NZ`aFD-s?xr~9K!<hwiR@nbyj_{0|pcuHe0DPw7bI_Q&Ge>v50}JTj%LdRM5hs>z
zXO3=$PG=qv?ZDINEYN&J!0-TQ#|o&D@8VIp{6N`RfWHNlpmz9x67dP}JUn<O4iCsZ
z@t{4M8L%6_Qd_`PQ>U9vXPnM1Pz4CC1z+fcZo6?a*u?<qCqS+*lm!c!fX_LHh;V~M
z4t2U&bi08LwB>59GhrxUX}we`vI}fgCMeu?FJNGJ30fwy6J)yKr5B%@K_>^BfLl~A
zo`E?Q5Y9~y$C=}QnF08iAC?!r&7g%AAQ2Prx=K(t`bA|k=*qq3Y95A4jc#WS=rwDg
zX~P$B5CgIpc7oC>ShaUE=v0c%Pdn6f`50aZ1^oa2pGBqFMn!?Y^)zUZuAZg&J<Cfb
z(5|%Gov(JV=<zeWSg!#sbNM?D?Wixk$II~ImjD0%&adyc-Y(HFytIQKq^b*~3bcQ_
z1$4|~_YTl3{4UT1Uf{vi*A_@cYRPHPU6iaGr9utWVvOZHows)QfJ|-ihZp!aU7HVa
zHUH%-apvFd#KXVci;I8#LH_MteD(b64<3BLX?eW#9{3*I&R^iB^b1bVIN&kR1U)A+
z1H&#BP}!>mig4fg3=A)1K%-E{ke%R@)>tj@MXJ;$t=m~B&DKevge}dMQJ_?(^Fzyl
z5~<D`FOIGPrSMAr;0#xg|AOZ+Fhs_`t_Qic{30*IiyMA$*RFrD2Q(;y&jJsy1uV!G
zq{1zz09o*PE+}eVgUk;y<YRbIfn+|y<@J9`WE-mm7zBhEN<m8Z*z+;G@IxrQhfoSp
zsU)DF09LtQpO4{%3J#Ug-Od7Owi;kZG6<BqfJ3GEM@_kETJw+ia)I7}rD@*}{rz8(
zAeYwsL-e&+^NWOCj0{}D{EH72i@)Y<e(*QVR*(g3(Q-FFh8KH$;i0nt-AQXj53qw(
zo_6MAcrgi~66E;ln}wM)MXosVF}w&x$eae1e;<UIq}k_R;bnNC<~v<Tgvp2T_VjoW
zCW(4*|Ap~1|MtTH8EZgcDLIFMVW9vE14EkXfBS=v`8aQ+Ee3H7FYN#wKKi284Af-e
z-*#cg4^VlOX9hZ~kbm1{$Ugpf1Q#S50O5iRKL9d(&upmS4NpEEe9XytWBN}KCgJ*U
z&~~mDhTi}GgSH977UY8)HT)e9KnF#=0^RY{0BIlax19a+|9@{b%P|Inu+R)CkilWI
zL8}(|f-@}iz=uPauLQZ$@KWcC7aE|mQVuP=&<nciLjt_N@=$Q+Pe?WL$M^sL*!q{X
ze;}Kj8{ez|&yjUpc*gte)`kPmu60~^cI5?gEd#?b)`PzM42%$MTvMT~NW+smu7m6^
zcl`f<(E(q6hO}m0P-rpjGC`>&Kn3p$AG81eU#vg;|37RyQ;F{elV{F`^#`6gJagF8
z)p6lj!3MQwg&VrT$EH4DY(ByCtZ+jQh_|5^M1oX2DQr2w-)Re~CP2p?y#ROm55H6b
zU3_!0(?<n#4Kz<cZ;T2LXmc0nyaW!z121|DKnHPwN3W%NT~ssz;F3ESL3_Pk<Q9PP
z&^H$q4FUd^^yzCXm~`r2JWK5Spm{>_R_3Xh^UN6bfr#(V7*Bz>fHq%ZfZkBv#XBv5
zpTY39;kVvO#=Zal|7Wl~+WA%TYOzrB0Y->2#*42ye{N=ceXr$q30ntPJ?nOE28NwG
zxIw+2?;jV>N#F+^>^UO=<SG7bASF5smmh%dh%&tN{bNAJV^BbQ&tzbTkA1libZFy^
z7l!?y+22zB7tT|sw^=exs;_9{W7xIyA5ycx@W2aIlmGvBDWSv%sH^va*W~~I9U%d}
zMlTxHfz1)#5#k)+_@W5HQ+s&;w4Sbl#k=fzcYs5;gUgHWHlTv7^u~YD9#4LT)&nJC
zueG`Z)VdwCUfcmm)gLH%`m&puf#JXC9<YK^fn%&seE1m{UY0V0ZX18i3eIrZhYfl+
zG<fne{GTwzlb@kOHUY#A6X-a!2&B5@0Dp@sGbqi0_R2H9Xv+dQkH6KBnSr6<7h?%u
z!!IWOmR!(C2WS~y7DE>FGSK>&pyYet1#=ApLv&p00sdAi@QtQf96Lc%yr3-x4lkZn
zgAQP8Jy7BgN(e9fY{7o=X{b>#WGJ=na#1nha#1lVwax-fi^H`U9(b{~8hjfml39ia
zUd*Tlb$SF^50r8pXRY7U#|IkUV91i|^-<B;1#UcmhD~3%*!=$wT6NUAih+S4OA55#
ze-~&F1JV{&vw_|w3|f8F8=}I~>!Tvk?Zo#YyqJNZ(}}P75R2u-(s#WfDjK~$Di$Ca
zTND}oZM>i$tj|7a&>NxxO5tYzCw6%9Gk{KmHaxiteCqyz7jLT|;Zmvr+WKO65_CYD
z17xxJr7B3M@V6u~f_Bc>^0!2QkAnl12%v7<OaEH%ya~^SLT=Ffi9kb(9EcVH(Y>HG
z4IKLQ{E$mtKQDzk2;v?dP(VZ7!;l5Ns28;V*zmxM=qgZxZaq*sEsH6OaVMzpwF`Wi
zuoKj+{H>M$|NjR~%<wdTcC3IJoMOjaRD>897^{xEsDO5Iu!7f#Ngc0uQ2|~53YsI~
z01cRBF@P>804>f21&fH`ffqN6q26p&0bR-GqN4TUTOk8O=V4ordj57kh^XF+2ZfL{
z_xB%Ytb?Dw?F)$Un!ous8-LpiNcKDC_W%FlJ3io?Ak$l-VqV{Qyz}PgC7rSleE1n&
zuxfx(*2``G{{P>#0@PwO1l0-KrZO<RTmjlQ4mwf=lsF6zd|rLrMFliS1qx6dQ0o`u
z?iaa=AOlLYdSk%xZU7oMcyYXnfgwvKI7_DUCS;L2D9B!fHi431Fwd^{di)IFepcfV
zc+6dH0?nMkxQG9<?(yYk*l{9}pW$U_Is-#+;~Nps*(8TydlnzOh^}A&-`Mk_=kWAR
z)=Y*{;)g-OQF^ukJZExj*KU1&P}qvTm^J;cHIsV%wL@U}9?)Tw0pQbtv*cdvUkIv&
zUR;v^cdJ0B&w=cT2KW6tk9J<}JO|mH%UGiNLK}3vFsNfE6%d@U*Z^FM)r0kS{&*2&
z3o=1q;hA1OhSqPDOr6JqJ70Ewf}~tGxBvgAFS210sfV5w((9t)@WQ?vJe~)d!N@u0
zqQcBz2s+JyhkrXmCumu>z>8k+qE-Hm3!p-!MunMC@^<s%56!OwdR^JTTN^uWfSSVZ
zUZ{gQy9YB_K_xV3*)glV6F<X#2Pe?+{olVco_O)F1GKO8=!<%5sF8Kd3=B}+Z#rC5
zSbBY#HiUMbde>XaykS-6uXmlN-gF%7{Po6W75~%&4L?Kqryk<Cz~Ac5%)nq3qr$@9
zY6}`%bx{EgwidL0<8K9>KG^M|lEc5<p!0iLw*yo20Vc2;H}HYo2q{JC^Ewz9HgG{i
zKn2%}8Y}Q1$+{_^$f-zcKF-!qqr%KkVh=gMbw8+Qe0akKkdr>Vm=00p0CL!d62;CN
zFTS;d^p)J(<pXLHgYKGov2hXu!)w_M3p#(jYp79iP$(7b{0Khyeuo2SgT#vulNlH`
zfXAcW?OX_2U>TxP0*;SbKX6(W><wjq11jHNg4R8sMOLxhZF-y?lScg}15h*KKWi!L
z-qi-+R95mrR}wVJ-3u{H{Drgj|No(30sPyX4FbBIbwJl^1!U}mBpO-JZ8gUNGHx4y
zj>Vn`$`&eV&Hq{XTjzrYNkOW;4fwYOuy;EMyl9yVYEyxYfC;7w^ky@KzQ_R$7yax6
z9l)me_y7M0@CDDH#kervGBCV&Gzk<wm0aMBS}#GJw4I=%QlZXtc#+`?@^k3}xWHyt
zP=;tdP;z#9rae<STX%^Hi{;1ZSL~TI1&@n^oB~xU{^G9YbUp_rnfm(>U#$Z<^jPx|
z1*pf?_JfWh)#2X;bGE<>`8gm1Q2YY%3Oh(I#4B%{KpBY#bUdpbBWPng=&Bn~k|>o<
zQ%$^|X6xusA_&SZj4#Fh{Quuj!wO0+@278YV3Mf63mR2=@uGMx$X6BekX~_%1H?<E
zQoCe8Wn34itGWR+5%U6EYuJFM-$7?xb{_A1_jzgOix=xG{{IJ!N;~Vk==S;lzuVd1
z#cYs}v&oCeVA|qEx5fYeNPTESkR8tTpiVUCehZKd@?at4J~S^_#G*Ucp!HG-S93ME
z2YsN_2;!{SAWc%>Kr?uu3%17Og({e~cp+;6nq~w$R|q7OZPN|DqdLeCbal|DLIwtq
zd#4|FWa6v81Lc7gfQOh~z=XVYx-&VNPY4Epg*#uo*iZ;MG}Hxj8Z5UVKf{X$y`a=6
z(Rl-OmT<SXM|ZGGDJR%k8%NM?o%q<7%)cNl@#Z%spvkw+tGzWUg5aSV!vmjJ9doHy
z5m*2k7w&XX0o`D&p}@e%06zQ)e0xl%i;4kw`Ax6PUr-Y-tusbNhkyI+&Kob5+JWa;
zK-Ut9?@9sXXYeJ641Ej?&FB8V1Z^Veyz%02CU{y*417_A>K;(?F0JT}QBmk-ez820
zf#G2N3+B#amdA^@ds#s9c|3;SUb}SOcySffEBgMrGp*aDnxpLj|Mml&KMy`+x%^-z
zCyNSahzg5)^M97ohoIR5(Ef<-5Ebx7h^x&%7@My#G#>^{sPR}HE)g*N4<3X8Ev0z9
zsrlT0&=lN@a**jCnva-7$N7NoC<|_WW6^mSJf!-f!VEOp_@niINlfRB7c)%${|^t&
zPzMEfNe=@<Z#d5ergxzAp5MT0;S4WzK6nvUz`$^fMWu22hY%)d4u1ze(5ZDL(=R$R
ziPeX69t+5D0%;fM0j+lK^ikn}titQF{r^8Y9=y8o3h10aP*!g~5(19DX+5AeMCYd$
zp$4F&^x}!k|Nos=o1Ze4=o=nregr<!wDZP`NwWX{gLe;tuFzHit6Z%DKF^dR41AvH
z>w1aKhr2*!cjt{4j@h7$R>>chkpOZ}V>hUW^4c4`Ke6-1i<K(>{~NwF{GY`T{=Y<p
zBe?S;c!7(^3xSUR|972n;saICA}@MD*H;}8XgyHLWO#t_sC(moPz$y6Wb4~fS*R(U
zH(q=+0nZ^f*F!z@$OKeSfISDUuAAS01Ev$?ke^+s0aI=R512KefB{|I3JaL}ZfL+L
zhJg-(HDf3V?7Z>fxHL3)N<k+93-dF)Hi8CIednRh8!vKYpeMg}-gt3D85~Y+%K!iG
z2c0Lpf}>Of5?C(^yTBomyC1Z%5fN_OS>SNv2+LS($j|WlM(3~QQ=qZb&Kobvl~KdY
z@Fe)?Wsw*6+8|+84+*sBKOpbp3^b52oi|?WhfKV~{JOyyqzMsbjc-7ETsjYTUhVWz
zVSzTTK&QdI*pdrwUU`6b4)waIM7~&*%fN8VMJ2Lc=$MO2tjaML6(5CO7ZuR%7Z;EM
z&=%w4E-HSE3@RWOy1dBR!NAbTq5|sU)G{$J?Bs-0r8T`SDpD^z`M}34O1($`F=|wd
zcY?Mh_JVeTfQLji`Tqa!{PDsGBwM1w3*I8%J4Iy*1L)f94==bu(jQ)^@PUtLEded?
zmhW&;;p%cxDFsjPp6GB<;SOwmBp(zO-s_^G6%d+n0+ccycYxOss&_a`G#`;^s8Qi!
zEwxGmot4gU+!=Hk`v2q3;9VeKZAt;58O%oDmfmd8IhmmKdG#`#H(osc^8f$Kg`i>M
z8Wk=E{#J0W$VJ8F#m?=ZWAR%Ll!yjo$Qki7yeRGfrGQQom6uhF3=H7l1ZRTC7a=*2
z09Azrr4VS%Cu&e~K!Q?nJE)xFZw1Y?)pxt7h`m^t0y^N!S&D!A1@MW`(m|mamLU6B
zIzS~j&v6z|@8SPTHc*SgMMdaEK?=xWhX0$7F*aXk=q%>xtQK$x2nx-J0O>l{&cFZ;
z<6T``;0BG>3(XjiK?0!Y11;?Dbx~0UyPnnX(u>*I)2lq0q#bHhB0FnTTo6$&4RLSW
zHjsNu-9ZNxCLeqx09yN+a_|8M=LP<4B`T?$$4YegxA~}~O~2~NWKmxP3E{7x^PfQ>
z3<}^}D^N<6c+CvDdw@ly@dzlPf(kNlUT=H@IuW7sShogfddfwGr`wkS)b;3m@n5j@
zK)n)wD`={?+g0Gj;u?@k_*)A(U<XUy(EI=Y_4#gBj^+a_FD~o;|6h;L90;17?ug=G
zVCZm@=w|DV;Ap58tmAJ#1)6#StuA>nTkk*U)K0sdpgYn)6(0XKH;HbR);ZmL450R|
zQ*VfhUFU}vPwxN!-{}T24m@NG>Kq0zu<~yU7IaGM3{eR(1nnFNF+ABDqEa95f++`F
z^|7=bDB<Z215K2!yZ`_H>u_*4>4k>g|NmXif({+df*o#>-C-=fK43dUuR!f6(d!Q7
zFg)4m#d6$5C7^+g0n`f(0WB&6sRSSJv;bUEmx#S|V`pGM@-WZKTt9XOhAtl!SN?4`
z(;9139R4$vv4h7zE<a9d{>{$cCIZqD#sca=!@Uizw|jk5G&(=L=mQ;Aco^#2`_pfE
zGs)CTgYDyQJ;Vm;dAO(qy>J9ok)YzBRAko-&_oz$x&4cEtqcq==dv*{fR54(0)?Or
zXiH;=idpB47uUeWB!6o*8+hh|f4c)ynzf5c5PxeVNW?~ke_J>U<8jbh&jXyGEssv1
zB}9k$w{g@np0GU5-(<|jz|c_5$Wr>+tIM0U;U{N_Y{O5EQr<3a_J*GUB?1jUlU{Q+
z{A4aY+)&NNSh}~{jinoGDk~(yI3aO$sWU_c5?28)oI%sQE-K)BafKD^F3<|5I02CB
zx@}Y#e`wz5bmJ50a%Q#R<ZlJlWZiDl8GV`b>K}q8Rzb4}ttG4s4A2?VUKf>s7pK!1
z7{EtsxUqDDR%AzjGLB(qh)ND9LLGYf7#iv%m`ek?#k##f2VtKq;c)8a?Dk}N{RQMu
zGX)-yLoL9G%BnX+#q33CCa8ufk$cGrvI^AF>a4#7w(9^`hQIYA3j>2QC}SF09<I3u
zVwf-<c+sQ{E|&vdc$ohG|Gz|~Afp9TJ{W+fR+?*63K%61fL2t$1g#mh;oxr#26axW
z*#r1nmoYLh@NaWw>katb@Qblb(uS!-G%Fw=V<pId_f3%Nl3rGVN<q*_2BZz~;e`<=
zs8ayC8V<Dm;=>CiPRRN%Rq#GZ(9wweEug(};M+h$?|?H3sQV_;`Qe2dgbSM1<Y3@$
z`NIIt>@A>nW49YPGc5cE9uf*+U|^hn+mDIMCo1Fre{eW~+L@dnZ<~QueHnrVW@S2k
zR3soxskNY`S)j9)1$VW8nxa!c(=9if7#Lm`LR)DsMAD`k`ZKB4i*&jhfEJy1x|?(!
z>iqCRtQU0l{jLW_{Gj{Veu8f#ED_0g0Sbm=jo{j?NBjT(sMnxDAn-zd&@KSbo)ya)
z6$$=6(B<&WH7YU;rKYdBz{5tMrL`OxJjVPCFIpSH2et8Zet4mO`~QE?;z9|~Ev~o!
z|BpECq5`hE8mifo_*<`o_At~5@NaWx<KGs}Zo^i}+VCr>L?kF6!w_VWO(Up$=XrU8
z3AFeC6sLx_!L~_&!W`7JZ~f2T(gxb-xs9Fic$Yh)jY^4xjX?>Q4Qpu;=$O~n_cBt9
z`Rf^8{$gNY=yGSWVJ`73m$hLmF|uLeZ+#6~^AEb=^}~z0Ti{rec)iYs1#-A1sCnJ_
z;YBJ$Lg4jOs6YrrK;(4`RKOV|aQI~rXr>!9u*2Un8MH^WMn!^wzXh~XytV!|e+wu*
zfoHf&DtEeo23RkFlX_SR14EZHOY;k+<_CXm7&jD&Fm$-61ay|D)PNS3K)2O_;|{Wa
zwQ~;mR3p&Z&rZlWL52r9A=}({x!Zx8s{t=OK7q0pe?RC%+>8mvp!4TG*E2B0cZaBe
z(&U_*;AjEG%EX)h|AUXF=zxd`bbfeId-MPQm*Jq6Lp5mX*%zK2z%9fNFId<>*`f77
zsX)dCP&Cb`XJCkYsRmm8=*(`z2x)3G+fD$D!t=NCF*3+AfR;S=2K-2C{>4$o9guO<
zn4jTgHz@SoSopUEPk$H4BvWq;K9rTe6?BvlG;1hwF>ru8X0W1-A2h`c+FZK(#{d6|
zK{kLEUx5x#%6M<g&+s}A6s@4?-DcY!koBc?5S#y|HUDBQ;}6K-G~s7>ajA}hAv*qb
zQa9LkCQt#U$UXgQAd_hQ{1i~gm0EzavOCBUkU6afO4Kq8Kw3NM7#Jd7gSUe)lnQmT
zsJw92_z&910$$ko8Z2U{0onin-ueg{2nAP`tT(_599S4iks1PlpjAyQjIIj*eI+_S
zG#;4(y0;qCf_V8}{r~@NSCHQWSYAI01)swY8iiv49f}D`J}(OOK@J5SiYd4YG-0vh
z7%2PCsbgSxUEX=P+sOu$J-Ul5x~ojOvkbbOKqq}e6CP**O(FwBmm6xbWA0{Asqb{w
z>C86htTyQ^1|25A(dldh>Th;BJ3zJ`>;s)Ud2pAz2|q*UjTZ|)gB(%9)p_HEo%;X(
z%_shY&-;y!1vh~LK^L4{g%nnY^*}01MRt7vowy6$)Aq5Jf#D^nRoZ#1E7qjD)}T9A
zryf>v$t8kLDsBMZgyAOAnWxhcXTraYN2SBhw6o5Df7|6=H>Lp4B}`qQh4XHv0sPzC
zOalIw>16nufE&Y?yFiJQf195v|F$rbZa1A53qZ?`K=&qmc=75JXuPHK$BRxia2u}m
zb_rMKhZogqf&c$EpZ?!@BMKA?U{4@*lB?8Uo#evK8!u+5fIG>tpj1&-1L`D;Y;ZvD
zBu6Ane-*-{SpU-w+&wOP2MUEsLBqG5k2+tx*!S=Me^=1n;*W04|JX~{HXpHo+lw4{
zxw;^2r6RlTfCBF*D57WAFhFup=P~|mu+W1A-tl-);58xwuf8MB1axYi8zk_4ga?Oa
z)I-8)5-3!TBZX6M98>U%WgVbkMTDI<INHIPVk+n;`@@|-UYMvNhn*UThZ=MUFVr)<
zSgix~!xE4mz-L|Dtj0_LFfXuyz0iX20*?6q2RdtY8*=>jLj1KG<YJh=48RGXqa9T1
zfjw~vbksk{6NM_so=67qK%SU>A&f~hB1r`l;V)X>^0$Dtuy?-h{PChj>Hq)GaQ^M?
zLID}GL2(~k1sYCcU~uSs^}aXMWCy4Z`M%fH0Mt+vGCa^5YVdvs0|T2==d1TSL92`Q
z@$^l%4QEo2PwNg*VS3*i?6M=KjgR5I;cckjdtFo{UfheFUK!3LUEi6b;;~E65nQfI
zy!ibZ6o{3=hTnQYH>G`e5&7@`f4Am;9HsA_n}4&Hu4q0I08c^COX`kxUVgy_8n-&u
z?X1&${y%7qAOH4XpU#&rEJ3G<ABW!m910Q)3dlHU0=q4zMn$AP{KfM;a5uNv7L=cw
zk4UusuapNb(vS@0-|p-a(0te=IO72*B%~`r)wRHD`5mB{vKKj8py6illGOvC5e?Ad
zxECuyYEJxr9o+40&>gJ9zx^%5l>fyp|BF39E%nm>|GV9Ez{@F1gzEXX`}y&25Ay-1
z%4@Cv|3`HG+@)p8&(Qhd#YJ##0-b{VB2Vf6|JN(vw;e#rAJA3WM<L@|THyIf{+1V@
z2Hf$^7cV*#{{IgT%`h|NXLylP!N72woe@+igBp$^y`Wn1$BPYm|NqxFAK?Mdd2oOh
zHG%h$uFwRP9bj+0Xy#+s!3i1^y;8xz0N$tojl&l_F`z8i3{Jn!BA{a{4URb*GIUn!
zbhD^*I-B%5Gl33M_|*C01!L>~|5*%Sp&22j;F9ZjE2Jp`8dj<AeDPvB=uFOophGh{
zZ@jn<Iz`?EeCL?Niz-EM;swoBv|cI!of4a&2u=?U{H>m#=ExBqq|_k60=gXmbmQ4B
zkVhbkrrg1YhL=k2IswX-KR{;|9swx?>3jLVTn;qww3CAcG`|kIRQrWlGy?<JkDWJO
zXhlz77R97gU!o$=S*&r~SqG%9GnxaGIXZ8GI=e5{gGR1EJu3cI(At7-78Pq36#@Qc
z(41~V9S;M43#j+e<;Dq`;puYY0NqajsW8-`>zPVLcI^N;4RmVei{NqwhL@lNXu(b}
zy!4_wih-g27()~PcJ@wZk+g1ip|nnC6VN3C9nNN5E-EY?&gP({z@5$p;6+^!pM%%T
zuT}$H0j2{!^#g3f15mm8sf>Z)bteC|92FK&!yB}riUkx`oiD+yy&o^En*aX~{a>QO
z6P}R@iLd&9&EN=A0IQMd{PE&U6R4m8Z=SmGLgWo-`4)HxcB4EvzFOaw@OL}wyjUa;
z9+aCc4_O6vOyK3cf1oXKu<(c0KRlhs`L{EGPmg;c;SHKrW|6$q{OCvXA&Jf(FRJ80
z$0QyD4HkpLxuqSnuJ6Z-iL(Fy|2I(y&u9fD@$6Di_tjmf`3Mhaolpr+@3ajJpo@in
zh?X+<hDp3t1)mFl*zhg5eGOVM&tiF)zeNf(d;Ob%fnfuGi!37pL%C=ph?h`e2&N~L
z=)GJD+PVYg9Vqbx(;xU-Co(WFWUK_){HX-gIQ-1Oz_1t8#cMt*0E(sN7tv|WKP1Wp
zcCj)zFoG5_v30)a{Pdc&H%y`P#rxMGAVs|%OVgTvN|amffG9dqtPeUpf}!)%`?T)|
z|Nbx4e7iT{6+=D43dR!o9iR!{7YAhi|Mx8s>iqO}1!L)(*POj!3Sceo_kspPc7SgA
zeen-6JP#Tz=Xl`(UKLTQ_adqQ5<>WbCq{+E@^H!V*G!!^IuF0R^$&DI%VASc>zc0w
zG=%nA5OkE!4`>_cWdV5n6FCclW~X0lE&2cd#nBu8|G${$2I>r!u)dgZ_W%Ekr)K;N
zFOC)?76ttS34}<2?#A)uhg{`jcyfoBIX}Y-JCNuakSG(V&1iUXhb~B110)Q(A^@@^
z_2dp0kf;zybcHWJ!;7_^3=F*;phNx*FYN%`nEE0x9C}DeZ^WN?@N(-Xp!9R&#pyr)
z{)6s%gDiP|{bX09IX}Y=Wo~|k7aQF{&Mwv5l?WE92Z_yth>0C%-IKr%x=WJb80)44
zeg?*ub)fq~vcM`q3QHjh#dj6Jg_6KR{4Jo1>UNdFg}uSTrJB2{;6fG<AyixH6Zjc8
zz}p~pHNjQ#LsV++ng|#A0}ky{sAf=K<{0Y+kYithZkYrxz+)5SZv`Dc2Jr=`M%ZO$
z%)qdNO%QY_^j}bjl-Q+pGrZ6i`~QFO4$zIjOoH_c3_Fwr7#LpU{r&g9`4p&v6$WKk
zaDV)vI|D=W1NPnkwocJ43H%JNt9Nmlz)ZCL`|m$!gIb9?$jlp}P&4_rv+V+nXTDeh
z(cFB1c`;b8eZ~w>d@d~no$w5@9klS_cs(mf5_C#f+-tcs+qQ;M35feaGa!&yU^vFQ
zF@c|f*${qb70cBB|6iwOoCKK{R)|Ogk)XB9zM%D?4a}vsoi|>52aPg-_YMSSya%b)
zC<G0cF@sMJ*afn+{>43RP&-K&yzZp)!;6T?|Nlosz2<->opn%KcW_(qGrVw`^8df#
zffpNp{`=o(3%bSulnhI_j<YWD1ufd*ft;cOzGOTeG?{xi4b;P12I}K)KM;^10y1M+
z0muoW4xq~XI)CPNUMCRi+}_j={0yBZ4n7dzJjB2KC}_Fdhvp+3mWN6-`L`br2+Yt2
zY0d&=^iJC+prvA+rq2@i8IG||YU5*I1l<5HoskMs;|5lv3s!TS6{LpYL;Q|e)B6*d
zMC+%t@iFuUGjCvi*Bi{Vf$`moJ4yflzc}T@06Jla>&2dv|Np;G761SL#r`S(|L+1N
zBEyqA-tzG?yl4;uHQ)GKD&;|?I8&+7i@(1>X{uCn;Q`R1i~}VK%@z!$(iy!VM{LSx
zV93}5Vr}gQtvGt=Bo7(}sefTA2{NYgtKp>``#{o6N}v`A%%&?KA#pKql@zjLt{Fc=
z>+KSz&Kr;gB`>l-v&uJKC`<nTzv~DmXbx(}Gmws_qW}MQwx}!s&45f%0WEXc@e?Gz
zR1s_vM^xl77ZnkP)&upWioH|7>UMBgf`)rQ3LsU_eo^prfe0gb6dtlP8+2X63p-Fv
z=b|EmF0KX<2ki}&0j<>rZQIxbngFi^)y1j#3=FT!!1XqGFOkfPIYFQm*e)tE#~H$$
zT#a_Bfn3|70;<YhGzNjrBWY1N13Ey=A9N{X^8<d+(SD$tVnN)4FIYfa&^>^?P(8oI
z!8?Lv8ZE+HgB?rcGQ>eXvdLp$h%f|goaQln3m%B$c)3Z0fdRa1hhL)gEi(hd4vlaI
zh8IpC_k;HA^Y7ZzGW|p{lM3Uk>2H&n6zUcDKyg&UwF9)$>SZ?QoVyn<!hZbw-#yiV
zpMjy*iLtX4!~hSUH&}5%7Or%@cwzM8-~Z0TovjMt;ERrwLEKiAa0Uj>!wrx5`CECJ
z85p|3T6+T+JHdwWZ{z6fbpai@`ICje|1%Q<Lw5a19>W8c2TRhS)<rRP&IMV=zfG!h
z4r>I+1yM{ep(4i4&z)OXV?d%+%$<873WJzBr?7&?P@4bQ^SAS;GB7ke=HYK;R%Kvl
zKETubi@9$84p5E$5_C|(E>MTA^Ti7-UQjQg^*}v;D+_2X(u)@<-~au`a4$n=s|U!v
zKbT9nz#XQS-k{T-dV4@lXnnvBo<CQ?&}PtCqQcQx$kQ9Z1oL?TW9O&N&&`kdJ7QFL
zIzJ!$&C(g8BG6p_PoBR${{R2~4UhQvTf;!ZFk3+(1iIJC@KSe)ih|{*TH)+lJfLGH
zt+&X6LZpP#>Gf0o7CjXPhU`l`jIX+9fkLD+QlNVhC>S~eML>r*eZSTCs6~*0p?8Yt
z4*>>-PQk7a6`tlpO#Is}WnO|ym@+VQ2C_6Cl(F<tQQ>bj0i6{TzzlJ8mj_dC01K2I
zz}y?b3W*3VkLeC+Op;EZc182vE&L1&O#H29K?~;gUf^e7VCHW<0Ori$XJAm`Z`};$
z?BHi$5ae%N2IgFWaAr=QoyH_(`R?n#|GiTkctPo94?hFL!3S);Ev!HI85mw%hDh;&
zq;8-}?fCj{`nxnH8^*cQwbPlB9n?WN!ZwS6Au`(VTW5(1&&$8R|Nn=ywn9NO&@P~@
zouwkX!1;D5DBm8;VqkcA_4oh(-7P8$rk_h^QWq@{>MRE>R_JyR0}bPL{s0|DHJvMi
zNvl2xWWn@IQ2Xg+G)U7{P-^dnWB?Zx(0&ro>>22gmhBM&2OqQWZ+GBh1nr@e0Ox2I
z6^^uS=Cn>16{j?ZQuY5ODgt2{H6TNsG8w?L`U+tgYe9UYOi=$+=H>Ta|Nn!F4#P{m
zE%holKyDWDg_Itkad}36&`ggLsId3|8lwaqfCDK??m)O4ASqCa?`?tTZWIEo$KIm?
z((PX&kntE~-H{9ih6wQ07og!=&~;Ci$M{=8=g&j=B9<;H0`;Y!fnJF&2gwc>701^9
zrLxU01Z)J#({?d3GBSW##xWq}4Hb&4rQELrK%Ejt%j2c)AVJX9bjYYM|F#$vN01Qz
zb_dYbdjbCS$2(nAB3|T!)_g$@QI~;4(Q%M>Z)Y$ty!`m{|NrLt!%Q#tgSMWys7UZ{
z_Yi;-a;-Z+$!0335V8ba7S%ch#NP{w8OwkCt-ZVq4E*cwAN<V>%59dXYgsydR0IzG
zXX)Gn9-Th;i=}f4_z?T!ty4e=nSp`fc<Tm!&{cP!I;^wx3_o~fp}@iV2Q1LxYv_s`
z8*mRK26Se!<rc6R{4K{pXA-)ofW|aEIzgxZx~K$zQ)5DRiAsXy7O<uKEj>I849$B%
zE2SAqt$SNLAmxZiZz~6=Fm+K;*vY^K>dAJ#c%kaez|cKaAe=#vp?fY5NctVvUX7Q%
z)AwgFiP~@K?ga^h)i6Lzc)|Yr-~Y~5fpAc^5eWy?_a%IW|2y}BL^}6^L@ZlF_!$`Z
zTLY&HXEP~t`~Ls`Kl`!_=t$D(j@eA25}kWgK*y(ojveZ5*#SDEVnqXg3peBRi`h&f
z!62!FKS1#(!pz>u-pSVO4(fpFG#>*^6sg#QrWJm1)(dyu1a~Lxe*OF3c?jbCUaxPR
z_b>l%d=A<dkFZ5&`jKoV#d?^*Jz(2Ak8_^q2j5Qsa!0R88+fB?ca4gQCMaKObhhjP
z<q7b5NU(^Ar8`e4YqN`rh|GT%6^-T^6%982md%jNAkyssI?X_(`4=aD|1;2<UWn^j
zf5Kf?&+zgbNTL@UP~hMW2=DDtSpza5L`4U5I^2tMKS7lvNCm`4@sTfY;?ZOR)-)4S
zlLV-&wdw0EXX#{j)bvqNX|AbPQDNZk2Q3$VDGaKWK=IDd33f;CTn8QohTc{O(6p?J
zipc*h;2fR7z{0}Nd9(9S=ZhDnzrf`vJ4hJ=BLl<#Eh?aG+E67g#30ffU}+|>G^o^o
zNq_(O?|*&oR0mG5JTq7xGzkckzwz_m|K3&yE^w9S(R@Uqw-;1o_qKxer~Tie0vfT(
z0I|D6R199M0;%qG;A3Fuo$A01Hj))=B&g&8D|^xY^WXpGBcOcjD8b*t#0=UuSfk>o
zP$Jq;qv9yQ-*S?bfdN!)FucqK9m)c_DaA#l05qZ0U8CZ`2s(1B0>onk%`1VXtw5Y!
z7SOOWL#GRPUJ7&uR!O&uN=2uON=~<n3h0<w&~$+aXzg4#WW^0Af<#zB0oGX$IeWP~
z1gzKsJdvr>U87>sU817XZL__*M8%{#Mn$K4%RI395*3B)??#zEDhi;3K6`ukK(09W
zlcUo|MWyrR!JkYAAF_7(sJL|AYktPuS)!8Cd9K?>C57=^XNgKicZrHYw~tCjx5+us
zn!8>e<Hq`*pff1TIlDmjk@6V7X8nHg;7|Duj?RzWF)AvWHya`H9GxGveN<Fn(jJVx
zJmyd-)?OZSxH!`>2WAGaH8CLT?y<n^ffxg|Mh>o?rJjIAAkz^R*}*lk9dlp@S>)0k
zqmt5FBFEBMqT&Lz*rnU#9)5ed;I=~jkLEuwRR6)P^<p~a1oxjycL}=xIJ$gP6c|6k
zT<OIEw+G^XbZc09r>7P$$<^yLAL3{}06L>Whl9WM1!zT`i;9UtGw3+7ZpcL`j5R72
zj5R7b-FraGs2D73R1ElAH-J>;sFXBx*QnGmg68*YR4N)loe|LVagB<IWsQmke{1C5
z|Nme92Q7DiR1hwpWZPY%;sZ|6CEfKdDgp$OG$`4F7K?#018Bt%a*_rmb)+N>PthQ?
zkW~!?Qgl5rNje3Vq%*)tIs=@fbHGvVqmqM^q#;2KO=|EI?ZJdQF6u!^9#@*?09z5G
zl7kuDP&*LGnH9GkU@KTqvJE_0)q5~^m#Cz4$EajLlX42w(iDP8*$a=qKz8Cv%3N?8
zO77L8Wm9fYX~6ioBZ~Dk2c$gkBH%MG96s}6{_moq(|m}n`2ZW}P9_fi)~}#6i<-LY
z85p3+y8tD5?*%E%QK^6>Zx_ZIl@iS4od!zYYM{;^Xn6plzz%>WZ%FEf6wd;P(i)Vc
zL8WyLDE))dHYg2)ifhn%5KwWg0NN4(TGa<yZU8B+AxB;tp6qr}ap`91=yXw00W(`V
zz@@W`icWTjii%O@0dVQu!UQgze}Gyl7M&*!{$M)zfVI;_C8hI3^8?VWSsC3fDk<GH
z^(q;?GN2r#&~0)9bl4-~hu#48#$TYKxs2QJQuB`={PPZZy=Ff6h@<fl!w&|A&hOnW
zDi)f@d)=8K#|d*A9sq5OpLf9HHS@s-%&HIA85lSZff_N4$9n77JAWMf!Q2Qs1(czT
z$M8V&zaRYb4tO*_kO!-&H|P-Q=qTx61ht*IV{U-PxOI9(Bzm0~5vKq82hsvEokJDu
zgj?M;Di)f*pw47J_)Gr#C6E)D8y|sf2OZR=!uY$ln6dNI!C%ac|G?hiF}&3L`ya?V
z&5z{4hq)Pa)VuUEb)@uz&iqX2u2IS8jj;eZ0Xa07q1J#y;}1wX$SRD`KyvSYxO>q<
zgBd+E>i_)#`3)8vCRjp)@kVa|E3zAYp}XN8I7W{3x-lWb?B8FIxu7sZal?(?0#;Cm
z92O?^JchTMfBfQ~ci6l6u{<Z}a3GV8kPfDfk`89a=ARt=trI~x!9~RdR3#{YP7(u^
z_6Cfgb^_!~Ldz1+M)?eovK*BhP==|1)(2QJjNsq@pu1KQnq5=^Kqkui7&N=6csRUF
z{tT9g>D~jr{ED$g#pb2Pv~ngfrhV_GOO!L|)ps&5FucA8K4IcD4|spnYt|j0q0WGe
zua^7_uaiMjO5Fi0mLVz}CGpk~0;OJ^H<}-?gH|P#+JnwxX69dijDP!2&{0_3F)E<a
zRiM}JKmYm@jHkLGHI_h$TIc=FYn=x_FZu7HA_7`l#rRwE(CY_TjP)6ER{RVvUPgj;
z*}cx+2^!@BbyXqbTxV?|Jyp;+7ZaqX+Hl4J)FTC*5&|393SoxyNI|OnOL#NfKqgL)
zWMGJRE!XX%5&@dc>W1_kU)*8<-4J`Aj}Mf+8M;~ORbE&#g9pYqUKl|bGA}eC42c&C
z%%GEuUr0juJTC-5j27@^8ZRy}fkq;mZ9!%+l<*iHSPWvl`0V}vzh#U{2!HE#4p8^+
z#VRJy=vd{~j0ljk_$nC~UT8D?{|_Do?Tx7a5MlVO`S*tsi{^hyCC1&sJUe|M1AU-w
z$%{jG|NRf(-`A$l&BqXskq0v2Yy|^@TX(cT^J@XnDDL4G_a1}BRZF-t%0SZVDnJ8z
z2bybCLKyj{9`I1T!^*($;-Dh~L+4S*mh&z~(2Sie=+c5x`TB)9EDQ{+8yF-QG+*on
zQHGbke{TF0&cMS^#`gML>w$_>pn?uGC(OU?<BKA&W&ABU><kRe|4R5<li6V-x26!A
zU+iXtc=(0e|9}4%fVSt_FqZIw7Au*vGcdeNVP;^+=mj~IrGkN>J{}f}Cm~Y~0vSBk
zpafCQz!3eC9n=wN0e9qHRDk769~d5J*rNg(*ks_Ja-j2g!yXmTpeI8qbMtwo&fm?D
zPA5YNYx8NA*SrmTR6t!fh7#uH(;OMvAd~yc85kl#Nf>mnF-Ls~dxoDiKf`O*j0liy
zQ8@!c6i60yxgk#pdqy%uvH&C*TF$@_0g?oD0tHIgGnzn>G8ywgk`^GzZ-+Tb*faKl
zgjqA5frJ%7!p;AgOSm({ZTJ~p2!i+-sURj>IRis|L^Jqw%@)v^ycu;M;SXitTVFuq
zFQC(N;=zZ+l!RtX21$a>Ejiwz0-C?oXJBB6Y<SF3BAc-qB((#g?+F6~1L%^isNJAx
zpV!417eSJ<5t5)gW+EVx78&(lL9%raS&*r63=9kryFt?_ucb4%ZTT5qBtj%X?g4Fl
zj{q-5hAi(B&yWYHum`J{15%*}((Y{dzjMzVPy)^{0m;jkfiAiO-9!3f(f@z{n}7T-
z`PlqJp<cQ9hlF4~hezp?mor!x7<vQVHUHu(zy4ok>WRAPm#UfU7;j7$tYK2DX92CL
z0L?DEW->hRV*2lY|6hW_3p@?511!!CW*Z)O@!#|R|JS9kMD+zc=TO4heB%G>jOIPy
zQiY+ED`UDXKf_DizyJS(b-!@^4a!2LZidjqa&~!wl5nXRbknm>ECU0>i)2es8P$5A
zR3T#vNc;OgQ0-tx{RL~`Z@K^H|NnsC3?@5%h8NdLK!b2RFHeJ1g1sN~@89&lHB935
zpxx>jN+3lGN*EY23_z@DAQm{ldLSBK?>ycD?xHs^F@SD;1O+gI444UuDn@k&kSHj^
z8F;{=pbj(xCs-7;*@%G?EDGwPg97O|BqxCu&evx#^v+QM&3pv+_NaiS0eh!_6P4kC
z7vV<WlMf&niHje6n*eu<$~MrnR4eGHI4q8m23rJnlp5H2{EkYiKi;AOan`XGl~15q
zj4Vb>mz*;Mg*Y@zbCvSKT+wpm-~azv|Fc*j!JJSG3FdX6J<?Oa_e%D*sDRFEdm;My
z-~X;TV4(~jP#BvOGcZK#10Aiy0N(e;zikazW#>=Dmxc$jFYs7(F?sTXRxUQNKn^6}
zdTs2`{DY(P@oVjXu#7s8As>ps7Iyw<xlzKM(GC*2Tg1Q+0hz(N1Y%x%?$-Q|vvfhm
zB#`WWkWkC*67GzHAnt~udU%E~{sYPoZ2WzoV+)&q$d$fmxn1(4caI8a%ylQ|rYO+1
z2GG?{p#0Rpbi73cba*}k1Ecow7L`W~pxd|@c#gNIJOhOy0|V#r7L`{JQO;w~K<=Fa
zzU-;DMP)uHAv1mYSO32Y!s%d9*$<l8Fub&Zv4usYMBMOX_D3G8Hc%k&w>)QHU;wpO
zN?%`m;9q*b^TLZfJqFPI7oar`*@xJAr>KB0McD$*Se@5FHGJ~{`4=7#RUj`Mhs?8q
z5?vNUFC+y9^wvWL#1M(@xjrb-wI1MaeGVF+ZBYRod+>r$4>a(|-+CDo-wd#W09-+<
zkWQI`(gsKaXuJFiQ(w?DBV(O%ug8D>Z6`fDU+`}`z`ytefAjQz&}@47f#KnozyALJ
z&)?cy|L^~QNNj<ocw=8y{Q3XCyN|&Wbl3bz{ua=>?d(r%Z7<V0drUwxZpT_oKvfQN
z%MJdi2fyF!=rI9RD;+&1pt`4{$7Cx51A`NI46oTng|U<eV)mH=28P$M(3<{(;eqDg
zANX4oe}G1!e<<;{Nc{N!pMT#3P~C2Mt%TD7QmMbb1-gdy&v%#uI|@KomkD&9cwuz)
zA850qGsiB_3~J|z7Y0}V{f~Ij`5jTsa@sJJ=)FA4$iUES3p!eYfxqPd<Uk9NouD!u
ze4vHlffx0CCJYR*5igf8f-^2SX+fCaGDZX}3eL`M3>^H1od-KF^BZ;^<3H8;f&T>K
zMZv?JJ>Y@C&N<*gJEW2YPr<^b2a02GcCKe&;DRiZg5~K}QHcGZ;oAlX6I47w3pUW`
zDPuK*2sAZ;>cuR^-ZkKsL1=FexajJ<Wq9DlVqH+OXx;;!v{m45-Os?lzzxYV{H>rU
z>;;c#)<d>e^+IZd&r7isX@-a}&?KTrgBNHF498l)lOrO%dsMzMKsR#rLb3?hrUjr~
zbKnfY7}|Lgkq2JtfKIl6x}B?(lN*u?N?2bsnKCf!x@E`D0B)JTSZl+;V0b%=C1Xho
zA43+)P7noNo&Z|IV9mhb+<b(m`8P-D-5uHg`50a_2|-TotPsio@eNPz_yAhR^n!))
z|Nl5h>MZ!s{O<#QizevCHnwKaeQCd#L6=~GPO{W#{=rmI`SLe21A{H-2txkW56qx7
z31KY!+uhg>K439C`JyzBf#KyoP><b@W!Hg3euf<kiTn&N9De-!-(U;kGnPt$4@qi%
zu&?<9W7>4d7AAGQ9*~AO7XEFlr7Ym<pFy2;iO!q5K-?V;AQSF>|Mx$wJDVx3@$dA)
z7A9d%(2Ds6YlTvk>AfvX^7Su4C0e($Oj;+4N?NzG9B6KgquW^lMDwIU+E!Bzq=C-y
z;h%Dd^8!eShXHboa4P?H78TGG9q0~eP?uf?G>rB=MMZ{xdyNWD=SBYY=f6K^Jk?z-
zVCl>wdA-O4WR5_&7-(M>2LnqvZ(2R5ac0jy{lLWsuO&gcyM0t-_}8Ck{K?3`#K1r2
zfWvF14U8SmlHJuZX`MAHJZatDa^2MmAhtkvHBYCFN_Q~$(09->anPCXpc37Nu|&p(
ziN6I@FM}ozJ5O}ysPODMX2#F(5>&SDU|{*p&~2k)`J*1BghBEGf74C|28R8hSrgFh
zc$dC^-wW!TH`=KD|6RvWuD=&FZUN@mGn6at1+69l@v0RV%7yoWF1-Ztb_+0+vF-)s
zE&lC)4KIEFzU#CZKg7`2<=}u5;BVaqj{AdYjX(dtFJrCW@&7$&wv}Z+Xh91|&t4GY
z<#f;@0Env(nDH~D*)p({8Kzx)aq($d^WXZi_pepDomtYltJ!v)H{)k`ErqZNd<Y)c
z@vm7xeg{P)2UtJ&YHtn(mj5Oypd~K++m8nD*Kc=G5eWzaMW9Lmj64_+obd`&&oX&~
zc4cORZ-GebbY@BGtY&LI0-Dp2VC3%ybr&H?hDD{@Tc$f&0kn&bhkv^)9}5EmX!3Pi
zh>FO;M=ZTA!nUAf!gx9DxU&<eulbV`vMTXarbS1vEBF#dXYe_$X`Rltov%8A?Lk+=
zdZ$^w<ez#V&9X*?2Xtb`p;9i;QTJ(<HYz1*5KV3!-X2{pDm)#|j>nuG7JwJ<f|AjT
zTwMkR4QHRUg&?;y*QiKL4{T@Bt{3n2W7+kjkB?zT11NV?e);#mJB+29?S<QwfB(DP
z1YVy04L&525me6`UHSLl@Dg~{#S677pqvQO$xssTV(ULpd$+<Je2n-D4M^)(a2HDl
zAH$APkk&9S28P!fi(e%0!wyh?(WA@2FrBf3Nm~9xC_h7|?DtT9h8Jt(LEBgtg4Q;5
ze$+f@c<Due?sV%8CR>iJp!FZJ41LoZI+$eS-s&(g{4eMEU(ONs-xQ=eL)D(2;l*ta
z28M+!ebaY!FliZk{`mJlIKu}dKHme>z!G_}@Z!J!|4muK_!%;?LE`Nm3=F#!!uT1Y
zA`QP;o3cz7?_^S{ziS4%{EVfXz1wE3Mm--xcpzxaDhLM!gk>~?G#Ys@Ft{}z7HK}B
z@Ot%eR*fXcy1iYXN!lF@4Ezi)Otl#pG+6)t2c7#H2Ri)*w0;r1GI%@aE<8wD-U-Tq
zS)kTDXo=;^DR=+>-@yecOJ8=~1uc~i3vPZ>@Z!A&1H+3NDNxg;R5YzybV>q0!yB8I
zC7fx;SwU>jw5;KQ7oM`9QuITw+yAuYAAkAVB|uj^f+}gl121&JayNE??)or1@Ip=&
zw48YtsB>j_;DvxJ14CNl|1VPft)K;rk!iM|Wf8YPl|C=%vOLDL#^2^bC46a(zYl1Z
ziewzM2lsDRg91X^oq-|tHGgne#vKq>2DIw#2v2W}icD~CiHb~EuaAlhXuZARffr%2
z(;K>&6zby*A;*=L$OgluA>Ae^Sq28sRBH2chlr@)-W(N~P?&yDxzzCDrwjvVPDdg#
zq7if`Y(tr9FhT`r)76XXAQdhuDhFT4Ha}oow4jfVAtGu4hyrbQ1GNC^TMm>6H2z~}
zU}z|pYdOH*D#r#rhh)bRdwz!9paVg7tpItkIJnnEMFw<u6W9x&6*~<t%4I;?AY)V{
z;$oYBYm__eVs!xTs5W>p4H83q&A(M36NSyc)nAM55`xK>Nii@q|JJB41?>aoH2k&$
zYzgG-7O>U3K=$th5v~7A6<<q%PjzWI0G8VgDn`N10$n_@6QngDI4BTwvQ0q7mL@)i
z40#8Bh8HcapoA{d`mKbmLv~>wAA{lBeW1p>;cd`j1F&~wdTUf<!eQas`QgQKY4CCa
ziKs}+57P~Lm=x+`R1AUx!ZM;jCQ7<8Fzl*x0B>2EBMCAceAHN{>6|`3hVC2{fyQH?
zp|961&9)#BhLWg^4v@ZwE({FK;N-)y5G2ujKp@icXps##X~3<2At22Fx=l?YV+Kgm
z8W)gL>Qxk)j|jld=qu&gwH+ikk?sHg7w+PqTu|ckqAwb>x*l}sSw@~XKf}vapi!WG
zAa$7_GpZ$`48K_y%kVe*fR=Qf6Jh+>&Db5t^1o2ve<9ERLXH;?KmYsh1{(0X`6Af>
z)H~;IS<J`)K0U0SVHaq?qw~j$(@r4ws7Sn+sQ{j1mN5KgU7{jU>;yi8r`JWr;6;-Y
z1LW+3U2**2gkbR^OakmkX1CXux<gb<I<KW2JO)}ZZSW!pWX!>|)=Q-V85cp0-Rlfm
z=b{Z-<}1Jox^y7z{XP*;0nmBE@Y45hpxZ4B-&*IWNbom<PMZT?2?L777d#M`>3|wk
zPM`~DTOWeXbz}NpqM`%Bpc($|5EY#lzd!v0ZS*zyU!nrX8Gk@_J2``5Q{g2jQ)DrM
zG=Xrpi%Pu)Smz;ZIt?888D4NYgR`Mcca4fe^AUyS{|umcgzgX(jdJU5UeN8^hPOe-
zmUM#Fm3{2|&3I7oawm@p=$?aa85K)ekc#dY6&~pr6_#RM#t(}@0<TrTmr)(-ysqGH
z$qKqMdLig4XUQMMJe}a%y*t6Td%M1T|8M$*J|?Gnkftm~!%IN{h6g~$Ab$jv?I6L7
zc#tDCoj~3b0i8dW!N9=6u!Di&&ws;9FYdet&GGYO{m){^U|?VciE}X+UV3rl{lEWE
z#f%_9(CJz)*1!Mve<7&804<$SXg(rg_|5P(q!n1-0qR<0`>1e;bT@+PknV{pVf+l8
z$2+ew@6-t6XAoYg1LE7LfNqi53#th~O{~9rLH%m!92J)0^yZxgVf+k?rJ>C=Dl81;
zew~Lpf41H(wdn=z!u;R-;DhDyBCcLg&y~^gMX^k8BghLN;e$mImectrFiF(^=;dR0
z@d6Z6J}Mk91ONa3zmtK1lVKM_0RzJh@cPlypZ@)Cy<MW%%VXSmYX|6-;TJnT{rlf}
z!|+lTli~mHuot}_z#+1ip`VYT@vVX*FGJ_69iZ~&#m02dm^3(-m4m|cf)xWpXg~%?
zNyapgK>cP128Mkge&_wpm!Fq(-fDaW;x!);*ufyr%V4`hgO{P0yPJdYCZk~U0hZVA
zc7mieZ|(p|*m_uiWephbG4g?BcYs7}LqNj3-5iV)L1us?-t5Tp;A5}_xv-d%@sKUZ
zkYd(ddG#KA42B2(Uji4Ekb)9aes><~JovH}ev%PK=V8#XYsUgI3Z3{FUVzRCi;YNY
z{>KPeH=ox0kBPsfjgf&N4RqF7Kj=)2Vy3k2V6M&!Y0VEfKz)Hyp8cSp1_$YDuKl23
z1YLg-!O;4x)U){!b6WE+rV_z4(ESFIX<j9qh6i4P?uqUE(R_phT<iZh{_p>b&&U6P
z7O4Js@e0H^)Oo}5GJmr&Bj{qwmogx0v)K+lV`=?XcVIf}Bqp=^PSCk6ou4{?yeN7P
z(%E{TG#1on09`%8!rzh(T9ESza)@vsQ~`erC=ozn*6`AcmUrN|eXRz{f1h4xLsfP2
zsFVtW4VHw8@V7{Uc0K+5Un0?Y<Hhk~paxxi39sehlJMpV0frLh&J2;x8?U{(y_uSS
z{^xIb13G8<Qa8)gC%t?O-Jqj5`K=u|O21lrXq0~Fc940k;MDw!we;T0!=UjOXQmgE
z!A9~=1>K?enz{MJe`v@YJ{ZQ!a4L+KVLJw{M-`kH#>+4-jF(|`7%ziEG%rJ4G%v%v
zXkLbW(Yy=~qj?#mI(QjWJ9rr^I(QjuJ9rtKI(Qj^c0jQA4qgUie0M8^{}W2P?BHcM
zx|Nq9atAMi*EWcpcl{1thL~-<41L>p86H6Kr)|6pb!mJIemL-4EaKDB_!yR?@iDAU
z<70S`#>enHjgR4T8Xv>|G(HC2bUud66bLR!=VPc&=VRF5#LuwBiJyUUuM<DRAt!!@
zW78d{Fx{KJ-IJMD`MeW9!(}IahU-rJ4ELQty(3V80>O_#$=iv4BBLb#YpB$FCw_*n
zU?Ha8PTRYtGD$JkCzWRAq{QbYr=`ai8k;gqfbffp5=&t0jDl1+J2x?<gkeHKVo7pF
zd_i(%Mgap<eKANJ!cGILNlY%tj4w_tDJ@`_P+pW<TohlNTfmSuAv3QeH77nZJq04U
zeg8BjSLW>ovzQDRw-?N2TF$6Ap{;>|K^Sye8R+y{h-Vl;ViKAR44_+^Co;-RkD1HF
zp^U7^)|(ea5lCOBH}6D7QHWY|A&6#>_%=_7+5=DnL1Ni!VQNL{#oHnB0!WU4iNPEJ
z(xcM_Rad~kzzAB=_W%F?cBt8cg{Wd6hl4OoU1tO@gNOhFgB!>o4v5<xL&WMCz;o|N
zf*{``d-ii3#9{*^53Ka$Wyls_U;y33&F~*$;P(iKm=eemBr%YAAjdF(*3td{|3CdP
zXp;v>5eQG@;o{}u;^uzM#Lw{0iJyUKdh0x<XhAM#eg-~geg<J@eg<)8eg>K8ALlXM
z7cW}J%fKYSz%bDnVkgLiI2UkW{+Z9Tq#kr}E9mlhMs=r%0A~gUrwEWpfHSBY>FF2Z
zBf%l6AYc@u7a!~tAK>h15Z$C2?C2QJ5g#1t$F+(h-q9t9hk;=gg9u-|tCs;|fU~O?
zNGfdt1Wo{%R>8o)z_=UPd{F0$fx*)+q#kTRbh8tybAY4cDuE3Q3~U^pF7fdovpqar
zcpaSsJPiyC%o#-Z<9!`N7?wB(_&S0Vi15b;hd6@x!68sS$N|m)u3jK+24^cT1IP^w
zpuHX-UxP5nSD<4IL2L$w2Mi2~3=H0jc^OI<LqhoHB3=et4_=0+D|s1wJa`!<dhkyF
z>&vV-{lNmJ6k$*$4cb)6(8tFBs$y9B_&^CbXCae>jZ`Wx!-EuvDYeeL41&(Q3=w4z
zzLGO9!?qM&hTvofpUD~GG?4Q^cp{_DbdzXCvFX1SGPzFI^JW&BuHeVa<~O19(343W
z2QR#Ae#qGTh|%I=32XBQre~8nP8?nc>g`>8(fok%u;GCQThMXZOr@aJAhw_mE+hYx
z1Bbf<SbDwwSe_^m4i5{?2<xBTyNJo!*}L=L>({NfOIddx_|3<_zfZX368KPn?f*e%
z?Z0mZ@1;E)+<Cay$)NccXBk(oQ+Vsi66RhfbN+o7I&Vb3?48cPm`S`o!I_`o;47KV
zpD*@->b6@4Ur97S;_v*~`QgP{sDKDeU=CD304C5472tshR6zweU;>#?0T!4*#Q*>Q
zn;-Lc-U3+>9akU!()~ZI<IT}|t@AYKLhY^)6`9VD;OU)%FIh^M-CzIE{LR1bR40#0
z>+L#W(7r{`h4Z`q{r~R`I`HB3%g!7X8PG}U&?@ew5XjzxorfB%7)qF(UjOL4pn2jj
z<3Y=VrObv04hMHhSxA(yOCD&RuCRoOz5Zb7Tf+m<hl34IcFAy9$#9kM@XrO+n!PRz
z|6j8^w%jg#4w4TG?!4S>y2BTA*7k+gZzbG}_YOYdVZ7GK_gbOz!odd|jgLW#WjSwv
z(nrItA3O{U?|1#-VPNPy@jg24Fj%`NMEil(OC>yvw+=qwVLX(^*~#@<6?7lst?3Ih
zm_?@VU&16JgQSofs<4CWwF*L+#$)E*$sp4^PP~hbJKW6+Gx=l*7vn{c$p^a`4<CHM
zG5ul&v!wLl&WqhBW}X5mIh5ATba=W#I<xZhhNVobND8<ZAqu)6@=`j?y%RyUy*b?F
z!2zDDZTQJlB4~K2;ip0=m*J(f<_aDL{;7vLFC1RDW%|RVOd`zJJI_u3v6M-pUaV96
zH9!BNPWDc@PG3;hMWRyx)J8iDIV(h<^BO;A=jG<de;^x!J8!)JMQx{x3P-OqXr`V8
za-7Ff&<bnN-Sp3xJ3sZ-m~gyE0!Op$|9T!!2ZDj2TwouA0}q4c$0E&RF6@kkua!Vl
zy`V$$54IBV&SM9k@%OG{Xy9S6d|CXg@fb+$>&wSnL^uSxeN;F)Z-I_Tsr>sNbY~b3
zXrnslB&;J~r@l=3`~QD1|MnYc-MoK1`5Br|GV*Uf3GS74-gx2q_y2#$eQluQPC9SA
z*Z~q?JaF;ft`7_h9t@xir}X##|FB^G?H_i64qX6WV$%8H#e~2A|EG1!f{g6EiEQYH
z7a#xp{}0}!xC=D)+xg)|%JhWgOyVIYK;mFCE`fFueu$2HX$f^4|8}tB8V`a-2%1ka
z?gDixI&Zv~3eo~9HK7iUe#!p#|Nro?;N1@1{0!Z;8q-fNXHrsdQQ-*y9YYNofdL<*
z4;dwT1Ud~js?k<uI`;}DMMj3{x+|D;>zkkaXnw=dd93qvmjh_l$`f?+DafV&PL!}4
z9(W15GoD$j;U`Opa=Bo`PsS3ZhM!EO&(hw$GzJYE{p2XU^|te%;qB%_EN@>MynSiP
z$iVRCCFss9h%TLSevmFrkgg5<+nHV~fsPtm*3D&jyW5Gyu>Ml#A;SZlCpd4t1dU8}
zGreZ!-^TP3G$-9{$9SE8n;!@NwlMbQL!e0xmKVEzgU$#6@j3XnyRmfse4zpsIo<G^
zrHmDH-yQ=*IS)ws1^e&+{~La@lvI_gH2h|S9NX0Jn~5KMhB#PZ{UHIc%A3Fc|9_p<
z@SB6bmGeK$4v19O@BjZhSyaGVHCTH6S-|=Zf$e{>{1>X)IPkD9$V=QTD%>F|EU$GS
z${|MCgKUxD-+th=FjN?H+ZW4=Szu2bFuc^8`URe&Kyd<ExCMz9OB?2r#D6FFTR{^K
zprB;}9ooiHBJl4tf9o|+3i|O5d`v;-kM}P@=kj#^NPGVh)M-XiEC^D(60Ep`=_RNx
zuJ5!0U7yX6)@cR4*N|DP^D26vd%!&j_H^gV7n^>9ynPzt2S`xQ{|O3erV<NKc+37f
zUFz2PgMZrzh!U{xK^}Yg2donmfnc#t`JZ6nB#`j-^XRI(eomjXipjM;t=mJOH;^$+
zIe;atGeCfU`=xG%P62Sa6Wn>dlSidnG@y--q4iQpQ0FnwmZaVocAj1xDQ#VkHa>>t
z6aOuBUE25<ip+ccIXbU@UIJ3m$=(~z(s{kxL<KZkz7V8;aR_Kn?v2GD_J3B;+1Z8%
zKwU1I|A@1BI*)Z;?G^=Hfv~W}lb@mS*A)+b2L7psTQBiXJ=k)(gtzru2`4xqc3%Iy
z)b@nO^#0XMO6vS4z^-k6qX9ZU9kjJ{D#MHCpmNV;DuYw=FM-mxov(VgPFLB$q*^c1
z4K6Pwx}71jVa}jqm=wC51whMUK{Ftr&4i%KPQm_QQ2{NZ1zj@?KDG*U0UC>Nxp3z%
z!%y8TDvE~;KY^1j$7^@caEW?3=)eHOUxuHKyQpx03X|9RAaUz*$<AM#U>%HyrtjXs
zWSA4u3M%9|m_=GYxbuUU0*r@tg4QK<v#4A?@ZUuRbTK;*sDoUhA^<WYpoF*cU+3}8
z5EY)6KA`=NJ}M%N7dyE@=ZJLssPHhJ>I??ykzqX8=?xm$Q(*i7y2;5!MP<6*MkeKY
z+h%*#vM-&7yG^%v@iTO@buy=QyRm?#jJlnfUIc+Q9R6S}yWGuhd7_x9^I#``^I^8;
zmu$_)*gEfjUeb9XIxhZjIH-c=-zEyWR-xe+e<^s)QB>zS{%r@cFB$ai0!7{bNi!ge
zN*;InD}apt{ueYgTi<!(|Hak=rRV;KYqTCHJq`-j|KXtHI`)9JVRnA_AFk4RpmaTG
zW~kYMvuxS_a2dk`AWI=NphxFX&<f^Wh8HV9=DGBO7HxoH_H}P7XrUzN&`xKIoq`Mu
z43|%I9`AOx*eMKQyQr}2WM{Ak9SzQM`9$ZjouCz7-OenRPk^sbJm2kYaquOV;rVWE
zW^Wb7pN7Y}ommdPU^YC)__5R5q4_Y2rHo4HlIiO=F<I0@R(68cT!SvQ23<6%13Hx%
zG_naA7X=MDf)Wd8NiwKz25nOY6>r}_O)&6jL6=W-g0?!c?Bs?y&SocQU>Bs|@(IvY
z^xZyN8JKytD!74@g^eLdxr5<h#?zotPyxdqAV({nF#G}DGAY7%1GGpLyzT*%a!zy}
z-U(`2LD()T4m&|NLBMz}peh`+)|K-hDD{G@vw;aI9_)5evEe+}>7!x;O8TISh#60G
zf<zs_Zg4R?3|ez80=CzN@vs}nAdsg!Yg9y<|2dSXgQhY;{s847&>#_X10WCRgd7(Y
zj!qesm)}4GFD@!Fj5j(#GnNY7CMt{{I-NiZr&T~(cR?Ib;??LbQQ-k`c)%;mPjotg
z!rCANbT&LlSftwpyxT|s#E}3kVrKl&=_J#9!~<019c~794j4*>HuOI$Fg)<A5HcMG
z%8`dHMfZ5|GZe{&hjkw7yx48KV|vRLCdDjJfx}QL*E<oEhWDND;Ahx>!Hb^(d@RD}
zrN^CEK)mb&2F*J_3K&YI_kjwh{Rcp5Kud`~FFoD>k^u?C#UEZ6!*J!_;vHW63=1Pb
zERdZGGeE2@)A_eDU3V-0^#4C|F<0kD&;hN@peoOq@5Q~3pt3($u=x-V|8{3SaJ0TS
z2@>4iFQEmR<N?VEfaId%;$Ob|I9+EOlWe`schCV1puEC($nd1)g%VaK4u{v@J5GQa
z)Cc*uH;92Q@I2hTQ9uJUFZX>Tiw5XO$7?Lz8#zES7Y;sPVf^sTfrqh#jeolX-|P2j
z-5W(T7#Pwz3;5DHCxV#HX`M4c#ze;*Zm2M4DB%H@!@Ckd_xK*(#-zl=^mY34ZA>b>
z9S3a$%6WHeWME{t{9?M)b|&fi!=2apw+HY!@o#rvQ9Q)I-C4l$P>ECLxq}bbn4Q^n
zf@bOsFTFSpY8z}17C87wpz|mHwx688It2_bbp{A@28eVPNEn{%^pNQWolR7rV0gPT
zLIt!W5#(n``4G@~xbu4FsqP#V&^DBe&X=H5N<j-Qow$@=eESYQ^nk7N$BWkxCRg(>
zrcx%*;wK*!z6DQwrq}Ia(yf;RIbqx3u-*_AmY`nHW$Ym;JTDS|LhisU1*Ji;X2_9T
zFRQ;p56DA4p(_M5Zpxwpz8&^#Cn(FZ^qOdB-fRACUk18>Mg)9fLg(?%OS?r>URZ;S
zc<u1|M(3-8uh_B=)gNGd(fP9Z;emsXI6L1rKeq=hq2TJ3IRsAj=Xz^YL_qcFF&7q*
zhVNHFD(y?<x<yoaT~tI~y#Mz9|4tjwp;w@jC`Dcb|NH;{wQ#Qsi>TqH7jFMRQ~EV3
zT;}EH4G-|2;6Dv2ra<#=;O)0DDghv4ghA%4_y(F?2VLUIGU3IHZ_}d>GO5(x_{|4d
zP4szb=d;d>;6q2>{rmqPe1LQ3{m)CAkBGqH0(7=_mjj0lb2*z0V>$P078`{UE70Op
z2k_Nf^ZtU)Jm+BIpL(Fzg+Zgkm7&|2=Y`<6|NlE(nbNwQx!NA2b-J>5JA*ccOTFgq
zE*9uyzy5g%|8{4d>3VyZTn(3h1;?iLF&7nmhT|+MkYz@_E-EabRyiMZYBvxRxJN7w
zgCcjy9wrMpQ12ol>KH5N`XmNWRo3`s3Mjgcbu+wB`Z|62ZYCp>-WU~~=3^Y4_d73s
zUefC%{o?KyuwBA1YZzeG@b`wONE#k^(erIO?;a+V`orO2&2L;fkHHp$gWCJKAYYe&
z5~32r!Q(C}plJXl(4{sE3=AUOY%h`^hU@g!s2DUK;{XTd=cUJ4R6q>@@HIVPAA$NA
zT80N+FoVMAP()<&iT|yaN@bdDROCv<x?NPbzTc1(Iq;gN^F#9ym$>+sH$Zhch&BDz
zVJ3Or)=RzF93`Bcr#fH02%pY&gvrPJ=%@exqgoF@2EG{&ycPvd;&ncF0otM4dZ6Uc
z4k_@-VW2B9!3Ao^1<)M-^rpQ`f%V`ahzX$kvYUVLm028o#KL%}lgaRZXBA6l6-W0D
z&;`bZCtLsXPd(Uqw(%^J1Or277LVcE&J|!i-x)i>O1i;Dd~;C|aVX*Myn65{3**tw
z_nkLCFL}+^dGX*w7RG~}hKAod3t1pGL~$6NY~CROUe?M#^&q#8ib$sy&;JIHp<p)#
zch3M_9+ja0x=J|&)I^#9y861i1Jq&acDCqc>F5-Qh(7$H^~HbCp+0)YS&t<0gSvqX
zh6fh!@#SY&SO7W-CV;V16vSvfP|6Lxb?t=1v%<sSVH+5qZ8n^Kdmob_W7_oi{Y+BR
z)%P=*L)hB&Pe9F{Z~PsgP6Yq<Z?MCLQ(yi6-!1z9wCvJWxUe*3R|Ke!@Zp8zE6~vz
z{JS1V@;7Y<tvlX+d#4uz1H&%Rl`@?-UTk~$|No1i|Ns9to@ZcSVCwt{*ZA`P|Fngm
z?r?8_#@pr-jPGBZ{`dcX{Z3Fm0PB980F}=$=zR6I^Y{vd(nx-o@t`%soi|=YfQ$!S
z-_-e|`GjKUtM|J=U6#%dV0)WS2=H$|0TWsI;{X2_nV{SbwgF-QD9B$5zl7Y-0cwBO
z2RFY_05?!2I(<}RVEKT@hN(oU`NaR1prWzYA9Rc|XbGCcixoei$4<NiT}QSMdSlep
zUJn*#R?tmRpmtSnIOxO{@F9L+1>FoUKE40{-_k`zq*#Q1TO?EGjouPT(3W8i%lZ-(
zmSP@D9~Bn<7Ep-2?grhc174$1$;`mtvJP}US~q9sInc~^T4#w0li`8v8$4;<B`Qp5
z)|)}=VoR0yw>2|+f~L%wz<VQl+d(-1G%aj-qgddj+5i9l!Rw@tzXaXP)Lf%t!cfYZ
z*6pLhl-60#)$0V(B(NJ~6zIeWrZj8jQf*L219aXJX#7N=I|Opn-~Vf`h4{C5Gw=Ej
z+A{B=BJg7JxBvf}5A!ts2DPnA54eJk+XHVT0?nZ^f`$Y^wv}*pzIgHR9q0tQ&U_9~
zkL!ZwiRL2;pxB5#++YhX+xS~Rr?7^H1vkC{IluF8=ef@3kelxhd|urt1FoL37`uB^
zdO-7gQ&c(_8NlV*3ro=O(c#F}0~OAlhdLj;c>fceQ`lcHO|Lo3B;~>S@Bjb*TU1&=
z#pcIO(Ba-3FS_1>8Xt{EKvsdO08pFbSm))=3orPefwl<*bl%(rI@hZ6!wV0PH$daA
z(>JVU@-VPb=`JYft|;mJ*!i1(%}-(eHJ^o%r|9{Y{AA`|@|oG#M}@;UMulg(%^D_Y
zcF-skh!eYp$xOyag+mxLq2B=-Rq31ox+Jyv0EZ=u3V&<#^!00)rm=!Nt1;bcEmIVu
z&h({gnVf`mx<h`jbhG?mX8F4SG>stgcggf$Yne1yRg_~?G^VSsV_MFrGyVKJCQW6X
zfRf<u5*3y18WoMs5*33^(B3r@5Ery{Tcxu`MPs`3dZtaRD#9Tu8q+VWXHu>QHAfoX
zfUZpdAD0XA5UAqb$MA=b0esEu=cS#OyIEA=?E>ju7ZnqDy8v`p<%?IZ|Nn1>Gz^*_
z9q4><@C94v!GjMuvk!n;2(OzT+k=+zvGvLv1T~<q_137EbRPV?<d_SKNj9uy&|9J+
zQYs6+$;0Hutk=km1CtkfKR_D?riPbZZ1@0a9I%;}UjR+Pzu*Lo%DAZTbcU#ay2Ux2
zAu0t>g92aw|KIDQV$#j@g6ZXSxm`?(^`V_l!^47`pZsWiGlL1dBn6}qw7FjZ+ydeN
z^$U7UEI_TG`ZADjCBRo^gIhtM_Epy}P||OBeYx}J!I$jW2OAiFG(T@Jyv@JlG}pn0
zpgq3=&ClvVS(XjdRcwA#-)nLeG_k?>vH3DXJ?N;C&KMPu-WU}La3A7d=Y42sNHpvO
zEnLyO*m|;F8kD0tZ@iENofZR1E{2ytr~bZ&1Ozjq;iVV7@1X&aUw#SH5A6<75qa_G
zC-@*O&;f3p;M+hT*FM~MapmX#|Ax1_B|)dzgxp~1X1VcV`_KRXyFtrpS?+g++@F46
z2a}Yj0w~@=%TJM-PTQxy-@zmokbp(11ys(0ltWro4xlWR)-4LU0u!`GM}pswe;Y68
zYEAyN7cRg0c2J>&rSpQ}rNiC4C2iAJA7OG<D{13n0L^Q>=m525*UQcU9ou&!8k8>&
zzbF9>iyZ7WoiknJC{sS8&h)j(%rf=-%?CMlg9hXGfyS?2YdF6C2s(F-Llraw2<lHZ
zbl!U3`6=zK2WS~znZ&n)?4`WT2RS-Vq#b<0QF8e;v*YW}%_skNo`{YE)dj(zVb9C_
z+Yf-o;*WP;YkUSC^*`1KI_tAxFUY3O51={+WZm0NAr_U+o6QgZG#_MXd<a(gbGpJY
zCS!ku%H1H9ppN9N_njv?U%dzSGjF}`{LyltR200dV<!WH0E6bieGKw{|92k$yaYPW
zaX7g1BLDUqoi{+k{0lRfh3h*{f!0Pe9{R)crt{PafzBJH96P^l`u9Kj|HJ5)Z1AZT
z9#HnZ-g%mTpLok9{+1{v&^4Q?{H@lYldZ}bkGZI@D;S>S-^SJ(aG~KBXSsCi$x;>@
zgA&f{lU%(%j2B+BgOnH;o^*SC%kYv-PN`6r8>3B5$#m1>O#Jn^_3k!${4EO@85ruN
zY*hJMuYuNEflloN4Y1$2_5c6N>x>KxHW83>I&G5qTepBp>1r1KeZn9mJ3&e|fs_>U
zw={u_;j}3ziFnxu5-Ke*vZ>&20iA>RvKCavTen;)Wo<sp@|wB%Fh}eE%6k4?x}che
zMdd}|t^fbO-|zhOTA-U5SrueLAp&HLAH?Qv>4rMSfYNxkZejjy*Rmj2R)Qkp#e!S^
z|L?K_83>wmlE3x;f0yuqSIqp|E+JHLyr=@H0<G`tcBxn4c<~c-LcMVFBX-cZjta*M
z8<16?%dU4BfJ|ahd2#*b|Npx{bE+T@pSlS;Ru^1?c7iq=v%Jv0_5Xk5OVHL8n+X0X
zpxLO-qurn#>Ky$0TvXUwE|nPcR&#U*v$S3+(QJOn5gGs*k$BO2>;M1yP_RLu3=SH`
zc=7Ni=p<L3*Xh00ETI9QQU<Iv`4*^ddmY$N$5>qI+gr`jEsZv#$PIFu!A;PV;ybt3
z8ek=mxked~j2J{_7c64gK*#g{d(Bke`MbA{@#SpL)@M+K7$1AM*GC1^IAYns;l<DJ
zqWJIs|G&Px{u|tRxbuN6XysHHSH^-rd<-wHfYwt<fctqn?)337yx8>eKWH%(`!QA!
zm+=_uJ<!fy$c2)iG10@FSGya){d^Xc?q(iPhu@`Mg@u26GpJt=T6@j~>J0X>oCTGs
zpuro)3!p(I(5ND)6kq|>F(0~(4F7kQs7Q3ysK|6zv4D0$^KUQU>nu@Gu?$fWDN#;4
z?!dzcUI_~tJ?%8;tY85RrFIr@G#}#V2A#vQ2~?&s9tD|M54!Y(@dro`Gw5!ZPRP;t
z-JvX<0UXUoIrz7G@HN+{*f5rG9d}UyZ5v~FeFCJKi6O1C8{}?Kw51(yahA{kxf+xT
zLARk8Ui!WnG`In3et{OEv!r#pgtIgs(Ev4&z$H`XF;IBMGYBx0ab+9<1!x<n(Q|nL
zDDZk$GBAAn&%fRFK_4H34O6M?!RIWRe|CU&KJBasV_?{Aki@|7Y}4lnUl{+qR@yn`
zJU_#~6D53*;U>ls)}8g|K_^-73Y-4>6q9uQ9Ct>B23yb-(F~=`pC=sN$=3y1!Do2j
zW!(S&|ARXp>^_mm&tMBGxXRd786anv-*~a<+W-HJzd=%^Y|$@w|Ns9V)M>c}YKoPz
zzC8N>|9`^+i$Pr%Xn*BDq`%@(`WV_>d9eRk;p=O`^)IYJb=Tp}8!yVh4Y^WwaGmh_
z9i%eoywG{7yI807KnW-GuHe_~Sxn&hw9XGN)_|t8nhzU*Z+k3!3YvqPCI%WeY6FcT
zf$rN(vpiJFvjfz&dol6<|NpP=b$)o^_w4`w&KuEjFK0dbKV9eylNdXw^)AuvI9>k?
zlL_Oo=_zNJR1753S}&D|fNpTM1uZctW8DFwIuE~Q-3=NHO0)c2l-}#3q5|60-udIj
z=jmI|Fj+9}n*Qz#lWcv73R8(7sQtr~W_ho84X9nf^m?h`f#xGN;8<?7J(I}K0K%o5
zu+V3H`3f}MxNJK#{H?$<jm>WaK%H5`OD~i_VGkOk3{e5yb7FK4-0NrQyzxRE#AH$F
zeDFf{-v9r*Bv@4$7~X@jHvhf<|C@g>ma&5;C||#62F-#VZoO2Z*lc^iXZrfHOe%q$
z=Rj<J28I&hgAW9nPjGb}1O;bw+)L23>@Lvq+O+qbr@#TW<p2NwfuOMhCeX&VBcM~y
zN`!ZU*2;sM&%G`xOfQyAS31X}<<WVl^+1Ud)aX*q&V#!ISs55!Lx$uG54?Q%@BjZd
zo~3^dr*#G>q#buqV)($nT@;k2!5wSO6FUu?_!(Y)nLgtjleTo&6Ua@%Y79)rTvX)w
zI$~7hj=87^vF}Qle(xNU7%%9kVTKZZ=okRwc_yuTa2Zwq{r~^N84X_i3>o)98R_2t
z|Nk=-K-{k&?s;%)U*K>+PzJ+aK86?j!F(Q2)1>uesXWyAC0wBKzKhK#C0-luDsks$
z*a52NUfXnDfCbNq7vQ52L0ia6v>>|b8A^n}EoN{6x$$Dg-~az#^Y2OlX$SRbUUY)G
z|1K&V(IDGhK(;$UZ4U^_C<pP4p!_E(E0{_QgLez4GcfEh0__Vi`TGCAcL^6r0<`Gi
zwa~6D9{dbDOhIy>6(G$g{?|tzHaq|tLh6lR>%5irw)6Oo4q*m{7uBEvons)8G|S_q
zDxDu*9QXptwk1NlmVnFvHAX=Lw-x{Y|9^4d*Z=>oFN4~5;bFnu1rpu+8bEh`fekVO
z8FbhZEK;h{dE-R|%$x?0Id-6HXg~%TfDEbt8FU3?P*`y1;T<U;hkp7DI;_9jS)$v4
zWraeCc;|-~W)LIfcSTIUbAd^&UK6D4=nJJ^pzB5<>PlrgKfL$`xdi0dt_YA-p#6l=
zaWB_{2JW3Djyte`=F6e2yv}2t*E`QbuFcH^S$G(9k!|NE#Y3GxEl!oP@^3rvTCMZO
zizN^fMRw_cOw<OsFaBR5c=+@+`-??C|Nnn|9GrFex1TV)v;!0jFX#RTtp(^j{9+;K
zZV&XEhW9x@ZW{i^c;ZF$XV7WIhoj?O?gce?w;y<M<Uc6TE2iJR$RuBXtt-Ny+d+qa
zyG7@Z7foOp{ti%y-ubsHjJ5fZf5UG^$pg&~J~Y1w;Jnarus59TO~>Jm6YmUftPm&-
z?eb&mb!ANJbWvgIt!3(sW$twaRVpehy{@bvQMS$#s_#Gt`TbBSHSKa^2j2qmuFH+1
z^VhpBH_lF<TkpEuxIil<-gUWggJjv>z2@!w@q!)fl*$FKb-UO=!c6bF+!(={m^wjv
zn4x-DK$2|ldPCVePE6l_iAg@y0yHel0xp3&T~yfkw-<ADYlBOQ&I>cY{{&4u@oxtm
z7s&&f-06G|GAQkHZa0ex<55t>$krRc^afOazKH$@3aCo9G|ghJ*NUp3b5i_D1e$+v
zlpLLIbD2r0{#tj0PIrJscZErJhC#Q34QL1AaVGT!&<s&$6DXn#4|Fzxy4|3uE|1P8
z(8xpcKX8B^V0B<%WH|VcmGfZpN!CtZ2EzlLt}LCQ93Yyf+nEEBgGE$ch~Eb}qeP&)
zm;==I0$oP;@!tRc5#9C999fLuy8%FccyagM|NoHG2I{hQ9*saY<T9wB1`V`0bvtu}
zfz_`C8N$EonOw0bNF^xcf`;8!-UH3D9C&U2{TQftEn(x|=C1VGu=yEi`eU2B(`&WP
z7cZ86`2WAP{y>Syt_Pq}1+)e8MZ)j@|6j_3c4jaB_W%FurWFnRt)TT>s-S%ipc9WA
z_*<Ak&2486@NKss%WUuc|KDBA(fr^a%xe<&{{N2zxd+sU11XULxo6h{{$lnQ-XL=y
zgCxOi;Cd027k}@9rcb+_IfB4`x_uXvU7=wYqQdgxF0wqwi``IpuxCS5I9}|%`~QDz
z)QXN0caX6<pr*Bm%8TV7UB^IUQ=ghoF+z-P0B!XG&5^wbe*gdfi=FTPoBjud<xa3B
zkXi9}|NoDR2blwNdjiP1XpZI+j1ceLcwv2adihl*b0J%h42uf?b`LJlMoNZqgXssZ
zGRX^qifqdZpm8|{X%`iqV!i3_t}-b~H2(!Bnh(tfOkZ<DIsckpm`zu_#^hXo;m`m7
z2Y<*nKj3LTA^|QcK*KD}Z)7?TcWZn<3UYKQPxBEOkkrc;pfeI`R3PK&oyR^eUHB$}
zA9OD$C})6bSRqCR5XHs-TGddH*6pIgmS*kDRa^jGpww-n0=kqLynw6MMTO(VjDPi@
z^jR9xcocLJezS{;2xD`IiUdR2e-{<D*Px{(AZ111%v7oeHl*`?w~5N<rC4>qEi5_;
zYPEnJ4QZPm@4V1?wkt+O<b@09UXWwm?20ceZj@-ac7AwK{ubnj60u!Ap!66BDnyNb
zK)3zB=6q57`Tzgd7r-;-v4=B2Iddmy$YPg4Dfl{@EB{{1p8oJUQ<x=alCoQhf7^wF
zk9fM87#ObnTcJ>@e2kUB;mSXSW2_7Y5J~|;2|y@@EB_RxC*EMvu7B|F|NkgZ_1Ad_
zWWXel0S%87O8Fg{f3TLmGCc627~DXGc<6BFwHFuv|NnpR0go!f2Y!a$4i$zg|9V$Q
zFkJa(c*$C<n7@m$gGJbhe_Jg>^K;O2z8H!ZK>paZp^zK2cJ0c)7s>yo|GB~BTHh_Y
z#gm_*TcjzA0o+{O;lps{-wQU7(+)4(0FnyeIL_+8aOEE;Wxy1H_%9y*{r^AeaPW&i
zpb8DV)}%X#1@62VAcq}m0Fe$^4&a%|&Kob*g7icmesKb-r=FjoJBS0ON%zHnZAM6l
zgPi-K0i+r>xdLkKyqE~q2by8-7MTUp){A79LY4ryFzmeX!U<V7tP{u4dA#%53olSd
z<?zA=Pmui%JTLM=GYBp!ETFLsXz;E81uxh^pk)V_K(lxZ2VZc2&NfJEJx~fdB#z}p
z^($yfvH_(e6;OF*_Vxe&9Xz08vQ%D_gWAHkULUsnTq5e+<s$#T!<C`)gyxMj#tWsd
zEkBn&HdH<U8(e|pLJ`nV$z@0r=)_BK!y|b5##>DC^}-;tKD_t{>Y^Sfxv)zCWaDH|
z+FkSI|Nqy@-OgP6+XJ``K4M`GVCxRz;onxl)A_UcA>+YU0-%M!r%J?oOH^3Efdd{Z
z@BHv$_4WV%U)%6+FW~C@dhi(wa{*hgFJqdr2TPje%VO^4PmIma|8f562;fQUtoPtb
z>ki{cvkvAfVM*%@=HuUfvYVlk13Y)#ZKLveDR}uJXzCJn#gIVf;m-4*?rL`q<RDwl
z6DycY1b69xT)q($R%xJ|7TI|XJi((KqGABLhv|U+{}L6A7t+^3*SH&W2C#G%XmnQ8
zgDyns4gKGE3bYoxGXSde#k6xEWjf7=^g+{!FXsRI|34z_yNe3nKgJT~=Cl7hUx0fP
z@v-1RyN&>T$f;JLFF;}2<*eUwpaj%Xn**81dbev1$Z=~Kz_$v7eg@6SfHij3U+eZ}
z;otR8yjZRC!;3tKa*<tgK+UjiAirpShP1+zU*x>||Nr$x!vo(BGBA`eln4c890WC!
z-9CXvKz4w}{h^J%#y6nuc;~Us5ETv3;5Pqu2hd6?9{z1^paatc__xKe9(>Hszs-$}
zv;HvuwmiPx8Wo%7=O3U4|9Ad)@%HNf{|$9)jFJabSH1cFpY;u>?OgR7+~*SMtow2B
zF-K>N3g{LA4u%q&UUz}!6D*zVoi})O86Gfnx`P&oaCEx!fX-(EnZdxo@Q0Owp+Tn8
zodtYw6X>cw1_lm>*Y(1kFIu3}oChBWgQk?gTjew$SBlCsr>MwOG`pzCWJ1jX-OJgS
zq5`Ts|1`RQ=mweYH7cOFE6}ZB3qi-0IWvNmiZwsxKlqr1@i%A)sq@B*3E;w?zZImi
zQwOwajK}h5T|M|NVHXvZ<_G+sH5Na>+w@9#!G#uRJlgVV9V^Il2RlInNgf9uh=LAR
z0Ilibya=l9IWKaa=yc}jZczyU&AB*(mcuA?I<qvEsIY*12x`+o<TQ_h&c1ya4(ir`
zyGr5BkNNA7o%sGQDBJV5f=+cg4r-<_fDV2J*Sa07pcV|++6%l43@`q7I)esef-!=a
zrPCR_29AM$svBQ-+>dXE8Tng5r5<QG*9*aCAR9{jc1-{!uz8FO^$ai0eE9#ryN;(f
zoGI-s|MnA|ztY|Y@^3#706Jpq!~X)7;9j>c0U38dY3=^||NoD>{Qwo&{M(Pexbp!t
zCMWS)>BZI8|Np<9l)?3nkKx5GWJPW~FSdR7|33npWg3rw5+<kx0Iqu)-?%UagEr)L
zhNy6Kp6@MDQE7hmVJB#c*zi*4hZnh*!3`-;8(yIGe~I#O&}D9)I_p?^-2^(_IC{g`
zJHvR6v#5ZYh~TB3uem!v9A{CPzV<$oBr7NsIHsSz&m>jP!@u1}Md15Q&^$!9j|z+B
zsbat0K9D_@CyID>6@bFx4I=}?>wwOyjZgpcGcfFAP+(xteA%6&!lHTA@?|X>XwS0Z
zS@3`xM`r*_^8tZQhaZfudcFR4di;64s`Y<~NAEPSi5H5*AtwF>Wnatp|Nl#aCRaf#
z;6Q1MQSwsbBT&L<e8s@<gJ*il118;i8<oxq4$y7GDEaNsV^Cqz?fj$p!5?eqFD3S!
zA6~FN0Y{+jt_+Z)4}h#V@b3Tr|HXg)7ytNQ{N;b~hYUqfEWCINiW?Eo`UcJyuU`KD
z|9YF@fky8Splytx3+X^hIwar!|NqkB|Nr{`jYnJ<L1h#49?8Zx4?v0eFnD^&M}?*N
zMF42Lu{TF0q50{7P92q<4UC|5N}VrW)LewLo<Vz2OB{P$9XeeZj=QpelE`sajs`vs
z&}0ltuP;yM_2%OomcNRHI|UmLF$gd)G(KVgrJsW=uj^leR%3z+;MZ)1pgVUtx~Hgo
z0X5V2sDKh1<8{!XC59(KMF0c;)Pn~fg66Iy__v<}$0=yd5s&4k-n}44@i#X!FfdsD
zDB|Dc0SY1~CI*I=t)L10>y6JLQ5(R(p!pLt38Z=5@@Fj@=%7>?#q-Sv96B8i9CtVZ
za(d^_gAWB7A2KlfukS8Vk>LCYnzrKn*m$x5v=hSPM6bsg#_N{9iba|avUCRiLH5w=
z7oEReW<xSL3qy&c<&Pq9h*LtC7#Lo#g5u@G|CgX?<>TO`4aXho!NCRc9VB&tt^j-0
z@cDl|XsGpo!*K^tJTr7=AHYZ=iywj}nn8_-0*>#;K-s(`r}M>&#}C1&B&xf5Pj~i-
zZtnx2#eTaiK;gj(a>T?p|Nn>mFM%v!4GiT82UU$3UZ8Zdb$Y^MCJD7}<`-rlmmZOM
zX$Km?nEm|!|JQBbkAVjNO4P$Lnm}sHL29MzIY6FeQE{-eQQ>d(0=F$2kAM;oIH!jN
zcV6y1*Lkq{;or38pM|Ajy_1fB#>Nl4@BGkwg1L7xC}+Hu?G18BYyKhH`Jse8t?{QI
zODV^}7tGBk7(pwLncqY15$k^d+E~oLEsUw**Z)%G&KobTJox{=zV$$f;4TS}=fLfj
zeo$E?|KjSi|NmcKY51jEBGGcGL?kFIV-d*B>tBKL1rI1+Fo7DfhtnD@LRXbKg$0A|
z^^9OLywq~L#Qfl6&dyseR-FA0xlX9%K#2<fwgUmdVHux6hGc;a5iq>eY`ej?9(4b}
zltZsUn{q&laKU9;U?*sX{VJqYa1(UzJBvzMw_RH6-x5~-?Z;o+f(9rh9)P1si+}s|
zApY&QgTpc=flf-|ef9tUt{zZ>VIHU*b^u}-$i?h07(l+-23e3D7Thg+!-v0~q4hR@
z%T&;EplX(YkRS#AR?r2_jn+ZIE()b}ork);1-hLjnyY0PO3hjilo&NyL<GBplxlSs
zurMBLKA>Xxp;)e4qPc>Fp;WN-b_uVga4BbSP{!r|d<?Hmn-6fjzGry5^<;@zqh%0C
zpI&z%3*)(7N0ryi%?DU4KhzgXcT2S1F8ORJT>3sZDB}&t58f}q!Tg%Z@HS}d^l<Qt
zFS|jWEw$^G{Q+8rbGwo^gO!1w;f3PM|NkRitMhNa4Q{S=-gvQd-~a!+B0-BmY|VvA
zSiv`Qfi|B^+YcIN-wC?kXIC2&=yWI09bo=0dqD=5uxCtR;%9g*$iGdLPXII%C|}N(
zv4)AC;l+U$|NloA9yq)MRO-CAe)|9ajzeH}%cT<bjDsLux2L;2W3sabZJO^qbnq2d
z^CSCiKaS>KiskD3pnktww^-)|g9E)gKsgrNHvPO*^U%RxEKZ#h1VA;1&GcQ*m{f$t
z55ANL49eK!&d-p+&cV;{;@$J<pPn&UC@6yR2xL<?XjHQEc<1HL6ECd6ef-WJFTPFp
zdd?(W|KUaUU9e|Fc3l9)zaTRM!wa<+kQN~Oi_FLW|G(Y?8b*Y)>Nz?OcZ#TVf)2O^
zm4OOf4lFjzCAu~&B~GAgcfb=tA}Tgaoi|E&p#6cDx4wWP2C}=n5VX>=L`4Cruv6{^
zOqK1=|NncNK|M)Oi>zC_^(22w%XG#UOk(xlO87vh%Sj$cGd#fRz`@KA0GX%*b+DB$
z{Qn=(`mID3p@M;jks+Y-W9KjMbRE-$|NrA5lB%GMm#hi`3=9E=CqY{RR5)HdJ`ZYj
z3v_$)bh|=UgT=k(g=%Jbk#OPv{|2LKHb%*ljSpA7`TxK1AgEmmYK3*ac+m`6Q}=_B
zzs3Lm|Nj9QYd}$;1&RW(=_g(=8Ko=+vF|+vHI`qSb_;igain#+@%6eH>|$(SV0cmd
z8x-&rMyd=A3=AcbY29%~yFl%Y&JQmheER=CtuxLDlmms*j=LE!GBh6(0H*@b5&%Se
zNK8+B$s|_aU87=<)>*;U`Jv&-zfKkvTPq0$2L7oBcB+9!A!}3&80(op^U?<nK49TI
z(e161*6GOe&Dnsdl=<Kz&fXdo9`KrGL(o#75EYJYXC2VYW9O$Apn|sZ80fS?(CG4h
z0Z^8=Q307=!nz;SA_fmC)~m4m_kr|zYE%sV_c|DqIDx|GMdL597yY`Ob<#R33=9u+
z2kSIK^>cOyDRhRkGQ4K*_GxA4^ipuJ1=S{{cOc^<uh)Vz=L<WC5!@gnjyo7IF}!B#
zJO*0T2pRGTexbSjzbNPy!=mOB|6g=~?`dy6P!ZXAWBR(IOcM2P(?GZ7necBveei{V
zEoi58DLXi;zvi(8?XfPEgyi-UFVb%R|Np|`=>Pwn;PT=%f9H+Yb22t?@-w{n`S}0;
z2w2Bkr}J=k2Fp&+ak7S>WwpF7t{(sYe<!G?+zZ-)dE*7cDUi1-`MaDsxSEgXfGVYz
zGmlS~e9ff9xqT-{j(_Tb>GrRgl$1pNK-Upxwf--a>vq-2;sq}>HarR5zV_nF@9E92
znUokWOkehz$$<SP$TjaCO~3n^Nj>7gvH$;%xu`HPf(EWw*52!ObLenU;Rbh%dqY%&
zI&ZwVaROu;*d@(JRKN}?JO-}7-3+o6!a>>Kh1PF~6G}ugK7owSn;!dyNm|kO*#H0C
zZYEhu;V`$n`2|{?7!lR_zl1%5lWY3SH%!vn9$fqk;6rJ<-7NUG2XpbSzZ&%47^Y>(
zumAreqgxM@7-YzEO~3z!Nz$V37ijFU^*{+%hA~JlDD(8Xs4(pWZ3GAR=U=Qk`u~4-
zoJp2a0Mwk$8!z0a8@y$bU`yrVXLwON-R~`vT8s<!eRos0gZu+J`L2Zhn~MrBQ>j$O
zaga8(hoCdC6}%zqJ0o6#j?_EO3gdU1f{KT3TNVaJh8@+@&%I@`W_sZ@o%<b=bp5v-
z|Np;exDT3BxM3{|(orJcsrtl=pW!&`3om}qY%{~>2_N`(>4JGhpI_g6QG4hA|4y)(
zonSNno2q#8GX!UR068V_0jNymf%NDPgEmMSo&>L(@4WHi$(H~BcY!8sK=HQ)w3)G<
zfnfto_V^ail7|ci28In8(LDSN8Sy;)3@?}-fV>9U$_kPI8H-puzyex3P;~wO|HEOy
z3m5qEGc^DBU&@=Y5v1?>|Ns9ZUyJSp9nw4V`_F)kV<6Fk|3PI|w<$<*=Z6=!*-n63
zL2lD^-!mzAci#Q~|Mi_0O(5!L#ut!!@YI#ZZSdAe(CUI~o#zj}U;!Owawvd*`{95L
zHc@_t7q0gaS8}<i@VziNJblJ{CKZzd;9DA9RD?jYwtApRT!R<pC!wR5FNAOY{|}y;
z1m`ur7k;<?|9>Gd{lj}Ex%!nLV|Uy`HFohK$ke3~15;;=ieBf34i^<AP!7=wU1fOS
z#p)ZV<~_R!iU||&Mq`lM4|iSzmzrSfm|lcJO;clF>WEPh1DV5efE`51F;4IOz{Fmk
zd;zqv`O=HFyZ`@xb5T)aEMd?1C(6(8TBP+`iF8_{?Y~+EhR{_d0vTFj{0uKdLE}0v
zLFY+AS7w%E?|LZ8&(QF@p@enUK~dOQmx^cp|KH&Y(qX*m|NjiomeLG{8U}`dogl$o
zpaodqLoqd9#GU^Ce@7rlCD*3^|Fb+YcGQBDfkbwJS}u^;c#G51Z9Xy?*R!Z}XRvg+
zGT0RIw}6%bm8;k!@VBf5-TNzO6Ht<G6Ug5Jy4CdM5mp8Uo5T{sm%*UbLlgL0K-UkI
zi`o?Pw}6g#vT5dTDFgL%yg<?u`CFziGcded3%Z+yMFq6fpQ(i3hMB*$iwk<$?Q15(
zOWiEfWj`_T2p<G3^FdJ-JDvX%la!O*lmGv_!4ja$qMKhZulUQ~Qozl?&|PZL8|DBm
zWI^rNO@}}!vh@Ie2NxFu19(gp+<}ijFg@oJlWKkEga7~IV_OgKcXDttFueTA#lQeD
z)`qD>9^|ZDplgvpGZ7A4Y0W>FBrh3UYCL2m$-wYhv>QWMhyir!WVb(0z<=}37cauT
z{r?{w*LvV(EE5BRO+l$bH;YQ+5zrP|Z~=Sz`~Uj?HVynONvsSE{Ow*W3=B3!{H;--
zGe%JqZu{~7e|M=zcdScqjY{B7V^AOE66pH*{r~^N3h@+>Z<ieemE!yz44mM*Hv<{d
zx<h?BLR5m%x_$jRPo*7v#nF7qp(8{kxWh*!q?<=YjDLG37ytSfohM#IZUiq$kUY?Q
zfNA=|&rDWg0lgtApj%&EuKxeud8_lo3*No||3^-Lc$!HjQs+8&&Bl!vpn22I4=>F3
z{Rf?x+|R(kz}2Dxy50TdOHdTonsl3Y`*C!;fle;v=w|DV6X-modF%2k&>D{5fD8$J
zeuftXw?J8o=cPU;1H<%;FHAB#bqB!Xc`Trao8JG0NzzpgWPz(;hqIO8flg<IPG^Zu
zXPINp76QkdT^NozJA%UYh0+F?A0B{i7wU9YfyNPNXoY|M!Rhb5FqtumPgniQWSr{B
z#=!8>i~}6u{M#JB*Nr#7U~2xs$lng?A{riOs8Qiy=AQyugdza${DXF*@ox{{>bzhX
zqQb-9%f`mQpzWf<0~!Zn>GlQfedFO@f3Vv|g_#|^RgY)-fv-#=5+N!qmKTay!OB2~
zaDq17D}dbd<|~sbQ|F24qTiVG#bz-uFo0T6lR%B9f1qKWvVesfrbm5al4s1AUiFPh
zg*ilpWBUAWOgh%fpMZi);B^`3io^dUDk@nFukV9<4xoiGoyXEFT~t_#L5rwZx<xm5
z@q_Lw<zVLDeyo&pI>&b=wR#Tb5-CvVCb2Ovbo<)yuRqak3Q`B!ulbq-B;&!xz`*FD
z!t>JP-~azzE-D-^c|kc{u|(yygiRBFi!CU<w(z&y0@029Eo+#d#}2;K1)0gB(p|vO
z>-HCvF~!*!7{FPwH$){6lu)DV_k!|e=ZDtY{2kjt3EovFt=l54yMPI-4t&D}XlD4u
z_g$bC?i>}+31Y`uR6sW-F6eb*0te*=$kcf66cv!t&KECM+ytfnQa}Ff?>k?-sDSVs
zz<VcqOH=|of2pN?&IdI(-}raFcmY~p*Lt8rvGW*s_O>^i@y%<I*4w2#8^CMn-n~p`
zWnfsrf#6$!PP79bVju@<J|2XsYd!h$?DXm%OtMz_dqBftpujs0I=MI30OVJXHUIy2
zg7!@EZ+GD0Uw_Q-QtL_nsfP|elHk116{5n@e5#=%WcsNeOiGfMI;W_B+Rw*ZR6uj#
zj0_BHy&)>*ol~Z>{$#Q=3Q@7_gj~mayajw;9s{_C(%GW|TE}?21$@y169WT#=M?af
z^_?x#3w|<r3f}IV13o3cw+9kXucx2*$)r>t%=4!6SZ}b?n~sCM!Om|uPVl!*WM*J!
ze#Qb@nWc5{|Nqz5yIfSvxLj0Bzul1h*8Gg;WjE-A+ij&LU9qN+(gza$Aio~i1<toT
zpdb(f-N@x@(0RVsQ2-oWogaDw1>W^Kg0qXj1}?_lK%RHKnIfI9rsw=(vT+BkoP1|^
z8yr8axA|K^bzkSJH!BqQTR|<b6%za{8$mPBpkg<IE3Nf*Njd0rVTKaWwOc&=>u-Qu
z@O|a<@4rCDC;S8tPB*ZE#@ya*m;g2$Y&3Y3|21p#Z^lyY6#^wzU_lU{sZ@9aXogwf
z9aso*0|aaHZ{||56)Yt}pt<Ka9S7gEoaArSVPar-EeWYGSDyd>|E0qJ|Nr-a`sgnO
znHU%hznQ({Vq#!G4<5Ijpi~bE9MJGdcdbrZcd5xv3s`ynX4~|eznRn+Pfz>9WEOL*
z^XCg+(7Xn?TLn6N4SeQ9Z;6T}*xXLgp70loc7T$6C8#p$a^OI!T}-z@qM|F-q|4Q`
z!$pOoJJ$d*SatRI^r?TCECfJh*mh8QhNR3J({KG@@?$!(e7e?OCT*Y2*S(<*y^w2R
zz)PlIgdT?^?^4s=V1u_SI7$?IgI(Ts9(-%v15U3cnyn`*d3VIL@iDyL2kPd$mVm5^
znm&F0UnT_&P(!bPtJ?v*Igfw+F<VeWx{f#PxHA_61NiFS*OHw#UX)IM_LoUrF%;DQ
zU{NuA3pzF%R4c!jbqwU!5`hd4P^~dzy52t~akJ_z;LeR0!!c(L1;YcK%$?PsYhs<b
zI&ZuP2QQQ1Z<z*~dT~)<1BaX8r5Em7rdR)Cl9vH(*#woirT_o`Z>UjGvMLqw3(H6V
znJzGW+dn1^!O0-@qx1j&?*Pq(zbHLA{rx{CrFt0-(0Q|l->hx6HYD;hlyJH={}U+v
z*nIB)P7!cyg6IA_H~;?+8Xj)`_n*HdjfsJw^*?`09B7nt<v*~a1(=SzsE7!HbbxM{
zmH;&ug%}w?2gP>gsBnM{vHAD^KR79Z92(BVz_6Qzp&oqyv<w4(t2^jS+}--1T}LXi
zFV-&p|9>}VO(jSzD2;Zzs3e1i$HB*?!i@)whdcvqgg*>YcNKJ8NR5gNBY*2f2ve4U
zzZG;uenX9lRVaV!Nr<TRD*jf`v4jmZD)lxU{H>rh4zQ-F`L3J#um<VvJ^%mj_yP*I
zw~PM&&tTvH9kI9*B!JY)l-UESzj!)rSG4glbcLwcg4Q+Ifu@;RcN}16U`SiMqm7Rt
z?KtbUHc-<Pv`xw>t&?|G8~BXYdY4Y!4IpN{NT-cT=g*5TJ9yWF_&h4j4;j-sdAGFj
zF@Vk}cWOS)eDFV0XO4;pxB{2p-+toYLzd37px{kw{a@nBzx{plUxhlzvECgaD(sy+
zDrucLDnj7EKlBHb;vnaEXufC6Q4s;J-KanKl$$w6g`+D(g}s|c<@KhPOQpQMZVwi%
zYvW^h3AzZR*%ov(Gy{Lj642biFXnQ`W2_)ahO}m00Tu=Z$A(`_B?1k<m`lXcj<fCo
z9dE(^S_H-vdJQ@X87!)DjCEfdAA|pERfqu%|5!^|<QN#zx*HFJ4tQJ)Qq|Q6TE(&m
zq_9JDZQJyZjLdf6Gzw~G9tIt{tYOLe!iS%MzfTV|cOi0=!Iz%_bhcwcy-M>h#uA(6
zUrhY1;*1Oo8IlJ43@_HbfetT&*VDb$Z~O%sa^Y{e2x^-A0<~cITVFCTFuc6az`&5f
z2+~sh=Kue0Q3fx52Ezj{-o5=_|3CUA=z8I9nWHSe{0tc;AVuMCKr4J-wEp@3KeF{e
ziBLd>4@lVI4X7Xaas~qfLzgTln9{mULGceuUiL`I%VXF7|2rB$x}p|<7B^*pmeufY
zKX&i|OF+<0kOZX9QxDo$|DtgxB%OUY_<*JH8N&w#hJ()pR6qP@VBq|~zwPpir*HoM
zf2{&@V;{)aEw4d)m^*L0IQa%L2lf92NC>&JSHB+8byQ<u+V$=kq+56V6v!rx=s3_I
zYV#W%h0ennw@mpNUPPS!|39MfH|P`{{?<v13=BKm9GwGRL`*-=%q&;`8l*%Pq~v8B
zXv$1x?f?HT47dIN|H5SP|Nk!*z5M@w;Rn#D^nnTv{_O`|)Gzw~f8iG-0X>kw8zg~K
zAb}T10u`_R|A&QS6l`lHn+;Qm$ZNOhIV{Y|OfS|=pUA>2UVnZaXhfv-Knd%MWKeg&
zc8xD+{ju`GCBFQi6EUS;EQYMM6Er-z3v_!DSmMR0SO5PnyyL~s&>Qiw`S-^XnQm_m
z{_Vj${M(%Q0y=NJ2tD=xe|I#0^K1Ty*Y{r>et_H$XM6E>?f?H_8BAvU4D~ObpZx#7
z^F#9keo%u!@8CNYP*>jo)Td>5@%Aukhg{?6|Nn9E8FFU)3@_H7{Qv(&>YV@oqd_HF
zHv<F1LX9L))-ADttgmM-Rm!jcscb#@|Np`#paa?uMW(eLC}H0LYG|ju2kn=rfAQtX
z|NoHV9zec(ZS~^u6VR$bd0vK{pcCVeb_ngzN#bYN`R6}BL*q-3)IOag(4g1nC58tU
zgZR6C@-Q%LV0yQK?cJFM+p|9W3>>BT-KH0O_!+uwuYj`RHr5k9{0sr%Vf@=z&wyAN
z^?4u{K0WdO{{oOe^AQmn#u7mrrV{a%1Et0bK*~GVUTc9FouA&lR^Z>p3liktey#Jz
z!3WIzYyJrwd@sQH0hCZK&i(&?H)zl8i!{&}33zq#vVH&mZ}|5t1yU=|*!Taxcj*JL
zOW!m<_}QU*xcLOryG{`mh<xR~|NlE~G@oGW7EyTz5lY+l|Nohc9*{G=r(a}a7WPwH
z1C344(A*1&HHeIn{R@&Y5{`p2#$nJF-xvHR{{P<%I=~xp4i<Q1&PN5bNu8tf#tW0_
z2JFlV`n&c!f-5xX7fy2^39{7j#l;mMqgg@c!@p#BvG(}?|G^n&9Qheu^iQv6XBMsh
z3}QDN1dYl*@Zx89t<-oJG$YdZn}LDRfxk5wG|OQNl3^%i&ro#&U8?XR;2t=Q@Em7-
z5XuiaN0Q++cZNOa%u(&*|Nlq4*!bxG{}+Ds|Nm$3c<?i1G=pRWkN^Ll(FbC&AOHV<
zVMH4rgTvy8wt7B><|8~WWqyIGJh<Yg$6$(Y9|P~a04Z-i!ee;g<)@$j|3l_V6gm&5
zbvvjuKlqo{>8!%PEm)?()&W%Ql?b$4Dv>$vECagb=;d|rCNg&Z_T!+7rB$ZZIP)_!
z*n)Qa@|W@)uXmPF1{KJgK+Vqsoz61HodrUi0~|rUWs$Vw&Js+F3qfZtbvkn_1f8bT
z>CE!7jR|zXzV*T9Ed1M@IT(-gZ+B)o_<)6fdoT;*g|u#gwB}zDC46bkzhp{dx(h_Q
zGbCQKbr%S9XNYtM@K}nKx_A4@G#^yh1v-PK-tuLsZMO$UcK}NkW9Nq#+3P@sb42T<
zQuX8PGN23zI<~3Pou${E19n^iXcOnlZqVK}kO{}xK_&LfYDSQwj1NA8IO-Vx_F$%i
zk3bw2#zXwuxzd_{3YO(|J8`|>TlD`wXv6No(m4L@QB^Ey&HtIpLejdOINBa`@jmh4
zX8;{=#t%B+OeBr<e|=i>560IVX}Sj)KqEQjTFviSI&D;X{aBh0abz)p7E=Wn9(d8Y
z7&0PMDhS$V8^B_CVEPA6W|{hz7K{uG$5=rT!)W-evseav&Km!A94<|3wvs9J>aG&$
zcH*&QFLmg460me<DYfW!m+AFT*a7merI$phZnqalcMwY!L+6hd%4@;3VyWbDHqebz
z-J;+S3uAc+I`Li@tmQZxXhq3O&~|kG?atHZb1}=ZRB*KZpMHRgS=8)T=Z6<|tH8Ba
zu*~Zs{_V_=*yK3Q0%~(G9Cwxh7i$sS#UhAcozBh8tX!YP*zGL=3WFC>Yry9_lyX8H
z5G>N^Ec2QjbSq7#vkG*-ICv%*v{Ca|=Ve{c;u6piN^Jbw^EkT0M4Ia)7)pgZUxNB$
zi`IhH<$#WLV0bMGI@;vL-CLmff-jbCA3)tK$klTq9-W~3FF^-xgLUPu1?3j#l;2_a
zCgJ8c0iB1QY~tU3>EI)l&dc4C{`><i*7*OQi2;<)nHfsUroZE6)=Z56O;LglY=xfN
z_EPFF$iQctcQO292CWC>V(7dES!;Xz^U@s*Oep;0tXC2tWB)HfZC{(M{H+H;3m<+l
zfbOhmJqhYf)TjtdujOG@tnUp`5$Nr{@SlO9(?^A;)V;Tv;U8opb8j=KX#%wcbSBZ~
zrC<(deMjfL&r89RlfApaTCagu6LvO(S|%?+w@ulCwv6$&f|_d(6MHu!nTF783bOdx
z=cUcNLHEKll(K^^ubKiL9EF+&y6CR)R|?qapc|`tK~A^hW!AO@IlVL<Vmx>k9{~sV
z?mqAz+NtflHhm5+v!utJ$>8Pioy{QIU;BVvUFr%k63xXZx=|fGZSwTLyv#DP+A~4(
zqtifz>zM=p|G)S=<NyEv;E9)rsKe72dNRvTci>}|n8wd6GLcba`U5^@h3N@=%nj2;
z_?fRySGdY7yIoa)*@cw{bRMpPOR!6bt!lycbWvtM#_7%4%oWqOiZQR+{#%>5ka2sw
zII}1dCs<)nuuH)9VoByltbzr}nO3R=0SvjhnfX?#1{M|DL*$uNIHm_{F$+#F&|;oA
zom-pPb$gC3b0TAXYDuzwab<ByYOZc^Nn%NAF#|}XpsXM<FEd%UAit=D!7s!ulEFE^
zz<>dC@GnDvvtI~9uz^851L$aJeFo6Eze$V?42<>2=l%wVf)@I~&lPrJjbY#jFbIz4
zsR%O>;s`Ksg|O;50u00Axr8_Z41?nZxw$}v26%>vBf!uVUBCxLKtMBwfg?WHI9`a2
z1$3A*M|`kJybuQq7ZYgMf+IfI6eI&OOu&IBMxPmWuCZsZV|;XzFIRwTSO`abJm~1*
zKv&;T0|Ns?295yN;1KTr|DziMT>XO>K|IFjMs6r4AcR9i0(=&60Z1lc0o&vRh9wLO
zS(b3|i|_@x1cWdY1h@u-BrHh~;Rz242w^P90P#8Eor8h}dAYdUL1Dtc$XLnH4HDvF
z@~rpw^@FfkJpFwmL?q%p{X9XY1c!L~`}%?H0ZD+;fvF$^17kNVkU=7#u?Ggw;mY8%
zl?6OmVi=+uT%6qF8M&EQKn@49U7XyVI7D<@oI>3hXJjNyOGqebPhd<eU`SddP(L*(
zv7oslA&CK`sx+y9iwndMPy&TkbdxmbAZQLy81Xn>;9}+g9Rkh35g+R5!YJS;3O_2E
z!#T(`SkQ@`E3bo>feAEf!oUDpfyKb+&iI4p2M;4h2QLF752)Z~_|5}bm<Qw6Gw_0T
zJ~Di67iVCAC}3dVV)*|bbUYj=?wA<BGT?w?U|@Lg|NnkaFNA@C;ecEv1BY{vnTen=
zmqC{{LOVzs18AKA_>gk2J0L<}64VK-WDs%W0>uDBeHX~-TrmN`#zqikLVzobnGxV)
zY*YYBwIJyNP@)A%78I3$nFhh}42%pQH4AtqgOV}B5|Cm2AUARG1q7R!K$v0yt}v!r
zfRC9;0Vu75qzeKJ>s{kPvIPN#KJg&A7LW-b0}_@b2>5b9V!@TeBfvET77dKd;0R!d
zZtw^Q@de$Tci|s5150$H0EjOf=IZC75D?@NuOMOuNvj}{gaVLIVpRf{K*9o^iIWo;
zCMR(J|G%W3VFBO7$%zb85_uRNeq~+4u!M^rl3WG3_}Vx@A$H*(s9daM5O83FM|gCT
zGi#VT=x}gH@TuTT4ABh%&YsRp3|uUr{Nn8C%nY(tL4+ed*wBSx2?K~>1ZGIa2OGOE
zEa00AQc%xhCe6UOgo}A0^AZLDRU``}10oEK!3mCsnSl{xzM(P5{Qm-OtVqf{SwQ(2
zq7IZDq8kEC44j#`5<m`7i_-&{5@2ZT%)sEG&%o{z;OfW7V8Oub><D5oJJ&n8`Z032
zxw!f<3iwE)7ZSQbA<przaOY-#1dIfis5@f;Lji*TlM*O_7cmquFtJrKL^qjxJGsD>
zGc${Dg2NvkqF{{)3<(U3jP8sn3@HqZj7s%P3?QBAzW$+bo&3V+Iytyll^6s-3cXm|
zT$~MHPGV<(l}8{Spp-`tw@PzKxHEoY{>03{;?DS;`8zWMqml!I77N%?JD-4%dbq7D
zaI-*xgvBfYE?#%W3g!xC4i2RTumP?t&i=lJFvqYmg3~1<%t@di#%0V8<{!)q97+NV
z^&n5Vfy^;NGlz=_Zjh6!A5MdqelRg`C~+`UG6;BbAksxcfOBvNBR9i3E{^C%0T9PI
zz}YiYA;8(wMIpK&*wrhZk(*;3S3M}Xf_TnO2CiNTBK)9Z?HLOy88a9_0wQJs&VFtT
z1q=y`bfzY7$(JT95Ud6nRLPjY0ImrW7#9eEL|hOeT+9Mq3qUznz`X=geg*`E2zeJb
z2ywG;|Nqb6<LB+d0AVxM`}lb~G6?a2B)FJ-{JfoD9A+OsZ)XM}UKXDJ{}~xTnu6gx
zMu<W_h#Xj-GlLL}3)1NVRm%j{=>+G2bi$M}F>o<~?011`Wn$n0X?27uW(I48If0o0
zq!p%=nE`C6BUC3dL?_G|7O+m36Ij4HVM<vbI-Q_8>scULVb-vMwZfdh3f2l!%L>s7
zb3Q9XC(If)uuhm0*uXkrO4%SfVXkL`=mgnP4+=tduvVB8*uh$1YS|%LVa{iVXoXqB
z0oDm~0tZ+pOeqIMC(QL65S=hvIKes{>!E?o3Dycz%L&m6b3P|TE6f@$uvVB8xWGDL
zO1U69VXo(b=mhx`<WX+0PM8z885n))!D$hka=0N{Vb14<XoXqB1J(+20uR_ym{J~y
zPMGU?AUa{z@Pc*1oWKj#2~)~j577#9J}*Qo%o;whR+tm`z*=ES`5-!BKIMbxgjvH6
z)(LY0KUgPBDL+If*!A^1pgW+z=^kc{09Y%`2?AiPV6{B|{|i90!kjMvu@q*FAXq2N
z34&mqFr|VJoiNu6LUg*o;$H}?73KsXuvVB_A&6F(^MxQ<Vb%zPb;6t=4Au!#Dh$yH
zbG<M`C(ITR1_o&Sg9{lEuvVB_5r|fp^F<(9Vb+L(ErmHj6s!}bR1~5U=6X?xPFQ$~
zfpx;1AXX373R5cv(F$|E7(^?~8gZ~zm=naoI$=u1Av$5M7l-JCSt9|~33Gx3SSLhj
z{r~?G5UnuhOF*>3tdRt3g*ibItQDqI5~364dP#^*m^D&hoiHazfpx-^N<nnGFw{dz
zZ7GOWm^IR1tuQA@gSEnZDh<&JasL1R(h!|6Yh=JWVNQ?%>x3zlf#`&}UIwJI9#P52
zg0;e&APd$CQ!5M63Uj_JNGrJH0H+)|uuhm0<iI*%O64FrVXl{h=!DrKUk}y_^Qk;o
zD@?6CL@Uhs@(`^~4AG4$`plq;71Z(rwe}bTf&vXV0)he!L4*;AFy;^u_6!UTVO+pj
z&DD^>u!M_q2^Y7BnP;GL5GO}KP>_Kj9~XBgTRj6OxNA|#&;=6YVhsoi@?5|@HG`|6
zAOpl+0uqjH@?i&6)UYNB4?no6!@v<A5ELvZ#wFaz$H2)9nzRHBR)e}Om7rT}z_-?b
zTmf>Qh+w>nXD~x8h|SdiB1QP)o$G^w8J2(?1r`vG4-N`u?8<;RqX1+-NE~Xt6Popm
zBv@~VWW6ESdP9))LG=jh4Mnh9Zy4R=3-Y})n)O^vB-n3+WWN#Eej{}Ijd0j+1hwA<
z-F{{g>^DZT-xzGaF}nT6IP5o$Zt`dG@$(Kwx1R-KKR6vRa592AOO*`praQL?8#uy6
zxWOIGC7`4t!Um3D0e3!7^H9XpIiTLxk+Gn;!#Tj;FM}bW06YQ$9Ro=$$mmGqVqySO
z%nSty9f@2l3`-J4q?`kSLy&YWU`<%U#SiL0iEx1~MPiCp;yMxC5D)}z0k7v$h;HNo
za{_{b;~fM<yx0PQf}I%(K-~J&0)`||^VW@ZYC=268Bo_GFeEPEs!rfyXQ)bIOj^iO
z(A<$)mB7W!z>ri>oy5qHyg+Hv<izBHWU$*47#46%PG$s+6eTb&<N(uL%%uqeew^{{
z0j}VXgI(}s#vsBL?_*%VAR-#?T5n*;fHXD(YHf=M#Jd_8F+eY(3JP`xD>sJdGJ#O0
z5DIFPIfQ2cp)4VkBZP8-P|gs_1wy$(C^rVx?Um}xFBqpcXfj{s1`T|bWE7<)rW8--
z(Pvf$9g`2*df(6@$Kb%r%wSN;uw74|xrk}{Dnn-b=^qW5mocf9Zl7z!?8(AYq??+Y
zQOuB&Sd^Z+{gW9pJJWPIOJ<Jg|16jlSjrPKOSY?8GP7|_H*;oAvI(2O$KX1FkHKUD
zAA|A)J_ex)d<={e_!vI)^D$ie%Euu7jgMjVH$H~Q?|ckd-}x9Gf9GS+{=vuK`h$;Q
z`yFTI4AxL3XMTpHMSKk03``2@&io8t*YPp%Ft8ZtIrB59ZRBI%W#Diyb>?S?+{niu
z#2}zx;|y83t<IpJ-~wf9FgO_aLfM)O4Gv+`XL>U0NA%3#W3V~K$8cggA4BLoK8D<*
zd<-{_@i8<W=VSPLl#hY$I3I)4anO<m(C`2Q14uo~Q9gzb)A<-w=kYOop3cXx<rp8s
zlDT{gk+b+1m}l@Y%s9r!F#X^>CYk9rUd$ZqI(zsST9@)oXY^whou1&u%%fziXQXGS
zU}RuqY+!C=p`a0znxf#5Sfb!ulwVw|U}&soG`-J@S(?K@*H|wt+1PUWMlWVDVKY5r
zT?5_pM6=Wsvm|o^!!(1$?YF#`jl=~&$6tXk$cg3*4-%)#Br)4D%1w_>VwM$mmj)f}
zek^SV=op-|ohCvI3~9T?c1-V2VwMdN21)L++QG;0a#d&Agkuh}3~9{?D*q0@0GSn`
z+m*z?aJb_jXb0&3)U@siQxZUTR9-4!?l|%8aIc3!^AFHnS{~u8mr9s>J<R#{9ejCi
zI%_hsVf_}+*^@U8zL02sz~A}l#Zo9&1j3yL<qAN!?NBZcgbP}B-g)ET3l0bud}-E=
zgD+Sh+$gYOFgrR9d_4x}riz1|mshZt>KuFkImdGP)?{W87tm3c`#=X!?gyPHiS?+<
zPwzpylp#l5ii3{2<Y_+0!N2XO<&Banpp!1YO#h$EtXB`dV2pnsbIXAeju&13Kt}+6
zYz7_X2c1|E>8(-Gd65b_v;lN)ibiS|ivj3JV$eyFHmcym<TZLDKnF>3C>S1iEy2I<
zz)Mxo3ZnxhirELa__y(>^ty0da8B*wG49||={VJ!d7<-V!%xn#yRZ2ge$^Y4-a6)@
z!eL-|;PoBDlMTOeN~L<U8B@DLj2S^3?&iZxsa+z*8yR0Sb-r%+l>%8qRqxvHOAoRf
zyk4T=mnwfNXg&B2&;f-nj{W`r|K$eIQlVcF{4I;X%U+WCTR|sk_2#qi?_+<l1f&AQ
zZ}?ST%-<3LI(O2v;a35FYX<0y$b6P=`yB?LZG|;||Nq|sI=b;i(cl074NvX@mFk^8
zUQ7cS-~+azv_z-jS4D~aOI^@<7X6l!rL4`zK_^rm=V*Of$+H7=K;;XQzyJS#zuWoZ
zHD5P7vWgectpEQ1f5|$1K`OJWqK}FIc$fE!7svkm|KIJSBH#&H>i7ClH;+o^j~9>s
zOlM1DHmwJ55-a`l|G)q14<MOWpko7HOap1DQQ>**o7&}K%xF_w>e37H2>(8IaMZf|
z`TyVj^+)H|+8|+e#t)sxQ@hyRTMm>+@$WnELiNx8|F7Rc0#FiURE&zoYo^Zkz2I{K
zG+u&y+zdV)fBN<`W`PLM6cB$qXwR?>Gk=RKXfeLI4I_Wc5e5bZ8z%nNr{Eb~XNiLk
z1o*cHi*R1(1TB`#=6JE}_y7OBJKlscFf^b0{}MDMWW&MVQV&{^&&l7qZn|hXv$0Gb
zXqh@Me+y_aQMr{3cN*vbi0#e-{H^Vb(?4V|OHHp!XXdli0x9F;Z&}62!0=L&iGd;Q
zxU+x&(~BR!{{K(yZU9-*;Vg07StP*OQ{lKX%gu}Y3@^VjGB8YEbCgLc<gF!(N{L42
zr_K{Ez&AJ@Y&}qUF}0iB@)$q(o?y4m4+kHB*1C9fetLbU^=*la@9T^F+p9Ucvn5_M
z`~n^M5Xt~Lk*E3G|JPP&o!$a3Tc(?2Fe@1zEl~#>D-Jq>7-a1EZWfi)ZU)O^wW27d
z-fjI~vdaJUrRm)n%zJqvK?faz6i#>%Iz1$l*^^OV`n*hLO~wn;Ph>LhVoaOfoW-om
zxP1D?EM_ZNvup;2*Q^=d*$fOXOn-tlh|0ZK^d0Q;C!y0hvYA_1TTb#%Jve=0HnT%L
z!%YT;zGG@>i(mZfd7!rV(Z8M-YKx!zOHboxbWveS?{-mPQd|7yUpi>{8;e@n;&=bj
zc7PhyX)g-?|Nq~2Ol{G<e?1q{c7n}0sJ8gQzb6G9hguF)aHKV#Xn0oeq_FRxT8G%(
ze`+0acmAar9!P6G!jTr87MFIo=Rz9)^ne^@c4d&}QvS5g2Wf_v(rj;hV_@K)ekiT;
zLfYZ9@U*bB;Iz(z)2nir<?5rDEPod>r*+;)GrVnitVALWe4=9C;WYm3m(<cbx%v*P
zEtX-}%-C@QY(+f6fMaQ$m(w~=rKf?;Yfjq%+Kb(HKy9HogIX8gG|)A~C46b$FQ+Nq
zNc(;%P4VJu&NRaxX`DCGI4`Dw?@a4Eq_$X`jiK+5S_j{Bxm;#hXNbGfc7Pn8)_JV&
zfZBq}Z)yD74y0+GP+L^_4dfTg3w7ds$JElh=5W<~V_;BA@0bOm)0|#E0XcAbeJ-;d
z`;>&%OC^l&rgP;n`%An?NV7at>JBls?|@pD*xqky3-*1RUYN%$$+YL&^qxHCE)S5M
zeFxOi78ZO<PwNf%ua?#+R`4y&qm&17NM>3y=#<Q~!|7?g9tLTkN{b)F3<sS|$qHhb
zr-7=jh0_!BnH}mu_d0^Y^xzALH1N`<Pif$zG$CRla52#F$`CODxLCq}(DL^iX$N2M
zz{Nl}I6>5Lz{M=!>R8}nDiE=Hm_T$|+)LsAX~AjDZ+OyngZ+3|ZNZ&?=^ZXA%xQ)P
z)E0qL5GawQH`J&wGnGWEEx7lu<v=MXC}F(--J#ZZSZ(2(f9as3<J8g?zWbLBTByYV
zO3ooFY#_-;|N0)NEqwB??}b|0!WaM2R6&bX6Vf^lmGJW`97t3B|NsB|G|mhBN(cH5
zt1Y<uujN1m3n&?<cYz$ye1s=0I_+===o%QIH1ItzX_sH5eFt4z&6su=nl}!owVo{D
zNb^kZ5aD?JIqfhg1s_i9ypY}%%#qgoimBljV|gGbeZ08*|Nnp9^oDBCjUk89(|SXM
zrk^fimY%Ls%&a;6OaZeFqwn;e1<YFYJ%2#qd@+rG`-L?A?I+Xt*I!IK_(CAfBaMIk
z1yEKw_(CAP(^(?DGgxF3b9zUxEGU7c9Zm~{W})D;&ckV)*FZ{N*n<tbn$~$J?cghc
zG>`O77M1ig{%zGFX`nNwD}wd9_zooMr7Z-d#t)^UX*(e0!~wMhYavPe;)B=XX>Mtq
zAJPuKVCg%M*8GfLExn5kocz7gJDmm6k2^Cld`R0-lfb}`-s#NpTG!@&xiCEAb@7!l
zfI{N6SlTW|T}B2_a)|`HI6f`*<*tA5^uJ*3H&9(vueM;_w=}~aHVq9I86b{iZ}`bn
z#<Y<sy~9U^IsKTk3`2THu;js4Oli%J4x}|dwNK-GmEI97k>16klHTDgnzoC<0b<dM
z$bbL;r+0z0b$E-UMZoM$JDh&ZLAEWu*+T^smz{^wn=3?^%ec~;J?d2$K}qZ|%me9Z
z{M(&G)Y7|I7+MdMvZgnCA!%U(Yr&<%g@FTE3#{bq;!F4jN=J$((l{@q?fS&b!0=9O
zQNp*h!=Qx10Y1O#<;DNg&lWSA2zjP;9)A5eJ&k`KW6OaOuCx~)rVE!ayGTHa>9iNp
z1q=+}WY>D2R3I&5*7VjAW?RNZ(+`8FyVDs<nZ=VNt}-yBy>JEPK~SoO7q!P>g{s<u
z1q>?~OMNylsx4Z;kaqBq0667wUhF%pme$EPg8@w2&0&B?R$8|hxIl7ZR7+c2@NIfS
zDYKT@jD*%prPBO{dR=_e64LnBUPyzS?9K*CiiVfc4nr!B=3fpaT4`_l4yvVfi<Nwv
z{-BguroIH^{ooCko;g2pNaNpj;fVuSUasU@+QA1Lpn&4vejx4pjWoj>X&{#2jWo*}
z#cXM;pxHu@(#0j;K=~Dt0bhVFpVdq27Mqih#=rhn8Y8HdfM(7YHlTp$JgAqp5G;E*
zjrBQmJ*evd+EEIMg72Tx7*8M>#skuzc_Xd$0RQ|0;DjFy4)PakKoX$Lb|dY@1rWRS
zKq<@T39sLQG(Q2I$ZDGwoCZFVH4VIKG3~`skTUNQZjfy0t2Dy{pnMT>6J$U5Xx6kB
z0^mE2PW%U%0ZEDA`UhOCy;uR#-gzjk^+2g=TIYvnDQO4)@uYQrN^AbdSSk!F%)#=k
z>0Qjv5<o!@u7lHF7<~KxKg|JN$#sdfFr=sTdNEp@D3Yr0xRACBTn-;n>k{kx20HX1
z%}cFAtnV9KL$_D}LmL0KOP~;Vc{d+k-Za0FNlybEp#`pT4bsy(ZB)`akER`bD*!5;
z#nSk<-{?E4mfmfh4!UCvQgSx`m*j8bWd;?MX}v*m^=X|K(+<95={uO#{D@yIz1s?;
zRsvMz$zV#Q^#&-QiwdQu^%n4?b$)~y11hJ|y7|=7)4I!8($hLiR9MoQ4@jkT9!op;
zj-~Gys4h}V?`8nGQA)b+Xd3vkAhq;P=Jd4Y8WooRr5b6?KmV61O}|jiEMNb!lOc_N
z`yp^G!;{9p{WzE<0M3Uz>1p3nR0KdqcV189U-F$V?cg)MG|gjalGoEL&!u(#NKcan
z?Sd2PI|{1Z(mS1*(sul}XJB|O0<svil1>dI2r6t`R3y~WLH8N<9R(XM0On2isbE&E
zmjbDhNN=uD5s~F@o5~1wDF*|8OBZ9>4$y5&Am>B%ae(znffYOQw`DM<H`u5!@J~6!
z-x9-^w&U);|NlXz$$=Gk@lQFBp4Q896m++fT6%}Gf?9e<up-p4N}!T8t@(jGf7(9N
ztDyFMsYKd7tE&tQ5X~iA>1mBADkjr8E1A_)O~4i#fc2(zI-5W>e@NTs0n)2b!j`tr
zetKvnvqF81iilTwT5qrg$m2dLVx>Od00Ji@3y?9@VA6>N#CCQ7lP+n7|I-XFsik+h
zaLIv!obh{_Q(E&c?b0`WN7Figq<y~u@_^@SJ7_?Fjc~Sry2ptHq2C_G0A*AI96_0{
z`G^dn&Ol1>Jn3njEGp9ts+eWDZ!xAdzeuoQ<Zr()J)(+PQ}#<5=f{IDm_Y#sDZEak
z1*Byur8S@Y|8m;&c~#6}^{jg7-8-2WKK|EB?`mXY`1rr$uwHt1Bk0(6P<mw3OHb==
z<blX{vNL@A532h(^wPV!KuXf~C4f4$KNU)KKthrXAOEKre*1RtcZp2eJ`T|0+@Fjk
zf@%9W*cccZelmjs9Mo@3Yd$BCwilGk>-&zTcl)TYsde%l_?FguoJp<I?$9?-Q;U@`
zP4Z+~^TQ8m%`XMiI{1!!+jv^7gYW1!wGO#s-!?L;b?_bkmS%WTt%L8xH?<DFli$=j
z%}#+uI{D6g+bF2k!FTRk+P(wd7#PwFZ>yzu@wMGdW4zgMI?XMu@!$Dx3=E~O`s$CS
zeZQ&J!FT>!TI+#Ien{-IK}v?##-K=Te#V}5@R>jw|F$#ep?MITEjZE+K9ES`Jealv
zlzY++J{5pk%D??v8s}F~Bd0`#H7zVHFs=E7Kw3ar=gZeTX;}<l<j;_1coJ+3PudI6
z=?-b2iV=iCWo3L?EUY`xb2*KF`|Y&G-=I({wM*-KoYwdo)NLs<O6xYe@U7=^TBq8D
zZ_^JHGK))G_?Fgbb^%lk#ifBdBoMRyKb#(2!>nE(1Wqz(88dD&Fr;M!g6m|^ZAoBf
zaDW`}a@M!Bojo@h81&M+K(#$z8vninX)lyP_u4qVewDTZG%fK`>;s~m2P%X_RMI-n
zrM=Mj^#6ay;q<g_5dTNo|7)O7<llBU?Zv&fpa!MxhqO3oQbsftJCCPzUe-%ncqI|E
z0U-z)mM_-6oz7CrtRTZz$Ik%1CZO}f|LdK{z~gL?3j{RkraRO!OGJT;Zaq+H32N1W
z!s2P#!N)9VjCaxwzGg|=6<5d4@bYNx|LeQ5>KGVaY6UVd^xf{eoYwgU<hU1JA3+ZL
z0Cg28%$wf`q^BKcQCa$fZ~CTMW^JY?_om;kWmZ)J1%G-Ui%QyVh6%h3Y2QH!%SD0(
zH1r_GWW&PW@@u+U9kV0j&FL9+%t|(3<!RkHDm*<m`tE*S(sv^rw4sd$EZ*m$!UL)m
zSftXLAACqp>o!pV6)bFEn;C9SKUT-AULVW^QsN>h0gg2gyF~IwdRniG<QH(kF9H(M
z01+;dB481gw9Xfh;Mcs6cJK$N%5hQQNOMS=nV$B&Mg_zVQQ-mA#|Iy<Kol}wfa+|1
z_9xBq1Aoike`@L7E|MH+(^Kl1MFIqRF7zEp2VL#Olb+ViqLRkH{zF>hJ5UgSQ;k3x
z<FWL#ZXOjR-+_+V2Ko9H7GF=_U(YNm07@bJ>kokoS%EahAJgyEGmB~Wx-k6*1%rz$
z4>TYc7(gKownzl57+eZlyxcThrGZ(Uk$JjL1GAPE)U-6l6A-^Zo$LbgaIc9(TIWTu
z;{+IPPM_bvEXKrebNcoMW&;rYvVmE?zD9-T<>9}e5rXXp(!e3pE5el4c_OX(hy*NU
zyiECn%!Osnw6L_!!|7?AA}VPwp1u74KdluMSRyJV5};9nw4H`cpz&c)(+`{zU;6$6
zCDRwtz6=cTuE6xBMrNVNMUcLzM%wNMNcQ7yIavbAeh1TDym|Hif0{Ea`=!0O^XmWq
zjuX#5q`f%$;{X3N@Mf$u!%LvFp~95*V)fhq|I?4VsHib8rR|EE{<e`>slM|tsxr2;
z7a5?O!@uoz!+HO7(D@-sAU#@)OlkXq-!p((8s9*zx)-3U+S0$dsAw_rx70JIgOaoo
zyg}B*Hx1N+3snI1GDXrlU)Vh0pK>70A&v8d+M;O;Fa4O)I$xxzHh_-n2lokIr8PgQ
z|8|hMM5*DIY$^M<gN*#GTFhzt!DA%H(>l+mH9!B8*7*aZyWy8rNo~1i!!I-bmc<O^
z{0+Zk`CHaAH2l&kDS7#jvEi3Fe@i}N!!HZ|mc0xwFEBRz3g&N_%~&qj@XM9I<s3u9
zFE{>{I}9(kF*ely3gK^E&xjEQX>b1jPe10OqTHI+dOMwes*4IF6d0J&IzPR1XH3g-
zNHaVM>di4QycTYF$i&}T%LFRFL4x2?zw<`g3l~r<M7~UB0xO7tD*%mMy}sM<kf|h1
z5Tprw6jj<T(9Vw6$3X%hQ$S}5zTOE^1W^O7Cc%TeuNTAAfGX72QyU&K^0)qHOv_S$
zxJiM5;dKK@V_X{eaMsSp)9*GjJJ*N4hQz-XDE^yYGBCWhPs<X3=n-IGc**zw+d-z1
zG>E2-Ld;MRK{g=v0yr^TN_+9?&;S1~ofzR=wr)9bhP3aO8y@qNN<s}&VNBcM1DXX<
zTU^AD_QJFZl>9*l$98Ztrl<8f{kI8E<KK3uOf)SZEh7e80kOXO|357vE$Zb<P)cGs
z+HjYFq2qMJW2W?u7!}6p4_cU|>vw{a$3eAjGjWh2ubmA)dD8i(v8beVes6xx0cxl-
zm9XojcRR4X_D%bK3>3l;KFe#{w9c>1Pnr3rf|@rLY2S}2FfcHbu!EbTr9x@V&m2kw
z)0*EWrgi>o_$gV=+WMA%%HfvVB@Q6tm_Q8@Mj?h08L;{i(G3qk?M)_z=?$&SN*tX}
z_0qc;Uhkj2s+Cz^<>&AJ|I?aJyS;Wy+wl-|EZ&Rfzd@VE(wa}mf_f}zFRuTd{<oD`
z!F4N0CFkcfP~`|3h+6&|QlWMnPBR3JdHia*U1A27<zM`vSVJ$pyTxn?sL}@aJ5Q!{
z{z`ihJiV}uS(wx9^)W~pHGM)GvkIfg_N{HqR*X!I&!>NEXEvyZW@Sj(AeHvQ<mdnY
zpn+Dqw1W@i(+>WSPiua_lb+U_`UPSNxZMF76w?3~Z2a3CMACL`Vq#*jxnCv)@1Lc2
zHSGAxz|eA_L?~_7Mo!RGLO0Tyk7%Stzl?p3oXOZ-Kn2q2XVVvUFbfN!IEE?h#q8-v
zJD64K|2+eR8%THB;j|Z$kHE!f34hv7zAjJ;?oyiJftP)seoy#3;nyF~u$MGAZ0Dyk
zFr@8>2D2xF*`Qs0X)oHrY%kFEuewxFu!BO6VZkj1hUOo2<!qp?`)fbQK=0v$ui4T%
zU5}+TKeJD3JO^6PZTpYCoGY#QG^mq(__Y*xr18W9kTGd5^gt$e-bibHV9(Q#_Cg-a
z1-Bhuil$Cq*U2na|2qZYsP`at=Z7@@Z6DG)KWyas_A#yVSbAEon*qeQ^AP!t2Wia*
zph9~<LOZO%e%b(H^KZMI)_DV>7c{`?3{^Neg@K{t2SQ^rNbwF2a4{R57Wc9&1s+#j
zViUeu9O7?zzyS7ipxUAd-#~4j=4TuohY!4FNo#)0p4R+;9WwB_0}{9<VDlh>s{v+%
z=AzPG$fPhZfU*QLdx>Eh)S(<;dC)mLY4tDuBr`C88on+n%zEiv4FPvSg~zr7X)hip
zGcdH=F42SOx||FODHE_)kAv9!+YY1Z*a#Bs{LpfsL;|L19!O}1Az0HSFgq8-jsm6K
zm(9s(^=R!%aI<v!ga7|K4ncYyeMi+6^nJ59RKk(=B0h|P;k7tykWFo207KtVwJx##
zZx)A2AA<XFYKwZmrGZ`G2Upe&8iH_ATj<4Lai~Zx?S<uo|Np`9X?Q8^g|KoI0|Ur0
zX`qqC*DupvNI#hVv71@A{(q!ehg=V=VGe3&!p2IQ-xPq;MRx{^UV7JD6G)G%)fCjD
z>O7tXKBWOPSgXR3*7+grh4*7{_NWw2?{Wh**$d#-u{_pGPwVbA0BJP5l-^Ls!Nfo1
zP};#q66tAt{M+-m()iaOP2)V2*7;-l*&b#YAyDEv_*fvV@ib@;DyR)G{a+8Wl2Qx{
zsHGUA0%_A}2rw`(rKk1QsBomG^~zX))!FtkE1Sizuz@%#HsIzJsE7_oGyI<px>Lmk
zEaU+?eg&+=Cq1n*L?s|Sty^sRv|eVr`nTzza|LqJ(|Su-B+@!hr>FG>>ZEmkcn9+2
z!51K_0(GGr0g$8~lmi-&3DkcF>az2I+VCI-=+G7r4LY`^R5Pvl8A~Z&8u&btv=`fh
z85mw)Oa~39r*pZeFnzm`CV3!@rTGER>*@Y|%%<{g58(mo3<}T;c!2(Ykk)y0`tm+z
zWzh+sPzC#eBMp3PNZJdrXVY)?F<bMc@ozs0>OFdc!uQ~Gm40SBqcq5UDCwY<Fh_|X
zJQ8bEJkmcec`c9zZV7+`)gwLa^U~J0(>wZ^HS5zlFQYU=U04j#nh!aoy@#~DU&Mhf
z59>S#8hdjBdDtKgbnu8Ki0P8{7L=>srl(n#s92O}rnP>n6iC|<1L_37PXnJL^jZWq
z1b94<f#LP)H1GyINJAIw>*;zEn5C3vf^M<uJiMU`G!xNspi&InWIYcOZ9P!RoA%=L
z^sEWY^7Y5kI<JE?zwif1bsm0_0va{_c8IYg^hrX;#RD%{(?I7>Sbi+kO>6yM3LdY2
zop1B2B-Q3$sZ?4}T1FSR0bmI#@FUWq(sqFM<Gl7w3j*h-fV7OoV0mzb0O}Znnp*lG
zyIMg-Lj5imP>r|)bihQ~iv=J<KnH*Fr@avV@&EtJ!vASIet`-HaKjtkUWd#~oCEbW
z<<dJsRG7h8i#ct_6#>u)HTVXv)&r$BuZ2Ord+`sF+e&rPI)8vhGC!v60yXMDAyWV1
zD`=Rs^+1I{nk~pC{;8l!13W?uE|9<-@Xm{%G2osA&}3L<n(a$w28NQ*di^xpPfQF9
zC64vtX|~T97#Qko(sV&5#esI^@=rhTT0YJ8KS+T>TJwqjX@}EnUkETTl!&L<eii^9
zQJTiTtsZRC;q>E-s~AAzL?9LeOZqWKrj*z3)6;q<fX9rRe=(MWM}R^7&c4HHU1B-k
z(riIim2#yuKf0gRe2VEcM_TivziG{<6#5RUb$}Ff9)b*nq(#5x1Wnw4XJKDz`KASf
z2e-jt#tj-jWC8`6<p1eM|1oQLez=|%oEDVUc~~!P;e-TG5OadM6ilm|Un``i_4=qV
zrR@TF8|2y-yL>=R!$Tl;>!ngwP@9AaG?xSF7EQl6g;}`%cpCT~jI<X=KsmJYSX$?;
zx0c6CwLvAsi$5T-)&nJ?X}e6o$pBXMrNzI@dXV<w@z?+VU!R3$Wkjt2I?5ho@8Pu0
ztKbo1P#MRf0ty^(76XlZY4sgQ+s`l|5Y)-P59$nCbATER;JzgXXw1(VTvvh$q7rL1
zwe&7Auplcq)gFAn4j!Q9g!ZdJeKKo4uwI?%Yo;>G)Vn~s{Gj`v!1p+ShWlU4xc&b>
zxX45vALwGUVFVRc;Hw?dz;`>Oy;$@Bq_WdRMW*KhnhsDHTmJxi3p6|o?aOwXsH8D|
z0QIXGK^<ux6&BElAlO9)(;cTV%QH$$Pn^cATn}1;0&0GOu4jk`wbtDj!KxHM6K-h-
zpMgdUSX3bWeK(dg{#_5mi*-Rps>r0hPy$thtp`d((st>9;{$XlM%s(X_x}HXU6l5M
z3v@@x@wAl;pc^qnK#l*?;Jkg}?*IR3QE8E{{nG0}v;G`l8(GpUU(~UIYY3K}i;$$4
zo@SY&!cm(5wom~yat`ULgF63=kZH<;4_QF7Ce0^UUR$PRJOf*h0kR+hWjFz59%vIX
zC|KCQam-T>isY9zAV0H#En!LXNIUpIG#zx@jsdtR7fIv12xbU?rs_FC!wqg6V6`gg
zX`ODM5fT>_&~S|#OL|&kiHZQ|{s8dc2}^n!V~L7Nn&ww9SK;NXe<*HBPiwBPQ4s*0
zJ`A=`M=iaBF}=@4MGI^^c(BMI?fWrM;ltm$mH{j(llEfWJ#gj4-!hRQZI=Q#;O8-d
z@}%rtP%=3VP1=1dDr)K7Io6<-ekjx1H2&=;(mG$g1@-TnAA!<FcZhgBOIjc(2+{)5
zg3`j$nqTvz1*c{F1&5;Q9dHX>0>#bnaEt*DW_2=yYQnS^??8Q<=Cl7_bEdrz{{%iX
z1~di$xw!zEAyL~uD&Vfh^q85<B8&mk3uiLR>A-8u5EUU%Vf#Y=2H2yZW)HZQR)LxH
z^2PK$Gnu98YgCxh7=MEM#+TAwgrzYsq{V}ZAn~+}E!RLHqJI1T|Fp=o{h&>yFT)wr
zz$fRXfsf7wWl~T-W%>30|9dWiT2XDFW*B$|^58=ja6Jt%T`3KGz;N1&ub{?%R9fe8
zkR2Rp89Jx0F)+NI1!?*+*|3#}+OU_nfd&U3Gk}si*L4Plm!}!PW?M|(FpF7adjBkD
zcHwy-b7Db;Sf^z?yvD%r(slaES<Ld9IUtE>kOXI1##fMp@PBM>K0W>8EM`fc5*1Jz
zjfV|1$PaNMsJ0XV83H=lg}+tdKg?~+CE(t-`gKsKT)PSFeXsflYS(ix@V73Q9ypuX
z+(7RdXlMx(THxYd1{@6<Ai>rH@MzG1N5jMEJ7+T|3x%lgrZHYj%aR8dYiubD4AZse
zFq^QPOJ-o0o;-)ykYy%_HDeC5nVb*U1-77=jd=Yct@#Mtw6w!%VbfpDVV0}E2XbHM
z;k13A<|Wt(61Tu9p+q5V*M}RRJ_M-#OncD@GUkQH_5c6VAjdSx^c_>{60>7yxm3ZC
z_TuH+|Nmd_2Ms={b%@zP+USUCArL$^buA5i4M5t9%$uOh11h2GJMX6*{Lhir{G30{
z@NL?zFU$-KZ(0sifXY1<m9!T<Am_CnDB(}r^#tq~e$X<og$!vgDnX-boiEZlkG?*!
z!l8se?ZsM9*zHgNbxaR4q_w^+<x1Q2m6?H|<Hl?5^ez{@{}3*yY3s_EX8E_~a2kL8
zuEzpJGB9^t2Klk`c-q0=JZa63K`weNoc3Zjq#06j^L1X@3uchDaA)d)CZk@w0BLJI
zQ1TGwNJDTD5eW*b7ZPAsfx5o0_0yUkIHXzLt>JDtz~AckKh5xf>}%<k1N<${|I^bz
zS3`l_`zF1EMK7)M?CTlR`{yys)z7&K3UknqOWF%@R|bZ(U7$n*s@PvNf}~zBLmXJD
zn6?|F3Y?sn(spntfD&LbRFWmlyYy)qsNsZ&mS9l+>b#tu20DgpAE=V<JEpcE;oAz9
z5}&lapcK(}bOZZ;wM7mLeaEI-&S#dXPxuBI*9N8j&wu~_?>o9lRjotJfdQ10_+Oi*
zy-)+qU$-78S@~Kct?@C#2Sx_a+zJCDLn&xQgNO>$VTc7H>;8hB1)5MnF1H|#yPBTX
z9Rn)!y9LsG(>m)ffELPt2kgP6AtRJ;$)dvF`i242A8q{ktb!4AJ4$+5FHf%<=;Ud(
zXIyE92cGeCTzJL;I+ixA6T|?Cq;<Y{#+ugo;@}I8XRIA3o^gX_GM_bWV0y-tp4RQo
z0xC}$L_j@0&|0w0n{1#W{l$vuaSNF9ZBxPd%j62U>{dtvC%xBfY2dR3v3jZb4P?}(
zGem`FI?qC8d502Er?1mQ1=O|y55RMz@h|>Sq?ryn0u?l3pa^Pos3@lGVrOIo)k>gD
zvHUM2hg!VcH9cz~vo;qGf2#`<XcVV)`uv5=n)RUBj*d3adC7X|UCoT(xkVQhIgn?%
zp`Q7Xmi?bgFTHENCTLMK|F(mWhCzCVkBWTSuJ7P%^A5y=JHV?D>;M-Pmb4dlL2Hg$
z50r|4+$jfgr!1&+Q?%!Ad(DtupVqrw1GH2qt+!nPOoOiKPEYG?SAy|GKs*%~Pa<uv
z5r}=vMMah|y~{^MHr>KUMUKCv88lB83L@An4waVarFXmj0N39Fdg<MQmWPUxK|;U4
zLLyM10KKgAZr4AMbfcHvEo^zH$W|}CE0z)AuPzrAd628IdX5R|ISz=I%4E|2xv0pd
zH6P^y3CMEtx5oTW+X1?*<>i;@{}(aqnt{a`OZdSw6aQ4uJi7}6YudrbY-yZ_LG?n3
zifmf;H!i*O?rESf&`a;`SDGHWm|3@8aXqMF2~kl@+rbQO?RWkJ$1Z=%g1@ibLE*~*
zacP%}3J-{-1WOV8OyCFsr3gk)o1pbTsdyh~deB4#q>V={9g+rKmi~o|9j3vu7-StL
zXklKb?%}i-?WaJKbjQI9$_}O-d<mM8y$CK8($l(~S<+tgLqnuw`hz8)7B*<&r<+Fw
zlss5LD<3*sRM^rwKY(1v4jS#}U;=g6gSkNUzSw_|Fu0?_CH+6`;3H0us0vG3K-x}F
zMg`Y7_kMw!si00MYIhRs#=~hZ&YeU!Q4XscuR()=+HO2r0bOUNis?qss-5OH9H4Q5
z7vf+S9tQR14!#no2X#`?)4JVQ(q5=TUFHwwgEAqcL^=4F36wfOqwt_WV*&?S7#F11
z47wOD=UdvrN1)W<qQVFYF5gm+Q$D1<m<>uI(TK&jNUIhUK#tid0P3xQ>j8nZ7X_!m
zwJj*)LRuE!aV-US%R>2ddRliLxTu?}10EggZUr^ZKz%hXQ1n1n1$N#C*U~#d2gs%w
z9{9Wp(O3mdT!K_{^c_gs0h+o@tN(su6SG=+hX|<u?<2tk=`?Nnua@2+sF&U~)eKZ7
zfm_WTArhc*xvAz1A3?Gq60DFR0JZea5D5WLItl|7#WgA{Y5eQ2tAWOdBt$j|sHJy=
zNU(t?<v^2z;9Eb^8sCE~2Q};KLEQ!(l{ChiY2bCjJSyp3K0F{@JXYyx|3NDxn{8AC
zO0T3h*KskFfO-L95VH;7R)SU&@vpxI5jNSx2)2?P;cKw-(>h}$I6!d<9v1}lvboZl
zAN-xp{GHjPo=dcpD-FC%<OCyVAov7x+I!gW*5z}c6nzZjSdd%66V_b}HvdZv!2NHA
z^WajTL@I694sgQ<bfr_;i^8*@wg9O9f32JL;?bl3|6lL5(Jhe!Evp38A!z}iPQ~==
zpqhVH{TXo0#Pj+bsIky|1Rmu`D@j4!{_AO-XVbv96{o$h1v?8g6dua{22|N89!l%{
zX>kfVyrc(84=++ciok<JyKaCTrwtkidT|wO---XPInrKuJo^8i>GjU(KFgRT#OnWp
zhsHaPrM=Jxc>uC9Z+g`-W)-!UAOZNII{xk8*_M|J{)4+pFP1?X6BW~sE@RfIzXl5E
z36M0}H3KwcsF&Wo3cOr~fBRo>Tg)D!fxqJsLwZ*jYg#k-)@)EOzxlz3wB{E9X`q|4
z)6;rGp?7DefiKU_N$>JwOHb={Wdx;TP@by=5wW1;>&gNWV@Xe|?{#GbG1)+)a^S19
z)0%&%lscw&xv{5rho~^U1CJSZ{sPgQX`Qz~G$`?gsIY*T+#p44?_LXlUAhd?Fsp2P
zZJFN129g5nXH0|WXM*Yn%?LyF^Ra+bv4I+};48L&FK4#n*Z}f=dS}UW#}&+S@@e49
zwZXktp0t^1-+zLF5mL3M@ozsiy=Voqmko5a0i%fuD7}JK)deuU0qYS-dyxZaTvW29
zYi4u3woCIZkw^nyx19#MY`bCl?-k4us*v$caP9*gt(f*==21`?!@u2`3lu<1w*MK*
z&8AnZWL5;-63LQgc_M8GXipY+jT}d@+w|2dnN8)>n*V~wU%)YQz~nVQs=)NmE163f
zW2a}XVwRBr-ADr(mVKPI6SOTQt@9N)C5BF)yNX%2UIx^|?Q-BqgWk>H%?NQJxCmqc
zs}wi_%5R|VWTkL=7r2iLU-$L$7^vFJ1{Z;?kmS|f0SQ+h6(+s(?hT-ITo5B+o)$=Z
zvF`By|DdT+;S^B$Ew%tO_rwHRe!T${=^`qihzbF%8GMoUA_`Ioln8DB<#rL3cWK}=
zt6#1F&E{;+QDFl0;a_k-RF&T9xt0c6<OCiR0-ckW#&~S{{MF3j^-OB%pYy>@@Hb!`
zsi0b^^+3gRP`M8}S)L1&Mwrr^-n?!BjS6$Y?0c=Zf`h*$|9@KNPf*tp)P8>mvaRzV
zOa*A2JLk*L|7qYOutB8|=F+(7wriN(jP<~~HlWo4XughLExn7u#(=+tm8qQ9MxaE<
zMuER&HN#6UCL0I-7Fnj3j?=fTVOC*0HvRS*X5IR=ptyK(>D~YTFBda{EP4_2<^TVe
z(;@8tAa*x|eP!SO|DYB>Xyh9ljc-2u|Nk-%BH91-|NoasjG#<s!(3ul&ew9F#4FA4
zk_}Ud`O79o8v*{-8b(l&(F~2#37|MlYpy@U{wA&Y!GVrLX*)ots5ks_cqz{asdm7w
zDgXWd|4S}ptzF%q(k89*EGRL6Owmj4ZU85W<^xRNB)@?V9Psa8^CB~k{r|rK5*hDc
zi>_pk{r{i#Vo|*VXwq)`KX5Ui_yb(fSJbC9A7ca0@|XC+3gdT2L235rh7D<*pWcC0
zGecDergeULW3!<|1DptiK<2g{D7lul>kPO&E&`Xw%}4(Kf33b@0Z2EfBLH%@jY6rY
zAt()iH^M+>-O^s@eE<J{0|&$ducg5O%2X-|PA4DIUQ}G4zIGk62^Z)*=GQ0EUR>Kh
z{q;I#osg-&L6@D{G?iG`w3Im5G?sdRLvOM>1H;Rz|6sP?OHgz{*b2`<(FI|P-ueIk
zWf+A0|MUO<FTEgasp;A4nWZ_t+~Z?Nd(nSpdf$3x&3eR49(d6)c#{rz!_10r;G#_=
zy~`EcNS07b>*m`4>Y<i`#tLf%KyK*#mBzp30#h1jGXdj?wB}0;U`?O}%^@lZpxQo^
z3$%pkxGNU}gI?OgHwo#Wg`a87&zM2WNL&Bcm$Ij|e&cVs1=1Lz0$La9qrw3id6$AV
zz`+KBX3<<!1kzp{181wlpta<!lR;y`r92>aG(TY8%#x;g7_{tyC5?X@sK^1W7PGui
z#|`elaDdv=ETG;3sHvuTDDB__PLRo3DjZ<P9DK%^p4M%nlE(NiJ*~Tz0Thdn_0*6R
z(P^D0rguJMR;&jZ5u?JA&KS#;o(8%z7_^8uL`8uCv~8;S7js<!s1*eor~b{9-Wj7J
zm7dn^3i6zb3fvRVLFG#4VNeAjm3Hs}Q#zw7S6b_B{?_H7UTBC43)rm3pw-=Js((Pq
z4eVM*SB3-iub3dMU&as>ne?<~u+6QvOY(6CS=BF4^#QtK4>XJbDj{Q3SYF#fz4-&O
zF9ke-0Ai-`Z#$iK@F6HPOjN*w=grUgdv5jJ_`Ia=RvJI|w%Z`DzuuMBd1Lzi@64k0
z&2J>qKx_D~gZ&K-XP)#f2N_V$gc%fC!IJ4+-Vz-rKuZrmf{f{1&Y~a&6R0P}{O?2s
zxHHJeP|BIMi?Nk~;pI`#IvJB*P^H%RjDb0g^BTw;7ZqkuVZaB@s~dKLa_{l<v~>P$
zE-FlxKlmpfgeYRPJj6fg0LO_^Zji!*F9a-)6>+5PVw}Lh@H#JzfB&~M{_X$M_}71j
zC}&DzJO*Cw#=rg(NW@14G<)E}2bu~7r8vU_pk$&VGF^TXvqU`$w14%24ZIX3M1?QC
zBUq;4%sf!n1XS$H?*TUpVN352!$GiMx|Wvl6BMHv8K430jP2mo<VjFT4C<hPjJN>e
zfM&~g?*RGnAb7S1be3>>*YxC#%p%~?;?5JGlH2llv2e?!63_zRZ8a*)mgkFEEUy+z
zr0rs42K8n@%UWPAiG5kI8@!6215}^#u!8&wTHgZMA_WdR9~EZM6a@eFvuXV6A!8N-
zX)yn%cY-{d#=qTpy2>VIVP$woJpBIue;O|XAIQQ(;A(_nHzW+EuUXG5H@#vLGq2?w
zh@upPqTRc|ibTNMG!TW52skaB2bCNJ9O-=w)Aw#-mS6_W`d{6|T<CQD+yDRReaxW3
zluIqWGmNR>%wAZ~zX2tQ<|7~zp?&d|OBLn~zxd0uL0JY=SBXqzn0|g6bBHfPB6PR<
z%UavCU5q!G7+xmsd?~mm?M34jaFqdC!Lw{T0|Tg-Hazh1+mYX2!0UHlE(N9dYoHZ>
zFAOhDFWAm(ZK=`l^Fb*`+78gctgqD?e{wx2VQc)!`=FFFjepz0hBGp+RT_WlKPZuC
z`1zq!GHnOw=>5i@{~5}rKiSUwm@#eoi5=jrso!=mTS*_e&cN`REiL0FIC+?Z!Ybmm
zxL(@AC!y25cQQxRmw;0bWEJ!=kjFuD(4f?Fb|)ye^KT0l0mVi1%eQ|ZtFzL(0z@EN
z1=AZUWW7smK|x#r3gWb#!k`4XZ_PIbhMrq}w?P>_y`e&ep_Ho+w53X|Lu~E0v|S8a
zm>?t1@h{7_)q`eZ`PP1GIay++*2TB(o5iV8dC+9>iv*DIVr86=9`H+solr)&Rl~3Q
z<(z4T7aM*yG~9yhgaMC7y!8G9sVe&pZ1}IXsE^_0f(;Nir@b)U2#F2Rw4HBu!D1sV
zI!z`nE&k<_gD`z+3;7s8+e$S+#-5livy0if9$W|a9a8Hy;{)y6?GjT1?O;`BXgOJF
z04ZPDLHisu(wx(pAF}ryOS3#(%bDh+)*+_G@R|>_+hLI!*uyVvL3@efz+09&52w9Y
zV9daf-sLQ7!^Pjyz)-Gc!&Ks1&X;C*5;XAK3R)Tey26IFz9i6wlfQL418BpY!OQgw
zHbNz(<$^W>C1GhhK{H`Cf+bNeXE500^S87y*i7PY?Exv3ZFt$jkoMv=sN;sT_cp!5
zS>|;PD9W5A(q0H|`2WA<Ksx^vXPMXGkZ88M4lxzd(0a|B#%Fj5A`|^P?Zw=))4xAw
zHWP&O6k(e$U#wU+J$V<io=-7HdLMX4&419&+q6zMi?kj5v!QIz0vTor1_g%n<IYM3
z;Qfa$(%1d}ug1?9!lA~`7$d;1a3HPu1S7xFfmcR*r$5-mELG0|=`+aMwDGshU@AAT
z3FdD(%}_3E<Imr+iOnX6zonbOMx`X?r3AZ8J%7tJM$p}I5==Jn{4LuUUNW=W9N=&H
z$y_dO)4|_zl9|745mQ?8fdU&w{<fcNFQ2g49O7?z%WU(4zvT_9%|ZUwOKiv~A-$8u
znd#-S>9xC=HGI<7f(lVkNeJ0Y4O-h&y7tMW3op`|A25Q$^#LfLV4JN$@>92<izNNh
zOIx^S`p4bO9yTI37#LnF+DP)Zw6eY~N>4lPEECVb0E#>bru61ym49g&@4(qsZ|nd6
zX|XS#u<E6C^X*8`OIx^Qdg&f!C%<W|=;klooZjUuW8+XFViQoJXk%J>FCA>G-hxdD
zueo6CjS1-;&Jr(mSRn#0m07{AV%^IuZ~2b}Bv{X&w_pQEmB7ol;I0|6x75Lwv>Yhm
zwP7r^NPF>m-T(hDk4=x=%dAv?2~zCwx6ERBX~B|y%vrWAz1drZG0g)ML@(E~fNBj^
zh91ybOdl0i@a!W0_Dj$ddGG;vFsWE1jq^j=i#CW^B^)4QnqR(S1`XY^GVr(Bv827o
z`VKlL0W$rX_Cjp+fAA0{Xl*v=<a&^K#Y}0PU(*ggV*%C7hW|nP!34m2S(?x3r!}5u
zn9KlL>z1C@SpeRmRl%c|)@`Pdl(q|Wgl^hS28MoyG`|u~DBtiTXf@pVw8rzG6rI-j
z7j*FfBxx5YfQFwkRC=zZ`9nK|phhYGlJ5}vIIpE~f;56`1gR_l?N{im&`C4=mfr0x
zk=FTLEuEh+fJ2X;QBEQWDHq5coc?kjv!<f&L52^Xm%e@mQlOC3a{;uC0@Pe#emUt6
zsIX+1ZoHq_gfVt{#(w72?4a%DAu6oXr4BI5nm{>eJ3wn^UTy$2h(c6Y({_9U4`Y9Y
z3}ErME@1$*p;*&9oCRM-P0v2SY@Ucn=6M&uU3Av89iWvvX)pR9x=QU~dIUfWHc*-Z
zG1${PoJC$f{spS?c06NXU;u6Hzm&EEGDR5((ahg+Xgc#jX61T4K2R(yP-jT%Jf6mR
ztyHGvKqY8BZas)^cqt9E#FioL#ou%P|G#Djop6xWc^niIKhzefgLI~Knkg~7jQ9mk
z_lza%HVP#!pgHEWg$!Y7whRmmjAfvCj0p@34FAD<uXixmFfhF4P19vy5MW4~zVslo
zEF;VG!v~q|7!{^79b)#8L-^cy9eM^+TsQsya%S=A&4-xPnBJ_NzWNYzDO2g%=}L#0
zV<lEC2iG#Cg=sH*LEXCZAl)w*)=r;(m^o725+Yl|mezc(0W|z}?J#(G4rol?S@yLG
zSaHLe>EcJ2&FaHpMJ#N_Z{d`0tq1s9jxd9(4E}QQv|W6Spf2j-L&e-`U1F2IwOrzF
zUCInP#N#_-xx5V%e~STQIR~gR5oLU>51NJ7XS8ACZwX+0S;uU{&);IlT+VO9$=`C7
z(T0z|rJ3nvIy0zTb!2`S7Xxl_SA(XH7fkxra-cL6)RAd^SPyCoH$SL?tjTG9a3ihx
zKmfRAg6)O?Z8qza3xJ&4;K|T;2sGlUw%CiI@6ZMbwM8uqeTSy!9AlQqo%ju0H}-#1
zTh#XrydD?2?ABWYG@+dgYD>JZ2eTo|agD)j$Z}kDFxwuiMjFgE2ebLX>>Mzg8N>$d
zuIKNlo&NC{vuId4X!L$tun4Hl>MZ*57bDEkY6}xUd*&t5Uc6ZXDoC6~`woHD!h%z>
zAye9mtx}*Rztu7frRnJn)shVSt<p^C4b>71{H;RMV~#T`Fn*j~dz@J=^b#Z3aKW?}
zXF=D$LK-Ih2h(=&g59L24)Pm#|JY|xNiWNue#}`=;pJ?`^zLE_uvQt+7GfR{GZ?g8
z;iWC3&GgU5nROk1EC$uqrIHY*wHzqrPkV7h60*|RS>R>r|Fjod;oP(rYKQ*+Z~ayR
zDp0pM%cQ;FJ2*Y@1hc5fqQ&5~y5Q}@&^DF-^sW=k3QT#6r>{A|EWx3vmiEFxl7V6R
znG?*?0W4|^3~AnJFEl~=I*+IEZ@UbN(zF-+vY>-Zz}r;%K-&`gzrBX;Y<u|)I%@aw
zz#3?C!tfH*F0<+8Cz<8z!HJ3kRMjvrzUE7BsFq<WWd|pSiLmv-hrwAOXj6a31<)c)
zP*0B;w2mCaO*6dRapPHGT3A|!6KF8yh2Ki>!j_1R8_#&3-P&;A*|m-v&#r(f3}&tp
z-*Ry<i?zhITo+VCF<Yj2*f5s|y;cB=bC+0wX`WICX#IbKf0J4|!|B%sAR9`rFfgRO
zFxCZ;{nH<wVpcKz(03_q4+Chm<gTwD_!wT^Rsb#81D&w~b~I=^6#sSx&~RTsT1F(;
zh5ak0Tb*WhbXH(0uLWhs5XN#H8%F+?!wjHfdXzvJZhN&v+QH|b7~AeFlE!%)REuSE
zq=C-o`O5&x*vlC~ZNYET51wYWmVUXK$%dD|g@viy*@ip4+Z!}00X~{%KjZYmv&{0-
zP0uh3=_N3MGWR>im#IwY;6r&pqbH%@vN{cVAP=bN0XdS#czWF#X0?dpB_^O*h0YUc
zFXkA5Rtka^+g2U{>r4Y3$}@)ndKAS2@T$NxkF?HDuP>#wzAX_=^L-7POx<1$8X(A)
z06G4(dphVyo^6cNWzRBex*jbtf|)LjF#Q0`^jcXgW?uo_%r-5}|MgK&TcGV_)bzBo
z%r;D1jMI6~F{@2Kb(Wcr=?VkH+dt1T3o$O7&U230lsgA>q(&%cyrN*b&pBodH6Kt5
zRV}@{l1VMS+mof|Y~MjpuRT4jcY^|W1;O_JX`L6RPd~@3P`_yo$g;+CaQg+ElR+Cp
zo}{FGzpz5FL?A6A8yvB3mw;9ey_S2DfVABp=Uc-grV=hlPH_cY8&)vqNy-WZkhWg1
zwrvn?x)|CROC-VC1YfM){2#Q%I&BB&c9*mly3={jGb;=2RA69W=)2i>u<v5u!@iek
zuU1Z<aGqI2V&!=a27ZNuY0VG+@hcsCwc|X)2XKR7`kwR5QjGl5ub*e`i%Q#-e}SLj
z<re8Z3=LciFQ#k!|Ifeb*Ppaq9U$Sk(kNGvcZ2UKfALfcbOjdpdU6H^hA*%G{`vzw
zfZ|5qg|t04{xLATT=sLi)<tG1`Lv#keK*rUix79X)$oCv8$3E`JO6`bd|sSbGoA4w
zvp?gT>46uSofwZ#pK_7eis{4j=@%|C>oCrl{`VrY31i4~qf5+|Om?rP=U!sg%(!`x
zfx+OwYo-kib5GCFOZ#v3B;nT|xwHV73qWTWW$e7fz>s!0&GJF1OoQFTZww_oX%X^i
z8TH2)7+%h0NQ;nf{=r`N{(M^Jk+cZ;^Qih4Uig;Q{6b^8`~_yM=^B@rL;1jKY;L4M
zBn%)DTQ4)GCR^@eU;vH1XWRxc_Ww)EaC*+b@N(O~w2VjRKv!7*OUvkQVqkc=<X>9G
zkH-uQFK7Qt%kcWa!0>X?Kf_DlG6Qr@$gb?Kd<-vFiX#izgM_AuZ?C<=?99rNHX&`o
z_B}V57qiuCBr))}x_&@b8})^c;pHT5q#0$<cqeEh*wwVo)8MVGKR7_EL%~B%ENT0}
zK02<pAm<yX6a`Iw{sEOu&F4V#m>?l;a0`z+ZASvAOnb3)D!3uT-+G3zKJA6p%K!iS
zj;D2gP+OGqEj_K-Mg`nj<Oa259^41bnLc=r#gIafA)Uv-L#zpmX`L_r9Vqoo1K$@9
zTX6{5OZ(#F2B>8gjA=U;@Pm8jkYU6ZKiB_{0c|Jc?~r9o?_f@Ae9FMbz`)-k#Q3^0
zt?@6Y5zF5?g&}Px=r-82U7tYRC(t~1+KW<{p-&jnc76dZ^#W}T1>3h2bX6bd#?_My
z(+ejti`3h{mP>1X;STEZIxwa2FFsVP`<f?BcQvTSZvMeoE{|?PD8z({>hun0#@7|;
z$DA1%UKfH!`T4h9fH(%~fd>$krGaS&|MH~ymP&)_bzu}Gd%;%+wjL-24J_rTu%t2G
zO|yJmqKt0o!*$?bs$d5Ng!Aj$pcAl;r+2xia6zJ_H$;UC7JsiMgVmNYgU7VNCn!OO
zveI5iPX7P@Wh-wQXdhWXT3}jGJ)0b;OOY0m#=reZ+Ka|n|Np1O$g_i1B&S83hmN2G
zrR@VHqO{KMpcRF3z2DRp^n7c%U7`Rks$K+xu3`gi<a^<`9DGRGg8px54r+_~zoosn
z)d^}+fzEP*4McQ<+K0zLn~>5iTvY0rOW0a&m+-!pP+QRd&EjzBr<aYOk(LF0-$2sL
z#mb;I2Poh`X1wqMTLAJnGq~m0A=m%ybs$J<%YhPMSVPN_2h=!G14;HB2is)jqQYD(
zl?L9tpY}o$BoCHIGj{-)^ZF*(veGFKlS+H~j%{F9Ths$-rS^V<*6;CYhc_rZQ%F1f
zl7HG0W+}_&H?XXC864$$>0Jyh2S8U}+o+a;mQ90JG4vKNg1Wuj3ZQdl<Uywiyv(1z
z<PEbM8)%(S9^>@aZ<r<PnbSJofzMU!XQ+1opQ^Zkv0e;(rs506H1LUlX)ktk{Qv**
zJ!1ptM8(Yv4Zo84TTg=qn!&aIKIXI+(?JSOGdBDx=5LwASZ@wKO>qTCNi}Hgx^&tO
z$R@V@4$vY6(2<I1FOorQDZ`U#;2pPVoi|>}FgE-uEinTfsObMPd-{yG%*srP9n<%|
zWmZ%@+WY_iOH;5DrW^u|h^B+Key68(3xh}QS<*Uxww#>K^p4q5;>G;-|NqlGUw;Je
zj)%<$zwDSE{EpdH;e{8f>@D#0HcQ%zi6HlM{+_<=9kU7(d;9b|@0eA?AGE>te}fK}
zOnY&m4KzU6ZKCp;8M1W>yi%V<<)!Oi&>;?x<|e4ZJ}Ys0!po?)91MRL7)wCwCDRZm
zKu!8Ko##2TKKt4u3=A)I-b}AL$!rwE4@$7Gt>c<6K%K1Zm(pImo%R2J!(#{jmM+i?
z)DiGe4Mu4@&VYu1!RLCh^c?~fx}d`d7}9J(;w3_$4acBf><x9$WZB25(>YEt+iNtp
z{r~@(J5Bc@GXsNK+TuA3khNbglbg?aolcvOma%m=1H()6*VBEDFiT7R1f{4}QAThF
zadsDI9O^izFUT>y;RtgWQ(W)#8%LPcnTlGbGah9Y4&`15?N+{y0_%9)3DR+_^*~8f
zdRlK7(;HCFy7|HHci?z~O@+Sd0jc_t)_ek#Od#{(VT`XK3(r?{PES3`tYddp=JZ+V
z(-YD%WX>}%ybOE^ZtRA^#^_l1TO1k7eL+3Xbqt^;?lXp#1Es~Fs)0G}h2Mhd`(82|
zS+FwMu=BS(U@YgfVdZaaW_+o^XtSHY^($k~B~VK&?cgJpG{#$?aN9BUD<5d&6ttIf
z_T=drubB1u=P{<eSiKBfy79NpV4R-!idkCaP<n^6B>Wsc&|sVhXmR_CT!_LFwzL=5
zrtf>jtjMylyW_<4hp(6=gr|eMUkqt4q#=s<TREolyk=I^02OnfG2n`CAXCAkR%aN}
zUff&?wzPyZ?S+#t1H;Sx(?ee~t2%;JA5vRX@eO1&sGpM7{Gh($P{)a91sxY&XF^@o
zc?{guVOXJ1nvwP*4{8=$+KcPccfMve=9P!(2I-vs{WY`tbc6HEGW8Nkdi;!HHxfbZ
zy2gk9|NoayYd*=yuXHf&mB$-?1`f!5;)urJ|3_&V?4ZU8&vSU|pz+NGQ2hs*X}Fr!
zc^*9T6abo92T!3wn+Q7_Kx#nSH(xe`^3`z{6%K}*^$ZN)wNGjLKx?+rzTZ<z?+!5r
zwd`9|o-i^nq%nea+JKJNFg%df`WCeL3v^0Y=TUH32#(J0x4@+WXsS0vg(J=KI)C$V
z(Cnm$N?PL~u%(t4isaKWoInFo83N$x2yO6Qg?(-R>;HqY^2^Vl^)_jZkN$%i2Rj)8
z7#PwtFM{`=aHMJeO0&FJ%L7?K=A*)srg*9cbZFm6P$Lwy3X{VjJ*|@?J?*#y=#T*h
z@Of1a1=1QHGBEtFPvd-<)_Agk2h@x1^Z;$R^x#Qj{FP>Ty;w4>`5<VXuCww_TH|qW
zU$5~w!-xO>Uq4D~KH!kndHtmhXuFcb0njKsbRQB2C_R9KEIq9^$M^tfWe;?V4rosJ
z2Wa@ul|e1N%f%RTUsHNoZ}kT7&QXrE7c<-c|4*+^16{%g2~1W{U_qk{bkJ;iT6YCU
z+V|t2RqLR29N@x}C+)>rP@xJc9{L&3m%(-W81Dfu83h$lF~%oAR4D_b*OIn_6%+$6
zzP0}UpBA2;_P<1hBdtCxEf_rQEsz!n7LrNJhyh2ADo9!L5gD+p9BD7^^MisAX{!ya
zqP+|%wqJm@RlPPydm%CV|Nocv|I@x72NlF6Drw<q8B@RpUTFdKqSB&Z2KIsC+8(r-
zQ4%~q&f)-Gdd-raW@)3s-}(o9vT5THaMFhN&CZIQJ}U|;pHe~PQ{&_5xl@=862RN=
zO4UJ$L4`SO*IRHC_reEoel8VAYkvGAohwF#x$l@-hun17ktByfBZi=vV-QZuFn__o
z@N)8FNNcF$Ftqn^K&{(s%D3qs-ZR@+8Pq}y<VbsQdFKEBudhODpu^|Wg29uKH_~2g
z28CMdfl`jN7wbW4UV&yU&rjdBo>@`WWAFd}4QI~5W+Ag0kmfZfOk|9h{^tWTH>1UL
zj*rX%^;aAJ{|9d{1Sbek6T77nRL6&?2tiWIi-2BGc@A1i#orpo2;L;e0!y4MYH8ha
zDc{u67G{7JXT*Tlx4WqDfHuDE1*K+iV@rp#<v>XQXepJIi-<@mfBG>O5fO&;4i^)y
z`ZTxK`ry;P*h(LP6#J+M!8Qf02Q~Yf|FV^UX5)3Z7)sedZ6D76X|8F_f7wfyf?94u
z;ByymfZL9{KnXbQg*r&v_si)@F)Bi!g%_aF;}=3xLB~eAs0e}T5RUY&7#oq6+a-$W
zpq0BID?u$zP?==|Qr8h<!UeWUAk8h!J+1jaTj{y9=6|eZN+2saTMm?}L7fVsTueB@
zRxnQe|Npf_`Y{(1F3_R0rI%lG+x#zK2hCTwsBof%8zgb6rPVJ^`37e5sHH8=`1Z2>
zA876Xw88aTNglW>B?M}Dzc|+oNfS}&T`?-cAZLiAeZP_3!2(|VEtJ;$05qh{(Q)&@
zPv*4dhXQGwC(^rkR1W-PN^5?okj8le)K*M;A$|fpWOq321@8$^;mlvZ4ZNWI1ZZgw
zBq@SM#Sf@;>rMFv+PP>CN(-^9X`Q#;{5t>|2Tpqt_Z~Es@C_uif|0+ahas)=)tkQK
zYF%QL-#~NQ&(ip}ol;BhXoMV>tJWb_`7O=u^?9`}xtee39WpBaPVl#!WN7#;T@sg8
zzYBCg2`CtORP@rjK}$()Sf1u@*~*}o-t7e8-sEpt2Ihj+(cG}S$=@=aA+7lkM_S`A
zj|U74rN?1&H{UBj-Am9}zAXnzCxWIecP_XC>IL4`OYd@Ifx6M+LNVwt5XdTudX_Z9
zx8Ti?Ec|_wKwA$&cp3VRr@5-7ceR2&z`qYNz-f7?<T_|(_8>=E^KY@zb>Nc>_*?A$
zzm@|XW+KhsYW)B8D^PJ+0A0<xu>Al3m&s@c3JImX*jN1@e4vmS0~5&qFJaBXIlce?
zgS!OHM=YROJ~r*JUV1mn-DMze@NYkm_QJRPKj?@#mb**9Lfa0cIlN>89d^`tI1PHP
z3wZFej{!WqFT&sA!C0OJ8uF84EH|)W=5JwOEEfR{7w%)QVdAfEdBp%~+eN?R{tY^H
z>k|X0Ew!BqBG$AYG%om^p<EO+y8jGR!22^Y*zoYT^fJAi#AGAD-|`qFn9aywBgo%U
z!Su40$;OqxMVYbO+{OviyDpcq5#w(;&tT)o-|~>bMwGub8ftb%b=poAhI$4D8)yF3
zql{@gLAOx8+{0+&!QZlvv0Nl=Cp+liaX0?f72x)2^vj&dHlF+~M;UGW_*-r;z7z(H
zn~N}1aP%EiTj0p>nhivkFr;@l%cge+tF#;djVhc1uf%@zFTFEZ<>gC8$b#9|Y!KVh
zI&ajcMZe703vvkq!|M+aUmI4Z?PBm?WO%uXF>Mz^7$d{Wg-{nv-JiCLp@@;;<pj|B
z!HJ9v=?&E)4E!C9jA^^rrZ6(RtY8EUjfSpDKkh8S4hosMp!Fp;(q4F1flfwpmNj^p
z3U$Ow(8@Ia`fbi4X}dt%rflx>w^=c!cLmEd{9-I|Yxu=fQVW`hnGP}rbkg@Bwe+qD
zph>KTU;j(_KvN}*X}h)@WMp{B%$Vk+mfiuDgo-m9V`O;w8bfQ#C5TRjv|Sr6GBUh8
zS<jH>1=HGcDV=|+vrO79hU<(BFV`b$hMrFYlYhv_@Uoww?;z-S*%EN`mk~U+`LYX|
znAYwCjW~0s9efBGgXRF0KrfCpffwdzF)^fd9(wJcwu`}7f(aak_sg8X27rc1*<QP)
zcR5cl+{SEC|MFP{Bu*w)gDN<1fyj}z12T?&_4WV%zrMWwJ0UGYsFs1@rONG>_Qh!#
zsvx$+?U!x`8vb<hw>-R=mSMk_f#D_VZFobr`3-mpaawl)Xfr~a321vlhYM)!Z&w@g
zNg?&%VMovzZ#U9jyeS74!C2N4FD*~&JPI0g=`#S0{C1v8PwRCQ04)s$71W@W<$(gA
z)xnNDpygsL8$e}hAP-nX1SG<i)_Ld+NDl{y#{}AA16f~Q-{qph3psW2Icpl{4^ZXB
z3px~}%f*HVwB(5C9k_ntDSf-a3EYfjd6x!02T?@jO<L<o{?<thAZ2WCRw(edzF}A)
z0b29`iW+Y&P%FEoo1yh2e@iPv8vpvU9Vb95M?s6-AqR$pvAnB?@IcE1!z|vVr*(rC
z$cK4=4$$Zga{)=d2XzD;Kx?wV2VqY+kmixr{GcI?wV8o|;oXJ_P)9+RFoTzwyk<*l
z{>fO%vqGT65h4y2VJa2hAc&?s98@NNWtmIGR<M)^fjq<XrsLq7mXoDwX@>t_D}uM0
zaKQSWxi3JqTDOl1$IIXU()NRv`-0~gkq`YmD|vc*-Y;fW7OqK`(=sN!WMFvtVS4R9
zX8n5OD`~;7E`8cANJr&X+HO!g2Grb+5dfdu8Y3XmcMy~k1whBTb~B}cMiCl73Yb7?
zG!41A#{fPhC>^{6AF|e|?=Ywd*ZBHRKQE~DF5U2(xkN0j`889+W2e6*Qs4z~pmWOO
zUjCYb#F2UnKDq+bK0Q3)d|HMDD3J?ZfwUsiIuE9SuM{zz9#hP$R4A0ze2^n;ALufX
zG{|it25FA3-+|%_)TvTs`2U|F4K$6|0Gd8|pVs;7ZJI~(kH2Lypi4#g!Mgdk9Zj>m
oQF8h<OPb^BkD!xILE1s~$EO{B75#wWgMpd8k+Hs|CBq*E0Iws5lK=n!

diff --git a/pc-bios/bios-microvm.bin b/pc-bios/bios-microvm.bin
index c98351e73457794373d67534f2c7cc639819c5b0..4870015d9ca4eb56f507ed8faf5a4e3ff3799b13 100644
GIT binary patch
delta 58823
zcmZo@;Am*z*l?hFqrd~j`aVVmhQEvq46IBH3{p%C46B$J7~U~6FnnibV9;P;U@&B1
zV6b6fV0g;Hz#z)Xz@W&=z)-@<z|hFbz%YfCfnh!?1H)2Q28NZa3=G@Z7#Q}mF)(c5
zVqloT&%m%rfPtYxh=F0D5Cg*=AqEBmVFrd+VFrfz!VC;wgc%r0#2D%s`otI*=87>e
zSco$)c!@JGbci!BTo7kqcq`7pz$n4MASA)SFiV1g;kyI_gQ_G0gRvw7L$f3U!(K@S
z1{Ns>22Lpk20<wXhA=4x20s}Fh6^$b47X$$7$jvG802Lc7(8Sd7-D1@7?|Z47?#R0
zF#J?tU}#ffV6aeTV5m{4XJ9z0!ocuRm4RW88Uw=*H3kNA4F(1u4F-lZ9R`M}It&c&
zbr=}5bQu`F=rS;z(q~|}s?Wf1Tc3g9zCHs3qX7d0y8#1(q5%WL0Rskx;|2^2p@s|$
zHw_sW9vCt(NE$IP%rs(PIBmqh@Y;ldLD-amVX7$u!&XxUhGa_yhWYiD3=FF+85k~E
zGBBuHF)%n<F)+AWF)##KF)+kiF)*ZBF)*}PF)+-tVqn;6#lUdIih<#l6$8UlD+Y$w
zRtyZ^tQZ)=tQi=htr-}Str-|HtQi=lS~D=5ux4QRY0bcJ$AN+2g98J@HwOlWU`Gaq
z*NzMfVNMJTF-{B&>zx=F>bE*EFq{A}oEaEeof#OWJ2NoMb!K2-abaMX<I2Er&y|7U
ziz@?zr5gi7h8qKey*mR#xjO^HNp}W@G7koZ8V?4B9uEeFNgfOgW}XZTE}jew{+<jB
z@tzC}xt<IRb)F0ii#!<^c6c!`7<)4?nEEm>c=|Cg{PkmC@bPD;XDIe(U{DHWV9*F<
zV9*O?V3-ibz;Gpuf#Gf#0|RR~0|R$B14Csv1H+MU28OfY3=HZK3=Ha#3=Fd(85kO(
z7#P+?F)$cLGcedkGcZhwW?;A+&A{Lq!@#g9hJoQ=ECa)dSOx~}I0gp2I0gpOI0lC7
zI0gof1O|q_1O|rb3H1yNTM`%;CM7X2EKOoy;7?{?h)8B&$Vp~ks7+>IkV|1;FiB-#
zuuNrO=uBl`5KLoWNK0d2C{JTxc$3D!;G53C5SPxta5kNR;chwugI@*%LtF*}Lqj$L
z!-Q-GhPZqNhF1j)48IB(7$z1oF!+@*FgTSnFql^`FyvG)FqG9-FfeSaU|{I3W?-0D
z&A_m{nt@?$H3NfV4Ff}R4FkiX8U}{7H4F?}YZw?#)G;tzs$*cdQ^&x-RL{V`RnNd6
zRL{WRRSz<VfuXCOfnjnz1H<Zi28R9h3=9Gd3=B363=9Dc3=EMC3=D-03=C}z3=F3m
z85jgx7#JK|7#Qkp+ZY%&wlOdqY-eD&)6T%Kxr2e>QU?P=dnW_K*-i$AXPpcTI$aD5
zN4gjo>be;imUlBSDE2TgnD;O+r1UT_%<5ram@$EY;o<}ahBp%!7=BG)V33^1z>qqT
zfnoDR28LG?85n*}WMF8U#K7P*g@M6y3Il`eR0al<sSFIOr!v$t?48QMaBV6BL*;Y^
zhW6<U3{$2vFwC6Jz_55a1H;Pc3=E&AGca(>U|?XG$-p2tlYzl-CIdtKOa_LMnG6i9
zvltj;XE88LoyEW~YZe2;!dVOq%Vse!M9yYlxH6l8L1GRAgUlQT28B5c3@URN7&PWE
zFzC!-U@(}&z+f_mfx%)<Jp+Ty90mr5ISdRga~K#r<}fh$%wb>%n8UyjGKYa7Vh#gC
z%p3-WggFchDRUSYGUhNa<ji4UD44^*P%?*sp<)gLL(LophK4x|3@vjQ7&_)KF!an}
zV3;t6fnmxV28J1P7#QZvVPIG=hk;?q90rCJa~K%b%wb^IFo%I*%Nz!V9rbe<81~Fz
zU^p;`f#C>9<3a|8B?}oCE-YkVc(Raz;m1M-2A)L>3<`@F7)%y1FnBCtV2D}7z)-M=
zfuUs)1H+6(3=C@)F)$ne;l&ILe-<+^Ff3tUU|GVzz_EmZfoBN=!x;t!h9?XR3=E76
z4E&4?4AzVc48e>H3_45<4E6rZ3=C<^3=9^m3=FQU3=Bc63=H|K3=GWd3=D7C85sVt
zGcbs9Fff>NFfe#<Ffhb$FfinDFfcT7FfbhFU|_h#!NBmIgMmSglYzmIlYzmFlYt?g
zlYyavlY!wbCj)~57XyO>7Xw2k7Xw2t7X!m0E(Qi+ZUzPwZU%-jZiadWEgl92dmaXc
zg#ru=v4RW?-GU4ZvjrI#RtPdMTo+_ucp}Ka@JEn=fnSJ$K}Cpx!AOXKAzFxmp-G5=
zVTKR`!!aQS27X}%23cVShOOcZ3^ybh7;>Z-7#yS-7&4?87;2;$7&@gH7>-IaF#MBd
zV2GDtU}%+LV3;Puz_47Vo`K=C3<HC(ECWNKECWNcECa)ISq6p!vJ4F8WEmJ9$TBeS
z$}upQ%P}zc$uTg*$T2WXl4D?4FUP>JTaJO@q8tOmeK`h(_i_vjf8`h$)Z`f$T;v%T
z!sQtlQso&Ks^l3McFHp_JdtN$;80*-P*7lCuvTDT@K<19$WdTm;ICI?V8~HqV5m}L
zV3?uEz_3h_f#H-Q1H(&21_mA_1_mu91_mo71_m!B28Pv23=CJ57#P@;85k6m85q2j
z85nw%85lMyGcfE|W?;CX%)nrw!oX0d!oV<1g@Iv(3IoG66$S<+RR)G+RR)GKRR#t@
zH3kN0H3kM(H3o(tH3o+IscH-iV(JVG+3E}oRq6~3Q`H$5)~GWu2x>4eq-!uRtkPg$
zIIO|I@Ir%uflZTvK~0l^!CaGpAwZLXp-hv3VZ9~;!$D0327fIEhH5Pah6!2>46C&m
z7!GJLFx=B(VEC-Xz`&u+z@Vzlz~HRSz>uZQz)-Kvz%WajfnmKiLp{S;Z3c!%+6)Ze
zwHX*VbQl<PbQl=wbr=}d>o73f&|zTMs>{G|QjdWlPM?9HTAzWTN1uUVy*>kjl>r08
zVj~6yQ)32(y~Yd-awZH6+@=f+^Gz8T_M0*={4`@=D7Iu^*lNkZaL|&0fz^tEq1%dq
zVW|}Z!+t9U1_o;e1|REs28K1(3=FTV85q7;GcZ)yFfdHCVPFunWnhr9WneJ0Wngf!
zWnc)lWnhT4Wnjp+WngHvV_*=mXJC-CXJBx*XJ81mXJ9C|XJBZzXJD9W&%kiRo`E66
zfq|jOfq|jffq`L`0|P_6BLl-fM+OEnCkBQ^P7DnDofsI@of#NB>s=Wb_PR1KoN;Af
zc<ai*5bnmn(C5a$FvpF7;gA~x!zVWe23ZdV1}6^&27XTl1_e(B22W20h9XY}hTWbF
z46I%Z3`t%L45z#p7+!iYFo=0GFqC^UF!XsdFx>TKV6gOIU^wW*z;MNff#IVM0|TQk
z1B0S314E!M14EuK14DhV9|J?F9|J?L9|OZ@KL!SUe+GtVe+GsL{tOHo0~i?MgBTc&
zM=&rPiez9=ieg|ek78ixieg|m9>c(JDVBlZZ7c(WeH;TrX&eK?>o^7m_IL&c&3Fa|
z=XeH&kaz}$=kW{-{0R&U`UwmS<p~T7`w|!!P9!ie+ySwZ80r~bBrz~JCNnTRN?~A-
zOJ!itOJ!h~mdd~|J)MDJLplQkTLuGzd<Fx9eFg(V9f+ODz~Gw6zz~_qz|fh=z_2!x
zf#Fal1H<)91_q`q1_t#k28M-M3=D<Y3=A8x85m@97#Q4g7#Om17#Qkv7#P;&Ffbg?
zVPJTX!@%$}r=Ed<FPDKqIhTQ9Z7u`Dwp<2=m$?iKOnD3pT6qi%wIH0&z|fb^z_2u*
zf#F&K1A}`Z0|S2%1A}G}14DWd0|QSn1H-Oj28L6`3=DUR85jgg7#I{w7#Pe-7#MO&
z7#J!_7#Jp%Ffhz5VPH62!ocvhgn>b_lz}0tl!3vxzKnrke;EUVdN~8b+HwYlr4<Ye
zGL;Mr#gz;UQz{u4PE;~5ysBhi;HhF@sH<XNm{rBVu(*nWVQ&=!!?7v`2DWMj2IXo7
zhV9i13=gUq82(f<Fx1pAFnH84Fl5#-Fl?`9V0c^4z);)3!0@brfq}D;fx)Pefg!e$
zfnjSS14I4SMg|6@CI$xQCI$w{W(Ee;W(Ed>W(J1y%?u1WEes4cEes3=Ees6JEes56
zS{NAiw=ghVYhhq`*}}je)XKo1+RDH%yOn|AQY!<)%T@*ki#7&^v^EBY7i|m-qU{U}
zmhB7-)$I%no$U+^%i9?k*0eJ)>~3dZ@a<$^IMm5d&!E`Fz|hpiz;L~bf#G2n1A{|1
z14BtS1H-0n28OfU3=CpD3=Ba%3=9u?7#J4yGcbftU|=wr$iNUck%1v^A_K#%i3|*1
zCNeM>Ok!a0n8d&^cM=1`{z(iBrzSBl+?>R~@O=^kgXm-i2E)k=3=WeS82lzPFmz64
zV3;wPfnf`%x%6Q&1B2ic1_t9P3=I8K7#LPgVPH5pg@HkRDg#5*R0f7gQyCcMO=Vy>
zHI;$k?NkPa-=NmZGzJFSX$%bE(-;_9rZF%~p2om%avB2z&vXU`*XaxlLNgc`+GjE_
z%$mu-5I2i~VZ}WLh5!pjhO`L?`2YX^{|uX-c2;xLcOL3y=ni7(WNJN7!rU3aa=4qT
zGk~R&qxED7bEhLqC)451i`@Y%)&U&FtQ}nc9as)`9%`^)C}DPZ{X_G@Va9`&CrX(O
z4;&8elCqE}VV6A6e1h>chl7*liPE=*2ci#$hXr>Y?zQ3S^<uRASt9Jnzpe0J=ckrS
zB^(Z&pE?5S|G$2DjDex^Ms!^K;m(6E7X1JJzt@HFzvYP{o(2nrdUlUv4vY-1KXjhx
z5&&sx_@z+K?C|>2;n47~;NVUXmCn=r+du4LV_;zD{P3b<83V%#fl?O3+pj%ZZkGz}
zGJ%M%TgJf9aoF(fYYqNwmz`d}ZMj`?hkx7e&R?BMA6`sa#=v03qEaH>8_wAI;YBl8
zt!v|7P@ARn+UqToD<?}!g)d`ZXgN@!(0rJKf7@}(52cd)+YcLFdcnAC^18`-yp{j{
z|L;6#c&VFZYEAg$my_k{EkBefbsla#P$JWO;(v3s07Hpb=ZzQ3K;CnH^J3or|NjjS
zyk>4b@jp85Fer$+1q=_gUMdmoE)rla;^_9`(fnw6qL``kM7PlE=Z(Log!40$a5Vm&
z5YEp~%GvzFK=RV}ONtkw;|>RRi&lj5GxYW_{by%jXne@<<NyB`i@26DFj$@_lJ1t>
zGI{G11->V9`5Ag6|7V{RX*|d<Z}Q_QrqK`P@-sxofg|Wx=k;#cl5l>8){`Y--IA|`
zdV^Uye|CO&QTzA*|JDN~Y~9kWw@Y6^Vkx-u@QaAQ|Nr*}FdClhyb=9!*Z=?jLpz^_
zhc&<9=)Bf>{>81ytxGk$J0I=jU|?YQKcRzxfuZ$4#kp=4mF^G~mdLoc_}If~jTIsc
z%%zsWorn3iGwfnvU|@K`x`ct@`-K(EC8CB0Ud!@tXWnH864qHVxoK*6{iW6eCDQ!+
zIC>*5H2mf)=gPjs)f>Wf!Qu7mhM$bhH~x2ugVIoN=fUP5Or@p^1tRzvdLtM+WkHPA
z1Em%V-^}4>X#OEwt_Kzd@j7{qGR);?=oC51GMAs>wP^DX#?l)Ld0;w0jMqn^4|g71
z7!fYZ&(QpWrTNF762UY}4}ns)G|K>?683Hfme<b>4@|x?ExEq)vf-s}51wv@1235Q
zw;gCbS;EG6sPn|@*S#)G|9f2|{x?5h=HJ#35ysCDeK;6db?eCzPX28NpsGWp{@X~D
z^D$mPsDI7X{D_%<TN6|-|8|L;3=IqnyBt6X{Kkuvg$xY4@|?h&=$GLO85sDtGb|36
z#n13!-(nDlHD(q+L-PTa#Yg7yGk`*TvCk}ihL?Ox7#J2ZMDR1%GB7YSl=B>C4G8B4
zwbvV7gW4es2g(KELI(^FEDj0hXE@I45YEqFyJND#jO_YnKmY&lJk@#Q#XAt=X0O|W
z<{uAALFp2dL7U%j^kzu(M(}jrc#-x0|NqWoofkV_yomq*|G(ui$%{oy?XNp;yhsDd
zu&8u~sIYY2c;N)%9qYWlgMs0|Kf_DfEGp6=DlFgcHD71=eqZsJ;`L7B&T5v<7ccbx
z|NpPkd9d?x=ZhD7|NsBjJSTbo`;F#H4Bu~om6bAd*0NZef;`muLz*=te6rO{DXr!s
z9MPck*HB^3P^u4dWaqWc<K0?@w=M71Nq4*4V`)CX()sI!&HTx?W~C+?-tLs*-^S2!
z_`qwnhTlvjN)5l6OL+gCE_E<Gu$zg2f#J0>|F%NrgU>`djdnAG`0R$?z!Lo19GMP2
z;Nkqx$>hwxt&s8HGZxNcokm@Z%@6oFKfGq$%?OGurpa?=D+#Y!%)qb{lm&JPfCO*6
za9uR{;%rf-rp1$A%vSJ8fJ=kabl!OJdm#fu=dmn?EJm;{!%LkvURa|my0(ykq4|iw
zYvEo84XCmghZar_nd72$VG#pEco<l4mjcAby^9za;0Eqefe5ZxH2KgR-Iz)w<vb9X
zG!*5aeBOEEMc^U^hW{lhG9U~w9ID!45y&YDuf=+uHDLCFyz)YR(PZzrhLf+)HDXFz
zFqwOvV}1ET28M_zQ1&<silP$bEQTy-*c5;Y15nzIh=Q1&0Cvl3pN0xEh7v`vLQtUY
z5&<dHTgbo=8PV%3vJ)g`c<Hq&LV*wi14FNa#tSa6Wncxngh67?;u_H}7tUv32<|-H
zV8K&vz`u>-ze?{6|H%*M1-ga>gNir)?Ke7ayl|Yuz`*%~fBT8fPvBzlWyNd;22erX
zd2s_%Z!qJ#H#SVAy1l_nZ<-(2+c50_WvWv7-eAVbRrBTRgF6p*Ufg8?a_7`V3=GE{
z%o&e4a58mr9CJ`-YCH(4dOAJiUQGJ;|Nkyfssa_W_W%C>5AM9!Ezo+Y#HRVz{}K-V
z?U4eOw@S6T16W{uA<J8(QvBNkMT`SDlmmE5`MM(nT5p#Kb)M+F8U6oZ^8u09`<g4*
zco<3#M<1SCzd%iUw*dnK!@m=yth+(Z;or{IdFzGcECz<ww<UtT!7LzwpP(G`Qf1cU
z3ky2yySZ9VmbirlcS-aXGIknuNOnaqHvEn+;q2yu3oxMxcrZ8o1gT&GmAq0N9NkRE
z7(jIoxE2T18V5VCcDksrfb&GJ^Z%|8+5Zi{qRKTJemU^Bp9hsqzw}Dn8-D4R)aSQc
z;%_|*j(JdRa*T-q)PP`U_!Y<BG8wEgp1)--m=VL@x`cs&q1#1;r8j^PRK6Tzh;e>B
zzt=^Up*KW@<%Qw@|Nl{B^?F@oS-?_a;F_A_buRz58d-+UpB+9b%+9?ftcgs9Z!O=~
zDYw2Y;RD&<>&4jVqr!5GNe`s0^TUgK|Nj4XZ9c~G`X>Lj5*6lNmd&rVQ0$0%Sp_m1
zRNB3GvEkqU|Gm!4ui1|~s({jI^AV28YKvUzIT;xkIu0Fp#oYXW-Jz33rQsJRf6HM8
z28MF}hF>ftvJJmDN}^xhWMp7y_{GoPdV!IF!SFyQi^|Jmj0_CjEGoSsM?oph@IdFm
zgFl)1x0P@+b{=eg$j-m`ToJp2<%OE(h6lQ9R5Uu-JC7awC*N7l(&@@@@P~Y-E6Yny
zMuvKZUT3CVpz`g7+K>PLp(?{!dYxGyq5?la4W7<xovsX>p)B3(-Qg^j*Z5mK85tNX
z5AwG<g2sEcd9ybk_}_f#KjVq!OAHW|FVz_t5N4nHj$}6fHg6Wg+sz06H(&l=&v;Pq
za;GmtXDrLhZw#OcESRykin-H9rTIa9^9wc`7XJ2oAn|Pn{;RZ}@#kj%xeQ#Slz#`;
zGuOLaR5UsbIs;gGojD-Qi`eh~|1%yFyxx55fAjVKo#6Vx@W9In;Ec}&QDX^l(d0Xe
zC3z%4>=G4?PPWdl$&5=x>VJMiaxTO_J3zVfwQjF7-!4!g_~IH!2~-bDud^6L^uV|O
z{~_x6w>dLgx~K@0$aR~jFqWvWw0<k$>#k8@v8++y;qO26_y7Oq6aQZ`86IdpA_B^G
zhxxZ3*tHN;P<)IBwfGNI@*Q}=()@s(e_O+z5PpWk%_sgJ4iD?RW_hTHt@HTjC9iow
zjS0^#5xx!)j@O?-&FVu7!OcI9|DC*Gh7)7<0TIoM*(XJMCos(8XJCCZm!IL~_Q~Iu
z*eG3i_y7NEwr+;kCk=0d3%1z9jkZ23`58dCg#Cr~;>ov`>O?PD%)szkdY1qz14G*T
z&J!<$moPANPi_Ha%MULS7c($)gL-WYuoiB!t;<S&28I%;&Ih*t|MN4HGaiNsvA@{3
zh=Jkthr?mP&2KbbJee~&ahaF}{~QK}wBs%+Y7R`tTvX&4J8!+nTgt%j4J1;kyh{xf
zXD%vCFP_has$*d4y!FC+>E!jx)a!LY22KREyN_r@$AKE*5-*J2gIluvyBb3H8Fr{K
zGBCW{yp(|f)b>8sdHIFL|Ns9%Mcu6z9a9(>Rxp<G>}m++XV@_lRHaKcKlsymxYyyo
z?Z5vF3}wO)sd=DC$zKY}c(0}Tx3ld8<zG-LieLa|n&WOVAQ4a?9_~EY>%j7Y>+S#l
zohM%8{{R0U5vHZw8OF8z3@?P2GB89O4hYKd0`XXvf@(~j!=UEzHYOYXGJ#!JLMCrq
zuEf3n9mpf4g1deMPrkQYyZ&(Jh0ar*H~9^^c|B(HGc^B{FB9CA62#B2Lz#hrAv*3Q
zsCkwBk*9NB!fbwq&bAZ~IW1#0KZ9c@SVwdmv=|oXu2E6x&Qa0mv{C8IQDNz>QPJs^
z1*Mqg-}QB3yXJsG4rFNa5dl!re980w|Nr{V5EYJ29~GYL4<em6H4lOk)jCk3>TMI5
z$IsCD>P7FL|Nosk!RB<ksBm<LsPJ^QfmC!(W0}VfDy%@|XlEM-Ncl7#5V=oa9zUq<
z0<s0_I2BO+0J5vwMa7~!M8&4lMMb1DM5SJ$+eO8p(?vz5+Z5zfa4BeMqQc+n&B(xz
z&7&gH-3YR*dm_lP&f}d|nRkM05?%?msYZpTGe<?BJ4S`YGDd}`J4Qu7I!1+~nDsx4
z%Ih87H7X+AIVuv&H7YE^IVv31E-EaY*Q85SIEu@=XM!BrSs$aK&>f>9V;Q5OP%72=
zv-7p)LCMRVJ}M%eF)9);N5A$2+0b30!l8Ls@>=IikPA9Df?V*QMa3HAh!@f>Dgwny
z|4UR9x?NNRx<gb%G=E6G3JU1_)%mj9MTO@@)W84#n~(5ho2ZC%v#40Jf_z(>Ro@K`
z%WiO3S|0CwDS5Fdj2Rr5!r;J!ig9(bsJu}A{r~^#!=3v;0n)h+6d)iwkb}P4M@7cE
z59G5_0Y(=U5y21@36Rd0zyAMkt^qae^t)YDWIA0`9J*apM7l%j!Jf3}3{kNGMPs**
z3P(4KO7jsFP~5#-0V>ZRY)~Nu>Sy|>@N|c$2!M3AUMgj2Jy{|Sj!GXDp3V>zfzA(|
zzvALwa{v4PKQ0~|_nn6Wc7mG4yL1>B7#4y$z%SZ={r?}?dZ1J{c;{rU)m-(U-tmjv
zU;qC{wH_!H-qit0s6n9Ynf2%Yf5W%0Ejo|x<OY>Z$2;$RUfM0(32H+zcRI0j2eW`i
zJD7SsM7o1TIs-&nFO@KNda-l|OLPWEbaHjR0C@vkH0iWnD$zaeq5>)@{`Z!sh=g@B
zy!Z*~^&Ga305`E7yzu-F&YPT_A6|I9`u`tPf;Jz~fo8DIW1ZI<Y!xFw<zUrL1_1_!
zT_9q|gz(81S4-4;tOWPM1Q^QLRT)0~|KEAEHxyLgzL@ah|NqV(ogX`2WoVq{V+ie3
z>Q?@LvGYcEG)uQCNY@L`-~a!2C;y2(-1ry7FBJwk`sL0!3=ANBAkP1XAo4Ic96Jx~
z00rVp(f^?K<lz_3!Hza86@tj#+5rm9=$GIB{r?{g*D)iUpW)?`fB*kO6dl?zCw%hE
zH3ktUpa1{g`QU}{Kd{FodR<gRUMzY3|Nm>=ZYIkJj-n%=@uk<hK%oGM%<C`0UxCz?
zXm%d!UID5wTHlt)_PR2@Fa>q|4uc~wA!M@jT4l!NlkL|^)q~oHEGnRucXy78%nk`q
zygrB6C$?(^sE`(B0u`1VATPe;{Pq8TH;+muM`r;?X9Y{^+fvrO)wTQ#of$mcyfNYY
z49zww%>46QRM>Zcc&#T(`I`?2KzoHRk3akWznjal@JIct8r5zY70bvE_Vo`+r5kEg
z*cnPhx--9Y#WGmP7o9ET=#CY!j29_7+<B^-^YzZ)&dc4RDInv2{x4zbJQdt|a0j^g
zWIdT<os5|x#JwWB_J9iJPmBx<kzm)lg455gDIh<A1_65=Savpmnyex!FG`+Gj#?+h
z|KtcC!$Q#5Oeb@vY)Sa!=5-dzU4Q@o2MsQj3hrtE8OX!T!0=+@kN^K)*YDB*nKgg%
z<a_HJgqgZ4K6Dp+v3%e8QJP1kNZ#5+WwPOVg?gQ*|NnR1fEMGRk%+}2EBF}<FBzV+
z%@=22DC2N)xcFit<Li$tCrdexu?no<XJB~E+i|f&6vPB8PCL#j1QKQlzWiY43uXoe
z!%N>k24vKNDz8U#K=Hv74UX~VHyqy_B<lHF0~r|@z=J)V^(-p8K)sF^JGw#r*q#6W
z|Njpb0F^Y)yBHYYoarD1Uz?x)>katd{Od1&`#%N-2Fn-xEucnWZz}_X1B31V|Mrah
zZBIej`(yJ-M!4R2T?`DJ@6sCWLRay(9s@NNx7SH@{$TvxSZ^QT>>0%0x`}~-VFh!E
zIRAEcwgCR^?koWreIWOP=4+de@U;HtZ|Mg`hO<DLr8`ThKw7u6P@1JXTPa&Zy$C~z
zU_-qqLq!4qc6Wh;4>%c*y`I9qEsp8nW6sVSFD`*X*hPh<^+2iMt~a1W`Wh53JHP$^
z|5~^Hh2{(f22iW7`8RW!eCLhE-wYfK3}vi4Kvd_!gD;sh4}V_zf_Vl5!|OYpFX3JS
z&5FMkMH1N4$-rQEyE8_G1=PiWrebig2X-D0$oL8JP55jEhJ_Ll{0yC-+E=z9oWGtS
zF4pjyrHM+NXy@H-;m#i~dY^&vWGP4UVF9<-&kWyozK8;)Pq0ay#{x2>>i8L6@Xuyo
z=(ZJ!;AiO8%?amch=?-0ZF#>=s5@jXXz<nZ+5i8}tp`fpyk>4b{lD`D*novg!a##=
z|4R9Hn1jq%{r~^}#kL^9?-vffkOz%E@^AlOc&YQli^rV|3~9Dz(xr;vE=K2v7Z*Vy
z%|Ccbgws4q_%o7026WGwEVxOep6&7f{~d>04wM-3Z~M_3&fNLo#idSgKlWB{I8*0`
z7e_i77;NOrCHc1<2*{WN(&;n{G_vq|OUA`Ieume}J3tNud$9S9Nax{B5tV?98A1FE
z8NWe_MQ1TEblyMsoP&S+fB()~oj+c%J_hwGK*{1;g=0Pc_IJCuKuPY!3t5mWZCTh#
z<#+yPU|`rK2@#&y!N6d6a+ef@*WAIt(0Qx#!;AfoK*qe@4K{NVh~uKd(Ojd#!NA`E
z>dx_RuTkNE82#hLp$<@xu(0vBZe|1zt#Ck`$X{R2&+wvnCIiDRP;uD#<Hhw31_u6Z
z2bz!YSl%d+4-Uvs2B`>~$-vNg6Q+it1Dq{i^9E<QfMktlGBCtOK-~M|#Z-_Bk9M=D
zbTK$|o2YcKb-v`^_OY`>g~j4Ti4iCm!!lw)+WyR7V5kSRNcgvDbiUx<cA(QmMWFK_
z%$(Wn5L*QPm#DC0G=OxRp25Hn83zf9A1`z}7#KQSRD>a+1rDDdFH+kX7`jDNK&kje
z_P_uCyIEBDw;Awnb5RlQbW!2y{9xsxBFx{?0}9O_FLu@c{r|t^KuH4swgbHZES*1I
zq=Rhz@xR2c^H{GBD?^8mig4#Ei$lds9fvGJRD_F#Kpx1L4RVd$3{W~S{MPw_f7=C+
zg^U-vc~tnfaax|J;}6O>2vQ?8gMoqZU1Tgs&5O|gB`N|LuR-EWpnU72!sFKYp@Xsc
z2+wPg|0OCs83GOb3@@Hf2btTQqr%hq66V(lZJ=leHG5xzs>tRekUm|8E=a?+>61@x
zQD(d{`Rx`*9y$JP9+KH7HJE)=BqrNzm6C`F<7WsD16d8ifdLuOAU(p<C+BSy<2?Eb
z+!lN(J-K(QjX-fLIH`e()XpC-lv*d>+$tmC4iPkhgxELGJX*C3W2x<Afo)=J{M(Pc
zxYROPdz&Pfxw&Ps=Qc&A2`!Uzw#nEOwJ<Pr`>3#htCG$SFEk;19&iJ!^TP|t7El*n
z;l--EpjzYw?}z{YyJJ*DnqMotRGxffn*!61(8<rXDc75{Ffceb|4u1A$G^=-g=yCX
z76yin6YoHg%Dn3$3j@QufWVB|AYb`T1*I8KrvfQMUgO`+WO#BHC#c-qd-wnU4i^<Z
z@Q_*OjTfxl3=9o5Dtrw5E&5ELl%J!**Bi>rzn$$xVGB5U@q5&R1_{1{2O>a&1P}cA
z89ML3j_j@G>J1eDsl3+Az|iSz^xCbrTI983Z?)WOn=Tg>z7A*hZnm^eXO=D>6}}E{
z!L&|iz7B8cv`%M<4sX@8PG_Yo*3htwGa!dgodS0F%L$-?n0ht_{?;~-h1=P>d{pZB
zI{evsLs?!tY-V8SaOda^<p9~52(r~hg@b>aJ4dfhE2w1)>Uh3-;Q^93xPr07x|2oa
zm^&w9=c~>SFQ&fx|39tu04RmFTxDcnXny#olSjqy5@<AwfBOMu7Zr|9_8o^B_!(Y4
zWME)ue(<4_Ma2-5C+k_7AF?(7WGOZ54FwJ3y?D{Yz|eWf@Bk-^3TKE4OLL713qzU6
zF?UX8Py+2_-*FUV${Yp;hGXuWOfUT3Lb}ASUaSXc1i6f7R}QEuTg$+}@Y;O^ONlxt
z>qAZNY68vjbo;0Xln7+7Hu5vnzo?qbz!33L5$x&@oo9O+;q`U77{sJqASXjI#mo4~
zpm83youFnDs2k1jLh9N7|Il7EbB+o}r~Zz;4g3rNpezT&pim3|r6}b9{%!7T0bv>H
zjr<HR7$!3?NH-r*0VO;>{_Sj#R8(^tl8Rm)oBVpGY-BM=C1}3(n6nvUeC%tTu#EX2
zp*52j7>+p`FhB<5KfL(+1{4q%I)gQ$BGXzAl-L||He~F)@uKa?|Nk$9!IEr{0cr36
zl<(8Y3A-ei_@7L!+6B%Fb9TwqpKD-X=nduoRZI=gTyYZQI2^g+EXW;qCo(W}nug5c
z2i2~1O$-cKOj!&W3=RwoI~WdJ{AYOS#eZ-Vq0H?xACUn~gMlVC8sCVpFff3c<h$w_
zSQr>yl(mDJX@)0vyapNXaOeMjQ2c=t3r8o53aGQ%eER?1h;V)eOW8AX`5E~8G#D8e
zoI7tEe89oK{eTB(h~?J*|DDHM|MPc%D!Uz^*@G7^K;4yNtp`dacTEAM576vE;}MYM
zpf<ou);Is_|AXflUVLo>4ZO2}i}Y77Uf%fs|39cv;xb31^+2hTWsC|-3G;sz6^QLM
zoZTWSptj9xo=&iHUccwx7QmF&Y1iq-(-FqRzx}=8rOp>Gw$?K+bh-(EhuS({yjTX}
z9y<6+Agwb@r0qdkr<>TWdOlDw_~OOidIp9LH;Lv4^&U2i<$91h>&1&_U|~>O!SY5O
zcXLgP2tz4LXGx2QH7h6>>R1<pC~%eSdlTe;P$~cN=fD5|8-Ig>fxq?KKX9LiN5#@d
zMS#EmG^j~y3ep5hs2TrxKmjf|fq|j%hyu&>YGy_`qdDRH3@_Hb1DnR8(rMB9zf@$G
zPar?T4rfLNh8MeE{r~^+1~UW0E(I-6Kkmhn*6F9286BD4HcjVaVH9U-Xq>Lj!l=x&
zzG=D-3!@B^ZR7MT7Dl<q!X^fWo!~qKZW`Qp!P5xJS05sxUW@iRYe1wx^D-|!H-IJ5
zTECUDXJ|L^GrW#XYy8K+SSFhRnt%w)aBkvfc(JArRK)ST+&cXs3!_2(lm-R{aKHUP
zi9kjiNI_yB14Hb~93}>a&h-*nAS17JPG`|zVCZfC&(FXB>CCosXfQBzUOf1ah4El#
zKM!b)b2BGnZ%-hz0C>_Gl!E#NG(h#3SEq<dw}^`6#bTk(vj?BDbiV4%WK8SK5#V!t
z{e1dFRz^jpFZI*6urg}Z%QS)~t)TNmpw49HjTh{V3=G}vAS(<n1qDDd<^)jm-+1w+
z0a-n$*VTFB#q|b|2Nk;8!PdjIEP!YMb;rOHN1(jD3pAb3dE><rh&cj~>9<`j5T*SM
z({tGvrJ0HvrgyP1%5a8&4HkI$c=~!aM!9-jh$g6GL3yO}#tVrCOvi$HaGf{6X%%5J
zXz-)+#)}vASRD(l`ft2ARgdgH@ZyIX;OvpbkQK}biFz4`V;9uJl8GEdz`72!QbtA#
zWWK~}>4PtL5Wxo;+U|AMc#&Ptzz`kJzx~*2!OkBqbe>IL$j&IH-+8?ATIbo$6E9}H
zhIdP2K;?iesOnz$?EnAQVgX^{8P%ZFvbcNlgp(rm9H3#4(&$Eu_+a1o(qQl^5pa3?
z!lx0m(xTL6Co8BiJ+%omv@h_Y>@v86qQ<|in6)?TL$9;I3uTBx;m(hpw|2}1nVkUY
zT!2glm4MKe1W)JH?iv+^?h+N1?g^k2Vl7yz+F5@ZG{D(;wDZD?Wv~AK?_^PFJy0sP
zO9tfXf1vDl_bF(B#>@Ml*_2+8Hc(OY;y<X7%+TEm5&-q43{Q3*0`*zHT?4tUgcr0h
z#<%lecZdqd>*qV3gWR<75@@1i#{<w*{L)MR|1%!k@xF<_p5evJOW>6*GW^>wbZhVY
z|DS<D^QGm*V&R~`j71=gxm}=`;4%F6T7vOar*P|k$gE21w-V;G|7`m}L(ARFwh>GW
z3}x&uR9^l6|C;p$56CZ|Aru*iS5%l77+wfJ1vjT(Bs}^5|D`5m#;cyCQ^N3Mrw2>x
zH~yB3puzNPiQ~)+5)2FwSO2~E|9`IsWAjhOI`MrVe{{b8yrlE*2FBwqDl8zYUvn59
zfHXonoLTmPd}sK-^;?N-=Z6;u5qkL`+WxzM2a{Pke{?vrrX6=?W2k=t3I&E2(;#XM
z4}feE-uJ$Vp8=tz%SDBy!<pllGbcl@GZ(mcf8kUQs++kujyns1s<gD@&SL-nA9H13
z=#6CrH)u-PkGV23^u{uE-tRV10S!lfUIL1ul*j-7?*O}8FwK%(hQE2+zyJT!I@w>Y
zgAA*JYO2Fw!C~F9PbS-(kxN%@=4Y_{Q0nIhYC*lu&}imocyXkIf#EpolR5mL;*p`(
zMTG@Yx`2#*v89!PA^IDO3R8(_hBZj_G_dLiP}Py(xy{ZSQPFYW<rf~H1o5JK^1(C0
z^^2bT|9>2|@&a|4MfMIphO};8@al~tJUbW|7#R#Nr8WNi&tJyMzx|-$rNtiM{0yC<
zKH>Zfhl88nfJU%Ix<gbXz^jQ&j<cvN+RVoQsze!Yfkw}JeN+@WA9RPP$h^=86+NJs
znH+ppP9my>pCJP@^wb-pA`tvy252zu#*6SvlRM9v$Q<sx-g&O`=)u2i%@6E5SyZ}N
z-W~|&XXqArdnA1FowG9azrjm<_**}N+H=3_OW6$%ynF*HS4vbkI{$UEgPIn>898t}
zTvQ|iUc3W`ynx~DUeNG1+xh?hJ8yO#0&_AhLQ0a7@@~8C4p4UMZczahzM4NQPZSI8
zG6>>l*bxsZUN$}a|NnJ#VCS#S8~-PRRvJMjo|xG>*^V(Vbc^*mF?O=?Z}Vrg?gklC
z#Cgn#k)fN-p_2`iOaC)z{^;JL0xIh*+4-AGK)z;w37Vh*bqp=p_*+aS?>{G55B4r6
z$h-Uu;8fIj1k@D;Cz^23#1&8H;h>C~7Jh~-uHF(AzOWbnKtpuLn~w;z-YymFmR%9X
z&(M0iM7rBqqV+&2OSkmvkIe^IJAZb5dcl4URCtuW0S(CUfJ!cidB-|02WB*YOyuaT
zcTo`tc(Dew=n6DMe&faOEC2s@UTLmTkzgp{>J<SEf6TlE&gRWWc%b9W&2I!ck9Rw0
zH2)ANRm#W-<Y&leYvE^jQQykIaNHd{+Z+)EE=OLj1y$ac9Xj1L__uL2{1hn{{IAmc
z#h;&HA82~>Wp_Oj14F~lX#SP}(7ag|69YqU5M$?$7iyr!;IZBiW)Mg6*8l&#C2Wi@
zW8v~_$nu$>S?>}y#_oKD*0=mE=1dF>yJofUGj#rV!Bq_EJMgz&1tpnSiI<@1eXz^A
zSd86T4wTmac*zMeG(?4?*O~Ff|I6Uvafr2xZ~p%enpgpK`@?#JK`wd4$iU$C5;VsL
znv)0VI1AEotk*|{qc>co*M*t!#qVq2Vjt|762)ChAP#9N0y(5qkl93~H^!K;GZr)%
z!_isq3Lcs0Ens}v1e(7NV$1?LI~+85U%>csFQ@<wV$5RP30is5`QwEhM4~%iAp+!8
zKSl<IUGpI}D1vR^Z?yuAhQ`XgGy?S(w|Ox({A?^qD|c-8$ynms@Uwxx^#|Bcrp_NP
z4&A5+jT!akgIvyRc(U`=3;S!}ux9RMF$VMXuYsnvUp@mZd-&N@V%F<eYr|9~{&EZ4
zkh&ZH|MwO!zXYuzXgC|)8_bji3aY7~G*!S9`EoT#B{+PUUMvLFSx0+Am_fF?-T+PV
zv8e0-HA`On0*zR?gQ`=G)&r#yyCOgh)-+I!DRb}te`vCLZNsdi0v<hh!BEM-(Cx0U
z3zYs}d_DF5fAay3ouE!b=dTy0r~m&C>wMW846??O0W^`?>8=pfe2nR}BGjaPpoZ*g
zVF?%)RMNg?-3MwK{P)-B{4hD|l8#OdC~2<*CGF-W28QEq;H3Rprnydqq2z3Ma0Xa@
zFGxPQY4V{<&OH9VKsl~NG%VwO%VfdJ!Wxf31rw+~34L+vCun3vp!3CxZzsWZV7HA*
z=ey5KI$ykadUCSQWoeVQKS8=nS&ligGWUA3f!Chy0JRQZT!zcAF?PP(#m>OM0Fl@=
zdG=*{r7DQD4mcTxsIc_9s0ajr32>3};#tAuKbPfIEJ1SuhYSxi|6(j-WxU$!#@OL3
z(CaO@OAv0J*ks!)l9qpdfE~h?2C57hdc8%!3!fl1K0wHcTww3@7TYBT*L`Gi{}pM*
z6_ZzAk!0+feDq2(qt;~2tI~{olU=XMGrpUgdR2kv?01mapdfk$38J@%Ad2`73!;+a
zXhD>GeDayAQnoqY|NjS#G=RLo!gzH9Q-`x)ueZ=H(7LM~AaA_z`VKN56o^9Xz23s$
z)mIQ1gUO25l<OPcfXd`=tOw@uGqCWtoCc*%AC-jO5S569Z^HQ*9C~9^N`iZ1RC0n}
z<m7?Z_#{L|uiz-<+Xu2_1!F1K%V`V@4Eq>;!@R)>4%`9Vu>jQTasv%q9bWt*oSy+K
z`Xa1^fgvm)gT0lX;YA{-9bA8-`2?fkrOuC_X?2jg<|91c9Az0x-1xUgO6_1^c)@IV
z>HBB?eV#I%hcCZwIa$f}{pRHdori-nR6&Nw)`7+X)0%BTb0iL>0-1+FQzW~bL2{=a
z{Quv@`!SrKq2*+W9jF=g?Vtkxlmq-z4_$t6`O)GB;rtBsouW^|`5791>XgYg+WraW
zX8?6G%LNS&fTfSKf@DFnhlZDS_<#)k4)#*(fszozZ`~qWLqhl&I&Zw#k_{@(N=)6F
z|1p=o0LyqlWM)BRlpr#}873k83>irvlagy07@F&k@Vw>*r^?r$wYY){e}wZhaI=CO
z!awx@|F#2*T|myW{Qz1mTFPPgwo?}*kWmjZL8+F3Vb>2H&@cr9L&N*G@!-X!C0rTv
zTKO4XW^*GCLTo<{s_2iosFZ+KWR(~mc(M7>|NkxZw@Y<0wu212R>Q#XLg)4W|KMe+
zi$SY74NrFRf)=7K1PxU5M*N9;E#2j!QeyMJ<cvdyi%JP-P&h=T<VDt_|Nmb<ZT|hI
zM5Oc94u(*Eh8L_C{{QceW@&!S^7?tkWsv!0H4F?3K^=96>;oDvq#<J>EN-BQWRYDP
zK+TMEprI4{>;M11{Lckd+Z(``eMtk<tOOP38Q(z$>46M_x+tRg_aFY2AB>aZ_i1pe
zG*_sAh7)R3R3=Z_r&KS}<qR5t*azyff!5vagRHx=?)=pG<HfQp2GBf>O!Hs1Qk|Wk
zwcKFgOPLG|$6ZuJKmy?L8j0gBDm<Xl5X@tFo%GE`MTW7|5;QsA{D7nR2cslt43MYU
zMTLh6BFNVKgN1*}fqKY@JqyUV58!3!oh~X8uf;(8KX5*HgvLdMrTOH4umgfXTV6m8
zWP><R$M9sQkBR|kxd2$+D3gH!-2N^J?+pVD$ln8La8Z$IKKUOaAdtzx0AkhucySma
zX9Cg<68iDtO9lf&cZiBfw~LAncZiBXcZrHf^ZEaZ9~6H<m-N2o0m&)5sEB;OVR#8T
z0^!zNqr$^bBEAze&|rCRCuqr=<i#TP9gwU6nt=cfo(Ba41$4gbyw&ZZV)LTj_714{
zl4w1^-|~@zfq^+kg~he`FB^ZK+do+1c=`YD|Nr1r(dnXM(hVLO^T>8lG12I@QDHpZ
zT%%&bz~9Ho0;=0UJx9*}J}M^7?=@aO?H1tQb}ajV255EHhfWt28))R0sMzptKLiTZ
zdc%{Dj&9H)&=eMEBIU)md*FddotE1rj{Ms$Hy>i^c30uw&hX-V1_O8*AWOq9_7b&*
zUu-3;4Zm1Qh0|0S82PsyN$Ye`Q2~v9s=U@Z=Axp)V0hrQB1Eg<$z9+<o;L?UGbQ{}
zK?=b+x1JG{FdUj|R2&%jryOdz%|G>k;-QWZ760yd6~ninWB>`h&JY!uO)~u3KJjm7
z2G7-WetK~_9W=hf-1+H6Nd~B!&fjty)HJM7(P7|k0W~(7|1$A!i&4=jG3X8E0Q>D`
zI%tl!Hy9LuJTFeCgGT2*cOG-#Z|wwk7XI_Mg1Q~At9pY)z#3M9G`Og+^ae|S`7=TM
zW4*yLU|u(f_qp>JXo8~o=l>EOw^C8(QlZY%hTmS>HvjlvYSH}rf2r|n?F{ZVeufuu
z6$}g!ujLxRE^GyDz^~s6$~ItcGAMu+O}ePa7~Xz;(C}^cSsuopohM#wJ_;TfWdZe<
zK+9AtL7gNQ6%J_^6`5l2!WB?=29&8lV*s5eUd(`K04+z7X#UGo!VS)pGB2AzlgI9$
zaa9@69tY5n&x<qlY2Y00(t4oO4rB)Zc7~lF{(txnUUU88V=A~VL#Uq%RSs2ZcoL%S
zBt)G{^8<d5(uv*f3e7JRntwbf;cl*wU?^$mc2IZ?ic0VbwAQ!$Qw}QmsQ7pIsJJxO
z*Qhu!lvp?0f(mQ~{;3CATvTLAw447jm8vZS)ji$ds)v8g1@42dxWRt+QQ?rhSj++P
zH7HEFK*oGzZ1GW1DNzFVlRzthTvQ~aT~s*00mK68TY*>ggs4bZ#;AZIRzmVavD1H(
zwe_Hht+3z>M^N+}E&~m62(-Q}3F^Gj`3bUIl-WgvML0x-0~E!Ex4+*6Eyz+lsCc>a
zUgv4ZT3V3taJ3@BpfyT9DlBldClqgW9`3x>9j*dei4LB=0~G^d!ObWCch|e9guHOP
z0WSl-f^u<y%zu-q5QlX$@NaXF49F-0xlaY`J`vaEzs&qC@_+vS2c_@U&42&@?~YeN
zO+%YhUS9k2|9{3pkiIvi;Amud(Rld(|Ja@X?Lo_8A;lB##bWhtUQn;STh=Fha>Efx
z#>tas9Z{`63ewn63L3%70PTJFZwjj9{)0C#WZVTwCYORjO9L8pC2ofQJ8M)5I%`yF
zKufL;@breLWV~QG4Cx0Rkmv<ff?p4Txi1V4gA=t#>wyxL42gDrhSw4qKil{jUJHV%
zG2z4i>;JbNC|&o`9W-RLI3GN3knv)|A+Rpc-VBXi7nPD1^$-DY-sp8v$#@X~5zy%j
zQ856kaEAz(bcU!{fL4_3ux#gNc#*aL|Nm}NP%EMv+?;W@Jl6SB@?tRyXjK$A+0{eR
z9jJ%|tpfw4D^N7E{{R2q9<+QIwCXHGMWMMyMS!7{8(i@7w}4iCbi1g4_7!QsRH`yC
zFdP6?E!{CH3XKmzJn(8_9~G9)7!?j!=z;1Q@JclPH5Zr<zGAKiZ6$%MK4$h&VG)i|
z;eb{>;Is$T4Jv~`%h$ABR9K`#R5(z)0a}p<D)aY(*4KejZ+DCe2jfS<-=Ou8oiQo`
z-99QdmOd&XwT9iU4BeqD)}X2Fi_$(S0>ylW%&r{5p*#=+i#Y$gsE9Nl6?uJDyF`UW
zx<&<5nCf(gs2D)fJ>v(#Uz5d;tJG(7hN$Ggf`HjY#Y8wn#R8$G+egI&nlCIAPbl6(
z38YRJm6Fa7l?rAT6&c|W6$Nm}1qFnMWdwra>}C-Is8Ln}Dg$50-v0l;cZv#lgvCWg
z<OT0-P!1BQH~eM|p694n>5ftH=)46=O`mT4|KEHVRN#9wA5gKpQToEI*+s=e<MkC-
zlMUQHY5}jwaTW^T-|j3B5S)<<vNW{_RKpnW0<{@CKfE}W2%6o!02)WRR3hGa<G(0q
z^AZ2H6T56cV+9}TUwldcO|kEA05$KH9sU1*Co`zG4eF0|et7ZY$p8P}oFy1b1b2dZ
zlDk0r$vQv0cz6U}(-(sVL|If`7@hh5AIWtkN}V@eyx#-rq?GUnXY_)ccDfL>p7wP$
zv;lb&q<r$T6LR%yL9$Z{85km8y9Q^R0P)&DJ9W1+?*xsXKqfOoj{N^05!D^d(|Wr^
zJ~-nwNL2z<6=-}N?6wzrNB;kReXKV`1=KOj01+_(y*?^2;I{aSw+Rdk@v+@5DjDA|
ztW*$SVBl{(16r)V6SORf--v(P5B^;bIQW}EszIxlHh{JTTrxbl<3A`@hn)HU-|$;!
ziAqUliAqJcC}`i8;Q@!vg9jf9Se`0kJ?6qv%+~yaqx4O8h)PMfk4nXk0FXWzkUr2N
zqms@Tm5Od&kUmh^vV*~agTeA(Q9bi9CN@^kyrh#Y=)eUe{h;CL7k5wp{|_z+B0;8|
zKmGsz?hGad25<|qq|*mxBxshAUzg#7I-}twC(DB%_lOj;vVs~T&A*Tw)p_GZ_v!!t
zog04_FflNc?&z)0QAr5xEm4UH1BDc*iwN3n)9~U@Jg5`48&vH!)~E!qGcYuiNrxg7
zaWF76yqF8xB)%<1B?7c0s<*|A0pzkvh9_TWoc{m6x5bPR#+Nw#|G%5%_xju2qM%Ml
zH@FM31Eie)#otq)(hV$Z8xlTQ`hiaU;Zy(r?_%Qtc@q-)n@&MPL8ybD;RVaC|NlEL
zLYuKXoriXSjs<wp2UDX3QuAOZsBg5`Wi~&<i;x^pwm4vUxR@0pFr|Qjq0ts32kIH}
zw@0vm#-<O1@iV9dcn0mN2eqkofVeL<r7$pPu-*r)!?Hawm!E;5)HJPI_E;D{Lt681
z`7#au?Ux}6J5xYSx>9le?WcEvbnY+*x#G~H|Nj?*^z8s`IDBDu4m9@GdZ1KfR|u$g
z1RBeEk$Up~|CiT6la)FQ3=A&<QW)wPjxz)}`vx3yU}HJ%z~SWY>~Y+IC)hb4bf0wx
zKLa>l^i~LbUV7X?g@NJ0zg{1eh~5yD5Kx^0O7$rLpft?z;#MqZsbq7FN(e)#&~X=)
z5C%4IPbdQvFR$6Zxu|3dl(K`z3SSF?Ce))m`S+f5+*c23<XwKY(178=zfKmF-ddf`
z--aixc|ieI><b<!>Adk`WikW9F=mDiZ^kYbl@4d7juQu7u<~y^&@IxcFq@y@@~h@Y
zjIAg6ryRKWfb&9!GiaSeNT)MstzAZ^Ge`4b5yp?NS9jjj{CV&vQ|8IDXU?4Iyw_|C
z>I4cflqmHUbATr;K)c0~Cr3S!6;T4&$Hu66<KPcwP(|0}qQWz||B+<<*Cf!u6$cZ8
zAmed29#HMy>&VpUqN39qCjcsDKwD2cSyVtfB4oh+R{?F|ZnjbR!{2fe)XHR0>1F`+
z23XP#zTn_*-3l&RYgAYu<>-$W(lOvwF(UliPIUUHm_SO;A1_#97#KQ_H+z9PG$qBL
zI#>0_e+C9?7ZsIK0sieSDl%O@DkA)gPZWi{<_2{(pe_JM4oK?qgEUST6&aX6^^ztR
zK9+J4=?(l33NY4V&TI^zSs(W1!=Pp1-3~0xFIYg^lypHoO;E|?0ZL=Lwt=R>4Nt<1
zxs*8h;$u-pp2^Q2n=<lDmVKgK&m5zolhzrll-3yv+Wcvi$iSfC%HCU|QUdNxb$)nZ
zo(K+^l6c>M_|6=a3XoH47+Jv5FStPJT~zA8yv`3VekFj@dJX?}SCD&}4+ub}()a^1
zqChTU%m$SmuVY@EJ_X8ztxBMEoIarGK`&4WzjXBf|JM$nl_)h~8GRrP7qce+eIi}o
zo4~-J;mp;&1yWP`s0e&s(tHFooOtiZ|NlESfRx&71sS>HB#3PQVjpY0&EK+x5j0lA
z-?9cY<p`duX#OeB-#!;K-W;M*f;zp?{6n6<^#lV0Lt~9f31|wHzcmx2uf9bEG%wNV
zqLKk#7MjDqy+x%9R8zXBB=mv?&{|YLbKwEKEh?ZABA_=!rJ(b}iwpNa%k4p3Vm**C
zAu1WoH7Yp_rQF>vDhalr$;mR2T?QcUJA%saN0|%^FG2Hwom0T}rFBAV*;Nl(&IE1-
zw#73rXt=0U@NWxIsce2F(A%N{s_$Rqfy7%>Kz%>3x=(li|9`oTn}MPEhXjA?G6n_)
z$i(lX4t@r(g4&IsN|?X38#Dyi19o-q6tG#K$??t)FGTPC{~s0EdZ46ymqa~C5vZNY
z0kXzLrLx(U1vJyl-|EASVX_L;WJ7KS22iK9s`D1u#xrrCw87sh$qiaP39jj0fZ~ez
z?*IRbLB@dxf-*jX#Exe$FhoE~#<&xpfpQlW9&q9404f|gK!G*o@c;iW&vAj4`$J~j
zcwSV;F))B@;)u=?l>|_m5)@;se?Wa>78Oug2q^<Wv154P#r+51Rya?5Z0iC3)^<<~
z<)~!z#!4J_WdP0DcHV?EF>)Sw!^d4q6v|i_FTWNz?keGwpPZ3)+?l1Ap*L0zF@@XV
z%F=mr7icKm@W2bB2cX)i`3GZ(0%*3jD@285@`jg^^`We3$6eVNUUc3B=S{-{FTUJI
z*r5bg3mPW+#R#@eaGz!;KLcd1#r@Aqnh$e#xN;nG<z(pf<pM8i1r6}s2SsS9AlSfO
zSFRUPu?!5yT)8-UeIX;nh6i5sL)5U<ryX|{Vqod@g^X<*9(Yj(kzqOJD#F<7E4oXR
z0W@#$A|5U*%Fycz8SOSa@WKNwEcU<GSA3T^M71GYSp5GnX6V2bv-4~AW6q2W&4-!(
zyQoBT-q3tuS?{8fPz+kGl+YQYk^zbsP#^2RiAt}F3apAU00qdg$Y@a9WP#$QMkS*+
zUivsYqcj5}G-|-*<%`|-5J4vk4ljY@?$Sun6R)^|5nPvbxI^NGivcp-_@eRN<Rvdn
zvb_-|l(8~icI*7m;m+21a~F830aWF^(8QvGy*Hnu^CdXEAr4`=2aW<BNNM=u#hPda
zhF*V(U7!_15EYN^PPTs~UVjoatPG!vfY>M5d2<(N)h<Ngax5yOjxjTU)+t~F=nqT$
z;R$LjzgPe=@pwd3>wo_G*8QLW1qFSv$Z=+75eDYYkKnWp-go&z8>AHCyb@4=UVANY
z+*t$?pl+b_UM#hN5o82IhcipBH!C=`L$rRl0}cYvEDmGmN5~`&*!t_BAz+A^W%aC#
z*W5w%7hC5?NEm~aY(-K6Q^DT(5fZ>)6_c^3;OO<{+yz?A3UNRI+yR`-z21=A0g(xV
z%S=B0TENT(&gEwA_2vN&>p>JM!DV=udcApf@q(s!!1i<8nauk}((LVRm?s4p;PWqF
z1()G6LJaWv7qHCE+mmD7$kj)5e$c#u6kR1M8Q>KRma?EGRFNA-UI6vDUaY$fsYgnc
zyGv9uzzg0_KKKt><QLI-Nb{3rhzck>g{UNe$~))Rn~;YDm`y<)i{|SLogetu)c+6x
z4L7lZMotd?;Ojh!VIQcbd0~J1|9?o%1MT?k{LH`Rw+P7Q<7@)_3<AA=ERe(kR(s+W
zG%(y)7<>JoX#p&=4lcvW-0KIP(Tif(0hXEqmttcB_bM8H|Nk$~P|gbKt#Ea^v8Nq(
z<No(Qtuv1|?YJ9114HvMK~U+@T%(d8P|k7OMI`|=-_=>7l41DG@@ub)O2XvxZ)NI{
zyb}PK_lmpq|9?Da+CjCuMkS;3BY3sp^oQ`k`-K{KZm(xSiy~0}FkuJi_<|QwxBmZ+
zj%z(o>H_KA9ef2EdCNG?Ak5Do3|{YZ@DZ0+X8_0KtapO-5$KL|QORfqkIsOOn6U*7
z)-aS5Lu~;Uc%T*p#HJ-Tp{@-EPYrd8f~JN#5Av_M2)B_@__zZLXvOcrhg^*Z|NpmV
z==9(??!dz!z{qgSL4d)%`2g0Sa=}v2g67p<7~X{X&Kt#dlO5k{*@68c0ts+Xl>ka#
zFuxczL;O;zi4^L+B`PUlkmajeZcJYJ-dY!w`VPJj(L9W-3S7*CZI8GCX=aqhfcoE)
z1wXhz0uaqo#`|tB13+U6F)A6ynH9Jh6hJ%ELFW^_a0z8#fai2@zp3gvG)X#hF{B-L
z2DO3?^TLu355za1Obx1h3~wX3E3EUzi;nv1|NlEj#y9>3Ek`PS)NFeOG#gi82y$O{
zh)P7ak4nOEhI$r;`ZRD%G#_Ad>I_kdX#U9xF&gA5P(XEqsyi0Y*53^692L;G4Jd!I
z@NYi~8pBO%{2Rek&i<lc-~a!wIrz69eNny-)PQZR2Xz8PK<ykwP@6b+=l}mNL7SpG
zk9U`-@bGUx`+3POd02zYGX&Z?5B7}*wahE!K^wcPL47F}P{*a_IHZ9X@8auutOeY9
zj!)}c18Ka@0k<-{SyVs`O;G#wSc}RehI$4D6>tp(ZnfPEhBP>#4b5GkV{Bd=0SO|t
zHa#wZ4}9QxA-3cHe^AQaVbaOZ@PZHIA@FW3{uX`Ec(98~2B?45{Gc8b0wp55{(#mw
z+yZ%Xbu0tJOGc2QdKVR*gD=>7S&o9sKI6UM6(!)-A6WS#kn+eK|Np<d%nUx1!SGV2
z0H}}Eo58XJG}Q(gL<Dv6Kr>s6FDzYDc=-FKf|R=cY5u{?-_p#;z)&s>YLv+||6t;8
zxyiu5@G^%P)K+HUZ`lLt<Gzdosjs!@b^qV`gTHkp0|P^stBnm~3Ew`@mQ5R`60Vn^
zb*}qB%Z(dq%^CPxTcQ0$iOv@<Dwl(IOZLj#>~v-UHUIfR#(~#KwqD|IVPs}t==|CI
zU!a&3vhVZ5i{#y)wJ5CzO8IwjKLG_wILJ{YlgmCU)i2)$S_Iu$%+bxF@}J@5a?lDN
zu$mN*n#oKI4BfQ_;JJ~KP8XF5@RG_GuUCN#>~*#17EyU|55zgtdZ5Iz^;?N)w;N0A
zffBv$DA2&IOzZ6uW&UlkC7nMRZx%^*n_2dOIuu3xz25&DezKRd_tty=Z@pQ<zv~3Z
zS&bko6`2?q7=QHEsFZXb>%94SNq3Ek3}cN-Nppxw1w-d?Q11~W{1UX}6XKdUm;=<h
z9YB`LcgI?E3w3V-S!MaTSfD%9rrXz{^E%`CA{NVk#r(V0fGnE<vTO?|J{S)(Ug$ja
z!X%J^L4*0_a!~7~wxHV;<X;(t&q0exmV)vS)Y~stf*OXPULa^G4JaPsKsrG#;BNt)
zm)c!g(fN^o8)(i|h4CkUlRfC14R9xszsVS+RH)lWrC!Fm3*=7zW<^k^G3<ZCFLwTR
zQP4soklx<F|E;I^TUi+y7??qW>7aS91D!4^3ZSW_?hq9P*l=*?2OEwO&4Uj?!yPgp
z3I4SgF2DMAP@#mS^8#q@mA~}>biE&_N^G_Tt#M>1;i+%j4H_N>ZCEW4+4TZcFgydT
z3`&k-V0a1INXfr_GN^Y7%C7%QR8%^DzKDndb-h9>A}tS<7VH4E&R?*BM#ey!2?Tfb
zfWr0=C>Q<N^8f$qxNaAflI{?d3ebTZEJ&6K@45i8tezRv-TD>@>JYqUPwQ?5S(eu6
z#?x8H(dAmv;l|hN#=lDdG@Q0_;s5`y`5_jZ1zB()l7XT5ZNtmxKalB?hnv9#1<Q*Y
zoB#iREeOiBFV1fM{~t8x0~&hS&CkHk(ERwr4u=SS=%yRXdKs0X=+1jPK|-20yO~Xc
zf?X84gIO9s1%w1Ca9$|2Z2l=+W&$020-YN3Lckx?)htzLsOD!ZQ|!(bvCL6nDH7~_
z)p_H^7eBBZOY7T8_U6L^uNN48>ok2aho7PK8-Gg+C}0;ygN6)B%)28rT5p#a)OQ!N
zgav1~f=aae5ey9A{aVnD{)_E?3=CmAL1Uqvw_fmE0}b8_>`Lq8XD~eQq5-tt>o6$U
zf%}%l3LqQALCLBb)X{+sLmQs#{MGs4Men-*|6`*Zpj&WVR7xOS)t$_s@))clXC0`f
zbl`8f3My$zR3f@-RAT;@sHA{!cv!D9M?gkC$dT3&p!qC`=Kl<3oZ(>^3p)83UJG@8
z?Pjwr%PcA>5eW~=*b7o83|7YjI^&U{+mEH!@qhCV#xkM6@UV;rAo<VXAaexjUuSf?
zaqRlq0@`sZRW8si()u8PAGBM66)bq1MTM=EpTV<~{Wy!t-xhv`|0XIy0ibd|JS>B~
zi=W}eYOq0|0}q;iFqQCu#==EAU+q|`$<Oebz4O(Mdvg2?FZ#Cq{|^qi&KoZegO;$?
zsE9C>^6&an4@!g%pol3CXJE+C2bmZZ&cG1y+Khi&h>A}0AyDbh^TNdqRD%EKZ+Q#q
zs~tA{hGj<j<*R%D|2G~1ErJ3sG6n7D={(kXwex(pCr|6i624veAmg8c7OWnAZI@Bi
z#m`Wm(b~n&0N%S1@Ztn$oc2(!3>*J8cc$he0xbthBm*)!y7(D(fSL=M7XpG`EIIf8
zKjY!%BLdy*oyVJ>vo{_CNkI;;3kc2V=>qLM(!3E6{Gtk~Ql#@o%YhPc{%t?P!DeaR
z3k!Y`3zeMw<eFf8<0}RR9)^RjxVud*bk|&9Y5iZy-hASJ>$j4E&eNSAo1ZgvJ}c4M
zH5p{~gBMbuvj=XM_yuQ7?c!(Xoub0Q$iSd^C@A2?pR@n}cYb+o(tMC5Fk=qPUtuqv
zoCPP{*4rhL5KX&4Zq_^$#P}iL#qqQCVA;+OFShRjg&#-`w4}E24T#lw5N7XU(0Ppy
zUQB{30w3|f(_Nw>(fQ$pA81exw2WSG*B8)H66-;6TDsx?|JO#a1=XNs@W(n!R5*|p
zRIdgdY6~hUK=YQC7mApBo&JN*wnVJS4F*kjcAkB4G8B|^`CEEH<FwoSm<~SV>^#xQ
zqw+#%KB!t~1?~4M<=J%yG~xy-(qFq<9xGw*{Pbel+W-Gs-<I<7Z+Dhzv|&~W$O|at
z=ih!FdP>-fdXGp@i5d;vhJIuoxPd9Ms|4f^&@RPDP;z>?YW@HJ3&F=mwlIT^jZ_6K
zELsc_hyclh_f9~Po8j%w4=-lS`43*3-TC3gpLq}mmT0}0wjN}7$^F*<B|^Ou7#P0%
zKlrMiyHn;mXlCa+OXo|&OD{P8|NsAbAKc95H!7XSIz?1Kg&+TR2hh}?n?OLu(Jp?5
zEWzFw73JU;>}US}@4WHi7|5QZ%|}2J*6c5I*8l(iTA|riCW4=Vv0i|`^&A5O!#5Tc
zM*fx~pwZ0_FL<|u9K&DV0vh`6wgt5~I%`xo_J4ZD&%nR^dgCbu28IuvA)t0?gcRf9
zMr%;el`t9JhOAnWfO&u$G;iB!a`Cv!MHbMMA^&!<ZXVDQ4i@mLUbs=#q97~yrylC|
zQQ@)lQQ_d9a!~P9w;hWL=L`NR2U|{+7_{C7C594>u;vFJ__qfOFkT4AxCY9#4#5lz
zX`Ns<rX6QZ1Fc&6(0qia`H0G7&0Dhd8r`4?qF~T~Au|I*Z|jFY|Np<Z>%qX#Eenbv
z@O(gT!Jo+He}76ey4^%n>eFl)m`g;P>tq;8`Fndo>cKneOaA@;-(AMi{Ep@IWti{|
zJCNz@|3KSYUQC$t|GzcZQ2yppP&?tq3+do`P|_^rXgmx$jNtV{{%y`o2On^<!jlQ(
zjn395e?VIzi=`OvHQIp!vQ+VS>zhCS|AU60TECSDciuSof`xzkfzH+!fByf6EG`E7
z!|-J1trz=#|Nq~4=-_LX&YK4x3N)W&2Cds+gPfm{Ay(hb&#(j3e0#BJ)BpcbFE4|-
z5Ma%nw_db>weoMT6X4(OC$)pGo1Y=A^?wOx=MB{l|M?jhe{}B!*?91|0O!x<U;j(l
zx<wPh`56LsfJVDtByIw2v;Yb4t1~b}@NX|;OKbgBQo?xeKiK(T&(sH$rgVe3y&nJ5
zn(L$(N*mLf>%<sJd?9hsdF#c$UmzbqogubEj0k6d4hIQ<`0Mt@|Nmb%b<YKb;>&u_
zTJh8`pe)jx{v-Zys9bnha9HQD9qT|5wRScryMbp<_k;MGW>1c~BP9%K&A*tj9@gRD
z*;NoUx&4m1_Wf0$cwy`2QQ7qe)T}vU$G{K<*%5K@1s7<(f+OQ1$ef~p$v5vv*Mkm%
zc_9HZ2UOgN>?#0NVJ`6FNmN&ZMuoGOLc?DeuLGOhd2?3`$lzFz!JR)kU-7TGAad}P
zNKim<26qoX!wcpBP+hEmC`KCJfYvE?9t+5D2FXA6XJ7#LC3a;nFw`^bSO8j(JAEBw
z7^hTn*PH-;h8>eYGaE-h`ar?*az3b0ei)>I;YF`21H&<fM9`LLXOUiK1JJ(JPcJ-n
z{r}%koyNf50&+ZP4T2h|AO#)Q6r#e>{D`rXJ1irnho9jksO1dGmY_1a+46x~^CRZY
zi;!JhJLmuZzYBCs5J>;e1(1f|t_A=9uiyY_?*(aR1htA>R9L33<7SlRQ*i|CAP4Ua
zXnw#leIqxca6Nd{-9HDAghp?+ANUMh@HW*~U@@M~U{EW7rTKvas3~0vnl0c+JMJvS
z!1P)LvYiMt+|c>r1?X(ov`%NKG+PFy5>Ec@2LfLH0!@#AN+oc&xAVn|X%3*0#90n<
z_84g8vsCAc7mW~68HgxoWT^ASiyVjP(VUFZ^&0#B|92=A3d^_$iVg)o&^*^mRnY!*
zQ24cOU|?X_3vxlPa|Bp_=c^Yo4xq_Hogc2ve@#lCgF<KWT+oDF^K%Eox2<nWId_7l
z!CU{Au<~#BQBg?i^p*m(Cz!yJEUo`b*t>I7L^`uonjf&#gMAI^TCsP#s7Q1=Yk;Od
zKuc;mok3xf*7%cwsYE0&EMp_ceT}}L<OFT{xv0pbbvny|7Cg$Obvny{81iYI&I(}}
zOuhUJSphGWgBG42?fmef2E;fBZbwgB_y2!ah>Ae-DHi^1mq5K8o)^zSwaZ6vYoOOf
zMdAhPH_&E06^R!sH%_0<#i&yMZr=a@-Of5MG?xGW-+7}Ekru_5gW46aqzSGl8{dFh
zEua)G*2~ZEVxtdI3Wp}})Yb3=z6O-Q`4~Z4fkE292|O2M3p9a8J25aEt7k~;ED-7Z
z)azjIV)=Z~5s?NjSU{C9<e1!MP`YIVrQ2R-gBKg-K+`RV^I<MT^~Sm2bjuNzVcg5l
z@LH_bTgUJcNCEF2X#9tP9Lwqhj(>0;lSQTZ0TU#8rf=tF6yp7B3rfW*-5?3%)O`ai
zj+(lUfW<&D2v&}nxQ$Q}_f%VO!i6MmaZut8%cui6DB2qm;VVE#M;B}SFIM?q%##61
zUtt;Rd+YfbURZg<cCLa(XggoL@Pe3ylnFXtyfB3bqUHewh@e7P#z#ncasCQg&Cq;A
zB`kxr588GHpY8Qx7ibyVhZk!>Wg{dVNv-++KLk9i)az`}ctnB`v>GTr_GS7UNQf_;
z14%OXmq3yXJa*45`Tsw-@r?)v14HLQNbm2#i#Ske;G@Fw!Y6pT3ooOg^o<~Jy?eF+
z+?_bq>!KpMtGADz;f1Zm^a;F-YW3403VM27RBQskP5msn7ZzVY^}`FtNuYKw4=AOA
ztbv@o)c6JzY@MLZduO|QR3tz<sJ5tpGWf0lNTaFGo`K<53s@+De>-z$iwd|kHAm$R
zNPdsX0}!=F1+*2ZyS_z51hh@8Mdb?vDDHYxKs8L-@fH=(;v)vo?ly_w4Euh5hAhxz
z?*|43hJY8^2SM%<=xzZU)q0>rA|S&ZRS5?~NpFpch2epnpi#TetB$#-m@nuB4TGNm
z&jx>9-C0tvl5@;Or9c5Rcv!>;nj1C;4I+W3%X($Lf|gLFb;hWa@NYl-qG<)FdTu>X
zDzj?^sNoCBZZB3Y26x{<hZg>SIh_r(p62iiF;KE~QL*g|QON+UJ$Ydq2tJu91Jrl~
z&FIClF)(zqzj$X;&%ki-1#{<N%VR~toi!=~y)4H;rw)SGVDh}S?{-n)crj<u|Nou$
zUgm+ue_d1r(z;zDINBb7+CeuDK4iK4U?%kF4d>?HETwlLEl-7J7Zm{x(8!c!jfwz&
z%U4#=kxqu+I!#nShwr@J_Ck3rXrXw0cMmvPn$P}kJz3(+zkLlj0w85riwdZJ^WrdQ
zLBEMgXhvW^xHrYa1no^N+YegIq#^?9$V^!SN%JCzSTXo-qQbv@3fPdKfQ-0)SXNjA
z))M+6ZU6uJ|D7*hL_+mSH2?iys?qS6u|yfH6=FYVRRL(%XFx`6KR?3@A9qkz7I>`*
zsqaB)4pQC!29JHU9w?RGRRAgt`#>!U-bMfaA7=rtYk7GWG`zY6?7wbEdh2wlR}tyn
z14)XI)CAhL01XpJdcN`Ehz)2xPXhmT#!hFEPH!DZ4P($*?EzZD*y-$&)>-TW9!7Td
zYdu*a5(rDL&L#mbTJ}NGs<T1sff5mTIt58(?)(4W1=LUW)@eOi62ZT{+K+#Gu@6ev
zd%gevAGC53E#&q0AwvGjs_8j`jB52YFaB6FFm%p=EN0jPUXcN*(SN*nWDU-eph0e-
zV=XG6v0Ig6kfCvfUPv%^x~SB2?ok1aZXIt?X#?M`qyowiH7}z47#P5t+4)=ZL45~E
zhk7Sy*0I+`MeoJc-v9qWyGiw4d<U_ns0c7JFzf`)Q1!Z~gumDh5(F`Bf*4a&6hPyM
zB`S*GOxXG1#q{3)|2sdt*xmd8e;33p9S55q%6Isvh;;R+FfuYQ9C*pz;iDqKzwKgB
z^8@*SuwECHWY7SST|mZhP^!Az4>}k|%$0$m%SFYc!&##FhzzL2V}*=MgBwB|$DP5M
z^tiJCXs8WjMl{F_GpHGS6To%7+I!Hzaq|%g$SyI)67|j-FN{D9^W&`tN~8k9GBhCy
z|AG$LIM(^&#p8M47_J8;Ubb%CjBtL2u+E#EuOPFjMoa(yj|8uO204g<ztsR#V7jQ(
zyzuY^70o5WS^qN(C-5`8h;RW{ngXElZEzj*<At6TJla&@(dD9|hApn@IUtb*YAAq;
zn3Iq;rP_-k3(x^Qpw3WEuZxO1I7z&?Y6&^v)_tD9aTk?91_lNNm<6Df-<^;ZKk$U0
z05Ln%hk>EHMFli4{X*ITRMvd}wI#bj%YW(_7`mr`Q`U=b<_rw4MY>&7w7^XM?O;`)
zQQqbQjG$H5&^FmW2Bs2;Fh~^ofPx_08I-qqUV=*2|HT5ZIvS!P8>GV28N7zv37mFz
zfwt4Xu<izhzeqjE)1Z|;2v2^pfO;~D<Cu$zCkv>M_hXQTd9-&5IFEFOsMMhQR~q8q
zbZ<};l?L-~o1!v{fq~)RBLV(xEh@7?%m*Bt7x=er0iEi{z<I1hpOt@GkILNX^F<hS
z>lHx>3ng`RLK4lgH~;^4zU(~IdE>>r#UN)(yawH3P&eoQ|Ci#w|Nn2cQDJNjQQ={D
z$?ywNuYhZTC{RNHybh?6$?!nq5l}4*YUY6(i@~6F;%ra=y?10_s0UXc96LZ;z+N0)
z2pU-h&mXmbibYUS3K_210&4ml?)>zEaVn^7@gjcW|Nos=o1Ze4=o=n@_Fy`1yx^Vm
z|37#ULg$Saev`o}1t!CqfuQcoYw^y9ki+$EyvW}8|Gz_hDSueTPLOMo9YJaOwIO(!
zL+6bb{FDFxH+*aOKOD4)s`F;&C&L3T3P1;FA9at6X#5YVZb~1wzAcsRyzxR4Vpqy+
zaF+>ua^TDG+5i6|I)PwcKLXkF+kt@r;puvY7v~qieH{bx^)?33iqE+C*p~;uec#Sc
zFPc_^dUs|FC4rqcUZhTd`n{9`(xrQCgd7Ik6QPaa&Koa$CV|6%Z_@w&`$7G>6&$4^
zVHu!+cv0#A_HKR9er8Y`2OcUB8$hjNj<AeB6Zjck-|YMa={0oTc)>6UB|yLfEQ#O#
z|7XM!AW{&ELuVlch{r7C0BL-41GE&$^*}dIYYpfq1wrV^vkuKaSW92+Y}m}l(D;&J
zH6Oz+5V51-J0HV~@EM@9M0N=<@Ikv3%jW<8zi>hL^oin(67^f=@-yrL%{?@}VqgFb
z^D^)=yht-;U;s}@bROCPnh<=EIRF3u7gIX_|9_FR4K!j_%42w7SMYy+hL^9HK_^TZ
zp4<gGD`^McBz}e$+ZX)*pT%f+au-tr1H%sRQq3hGA<(&OpqAPW@H*v*3;zG#$pKn=
z2VQ~F3))~KYy;ip30ASQ^Z)-|nWLbAu3&J77_4xIBFK)A1^@r|dV{t%L>zp;8~~9q
z0?Al`WL#7Nc7l7n;MK=_tU<+&2>5~x!*8Gksy3F#Y6E*+R2=HT3HwE<H3LIfhT|mI
zX%;mqDd8{Tw}A#PTvP%AdcB!;flTWB@#4;Wh+xQzXV#zs(nTetH%5ZVt@((^>t&!u
zHpE`W1_p)~uGS0;;JxUEw;`4u23g793tGkqUOV*SZ@m?0;MGONxuHhIiJ?@3e|w0E
zOHe=t;$V#$m5lHgSGWHE-|NQ)G9{$>1>0-I;D8K2B-dtyzt{v;!VFcy9Iy-I1kiaq
z^TFj1NZg_M1=|Y)sIwgyk2$|gtN;K1KctHVI)L)URM4GsE-DT$J{W@cn>iTXwvJJ8
zC^iBOD=_rBs6@Q*fhdW1aTcTmbZSjZ+b90*mq3eD0u4{T*gNn4f9KfOCw3%&V&ic;
zD7o;r9tVv<fF`_mF@w%Db5Zelp=rgy&>UW);=xd23bw|h*bm&#0bBFT5`1)J#{Uu(
zFz$9yN$CddRC+h-|9@xDA&O@qH8@L&1o8=IzyBLvdcihxdaV?rW<6*zN+)=cNfu*J
zfZ>5%ppnKGowNS`|8M#Sv^^TUw<seM<kD;#P$H3lOzm@lon0c8b{u?68t6_pHU@@_
zE|5Ye8wQ3r@M?qzSeFvyF|ezRLDg<^jY<Rqf6Jaf_5c6xSOn6trwtMctN#4|zhe_f
zWEE6o21o>?{l$DxxdocR<k=+y>V1IDEqSeQoZ$yE1H%qb!|p{bNCjlXjRT|t)XICY
zWZM7#FN6O4|Gx{Yrr!{JR2t~~DTZCyV9U=n|Nnm+e6Bvop5x7+*;dxQd<>nNL2W^#
zLxTAkUUK~b9d9F$cHDu9;Y0HQ7F*Eq2BmMoD_(XzzQNCs)`^g8{^3yie#Zeu28LZP
zpH1hNVRYFZA;T!Z$aGkLdX_AsJkuim>D{u7QcO#yPhT#}sKl5s{gf=DoEU5*^*AeN
zbQ3hDdYm;QeEL6GMwNPy$ZNh%QBW)EHCrcm7}lxzS4QdCT?wzi+aivEf^S#z|Nn~@
z%mtl3yyGTFz-T6@M+=&a1oc#pvx3f>1x0q}al?~4Kn(tE=HLs&csoBe{NgHQcG$@1
z{`ytR$rAR(AhoYq!K&&HK45xbKjZ)Z#h{~VTMv}V?>YmTP2mQ0fl441)*(=legLA&
zJ>xOR_G}9Vh6uxN3qhKCZ8mhucQLmdDB-r@;%^ZUW?*oB{oe3)H~Wi~4gddlvbzO@
zWqbhXGPMAuIG)zqrN;~}?f3x_s?Pxx*5FB1(5W29SwSc8f}Br`KR{}s{y6x6<wfQ6
z|Nj>kfUf5Pd1D928<Rm@rge~N=FddXVE$sTrrHd)$@~m2mYOSo{PDlr6r_#uU#A?x
zAC5v`e@s6n&!|-YrRo3w-Y||AZ@@IqiziM0|Nk%J`CrEIzl`O-S%w(MG#hgUhUVh}
zpvjoqr4x>`s;uB=aJ|mY0B)e}P*}mw@ZysWXp@Q73Vwzir?2ueq%FQam!Bc+IO|Q&
zhLaBvg%{@XGrTwnR(NeLKf?~)Yy2t<X^VY9nl!J0GzG5UXV?W=OtixRWavDwT94`7
z3XJCU2cGdhyS3rKvulP2o?SV{x@Rsw10y)5UuYXLFo4Sg!;?ESK<<@o{QrLu=%Dqq
zW?lgn1_q`V>D&MRhn>byqPU^!S;3RSmIM5qUZB*lS(||&TNZQzHb3Lxm%5-mQ=nZ^
z5xp)d9s#{EDlWmjJ}Sm8y&)<Nh6i5kRb^m^2Q4?VU?`CS6%_#>X|OEBIdfD&4VZ5(
zDiPDm6d5h+JC9|anmNymVF!r#{*3Vycq*m&5(9LLZ5J=-Q0)#M6^@S6hTjbT?*v`W
zXL+y_v^`S98PX2tUvq)+;w$i2$Lsr@A6rhAaCOLnwZ*7#ux{sOVA#C_e6GUx&#0$!
zclp$-aG;#fZ2}4*PE%0x=jEY)|Np;e)?#4LywQ4~p8rLJAp-*}a4Mc{XaEIM$H5Iv
zAiDF|h87SFx|IerkeYpotN8&x<Du+JHk}_1ykOzqb|Cu(SMxLeUKV4<3)u&3I!+yU
z#lpXB`eG$Uw|WPVt-&UUh>8RWFxUV8zjy<v-2%!Ph9`Fvf<)ie{r|ss4M-GJ@f)7p
z(E$>@4iW{;|G}bqK1lQ+NOT1#VJ!k(NeiBZ+yR<_esNxtfdMjA7V#&d9=zf30c48n
zQ5~oZFXiZl90c)X*Otlr3_Cze174h01a~7eckO`-?STl19cQ&!!4GQ6GaO?zTEWl2
z__7LAULJ)joD5MYzUwqxr~xd*-x3a58no*ITs#vjUaGn4DqJWGB7|WL$4k(l&91v}
zg}M-hn!Db>g`^-tP`#iA?J-sZkYiuo2d%(x7D%hNWfSCY1#QrWcmovNyUdIk7<RA;
zGBCWj01lB7tF&&07s}oL|1Y)xWke=H28JC<0t^f<Hq?Q}(?HYsmrA_&w=?YmS6JT_
zLFdh~Hy>boZMuuo1ZG$>Nb#}O110Jp<F0gpjH_P(nuTS9)NBV}`j{7+tl(#OZJ+TO
z6qS}npdD-=n?ZXLj<bT~K=oYwYq>PrwuVv(h|@u70uloZ$5;(l@G~$Qo&+a}&Kuwp
ziC?E?s7&E!c=5^*5&v<Z_%HEIYpfP&U@o=oyz%106wu&7>wyx3;0!O2@;!#2HX!nb
z&8`+u`%oA%3G(4Z;2qEq{%csOSqHUsM;b`?{X3u{_(euF=w=ttBrPZjmT(<sT>>iq
z7<lTzhwDR{5F$083NEen0DsGL(DeWI0|6QNAVaJSLFcQ3ZuCp*HU-_~7ZC+IkMlz*
zYntWz5*_~S#{>Ac9}CFn0x9M-1P#L4rmO(f<fdsW_!*9|F8j{M06vvkI^zIH%}WE2
z8r_r?{JfyD7^H~dL+p-}=?!X(YQ8T(N|qZiFu-opiFwha2I+=ZFf)J#c0qHd3{1Pi
z-hd+S(u-^Q3=A*s=rAy3fX@5N;F`+M@WQ}^fuY-!C1UyqHAYD((AkTIZ(IMDu=8)v
z7wfJEoiX^T^T&&nn(4~wj7pLo;0CJUfzPXZLsUF^ojJfGgD-e0rpKu>Mtf-RZ*vBn
zGN8l1&6%^)Ma6)Bn=@CZi;4;VHfQb<HvVmK?63K{WkI&I-Y$ve-xkf*{F|v>zBHiq
z8(5kHB0Zf^gVBgL<bMf#*-_4P2MtCgZO{a$4~PIaL_rPG3<Z!c<{5$NZ<p8Xoi|^C
z?p)i!uwr_z2BSj#VNgTi7_1lp9VO$P)>tj@MXJ;qd>Mc(qd*B;nyr&SsdncF&=Q-@
z8!r~#0CgexgENXjMknYoFhs_`=IOk(V~sRu?5G#E_4xIM7bygcueW6Zo9}^az7x#+
zWgznz^*|*#*!-DV{0uLC_8`m$wM9TTL)>owrQ{2pmv{UCt&qFW09y6~+V%-Ll<37l
z1Q#T`3CcYjka4RXWWxeo&<*J<3=9oVJ|29`$$2Afu>j~uoK0>2|GxmOS_kJo!;_FM
zqjAOm|KNQ}Et^5-KL21U)m#X^XyZVMLbC-!sdUCikfGkX3=A0x)A$))a2bN;QC_x!
z3ezK;;D(_RNc>efXgk$$nBk@%vFqjFT>HPm&+x#DgKeO2{$_Y-hdW5l1vEB!c*n7c
z;Dh#<I&VPcNM5WqU;rJ3B;O9YMdd|L8)$7>^N;@}%m;sPSRUhV<ptIE2VN9IOv{J`
znN@DU!0_U7>;L-yV7K>1e26vt-~9VSiD~nHr4obgU>;D#ztb1g2-{oo|9=4gzV?PN
zeujXIVvu%A0|o~7?r4GL*8-sK%`w9Rex<BC?yxd2y!fpIIt^t9IN%xE{{Od?W@KO}
zm0y^{!oa|~fkA>n^TSRM1-eb6@z><@%UJ9AUta*Z_jKo>gTFYuN_il`c2%E&;dKaT
zuc|F5czfeN7+wOoa7ptorIPvl`?^5xu{=@2=>&1e>qo7(OWGlNXX=9va2I&7sQCYX
z!~dPt9N?=^Kxe8hEdKvL?!~Q^|NkM^HMC9mU;iIuyGRD;`Ub<3oriXSW_DiK_5A-I
z4GEl#56yo+@VD@T#_U}gzzdh}F*7jK^Me*H>wp&0RldB>%)np^TGPSbdW9KO(1x<`
zZ+B%o_<+Um<cpR13=A(9F*7i9`?BnESjo?@qXE?V(`x(wzrogFx~dMNrB5M9x|D@~
z8*3@(6nW6hF=!3z$6X-qjsqa|$6NpZPwS3jN&}tATrQl}?Z(y{@P7kKTJtYE{<i&~
zqw(w%N>#f3rmxarl&c4w4%Y1^16q5|k=E@d2V(Ga*D0hyE@PN-0L0*7;Gc4c^Fmtd
zfBq?lI4+bXfjZxyA_}}YmIt&r{CkRu0B99$XNZal|Mu(ME-DJ&A6dHbbo&WNUMw;M
znZhAZE|S&=I;x1JoI9=gzdir-1N9dlycX{UZLVGKqax7wlaYamfq%{chu2IS7(3h~
zyX$1qIzd;$ZTFJ{ISMr6)LqBZ3A&IfOu&YjzXh~L!iI&v1+*yLhOtD(hKavrF{rw)
zQ4#1o(H*10v+MmteukH4K%0UXSbl@<8xgVm0a~%kAbEkmzUd$X1H*26(CF6>&{<}k
zhYr5t+6~%FZu_5^iJ@G1H>mh;{^d|Exf@g`HUCm5=idz)?r#1iP{z7j0bF<eHoWxx
z`>rn&`5E?ujC!2}@-L4-sTTkCgP>zd-<PrO`2U`P;ot+7-JlU8kWH_JJ5O}igB<v1
zB0s}xZm4TtOyp-svt?i@lTN$%;^O19=HK;Y?_cwEyRoEo*Rk#T0a6RPlS}{<QygHG
z60i9Yc7xpx8aU=)VEJF7A_A!|4+nsvOe7!(M5%x|Dgl9E8THkmoZ0|7h`KWlbV8Ov
zTBjRJT4x<w^AQcuO;?Qk{h*<awC*suZa10kGKI9x5)}dd?Yw*}3=9V!vVgAm0&O^#
zfUrSp2Spgqr5$&3`u~69fwbly9A!)!PjvXXrgesSg3h5$>-4kjh_mnf+2QA%X6+cF
z!offFV4CF({;7vKPM5N$fu{dTw9`7n+&bJmx?EHQI@}zOxj8HVO<i@@sPOc<SlEI)
zQZJUsGB9YkO`oLCXjU%)$}|cQpz*$ypu;_z{{Qa|W$AWhcwtif|9`iuz{{t<L5p}G
zeG`S^|NkNP5{VUqau-M=LrHnFZ4T%zpHk>d9cbYfWTx(CE4Zo5v+Dt9m;!Vr$7|We
zAhkPmKxN<4HWjeE;I1Pe`BISByT<?jU#l(70JR{&imuB{&oN+>l?8SGI(b3;!WRW%
zpsRouf*MMlw=@sEm@6}VnE|6MM{Nt}9EBO-(_b4fswx`FfOk#&FW~uKz!Ci46r?<3
z8z|cJ)EF2R&IzAxXvnB#%-Zt*e{jZKkoYH6P(3d4Lc9PpE(AJ`CF2iB{FW*M!*0-_
zED=$l^Gcpf?=xgns%M+T&(QprrJTLnX01m6KSOxn{}L4*5Dp3m%Mh8)&+wvEm4U&n
z`LIay5rx;QkF%~=3F!gsVqjoo*Z~@4ePJUF>iGWu&(H9}LJhR212nD+8ts4CZwi`>
zWN?1D`|W?wE>q{1Z{Ga>4_e6E{HEZ=e93wShO}-`z7_loZ){$caHbt+1+l@yrUzcw
zi-1bW54~>x)0%($<!|Q)%{76VzJ>>0D1+s0fR}e09(W-l0@}mBOAj=jeBcF}2m?b}
z<Nq&G{H?bc89*6IkiYdJs4C_Kou$Z_*7)08sDv-A@weRp%~Fw!u<85^uURu}K)#)+
z!oU#!nm;%!BNxQ&QUQe~Pj8HhOmJ_FicEN~kBUrh2<U9#7uq7zj2Y$YBjXIefluTq
zkqw4RLz3EiVFrfo5*3x^XATijsQN)=P{WIJAO$%p5|I&&e?f(FnJTIg4KLORgQp4A
z54>P)e!#d0bl6}-)B+F%TA;oFw0^ARK#4%(U(nGW<#H_t_*+k~g3f#d6?vx9`5C}x
zf9$dZc`+Z!aPYw&0m2O6UEdOM@y)+A${lu1o6Zj!7d3b>O%U7(<ZJ$|!rxNP%D~Y4
zTm7}@uEj9<GKf5D^Y40%5>CT!JHQrjfqUmWK-TU85j#P|YdNrJ%K@-Bq|9uQWCcz0
z?F8ux2o3@dUI%0d1oJawYybs2sEN>gL<ZEP?T`f>6KVK%Hv<EM187yPiU1@cN>pS(
z=a`6qqoec2i&i1<c~cTmk(M{6?=)dls4r152nz_#cnvaff)WG6F8&#y)!Z)@3V<S2
zp!Gm0SEuY7(9A=Qia_IG(0tD8mS$U!2t!F&hU5%TTUCjHp&6WPSipyFHXjg(vOHR3
z5e~8&Z1syzg5beji40AU26d2zBLZp7w)K#MFZp(P%-{!Iz$@_LYRmusFW6^-$_xIM
z9?-NisB;Iof#Ji8-*ONSya)po4K6AY;BjP$V#8h+6$9{)^@~k%;0Z+w@ND)j@R;<)
zOptLU%+9Ybfld!hYrRw|kl_z<N&P%U28Iamy0&f?6@wQHAY%`9UTAv&y|Z*TXpLLv
z2~d3mT1a5{);dQ;g1<QmG~*3A&;lg=!U5tc9Z*Zgsrd&JWZiKV)Bh3`9T4tzQPJoQ
zQPFu}0UCWTQ8D=s!$Ku0CK**AmxzISyGImWPMuz0#wb?*zwZBkxGJdXjCCM|cNM_b
z?$~t4fbUjx=?+oxfHf>SPjud5c2Q9f4pC8QKBCb4o1t97@V_N1XwRbL^<tfF78S-5
zi$T2C3ZNzC{+6tu5%Yzhp>fF{#XOzh;qgw}KkVWB46ZMk{!f=TXLPCuX~<#(o%3&a
z!0^%w4UpTwyKpn^f?On^07@$&kU@C{7Ep=z2Q(;eQ}h3S)_>4lBn+$|K`sWvOE1(x
zg5V2EU}dA>r58dq|NlcSpRM@cd_=|Yo8fKH)ghn}@$B;=3Ejw7bAoQN2~pu;ZseH9
z&mcSzbU7wyac77M%U)3NYOSLJI%k<dI!A@2IK6o%=#EOpQqVvg3qyHecZdo{H;+o|
z?NXawP&@N~^MenT2d6t(Fd9J?x$@Qj|L^}Y1T;y)z`)6{i=lvl0esWpi!Y$TkJ}}R
zy*$R9w|0P6);<IcVcamhl*MHDKRoQk(;Cpk3(sEg<l0-%)ExLk+0Iux!0Tt*YC);6
zR30V>x<BznAw-ZX<7+)AD4iuiHC|{y21s{?$V`5Q7aej84EsRb&ikD&KQHOLp$p<P
z9}(EKU@jj+<FAUvd<@0h-CT?}85x@ovAli@o)px)xeFxG`0LFou(T25Jw`sT^e&J{
z<F79uao%n&#zv4a&4*a(U%%eDLYtqV@h8ar#oWCj9F0FgRu!}E0*M<Q_<sppMs{9&
z`RLdG|KJh}QeJ_#3mxh_`0~^*Sk1)&xx(*QK!yj%6Gvo0cZj7m|6}BD2?f<R&HtGA
zTN*&D)^Gf+9gLv6!it&Fx`VkoFQhd;;7IFaQ7Prw4+=PN@W1BT4+?T{bEEZJscZ8i
z=CtNtOeKP8&A*sSB-6Y~I1O*V1g+}r`~kh+?j=k5|Nk%kr-6o1I)A+QmiGU@<zfD2
z&|;O&!!IQn85j;eV`=?Xcf32BZKnXk^js@O<N99EmV?euoj+cztp;gqJy05()@-8!
zzUhj;B^$Jn<`X17d!P#VTSEW;{|`w6hL>J!tpcZl*J_<SDxIHRq(N16^Qe>xgAERW
zitx9{{{R2K`S1UdWYF~@si4$RUlL(?qa>ucLV%&fuQNmBwP&|CQ}fUN{4JkAOYtvt
zvrGj~12eQ9DB-tu;3)lS?V(Znp*uq6wY*dFFV@m~FHeG2^E)%WSegpDS+w;4|J1|K
zoA#jLayV^5%051Z+<kluap<@nO~7IwAA{>YK8B!ud<-&&`52-O^D$H%=3|(3n2%xa
zVLpaE*Z3F?T;pT7e2tIc#x*{MyCC`nAH$6od<+-SaQZWdSUZ$H^@5MV{}~^{{TF-;
zC!u1RAWgTQ@iFi|=VM5M;<D#_4DB=d8M<fkGfbJu&oFZ)Kf~PVt~QKS(>L2N3Mwy~
z$<MHACO^ZvnfwgfW`ep8pc!Nc-Zhh-VgF42iHwr`hoDl&X7V$f0Shr++OBEKD9yNi
zg&pG^MunvO{2Yd~2@|f)<Y%}(lb-=p^WL7x&v17pKLe<io?hX=IA3EzTLS}wxex;b
zXwebKlFvK%7(ikNG!bHIkNGAticY^UhmmFa14l-I`j1y3iUbM~ieO?ANE)MWLe&*8
zFn|_Hfh<`LwLq{CRSYBt!Z39w_VY1_2rw|Xfn3D_u}A3uSgf7_bT|*F!4A>@5(K$e
z7|Agwp_UjRIp*08K89=o1_scEONRdt1I-RV#FRjmAc=v@1DVah3{f{l3OOPs@^JBT
zadC5lE+Bg_lb_+qbXI4^+q};%^Fe|Uw1I8<RToBmVNj_ETI>&6g#gO^bHe$dAt^B3
zWHzH6C`{R=H@Gr7OyA+kD8>{SG5vxoqcu<GLGRbETW^=L?mkd6UEGaPR<83x^DoYF
z*4`k4*Id0p;jJf2n0o`v`S)Gwyb=AfbGn}!qj>$Bnfwd~U&(a-e6b6Zvu_=ICDHtd
zzw>A3hZifM0wOR0@Ld<T4!#nA3A961@W2GhpaL8)fmEmf3rql1u{1yC@4N-FB08=<
z{-yJOM3H&5^K^HOibAK2N|%p{47h+j_==^3+3ocY&CmS%ezxAO6Y}o-1v>HK#STz5
zcTr(^{R*`2$VWv6bn`DXhrbm154yAWVCQAS16?AFRwB$LJmA)LEf46{cy@=DOQp{Z
z4@4i94DOcQ0lL6z`+?TmCEN!e@GxFxywS<=T5h_n2cxuV=ZW{xpsUX>cbmeLeJkMs
zDZ9t`A+3|+werCS9MccDGipd7DFB;ukMTnX$7?01yy$dE4@Q0wm?0-ixIl(nWIWN$
zFx|$3QArdga|z;#Q;ZkVx*4W#@L-gl-si!{2iJKCqVp8vg)XqPssv~~OSc10^9up+
z?lkb~DbOvz)8Be9YH*8pioNFNU)0IgDL-AolToBzr1LsIXXmx%XMgy&-{}0*dE><$
z&?Y|@6`tNa7Vt)ZGZ4N&^K<527aN{V7L^z2pm=mq;V?YVdFbFHe$b_QjfWT-co-~0
zR5*&IKsQ=99%68S@QWn6c~p+MFftmx=7X{X9h!fzl^#CkVpGopI^B~8Z1M8H|Nnz7
z!UNgb487fM^56gegZa1LNP}MHa*~mM`$=%aw)4h|vcLcTLniv6S4lkt2{0bG_-_|z
zv<;N5ga7{j9~R8N{R5==3pxGr#m>K=F)!JeS^SX<oj0424E^vz32X-F5+%?;4ru4@
zU(hh{>BfVg#(wijM(}J*=Z6<R|NQ?CG4&E?H0VQg+{+}WYx%eH#!R2+#VDe945Ww=
zWEyBN2;?Gzzn}%L!MhV?^D}hYdQ3m&#i%3)IwtiI=n5Cmx;h@{A%3s^f{wmyv~`)z
z;mxSXs4!j2n^Ctu7}UDE&cCgIv-5)uQ;Cxeb4ekn8QS^z-)a6<(Cr=FEGo<voxd7>
zvXn@abN@S8B9Zp?CFrV|x19$KZ#N%edHY)9EqGJRo0lI!Lth~EAl0(voc~UiNb_%J
ze=XU~Z+N@gou%_o=LybRFVBONvA<^K-&W855;OwVd9GVVg;}^$M1_BwHwXW=VD{!i
zEd1M@Szdhp{r^9N&jI3h^QgQ?0qs8f*zl93jA<ha|F)A5X&#XD3lEUo2OAcU7)YSR
zr(6K!m6G7*Ljo_P|NQ^|+6BbA3sQH?@PB<bk4p1Fu=3_ZU>jbr!EF=(nebvWNa>-@
z51hYV%Yd{l23_ASz`y;#Yi<yi4YUbw+X2H%;6;Mq`~f;Qy(@yV;Wtx>QNwTMl0Z;U
zg8a-Z(D0L~gty@*OQ~SzhxadcgLi9xNPGWs6FAP_y<Ek>zyMLj15(A`Y4j2_J(bpJ
z1m3&f`Jsd9C1|a2=lRaV%mSTP`L}s+@NWx%1eXKLi(|h~f~)i83k%R%+#megPJn`>
z`4A+Sl)-{FO#G?ag4sd7ED`Pe-SC^GRJQq$K<7vB$O&jgCI9ww&4)lYg2uko0%`fo
zzwI<kAm$h7Aei{r!<`rTPj(*SKh=5SF#n0e&9<QN8HQ4!4gJpw3=cdjJkGjeI=>&|
zM8*Zv7y2=Zi1GgfJ5dng7QUUJ@st<8rl0m>l(drk`Tu{fvqpCp=nA{e(+7Xc2M2-`
zK!)7Df|D?4D=~B#0Yj+-zajrNUV#<U<@_1r{DV6WcFzFaAjiMGK@4<{-KFmvL6_il
zhg@dqo(aDF?!v(bEQ~k4Iq)!+u<>tq;CuZ(t$U^jcmy(nFRgPTnEAgEq&s^01%F0k
zwPnBm|F;n+7u>axfsvu(;N@4H7rtL;e!zGbT<9O}xBwnNnywze7|a+jy*hwVhR?Y9
zAV=p3&?%6m+MOq+zl&m&FiLyt0UAXr<NkJ#z2vOp>$9L!{ZGKJ3F7Fy%)kA_!G|23
z*BYOJHg#~GoBlt5QHt+I^MgOl2Ut|WVh5*d1Tq@ecYXk0?eM;vMP=6?9tMW@ohP6I
zE-EZgksmDwO2v0FFbFU-z65nb_AQwE@Be-f3v?JF2PlpY2ZJr`JaO;=N8=-~1s6ak
z-84W9>%0Z(2Q(h~!}F%|)(U~n6QvwGKPCPDA07VxVf0JTA;yq#G>*=ro!2{0^Y0UH
zxy0WBI-9WJmnwg&G7|$sZ#m;J78M1<ll<G*dIK&r{NgN^YCT!XVq;LknSGM0*N5@K
zYqn!7Dh7rp-Cp0GZV<#MU7u0!WTVI5(g*6bNZP3Kw}O{MfsRG)eDUJh=l}m-9%N)-
zu!-Pr0iB{@lg!^bpOJxqf1hyYix<a1(*7XnV*ZvQkO`bN1tnoGYe7P#C5AQ?{4JoI
z_%a8y+}pb4QYmZmVV2j-&4)Q!|5x(u(gh7?b-sAf@cIA$@Ao@@y%y+ZMpo2$sPn~(
z43H&uU;`TJ7z0Yf-MYp3w_VGE-1yk};>FI-|Nrj-oh94(;)U7g|Npzh54>XL-*yS1
zVme3#Xt1#J#S4+o|NnQ3H$P%GJPF#|QU4iKPQL^#CIeqN-udFi=THCt@2UV55iedm
z|MdTV76W+wX6LWY7ccxi|NkHVI?*Nqba~0P1D(gaL5G^M@b6<$X}MIQ-y6))DWcLH
z%+h+PM5Fm7M|eQzix-<e|NkEjHUhlm@5Kww&yZe~X!Bu~`c4^@@PO_R6`sx)FS<U1
z=G(hvR9**z!pX0pj<LAZ!>zZPrCS=>9OMTDeaod1gU%N(yg&W_@BI2bSek#IaLc6<
z&`wBGi0Ce86smpt|G)F!Yo^ZMy>*N)xBLZJ4M~omJ9)Z|LsVFHWPmPa>;3!x|F18v
z|8^eid|(S2Dk$U1I9|ig@Z#$K|NkM!<lXtt$MAyv_w<P&jMDWgorghfhwcV&Mh9JK
zx*K!>CI9wjP^RuY+UWw?Fmx8wv<96w!FT~Qa|AkHiAAOJqP35TNQrAVi^{<VEZrq4
z9E``h84WLiMx{VkFmyYD&L320KFGnp-Hi`?2&@|qBWO%b0(6ZV_$(CAb=(S_ZXB<-
zf?6!hAu2pj(|lAo7!Rf$cjRGa=w|9<G(6Dh$kOe^(&@+nu5%ng<~7%-STL4w9d}W&
z0M+lWkAT!OF{E{Z-QEq_$8@~KSpszZ69fNtcP7J2-#3FwwzSTiaF*sHD$#NA)3<~&
z3e~>`1<({wBkSDG16TMN8f-yf#8|=yDVP~cSa+_z0$NHS``|wxL*qNp`1!64D;XI6
zKV-ZEDq0(CL94nLN|`@TIJ{HfIA~3v;enS^!EN3LyFFI&GuVO(l`?k7ouY?3Z@duy
z0J?(}Bvm@yHH=ZP{<Ptx7l%QcKcT}(pexrQTo%xUI3OmAO6P+YtG<IGl9ho0RFb`z
z1G>`a2V)ug3sBqt^_%7+0?~1YTQ8L;!cMp00#^oL$AouY>^#0pkd=Yqb58tWP&4{)
z=LM)bj}qa74+NS|aCM&QJlJ_7I__l(D8&e{GBBjQ?>q$-S@!?`|3J`06%zwPvn}X4
zL533HUKbT6uod7l3SX?4E*H+IRo{A`L?gKKFxWDv4JG{GMHHaxm7-rh{`ddC_nX$+
zrN5#N9|m2bdA#*f=c(=jof6J0$bFx$*|V5nOIXA~m00s}1Mq0Y(r=)q<1|oh)7=KD
zxYD{En9?i{l^VWi0EN=QY*vww75ogWtk0Pl7<PkZtU-gNy)qmx62Jfd4_+~L;Dy=0
z|NmdV>-_Ly4@l3C=(zZoOg~^9ADhmDp!*`aD?rx;h=8w)l<0PtE*ZgS!gzSPUj(Cy
zu2@>@r4m8VZ1*luN7nL?<TuV^uUYpwfc6+#-YZJ)^#Pym&(Zng#l`81A{Z?gXH35x
z!6+*fqXHTv>MT)VO0)c2ye6$PW;$0SqdJ?{A%2FJb<@ow88sN4rzb=*N~(lG7qCnQ
z4a*$SI1H+Mnr%U=#u!TYVU_6INJh<iaOOAt@&EtffS?SvT7HHXpab}tkMMwE`50(Y
zwe@7FJS---4n7j-yx4qF;<er`iCO#%J3wdnzBcc?03BoQJn=&B@Bja;w@Wl&S_Hr=
zUcd(<N`ab${JS_n8bRaXFFOB&?s>Zr9d|gb(IRwJsY_UJ=P~|m5ln^$T5gwE9(>FR
z)~ERu)QY(PZUVGiDp3py4$IgNa;iDldjf_Bnr%UA>KOQ^9C*!ac;Ik!+~MGE*@#*E
z46U~-c{6P4_!(Ys|Ns9#BKk1@_S@iP^PM+dXutdaUwv03DBNw$g-Tc<y@MOkFQ32r
z|3A3-#QzruL7Qa{w;renpZ+F_QGwBDx<E9ec)b)@CI9xrFQ$C^|Nq5rP#Fuh?KOYr
zjo0%set~W?E&K<zFC28Yp+GOzUIO<!@X`z$6^0V_Z!RjlOr=s8380HKP5*&TZE%<k
zxpp(+<p~DRLNOSB`toQ-UZ%FI)3-%4TGdNHRUKz#V1DqA!Ig&r!V+-fVR(`D{{R0M
zZ$a(U?KiAtK?an_cdCla=4Uw03epHFo<C3cz`siu%q#l*`sRzrpxf9?LGyi`wk!;c
z4F63*=U)bAbb?%#0IorJz@<g};jrNDdRg!RO}F`5K-*Xvt64xNKk>IN2c2hN9Te=M
zz~2hmlGN=i(OfOVP{P;kEMR!M^+2gFxM|&bpyXYnMMSVmNa?fg02anWpxYBJ6yNGL
zXs%#kC{=F#RwCbM=jP}fP%0jl0irWDft+y*bTP>hp3cv&>z$hqaJ)X#Xb}W5#0<$0
zjc$q7+a(;0)*x*qtjz~lUcU^6m~k3p#&n1oubB*Qg9@p`puVc%$z2Jcs{h7|U9bNC
z-vv7Gr1Qp$b+7*a2bCxrV3KoRf!YNb3=9k#>NB1+^D|_;0Ga6a2NZ3f{y#_t6h@$v
z6*)jP)Q%KTC7bi*|Np~b!3#mFzd@Vccr&;`m-Jo#|NnpFYtfyc5@+W3p8**PAkl-M
z1RDib`(hF(i5+gX1!??WqJp$|X8Mg-M&U5kAOHWqzVkv3ME%V018FY>4g7!j52;dK
z%>4fU|BJ`{3=H7(r~w*PIQW7EG_rjtfPeepfQ%)eV_GVH|NjqL8^`w|c)DX8qiP~(
zVKQg|f)HpqfF5Yau>m+IzIgfd|Not!!p9J_fr9Ua7|0ILF$B#=OhA<zDCKK_uB8EO
zb_bo0A`p<_4myhC(=TLe&Q3ob$0(=QjAq(~Z=kk{Np##{xH&MVF}-M<E*#IOWRUp_
zRJmSyapLFy|KD6x)EG<HGvd4X8D5LDek+kkYqb4W%fJx2s)RSA8)Ps4^wfAp<@)Xn
zmab5ShF^&#`Q_>jzXHo83=cH?^5<`#3%dE>K*KLZ{;3CEP5@o=^edsH<Yglh1H%r`
zAr}q5n)zEQm>3w!<v=<L`CGCPQpNl&pld*18iQKmP6alM{B15ESx^h3;aAH`JthW*
zt^kgPU-e8SJPp5?OC`Vyy<RgJUTQo7+Jp}3B)mNJ{r~@t3$N`u4|ltQ=E69-U0pzf
zWW6pbs=JIqs}20#|Nr0R%+cYZ!feA_&St|{uJD?>p+<#SfxiW`!l%ncg&E1fjqm^e
z@Al^DE*1a{v;DU`u>-Vi39^t~@<XqSibavmi{J15|KFemGK8s=X@f?Gi;6|(i5IzV
z!G~~LrFA=Vfo_#|QL%q*^x`~7Z5K>!2Sjb>rxzwr)tw<KcKq9&xnAf&1f2M{`%1kQ
z>Mj-l*W$f3d@2^7m-27-<~in~qRQAc{a^y4uAD45Nr6mNC=~>+*GOxw=3yvh1&dE-
zO=PqH-R{F10N!u-|I`2f;Q24mHM+giLlYV0>yts&fvRxqHMq-LXbrySh2$4d4GuaI
z<;C2$;6v{?UOagVTF%-PqLR!NqLNf9{#v!+S3!w*nPkhQ3MsG~8h#a(3V@TrYfi%h
z(7g(XfYv$;8mlVc>JDJx-yS5zzy4a|FHjj;$D4NC0d%M}Xh-sE$<D(sSf?u`F)BIF
zc=P{%rYL9)euppv1LK8G78S#{;M-?k)V}%uUmJ8mcb!0n6zD*NXW#z+j{vW0>a9@`
z1NYB6f4tZ^y)%hXT09tZqSyic7Em$U>!QL2mVVJbeRmS0LYNFhvbFO6|Njj&DoR$R
zLVjTxMj%6zzJY3=)^8;qAPE-!R?yr}Lyd|uBY&$GNZVWfR;T~}|7WCvRGWZmx~;Dv
zZk}$K%qUzh0jhmZ{BJ&@0ZO`uLH*OlHyWTbAC4P-v$omFu#%slgww70pFruy=5znS
z$McJH#;7QC#;B;kc1wx8*ao^oy+%c%`QLy3mUt!xhSvZ5E#aVrnUnwh|9{LyMTQB~
zbd+Oc=yg%i0CgjdyQnA#f`)Uz3j|bpLAUd$|NH-cH)tU^Xsa#g5|`be$@YdC6%7Xd
zRtHd?bWzdV1wLM)>hb^oyFn|iK}uDb7#N_&ce|+MgQlOs%{GXs7eRL#gSND^o&%j1
zQ=_86$lrPj!mQV1;BP$!VY`L$w;qBp-B<CqZig^EI`~^bYeGA1_k8DL=yFl<>~K+G
zP3sO(@d8cUv+g>;4qC1(dgePHXtnaG@1T8%Y27X=erb!(edlB7&QS^I)I9=X`HOU(
zzxclM$D+gE`52lXGNyI%)}Q#!$H2e6M#ZoBIP<~(OrX_sY@Ipap<U3ys@q>3e9F?P
zqtf{Tv_g%Ip(G8oL65EZmqH!uF3?)Gw9XI}Ind2hpfCmHD{w#5MMa@AL<QpgD}O*U
zdHk*4Kx2p@DgtSmAu4R3asBQb6_qH)>&;ggK&M7@=BV&=UO4!Go7qK0<n^S68WmQC
zQr=#-2a67U=VN#Y+6CEc3tAq<z~8bNwD6@yg_XJ7^%yHingP0H#Sx^9sYD1wO^-=s
z)H2kDC}{WxUI7U@#Gt$3Fle52@dZ$ju&8u39A#u+Sab;zxU7q&uS;cgs0XD$aDohO
zexqT@`eqJ41ApIbP_2Hbo8>6OT+msG%q7wFDxftER^T-bpc6MU4ug{U`fvaLgUe;`
z@ma5RZ5u#~{#rn!EofkxzZF!*f(HyTR)aLuef$5vTQp%7_*luG-~a!wkA7X=EpwG+
zE<Z!YJ&=mnZ{R(-Er0(12i@7gACU14B<u#t(^0Rz)4IX&4+=k)#zzbv7(hF@RX_Y^
zU;ypm76k>-3#ae@|G!p*nX1*#&+vl%8)%JN=ZzO?Ai3@rTp)+5F)%RHgZfo3IA8q#
z4@%Z*3{1NYzK7J3=^sHgszx-Z+tmC<qw{cv;zWLi7hgaA{~yu#8+4`#f2$m5dr<Ee
zP_&nbbvvklCTANh+#H>QOWC^%cv`=e3S=08bnOS}difqyBRM|)|Nn*K=l}l~2F&7T
zsBb+`!NI@%z>A(o|Nk!x0ky%Q0@fe_A0&b6AOQ~~fd^my|8KShZG>ScQC<kzNdP+6
z;Kk#QVD|_bo&+EI2bOrT?Cbyk3qePl_C|bc{{68;rrVo?e|s>`^f&2@9GXraL5srq
zn_u%syuSb9<3~h;gXzVaXaE0)Wq5*o@#DjE*$hUh`dP1$n=)K4j=uq&>YkAbQgh(L
z|NjeDto;8!y7d6)7D3RED|4x0Mm<P!@dr@!ADPR~5DDtnvF~6|0QGx8BPlPIeFQZJ
z!O9sJ7+zbwnELVm|D7N{`XFKW=OsJ;{O4zAd<l}>w`S%4|NGah<Y)N2#PGmkkkGE5
zJPZsQnBHw*dw1qd=dtDoKbuc5y?e3dDQJ6iHY=zWF~aP%_D<)^WR&D82B|s>QZ?N$
zlToBT^eMC|WcfVd^~W<ATR|R4diDQ*^Bav_3==pQc7VozUQB$79B9o?5ee%3KS+Xl
z_zs+)4kPW3D1QI{e@4SBeufNN&|--cQ2(Ru!~g#;lu!NtpJ4-%$cO^Tc!LzCf>@64
z|NmbI+U@PI7(_N7;dv?W=l}l<1CU~{T6wry(f6Qg8m7+hz{_X9|Nnon<-z~|0U5a<
z!@j)x|NlkJga7~kvpQ_o$zo(?*>0Q1n8!GsxrZ@eyIm1u71Q*dGRAPj{DKnw{GxQd
z;?%^X%=}{gg5*py69&~{D}~a$?7aN)Jn$U4LUBn^W?s6Lf@<;hmHCWQnYKSJW0YmG
zcXST$R47SI%1JF&NXsu$C``>QRWQ^uQ%KB9QOM6pNi9-HEJ{_#%P&zVE-fg?FDgk*
zQAo_IRLIRQO4Z}qzP*I;D&zLx9!5JBHiHV)oScg7lP54nGxFpl7Nw^$6zQfWXB1EW
zHIdO+KD8uSKd&@5Q8&4uR5v%VfB`O$m!Fbayj^D!;|FGz^2E%N>B`d>6{pKgW8~QG
zIgPP`+0cL?KP`>HkRd;hAvZObp`a)=4MfLA@-z5E@-tXR@-t{f@-s+A@-uKm@-uvo
znEq-eV;oO$Ha~++5<f%QgtQ6M17<PGD4FUR>KQ5+85o%wm>8KVXauFED0n26C^#48
z7Z)oSn(7%&@0-Oa&0(TzsF#*(Vl;i@EJiV5b3FrH1Kso_Q={ZW3$s)MOOurCw`MU0
z@p1dC<Yxe3bB2WJ<|`SU>*uZHXJDA{A5?!cq=7aAgDp?%yqR|JF-zaYG|fAGH`6+Q
zrFDKxd!Z}Lz>v1<O*%ir%SBosH-hklV-B(mY0U{L{|>(Zb!sDYU$10fINWjY#oPb?
z|EH#PPvBd@zyQjk%pE7*9qv5X>tN9Qle3Jg*D<{H5?2XxucJBtz5_4MO#io%(Xf6K
zXqNQG!50$E5BNJjy;uz8ia@wipj-h6w-w6efpEc7=Qj?%;DB(!6Rx1cAtBrduwpPf
zI_@Q?odp`iI@o!A1$(Lg!3P|wpydtIn*$g{c#S|KpxcgG{(#SG2%^kuoO67AZaUj)
zM!m>R(24>6eV~oI951H*1C0xRL>$4|{6?fZM@6HzMn&gEE@-gwSZbGxDMQNv{ua>P
zmo}=UJiW1u$6Qo66bui%mH-8V45%4)phSN9gw>3q_02C08h&z?-G9y3@XMg|4oIbe
z;eprp3{N)v$|)5~?Funw1hKfA4>P59i5PEWe9h?G@GFJC1r(L_P7S~G_*-f~69f|A
z$%<8s3=BI!1Jo~W{{@|u32H6<ir{aV18N)mO6G6v1kW+Bzt{tkw(|kY7xTA7fQ&F|
z_*KB)ngN;-(BEMIs(+^c{r`UlXvF>nXb>BAr`C%Xn?brkD@q!Em6qr<{HiFie`zqi
zW(}jXy#L?-|G(eueDRvEo4w^^DQoj_(7eQPju%<~{{Mf;HhtR~MpwlU6#>sq9~F+y
z7cU-w4#^Ht0Zn*wynX~)rtsqh!{6yLYZ*=J{XtEq7yY2Itq&lXSKyw-W{{2=6`t3A
zAhSJFyIhPJZHh}BoO|<Gy6yS*v9}y3F?<pE=l_5A*B?P*?2I2ekEeEl#3kMN_Z@g)
z3o`K?B%BQY{Quwi`ZZJM``&EEmutX-Fe2baPH0ScSa4wH;VuUm(3b7rpab;lLAxbf
zK`cWXM*fz43=9l5O#H1+m_RG6izN;|15LJya315|Ud{31G-%3|MWy-d|Cg^p3OV?}
zM{V11^0#hgn!aH@qY7x*0;h6Xr?bS%VkQO#8(#hvP!qV^%7#0w+Z!}>EWqCi8qb@)
z(SuRK6Li`4L+0Lzpt-VlFZDq>`1o7aGcquM`@m_(odpD#UMT$j|39_6;mlkHh7M<m
z<IW-h&YlX#omm!N<7asJ3$$$&Je4OIVtK4Yzw=e+i5FWz4n5d<pz=~Tiwab$<x&1#
z&=jp}=Zk|6K&=js&R4Imw*D^>_kVqge|s@UceTWeMWESKun%8brFD7>yzH1Bww_VR
z^mvIj*kA{k!RL_;t`$Ww^k(a~l4X9c&rM&so^daC4QPxE<cbL=rWbBt^kQV1zGnlY
zCgbPn&o(f=Vl13~aU-LffY;Ce|07<@fk)?4yBm&7SKq`~HT~cw#$XmdTLy;d5}O%K
zIn%<^!qS4%IuB2;-pnZH<i%w9vzR%p^F*5ANy}p;5@|a@1H*j>)A+YvQcLfY>N}{m
zScYLEW5<cK=(M=B__V|6#~lP17}5@>?EtGhF#Y0YM$t%^scHKe9xyQU9ame>`#p_+
z+krIA8)}Pszo!{qO0&FBC*F5lExoHpYQlF02DS8#E)bpO^!f?RY`tzVz7?&PN*Ldz
z9Zu^!q?fiZW4hfI#>FaWod?s?dL0bXK!qrOdRnhzIH+)C1+mQ2Kt+h!|LOT#8SU$5
z{s$e)a3k&D3yHMm2mEQBpVD4{O3buQkeCQutPrkF04^2_7vq78dBVjw;9{n5F&4O(
zB1DWACJ>z#_flZG)iy>$mTD^ohUxj+7$@qzuz&^sv9!+1X)pLZK$XOSQvS5gTWOsi
zpuzC}A&A|1Yx>{4j7CxE%@rcdWnAga9x9A!hL>K;q=6T;^c_l1<KG@2qL$t*BGh`R
zlog_&^FrF;^kWXPZ4fS)%>re^>^_(VF8<@D=l*9@;<HX`KFE>AzwKz6<&RRM>Dw+b
zD$2c0^JxC@w~QAwoqaUT@%7QP=9B+Hi3FSmrkCwtG!yPToaXuZae5m6KE{><C0uDQ
z6#q=$zk^Y_ULqZ|1T{Skw0|eP%SA;ey~9O?KRvBmMkVdwYXOk6byWHetEG3lGNgkh
z>zaQ^^0zHzN>A%`l1uA6n0D|bOW#3III5+0gH;HCq-3y4ae$;0kfrMR!P?S#i+Diw
zH`K6a{A%fG-FzUTjwP-6kW^adwX}opSo)5oH9rFBFiP(%Q4#7poCdynOD(-Klp(G8
z|Nm0;wC11xOBMSLr|l?V0HxYaS0=Uev`$|ZFv$TXd0v;N@oztn4jQ+tX94-pMTG;*
z<48~Yo}$8%whwgAQrh=tX_hC_IxnP2{wN07Wq3d>9co@F%WEl+C7>k}U_po}0wD8U
zS^5sAgF5P9+gv%oY_R>VJfMI~>+}Vys})J_cBxkp0_m4X2i@Q-TgI6V>W+&rl(MB6
z9(d`&n6^U>>J5gz!)eVY{(~)$0;_f`yPe)pqr%Tnayf0s-F^T6gA9_}paPckDrMTB
z1G25dRUr-J@D5i+Fx}~@1W{1Jm7dm^Qm<kFI$r@4k_;dI|4&crtyM__kHw|!6S~R3
z&~u~j*5@UCH^5%1Q8577Uuyt1DXr7h1f*Ug4LpIJwoe>MJ;V-BsPL$iy7V1}>97D9
z;A#UV9n{j(>N{Os(hUEn8D3IL?{eXiOJh8q=9Jd_OS|-a-{G{*A8FrjsHJzfdcOSd
z55o{_`jk=iIlkQSFKq{Clr^pShy*mp#-<&Hma1u;(>3=n)-qO2U%rRYK`(8G!c7K-
zv==EF3=E)7T6$V<2q<NM>g==^exRi(htq=7S`U;8q-D5H|G$UPmeF^*?OsM(u@10C
zaFNt}L?JCY?Qq%)v+vU<>}B+-57vSe0&3l2!VKx10WxWak%R<bLObW&Vqnlq?*e5}
zK2SNC_JaNU|Nm)@uV1C@-~wH$^6Oh#D6C*Op4NFat@B*ki_RaQ12NM&UxC8w|FyKv
zV`==`4yV1S`U)ysKXAajJ$>CiMro%2kZ9|HQcF-7+jBjw^J&__=PYTAf6@-VXGz;t
zw3naZCA0YdYrE?9GBCV!5@%rOyWe*`t@BM<=kc@`oIn2mpU$_RaSoHW()2a^8I#$|
z3i%n*Ud);<c7V~L{#aV)g>=x+5l4E5j|xwE8vnL1ne?tWiL}o9Y0b~=J1+h^S;3yx
z`LpF@DQDU)##RQ<2vFL=$4rfn8JI!J{Up;kPlFhFqUoI>Dtu`#&VK=U<7FEEwv(0z
z)A=X6s4%B>{sePR@lQIK&gG-RT*?hDRO(*}Se`E8NZZ9Yfq~(5UK;=Y+n}7D#=rhX
zTIY*2{%tSP7+-@b%QXJ=w?LuAzwJkQTCa=se{l8}NHc_#3L>C{>&BFJ@Bz4Z2op$S
z1bNFvg$1Nqg(dC9&A<Qur+3Au@TGUe$uyjqm)3bGt@A^D+KbR{prch#(i$wrn%^j-
zbsh!>4@+9cPteq2257%(TE;nW>Y4K!td$28F)u)i+aM)J+Kcm_K_PGutdk?X%UKds
zMl+>%Ig5fA;9#qk0fkv+jtUbfNgRA9VEL7Q@`1F@qafiD6=utGVD7Or&Ufhz)iR*T
z(6r8@;F{|d$Awb%bn6-wjxvd~U5w0(3?K(UQZc9v5&N>`E5s#`KuSO6q9QW=-2q0a
zC{QqksBon5uRjEqlYj-FOnPUHiWo@R86Jwk@KEFdhaykfi$>6?OuP(yAS(}nY<<BD
zN}bI|6sD{GV$=?>fyk#I<oAIRL-P?4a1KKRtOz(@`L`Evr1vp&oB&lEexTyFJC6rk
zwSmYS6@lrKzB3lqSO5P1KfRARy*osOOD(-KjH%(wUU2-~NPF=a6x0y&!G2FW49jkZ
z(>gDvy->0Nw*gAT()hPuOxx*o2sB1}1CqmDKK~5zL+7cq7iB^W3=lzRS=0PR1LDMO
z1@$7JVBfWgiHX7HewljO4saXn07#I3+X1!ou7)$;K%H37cwNhZ5|OlB8#zJiPi~|&
zAJG6A`ZDlynin_-nbMEBh%hmfegMUZd{A2FM^LsCOWXDKKLZ0O`zZCC0#PbGm%yq1
z1*ou}ZhnYSvHrs+aAE@+2z6uUHF$f{@RC}GSRX@rSAcB8FA@HhT*mUshF=`~Eq09M
zmJPp{`CDWe%Ox6qG4i+EU}*To1X=+GYP^BkQRj6UezEYk@Gv&~V&!kW#{?6%{L}D@
zm%oLdv0S|2S3M_x%U_0uUp)M+dzsR9G59kwyj;uF@JoQd<p)E<FG2p+Wgy{fMuwNu
zm>Pb$^0$~Wrga`Jw`=(2#NVR8ST5i2ON_teK10JVNB))%3=O|T`CE(OcDZRoDzS!N
z&it(x7}LNPY`;9t*zn7PzvV1rxk!E5PS7Qx4Zqy@TQ@R-L)GqI!!J+%mTQa+zx?=H
zUNF8?WlC?T5Mij`>^rE|CFaQRnjOq2VMy-?kWKIQ04?icOKU#K_?jiH`Qg9xP7jrr
zKN!<?f*J*{*&uepJTLbP;-J^>AR_f~FRPW)b}@J`GQ8Z*n6`@{jFI8xI!1_O+{>gt
zX}cJT7#Uv9W=z|~IFXS7>=OQtPR6udY*QE+UN$g-TK1u<(vLexurs9XVwlUwkoH3E
z<NyDl_N2kfLZ~}lUS$B400ANmzwVcFrtM<*z{v2@jWNBxD?+B>H)Dw#Xl-n5%WeMF
z=?rN*!71^eT6$L(C<!+F{9nqKe#}9JF>TkDgNzI>`5Dt3K^*~*BvhQ?7$d{W?-*KJ
zPC|4tr0v>pk&)r$RfaTAn9i1y>HJgc9c0pWF<fV4c)1%{^CXbbEtk^yr-J1lf<l0y
z@8BjzwGOco29Vbn!Oi2BlNmrk)d|jdFH3)eN*aN*gO9-NRR@kV&I=&v7rQ~F1uugZ
zDEl0G?Vq-b!I%jgl=lV8oWKTwjAVQ5p5Em!-QXyrg<4wN%Qf%8$>GTt5S4bg<x+)t
z!!Q2w>@@yum-N!px<#foOz%F*7*gK=8#H?9`X_A{<4q=pmrCzn#(e=dE?%UVLrMza
zw4DOS85lr)D#HUHBVX#gPumR+>BDMi-DVx%(_SoAVPHtp{E*gqpiU|6#Z(Xv+@BIz
z(RVm4`+#{G;{~;}#UPbG4Hy`HPxw6H*PpcMamN^sF&0i&J<ez)b^9g*!)vy*j1S<N
zL>*L$MZ6Z*OIvtkdgXD(V4-l3qdE@53LCX<yXg;(Gb-t&r}c)jzDfIjVMRhIN5_q{
z&R_3d8^bz_YH15|7}CH8aHMsfO4Ix_-S7mXNd3mY|Np<<0rCo{hncoR8dQ_L$Om<)
zc0_~O$zZk-m>mvgdx2Une*YnbX?j|30b_bvZxka;vk_PkM6()*-T5Jnf7^kLT;D#X
zbskGk>vb~#@zX#T=+ysD>-^C1Ag%cTRP5Wo|Nql=Sc7eQ1!D7WI}FizI6bY`8LH~S
zzyJR`ejs!m0IA&J0n!ETC%xSG58^s_<SbbDJ+1SY+JXh&)4*qpDMOr4-z@<u^uZ2H
zdr_#$z|ePCZNcL2X%1?O7JpBBA@dScTOWf5Vz*rYSj8fcF%}0)IMX^ow?+xPmImwU
z{AF>d^v%m=WHrTVkjBXcXr++$;^@Es|3MAn4{D3*K?eN*+4VXAWJ1e<64A6Bpw+@@
zFW&xzC<9A_oCQ+*$>Kt>6r=%}_Tn^Hh1!BeVD~Qi{`#iHq0&hZb4t7V4sT#rTeRRi
zsJXsq;dgi(Lk1xrEot?%7cW&9K*h@TV2<=YXQs3rptWkCCcTqI+7ABNpng|cr_*%B
zGmIi~8<atTbxn<*F@!^npD{*&U*SMn^9e?Nr30@vot_?WhEbpK*z|@ojB@qMnQb`u
zTfQ-t%YzQ@&}S^?0BvCxVSKF*8nV)3v|;0K@n?M5z-+_M-{Qbr&TqrX-*Sb~hL69c
zmFZ<BvyDH0i!<}f1Zab(@0i+xW#3y4l!kzsi_H(~({_OtZKi!cUd6z`P{Ni5J|;c=
zn6r!lIIdI}`VOQS-d5|B3t;Fwpw_|X38Fg1ycqfpY?4sx5Nl!RJ22hpETdsPAE;fj
zBN>!-UNC{#kUa1W)PjTNfmdKQ=oFB&7x%zybFlhLV0I3eeGJ3~r3U_v2Bw!=7}C3)
zCEy){#R&{AvzS1ocQB|uy3JYi<zGgyY&}EYA+?1G4C$TD5@|2Yp8fxy-r+0?5({8R
z?{F4*X~LBDV%MMl|G`bY()9F(YDotERyn5hhH420{#H?lsiI(SgFLyQg(1xWoVq>I
zED!Oweqn@I3s<nvivdYG;wo6)SupJdmnf{E^RnqTEERtI1<H`%4$C)&^kdGl?CHmx
z1r=V-V@&TZmT3ORSSkcIA5>azbCyXnJo(ar5#-kC$Idb8X4^mg|G(uxsU*ZhEuaCH
z7od;=>2Vf#ne;#H#dc5=E{%Vivq0L51Q7<%_1ZAQUN|c<Fr@jtegk)Ww^#r}+KZP@
z{{IIR;b4D2a{RSl)8o!F$}?`AUU!~RlH=viv=>Id|Noyp|2(5~;E|vI|EGDUy(j?b
z>pY&uzwI(u>x*NcF43{H&L3)v7JXOikX!uybsQw4yj&{|WiY-?1FZ=Im--O9#5JaK
zUtsj8-vH`Gg4ZfxwBe4ssHib8rR@s)fxYn-25YiG+oYg<9Zw3=__zH?>--Jkq=9yM
zq=lztMBZXxNPE%y`v3p5h_on>F!Zp<GzY^2&#pB5<}Pt97i##;RbtTao3&iFM6=~~
ziQ{Y0hTlA;R?u*}!M{l@o#FIrEs%i<kZR@i|Nqm~E;1@g{OG%swub>Uvbbx0B|pQ<
zZOjmlPmjOID9TX)w*Kj>=`|M_9o^KK%IniQ?}74g3}d+tXwdl(c*t29lu@@wOQaoq
z42rz%ZX#)%he0)Y9Y-2y#F>>5R35Bm1dTR-pLU7STIzK*XndKIsodFyJH6W*+&Oa=
z;BP&`IDO4!M)~Qbml%c2lbApy!e_>p=}hV1;bgtEg=glbcQ{L=r$L93K@9L<@@tm#
zPCtRP&JQp3r*FN)s8)Zt#01=tK9Tm~FgW55rnMfZJOVZ%4K$!UnIX*;)R#Q?fCJpM
z^hoP`_4*R%(ygg!{;$E#j|L6-)JcH+0Ml0+i>WK^MIzjWiff?px`Pj<TV7^VRybbD
znFhN3R27r}LEZWjueYWjbCYdLZ}wARd>J!+;ble}rmO#^-@nXg!gP@V;(3!Rj6zKF
z7(jw*)AOz{@^NSCr7b)$H?8$RN$&LaD~uY-o}l7dExo&vNiDtGlcncuA84R<g95|H
z|7rZ&LHN}4t5+BmnEpyl|9*whKz7DTJ$^>9kd^!j2h$osYk%cI?OlGQgK4j3U77B3
zl~K*}>J<rwouH|fzMFjq`!4o9?0cE^>gp8@29TcShyVDM4!(MFh2eu9Kcn1&m4+ul
z3i=NA-R!%V_Ww~@Xj(v8P~R=S4C|}YXWw8noBr}DqrdXxtNaWvpZr5veA*3Onfl`A
zGSIxa#O&$O*BE7(^nXqN_?l5w<fJb@18B5{M<;D3Xm@Vf3*G0_wcaqQF^9Zn11XW>
z?YY=@6WnRiNqZ47eaSUO8^)CB53e!mGKpTFE^wXESb`B$Y<1p|XHSbyi%W}5i%yG5
zi%g3+KV9)UqmnIXVOSa#**Uf<0nVPK!n;B1_jiI;b?sVwje)`7z-y)r4RcS=(M$Vp
zmNGr@I-{^;^L6l0yyb&ZnFhP1-x*4H(jw&3GLD_z-g}+VjnOjpKLf+d(En)}i#{+g
zyxjlK@Dezi6@Yq!6*c?}FXMhA3;BSAynhEcdu~_0$(YN?lr~}dgj<XTT%b8m2;RQ$
z7UM$J`V}h~_*(<MB5PIwX@2q<KAZ#|oHz<^AEqtb^Bvr!7fA1N<p2#ch=3ZaN4}@0
zb-VJUr*(%4fJR(8FQ@UZxyh7v@HJB!<Hxk-%M9S|HfT^eMg=q^vE7#|t+W1odRixs
zO8RkEE(Qj@v~Iqf6<}qc@pxuX!?^WQDLeQC$n6a2$6Zv!7#WZT9N?n`#dkmrtHU6L
ztqqLnY2Bqfp!QMo1LjREX_|-9__rNO<KKQh&GJMYGiW}Tf7_w-G))$jG@XMFIKiIb
zNNaw^oObXTXL=fQ31~2<yOsge(mMEpr4QTzKlp-W`p#F3iuItHBAqdmD?P2*MMZ)!
zJ*_!JMF!+58I`o=-^_J6X$OBZrFX`F201_@<Dju*xI;JG20Jvp+eJkz?cf8ZbVgS$
zP=;>Z05jn+b9x$R%@TMoSsK`RjIIpnT`VdGUNEKcZ>v9$p2p~+A_28Gt@U<E8J>`F
zxD6V*1#O0DJy61)4jR0F?UtSf_T8_vgRfXX^ADh#96_V?ppphunH_w@nV!~NqQa8a
z{ER=X`8j`D=f$2|eK$TY>AMB;|Lt_fSgzNbK|>lygF$JBfBi`dNDE90Vw3B+(03y(
zB#nRjle8CKZ~p(E79-CN%`<7cz&)HpYF%PWzFQpPZ@I?+ZC!UBR$H{>`+*mr$Y%$Q
zRf0zb*<n3_{ZBz{hk8g?U^AElDqPZDEC;bWf7q~>7{VI+Q$RvHKnq{fUUY!ioj*Xe
zp<a4dd%;}>NQ>n~K3D>D8YNs`3`l5)3AhOs0AhoC8z1!2yV{`oq7J0JFn{|0f5T&r
z5($`fY9OUM48hu@!0cQQ8&bb>KTQLT4R;<+%UA)b{xS}OtIYk^p>;5*tNQZz^_MrN
zJz+FbT+U>pS}F=o1CY+pF&7nX&_MlbdC<7;%dF|aPZ-@8Wv0)6!YEnKl;#GWFz;rl
zw+2s_FJ!D215cK}WK09k0jIqXJOBUx%MXkVpsDip3=N=(@-v`T+CJvA7r)N^|Nk<b
zvEf%Sf6ENUdJFI*`8rSzvQ7iflBd16ehw7upn3AN7pFmN!;@*?yED={e~6~Nm<%#q
zjS)0gZU&kw_kUS1J@6@`GGp`f(x;3{D&H>t|Nqj8G0pHK$N^J8LzO%#>1o~E(0tzc
ztL4)4Jx>`eB|Ot!Fr54U|Mkc8v~C_1a9w*N?ZxqP(|MmU+Nyb`y;yw~N%j_`97ubS
z4{}rI@7K9$&4*d0XFX$7VN99c|BO-1$@c93|7p&k5pvL?fwUL8XF++P+eGCxb6V$V
zP}h+WJjM0W>u*}~5gtf8B@HwOkg@n51H;RmAEtkL#^_m}^oD`q<+l&u+19idj%PsQ
zyUwyUTqU*TYBo$IzU6#rh9^NCk|u^U!;`N|ZCFcuK`oOlpcbx-!OJxaHbNyu<$^W>
zCBcx!pN(Ki_{*sbHu?N5%?vh^_**+cN@W{fHZr8WNV*RSaLA;r+Cp&#TgY4+s6n54
z8Z<Qbfib<qS>|;(DE~#jTyq*?W*T_?;cIZI2~JW~Y-umV?@!-;n$fI&LRyB?a|VW&
zj31DSb&j;o!)cw@LGxHIR)b6iP0oUL=cOHdA&}k`ERx<4qQcyAsUjlHL$6EBVP#t9
zHNCWMy^IxUmVZmd;8Vn1Vh2HU#J|!mK7TEq=APF1H|^kCmcFB)l0z-MOFWIge%r6~
z&T4`5<IYSBAJX<StN=A*t65%~fu^aL@0W|Ef%h@>9aHNPD`fyp={3J#dJP(L)&&jl
zg2p%Da}_U5&!%~z*xhoe#7M16?9lhL&g<!2Au7yihS$?Ne>MDSNbCI6aET$Uv;G>`
zB8Cd?hF?r&Y-#&I1971K9jH?zdGG~OTJwVgAgwHE&5!KUI4^+PgdN_ZX}cI4ATD^Z
z_YA1${s8Jlr8OUcJ16aMT81;IQkH%PEyjXC!?|4!vY<034H?UQZJ7AQS|%}oTDgxI
zS`L(kgX&D?v=@GNr%!srXe51~(T1JBWe;OHrwuEAYZl{62}YaUpziC-Gt=+CVKfk*
z!kG2~bP88`cd!bm$;Ot}e2Ve4^>n$njMDW7(>t6cH*|vz98YV007@AmpnerYdWW}6
zTJxiS>7BtUFFhI4UZjXHFn|s!2Tcw<D+C=?p5Emw@vIPZSUG6s;8`KW6i~#cH9ulZ
zYkrWB#(5~M`4rR3K5+76NP8g<Iy4Wo{`nKbhE9;3(^tM_)aBd8koMv(Xnhq(YQyv=
zZyEKqA*Q7@KdA3G1Y&nwcpU?xpA>?|ZH_z3Ffgo8D2+~gQ7t^({T-u%EJ!k~^Fvzm
zgZQ-O6AI4?UxS676oT|mZ-2+A$*;FiXa(ptG=4+9E<S-3(?4usl$W^i!~s4&nbs}V
z@;wdI0_VIjU41K~tk^-dw8br;;flj&1x}}BnEzs6czNyh^vVZ}`b_GlrmuRySjx2F
z<aEV{jO{|zH~;^Cy#bW1UdWsT#rE;(yB;!X$?gLkGz)5teE*i#c?~i!)^TtJV+mJU
z=dbCEj~Es7KBO^T0IT?#*7z%&frp_SH2&N0nj`JS^BW*j(>uInU#o!4ZaOjD{}H3<
z^qB9AoIIc`crC5-eA<hi8`Hy|GpeblfYjef<KKQrExnrqR42FoFV$=K`Jj|9ZN~!!
z28PC;{~5|mr_X!NC?+V^_*4Hui4a&wsNv^_(&?w4GX~Uy1}_=XLF?Mm4ujfz6VfsQ
zK}|^S7ogETaK68mwu_+>G&H>P7^pyV5J_u3(6EWoCcfMl6bmm3j(|b{w1DIQc!q#~
z{h_pjF9p&()A-jP1Wk$@d?k?H87z_B=`6B|IlUuT7F>WHJ}Yth?DV7W8Tsq?pJrfq
z84H?RJD``|-NJC-7U(+nx^gy9_vp1R#3jcLzGDNqr}?pc!|4Xwf9&PFAnTh?902vH
zUrQZ)!IRc};sJ=0_F~r!kefhB#Ga=i?Zs*^7c$bj@J8C<^J$$2pG@jFbm0{!0Sl!y
zKV-BxRl=6m{DJA&q>c+|ho`50U{n$mIQ##9!<lm+KXl$mdolIs^cf!*bL*Sm@W66z
z8-Gg>Q@MdnFn`NwhH_!h@X;Aon;`y{ZU!5bl9-o9Y&P|v`2d?{{uT))n|S_~Z457E
z*=!E*x70J2i`#VYxA-&jw<$2CH6H+P=@Djo`H$7+5PwTCv&{?s7B*I!gZ!;;SfL&2
z18NKT80ynIota)9U`_9Gma$<fF)in8IZ!H?W_aMWkPUOG38=%$%<!5AGSZgzVghK8
zvJ+G?!Yi(qb$_2sy6^&849L8G07`90728X;qv#?{SM|~s+N?-x{=vvu!kq?M)!uS?
zI?E?UD;w=w3=FRoZ6x_y=Ciym0`-e!;u#n~1%U)pdULYMzqAZiP;=&m9Vn|ry!^)k
zYQI~o&`VorGQH{(qm$nT7If>xj(~mVP$FUzP@-sKT6!=2xU)<=gWdw86|cEqY{M0x
z;`gN+3q;_hEeptz(>Xpf%GXPP1?w5~78rn33A|*-uw=$zPyyJM-t4WynEuaO<|RLd
zlG4MlU_1yK3+r%E;RcN^cyoYAXC~16=fMXoX^ba8S(<;zA%V1m4+PShPw3Y-oSWQt
z6f~ge2%1Ff4CK*ETexCn+CI=YXWD)ShJJ=Lj}lHO-|&CmQBZfI@f2w2Gd-=-L<Kxk
z%YqmebyR?~W57nL^jrXC4bbE=ip88C(l~!LoSUqcuAkQFr~y(NsFP;+Ev@rJdbhVk
zTIYAQbbiJF4p2vW#!94N)Wqo?Ul_F%CwyV}@OkO$XCV0nD?x2@(14kX3inH%zj|ri
zVh^TI{=%qOUk@4;0aegDzCHt0(9Qxcum1r@7z=;PQigH?8>W&x8|IQqP+R9Z!)p=H
zu<JtxQ0=A6Xv50iGMVAETY8tXV9S9Lwtpu|L|$8<CxFujk&}Gi0ktkMb<o(RN?P*?
zVaAqA6(*p#V|{G|q8MLJneOtH(Lm`1Bf2?J2h$s>1({1YK<b!ZI!&MQl~FAWIju_^
z1i1uq-gAi-$i<2O(M|bs0A1t}hRB5j(>cB|`e@nx28RS=3A>F#iOb8=40>q`AIwby
zo%G9CCIW6TrS(o=`2YX^^tx}1I*d=Iul~lUC05sS7L=x{SwQ0}Y1!XI(i)F3%$xrD
z8>34-xHdp`bJu=!_f+ghYnj3(wm~!WkZR-a?*IQg4k4x{7JaukRKk(=qT$m2|F6Xn
z!5sjaM(7e-{N3VE=|j+j0mln9&_I6YkLg*b7-j3{?*@;89ss4h7eC+q{|_$C<I`ea
zdLK!9(Fl>f1TKfc{hGAcmsj7Vb$$R(3P435l}*}&w2U=-7#Lo@yZ=)Ed|JkS5c|>n
zvofa}{&e!UtiG3)@dwmmI)5LjF*?2E2cvQQJ_gXL!((dQax1=r#<{?gLD{Tnov+^f
zJHX$P$e8vb_2U2kp!GeSuimU+<ZtO?Nb9`y2HbM&{SKOqdzQw(?UY)2M<ZlWqFRSo
z@AowK*XPx`_$GW$@9<G!`*(uB<uXIVPwA5Qv|SB%!4nqSd{o%<((AiHUF;i{r}<m<
zGw7vvJ3+WN`CB%Cxh!e?+iqCi<ZoHXkk)*NBdzh5#{&k2(&Mnw#BtaE|Def*UeM%1
z|I5t`X}b>G0nPB;)=TelVgb35ulKvfiDG+DID$JL;B^s}EGl(Ldg)#DJOXK*XZwz&
zIjE&~b$~noaxi;Z=gTzyeJ??o)<=as&GKx?*)(Uc1Dbz}l`aL(8u7Q7{D18NYUZ*@
z^S5gJfBh14Z$=tu<nBP)3!R<+|G$j<ub1A<a`za>Mf}?jq`eT^`TxIOdKb&xBVeIz
z2fWf8URwP}Yu<tunWkk-0G0L7u50o^MA!92)<ICOiho<M2q^JJzf?bSR`_(<gzb61
z7+G1kV{W8nOnAw_@N(D9>Ass8)i@8QWvoBX!0__#^tJyO6Lqh@`Tt)pty@lHMOyZ4
z{xrtJuv>L1#nN8vdh`E(n&yqP)&uptX)i7xpKkr1QM&&2V+Mwow{Jkk5z-qfWW7tB
zAx&>kPOAW|^GMqXy30Ln-+}K83_Z8O>(p+iH&n<llydbQ0<9?P0Cib*F>GOiuEluS
zv@N~ML!=KhDsk|8%cT-6aEHR;VyQ5wfXr9{vPZ0p`Q^;r+Aj+aH~a)mnH!#J_|?#G
g6EvD|@#W%UXGKrHihjWG!N5%4$XMUflHm^n0CLu-JOBUy

delta 67478
zcmZo@;Am*z*l?h_zMYYQ;XWe+!*fOk25}|^26-k11`8$zhRaM046B(L7`8AoFg#~w
zVEDky!0-ozSr{0!SQ!}1SQ!{PSs56nu`)2MWMyF3!pgv~i<N<4A1edH1vUnT8*B^=
z^*js=T7nD=E<y|pUxgSLCW|mI>=$8RxFy2C;4jL+P$SAv&#+IFfk9e~fnk;e1H%>x
z28P2D3=FZ73=H{_3=C@}85q7wGB5~9F)*k}F))}*F)-|uVqg%KW?-<9W?*oZW?+~i
z&A@P0nt?$?hJis+hJis*hJhhXhJhhfj)CEc90S8UIR*w@c?Je!c?O19c?O1jc?O0O
zc?Je41qOy43iS*O-;@{_T2vSqa#R@@_Ng&2FsL&ySZOdYNNO@Lcxo~*v}-XiEYxCP
zSgysuuvv?NVW$=Y!znEWhRa$E40p5`7@le|FnDS+F!*URFobC{FhpxJFm!1%FznT4
zVE6!{4Hy`%889&1F<@XYHe_JfX2`%GVZ^{7XT-ozSZ~C@P;SJ)&}GEH@YINb;k6M1
zLx3>@LzpoGL$xsjL!&VR!);>*231oA25nOY1|L%fh9FZ0hOMRy4Bt%|82HT?7(&b#
z7@Ex(7(~q(7+lO580MQZFkCZdU|4Lyz))qyz|d;Nz|d{Qz|e2Sz_8JZfnmE91H(lt
z28Lp528Q}7YX*kz)(i}lHVh06HVh0qZ5SA=Y#A7GY#A83>=_s~+cPkjIWRDUIWRCJ
zxH2#lyD~65aAjc7bYoz!bz@-gb7Nq5?#95t=)u6i=E1-a=E1;l%!7eJ(vyL~z>|St
zt|tS7h!+Ecsuu&p6fXvbC0+~+!rlxFA>IrO3Em9#4DH?w3@$zl3>`iU49|QR80Pvi
zFf8_EVA$--z_8Pofg#q9fg#(EfuYQgfuYThfnl;A1H)oJ28QE)3=Gfw85mLn7#M1T
z7#L;-GccruFfbepVPJR>!obiJ#lX-J#lX-P#lY}3nt{PEhJnE<hJhg|hJhg?hJoQ)
z3<HB=Y&`>mRxATU3kb(CF#L>TVE7)-z@VDIz_31nfnjd~0|R#=1A|W@1H-{Y1_tLO
z1_tkB28N(y28QX$3=9X785oWyGcYiwFfc4lWng%f%E0h3m4SgTje$Wnje)@`je(&&
zje(&zje+4o8UurKIs?PTbOwe4=?o0V(is@;)u%HsJV|F@sK{VoD9dDEIG)MC5Sqon
zuq2y-AvlMDAvKqQp(dAsK|P;=VNN~+!|Qwo2FU^jhMWQh2FpSQ2ERfEhSE|7hSpLB
zhNTq@3|lK07#eFB7<lU#7-Z`h7*;nhFt9c=F#Kv}VEE9&z@Xa7z@XpCz>w9-z~I)w
zz)<hg!N8Ez!N8Ew!NBmRgMmS=lYt?&lYt?llYyb2lYyb5n}K0cHv_|*ZU%-!-3$z;
zx)~TQbu%z<^)N7)^)N74_b@Pc^e`|4_AoGH_AoHi_AoG9>S18`*TcZT+{?fq(96Ie
z*~`FS*vr7+*~`E%rH_H(!UP5ehKURe43in^8A>KIF!W7fU|2bYfuUh41H=5O3=ARD
z7#L<xV_?`aje+6!GzNyr(-|1tW-u`1&tPD9IfH@W{|p8Oy_pOQNi!K3a_2HIET7B3
zaA+<A!-csF4DaVMFj&uHVCbC3z;Iw51H<`w3=A>z85ndHGB6k~WMB|j#K54wh=F0=
zA_j&Hi|QE|PA+0#h+D$I(6EGoVd4@7hDA#l7?v+#VA!~Xfnoa+1_s8Z3=CpR85l&C
zF)$b|V_<Mu#=uatjDewZ83TjVas~#Y<qQn-mNPIcUe3U<YB>YL`sEA^X)72Q9<N|v
zP+7^qps|vHL1!fcgTYD$29uQx3>GUH7;IKDFgUDaU~s8l$-v;Tl7YczB?CjiN(P3I
zl?)6KD;XGKRx&UotYlzFS;@eVv66uyXC(te!Ab^(l9db$6)PDSYF08ZG^}J`Xj#d?
z(6N$%p=Tun!-SO#3{zGzFw9uVz%XYe1H*!q3=B(FGBB)I$-uB?B?H5Tl?)79Rx&W`
zSjoV!XC(u}ft3sl^+#4RFq~M)z;I?I1H*-t3=9J685mU7GcW|KXJANK&%iKYJp;p%
z^$ZL<)-y1iS<k@mU_ArFm-P$`92*!IWHvA`7;Io*aM{4X5V3)QA!h>vLj#DtiGg9s
zCI*HTn;00@Y+_*8u!(_T%O(bfBMb}-cNiEL{xC2w@Gvqkm@qQbGx#tvFnBRBFmN(6
zFeorHF!-`EFhsF3Fr>3GFto5TFjR0bFvM{(FywPGFtl+pFs$HYVA#pYz;Kq6f#Dt}
z1H&gy1_lc*1_o~~28IMK28Mnv28Kmk3=G@37#J>aF)+O3VqjRw&A{-6n}LCchk?PE
zhk+rIhk+rNhk@ZfPdx*}M;-=-L|z7l23`h+d%O$`pLiJ<BKa5?^7t4SjD;8&Dufvr
zmI*U3Y!hZ+I4sP-@JX0~;lD5ggSZF-gO&&bgS`j?gRck!LzxHz!(0&thHWAY3{OND
z81zIL7;Hot7;Z^2FuagvV5pH{V2F@qU}%(OV3;b)z_3V`f#FWQECYk690Nm{90S9A
zIR=IeatsUy<ro<5%P}yh%QG-^$}=#`mS<pCFVDbmL!N=*nLGo-4|xU#6$J){AO!}7
zOa%spas>v46$%UthZGnX&MPo5JXK&|_@cnTz@o^&Agsv1V64c%;I7EP5U$9;kfzAM
zP@~Aeuvw9T;f^8$L;YVx1_oIr1_lcy1_mD`28MJc1_mBw28K*!28MEF28OB13=E5v
z85m9~GcY_?W?<k_VPMcuVPLROVPNo3VPIIP!oYA<g@NI(3IhYTDg%R+Dg#5PDg#5S
zDg(m_RR)GPstgRjR2dk=)fgCp)fgByt1&QKS7Ts!s>Z+|sLoK&kfYAPuvVRc;ea{=
zLzD&sLy86i!vqZmhPfIH3=cFI7}7Nv81`v0Fr3q5V0fj;z`&%%z>u%S!0=g%fx%vz
zfnlLG1H(gY28P$#3=AbY3=G{m3=Ax~3=I6b3=C?z3=H<V3=Dy~3=DC)3=H|Y3=DmG
z3=Bg03=A^*3=Dqy^$ZL#`V0&?`V0(>`V0&c^%)rE>oYK%(q~{WGGJivF<@YbG+<!J
zF<@Y@H)LQqX~@9v!;pa?#fX8S(TIWJs}Tc3f++*THB$zLr=|=HY-S7$MP>{PE6o@f
zwwp09+%;oh&@*RXh%;wk=rCtsNU>mGD70i?;Im?2(6(Y=u&K9VV2HP3V0dN4z~Exb
zz;M-;f#HQM14D)#1H%bB28Px43=9sSs@H*mVU{BU!vt3bhMleq3_@-U4C~z)7+$+G
zF#L9BU`Y00V2JZ#U?}%uU^wf=!0^nAfkDHYfg#JAfuYQsfnkp~1H(se1_oze28Ik@
z1_m=f1_pOO28Q|qKL&;wehdr`{1_N?{23T}{TUd3_%kqw2QV;r1TZkH2w-5?AHcxC
zAIQLvAIQM)GmwFSKZt?BG>C!0BZz?^BZz@vb`S%@jvxkx#lZ{=CxRImo&_^7M20Xh
zEDT{_xDdj?z#7WHpcKZya5|iUK_!lXK_#AnVRAeJ!|Hg3dIrV>28QS)28Nhq28POH
z28N5t3=G^U3=EAa3=FeV7#P;1Ffh2JGBD(%GBEU{GB8|8Wnhp<V_?{j#=vkYje+4}
zCIdrm76Ze(ECvSUYzBs1*$fQXISdSoau^t%<uEYZ&1GP)&0}Dgo5#T5me0W8Qoz8_
zUckVxrGSCqVL?3uLuMfZ!<s?{hNFcH46h0q7&wX;7&M9)7%Ynz7=nrz7%GYw7&aC$
zFdPQ)iy0W|iWwLt7c(%dD`sFgT+G1mu$Y12TQLIzcL@W7MhOFhTL}Y0ZV3ZJQwamZ
z+!6+cO(hHr7fKiyo|Z5${3>B!;4WogFf3(YNCQ>b^`#69wq*<qiDe87<z);EOUoD-
zPM0w-JSt;g_*urlpjytr;8o7RaIBnxVOj+P!_^7~2FFSUhRjL^hTcjBhQ*Z(43{ez
z7~WJeFz{9}Fep?pFql^{F!)t5Fx;$SV0cu;z#v-9z@S&nzz|l=z_7fUfnk0P1H+mc
z28IJQ3=H)@YZ(}_>lheJ>KPb3>lqmO>KPae8W<SvH!v`~YhYktYh++>Xk=grY-C`_
zYh+-kZ)9Lt*vP<ewvmB>uZe--RTBe4c{2mU{bmM+)D{MYxK;*+tE~(SI&BOLzHJN)
z&20<}i`y6&j<zu{n71=9gts#=B(yUyRJAiOG`BO<GaPJZV7S-Lz);k|z%aXmfnj?G
z1A}=d0|Q4l1A}Ha14C&K1H<|r1_p;-28Ol03=9`~85n-{GBBw0F)-BiF)-}wV_<mQ
z$H2hT&%kiApMl|NKLf*ueg=lV2@DLcConMlp1{DMKaqjKX(9td_CyATx`_-7QztSo
zteD8aaB*Ti1H+Sv3=9#I7#OBbVqjP^iGktwBnAe}$qWpuCo?cSoy@?%Ifa42dkO<X
z<P-*mk|_)fl~WiPI;Jo%NKIp4m@tij;lnfrhQR3z49li7Fl?C4!0>ZA1B1;B28OB`
z3=Gp}Ffcrt!N4FjlYwFROa_L$ISdRsa~T-8<}oms%mdZ`^B5R5%wu3UHIIRTZ9W5o
z+<XRx;`s~=Q|B`<ESS&0uzo%R!^8Ou4FBgdFi0<8V9;8?z+ka}fuVQ-14GjS28MYH
z7#MCXU|{&YfPq1FAp=A0LI#HE3mF);FJxelTExKMyNH3IbrA!@#6=7YdlxY<JXyrR
z@M#ePgZ5$u29w1M40?Wx85pV;GcfclW?(q7n1O+P2?K+}5(Wl^r3?)7mN77_U&g?Y
zzMO&K*INdLu!7B>R`qezcMEhouyhKvUMgYkbYeN&&D9ye(#g?!vV^(Qk)@OAaJL7G
zwFgHrYlq-}2bRN~2RjcnSTU3^JH7tVc|r5UVa9`&2TPd^4;&8elCqE}VV6A6e1h>c
zhl7*l!P2*e2ci#$1@}fV_L^{Y9_$MK-*Tyh)3GD)zq94%(htWN8KUFr4+nQ1ezENT
z|Np%%%>ONK6ti^RcrDamp-}(b<Cp^@!|OK<zZB}(9l8WsE|q?XJ{%ez798Apx+6q|
znSc9>U2F^t44p4t7;R->SRqi#VtD(tXUpwUp<N~r@rbPq3>}9J|G(Dd-*(yQ_1nh(
z42%p6B{%rDeeV3!`QnAeR%r$XD;E{!65-x3#?BWnG{73%TW*(LeZ6_|f-TZg3|ko(
zS`JhwG#}>R-*(*cL#ZVH_QQskUaZ<O`RW!u-iCkw|92iVywuGymBn?kz*afl)&nI<
zorjxG{I~pEA~V@~t9*Uu!EOP=1Fe@z<r{y>xbicUa5VmuaOGzx<!k<7P|Ui+fPsOb
z`GvvZ!(qYQMFPx49Nkeonx8Fi6f<?+=oV_dRQeK4A1{i&=(xkd-J%Sx{0zN4O#j&#
z7#bfk{P_R>h1wPd2Fnvg(#+kmQzmcUs=#+-E<ZzW<p1oGB8>+h%$@vnt7-6ox%>>#
zafidhf;*3OUVf4M_y7OS<E^(#rMhMRxbQQy-Yya84QA>5+4<o`#NYq_TMv}5bW6W}
z(Rm{}F8**@V}%F<bE#!;=VAWs47*qu7#Lo>-8A{)Hc=*#&68hj3$H)fdZ0v>f1gBe
z@rBM$4Zk?cxw21k_4-I&aCrT);WuORjsKneAd`YSFE;;RDmCvGodNPj6l13>h|zkf
z)T&$b%p87(=3m0)`n@1=5U-Qv>VrA_44phzpUmNBcrDiagR%5_x9Aj@UJ&E;q3FZ)
z!JUT}K5*e@Xnw)c{NqoFNSbAYKq*_AWq?o#SGNaCuj8NB&moDl^Kv&R57;;V`d`Aq
zzr9$%@>;2GcK{2FFJ$?tRF;2xu!wO0hjIW<sbF`3K<l>>w$4+XH~wEUJn)*Y`GCml
z-OUv|45bH}PyCOLJKTC;^1bZ|^@b<ABY3(Q4!mII-*%w&b_pBf!Ok16U-!B&{_k~R
z`rrJ3nSWcu4<~+x=)=JXwXL^HIQh37fT|4<{BI*s&c}EGq53sf^CM>dZB0;}{M#jV
zGBhwS>~a95{2MRcu4iD_<;1|iP~UkY`X#8L&%d2vvB@lch8KaG7#R4svpUS;XJ|ga
zvUtf{eg;tdEjF0N&+u~LCI*Iu9j^QgwhRmm4dpz?S#P-TGl1By1wldw$_3#<2MiA^
zzT?8raGZ6A3qOO|bUuc|-3}bB2TItx1HN=Sd^o&=k%3{d!_F|Si$DMW2Zhv&>ysDk
z6sZsF&5&q5z|+a1@*?~H|NouGIxlv<c#-h`|9{J4k{63Ox>-~@byPZ!cC)B}MLQ36
zUIwx4Ad0W=U|=}#&+wAw3CUaE?=@d%_<mpUnBsMiE`!brmd+P1v_T3Fc3$p$@q+9B
z|NoljB=3K}(R_*F`z?^d$@;rExIo_O{2|SH$7QnPE~)yc=(zaU!<`2YykO<ucA%T3
zm0>nN!{ryv4;T+0chX^G;AA-NWUz^Wfg$a<lgY;q(D3VYvgq|->GX1FKEToG<a699
z02I<`$DJZrn9`0rMYFIRcS`ur|DXT3Q^C>(1_mr<F)@S8s-MNr05`1HgQL^Sr}=<F
zr&9ouSpsNgH9z2Q{=r$!(tN<+aPt9kXwi7R^Hg_^icEKjibA)KiiGCHV+<nMH+h;5
zvv<m<9Q@7F5y8|Yqtg7CzxlL7M+9THd}jo6Z$v%EF$Z?0&imaiDiWF(S`XAYA7fu|
z%$<?@m^;(tWA4lu$J|-CI>K3xxwEx(yE1gTvv*!N_=Dv|<^TWxJ6z1!J1@M*gD^Ro
zkMkUJ|DWmfdUNZ^N+!dT*(Z5=S-2tL+fZT7P^u3q!#j_6UhCE}ylr{6PP*IW9w$rl
z0hZ2RFOt_xZrzm{+j+t8cBd5oHo=a|2VS!^{AMaqX!y-s!u{`bsnu>K1_p-L^8DKZ
znGZe^=@i(_4C1qbh55GyG97%x!ztj*zpaq*;4>C(gHD4k!RAN&oS$B^?q&q#4S~tt
zyOo4BHZm~m1eI931VDl}Uev9h+^}1eiDBd9>AMwt?rnfcgVc21cww@hfuZwQ7DE;z
zSeN0Y&KoawqATKG&%n@pMBue>uY(3u*^A%nCNuAG(em5Czz`k=7Tl!(vC(=10|VT^
zT`CYkwGERC_vku*Uyo4E1Ce>M9$7gDMDYB228RD7Dl#ApF&wIT+xp25_lPsiT|fEP
z9>b{4gPj*ZHA#tgSa6qQZxLgsL5EaVBxA$x_!7=;0k{AYnt&&B!%v8cD8^2S4z6y7
zV+;&CKtU26cNk1h*4k^#<g#{h{9ecUS?d@WBBG)}H99DwOBAyhvY>%n0ID0R!154h
zCV(Q%yP?920jdlXH@ieY%7WK1FhoZ5I*aTCi5Xsct=4>418fwCze@<>b6tpGU?E|!
zkXZD~hBXWf!JVfYEO^Qd__uNVSLtoBo@}-+&?7jw^F06d8=WF5oi|>HuVi50{K3Ed
zL^p^VA07YFa|HuKSa9dz&WpVTj2oCbKfQZn!&Iu%8_e{k`GI}MA;SX=znDtpIzLT5
zvroPrR9hbIyxz@V8WilJ&>hUu_$eSHNP+W0sY~;J;WB%$H#%>;n7y8Xq2o~ViT^E^
zN_88m`5DWkyNg9EzZWTVe(JpOq6Q&d!v30PAIS5aA6_$qYmazPD0W`xJk`nE>CJM?
znS=4TGnbRUvq#$TbZ5R`h2zcwP7wjloz5c1oh3klaNJo2ByikW0mSRP@j`Ar1A~S$
zCpbDfFYdAc1+CP228Lq}=8VT2IGH**jyb3^H68@Dh&nywUOf8y|NkyfUIJAZ{eS=e
zpIoqCP22GHzZ3jZ4)@C31+`N6x3hKLda-C314HZE62abJ7LdSCP|^9aciH5F`#bAF
zc{{N4VCS_?7M1-Vm-NQ}?{cyGZxdCnYU9A)K8b;W!A7sd#74g)pydF6Yd<LJes{B|
z9AjX3*$I-2D@nGAFUhruDJ|<}QRxj}>=aQs#t`HFdTTF>UFV}0dw>7`-z&q8B&XNQ
zBG>uowH^O99Y4F?ct*qjmVfIUTmP5vU?_Ug@caLN#>4Kf?;=UXy<Xh;sPn^%6tLWD
z_T!E!AeVREh?>0epiBL422eB}c*WfOfZd^!MWx{vCx6Q>1_p+5{)S&HC9(~_I7)n9
zo?~QSX!ym?-+Gjhfx+-VCyUBUP<aEgM&u}{0yRAF&6$z0RMx@rP@P!k!Gk}U`L~sD
zGj<+qe#p+h_+0Vx*Gz^7X1=s#WMJrZX4(ZR<zDdo`2XLiyGBK$lf5&XrPrASBK++;
zsL|PZt<#mEGnAz}oTZ!H@*00DX!OnUAb+dN<TZyR>UV+s@KPSxxYZzi$2zZfyQpY%
z8gvG*@NaWwF}&1#;D7U_|BN35f4x4!zde|-w~D#bMy2^dee(;p=2QP|Soqs-FfcIi
zZ#(c`rFDljKLf}iphDn96uN=E&K!_-pu=Q`!y@&UUV=u4d!4x;f->L#|3~r-A6WEt
zB1jY1yMMl+$a8^x``WSBnH8+^#T{gMi08p6_O))WGv6*yk@#XKvXc5<XEBKI;&1=|
zLp1Pj3ud+qQ4uJS>o!qgEKy<Uu2EsJtWn{q<7oZH-+K1%|NqS={)6J8`G^Q8Wgq6>
zeqh%^Q0`$|0_qA>@*Q}=()@s(e_O*92Yv=nOaE|qSm!m%Lq%+z$3HK5&D;Evv52Ef
zgs;O`gyZ$+xcI}t-Ll}exA*@}UN9qoG5eB;=E3ZfBE7R7fLi5EXXf%Vbl!@7xp{Kq
z5t|^3xBvgYX6t5nebVqYxUC%vX`;Wdd;9-?Zv`V}>)h-udh0y2^J#ck^Ba!NYn|s`
z?3-M=O+$AlD2O^A{h!dmz`)RYpyFINi%NHh3QJ@hsPWTitFw}y0fbA~U$}0VeE*0}
z{oV}>46mhk39vFSq`mJv@j`DS14H-Z7Eq@B@S<u114DN+hyyLO4maDXtmJ24D3R)X
zVEg|+KSMbqT!{U}>Gcc@uRk0P3vPa+@#5@CP<^`l$a{VU{_VGSfu`zuT~wG}d|d%*
zV!5cOIWQe_QDK*7?7a1&Yt!V3M}-B>!lW3OI&Zy5-!ys4QT2Lvkf9TsPyBB_q5*Dm
zmq@%2fP@AAt{D#e3_H{q85mxk-^9RhI4n4@^H`^d$_uss|NrxEXX_SGdBL-gfnfz>
zDbKDW_WTSxW`b%Z$<D*gkN@;K|F`}3pMjxF7$P+flma?7f%5iiY5whO;L2%N3^*HH
z{{H{}aW@%IhU>f$6&-iD^I)$7%Zt~q{{Qbh@gnp8|Nn@vE#=Nwn#IrXLVFVfL&V{L
zpo~2rp6n)2%Yg?}=<{!5vf(ci*!9L?@}^@--22{uBDPd;myN^Z`^U8FkAW+NkNgJR
zvKq7b8Jd5~mkI7#VaLy~Lz#hrAv*45+W-ImvrqGMZgiN<&(PWE0wO1R%;sls?gZ<I
zjsv$8o8Jh4YC|7z22knFQPJqEQQ_#!QQ_&XQPF`U*yi8$bz-}=fI<;uc=Hi~=<vAs
z*q1CID?W&H-h?FKb>Jl2_63xLU%g=X^Z&ndCpf`FlUHXONI~bcCv*83x?NN_x<gcW
zI@?}=luvsDBKLimJNdzJk$R5K5EY(o7Zr={5EYwF7Zr)l5EYs392Ey<7Zna+kS-RL
z&JY!rg`iB->7t@wc)Qz0MZxkge{TpQ14H&<k?sv3tGai9tm^#K`IC79$Qt1eur(nn
z0-Zi8BHcbJ9F{&R0^L3;BGNu8JjKk;uXlh1>n+c9{sfCu^>%>GaTEaAV)>#}7U~tv
z50bxN4(lvY;pnVU;d$)?^AuRtk)tz^$GO`@MZl6prQ1b?McPG0q*&uWs6p<cBGMhA
zBB2cu4N>6;3IGK~w~vZI=ZzOp|LXt$Z$844{aM5s9D4k{jSLJ7y?tPpfP=6b9E2ca
zYgAYyuNS2-J8}pI@^reW2y}+1h@jb7#Myb{Mf0!!|6i|%x*jbe1iC|1M6_8{q(f9#
zIvqJW>jQbLGX+Zd8C_H)1VdD0I&Zvi{q_HU^WXm^TAev64xr9KH%Qz?#iBDr#ilz%
zg`?X?g{SjI^AQzLQTcKPsPu%eL4z4FDm)<1b(g4!w4N+wX}w({+*zU`(ix+|)9Irk
z5FPiD`QLv~R~g)*3aH-+YK!mEVPIfb2pS)G@%`uj|B<Z+N_B&gWI!V*FYf;Q|39kr
zK&kMq1)$U!1j?MrfByeBy!6_l^UzLiPyuzk^WNvB-Q4iOtZr|XP7jt&#@+&vZf}uJ
z4-xPnS0PKcw?wChM5kdV%Z2E;_{q7aq+GK={nf(}t+z{rIv>37{twQAoSh$D$i4Xg
zA5<haAJKv4qt0WU*BfkCx`K+ms+|l13=F$K#10A9$!AVU)N8B+ccldw%GgyIKK%dR
zd9*haRFS{PeD?o;=a0^hov$)<*YGifb}Dr%|G(IIqdS_VTNR}1h4b(K|GSg_#2#+^
z3*wgwgM;`asNnq3`4PnV{}4nT?mPqzo*ketdnx+=|9{Ys+H<g@4NHZ<a-Fw!fWj^M
z<#$kk!*wXQ@-w`A0vf`C8lmDkdCF;nphZvr|L=V8Li8Wl<3hbIDk3lHpZ@><n%y#j
zqj=xzBOw2Si;>RjFMNK0RF!CU9_wBKstj7+mdN(HGQO||b;1vWBdNk+vdkG}#>JBz
z&PdgVbsp}#-g&M&M@3?X1SsM@K&%nj^#)W13o|h=M1%bGlJD35|D6(@6&#%fEUj-#
zS@*up;%Dg0;OQ290vdH-Q2|k{mr4bi4+wONs6>J_ZF%zlzh%{r`qwoo-B}+j@76zR
z{>@x3VR^Syq&w?NmoI~X1z*wmQjTt45lcUjqNAN6D&0b_cLjG|?mX4a`^JTzq4iQF
zQ|GDR&VxI^jS{cP5@%)1%wTS00J-rKBLf4(x)5+m*);{^50!-s480C4I~y1n7(jJP
z%9F`iXQlY>FXdxc2pUc6WbTyx<1%^jSqtU)pn*0}*a+@A0xG+Cm>C#e9Qg77|Lgi)
z8X&VKESUW6tb=gHhwg$emhU@1O7o}`DR%RySe~2gcut{S>hb^opll}q^7G-a;Kg5-
z^D`KpG`!tg$Y`4{&cIN{>2UEy=f};Auiv)ZF6BJN`e8Xg1H)_X4qgxgtUT>F>nD&P
zLlFNqu;}FnJ6|v}Fc@C?{xKlqJ*Zk@Tm`O{ph>;?4aYYJiF*Flpn66IhR&n>+Zj4p
zRCa+n1}_|EFfeo;-udtU|NmeC&~Q!KbOr`EM_~p7L-XT*y#fE5fBofeXJlkxu)M+F
z@)K0VH8U_cFxdY8Z_miz_5zf3Z#JJ~gzJ=_&cM)lFRjrobQOQ=Nl-&{dwrcm=MTp3
zjrIY~o<aPrTNxM_Rxp={^KW-&3*g`G&JvKpkj>BV!eu4c`K|x?TR{DeZdZXcOLvx1
zfwXQ{p)^Z(wo<l+dJ%>a!G?NKhKgeT?d}2xA8;}rdp(7Jn;X-?2b`TQDl9LqgM#{K
z>w!|iT?U}C<~3+g?Zv@w|Np->c;UX3fuZw#bBziMbD0vTu(xI4U|=X?-2tLH4<3BU
zr0Jr<@_FeCxupyYudjFBg!{^S8Uw>?K_mgIX$%a8Z#!Q!AK?H;Dx@cMEFdEr<dv!w
z3=9hwxbib}f-2B@*&i<a4Dqps|1E7)>O?#5b_;iYcwzkH|NrL00<8y1S>0bh1DORG
zbpe^wc`P8K2V{`Z3I>L5+c~cM4Bfh4T=*Fxq6}|a-meqt4w=i)`QgR;$N&F3w;m{Y
z^P0K&^nYmEv)R_gnV;cbDgTa@AS2fNumAslF-T}3i1>ct;0t+B`;>qC2g6I9A7126
zV_-<LHIpt?1UKM2KfH(ri8TM<DG^TdDB;hz3NmHYat4M-!`rX@4R7;rJH3k&6z?Bi
zJbm#0f5+jL10{z1+kW(hGk1P?5i^Z};ophUTfN~-ogZHKO#{ue%9l&>Z#xi>!I#6&
z@FH<JXx!oTmJH_{eume}JHUg}AWwr@zsEW+2V~r_<7ddo1*tV%&cM+5{or#B{_X#J
z-T!yGsPJ@tdhz%HXxzK`2v6((3P=9!?{{&5T=U|^lBpn{u&|ZN@BGiez_3daA}m%v
zm4U(V<Sr=)mt!geL+7W?A1~&Djd{Jh^Ajlf_k(yxTMzJe>}3RvxE=*%7LdU&{Gi72
zx6Wc@U<idcuMy<D>B|@xc7X~-{_RI!q)r8Qx|)yhSbiu`2n)!V3Q|(C3^b_w5w5Cx
z3OJF!<_*i(29gh5#=sC64|XcZ5XGqs3>_>gUCa(0%vLNa{M$rSN;E)W7nE@xq+D$o
z$P(@j9~B<B9t)U}K^dPwYM7RR0vPOFkdf!6)H5)2xTvs00tFNbAYtYyAd_rVI&XFU
zcmbLh>0<71QDL)kQDNtA0rm4iif;b>|G(uxNfQ6I1HAz(AQ66$Wk3Fx_=6O8@u)B!
z>=IG2I8@BkameCgu_(x?8N9jt3@>Vzg2si8xu~!))bno(QDN(45$E5=ZF!<jG$_Lu
zq#|Z114EaO3I~Ia3SUGN|27vDwg3>x9gq<VlD7fLyQm0tFgG9Jc`XEzVhhM<0!b-?
z43FpE=A*&}_owk>aJ;^FY4Q)$GJ|BxjQP3z49qV+Et&l8vNGfK$wF5g`4srKc}QlT
z)aWizkzo8dIsS^2#2+VqhVZceB`N|S92k&s7G#U>lF1XVh;e>@1u~E4rOf0FS8N2t
zCV>+Zs2J`1@#65r$$zfMNWYp07Bm8-upcj`Ph?<du9jgewd3FZZ?eHvG1kr>FA674
z_PHtvVg*l}oPAZ1$zbB-zN<1eLK7Jnx_wkwz!gd7hZlz@fcZS&hE?Z>7n>)5Mi>-c
ztho)ULtbco`2W8<Mn$CgwZcn<$<MATFwJn9%yCUQ>)Hec2IuDADW&IjU0`8g=yFkE
zdIt(J=3N(A7#QAxLzXQdgEx<#;YG_LP$C4?Mu)-UXxF+OG+Gaou)di5{{R2ZVvSuT
zAdlR5@qapaP%11#AEe7~5hz_n$4!pECSKog8#I)xA_N|(>b&vd(sTxfh8h(i2L2XT
zCQ!=CQ4#75W#-?`_Tv5oaQYMW01Zv>f+ayi6KAaX89MK`-Y$)M`2#fUQO(sGDgaV%
zJAr|r)7j{?TW__<YscPdxz{#bpk(08-p!WQ>CDpQqarl<-8HFtACRjiE(H7K<$Q3i
zWoxKsW8iO{#0XAWLLL5Wy`d~GJU}jR=jaXP0GWTHp8-@Z^YCwT=jdf=1+`*3SyZ4s
z%+>v%9%hMP^MgO2`o!>Lr;iH9CdSwHorjtqeE@Z53@>$tsBkntV5{H6)ck{`R1Gv}
z1j-z2FY^0A^>ODR!vmZyDlD8JWi=`sjFOj{4>5Oyb2j{9DlusI#mwKb7t-eF{P05J
z9jJ4Ap!EQM3urwssDaLSqLY1xQyyq~2h_IEd<#+m?*8(FTz+%~V+qf$4fg!?3_I2`
zFfhD!Siw@F)GeaYd<Zna_X0E{-+G`#Afpu&JS7Vl7$RQkGBPkUKmE|#3a`4$#Xv?d
z?AQgG%{&4gI(Zqr095d??F2QXAVWB-p2EAz-7YFTj7K~5ci86fGrZ>Rc2V)>>15yG
zn#a!&0LnBl3<_0nVp9*`-{#I15SFnV<c_!VLD8fF%CbWI+u6Vs$P3MzkVN!y!{mcE
zWa~eJ6t0=iz;Mjjj4?j;wRTvBd_F(Ji<w{{0|v<8|A!an-he{nK&P`tRAlRc5}RYr
zhK!vzUT{A7|Nq6)*C07I$gnlIyMO)(+z;U4Cs0ES;@?S+K^Ys&233fY<8BJq&v4>r
z==|CF<KPeG=7;RyQMt>HI6_#MI)8TF>iqCRwU>dRH<+XI!wczNXofq9H^cdYd~g!9
zD$>*fG;Q?Z#qB-@hAgHmh71M=28JCB2QL0Iy!7HSIF?!Kk>~lEkH~<gTS0YW;~Nnc
zP+x_GfdSmS*O>xJX@)0vWP^-X1r1%esPGv6Z?;`Cm!E;5lB4wie_teQY!lQ9X+Hh`
zxQhx4XnxhX^Txpk9Q@l4cy!)+@%cJvO0V@Be+LI614I1|&~(R(J>b4i>w!|qT{l22
zXwY;=;}MV(K#iT3mtX(?zYDBz>11#t8q}u+4Nbk6a_#?r_imRtBCQ8Xl`LaaI7*oR
zv#40gf?QR@2^ztVQQ>&a(+L)M{hohY08?6LDMP0#Pe&*d|Mp|`;7oVv1xpVDL#L|%
zcsP)M`>_{ax)~Tc4;_3Zkk%P0()J*&(^YI2AGmRO?1fhk14D<aMDv4s4;#jEeQ3RS
z?1d3n9Mtl#yiv#9T+<@LP|DJo(;{Nc3UW>z>tYZEj@1v>K!MQhqEZhULST6b>f<Z~
z$u|B5wIoVJyGvAfEKOASdk+8m|KIWkfB$Y!+u0PPBs`-Y6bG;7FfcS8QD6a$>cq!_
zdt1$KV!C)MUHKVWPL{+O9x%N0?Vtkxlmq-z4_$t6`O)GGQ2S6c$CaO<;iq1iu;GEl
z8Lsu9`B{(<C~drEZTP8NrrKaz0q(ELG~2d-7^R%ewhbUg3D<Gf1Xq60lmJ7<YLFw+
z<}fhq`oRNARtyXc@88CPCV?ADxH3-V^E14h%#ECAzC8c`zw_`h7nJ~p-Vl`l!vimF
zeEDDhzvXtRPR3)9VN!D#7+$pe{r?|4!@L+Y1#9@N(-bs^44$U%jrbG)TDr?cCBWu?
z$r*<Z7nJ}|J0V0R;6?wJ|Nmb<ZT|hIM9lDH=dB$J9Qheu^xpXYzdM?x`8CVyry2i2
zHtd+qzyJ<rhwK9yFTCIV|L+5e|LE2OrDD6jfO=X7SU|-_3^>&#z5M?lthyI8Agcjt
zv}sRdV8~D|;AeP|2QmtjxO*f1L^l8a!{5TqG`Zuw2DeUgg$gL%YgBY5?|!dTFWTh{
zN-Cgvk^>;;nj8gH<^0>3K{j`Odg0f}z|eWT`7c|k-cHcMjLuJ>j>3zA4hDwfE-ES@
zA;SZmE-D(wT~tIE89*Tl8V7qFy@IjSxcLD`^AAQzki1B<i;4(S=a1$GY|TGdK+(Pp
zBwWt}GUdbn|NkMTycPrT|G@d3E-E6RW^VJz|4^I1w}aX>U`K530M}e5V67INKcOnF
zf);eusPHh9Wc0eRbh@a>bRGh$Zw9G9-hA>uXdDPEvZ}tFfdS4-0m&ch{0SH6X=h+C
z{NMTA@LRWwib;2fiUsEf&R^XnDk{zA|0{k_`~{tte+?S<Gf{R?QTcwu@KWogQkK>O
zC0;xK^D{759^A>mz`!7Rv52p^Mn#07gnb8SgvIdE{}L6R|0VS*5<vk$0i7>9Z*{w<
zxV&(G2P%UlK=mIRCj&!sjS3HA^WFch&41bW`;7m=Qq0RYpmYezZk;YFI@t#_x@}Z?
zb=aG0RCE~l`%W@5Fm$`Bv>qts{O_Zp)BINB_0w(v{%yw~3K@TNx~P~y(m{P^jfx5X
z_Cug>HarQgQC_%T0#`#$-JpRJu8&}jb3=`a6GMp=sOjp|e2A&rRfT^$!;1`1WE|q(
ze&FB_mX3qX5BVE@vX_W9Kj1YyX~R;=#=q@c^Fzi?9~G6?3J@KJCwGD7cwaoe2x>|5
zPpt<fIz~`RP%-=u8jn2gq9OwhAdr|%cdQC12pCGZH-Q;UB`mMiHp%dB`^3MU8Qg&H
z{PZHX4OCAvcYb;y(GHs9;BQ&M1a5sfGw`>}0hNl|VpN<#<}jA1f+(gE<KAEnu=naq
z+CW43y}_Uu6nT*b;vIh-(i<!QmJS2)k2U}JUmEo~tTz}mNGbBd5hUoM!qOWo0aj!P
z;vee`mI3pWLA>LjCT#Q1|0P`RrNVBV=SulrOE&-iUn<u8?|-S_YwiqlP$uo4&QQ+~
zXZX$Vf3}MX4^J<TM(2qa53l|Qb?jI`t*UMp6&Xtx6&BDCt+b1ZO)<z-GN7E<?E)TS
z=IA`};uu7OOlOFS0yMmsN<fRra`?A1gJ<SnOlSpX6r0uqrADBD`|$t6e~3)|`WA5D
zL3o)^b^P0z4NpRZ`db(nx?@yqnjiCfm#*%1RcL;p(EQ^;33qda1VhQJZU=?eZ$VRq
zproq8SSkiiC;U?n7@h=$Gz0&XgNg@VbAov)3?(MbwxAN4fq&{DkTes2{geYOhf3sH
zZ<k0d1XTdt;0l0$%?0j*ued=Tg$4tQrHcwEd=;c!R5<u29ccc@*m9yoytzh2g`or#
zDlDM!TyS0wQBklgfhd;zQEUoosQou-g>-2$azWt^S})mrL;&Q1dWI6K&JUfxAhU?f
zE-Ea-Au1fN#XzM4$V9lfj4&v8OH^14|9`(HU8BMQT8q;isuB!q=z-|)Fi_#*qT=(S
z4ctir=VMn^28Qkcng1qJA#Uhq;NRvT8IZ9E<dpCUQ$Z!V$bT0VP)R7mz@Wfjc)Jr6
z;58~d%>1nkfB*k~Y4_*<|BSOB^@&p%K(i1mFRonv|37l)e|w}7rdYk3_kasOL$~Y^
zm&y0ON-|EI{Nt-?{YQ|#uTwzlFET(&kN$(JtpBE<3M_-Oke}hj4Nxcchz2xnN?Z)z
zcIK$~bmpi;bhD^5AK>W?QE_<@e)<1@FjoRpJ-+aOa9^}s1`P|h9w;%&a4F<xc&(P9
z3Zmpe)ltUf|NmR-50q{&{NHJN!G)ip)AouBKf}vjCI*HV4E^A?o6C#qm%s@goPK*<
zR03Wcg9v~oOEh{xh2ngOfKF$KiUC+fA4I^UGepJ0@RH%l9jPF1oVgF4SiZav)Eej(
z1vL(wI$i2jcq~tJUXZ*|%+?7S?gy2#ph*Xp&JY!kZdq`mGX*s<I%8BsI!ja}nrl=f
z7)rUDL8Uc+3lk#)LpLZn)u<>m9{d0QzkTy{hQ?<M3=9XleN<GsV^lO64}yg+gO)Bb
zFdSe!CwRZJM1=)3Bh_r1P!DdJn1JSMx?@x%_}AQIKKPos^IYfs=41bxum5K*QDG6T
zQQ`Q0v-vW^_uGme6@Pd7sIYX#sBnO$9=dB(B(zIZSU^b*l$0%xb^egNP|OBufpuQ*
zEKzaktWoiR%_)iO1kbmCii{8y4$!1{XAEeNC`1L6M?@@-)|z)Sb_cR_$EfgF-srq6
z9it*p%m<l>u{_rKTk>)dn``qyk=GYtcEW7vc2Uvk4pA{+c2RK=4pH%dWQ@sPKUC@=
zAqmQ#Au0;YE-EI%Au1LSd9VvW>)%{dObjo5zabr>Vxf3K@fIsM#4a(Yg2J)WMJ1p!
zL?xut6p=<S!j|!%;N`}LVCB3gKuJmVj0-<QaA0^?eMT)P_J2-f05#kqz=bd)Xr?(t
zB?Zj+@&;6=ige4U7=E(`w^8fWI&Xmz=&d*Z|AUHt7L^z0!AuE|=#e-7|GPCG)_8ph
z)~*9LpxQt+$#!R<0RHXH0s+ApGeNdCPh_ZP;NNb%3)Hgg{P4oR0o2*Q(0l~69#g#Y
z#(z=J>O%f)CwAF@#t=TdsH_JKjdb4H@c`5Y<T&^L|4wE`1_p5dvh%}>71#d%|K=>g
zSR%NS2{dMB2hlb08ocH&{148DFO2T}{||PbZg0dNP}5SW^Tvz5GvL__{@{$AAlE&g
z0BU}}u7)-<Z!Ub`GWpd{`TCn6$qf@27$RT024{Q$@fJ-0*8@92YiPiZdBJk+|Nn@n
z?r5IY+a>bB8RA9!3@>V+sz6imyFhMxaqsH?|F4fV9|5;X!OeWo;<(PUohM!hfX1F7
z(*z4Zy(U>u_g(Pb|Np$N#R9^@GweVnYEPKV_&}t70w|Z1#)N~$Um7jqgMH&my&<iU
zd99#2z0|h1T3{zDC`clT_!&BXyf}IS<keDD{%ysqy<s0Zf4nGxs1)w}*m-M59LVta
z|Ns9l1{n?NH-a74{D!CVIB3=+M@0eDj_Ym!P5M~ZGnUGAo_?Y52wW7gfE(NiAUFSG
zWMFs^a2M1(efbzv6oBeOP>YeJ^T+?`pp^*x+uK1#fclh%C!r0^1V}XSHdru}_;wxy
zRV1&U?N|kJ(!b-N!P*@MKx<h)9smEI@%WBSMf~*)FP<F-ts-Za;op9t+j{5!{|pS8
zKP@j73kL;eq=Gbl?E_U5Jci$1OECWG6mEUX-|E1~z|i`wggNa$+dfd!yPMfIf{B5l
zjQz!|hyVY-W_{805Y(q>Jy0sU3+x*eP{G@L=l_3D_4eZQ?f?H@s)CbKy-KHq;ib+1
zmbBJy{4Hl0Kx1qYoh&NHnHeM)7$7cp13A!xvH2%so!CB*U%G8nJ}>FCQQ5!<8X{(R
z&0=`K@NI`P%RZ3j4F9)&E0OB_@PZ$qjT@%Jwex-Fj}B+nwBycf3@>(UDyrvac=7z$
z|Np%njD`n5HVEw7RK(AKQ2(OCnd6u<Cj)3T4k+=xnB5E-7vbVK?kvQ>0$O$9EC$XO
z$H1$*SUV3pzvcoh%yM94=#2oa4FxTh@loOUyaep`i?{y&-vJ7<*TQL*t_-sL&D;L{
z|DV?B%J6b6c)XMc)W<p;797?sdt~yOM{?=Uiuf5UKa~18HveQPeVy?d6er%j3=GFv
zkIaGeIU$2AAVYgWQ!f@>3=GlVSX7uwL^J+@RLg=@AAqWk1h<+XD=t8*n{_}bB6-4O
z!^gt)f_MJ^$FWd3X*wT6S~o9vT;vGP4h9BB2E$8fjX(eMm$CA1KWKPqF{la9DSE_(
zpW$$D^BW$}=qPB~9<+wP#N;@OO2Z^RhRzrj7RFnkwpFi>iUO#=)A``V1W;2CRCP>u
z7h~j|eBrU6glq{vLk4I@us23UAo#@$(4^>%7rU=d{`uHM{&?r*&a<7z4*p|ne#YGV
zz`m13rJLoe188za<g1J8WX~ru^`Hr{)&u;l4?rV);67#Z|N2sP!vilbGcYiOXXwK%
za8Z#6c<~V&_5z0gJAd`MsPMdaatxGPS`U<zb_;iRfbv;)i^>uP1_sRwmM4k@cL{(x
z#qpqWMgQji|F8W)K7wV;?)DZ24+aKi=1%5g3=G}Oy&jC6+@P$;zs-x$8k~=d*g(59
z{xkn~W$0$sywKgFvVehs!IH7Kv6Jy-6)0!8sIXWv^SAg;wtp&F5B3`;$Zz}%;Kb8-
zqzAlgB_6!O2~@Tm4$81E;b+L=>a9`X3xB}}nw>rdsts<J3U<qSID>a3NOwC+v>qsB
z>6U)|vH1XN=f}=pFVYW#i?cVN;W$v*1FtmV0qtuD%y0&o$kAKxq9PFRV$a|I|9e4;
zL2kUba2iyxf!eVW3?*E>BB1%ETNlCEp!o<7eBM)_^H{foM)MDWQl$(ZTYiQN&k}xy
z7ouGZ49DHTYXu{sz`l98o{52>^SVQ)n+E?ju7;l?<%0iJdLLNxGwcA>3NPzH?Y4%W
z(flnzpjAmZObiUYL5!UrUZh|A|Gzhau~$UC^TUg%i~s+>oCzAi2FrOP%jJU74~t57
zo<i%}QqV&Amj$4@FSdjqG<(NZ4qDe$%G_Biu`3B8^tlWybhWcq=Jkbouq(Sn*d1Cf
zmHv3iz{J4d-W#IA(fQ-WiBq6fXs-x+=Z6=!E`X;5IC_0p8G<{1b$)p95ab$X#+R~;
z5FIR?KVD1&={VdQrqav8-s_{n@k09C|No#A402nE;;wXv1BxLI5bS1AVXQyQc)zn&
z0n{1mbOkStad=q+GCGJc3*>&kfB*kGyaaXkdxIFW7<WRJ#J(^GrGdlUc?uCAPxm@A
zzH|q98tOw~hy^b|K70&HnGHW1OVY}%8h$dCxHbH2;BWl_Dvg7fIzQCEV7vedXy)EL
zm0lKk!;_t_UZkG|tq6tjBG3N+|5~}>XH$u7uVbwZQ<>b$-7wuRj-3Dhzxe?3%To*t
z42(Bk9tLfTI2+v?&Xfg;!%3jUF9(<+U#<p?fFEaq25jL;M8MWJpa1`#@#qc>P=2eq
z_5XjTn?mb>Qkh*Aw)_k`(m*xkoU5S0WpJYE290dmfTwX@B-S!8bh|0+0;T^K!3RL@
z;MfToFzx*GV(I}%bOm?51V@%RXbkB<r<+1luQStYMQ9QQt!9v9cr6U$f=b!ftUEvr
zg8zORlV85j;fVny?Ho|jmTaG__)-KS&;Szn**4knrL%k7FHjyU5e>^&RKm}&3si4t
z9t!GpVf`QQnkOt{8K^7*35LFS`4gP8I$yj9+z+mmx@}ZC-+f-v`QnAc{>i6bN=yIw
z2{Nmc<(M-obFViWcrO=tP5FyQlNn!0FrJ(&^~zqU6QW9|7nF4&gpZ0qZ-@#HI4!?;
zUNX7*mAsP2Ptf9@<{yk@tc*u{!x%e)1$w;&cL_2;*Q>u!pS<stq$MxJG`2KQrN_|g
zEdpMv4YBnjcpXbANKWJed#|_HE-|?7tCIy@OEd1Atn*ruasFht*U605lUKc#W|W_N
z?6o}O|H;o@E4bhL4)PBuY}R56n+=Gt$@~rrn~QtU!sfu9$-Zx-tZTo+yu-qHbQ4oY
zuwbvZ&@Rx@_Z=WFy@&<d1qwSM_Fiw{U7!{45E<vmOWr8ggH|PVp6&MJX+2rOw`&I|
z2A_gTj>E5QG7f_rat=g*#(4u?toR06P|e1_EtIMGh(ODw63L*9i(nrxGB9W!3JQMF
z_6?LpnvV!{yE1^rsMtHtHXZ|MhHPpI2+z0*&g+^t0)k&ee*6Dln(=V+5s}UpEeA@(
z!4tS3^EB^;1;4QQHeFYgQM|tMbmJ=q1|EikueiHSE_ByiU}^nd%HDhe)aJ?S{Mh`Q
zsq<Nh)~-8Xb6-e;7Bk&0@e9tlSHjQGJ4FRFv!Hn>DB#8IumAsdetB)ue2^tD<0;Hj
zVJ{AU1qX5K?Gj0drd=TSY90z={1EVB*;nvVJAuv*FMi$p|G)7FNDkD%ZF~b_bsmJ+
z`{2bQP{H%y#Z|Z>NP7S@s<-qCv|%W?i^q|lVaIw<<~?@)|Nqx!uoeQSApjcEy#Z?3
z_WG#EfEp2<4_>^gWSH(K#wb}2Zcl@D-d*oJ`@*0JR8aG`^nyA`+x(agKIH5?(aEFo
zB7P6VrfwdUQl4E3pfxC<YW%gk<*^d>&QCAGK~3eirM&#xouwLWm{kJu0!sP$x1Wd3
zO}&`k3hGcrGaY;kS`a9>2b4-nMRxT#)blg!m;hhN^yA$B{|mvp2wRvzy9iZ51JjE^
z0ukVb9B9(0^C)QLmf`KrTb(an1VP<ZqV?kKIgp_xFIvBq2=z{2VEFPMH1;HO4K&$#
zjivLa;iVTs|NsAgeH?C5^BbMc`oo~vPte8;2WXctgRhjIAxp5gL`6I7#fQ)T|95_P
zA$$hhqY!C6A_Cf4_M++B|NpNQn{AhX<|*n0`CBhBFfe>`QDI@^Z#fR?>)m(}a}DGi
z{+1n}CKGQ8NYF=xXYZ$H{0wQGIVxQI+pjjBVqmCe08PIN@NX}WVm#Jp2MV|nCc|&7
z|4T%WJaPTF%XJn|Pm+JTFlbB?G|v0N?H_1TFhqq5WDdgzYf+FT{8JBg*Qf}97L)T&
zIjDH5n?;4&MTLcb%E6XXB?hga5pa<bjo{`7ANaS22{2wz49Ji#<!5-Ys-A%%ty33d
zMA~uIG|*u8hvp+Z%|~>m*GMqR))#^l<<)~`>zElBdRssI`TzfgU?~Gbw<#!kz+G7A
zBt?lvx3h>!eVQ!;bBSnkwG2Zke{U~HJ$S=X{y$hB`1NI&@Q!wn>D>Q7{j(PjcmDrx
z4K|d&IiHaMR3*37*Mrh!DM#Zm(3+;#54+r$I$EFq0r@{pit%&j_k-_QI)5};gMzPA
z`grS`KmY%O>Xw5K1Ug$^{Q3XC^)`R&GEkLtvhx$v@fUyp|KEA&;B$e_pUo$k7s6NF
z9m<F=<!9IdTKD=w?9%`LQ7_Mfq6w~V7FZwu_G$tC?cP#5!b|xX(pvwQaCUxB{qUck
zf$>N8UXYEPKf7&Tz*h483fKW^e!n<=5!5393G=HnFhuZgk7i42y<Jko`1wEB%}^gC
zb%S}m9{<yttECu9o73u>tHl^fyy1=zLw1DN4v>p+IRfsnUjYzLIbZz$|8)!hHgEtQ
ze89;H&uNUuUbg=G|Gzi&3n-8DrvHcsmkwc_$6R-O2Sw4Z6QE)MJXXh1#?SCV8q}^h
z-g&k4c1aavNq+04k^=Aw)Ez3W{0uL?L7HQ&2TFN%ZLypFK#Ebl-uM(K-q^Z%RCfIV
zwL#`)F))O6gV*pMe8B~pcIU{D0-64(2Gmy;XnkAC()zz7J+0YJpfqtO1A_oV=P&R=
z(-&nR<3VE+BD=PL`VcPglBD(&sPf8U3JrfT`z+YL&YQbpK-Sgkf$Z!2(fNvh%>|Kz
zuS9|Zf-^!u_7#KeQ$Q3ojc+c1@-^#%x%><)y(KC>y)`N^{4JoS*TNE4eg=o$DJr0N
z4GQn|QHkmN^dd4FJgyrO8NGs|ly5hvu3W)b$^|-Nh+#LQZ<zN^1qM(a0yUa;Xn+D}
z+gVV{Y;l1rKf^AN=!->#3=F{m8S_96dRz_KS>Akt(eP5|O@4!JUXZfpBRt<6Wf@C6
z__s$&?O<Sd!EAWx`)B@rfij&JI}cxe-Eygt?fcEk4>}JAXY2u)GPfGE!X>TQ7PQjR
zp|oBg^Dt<M<*r*GN#%?G|G$`f@BjbsuwEaPfZh-lA4r>KLKXu<d~COiO3e2QD-{G7
z82DSiFfuUg{0FKUjQF?x;NSItgTMI!Xz=1cf6EQftUPE8_djTGqU7ZN|AyZ>w}3;Z
zbBhY7uILs8ZRs^U;OWqL@ZduM%Tq<H$6Q$I*_wZFl)mYP1Y~y)Sm}-ckRb*jLvDA@
zffzCeEYr;kG6WjzlmGvcsz=ob8aR3J=maS44NvZf1Q~M$#Jg>Hva<(b5X1_IL7le_
zKH@h#;Ly8?L4b$B@*~7atc`~l1Q-}V4tv_$oWaDvfa<&#jVJ#9cW(a8QM$6XK1U@a
zw6{bh01<qk7WoUiOi-Zj1}`zFQE_2sU}z|l4n-*9U|?u?A(;uP6=PI<;$jWI_3D`Q
zwt{*?pzQTR{>1<Py{(K)pqW_1lP?5L{QvJ}`Mv&Dw<u`9znd2{U%i8Yi9vwj#n<Ei
z|96Au0lIDPxJ(xLqocU{`2YXA*myu=lsmu?vg$ZANFIYCo%iVE#6KeSZ7{*#Ai<YM
zKzVzy%4~jy7s+LyVZ;NLhl^Pu0?Vry7#eLsa-fw1{O#2&pdph4XMP5i0MDRZpiHm>
z#Cy?`$H1V$TJOxy&}_Q`v}mK$n18!$nlnE`8fcq{TIVf@x|BQycZQY&rDB~ocY!qS
z;3(&3c;WNn|Nq4xZ972w$Y0o<24#-c1EnInOhDNioI&D`{r~?GbaEhgE!hj5yveqI
zrRsYf1orWi^D}@)K0A+pUV7YBg@NJ0zg`!Wn1Egvm56{|AC-{a5S0K(@(xW0t)6bK
zQSo3X6*}&s;=#ZMo(hiv1^H|CZ!RkF0;TNW-Gi?MLF;?`Jo)#YbOZ}re!kFv;laNS
z7L{IKozBys;plo$&=iM&hWx>;`OX_J>T?+wjxjTIe&}#!>|#;raAxZKz`yOli@@!m
zdZ+ap|C9q4AGBWLpL&S%LWeVRw~LBLr!#1dFs9R)qxrB1<3CVM|9VO14b2k=e=ud9
zID6*Ina+F7wxIO@3?)jv#T?*;B%L>2h~!T8`6ny!HHU%W7#pMJje|cxV>AL?E-C^Y
zE-EsUYyU~sAISj?6mT#x2r?db;{nYe^*S<jx~Qo1#tDFH@8%aQoh&M8palR749zG1
zH`}QE;co#oY&v~Z3_!a#7}7vfd1(h<aPYT+R#@?GuTf!v44MCU(US^Z568m~UJ#%G
z87Tkpq7)*m<JDZFq5)bGXi!oF+U?f({KtO=2FvrM0{q({J5qS~7hfm}d(94Y0XUkv
zd{lTYKS<+rQ4xXp^>6m%`2SKdJiUScLE*-F%$W_eEKsMznZ5ZiN9RwFLmgNko_VPP
zT7dv6l_Wu_Ys*2<FqGj*m{D`HK_@oyF);8iK2c<FoEbDc(gg~yi~mg-1*WnyYS(wW
zsHiX=PV0<SO6v>-?doUFW?;~8W$%R)ZQ!x(&JQpCW-%}vZvmGt@xB4^oom2_Rod|u
z70}o+BMVsFi{n`g3>qyeU7+D_@cO(DFScZXhsEppx4VKuzxjXwWbBteAVa&HpP~N6
z#}ZIE@;d&-O3;WisHzj(HNl>rVTTu}E?afz|Nqy{0spsv?Fq|>2YGW}33T6h=l#!1
zdz}S3k9RslT+n&rg$u|H&RpGFR6yGWKs#eTFKIp^(D~xU`h)-f?`Q-Wz;*ys66}~&
z4jRz@wI8&IsP#5~3+Pl&(29oZpaJx5P?6sJQ=Y&51ZeC8QVMt8_&*usVMt}({6n6<
z^*RFsL*pJu$OQYw^SAbabhoI?05ynRRARuhqzU}nTU4e&L_&I7R6w)+0lh6MJ@pI>
z44{k~(;K3a()r<q!IS_0<KjV%2nHDwq7u_wqmsZ-%H8dv5@HJ)Z7&nqRRRhgM^Mp!
zvY3J4r6#BiIR$KCS|`LBaCG!S;_HP;COB3={^8#?MWq!qaPmr^w?$<FsM+^I3?e-h
zGyntD;rjUh|CcAZK{bQ~f9rk*1_sEK#^!Q<2AHXGYrxI_R?wzR(7y5B9&mv7LLAch
z;YHfx|NlV?{rFozJC1jO)?35$F3teEs1;;?vuzJ(PKCcUiW{3XJ61!ivEc^QBy&_i
zvs<0FU<O5JfKnHKs~k52L+4Fst+`_-D2{C({r|rhWb{i$ZU%;oBOtNPA_j&CNXg50
z6x`vd=K&YK3ZTN50~Dfm2mb$md4UVm4QK#2b$DK|XD~1re(Nkz@#!p42?0%RcDks<
zu>PrM0PV~`DSJ~454?~9?KyH$;faq04JfyOqA^A#rZ-yxGD*?-5;ASI;wh-Ys&D?m
zSfWtI!g%zxz;R~@r~KrMwBxQU#SFdKa+?@IEB`>P{ElFj&X=IGVi^n%yeI%`1nE=!
z@1nxe6{5ld8j*n*;mUw8qWLIWM=*5mqVpxVOfWp~!VpD!J*xhFzd$t%cw^W5&r3T0
zb_7FaGm5!7KZ2L*8y<M^@d+qKN+FB<IzPO4l?IvNfQ_9P9(ZvMq69R^BgDW08vrsq
z@M0@Og5{XA2xG6e=q^!E`ZqlAVjf&vlmRv-WO(33J6u@of3LUrE^$x?=fH~sxUl&D
zW3J%UM=T5_%&xE5kGV23G#_R9@1o+<`9kxCrHe{PF=%B~NN0{p%zqOV<a#m%Q~=jA
zyvTb3%Kwqkpx8<P#a4|<OmDpOadt*&2FA{t;Mf8wWq9%PF(}GFAun6T!g%<#z;SnJ
zNN_uYVk};96C-$jt0SDH^CmdDAo>o%^+~&Reu6~S;n)1fnVs^d=dv<N*LTAdl(8}%
zcI*7q5zf|ma~C^kU<?%fFS0S@*?aRjpm7SZ!{aeHR(QZUzw^Zl$5hbCbQ0if2T`F0
zQNeP|T>@k}XqN><g4Ynkc*)M2;05{+1#cfg{S9~CbO$y@(R!cG8=60m!Z-#?7=x;u
z7cW5bmB%BZTL1I6ZU+T1C_@yB9A{=0VPNk32nk}a%3_#RC7>Wa2Fes7kRWyg1#z*|
zCPr`zr6ZW7x89o-63AekR*%2|02=6I?EDBB=LAbA!i+3qWjyBI`Ku$Ct@9%!aKZA7
z81n3$AHlf=Je~03;X{P)A^JIby*YPrGN>>>CLCTIcnGtaleyQM3!G6PdY3(%UeC@b
zVb%jz!Oh(3%>!Or22oK2m*HXR_2%8h3yO5GyCNP=Kg-T2X=V#oA;<vBV-UT{a2X*6
z`1mAPFXzMQG8~L@^*)^+P;x<uN(^{9&r%lDoGWs}$P(bC*Z&?sDxp&4?h=(4@Jd^*
zXaE0$bJZcuPnIFzTm@PQ;i3}b{CZQjDR?Cdc$q7+DX9O_e4T-R%|DU)gYQ90RaiPd
zu!2?q9sI%9c@)D+P($HG&x8N}Az5%bXgDcGCFVG@06&93uQv-Mb%0e#KY#@^3u7-V
z_Q5iYa2cdwZUIo~^5Xe@m?kzh&{$PN<G=s^<r&IZJ3kzJz}4x@o_5@s```bx&TQVa
z<IemH49$lHL0)aHQ3(+!=Q!@75&{|x?u=21G5luvwbw-@q%N*E^#5+qT3^dgrF@{)
zUT^&W#>XH(I{!CO0afUrmUv1cWVCqW{r~^tK^tjRyK7WpK-2!6KVIBKgy=8S5OsS!
z3)zqzpke11x%WYPcv}yYx<I;_2VaSRx~|iuxfqq}ebC+Nq7s9#>bMvq<iQ4izXx?(
zFw%M?=)ggDh)T?HCSiU?;p0v$pgjl&A8@h$|8LLG>BMo|iHAXek>Qw=0E2t;A*>-5
zf~7nFO*Xw~xd-)(H>zh?xEZzVz@8C-1iUDu$prU|5p)T4sV2xXB`Oi1{w6r6Aq(Ky
z?@iC)X0+A?rNM(QL^KbBlp*zvQg(ptUws$SG%1Y%hv5}&Mi)pJqFKv$-|b}pXnGZ#
z9u>G56hMb^fR4j^@gk0a0iM^v-L|uLVCjsD0hFXb35ge$ka!^e0p)IRLc0CmL<R2l
z&Koao*Wda7-#Ip-@i%B}y!27Ctq-VGRAC5mV0Va$Pq&Xs$Z>{x7KZw?;|`$J)d$#|
zIzv=^nt!rFj0U+1)Gq1HQ33giNAoDC$q1S$1XYHh5z_5PJ6%)+(i;CpFqN~vFx&nA
z|7#A=-Z0zU|NnQ^gIeAqyS~`+Gwe_VwY+t={r~@R8z}sbgVu2IZ$JBa$u4=MM&gTD
zM3*4gHy+d%05vV;nU1xnv@<X;uynJifZC&=_VRIXW0N7?#n<y#3%H#apVqks(juM%
zZn=UwA}k=~pr-M$7L|Dn3=AsZ$_&=l%Zvp#8bQt2U7*9#APrcC7l9CQ<o0XBb@0*=
zo)^2efG442cCc3PGrZWg3*6>o0X47vSir5j81SO)2lbuxE-E4=BD?N@{C^AN|Lk-I
zhL@my0iXuo!58ekEJwkGBWU!tlLfSB8LIjbNHycu|NmcpVrF3IW&te_wg4^O=*?i+
z0a_srDjzgKYnefFu_}x&EL~K1`1>}26ubUu{=v-OG68g~bGb06Wg*l2gNeW8CIjf8
z9%fJjoQ1yy)E{|S4N}jd(k;<lYtifezx4-yD`<g1m#d8pV+r3r1y_Cs8>SMjm!Lg>
z`#?jJ4YlSB{H>sYi_RA>L^l2Z-_4`aD|55c8SH-@ka3`u6b!AG_*>+d)fpH%e>VRY
zC}xFhW&iMke+Q^t)Ow(lf7cOEsDy*u)IMF7pHZpabMycIuX#I*L388(8D1V?VqkzM
z0u8Uf+yEL-sx8169}`jOeDUJpGLW&ot`?xp+gFzT|KIwp#G>^;iAlE~OY6xJ-R=m`
z5e91f+gwXJLCd`b7=IK=bembWfg-+$uh;3n4SRh#d#}^~)(a*4yH<dl1{%tKX$_j^
zXR(BK0y?jE9)ooL7$M_p%~QZ#RtC_rFNnlTK9D<OExJo>x?LSWc>}c3<;4pJkfRQi
zsC5Uhv|cKa?`D83zOp=AEDV}?Fg(dv|DAu*LCYUSAP4jB>H#?c)ZKdtI<AEAaxaTf
zcZiC>i-l1P3>wTYSArTmt_5K8T}wJ$RAda%#{4>8yolZa>XAZ2<-k(#0LlUWmN?Mh
z<8A(yFpwDz;E3}EZTI2dR$9^d5#$=i@BB@cpl#l}LE*#S1llszE!173B4fP^EYd6u
z>b{2kZ}`Q|-_8$Vw|?SpWdRu(q9Vh1!SGTiq~F&G38IFd93`r~JYPXmB>ZbHTz>WK
zph5{t=LOJ?0shuApq<&Ew(=2BKhhSoOo*X`r*StZo8Mo`$50}&O9#|HeFmDU6G&lT
zcsUz1pt^lBXbDOfXnARG3pgfTFsFdJbfFcImWN8Kc7WRUFXnFpB@Xa5@ElO69s=d9
z{*C|tzs~4}xUn1LMo`a-tuu@T$yVWAA|P9tL4CN{$>0NI*web3L6)X<x`9^B3v{}1
zbh%b^xbgM6@$dQoTE-+e=l}oL{JX$bodsEyn9RV?{I&tSkQubZGHnC6AYpkCyW#);
z*Mgv2{UT_?|9a4#ERp~J|Nq~Az?Gk2H$MYEL-XSgo&TDjeXzV&Bmq8q<Co^G&Koao
zt^m~vmE6sT1ztY^ZvX+gg=g`JIs6Qua;OayOzo+l*`E^g?g)+6+a(6w#VldL8DgL!
zYhMxr19%t^G*|#~VL}80Ls<Pz(6DRgtrwxU!4t5%%q#doUBeUCL8%C2tRoKtLwB(P
zXqB8KD59%DT_5l`VL*W4N$>)OORN6>j|BBmJH8`Ibx3a(GR6p6lCpNy|NpU3pzYP5
zakB0b6`$@Jm4N#HB`Ogh93Ix|%n^{`0CK8m5@<3*qWM2V8E1G{Mqvd%!)u|=Pu*;`
zWtl}KB_iQr8GRsiZxcc4cwRPv8hU;#y^jAuJtCpN@UV=HAo;Ukd4bod-FX~4ddm12
zn*U0b3v{!rJzxV0vQpL^J@sY$498hi=9cj@c$TssXHl6_#?R0hqQU}dH-(0WW!wN6
z)Cx98qWLcqXpdV7PxD`nQo$WIqWlc6S$90<;%9gfx%vNpaM*R;czF=Cqzkl`x|DyH
z11KqhRxQ2=Nn~Jv4<5RxfYvYx{Nb-}dBO!6dIn|l9SV;83@`4^1y?OHtp`dtK_|p?
zJFvVy+gzg}z`)<KgNuP-2WV^Vi({L?Yj<{njt>Q&Aqts8n!E|LAiUW|g`otrq*HF!
z1ki9qH7L4gt^?0An5Y;Y0Pj0dc^$LM0W`z%A|{N1;W&evqjT_a2Ntk_AS*zL)+r2J
z4Rv~`7~bxT&;YON6xfjfa;Ev*|NnP_)a`O}bPfP1Ua}0l4hyuK3DnhumIMny-2>2A
zs4ZwTybRO`W&yFXT~t^SL2K1TSa-04_iAXo_zZGA=;#KiT`eGYyMa>l<F)_)cju_6
z7#?_e1ynAFsKo4GsN`pOp}HBAA4))5fMVE6SU|1meL0o<3_FuRqgd}hFKMV?W~g8}
z=2{cc<-pQ%pn~&QE2wCRc+KDZpuVFObi_nQeJkk1vxT6Ef=*Zc<F1zf|L^~|5VR`0
zTNJc%AG)*2=$NZBW2dWcXJ}xzDQGcvw=HNfcIU^=-^~aAH(&nW=^NJ>o1}S6@_J`!
zerIj*YnEfK&J3XGi5)^9$1<+||39s>6*Nb7tQF)y@L@iUhw4Mw7#KP)9Q?u4(V7Z!
zH|Utoj@A@L28NCcpc6w+G<38kgUZ_0EReK|ipcR+(88nmV5fM)+nt9jV^mn`40nQ?
zx7YWjxbQQ4UfOvBbk?Wb{Qv(uoY+8P-e4AcM-)d#lt}ZT5a-t?LBSu=U87Pj!g##%
zM;23tMkPP!WJ(^xle?5b4*oa~RC63>;BXG`2elLZgg}Y0`2aKMC_I)9FLtow96FrX
zdW$&0qvuW>%}00)Z-X5q*m>i{=eeNx;h*Xv#p(R|C8)sbm0>%^EYKUm#;ExUbf%r=
zh0gjz2Y>N&1T%LYI{1sFBbW(nYD0%JW3Mv@DAgQyW(jciG}y(n?*IR{pq*c!F?Ue%
z0*@zj`KX9oe$ZW`qN8}cvqnW@pMVQL!%lTjaZsbe0$%tk0tyPzdH+EN*|BuEgC-3`
zUa-#l|G&eXwaZ1NUZlgFx5Hhmw_FOcm{qqDyfUwL8p!b_{JSbZ3DFRg5NF4N$A>f+
zO4*LHxq2DIH@m2?sQ-6S5dm$SP~dOP0-cK8e2|5KA&W7?ypo?GOJOI-sk@9o0lH}J
z|NojVIuGs&4t5FYeDR`s@&EswFY3E%R1A9a8JmxQ&hb*|Y}o^9W`Q$JugTGSphokD
z7Z2A%3gc3-T{$4<fU3b47gzoN-}&w(sKo93^kRMx1H*9#@HEbG2Mv&|-KL<NXL!l-
zT8ZW{m&-Z~$6PM!a&&}T*6Rqltk1vg(2LMH|Nqyw9^jt}+L6}ja@oM?_2u50&pK(x
z*%^6`xic{wcV_`jei)wY^yla;=K-f?@a%vks4BVy-t(sh9-{yqwG;$elkCpJ#C6P_
zpW(Q>0B8+H+HrRg28P~pF>pZaP=HJz6f3|qy{r!e>0)Ez>hNRk^kYdo?#98((0q)`
zvH7P!>4oELENuT7(vG{aFfjJ|v1#7i<rv`U+<D`L<D&ondrKKR=d1w-7X!nEe+OR(
zbc?buT=)lCbpjsWF6HPfQBg6x{W`AK>A&s&2VYss-|YaOt2t>MG(ZLGcO`&A6y&@Y
zO)LNZe|;8wp23TtKyY|6E^2Ey?x4fKaN!?lvADrbkoH|30j?o0_AmVZzt@csG%eIQ
zXA8&~;0a+HP+U(2neU>a(F-c9yg?$3Ad$nM`t%|bG#T-?9Ajdr2W_>9Irt7Vr{#0-
z1!yixr#FoG;3Jmi15DWmG#D>{b}qgE6@s0hl2K$=2*|yl8^c~)Uh)6`%Vto^GepJY
z#lirHi$OJTg(Y|&-LX3NWA5J>j=BE;&2Pzcxc>qPce5PsaQ_KeZS<r5MOFX<!!h^&
z44|VTWL~(<0;PLsl5qe1-$g~H`MALAjh!D3K49tfVKwMw`P}KE;*fTnkx`@9kqJDc
z@<I({h9eWhaYyi>dWQcyD>*tVd5${@Ffed|PS<o4X+Eg2540S?5Y*r?03}fH@DZr9
zrePVQqQl?g1!`S{-1yV&as$-G0dEIv{>@m*+vuXg!ocw1e{+Zm$A3^c(hb|`1KKJZ
zq9Os_o@{st)F1|J3G8+L-{GQSZ3!Mf0v$Lf`Gdb{F{n^*Q4vAfRVTsU+zT4l0S8Km
ziURmJI2RR&#WgA%45gsDg@vKSxz|yn(?!MRzl(|is>k*H!3S+vcQ`UZ{oYv!@;S_v
zosI&Xfg;^LDmI{fIiU4q+Ab<G(jh7epu(*)M5Ug?3A8||Gekwg@EdqM64iq9e#BVN
zd{6`AHfPxOsh2DMfeSpHUYQ@w2bn-SnH(%#R1E43k2(HhJm&ac0~~LiCtlR&`!O&a
zV+74g6iRg#vUL`6br$k<77BsPYd)y)`bf8ripj3vAV*M{brDo4+<38JDYz}`@M1Zr
zd-0;XMn$DJo)Nr-P~*j9kl2kEJs>qPplTZ=4K3F|RY+Q6g^+}1Y1|Ib_MjK_{Hvku
zbg5k~pp*^jd%gI-^#6aulbt<tK-ucG33!6^#W7z{0tcNow*j0Nk2`>F4fwwkWX>*M
zXE*m3#vtcy0c&ywoz%A@29)(|CxaVQJgo;x@*(}N7qdWR=P^*{pnlgJkgXM<#(vk*
z|Nmc~0CmzK3-3EW{Rf}C+5AJLY-6LHOR!5wsSvnrB?37yh;=Jy;G+|2WAks3(k_T`
zZ6M>Um;MJ$3^SB~_Y_uWFqHc5FcoBAcp(e29h8}QcFm~=+1}5@!0<Y7-?=J&hMgc4
zpkqlp4}sfMTmD0~t#-b6al(fIBE1Xbk{2Fx|NrmRnG0^dzj$$KCA377gt%ZH6X-Ak
zP;&#cJn7|zCIA0-zIxH>13IihrPuckbW*mn{`lu5oiBF<f$F3iFTT!!S_fJR@FKzo
zGR+S<HTk%UN&@K6<l`<XsgPrhT~soI6*^;7a=?@LFQk1K7&Kf|Qkrc+{Sk&z)#g+G
z!KPTx0X0cm4^#+)OT#2kl)OIr|3A3j(#U+|0>k8)x8;mL;|wn@E(gszgARtbX#HO*
zvP%clb8`k&zBd;C|NrtfGXuje1uX{9W~jy9lV9F;l)mKwn)7X_HfJcYg;e06MA3QU
zg@*fN*E`Bgb37(z-H~B>>NdIKj$CA%2Ll6Sml<ddvGc}@EpDL28y_N~UW@iRYe1yH
zyR~OSB+^>Hm9l3r_wX~kj!kR)$G})7n*kbD3(Ju1;b(a9Fa**8*)jS59fNusHwFf1
zdr=_63?x4-gn=RUWj<(=!FmZTkX7e8`&l#?7<$`5JLOfuCk(c8XfQBzo;vu5h4E15
zbRG=`hO}lb#@;Dj%mNGyjgP=;rVD6*R=0R|@~CuPJou1>@nE-(ish?fuHG!hw9ZUE
zr`In!8DC9acUO^Vw(I1JceUI(+(Fx4Vdr^+`tP77nHvK`cRR=m!%IN{knjSve>-oy
zxZ#GZ9yH<IdE>=lx5<Y0MU6pQL^^N0Sc;+qG-T9y<HZDsAmo_!T`r&o%Z(S+Zj-z2
zNvp?!tpj=Q;0qpvji4?@=ZzN*ZlJ&uc=>elnR{~Lk`QyC=Z}L^^^F%SZj%}BONzgA
zMRpsg1n9i+;)?5J!}~Jz+fd}7k-rck$Ows08Hl5LK-V{c8YR2rAOeq^85la-Wwb!f
zka#WId{_g;nV?Nqoi|>Dx-u|C$MbJL_FAy>#|x+V;7*R=$xe>u6aS;4>p>^+f|lAg
zzTp71&yNOV1cPG!b07l)c=&5q251@vynb!!V#v%yspPH>8-9izpbkjm5s)@;9-TfP
zl!d|SU!=P;FdSn@<lpYf(CIAF>uk`;qSE>5MacU9{~M~)82DT4K$Rtn%8QVEQ0aE8
z^Lq0m#!~LkjGP{RhL<2o@D}d}Zq1LFJ1;`Y60Rx#|L+1#$bt%%rBlKFc#$^s|Nj*n
zAf0nTIzdA@ogb#JmS>da+~5Q{g-NCJ!}JUCjMDWzV6H~5vmdDH0v}Cmc<DtMSd^zT
zSfKftgW><y|D`;w-%2^sjyp>+FuhiTBr(uPIjBZ_;o$^YIqNKyX3M}-!pXn=K)_4T
zR!~SZfo5O8s+1tA<Uoxw2Jj;KZWk44mKWR*aT$m>XvzVs{EOrCNLfbddJgbjhf1N)
zjCY_IFbM#a3@_C|=X`^LtaTFu<OWoRUgrp~5uLwYEOrE~#IgC}-u&OB^f@SC9!><+
zN6il$Kx0&;oI63Q%s?k&@o)E0kxA?Hmg@Y_{D2882|DtE9aN=tI;(VksBeD2f+8%^
z>8#NWI{goH5Uw*Qh|(H=GBA~h1cqiD1i5gsKPct#yabJPgU)JA>vWa_wZf#*I-O-e
z4C%B^XNAxVp<aH5tbiB6pyiLpL6_cu7zaClb>4W<u=xM~t`HT0=2I*>{M#;p>aG`k
zpcL^Eyd)lcQqYFeply~aA}?kv0}b(j>OqU?1*(jq(>KU5vei$W{QrNqv(5`SP&s`A
zDLwMe0WGzMB~S3`R%jwW7LcLV%g^xQupee3Ph9{{<TF5toR1My5y4D(nGUk$FeH(i
zyD%^ut7k~;ED-5+0H^RzFMdz?|G(GS;Dzr5P)*PbO2CY;1pIFTQUabi36g-LCV>+$
zM_7h)FF(U;@m_Bo!%Luud;{KcQ7IIbkp^<BgdaFLM1wNv52P5JzD=G{fV0IOlGcAf
z(s}}zi=NiKz@ngt1Rd%ENg$v_AF$MJf|lB)?2%HtI4HG;W%PmElIshJ`1K474F8KY
z{uitKFXqVrrL?e&{k@>2Og_G_iVB)5WL})L1Dl4LD`Z}5g9xK$3Yi!4A;Jn_8H|14
z)bkRw`|Eh~5tXnE(LR0#a4ptbq9PLZ!XC7Q>BEa@pe6z&RYm?=@c%z}W(1VF8;^i4
zEC3f#>=Pk@?h2xvbzYpC2|AJvDb4Ji`Tu`#;~NnU28Paq;D$lxgBQl2GQvlN<;9nf
z=@yENhSK#Rph3#gvkl-uvSYjE_VF|Hx~Pc0SZg`GMUhdh-VUOmr`JWrCLjZ}_a#g2
z#a++>>ccO%TEVHf^G4$lkTsAirW)UXPLKl~RNK8q1=REG-J-Grw00~2RMdZXk?P36
zaI6I^lmI&Er$uECNMer46%e&Y1$171XOGGUP$!{9rJe^=W4EZh0o@<dxklv+h(6w;
z@(nbO&Cq(gL?SrDzn`BW3$*kJwBIw}#m0RgR|#~tfQ@QBP$ChK5ss>)52B>EM#W?&
zXx7Q_z~@!RTvUt~be5=O9CuO4Q2_011sz0DU(oBKV%+JXQUYEC(kt^7R2QXn#;6qV
zZ@=An<3$@}j4%bf7wrIOhY84uFP6^u59(d<fQFM_YJ&!rZoK$v2OeCr>~&E|dGR6$
z6!845|3C+H<fx={yE44EV#mM$>UbWuJXR#o>vEI<G$<zl9wOv<ZQ1$a#lq?T|99Sd
zS^oe3|FmwGSdO*_{M!$7-aPn_<?@4>uw(9=n}4&EJ^&SWtp`e^n~!o>=BP;Ux6ET@
zU@*K5Uh>4!S)#)6dhZL3MgRYI9PaJ`2mNst(6Yn-ttUZCv|GRd-FbXh{T<M*p%xX;
zKEM}spd%<sR9M0@68ph>i9nk>z<Y@t_Wu9h+oHk)Y9CHo2yWzqcAX&N!0LaA3Jd@C
zDPV(w0y6UYVF`Z<SXa=Czo7kGQ&a>%rNV_5z7Rts>YI;9wA?Py0=4xkRUn2yTmxEZ
z_XM=iE~B@fpW#J<CnzHeyw-$N^`OKCS*reb7N{-<M^6l>6zl_yz;aFpM-S*U_Wv*Q
zL9>Qiz&`HY15Rn(E#UOm2|9xe>IYEQ5E@duK!$hTc(Krqf#Dc)0{?c#PG^x$Zyiv-
zveVfBlu<jKJvysh(mIPl2b{B{bvpaCo-7dwge6sHlYkfedmzcw*`W16i3mK2f~3Ce
zhDdqqv`*JjW#lnLj)bpAK&##{Vqn*9L<}6BKRsQQQLVn>#SL2q(01z@*qke9ht!M1
zw%{BHVhbH>Q32gRta1!85u?xx3EWN>m5SaL6_Aon$ZF8zEh?a~eMSZqQ29{tf-L}?
zm_f5wt$&#ychQ2jmw}q(y)G(RFV;5HgDX3&7e^ZY|L-kP3El}>aRJ?d*7@N@Zv%Lf
z(lU^2jfyOIF=Fo&6;KJ+`Qt@CNcP8zj)wpLyC7}?ZJ(3x@KF)ynxX<a`}n{scK&Ur
zIzm)L0-GPm2ZV?9x~NzMWLyWOtjC}vQLpLFz|a+<V$cyR(R@Uvp+-f3mA@6V))3q#
z;yCUM&Ys7e1wgqJtltQ#Uv2`pq`nSXTz;(ih{QMWW(vj<_0AhF>_BI0A8$QSA{7vp
zVF^*V4y>^A$BTQD!BMyHg9|@HJvh-ace1F2b>0NcR_p*T<I$P*|9|95(9Q#pix~J@
z4}!*&T~sPweD?#D2_-@S8IBY98D3<&f$Padj0_AY@yBKZk3Us-yt$|-p+{Ohcq$(f
zYaEbR3jy1}-|7!)v%09Ly>PYyS7lQC+b@7yf)YWH0E_`S;5BF&-VvUciV)RGFGQ_C
z=T#a0Z$8G@e4U}Qn5VN^z##ytr5dDV2dHHa+8Dd*8R%REP?WrAuLFk(XnJuOXh_UO
z#To3M7xvbm5l0sl=O~V2E-J1ppf%K94AO8v?SUk~8kGw4L?{jMPMa?%z)FKbD_}uO
zj1E2$;NJ#WrF-xJhcM>_{%u=SKsQrx9xKu3-`1ltYdW_kqi(${Xhtj?M8G0^DkL5c
z9|8@vcl)SFbl!OJeFn(g60dnWZ@hRs@&EsqEx-T&2OU_=*c_t5!|*cp7q}1sC!%gp
znZ6HH7rUtNv>vErGCa_D1XK}%Dr<0qEx7Y=K*n-V80FWyK-ZpfK*m4~r~m&CT3A{t
zva0}8M1d;1NRY;tGLt}C2|91RIMxLkqJAOS_Wyt9_2%b{CHjU3pdE_N7cY*t{r?YM
z+}8QxMREsNrD_MHF&3Nw>P@_s=zIt{QToM;ZEx%U|8G4|$se3?6yzLG-zy^OwIO)*
zT<41y${qjz8~!)^20DV51#~u?;ei)VzJm@6af^%qb-WoEN*}lWFO}|m@xm5j+3^YB
z#t8V#?3cSH{Qr;Gj1=5?EFj|@$et=^2GDtSH7XqS5O3Q|gG@t~itO^R;b+(ZT9*Rx
zwmPWgf4KA03sCE)q1ue0BoK5hQ|tf#omZQmGL~|LfqPf4jSzuw<HeCyXq&Y2#*2jZ
z|NlF0yijWY|9?NIpS6OcR3r=>5-+|uG1N0eM7<8)56X?OV7c*P5%{){N{+A$j*0vX
zuWxkzYCgrnzYTO-nQ;66|Auc3|A&L>pU#`$le({fHufHMkBop^j9L1)^=+wi=ZzP-
z5SzF6BZbJSe&i5od{Yl<>KGpA=4oXComU|UzCqNB#i98JYw4?<36uC38ecx><YU+c
zB6c)<=VN$b&<h&6*(Jch#{j9;gr@%gzYx@y?PO6gJOC<bN<c@BbX#=VsJ#BLc*<OU
zhFzd(Y|vg|euf<k4Ezi))|oRf>^$JgU(e8aXa{I*$&0g7{{MgRv*!Q*7m-^)iK3Lp
z@W8I%|NIOu-!Ov?Mm0PMKG}1J)Fgg}7ktzH|IcDHJh_Xhfq`KMc=qA<)c^mpm<&&X
zTc|t08**Mu{r?}_B?Yf~gq)aV2O2RkJPA=?&<m;<WR8MbaKQ+bJHUhUtEc||-|G!J
z9xvqJ1Lgp*89TrO`4d6rg2xO%n{0YrRD52T+kxtQ5%B$WhTlLtGAt~Q)dqqSI;g$+
z;)5+{y%tkghVCSO=usjyDhc8BFM_v#HrKhR_yly`+yyeP^T!LrsSvS%7m0SD@gWzL
z0LH^^%|}FDFWU*Wm$3nSXqd%|1GWqd`#?g5w;`4u=I;enmEiTMV2dkk!Dj&4frs+#
zOEvhnhp0FN1!O>uGy#ot_tvPSgughm`Tzf3KQ@pl0nIPiUMmI%WLP1&H6{GTO0W`U
zs1oLYT_9(4{&>+m1zb9T#BG{iu)SDo3vsj!<1uIOO*W7&5NJg(*hxIL;I&aUFHB6_
zz*V=6;ce>}6`NuM@T4_p&i2J&8?c&?7lJ0>lPM$GKJjnA6kvF=*F`1ah0qkxYPQ#>
zcKCo&gH8AJTs=ndIF}cTY{1hfE(|56U?W|M{lNVVu#xdL44}!(l>a3vVBGDZlF%KZ
zlJX*H0%$kd5uVp)A(bmji3IXNyube&UV4$$H~o<wqh>v5C2A-5Otmb=pa8=I;G=+F
z{O$k$|G#OAD?h`3@LJW3P>{QxgA;`WWN}z>7bsPiNTnTT1sz($z?K2pFqKgTQn=5K
zfgvs)ROf`idU&9<U|?6T0o6>P^_L9%ExZ2I|Np<E52QsDY#e{<ia-DV@0bS?VTOuK
z1BrmNzu*LwU7!JNo?Qu`?f@uZyjD2Q@PnCwVFzf0@5OUahZ?dn&j+NU7Stl;==uNu
zWx${R|964aTr~y_4?`}**kuH^T)6!I|Ks5OrXYKcgU%CW2%F2t(77439%dopnhbu1
zmmJfr4H#u)Z`}ZG+ZISW?!d(Gq4@wy^ACs8_d5=N8WfLjOfNBDbYad>;n=>-fKiB%
ziN$F8DMLnirpJcUUmG$?F^Tj}XE$P0Vsx3VWyB~a2HXC7oE5Y+7qk)hIO_+O>2XGk
zD)k_d*L<C#pjOXowoXxyTBqh;8Kq};CA<Qyso1dz6j)mA|Nk#;n9I*#cxlH`kif(~
zNZXvhWfKEvXCCNo1<-s{=Rw17J3x#s!In!Ud=0<2O4%I19Wck&Z#qA=oGf8o3{txg
zL>zoj&-7wh@BjacL6<VL9w?RHB>)OmZcu0BDyV|G@j@O{ryT(6dF`EX9%T0uD+Y!L
z!*2^gntE+Ebjo)zw;U+px8dq_X5??N5N2TLJpB5#;q7kr7k7&P|L<gX3kb`&1Jb$5
z3RLXywB9Z~WO!-ElS!ccMkhh#Gk8)FbjihW)&-y~_Mi?e5k3K_1z%8c@Bzz<dp-aE
zF9uyv0XnpK*B{WDmC2y=!3*(7IH)Q*uo$G}C1`<M#-~aA4C*f=!JhfwZ3@!K_^(qA
z#WTr55YJ4PH(^w&e_s0ke{UGai~C@j=f(BX|NsA&@%%62_+Q5I-z<Y^GC#wMHI@tv
z&Bp~mCkNav?K#fMvVxz%?E^ogA-aQM1wX?J9evQANv;+A3_Cu)=4VJ-ynQY|L)vlH
zouK`bAHXfV9UJEIGrV91E8I4hpJ7MsHGUO_w8gq0O_kR`nhaO)GwcGbP2HgYGW3QX
z$WV>xPfQri>o0X&c*gte)`kPmu60~^cI6oBoVolAjNpXvqSu&#0bC3ip4=e<a&b$`
z|No0tx`K9W@(QppFfhIF+w=cFZ2xeH;)bqg1y2fF4)Aw6f)d7ST?U41S<u}t{EUZR
zf)0%Vca1|pXFdk>#;7<1_nP{sIP`|7*ccvoF-@I;AwHtHM#Y4oL<&?w1O)d&Wg*Tf
zRR?X%{N|z(GX1P6qh)>OshRW47<Pk*?~fTzfj6r+Ut)lsE!qXXG{*3DZzbct|Ns9p
zSRUI4stqNt6$>>VV1%e+y!fi~=Vr#&w_9$Puyuenux<zKrrN;`s!hLtM7@ay^&*;j
z$W1f~pnz#G2X`Y*|NH;{#St9_2F)9-2kQA>oHb@(fQ3oLvkeWP(CIk1p$SYM-p~T3
z4;^>~Y6E3o;%a`t&v+sGfKA6OgwSJt##<1<QwYI_{EVj<r}LRJ+SKcStUqmrh$vT(
zKuOd8|BEMp+9#kKZg_G>EJ!pCB-#TK1y`&mca(rcJwT$M<0@cL-3<~o0*Q8jl2)rK
z14A$P)QlaVBT-%m>Ofa^fzHFO2cMky1T>&<<Hg-VP)$(E0X>cI$*u*H`5AVA7Ms0T
zqYUmvXzp487n%tX5<AW+vw|Nq8pv>rRcHl21LMm&P~o`|uCM^2P<+>RxKJ!uh`%Ko
zbk)zUJ#cY1uz0EFu7hwPV~7xjH5@NNz2IFZ;R?AR3N?4#fD3(B0=pWj7u1$L#wq}E
z?90cXp)+TJw0c`MLH<_I?g)rCK*7Ds%$R{;2ODVa^8z?TO6=0Q8D4y=|Nnon1Sl&q
z2{JJ3P!eEZc(I}I|NrJw|631~2!rk@2hBshxTDO#(ENbCH-N2ERAdD|!|Uo@oF*^>
z>kC2S^{od=)Imlru7{Zkx?%uasm+JzZa%=g7_8Yo<31=l*P4LJevs{;j^lAwkQ}Ir
zi+e4XX4}?KDgkjmC|y8ef#Ddd;0k^Q&@sUvKXu-Cu^zN^IW<FI3O~b(I1^|ZsE3{G
z;hWZ2Ez-bTYTJ3^g&U|Nb*%M3i9v9N8A!Q-38>w~yb~0H;Hmf*lPW<CL1D<m#D^F0
zn?OfVzJ{fob%rOwiE&2|NcY=K;L|@2=YcLN1RW^?N`|1b;9KVMgPM6fkcDU93cRr%
zRNJM2R-S-n>_DT?8POm^))|AGzzd#?JI}ve6m<D`=e5oY2OkJ<o&e2u2sEB#U|{&r
ze1yaDM2RN<_TvFT8D$`yCB~rcyRFL#P(5$zwt}DG80)g{d<>vPOt0mnGuD6<1%MUl
zf)yQS1u0_q5W6FK`UNXSwbUyh6?~w=6nc?l#EZ?KdC%i6DkaPepw>|h1JkbNm!Qig
zFTHRuVqkdTqR+sP0Xk+e;~PkGpBd;l70{+k&@DjUO8C0#1e)ta7)n{Y^LSnhciT>I
zogQb+D8{rQe|niUqmrZxxMga1;PdKUXAbai9r%o2`|Rl(tr?>|RQR_!gBF}=@NaYG
z1g$gU-{#EK>7ru5zs;GugpGe&9Q$j&ZduUDnyt4>qWQN)vo-%_s+TVf0NpCjzb%df
zB0W9ChS7)@bT9{KRcpfk5|xbUlWiE4w0-`UsQ7@y!3|PS!!(0uDnG-EKPI4h-Q_iV
z=gpUs{{8>I<H7Rj4{R6}>bW{W2^+j(6nfmLPg-NOz!#}fo3w6cp)^}YffBYfTPJ~1
zoz4#}2TG(sGqmeK<xM4ja7H}H?2`tdtA$?kbl%#rnVp~E#rh`rc{1x?tOC{T$8efo
zpJwX;wtxlM0#~>NlRy?^8h}c9umy%<{0uMrkt{I0v;)-od~vrFlmPj+UD)vhv?}6U
zDd=n}{%x0cfDYDpu^+(&$!>sfw;v9u&o~CMfy01-VW9vE14F};j|U%fa^6T=4C1}`
zSN;G0i<k}n|AVuI;YmnmaY{90OoP8=E$F_JA55j13&EGp9Vk&~wqPig&bSLQbTcR|
z@l4}qc#&odIxhAlsL(V#@WQ+X9DH95FYVx~2TAX30=XS#g$hW>s2UV4J1$KGpKHj}
zc>^*(@j}*^fuZxpi^iJ&|92hX1UEm;K<b%54!vIu*(FrLeDDW{<uU$N(CT@^122wO
zLoCej1S!1*O6O|T|Nn#BJe|>=QKWvSFJ$a0<i*$Y|NjH{_q8iH^D_iw#Dmn&F=AkF
z?~WE|ek}mHAL*Fk0YCn!2Ru~oure^bFjWOLzaW7e1ak91ThQ|TQu&2BEDQ{+8yF-Q
zG;iz!QHGbke{1{|&cMS^#`gML>w$_>{M#-b{K?^2%2S^K4kZ&K28P#xAXhQ;7JM)~
z(ERU1$+G4jN+k>V_jQ0AWO=HD)1kXep!uD^>qo8MN;)C>{unYa^!f>Oo_KL14K%#d
zS;w&p6dj!>UR+E2|3B`9PSyYakUPpQf`(ZRwH~Mt$^hM2W_WT3Xf7t}#ni_C|D$0x
zH~;&<-y#hfIA;TIb^#3+)boS(y680jU@ED6`Iec1!4}j)<!^n&3@YBjSopWQu^oKC
zVtDcemk|TQ%MGB-Dt;`x6jt&x>_`AL{+g=)|8KBWm|o|=Xjxwel8$5H-^N<X0-70C
zkpM3$ySWR*-LU|qUcMSM50cH4*7)~7L%DETw=-LB!2b;_Y0bav_}jo|3|cFcs(`Mn
zJaO;^Q}Y4K<`dv{4*#|T%@3IwPhS4f{DAr8EO31(13D&xBdyz64#eQ8?{-!IF$B_@
zLF>=>ryKw=co_Jn9OAqHVhVtm92ZLCKs|5{(4i7Moi!>V-=Bk+0-YE6*Ps9Xobgn5
zwSc8FkL2|tv$RIgwGb@jq9ENI0_D6QTEL!v`hklNUQ2;Z0d1t<Uw@+UCnG~W69fO8
z0}ij5HZXQLOLkYwq;=M)2&8pa%Yhgi-PH;pTBO^Xr#o1{hMB(wbP$0J3x5mfXj2=;
z5_ucYS~HIB92J3GzbEoD@VA1tH0}C2k)PouXgY2O1Iup)%M+m10fXcP{-#x+DS3NP
zkL85nrSISO)`M1tH~#$pyN;n;XD?{+7l>oeP%gh0R8KYj{9moWP%g9=G%4En^Z#xE
zhBDT@3gAs4e?bQ9Vwl9wupeaL>s+u$1^8PZf)j#^3P+ml|Mz9AJO00CU^w`IWj}Zd
z4rD2a@$xV;14G)y`WF|UrZxYqFV{)4Wnd|P|5~NnnI)~enr#=$Bz}h1QV8>RFt9K%
z>;*aZHRwia5m2o0fHakX59Q!tU<m}(nEcz127m%tA|MDvX@EHpQY9cbBOR2DUu%J?
z(`-=4)ti8>w@T}*W@|p8(Ojb<!^qzcTEhiPAROJ^GTqS%pqW4c{_V1SEDQ_>AG7dp
z3sI3c_=u&~Mc5WJW5jql?YOfOs2lQ=Q}R;tqaV$$EINW+L6dW7oz9-1MFMG^&bFPe
zI)d#%o0z@REMM|Zby1N>v$CvF5#XPCh$}=zqLe+&(nW=%L>;Qnt;5>`yw2O%@tCv2
z0&rIgH2L)6f;<C*hV%5h&WvXD;@y5MyH>dJGwgT($}1<!|Nrj}W9eplA(Qt1f47^!
z%bUMJTc9D`7Y<ONa0ztICBut9si0g4(#cR#-fZi$f}eq*6gsWOz`+0=fAj#Cm!&+r
zet`PgpaaNX%Pt0~-2qw@^ui<_T!5Df?z#h#F9mgB&CCD)f33FI1Juj}D`JudEv<1#
zJMJLGz;xUJJdl3e0X!RHc(Rih)OqaW1@$Ul*hqkiQ1BUhowqa(y*ME^{eugmEyuOW
z|Npy96<nvAx-zON#>j#9Nc=D0`Cq^h{2zQ8TgD<##P(}2Ff3GYonGzAsAU{i`Tu`#
z#z~NPum-5g7kLq%3>r!T-Hn{_0wiv&!N9N^beerc6zH6sBhzoVGAh*zO#<y(VJT<t
zwpnXp!_N>N_#b?aiV9CqKv)LDbbf{x&(s+h+?o%IG#^oTz4|z7$4W@=VHfDAWXK?F
zx-6)N3%cU_#Vifbf(+1LFnF-v+Z;Ul2FbJUKp7Qu^#bTHp2II^zWx8d9>P5G=Kp`t
zGN<M@1uwQqGccrei@saV&+x|PWeI26aaIr;)Il^n@Z!5DsNnt3>-Imb`Nv=Wb_pg1
z2Jqmh;ei*o!E!gi+mH+oyf`BYx@l*Z9s_8T)r)<ipvxN>1o>N^GBPlvHU9r1#ou}h
zbntF7FX&V;#<a%Y=0YWWX^p=RXqJj(I86s_zsb-5hkzObL&R(T;INEH5cj$oD1>=>
zV^m~<drMSgK>K55dO>S!54?CRI^E2jQNA8@8z*>MO^IwUTpp4zmy0qmfL5(GKX-_X
z3+~NPkqHGI2MIC&RCG1GXagxIQIUv<YWxQ}!m3O)7@-2R;OIpPNQH}v%E1@1%?}tC
zRk-pq#6~OtQJ~vRSAdQyX*p0L(D)B@+Euw+%K`q@=d272;NhkniqrWSz{g?jQU&?3
zIJnnEMFzAL9PEc3;PbFpKtZ`JMnxhruKBk{xx=oe>EJ~a1}|KM!F@Eo=HDv(Et6Oo
z7@B{pzZTuq50h6B1_{+`fS2!c8h+aWwuB2|^)8V8J3&P2|5C-*Qec^u0}y9{N?WkA
zN|-ti?F4BJ2o4JDby0B$$Oy6LXULcXiU506Pz1<;+QuESpbM}J-+~4k91KCX=?Q?m
zBOB0Lqap)33=Zt6&JQn4M8GLgB09?Q!}Mn!j0*KJDh9y;VHwv!CSFltVA%D0IzOn9
z<s}3%9dvOjSEniHa5+$g13BUJbxX4?NQ9vzDuZ<fKf{YTDhv#e^uq!^hpzd6K$PXt
zA{%hpfLs4!t}uASSRz9dq$ynm<dk|9h2|pyu)&;Cu3aV|xp$TS|Gzi@-X6l=vKVyC
z8>rg|zH_Ye#|sNZkWLke7YU%k!v(ae+qy(WqSy&G-fi&Wy#jRNdKYL&yVpg<;>E2P
zP&=@M+3oeE?hqA|&TDB0k8yO@yQmnvkOY}?Fb#BVa)vd?{<F%U`~0*)BLV`fpd%mC
z-tPk~u<Ha>q2EB4og2Qj1}(m5&IPFfNrA%qMWq7RWjdhdl2h{!CjM5?-4a<$|4USK
zKp3<kr#nPN=S5D*|Ns9>R80QYg9s?jNCVj&1nNs4Q2^KFS&SfEAPm=O4ATkK1TrOK
z7D%I{GWbpro9-GFhvp*+&Houdr$u##sA!a1Lyng-yxr-e!U5jy__6ah<3Yj8onAaD
zpi|qsWmGI>LEG>_S9nOrsIV04GJaSL5_qiwzHQ@J=XHNeR?u+$LeRLp<d0&WPVm@#
zC-@u**O%}AO*iyrbn*k~$zn9T1RBjZy!67e7*zg(1T#*89BHWpN>(C}2>}Kc(EQaO
z(1d_*;s5_x|3TOFF|dLJxfl#Dy|5^pe$bmyxL&#N|9|jZBp#q%WAhOe!*7PSA+5I#
zP=`C)M}<SAyAf2ZcTWUgbAP<^D)Ub8HTNsQ*WBBvbmpkA>;)Ch-8L$ge?eD6GDzpB
zuoR~^@B9E7d@KzGO#m~L`*j}b{MmZD)TS4-EB=4;gAbOB$EOGRFdEfMfDTAh28F+m
z3dhU9|NsB*WMJTA*u_x5zyQ8V`~_Rd|NpJGOB8!~j5}{Zb_;$64Kd#^yp+Xc_&+@C
z1!ECta))Oxcn0q+XhslnV)ZM?0g^L{K%Jr11Eq>EVbB%jFB(C@;649b84p3h7%t7g
z5E`5T(x1UF6Lemx0t3T75V!Mw=gZGaI&bKLIL$`{b{(kZV`%)P(8R}3%-zk!c$1N_
z`4G$Nx8T`G&6~SG5{<vkbb_Ug81FIifu(nWL>hlx0g3Z=b1^m^sIKQ@07<>x=_t<6
z(D)PNgJSMp5st>6AghX5cY(wW5B$FbF3TV#8F-EHq0WOZxBP<DZ5*A4`L{EGCXY=(
z4*w+2zz`de*8Go=zXh~#Fs=C?6MqY6pDpOph}M443WZ{(wC-T8=^TEHyx>Rx2li{O
z{h;;i;7QZgZ>65ikC@Y%e=(H^rZxX!E|E<0D&aId@DjBDy7LG0{^*xqBLDw?@jen1
z#+^T2JOeQfb>6VN%-^gG8ce+K6126ZJDcs`GnUqGbqByh7~c-Dl!)=~IS1ZKb9wp%
zKSt&HPSC-6;OmW#7Jv+EJy05(2AZk`9g)Z1k`6jn`V%BZmp~Qpw}281Bo!E5dT~7;
zoDN>AfmWM;dQk^e)y<<)DhxI_2P(qf0y^lq`S1S{(8`6w5uie>zJ%BEa7lP`g#bed
zb7zJ~=Z)81-QG;iKmYT$yaAnBd#RgcDtHE(q4huszqJEL=~rtHjnWU@4l=J5oSJ{J
zmfm}L_#bFZD$|R8u#u46NUxcjPyB}l)?xnnd<+uv`4~7ca6PKv<9U1xALj8f{GG?g
z(6^Y6;ml$_hBu4(7<iWOG3YPhW4N%LkKy)qK8APO`4~QL=VSP>osS{<5(I}_;$uL@
zFU~{wEEgcO?<GEl3+MS5k}mNvghItaG%oQmq+j4;n0bMZ;WZThy}-v%Jd>ZHd?r6b
z!%TjL)|vbaozo)&7^|k=4`5_fo-~u6VcJZ7hFLTD85Ye1^+!Mh^ANmjCO^aKnfwzO
zCHdDur8dpvXV?K2V%)dgGmuf5u|BCZGbbfJH#sdmzR=i|VFH9-T$ES>V`mhk!r8fr
zDJ2XO3KC0_GvW)9GcyVppz4c3;t+NkSWRMbL1uh$YDsAU!-Vpp+~T76;@kp;v<aDc
zC8;^_ndvDI$?f$)j0YK~=Y%j$)=ZlKffL#q7#M^L85lt8oFIN-U;v3pXhOs$GRjQ<
zFo%(4x<e=<i!!px{F!_xDnYt;&*YoPD2k-PTnJ(eNb<#Wh=v1Dqd{WZ&Y)-zs6W3A
zqDTPAO)xQ-n?M>{c0tt@Fff3wy$88}4%7m{LR2x390<eIU0=Y*AR@rP;07{?1L8o#
zg<!FI2GE&%puP-914s}Q7|7n<2erfi$rrb$^D$%#Fff45G+_7-G0=4(L`(@}36dDd
zJdoK8%n)_fcR&}Uf)s)9L>?}FE-r3v(7nP3XYw-~oyk94F@jNYdP5lFfqKxURM4>;
zjOtDi0nQ8zP7xrH0MOnW22Z~b9|;ao1p%WNJ<zse(1zUTCe>g^$9RtT;7~uVRUGk-
zE<rpD467JK_~Ko?3>X8PUA;h3kfe|{VFJjs3eYtSyOGTYbx;^U=GTKQh;DXbbq;WJ
zTqUr9fq{*~(<MG0WVVN=3$LSdfTw|hfjNT+f4r|_2*VQR0AELt0ulcB;1EX;KR5)+
z2RXnwz|{-H%{aJ)j{)Qg2GAxJP&j}vBZy!CEx`aW9xyOW4-02h69(01pw%s)RVttg
zRmGJbn&t$i?+ItrfTTW!*^ELU7Tfe6;fxN`9U>U{m~OgG4~Ss2=JD=4`1*D0?NZj=
zMp@IRM=;9P_c|Fg|Kcp;>U9clJz2us>txQq??UH|=$F0!K}#w@r^#Oioxb7O{FAMm
z{l7}@g_-;e2Vco_{(J$NrR%(P@RdaKBmT~xogZGT1(n^m4!#nB3Cw{C2*3oop#nTG
zf%+<_2nS3g6Dq(06Nvc#|9|si{?1z<JEG&_U%LNC)Q8tPPj~02D0GFW$aH=L?@v7V
zlBI;%{q+yc-~9Vdb@HgR-mVh{opu7c0BG00|Np%~n=)R%?95S->HOJQ{|Q=TzXTm9
zA8dHCONPTrhO2~!e=ca(ajy%*|JUq}Ew@Xb8y<)T-9>)6+jPcU(76AF)^8=;jQ0*c
z;$ghj$@f|TG&8}`_!x8yHs=k{=|>IVdv4$F`oqJ((0Ss0bR0yxC`9{#)=MQkjJNm?
zKHy<Il-9}hTJ_)qj?P=t9ikXDWRTQwGu{F#>EL>;0#_kAeR>olKU~$x5-!GzAXNvu
z84pj3Vw9GCd${vrH(dTw2{+>@ko=*vZl>uUqZl<s5RTx2N_Bx{q?MR^CxTr3=I}z$
za;a_yp5_+<;IsP=gZkH?^ZKV}M>A^Fi*<^>=I3A3$=)f~=?iKuOLT(nYmWshYknip
zd5xd5^K$d!KcLmvEGnJ1Ufc%Ve&C|Q(d!I4sE`G+>*p9mkf-?>bLXet8WWBeNuUI9
z(Dr{l52!KAz)&u*kHG<aqO;~P7j{O&*GeF&UeKZW2V04F=dpv&_<PqeH1IH3zAS#$
zcnqZW_2pwOA{+wUpceZr&}NHSfB*jn-CPb@a0<FI@d((dFPs1V{~yf1{RZs%rjv~P
z+fRafLY+5Wr2YN>e<x^+Zx?je*iDcC<AIC+c70%AU}FGf66fg?V;Dv2H~s~Uxypi8
z({$c!Ml$8Y3n8#3&{BVpQJo)NwEhK6q@8X&2wD`}e3B8ow59XIi<f`?|KG_8QV2SK
zr1L{`+{-Aa^Z2*(f{aFJ0d;aaZ@kzB(!$8VAjtrAbM#A%zu;WE+hI08L$|HQbh}ta
zB?T819?-H*9#9t@baf;LWEkPmU(g(0qpiyHx>!a<MuzDNVi|Soo1gq>e#6mutn+l2
z1E&pBi6>|r73B7RCrUuKM1f9$U>0lm$x@<RF4*vsu|%oiCsXOOw6`yfK_d%4IZAK6
z?L26ByZI2y+t&tfUz##9FuZxG!^pq@(WO()57MOx(zStqJJV~WhMydz%euJ?Z+APf
z7}j3`-%fvm^VUny&_y@XYi9m!OfNyB?cH{a*ZH^kaqw>oV+UU)@5b`t_V54yA$$)0
z?QSfcKVP_lMNT*TW+`I@&#6JAc|g)HG=Bg8-|(BIq^ew{;Ws0H3uxVQ!*3@3R?sqk
zu)_L70$`QDe*gdfI<4V12Y)N)f0!K*snwtZ`#}o~K^x6_{aL{J4uS1|apD)M+IsMK
zBFIbJEGpa~DlD&cAj%;|C4g*^;NO1WwJ=n;9&Gz=uqO@}UV@(A56)DeIO(oY5rM>u
zr44gQ;=dF8t*;m$LCaJk3yKwif2a9duYty_f4qBn4ots)c??Xay?+Vnyn*5Ys#p-D
zcqLe}gXtxx3aan4dI?$_oYrae60``OS*-IadZ1^*Jqh-7=gSwDe}cSy8sY~?P#^dS
z3Tmbj3s88={ySaj*7<{f+X;vgu<ya+d$Mq|z+#=YKf%JyAOp9bM_0Z2C+Il6_}Ihz
zCk{8;f(8;9N`*G`KPxai@T~ASYsYlG1jdPs_R|j}Fp6X@`vG!Puwe5c9{%mleBkwp
zFD8NnxA%j0yKV!?34r84)ylRX|Nr+oYjk&k<T_6u{4F0G2-X80N`CPeoLfM*x<E%<
z7)mAh4Z$l+rrRbm#)X6hcOK;5-XI3rEql0oBV<SH_l=<KwA~@sSh_cYHkyKJ2^Pi=
z-yC=tOW63gJMg`JpVqxm1T?waS-_XpIT6HkPV1ZrGA251`m01nV->I8|NnO!v=J!h
z-La8@k>T=-?-!aMFdhcy;=>&mz+;`$os$@Y8Fi+gUd1Sr!QXt4V>jrQ^?jhC{I!PT
z>yMo$4nE*e1-0?ObyMf9_nn{8-g<z>K+7b)9b_-%Z9d4+c_QuL3yzY@ubCZRe+FIf
zeFA=E8As=3(52E3I6$Y0H9iAZbH}E0Co@X%-)w&Pr}-dD<3q6E&*{d=jK)5DLDqME
z=zR5lH^>d3J=3?|cb@2c^&V9Jf~^11a-dXn2dIk;z6V0{;JyRZ|NevamP4!L!@->w
z`M2NbyfH0`QLMi66sVWlc<2w$o6b`!1Uhe&a_oE(@c)1G|A)~p+2BnA9?(wI>z$|h
z_ldV$;%|up-8=nDmA@6VZ@;&k@tBJWyMp0K{%vf%0T&v6ah6NBo-AdtF(~28KFQVV
z!+7B}J4lIv;YqjGw+t`Y<dh0^xiQ-0luY+XVdSsRt#`N4<8N8O$iPr9Wuwa9dJQy&
z1-dg8RLc~8{{R0a=m<NT2>uq()n+!y{H<F+8yTuu`1c8el=y*^Y+__!uqozmX#yF;
zX;V-V@e*{DwoPe?kxd1E3uvjz%UV$9-MZycDQoj#me<V9hdEmRS90_3(gn@Sv8cRY
zn|?cmQL-Ln=G#yI|G)HuSko=tP{$Zh8t>LE%)jkg7GyU$D8yfwe*XV|mla4is3o-J
z)Bpcn!UtY4^KZL^P{r|rAEXL2;0>BpdC~Xj|Nm~`=11&?C&B!SAe%sIH+O-qr0-@?
zseh64>Hq&-pq4YpCGnsB|IcCoFJA`Vp3d^(z$ehYjtvY93^ozaE9Q@OgH93Q;NRz>
z!rpSJ#GtpDqdS<T^-_su^GlA<0I)?$pa1_41)I|yq9OvC5qeSf3DWCN@2zGD4FH`-
z)$O8E&++2NCr~Z+I<TRRvAEQ?x0<C}8rs0+XW-u_+;XXe8|1X3AOHV%e*MnvwFX!T
zL`DWAvl=3^3l@vBKmPyU`R_GT=kMM+#+S4If~^G=N{2zW(t%nKJA6P#sulnJ|G)m%
zm)Czg4|YDV1r21Cab;L$@iV-*`v3ob$Z^DX{_`=sxC`3&d$NT67%Pa&c#QSle?A6A
zaFO2pMx*m^=hf~8aM{43(%lT&{0^#D__sHMiUQEQ9T({2#$J}QpuPa;Y(4OqE1*L=
zcslD(9DKmiZKA^Xq1(vtKj^OH&Keb&?kdn##|r%03-~}M%vgq~h?FR&9e3bi1fAw0
z0Xj0T)1b40rMpB$p|gOa`4C4p=tB5SpiNqgM?ob8OSg>*;}4J)W`=HGhE5L9i54u~
zp)8#N9L+~L__urTHP@)vFxHoF9d}W&0rgj2p8zRmVo2-k200uQXKBY<oFzba(}9|Y
zEd1LYm<%s{-wY}c)4E+$xIm{xrggf6vos&k0EaK=uG#CIj~ai04q_?e%7_I8W*4Y|
zczS2vRepvBTW|oD@Ii`x#u8S$osm~Tjd9Zl|M?giUxOC(@0zfZf#Lr{M$o-ChZ}4`
zt0NgonLkfByz~1}&>~yI123ok|NlR@^TBS7>4F)IBK1x0|Nn3Nt+A4yp_DE9<?jFg
z|ASik;3jP6DZ`WeC;3lwf?ATGYnwm3==l!b$;Z-p;YA~e$)eKv;6?d&P>i!OFuVt)
zDDZu3KN!o{Uv&Kc|Nr%yW>9nUaO<TK#b)R!f?VK=<>fR`A8Y#33`UW_&T}w1;e!tZ
znon?b9_;+oc_TXRC1@6I7icIw?S1Ddu*j1C|NjSqRw03o>ahh~cFIs93^oybN_4M_
z3e$^a(>XF3wdy+$wH_!@f*M`Q*?Dl6AS(mIYaVdR$ne0+NB{o+f8$yD=P)Sjk9A(?
zJk?#N13KC*3vxKYYxXQA$eOPoFZe(;VDm8p@R@o=-#|^?>7Z(=yB$>5rFA<nrCA;-
zHGJU<3YLS}tY4P%Prp#iC}OAg{r`XP0?Py7s~2Ct>-_Pe6Qt+^sNTKu9oC(*={yL!
zF0{J>bi|Da_y|FXZpZ1YS&Sx($EI6lF{&6yrnO!w5dkga1RtRUnlJwkngxB$x*IeD
zpJw^FD7_bS3wVeM=oZQ|)4Q`6Eet0A`~Sb8Mn#yR^f)M8GJ;MG3Q<vDV9ZfrNz*P-
z0gZfi#;7o*S>7vNlh#=>{c{$hI$P#JeukGd(-pEAHSBmn-aYQ3qQ<~<%tb|>ufs=0
z?wE^;5IcMo*kn*Q^@zsd!@-@Gn{7c0F&RquVU=@RHlt=exYXeP@&EtffS`;DP}+V7
z*28l+xbtx9$x?Y}G?j22d?e6$vH7ILYr|cCK!a(ZI^?xY=LJ|YIPt;=R4jqkV3cUV
zbP4SQEjs|6J=A&Qg~Xr#pz|KzfOPkOmiBi3uLmEB!x4Qrt<fTMRjE^0aOW}pZ4pd{
zms)O@n1gO}yY=GB7wC$mmIEa!pquuB!!iuB`59hVfL$tJc&XVIv`Q7U%;Pn);eo@Q
z7oy`12Y1Wb%mS@9s^raB2U5-TAGEjUF#q=3;F;CV8!x85{jc?ZS0reovaPvL2`i-6
zb0hj?;Jg3-gPTwMf6)uNdGB!Rfr`k^8`BRaF-lB-m&3?bZ^FO*^uZSbwxHp(Qg*Nj
zuX$`i18Jp_5JOJ9$o}^K|BFMP{{Qa;yW=%~=Z)8MGWLRQ_|5wVc1d_xaPu3`ydKt$
zP~lt9@+Z(3bP4FT7+$7QsSM>}euftY|Fl7ud@0O^Tqhjy@&tHAK8)XO3K}5lwq;>p
zWY}SHZThTSMyvWCvmlC(vobJ0_{ZSN!vJ9kxbZN&xb*J-{}<0eP2TM{tYtywl*o6g
zewoG3aGVvS5mdx~p74QxmoAuB^!fG87k7UC|KAC=sS|9|e^b!GX~7vjAQwi1(gEmh
zH&BNb6cP2H<84}R^S3Mq-PTdf0y-3jzjX$PV+}eehrboHF`_$Ipxapje4(3N>wyxh
zMvDm0=|M)_9xRLpn-8d1o+wu9mT0bEVJMYsy<H;OXbn0=v6MGB14L((7V|T_wrxJZ
z@%ozK?bb^rc8yk`6M9O`x}EA-7%wy*QhCkXe2B&JP_c5iRO{`M&rtoZq5AtkPG9r~
zT(iDrGQ8b+Bl<9?A8vSZR|2Rra^r>itN;IZfsWYiyzxT%)&KvXGH3%#lIs<ynE^Vu
zWJAXCVt$5<)gbeN{($02A2hPTz`(EpROljVY!6V49rWe@|HEOy3qiXrnt%K+<;^%(
zJbhw5qe${&kO2olsWz(H6eQjG;Y9{0K^=B0Q9)jjwiCJ{?IUzW8s7_}AOHWqzVkvG
zME%SVEa7K(Q30CX0$m_yc**d<i)G*c|9^3N;dJf-Mk$fEAo=#+|NrlTt}Nwyp)=jG
zfKioEVS0Q4qlDO-umAt=1eH97mwH`P_+BW3bazhgEnt)rnE<-CjS)rjvg!K^807@p
z&~)vc{;q&ghB0b7cOj#a!SBbQI`Yzs>p%bh|K_5i##q9hv7(fp;k8KXw-Sl8M%#b2
z3=E;GN_aD_fNT(&9$N^Ss5#u7!O|7V(C{m<B&%G#;a6a}gyDgPU;g~<ZlJrY4mA8y
z<ez%rr6stDoluhfQj3X!VFwRr!NIR){uV_h28MDukd8wB77>J0F@Fmi69dD`+n^S!
zQ-KX5f7@Ho$ic6cm!Q^kmjj0lQwg_CJ#%RgcxB^jCeUSrjYmMI@Pe8NFK>ST|G(Q6
zG@r@Q?dk$*EbTIeEJIX%VetO{|1M{a4i^<>8|HF08^&^(*X#{7D$EKceqAmq%t*$}
zdH?@ExN8TV;{N^)TtzT5@lQR_>%ySXVeO(~(e2FhBK<A6zPC#2cIIk(0BVof^KbW+
zdMyId)?F+Bu1P_+RPk^3<~in~qRN=oJ)OIlQCD0H+(83dUdol$T+PEMd7$|K)AX=n
zMhgkh^=yLRwr=$2|NlXyHmGKLv48rqVn%tcsUS<iRp|8d#f+l<WpAN1=$;q#U;h7p
z{SMruKmQg|q`#1U_y2#Fi%K$=i%QbB8<Gc_AMm_ZYxq@AB2gyQa;ZYP;a3r)@$J$4
z;A`^%p6U7}j1n54$;1M#ZU<1yOp1T~F<Ve+R>zxm+!=I?D`+U{wPfdw7m?HRN*I+A
zkG}c;KT{O6H>5+Dfr0S?Xp80BeV_&6FIK$)AGxi0qV+(XK!#QyKf??6@BjZtyab(~
z+*_j}1`g)VA1|J~`Tzfzi;5V-F=q}1!vmenoz(({2Rfa(I&ZuPnEt+mQIv7hbk<Tv
zg?iA$9cXVf=v0S>8Wkn0QX#*v3@4D$hrfYJ>(*~29v}%8{?_3C;HXn(<Ztx=UF`an
zzt!RY|Nj}KAk|Yrb;E<#Ft;0&g5B<-!V<9;)M|Yx2CCRV6L*j%C}@nc@r_J9=zx&p
zhTp7hwt^Olm2kQ>{}U+v*nI9kY!e^Hi}$bp|L?3(;c5Q&pT9+oiGiW@KYxoHXqE8%
ze_(G4Fo6yO1?}%Q1f7~80cx=cF*5YJsK|7JhCy9aI9?e2`~QD8C=fxO6=z~#*bQ2(
z(NJHbBE!Jn$_`qa1U-F3_J!Z$|NnP`b_0Oaz5(?QT~v}m3+liZFCiJv@#4;3$kZx-
z>r_zI0<Y9-od{vdGVr(dLYP*e{H>i3ru8cRR?s$%h8h){4*vSqD$t~^?Vj&^pu+-e
zLG5+BwAKTqtUC^{GccqrKJ%Rqw5{pXchD40TDOmiQ(7nQx$k@o-8m{Qow`Rrta_17
z8<ozV7hiVp9tQDwRGJ?$rgie3_|C@wS`X^fe4P2<f2PhH6%oUeojxiO{M%0)e8|#y
zwlk+*g#&a4rYryU_sxG5>L80KJ3>_0J9$*nI&)NndO?Br19Thc0mx{V=6l8*6_Mr;
z6$yrePq{%m__{(=*t>aDUT<o-RLa}y_F&PW?|cj|LHntjZ9PEi_xM{t3m_VPF_$|Y
zV+Bbvq&0(gNjWyK{bDK+X!te#NjamIhAKq1;U9R>ZCZEZVbJ=o#TP(f(|DATfnm|5
z?|cj$qSNgw7#-?mI6zCb<6}Wr`)XLSo|(hXz~6Tl)bAEK`d|(}189alwqB+A7h{P{
z^Did;R?yg7#$`}i1vQ+(Mc$4E1_p-L`i;LpG=EDosP_H^8UlsX<S#+Tb!6-YX^{ez
zg`zIAz=vW_`tkq2RrKr1ZkeM`=I}FQyaTED`3=15`}Cjx|06*&+5s7CpmQJ|eFJx!
zebc%{L2=2yjrY)W!%9Yp`p#1?Kn3h;MVKj8Amt0cf!0NK-gvS1`~Uy1J6|mMhN!}r
zUR1vL{~wgP)fkv|9efX|Y<R)_b&Y6H&jQ@d&Cs35&+uY4sJq_y8#K1d-zo=cnOb}W
z&C8dFbvvlE9w?c9wvth>-VUTR6{Pg#d(bM$h{yl`zj*ce|Nn(1poZpw3J(752VN|G
z^#A`t3nYOckbnV_z&ntD4w66>=pJWV(3UEO66J+0b3x~9mq@+n`UG}^py5gIxugDI
znHRR-{{LV2VHQ6_Z^Xyu-ych4y1hC0w+Hj^Z*%4g=)Cdb#YfP71^(vO{1LD3znJj}
zIY?rj|NkGB5eo9hypPk@R541`o4i4;+PPk2zy1F|E<U3Wq$cg-|Njd+R{sAV-Fl$J
z2GYM}E>+6t21$B?B$v$PXXrc>nFcyOb_at314G(-(BQ)hpHHA>4`?V9RE)f~dSU(P
z|9{A^8b}Z^tQN6kN6$)rhMj-@^D{KQ1j+5|0iDWt{PPmS1B*fYT|apk7&b7y+rakj
z%$w#1KRb^#pJ00TLK<|<7q~LwXE0)Y&dk8D8?-k9bX94u49AN<)8|w(O4dJm3Mz8I
zy*{X_olsRD84tfW@)TNuv3#EJ`s105gCKwXe)a!<^Bav_3==pQc7O&@UNAgE4#Q7R
z5y|TPKS;7_dk<<gY8*z|Ya{XD|No5ogjxIy8JeJFF`OU%|9_$K@&Er9)hGV{&rkqK
zxPc@-y#N0{BM`)T_Wu9>g`hJ892SGf<|8~WdH?+XpCJNQdjzg_*L%=zCYU<I11}%{
z{{R2QsR#f62V_Ko44e7>|Nj^4lOFv4|DRQ1`>q;BW)>dMe6RxO986o)g6+E-7z-G;
z*S9iGX4+oe#8}0&J->_b3gh&zEsWvYg*q5znd(zZlJ$!#i%U{-b&E?9OHzv&Kq3WY
z1&Mi?$+`vkMI{V=A#RZj&H)An44^4&h5%>35Qbm_gLtsYywco6-Msu1s75e1xu8@x
zH?e>Lv`9jq0qmlnV3z;}&|Ej@h;PPv_*{2=uuDjAD5ye&Po_Ju#xQUM7zD@jRD_ub
zaReB+!dQl3@mxY20fxcxg4|r7lb=An76y(0LsxVG9~1!r%@_ub_+aCBAvPA!f&`BE
zV3T+u4i+vZu6ia0kd!G%3S^pq15b=TGi);7GuSacy2+O-z%?v{BOWx}9_Z>DYG7bs
z$iNZc8XUs?|9^BtfUAEHBZ$Ws-N+5)1cY#iNPy?x3qUdn3)m(nFf3tM$g+fsUxY8n
zB_M>MAiy;sB%yvuf(TD|P(TP{K?X>GBi=bESdf>C%N-OZ42+DG4Ba3hE+$WZUq1+w
z#naz6LPR3o)6WxRN^l5B3TzKZ0u=Y4vr-wmVSx-10kyEe3ktyN2?RV@Vi=+uT%6qN
z;~BY`SU@g!adMAmba8Tb;t<hsaSC;3oRN_*Eg_+#J%KT?fFWs-z|^F~g658dBnFV8
z(xd_|E)YXN2^3h-P12yn58yE3alF9A%n|SC62!m}AL{ACDBvdwUmn5X9ON1-=)}&I
z*TKuc!~;5Jp8>RdgMoq3o$&|H4<1I24qgUE9#E0O@STT&;Rg?#&kJ5B^0{4{fdL{9
zIz##Ye{N8`F)%PNF@R;j;l{wg@ZkUd{h-30fq~(GTqOgCbC8*dpfQ(0mo`E>Xtgn@
z*8n<h4!l4FY7~?LRf3faB92_37+~lEIh`veAlTRl!b}Kog)uV%e2k3>K#3M4T>wh6
zAjyKF5-`&sIG%x#0i<RD&*T8Zuy}?gAjA5dgX+ypxcCBs%}n}1?&A^*aD_3|0({I&
z3P6b+BwYYX<RHm{07IX6kW>rE1dyhLB?$t)9FSOW<?sk_g(OuT#|w<i;0R!dZtw^Q
z@nzs)V7Ty)n}H>|Q2@jj4s-Q$saFUHa*0<EF@q#lkWfMaNGP!?flDA^0nfzA2@I1H
zxc~oO!mxmE;^ahzDTzD`55KZ5VOYY&4@s?pTzqYyMmxiWf1u4Dl?(z7Z14z=ZgOS~
za|bPmfvkjKVu)@CaQ1X&V&GzlZse{9v6(^EDu{5z2OGLDEMWjKjKB=Z_+Vofh6Q|+
zK?-=xq!}2Oa4|1rUcw-tie!OgK!l+&IKlBSGcbb8H#7#B|6jn36-k*V3n)87)Pb@?
zbVGoNLA^5*R|3c-YH@lXV*(6~of#NB^cmQF0$lwV87vr>ogG08W@jf?KSmBW7gs+<
z0Uv4fGD0^f#5o?8{J9w*0VBaB>dsieP{1I-qy$ReMGQp@Ol*}5(M{&wPA*{O^)5V)
z7nqqvIKkl$4^pts1cn3#Mn-qW6owQAMn)wj29Qp5U;j|BPLM`^VRVfgT&zkA0w9H6
zEN(8&1~4bFGr-CtkPi^$Q9ayBX)XzO#!t+jm>F2y8NV}sXJ%kja$wM60o!Wl6A%Ko
zl?84VD2xzh!Hp8&;&o@NV6I^1;81D+>vv^w_V+b}Ifj)HoGuwfB;xBqYm^E=L5$0s
zAIv|P890;#z~;Dt%rQbUhl>g3H&7hmG>7R269b152SX);fF}nmUDO+Zl4EcPBR9i3
zE{^C%fdJ>=5a$4A&rpQ`XHOS}=!RfduXsjoj&-0!!VTg$I~lloDTwfcmU1x`R5E5T
zfCNO$0-XKa7z!8?7U@h);F2#*SRhypGN+O;fdO1+CNM4#0*SaFM7Wsi1-ur3vaW!8
z38VlG2nrGME^ZLwX5s$-pTWn^+l2wbX7us%c4QFZ0f}=l`S^J|!8pu5e%{UuLcA<I
z|Nk>Gfb;~zc_3X*3_^SmIj}xw1ee*T9&7<vD-&3&6I3e`14t`OEfWJ+s|!>s69X5>
zQb(v-X0T3}6PUp|VM>`HIvt@pnISr1wy@NLwYoqJVgYM~sbzs^g*l%Eq7`NhD_AGY
z39Mk9Fr};zoiNw4LUh7xVFT-gIHCUke>SjIm|8Z7R+#hIAX;J8u!FV2oWKs&2~)}r
z(Ft=sJ47eMn*aYfz&c@0-~j7%WDu$c#|#HVE6n*E5Unt4IKf(BPT&M<g(>BP=!ChR
z6QUDl4HsA^%n4jzoiL?bV4d}#^aXYU7ep(}8g8&wm=n0cT46rr25SYSMzBt9h)$R_
zJYbzLC-8uE!UBZ{q7&wN9)@~wLV{Vt3)TvA0xwuAOf4@&E6n-45KCd!@PT#0oWKXx
z2~)}k(Ft=sA4Dg_mU__c0#KHLIe{On6{eOSq7~+Reu!3>H3DEuVNMVL>x3y4farv|
zUI3yKW{V(LCn)~GSx*qG6{c1Yq7~+RL5NnEH9}ymFeeCsb;6ViL3F}gF9gvE@#+8n
z!eE^+CkTUe*2B~aL$t!2FAUKNvql8073KsHuvVB-5r|Hh>qQ_sVb+L(b;6t=3f2iz
zD$2lB4=TxE&KHGfg;^s8)(Ufi7+5PzsTjmknCrzLI$_p`gLT53AP&|EQz{P833Yw_
ze{qObm^Bh$tuQA@fVD!^{+EDgg*jgWq7!C~Bv>cR36fx)Fr|_ZoiNu+LUg(?2-Sn*
zUka=h<^(CQR+w5Th*p^Mr65{i)<}bO!ki!t)(KN84bcg6y);B8%oZ82PEh=Vogf3&
z3R5cs(F$|E3`8r;8d<Pbm=k2dI$=s>Av$5Mmxbtrg{K@?C(H?Q42<=Vx(i&6$U(Hi
zoG%B_3bRHYtQF=2d9bB0rScG+FxSgNbUHCaH>&6}gX&dK%P+vhz?m^1DA0f-ASlof
zL>O@d)CUC`bBG9g1_p;PF5s-@YRF(%!o|6Si(ACZGtfDRlOrG~$Uu;fi@TGJffL-d
zsAT8@iE*(81O<66;GUYn)liTDVlM#+M>qMfgDPrR6NQH#+|*&<hz|$~78K(W?&M?O
zWCo3;axpM4aD)0km7t~Dpk~k#kSjnA6cLPf@eF3D1+lprK%@vixC^ob<R&m*JU%!m
zn6WDZ;*0{2{UC9u^-gHkGvczIp`HQ5dP5}Z4Z+qMqFHY!g57$<=q6u~@14=C=VBto
zej_CNjllLBq1kVQ!+s;E{VwSCGm~P!F_QhpVEc{H>^H_?zj1VvKZ}o_cQCsBED-x)
z$q3Y0s$>8+-Rm70K#7eF9N{9|kXQz#6%jUY3=6pPftrURrl4j0j0Mdd&H?^@84L*p
z;1Lk$7)WA4Mn@tS69brHW++JLNaSK+Sdu6r<s1+kf~0E!Yr+yPeozNWgbTD0fGN6O
ziR(mkLqHI?1-zb1A-a(V%n1kzj&~3c@nQ=I3U+2F0C7_b7?MEETQ}CJ3GE<fKwXo-
zkhp-WI)RIwp(=?nX(3NRb4O}b0v9s_LsCI?5+g(M0;Nfl6O#*)!ER4rSim(onGrOm
zl)$)<qaMuQVlGV(@Z*ek4{!ws9c)*F8G{I0ypMqagNSIntAQZ{($Ea3wJjnL?`mMg
z0Ns2M6zmLEZ4A+50-;PH6x1Yh2+smSSu%)dfXsJ<aGfBOGlX)1P_7WlZMs$yW8ik@
z9!5JBCe_mI?GqTI8F`9yQ<F1_8FCVf(o?6uo5*Oq-Ek7*duI0B)Z*gA^wjAl(-;+}
z8%$$l-5xuQv4UAMH#L``peQvBM5j%daMO*S;e;DM!*(}*hGlO23{&0s8Cu-<8H(Me
zv&~|R<LHXyXHW>>XP90vi%~|&SkFk$P{GK+$k@Q#$U;FQC^bdFBe6umxhTK5Si#U(
z&uIF(S&Y&g2D-+2Y01Wx(=X0q6caYnGuAcGO;0pSO)*O{H!w^yNZkHw7Gn?}x6Vp_
z1`sx9aF`yxlF_-oZY4hh!-W6fp_eq!5m5}F{UK?cAJYy#W9hq?run7sW?JX3w9cDp
zFOG>YFr@8b4C7~bS)dJ8HsP3qEJIpzg37<cpp)MjB6LrzWMDYlaqz|4|NsA|rgcwv
zx150iw2Fqg<HWney&eY5KS0|*Ji<W-uJ(GEv-0md`10Iz<yDM^^;<wo@oyY_A<_JR
zzw^_JrBJR2gbP}|)Oq9J3jqkX9V*KM;esZ?L9!eWE_hqVje{>(AlxXhVlX>8?xhcC
z9TaH&Z0F?_?4>%em8#P(uVNH&0WD_T2U<<KAGDAZ>tfbV?>m3N7PE?j7PIm+ALQWQ
zcGU7l$raFA)-Tg#S2OC>gLl91?*koa$nm1<A80|~$L1qE@HMU?y)`O2FH%7Z&W?dL
z4X1Xo7_=OKEF!g0EfoNX^+tf!kb-6}UrX@sJMdB!H1T(!L^1mS7ymXMm0lN)3(l!s
zJjNY7DjlbKGcR<$Z1~ApcK0=3!>@XS(p$$|R5%O_54^r(c(UPFPN`IHHe+g6h%qCG
z!`*zCDYZ+)cq8L$rq0(5zfvIQm(;s9{L<rZ0WAovmuLX3Wd$7`v;(wU@x`&f|Np<-
z0Gh%36~W)K2sDWHE1AC)wBn~XpM`%P`->$Y6(D}Yue4(RmI%<2Q`3fD1^lfUp!xTF
zmTvnU2B0aHn!o@5?*J|2d{Oilbh{Pg=;R+SrhyFb0b5a8qSNrJqQw3s`08E#mXoEd
z&BsBDQ;&1BzOCfh0a}~-!esh_HH;E$(f|Jcf5|$1-x@|&MIRLb(7LY97cY+e0q?^Q
z@B~eGzkbxsqtf}~#p6HIRn{_^g05QQcv1T2|9}72A3!p%z?0mdLqxl4RCr$drgpg)
zGujlFy7Yov&A*Sm<v<C?3zt9t|GU5b==@q6B+SnEq4RiZ7rQ&?#3}xL2VSUx7DBy)
zgq9@8_81k7*G!%7dz~3OT~st)g1py!L?k*ce)`q5i~^CMbM5%sL06uD_C2^VGBA{z
z+c5IC9ARK!uwmkFeaZwnKEhez-~$2v?ZG0Ppm}iq?b#eJmi_+!zjw!)xeN@==l;J0
zomOqb!QWC3TI$Qm-@1-z`iAw4D${wQ895cwI-Mn6<}ooa*zoeVfF=;jt!%i{y1iNW
zw>t~)x3*7jT*s(s23k#F!^hvUijjfgr6v>TRB&ej0j3u}e*OQS+T8%Msl!>~xU)!r
zv!}vwXO_>`_!(Y)o&I1QqkIsHN{L42r_K{Ex<Gps4z?bsyqMa}Zh4F!yffPkbXy*1
z2F;`M)9X8}Z%br+Uti?kUd_>+E%Bn^*Z=>lAj3OZRGQEIe{Gf4=`HZGWqQzhMkT|e
zCF)>f#bL&t?`Ba+?Pjn%Rx65P>fP4=C9C{jUz)yhJ>y>PNYD}{kirQorWbBt^kNj4
zzGnlYCgX+a&o(f=Vmvtg;zmX{0pp+l|3|!*d$Hg<*n>-^t8ZeglJ7kDWKzeW3$N0e
zA2GI^<ez%b;#3J+TJr~{XOlWEq#d5VU=w2q3uv9?^dFlTO{drWV^re^PYX*6PU}24
z-E1?XoK_T*<?mwVw9Xr8hPN$`l}Mz4mkRbBPUGKxNiDsTtM9PdVi|_bj2$<o*KKB$
zs8?GUz>vnj?MT{Ts4;0f7#@Jmz&X};Ky5+q_cZ=(2huc8s4eRKo@RI{&GJH>c;7L#
z^sYHv6TUMrsHJzz0?}zsub-qvr^Tfm*6S8~x4iXI3FEu8!)cv|^wJi3tN^W)bcdMR
zcR;O6?BaK|1(&|3r}gqoovyHjv7KLU;iu)T2TG;+4fVSCJ}jU9<29qa#EB;kX}dvg
z={u~J)-BfZJ?-EFjx^2_)Aipl%4#20OIzIXJuN!zaC%y=hd~;sVCM%h!$HM8D~M&D
z1}fe6{F{Dy3!{BKXnP(gSPs6BNNaw;pVs*)4ZLC%A|?VC18v)fhzY>O68?iOjJ=U|
z@C6TC3{;Fm)N#PYKnn*UVk~em&}N&o&KtZif#|fjm%`JhZDllMG5quY|Mb&a87J23
zJEn!EK_W6Zt@ChN=e4xX3u!N8KwGUkucmb#N;~*UAk8DalSL&xjelFUNLuHQmID>R
zdR=@9E1_Zhp;Qze#tRNYBJSdY*WzhzX`LU^4!&UNJCN4=j9)Fiiwzv9Ug@3A0_n${
znHWCQr|o#KoPi;|)0yS9uFd^&;j|r~1*V|L;wxoHYktM_S}biBqb?%@$aj(8n2t}2
zeJTAP*+x()q_*JD_cX&FHVq9I86a+CZ}`bn#<Y<sy~9U^IsKTk3`2THu;js4Oli%J
z4x}|dwNK-GRiEAwERo*DqLSX>ESk29!2x2?i(UWz|4;7%>Fe+oNsEBln|3(;n1d`!
zdb5WLBRG|%H&=)-mvKP^3=gCohPgjIjeon7h+29#3j=69M|!gtNC!xF8$>ZA)lcu)
z&ZsZ!nbvvu_2cw3{(X!s2THioUS$2Aer`LXbiGV^TBnbSNO~IRe%SQ1P8*f9&ZB7u
z-wLF6x~K@H@o&G;cT_FC+d3V5K-UgXm#z7~B!AmKrnJrr>1n+|a%r6x(+<95={uO#
z{D@yIz1s?;R3bgCH$VncDy=s_0a=t2q(dk@t+!x$;SNUe`ZAXEw9XP0mbB&rQfZyX
z(hk03={p8WUTW#x3?L^-^&L&yA;kd7o}J9;ptHAF{+DW`HUIoyssxe(-4v~s-s#Mw
zmY&w>%>pJlz$DMhPKGr8?T6AqOTReM__rSivv|@$YhpOk)4r#u@YI9s?7W`FzvMe#
z+QDahX`08<B(JAgo=fZek)9^)qQX)v)OR$^@Br9~v>pHL85mxRfb0dG-w753MT?7y
z1jtHfmcFB4(|N!=4lo<+7-t?(sDcV)uo&2x&LZiclUSrcrbwiNP7IPQ;{^LqgrSrz
z&G5j>8pgC8a!{}L9ZhRK@gHoi6j-ri*`4$T8x_!k-jYjcJMQlL{~u(M99Ytef69UM
zv|g5@ptC5{(mR|L)Y3bG6`>wc0wqsSAg9&u6S~R3V8c`@k+x6#CIbURa|u^^T4Rce
z3Ft6ikdJz+Rnow#<<fS5E)DFt)pz6blD=CYscsh)6R@KUz-Fg)I-5WZ|B$v%6=b$T
z30vAenVSp@AmzQ)8foC&AyAX*p+-UMO;76$wg82vkBU&KJ2c$WI-M;*HaI~7%>l%A
zc1bh*pJsSTExpTyOAZu=jNj9o(wcv1m%iycn%4Ov?fVUouRUMx{D)x-vQ{M|y~?P1
z9beY{OKUzNGyTFY#tDq7(-U_yI!HibFYSe#Is-%6;k01T$|`}hjNs|#cQe{DMo;J6
z!)Plu?Ir_5+KX6FIoo_h0aUD~y>R?CJz)={m$I@Zq-gB9oW{TXc3R_aP^D06m)7|>
zt?~Db?+grOM$@~tF&c3~%ZL9Dr|;jxD4Mw976XG`dKV}&^QH0cJCOF`#Ml4-(;Q#F
zN(0^9&hT>gSBSx&>JyaEMO4x{&!xTC^c{35QhHi9i2oz)|22?@`L`WTdm;M;R1bVe
zi-XuS-Ec3XwCm^3|Nn#hWCJQ2d#<N-K21CLoF$F%PujuvENQ#m@8f59X(IOj+OFUG
z7#Lm_i!m_t-S4}e*7*ih(7!PF4l?ro^uE1}bC@1!PS@GTn9N=m&(DzdV*2!H`xqVS
z!L>mK=)Rk@j0v|G7}7HCfCDT4&;S2v%}01Z*1jkMaXLSwy;u)&P3OV1&a0q`B3LH9
z%ULqL!$pNDy~|k?#9#)A*QhY1f%m@&SROA1Z5!f;h%#HAFJ`g4S}c*ai;)>p2un5}
zk$`wNE%xPyui&DGBmJ0*3eWUC2N<R5)A+ZaP2*pG5L{3Qq!}InGepumLsa-c>C%}g
z?cf6z5Gz<9jqw6lmL)x{*F}XT?ZqWf1;@+42eRrA*drC7C_=I_?JzWs!qPeqr>Av_
zsHD9(_YoZ8;25eekpMMq(spJZ1hrajq(ws<`_lRk*u1~O3=Hs^1C;uj-)MkL>Ix8P
z_;tUWBW>3vCMJg0DzJ(yjepxAwe+rzGv62((sqE>Ew`L35lY*&krTAr=SEud5skFy
zmsh`}d88k6VPRs>EByuv4Edn+jt~{Gv>iVlgX&Qi6{VgNprTl%=Mu<yVE;0uy)c?C
zewb0Ez8sW}z$Sq+MCakOo#6WRAgDlC)W?wC<t%F>!r$V-Se^xHSj#b%8-QBq42<O>
zp!WGb1{)^+mRI1~IQr#2UC^nIpBQXd`CGR$fqWhPvgfZ2FMrE-hH_CGPX3l>3~9R<
z{23W+c=%g-nO@dUVzLncZM{p|#gNU&U?a%iQo;1HmdVDIzeSm`+}y^AzeR|#T*^j_
zzvVoGjU#`{Lk1gB{?=%y;T}4WqRqyczx60%+D=gK{pB7;8xQ`LeT?NIX*=0L{RcPx
z))kBp*JS^*@dP#gZT$FKZZN*A7iLOts1{+U;OIN3w!o3$H5-U7VMy<AmQC*tR%tl^
zYV@9Be9e;9{ODhLXRyl4myBsULDk1=Hi&f)bEiYg*w-H*{GiWiyBIte8D6epOxwi}
z#>nt;A=Cw_W@)<^iWnJQPGC&iRnIt)kpb)i{*Fe*v|Vgd7#UtxFs2`O76@IHe%x7t
z9TZ-3L5cE4+KaQF{{K%u<}7RQG8O8GmzNko*~M8TZ5P7_Mh2Vv{B2f@>0QAx4Zj#m
z+!}r{mDILe;%}V}GUWjSLmwzXO#mgRhF||n`O=ToJIgSp?b>pXk>MpXW15p%dIwk*
z)HnjU`xqm`%hwosTP}gLI?FJm?b>jWk>TY@hBPmj&X!B*{8OD}(snUiXJmM}9$9Y#
z$ljI%F!_g!3@`g*8Tt-xU{qUF!T|CYV|uf<3ggQzXllwf0_9ciw1W=?Kn!P4lRNE&
zIH;K7WzYg;f<v$U({?c!Gl7Hfewh<kKgcAu*KX-u&ePqFF<L0U%=ie26Gw0(z2#Dc
zdBZRM^6WJJZI|>wId^Kp^d-j_L+TS&Ku2g^R{lxb#dwp6;pP1gFZX@}cSm0Myai|V
z65+I+-;XjdfVv=t2S7Re<>Bv0y#uq3?`bc#y!-z@P4h!q>w!9@v=_@jJa7l(%ksX%
zY1s$N(-<$Pr7Z@j6f$C9_&wqCgkOKsrk5XQJjQr%y4?vzE2)<^85mx(rDgmB7qA7O
zqA23ExL(@ACDSLJU<?+4w$VEd!%7RaZoTQ>PcSOgr|k!2;PkZKP}VnT-!H64DCOw5
zk=FU@-D|zR<Dl+K4nrDvI|ZoN)%=jgcmd><?;q2kTPrxyUab53|NrZ~Ait%>r^SNW
zu+pF%L@%;HmEw+QFgp&+HUhJQz-%uD28NfO_5VS^1!^KPrl<8rF{bT+=+y_Sf#_8R
zu{%Gc@o)Q(*7;#0*SC*poyXGCdfg1b-GLX(5c!S=Y0U?qLLdJ9|DU$Q8f@JY5SxG7
z?X=Dt5WS#|morph{qcYQ|9AXA=-ducy~6{fGdeBq<*I*ayFj&e-yyXwu_fOv4)M1<
zU;sHeEl_RIlJB4jw)q)H$KeB@EdQ82t@!~vxUPcvBLi$4#2+zWHfR_p?L`2ngV0c;
zQqRm@VhD4o4OjtamqgkN1CW9=(EY8<dg)ya1$P-hz1;(8FU0@-|KD=EL=UEk9jpm-
zWpUbz-=JEFf7@YH9Zx}`;M2V&V4A?y*A7F_lCCuH@KoB4T#%QeK(Y98``@&~@NQk_
z@wCp%;O51$m;e8F97@{@4v(X13l@F1I8?%s_F}OF1H)@^SkDF2FYi05)+M(1yTzf>
zhu{{P+M<Qu)4(q9gDdM63t&idn*RDbBUio0%m4quacOud?M1o_0|Uqzpv3g@<)^e4
zS`gVwU=^UgI;aQdETh&Tw*Zty<3I{w)ltSAa6{uFI3N56RksmoQK0<%f(=v}rtxnJ
z76EaiUsnABwVn>Ay>M5oXMj{(T>LE!4CQJzOeMbMd})R!LFZ|<GNc)vd|hF~S`ui(
z$=|viRPx9eyj;&<BUDmaE@&fA5|#$q_QYT#SQ7Pe27^sL=)4M>NuV8EprWPWWeY>v
zi=JPg^a#pneFxMQii0W)nb$esVoD<Ih0)9B|Nn!Ex+%^wufrkEGkgItHVwSg{53Nu
z*LB`Vi+<TJo%X`+*Yxkt8O@Tx39<8V8o1|{_F}=a|NlW|7IUQcIWwj004)IowV>TB
z(suCA2KB1aI^As2(~dJsFeosjA9q$V0GFLFerPi=sPQv~aH#P!#t85$97t<E!N{+4
z;8oC>=^IWn>N6gh{@^sDT>VmJP^JEzv0NThjT<nQbAW<Kl<~DbsFK%bv|;0K31EC#
z$85vT-(tsH&JU`?uQGzh$C{a5rZe04^S3xMzl;Mn<*H@+j;SqJ_PymmX=qyK&$Q-;
z^`ORl^MfiI#x%(TY0VFAq%|K1097sqY2c$%RQnF48QxawlnVe=O&xrm41I?{i9&6$
z7en8n4H9aLS{V8cO<#D1(Xc)Q9OB8KME$}8%!U*!Hefa+LmGhDpo5;%UZ{ZC=3w;_
zV0I3e%>!bC#w_?dYMEYcVMy<GmVmgX?~vN!1csOCOrR<?SOi2mi@yBD2$ppKxo}|u
zXk<bn?Zt(s|NnzV2>K3zaz}cHv&c(BrnDF5L>NF-kqkp=dU`{(Bm;k|G^l+c!NA`t
zG=1V(Muqy1j38r!Mc}z+p%<hW@JO>f#NT=eEbT0q_F@spnc%$f^6byF9lT(-oBsr*
zI?&wd%g>;6E6bjK%vn(3<!r|E?qUg$$<8v({}@YoK+Ir)G{ciGZ5eG8O1;5e00pJ-
zIYy=IJ5NBVvs4n|`j!Kw{An-l3Nt{O5&|z%|EIk;2j`}}`2F+$|JH9Mph|d~vrO8H
zrJz;tey`ua{Q%DSFWR1f^E^_neyQ?v`hjzd@{B>#ADm;9<S_b?_QF$`fnhr1c}D3#
z-XH(}r+KHn;05XHJf6nC?J_9t(_UzZGcfcWOY8ihwrJ6JwGO$(-(N$!IWPIeAqC0H
z$#0>#$?y_Xg!|X@-1Cec^+KRSJ;2RnSi`vVTRLP5aoUcsANbnD*FS*!F&fYj$e>OA
z9Tz}X&p;{w{%s#X+%&`69XFm8riG<tq=Sm47m{!O|4)ldi|Dukx*#Y7d_&NUXIIie
zJJ7gGg34vUEUpqOFwI)7QepsRF_gHxmH@MOO0A$_d4qqGS~|n&*IFRs^}uDGy95Kn
z^pXpVil!g>E~V{Z5CBa*38eEgyxhbL?M^_3jzFCf{_PB)8Z00!qYmu0<k!<rU0`%{
zR$wZx1?A`v#&R7{v;8or+1{!I%C_69CDIN)2Sx67XOT3{<Dl{;n<EW0n*NsoR5~nY
z1eKHDrUzbRw3dFknhDgLXJIOLw&70i_6B#SK%?jT8K*N|W|W_P^dh5>UIG)Sgm}mJ
zGL;F`loepoOIx^RZhD8aM0y%@<Q&9+jGY@#=exwH7ID191T+%bc_Qsau@0yMbug{<
zK;;pz&NR>v`Wy!6_~8T4aL|D?kF?HDuP>#wzAX_=^L>37<nC(FpiQ;}$nme;(?J91
z+Zd;>y~L>LdbGp{X8I>>xakLArq{}1G5ZQ=FVwU&|JO%B<$l}CsOjG>G1@S3F;1U*
znNe+e)MZ9KrYj5(Z+Bj16k=RBea>Y@Q|=tSw1q3?f_97)OuuuPQA5oKRC=qWcULm0
zrFVO>^qlQG2<?h(P+<7@KaGF;|Fq7F)77sqDll0oPxrjSXuw{vQjece%w&4Q6-E&z
zkE_$CU13!7Xuc}JuoKkY=)2i>u<v5u!@iekubQuFFz_oJOlyAlk6-EFt4UWGKIri?
z$~CMsJPA_Jcd+kf-^H~5kJ3WZ0@8x|Zt-QjoX&EUu}#?#G;{IfAIiq(Zt$+?7kejz
zcDMYPHGS<>Mj0mgU(+?OF={dHnjUhE(S}iE`owFDx=aVIO+Rpr(U@`BbiM105|Vmp
z|IJ)h{Q4u8765IN-bm|wkd{$3z3w`r7*pDr?bEI^x-kZ9c*nr-GW361M&N%2hL`*Q
zrDZJoz`*cw+dsog;PhPpO5d+C`59jF{6QAl2NL@E+cVfvfg!-zQ-Q%T#8E*(L1DY-
zO~zct=`FVy4YnV+#W<f;s$(Ssf9t=m$eO2tG*9|6J?RajK2zWI>670umNJQ7pU(A`
zv0cdf$^ZYaH-KvC7tPl|V<5+-FMi9YHQn+pqZr=`#uBcy&QEXBJDg=+TTM>{Nl3qA
z<PzTg7^Ew`!&~;X3Rv&UtJ5vsF`7=lcn!2#`TcbL>x^RcX@}DegBte%X@O}$Y;rvp
z`fj9!r15WmlJ+9+_W%EBG4kwbQJ~V}Jalj&C~Y68IhNM>z3-S>m)yedY6}*8Z@FEf
z04W>!pMeY6!)Y(}^MFc8wFQg6r#YxCTKqlj#nKC)O36iq8CsYeQ0uM-)vU)rExU9J
z7Zv6bwwBu^yssrdx-1TtetOx+0IISVeFw`HD}%~lP}Ko4;|1H(|Nr}rrGvKbA`0R_
zkk*z1CBm>ON%ILv6}Xh{I}WzU%0-2_SPC+*<&yS-6Qlqv19Io0@2_uyEi0V@F{!kt
z@7M-*wM7fQgGU?|eutK6@o9(8ik?0zeEQ{uX-^o96xT4>sFsSRr*(to9eN8GK|>wf
z3TcK1Udw|<)L!OK4}QYvR<D$v)|<zum);cyp4$~jYd*%Lm)<3o20o<lHFH|$JMau|
zKSR9(cz$;QW4#!7cJ~Ei8hE-g?S<F*|NmdUXKVn??QUjh0L|>426bk@h21{pv=^En
z1*aJseiie#Ok%7z2hZ!S04cGoW=T)$mQDlD?WVn8JP)d`L9@GQFTS4p|3A&}WEyya
zH?8x=OBu$7U!^5xps8K|m)X<ZpE4>lZl0d~lu=3b?xp|#Uz&nlFa^{gx&$6>N>A$+
zPEYF$QDI5z{MmAH`o^b>mJ%-vLFRhC{+OQD4cesn3Y-=b&QE80#%QbX;?CLs|I-k%
zw_rn{93Yo<{+^!tj8TPg=Jc*-jB0{KAhph*F-g!QciM}j=?9-NN{G1r1&{54+aloJ
z;DodZ(?309^pvT5z`*eG?FU590z5$2c|PsMynEA|-Z82vmfidR|MeZvIKEnXHwUQ4
z+4{d!qv7X+QjWA84;UC2rk{VuC?>Ab_*4HuiA2NC52cc6;45AlfBt7EoBr(`V?aHu
z?V{E#Cd`oD86cB(I4$GvDF%j@Ki)$#P4gQG&=6+lb#U--fF^i&(z_gFz!f(rK?h5w
zcX>;6oJebaU=I>xgpENmfz$WD6BQhwnwXKHlrwD?V=Dv0%cBhGX}u=Bpbiy7<1+^4
zG|p=vgIrXYL4#?0poZ;>`qQA&0#sveb5UWk{J}r@AVdwL<stq_2RKfYa)Z<zd?8?Y
ztcW9R7vls5hSzy%{QJLwi+uj|-yzDG(io3{Dugut^`Af@J}RKJ<ihtKG(=gif;5zw
z#=jl^DCX7w|I@oc<DDJBG7V?uf#&NvZ=}5dM=fG36Vzc2QQ=720cm1P`t|=mXj9`^
zfzuPxG7daqV0bC?4i>BRY0YoIvrORG*uDd5X$$v!2RTedB)!X(0~DGPYH8hkN4}@0
zb%R=--L(Q~ogY9;W%$=zU`hkcuQ8rTYX*%}fo{zKN09=kwhrY=>%5qL+?9)gK`(8g
z&x-W4P8OB4=4Z^HG5*&7rR<>Nv|H+LF@Ux3fTzAVKutL*Muv1qK>#|J2|S`HkoMxn
z6;Ny(2Hk1aI++pd7?3-fA24rbNz*)>-Vvk1lE%O7aC%yIhzbvA{+K%*w1pa+TtMxZ
zZJ>c*%|mGiA8>;G#{qVW^1)}E>1o|IDrt=W($l(Y89-ed$P5~2ZO}`Ww9XULJ0CJC
z)`OxhMujDvF_tSmt=UCIhA};@8FbzasK4F(i@B}<>=Bl<gTI;5J7ZL&($l(KL7sC_
z5rBE(=Vh=b(z{($q|y#PU`l6n<w|S4&EL8l<YjQyzns?mm>D!Fs|q^!4dPlxSB3-i
zub4nXTIp$wAu2L3n_F*}<l_#qp39*ACFm#zP-_L$c#2VBd2I*v<`2kJEjXw_%ryRO
zr_&BT1cinPD4zJ!nxFH-rjye6CAZxMdHwY+Pzlt0L<Q0=2bCDpb+0i>$*1*P?7NwE
z@F7duj!l;QpzIaGqm#B1wDT<OMa!k>EY}#-oS?J4pe%kGl*P}!hGy{~@KCvfENFmP
zim}`m)L)&%0BX~oVrV%~8V*W_%xN!@Z%#k(lF>-|3Zo4>f6IEta!$}#bSUFXMn;?6
z{4FOLUml#!`-;)PrIRu3#Y;iZfZqZB)@DY?os*z09pu(YP+N5a^xnzz4rj>?-Jp&@
zTJr-&aA(hnG3~`_!RfPJF)FZZ?Cv-*ea|aK3E>IgJ{d#Wixil_|E52G#c0BJh#~ET
z5=?B*bj{a{`t=}fP&4a04t1P(R?u<bbz0hf&{@4{oj<@*oyXFTJIgRItWYS8OM9_h
zfPrB{<Ff)#+4Zb&Lo=8q@vLw|E0`tutPrdZlIY{pnolS^D|{^vvj=8JTJwYWXNBq0
zPrqiA6NdzDdRKr5WC%08p+eTX)OLEoe@3zTTYa}d6NTvw6*3H^Tz!W@Q+6F<2fwH7
zV%Wk29npDt{&?SEwJyGc-&;<Wn5lK~9r|u@s#IPtty|1v1;{k9GU#O3%eJ$S6!B8`
zGHAYoGtKZ~!_S6>TcG|gtP`ht4YZnWLR!YYM+^}RFP&b%21GiqrR`#<WCYF39S6<C
zJBXw;A86RbXcJ#<4D#@cRYyP>=VBWF_6uqJ+fSzPufLdf@P$B{M;ib73!vO`@P$Bn
zr?W(QXYlkb?->>9<IgZKybO5(YF6o`cegMcxW&NG{G+a%Ee&)os2|kggRj{@9jfMM
z_GyjhKszFB|FM^Ir8S>E04hpeOM%y6oOl2-CGEw6>mWDW097(P4QVeXg1H|+zJA$$
zeZu)UwkiS6o~6RO85sB(gm!{<;qCf-je)`7z-y)r4RcRVPyN8CBsk&R|NjkV&cRA<
z%VX1Ld|=G22TwY6Imp_y@wa#|l^fUu^S2ylC>I8ez^q}l3F2?*X0TByiFql&W>e4K
za*olanZJdP$tIq^Wdp;@->fzV_*=4>%f)Rv_*<-*`P)R8(wYx|Pl0*Q`tlB|%_07l
zcxIay{4LK|Y!33bo??YJA{X*8q<7XkGre5En%?CsW5ZNpT+Z2Ypi~gl_!6>VE;R!6
z@t7H2^T39!-W-6019So`E%s$D+mlHbUO=;t%<D&>A_B2^qw5%m4<4!n4gI|=yrP%3
zP-aCM=uQ&uG|;6aEsQ6p^L%2o;<miS!0=kpMv}j!b$Z|@MhQt_a6h-~)c^l!u`eI6
z=%sb@NvzOITPQNU=@X+<{UjEU(ea=-02@8;DA*4UB_cKfC5kqtr4K+kES^DcfzXQA
zTrjra3Q+!ksmB5lc&W+)a}aZ>HrN2B5+NIrQhAVkJt)@;FuY^{tFC9zTOa_^F7Wa_
zb6S1p4cHWITI@?DNJkPfOYzTJ=H*xL@+d?wF&>2lq2_*QTOL$VI&*-?Vy3jtuW1LL
zv4C0&hW|mU9t6@3J`+f5KBu47c%ET0Xp$Z@I#>W+v{1pLm)2cx*0C~e7iicpZ6^am
zKSP>d2`7|qcoH;{dp@o4JZK~_t@Cf%K9D-F0SX{8L#5|h8vpihU@MXB<Ghx}3DO6$
z5u~s{14LHnq#1ro@Aj5R>-?^k&d(UYp~uh2FITaWA2IsqJw5IVqn2XT7lsd?m%e@m
z>867EM4+nEMTPmL!e3CyabWt&FN})y#h}3hCWa4bJH9>x4cj;iynOu!9QrK$EsGh-
z1#Fl~a%`AO%0Xk6ml<A*fJQ5CGk^+yaYh?f{+51**DmQ@&Vry>yniQ3gkGD05(6UL
ziNjats4e7U0If1pXJ|Q4!2#;-v%VCZ#Ry`syqpB48DDlykNL`Ipl}O3k%vgFD-NYM
zR0}effVDBdw3@!|E2ElUEIi3&90Iw)hOtD-hN(mi<kr;xAa@`Vr5kv{89K(57W>i+
z%ts^(wL{ajzA^e}#r+2Rp0R}8Mxn&z<!Ml}>A>7H(1mA=Wg_WmpxcKT{(}~1O<(Yh
zQHSx!^t0a>wZy7=&VtfUH4A7MA}#xyNLu5u2Xm+MerI%1Q~<dI5h6MVL41VYWDZVG
ze8(uN+x$iZ+`v8$GN^zfy^ldHJ+0dhl+e2KAT2WxnWG|**7;-l>Vu4hOd`jp%N=5r
z;@GecJg6oz-R3=`lzLi*^a}=tmrw7%6g!ueVF6l)aP$6InbQq_I{8};-b>5)0~!oC
zHa+79qrEM-#hKQ5yzhWox892Ht#A2TQb8@_Sk|=8TW|gy;BN_IOnV{z3e>Us1`=Aq
z$lub(kk<L?P2ch94}UPq1-QLFuhzvk;X9~H!2It7f6EDmhM&?U@oBpn?m`AUeN>qB
z(z`)TryG{1`CGOy=%sf%LAW>hTb6>kpmyU8%bWZy)293XWE88f-1YxIsJGh-8td+V
zxq=~W$ALQx3~7e9_0qcnSo)5ub@BCnw>VX7lE%O76u9Bal4kfeJ<T#lg{3Z3FTKl$
zm7(u=nyXrR*HrMTMgDy!L5;UG%Znv9)11?q4{)S4{}wCV0G?#wZ?XUX+6B}>VV34^
zHU4k+`X%V%-a^pG(SfuVl{^3cf0^=MFTI=P?lF)v__rTOdy%~J|9`#oE|$ATz(U&&
zq&d8F1ufIym~L>8QCsdfsKVrBNCC|)gVWoKT<{&`M?^qtUbg4`Vq|5p;(wBsk@SXv
z;pN7gX+e<odBzq{iJJkLkn!3FYCwX{(@Fy!<`KAWLRyCJ1qOzfU#749$C#*le(V4L
zdTHHqUzVq3-{wzaJPf<#yHYIe#ip&GS<)M6tq1CP(_ZX4Hr@I^qqKP4KL&=Emu^5>
zCTXDcBcR3Urqji?Gb$Adr8OVqNCPiRPlK#WH%N1Q{SMTz1TDz~AGDkX8Y^!AjrP4y
z>-_aL&7=9p-!d7{@^pT%ZvJgY(=2b4oPN!c=J@(!TJy>OAnlOu?crC^4;VfenCTlC
L>swkf{9yn9Q0Fw6

diff --git a/pc-bios/bios.bin b/pc-bios/bios.bin
index 7e2d062af6789d4d055e8d064312897f8b424a79..4b81a969a9d63b6deac2a38ec5729625dae87d12 100644
GIT binary patch
delta 64204
zcmZo@;Am*z*pSdv&&$NXP{YK)(89#PFq4Ua!GM{8VJR~M!#ZXLhWpG63@?}&7>rpM
z7;IS>7+hEw82+&^FzB%|Fj%oNF!ZuAFwA0QU|7q_z_5drfngsj1H&O!28Ii43=B8e
z7#LJJ85rz185lx185q(z85pWK85nvw85kCDGBB*?WMG&s$WYHvCd|OFSeSv~x-bKS
zw+I76g$M(~E)fO>eo+R7esKndmEsHxJH#0nQY9D|7E3TNyp~{K;E-fskdb6ySR%>5
zz$nGQpfAP1U@OJIuw06P;hhu%!)GZ5hTl>Q3=Yx^3?HQ#7}{hQ7!JxXF!ahYFwB-^
zU{I82U?`PmV5pa`XJB|O&%p3ko`GS$0t17iA_K!zWd;T%RR)GhstgRVY77iB)fgDw
zsxvTzX)rLfYA`U|*I;0f(qv$`smZ|bL6d=jS%-naT#td_ydDF?Ej<Q?2YL()PxKfV
z*z_3~c=Q<<Z1fozLiHIKV)Ypq=IJvq>^ERwxMje=u)&al;e5Rz14FqH1A~|`1B0wF
z1H%Gi1_lKa1_pH#28KvW28J9<28Iik3=H~K3=DNv3=GGu7#MC_F)+NbVqj>oW?-0Q
z!@w}#hJoR|4Ff~DEd#?DTLy-^whRnGb_@)g?HCx2*fB5|+cPjY+cPk1vS(m;XV1X!
z%btNj(Sd=X%z=TSeu4u7!!!p5hJ_9c4C@>i7`8YtFkE(EV0i1mz`)|jz@Y5Nz@X{K
zz+mFYz+mObz~Ji0z_8Sjfnk*+1H&dq28Qj93=B^k85qQ!7#KX97#OtO85r!{85msM
z85kD1GcZ_rFfc6jU|?A7!NBm(gMop?lYv3plY!x!Cj-M3PlkGiXPyiUZ#)?og1s0R
zUVAez==v})IQuX#boekZZ1-Vc=<{V@IOfa1AmPWraMX{1;j|wE!)-qXhKGI(46XhQ
z43qsC80PsiFs$=uVA$i&z;M=|f#IV+0|R>?14C0F14BzN1H;r11_p;v28RAn28L~+
z3=GN93=Emk3=H|v^$ZLbV;C4jV;LCaVi_3RVi_2GVi_2A#WFCk#xXGP#W65sfN(qm
z!_{~OhNtli3`Y|f7(OR3Fq9=SFtj8xFkDY$V30^+VCYI>VECTIz`&Nmz`&crz~Gg_
zzz~(fz)+jQz|fMyz_2TYfuSOmfq^fLfuS>vfuS#rf#G_68UsUUIs-#yIs?PU3<idV
zECz-ZISdRMc?=A_c?=B4^B5Q|<}ok`<TEft7BMiy7cnrD7BMhX7cnqM6f-bb6*DkY
z7Beuk6f-dN6f-a^EM;I=UCO|)wUmKje<=gQn^FdbpQQ{8jAaZAoMj9Qj%5rCxn&Ft
zjb#iBU1bam^^3|F7`Bx$Fs!O#V7OJqz#v-9z|dLEz%ZwVfuXsUfnjzn1H+bD28Q%H
z28Qe=1_t*Q28KVA7#RE~GcZI>W?<-?%)qd9G6RFz6b1&LDGUsiQy3W5Phnt~HG_fS
z#ta6A&odYp7-uptD9mJF$eGE&uxlm*!<U&149v3_7$(eOsAq_s!@!U-hk?OjE(3%A
zTn2_?a~T+J%w=HsIG2H8%6tZfMe`XL*3V~P*fO7iVc&cPh9mPC82A=2FeoozV31$P
zz+kzMfx%}X14Gq928RBH3=9g37#J)TF)(ac#K5q15d*`XMGOoF7cnrDEM{PMznFm`
zU<Ct1$_fUC2`d;FmaM2}VA!#Of#J*w28IVK7#O~+U|`@_$-p49l7YcsB?E)YN(P3A
zl?)6yD;XFXRx&UYtYTnjS;fGhu$qBk!D<GEC94@2R;*@VShJdeVZ&+$25&|NhD(eL
z46B(K7;=~y7_wOz7&=%P7-ZNP7}$6i7-V@F7>sxs7^H+47<7af7<%f37#QXVF)*wY
zVqiEZ#K3S<h=Jja5Ca3FFara>Fav{yFatw?FatxpFatx1Fatw_FayIZVFreS!VC-#
zg&7#ML>L$>L>L$@NH8!Ql44*8lV)IGmtkPAl3`#7lwn|~lVM<(Aj810U50_-v<w5o
zD;WlcA2JLKin0t04zdgk_5QL949T(#43lIT7?#R1FszqlU=WsLV6c#5VDOe>U<j9E
zV3;Jwz;I5Efx$_hfgwnqfuTU2fq_?nfk9q@fx%dTfuTl$fnlWr1H)wn28LG(3=BUM
z7#Q>v85q1385nXE85pV+85p`185j;JGB7+)WMKHL$iN_`#J~`$#8A)Bpv1tiM2Uf6
zj}imJbtMLd*Gdcw9Lfv~tCblTI8+!IOjH;cuBk9EJX2v{a93quC{$%&*rdw9ut$}F
z;h8D}!)H|n1~WAVhV5z$3_R)#4ASZh44c#$7_O-^FtBPcFyw16FwECrU^t<{z_3)4
zf#IkY14EQH14Fqs14D;)Jp;o^Z3c!L+6)XIv>6zFX)`eJ>M$^f>o73r=rAx$(P3bC
zrOUv;rpLgbrN_YFs>i_KrN_XqP>+FOiyi~RbbSVf2?h)d^9&dmb{a4+co{J;OfX_#
zNHJw#XtiWu2)ANj*kHxL;9<kS&|<^DFvW&};g1ai!(TfF1~GdEhManP28LF928KiS
z3=Av|3=9Ge3=AO-3=Fp%7#O}dFfi~rGBEf%GBC_`WMKI1$iQIf#K7R}#K3UUiGksP
z69YqnGXq1WGXq0|GXuj!X9k8v&I}A|oEaGQIWsU^abaLcc4c6g=E}gZ#Fc^Jm@5Or
zHCG0PC$0<(!fp%<i`^I)>JPdxFkEtDV0h`qz_8Apfx*{<fuYrdf#IVE0|TEY14Ef7
z1H%k&1_mA<1_m1+28Lxm3=DUD7#LprFfa)EGB7y$GBD)$F)&Q@V_=B$XJE+pXJDA&
z&%kidpMilZfPo<-fPrCS00V<$AOnL%AOk~cAOnL=5CcO;5CeliFhf0qaxepfLofqF
zKrjPCK`;Zuf?x)Qy}=9&^FtUI4u&u=Tnk}fFbid1C<<j@m>0^xa5<EL;Zqm`!-5C~
z299_J2Hpe)hO7hzhMEKhhVuyw3_QsU4B{ya3`Qvo41FmK3`bHJ7_3qm7{XE+7<y6}
z80MxjFtnsGFuY4=VDQeUXJFWp!N4Gr$-rQc$-t18$-po<lYv1Xi-AEti-AESi-Ex~
zi-Ey5i-92|i-92}i-Dm$i-Dmli-BQf76ZfNYzBr4*$fOfvl$rpa~K$mau^t5a~K#-
z<uEX?<uNd@<TEhT<ufqc&Szj?Dqvu+FJNFuFJNHkFJNGhEM#D?s4rw-a4BS9NH1hy
zC@y4R*i*>B@Tic1p|yyCVO<de!-XOShTvib2BlI42Io=+hIM5O3{T1!7+A^~7<9`S
z7$V9U7?zYXFl;SnV6dxTU?{F&U|3MWz)(@iz|dC7z|ddGzz|x+z>rbJz;LvRf#GTu
z1A{;{1A|>P1H*x828Q~t)eH=hH4F@CH4F^vYZw@I)-W*W)G{!ft7Tw#S<Ap+T*tuR
z-o(K0wuynkv6+D(u$h4&tC@jeZ!-f!a4Q2t|0D*6C6gE!?oVQ1sGrQha9}b6!=uRz
z4BAr|7}BROF#Masz_4^W14Gyh1_tYy3=F9=85l}uGB7-z$-wY$CPO`g)hq^vpjiwI
z%V#k#oSenLaAg()!{b>D3_`OR7z}1JF!;=7V2Ga0z>qncfnmvP28PYE85qvbW?<l+
z!@!_3hk?Ow4g<rgISdR(<}ffknZv-~G?#&)bS?wK+PMr2JLfVmJe|wHz%h@3L2Moa
zga14RhKP9#3`O%880ODoU|2U#lY!yMJO&2!`3wvR^BEX)7cej^TFAh#bs+;o<st@#
zv-cSol>HbPRDu|%JJvJGPIF{r**vAMhoippP&Y$&5KAXh>wyyH&H$Ff-CUgkES(&!
zCrg++9a%b=4tHMc4q&kk;3#J8;QH^ta=7zQg9Sqgv%~8jnimc;9<)4B%4~SxaB!ED
zg+vLv<bmcBjITKyoGee2zBN1$eK<TUxbtwY4Og!hqvg*MVMqRLh5tG~wOlIUaOnKh
z5fJ+S^~+-n44pTk<Kho@9(=Lj|NsBJE{y*zPZaSqSSZx9dmM9MWO)6d^F)^bNK?Zv
zg?eU(*PjlD1$SQVHjSv~XW-v{p!Hh`&%p;gjQ1Enq;+z<R-PW<$|yFOd4`AxOu?lR
zE|7v#j2F5XCTq{oN)}P+Jk7uT!!9-k28PZLFY4AZFsu+LWih<{+N0%msn9MHi1_6H
z|NnO!HhlY9gMZs)r`K;=ZkOEQ-}bxnSLcTp<^TWxw_;H#5$_FW?ELT|1FY1w@h<}-
z14HSx*IOp<njtM|^Z)<<mID<E&4)Sow;i|qP%6p4{jlMs7vCqpo1xG9>+k>nod*ps
zb+b%8;5b=prW~*3hZ3dE!>tEOWSUR>pBy?<J{A;!-2#ROS}&D|b{7dS7jblZ@o0Xu
zJW<Tld7@kB_4CHxHyrsHN;n#SUvcDTDCKN^VIX<w`z6H-(Q$`^yG8dn@-y`IF#Ts|
zU}${E@Z<mg7cpxX7%Wc|Nq5VJO#U`gfp<wgKSOWi|Ll_@jRy}*R-R>MxuBk(Avz8m
zdB-|0zF-46^LV%H4o7~5){`Y--IA|`dV^Uye|CO&@%_*L|E&i~*t(@#Z<oHBJYkkp
zee7xmhVK_vFqeoL9(XOwznyuP9RmZyi{iik|F7UEdEFh&(|Wt~#STUW28QUvptRF@
zu=xj5sp-NPCw_+B2*yrX5To@#sl~#cI(~-cAHwB&U||riljrDyI(~*uk)uoM_!(Y{
zHveEOy|FL?rZd8czn<ask?6z0od>%oIPfzt^g1ziHi8)Z+n9Qzm^x>I*ashQ@NWxZ
z<h&4lI5a#gxcLo7CyPpFhzg70rCyt>3=9km-6m5X*z+?O9^l_Lhn>NJpP`$l6(qpF
z{@lTz+}%1V{M&M58Ti+q?aonQ>GYY);L!Yoqx6zf^DkzO(mj*c&CaUtyli->+k>Z@
z;lK-K{%r?ZPnNJT9_l>t`gN}h)Bj!<iT}+HnEAIg?6Bu&0J#@Qb?eCzPX28NpsGWp
z{@X~D^D$mPsDI7X{D_%<TN6|-|8|L;3=IqnyBt8t_Qs2(-~a#b%5ws9qF;vo{{NqU
zJHz4+)%*-E?yX{A;NQ;rr<$Lk`2fq}mU@1M!yw5w)%*-E^;R=5Ec9^VXRu{pU}z}k
zInEm3$PWsQhS!21p#$ZDaG?W+2Ns7o@-rM~b#UZo_%>@Y<J|1}vp@g;?>yCc<Hc1F
z<7ThhgXSL(N<k?R8qB>J61@>Toi|=&{r~^J^H}G_&KED@|NsAQc}((R5mWo?&Kob%
zKr)cn=)Cd53B)_rd3^^1!-0Q>m$X?_q(f9#zTa!U&hY)d;xWbRoyMKjES)c2=>Px!
zU%T^Q=jF~9FZlld|F3yY^8WW5&6gOy-vTQuW$3JBu{H&HsPl(3Ysh4&dD5EAM>wM6
z;$sgtRG2fA>Vw?ad9Cw!x0c~;%e!^b-7fc7nh&sa{(5nHa?HFVtXDgIR9Ggf%vaAy
z-p|Frz|eZBp0D#@=ZzQkAV(hRc4qPF<uU8zQRzI^aq;rM&X3Ix8M{qXIL}#@>}9BD
zc7J`Y`9FUh=W%DA|NsC0f34T;v-b~k$zB)6lbYxFx9u@)0Y%u)ga27N&ow{e?*>`6
zalRzu*~zEp2h?jYGB9)=?hH{;>Eu!Ao}yyI$iUFNN5z4Wfq}79uA6~>JtO0VgFm<p
zFLlSLsC2SSc543RQ2P1hWhMp&!vnoJDjNLTOpYcvf>QG4ZW|T;^*q~qZ3H`OR9N`8
zi5yJ?OH77HOz-qj;Q)yyK}7l2^VEaHctB#wa50dO0RJ|gqbVREk#7F=BK@5qDk31E
zRFIHKH~)H*{>~B=36M}4LWqBx&CzramuGjk2*@eBx@%Nex<gb%7_WEMsK|hLnjjWS
zcZ~`U<M-~6dKDhcPnnkjxEUA@{^HjB)m@?@!}zbWM1=>$(gd+YK)TTMD|FYWNOYH|
z2xxu>`Ly$UcZrGw<G=126^>pJe$DfpKYMM&kPPk&QQ_zgQDNyd;mZ6b&&I%T@E>>P
zrIj2E^&o2*KV_bLF2cZY@F%zCN6nw0<j`HB!l8Li^AlL3j|vat&rV;4ZXXpHW*-%n
zPG5!Y5EX@99-~fQ2axZ&eN;FYFLwGSbY9f<QQ_$9Z2%QDAu0-*pE{>5fUsq>LsVEg
zryhXtcr<@?PJO_@P|whOl*PgDQu7ZE{#LVp|Nr-fsAzy<x|^%Jh^5<!qdSYI*Tzuu
zW3P#Z=8Mb&;DGwUt@)u>$GlTV1>*f)8^+EW6%NgVojxi&-ChFPUNYTP0?bu1-A*FR
zP7>WkBHBd~y*ligKi~%R+8Ad3muCa{|37!;$(0;n-!uNq{00t)f83h?I=^ea*ZiS*
zu-in1@!i3H+?~dtKw<m`VivP>m#FYC9s{#Ex=U187|(&(plD;!gs=s=eN=cf4<7u<
z-RUjT?V`e=`QzXZ?oMZkZWa~I7htALTJs@==EDlTEh?alV0nSRmG%Gs|BXjLJa85U
zwKT4Ep6B0wqw~g#!;2UgIDhbOKhgOK+_rc*=ga^9pqjMv;s&PPV8(ZEY?w-QdxM$Y
zG(WJnVcG#I<4WawgBd61E<UBT+kk<A;opf;*4-8ipwg19^VW-h3m6z$-<AmW2D9*Q
zXY2e4vh(H3$%#uQ)R%yA=JC!D6@%_}Q03Aaz}Pt*#AvYi&)+(kk%6H%fC(bPzb$~#
zGDO9IzvUGZ14F~F+a=EBN)5jb@weOp^N;Yi?qFhI==|~G%Gdw@J6%+GUTQId6yD`;
zoez=N4U+irVhf0B_u*$?sDItr`Qyb>5dUEFPbU68P{X7f>;O>R2X<1I)VISt{H+{}
z3=I6+4mUjhz~B0Zfq|j7i0R-1HpU;#hnzaMgIwGd_rGJt4}Jy)HwVjWrLUV`I=)`h
zd7<@EC6nO+Miv##5EUNB=AQ!mt-lx;7&2W{SXw}1pS^3?e+Ym|8N=J1b6Q&%85kUF
z8CVz?O5Yn^0+k27E-EFRE-DI!mkdvK`ltwWyQm0sx=eNHc9~+*>7pWIc%aiog=GgP
z0|SHRg-#c6hLy1_QDNclISwikKeT=WIiTA|MTGGnql=0Fql=0{r_WRdr(PD$&UzOW
zk>+0lrK^s+IxsLWF*Mhx@G$ZB761GHA1xI4w@G#0>b!aICrk5h`7(~?6aQakFfuTF
zJIq)5nek-vBmQ0!!Ojv;Bfy~(9BlmCJpOn3Ofhi+ng6;uM}<ew@LQ*eis8xbkRB7m
z1KlPny)pGBC7m%U9F~Xp`>ufO1P5eq9%JWvaEQu*GDC+9o5Sn7-7YE$pe)eEV$k8D
z!T|~f#ur^NDjXei3_xXn^DoXi&i^hdEHD3p402HsVRlhr>GDyLxcs2gMMVRYHJTsr
zce1GL12vv5KjYu#qQX&s@BvGwi;7P3JI12J-7YFRsto)L44p12D%~t9j2D`JaMt_m
z1cfaqHyzZx*!lVL?{6+D9Q-9xy&nI;&9KW4EDzW6G@tn2#iMfhL2nE*V>gRRua5xZ
z4p23xdE($>0qz(T70w$x4X^pSSyT=_5a4!EQQ-zfm5-i^2It4lmR?Z2zpMb&gg;)$
zeE$Ex`3Dn!--kc{|9kug2j=T{h6fstluXWBA!Y$;;COb4@O6lAy#5So`X5>dZiRaM
z?}Ri*ofxwZh-hBSJ}J^W;Xpk<1M8Z4eukIZCm&d0V?5*C|NpPqx*1-dG`tPY-Lc@7
z>hTu~-u?gITfhiysNOCS0X0%TcK&!VWwQQCclORlJ2@B_7$(=Ql$7`B=4Sxm680CZ
zOBonmzXi7gI}dkW>pc6Sc<JP=E92xumoYHBmfj`6%D|BJzVpP3mSqeK-IGBP)%oGY
zrOAe?!~@>UXJF_&wp;KDs2_5Bml`Nfxu`I`sF}~ekapZfMa_Zfn2U-$W9O|GiOU!m
zzJWwal@aPfVCoo{I&ZzOTQ+&dD)su~OBfhlPi#K%zxjwpbll<2gK5VdR2Z0EESS&0
zu!{q1)uql8FWxO>V0f9agn^;;K#9bQ&F{eNaQ<B$w)_k`)EF5UUbZe{U;uTLj&)vc
zwsq;|XJ9Cm0+n62Ui_ZLz_5a`RCSk!4L`$<nG6gJuZ=n%*#7^|&ro((2dcQ_%8Pr8
z85mxFXnydg^Kh@jf7^fm85qihA)4lan)E8mCKs+23H|r||NrA|GN3dGijTvc2YVe@
zUc7((|9|I+7XhGR+7=YnAY96wA(70_@Z!W$28M{k0YMr1Al|N}3=GXjcn$}59_HW1
zWW!%3uuEa`?bXWM%3xoW3hp{!GnsRZcKzYb3!SGrZ}J;-^S-FzXK4N@UnaQA!J408
zhcc))5%&_*c+CFD(>af!mY<=sjRizb<EZ6laO?!@h>inCbn_d5?iv-9?i>}3P8*fZ
z92HPIL#JC7ln9%D*Vl>dN&y8U$k65^0^qV9)Ml#()$*XaGy8)`=S|Inpyas@lstRe
zuGI50biR7A>i7Tu&YfU$K)JO$M1`lb4Wy!T+L3yGhHe%WQ0t<z?F2~qv@;-b--UX9
z2B<Ai$EkqILy%qFE-Dt?Au2YVE-E6OAu9C}-7YE)pdz!|6y#LH1Dz}?mL@9vy`T}>
zY#tSn?naPh-4j8Ubsq1$%DfX~lkiHgO*JY!ojEE3-7zXGmN6<k-7zWx(lII=#jO8X
zR9^4su2B)`&QXzIu2EqT&Qam8c2QyJye3_u!ckn_Jrm@}&iWV?h3*&?8Os<Ig;J@`
zpPjEY4@zF{^idJ%j8Tz*Ir_CH$Ocfcr+HZNTIWoV3pzJ~T=1Vo#Tw*@7t$^&0>w)I
zOH>p<g<yAxiiqY9$yY%EoxeI?cDtzXyombu|9|rlo@^5pk!}_hYgUkNYqRRR!C~1A
z4ol19oi8OX7KJf`15+3rm{2jUZWfgn4!{2Ye|@-fA1FXN*MR~AWCwE4cl)TwSoeW^
zRtl<8L<B=rKuwMpY`^~hZ>~|1`Cp>n?V=*n>7wG$?V=(AYJ`G3Y0(*?VgrgsP;0K6
zMWy+O3OI$V_zQ9~n0+`rtn*msbx^yeI|N+eiL_oSWobQGA`Xs99~GX?5EX&W51qf_
z;$L$A`~N>K9vt_bhXZyBFfcIe(qUj=SP1ISzgY6~|NqF=1EspbJ2Medpg#YLuAl$^
zN3|X(72Xv9O0GemJel?9|9```uPr){?&Jnlp2s`yeO}rv+$qp{sf4-HiKRQ31vJ9L
z)axPA9W2rrAOaTmV(AW+=nRnP<m!9@^33G9>!qZ`K%Kb55v{jNggPI*@ca)dVM;kW
zKfG8s`QmzUk%W4F28NQVoeTmD47)(Yjw_Cn|E!m&_vq#a^&kZp%GgyIKK%dRd9*i_
zrPrC|Md|bZ|2uzle(Zde@pv5{LujW`xAOmsoj1CpS-Mq0x?Xtx{{O!_`A_WO#=jtb
zsW8YfFSpJEwTU`Ef;j&lg2=<*Q0hFi0~ACrMgRZ*AKZEP#dEL|6-tF5vbT1CLMi&?
z_kaKYN5gg8ah$w)gF*QIXaE0qK6s(>59}+6UKbUS7qg!I|Nok|o5?bQqv!}|XzcZ_
z<|8_gF@nzPFPMLT)Rt&=9_wBKss>u$mdN(HGQMyFReFcP@t`r;WTQ&`?4SStzkb~M
zzl5n%{}_ulWPB?Y9Kq0`hHIVYyK_`zc1VDt><7dRV!K*E#j!9Gs4xWgOJ7R;`v1S1
zN2Qaavw)+sf~ECsDeK;ZWPXOu44!V@1&;g-%{D5`{PSE?*mr?=ttU(Qn-2)oL%X#v
z_dfmqznjal@JIct8r5zY70bvE^$$v=8){V88A?RDGrx4jGFZqLoh{|)juo+t7b!a2
zd8(W9^-fSnI2be{a=r5$s7Tl`1?0>ih%-fY%>Wg+pBNb!B0*8{vJ9L|c7fGQp3cC~
zYv#bR6Wp;8QF+nz^#A|P)u7Po+}#68kDDhjFfbf%?f~_lSMV_`1Pv;6GIz@EaGYGT
z$wFy2XsihomV&!tK-TauGcde(^yB~k*Y&$JK(6>d`PwE&VW#ei58VY{EZ=v2l;%+>
zlD9TdnXI*0fywE~WS`BF%326h8bCSY3=;#x3qz18+TfwR7k<+wcWl<JKiql!Mff~W
z6<QkAd935cvy{#o2Y>K*l=8oDfCxKxu|G?A?a=rb)TnCw4IbPx+AW~Y!0;qx1!Jk)
z4kM7GzE5Rf@GgD3>jTI#P%GdCXx{HN+mnP2_SekK=l*wo0F7`4?*?UHkj4^akVaRA
z7yG6%Fg!`{E`7c00!Xhr$h2*985o*R{C~{^9YJk=qtJQ0^YShRP!Hh7i|nb8r3DPV
zppr6n>g1j+>dq!pL37P2Y~AiUY25~C-4RU9hnY5Tb>4c{`Ka^93!8Zi49zG1w;m{!
z<KKSl1s5no9c(>NDgZVVY|zKaU$<!1XE^aQyqG@)6eJ}gyC#6#<N=C;J98jz5`6Jt
zCIiFk6a3o_yk_0;A6)Am4(`0X*r1D_0o1^^%@=22DC2N)xcFit<Li$tCrdexvFdd3
zGcdg7?YP(>3Sxp4ryXb20|_$(Uw*I?v_8Y|()W+`0U7n67Qy}5piIC6$$Ej`93<-b
zTeZRcEdK2VyFmT3&JQnQCxC`TcK-YS|36IVLO%lojBN*!zT5otUvI$w=3jsL+wU+i
zFj&6eZ@B_$rnNFKI561$|8LL8-*%XRfuZwe^GU{C^-!Zb`xzKIU!^r#g|6ZUH4qv2
zw?|2I-eA1kXdU3}8N}Z@k%56>1#^jPr-%ywc4xK#{_V~z0T~lOZdZZ0y<0@3^>#^4
zx4S@^r87&ZKw7uEP@1JPTPa&ZwFpCrU_-SiLxnH@c4vWu4>%bQy`IFst%|9>Q$*$9
zbI#5mFX|uv{|_1o?iNug72LH2R5H8<B@V`~|Np;c@BI1V<){DuJ72;)d$W&$;k5vQ
zf3lB(0n|K>0%cKn$#Xm)<2T5OO|uvn7A83HGl067-MU*G`5EFO3=dek)T^-61$KwD
zGIZLgbepK~Z!_!s+;Y21s+6bYc8OubZ~YP-hu1edKQ{c-Dis59LE;?UJSrBEjHNuF
zcEm}Go26|3SyY@}?>D^U(0Zw4^=oEuTNYfR9d5SW<G|1Guatj>L<&E{i<JNW|1SoK
zfSU09+dtGBUh4etVox6fLz=CbbgAMlCQ#ITc(Dp3()@#`L^#c(gg?Utq<8;J28Kw(
z+pql%Z}V?Ey$jUE>HP5G<pa==eanFoL;h_)dc&DJKfIXr;Q#-BCrWSihBI}3c+vCV
z|9>0#a!LMe2Ldu`K?ar0WMGJhdc7rMQ%XHQ!|UZ8H$a&cR0uY|5$QbKDWVdPQDV){
zkZ}j3+H)oYL+Aa2&pG(F|M%~_)%oMaiwB^w%;qCJt=}pf`M1B@1?n|*zIgGi7vv2V
zwo>_>pp3Fh66BW`FS2?W7z|JDl7jGJdKnlxZ*_inu?S>J{jt}(!Ddbc@my3mnrl=z
z82CGGf_m=TYg9NOX8(9G8)`Ox>t;p<hW{lh91tgd06B5_3<ic>psJ<w$BX&*|NrOT
zcA)tPkL8UL`QU&ImQ;R*7p*fuDITWgW)C>Gz2*(B&rk(Pr_W$uh>d_a_{WRb`=C0!
zn?<FI!J*qkrGu^WCI7aMpq{eDi4r4FIEH1|fwURSU|;|>-}tv_biUx<2I|%ebRL8m
zQv$U`;D3n<OGY9{!~f|F43Tk=p!o6P>%IT=|2te%gdxEN4xk?|?0Og&x<ypFT~t_J
zWP|#}EGqol3_x99VNmMr{9xsxBFx_cu3Ub+*!34Q;Zl;ozwJP8088hO7Y-m>fBY};
z>pa%$!^+U%qaxh-%HmKlQ^z5T5EbEKA&~nsYCx_jn$A$q5D{hgt@8u_whJH&883A6
zsPJ#&v^-JAAC$2Oq{weN0|Vo`$XJk?7oq=4R0J~4fW*zFGl0hZcsf6HFg73Ic`fq4
zM1?2gBS=bmIw*a0=cw>>zJ&QTvl|rcpgzJ&VQ^bl1e{UXGx*Z@8D6}aoV`nh@yg^0
zyBvAs__ujTW}nnx_EC|Te1Dge#2$NohVU?u%^(~YkYNMT;y!J%;BGNanU|nOD9=mj
z$p*V^_<g#-Nex`6{dh5Va`kRm69tGEsNU-Q@uKj~|NqU^GK{6R(7p-(nhOF4UkUJU
zKe0;zJo<I)h3}oo{Ch;Xl%QO_JCon+R%GG^iOSf#z5V|`XsCJ@sCMrB@WQnd5)R-N
zZ0Cm;rkxB7z0L|R_-_CI-+ALj{=5JGyJJ*DnqMotRGyr^M}aY7a>pJO9o|j`2IuDA
zDW&K5xA~|r?Yh9iz|e8x9VnWacU@#*V0af0m{9}rXycU0xAw?0Moj*-M?P&)2LnTI
zFh}Qy7c)Ab2AsrWz&wxvJX07LI!(V+^D}gQcp=usz>vk1#gM_^z`(GB;lRazhL>Jc
zz6Z^iASOvBH|`aw2elA)frhnS$oDXStGXR~K*kk<`nfJD0^m_B@H~=>3QP0p|9c}G
z`57!_dq8uPeV}1V=gu3Td8h3MJUVZ^&;$j?@z($R9iXCN2PmjtB!NowW32~DC3nSu
z%6k<C28PBXA}kCH(Q)zhu`lc2{{Ih-lo#{585nvUK*K&fov&Va-2DIlKX^cCj!5f)
zQYFh66_yg_|12sH+iN(xMN~RtR9If~bb_7p`aS=)0H(A~yG}QrjxZ+v?VxeG7cV;7
z85la<1a^T2NjhJ=r~+{h9egE_))^+!_Mkqk(@ks_AEeMaaP$BF4mXMB2lXB{jOBWe
z9RA|PO0Y1fWVO6e$K71hBEnG0(pl0XV$BK)hC0^8APQW*Y2W()zw<aKPrUs3@BjbC
z-=JXNZ$0-9+yduOvGh?9;O{>Ts@qLLn*MWxveN}nfICc@Y_MO}><@@7GYOQnUd!$P
z^_O1gd;~SnONDnG0kvDoLDi+{oB#g}54^SkC&w27U6Y&lt8g9Y<Y(v%VCtTHWb(%S
zV)aKseH2KW(*hLkvLKCTUjP69S}Y(eJVPLzpW#LGL{O>U`SSCU<|6`~pb8@PaI<ZI
z6KGT=y3ry&*f+j37&Hcbco(RR_hMNm14GM!Qk$Kupx&HTIzL0Nv%rhC>tF|}@oy_;
z?G5_?5~}U22dfnB{MdPGhXKg01W=_2G8$A3LF;aw&a2%u;Ne4+?g^mgw6$QVYUgRt
z&_(Cb&I>OtzW@KflSQTVK&jZSAE1WwKSl<I7aXrazJK|ek%6JR7o-c65?=hD3Tl0K
zw}J#ZT~z8h3{Q3*0(F_?Z-bmy!V8+=_w78`9iqbV`uUC;ked!(15H)$XsF?5c(L``
z|No2!ceH@SS6&0p*vs&5ztF9{^Z$Pa2F;h27mJ010yE4(^1c(mRg2-b*Ak4cI)z*R
z^SAmkGBC7$D`8Ii&judHoa}N?u>OG~Kf?=k(8wO^3vG~JK=C01@rnwl^=|a)|9_Ah
zlV1M+|5En<|No%!xl_XMWTyv9>o@+Ei=akbw#0E}1_=fRh?^NfZu4Ml{>fM;z7OP!
z&i9{}bpGAIc-%#Wg^_`Q;WdZh0q_ttOMQnk%RZ3j4F9)&E0OK|@Z#vz|Nna-n)x95
zKqIrDDW=XJ9nP$2$DP?2UO>WN7DTDx0gz3?`#|A>(9z|h!qVZ)am<;Mq1TxUoVi|1
zXlGzJ=FG)$+*t@zprjplt{40NAGENkH<q!vMuml;l>L}1BSUX2Q|J9|6BW=v!{;R+
z->1F!4;iw3EtqD>&fmQ1-~az<o$N0cf$I<+a2*mB9M&z{QpeBGdb>2k@W3v}0H)!|
zU4pC(3~%_i9pK-$aYs5ogXM=(KgZ^uETykA_SS>qYDOOe!*N!SPEg?Vx~Q=1WC5jK
z5buRnF9SpLHx?D9648tcAk|r5)eUw0pgs{p<Zh6v&KptDaiB5B!<`pil(vBeN1vqd
zZ@cjA5MznmlZ0=F6iQWFZ<n%ydJmB{ze)mZ{*{UZWw>Y5^E14V>I3EF9sfWPV;cmn
zmJ>4g8D22;fs;_@hZp8;(0&Pn9Y4d4ZJ=yg0+KxO|25Bxj&25q*OPXDW+otRxYlv_
zMQR^NN2z?rjb{m+pLT%U_#*EA|NpiiW&BeQ@NYZt{l;tNW~USXp+kd#oyR(_@^7;(
z{m#eG`J=-{g{k?$pXL*w5qsv|5EbSf2?7iZFIK+?=M;|S)Bj&?2f2g0d$Pb0nfe-N
z(k)?aKK=i74yciEp!4IugQcRoKwX>{{-D0f0)DWg?!LC)bpoW<3OsC4dbaZexbG>#
zzs;2aBBSvC|NrkdByYb~YJ3Lnfc^socB#m&FN~o1mKU|4X#erQWKxGKL+6i0rS;$W
z7<xlgm>`b)03JQ%Z*>HXPk>@39z0SW{=y6Fdj3{tkSUjTtOYsZFjTQVL~J=oY&}#=
z8dR2uLN)O*GB6x-QDK5uv<f8E4psNL9@IqG=Ay!66I#L%kkOIB&+u9m?4Z>kbqP>)
zXTZv0RG3<Bmk0%CYy!nHM-Ql)d%2MTTDLv`32p;*f{wkAXklRJJl+wb!UQ(!KgcZW
zf1q}4j0$Mwl4j?R7wjzz46S|#O2k{gl@#o{1F8UELliG<dKeg9gmyA8yx!CBdsPWX
zaK;ai%X$ni?f44v=ZC+b*etaKc?)922T&y6oP7VNSmYsyBzJ~tCO^ZAz-|VHs0dKO
z3|ckuqMD!Kh35oV6M}(305p}j!SK?H9nb#%KMq?yfx1>gWi}r}S~u^X$-c*=(mWjb
z89GIM9Qhfb1wBXSu}%>c@YFJBB0NV$VTTCFjSpXf+z4uEm5S|J0rK85W>CHWcdK6B
ze*)?)c8e-F@q<>pEC$gX!5m#8DjmV>9o~~K9uuy&PV3BON;~e%!oUy|n8gqp9*~g+
z@=|mcs42R`;y)h)Y$$W~i~s*Y{h!Xmomcs{GwiYfxxoA)sGIZsC@2$^=!2`d&Kob*
zJO;Iuet`BmFm&E{G57KR|7ooUO6t;D|CdzqZ$HraiGSOv*Ze#A;u#nic6?!GVA%hG
zk%1u~-0)K8jTgWF{r?{s-~5!NL?6-_x$z<fYM>0Lsd3|lFVsLikb#;Y13&U_JNcS_
zCum{HjuMc01z__g?>jE(W%3`CDgwk_YX67$p!rQo#uJb)lR6m~U=uG+FSa*ACTQZA
z8D7kM^#6YbsO-;R%i?Ev0V)N%O?@USo{*9RRl<gETmP4^^KZ`=>#he?H?KgQ^T{D6
z^!P$l^m?5+z+;Us_|8wBaH3HGq@ne8Ni_eqXtw6xO!e}m0j=Lk*!Z`_alGd1mJOI}
zc(RmT24oF;@8q>7wWXY<@iBD9sIV~J0*&|g`lu*$KIjfnk$LfL@~4w(;`v$p3>l!Y
zwB8sMf#4T2z&ZKF_R0FEOhJQJo##4_9{kJJ{J_4GMWvhNErSz3L$}CV7AJm&E*=&B
zwHGeG`gTyEgr)O>;icvWjE0w5FY&j&0S&z!;BS4xz`)S_yS|j&@W9KvpujFs;pqI=
z%?=vJ56)<W+w7tu5%A(2sH8a}V0areR@8ax#hml?pcL17prp9luDb)&l<00zSpu5E
z{b6~cSa25)s1X8+^A}AI{{MgN+xe^W#{bFShDS3<H8Wc$+c5@)ZZXg#H5>mne@5$W
zka!X2F(*cbZZ?NbHc<QHKa=K<?ma4?wGo!=#m$}UFKeK6zq%zGe~a_~|DZ`r!vltw
zz8zHHpK^eI>Y>XIE<fUggaxO_Tb9Wkr`_wVz+;ysqG1^mv-lan&3Mg2LA@@l{{vq0
zgk?+xc@|U^hrT!p9>o{veDR|DG`I!OZKKlp?(-5*i}>{a|J^n!y*ccR$DCOhd%anA
zfm(MvK$YZ+8<1jx<(M-obFViWcx53(X5Zicll{(!F)p2)dd6NU6{1e3*GGk;7qrsE
zMMWT>7eqj6r!AF}kDZaXQvr=&9x^=8{EM-SmGNq?8)JvFK(DvpE<sQ>0^7(4F^T1v
zvmisSx6m#jxXkm(if5%6PfxZzE6uoma^zWQ>B-<_dZjGKoFyE4y(Pg7c8KdLC-<LC
zmKBA_v!xw(=5S!>_2vSPGwc9a_TuMc{&Vt-Hz(_#Q>fqZ8&nE`!f_6^aGZ|_N9W(5
zjwmP`IZvX6<Bt<a;V8h^`4ZwOuw~)D|NrlV`kRIE>IS9`XF<5<Kn)m%7p9Xho|9yh
zp8WcpTK(0|^WC02ttU(Pb}a|xs;8g~a`?4f#wL(U_JRmdjT!Kw;TOo<UKuw2ZSG9X
zM+909lt>0-9LVBl*a1?Yc_AS9Ma-}N{}~TA9}(zg?>yf8oW1cFND8ugFCaAINEWEa
zsCgqG_=OQvrJhLVkCp=^;{4lwgo6#!ycZVyLKG?s>nDVV1vkC{88!Lfd8zt>&eNSA
zo1ZgvJ}c4MbsA*mgBMbu7QpQizu=6sS^NyWQ&d1JH8c+e1-#e-8eISK+NAj)OJK$o
zn18}v%=rlp-qzbCk`PV1Ko)2o3S#^a@S+|f+4<o`@iWjO8ITmH%4$7O;#?1NOy{}I
z%bf>dE|~cbv_K}~4#avMMg|73^=3ao&3hG*7usNhL>NJp^x@_c{||#!O@bEjNPvc}
zKm$ae2D{)c2T;pwJ*a{{dF%iG*G9)#RKP_XsKtG(vqXiX9;u9DtOk!4ffjyoSY9Y%
z?sfVPUJcxQga@+x6cTKmhhOkPS`IC3pmOS1ud`!7#=9(jhOB@WrJxu;zAyr`%+=#h
z^AVorpMOgH(i$s87}-iVx;<H%U$VS@-FmXbY8OK`KSO8zgBR=n{{J7G@qw9vA%i6w
z9NcjKdi;R;*A_Hyaj5x-Nb`^XrEJ}z8yxu=!aF}g^5}y5|Nloc9)SfbsHO}C&G&Vl
zebL<nYTNO*^n#l>eoO}+a(15R<WYH{bOKUdN_O+8l=AFa0_teCfSS7Qmd8riJ3qaM
zpZxZse6oEjXo*fV)4|7_oi|=wIS$Hhr6Rj*Ko$N3_>@c7&Hw)wf>-voFoRb1s)82w
zE(QsJnkJB$rp}|C*E`P{-tN5B`Qn8r)b<js7v7WeFB#XXz?&KT+Z}`g__w<W1Y}rd
z^D|@#_Qt3v2fz6K4Ln{W2I}`6Z9XE>dZ2{;#lsu_|G!pfwoP&3XJD)s;BP(0z`*d0
zMTL>S<p?NdKD?-U1adKd%U00xHQN-BV2ujL{!h<9D<rNro?>8N_yC&8=HcHSA;oyO
z(OM-SFQA0U@HV*HQzFqjfq~)6|AVi%K`ot5lZ(e)F0z2efcdwJfhNL0gMjX!mfv=$
zS=OQ;JNTy_0?oBrf|e~#IjDH5n?;551^<+TEvHHhT5p4TiX|Fh%@02CZx0q=ybzG#
zRiDkz@M2Xh14CLT*pX?+S<^s^z&?Ny5M)00aCmQx3P<ykAOFk$gmyj!XJQdhnwbOA
zn^y~(^kimW=xqh9ad~mDl!2jJ78C=Jq*(ALviaYi5{+&*5taHhTL$J5(dIfChEo3C
zUXXgoICsgv|NpzoSeoClyuJ((H@viC6Ucahf1r;0i<L+J|F;I4%HLcHn*O-);#oZ?
zft7MJ9%kTRV0itIf15MY!3UhI@MOSvqqFtNA5f#LSc>spqa7%KOBIi|zWMVX)NlrM
zy@fmLZybEV0%}aPzWDS1|I5{&&NJ8}h9^63z4!($EDyeB>AZRHp+NIVW@si@;mFUB
z(Ur~5u%i*wAPl?n|9{lW%W%D&w_fZ4>*U{FC&0hmPijX~Ha`QX-NxB@L-oUdeg?)L
z-Frb69;|;Z!1=TJ7dUGzapY$R*a2$fykNZpYBhrd_|+L0BKWtLv8A<sD=A^T_aE$j
zsBcob!Mt9N|7p#2QVgYyY0Y(F3?;shxahp~!VK9NVmm-iMs-F#)E!990C_F|;<5VM
z|Np;k>YfV<#+UV=#g?gGKwazJ^dFFE`moMpJCt(x8D9Lo1j^N*d9NMDAimsX(6CnL
z)z;f3Rgkqpt(Qs)z*FQqz(X9qH^JjH?5zh%d3O0&PgcC9USEC%6kBZFJSw|DtMXpR
z<ufpZb%R?;2VZanfCu+oL8jlS0=4)BTHltkwEiziPiwXlC{5hSz#zcT`3pP~{^INn
zkb7DWl#1-~0X4u};6=u*EC2r+Udmz$4S(_CI@rF>o4aB_(OADekAWeq^GD|^{xugw
z4!#lz3JA`q2icbkwod_3rZm0*4YPk^ZK&sGVBv2$4T^dnm6+ZTm57BVPW%iGy)h~|
z!M!mmDZwwo^1+3BLS*y`j#9pTpw`I>#!{}A(-;^S_A&Z~dG7=bdhSwS0Bv4;0vi4i
z0y}=OffGLiWSBFsh=Cz2AY(hoEsrWe`$U>gFdAO!{0LeA1X9*~gy);1EMtiq|Mp0!
z9iVOAhL^s7=HKTj(|P#v>z0$1Y~OEQe$aV1IO8hFjCqxy5r(v8ThPR#L#aUKVNj>M
ze%EJ^q~G2D|GRiCo%k7APL|kVv?v#AfTqhtb)5Ja8h+}O$u`=$IPo)pMlH()4G(~2
zkF$bgK`S8)FYWjPGIJByN391+LJYrki)@v#<p=eVWOG4TxWv@0`5$xX3&VPllmJAE
z86u?wkqXZEW5dsoA(YF{@Zw1YDDHV)bAzj(*Py)>f(sp-_!+oaK@Ne8Wh{1a<Y#EG
zwEz!Gau~kt)CCD-=z|PcT*1Jw>jw{Ll$(K};r-iq(2D+s60VGTzg&KXm)YFVjyHHv
z+v)-+9UXH~$pLlqa|{o>V7UMPf6MJsos4vlVc``F3@_@Q{QnQ$F0dH1s^0KqCogD2
z0Hpkj_!IY9y30i+$L4>@8HWxRl^oEFOo&R(i|zOR|9}0o`S+g^k<ME?672Zv8D6YB
z_5Xi&G)wbqme<cSnn4zPFK1v_2pafx$UdO);yI`ma#3LcEp`#v)dNb|=U5mRUT|Of
z|NrHGE~wJp0LJV~8lYh^nF0oejO8G6)`QFeHx45HL^S{Y!{73Qk%1wtv08+Mt(1>{
zo3mv0<hOSuxmB7gR6v8(H7Y8T1@9`=i*z}IhPU^DrcOXhf%id{0$X=}>iqHIOg4Cd
zrA+f*wo;v)pt=_<Y@N-(aNI>j1S9~S4UjnQq5^7KFo1b1uamyHsK_vuT7p&;H9z2J
z{=p~-nj_<Bc2VJBf(WuT|6t*ta-beEd&UAX?!$jjT>x4a`&tad{{!cP=f6O+4JZGD
z9k4r#fdS0WfjCeHyx!ITw9W}EJUfd4v^<uDp(MOF3^X~$0#PT^eDXg;pfZbr0mKUU
z@!}=OFc%dQkZzFBj~B673=G{NDkh*srre<A&Lt`$&FB9seo*`c-D&Zf2PCKLq9XGB
z2B@=H%F=qE#0|6}ck+aLvh^&W39F!hpn%SoowvGORBT?{xCUy*O0*u}Z~4f<z`&fN
z!s6QemyN&A4OBIPQ^d>vfB*jnCxuRsYgj;w<2<rmR7^CwZB!VKH`l0`F!1+rvM?}o
zyMxBRIsf~pm^8oFc>T0nfPdSu>;oF0h3Owa1Kl>zNG?&a;op7;6ncgy!Q&V&n)ZNZ
zjX`slFPv}x2TeliwA?On<llC=`4CgLy9)nyh8JHm85lYa9eBmk@Qb}ft>G7232VbI
zmQvv~RR%`>ZAa2TOKw5)RVuHwj=89)Fc=<qtq9R-cybpH0|P_-3z<Ej*-8GXE-EUJ
z49f_Le~0E86$eKCDTi8a^G`jXc&H;p#lJgV#qcdCwjsqyXNZc-CK>*1pZK>kgJ(xO
zKfM5LwCCT>-1+H6=WejEEw@37$ZJ$|82DSZfI9bonfSNGsOXd!^ag`g8`tx^_@4n9
zlkE)##S;(MgwD^M#~k=uJ3;Dy|L1Q7)x)o=dV@g=@p)dH2dQ^aVd)K)00+)~5dT<j
zund^D5ybo4c?{H6YySDagvYH^)VWls^R(f&*S4TGgGKZ2|E0#SwKH~u@?!n{Vg`nY
z*K!SDC$?tGGcfE04JLuT$)EtqB{GJ$UmrAln|&6vmEy#U+Wp{l@GPLw5zrz$OBWTE
zZWk2}X%`ilV$e!*5zuf2DDQN-sBm<ic##Cr09r07(fpUGgd3dqWL`Fb_E2=YgHn$S
zXh;h*x%T2yIyfV{v>qt61DV0UonhyP{~!ME0?S6FgKIE^^21Q&P^E?^A?l1E>Rg&1
z@OzX_>~>dZexcC(<3R~`bA<#$Nkg}T!fQ}e%G85A+xnJ&%0VR`75@$&6&Fy%Gn802
z+k%Q|2L7oBT3l3QO0=8*GL@<=1XVcQ;0lL-%?0j*ueiZ}_fg@HyjaWu@--+-x<ICU
zWNh(KQ7KUZHFPaOD-~T-B&1zbIKTk}?p=Xb9oC1aNLa?GfMQlc@<XxHf0MPKx#Y0m
zjE|t`aVY}TFaoV_OM*IYbbe|+@W1)ef6xkaVbG=+9~BnE+uv`37K|z$RJ`1Iuk-Y4
zEs%wvQ5v{f5n<38N@TSs6mNl+Rd<K0{I4%jkpa(`gNlK$;O3M6yIoX5Ufj6^F9W`U
za&dsnf0L;YhjlaXZ*!0g$WY7UXLzx+5ad1)*XF;>{4Mf-{{L_O%f#Qh`S1V#-SH}@
zX=szm%WHrB|IY{n>B}tyM<dG%ChxtI?>`b{_W<oYlJ%MV`;ipm<jG=>RqIPZ>KF?d
z7(f%j3<v)GHwD#X|4l*lT1GEO@<{>6at&xqmAD!H@2pYD=&VsG>1I)BKETr(qLT39
z+#c{8Rr3LfUQkW9AHsd{dk;7bgSt>E87K1i8D2|dtOQYlpt|brp8xfrg<0!fx-&5_
zyeQ0N04?lFco7BB1=^OV(d(j;^THD%0L}`%E-DExlpq2+psgoh6@m}}lg<zo3viqC
zCCKS-kN^MQZ3=2Cbc5S0?v}?oe@b2~W&w3s!KthslFUE_B4}AEELK4~Z0wsafffnL
zbcU!XG}ovIFqCqGigO13mZzW|o{I`-L9+%-r78mh!vRo*(H*0r(D)F<V>~DbS|Q8=
z+9LrAJx~q816ml%zvcq-!B@=npnZGI2md!;{twzVB^;x|0j*HLNe#4<Dh9k?0<1~f
zMTJE=M1=#z8%sb-sa;fT_8tH&v-VM8>5ft1VEicf8?;=zGX}is*#?yOYYn?y8M;GR
ztX))iIxkB5s0bAE88W+a2#4}O3@id|!4PRaD)RcQc8Lm$bPd>Mo$e4714uGw{2=&i
za_dtS-h|E&m6UF15KP|o)TlnEGeo6;*+oT0I7CGO92h|X;b9q!`TPtoqCjV%gs7B&
zO0gGN*Z=?TouUFNY{C4f>!3U!V))G(JlkEb(jBAX(RmA$KI}nKhd~9lNAm#{%NwOH
z+?rifJTzWkfwi>2%^J{HLOuU>XHZ|>Ss)-dLl$J|vs};yCgWY8wqECl7q_>7hQ}{7
z9|5ff7Vo_AUlg=?lYiR@@CbkBhZmp|U^;K@SYXG`@WSiB|NlFg85tOMfrcA9KfIW;
z|NsAQ&Jv6zf;&N7a`3j^&JQnI_rn@*b}x%TgR?9uFCHHI{~yVDB}$z)UhLfl8X73!
z56-X!In5^*G?w(b8rtr=xiDg~$#aGJSdg4(E(1g4YuDh63J{MS><Q+b%%I6gkXv5-
z*!TZ`L{v9uCvk~<aK>zqs)sosuQG%8cz~Vu;?lnV|6d>L4N(D&uO@(qn1Eg%m6#o%
za`*-4z?=BkZWon=?-y1o2rw}4x1M2Sn0)!UU>Zn4>wo^14dA&j!;?GygL0<A@&Eq~
zzjc<V<aCy(6m*M%Hp&_vaOgaE@S%X^sUp^6E-cw>pk2Ukx<gcQx_wj%b_9U*y*T#&
zzv1o97?qsP7?px<UXVUe`7qh*g-ks}T?9zoN|3rsh9`GKf_Sr!{r|r^1GIS)v}Y=(
z(+8#%w2FjZm*Imtqv0hd%Yz_$MY360LG6U*UmT@y%R6tp2tW4!zjNd70wxBA(jC1y
zDlwtGB`PstpfCV+*>-@c#D*7Z5<tD8-JmM3u|_3;oq?gDOga>yii3fn;YE7_Xk02r
zB_b}?@LO+-8E7pksEB#-<>>$ay)9;pAeUY;Jo)0u(f|M5EWg*^?iK}=p55R+!48n}
z7blN`3L>zmEvS6;@3=WR^`&}!|Iz>dcY)58frWJ4QBYsi@Z^p|ponch^#6b7MezFh
z10_72hjv(jdaY3~HMc-&l0j+?FMa}Ao=~0%N(cum4;QmS1j_Ol7#eLsa-i-Se|rQA
zXrB9k13!aGfM?LIdQdLh0ph+`o5aAN!Fu0;pP|{d1GK!o)HJPI_Lu`dLt681`7#au
z?Ux}6Tav(wHpKb2pWX%1x#Kz56*vC>UkuW>1GF3a1=mT?x;b!X+yK;N0rhuZ7#{im
z|K)XN=o0@I-boDg496J)oP7h1Ik2%Dci?dHclJ2$z!U5o5W4SmK0gCE+4oimd|nFL
z2E_2-U$2i!L~n>n2&fJKCF+C#P<mx}aU>43BD=XpC4`|==(vkY2m>3qKav27o7e2$
zTvU<;O4-3nE?x_Q7D+{U^6x$AxGw>e9WFmxXu$B`Unh%7Z>>(}Z^M(;yr2Lp_JvLC
zElFfxIL6G-;mz2^qSE2a)N$g#3(!1%w@B-O8h(b$ubLk*ww~mla^T_v&I=vR%%G~h
z(;3uOOPHMVT3Q6u2V*Ev>MiB~uYu^i@xmr?^6b~LBC;TZ*%&o%9Q?rys)4#(RCp#|
zcrD5FAz||C*V6SMjm<AuI$2aeJE~;BUQz*Vpl-HN`NQ9G5>ySbsB|-c+TSc`2VZdT
zw}J*A`M1}out3VaA1@5ngWL2X{M$}+`ly&dO1mE~B-evRYrs8-l44M;r~2bR1B11T
zib|;f|8^G@nJyoddJ+D`CyK&ebAy`qP#1v1yURyK<nn_wP8Ss!n2$6Q7#NN-GczzU
z9CKy?t%L-*hxy<GCXm|R!2h6tVLj%|23lC)%-(#M1GMJOfd%5bm%5;S9Vq|*0Hq~c
zP&@Xx;YkIU;b-F+7<MS|F))DKV*s*-fdL#=8gES*c_zob)vjlbQPD~3j8#hO3<Yh8
zH;rdt&~Rn%Em6q<_i{QvyfBIfhhI*-Z$Nx!j!FT@LnVwXVCfgEAoVUPWnf<ChZkSt
zz=^zuf4eIv_?r(1*n$eGGX8)Jt^$6B7forPg5!0}i|I!}qXn%>2TBEZX@CZ{y%-o6
zUd%i2|Nm<T(C}4BScV-)Lr~geop;jp9dQf{8qQqZTOjqHkBR_fRn?0Zz5D<F-;n@P
zx_B?h$Q_j+_H+>YSnF;6mKBVkkrV!w1)v2@;OWBVpYr_e6G3}yLsW85XBeA*$n&=z
z0<EE|QON-<(Bf~61?j7AQ2|w!oh~W~;9@z2e|w8c6KJH`MI{DYHnymM<|#pWt0JH`
zL?xs1!;6wDpglUEeyS?Sj1ZNC<{Fh0hEncs7nK-W(7LBGkzG6>zdM3T@3d3~hL^uV
zW=;WHmevWe0u;3M4B*CEODqF}hKou8|F#g7!sb^3y)G&>FY-ZxEh?blRj{I&m;e8N
zxr&>Cq4|dde=BGf6tbXfQUO226qD7UN|nF06*3f8(Ho*tlf{q)TH1K%^8f!)k*x<x
z%6Ea*0)x%tk7Zz}*KkoOY_|0Q4HEIU`f)Qbpqcq_6~s(qZUzQW2ePR17FhG;7*KlP
zZ<Xc-Egl9{VLN7k;%CF9|Nj?*jC;w*&A^bc7$g>w!oUy#DF)3BgPXrR;DS)bn!lc5
z2L~vOa`yfI|MCJCXdJx(+(PGh(G<hL0Ip&qI!jbyKz&S5EV2HnXJ7!8Og<_Rph!so
zM~dNr7oYAxOpcFjJ;2}E3W}H<m4x0{iQ}#epk-j4H^EJp7xf@@kV(Z7g|d1U#>=k-
zj=M@Y<tJx=)<YCC^v22|R)uxAvUJ|u1)AA4Jn+Kx4yY<>{=rzH09yam6{5n@{DZNK
zh4Juf{^QID6PgdRb%e5}9d~78c+q(ioM#OWykLjxRzm2mhiDhvce8+>0kTQ!{^upl
zhq*gKIgYt<GW7aFW?u~tyf^_~kXI@QHm}!}>jmh@zhkak9KF7f`Ch{VFP1>mu%#V$
z6=GoN^%Vh^*oFsQbVDRqj=733_WFwM5@lduFg)<01T?zcdZ3i$n5!s5udmoHF^G69
zT)Ei)USIKD;t*jsxUl&DW6aRuBWCB<?8lrL8JZ6>{dZA`=)9r%!qP=0rWmv$HKsF0
zB>`GTCHyy00asJt67z*CXwmDjgve-6bY+2}t41ZEH(vTUJEJrMBQ&-kN-u!cheD%F
zwhR(u?$U_x?u}R6zzD9(I^1E=1<^U}*5vk2CiMvj1Ikz#FS~Vq=x}H2yt#`VG)oSu
z@m|<rQNiAu&(Zl39NZAoByWN8LMaa@<1%!<c(FB-fuYx50-U2DD!$(Yt6(|iE&(zh
zw8(!4BWO_j#XZniKg17kCrEbQ1TO)H=-q=wh14--&>RhB5dR<$#GvN!i>)9Nk4Hqs
zgH~GZ2L&-GHi|`#Gc$`YFn4|gXNVnOr4Asa5a*SEg815Nf#c31kRWzrDQ4&`mfFAw
zGJ>JQnFYSs0j!nv=48Gv;`MJp!`l!O%2*k%xr0_lvUPrhgfUp*DJ&}3J3m4K7_4Fi
z78M-5-kjk591w@L-hhU%Gbb~AX#z6?gB-()Y`7E`bFVk|F3^@oh^D|BllOd)kTHiV
z;9=_Z=H0~$ihi)gvNtAw_#$b>1XqBxiUO<vG))4|C(c3)z23sRgyCAxU7u|KRjxjw
z^MmFMq(~`INdT{cw3G!kor>HrG6A^na`-x=CMi|!E>TGUZ~gdu1H6DcqVtgEC(96U
zJ_=EZ0Tq4DuQwrg-I+~6ormV@44ohN*VO+2kA1QJw`X8D_=B(WD29CkplUee`v3os
z95)wKAAROu^IHUD^Kmu-eg=VFKNd)m0IR)w4I0vJER4N=(B&;)nZs}yR_0zm@bZ>=
zh8<uj&=O#9IJvR0ftJ5DH2(hoU!I|y71UGV>U3jIJMPB)?|)in9&g%lH+}|&=3|1O
zQlq&>B}Sl}<G71T3~1>`XNgLJ;Wx{#y)G&-b#c9+|969y<Xe6!<pV9c?T!E6_!#6<
zXSgp@OjH6OD^!ZF{r?{inj28<u2D(o{0LrQeh{)M9u%m*Py^NN^(@eE&3_XWP<Jq4
z2Pk4+=wJK)KRT}UK&cC)XLs-wXq+rzvh{c6`UrHVx~L>HgU3=p=WW@7hE^C#ilJtL
z%e!756{xv8uR`4x44$p&76r}LbROhia}jL*aRy<2M&aWQETHXZ2On}Z9{m5`o}tr&
z<G2G4g8(DLF$Vz#_vQmw1Iz_WISXDZ=ynzA7jIO*sQl2f1N%h;66~NF0hG#Melco>
z_@z`69>^vty(KCMVUP_9C$CKI`C+XKN`nVqh-e;0R^_6S5CB=Jn0p1%?kELS;0cqz
z{BVH;AeyC&_uXEC4hQItQAs$?tia8n(Cf?sUN-f@H<$sj1_|72>c0$4n9f`bX~&&G
z4Wh%mutdZI@eL?zgX$i`+eq#T1FcD{zx@Bdb7VYp`{tu&TOLr`r@|1_`R@)<iRkuG
zi8;<t&%#ij29Am518h#6Au18gKUpD0gO7=GQAy|qRdy_(a|05zb5uZMGN4?_!oU3}
zXn-}X@oxlEIr|H*o&W#8hU`J+-+pz+1IK!Ph8Nm9Kn+@O8|Z@-Kf?}1P~NoN^8f$K
z8K7)=9CS_&|Ms(=m+X=UHRV79ejY*4#(J=CJgA{wC=WVKq8QYtVgdDbN{+jz)Wo~^
zdLC;5x1{6KI@drNvU9+V&TbYJP`k4OR2dy>QR!k}U{C?qW8l`@?LbKT6V&e91zJq`
z;v`4}sqy(4G;j#oV|soQ_`IQn9Zx__yUQS-xTvsz8pD>L0b3W91W?DV`9VD>6iP&P
z-2i#;7RZBUkqitkx$7aScn-c`?`1g(E(JM3hJg1gK$SlNDc9fp|NqOo%nYD|5)3bO
z3V`}#y%{V!KvQ0zVL#A0C!iT7Mo@Euhre$=NU7_e<{!-bEzOJ!4CTV0mYPiS4<`PW
zn+yyLFUvq{WPjAN@VD#%9f^?vQeSJ)>;Av>2Y>5I1_p*MR~s9~625(R9Qhe+m`b=_
zg0?a515MR8)S5Fu+SQ<5nndS|7q8ZXcVqX;-0XA)`(6@c9C$ZI>m~jcZe|9C&Y#Wy
z1&Ue0YeG9eys+E`S~A<pf1s3q*8xzVgo7MaH`(})Qhmb4|Nmd}b{2y=f&Up^Ze(I$
zfT#g2Xn8r8iGiWJwg5bNk<;m-QUKn$@nZiHkb%9f7TqE$FE)WVhguJmShjvEG3|B(
zO}6QEM}dY~Wm<2SDD!WNE$RHpc(X{d+sv{L)aNPU@AdxQ@RPlqy|>=`f9uT>{#{Ez
z&I0u}UTQNjFfjh;tx?J8Jl1*h^OEiw6&c1Fm7L}fl>&y&<DhONNcbhF@eXl~5zGN<
z-3}nj<-21ox`nzofvmFpTrAKXYSZoO(0QHld=ZP~zheGf9U#j<>HX!tdeFgThZ!$)
zo_b;F&%mI;{Bk3xwNhKq?OFml;R50F&KEDj)`2n))Z2R(gO>7vQXgpHFQ{7xI>iU<
z0{#|o53jVM6SPRU(?>;x@h5+iCnE!cCAhc9-((B2M5x<GrC!Fm3*=7zX3)Ok-mw1-
zzu5WP<w1*VKze%v|F@pvZ{=rXU|@!v0RcItNC7nW13J{J(?tb5+S~cThNDFD;6u=W
zhYUypb=56s!7XUf6R5=t>Wenpf_6+Wl<?Fy?gn)-TUYQgl!)v)0vaEB23j`vE|h`c
zCFn>N{_T@Ni!DHT^?!+qO6SiPk3&KIvCxW0%R{AA;3Niaq(c^#Y}*V<8Lgl$cm^nx
zL6*HZvHt)6*Kyr0DmmRDDg~Wvonb66YwP(KN`!Z<0olt8>W!6$f_ew9+0(k4LDr^q
zy76?@adf#>bhz>Ly7BMY02*40n*IO(YyMqe3(kTvtYatxL-X5)mw|u4GaoM|tb=UK
zdC|V^|Nqy5p#1xyX5Ih)py?UVn9Xi}27ZR-#~*ey)I0GrG(Y$NI>1Cmr6{`d-p&Rm
zeg@5(-OQ#z!7d8j!7PoR0z!fmI4_i1HvbeZGXZyNI&XCPsIa`?_67AsOBEWb`5DWU
zyR$_sb5vN01Up}K-gxoe2Xs<b1xw3;63*ts0<RYs-ZuQ!Y1&c8&%hm{B2wzV>jucv
z^`MjU8jpbd3R>FpvN8k|xFIS!&4)n64$q4p9-v<LfBu$g&{o{ThTpKvRlclv09s!O
zGX%VZAF^g~SNluQinmLU6>pH%e)h8e|93TAhltCa0xgBx0h$+n5xfl4$=p$Nn2+Iw
z(Wd|ZcgS>2HoLCof7ph<j2}GZ%)jlD;ei+am;e87c+6kI%fIb1#7NuA|Nrj_e-AMd
zVj`%ndhuZC|NlD}Y8e<_%<^VnSPa_Lzc6C*#_KXnNhc<szb;wtegZV%An;lewh*Ji
zfuG^UwxzJ4{MXNqv6itgFdW!b0Ch0LbkGLC7vW36?)?g?4S45(vS#anlDO^-p!~E8
zw7Cx4YvAAR#KXVci;I8#LH_MteEjPV9(=%Qd8~xnz4?$8SMz_)(tEG9c7n#OJ3m2I
zFRk7H88GE<Wd%(;6o3{zYJrm3&Ncu4zsTM3|No1O9g`Q{aM8VFv#L~*fBV6-<1Gvv
zEDQ`4Ovf53SQr>Yc7eKfy)s<<+Ybk1XczJ`ykH5MEO=ASo^uIk(bI*_%R7F6lKZd4
zptZiB@m$anpck(ZT#)P?DEDwchCRrP<$;s)Zi?3nfS13<#~#jNGQ1QN*7?Hl(u=d8
zqUj?j<v~`rgSLSm;O}_y@BjbKU!5;rsDj4vj)6+6i=c&M)hx#t3_`;*7(m9_1u`%+
zALa|rkSheQWvv3Qx(P?D^X;usQ3-$13>ruN)A^(RMFprnIRu(nXM-$B4TddAy|>~2
z|A?3Qp#74pG4=cmJ3z;$yab)A4O*Sr_@;#mJk!n6>!K0>IRZn~6Flew>ay1yb5UVt
zF#HC}uKe2>Izg=&ju%Q>{{MI2ZvkDEv3Ws5jS6!;LkZL74IMXnL)qTFi1h#)$dk!x
z(8bRHTAIpg@5Ilr6Vw<6o#em_YB-$p01d?-eQ{$m*r+X_O}$|4Z#rC5cs7LghBCd|
zu&Otd`CV@))0^H<=8l7J8h(cIPd#L_iht?>jtl&)4J-@{Rxv6({H<l6W<-~Z3Uddf
zxzqZMzjZfg^w&kDCaqf{t-FA!`54m%zRpkYK-YLMyh!z6VA#L~;)15DUi^0l?IP;@
z@q*I>G>TZt{vywpf#LN#{_Vdzf4sOEz`)>8lG%Ki4dhjZ5+_LZIR(-La_ff9TlMcc
zf4n#dR_D}t>y6EZ5@pa3)r(#3AoEJ@?%DxLutlH*``w>`;kE3B1)aCvHPomCD3l6z
z{@evRoplF@cp(|Uz_5X%^V7SX3qg%N$QU6gYF-F#0u4#G9w-s)4P}4Ra)7@DbRNvh
zyPy$HUL<v|H%#YeVN|SNqXHWFYkn%fv#AI)OYxVrlyzry5kJE|P?HWcvZ(^9(mwGo
zzEH&KSNhHHTW^SpdRli&%`OH8hPDT3oh()E&HqJ8Uv&DYa2#_{@n`6~@Iqzk|No$6
zhhe=TD*8eE+nfyox}A0Sw>fYGWONpR)9Q}1p!%jhAY*kAKf{Z7KhX5JN?P+@R{qv$
zptcK0xwirTwgC2S2Z0w3Al1hq3kMnbTW*79@<3gcUKbUC7p-m#pgk}mFJ6R$0+PRV
z4+D6MnFP~u7Zn*$-w@mwPyn@or5G7{*QkK5c>x_|)msnJUkKF(S{&Z62Q0}@TGQL2
z(#piZu<Il!ryX?!nOvHF%tZxaDyZj*Vk+1;kZH<b(@Jf6TU6FCF)##V>;)|}mwR#Y
z45)B=!94|3aPqXiEs+Wh%cx%u35~TN$zz=_UYuG6k``$G4_ex4yT*~9A*}Oe=P&S>
z#LG%h<HJXV11Tl^@C7A1>7AfWIlV~n`w28Pajf+~2^V;f>tzZk0U*g=1{FJpTk8*$
zJUGUnkapZbih(JuyF~>Q25Ftnav(OS!JpRYEYsbh0y=ajt<zcITZ;;)xx-Q-(A}cq
z19Hw3l>kNthS!|kEh?bJr-qk0oq0Ng1we;~@vnK$eef+ecvr9G&z+$4(ULDW`WAEZ
zuel(4@Rexi@s0KF{QEBMMM-KeLGu%=zNOy`-}d%^BO|T5r39YZ3f-FjiIhGCtz9_=
z31NoL6EAj5f+V=`(B2-E2}}$OfvAaYJ0zGrPJ<F%^AQDTvU^kS&A<RonTVuz>lCPY
z7#R;OB|*!2!#Zz*j@4v%v3&La{}JH)U8)5NAv@4oK-I+iX||3IB@*C}e$5V&XDs0Y
zm5GcmZ~OvP@SxHY)JlL>@G+oyVbB5)j(X5qB+wKXXh{iEE94M$&|ZAdxgD&f4|gg|
z<6~%iIiZ)2VHb$lQShCQ;f2W}&}Qmg0t|c%JDxc5GrS00_5c4u5DR=v=7HuK6$OS8
zQ1?=y+oH2ZMd9_^#Ub_l47)&0q{dea44_>r44~bJ_09|o;D%G@p&g(u%nP1X|Np<(
zGWq}i7yoyIyUaX>2X+Pj=Vy4C!~)u;Xm}F5hkplC2|vRNr`7-eXE7R{+{M(uz_0^6
z?W7M9Vlq4l?h)<)&#lU=2F>uQfDWXEOs<1E+AownLF+~94NpQ8X)gNzzgOlcD2)Uo
zRP7K2S#xLA|Np(-9NjG{M;I6w4nANGfDFT_fh6~XBwJKKS$-#|nBE1RIz0wzd>s+l
z4H7Z@1}er@fDZ3DR+|9ImY~uDB=e%O-h+W5EW@+}wo7i0$_oYthVU0Ihd{MG#Mppd
zZziy*oj+a#t%8VyJoDlqxOQp*`>Z!cg2}D<h{)?Hy)7yryC9BXY+zt`0lNHWAILt#
z+i;g0hPb1ifxj2D=?yY&@x~q0hHOz;4>~@3kIFhwXp|cAZ=a&Ffq{V`C?Er|oo|l{
zD94Atm~-&||6V^fkhvf?HNRkctsWeZ;e_NPh{9s9LS}?Q=73#{4WNmUA1~@wf(ji8
zklY#u28QMrY%kcMegp9tk2$||{r~?zWH&cxfcizII|D;^iwa2gg|h<#Lnnl7c-wjo
zSg_a*Tt@Y_sN4ZnXCe^g5H?8p!R{$44?s&A+dlDcztr2J0@_R%Xn69)mlgm2JIB4=
zxg!J=xzFZ<(jb2;sB_=jq5@i!2yp~6C|sYqfse2Ti87RUf$avdixa?2eVE-d-541D
zZvh7vD%IVh^1={Q|4#u+zOY{U|G#td5uVpOAoUDOi3IY=9>4z^UV0I{czQQCqh>v*
zmC^|wipydQ3NSnXZZ^KSw&ef+|E8b;y8qzyQW>!zPvp9T>NW|;;K!$VARm=Tr5y(!
z55mBf0h(pcr~@f<aR*JnryYj`8Uq6)34w+?V1Bvi%D|A;yho)T6p{@5EiQll|KBkU
zq<1#hT>e%gkjOHSNGDW80VD!4<i+EqpwbV#bKnVRrV*6zUMn1D_`%G;ume=Wzc>g|
z0osTqvg-m!#S~EFfo@fJc?)zTJXj5rJp+SvFZ77EU0}<<_x%5V9K7EEWDn$Uw#d1B
z44s=nJsYGW+V~k>PMZFfhf#)U%Ju2oyo{1eFP}|U<7IrzxM4aMA7e3-vF-GFK1O*a
zA=~K-_!y;_o-LfdhmTQ_iJ@lteLhCndf3*E<E)@^8MMjcI4h`<gs?!HtU#<?sh}aT
zgUt{5I}aax!P5MbxkRVoF;A&b^H0VSspg+drOKV6AOl`YgU&Ay>l6i<`<ky4yiMyh
zTc;?<OsD2w8KpaSCA?x_Fg&?q7br~Yr_TQWf3ZV7=%}(CXF(#apuvR0pyoL!iymi9
z0PSo7*?!#cB)E&kzs($cVFhpJr-ol#rOXZ+8QovMYB^cLz8IwTH7i)v!3Rt)k{A8|
zzZi6sR_lRM`CU^$;m^&;!0=+m-2eYOZ@f4;=l}nD!vhdq?itrXw!1hpFvJ>uTL{wC
zYqOzKzKgl#Knb@E7k>-r!XW3@?+tHvv%lEX`Tu_>yIVk5#uJb(K4(yZ1l^)=>^Q4S
z7eB+BtNaY$fxR6LUHl9$9IZjCSiHLU8Fs{9;b%x&JiVTuA?-Np%zDsi{vRMJCx8Ye
zCBQ1D)$=p#I0#l53(~X~%uMX!XV?WArQ8t!GW4w#$k2%C`vn-y>J1M(<9&8(!+~el
z3=cfJ@`A~Vf#DcyVm&_tBRDi(c-S*AfU}h0$sKP%PJTc0|Nljx10&O#c?DP)7?^f-
zqjW35RZ9Mp|NmdiJO2MaY==gP_Xd+^&V~n`IXrXN(DkffgW9vg4c*TQCV&1fRu2+*
zQrL2UzcZDQfnf)z4f5iFCFn%BmtLUy`DAAgxbT9OI|03Oz@>0-Zx5L6odPcC3=h0m
zYR1427vH=GynC6UL>Zb{1JG1Ld{$uwTJ!L&1(JmY_*=aG|Ns9avEwlKlnBOWi5oV6
zUF@`h<Czn`A!v!^lf)GYCBOI$J1=$~>bUVN5p;&F<_F1NoyRjz&75b(umePVf6jP{
z6|{$|`4R&^WVvsbEa<Gf4jC20Z~OoM|Ic9f7IM64v50f?0mgcWLdJ`)AkCI1ogZ6H
zmT-2!G_h{yW?<O81H7x_`)AY>_rS+I!_V9c$oK(@qACXlhWOZ*)u4{+jTfsezzt^p
z7Xo$+46vZCc($S8S;3RSj)NPTrpGffN{bxIzGTyJ<G>3R{%r@c4{$X<=4ZSyy^oPG
zsa|Q)|NpxxQ6d?1u+R&xN&o-9U^fDpUc&k!|Mma>87!sz3@^Hnl8h`!z-IdY|BC}a
ztsYR9-tgoOQ;?_{NYn=;$^@F9KDomOBq{(B1#L=%CA#E#knpc*|Nk%c03~!M69xvz
z*1{bO3_J`k8q66OVCxg(KtmwPpgSo#KxKO=2XsZ^3&WFO<2rA=umCM(NzJGL8T!Z$
zp*0eu)fcpzq=C8Aw)4h|*PxaisM%g`5S%d&q<o7Vs0)m|cyZ|jP#Z*eC&*i!A6~ow
zuVs7<vvnQR)*ZV*y36*1_I|wJZ~y<l(H6A35ajw2uH&pOpw(#%Jdks!z=b&9G|)gy
z8mK5+1zOn0zx_Z!#$k{lMs^Gg-L{~PXIi%@=vI)}h_uFk3?E8)kF%(xe&A<Fv$jzw
z(c#~IJb-`uv4D(wAWeU5!J8vXy7(E=I!(*E_!*9|&ic;B06yGIEkmS?pW($#Tkr%0
z3&;%6*g@K2u=3-qWnCcWeTd)j@hYhN0b6~X6=XHThqO-FIiO=of|)lkzv~TV+Q9hk
zh1{0^|6hF52PKM9t`~7H|Nnn6b?X2BFJA5c{~sI&h9@B{R_&>vDB^GVAkM(h{DY}f
zb0PTL(*q?6%@z!$(it`&XF1z4Fw|#cgP1d%K#NRY9uj9@*mZ;xToL4g#Gg$0|G%>Z
zyvzq?egjDS3`87M?KSTKOEd6y<cfiYMqg~2`v1Q}={LhmJ0^jYCV>aOcI+w!9kf%z
z)OjNS+*5p^>IB-TR{z3q8hD8>s9M>v0;ItRq`^gnBPtTq3uS0MP^#EF1>Dx$u^l8Y
z1d<0$iSV}^5ruSs86l&*pw*K*Kxf&$sGS8~@uC402Nir^@l=SoOmmHj215x;>w)@G
z!CeKQDyS0F1jw8A|NrX}@L8YTE-D%?+D*V?KN`mw!kk=<Aje`rnrAO^Oh6}Nw5VJF
zHD3Kes+%A1gQk%{Q@bGU!51tbF6i_fXwmvYZ7O)wSEJD)%r)4tL@wi487R~3w`O37
z0C%!^4Bvujj+Z+{7#JFAR3sSqTbWoG7<OocGcdep2D$!dD`=Jk?B?m9SrQM(QeubB
zRtJ9YgiwRU{}SHgF5tcK3@=wQg9V!pFd-CFFy1J=w+qyc?v#G<f}<alRv=nH!<H}0
zK@&7DUMNpb6lE0Guz~PcT0z;SvsEFS0kpp3Ys>%tovkY23=Euy8y@rXw;E1gAj&9G
z&(PWG!VgMwEd2fdm>3wc5AZO)=zL{)p(MS#7v#X+NXE{&AO`<7$<A33{0t1ekxVd=
zLdMR|ott7nf|bmjdm+j^nL4`?KxY24=WkDwW?*P|%){RrE6u>re2Ay{Cv)8*kY_=K
z=F55YppgvFj9TZ57ealIAtL@(7SP`J7cWd&{{Qa=hf=QxV<*@({M#5hTRlLA|6qoM
z04FF+!<iTudZ+e)+|l{~a!Y_guOlNQ1o^iycDksDbUN{Lo^C$K1T)C-e}{`oJx}Mc
zga24MOH@=q%j()e=XQQ`QQ_g^Z;b@S6F6`{vvZJW?k-W$u`E&HsFlbrQQ_bLEpfMQ
zF$D!m2@j}u{Q4e$OS2RML$(V@b_**gWIBrkx?5O50n+It0$Nr7{f26bAOk~h3+oR7
zP(KH>Lyo8U0e|xWrpyCy83u+<Czj?zGT>`9S`9%Lh&eMuJk;gP)EmswITaM#UBS$~
z#jKrML2NE(7XDT@@Vy%L{H>rFq2|3a_!$@&`CCCZI5h9w!q33K#NT=xbmqz43;YZW
z%x?UxyTH6T{0t0A{H<%j98jY}kiT^Sm~(}nfkBYJbuws_cd7#q14DN!=%A;A57<CH
z;AdcXv7>4FJ8?!y*||;s|MyOH-~%bS!4K*Y!<95OO;?d%v}N2nJxPMmy8amh14H%+
z8N=J1b9g)W85kU1zXYWTP}TPuw8WPKG}!+dw1k2KwDJWsWS4ObRF<qZ2X#fjOX+xC
zzWDwBKV)jY5mZOGs6dwDfwS6DQ1P&R;{X3I4}gx|ZUL7^%|A@*JiBdFrVB_i%7{h?
zb;g4xDZ3rS!0F=$=%o1Rj*^U8^^E2G3@=#CK~18UZXo@0K{=-zl9^moM8K&56#W|f
z+Y1B^K4anE?!d=*3^a#!@C9h(nIo;64K$VQmF7^Y{=Y;;BsfDGWadUQ28M9Zv{!IO
z42Zwb4AkV6dHML)|NpS!>JDgL`^9TLNO|>xfq{Y1KdswE#S2tCeF1e0T~uVCg%_x=
z3L2^bN!<etxkCDAFJ||HTAO=RK)U@)1TrRpEHeeQ@m@}bn!vx^LCEqje`_;>F9O<R
zRa)9z4_YGZAlc!f;@SGYRJQqrfQ>+T{4PdDMh5=Hhl)c%{%ojFWG&@>?Frf$=xKSp
z6m*olOt*tZCuC3#q=bLFg8=_}P}Xx%iFvUUR0X-HaI_vMm4OuDpi59*-0uJX|K&5#
z!5+t$UY-CQfw0XbOvMv4Nz1?8UjSOBZslcQ=$;BH%Pd1wMEF}Lg7{lOkz)CozqN~(
zfq{ShF~~w|5z7;`ETFUdLHT-%3aG1i@E1$x6qOm%9i<tS>P0~JinOTAfp{CV;midb
zoe7{dHkNx-K-0MVEk{5J-9^Qv(?unq(?unu(?ul$vZ}VbMkU2^57=D(mQEf9hUUGX
z>uMNEt$SNRX&JPhy0?`BRP4H_=<EV@qdQ-`VA2J7Kp>pKj-h)l4@fdcMFPCp%HU-a
zXuPsD091NK{O_C#Vzk~a-PGL+QrA6IARKfW1IWM^ha0EM$uMd#`b~G2VN_=Hot`bj
zC|}>*vJZ4g$%+R47Ix5}_@U-U^^B(u{s7+v!OY&t4!SI=lO0s{bUT1NY|-luN~99|
z>_MX{zc}lKJ8y!PAH3jh1dTC59N6pit@Hln|BcW8gDR9g;9dpz-iDSPFxx=qopm0X
zE+xw-P!Ae%Iru{WyqC2HqPRxIg!4Rq>s3fdOZ2jA0B!aK&lG5W=&n&Q=xo^o8ZZFQ
zYG{J8pNgeBPbq7&i;9ZOe-{;l<{A|PHvSgSL3Cip7qB${;^goD3Tnzj930R9b#Q$+
z1H;R^Ac<a3cy)rqxEJD(fbh;w-7YF7FJ?FV{|^aIh!^AHUtYkar8@+CJA%oJG>{c8
zDmKU(BO+f)fU1WY6^UM#eo$D}gZ7b{bh7k2YMyKT#@|2h-~azFg+cWgIR2pSX?0)&
z&n`*)-vaK#WiYU?F!c6<O4ZIooiASeZ2*^`?4Sq-ox<{e3wYcQN!g2A5G5R7B~0KU
zBv6@9kE~`pL=7ic4Kr8`$TVanQ$R{u9U!x30nJAgdV3vs!RlGS>Oq5Z8K9G+x<gbf
zz+uqa3o6-rr#f(hm9c`Afyx)KvicX!4WPj~P=@uC;BR4M2DgVi6-q=KYE(Q0_*+hb
zuAv9@W?zCXn+H{$j0ZX)OV&Z0UY4VvmRYBZN)3qHU854f_@fgtBi31?Qqk?AV$kUV
z-ey(-TBFbnl>#jxaZ!-~Ezz;)b^%|=WYg`UBEbssac2woge}k_0nlOraDFrCu2He+
zE>SV*w%OiYqGHqSqhiv%r4OvUL`5b0yHRG03V69u?;JVM7Mg><IXYuhbUIHT{LOUm
zF>7axibLnQ=4Z^EB`QAMJ}N%FCfuDR^(q<NB`Ox(J}MdAGUvKWR8$!6HG(ddVJPPW
z@p^gWUbBC{cJQBk=f@6?&U@M=DmqYkj*gq!J}Np0X%EI;6M4qp5a}|guFoA2OvfCU
z8Q`{*oMY+sQBmoYF>L((A5>+Ob9BY1s4#wh&HDZF!Qb*75iFgbwPRFtK++5h<s1+m
zT$Z(0#vCfe+ACuR7iT->zz(v-0qnODK2YPx0cxuQ4!;?{u7^7FV+R+0&v{|@ToltW
zC#dIQR2;fX?jd^)<a$)UMX_{#1O-~-&;JY{*-ln4cls<vM$LMY=0hCK2S7)Rn{e>A
zz5^Y6=AvSw(CngO;n2MYyo3z2{)e$fr2uvWTaAhZf9p1o${dxFhDH|^2~gjpyGEsk
zagPcp5io+1V2z4|WsQmfe{1C5|Nme9Vg+|LM9`Bl=&(r8-cndP4k0BSce<z$PR5|k
zdbpEuJp-sYOJX`MQSo8C*I7bJD)wN)9@F*Tp~)OaItJZaXwe;`lF=P=4|I(lMouwC
z$_lL5?SNasf|*t7J3n_sFn5=zICRIT`1F>@AyP0XY02CJ<wx|~iDai24u8Sy#F2uf
zz<DG_#i1U<UmRUNDk_XO5#I7*?F8p}Sn`FI0Ic6H9{efa;l<L+BM+5gXZ+m}#r&EB
zD#QHWMa87~5L@#BHqiDi4*u4kphSz3yg}&?Yx+J2Qc6_%P64HF1yE1aMFo<+L3sdF
zE+dL*P>Bq>nlgg%2dK~nZy5)d(e)|?(1IA0l509ab*BsX8YPu(7nOoe7Zo4F1Kl+$
zKHWC$oi!>tVCJ57Z~<JSVv_BnqGObK9kg+&cZwj$-h;n5Izv<(Iu9NE#dPoyYbR*u
z((&f!%$+qVIo%~HIgHo9mtM(y@2*iX=@qG$@AYDb1Ya57PKF;049&lO*76#je9d|A
zAqVKPV9=4*+BGT;z2VG_zd!{@8Q-o4><kRe|NqwV8eV$MdGHZ)<0Fs==PA(Mv)*d<
z&YuT=GB<+uLot-`>;x@kZT|hUmdWrW=c(=*6^jm$_KuQvMzA~TeZI4RT_VHZ8_Wo`
zfM*xTA<i)4IT{~<_?@S<V^ka<rEnSh!Qb-VFTZ9!_?WrzG1&53%swhQy`WC^!Qaf#
z>VRuE$a2S8Cd1pDx4>41v@>;-v@>_tfHQASZ+(e5$bOY>Sb)g)dNHGg2gsk;!UN%4
zkOSOd&P59iW^AGH7Zw`zDmKW$5%V2%QiBQOtzIuyG*|paj}=h0=+GO+1PwH3to-|j
z;f`(}6&=Q#y@jlupAkXB0}h(z`k%kyp<~kl4IR)m#{8|_pd8?$;sdG+R6unBD0wl~
zs8}$9+61sxgQbg#3V&-XNNtWv0dj3n!3e4mK!+p1s{*mV;5`m0%`PetAY(%ejGJ9l
z0vukZeFjS;bngN8H5hADTwZE_{{J6Kv%a=;dcFpu9%JkDc^ZsT^-Ie68D7VOZiwv;
zXR!=X;V6l=b{8mh10UYlS)(FRYJKnrGynR-{M&zag06c59U@SpBGT*spMU)c##5lX
zU@c2jL`qaT?{{A7JotIZe-{-A<`@+f%|ovrWie))1@#7#K_`(#z0QSoJ3&*FFE+|E
zfEJ5GhRK*9-Oh$H4xsKOXpS2;Fjm<B>0W{c)BH<#Groch6b2diS`M`69CUUDbaloH
z^?K0RXCct}C(zFS7*I3ZMTO%<FodD;!VAKXdEwab|9^ewix*Z90iG9zAO>VW^F;;t
zXx8Q*|4Wz;{^n@51)0fE!UMXn*@>Uwh2q@*|1IaJfW|oaTg5?BB?n%()`Q13GuSKm
z8D3n{W?*>HTKE4ycyP5h;zNYtx8~m;N-UcHDU}#^2lGH?NP-!5`Z6#uyjY*}|9=4g
zzBUI3eujVyS&#`6wHX-Px}yb}UkiXHWDgr2Xx;<1kg=3?#~oG%h8L&hKnKz60585f
zS@-|Htu*M`bot2(SIN}#zrFx+{Ao}@#^F`U0~yLy(`I0J9m2ouK({Su%(plGgW)BR
ztClqXQYx9xzpo2qzvYP%PA7=PuOGGEE@_A8eWeAughJp&Z}$KHhHpEwIl$LtfsWtr
z$^QR8{zX&m|NoE+X-;?jum2CST_gi^L5<<b&O<vsfP87(`u~3%I6#_T2z0WjG~1|r
z;BWa0D*HjZkHJgO4>2<^)boRupzAmPU@ED9d5oEX!4|Z*n!j~7L?!?B0MH-^+rbAc
zh9_Tq)M8+G*$k2C_F&oN(9O@VgQo#B-=<Rk|9^w6!}O)vjF!G3P$dy8{M%SdL96H>
z6@^Ua&0QewjsqYq`|AGxPwUQRN^AW4pP^hht=pNcH{kyUmbB(ycKmIi&7%$03Z;tE
zHFOx|>t9##Z!ebN-ySU2d9mAB0W=81!N2|3_eY?m{Gd}n__u?OeQ{CY`Toe#nWwv2
zK=OK#OIqtU{wW92KpVXeab8FRt#V=DpK^%fLaAn2<4*>ba^bY*e*)#aU>SS<=?5-8
zcrD1k{#@fvMg}GZ{y7I6UNdcA>~NNx{!WLHy`F=AySH3-wL)5FjS5e9HBTq#4#Hpo
z8)p8NNem1OHZ1%t_dzsciHr>se+y_`1}M9Cp6Jd|;n?-Kn4jV0MbNG+2A1CppiwEy
zAD~fc2FVNjO`toS!2R~lABLB{f9pJS@D<lyP#tFbpP7lFTzPK;Xva<SFNbo;y`cGt
z=3ffs{Ch#m!kT{xl(FswZ9C!L{@3u*_wT!26!SCe2aN%|P6vBTpj02U_O$Wm^xe9Q
zQuVKep$@uM%+K(e8_Ky;%+HW!%fM15op$lX#iwb_f9uQMzvk<9W=ZR=X4~}!q!v{F
z@N^ynD-(OokFW^r(tV(QC1_9#GBa}&JUbHv+L*2o03ic|GgK=;L+!pwpxK&irnJst
zmbA`lw&o)m%{3}AjQste!K1Y9V7YE*nQm`|G|(zP{_VVcEDQ_>AA*K|ct9rsNI=*k
z-7zXWjHlC%J3IaVzwtm?^AC<Pri~{$yj{~egFVwai)}k!c6i%&{_ODfPP6<3I>$;P
z&C=}!|I~wAJ}MHW>}i%YDjX%+X`R7t9nKzIE-D-y&W^{N9TtGrNrED%*TupXJpcUS
zy(DN8xKG+bkW)Zzoi44<s9i4$+HB#$vMa|4w8p6$bRKs#cxice082N+i|1Joj)TC<
z&%eQokQqUl^Fr4D|Bw}4$Fe}#2Be#zq`cX-rVDgIhbDBogo6RP-io&#G&NAlvr7kb
zTrKEul-IJ0L29)j7m56Y$P4Zg0LhnvtYE7C|Nphx;tJ5LIQX&=sp&8E8RcX^^XQ$j
zpc(cTi$ob1IuC=-W$nDBdFaK1>B<I-c7YRXLC0QzR%e0M27fEz=qyoD=r()(1$-Z{
z14lRLUXOYn&_$%bG!MNfk^py?6#f_R{4d}L{%;DJ_RB~B6{}z585kBmaGbu$fKkg>
ztQK^NZ97POhdgL>ROCfZ259{X=qQ|wWgzhd@(c{S57hHBL`8y5mRT~L-;hzM{#P+S
zL-Svja`tYUwINpg4B>&GtBOE4C?G6jA4sFOJOhJU^I?(ZBMPrqA7@?B%@6A4G3;Vs
zU}V?<T7LGTMjW&p0CZ#Qi+Cl_H8r3$aiAq~FHaeOCj~h`8*N{DJ_oP;=K$S^_0s0~
z|NqCB>lvJ1g7!6o)+IN;DR@yK#=wx)Evf}t$6)iagfs0pD~JtRU1oUT#Y|z)^y!CQ
zxBqF)KmPK!^MfWrK;z$r2VT^I<!*qlb}>BgB2O5!zIT@%XkPfhiv(fNF@OKRNb$Gc
z2Cee51r5$$WMp9QYvu(VU&)x(_}g5lgfFe}_W{jPkqm}Peumeq8P7o8_mg8_h=0u=
z9F`$o$<Oe@UJewzJiRe0GQqtyDl*}{J}NT3Au1Av2VQti?=)gmsE>>@{02TAsYEsy
zF1-VsHhF~^K*Izo&CeVnqEPjN3af?}Z-f{ax^q+{A|o3Af)<XIsiGRu@ZyvZ_^1c<
z120&cA22SmaN=i(h*|)mTEFqPEC9{+wj3xCX#5L0yQN&N<p6){304LM@WOx{_bd1r
zz=yl+dR)QJ@H!vKaPY}4c|r`}UH%er@y)+A${lt&RPr<Qx~LeuFct()$nrJ+R^e|c
zX9b-Wul`zemoH3S7$VQw{JUPGgwycb4zLA~1*>3dcY*BQ2_jz0fgRIw04%;6T)4JK
zvNAAq9@+`g6%ZU0*z2O=5RmZ(bkSNADA+g1fP!5Hbbfw^Ea+TL!?&R2-VWeH4Fw<(
zQKBLPI;f@|937oEUMv;_XC8^DNXr{V!Jvy}L5E{?hp0$&hNzf;4%P>qjdjdL#fG7`
zM8zO1AUI<x$SzkI28LZbD?tZ*zpxVk*(=a`pp>gq7Idm<caDlc<6%(0>vc=BEl7l+
zBrM}FNFOiAjl2!@pz~0{C!jVT5QwroT4WIpau(QCF9Za^7qm%aTn6d51DfAEA^=<B
zQp&gMQzbv>tPp`0z4ib9zj)CDDw_CPdKeiPAZz773-&rcya<wlc<qHgD4n~gNEqI>
zj!}^)Htcm#sW;dKs>5DzN`Vg#vjE@sy$ieqZ(AbByb@;T*Ox$NH>R~-Diz51335rW
zGy_A#OYm_PpxC}C#K6#bu=7IOgI$mtV|IfUXm_3fou~>Lk2ZX3oueYb-y8*6i3~dQ
z1SI`px+KU|yec}NR*w^C<6Y~y=?6_2#TYH73z{*C)T>nSGrTx01qxDyms1%S7_u1u
zm#FA~FlaWpJ48k2#s6~f>R*%pB`R>75dqRT3FK)X6`O9*h=hxZOLvHh2WX9KXNZbQ
z=ZVf+%q}Vl!XYXu%|{fPe>0Rz82-0p1#M52yk4x+&7#71LVGcY`&t3C5Xaw=6}0Ye
zA!vc0<d0&WPVgeXPVh!v*OyHHr>`_)bgBob&tf#Z6chkD1NMam$Zg<l*BR{~7af%Z
zc|`=WvXFrVR2=>Rtt_-D{r^AfKluDOR*)bUgW;tY>L5Yz?P9Qk)9}&@q0;~V7lI1u
z-irUtM^p^I8QyOF&))%B&6j;%Bmw0LXV963Au2q~ji5`Eg(re8Q3l=18lu9o7gY9I
z>!|DnjRs5SsIU~LH}3@9Wz1L#+TzQ?P#y^GUGS*1-Y&K21vNtdH$V7bd2sp}b4H_j
z(7m}Y{+9p$@BcCcv^11~fs<huLjeQB4)A({$L0V3x85#M?By};yam}{cA*@!jLq;;
z7L(!s@URz8OF_ffJbS@QlHY=sIfKvh?R*8<%F|W`N_M64FhQ`Xg%ClmjQRDTpmYV-
zm!Sa}Al(`JKti?>3=I1~+|K);yS6%S=z=)SM+9~yH1RPs{#w$`$571O&Bb_=k+Jy@
z%j>t`1=gB3cY!1te`WN7rHvTxG4g?>cY#D2f0cm5dAqq78$rf2A7ZJ0{d(s#7Ji1t
zpCI=abN7mHH2wrxRm{2zByM=%|0QsF*?IBhqhJ63gG(<+*`)$n9eAko;LB6LU{{QA
zbRGt6n>iMc@d@OKN^#KbiD}LM82MX5L3K~_KPLW`1`rFhXQhLYfnj=yC8LNWC=$To
z{hDh(Xv-;hF?j2@QrGDVEg40uZ@+W_O;i1VUFVw-|NsAs<aqFUg&!}X;{X4*Jj~y$
z08(@Kr6eN*!@*}Pt>5a7cW1Lr|6<8#R^JQSEC)XMb!`bqSL=b&*tBLF6$a3Oo%}7?
zplKKA)~g<<0{)iJ|Ns9(;@I%gi><}rSbnY6$)nQw=|vh;73d6mVX(m=P!awX(4Ab(
zfB%;xciwnm9S4g2`jQCC8zmvl6#@(;ew`U2uRXiHnVNt8=WqE0I^O(JH_Oxmj{FSW
zpd0M@tsOW@zgl}}lz!-rka;cd)clLJ^xn&ppkrX2nO<<lfzD8CJ-|Qp@N4Gg)Bihf
zKm+A)+Jp&))%*;m)%*;0)%*<3)%*<Z)%*-a`MGJ^HLMxuFexPE=jSk_O_&f+&Cd{2
z&Cl?-f}bI*nx7$}nx6qwH*Mcx%c#yc-J_mSKx0B%0|SG(5Ca2fvmz*Gt(nco01`W(
zi4Z$|gl{6F==6d*MwaOc_KX7cy1OBY1PT#~U}6$T8t1^&6)-R`g0AiS|Nnmi)B?dm
zR56ePKp3VjdNCh^hyVkF8^~205PP;l#OfKq<84TSAQuZGIi?9}i2;&h=FjG1$QEE=
z0G;!~@E>B}$;A*cC6FaZVj%NCj$vSisGD^Kw4es02!to{aPf0-adSsk^E1R%^D`t>
z^G|oIXOx_t;J~;+eAY2O1||UphKbG)y&xSEj)6na#*wjwLun@;IJBpqaAd3y29*<_
zjS!&bGAMgIaO8)EwZQZWCq^A`s88w_0?};K4>&Qp@PL+;GL`Ze9%!~*F<ro!QH*J$
z({v4IMr-cQgWj)SgYFyKy>xn>GoxI6=Y{59oaL;&K?bk6dV|7SPnIzE2AK2jyVQ9j
z`eo<;|NlWZ_#NxK++Cw0;Mx3>t(^V8N^edzKf}RSGMztP>;h$&TL)iBG(Y0+{Mq^8
z#Y(7v2uuKcLC>v&uLNKM?NAjwAc1<2o-(Ki2S@}YkO~!GfeC;L<mSixowq=CM90Oy
z1l@82X)begUhO;$>M(TLsC4<L$bieGgRfXhnB89g(EQB5?`P}nIw9}QU!e10U+e(o
z9v2ms*RMc#C-|uN$$;)&hvuA@LjOUxrXTFQY<QqcgwaZbxr7JYVy)!?T|Uk3&~mBt
zIp_xJ;BMK7de9Ej1Fg49xDP(yVZ6+Eqm$#c-1GofM(ODvTo_qo4~GSJUhX!9srv>|
zcaQNy2ghqAkUFvHTCR+OA}|FfOSnJ=U1U7b%`n~Hl~G9)CUXg*^%UcUv~GsU+B2k;
znR+Mw;bCA%dwX~xXcJ7g15fh{0q~6%;O#h_*E-KnKjO-$Q7_&p_L`r6Q72oce5Ws{
zNhQ%K0P2!}m4UAEz0S|sd9C@`AO7t(IzM&ZcmbN51`T)g=COb_aK7LG#e|EBK=X6v
zUKbmlP8O9H=@20f!vmd%4nE@V3{hceJjBqz!vGp@ESBnq@Et(>dKHc$iEbX1V=j!0
zhOhacEJ26nA8e(EkGa_J2!QUW09&jEiWnai0g$cDN5EIVz7+cR|9>$5_8Xw9!K(Qg
znolzFZ$Alc)^*-^@%8Wj|KK~-ce#M7pBpb^|NZ~JlkvdCf4e}VQ=sH~Y5E5@M$vkZ
z%Cv6TKcMSPL04MC4f*h5A;=I=pJW$kIJfh|i<5srD^X839t5>*LDye{HVAZncu@gT
z2wE_<>k`Pe57BWi=Yj4_;op9Pe>*S8XoMC}Q@-=Y3s;a9Mg|5+2B?#xU*`M;=cnBa
zwfqd-wlAj7b!SwP1D)mi2y}-O=pZj1=*fkz{(_G4Y_xqc{k}V+BIAMSj2?{YN}U(^
zPj(*SKh=5SF#n0e&9<OkC_|~xhW=*-h6kP%9%o%K-QI)IfL9OP$CuzY<ln}tGrh)x
z(T~w!`e_fw2u0A&)ZXUj%nS^>K?9ATmMr6m=$A+S|Nq}{0o3Q5?&8VlCzk#bR9ltk
z9cOjv<_84@gW-Y2G1FIgGHNgeOuy*KD8pyme2}B_MB2d@9HrWwC#J`RFiJ$Fz4ZX~
zNz1su9b_*#>-hR?^U436C!p5|HoxKMyv)D-#KDIgo!1(lfwtCho@)eMm(s8obO?Xv
zht5~;cY)INTTp}U259;C0TxxTx`Wf}ycmrGIzNDq>wn+Pq5@X<zVifBz(s`xD)OV{
zK&d$R28hO&pr*~fgr<N0_k&oVBlS4IsXrL(kj@j}Y*^oUtN9UgTH~QVJa0O0tq|xu
zQOdD%z32b`(f=PtzXYA*3oB?q*T<aZ-zVO3iN6JOrd`7?RsL3G&;r78#$zlh3Wg{7
zx3TpGTxj^kSuWLjvXsTfpoBB~Bv-Ew<Av93$5>Ph3{SefzHNBPCZ|-W%Z<?{2UJMa
zb9A|Zw&`wSv`Hz+sCTl_<8SF>WMHV5v{B`6JpkJF4LUcs^TmtC@Bjb5JjlqvU=zXL
z0@@F5lg!^bpOJxqf1hyYix){CX@8J(F@H-D$OKNCf|9V8wIHF=5<{B`{+9EgHIF%<
zRYTS-mr7Zi53{@$WNtpp(fYrVZ<j78X}@?OJzd*}Q4%zk&I~dUv?H+Fx}lCSpfudA
zTbzH}wJgX!p3WC9Lcah1zYBEuXy=O;7r*`g-z9$F6*K>~O9&N4AQhkih|U);)_?o|
zzgxWd5xe2Z&KEDfd;=x%m!Ls+$d&CcUi5wY|9@8n#1-{T-~Rv4VgT=)18*CD`R)Jz
z_}7Ux5uiKGwjJm^-VHh&lZAgDi%QF-68+v_j!qGk?qHVIOC=i3FFC>kI$yl-`~Lrb
zIM@i#*~*<SUM%?rX}yUyA7<&4Q3(&|4pHIheDOl{JLpKLZW)!=!JshlYpAPdEH3qM
z>#b(#mWI@qN&KL2Zn;!q(D~xUv#<aEJHLJpmge6l+;XWzs`JH*3lPy=(D*v|_5c6Q
zf3KN3fA`igzT5(u6*>Y*fS{|+Kn3Lv4$v7Ay?_7z|Mlhd-_C=b4{Sj_jxw%{H6ls;
z3@@(!|NkFyu-cRVpk0#FpZPMX)n5Qf%>os}=XTm$23>Cfl4UI6gOmu2C9FHuFN3Nl
z*%$x$7#iP!hNpHN=w@K}|B&$x=+>(SThPuFhEnFw6Atf`TL#+uV|d^tXoquf=Y!p#
zee$-TD^$wZRT;n+0e9YbvEvKqN@9>ysWe;k%iaI~|BpWWqWcS|oG4{|dGtSMRsLd^
z>C5~WmFs=F`58dCloMtX>&rG!pGxO2)Gprt|Nn#T%M$3k)_L0S(hFD6rC!jkUFU}v
zju0+O=ZzPj`?f&k!Gjk%KS6=P%D@21|1ab~3;%vFma)Ik`Tzg_>o?6u1ft^(w_Yky
zY_5l%D8jW9G%N=8S9s^e&g0<gUO(r=9|qOUhdVF8P970H_&}if1Xt&&&V!(Pj9-G5
z@<Mz3ou|Me%l`lW9|+oP&BVaaYzw*%mZ3zr*F}X1Yy<dY#1||6|Np<C1GE`r`U!tV
zMV;0IB^tq<hryP@Y~lxxUx03Ni+=g|-~a#KZ(47c{)#?4T`+)AimhQjKf}wT(+vX{
zHEj3(`2Qbdp&A3|gd=&r4j&b{V=gK}?7KLwfTH%&i^=~%Nm=9Y;o#28&9)w(?FA+L
z&_aA#0HantIBhlk`v3oMKv2eOP?~uN*1`kw{xQ(NcI(Mfd6?6<4n7j-yx4qF;<etc
z8P)s@JGOu}L7R78fQ7_~7Z*TR2Hq~wfN2o`4<dulYuob|d<;qlNF!*R=0)d!(3IPa
z=s1w&Ny+>SFF=jD<|90ZgLez4GcY_!S;17IxC3<O`ipbl|Nr+ceY@)lNVh3yX!!)l
zp(p;oW&*XgK*cZU!2HhhkOK%jzJs=%_lC2-={Tf#tMjA9DaiG?YMn1$*nbBl$P$rV
zC#r?{8Fpxc3<F({2yVZ<m@xfzAfsIUT+l^c2homc*asR20nLjro_Hbj9n=aq93A&^
zFX;Bn?FU|fDoD^AnCJ?|QXbevCCv|h9|j-91Z_@%>bGqb2Hg%ipuX?X7Y+YGQ-~bR
zC;o%4lj?G2ZGPataY23Oua-+COdB_F9_$Ted((Nm<HS3|pA8QMO1-<B**aKMdR-Yo
zlTR$YuB;%Mt(!$f^&M!v<qwroi!Nt&P|5MG%b5doRz#OGC+M(<E@!UZP?mRH&fIC;
zAu4R|UJLMVKl*|n?0{7-tN;K1-^C2o#;6F<#{|*G4AI8|(bpTw-o>IaT{f6eK8^!4
zHNukC?Z5<f1^@P9u5Rtl3l~9)HaPgV9|W}%yM0tRI^Tm#PWzk-T58PJ8^H7iG`I00
z8?*)-bX8oMW--@m6;;rE8h$0h%sMK~KR8N`O<x$ys8sI~7TkG^e_I5T;enRhC6=H&
z-fne%c;WOFd@4J*@!fK%L@_8hEaM<35rOV7Xg(qU>e&Q<Qat~Z1FxA44;+q;I~?3C
z`=c7P^Q4kDLpB9;nc1KJ|0ALg^KZYs3seqt-guG!@&Er_kqitBX}0D<C9Jz9NP+5_
z8__S{fBgSHxcS8Y7i&R9_Tkn872(rkLKqbojixt*FpAep?E<v}`L`c_(eUm6{}=l{
z|Nq|!w(T{4=Z)9%GWtQ+KMO$Y3kR2Ly;z%d!XN+tkBS71H<W-*pXOyMmCE=E(tG7M
zXsY``4WzLZ@$v)%=s<25f4X=mBQK-Wbk$HsYsMYZ6GItgg7QB7|Nlbo7bv0Lu$Bd>
zERpY2-BQEPaGZ5V4L_()$?$o?2mW2UU|!MZ*Ee6B{PF*PrzvR4qSKazfsx_ADd<?n
z;0!s?&BFhupATh}PUm_5|NpKOaJal+cn@k)Gcat}l>iZV{|;0qXD~1@Y{;<B<Y&lm
z23;h(;TOp9pzaDt0#pzmhF5SbpbAd;>wnPohzlL+`58cm5b$P9ogNs*C@QxKr2XK3
zP(uJL`9csBvWJ^(K`Q@GZwzBp2siuj|NrYdFZ4mw&x{)&9i^bU<imeRUGl=~`~Uwh
z?yh8D0EfH=sP_X}N`IJt`=J2vp*IrQ{0uK1focym&_Z_?6}}hdpQir^V^lE#ZR7-{
zZlSc!5*59)&KMPg7c)LVZxnwq`x~f_F&|`4FG$xRP~?YB4+v+JbKVUyG#tgyH6I~m
zwh;qUXN-zo=Z6j#6(vw1t`)k<@W2aGG}B_HZwzOYVN95QE}T)xfE!w@>;Cxv|C@`7
z8e<82#^r2&hSwsk-%2FX8g2j8GBAX$D&fue53-qSx<Uk_e7!>F;qDBUE>{MdV*ZxD
zp!42T4ZqnWmW$fN^S6U;d+rU`(C~|~+~Va^P%E&IzXfz|%4^wupi`D?n)zGKfyS-_
z3JkwB{9@#91GP3^OW73gw`>EMCGwiZMzO>U+@*fG1Y|%{xfob$%K`q5$)Gb`!E!c5
zuOX+X+qCevRDh0^0})-`9KDWz_c1dtFs%5?-vZi`+VGR9M5E!S0)I;%_|7xX<jzk4
z{&vuLWcxNUFfv?z_x)P)Gsc$|peCv}Pj|5ZsK@@_@&ssNhyi?OkmQG67Zr{or5B&y
z|F8dl%teJmqw~ZINzgUpE-GAU-OgN~GhAF$_+M+hxcL4*SVc$YiOx?iUcCcv731m*
zQQ_m??#%V#2}D4Mf4i&HYoYF9&=d;CPLP8?FXi9v4C?N7yXvHMTYzTc+0wczn7}UR
zbx{#{QTG1-|L%Iwd4et~;>TQ6q!u(EXWGEk`RiS8h>A$(ix;&&z*Q0Z29C~O?_Q_#
zZ_iO->wNLT87y4-vbRKqV<%{{3b^1^OZ%MP`Rh&Rix&^R{|B$OIMI2m`59vgCs^9)
z&FdYYQlk`Vn%oMGlI7hZDqfv8Uc3Wk>VsfgT2Gd+f}^MNL-P>@a91ZRn16c#S2t*h
zMUWK#`fH89K-s^JH|;oR1@{h6m-e+}=iwI{r#nV5s+)U(LWD)d@GUsnKud1C!S{@o
z2xNqTPL28Z_5c5fm!S35y)`Og;CbuLA1}P8&yQl17LNkm*?NG#1+;OZ*F}X5Ed4@q
z`o$<l1sP?CWNYRB|Nk3mRFterh5W)Y@<4`GP3Mhf)DTz*V*7mk|9^);DFefcyy>pd
zjLP*I9H2Q&!*A9$TN%3f8A>?an*Rxuer!JXAH1nTq%%fEp)*EB1#&_HC}#ZM{s)~z
zBGLTsKYvR+69Yr*fBqKGKCc%G|ACW(3==3*$}uwZx~OP?Ht-yGQBeRNs&f)_Kpr@H
zP5=G>4_cs7&(L~+zZG<A#ct3^01cqsg#4`zpiZBQiYDYJoyHgc|L+E!jtx?($^_bd
z<Dw$R2pVt6?{ra7FuVksoB<nqA9RT^XmfolDC2=lW8`l=1=@I3qoT>c-+BzfbPMHg
zJp^XftGKV?Z`}@Nt9W$qw{8XvZrg77&IdZ`-m}9+g%y-Syg;*9th)}dgBCrA9{A43
zkanDP-*?cMB&b&QOIv*CJ0ECHHK0>>2Z-e_(s};k`_3PWwtweiXnx3;*2%l)J0An+
zjsU;r<ID&DGlA25XMK(eXr#wQg@=FptAkHjI(1Y!Ux1c;urZXRffmHDHUCnmW8DQB
z^hoOrQIP{JlmUe)Xm1g?bLFC<0QdeQ@TJQ9t=~W!J3>?h(lkR<*g%7K-8m{MjMtm5
zGIZ9caCGLV@N`}{_<)<)Ma5O*^`wRx6;_5)-d?u{i?)5|V*n?=W?Rs@0|x$<&7d-*
zMunBR-1QhMNSXn<q23Xsjj2QkL`~0*Wz;g%hA3$G2VO7)It#SB;V@_pV(}4Bkg%w9
zH5_GRU|4hv61c33rtghqbO5J7a9#>-exqT@+Ed5Rz~2Wtuc`A;H_Oolb)Y(pxg@$?
z1vKGj1)lIb#K6Fi@gJ0)Q$YP+&<N9x2GG^Ey0##SzXe3vg2t)%TS2!!f_uRk&p{fD
zzyJT=Ey_^C4?3BA^N;`k>!V+ncgtK|QpeAbAyvfB0B)Uj-gwdS=l_4uS@!$^8Ac%C
z-{AiAYwxsfaQuS;kfrev!v_Y2gO3DMKm2E4;Jm=UO%xPFFaCW0|Npfj%+xfH_C4P~
zi$^+dfD544-7ofk`w!VyRuAguyjb)SQn#rwFzph7R#j~uz&()Y!_bQNaK_^zeuft!
zA3=8k|NaNM@3-|ls2~>w9W@A^X8i(E@c9F%5ZTJez|dI50y@#K^m(Hd=!nD8``u0w
z%~diCC7j((py_6Z*JoSB50rdvw1^0H2`PQu?ZLu$5On9yiQ@ayd*d0U>$yRThOC<p
zaJ;_OXb}Wb)ZQJy!g#3pfXZv;<^wF27x<ftKpSo(T5p%UZ?txEbPgze9-IN9GgOK}
zCkBCi!PD)m0@^6<_W%F?MhiDb=V1O;E0Ded9?*&c{r~^}zqtMU|Nj>fAVT2F|Njd=
zRP!^`w;rhA;NO1WMe?)%{}+A%wLhT(LLh-RNCN9X0xysRo_zWLzu6YFbDyC^c_C=~
zdh3A_sTZ3*f$I%H!;`x}H4#|i#j3CW|1Sg`IN2NVvHADM5}9sq4*u=IJoWtBocRJe
zZ@kz5s*a-hn_u%syuSb9z$a+rf#dGV^Z)<DGHgMfO#@YvAHZ7xT~xFVzGF%2EK$(`
zx3gb_zCmv7aJ{H`13H#FBNC)f@BRP(3s-di{~z6Y0CYPWXylQ(R57Ez7$hqQvRt&K
zo}VEyt@Tm~`wj*L28OivpfQaXrJq2JL$G>K2C#aO^6CHooghBu_}tDv|M?jjUxFm}
zt?B;%fB%|peumFW3=b>@3GMpH!@#hC>D>mlcV~8kme0JfcwhhjKco*S^!)$-4ga2{
zKzJ<AK|RU`U>$EjCsF)tKEd=3BKP9i|Nk8~noqESWubzXpZ))TCSxVYGghzv|8IVy
zv5R2>2g44~Xv~Xg&yYj2;~63+h}T22Le5)oRydr|P{YrV!3Mf`{omXF|1%Uo+~=Sv
z(D!fu|9_G7@&Er9KhORDpRuQ!pCN;#nxEmtHIO=f5bMm_|Nj?)j>B?T3?iG4@Vu<~
z{r`W)2DsW)aJ38Gf(KmGpb8BSybSvN|Nn~>PyYW8$PfpaRu8hU;K~30|5+bwKbOQP
z!8JWNm(kTIzo0}vzbIX=I5jaTGrw5BAUV^_gh92~N})6_J1@UH4?I1nP+U@!nU`**
zpjyneeR?kAapvjIau^f0XB9FwF!AIh7Nw^$6zQfWXB2P$R?Nu7D3)51tY4B*l$w}Q
z%-|dls^FVZWvg1c{a*=VCFAt@WsI!T>&qAw*mF~hixbmRw=XVZT*+c;z>uGo#$d>h
zpU04y&ybs%%TQ31ng*iNCTw-)XISFQ&oJ4UpP|W_pP|s1pCQ4SpTU26X*FX#`(uB8
zhJzm9X*E&3^yFkK1r2v+XH5k|Q$0gHLj@xPBU1wtBU1&9pwtuvkHiuM=c4@LVzBgd
zy&6Vo4ijBNy|iQ#qv?S)jAFv(dIq`%y6H)#M#+g5W~m02CMnyiY8W^1af1f3K-ioi
zVY+!Yqch*UZhi)a381}=3=C-#rrXssO2%~FOgs3PrSD>z=AFKqX`R2)IzOhpU;-_;
z+O^o1pW!8+d)fpL1f9jj5Y_nVT{i<mYFhUstu6)zP?lkQcewLluY*DJPtG!~UdQm(
zOC`*`j^_OP4!k@${arVsVf`l1c;AhKFC>~D@OOTCu^7q~fpDilxdISwE0hb`9Nziq
z1$ct(#=#dH5LxgH4(PgT2sZ+(7|f22dkH$d1=NG(={$VQMTMK8*GGkG9~Z;)c|D9m
z^__=3U%%$x$Jlb9gyY4}fB*kGzWxZgnjSPr)BJ{`J4Z#PH%3JP?9ced_q@Ff45?i%
zwhW+i8$rh@+o+cE^p-Lnb5UVYFg);D0^~ymP#f()iG20}F8*yiD!nco7u-_2c<efO
zR60&Izcgt0$ys*)HDAN8dV|tCAe{z=2VUPZJlXIor&KJpE5wcw#Nuu~#+2G6Vz-g;
zHKSX@uN3|kP@lctso|F%e@g^tI9vieU=JEw-vJt-ePQ|U|Noc$pr+NY2>uq(w%&$c
z$^5Ok;1PA^7g8W;DX?@ge~SsognFZfUj_WF;9~-<cNl<1mq4>iJ3wRBFJAxs|KIQ=
z_#%hSA1_2ey6=J-C%;NdbQ*qDl-R!%0ab?9EhixZ@6d5~o*kfZ_ZMsb{{R2|e&>(Z
zeBI2*Dqf_540;7Ns6K*!$|3%3mp}vE+ASwbynCxbhorRLE^+Dg_|bU-d~nCX7c3>r
zPOpDxUgX~gI+Oflod9T#&hv#2=w8SW6_(d;Ky#lrUKE4)JSt!Zzt-ukX6bwdzN`T}
zdFuT7hvtpWgD@jFJYVqs{a^q8^%s!dTb(ann1Ncdzh8%ehRXv}yIkxTZNLNO-YnhH
z{QE$MHd(&7{pbIG=hq*5L1N$(5uq#H4@wX$AbCmteFt8E#?PEzKY~Qa>OcSgcfNbg
z)Oor$kMSjFOc6RWdpNlBa94oLbgO>GMU1S|@Afn5GP+IYp1^3ObZr6yXqDpY2@DM2
zCQ-y|6{uCU6Brm$yBk`jr%zz4WZR(dY{4^y>HFU?hOs=0V_=vr`JT~qI?qH#UB<)H
zttK+c)q62n{w!ur>pYQWc+&D%iA35?&<e7?gK7NRFR7(>O7$I7TP(w{k+I`MT69`m
zT725!wD7dBwBWSPV`-h2(?RWQfi&=3U*93MZaZ-XwJxz~44~WE1=Bijq<z1TruZZ6
z`^7ZHQ?EJG41c6?-bmv-1+zqLF}pZJ-$AtwvFUdwGRnF@O+K8qpWy)mL*H?=1&!a+
z__rNM)4ZX!sPTK6;iWXo3w7ds$JNridZb#uGcc&7cXWa1G^f{3AP$^vJBiVbQEPh5
zB*uX0Ws@15c=Wnj50pyt8|roO=}bQ|nNdOF#uJCMonR{ts-<;{)qGDo_<$pg^TzZ)
zlNn`04yvUsuKAu8opu=H&BJLgI{yFvub0*>X3&+!zy4Ml;|(Oaod5s-r)l0uYdyd}
z{{Yyn2z{Vy4bnOf>ZL6-m>xKVQQ34gNO9|dQkKsXUcUny(s?jFt=GXI4O9g3r>FHg
zhJy-5RuIcP4OC3T{+qsR3Zs4fOpw;j8)*k$NTh*VGN003fC@ZNARl}o0v9WUs}q2W
z#lppS;9{O|F%GzxDO`*NE~W?(<An)Cr^US#m|i%Q(U4_96a&NbWm6ebIlR)3u?R4f
zexGhJjZr^PF2zQmTs&<TXlSG3VA|zZX`L5938DD`W7^>~aI*_F6{Wq9`ThTY8tCAc
zw9Z>;ogW}EnfCu7h~0T>I`0BTqvZ7F3K8ZquJmRP6~;8fORr^M$u2#Oe|vz4T6(vL
zQ0t{qR)~Vm3u%WzI+&1j$YSUS5#m7BGX3auMx*I|GZ;;D4qs<rNPAJ~!@vM)(50vK
zhNy6WQ#(uAi)0@L25{nNJy0r;mhocxx*3eNj31`InZamVuYCig5gg>rM-;%39FP{2
zmXQV)2c5r|)_jBq5deqNI<Kd__#O_b5)YKHr8S@X|5`q+^H|4?XDMk1fAgeymkOl4
zxDJsoeURS8{wx6$ENHnAY|IV^20aFbz5{AqVhb1=9x;~sZempH5L>{IcJR4C8vpi_
zX`Da%4ydJd^34FLO6!!HE<TIVr(Pl*G#tp04jTIwNbhn{(Mj)cQDII`1MRO!JNQ-r
z6vQzq9DPUC(z}_{LEBz_Nb<McWJ*u#b&^Z#JeYRyB}?ByP#RH7?`B8`b%jAvGU!qU
zAW;Q$(MX2$wB9P7w9cO}bDs07rKfd+iF%fFP^X+Ft@)4?D5ws;XX!hh*8GTHExp?+
zy|YF|tnX+V_%0>2^iJV)P%oY3f2n#}^UwdKiqq|9Gs?%l&Pe0megN!8o;3dL-_pK6
zOWO~+L?-R~^EAs7X`L6+)1+NgSc--Ej;0wNP)qN0W>QN}>#SyZE!B544ZNcOEC>n)
z7ZnkZoHGk3Fw#1Ur{A5;s9G-ul9xztwo#GgZ);@)J41khzom*XZHF8KsGRC#?mG%j
zKmuUxQt6=cWf?$~G)R{tf15vJ+K#*X{{IJ=B)35YB<fYlv_S`CPlvMt*kK*cieS3a
zSqT(P%%BiY+t++Ul7Yd7sZ=~|U&jpw2C&W&uJp9V6cvN%3+6DYsTqLnGyv;O>vT4O
zY5tJ5Z`ut81{;MEwzPe{(_hbFRH(O6@dEkNM}?!*6C57tX`t=@AQOr$K%}z`m~;S>
zE@_7U(+n@ErFXe-$)zzKPjgCZ{-s^|zVB#S=a01SH`LNQoIPJ#L;Y?7)?)#4hYc3Z
zHoufnbvvdR9(c_LEjOBvNI(mR*tElGq0qXh`HcWLc3GyMoXaT7{fIHG`9*>aBY*pi
z=^y7ZYO>r(<GeXtZXTmV{X9m!^tA3S9fptp_0qeV3>ZHC2PJiGz4Y#xOc23FHinP?
z(>jmqrFXAn01KscH}ZfKrggHY=%sgcvV%AsJ}NwV>0MnQB@I6n(sqJo3raOXrb>bg
zFg&^9cZpQmPS7<OHjE_#X*)UC80r~pm`m8wz?1W7o#)b;&k4XQqE5XN-_x28GpTjT
zo%+7{0VsWNgHBri0IDG6&V1i|TCGFw?Dw?JA8L!vec#Ne)**NPdz#^GwGO!p-_<(g
zE`C?*G`j>A>6E+jeY2oihupRAY5PumXJAO%e;q^`*56i3?_x`1Je=m1X8FDJQ{Ta~
z@3+-D<gR~D2QLV%1m%yrkg$I3l%56}E^2<j4yx=AJ`;fO`M2Fk<NOR}AAA8yf%1^r
z^DsDd^Q0YoAd$v-7?Nv1emwY0AZ;hu5&YX7Po{BxOi$zAR-(cUZbdYo5J(Gn&6AeJ
z07Zr;!Nv%ry;$<=|9@~%*?dF*5$DrA7BH&U?<~2+z@V4j1!|M?f$GV$7bai+|4(y#
z{VHt-sF(aw{R=#GbRJLZyb5y3i~4W>|92ct>wE=DoBywYyv4umaN3K%pg9b9wS%0p
zz^$CL&hwBUNqcb_q_VaCK&d6D;_bPf*7-E;;B%HV#y@EX-?OCc3J1+*&ocghZCCPq
z28Ne6jTspF?)P0!>wJ^ec|7gK|F8f5gY1SB-XM#@!NJgZIIZ(y+6(4S;A*f$ERBEr
z#k8Fb^Faffpw>oQTKvmh-#}J&o=SVMr{0)>0U9KS(>ntcdQPQx1}ODh0yWxRuKAx9
zoYwqCBW-sEB#^jUPL_ZI>0laorYX%C7D#C?7(f62-*MvEhqM=8KK%cm2HxA6o(38}
zNqh0;>;M1h$6Zv^7?{#_F<oI`0GXZ!+L!Quy7D4M(R#4zH2!TTz&hB{UabE5|9`_-
ze{eOT1k$R-$dtB^52E#3TIZ*<7xw@E|4;wsqN2sf-{K3ZU}991(!fXDfNCwiX`q_G
zS;2;}T&Usq1O6!o(j3w_PpB=L#_&>}x#Lz^^P~E22boLc8h*)^*0X;*$jINy!3@*i
zaU!kx!5@%fP(Z1IMjIP`S(Q|lYc~8c19f%E`5S)8g0>Gf{L(5ZczKes;g>moOA=$l
zFAM&bZ457WFgE-O=5Og>EEjC}<;vf3oT1^D8-L4HhL`gg8-9iGw@zn73Zi<pv=_U-
z{QnO+OkTP5z-#vOju;h)w;7nyIzPR%U`)$$NHaW{wu`}mf#J1q!$T(i)+i=WLI(+g
zrf1V$G=aiB@})BqSk?wE3mQFr{h;9?Q;8r*19%BV+Ah#&{OeO70mG9VX}efJs}=T4
zKfjn!RBstXG;J5Cz<E8R;UOb`>wU(wEQK_XWuURC*Ucc~B3f?qcOIKAx`ff8e#>V_
z6l;N^`0alNhS!#9SppCZ0t^f<#s7ah$W#*Da+|*+3fb#yX)h{~wX#B@_)^*n$-n>q
zztm%dMTy!%afY<-7gq3;ih&FfWlY;)BE-O;wz!BP?S+h8ECT~b_&+Gto&MW|r}1w)
zR3@4hke0Cu+*(==%F_{PQ7`X;RInUvxXZxMak}9#6DX*er^_y7l&;?m?ynpM_dU|n
zdZTtW{N~}Gb~vr`U-L7L5_Y}xZU?s4{%PNjgTfBNXL)U}m)@<B_Wig50|P?|OUvz2
z(X{W!K?aqGrZvA!OzV8v@Kds!^ZRjT2L34rU$cW5QxCSBEU^R`$OI~!nHfq%TW+(J
z2yS@L`fd8jrHo1(&)@2$cQd>`w*B)`Mkhw5*B_>vFK0BUhvtAw;Cv#L_96jPvVpIB
z0c8a{#!}`q!vpDQy{TWInL0M@FsP6W5NY^zznmj&*Cr+=hSyT?nj*bx(t&Rb3@w*R
zIMa4*<YZ!aneqXe=Q|H0rBJ4{7j_^1|5pN~Q2C(rE@u%?T_={d3&lZ9X)i8J=Uc(3
z68--@xWv@}H(Fm5zJ?S={AoMomN77ZI$wqdUh04NJ>m0&Uw=R?d1=t1f*1Xs3=C;I
zqQUHDFdMYKCGABym<_rD_+_5w^xhSW;`P3e!tU6?cWh~$htrxL+c%tUu>Hqg&I@YM
zHlF}@pk7NIe8H2}eBuGPH}yguWK8FWwB`r)JPm0t1i)NynfQ{;6H@=Dr}Y*vg5sVr
zZ3o0nuRIWLx(8x+en{irR)1h4*SC*poyXGCdff~l#vg>pc05RHJ^&S32NK$04ffC?
z5SxG7VTi`V>1n;rP*ois3=ADV5V|TrDtCB*bb(9vmzf?A*QM<S_cRZyEvTRRJ+1SY
z+JY(H)4-?nDnp#$V+|_iK@L2S_TtFD|Nr|At1X!RJ<UOF(e&?WFSfk`)fva&S*qJE
zfB~dp8psrjgC(44oj*X^{$5Lib#?x-I8^%PWizsxVl_~u!(YGc0w|n89qJcH!S<we
zeo$KkGUx}$uGaw|6Iu?Gh^FlToy45>VyQa=L*HR=lVkdKn5CaAE)+{as@b#`&0rO3
z3#NhHJMH`Hn-+&kCqc|9?dm(cfn9CUl<%Mh-=e9ppiVVp3<1`1>pYs)c@0#*zPR}E
z|No9dh`^fm-QrLQN7{>B|Nj4fEe`knLa^t%#HN3@I8^!&<hB=Ti$LM}WBR>SjI#B`
zpeY-W4-GG+z4!t;ycQfAX|XR~g{Hj-g~(n42RuyTf-N{0rodbmn|2s>(s89-T5uZZ
zct?h`7i+-rfRGXc)iN(Ofkayml=7y%So-Jx|LGO08D+c<gFSU3?L`tuw)6Otlr;Wr
z7rq^0ED3#*&~fp=OV%{d?4#w)Qr)!HZ>4M?=e*9h`Bjo?^RHA2)LXm(F8_AFoqlgM
zqlCprFmLu-aQ5T@#pMejkjbqFN+i;D>D&S(cF;krX)l!Cfz+J%|C&GT#oOQ0_0}+|
zdMKrLgn&A8y&)>hX*;e6fcmE&L1wicD3MG9EfO;Yb*x@I1D#6WdZ6@8TIUZ?AM;}x
zcxVmm&5!^7|DQf*4Wsn*Pp=tm<+B{Y-PKZowC2Y@(z#+(nEQ^Yb;wO;NQ(d!Vbiy)
zVe~iu=a3eh7L?Wr$~8VJOliA5F@cJa18FZFIY6|tr+2%kFuevBf1S<(V9kf8+pcAl
ztM_~XO7(}qmPdlvtp`dJ(ss#!{rVh~%U)!@`TsxdMJA}2g3L22!TR@VU1D|&Ete`d
z(q2ga`v3p+PEf-^twYQX)M`R>8v;RvQ0MhD@bMFAFRnfR|34kn#!u_K=bv`)A4gjA
zGyXKgw`se+Ff%Z`X*p1#4sP|Py*T+CRy6Js06PeDKitb%3~4Xc{`~*{^|=)eCH!eG
zE`Xv4d}HRz9n%fhF$&k~|4-ZXm6?IzU7F?BT9!1|*VEJZcRdy;l7TtF9b|ClQE<P%
z`7wW*;kVbqX)libgIIU-bzIsDyPu$j8q7r+X`L_9Ug&_dwH_#Wm<Dx^A!vg4g$*cZ
zUf8_)|NpgWn&rKkFzyu&po3b|3=h1PUg5ys;s<rloAeGA^E9{DE7HILnHB|##I*P{
zPy;nMEii2t==9mN9iSRC?Zqij9(rL2nh@$d3?AER_|GU;KM^F*dZ3ge?L`Y{)zYgp
z@UoFK!vkqA>cLuG`~`ahVn?ZB8hC91cw~hsZ3hQv^6Z5j#HXb!Y2Kwz!OlR$Rxqdq
z-FYoNt&>LuQB0J4U%^u1leTxd#(G9x#>3Oi)-$SVeMoz8?(hHqeMdK`s&$AtFr>8}
zDB*vtm-gZV#Qc(#uNBi8pD}!3nBKFVQIcuG-{}uGFpAf6q;;N6PwS3Rkx5VM=1B7b
zbs7%71C5;gN@F~qcJRGGn&m(KRtCnj{h)d+t?}=(3Py%fwzU1A?O5q)ojEEj;1slh
z?HLy+<#fJy#?x`)84GB9_23H*5CbG~;TdaM=LL`eD=4pVr*(dK*0_O5^%)m9fu*N)
zJFtNIsSP5ao+PL=>%5r`TJgY=_G0n$unmm)GLknz+4vbK;z7eq;A95sC4<(sOt;^`
zD4C%E&Uu|7Dk5;Bz@20ccv-r@jseunr~!>^b=s(aN}=>F9~F)?(A7Pf>7a8PKn(`T
z^t4_d70I++?2L>IU<anX0PP_Gg{sBNn(2uf8MV1Y_*>bS(hLv0be}$LBco=$jfz@&
zM>}Xyj9z+IGb00}pUt1vc@*TDW{}6gt^o}#Z7WgXPs{$trI+3{|70fv*ikMj&@O%2
zuJ6nY3>`P#f!rg2;vTO;uzOroSkhjc_ybN{rCgw<nWTL^f7@1uw7r))85q*QtF_WP
zKc-vwsPOZ*w1GN~p&+9DL?;7-#i7ztz4UI^AA0HC(+_kqFjyWcN&yM{0tp;~2n2%!
z{(uCIKm?rh(z{|Aal6fO7qa7Yp^oE)IIf&Et@G<^@wDcnTxo7;&Hp(0TND1L?KlA1
zrto~a`esI5O>hg8v4nF2d&5trQl<^8X$K#(fx6Y%-?;SByQhKNrI+5_e`tEwW=7q5
z$@QS2xDXY|v>nW#LiWWRP$>bL+Q0YrwL2)}I3OX{<)Q*^1WLi;l%EM4hAb*+FD#*h
zu;P87uDp#3NSg>O7GG}un+8f~&`J|!@P$JcRFJ+<djKl3kAv&Jqo7ekP}#)4?LvB5
zw=+xHi*wLG$eu2<l~KkYw215l$We@Goj*V{Q(ET-5X}r~uCg$J#-M_^Kuu;b@DL3v
zs6)vn{XgyCBhIvtw4I=w2d*6?K+cW^r+GaNutQ4j<8_D(ibKGw*(h<y(F#TeutU;7
z&HCuH<|7<P#V2U0r1=fRUB~W$+;uFi^HAEsR|0AL+b*T2b(@32rUc}N)&r#>;IIPa
zkO`0+(#x_Hw5T<W^8zSn7(qe91PPkyAGR_o*562baTOHR2x}1qCTLIr+_nO*AWwUt
z1P+#?>1mKv<Y|hx(!lG;A<YjxP;9-B0;z#CD_Foa8)z|k+6%46&}Ick+KaCr{{Mfy
z3*to$a23J7{RF6Y0IoY;HvES+^3z_pg8d7b|Jb>WQH5pxz5oBGKitMB&jMOjKAm|x
zqfY&0uy3IQat)vXImp=CD$u}M8vpjAX)o+Ra}W-t?4Y*F%R3C|UCyj&;6>$Wutnu*
zoS=D>P&UvgOUH?KX^@rWN$FkAZ0Q{=D(Pvxu8g2jX%-NR6~tnL6lALPpf%=c%|BF1
z-O{_9*&(IuyYwz+j`TFplJWE|XHF1{86*Zuj-f0d7I!*i#knBFg`ji5(;P}Cyo~vu
z-US-g2vGqm1NBNmnLrvq`7;!32s6kyuq;b@cL<LP+dGf|dpc+dy7dl5JB|*J&(k}7
zrZ?_jloJLIhw-Fc`~fa5S<?8oADq5#2cwsLw~LBUdKzfuIarBE+KU!Y1q)hg%$Ba1
z&Gp(l&9_7q>>-}?G)57XH1KM4&}lyWEw%rryX<6)RRrZP6#-~f{o>$VPz$J=MJ2sE
zgA06ml=<{SI~i4ltX)(%(!i@x!6W57#rD(x>|`{M-k<^=>1JUl5!_(%ns<W&jLWoP
zdf+a`QmcGOUMu0-z>(H@>s{JT&=TC&CXi55g-Dh@PTL8Z4F@}w1rjeW5~l5D)SiBO
z52F*~*XeS586_q8naX)>1WJT#6!=?KGrSC9vT@*VQD=JTIXz%6qY7j1^wPbIy4mOM
zfEtBIKmGszaxEjMw*y{#`f?$J{qo2E|1YOP*l9QZ|4%#k0+bIgfb*}+*Z==tRzM_+
ze*XXeGKVp}%Z<Z^xx~7hujN3Adz#@T8>SMImtBlD0{pEl(|PwXO4r*sr0rM*D!FwS
zVeRD)X)k{N`Tzf=IC!wR8Jf1cL1{a^gGWU#y?X;FiuKaFcYwy6(?Dxz`O-Rny-Nch
z?VR@F@s0ogH*i5jAj3p6L5>A=mR_X2SP5c7T3T~n)&Kwh`c)eL_IKdyy987gIPkYL
zF{CvgV@q$aQDG<vNQ378up6M*?PO8eupzDU6GTHZSVKv0TIVOwMV4C7(07MeQF1kH
z*AGxbV+ZIq%d{8acmDr>t-fIaNIR%nXJGg^U3WhtyY5R!%Nx?NNPDs7$N&GJ2><o&
zwKO;gnMx%=B}C_kv=^J6Pfy;@Xv8I;!ocwQRN9NnH>c0v&#1<7!J2_#`pNx_1{{sy
z{0wO?TpvwmJiw?qz3~vE@bsz=jJ)-|fBye(ICBnEe0JVQd+`F~#^xg;;L!?Lf3o?F
z1ZY$jG@}E$S}+|nN)Kw|gvq3L#Yv=f-cM_OZr^e7-^mL0w9cO`Crdfgb}_axFuXj<
zkaqAfQ{!U>W{`3}$u!Q>AV!{OI%wf^+6y7WdQdO@Wg7psla>e5`6s)mFoPznK-^RO
zlMbeH`KU0Lazm!J1T0S%air~HoWQ{FIxmfX|83CxQyTyJ8=y$y-}WMn@illb6*QaN
z`6G>g+YeAav<CG)TvP<WgF%ofH2&>wOlb!nuz)H<-7tYP#tV>A0Hhq$>Z$qt|9^T{
zj0#_RN1RN<nR(!_0kwXwPcJycXc%A!s#ka!Qb0A-A#ft^ybdbKF+xoQ+*st_Uciyw
z$Ix*CH2dbq0V4Bwz{9y9GDk&V`qx8@h4lr${{K(!V+Iw0Tx#i^VN4BY_JVD`k@jNW
zHMsepo<67t0jdH!ufgX0L6b!tVtowhT>-KUzeM<3av94j8-8){x7ab3TQ>Y+=5LW@
zESCVS%x}5D(C~{1wCfWzb{w4+_tNce!!MS4{uUm_hF`4wt@l9Vte~3crILBWFJAr@
ze#Ua~hF_fgEq@sre(~_P?qy2b#o*7#@Nz9v!!H5;mLCiazXbVPmw|+{85v$qV*(HK
znlh$!9xk_Q_~pdkqQF=#-|$NebmCmYFGv2C4-5^zMEP5b;Z|wY>!*Q-V;g=s^S54L
zOarf-e|em-;g<)0%UQ;9k+hwlL$5$%$E_O~!OoL-+VIPhzvUWZ!!JMnmKTgKRhiNo
zDnuA6IQtH&b%{ALyk-Y8N*K~R0%X&>JycpQf#!lwGQMU>Ykv4Iz0*VG<qyWRouJa7
z{xuuKPFSeq|A9E@^*fkIyn5O$1`kGtm)jZBb}@u8GQ3>J2$M_vo3@Lgh>_vtY*2wU
zk&yxH68?@(#<X2*Qy3XuHZZ0icMu3&m44hof}J647sFgehO`$iu7HNR9b^q&))zt@
z^71OUsSX*Y<V@Se@PU!xr5j^<SA<N%Z^jb0hTlvjwJo>#Tc<N1ja_zu#x5Iv{x9WA
zKjt9An6_)nK}Lp`{ETUipv4>@NvJr(F-C@$-!Zhd)SrZCWk}n#;UXi$%c~4&o-nN~
zC)4?-I>@B$Vz|!8@Nze@X6TqHO#UG#1Q_}bf@jD}7}Ae9$TEVL4!oSq01B#3$QWbE
zA5h*CNIUpQ0K{<MNaHlT0Fr+pdF%iGG+qWRCWf@mL$CeQb}<+;fy45CnG@I`kdbVl
z*0;m-gky{rYH4vV%PxbH!{#d>D(!H~r3&+gU;O3Sptc~W9V9ZfVfyZ4j3Gu1&?R!r
zFJ1qn?P9#i#PIUXrI)%_(q1H=19x;v_|tak90rZ2TmtpF6faMAJkBV|wENNYnB$Dr
zmU<08AC&T??EqbP(fIQ}Lz(GowZ@-Z4@%e?fAT&k<xJz>cCg`$%xk&EpZX6<guqIK
z8h(B#oqpjsW9am&-xyt(cKw?!{hiT+k#%~?cSg|Cqe<Txt)wDuGBCVmOUuXw)eA2&
zFa7_Y7V%nKFKuDV^k?50gX@DqP4J8uP~$OUK6u>f$3>8uv?y@-^Zz2K65`($ECS+2
zzkK@#Qfc%Z*zjL%Q6IxggVWGq(-%8WLwqWlw)4VKm`}k07yq*G0!*9QLO#%1hAuu0
z22j~N-SH%&xe&O>fvq)p@j;V;VS3dmMxD4|j`TifrnDWPgHk|K(M}d=JNRdVrsvZ-
zoov$6jx$RzC@`cScUCfhwCPuaX4*Qhsqr(0aH#P!#t85$97t<E!N{+4;ML`077RNy
z82WDXT>!i4@bt_djQUKQ&QG89gRzv!`uudkpNz2*4^M%;QCgVxLhIiD|F6%3JpSU?
zx#?{`86(vTAhMv$ey-s)N7{?ccmMx?eHPpoa+ZCq0#@vHZaUj9Ml)krEe9S{>vE8_
zVdQVw!vH!G^DAhrVXGh`Sh*x9iF6(Zb^lnVXTM+!WBPMy`r#Lh>h*~y!EPzxN^Ab+
zk=A^U5oF^6P^}KK@pTwjd*)eiH>LGJNmzPXZyr-x=POXVI<5J^Z+Hu(3*_w1A8E}e
zSkgLQfm*O(jIV{j+O^JtmvV!8m;sD$(waYbq<1*WrZ*?6{F|Qpl2Ld%<7q}o#$(f^
zPczEZFK4#l;BWcHSS}Cpg+60B2k6u~5ysd0Hq87jdW<$~{4M^BFB_O``1xBLn9KQX
zIQd(yFxv3(x3n_7%w)Fl=WlUlewhHSwX0?Nj;Sq}^}XdlX$YupZhlywwo3yvR`~sR
z6=<f1Ep1l-0|P_)F=rVAaQabU=sN(KLhqCd041UhK2H$UDdxq{cVLr*T8CH*L*Iev
zcTY1K)?ZNpjj|?#OnY$x%!W)g>;bc*!QvahY|sgzX)l(5+2&yJ8DMq}nB4<ngGTK6
zI~tf?Zed98c9wv&p85`{Elyx~nFZ?KZ3`9wH9wq1U;bqT%Q`Uh9a3AEz>wbQERpu&
z-m(Ax(>t6+L1F<6=^f4@FHM-zUVzS1OmC=`VJJ;cZ>W}J;BS><N^htJ-LfS*{p=Y=
z1;#Ja-<@HUi@3@NHeE37#ZAz$i{MWEOO0EwVgK#QAisj=(Z7L0OO`$Tn6se5%Xy6H
z-Nh2k{}@Y!K>CA0MdCJRnKZ+bFC7>`7Eez+%c$%4{OJGxEeA>^A+BpVP|Bb7;>s;Z
zzIPUQne;#H#Zfpn?S;M=14HY#5}08xmfW0v{w$-Y=)|M{|APuf(6|&hgT=pma&!96
zvyAdeu@I>PX@-|x$ENK7Rku(T>y^@8INbXGf4bE<Mrr9T(0QodX)h!|>N}68@o&2f
zHtoe!$>{~>7$s$EB%%6B4Aa0j@qwDDkl=WIYx=TtjPvYYo%sJhZ6A0J=a^cz+??;N
zxA|LqK|Q-{R#4XXcL3CMNqfO{^Z$R)dX~;tZ&omZ_WGrD-g?t_Y<k;yM!9<T*XPx`
z_*%ZFclfBV{W}4gRBrewT@s(R3pA$*3QQjrHof$2rZoO-H!M%{w;W{9OYe4qaBuRr
zYyxvxz_K^_TNX2<H6P+gYy9Q$fPta(IBa!7!{Pt`L0O;?lm+@<PGCsewcrk@<gCA~
zm)_;X(sxX)i?8v!#ff4^P%wapD#5KyOBNOWzPX?=F&=@m&a-{T(j3&%yE;HCD?u)1
zPwRY{#=q|+#GUMEmS;;&r#XY2(EMAhbTN1aioeC^|7&^B2p5|)f2-R6*DpZ@P|AN$
z+t(oNh3ujK|6hh9uQA|Cdl3Oj$H!e%^gt8P0smoZ41S!Se*6NXve=n}|3S-iSne(X
z`2sW!>hSXKzv)iT8TIwAABD_agO?|~{|D1re*XXehQ|*4EnN(HX$xJtL4%Y=X*+zT
zFL=%<F6PtCz)&Itn&39Pl(s|TKOaNdi|%vN&pv0gXX-dKo$m#sSe(oONCgBsVCG37
zsBxaw`5VMZ106S$7M_;T1g`q}jzOz6#4V^G6;~R5bCo!h3pD&@Eio=vPV;W~&0OyD
zTB_kUcZqq!@96~>8AXJ{(=s3n3{^pfyqLNF|NrUJFET1h{OG%swub>UMYHQe96!TL
zdvN<PEq?lii;SWiGr<<$Jv#mEMMgb2a3dq_Fle~tNeXC|U9m(UEn_uU&BUYAjV>`J
zNhN;%{~wgXUv}+#lCnYpq~I)AfynfAmlzcVCxgm*P*{L2sZM*b<mmJVml*A2W_0WE
zGm3?D^D7)oYXlvjAfE<0h)C&R+AFc?R+kyobptO;Fzf`a1@F7rcd+kb-^0F_X|Dn=
zYcPPcG(Y^uuXONL!exdJdi;!X3#Rv7W|U&wK7Hk7#_8^7B~SnQleSC!3O~ckGygtM
zK-#U{4c^NA!mAIodj`CNn}LDh%j>_t{-o^yXFyO@yXV1w28Nfd(_5}Es)@8%@Pn2H
zgz)I3?F5}nmiD6V)bxE<82uTyPv^VJ=)|ZoJ@6`{731saJy#h`SbRZKbVsf-n)zpg
z)?IYok!MefPm4>7O^Z&8N{dX3I6r4Y!`#zz^wR#Dm3003BbNs1J%iRF-$?6xkd`5E
z4ZQNx@<FLggWb&U3?)2i5%Osn-%oCLxyI<m7#Rz4TIm0@jQvL$7+&uGmzKeBfq~)W
zwts0EpDr>myj=S)E#nGkVbGF)X&DFKGcdfI{m<|cIL-?g7}9pdCh;@8)clPsWC#)x
z+kWCYqX`pJ+JxzUZZa;}KIazWVb=N;-3<J#Pd+27<^-uu_>=}~DKx)PNb5Wb4ZQ<u
zX$v=e2lpTa(z{&2L&73zY29W!zNe>kyYi%`b%zRoda#|B)A-liWJ){unkkL(V_NfN
z25=`3v`iE{H^RT&mn*Ha{ycatCjGc87XyP{S~p)!7g!l+@h~%}9BsW+$_`o>-Ljnl
zG<Yip9%*&~Pm#E&@PPZUJZUeQLH+p7!ytvN4UFk&-K9LBahv7`%$r!!G!LcmZ#$I6
zzx{lg<%v3G&?Xc9ZHLm+G+9*AbPhh?1bYTFQOBHi@EK=%8gmKA`0iQ;&?M=>7c6}T
zKxQ3$!7_d4D@Mh7P<4{d7|NBN*6gAp0a~URq9VhPp4Kg+lGgm2xh^N|;BTh%&KMOj
zP=J7ZjpWb+pssW0VbGkVSlYn{OzDiSTxqSh`CB)@On3|$`eRW^1E1fN26i5!D?@r0
zi^_o)prX9~KzbUZi;6^gS~JMrwAR}tWq3j+;5w+z>|{{^6=I;FNg0*bZs}=Y-~CEE
z_==_PP<k5Z3`fwiS<n;{sCqm2h!ebElLb6`+5DV8t@C2ft-c$dm-O8N`Tur0V=UL}
z&7h_l%6R^-KWPDJfoVZ(ay=LNZlr~z@o#^U_Ttv=|Nqls<k_LQBW)Kr8y-^Y5}Wbe
z;t+q!JqAc&nbvt&ZPASH2VQ_8AG}@=Jk-JtTad90baLB{dPp;A6_^7mJknmw1F<`Q
z*szxvra{+Sbc2L;7=v3&^&mE6h(s^Ft3BW@sGQ$+AnipOSmHy=0ffF_kkAejus(MX
z8@%Y_gI;=98&qG^fwUKTJPZsCk2y*tVAjckl<olCAfNU^5X{a683AboFo9NTL%K8#
zNL`v$o1tYtsF(P1)8?0H)1ELIDK2NSQ7sh(kD)=<q<}UPfmZImmIp0Te3>;p_z9yM
zqs;XAPZ%ZZnbIITcDfnrt-<?s7Bbe0fp_b?WK09^4M}^UvF`u>mme4#Kznu8Gk|yM
zoB_4n_A#fu-~q{{GdBDx=5Lw7SZ@K|rLzu{gRIkbKtlKB+W-I4z#DbaUfcz-L2JRl
zlewKgMAKg6t^fc3r5a<yuhJ4T&}JR~mj%-UpE4>lPMu!*lu=2gkd1-ir4?fuXxC8$
z|CED}{GQg$ot_3dQWQM=K7G$qMoV$ev=>5a|NnpeF+HuDM+LmX@<!T=MbmknG1{ql
zroGs^21)W3c)*$^?S<DmP*3Cc>)f>F!z|OYo-wL0m93dR;TfZ<i~pMc{~;?CLA#dH
zUf8bz<%Mn&mDkK^ou@$yco@OWmzQ3kc_|)H9S5DT&hYxd!0^)T{mT{8zdU1fuYYh1
zbh*NN=w6P@!=Mo}XIUGrlG<`L8>SN9a=tXflb~Kl6GNKe$=9VetR=oSocyg@KrLSx
zgO_U<Y=laR$^~r%N`fJ6L>s}9@Rw5=Z1VYAni*^+@waw@l*%@|Y-C7#QLqmb<e;@=
zeFs3x-)vul8n)X(t@ckVL1SYd7}GnPWnPDaa$xk!uEP*BA!Em&r4W}O5|OvlUa0Py
zZg`5(tbRgThSPHfhL?TskP3G2oKoj?(B_I4(QKf>Nl^TRsIY(rwbQ$TMZn8GS}s*Y
zq<QFdi8*wqbzaj;>(;C2O0)c1DhA(U(<QbQw8`dI+QsLu#nar=I{&5}e9O{zG_CnL
zzgl{icp88GwqNO;)dK0qotYRur0tjKVqi!IEsi$>HTIbAmy4zC1N--wT9;TU18DxQ
z`32K!iL_mex}br_8^}{)FQwO}d7{|ea;d~ftxIg%_q5LI>0Kcz%xQ+#(>i}O{Ax(+
z{M2xXA+59i8rUL+3hstqOl53o`#_^$piUg9=OcOW1yfq{g99L~ENRV;?7?$o&JyVz
z-lCwDmk<}cSPV)}pb1825oG729Zt(AyTrioa>W}^I|{N~1=O=<;cu~FEcXTVN+*dh
zfI6d(8CnjMhJ&WznA2Xw?U_E|4Wp6tA4VH?{+64J<(xLG{H-;NFO?Z>cJsG<WPJH@
z`rS8-2I3nT(_Z}D_y2!-cQCjZXG?27#rWEKy3AWfX|sdr9nO*)x<SWhr8PeQr3;bt
zW6rV+=^frOY0Z!RrFRCayi8+Ed$A0Zs9HhWLtfkzo*wg-QGsbg_w<Ihj1t0A!D){n
z?L`<w4Sy@k^wn<}O+-&Hq`eS<h?Q`ry>J(1V0gKE`j@wi`etw|>pKpC*c}&Mr-SGx
zg`mZ8$DL&u7*;5hrlq}Dy%#cGz?Synp3wB@cZ^2dvJizJjniknW7M1ecRHhPedpmc
z&)1LB(;(X<xzb+jSO#8>{T94}J31{66wtk(Mp5!B)HDp4FFu`~cAP~8RJo-0v8bpm
zDE$r!Xg1J-UQqj``K&=&CwP*U9lT(KJ#9w<sFD0)^=hyK>r2?vn$P}!d5<yeMbu7E
zNr7ZqTIUP3MWx?C)7k84%@5wEwf-;Rgz@f!>_Ia$9As$cQE;sbHZ}q@DfI6^sZ-ic
z&;gQZyFeF+fLa(Y1R()bUwR{L=K_9ESL+g3+;tBqtN-|4av;5f8MM@dkAZ=|MUe4z
zNm}E-PfQF9{H+rh(sqJQJWAX32~^*7{z!Xq1f;9=Kxuc{&M%-9Jcba%et;_B<{$t0
zTMGY!jBEapP_K~I{KKuDBdz&|cB#Ybdbzab7w(`k#DOUdbmy$zYo0XS)gW`5e=wFS
zpqjT5Zk`fo6oK(|b^0-9MuyiVY2X_30@Pg~7a2ob#NYbkA4u}x51urSQfW{>P#8%S
zZ#_)erGII#g;R|8(kwrhD56@e54U>7Kaf|PU*AHBc~G>lfny7_<BAOy%_l%5C+MIN
z>3^Up6x1p9&O>_4X$vc+Uz)_YBqn1&C^z4D2F}fp8Sq^Um7oFa`O82hzk^6x^MQs<
zj5hJ*#vmWPPykIXcY^ji9)Qlt97;R*QXtJUjeq??(5%M6R|4ss!4m16&eONNXH;O{
zbb^85<*R4YZ@*^@te>?Aoc=(oo*r-g|Nr$>Xhn4Rd|KzhCzCo3U3it&4BC(KkkR54
zXprv%)3Zq(7t#)&PYX^%oC&9qwga+gcF*Gf|I@rnU#0D`0W~*vfDVRBd$DmjC^en<
z52_vxfabeEn|wj*0w!_<PXF_Pk-J_1G=Bpsx7ztzsu|0*Y=Ze)mNS$KgT}|AS#5&&
zTTZjssFZ}h^kfAcfHaT6rj5Uah4G~otIa|FmN`u2IyMu_`EC07+k04TI`~_Xm|n`W
z+8p3-m1Kn$`#Ziq0~Pzu0xug`Y!30aR5RJU;BRSXdHJ0sy(`68#)hdxvz)W#K&c35
zd6}pUGk@znmh|J!0?Z6A16W`q6jT2F|NqjF<;kQAFQ6r!%u6E{P>qMQ%j2d0rSvXm
znU(`3yf%!bzG*M=7XJVL^8NHz9~qTgrhp2T)&uF?&MGC`pwhApG#(3@CVB8Lz0+Cc
z<pvh8XnM1^3S$~*>`~_BTo%y630{UC&=PDP72fIApBQE9jUgtLaDdb|zhq(o)iS&c
z{H;MOX)oqo`2YX)JD9Uq{rwMKgu)G)1Mubmk<Lt@g6ZG`mNZ82>IeQMhXm3NJ`hN2
zKB3=mZZc@sR$8YcXb!D2kVh|V;fn6Geg8ot9Qzp<`WezZO6obG0*3!Vo27oGHJ$<u
zMW?5Any93MPL*Lnj8i)*K$=XTF>6Pao(rHc70|pOsFww|nDav#=dXrylfjBKKxCj!
zn&G#!&J*d~-V$k@-__Fj83Q;#J@Ogd{0dy~f$WOu5uX{g6qkQy`0#n@>t`SZ3%WtQ
z08l=6QQ?01@h@om>w@WvKQlgH=LMI*ywkhBFv{vdIcYmyfc6W3Izqi6D!gesKt){I
z3;k{2+`-?vhyj$bd8c3f!f0y+-_7%~7__tkto|i4XgS-7tzh+~wqVui9nRp*h<xcC
z&JrLI{^>qn8D*Kew@%Og%BWdy#|Pdbtj++62+nJzGA#!x<<puU)Pwk-F^#XF^6!Nu
zC|`osjx?lo9_>30t_{>dI@3DMl)$6>$Vo4X1(ft`7)#h}6iS?5r|P9GTu`3|x*CYF
zOa$DrO6#2fI;cEty6`tfZN??j?Y}YFF&>y+_l?oL9_}@i^-=JZcr0ldKS6HF2mod7
z3~%sAOw$5T=03s$$^<Vu7l10SZt#+}s_&rIF{Dw)k>2Gj3971?(z~2RK@8}KHz<m7
zRG1(u73&2ozw%E$kk)w=BwV7xY<UjMJ(kA#4m3Q=0NPOlT1D_7t@9Pfg;Mr(>lzh~
zGEhs68PZNd>Jq+8od-#D;6AnhC<lqKg3NVMVFK?Z<zIgg#Pv~OPGdX)$`T><ptXbR
z4}mpEfCm;kT~uVin>0c4&P<>*3t|Psr?Poq!vH-8|AVH}_(1M}OjSRb3l1329$MH`
z@`SXEiSrm3URK|Gxp_uf#u5-a|K7_pryKrs^0x$O+)c~)^MQfkWz0RKMutLK=kfF|
z2hf6^fWHlo{_?jRp6;-lQKEkF-1M|=f6%Z;yg(ZG$TiSzQ1CJr=!zK08(`;g6e*>>
zu$&8;00o`Amd1Y)+yUZB?{?>Edyw7<I(N+=?S(i@MF%J@`A<O9xu|e~Rr7&7?#`9Q
ze*zpnLg~zD-Tu@2cQfkNgO`J(cb2Fy>7{qi0IvxFFP;TkE|T_Q#+?8E(>rri#6giD
zwE(nB5VSnx7HHljL`4MD^?#uQse()RK?^T#y-NchiS}|iXohw>IDx!KdvP07`?ek^
zy@M!0($jiNm{>Tb8}4Bgt_RKNGpVJ2&Ib)$gDTn=wjdqNKmM1@1ud%poz2DtR+Q%S
z=5-fzu}>)n#LCzDD>(RDivL5$B%qC#O(1u59)u`KYdu-Q`7-Q(8u+9&Q2mRP;L^Ac
zgQiRw(wh@h{%z0s#mLUW#e6+2W5P=YhL`TsYyUB7$vrsB!0@u`dRj2JI|nX_K+}2P
zHIII4rXT&ss3Bhb`>fY#SPcoPB|$|?_T=d-{~3K<Wlo<@%eeiRf#GGwb;xK&dP9Y*
zcd0XE90L?b6`(Z`X*-2MId$Kb?+gq*xBG5=Ueb3vy`e&ep_Hrd(DeQjjH00#)6%;<
zMEXF3AzQz<Tq@B5_hKwAmI{MP%Ze_L!D401FI%R+?A_n+^L{yJn&GL2Ukwd6K{J&X
cU+zD2R{Hd-=m!iR49xV6jP)%o8U8Q;03&J!egFUf

delta 64366
zcmZo@;Am*z*pSe)Q9yyQo`Z>jA%Tg3A%ls5VFnWe!vZD-hMi0d3?a-63`dw57|t>?
zFfgz%FmSRkFod!&Fr=|CFch*dFvzkpFnF^vFod%*Fsx!_VA#&ez;KF{f#E7E1H)}r
z28R2r3=ALH7#M!CF)+AtGBCt*GB6ZzGBC7qGBC{GWMEj%$-uCSlcApBBqsyIKS2hD
zhr$dDydn$?t|AN!yF?fmo{KOrXo@m0w23k>uu3p6$V)IV=t(dz+>&5mkdS0xNRVV;
zsFh@3m?+7>AS}hekSoQ&FinbqVXhPd1DiAhgRe9LLy$BBLzFZF!+dE5h5#7`hL17~
z3?{M+4F6;q7<l9u7$(ZsGcY`tXJGg!&%ofNz`zirz`*cVfq`MRA_K!sWd??HRR)He
zstgP})EF3Es4*~jYA`Tt(qLeCsKLNsqshQftjWM&s>Q(Iqs73Gpu@mWrpLe_pwGY{
zt<S)qsL#Nls?WgSuFt^WtIxntug}0RL!W_Rfj$GnV|@k&215o0>3Ty3hL45}3<5?B
z3_FY%7@~|B7!r*c815M}FeI2TFr=F>Fif^&U|43!z`$$8z>salz_81Tfq~hYfkE7w
zfkDHXf#IMv1H)|_28IVV3=9Ug3=9iw85lm>GB9x2F))<dF)+NdV_^7i$H0(h&%jV;
z&%nUtz`)S$z`!uUfq|j^rUL^*xFZ8Ywj%?>TPFsFYG($9{mu*wr=1xXJ~=Zmc)Bn!
zB)c#$WV$dgl({f4)VMG(^tv!GOmksinD4^Cu)>9bfyb4BLC}?fLDH3hLC%$d!P}LA
zq0W_oVZAE@L!}o3!z3>Th8bQA4DY=d7>c|Z7_N9TFx>KHV9@npsAn+tVPJ6cVPN>@
z!@$7e%fO)N%fO)T%fQg-%fR67&%n^>&%iL>pMl|tKLdks00YCT00su7Kn8}wKn4b-
zAO;4FAO;4DAO;4zAO?m<K@1EZf*2Tn2Qe^k2Qx581T!#b1T!%B1T!$ChcGZa3t?b*
z7skNwIh=uEY6JtrlZbi-2JT1(hNW=~46EZ97&gW+FbE_tFoYy9FvKP>FtjExFmxv{
zF#JqlU~oxfVDL?3U|0^qNem2P$qWo?$qWo%k{KA3QWzN4q%bh-N?~B&NM&H~Ol4r$
zk;=een8v`Mo6f*slFq<Tkj}u+kj}ucIGurERXPL16A-&TgMpzjhk;>R9s@%{0RzK{
z0tSY^1q=-Ag$xXCg$xW+N*EYsl`t@DC}CjOR>Hs#T*|;uTFSt%rIdkTe<=gQ@lpnc
zJLL=v&&nAXK9n;s{3>T)P_JNMFsWc*u&H2RaH(KmsHtFJSW&^iu(pDMVOIqM!{G`B
zhT9bk4DTx#80rnG7#I?&7#L<(F);8~Gcc&tFfcIGGB8NgGB6m{GB7-;Wnehh$iT3v
znSmjH5(C4*Nem39CowSmnZ&@LF`0p3<zxni{gW9O-c4p;P@2NPpgn_uA$0}=L&FRP
zhQ1jL3~OgFF#Mdsz~DZUfuV6G1H*)w3=Fcf7#P0IW?=X`o1vcJ)*J?gk8>CpGUhTc
zRLx~zm^_z(L1R7xgV%fphUobW3_0@|7z*bzFjUWHU}&7rz;Jp#1H*&)3=H=cFfjaH
zz`($_kb%KwAp=A3LI#E>3mF*xEM#EFSj51PyNH3IWDx^H<st?KgT)LCYZo&xTv*P)
z@MJjygTM*~29*^I3>GWu85n$4Ffb&nU|=X&!NAb5f`MVq3I>J^D;OA#tYBccv4Vl&
z%?btvhLsEqA67Cju&iQWSg?wLL18rmgUV_K294DW3_7bB7z|c3Ft{=@Fq~y%U^vah
zz|h6az|g_Uz_65+fx()cfkB9efkB&>fx&^7fuT`|fnl-`1H)$_1_tJOVFm^PVFm^b
zVFm^VVFrd^VFrc_VFrdWVFrfz!VC;Mg&7!53NtXA7iM61EzH2cB*MU;C&IwsFT%hu
zQ-pzGIjF>xWMEK~W?<MV&A^Z*!@w|8hJj&|3<JYM83u;mG7Jm~vJ4D%vJ4C{vJ4Da
zvJ4E9Wf>SY$uck;kY!+~zaq=Pz%0kWASTDapdiP<&?Cpduvw0Q;kX<F!xcFO20nQP
z26uS|hOP1p49Dad7#_(pFytsOFw`k9FicWlV7RToz`(A^z+kG#z~H0Ez!0U#z|gJ8
zz_3)2f#HNA1H*Mi28QQ~3=CpQ3=CRI3=CFE3=Hu~3=Gqh7#Q{|G1N0WP-0+UP-b9|
zR%T$(S7u=FQf6Ryugt*Uqr$*Yp~Ao*t;)clt;)dA11g4985n-5GB7Z!F)-+>F)-Mu
zF)-AtF)*;HGcd%eGce?;GcfRJFfbTtFfb%)Ffg3fU|{&I!N8!Z$-uy<#lRq?&A_l-
zn}OkqHUq;`Z3YH5oq7faQym5dUmXU9a2*DQEFA`h5*-GHE*%DjcRCCVMtTeketHZH
znR*Ni&3X(B9eNB5kM$TBzUnbB+|g%XxM;w@aNmG|;g<meL$?tF!$l(oh9#y942LZl
z7$#dWFubv1VCb}AU^r^Sz;M-ufx*_6fx*I_fg#YIfnm8l1H*xOdj^I!2L^`sjtmSw
zP7DlNofsIDoEaF5of#M=J2Nm`b!K3A=*+;N?!v&Z&4q!1$(4a2$(4a&fhz;UDpv*u
zV>bo{FE<8;!)^===iC?=p1LtG{BvVq5O8N;kacHZ&~s;C@bzF|xah&a!0XAtAnnP(
zpzX=P;NZ!?5a7wcP#@>Xz|iT*!0^tKfq}z|fkD)ZfkDHIf#J6o14FAf1H%??1_lKm
z1_oOn28P8x3=E(A7#K4A85m~xGcYg(FfdpKFfh0WFfil>FfhywU|={A$iVP6kbz-$
z5Cg-RAO?o7K@1GC!3+$k!3+!=gBchELl_t;Ll_ulgfK9i3}L8em=Maq@FA3ep(>1l
zp*M_yVO1Cd!>%v}hFf6_3|!$14C>(w41dEJ7$hSY81y0-7`h`E7>-9UFno?+V9<zU
zU~r9MV0ahJz~G+5z~Gn6z%VD7fni-T1H->$1_sYG1_rxy28M`q28J!^3=Hqm85lA$
z7#Nx}7#P-OFfjbhsAphM&SYS4$z)&<$YNlS%VJ<q&thQspT)o+oz1|In9ab@k<Gv$
zn8U!Jl*7QFox{LjlEc8@ki)<bk;A}{mczhMk;A~yox{MeDu;n#c`gIPlUxRdx48@q
z%6SY7Zg~t0g?S7N_dx6d1_rA_28Jz#3=D!r3=9@U3=HM<MGOpcix?P=7BMjR7c(%F
z7Bet37Bes`DP~~UP|U#ay_kVPwuFJ<KnVlG%Mu0#?otMZzETE;*m4Gjx^f1F=M@YL
zDwPZjE|m-nxs?nIGb$MvZdWoeysKnj@UCKDh^}H_m{!HWaHNWX!L6Esp}v}dVR1DB
z!-r}H2Fn@-hI;2328M|>3=H123=C<t3=A7;85mYIGB5-*F)%D`Vqn<X#K3T_iGe|}
znSo(v3j+hwBnAfYNem1@lNcC2O=4g$p3J}yKAC}G(PRdOTay_W(x)&m7))nicr~4Y
z;lvCEhEFpX7?@@<Fci#WVCbI7z;Jvf1H=893=Af-7#PB4G1N08&SGFFn8m=bdKLr2
z$yp2xPiHYOe3`|-z%-kI!FDzSgU@URhK$(^3`=G+FdUuD!0>!F1B3e<28P5r3=EBP
z7#N<+VPFuS%fR42mw_RAE(1gRTn2`9a~T-+%w=HsI+uar-&_U;iFphRuJafe!sanB
z^vz>nxHyl2fonbk!>jpH3=A0y85k-TGB6k}Vqmy)kAXoekdeVPg^^)%OYa<x`fh=4
z2bNBO)=MSKolY!=ySX|8SUNdcPnIxuI<j;!9q#sEvG(97X6+FC@4#}n^I+$p1}laV
zW~bLbIxlFRILvs^@?a^m;eo@!T~ZbjCG3(1nolsk=5TPbJXreH@Idt8u;AV(#$FSy
z&VyaS|64AVa5{Db{&%+gT>9Y{BSUmt;NjrT!!MTo|Np<&h55hbjbfJ08?S{LEEMX$
zdmM9MWO)6i;g>=^yF-^i%casUAmchOcZ*uo^E2>oKhS!qgop9g!3R8yhtfK^UaKB_
zz|nbY^7m=#A_xUsjHkc~x|k*#P1j02-4UX~%)kA`E;a@RhRzo+Sk^KytPm(=F}(fS
zv*mWF&@K~*_@w{;|92cV{Qp{)f7@lJ*KZsDGcYnRl-%Io_PO&@=ZhCb|NsBDa#3L}
z5$+9R?0oSe39R0|<#y@S*PAErpDrzF_5c6>mID<E&4)Sow;i|qP%6p4{jlMs7d4YV
zPuJ)D|M&m@&Vz=Rx>=?=I8D}{A;;T#phT(jaPx`(mY+*xCP&SXukSqAEns+{^-`&P
z<Ie~ueuff`#-AZh{0yah%|8r^S$7yPFfcT~FgScTEV#Q!fVqgHJBmm1v*nFqrp_DP
zLamodU!v*bMbQ@>cR09P)W(UQp|^+WKRW|M<3olY|Np<(vzmdy@<fp|bGNL?<ZCk&
zcw6fE8G0lCXP*>lJh)&o^Gvh)hI)R6=(xk-VZoipIxoL?^ymNo&f~4OOQpJHEu8on
zT5p$#^aitZ{_Onl;`*Qe|631~uyjkme$ja&IxhZjT4RL>19PcmaOYwE?F_qE7#J8{
z>|e#e@cqIH<`PlE1FvQIw=?gu0}1>6{r`UjN6G8%Xr9*Fr7w0cGB7YiA2zH%a5%X0
zV)GBCQuA)nJ0K54F?Py=7_FB|t-3{X>i8L&e+ifC_kzShyiS&@4R!nsojg}t>i8L6
zi#7jXEWO?>dIP2x#CUxu`fzaPq3#X`eg=kKN5;-35QBdkV{ar==PVHW-~$f+ZGnuO
z;TNJ0hlYm*H^1TNJluKB@KP_!RR&PHaZzFEW|^Acz|YXhqGEWUyGDhDf7>4R1_yqI
zZXOl>^*pU0xr0Bs`M2p<^RGYK$+OR)`3FboHK*oZ9Hl!a_s+_yH$2%L!PCuf-~}`P
zwgauVOV}6>cHVgXy4QvAf3FME|K<nG{M#BV9QYZc4+kUEw%#t`<llAxsy0OMzl}sW
zAL9jt>epP&kC^$lH9>XqZ<pA~(7?d3%K_x>8!v2r|Np<siGhKkzVk-(Oa0&f|MPEW
zSp1-xpW%i3Dh3Ar?W}LA`5BrIuq;lg=Vt&#+~Pac{0uLruVP?Wc*2RF!Ipu6p`o1T
zIO_#Reo$C6ycPrr9Vi!s3mq^#u=t82Kf`g>1CIO*;&b>I4tG0nv>qs7?+*CV?eO6+
zD1ImZoE=ub;phMVou@i)yx0a}-0XFG(EQ^;>4oSxaIgpVW=J$2;OS&hd6E79|NqWo
zofkV_yh!-}|G(ui$%{oC-7G4dIx3w<yIEAgqMZjjFN4^25XIMbFfbhWXLw2TgygO7
z_nNOWe7~=FOz}EMmqBL*OXrIh`r06s2Rko!zIeg)|Nno@bCUPJ-)O$X@ckA@WoIcv
zXDy4hDafatKcrc&O#V4XT0JT{E<W~fLxnj*sXi!ibRO@#)~#iD+wyLmbhpbrmgWO2
zoxfgKOtzhSgyniCkIH1WdFu5^d$|}G7+NpY^K~BVyz#;TWbdJFXBMws9<xp#6_(Cp
z9TzYEYktPq?W4lNdCt;geLb`5>+{Wj`Rh23JM;Yi|NsAM-EN=tf0#?wyD*;AJjcIn
zk9i9yN`D^w&(e9W`5AvVk4mRy>$g&_&R~vCXBNZ%ue~g<)j{lIyfAtFynuQgMh1q?
z!<`{28X!Bnr>HnEGB7mnQE_2pU|=kj>t^6z&&YV;;16!YOWh?Z8l5cDoSJ_*lzx7B
zkcol8@IY^gicY7A3ja2fqYoTGDSb0I;jib}-fJS*S)#(hzfI)mL$J(b{`EZ5JAG7m
zKthk8LiG?a0g%{Zs2D^@gnt{)(I+4wk#7F=BK;ulQxMmrn}5AYe`kq`1W4!^LWqBx
z&C%x|F3;}n92FM+^*(zUx@%N8dUeD#uXom{aCFzG2rz!{4p9-%{FHeqfSZBgVEr#{
z&0oDGwhWymDgv5+J9AWIx=U0z7_W7fs3?FmgLSHO=cq_@m#Bzne(kPNkzoASU8BO&
zE5fgNzL!U=(?^8^W?tvTgFm@@Lu?r`FUhkpFdY2Fo%wbp2Lr>wzub&hGyj9eeGdNT
z*1X;cGJ!+$pJx3>&9fk9b%&^MF#hVcQRx)#u2E6w6)^{~!$D3^=@sDza~!&BRAhQZ
z^ue5j?hq9j%~ze%8yFZEx<gb{G*5L-UjSh%XnyLPegMK20C@+*e*mg6SX5XX3@<hR
z;NWld`S<^SuTQ;-4k%i?1-m0zx*a*XGkJP#q%?2!%4lf5$UFcJq95FvH+psCJ9Shv
z?|0Uyu=L6>b;hW0XddbeQQ_&16wr>8>CO~j&Xnm66k!gO=ynv*c9iI?5oOSP1r6k1
z+`T%?nQy@%@|QdFHaJ9nb2GlqJWvk~k{{ffFEoE>9@4zrt)s&D_uyadPQC6N6%NLu
zAZ8v*ca91V<5e)50~EE4cfo8P5L*+%7U+&q;nBQ&@Hcm7oCqj1H4k-yl5MA(L^q3y
z=8uCvxI5isnhz>8A5-XUQ2`};%M<*q5iI}z|8G13;)3&VcyMs%dH(G;Iz?1EZ@e&H
z#K6G$gMa&pZV)#<I{szbm;e96f;$g)UhFMk+`!cN>D?O}rc#~WV5T?C59~V*86If(
z#Z)TS`Dt?eqElLixBs2spK`cY<}Rqd=HJfNdFw^S0tSZGw<UtT!7LzwpCD^r22T!N
zJfXe?mKSZhn?ZF>ZvbQGWDujl;y-`uE=C51-T)?u2>-SKM#~Tt8~zr1W(J0aU$;w~
z%as~_9pZ1%2lJ2cx3VxZFm&E{@%-!m|D7%>953A&K??8kx4vcqOPm8q+<0*uL^b>H
zGceS@?(DqrVh4zS4DNvDe@y&+d7!ch>=OQM44nr%4mCgGZ+OVV->S~Yz;N&f3xBH|
zBLf5fwo3;eu`%B2?gqKJx011QH;B>2+0n!FgP(!Hq4|eH>7(X%j;|MXUTD2k$z*td
z@wjG)3WsC!PXYc`{(45xP@D=&iy#9-?;7SG0-yrM@PFr?R#3n=*n);?OWzxw?DSC)
z=xtE}7j-TwDuxFPzjc<Vh;-Meh;-Jpx^&mHxOCR2DD3BCU|`TZ-dUr<0}48ZE*}-1
z%a3}C{&$wBSQuXF6jA9eQBkloQQ_~o1}Zf_)wh1DWHP+O7^0%W7@{K5U7{ku_^C6b
zmBFFcMyRt!MWFeIK<TXGt_}<gObmzss!`!!;_vhQ_y0dEY8W~X9sI%4Yr@cZvH2lC
z<GIcf6&8;=j^-2pUrqx>!Xv)Y&xQxO!2#Oq#n=fBFaB-yLY*NkE)F1Do;2sEa0nXy
zH$2%L(&J+Iwo^w1>SM+qoh~Xo-7G4Whxq$;{QLjEdow7Id-E7OSA!T`Y~3X)Jl#4f
z9V~kPSyWzM?XFQ#={8a65-|q_P_K_IL&p?DP}nv9;H=~L&!Y13JIIt86@mJ06BWkq
z;9z>*S)-!S0djqZkBW5X_2%dN2OqICK4Rc!VCW1{k?H((@R2~bkBSWEscs(?9?pxM
zJ}M@?{{O)Nefd#mh>A}0ssCL*D$<u9fqdwrV$kiQVgagRc7mhjXQz*fLoW||cZiBf
z^H0utyKWzqdI!ye-61M0mw$C$Y^YI@W+>t74pGsuyjaWD9in2uc(FHxow4)UE>N|p
z`RU+8f$kC&8P1QKry5Q*bo;1ibeE{GaDMEZ(hEv1|9w<gnrl>8{+G^rDG5rxH(osc
z^#6Z1I7#+~GdBNV;_sUcYP^D@!Q=H)!>|L5M?hLZIr4CLSm!m%Lq%+z$3HK5&D;Ev
zv52Efgs(${<Mrpb_`|{7vf!4n_y0~v6FGn}`;v&}!R(VFy|Wg8+RRNo_52K-x1wKe
zo*cQ{##sN||NpPqx*1-dG`tON3dcfP&@W8i{r}%v!HC&-)}4G}xx4*N4p7p3^nXGJ
z0|P_rfr@k8EGnQdii`ubI2vtry7?JExP<-1p(P9quit`ONuZW#=h+t<mQ40r5mz6$
zl!4*3^ezEb28OivohM!#TFSuCJsFe)IzPPN196%`oY&0FC;msr9R{^+HC`~yXJF_&
zw%h6osJC@{ml^|TXk3Nq#iV%*3~9$*RMZ@pj=8AFGj`s3F?%Tk!#9vfsWL)c7EB!j
z8&l`47Zpn<8?IEZX92l!V)Kdr%||q%;|>R<9d}S+U;?$~w#;K-*kuT|?GmWLrn;1Y
zA@b$I#UNjoNW5@<2kuJn@48{j&#*&{k%8gm?xhS2hr@ycJC8Nns&w-+FqBI1Z)bZU
zJPXvIS;1JUy^95;b|wP@!)vq72e$wJ^Vc(!-GwSHxzZ`3@<Mbm14Fln%IjCnkN@;K
z|F`}3pMjxF7@~0=s238x6jTVkmge8iwiDC?fpl4BfB*mgxSI?}pz}slbll<2gS`$c
zFB)F||KEAyg%7AofyYcKcZPd1Kf{Y(OBfjBA`S-xWyFEFZ<a7HG#}vsb%FV}G1>5!
z3GCW1IcJqJ_m#IGpOy;ls<E9sYn68WvCa#fr#e6K8+6N_sNrX5{w-f7xa*HKKf?}X
zP>(3?W!nG$|Fci?bZ&f5!_Uy!_yj~wd{M*C;M@t;0c|-qzYzdcYCb9~;1VH6MFZ3%
z>daB$>8?@Hfu!f=-}QB3yS{*e4P<!p5rOFXxcJzYph`0PgGlF1ND5yEPT_4^Kq>sy
zi+R8Q|99>L=Lcxw>}&%m=$y8so}Z!HMTMg~M1`lbZ3RgAv^5}d--ddA29W8XL=0*$
zH@{H<)luLUg^P+scZiBjr;Cb2XNXF@Om~io1G9??hcL(#7M0Er6_$md%-89nqF{Kt
z+eJme@-TmI2qObS_F<9k4Irz#cYv(!{M7lAc>>5<;SR91Au0l$J}M&JJ}MlRJ}RK{
zOGMg7g{PR=`SlL4;JMD9V1cUM4zMwf0-g0B^Iw$8LcON>LGl;WWip`VEvR;R?E~{9
zSk{rFGmyu*+eJmdl0~K4MTJG$MMb1o<3FfD>7oK^n@DJbL_<_Kf&xH6)9s@o(0SuU
z)W84#n~(5he-^O@2PS`SBdAZ-+Xr?EI7qv}K?*XqMukQ4dQl3qBZqJxPp6BDKqsii
zLbbDqv-8Fa#b5vbzg`b@JzB&Fbcd*jXtStDhp4c0f}L%hDNxGK=%OMa2rA@nym<Vx
z{{R2xzyC|LI&)MUx?NNxK+Voh7Zr=n5EUCxGYeGwciw0|q5>*4U(Wao@&lL+8kvYu
z;Q@IL)N*b;S<2FSyF?gNQ+LLw@PI1u=(v~6|Neu@9MEXO;eee23=9mrbQl;I7J|k)
zUQGS@|9^dC>w!|;U?eHfaL9}5pa1_ywH_!H-t_>KT7y7&HTlo~|Av=dTXY`U$qgzs
zk9XetytJDeKBCp_&C=<?(#hCcAkytE(&-@r9_cD%>GqcB^pNN@?7RRPq5u_tI<1#V
zbdS5JX#D@5@&A8siHb;AH^U1KP>1wzMC<Jmq0R>{y#IsqDQD-07bY+N{|6Q8%|~>g
znXU6!=k*3#hkAYnhLWnC3<3-cyFkPau(xJ|s-wfL2TBrp8$hC+%$*PRYD`|RP9pT*
zv;Y4)e{_EAe3cQgfsY}yQ>k0||HaN5-O()Fsv6z=3@@C2|Nq~e{3rHs<6jWJR2UrY
zPv$Z(fb@Yl{~v<L!<~n~VYVa0X)^D6X)#c!MT4vQXt-32(`38#27w+ROCP*Y`v>-r
zP_K)M$P3kH|Np;cw~XK@-uL<l$X}3p<@$@?-$ANMG&_%VuK?8=t#3<YdtDj9g<j`j
zaE$Dje004E<Mhd|)=Slgbsp}#-gyqxf7&4diX=uzu!-z)0L7ay69Ypu$hj}&fBpa8
zDbZQM(OJOK`nHsHZ+|jBLuUq0x2S>>Kf`er6%f^WsZ^l(fIzp1N+eiQ)YJd}EvtUi
zzphc~&iY_^xBgM{Z{~Ul%e$o_-C19{d>QI3_=?V#a&-HOSo(<+9R;=dgkJ9gl{mqj
zEGlr9O#!(q1LA*?T_HC73_CtCGB7|aX#+?5F0h)7(-;_f9awgPJ6$3wFSMWj|KGV9
z6b_xcdq8P!^8^M4hU3kk+WO5(J_hcE7Eb&Ooy?uG7EY68H(DrN1daWHf=O_f1jrg5
zW(I~ApML!R|GIvc2FMk%lgl?c3RisSF8E^kzVo9rk4lkZH;;<txyh$DDlk2KJo)WL
zNo5CwDFSx<3_H#+F)+Mv1eu}@9>jc+Gj+1&Cf)jDo!4K?0woQQjj5d<o~3ktKKPrb
z`8Q*!;EP6>gijayvxL`fjn6=>yT*T@!Ol{PCn@^`)EO97FqUe9=I$9@2u@{S@GIeX
zlCpxa<n3#bT@4_MLCt~}8gm&Knos|K&GICngB{$sISf{191*-5l%pZ~FHK=!c#_~<
z!Ud8meQkK)wa~5vkQweEZ$F*GzyNA~95y@vY8W-YQRqD0d3hHDq^nXk1+s2}q1Q!)
z=S9Yp$x@ruo$RMDFm(8+uywoZq;(slbw@BYA7<LX)p_e(=cCRaFG@h(JJ@=lRE~f9
zu@^2do&eZPusH^kTQ+Ofzi{Gbc(HmixSb)gO9A8}4^X7=LR|D(@P+bB28P!s__rN+
z&AQ`1xXwKs7Q9%Xi=V;pq~Yz}LPpzsaR!DmPKS#xIzMh^eEqiNb}8pER-P_?28P$%
z9lRh0Sb5rURz8p*LlFNqu;}FnJL_LCGcXul`u;H>V;!hnz&@J+)GmOQBZ1!>B<lHF
zRY4uYqx{=JLyNmWUC9?o{h;RA&VT>^{|5_znoMW<7#QFj$9@Ke=4bzU1O7Mv`pe&b
zg@J*=@&kX%8BjZ}je)^|!S?@udq)1Y`rV*p`?2{XBV2219|J?@_q0a)&{h1ca~MD)
zfbkNYHyD36S_e3L2JyFoQuhkx5^?_R&TIkv+nregGWLVq?lX%4<o4FvC7Io>0%?}c
zETsZz-L67umd<RYYz@^S3?+gM)uId)Ui{mg1r9#oWIX=5eg^-xe5Qj>IXhpx(0Tm-
zKe!AL+*JT79bSV{2E*6?|6g-<zU=(<;@+qK|2sdz-FdH<f#J0vlEB$s1_n?$3>l6C
z<?_JJ;{h33Df|pCHqK;VSoi>x89@yaT@xqJD7N7N%X$`-I>+viR))@hU2<JqEw@W~
zT27W|H2l;rQFeI!u;I5>sUV2M*>bXk)xwXll*8@yHH*`wEN)J(&lz5FXuVXj2i$Uo
zSlVoB<H*nOuatj>JIL0`|Ns9l28n<YHUIVxhL<`&ytv!Tz>sEZCS9tyi;1D0fuZxm
zi_;*X<{vyI!f75Q{29d{y^J#%7$OaCzxFr0&A;vRE>O3r^TUhg2cXG`mIEb*{M&x?
zhBJezp9lZ{|2t87t2dmf^TP|Z2mk-u$d^m<Z#xi>u?A$&ju{LL5mB$VWIRmaXL!B5
z13VHB3LVfGcKxx=%K;e%Hv9}3+^PHwFM4KxBLCoX4*u=`d)+}J2RxmhUNk-cjq*1i
z;c5L};mE)JJ-83n`Qn8L$lbOqY^Cx$K{;cWBq%Yxc+u9wz+iZCmlT9o(Zj&d`Kj~A
z3u~|`uXlHT0wq^n5btPx>jD0by`a&9?MFLVRKNzm*w+IJAr?0N)>(`U451L`$%CBt
zZaM?QE>K0nzy0V7+x!3j^KU!Qe1ymHLy1CIK!!0$$?53~44oh0ihg&46Xk2(u#6Cp
z^qT1m43Y6*mx9cw|9S8K{|*+FE@p=gW-AsI{%s;EB^sc>3(Cj^sjr>Rz`(zayTeC?
z2d-%a%*>#S2_Q9*(?KB&_AkiHWgsJ6RM;V50ty9?XmK~lARCp=Tb(~%H2nMjzl*uU
zMWvq2%0-2pzoj3X&yK#h`4=>GRFcHM?Lcn;3rJr*$g&^*OZ+=rRM@(BR2UC-iKti{
zDrV|9WO1=r6y(&5)gV_~na02n8F9=-g^huKTZjr<FN-+;Hg3xkb)rET7eNX(Ph$X$
zf^abSsPIKZ@o#fcVG9TcQQQF;zd;HngA}-^2z4+wAK`f|1d?J4$WTb*XLwNoGCZDt
zn~w?`+@FiPz!Cf6r3tv{$^ojA4`<kdlzUFr+^NENeX`$9M?MAqZ61=@Cqeyl3C53;
zXYZ6Uw{hTS2oL*Tq9OpofdLuWAWciAf}%>HJDBBvvBdup6%G*YW`6PP1*lcY^HOH=
zo1HfNZJpr61u6zRf4m5oY`#l2Bnl#C1WIr}UZ~vp|G&9fhOyL+fBQdZ)0cnE1%ZRF
z1o*d~*rfnb_3!ro|FDKTk}PP+M(2+g4{lFhzDtp5@9oK_cFDxf2dVW@VFB0CogZFQ
zbTBZ0TE5`MYUhU+866A^z0L|RPTu<ezw^e6sqg;(?~YLsX@0HnQUM$`GT^WY4+{?J
zJO=7MGchpiP5?#uw&oj?op-C$yLB)yI5+=JDLuFA0t*8}mx~J1J5cyD@4Cps!0;{r
z#AXY~SPcrN+mk`zBmioyf=om)Z@U5iw%s@E`58KYcK$f{gSq)3J9JQnBZP&i^JnL+
z&JQncwlgsF26J?NcyYcRVr_ltNxb%+1=*W2nSr6x^hq^8sK^TLWMIf*%3{c1aA08A
z!EoT>Kf_Be=D!C`9-+(^H6H=_9o&3ud?UgFY6-J|#}Y(d1b2g~KEsncUZ>UbGrZ^r
zb)Q{ScntqH+vb3p&XpXk2l)FU85tN14}h9$E-D<&r~e;!QDM2^2<qP608PqmKj6`M
z>%~=2z#nV<#^1rg$iT1z6vZz(K-I<3)&r%IyCgu>i3$S)L*o&U6F`yia{k-@|G{bD
z#hEUKdQh_t)Q<uUuDtkq<Nts6ZkIVCtp`e#EMrtSN|^t%s94H^Tvfvf8Vrt6;dsr{
z2^M($o_|{aQyOSy$d#ufl!<@)u}&8i7Q;&~cC;}tbh--c0*&E-8X+q{{6hy{38Zy~
zinKjQ>vR>{#Rp0R+mF@1NW1y}e}}6?^MiU18^&^dXjyaYg&$ZPRGeGhsN-&~X%S&4
zW$Dam5wT_kIj4?wF^B?3>!q8Z88J}L6XbxGAO8LSzYrwZ_#0F>mxzK!2EpT<hyVTm
zZ+U~ie>bT8U<y(a6Q1!O6veF*L1Co8!oUCuqr;F%-d?Bw%|F=7_=7UE)A<=*Bu)gC
zcCTf3fO={#Tt9+31f{~eLO@NYa!{4+@#g=3!vn8vz`5f^VdrG^eJXAXI{6to1DLue
zF99>ype-EGR9WZQ&J!>0eSlZ~UqCHmS&&KhU;qFAS}Y(eJi{Jj^N9(QC+-uezu*KK
z?TG<*8XGO*gMH&my?23HnlFxbFfg<nD7Eda7TC!O>P$wa^D}h*c%g9}>_}DqZN;p;
zVIMkwyqF77Dct$7^VW`dkm2#5x*B9OC|`loYx5hP&f}myLyn3<cZrHhcLS)UZ(Yw=
zD%W}X#k=?5fpwPF1EpfSwt$@ckCB1lh1_e9=U={OWMJs-2dM|8sLmh%r-NEe{M*|>
zLZGn@!;_tdK%)aMp4<Ytt%SG1f}zB>6Ep(K@%q`0)gUJ&UISITI}&R68D4~5`~RQu
z_>Rr#{ALU<Jg<QkO|Z-GZ@<uOz4QNn1_sTamKTeKg90<sKpH23T7O4)48OgWVEol7
z-1?Tk)o1d}{R;I7pw_MfXfTrXg$u|7pq_y&#Q7?qUWDr_aH+`hqTuEK|KO2R(B!Cu
z;ib+1mbBJy{4HleEl6jHP8OBp%nT9?3=o&jz54%uuLooEPsTd2eIU1Y+o*hA(rKfz
zfe}=>GrVRoJYe{?qu!ZiAILX`|69M6NOgXAk%rL64b$S<`M&c<hcj#1ac4G$7a$)q
zys(3)GduvYL15qJbbbbe@)sS>9LJnF8G4<$z<CXv@s2rjaU6FR0!<pE9d{P{|G%3>
z<ya7S?uE7Uu=8s!5Z{53p*Mo5^FC<k7&HR(c?md5%3l2czk`thv@9{r(v^X~dDXxF
z|I<2M8D1^~m*zas%n{Ztn=;wspq%IPbbbcQ52b#N%|BU6UuV1l#lf9k28QFTDRumy
z4i&>r&{_v@N!;tA!t$b^hk+sb8;c54iD<@ukm_|{)d`c=9~1)(`MsFh3L3_IlET03
z!nZ?=C3a5|z8z91Rc-xN$_na<MB4l+39$KBDiV}Ymch^PBCZ#dCwKe<x!E=d+$QJ;
ziM#cJstTUY8!y6Jp<SE_pnSRwl)H9<Bv1T*&GX`X7X!oVNjrXldpGrm!vaA=g~wj3
z>;>s5RqFikETLOO1so(VV!%E43SL`~YW}GQ__rPSej^GxJr5fA;NPZO`kjxV^F@b?
z3RClgKg}l$I$TtkdqY&1cO(cfFuYjv9+cwwTi1dd5!wZ=?U)yV^fW(s-{De^thN!B
zNHaS>@NYZN`SIVuQqf(YPScBUQ0Hd>KiG+$udQ~S02${5c3r7u=ZAwocsxq^`M0q{
zBs4+u<w_`>T(MnWz;(-uE^ybsf~AA~HB;x|`py?%$MlA%FhLyr7d-l0$^;(ljgLJX
z798**4eALCkP(-5fc<h6td74`1tPW_<e-C4F#%BFU<lR344TUW8NUi7IuEMkEvPQo
z=2EZ1WD{D#5s<MxgP-BGD%csTLF&q(>W)FwsW7!1C=m+CcnFH<#BNZL{c<&E?foUg
zlRNk``59hZ1$U@k_%?$&i(qs9gUks9d$&ZR^TP|*W>D~zh_&7>Dc+R>N*SLR>%k)*
zFBfz(Fud5^!NBnP7^v~VWU~t7CiP5yhS!q}FYWjW@*EG?q*BXcE-Fk+U<*EgBKYfH
zPz0AM9b*MWYNFw#9bZ7I??HsQGeSU)+t9_p5ET&}2VPKeqne-L#o>N%lfsZ8gMooT
zU<U&O!v@1kFP=U7{~yOX66ZO53~AlGZzl5`m8w7C$j{Izdd88T0a|!-bRGjG<MZ91
zNqrv`1<>r%4iS(;gkOQ&2U=HADz?i4<m+Y3pnL*u!M@}M4eA{37G2=P&(Q0{xEMrt
z1aowWsB{FgcmC=KW@|nLD!-Wdw~KWK^K=#qq;+bi)pvR`r5$%>VPFUf&teD+4ak@Z
z^5ynU28PaCJCvC~1K!|)(U+%R{QnQ?eu0L@K&zl^Ku&sn;s5{6qu-B%N}Up2aBbFk
z<He=Np!U=U(4G;{T<&2o_dx4`l8Vlk{M$~pek&Dxox2m%hS(ALg_(h2-v>qphJY}`
zOPx1f{QUR-e`H+qbCwcaaA&CV#)}rP{tvrkKrP@KFG|5&ka1eA-%8XvU-54{^_qVt
zXbsPf5|C*HVACeo9+UL4_z&u91&F=W{||9}^P7|m;VgcJ7l%3+7+~{0PA@(;K<0<y
zm>FK|fAs%<2B^5tFa;?T>SJK&Ha#=>!7(XGP(5q-w)KArJOB24vF>^a!;_t_I)A)~
zpDcV_kI$I{Ja*X|qN4ZW?77MQ#~T?hOul$rj`70e564T{y+Nim_Ds$>p)KVwosXe2
zMumm(R%eI`N3V~H0(gY_!3+Dz8&9Z-&&%Rx$N-Jj^~R_O1izR88hX9);_l>kCrssz
zcV6y1+j;EZKepy)%*_w%J6Tk^S-v(n@iTObd~KO*cT%?g1$fqtzZJB2qMI4is%rjU
zU&?NH;N@io28QsA4RGUKR3rjkd<54H0*3!Pe}PAs>du4e@74n)rQO2a9iW=OyG3OQ
zXj=M$<%wd!T_-@(IPsw9-~8bJ|JVK?FTk1#-R&))!2xFGPUd3_4BgDV9*mvbpb>Ze
zZC;Gl;Fd)Z8)%v2f9C(L4BgC{7rJ{?Knp-D8H*b`8DCcYhg9U2%=|6B|NsB*;sMQ+
zU;1`Xfq%*Y{;7v9Ke+se6XIP?k*_UI{0!jYz3~WW91~o>g@#X#J!MpH4bI~wqG1^a
zviKQxfhttZLqWYRtp5XE^Mqv_0R;g_F!aSS@aVrl=ZhEar@_qu&`OnepO<vLcwu(>
z|Nm|qmEIh7#$(PbjJ@8hyFl%;9iUqA1*p&4dZ3i$m@_MLuQwZbeI`U^|KI<U`A&;5
zE}N`++FmIQQhw<4x~K>QKnT!MfDjcPu+v|BshHe$T0TPcFK8a1`3GYeE924LFvgBx
zfnIOHU4je@3=mUU{(`bU$UZ@aUT>jYLU5T^;1!FdY-ymD14FO32sr0Kbe)_0|FksY
zrpeN0q@|}p)Uh0MmT>I#mIOD}A*yO72cAimm4L{D%;9ig==J6Tk8A7zIpM{h$rsPa
zGv1l}@r*+K?%yDnfWr1Pwy-^i2wS(`pgu4tY>%Hn3)^ickiu4gvGXOwt6<Bbe#63o
zh4JVnrjB4ixQ7K97-Sh<Sb<#t3JW3jUT@)D!l1AKYgL%M{;XR4_0F^1o;<B5OZawO
z17*9Xpd57gwN1uDklWsX2vGYb;6>}N|Nnbs*!Z`FGBqC&Xt`7(8I<uJ>?uYD2F*i3
z!7q}3{r}H+xcP`cw<|-(!RCkToo5@5fiy$bI|hVje9i)OEj4ch1ivtYD6T&u()pt0
zK#4fGNdq!Z^Ill+3rUFV5drXUGk7k&@eRnR&eM&r7#MgM4!+{<Ho4GUbAhGxe<^$O
z2~c^R*ZHyeIaBAe60Kdoz!tp#EevSAUE&v<@h6L)p?8W3sPm|KC@A2?4$z?gm)9m1
z%?DWmGnlja88Se|hrL+v6C4k%w@V};x^{uYH4g<beh7Hc43X^o@M6_uuJcm$mpjjO
z9)wu-;Khu8pru0@+}U88cp#w?@WSdRs41@^@*?ROXeE*eBd8t+tpz?D-28^88#Ebn
z_ddL9bOBUZtp`=&|8D*N|Jv+0iwd{|1g$=GQ4wLh0qR=x`l!fshp0%@cRqOGTg3pH
zgJtOsQQ@$>P{iEp^#2%W`A_o^o@mgZBsAC#ztDv=E?Qbab;Ge<XUBjH*=&A>tbiA#
zpeR4S5Y*@H_4w0#gs1uEpAz4+#!3-Jwi1qRPnPDFEU#a;o-DE4rJv2u(D~rSy1)Pb
z2WNb+VrF2-Fh=vQ&kv}7OF-4^q2?nZtp_UEx<w6~_!+`GKSFZy<;k%Zq^#JQK#ddr
zmR@js$B*gYL(a|<ojfWp*iJwKq?<>jlxJ50sB_-}YWccb9xGw*{Pd!2^2Q7DcDq|Z
z18&hw2OonbLU$YoWwla~U1vbbC%~t7I&c2}zYx3<x`i3E5?Ynv2WZUJX)@nMNuHm_
zAr_Try{MaPe9^dG2fS921++%YK?pSVEfA2A0SYF;-Vzn<uor*7{r}(j;e`{Z<L06w
z0`^@A`wQWl|Np;MY_@&k#LvK3FUa3|i2=N3f`yU4<v1w7Z@k#{2;@Hg7ErUNn>Pg{
z=%d23_tP_ehP2Kc6)yhmR~t{&GcYiG=nPR2;NM;##dxgIP9-2OpoGcrTkHQ4k=_Xm
z3}5~qe8t@<bN#r>brvR2ux%FxHFG*a$;j;=s4)?u!qs>RWQ?^a$P)gkhd}EOEo)SG
z_@^9HJk`yj!tJ8M!awC;%c&BB)^DH$SfUZ!{NMxs_Ar5Z#tQ)%mD&6ZFStN^DmryR
zMx-5QO#?0a{QycDpefM!*u&wyH7Xp<Pk#I_{}bBzG(0T0@r?*5HJk?NJy!!71!87k
z=xzP*=l}l~e@j3O15g}55?REb$mZXFN;JBiMO5n3Y#EqKM4PK+7)tqj>w7^Oz|EWd
zfB*k?N3%4)W_f+N7b?8tA;@^{f1n=ti;koJ|67}aOyzIRX9N$k$JB!oR4GT}F$N9>
zhSv|f+?YCApZ@^`OPmzr=g#j3-?Mc7XtV}}YN_<`);E9tgBr{X2OkJ@w!ZlD|9^e!
zZT{9}pf>i&&QDO+GyeYnzw^++=K`HSn@=(?)Br7lzf{T8c_?FNHb27-&?NqgX?Onr
zk9v6?6sa(6r$7^)hxoTw3-E9EmfEo~o1Y=A^?wOx=Lgjf|M?jhe{}B!*~s~`+g1f;
z<gfaG9iYa{3->#qHZe$?U!8#=f`5B7TUzVwk|M^>|G|!idLgMB%<J{|pVnM0#ZcOu
z)?6*dP~r`DyBo42#CCujjLQ*Vf7OFL_A3D5sl&Jb|9{=WzYQFM2On^<!m|(Kv6rp?
z{{Qby{Q_!8^rrua2RF&XI*;uL%;9Hvp?MjUtqei^lq3+}3&cO(dA0R+Nfl&eQtPFX
z0`R=~4)BOYJ7{E!MWvPPKq=2I4x7o(uBg{9zXFOkwr(DkU4KALsOUTfhOln%Ql^71
zxB@_9#~CFc)19h7ZF_;%x1}tt|4Y)-n(YKi6L&H&2rzX1g3QRXgNz4_goy0o01f1T
z7C%EKfBCM0>d!2u(C`;JH^BCF-rN-fvabG3E(1eY=a0@;{A(_V9DF4b6cC)T4rJfu
zN|1dD5g@;V{oVM6g^___SNluQTB=Ks+y^P=YR~-tziZZYWN{vl;i+dp*6uiPgpc9H
z>Kp(6@A%Wn&#?dadwvGU(uQN7mrVBhBNpnS!feA|#@})1z$+I1ZI=uWyy*M+|9@AA
z3Uk9F{t{mPZI>YSRQ&w^e^>Z>WP3oHU|zgA{r~?C(3aR2qJ<0$i$Qat3vWzb|3`*t
z;k(Ia|47!iy#rTwuO&elQl#_N4hBb1lONQYgXF#E$5_i)7#I%h@<TBl)FpY5d>ZVF
zXP`jQJ_L&L)&nJR-8(>K^)AqOAb4nqf4dV8|8_4f{`Cj>w|nvNuRnP30jK5h5^mS#
zLsnePe>qF<z19M!1z2>+T?dVGwjSVb1&1pGs7}-Z1)JLC|Nmc{y7&M8i=+1@&;RS9
zbK7QBsU-jQgK5WG7&urM7%G^KHB_)LFo^61^|KgH^KU;KkRg-H&+uYN`DB5Aa`vL9
zK+fdfc45a4&}bOjDNvJzf7|69;1P%KC*fR>><b7NWQGCA4EOTMx&OrLAys&M?BOgX
z!%IQoogWM@z3{&J|9|Jt&QF~;{!a!C1cIj04)Aw81+5x=)%oE?1E?}Q-g<z)<q|04
zWV0M&FbE6H_y`KRdu0p^&4>AdGx&4C_3<`P9dkGo(JJXJQPBu{ariwbsx&(5KfHK#
z2UH|21XZb^b+(;{f;)dg5`y>j|NkRig33-%548D6gW;u)3(t6;-P&;A*|m-f&#t^+
z%wu3U#_Cwl&%g-Ll2^>Y03Nt9Jh{Ui<jouB{{LU(P|weh*32uw!oa|^%i;%8%BtVN
z3yO>XC;tEc#+p#i&%gp1G+emFiJ!rtH$){Ns5e9<BB<9#C89S(CFBKbHn@or5*fXM
zqm*wSs5QQVv6SoO3<d^<eT=?g-aA3V`QV}Y9Vwvk%WYRck+gV&6F&o3^u=FLRt(4p
z2DxrieJQwobAr+E5_s7hFGyYU5uR_3vWz7j{M#d?b}%r!U^cw;{WJf*K$*^qorf>K
zZn;#+_WkDN2c3t5GYUb*<dlL2)Y6)5K{NIar2?6UK`CHYKS=J)&Hw+qcy~JSGqjv6
zi8nl8h|;SHf3$c7Xr5VgjT1jZ!%w|35yQ8gx*(zBtRNxKe93FphM&r1stvX~KttIj
zGR?L}K#Wq(X4?ZGMhVw()+L~}0s{j>#te|1cS|N0UKg+5p3BehGJzXDZ^F;;!s;w2
zG>*BbBrt#i*YLoLAGiPiZ@FEnlW_s0b7Bbt!;6H6|Nk!p?bTTf+PPwQvXd9I8wXb1
z#=VyAa#2aJ`CoFzp~FQb0W|p-qLT1pJ*b3#3d{Nr?D*>$UIZM6*SpU%-heDHEMZ^(
z&oek=AJBO56;zhHsIY)mXNm0c02QYPSQr>y2%rD||K%4hsM220f>{mFG_X+)14D*D
z9zVm2m&FVWFc(EM|Ng_@!p+3Mkk(i&!opU{$G^>4GJA5{4M}dD<_Z<i97v6d&g4}$
zl<GyhoI%qjpr!Vp!N^{dqoBD#{_WuYdgrGXkJ1?!I*&L1Wh>R&32NMRegY5jdZsfl
z9CuMs0SOr%=yXxhIPRhX%DbT1CKnZ+*U>8&OO2Z!a5Vp5lmy9(G`pyXFm?WDe!$lJ
zgN1(z$g)lsm3khKDIfm-{|{c8uJKw7#Qy{0Ujpx|2~iONEo^K)`5$WYg*4E-DcBM2
zAh)@wn1CH%0V*ND!t2r)7@BKTco<4Ddfiw$T~uVClLg`+^~ak}{s)b6fR#4Kr-3(s
z$bfl2Kt><y{0Wy%O=Dm%{NMTA5Y&=0=?+n`;QYY(3pAV2eEz@U2gP5|%}uXCT@4du
z7ZsK7Hw-VeUMgj2Jy7D+T%#f~S?ZQ-J<tCV6^WpLpn%SoowvGOR9s#hybLOCBtS*h
zbq<JY8Jq9^cWwU5#@}ZQZ=Ah+^A|b`)#;+5lYKy=+eW2VhrPK*MTddE?-(-!L$|9+
z>w!|v|2`@@&2KecKkXLa-*yb55WLvkq`5++9unUs{M!$KnzDu`!2@J3ICuX4-{GR-
z1Zt$d(7OTVI5*U&I5Cu1fu_Knnh!B`yQ=VSXL#`^m4Tu25dZcA2Y;}DI-mRvKiNw}
zn;-BRp0r^pW#iv=uK6Kjr;m!tYXyi7!;`zfRq@gt|NpntAAk&WGlJ5A3OKSru`UBz
zz6a*nbjPYdB8+<zn88%S@>*?^4F9%I{M(tq3jsPmy<kiQEv8}a{PaQuWa<I_mZeM#
z3=K6Z&J6r5;FUJpVpN<#<}jA1f+(gE<KAG7ZkKu$kr$w|H#(2?27@9><i)QPP@;Yv
z(i<!Q_Wdgm|5)>n|D{o{!+L{7z=Bsnf-Wj7y}=S-{!tMBSZ^>Wt%$tX4&ogLbq|_<
z{x9KjFBNv{JXgy1TC(~7|5CB$fB#DbUvp=ufU;&iR{;Y<gyA>C|Jgn&JUomqJ5RiD
z*#nvX0u5SqyQs)mLi(T_(k?1C#e5(U(0Ca*bT~RsywHXym+1^qQGf;(QweDAZ4Uo-
z=3St<*%#^{2f3)&v>qrm0)^U#{~!KCWa_(<!666XF+kPvZ)Y|<2@%RpW?<-!QL$-$
z%<o;gy4zKu`GrFBj|U~(%@q<1C9}F66kfjt*ZIvgDk_YnVxYif;Gc59@FY07@J~Ic
zc<?o+;YpA*Ly1YVEvWQm;GcR3q>zcfe#(KCLnU&pw@aiJf=cpkaN*9s<^ngUyXB(7
z0u2NfOBWST;3`PFsBrL4I?())vE@XGIK)&?M1lL^;QSn-qF`A9Q7rkR*tFY4h3CIX
zD`a6rMieN}XXJs}kpdtW)H9S=b$;ml)qLQ8^QHgHE-Ea-Au1fN#Xxx;)U$_+%Ls#l
zw?u`-@c;LF(lsg^piPV2p(??kbrvuj9tJ8vTvU8sFkgUYVo6p8hVB5F|0Yu*Zs=y<
z-{v40kkJoviWMK&Eh7J2R3Pb|K><=q+JIcg%-_oV_y7Nwj(`6D&)5Z0e?J#orL(-S
z+%<W_JyCYh*nGF_naOAFNij~G{QRD3{XLMf;#>v>&<X;E1ONV;f-0o{;Ek0T-$0UK
zxghUrK%=6>#qfV;jY>>sjY>v0i%RnW9&p=X&ra~fUh@G7P~G=pErk2x<xbFOdh3A_
zl?=mteumc)8A2dR5LDru-TD82YyE-J4KE9s7#Lo>$ONxO2zlWJ(gP}KLsS%cT~rcY
zSV9CqE6z1~T~tC|2tfpNIzv<pz$zFa0w$dypdCeqCwBzp^E13qKMLC4-FbN-s4DLk
z1=Z|Moh~XomM1zdNZu%B1MPvV2bZFtmD?emAu18wrr=a%3u+&LS4h{WNHo`|NHCOg
zH`l0$Fz~l9f##Dz>7_<Rq4C)N|NrfquQN10V_;x7(Cwq5(jB9s(RdInd>OQvn}Oi~
z<2k|mpq)pcW&W^0H0cJde~(d-sOMjEllkCl=FW4S_nVLXZ@&JYxkQCUxJHHJ`_1Od
z4Bu}nepLJonlJ%v^#iTn2JL&)E>U3tr72KawLI4OL-Il~8)!{I=k?AKm5|OFl?d3v
ze36~tMeCpv0kpC4gCJ<pJP&B#qT5A9#PVpZpLsW9cOVOB)1Kvx&dbs<DgwoPkk#y#
z$2xyYUM^yDZ9XXS`XbCum<`=7DmtLuK+G;GA;KXl5s;KW+47+ZFC-*E88AdeVRF_(
zqxyu-5S0{+;9)!{c)9T*DCB|z!^1MNKykJ(iviSn$^bd<MbMT1|9eAJO28b~E1)bQ
z(k-K6_{|!;R-#_5^A;!}X@isngZ5&*PyjPQI}KlmUitsut@*IV>q`q6Z%pQSBwgPI
zvOqfvRDc=p0&R>2Eg;$mnohaUd<1m*f_UeR|DvFM(fr#^>;laOb$)nZ6$hR-Qn2S|
zc=2b?|NlEdQ-<K(C!HT&c<=fD|C_S}V~OBS&>#<Z!#rpq;2v1h>}4@%^q)oL#fQWH
zjsC+LRiK8PQs<2q^_xLMO(p!n8OuOUo0th2a(rD49Zk8p@W$jDj}+>Uf#jkx85km8
zy9Q@G1o3<_L7rgV2|70o?3NeHcmMw%5!DUaqhBH)oWWAS&+tMGstUC11?;pJjl2K<
ze|-#;hd{&j0Rg=}DgnJADn2_vy|5R*V;LCYW4m2cLcU*EsUX0>z~6e7k)fVpCulaC
z--v(P5B^;bIQW}E8*p0x^S5jS&#oGt-0>fje~pj){}0{(n9y0GlF}^-YUCOoaOgaE
z@S%X^sUp^6E-dkEppEu#x<gbFx_wkqb_9U*{XPs{v>&6A&>5qW(#;Ff2P#8$FgS29
zSRO2z{Oz$wJw$y3Nc|p=deDePB#5^T#Jde{@FjHm!1Q<CI{1j+@PI?_CI$f>2Fs5S
z+gTeAf!YZmH$3fa1|3ERbIFVJ!~g#~H~;1+-P)U@5)j&3q7o1W4;%)DdWMD<7h*si
zk=>vQvav?Rg`I(+p-egyp^Afnq2a~q7zPIZZ80i7aj}NqdUectTR|(QK?5u=SP%dI
z-`mOv+O2)b@Z^hchyMR}v;1Cvt6LP*6X*u_19pH^zqozq|Nm}q0o-j1DvbR*CbK`)
zP+WNE|NmWVJfKB)kPx462-K}NJh?*~6x$Q`PY!r0QlA48bOs6L?g#Zr79RmET-gt9
z^c=7}T+9j)xRk}f&}a*i11(G9Z%<+YEtGI@<Y!O`@C@1o8sORi;=MQ<$H1V$8t=%@
z&}^FlS`b!h%)edM%@Ne|{4HOm)_Dt}ZfP8YJ80RDSm(`MAdNc$KyFC6`v3o8khUG5
z!wz1k9D`H|r6RlDfTrC*eaaWE2mk+n`Iwmjvg_nUZro&@XHxaO4g&i^3iuho>Ads!
z=cUJ8RTvl^{DURn5KsaR=?zf{fF$7OQJ@*~<{A|bhEk#9E-D@jY~Zd%2q@HFvww3@
z2^T13-v>(UuLVI%DE&P7_nveF3tWEIZEL{r;9uvD4i=T(TAj|{hCU~)c|oC5><gZK
z>b&vdU@QZ}F=mDiZ^kYbl@4d7juQu7fR=%Dv$QU#;b*w~qWJ-1>q-78hb}(iywKsy
z-0h;`(do<r%2Jbgo=b~>hVB_klzNLf!0Tf=Z@h?%ooxMFR>BHoFdL)hje|cxy(N(@
z7Zs5X7ZsJsInO2QIb#_Zj=OO%F$gjqcjEyaoY3pY1Zu_i#tDFnl;#&Koh&M#<%cp1
z49zG1H`}QE;co#AZFl;p*nk#ZGNggpfN2L`aPYV80uM*msIWlFz#lJ;tp+#Pc|glL
zTvSXTCEt%1>mkBUpw5R0XqBZ+NfGE!fyU=Q{xdLGo-Y;P-|hmQ;Nan3e4!}pH9OP=
z;K%@PUwx3q>7pV7^Q%+LWWN_uF+9D2|3RU{dd!&(w7$}*!<oJLFh}Q4kV73<Af9=t
z0`9jNp4^cLN<%iFM(c6IlQ5$mMS~U>@-Z;*FFsLZaGV)b5O#sW>%a?BMv=+iUTD{Y
zDk#RoX`Qi3X`P{<6D2&N85lHN*?UV=62QF{(5j1QaQaAy_YH{e%uz`Jc_4$41uXqS
z0;JwWB@4{!{P2P!8oZ{hl7G7^D7c#s2-t!Oq%!`1jAD=*cP4=fh}V%X7J-J?>OsSp
zg1er8`rTfjahSz>|Nnn&3mOj12+LRw($Ja209lUIdH?g$UT1;M<DJeByE|{Zm>tEy
zpyABbU7}I~+Pd|5N%IlVq~pXr|Nrke3DUiI7bt7*cm!fk2eFT}-sW!s?P~^g1^Ymo
zxVyVSBYe$2<@wt|Tu`YB8~1{Y&o=*%=WpErT8>$xk`N#48_(bB4Qk)Gs8n>isDv2a
z?u=210L5}yr;7@x%BTSmIiPF@8ZwIM{P3dq;{X3~@gOTf+c3LBR6?3-R3aEk>$$sK
zR03>4OXA8zcAWqPgCnTGUYW?i@bVLA06s*e0+cGtz~KvS#;uHGV9;<;Nda{kQ=4B2
z^tz}NyqE$JECs7raN+;|mo3~349!0z_*+4<>^niz*Smff@H2oF++Pl=Qu$k3K{GU2
z3|S1lJ}M=>Au1J}A6}fg@c(~QWb1*F@?8?3#dDyxr8&g()Mnc=pz$95Rt;_j1~fB!
zpl0%NLkjn_&Rbx+en)^31b^#SE(V6qo1oC$!C1)8@M8P<|Nj@)gUow*n~Q-Vg9jwI
zAc27)0#X8o9RPROcv=sXitM@pDg!|Wq`qj|{r~^VRa~GcnFesHo#(}>2nGglo$AwB
zq7ndV?t!9(^$%#X0t+}oLO^i=Dgt8+54^Ys8a{VX;farJJy6dN-mTvqqY~1aEdf~~
z*!dFDSjf2vsyLc|FqSBku`nKeEpXgf!YMyFBki~=OEE)lw%jI0(BfWDIoT1+()kj+
zM8NRC3lq3L#s4lUEL|ZgETGwah!L&~2qT)0vekD4Ll+Kqz69r5!vo;uyoQ%R_G0Sa
z=TrzARDb_@N$1~=V8~L!Vy@1Q;7NPK124AT07Y&oWFc?ohZnu!3=E*<g|Mk~!vilS
zL6oqi)q_?Ju)tOh7#?_036Wtr<}AY4>n*xVlmWDy`9%_3Sd^jHTWpsYMA#cHEcU<G
zTYQ%|MA!r_EdKwPD|obpg`tGm^)>r3S4M{BqfGx@RD3#LXx^}_cTou_28|d6bmpjp
z{5Mg7R9ZeN;K%|OkuQvHfX2@wqd_C+37~veqY}~^FMXVyQJR6V^Cmd5AS(A>hsBs|
z84Kg#*8<1gr6IxX42rRM#Z8RhTC5|SrSm2@x;P*jTdz+xeP>ed57S@9%6QnV^HWDS
zTj$MP?4UIUpjdvPk0H<Ao6iA_IfzL-kfpmk;OyG@;>D9t28LdL32;_|sCab^96c<@
z+$BJ!gZ7|6BrY0WgE}8>y=3Q2@b(3Wf{hsRlNH~K*86nc(EMSE2*?;L0SPMkU#tO5
z^B#|gYW>gOx*Zgdpj2Nha-5l2gn_y9BP1ZfD$QXwm4E{B7%1tBKmyVY6p+PIn;7?l
zLZl;@rMDioI0mfq-&LsZoLLz=KSI{VfF+)Sr=~y|ftB%?J9u4M=SN7`g5{55$g_8T
z1ZRmIVELsO@*KV1oVz#~R2Uc_Dq7%Hb27u%uz>YuU7eipLBcEmu7I1l*P91CU<T1@
z2AAPs>h<Q`1)36o$jDrsyzYaf86#W)(i$AF+0U=QJS@b}3tN!_mN|Q6^4||~^*)^+
zG;bh9Pl-whcxcB`7Sw7ga>GdU;6+A<u0Se`Qsr(?XBD&!;^Wo-|G^pOkme`L5OBT;
zQ3(JQb<VFhb(?~_@8E%XW>Zk_p!qrj|C)ay^#|XJfcw=SSpVCDjz8h+Jc?l@cr|*!
zmH+=CxokS<FrFBdkmJk({0suU-Yk%$0akVYGR(h7>!QFiN8vI^>!JieHO!0Ea49x6
z(29YE#()3+%QKX-c78bcfUDD)J?*$N_rL#Xo!Pu;$DR2>6G(y}uQu1H1PGLK9CuL(
z04?(Aj8O?O{AT&J*F`0uF0ME9|8CIigypAFK2VFRH~xR)V~`)6|C^}53;aaLGN#hY
z|NqB>2KiOHYg9r&%ji3Qyf|<T9-_ZcL)7i{EM!A=fYuqkFuV-f{oQ(?)CJOSJNODT
zZW%K9&nM-2A9Sa>sDxlllN4hFJlNdbm!NJ7MjC^GPSb*#3dfm*`5A?eJF$Q^LLPj;
z#rprhJwvAx$8jef1_4HfV@?7L?#+j=23QD|vH-lM)Z-G=FW#trdHPw)4(t~ZNU(#-
ze^3&G`Nar2<x{E&@=J+I2&iiZDXhU=l+za{`+l+31tq|PFGMsCgH*YwAnISpiq`y#
zkTynX47kz1^@|H60MRUEyzllh05miJPKyfM3<|x@EZ{QbMYlf#Vxbz?=7|?z36qNf
zl$=0`h!>WKcp$z3<!f*vy8Yio1@7|B8!zV9U-<vuIX0s4H)wrS>7!=b9#BK4!Vu)X
z?hqB9ZXcC^;|%pI4E1Tp9atC`nh&r!b%v<;H2-9U7!8`B1_e}ij!Foq38Hxv)UpFD
z(gf9YpfxJnkAfxx(i;CpFqN~vsN44c|7)S0pq#_M{pt?LR)_elpw=q5#j^&~;!y-O
ziL*EU|NpWL)D}Dr8ouJ+e)jW{UGlJ|S&JXEaUSd&4{DgF%7aciNoVP1Q316ZGmg8c
z6vVsudLDC8DTz<(%uy-pj8Ulojl_baYmT|7)T!(e0Il5wx7O7BAdSmipk=k-mZb<p
z1k$opI0{~-$@7AH19;FWWQQ-P*(SUV+*V@&HE>N>z|FD{&=_L#gL=^Daf!&TDIo9M
z0(oaeC<DVwHi#mggD=>7S&p)R#tvTigFMdynq7e^e*{vVzv2J?mp4EYFDxpC|2r)}
zF7M4?*#Vld0_A#5&<R62;BL$dOBWR${=OL?#jbyve=zg6G%_+UlnaB}QZmgynD|?6
zGB7Z_%m=NW{=vfEasqTPOCm@)OT9|BM0c%4ulxVjAN;MLMXz11Ha3hUeEVXY_!(@N
zO1NHv_B`$bt?y{4HD};&1$F#8U%XIQ`~QD8k4mr1%}!^q|Aj#2O#pQ%S}*apfRDBM
z+5BIim=zq?ogZG*ZU(hyS`U=+@2UZXN;t?(jK!0gekj$?TKE6|Yu?Ucj&2r}{|qlz
zF)=Ve6s3R^O=DtU=&mgQw{;=oM<ObnFJ7!&2r{tO)uLNO<;8-9|NpmsE3s%jP-4>U
z$I^PTM7KKvbe4r0|2Ef>PVj^j<BuYVZZpd^kRyxudY%5;u$Qy<I{k00zfi)zD*@yv
z&^n-(>P!p_y)2fXHhbsw&SRj_*w0HCV^k8FLsU{2KzpGeLNA#?4vV$uF16`)bpWMu
z(5AB&FGN9ZIZ&e39l+9hsYJe;0kS2@@^G;*=yWH;lZ@Z_Cmpo>Q3P@(|1KBndVU7b
z_FsmV>p<uEUG8Nu0-gEsqSBjzL4*0_JW!j(wE%3sYe^^QFfCBm3p^s$`Qk;*YEb5Z
z2E*(Hpfv@cz8+{p9w=P~f^<88qsWaB)I}++===zB2IF`BCKE;m2Fu+opvsEBNdu%(
z2z2g@^)65l@i&WsHb8{^Z}`Q|-_8YLw|?Sp1q}#whp4D9UNF4W>7oK2zis%*QKH(*
z1KMxEz`ypw<yYShDwMEvUI5Kf^0%IauFyUTI^NDUp$>H722Ues+X4gV0EYS!kzEa-
zPT(`pn#qhH28Ng5dA9A7LCc)Ox_wk6dR<gfUc?1~JP=wDX?du$4xFyQO>fBRBi4<e
z<j{JcRB)FHC@K$uvXS80|Nmbnb-Sp5PU1`HWa|uLL0DTNyek7_D|0=l@A)YZ)Z~B7
zp4QzAvNf&KjR!Qe-08;A<yz6<#@Fk{ziUDbKf?>X8UO#k=7(4U^4N<VfeZ}IZyR1l
z`~gpMytud;Tw1WaII;Tw|JQ<`tovf`>i?iUkusnIA@?yj^E2$^XW(aOe)ysDZ0Cpi
z<_8}@Lok*(DlA12ov%ATXubdyp{@+3LBTEx-JvXvp8`UH6gV%Gnl{_02$$(Y#++Wf
zi1GyWGE3zfYWW$<6uN6gENxVZ1Ur9qzIb5|kz#56U&-ElRN(a@!`q#*8Fl;&+%YOL
zrTn|5fV>VmNAkr_=>P@>*dmG&-wh_uoDB~=b9m;ksjK6{bS*wch5C*Q&kCLtwjAK^
zv;*zj1eKC6=6QfNKfP224fKM}c1wVCVq#Q6f_ou7nE=BBFG^iO<Hq1&w-PB(SsMVC
zg*5L&TtVY<-&|A@1o&G($0R*T>^utIki_^bal;0%Tk4%Qa6EJ3Hv}CN`Xq6MLdh?F
z!_H%!FP<fKegK^knt5vGJTr!UAmaNo##7)mZq1h%pi_Tc;A0#NZySE=tz_K$|Nnmm
z%cGrNC9f6>H6LJvC}X_%s`KY&#@F{+ZkMn@4ufFb4(jah0I%Y3`u-91YzV~B5TFGo
zkdq<eKvhDsKWLoi<pR)>p&KtIxPzB6^1qProxYKu(NN?<_5quYTaa~N*_XJQAM-Qb
zn*NQSF{ysW!vFtwO+;B_1{#`ge$xP2q4u(J;s5{tS#3Zi1?WVXmtP$i7(k1I8sBt)
z1{hpacy@sfMg~Q}i|uaUs)(nvMFmt^A9GP*W&p1&-~k;@0jiD#UM$@NYBun9#IS;=
zwwdc0C2u!B{?Pn7ptqK-<3{JNcQ2m1GBAKrWhN`=6b;Z?TvmH0eukY6PW<4rFhFzC
zj3-`%xq+q|j=l(in#j${zyLPjO$TUF+m~rWXy>VSy|v66R(1Y**Lmtq$HC5DZ){fa
zPd(7^Gn9YoA&v|Dt=H;V7#OT#R9N_1&p<X-Gj~7^4{ZI$-+CO>Fo$?1t=l54+kvV1
z08<*sZ5u#`&#}DQ0UGCd@z9llVFMRvC+E8zpc$7Jl^`D+?!57$*%cfQ>@WDe85mx_
z<KKS2^TvxtKagNWTJv$XhMIa6W`+`b$SON$khWtRHh`Ra<3$!knFGkt8%h*AKfEvl
zn^tmfmj`G~TM?+7nc>U8@LG1mg3e#>8fsKR6iNj_qudM(3_C!__r5sn%fPS!bix+P
zyPXR`O_(Vvp!H?o*lO4SDz}td50nV@hO)nDIl$inT5$359jL%XQs=&YIu9eGV*MVK
zPEaZOTz>DgBG4H7e^$^rJVl_jT~ky*W%vgE&Wi_M@|TM40Ilz9Jy62a>+zp|@u4D?
z&J(Xc@Nc`&>!YHb*4<LFkAZ;!w85FB(5?BONa>5t5EYhVE-JwcohM$fP5%Es6f|iK
zS^;Jp$iL0mAfVe>hkskW14lr{+#>KAw}+=eP7lb~U&PPw;*B?GCRin{`9CXv>mg9h
z2vY8Cz`rekz1u<HMJ7n`QOII5M*f!DppCzvHaYktqj$~>pbbJ2FFZm)k;31)hk=3N
zn2U-G({UFS1yCmlyhK4I?RdS5iX0<D?;e#7CI*Ji8Wj<+{tF=xZJ_pI14NFYv}V`c
zLVkwc7L`s=`L1gZQc{`@Hx<+dg_#OA6mD7**tAlc-WHV&ObiSG8E>-q8M5SFd^+|2
ze|_ii7jGtlW*d20|CdOGhh-dw1jaScqQqmJKVB#<1<495)B!CBep|`Zc{Hr^X6Gw#
z$NJ?`P$lc5A^<+t8Im~qy+ID+?*J8tJKvzC4)1lKAO?*A&4i?fdU(Q-Ukj@EL3KQ6
z{Pq}wLfUZ$DF&vr?iQ6U1_p+-PG>m~yAQ&a>26U0osN{&>8$XrMMa;Hfq|t&pu0sS
z0OX=6Dxjm;UUPQ0sDOF`hL<{>c{+nZgU(m^*SzOG_?8=VsBCAB3P=4;(5Nk_32OOs
zCul*rw2unMM&DvV{xugw555uw<x0>xi;eF5`(A>S@oy(KS@wYA6ido{3Qn1j$fyUU
z&b$er?QNiA*@Aj|RHiU7Fd(H+Py#&-i4)h8pwMeRq5w^!zMc#W;8cuAme)bM6b>x}
zEu4;whpfX4>%0jmKd!C(|33m0hE9y2MUJ2Yw7~^MsY04+;{7yRM~4zIQ0dC}vj5lr
z|KKsUh8j>o@~ZI&s8|M-+|aefpx`yU-7PW~RC;zZwH_#8?hIgYZvM?$`f8`bbUud0
zmlOK<7<Pe(9R=U{7+xfTnsNts2{7<6Ko(R^S@Hk>!jyW@sznzS8N&n3H7YU;C7?!%
zOt(d6jf%|cw~I~cL7Tsv`58bPZ1@>=Ffi~lyqMv@z_1h4=IA`M1Jta4;l1Mj{}=Nn
z{{R0%Z5OB-DCIFcuq*gKKf}v(7SQHS!;|0>4|a%^@H4!~Uitrj7Ng<GT}%xO3_B9*
zK~oA5ATcJxli=>s4)A26>&pNC!RKItN0EA4R6qkBFDAG_7eRv6L@oILzt`j_DAj}^
z)b7v(S;M;W|NmY;j_wu}P}V>AfH?qc&<-n*<ck&m|L+79>AM)}8yG-YdJCx31>HT;
zd_-g)NXGC#|MnIY(4fEN@!Eu4AfetC@HV~|&p>0b$C$!1JWF8v4A-cDHVcNn@Hqfl
zF5aR7GA^L=<1U5<@TCKlD<HyPKlp(wIEaTBkJY<39}#&y1>zb;h+{yuzF6+cz_1@=
zt>HJgOOEmPg7*6E0`-z%u8DMIU})H*vJ4ao{M%YoK>LqN4MDjCbj?ptKn7wr<QkPH
z3=9mRFP88B|G(Ft4P@*NP+PtE1>0-&uz-v(B>zBE)`3+rgH?iRi5JWPyFiZYeDPxW
za!|1(0g?js^O|3<y(n`9Ro#$KVm$8l()IuU|Bx;4py64VgU`D#FhF-izG$`u%`UWn
z!`1Mc^%gLr*alph^|q*70mVucL_L@tV#~nLJw@dPsHXYEzx`5x;mO_>aM-_)SpNUN
zTm0+YJ2F5qEHn?45cyj{onMF(m?2@i24tkK3;4Km5Id8h#0zXQh*O*ZZV1C{W^`d-
z_`d}lXsA>-#Ln(1V7V9di$SYDj_|zR0jZ8yN+ggEN%{TX@Y0L+h0_B#7&Yq;fbtu7
zc~BN(P=Mh9@FMFMQj7op|8ELfH1r=l0+~?=^2BA3Gml6>1_$Kkf_zjWm3AC_(h37x
z257=LV-iT=Di;QZ$hfrQkPw61cL%v>0p=A;XHb)Tk4il#7#a9m?En1#zhf0h@9{Yx
zbNO3!K_a_AB3q#%(jXD=Fskel$d=Ypo?Q!U`5AVA_GZ0SIL`2cnSo&k=<vH2zZZi_
zM(~hJ4@gBVD41pD|NsB;D(IpCuo@Q|28Kx3L3+Eumhb8M|Nl6+0}Zn0cpIoPs+h;e
z&<Q#WiUD$t9$TlWg%dx+%iiCh;}`_ejyo_hd}uzv0y!G`E%?}%T>)>VU*KevWZLm)
z`fE<c$Bf&ipXXvMwlB2;ZA@n618r8ApLU#87&J!0v`Z1x>0tQ7$?zh?3bgPY#AJj-
z84KuKn?IZkhL>JwEtuZO&8S%ap_-pz!(LE_g@4<H4Ld-LgAZ6#K?mn?UO3JQ+mLgd
z6;$Yhw&omX1=ZCM7HBy>h_x#fH1u?^`5}Mjv4byIntw8v=rlj$DHUq|$yg%Q{FA9v
zxl<Hmz-wvHaS~#kq9Ai$^L2{WgN%61)+q`y)T#MbM(NI739rB_GtPmc>)_1){}(IN
zgBsC09)biwZTrq+po)Ae=v+cp&;e+mX@<^&hL8g;x&&J;mGCwE;woix08c<TzJAmB
ztL0J&>tc}Fg&^YK1Ev@A7ySRf*aTEVv>qsx-xUCgSZ+|4`rPdQ|2sdt_&p1>=L)Rn
zwO__-klkw>7#Ly=|1UIg;%Dg9+0j|b(8bnrpoHIstJjT@zolOhbSS~=*M{G^T^U|v
zwEzF#>B`_95T5Y^q&eRK)a2u7{Z_jFIIBt*Kf{m5{0zHNK@F=N3SImRFX}8nYeTfU
z_!)MzUg2j*TU-v>kZ_!}60}a_19-A%M?pR4+!V0FGEn#CIar}BNY7(1)3J-6VHapf
zaEAfNOf9fdi|O^ejAr#O3{L+4|ANs7)PgEueev|@|Nj{brTh#pmf9osLr8)IWM};U
zzt{j&J%WPP@Z=6dkSIGyR0kvqF1b(c@BoQ^oc{m+V$d!?aAr3=xg#DVdK)CF0dlR4
z2?IkfXdhqw{~e%xtS`#VVT<Am{=_%``%|La`QZgqCn%$qa&(umG{0kc{lf4h*tpIQ
zFWw#a|NnJrMhVE&zjg?%ksz(UX^nLv4a}vsogZG@2j$Y^tp`dB!ZK!oRG+s4mDp_H
zH7~nZK*N_Wv?hY;DlyQyD~8S=FXrtBt@U~hvvnQR)*ahG+I0?q62Oa<?f?Hb+JZLS
zfm{#T#-IX<5C$Fw&|)M=G4p;JsDMZVrOI{SH6aHAGWLVa@C7?T6x6TjtiQ^?ofmW|
zN$2^_69*p%a2^7!2jBpWH-Bh8!eM!+M3aB}(SX2=TOgexcA!?NZb%nsv!rcU7eB)>
z)>+^A7#Kn4n5kt5l<_mX_+Sej*JVll06vwNC2cWS`Egc|a)uA_JA|%*(h<n^wBxMx
zAiEhpq;;Ck`Oe4C8^*kW`CV@q(+0+OFRpI+|Nq4seFlcs1EpLqE*$><|3%TX|Nmbs
zJn$cK0J`BxNc)Ck8Yr6hTW*Pi77j3#YAysHVtSxNq1l3=R64@~<g6%L28N7u5bLB9
zXdT|mHR22mh6n0joCWKy{Aze<M<z(RWiBY#z!7bDaz{N#XvNh3|2rX_*&XMK`59Wj
zl`wUFfOINeR6Bw9Jep7c|9{sJPH-VH5u~XYq6t(}_fAm(wG4JF0g0=C%y&`Yh>ASs
zq9Rfc@||Mu6mYv|$7YZM7LWqaa58@jXcil!iV-qY25Q*vhyZQPDFqb=E-DJ>;;|5M
z3DAu%%{3|t45fm*bU=kjC8%~tnEwC&>k{xzYS4MkFWOBQ>Os4f6^=86Ik_4^PM2s=
z0oBVda!f$wc#8_?v=;_{kn-jS{ArynDxmcwAnw5zEFdl@Y4t+&2uuSHn<+F}gt-Pg
zmdIrs0{Q2$H3LJ0;akuV*oJSxtBW~at``9hT8J=6^0$J<Uv_AOGcdfU2D$zycz{{Q
zc6z4>qbvs(c*^nR)ae^V7{%)!?gCx6(fQ)VoPJQ0mvHR{b&y}Cfv#Y9@#1Xj|Nq^s
zpwsz5H#$rOF&Zp5_*+dN((7755!>0S5Y7O)mTEqT+o}@Iz`%K|`58Zds{%6v1DbaJ
zZ5*AwE}&_>pDg_SpFyLH*(Z4n4_F>7N$&<*0J{EYF32YSZBm_cSR+998bvX6LWPPL
zJ3n`BVT}QaRxx+(g(wVS>YT!w05bKTJ%4+TGy_A!V;=t2W@*su3{Uef=DPX2K_f>m
z`$41Vpt*<67cW-#fqSl?ek3Poqxg##4_Yw1%fF4Gv(*D+@(<<`uHBrVv3GCKSa@#_
z$O)|vK=%r`sAyn#)1b3Ng`=~Or#FD96YMYkZ3T>-pE^G`Kj!ZM9V7ku;BS`B`WO{~
z=6~}1?VvNf8XocSw}ycxx#ogGs53@I#SnCNjf&-`TH)+lJfI6vthdO5LZpP#>Gf0o
zmUU7L4B3}>7+-bI0)<Ftq(Jv1P%v}`ihwSQ`F^YM5%^AuDWae|DLMtaLR5H~4>9p?
zyOeneEKv`Y31n$LC}ZiPqQT#40=m{LfEnWGE)S;O02U}afVnq<6%r9#9xVK=pn=kc
zU-ta1=8Oys&3k9?GcYjnx84FBC9-!5KLZ03f9qK==K?<i12cc?0WfC{KLdjjf9qy2
z$8ZNf1A`!c>oPF!3WPHgw2^SC0}m+iEZ}EgIQW3Aw}tfwKLf*ytmf(U;*65A{>}gY
z_fB=-11Y(Is>Gyu`c`p9TgJK5KZ`S3*MlNE`-F_)?an#89iY2BUccN8s@Gog><0Bf
zUbF579l0HxaS4>MUYdi(UBQzoJTI9*O-ImZ%!|p>!E;(X;HDus^DhNu{=<|0|9^Q4
zbgVU`lhypgw9d2JMkTG$-pRMr&C;Ez)MNTi2}S|Y0-?@w&^%7JgBa+jzRn+@o$J%@
zNib^F{{`9WYz`hFO#qp-6_kOxA$iJ0MF2b+!viWF__s$09DK~ezuke4@i6E_b8va#
zqQa5Z%?uj&b4zn5RR`^q2+L3}=Vy5F&WwQ}9CUblSVjbhf6olmGLd=t=hy%Lu!89d
zsO$8CMITZ!ePCc<VDwMxc2RKy6-1zM7mz*8kYWndVd(~0*V&>1x_1QDET1>w|Npe+
zJt`pG{v`q#eIUz<%orFVUd{pyQo5)}@NahzvOLD$3L1j}naIE0LB!HUMWD0>wCYfz
z%R#ckMa8xCf2nNq3jrH}^0ZxyjEoHYiw_lpW`!jhDim2uxnF~il618^Ug{1qquW8F
zvjse42wFev3KHVq?jQgPS^o9MJ6%*FUaSXI7%nOttp`eFAcZz))bz#u3IG4U`~f=g
z;xJR>%Y*;GMXUt>b`OCD@Ro(veY^||-BUrOnq`QJ0DtQ&5PvTyUM&Cdw@&6|VBlYW
z|KM-t&KMN|%hR<ipd;ZyH&^XZ0nL&e{Ke8aMP<VD+fs~5^#TVUuyjI3nLuIJ>7wEQ
zj?tLz7?l{yIVzw|1%Jy~P+E6U0nL~BfEEsdW{<&Z2@|?&R1z#9=JK~p;sNC|(2X|?
zrIx*|pyUji0qbq$02RP4Dk{4`-KowOFC=wA9uNp;5M=0{%L9^p2d*Y`UiMD!mu3_d
z+tS?&67HTV5Dq%b0Hps#UDNbk(u^96k<%YbGb%IsPiL25l$Yq-1MbgugUYy;9iUrA
zRy6Rpa5GL{D8ndX0IG`*{s0BK2s3*pdna4BJ4dIBib3-+7SJj5_MrauFV1@5&YRsX
zDk?9wPA`;Ul;!~G>UL2vm_9{@QL!Gx1DVkSwy5(s=Xw6t>yU(_(QDEM9uVxVQPI!@
z<r<yNmOY^EA9!>dEFxm*&Qr<?+Tkek-$g|Sv_FrHzhyJT01?nVkuEA4&A&ML`=5a(
zARrF;(*T+i1cyyM!^?9ZiC$1pbb>=GAiTE+TxWy!Yk=mHU${2@{|^Z)upWlU_?I{F
zXaY@5>%0)a)Fc5aTy6S#%UL?v9W{MaG@5JbRWum*`&az?|No^hs2T!C3B(<}b3uh*
zZ>s|vc-BGW{}%9QLIwj13q$A4&O@CqUaV;Z7liDfSY%)XclAM|I8Y@odLhyrU}+|>
zG$>cYr1Kj8|M%{l>c9z>X9mmv0PWm`*zm$1q`lPvGMnPld_<wQ7j#*2Z!757B<OHL
z28a#14d;bo<MfGgjN<j6f&eV~;$H)3d<B%PTqXEh*gzLN)u^~Cl!!LesJII7w_Idp
zU;xzs3@=ML!Sgeq)L#HP2ei9J#Rt5J(gVa}JOG`y0daa+j)KOCI$cz1KylOQqGAJH
zHtqsm%TNHi_yW8Erqe~mq}v629|tHtL|8%L)7hc|+MV4U0#;lC&J_mTH7XX}F)9Y#
zHuJk<R4lqnR1CVeYz8YYQBleMZj|YxqS6E!h3?@4%^n^6$<YbAw#P@s;NVZDgAZ9d
zK^rMbR1BJ*F?W{Kt7LSZ>-JH}0N<aK(_Nwh+Psw0ZE~(VMn$EU$GGt)XtubVvkSs~
z&HDY~!JqOS9GxFQo1rvsLghI+KWh7^XuzaB7<+llp;D~9Jmzq5rehAwpe=+Z-6bkH
z-6fyvL7S5>?U93PU?E@;$aI87c5r=c#~j!}7NvBTsATlU7_)%)pTwwuEKcb*`3&`5
zJyb8$e{g%b@LTJJ>OZ)(UQEZF;QmYLF8Pe+J&rCP6&1#hFjso9h+(&9x}hSYX1zi4
zA&%w)9L+T<1|0mYPeA8>xu{quG`pynICSp;&kZuxsFX0)s8n?C0Vfs98Wj`%)-@oN
zIVv^{-8CvTj5R6+j5R7AjV>x8pbaRXr302VDmwhFp@0AXf62@SPRjwEF5sP5pwck_
zoR%xP>s?d?h)B$!#pIxD09x6Q1D<impO!&tbHL3O0%^IPxWw!M$^ziTtdasw%PHWr
zoB>VC83fa^2NU*4sE0)puGGxY4M|TKm=TSho;+Bw+X1(N1tr6P6I4AYqj@lQ$Ebk3
zm;z129#Bg?5Q!K^8ur5BFPNRU5-}IlhI$W7e{qA#0mjcAQLL{yASHnp0iStc@fpZt
zUd;bNb?+gz<^ycd6#fyEZV@TG9-hQ=K#3S7iSGm{MM~n}On{lhlR!ya4b-!9Q30*&
z0;Nw-5)T0<aZpMGrEo~$EPyDhLF>$PU}ZCC;SQ)w&ViQEBA^vK-7YGi^bRWU;bk?b
zv^6{lD&D(UIzT5KfSD~F;Ii38#UMLGMZ+lb0Jv;!0Zqm*9Q*-lfY@}NIQWC<-~-l9
z7nPLG6U`4mn}jkz+tE|HYg96NWk9y8ber4&HA5Ib^aiju{sI-sW!#|U_CNUN9rAk3
zeDD!R<0FP23=Ey$LG_5{@m_akTd1l7&Hw-K&pY7pn)%=ZX4MDm3=Ev0Ly<KYkM-8E
zgU>H-1kDLDl<^oIX#V#Dq_p{gJZC*fkx7S0M@LBqBdAH#9diS;+sU9;M55P;5n=kT
ze;_R&(>YYZPPo-wqhh1^3+hbvgTLgzUjjLix$zO$_6wjU665dQV#dx-2Y)d)f-VFD
z*?y_{_dk$#njgt?Ug)l`Q8DRo>1XOl>1XbCQGo<Tj0MOE$f3auwFVp-e?ZznR$+t&
zl6(Kd-HRR?%*dfp4-O7+$bo_b6dD#-LWA)}ZvZQ@8-Ag?;T||fj`g}RA;Rq6Us#x-
zxZy@`0W0YC7*Lpix;te&hPRu4{NkT?*t_|$JSXT-2#b!84yKNh4ra&ZpB((H6G1t_
zMa2VDEvSGlF9ntOCXAp~0wn)f)~KlPw`PEp<*1Z^>Vyi$8WnJs!pty&f5A(O6PjIA
zLM%Z>1{gHEsQ5U%jQtFji0R$~o`q(tQE_;w^!fjPENye$vS}KOdW@aZ^)(o!>KByr
zGrUd)EiLU1V6hBQ;V6l>ju0sI>b%kXfF0B$D7EhdZH(hze~f?o&rZ-iiZPH&WPAPp
z^RGX_cnY*J+OkANphT_ne&@B$gP)iD2i@=mI%43r=AqXQvKTW?g1T`NL5Fljz0QU8
z7r_Hr^}FRE{YB77789hu*l@-H)MeZQY9v9&u5ue8{X&o`{}SGek01jbK?c5->-JHJ
z0Ij6xhV<ZGNH>6v1-k-0I0m#wIRw;rc2VJY;SFIZyl{drBwo~8Hva$L`Qn8UM1bdo
zCWz6Z0$LyUA_vs6Kiqntg8ATYj%Hhskqjj~pi7)VqkJFc{{L?|2Ydr3f2$;DmDYh5
zRt=z$ugb3(%oY3$FQjxB7+zG?|Njpj^6ZWH5MlVO`S*tsi{^hyCC1&sJUe~C3vMCP
zR4;6D|Njr*-`94)fuA8DLlR`d&FK#{8Aa+r%LN(vrylT7y~E1D@Zz!@Xx0F78q@B2
z&^~)xX+{QyQu&2BEDQ{+8yF-QG(YSHQK0jE8h?c|@Gz9Iy*}4^pyCw&wu=XUa(I^V
zK!#hhv>6y)2QCB+$@WHkFg(!wL#bpL$c+p6_jQ0AVtJ~Bv)-XQTA=y0!0Sh?w@W%9
z8jZ9;E2RZGPrQ)G`TyVWZD%&eE|4jmCtir<{Qn>SqO|V+f5`nWr@KKNq}Br!LK&d@
zU<^<00JZ90=(qj<9|y6y;6wAj5Bx2Xpyj)4;1#y7m>C%A`9Ujeb((+JGnG`ne9g?j
zU<+D5%HR5c88k{C#=^hdjqTtA7Q>S-9JCo2UakXGBz`Qr6uS8tb|ir2GISgM|8KBW
zm~OAlXsKEQl8$5H-^N<X!obksq5`TZBsy>I0&#aN0I5G!KYf8VqYNh~nKf7|l&VZW
zs?8{0|8hR42k0!52HNP^?JNfxA>rtDRshjFY0Wk&phGm$nrl=z82G0g;=BN2@_?8e
z7fMt4x3hq*^#kwM1XU*rpnk{q6cq*j?KLVqofrAnpa1@x@l<!UfTc5!<n<yGkbwf_
zVrh*a^H|Dx)9OLTOW5;IKXCEEYe|sqZXXo|{`Dsse=;&KG4Rhh;P9Gh17nA?WOubp
zT4#+4Pg-}iTw14%N_Vvah%eCX&C?w$V8hJcGL?aW!G?vu<syh?ERnNe0`2?EQQ_J3
zy_lbYzZG;Kz^;$Q{0uKa)8;!ESbj5Do~Q>+(=$k3;BQ*Vz`(E{)DiDIVR-5L_r0JB
ztnugn-*pV-I(tF&D~MyyP%gh0G=b3g^MADhL%Gmi(1cav&;Ppx7|K}pf>zb@Z~qI@
zzw1viKg7J(Ip8o8;BUPTj$0O$G~560%UE~(f6u^BfA9gze$bLgke<CD#><1u3=C-(
zUtD~e*8I1=Tqn(zfu;QYYn5(imbC6_wp|P*{0y(95XSES^((=yea!+I)B!~t2S`&H
zc-t%o14|(P_TvGdxfIX@i%38ah*AlFko6!+CLlON5tJp9l|ZvB*-W6?KCRQ4C9SiX
zt@(%s=%5Nl{(jKaQfc5M!lKgcEz=#XkOsQwkAJ%?XwDTh<hCtDMdaWkmR=WOThRC&
z<K?vD&Q74x?I)+?rRGOJnqOIT1iOOQ**klJ#(B~rJDqJiUv&iAgSIz$r&+$_pL!q-
zd{*VuLmY=nxj;8`r&-#ll&C>;xpjDZbh)VTbT~U6b9Pt&o(2RZn-@1ELEBn=(iVc;
z0&?*5c0ESzdhu>QmR)b0_!)LQ0A+%*n*aa1!&ti6UX*A5|KIH<@bWhJ{M;Rk3=9k}
zlCwd($sp@@!m~ly3#5~wq`cWS26U}gsU~#RgM$IOuI6h!s7x&7*|i6>oDX#L!)w{a
zAhnRIGajmd%gj>2T?;_+r65b5RR90~T5WLzXl4?8zXsRz7=1=L8PHs2rz~ia^TkwA
z(CS$5nWde#G!MPFFnyXnqg`Ng9ccSLXcZ3VaJg?K9G#%!Ld;%&0UgED?Z5%LJ-oY~
zr_)BI^OxqK7fBM}?v>2{0-pZ`9Krv=CuL^DfZ~}$fq`LRg41+W14b=lj=KN<gEN{z
z;%DSRL!Tlq<TF7_6hL=yW-J1UZ;@wU*bO@HBPtSfMn=o@CId#LdcG2VhUUL4<?P)y
zYXz+N8Nvhqm#Bcwk>Uvo2+P<7(ikt#z~I(=Sfu%g!t2$?Sv$J<LH$66T?`D2&;>?0
z;-G2X|Nr?JUUVvft|kcqpN|_K`!dIXfdQ6-UxBi%!=L~EcZ0STz7%=>|NriK&^5s?
zxt{<3e~gWx^VrMWd!U6~pxYe_Uc`toFr;;ha&_@Dys>#%!kKoQ6~qQFC_3<>K^RoV
ze&}`kpVs{2FMqoPXto11*ll>=MG9E%2KZ(Z!vilug+Zq<?b3tn(sUPQU`VqC4a7fX
zWQbx&YyAI3iof+1Xjq>YbPyh6TH|kXp%T8d#@`1tOGPsNRPZyrX3cm63W_i}28M{&
z{J~)v!j=3CFWluoLCw<}qaqXBTcRQZ+FB#i8=@j%c;JP>^bdxN3ia`^hX0#uR0J4G
zWP{<-kd*pGhyir-y-M?Qhse0#-W(N~&|V)Euzpa1*6`voNI{8;L_}2MKhWB<GSy&&
z3eXkRFE)ZyxTvTcd?DNXfN>G%oVwVE1t1D^1jh={{*smhB?68AKnGHk%e5TfZ+*@R
zUCOrOb_G8J_{54`_d#AP4(@ePkpXQWgE#?vWJRD5XvKYuibP~w^KXrEhg~+6;Jwra
zFN6faQ>%Q<zg75KCb2RwH2+qAExOASCjUtQBvh{fKBA1%@Y@csC0yV|a$u`>f$ZN2
zB3l2KD!!Hi%d{K-%k2gg!eD2WFm)c<3DO!692D5=qT&#cu>y1rS{Nw&*Mm+pI3m;f
zt%R*Z7Ie~|;akv}RtNBj9|9on$OiP*sK|uF!nO0mi$+0kj*^IuvivZ8p)sREeT<4h
za6nkbM39LtG7Jp6wpQ|k&heK3`QV5EX#Tj<6m%?NcaDkx<SgvhEzPzd5r&eejQt>e
zJRp~VlMf5{1jXh90#TMni)_G218)6`R{{(SpflPs&Vw{vmj*edUPYn#h(H?b3`4G6
z??7@94gdeYnBNO3nfO~4GeXY-03TuA`QwGZ6iBCv#0xf1(sogiF#Kj+q9Rf31X+mX
zqGIrZO^Sg5e2e!k(E6%g7Zr;a0!bj_N|@bVUjmI`c3w+6c#H!yOk?n3zYqgM=fSkr
zOQixCUqSZUN`vM!v_U7L3b2BvsMFr>1I-VCE7otI%XJOkTIZ-p@Hgjz)PSTw;r(KQ
zB-mv-pq7ynXzvlY%Fbf?U!tM|!r-y>5EY#lyp{j||1VK7`7Z?`pg2RJ3UqL(6ewFM
zyj(Foz?4y}{z?T@B~%eeS4Id(VJ9dUN>psRYg8PXk0><%2TezVZr;`?w}zY*V|csM
zM}-4a!*zb_{0%x&sFOzpbQ3|hjEbc!XuBTha3kp$6_#RM#t(}@0<TpVK_?*{>%8u7
z$$G$vUy5NNXq}hjk7Axq@LI1<@NQGrm+${ge`Ct%qyW;C#b|gbC;)WG<cnA3pmG-^
zn9&S!<jU!OW{l$X?@Isw&-xEOM~f9yY;u8CEZqbNg0JU-m8FK4UK}a?{~vrrlLzP+
zkLDvPhTjZtLmF=#p!tJr9~BOf?nY2i-aT;%=%(i5omZK6g0E0sxdz0yQR&Q4Vc82R
zkh^VEEdTChV9;h@kj_zIDNb+R3A)yqu{0EP?>a-dU+1CDpRKn`ZF<`o7#RLHKlosI
zd^)c=qftHh7TnFCu=i2nco_&<8py!F$*_x|fPn$Bj9^;D|NpJGOB8!~j5}{ZHsLf^
zfUZ_Eyp+Xc_&+@C#iBCMm^jZ~(Bjj^x1eRN;8Q|7UqMdvwJe9MU@ldJ34@m>D1n5*
zM`Uni%mxLavM2*XXmAEdf5tA5fRqFS!#)tV^M2>c&r3RQ=z=)SM+9~?H1jbu{yNaX
z$571O&Bb_=k+Jy@%j>t`CAOM3cY!1te^vB>rHvTxG4g?>cY#D2f3<+bdAqq78ylK!
z`4~V_uXo;L=VxgA3GzWPcdrOX<4=%P#jLwP;)VzQUjmm~kWveD{7>hh&Vw(vOmDPc
z6s~^<a%++}14C>?TJt|f{+4J)(5k+FO#CfvAQotELqBNwbum*~cQ9Ayg|y}e9H2&g
zDbIdT@PmW-HP?R7?mO@r;MQ-Yp3RS#)0%%Vl?bLa|6(qYO!F$?G(7Oq8+3N|kLDwg
z%TZRx|NsADnPxmFctO`_ff$E6Z&+UDZw77G>Adh#24rnE+reint>5YnOt-LPG^_6f
zA0-C512U}?q_g!vX)LI*4?5n3g})^oG-LA#5_7Il1^g|bgaL_d!%HtJO2F~`S`C!T
zKE05Ks_N!ZDHR4^F3AfO;ct=r54p2iqVvX!syI-=q*lUfdAKCJxk7-Ugt;?Ar1QpW
zuWoOq=AZxhTi$?93%}IOGS$Ipx}X)Ku)TxKYXzs~U#z9~UV`pP>vm>(;RZH^AAHvl
z__9xEXdF(Ppj*w)U|7x1U{%e}U|-G8;JiK6ig7X1b`x7hX-16+Z4C?z=0Xe%pv_sJ
z>6Vjo_!vN92Q(34JjeJZGKx;0P{+tJeSsaLKz-33h$4YPgd&)j1d_(bFm(kC42+;z
ztN;K1*Fr52EJPIpIRJ!V>N1z`F^C8-Ft~wS#R0MBFhs1L0X*i0BnWb`Fp^{DLoG2t
za?GANd<@wF3=E(XD;WMm47|PsBBlhg1W62J9>_5apt-XD|NmdT3R*4$QUt;idARtw
zxVX7}s`(lGtN9s%tNEuV)-y^@e_+qJLHzb{J_aTM28M~w5IaCRE*=Mm;2sCY7LJr%
zd<<z5(k4vzaAd3y2Icw`Cw>M{vlx`_6P);=VJ$HIM-8JBDAd`eJ2)}A@PJM<W&*8O
zZ?^52KEa7mjLFb>`U)pTYi{q(gRft=-Y#X`eP#MPCq}vYUMGX*Uz}xJy-wk+Crg-n
zoy__7UFf_K{j&G}|No$C>5g??26eVPn}4#Ev;SA=jj85mIQUAY^XH3wprn55;46vd
zNBo^XJ3qWw3l$K73Cw{C2*3oop#nTGfqKy0E}gdyzT$w1fEwf=0T!4*1Sk(Y=I^`(
zvLiY!{-yhWSo4>o^IGTW?i>|`F3=tCAHl0W558n6VRnE0L-RNPzEhn%Dy_Hcgh4w_
zL06US`uG38H)yBf>zAE5Dl(lvJL^9|)Bj7M|Ns978=mZv;joh7D&gUu3px|G*M;H#
zYj($$+ojJ94@86R5WL)NYEci`Ms%U|TM0Mgy@QW<7_W8my;kVFaPR>~<73eI?VLA2
zYx^2@{or9>c)#lp4+BHziTBZQ5bdH6?FU*fm2flO;yd_&hw)Gc*K3u74>&q+O`q<<
zs3HPWak7Mq@ghjU!EVOs=Uo_;Q1qSx$s9`SW}43C%BUs*+SJhPz|;If0DSGkVbH!e
z(5>LpU0fM8>cu+6U-R=X>SXVf>+}UR03<p=mu|*_l{LQ+=)A_y*?GD7@gM%}2SE2z
z-g+SpiYgZsj$UWb5iBg7hq_r*UNAufc|bEkpL%OdI9?=yL=M{iujc{P*9;8h0{a*o
zzz4=@9&=%5G<>ZDqUr@5nt!mBh<6@4_>8}I9YX^TgXPQOXN|`|YF}SI<|4u&0J^je
zavGsDXaR<g3J++L8t8z`BVeb#Wcm01e=z^{8=z~ls`(k3PcrgvKM8Kjb>4XK{O|w&
z;JeIsxqy}=-*_SV@Bjauj0Z0M+w}p|!UrYkBY#2Hmhf-?0BQ0;k0*Tl_y7O2ZrL}W
zyFhOu8~WkJWRRht4m0>9x6ThQ4*vcBpMU%5#)F{g2GB**pw$|kA6{gE6mo(#Yh41_
z{vkT<<uuU6A^h8K@NegRQ*FY}fY1YKws+omVGhy*HXJm}0&-u<UvQS&{h)@Qq1*Pv
zba8h^B?T819?*$VJfJ=YPj83{2c%#0=r3pmYoqOv>EZ5-ii``USGqH*i}Rm2+-wW#
zdoq*?ZRmeiV0hqJ;c?cE>4)4I4R}Gve>0Ry@Ed~mWlsO^&gjP|Fx}6CF@jNG`f?9O
zc}A}3$2}PR#Ik;ZDw-0#<E$#(kQ@ID4=lEsuI<UFQLl6G0f#E6Q03)eV1T9Ye>@Bf
zZ(0si@HZdi*bPeb`#@>_wT9#CkDvvwPz|8YS?8_youAU)dVqSPWfI>GvX}BUALQsf
zk#_I}N6F>a%#N==gU*&d5gi9jm>iv#K?fZ_-~eqXZ+xZ?&R)kF&w&iv3$m*7L+2|<
z9(xN)w>O&~{%JnQ()bXp@aOaoo{Yvm2!*>r4g=i+dFy@WiOyH=L1h8RO+Q)=l#1>E
zHH*NPDQF(t*U<d$f9G+~nPK3@!r|b~i~QSfbl#YL!G%$*zVj5Qfzf#A56_#<Q!4~I
zZ<KQEwDS7@Kl=Z}=$CB&VdWDK$Vt~bPxJ2+Z@I+Z5(PRT`Ijnxt2Jo7U^(M47Zr8|
z!;}2m*m?slH2mT$mu@{-%3@<s!kK-NtJjC|!fSSr5(C4NZm(|{Ub4w473y+hw8<%%
z&g#v`U!Pm=ZllNFvVf6+p<c>HmA~~GsFR@z8s%hBc~SiR|NocQ85tOCBKTWmL3A>I
z>lV=VxM~*ueZrvJ8~{?X2_#j_-_is!hSR2?B;sWsNT{^L$fkn7<uPb|V=bs1WZiP9
zl(qRV%WLN5!yK*uE9?1p=|b(|`2PR@_xqi{UJG<HBddZG8t=dT|NqhtVsp22Lmgv4
zX}nvvF#on|Sq$JELZDc9VgCL9|6Nuf13@MAwr~IccL^VO#mv9$5<(Tn3qg=7&=>`1
z=8ogVgm3@<cMCT^Vh2wNa=f?<vI?}11Aeo5-nak%cU6FlWl?#N`0fAyEC%qVD)6DT
zEH4gy`~N@kC1|~^O$0yW81$py+tE1q_qnLBw_GYQ=&k1H4hEf3pxOMABNTLm7{?2h
z@BjbThk^|P9YO$_czIFr4brSj@2zGD4FIjS1daQ>`1K8xQC|l()G-#9`u0|{bW20(
z-z0tp{(ZtNmrA%nadG_X|NqXf-?_ck04ssW$be+lLS%NqB6jZA|NlGxy=L<4{M}o}
z_;NOA&glr`8qZ!I74ZJq9X~*K5ElRa|NqyQ*MB<?c0RBLbx6v%GHxe<?o#~!|3Bo=
zsVD#W7+&yBck*RatN#y@nguG(Pwz~<%+JtZ3zB6l;e(VYj3ul)11^JVKGPTf`4}2s
zgLcjBn$XR_@c$tr=yH_94YrP;1@fiLpC=sNX}5wOv`+rO%c-Dxwe!Jl(1vVV&`l*}
z?5Ygl3vxSeyqNOk|Nq9{AgNMmw&<6;|Ns9VefUNC7f=CI%KGvs=mf(9i&dsG`7tWj
z>vZ!ofN&`%%qG^CZJ-{P`f;dTy#GN3Jh(dRJY{&2|0MqjaL?97g{Skw3u(|rSS~6o
zoflpRfS4>Qoey5H{RD*tD+9xOP+0%?@&7;Q7%KJ`x}ZBY-!y}&p2Mw|N)(%I>mesH
zaDkKT%W0tIQRl_Z<GTb|85ln2#2*G#?}s}tbe?O5p4}jP@PR<{39inApt~}n<6b6%
zf*mwYkoLaw6zI0EmrMTt{~riCn1zXfq1iSCeBy&J*nIE-WW6pbOfQ!G|NnnO$FqVb
z)0O-gl{7jJwH_!@f?83^*?ACb|7#xbb}+*OFCYE;|No6=>7VHZ{)|#=DGT`-UY?jf
z!JkpXcIJ=&|3P-CF@O$%k>~61QIR|5q9Vk;%kT;)S}(nr3~Ff|(KviKxbt$eEoc)5
zLkWM!1<>%~^soMmTJ_*$mHq4g|HA=68B)po3@;vnweTDc?mXOjvQ!@Gt`e?;j|4g|
zHlLJuZMdtWnxA0@sNi{R(|KVR)c+@5fL6<a`|BlIFkO%nZ$Ptvoi|?W|N9?wfJ6mI
zcMoWLPUru6@VZQnXprp_LAIwrZGV!of~mwXc(;H$1H%p@(Ae|J@BjaMmvDh3O5YkD
zcrCQ+2*@B)kQ}Jp+I-@F^kKsT;992hSm*W5vyffwQr|&+I?xvL&QFSmI)7T6f?QIo
z)_LQFpzL>0x-1ddwF6|9Hpnc{;l#}+{=a5_(K+29kWo%KA9SP1LA28V_JQ`Z8eaPT
zjq${bC*P(Q1~Q5;w;rgN-WkX!Uw^GD!l2thhkv_8=Z_an;5%RWJ3xD!I{$Wsu{J;Q
zZ}`n9d7$~hhvpXnoEJI{_J*^)={VeR;+^4*6#}K9U4Cr6u8e7&E-FmDwM@OS%)PEG
zARbGvD=Ua*>pY?Q4z%j>hf1kwmm7OpcZdqpyDm45&R_4k+&DXZZoTVrgPaG@<;D$?
zWqbFUxAVsfcCb?_7rfT(Vgm_-G%<oTF?E9UFoT+B@4DPrK$2|ldPCVePE5}YVw6v{
z0L@piq;)%hj~`&;-(Jkstqo4rofl?){|UO+jek36K`sxt&G#N;P}=9*ZWa~BqoB3M
zY`p<YZ@OJncwR(<FKn!2OVcdodabAm+SBh>BGCMUqvYuHS3!(Q^-iE`z4^CAFd1HI
zxm{uox*zS<3$CyKA-h*v4wR^XZrckE%lH6FFNgksif94DOU<^RO-`W6z1Pf!2M%{$
zh>klP+%5Z}nxCQdb|r6yPYOT7iz$Ep|Br}1%)k9Mc%y9RjTaUl|Nq|=3EC=dYc5p6
zx@&?AsI_+^`sI#~|NjR!pZNcx7*sfeCYvKWZ%nWAWR#e`KbVoN-h_Yq>4Pr>Y(f3!
zQg*NruX$`iJ?B!%UEnt4i5G$2{{Mf`^!fk)POv*(^LO5OJtt!y=tkuqzrijE2Mzgy
zMr^UR2yc7<otp)k$1DMz)62_LDwUy<!O!qw*KaM*T>60;NMkPIC1_&wI4g|bZ3>#B
z=(c46jjlON&kA9*uAc!_dz_Vl`N2O1R~`lkOTdkX;f3X=|Nmb|`~tOvZ&=HMj46@t
zRGm`8&v2X-q!HAO{XF3V|1MoHujupZn=dx~`2W8XY*8oJqW`9#1MY$|d_fL;`U?~-
zJmA7M{%|n=_WB!!CwC=)!}i6=cmMzI0-bQwdE>?2cc3;s1H%TG<eGP&3LSLE?uLxK
zOn!!pBG5&((|&>c3+hENFfeQY8G9IBGk&S&XL#}H%m4p}!-5wo)blfd?wR1tI0Djl
z{r~^}k*`H}zEEanV3_&+XF$eHkTB>h`iQ7*Q;_P;4=*l!0u>Q%(@%ynDyS>{`2YX)
zofpy|>SqRf7C*xa&|u(B(7k7dpi8XGzW@LKLUp=87^AePdp1AAi_@SAM-8+p!bOGe
z#h;JU9l{t@OhB9VK)F>Yt+PZ$4>a3o@FMmT^y=;x?ce_Y-w7(q4KMYAbgcs=702l_
z!WiX5UV#jCKrys%`l&ERIYC7<T^`eahB3-8s!kURXH+sUffo8=KmPy!=Axp;Si+vc
zl*7;PTBP+`i9}kX?Y~+EhR{_dycv3+o11v2XM{7#*UNMs?#^K8a%He7=5GP@M9NhS
zzu6>~i`vBVx32}Y@d7q9{9-J(cnNBj+7$A)%wS|-crCjRbODJ?Gk;4bSWSW9w}xMg
z{B6}BNhzBG{+2?}VO%1wS!@(bOu>VNFXKV2(57-hu-29X{2hLvlhkdBUNhOWK$~jE
z{F<MAZ9c~H(u9$Lq05`2*YWQ@(D8~Z{_?kgcEdLOWGYc<_^D9h4>q#lrvQIDC+L)d
zjSP$om*0KA*8Gg|C1`mw__#;#ZRVHX|Nno?MTJG9+nMLZk9Xj09&Bmd&Rn1~KwRoo
zxcRr&O1&29E*9vmQDFgZG5oxge|t4gx2sNCH%D5hj|x*-w+9o<M1dDg??F3!YgB}f
zxu}RO=yhZQja_cw>K0LX*BhcD(D~xUmLH&cr8JO#dyWcI=ZhCj5WeG1(0-KO5*2U>
z%cPd}IlsPJMCDEAix+ZW6%`7d$C{rpmT-bfU?!(GuLWBFmvU_202%#SZ3PFME!z33
z^TrDuP^0G{M7s542`e~YJ3llZkpUmU5Ek5dn16c#SGNObM~M{w`eU}Bf}xH#?YJ`+
z1H%qb_m=IoWao_+U#FjqWK=f~289lbis4&un1h;6A>fNQO9V2qK&Sj@gIc~XK})lH
zYgEL*6WE<UUW827j$)J+j|A5){4Jo<HhNuD*uc^+l%~f<F)GL?K_pv2vmXsLDoR$R
zLVjTxO&~*;PoEjZs3EWw#IF4M|NjnyQU-<><<l=lF)G)~aDe784Zm62Y<<wh&rrhY
z*8ESP^keh6|GS`bFB~t@-u?&OzQNP{?>~Qw8WRIU>wo?hIndcB>;HkHUI28OiU{~L
z70`w{2~e9!h>@Webe{%jJj6wX<Au|||NnP`QW|Klm^c#y!*0+{@A?MNVH5nV?4ViJ
zyP#85TvTLVOn>qJ|8CIHJ0P`hKs_lJm1NMGEbx8~B;z?=fG!y7JPcAd6*O~Mqawq|
z-#QV(lx5&=?S(L{Lit-k`KX~r#d;NgYaK+?rlX#}wF)%CZM)$+A46A&iY=%zwM%O~
zP|CXF06POi+TsJ>`54lUv+ny28l+6?_EB+4>*PK3osXeAN5!R6cL#`7FVbnF()sh^
z%MRY{AU=;u^Fzk8PToD=`4~W}U7VVaGavlV)S06q0-i#Y;NO1Y;6s+qvz_%hDjc9Y
z7hU<czi<AlPzPBi(h;J<-pQkq)|sOs)C&qc4)C4D{H>rZLz?dyb5ul{LsTRf4nE~(
z&Qam$3Q=M2=23aQspV2BZ?D^fMccmfF}&OcYQflomJ%@Vw}9q%8h$aCJ04>NNy08~
zb7XJ$#Z)5D@N2qhETfi&Dnz#7A9$ruT6g1N&}_ouBcQNpJj%$xu;|!#K86m_=@ViZ
z9l%KkoDG7T-)LB}=G5^s@b}#X^&3TwHq`MmfTj^*>s6Y6F_zdg|6<~A1>IbqAzZ}I
z@Zt-oPYN2y0bgkOTEFpE186UBOEc(H@L!-+Qv9u;Ee0<^hs<RB2BqAC-~a#b76om=
zH$3pd?&tsi_0g{@yJe2H)bTT9=z$Df0BVTdcyapA|No%#w)q1x+(5#e-@&~}-?VN~
zP+anF;{}BPXzY=t@e#uZ28M%=1XMr#XJFvG(0S@bE2vshgqd3fGQi_IXyr%ejTf09
zxy~2fAjhkL_DF+!8y{Z6I|;jNp*6&h51{H<BN}waZu1+R&chksK_<0*{Qp0q@i%DF
z9em3LLpLwz;I!70r2-io#rzB}Qb7t{Zf0a)Xsl!boy=DHywMVLR9or&?m&TVM~UW2
z8HQ53)&nJ0jrA50!7d@CM%^APj0c+!s92sTR_m5%u3%v(m2ACTBHC!}=I9(y${U;k
zqBG=+`59i@Hy_}5eXaFU$;3vhAdv3PZYLJT3(bdAUNbizVzE5L-&_LPJ1NzAyW~C8
zfag#HEI<xC3icRJx3fxX{Q>?KkN^MwH(IzkItTN&+JH0`@U(v8Z!!G;|Njf^7ytji
zD183^|BE?a{{LV20Mt-CP{F~!{lJSo&;I{k_ykEH8zgWCNr3(N|NjebAPE$G{r|t&
zRtMBuE>T{nQqRwz(0ZUm>V?f`P(@H8Xn1lLsBi(xyfFRt|Np`X)3Xy8rRr5afUZU1
zZ+^`m@%sJ?ug|c3doC($FH~Oq{~wkS2=dsi_n?yuz`OKZRP+wMV*#})3_#U2!;3R-
zP}>rp-+&Gi&d3GnTlD__|Aigh|Nlp~9w@Pa^!u4hl``5vlCAIm*Z*Ib0-8EK6qyFv
z{k(%gfq^0IJ!p*K#lKIWHWz5<5#;jMRxjRyS}zUFd<;85f=DB3J9@hL8Fv2p&(F~K
z5+t>+2eh*A_~#{t2Nr|)yMFR8Fl=CYw}I{5ncbk3FE7@-|NkG{t*d{L`27F>4ga2{
zfVnS%pa1{wUHSm5<4yB}pB;yrPcXgf6j6aln>_#jzvD*p2{urL2oX|z{{R1(jJ+WL
ztbhIgfAbrST?`XA7<Pb$M_xR6h6qol7uTL4vckJ(;2v`Qi+gXudEszILJdDdhAF7M
zSMUyWoC1jZ7&Mca`0oGz7oR@<|NkQS{Qv(MYpOx_ZG#$}9w2qxAeP;`|Nj?)jxTap
z3?iG4@Vu=0{r`W)0=QZkxLToipu-5D>J)ek54;Tc{r~@q|4;t^56BP(nfCGR|Nk$J
zKLMS5cVPScBt{9Y>0b*N6S-4MlJ!e6ic%9(il=YOVRYNBpUZfRnaepKRKYi+%2u^>
zdq^Q;6BAF7ZfbHyF+)ybQF`k3N5za>jN4gC8Os@`FDPT=nBGvvsK8R5m|3!Yc^TtM
z7R}6jhTPO#hJvEhG!Q+((1o8t!G)iJ--VyypEEzhTW5ZTJI?$Jr>D18GuB(R1n@K1
zdGdp&vC@;1trRreot-rm42|`S^b8e@42+Bo%#AD*G=fr76g(136r79li;Kb1)BS1~
zr8x|AjrG!!jV-4a)-Z|*o9P+r8tA4cnx&?gC7Bx-rWqt|pH;)SiH{pJE(F5n3=Y%7
zyBVG9>$>?F7$*D&B}RrcP!9|2gtX3&X$PON^j%ET{L*(bt@Bq}=gqVi{GtpDX}jG0
zKu0^dgC^WSc)|-%KPIa2)xmBChSap~NnBkF3~8;GN*LcA?)5Ne{sEda^9XOfRKncr
zVa~tr;LFqC(WlPCo#&c=P1opQRIA?t8cn-#@P$P41OCoWFP1{NA`mWU2&wbN!50D$
zZaY+#2f_t)BS5ko5H5IH>;~wJ6|hlJV8vjm=(v|YV4IuY@N^zN=Ayz4y0L+49~Z;)
zvptML^`4!FU%%$x$Jlb9gyY5UfB*kGzW&$@8ZZP8el))Ut;|vZdp5rD{jDDG$`pmv
zE*1;WA$y>aY8%y3(0y+Ty#=5VYi<R@1Ft3c_Z@i225LMVC{fHlz{S6fN2S+=<APgi
zmxx`5h)T!B-pmV~FB^VxmPy}z&DZeDp!62VWd?=^Uf(f1+3+i;RH`?Rae84dqewkd
z=eveqDf}%H85kJqT^oMs@wbG52BRe!Kx5^g!RQ^JvCkJqpdFFm*3hpA{+79*DS%(e
z{H>s+HND;}{QH<+2!K?8_zk~``CAM@h8Q&bD&TMR1ob*VL$5mwK%+J<{{H{J12ic7
z;@;o?(*NO?qPzq(Ng95YmgqG6swlC4DLh@ak5RgQ>0j{h_K(+m-OMc~5rg31;fa^8
z!48SwpK^$Q+oetsm2PX$DR3<(OI$%C$I+nUb?tgRestadUlDxp1q<l1gCCkNK?BU(
zttaa^Ubz1K|KIcVmu?=F&R3l`US$6TpBfB4-~P2;Z*@KBracz$Aq@v#v6L`7zy6_l
zqw^p_KN~_nXzv2c3$4HZ|9Ad=9h%zZV#jDxT<X*7&C)H+zmFN52Cn}B4K;ssdu<FB
z21k8_?$<sBhSV+=kP>PBeFt7_1gm<qLzO{}f#JoHKmY%Cm#8SbX6iiM>&DpWqN4C}
zC1m7zx_>|8T1M^ZfBPAA8FQv<PhhlC+BSg!v>fpC1O|o|rJ!My*N_wzp&L7afg!cK
zA!T~|1jb6Ow9bQ1CUqRT@G7nO5o60q{;3BoPL;5wHGg1wHmT!6+TrwL4zdjC%?T?1
zrca*8s9%3D4ZQic?||CE1_rfmyCw#;ZZjzcwQeyPhV-=FC??C_#ms4)H_{AmTOKQs
zNZSpXTI)NU#=rfNT6!l}-(j`IG7Os;J8q;!r^ThkryWiUPYX*6PU}3D)_FOt^Hh2o
zXs#P!i8zB=7vD67wAODWd}-e=tEMU5Nc(;%P4VJu&NRaxX`DCGI4`Dwry%<dsVx>~
z=sTp=!8bj95~Hj$*w}+<I~X2-RvI7cJD|3p@p~HowgYLJC)5@-eor&JlxBIMPQ34!
zT6)(Uu9oi%3~K2evp{s3)9WW72TngRiP4UcYdZU6#sId?LwacoBc^Y8$GBvA_+&;W
z9=@*D1EtdZhI(CmJkys>W>k<k@x&o*H^{!e!)j^WVm05>4nE*W<2*6_?qo(;i^FPZ
zi)+58MW-DGdH8VJi;n;Q|Ldi7iwSh4@vpy?#s~@&m|V_(P^a~vUfM!|>3&lfm5t6t
zgG#>xr7WK(ynY8VBt5Oy!ypY*4Dy4R;h>_C6~r=60~Lms{!U*uh0(qqv;+VYAqQVb
zq=6eGpCA@P#6;j?C14A0q#b-A02fPui}Aq4Kt&xyF9%%A0<Mk)E(W^%D6R7bFH9gh
zE$*f8^uno(hAdXU|No!9Y${`_ZtJBI&NQ#|V=Mv;uRo<7?l@>8P%f0V12j62cKJox
zchFKJ#<as};Fi;L;c1Ne_0xZ)g+dcea9Zc#w9ad3ofpzxc>V!}*VVMnLum(J38Z<X
zce1FYr}1yA7D?;;(Q=?7Sg(sup&Jx~U1^pdN<|^*0+cAWLK4Nr2d~A`+|oKfq#b<0
z(sv-O`5C`jdKViw!FZ*2It!#9cV=SvP@lHrPbULIdZ#nXYh9cB<-+i^+QnDOkk<T)
z>9tteE=FBO22dbHf>Kdhd|K>F>Ho+!wj3ytQd_X?dz#@7n}&vq3=lW6H~eHOW7^1+
z-r=LdoPNw%h9SKpSn}X2rnKfq2hy6K+NW{8N=WYrmPqenQAzJ`7ERm5-~h4c#jbz<
z|EG6>^mTZPq(#8&O*@>{c__WPLWH@DE4|r6g)z<W04O}c+44Yo8vk}D5w-Mg7SIVj
ztm(~ODvZ-LrZXB%XMV$Itn8WAdHD6?^fXA_#g+EL^4I_WX^yYorZpeo0o!nRdgOFQ
zQ=OC785q)Dw0bizfSRJ|X`os1bWq=yCGADNHv<DW#kU?P6-di?H+|Q1Mq9>j(|=57
zw5>P10n!)?N<Pg;6hNsuEg&r@Eh7gk4m#)$Y}H}VG(w4OT5uY8h9M2yluUbZ1>_v>
z5^j)e>8muu1E8RHxW&MbwgWWJkoICd*x(cY!3Kjp4lWeHWew=C#`^!D^wN5uR5h*h
z!?TpMga3HaIzOc~|6?o_hUJn&;O={R7xS|OP(lM0Tkt~bIIMhATd;s(1!Jkt21d0-
z3mDQ4J`zad-+nTU^CGAq=;WKh0H*EcFu)T*TDMrm_vxQzFxu41q=N>nIKV}pL3&!J
zjY?YQ(X@ka1=2fRRK(Kwx8LYHs+Qhuoenzr6_OR2|4Z_>@iM1%UPw>t4U$XiyqI?I
zB}?DIwB|?rYU$lpAf*!NX}tk5m{MuI0Sd^Xu^=5n>1n+MJmA(D#2irSPwVDWOHb=A
zV@U^fUs%$b4@iLu>VxlC`i_CJwOV>N1IUe1eMi%FNHKuQ&rara&=wSy|D_sf%|HK_
zDotmb#V8-~vXdc=fBT_y&<HC}8vpj=V3q(ljqs$WeNRyl0GZr*J&k|KcfPcP&-l_b
zkEKaoPqRFi*7+knP1;3;rC6x%Xqw>xwe(JBrnDWPt3+OlOi!G}C@dnOmJZrN(svYW
zo&cCPy=fMsYP}RlwM07T-cworwyBI@$8j+5w{$V4?T~}I7^;s0tWOH8*pa_2gE76q
z2DByV5PwSyW7>|p`~Lq2nI;ET;Ke`XKzdp)%Tdr`O11P3X9czNj$lQo`;<T#G_Co8
zJb&80&KnF2HcX`wY5V$aFfc$gmvE)0HKwSTOt+uSsHSQHw%7oyH?7mz1giN%+P*m;
zy$U64Y5OKm@1D)5pjo3L;+3A(8*Bl}xjrglr9R*=0Vf>`kTKO@(urmIx!H`8v7N`#
z7{8}Er8WQ3E`8H?G_CVT+V>kE*LuFTgZdh*-q`|bxf4s8;r}$lOKRy|E?jb;D1qu%
zM%C|_W_V!w+?|Z#)1{s;a;aT_mYJQP@)}fZGT11Vv)jm*2fw_<nAZFv!G@8){lfIV
zIgFb1U(z@~9(=(J3LR+em==(hrIglu^8d?ejC$#5-Ca5iAOGv6cQqL>eEgr@;iAH-
zm)^aT2_o3Y#_;if$6>wn?nVZXbf=378%R?l4@AC`9VFV}qr#z=-qi(ClC}>tk<su|
zp;SjNy{o=UlHue3G{bM-4*o8YN!tgywyfbNV~JqeJ`OephK8Tapx_3bOqJGrP9SYB
zxHdnU-tD8prq;=K;(J>2aVE7+yHnrO8){To8Pg<BrZqqOkk<TCK&^xC%=e9_)jIgj
zepl;|JNJDfqgn^w`R{3lC)GOmE__$(;Jf%;t-jOj5?H8{@5=X$f@&Rn*S@FiJMo=?
zA<gi%T6z~>+s!n_n;oaq+|nBVUH{I&Q2MIxXxjIiY8`ynzo)exsN{!4JsYGTcx?=d
zq~>SrX$PMPr15V%gC4pE!Fhrs?cf86G|q!*J3z;KF{B-QDgd>VfBUyI&aa@FvP6Y7
zEi5fCt@(sNT0mOo%hx<<SqxBQcoJ+3Puhz*P?-xV{y`X27{;f?!dh`Xm(%#S-%e}%
z4GOeUyR^>7X^p=hd}m-NGfL|=yYao}a$4u~Inx+5Il+}jeA@qq(<jbjRId+82Mx)m
zWwe0G?u@12!k_cU|Nmf1IY3pwOMxG0J1cH6FzBUsfjUxrY5e;Rq`f%v5nLg?O4|V%
zr+B&lBcf#hDq=)b(mKzjy;$(&|NoA|>1o{{{*Sc(*Fa&$zwL0^i>tn%wqgB;v^c1X
z4#OK4&=%==NI0jxSPfFzdZ5$>RIm43PwRY|cJMh%8snd|gYQ|=c3FTX`X3qozqZR|
zAp^rpMI#1=zWaUG(>mXP8YwU2zJQu1_dz)jEzr`!(&{@8r>Av_sHDA^^#1?<wAKS)
zr<O>7TFq%YQx<~U2x=RGb-oPv2XeuSpN0$!@Ou7mdS`$_&#Cmz0HvNwAZ;%f{Z9){
zYks4VwmSzBYTPX+OF*G^Fzv;R5C8wCIlqR6TG|V(jt~F;cbs_kA?<~Z8>lA^njK3|
z1C2+fz4-U}|Nr#kE-GpaOliBcr)w-=RI2Yhm<HZ{3|7OI_F~`X|NqnYx1DS_>kqEW
zlt3D^7@5-cnO|W5mHgj8)#?k-m|prf7Zoi={+2T4^tA3A6(xA%9n{QEPwNd;0L@;B
zq;<ZqdB8vAK$=4u=Lxk%(->a5GN*OENK*xk?AC*Vv=h{2ssDD6xkRbqmuxBfw}XuQ
zt%}TP`@v0{<7u7e)0&_EN$dOp(%taOs-&u1v*DK+f6D@fa{h*2vivP;7#e<Ql@z|b
z!PxN2oWCWLvEi2mf6Fe0m&X|!eg*TlOkyk-Z20BM-*TFv;g=iedYYGO85@3u@YlC4
zV?+&r{h$8-2OZh2+?v*UJDq>3iwYzN7?{#JKfQEhOv`deGdu}ut}!sY7H)XR#NS%Z
z1j<_=LC|(ENR+<)|35AAWh@g|K^R;CXlVQO-G+yt)$~~mX*;Dra~)~mYrkF}hnd0x
zn#tQa{ro~kQNzVBK~U-TdTPT%M*h~HjA>a45JxC5FuZO685f<_`2uuX#@*>cix?g1
zH-3afwH7F<1O78GytYZp5`gFtU|@JD`2X8Mrjlfcrj9(cFepaWtp|zsOKC3{|Nj5~
z(uon?QtFlyXGr^gx#2NSsU*}S6~?q3CPECJ3~Gyu7}8z{f_ge&hjnl>rl)~!zzI*|
z-*%`>G%X-4V*|K!=mn*?h_tAeFG1Z-mZJ@K85lZFH#}xa?}$-hoX)?PQM!I7I3*lZ
z>oyYyDe~Ic@RKK<e;VlOrSHwpIY4bBrV@6&^lk^X*S=}rkAXrJ!e@DHo7VZY`6)C1
zR8UQ0k@o!<Xw7H|JGe<uDwNjz%mK8s;eBFS=g)?plI5(eZ~3PjZn<6J05XmVR5vgR
zF_g%F)t88FcmS&RnHZ+8U(Be);qqE9y_@0n{_QsxGdeLcU3@oPb}6GlJv6Ia0%t0z
zv==77{{K(!c2TiQJNQ68?cfjjwB`pq>1n;GU!Y|bsN99*aZvfezs*4;ZPz9yCI*}P
zWm0Lo7#=Wydc)~m4F|q~ZeJ-8O53%OlL_1{X+ENn7X32e9a17@(nxzD_YRVZ<%80@
zoJBx2uUOhH6lXD|y_h%s-BL!CXqI=N&9)$O(hjG+IPn5pZk6z-?X+6~s>&{<86J2!
z<@@gmpC|nK1L|-{gBESP$ae=d&ZEKXWH1}FSSam9IGF7PTI%TMK0S9Cqj<d^WL)6z
z!Pjh{;=1{neOlu=Q0}+=$6n5r)_nRv8vnM#ucZ#Y;7Myf@c`UUd+`rce0APPYkpwQ
z(~$P!J(&9e6kac%x`7M?HFH5}DvB{}2gFIIL27nDoU|Xr?);F(zwJYPTIYw2T;D#X
zbskGk>vc1Lm_Hw)pyNSW^8u((4@hW-HP}lHAU6ND+i9IQAbJm{r}a8R6(+keFm(Jt
zXbc7^-r)h#7@ZdP(#;JXXI)}5zSmnE;%|At0CIC$pxUAt-ywm((Q){|YnHU;$Lwj%
z57<Fb#0>KY3)nn}M}D}1!WlHwmiFR}D+2>4K{B(K7^XoTdIKzP46^&h8IXJ$|27vD
zX1(;ThJd@E5_?<yfwUK!T^Sf!ZkOo6bS(z!0$t#e_F_7S&A;t1l9mH$FB(CjogZ2b
zlt{od<$;8D7=o=z0<&{L>?m-g1iPjo)wsvOV?gK9UbsE~Z}-3B5Ulm3wqV+Ki$f(G
zX)p9G7#LoQ!@JxI0~q>_s&$D?|88-p^dY!`tF~zB_q5Ir)9<cel(l#Pnn3`K_!wSF
zd-2(tfdOPGxI6wbIPJwLi0mbB)Pn2QwAh#Dt<^f@rkku}R8TqtO4OZ)H*`G%Un*27
z1}>y;x<JNZc+*}Sn_jk(QQqrVTIcn&&J$@bnjjjUq@?k0yYTH0V@c?fgpP{`Ub3cv
zCU7l3mg=Up{x1a&DZI|N`Bjo?^RHA2)ZM)YF4H!=nSOsIqlCqGFmJ*ea0cT6TWSfh
zv_v9pmjS4av;#C9oAyE+RAGQtzwxKN;QKROe-)#ur(AkRhzc{f56+yn<B9;NgRKWr
z2Wq>#76!TX#Wj%Gtp`eV(mH>Dy0stEz()att@`>8oRupCrq5Z$C_P<lHKUJJiE&zR
zT2LCOnCS&Auh{j8iGcw$lJFwJ7}Pj91Y);dDrE(gS4^P65^&4pa9Y^(nX4J)>W@4F
zwSEq#?E{s_U|X&_fkUxGA#Ile*h9}jiQ>iP*Z=>gy@+}B|9=`}E?1`Sm|B;Z9Yf2d
z3XZfF(|`T{|9XE~^P_sT4lz4OY$DQ6Ah=m@Ee(94N7@VjXP^co=&XtQ&iiQx|8t}@
zKj%*~e4DoG3o~T7yl#3LXsiDVPpD(~({_n~9m5a0dTt>@+6#41Yq#@7TIbQ%CssI=
z@Ta{v2%4V-9}fTWFhg4F+fuHyU0<0&cL}}bPVaKj`w!v1OHTtW3bg!Nb2yE^e%E7x
zA{m&wc0L6K#__a+zj@M{AA?-<S~%^+Zb-0~+<cvv_G07D|Njxr)C08|Uo3TmgxEuv
zBSE9<X)l^VVf8`>>?%;{_*y@$`GG^4<=q-?&^~Iv|7nH?<X=mJrV^b0r>FJ$GC~~q
zCcT42FRk<J>ltZL(--b!6c!0i>jY)M^fb^~fqmfW<Jh!yjN**Prc112RQ0=&_9E=x
z|NnhQH>s+1h&eETW+3@ro2I>Z>JM?*%GVlcjgJ{VFfxF;01S)_r4rzVY}yXcApmKJ
zu`t1ZP&?}(c3w?S>yA+YDHcfc1r4$sd?5ho5%6z6n#Ks~T?(Y9S+c0`x4vNjwdfmv
zKC574;GcRhJ*}6g7qsnc1KTsMG{XbWcsedTV@W&siX*KP!~lt;b-sAUn%4Q^;0umt
ztQ{wwafABT&l)!{J>!y2PwRGP(MwP3ZV&<W3PD9h=S^^1b;Wes^^Ey)@;5>G=iqa2
zUQ|c}NBnEHH1Jv+s3&+pt!z-%=nPTenf`h`qr5|j3P*Zcr-=%vWC8chInwwS|0vQ-
z?{ZP$02SJb>1n+_DvD{l*cllaps8^AUvS1Nv3R*_y5|N)Z7v@ERu?8vJ=!|GZUduc
zy@`ridPf^*y^dabS2H8HpX;I`2XcNl)cHTsvj21GrFYF=*$FPi4}!;8SU>}c@@c!i
zgVX6d5D)GEuR^c`TvS-nUfczZp@L4-1-VlW<W5;o#i3}=-}agzy*{mX`wGy|XIgLj
z0x%6acq2Wnw|x<eCj#Ovf$=2L_HF{PkGZJGGJ?h?Wz#KuROI+unnAs|P!Pdpaj3LR
zFTLCKM>=RRjDTKxx1i;rqGXWJFR+jZR470%E4|zG4<x1NrFRQk9xAfcOYe$hMEI-A
zMMWOuYOJ0EogEAs%Hx1|sZ1vQpNooYTJupZkbo>Fe{0PDv>l+Mw_kples3eAt{GUI
zv4kH?Gx1La4fwb)u%;b+%$CM^7}8~yP0RkqrI+444HO1?>D~Q{rkiYH)U8)s&jc=l
z71MTru3t=h@dlKoLC4fD`1{%&6u!`O(B-1S19GzxEJg4$fg^-PCG7<x=xU1A1Eu19
zpw6p_3P>9dEDgLY{hJ1E$ARZjKyATraATqQ4NqF9?%}i-?)M<&3}}G-VA{c#py7dw
z;M|>_20G#8ML#sUOQ!GN%qUauqQa7%*3F{=N*=7BQMV2k6}Gg_4<OgEgE}`HOrW8M
zU@lMtRSY~Z!wKr=aY_GAJNSqbB&x!a7Lc|RlsCbJ{5??V83pRTL+f4Gz$w^`htpp4
z-9<Q24yzllL4$zWZai869XD6SbR%etxcLnSsKNE(`W=u9L4)X^X$8wP{%x1i)4JVQ
z(q5=TUFHwwgEAqc3_19i36wfO-4IZqF@XauZ2H74pesMpUd#rigXpy8BOKr`LDXKL
z@rLVZooCa)>)_K~JOYOer~w(u{svSeDIQ7#FNcS;AN0T>{J;`Y^h%`d;sDoNpf&Mn
zFZMkGl~*VJzvf7LvGwEs|F3s~Ez^XI)$ngW0h;>)SFkVZ|ASLa=drXGEMOZUQ%;dv
z8C6(PEg2Z5H*RH=2d|Z1vXxP%{u;=m6QBchGe84$dg<M(z{70(+y8<qDtpkNd+P!I
zjz<jXU16+gkOlN<k_Xb7AACq_ei4ucT0{@(>O+^&r-9ee=cIS}v4Lw%(2z1H_tb)j
zSWr{Ol?5cmlAc!I>&gmZvVq!L;8pc$%|BF19n-tq*wex5>eIX2IMO<Qy-V+M<4o(k
z1){mqLCZ5)Kum6sBDQz01;8!^9dQmCQfqr{ncl?)l41fWVub2vg6ap2RD`I2_4BcS
zRI!0-ckpWaTiY1zI5vR1pWazAU12+;oP63&P=6jga>bK2Gwu7&H2&=eAjNPR|Mp|k
z1Gh7J*`$H)3QkXBG*JPym_UQ?0ZebedPLG*<UlHdO15;(Y_8XKX}%>AY2cOjY0W=4
zN*bo$+RhlOm<C?o3eI!_X)nU>fZ96UEGp^U8C;Ej|1*?ZO^?{Ys45CNpgzs=LmKF)
z76$M*I#037^!^=;2CCq(a27^*#2herErcO9{nie~QpWJ<0XrFG82P5>?qrl^^qSte
zlTmy6{q>COv0V-vplOD`4Uhivw^V_8RssJSeleEur$Od(Ky$pYFAv;8axO>Oi+Q&o
z9Ze1mP*KE_#(x4FKwRnIWxk*Y=1))S_MWczlTjCRY!+xZxO)R=1Q^L2k+c{3Aago%
zRK!6!O=<zCqs9c%&9s3F6i-Z`cnVPw0VS3fQqcTboyNcYJ!mND#T`)AZ#__&*>f!o
zGz@z184EZ(Ino%9rNQR`>zkkPr-2s&r*-~POaGh?Hu(+M1Z#*16&j$j0<;hq6d2)*
zZ(fT-0+OMWYXb*Z{kzw8D>zC8V7xT&(%;uw;3|#<lp8y5q`g=Ia$@H}xT4mRB^<B$
zuB3sN_kvv1d_)1%Rtq)$#{|m$kcmogcNa3~ZouCn!Boy`BTyn_qrl&?n&D+MlZ^v^
ziviQipy`^s7*!ajP50Zys9W!H3)Ifu=*YnEavLMa<QGMtjeDygZ29m1|G%6EVQ;ze
z|37$6n19;^kex4hKL7v!vJoP=9;C385tQd_m`m)+`C1N?c%>O$vSBJQe>s`aMgX*8
z7F1$1LrRS9381W!)?9yx{Y_f)g99Ch(srx@uikKYX~YQYgnUSQVg396|Ch4h*#M~4
zu5M6alh%1wFTER_;q=nG8^9@|`2aM|`5+;k20n;9?ZvjM|Nq0%K^pj^t+W?yS3$-3
z@p^Ffp9>m6Z9P!Rk@lkN<^TV$U#0PH{|A=2^c~z3tEf+FKE?(fq$=@+mCG(*BaUv^
zkk<L>9a!}isOrG9&QEV_Hk4?9(}q37^pb07yZ(S0kvl*)aHhSGz4ib9>**hNGm7f}
zgp7Scdb4RS?tc6K9~SkmrNLp!R4NHh8z0hM%y~B5cn_ly*LO_@hS#UkUQ}M2p1+4t
zjU^H^mp*e3qXCCy1V2OCi*FC6U);l}Sr2OrNTh-0$giiTfo?klRqZ_KT@Es!I-MER
zf(e#P@A8)DH~|_l0SPjucR7oK7)+qX2J^oY72x&~BSR@?+AhXc28NeML1Sqqpe>#Z
zjn5dE(>Skz%yCg+24y@xaDXUY`VX2}Jr0pzvi!k6`5=VNXnBZ#(gBVWrQ9He2VV$S
z9xLKV+r<c4t&*3<zyDhr|MvfB{Oi9%lrw>HBLDVFY5eOyfkb>%KqZU|-+yp%A&_PW
zDOg27?Gk6Ew1W>=K&)VaG{*W1U?q?Y&64(F`ft!+T8Ii?dPlHK!<l)Yd0$YLdk#w8
z%||4_^<zBJU_|p9NXT7F%lHZEnr4K6>eq}wP*lEPzYeNjk3jn7d>~HehqM<u7eR^Z
zU|Q$Z^t3qsZNW0>UCxrwu!ICEILK>Mm_P**$n(dGLEBG3GdkO9RG2N#7qeJiEtW{z
z#mEe4ogf?*`_kbGcovoeRMhcIKlq(dDm;yU``I-9^^itBQfPF7{F%nT9W_YMLZs-|
z|Nm*c416G)4uNy_iOXPLNlbsghf!{N<~~MVOI?Vf6ojH?h$0d2lsar7M)MmHa56g&
z3jP9)^gf2^>-I59FsF6?n0{;@V_|*9&;S3^`<Ou)luIqWGmNR>%wAX&Y`Fxs7Gxs0
zwg4{{=scVT9liz4OfKqUNbho%wGrWO@n9^^vf<!wkz*`303F51z*sI~!^q#VkHLnC
zzvUHpcr*HCpAP7F#!n13to*IpnbPVzZ=^-PEdFc5%ir>yp<L94lfUH|L)tC|e?|ry
z9{!eIrk9hLYy?1?t<!cfWHU0@2=cd7Fukm0vT@~aQD!VRw{hZc5n?QtvJvBNInQ9@
z$lvmi!A6w7H5yzHN57QNP6KZMwQ=TeJ<6B{-j?!m52K9-f6G3`@_Lc9ouJd?Y~1);
zS1^JCJNl*4V;fKYmZOX|e*7&r7+(rAr8iWIFjR2#9aLN3$ncsCM3*q6cR0(YcL%Gq
z900A#I>iVY`+M{+y)#(l<x56LQ{y!o#5#zvk-s4hdHn&x@4T3{i=p0wk>TYk#<X1w
zVT=qf7eZao_BU-8LlGmx%L$;OcOoML*aiF@jf`o#*rqTtysThMKkh6Lx+?v+vjjUR
zxaKl~!}kTtMNs|iENk#G73zqWml!}9)LA5L7ia*$=01O$6=Ql=uuQ`*#uB%B(7u4$
zmP`Dt(?Q0-My4l#My4Bn{V(MMEp}l{+qLB&Bg0E(#xy6j^bW8jRGi@$Bg4zr7+PB{
zL3A>t?b>jWk>TY@hBPmj&X!B*{8OD}(snUiXJn{<xgJ?FbVMAc;2|T!%YKHwgP_G5
zB@F4uoMjo)o4r*SUv`0g8~t+LA5gmHPCNKe0K{+xE$K>oQ4h-ZybM~PA@xJA{nK_a
z7&C!`@P3&SSU<=lw%2ayUCz^!4l!CNznp&_5+|!Jf^tvGr3&+gU;O3SpiTv-k`$Sm
zF#W(G#t`2G=t5WKmz96gb}`;$Vt6Tb{-xT*v={eJf-5G_IJ^3B&=4GWoPG6;-(SF^
z?6CX@D)O&^X24!NcrZQjFrzh(M#Iksr5tHHKsQlLUw4>MOkAb$r~ZQyiH4saN+r|4
zN6CT?STCD?^)O?oOIk((xVVE%#YSHE|357vEehoN7YP?YO-=r7!6G1T^vlqHkU7`%
zt^g6p;<xmM3R&+`+vx@W8O7>v_1*rwr0-UGLxl`ODOcZN(Bgs)v8~_Jb}?*Wf{ftB
zznpTm@32}I-`4LfCrixKy7;zzw>VWQ4_X=*(FHP1tPDD1{Id2uq@;ei`&YxS`{kTz
zh8G)tHZ<H~00kmcYV%)6mD+b;!+&SBMSTn}73CprOndSBI3xf?({{3+gasf}-@$7z
zeQFE&7(h$IG(g6ln9h5Q(Ht~XbvW%sz7hkZDB|L8X<#T<vtcUnE$2%!JP8_XYh_3?
zJo&o9hP5QnhLgW_J18y57`$B1U?WsgS}tfKP!g5~z5vfguq5i`3<jHg{+2cdn@Rkw
zJs_pB4KG_5(q2S@`t9&lmg1lyK<0Ih6*%Qdq`lBP{{Mf=fpq>U&N8pVAyM%05yV(X
z1L`$1xXl16@udEyz2Lq#{rhu9Ghs+K54w~t?M2$L|Np0l9b?p~FXl+^1Fxw04_d&J
z*6C)Ewu65*lx>rqcAQy)L4hItxU-T0I6u5lJ@)^<8b4zQhZ;X)i~zsFfwblmjQmOm
zUVS-b!LUPvq3=fD1#pnUy8E4n)1c#tY76Il2MvN8VFs7y{N>_l)1^-_iqtP<1{Lbx
z8O!BC#kc`uIR_{}MHye~g9>?lMjJN%mH@_=b<8&W{4I9O<@}%`{3@djAAd_T)5~;b
z8-M;5N9LDt;2O3XG-|wH*7ueJrJ-q^Khv5Yf*X9z52|dS-JKh0%?AQNg^K~C4W`<6
z2(<j7Q!W5BXV$^z$<TKQG<c`B*o&d>&;|*$MJ)_{ho)aT#b{W6QW-S2k_>7Tyx0q7
zLne|og4vMym!)7f=!oC67c;?ZbFlheFgpj#ZUnJGYZLi9YMEYcVMy<GmVmehw3Ic0
z;bl5#=wMqgsCBc=S@h*EMzCx>$b}0NKr0X>(q4ET{r?}d60q-(+QI-(QW1G+$dvZN
zSPV4hQ!T?#nx5WJEy=*&Dh;Y%BpCQxg&?Mi!qfVK7KStjkZ038(ku`0w|-;<mE^%9
za0Ls!K-u5`R66t$Sl(GM?L{?ca0EPY^3wKp+78f}OKC6GfDZPBEXVi^PSxz`$D9Qf
zUe0Dr?=F@A8SN|sT42WmVg`d|mtWd4+Dwl;!>F4bdIXfVOC=$`X*p2JpZ3B@lmSw;
z2)s=FpZ3BS&P{u9<@W#ot=~#Oh4MCMnY0&sK)o8j*Kgo1?-mPSNPF@BFnDzW(mc=0
zzqh7;Ji{noe;OinAkFa7>)5m%pgJ0ya^qhvS4?}cP6QOwpgD`a18UuJ0Sqm-`CBG4
zr0oDN4|>t0$iR^1o%W&)WJu@nH2!Uu!NK^VSAv0|?-*q10ca`E^zW~s>q}miKwFwG
za}3gUGV+5Gg5f2ol}~O@pLdpVo>Tn^(DVmr06wkrILKzbIp15~^0zpF8o#luX`Q#;
z{5!zkV$7KKqEr}EhJ6DGtzhJD>0?OieD$X9`1I;?jB@pEug|M>@wI#hwfdR=o#1ad
z#nA9mx+Fer7ihK|6#PD*DZg%}H2!TjEKl>dY-7+%?{<Q4Z}PV+2Xk4#vN!o#W-z2R
zAL2-B{N?e0fuZy`Y+cOjga7~c9S5zgZaGle|FV@KZO4K;AXnAj)=TdSVCg%q*2UNO
z-QrZSSsMSgQ{eR>ENO;s)6*<-R9N`?CV<9)eOMX#j;Fb*rFTsQufOKscM@EnTV5==
zp5~m^e1IdZ`L|f<x-`(-B7ckR|JU-MQCVhb{#L{PuU~?Sl>GmoftIuvQx5$9|1#-+
z+AdZ2Di*G^7ZIR*a@<8l545!5{Xfv)`1VU_FP>ePe*8S6a=r6`|Nr&UyIAfn0XZEs
z4dC#S12Qrew5h-20%!&h)RJcgO$~#%X@<8uZagbY3roxB0Cx!zKov`5T13Z<XS~mD
zZ8-4kTE~rNSHO<sD)B8B2eVj9Y|C}Q9ji1C8|Lz$*9u@^ZuSx@Fk`yIMMe?fu(XVm
z*Fn<`FOU8IpZ20(jDcZ#`b9=Xi4T33()KWbX7qN+$MZA1v|t2Jv&BtcaFJ1zV?Nj&
z3y)3Tdy!F398}ytNlE*DVTEFeKw8E|uw=}!>717slcaLL{RgdyjeFTH`XptA0!YDS
zu!8&3TQ4yx3Pzm&4_XD7wgYtWW!j7F$EI(;#Aqi|(XGeNC}z^luW&G}5p?i~d>ZJu
zE~SHMuk5D_US?GHsJbk{uoE=x+;_9@VBf{QhkY;8UR7PzU;t@pe)x}H>ENr*%M2g%
z_!;FIx(!c)6!abJyV-X!?f;{+P|)JvzFT}552iO<W}L3}>rdJ)-z)qKFVFu&InJOP
zeAdB>;6Bifw;9tNt}x0nRsWfO@Cu{U^vWxY+#)uX{GeWH2#-$MPSDwaX)i3#OrLRu
z(Vy|)^cPncofw&>YhPuwVq7{s?JA=Q%N}6{hUxRJGMag1f|qICk!MefPm4>7O^Z&8
zN{dX3I6p@(?Y~(_*RMZvX#vnByf@N1AEad%UIVXgwtP@3(_lCAJ3|RiT7-OB2IJ}N
z%GVg(80~^iFfhCf{hyZM^qhg=<^F$Z8Pb<PgD(FJFM%Vo0JPkyCyAforO$6<p#+eS
z<@Q6@8BLg`|G3GxWcz|!jQd%oI=UJ7Te-d<E42VA?ff)d@Cl=E{nfP2)8HAjAK=yb
zkWO&geo$co%A}>=L8+K4t@*(p@Q~Fx1Ly!hH+Z&!J8ee-D0#g&v;*8s;%_~}nD!#-
zI4Fmwb$(D=RQf#~eAFf=4ReEfBoFR`dL$3tgN)?{jn9UtzzwMb8Pa(SbUANp0%Ka|
zi+=}7J=1oAu0l=Q1v>K{I`Q@I6x1>c#<ZOa_(5gIC8(4hRH{RkF};I1t??-X9|HrZ
zC-%BBt?}<CCI$xn)+r2WJ3$9(r0x0y+C>Z1xeBVY^$A1T&M%;i$A&ONZ$TQ-{2eD5
zK!!H|NT^pxYyRO@&ym*rL%Y=ewOm^B3wKas%7G~jbmO7!Yo0XS)u6Jv`3GaUJi2*Z
z5c4Xk(>v;&8DCeVA9H48cwGn@1p*D4fgJ~Rl_<njrGaS&|MH~ymP&(4VPS~-p-MhM
zOe+QT2y#?d(irciS-vh&Mz>T9qO5`)<OS!~x6?Y0^&L;I?{ZP$f<#kqhzb`hI=^oN
zhj1w~Xs8c$;bw-{4+e&pGd`z**69SK1*QeD$@N_5yO9=>#=reZ+KcUb|Nl>mk!Ocy
z1ZX=t2-2WS>--LypO>5ZU2VaX?=81W>J=b0U^A%X0<W+vJo^8C-!ZiX)4!)Vs4bfQ
zJ?+KLb)Y7TiwZNMng%tyj)7Krq+7VCFqg2k+%DmLEdkPGak%u;%SHx}3DdrVWs8+T
z6)h;-Kt{Z%0-Fy?kIZU|rqx5M+dz=smIEciuvUpB52#88E$#RY$_LZFr(3zGFc(Wf
z7LKO9kOave2RQ-c%xT|W-vnD$It5}-X;0s=4eV-*rhEqvM@;<=DR|T3(+<zs&@lJ(
zgqQ7~LAw>Fvp!+eRb0blqgpBoj!(#XBhbz}1<?KkdC;=em-*9!pD?=BgQooQ81>S-
z!WbKV<&+AfH6LTrOYag(10SRLnmG-+Ew7)U-T}NRZvkVy7<fzG3&u3?j=Z!N)7Sq0
z|MER!1876uW`+jPcD&P|W`Z|pBy1mZ+KV!fg42xP{dkiY>&?Nt@m7G8SXP7P`=rx$
zfXeH%7k+C&tq#zhytEfiAhzMjH1H0%w9XqZWf(!5^2|V+^88<BPj`RHsLaSPJ^Lx6
zl4|s(|Nmc_f?Y5L)MmZ}Udo!D)-4Pkb7V>D{MmAH`o^b>mf|n!*8KmU=K1;~c%Ct>
z^A)K3@?!dQ#%GLn3NJKKC2xVJLs-&Y*slW(tNosy`ixP9>DlV(-Om_R?f0*SEnx-i
zOiX*Rel@69+HIl&3bxbfX}xZY;1vWfT|u*?kj*OK*{`#brzgBzH~q^qMtAm1P|{!W
ze%b{_ef_DRR0&(=n)CtIKv3TG|9`_{2mY2W2EDX}D&1+V2TF|6cIZrxyTB+erqj*9
zP$C3cAZd6hZHF)uXaH7g=k)FijP~)VtN;Ih&7G!uk(q%(Ep71}2FPsfO9qAw3eOfi
zQ%F0UmQj9^f#K!)ckngG;3YO)4zi#Dtv%oYt)C2#eh@gMZU}-F+Z+eAb~vU#JHZ&n
zRJD4#-AP9E`oNXo3|_*O*8I&Qt@#`yXy(s)|NsB5&!%;Lcn#^fYk;*MYdugBm7dlc
z#`Gqw^LSeGgWvDKF$NnpX9I<7=a01J6QJZFq5_&j31fUM1a`qw0nl;!B~qX{AI3Ln
z%^y6#160!=oMaTQhwLvpoR%>kRK=Zq1NT<*8}N=6@J_tG18QjtH+%<IOd{!BuHb2K
z3AMCtz8&Aw)4EG}($l(Y1wiFg=dU#WH5ZuDK>ME<Poy=2MwmKXR6x6BLR1t$-QiHK
zw9bp^$6dJ?K#@})(*=(5wB~2bpj`~D|4Z4^K<5YCVgRQ^9&po>12knV1)X9CyFvgw
z=_8Q#q8~I6*?AaTUrlBNI|k&A<_FB1S<*BQgI1P;8pEKu_z)Ey(B46A@ca!2sDaIr
zZVg^T$C9RbDDB__PO#A&V7DB6#+jZ5x`deVAINhIX`MfzyLCXDp<lA3b)J~s`H)eu
z9#p8ssIa6n#&V^nHM^+DfcC3|s3<Ui*2RIY%q{?XgeC3ZZ>IFl7!|4Xv~E|B=Ui0a
zp4b2$ggy+KR+LIR_<$*$(UmK$^)`R&a?m=H5ET}%S&u<mhtgC*XLLdw%jn8*p#Bx8
z>3=CbjWGli%FSS#TW^=-;|?-s&_G~XCusFZ>wyx`7N!^#me+PrZ~lO63jr5|AZ8l>
zw$o_`AA&-|L<O|L4zwbx=T_eh&<If)zxcM>Ag{mP1xjkoM^qr)qO{oQTUIeTu(*Bs
z|9|?ARg7}>83*4pFuY`Vm6o9ZYF)Lw0=0D^%hN!4hlRgIm9g9xG>$Nd0W^AWilOB|
zX*j5b!kqSE&F<;@UNRa<zhtyw=WjW}Sk4I=BTi?0$-`)~o4@5A<I8K)xnD6F)X!r~
zd!e-toUQm<XE1JPfb;>JMK?4-SrQvsK&*~K=^f6J8@fU4wB`ql=^f4@FT)wrUc3QS
zovomO+ZPIg3=AL>K(i~)3PC2McR5QuD+HMUnk9HvxUswA1jvN+u3!<+UR=;>--I;I
zLut*Ym|ji?ccdB8Ud)0R$=}K`{lhCp6VWpaX)humVkMkuFM2?$wD(W9e9fqD0W&bI
z`9XchA&}u67hY#Vo!NOT{kXFX1H%f1(u}khZ})(`S;Cg~LQ!D)yw{9Iyz(&ZAg$AH
zzh=~%&OedSm*x1v|No~aOk^~zPs{iM3Vo*MX&Em-`TgfJa5O-M9(OTRGBTvSII;}1
zDbYbBt@%L1CPth1a$``2dSSO1RH9!@<KKP(yiJaO{YCH;qemM5`U~LJ>kEPOPG^bq
z&R~&E%;_D$vf!j}c!L6{*aX$H3=GrHzGq}-H-Evv@RIxa^xN+l1FiTMfxQ8m&tu;4
z|NrZ&U|sQPhtH>hcZ$A91=*{41C+t%gH{h801d;Q^*Vii`p-R#in8u!{{L?{a}G8y
zv0y2DUgB`tgo%t1)Bk*6<gVucErSH5vv&TLG{$l*n_y5+xm*}D0%gZ)6U5)Lj>Sf$
zB=n^YE9khbc?>pf{4MVpUdpoC9OQ4QXDZjRnOM$m)6d_Y&uY`b-{Q*jl8M#k0DtQr
z7RV0Mv>jicfj5{6yi8%SImF)*$7J(@za@+1<t>)<t`uh(8>SM?a?X|mr6Qmvg{TcP
zf9pYzUIAu?m&Poxe!1TK|NmdAusoS`;RQ5R%Dfb1fn+Vn+7r;W)L$&=UCuHs2TFKt
z7)veEUi2>f|NrHs>90OAD(RnJ4h~QLmSrq2U06V)*=^u)?KDuKFY|IL3ur2em7xc;
zV%<lDb$Y-jM%nsih^7(_koxAAznDQCTUG}CRxg&c7wfM4|Nr_O%!QHjpbbG#S?<gM
zB8!>QI=`kJe8!T-cnnmA^Dp@>0N&Zud`>^D@jSz12GD}v^t8?b4$yA53Ld?*ZnKW=
zv|XT6=F@gEFx2-mr1_O_LIn&@g4P6|Pis668qiGZ{F}B9q!6UFKmkN%s37M4QS9Tq
zmc|Lv2eJ{Qus{PuR_LS|eoOE6mPqUTu9nWv7{CGQ$X0YC#z2`~MNcpN%&4W<^_k(r
z=cTWoffO`!gId&}(%nUc`6b^!(7<-X^aGz6AFzWqY=@|@PGA0oQC1JiN!#%Pl#e%n
zyRa&(X*)puoU|8jw?m?%brA!oxyw5J(-%ftD@0UI04>1^0jYlpy4LGO8$^AnEm(DW
zhqC~P!Is|PECFJ$PtW|yD9hxzeR{`NM$LLXK2XRmP-g%&3OKKo%CsD)1eHPcAU>#d
z^A*(pc>(H4yk<{pKG6Ugn*!}9R9mDD(wWw2rUV`yhOKM@r7qFgpwwl<Si)wbP~!YL
zRWEH}Lwy?P?kdJI&{{#zu^|6J3#-zm8+>EbW^9=r^NrDtal!Q2-x%E)Ii^b=VGL&C
zx-h-q2%`t1_Vk@czy};WKf-7w6?c<?;Wb-YMlpEYV$%Z948?14y|jfX)2)v(1{-7?
z0&T;RxR;jUv4DZ$<(zvjZ@y2<hz7AI+<RI6ui;N8e@n&Pw2VI=7#LpG-kbj57^6PZ
z&w0}Yk297sHO-seahx$$;_M7?n3oo&y*Rk;|NqzE37i+a^QQkj&KRj41Ca&wgU>a9
zT3lWrHJ}z(dWW;@YZXvtd(k_0dhH2DGXuyrY^E}N+pt|2I6!BGf%jo=&-um3&cda6
zJuM^Y4Fki=jOn%i7`5bHoMT{kx%zrqFt|(u_u4_bVL|J$U%X#C{pdeN4ROIqXJt-<
z!WL3gg2=QN4<}7$`OoO9FMaxaT1Fly96CX!1VS76J3zZ%(q4psy!66$3aEfS3_g4y
zcP*n_(vlC5aNtOLF>wWWsRVfW5op=>3r?_>a!{9{^+2g&8u%nOn8Uy;e_vdOO0uMR
cmp)AcE&V_ID*6G#2Lm&GBV&C_ONKuT0BJ{sUH||9

diff --git a/pc-bios/vgabios-ati.bin b/pc-bios/vgabios-ati.bin
index e10cd263b8112d25e533df1c3c9771cfdb0a6ddf..011359e7c853b40727c706f1b12a0bd8c7ba7c71 100644
GIT binary patch
delta 14751
zcmZqJ!ql*ZNh)-e@5}X}6%6P=X68nzmyGr2X0~1`VSIOpiJ|2{iT1w}X*(Dk7#K<{
z()hPuO5@*tGL3)z#k7OJnA18h%t>SYFVDa*SC!$xAtna?^{3K0Ps~ZX_#ln-KRa0X
z#~~($Lre^5p=q5@)56k%(>f2Qr*)Tdq<6XUq#b-L05+5JR+{1MzQby1onkzUX~vzO
z8-6pE@HYHrF5zjpUBb0N@-^EAzSm3}w9|GuFfcIm9ZK_1Ths!g`L~@^>*Q-?m>eJ_
zHu*LaFSE7pht2PpWEpwWI-m7i=sS?MgQ1;)VX_2^wt`4n^ACX%v9$dh3=9luyFuh@
zk+l7+3=9mf+0yp2P0nX2Wo9n@F!>dW5+}Fohx9c5^{#IwOS7sW@d8+7Ii3`ywO-<H
z*)X}3Rla_98vnKf>1my=Ytotzu%{jT!3^STNKfnb=SWZE-|o%_HfIA!bVYhvcRUMN
zR3MFi{oypm6X|Kpt}D_ykIhMAyf!zz%bmxDnZHGh$%ci$Whavj6MxGp#-0mlov-Jl
zH6PwGH$AO0c20U)ckG6=&YN@64nAbApPR<N{Xp8m2P`0y=A?Cg3V7l2H_Z_2qy_0|
z-L4?@3?SQ=q&L*g<}Z-|Q355BX*)n6ke+tjbq$E|T0CtBG$?kkF)%QIB|rjc`xrst
z)%hvC%XdxM<wt3qmqCvC4|dE7_l|>Um!GBirCt0Da@-V<<JP2g9-NcLcylhu`Xy<X
zU!<ogyRMj%mVJPEF36Qr(q^WoeXm^sNeiw^Kn72K%BEPq1ee0r+a-o+t=~#a(pnFc
z=%+RRW-8@NYyQVns-4#SgQ-;YwRD;{|I~wN2OlzR;z-*Ka`0=ZG{Z}2h9_SOf$7_?
zIbbpyS<*O9rCHwKpL!sT^H7@QJrLvKgEY?iLm&q)Nbd+?7fMh2?+OaO(hccpjHPqZ
z)0%4+aPYTI{`az+F|G6EoV4bHTjr)2-cC>J^j(pj#=k8@UI?UnO~8xJKj~@RAi++?
zH0Sg*X5S5I&A&NHul8I3iEjYK8Z6GzIuFfBV|<m?d}zzuw9fhu0Wb1@zZ7Q#nHLT-
z&iYSU=fSkjS92h$pt07;1q$g6X^gkhJW4;L9em8(a{;@lH`6*l1iTRc4N7+YQlP}>
zyCF^UW?JWsIcba^=7Lkq&tITGs|Uq8|8{qoG|R*My%QObb)=_tyR$&j><6%x<G<3J
zUta(zahHRLL(?+jA+VqfD9Nn>G3&vW)^13%{8TIg4x=;=h>l}vjEB;`-v$Nl8io=@
z#k9_!>1myz8^A73|COHh-*-(K<Gu8>?og0VUtgbW&1uBZa<WpQ`5#B=<Wf!-o=)E<
zpit#W?{xhz`3R>M$BDFq54cqs6ede@sc@xr*FH(Nto>ACJlTy)gPS?_O?q0h>kEa~
zhbGr>^~%Vl?O<VGU}*ToT%w+~gNcEGq2*GEY}yV``k5@pt-u_X7ChONTd6)*ty`>>
zq4^g_S@KE=h0-`sj5I%#Klp+pt@(j{nnN1@_D^Y@r$AA}I5&-d{k62t%V`IHGpBXl
z0*U>bn`U{iL@<qi{V`Ah0gm<NL;vTdbzV$6_>cpt>i^s{{%x1iI4=gg;P{``c_^*(
zgu#Kd<`Z1+C%@z7t&dKNON)gUrNL>P2LoQ*_?OmsXoK*(G^aNmhtoPw1iX0s59Buf
zZHLniK44CpnfCo>S~QZja7Y<^JmAG#kirc-X`QFu!Cn5Q<M0MvRFSmKV`-f~0$y~>
zgVd)%4CYAd{G7(W?Q<IEhqQwan84OdUZ^Z))Nwd%*DYoShBs-u4uGl7;~h8NrR_Qh
z;vghDe?a8lb=;V2C@L~JfY*xe7>drx^LWL$J5Ho=-hil_yq8z9J~(aHab^aFcWJv$
zg3L?f-*)0n$Kf|={M#;c+)F$7P#~@ILYnIT{|x`rI8R{lc5qtf@wCp%;Q9wtnz(hG
z0A=3~pfZUgt@C4=<_S<?9`K?c9Q+4g3G^LTOYaa)<KK3r@3@+8dPguLSj3qrt@$u>
znja|TeR#b!Eg}sRIq^v042mATw1qj*dTHHa1<{~l%P1}T5?@;5p@wJ%hO`|GlmGB*
z2sETKFo0`7%ZsHPX{=3?O#~F#g7wn6`64C<h>F%9C=~*6QlcSgGVSt%G|t0mt(PFe
z2`IvPX$vzz*74;;r*)o6v;EJ&z);QwPHT*(=Dy}mdk>9gmbq!2H`3mt1Q4jGJP`0A
z_dlqx1gHOi7YYA$K|I3)X|XRuK_Q}--o?>!vP1>qn1-LsCGvXdT|sPV{M!yS{Nk9*
zD&`*u%JmzNiy~0X_AagY*p|6^Y29{Dia=G<F&EY?3~3H&%|9GUKY<HT>(~v&(vTwQ
z$K14?pjsYW%1rw_d4-q})23gO?}+I#HUFB-Ev}<^0Tj;%AF!)3Fs2=R#N7CZfhmm>
zR1|FseLE+O@j_bj0Z=a7eqeHfxDMmT$-Uy1ri#BHO%O;12u|At%Ht4^1iT3Q3-Tz`
z+n!*K;emh`_LF~$%PYzMP3yb`Qz-=IfFwEorZvA~EIt|VqG_^?goMk}Kd5G2{X<HG
zyah#b%;atfS;m&hD<!0@_?t`q2fTRpr{_f9fwayaYUv$q4+<F=(%jM-|1~f$Fz~l}
zgX0S16q`Rt&exy(M?ykh3{+{%Nozh}FgLCFCuf;BxLwwKAbf6G>!lJ-D9?Ou8vnin
zFW0@F>@0b{9#qR*3wV+8J*^W`mXv=7msp(#(+>XNN;~*~Bdz%aPg>`#_i3Fc(hmM$
zf(r41k`h|kbUEOKB}n&Sa8sc9Ap6{a7u??=g&MdBgqS7_(h4oq>N}sNL1Kr0+bvi_
zPpw<biy@7F+efu-J|9q40X06)fpTdY<AF5BgW$}=zy5L><0Wuwl<~w|q`cVhlfAqS
zIo|oV-AwDe1}X-2fRb3>0ks853>G&^jXG|od4r0%ivQqpHR&7Nshm(>@_~JQ@duR4
z|2_?BMB2e;9BG|D()hRiNaOscmfl$+9WdFRQ*!bbDH%TY@9Als&Me>x&FK4NIq3+E
zr!3{XHjMl&tV}k{B~mXJvf8lmx6Wow>%7sM_66qnmwX>4&yzObJIm1Ui-o_%iLv1q
zQ%Tn3JJJ@cJJ}f+7$(ceD2m=lb4zRf$5OiHr4nPB;Ww})cP0nP_|%_ffbm=Zff^Ie
zLZIU9@{hFU2aIXoZ-8p$YET7T`yxH9yP73Et+Vz?dUvqY!B@=bY2CFSKmu<-VGF97
zUoey?r|oB0@c)0`@wCp1AO&weuL4!hAl;z)m(lml>#I=5biVda7fs{eUJPm#d`x3J
zmS*@LT!Z|XtS76@bouq<Xjyf}#gm(5wJkvH>$J{O7hgfF;$I*7BCYfIoHWMkpvGnG
zhxD#so`zq{{4JV{;9z(G3I_g`uE}p?WlT-`4uBdHAJo#j1kwx-r15Y2lm-r)G|hu)
zouAS!|4M6q#F*X@!Yl+XYB)+CynH{|LCzv%8&ktW#uCo-v_{tt3<{t|Pjl@X#!_2Q
zm>C{O?*i#)e#D3{?ee2E&TBA3(snTH`2QbldF+R@&JSwo9n3G2C!d!y<EZ_hmfp$!
zQgt$~ysb0;`p`F^)(oh968ZsD-$<wJ2WveJsyCjbbzc9x3RH(MhrW3IAU&-+SOyjl
z-Nm3NDSa_{g1nmIK9C-8hogkC?-)qyo3zgRpI4=MrKd5+zIgp)@>O{w32;ybq;-A-
zHI_br+{nNX@IvP0WF-Y_KB(jlh8+wHFAq=7Q&3~9m^@X%!6F5e5}ZLP!SzFWm$MLv
z8!ZKj^bZUr?ubag33e<f%0HwretLaxvXG)W8~2N}<|90l6<K8JH9+khXx~h&TWk*l
zsDISRkk)w~)PCUKehCy17t%Xi&!=_102NDD<_5gT`w6Otnjic~?{s~X4oZQ?TputZ
zDcJKft@$x~TIYwB1L<A9=PRW^e!HNT-sQw*!(Pq<O47{_>(h;VWM!YFclgLYOF!oN
zfC<TfnxARSM>HlIii%F|Q)5>~bzq4DsGI|JX*<DAx-mE4#mULmN(utvV0+WMTx4Ip
zW==CaFiBmy-XU!_xWqWD)@|3ykltB)2$bN!#gpYV{^lPH&Hn}X+dndNoCcR1U=u-}
zbo~Kx6l2=KXUyrHrH?=jsC54Iu7^Oi-Z9rb4C$S&PtvVp4;8y0xx4;Hn&C-MMcEa?
z`>f?si9lNYeo&#GcKLrA=a2M`&^>96Y0W=5O7Ew4xX2y>WrHVa4r$J>H>DZgPV2l8
z@FM69C@MjY+<qbL;0uAY&SU94p$DLL906r7*BxoC|4Yo%`&_~KXop&Q7e~j5zGG_X
zU0mrMzT4BST(_6-ra7lI{$^lQVqhp;{#rE6AJi|}k>>RJ2-qiGse8a7l-7L2Ve&#{
z>3aTcw>nNi>hHdTYTagD43?kyn++J#J3=pj+>pk<&6NYx=sFYdV&-d5K@17}E0BH&
z^LJ2BCcQKEQF@>28E~UJjeq+gP^01us2p>>z`y<wD9Av8lh)~aA-$oNhoMqjFTKkR
zlqTx=(i>8F>Op<i3*ZVK6dXT50RS@ML>mA0|LJL#v1j=E<}sxAxt>r<?_!Y$B~inZ
zphSOxp%m1Z`S98a5@|5E1-!WR4HP3gAd&C`RJ?$i>a7<*T}M!Ps_e>>Zs5Y}{0tf~
zS6{27?SiQOmDc)+f9j#M@3+#^ltX#aJ3@G2s_uZSK~AtG-_o2Xzfw`FPwTv%-r@Tp
zy^A5e!}W7|S1@CGmp2ov%2De!+r!ZMtt2UpfBQGR^e(oR10~YwU9KO}0@A`eE~a;d
zeg;<tj{njk(xP5lr+2x24tTNVOIqh4z4UH3uJndl4u%qGa2e(bYQl4*b^c7_-}W<&
z^SD}ir`2mVPH?MZ@?=$i^8x`-$U6uIyjc7m6pEm6k?oZdpu{7c<_}F#ALgcIF{E{V
z?6?*1;^n`zh}RD$E3!yA2c>l$Oz(=20hxd>#|^(Zj8JoWAm%L8lA1h0ja3NLAp&Qs
z8=!vD&43rqlb5T7Ge%ARucluA1~i_O-r@Q&y~|Y~y(?BEy(9J$BFoC{VQ9V0-!cW%
zg7~bL-X+&^yF|R>Vp`{~w9XHpQVd@23jbH@mIF08w%<-;1oiG?U!?73U}s=RZ>asm
zP{Ix>GY&omSNP4R71BFnKY{#a8~YJN)xJq%{2%Zl<`X2K%ec}mg1lP$Cav{$i6p%6
zzMkIg`swrPH1G5@P}%=z@<x5p$z5t(Ldb;&s5rXuY4Qp+waEq=ER)SOjG111nxrln
z9iHA5%aPs@`#HTUmIvfbP=7`M;a9so46Xl5DnMynFTG2?<#vf=dRk|xK*z<7L!fp_
z9Ne!`D1Hrip*i`LhMdMHuxij?4iCsrv7e#gz>yXW*UA1MEn@OQWl2#`UJiYe-W4GM
zc1c%+WO_&J<T%X?JKxV~ny1s8(^|jr_Z?$MYrW0iw;wd3u&qKS&GL6WbDH6Q&{#z6
z8+cQ%i!X^Gy~{x`y~Fj*WNt0_`VQZZproAM<@zb$Mc_YBJc0P2F^??9^e)#opyZww
zmfq$2@wFXTrt?Rd=ApFkG{)a)!D(UXU;{v!MZlWV;JP}0q<z1U768!;(h0Gn`cGQ(
z5dl~;Z1PGiN8!%HX`Zhir>F7nV{AE4!V&PI@$TfmS}~04CP!)8GrpfZOIwO9={HE*
zWJMN{$>+2swKl&5Ws@J!obdycGeFsb?|)i!dYA97^sdmK>0Pcr0$#*T7Sxfc=K&3a
z9drE*^1DcShwJ<FE@#p74%c_-UEYG}-PIDHlH8dmy(?HCy(9E(>;LqwV43ue&^IL&
zY5wVb&P<>NP<lt`Yw##y^D)M`>EB%6FqH_YrFR8@3f{L+38uN}U9RubJ3v*v>pO5}
z>G1u8oP!zDyL{iKcZI$Vc;WRgEdo@cKpf=y5#k`<PidVWUe^3?c*IyDmfjWm4rC%M
zyyDYhUzWZF<@*$9Pdlyi1gO2j0UGD*aQ%?hda}eF)Pe3|29;`R>0Qo@=^d`0Kny03
zdqBNvkforG_^uO(u0E*z0$KG5M0|Xg=J|RHB>hc}72v7|wN`!Kq;;NN!N}jTk136R
z*8>jzW^=}X7a@;9HO#IfpwWW#KG2A6cj+6o^bWSP&R=gp0&3|UZj5QW&cPIb_)I7R
z5g_Gm%xSw$fs}xxSwIy5XpkG+$=r2>xgI<saTFvEG7{8A0cmpKVg=U)ETxw~ty8cg
z-lgq=s7r&m!;KSc*l*ByD&yRa6KS2l-lcWk0y_<qtHI{*ae>W|EWHm_d?Mh5<rAny
zV9(^a@F{~;h?G7`Gd$UG0^*-{X}iuNxe2V)h0h$UlC$)tT6$-lLz>|Mke8f5gfob6
z0THh0Y5coVUvTm_r!s=91UnsSqwAZ=7X{_&Z-AN{Z`9Je9KhY9_fT$kghSd6LGWnt
zt@j|U%|8W8+0u3jfyR>|;qMC4<-!5!PI8_A_a;GY8OhR1X}ivV9NhT(3N!zdLut(q
z{-tqVNZWM?ln$U4bU8?a`d?;g%_juGS`EL!9j2Dv6=I+a9zp{Rc)C6YcSuA^@4;0}
zULYh<59g_+ce!wwgNy@>7J<{iduZs~hFQmu2KM|r7~g?0t@9Rw#{>;(xHJoND35I}
zL{VDjVNl$<fk(n$q%}Wanrtd8!1!UZo3H}ohso)}YHFY^gR@ea;eoybYH8hKHK2CM
z2etIH&R`Xg$U+`Qkc%g87S>_>F!_P7ru&DU8-2GvFX_7h5?4#_c2-K;4{n+sS6jS`
zAx-r^BdFzn;ZfglwZ(fFAd1qugH@nbbV99|93Wy`5AM9AfwLMo(W#|(I5Vd0ItGdd
zh|UgYCa9l4WB2^qT|cB{FfcMOq#2$Jcyab&S`<hbBpo#~GlTk4;Ivb02NDNoY>087
zbPXB`MKOgBV$7jmX%QghlLbU2n6+KsOkSuZQ4bnX1&<}B@o&HJ2AqXJLyGUx81JQ7
z-m6OmwLb%1ym<g>ZXbLlkOpdxWnc15<KK2BE%W4bP$FbJ1s*8KJ|F`g6=DUo$L6MW
z9!xv<lOxUczdZv(8C%*;dyrCa5P*j&K|_ljC*Fy@dza??dK$DW*q{IzhI}_UKuXlE
z`3(=K6U+gfmf@MJm)^zRa)7^O3X_d$sc>57zd32(a`>3*3xzbp1Fsd+K*KC?OrT*v
zt;veI3X07y4H|xOmR)|$-|)+z^kVuk*B1sLmABFiPd5C@DV3O9s4H5}l;+m(D}}$M
zk)hta;g=qN%S6U{k%nKY{H+fe({`vbfFgR<m6y*L8-7Lbx6EZ|_?67xdJHsuu#Y+5
zMZ=Ys(Tokhiuqe6G1eP3{3_sYUB#H5)@_}(!vL%`{z}>o&?I2Mi_j~e+`5Yc6cnIg
zkm*leDlj&1|0*ppZ1`1C;`*{^vb>%GlgO3Hj(RdI>fc^EO-|H{mrU~vc+n3UPYr$X
z`X#8O{{ZfMoO?X^rk+hbNY?7|>(5Y$Ti{$0@S^f@TIcWAg=x))Szc$Sb$$d*r7(hm
z(2dcixHK}Y^BySlSU_1u8dUExL+afRm(rYHzXuIGcb<D~44(dKJ_u2zm)-?ZBn=AX
zfEUL>3g4vdkcNcM&P!>X|6Vhvb)HV^{5~hG`8ea;mr0X1=*w|j4FiRr!r#f)^iA0B
zf;mqn3mRCmON4_YmP`&bkf;YuSf&M~1*T;LgGIqj1fH}`Pzf0OC#~~MTI@^1|HxxZ
z&2J<?_5TY{mlxC^&qx4kbo!GPl@<vKgBJlWLhq)v9^h};z?#;1STAj1L3CQ<@1|%5
z2L7hm3~AX1_|jNQK%>N#H-z|`x)}7*yPcWR__u@S^xjPVZJ=Eb9-K)FO3SE;Vqi$i
zC<I%v3)BvgNbhoeU?WfxRxW14Q4(jvUs{&74>Yxrwx5BSf#G$YjYLV9jY4Tc+CI?S
zN7{Y{HU@^*5ukDEoanUXLjj<y_8#P(bdY<b8Pghni)Aq|@V5&vzSLucm}Q){pMiye
z;k6QUa&SKb69dC*k+glxpcJ&9ffYQZYWOY9@IPo^6Fee4`J<s^J$Q;FU~U?u#z;H(
z0z6y#AZ-W80MM{CSmHsNN7}&$0*LYI_h~ygm>3w~3Z7t5paN3>@&IHmhGlNr`?MW8
zFp2cE`fk?;NTz}-x)1zC!k}mY^_bVYJ^>AR2E1Us3lESGka_Q4zGO_xI1MWJGUkAT
zycHberoTX~(zNCi|6gumPXFfmful5U!+&Uzrw1Bb;{(N>P})v#$V~okB$09Rb6P}N
z<3G^&e7zK?{{b$1-a%$H(hLv0d-pEQ?e$%dX-p-&X}ciB?SX(7yg$JvDy12MI(;JM
z;4%+X*Y)0n)^#ty1HmHT++DG`(O8NxfT0+am?f`*+^Lt|T@6Y|$3Y47fnIudF-sc%
z_G2L46Hq2f?{K}Zm)_;f0cwInI-BWfjkPbpPUYx3kly9`V)APfImQ>0xlBzs?7SHI
z4yJW}nCxb1!uV!#wW+qkxij$2|6(78fEV^x`wprtPG;yk2<l6?zL|W?G(MPNDs<L^
z^AxCx1J_6mwQu-J6w@1O-w2dwfGCa<R#1Ux-*XZ?v$Km~A_K!~DLAj0f#Ed|oL4-#
z!pypU!AwwI*bj~vk8hx^Z(4=}SnM8H%;Z~IWLjKWh7TxjWxN54DSS(dPm2H-TlatH
zr7aYgnbvxsGz8S<j+RO5ya}G4Ydp!oz|a61_1^V^hk+sOecG-+JPZtP^}59rW?CL9
zRRv4c!{q)!<&;2jT%ZwrwX{w-k(nC~Lt8UxJ6J$z65O_UpO%pTPF4lrWc3~Fs_w7g
z=mI$h6gh7|rA4bfGiU}yWM*3HfBqIDW>8-aG>Wdu@c%z}e!u<$sB_wQS^(_U8)+zR
zO?wM6=s{ZZ15k6>^$BR`4W^*^#D9o~KvP5*`aoL1W5%7XFOYPBvdjaRHW23nPa3ZX
z$ZD{$lMO9oSs|<d3$gkaX$N13qy?m>{V#n2a(MFt_OyVs&L0O~FsC&?kO#BV__rNN
z3rNfO2M&V7FKNw36hMIoGW>~J+TtfgAl3`Dw8d|VKmiJxTmu!I;PSE|8r1gabbXSx
z3&OMxeZt?ogdwf-;+(YR`h!fM8pa9K%K)YOA{M>$?kYA=5q%>K)Jf^|y%X@l^jaGK
z_Iqjk>u;nrA7%&7-|}xi4&s9>z7z1`=EbzmgN^_H^Yc$Xkk)y;@!t=75R3CidPD64
zHvXxH(mJoFaUM@=e#Q<O80!4R0a{TIdZSd1JB@$+P0-NOi((#-pFkysT6!l_TJs^k
zm%)=;EKTbpqSJPO8p>*Ei$U{!pk}mM+G5ZgA14C?gIe0+nCP?}84zYhbXta01Sn(k
zd`^paIgbHsCb;Ph)h+;02+|I!)gjt5^1ym-d`gReXh?vl%7_klQUCgyUYFQ|!n7UR
z!$I@lr4o8wVh;=d9V+Dq4X3>U52x+e6wbf^ilaoZK@&cKG7o6v><vSyZ(7C-uxQn%
zv^a?IDG1|x(M;!una-95F;prbEdyez^{2GRv}jmf<Zrz?`I?m*W5Q%vYuS2*1aQ%D
zAdT}x-yu-&q=Ovy;!iwiMGr_46jLwsKvM#s1|et|x{Wc-@PJ-=cL#K`^<<jmsnR5H
zpSbZ@Q#u0!XfU+&gI;>~h8D<l>_71IhhBR3j<$3L&{*#i=wM1mJxIM?de?+5kVHr5
zgO-z}>R`V@<^j^XLZ760sevYnUpu8WAJ9p&J;21kP}=yCkrAY=Go1kvRs7pNfn53q
zG<E(DG=l&t9!np9vc}A`@Bh*~z%B9g9$!#b?+K_%2MI8Rr15V%2wo-89r`BVh59kI
z^iF5cl#S~LP}NW%mezS6)W%_*o3;~FyMsETPvHH9v~G~HE(fWeQ+<a(=5d1D@L_VZ
zjUwZR$xCfi89z)uZKLhGBLNf+mN)oY1OBD$00-M{hb&N=|B_yMH%IeN;c}j|{on*~
z`FR@WFR(`~50^dyg#>637sE_&tNf8b+K#uA-EDO>A2Fz<cSW$K@oxjI5~}?GYHb=`
zN>8&6{ZP!Kmfj^Jkj8j3&FS^q$%}1OMGi%P%5iXuAmb!BNvXe|e8<*Pg*_6K<gdL0
z740Cq(hk06QR|eGKv<_5HrdloQT5+Hurzo^S1oO^z)VmNWf2>LUY8gXXgcvy+QCPh
zlPB6`*Mr+?AJV%VWI%PE4I6)p0$aHvXc1N^D`cMTCZi2gsmn`QR#2_P!r%Iq_2on`
zn~T4tgri&(B+S9zqQeeiaPqhIvb_ufvjzBDk~u(vqWmq#IbPa9LOZ=Xf(cZ+1hDiS
zR!dh->t;&Z3HGXOn3Jnf30vAuP<`Kb7*v!P9{9Yf@9^YKd%1eeNN~bGnZ|h#)H(EG
z1GTGO6oJ`XX`R<VZDyspX`T1e4n7Ahsymm)`4cS32U7T^DDB`&0k!l_FQK%ZwrEC)
zrR@wr6Ou~XnF1F&p_ZOj-{~Zm)_HwSTI2D53=9l&VQU-s3Zm0?sezQX9w=c;+oco<
zE{1(UtzXwSpayCWxLV5w$6WIpP_+grFF?J57bQBN#+BuXVwE(@f5q}?*%v^~rAeR?
zy!qGv5-v~>b&91mAG2dhb9j9nq!_e@53X8AFTHybD1oA?1}VPQcNkj8vc23p`Kg1l
zXEoRjk6wdPPg>`Ph9`^xFTR`sRf{h`b-r*~SX#z3u$q0Z)8f+NUwX5r_qjd+SqhF5
z@T{9&H{XNFfsSsBwUcK!D$3WM1*LRIEpZ5W0pJ}_*19wKzN2Zq16z8B>x1+T*XN)-
zCkc`Ol~5dN=^fsnQG3uRkF%U!+QK(Q4L=!6oYMHWe*+DTmflHgJof)T0|TfXeJSnx
zH_(a;o0gNM?ocDT9k@VKmOJ$s7#M6BHk78O?NkRXW{lkcGTT`OENNX2Zjys~0I$8%
z4!&SY+XX5a(hR@7mIAeLpA>;+#39QecJ2nLZT$usv#|y-A(`A3)NwACOKbkYST6Tk
z2%7aFTEJN>&EYj$8hCO96kuxUo!k(*BUmEM!v^GQS;!g&XDLukDN$lqt^{K6mw1CH
zf%Idp&l%E>xxQg24M^J$T79^Q`?Uo~YI1_JA}@Hs<|cs+9Ixfm_D}9}7L$N3eSq5H
zEDtJi71BC?PTu3JZSjr2<pKjJ?H6mL8GZvZbkx#2iw!_SYIi^^qcp>lpwKr3In4~D
z*&L)<-o=W2EjR(Jnw;RGP_Og`)Xo2p-r+8re#~9Q|D`1hq*2^=KyBeJ28d**J1Dyy
z09A_n!Fq#VfD#xeiaw+tcaZUCc*(>9;id6!50FUjiV$i3#n0cqpSj^T6My>-W>9J1
zApjx^m_VZ%kRhoHY4xDBoH>s`ZNHAm%q_P|K`Tt{(+>V%gWLRiCfH=;5!l|JV4?Je
z3IQhm_Go6fi@TwdARf$V{M&DXTfFa2g6HJAK_kKr0xbth!HE+*!4n{nrVCof)_jN^
zwAA-CzYS9<cts*i7BtJKcMfb!_OZ0igOlI8iq-#vxl96_oI$;j?;q1U-9^%myMsdF
zCDIfY)Hy3b9TJFh0zl3Io5*o2trIj$4sn<bV~NR%dj8frCWzO-;Rs%32X!4N>>NbW
z_{G*A2dyXsInC_s%iMopv%Vaiyw6Rs-uWLqBo^*r0QJ5_KsF!HOYdSxYkt9I!^q#x
z1hoJZZOktf5sroGc*F?mg@albdg)yrY-!D}*cyH@mYr(&$x(h3;<kngQ3n3jos8*S
z4kDl$1tOZpU%$OV0<wq*w1}${v_^89>zg#jA8D3{_<OoQ<1(%v(z_j)(mP#2%PK&F
z)%@EdSkk*31Z)^fxIz9;0j=_Q%?ir8UTK!!`TGj~ruVtNP)kqi=1%YMeV)d@?I@@?
zdjKlz(?Rnij2|F_d+$2DPC)vXpb_*3AmaHuP@nNI%j<1mqtyPwH1Kab5b)y8QK-qC
z%ur=F({}Cv73I4&O_p)jWV-Zcvb(#M+_FFLP+hQ-A+7lVKO_ZoxC_4Q`ZKxTT~zu(
zVatKiAiV_-3;!J`^@4=QaR&ir#+Q+k_q%I2ftNMy1Qju`hRRD>&<a{tNcLfTt&p~J
z4cO+FjG)S;+x0`hi|x;02FWlmf|ejm&hX%|HeoKW2UX$xOy%C7Dm<03oFBB*#){E~
ziNEzC!%J628y5c7e8#k$4xm2Zt{PC!3zS?uCa?F9s_*Bq;pA^|Vk+mgVdrl>&6w7F
z>i^5lj5b{St#(Xls0(zwuh|Ikx4h#hH?ra9Z@JA>E^EWf-?|rEw+D-WQlzs)zzdH{
z=^f58FU@#t1k$^lW%yfzSzq2`vXSO*`N&nyZzIg#Qpsf_#oyAx_3|rsy^Rci%Peji
zfBx2&+-TPEe+B6WO;tBPs|Sr?Hb1OK%$$jJGNd&>;!0~i#n^J7lDXkrL)v}?1_p)|
z6{W&y`@tieogZx2O4!o&gNFXnI)8wimDYIzx#WlueFkwhvfz&clW%&e*Rvc=?{pS<
z>BkLfr$);({ATBGcjSf-JVWNA`CIh3J8pt9J!n-LC^sL14ljg$2zasUL?0+ihkj7&
z6!T-~JFeCtm&A}3lop(paRpp(Dm?<V4#0VK>Jg9^555Eq>t5+i`!c!Si&Ht^By@!x
zYD92@mNRX077Tb1ePr@#FB8E}7dk+TGmgAg0IxfmdSdbiFFBpB3}_)*eI>oiS+M0m
ziO9bbrP=9S-U6UC&<qS|%?~HrddoA)O^)@JG&Vg5O8@^@N?*LZ&Iz|a;DzkLH0QMD
z-z=rCU+(8j+i3t!PB$1C7+%hwyvAEz;@LUyG+mc7d^!;{Jr;U%@?&pZc5hBl+KHbm
z?jv7s%LKOi;6vuL=7$_<;4#>jDU6_mc$&dRfWPGrgAE6Ns~8hxX65B-1{(?fmMx6s
zqBf%ZErpCW;`}YmjG&Yx#`y9BBPcN~WdtR#Q;ar}{H^!k!}%S~0xx%fwj^wG7O)ZF
zZ(jpuPu}VyQ@>_EDB_Dnz{5j^x4~0%B65)7r5gb+diR6<Dp2|iEE5Kbl}oR8fRX~l
zC@+qH7Yh5+JDdey+Jj8p4l*j53Dn95tx0Cx4{FDCu<(JWR|HC5LA(<1;>|v=gu0u+
zOAe0oE@uH~X$6`Ag%?-OlJC;HoF!gvWtjZNS4QB;jhC$q;HlAX&H{|3N|UGiD%iZ<
zm$n1c;|+L`v9IMo1q)~+0BEqV`4NBG4$yGe%X^S@Z~_4@g!hA*YzJQnq;~|1zAR<|
znQE`NKP~d5H9N!&py`iyFLl{rX8zrK;01ffL5N8KFW&71m2)j8OPLS6U`p@s7I?X5
zvag?{K;hlAoeJP|P|d`^@bbjuGQSFThGtNg#cuLfKLd6K@K7B4WF3Dkeu((BouDND
z@-^$^-~KYP;32NdkYEKj0-8@SLnff!zuY)^p1&*;L-FLj{sxS$li&GkvV)Wdybzr%
z7a-1*zJIcLfCc0I$prz9Q6GyyBf8M}o`pP&VE?`lc<tJAB5fDQ;@8$-7HCAx5XNde
z#K7`e8O$qYV0bMFVtoJ^#1CrPd<W;y(#hO`8jRADO#(HU7@8-?2P!c!Oq?7aC^30<
zAQ#ASAm;u+u8f=wpf=FUI_9*U0^ksFVP;@>8OIC?UmIiomMF$@aT`Pa7A{5`BmNe3
zMjL?=QyYVl?3c3{ZA|%Fau{vQ_*+UCZA|!EI~n0MOqW<Y1Gp4ye!!U4{OI3H>&b>e
zmi12%_4I;HhP2M(YF%O-3~8O$Kq2WZ18P&tHT+~MQENF_YL(XfAV017L<4AIxcS+K
zwB~ahuT8;%ouF}>53hy5oaPe(U=@!(fLh1R=Qv*rfaU;Xqd>8_<YroAS_I5llb-~+
zv0Z$W*8GTRvO%!3I|JCm8$o03JZU>WfNQQD%%H*R8v!rE@1!4dmJxcnkuh!O1F+P7
zP{>SVL@S&QU!1%vSdHBoY~Pg0&w~{O92wJgUI1%hW?^7>sW@38M30GK=46kM3H3#w
z{2L5fDX^_rrui3pd16}U2OFmHD3G`}xNQj<_}vEDD8vDpRqgy0@Z$2twAKR^=4qWD
zTTYhpq%|Lav@JWG1wd|;c`ci^^9a~J4;HZNk*kGyw~%;;Ci{k}Fl~P^d3C56W9;Nr
zq2`QnlOKg@GfB*x%pc~>_;ho0*mLI1E>QxEn-ikzStdV@mtjqtkTzk$X2yhQ_Q}!d
z!u1Rc3-TEl4lpn<bmTBFq%$xu<m50gMC33q_~bBvdc+JG43Z2ioB|A>MU42=f_gdu
zSk!tz&DB9N7c?jjR$Gr|FgC?342%p8j3*eFI5@zLNGO0fSR;plA(?@JfhUK7;YT(D
z!<%dd238W(vN13+)Hg7lU|>Wu_(e9v;4|3_3_G$J7}jJnfL0<gfL#o7@CF73g+hoU
zKn_l0U|^V#&A?ET&A?EQ&A`CRzzlXU3&`9B3=A*_=RnO3$Yx-$$!1_M$Y!W#;A3EB
z0679(u?|$R075YXKUi%XBO?bN1H%G@BS2~wGcYiG$zou5kOelFK>(_j1*#Snb;xSZ
zWYt3y3xX9tU}WSF02_>~_%Q<m!-gydhB;7!g`jF#@TfflRV&QE0uBidXh<x`VPF8w
zhRw)=gm8^X76U^@76U^}76U^T12cmHa|9DEgF!=KV1qZyX7TGQnd%wp87deV7?~QF
z7?~<)1f`}ZcqEo6I2Yv?7b_T=>KRV<n<>p<qHCy^mTY1)xp1bKu(_Uru7PfPlBrR0
QqJ>$ifu%{x<XJP_0Q{>sh5!Hn

delta 14829
zcmZqJ!ql*ZNh)-e@5{zeeg<^#XU0aUmyAm5X0~1`VSIOpiJ|2{iAh>$TIbWW;Iz)e
zX*(Dk7#RMYE-{}h%_LX<TAY9VskF`$bJ8w8NMrra&cHBNmEp%BCWf@=v{(=Y)))rT
zdMvH;a$4u9^t5hYj`S{9p0tC{1k(7o-%jKFoM!l~@0eOzryLJs!%xN%-iDvdB|I%B
zOSm>jzGmCN_nK*gcG^w{1_p+{gJ~XWi&{W5|F%nNoy=mb43j4+h)zDm#K+d{`XSBo
z;O5&*vW#Lq7y1sQ?O<qUU`XqH_VcXhuRm#X(xN6OddL`wq&5HGFVRSA{vp6W^*|c`
zwgYLM$LFM7e4f^PoNaDe=ixbN7aylF9!_gM%sTfqPuhOg$pI{-Y~7(B(ipEzKEa~I
z4`Om&NKfkyeUrw&{?O#lENUj*u^-YnZ=|Pn*Mh{3r#Ym}O#A*XjqyZU^AVA>=(M=B
zcyNH|rFDxPDN1X-#NTpdvOBAM{d|xM($hL!SEMx`U{5>vgBiqGlb+V?&yk+SzulcL
zJ*~TRO&b6D59w*$@ho65fi(X0he3ujen?}y0Mf7_y~~})hMB)bi^+zCzvUj24HJLM
zKE|F4X`S!pq%|MgGB-V~vvdK(tj>>f(hfdko}0$Mz5YPj!3QiL;RR`oAR9tA1iaAr
zn`U?bWa^Uiv~E|BCI%31MS4T+eEt%3kYq#cd{FR#<GuL++g$#shtv4C-JX+{eVZ8;
zaywWV7#PxagUMZt3=9k%H`6XZO6$A^a?pRUgEj=G?E}jkOuPIn%@33~Hl$trnV#0^
zJ0-32;G8tZn{z>KSdn)51w>Nu#GJJ31I!>%-zlIVn3<mTy><i0eKWu+J8n*1&8Aqt
zB0a4;c0-!t4Y=~yDQS#1(jdyyTEFp6J(!->Tswn-f9j!@izV`Dtp`e^(whG<@lQRN
z*8GEsf9fHQQ>6l6HB6-(X@-~53{Sr1NCW$1BS(6gW#|l$uMa+EO0&EGN=lq3(l~FV
zSzhCxdMK^_;-fTh8Yx|p-r-^{l%DqA6%?AKYtqvgLGjRByM%+kwdLQ-Zbo<%r5WB%
zPvhSfA}<8?Nx+NbKj~?mY-!FQ?wT~lV`<I5IZE&JfYP4t8c-Cb@oxu5U|Q$<Icd$u
zx6DoJJTxbb@z>mXkd_SrFI;}V)Mf-38V)m4;7?lT%Q<Py2e-^k+r`1a0E${hPy$$!
z#`rPKtMo%!=jS<T2Ol%f?YWf3zx`6$!AC4<oiFC3H6PeAH;wU7TIWru*)M*95~IHq
zhzm-fC(<+_QfZ7gK=y-@($QaOyFn2QQt2*}W_g&ucMb!HgQP7zt=pXil%hed*pSBf
zA+7UMz>Dr*Y0j@tfRwt+fh0k34NC5ZKtkm*AhI5A^$(C6Hl$e|Dwas={4gi2+48{u
zxgcHXX^gHLK(79NJFWFwiBei8C~<{?@|Wv|fEVh&K#7hqb^|CkuSsLP_4?-ImmEeM
z&Hp$`#am8RPFCi0;qETwN$+(1klyM0Y;rND7x#y>gAce>85GhwKTbZ%slwS^`z+nE
z_EU-3<j<TMeBG{Z(ijh?r!~92P<VY{vKm*fsCe2A76t}}hF{Dj3g2#}NghaRKEO2j
zJeLA{cp9i|44V9jOR2t8t=q1Zq4_^YS$10I;e)R^(mIc&H9wQ+xRuuYNFlu=^mAJ0
zr*y8+&!ygJ%@5?$njhPzIj8Y&|DFbl^X5a0AP-+lJNSz^t@9!%g8$7;v%FCvn8v^U
zUfRLm%xRrBL8AZXrX769k>-`gzwJ^Q=f!{*%>UCm52baAoG>_$)_j8NeOl*<w1W>g
z(wa|jzn^T#EL<Oy)_E}C#rc0}org9Eze{s^liuO_Kdtjbz>6FI(mD@<QkU!hw1W?r
zL1o_0w9Yr+k`7X5fW4R2c{t!jKS=Ecp0v(W@6tNYfr<dexoMrBK!$zazzY!u^S-5Z
z-UxV63sMd?I_o>gIUr`}w=~WRX$K!LK`e>{m#b*i%)zwIYXL8m|AFc%kQ2@RrSY#n
zmbMcV0T6AS2f-fYN$b3Y<X7JJX@&<TPgD@m?>L;c?-nzt=J@m`ZRY_n>(raH&f^_7
z-lgq2$jrd-rsFWk<!PNi(mGE~ZsrNJJ`akkT_9aZTGBgQKc{tmfN4tmemPC?Fh~>U
z4Ul)!yIeoNON*N<$Rb|fc^Oo7fMa~uab^aFjuY?FTK|`*rtLZjvaj!$T6zcb8!+X}
z2&I|Qnh!Il`M<sf4hBf|0txisw4k)k!=Pe<f15X`l0A@?#hBLlYED}7p`UXDUbOsA
zi%jow{h8k3ESlc!`m3$}L3*dN1gOOPgBpF1^a*xdDMwo8@w8nhpsoWu43wp$`;M!n
zcQL<HOYd@K1d~kfz%KK9{Q$#dLFruqqUjx>f781IB-%cucZUA!xs;w(&%ezB<jz9~
zcmACl@S^&ES|qA_K*=c(6t(=@Kczv#+wefzE>JAJ1Ggp^@1<GZ<L~QcNaNpjy5|D8
zfP{Pg>)e1Bo&VCJK#9rqYg+aJUl1$wTYXyQrRku`3RIc$ZwvjNmVHTP4yf2@Jk-Fz
zz%Vzh^FrFe9~^0ozy8}ZFqE;S?XU-xoE@&;(>q+hrFXb~#b(u>e`yhE&M))+L!G)o
z0qWA;v>)K0fu&s)aO3KrUfM#3Xiy8mB^p#48Kq@k;!A5hln~9pkhUXX@(W%KfrNAh
z25_ltd9joujWubq0-xe!9(AGmH=sHbRDsvNN$Whlf|0*vBU2jxt_K|a%|?s?FJgXy
zQ|J*;YD({OeFLgYKd7a5FoF^?NI)&U!;vv<*EyI15T6O^ZiuVjfP|RScAWw#0kK)q
z3{R$k+J4Ok80+Vz?E)G8E^YTwaE`h4rtdhYPz71y!o`~AnAZH0rSxJND7GL9J8ywp
z5erh_%n3H?^PIHi!;Et~PNa2ydY9ITY6KV92+7iiX@<AKCB)L-U>kfv2DsEqDyKQ8
zHUAbVeF8FSH^?6#b8fv$+jSn~V6fUyuv#v2uu+_)_termiyYDn52&SgI5~j`XAt26
zB3#qc_;;ng;N)+PWdxZB_8r&|*AHsxT`?T2Ft5)|JNTGm@>~sW(OaNe2qf#k2`aMQ
zgSnIUYRD-dG`etbf#lLSPk_rGP_RgrUYYz?L%|NLQyMJWd_oW`ZTJnLGsHj{TxNHE
z2zasMSDIT|^FNW&2cWov*b}QMQJ=OC<Z*-^7Y=i<c_7<9y@z`H0a(3SdKUvU&R~28
z#<b2`@8CQpP&B}KENPv$Km`cfT!;#AOS$>58>l7b`Xa6Q0TX}A<ZqgMjBh5hYAG<j
znXIOzruIfHz0+AK&G10q0kyPlu^I-DbJfz*I)ha}A`5vKK?0MDv~(EXOrEc$>HenY
zM&GT^OZskr#MRQfot4t|gIoT`)fVq!NK^gK$iNWrV)5_3<7$idFhCTgbqA|Jt>}bW
zF_~Z6I3AQ>nIR?C8;HsdXU4Q$$3V#e#%F^13e=$F-|qS*ErWrPfg#QCWWWoapJ`Db
zWsvmI%*+gGDuL5Pu^mW!@<MGX5o8U?Khq+>66dug*t%;!q-p+`oaiAkxj~wxzVldG
z=LNmAZa$r8Q2K5D`M-n{(lScB{5Y-kTd5F8(jpqtyaY9qIWMQR9)Jj&M5pZlHKNik
zKS<*|te3XX23$%wM5o#QXJB9`XH8=~^qMX0eOmJ&mbA_rY41@Am#1llmq3X;;6=fI
zP%9Q}RKSa5FvsvfTI|aRPzyjWy^EveWQj7wDo__pPA|R7iOq%s)I*uf!S5fE)_DwC
z%pH8d0<BL#Z9+&7L@%w|?nn`+b8yUsbqhn9Lt66>htf|V?{?mplg9XCZkpxiVo^v>
z4pcO32zasb&EysQMob)ECg0)LWxDx!GPi(^<^fQl?E4nfDmnOwz3~wPBdBqq%D|My
z32NM4Olv*}YU^x2I5|N;hw;_qUI9zfg3pku4^m+TLxU0O)$qSa{`LZM3=agnaG3mC
zKwe4VZ(8Rqh^GTy2!lBwNzT7%&F>hCPX@ebm~0~`VgBq7s+rgR5QvAjpa?aXJVQ{n
ze$pRMFX9732_M9sj+@|^Jf7D4nz6V!;Kk=ZJtz7Oq;>vKOYdkqP{_cL=9bp@4^;8+
zw?;vuDd2_AA0%Jcqc|rG(iDnMi+!o~2i$LJK4>sEt@#IMnRr^K%t27QFMMuV>!lJ-
zsI2+iH2!@DU+#S|IY{Wd-EMFeJFM0%=f$AbZRP{2V!oyEZ#$XBzy2dA`qLN>fVv-`
z?mDR1$iMz_8snw3&I@zW7(dJf^}y?c!L1$sZ8sZ!vzKS4bzV!`0XFo2+JYnoiyNiZ
z9XCM@o`4q>|G~{k-w&YXMCXaLolKyLcV^o6pJ~vR8DCoGFQk?k|9hBGX$PNifYOHR
z=QPe^YU!ON(gA4^;Itk;*^-$Xl+h+PiOBMO{g9s4>CBP_Dk)VzPF^b#q4AxioY#ht
zzlDX#hPg!Q<qlRGHvZO4tZAJ$dego@j7W=pdHUsKT~PzR3k(gvSom8U85@2vmE=y&
z7Pa8m&kk~B=g-M2L={DEg9~4l(v>ge7}E^Df$h0D`JSjx{c#3R`cLZwSFo;c0$x=A
z13B1PD80+~P1@xjY0VE9)4tyTbzXvH($l)DS<=%wYhR>yS4$my&z#;_`vlYn`T&Y4
z`Lz8E3;zEHmF4`~eV?Rte*e5G%?s2_e38cZ@AVx}kMa#DUA<u`o%GrtWMr`*sHgN1
z6jO%((>i|yy!bnLpO`jN@zcq##nc&hPZk!}mV}K^be_8S3e=K-n8?5W`s6@yF?W4N
zu-D&%yw2a!%h2$Uv4k@{t<m)Zg94}(!m#82f3T&Dr51e$V3mVFnjvT;<x?6wm{yBR
zGCzL#Z}M?*3&x|9B*YvXKmlcV0HPwjD}-4nt@#mSTIbI+&4b|L?i#qj;3$2ZwgY4d
z*znp9X`P@doBd_}<X{Oi4p3vElli6L<cSitZV-=L2e}^<-?dLbtx<)v{b1e4(>gDL
zWS)Fp1?u5-`@Tp|WAuIU`gVF+cd!iH=fy0O1trzwLBlc4j4-XBw$Yok&ikP7PGkK1
z`oZJ~Nh4{9b;r{J(mFqaO0N$fcY-RTHIF7QlC&1=js=bU98L>>h`&5B`L(1PW9?)i
zDF@q3Q0zF%fCec(q<1?@rGpYkm$OjXZcr41!t(<|iA&#MkTTylX`R<UuS!q*@B1N*
z@zd*vle?tU*(N_sYd*pQ8o;X80JY>mP4Z6PGwB_!mtna>ty^plL+hoI$~6A%ztTE?
zK|AeN<_5fo{0XWSnjic~?{s|x^4^*BPTwc#$6OyUBB@&RGp+eCds^p*mIIZNdg)#6
zY&PuW0%@He(wZOCryIG*J_A`NmEPrgIlTkKJLdX;2}ytQ<Sc1<jl;-!ALOJo!vn3C
zN~}R?4XXIY+<+HrC$E!M;QsvsWMz7ni|nh({}m<co8Q=^b)JJ%5q$^My5(9K)Vle+
zK#lodmgo7Ke=;=x7T|CH!~m)sAcGPh{~7*(_~qbpP#$^&ax(w61N`d`gA?8V^iJ0&
zmiLOCq1J<R<oy6O>I@I0cZKjiYq?aypSHh&fuWuu?ehOL&L3%=*THQij?xF|9WJIv
zK<WHRnnRk~>#ZOYLB$}%@*{K87;k{0bq}}@;Cq(Fzx_tq!50D`u><Knp}U}iEl1|2
zr&;>$DN#@FbKRwu-X)mc=XwCtZ?ZU4!V50$LG2Ee(w(m*(;U;BUta>{sLoFvpsKa@
zKzdi|f!E9+q2?ntlLc8M>vhsPkEM6`o=Afg-3y_Cbez9g5<KAJ$`SA)`zgpB7t%UE
zA$k4Nw=`%t^&M7Q*a|A^e}GD%GoX?x_5}a>8|j^~Ptpwkr#IB{FjR`@rFXf3QUZ5+
zLn=>w+I~<=BtFgX8z@jN!2Eh5J<YQ841eD|P@4=qYU6rAExk*|02Iuv|4Vt&c7f_M
z&=}!sdq`wKLJ$-g7rud1?Eovd{3DHj+vUj$a#GGWUMqt7U6+5PwcY@YuYt-<Wmlf`
z4j0~M(CE1jG732j7JN%{OaJfs<YnalwB{o^;LbH@+!```axT4#A-%)(Q+ii0V|tf2
z6C&%_?O|yBUy_i<zx}^ndKY`kffDJoFi?e+7SM4qy({z+xHt^~b?BmATc&rpehPT8
z=u2AXA-(i&cdqn?S`LO12~Zsl8XN*wQl-#J%827NSKk4UQIi$q{Y@(bK*8)F81O<D
zRBE|?0Ok2Y2~gQ3otDLr*7>vJ7BsRx%nf+)7G$H}WJU$C$^Ja7llRN>BAIaEJt%rn
zO#l_CC?-sRnV=}lzwIU>-+(fq<Cn<`6xAk2D;O|Ee1T>_p0v*6>0PcI=^d^gLF4r4
z9j>4Tf2lxvm#YXU@DPC}w}+wiHh)V$C<)!xOYdTCIZz_raS>eh+yIqV@QPLFzZy7!
zZa<L5cmU++7il{f*clko8)`o>lz_?{a5tsd?Sw*lr|TzB5S6|I2YKu#NFY0NrFViH
z!oMx{BPg(B()(QBrFGs+>%5-c?fU8SYH%^{`U2DxzCSr%QC60J+bvL80vg)_k6wa2
zeB%>nWHY@pcJew!8K%z9lTRv|Fus}mPf@16!}T-N+n=D`1{L$A0toLy(nuY08UYQe
z3xE^IXVAb-9NfcV|G|wZ$dJTsQ0xc1ko^epiaS>t|N75qpiy|ni=aVxP=i-vTj@uz
zY3XU5u{@vvi2antcpJpyNQ;J>yWr+zLuM(lHyr6{ouO~iyF4V)JA6N-cX>#rclb_z
zu9V>#`Z-PWa+)(}guCx7Lt5)?{=Q?N5!Y=MGHI5->zP3r8#;CID{U9Jjdn<_i!X^G
zy~FoSdY6MBDB>sgD$Cb*f%u`IQ27+_!r>n%LeslKKc_L?O3PwQ?{fW^7LXPW$|b&U
zUfY3XI)9{T9!d*OWBi>K43U836lSnygs#pXY2R<81;CWR>?rt?)_g<&)*zd#t>P%`
znbvvu_2cw3{(X!s2TC{sUNB#uT(1(txODOz6??{elVwz;n8JTgmRFIO9H1&`Z1f70
zxPGK%F~IY{kGTOa`2MFwr+4}OO79B&ncn64BjANQC{4$LM!P06steb1q;(!nKj!+G
zA-&r{1U%T=<qQglPwCyo5}+LF%#+>~ERfz2`o8sBdY89MiEDbFGm~0+mjHP7sQEbK
z+=hotB|>WHT^@|-9lr0O!c23)z6SBZi4c^hi@-TDt@Fq0&7kI$RC<>LC<;SC+3f?&
z_n@}?)VH7t-;pP+^EGH>ga_Q!=Fm&;VrV(Q-?D?rMzs_)Xy*zVH-rqRrXO>Cp^#>H
z;I(2J|Gon+%a}mpNCuN%=_u59o=<CjZ;;mcv*9Oa+1c0p4ZjRZPlMDOfYe_}Gd$Vw
zE2mT`t@Ar*CV_FTUV2v;BS?rRt@#*}UV4|<M#k67X`TNXex-o&e7!@%FFpR2nT+)!
z4Zl?RTVFD!?NDU^HHd<*y!^n}@GFA9Wi>;?uVnt#bBt-7@i#%85SF>1sALX!VQ}T;
zDaM9h#r!Q38SBj(eiiVyu4GK>ybrP)q^MguZHEEaG`1^gJ1W4eKbJw(1bEIOt@Fl9
zamI#Ur6q<9zbZ;xU*=3crK`ZS|MKKFx-u*Qe_q;6=Fy9n40vI4In5K)T6^*OC8*u=
z0X%Y)^=fj9o=ttgi|3cpJYRo?N`Oai-UPf5eU;Yv`*kije}a0Np!$!|rnodZt@9oz
zlp)Ro`va0B7hXzpe*HeJ^K)9~x!0!9VRncrXrU+zij9C56(EIgV8JAtbqUni=Kuxj
zX~?X_0Y=cQm@CIi%fFNJ6-6f(=yPx^4+DkipFfiu^i9~;gE<E#@7A}he+6bYfbxt2
zmZ96`H=w?S>z}lsw7|3s)o_q0!63yvpo$xm^3!5p8vIA@HaEYK0A(N0P-5tZw1Bh>
zBd{*nKcN04NY|Ty7ee>bS`YBI9AY&}>jVu&xJ0Kl{!WT!VBl}s!;qGJfG>?T1T<c0
zd4s=cHG^Jyw=)xH3>IYWi^)q2wCi7h8-hV;839oY3~3q8U@NBnPHR3Qk>2I{z($~?
zyj;zOqoh8~@T3ht|CEDij3635Rh#CY*7%%(nStSTxs60gI!KiQNY%lIOg0LjW&&hJ
z7ov=ff#G!kXhhW^I<5IoK$_tJpS1UBjlaKTGBEJBvonI+o(^*RABLAwjL^R5eg+l>
zhSySQJ3%d-wEYZB3=FS%(snX4FfgR;XJBPu&`aw!bBIps{4}}IP_q6LXjCj<ZW?H~
zul7Y6xF1*gAZ-UoAE@Q^KCSZyX!Z;=@$x_*t@#)WM05uS6KF)KJM;lqtLu|AkF<ji
z1fY^C2uV=8uk%yd`?MW8NP?irhfitm(_=y7lppwu#6S@Qnj|fK0-o{UUw<&*#k|LG
z&xe4FdH?bqV_L>B&=6Nf0XY1_!Qs#R3skzNHJ|wZayxVSH`fmwrNw&bUCum{>x~TS
zLvE)<r8WKojWyNF^qc_2CwQR#W7@7e@t|~Nd^;^7&F%GVkWQu&-n3ny#%vmB7-hw6
zJy17SDb4VkUV4{^c^YW=0MswPbral)7AbuJ9@P*5=kTL9({_NO7BVjR9;CHcEN!!{
zF)L&KgCdYkOjkh;)l2U#1|_Rwpk(zxFTJ~(C5?akaS-nbD9fdHxZVdjAJm9>0ja>#
z(;92vfPKILZjHTp&C+*Z!+*6!o(!<=1}FeOs51OZPvdrdGkKwj35S^%XsJQxkI8pU
zOc-BG7BbaVNIe5nuC~~RA>f71)xLvji<24pAoE}^CdZn_2S1ns9i`_y1sdiAk4iSw
zzThiSOmC=tAyA?LqBu%eK_#z!&&jld4+YY8J(vJWb#Pu2DAmDvMU(l>tlb)BGBBiN
zOaw=n;J37hw5YTU1+dr#u-M<PX_0AhX&DNj9GI~WEcWtiT6|grxZFGQLoaRNhZ&P6
zm`U01`@sX6;sOn|r@c?x^@oRn;jLb`7{g4<L!e3kCjJj9&IA(Y0u57v)@gj1G5MvL
zT)hi81)T(26Y>=tF(C6n(eMIPO0*g?g9gFA%t&iJ$={;J44YY0W%&OeH0|vAA&pmn
zfuRAU;Y}LUMWBQZc23$`&_qw?@wDdWpm`0~H;|mseBwXExoP#F90wDIX=#4&0X)Fc
z=?WT3fys8>fa(Ej`H;pd!obh~F%O~f52z8423khKD}hBCR3Zk0(#VsvgD*tV0@CWk
zK^|&;zz!M{IC1a=a~fz`HXx0E+fh*Ac>x?Qc3;w(k0?L`&hAJN*Z{S(#b=5@0STJ!
zS?CfCDK|m$JfNVsleQDW>~_7AW_ggmc`XBUu7L?$Jv`7$?}}v7ORw*CWC4vN=%sg8
zvVo?5K<iIj9|XL(dnc_EJWcKj8j?5!URbgZG}RB90R5N7zx{d||N29q9%NcKNd2jc
z>5a8-e%SL*Kh*gDKR^HUgK3@T(>Sj;{AS~ydN_^qcltNiH|(GV5uj;G-y5ae;N>V1
zX_lo=ig`eO1C<<V>79&e%?J5jx=&WOG_BW(PTL{Gz`&rEw%8&%ZHFL)2^z}ggfI=F
z({^M)m^RUA89Wi7{QdA#TExqF3}7>1dO+F*APPa+K^{>{TWk=Wmf--_v-VS31Vlpu
zM3qf+z>E66yLw$>2MW`6bcQo9v|K8c(CZRASorTyDSvv}an~2%vVBKOI0FMHu8hG3
zrG5fs70__Z3x-nPw2UmUsQ;(5IEe8n2;&XVOy`H0&Xxu-R6Zar17fPcCs6eX&Uv8N
z{Q%AxHzt=@xiLCS-fbmY&yWBvEe@n{p6ENImbTa-9qhsf@u1Z+AW2Y~d7%etYl2Eo
z&|p<9W18Usz4Y!5=zQSGG|N+^vEVjm<ME_)1_n?<sePlD-n}CQGGq81)VX+~m)<=g
z4I=PKFTJY+q_jT0!xxmKI<nHi9kK@urOIIcg2$to)4bHuJAxTsJES!q&`GmBz{J2%
z+V=7<gI;=9LuNVyL(i$cLuvfmz$-AGfD+h$&|GyI|F)l?VVId|-~Xq1sHJx}Gp6_W
z-bwFsy`z@i;mri<;J7{j52Xoqhdv2-aqcK+s)!ln)i;wrSW7D2fzJe`b-TXNOYd@!
z0$BwziW8zr%SMs$&14@NRmL}yi)^$58-F{1>hjj;f8Z(w6vOFh*}fli(wldJ!b!NC
z7nJ6^d_SaJewN1h2{eNG0TkOG1WK=ge5{t%DfVCnsEd5?kwDsx{gYqW=<2^<P)qL$
zU`^xS_6syh@&VKaHM|5GTl|n_`Ky>8G|C~6)_FgT@n@RT>*tdlY*j_3M1aa^a04J?
zHaHP|dpEh#)>Gvsn6va9sOSdSn0D|ri(04L4}_)PLnlA8RaF1+4=fFyz)(wD{9y)Y
z7HSb2gWdur&|uhww1ba0K?@di?6T`cz{x7T%Rwf+!}W~~8-I%=Te%`=F<3P#WYqf@
zqYYE3%S&a}^oH6uEc~s{SYJ*Av$^<NuCtemf`r-mTOPB47##d96WL#G;{dS*_*;&#
zgBYUxEm|Be7jl3?{zH0q0Vo2u2e9-VOWVl@uIxLnrx_mjysGcmWJ`Ow`rn`c;NN~S
zjq@OAw$F<VR1cge0<*c&I<JG8`ATy^P3D7-1=9GppHJhw36|soDLhk@cJQTuT6(9K
zP})xZNO10e8zq*uQwdE-Ds873T<C;adRl#_lU!Qo<vD4MhyQ`5@AaS)>wGTJX}f-a
z+}3)age`5?mk3Y`tP?ai-0AuzEhsG`0bHfoMuN(s)Hk3i4dmlDX|15KZr>LrI-pjR
z<^5unG|Lmk@@d%@`1I1dCxMFV=3oCyxIim3I>pl*nvXN3IlKl1Nt)&TVpY&$!xE5c
z9kA+j1_or+5XIN}jzLRN_LtWtPj*oD^aZ=(&}&d)N$dR3@Psko#kO;x$OhG}rNU`p
zX&D({HS=DB78t%f$d=yc`UK>{osc-W|9O>OH{XHD{~g>I{U^IQDynH-0VQw#?Z?42
z0BFVGPEdIY%D13}QLYa_-hD8+&C#^pgDt(o_c<uHf(C;@<7Ur5nNK>s%M~=U>MW<1
zw(v|*8vl0CNMP-QH2(G9(;AQc|Iff+_zjc+zkdVewuahgj3s*M4YkjhOKd?DL#YSI
zju(3A-40x~3>)}c*092+*7O+|7+$Vq-N2!i-cj!?leP;yH?+eVBs`fl?ch5maLEW>
z%VYTewTxcc!XrhX@hU`#z8lm^Z~b4&mIl@aH5oFSR?d~y{ExAmE6wdSTiQO*a3d(Z
z)Y3bdL3DbT>kE(vp)1Jz4*Z`B;>v=GKdFYF5+y<977ai7OA^zMxjtt|Kj!*|q2VWJ
z5oDT2TJr<8w9aE-?x8fVwB|?LAoi34pv8x*b6@*5{G9yNNzocy32zeE!0}o>Z69b|
z<R-2StgnR;27*SHK?@BJfE)y}T^?jRc%@mOv$n;5{+0_2pnOuTk!JWG%+OIw@2oZe
z6-N(1ETc5Tlb|Rw1!*<|X*LHfQ`_Qf#a<6iDut83Ix7hCy#eX?klx`gn|{n)#{cC`
z=E)i^vh@?eYNTF(k{l?OKD>+ttqp{XQU-uCy$5Ijb9;eAdRK%<!*3@3b}{DWfBgLI
z{LE?m+YW<=@i;#Oya+xGs^>a>GPT?;-I{jr2OGq~PIrOV%fKch4|GiV2^LDPZ>SJp
z;%`5SG%#znhoSWwf6FFNb00F()_(yU<K3<w(z_f4S`L(&gU8;d9)&gEK;tzI5^4PF
zkAqu2hy<Pnnh^k{dC+X*YaJV=QaiBLsH5QaQn#xkcq|pH7t(6l4a*$A!IPGvAcdet
zA7p);@O!X!rDJKG2f@DOWt!~ZDpvm==2r<w7BRe(_Wfger@Kg6=a2N`4l@1>FO`tI
z2pvY<&j=nZ1TB7>171%CVr@MNnkH>Mz~8X|8WCL%0yc~#?kno~TYI5GY5d#4ZaxO_
zuNBPEpinIZdnrsLjeq@h(1IqAp&Z9Ru5ID}_tJ+E+%f1m3KHnBW1RfjRnhkLUr3j!
z?||CEJq)1UJ}1a&2S5W)Y0WR#Y#905zcWB$4CEW;mzIoaJ9|JS=dPN`A?}(?rGF>a
zyK6Cd{++zqUCK!JFGMXkwo2IkohVUw9i_M6Kw-;)(jdJB2MhllC<RSyx_(GM?jXR-
z`0~%>@9r9@;EC{^pj--T3A{Y;2VxS)R>s%PX*(OhmTqPQ731Bm9|B&uf_lJUgJc*O
zUn@eh{|<FfsbKgYTzY`o1&~$8FBkrroamuZZ_Zp^52`kKn999D)n*c7IX`H!*qqUZ
ziNEzC!%HVd8y5c79LBVrBA}ktt{PAW8WfV7pQj&p7GYpWKkh66CI!Hx3<JZ<G9DXF
z{uX<ta$XyD{?-$WY0anpzudrR!^Pif&4e=VTp#=L@*Nu?{+1^k<wiFA{4MvG%4KbM
z`CAWwGhDC;C_y_*1iW~DBfY~}=A|r;jX-*rvkZT$C+o|HOg7T|Eswa$`E7*xTe7%p
zr1)D(xnADkwvpj)>E^ca=Wo5hjbdHw%g(Q$=2x*yTIa{K=7;s^X`SEGnxEIhW4%kP
zlOe775m#FCDaQ1MY8i$~=7w_(8x+!-pH-9!H2h@apK<_P=zUCUK41@WQ(ET_<ota4
z8N|uRV(|wjfAmy$l{}N)=`8Znf*a(7XqkrJ?ELN8-0(#{-O&6l!QF8aREdDb5H6pG
z)LEe3e&~mQ7nz49$9hTnE(4cUIgdb<G&mKnIt|K)2VV-L@o&3=Z1wr`&~$)0+du0b
z$PLbd0WS(pPd@BrA~@-K2dF7~<h25L>OtcCWDak+`riy_!N+zxy~|k;G}rO(L}_7q
zm$N|HZg8Rkuh(UK?VR2fEdXA%%m3{#M+r+>^C8e08qkzpz>Aj$A!#qI`LO_K`eGNT
zX9F%q7!H9)L|95+yxhkLiW=}r^E7!-I(vFB4YaxqB)6C|Z6^yj72aTEV0hU)d7rnu
zM8nneu3#CEQ;_}r^#0_p-n#7ioS?+zH(Aq1zTSW-y~|qwymY+zAqQju_{#`JP*Oe3
zU?afa@`u5OgTIxN3DRSGxthU7g1==UW4Wk}D1S>Tqm4L!O93M&sj)J?e9Q<+ZIc*5
zDR3{NjU<2TMfm!v4rhUvbHEc}&H^?f{OuFK?D}BA*Wk&GU_pol$j&VR&4X+&7D?}}
zW=b=>4PI9&A_o~Ux)Jaq^Z+;v1WKQQWx_zweChQLa2$fI(BlYr@nU~^hqK^IWsq$M
zqrl1I?Eb#vMr!FDEOJnDUO}7?@M6n;kck~`0x#dNqs4Xj!O4PtGNLaJyle(fq7)0J
ze{&XKEL8>7s#|>(O!x0k+X0HgfEPCVTMksPq#b+)S~r*0{D?no2WV95<*R>aW?CEo
zndy3Le_G^ABX&@vK^CRGd#S<>GwjB`125RqJ6u0N3<-E~d|z7g1OD``&<`z_N|_J5
zU`p=@7I=Aba*m&*z?1`NJHLQS!U`q^hL<}hPxY%{f6xSK!>*q!;%~qX89S?(?Cr0`
z4-t3Y1<E!r@32mm3XqWn4?SImge15IZ$7~c9fNzhX!2fvS*8a?lkfN&Fm9X78=%P!
zQXcT4ZL)2EI8)oP$zcH&j29;N2RJfboP04r#ujA5YwMm9&><~D7_0FR1Iue=Ft3P#
z;k6`)bpgcU2X(<ug0u6n$y$LLj69Qr12vf*G)=AxRAPECVRBud#N=IpTp(9~nD+v?
zGG=T5wNYN?GpFr*0`|HiGXuj*e`Zi{+8Fb<gff<k+Zgh<urk^h@wX^3+6a`G+8C5%
zznsQsW6Ix>&S+!C-;&R0W5VCs!iZGzwKIT<R`5EV=12ctnoSM}vaG*~sI9yBIvLVB
z&#QHbbugrLUIT}jj16Onf(=uNQp<r-v$W=i`JmyG=JO3{&5u5SRzozO<9Mx?*8DvG
zH8(<503plyS^yLR@4+GP>t<SHS_I5RX`MgSIwtc5JF<aR%UpakIV9NG{R-H_>zF|!
zglRjEfO%WNt8Q-uytsHL{g|_i(97kFX*;)orS^bArX5t%Bj>i%8<Xz^tFenlfs)Cq
z$=o4|0_KcqJC}g9fJVSyichu)(PMfrV{%T&gv<<3i5?8Dki5YyK=8cSHfK<u^F#AL
z_HuU{rgCR+;sG`P+;*q69;h%*Z>asiP|5*r|8+VGfLtc?S~hLx46rS(ETADsloeP?
zw<qU^8ZddioV+m9jOoh*5XD$NSs+ZC>Bo%8wqf3k|2B7qJ!fW0o3ObcN`P^5Npv?0
z<Alk7;^i49Y*tK&W}jT0E?obgp&_4v;Q#{zLq-k*LplQkgHH|vgGCMlgH8?usBgre
z!63=N!YRPOumitZP!A*ki&_n+xjabbf@TQ7YU|Mq#-^Bsfsw(1@dN`C2M5>@4h0Yg
zbL22EBr`BDyvb%@xRK4ka3-69ft3WcYz&MH^$koX7#PtEK9LPEcuh6~!;EYOhMsH&
z&=foa*u@|RZ}`u^PzZ4Z$iZn03=9R?3=A>Z3=9F;3=F&s%wPwzfXrR+p8@7zAE>zo
z*$fOa*$fN<*$njzd<@JCAV;7p=7B2ykOf!Fzz<d%$H>UR$H1@v;Rul0#S9D#SF#uw
z4rGB1W)Og?Wr3=NMKiM6HCgo##e!hP4;UFa1i%I(D}Kztz%U_;fuRO!un<%&3m&y=
zplXE~Sim8{0S$?U90mr^v_(Z0B!pv3vKSaVvKSa_vKSb$7?>Fpm?M~Q8LW`SzyLOQ
zvuzf?zLK$?k)EM~k%5u1fw_@|f<{nkih@UCiGp)cesQsap|PIP<h+^E90t0^dTGhV
lmXjyW6caYnGuAcGO;0pSO)*O{H!w^yNSwTDrrX2>1pw`J$*KSV

diff --git a/pc-bios/vgabios-bochs-display.bin b/pc-bios/vgabios-bochs-display.bin
index 416036d98689ff7b567f34ad56a0b22f08ad6be3..1d233afe69c123417397453d3c6f1f55a82b2743 100644
GIT binary patch
delta 10142
zcmZp8z}WDBQ7v?p#mj8#vkd4UAr~a#>Ez3x*Dc03QB5o8aC%yIDMxyjD^J?N#{y~m
z+b^YY-bypP-FH|mty7GLF|G4+!*9kC-iF`IB|I&+OSm>jzGmCN_nK*gcG@ln1_p+{
zLunpri&{W5|F)BAoqQ9Qsxn*qe%N?HmXSBD^I6Y@z5{7H7}^;aCjVm8RuD;R{vl8z
zmbRaRfq@}yH;8;KlD40ffq~&QTiSlM$$?Cz%*>@9CZAza;^cPyke<fB-u2Dozf5X+
za9)~2+RU`?|I!#wq%|KANsCU4ON&p7J;cPIm)0$&;-1!eiN9sT<Zx#B`q^px+YY3s
zb-J!eYd*l9cJK!?h_fL*t=pd?J&k|6J0IBm4It4K>1o~ZEMQTAH2(F6(-=>rr!l*(
zNb5W{Cynvi-1IJY9vf!<7BMCp7XFr<Og2pXEvp!NE~It7o|D#mc+1@Mw9eQ$>1o}u
z8`3&&&PhA?khy+t8vphKX$K#$fJ~Z`*7+&mh0EVGL$H$;q^EVeg48pBY+sVzP&=Ey
zL;^$!lt`xS0EJ9?+Hu!4AjWI)v>nhO+QG)azyOv238d{~1chVgr}Qr0HEEY0rFC8g
zIp#muF)Q3V4yIjxmgbjs@i)kEQ$UVelh%1~P8#FQxghJ8q+NcIo~G=&VoqB20p__N
zS58TrnV$B&c12nzC~3GZ0U12`IE!Na5?l&fZ<iRRwSFrxNoze&qMz3Mo2is9t@$5Q
zsdifP52jMp*V1X;{8JC69el{Ni6d<{$ic6r(hM)98J>JC1g3Al=77m;WJ%*Zm1cQ^
zf9ioW&O>RI_dtw`57Id64}l!KAiX1mT_`>6zbh#CN;jmZF_z9rPiwASz`@@-`QOWO
z#<b3tbJCg*Zkd~Acso6<(|1LB8vnKsc_EPQH32U=|D>mNg9JMn)11@On0+^-HUH))
zz1njDB)$O@Yp^&=>pV0kjqz1l^Pw$s(>m)v1iZ-q{ZgC}WL`MTIO{)Yod?r8U(JE2
zg2q}W7bv7Rq%qz~^C<n0cJMKC&jswJ-c0NK5b#3$Hz?WpOMw!j?}jwZn`xal=A<!x
zm<vuZKYxJ&tsWHX{M+4S(ku`2_fBL$){&mp?al&8vmd}(j{iz?etiL?#9a;|4o%C9
zhrog|pd_~j#H<HfTDu|5@>8)0IE>OfAUckvF&;|$ej60HYZyut71KI@rl)m=ZUDPD
z{a1S0f8RA}jQ7&hx<f%eeSLkhEV}{k6DAur{+89u|4#6?Zkrs%t}P78ziFMPF1`X4
zE+8L<zL-3ZUCc$3vEdgBf6EKThF?tlEnN%^4;f21)6*JVKQJgTFr@8Z*zx~A$nrOg
zrKWucKu-Ihmfj_hW_Tctf7_?Do$L$@43mGeOEN!r$uwD<!-DbT<Nyvab=x$<Z=f93
z6~Zi(*8GSOqA*SKASicmUQ2UGYyQDe`e5<|4pGLk$;&uw87(G1;jne)UmyAg<i95%
z4}AcoXX&*4AUE_K2c?WBX`R<UuS)YvPh$>!@%lk}T6eGv%uC(HEa_>Tr7tF@bE+xs
z1L*-5LG6rv$3R-&q;=l^yeiErJ&if`#p@@N*Kit1fCD8Ut@9(qwjB&R7#IRxaDJcs
zlhc|HDhU>Rd3drbml|Wm<Qy&si*itmIfEnbLwc995QrNs1q!4O3?)%%`xzGe|KE2!
zt@9?>v7i|GkjD7w^}We2xzrhdOcvx8V~zXKoAzb0fQ0B|M{Y5WmXnnd&Hp$`C&zOe
zW`w47K1~Zw>pZNNwy?)B&GK-GciN5;M+Szp=HJXEu4y|LfY^oyK&9*i$27|e#cF!#
z-Ga@({+Eb?;x^6lRw++f_5r>$)<upC46lVjVSSMA_4zcz1FzZAb~J#rN2kS3{>Lrl
z==&k9`2iDuiz#DT=jHS?{#~hWIEpL#4nZoFw4E}bVr`!%xUB20{m^rx@7CufeK-2R
zh0=$#&f}BAcogcv+|mzf>78y$X@&>-4ydJdi`6jn9ac+E>kLx?@fY$iLbz@k5NkM#
zIMa6MFfcH@oW}sMt?v-TK2TNoA#Fd%(w-ZAx54&-OPvqkI-vQO%-pn{pyD@ee+vTx
zL(h#ks3M4?)Y7{hl==>V644vA#k&~NRR1%AVzumFdY|hXwZ(fFz|M93pq8H29iRer
zZztHjpz;DN9;^X!G^pl%896za*Fo)o!Q8awpPXglX`LtLq%|K1pPSZtse}{CGoPEr
zzwf}y6O(uH9+&RCn6^s+6mDMW$5;dyO24P4b#j1WtH5#c3_ivB%P{Y%b&Ks`0M(L>
z3~8O`(>jlVq7UTm3+WxM=hHf0fGoN)H{eD8|Fq5<Y0VFQq<6YLO7E<Fl77tf0V9$E
z%O7dYkJ-~YKeQZ3@A5rgDFsT;7xdD*oY-vG%X!i|Kc+Q5tWP)ck$sjf+5sYuxjtY*
zGT`TAe|~w@YiKSjaY*Yt4004y<&C)kFJ4Wa#;+hS<vYm2^ez|KSFf4V3=d2`$S>(<
z3reLWLXdRZ{DYZ)3aE?#Cpu7VleQDwP&ug9#kUje;pXS>L6veE=MS|-Ad%~7jn5ex
z7#K>^^%gWZPSz68um&eqNI=|~8}LH<AE-=8>vVmkx3I}Ez0>uZ-oh3T{UiOD>kDS6
zGeIi%e49K$K(byXt@BuVN9g7B4&O^@JHYlIP+OS5kk)xvtxK$(q2Uo@X}VfBUn@iN
zPmZ$Kl@bc25ow*r)0&^lAAG@)*8IR8T>Ug3Vg$7zPNsGK0L2N2v;H8c9h2617*x^!
zo112Ny+kmLfBnU@gTI*J)qhyp!N(k+l6>2NG|t0mo%avE=Sb`P1a&7UYR&$FDzehc
zX$PM%r+1b<f;+NXtd${+fBPqpwCg4Q^@q|Jf28qm|DVRc?e^q3f^v-OChr#17p(i5
z<_;>9pQJgwUYgc?L}jvpxVRnvwp&P1>BW%7zwM)1H=hs4#FJ_K>(7B2WNC~C(ijhd
zqnCgE<ut}iX`L75q%oeDJJ~>7vYsQY^HAD8aEKjKTd<QMy~Fj>ffuZ4%?}vUEHCi4
zY-CXDmfOS7dYivx8K~(L`bKR*63C(h0Wa?SO7C#}oW{THO5ZWHZZoj`KP<l&*Qs^!
zwJ=y*EGkv&HcMb={P$nJJS&ZV`)yE`f0K6b8Ebl%@29lphxgMWI6ta&@a<&KOYh=t
zIawmnaWTCs^fM?MfZCZL9G@2Za@F6ogD(WqIuE9Ixqc3K@#0@v=OMlHZfCB(18V7A
zPK<i#-QHY%2M-)zQA_V|VoZxjivoMjCT%y^XNT3g?OGYqJ8KW6@o)R3)-C46V0oRt
zIgl~Ex%Q9%f4c``TIV@XKtPfpD8e{@Lo(mN=gjGywU5#|Kcw+*`;gARzVuLfXX%rG
z7eC&B5>V@b5*Kj1q<6=H+AlZKnh*S+o8IaAB(3vBJtz@@4D0v|R+HwCuI+jVB$?jj
z`Zm48^<Y}_2ln(1*8{J)(vP_wWJo{edVnF#@LRfd>7n9cq~zoNInD4SC{J{S@IFho
z3O!gNkhZ%4RQO!}oyK`1y(9EMnqyk?Pma>N=^ZYnN7DbhK1p+{f4x1;FU=v%2~@xO
zrT4k+QcLgRNbm67ncnBRM=iaJE8W6(XUXj}_q4|U42%p6B~EFbKLTEy`Ua}%N)M&+
zZ@&Nvcu@0YPkK-2E~tx+%zeEU)ROG{(Qzof%k>~Acc-UuyB_E`1}Y^$2`sJoh)vpL
zLve|EgEanaHz92Za9kXO1phVu=6Q^1oyWoHo&(f$JQMK3?i<Le3u&Fdpf-U5FYhNT
z)1>#go>A*I1810HAeCqM*WXL;jC~UDBJwq;2x~o1l91j|E5J}92<l@Uc)^lZ-+3&(
zA(e;!wKF(A!SMiU>><Y!ESfHW+6S&r(j3w>KY(K?jelF|TTs+PqKPNX@b+stQ2aF1
z@-S42=%shLg9=`5kPY>qW+MYbn&E$t9q@3AI{^wy*9#!$9!XELtUbfux11rp&-DaI
z*%7t$E*6XQ4%Z8y_-(yi$_>h~Ahj1>`+*&d6c9!qL5g-jqWuRb;6g7<))13%Q%mn~
z;e7^40HDqcTt%zvg|yBOB@aM>@%k3XJmkvY^oKNeP(pbb@IS5jhyf_aOkO4?$+&;=
z0WlxOrpdhGvW)VRwZ%2--+&BA?{NK?-sLKg-W4m7-Vyr=k+-1b!xT`l^I0#wORnX1
ziFn6Fa5R2MYd*pQ>omUn`A@A|4pdHTzn#Vi>M+E<NZZZ8&cKk~Q2U9YgdG%#prW+%
zM_Th~h4ju?aJgt3`w`^Z+Ba#8{{vpI{(|KGGOo0X@6*#dYu}``-Y$`ZxBjlDce{T2
zygJPr(s+C{nMXp_w)0xYX+#DGRdDv-KoQHo?E^G*Jp)<c%8_>P0dsn%>nC^ty|9&G
za*Bir)9QDV5AusnUN6BG*%ix?-Vysby(^Xn6cC_NO#l%Zc6%6F|CdyN3UR&kF8P+*
zC6b`_szArZjzejkKhomhp&|7jIWz)ZT$(H)DW~xXtQypV<N-M;_A@l3IMSlwI=4Mf
zivY!!C@ANIzDe(jkN~@+D?&28BX)9+WQLvZ=QPdJY0hb_-}w8EF{HKL=I`4N>c(uV
zkV&)rUC#_osQl||-@t2-F1{p&^ezX%^bXfIlP#s>>pOfurgw#YPVaL46!0SOA1Ee4
zd{9R#i!r^+^-WqpT6kJmdYA9V*LGl;&L3%-htk5+7=Nb)r-h}14FG8t0c%c!>+1ZG
z_Wed$07NfHC&Z5GKWWWJ1bWlHfIT{Sl`PNX19EKjpjL8P=k@ds-w)|spc?9PdRH)G
zdY3m7JeIo6_As=5E6GUX-~LT6y^F2oK#5{{mn%nFKzf(!2ar2qHOq&97ZZPiyz<%_
zQk$&&21!qDT<Hz991JDW(C$y#!3P{^oj=p~Ww!lH<2<gG-f8ukv+qD!=MS~?4yN=j
z<}`=&4(7?V(&B8)4C()z87H5Yl5!3L*HRHOpr|Vl0Fe%Y0Wao!1m$Va@XGc|iL}=L
zCDLjB(475YZdw*YTIa`(TLCW~|4WN_{QzW6J$7^K@tea4HKz@14lEoYqcsgb*~_)l
zpuG-gwV1}g?PS`)M;xF+Cyn!vT6$*)XFytXTI`|8lVlu(IuECLzJ8pZ#=noT<v<BX
zz>6i5pUA{APMz!|YcFH)8x)8jw`Vb=Wih6OciaRuc?=H(yjVPWuB?&POi<=@{Q>pn
z50E!Oe&qX~7M<SZ`zyUG^k;gP>yLmJS(AUt%GC3KhCq(Feg-8$k@ODN_vu~EqUjy3
z@6x-x1=G8$B|zn<Gf#R~ut0i8=-bx+>0QAx=^deON-EO))BBv6K;6~!j?mZ8-UH*@
z^lz?jm`a4y(z^l}L0X^^Omow_T;Hd6xPD0Qa(xFb)jE7XAx8&edYA9p^sdm?0WZA%
zrA2^J5X3>QA0ZC%{gl@E;bqPLhDVGgV(DF>??5IZ1^3Iwzo1C8YktF%p4MH<0UfmB
znX8xH#ols&zhw%OjcTcITIatxY0bwN=Ym?b3TcK1UMr@7`WJCbps^jT$(-^E_02C0
z8h&z?U4G5q@XMg|B1okHNad|G!;=laa!Mui(!0VKK`frM=3`8H>0M$Q8DBG{xi$Ps
z;csbVs5fu;rN`egk+EK+;g>3Z>qEx09jXkVj?$$EFP||s{EFajnaj}dE1AFb7-+C%
zA9KKq9S>ecGdBDx=5Lwg$XIXG@T-8obroZJTDNuD4g;{>=?~I&RDfB%4?vaDF3_+U
zxb3j@?Mns5hF_&6h7G?eN?czSO=ee6VDfn|SyMrV#pcgTr^%iQ@e*mC0WXf<2lZZF
zynYGlwSP$Kyb<u?&Ex|Lwq_v7qWiBwZ6@CjX`Qz~73G_N7t`OQb^d-`nAUul<#l#i
z=SR@E6C)@@-570(OCu-iDoXfh+)s0U{XVVpb6V%Q*T&$1!RCW3pusn3z4R{TmIEcy
zpb!pt@&8_$^XoUTp!j$%t@Gb&=Csb!X`SEaq%|LBocl6q@(e{e4tHBnP$~SKyid`D
z-5<<(GWn;XWqlWzy#!QXDS*0@f6_YNfJa4PS*-JLT2NYGTE<bZLU75(lh%0yq4uTW
ze~8-fw6L_`wB|P)piWF$XDFyx&A0^C=JF>kIxQYN2K4YnTI&J+7ELB_qp7|-^i9AE
z-nV+`-R?|!>D~S;pt=TB2k51D#e=ISSh=3o`0qah14BJmTIXlA4mnST*X*1At96KZ
zGQjFAP&~Y8e8liCjq{UQr`Rq~kG|6m)PYv(5(D+vuBCT{zDYayh%K%8kwaSZv;ArH
zoS)P>#CAgJ?NYP8!)lAY82S#Ub)Eu^&HbON)*;pc;_qT-V_;D06iZ;>Uw?2;+QkQH
ztpC{=80M-n{CHiN#=reT8vpi_pmr2{-{Ca=Z9hPD^31gF{~^YKiqF{3X`LrPBhbGg
zBi{ipuH8v%We1INgNCHeDXVatOFQ_JIj!@=<X_6Y^$wW~pmxZmG|p3yzI_eIk)QcW
z6w@1OKMRy-fGCa<R!}Cg?>U)v@S#B3E{9YGhSySXUN{58YaTey9nC-<#@C0^c7VFN
zNLl_669YIlnFC%-oXn%DQ!nrqDLKHRSOV0*$#{^<z>t>l797JfeuBr-GaA5RJa(Yu
z*76h7gGtLs0S)0~NP)!)ex^mH#es8){vW-xg#o!~tp`d&K!swo3}_7M;6skI#*+*T
z3=N?0+LiKyhk+sOecG-+JPZtP^}5AUaxD*)s)FTUQvaY*X&@=Co)h5kk_*XA%TNW|
z`S(X!G}tOo<@E%V{8~RS>7{k^h2*BSp5$+NJXu;z(GqM!+S|0|2OmJ{9)LP;yb>UH
z?1EVYasyb!ACQVSX#weJ|4ScCE>M$YcLLiKKY5Cpa{UWi28PDpM>mwRrR{iZ%fOHp
zkjB6La9TiGMk832^bb&#15&}?%Ekoh4yAS1zDeu+H7AYn(A@Mcp`Md{2i4L$CMdWu
zFr+!8*@F5srML7JD7dv8D0S0Ypy>ARK&hQxmso^b8vnLSdJCf5Kz)}qRR(?rhO~N4
za4Y?TUYA%jR6Z72p7TOl=i%4<X}cMiL8HURT|Y3efEeAbkP)kc&zR<>g{5UFqy>ZA
zya4RxjPIaXlb%z3hthU9FfuTxr7iAp1eItH)Y2BKxP#I=|N6sfX^VB->($aa%?cbh
zu&FI-04o7?LLR6s291Ek-c#$8YjND5pth*ZaRZ0iqISm(0&0so9Mg94fVzSEz#}O8
zK_fG;!Mn5_OF-$T`TT#-pwtA%^fb%RC;ZL*4B#n==7WDgWoN)Yc&*q_|BJ0uT`#>m
zfC)TUV0pPnQZKz5JWB=A`=N+SFTE>(rQw%C2?xkSYU!Ppdg<L_P}QZ{D5^_kV5&=n
zKm(VcxB;mIO>}`m0MtWmKEU@f3EW?Lk)GB)`GAI%#07Au{r{R4`I46jocO@$j&ZV(
zrW?~r>&a1?I+~9d)Y7{mSkw5ofhJmNKY(f=!%OLD)}bGYdDPOoWCYR}Z>BlDemi-q
zrmDz4J5X+8U;>e>_MrSF`E~L;O-~hPFz3V<P-g2n(RU#2;A<AOPPv#|P)Fh5BZ0IX
z53MIhYbgf(0}V%kGDo+W0z=P<w1W=>(soa@0T&Cm(>M?7b&JL1wq7dXP20T-Aqr{%
zr)9)}Eph(>O1U6QKye(AJNcZJgjhgsn&APpMQjXuU1Ch2A(cyM2On`x{->2)4;kxl
zkO4KtK_mQ2SwTJI59NxWDKT-@a$Xxo{+2C_HcX{1FZZ*gH`Kmi;cuP5`cjt_#OC5}
z>0v7u1u;4JTm0ET3{L)5R<@Vb>>#!Pe@iu3P?W#r7Te1}c2Ii!kltOu1S(DfSo&m+
zfd);P(sqJF%{I)*)u@CmZ6_!@^&Ol1Mq5L)%O33e18JNmK!d+dY<g)6H70B7Xqf7_
zryYDPpqAblC6u;%9z@ygG|tl?Wl>^jyEmc<Nu}*RYCpM6N2R{U5fqWlznDw>(hP5>
z8J>is+ce9|#kT2b)~;`g&C;?j^Xa8`PXdjNgGRy?`;MulcM7C69{`n0c0G=u6qaWB
zi+>7eq~}r^=fyPV*E<>>GM0)%Ob`H>+2e@N)^{we`P6@qAxtk@ChO}eyPpBa*zAv>
zWRceSqu~i-zzfrRpn|*gK&fzAcv{ADu!_o$ppyG#D{Fe6>kH642{?SxI=_EjrPs};
zFnOk~BctWy+q!Z*1&*ND15I`KKAFs_r&jOGmfqp|D!s$?wOV?In<QxPOD(;_Pa4#x
z0*T1!r7hHPZ}`brVhid<f~Ik5pQJS&|NozX!SFw5=;izOhM&wO<}D{noxlTOpa9#c
z&%nT7%dnv|HEpLlXofd-0|&@78L*@^sF>K#1QM_JPCNL5DQy=ENXYQ^Ybj8mfXbrF
zX}dtxTH4OtAeq+NrEF<CA^O0=wxEH9a=EnTAB^R4uZ7a~gGC`)c7WLq;F$-|G(w;2
z3$^r4K2X@GrFVo$q<MgxA`9+48Fjcxr8m^Rk|?n&R{}BkOT0mpK>9J)*PubLHw>i#
zY5PHA|C_j9TY#h{7wIq2d!m-!8E2Gccv~&KBhD0Lo*Bq&^R&*Npy0CriCBUNE0BW8
zE(R*>|G-f-XL7!Qf{@53P-FZ<dWXAg`Z0GI|Cg&KFEo&=7jOWT39j!z@eR%hFLgl;
z;q8GE>0OZ`&A<4|JsN&9l{=^LZ#xX`6LMZ?c*I+33^6Q?f4jc`DBFZH1-uZs-EzBh
zcUtoS`?P~U*dPiz-34B+NN=bVU@DVIKkg{w&-hZ332YCf^-vF<PJj9QC%iAaa1TT4
zfs!krDNH@k6x?nB1_p+fOC<`B5vGP;%q60F>0J(NY5d!6*l?6_q%|LAPiubsBmJAB
zz~7SDdTHHe1&(R0-zp}gcNPkyb$*xw8r7H!ZbYSbI!b_37dRDtOYf|A6ahPn;bjXW
zsuTEI0{-izEd&{LfWO1#Kgbh|{H@mD0{cVyaR(6whV<hO5@1rspW&r5h5`Klp}t^9
zYkt9I!^q$M_aE5r>Bk*p{Fz@0GN$S7yx_pVkhW_RBLl<BcMR!WjsiA}B@#AFB@QhI
z_*>7x)e9K#zf7FmY^2R-I(fa3w2>rKrprN~<v<DBzY`@2ucM%KeGs&+_kvj_z|8pa
z#pFLm8cyK0!A?+0hE<d=*ZhSklksPKt&q0!2-rn08KJd%zzd7_a1{*Tem)ntxqdj{
zh2z=DYmK#C58O-da+bB>;cr>ZR9+7%vi~ubdxJ{rY{qhaP-*SNXv4(cdXwR$52FnW
ze`_gY+Rg}2{k*G&k%0l+uA4Dg)<mj)BfAYJe~STAIj;>nf9ozrQ1SF~5u*(kf2$5t
zTIUT&s(~b$xzBBc_*=|a%B^hp`CEdR%4KbM`CCoE#dxp?C{;R31iUc0o!;Rr^D=_n
zMu5LHhAC~Q1=!wdCI*I=M(j4y{4LyU<@`3n{4JANZR(}?TjsI8<Y%{$;cwZ(X5-J_
z%FK>t?SXIUUCuI~iLB;l^`IH~=7;sL-iBJ2SSLeT^CPab=2MI<2P&Bx&NZa%2hEeM
zs3;Xq+iwplSvo)1u$8c-?FV%x(>i~EoR`*l0_-zsP@$R@`*O+K^loPfxT%X17+%ht
z>}#qX>3Ji)(^=$Y78|H@5G~X2o1MQsmMsl7g#pey{4L&W9XCNK95fs;>rUS>wZ(o6
zeaF-~<dQ(G%HXsNRdB9vehI3V!J+?g@>x>}rAyDCMIdTG9|DbnY;zV2c(HvlyP2tg
z=iLra1#{%J0=U!rb+V6{zQFybX*)f@L3;y~mc1r-o5@Q=-vEzObUDL^wLlXZ&d(<w
zGSg-JHu-~@E#r>KdghLdhLa1-W$YY4T@S0C6VNV+0gTmnh=Jv`5}4=C!0=iE#4-S}
z_&`lf53pxyo=-kyuEzLv@<(%3{+A~}<=M*<%pjEx;gbt3BqrNha4|Wgf|vr}{yP8m
zORrag<=rP2S}4S6fF19`%)s!{f;qj*S-{4azr}>HT-?TxzlD?0#)!Ygkl99{#MH*1
zB>QD4qm3zliyNbj8Gnl(qm2oFYceALgC^a;i3Bu{)cok*OHszj?=39q_aTPt7IZSC
zbsksi66;_{>%0bvO>Y@cl_%Hmlc_|l<z%T<TJwYawB{2Hpox~|XCKm<&vCpq1q*_v
z?w);kEd=H?pAZ16c=REy^IBT-InLJtppJJQI8fF+O^Zy6fE8@QpsJ#Suaf~Zj`u-r
zQ3u28(#cya6`5XZOnzdi9;}tdc|mPaJHu<mw4D;*(AdZf>I<gr<N)(_Fhlcd>x=Yb
z&N4zTH!`N}`~fa4_Je|LA|qN>VS6&!-%5>r3fL`&Cf8Ug3OF*R?R){&!py?J@KSN|
zS}Q$y2T=D9w0ep2M0%g=J8;zjYB8}xTt4})RdIb0BtwHjs#vD^2YY#9TIa`xpG@VE
zY5d!MrX76Fk;Zv^1#hVrNS!yhQVM1Qr_WUv(mFr3oGj&mS52MH0w52_yp~Pdc?awm
z4;HZ3z?l%52hTi1;vJg&+FFItZ?b@mIg|Cv$$~a!jNFqOY_yqTawo5~@n)Pf`KL{i
z!mH>1|EI;sv!_LYf?e;wUPSJ%KXPdSdVQdF^^O~pH`o|XUSrG0*gbi-tsPTD?&jaN
zkt~}NoZe_Fnd%wp87deV7?~QF7?~<)1f`}ZcqEo6I2Yv?7b_T=>KRVX%ai6X(KXad
qOExi@JTXs9*j&#**FZNt$<!!0(ZVd%z|tgT^R7HM#>pSt4gdhViUw2w

delta 10357
zcmZp8z}WDBQ7v?p#Y=gcECzI-kOva+bn<1;>lQmVQB5oKSX$@hw9ZrMY2CgY>0Pco
zX$PMPr15XRoyPe&&G1{_F}1W#IUdG_pNu8E4L_Mncv?=DaBYx$&9;H>HPZ&|w4DwN
z3=Dk-(>&A`wSZ{;ZI{$K#U?INW$SkRkY;&s<0)B2-kuA62hw&hv@<ZIbv~Q?g;85a
zBdz&|0RPkjY5dy`q;(#jlXmfWTJv$XxoMq;=cHYHoW^)Kt@$wP+}Av5`&lR3GnKM+
zhki(7yf%3|lM+9O$$23?tvmEh8vpu3lOHju@ps35NaMVbp4MFp5<5OwkXe@FiF;b>
zCH|Hxlg*gr>*s@PN>A%_U6Iy&fIaQt4`vW&O?q0lKSz2R|8{r2^tA5MHEI0oKcuI1
z$FqRN1k(7|A5LRDk;eETjqw6V!-n)OcODyN{uV7J8y5bSdrUS={4M(!doHAPzMGTQ
zd~D0y^t8^>1rW13Kh8-z_>g&S8vpkC18D~zuz-XYq%neQ2;C6yLgR0m;Q^4TOVZQ2
zT|t@{K)e;{4Yl+6OVmM<4Yl(@!89lB;)As218j5oryfq@-*$UWTJ~*bSP1Q4Wnf@P
z+YKgnF)}bPblgn4{3xyS8puKa!4BFGoVE`vb1?1lvot?YWN%2j_%l7N(|1Z*=fOE?
zj5p_k+^{0;@(YNh;)ywF*$0?GqP|l=K`=8t?R)J8ko#tURd(E*Jc~uKenom(ckG5V
z#T#(tu~X6*Z=^w#r?r0LpL#Got+{pv1OL=REf-7V(^?OdNToIZW8$BBFs=Cq6aUmh
z9H&YJz-pLEInoR-r5T=l&5;K7$wrR!G|SK#AYUJR%#>z%0hDAoPo#0)NVB}gKlM;r
z{l!OV;IvS>B)!AMTqr&5zbhy-OV^~QF@oZuxpoN$e{0LXm)(r;C`vQDou0<OEks@j
z?2~{O$$!$*I@!{kLEJTIjK|WNe{+=H=>erN-!-5pOyl1Uj=;3e_jA&kk8hcq)_G`7
z8so3I^&l-90$#ZMeyPm}GBg}!rof-H&X;r2nh$Q7o3@LCfdLe?jGzRtCXMl9npf$E
zw9e0S(hfdmp4)RNjeq;4w1baW(mG$vNozi^Wo{bdp|sAMP_tkB0wqR&DG(QwKu@G;
zLZs3dZ-DFvC8eXk(sqL)7^Ko&Ce89NfA1Uy5C=(HdRn(T3n)c{T(JR^raM0cyy*Uw
z=KT5uNU6IVND>s+pyYlCBvdW~BJ1H+{{XpRLz?BGVu`fQ4|CF*Ef4&k3(}RI#^|~M
z<m&IY(^|ikD5Z6R5?3fFf4Oc5c%l9al;{{^H-K{Onl#2+uWwGi!DhhwoymrczvVFV
zzZ3ke=O&A?YuiCHa9Zc7i?2Yz0?N`a()ib32bU6z*Fnj-_CtDCFi*oTX8sm^#)e-k
z{4MVp8-6kIxAab~V3(1x=sN&%<_ER(E`c;dP!aPfZ9h9Gk97W=yp~;(`SDA^$tT$@
z9B(i+JY+24Oiycc{lK6AilOG(H;knYX@=iG`oMb9yF!?S(wZMJrgi>I(>w^uSe)0=
z9MYP9aFjltY|kOe*fcqm!<Nxy@?;KMH;C)6gB<-KJ*~6$2`DfW()Kg#`2WA}cv|O0
zkj#_Mt3aXA?fW7<jnVhX>)YvR-N7<&?-sL67Uoow2Nhk@7-3pLnet6q=l##C(!A0b
zKfiu3If~Or8e-k?w1BkEkD!qKkhX(i2LnUEi|yYgFX6Nn>@EeBhR4zZAmT4iOn%F$
z##lR9gv-IU1{AZ-GN26oA-&sKD!tS7O?sEJP}**W1^@qpvf~GalJLI6AZ5O9(mJny
zUX`Bq-}gfr<EPgTC--ovOU(P4)_jELwP0H3jo!2`Y0+tMY4K^XFO?>r=F;bA{>M=&
z-g2^XG84C9Ugsgbw1o~%X_kjdg3@+qI59A!HUDBR2}=u2>wKCPoVGgwBxHC%FRh!;
z#VO75M6sG)dN+6T&;KQ&Y5dzyrdeJr<w?svz?a6F<ix=6S_~8chxuNgPcuC5nlo*O
zi4z0EAtr{j=(N~FObnA5B}FH1;AXW8{gBrDfQi4wh%v46bb1>9uGBXi#pUUJt{>8N
zfvT;void<QvCk7kcHZx~(Rb_flD->Y1)cXNf8$oD2eH-CJDru%3=i}jP)q9;t6_kM
zrF90YfJ7GZFv0|!H6WI77ICKS&|zR;csZ9LZ6C;{zGG0kI`5_J2U!P>EtrLHHJ$fB
zMYhb`w4H1qC+%;E1D6}!p&wvMAy#!eE5Y=rE#AeDruv@|6zkdl`i`kB-UD-Bcd!c7
z)tv}ecL!^LT-_<g!}v04@@F0gwSxw8)0%&9mWhKag64zabJJQcm2g6N=5y2d_Z@th
zF*%a=xWrBckh46~kFjttlzvZ7>lDyS>lRaSnrzLdSPyDQfGU(T=^d_@({_NpeL$^S
zY!5^0rIN}t{_VfgI)6b+xGQr5UQGF))_EhX`N5C$PS;1E^nE71)AvdGG1mu-NUG$1
zq%}WgPwV{9a-dRDFTKm1&4#^PAgvP=we{&nF0#)+)}?p3ieFCe0P&8wK43!9e}D1^
zK6#D9X`R<loRnsGp!HITHK>GvD!wr{;Khr{Cj1KA<=;V8rgyo>zM5<=AsW*BMj@^9
zVA>8)`I^@F6O?>Q1Rx2z`3E!q6i^9s0M-yv>*CwV0IKWLI?tyyKYyRb`9p2dPKLD3
z>uHV885$TEO4Icgm^e*7&97kxO14nj@5~K&A@dJZ<EM4HzS3K0=9J#)`b}@41&IEU
ze$4d+Gm^?hpz>+5o`7V%Mq1~w^p4Pr=^efokUW^ckk)xYt&6Xnq2VDTe`^ziS~p)S
zLwcw0rRJX;WhH5ymk++?=(w2H{7@pj!}okz=l!(i=L(=go6GlnX-Hc0Bl)!E$M$KR
z_d(Si<6Lkda4D_x@|?8h!;GL3|7P03-^^+Coi{)g*1x%FmcL2_)A-l_Ogs3WIj!>t
zNc8{Qw1W>g(!4<p7Eq1ddHmpejx_#lH_|#kK|KRX2SR^A^``5^w1W?rK}iA08?6j!
z{M$c)r7!TWKa|G!BaMIi|MX7RCux@d>VncNC#wqzGZs&_7S!i;{+i|vD)yhGIlNvv
z`6HiX{cdm)Jgn9&=f$AbZRP_q>{}ZDwv%c6>py~;gK3NhK$ShHvCF^hQX2pI%V~_4
z(mF59Nn`vl7hIl!iW5j76`mHB7MvEA)_FK>KiJ&kY72HUq<6S}I`D!ut@#0Cn&l1t
zmU$qH_As=5<8PT<&!Dy-i2-C!z>DL*(mD^Oces8|<KK3r@3`7RFObAf%j3m)Y71Hz
zEG`tKsVz)ku>CJz9-GF${af0>$E@jHuAkDHAKXvlJgn9sx069Hy^F2oK#5q##q_Sw
z&!8L-4R#}_%$@%??chs+^e)%W0Wbdj(@XCT<LVPVq?X<lz^Iqr?Z?%3@W3G!we*ev
z#>ondQuS{f(mKz<Q*5_fD=2+{o%GA{Jb!ZtWAkqT{&ru+w9Z3F5ykZzk~t4PXHM^|
zeFSm=|F#eO>p!P=mOcr1G5ZauE;#^d-$5c`4yYa2eBl3FaD+jcHlPSEs{ag)s5H$R
zAi4A|*SF~%uKUwEkEb<%XHQQ%?s@=}*<N#`A9LN$kY@Nl&G4J$y<#UM$LM`dGdu~(
zFI^$L&(f_z_m}Xe?QZ}TPnZ9vasB}1H^;Q*pB$z4(mPyCkEH*1eUj$(dKb87Qx9>=
zk-2G%H$ZOQ0dmfPfESOyrSWgSk#_Kf07!I8&oyWZ?#SHqG)vzdC0c#Q)Y7{I)B9Yv
zsHJx?TO29@w>J-@r#03dU|?imDBbp2I?XZ7`Sp2FnhiaW-sQR<To!Qt=s5P88PvAz
zypYz+bi`p2lVrUKIPdyiPJ<;>NUHc{d7Qs_8n`j($`SCw>Kn*0XHfG@?$0!6Ec6{#
z>$U^ulj9(DM?e<GUglqaKfN>dNx+LQuRtlb^*~8NdPA)MLx~Wmi+A7!OL~WE{pIwA
zR384<PT*Jt1;LX!pd5xJ#@2&c7p_mz9MUvFrS%hNgk4T+{=lBz;mVU{c>A?N`Z3qb
z4CxKEJPeg0dg)zmpn{qkWJNusX_{vEA7sfHSonq>NKdn@J;L9&22^1k02MK=XVlWW
zSS->zTu*>vxAk@@PuebUr1Ee3@Y)aTP^2^<`4OaQ2Ux-7A0VHHo|t?}RK`;?y~Bm~
zSsFM2l*puYUPuE;ce<WP?{dAIp4M7=qU0_pAYNYw8Hrq7tpAYa4oWL8z5k~*A2FH4
zBstktOp<Zm<ajY3M#af%#AMl+KcqDuQ2<3CPg>{k^e$J9^bXgLAmh?IT;GA()}V|i
z0xB91MVZ_lhSuBsE&ZS}=(b*Z7jw&j67i0U;2QA;s2K&%%0K==N{8(S(ip*=!xw2g
z7}yy=A^VA;1XL4(OV#ER3NGoLuHeG4^j%u#kAN4tztTDn>7{o&bES8J9KydX_9LkM
zDU;sk`Yx^WW?JX<^lsNrpI3uhpRO;`7!SR^KY6{ltStYwTc82~p4&lnp#!K8VovXj
zo%~K*hN<)OWKIba#;KF-BxLG4Tt7p-{R!%AQ2HnpKzP?~4@2w!k~&ant(V@#-g2Ns
z8q_ZqfR$Z8(&FGA7W=OTDxtwSlkqmB414<n;uUwUH2(FU(?A_*#*3hSG$@&9Y%Bc;
zHZ47^GnNMw?XjQI7;l4k9BGI$G2}U@tP^{~k)GBW`X;^0160+0O7HTJOz-fWtS*`1
z8u~d+^KzOqsFT`vmLaY6Hh<qSP^W2Ig-n{|?|NoPiUp4{{DQO?`wppf@g*^&clf?Z
z?{W|XMf~KmlJfOkAbuz)R6Yf~aQFv`P;ep5cq=W7F}=(6V_HC3cv@I`m+za`c3_##
zA8DG0(!$die}k$OkOZi_4|u^0){M~A`6KQ7jkExWUXV_RvVuQp%|`@a&F;zBQlj<8
zIxeSo_<l(50@X^N)4ReL)4Tkb(BmWtDNYnYv6vQ+-sSosEg&rz9ytLodVhkv@Y)m-
z8~eV&Vk5nwmV=>00@}d>Cq({jr_(r3sHN+7GQDQ&JD`@{A(h_6mgbP&!3GbrZZUA>
za=`LJDM$J-Hiq<nZj6)vGD=PMm*z385CBD?gJ8gm>7ZzJ{QxQn3MD`(S2`_=A+7Ug
z$1P~4|1dY;#hZU=5ovytCrE45BXn9}(Fy9Yq3G-f>wNtH7HaX}-a^Aq_HtcF9Uly8
zoOE1(IUC$m0JUH^Z>Xhrx^M<S`xl^|2B_mQ*;K|%$TO|;@axCvY5e;bTMm?P1iY}F
zTq_gHIBW848GA;R$<ne?Omlxuj+c^{>@O=>Kj}TFkp7XD#Q=BNkGTOa`2MFwr+4}O
zO79B&ncn64Bj82GKhU_!pR~?5U`ImS2Wf*ezu`#hJe+>a^)o|yw}VJ}r|XCGE@x0$
z{FL5ZECC8VXP)$~V1e|G(D$w1(!0E6N?g<XoSD?p<GKXE-RS1yjB^_vGL;CarFVHS
zrg!+hhYB;z1*bd^A3PEP3h*Luu%&hWc)c0aU6xAk^8J+F6$&cxJ|G3<%WZ!r|7DbM
z<Vov%4QeIwfQF7-IrP%I7+MbSx9niDQ7x4KRRA1moyS1k9LBkzW~~CK3#XXIzwf}y
zGA2;l!C>+gIfZ&q<N3WoTIbJ(pPXf9U-LKoGAKO_Qf~lKe<jWEWW%qVQl+%c?~n$n
z9w@zogm}`Lk1^?`cZqFee9fHJ`LE$u3aHqvcWC&f$KNuOv0kL%mnwhjOUASvstlk`
zQ}2V99~c{cMew(*W@z}8%-?#BF|9NHCTQe_1=Q}{#~kn?>%q%Yj19kv`CBG3)|)r{
zD&TKj$p~#6gA{d3r|mERo96H!ZAS%|W%dA6Ie|xh(mHRv6lZMsRa#=$@T;Q4^<~cF
zE%FLVKkuh~zYhvm(2x;x%gIu<wC2MsuUXQX4|4>(2>A2TZt^$zc!_`)W%tuOK^?{y
zuU~@tNgvWWZv?#fIXPFs)*#@8;{7zw*PsTK?}xO`Tc7}b6Yyfmo3zf~uXDi#XY)bE
zxuE)((WbaGdh!DWiICg((wtwvPwV`g)_Lx=X<8@Tv)$6rs!0|UAptKoffT-hh18OJ
zpvsK{6s)Jyz@tA0Ks|#_SB{sKe<!aO7ZnIjYduiPmzMF{78J67{!GqNG+}49191*a
zUaDwWZwF>KfC?`KED5~%4GSoL{7DN+3rx$X1S<{(DdqwB3z8dN8vIAi4LqP`6sU+#
z3rNdo1M89hlNON{mDc$o;Kj=qX{`tNTdbKtd8QsTW*qQB^exC1utcj46R5^y0_7sT
z^zL95z4R{b^bX%odg)!>9O)gtpJC19w9b!djsN~LFfi0HZTzp+!RN^UlL8IuylH&S
z@Gp(?yIQB+E{48?YMpX>K-2<I*Y7we+}@-ed{)nv*8I#Nt@-)>G|qo%ogY9w!}NyQ
zPYk6FeFs5a{Ghhj3p9!j>1h3*tJWb09#!AT&c?u?*2$N^09M7n{t$RXnDsw91H)WZ
zh99r1LD|0c1E{;Cm);f4-ggk(>+1ZGHZ$$}Z-}YsY4ZHre8D}3nQ7mDLWb-EUS!<?
zHS-M*q_tj}oTRM6@jdO}KjyT~50m?pdzl!rCd;ab*UO|g)P5EyQ3g>QrA|F3(+)lq
zNZZAb#=!7e3eJmQV0g^~=Xo%I8atQLI8VU_9A0yRn)WY1O?!|xULchourf8^h0<+M
zDWCzbx6&5oFihT{BFQK_`IL&3+k!j>hO~@@;AoEg2_ACFZ~%)P0E@Z)1V?>_1ZYGl
z;~ZGb@Ml_NS{yjni2Tt@TPTn>SxZ$aW8V)R(1gSZP}BN-+O9u53=D7ey2VuTEDwQ7
z7MS=ysJI$PoU7*q*f(+_d1)Cp!KUx~kroX$6qKl*fKprQ4<^t^mPlS&>q-8W*OS+%
zDn{%B84t4QZCdk#51^h-=Z!R82?mCSv|V6#yoX7G#-d%{fEx^*C(@c9u!Dy8P8@u}
zoYwq6J}n@Pf7@A5?)V0_Ty?URnsWUdI|hcv-$yr;vZd{qZpXj?QnmdsC_k9mgEHU4
z@1W`&q=LUym<iNtO6x9tlh*lZP8#E(x#?X(JtzAPs-<^Kc;LpskmitP3+~L^(p&Jr
zt>r+eyWWC_ZvPIH+Us?RNw}x+Z@Z+oK*}B5uTf>-XJAOH=RBmhKpG@-K(C8W);;au
zLzcA0hhVwR(`lTCK~1v{ulYf-|AB#-fgx=d0}CkVugyt2_>5_8T3A|^LVDW&(hq4t
z>1myz57IJ1!0y%pxm%>?L|W%z&;*hLBLjn4+F}PMwX{yVC+=yTpox^)4{7!M>yN9Y
zEq>#!mey&e;<SNHZIOu+sK9)X-WmEpty9bl#B=?S-syTzZLx*Z1_iZ6R!$o@)D~Gg
zZ4gjfWaE^!lLypw+y@?!*$*1w>ABH&`}2~%8)-XIoER8D(dps@>IFXGZ=TEmtu6n6
z%2khlY4wl_jcIPfPqtEZz4UGmCeWxQNco2%alQ0z4iGoZ@>CI*UV4`YOT$lv5*|>H
zr!}Acua@2^ub1A<2T}soQL2fgqf`c_qf|&Qy_>)1T;DN}O0~33J_jezY{!$dW|jkd
zFXJXVXgEu>fP-zv*R;r&qD<gK2~LlklV@wVF~!<UeypLR|AGNDF2I_`zwH-ji24Jl
znliiuD#JdcS^g^KS4;1b5de({G5$<*di{K|g{G>=CVNn>V_*W2JHd9G`7*gs(^KU;
zm{a`)l<7cOBkka87PU?}nLJRLa`2Hr+K#C<lkaINGX9vPC1UGp3oa9Gr*R(E>lTyA
zYrRy$o3=X-Aqr{>r)3B^fD-Mm&!9vLG87c85_yvYwIn12^3n_ss4Ze+&|AO+8bY~{
zcJL8rn&E-T^;+5WBA^`jA-&5%CcVS;4R~gOwOkQ2TPMp}&TGTS-?Es|hN;x$<x!UO
zhT1nQ{H+sMUmCN5*j)TA%h}3BK}>f37ELw~gM+^%k?mz0JBTg7-!cs>D9YdRi|u70
zJE#ErkltOu1S)s~SU>~3ETCL7xm8<3)Xo9y&ja9waayMnn_k+&7n2WZYnZ-qPdoTp
zKrOv9N+@l25JcJSG|tm%>1mx&Vrjcm(S)SZc2_z~me*0KcW?ql6lmDoA3Pv(5;XJ*
z8Z5tFYzL}J-=taIC^kvUzRstY-aQF4px*rJe~CP3$f8pqt@!|`NRo4K0*`oFUM^)z
z+X*U%)7)QgPis9{3Yy`meUoPSqZmA->)?dY*LN(f`P6?lwe(Jbm$N4y(NT790LM?l
zM^L1vb^d60!Wi&E{T^hXp;S06JS}53ScTn3Q2G3F8*6%>>kH6~%1%%SrFDM)yh^W|
z@4;j}T}Q^ZlM8g^cvPG~BgYRwt(ymvXX&cdd$Xl?_`X(4@9+Z+`ZA|?xIR%!?{Je&
z?{a+uV#w*GEqvn+>dS!hc^d!vUuliU|Nm!T01XyhO8fpD)HiRaeZp9xnch(Qgt^25
zL@|^)gQ|NjTZRq%E!SBflZ<IQ^g(0wS6DW1fQ*(&+r?B5Dh+m6gM|07q#b<E1S-0o
zuz*AjZ@-q&OIrvkeh!00!NIs=H%PAaHmC#!X@i>F_#ZSlQO=dt{GYL$E6x2i8)T3Q
z6d-EpoopaFy$j+u3HY$7TDoV4o2*)TN0?N@Pl=MCa*Kwa{3VI$$6Q}Cq#tvA!_e>(
zG%1|sk=FcxEv@r7n0qMAE3NqvH;6su0BACnb?$55hM$u^=q=HEpqAblXOw1m5)`1O
zAWxcsOgB&K{H>PW5oZAsu>=uTAO({T>8r4B0>_}&<hS|?LeD|n``Qob9qzK}$J}N7
zUp}8KZy;BH1gzxqTTn6pXNQ+gpb1V$2QC1dF+4zhyX^%M>0J>b4ZoTA+g+HN|MBy;
z+cKr`Z#xX`KXQIZYktPd->StF@Z#MqP;u2E&(w0ebZy$fA8g=KDZSHO;PpJP4M;79
zm-VlHg2mDsDg>DL+g~%nn+yy0Fo4>8HyJ_GwtAphz?}jN3=A!oN)#cfzTp>hi5RG0
zWo!5e8j(I(#*x;1kUg#WA$WrGL;5!dfxrAMGZ^*Ky5&@yKqCVk-Hhp-5dvwT0q=tk
znCGU=tWWz6azO2e^iFpPNOCm1l=l5|dZ)Vxs8w%)?jA2jy|jfO(+===*g-?8p+bO>
zztw;-{kVe&14H_82MI7K<InIi8^c4KFb^@LHNRkUw_)UO{|;#orXP2Z@n?Q%$(XjY
z#Sv7$)-W<Ky!;H6>~avWVJwlbVJdNGIl$j~7%F_+LBN3jrTgUPhT3w{|KP3#HCdY<
z@I!*W!(H&@|G$$Bj6|iuZGj*?NL#=Q67<I%1eh6Lo|~Ltq>%w`JM09dci3dr%SnG>
z%4GZ*UpuGmtN=T1Gb3oOwcGVWz>5!{0W;SRAonvczE*^0n;q()+yt7XKkoVjoWJ&i
z$d_fmd(*y5z91;WdN|-k)0xTdjI>>A@1=J+%i8epx2#|)uLl+SzZuKDL4|$>V>v&l
z(6?u_Vd8JS$?(#X(T0V;wTLloCl9D~xC<0W;8vmT<Tzug`ep1koct}iOy#^b?EJ0U
z89~L~%lV8pT>Pz?OlXsw&d+Ux_*;xw%B^hp`CI&%%4KbM`CARai9T2aR3|t~1iZL%
zE4{;6=A|#YjR1dZBvabXH(>u)FflN^RA;x5=5JwSE9bWn=5Og_wW*ilZ<)gSl7-zy
zhQDPkn~gtz>kl?GYa70S#!8B1K%J51hxKWl-_x3(*TbW(ORSS2t@#mGTJtH!^oD8~
zhDzp!a}665(wd)DlnONbWCKlBfl7^!Y0U@hL2gUy`~k~T5}=6$+qdc6&JwT@5Vge#
z3@;~6o@k;T`SyBxr?be*BsP!(qGcL>v-7uyvZX<1H`Sn7&Y7*_CTNt~@Ib(exI3WP
zNI!<YV`?38NuV}qa9YMqaGCM_1*mEV2mRE^f~FEm)z6?Yk2;l{4H{V4<}4WSB6_m7
zsj0xHI~|A8__rN-tpFbI+&OuIslGtR)3lv`z~OoWl<1u%pEs3f`g48q2U8KIch4rX
zndvgVn`~lc%eY~3k(p!kM|TE>*Wu8K(S<zVIgW!b1YW!JoJiZn0P4b6fmxugjRB0+
zc!+`JwGx=;!NBlZ0>t_NGKde<$o>QN)Q4x2`OMWA-%d6)SLN3|0V)+=9$*HkWQdsD
zYc9dV$H2e<H6(3vuell%g9k`_@>z3^xI17EI5IOZyfk1=?{XHfG3IZvVJsK7G30My
zVYD&gZ_#A75hyXWF(}D?na5~j%HQJ3Xk*6T;>&1b!rvN$C@i|f+8NTjoMph1Qq7P4
zy?n+n+1SFOej8#eu#2ygA+7VgT9;S{Lt5uGP?S2$*f5qT*f5nSwHzolOKX0Z51zn0
z-;mb)=mTi>wD}yzYrVAQ=lQR>5wZdZS<cr2ps-MK1hw5%pQc5oMWjI|fzvvFs&!0$
zZ^6r`G5N2BB7Yj^1+_)(4C%+5WrSY-W}K{GsqS(iZRZ(q7_4Ik^&-=D?g8_*f_e*}
z;SRYMuh*vSTmu%|0}7@IjA(gd$K%PfEY;XOzz(pTeB4q|z=1Js=NzyWP=Dj4!sH*8
zdP)qS-Xdr{59bNcz&NOH{sGkdVuLt0t@Hb2SF7UsJWwVM24`q*a4iNNTHEFfYFmD2
z{>NVKYr|CTiByG^+626ax{%g-pu#x4q4onqDF?U)>vR?Xc~s`LY}(EVV7It}`#vaZ
zCUTy^av@|;^4Fiq*47G)l9OYs&6&Qvm>g?u#wa%VjI}nCOy1<5*4~VBC%f7tDJ*^d
z|9@JHJbPLcD7f|h>q+GO`XiSXpw|a#f$z96`H!{X<R3PCjBb<JZS9yO@;1BMMzU<4
z;`l>b$ym=w&rre0z{uFZ+{i*fBPcaR!6UIm!MP~ExLCo^SkGwkx?E`v16^aiv}9w;
i$rp3Qgw6Dfbq#dW6U|an%#zFv4ATq}H~-3YV*~)D)q*ep

diff --git a/pc-bios/vgabios-cirrus.bin b/pc-bios/vgabios-cirrus.bin
index 4ffaa43d6f826ceae9b8e6edcd72cdd3e6b633e5..f7b06f214c431bf141874fca904c99dcb87e80dd 100644
GIT binary patch
delta 13728
zcmZqJz|^pX$su%=?@O*gHwJVNGaV%2>Ez4s>&t1qZZW<Yt(Qs|-yLFNXgN@#{qIED
z4h9DXh7ya3UUKz^m>BripGxaIF(>WfgEZFv><kQZRT+L9Vq!SN#E=%6*7-CoEG;;#
z^Kg1vcPU4Dmn%=&!N&q={M#?3ao$QZyxn(LEv-|GhcT`5bHi`O65fX2%q2W6w@bJ-
zNWNy<!1tPIgLc|32L=X)zC&pqYKvMxH2=1fYMp$o3~AA6laH_qP5jTtZ0-ADvoND9
zBX3&gvz`lm2hw&hv@<YFwq?>*5J_wPAy6Wgwx5H6fgx=-h<q)Qwx5-Of#Ee<+J3gl
zQ<zGbnM*%R=4V#o<aYg#p2ol4_041lW;H!HFU=usX4?0EX^bb*nvaO2MW@B3#izv{
zVq(xs>lRZfOl!Tw-?CxyEN1!o*=hXS4y31bx~@rUKER%K@CP%9vmrgL+n*ynjeom4
zAK3g2Akh`+Y2EQGU{QfI{`H5`7*C|9F}tov>pV6mjq%#t^e%TE8)p6%F(w-p{+69g
zHcb32s~CGOq;<ZYlh%BA%iQ#|&e%EWY2C3K(mHR>NjvzExqfaM|MmlE2OqG2Oq!F{
z`6=Lq%ilCZu#*;~r**r6)H8r=Uy|NXJDa~m0z?UvNT%%og-m+dao05<#%uAk9nc`!
z!N$PA0G0p=r0rt_g=6QZ^e*2uX_p_RbzTNJ=0DgmE8IH{rd@uP=9hNyH^^~QK#p6J
z)_HJF8sp8mAnTW;U4D_CrtG?6PFnT>=D8qOPDz`Yp7y<V1tgKUE&&-lnTu7iehDsx
zt+z`I(^|ikn54BHDA7-A{>@a%m)87`sZ=|y`3F;}>TBsVZ~mzV(+)ml+QgBz8|2{E
zQfY>l(hN_&76Q|^Uvt1@HnOB~o=UU4!9Vpt8t0)j%X=Wk#RqAe^@l(XUXb1q!Y-7a
z_TLp0e5D)G(-=$Vq^C94F5uvAo&4`*Ib&Mq%Q<Py2e-^kGrXOi*6F(<J&k``h`bO;
z_nLqgoqy8Px<P`SjA_p4Y0SPG(wcvBlwR$*021E-iZxiArF9;flg9Wet@+TFxoMsC
z9|B(F|9&aX2r@4mW}Nk(w9bQRov-FVR6%2{lM58m8`2nWrFoQoNIUqLx#t3QQ*Wkq
zeh7FW{u`9+{G~vN(RV|d=FPOu8*|baKg<QEn4iBufmRQSb^h({GHI5F`FkfaAnQm^
z>vm^>q}dN(EysVQIlsODQsOQL5r?K_#zSC18Bmg217g;LEv?;<X8EaD1RO?b9uOVJ
z(ijh=eZLI~+%*g(ii&BSKhx7XLpOk3oc=34?Z5AuG{$@BY2Be9pT536If31Xqvd3!
zMDst6(#f;fU3fZupMXM@C%x14!{nFjUK}UV4nE*kWl)%G$DzWN)?ND~-Lm#miSguY
z4h?SR*f;5E&8{yLULTsgkfYaLE^P-30|P_DFXj^Uv>i+g3=A!oN@UY^fYJ{rucvo;
zu%+>DI|)$+DiMAn7jl!cIF;&i)w;!68Jd4_lqIi}P$-Q9MOO1e`GYSw(wZOGr#YnY
zZ~v6mc?uMJjC0fY*I!HPyqtFMH*;F&Es)s1xoMUMO9a#S*B=9w9pD7feCYq&w9boZ
z2On}kRsElv#=q@S8t27;7aaf7IuE6Fo-jC&)_j8NJx^LE$j2OM%_q3uPd>;lKG}+k
zpYix)FD^aC8IvoybTu!ebzVq2_<&uNfidmiBj(0O3`}X9porTR`gTql<At>510aWO
zKQQ?`mp0?n$-lX*Y|Q>aO7d_}S>ACtZPzVk28K6jyAFV<&f^_7-lgq22;v|lJAXjr
zCl_)Dnjb^elHTF^Ij!>pOjFwT%V~;-J5Ho=-hk+Nm)_<2`CVGv<Uk(b`d!DF85rKB
z?K%lEKaGFei8mdG-=y(xyU=kj?chTJkatx7|7ZB0#(5$w8eAwNITlp)98c@K46c1Z
zMTT3)2~ZyW04jJm(mFq;X`TR;*a0v4!2x;jl|bKdwe$|*H2!T@z%0#RMlkKnl-7Kh
zIn580ygt0%nihdn3xJ|vhr(nbK5bcr2nL4IOKFA&^wPUK4x}<Lr15V*nPz#alrxR>
z(BvpSm59#c0WaSCPU}3lK{&1R)H`@$c$3z7Y=bnaP{-l4&L06UZh@4ib>0A#>uIVC
zj0_BEouAYAw|!1y{E&9=0W&x$PFCcSst4t=Hvuooe}fF;N$dRdF0JzuC}A<qebaGx
z123uwC>}soBCAT{-}YmJEULP+&SRjA`X=CoHP|Km+YYB4d;qG?wuOF9<Ghg8`77<<
zBZ0KWxJL{Oj0_-=gU|WX8lN*TurZ`@{zyCcj3=$}83O|cLmDT@#Y|uqr$wekqlThh
zdKX8_$r2Svo@@BYTq3WR-W3GOb%z>$aZFw!;--GUU~XFTPtG!NaHFI7K=|CW)=MRv
zP@ehRH2!@DUat5!Sy1$JJvhOp@o&2YYeT4Yi+M4m@o)R6*3IVwi5vd)=RheSjqyMl
z<3Vu4gn#|zG{#G5ofqb$F`k%<<iduZ?B#XHsf&Nx&9u&IX`RQ@c7WR`2h<iMF<9Iv
zHR`wtin!nx75~#Z4+gw=^aGScKw0w#Cn)67nosb(2W8cZKcHOx_b?;U4nE^Z>-+(V
zhcwQAYU!ON(g8?rn7l<yi#PvIdRnJ53%FpsH2Jkyq{dU0a$Xxo{uWjy8|D(JmkU{K
z*!Wv#v!-?4=uP_q)BdvW)8rg+1HQ8i4Zm3UTbvjhele9~O<pB#!Mc;3fq`N2D{)29
z8)<H7&Hq?R*Su6>Of&ojw&TuZ1qq+}(+n_v>pxJP<SYcrK$m}{H9ufX`+fsdxL1S9
z`PvuhY2DQ<>1my{Ptv=Cr4GJgPEYHu{Qwep0}5eK3IBqjL^*9g!-D_+`;Mn|UIZz4
z^LZ7hj0fok72}M)Z(d)8I;Qirf4XQI|Mp@~<?=C&@mQMSe^3a&_%r#Bgf>&~yUCi8
z>Wqsg2TE#NfSPY<ou@9of>_1BKJ-Oe=kYmdjMqVJl-dvJUBNsJznJ-3G#SCc@B$PJ
z{4HIRcS*{an)V$4CG`(#>0JV8h6mF4w|z<jhfSL1!L-g#X_tScH9ulZ?+9TQN^?kS
z{=rfD;N|<td{P!6+n5?2GL~?rr!~5MU{C<noz1mx7)xzIVP<$By$htH`4J<+w9Aju
zIIqDBN!!7&<NtrK<*^^qIzOnTcQC(9o;+8|jHC90T6!n@OV!D@rEHz~*N46VRf?c$
zF7yMaM3YY257v4dR5CqD>%9JX6{wVA4t??ZL3&zuuna69x{E<kQu<<YoV1$aK9C-8
zyS0R|50txo-=uZk|GX;AD?N=l_QmTblNU=HNq~bgAg%KwsLuTWaw7vnz>7JrCx4K(
z=7UP^VA#RH@bd6v8yPjmipj|`4i+h(l;8|X39cW~yPSnU+-NCKq<>&2aYsb@O|WA@
zQT`!~@zd*jlOM>avvt2pYd*p=d7+a`y#}amgf{-wy2bV|fSTEj3~8O`(>jkqBDXX2
zLVAbm`Lxa#bJCg*T$vm2BJU@tplp8dBfZo0Q939E9&>%bh@@c8&$Q;p>}j1JS`MUl
z`JS(o0{QKNUV4`kn+<z84=71DKdetT@{yH&mfqnb`z-yK>jNev18RPzH6PKKyg^w~
zt@9dE!2)t$i9=fFVUW|H>Tk>qcyV$vr<{U-IM~|sE*IHXubI;f4@^F%Bwg>2wi{e-
z99HYLYh_69tUUxuaNt79@*02h4~FLd0{rbC89Gjb%MZ9GU4MWa#h7;R8FPAP>7z9M
zZHLqO*Sj79wLp)#?qNvpbbXR;9eb$Q1?mn^$khKxGdv0E3Ur0=K5MyDB9K<UzX8;i
zzx+Rq^GA9|=$<skwC0~2rT5c2Tx5@cvcZ!yhcxHco6-z#r*+;4cyZ|+C@MjY+<qbL
z;0pmzz0ebS0BXk(Q1)`&k=FXZ#5}#v6`YTDsHJytbe!lrrk38tmEPgIJ>AN6dkJrv
zb6VqX21X?YhSKG)MbrF2&FdX$POp!EebSY>2OLCc%|{$2D{@KJ>wt>zj#Ftn!GU#9
zt=r6t!SXYIvjJmzN9YBRE7JJ4xpIIi_A>!5B;SDw<W6W{fm^4{-$6~{^v>8v>3yze
zz)iF?{_TfAwdEO5N#=TifBhj)pn-xXt<&{FdP6M_L#4Q0dY2oUO+9-#UwT6-Pd%s;
zbOF>F1P90uP!NEOIFZJ`{eOCzW$YRLzIhDkeXb|e(z{sXL5bAxBq-TmU?>GuVIN*Q
zL81-jwtyG6zJcOo2P7JPfC?B;!>;uLs1E`vQI%bJ(hXc)c%MO|=IU#ev|SL@ztUPi
z@lQRJ_Wf3RnsO*ldPfLc)g6#E$Vs;3TblFa9SUmoX`R>8JA6N+cQJtK{`9V3#`G?4
zCRo*@)@`<jq4iryQX2pEZ+hunY%K>$q|>`xKcoeug?C&`?+OJq+X7xV{!5EUi+XJh
zYNiFeSo0;V^N?P8w;NY_LoEkGi8Qzra|PA&9BG|D)A+ajOyfMRmfmUgnvJvXKw9UI
z$%%^o<^=+vkarLac)|7=6pEmZ_x4H&Q1X#Z^M|IX4|CJ97}7dFcH9bh@$z3<#Onu>
z7dlBf2c>l$Oz(=20hxd>XXPin<}gCd>4BINC@dk_{6+y>e;<NccLUV0z8Ubsd2*>z
zIAhf0vr6jqZ$N_<=^d^g)4N;+(z{|s(mP^5A@Z%<9){N2{4G;Jjfu~C>0NRyw@bu3
zE`pjwogY9&8NBip{;$?82Wow6zn#Vi>M6#)NZZZ8&cKk~Q2U9YgdJ3J9DEF}`<qWI
zq<6-C0(s9i_9KX@eUrxcKj1~oCrDVAaiv{+52;UEZ<k2IOYrOI-L9WLuTJw$PXko|
zk0#e^i^_loU?4t4E=NE`(~VD)%aqiZ7q&7?W>GO=dhu!UIVH*H@bs=&j`WV$&*@#U
zJRskKTF(LqFWc>5X#HPO0ZR3H>0R<Iw@W0`(>hB9Ixcn`0<~P?;9izO@p8Zm&B;4d
z<kUdXR4M=(AK(FbE%q}sI5-f^!I$liCd+flh=8iPH|bpw5@2U^MM$Q1#7@>x&9L+R
zoThm?%{i_08-L$1hP2k({C)dDJ=AR#GHI5->zUIG|AYFrwQt}BbQfO|Lwc8kV0wq^
zo5?p-<?B0qKY~(pdY9{`fER)PKyd})gZj`}jOksjZ$PO&EiApu_v33juuSKVG|fY4
z;c1M&(}L5&(!mCRG>d>Wr@?h~{z&_NBP{@;7o-znNA;hy<|6{I_Sob|VS&l*YKFp{
zhtoV?KTc2M-^bW;poAmf1>=Lsr`2K@*G<+?w^w`*(!>MG1z8MfS&V7npr+-gG{XY{
zFOq(P%$po2EHZhHx}=uaTTt@<0Zqz3Ksg7LZTSADMW=W9{z~r({h8k7`Xk^)+~oV}
zGW9&5@s?w*pFx2llHTF^KE2CXG`++1U3!<dV0w481gNZc=1K1g7D(?1ecSp!y(?HI
zy(9EZNky7}dY>~BsEL%`5&9ZDT-AJxac=rI*EdWhLTc$<0ic5UEmVSOZhDvN`}7V_
zW5D$tI45=Ze)5C56O_Xl)4P1%rgw$D4tU}9FD(L8;y@ha`VrzF-%n|sA70k{Z+OI5
zB9`723hE%fhXrJOTI|cx$rClClY+qo|K+sK6QH&b2WUL4!}UX2>&X&#P#>;~8C2-0
zrFS_qrgyl00x_6C&H;7oKz4%qg1b&2dYho)4P?_N5b^O{n&;~+ljXUjCpYkM)q@(d
zpeEDl6^#5X`<T-BcRk?XZ#HKPcyZ+^$Q8SefV!*ceW3Bg?$S4E=^boooxk3I1k}<y
z+!)h#or5U=@tIIN$RHu+v|Xn_N<eHDP%Qx(V+D84cO7A_2X~2&g5*I)f|@WOJ6yO}
z!4(AyxC@#FcEr21T@ZC?5O=t7f(`o(8nt7b+i@bT^Vhqy&RbxofigPS96m0vIg+LK
z!HQ1=yik4)wFvB)dKW%runLjVM`?y9J5E6S^Db@Ic_cT1mAdemgH>{t-c(EPtaC^+
zJOJ{N6NqpI5iTIYH9d`gSLzE+{^nFhkd<JkLv3_@qn6$k!@&ye;xW!mJE-)SBaQRM
zd$7SQr8hur6_6qaaPR6pm^)crK#mh`!ek!-3C2s4Qw0?2!3w3J{Vu_@&Rg%(48Oq@
zs-<^@7$}3sS3m=0`p>{U5RuY*$SORTQR1uP#Je=ZlgJ8OILyHoa6$tH;!@7i+v#a;
z-C+MPKw}5&R<-ml2gbC{TkqgJCTM`d1z4bCKWuX$iYB`WDlvYToGGZl_+fIFpc><c
z$r}ZQg+8dIr*#Ia^c_%3Tgbx*a?<2$f;x;JCNm3Zx_{`o(Rb_flD-=takcbrXQj0L
z;3m~^wZ*#_(p3L5f|~ccp7tGATfBz>qA0C9SS8Ky0LZ{ju^O=8<YFOXcW@6S4V+!T
zNk=Wc!<jK{*D+Z1gZNBPH-pA``M0}%NXr0^T^ODWc(MISS`^5F$!~?ky*_}mB1AJN
zErJFtu;@ATD=h+~2c()2V)eVU#=|Vkpz)9!>1o=oZzcx{OVopg*uX<nY5d!7yaDy%
zz#~=f(irchS>CHl1vN4QUR-+&YEvJ4C6ESca%ErgP2=BoCN1+MX!0YC@f3JWAp3v}
zcub5H)a06*)_E}P;7^V;+yC|q3}tL-JMBTOXK)aJN5DWMR2?VYiM@N5=KOjZG=*$X
zfR1T_M&oRFK>b_}=m0*?T)p%z_Lc+uEmN3mR7-`^I{(c{0~e&nTwf@p86J48m<Afm
zh+_hcb8Ah0uc4sW{L-M|CuiB^*Zd8?3`#GiA9H<S08)7?&G2Nyubfhe$@ZF}^-O7Q
z4Zl+OTN)Ya%^QB{@wZH5tQTqcrOMy>kTGqCDg!8*rLMnx#@O&Hg1==hL&L9R{?=ol
zf#!Y80WTP?zl>&V_*Kl`GKsO?sNq)uf9op7^t5j4v>gUut@p2`?Wh2=u3iIYRt``=
zfJUlhpT1OJY~cP?T4LDntD?m9WzpofnhK0lCi7{@vZ#N1=`>kiD_%0qGvEdPHBh1T
z;`K{VQT+kjy$E?SdAXKNJxF%f)z_b)61TuvAmGLS$7!9vUl*n|A7*)-o!0pgH0I6-
z3PCqUo8r>Qw9b2=z+(Z;GDw3eQ)WnIT5vVZ`Sp9ycv<JU*T&#^lIDXDReI@NAVt!k
zKn{4}4pR6gZHF`@cr34`b^d$JoYr|dt@HbwwC3ZCb6+M+uG5y|FbDz#pTghCOSDbc
zEx?>7lkaO=vKNEdOD4<fNT`CQywZZw0@E_qfknY}KTldGsHlqllh*krE%v41<X9aa
z#*WFWbb=W#P5!5&ZSexs-T}3?Gj@Y@b^Qi4r9c7jBH%^){j}Bt{4K9pKn+D(l`sZ|
zBKb61mIwxh^2v$1!r|6TFU6SBb})p2oOk<QTE-c$85Y0OBGVdwA4+9lDB?_O{2i9T
zz)+@`mT?+1jF{mN%D|A8@dB)p57eIENozjw|79IZ`Zw1P9Hn_1{!c!qYgoVOOIlP~
z<G=q53=H*BX`LTnxeq)ln`U_6-Me>bZm;ixG%=O%rtN~{^8*1dp8eDV4F)Nt8G<?#
zBIe-C1}azs?m`RJ7oZ859U|c5WPLYn2LmWOgNy(7Ag#q>X*(G=H|Vi4vO5%ld{!{I
zM_+;CK^BP3_<8aceJ93ullSY3*6XD$)G16m_<|4A40-}7Khx7JOP|!KgIs*@0ccd5
z^L^S5@SxLyw4I<)8c;j2+x6Y&)oE_8FQx6^1SMo})%;#By}Ozzjeq-bkZ}+6(z}aU
z()hO@1M!}KQcik@>s!6_E@uu<6D4hj1IP#IX^pinz=6ckcObpX^~L1*26BuqChs%Q
z5qQf`s?c{(t<%nnq3>W?=ZDF^3``i`P1ZM*(|rp{>fjNb2LUgl&%^t<i+vaZUYxn!
zcTjC{GDF`%P-EHk-Q+66_#lVL;F0A^X`H9vC38dVJH8Ud^oH7Z0wo$Cilc-TR5aN4
zoCFV)?{es8V0bMB=QT1gyyk)PCTkn%P5y7ht#IiYD1CLF2zc@I8h9Q8G<(;4kbN#_
zyz<}==E*w7GQ8|*%?}0AnjgGR<2><h@<Ddd$?-<)^||1oP>|LJkk-TC0`mtGxF&2q
z!JF3k>wQ}1xwM1-xDXM-^L~TuyR^<<pfaCv?whpEQ)vf(v86RW0u{Mw%@689qscJo
zcc9T~P;&*Y{NPW{wC0CAY0b|V)3`W4rZqqK1a^`lm!!7<$RimKrh`(rXfP<fcz;cc
zPm4&)XaI|ufW^$ef;zKl86Uto!3iv;{535yEe>2LJ^HSfwlHAwE@SEX&J$_7e(*3b
zq`gnu^@oRn;jLb`Si*G6L#3*qpn*&MgGwcVq_}!cfFnpQWcr4~X}b=ATbDanm>8h-
z|NFEIU$B+4zNE#a?O>bq|39Q*@O}dutmS4SRKlN@5oHBdSNtU{`sFs3w2TfgH|0xO
z<OY6-7MS|9<_8kcFz15EOztp|=L?t)DnD9V!IRb@lee0fgsT){=mn3rbsS9lezD=<
zj1r*(FPPJsA24?uOxp#T8%w+V2;?EqXg_G)UZ*f^hX4ZugW6(+LQpV4Y&bvJ#ng>)
z!Q^gJ+4_Vya6&zh#(ARekXqW}1*xDxlouu-;oTrfaN(v08f^tt!=MqqRz@t-CrRKT
z+{WXeVhl9SRQo|My?e(I$OOxG&}7T8R0f9hPTyys2^Y{v&>Ow<u8w+;dcE|n38z4^
z9idNKPL`^JebD&>G{l<T75XgAOD(-4nDMn!TJr&&G}{AA3=E}>FBus1(z_Z?rZO<}
zoazG&%l!bQ*_mnI|AY0V@o%er3Ud1!&{W3%G!IaFhcUg!_gQ+M>$CJO*QX!>rr<RG
zZ3jWQ`we6q>Xce~r!#0Y-1P&fa4Qf?>%0%DTv+F(?F5BydUxnEcq1*X8>FhsK?>vo
zka3(K3qMT$Xr{>cVY0BfD&vRAmgd?XjlUP9GBEJB2LDUj0iJR)yrh@j&C&c*xSS_#
zKX|<A^7Ay#Ul9K_WH2z4-Uo#NC<Yy-gIht51k!eROx|v;tNDmQExjv(HI088Xa>Lb
z1E_vCyp*119r~e|M=iZeMj(yxW}4IMx08h}RE4JpgEAKbC^=`$11HGN$=()T%6GtQ
ziw~fz1+psb;A<AOPPqt#Z4HxmSSYFf`v;Z<PqC_{Ee@Ct>K!a%W6<joV*<_7TuM9m
zh;uTd<?Z^rtmTTJ#SogTkcp07MjNJ5mzNh=(i>{uv+%dBVtwh#3Sx8dw-|Dii-MRO
z{4FopKnza)Rxh@f{OlmM0Dp@D2Z$lc-_pYI@;3)KP}92$m_Qxg02a_#Wm-2=+D@>q
zY{Q&fjY`<k*mr`ew7z4L`K>hSzk_@YT4%v|0@U1gV$(}os8I-Ja)GCfnhz+=1vNP!
zOI?1Xaoz_>R`Kbjb<2V3sMi8&>77wRX}h^Yz}e$=8s}+{iYT$P-EwF`Qfa%5;6gV+
zs{Fm=(i#u_165V~mBJVpKvC5EQ=mj4&GJIAv|f6*eDm-BC0rnnbV{T(A7BD?la4FA
z2DK5>Knhhr3gy$XZ|dl!ch5dB+09y!aqr{|Yh_Q%5Ku8`^cECvX`LS$o-hWy(7On#
z^IoL29w-$~3roug0juGA3t9y8GK4+7&lTLp1_uy$4neP*Phs*EYd6LllcjAGMGY>2
zk{JK?<7xcs52Zm@#Y~Q{v9EVvOYd-f0;)ejsap~h5idYffNJR--k@>E_aI?8aJ}B}
zld;4JG%N`k)hT_D)_Cmye+CA_Z=lA*_ivz?LYtP8rS4E8x*fPc(=I#p85kIB88(!r
zrtMS*t@nxDzyUH+1}te^4-P@lJpXI&w1Y30phcYFx7Sk8bv>Z*eQ^HSxf`Um^;;=h
z+D>Z_6OyfLL6uawTw3!F#&WsWLeR{%3#<j4rqdi=v!#KDcR|6Vmfpz?p*w;l(mZTH
zZjns`mqgA|=?%3{Buebcl|T&s5^oSCkbcbd9Ygvt*Y^yi0cra|3vo7azqSBLO@3^v
z$O~T6v`JtC$7}ht{gVal#3cTM0>tnD)D~xXP|>E4*7<X?y`8qjH~y9j44@QLtdVB;
z4b0F{OYbZ;0QLJHfLKOph9^OxZwhjn8A!7^Nb@2)tNLtkwEubunzaQ5^M~|q2LVvb
zHa=qb$G`yVJ!*lvr?nr_JKSZ{kGaeEzjR`O4=*p=#gGo32<&tREde`_7Lb-v3pRG~
zOHhh~7<=47#-HIOHw%Q9#=kv4BE2i3UZnXKKY#lP=7!%){Ot#sL7g~oCC7Q8;SmRa
z>v~YB3Yuf&-|jB}%E{qO0WUT`232_-lbKs?mo83gK471A@CO^*39l!Btw0_}D*6c)
zN^htTVB&9&W`;YxI~F?7>%pAHza26iGV>gG>Y*Dnu;n1oa-bBPg2Ch10TSS~9nFW>
z(+>V(e$8*gR0>|e1Cs>JrdWLfH!!5mrga{itl^+suTuz$yzd{=JKaUnkGq3H;U&`8
zJk$XzL5)&~1Ad(a%`t$?+I}Xj6Epz`af%INiOGt3{?<Ash;P7Qi0mLx_&A89@vlD)
zT5<z2;M2#KoGJgn4!V72vaq9Kz12Us=NIl_0QEdXKsF!HOYdSxYkt9I!^q#x1hoJZ
zWy~)X5sroGc*F==gaoSH^}vf~nqRRs{9-IS)$o&}{3yh24Hcpc{H;3~)4Lo*z=M9E
zS}#3~zkYj#1Y{XN+T{mnouE}j+g#tLG5$!iJjCDA1?rEwf|4LpdZ#OB#uzlv#=kv+
zCB4f*z=pAe8|42K&;<5t)-=O!uf5VNzw`H{|4r|6eW8|~*3F&X;rlL)f7?+|+4dyu
z;7b9}ASGx$1-L)|uEXmDWXTC=?C%MP0QGRdozHDxqh$ZWH1Kab5b%Qc6x8HSW>CN8
zFw5(kX***;P0C%HCKoztGM)T0d5)u&|J*<DP+hQ-A+7lVKPc~gNbhhHeAx(EDF%tb
zmIEbh|4x)BypGaapit0qpfpHtfnveG1EpS&P&@7*z|8nE;Ll`HCv_)<0tSY(ouHx!
z)^vC&0yPR0F^sPj(sl-bo$`_qG%wxl`XS)OKWLyGcaULVoV?IUquzkIyxxY5zlEEr
z+#6KWCNh@ugO(JSG1@Tkx1MEq>Bwlq!rz+Bn6~o?*t8l@4-%Ak`d_3UcNSq_NI&i@
z0VV~&qznVY%N|}EPW~1<rgB~zcK+7mjA_lM{=Zz$Xv4+dYQ==II-x%H<)rI2Li{Z+
zIm-2H`1xC|GnGr)@bb6r1Xs+#BA`U;ED`Xc|MJUPP8)&rE@v73)?n6`_n2&?`CC45
zm-E{Q^S4xS+eq=Zv~s`v#$zMH-!hxW#-G3S6{zQpoX^9)g0zEjPxG^SP&cLdVOl+6
zsz9uhA+7llS6cHa#+Cz>%nj!n()KGbFfgpBC>2iI4<7dE{9waY!j`rlG$NAL`6Io<
zSthOX1hO6RFCZ>P7CU@ovX+Z_{ic)Yoz5aJ{lW7e(J~Fc+4<X@c;JI^kZCyn7JZ(M
zo1h{AG}u4;6sW9)bU;Ht1iYwv+Xu?<p&!&b#rzohj;nRZB{8H0r3I&DOad3FxsO3J
z8sHr5d=livgD*itT~~V3zUY8P6+kOkU(P<22C1!3*NKGP1obtY1p{7io}B#0#YE8d
zQU|CFeB`wPc-6&&lan1?<#fI>pu}M8%VSs5yPO4E4wQ)eJ5idQ-sLR-T1d#ikk<Tg
za-XX_WANm4u9C)CM?qQSA4}<rmp8cJ_6NKOI-2I3*8H2L^!3XFTxmP6fD_pbMh1qL
z3nu?{m6tHQ0G@*Aa)!^LfQJ4T+?s6SrpxZb1xh>dlQZ1p>us69Rv&!GoYwr1BW)LG
zc<N;eBPb=FX0Q?9Z~4Pu!@=JQ8Z8lIU|@K;n!!ebzhw(!xu}gOe@h{wjW~ZxGb1Q9
zi7~$Xzz9lEOBq3l>=dJoB!BBY_&8^Wv%t%poZzq$uo2;JUkheWW^<RRe|Q)a`^6&Q
zQ3S)=;Q0p;xinBG2b5(F9R~YVp!6A7CJYocmtOBc80F0w@FMhZdWW;%O9zmt+d)P}
zGlANApboax;l9Ia=^ZS5ptjvlfznrLJ3w9uc%cZ9P<In}$;p}C<tzXlssYXJz)Lh|
z$#>~p&Jr)TGEBDhkP*<o^|F-#Jni$%S%9%rY4Qtq1sjFKkiK2Oi@Aqd4pgv!R?~ud
z=gp7!)4;<uFYiHC0SN@W@Hh-goCjYCq;~|1zHDa&nQ9+)I4$y}4F|*xpmE`MFZDQJ
zW*Qwj@PfVLAjG7A7s`h~MPbXyQsx6Mn9@7E1zzr%JkLW?V9&j@okzgwpqhz+;pNH6
z$2}_89U4K6RL;q6o(3F{F`-L)C)asu@<SvR?gb_Mmv7i6`*_L7f(Jb=L&6o@UT8kS
z4CxfVf4OP$drw(LhsnHNhKvG}?Y%TPK&k^?JlHe2z)Or#c5=IyCF6t12fZAl4GS3<
zUWY>m!WV+ps~-YQ|G#$WIgz#tWbbP$Fbg!qVgO?`9%5j5tpw(Qv`c_k1|Sw6sO7U2
zoJ|khnH=k_#wa_v#aoqs#THOA=;a3%kV=Qf$#=XZCSUO8Vsw~%+gqK<p%5$}<HNzT
z1so<W%nS@K6DAw@Xff(cj`mR&QDU)K$KSe@A^n)M4C6}?mVg&OcTb+=qsRY%IsLe^
z3<KlK>&yW!_UxW~-bY+z7c;2Pdbt@amEZs>yp053E@1|jjLi?~1767PpUmZ}E|Jd+
zGLQXbI&<1i1F*%apvZ8a?CIOacyaOt-*ArGV86V(Ia%K?i0$H|wB|=lliU5A-Isus
zZ)64yHKpyG0_N=i4e){Tz`{EqbA?`RWK7%H0+!kj^3X&^v{Hrl(qut@H4es5P_*B>
zG1=Z<LBNqQZD$Es4>Jn`!%M}<`Tly04wL8kPpmHjWxQa}^yRi<ndV>Y<%wyXA8eS)
zqd?-`;I<)XU~k(2aB={zUJQ64dnv8;K!tf)=f{?lr9AMaVyCkJ$c-|uWz%+MfUWaj
z0naud7wRu=A@L4PUJ{_fH2?YJQvqg7OCEwK#>B~%f!d4_lT!nI7+-AO6zIjwlr~}V
zpOEvD?}v(V8pJU$Xv8rvC`|qvD$e;JmVtpKj)7spWZ5ur&IBk=VX`d>FE&h^^Fa(u
zWi3b!%2Sv;7bF)AliQ2Jy9?q)!Q}pe^g($FlV!ujITPSKTM!Rwio)dBaB<EDkuZI=
zAUP;cVe(v%Tm(#RFADE2NF`KGVe{W`DYnVdaVo576VfJ3*z6b=%|3Z{s&G96!-HG~
zh64-?3@5S}7}6OS7}jJlFwDqeVCcyLEhuGR&|r{cVBr*C0IfB{rxw(i3&5hb18Qy#
zlDW*FA!m@<dNhNvDQ00{WN=_S!NA190d~ZKJcxrcvKSbW85kIRvKSaFvKSb2vKSax
zNl?qiz{pVFz;uFv5zSx?sKGp03=BUq85rJVGJw{KFu;Acfq@|*AL0m*gVPuo7%pTo
zFzm@>VAzn!z`)DE40bRJ$lL`C3@`_;$%Hs~LM8)4O(p|FK_){z10Mr31IQ8RigTcf
z0}zTC_`z!97#TVE7#J2H905|hn1O-8B$I(b0b($N08}jtR4pv(kk#^J)`MNaAP83c
zfRT|y0BkU_;>QdO3?DKW817_1)Cxh>vfxq619gNj0}D7LIG`Z`nmPbYGTg|3gv1_`
z3<ic384L__G8h=L7?>Fpm?M~Q84Mad0~@?KHsie>qwi$j>GDdZdWL$23PuJ-rUoWP
zrV1KCsVNE`i6sioMft_W3Wlb7hLiiIOLLg$8tSDbn;1>rI9*KGT+cw)KsP<f)F?U8
V!YtLm(j;Z_t?6o;1L7Vq0suy^XaWEL

delta 13754
zcmZqJ!ql*V$t!e~&&wMDyBW}d&2*56r;{(kuP>+dy2aj2Z@pB)`0fxBL(72@leEyZ
z&ZlX?X`P4Db}%?FF#J1RVm{G9j_I}d#6<DTwCJ?hLre@1MPVRi$I?14r*)o6PwV#O
zNbhpxNjvyVAdP?f?KIBMX@=kWj;W<}%JDEZ{A4WQZTQJt!qalHglmK3Yqkx1ubDPz
zr|ooLU|{GwnC79js0BpxZ@Z+{Db~s`IiFp0;(I=}Zr2ZKmIpU6$};lyT<ANHwu7Oa
zfg!E)*<>vyZ5@rY<{tw5QxBx^Z#$6Id3;XV#ph|w$JyqlbsnCRcJXl<<KeXC!>n^(
z^Q7%(om|RP%GMqFA&v3c<hM*p{2(Uhh4i%U&^KxP>kmzqU{>Srj{T6vc_TfoyA~vN
ze6l;UEC)+rTI(hLmMfEUnC0u|gKSDq>vUa_)_j0H?cfh)5NAz#TDLz(dK&+BcfRzr
z?$R}B{OdoYr*+4(fW-vT_}3p!V?2?@_#ut)0!YJ#^e%TE8)p6%EhZZl{+4@8Hcb32
z`xtvJq;<ZVlh%A}%iQ#|&e8=CvpPS{NjvzEd2Sm2_WA>92OqG2gcqbSf@}!g5b#3d
zZ<^r&kf}@3)4E+jnixR573mGN^Z85EL6Qx%^FhHhC+*^cwB`eBbNQzpPUGKpdrn&R
zZDv>q?O<hKU`X2yCU-G1Ffer7OuPIjt@9elLI1%H+7O(!4=i&q?eeoUKTwo!NW1tm
zJ+0GsN?PZ^IcbbH=Yrg@BJJ`Eh@|3)IceDkm_eexQ$Rs5Gd=Bl?FNwhW`I?8+?;%Y
zMX`QGdRlkvhBU<+aOJU6(im@~L6oPpe&e5dFg>lgb_N6g)I%*7OXSm950pryHUDGc
zpL#H@`3DpK)I%JnN(I1bm`XX)3@@b_o_x)b2KLEDj`TFk&>0|KAAHP|W_baWWH?Wx
zao$L?yv9HEP+I-PM`_@+P`V_&!^K=EJ?+0MC^Spgq^B{0;-R^A2?u{`%fFZ1jPNK*
zGrXOi#=k8@UI^@yfEUSs($hNG(wsruHEE2;(wcvBl-}t9r7_<%peRh^-wuwzw9fZ)
z(wdKNnVZ&mXiggAuetRgEgJ$}xcq*p%?L6y9A>7#pR~@GbJCg*Zke05i-Umy6t#??
z1h6KJ@nf1->4&t=&vViaK4zZVb198~`=zvlk66+=U(88sKCoqO8snj~&YMuPU;F|k
zMt>;~7nDFxq-jE=(im@m><1;KqrcL2gCZED(p@Ia@-Tnz90m{vNn3haw>t|cMT1<i
z0hFdYKLxz#{*~tZ`UFU+yBtUo6xX2Seh4H~E(0R#;a2|uxnV<^<)LDUw9XH6(wZ#~
z{GSWbm7d1vx&h?s@3+%hzm+JZb%GLCC@6oqZU}gx{tJ}o7-Khpa_yQl##^s%PUd4b
z;%NTIQ7YbYvU0Kqy9;-BDNlN*>xcAC-)EC&uzPWTNIUp|Ta`f}t@GpLSL`aB-L=os
zEo(oOm`#@8(BSKKeUrv`I6bY|^@YOg1CzZudPT+4cCauoFf{yPE>ZY)D^2o1TJr&>
z$zM1W*u&F6C0@{EaZaWBQnhZoR)*&P9A(*Qore#;=1A*2me%}CqT^Ot^CN}yj?m9(
zouAUVLO+*!r!_y2PiuZ`pXQv#zx_Kn&YKT0f;@aJ?cguww9bp52>v%W&GJTxU>g7W
zdua!MGpBXl1d0Bin|AOaN19g}|F%nMoEHOLF#k{MJe1Zsc>|{?W5nc-QsR?uatbo;
zoBWznkFkHU6ql~%0Z;<+eG5`{@DY3CBL>E_gAbTh8JN;IL8<LxTJu4W<=YQVF5uE;
zG@Cq!%gRRWAEZPF`>^A1+P+)Npi=hJo3xz=z^qem(mIcK+<2F^>mV}&!<&x7X`P?m
zq;>vC>pV4Ch&xc^JjnaIK)MiGCKqyx34+vc-bm{_^)9{3_4B*5IFOs`J1>I@S#X%`
zI?l|%&~f5jTI>H3)wEqFLB{tTQ%mn)egmeQ8KE>&TJvG%H2>Gv(xTJi(&CZoq2RQj
zw9dnzjK;ss8&vrmNXueO>wGmQt@+T;xdAU){-;Hzce(yd?{F4P?{@vwR{tQq(^&#k
z=KM+Pe1l{X*#Bu@*OhXlbskUKbpq--u){!!Qo8TBT6!1rJGJyKXGSo|^bYJYzt;~i
zTo#nx6(E}45&Ad1J3ylCQ+j9Uzn)9!Y4!ZuJV5R|gmCBIxdAV#|EEQwx(Afr0zp+V
z|MpL5(BL&ZkhTjHDeu6wEaSa2%X|EN-3)2`+fMgf02eWE&wrg8@S^iyS`;WnxPDE`
zKHv*tg?_6~%e(|?1c0j}{%xV()3Ptg%mHP*#zPGZ3=DJAIxnOh{K1jd`0Kwt149{G
z+75eA+0)_rJ-x&ATY87<S8P`8`Ii=v=KM16Kh&uk6re8cP5S{38gSF0^H3Vo4u;90
zJle7h5ey8am(mOm=%sgeEJ$TwNaNprGR^W-DQ6n%qRDf4RO*}G@PI0d7wKu8p>IGH
z4XD<ueUsLCdIckY%SNU&{#_3^_?wLw175`a0;j<vpahiO=lTXz1AS0S?_dNaRgi#M
zdWR!p+OBgj1t2~X)Tt1Mz5xj_r|migQUYR6HdGd^-+dIE1#Z3RI}R#%KxVpdv8Fku
zHUDHOy_g1y50Itr(mHQ}ER6*zaOO-iJP9tFn-4S2?KqLv`3WqKYy=nB2+7iiX@<Ac
zI&TEL*!3GM?F%x%MN&D<Ij#A(NNMsDkWsrq&IXxt>s{Ke^C0(u)rNxAa+!mT;w-(V
zmfl(9kY;#5Exp6Z2}C%92p16Hnx4kLEA<5@e{(D&$i!VBM}rM<{V-WyMXvr9s964>
zmfq#SnRf62$9pKZJHjDthajkN(0S`UNMrL)!BV!gokF078z@9vL3&&`xImiHI8UU3
zlz{?Avh+&Yt}`H~HvYcC%s=H&TJwW{X`C0*b{%47V0Z^LzRN)xtg*TNgdkX};WwzG
z)Y7{`43xnoU+0H_7iWK^xurG#6DfTFicFYp4`!4Y1QjHPC)4(ULJMJx3x_$_4v^zM
zy@!U?1DFvEY2ctRL%4`Bt@9Rw#{`Nzm|_Q(w9Z?gf`x4^M8)KGRVBtZlUJ!KFus|5
zT2)Q$jaquAvr?MjfxZK3Y29Kq3?S#KrKfcUtAIon@-Tt~CX1`-Fus}WqNeHorsqcA
zt<OvPZh*wq(z~6N()NQ}#mCha?_x+({m;n25b$Eh@4n+|i}x@<6s2_st3a*jgjz9q
zi<+@JC<QY^O072#l^xEEX}gYrVgbfyg8Bf|EaTtq`X()dfsuhB&G2Nv3&o#lQ6OcL
z_0+|E-++oZCWvNG;syB{i=K*~X%QejAk~ZztKX$H9%cb&8gOI!Lz?D~$qyAoVnM}O
zP+I4)fEP2qrga|NAPlM((mGGiNdx5)aQ^9V{k}mOB76&6&3p)W(E(DN)_DWe_)Sv<
zITl=ueNSV&0IJ&3W~P1rnHCA^G1Ld8bsi6Rq4hPb^Y8{9P%Nf(-UBsY8RvpafezQt
z8+akYpWdW*xPAiJb?Y5SuH)baS(r=*sCoP`t@B5~i$7n|IuC-ZbNviTLLgS?Cr~2p
z{FHX^kw9AGBL)UW29UtPXZ&e?jn5bu*cj3{KcpRe%#+smn1O+V0o2Ys_<#xOOmIO6
zt-U%A>7{pZw45waPTK)$cY!)ca(d}qPHZ+Dpq|EL0X{eNg9dZcntyPXiG!Qi%?HEh
zrnO!w;e_(c=ce)RJNQ!M_2gQ<(@vlO-VIJWht;~}ycpEF&3r(G>bErhZ70+C*M9_=
zn#Onl)H((A(Lk*V{`HsB7%!!DUYL`{_+c(M6ob<{TtBDrZ@by>o4q_Ut@B#i4zQsI
z)D|Q$SllSJ?zjo6%>!Ok{7>sV81Q1rCs1A4c_M8m6R4a3$4BQug9B;JC-~Ajf4xuZ
zJOK*4wB{51?_oxz9el<C3QgC~X`IK@(mP9}1JWWOfy0y*J6TFVi?<%spmt_S1Lgkv
zlLG}JHNLZy^V%@-x3DnTFqcTZ+`($Y#^1V$HLdeTZ`v1#=Cs(CN^d4#5-{Mqz|ioE
zg}=p-vEdg}N$z9;K?{!k>>&4b{+#S9s3>|HT%NF$u6!xSm}dA5Y|YKd&4NDl#~DDq
zrnF9QCF1%f;6?R6kW-z7(z|@$q+R}z*8G4m?fVT-t2S6BJ*~T%B|WXP_C<Pkwba4)
z%;}xAPe6_151@FGPutJ1;QxP6S;W8H_eomk_s^@+yg;p=7io<DUf%(AHQs=_EpJ##
zC%yIu8Cfg{YC?Ym#gXBEa3cIWIax@X>D2Sd6NJ<mcTe6Sq-_W7qNa78y7&sz@Q0Yl
zzy3P7AIx|i)M2arklq!{)9{O#zeS%B92W0EVZq<hJ6T#-M#iG=0IXCK0M%mr+diei
z11LaPlKJt=f0J{BEy9m7H9TZ2;Y?3!bp61f0P2G@*S=vabpQpL;Q@%A^sW$Qp|s{l
zjA@-e(=-o)x{jRJ(j3y7e{hsOPTRq-<NtrKb+sSTIze?7`^)^vKZMOVK(%Ej^Gn0Y
zW+Jw35KmnP`Q-yBM4x~fTncIX!Mcy9bzTI?Jo&r|)D7tNeUYBV==<dL?ew(nU>SHQ
z6thg;CZZ+}>a#a9!nA_g0&mhf?}NfVjq&sA2b2Gb7)e8{JDwJh*7*@!vxD3TDr=da
zPIecy7VM4%4Feob3xJ5fJTZBKs2XGK<n5vkwwa)qa+U!#PCle}J4>a55=)n}P}*)#
zbb})F14D^R-(iq4-#2NU*FUdHPy6rtA&v3V>xYx|#njneJx*&r!UHN7Cl`ou*Mr7U
zKn<KT=^d_@VVOj&TWk+Q>!p&)H2&?s(mH=ZyLMOR2E2&;2`UkrAN)w~bbSQ!-<kAI
z-zVwETputZsao_it@$x~TIYwB1C^3`>0Rz@HtgjBX`LU^njh4s8@b3n16h~e<tlzT
zy#vHM=K6pMNq_QWesTHm!^lMd$Vq922U;(cSc4KCRPl|u0Wa46Ksf1HdS~g2^kc41
zV6Fiv`27Rqn)EIg*;i@JM-(RKvy0c;q;;NyjRL84%e6A7b@O?FTC=|_&+|9`WN7{^
zz~BCf0o0v=^lL$$H~azd=)vcp-1Z3MAO39z_}3o>C&~Zmovu$T?-e^k-3HQ;_XE^)
zF+7mo6~g<h<x&ZM+I~<=H?98i|1{1YX`R=>tpbkH2k9Lyrbj^e;z^oAn%nEGAQM4F
zCB*V0bJG}afFgYlxVT7tk;cFMM%uv_0wA#i={=#lp#AkDbJNo-efN~8r}w$;QcLd=
zOz(3&0O~kc94g^Wb4zRd2dc+PcPhP>Omj?gehq2`r*(en0F4jT9!T#>J@A?tlqs8!
z*noRX&2MzlI*+Ay_?}3E74Qq8!E~IzSrR;I;K~v3;?Q%DOD?2!enRs6r*CP{km@_E
zwy+gcBm4m6uQQ-hE%pTe`Wxw;u}{(r|ED+9@-S42=%shLff5RLdP6EtecFCThI&u~
z;TtGeF2H<yB0bHr^bCLBJW!Ja-1T?8pqAbxV*m>1*8inEX}iE7%)jmSYkNp^LBbFe
z9T&cVRP6vOxcnoHf7|7>R`9S4s8m&U<w-Yi;e7^;k{hoT(@Z)qfXdz08=#>Zn3@iR
zn)@INkP~jfw=}oOQc`O5kgoW-^ezTaeV^VH%$VNg&4kEcc6%6F|Cc1B@o)dHm)^zR
za-c*yEeuq<r3G|cOz#T)1TKL?KwX=t*OuvBuAc&4Ec%iLs=B+~xzZbIIT%VL`VN4S
z;K2vr8m$ysqZz&C>N~&!GHUWsDSz_{0Z?c=2nM|P_X!k7A3#Mzp#-RilTOQGNbCIB
zaSIw}ALa(Ucnh-8@AU&{0l_wzLz)N4jD=Xt0F}KcW=udfV~;eq5dXHDh>Qfvk&csZ
zN{2H>Og5BJum1=dzD@6N1+{BS1=71*ML;2j2r0Qe46V2MTlzuC=eAyY7jw&j67i0U
z;9}_ps4Rn5z(W7kz=?DFfiy<&(BzA>9SrOY4CxKEpBPF&#SyeQppf3_`Uw;)rSH-#
zLCvk$Pmqvx=1T7bIfQ>(>_<=t$)xwWzDw)8nbvtdz1#KE=hfgU!1YBM<Du90CuxgL
z-XqOn&A;sys4xMIkAO$OKpwpD2{byE-WmH0WQ{8asKE%b6z(lhcIf;(IZxJv?ae1>
zsU(^j4r&3Vce!$af&dyWpgN*d0Isncl5*;hQx0g@RsfuAK7$56;@}}7_8;6HgLK(%
zgVIF63)#sMa&j6U!FtluI%9c2E{y$@#&{dV<4B8!>;8T_4Kmhaz{@5W`X;^0Ln6Jy
z_fvY8hh%z(@8ll2jQY^eX_}YQoIyjSeP<ccT5t3B9Rm&BZL5$;v;1Ap49eWlvF=}K
zyTGlvLuy@oNet;7zHidI90b!lTtB9@{x9VQjY$Ng1*e6*E~~Rj>->?Xc{nW`#0NEg
z(z`-GL-K&bKTwo|_-Tx{(ju}L)4N<hrUj&hgL04Wo7Z+=DUkL<Y2j&%zY!*Yau73E
zcN$z*=a01SH_`$idO<oNmK6M%d{;qY@*R0oY0tFI!>=Ewr}6J&Y&lTE5%41FW}4&c
z_aH}r+N_fu73>+8PHt4NXS_H0pn?=*_~bhZMq12oL0RobS{4I5WBiyK@PhAuT6B7s
z@2~W((4XmDu0H}^xKFlFl&R-P>pYx(%=I%vdbfiJco?zE85A;~(z}Z#K>5{~C%r3J
zAiX2>ee1XME^nC<*YrMTCbje~0dTvk`8ea;hKEcgLTc$<9*pT7zVD&JOmo401@Xa2
z6O_Y?z_~N6^T+GWp!StidY3pTPD4TY@B?ytcIsqBC28m8H#}*buR&cU9?*EYD~Dcs
z7emVd{+1m~Hmaqd(JWWcfEuK?lYY$gg+iL)f!B&@{QC~PEMo!<m>W#)*HAF%JfGJ5
z-XN{>XTwj<va_%G8-5v-o(8Em0I9!{W_YsUS5B!?TIYArAT{IM$rm(4>zUI!|26zd
z0p<RBhlXEz{4FyX>qQ!Vsq(kJWK7$k$^dFMt-AK|17pLl2>zDU3=O}M`CHF1LWeO~
z=7J)QIp9V6wU?(D8-5k@w@hTLH*fe=z~8!(F|G4H$SRPcZt1ig24KTtuchs%0JDOx
zrAZl{gbaVDb>4U>&e-s)w8XICS4D~I%bdyinhK0!lP74(vIP8jX*YSJX1rv;i^*5h
zJV8ym7q4G}+D0G1<11OOCTnWhgay2?yPD?t`ZH7lJnZo%;DzX`w9enJbJIZcEubM%
zP$kG{Q(PJi?LtDF2lfXf0sgp>=KT77TIc7q&U3F#Cm+-jF_Z;`cEF4CAelF?U^#dN
z)EnS<&79VG8ZzE}fDzO@cjb6#Ir+bq9LK*vQ0V>nGg(#Jgq<x2#5piILEDnu5zKCw
zyg*w*t@#b8li~U&EhsH8Eu#i36Z{91{6V!cWE}IQ!Q{KzK8$gbwRD0RH%_k8(Y62$
znuUHy3rNf81ZzqCofe-K0n+j&;Kh*#X{`tNTRyOWh8S(1gflRd%ct40gfTD_O@62&
z9Oc0DQkp4k$AeIilWzY@%a{c=L-==ETw3GrMX3x7MVx7kzs)ij7|ImWGLC_U5i)o}
z85q(swt-c?`~`AgTJwqjFPmA?zqx+kC@t1Y?{emu?5%59zvNz8WLo3D{|pQa^)fvt
z;A58`({_o(fvjx4mll=g_WCwRCsPS;+AdI=Db4Uez>6RE^g#VCr8L8Ddg)yv=4qgw
zEU2HTbr;;L6DfTGngiM)0!~4qchhz-fW{-h13m9ST8qWfHviORXJl6>1leRenO$Fj
z<3JXO{qfFZeSN3;R~xt?gN3jGx3uOH3h(sN7V;FP9elwDDp#I>nm|wLbfJ}hTJs4`
zh?e(hJ3!rlz5{7HK^-Pg;oI%{>htO}x7TOVc5s3^q2O`I_j>8w#Y}1Z+mC^ad!U!z
zUCollzx{Z6TBnxl6HpzS-r@QZ6k?!?=oO^yNl$C6eFF|Oj=lrwU9N8?OBu*9zL{)k
zpd;{-p;V#opjxMy7icoI^T*^;0~5wqlUEtY>4Gx?sAC%XAmGI{M4NlD4@1C<x!3y+
zsx3}t=!1-Pyqf&gAU;T8GI&JxQX1ze(8v{dpsAtu6<>*BdPD6iff5Z6#ZkfvDmUzV
zPNp4vD3G>Gp`U@_wG^D!$iVQL2hN+k%usJ~ff(ClTO;=Rh1VdX1_3X&Tm#Mir0oRF
zyFi9XIuAly2)vN-gL7#I|8b;so&b+2@Vwt3`!22XH>fNG4eZ={lh%1E?cgt#w8lr^
z7G?8;deDeW=dE|3@tt3w!K*iE2Y<4sH9zD@YktO<#`!U=+5N$%G|m(6K#gql2?fwF
zO6S3}&T9cL{$2&;jm{GRF9bl2JO-Zk-3gkBgE@5ae?u7ombB)F0%^?;-b0N9b#1&w
zKw2{nOb6wM$Kd=R`xTV?(lQdjVobrH<i`0mEg~%{En^Qj-w1%kzJ5uIOp5~-S~tGy
zr7bj=Y-lW9zwZYRXjTR^n4I=LZPy<j28OqK-C_>YEf0apYnb>ysJIhIoU7*qIPT<3
zrf)b59eGXL4I27Q+rh#FGVa#<v<zvmt(jla;?j1oP5S>IG!VOi?OobF$k6wvH#R~g
z{3dA`8enx!U(%vq?qNyG2m^DCzobQO;D?Q!r8Pg0fW{qHTIa3FtS0h&2Gc?1Olu2+
zURt-9$z&rFlW3O04g8RC*LP{VK(@T;IC$VCb6WF5=7yilrEHrVS`JijrtJbJiOY{b
zz5wU(gO3E%(mKU>3e$E7FfcHvEoLYLh0k<Q{`mm5<<{iACT=zjkl6%8+FilWb1JR#
zA~=!maEJq^>;q|>C;ASlr7dnqO;0=S`a%LEyxU>2y{Tw@EhCnBiP*HxV{_6PkAaFl
zP!V4GMlZd4#}bHL-$5<8Cwl4K6P7^)KIx@*b%2znclbUAu~(&n+rW<*N|nJL>ihwk
z=SuTZOYaC~eC?3dd_X77_5c$DLup(6%fAeI>0J#gQyCa~PW2s1<KG6JHhlt0cK^ZJ
z__zH86+AQ3zW-12P)qM{W=!w#1r3frP)qOdW&*V)T^~b-Hl75$XgvuUm}UkS{h$)C
zKnz;%vd)F%JWzf405%qF1y$GOAO*4>WIQKSD6P9d4yu)FZrV;s1_lP0F0hKpQ_NHu
z-%Q?RrX9Qk91WH?_**0Yfy-miC}(<Fw(kd>^yZzQ86V+t-n7o+>0Q1b(k?$w<NO60
z5BmTfJ`pIr1_~rlY%5F$^;$r~tvkdf>zeE8zhF>H?+Rc|<KOlR)Q|lD>P#A50*wxR
zNVEJ^%n#~^3Z!-3Ph<R<=Jfjc<YseK;nZMIK4bu;`HUQJ!VQ_c+uTce6`0NZ0h9|t
z7N#A1&7#&RXMwQOZ?cAklKPK-U|H}$ty<b*gXy4YmPKp~dJC99!xb0O4nE>cGdwUk
z-{Q9MHCF!iFASg+9(t_&?e`c!W0vKNpj94MLCZH>KcsgTfFfvn088Jow4I=8ZSn<6
zjryY?H-c6PaGn6o7&x)%r7h$r1T(q7Becy2l;);&eos62TmU@s!1)^_8O5iU)-4CB
zmtG5~rFTXNrR}~6G3j<1=V`DCv9#T9(1fJYb~A*4^TF*j&YK`r^<Hvmjfeh$s;Avd
zVW2Mm$=3<#4YluC_*>7hyewn^vAOtLI@!uaK}>f3mZ_{D1_ytOGuz7yb`V>Dzomi=
z#1Q3gxx@A{m_4oer$C9EUV686^Z)-PT%cLqP7BbaI;ektSRu{wLeU*i1X^AYELH_8
zmQTyRsiT+PJ$u3AV^)fc*CxNPQubsI0hN}#Z$a^t*7>2~31h&E>`S10|01pRK&fzA
zSXzb>Sk22fpb6rali5Ji5}@)O9KdOy;Xl1@K8DF5)^3c;CeOB3lySWQN?82ckAs!~
zp%v|uFIwBzd$6T<_`U<>C(!5_Xb9msC@V;(ce%a?G2|fa0sifvv60#bY5eQIr!^k?
z|DS=u@Ea(>fByy=wP~n*&RC+C-cb9Txx^MkF_e0MvdRm+^lk?(TZRq%Ep@DrwJK>l
z^cff!URJYi;808NsCSl0+XWs|-(d|BPGwCy_>Ku&R)Gsf!~d^k^wJix6oT>)s00J$
zue2SYHD771|4Z4@z}lcDH~s@vj^$iw&Hot7xzgNTv!(3=iGV^$ExnT&M5lMTz5w|P
zx-i4<!2h`*t}Lj8l4|%VQ4&;c(eRVMBr*M%>pO<@W3KNR8h(P-7NvQlH9ufW>pTYL
z9!m2{YktHHVox~$TGPWi_qA`s&&gi4iYog+mFFgb4IHoK)AoUu8*Sp+!1`JkVPKl!
zx5@psVvHXrFSFIQ_|M;RfdP~_t2NRL|AQGiYU!QT2B6&j0K_s%Gdu~3Aybe`%|I?S
z2QBvCw6kKj1gD2RlfCQ|gatw48nqwNJKSZ{kGaeEzwBn7Tx%y=?+sRy`Vy3`K#}s{
zr9NndjVpM3CIFmEJwQV@+Y2PpyCOsyelzj6zhG+q$IsvXkSUFS+hK5R$N3?x`56a)
z>p7-?7q8EODx!|VOf9!d*QOo(!3J{bhxAT&f!FiEHXwKI>MMVO#nKxp1eo~S`;msG
zpaU*7pavpjhIsK6P;yG^cKwjv<si^<pi~*6H;sS0gG3ttdd%j@q1PccOeL=1riA0=
zw9bQIr)e@l^mTd&OkQp;RnJohPOKl(JKaS<9a8X89Y_F3fVFmi0(Bslyu8hre%wLE
zpW&qvraSjDf`>OcZv?z}b~&x{7+B+uOQ1$x>jD0b1<+9KauBd#EOB2^&)?b$74pR8
zeo)5=?2IsxG|=1zXhGABfEN)TLB43Q{rA#`5p2u;OCW&`JI2YL4vMy%{~!(Jz5{9t
z_b`BZIGiA-9RPKh)0$tf*)a0Ae`kP%0LVAYFD)6<c4~myU%P51Z*tURTKsqNT}Lhd
z^1pC{7VKn5Ykt5FiOCLk!I#m0AqIfsp@i+<i4uj^QF;p)3R(`72I(zeEckbz6g1D{
z`XT+eg8(z*ORc|?!<^Jp844H}(sqLK9jwxP`R)(ID3DtiUpuGmlmR<sGb3oKrQ7vG
zz>9sL#yi*~83xAJiqH(bLmgC78~z8E2jH9!UY_^z{4eOBA;;v~PCWI-%;ohqZ2T=8
zOy%C7Dk+Y!oF7yn8G|aM*0T&R?HFxX_**j=({^qETU-O`$AO|z=VkhFXAuU5^yAJF
zU{U}~$}ljztl+ib<ZrQND(AIf=Wjj2nAUvi|I0OuHeCFz=1eH_arLn;eeT%^@weRP
zDA%*$=Wn^iR4!@5%ip>OoVS8Sz~d?s0WT76y)5Rm5lHWHmf>&pWPSON$wr#L<pp;+
zzl|_|O98iy6n{%K_sd5-HZuGz6M1a>`CG5?pjZ|AlI<I)*;6c&*7-55`C&b%s!VQv
zUJsAPF0oFAwB|=#Y0ak?(;KQ~7%G_?&NXaMNNavpQ7X{zlZ}7M0dP_FF|GN4eR_wp
zOj_p;<m}4u65?EBG2^3?y<ODn(=ViVI*Yut1CQfH%QXCE=WjRUfzRc4o9$s}{l?!S
z$J22Wl-oev*no?W`Ulkg3;huAV((kfL}7R62enQyKZd^JY8`S(3~51W!D$%@;9}|}
zc+v=*=6{?A<>rGg1=9GpUFl8xq5~f;^tlL4AgI%#;txP!<185PV&D16vaTj^{5Ly5
z?aCvs6~JTMQ!nVHcZYHH9a2m0W`N4DfvQi#OX(fKGB1BKpapjGo%AkeLC`4hzZ0c}
z>0QnOkmZA*yx;t6@)}op#tW0rxJsHmKML-Yvy{Ggd4vlTHQ;5LU|*a$3SQ;{l3K}?
zwsQeE0p4I_V0hU%S;9?T;_tQeu3#CE*~lTD^l-Ajn{K@+7bso%F_!z;u=BS(XDHVO
zHL+GRlykHk;BW0@cwKD6%-?Fjl-}hn0A7IE{E!1Oj`T8u5tM#UGuR05xBOwS;oxuO
zWP&VndAXXwMuNX(A!E6yjVOOhDx-}!e@g))C=IeQzI@CGN`{jdK}l0_FQbhlf9pl~
z0*el3ftQOo!J#Z*Bf{T4ZL*BJB2)B{$@cEDOg2X*$GOXgns5fZIDa_3!&&g9CP?Y_
zVv+RjY9`nkpe=_%>&rS=<iNoqQ2GkusDKx<Arfu^FF$dh#e?0^$=Mz<q8E<5Yz7bc
z77M0-a~5DMRRvXp{2mIX%ML?&O93yG54RksU`adp478{vt@#mu8hD80<*R>aX38G{
znOVQ~a9ZR`3l32DLl=U))Z%~{w*Sz97wqXBt{)(V1iV-WTH?c>-WB?x<x(m0ffr2a
z9l-)GPl6`Tw+BPUPX&;pvHD2b&I#ZcuV7+ec)6b)v>IB8vD_XMjSm=Xm?wFrvnw=$
z+I`KF^E?eWAcHkN`z9~*)Z~LmNbds;F}-{=`L3rdqr&9hp3;mfCX0K?a)H#oo(amW
zlQ((`PY(1FW$c=q?xiUY8leby5w#bjFKq{?HG=G>C6m{CSu$Rm{L;&jQE;-hw~QUg
zp4V1AC!k{+1~69RAqJM$N?=|g1H)?x5K92W;sXu0HG}i3^WDj<-fE1(lh=5w^4;A6
zYGb^7#sX5QF!{c>GLu68<OkjolVyDPm=p>@Oc7A8_Vu;2oekh{ab#v-co{Z1!bgjd
zXL7TTvWNtW%{u<ptqkeMoMjkaa<K%wDBm-Amye#;HRkl=&N2*)FV8Xuys+An)_G`y
z`nxozH)+iem_g-O`Y~tO^)EMo*)Lau6(=}=3U(vGm$R5bg)V4HIN$}-!O2Fx>Jq8U
zARE|U#xkev`~&JG>{10qk?rI{-!{hMlYjVzbF2jWu<+L8aK9in(9HkEN0Zn4IlC8t
zUA~SPH1d<SGXc!o3L1R_RVf~KLFNj*T+W!bGXN~L2js<eP(6+u4R>x#w)9uyI1jcX
z@#f@oe+2<^#<ZOdU_A^h3=A*DCr|g+V^o-Y%zt8i1}L6`!4--(xUmKvuHWV?14^FF
z|JcjjZJ5fPp)Iw57ef2eS`Snhr#IAoU?}APH_<ws1wby7c`ci^(*$gZD+_3N1Z8E(
z%-cwAJjBHC>rYxhT3}kx<Ocy#Ovx`M{|PW-ihl&67)vK-2Wm4~Or9R-!}w?OlRz)#
z$p)e4`O+pJ!^uBGr8x!S7#KL>7#J8P%Z7<_9*AXNcoNIN&@kCHOq|mJ%43)ui^8h~
zsf>ZCoC}hJ@)#!X1<6Ij<nE&I{(^W>Fge+9aZU#)k72Sc3NIGKgPOuHxi(y!^FSm_
z-&~L!l*cf6FGwx|CU+Nw_ZOrRD#x%{HbRPxal&MiICaJen-k-r*(dK#6|Vo!a3Gg~
z;Q#{z!-^~hhIG(yLKXu<MHT}?P8Mi!6$66?gCqkBrvL-P4*Y6CJ*5CFYBQkb`XHIh
z3>p~*sjWvd7@J}i21W)4#uE%o92{UrG~_`X?2*O5kj%iqpp(VGAd$tuz>~$mz)FHz
zHU>t9`Ua*G42)<7b3hG#lgYqvBa?yQOeO<p0+j*oyAA&t9P%NK0692~fq`K|CIiEq
zOa_JtnG6iP49s8$vw+N9@Sg$Z;GRr~g9|bl7-BLR7y>dG>KXVLm>EEhKv(PoRcwGz
z%)k#;8^_4V!N<U`0O1Ib+QkeE3?i8f3=9y183dqeS)giR(TuG2O-4P~6%2x4#Sa)6
zIRwB4BP)K)z`$@JgMndB21Kn8R4of0wQrzmg&A1DA;AF+3D6inXf9w!1|%frm}D?8
zbYw6v)MPL)WHB%^C@@Db;W9WOgMk5T@aEc#_j-&zlXIubD;et<=@}{*85kKGm>XFr
zXauFED0n26C^#487Z)oS8tWNNUN>Eu!$8+qFD=>Fa`MILV!~#6#<~W&>4|2kDP~FL
O28L+{iIaa#R|5ceSiM64

diff --git a/pc-bios/vgabios-qxl.bin b/pc-bios/vgabios-qxl.bin
index 1b7a3831ef9541a1729d3c14a4a19688014398b6..50dfeb208a163f74081b3547d0ced0365c9d1f48 100644
GIT binary patch
delta 15018
zcmZqJ!ql*Z$u@MA@5{ZRDh%kLW(G*a)5(`XuUkxSX6vOA#&?I97+MaLX#YErwu8Ze
zfuY1=qPtxEAtna?^{3K0Ps~ZX_#ln-KRW}%Tvdi2hnN@+F)^ftrgc6|3rh=5>pYyE
z)?Lbx-sQ@ZcJQ%48vpi7X`Hvx3~%=xR!i#?<6%te{M_)Hv4pqbH**P3%k2`b4U(_f
zHt@Y>+Mu1b%YlJ`q3=+dhuWeR5Y4~sq*^CmD??gz+T=@8LKFY+F<bk7*et*(%gCG7
z`K;$c-+{Cp4DAdIldYJv6-3gSe+ZO_rS0cnU|>kw4I*EQr0r*AU|@L7mbRa5@<gUm
zX6DillX;kxIJsRvq^I$(cYQP2mRU^?&P#Jho0<0gUmD|ywB{osY0+tMY4K^XhnN`j
z(z?Z5iqcvy@waT4Je^s-es&uFwgc&Dovv%rnh&t29sI!z;%rDy>-OhJPvhV2&IdMs
z14wj5dRlip3s_Vjjeq^&G{zI@Y0R!G(mIdLNn^Y=H@(Z9$A+1|MU2UYg}-GdlMNGp
z%PPj63u&FN=cF|s-ZD2mtuuB`dRlkvhP2L`bJ7kzWUil^#=reQ+QA1bAd}{#b$$wX
z;qo`l5bUG{>1o}rAoUC&+n1y_)XwHFkpNKwC6Z}7Kp~T!cHDIhi1AuHZ3i@ncCaxp
zFn}dM0%`jgLE+f>DZR^gP1@y0X`Porj`<IE%nJ98gK3warTL{@{0(y46p-WAq;(#g
zlg4;+F39>NX_sH5rzyLxn3I-$fO#&+l~dAYrl)<cT>(iXu1i1$PiALTtY3mlVe9P@
z!?f0KB_?UD2TJtQntwBu@})KZV=C27YyQDhs`^?w&6|Jf!L)-9nKp5x?FKpcwN#qn
zr8L8nuZ6($?bjSInT;%IoTt((Z}3k&kj8l^&GH_Iaq&SKXZ<0NgBPTCgs=;xr~P*Y
z1z+ig^fboOIq7N5wF@}-TPOc}S<aZ&`EpKL^T921(+qE?r*-<SNKfP679uYM(!D0&
zMdzRNv~G}KCu5p(dK$CuhP3A29Hm!#E`Y>0fMN|6XK9^>=A<#cN^3r}Wo}w${fB@T
z`M+O^GlI+uhZ$%6C#~~fTIZ`d5LM7v>*NB3^oBIXTWKDpAJPs!X70Iw-PD_DogV^T
zi2nv9JAWxqV)WgRrg<~1^TwPs#t(DBDdy)dP@vU=Vx51xyG)wpVgBBU49Ggt)4JVR
zAZhjkSj+KWY0j@NfRwn)LByeHneh-<PzIFb)_|DxU`uN^q*;C{76FG*ng>M3u{6d*
zY2R;y0(T8ViK1d!=g;)C&d?2D7pMP9Py6q?CXMl4dRliV$fvKbPmX0b;%GTpDbf6o
zqjd6gb{C#b-zT6@<w@^!{V@3%yBEiaw1W@0RT&f}TXU#zrFGXnNw=*1RAM|igF}Ox
zIrdF@TC?j5h1Z8B&*SKokxSdb!oa}L@Qb-bJ#7aQ0|P_Lr4re+9ia3x*@07mIV>%B
zayq9{eXd%!SSv&GFOIV0l@bc2aiAD!ekgzN1xH%*1N$_GH2&?M(mGFpqKI*B8vpuh
zX`PqT4*q6N>%0XL`!_eu@?eQz8vpuZpaKFM>&=J$&rR#Rn0D|X2UOMnxoP~{E~Rl^
z40yruKdtjnTIUIa18L1CxZeAxb%MObk=A^I`#rcY0u@D&!ZsXK+;$vJ+jWbXf#FTs
zt^;7I^LWRNcWJv0f;b4t&L0r@$$8v?^~X@Pq<6S}PV4*t)0Fo8a+>1djuUB|Hz0c6
zrFXf0ewP*pwjNRzLL3mBw(B@E1H-$tT_-`drSWe&@uuVOn>7Ay7dq~x9egN|)_EaK
z_5Xi{|7n~j(xSnoXj*96<P2G!`r~Pxm%;S}D091YoB-vf51=A~Bdzmen&t^m*&6Vo
z9~>G7UkUUbS4-~@PUGKp1<VR&1XIpTY0Zb3)BHf`;KS>!X%Way>^!8G-o?>!vP1<E
ztqnh!OXT&^yMox#__whfYWT%5S&Pqw@yz6WJ{_aZg8?s2{%<)@suA$w+@G}0LmPzO
zr8&LnIGombBH+bMa7N_cb~x?e17=Y5@bk6q<a2yl^#^}2BmC9*Gz}ajX`ROdUW9`T
z3l4Y@1Jb&IC$00;J9sjA({XqMFRDmd=drZT9|14CK+4k~HgTkNeoo`x_BoC7L)yUy
zOb~nXz{;lo18LY%4=S$HcAaBnV0fRl>pUX^!`n3e?I$4RJBIj;v>lwF@*GY5`g3Uq
ze=>th5dQTi()ickgQQ<jA#q|ZN{Akulh%B|U~XFTPtG#&w9XUKAb$AVwAM={oZxmr
z^8xd@Y5e;RyuA5ovWCFLdXTR!2fXP0mDYJ2oV6GH0_XqEgJ}nUaHSo507}?AX`R2`
zgVXsBCa4ha`+yhTe_IZe6oYl$`vdka4&U-ad{E+^)_DUQNT4j(c`$7UM?I2vL51GI
z2h4LpD*izN>pg0Kbe@0-BPxAZLhrmB@Z#xDsM|qR0Q=m47u$bA@+vrIL;NBP%B1it
zI<bpOIN-&W{{b&5|Fj$^(E)pg=g(vtA+^aDq(tiZx7~uZc+|SZycp8>w|!LW=JR1l
z<KKQV4dgHWZ3ogA52P_31UIAj*I!O!yp+~?VNMz&O4Ky`WG}CSxD}EF`M2Fn>%0aE
z^&Q|A)d95yNemV@N{u>hf)h~1|Fq77P603W{eXLc6B_n>;JCQ>1Ip!pp9VD|?cg(x
zw9X%C{M&w{asE?F?<|oHn4HKiIXO~ThBp<|2ykWr`|$YWCgDhpr!3{XHjMl&tV}k{
zB~mXJvf8lmx6Wow>%7sM_63%#US@ro%q(KScb1{y7Yl!j6Jx_Krjo45jv^MUJJ}f+
z7$!H0D2m=lb4zRf$5OiHr4nPB;Ww}ycP4Ka@u@$}0OPm*167^QLZH&)@{hFU2aIXo
zZ-DBcYEX4l`yxH9yP73Et+Vz?dUvqY!B@=bY2CFSKmu<-K?|ygUNDp>r|oB0@c)0`
z@wCp1AO&weuL4y?Al;zahSB%U>#I=5biVda7fs{eUJR-OKc+DrOEdfr4%$DHCyQz`
z>A#zNKvbP^@#Ghx+7_TzW?JW|i?1M7@vjekk=A*9P8#ENP*bY*LwZ**Ps1-}{uWI}
za4@_81p|Le*W^Gk8B^1~1E8w&gIao*K$_u!H2!U$(!gPprg<=}^HbX8Uun&c7}GmK
zn1#|D(wcv8ls<U*e)3W=3&w4e?}>@o+Jb_}@IZPONI~->Mug_ekJ31=!Stl<VA%2h
zKiIC=4{4nr)Y3bcUnWmB5jW$g{h*fK$^KGxa*?>LGynR~H=wE-RQZN}0F~a-Y5T!i
zkAsTgCuyD6Kd%B6$;_cIUOz}r>kgKI`MbLq6a%F%CVv%IQ``sA18z;1F!mh-X?>H{
zdH?gOG_UkD=GYgnpG>xrFp>a=TtHgqM^H=P1IUdG3;{1HUQce9u;znG?qJx#!0__$
z<jWFjj1`lANjO-ffFj-*6!ESf(z~36K-_34P#k|?C~-%`@lCK}K{5Oxjq%g#dy~s0
z)tS;?O<o|WTz?rUXYOGDwfY+w(mKzB3L^gPmp~zKA-%)(d|KxVP$76_ZorGYpP&M$
z`N5C$PS;22pp<sZ^#LQ2f;~Uenjf>Lb$)0$kly8czETS0sSA4PT~2H^?BzV5q}%+k
zKHbPi_F1}A2Z%i8`hW?^fSR9a%||pQ7jlber!~J(0OfFKhe@ql4CKfXhqTVaphO1M
zbYpJ7i<6TVNGS-2gY8c5a*=)YnmNtzz~qYxlJ(7R9MX1!%ZI~i-FB@E>7BKQK<Nuy
z7+GH9Z~np1{9k~-{UbxiX>d6K_p9rVbg<_RK4VVrEPVv3vC{e1yB-3yi;ubPVMy<E
zeUfe+d#Kn2>Jm@@)&EE{JPGQcbcOIfYq?ZXFOass0aQd^{-4JABfTSZPnu&|^G}Y_
z`{^AnvPVFv{z;lcn)B;TX@<AcI&TELSoaPTl^{oMzmRtDg+N;8vGktM15i7TfO3=T
zj<nYQCFbdUuHbC5LoL0FqvJ&1F}3tAuJjJy?devo+e>)UoYNYAt1vJ!FqAHTEt=*J
zYV_|&b9#LQ?31q4J>Wn}Yd+#IxlvBMzWI$#8vnLi9jDTEf`jXzTDO@OgXL%bW&_6b
zj?fDrcck%ebL9XvW6lJ;`1%%9^um$`xYf-39n@4$?~Hwv-sgG-+^S6D-+l<xRz3qN
zx?C^tuRjC|Hc$Yib-G?iZ>Z&As1(;r?{cdLr4PRJhE$$<Q0MFdsFey1k{_Tz02y&2
zjeq<9^fb%ZGyHw?7}EP(PpGALvB-l`tKmsd!oR>!3TpR!c<ls<IGEc4UflWyij^IZ
zi1-02Q9y0c)(fD%5vT}NcIBDOEz4tl^|eacE{LjMX|135ryffCek(mqIg}^8BZT)E
zH0thvj7LthCEwDVC;Q8))u(k{Pw(*kklw`rYH+4^1v931c{9N(7qxD)Jq)eiN|Ms}
zw|~=1?_z5?P$He)<@zBlAT7M(VtQ97sEr!%!tq~PL|W8qYfzgs;KiCRX`p6aw;NY_
zLoEkGi8Q$Uas{=QIMO<Qrtxq4nZ|isExps~H5+H&fwayalYhwin->UxLfk<x;DrUK
z3IGoTY_F66B^>EAe`sp@FgGoWA+7Uc$E|=DFaM=QynZlQQBDm>@9p=XkOvJSVAabA
z)!PHpD>C`L9Jdgtbq~%)H$aX4n*lGJC-caMGevy?<;cl(^1StLKtm_#9j+hKyIcj*
zyJAJsJ7PZ}@~PY&hSuBsEmJ^^gwJ~EU2-kAOT;@argi>G>-><`e1r#Hw+jDP>y`tx
zDz@KFV+8eAV_&50W?*MvNN=e9#8AQxDk}~?2G{A$rxnsWV?Tj{#WD6Hh^l>)#`r(r
zMa(Bi2$ylCT?F~J_Dx#r?Gj0NiG4l2+x64u)oI@8X`llC5y%0c0!k8EKp__#pwj5Z
zr^&qXYRn5;879wGFkyT#`GSH>WLGRldPnT%^sZPQkY7Rl0s(}F?e;LV{x7KjrEtCU
zF8P+*C6eiBouvXD7dsAt+9U9e$xA5|4+p%^ob0bCr}hb~8Z<`11M*nxXJ}w>q(#Gn
zD*4f5M`7W~`dplo*DJE~Mo56&(G?+?-Vr<buwsUt@8>kl(`n9Wt>5_jjxnUQ-sbPy
z59%gwtB^^v{9VtSX80e}!LEG+uQs~)k{Hsv90b!lT;EJCP?E3j@cjr%#_3(Ip8{S4
z{sV;+h!5(>XECOCxxN7<^|Y|`F5i!@?Z7gfKhiW0rG=+4{!R-{3rhzZ0MaZ1)|>{{
z)%hds`;D{!h+dFRh#l2`(wdJ5z*<|A`IH@{I}fLMzJ8pZ#=noT<v<BXz>B;0(;Q#F
z2f1bPc`5P9=3M+t)-NV|aOpDfyqH|hrK5QP)QLOzfL)b=G40?Z=Eg@1Olh2;-v74H
zw{y}MFQhde0Cjw~ADDcGOPh)F{^XxrmQ1UjPcByWW?KAX@&RQ#rYFBAsYtQ@0y$=~
zptjg#Qx$Ph+n1os^8=dKet_~?$F0eUDkAm4Z$aZ5f6_YNz&ecZj#cv;9?;0qG1t$a
zkQGVqaDAWN<t&=s;rcGU%UdwLyIKNNKRENGcLfWicZ9xe{h!_yER)_5`lh5J%|E@*
znF-X2O794L4IX%FKE^mV{hR9>rV=5w^sWF<QT{duD#J84z037|dIzWl;rb4o9XotK
zLEQ@~8yM5OeBY*bg}x4W;q@;q0#sH(9OU{D;vkUf4=-!}H#}l25lin11@)uf!(t;o
zE%s&Bo5_lDQc1z!y5e$L=Lt|Nhyye<*x~vit@UJyJE)i2#SAJh)zZ718PhvlKY<ub
zAm@O(z936Mo#kC85dCma$q2IQ6NvcuF3t1xmdTF7;`N|`3h+=t8vphiZ$K?c@QA^?
zG{$>rmiOvXK{a2%i@s-|ivHj$0q}@K_9fpm{%vQ{GEYti)zgfpK;81R>;p33m}dpm
z26NLuow=VJX}16E85qjg(stT|l!9FZ9*F>r4RoA%C-&}Ln)B;v(4mJ73ed3yP^z=x
z0kyR`pktjpbM?}@*jo<pw@hKOQ7sit>-;w-4IER)Twf@p86J48m<H-%#xa401hpo&
zsVdYrzcgt0$ys*!HGjh|gVKxX$6Q|+fK=W}Gd$VwE2mUKFTE>_5yaw2Yd*%Lm)<3|
zk?}QCnp?xK6#kY*hI;dcUwZs46B+A88h)wrw?1S{+o8$;YHHrS_3{~G!><VbmbnZK
zzmoY|kAcSM_Av*%IDG46G-JcBV*Zv%j*Rt24ZjNbTURlrr*&JW?JxlAU34pLM+KNQ
z1LTmjT^yj00d@1&KYyvf*zl{g#IWI4MTzUnqRB043QFO((!SqM>-_N=Gyurla<Y^y
zt@$v^YnHU;!yExG_<p@~ntV(xUNX%y;Kikzptj?S*Dpay<^#BG^z7MWJ9V2FkZkSE
z*Po#hw?M6^HvumuK1=KT{kjlrV0K#PM^GP@5fsvHj5fukk!hXxK!MBx8n~4P6%Wji
z;=%Z4n)B=Tpn-_abFYmjUr-kbkOqZ*zzZ&r%o|uR{kf6W`R_GzTIcDs&hK;5nvXNi
zeVOzZRII>?Soj=4a9ZnuQogi|$6=uGRrovETEm3>HJI~ca+!u@y;?X(VhO15QovFa
zfMyudg3<!hG7`ZG!KEBeTIUUf+Lwm^kvqeIpw{|_G~2RF28MEPP_1YCD2;)k$f4m8
z2Y>5Ch7JGIb{zv{AU#koak7!7YW?G1X%Vj#(=tvoGBBiN2t<L%Jg{|deuI70eB%Gh
ziHvED|Nb*DFw{$ds$OuCe+L;1OEWz1?%lgIx7T;mzqx*3D&bAr1!`=j86F6D!Sow!
zk5ZZ;sG%cb4$f(yky@39;J&3u=?fmv$n_2paN6PD{6tfpkt3l96e>P<Cv$5nNnME2
zOIvs*3X}o#)3Pt|r8ORU0CMAw2b0~kH3S}{F@RbJm(naRmU5)AKAK#wty#|lDsW$b
zg96k_eUsLCdIckY%RZ(w{#_3^_?yic16~}t3o46t9RUsJrT2l_McuJ)Ks~{<&R=gp
z0&3|U&Wvfh&cPIb_)O3|4aw0U<<87$yH0_WfTUSK&CAXc^`LGN<J>f`;qTIR9R<mQ
zj07cQkR}%{R&X1VrSuZGZ~{33t}YGY4rflVVZTAs5R7v>PNa4IdY9ID3+yyds{w2d
z9~amh$<q5^#U}z@aNJApt4H|8g<Bb{LZtLjn&HWg6A=HrOWSoG$xWpYv&_LNIZJP<
zrFYgjq!}JiOYd-V0ujz2!UaUQrl;}mN`1k}-<-+_vJ&h?sMlQIsHJzsaImJ;gXYb^
zbtS0D#d+gB*kG1YP_hLpasUs&ya(r3we;=?hqN7n;PT?udyt{cKLtzK(sl}gCTJir
z1J>oj0U1W)JdxIU3u2~Z>7}$?XFy(Q{C$O)f6Ae><_G`M>Nzi@?K%WX<xm^C9HgN`
zJc3}YhTo8#9AcmhPnRNhq3QA-vI-Aolz8tr@h;8qB(ee*4s);toZtYiXJCLhkF)eP
z%mob4)Bxi<Fs60hdI#q*K_dn(zycjFXPXOAl-79|loH%PrB>;SwB~0_{4Ls`@_AS4
z3y$J)kYgatv9z5sljHO_h0;3j_uS~a^?6C(4X|YA{mBh_D)nmVoz6;Wh6nl%sHJs_
z)i8kM)Y8*BgH=Ex3wan}0?r!nsGh};wjbOVJf5~w1{_cK()N3TVkfOT^aIQmxEe_L
zDl<22CwLTde+!bz$@==7ENbc9&XXPWMJ;Ck?mMowcn{1G-N7nQmvtgs)*Y+?av69w
zb)OE%cE)>?7wAVb&AC1KufB`d!_R3E5I1+ZF{VKarp99|%nS@^ogdQEv|T}CIIeH_
zJA@e1zq!8P;BVn%gcT|LEq_5RTW}aAOzt$0mv>0({0s_crnzZ5!F|u>pDd+pX*<D_
zgq<fQ_Zx_+GN&~kW&)>auF~`HP-=#Hqg(FVVa8I)$^M2Caj~E(7;4ad(4ci1$T%s;
zj0|kly7LBjR2Xap#3$Ws>7A}GK;y)a0c=pJcmY-f8Z_W4VFMZadh_HALmgd6F_#vQ
zmN6S#XixZ@7L^tW))DZ+@n>4=0sfYFmbA{pAU{t&XsA$sAu6r$_oFBVh9ZTu>;rsh
ztXDwgspX9#L68zqNn0wN1}gN0SwICAq{`j?4OExCcqs~MQGl9h?`@b%K@AVR^zI3u
zLb&-?7PtUTV_<mApVoXpC(ZT%69WUNWIB*$cq!mT>9^OK=?%5->sd;bKs5zNsdNvh
zFMl8{15#g{Oxwkf11k9^d`yebOYib#OWVN=if~9Er15V%2pzT7OYg2`(o665W`WFi
zz(eu}Q~_k33od*DR0}+T%GE=rfMJq`2cY68kpc?84`~N~aHt+&NNYa92v-9xr*>Uo
z24(Ti9|vDBr+I*Le)9>&_i6mwucv{=Zv5^9yimB7)(M(w^?j1&35rR`pt;cd4U+7j
z>6Wz4^9SFvr!_xkI{1<~t@)ut8t2c+^~R>kKG)NBu(2{QKnjHSX*-zsK^#yO@g5X>
z%q3xy?;5MgGhg4p0xeUZHB4Ib366IgSRooG%b2J*Rx_pXZ$F-%*6I2{FTJ~%C5?ak
zF%a*GUOKp`{Z22v%b5ezl!uH>q^C93z5v(q9DN7UyIfyPZZwhOdZD&>7en7cwNAOo
zD@~N^-!YUbfOvLZ41EXFIzNCayZ>{+ix>{3?O<nPV0dk&m);f4-ghvKe;c>}d;pq>
z_^q}WqyyY91sDBKz@pIg4+lZ@&Ef=5ZrtVyD)K;s(A}XA0$yx54IhbG?86Ws_(JhY
z-$Av-$qao5L1wwWpB!o$ACxc!+79461t~6SKwba$d?kvYKocm@08tzzte~c{ea}ho
zl-;g`2@DLcrQp0K28P!>aNZ;{GjADC3o3(QCa6uc2AsW~zXJ`*q-89a0TMe67Q6f|
zEix@GE#m+vA7$JGi|v1x7M~UYP7QS*_0kp=Ol~xjt_RJ#{NQ0=NPC~Q>kkhD!&|*>
zv4$Czhe}mJNn{sH>K|092_(hUa{}xmxsn+h4nym;v>hx=@KgbALO>?Qb{yF7|356P
zf>Jg_7&2dGd%$Ny34dC~6R-n0-=#&oyupO5`6xm&$WBP!QcGKW2Gj&Am;q`pwI1Ma
zUCgAH*3DNkImKMV65<P66QL4u+qI(nQ$S<(2f#yd;I$baUaNuzig_g%7#h;x-UIo3
z@=^1sdf5n2c4vPJT7L4H4>}t7A#FDU1H%K53)Ip&<y?x=c5oq;0uaBX9ef}FO3823
z(iZy^K~k^UVuvEQn>~s^S@=!b!51QF0cpW$8BSokX1@V9X~8q%X_K$=3D!fH&?2Vu
zMq2X;CRhN1r^sRD1jJs@csFXP1Q&mRQh<QG4VHSZm$vXi6r`X9HC#ciev-Bu!nBU9
zf5P9qltC}O+nEJa=7X{+8!T7ehqeKj=B9OC0JUas1iYAdDXkNf?zg+XNaJ6B5Vjl#
zG?bXezy1Tr(>DTMd_NB=xnHDPhCbq-1X`-F&G&w~rSAj&Ne4MDmU2T>T9&>kR?*T+
z?`8(ihz6u(q=CaI_cbUvgTfzF3#g@cg6ccImqC-yTgpf|6f!WRxu-S$2bI~c?|@SF
z3{V}@dTBD3l^f%M$$?g~^$qdh%y=M;^F-evwY0?t(m-RmZ(=~gyFrp5XTH$`&GLW;
zU@!5vv@xa`9?(ng?f}&#;5k9dQ>97ZsiVf@pe_t(z`OQ?UV8V2Cy*xpKhTWU3%&I2
z9naDjK;!vOpu=Vz^&s_n>0J|Efh0OYAGMq;RR{YAGS`#d75XI2OD(-4nDMm}QdQOX
zl93Ul?PVGR16Vo#wof3Jz5o?e|3G~MP=QnW2s9E0UO43eYV<Rv_xL_Z?{j^U-sSoT
zB)}vEuBt%GJi0?)1iXkp3TkwLX5m~vOs=(-RD1$!GJy>LpqJj|Ak}lK?+{2YCs=6m
zc56k(50h_Nt1^C={NGwN;7wZdVTZIG2S7fzyusfZ@Gor#IG_wK>7{pbH2)MX=SkZS
zZm(Q^p2qnL;;99hp!yf&6VPh3gc;!Bjz<D%JAO~Dw$asm#Gsbm6~UUuzYR2@S^ELh
z^ftVdo@O2Tp_oT4y-P+Qjqzrh)9bgBuiK~!S44mcJO)s)lTi;&C-Rf|ZM~HDg4ySu
zgNj9vRcQxbv#52-RUm9Lo?K(Ar26k4SQeb8)Y29g%m5Ymi`W?Sy2O}3v%#0r4nE?X
zeAL#A>nuZhLxlh%fBTWitaeIz3mK3)xakd*0t}$x`p#qN4V8inC7J;*xX-O%EXfAX
zHI=4J_P3LCbV~1z6bX27@9YZ35<7^5Iclxnc>|uw!7V#z{s-sSx0Z(|FSB#0f5uv_
z2wJG-$O@U=UCe01RO<5bB@3u3Vc~Dx%=$8%6~yM^Z+XR0E(&6D@V9(o12H)HTZ7qN
z9$^Qu1^8QTa)213{4KVeFSkG<Ila4p2{eQkzyg}FN$X}x+X)U`+b}0rqY}0>_MM<C
z)^}`jw7o|C4N&NV*1&O|0JYYg*!0pCdK7_~T;NIa<^xJ|L1Pz?Wr#o0IPZfbtN8TN
zy5)R|(hj~BP)qNO5=z_s24d3fG|tl?6;WboyZ@sJNu});js)l6+i9FPL8?-{<kA`s
z{bOJNEe+%Yb;-NsKz;JtB_?UvC;8GE4}!|GwEbYx@_eyen&pLJNxk%L`R3pMOSnKD
z?374rKERaLe4Ov~T~JDE{wYwR0#YWQmVHx4FTH#AgURU*ijn&v86~~jfhoNc)OPQ7
z{gB>W0A5fSApt7Mr6NJKM&c7tic9Of(eQ*Z;Dz8TP`Ua7)J7EssWAnsv3&ws()jWx
zdm8`tdz0@wh%!1%{_5by*ge_CQBkzy6evURZ$F;Kzy1)cAe~(4XkYKZmfqp|1T?e>
z%9E0yJoy5&!bUB<!y7bH^ByEDr<b<Sr>Nm4V~G=}^aTxxmp({qJof)T1B2l=(5S}u
zZ=i)ZHZ3Ph-JwQwJ8*%fsCVi!FfiCMY$#1l+o=v(u^GF817xHOSkfB2mSaC?rPgcj
zw1Y30(sqFsaHSc3do2ZBnb~<QZ5KGV?*!GAX|3NtT@-6jEeR<EY(c}7<#K7wKN!p9
zUJF5s28b4L4oq`+&6c(Uq$<4+)Vc2DhR_|s5@{YbAh*b-b^ZX+Qt1t~Pb5n0%9TJ2
z{t|BxC6Ip1^&La{G1vDDr2%RCLH)c<+^;P_Qj=Mn6|KRmQa1@~;CL+$S(CbnYXj?R
zVT7(U!~dWVGCTma)>$4@94n-C{+yiPtZng)zvTi0DB%@rq#1q#Gj!C_JBtlKBOeby
zETc5Tlc4A@1-a1-q}d##`LMGUyAL?-RVTB!C<yt3M%ZgVq<6T>rXO>c@qhVvvYCrq
zeH>WHxd)&m1d5suFI$+vG&n;_q<2M#H2>n~Z_j6G_|3%Mo&ipM9s(fQ0w&PtF}Tgo
zc>z4#dEgnS0_<>RX}MjxDXsZ{ecHhvY@lJ@59yum0<Y(T4MrXe7pwmX76TP?O#JQK
zERgm~-vPC5=#1A7P?Zds2Yz!btrN6n05mx7AkcE46r3EvQ*i+jX`oej&4<|24*p_(
z&2Ph03K~uYjsEa&50C&iKI>0`DZ}I7W&<cMb$SR)_Hvb~_bCF!!1s^oo$ey($K7T8
z8D7q0#&Ag_!X>^Smw-(>cPy<Fv;+d;CL6{QlNI&+t$NU$n+CQV$z`Bma}Y`6Uw<65
z6cW@yI)CCNXYoI<Ss#y0R&-O0_5267df^@hP^a|>sPl3_FTIN)t@#C;4P!YUB+!mK
z$oMnAybO)6E(ZY{M*jBcOf3gWqag~?__sv}2E2HB6g042$CS2%W%5Nn;mK>=gxP|b
z(wa{yO!hYvtv~TT;Kfw15<QR-P~JhQ1Rz7$D-=rE(sqH;H^l6Y0Ks&S0~lVaBIa|U
z4t~Z6YDa-uHG1h?9&BmNuh<%XG4i)b{crfm!QU?YA7Vs9g(w4mYyD2f^ezVxP~Qt8
zoW{SsLITo!O}qR6+;`;P=K4O3@kg5FA^x5&&~Q7bBm@_WpjA4MXpUe>2M0k3Hz*2H
zK#PW6vx15WuQbc={C&s%r1!bLP)kqi=1%YMeV4|+?I@_Ae3BM(@TCA~)+dee19Z>?
zG&l&FzyQsqJOL4)L0#}5`ZlmpHGg30`L`Vic;SB-YH}xYnj2Wz&9t35pdQe!O_R0V
zHJLR2Ob&C`^8fQ29<d8{GNd&>;D=<54tK$q4}L@Z-UUk7C2aprlqkH8(p%tA*m9sW
zNN<5-;lBf=UJxb69R!#eU#|Z>`MkTjBe)T|6I6P^T2e2Ip+<oshw-&S+D-+qQ(iKH
zmiu<Qeh7HcaUW)q48vpvIqAt0RM?%n9As^H_*+bv%j<2}_*?jy%Dq8Vekx-*KWIUh
z6{8Ikf9pktm#&O9Ec~tcjA=W!fX%G|4VHsavgG~A`#mJ<`+00Q`CFWr%6V<r`CCsj
zrZu1X|8g^<4Hti_9TVC*Fy>1(Li{c7ILeJ|`1xCIGnLEQ@bb6r1vdtQML?OwSt8&C
z!@2YhXPK8~JT?O9UCuK6t--7>?=jg(^S6BDD(ANm=5MLwvXSC%Y2kYLmAl?XhQDPN
zw~ar4>q~Al>t=od=?C@6nxEB!X0Vzc)<cF0`wppfiFGohH9z7?Yd*!;a-fpA;ao%7
zegy^wh7}d1!fE@#^IM%CY}iWJ()NR9deS<7fSi@qc>=jWyD#z#;%sC=p2^QWHR=No
zrgu7vy!7J+HJzhn8h*3$w>xsf#tNZJA^2PLxI1owiX+gZ0mo5Dy$l+v2>lT7V)5ZV
zP+=4LL9J8FkD>3lT8CT`Ls}51nlA>I<DYMWJ9VJwcys{d!-FqDb9z^L)4ojZ^Ws$I
zI0~&TJ5ko-9li{5le1vJixmeZ@A5JcTy>`7P#XWXBd-<GKr>gqM<)OGlGFLhfEJ*}
z7t*_&1zQf3i2OTInw{R|EdW|q&cKk?{BW|5w>;CteUo#&C5%_>1Lcc<ETu1AUgv~6
zAmGJ>eQC~V&A(YnU%%YXnYMEYI6d89WMFtXfAVf`d5L+az!SM$&hY7M&;+W)waK5n
zb=kc+L1`y`vYL;4y)6^i?t>3O<3}8j^6F&@BPb!BX0Q?9Z~4Pu!@=Jw#snE%f4Q2$
zMuNX(3uC#cjVOOhA)}2re@inXC?$z8zWl%lN=!=`K?&>>qm3kg>pe!uRMDIC4rhUv
zJ3#w9wmA#fi14?s0kbC`@sUxK-wTTPViC}Q9BALmakca=5jn_k`i+1W40|Ut`pTzy
zaRj`WyeGZGS@5MjNbh!#hG-^GGZ3`qxMEM=VYT!Q7C!KpszB*0h=T)O#6u+91YUA*
zq<1+BKuapnL^x#b>0Nr4vm}U+c)68f@^4=mf#p|UwlaWc$iF!YFqSG!UgoP{6SpUA
zhX8nn>GtlH0~IW32Olz}b)HIVe#D=)12pyY@*ZSOr9i-owmqQKckq=!dPlJ6%VHLg
zsrFO$q(#28W{0=|Jb(65mmOwi!R`Yu*gFnFObU3BxEoZ+wVW(vKJbDmy~A7J<(|ng
zev$%CSJQS*0Y`Q<69dD`6O&v0D%ca6KyBHe$t?Z`?2u_M>B-jqTKo|4SKC1e`{ira
z$y@<4j0uw``b#rzoV?awmN8-SX@5h;$jN{GHQ7O<SfB+Ux&h)$pUzKq3$S3kKe;}@
zkuh-c!2lUMkWsI#drqW5hPw=5tj0qOEU%TpydnmM*ODMs0Eop88cd!B&RK4kCrbya
zGfGc(4%B2!n4BA^401)FGE+j)<h($M$>##OG8)!_T2U|SnA3K)fW7C!%)sz6ju{kK
zHpcudQH<r{HirByT#PnG{4MH?HUcH4HU=fxFK08_nDV#eFxr^$x0Ep2nDDoDGQ#VM
zF0pn7aJdCq-rD@=-%IPs4ndanPY|{4f=-6C&f{ubVjT==o!3BF*;@wG8kcMM$yB1&
za<bGat@%NITJwnp(7;vmvkz&_=Qv)Qf(1K|r!_zO@LCAWX+9wUR`KWqXq92}InLJt
zpeffq;1DRim=>890dv;m&p~c%7ayfHKVq6}AMEU20`~AmX3)T4+RhX(4>V>CZrNyD
zNk8T+BlL13W7^ITu+)A~$V_BJD^J?aO+Fc{#_<SjU+RU)--8td92wJgx`6dCvoJ8c
zRGh3HqQ{spIV@yieGw?f1%p<9Y%7*&{>5INnAZ8hhN(OXB<>Avqk_hLw}JLcaioFT
zsJ{YUlwVD2Jy2nu*7>pJWGN54k=p4j0CJ<uYuU7&7GUc<SU~e8DCK1SC8T2g(Bzm<
z6{ZQ#C+`Y1W9q*Tq8Q^Qe+<=Tte7kt=EL}Ob5>Xd^W?{o7dIb>s%M$(952I~HX&`o
zgw2WZ(d?6VrwN04H~9<<2N)O_USu;cq%$xuoXKWj*pbb^uqK-U)aPZ;V31^B;S^v1
zt#)O=qZZUf3c#Xv1=QRgBy&MC31GGLXa-|b%)-FP;J|o-fr*0y?1%$UM|5N}FeEcD
zFyv%2FhpcCF!*FMFtC!KmW_dtp}v9X1Op?Q!5&b9b+Q>4B(fP8c(NHltJfI7E(SSx
z0|P@t0VLEw4o+iWVEB;5z;Gvvf#E_H0|PGuGuXi_AafTmFu)vqCJW-=4Ot8fbFvs1
zCS)<xGw?AmGk_d{uDA!PxB#J;fgh|kj**drkAYzU!Vw^~iy0UgLb4bb93TcW2td`c
zK-I#c4q2^ERz27i41!?A4;UFa1i%I(D}Kztz#x#t!0;y%qE-m1mIaSm9jGIO8Cbv}
z!2t~k(3BDbGXukqOh`!FG09|LIFZS~uqTs&A&Y^TL4i4f375g35j3#Dn`<-q^_5KZ
z4D}2Zj0}uS4NQzo6*PiUQxrTBOB9@o@{5ZV3{CY6C$F0!&0(TzsF#*(Vl?^U3^8GI
bJp)|>-Si|=qvS*jvs431la$H7W;_D`#3jJg

delta 15269
zcmZqJ!ql*Z$vt$H@5>3H^BK@V%nXo-r;{&(Ubh(E%+^aKjPDLHF|-^gF-Z$e>wKCP
zoYr|bZ3lw`1H-@5CFT=t<(OWJPmB}KOp8v7J;cNSQ4|JJb}X&)a$4u9^t5hYj`S{9
zp0tC{1k(7o-%jKFoM!l~@0eOzryLJs!%xN%-iDvdB|I%BOSm>jzGmCN_nK*gcG^w{
z1_p+{gJ~XWi&{W5|F%nNonoyFlMix=OnlAH*6sQs&GO*Jzp{+HJs0{8r0rm6XJAO{
zd^TB~Nn1xFt@(!l|I`C%{M!zsbsnFScJX;y^KrJhX`P4Xq+NWR#&|fb`7rC;*F0(a
zStl1Um9lk*en?}yHu)8k5<iH^c_BTmJM>K&|N29dMVZx1x??}2ao$Kz>#hZf9Zz#e
zo0<0gUmD|ywB{osY0+tMY4Kq1>!o#zsT8HPUgB@LGC7l3zJ5N)1?g#>t}D`-53r{l
z{J{+3tVvJn_UA}X<KOPim!8&Lx+aZ({fG3l?syikm_Qo;`okc@89$^kUI1y>kly9a
zW5dkfqQzvx!ryX_$%cu)WglbDg|yChbJCiRZJC>%)>*m$VpiwJIcWzUGS5xp-(G(p
z?cf6zknn;uMvx7m8v<Tv{7o}F05Ww+dRn(DND~8yw<5ivc0PZJI!Lmic0MTh=A>PG
zkk)*FZ7%=R!)g56ZqG@}zRe5^xgD$w3=C<z!Q?JR1_p+Xn`xIHrFC8dIp{ywK^ub8
z_JL&%rd@uP<_Ag&8`3WROi%0dos!mha84TI&AA{qtVp~30wSq+VoqB20cMb>?-WoF
z%uG-FUb_M0z8PSZ9XBVRWl^kOk)GBayCF^S23&dUlr+X0X%OXUt>5^k9!yVbuARZa
zKlM<{#S;0n)&nI{Y0dwb_@^FBYyQE+KlKpDsZs&38m3Z?G{Z}2h9_Thq=9|1kt03L
zGIR#W*9RXnrCDA8B_+-iX`DCGEU)oTJ(N~|@lhH$jg&4)?{F~}N>BUm3JT5AHR)-L
zpm=DmUBbcN+VbyZHzPcX(hP5>r}1wKkrx8{B;ZBzpY*g&wlrrDcTF1Ov9#vj9Hn=9
zKxxl+4JZoJ__u>2Fs<|boV4cSTjr*99-5QJ_-k%GNXv$R7cReFYBPci4TqU2@F%VF
z<(#zUgIngN?c!iy07We$C;_ZVWBi!rRr(>V^YfgvgO8c#_FPKi-+n3W;3Jl_&KGmi
znh$K5o5px3t@9?->=(a4iP2vQ#04eL6KR?dsWiqLAp1c{>FBSt-Jl2tsdSe~vpme-
zJBI<pLDH6<*6q#$O3@%!Y)E7Lkk<Jr;6?YZH0ReRKuX=^K$4)i1||1HAfa*@5Lpkm
z`Ul7j8`3Nf6-%UbewdTiY<uAUT#&BxG)C7AAXk6Co!0uTL@BKkl(<4c`O9@fzzg+X
zphU+Qy8)D&*Q7DtdVMpk`AEWK0|Cj&8tkGR&Hp$`#am8RPIhH?;qETwN$+(1klyM0
zZ1PlgFYXU%2On^&GAN{Vew_TAU4^r|_F1}R?WYp6$)X$@eBG{Z(ijh?r!~92P<VY{
zvIj@6sCe2A76t}}hF{Dj3g2#}NghaRKEO2jBZmTecp9ig44N#$sZ?L8)@|3y(EOjH
zEIY09@WIy{X`RQ?nx9E@+)8VHq>$bb`Z=xhQ#x1Z=Th&q<_Gd=&5!NVoYVNXe+S2X
z^C3o%$FHRw{KcHsc@Y%R|K_Gy-Y5}F<6nO-?ci_bw9cC#(f@PP4nE{a^Gf62b}5bX
zV!#XL|7o3v(mKUX7#v7zKEd@qt@A|M!3P{^%_q3ur$tN-R2CO*e!~GO-TAkHONS2u
zFZTVLT&keU)c<et5(OR21E7TF`xa!(!AI<kj~E!!4nAO3WnfC<1f|N0Y0U>gj@y24
z@=pbACbO@T)f6pl)c!%L1aJ^^98TMJiy2f*e|nR)^8lE2>P=eb@s1ns(smtWW?*>J
zaX78>)0?!;A8DPZCbMt_TAv4n&n}QIBrWM3uAkF7KfpAleZQQhco?LK^F~_dsdwpJ
zuAkqf#eqCk-+38SY=c92*KuYBhK>{O(pvwQsHW{Y39_&6m|A)V^BXYb%m}5K(wYx5
zr}@9WhE%jeyb+uhl-79|ltuZsd4sC618G@|X`Qd;q%|M<IXB=%%m1{<^e)$*=^f6Z
z>D{is+Ug&qcREXeN~=F<oo~RE1jHn8fTV$4SIUvrc|2{`38?G94g)1;>AvG?>0Qk4
z)Y7}08NnpeJFv_AUO&KaSx|acfM|M0=->420ExCw>7AkfdM>4>)$?!j0J-xJ!kvHT
z2E3^LpB9Pg9#9Gm1V{h&PifHbHaw8F3lvN5!1Xrcy)?^v{C(XFY5dzx_gnxMPH@kE
zog46?^IuvND2=#&P0K#u3u1+St53_kG#yk?fGRTnZK2=OvM<TZ0cF|7Lk$cJ40F>u
zFQgs(!I9SZ>%Tn%Lm6Az4tr3k)#3U*y~FiedWY**Y*y|0mll!c{4(!9)TtX3pf2rA
z`vDFbaATzNke+OM7e~v<66LfVpmGY-(2&zh?{Z?Z;Q-allask!7#B=l!L4H)nAUkP
z;KlL(EeA@~171Y`O6xqdLHJ#o)0^}T*WYQKCjwri{7UOQ2=bNdZ&1R2tv{KKM~i1C
zsE`FU2Y#kSP2Q*_Tn`GwfEV5%gF*sc-2a)@d2j;{C{?C)o&!~ljB`OLJiWv9(*|CM
z@F$QRAJaN-1iUy4QVzD`6DW6rSfL-&I4`6fe82>@<aIe%UH3mwRP8^<$iR@cgAEkE
zoxk3v?K{uNP|uLo`RQ$1=fSicV3&c!J3qZm?{xi?wu2L<5~PHG`-e3C?FT{SXxe_T
z+L>wJ|EKY<KL+vVcGpi}Ij|_>iL@wiz(N{2;M%+Spuya<<{zA8;!tk*+_YBVOC_98
zuKC<F{(T2u{(3*zllLMxT+-7zLq7z(VE6&b)FA%~gNpXr4{7}CkEiVim7X9^{!i;X
z2ri{~(mFpO6;!<M172wUZ8=a<2M&Y1e{h8XBnUv2C#WF>iJ|(LY2QJC3u*}1gX)tH
zAgjRD#Rrtog2)|wzzmZA4R!%ixSaqC7#=_k4RF&Kl!H1i2fT3j4h}X@`=<FI``myR
zLf_LmkIAL&28VIy35dCnvR4>vTy$F8WIlc|!DasgUReHVIZ&dL*7+ge#o6DJP5IS=
z4G(|=9-N}#7VQQ%j}NPL%Xu-Vb({Gxr15Y6md3yBWE%hakD#QT#&`hKqyROzK~(_%
z`papIm(n^f%t>SXFc;K_u1^aF7o+^!ZZ`a8FV9Ttyq2~DZ0Z5E1xXARH%hHLZh}hE
zfEN{@7zud6^$k=`b)HDu$plJA&;SL;6ki%Rox!RU{`WAW(hff30HtEr&uN^;)Y3ak
zqyy3-!2V&5Pm7&wEuh6K^E*AQ)0qYA<&Mck0+AZuS;~2B82MXRm~5C!q+ae|wPE9L
z-Nc&Kd80S&3s`e}TI|b?_me*h81P+SX!ym#-{Q#F@QbM=ce0_N1;>7Nko!7+PR<il
z6uq71me%}_rF7*>ImR@@Z(wU~PF^DDQ-7QR)YeVwbbSMg^EUx6s{etU>MWGr<@+Y>
z@{hFU2aIXoZ-Ck&!7}M--PJ7VX`Qt%(z~mr4!&nj@2q_SYSMg2YrRw=pSGW2!T<k#
z$3cpHpQLqu|GX;A3sm#GNMro>`VOdp_y*M2e8W;Y>9s#dRk0wb;qws`NrwN^I)4Pb
z_&d2pNSn#v_2i90>WsT5-xSiegLODMPhETkYOX;{<X?Xs+^b={4r*rCen{^M=4trF
z%-^EV2o8()ps?U?>78sNEF)vlcL3zQ4{GUM0%?YzF43nncmNd&OEN!x`EPQsutoS$
zriO=%C7kJLjjkUU6hJM<=Gr%mr4FD#Gduv%lin4=ER@##h%v46XPV|gP=lZITAD*z
z^AC>F$7wqlcKrVjwyyR=TIUC~^bYoy`I99@%s65{sHJx@zcid2E@JBj@ziyYUp|0B
z^a-f4Q%Ktn)_pv!^CC#*$>&v|##^`Vi}W-`-zTqcr>AuX%fLgSm}T;H5jA;GPpg>`
zrWMqOc$3z79~Aa!jGtdWm@Fr1Bn`3dcv?VO=SNUO@B_%53=9D;GG9#25VaQUjs<n<
z4yOe`#9yA6yirt*v3BweQ3u;hP)s??fchUF(z~6d(m{!(%ULLGHz>M65&D6l#HH^r
zNSW`Ow9f0FSEZ-@_x+H@`04e-$pK>OYyr>Hnvd{IHeiye*8rD#mqFd1GwB_!mtlEC
zty^plL+hoI$~6A%ztTE?LEGb3<_5fo{F&ByBdz(tkMvI0M<DN=N$>Q1l77tf0V9&C
zML*M;AG4=*erP#RDXEv<<<4fqUM`T<`5~?OL4CTBi|jLybyDeFu9wq0K)hqF515ej
zCr>sIm)AIqTmpcclxBFK^-_s7DBVF7-<TWlV(sJ-aRvV0KR{Ndce%*EN^3r%04Y$K
z-`J#eo`ZGW)w<<c8PvM@yg&_xUzX?jn}0Gi{}$kH|HJ@lLqa+oAWs_pfOzQOb5N#w
z1ade3wgdd@4}(+Q|MX7RCzkh$ouO_3>B#$$W_S{mdAmY*pS4^n;ZNJ&z);V?kaqch
z8t0F+&g*H8Y0W=5N*|<mxR@RRCI2UB4ry+$w}MOr6^RhbkIYSDya9^aJ>XK|^y@VK
z?Kjd6z7PP39Z2s9-39GT9hsY+X6d`9L_NLFb(dOtmtcCI>j6;P%;Hc9Z<<?L<39#Q
z233aAov$U+9Mha%Ujk*c&QBen&U@{F^sdwcubDwY%|~p&jnd{fI%%E9(mQ-lq`?aE
zh0tI+&fhEv?$Wt(1ia9A4RXnaw9ZdRp8xbM4H{B?ht(Fgf=d1$ployoRCvXn;9q|u
zy)*Vnn&JQShFTtmN)f&EE;mqu;7)Hy<*85G4{9SYq#1q#1<M7PZ%?GBS(cvR@0-Vv
z-scMLm$_b0OYf2~00ngG|5Bc`U7+R~XcXYJJtVpyVF-$j3*SJhc7PRJ{*lJN?Q&Wx
zxX%nKJe6H}(hXdApFyMK#%skilg<mE;<fb#s9z0J(}7TPA7lY?0xkHK<~G?{O06E!
zKRTD*#Q<tRrFR80rgwQWAu^KP9){NcB?)Q#+yCpOcd@q|D3MMJ165*a0Ua09yFx#K
z3)&D+>oMxJWqOzEr+^oWzNB>?(o64l=Spv=<zOh0=sN&Pf(IXfE3Q&##bxxGtM32{
z$f(KBr2Ne*1VEwfAQ<rC?R!uheE^jJg%Y5WOgb%#A+7Ug$1P}_eV7~Y;w{KVzt;~Y
z8!$;t)|BQ!(mw%<eo*m>qJIKHzsTgf(%eG)+ioH<5hz<aPW~kw&KB_nmK!H$%kb5I
z1P#2UceuU-Ra64$U9KXaU_%6#+#ZJ3+x#v4pfq$_FTIPo<v@ve$3<`%bOTgw!7E##
z|7zeAy8S>JBe;9`B5el)I|D;{L+vMq5>VL#YOkg>pHKj`G(llg`Yz2DRI9~)f&{NK
zS9&MNA^h87KZ1fuCcV$~U0UbOw9f14-L9WLuLc+Qt}oIU552w*vU~CwX-RATZMQ&0
z3aIM}9;5(y^~NXA07iOe>@$!(t{kA&ILKDGzd)Iy^Yi3>SrfK5pI`x!mKF|b@1%FR
za)1H>8Zw|7p;Q2_vm26t>W~u<XlP9UoO(Wkx|nhBFcJF?Zhk>JN4G&qBjAPXWJ@_Y
zjgMeG>1my@JRm2=eoAA!4dQX6MZ<N+-iLI%#hc%7fZD}x(z`q)(mQ-VrFVHqrg!*G
zUMrVTANn~>^KzOqXh5s)EJIrBZT`MvpaGU`6*6g-zw4Pnxg0uD`73P~xb=2Ot&1;-
zA-%)*O?sDuV0wq^$F$b}rQD$YUqD)LTG;EdIxCPrG!LhRgZQAvPI_19XGmsn_y-Dl
z5I>FaR$5FJV|thC$FzX7a8Ne#ee>E5EY<lVP4iG%cpBqxgbARm#0=J*2G`a3BklW*
zv;c@+kWPpt1%J|-j|faQU=o@9SKd_GGp+OR>&NM7{QDSN4wP^Nyf|<t&GGenkV8QA
z%H$kH2d1SzC$CeqW4iZe@;gN-*57dbib|5kpI(A;;E%K{26&$NF*o1^-~Y7e^e*3D
z>0O~e)4N=M1iWwu<%3vIM|^Uif_Q!UG1t!w>D>+@;BlWWXHZ~$O7AX~0Oe(8p7gF@
zf%J~h_pRU3yS!yeT+{oUnZS)G(13FDamKj~51C4Y)Y7{=7}Gm^--BCZ&BvMMg1ryo
zgA*($_ZNY4Z(8S%*PB62EUEM^P%Mjtg0kla<R<OZx1ffCBTriA>p5x7hj~EbpspNx
z>0Jyh2l!idFxjY<g2obDLBko4zGV6_*B1(Dh6i3Nrt$AP@Un~v)W0#9d{RZBzVm!q
z^LvA|&YulGIm^zz=5P3AP<k4q-T<WjN}A!xhF>|QN@<<nL4%8obM?}@!Wcn9JZa6x
znDo-S#5OX%W=`w;*YGO^R7TW0H2l)zZ<)zhFVgT!mA~~RW7-Z?22evv;MU6zj19jc
z_*+&pH2g~DZ#~DD)){{jG!Dfw7Zk6|0WaR(e0hqo;a4$#%S6U{^M+pq{H-e)(>m{i
z>;@_7mQLGY05<LL&9ogAVAjr?pn3&7jG5MX<E1!b!>`g3!-iiKC9W@XCa+XgV5+$}
z`LwDGOTeF(c9UPL#!Cjg_<1AE6V%Fk@%kmGz4QUxRebega<ZCDeZY$)H_|*`e}+oj
z0@Z+T0$xmgk=FV9b#5AH;2boD1*$L^ZHh~y(>m{gLK)&bus<N_Gww#3^XvC%ouAV>
z&%HK<j<`WoK?_k?P;3OeFa;@m0}Cb@b<h+-DF-M}PeTSW4={pS@U9#$Ehk&5%W-TA
z0|n=wKa=CtP1yH=IR_@sQn#%C31&Bd@{IzP!KCIlpstDQpR}N~z_bjLaF8j%AjLc&
zFM<+$TI@@M|HvaxfuJ(yLz-<^CIdscAE+m7dnk>8p~$)65eI+kGzPu&E(e~pUB{Ri
z7~bhk_S4X;_k5fd^;$74;}~erA>&CT14CMdBiO1Vp!~>_)_mgs%gKysjsN~LFfi21
z^qhbX5q(VCWfKo_6zk)(h%~p?x6{A5eqbu$P20r)GR*Kmz>BKKdY~?rQkvm6z4R^-
zbMU|=s29BEA-Dr4!dLnNG)lii1e`RcZ)VbzXXJAz0-3t!4ydeneGOEiC<Ui=9t6$9
zEQ!)fTeu(!lppldvM=$aH6A(;1sX0nFgaCAL*PIf1E|)!lxBIclp~Gx(B!#Vn)Tp@
z-wQ~{be;x<-G}r}*Jq#>`<wJ{t}ht*TXLAv)A)C#zTn_*mSGHdp>-G3C*E}gG?tj&
z=L+icFs60>dIM!UGN$c1ha~671RbzS0}rgdQA_V|WKP?43Zz6Wy}rYd1(f3Vfs9M*
zJOLV&2M-s$OWSo6q$Iu1^_g0FhYL4r8mNKGQhE#2s_gs(lUGacaOMP=(D@IPa2e-z
zoJi~Z^$tAX1k=g|)+$;01k@G=1@N?cFk|bDl_6nW`W$4)K9I{nCV<R8k7B<$*bvUr
zhid7a)edQf2S7GEfe2?1;Q}IDApyn7->kz3G7cO_5UaXCKIlA#@Z!N|9BG^%>feKn
zWhuP{8uH`>wJ6@JrFU05r0oy{_vnAU2N~4-Q?QgRZKn`uoDl4*E*EYtkm58>kar=5
zNS0nt+jR!y=*It7nE9t1N^5@b4>Xdt>kueOgDj8+>uEkA2p+sJ{FYu1F)hSc8J_x%
z+=Yh7V@Qm4c{8KLAZR$*@MIb|sNjAx2OA7>%qNIrI7=UcdJAdbAOMf#f)WXs!Iakd
z3Cv(g>x}&c8b@ZE`!22X1}N^`z=Z>7bfWY{TJtj|{uX~w*8r0Gnn5k~50FYfZKn(<
zeD-;Qf&?^6*>j`s*5@UCH$aXCC1cPa`{diYDxis*+Ba(Ho$g9$h6nl%sHJs_)i8im
zsimiNhO2-?7V<E{1l%>?akzmYZ9lkuaU5b9s73iEZ9mk;&<`*hVXC0E9s{LAnYn2@
z!Go0hCl~37g52QxMlHSDK?$Z<ZSgLKG}Zr%pv-*yci(Zf#e2Yx0vn>1p4J_p0(EXD
z)VZJ`f;S+Ua1D@~JH>by)As2=ybqe1`2gx)eRF-m!r!tP)L;UIS#eAnXbNERdp#E>
zjysc0^<9|a?@X@Nm(fbo1a|}9@OLmXg7P^Bf6FfhSn<K%@(yl7?BtEyB9r+I*i+b6
zFqYVYC)1h_GtEug2^wBbgAB+v|70nV0?n_0#>94=XJlY_3rQNCpvhAva2n?-1&u51
zN`1juTnP#7Zn<xV8B4%*FT}Lhj*~ZX3!9{M-gy7o9b!PY9mv>Spkd$lX<(DnI)A(e
zRo4(hOXSm<f3lQb0%>FeYrHvmqk)d@8%U8Bkd~1LF0dzlPK!#51cz?Gi=3Zntq1s9
zqFB;8kAeI=nafb2eo0hX<G({u3=BnzY1s$((pa~E%1+A<MM9vmbwL!Uuup5fR4VzB
z7c{>d3L5VTcyZ?&$f(v|%rB)t4G6aM4%Zhp%%z|PhhBR31W=jV{3{Dw-lj1yyyj19
zKA@9kdw_|7q4YkeBs07e@M6Zd*P7|f4Ye;OuQZgde~=AI6Ee5bBJ|R`{MgcVgZ!Sh
zgBg_EJ8!*D<KK1=5)kk8(!2eb^wPWQSRiBlX&~v&6HwW-9pEubu-Ff{7<lp;BnF!4
z07cY$$Q&L>FDP_AOb#>>uHStHG*bmFf^LBZqz}GePV)d~^5zqa@6-6VUjz>z%($1<
z`2&=3L9=h*xiuk>NooAskEeNn2AL1O<Vb6N$e4EVVH*Fg2b{$$Y0W1cHn6Ad0@?5`
zZP!&$d6m}uU~d}diFeT9`dyPR7^!N0zn-=mR2--6U}FVMpxt_(wjW$e>|o*t@qfKf
zZ>W92ToN!@!dOjm#q|v=;DR4gZKO4y;CQ!zHLdg3<XB^s`Z^|%i$HDWCwl4KZY-d&
zB~Voj5_zGQ-UW)bhkEH<aU76-QF>Zq?Hh2N&e3-uz038@YnHwP8~&>;@??OG^?(CQ
zmEm7{8n^2kP;Tx!sMcw=hoSGFT9?>PhV(91&~z$WTJr;kv`Hqs^$!_JWkE{pycqfp
zrgynMg0J(~!Oq6O@Y)2_24n9#n8v>iv~0ok324y#pW0%O@-+T!pcb6#3$Pemqu~Ly
z#R;H{y3O?=sDTGsQ4snh;KjF7Fh{B__F)KkvG;P{K`yn$$&f`QhbPZ9iT81s0&NU%
zo`RGnH4F{E`ATFPehZYSHT>o%VFfjr?R!q99egN|w##7x1H)@6IIoF;;WZDOH`&kB
z%v%D~pvrhKgMlF}qaK{)-o8tVNQ+9#XaI}N1B=~!mll~8mzFUFl(#b0fW?l!ON&p7
z0JmCKeAG)@7%=&~sdW9mA3UH~2F*UCy-(ZqhlhdTtzNfS!VJqppcXt#{2x?22_(+d
za{}xcxsVwf4yQq?y|f)HObiT=dgy(c;qA12;QZ8i13VA06O;wgb{yF7|9@KNsrR6v
zNALv9DbKgI2R4-Or)6vhyOHNzTExp!OfdN!N1+-(7D6(gTH4|Tp!Qe53{dl^^#FhC
zY$m<5ZoZJoTg@~q_kr9Gnx?Wf5h@Y4T`S5z1vD;wAg%KlXizV$)Ahq^C6MX75)2Ft
zX}iFlf1lR*X|kAkRQ(6A8wB2h*51740}o_%mVQXv&A`C$0OSJD!XlL-sLytAflG={
z(BkrK+QA3lM&28>w8c6_ko2v#SfL2+Y>gsNT7Hvu@P$YksK1;c8UZSS7QO*BG1GRk
zfQK17K>-dovhy&gR0fCCjkM+yOz`3bTql6U!9_J_4(?GJwCI96D81A50g`sG%J+I{
z3ztMe%3V;K6_hcbr0s(+>$_c_q*)&0Z(hj&%e^l^47T)6*L$FB0~+4A3+-Mo%?)_5
z>k23_g4azP0P&BU2hZ<yhrUR+41H8&k;cFM5O~H4v_c6oNi{R=`)^PuIP@N92~-;Y
z`h)3dmacD#K%*JP+hXsgTgE;pR?$oEW&@QQX#r^&mf%pTdz}`U77dC7Q2n5m-pQ8M
ze2nj<_hb!A8F__528J~Ew8sCSHvj88ptL;$<g*XpI^)LVI7_$s1+Z2*EF-R9=sA_v
zc@doNb|l1uv+02}&J%ryKuIhuJ?*&b69<s+ZjdA>>YnI<COSZKUZBZ=TE;ZP1A6J*
z9iX}=jeq;eG|N+^vEaUX<8e@j2h_x>eWRD&z2Qh2X!4YQ`#;cNDkw-N9D}&#mtJ~T
z2S{ythwmd0`&1fu;Oh}XsWRBF;HeJgG%vOEj$p>u4oJ0H+snV8o>arhGzNyAQ+<bE
z<r$>x0xdmA<KOlXG#mq7P*(2&YB)2d_xL_Y?{j^imfqnF>TYaveFR?F(jEFD;KiOJ
zYU!QM%pkA60d<)Q#Gt)s*14eM37WU*4t)S?jzN`mIY@!52bs<Z6-w(akb~;vnwz#$
zl7WGtXR?+xH{+YhX4a~VZzjiBtA;;GYd-9d*7zF~FZ`|1|G+&kP_j->%l7@Clis`&
z6t2SMylI`s)4O~>q+NcV#`z00+w}oFIU-Pc4HQCZX`NyYGe85D2OkNf?Kn62qP4F6
z3kJ3Ht^n3F{%yZNA^sr^G^BqC)Uf-IX8Eg_A2j?dkk)xWjqzui)9dGx)ooOTy(2&+
zDg&qt%LoD|IrYi$HeSjT!0c<!L1iq+!nA|0S=2h^A`o`6O+I6zr2gX{SQfk(KrL-?
zzzk5=Wf2>L-U24jEX9SigO51V3=d2ewl(8A!jRrjA;8GrzI$@8ty29A=;B83!j1HX
zN&yD`sfW`WDg_xz)B;{8UuZc{lG<{+G%*dbFb=tq_BOrKQRKCKdUv5nz>A;fTMm?1
zx7;o@hc*`>>OpPA-Qe=K^8>iifDrDy_15y(<iEBq^$%Ig6+z1Yomn9hq<xGwOr<U_
zU$dk))V^ooZ(YawGLjX<=HhSR;wTpdG1>WBve-Zj4*nJi_Lna?Kx_g2mY?h(hA4ka
zEXT_$9H2z;A-%f*l-#xlu=E{E+X>31ps5tY1D{v*9ZTC0<~sSRomBm5P!xdX);Ujr
z`V3BNdT9$aioi@R@ceS~0j0TVo!`?AJ_jv4xsk^C8zdRUr<c|(r&E-6@U?(idS{eS
z+V1@jlWwPRo(8KBOWS=3O-L$j_cOTAO^~X|dG@>!puT;#9H?`DyTl|d`y^jl<3UjA
zn6?{CTAnVJOS8OCEUA~?ZQcC;e+d_8eNU$aXhBw5^I^W%cR^{*@<Op{TJukV68W_3
zn>u>w-Lnr&zHF~pe+`_sKBRX$FoCE0(z;#2qx%uy)tLnnX<=y@Z^7xU`3We!rFDL2
zc)}R)BK8%iG<%WOdZ1Joq=q9BRB^;V0j&;wsl%S$=lTZJ#)XFK{m-lPy7?4}ntw8G
zVr#hdA0!PbKbR($I+!rVO<v`oD6{GeD9eCakNoQofftZM)-r%*-X}kBu&?)EOYiV~
z2P!5&(|({ik>{W+E}h=x`X0oP(@R^ZQv_NX0LoSm()ibZPis8(|33qR;WtoL{{9Wr
zO=_rp&RC+C-cb9Txx^MkF_e0M(gUarbl|dO*udW+&IVZ-nYKfpfq~(r2-^k@we*g9
zXPLBJ;CA&6Ymo3i*0h7~m_TLn3-DSF!~d^k^wJip6oE>IwBxQXKqW`o4p2=E8k1&A
z18akt-1rYPe^kzu*8GpLoGZ=kHCx&~kO(ATI+;OqdY9`9kiR4#)tlde|8qfHSx~@9
zHT;w)2`aZ}_{m?An10Ol9Ygvt*Y^w!KLtRuOde^?57^Q=kAb;|(!A1|A8~`&Qx1Su
zkh0Ew?c4Bka-@@@%0AF4jZFd@I9|)A?F01>HgRoWeJzYIFwOAW<athFj2|a&b<(!@
z&);%^0hBJQHPQ_KgBd!YF%biBfP+{@X@)03F=PsIsTs(n=Ab2o63$la^57I=G&#~)
zK`8nyNXLit4tLq~W9~BkFI6UYJImD@f|cBU07__}IQj5$BNLbgRnGz7-0C3!Vi!oH
zcSVRa{AS{BZ)9%%$Isth#hk{!?J&5P!ucWK#jj_edbT5lx#f20*0h5^*dX?Gx(mEs
z1~w6SAX?=oSSY=|p+bO(zukZt(o*U>pw<nYGm>Qn&wF&<2zViI5|oO-*`&)spyfcR
zGDLG4|8@rn@OmOp%L0*f(>f2m4zgh?aR#??V@`s4My&_<J5E7;*6ASt9vM3LfO+zI
z7omEcB5+#$nBM6w@^Ud~H7g`T21tMnn0f{@#<%Qc9nw4?)REbsp3ZHss<;!N)+NZf
z_fA0Dq#Zs`3%eWyY#2-2SJd;jT0(`8+-`S(Jq_V_(6|S<I0zF-1FgegJOnoW$th6i
zwgmip`GXNG@bLslpyL(eWKUPcP?>-509?3-0o2{z$_Q#Yfrj?enqRQlKzvosnSR_s
z#-I7+bH;SAqxjo<8CwpNM#BPhTZCZ1i<`$mvjHWHlQ(jUPQK|X!sN*~`Ms+wM<-ZZ
z1tc!6tI+&|5xfTV!N0WT1EBJ~7L>RI(>i~E?O=Fm$(Xj20o3!@RWmusU6YCH@8n*0
zE&qFe;7(nzlOe770Y4<6bhrz?JoE?R5O6e?u>CtxqVPIOZ-GK#%Yo7$y#<Pe{|=Ob
zR=v1>NI&i%z|8n^;-ATE9_p#!rr%CbZicl>UWP)A0{NHmwR76eFQ5VCU7H!f4H(xC
z0WW4hfLM0iL56|xwIZ~b*r5(;&>Q{-monh;1iZxjrP(jg)XC&-51x8+=JI+QHvSeK
zrgCpkZJESa&JS8nWX@>A#NT?6;iVI!4GVv34rAKR4v7CjgV3O)!TBKlxU&cYL;7)N
z2{0)DCS@2HUY7CLaPqg<GnMn&u=BT`U`%U1_5bAtMjI~vR%=jC2$6g0V_#}swGrZP
zdBRa{WWx_yu3s)|!^_`#0GwTeML^lrSt8(t?ZxyCXPK9>JT?O9UCuK6t)8qeA2QiU
z^S3<WD(ANm=5NX3vXSC%Ddl>3hucPmzonbo#-G3S0yo-1sIae~NycKCw9b!d%@6C-
zK$UOv^LltRc8PT|q%}X{N^3sFnBGt=!%)fGaIRs4LR#~)ic*1wpKPG+7pQ>znAUv2
z9^|I9&L0T>#J*hn9O7hTv7*WUJT+YPkEC}xi@dbp2Du<wrr|d`f4ep}d|0pBY!5^0
zH~tn0?v9(FJPaD>*E|8K)Q*A2qyk>dJT^JoOH#)TT+ki51@2~n;^M$zP`PmMr9c}0
zwkyastDcy=!Aq3q!!?kd&Vm6i+73^?=w%}K;(Q0FeSPG$0(g=?@AzafZ#n(n3}~Sh
zb2+`sSr9bQ{qIC+VS1OdK-z9_Is&i5o}Az<&%}RVa-+9|nc4yH*e^@zi<kR2L4gb2
z901PU+y~N})0%&Sq!x3g?W_PNqZ^D23@@7}pYfKLxOO(ZD_90(II_#FZ%k(P(Ph`?
z1f>qY$>u)t^#)AoUETuV#s19?IUq~+Uq&#3(%NYT8v*{7KMXb;{H>f!kRkAws~K!0
z_*)h-mW$em^0%Zi+KBVF6flC)3M=Ew$BdxlGKmqCg!VGpNb<K{WQ0uNyh-nH7I--a
zyrRKbz($0>eFB(0`Kpgh{j7bU=q(mW@2+M_GrSF6bu1#62I@kABBFX9*slVm&%iQa
zpa{A2dIvc4!A9wE1iawem)_wl_)-~U>UOwM;IR6<7o@L)MGk7rD~MMDUfhC6h`9;8
ze8Y|wOSSta%lpY>@$Y}x3?9=d7EJ%<EWlW*3W|q=581&>9U)6nb_g&qFdzr>)4ge6
zv49szds_}vu%sP)1{!5gYktI^2A)28`RX5<b#ePZ*44k+n-=-fh#eGfkZ^nVQiUC6
z*uOmoUa+TkxPE{b67b^f9&qW{75bs&QYrI+7fk6L!2&N&f)){O4~9%43n05|*S@r!
z8Q_#s!NkDuawi*TFOL#qxjkq%&jSV<=E+<9(%BuFK+VQOla>4p*dfzf-IF8zwfG?7
zQ9D2x<mH{o6a8fw9VV~$mu6fv`81gQ(%+Er<YegpO$E^SRKSaw+d)bp%Yc!c@p$Lt
zlmH9H3zO#tI5HYez8@fC2QvG$b<YXt(3T;L)p&@3<+U=HSH!^ZS`x%E0I~Q%ef~^v
zmX*0O*)mX_k!NyZpeB<;)8q|-65M<Y3=FT`K&l-kuMbpaawq}`Pks}~m9csqs44R@
zpE+%31UM`lnHd;f`ZI&V+{T!{C6uvT+{Tc<g_Y69h`&XN(MF)e)W)DB`{gu78&m$4
zbVeI9{+4`38x#K47Dl8ZuAKo?hNgj*Y&Jjo_tI=~T##k`RYa4Zi?5R*t@FHEmskfw
zS|_CJkg;JbQLteuQEE9*YL?dgFh316XMVmRt@+Uh&|<jea~!Yr(wd*=zvf2B3Ls=T
zUkiZ3p&uL$0hiJu(;{FlO6&Zo)-hQ+*pUsiSn}ed$w|S^?jB$duVV&{7pCpB0Q0so
zg9i3)1iVncntse#M(E{o#<ZOpV5vQzkZA`sCy=9W_l3!Cg4H;-f-QBpI9V!0LBO0b
zZKniS4+9GW!%OkWULksn4wEZGCT3=U@^&z|=J5tM6v4|IwmHjyQgZV@_HuU{rgCR^
zE3xTXTI+!d<Mf8w4-BOo;AUc{vjE6tGOuORcJhENab*F!8QE18mnYYT8ZhO*n7lsJ
zj4AH{h+-_CEElHD7%|x^%!l#c=ILP-%#3N1`J*mwz7o~V!Z=}aOuRhfgw2id(d?6N
zrwP~pXLyjuz;J+pf#F0p14B9k1H+nZ28J2g3=BQl3=E($T7yB7frV3mfnf)JwV*yp
z02Z|!P;+yT%mqy)fYsKc8H`Oa3j-sA1LFw>CJqj;BNpUC9GsEOz>v(qz~Gb3z+jQh
zz@U@Oz`#m^S~dnohWZAk6AX-K25UeK=E-JY_>slH@Ft4^wCsuj>|&6EH~eQvD1bNu
z<lr<028Ih+3=Dg+7#KEWF);8lFoPY;0y1~Oe+HO?*JME)JRysLp(cxgp&*N)o`H{n
znE~Vobj3MP#Q_M#4E$iVag2-{d<+Z=5RL$;UChA1V3Nhapa3zLK>(_j1*#Sn&B$tb
zvg*OEU=Rc=e!$4cApkZQS@B~A28Iur3=DTNA!>!7YFY58<$*dvn1KZx5**Nw0L?5h
zFf%aR$b^K%9+ON4h839%40AFW7_u0c85Ec!m~a`~kjcORHhA;gOn!YOV?851Lj@xP
zBVz+|BMSwMpwtuvkHiuM=c4@LVg*BEJ)_CzW=L}w=o;&#B^z5#{y0NS*i6q@*FZNt
Z(JVE^EXmx!FwG!wvee9HlPAP0001e?nZy79

diff --git a/pc-bios/vgabios-ramfb.bin b/pc-bios/vgabios-ramfb.bin
index dba6cb8e32256d6bd8d0909cfa7361562f1fd814..b72279fcf330603326813c1a73194a174ca55798 100644
GIT binary patch
delta 10304
zcmZp8z}WDBkv(*k#mfiQnUgm<iBFVcXX?wFsID1wI6bYqlq0>%l_%}sV}UgO?U&Lx
zZ>1UD?mMiO)+xrrnAZ8Z;WuLmZ^Liq5}uaZC0rXMU$brCd(E^#J8hQ(0|P_fp)?P*
zMJ*tjf7?m5PQHmtRhg}QKWw}p%gCG7`K;$c-+{Cp4DAdIlYcR4D~O~u{}3n<OWV)E
zz`&5U8$`YqN!!oLz`*dDEp0#B<UpoUX6Dillg}_IadNwUNKfNm@A_u)UnVs@I4{j1
zZD!i{e`$;-(wdKmq(!I2rNyVk9%5q9OY0Up;-1!eiN9sT<Zx#B`q^px+YY3sb-J!e
zYd*l9cJK!?h_fL*t=pd?J&k|6J0IBm4It4K>1o~ZEMQTAH2(F6(-=>rr!l*(Nb5W{
zCynvi-1IJY9vf!<7BMCp7XFr<Og2pXEvp!NE~It7o|D#mc+1@Mw9eQ$>1o}u8`3&&
z&PhA?khy+t8vphKX$K#$fJ~Z`*7+&mh0EVGL$H$;q^EVeg48pBY+sVzP&=EyL;^$!
zlt`xS0EJ9?+Hu!4AjWI)v>nhO+QG)azyOv238d{~1chVgr}Qr0HEEY0rFC8gIp#mu
zF)Q3V4yIjxmgbjs@i)kEQ$UVelh%1~P8#FQxghJ8q+NcIo~G=&VoqB20p__NS58Tr
znV$B&c12nzC~3GZ0U12`IE!Na5?l&fZ<iRRwSFrxNoze&qMz3Mo2is9t@$5QsdifP
z52jMp*V1X;{8JC69el{Ni6d<{$ic6r(hM)98J>JC1g3Al=77m;WJ%*Zm1cQ^f9ioW
z&O>RI_dtw`57Id64}l!KAiX1mT_`>6zbh#CN;jmZF_z9rPiwASz`@@-`QOWO#<b3t
zbJCg*Zkd~Acso6<(|1LB8vnKsc_EPQH32U=|D>mNg9JMn)11@On0+^-HUH))z1njD
zB)$O@Yp^&=>pV0kjqz1l^Pw$s(>m)v1iZ-q{ZgC}WL`MTIO{)Yod?r8U(JE2g2q}W
z7bv7Rq%qz~^C<n0cJMKC&jswJ-c0NK5b#3$Hz?WpOMw!j?}jwZn`xal=A<!xm<vuZ
zKYxJ&tsWHX{M+4S(ku`2_fBL$){&mp?al&8vmd}(j{iz?etiL?#9a;|4o%C9hrog|
zpd_~j#H<HfTDu|5@>8)0IE>OfAUckvF&;|$ej60HYZyut71KI@rl)m=ZUDPD{a1S0
zf8RA}jQ7&hx<f%eeSLkhEV}{k6DAur{+89u|4#6?Zkrs%t}P78ziFMPF1`X4E+8L<
zzL-3ZUCc$3vEdgBf6EKThF?tlEnN%^4;f21)6*JVKQJgTFr@8Z*zx~A$nrOgrKWuc
zKu-Ihmfj_hW_Tctf7_?Do$L$@43mGeOEN!r$uwD<!-DbT<Nyvab=x$<Z=f936~Zi(
z*8GSOqA*SKASicmUQ2UGYyQDe`e5<|4pGLk$;&uw87(G1;jne)UmyAg<i95%4}Aco
zXX&*4AUE_K2c?WBX`R<UuS)YvPh$>!@%lk}T6eGv%uC(HEa_>Tr7tF@bE+xs1L*-5
zLG6rv$3R-&q;=l^yeiErJ&if`#p@@N*Kit1fCD8Ut@9(qwjB&R7#IRxaDJcslhc|H
zDhU>Rd3drbml|Wm<Qy&si*itmIfEnbLwc995QrNs1q!4O3?)%%`xzGe|KE2!t@9?>
zv7i|GkjD7w^}We2xzrhdOcvx8V~zXKoAzarxaed@ZZVFQla&(9|2Rq~$8#HIgr;>q
zO$$!zJgk?t(84Lr@^FcF+71OL28Oie-^?YhX*(T2Y{LVfLe|D9&GJIAnqGRhVDqp4
zC8D6HO|!gJ%9ECTfG>^J$%%pCwJ<2C5AwY}pJsUAHCx&a9gz0uwAji2xTPF@KcqE3
zVB&8vWlZb5oSw$NEA<UWab@2jNS%_lQwCJ3?ehc|b=|cedT#XH`n;s?MjyCL`jFOn
zd~z6%LOqyU`avzd(@iPO@Ic=IwX|-r8iu~ZYUyd6VJaa0LLNp4*G&Ur4QCN&+72BC
z28NgO7$COw9fH^gstG@&?FU)fbEEGz*gkNf^8s81G#`_ho3;~F`ljt~VPIhBxe*6d
z1aXvFdbfj8-yu*MdZV^@7ekure@0NGmi<fbbA6+>cn<^Exvn47($l&FRG{wd1iKeh
zT!6)cH9(FARlF}FCkOK$S3h7dH?8?6XPJ0f=ZQIK%?HBgrnO!w;e_(c=ce)RJMhx+
z(_}}!V^W<L({?F<0?sS_7>fWy>G$-sP7Y9X$xN2xSE|1Z^R8OA*d7K@CE3W3)_Fdy
z^B5@lK<>Vf-r;&at@8!QqAPO)UiAM@>%5WH{NP7=r|YBi&e|vG$6OyUA}QGPJ+1jM
zds^p*mILWszUM2YK*{-nUV4`kn+<z8Pg>{4wC0EP=|(=X&(g&@K;$vk2TVu?6n&pu
zCnP!f13#<kH8kgyIHYwR2DuEX{KnjX7q2GE3Mka`f^ALja*=)Yni*6cG#^m_w*o+I
zfHZJA4o_=-qmX6`O1>pRkObZQgPDH{sO$izMo=x3wiDcdIjGjfw-X!^&ClP1D(f`P
zA8Lz0BG=OzpEEQtFqEe2EzoglIZ!GADwZbi6i~1Sr)Ee<-I*KkLi!)5%t`BXeWkZh
z&ndmr^_$*80}%Zq{g~?uW~diHDowwoH6Kx!+$btquaeezEWIQ2a(ajFrL-Mjw;WJg
zn81+Md04GWtev6Z5o2k(S~p)SL-S9Lve=ap3Z)TgoyXIfpUWS7!I9Sdz#d#hH6LOG
zwKGnpb^ZWF9Eh|2AgHaA)_EAz82C3g&GLGQU>g7Wi)jacF~ge(25AQ$bAU?wZ3ogg
z52tnBKlq*_t@9Jqt)Tcf`wOb<N-w7!e8!yKSvr|fNL>FC|N28|j6c%&xBpM$-*!8_
z)AdQ3<-fY1G|T(-zUb*g{p)0BAw9wGU((z`1^AORhu2HfnvbYVRuB`n<KK1*DaySV
z()hQ1RO{yRVMycOelm@J{W(zMEsgO&8skB5GT>i-IgRmBTIYp1X^bc4PF4_;tmjDU
zJe0N%9CF9h7VKn5?{NKe;00@1^8>~-%M1K18yVEP<@PYN-sW#v25M%7zEN9{1hVKr
zz>C~p=^d`0)A+Yt={u&@Z3edghvoO;I<+po76yxpMWt%pW(f?9|NhIDXQlCPzYQuM
z-lQFT#+u&c`zfvY;r+A-&W~yxd^;KR(!01@PL@b?Tuko@{S3-8pf)K8$EU@<T=h5Y
z;0uAY&V%V)uAc*5y!e;ac}Oq4+nKBHfLeN&6Qf>ww>MYc!2<_a)Y3bg7}FxsqQIUr
zNaNpj6H?cKeRxo<Tg;2W@*02hJjS%n<DjT<<p4Et&IG*h0p)eq3u&FdkfM+IH#FiN
zrT4j>QR_Bq1qJOfP~CrqfBn7m&e$gbFVf$DvRUhal7#ezS^<U<K~P`dzzdeN`p#qN
z4XHf*ubsiM3XVTeqa>~Q!2h}6Xon<!P(r!)2`ruFkf!+oBn5I?>D#o<4{6OG*wZ^)
zdD0ATzm`ig{FdHO%fnD9qL<#~4k{tIK{nKbnl}s#X@>tnhFkyz7RZTlCqUJk>je<|
zNP3!O?HT^Q<qYY4t|vgsj;N(~u~?*cxL!yzJek&dyObN0T0m+qy!Hb-7%3neK7kbN
zXaJRsmw$j97kXi`gs6<0T6%{I@3S<=wC0~2phh=bMJp&QKa@NG1;*=JAoGw*t(zay
z+|&QNK6x4NKdt$Q0VuX6PZO1744J$^)Q54x<iDb_jJlJh#Wd^RfDB0QaQ&Fx<tmWg
z6)Te75&J1^H#j~I!_(#zP`rHBOYf3vxm_aOaS<GiAJUqS@PLaoP$K&IPpw-Hlt#DT
zPGbZ$Y-3-f?Pg$SU`TJM{lrkh4vIujcJBO<)_htay)*U`$eXsYA3;>@n>5D%0WW6#
zhNQeQuC$Bq)6+U@-=wwPE|G+{Qm&_WyMFq-I?Wr>$aysRkC?1&=e3U0pj-xtY)~P5
z<vS>1`L}(5rmkloD_l9!4nAN`?{xiyD9KtGCWnZdFz%e(DJ~P)70Z#{5&Jp4E0zZo
z2B6F&fCvb?Jq)e?ODaI6ie7q`e9P?;Nl=qYpyOi4p|s8)X>ss?kou1t5CJdJCv!;1
zX?y~!26b|HK(2}X3=JfXv}m}_BQMe-Kv5+M$~2*G(z_xgz%J>EkWBB0om?Z4Vdwif
zP4je`b6V>+{=Q=jX|1>U`}Tuc+S@8*(ky@1GlSD8|N7cD@Pez0FNq<&%Rw-`!}ZN%
zO-cFs4&RTULLj}%^;5u$z<;1f1o1(Afh@-KF4s3{0cqiBVd-7IA79&nWjcSPX&y=o
zPh<R@7MvEA4mJR!Sp=*(4X&&6N80xrX#o(uAe|69s{f=l9}(zH`vUgp<XJL2lQ+n+
z)q`4cX`R>8JA6N+cYzAV&*@#kjOkt8Oz;TmHrvC{`mH1*jeq+$z4R`&mIEb<>0PcI
zX#we7t{*_|gcWEX0$xn~3G&KoYe*qx_XCoY+_=&kYB?B6q@gYJw1W>g(mH>p@yl%c
znZ|isExps~HD}*}w9X%D=^aezUCe0?=^f0IbEU-Dm>JUlIWtb)FDd051TGvSWI$0@
zAOIpA1Or|i0!1o#1YmomL|W_r66rL5Xr}%!H!X`Ht@C5Yt$-Jg|D{E|egHD39=kcI
z_|0L2n$re02NsTy0fmO2?B&{!7DX^Dv8M5FJDGOy5eKNeN#i`Emfjh{8ITs87JF!N
zleB|S=ixNZ*N@ZF`1dik94O%kc(G~n73o;UsgsRl>}3pog8~uc_AG|9EXK6(j+>ww
z*YH5Vi^Y?BWsJ1;e*hI>KcL?H0rDouk9_~rqSL#4f2DVY{!H(3{SojYYw}AOnR*^j
zFa4P7XHXIpN$+rdpWfvxn%?31F1^cJFul840#t-L^Q3nL3#501zHR-V-W4p9-Vyqy
zq$15fz0a8m)T2u82z?E0;WExm|K|FJsYFOEy(@qbqy;L$G&jA=^?iDW>xc9%*LUCo
zt;6>da&$1Jclo|e?+Se#@WSg~S_CKsK^)}z5#k`<PidVWUe^3?c*IyDmfjWm4rC%y
zaKCK)JNdl2j15nET6Zl6bX0|Bu3mZ<d&>d-mMKg&s-?ndo&V;fH6LS~3u;y=fO-~+
zX`mKx9202pL2L3)S%v!Mmj(?#Im<4;=5P3AP<j!h(g39LR+{0-hF>|Q5_;)fVT>Ra
zPg?UaCcX47v5kzcnbO=Eex>lYG&0niH~iA$Z<)wgFVgT!mA~~NW7-Z?22fM}!NZr&
z7#n^?@VCrmX!w=P-+Bx*8nBN!;Ki|rFQXY7eiie#OmbwbH){A*z~8!xF+Hu@I&Fsm
zSntw@X*(*wtl1Aiwb3rnxK3K<kAN3m?_Vk~HvB3rF>Lr%QR4ctX!3VC1;(h!67sSv
zHh*3^O}3Pemq_yrcySff?F@bK`X#7W`5~?IM!<{4$s6Qt%|Mb34_<$Uir)fNkZ%HB
z=)6no{QbHxt@$v^>+H17kDzf8Mo@sdG1?TDMoyMhknk~kkmmgQeOl+|w9a#{jlly~
z%?DXPgG17K>0Qh%2TG(t0UYpx7o_kFEF}KlPwV{mnmMiWbXw>4Icd$u8Rx!Cn%tov
z$Fav26jBO*C$Cd5VLt-qJemAb!Lt58n7ss4S}B0~JAcwT-+)K$VEL=_a9U7WU|NQi
z9moW5vBs0uc>|&LrQv^w+VHfnwBWSnH$0%s@&;7OrFHtg0QCg+F?{&{zwa2RizSfO
z_)8_g*O$NbFoRlpSA7I)8vnM_p!U)SQ1}~ON>8&6{ZP!Kmfj`9l*V{7&FS^qmXrLg
z(-_irflWCCGR1)%WCv&%a=Y&bP}3xBm%kkY1E@G+OWWmc2O5>>j(q{D&fcU2rUj%0
zrG=$sgn_-V6O`LU(hfdmN^3qY%9+ObJMG{*7Dyxo2B&5HPYau@t7O3>`+xEob$L)@
z7SuKi1=SE4Q@|!@|4xfeiwBRmTziq$dVs%0lL_4P>kfSr@S^jrUV67XlU{naKMSbV
z1l4AG>0R;QiWXKwr8WNh&%nS?&z08sS*=6Pli@Y{rvGXkVxA1J0u9t>d(-%+p5b2_
z=O?vJv0b1Jbf+DtzpB<H2I>c0OYaJOlXmbCTUzrYhqUHr`#}mj#CAd&AEjn}ht(E)
zG4vfy>pTS-2>U-*twXE@#NWlv#=xM~DVD&%zy9Eyw2KeYSpTy#Fw9kD`0=_jjeq+G
zP*We&7-a7|Y@Eiw?FXo3F*EJ^e~5XYnjrRbTIUJSc<*n>ICH>@(|6KZK|{)*@t<?b
zDjet14*q0L>pU^}mvV2;gG>fcW9m{G=P5`}x(4LP&wM3{=?%4?1xhqP6h{dws6epq
zIhl6wp+MTM2dNAUuchF;a0Z6gJaC>nnt?owuMef|0QDb1#Z`SsTE=>CTpj+A7Oj`I
z@Ix*r!K?s9R_i)gqjAIBw4GcGk_>6PSinU<0w}?_ZU}gx{sN?WLz>}9P{LdTY9Xgt
zmu@Idg4O_A=BDjr0ySH~W9=aIJ?DEartMe?N`s(b$H?YGd*=2XR7>xYO7DnW(05!d
zy-On9B6dNkOqx@gLz*qfaiyS9I@cX-4?u&EAPd)|xxJna8aG<QP|BH>vB!>q;pHEO
z^tAt_Ytk~FfxYu}@*P!4&63}sh9xNB9cD-iNXrnm2j$J9-_s(~;y|sf1>hD@XYG>7
za%z&GA>#j~3(_*o!K%8yr!^mu={ePRC~b!WBLjn4+F}bQwX{yTBkpNC7#Ivd0%t%>
z0kE8m(*`!RMLJGtI~Z6P7}OT)fmqBSmVwg-1+_&+P8&GX78yHj5KvoW;*_?N2NW#(
zbU>p@`xTr(<1zJ+L87!BE}-$J<g|=5usc}3r$wbTpZNds4+FHn{0CGBM*IU+zTh4*
z)7*xiY^9ER>D>iPjsF;!%gyxCyA2xuF|d^D=%sggur&NsC{@x+@0M=-&A?oumY(+C
zbwyh90Y1>+ij7lxnq}yUqQ$RW%zDoC9ZPFI{~z4$xuBQcEz$U!fu$5QA`-#U@LQqu
zm|l9fP|xW;@W2LWhQ-3^^(Ihp4I0i4T@vu({^W9Xb9qo1u?Czrn@>t0lEN;~uvoy0
z)00oDE7;h;@~>LAT`NO+XYHXh{%yY?eZ=eh&4G;R&9#RF_}e`g(>l)~TJWIm+J(uA
z8lrOP{Od~(rFWJ-33y>~12nGCdZ5Gw<d!Gt-LZ!z2WUvtp8zMECut7p+OCJd9lI{q
zx9J_O2ciAC1FyN#kGURXNI&L!fB}?vtxFFT7egHkvZ?(ZxU4;p-W9_8EZr*fV2ME5
zZb&cdcN*u7^p4O2klt76-SiF@(<7i>RhrxD?P-2#4rxyHpkY|Q^gh>JYUy1Z=^eg1
z)B9ZasHJytrCa#!EV-TLp4RxEfsuis#0gxJay<gIcS;YX@o$HBBlo2Dgzkd6=*ZmH
zYe5qZoj*DbrFXd=1P%72r*XR;=r{%%NCJ&5q%|M00XL*U4M1)t25^NF@Ph67<XTPb
zdY+d^H5RB2>O7p5k&ws0ke1N{PHU`R(&Ex0(lQvpVynSoA3uY-^l2Fapro3y6D)T3
zGbjgvtMEDB0$zOj1!}(Vr)3-g%kKZ27Wp!W5nP&p3lcX*aHD;)u9icBoDH}@I*`VB
z0Xk2&*nt5Y%9ql1Fff7g=iP6hLA}-kB^IDO`w48O0oWBiC;AS6Dj~H_vmd#jL~-zu
zK-!KlgpqxRC!f`lsAsbUTXH*%^RQmG*pJ-SOC`K%yY&&Gpsq?<2CoCix<j8pty+-L
zYH6KjUvgnXn{o;aAVElBsg}0*14u?~5gUVEmlzXh6y{Re!AG1Rr(0eu=2lDZl1yW~
zk>>dNL(k+i?a+G2kcoo~sB2}z#^17(6;wukC|3l{!ilq%^V%@-w`^gwVJdZbxt}Gy
zq4o_6f9nL+m%6MVHWz<O4_mn?h{?g<;?D+RaPqgZvc0Tk2eAeCTdKi=qWmql*j@&*
zgHrwnPzeA^Ljf#(GT>GOQ`$~Yn5Nl=Ik_5@u%+z;CAYp~lkIdg#4H`afpj2^^8{$X
z*@;arZQ%*`$u&Carf1yK4!#ypOYe*lO55!VQFl9y^E60ZlvvvC1T-P3wB02RlW*v#
z)LS@#0;KsDbBSM?;q5fTlaMkd&GK@wZF-uu>ziV;wCu}#dg<MhKm+oi;dez)gQrs<
zt@!|xURt-Eg%fzV%<>oi6i|_HDUI`Dn)B-&4G$Sh#UUmLfXuXTLTCe(TBkszmH^Ys
zmdTB}${y9=n3ebdPP&~x8lEr)yf|<dQW=yAr-i3wOarU<_8v6*`m&WZz0Vcg0s{w7
zTIcuAtMt104!BQ#qwB!5&U&(*o-B`y6DR^f6D+<@CWq^()jPALceuVv?{Iysmfqne
z2^vOIOYiWL26dA`B650Z3(vSW{A4V#1&s`VCXZ^Lq%|J@|DS=u@INRgfB)X_lexsa
z<z%T7ct{NtWIOd47#M6BHk78O?NkTNE5~l&0GTEOmb3;{8~Z_Z>g#&%w1Y30Aaycm
zfJzD!EJxhaIxnZ~0@d$nJ9mQ=x85#gOWO(22Nt#k6=3CZY0W<v%jI4RrR@icLbQMz
z25AnU2@jAeP^hS-ck)5#jxdQd50F!2!5w0w4mYXvhT2yWC3fXXAO?SlH;58QKj!)x
zRHnXRC=E#451Mk=#QoX=BsKYn{t~?>YU!PEMrnq()zUlSOhM+Esik*>nWuIB1O=Z3
zNW>CESb-Ewo@Ss@zZM)>l5f)@)1sjX-9Z49{~I4M{9}O6RjdNdN7a5v?{Jq*Kjtpu
z|8f;#v|!;b22juJLwct>Xq~_TP|>m<Z0w;opi}}j_N6YUN3=aqBE2h8r1=+rxktlq
zrgG={H2!Ue!D9oQ7aAV%mKsA$O5@+|F96DJ;Y<N9=HF_$UAjB1`G9@e!5?f81)c5!
zuUDiuR0=Sa$)q25l<{YLDai!32)X0<{3p0{WavAfwr~$a>w%IhpmvTPXtHp(00RR<
z%cc4f1;`*{!!PC%QN8po2evf+Z8vN<$~e-R53{E=KmL*a%~9ZQ$!xu}ZZjFDwAODG
z6Vf{i1=2b{%mEE-%>}nW(>om{z)2FE^uDEcI*Nc@#qhEPQb5C<z~2(^UoUMT$fN`O
z9WM3%L7rgbZ?y)GaehcY?jXXzkbc}j0!+&IGrV-hFoFL+)Ef+G%`ez&82Q`({sa3x
z{kVgSKl4jL#<ZO^jtmTGyEZX0FuZ)nkly7eV8d7<VZ&77&~kvk^&DI|tAGLj%f!i7
zjkFm}Co>vL8%aW?x*P;r4wSI{J5i$WI!bTB0k@U|r9pZN4!Zq2Q0fJ<On{m3<%`LF
z#u`os+!z?rc7hT%Y)0<on!hk*GX9LO71DMVfSvS`5!^F!{SfeC>sz=A21ZbunVlo8
z^Kih6Gn4-r>$qLIm)_+pYs16evYM&99#qc%V=VUu74g}O<@}%`-igtMiNEzG!%H7V
z8y5c7QpU8METF1%R}CWr1GowmeLK0pM6!M(yA3CQivd$PuMInY>n_H$=2QP)E@HId
z;&0VqO6$CVoMxn+*$DBsn6Z>w+3@qX1TmG%+VJwXnlOP<W3UK_be0Hs;dVQ{!&&BK
z1iOs@e`^d=+Ri6n&s8%qFuXKkw~^*=;btr6w-M%VnapZaFU8+7kM$)#yNwKg%N8~p
zfBsfxb~I}bd`s_gmI2ky&ClvVO9z@C*28*gYF%QT3~9}exYC+WF}572WNtXukhUK*
zp|_%<R5)$FJ*Y71{9waY!j`rlG^mi)`2*y<w9XS?pGkvC;<VV8R&Ue0oh9I=E>2*0
zIdk%SQ}xI<*V8+lMP6pHf%;X^G7Z1k`P*aJ(qQu^;Jm}%;?34^6O_I|gHmhm^c_=M
z?8ne|OszvM3Dg4!PRqCg&h!i~K$Si?_@_*kH<M8Ee+n%%Q3Ki@)F#{JEEw=2YI3BR
zso<249iUq2$ZG{~la2k(<oRZL0x?h0c76ee?F~>`_L_XxOkO<q26(ut%Nahp2^tAM
zFj?4KkMY}NCv#iI9g`c(9iuL~GcddkhqgKvg4Qe@0`=5iyY!q$+w}m{o3jG5K)pNz
z7_0FR1IueAFb||%0>ruiV)20rw(np+{+ujrq0abqva^LMf5{0@A@}kGGf3fs@X6&C
zN=y$@C(pJ}tA7CLA|3z*tG7s6Aea_N3ryPyDt%sGOWSz`>@^o=28Ndw%;{au0yf6{
zEhdcR;x>l-Eu4%tM*J;?%r*igrZxs8*)K~OZA|%F+!$@l_*?uKZA|!ElM#gjXkrkY
zhCp*%&5!=Q6lG+b>}Y9GzYkGVFX&`Q>pZU3CDy@^)_D!=92rn8D%bFnsYI>iWT{nJ
z^Mm}f<`WH|W`Fau4{6QkI9{8A1wr$R&px~s0&|*A2!K^Q`jFOnEv@++=WCF+GGrY=
z%|6X1X_09Wu%dVJXG<Z*(#dRAicGIHCYxEQ2Wh2oUQk=q&hT0>ZRZhi0BmFi^{mr&
zZUOUlFhjF1)ARIW&N4zTH!`N}TmqKb4+^P?jA)ssdGZ1)bq;5+<@S#!pSMyFaAZu|
zIR&hRnT3JjrQ+oOR(kRea^dZ=^gh>j;Hm`F@M4F!b+W&8aeWaai-W?ZSf=?0dwF77
z=f{ShOy!Yj{M&w}9emD_#(8`NFQ^dY-|h{rq=K2iDc1BtTIa`>lchZHs;bjj0OSFg
z*Rp9lJHU?dU;%p#oGqcb((@@2@6cph8x<zM_mgMam@x)Uo@Has$UXUzjW*Md+{yoK
zycs7=_O?xuWq9-de_D(@ds-AIp!NRieaZdxM=mWuuTSnr?&MRpPK*mD^V-=leaYSI
zYqy1YGK<rN%@3T;Xe*iO8R{7-7#SFu8kiWFDrf|yrYLwMmMAzE<rfz#7@F!CPCl0>
v&0(TzsF#*(Vl??<o|v$?o`J4`ZhDfbQF5Y%S*n4hNy=oY{AZI3+!p`<3)o;*

delta 10691
zcmZp8z}WDBkv(*k#mhpQACncG#3#zJGwJ0|RM!kWmezSWt@BiRTDLDpdY3Ct+QDZ6
zY5d!7r*VExGyK+fOf9Wbj)$?~Cu0e3!%yZCo|cm(TpJ``vu)se&9p%~ZKneR14G}z
zG!L~!Eg+hI+a<M5v5AXR*}7dnq*)%^cuJO0tmi`CfwUbA?F<ZQozH%r75()mZBAO$
zWCbM|BayV`AN(a6Y0W<b_@^F7<KK25t@HStw2RNvnvb*1P3t^7C+*_nG{(be&4*d%
zzUE2W&pO$jsg$id^g|lswaMF=l=wkR&I{>j-Jx&N_}3qr{D?`7zdQCr8t0AlwC-Av
z*zw7N%(5IQ9%-$Y_*<?_He;5rpAWJrJ+0GqMOyO#_OydPm_eL1>1o~m9O-HN+uixn
z)4EI7r17u+ke=2Z&jJ<`NaJ6BIF0c{8smpF#tR?~8`8Vnd2E>ZTeO&LSomA+G1)Nj
zx9nr=xscZRZcbYBu`P4c(>hBRK+Nj=I4AAkL*}_@{M+jfq#b;~0uo-3#t5<@bVI-k
zjlXGz2SBDSNl)u`1!-ac@m8ca)XwKGQ3pvj)XoP5)10)657L?su+8P4dN_@L+wD1N
z*|(WtA+&>)fq@}yH<;YT$iTqRaWn1mqqNRzAP4;iJ7`02+CH$%!L-ZI()>Vizaj17
z&-AoT-zjOG2j`?Q-kb|^!-}-aFCdbNC+4JOA7BQF`c44_!OZlu@3k91?wbKt*>Q97
zEEdK373pc+u^ZA9Z@`tuPDx|Dkp@wo*7}Wq>cRB1=Gqwy{8JCLTr81KYdugRmDc=^
ziGS+BwB{d7{8JBcoGKLnt6?hTNHe^YW_a>7M;h2C8#&U`EJJ62e0}gSQ<~)kP?F(1
zk;Zu=&GH)m)I(|Y7ayg8(?aQz^bQwuq4c!>uAtB?U6Y>12#Sa1+9e$Ptu6mvb~D1G
zD9!M8dK&+>5P2c6PXb;f|4C2lWJ_}fao40V9!qQf%~5)%2b9Kq*MOohjek2h0@FI*
z&q-@OzGZG&=b<@ijKAjAgS2c2c;WK<r8XnT&~TWU0)NsvU(QKuKDcFW+Aa<T22j*8
zf)c=*G{%o<UZo$>IzP`zJNTG+ZqKDO{_U624nAT@>wGaMt@*%~xoM1t(mHQK&3^F<
zlo<V`KwMA)J&~pfkxFB{0kR*Il#c#N+YO3fkV<!%G|R*My>l2q93*Y&Y2EHDpcD;q
z#RgEC?)((+qWf2x^Xn5JrS5VdNl;valKUZ$P`M0<tcP3u1LTGcX_kkICDJ-S%t>pu
zJn(-mNLP9qqw5BctH0k)YyDQDl-3DKT%n-+<+>r@h59d0qGOER0Lry%(im^OzB%~@
zn*r~4CL1>Xmcz{dPVl#$n=Hz%Z3oT3X`QDoz5)dcC`-Rc<6nOrTuLxr2PNm)59wXO
zJPp5?`CIfE8-B6yx4dU;_{GHE(mT0=T}H;D?*Pb|AJo#j1kwyaMa-wP{p_GT()n}p
zT6Rh1$1epZpJcaiyusA)kg<d_J+0C81A_u6hMH^NFqS%`8GZxl1M5le3SkyXYktI-
z*7-9{^B^c=ab8PvNNfJVQTlkYJ%=b`)8tSNTSk}3lR0eNAg;d-a`cDvw9eWmpukW_
z+t0A$|Np+@X`L5AGEY9Q0)<Am?~C*_M&Bo|Z>Ohq2g|^{Tg)<9m{Uz2RCG;aglPq3
z$~S49_dl;n^Gaj<{QAM<C{813h;_%)0@6A^f<pE~+75;t3=9D;wtt(vgwtBEyA)I!
z9!m>=h`&5B`7Ng!W9?)SE(hBhP|P~ZfHL%l^loRV^iJ0|>0Qo3X}cK~{QnQijvp9G
z!ut+`l=;3%>%9JXReIWg-w$bwpI$$l+{2|VIqz#)^AVocf@z&Mdegq7MW@B3#izx-
zRQfSlK}lrt11>3!=6@We;w>jDCo^#y)^{G#OIvuxDb4awNl@C3Elvy!Y0bZwOTyAZ
z(>kA~1*h$P01`4hpqJLocfl#m@<g$kUV1lo^Uwb!qG|lwPo`O3EagedKERj8`pAia
z;k6hj77p{hKA&cI;5BF3jss2%42PH)(xTI14>5sRV1vWc!qS4%n%_)b!_8?I`XR0P
z0TX|V5o22C>GU-IU8!$4ip$gcTtB4k0@Z72J7qxWWS=L9?7ZJ|qwm(|C4D!*3Oesk
z{>H6P4`QpOcRDMj86N06pqADxR>J@hOY00)0f{W+VT1`dYd|dFEaFVtp~Jwy@NzCg
z+CGp?eaE17b>2(c53&v%e=rN-YC7+M3UQgaX*=0KPTJoR2QEpvLqEWjLagd`R)XnK
zTfB=QP4zz`C>><~>pP~lcn{2h-N7nQS9c;@-5sm}a&@N|597<I$)9<Ss~<F&o7Vh;
zvrHUZH8dX#pPSZtse}{CGoPErzwhA7haV?D<UJ<7Qvu{I&-7y~91Nx3)6+Ty^wPS;
zHcURqr&JGWX@IJjGwB_!m(zBDy?sEfTWk+Q>!p&)H2&?s(mH=Z%e*Ud171w|pVoOJ
zt@*)^^iJ1DpcH>5z0>ze`Z3oBj7X}ce@|<E%%0Zyq2)lOq+WWLJDUxAxj<ScC~E7|
zja+1(fvijKa+SH9-T~qrbA7;sq(9<&TJsT&$>+I5b(`NPq;(!n>%4~IxHQ89t(Quy
zL8T8=+l{#aFJ4UE&9A`y;Ty>E^ez|KSCb9JMJEZc_;(&m+W{(i(;9z*5_O3HB$+q=
zVCJ6!Dtr#WnoMe4d^;IH&49Gd^J&e`-=}f@P+PQ<A+7UzTH|wu1_p-GbiD-!CI<>=
zI)TzM)b2ZT1767d1GNRxI$dAsEj;9u-s$>HZ{ZOT{UiOD>kDQimD1pntNDn+<oDvD
z^%`lN$I?4OFQ#|+UO@6<0z+Eo1+^}|c7}$BjQp)l3~Jqctqkd%zL%PRa+H;%bzVOB
znxo@lTJuAR^bX(iX`T1enx8AAb^c7}@;zS~lGgl4KCSt&eOl*zP-VzC7hFVKO6$Bl
zC$0G~Bd9*OnRf6ub6Qa64N!IVZ*H39uM)vD{`Ei84*q9O>-+%{{XaMD-~)~{Z%}gv
zRG)VqKlq*_jepyXw9ZdZ4}sEz&|grk>UuHl-~;CLPS?q`g5ug2_}3pwWBifEzx{uD
zr|Xk6%YSu2X_oivebJN3n=g|O3+f5(`I6=isu7-~IlNw)295ms-Qe_iSgl*mi$Sg1
z%!eV3fBUyI{%t4I_}6~~wHDJD4}jVNpr$eZwo7UJ>o2D<UP|k{Fei=i!(4E22P$YF
z#TTTM2?M33{a|yCt1Z~cklx|?>A(xtwB`qlX_hzmTjqf*+QZQLjlX4bJ%ieUBnFT@
z0WTtcrF9-m?{NK`#=q@K-*L5tULc8|mdA_p)E2ZbSX?MdQ(Kt8VEbRbJQnQAgO6F$
zyIen|H9xqY#(7w+LvAO7UV0Z>%YhQHj*IDCp`St7AsXyPP?0?UZ`#3^0_k0@p95a}
z`=^)Q9mdrsdPpt3D}Yfiz1xqg@8E$$ENbZ;0gRIs7^Ujpn1Iub@8vXD7(pEL%knsX
z^E7ZX$CV@Cg%>EhyPiRfFP7hF2cI*ich)}YJFM1i*9r>N<Dg3BNO~Iow%E)3>+h#`
z#y$yn!SV(aSgi+264D!L1sF<%Kz)$|FIdt$5?n8*H>C3Lzjgx0CphNjfa1IP!2h}6
z2!}M2K*?kOC$MyyLz*V2)OeEK<@y$s{nMI1u%~yp@}wEweyxyx%=I!udP6M_L#2pb
zdY9W|I}!1?Gie832!I@RAU(~p_6UF98c->D0F;(p&#0w$u~?*cxSmKeJek&dyObww
zR|BY=<KOn-wIA43NJ&)l6G+t#u!74!K;8^JF?o-OjHhOLhYRnsG{>~&pByDJX`L6+
zK+>JAC(^rIFQ=!qmYyiN3-a~r>mVbM%c%Vy)7;blyFPj8{Xebwh{@!GqLP!%MI{+S
zCkKl9Fd9ytCo0P*Jb90(X8lKy0qGsC??8<@P!x-R5*;G5%k5!kz0Kd!4~mD|dg)!v
zEeA@(J1&9?-W#C$8=gph{DY*s?FZ5r!M&0fX*(F$89)K|iJ=5k;DR%3^9hCYPS;N$
zZ<fAGv+Vp4@Z!ktw9Z3%>D|s;>75{l@NbL#2x|Dqr1!bLOY6Lu)_Fa>+x64u)!=52
z>x(qTL$B{oUMMCj%fIbbTIad6&O^}P1QoQ`zk^!E>7B8YABf2?b$*`wTg-%U>0|?O
znfeab&*@#R93US;y$x#ilnNlcYqy7?^?yknsA$kj?_zH`P$CWLkO{zY#gDW&xQE65
ztAX-9xbMq&8<IO(enGtA&XvZ${&O0r2gi63)PVyf42^B2AHk-jr*+2ifI=YlQySxK
z5RW4bk=s&UfO3)88;<m}&d@jMT^^uP^iz75hh%z(?_^1d4A;=lX_}YQoI$;#zOxKz
zt+)C6j)7Y1+bU$zEPvNCry2eSH3vYAw_lKkN#7y0F1{p&^bX%Q>0J(j=^d^gC-0Y#
zukQl!LqVbPDd2^}KTw2%vp?glv@FK-F4vD~0cqiBVd-7IZ(iGhWjcSPX&y=oPh<R@
z77UR9l_UW#n8BJ6x;lTPeZP?w08;|9qu@_k^AQ19dv9{Aq-g!Ij?3vCz8})NK;_-%
z^sX?*^e#Up^f*aEiW5apET#pdce#E@3rGuwM^3<t-k%^Zyf%fzM(7V%Y@|2Taxj!g
zKwI|Ugvh_`bQ<RgwRHVXrq^tJ2h`F#q|&?C(j3w|*x+H-Ee0-04_IC(<w!rq#*qHc
zjd8MqlGNmRQat7r0-z{#5Da($Dn&Y7KY;Rnp#&)9N~dKpq;>x6xCKp@ALa(Uc=InU
zBF*ph1DO7Lg#M&Ypn?QdKd8fiqQ4)i9~O4;;C5=mPxf+MNF5Rks{J}Hz#I>*ia=E)
z=MA;=P8ZGqw3h8;b!jsp&$Q0NuOFwU@$X}7IZ(n8@WOX;zH}_(tjTAk?HN@j^U6pu
z&HXt!P*P&Dql~2SE>Ne$^+#G31Kedl<_5gr`=1t_-sSr%y({!*dY9{ufEOA6K;8O3
zX`OE-e-sy~PwPCKe$4eVLwdJ^NIEE>x|~5t@Kbtsu>>g4oO#l_f(6n$Lf^N3OYicQ
zDRE8jb7lhfzd&O<&Bqz%Haui15mHO<@?cEw@O=;N%rzfpnhQ>EAU?R`3kv2Ua4@BH
z{&>9^)H{<(@A4J@l-?BzD(F5Sh26_-e?j9(jy!3duR-k&9?(#QD~Dcs7emVd{+1m~
zHmao(pvr+Gt@9YD5zROk)L2pg^%fM<`1c)nS;hn!i!hjcOje;D)FOLtkk<LL;U{O=
z+1LCHzYI!GgVY;<)L%(6JlXIor&KAe^E;%;qX$anAR(T#=3`8H>0M$Q8DBG}b^dGk
zl>#bl>m3??>G8MBWULoy_@&C<`jRnihbjZ8Nj~@C%MXkVzascsRx>pGO6G4p$C%a`
ze{)V+^FbC+OKKl;z>BJfFHbQx{3_;enaEgg-ten{zjY-ew7CUR)GeL1!vJhrz{9j1
z6=0UzLr^UQ9%)GHyzx?;vEf%~iDAR9iW1kCIg^*kDKK(QJ}xKA67c7x-Q*W?@e%<q
z+8(5Ng36f}uU~>%+aJ<8Zv?!UFgae{wm#s6;e#~K*Po%{w?F~;Cg6qjyR^>VuXDlW
zV)H@9xuDvV(WbaGIt|iMfjAD796|LAN5G5M_tTtTzfbG@oYr~nwP{)>+@Iaj(8@>_
z6c+(64uKTDfd!K6miwUki~|&;ry(N^2SDx2PFIeXmVYNN6ce57qrk!8YX=I^KYu32
zD44K^f;k5!Pgk%^m;h!sfXXTbSV{(GH%Lxve!~LFuz%8m(gM>mPJ<N(gB0_C{0U0-
zX|XR2{zDW)ns&`^IMO<gr*&Qib!gs9HdK_X-@^cEL9wRsZ~Fw!9iX8r%TL9;YUy1(
zOz8~1pVORPze{hZ{mj7MI)Nc=7sH4D|N9Q9rKfclu&42FKL=_!9egE_w&Q^v1E>-x
zVN2U_1H=qW3j!D08PCBkTlzb#`G`mwq%qA2O6IX|(hfcrW=i8coObX%3ut5_EI2Le
ze_G(=$BGt=a+7706zX|EZ8%T`lopVdp=u8bDE{AR5ou9rogV^TynK<?dVs&hnhBJ(
zK_jUFFXp@jg$Y=^Rfh>woil;*x?XyBFpFM#7k7Gx?<c+VE^m(X4&TqPK22KZ$F#<O
z{}~t<>X<hESL@*OWPnK3_Z<X{b-ZbO&hRgd^SfH7-7bc{gKC{}dqC6zP`BqeD2m^t
z9el=?*8I#Nt@-)>G|qo%ogYA*qV$H^PYk6FU_)F#s4eya4K+hL82{(0b;yB-o_Dgd
zF)*lg@+B~UqU{6!`a|GxQr7?M3=Cd#RT+M~t_GD(wI9;>w}YG>&E9tq+}-H>kv22!
z`)`P`pi00O++d!W_WdVhTsz=J)*Vo*#PC2`>!r!L$|@Y+(+>V)PV4+Id8Tr2eM1%l
zs6BNljq?<w>s$kBC4J^AkpV@wK#4Ml;wW|MIhl6wp+MTMhBO9-*HUm^1Ovls9yref
z%`6_q*PQ8T$6a55I+Y-gy+A7UKm#11lMR%3>O;~p9Kf;K`y(w<FKyw3JW%wl0Yz);
z9Hz9LTnv&7X}efJtyV~LdBfa*7crpGUC@A>@(Yma4QYnA(+t0*r&*V7D2`9t$plgj
z83=*s*)liag~p5Y9^WPDJ)w)zc9_|NM)W~rp!LW1%uVleU8I)Y#h>2ix&&0%TU;y^
zPjgRmNV5gGtn>lM@jKccr15XRk>>V#7N{Z3nU>*e&%p5VFGE^zT1Gk8182X3ljTm3
ze<8!ZX*(Dg3>X4l6#h=@JO=Vn%W(!!GF}2!KlgiDWLkYZs3o=p+Am&_mcbyvz>t=u
zke0!~%)pSA!N39<&--7xB0cSY>5{aJ6JV{$puWFM&#AscX*(Pk85q>k7N2oaOY1aC
z@qpN=mbN$t#1sI_ZE)JarncySQ`!!YacYYXfmqB83~Gyy)H`iZP+N4&X#<DaqT@~*
z1k@Ita7x?B0}8->;NJUw&|m;;kS1-%6VTvR^ZEa;6Vo!jgWYoDTUu0F^NIg2zc7GD
zlba9y0hOm7|Dg31)7*xiY^9ER>D?YojXxQf%gyxCyEz(vGO(2E=%v?pd9XD6R47%_
zOYi0bNtY;r#=h62H6P#ujlf)R0*#!nDO&p4sOMzgLACTwtJhax29#dWONZ(|rI+3<
z1X2MS?odnX6g%VedK)O>K%?lPD*|4;ehNw{TR?5u9iU{n$HXWoBF%8JrMjYA+QG*H
zp!R+9Nr|*w;E^*#vbp(mvaFJPy#uIy51lho>y~Q;jWu|IdbhtU&+|8jFgE`d;BWV3
z1Z6geUQn;@$um%gh!NJ41a)Tlw|(GW|2e(0^hv;rch^BqIsmG@A^rL}pcw}&y~CsT
zK;z@CPe9$n8|j^{u<qf0P*L9eogL(#1E6I0nj`&~>wbnb!~bc9-z@JHJ3-rhAjdS`
z168bs2hzJjc%P+Ph3+rmPumaa?EO#U`~e!i0r&7q@1=LRm>vOj+tS=#?*ex#I_tsh
znj>@57;k{wyaN=n2LfK0JpyM6Xb*Ht&o$^=!I8P?X_me_O0@cpsik)bruVsSQA_V)
zwm4J*p4m8%p4M1<fPs;Lp>*48=`_bQ=hx>!#aHNo^e)%^;GreXA05YDGlQz4&I@VH
zM?@W9-5qerk=FS%;KinElQlK9>rGxF)rg=m(qNDazoca_<byJhtOKaZxcxaTE-fN0
zV?iEB%myrW{4+SeW-I|E=?pKh*yhh^k!jH&-+c*qG38spi$A|W(ZipX5ek-{{5dW1
zWe6j<oC0O&R*%VNHQnmh+kgwd18JNWpmUFl9T>pDeJO1R0~5#v*S<l=2`oS*Kr`4h
z7O)F?PV^l}JNTMKty6AB9w-4Fd?b*z<2k}e&|D_iJjg(;nF2%4iL`?c1k!d-w*}i<
ze>;uyuwJ*=jJ(!MCA?|74?u)LqM*)ETE;xEb<;k9Iwc_MKt;urJlGhj9LPY>L?<W-
zsiiHR0FqH##KxevfC-euFQgrO#0i>7Fa!-=7jvtncS(X$s^jYq;3DYzWPa^{dJ#~t
ze@O3gkV)@weFL5kVJ%k#%`wWdmh;*$^0zEzv|%cBd3ls2y`lCE3xDeb)|bYtAT}3&
z%W}4IQ4o`zzeSS`#Ngm>No0H3#tvc&@V86@3ySi${9=1q$PS9259!?nOrUx(fCV%N
z%>qhJlYePzh@El(2g(6(uPUw6iA^tUVTQ+K3mtXS9FMevuLac7JEMfscHe`jyPd{)
zS}i@TGfFIN_eV4#skGg!j+3Y8sMMcv0!1fipx+;yyG}w1r!>p!#de^U*_$-W8^tDR
z+1L5>(z_>trU06M{V$ORrT<QWwB`d$dTHHqXPiK#Q<~-FQnoZmHR1kxds^$sQqaUy
z?VB{qAI0Ed=QB<SeSOE$nos>_Q%mm@csYBrrLM9Ek0U5O{d*5iy`4WAo-hWyxOx|o
zx=Mx9!qYO;!7A>&2hC)>+{T*T=lTK^eLF!xl-BwE^D4b=z66iSOLQHy?Gecg6bNoS
z;0BXkdUrJoXaZw{6R4dCssVi;Oy<{9tM_J0@9=%Cmfqn98nb3j?{Iyhmfqneo!;g8
z2E>rlOIw)Z0qP@zTI3JX_}BkRYdrq{KLZ1(OuCfz{d-#H@$`n;CyXVUAd0!f0z@&C
zI)g0cvSrx7-*TM=R(<M&rW&rWY~TPHEt9s3sUB1@?XU(3?_)_j_?`(=^gRK$4h(O<
zmeEUFnBoC$3LbZT0!qzkJ9dL~wB9adO9N|zn%wvwRPvQ`r8WO&Eaysdf6WFd3qe7p
zmfpz*qSLz|ev^QY^s1$McDTu^rFVo$HT;w)2`aZ}_{m?An10OlHADI_*Eb9eKS8tH
zX&!0K57^Q=kAt~~(!A1|A8~`&Qx1S;ms#h&_HFn%IaPm&-UGGt&N!nq!;_!@H3fOn
z3}m`_TIX-I^o}?SkccISumUNVY;K@ZZwHRs7jIzY)Q9wL2Z6NCLurkV82&N9XH2Go
zMwDtlq<6T>rXO>c@qhUoF_N)x7pS3G`ysv49kgQN0H{C;02@2;4Jc88bJt5J&@3-x
zFd+b(&pbfm4E5U!B+|PgL>hiG@wdA$HUH!1Z?|Pi<KK1|Jea}xA+7ltFMq2RQ^1Qk
zw?HLihdfiu?b5Yr2Y;}E8q#1(U(W+ufz%#+`RXTFD7~RVfQi5TH6wi3W#JwMPz(Pi
zBWUg#)Lsxs+bO`nz|eB3L=lpS8h$aCh=CdcYz;p_Bkw26IMSLAvZpma1W)sRNdM*_
z@Rz@31|uj7Zg5I#z0Kdz&6wU9Apq`+9DKk$7u1XfIRG3c5|AWpcq#4s=k!i@5l|oA
z0_L82HK>EUK$QT<v;+JdcF>?|s1RV}Z#7^{KkgvHz>t32K>|$5_%poB#_$m*)JI(m
zY0WR#Y#905zk{O1^+Wn`2N{3nmzIoaI|V>h)2<pu28NfPA(HaxT@C^^j3p8_OeGF2
z2l!hLL&VdMI|vx?zjU7*W2EgT{SW3`(CB?y^8<cJ(08~CzWo0e63|@^0xbth*#4a;
zQFtAtw;;j2<v?kW-hxE;e+NpvAWDuq2rx6gJU98Okw$8QI|D=7PEe+SwFO^Jf|>+!
zF5_$Gw4E$q*KTG6wOG4dKLot!dkZs2hJo?5A~f&qPzPm6(Aou9CfyIpsxQlaPgYQp
zXE_}3!eDZeu}=M_d+A-yvNk;YEi0JH>p>ODZ^m+OP=%7gSk4csQ0y6PnD|?7GQ9L;
zv|-_IEn-aDIRoqlP>6v?0ZzY3Kkf{U3uka#I17Mc#94-c;pH-R8&3WfU8Ztg8+QKI
z?Tnye_T_v=8!rA<O{TQY8}-P^^Wjq)A^sL)mU1f_e*PAJrgB*uUj9}?aJ~o@0o6jz
z5&<tbZ>M)S%e?euw-MlPjbuvOSpjxU1rr0qOLcY|Y5o>QwsL+OVg8m*RvRh)mMN?+
zS=eo4_*>Sp+4%Ff{$N9%g04@CecA90)GR8N0d-HCAJ(UJeot$DUJsAlF0oFAwB|=#
zY0ak?(;KQ~7%G_?&NXaMNNavpQ7X{zlMOU;2P%v{rZpe12e~b+^9QoGUcX82c9wvR
z)Tu2_V0bx^ExpTIFuf~yGM}lu@#gF4oz5aJlh{D+h?Z&i&CcH*%9aM5`i12MXSR-;
zpr)GPfq)m2CnuPSXs3dUlc~=^4GwTbL|;$qJP4Y-0Zk1dJ3(^td{Z%Q&PN~%oCO13
zC{8|LYAWdavExu0|F$Eq71BT>^Y3m?W;4@sQ+txOvjZHYH$Yj!i4_#^-r(R51`XhC
zbCy9i+VDntSFlWamot2v7c_~~Gr7u4kMZ5)m1ee#8zw(Db7U&?n5<<kZQB6q&sz1I
zfcA3@V64VN3@opez&sBIhSw4xRso2`2P!x_z&`Dp++?oK_;&Itb5;J^$3cbY%LB|H
zg$)st@0lwxHKa|xXD%^W%7Txn!2`tf1eIa0uchtG0Q<+0nStS@0W-+0HpcudHjL%s
zHirByEQ~fr{4JWyHUcH4HU=fxFY_2}O!-?}8Ewq?TYMR9O!!-4CU;v%Gd*LNyu!kw
zejB2Y@8auZNb5YW)+N@#kk)w(9K13%j3o*-OeIP!2TIM-njhwaXK>Fqq%}YK0Gd5+
zKF9G|FRl4`{%dZ8tN=om^R)oT%j>{iKKwW>GA$wvIvt+Y`BSaKj<1uU??4)8=%a(-
zwMKfEvkbUPc<>SP+_dIL95BUd3)&gdnjd^m<Gi4@sGTAGn6r$~%ioNXr&_8zUr5^-
z0S=ON%nS^#dD3=zfO%U%y<yO}-kxW#*QV{X01NH`h1vv0<Xn>$`!Z}YpOret6|f_3
zKbmZ7r6AzIn6^^`tOe8oeyK1y*Gf;R0n`@&Er{Yg0h-_ejpBR&wSm|m&P?n4K6#f_
zaeW>rkp+Wux;Ll>+zuWq-sTKy=6-1Y$6oGh!&L5xRQr|M1iaw5kk)#j!Z^L5_5(vH
z2e|U<bQS=4ROYp8+D;j;TU=Q{qYx;IPPm>TCE!C$48Q(N-e9f3C^`9}wK=26WKJ7%
zMzP6`Hrh-x@+Rlmcr(tOyvrs@;qdGK|I=dR+0&vxQKI)>Z%W>;KXPdSdVQcC#f}@3
z3vCQ1=i2fyrcAD}wPTu+w|S547G~zO2@@t4I9}jMn}C3u9h}Z+D;et<=@}{*85kKG
zm>XFrXauFED0n26C^#487Z)oS8tWNN*2|OTFwiyDOG`GkoE(@ZCTyl>tZSf~o@kbu
RVwPlXV3=l*IJqkC8321NFy#OM

diff --git a/pc-bios/vgabios-stdvga.bin b/pc-bios/vgabios-stdvga.bin
index 0d541c5530d1a1b186e43eec06b494c149ce824a..5b48ca860af0da4d43127c45e3b33e088212e345 100644
GIT binary patch
delta 15018
zcmZqJ!ql*Z$u@MA@5{ZRd<^KIW(G*a)5(`XuUkxSX6vOA#&?I97+MaLX#YErwu8Ze
zfuY1=qPtxEAtna?^{3K0Ps~ZX_#ln-KRW}%Tvdi2hnN@+F)^ftrgc6|3rh=5>pYyE
z)?Lbx-sQ@ZcJQ%48vpi7X`Hvx3~%=xR!i#?<6%te{M_)Hv4pqbH**P3%k2`b4U(_f
zHt@Y>+Mu1b%YlJ`q3=+dhuWeR5Y4~sq*^CmD??gz+T=@8LKFY+F<bk7*et*(%gCG7
z`K;$c-+{Cp4DAdIldYJv6-3gSe+ZO_rS0cnU|>kw4I*EQr0r*AU|@L7mbRa5@<gUm
zX6DillX;kxIJsRvq^I$(cYQP2mRU^?&P#Jho0<0gUmD|ywB{osY0+tMY4K^XhnN`j
z(z?Z5iqcvy@waT4Je^s-es&uFwgc&Dovv%rnh&t29sI!z;%rDy>-OhJPvhV2&IdMs
z14wj5dRlip3s_Vjjeq^&G{zI@Y0R!G(mIdLNn^Y=H@(Z9$A+1|MU2UYg}-GdlMNGp
z%PPj63u&FN=cF|s-ZD2mtuuB`dRlkvhP2L`bJ7kzWUil^#=reQ+QA1bAd}{#b$$wX
z;qo`l5bUG{>1o}rAoUC&+n1y_)XwHFkpNKwC6Z}7Kp~T!cHDIhi1AuHZ3i@ncCaxp
zFn}dM0%`jgLE+f>DZR^gP1@y0X`Porj`<IE%nJ98gK3warTL{@{0(y46p-WAq;(#g
zlg4;+F39>NX_sH5rzyLxn3I-$fO#&+l~dAYrl)<cT>(iXu1i1$PiALTtY3mlVe9P@
z!?f0KB_?UD2TJtQntwBu@})KZV=C27YyQDhs`^?w&6|Jf!L)-9nKp5x?FKpcwN#qn
zr8L8nuZ6($?bjSInT;%IoTt((Z}3k&kj8l^&GH_Iaq&SKXZ<0NgBPTCgs=;xr~P*Y
z1z+ig^fboOIq7N5wF@}-TPOc}S<aZ&`EpKL^T921(+qE?r*-<SNKfP679uYM(!D0&
zMdzRNv~G}KCu5p(dK$CuhP3A29Hm!#E`Y>0fMN|6XK9^>=A<#cN^3r}Wo}w${fB@T
z`M+O^GlI+uhZ$%6C#~~fTIZ`d5LM7v>*NB3^oBIXTWKDpAJPs!X70Iw-PD_DogV^T
zi2nv9JAWxqV)WgRrg<~1^TwPs#t(DBDdy)dP@vU=Vx51xyG)wpVgBBU49Ggt)4JVR
zAZhjkSj+KWY0j@NfRwn)LByeHneh-<PzIFb)_|DxU`uN^q*;C{76FG*ng>M3u{6d*
zY2R;y0(T8ViK1d!=g;)C&d?2D7pMP9Py6q?CXMl4dRliV$fvKbPmX0b;%GTpDbf6o
zqjd6gb{C#b-zT6@<w@^!{V@3%yBEiaw1W@0RT&f}TXU#zrFGXnNw=*1RAM|igF}Ox
zIrdF@TC?j5h1Z8B&*SKokxSdb!oa}L@Qb-bJ#7aQ0|P_Lr4re+9ia3x*@07mIV>%B
zayq9{eXd%!SSv&GFOIV0l@bc2aiAD!ekgzN1xH%*1N$_GH2&?M(mGFpqKI*B8vpuh
zX`PqT4*q6N>%0XL`!_eu@?eQz8vpuZpaKFM>&=J$&rR#Rn0D|X2UOMnxoP~{E~Rl^
z40yruKdtjnTIUIa18L1CxZeAxb%MObk=A^I`#rcY0u@D&!ZsXK+;$vJ+jWbXf#FTs
zt^;7I^LWRNcWJv0f;b4t&L0r@$$8v?^~X@Pq<6S}PV4*t)0Fo8a+>1djuUB|Hz0c6
zrFXf0ewP*pwjNRzLL3mBw(B@E1H-$tT_-`drSWe&@uuVOn>7Ay7dq~x9egN|)_EaK
z_5Xi{|7n~j(xSnoXj*96<P2G!`r~Pxm%;S}D091YoB-vf51=A~Bdzmen&t^m*&6Vo
z9~>G7UkUUbS4-~@PUGKp1<VR&1XIpTY0Zb3)BHf`;KS>!X%Way>^!8G-o?>!vP1<E
ztqnh!OXT&^yMox#__whfYWT%5S&Pqw@yz6WJ{_aZg8?s2{%<)@suA$w+@G}0LmPzO
zr8&LnIGombBH+bMa7N_cb~x?e17=Y5@bk6q<a2yl^#^}2BmC9*Gz}ajX`ROdUW9`T
z3l4Y@1Jb&IC$00;J9sjA({XqMFRDmd=drZT9|14CK+4k~HgTkNeoo`x_BoC7L)yUy
zOb~nXz{;lo18LY%4=S$HcAaBnV0fRl>pUX^!`n3e?I$4RJBIj;v>lwF@*GY5`g3Uq
ze=>th5dQTi()ickgQQ<jA#q|ZN{Akulh%B|U~XFTPtG#&w9XUKAb$AVwAM={oZxmr
z^8xd@Y5e;RyuA5ovWCFLdXTR!2fXP0mDYJ2oV6GH0_XqEgJ}nUaHSo507}?AX`R2`
zgVXsBCa4ha`+yhTe_IZe6oYl$`vdka4&U-ad{E+^)_DUQNT4j(c`$7UM?I2vL51GI
z2h4LpD*izN>pg0Kbe@0-BPxAZLhrmB@Z#xDsM|qR0Q=m47u$bA@+vrIL;NBP%B1it
zI<bpOIN-&W{{b&5|Fj$^(E)pg=g(vtA+^aDq(tiZx7~uZc+|SZycp8>w|!LW=JR1l
z<KKQV4dgHWZ3ogA52P_31UIAj*I!O!yp+~?VNMz&O4Ky`WG}CSxD}EF`M2Fn>%0aE
z^&Q|A)d95yNemV@N{u>hf)h~1|Fq77P603W{eXLc6B_n>;JCQ>1Ip!pp9VD|?cg(x
zw9X%C{M&w{asE?F?<|oHn4HKiIXO~ThBp<|2ykWr`|$YWCgDhpr!3{XHjMl&tV}k{
zB~mXJvf8lmx6Wow>%7sM_63%#US@ro%q(KScb1{y7Yl!j6Jx_Krjo45jv^MUJJ}f+
z7$!H0D2m=lb4zRf$5OiHr4nPB;Ww}ycP4Ka@u@$}0OPm*167^QLZH&)@{hFU2aIXo
zZ-DBcYEX4l`yxH9yP73Et+Vz?dUvqY!B@=bY2CFSKmu<-K?|ygUNDp>r|oB0@c)0`
z@wCp1AO&weuL4y?Al;zahSB%U>#I=5biVda7fs{eUJR-OKc+DrOEdfr4%$DHCyQz`
z>A#zNKvbP^@#Ghx+7_TzW?JW|i?1M7@vjekk=A*9P8#ENP*bY*LwZ**Ps1-}{uWI}
za4@_81p|Le*W^Gk8B^1~1E8w&gIao*K$_u!H2!U$(!gPprg<=}^HbX8Uun&c7}GmK
zn1#|D(wcv8ls<U*e)3W=3&w4e?}>@o+Jb_}@IZPONI~->Mug_ekJ31=!Stl<VA%2h
zKiIC=4{4nr)Y3bcUnWmB5jW$g{h*fK$^KGxa*?>LGynR~H=wE-RQZN}0F~a-Y5T!i
zkAsTgCuyD6Kd%B6$;_cIUOz}r>kgKI`MbLq6a%F%CVv%IQ``sA18z;1F!mh-X?>H{
zdH?gOG_UkD=GYgnpG>xrFp>a=TtHgqM^H=P1IUdG3;{1HUQce9u;znG?qJx#!0__$
z<jWFjj1`lANjO-ffFj-*6!ESf(z~36K-_34P#k|?C~-%`@lCK}K{5Oxjq%g#dy~s0
z)tS;?O<o|WTz?rUXYOGDwfY+w(mKzB3L^gPmp~zKA-%)(d|KxVP$76_ZorGYpP&M$
z`N5C$PS;22pp<sZ^#LQ2f;~Uenjf>Lb$)0$kly8czETS0sSA4PT~2H^?BzV5q}%+k
zKHbPi_F1}A2Z%i8`hW?^fSR9a%||pQ7jlber!~J(0OfFKhe@ql4CKfXhqTVaphO1M
zbYpJ7i<6TVNGS-2gY8c5a*=)YnmNtzz~qYxlJ(7R9MX1!%ZI~i-FB@E>7BKQK<Nuy
z7+GH9Z~np1{9k~-{UbxiX>d6K_p9rVbg<_RK4VVrEPVv3vC{e1yB-3yi;ubPVMy<E
zeUfe+d#Kn2>Jm@@)&EE{JPGQcbcOIfYq?ZXFOass0aQd^{-4JABfTSZPnu&|^G}Y_
z`{^AnvPVFv{z;lcn)B;TX@<AcI&TELSoaPTl^{oMzmRtDg+N;8vGktM15i7TfO3=T
zj<nYQCFbdUuHbC5LoL0FqvJ&1F}3tAuJjJy?devo+e>)UoYNYAt1vJ!FqAHTEt=*J
zYV_|&b9#LQ?31q4J>Wn}Yd+#IxlvBMzWI$#8vnLi9jDTEf`jXzTDO@OgXL%bW&_6b
zj?fDrcck%ebL9XvW6lJ;`1%%9^um$`xYf-39n@4$?~Hwv-sgG-+^S6D-+l<xRz3qN
zx?C^tuRjC|Hc$Yib-G?iZ>Z&As1(;r?{cdLr4PRJhE$$<Q0MFdsFey1k{_Tz02y&2
zjeq<9^fb%ZGyHw?7}EP(PpGALvB-l`tKmsd!oR>!3TpR!c<ls<IGEc4UflWyij^IZ
zi1-02Q9y0c)(fD%5vT}NcIBDOEz4tl^|eacE{LjMX|135ryffCek(mqIg}^8BZT)E
zH0thvj7LthCEwDVC;Q8))u(k{Pw(*kklw`rYH+4^1v931c{9N(7qxD)Jq)eiN|Ms}
zw|~=1?_z5?P$He)<@zBlAT7M(VtQ97sEr!%!tq~PL|W8qYfzgs;KiCRX`p6aw;NY_
zLoEkGi8Q$Uas{=QIMO<Qrtxq4nZ|isExps~H5+H&fwayalYhwin->UxLfk<x;DrUK
z3IGoTY_F66B^>EAe`sp@FgGoWA+7Uc$E|=DFaM=QynZlQQBDm>@9p=XkOvJSVAabA
z)!PHpD>C`L9Jdgtbq~%)H$aX4n*lGJC-caMGevy?<;cl(^1StLKtm_#9j+hKyIcj*
zyJAJsJ7PZ}@~PY&hSuBsEmJ^^gwJ~EU2-kAOT;@argi>G>-><`e1r#Hw+jDP>y`tx
zDz@KFV+8eAV_&50W?*MvNN=e9#8AQxDk}~?2G{A$rxnsWV?Tj{#WD6Hh^l>)#`r(r
zMa(Bi2$ylCT?F~J_Dx#r?Gj0NiG4l2+x64u)oI@8X`llC5y%0c0!k8EKp__#pwj5Z
zr^&qXYRn5;879wGFkyT#`GSH>WLGRldPnT%^sZPQkY7Rl0s(}F?e;LV{x7KjrEtCU
zF8P+*C6eiBouvXD7dsAt+9U9e$xA5|4+p%^ob0bCr}hb~8Z<`11M*nxXJ}w>q(#Gn
zD*4f5M`7W~`dplo*DJE~Mo56&(G?+?-Vr<buwsUt@8>kl(`n9Wt>5_jjxnUQ-sbPy
z59%gwtB^^v{9VtSX80e}!LEG+uQs~)k{Hsv90b!lT;EJCP?E3j@cjr%#_3(Ip8{S4
z{sV;+h!5(>XECOCxxN7<^|Y|`F5i!@?Z7gfKhiW0rG=+4{!R-{3rhzZ0MaZ1)|>{{
z)%hds`;D{!h+dFRh#l2`(wdJ5z*<|A`IH@{I}fLMzJ8pZ#=noT<v<BXz>B;0(;Q#F
z2f1bPc`5P9=3M+t)-NV|aOpDfyqH|hrK5QP)QLOzfL)b=G40?Z=Eg@1Olh2;-v74H
zw{y}MFQhde0Cjw~ADDcGOPh)F{^XxrmQ1UjPcByWW?KAX@&RQ#rYFBAsYtQ@0y$=~
zptjg#Qx$Ph+n1os^8=dKet_~?$F0eUDkAm4Z$aZ5f6_YNz&ecZj#cv;9?;0qG1t$a
zkQGVqaDAWN<t&=s;rcGU%UdwLyIKNNKRENGcLfWicZ9xe{h!_yER)_5`lh5J%|E@*
znF-X2O794L4IX%FKE^mV{hR9>rV=5w^sWF<QT{duD#J84z037|dIzWl;rb4o9XotK
zLEQ@~8yM5OeBY*bg}x4W;q@;q0#sH(9OU{D;vkUf4=-!}H#}l25lin11@)uf!(t;o
zE%s&Bo5_lDQc1z!y5e$L=Lt|Nhyye<*x~vit@UJyJE)i2#SAJh)zZ718PhvlKY<ub
zAm@O(z936Mo#kC85dCma$q2IQ6NvcuF3t1xmdTF7;`N|`3h+=t8vphiZ$K?c@QA^?
zG{$>rmiOvXK{a2%i@s-|ivHj$0q}@K_9fpm{%vQ{GEYti)zgfpK;81R>;p33m}dpm
z26NLuow=VJX}16E85qjg(stT|l!9FZ9*F>r4RoA%C-&}Ln)B;v(4mJ73ed3yP^z=x
z0kyR`pktjpbM?}@*jo<pw@hKOQ7sit>-;w-4IER)Twf@p86J48m<H-%#xa401hpo&
zsVdYrzcgt0$ys*!HGjh|gVKxX$6Q|+fK=W}Gd$VwE2mUKFTE>_5yaw2Yd*%Lm)<3|
zk?}QCnp?xK6#kY*hI;dcUwZs46B+A88h)wrw?1S{+o8$;YHHrS_3{~G!><VbmbnZK
zzmoY|kAcSM_Av*%IDG46G-JcBV*Zv%j*Rt24ZjNbTURlrr*&JW?JxlAU34pLM+KNQ
z1LTmjT^yj00d@1&KYyvf*zl{g#IWI4MTzUnqRB043QFO((!SqM>-_N=Gyurla<Y^y
zt@$v^YnHU;!yExG_<p@~ntV(xUNX%y;Kikzptj?S*Dpay<^#BG^z7MWJ9V2FkZkSE
z*Po#hw?M6^HvumuK1=KT{kjlrV0K#PM^GP@5fsvHj5fukk!hXxK!MBx8n~4P6%Wji
z;=%Z4n)B=Tpn-_abFYmjUr-kbkOqZ*zzZ&r%o|uR{kf6W`R_GzTIcDs&hK;5nvXNi
zeVOzZRII>?Soj=4a9ZnuQogi|$6=uGRrovETEm3>HJI~ca+!u@y;?X(VhO15QovFa
zfMyudg3<!hG7`ZG!KEBeTIUUf+Lwm^kvqeIpw{|_G~2RF28MEPP_1YCD2;)k$f4m8
z2Y>5Ch7JGIb{zv{AU#koak7!7YW?G1X%Vj#(=tvoGBBiN2t<L%Jg{|deuI70eB%Gh
ziHvED|Nb*DFw{$ds$OuCe+L;1OEWz1?%lgIx7T;mzqx*3D&bAr1!`=j86F6D!Sow!
zk5ZZ;sG%cb4$f(yky@39;J&3u=?fmv$n_2paN6PD{6tfpkt3l96e>P<Cv$5nNnME2
zOIvs*3X}o#)3Pt|r8ORU0CMAw2b0~kH3S}{F@RbJm(naRmU5)AKAK#wty#|lDsW$b
zg96k_eUsLCdIckY%RZ(w{#_3^_?yic16~}t3o46t9RUsJrT2l_McuJ)Ks~{<&R=gp
z0&3|U&Wvfh&cPIb_)O3|4aw0U<<87$yH0_WfTUSK&CAXc^`LGN<J>f`;qTIR9R<mQ
zj07cQkR}%{R&X1VrSuZGZ~{33t}YGY4rflVVZTAs5R7v>PNa4IdY9ID3+yyds{w2d
z9~amh$<q5^#U}z@aNJApt4H|8g<Bb{LZtLjn&HWg6A=HrOWSoG$xWpYv&_LNIZJP<
zrFYgjq!}JiOYd-V0ujz2!UaUQrl;}mN`1k}-<-+_vJ&h?sMlQIsHJzsaImJ;gXYb^
zbtS0D#d+gB*kG1YP_hLpasUs&ya(r3we;=?hqN7n;PT?udyt{cKLtzK(sl}gCTJir
z1J>oj0U1W)JdxIU3u2~Z>7}$?XFy(Q{C$O)f6Ae><_G`M>Nzi@?K%WX<xm^C9HgN`
zJc3}YhTo8#9AcmhPnRNhq3QA-vI-Aolz8tr@h;8qB(ee*4s);toZtYiXJCLhkF)eP
z%mob4)Bxi<Fs60hdI#q*K_dn(zycjFXPXOAl-79|loH%PrB>;SwB~0_{4Ls`@_AS4
z3y$J)kYgatv9z5sljHO_h0;3j_uS~a^?6C(4X|YA{mBh_D)nmVoz6;Wh6nl%sHJs_
z)i8kM)Y8*BgH=Ex3wan}0?r!nsGh};wjbOVJf5~w1{_cK()N3TVkfOT^aIQmxEe_L
zDl<22CwLTde+!bz$@==7ENbc9&XXPWMJ;Ck?mMowcn{1G-N7nQmvtgs)*Y+?av69w
zb)OE%cE)>?7wAVb&AC1KufB`d!_R3E5I1+ZF{VKarp99|%nS@^ogdQEv|T}CIIeH_
zJA@e1zq!8P;BVn%gcT|LEq_5RTW}aAOzt$0mv>0({0s_crnzZ5!F|u>pDd+pX*<D_
zgq<fQ_Zx_+GN&~kW&)>auF~`HP-=#Hqg(FVVa8I)$^M2Caj~E(7;4ad(4ci1$T%s;
zj0|kly7LBjR2Xap#3$Ws>7A}GK;y)a0c=pJcmY-f8Z_W4VFMZadh_HALmgd6F_#vQ
zmN6S#XixZ@7L^tW))DZ+@n>4=0sfYFmbA{pAU{t&XsA$sAu6r$_oFBVh9ZTu>;rsh
ztXDwgspX9#L68zqNn0wN1}gN0SwICAq{`j?4OExCcqs~MQGl9h?`@b%K@AVR^zI3u
zLb&-?7PtUTV_<mApVoXpC(ZT%69WUNWIB*$cq!mT>9^OK=?%5->sd;bKs5zNsdNvh
zFMl8{15#g{Oxwkf11k9^d`yebOYib#OWVN=if~9Er15V%2pzT7OYg2`(o665W`WFi
zz(eu}Q~_k33od*DR0}+T%GE=rfMJq`2cY68kpc?84`~N~aHt+&NNYa92v-9xr*>Uo
z24(Ti9|vDBr+I*Le)9>&_i6mwucv{=Zv5^9yimB7)(M(w^?j1&35rR`pt;cd4U+7j
z>6Wz4^9SFvr!_xkI{1<~t@)ut8t2c+^~R>kKG)NBu(2{QKnjHSX*-zsK^#yO@g5X>
z%q3xy?;5MgGhg4p0xeUZHB4Ib366IgSRooG%b2J*Rx_pXZ$F-%*6I2{FTJ~%C5?ak
zF%a*GUOKp`{Z22v%b5ezl!uH>q^C93z5v(q9DN7UyIfyPZZwhOdZD&>7en7cwNAOo
zD@~N^-!YUbfOvLZ41EXFIzNCayZ>{+ix>{3?O<nPV0dk&m);f4-ghvKe;c>}d;pq>
z_^q}WqyyY91sDBKz@pIg4+lZ@&Ef=5ZrtVyD)K;s(A}XA0$yx54IhbG?86Ws_(JhY
z-$Av-$qao5L1wwWpB!o$ACxc!+79461t~6SKwba$d?kvYKocm@08tzzte~c{ea}ho
zl-;g`2@DLcrQp0K28P!>aNZ;{GjADC3o3(QCa6uc2AsW~zXJ`*q-89a0TMe67Q6f|
zEix@GE#m+vA7$JGi|v1x7M~UYP7QS*_0kp=Ol~xjt_RJ#{NQ0=NPC~Q>kkhD!&|*>
zv4$Czhe}mJNn{sH>K|092_(hUa{}xmxsn+h4nym;v>hx=@KgbALO>?Qb{yF7|356P
zf>Jg_7&2dGd%$Ny34dC~6R-n0-=#&oyupO5`6xm&$WBP!QcGKW2Gj&Am;q`pwI1Ma
zUCgAH*3DNkImKMV65<P66QL4u+qI(nQ$S<(2f#yd;I$baUaNuzig_g%7#h;x-UIo3
z@=^1sdf5n2c4vPJT7L4H4>}t7A#FDU1H%K53)Ip&<y?x=c5oq;0uaBX9ef}FO3823
z(iZy^K~k^UVuvEQn>~s^S@=!b!51QF0cpW$8BSokX1@V9X~8q%X_K$=3D!fH&?2Vu
zMq2X;CRhN1r^sRD1jJs@csFXP1Q&mRQh<QG4VHSZm$vXi6r`X9HC#ciev-Bu!nBU9
zf5P9qltC}O+nEJa=7X{+8!T7ehqeKj=B9OC0JUas1iYAdDXkNf?zg+XNaJ6B5Vjl#
zG?bXezy1Tr(>DTMd_NB=xnHDPhCbq-1X`-F&G&w~rSAj&Ne4MDmU2T>T9&>kR?*T+
z?`8(ihz6u(q=CaI_cbUvgTfzF3#g@cg6ccImqC-yTgpf|6f!WRxu-S$2bI~c?|@SF
z3{V}@dTBD3l^f%M$$?g~^$qdh%y=M;^F-evwY0?t(m-RmZ(=~gyFrp5XTH$`&GLW;
zU@!5vv@xa`9?(ng?f}&#;5k9dQ>97ZsiVf@pe_t(z`OQ?UV8V2Cy*xpKhTWU3%&I2
z9naDjK;!vOpu=Vz^&s_n>0J|Efh0OYAGMq;RR{YAGS`#d75XI2OD(-4nDMm}QdQOX
zl93Ul?PVGR16Vo#wof3Jz5o?e|3G~MP=QnW2s9E0UO43eYV<Rv_xL_Z?{j^U-sSoT
zB)}vEuBt%GJi0?)1iXkp3TkwLX5m~vOs=(-RD1$!GJy>LpqJj|Ak}lK?+{2YCs=6m
zc56k(50h_Nt1^C={NGwN;7wZdVTZIG2S7fzyusfZ@Gor#IG_wK>7{pbH2)MX=SkZS
zZm(Q^p2qnL;;99hp!yf&6VPh3gc;!Bjz<D%JAO~Dw$asm#Gsbm6~UUuzYR2@S^ELh
z^ftVdo@O2Tp_oT4y-P+Qjqzrh)9bgBuiK~!S44mcJO)s)lTi;&C-Rf|ZM~HDg4ySu
zgNj9vRcQxbv#52-RUm9Lo?K(Ar26k4SQeb8)Y29g%m5Ymi`W?Sy2O}3v%#0r4nE?X
zeAL#A>nuZhLxlh%fBTWitaeIz3mK3)xakd*0t}$x`p#qN4V8inC7J;*xX-O%EXfAX
zHI=4J_P3LCbV~1z6bX27@9YZ35<7^5Iclxnc>|uw!7V#z{s-sSx0Z(|FSB#0f5uv_
z2wJG-$O@U=UCe01RO<5bB@3u3Vc~Dx%=$8%6~yM^Z+XR0E(&6D@V9(o12H)HTZ7qN
z9$^Qu1^8QTa)213{4KVeFSkG<Ila4p2{eQkzyg}FN$X}x+X)U`+b}0rqY}0>_MM<C
z)^}`jw7o|C4N&NV*1&O|0JYYg*!0pCdK7_~T;NIa<^xJ|L1Pz?Wr#o0IPZfbtN8TN
zy5)R|(hj~BP)qNO5=z_s24d3fG|tl?6;WboyZ@sJNu});js)l6+i9FPL8?-{<kA`s
z{bOJNEe+%Yb;-NsKz;JtB_?UvC;8GE4}!|GwEbYx@_eyen&pLJNxk%L`R3pMOSnKD
z?374rKERaLe4Ov~T~JDE{wYwR0#YWQmVHx4FTH#AgURU*ijn&v86~~jfhoNc)OPQ7
z{gB>W0A5fSApt7Mr6NJKM&c7tic9Of(eQ*Z;Dz8TP`Ua7)J7EssWAnsv3&ws()jWx
zdm8`tdz0@wh%!1%{_5by*ge_CQBkzy6evURZ$F;Kzy1)cAe~(4XkYKZmfqp|1T?e>
z%9E0yJoy5&!bUB<!y7bH^ByEDr<b<Sr>Nm4V~G=}^aTxxmp({qJof)T1B2l=(5S}u
zZ=i)ZHZ3Ph-JwQwJ8*%fsCVi!FfiCMY$#1l+o=v(u^GF817xHOSkfB2mSaC?rPgcj
zw1Y30(sqFsaHSc3do2ZBnb~<QZ5KGV?*!GAX|3NtT@-6jEeR<EY(c}7<#K7wKN!p9
zUJF5s28b4L4oq`+&6c(Uq$<4+)Vc2DhR_|s5@{YbAh*b-b^ZX+Qt1t~Pb5n0%9TJ2
z{t|BxC6Ip1^&La{G1vDDr2%RCLH)c<+^;P_Qj=Mn6|KRmQa1@~;CL+$S(CbnYXj?R
zVT7(U!~dWVGCTma)>$4@94n-C{+yiPtZng)zvTi0DB%@rq#1q#Gj!C_JBtlKBOeby
zETc5Tlc4A@1-a1-q}d##`LMGUyAL?-RVTB!C<yt3M%ZgVq<6T>rXO>c@qhVvvYCrq
zeH>WHxd)&m1d5suFI$+vG&n;_q<2M#H2>n~Z_j6G_|3%Mo&ipM9s(fQ0w&PtF}Tgo
zc>z4#dEgnS0_<>RX}MjxDXsZ{ecHhvY@lJ@59yum0<Y(T4MrXe7pwmX76TP?O#JQK
zERgm~-vPC5=#1A7P?Zds2Yz!btrN6n05mx7AkcE46r3EvQ*i+jX`oej&4<|24*p_(
z&2Ph03K~uYjsEa&50C&iKI>0`DZ}I7W&<cMb$SR)_Hvb~_bCF!!1s^oo$ey($K7T8
z8D7q0#&Ag_!X>^Smw-(>cPy<Fv;+d;CL6{QlNI&+t$NU$n+CQV$z`Bma}Y`6Uw<65
z6cW@yI)CCNXYoI<Ss#y0R&-O0_5267df^@hP^a|>sPl3_FTIN)t@#C;4P!YUB+!mK
z$oMnAybO)6E(ZY{M*jBcOf3gWqag~?__sv}2E2HB6g042$CS2%W%5Nn;mK>=gxP|b
z(wa{yO!hYvtv~TT;Kfw15<QR-P~JhQ1Rz7$D-=rE(sqH;H^l6Y0Ks&S0~lVaBIa|U
z4t~Z6YDa-uHG1h?9&BmNuh<%XG4i)b{crfm!QU?YA7Vs9g(w4mYyD2f^ezVxP~Qt8
zoW{SsLITo!O}qR6+;`;P=K4O3@kg5FA^x5&&~Q7bBm@_WpjA4MXpUe>2M0k3Hz*2H
zK#PW6vx15WuQbc={C&s%r1!bLP)kqi=1%YMeV4|+?I@_Ae3BM(@TCA~)+dee19Z>?
zG&l&FzyQsqJOL4)L0#}5`ZlmpHGg30`L`Vic;SB-YH}xYnj2Wz&9t35pdQe!O_R0V
zHJLR2Ob&C`^8fQ29<d8{GNd&>;D=<54tK$q4}L@Z-UUk7C2aprlqkH8(p%tA*m9sW
zNN<5-;lBf=UJxb69R!#eU#|Z>`MkTjBe)T|6I6P^T2e2Ip+<oshw-&S+D-+qQ(iKH
zmiu<Qeh7HcaUW)q48vpvIqAt0RM?%n9As^H_*+bv%j<2}_*?jy%Dq8Vekx-*KWIUh
z6{8Ikf9pktm#&O9Ec~tcjA=W!fX%G|4VHsavgG~A`#mJ<`+00Q`CFWr%6V<r`CCsj
zrZu1X|8g^<4Hti_9TVC*Fy>1(Li{c7ILeJ|`1xCIGnLEQ@bb6r1vdtQML?OwSt8&C
z!@2YhXPK8~JT?O9UCuK6t--7>?=jg(^S6BDD(ANm=5MLwvXSC%Y2kYLmAl?XhQDPN
zw~ar4>q~Al>t=od=?C@6nxEB!X0Vzc)<cF0`wppfiFGohH9z7?Yd*!;a-fpA;ao%7
zegy^wh7}d1!fE@#^IM%CY}iWJ()NR9deS<7fSi@qc>=jWyD#z#;%sC=p2^QWHR=No
zrgu7vy!7J+HJzhn8h*3$w>xsf#tNZJA^2PLxI1owiX+gZ0mo5Dy$l+v2>lT7V)5ZV
zP+=4LL9J8FkD>3lT8CT`Ls}51nlA>I<DYMWJ9VJwcys{d!-FqDb9z^L)4ojZ^Ws$I
zI0~&TJ5ko-9li{5le1vJixmeZ@A5JcTy>`7P#XWXBd-<GKr>gqM<)OGlGFLhfEJ*}
z7t*_&1zQf3i2OTInw{R|EdW|q&cKk?{BW|5w>;CteUo#&C5%_>1Lcc<ETu1AUgv~6
zAmGJ>eQC~V&A(YnU%%YXnYMEYI6d89WMFtXfAVf`d5L+az!SM$&hY7M&;+W)waK5n
zb=kc+L1`y`vYL;4y)6^i?t>3O<3}8j^6F&@BPb!BX0Q?9Z~4Pu!@=Jw#snE%f4Q2$
zMuNX(3uC#cjVOOhA)}2re@inXC?$z8zWl%lN=!=`K?&>>qm3kg>pe!uRMDIC4rhUv
zJ3#w9wmA#fi14?s0kbC`@sUxK-wTTPViC}Q9BALmakca=5jn_k`i+1W40|Ut`pTzy
zaRj`WyeGZGS@5MjNbh!#hG-^GGZ3`qxMEM=VYT!Q7C!KpszB*0h=T)O#6u+91YUA*
zq<1+BKuapnL^x#b>0Nr4vm}U+c)68f@^4=mf#p|UwlaWc$iF!YFqSG!UgoP{6SpUA
zhX8nn>GtlH0~IW32Olz}b)HIVe#D=)12pyY@*ZSOr9i-owmqQKckq=!dPlJ6%VHLg
zsrFO$q(#28W{0=|Jb(65mmOwi!R`Yu*gFnFObU3BxEoZ+wVW(vKJbDmy~A7J<(|ng
zev$%CSJQS*0Y`Q<69dD`6O&v0D%ca6KyBHe$t?Z`?2u_M>B-jqTKo|4SKC1e`{ira
z$y@<4j0uw``b#rzoV?awmN8-SX@5h;$jN{GHQ7O<SfB+Ux&h)$pUzKq3$S3kKe;}@
zkuh-c!2lUMkWsI#drqW5hPw=5tj0qOEU%TpydnmM*ODMs0Eop88cd!B&RK4kCrbya
zGfGc(4%B2!n4BA^401)FGE+j)<h($M$>##OG8)!_T2U|SnA3K)fW7C!%)sz6ju{kK
zHpcudQH<r{HirByT#PnG{4MH?HUcH4HU=fxFK08_nDV#eFxr^$x0Ep2nDDoDGQ#VM
zF0pn7aJdCq-rD@=-%IPs4ndanPY|{4f=-6C&f{ubVjT==o!3BF*;@wG8kcMM$yB1&
za<bGat@%NITJwnp(7;vmvkz&_=Qv)Qf(1K|r!_zO@LCAWX+9wUR`KWqXq92}InLJt
zpeffq;1DRim=>890dv;m&p~c%7ayfHKVq6}AMEU20`~AmX3)T4+RhX(4>V>CZrNyD
zNk8T+BlL13W7^ITu+)A~$V_BJD^J?aO+Fc{#_<SjU+RU)--8td92wJgx`6dCvoJ8c
zRGh3HqQ{spIV@yieGw?f1%p<9Y%7*&{>5INnAZ8hhN(OXB<>Avqk_hLw}JLcaioFT
zsJ{YUlwVD2Jy2nu*7>pJWGN54k=p4j0CJ<uYuU7&7GUc<SU~e8DCK1SC8T2g(Bzm<
z6{ZQ#C+`Y1W9q*Tq8Q^Qe+<=Tte7kt=EL}Ob5>Xd^W?{o7dIb>s%M$(952I~HX&`o
zgw2WZ(d?6VrwN04H~9<<2N)O_USu;cq%$xuoXKWj*pbb^uqK-U)aPZ;V31^B;S^v1
zt#)O=qZZUf3c#Xv1=QRgBy&MC31GGLXa-|b%)-FP;J|o-fr*0y?1%$UM|5N}FeEcD
zFyv%2FhpcCF!*FMFtC!KmW_dtp}v9X1Op?Q!5&b9b+Q>4B(fP8c(NHltJfI7E(SSx
z0|P@t0VLEw4o+iWVEB;5z;Gvvf#E_H0|PGuGuXi_AafTmFu)vqCJW-=4Ot8fbFvs1
zCS)<xGw?AmGk_d{uDA!PxB#J;fgh|kj**drkAYzU!Vw^~iy0UgLb4bb93TcW2td`c
zK-I#c4q2^ERz27i41!?A4;UFa1i%I(D}Kztz#x#t!0;y%qE-m1mIaSm9jGIO8Cbv}
z!2t~k(3BDbGXukqOh`!FG09|LIFZS~uqTs&A&Y^TL4i4f375g35j3#Dn`<-q^_5KZ
z4D}2Zj0}uS4NQzo6*PiUQxrTBOB9@o@{5ZV3{CY6C$F0!&0(TzsF#*(Vl?^U3^8GI
bJp)|>-Si|=qvS*jvs431la$H7W;_D`x?I4%

delta 15269
zcmZqJ!ql*Z$vt$H@5>3Hoebz8W(G*a)5(`XuUm|7X6vOA#&?I97+MaLn52cKbv{iC
zPU}3Jwu8Zef#Kij67z|+a!jwqC&r0qrbVa49%5pEC<+59JC@dYIj!?ldRn(HM|zhl
zPujs}0%`o)Z>Mp7PBZ-0cT6p<Q;vtR;U{AWZ^KXK5}uZmC0rXMU$brCd(E^#J8h=}
z0|P_f!88xGMJ*tjf7>OsPO(;o$p<+_Ccfrp>vsK+W_fVqUs*=po(p{k(snSkGccre
zKAWu0q^+Zo*8D?&f9ioW{%r@+I*-puyZAh<`8eC$w9dnG(k?zuV?3PJe3*6aYo4_I
ztdonFO4+(YKcq2UoBWDNi66w|ypW#O9r`AXfBm7!qReV0-LW6iIB%q<b=QK#j;A@K
z%}o3LFOBg;TJsT+wCJ?Bw0N-h_0qb<REpACFY&irnViWiUq2t@g7mab*A;2a2iVgN
z{$K`i)}*I(`*WnH@o#tMOHb=AU6aPY{zH0NcRUMNOdySa{b7*dj33e%FMu>`Nbhpz
zv0>(K(PFY;;cvOeWW&VYvX8OnLR#m$Icd$uw#-dW>nvRWF{|_AoV0@vndheQZ?8X)
zcJKiUNO(aSBglr(4FNAS{-zlo0GYZZJ+0dnq=^B<Tan&SJD<Nq9VFRMJ0BE$bJ8w8
zNNYa8HkW_u;WYkjx96l~-)4q|+zwU-28OiVU~(5D0|P_H&9uvp(mJn!9P}UTpbf!k
z`@k{>(=I<t^8+P?4QUsDrl)oKPD$%LI46zq=3I~)R-|2i0g+TZF()ni05eF`cM2#7
zW~QfouiXH0-wd$Ij+>LuvMAQCNKfmI-H@hu1Fk%FN*d#hG>G!F)^Ge%52mLz*Un(z
zpL(d}Vu^fO>wyxfwB~<I{8JC6HUD7ZpL&SnRH*=14O1ycn&G81!;`N$(!f61$dR6A
z89D>x>w}M((kw54k`m{MG|n4ome=^F9!jgf_$UpWMoO2Ycet1frKkOO1%+nmn)EbA
zP&_o(F5%#BZTa`In-LyGX@<Ac)A+ZA$P0me67VAVPkLG>TbeV7yC#kCSX%RMj?z0l
zptR?^1{8&9{M*41nAZ7zPFnNvEpyX456wwq{57{8q-8_E3zy$7wHZN%hQrJh_><Q8
za!y+F!7X#sc5yH;fTETWlmOPGF@8+*D*cew`FT#-!N<&VdoHE%Z@-jw@DWQ|=ZiUM
z%?Gy3O=CQi)_D_Z_KRPj#ON;t;(`+Bi8M`!R2t(Ako};fbo5u+Zcqe+RJzNgSsv!^
zox=d)AZbfa>vm@WrD%{VHl#6rNbCF*@S^)yn)B-uAf@hdAW2YMgOd9pkWje{h^&WO
z{R8BN4QZB#iY3xIKg>yMwmtBFE=X5;8l&q5kgLDnPHX*EqLkJNN?f6!{N=hK;D!1x
zP@-du-2lqXYtk5Ry}p^&d?aDAfq>*>4R%qE=6@We;w>jDC%dw{aCevTq<6Z0NbmH0
zHhC($7x#y>gAce>85GhwKTdwmuEN<}`z+nE_EU-3WKj+czHZkyX^e-{)0$mhD7-!}
z*@L53R6K153j+f~!!PC%g>SdgBoCxDA7GmNkwbw!JPlML22B>>RH`pk>$YoUX#USp
zmYvpl_~2`fw9aE`&Cet{ZlyIpQb_Lz{hZeMDV;0ybE$V)^8@*`=EwGF&T0JHzk}nx
z`4A(><JZy-{$ft+ya<Zue{<6;Z<Gk8@vpy^cJMcITIWrW=>NHC2On~zd8P4hyOhRx
zG2jLB|Fq6SX`Nyx3=X6<pWu3*)_EfB-~*1d<`dlS(;_AZDvJv@zu^Ft?)=-prNf7S
z7yJHAE>+NF>i;)+iGq&i0Z>BoeG4+?;3M|NM+}T<2Olu2GBBlaf>PzhwB~~#$8A42
z`KN+5liAnFYKoRNYX2Zr0yqdd4yWzA#SAK@KfOuYc>v5h^(L+Jc*l)*X}b<GGcdgA
zIGon`=}lVakF?HHlUcX|t<QtPXBS8pl9u!i*UxF4A7Gl&zF$sLJPgvrc_Xd!)VuU9
z*U#_L;y|9N@4O5uw!xvi>o_w5L&u4CX|4ZDRMU2y1liYjOf9{G`3;zIW`xpAY0Zb3
z)BImwLn_)K-Uv<$O6xof%A)++yg}93fwU~fw9Z#^(wYzboEz|><$qdadY9|Z^bTjy
z^lsN*ZS@b*JDnv!rPZIb&Ntvn0%8(4K+?djE9FS*Jf61e1k`n4hk=r_bl-8c^e*Oi
zYUy3hj9`-K9oS`luODEzEGWGzKs3E0^ly51fJED;^v=+KJ(tqc>iM^MfZTZq;m*Hv
z171}BPm4r#4=9BOf}?-?r!;7I8y-m81&XD2;Ch?!UYg}S{=RO8H2!U;doF+rC%EUo
z&JB3c`7bRBltx^?rez=S1+hZE)u&}%nhvTcKouGPw$Sfs*_UMIfU<1kp#}y9hPi2-
z7t#*?;7Duy_1~U>p^PnUhdrp&>Tvy@-r@Q!y~Fh@HmmmhON&Tzewp_l>eLMiP?z?m
z{Qw6IxG~asNKZDsi=*XaiE`QwP&ox^XvpcMcR8`yaDZy&$;sR<j0+~O;MOq?OzS)t
z@Z$LYmII~g0WYF|rF9<KAp9=P=}mfv>+iJA69F$$ex-FD1o_JKHz?u1)}PGAqs6lm
zRLFvw13%NECU4Xdt_KBTzzc7XK_LMz?*B~dJh*`elq%CY&w;8&#<`#rp5Ed5X#+1r
z_!G#Ek7=DZ0$!X2DF@r}36wiQtk92XoEOp#K41b{^12+XuKOP-s`j5_WMD|!!3GN7
z&R_4-_MK;BsAov){PZ@h^I+Nzu**Q=ouA&Oce;K`+rbG_2~xtp{X-i6_Jg2uG;Kdv
z?aZ|A|I_%_AA|UFyXz;g99Wd`L|PO$U?B}1aP8fE&|q#_^AFB4aVR%@Zd$AGr4mjk
z*L-do|GtASf4!gV$$JqTF6n8Vp&tTXF#G^zYLI`0K}CD*hcy26$J6$MN>7j{|EF~x
z1ea1gX`P>t3M$_B0WUQFwj3y_1Bb!hKe)mG5(J>i6V#A`#8CarwC|w61vLchLG{T8
zkX7L7;sZ)(LF5iTU<S$m2D<<$+)jW63=g1&2DoVq%0Zo%170|M2L~Idebao9eQv-D
zq3>y($K=v>gTuJ<1jJlO*((e-E;=o4G9SN~;IjV#FD(DG94OIA>--S#;_UCqru=Hb
zh6lg_4^Gi=i*|#X$A{Ir<-8cwy3KqT()hQ3OXJ^mGL3)zM^MsEV>|$AQh*xVpelfW
z{pB>qOKF`K=A<!xm<wt|*QW)8i&6e<HyeJlmuIGRUQ62nHuZqof+Plu8>QAAH$f$7
zz>5k{j0C*k`UWbeI!~nSWCEolXn=xaiZ2bE&R|sv|9hBGX$PNifKsvR=QPe^YU!ON
z(gA4^VE-`3r^QaT7SQ6A`JJBD>C6K5a>wK%fk=(-Eakj5jQlMuOg79VQZIL~+OYAr
zZemUAywRKX1*|zfE%s%{`^ldL4EQcEH2h-WZ*gR7_{CI`JK0dsf@42B$bFqZC+7(&
zir!9hOKbkeQo8b`9Alc{H?TD~Cod87sXxvDYU`$Ty1oI$`I~?j)&D?FbrwqR@_mzb
z`A1sw1ID!PH$ZKXV43u^?rN6ww9eWW>D|>*2j4TNch)`uHEBMiwO%TbPutJ1;Q#-=
z;~>SpPtrQSe_oa51*&;oq%r<`eFxM)d;@B1zF{ey^x7Y!s#p-z@c9UeB*Xt{oj(Fz
z{GHq)q|IdTdh$jgb;jM3ZwhJK!8#nBr!Kw%HP;{}@~^)R?$t0}2Q{;6KcsgB^ECWo
z=5Ntw1c$|YP+0J{^iH-BmXWdOI{@<D2etGrfiy!<m*`U(Jb(&?C7B<;{5QE**dqKW
zQ^P~X63+CrM%NDv3ZRx_bL|_(QU_3=86JS>N$(0_7D{V=#F*CkGfnd#sKL*9EzKdV
z`3Fbo<Fp+NJO2L%TUYxbt@DFgdI$T<{K=9cW*o5})Y3bdUm8vh7qNANc<MUHFCRc5
z`UF(jDWvTO>pq^=c@ZS@<nt;}<E`8GMS2>e?~~WJ)6=?xW#FMu%rg19h?+d8r`5~|
z(+cWCyh-c44+{G<#?P-GOqLThl7?7!JS`xt^CPGs_yOcj28MtanJ*@1h*}GF$AUU_
zhtmQe;xA83-YBZZSUdTKsDo`LD5jicK>d#o>D|s!>7c~Y<t&u88x-B32>rlN;?j2*
zq|EnCTIco8tJ2f{`+i7c{Pg<a<Nz^swt(kp%}0198!*Y#Yk*6=%b@Phne-0V%dkA6
z)-AS&q4iQpWg7qXUum7cpzZN1a|2#P{!Ht<k=Fd+M|!90Barvbq<8v0Nk8WLfDuX6
zqMvEakJ-~YKeQaEl+;V_a%Zz)FBeGb{E*iCpg!HmMfMrUI;r$7*URZ0Al@<82TVx%
zlP4R9%WE7)E&)JJN;5prda1-3l<uI4Z_EvNv37EaxB~z0A0R8!yIf>nr8OT>fD|ar
zZ*0;!&%wIxYTa_J3~JqcUZ4iUFU#}%%|98Me+%%pe_{Z&At9X(kS7g)Ks<EtIVe*-
z0=b)i+X4RdhrucDe|o3u6U%$W&QLdibmaX=Gdu~(yj>x@&sr{(@Tcu>V5nzcNW1($
zjq^uZ=k+wlwC0~2r4Q0OTuhIElK+!5hcvg>TR|p*ibROzN9Lw6-T=kz9&o8}`gI!r
z_8VyjUkHH24y5;l?t*rvj?7I@v-I6lqMqL8x=Ss+OEA69^#G`CW^t&5H_a`r@gD;t
zgDOMm&exJ@j%m)XFM%>z=cf)(=e_nodROX!*UTWH<|8)XMrrdKowUwl=^ef&(qIMo
zLTE4@=Wmt-cj;U?0$ymm2D#)yTIVMu&wu)s1`Vmc!)gm#K_&kWP&PUPD!gJ(@UOp-
z-WmHO&G3JELoE+OrHEd7mm4TSaHlt<^3<p82elCx(hR?Wg5?6tw<prmEKASu_swHS
z?{fwB%Umz0rFY2~fC9Spe<@GeE>Lp~Gz#$A9ui%UFa$-%g>N8LJHQGq|48HCb~&vT
z+-C+Ap31H~=>{&m&!ACq<F#U%N#_Mn@!EO=)USrA=|HHt53&F`ffjsAbDL}}rB)B=
zADv6@VgNOu(z}8g)4RNx5E;pC4@2w!l7uw=?f>=CyVzR}lt`zAfhw`IfR2mlU7?@A
z1#JkZ^%(WqGQG?7Q^1QwU(z}c>7{qObEP-baxj!g^c?^t!GjOL6;~;=;xc;8)pvje
zWYpwmQvT)@0-(@#5Da+n_B|+$K7dMqLJ3ewCY_eWkk<LL;}$f|KFkex@fKvG-|GjH
z4Va`RYfAGV>7Rf_Kd5*`(LVv9Uu5!KX>K9@Z8s5_2$U@yC;yTTXN&j(%Z-z>W%%kp
zf(G8wJ6zv^Dk_2WE>{syupxp=ZVyB2ZT^;iP#U_em)^zPa-c-K<07~Wx&bP;;FYb=
ze>HFl-F_gA5!^j|k+y?@oq-{}q4pC)38?G=wO7-cPbh#|nxL>LeV1kns?}mYL4wzr
zE4>rs5dLkkA3?z+liuh0F0J!sTIcojZr4wrSA&at*B5DwhhE<Y***D;w4^ovwp*Yg
z1=Mu~4^n`<dgBvl03*FK_8G_?R}N5X9AqopU!Y9U`FV1`tO?tjPp|+<OA80Jchb9D
zIY5B`4H;04P$~e|*$qiRb;t<_G_)oFPCcJNUCcOmn27xcH@_gAquZdQ5%5BGvZb7y
z#z(N8^t8@c9*`4bKcz9=2Jtx3qT#w@??bxX;>~Y3K<(l;>0KTY=^ehG(z`q)(>r`8
zua(QF5B;2`c{$A)G@#XYmLaY6Hh<qS&;ZM}3Yj#^-}TI(Tn-(n{FSx~+<H5t*2R~^
zklx|@CcVo+FulX|V_NI~Qf^THFCZ;AE$nq!ofXI*nupWEL3~hSC%r55GbA%O`~w9&
zh@ZxID=j9AF}=(6V_HC3I4B$WzIkm2mg@YGrg<nWJdN=;!URxOVg~C@gX`-2k@o#Y
zS^z{ZNGHUSf<I}^M+7DtFo{h5D{m_8nbvvu_2cw3{(X!s2TC{sUL3fS=J@(O$RVJ5
zWpa+91Jlx<lh-NQG2Qz!`JJK^>u<PzMI}k&PcK0^@JCt}13b_Cm>ckd?|)i!dYA97
z^sdmK>0Pcr0$#X-@<A-9BR)A$LA*ZwnCoYT^lk?c@VHNxGbpe=rFR!gfbz04PkL9d
zKzc{$`_^yiUEVS!uIYWwOyEWoXh6C7IOE)ghfF0xYUy1bjOiV|@4+py=HpCr!QKb)
z!3h?W`-{N2H?8x>>&>7hmQ;EdD3(P+LD};Ia+7xITTny6kteP5^_;Zk!#tpIP*)DU
z^e%>$1N<#Jm~2!_L1PK7py3QiUo!oe>kEZ6!vn7s)A;utcv;2->fablKB=Nm-+4Z*
z`Mp6}=g)?poMmTU^Edo5C_N2QZvaw%CC%_;!>^oDrL@lPput7Pxq9hcVT>Rlp0ws;
zOnT{EVjCG>GpBX_YxtD{DkJJ08h+{Vx6EX$7isvV%HR5uF>Qw`1E?V-aO>p<#)e-J
z{4J{)8h$17x1M86>x{n%8i!(;3yN3ffERCXzC6X)@T-`=Wg=s}dBd*){??U@X`S~$
zc7qgkOQ-EH0GoFBX4;MlFl*;cP`v^k#!TzH@lu?z;a6#iVZ*PA64#eGlUJ%LFxA|g
zd|Fk8CE(9XyUDLr<0S)L{JfFo32NoNc>NO8Uitv;D!zI#Ia$r7KH$ZY8)=@eKSL#M
zfoi}v0WYS$NbCIlIyVh8a1I*70#%rdHpQjUX`S~#p$u^z*dLJe8FwSi`Sts>&d+I`
z=U$saN8BK)poOR`C^iCKn1U3(fd!L{I%o=^lmir~ry&EG2N*#ucvp^>mXj^j<v6y5
zfr9hTpULs+ChYsboCA|*saw|n1hX4J`9=ZDU{doNP}juuPg+n~U|NPrILMS>kYXN?
z7eNU=E%v3sf8>#;Kv0?UA<Z@{lYyb!57d*kJ(R}4P~_b3h=ad%8iQVXmjh4Qu4Bv$
z4Da+N`)O#_dp=H!daan2aSSx*kntpvfgvr!5p2~FP=4e|Yd-P+<z&XR#()1A7#Qkh
zdQQNHh(4z6vWW*diuG|?M4H>{+v(q2KQNW>rtM+?8D@AO;6>GAJx~`*Db4VkUV4{^
zIe6d_)C*qo5Zr+i;VXRs8l~SM0!|v!H#2F<Gx9kUflS?V2UJ$Pz6L5$l!DVb4}#`l
zmPF~LEnE-<$`AT!*_Zgz8V?<a0u7fOn4GGmA#fm#0aWW<O0&FJ%8|x;X!2Yw&3bUd
z?*$}eI!}Yb?n8Q~>oZV`{Z0Be*B6ZZEjdi-Y5coVUvTg@%P<DK(7Fri6Yn|#8cR&?
za|QKz7}Gj`y@9eF8Pj&1Ly~i3f(}@vfd|&!sHJx}GN<i21yZ7xUf<!!0!s1wK*ptY
zo&b%?gNKXWrR_QjQj*^1`b;go!-bnQ4b;G8DZK@1Rd#-Y$*ZMzICFwb===vtxQuf<
zPNa4IdIuhGf@$RfYn3d00%{9`0(jazn6dT7%8;-weGW2YAIRk(6F}ylN3q`=YzSxR
zL$&nIYKJt#10b87K!h`hZ~+mnkbvUkZ`NT183zs|h*e!6A9Nl=c=6yfjx^2>_3y#P
zvXtHe4S8~cS`_cq(z~l2(sl@fd-T8FgA8i^DOk#uwo?c+P6+l@mkT!+NO2k`$h#0j
zBulTS?K%T;bmRXk%=}Xhr8PhJ2O3G+bqJKCK^91Z^)#Ol1P@*qeoL>1m=<EJ3{QPW
z?m|Q4F(gL2yqQsA5Hy@@crpzfRB*qUgAE2b<`cv*oTZOJy@fPz5P(N=L5T#+U`p%!
z1ZJ?Lb;kYzjU%(oeV5jG0~Gge;KBhkI#K!}t@#-fe~Uk;YXC`o&7hY02S}x#wo?Wa
zKKndDK?0hk?77i*>+_Pn8z4u6k}+tIee!Kx70|>@?Hjf9PIsj=!vlQ>)Y7`eY8XJO
z)Y8*B!&N{c3wan}0`3~{INZRHwjbQSI1aH4)S`TowjXL^=m(gMFjY`nkAc#m%-pn{
z;6cj$lZ*63L2ht;qn6(7pafH_ws;pqn(BW>P-Z^<yYIN#;yqwTfelehPwNg)fjYMn
z>Riwe!5ffFxCY40onkzUY5Q~_-Um(1d;s;YzPY|&;cwXtYA}JqtT-kOGzBpEy`Bpb
z$DPTh`YufIcP3Zs%V?!(g1dol_&b;xLHV46zvUMLtoYz>c?UNkcJfAUk;(i9>?v$3
z7)xxylWEO|ndYYL1Pw2zK?Y=-f3lQFf#z30V`96`Gcqu|g(Qtm(Bvr-IE{0ag2t70
zrM}=Su7rekx7@eGj3wZ@7h>9L$H^PHg-y~rZ@ho)4l$tH4rJ^u(6I0OG_c8Ooj=}#
zs%wa$CGu&_KUqpIfi$v#HQt=O(LhJ{4Wvj5NXy6r7uXX&r$wbjf<rgpMb6K()&u-4
zQ7mbl$3T9b%w?!hza%QH@!z2+28JTVwCn?XX{=j7WvAtbA|X)Ox*!Tv*r&B#DwTZ6
z3z}aJ1&#LvytwlXWK`=f=9f~S1_WDrhwBR)=2B3DLodC10;tSw{*?tTZ_^kUUh}6l
zAJ9p&J;21kP<kI!k{MnKcroMKYt3}#hT0dCR~ky!Kgb5937K1I5qjxeer##GL4Hr$
z!3;|7owwen@ozf_35fT4>D_)zdg<MDEReDOG>~-X38-w^4)B;ISnLN}3_N)a5(CY2
zfFkNWWDXCc7Zf@lCI=b`*YCapnyG>oLAO8y(g$BKr+I)gdGiUz_i6mwFM<aUX535b
z`~k|ipxHO@+?o)`q%{8R$J0DOgUknCa-=msWK6sGFpYoL1I}WWwC0lz8`#r!foyn}
zw(BaWyh>|+us4nK#5?G4{jSLuj8rwhUr*Z&Dvr~3u(5(B&~Cj?+YhcKb};dS_`lw#
zH`KmhE(w?{VXP*(;`#;_aKR6$Hqx3;aJ<{Vn$~%1a;&jReH|0XMW8nG6TS3qHx|&?
z5~!*MiM-HD?*c{JL%sB_I1Wg^C_SyQ_6@jB=jc0--sSq{HA~-t4gb{^c{0Gpdcc9D
z%J45ejobANC^z>VRO>X`!_aq7txIetLwc7hXgZZGt@(jN+9VU+`iBgqvLGdPUJQK)
z)4N<B!Pj~0U}s}scx?h|gR%D=Oyl1MTDIW&1T<*=Pi-+sc^dyVPz%oW1y~HO(eQxU
z;sj7e-RAlb)W8F+C<uKL@Z#Gkm?PB|`!EE&*n7F}AeY+WWXPhD!;|Nl#QQi*fi?y>
zPeDqP8it17d?m6CzXeLv8h&$>u!5S*_B|)l4n7n}+vPBUf#J0joY%y_@R|qCo9t(5
z<}CqgP-Q%r!N8D~Q4h{?Z{MXwq(!A=G=RnCfyHjVON&g4OUsx7%3B$0z+y+=rNyU3
zfLpCAKI)|{448c0RJwlO4<1k~gJvJn-ly&Q!^6PvR<BzuVTR=)PzxR={tqgi1QO@!
zIRW;JT*!<KhtnX{UfK>8CI$vbJ@h`!@OIihaDM8%0iK803CaR#I}U94|39ts)O*m-
zBX|Pll;>O90~<>C(=xV$-N^GUE#l=VCYbz=qfiYX3n7_LEp71vQ2Q%j2B>+|dVs%m
zHj`djH($u)t!5gQ`#|moO;g#L2$hK2t`+5<0veY-kk)w&G^m%>>H6Wd63BF32?mCS
zv|V7&zfbG@G+E3%s{RAm4FYdLYj0ljfd{fWOFyLTW?*1=0CE9nVUbD^)Mq=mz$L{e
zXmR;A?cf7&Bkzq`+G3p|NcvV=tWX4Zwnh;sEx$=S_(CKN)L+gJjR2KE3*Ug6m}xs%
zz{8B4pa6#(*?AaLDuYAnMq2X;CV24zt`k7w;G!Bd2lprqT6Do3l-}w307*Mo<$Jxf
zg-fC!<u0hr3d)#I()K}^_1&&d(kzehH?L%X<=z({23vZk>pf7m0S#~5g?2BP<_5gj
zbp@0d!RsatfcQtwgXj0ULtms@hCV8?NaNpr2s~p2TA>7)q?(!b{Wqu+9C{D51S*Yx
z{lWA!OV>9=pwSHDZLxRLEn^=PtLUY7vw_Nuw1Bh>OK>RFy-tfviv~pksD4mO?_^7B
zKF0Ubd$NY5jJ!f214Ej7TH}9EoB#D4P}-gW^4SM)opEDwoTXd+0$8gYmJwGl^qflT
zya>*BI}+l-+4Mjf=ZU^Upd^--o_5^zi33P@H%Jl`bx-s_6CI#AFVN&bEn}MD0loC@
z4p7~b#=re!n&qj|Sa4sx@i?f%18QQ`zR^qX-f$!hG<nLu{U2yB6%?csjzL`WOE0~v
z1Ee;+!}k%0eJTw+@b!qHR2l47@KgtLnwMI7M=;}S2c%l9?d4xkPpaW$8UsVmslG$7
z@(faTftDVm@o)PG8jb-kD697XHJlmKdwd_H_qje$OYiUobvL%TJ_4_7=?;An@M6yq
zwe(JBW{_9kfVxZtV$fbR>s(Os1kKxYhdzKc$Dqo(9Hc<jgG}dy3Z-=y$U${-%}v`W
z$-uzSGg-@;oAJ$LGiz1GH<M$mRl}d8H6M0JYy1t07yj1hf8ZV%C|RecW&3{6NpIc>
z3RmHB-n7o+>0Q1b(k?$w<NO7h?fL+o91$qJ1_~jyv`#UH8K42ngO3E#cAT4h(OOsk
z1%q08R{(1o|F&PC5dV+{8q&W6YS?{9v;0-e4;p?JNb9_x#`rVM>Gku;>Ncvv-VvY@
zl>t<SWdwnfociQ=8!zPvVD`1=pfVO@VcNmhENY!{5ePfkCZDlUQvdM}EDK%?pq92c
zU<Rn`vWSgAZvhi%mf}L%!AG2Fh6g4K+nRA5VMuSN5MbnQ-#t0lR;hjlba5ki;YNBx
zr2qr})Whiwm4XZ<Y5^~lFSHyeNo~1ZnwSPz7>C?Qdz;?rDDv7qy}M8(;Kk4LEeA@h
zTW*({Lz{~b^`N%mZgBbA`2pN$KnQo<dTV)X@?Tq*`iHFLilAkH&a99L(mqBTrc#%e
zuUXO?YTvW)x2|J-8OaJ_bMd!uag>XKnC$#5S!^H%2Y-tM`^%RcAhrO1%TIO?LzKTI
zmgD6W4p5@_kltMYN^aW&So)5o?F400&{T@yfzPY@j-~AgbDezEPO5%2C<;Jx>zpS*
zeFi5sy|jfIMPMcucz(J0fYRKw&hKdlpMw^j+(_g64U&xF(@X1?(<w?j_*y_My)#NE
zZTEhNNw?EDPlHv6rR~0iCM1=%`x#v5CP>xfJbT^<P~W~=4%E57U1E}!eUdM&@gS&l
zOxq16El(HArCDAmmefn{wr>9azl004zNgayv>+?3`7qz>yP&jYd7)S}t@)=wiF{i2
zO&z`T?%4+>U$$4QzXr}*AJV%Wn84G0Y2B{i(ftVU>dXR(w6L^{x8U^F`~;NV(mFph
zJYfuY5&H^Mn!QMCJy0qPQo|7msyO1GfL4dT)L~EWbA1D9<3hvr{^wPC-Fyl~%|978
zu{GTK50VCzA54==9ZVSGCa-c(lv#BKlx0AzNB;GPzzawrYZ*W@?~@-m*w=forFZzg
z0~HgXX+O}M$a7E@mrn0;eGg*D>7^~yDFQ7G0A;HOY5eQIr!^k?|DS=u@Ea&AfBy#R
zCN<PPXDrc6Z>W9FTw)8N7)m`r=>b#*I&j%CY~XJZXM?PaOxvN)z`*cQglz+dT6#yl
zvrO79aJzbkHAwg$YudqgOrSFP1$Zro;s4h%dT9$)ia@19+HuzxppqkP2dJh7jY+em
zfwe(RZu|$DKPu-+YyQVr&Xwl&nk{V~NCXlvoy;IQz036l$X^nW>do)K|G6NpEGXcl
z8h%QY1eIGf{Nyi5Oh4xOjv@V+>wAWVp8}v+CXck{2W)Ab$H3e}X<li~kGMhXDF;9+
zNLlB;_HFn%Inqf{Wglpj#wLLc9Ixfm_JR5bo47Wxz7|Fpm}dBG@;oOo#*dS?I%!+{
z=Wn^d07{qD8fk|A!3-VHn1}&5z(FjdG{cji7%~O9)C}ZObI_7P31=&Id2k9bnjGn@
zAQb%;q~k++hr4Y0F?SjNmnxIHo#pBc!AfpF03|d~oP2n>kqJzLs^<W3ZuJlVu?r;9
zyCOsyelzj6H!?T><L7U$Vou}Vb{O1C;rtNr;@2}!J=>AO+;Y2gYudpdY!Lf8-34AR
z1Dl9E5UuhPER<f~P$9s?-)_JRX({y`Q0s=y8Obt(=RG=a1iTP92}(uaY|`Z*&~l(u
z8KOCjf4hSOcs&uQWr0Y#X`P2&2iY){ID=ccF(*Miqt*lb9jBl^>+}!+j|?4rz&v@q
zi%`8z5jd@WOz(6TdAS(0niY~E10=u(Og#e{<6HK!4rv|`>d0(RPv<sRRon?s>k{PL
zdncf6(heV}g<TE;HjE|iE9&`MEulh4ZnrzYo`!HdXxsx_9E6Faf!1L#9s(Qx<P<1$
zTLS*Q{J{to_;>;&(D90KvZt$JsLVfj0506a0P1dUWdt>yKtua!%`ez&AigT+Oh4`*
z<Inu^Ib%B5QT*+_j4cOBqhSHMEkZEh#m(cO*?<zp$s4&vC*O1xVe(|0{N7cTqZ2Hy
z0umS3RcQXf2wsEw;9pwv0Z{o~3rbvqX`Mg7b}+oOWK7%10P1<{s+pYRuF1spcXF@0
zmjAs!aHlTV$&l9kfFF`jI@|?c9{K}u2soNc*#4a;QFtAtw?Lt=<v?kW-U7wKe+NoI
zt6p3`q#t(>U}k(d@y}#75A{@V({CpzH^bT`FGHb5f&9z(+Bt3K7tnz6uFZ_#28`>6
zfETkLKrB1%Aj81;S`k`I>`(_a=nemaOBrx^0$yVN((D&#>SS`a2T#2@b9ucD8-EKA
zQ@J;&woGCy=Lan(GH0}5;%~jk@Y0FVhK0X1hcRtu2gLuNL1<9Y;CzsN+*yQyA^o_s
z1eg>6lQIkpFUxprIQd)bnaX)>*!f#eFs3!1`u}nRqYW2-t2L-6gvdShu`e~R+6eKt
zJmDxevf&3U*Dsf~;pJ~V0M4$#BB1Q*ED`X+_F{U6v&>6b9vgx5E@v73R!`QK51DMF
z`CA@wmGj#O^S5Mi*+}uXlybei!)+tO-_p%(<ImrEfg5chRM=P0BxA8mTIa{K=7;rZ
zpvt%Tc|ANDyTm#f(wZM}r8S>oOmC=`VW?zoIM=X2A+7mYMX5l;Pc~5Z3sgXUOlv-1
z4{}pl=MRK`VqdO(4skNFSkdHvo*J(DN76f;MP6EPgIo|T)9{;}zg?RfKCIVmwuhnh
z8-I%gcgIao9tI8cYo35qYRAB1QUNb!9-Ex)C8^^EF6a*30(Y}OadF@<s9ZSsQXq|g
z+ZAM+RZmRb;3dlQ;Tp(JXTg9MZHFgc^fD2AalQl8zCQ9=0X)f{cYLy#x19cO2DH$M
zxt!kREC`zD{&%9ZFuluJAZ<4|9f8+jPfqZbXW~CFxzSs~Ozi-8?3bnV#mjx1puh!h
z4glwF?gMGgY0bYuQj0m$c2<Cs(G5lhhL_Eg&v?sATsxcI6)XcX9NFd8HzqUt=(6i`
zf>MXyWOE<+dIP5PE^h(wV*loc9FQgZFC!R1Y3($FjR1ek9|ju^{#H&V$PoC;)eJTg
z{4EO^%SCNO`CC#MZN&Lo3K&6Yg_ZH;V@6PNnZyW6LVFo)B>7t}GD4<s-lTUp3%r~I
zUeVwzU?alcJ^{?0eAP#$e%3xv^cIVxcULo|8Quo3Iu?;j19hQ55mCJl>{o%(XJDBy
zP=s81y#pNjV59Un0$%X#OYd+Ne5njFbvxWBa9Dlb3)0uYA_q0*6~rq6FK$63#M}g4
zzF|j;rP}?I<^5!``1ikT29N0!3#NZ_7GNw@1;xX`hwR{`j*ulOI|LXQ7?6Yc>E1N3
zSip;<y)6eSSkewY1C6q$H9z7{15Y2leDx2_y10EH>+0X^O^bYK#14u#NVvUwslpC3
z?BAXPFWA#NTt7ez33%~#54d#f3jNS>sg(J^3#RmrV1bt>L5m2t2SX;21(4mfYhT*V
z3~)-RU}9i+xswgFmq&@Q+#a->=K+Ha^W-gl>Ff?opl0Kt$x8kP?2zfL?#Yq<T6_@k
zs2!jT^778)iT<*T4wKjWOEWH-d>YJt>2Jt*a<X)QrUGbuD&WP;?I5L)Wx&YJc)W9R
zN`M99g~@XR92pHK-w%+n1DXBWy5|IRXv+}BYCOci@>&_pD`H@HEeT>7fLQ#XK7S@S
z%gS7tY#FG|$TK-HP?O1_Y4V0Z32r_H28P#eAk_|&*9R&yITV3}C%*~g%2>S))RcLd
z&z!b10vr~O%nS@K{h2{wZez^f63SREZez&b!pdl4#NVRCXd_T!YGY86{c;+kjVXUi
zI-`vle@i~2jR}8i3nNky*UkVcL(@P@Hk%*)ducW~F37U}Dxyiy#n;J@)_Gp7ORR$-
ztrJpq$k;HJDA+KSD773YHA`!Ln4bokGe6&u*8J!LXfa&#IgZzQY0b~`Uvnd51rV~F
zuLVHi&<_rWfJ<qSX%R3NrFH&P>zFJZ?8pXMEP3(K<fLF{cMq_K*D-^}3)6O5fO%V)
zK?8d?0$!+JO+V%=BlL1PW7<v)u+$z<$h3o+6UfoG`@-Zm!D<{^!InB)oGcZhAYjgz
zwo?MEhk=EG;idRwuMj;(hsl*86EibFc{><f^LT?Bis0o9+ni-UDY^L{d%3#}Q@Jy|
zmDqGGt@S{Kae71T2ZmA(a5J&fSpeiRnb)#uJ9)sCxUzuVjO?n4%adzE4Vdy@OkN*q
z#+3H}L@}06mJ8EnjF{{d=EL}J^YpL^X2!J1{81M-Uy15wVVp2ICSIO#!sf>KX!gms
z(}e5)Gd##+U^u|Qz;Gg)fgzoNfniNH1H+7L28Nz&1_n?Wt-&D4z``lOz_0_qT2P-P
z0E^lVsJS^v=7OdYz-sH!492FIg@KX5f$;<b69)&_5exDm4$jDCU`S?QVDQOiV6ez$
zV9?2CU|=OdEgJ(PLwy6&2?j<qgEgQA^JFtH{K#Tpc$38dT6V<%b}`7o8~!sS6hIsS
za&Q_01H*+Z28KOZ3=A8x7#MgNn86Na0hzntKLgCcYqB5?o{+`BP?N>LP>{t?&%npP
z%m8u(y5bzD;sAtV27a*GI7UVeJ_d#b2uFa_E@oh0Fv((IP=FZBAOKa%0#yr(W@NQI
zS@mF7FbIMbKVW3!5C9vDtoShl1H*?*28KJC5Vb;3wJdnl@<1IS%)kN;2@YsTfM%8$
zm>C#uWI{q>k4Yv2!-`A>hB=uG3|S1!3<}H<Ot=hg$Yfvu8@zdLCcnOtv7V8hp@NZt
zk+Fffk%fXrP-=>TM`DSBb5VYAv4Wwop3&rUGo(2TbdB}Wl8r4Vf1DvEY^G<dYoME+
YXqK8{mSk>Vm}ZbTS!(99$rIug019%Mt^fc4

diff --git a/pc-bios/vgabios-virtio.bin b/pc-bios/vgabios-virtio.bin
index 2ce35576243f4d70927491b596fbfadd8bc325a6..f580c33794a5c5be464719ecb563b1eaf468b07d 100644
GIT binary patch
delta 15018
zcmZqJ!ql*Z$u@MA@5{ZR91Q57W(G*a)5(`XuUkxSX6vOA#&?I97+MaLX#YErwu8Ze
zfuY1=qPtxEAtna?^{3K0Ps~ZX_#ln-KRW}%Tvdi2hnN@+F)^ftrgc6|3rh=5>pYyE
z)?Lbx-sQ@ZcJQ%48vpi7X`Hvx3~%=xR!i#?<6%te{M_)Hv4pqbH**P3%k2`b4U(_f
zHt@Y>+Mu1b%YlJ`q3=+dhuWeR5Y4~sq*^CmD??gz+T=@8LKFY+F<bk7*et*(%gCG7
z`K;$c-+{Cp4DAdIldYJv6-3gSe+ZO_rR@j#GHo}Ad@Yi;pOt}u;Wb;@ezwUInM#?N
zOFvBJVOHYgcKwi^#=qY6&173<H9a^l%^_`O+V_8Hj3?5XkBFp2r^Thkr^Oy(V$e(L
z7IP^|YrVwZvSIRcX8HQrY5dy`q^EVdu1RY?z@B#S2Q!GXAw8|zpCdhuf4e&$*!&G3
z(G}@w-SI47QGqo6^@r0KPo$?YyRJy<JT@nd@!H(<E_WUqX8sm2CL0$1mYqyCO#CgY
z7<(?Hb-tdH)_i!&-1M~0*g5HG-LV_eI&aQNJNS^fer_87_5*1LAFzN-nv>S~Dd2_6
z-!wz8lNO|>b-RMpGk|PglHO1|o4-T?L<y8grtJWQOnTaJ*EJx<Yw@%l&>-5u#=yV;
zmH-K)?PFwMU`Xryl-}jLChhX0w9d;Q$NUF7W`%pl!L-ZI()`jc{suX23dnJ5(mD^$
zNn^Y@7i9gCw97Bj)0ACT%t^~Wz&sb^$|-3x)6>4!u7D&G*Cil>C$qCE)-S=Ou=RF{
zVOs0A5|gyn110)t&A*vS`O=#IF_mhkHUD5LRedd;=FLC#VA{clOq)2;c7q)JS}M)(
zQkvn(*Fs?W_G=E9%tn?p&QocYH~6O>NaH+|W_b_9xcDHAv;Gjs!3)wmLfD1U)Bd}H
zg0FN#dKzQtob<Hj+65f^t&{(~EN4vXd^snr`QVnhX@<Ac(>i@uq^I$33y~KB>0T4?
zqVrFBS~p0rlQGRXJ&oCSLt681j?$|=7eL}0K(Pjkv$W1bbJ7@Jr8OVgGB>TW{zJfv
z{NFFd8A0ZS!;G{3lh%1Kt@G6!h$?8Tb#j41dP5rHtu&9)4`~M<GxuD;ZtBgn&JO`E
z#D9a5oxc<)G5T&u)4ZA1d1Fo*<A=H66!Y^JDA4LbvChBUT_(-)Fn{kv24o%SY2EHD
zkTm-NtmXKxH0ReBKuX-@AmY%p%y<YaC<97zYe39;u%)#d(kwp}i-5x@%>$z2SQ_J@
zwC}e;fxCvGL{TxV^JjWmXXpm7i_?Flr~UU`lg4;2J*_(w<kQ#JC&#iIakQMQlxY6P
zQ95}#y9-aJ?-Nj{@}zgVewh4>-HYQy+QA3hstgK~tvOV<(z<J(q+8a0Dlwj%!J)y;
z9Q!6ct=aX3!s|nm=W+DP$ffOIVPIfr_{ChJp0<ODfq|jrQi*KZ4p91;?7*qO9F`V5
zIh|9fK3A<<td*hp7e`t0N(qJ1I8cl<Ka@ZCf+MZ@fqj}o8vpiBX`QD)QN%bmjeq^M
zw9d<E2Y)lCb>0Gr{hOO+d9Xw<jeq?yPyqps_2xtW=caXDOgs3H1FGu(+%*1em(n;d
z2E5?-pVoOOt@DJzfwblmT<`tUIziszNNYa9{T^Hxfr=tXVH*xAZaWUA?YhOx!0;w*
z*8woqdA#GsyR=;gK^%l+=MRYd<UH=c`eUeC(mPx~r*(dSX-fNkIZg3!$B8t~8xTG3
z(z{$gze|e)TMsD<Ar1&m+jX3of#F@+u9G0!()hQXc++wCO&b5U3mx~;4n7n}>%5Sr
z`u{(}|1{1MY0=<PG%Yl3a)vBV{qeNU%iwwfl)2qHPJnXL2T&2gk=FS!P4fh(Yz=tP
z4-SokuLSyztEG1cr}1yQ0%ip>f+=UFwC2OiX?~z|@Zt5=v<PG;b{^78@8W1VS)u}o
z)`p+VCGvXdT|sPV{M%R#HT>e3ti|WTcxG}wpN>)I!GISh|F;|{)d+ZT?oV3hp$)?C
z(wyFO98T*z5%A(BI3x0JJDhg#0W+w2`1x9Q@;N@O`h!215&r6Yng))Nw9exJFTz2F
z1qZx{0cqX9lh%3a9Xy%5={UTB7gZ#!^H^HvkAN3mAmwQgn>f-sKd13;`<%x4A?@G;
zCWyUxU}e+)fi&!>2Nl<8yUsB(FuYIOb)J!d;cXiK_7jlu9Yg#^+73=od5)%j{kgP*
zKbgTL2><#MY5eQ&LDDa%kT@|HB}5O-Nozh}FgLCFCuf;>TIUIA5I=lwTI;0}PH?-R
z`GEP{H2!@DUf%pPSwrArJ;+y=177t0O6xoh&e{upf%AXo!L)-vxY7<j03~dmw9a4e
z!Rh=56I6)zeZULvzbyw!iov?>{Q-Lyhi~~IJ}7Zd>%0LDBv2OYJeanFqaMk-phEB9
z1LnCP75^ZC^&T}qI#0la5tTkHp?6*mc=7Zn)a{@ufPHSji|s!lc@><qA$}1CWm0$+
zo!G@C9Pnbx|9}^je_9Td=zu-L^JlV+klN%6QX=*I+it;HJZjxyUJPmc+disw^Z78O
z@oztw2J#pGwgYL52htc1f}2tN>o2D<UP|k{Fei->C2AUevX|FE+zLs8{M&A(bzTF7
z`VMf5>VVpUBnFEcrA8e$!3n71e_H23r+^pxe!#uJ2@QKba9mvc0p;?)PlFnfcJLWT
zTIY{6{%t?fIRB}oca}&8OipB%oE#}E!<!0f1UR#ReRzCwlW?TQQ<idG8%F*XRwf(f
z5~-I9S#8+(TW7PTb>8Sr`vOZ=FS9;PW)?BvJIm1Ui-o_%iLv1qQ%TljM-dCwo$L$@
z43is06h&{OxurG#V<}zpQi(Cm@Eh2UJCnDI_|%_ffbm=ZfvQetAyDaY`A1sw1ID!P
zH$ZhzHK;nOeUYBlUCol7)>-=`y*pUy;49|zwC>suAb~fapaoS#FBnRc)Alng`2WA}
zcv|O0kb*a#SAnV`kZw?I!|40w^;M{2I$!&zi>C2!F9y|tAJZ6*r5XMQ2koE9lSQ?e
z^xsWBAga!|c=8KTZ3|E<Gp+N~#a9rk_}7QNNb5X4Cyntss3}$ZA-yY@r{Nbfe~Ts~
zI2c}lf`PxKYjU8NjHzkg0Z`TXK`p&YAkFYV8vnLWY2dI)(>$2g`6=!4ue9bzjOiUA
z%tC1nY0W=4N*}y@KY6K`1>?5K_r%0(Z9zd~cp$wCq@ei`BSQ1#M`@hbV0zMaFzopM
zA8c3bhqTTQYUv%!FOw&mh?{ZLeo#yAWPhnTxk%jBnSXug8&FjZs(eE~fJ$%awEbYM
z$3eyLleEt3pI3p3WaiKpuOFnRbqCA9{M}s)ih<G>lfR0qDeeR50k@`082gTaw7yB}
zy#IMsnpb)nbL@-PPbOPQ7)gLbE+DP*Bd8_t0pvyohJY6puP3)lSo1+8cQEW=V0d|W
z@?{A%#)`?mBpfVKKoRc@ig?!#>0Qo3Aa1l2D2_icl(-|}_$Jt~pcwv;#`x*=y~*X0
z>P+dcCNGdwuD^_wGxsonTK$a-X`Sam1rh)DOP~<Aklx{XKCSZws1Up|H{eCyPf!8W
z{NP7=r|YA1P)a-I`hXEh!JeOK&5zmBIzO}=NbmAJUnvFh)CIltE+;k{_HrIj(rtcN
zpKjzM`z&3m14JHkeZYidK+Vsz<|7)D3%NzK)0*EXfO0sr!=%<N26AMHLt5uyP$GkB
zx-mE4#mUJFq!a|i!FH#2xyZhH&75X<VDd!;$@=Cu4r#l=<-=jMZo5{7^v>Etp!5YU
zj4ZG5H~(O0{x87a{*j^MG`O6A`_=VFI@ogupE0L*mOcX2Sn2%hT@QiU#m8LtFr;_7
zK1sKZJyh%hbqOed>VKpeo&<GJx<YuLwOlHx7f9RR04ky{|4-xmk=_xyC(SXf`6ox|
z{qznO*(0D-|0K;J&H44FG{f6zoi_qrta}HFN{}PBUr0OnLLja4Sb9(B0jM2EK)K0v
zM_TLu67%#vS8%r3p_bmo(Q%^hm|A)lS9*u<_H--P?IpZv&S{OmRTvl<7)qDF7ESX9
zHTrj?IlVpt_DNUj9&jL~H6L-9+$bkr-~2`=jepy%j#Ftn!NGM<t=r6t!SXYIvjJmz
zN9YBRJJR^KxpIJ-F=ql^e0>WldSOWe+-he24r;2Wcg8+S?{hr^ZdIo7Z$AWTE1v-s
zU9K1S*B=4}8z_L%I$bZMH`MYlREq1Rce&Mr(g$C9Ln==_sB?A!)Jg>h$q!H<fQ&ei
z#=rf4dYWbI8UDU`4C#HYC)CorSmZ&e)$k-J;a^}V1+{xVymo>_9L#M2FK&GU#mWvy
zMEn4iD4@1z>jhBX2vmeByYfutmgTX&`dTGz7ev*swAN4jQxBzmzm=Y*9Lkg45yJZn
z8g+L-#v`ZMl5c6wll^7Y>eD)}r+4^%Nbh0*H8|6|f*I4hyqRE?i(0qY9){L$B}r-g
z+rR0hcd@k`D3MO@a{Z7NkQUx?F}*7k)J6?>;rK5tA}#8*HK<J*@M6uEG*C0I+l?!|
zp_YT8L>gRvxq{kD9BG|D)A+ajOyfMRmfmUgnvJvXKw9UI$v<TM%?kuTA?_d;@WKLA
z1%L+vwpU7k5{`75KQuLcn46Zxkk<LJ<5s|nm;cftUO$+uD5r*`_x5{G$b$wEu<B)m
z>g|E)6`A~Aj#~)Sx(8>Y8=yx2&43rqlX>LBnWDaca^&PXdEWXrprMoW4%d(AU9JM@
zU9lqR9kHJf`BZKXL+fq+mMNe{!e_noF1eQ5CE^_y(>i~pb$&=|KEea9TZR9tb<2TT
z729v8F@pN5u`kkgGq5u-q&L)lVklt;l@$jcgX{F>(+cUGv7bP};u!l8MAg1YWBecR
zBIXk$gv+?nE`t19`zEdRc8Mgs#J-;1?fU8S>NM~4G*E&62;=}z0VN47ppXj=P-%4I
z(_~(GHRgq_43lRom@vMWd_h4bvMZJ&y(9K>dRHtD$giM&fdIn8c6%6F|CdyNQn+4v
zmwe0Z63O(m&QgJniyenR?Gbp#<fRmfhXY<{PWD%nQ~Lx~4H~210eLL;Gc+(b(xTx(
zmHcS3qp<K~eJ;+)>lN8~BP77?=!%d`?}(jzSTV!S_j8)&=``oG)^GfM#~9LDZ}a!<
z2X&LTRmh}S{;p?EGyD(gVAsBZR~ub?Net;-4ua_&u5Tt6D9P7%_<jT><Mb}qPXR9i
z|A9gZ#0Pccvl!F6T;G6_dRka|m+!~dc3_##A8DG0(!$dif2Refg{6ZH0BIHhYfgjf
z>im)R{YF{<L@!7u#E$AeY0XCjV6Cmme9Df}orlvrUq4Py<KM^Fa-f7G;KkkhX^yYo
zgWNLtyp;H4b1r@+>lc$fxOAC#UQ90M($TyC>cky<z^=-`n0D|HbK@fhrZi4a?|)n9
z+c{~B7t)#!fI7b04@^G8rOm{7fAUW*OQu!NCl@PwGcEox`GB$=)05wmRHRscfgCeg
zP+M%WsfxI$?MqPR`2o#qKR|h{<JROv6_NVjx1jNjKWUwBU>!zy$Ex`a4`}4*nCoXy
z$cm(QxV}&Cau!YRaDA8F<t>=rT`d8sADns8yMhJMJ3`;K{!i};mPzjjeN$4A=AYi@
z%mivhrFVqB1`oV7A7h-G{>}9bQ;CpTdRG9bD1Vy+m0_Bj-sSo}y#v&OaD4~Pjvc<A
zpzZ~g4UFkszHigJLSF~G@cNe)0V=B?4s!hnaS%xLhnF?~8y+#1h^2Rhg8I?#VX+aP
z7W*>m&16M6sia_VU2!?B^8~0B!~q%_>~Q^%)_StU9n{P1Vg{9$YUy3hjOiV&pFj*I
zkaIv?Uy!As&hoAkh<-SzWCU6D2}FE+m*)9;%VbAk@p{le1$d|+jeq-%H=vdzc*Njc
z8soh*%X@XHpqek>Mc*?}MSt*>0C+?q`;u=O|F$z}nJ1@%>S@MPpl*3u_5m4i%(H@O
zgSly-&fHIqG~5673=Cy#X*=yfO2IAyk3@jR20Bi>6MOeA&H42-=+MIk1?boUDAn2U
zfZEy|(6LUQxq9hc>@5fQTc$ACsFn(+b^e=^29Bv?t}hhQ3=h0kOapZ><Cs80f?AW?
zR2Ax*Um7(0<Se`Vn!n+fLFvWxW3Dd@Kq_yg8J=wTl~XFAm);e|2x9T1H6LTrOYaif
z$oQHm&8^{A3V%x@L%n&!FFpR2iH!9k4Zl?RTOTr}?NDU^H8t<vdijj8;a3EI%Up(r
zU&;Kf$3SCr`<Me>9KQ83nz7+mF@MV>N5*=ihF=Bzt*aQ*)4HwGb{K&5F1nSrqXNvD
z0dh#%E)G!0fV%nXpTAUKZ1`1LV%YGjqQv!O(c~621*Py?Y2WXsb^dq_8USQ&Ia$h<
z)_j=dHA`CaVUB<oe7{~gO+Ka;FPY{U@Z!=<P}}jv>zAM;^8ws8diHFxow`j7NVfLo
z>(5Y$TcB3dn}8P+pQUyFeq9JQFgvaDBd8C{2nuO8Mw{Z&$h6LTpg?8;4ctnDiU(#$
z@nC#2&H43v&_G1zx!1;%FQ|(INP|K@-~|^*<_#>E{@h6G{P&tUt@CtR=l3~j&Bqz%
zzD)WHDpp`cEPRe2IIZ<SDPLN~<1kS8D*T;ntzp9c8q9ezxlF^dUM(CXu>@3jDPSoI
zKr;+!L1}?$8Hr$p;8Kn!t@8##?MuV|$erOpP;31|nr&Go14FqtsMfQ6l*YhN<k0Yl
zgTHkm!-oH9yN-b}kRGU)IN3;3wf^z1w20S=X&I*(85q(s1foD>9@x4!zrnt0KJowM
zM8>qnfBzX680w`!RWCTnzk>{hr5PT0_wHSq+v~gO-&{X1mGGwR0yQ?%3=agnVEPTV
zM=8w^)X)(z2j?`<NUh34aNkm-^aT%S<a&n)IPLInexfPQ$dOP43KgHblex8(q%K71
zr7b)Y1<C;WY1x<f(i#sv0J(9;gURmN8Uhc}7(lIqOKFxDOF7b5A5E^;)~x3N6}T_J
zK>=!|zDesmy@HXyWgk--|E>od{LSW!0WXf+1(ij+j(~>q()&Q|qVCu?pq^k_=dU*)
z0k!lFXU4Q$=U@szd?sj~hU93Fa%bkWU8g`wK+-Ir=4I!JdQdlsac&ye@ONpuj)LSt
zMuHMDNRtZ}E4U5GQhEtoIDs4iSC<BHhchSGu-~9*2*$Y`C(=59y-Vx71$G*!)c`h!
zj|*&$Wa)jd;u8TcIPRtQ)gyf4!mSKeAyWD%&G2N$35b8*rR_S8<fc-HS>|AsoTWF_
z(mU%M(hLu%rFXbFfe2?1;Q}ID)6@8OrM}?gZ%$<dSqb(c)N8J9)Y7|RI9Su_LGxzd
zx)Rjn;=J)5Y%ohHDA|G)Ie-UX-h=b2T6%YcL)s2OaCvd-J;>1JpMs@qX*-2L6Eu*R
z0qb(%fDEH?o=EGw1u;{y^itZcGa#=t{=UM@Kjlzb^MikB^_&;db{ztxa;Obm4${ye
z9zn2H!*9q=4lz)Mr%RE$&~$kZS%n8PO1yWRc$a2)5?O%@hdI~+PH+I%GcZ7$$60zC
z<^l$2YJl+_7}Gj$y@T_Zpb-NXV1bU8v(1GlO6xofN(pYDQmgbuTJtj|{uXUe`MfLj
z1xIl?$T5)SSlUjR$#Hs|LTR1%dv5gI`n;s?23WH5{^SNdm3p=GPG_Yw!vlQ>)Y7`e
zY8XIrYUyd6!73n;g*=Qf0cQ<(RL^2a+Yjyw9#7jT1CFPAY5P4vv6I#v`T=GOTn(gr
zm6@Bi6FiE!zXeI<WPN>37Pa(l=gE%xq877%_Z?STya(op?qC(D%Q_J*>kifcxePp;
zx=#mWJLA2{3-qIz=G>nASKr0!;pemnh?~3I7}KByQ{yofX3%urhx9aUSI`)a>l^+K
zA;$D?t}i(FTR0hEMGAk*Ur@^y9EJ&#I}POJ9nv~Kg94gqZrV<8-?RBAODS90PVgjQ
z=ZVSv2BNCWY0Zb3z-gMR^gKM2nxWq4miu;?u~c%hzoA52ET{^G8nhoYXq^T!P6{$3
z0~@vOya65+23rB~NjF=1r|S#QI5A`Z8<Z+ufE9rT4Y*3!K*qk_JUPQqM;B7er3IvA
z%mx?Q6F#R!rA2~u1iWzknbvxMza^d}t@AL*&yx=tD%4+yN^AW6D2johNFgoz0ACvG
z6;OF<d80@Wqy$vbmP)6A3VmS~P=N)ha<_j2)nzYUih^1cpk~^88|G3_!$U8<djhBs
zZvK@8E`ZY*7+&+IH6PGPvpvAXzyK<l4x|}g3V2ca?X_llL+$%|mQp29O~Fwr-2>{&
zA4to9)E6hyb}{6DO8yBS(<1cJyS&-bb})k?91;j={M!yfN3HeJyQ`V>(!0G`AoCsY
zko*Bv0Ga243!ebh0#BfF^^hrGn55wWs5nZbfWq%X+QA<jss|X-nolso)qu;XU00Yv
zS-kVd!57SF9^jnce1h?P8vpj|X`rzizdHdh6t1Opf~H!1pQL$$ViGcFF7$qbBs*xj
zC9U)P!T0QG&Ci(*zGO~oe&~?K`Ezo;v8l4p^|T#qtPBj00^xny4kmsO2UJD82L&H<
zN!aAO#%l7+*Eg_0%M@r0lh%BK<J|^Uh{nk>CMu5AOlkbvkEf?~x<1fL?=EIZ<KKP^
z#CxKb4sL3{(@XDi<^VP2A!8HiX^pinz_mO_-+}Zl*B6r;P2{*<s4d>b(05R+Q*QD~
z6Xp7M45bPno}Cv%-@&xb51`8K|6K4QhJ$H4*x48uUYqHqcSW=J9Zcij1}*>}fMz0o
zt1SlU0QXD5MgJ49D0Kb9K~R0OI02L!x4D9fJkTI?cj$wF7aLB)N1_({Fa!v`P`uK2
zP;GHCL*GG=S+4IVhnmI*B}{>~12|7Xii;Xh*Z)0Vi6SV_1WGhO6h{dwsHtq<a}qpd
zw<}=+1H)@6IIoF;;WZDOH_6P*TL#pE%3zoYY7?yiXRqh)K!Y-A84G5B#7=|7F275Q
zOp8m)H~`8=88^XV``@L-r$vBML)}Ncw1owe8_lHaLGvy@co-Pc-ly&Q!^6PvR<B#E
zVTR?QQdLkA*#(pO2bF39Npba@0Q*R;WX6WW(0VOx2MZHCRe+likcqJ!2R8iw4@;|{
zlnoJv%$M07@YztppO*0i>_E<UX%R1PFd=I`iqH(Q6Oy;o(iWcqHNgsIfZ9u~2l!hT
zGwG#u^Oa0aG1st!_`=pis6^a$ttkH#(3t%J@K79hZN`V!s-S^lUI_+<hBUbMKt7**
z)I6$QHUgC0+24YepS<RSjs|{6+s(kh@BrijwX{w-m!h;CTu7w=#4l+F9|(X_@*B0Z
z#Xd!l)T_4Gp$P6~k0MYOev@|ag-BXJT5wv16WFfVZ@^7j@Qirc<g0vw^$;esi0QnM
z)_j5q7J%R>a#%S5u@^Mnjan+f#UG#)ARupprQYkMExZr~DQH0rSCFfpr0s?<tz+w-
z@Ha1I&`a-jW&xG?plr$p%a!+`Z2+dZX`L59t=Ss^FD70}>jb6y?XEA<_}3qVEyn>3
zC8qJO{{Zszjer;5&x1<t7wMLvkN78nmMU!Xy`OIB`+$GaL5_>1+z^$PrEiK=wDi)u
znZYxn0cja&;4sR44NA_S@CVfbYU!Pz`i}2q(B$)$GExqO3=C=RX^sCuW%lbkpp-oW
zRL8Vln#^V8#&}?Ipp|TWLp(S$9!TRn(RWBKZSjFL&{*!97?AL8kR-^NZ}dR3Jm3M?
zOZ+WujA@1k^wPUKKy?XtPSEmHX%cwqsPQ<c3j-SPuKl2w-o4=oq{;seG^6!GFTH!m
zvor?Kc>WXUuvtevNWETq*MwIfiH^`mEhkIW!Ty2F^`v)&K1uUZOYaC~eC>o(RW-h3
zWCUq@na02XR?ffe6Ue16Kn2x5P~QMl;FLZBjl_W$PI-VD{fy~7zE9HoT%V+Oxjq63
zFiC-{D$p{I?$8$jFXE4a8eO1SIM)x8Ypo>}pTL?-Aj3cCrFS_<^_=QE1k%e17Mi@>
zT9NU?<eS#2j2|Zdw^j{!lh%CLA#KM2kk2h|@V5s1OWOesD8oy7>D?U7KZVPA()NSf
zE0>?AasGmMYC$Hb{ss92v>Gj826(vRkwDsx-;=9tbTuC_sHJyBu%_{E15IewegHMS
z4KJmqS%-co=21)Uk`YK_yqV_o`t9WFHmbrE5ugH(0aWZ{)PvKB{A7MxFXg>p_POVv
zVi9Cj+QHW>YMpWw2-}P&*Vrnl{`&`(1?MTXw8aH8Kn4CHHU_;eF(%M#@TIhak2ohE
zwKd~9%aGnsA;8Greq=JMos!-{2BZ#ddPAiE18BIu^H_RAr65CzX21*Xb1N82vcYpr
zr74sB?IazY(z_!?0$$uZyMnRA4kBTWTI+Y-fM;@W%MP0V!8!J=<>AT8>|E-fv6d@>
z7OFY2LS}atGukkfy1abJ0;)<__**x#z6@stvAOtLUU8I*f|wlqEuYvx3{L*mV78Y>
z*g<Ro{+62@AciP^i!JBNEs#h~?=D~h4dDf_fM#scx|z~;f<xCf%*oZLge{GICn$^c
z9h)3&uTg&k6#AewaGWPVt#v0hy|jfMMPMcuc#^#NfYMyh*ac)6;*T`W`yk0GKE1SV
zIiI4mgRceD(mSJs(ssXrm~=ah^E60BlvvvC|7b!|X}g6Z!8!PL8s|-rs#Gtzw8lgK
z7#KiH1NlH*@@_d$pZs=-Nm}+vzO=@Jpz<tjKbW*UUo4kqd7)TRFTGp7`S<@4E|3R1
zCDNJ?Fr_sg=X-q@l+v1i3Y4gTl*y-M-_+4d@1Ff&a=L?J<bFs-N$+-GO78@<-Md{s
zq<0s97ZgTFfJ$<yNKmbj_ym;V(mHQ6JYfuYA@~YZuD$@ZQH4QjOu=ewpMaJ$zWm9a
z#=rgE<ogbyj1H5(I=C@*PquMX6fHRg$`Jh9kEijkKLjgCCs#V!*E_JKcep+Q4Q+z*
zq$DU$z5uPTQA_Xe2F=vG2MNpRr7iR+YWT@m;sh#vK||uD57HWs{r}IvVE7F*s`33B
zXd#YG%gIuAs1e-`T%alHo%#$647Lm#N>kHzs)JT+#%|yM87Tvnv<9!`*biE%_1Zh_
z;0va-U7!VAX@=ikOF>s=c3w-{1<vg|L3L$X>o-sr#TrygLJ9#}&~RnBTw3!F#&WsW
zLeQcCq6M4-(;Qy2rR@NzO78=8t~<FQbVsm6nuiU@EwX8yKR~opdPD6Ki4wbVB@lzZ
z#2Z8jq#tvA$B=%^^*uvrK-zv#KW`KFYYULnWEN*dYw)VnO#&M@Uduz)q;BHc!1`Jk
zp)1YsKPZF@4?wMTmIoEb3Td4`Cnq>-TYTehxxfHQc*PoNhTp&p9kuk%Vgt~~#{&?{
zD9!LBC^}3*ZZrdFHV0`w>}<vE1CD#u$t*4kLjIr;_Sz5W9qzK}$J}N7Up}5}<|0=g
z2Uc?K0VoN9qUOWP7A7za&X5x6T@fP9zxesv^H~~xGx4`)fK#7`07$lg2{d{PZu4_q
z08e)wcm}EfJDgcsZkKLKYd&C~cJK!qXqfjydZ)X<>-k`Vkq5)Y>VJa8K*byre>*n|
zr2W!&K&=}(<MjhnB}3+c-yBQp1g#kW4bD3Vv>Ye}Cr9v9T!2IxXcb=bA@;O`znEY1
z+c1@ahEqYKKm6MRB*2Z&`cq)a@Hn{H0Ln|99s-lST&3!Lia;^&{bPEkyGZ(RcNu?%
zmou3$ToQ?Ji7&_{VAIYWOX~zJfq=NlhOxwCMLmD39yI5sfh|XJ87SBsMAG=z9|tXk
z1a*+kpLoex{10r_$77Qf-4tUz|G}+ZxQ7AMX*~k!yd2O=?_x-6e!*tLSk4CtwBrsk
z{>(2gL*uK<LBNKQzkNDW%Yo8ph=Mf!Z4rV2FP<I+4XoEOrR`vue34Ih@>(}xwqT~T
z=93DO{S8IyPrMI!F%_&t52OT?cTg$;$Po4lg;KV(U7++0F}ou`FdgIohL@^{`CO=j
zpD}{kQJ_|hUV4`YTUzrgwuWDf{B2VI8-8-|w+sJ=7|~E6%D~@RzmqY&%RvOx_kswg
z@o%q?fHYszE<XVG9r?GpzE5NPk!E>_zo!c{+zu)U!NnqIl@27DBUsYGK~TaCih>l-
zqM_HUprXPn&GI{c-?2aGeXcLm($l)R(>r|MrSWe&3Mwd{q{SS3DFB-FNn`u~9W((A
z4uU2yKyxWiKm=$|7d(i*4Qy1+ADDXnZ3hBg_#cLv+{v8g23B@6ZKn>X2efO`WNmj%
zCXGLn!`!v}|NMqW?1G&PY0VG#Az7otUGU|D-w?ldff9BJ+rJYf3a_K|7C02P94HOa
zTi{su??9;+M9Fan0cOUR>wix^@2>6$ZiMaxm0qxx)XQS1QJ~0Se65hSQvvLhmyDq0
zzTK`L0$z07hnXb9Fj+xPdh!GncIPe!SsNby78B<3dK)(W7JjC3Z%~z=%2>`1TF_<1
zXv4(cdXeF!E29kye``Kt+RiOtb8A3@<)D--d4KYL56Sv|9ve>n7AK~1UK@7)*3*n>
z&8Pmq+{|dh#oubjgtiWh`I3zgf6F_Law8jl{+8QJ<+3)s{H=Szje%ehP-bzK2zbG8
zF1^E9=A{{rjX-*rvkZT0Fzd^EOg7T|Eg!kc`E7*xTPnG1r1)D}xL$tcuD6llZ<)ny
z<Imsvk{ivsnO{KqL4C63XZ4^NtmcRHkfFl9Luy@OoeXKskGRsBPcgO}sAO(9*O0bf
zfq{WxMMbG_+J5l-R_6yBwi33q{h*niw9X$OXQg$XKrYbki#&rk8(ENN@^ep(`oM$f
zoz5aJ{kTC*=V+OR-|YPDj@+=ZLg-Qm{uVv%j+>z32sCNHaTHQ7gN7<XKLos3e7Fx(
z*o1yi>lE{2=sT{~A(zCE76hv1i^1ji=bPY89Vj{;9RT_8;7ib)-j&|8FO&PcIF&h$
zLTk%Tl=XOrFN56VEEw=&#evDYyi5dFo#{A~#=q^zYlSq>%$4tv$^X6NbiOj61*q|b
z^e$(?mIEas|4x)<r+0Y^fYy~WFr+m<ob2N*&opu0<XmqF;}!cr`Qjf->5G@wIpGcn
zcrjsLnsZw7Z<f;6FZXk%?OXy*Pd6AD7+%hwyxUt|V%{n6L~fTed^#I6fhuur@+WUy
zc5hBl+KHd6<|AKk%LKOj;6u>(5eKBadYQrqN{FW!Yy|jQ{xH~Z@VAOFK}OeKu4b^2
z;BVQ&ST1TK%HLARXd}+w(#!}-Nn(sIKQMw4(^5uI0z1WMBgx--j}bCe^d`N-S>WXk
z&_0iC&H^?f{OxPN?8!%bWEAE1f+D_H1T-KA+V^r?Exk)b4l<m6Bj5$Y-pP!<@@ZZi
z0WT)+N$+qLd}$BTyB(w<nhDel1g$x)*wc4dExm(<4?LzSQ2Gku;D8tL5D7PdmmD1F
zUCsi~k_t2t4w-v;m)_+p2_ht3Ze^JK+gC<l`PG-L4B#2^Z_WaYrAm{R`6}4N?Md4q
z0G?sGy}RW=1xwn&hfHamr_!1q@u%$oO+CH52U$}o5b&aH4=D8=d?k?H5iI($m<432
z{ggdvkuR;;A#MQApS{#&hnZQh`@jqKj)M@B0$wEU1{HEGCrg<RykJW2@D_NvXL5|6
zq=3`aw4GDHkzLKi!0__K<W|25_Jk%-TQ+Dii@yOoWZFx5vbDb!KScc1c2L58`I>by
zSAYy-!sLnm(u^A?ul1K@OqhJy-;gnK@?U>VcF-smXaR_BfH>2q^OM~IEEw-kt`Bfz
z44iy0K*kPa)NAXW6KRm)E<+fr@el*cYh^I6h=Jj?B#0FNV)26plc#}mmfPjY(t+xX
z(vzJ7H5n5o=LRZ+ToI_ulu$G|FHmCgxj?RrhIOD;)XO^Nw4E(r@3}BDFuaUo1_hRl
zF@H-GW4XAEA%6=Oqm2=Ni#nr?K#8f1K}q(@*^D-({4F_*HfH=SC5$#E{H>jg@VcT)
ztepW|Zh@A!Hb46J(t5H(kY)W7M6J7^lOe71xLTK32SZxtHBeUemI1ZK<r;o6m8i9x
zEVW8&evqHme4+s~aMk?mLt67Wj@PDO!Or7p&Cfo(76NmcPY8fjJo*4yW!QX<^R)nI
z%5@Jo1WGTaMW#i-oHhA#kQ>{@M`_KEm?ql?JG+;FJ-m?_G;o-<GX=~8jah?RHX2vb
zk2%W-z1+x{wlf4QwI38R6B*IUleTk{PX?=TJObO7dSUYSU<Cn3#<ZO-U_Hz%3=A(7
zC##3(F(yn73z=A71j=#2pw%DSie;LAv6m;Nb$+m6Dvtt*dxP7kpmE=Ap#4%DX`nXh
zuYecjSJPS#RG6oAer!2e$^&ntb~+1y+$i%}Hf^T`*g6ju(7XvsIhlV6saQWWIVMzv
zX~Of#yF$&F`tO4%#<<BJL$w(zCd-ETFh1R!6;{DK`ElgM%?G0DStdKj%dn<RNSiQW
zb7Fin`{dne!l2$wJ_Ex61_p)~*$fQn3=9lsvKbh5WHT_V$z}lcc^NbqBpFyZ1sFi9
zT^aDG1$B`Eu&7-DHMa-JT+mDcSZzI;!PpeDFfcMWFrHvw;@|)~;sDeU9oY;F$qWn(
zIoS*h5!nn3KG_TmtR$#qV_;;cZ(usXz=&qB2h?DlYz792Yz79NYzENkH3qPYK@Q%)
zz|c?t2{n*|(-;^SK4dX4+{t2KxRAxbz{|i4b}$Rb+yx8_FbAK>f;f0X76ZeaECz-N
zSq$|Id<@JCAV;7p?tv;UKqzM52dj-^WaQvuU|4`~1W4^-1_p+ZECvP#h`|g3P_-;j
zwXmo|R;!a$4|WBEAXxDOMn(<+u))ZRA2Tp82xKuZ{K<r<6@sc|!J}3O>Ih*57H~*#
zKtlpFrNqF@!0;mz5)yYzG8q_7WHK=9$z)*2Vqj)aV2)tIWiV(24Q%k{+Dv|ZB~v{^
zJwpW}10z!d6C+avjiA&N1&_oM1?Qst;$j6uQ$54U>t;xEnCKenr6rpfO};ooOxRq{
ZK-WMwJ;~H4Inlx_)xgpuW%92X&j4DVz_<Va

delta 15269
zcmZqJ!ql*Z$vt$H@5>3H%?#)uW(G*a)5(`XuUm|7X6vOA#&?I97+MaLn52cKbv{iC
zPU}3Jwu8Zef#Kij67z|+a!jwqC&r0qrbVa49%5pEC<+59JC@dYIj!?ldRn(HM|zhl
zPujs}0%`o)Z>Mp7PBZ-0cT6p<Q;vtR;U{AWZ^KXK5}uZmC0rXMU$brCd(E^#J8h=}
z0|P_f!88xGMJ*tjf7>OsPO(;o$p<+_Ccfrp>vsK+W_fVqUs*=po(p{k(snSkGccre
zKAWu0q^+Zo*8D?&f9ioW{%r@+I*-puyZAh<`8eC$w9dnG(k?zuV?3PJe3*6aYo4_I
ztdonFO4+(YKcq2UoBWDNi66w|ypW#O9r`AXfBm7!qReV0-LW6iIB%q<b=QK#j;A@K
z%}o3LFOBg;TJsT+wCJ?Bw0N-h_0qb<REpACFY&irnViWiUq2t@g7mab*A;2a2iVgN
z{$K`i)}*I(`*WnH@o#tMOHb=AU6aPY{zH0NcRUMNOdySa{b7*dj33e%FMu>`Nbhpz
zv0>(K(PFY;;cvOeWW&VYvX8OnLR#m$Icd$uw#-dW>nvRWF{|_AoV0@vndheQZ?8X)
zcJKiUNO(aSBglr(4FNAS{-zlo0GYZZJ+0dnq=^B<Tan&SJD<Nq9VFRMJ0BE$bJ8w8
zNNYa8HkW_u;WYkjx96l~-)4q|+zwU-28OiVU~(5D0|P_H&9uvp(mJn!9P}UTpbf!k
z`@k{>(=I<t^8+P?4QUsDrl)oKPD$%LI46zq=3I~)R-|2i0g+TZF()ni05eF`cM2#7
zW~QfouiXH0-wd$Ij+>LuvMAQCNKfmI-H@hu1Fk%FN*d#hG>G!F)^Ge%52mLz*Un(z
zpL(d}Vu^fO>wyxfwB~<I{8JC6HUD7ZpL&SnRH*=14O1ycn&G81!;`N$(!f61$dR6A
z89D>x>w}M((kw54k`m{MG|n4ome=^F9!jgf_$UpWMoO2Ycet1frKkOO1%+nmn)EbA
zP&_o(F5%#BZTa`In-LyGX@<Ac)A+ZA$P0me67VAVPkLG>TbeV7yC#kCSX%RMj?z0l
zptR?^1{8&9{M*41nAZ7zPFnNvEpyX456wwq{57{8q-8_E3zy$7wHZN%hQrJh_><Q8
za!y+F!7X#sc5yH;fTETWlmOPGF@8+*D*cew`FT#-!N<&VdoHE%Z@-jw@DWQ|=ZiUM
z%?Gy3O=CQi)_D_Z_KRPj#ON;t;(`+Bi8M`!R2t(Ako};fbo5u+Zcqe+RJzNgSsv!^
zox=d)AZbfa>vm@WrD%{VHl#6rNbCF*@S^)yn)B-uAf@hdAW2YMgOd9pkWje{h^&WO
z{R8BN4QZB#iY3xIKg>yMwmtBFE=X5;8l&q5kgLDnPHX*EqLkJNN?f6!{N=hK;D!1x
zP@-du-2lqXYtk5Ry}p^&d?aDAfq>*>4R%qE=6@We;w>jDC%dw{aCevTq<6Z0NbmH0
zHhC($7x#y>gAce>85GhwKTdwmuEN<}`z+nE_EU-3WKj+czHZkyX^e-{)0$mhD7-!}
z*@L53R6K153j+f~!!PC%g>SdgBoCxDA7GmNkwbw!JPlML22B>>RH`pk>$YoUX#USp
zmYvpl_~2`fw9aE`&Cet{ZlyIpQb_Lz{hZeMDV;0ybE$V)^8@*`=EwGF&T0JHzk}nx
z`4A(><JZy-{$ft+ya<Zue{<6;Z<Gk8@vpy^cJMcITIWrW=>NHC2On~zd8P4hyOhRx
zG2jLB|Fq6SX`Nyx3=X6<pWu3*)_EfB-~*1d<`dlS(;_AZDvJv@zu^Ft?)=-prNf7S
z7yJHAE>+NF>i;)+iGq&i0Z>BoeG4+?;3M|NM+}T<2Olu2GBBlaf>PzhwB~~#$8A42
z`KN+5liAnFYKoRNYX2Zr0yqdd4yWzA#SAK@KfOuYc>v5h^(L+Jc*l)*X}b<GGcdgA
zIGon`=}lVakF?HHlUcX|t<QtPXBS8pl9u!i*UxF4A7Gl&zF$sLJPgvrc_Xd!)VuU9
z*U#_L;y|9N@4O5uw!xvi>o_w5L&u4CX|4ZDRMU2y1liYjOf9{G`3;zIW`xpAY0Zb3
z)BImwLn_)K-Uv<$O6xof%A)++yg}93fwU~fw9Z#^(wYzboEz|><$qdadY9|Z^bTjy
z^lsN*ZS@b*JDnv!rPZIb&Ntvn0%8(4K+?djE9FS*Jf61e1k`n4hk=r_bl-8c^e*Oi
zYUy3hj9`-K9oS`luODEzEGWGzKs3E0^ly51fJED;^v=+KJ(tqc>iM^MfZTZq;m*Hv
z171}BPm4r#4=9BOf}?-?r!;7I8y-m81&XD2;Ch?!UYg}S{=RO8H2!U;doF+rC%EUo
z&JB3c`7bRBltx^?rez=S1+hZE)u&}%nhvTcKouGPw$Sfs*_UMIfU<1kp#}y9hPi2-
z7t#*?;7Duy_1~U>p^PnUhdrp&>Tvy@-r@Q!y~Fh@HmmmhON&Tzewp_l>eLMiP?z?m
z{Qw6IxG~asNKZDsi=*XaiE`QwP&ox^XvpcMcR8`yaDZy&$;sR<j0+~O;MOq?OzS)t
z@Z$LYmII~g0WYF|rF9<KAp9=P=}mfv>+iJA69F$$ex-FD1o_JKHz?u1)}PGAqs6lm
zRLFvw13%NECU4Xdt_KBTzzc7XK_LMz?*B~dJh*`elq%CY&w;8&#<`#rp5Ed5X#+1r
z_!G#Ek7=DZ0$!X2DF@r}36wiQtk92XoEOp#K41b{^12+XuKOP-s`j5_WMD|!!3GN7
z&R_4-_MK;BsAov){PZ@h^I+Nzu**Q=ouA&Oce;K`+rbG_2~xtp{X-i6_Jg2uG;Kdv
z?aZ|A|I_%_AA|UFyXz;g99Wd`L|PO$U?B}1aP8fE&|q#_^AFB4aVR%@Zd$AGr4mjk
z*L-do|GtASf4!gV$$JqTF6n8Vp&tTXF#G^zYLI`0K}CD*hcy26$J6$MN>7j{|EF~x
z1ea1gX`P>t3M$_B0WUQFwj3y_1Bb!hKe)mG5(J>i6V#A`#8CarwC|w61vLchLG{T8
zkX7L7;sZ)(LF5iTU<S$m2D<<$+)jW63=g1&2DoVq%0Zo%170|M2L~Idebao9eQv-D
zq3>y($K=v>gTuJ<1jJlO*((e-E;=o4G9SN~;IjV#FD(DG94OIA>--S#;_UCqru=Hb
zh6lg_4^Gi=i*|#X$A{Ir<-8cwy3KqT()hQ3OXJ^mGL3)zM^MsEV>|$AQh*xVpelfW
z{pB>qOKF`K=A<!xm<wt|*QW)8i&6e<HyeJlmuIGRUQ62nHuZqof+Plu8>QAAH$f$7
zz>5k{j0C*k`UWbeI!~nSWCEolXn=xaiZ2bE&R|sv|9hBGX$PNifKsvR=QPe^YU!ON
z(gA4^VE-`3r^QaT7SQ6A`JJBD>C6K5a>wK%fk=(-Eakj5jQlMuOg79VQZIL~+OYAr
zZemUAywRKX1*|zfE%s%{`^ldL4EQcEH2h-WZ*gR7_{CI`JK0dsf@42B$bFqZC+7(&
zir!9hOKbkeQo8b`9Alc{H?TD~Cod87sXxvDYU`$Ty1oI$`I~?j)&D?FbrwqR@_mzb
z`A1sw1ID!PH$ZKXV43u^?rN6ww9eWW>D|>*2j4TNch)`uHEBMiwO%TbPutJ1;Q#-=
z;~>SpPtrQSe_oa51*&;oq%r<`eFxM)d;@B1zF{ey^x7Y!s#p-z@c9UeB*Xt{oj(Fz
z{GHq)q|IdTdh$jgb;jM3ZwhJK!8#nBr!Kw%HP;{}@~^)R?$t0}2Q{;6KcsgB^ECWo
z=5Ntw1c$|YP+0J{^iH-BmXWdOI{@<D2etGrfiy!<m*`U(Jb(&?C7B<;{5QE**dqKW
zQ^P~X63+CrM%NDv3ZRx_bL|_(QU_3=86JS>N$(0_7D{V=#F*CkGfnd#sKL*9EzKdV
z`3Fbo<Fp+NJO2L%TUYxbt@DFgdI$T<{K=9cW*o5})Y3bdUm8vh7qNANc<MUHFCRc5
z`UF(jDWvTO>pq^=c@ZS@<nt;}<E`8GMS2>e?~~WJ)6=?xW#FMu%rg19h?+d8r`5~|
z(+cWCyh-c44+{G<#?P-GOqLThl7?7!JS`xt^CPGs_yOcj28MtanJ*@1h*}GF$AUU_
zhtmQe;xA83-YBZZSUdTKsDo`LD5jicK>d#o>D|s!>7c~Y<t&u88x-B32>rlN;?j2*
zq|EnCTIco8tJ2f{`+i7c{Pg<a<Nz^swt(kp%}0198!*Y#Yk*6=%b@Phne-0V%dkA6
z)-AS&q4iQpWg7qXUum7cpzZN1a|2#P{!Ht<k=Fd+M|!90Barvbq<8v0Nk8WLfDuX6
zqMvEakJ-~YKeQaEl+;V_a%Zz)FBeGb{E*iCpg!HmMfMrUI;r$7*URZ0Al@<82TVx%
zlP4R9%WE7)E&)JJN;5prda1-3l<uI4Z_EvNv37EaxB~z0A0R8!yIf>nr8OT>fD|ar
zZ*0;!&%wIxYTa_J3~JqcUZ4iUFU#}%%|98Me+%%pe_{Z&At9X(kS7g)Ks<EtIVe*-
z0=b)i+X4RdhrucDe|o3u6U%$W&QLdibmaX=Gdu~(yj>x@&sr{(@Tcu>V5nzcNW1($
zjq^uZ=k+wlwC0~2r4Q0OTuhIElK+!5hcvg>TR|p*ibROzN9Lw6-T=kz9&o8}`gI!r
z_8VyjUkHH24y5;l?t*rvj?7I@v-I6lqMqL8x=Ss+OEA69^#G`CW^t&5H_a`r@gD;t
zgDOMm&exJ@j%m)XFM%>z=cf)(=e_nodROX!*UTWH<|8)XMrrdKowUwl=^ef&(qIMo
zLTE4@=Wmt-cj;U?0$ymm2D#)yTIVMu&wu)s1`Vmc!)gm#K_&kWP&PUPD!gJ(@UOp-
z-WmHO&G3JELoE+OrHEd7mm4TSaHlt<^3<p82elCx(hR?Wg5?6tw<prmEKASu_swHS
z?{fwB%Umz0rFY2~fC9Spe<@GeE>Lp~Gz#$A9ui%UFa$-%g>N8LJHQGq|48HCb~&vT
z+-C+Ap31H~=>{&m&!ACq<F#U%N#_Mn@!EO=)USrA=|HHt53&F`ffjsAbDL}}rB)B=
zADv6@VgNOu(z}8g)4RNx5E;pC4@2w!l7uw=?f>=CyVzR}lt`zAfhw`IfR2mlU7?@A
z1#JkZ^%(WqGQG?7Q^1QwU(z}c>7{qObEP-baxj!g^c?^t!GjOL6;~;=;xc;8)pvje
zWYpwmQvT)@0-(@#5Da+n_B|+$K7dMqLJ3ewCY_eWkk<LL;}$f|KFkex@fKvG-|GjH
z4Va`RYfAGV>7Rf_Kd5*`(LVv9Uu5!KX>K9@Z8s5_2$U@yC;yTTXN&j(%Z-z>W%%kp
zf(G8wJ6zv^Dk_2WE>{syupxp=ZVyB2ZT^;iP#U_em)^zPa-c-K<07~Wx&bP;;FYb=
ze>HFl-F_gA5!^j|k+y?@oq-{}q4pC)38?G=wO7-cPbh#|nxL>LeV1kns?}mYL4wzr
zE4>rs5dLkkA3?z+liuh0F0J!sTIcojZr4wrSA&at*B5DwhhE<Y***D;w4^ovwp*Yg
z1=Mu~4^n`<dgBvl03*FK_8G_?R}N5X9AqopU!Y9U`FV1`tO?tjPp|+<OA80Jchb9D
zIY5B`4H;04P$~e|*$qiRb;t<_G_)oFPCcJNUCcOmn27xcH@_gAquZdQ5%5BGvZb7y
z#z(N8^t8@c9*`4bKcz9=2Jtx3qT#w@??bxX;>~Y3K<(l;>0KTY=^ehG(z`q)(>r`8
zua(QF5B;2`c{$A)G@#XYmLaY6Hh<qS&;ZM}3Yj#^-}TI(Tn-(n{FSx~+<H5t*2R~^
zklx|@CcVo+FulX|V_NI~Qf^THFCZ;AE$nq!ofXI*nupWEL3~hSC%r55GbA%O`~w9&
zh@ZxID=j9AF}=(6V_HC3I4B$WzIkm2mg@YGrg<nWJdN=;!URxOVg~C@gX`-2k@o#Y
zS^z{ZNGHUSf<I}^M+7DtFo{h5D{m_8nbvvu_2cw3{(X!s2TC{sUL3fS=J@(O$RVJ5
zWpa+91Jlx<lh-NQG2Qz!`JJK^>u<PzMI}k&PcK0^@JCt}13b_Cm>ckd?|)i!dYA97
z^sdmK>0Pcr0$#X-@<A-9BR)A$LA*ZwnCoYT^lk?c@VHNxGbpe=rFR!gfbz04PkL9d
zKzc{$`_^yiUEVS!uIYWwOyEWoXh6C7IOE)ghfF0xYUy1bjOiV|@4+py=HpCr!QKb)
z!3h?W`-{N2H?8x>>&>7hmQ;EdD3(P+LD};Ia+7xITTny6kteP5^_;Zk!#tpIP*)DU
z^e%>$1N<#Jm~2!_L1PK7py3QiUo!oe>kEZ6!vn7s)A;utcv;2->fablKB=Nm-+4Z*
z`Mp6}=g)?poMmTU^Edo5C_N2QZvaw%CC%_;!>^oDrL@lPput7Pxq9hcVT>Rlp0ws;
zOnT{EVjCG>GpBX_YxtD{DkJJ08h+{Vx6EX$7isvV%HR5uF>Qw`1E?V-aO>p<#)e-J
z{4J{)8h$17x1M86>x{n%8i!(;3yN3ffERCXzC6X)@T-`=Wg=s}dBd*){??U@X`S~$
zc7qgkOQ-EH0GoFBX4;MlFl*;cP`v^k#!TzH@lu?z;a6#iVZ*PA64#eGlUJ%LFxA|g
zd|Fk8CE(9XyUDLr<0S)L{JfFo32NoNc>NO8Uitv;D!zI#Ia$r7KH$ZY8)=@eKSL#M
zfoi}v0WYS$NbCIlIyVh8a1I*70#%rdHpQjUX`S~#p$u^z*dLJe8FwSi`Sts>&d+I`
z=U$saN8BK)poOR`C^iCKn1U3(fd!L{I%o=^lmir~ry&EG2N*#ucvp^>mXj^j<v6y5
zfr9hTpULs+ChYsboCA|*saw|n1hX4J`9=ZDU{doNP}juuPg+n~U|NPrILMS>kYXN?
z7eNU=E%v3sf8>#;Kv0?UA<Z@{lYyb!57d*kJ(R}4P~_b3h=ad%8iQVXmjh4Qu4Bv$
z4Da+N`)O#_dp=H!daan2aSSx*kntpvfgvr!5p2~FP=4e|Yd-P+<z&XR#()1A7#Qkh
zdQQNHh(4z6vWW*diuG|?M4H>{+v(q2KQNW>rtM+?8D@AO;6>GAJx~`*Db4VkUV4{^
zIe6d_)C*qo5Zr+i;VXRs8l~SM0!|v!H#2F<Gx9kUflS?V2UJ$Pz6L5$l!DVb4}#`l
zmPF~LEnE-<$`AT!*_Zgz8V?<a0u7fOn4GGmA#fm#0aWW<O0&FJ%8|x;X!2Yw&3bUd
z?*$}eI!}Yb?n8Q~>oZV`{Z0Be*B6ZZEjdi-Y5coVUvTg@%P<DK(7Fri6Yn|#8cR&?
za|QKz7}Gj`y@9eF8Pj&1Ly~i3f(}@vfd|&!sHJx}GN<i21yZ7xUf<!!0!s1wK*ptY
zo&b%?gNKXWrR_QjQj*^1`b;go!-bnQ4b;G8DZK@1Rd#-Y$*ZMzICFwb===vtxQuf<
zPNa4IdIuhGf@$RfYn3d00%{9`0(jazn6dT7%8;-weGW2YAIRk(6F}ylN3q`=YzSxR
zL$&nIYKJt#10b87K!h`hZ~+mnkbvUkZ`NT183zs|h*e!6A9Nl=c=6yfjx^2>_3y#P
zvXtHe4S8~cS`_cq(z~l2(sl@fd-T8FgA8i^DOk#uwo?c+P6+l@mkT!+NO2k`$h#0j
zBulTS?K%T;bmRXk%=}Xhr8PhJ2O3G+bqJKCK^91Z^)#Ol1P@*qeoL>1m=<EJ3{QPW
z?m|Q4F(gL2yqQsA5Hy@@crpzfRB*qUgAE2b<`cv*oTZOJy@fPz5P(N=L5T#+U`p%!
z1ZJ?Lb;kYzjU%(oeV5jG0~Gge;KBhkI#K!}t@#-fe~Uk;YXC`o&7hY02S}x#wo?Wa
zKKndDK?0hk?77i*>+_Pn8z4u6k}+tIee!Kx70|>@?Hjf9PIsj=!vlQ>)Y7`eY8XJO
z)Y8*B!&N{c3wan}0`3~{INZRHwjbQSI1aH4)S`TowjXL^=m(gMFjY`nkAc#m%-pn{
z;6cj$lZ*63L2ht;qn6(7pafH_ws;pqn(BW>P-Z^<yYIN#;yqwTfelehPwNg)fjYMn
z>Riwe!5ffFxCY40onkzUY5Q~_-Um(1d;s;YzPY|&;cwXtYA}JqtT-kOGzBpEy`Bpb
z$DPTh`YufIcP3Zs%V?!(g1dol_&b;xLHV46zvUMLtoYz>c?UNkcJfAUk;(i9>?v$3
z7)xxylWEO|ndYYL1Pw2zK?Y=-f3lQFf#z30V`96`Gcqu|g(Qtm(Bvr-IE{0ag2t70
zrM}=Su7rekx7@eGj3wZ@7h>9L$H^PHg-y~rZ@ho)4l$tH4rJ^u(6I0OG_c8Ooj=}#
zs%wa$CGu&_KUqpIfi$v#HQt=O(LhJ{4Wvj5NXy6r7uXX&r$wbjf<rgpMb6K()&u-4
zQ7mbl$3T9b%w?!hza%QH@!z2+28JTVwCn?XX{=j7WvAtbA|X)Ox*!Tv*r&B#DwTZ6
z3z}aJ1&#LvytwlXWK`=f=9f~S1_WDrhwBR)=2B3DLodC10;tSw{*?tTZ_^kUUh}6l
zAJ9p&J;21kP<kI!k{MnKcroMKYt3}#hT0dCR~ky!Kgb5937K1I5qjxeer##GL4Hr$
z!3;|7owwen@ozf_35fT4>D_)zdg<MDEReDOG>~-X38-w^4)B;ISnLN}3_N)a5(CY2
zfFkNWWDXCc7Zf@lCI=b`*YCapnyG>oLAO8y(g$BKr+I)gdGiUz_i6mwFM<aUX535b
z`~k|ipxHO@+?o)`q%{8R$J0DOgUknCa-=msWK6sGFpYoL1I}WWwC0lz8`#r!foyn}
zw(BaWyh>|+us4nK#5?G4{jSLuj8rwhUr*Z&Dvr~3u(5(B&~Cj?+YhcKb};dS_`lw#
zH`KmhE(w?{VXP*(;`#;_aKR6$Hqx3;aJ<{Vn$~%1a;&jReH|0XMW8nG6TS3qHx|&?
z5~!*MiM-HD?*c{JL%sB_I1Wg^C_SyQ_6@jB=jc0--sSq{HA~-t4gb{^c{0Gpdcc9D
z%J45ejobANC^z>VRO>X`!_aq7txIetLwc7hXgZZGt@(jN+9VU+`iBgqvLGdPUJQK)
z)4N<B!Pj~0U}s}scx?h|gR%D=Oyl1MTDIW&1T<*=Pi-+sc^dyVPz%oW1y~HO(eQxU
z;sj7e-RAlb)W8F+C<uKL@Z#Gkm?PB|`!EE&*n7F}AeY+WWXPhD!;|Nl#QQi*fi?y>
zPeDqP8it17d?m6CzXeLv8h&$>u!5S*_B|)l4n7n}+vPBUf#J0joY%y_@R|qCo9t(5
z<}CqgP-Q%r!N8D~Q4h{?Z{MXwq(!A=G=RnCfyHjVON&g4OUsx7%3B$0z+y+=rNyU3
zfLpCAKI)|{448c0RJwlO4<1k~gJvJn-ly&Q!^6PvR<BzuVTR=)PzxR={tqgi1QO@!
zIRW;JT*!<KhtnX{UfK>8CI$vbJ@h`!@OIihaDM8%0iK803CaR#I}U94|39ts)O*m-
zBX|Pll;>O90~<>C(=xV$-N^GUE#l=VCYbz=qfiYX3n7_LEp71vQ2Q%j2B>+|dVs%m
zHj`djH($u)t!5gQ`#|moO;g#L2$hK2t`+5<0veY-kk)w&G^m%>>H6Wd63BF32?mCS
zv|V7&zfbG@G+E3%s{RAm4FYdLYj0ljfd{fWOFyLTW?*1=0CE9nVUbD^)Mq=mz$L{e
zXmR;A?cf7&Bkzq`+G3p|NcvV=tWX4Zwnh;sEx$=S_(CKN)L+gJjR2KE3*Ug6m}xs%
zz{8B4pa6#(*?AaLDuYAnMq2X;CV24zt`k7w;G!Bd2lprqT6Do3l-}w307*Mo<$Jxf
zg-fC!<u0hr3d)#I()K}^_1&&d(kzehH?L%X<=z({23vZk>pf7m0S#~5g?2BP<_5gj
zbp@0d!RsatfcQtwgXj0ULtms@hCV8?NaNpr2s~p2TA>7)q?(!b{Wqu+9C{D51S*Yx
z{lWA!OV>9=pwSHDZLxRLEn^=PtLUY7vw_Nuw1Bh>OK>RFy-tfviv~pksD4mO?_^7B
zKF0Ubd$NY5jJ!f214Ej7TH}9EoB#D4P}-gW^4SM)opEDwoTXd+0$8gYmJwGl^qflT
zya>*BI}+l-+4Mjf=ZU^Upd^--o_5^zi33P@H%Jl`bx-s_6CI#AFVN&bEn}MD0loC@
z4p7~b#=re!n&qj|Sa4sx@i?f%18QQ`zR^qX-f$!hG<nLu{U2yB6%?csjzL`WOE0~v
z1Ee;+!}k%0eJTw+@b!qHR2l47@KgtLnwMI7M=;}S2c%l9?d4xkPpaW$8UsVmslG$7
z@(faTftDVm@o)PG8jb-kD697XHJlmKdwd_H_qje$OYiUobvL%TJ_4_7=?;An@M6yq
zwe(JBW{_9kfVxZtV$fbR>s(Os1kKxYhdzKc$Dqo(9Hc<jgG}dy3Z-=y$U${-%}v`W
z$-uzSGg-@;oAJ$LGiz1GH<M$mRl}d8H6M0JYy1t07yj1hf8ZV%C|RecW&3{6NpIc>
z3RmHB-n7o+>0Q1b(k?$w<NO7h?fL+o91$qJ1_~jyv`#UH8K42ngO3E#cAT4h(OOsk
z1%q08R{(1o|F&PC5dV+{8q&W6YS?{9v;0-e4;p?JNb9_x#`rVM>Gku;>Ncvv-VvY@
zl>t<SWdwnfociQ=8!zPvVD`1=pfVO@VcNmhENY!{5ePfkCZDlUQvdM}EDK%?pq92c
zU<Rn`vWSgAZvhi%mf}L%!AG2Fh6g4K+nRA5VMuSN5MbnQ-#t0lR;hjlba5ki;YNBx
zr2qr})Whiwm4XZ<Y5^~lFSHyeNo~1ZnwSPz7>C?Qdz;?rDDv7qy}M8(;Kk4LEeA@h
zTW*({Lz{~b^`N%mZgBbA`2pN$KnQo<dTV)X@?Tq*`iHFLilAkH&a99L(mqBTrc#%e
zuUXO?YTvW)x2|J-8OaJ_bMd!uag>XKnC$#5S!^H%2Y-tM`^%RcAhrO1%TIO?LzKTI
zmgD6W4p5@_kltMYN^aW&So)5o?F400&{T@yfzPY@j-~AgbDezEPO5%2C<;Jx>zpS*
zeFi5sy|jfIMPMcucz(J0fYRKw&hKdlpMw^j+(_g64U&xF(@X1?(<w?j_*y_My)#NE
zZTEhNNw?EDPlHv6rR~0iCM1=%`x#v5CP>xfJbT^<P~W~=4%E57U1E}!eUdM&@gS&l
zOxq16El(HArCDAmmefn{wr>9azl004zNgayv>+?3`7qz>yP&jYd7)S}t@)=wiF{i2
zO&z`T?%4+>U$$4QzXr}*AJV%Wn84G0Y2B{i(ftVU>dXR(w6L^{x8U^F`~;NV(mFph
zJYfuY5&H^Mn!QMCJy0qPQo|7msyO1GfL4dT)L~EWbA1D9<3hvr{^wPC-Fyl~%|978
zu{GTK50VCzA54==9ZVSGCa-c(lv#BKlx0AzNB;GPzzawrYZ*W@?~@-m*w=forFZzg
z0~HgXX+O}M$a7E@mrn0;eGg*D>7^~yDFQ7G0A;HOY5eQIr!^k?|DS=u@Ea&AfBy#R
zCN<PPXDrc6Z>W9FTw)8N7)m`r=>b#*I&j%CY~XJZXM?PaOxvN)z`*cQglz+dT6#yl
zvrO79aJzbkHAwg$YudqgOrSFP1$Zro;s4h%dT9$)ia@19+HuzxppqkP2dJh7jY+em
zfwe(RZu|$DKPu-+YyQVr&Xwl&nk{V~NCXlvoy;IQz036l$X^nW>do)K|G6NpEGXcl
z8h%QY1eIGf{Nyi5Oh4xOjv@V+>wAWVp8}v+CXck{2W)Ab$H3e}X<li~kGMhXDF;9+
zNLlB;_HFn%Inqf{Wglpj#wLLc9Ixfm_JR5bo47Wxz7|Fpm}dBG@;oOo#*dS?I%!+{
z=Wn^d07{qD8fk|A!3-VHn1}&5z(FjdG{cji7%~O9)C}ZObI_7P31=&Id2k9bnjGn@
zAQb%;q~k++hr4Y0F?SjNmnxIHo#pBc!AfpF03|d~oP2n>kqJzLs^<W3ZuJlVu?r;9
zyCOsyelzj6H!?T><L7U$Vou}Vb{O1C;rtNr;@2}!J=>AO+;Y2gYudpdY!Lf8-34AR
z1Dl9E5UuhPER<f~P$9s?-)_JRX({y`Q0s=y8Obt(=RG=a1iTP92}(uaY|`Z*&~l(u
z8KOCjf4hSOcs&uQWr0Y#X`P2&2iY){ID=ccF(*Miqt*lb9jBl^>+}!+j|?4rz&v@q
zi%`8z5jd@WOz(6TdAS(0niY~E10=u(Og#e{<6HK!4rv|`>d0(RPv<sRRon?s>k{PL
zdncf6(heV}g<TE;HjE|iE9&`MEulh4ZnrzYo`!HdXxsx_9E6Faf!1L#9s(Qx<P<1$
zTLS*Q{J{to_;>;&(D90KvZt$JsLVfj0506a0P1dUWdt>yKtua!%`ez&AigT+Oh4`*
z<Inu^Ib%B5QT*+_j4cOBqhSHMEkZEh#m(cO*?<zp$s4&vC*O1xVe(|0{N7cTqZ2Hy
z0umS3RcQXf2wsEw;9pwv0Z{o~3rbvqX`Mg7b}+oOWK7%10P1<{s+pYRuF1spcXF@0
zmjAs!aHlTV$&l9kfFF`jI@|?c9{K}u2soNc*#4a;QFtAtw?Lt=<v?kW-U7wKe+NoI
zt6p3`q#t(>U}k(d@y}#75A{@V({CpzH^bT`FGHb5f&9z(+Bt3K7tnz6uFZ_#28`>6
zfETkLKrB1%Aj81;S`k`I>`(_a=nemaOBrx^0$yVN((D&#>SS`a2T#2@b9ucD8-EKA
zQ@J;&woGCy=Lan(GH0}5;%~jk@Y0FVhK0X1hcRtu2gLuNL1<9Y;CzsN+*yQyA^o_s
z1eg>6lQIkpFUxprIQd)bnaX)>*!f#eFs3!1`u}nRqYW2-t2L-6gvdShu`e~R+6eKt
zJmDxevf&3U*Dsf~;pJ~V0M4$#BB1Q*ED`X+_F{U6v&>6b9vgx5E@v73R!`QK51DMF
z`CA@wmGj#O^S5Mi*+}uXlybei!)+tO-_p%(<ImrEfg5chRM=P0BxA8mTIa{K=7;rZ
zpvt%Tc|ANDyTm#f(wZM}r8S>oOmC=`VW?zoIM=X2A+7mYMX5l;Pc~5Z3sgXUOlv-1
z4{}pl=MRK`VqdO(4skNFSkdHvo*J(DN76f;MP6EPgIo|T)9{;}zg?RfKCIVmwuhnh
z8-I%gcgIao9tI8cYo35qYRAB1QUNb!9-Ex)C8^^EF6a*30(Y}OadF@<s9ZSsQXq|g
z+ZAM+RZmRb;3dlQ;Tp(JXTg9MZHFgc^fD2AalQl8zCQ9=0X)f{cYLy#x19cO2DH$M
zxt!kREC`zD{&%9ZFuluJAZ<4|9f8+jPfqZbXW~CFxzSs~Ozi-8?3bnV#mjx1puh!h
z4glwF?gMGgY0bYuQj0m$c2<Cs(G5lhhL_Eg&v?sATsxcI6)XcX9NFd8HzqUt=(6i`
zf>MXyWOE<+dIP5PE^h(wV*loc9FQgZFC!R1Y3($FjR1ek9|ju^{#H&V$PoC;)eJTg
z{4EO^%SCNO`CC#MZN&Lo3K&6Yg_ZH;V@6PNnZyW6LVFo)B>7t}GD4<s-lTUp3%r~I
zUeVwzU?alcJ^{?0eAP#$e%3xv^cIVxcULo|8Quo3Iu?;j19hQ55mCJl>{o%(XJDBy
zP=s81y#pNjV59Un0$%X#OYd+Ne5njFbvxWBa9Dlb3)0uYA_q0*6~rq6FK$63#M}g4
zzF|j;rP}?I<^5!``1ikT29N0!3#NZ_7GNw@1;xX`hwR{`j*ulOI|LXQ7?6Yc>E1N3
zSip;<y)6eSSkewY1C6q$H9z7{15Y2leDx2_y10EH>+0X^O^bYK#14u#NVvUwslpC3
z?BAXPFWA#NTt7ez33%~#54d#f3jNS>sg(J^3#RmrV1bt>L5m2t2SX;21(4mfYhT*V
z3~)-RU}9i+xswgFmq&@Q+#a->=K+Ha^W-gl>Ff?opl0Kt$x8kP?2zfL?#Yq<T6_@k
zs2!jT^778)iT<*T4wKjWOEWH-d>YJt>2Jt*a<X)QrUGbuD&WP;?I5L)Wx&YJc)W9R
zN`M99g~@XR92pHK-w%+n1DXBWy5|IRXv+}BYCOci@>&_pD`H@HEeT>7fLQ#XK7S@S
z%gS7tY#FG|$TK-HP?O1_Y4V0Z32r_H28P#eAk_|&*9R&yITV3}C%*~g%2>S))RcLd
z&z!b10vr~O%nS@K{h2{wZez^f63SREZez&b!pdl4#NVRCXd_T!YGY86{c;+kjVXUi
zI-`vle@i~2jR}8i3nNky*UkVcL(@P@Hk%*)ducW~F37U}Dxyiy#n;J@)_Gp7ORR$-
ztrJpq$k;HJDA+KSD773YHA`!Ln4bokGe6&u*8J!LXfa&#IgZzQY0b~`Uvnd51rV~F
zuLVHi&<_rWfJ<qSX%R3NrFH&P>zFJZ?8pXMEP3(K<fLF{cMq_K*D-^}3)6O5fO%V)
zK?8d?0$!+JO+V%=BlL1PW7<v)u+$z<$h3o+6UfoG`@-Zm!D<{^!InB)oGcZhAYjgz
zwo?MEhk=EG;idRwuMj;(hsl*86EibFc{><f^LT?Bis0o9+ni-UDY^L{d%3#}Q@Jy|
zmDqGGt@S{Kae71T2ZmA(a5J&fSpeiRnb)#uJ9)sCxUzuVjO?n4%adzE4Vdy@OkN*q
z#+3H}L@}06mJ8EnjF{{d=EL}J^YpL^X2!J1{81M-Uy15wVVp2ICSIO#!sf>KX!gms
z(}e5)Gd##+U^u|Qz;Gg)fgzoNfniNH1H+7L28Nz&1_n?Wt-&D4z``lOz_0_qT2P-P
z0E^lVsJS^v=7OdYz-sH!492FIg@KX5f$;<b69)&_5exDm4$jDCU`S?QVDQOiV6ez$
zV9?2CU|=OdEgJ(PLwy6&2?j<qgEgQA^JFtH{K#Tpc$38dT6V<%b}`7o8~!sS6hIsS
za&Q_01H*+Z28KOZ3=A8x7#MgNn86Na0hzntKLgCcYqB5?o{+`BP?N>LP>{t?&%npP
z%m8u(y5bzD;sAtV27a*GI7UVeJ_d#b2uFa_E@oh0Fv((IP=FZBAOKa%0#yr(W@NQI
zS@mF7FbIMbKVW3!5C9vDtoShl1H*?*28KJC5Vb;3wJdnl@<1IS%)kN;2@YsTfM%8$
zm>C#uWI{q>k4Yv2!-`A>hB=uG3|S1!3<}H<Ot=hg$Yfvu8@zdLCcnOtv7V8hp@NZt
zk+Fffk%fXrP-=>TM`DSBb5VYAv4Wwop3&rUGo(2TbdB}Wl8r4Vf1DvEY^G<dYoME+
YXqK8{mSk>Vm}ZbTS!(99$rIug0Hnm3r~m)}

diff --git a/pc-bios/vgabios-vmware.bin b/pc-bios/vgabios-vmware.bin
index b7cab15593e784d61eaff34db79ac5040cd5c89c..03b6dbd77d27ba4353a25801c4a674f9608dfdd9 100644
GIT binary patch
delta 15018
zcmZqJ!ql*Z$u@MA@5{ZRs~ONi%?yx;r;{&(UbmRu%+^aKjPDLHF|-^g(f)TLZ3lw`
z14D_$M0dIRLre_(>rbV1o|uz%@j)8ve|83jxvC654lywtVq!=OP3wG`7M2#A)_FKR
zt-F*Xy~~v+?cig9H2&?E(l~FW8Q$(Ytd`a(#>1G_`MKdYV+n7=Z{`x7mfIy<8zf(|
zZQy&&v_U&<mjeR>L*Jn^54A-tAew*MNwrSCR))0bw8@vGgeLysW48AFuvvgnmXSBD
z^I6Y@z5{7H7}^;aCR;ISD~O~u{}3n<OWV)Ez`&5U8$`YqN!!oLz`*dDEp0#B<cUnB
z%*>@9Ci5^WadNwUNKfNm@A_u4Ewh>)oR{X1HZ$$}zcj`ZY0XDO(xTJi(&E!%4>2+5
zrFDzB6s5IZ;&0h7c{;Ov{p>XUZ3oiRI$hVKH6LJ4JNSbc#MzLZ*6q)cp2ol3oeymO
z29W5A^tA4H7O<#58vpvkX^bb*)0kaXq;(#flg4;$ZhDtHj}0?_ix`s)3xCT_CL1RH
zmQ{>B7t%Uk&q-@Oyk%~BT4(H>^tA5S4QZV>=cFBc$Xq`+jeq-rw1W>=Kqk#e>--e(
z!sTz8A=pU^($l(KLFySmwl7I<sGZGUA_1ZVN+i>EfI=oc?YQe25aYFY+74(C?O<bI
zU;s;i1k&~~g2J)$Q+k*0nzYN0(mF4L9P=OSm=*3F2h%P;OY=*+_#5Q7DImwKN$Wf~
zCynvuT#)rk(k{P9Pg8bXF()ni0P|dsE2pH*Oi%k>y8@C(T$g|hp3KgwSic09!q(d*
zhH0(eN=(vP50vPqHUDNR<x6Y+$5g7F*8GF1RQ0uVnm7N{gJ}mJGHv2W+YNH?YpFED
zOKFBDUkich+pjrbG8<XaI8UWn-r%2lAdT}-n&mwZ<Klxf&iX?j2QNtP2w@jWPy6o*
z3ck_}>1m9mbJEkAYZq|vw@&`|vYauk^W~hh=7U@2rWxK&PwVtuk)FoCEks@jq<c-k
zi_SmkY26^fPR2Cn^fYGQ4Qb84IZChgTmXr00L2<C&eA#$%}HZ?mDYS{%iOfi`VRpw
z@_)Y+X9SrS4l~aBPg>`}w9Z#^AgZ9T*2x75=?!U&x6(XHKcpRe%-nMUyQw$RIzI%w
z5dRHIcK%YJ#OS*rP4i}2=Z!gOj34HLQ_Rm_pg^k!#XA3XcbPQH!~DGy8IX0Pr**rt
zK+^07u$JS$(wtvk04Z^ogNQ@ZGUFkzpbRL<tpPFX!Isu;NVEJ@ECLRrG!KZ5V`+?s
z(!SpY1@0P#5=F(d&Y$UNouM1RE>8cIp7!5&O&a69^tA3!kWXJ<pB&3>#L;rHQlj}E
zN9pA0>@GZ=zE41*%9Gyd`eE`jb}x<-X$K#0t1>7|w&qabO6#tDl5Sc1sl<4428RYW
zbL^Y+v}V^A3a<}Mp2yKEBbT;=g@J*g;TLm>dfE;q1_p+fOC_>tJ3#4YvID0Ab68sN
z<aAD@`dqbcu~vrWUmRu0D<u?4<3KUe{80Yj3y!qr2li<WY5dzirFEVHMG@oNH2(G1
z(mF4v9sJFl)_Dsg_HS;Q<-rocH2(F+Km`Oi)|(IgpPSZsG40?(4ydaCbJO^@T}tD;
z81RDQe_H3Ew9XR-2hy5PaJ~0W>jZg=Bdz%a_j_<*1S*Okg>5*fxa~Ncw(Ax%1H+rN
zT?fEa=kbmk@6vW11aT0Ooj)M*lk>O(>yM#oN$+s|oYwgPrYY_F<ut{^9VgN_Z$R|C
zOYd_1{4OmHY(1nbgg78LZP#&T28MTOyH0{^OXJ^m;!VflH);IaE_B>WJNQr_t@A>f
z>i_=?|I;{6q(y^E(X`OC$r-Xd^~cjXFN5m|Q08{)I04E{A3#L}M_T8{G|dyBvNhmE
zKR7fFz7ps=u9n^*oW{TH3YZnl2&SBw(wYx5r}=@>!H3sd(;|?a*m+1Vy^EveWQhtS
zS{r^cm&og-cLlMf@o!@})bNXAvKF5U<C)3%d^$#*2LoQ5{NHk*R3qTUxj$*0hc*bm
zOLKbDaX78>M8J!i;Ec$>?Qq(`2h5=A;pc1J$>;dA>JR>4M)<4qX&N|6(mIa^ya)#w
z798**2BdWZPg>`xckpELrsMDiUR05^&SPnvKLTEOft05~Y~o1k{G7(W?Q<IEhqQwa
zm>~A%ft5}F2hy;k9#mYX?K;QE!0<k8*Lg+;hPP?_+fP8scMS0xX*)PU<vE)A_2<$K
z{$vK1ApGl3r17u62T8x6LgK_+ln^~QC$0H_!Q8awpPXglX`LseLHzK!X|0z^IKl0L
z<^$$))A;utczN^FWDS9f^&nqe4tUY~E3NZ5IBPHX1<wDS2h$Gz;7U9A0F<zK(mH>=
z2dDENOi&@-_W>`w|F#?`DF*Ah_Xq4<9KPj;_@Kl+t@8#rkU&|m^I+Nzj(Q~Tf(pHZ
z518kIRQ!Vk)_c?d={x}wMpXK+gx+~M;KkFQP`87s0QR{7FSh@L<W+FahWJGolu6-P
zbYd5maKMW#{{voB{%JW-q678}&!5RQLTZyQNQu<*Z@UF+@u+o+c`>B%Z~Lg$&F90A
z#=re!8pvP#+YY2L9!O(62yRC4ufLqecqy&(!kjcll&ER=$zEOuaVsPV@^8DD)_DyS
z>N~(Kssm~Zk{B#*lp1y11Sg=1|7o2EodRC$`vLa?Cp7H&z;SW$2b9bIJ`HL_+QDZW
zX`MgP__zH?<NT+V-dQ3YFgcN3a&n}w3~wr^5#Y=M_Tll#O~R2HPg%-&Z5a7mSea~?
zOQc>dWVK=AZ=KDW)_J2h?F%efz0CSFnOVeu?<_;ZFBbk5C&q?fOeI;99Yriycd|1u
zFidU~Q53zA=9bp{kEL|YOC`oM!*5_a?o8e;;!}T`0mg6r2dX-qg+Qgp<sWIy4;a(F
z-vHG?)u8IA_C<PHcQs3TT4(K(^zLA(gRhv=)4FRvfCS!vf)-Q}y<jL&PTSA0;Q#-=
z<7u52K?>e{UInU(K)OM-4WsXy*H@vA>3r><E}F)_y%<yneoSLLmS*@L9JGHXPZrf?
z(tkJkfT%j-;>j;WwJkuc%(Tu^7hgfF;$I*7BCYfIoHWMkpr%yqhxD#so`zq{{4JV{
z;9z(G3I_g`uE~L7GNz_|2S8Ql2etGrfi%MdY5dzhrGdjHP4i${=clyGztWl?F{XEf
zFbkzQq&5HGD1Gqq{p6)$7L3~_-xCwFwFL!{;eqrnkb>q%j0nw_AEj|#gXu}z!LZ~1
zf3RJ#AJRHMsHJx>zf7KNB5uY}`#~+ell`UY<RWofXa4n}Z$MQwsPYZ{04lwu)Aob4
z9tRb}PtrQCe_jPDl9@waync|L)*UPZ^LKYKC<aPjO#UjarnnEJ2i%%2VeC5w()uQ?
z^Zw^mX<q4R%&{+CKbdSLVI%<#xq!6JkD!*o2ap>X7y@2Yyq?@HVa*4X+`+Jef#K!h
z$(JS67%L|Kl5ns{0Y$tsDB@i|q<1+Bfw<99pg8`(P~wh=<C|c|f@1hX8sn$e_a>K1
zsxzg(n!G?#x&AUz&fLQQYV|iVq;;ML6-4~oFM&efLVAbm`Lxa#phED<+<+H(KS2dh
z^MfDhovx44K`HH+>jOq41$%y`H9uxg>-^AiAic}?e5Dk~Qy28oyPVi;*vol9Nw@i7
zeY%m4?6Y*K4iI_F^#K!-0X09<nvZBqF60)`PHTRn0LtOe4wG897|4+&4r!f-L5U2i
z>BiiE7bhn#kWvs32iu+A<s$p)HFKKbfyoyYB<q{sIHc_cmk)>4y6svS(mQJpfzlVa
zFtWVH-~5B2`M&^v`$vY3)8KLf?pN0z>0r+te8!yKS^5Z6W2N)2cRd7Z7aw!o!;s$T
z`Xt>t_E514)Fq$*s{fH@coNh>=?dX})^e$&ULb9M1E`3;{6CHJM|wx-o;1g_=ARs;
z_tQIEWRHMS{gX6@H0Rfw(hP5>b>0YgvF;rxDnX9iej)AP3xTxGW9dDi2cUKw0p%vw
z9ciuqOU%>zT*299hgy0UN5_f2V`}MLT<IOY+taOFx0mpyIj1%LR$*XdU?^SwS~Sfc
z)ac)l=Jfgq*e6}7d%%H|)_lZaa-*Dhee)ZgH2!V3I!>kS1P9kawQe&n2FuU<%?6C=
z9ibOM?nvX`=E?zT#+(Uw@%1gJ=!GQ>aI2a5JE*Ci-WmHSz0dUwxK)|Pzx@!Xt$YSl
zbh%#OUw;S`Y@h&2>vX-4-cZZKP${mL-sM&gN*{db4XHf!pw8I^P%9N2BtJlb05al4
z8vpkH>1md+XZZW(F{Jmoo={8gVvz@>R>PB^gnxmd6x8nd@Y)FyaWJ<9ytwrZ6e~L*
z5%B|5qJY|>trtLjBTx~l?8-BlTb9TA>T8v>T@Y2j(po?9Pd$|O{Z@LKawt!FM+omT
zXw=;S8IPQ1OTMK!PxhBpt555^p5Ed6A-#(M)Zk3-3T902@@9fnE^6Iodl*{3l_aI{
zZ~vy3-o@5(phP;o%k@KAKw5am#q_RFP#ZPih2y`ph_tBJ)}S_Nz>76s(m>6;Za1#<
zhFT7W5@~Sx<qB#qain$rOyl47GmZ1OT6(9|Yc|fl18JQ<CjXH2H!lzXg}8%YzzYjd
z6#yOx*j_0CN;uMK{?OF)VQyL$Lt5v@j#~jQUj9pqc>Q3qqMRC%-rMg%ArBfvz^a!K
zs<#KGS7h>gIc_0P>mHnqZh#v7Hv?WcPv(&iXNvj)%8`@n<az7gfQC-eJ6u1ecex6r
zcg2dNcf@`|<Wspl46V2MTc&^-37_@SyX0DKmxy;<OzZrW*7+f=`3MiZZWaEo)-4BW
zRcybV#t7=K#=c0~&A`sUkls-HiJ^oYR8|~(46f6gPb;K%#(n|?i(~9Z5LNpojq!iL
zi<nQ45H90Ny9n}c?VGgL+a;3l68n03x9g|RtJA#G(?A9OBaj0?1(YPTfI==fK&8=*
zPm_7&)tDEyGEAPWV8Zxf@&yH%$gWt9^p4oi>0PlrAisk81p){U+wEa!{a;c6O5u9x
zUGgorOC;0NI!gsQE_NIOwMXC`lb2E`9u9b+IoV%PPVEy|HE4{22jsEX&(Of&NQ;IC
zRq~_Bj>5u|^|?4FuUBN}jgSDlqbou(y(4z=VZ{tP-_L29r_-F%TEFr49b-sqz0KdZ
zAJk3WRw0vS`MaJu&G0{{gI)UuUTt*oB{8ITIS8hAxW1WOpd?@4;rkJkjMKYZKLxx9
z{09mt5FgZ$&tgpPa(x3z>S<x=UA`Y*+ks^|f23(1N()b8{GAq@7M2b+0Hj$2tT_#?
ztMf<N_Zw*e5WOIs5Id^>q%|KAfVH+J^C>$@cOFjjeEm2*jej3w%YhP(fERb~r#ZfU
z4|2=o^HSoI&AIrQtY1v_;L>H{c`>=1OGonps1tYa0lO*#W7@$-%#Dv2n9?{wz5i{Y
zZ|9^jUPx;`0P6T|KQQ?Wmo^jU{mDPMESXk4pIof$&9wN(<O9lfOizAKQjuc)1#-+}
zL2a?grYhp1wl6`M=La;e{Q%{)j$4xxRYdB8--5<B{-kxjfpr++9joRyJfM-IW3Hb;
zAuE#J;rc$k%ULwN!}VQym$zVgceMnlesJbV?+O-3?+AU{`aiuZSSGzA^i4@cntytq
zGZUy4mEIBh8a(jUe2j5!`Zw1%OeI2U>0JS!qWo<RREBA8dY9|_^bSx9!u1_EJ9hYf
zg1Q$}HZZ1l`Myo>3Vj{$!s}mJ1gNZnILP%Q#6cj{A70k{Z+OI5B9`723hGC{hs8#G
zTI|cLH<K0Rq>_Tcb;aeh&J&<k5C>>zu*3C3TI<OYcTg|4iy2g2s-<^1Gp2XAegZL=
zK+XYmeL<FjI?KCGAo}5;k`ZLpClK-RU7F|XEt4IE#p^)>72u(QH2&>3-hf(?;1Pp&
zX^i*MEbrB&f@;2i7k$q_75%|i0^kve>`T6B{M*i?WuBZ4s;3!Gfx6{s*#~66G0zIB
z4d$kSI&(ic(ro|RGcc5~rR}r_DFwR-JQ4vK8|XOkPVC*gH0RgTphFKE6rf`Zpj2nW
z18Qq?K*u_H=IW()v9}!HZ<)emqgpDQ*7<Kv8aSqoxxP?HGd%EGF%8tkjAH@~32IGl
zQ&p&MereF~le6sdYyO5`2BjC%kGZ}u0I9r{W_YsUS5B#fUV2v;BZ$S5)_jafFTG1_
zBjanPG`EIdDf}&s4E5#>zx4Q9CNkEGH2hNKZ+*y^wnLQx)YQCt>*X`XhF=l<Epr(f
zekJp_9s`Zh?PCsjaroBDXvT(L#r!Rk92x748h#b<x2|GLPwTc$+hG9KyXaQhjtVeq
z2FM|4yEs501M23lfBsT|vEf%~iDAR9iW1kCMUz|96qLemrG3Aj*7@T#XaJD8<zy*a
zTJvF+*DPtxhdBaX@cnw}H2IiXykweZz>7;aL2btuuU~?a%m;AW=-IQ$cIq}UAlcfR
zuRlX2Zh=}+ZvtLSe3sVv`*k7M!0fcnkDxv*BPgWZ7;TD6BhxzXfdZKYG;k{oDjt|2
z#e?z9H0RgvK?4z;=Uy96zMw7=APoxrfEQdKnK!Ut`g0?#^WSUcw9eCMo!{rAH6Lf3
z`!eY-s91p&vG6&9;I!5QrF>}_kHbLWtMGTSwT21%YcS`@<T4G*dbMzn#1c^9rGTX<
z0L?I@1*HY1Wh8<Xf=fA`w9Xp{wJ#0-BX@=aL9O)<X|`pV3=HMopjyxNQ5pk7kwe2H
z4*u4O3>*HZ?K%d^Kzg8F;$$OD)%wT3(js0fre&OFWMD|k5QqYid0^|_{094~`NaR1
z6B*MQ|NUoRV5pY@RlVRO{|+)3mS%Y1-Me>bZm;jAe{=o7RKlCK3)I+5GdvLRg6TKd
z9;GxxP(w$=9GufYBeg0I!F@}S(ic3Sk?S2I;IzZP`H7}HBS%6JC{%pzPUhBDlDZJ3
zm$vXs6et7er)6K_OKUvz0OZCU4<@^7YY03@V*s@dE~QysEagaJeKfgVTeF@ARN%e<
z2L-5=`X;UO^a@7)mVHcV{JS1-@Hd+?2D~_O7gQGQIszKbOYZ}<i@IaqfO>*yoxk3I
z1k}<yoEg)0or5U=@tL4`8j_<y%AJ|hcAWw#0ZFrfnwOm?>OtKk#<^)=!{4RtItr2p
z83{_rAWbe@tl%~zOX($W;RJF7TwNN(9nPF!!+wLNAsFX&oJi~Z^)9XR7T9T^Rs+}^
zJ}$61lBM^-icbW*;JBCGSC8<G3%4>@g-Ge6G{ch}Cm{ZLm$vIXlAB5)W|@Oka+cmy
zOYf|6NHaX3mfqp!1R|V4gbRppO;6+BmHL8{zd4l=WF^>(P_MbZQA_WN;b2Xx2hE#-
z>q=0Qi}S{Nu)!>)pkxbH<NzLkc@NI7YU$k(4rx0C!R5uR_aH-?e+rherR@{~P0&DM
z2CU1412T-pc_OXz7Q{@+(o1Q(&Vanq`1=Yo|CB>%%@6*i)pK4*+jR((%Aq!NIY>i?
zcm%;(4Zk5fImAF2o-Rf1Leu3vWECFFDDmEL;$52INn`~s9OhsPIKcs2&%gk29%t!o
zm<t%7sR71!U`*@0^$yNsf<_EnfCV~U&NdgKD6R7_C?&XoO0CitY0b}=_*=9=<@2u8
z7aYaqAjd$OV`)2OCdcV<3Z-@4@43-;>+_Pn8(_)K`;!~=RO;2zJDru%3=i}jP)q9;
zt6>1isimiN2CINX7V<E{1e`VCQ9X+xZ9lj#csy;V3^<<drS10w#ZFpx=m(fBa5a$f
zRc3D5PVgw^{uU&allApES=7?IohLi$i(1V7-FIAV@gA5Xx`S1qF6%_NtUFi(<TCJV
z>OLKi?Tq&(FVK%>nsa;dUws#^ho93TAa3q*V@!h<OpV7_m>C$-IzObRX}f~Pa9rQ;
zcL*`2e{+4o!QaBk2rE+fTmFJtw%{;KnA~X~FYl1n`56?@OmowAg8QD$KUqrI(sqI;
z2|G_r?l%xsWln28%mhx;T&3sXq0|iZMz`Fz!;Gbpll=`P;$lHnFw~&^ph4?2ka1Fw
z85!89b>|K6s4&<Hh)=rN(mP#WfX0a-1K6Nc@dB&}G-$w8!Ui(-_2$VLhB~^CVlFKp
zEn_yg(4O!)Eh;S%tRvus<Il9#1N<%VENPvGL4KZm&`_cNLR4Dg??+J#3`GiQ*$4R2
zSg(M}Q_CAgf*>WJlD1Sj4OHk0vw#XLNR_+&8>lXO@lq7jq5w71-rF#jf*Kxr>D?1R
zg>dt)EN}sw#=!8JKdt$IPMYljCI$vj$#fvi@KV5w(r>Rd(;I5v*Rzx=focklQt2L0
zU;aQ^2Bf|?nYN1|2UPM;_?Q-<m)_;gmbQZ#6ycCSNaNpj5ISnDm)>2?q?g|9%>tS4
zfQRG{r~=457hL!Rs1|qvm8*wL0mCE>4?x9HA_WwFAJPu~;7~olkk)*H5v~SYPVKtF
z49eo2KMuZNPV)fg{N@vk@6-6VUrz&#-T2)Jc%g7DtrIlW>iZ<k6BLt>L35$^8zk95
z(=BP8=MTPTPiub8bnqo}TJuAPG|r!s>y1s7eXghNU}I%qfD{Pt({?cNgE*in;yoz%
zm`lPY-!)c~XTH9H1zM&+YnZg=6CCe0utGFWmN8LrtY%8%-+nwjt<&{^UV3*iOB(<7
zV<6rWy>xI>`<-5Tmoo>bDGwQ&NKb35eF3iJIr<Kyce%cp+-M@l^+Ij&E{48?YMpYE
zSDGl-zhfv>0P*a+82S#Tb$$R<cK_#s7cm@6+riGp!0_5kFTE?8z3*Te|2A*|_y9B$
z@mp;%NC&uI3NHGefJLF}9}a@*o5cyB+_=pZROEpMp}RvL1iaXA8a@)W*oPrN@P*=)
zzJqFulNtIBg3NM#KRMJiJ}6-dv>m{C3Q}CufV%$g`AQT)fhJI*0irlcSV2u?`<|2F
zDZ5<>6Brm?OTl?f3=FS%;Jis@X5KQO7E}hqOi-I>4LEx}e+L?rNy}I;10;4DEOz-_
zT4Y*WTE+oTKFYWW7Tf<WEj}#*oEqvr>ZL6#nA~V4T@RXf`N6}$koG=p*B>4RhPQg%
zVhuAa50$EdlE^NY)IX?H6G)1y=LFbCawRi19ER3wX**b$;Hd)Kgn&$p?KrUE|9@Co
z1*L3=Fl4^W_JGfZ68^M|CtwG1zDtXEd4maA^HGFmke!gcrIxn%45$fKFay+HYCXW;
zx|m5Xt(&i8a*DZzCBzrDCPF3RwrfTCr+~)n4}gc_z-u!;yjBGb6!S_jFf^pWy$AC7
z<fG<M^|BG5?9TocwEW~XA9OVEL)vZz28IV97pSFm%DEJ!?chQx1t5M&JNQ5Vl#<`5
zr7iX;f}~!x#STSqH+vL;vhbU<gD*tV0@8xhGMvD6&3*%J(t>Bi(<Wc#6Rd|Yp+!vR
zjkM+yOt1h1Pm#mQ35dO*@ov;o2`>Hsr2qkW8!Yu+FKyw4C`dsIYPf=2{UmKSglQdH
z|AfDJDT7{mw=)Z<%m-ytHdwB_4{ZZ5%}wjP0BX(N2zW8^Qd%b{-EVh&k;cFNAZ$4f
zXecp_fBgrLr*8zj_<kN#a=%Eo41L5u3A9vUoA3Q}OWz0llMZrREair%v@Cs7tfHlt
z-pvf25e-PoNCSsa?rTtT28BPU7Env?1l4zZFM}qZx0I1`C}dzrb5Cph4=S@?-vOoU
z8K63*_0nW6D>udilLM_}>l@<1nejjx=ZU^UYH5oPq=CkA-^74~cY`EB&U~W>n&klx
zz+U2SX=6+?JfN4}-2tjgz;l9@r%IE+Q%8-*L0uTofOqW&z4Y!4PasYHf1nwy7kcU4
zJD#O6fX4HmK!?pb>Ot!D(z_<S0!eg)K598xst)!KWUeQ@EA&a4ms)y9Fym_{q^hd%
zB_kt9+siZt2C#DeZJ$6ceE}+{{(<@ipaQ4#5ojb1yl~0`)aYkS@9}+--sk!xz036x
zNPtNSTvdUVd31-q2zU{H6x8Sf&BD2Um|SZusrUreWC9ufK`*__L8|9e-yx7*PO#AA
z?beEnA12?lR%QG!`M<Slz?-z@!wzXX4uE`ad4s<-;9uGfa6lPe(o65=X#Oc&&Xcwu
z++Ml-JdN`g#8V40LG>@lC!p162{XXM9ghUkcKn`PZKJFCh(RsAD}ptRe;a5*v-Sh1
z>1}u^J<U4wLott9dY6nq8sp70r`K;MU$;>eu805?cnqLoC!-#mPUI)^+j=SQ1+&jR
z2NjDTtI`g>W>M>ut3cRhJh{eJN%h}9uq-%FsiiG0m;oyA7qKzub%`;7W`i%K9el(&
z`KYZK*I9=2h6({j{`Mo2S?!ec7BV1paMK$q1sFiX^_|Dk8!81EN;CsraGzVjSdtB%
zYbs5d>~AOO=#<_aDH8DF-q{t5C3X-AbJSYD^9DSVgIjjc{148tZ!Hf`US{V~|BSU<
z5wuXvkrgt#yO`02snq4=OBPU7!ouIWne}BjD~Qd--|~v1TolCQ;BWcF24ZmXw+6Gl
zJi-oQ3-Gtx<Nz^5`CDu`Uv7a!a(Z_G6KDu8fCV&Tlh)0Ywi6t>wqZ`LMkQ=%>^nhO
ztnb+5XnT$N8=%k!t%2h_0cx!~vFW8P^e6%|xxka;%?Fg`g2pZ&%MgF0aoz_>R`Kbj
zb<6n_r5$`NpqAblC6u=N4aB6|X`H7)Dx$>FcK=5cl1kex90|_Bx6?Rpf>fn?$)z<O
z`p3WkS{ld)>XLWMf%@dPOH9(TPx7TT9t4$VY5T#X<@sW{G|LOcl6vXg^3A{hmvDhR
z*eQ|Le1Ivf`8eO}yP%ZT{8OMr1*A+qE&Ha9UV8WJ2b0qs6eIUTGD>>415<h@sO{eE
z`XRl$0KA|uLIPBhOGScejl?IQ6qnX{qu~i-zze}wpmOyEsEsNNQez5MWBUZOr19lX
z_B8(O_a@(W5M^|j{MEsYv3s(OqoQcZDNu&s-+nxefBhj?K{~n8(Z1e+Exp6_320~&
zlqV%YdGZBlg^gNzhc{@Z<~>MQPA_etPf^29#u6t`=?fYXFMW{Kc<ldw1_r}#pizzQ
z-#`m-Y+6p1x<ifVcHja{QSa1eU|_Ii*if39wo@InVl#FF2gpbnu%tD3EysS)O0C!4
zX$N00rR@SO;7T+6_F4+MGPCnq+AeTz-wCQK(^|iQx+vD5S`tzS*n);D%jMFVe=wHI
zy%vHN4G=Bh9GK?tnk{VyNL6|tsB_)P4WT=NCDJ@>KyHyu>-+(trP3Q}pGcJ0l`DZ5
z{3YHXN+A81>pO<@W3KNRN(0jNgZg=!xL;d<q$aaCD_VnBrEU_~!0}ohvL<yC*9O+t
z!U$byhW|k!WOx8-t+PC+I95pO{5d(nS=-_pf6E01P{J$LNHhEfX6UG;cNQCfMm`>Z
zSVn1vCqdC+3UZ?vNV7Re^I>Nzb{}xut4?NdQ4sP6jj-2#Nbhi$O+V%?<NxyUWHT4J
z`Z%zXa}PjC2oyCRUbZlSX>f*=NbiaeY5v8}-=5FX@SBOhJp-KjJOn_p1x%pPV{n_F
z^8$Ff^T0Du1=!)t(sH|WQ(E%@`?P~U*g(U)AJRMB1zyhw8;m>{E>`~&ECwp(nE2bd
zSs?9~z5{CA&>62Epeh+M5B%m>S|@1D0BCUDL7?S8DL6TTr{V%6(m<>5nh&w39sI@o
zn%{=06f~R)8vWtl9v}g3eAb@=Q-;UE%?40j>hutp?Byy|?^6Vdf$tyFJKaUnkGsqG
zGrXM1jNy_<giCxuE&-c%?pRtUXbA+wO*V`rCM)XsTlJthHw|n#lFLBB<{*;Bzy3IA
zDI}<abpFIk&f<Syvpyc1tmvi~>-i6E^};<2pib)%Q0L`<UV0ZpTJsAw8^&@zNT3~e
zknv}Jc^MjCT@C^^jQs7>nOY8%Mne>&@o$R|40!SMC}?24jwx*i%jAoE!jsp!39|(=
zr8S>anCx#TT7Tkwz>BG1C3+wwpuB@p2|$LhS16RSrR@TxZ;06)0fOlu2Qa);Ma<_y
z9sG<D)Q$qRYV^{(JlN8jU$Hg(V&rd=`rq)AgTGz)Kg5WJ3Q-3B*7}`{>0J&YpuQJG
zIE{aMg#@Jens)gCxbMin&Gmg6<Bv4UL;O8mpy75<NeC_$L928i(Hy~&4i176Zcr4Y
zfEEqCW(5@$UTK!!`TLIjN$+!gp_ZQ3&7I!i`!0=t+fh(K`6Mmo;7b9}tWO%_2k4*)
zXmAiTfdQIJc>*FpgSy~B^lf0HYW~2~^KUy4@WTHv)Z|X)G&iuan`t|BKs}&cn<i_!
zYcgs4nH=V><^Sh5JYpB@WJqg%zz@k99qxiJAN+>+y$h7EOW6LMC{cJFrMJMLu;oB$
zklq5v!hZ)!y&y`CI|wi{zFhx%@_Bc4M{px_C#dv-wWMAaLyZDO4&!Tuw4DlIr@UkY
zE%)tq{Sfe?<37wJ8HULUa?+D0sIWVCImp`Z@VA&Sm)F~{@wf0Zm3xD#{8Ywre$aw0
zD@Ge8{?>~OFI^dJSomA>8Pj%d0h?O`8Y~B;WXb!J_j^dz_w(3r^0zoKmGj!L^S7R6
zOlv;%|K(;z8!rA<J0`SsV9b|ng!o(Dag-a`@bkCaW-6Dp;pK1L3vLVqi-0nVvqZoP
zhI8p1&N45}cx(jHyPReCTZ36&-ea<n=5P7PRnBiC%->SUWh2Gk(!%xfD|fw(41dck
zZX198)|cF9*3J9^(husBH9xBd&0sY@tcMI0_8n5|66<70YktI))_jVw<v=BK!?}jE
z{R#{W3@a*1h12$f=eIgP*sztbrR@jJ^rUtE068nI^8|8%c3<Qf#M#J#Jd>Y$YSafF
zOz(6SdFjUuYC1>DH2h}gZ+GN|jTJ(dLh!ffad+GV6-S^+1CFDRdKolS5&9wE#p1(#
zpu#5fgIcGUA4A`9wGO!?hO{71HD3%a$3Nc$cj`dV@#p}^hX-GR=Jc-grhS>*=f$ba
zaTHoxcA~7uJA4`BCTGEb7b^}--sNQ?xav&Dp)~$&M_wzWfo86Jk4*mWC8zV10WCm{
zFQj)l3$`365&3tbG&{Y^TL84KoPi;&`Qc<AZ+WJP`zGglOBk=%2g(=!SV~{Kyv_-C
zK){O$`_i1#nt!vDzJ9r%Gi~P*aC*AI$iVP&{^Z@>@)Gk-fhTgioZ-{ipb1ooYm+~D
z>#}=ug3?a>WHlf8dRr#2-3K3n#*a84<<-j+Mo>aL&0r(I-|~mShJ(LVj0rNj{&F>g
zjRb$o7RGW>8&Uq2LPi^L{+4D&P)ZVGeEES9l$e$>f)dy%MjJ`~)_aVQsiHUO9nJzT
zcYyYJY;zW{5#euN17=S?;v=IdzZVqo#Uh{qInchB<7(+$B65)7^cw*$81_zP^p#KZ
z;s|&#c~5$Wv*1g6klyVe4be=XW*}(IamAj#!)oarEPUWGRe{o15C;dmh=)kH3B2Us
zNbhnMfR<FCiEzl=)4TL8XGstt@p3D}<lnwB0?V(yY-Iq?kbiR)U@TRdyv$d@CT>sK
z4gv5C)9u|Y2P#<74nAZ`>pYd#{D?no2WaZ)<vqxnN`ZhEZF@ke@8Bze^p0TBm&Gg~
zQ|+hhNsD}G%?@z`c>e6AE<4Q3g53vRuy-7Um=y3LaW|-tYdKlUeBcFBdWW~b%RQ50
z{3HdOuBPpr0*>rzCI*I=CnmT0Rj?;Cf!eY`lUe)?*dfzi(vz+IwfG_8ueO5{_RH6-
zleq$97!xK>^p|GbIC-tVEMvmt)Bc8xk(2-WYqEnzu|NwzbOXehKAoTJ7GS}6e{y|*
zBV*v?g8?#jAfsMe_nb(B40jpASdE7mSY9iGc|{BiuO&gO01%5GG?+XMoU`06PnHf;
zXOy1o9H_~dFgZ6+8RUvUWu}Cp$$5bilg|ZmWi+e<wW40uF{kZp0ejDdnStSD95X1e
zY>fF^q8Q7?Z4CKaxEO7W_*>K&Z3Ie8Z464XU(RN<G39T`VYD&hZz*B4G2w6RWQ5lh
zU1IGF;BpJJytVn!zn9jN9fB<DpCD@81)U6OoyXO>#5x$#I<JAUvbPMVH7?iilc_|l
z<z%T<TJwYawB{2Hpn<FAXCKm<&vCpq1q*f_Piubm;k6K$(|keztm4rJ&?>{`bDXaQ
zKvS-Jz#&k2F)cDJ0_LpApM%`kE<Q?Ye#A7{KG@m41nl9B%%Fk8w4Etn9%#%O+_KTQ
zl77rtM(E{6#<ZOwV5$9}keSGcR-Uw-n|v}@jpGs6zSIkozXvM_I5MW~bOGyOW?^7>
zsW@3ZM2|6Ha#+a3`XW${3kI$J*j6ml{ENLjF|G514O4j(NZcFTMg@)gZUgO?;z$Fv
zQGW%zD8HK4dZ5BQt@C5c$x<G8Bem060OUrQ*Rp9lEx^`!uz==GP|C^tOGw4~p~*3!
zDohiePu>-3#?*fwL@~xq{urvwSTR{P%!l#m=B%&^=E;vEFK#{%RnIcnIbMb}Z9>|F
z37Zq+quD3#P7?<8Zt@uz4lpn<yvSx?NM~SRIFrr5up^s+VNEszsL#uw!63=N!YRN2
zTJ6e!M=hv}6o5tT3aGg~NaliO62NNf(G13>n1z9n!GZAv0}}@a*bxVyj_Al{U`S?Q
zV93d4V2H?OVDQOiU|=OdEgJ(PLwy6&2?j<qgFT=I>tr)9NMtiG@MJT9R<ALDT?}&Y
z1_p+P0!XNV9Gu3$!0;i9f#FUT1H*+Z1_oXRX0U@<K;|xBV1POJOcun!8?qP}=43H2
zOvqxWXW(OCW&k+?U2zXoaREXx13y@893vwK9|OYzgd;#|7c($0gk&)=I6w?$5P+&>
zfvSZ?9kN=Tta`937zDwJA22d<2!IVnR{WTOfk7aPf#FXkM6D21EejsCI#5RlGq8X|
zf&&^7peZE=W(I~InUIjUW0J|ha3Yg|VNWIlLly%wg938|6E1^6BWPfQH`iwJ>noY+
z8R{7-7#SFu8kiWFDrf|yrYLwMmMAzE<rfz#7@F!CPF^=dn!`lbP%kan#Ax!x8Dhfb
bdIq`%y6H)#M#+g5W~m02CMlDD&3Fa?uED`u

delta 15269
zcmZqJ!ql*Z$vt$H@5>3HY7FQgW(G*a)5(`XuUm|7X6vOA#&?I97+MaLn52cKbv{iC
zPU}3Jwu8Zef#Kij67z|+a!jwqC&r0qrbVa49%5pEC<+59JC@dYIj!?ldRn(HM|zhl
zPujs}0%`o)Z>Mp7PBZ-0cT6p<Q;vtR;U{AWZ^KXK5}uZmC0rXMU$brCd(E^#J8h=}
z0|P_f!88xGMJ*tjf7>OsPO(;o$p<+_Ccfrp>vsK+W_fVqUs*=po(p{k(snSkGccre
zKAWu0q^+Zo*8D?&f9ioW{%r@+I*-puyZAh<`8eC$w9dnG(k?zuV?3PJe3*6aYo4_I
ztdonFO4+(YKcq2UoBWDNi66w|ypW#O9r`AXfBm7!qReV0-LW6iIB%q<b=QK#j;A@K
z%}o3LFOBg;TJsT+wCJ?Bw0N-h_0qb<REpACFY&irnViWiUq2t@g7mab*A;2a2iVgN
z{$K`i)}*I(`*WnH@o#tMOHb=AU6aPY{zH0NcRUMNOdySa{b7*dj33e%FMu>`Nbhpz
zv0>(K(PFY;;cvOeWW&VYvX8OnLR#m$Icd$uw#-dW>nvRWF{|_AoV0@vndheQZ?8X)
zcJKiUNO(aSBglr(4FNAS{-zlo0GYZZJ+0dnq=^B<Tan&SJD<Nq9VFRMJ0BE$bJ8w8
zNNYa8HkW_u;WYkjx96l~-)4q|+zwU-28OiVU~(5D0|P_H&9uvp(mJn!9P}UTpbf!k
z`@k{>(=I<t^8+P?4QUsDrl)oKPD$%LI46zq=3I~)R-|2i0g+TZF()ni05eF`cM2#7
zW~QfouiXH0-wd$Ij+>LuvMAQCNKfmI-H@hu1Fk%FN*d#hG>G!F)^Ge%52mLz*Un(z
zpL(d}Vu^fO>wyxfwB~<I{8JC6HUD7ZpL&SnRH*=14O1ycn&G81!;`N$(!f61$dR6A
z89D>x>w}M((kw54k`m{MG|n4ome=^F9!jgf_$UpWMoO2Ycet1frKkOO1%+nmn)EbA
zP&_o(F5%#BZTa`In-LyGX@<Ac)A+ZA$P0me67VAVPkLG>TbeV7yC#kCSX%RMj?z0l
zptR?^1{8&9{M*41nAZ7zPFnNvEpyX456wwq{57{8q-8_E3zy$7wHZN%hQrJh_><Q8
za!y+F!7X#sc5yH;fTETWlmOPGF@8+*D*cew`FT#-!N<&VdoHE%Z@-jw@DWQ|=ZiUM
z%?Gy3O=CQi)_D_Z_KRPj#ON;t;(`+Bi8M`!R2t(Ako};fbo5u+Zcqe+RJzNgSsv!^
zox=d)AZbfa>vm@WrD%{VHl#6rNbCF*@S^)yn)B-uAf@hdAW2YMgOd9pkWje{h^&WO
z{R8BN4QZB#iY3xIKg>yMwmtBFE=X5;8l&q5kgLDnPHX*EqLkJNN?f6!{N=hK;D!1x
zP@-du-2lqXYtk5Ry}p^&d?aDAfq>*>4R%qE=6@We;w>jDC%dw{aCevTq<6Z0NbmH0
zHhC($7x#y>gAce>85GhwKTdwmuEN<}`z+nE_EU-3WKj+czHZkyX^e-{)0$mhD7-!}
z*@L53R6K153j+f~!!PC%g>SdgBoCxDA7GmNkwbw!JPlML22B>>RH`pk>$YoUX#USp
zmYvpl_~2`fw9aE`&Cet{ZlyIpQb_Lz{hZeMDV;0ybE$V)^8@*`=EwGF&T0JHzk}nx
z`4A(><JZy-{$ft+ya<Zue{<6;Z<Gk8@vpy^cJMcITIWrW=>NHC2On~zd8P4hyOhRx
zG2jLB|Fq6SX`Nyx3=X6<pWu3*)_EfB-~*1d<`dlS(;_AZDvJv@zu^Ft?)=-prNf7S
z7yJHAE>+NF>i;)+iGq&i0Z>BoeG4+?;3M|NM+}T<2Olu2GBBlaf>PzhwB~~#$8A42
z`KN+5liAnFYKoRNYX2Zr0yqdd4yWzA#SAK@KfOuYc>v5h^(L+Jc*l)*X}b<GGcdgA
zIGon`=}lVakF?HHlUcX|t<QtPXBS8pl9u!i*UxF4A7Gl&zF$sLJPgvrc_Xd!)VuU9
z*U#_L;y|9N@4O5uw!xvi>o_w5L&u4CX|4ZDRMU2y1liYjOf9{G`3;zIW`xpAY0Zb3
z)BImwLn_)K-Uv<$O6xof%A)++yg}93fwU~fw9Z#^(wYzboEz|><$qdadY9|Z^bTjy
z^lsN*ZS@b*JDnv!rPZIb&Ntvn0%8(4K+?djE9FS*Jf61e1k`n4hk=r_bl-8c^e*Oi
zYUy3hj9`-K9oS`luODEzEGWGzKs3E0^ly51fJED;^v=+KJ(tqc>iM^MfZTZq;m*Hv
z171}BPm4r#4=9BOf}?-?r!;7I8y-m81&XD2;Ch?!UYg}S{=RO8H2!U;doF+rC%EUo
z&JB3c`7bRBltx^?rez=S1+hZE)u&}%nhvTcKouGPw$Sfs*_UMIfU<1kp#}y9hPi2-
z7t#*?;7Duy_1~U>p^PnUhdrp&>Tvy@-r@Q!y~Fh@HmmmhON&Tzewp_l>eLMiP?z?m
z{Qw6IxG~asNKZDsi=*XaiE`QwP&ox^XvpcMcR8`yaDZy&$;sR<j0+~O;MOq?OzS)t
z@Z$LYmII~g0WYF|rF9<KAp9=P=}mfv>+iJA69F$$ex-FD1o_JKHz?u1)}PGAqs6lm
zRLFvw13%NECU4Xdt_KBTzzc7XK_LMz?*B~dJh*`elq%CY&w;8&#<`#rp5Ed5X#+1r
z_!G#Ek7=DZ0$!X2DF@r}36wiQtk92XoEOp#K41b{^12+XuKOP-s`j5_WMD|!!3GN7
z&R_4-_MK;BsAov){PZ@h^I+Nzu**Q=ouA&Oce;K`+rbG_2~xtp{X-i6_Jg2uG;Kdv
z?aZ|A|I_%_AA|UFyXz;g99Wd`L|PO$U?B}1aP8fE&|q#_^AFB4aVR%@Zd$AGr4mjk
z*L-do|GtASf4!gV$$JqTF6n8Vp&tTXF#G^zYLI`0K}CD*hcy26$J6$MN>7j{|EF~x
z1ea1gX`P>t3M$_B0WUQFwj3y_1Bb!hKe)mG5(J>i6V#A`#8CarwC|w61vLchLG{T8
zkX7L7;sZ)(LF5iTU<S$m2D<<$+)jW63=g1&2DoVq%0Zo%170|M2L~Idebao9eQv-D
zq3>y($K=v>gTuJ<1jJlO*((e-E;=o4G9SN~;IjV#FD(DG94OIA>--S#;_UCqru=Hb
zh6lg_4^Gi=i*|#X$A{Ir<-8cwy3KqT()hQ3OXJ^mGL3)zM^MsEV>|$AQh*xVpelfW
z{pB>qOKF`K=A<!xm<wt|*QW)8i&6e<HyeJlmuIGRUQ62nHuZqof+Plu8>QAAH$f$7
zz>5k{j0C*k`UWbeI!~nSWCEolXn=xaiZ2bE&R|sv|9hBGX$PNifKsvR=QPe^YU!ON
z(gA4^VE-`3r^QaT7SQ6A`JJBD>C6K5a>wK%fk=(-Eakj5jQlMuOg79VQZIL~+OYAr
zZemUAywRKX1*|zfE%s%{`^ldL4EQcEH2h-WZ*gR7_{CI`JK0dsf@42B$bFqZC+7(&
zir!9hOKbkeQo8b`9Alc{H?TD~Cod87sXxvDYU`$Ty1oI$`I~?j)&D?FbrwqR@_mzb
z`A1sw1ID!PH$ZKXV43u^?rN6ww9eWW>D|>*2j4TNch)`uHEBMiwO%TbPutJ1;Q#-=
z;~>SpPtrQSe_oa51*&;oq%r<`eFxM)d;@B1zF{ey^x7Y!s#p-z@c9UeB*Xt{oj(Fz
z{GHq)q|IdTdh$jgb;jM3ZwhJK!8#nBr!Kw%HP;{}@~^)R?$t0}2Q{;6KcsgB^ECWo
z=5Ntw1c$|YP+0J{^iH-BmXWdOI{@<D2etGrfiy!<m*`U(Jb(&?C7B<;{5QE**dqKW
zQ^P~X63+CrM%NDv3ZRx_bL|_(QU_3=86JS>N$(0_7D{V=#F*CkGfnd#sKL*9EzKdV
z`3Fbo<Fp+NJO2L%TUYxbt@DFgdI$T<{K=9cW*o5})Y3bdUm8vh7qNANc<MUHFCRc5
z`UF(jDWvTO>pq^=c@ZS@<nt;}<E`8GMS2>e?~~WJ)6=?xW#FMu%rg19h?+d8r`5~|
z(+cWCyh-c44+{G<#?P-GOqLThl7?7!JS`xt^CPGs_yOcj28MtanJ*@1h*}GF$AUU_
zhtmQe;xA83-YBZZSUdTKsDo`LD5jicK>d#o>D|s!>7c~Y<t&u88x-B32>rlN;?j2*
zq|EnCTIco8tJ2f{`+i7c{Pg<a<Nz^swt(kp%}0198!*Y#Yk*6=%b@Phne-0V%dkA6
z)-AS&q4iQpWg7qXUum7cpzZN1a|2#P{!Ht<k=Fd+M|!90Barvbq<8v0Nk8WLfDuX6
zqMvEakJ-~YKeQaEl+;V_a%Zz)FBeGb{E*iCpg!HmMfMrUI;r$7*URZ0Al@<82TVx%
zlP4R9%WE7)E&)JJN;5prda1-3l<uI4Z_EvNv37EaxB~z0A0R8!yIf>nr8OT>fD|ar
zZ*0;!&%wIxYTa_J3~JqcUZ4iUFU#}%%|98Me+%%pe_{Z&At9X(kS7g)Ks<EtIVe*-
z0=b)i+X4RdhrucDe|o3u6U%$W&QLdibmaX=Gdu~(yj>x@&sr{(@Tcu>V5nzcNW1($
zjq^uZ=k+wlwC0~2r4Q0OTuhIElK+!5hcvg>TR|p*ibROzN9Lw6-T=kz9&o8}`gI!r
z_8VyjUkHH24y5;l?t*rvj?7I@v-I6lqMqL8x=Ss+OEA69^#G`CW^t&5H_a`r@gD;t
zgDOMm&exJ@j%m)XFM%>z=cf)(=e_nodROX!*UTWH<|8)XMrrdKowUwl=^ef&(qIMo
zLTE4@=Wmt-cj;U?0$ymm2D#)yTIVMu&wu)s1`Vmc!)gm#K_&kWP&PUPD!gJ(@UOp-
z-WmHO&G3JELoE+OrHEd7mm4TSaHlt<^3<p82elCx(hR?Wg5?6tw<prmEKASu_swHS
z?{fwB%Umz0rFY2~fC9Spe<@GeE>Lp~Gz#$A9ui%UFa$-%g>N8LJHQGq|48HCb~&vT
z+-C+Ap31H~=>{&m&!ACq<F#U%N#_Mn@!EO=)USrA=|HHt53&F`ffjsAbDL}}rB)B=
zADv6@VgNOu(z}8g)4RNx5E;pC4@2w!l7uw=?f>=CyVzR}lt`zAfhw`IfR2mlU7?@A
z1#JkZ^%(WqGQG?7Q^1QwU(z}c>7{qObEP-baxj!g^c?^t!GjOL6;~;=;xc;8)pvje
zWYpwmQvT)@0-(@#5Da+n_B|+$K7dMqLJ3ewCY_eWkk<LL;}$f|KFkex@fKvG-|GjH
z4Va`RYfAGV>7Rf_Kd5*`(LVv9Uu5!KX>K9@Z8s5_2$U@yC;yTTXN&j(%Z-z>W%%kp
zf(G8wJ6zv^Dk_2WE>{syupxp=ZVyB2ZT^;iP#U_em)^zPa-c-K<07~Wx&bP;;FYb=
ze>HFl-F_gA5!^j|k+y?@oq-{}q4pC)38?G=wO7-cPbh#|nxL>LeV1kns?}mYL4wzr
zE4>rs5dLkkA3?z+liuh0F0J!sTIcojZr4wrSA&at*B5DwhhE<Y***D;w4^ovwp*Yg
z1=Mu~4^n`<dgBvl03*FK_8G_?R}N5X9AqopU!Y9U`FV1`tO?tjPp|+<OA80Jchb9D
zIY5B`4H;04P$~e|*$qiRb;t<_G_)oFPCcJNUCcOmn27xcH@_gAquZdQ5%5BGvZb7y
z#z(N8^t8@c9*`4bKcz9=2Jtx3qT#w@??bxX;>~Y3K<(l;>0KTY=^ehG(z`q)(>r`8
zua(QF5B;2`c{$A)G@#XYmLaY6Hh<qS&;ZM}3Yj#^-}TI(Tn-(n{FSx~+<H5t*2R~^
zklx|@CcVo+FulX|V_NI~Qf^THFCZ;AE$nq!ofXI*nupWEL3~hSC%r55GbA%O`~w9&
zh@ZxID=j9AF}=(6V_HC3I4B$WzIkm2mg@YGrg<nWJdN=;!URxOVg~C@gX`-2k@o#Y
zS^z{ZNGHUSf<I}^M+7DtFo{h5D{m_8nbvvu_2cw3{(X!s2TC{sUL3fS=J@(O$RVJ5
zWpa+91Jlx<lh-NQG2Qz!`JJK^>u<PzMI}k&PcK0^@JCt}13b_Cm>ckd?|)i!dYA97
z^sdmK>0Pcr0$#X-@<A-9BR)A$LA*ZwnCoYT^lk?c@VHNxGbpe=rFR!gfbz04PkL9d
zKzc{$`_^yiUEVS!uIYWwOyEWoXh6C7IOE)ghfF0xYUy1bjOiV|@4+py=HpCr!QKb)
z!3h?W`-{N2H?8x>>&>7hmQ;EdD3(P+LD};Ia+7xITTny6kteP5^_;Zk!#tpIP*)DU
z^e%>$1N<#Jm~2!_L1PK7py3QiUo!oe>kEZ6!vn7s)A;utcv;2->fablKB=Nm-+4Z*
z`Mp6}=g)?poMmTU^Edo5C_N2QZvaw%CC%_;!>^oDrL@lPput7Pxq9hcVT>Rlp0ws;
zOnT{EVjCG>GpBX_YxtD{DkJJ08h+{Vx6EX$7isvV%HR5uF>Qw`1E?V-aO>p<#)e-J
z{4J{)8h$17x1M86>x{n%8i!(;3yN3ffERCXzC6X)@T-`=Wg=s}dBd*){??U@X`S~$
zc7qgkOQ-EH0GoFBX4;MlFl*;cP`v^k#!TzH@lu?z;a6#iVZ*PA64#eGlUJ%LFxA|g
zd|Fk8CE(9XyUDLr<0S)L{JfFo32NoNc>NO8Uitv;D!zI#Ia$r7KH$ZY8)=@eKSL#M
zfoi}v0WYS$NbCIlIyVh8a1I*70#%rdHpQjUX`S~#p$u^z*dLJe8FwSi`Sts>&d+I`
z=U$saN8BK)poOR`C^iCKn1U3(fd!L{I%o=^lmir~ry&EG2N*#ucvp^>mXj^j<v6y5
zfr9hTpULs+ChYsboCA|*saw|n1hX4J`9=ZDU{doNP}juuPg+n~U|NPrILMS>kYXN?
z7eNU=E%v3sf8>#;Kv0?UA<Z@{lYyb!57d*kJ(R}4P~_b3h=ad%8iQVXmjh4Qu4Bv$
z4Da+N`)O#_dp=H!daan2aSSx*kntpvfgvr!5p2~FP=4e|Yd-P+<z&XR#()1A7#Qkh
zdQQNHh(4z6vWW*diuG|?M4H>{+v(q2KQNW>rtM+?8D@AO;6>GAJx~`*Db4VkUV4{^
zIe6d_)C*qo5Zr+i;VXRs8l~SM0!|v!H#2F<Gx9kUflS?V2UJ$Pz6L5$l!DVb4}#`l
zmPF~LEnE-<$`AT!*_Zgz8V?<a0u7fOn4GGmA#fm#0aWW<O0&FJ%8|x;X!2Yw&3bUd
z?*$}eI!}Yb?n8Q~>oZV`{Z0Be*B6ZZEjdi-Y5coVUvTg@%P<DK(7Fri6Yn|#8cR&?
za|QKz7}Gj`y@9eF8Pj&1Ly~i3f(}@vfd|&!sHJx}GN<i21yZ7xUf<!!0!s1wK*ptY
zo&b%?gNKXWrR_QjQj*^1`b;go!-bnQ4b;G8DZK@1Rd#-Y$*ZMzICFwb===vtxQuf<
zPNa4IdIuhGf@$RfYn3d00%{9`0(jazn6dT7%8;-weGW2YAIRk(6F}ylN3q`=YzSxR
zL$&nIYKJt#10b87K!h`hZ~+mnkbvUkZ`NT183zs|h*e!6A9Nl=c=6yfjx^2>_3y#P
zvXtHe4S8~cS`_cq(z~l2(sl@fd-T8FgA8i^DOk#uwo?c+P6+l@mkT!+NO2k`$h#0j
zBulTS?K%T;bmRXk%=}Xhr8PhJ2O3G+bqJKCK^91Z^)#Ol1P@*qeoL>1m=<EJ3{QPW
z?m|Q4F(gL2yqQsA5Hy@@crpzfRB*qUgAE2b<`cv*oTZOJy@fPz5P(N=L5T#+U`p%!
z1ZJ?Lb;kYzjU%(oeV5jG0~Gge;KBhkI#K!}t@#-fe~Uk;YXC`o&7hY02S}x#wo?Wa
zKKndDK?0hk?77i*>+_Pn8z4u6k}+tIee!Kx70|>@?Hjf9PIsj=!vlQ>)Y7`eY8XJO
z)Y8*B!&N{c3wan}0`3~{INZRHwjbQSI1aH4)S`TowjXL^=m(gMFjY`nkAc#m%-pn{
z;6cj$lZ*63L2ht;qn6(7pafH_ws;pqn(BW>P-Z^<yYIN#;yqwTfelehPwNg)fjYMn
z>Riwe!5ffFxCY40onkzUY5Q~_-Um(1d;s;YzPY|&;cwXtYA}JqtT-kOGzBpEy`Bpb
z$DPTh`YufIcP3Zs%V?!(g1dol_&b;xLHV46zvUMLtoYz>c?UNkcJfAUk;(i9>?v$3
z7)xxylWEO|ndYYL1Pw2zK?Y=-f3lQFf#z30V`96`Gcqu|g(Qtm(Bvr-IE{0ag2t70
zrM}=Su7rekx7@eGj3wZ@7h>9L$H^PHg-y~rZ@ho)4l$tH4rJ^u(6I0OG_c8Ooj=}#
zs%wa$CGu&_KUqpIfi$v#HQt=O(LhJ{4Wvj5NXy6r7uXX&r$wbjf<rgpMb6K()&u-4
zQ7mbl$3T9b%w?!hza%QH@!z2+28JTVwCn?XX{=j7WvAtbA|X)Ox*!Tv*r&B#DwTZ6
z3z}aJ1&#LvytwlXWK`=f=9f~S1_WDrhwBR)=2B3DLodC10;tSw{*?tTZ_^kUUh}6l
zAJ9p&J;21kP<kI!k{MnKcroMKYt3}#hT0dCR~ky!Kgb5937K1I5qjxeer##GL4Hr$
z!3;|7owwen@ozf_35fT4>D_)zdg<MDEReDOG>~-X38-w^4)B;ISnLN}3_N)a5(CY2
zfFkNWWDXCc7Zf@lCI=b`*YCapnyG>oLAO8y(g$BKr+I)gdGiUz_i6mwFM<aUX535b
z`~k|ipxHO@+?o)`q%{8R$J0DOgUknCa-=msWK6sGFpYoL1I}WWwC0lz8`#r!foyn}
zw(BaWyh>|+us4nK#5?G4{jSLuj8rwhUr*Z&Dvr~3u(5(B&~Cj?+YhcKb};dS_`lw#
zH`KmhE(w?{VXP*(;`#;_aKR6$Hqx3;aJ<{Vn$~%1a;&jReH|0XMW8nG6TS3qHx|&?
z5~!*MiM-HD?*c{JL%sB_I1Wg^C_SyQ_6@jB=jc0--sSq{HA~-t4gb{^c{0Gpdcc9D
z%J45ejobANC^z>VRO>X`!_aq7txIetLwc7hXgZZGt@(jN+9VU+`iBgqvLGdPUJQK)
z)4N<B!Pj~0U}s}scx?h|gR%D=Oyl1MTDIW&1T<*=Pi-+sc^dyVPz%oW1y~HO(eQxU
z;sj7e-RAlb)W8F+C<uKL@Z#Gkm?PB|`!EE&*n7F}AeY+WWXPhD!;|Nl#QQi*fi?y>
zPeDqP8it17d?m6CzXeLv8h&$>u!5S*_B|)l4n7n}+vPBUf#J0joY%y_@R|qCo9t(5
z<}CqgP-Q%r!N8D~Q4h{?Z{MXwq(!A=G=RnCfyHjVON&g4OUsx7%3B$0z+y+=rNyU3
zfLpCAKI)|{448c0RJwlO4<1k~gJvJn-ly&Q!^6PvR<BzuVTR=)PzxR={tqgi1QO@!
zIRW;JT*!<KhtnX{UfK>8CI$vbJ@h`!@OIihaDM8%0iK803CaR#I}U94|39ts)O*m-
zBX|Pll;>O90~<>C(=xV$-N^GUE#l=VCYbz=qfiYX3n7_LEp71vQ2Q%j2B>+|dVs%m
zHj`djH($u)t!5gQ`#|moO;g#L2$hK2t`+5<0veY-kk)w&G^m%>>H6Wd63BF32?mCS
zv|V7&zfbG@G+E3%s{RAm4FYdLYj0ljfd{fWOFyLTW?*1=0CE9nVUbD^)Mq=mz$L{e
zXmR;A?cf7&Bkzq`+G3p|NcvV=tWX4Zwnh;sEx$=S_(CKN)L+gJjR2KE3*Ug6m}xs%
zz{8B4pa6#(*?AaLDuYAnMq2X;CV24zt`k7w;G!Bd2lprqT6Do3l-}w307*Mo<$Jxf
zg-fC!<u0hr3d)#I()K}^_1&&d(kzehH?L%X<=z({23vZk>pf7m0S#~5g?2BP<_5gj
zbp@0d!RsatfcQtwgXj0ULtms@hCV8?NaNpr2s~p2TA>7)q?(!b{Wqu+9C{D51S*Yx
z{lWA!OV>9=pwSHDZLxRLEn^=PtLUY7vw_Nuw1Bh>OK>RFy-tfviv~pksD4mO?_^7B
zKF0Ubd$NY5jJ!f214Ej7TH}9EoB#D4P}-gW^4SM)opEDwoTXd+0$8gYmJwGl^qflT
zya>*BI}+l-+4Mjf=ZU^Upd^--o_5^zi33P@H%Jl`bx-s_6CI#AFVN&bEn}MD0loC@
z4p7~b#=re!n&qj|Sa4sx@i?f%18QQ`zR^qX-f$!hG<nLu{U2yB6%?csjzL`WOE0~v
z1Ee;+!}k%0eJTw+@b!qHR2l47@KgtLnwMI7M=;}S2c%l9?d4xkPpaW$8UsVmslG$7
z@(faTftDVm@o)PG8jb-kD697XHJlmKdwd_H_qje$OYiUobvL%TJ_4_7=?;An@M6yq
zwe(JBW{_9kfVxZtV$fbR>s(Os1kKxYhdzKc$Dqo(9Hc<jgG}dy3Z-=y$U${-%}v`W
z$-uzSGg-@;oAJ$LGiz1GH<M$mRl}d8H6M0JYy1t07yj1hf8ZV%C|RecW&3{6NpIc>
z3RmHB-n7o+>0Q1b(k?$w<NO7h?fL+o91$qJ1_~jyv`#UH8K42ngO3E#cAT4h(OOsk
z1%q08R{(1o|F&PC5dV+{8q&W6YS?{9v;0-e4;p?JNb9_x#`rVM>Gku;>Ncvv-VvY@
zl>t<SWdwnfociQ=8!zPvVD`1=pfVO@VcNmhENY!{5ePfkCZDlUQvdM}EDK%?pq92c
zU<Rn`vWSgAZvhi%mf}L%!AG2Fh6g4K+nRA5VMuSN5MbnQ-#t0lR;hjlba5ki;YNBx
zr2qr})Whiwm4XZ<Y5^~lFSHyeNo~1ZnwSPz7>C?Qdz;?rDDv7qy}M8(;Kk4LEeA@h
zTW*({Lz{~b^`N%mZgBbA`2pN$KnQo<dTV)X@?Tq*`iHFLilAkH&a99L(mqBTrc#%e
zuUXO?YTvW)x2|J-8OaJ_bMd!uag>XKnC$#5S!^H%2Y-tM`^%RcAhrO1%TIO?LzKTI
zmgD6W4p5@_kltMYN^aW&So)5o?F400&{T@yfzPY@j-~AgbDezEPO5%2C<;Jx>zpS*
zeFi5sy|jfIMPMcucz(J0fYRKw&hKdlpMw^j+(_g64U&xF(@X1?(<w?j_*y_My)#NE
zZTEhNNw?EDPlHv6rR~0iCM1=%`x#v5CP>xfJbT^<P~W~=4%E57U1E}!eUdM&@gS&l
zOxq16El(HArCDAmmefn{wr>9azl004zNgayv>+?3`7qz>yP&jYd7)S}t@)=wiF{i2
zO&z`T?%4+>U$$4QzXr}*AJV%Wn84G0Y2B{i(ftVU>dXR(w6L^{x8U^F`~;NV(mFph
zJYfuY5&H^Mn!QMCJy0qPQo|7msyO1GfL4dT)L~EWbA1D9<3hvr{^wPC-Fyl~%|978
zu{GTK50VCzA54==9ZVSGCa-c(lv#BKlx0AzNB;GPzzawrYZ*W@?~@-m*w=forFZzg
z0~HgXX+O}M$a7E@mrn0;eGg*D>7^~yDFQ7G0A;HOY5eQIr!^k?|DS=u@Ea&AfBy#R
zCN<PPXDrc6Z>W9FTw)8N7)m`r=>b#*I&j%CY~XJZXM?PaOxvN)z`*cQglz+dT6#yl
zvrO79aJzbkHAwg$YudqgOrSFP1$Zro;s4h%dT9$)ia@19+HuzxppqkP2dJh7jY+em
zfwe(RZu|$DKPu-+YyQVr&Xwl&nk{V~NCXlvoy;IQz036l$X^nW>do)K|G6NpEGXcl
z8h%QY1eIGf{Nyi5Oh4xOjv@V+>wAWVp8}v+CXck{2W)Ab$H3e}X<li~kGMhXDF;9+
zNLlB;_HFn%Inqf{Wglpj#wLLc9Ixfm_JR5bo47Wxz7|Fpm}dBG@;oOo#*dS?I%!+{
z=Wn^d07{qD8fk|A!3-VHn1}&5z(FjdG{cji7%~O9)C}ZObI_7P31=&Id2k9bnjGn@
zAQb%;q~k++hr4Y0F?SjNmnxIHo#pBc!AfpF03|d~oP2n>kqJzLs^<W3ZuJlVu?r;9
zyCOsyelzj6H!?T><L7U$Vou}Vb{O1C;rtNr;@2}!J=>AO+;Y2gYudpdY!Lf8-34AR
z1Dl9E5UuhPER<f~P$9s?-)_JRX({y`Q0s=y8Obt(=RG=a1iTP92}(uaY|`Z*&~l(u
z8KOCjf4hSOcs&uQWr0Y#X`P2&2iY){ID=ccF(*Miqt*lb9jBl^>+}!+j|?4rz&v@q
zi%`8z5jd@WOz(6TdAS(0niY~E10=u(Og#e{<6HK!4rv|`>d0(RPv<sRRon?s>k{PL
zdncf6(heV}g<TE;HjE|iE9&`MEulh4ZnrzYo`!HdXxsx_9E6Faf!1L#9s(Qx<P<1$
zTLS*Q{J{to_;>;&(D90KvZt$JsLVfj0506a0P1dUWdt>yKtua!%`ez&AigT+Oh4`*
z<Inu^Ib%B5QT*+_j4cOBqhSHMEkZEh#m(cO*?<zp$s4&vC*O1xVe(|0{N7cTqZ2Hy
z0umS3RcQXf2wsEw;9pwv0Z{o~3rbvqX`Mg7b}+oOWK7%10P1<{s+pYRuF1spcXF@0
zmjAs!aHlTV$&l9kfFF`jI@|?c9{K}u2soNc*#4a;QFtAtw?Lt=<v?kW-U7wKe+NoI
zt6p3`q#t(>U}k(d@y}#75A{@V({CpzH^bT`FGHb5f&9z(+Bt3K7tnz6uFZ_#28`>6
zfETkLKrB1%Aj81;S`k`I>`(_a=nemaOBrx^0$yVN((D&#>SS`a2T#2@b9ucD8-EKA
zQ@J;&woGCy=Lan(GH0}5;%~jk@Y0FVhK0X1hcRtu2gLuNL1<9Y;CzsN+*yQyA^o_s
z1eg>6lQIkpFUxprIQd)bnaX)>*!f#eFs3!1`u}nRqYW2-t2L-6gvdShu`e~R+6eKt
zJmDxevf&3U*Dsf~;pJ~V0M4$#BB1Q*ED`X+_F{U6v&>6b9vgx5E@v73R!`QK51DMF
z`CA@wmGj#O^S5Mi*+}uXlybei!)+tO-_p%(<ImrEfg5chRM=P0BxA8mTIa{K=7;rZ
zpvt%Tc|ANDyTm#f(wZM}r8S>oOmC=`VW?zoIM=X2A+7mYMX5l;Pc~5Z3sgXUOlv-1
z4{}pl=MRK`VqdO(4skNFSkdHvo*J(DN76f;MP6EPgIo|T)9{;}zg?RfKCIVmwuhnh
z8-I%gcgIao9tI8cYo35qYRAB1QUNb!9-Ex)C8^^EF6a*30(Y}OadF@<s9ZSsQXq|g
z+ZAM+RZmRb;3dlQ;Tp(JXTg9MZHFgc^fD2AalQl8zCQ9=0X)f{cYLy#x19cO2DH$M
zxt!kREC`zD{&%9ZFuluJAZ<4|9f8+jPfqZbXW~CFxzSs~Ozi-8?3bnV#mjx1puh!h
z4glwF?gMGgY0bYuQj0m$c2<Cs(G5lhhL_Eg&v?sATsxcI6)XcX9NFd8HzqUt=(6i`
zf>MXyWOE<+dIP5PE^h(wV*loc9FQgZFC!R1Y3($FjR1ek9|ju^{#H&V$PoC;)eJTg
z{4EO^%SCNO`CC#MZN&Lo3K&6Yg_ZH;V@6PNnZyW6LVFo)B>7t}GD4<s-lTUp3%r~I
zUeVwzU?alcJ^{?0eAP#$e%3xv^cIVxcULo|8Quo3Iu?;j19hQ55mCJl>{o%(XJDBy
zP=s81y#pNjV59Un0$%X#OYd+Ne5njFbvxWBa9Dlb3)0uYA_q0*6~rq6FK$63#M}g4
zzF|j;rP}?I<^5!``1ikT29N0!3#NZ_7GNw@1;xX`hwR{`j*ulOI|LXQ7?6Yc>E1N3
zSip;<y)6eSSkewY1C6q$H9z7{15Y2leDx2_y10EH>+0X^O^bYK#14u#NVvUwslpC3
z?BAXPFWA#NTt7ez33%~#54d#f3jNS>sg(J^3#RmrV1bt>L5m2t2SX;21(4mfYhT*V
z3~)-RU}9i+xswgFmq&@Q+#a->=K+Ha^W-gl>Ff?opl0Kt$x8kP?2zfL?#Yq<T6_@k
zs2!jT^778)iT<*T4wKjWOEWH-d>YJt>2Jt*a<X)QrUGbuD&WP;?I5L)Wx&YJc)W9R
zN`M99g~@XR92pHK-w%+n1DXBWy5|IRXv+}BYCOci@>&_pD`H@HEeT>7fLQ#XK7S@S
z%gS7tY#FG|$TK-HP?O1_Y4V0Z32r_H28P#eAk_|&*9R&yITV3}C%*~g%2>S))RcLd
z&z!b10vr~O%nS@K{h2{wZez^f63SREZez&b!pdl4#NVRCXd_T!YGY86{c;+kjVXUi
zI-`vle@i~2jR}8i3nNky*UkVcL(@P@Hk%*)ducW~F37U}Dxyiy#n;J@)_Gp7ORR$-
ztrJpq$k;HJDA+KSD773YHA`!Ln4bokGe6&u*8J!LXfa&#IgZzQY0b~`Uvnd51rV~F
zuLVHi&<_rWfJ<qSX%R3NrFH&P>zFJZ?8pXMEP3(K<fLF{cMq_K*D-^}3)6O5fO%V)
zK?8d?0$!+JO+V%=BlL1PW7<v)u+$z<$h3o+6UfoG`@-Zm!D<{^!InB)oGcZhAYjgz
zwo?MEhk=EG;idRwuMj;(hsl*86EibFc{><f^LT?Bis0o9+ni-UDY^L{d%3#}Q@Jy|
zmDqGGt@S{Kae71T2ZmA(a5J&fSpeiRnb)#uJ9)sCxUzuVjO?n4%adzE4Vdy@OkN*q
z#+3H}L@}06mJ8EnjF{{d=EL}J^YpL^X2!J1{81M-Uy15wVVp2ICSIO#!sf>KX!gms
z(}e5)Gd##+U^u|Qz;Gg)fgzoNfniNH1H+7L28Nz&1_n?Wt-&D4z``lOz_0_qT2P-P
z0E^lVsJS^v=7OdYz-sH!492FIg@KX5f$;<b69)&_5exDm4$jDCU`S?QVDQOiV6ez$
zV9?2CU|=OdEgJ(PLwy6&2?j<qgEgQA^JFtH{K#Tpc$38dT6V<%b}`7o8~!sS6hIsS
za&Q_01H*+Z28KOZ3=A8x7#MgNn86Na0hzntKLgCcYqB5?o{+`BP?N>LP>{t?&%npP
z%m8u(y5bzD;sAtV27a*GI7UVeJ_d#b2uFa_E@oh0Fv((IP=FZBAOKa%0#yr(W@NQI
zS@mF7FbIMbKVW3!5C9vDtoShl1H*?*28KJC5Vb;3wJdnl@<1IS%)kN;2@YsTfM%8$
zm>C#uWI{q>k4Yv2!-`A>hB=uG3|S1!3<}H<Ot=hg$Yfvu8@zdLCcnOtv7V8hp@NZt
zk+Fffk%fXrP-=>TM`DSBb5VYAv4Wwop3&rUGo(2TbdB}Wl8r4Vf1DvEY^G<dYoME+
YXqK8{mSk>Vm}ZbTS!(99$rIug0R2LlO8@`>

diff --git a/pc-bios/vgabios.bin b/pc-bios/vgabios.bin
index ee748f6599de37f90a6273c8e9bace7bd74a7e03..3f71aae1715b2f3082fc973297d8193fd5163526 100644
GIT binary patch
delta 14868
zcmZqJz|^pTi9K|c&&!~Y1(O%Xicgedm*|_`dZ~o*-61B1mIEc)|4yXsU~phyD6yF6
zE?0kuiGhFpskF`$bJ8w8NMrra&cHBNmEp%BCWb>y3~8Zholn!k(t^`E52vSfmvW?c
zx$>kPd@PX0zx`4g=dCou+kJ=C(mKU>7}GjGH~eNS;cfWMT*A|GyM$|l<ZHGKe6N`{
zXs7LRU|?YAJCx?3wx|U}^KUz;*2&k(kQSXb`I3~-#6Nt@*1jJ$3oyzu@}_k@>$%W(
zAZ-UjI|IXHD<*9Pk+kL?0wrQ;`#BgG7}9ow$k!ri`&k(n7+$lb?Pr@jk*SoKx%9(i
z9%dy@Zr2a#Y5eP5-%Pe;R?~y?(j3xerhWgH#&{yF`G`nbbXr_md|K=wCI-E<Zm}Z;
zX|0#|TQ*Fd&MaR)JB@$af%LRa*EMO)2iVgN{$K`iHl(L@`*WnH@o#tM1Dn4AB)TF!
ztvj9tEGm%3zy5F<<B9Y%X4e&IoyX>+F<zUS-sR3?!_40z#$?07-?Ed*hKavr6=TnZ
zw9eOa(wYx%nVX*089OIEtvhx@TIbC<X$K!N*UwGk-+mzN-~$$rNpsRVKLxyS`I}}4
zcG80Mv~E|BdIpf~OVS%^XY-dxfGB|y$+R7ykV#KF?z#rVcrBi`0~$m-*cccXz!D&V
zw0(@AaP0h)-sQU{?ee3v&dVUj{0BQ`g?q=rw9C)Z{L(J|203mD$Z>1ZIuFiCW4t*R
zWc`w~%P-Q?lwDWMNy|RKJQw83DQPp))4tcPfFu&vB_M+*v$HDJFTtg-^>&G2TI;tG
zleE?YCHiU2znMz;(whG<m1?Io|6nRreJ!2l%|G>E+QElRn>f;TgB<)?D$Vdxn&HXU
zLSXv#YYv#qMwT?rQ)!kr_@^F7<2;mRc@M<6_#ln5{t(E)3(`A6*oD&5{=0&LuXICt
z8e{34^t9&M1swdXlmEReXH4sSIVY|8;Fh^*hPTtxI(=89r}1wKkrx8#UK8-5^G|wO
zH%PFPG0izWjoEiYTJvv?(yKieK;j!fu?CB?w9Z3w(imT*H6PkCH?6b&L%@st-!H`(
zLFR?SjI;ie)_E|k^VJ-PDrl^Aa)Cm6LmK0)G>_5`X$K!O_guhk>dmyy4*@U4e}j^p
zzZ57j`ff<myqVT{V@?|5hq>Ss^Ya%d(CR_4&cEGVCe89NfA2&FWF6^g-R>-qH2VRp
z<@m2O=hqiNO5Eij;?T6rcnB;g14?phK+JlurL`N<EI$>CfWs)w1ES+t8snj~@3%pL
zyN01eQ8BIaXL?#^=mxNh(|@I>{r6py#&|D1tveLt)7RH0$Fdu7w4AJzX#U4hI(a&~
z3s0x-6Hut~q<6Z0nEZ_0i{nJv!3W%`3<{I2IaIjPx@(`LTh@LmF`k^kp~1}@`zAfD
z+4Y6O>qC?0arDZ_rR`v0U|?wY#ayDEwu6a*fuZG6iEP>qQ2Lqdz^T9-mKHoYol~hk
zSFKyDm7)0;M_KYp35C))P>eJ`lt1`_Bdz&?eVRiW|MpL5ou@!i#5gyNfBm(z&dX^B
ze>10b-U5mJo112NutYG8fBi8~0RfKn=0pGIrgdISJNS?Ts_OsTH2!Uu(l{>$yx{ns
z)_Ewc^Mt{HwB{3B@BPy{LEhp>Yd*pK9$XlKiXup18xAUNI}WGqy2Z@E@Fs270Wj5h
zyyM2Zv|R^59E4=&4~YEaJnq2yW2jovJ6u1fb$)<pO8b5}P4RHYi8Rg|5IyhGyIeoN
zON#?r4=D>F4hT-$b)1=j;a%FUlOWsD__v*S({cDs8vnKn9rw}>J`_mnypX2)|3Ab3
zG|m%g(cn@vEi`R%hAdD0@wCp%;Ccd-x!pQWfO69ZP!YkA*7-3_^8~1D4S3NH4vmAa
z1p1DvrFRIY@o&2VW(6~XDQBj%=EKZsexP*l;q}(E2xKRA9@0zi;%GTpq5_H5hM&wO
z@_OlAL2POK+gJ`Y{Nk9b#pl9g6FIqnPur;TV8Dx$|62}}Y6QGE_b09M&<5dmX-;oC
z4ySdV2zYT5oD=!C9Zoy=fEiRj{CurD`5d2C{lOp12#<9>O#{bCTIcbA7vUhof&*T}
zfV6JlN$WiI4xUclbR6Emiz<@Vc`U8-N5Bg&kn%K$O&n>RpVRoaeNN;2kaq9^6U5#;
zu(Ij@KpJ+`gUai)UFR4X7~ZGtI?u?!@HUNq`w2(^k0E{|Z3ic)Ku1%*{#@F@pUmJQ
zgn#{sH2(GXAPE>$N}QOB5~K&`q%|Kfn48x8le0`bt@DI5h#x*Tt@Tm~C%9qIe87Be
z8vninFK>RDtRZl*9^|Xb0WW%grF9+$=j{c*zy(0(!L)-vxY7<j0Hti6w9a4e!3q5b
z6I6)zeZULvzbyw!iov?>{Q-Lyhi~~IJ}7Zd>%0LDBv2mgJeanFqaMk-pi=MP1LnCP
z75^ZC^&T}qI#0la5w$)nrFUKqc=7Zn)a{@;fPHSji|s!lnH8M1A$}1C<x+Sao!G@C
z9Pnbx|9}^je_9Td=zu-L^JlV+klN%6QX=*I+it;{JZjxyUJPmc+disw^Z78O@oztw
z2J#pGwgYL52htc1g4<F2>o2D<UP|k{Fei->C2AUevX|FE+zLs8{M&A(bzTF7`VMfD
z>VVpUBnFEcrA8e$!3n71e_H23r+^pxe!#uJ2@QKba9mvc0p;?)PlFnfcJLWTTIY{6
z{%t?fIRB}oca}&8OipB%oE#}E!<!0f1vs;SeRzCwlW?TQQ<idG8%F*XRwf(f5~-I9
zS#8+(TW7PTb>8Sr`vOZ=FS9;PW)?BvJIm1Ui-o_%iLv1qQ%TljM-dCwo$L$@43is0
z6h&{OxurG#V<}zpQi(Cm@Eh2UJCnDI_|%_ffbm=Zf$C0YAyDyg`A1sw1ID!PH$at8
zHK;zSeUYBlUCol7)>-=`y*pUy;49|zwC>suAb~fapas=LFBnRc)Alng`2WA}cv|O0
zkb*a#SApsxkZw?Q!|40w^;M{2I$!&zi>C2!F9ubDAJZ6*r5XMQ2koE9lSQ?e^xsWB
zAga!|c=8KTZ3|E{Gp+N~#a9rk_}7QNNb5X4Cyntss4Z3dA-yY@r{Nbfe~Ts~I2c}l
zf`PxKYjU8NjHzkg0Z`rfK`p&YAkFYV8vnLWY2dI)(>$2g`6=!4ue9bzjOiUA%tC1n
zY0W=4N*}y@KY6K`1>?5K_r%0(Z9zd~cp$wCq@ei`BSQ1#M`@hbV0zMaFzopMA8c3b
zhqTTQYUv%!FOw&mh?{ZLeo#yAWPhnTxk%jBnSXug8&F*hs(nL0fQoPFwEbYM$3f-r
zleEt3pI3p(WaiKpuOFnRbqCA9{M}s)ih<G>lfR0qDeeR50XL^h82gTaw7yB}y#IMs
znpb)nbL@-PPbOPQ7)gLbE+DP*Bd96x0pvyohJY6puP3)lSo1+8cQEW=V0d|W@?{A%
z#)`?mBpfVKKoRc@ig?!#>0Qo3Aa1l2D2_icl(-|}_$Jt~pcwv;#`x*=y~*X0>P+dc
zCNGdwuD^_wGxsonn*EIoX`Sam1rh)DOP~<Aklx{XKCSZws1Up|H{eCyPf!8W{NP7=
zr|YA1P)a-I`hXEh!JeOK&5zmBIzO}=NbmAJUnvFh)CIltE+;k{_HrIj(rtcNpKjzM
z`z&3m14JHkeZYidK+Vsz<|7)D3%NzK)0*EXfO0sr$E4OR26AMHLt5uyP$GkBx-mE4
z#mUJFq!a|i!FH#2xyZhH&75X<VDd!;$@=Cu4r#l=<-=jMZo5{7^v>Etp!5YUj4ZG5
zH~(O0{x87a{*j^MG`O6A`_=VFI@ogupE0L*mOcX2Sn2%hT@Qg8#>ZUuFr;_7K1sKZ
zJyh%hbqOed>VKpeo&@z!x<YuLwOlHx7f9RR04ky{|4-xmk=_xyC(SXf`6ox|{qznO
z*(0D-|0K;J&H44FG{f6zoi_qrta}HFN{}PBUr0OnLLja4Sb9(B0jM2EK)K0vM_TLu
z67%#vS8%r3p_bmo(Q%^hm|A)lS9*u<_H--P?IpZv&S{OmRTvl<7)qDF7ESX9wfc9Y
zIlVpt_DNUj9&jL~H6L-9+$bkr-~2`=jepy%j#Ftn!NGM<t=r6t!SXYIvjJmzN9YBR
zJJR^KxpIKoF=ql^e0>WldSOWe+-zq44r;5Xcg8+S?{hr^ZdRu8Z$AWTES~`tU9K1S
z*B=4}8z_L%I$bZMH`MYlREq1Rce&Mr(g$C9Ln==_sCRY&)Jz2j$q!H<fQ&ei#=rf4
zdYWbI8UDU`4C#HYC)CorSmZ&e)$k-J;a^}V1vPv=ymo>_9L#M2FK&GU#mWvyMEn4i
zD4@n@>jhBf2vmeByYfutmgTX&`dTGz7ev*swAN4jQxBzmzm=Y*9Lkg45yJZn8g+L-
z#v`ZMl5c6wll^7Y>eD)}r+4^%Nbh0*wK&tef*I4hyqRE?i(0qY9){L$B}r-g+rR0h
zcd@k`D3MO@a{Z7NkQUx?F}*7k)JP3@;rK5tA}#8*HK<V<@M6uEG*COQ+l?!|p_YT8
zL>gRvxq{kD9BG|D)A+ajOyfMRmfmUgnvJvXKw9UI$v<TM%?kuTA?_d;@WKLA1%O8a
zwpU7k5{`75KQuLcn46Zxkk<LJ<5s|nm;cftUO$+uD5r*`_x5{G$b&`^u<B)m>g|E)
z6`A~Aj#~)Sya#8a8=zMI&43rqlX>LBnWDaca^&PXdEWXrps|zm4%d(AU9JM@U9lqR
z9kHJf`BZKXL+fq+mMNe{!e_noF1eQ5CE^_y(>i~pb$&=|KEea9TZR9tb<2TT729v8
zF@id*u`kkgGq5u-q&L)lVklt;l@$jcgX{F>(+cUGv7bP};u!l8MAg1YWBecRBIXk$
zgv+?nE`t19`zEdRc8Mgs#J-;1?fU8S>NM~4G*E&62;=}z0VN47ppXj=P-%4I(_~(G
zHRgq_43lRom@vMWd_h4bvMZJ&y(9K>dRHtD$giM|fdIn8c6%6F|CdyNQn+4vmwe0Z
z63O(m&QgJniyenR?Gbp-<fRmfhXY<{PWD%nQ~Lx~4H~520eLL;Gc+(b(xTx(mHcS3
zqp<K~eJ;+)>lN8~BP77?=!%d`?}(jzSTV!S_j8)&=``oG)^GfM#~9LDZ}a!<2lbP;
zRmh}S{;p?EGyD(gVb{KaR~ub?Net;-4ua_&u5Tt6D9P7%_<jT><Mb}qPXR9i|A9gZ
z#0T}{vl!F6T;G6_dRka|m+!~dc3_##A8DG0(!$dif2Refg{6ZH0BIHhYfgjf>im)R
z{YF{<L@!7u#E$AeY0XCjV6Cmme9Df}orlvrUq4Py<KM^Fa-f7G;KkkhX^yYogWNLt
zyp;H4b1r@+>lc$fxOAC#UQ90M($TyC>ct&=z^=-`n0D|HbK@fhrZi4a_kUaH+c{~B
z7t)#!fO@{$4@^G8rOm{7fAUW*OQu!NCl@PwGcEox`GB$=)05wmRHRscfgCegP+M%W
zsfxI$?MqPR`2o#qKR|h{<JROv6%nrBx1a%zKWUwBCO>o&uIB*_79Df_3<^t;^bXhe
z>0QpE=^d``(!0C`)4QuBKsAChPkL9dKzc{$+t&Z-UBNQx9ieYZD$@MZ`<$6T?WXjO
z(AVIxw&r7ubJM@MzF{g6QcLd&02SVEp%P4U)4N>Xr+0vw46g6M`LDzG6LM+5nBL|4
zHoYtKb-)X+e`yh*(h1@q*N+ef`F=|4{P42of5Rij60!8IP*B(TJuLj=(_&v{y_u{i
zCzTWot{pC?b)EpVdpJO&fgP?N(ppcJxPv;jUCf{oQZ2p9nK8Y?^%ID}1ac3kw+pfq
z)IZ*J0@3vbm4zUyK7ojj@6tS9Z<*{UEM5;9n*fgvr15XR@dng(1P>CtOJls3W_hnJ
z6;#&+yy$xds@e~}5&#cEWMA@4<KK2BE%W4bP|eJE3e*!%%RV3jj%!v>`9C)e)P4KO
zk!Jhfo`Io^Ep4YgNGaGw;K2vba6re2cVh3}r8&Qz1|4nKpa30C0Hre<9#HF=13J9P
zGgmLYi@oIlf6Ejm8`V<bw9bEX(!eow%=Lvrn&E-hifN!uWgHV|6i{n&o2o*6^Gkz<
zpPXfvU-LKoGAO;6e$4fS0Z8SoG{ch(zj8_?^wPV+7(pzawB}<>dg)za8yR0SrMWfy
zO5ty5WT-c9_@&3+GLf-fq~Vt;f9pfWv>mDppvL9hTQ8q6HvEd<Z<))`@GF_W^%!Va
zZXa{Ni^I2GMl&}2D&}vQ<j7cW)bOi-zjYO3dRn)2+71J--bJ_4c2s~_Ge8bW+r<G2
z8BoW5{qvU!j19j^OAH%+Rg}2CESlV+rl1slEA9LJw9X%|L1TW*EhkIa(wYymyk<#j
zKFksDg74Q$r^(0E;w95O172LZ32H6Ac>NNTWIljfL(iT~wo|u>0m;_heEk_JaSPOL
zdK2(s;<L2Q->(b724<&qegySe89^cK#%NPq8kyF44;08Ops`wMP=UY<DG-crra8ZU
z4;p&tJonmo@&$E~0BKO@2fW|{$-IFD)1Mn@o&R1lr*)oA>-;_^t@$|P+?PpzK?Mn{
zP=!wm1gEtgDCJAbs0amxufpHS)*2@44Pefb$z>Xr^}E6BC7|L;0hak;!$qA>!IKJU
zL1}?$8Q;JP!Q~oHTIUUf+Lwm^k-NWvp!WHPG}~|K3=HMopnA?WDV2et$f4m82Y>5C
zh7JGIb{zv{AU#mOaI%r6YW?G1X%Vj#(=tvoGBBiNG(><%<}i?h-~0yqs`<qKmlGM&
z8vp%gU|^`10#&x)B>xUF{*`8U;N81-X>PCYrhjw&z*NGUwhPp}Ofx(X@Pg?#*dC=c
zLr~L3#2lQ{K!dX?55c`jk<u4Dpuy@LBH*;czxj!#JR`@00+8)KcPDdeD@i#->ZL8T
zi3DW;{j}^$d})n`5+WHG(sm?FcGuPrNJwP>wFfSxSzavVNMlW!T(7NJ&jTuAUx0%G
z)GmFK)_HmbBY(?2rZoOt4><Un%^3q;9JvcBi*_9Wjo_vCfm%Y{v2Q?qzqHO@Z$JWS
z=^f6DX}iwB6oB|l&^!&v(IDl{%xSw$fs}xxSwIcS&J*>ZjuGSBG_c|C(smsM$%Bjp
zC1j8$7cN$CtC6Mj61Z>zIRdUO4dM=GPOxFWK{F4Gb30C?b^dyn)_Du;G*CMMYz`k6
z*c{2y`(VW<0$y<3OYf^k_{N1>8LUF2^ii7O$&M2c|GZ1vbsou0r4X~s!74dRZ>ptt
z);XjZ9#Bi~aB~6?&LF}CM7XA>@$X7~!O7p8$_TO&>_w>8T;Hgrcg1k9rqzR{%D}ZF
zsFB5a<2~45mQql%1uJp@54pSt=U27#?g)pp9fIKU;?{eRq0K)9OWD$P3W4TiATa~h
z<-!3OIO9B#)_DtJrex`*v|VRFUTOS&g_(cKp|s`)|I+F?FQn}{1WM&l8@e2%p@TYt
zV6BGVkewW2pbSr!B6p$b@*c7Z4`!5j?>O-;&G00$0v8T*umzmp0Ip|XfH;q{^ft@|
z4A9g7<2x{>b>4ah=P^Me1}?w?9U^C&3sIETc^H%u+(4yP>5H`HXH5Jp+Mx1zSLzFn
z;&PB<APumzoidZ-^f-mmI`8+~=)3iKN#6~yWas_K4SFi|YU!QMN@<1%`VOe2b&J(7
zfaKKD(>jAyKq3oy7-0g=8t|x|#gMii-1|G8wo?WiPxsRHdxByotvmDs%oeyBNck!=
zH*F_)+;V>llFG^Y`kX9k>D|tg9rZ;mX8-OxuC{m&%n{weDo~eoB3#xTtO0Tvcmj2w
z4#;-Kdy^OFM>Ea2J^8P`i`T=?X%P@Nceyd9K?|nFV=T-J3~8Mo($lnEL8CUVZ}>Ze
z7}LMGzTn_*;beprDf}&eL2X%Z7$!{aG?15fNbCFz3TUReX*<Ea&E}shrEF<C!SjNh
zCnonBh^jKDH6LaIr)jRz^YBn=hI*r0?%QF;Qpw5wh7xhHpeh(@(0<S`bsESxDaa%Y
zY@E9D26!A8Yz4$8-E8Tdt}j3%!;m3sP^x$VRs<R*;3{DQ8T)$k<P1ZddPp&s7Lb-<
z04}sAd`^o>iv;Tkc;Want@QwZOFT<j=V6$iOT<yFH#`6x{nblb=n$FK_&X_*fuTqt
zE&Bjp8fyrssI|ONBnZ=8DxC(Z4}@7jW!Z<c&iWexFSdUJ)pIXiih^1jpeEdV8|G3_
zqeL&gdjhC{ZvK@8E}T;t7+&+IH6PGPvpvAXzyK<>4x|}g3V2ca?X_llL+yK(QYBC&
z!ci*S1M1ixNXvj!B`4E%HDrM*g$W<iBJ|R`yxG!rFoV*<u6oEE0ROgwFkhs1S2O9Q
zcYCuyra$1J`~#{0GVKKyJ^`vBp1|e6@eB!daM28kwD%|h1`65_X$OCBs2*TQYfd}C
z2-gcP!**R^24(-w9|vDBr+I)&h2|5C@6-6VUkA5c{O$z2P`H-X37UEJeUj!0ie<<U
zy3qR#?4Y@qw9fMf-?OJRKW94lk~yvUp+g$y&&l=1rpi9o({`}2GB7~OiuY+dnD{{)
zQ0?&^6ne}hVUzC~tI0E8-@pPbZlIM<TJs5xcN<tC8Yjz`s5n+LrSWe+o}Sj}`amze
zyO<@7fBP{I?}=VIxE20RFTKl|1Jufg3{<42HP*fWHvl;L4y1RvzL?x-BFFVYZSgLK
zzJqF=a+6n@DA&JZC{+OQ?7SHI4yJW}0M&#4=Yp3s98BB6&c?v-+DtFKE1JFUU>g56
zaM}0(G%fL4Z81m(xRVO56`p`ap{pSdf~um$380L+%@tG{f<~mfLmvdZ*l-#?EVbB&
zAwckj;+4LGYKxN@`VNB3a(zEJ)HFWm!6axCf%6okB&h+71H9)eQ3M5=K#2y3;wWJS
zwW95NPJ$=!c0K50V0bMB=QS`eyyk)PCYhPLg4$LY3DZHXB}Z_^d;ShIK$Dii02WIC
zi(P(~7MT{8mSF(OMj3fvvHkDT;?p9)X`ya%gPCOg0a#kxabUy$|FF~q%9fC{4VmAv
zJ+PsKKP{sYY)1OKwD^~&8Nn$OqG-oagx;PLeFq?gj#^qLpAD!1^<f&QAZVSzn6`s~
zf#HE#+TtSxX*;+;S!nWAK7Q-tX$PMRsHJt<ohg9Cx7y+Z1t8rg3P2+b2VaPQN*IvV
zw2Vz)C)|1qZXE7lnS7B?xc(SQ76CO8n@=#oyaJwGhIta=8*ups&B725z{Q_o7zLJk
z4=J9&r4pzC2uiGP(so0b_13X(_?s6q=%sf%vw$YXL1~%|mV}=|>r$q<X`L59t-=QZ
zFD_h8>jWi|?XDlv_}3qVtz-cW!lm)A{{YJ54+378fhI#jKcriRzTlq(n&sc-`!wCs
z_Zk1BgB%x2IYBDZEWa14nCYc=GlORm1JW|Cfx~Cr8&K4PqoVo5f3@^ZP_4oDGUUHr
z+Cpe-T$<c&;l|{UI{CbXOg%#!IF%kq<2=!KNG)x#Ln>&*^TnN5(25?AB*;lG^gweV
z;9<&3{4K4Z1fZAR-2p0N!82!;r%IE+6D*C#LCt>9uyE}Mz4Y!KDUfFJcaZ9|R0f9h
zPTyxB9iYPRjb3_JM?FZrUV7JrERbwR=+l;yrRreUcm4piiqpG7pQU-JrFR4~zIH+?
z!W&;QFzTguHDsnTF!Y@2I|QC2>-+%9zyHDd()hR4J_Wh`4OlGA1JqDvOz-i1mfq+3
zEWOM1DM)}RIE{bXK~P8T4S3M_)G<&)1vFRX`T^91C=g5Qygw(c`8ey`w4I<84C&pW
z&tNSNkm(=v(z_g_KrR3o#|ajiY+|Lz_+fIGl`7+h$u(BGo(`!D4E(LZ|I&7VLu|J~
z1_MKy;U&HFZjR=k!sR?^`@vQI<>zUfzrcR9JY4z+6bPUNTo0y!hYKDFr0tk6`G=LR
z<|78R^sWfjH2!U%DZttfpr)(grSvrG&=18tYUy1v0%?pl)0|$vog8AVD*Pf0R8%l9
zfynpZ6w)=h$J$F-Hyl*2S-u1n9w4jI4!&kl>y-O~u<gX;pVmsM|Nenx!Ffq7ZSjX`
zpi*%W8-re#7!zpz^itZvN1T(LY|OaMGNd<D2r%-uADP@_qolWx0jYzS-cTvP02<)#
zJeJ;2DacTw8StX){0hdBZ1C(%Y0Bg?Hj<7`>D`ec0WUm35_S*?bI4jLST63o0ngmX
zH6}QxzO_6&S=rX5{uyhzB4}-wBP(P+bTOk1Q>n|#mn@+2mW97{GwaK6RuG$uzvUH2
zxhROq!Qb+U4aDH&Zw+R9d4wIr7T|BW$pK=B^0(M>zT5(d-SqAPCeRRA01If2Bdwb$
zZ6`Q%ZNr>gjY`<k*mr{34t>Wa->}tS^q9<OCmegC0MyiV;sQ@3Hy==%3+nAd*6RI8
z<Gc@&tm4y4>y|rHkaqC3fLeNIlu+94m~e2;yq(5*8l)mhENyo_nvhi5?&isbcG3}`
z-fFiTsJnW*#3U{IBwt$NK~NEuwjWGdo-dY5v%F9&sh8d@-~9W32^Yxiof2uy2bj{D
zkMq603ra-IKLtuuK+5FPvTy3>rFYLxnEb>}v3@@!Kcsg%Fr{~bnzh}oAJV%Ez{~3*
zB+`P@GP=Nt>C975VoK}0(eQ*Z;6=@AP*M2;)I<{osaXnEv*Iaef#1uY>}mYlL46(Y
zC>c1!z>|@B-FycMntw8GVr#hdKfMps|LU0BWN*f#5Hfj}y@Kd{@U$5J_Ty>%>kq*S
z&&l8H?du)b(mPzAfQAJ@8Br3H5kaLEhgy1vH)vktJxEwiFKywOf`*@rB~G9c7c_ue
z`XH_G*#G|w42Iu8BLd&Qf!3|qw45w;hZ@oCzy+Gn-Ko#Oz+lU;p)@sZr#fhXW9$Zy
z+0HUxNo(-Rhy9?1O|QMv4!&SY+XX5u(hR@7mVz#1?7Wt?3!Ke&?gmwVt=~Y+dutFA
zlKX8zLw)6PY0W<v%jI4RLCXY)7I5xMb9l{`2A(#81WYG4gzgBINb|4(c~3SCTxdE=
zr8m?*ktne%R{}BkOT0mpK>9J)cMR#rT;DU42Bhr=^^rDlzqSBLO>T5l<OMI{+$6Ap
z<F$O+{>ked#U%cN0>tnD)D~xXP${gC*7<YtT}N$;Z~QG67(nT=SR>8w8<?S^mfl%x
z02(BC0Ad-X8J+}%zA4CQW+2VxAk7X=R_uGgX<@?TMkj^(U7)5_?T7RZciHq~?lS%_
zAG1K30(}S67VcsIjaz<5?{o((Y&`&K44eb&wR{9hYoI9l@Un#oOoKC}M0!_*Nb@g#
z{`P#9hTly5?HS-?>LCD<EnotTz=GSxoEO05z4nWGPy?mInWg1+>87;i1NLbLf3U&r
zd_5m*GV+MB*iWz!sHkJ&Z|6q1wHrE5^aE5OLuOCIPo#B%X4*j`+ztXQ2TH-o5<Gzw
zAOT*y)_h2vJ?-Ex=GXi-Or=5)lhgRO2S|Y1X|GO$sW~UoIuB0X=d4_RrT`Qr-#?~z
zx{IVAcbD;JcsY|99$GLLL?T?U<2YzW5;T)*c_OV7v|s?@78}MAlNI&+t$NU`4Y3on
zoUZv0*g>G+au7-5Uw<65au8&I)v1@9#s9z#ia9ZPo{M6v=RdgB3->U9I($b!t@{Id
z>0JzI%`ez&7|Zz}UOMg|<Inu^GBlpL90Y6_`P-*6wHzpohA2qm-xeVl@FL(iXi&P2
zDGk!Ro2=z3%oNNt+1^#Qo&hYS2a*Ei8E97tQt(5DeOD-yvZd_;rE7?p9RY&rAd4AZ
zsv>4Rp$>h<2x>KfS~Ys<T^?*{&9B%Relha5N&Rp5$-&<){2yXOLxm^<f9p=h^sagb
z5m2WDBAmv*y+Q)o&Aa>n+^6E-=K4O3@kg5FA^x5&&=57Khy<6HptUTZfieE=5iIFo
zua|Ixf<6VbwB|J{sEF`Nv;5BAckEAkpX&>?^t5j7^bX&5Y5d!cf=bXQX$M~lq(^jt
z%>Mu#XaEhUfd>6S^AArz1ZW@>Jn*~?Y*fu3(9}vA;|I`WLcoh%N1!HmGJ}Sh4zs+z
znYMEdXvB5brpYT@HJLR2Oup=@#q{U*<o~Wx#t(i&yx9dxvn6c*PLwFTj?!CjAiw26
zX^`H6gZcjslzKsw9Cr|4W_-E+_hcV8b;kqw3=C;ILB$xXh4iu*Y7{6Q7+))-?VJF%
z^(7-{0c^MHhkzHKK}%L#KY(J2VX}gp^yCRD?9N>dvNk;YEhfz6^)_t$E&NR7-k=&i
zm9d;3w8F`X(T0h?^&-PdS4JBa{?>fPw4ExTp3bfs&{#4kv9>&zY~wCj-_K*i$=~9{
zRL*O|&fj{PF|GO3|CgH?ZMgVb?U>LOM&(_$5#n!o$5C!%!_VJxo2gvZhL^u}FSxD`
z76Ii4XNiCp+2_+coMm2`@z@BYcR9=Ow+6GmyvJlC&EN8otDN6Pn7^fx%SMX7rG@L|
zSMGWn8UB`8+&2FFtuMLJteg1-q#u+!o1fK#CU}}3)<Z_p`VOgeiFGohH9z7?Yd*!;
za-fpA;ao%7egy^wh7}d1!fE@#(?6XbY}iWJ()NQULee^afSi@qc>=kp@)CIgaW=AG
z`Q#K24c9$~(mS0+Uixu^`m5104Zqp>+a0-KLut^p0sJj`+#NSTB@Spzz4#cY9SZ5L
zhkgin!FP1>MGr~g$Kc{P?l!nr1`2xLLzDk{h$|N#gI0H)D9g|Eu7YfI77TbHd}y+{
zr-`8Gxeid{{m5$t@M5kVM<>^K%ISP%Knt#U7t_0(1zQf3i2OTInw{R|EdW|a&A^b>
z{BZI~PkG-z`=P7nn;#3Lb>2+dB>*ZVKtuk*2S925A4}<rm)AMrZVGtudw-g9TJvv~
z($_EdbEfSS0Vkjvj0_Af=TElql9%8-1D@FIa)wXnf+iH3uTReR(yjOA1SOVu#&SO!
zcK(*<4CUIO9R#Zx$~jsN@V9m{ye_t3=5MuS0z35JL(p&v2c(pGnZgK4lcyPM1o&J2
zFxYVLw~8@A#-U%XX0VaqZ`s0FE@~sn-%`kEBhKH_%m_+UVvH|8FoM$6Qbtf(Q#{3J
zBgx--j}bDf@+Q5*S>WXk&@PB=&H^?f{OxNd+juK7b?uuR?=8!ey>D`zw|trxN5G4J
zd(%6d1z*~Olx{B;N$-wk0=4`=Yi=L!?K`ZN-oe5L9$^$HeFbq;z>8B52{(b4931Ig
z&H~Uf2sAAWnTdIq-sLO_A|zgJWtd#yBU3MQ{befyc)s|XvjAhMQrf|X>}mYlK*MRE
zXxRaZ9OOiKa&H<~EZ~LP-j)LuETHWLX`QFinji6}?EuZuyu9}hoNfdHUVPjON{0tu
z38Z%fi@pS{aO2<R4X)myxs)k=a<>m>{r|mbkuR;;Aua~bJ-yUrhgoxb&w&^09S0$X
z2fR45C$0Gbf6K{I<^wO7(mT8bUhV<ew>=m#*^QC{)?Q27$pTI+)l3WwFHf+6c91AB
zmfM3;zyk(QIrWF3<-lY~-$afF4WLfe-kp=1eD$HzOKm$R@ATE=gUE#L1ZA6-uP1--
zm1TS|na@v}apPnyKM>o)&yeZJj>*-28VaB>p@0`tc7W7EmKr06UF^llhy5%V?@#{Y
z=g4?*vYo$-9mw$4);%ZEAj3(9FjnIs2A0>#U|s<O!)r+p>jH?y4{BJkMSvW;@yg^G
z{_2d<lMnc7GCgRR%pV}Z%?E1lx`9+bn9LWT%=DlDBs|$WfXnCgdQdy;WgT<c&M)Ai
z-G!Nf;bj~%DA;X``CFnG%f)RB`CGUcZH)L^)ER9AN=$7GO0r+hX0$QoZ^>b_G2?G3
zVYD&fZ|$7CFhH8odh*@?%lapX8hb$}Lt5u?wJxy^hP2LWpj6;318Tv`HT+~MQENF_
zYL(XfAV017L<4AIt@+u9wB~ahuT8;%oyXIfpM7{O1m-lK5CE%q^Z~SvulXG3YXQ&{
zrw-WL4=$xerbWQoGm{Gf-PkTZN^5?^G<i>;v-=aU*ETYPM&r_UUIFt!qe$S^(B!M>
z$DCz^UT$Pe+j#^mwI37)6B*Hpu#e{_y9KFn1cB|laB*@;kb;0CW7^IwU_Hz%3=A(7
zCoc)oV|+0Aa?r&3B2d{4PJr8rWtxAnmnWumez0LGj{=E95<F-ybsK0)5=R=SJ^L%*
z#iMI!tp_U1(>g!4oGj&mw`V(@1wd|;c`ci^a|PHs4;Iio1xnF;>oQWZIyCuaunN<J
z=ac^jn=$=*0HPS<Cg+7{Gk%#oE5wKK>E`Dl!OWAbBaX_XO~4H|Mb@)SZjO~<1u2=Z
zd0}ic`{ds#!u1Rc4Y>>q2N)O_GO`#L(is>Se6koAEV39Fbg~#g{bvRZ21y1MP5}nc
zT2p*#L0zr@ENV5N=JFt!3mUoytF1>f7@J}i21W)4#uE%o92{UrIOIVb%#p>wkj%iq
z@FtUi;YKC{!<kG5238W(vN13+)Hg7lU|>Wu_(Uee;5C^H3^Otr7<w`pKx@Ysz%B+k
zcmo3iLq5b2AP1*0FfbHkGBCtsGB5;WGBEHmFoPY;0y1|20|U&#K2UQFG8q_TG8q^I
zG8yU__!yWOK#o9H%mY>YAp@?Mfgh|kj**drkAYzU!Vw^~iy0Ugu4FJU9LNA0%pd?&
z%K}vki#lYrYclE~iUq-nA22d<2!IVnR{WTOfnh=h149keU?Hel7CdU#K-CH}uz*8?
z0~!(ySquye%nS?_8ITZ;G0k9L@W^0bu*qOx$YNk-P+*Q=!euaMunuDI=6&h!^ps5X
z4D}2Zj0}uS4NQzo6*PiUQxrTBOB9@o@{5ZV3{CY6C!d=p&0(TzsF#*(Vl?^VG%;aw
aJp)|>-Si|=qvS*jvs431la$F))7t<i-i2NO

delta 14985
zcmZqJz|^pTi9K|c&r9AAw#kff;uGcAmGq{!UMgXHcZi9h<v@u^T4-A5)3o5U&ckUt
z7#tWF{+%u{pJ*$`^jdskoOothbXx2oCI*P2Fp#oiX`PqTI!~pib^CIpce(PU9egH`
z#=re`8t3OU!*6}Z)Y3ZTco-XgGM4Z*{A4cSX*pTKwL$VV+XlYZOdGV*b~-RHF!UWv
z^H5vV0;2i1T~g~5Yh{>xkW*yhYkszF*AHoy2RHteW#sL-(03qh2SYmpLt5vv$?8nn
zIvQ!sKLq%v9!TTgb|9_u_?)zh&(oTZv&~KGJUl1u;^Q>N!)eWjS?9jyN!!mlxrnKh
ztvmEX8soLeub7nhK}^mI>1o}eZ_@bJADS%6tY*?3`yq|<MtWLzElBKmnnT*mwD14Y
z7*C`%9}!85PK!&62YX*Hty?UmAg%Qhf6JB0nauL_^Fc01PwRADk=A^GJ?-ERW)Nph
zdRn(XM|v9nc6Yw?wC>V1Y5eOyq^EVqvw+0}()iaO1{u!yA&v0@NW+HoE_WUqX8sl}
zCL0$1mU~P#O#ChT7<(?Hb-tUE)_iQs-1M~0(ghH+IzP@yJNS@!ZW{mg`U7bPAFzOg
z7o;(QYzW;D@IvEnn&APEsY}w+x?Mq<7(l!g=?%5>`AgJ6k`1-<LBTgC?c#&9<^ybV
z`KKOE<KK3BPFnVDW?0DWU}a!nNZSo2cQG<BFm&8ZyZk7v^BTxO|G^I05S+FTEORjJ
z^0PEQP*T{CcJXI=TBq-nw9bQb(im^f1-W5G+T|AzNyQU$(y|XQgG7C&fP!FVdfNBe
z4IuZ;0ITe{Ir%J$V*QHrwC>mqX^J=C%44UbG2TdnC{Jts#y|C7dRlYs3<mzGhgvR{
z$fva)D3MBQ{>Q{W^<Y}_4<`Pphd54^3V_uxm2#vRUP?1O`I;jQ?30Zg>1mdsGeEvR
z_?Rip@&YI+ah^!yypd*kjeqK)wEByW(!gn?bV+)Li@8vG+J9G2XqK)?Ph$kdLv!sC
z4*u4be=oZk;Zc-kcso6fe_M#W5ZEUHFOvVHr**QWIfJ-s(io4WHUH))z0(6qd%kNx
zQJBWR9UOsao$u$QH6PzHH?8x~oHWK?bL&A`HUzwI`TbIx5oBmM%uInlX`L_Uq%|Mh
zGB<4(2Ll5rY8gQZU`-n1$270f4{4pB=cFBc%sjW}QX2pEOKArmv7~jrn3L9gV9VSz
z#zSeHH=$;~_ytOg{!$<=D1n|x(}YN+G2Q^#4@yc$f2HjPMKDOEyG)wpVgBAZ3?L4Y
zw)C`acNS2J2DxHG8smqw&QAd^x__lPzdiv{>MjS81jRKdxgP=vmCJz0dbrg;KyKKO
zW_hSsBCYeooU~@!1OMlObfu>;x^4iu`upv))^8<BX`P_N6$;8<t{VbgsQ&^bI>y)y
zpxnGBjq%p&n`zBQ5+)l6NKV#Z7v*UF$5ATYa<X!=E4vGKcPUSLr|XCGPTyyfr?Pu-
ze@Hv{fLoP8A+7V{<mc=voZYq0(k*L0m6%Ny<<Q{kc72n^csM<++4Y6O>jRTLIC@3J
z({`{hFfcUyVlGkmb}LQtKw9$wrpX^U6xhSlKqX?(WD!oK`ck!SyH<wg{~Tr6X`P1;
zzUD~lJeJn{OrqmfTJs}?^p4QaX`P?axk5jedZ#r%kWXuVY@g<w#=reLIPRMdF@ijP
zE$!eh=Csa>posoAH_h@!iC`N4`g>^ye>10b-UNyMpPP2@AxD~58vnLSX`B}WUNHYp
z>pYa!DR#o(Kw9$&uJ>u3C(;f+;7Dse!TmlhVsfCe_+&YEHeOhH^&#NJzJHTT6?B>U
z|4m+^prd&Jl+1kJf($wMh`sR<17q632h6GrOlh2;G<h+t`5?$?+Ye6usi4hd_I0wF
zqNR=6KS+fD4uFosY5Q(5g9_<SZ_;)i0JBcLN$Wh`apPUuu7k`B3~xFPr*(dMlh*ko
zt@G4m7Op_+^Pte#1=5A2CB4J-b6V#In5MMvm(vsvgEVp8Nb5ZHF1^e3^SiV-keBK^
zFM|qga2W48&dk8japGNC>;Dqfv|T4b_Vpc8OYdNQ1E!oAp)^xk^I_&R|JT=$3U-J$
zg42T1IuC;~DE~HZP-S)?EsHU&^VOWR=0iW{2E1tbpB9<k<@z(d!&x-F+x1sl{e$#Q
zX9-YQ^(U?K4Y-Pcm;?@xG_dPRInp|hr|micbsgAYpu{ZQcU&#Ki}{^edY3aJm}Ghf
zcA4Mn2N*63O798~P45W(o8BED(e^35GxT52rS!CV{%sy0cOF8x^Y7e%7uEmMB2nD~
zN}qwCs-1uPr!;7I8y-m81&XD2;98sUUYg}S{=RO8H2!U;doF;BCb;Ln&JB3c`7bRB
zltx^?rez=S1+hZE)u&}%nhvTaK-C!kw$Sfs*_UMIfHG|3p#}y9hPi2-7t#*?;7Duy
z_1~U>p^PnUhdrpw>Tvy@-r@Q!y~Fh@HmmmhON&Tzewp_l>eLMiP?z?m{Qw6IxGB<k
zNKZDsi=*XaiE`QwP$>m!X2|KKcR8`yaDdYJ<YaCarXLZLS8{6`2c~r%40v(;f6IYV
z^?(=AztTDnZ4iE!=JY1L!}WJs=ZSz9DZkP>4}!eq`Wuw;U+Yh1<I&>T2`Xbjt%09u
zQIj`n3D<){G2n$a$e@sb7x#arbspTn14@=@o##L`Bja395>M}N{j`A>BK!$t$H%nJ
z8v!rQf|P^p_yo$FAXezdG|mfY2OltjEqPrIR@eOx6j%GtF)}cu?O+21aObc0Y5UGI
zGSoAqb$)uA)_E{(2iRpG@y<_g(>q;1rS0H^sRSwE-~J(ufBQjDF`Bj?tafJF_y1}9
z>yJVFx!v^>SPm@8cp@zd9I}vh4!H7eK4>sEt@#IMnK+aiJ~ypZ_)-ZclxsdWjep<4
zm%rXm_T;??4wv+_&d?75FBpD+ay7`m!l079_Cp%~`r~Q)L4_yClmF8?4}uFRp0v(S
zNaYmo`+ygke_IZe)Pcib?;l)Y00{z6-3e+(L1L(WX4-d9;DXu#_MqzI1IQ|HZSesm
zv><W^A25UDe}i3s6mBQL0)_`rLj&A024$hn%K<MOzJr4e)Vygv$UZmVh0yo3&SP?E
zyTM`Hc>-cCr05j}8yB4xH<^!LOmNx%fESj3S`L)xq;-A>cyadkWK({%V8a98fCndO
zxJA3ct>eRL-Ev+GYTaf&3~Bt^zoqeSJDJA6{v#-Dr!gJ?wJ1RCZBPxszy5L><E6CD
z3v<#KKg<QSq3hFv!R09bwwn#V*~>H2I<KYe0GoP1Z9x))#f?(yj+>yOG~h)AC`JNa
zaD4+6RGlZ%b~1s|5i~%-F~ye#PG_(hh5tRwsI-I6I6$e`^>Z5MF}3v066t`n2(W*c
z<I`d%TMKCM%KT1G>vU!Td%0tBkwB!zcb0Nq8%F*X7A70!5~-IvSZ&z&TQ{+$b>8Sr
z`vTS+pBDSF<Nf5%0tS2+7#e=D@V7WJHvD2L$(?K{Xu+|c9pt{wpOf<h6-95SxurG#
zV<}zvQjRgr@Eh2go0FFa`qUq105x^fI$hs@;`~j(i|T(Mr#cIzclo|ayZj@q`2l0v
z_Zy(5NU%(LT6Z-|dRk}gi}dblse|vC(>rUQfLb&k(poQ-$fxaRSn&UU-*J#)-zRCE
z-#@QP^8!^pFVYzQy}ko#AHD&#HQ%t5PI~PRQdKMnYWI8uMUvtFw9X#^FaAz$5z=Nd
zcs+TekUHb;$v1_x?O^?l&Qlj(fm&-26ZzL)2X|^1uY+3IwI9;Ef_WN#G4r?RGlIk7
zJt!>rTY4wk2+PP=^c?_s?}J);mq3~!s7LfE4IV&+!jjC7U;dliD{K*dl&Rq%V+m(^
zTBGX+1_e;VvAOmQW2plu&<qbi^rUx%FbkzMKVnSl{F$bC5Y*o1yq4yW*8GE`^l{n_
zh8_R^gRQImkk<J@Exm*NW&UJI5i^e14{GV1%r6Zmhl|*{K|FOG<d+Yi5Pbrw?G)1X
zgLNNI>%0h(dGdJ`sO{G6`yxG!(f7&g+v#cD!7}hrC}x>_T|`YD)X{2YglPqJA>O2Q
z-Uo$!8sq2J4<^fr8c9Q}JDwJh*7*_C4*UReCj&#ki_903GeoTgyJJCpy2EJ!5b>8M
zCT|o~W2~KgL)5`G6BJX<GNA6qhxBe|sdP|c>2elI+YO3tP=tP9C~@gK3{vL%Cav@O
z=T+%x|9wBCF@AdeaB_f{I$OZ=wB{o`lMR?;>NUWn-epkl=S+Hs>t$FTQR^1l!_a!E
zq%w_v`>(XlU(n|GmAL^gB7dfJ-bibH@FTs`^%2N>XVN=;pQImieZYvMYSGWM=Ev-5
zogZ2bR7&clce%6Ku$K#@b$&=|eo&uo<RbeFWSvxcm+R&94iN8{>jNev{mGLJ#N{;(
zBbNXmC#4x4XuVWo4N7-V#W&^#yjVNAL|lRY_YaVj>0K_euhN>2C_oC7<~KHJo#$XZ
zceQT0RtB|hJ}*#<;g{uk{^p+y&A$cs+dnaY8j+Ab2gs9#KOi1D_#Bj}9)aA=zwH43
z`orLq_dmVU^@-)ZVrQruKsxe%q#2$BW!|n3-e)bBO8C?EH!##QFr;1npT_wkt@C=C
zV_Nf1j?xF|9WJIvK*|3}nnRk~>#ZOYK}90O@*{K87;k{$b`Q8zIQ=?}fBTKJgD(U?
zVh7TDLU%#?Qb*>dr&;>$DN#@FbKRwu-X)mc=XwCtII}oZ!kgxn*7%QskwKNAbmwcy
zG{-dO*Ox#Ut@Bd{sPA5TAiXQ~z-wlZQ1cNRaI3WWjZRwUvGfk#6KSx5d?7TLj`KH5
zf_rqX904yhUV~h6A+7ThlIK5tOM`|~-(j_dt)P<s2Phkz0To`cC-~RjNbih&l4kfn
zy`h$ep;AOIy~_=hAh^>TQhDmr_Ji683~7enK*4eW=GznLX_lpD`1|HDr1!akyJfBy
z)Y7|T3_t<h`oEMXZ5OD$1{wr-Z4ZeqNEm{m<H9$PsvTejmw%-3Z@Zk<3hpw43QuKM
zo^%5j-e=G#x$#;t&7|`JsCaF?0qR!6)N~-!+y_~JoIne{rMXSEmQt&SbdS!ZcQJq(
zQ0ZO4jOkt8Oo)tRw}+wie@Q|b|MvfS>0RtC2TG*V!a$W+T0qCe^sdlP;DR;;)O?J3
zZJFNX`YGVWqAzKkhxF3B-MP{mYB?B6B>E13lHkDy;EJmhT5%b@=IT4Z0y1jyGbw-b
z3IR}PI|v56c>5j{M;|~XK%oSvB$H0dVo2-!*>MXRXCLMUym$+;(eL$x$p%bPlQpGz
zkn~T$q90VeqUfK1&@VFit~9q0|F)ZmOa#i7j+1{$hqFa|f#t@@*)n|fA3@`8=^d``
zKoylhdY7vRDA*9eCAWv6^)`P?KPU~|)=TeVZaGjQ-f<CJ2HgOaTky(O=)W2`g>FBP
z#t0redXct+ft`UNy`lCKLkXzt0kv1tnolTzTAHA+DSek_3#!#(KS6@mnJc{$<PiRC
zu^&OfB$M9f`Yx^WW?JX<^lsNrpI3v6d)F6fjE7#|2iZOOjI^XR|F&D8A_dfQ1&>jH
zyn5pkX#66*GxizC9#;-fYaC=N++Uzf(fN6DzpM${n@_L+NlOa{wRh6HTsc6201X*X
zjZi88*Vzq8Ky}Co2sE-L08TxhL4C|Pc$kR&2RFYUy`$Tpq!I8!cCw|MoW@76p7gZN
zSRRlQV?U)a-UjhF(xTzIWA8(H-Qvw}I6&><H|bp-66qbjpVGTLB-1;5C$E*us1N;|
zrg=Hd88n{Nca|Zo^)`RsG0^zRwhEav%is0Ppj-|esQi_-3*34;q}Iik#E{<M`zF21
zK`_0;^<!G=|59#H2QVNlI4$gTS)CQgADV~L!a;mcV<){U^fM$gIQ#<zJ&2#icq=U?
zi!r^+^<!E<S~w^h`M!B=2bSvmk*0YlEj*3!H^Kx^R$>P0PJ`>}{E_zkMp^(wFGwfE
zl7c^J%|`?#8!(AX{wr@P?U~kj`1RxTH2!^zEeA?C0$v=rljivPJ;))TdS!Bsq65>?
zpOe=q+A-bxGx?pO6zgxeenllo<4-R^Iq*kX76Uxb{Foc?g71G?bb6QXuk^0apXpt$
zKLTF3gYrQvs3$%-P(i#t{g~@#hV*U+5%922moq4^KBadTOMvpSGf#R~ut0i8==;`h
z>0RD3C9dgx&P?D&6lgrT`8ea;hKEcgLTc$<9*pT7zVE>;vgYGVbHUyR@xciel>3Xo
zxi_uz$Lr0YCYDrs7buoRLP6Q{19Fpg>RV7l!I3Ae^Yxsx=EFRoVNh2Nz4R`ImIM4P
zJD6-#OF@GPuAuP@NMADjnClCLG{Xb071Q|l9e7#B1nS=yOg^ciP~Ukzt@*t{TIbJ(
zpPXf9U-LKoGAKO_Qf~lKe<jWEWW%qVQl+%c@1U_o#<_awU15wMA)d76V@!JKU1A#<
zUo)q5{%iP^0xBcw9U6Y=@wd!mtQTqcrOMy>k}++EDg&q?C2;HI2gZh95&SKy85({i
z^S7R3OzVul2^xlCnG1?n=71M(Z@xUm*zl{Ezhxq0y?Mj00{+&OjA@<sL3V=_bxWu1
zFaVo&_-5LU3NUNuO;Ei89>q-Syzx?;vEf%~iDAR9iW1kCIg?kaDlpaDoP1hUh9%(7
zOS{RhRpTWCUi`d~<_T)$y?Ff+)L!}k?kc`|F*#Yyras`sk{fBBuRlX2Zh>mRHvuoE
zzDVo*{W>=dG;R(W!~#{Aj5fuk(P^FcK%oqA9@rm{^ci;}&H45Fw9e0Io#$SgLI>O+
zs-T6aEGRYtUYLRuzJUdkj5=rrp_Bs@sHY+0m<Jd^EqGUsmzI+))#W&hLqWm$=g;JL
zbrW`LFz3MJS?ZScWngv#DBmbx8BJ<_1L~T%{z(f;3rx${2v!^nQp^MLA}GP9#lAH7
zk394g2r6?vq}fhOXJ9Dz1NEeBnNk@TikurBaqzcJW6(?Qa^OkZb&Q#T;ho-OKMl=#
z&&O#|uNBiWj)4XpGHfCk7}7HKfvq|M%8xv0%_si9oXnWk`0qah14F$`&k6V#(Z{r1
zHL)PCu|7_VNOOCAJN=vM2c{C<v|S7!!we4uyr_Dt2kK%er5S$HOYagf2aj8VdckWR
zf;(^`e5EfygY-K@z)55JW+qK}M!tpukg0p_fXa&3*FYtTQgB-5LC`eJp9sCQg+C%d
z`9VJ|`x0MT;~|Df&~ORE<WwyU0ftltP_1_<&GKR?M;a^B<hfd!_27oz3rNUxo(6^8
zhxAU@XP_4QoAht4FBth-a+uQ7_;;ng;NWkTVGMYobr;kp-gN{tn3&$@3hMJPrgi>$
z17$lhrtLb1B<IKk9kEISkF32>OYd-GPTO?~q(m*fzQd6Pl;Zb+j7#f00UDGC4;Q^l
z+jSJAB)!k|nOb^>3pZ;TsDaB;dJEL5?ED0iS4;13<^-A0`45zE8RvGKNbCId4m{ul
z)5-<bDp~pj)D{K>@U(j{W9yBTAz@wm9AwBokjp_PfXqLSV!t`q5YEzvYU!QT4rzu5
zKsGyp2xk!C0wP=?0maGRtiuR04jf1jtGYlw=sbq-;=yMeX`CPG--C^1DZK?6^W+4z
zDBi23cUL>4?GOa_=zqNj8Pxn!u#_!rrx0kM5bUci7j7<);xtZ>cOiyImR?WWbq3_<
z#{XBC`KKI8Yku$#G?KRK5GYB5ERY84X+9wc9=tI8mR=7rEyP$Ep8Ag5g@(vuNQ`!Q
zGo!>HXgt~QWEwcA;C?d)8w_&HCx~M>OCN)J3u)jW01xGY5(${Wl-BtP%wS3DjQs@~
zNM@V+F0JzhDDK_Bg#&1GqVz>t^D`#?7JpFJ0FwHeK`r$UkV-#orwk~3_IZMW1T;z6
zbEEIp=OukNK#m3_W6&u3<lDL`pn03xH)`pf?n-Hf2l@`ErFDzdFo0C4rKfd<tAIon
z@-V^#+%@2FxPc*UKe&By9AX)$MfoOeKh(z14=@{Hs-U(W1EoWmxoJDWgOvLx7wL(D
z+~E2~Exp@838q+W@h*lm)&Gp3%zXTJ-*L6Yd%%tY8={t;)*YY%b#5orxu79}Hz1jC
z4Un5V#dsLg_US;p51N_z0P0_TbA7?W-?AChU;>3%aZDO$4q)<oJr^d9JCjZIU6|tU
zOs>|K(Mr<<cLU$>cQ7-8@;L{8%P$64@xkBn4sJs1<c-`SllcwUQ`lB8me_*l(wYx5
z%}v`08edL>49GVBWGRsXO|O8)#CDx$WMFs;NgAD?xl<-^8s{nnjVtX+eZg5=2?_0P
zxo?LVOTcw6#I)CrlQ(h;o1}H#c>mfRVnDYY$k<(=Vc+*@V3X52f4m1(*APQX<kOme
zvXou|X=DRyyg7NJfsWoANRbwhmhl=~U{Cy<7L^tW4&8tkIX}}{5Ae4{v7~h#1N(V0
zx1oIfpNO=^e@u}K3`L4**$4R2SigV@e9I3-LZHI+M+B&}PiwtYD*2KZG`}1Q8t@5t
zapxPztkz%5FQq^&2)6VN*B3U-rJxpvUV8TgP@&uWD+^rUrZO<R=1*%rpp#~MfQf;j
z^ggI4GrSb=V#c@En(539wJ#>GG?cDa$O0t_nOkWQdg)z$Y-zheo=@As3`*~vx8A4m
zZ#xJHiT8Tx-F{4Z>D_fKkkS4$kaXt>sBGE}@Sr7F><3&7Jb4Wg1I=}SV(L9)4iBUk
z6g(d$2O0_2@4f<>tAdt6w?HG(2VXF!d4O|y^9jcHY5dzSf=3W$+)L~H0m`|c**Eaq
znh?mOH2&?!(>y?<%m-g`q%}WeOuP6njepkz&SI9d=93N^*wc1_Y<QQp>nf<gN^5?w
zH;wbeJLq`*uE`gSR5ia}PumSDkJEOrv4W=1ZoN<253VM5F!6)<zuu=e)V^RY379Nl
ztR}hQ`UVzo$q%VF(wa|jyxYK<)_H4ktg%Xc9TUh!phoi(z4UH37SP}lsICTyywFSU
z0!7<Hz4Wd)4oJr+J*~0!4Y*S0=sS?!<@)9|OW%PF|J4?GGQb9Vz=5U8@Gm`$+w~17
zJNF$_>onWL(05R+OKc}YdY3C`I+ZQ0`GG^)Bop5HhYY2%ASHHQ41EXFyIdc^*Lmz<
zXJcS^Z31e9vG*NJ<KG5aw&3~%G;01&Z81oB8viy>6VCMoSPZVw@POLl1W-=h=K2uS
z!UL@+2z?Up;@c^hBh?oBFa*5Vd%5o*m)hcF$fA<NljoYm`!q~~wgxy)L5h<ahKApK
zC9(~_1xnN!esh$tg4)dXJtxx+J`_mX)zHVl@LCGaYhYk_%>(C6_A@oF2L<Jav<!yn
z3=C-*f54gU^}DqAw1~8f1=B!c(qW)<ef?cpL|Rl@#v4%P%FqOh9e$S<nHCKW(0~_9
zK5jUi2C1^rcCaupFhJ@Ma6PyWoE17DQxdyDsW)xMferuvr*+<{2PIPQ+(PHAx3&j1
zl<=ozn1D@BdzTjXav>wA905(P>^KV1@V@6n-vLOuqn6gm_XE^;nlKHVnM)Ycb}%q7
zJWxwpoKldsgA1JVK=U%U-liRV0B$mUP)l2!QvgXUYKs#J)auhZ`7#Q?en>m`LL@C9
zEdyjkT1GC|5s%)28f<Ah!81Nk4|Lvo3u;Qict6sbPcVTq4|wVh=9lzN*B7wd4{<|!
zr|T1#Z$R_Lx8CceEd&)`;8F|J<O9XUo3wopCTQN?@)&>f0tUVG?l=}u`ey^Be^7b@
z4GcVhHq4noJ;-Zd7l9TW902hpE`nypEMs33S)}oAKMbC=0<G#n%$|XIj-ijz_(Rqo
zO5<ODFg?xE^+OS44B$b!W$cq;6}|LsHc(yz1<6EkU|fF#if?fEH=p>gmfp#h)_jcb
zWypWMw1pF<fgJw<91k}pe>QhxdXO^N+Crv&K`c1I9!TRn(RWBKZSjMY^t9uyFB(9?
zyFrqmum|O3fi%$c4``gcmNCunfL?lc2dETI<KKQV&GJ-fY+C2BIcbf@Ky80eYoqjy
zUV8Tq7D(gxJ7^dKR76Z*g9v=mOYiCcDXmZM@O=d0aHWFBfF3cFDuaE{`2#eep5~>N
z-Vx0B+5xG2Z+rO{)TwCTOl4r`In{S4jei?x@(+@;|ATe$Z~F-vc>_;4dVrdcjOjhT
z57PTwAE>2wc!L_=+gu-kNAU%_K{?wVG^6Cq4D#xm$@!LIDrw!J4`2-uuqdb(BL%Vz
zWEv+}Xz~h6MaDOiPg$xmzM1^NQrG`M3IhXwYxF;G?*defr>AB6e$Yv8-U$jQ;d0)z
z&g1D_z8}&qKTqTQ1)9nE03P@kD7^;qvRYcFSi>~XVBEn+0%<$ECns8qOs=w$)PKRC
zmfjV>n#RBF7if6)LmFtv`Vy$&@*&OgS1~_mcvT>+^L`rR&ormk&nNG(QWaht1}YmE
zK>0jl6*zUQn*7DeOZf$u9r+SeT7WD~JNTMKty69a!rtb|iPlQ$KmLJb!C6KvZSjO@
zpr-jEHU_-~OrTNt3uy-*ai$p_n7qQ;jOz$PdP9W(BY*qu$uF#x>SsXL?txb(q&HLw
zFz`=3oZe6=$WWpd@M77;mIEcJEw@V((;(}<kQ*Uy(>onSUfZX47m5VDr~#?8Zn<4*
z4s8xW)PveWkTR<C10-8R>fT@P(>iaxwLCU?l8sCKL)LOd&?+})R>%ZkAEOOZsmsgP
zEa?rk?^*a;*Rj5gWCgLg_*=L*%0)p;cK((uHV}h@zeR%m<x36_TY$giCp(BC%HI;p
z@$w1>DC$3?cNc&X(e?nAzGG=S!ClYJ>uH7uKCkLKmbN3zb#j)iR6TPzJZFL0#7=B_
zX$vz7z)UXi{Au$6rMYRH-_s607f1um7jXUtNk;MMrFF~Y6r>$|Eufa(86}jqTO4B2
z?KIBQU=?C%yS31Sq|$cV!G&&uRHb^!r8OS<$H2g#m)6Y(>cn=-fqJpGOH9(TPx7TT
z9t4$RX}iIs<>_L%G|LOcl6vXg*3JL_mvHrgvV;X_;Za)iVZPUQL5a@tLa}OE^G|^i
z`LyhtI(q5dvl%95*eTXu1LvF%>D>-Y;CZdIZddRyb_948Vu3_jSXzc_IH;Opdj?8)
zX`LS$o-hWycmST2c#+n6pi~&7CIPJG(NoYW$d@|o>3yzmKy5i_0N?+-O0SzQp`iIE
z<0iI-TmM1QpwfY9GMBvx)9v8N4)zK%y5~R{2-HmCUw;U^QW7$251M11TxxG$@4=Sd
z;rk9$41gxMK%@W9L0MWlz037Ih#{w!wlJpvGzkvMU=Pyx*MCoIJof)T1B2l=P{#iL
z4b&lMsC~{@qL<!K`<%JN7DO?WdVo^K3%&Gi2QFKN4g4+QY>*{@X*={87#LoPux;Q_
zOYf+6mPy+MZb0s^1_}RTO*{CG30&lY>oCLruVwVo7N!({$_h|H3@S&`cI*b#m976v
z+0ww;pe8r|1I?6_bEP%^V=U)Nb9>E}whtr%37Jl25S`xT`U2!H2}pJ1ci{hA5LXry
za#9UHB}#(IEgF9Emn5bibA88<e$4efL&HzdlFc-awB`qFX`RQw+(T(zY0ZzgLF_39
zKuaZA=f3uB_&NEVgQE35(0YVT0vkA9%ct!FWyVch8(3cpBMbx$5P+6N9soHAWV<}b
zcJO*QFGp>Q|NJc%7(hw3S|iQyKbWBd8V)c3#{h_BlxBDm6lJC$&1N9Y=AgxNYaOlF
z%fV@8>*RNi3PSfl!?Lv>(mUK`(~r5!_`g({tl%V9-w9R{_Xw2qK#}y}<whnj4XR`V
zz!}*?0K_hkNbiaeY52{=-`>dF{Ewf%y^1-Ff7@Yj`<(Mbz>8W?TIKIZVQ#ryx;5?K
z4>phsKcsiM3%p(iHW7IYR^=yHD80U+LV$_C-GCX=tm!+T)(xF5k!1!C`FGw3crp1D
zC|Q9sPM3o~%Yjm5h~_l@?G6&)r8J=S0U|A@bsl;hWW!YA3?7!ee+twmXg$E+aSH0Q
zP7eX_pvb`o%#&T5h3az(z=`)`dZ)X{%f+B|oRBOUAOSW&;v8srYuU>>q$x0{BeOwm
z{M%qv4^O6n##(L!yhuC+YS4fz^nqH~<se|gSmM5-p1;)+Dum>Ay94ZL2*-oE{NMs2
zOe77o1cC7o*!c7_pyo+Sz`vJ27{LN1r$7Q7uNWuab5;zM`3Dccg?ku4J<Y9*pau|V
zR6DKt1)B}TSLK}P#~oz+nO{C<Ob0uPzrB~S<v=N<Aq<*Di4Y8U5pxnW5MIJKc_X*z
z<UAJ<Hc!U1=93Db{w`ly=ZW_LFL=NzR6r`kbrqU_FoM@%KKPf`d;nAlfRmYETIUb2
zZ456h8Pj$~fEwSsY9@bo)nwxOJ6Xw13pCH*=O$%*=no`1!Esx{_U}ZA!s{r#1qt~r
z2TFtV79{5XJ5UN*<>C4v{kVewGvmvNe<sg%Q%_CEXJAO%3Ch#3*2v3Hs8JwKGQM_B
z+vx+gbu%Mqp+&drhkzGypb37kNiqzKuN9$%#SV2)8DjV!T-Ja~74VAcmu9~}Qw5V1
z+<EHFnak^K*!Wv`n999DwPzAzIX`Imj5(tX6MySPhL=u^HZ1(DIgDvLAAl{b0S&r>
zl5fw$^yAJV3=HYVoh87e0GO0vV0c-^W5dbcV$W30Ys1dpdV(>n`PBcH8yIc4_*<=+
zP*&p9$G%*1%|?j7<q1c*kqtj+b$Yq14KIJ|0dO7-76Ii^XNiCp2QH;|ILo}0<*^Y+
z?{b#mZ}nt-`H;y*n!n`{S2@3pFn>!HmyHyEODWgOJKQ!h{4L$wHvasr7r0TZi+vgP
z6_gx`Wzsr7rZqpTuLo7e&Cl!M$*fDPlOe775m#FCDaQ1MY8i$~=7w_(8x+!-pH-9!
zH2h@apK<_POnyvjK41@WQ(ET_<RZY}CB(_dVqXuWcX<n@cLj^4cR7o^oWcONZt@xr
ze%DP$(>t9-URrR2oE9z9@SB~#U7H&|zSV8EhoSWwe~Scn$4yX<290>HISHxrj)4bf
z0$#|RnB*zxI}cpyxq?Tu!MVx#D5#J)_!88Rzk=+d6(^xd1a(<dF=$|Eo3miR3(ljH
z(>zTCvoCgl8rw%+D}X1zKc1Mp+EY&dHv?Lz-oKLG<tzxA0RDHPv@pHPSs-mUIK6?F
zCr|$BDIYNDAY?gzTJvK8(9G>F0Z`fmjUlf*2p%S7DSh#BA15eYz{}{t?(aL8=A732
z8zi-uGi~Pua0<M^$iVQjd2*tcyhP;r^sZnTkbTIW+jn#F3@=@FeNIrq@|%3dOTONK
zDZR^E0K6=|`5^~nar?^%Mo=<6&0r(I-|~mShJ(MAlL<0f{BkvejRb$oLdJ4Y8&Uq2
zR7M+d{+0qpP%>j>eEFCWl+q?Kf>PgJMjJ`~){Bgg*^W2q9nJzT=YS{wods+}_}eFd
z*^{%pWte0SOz!ZOW%{>&@^WwaP(6--7ZdlVcQ^~aR0gTpUM!N{UCoqc2q|~V_JdaN
zcCg5S13;kk6~tiyFJd7QZUQggu%pES!@<cqJ~E<{4!mpz4`mb!rhju5U@TPyRh$t%
z3Z@zR({_M@J>bRDeJuwnSkewY0}UakH9z7{1J8}TeDx2_%!m6yX1eC@Pm6qM#10B+
zh)>_WRAGl1*0}G$3-<I5*AEaw0$vpCOKX0>pWYSvq2*F3^MMyk=^eoWFHcV9_mvc|
zJ&?BZ05~2im>3vd?woAlTfx!L0BR|^?wY*ASDyniFT=NM@_S!Reu&K7ouEGd%R8)-
z_xj1mf=5s;gEEV=0JxrRKEVtf+IYEWa)O^MW5eV+KSL&;os&2EX>fp)2fUEkIr*WV
z7*pEr$v^!p7%xmV@^_3bEMQ=G9RVF3UdY1;%2Nkl2)uUfIgz#tWb<olFbgzdV+dn4
z9%5j5tqkUYv`d0m1t1nbs9SyzoCW7!oqWz;osnnqH-AmWhRF&6%1jM?lNAFbCdUSF
zF*Ou`nDwBT0IiP-c%ioe)J}Ps&z!b%12||LnHd;f`ZI%q+s2r`C6uvT+{Tc<g_Y69
zh`&XN(MF)e)W)DB`{gu78&m$4bVeI9{+4`38x#K47Djm4(k0f;04gifKuZyuAN_l2
zhLGzPOP&;{Q-2jv_jmDiGNg5$SL+h%U`Xq{1`b^r8^#g^8>SMamII|`Y0VGw(?IjW
z=Nr<RAAJBV_-a1K@mepf`FZ|pZiK7=LYDKj04PkJgTv(V<+RAO2$<{AI)AElOx_Ua
z$Oc*vc=6HX?}5(l3&5UV#|#=0OWQdC%-aeYJ_Xe`tFEOVbCwZ$xtuX=X9HMj4=9w{
zLG1?Q+;4Yja$}Gh2X6!@Ngcj4d3}(AfH`B@&H}I=1{MZ}m*SJ}2k9|3Oy&!oSf2qZ
zu7km~jW@VO2%f^<<}3qB(9QqY%iV35%ALW<4AdNCy^+>>pu#x4q4onqDF?Vc*y$_)
za+%C)*|eQ0U`t$CK%=TC3r>F{7r%#?7=Hap3rGu03!1DEBE^*dVscH08PmsyAd0bk
z^5zh2#wnBUhxjo5+pH5B%*>cJxjy3P=7h+47RCva@5IV8PT0&C7tKC7I#sy-KZ8Op
z1H%CZ1_q8S28MJ728K783=B6i85quFGBAKjVGRaJ1{O{M28JE@)q?sc0a(<Y$b^`?
z2FYB|7&=&OJ(|JT6tgfeGB_}vU|{0l06XFV)WIt<85oio7#Mmo85k-u85nXh85mee
zP|L=^$WY(Fbb^5q&EO2E!9JM`3>KLT3_6(%pan+^U>AcNyx~8?f;>p5fgGI1z`!7o
z$-wX@gMr~g1_J{x12fpcEFg0i{AYkU_)P}H!51<Z81`f^Fl@+RsAu3~U}gY00$uSM
zsNx9-#SHvlwQ-D$9DEE63lNR~sa?##z)+IGz>okjm_Y!lmIbO77R|_NeKP97u3!)Z
zD}KPp$RPkW7+LXS1_lO$3<d@nsKG)|wJdnl`asnRGq8X|f&&^7peYpwW(EccsOSEe
zrZX_SNM~TUlg_}9#lXy<z#PGZ%isg)3=9y1H_K(b(^E3mGtx6uFfuSQHZV7`P|yfU
zO;PYjEKzVS$}cWfFf`UPnyfcnn!`ZXST8Nv*m82<bTMHwJ!4%1-SkAW)D*KMa|6RP
PgT%>I)7vHs#3cX#W^OFR


From 0392c66b05866ab0483595d07d63749ed58e309c Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Fri, 30 May 2025 13:54:54 +0200
Subject: [PATCH 1506/2760] travis.yml: Remove the aarch64 job

According to:

 https://docs.travis-ci.com/user/billing-overview/#partner-queue-solution

only s390x and ppc64le are still part of the free OSS tier in Travis.
aarch64 has been removed sometime during the last year. Thus remove
the aarch64 job from our .travis.yml file now to avoid that someone
burns non-OSS CI credits with this job by accident now.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250530115454.187727-1-thuth@redhat.com>
---
 .travis.yml | 35 -----------------------------------
 1 file changed, 35 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 8fc1ae0cf2..0a634d7b4a 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -79,41 +79,6 @@ after_script:
 jobs:
   include:
 
-    - name: "[aarch64] GCC check-tcg"
-      arch: arm64
-      addons:
-        apt_packages:
-          - libaio-dev
-          - libattr1-dev
-          - libbrlapi-dev
-          - libcacard-dev
-          - libcap-ng-dev
-          - libfdt-dev
-          - libgcrypt20-dev
-          - libgnutls28-dev
-          - libgtk-3-dev
-          - libiscsi-dev
-          - liblttng-ust-dev
-          - libncurses5-dev
-          - libnfs-dev
-          - libpixman-1-dev
-          - libpng-dev
-          - librados-dev
-          - libsdl2-dev
-          - libseccomp-dev
-          - liburcu-dev
-          - libusb-1.0-0-dev
-          - libvdeplug-dev
-          - libvte-2.91-dev
-          - ninja-build
-          - python3-tomli
-          # Tests dependencies
-          - genisoimage
-      env:
-        - TEST_CMD="make check check-tcg V=1"
-        - CONFIG="--disable-containers --enable-fdt=system
-                  --target-list=${MAIN_SYSTEM_TARGETS} --cxx=/bin/false"
-
     - name: "[ppc64] Clang check-tcg"
       arch: ppc64le
       compiler: clang

From 6ad3a47f15624176434490e895ac244375322607 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Mon, 19 May 2025 07:47:44 +0200
Subject: [PATCH 1507/2760] hw/s390x/s390-virtio-ccw: Remove the deprecated 4.1
 machine type

With the upcoming release of QEMU 10.1, the s390-ccw-virtio-4.1 machine
will be older than 6 years, so according to our machine support policy,
it can be removed now. The V4_1 CPU feature group gets merged into the
minimum CPU feature group now.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250519054744.36715-1-thuth@redhat.com>
---
 hw/s390x/s390-virtio-ccw.c  | 14 --------------
 target/s390x/gen-features.c |  4 ----
 2 files changed, 18 deletions(-)

diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
index f69a4d8ed3..ce3c13defb 100644
--- a/hw/s390x/s390-virtio-ccw.c
+++ b/hw/s390x/s390-virtio-ccw.c
@@ -1145,20 +1145,6 @@ static void ccw_machine_4_2_class_options(MachineClass *mc)
 }
 DEFINE_CCW_MACHINE(4, 2);
 
-static void ccw_machine_4_1_instance_options(MachineState *machine)
-{
-    static const S390FeatInit qemu_cpu_feat = { S390_FEAT_LIST_QEMU_V4_1 };
-    ccw_machine_4_2_instance_options(machine);
-    s390_set_qemu_cpu_model(0x2964, 13, 2, qemu_cpu_feat);
-}
-
-static void ccw_machine_4_1_class_options(MachineClass *mc)
-{
-    ccw_machine_4_2_class_options(mc);
-    compat_props_add(mc->compat_props, hw_compat_4_1, hw_compat_4_1_len);
-}
-DEFINE_CCW_MACHINE(4, 1);
-
 static void ccw_machine_register_types(void)
 {
     type_register_static(&ccw_machine_info);
diff --git a/target/s390x/gen-features.c b/target/s390x/gen-features.c
index a814ece82f..8218e6470e 100644
--- a/target/s390x/gen-features.c
+++ b/target/s390x/gen-features.c
@@ -884,9 +884,6 @@ static uint16_t qemu_MIN[] = {
      */
     S390_FEAT_FLOATING_POINT_EXT,
     S390_FEAT_ZPCI,
-};
-
-static uint16_t qemu_V4_1[] = {
     S390_FEAT_STFLE_53,
     S390_FEAT_VECTOR,
 };
@@ -1049,7 +1046,6 @@ static FeatGroupDefSpec FeatGroupDef[] = {
  *******************************/
 static FeatGroupDefSpec QemuFeatDef[] = {
     QEMU_FEAT_INITIALIZER(MIN),
-    QEMU_FEAT_INITIALIZER(V4_1),
     QEMU_FEAT_INITIALIZER(V6_0),
     QEMU_FEAT_INITIALIZER(V6_2),
     QEMU_FEAT_INITIALIZER(V7_0),

From b894cc23f8fe6681b8bfc9679a6df1c976e9757a Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Tue, 3 Jun 2025 12:34:49 +0200
Subject: [PATCH 1508/2760] tests/functional: Use the 'none' machine for the
 VNC test
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The VNC test currently fails if the default machine ("pc" for x86)
has not been compiled into the binary. Since we also can test VNC
when QEMU just shows the default monitor, let's avoid this problem
by simply using the "none" machine (which is always available)
here instead.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250603103449.32499-1-thuth@redhat.com>
---
 tests/functional/test_vnc.py | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/tests/functional/test_vnc.py b/tests/functional/test_vnc.py
index 5c0ee5f927..f1dd1597cf 100755
--- a/tests/functional/test_vnc.py
+++ b/tests/functional/test_vnc.py
@@ -31,6 +31,7 @@ def check_connect(port: int) -> bool:
 class Vnc(QemuSystemTest):
 
     def test_no_vnc_change_password(self):
+        self.set_machine('none')
         self.vm.add_args('-nodefaults', '-S')
         self.vm.launch()
 
@@ -62,6 +63,7 @@ class Vnc(QemuSystemTest):
                 raise excp
 
     def test_change_password_requires_a_password(self):
+        self.set_machine('none')
         self.vm.add_args('-nodefaults', '-S', '-vnc', ':1,to=999')
         self.launch_guarded()
         self.assertTrue(self.vm.qmp('query-vnc')['return']['enabled'])
@@ -74,6 +76,7 @@ class Vnc(QemuSystemTest):
                          'Could not set password')
 
     def test_change_password(self):
+        self.set_machine('none')
         self.vm.add_args('-nodefaults', '-S', '-vnc', ':1,to=999,password=on')
         self.launch_guarded()
         self.assertTrue(self.vm.qmp('query-vnc')['return']['enabled'])
@@ -103,6 +106,7 @@ class Vnc(QemuSystemTest):
         self.assertTrue(check_connect(c))
 
     def test_change_listen(self):
+        self.set_machine('none')
         with Ports() as ports:
             a, b, c = ports.find_free_ports(3)
             self.do_test_change_listen(a, b, c)

From 3f11e5f4009f32261806905c37b2d260a9a194f0 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Tue, 3 Jun 2025 20:47:10 +0200
Subject: [PATCH 1509/2760] tests/functional: Speed up the avr_mega2560 test
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We can simply check for the expected pattern on the console,
no need to wait for two seconds here to search for the pattern
in the log at the end.

While we're at it, also remove the obsolete "timeout" variable
from this test.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250603184710.25651-1-thuth@redhat.com>
---
 tests/functional/test_avr_mega2560.py | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/tests/functional/test_avr_mega2560.py b/tests/functional/test_avr_mega2560.py
index 8e47b4200b..6359b72af3 100755
--- a/tests/functional/test_avr_mega2560.py
+++ b/tests/functional/test_avr_mega2560.py
@@ -18,12 +18,10 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 
-import time
+from qemu_test import QemuSystemTest, Asset, wait_for_console_pattern
 
-from qemu_test import QemuSystemTest, Asset
 
 class AVR6Machine(QemuSystemTest):
-    timeout = 5
 
     ASSET_ROM = Asset(('https://github.com/seharris/qemu-avr-tests'
                        '/raw/36c3e67b8755dcf/free-rtos/Demo'
@@ -40,13 +38,12 @@ class AVR6Machine(QemuSystemTest):
         self.set_machine('arduino-mega-2560-v3')
         self.vm.add_args('-bios', rom_path)
         self.vm.add_args('-nographic')
+        self.vm.set_console()
         self.vm.launch()
 
-        time.sleep(2)
-        self.vm.shutdown()
+        wait_for_console_pattern(self,
+                        'XABCDEFGHIJKLMNOPQRSTUVWXABCDEFGHIJKLMNOPQRSTUVWXA')
 
-        self.assertIn('ABCDEFGHIJKLMNOPQRSTUVWXABCDEFGHIJKLMNOPQRSTUVWX',
-                self.vm.get_log())
 
 if __name__ == '__main__':
     QemuSystemTest.main()

From 23c90999f64598439990f9a599d6cb25df90eccf Mon Sep 17 00:00:00 2001
From: Alexandr Moshkov <dtalexundeer@yandex-team.ru>
Date: Thu, 5 Jun 2025 11:59:09 +0500
Subject: [PATCH 1510/2760] tests/functional: add skipLockedMemoryTest
 decorator

Used in future commit to skipping execution of a tests if the system's
locked memory limit is below the required threshold.

Signed-off-by: Alexandr Moshkov <dtalexundeer@yandex-team.ru>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250605065908.299979-2-dtalexundeer@yandex-team.ru>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/functional/qemu_test/__init__.py   |  2 +-
 tests/functional/qemu_test/decorators.py | 18 ++++++++++++++++++
 2 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/tests/functional/qemu_test/__init__.py b/tests/functional/qemu_test/__init__.py
index af41c2c6a2..6e666a059f 100644
--- a/tests/functional/qemu_test/__init__.py
+++ b/tests/functional/qemu_test/__init__.py
@@ -15,6 +15,6 @@ from .testcase import QemuBaseTest, QemuUserTest, QemuSystemTest
 from .linuxkernel import LinuxKernelTest
 from .decorators import skipIfMissingCommands, skipIfNotMachine, \
     skipFlakyTest, skipUntrustedTest, skipBigDataTest, skipSlowTest, \
-    skipIfMissingImports, skipIfOperatingSystem
+    skipIfMissingImports, skipIfOperatingSystem, skipLockedMemoryTest
 from .archive import archive_extract
 from .uncompress import uncompress
diff --git a/tests/functional/qemu_test/decorators.py b/tests/functional/qemu_test/decorators.py
index 50d29de533..c0d1567b14 100644
--- a/tests/functional/qemu_test/decorators.py
+++ b/tests/functional/qemu_test/decorators.py
@@ -5,6 +5,7 @@
 import importlib
 import os
 import platform
+import resource
 from unittest import skipIf, skipUnless
 
 from .cmd import which
@@ -131,3 +132,20 @@ def skipIfMissingImports(*args):
 
     return skipUnless(has_imports, 'required import(s) "%s" not installed' %
                                    ", ".join(args))
+
+'''
+Decorator to skip execution of a test if the system's
+locked memory limit is below the required threshold.
+Takes required locked memory threshold in kB.
+Example:
+
+  @skipLockedMemoryTest(2_097_152)
+'''
+def skipLockedMemoryTest(locked_memory):
+    # get memlock hard limit in bytes
+    _, ulimit_memory = resource.getrlimit(resource.RLIMIT_MEMLOCK)
+
+    return skipUnless(
+        ulimit_memory == resource.RLIM_INFINITY or ulimit_memory >= locked_memory * 1024,
+        f'Test required {locked_memory} kB of available locked memory',
+    )

From ec3a7a7150462b2d1be5b71c2e4fc6338366da25 Mon Sep 17 00:00:00 2001
From: Alexandr Moshkov <dtalexundeer@yandex-team.ru>
Date: Thu, 5 Jun 2025 11:59:11 +0500
Subject: [PATCH 1511/2760] tests/functional: add memlock tests

Add new tests to check the correctness of the `-overcommit memlock`
option (possible values: off, on, on-fault) by using
`/proc/{qemu_pid}/status` file to check in VmSize, VmRSS and VmLck
values:

* if `memlock=off`, then VmLck = 0;
* if `memlock=on`, then VmLck > 0 and almost all memory is resident;
* if `memlock=on-fault`, then VmLck > 0 and only few memory is resident.

Signed-off-by: Alexandr Moshkov <dtalexundeer@yandex-team.ru>
Message-ID: <20250605065908.299979-3-dtalexundeer@yandex-team.ru>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/functional/meson.build     |  1 +
 tests/functional/test_memlock.py | 79 ++++++++++++++++++++++++++++++++
 2 files changed, 80 insertions(+)
 create mode 100755 tests/functional/test_memlock.py

diff --git a/tests/functional/meson.build b/tests/functional/meson.build
index 557d59ddf4..c3fca446cf 100644
--- a/tests/functional/meson.build
+++ b/tests/functional/meson.build
@@ -312,6 +312,7 @@ tests_x86_64_system_quick = [
   'virtio_version',
   'x86_cpu_model_versions',
   'vnc',
+  'memlock',
 ]
 
 tests_x86_64_system_thorough = [
diff --git a/tests/functional/test_memlock.py b/tests/functional/test_memlock.py
new file mode 100755
index 0000000000..2b515ff979
--- /dev/null
+++ b/tests/functional/test_memlock.py
@@ -0,0 +1,79 @@
+#!/usr/bin/env python3
+#
+# Functional test that check overcommit memlock options
+#
+# Copyright (c) Yandex Technologies LLC, 2025
+#
+# Author:
+#  Alexandr Moshkov <dtalexundeer@yandex-team.ru>
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+import re
+
+from typing import Dict
+
+from qemu_test import QemuSystemTest
+from qemu_test import skipLockedMemoryTest
+
+
+STATUS_VALUE_PATTERN = re.compile(r'^(\w+):\s+(\d+) kB', re.MULTILINE)
+
+
+@skipLockedMemoryTest(2_097_152)  # 2GB
+class MemlockTest(QemuSystemTest):
+    """
+    Runs a guest with memlock options.
+    Then verify, that this options is working correctly
+    by checking the status file of the QEMU process.
+    """
+
+    def common_vm_setup_with_memlock(self, memlock):
+        self.vm.add_args('-overcommit', f'mem-lock={memlock}')
+        self.vm.launch()
+
+    def test_memlock_off(self):
+        self.common_vm_setup_with_memlock('off')
+
+        status = self.get_process_status_values(self.vm.get_pid())
+
+        self.assertTrue(status['VmLck'] == 0)
+
+    def test_memlock_on(self):
+        self.common_vm_setup_with_memlock('on')
+
+        status = self.get_process_status_values(self.vm.get_pid())
+
+        # VmLck > 0 kB and almost all memory is resident
+        self.assertTrue(status['VmLck'] > 0)
+        self.assertTrue(status['VmRSS'] >= status['VmSize'] * 0.70)
+
+    def test_memlock_onfault(self):
+        self.common_vm_setup_with_memlock('on-fault')
+
+        status = self.get_process_status_values(self.vm.get_pid())
+
+        # VmLck > 0 kB and only few memory is resident
+        self.assertTrue(status['VmLck'] > 0)
+        self.assertTrue(status['VmRSS'] <= status['VmSize'] * 0.30)
+
+    def get_process_status_values(self, pid: int) -> Dict[str, int]:
+        result = {}
+        raw_status = self._get_raw_process_status(pid)
+
+        for line in raw_status.split('\n'):
+            if m := STATUS_VALUE_PATTERN.match(line):
+                result[m.group(1)] = int(m.group(2))
+
+        return result
+
+    def _get_raw_process_status(self, pid: int) -> str:
+        try:
+            with open(f'/proc/{pid}/status', 'r') as f:
+                return f.read()
+        except FileNotFoundError:
+            self.skipTest("Can't open status file of the process")
+
+
+if __name__ == '__main__':
+    MemlockTest.main()

From e317f0ce722f2d36b1ea61de6d85f2e9f2282a0b Mon Sep 17 00:00:00 2001
From: Haseung Bong <hasueng@gmail.com>
Date: Sat, 7 Jun 2025 15:04:56 +0900
Subject: [PATCH 1512/2760] tests/vm/README: fix documentation path in
 tests/vm/README

The README file in tests/vm/ points to a non-existent file,
docs/devel/testing.rst. Update the README to point to
docs/devel/testing/main.rst, which now contains information
about VM testing.

Signed-off-by: Haseung Bong <hasueng@gmail.com>
Fixes: ff41da50308 ("docs/devel: Split testing docs from the build docs and  move to separate folder")
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250607060456.28902-1-hasueng@gmail.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/vm/README | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/vm/README b/tests/vm/README
index f9c04cc0e7..14ac323309 100644
--- a/tests/vm/README
+++ b/tests/vm/README
@@ -1 +1 @@
-See docs/devel/testing.rst for help.
+See docs/devel/testing/main.rst for help.

From 97b091c88f05df6feaeef58b2357621ed3186fb8 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Tue, 10 Jun 2025 07:37:34 +0200
Subject: [PATCH 1513/2760] MAINTAINERS: Update the paths to the testing
 documentation files

When the testing docs were moved to a separate subfolder, the entries
in the MAINTAINERS file were missed. Update them now.

Fixes: ff41da50308 ("docs/devel: Split testing docs from the build docs and move to separate folder")
Reviewed-by: Ani Sinha <anisinha@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250610053734.10417-1-thuth@redhat.com>
---
 MAINTAINERS | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/MAINTAINERS b/MAINTAINERS
index aa6763077e..eb2b338fb1 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2124,7 +2124,7 @@ M: Michael S. Tsirkin <mst@redhat.com>
 S: Supported
 F: tests/functional/acpi-bits/*
 F: tests/functional/test_acpi_bits.py
-F: docs/devel/acpi-bits.rst
+F: docs/devel/testing/acpi-bits.rst
 
 ACPI/HEST/GHES
 R: Dongjiu Geng <gengdongjiu1@gmail.com>
@@ -3440,8 +3440,8 @@ F: system/qtest.c
 F: include/system/qtest.h
 F: accel/qtest/
 F: tests/qtest/
-F: docs/devel/qgraph.rst
-F: docs/devel/qtest.rst
+F: docs/devel/testing/qgraph.rst
+F: docs/devel/testing/qtest.rst
 X: tests/qtest/bios-tables-test*
 X: tests/qtest/migration-*
 
@@ -3459,7 +3459,7 @@ F: tests/qtest/fuzz-*test.c
 F: tests/docker/test-fuzz
 F: scripts/oss-fuzz/
 F: hw/mem/sparse-mem.c
-F: docs/devel/fuzzing.rst
+F: docs/devel/testing/fuzzing.rst
 
 Register API
 M: Alistair Francis <alistair@alistair23.me>
@@ -4078,7 +4078,7 @@ M: Stefan Hajnoczi <stefanha@redhat.com>
 L: qemu-block@nongnu.org
 S: Supported
 F: block/blkverify.c
-F: docs/devel/blkverify.rst
+F: docs/devel/testing/blkverify.rst
 
 bochs
 M: Stefan Hajnoczi <stefanha@redhat.com>
@@ -4156,7 +4156,7 @@ M: Hanna Reitz <hreitz@redhat.com>
 L: qemu-block@nongnu.org
 S: Supported
 F: block/blkdebug.c
-F: docs/devel/blkdebug.rst
+F: docs/devel/testing/blkdebug.rst
 
 vpc
 M: Kevin Wolf <kwolf@redhat.com>
@@ -4276,7 +4276,8 @@ F: tests/vm/
 F: tests/lcitool/
 F: tests/functional/test_*_tuxrun.py
 F: scripts/archive-source.sh
-F: docs/devel/testing.rst
+F: docs/devel/testing/ci*
+F: docs/devel/testing/main.rst
 W: https://gitlab.com/qemu-project/qemu/pipelines
 W: https://travis-ci.org/qemu/qemu
 

From 3784b6e0771fd2278fc1a13045cde63cb6e4dcb3 Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Date: Sat, 31 May 2025 16:00:25 +0900
Subject: [PATCH 1514/2760] MAINTAINERS: Update Akihiko Odaki's affiliation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

My contract with Daynix Computing Ltd. will expire by the end of May,
2025. As I may contribute to QEMU for my research, use my email address
at the lab.

As I'm the only maintainer of igb and no longer financially supported to
maintain it, change its status to Odd Fixes until someone steps up.

Signed-off-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250531-rsg-v1-1-e0bae1e1d90e@rsg.ci.i.u-tokyo.ac.jp>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 .mailmap    |  3 ++-
 MAINTAINERS | 16 ++++++++--------
 2 files changed, 10 insertions(+), 9 deletions(-)

diff --git a/.mailmap b/.mailmap
index 33fe75400f..e7271852dc 100644
--- a/.mailmap
+++ b/.mailmap
@@ -67,7 +67,8 @@ Andrey Drobyshev <andrey.drobyshev@virtuozzo.com> Andrey Drobyshev via <qemu-blo
 BALATON Zoltan <balaton@eik.bme.hu> BALATON Zoltan via <qemu-ppc@nongnu.org>
 
 # Next, replace old addresses by a more recent one.
-Akihiko Odaki <akihiko.odaki@daynix.com> <akihiko.odaki@gmail.com>
+Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp> <akihiko.odaki@daynix.com>
+Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp> <akihiko.odaki@gmail.com>
 Aleksandar Markovic <aleksandar.qemu.devel@gmail.com> <aleksandar.markovic@mips.com>
 Aleksandar Markovic <aleksandar.qemu.devel@gmail.com> <aleksandar.markovic@imgtec.com>
 Aleksandar Markovic <aleksandar.qemu.devel@gmail.com> <amarkovic@wavecomp.com>
diff --git a/MAINTAINERS b/MAINTAINERS
index eb2b338fb1..8d2fd4d57d 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2519,7 +2519,7 @@ F: tests/qtest/fuzz-megasas-test.c
 
 Network packet abstractions
 M: Dmitry Fleytman <dmitry.fleytman@gmail.com>
-R: Akihiko Odaki <akihiko.odaki@daynix.com>
+R: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
 S: Maintained
 F: include/net/eth.h
 F: net/eth.c
@@ -2549,13 +2549,13 @@ F: docs/specs/rocker.rst
 
 e1000x
 M: Dmitry Fleytman <dmitry.fleytman@gmail.com>
-R: Akihiko Odaki <akihiko.odaki@daynix.com>
+R: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
 S: Maintained
 F: hw/net/e1000x*
 
 e1000e
 M: Dmitry Fleytman <dmitry.fleytman@gmail.com>
-R: Akihiko Odaki <akihiko.odaki@daynix.com>
+R: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
 S: Maintained
 F: hw/net/e1000e*
 F: tests/qtest/fuzz-e1000e-test.c
@@ -2563,9 +2563,9 @@ F: tests/qtest/e1000e-test.c
 F: tests/qtest/libqos/e1000e.*
 
 igb
-M: Akihiko Odaki <akihiko.odaki@daynix.com>
+M: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
 R: Sriram Yagnaraman <sriram.yagnaraman@ericsson.com>
-S: Maintained
+S: Odd Fixes
 F: docs/system/devices/igb.rst
 F: hw/net/igb*
 F: tests/functional/test_netdev_ethtool.py
@@ -2910,7 +2910,7 @@ Core Audio framework backend
 M: Gerd Hoffmann <kraxel@redhat.com>
 M: Philippe Mathieu-Daudé <philmd@linaro.org>
 R: Christian Schoenebeck <qemu_oss@crudebyte.com>
-R: Akihiko Odaki <akihiko.odaki@daynix.com>
+R: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
 S: Odd Fixes
 F: audio/coreaudio.m
 
@@ -3211,7 +3211,7 @@ F: tests/functional/test_vnc.py
 Cocoa graphics
 M: Peter Maydell <peter.maydell@linaro.org>
 M: Philippe Mathieu-Daudé <philmd@linaro.org>
-R: Akihiko Odaki <akihiko.odaki@daynix.com>
+R: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
 S: Odd Fixes
 F: ui/cocoa.m
 
@@ -3738,7 +3738,7 @@ F: util/iova-tree.c
 
 elf2dmp
 M: Viktor Prutyanov <viktor.prutyanov@phystech.edu>
-R: Akihiko Odaki <akihiko.odaki@daynix.com>
+R: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
 S: Maintained
 F: contrib/elf2dmp/
 

From 1da0025ecd527c833697822511057f1b93579045 Mon Sep 17 00:00:00 2001
From: Bernhard Beschow <shentey@gmail.com>
Date: Tue, 10 Jun 2025 22:41:29 +0200
Subject: [PATCH 1515/2760] scripts/meson-buildoptions: Sort coroutine_backend
 choices lexicographically

When changing meson_options.txt, this script gets updated automatically
by QEMU tooling which sorts the choices lexicographically.

Fixes: ccc403ed5844 ("meson: Add wasm build in build scripts")
Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Message-ID: <20250610204131.2862-4-shentey@gmail.com>
Tested-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 scripts/meson-buildoptions.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/meson-buildoptions.sh b/scripts/meson-buildoptions.sh
index f09ef9604f..73e0770f42 100644
--- a/scripts/meson-buildoptions.sh
+++ b/scripts/meson-buildoptions.sh
@@ -80,7 +80,7 @@ meson_options_help() {
   printf "%s\n" '  --tls-priority=VALUE     Default TLS protocol/cipher priority string'
   printf "%s\n" '                           [NORMAL]'
   printf "%s\n" '  --with-coroutine=CHOICE  coroutine backend to use (choices:'
-  printf "%s\n" '                           auto/sigaltstack/ucontext/windows/wasm)'
+  printf "%s\n" '                           auto/sigaltstack/ucontext/wasm/windows)'
   printf "%s\n" '  --with-pkgversion=VALUE  use specified string as sub-version of the'
   printf "%s\n" '                           package'
   printf "%s\n" '  --with-suffix=VALUE      Suffix for QEMU data/modules/config directories'

From 144227dbc46f82d76de065e507a256a4d723b9e4 Mon Sep 17 00:00:00 2001
From: Zhenzhong Duan <zhenzhong.duan@intel.com>
Date: Mon, 9 Jun 2025 19:54:33 +0800
Subject: [PATCH 1516/2760] vfio/container: Fix vfio_listener_commit()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

It's wrong to call into listener_begin callback in vfio_listener_commit().
Currently this impacts vfio-user.

Fixes: d9b7d8b6993b ("vfio/container: pass listener_begin/commit callbacks")
Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: John Levon <john.levon@nutanix.com>
Link: https://lore.kernel.org/qemu-devel/20250609115433.401775-1-zhenzhong.duan@intel.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/listener.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/vfio/listener.c b/hw/vfio/listener.c
index 203ed0314e..735b5f21b7 100644
--- a/hw/vfio/listener.c
+++ b/hw/vfio/listener.c
@@ -437,7 +437,7 @@ static void vfio_listener_commit(MemoryListener *listener)
                                                  listener);
     void (*listener_commit)(VFIOContainerBase *bcontainer);
 
-    listener_commit = VFIO_IOMMU_GET_CLASS(bcontainer)->listener_begin;
+    listener_commit = VFIO_IOMMU_GET_CLASS(bcontainer)->listener_commit;
 
     if (listener_commit) {
         listener_commit(bcontainer);

From 6c4f752ea7c57b9782da0669599659a9d63df431 Mon Sep 17 00:00:00 2001
From: Zhenzhong Duan <zhenzhong.duan@intel.com>
Date: Wed, 11 Jun 2025 10:42:28 +0800
Subject: [PATCH 1517/2760] vfio/pci: Fix instance_size of VFIO_PCI_BASE
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Currently the final instance_size of VFIO_PCI_BASE is sizeof(PCIDevice).
It should be sizeof(VFIOPCIDevice), VFIO_PCI uses same structure as
base class VFIO_PCI_BASE, so no need to set its instance_size explicitly.

This isn't catastrophic only because VFIO_PCI_BASE is an abstract class.

Fixes: d4e392d0a99b ("vfio: add vfio-pci-base class")
Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Yi Liu <yi.l.liu@intel.com>
Link: https://lore.kernel.org/qemu-devel/20250611024228.423666-1-zhenzhong.duan@intel.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/pci.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index b1250d85bf..6748f4e876 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -3425,7 +3425,7 @@ static void vfio_pci_base_dev_class_init(ObjectClass *klass, const void *data)
 static const TypeInfo vfio_pci_base_dev_info = {
     .name = TYPE_VFIO_PCI_BASE,
     .parent = TYPE_PCI_DEVICE,
-    .instance_size = 0,
+    .instance_size = sizeof(VFIOPCIDevice),
     .abstract = true,
     .class_init = vfio_pci_base_dev_class_init,
     .interfaces = (const InterfaceInfo[]) {
@@ -3647,7 +3647,6 @@ static void vfio_pci_dev_class_init(ObjectClass *klass, const void *data)
 static const TypeInfo vfio_pci_dev_info = {
     .name = TYPE_VFIO_PCI,
     .parent = TYPE_VFIO_PCI_BASE,
-    .instance_size = sizeof(VFIOPCIDevice),
     .class_init = vfio_pci_dev_class_init,
     .instance_init = vfio_instance_init,
     .instance_finalize = vfio_instance_finalize,

From 0fb8a62fe46ca0cdcc75479658301b7e1c3aa797 Mon Sep 17 00:00:00 2001
From: Rorie Reyes <rreyes@linux.ibm.com>
Date: Mon, 9 Jun 2025 12:44:15 -0400
Subject: [PATCH 1518/2760] hw/vfio/ap: notification handler for AP config
 changed event
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Register an event notifier handler to process AP configuration
change events by queuing the event and generating a CRW to let
the guest know its AP configuration has changed

Signed-off-by: Rorie Reyes <rreyes@linux.ibm.com>
Reviewed-by: Anthony Krowiak <akrowiak@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20250609164418.17585-2-rreyes@linux.ibm.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/ap.c | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/hw/vfio/ap.c b/hw/vfio/ap.c
index 785c0a0197..93c74ebedb 100644
--- a/hw/vfio/ap.c
+++ b/hw/vfio/ap.c
@@ -18,6 +18,7 @@
 #include "hw/vfio/vfio-device.h"
 #include "system/iommufd.h"
 #include "hw/s390x/ap-device.h"
+#include "hw/s390x/css.h"
 #include "qemu/error-report.h"
 #include "qemu/event_notifier.h"
 #include "qemu/main-loop.h"
@@ -37,6 +38,7 @@ struct VFIOAPDevice {
     APDevice apdev;
     VFIODevice vdev;
     EventNotifier req_notifier;
+    EventNotifier cfg_notifier;
 };
 
 OBJECT_DECLARE_SIMPLE_TYPE(VFIOAPDevice, VFIO_AP_DEVICE)
@@ -70,6 +72,18 @@ static void vfio_ap_req_notifier_handler(void *opaque)
     }
 }
 
+static void vfio_ap_cfg_chg_notifier_handler(void *opaque)
+{
+    VFIOAPDevice *vapdev = opaque;
+
+    if (!event_notifier_test_and_clear(&vapdev->cfg_notifier)) {
+        return;
+    }
+
+    css_generate_css_crws(0);
+
+}
+
 static bool vfio_ap_register_irq_notifier(VFIOAPDevice *vapdev,
                                           unsigned int irq, Error **errp)
 {
@@ -85,6 +99,10 @@ static bool vfio_ap_register_irq_notifier(VFIOAPDevice *vapdev,
         notifier = &vapdev->req_notifier;
         fd_read = vfio_ap_req_notifier_handler;
         break;
+    case VFIO_AP_CFG_CHG_IRQ_INDEX:
+        notifier = &vapdev->cfg_notifier;
+        fd_read = vfio_ap_cfg_chg_notifier_handler;
+        break;
     default:
         error_setg(errp, "vfio: Unsupported device irq(%d)", irq);
         return false;
@@ -137,6 +155,9 @@ static void vfio_ap_unregister_irq_notifier(VFIOAPDevice *vapdev,
     case VFIO_AP_REQ_IRQ_INDEX:
         notifier = &vapdev->req_notifier;
         break;
+    case VFIO_AP_CFG_CHG_IRQ_INDEX:
+        notifier = &vapdev->cfg_notifier;
+        break;
     default:
         error_report("vfio: Unsupported device irq(%d)", irq);
         return;
@@ -176,6 +197,15 @@ static void vfio_ap_realize(DeviceState *dev, Error **errp)
         warn_report_err(err);
     }
 
+    if (!vfio_ap_register_irq_notifier(vapdev, VFIO_AP_CFG_CHG_IRQ_INDEX, &err))
+    {
+        /*
+         * Report this error, but do not make it a failing condition.
+         * Lack of this IRQ in the host does not prevent normal operation.
+         */
+        warn_report_err(err);
+    }
+
     return;
 
 error:
@@ -188,6 +218,7 @@ static void vfio_ap_unrealize(DeviceState *dev)
     VFIOAPDevice *vapdev = VFIO_AP_DEVICE(dev);
 
     vfio_ap_unregister_irq_notifier(vapdev, VFIO_AP_REQ_IRQ_INDEX);
+    vfio_ap_unregister_irq_notifier(vapdev, VFIO_AP_CFG_CHG_IRQ_INDEX);
     vfio_device_detach(&vapdev->vdev);
     g_free(vapdev->vdev.name);
 }

From bc36d14e13ee9bfc17a6818c5e1664fb8e316621 Mon Sep 17 00:00:00 2001
From: Rorie Reyes <rreyes@linux.ibm.com>
Date: Mon, 9 Jun 2025 12:44:16 -0400
Subject: [PATCH 1519/2760] hw/vfio/ap: store object indicating AP config
 changed in a queue
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Creates an object indicating that an AP configuration change event
has been received and stores it in a queue. These objects will later
be used to store event information for an AP configuration change
when the CHSC instruction is intercepted.

Signed-off-by: Rorie Reyes <rreyes@linux.ibm.com>
Reviewed-by: Anthony Krowiak <akrowiak@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20250609164418.17585-3-rreyes@linux.ibm.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/ap.c | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/hw/vfio/ap.c b/hw/vfio/ap.c
index 93c74ebedb..681fd4a4f1 100644
--- a/hw/vfio/ap.c
+++ b/hw/vfio/ap.c
@@ -21,6 +21,7 @@
 #include "hw/s390x/css.h"
 #include "qemu/error-report.h"
 #include "qemu/event_notifier.h"
+#include "qemu/lockable.h"
 #include "qemu/main-loop.h"
 #include "qemu/module.h"
 #include "qemu/option.h"
@@ -41,6 +42,15 @@ struct VFIOAPDevice {
     EventNotifier cfg_notifier;
 };
 
+typedef struct APConfigChgEvent {
+    QTAILQ_ENTRY(APConfigChgEvent) next;
+} APConfigChgEvent;
+
+static QTAILQ_HEAD(, APConfigChgEvent) cfg_chg_events =
+    QTAILQ_HEAD_INITIALIZER(cfg_chg_events);
+
+static QemuMutex cfg_chg_events_lock;
+
 OBJECT_DECLARE_SIMPLE_TYPE(VFIOAPDevice, VFIO_AP_DEVICE)
 
 static void vfio_ap_compute_needs_reset(VFIODevice *vdev)
@@ -74,12 +84,19 @@ static void vfio_ap_req_notifier_handler(void *opaque)
 
 static void vfio_ap_cfg_chg_notifier_handler(void *opaque)
 {
+    APConfigChgEvent *cfg_chg_event;
     VFIOAPDevice *vapdev = opaque;
 
     if (!event_notifier_test_and_clear(&vapdev->cfg_notifier)) {
         return;
     }
 
+    cfg_chg_event = g_new0(APConfigChgEvent, 1);
+
+    WITH_QEMU_LOCK_GUARD(&cfg_chg_events_lock) {
+        QTAILQ_INSERT_TAIL(&cfg_chg_events, cfg_chg_event, next);
+    }
+
     css_generate_css_crws(0);
 
 }

From fd0336021553dfcccb92522552d0ac9475e831d8 Mon Sep 17 00:00:00 2001
From: Rorie Reyes <rreyes@linux.ibm.com>
Date: Mon, 9 Jun 2025 12:44:17 -0400
Subject: [PATCH 1520/2760] hw/vfio/ap: Storing event information for an AP
 configuration change event
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

These functions can be invoked by the function that handles interception
of the CHSC SEI instruction for requests indicating the accessibility of
one or more adjunct processors has changed.

Signed-off-by: Rorie Reyes <rreyes@linux.ibm.com>
Reviewed-by: Anthony Krowiak <akrowiak@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20250609164418.17585-4-rreyes@linux.ibm.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/ap.c                 | 40 ++++++++++++++++++++++++++++++++++++
 include/hw/s390x/ap-bridge.h | 39 +++++++++++++++++++++++++++++++++++
 2 files changed, 79 insertions(+)

diff --git a/hw/vfio/ap.c b/hw/vfio/ap.c
index 681fd4a4f1..874e0d1eaf 100644
--- a/hw/vfio/ap.c
+++ b/hw/vfio/ap.c
@@ -10,6 +10,7 @@
  * directory.
  */
 
+#include <stdbool.h>
 #include "qemu/osdep.h"
 #include CONFIG_DEVICES /* CONFIG_IOMMUFD */
 #include <linux/vfio.h>
@@ -101,6 +102,38 @@ static void vfio_ap_cfg_chg_notifier_handler(void *opaque)
 
 }
 
+int ap_chsc_sei_nt0_get_event(void *res)
+{
+    ChscSeiNt0Res *nt0_res  = (ChscSeiNt0Res *)res;
+    APConfigChgEvent *cfg_chg_event;
+
+    WITH_QEMU_LOCK_GUARD(&cfg_chg_events_lock) {
+        if (QTAILQ_EMPTY(&cfg_chg_events)) {
+            return EVENT_INFORMATION_NOT_STORED;
+        }
+
+        cfg_chg_event = QTAILQ_FIRST(&cfg_chg_events);
+        QTAILQ_REMOVE(&cfg_chg_events, cfg_chg_event, next);
+    }
+
+    memset(nt0_res, 0, sizeof(*nt0_res));
+    g_free(cfg_chg_event);
+    nt0_res->flags |= PENDING_EVENT_INFO_BITMASK;
+    nt0_res->length = sizeof(ChscSeiNt0Res);
+    nt0_res->code = NT0_RES_RESPONSE_CODE;
+    nt0_res->nt = NT0_RES_NT_DEFAULT;
+    nt0_res->rs = NT0_RES_RS_AP_CHANGE;
+    nt0_res->cc = NT0_RES_CC_AP_CHANGE;
+
+    return EVENT_INFORMATION_STORED;
+}
+
+bool ap_chsc_sei_nt0_have_event(void)
+{
+    QEMU_LOCK_GUARD(&cfg_chg_events_lock);
+    return !QTAILQ_EMPTY(&cfg_chg_events);
+}
+
 static bool vfio_ap_register_irq_notifier(VFIOAPDevice *vapdev,
                                           unsigned int irq, Error **errp)
 {
@@ -197,6 +230,13 @@ static void vfio_ap_realize(DeviceState *dev, Error **errp)
     VFIOAPDevice *vapdev = VFIO_AP_DEVICE(dev);
     VFIODevice *vbasedev = &vapdev->vdev;
 
+    static bool lock_initialized;
+
+    if (!lock_initialized) {
+        qemu_mutex_init(&cfg_chg_events_lock);
+        lock_initialized = true;
+    }
+
     if (!vfio_device_get_name(vbasedev, errp)) {
         return;
     }
diff --git a/include/hw/s390x/ap-bridge.h b/include/hw/s390x/ap-bridge.h
index 470e439a98..7efc52928d 100644
--- a/include/hw/s390x/ap-bridge.h
+++ b/include/hw/s390x/ap-bridge.h
@@ -16,4 +16,43 @@
 
 void s390_init_ap(void);
 
+typedef struct ChscSeiNt0Res {
+    uint16_t length;
+    uint16_t code;
+    uint8_t reserved1;
+    uint16_t reserved2;
+    uint8_t nt;
+#define PENDING_EVENT_INFO_BITMASK 0x80;
+    uint8_t flags;
+    uint8_t reserved3;
+    uint8_t rs;
+    uint8_t cc;
+} QEMU_PACKED ChscSeiNt0Res;
+
+#define NT0_RES_RESPONSE_CODE 1
+#define NT0_RES_NT_DEFAULT    0
+#define NT0_RES_RS_AP_CHANGE  5
+#define NT0_RES_CC_AP_CHANGE  3
+
+#define EVENT_INFORMATION_NOT_STORED 1
+#define EVENT_INFORMATION_STORED     0
+
+/**
+ * ap_chsc_sei_nt0_get_event - Retrieve the next pending AP config
+ * change event
+ * @res: Pointer to a ChscSeiNt0Res struct to be filled with event
+ * data
+ *
+ * This function checks for any pending AP config change events and,
+ * if present, populates the provided response structure with the
+ * appropriate SEI NT0 fields.
+ *
+ * Return:
+ *   EVENT_INFORMATION_STORED - An event was available and written to @res
+ *   EVENT_INFORMATION_NOT_STORED - No event was available
+ */
+int ap_chsc_sei_nt0_get_event(void *res);
+
+bool ap_chsc_sei_nt0_have_event(void);
+
 #endif

From c393e6d181c98b76b09fb5120c68f458d5a05d4b Mon Sep 17 00:00:00 2001
From: Rorie Reyes <rreyes@linux.ibm.com>
Date: Mon, 9 Jun 2025 12:44:18 -0400
Subject: [PATCH 1521/2760] s390: implementing CHSC SEI for AP config change
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Handle interception of the CHSC SEI instruction for requests
indicating the guest's AP configuration has changed.

If configuring --without-default-devices, hw/s390x/ap-stub.c
was created to handle such circumstance. Also added the
following to hw/s390x/meson.build if CONFIG_VFIO_AP is
false, it will use the stub file.

Signed-off-by: Rorie Reyes <rreyes@linux.ibm.com>
Reviewed-by: Anthony Krowiak <akrowiak@linux.ibm.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250609164418.17585-5-rreyes@linux.ibm.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 MAINTAINERS           |  1 +
 hw/s390x/ap-stub.c    | 21 +++++++++++++++++++++
 hw/s390x/meson.build  |  1 +
 target/s390x/ioinst.c | 11 +++++++++--
 4 files changed, 32 insertions(+), 2 deletions(-)
 create mode 100644 hw/s390x/ap-stub.c

diff --git a/MAINTAINERS b/MAINTAINERS
index aa6763077e..1e84bfeaee 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -112,6 +112,7 @@ F: hw/intc/s390_flic.c
 F: hw/intc/s390_flic_kvm.c
 F: hw/s390x/
 F: hw/vfio/ap.c
+F: hw/s390x/ap-stub.c
 F: hw/vfio/ccw.c
 F: hw/watchdog/wdt_diag288.c
 F: include/hw/s390x/
diff --git a/hw/s390x/ap-stub.c b/hw/s390x/ap-stub.c
new file mode 100644
index 0000000000..001fe5f8b0
--- /dev/null
+++ b/hw/s390x/ap-stub.c
@@ -0,0 +1,21 @@
+/*
+ * VFIO based AP matrix device assignment
+ *
+ * Copyright 2025 IBM Corp.
+ * Author(s): Rorie Reyes <rreyes@linux.ibm.com>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "hw/s390x/ap-bridge.h"
+
+int ap_chsc_sei_nt0_get_event(void *res)
+{
+    return EVENT_INFORMATION_NOT_STORED;
+}
+
+bool ap_chsc_sei_nt0_have_event(void)
+{
+    return false;
+}
diff --git a/hw/s390x/meson.build b/hw/s390x/meson.build
index 3bbebfd817..99cbcbd7d6 100644
--- a/hw/s390x/meson.build
+++ b/hw/s390x/meson.build
@@ -33,6 +33,7 @@ s390x_ss.add(when: 'CONFIG_S390_CCW_VIRTIO', if_true: files(
 ))
 s390x_ss.add(when: 'CONFIG_TERMINAL3270', if_true: files('3270-ccw.c'))
 s390x_ss.add(when: 'CONFIG_VFIO', if_true: files('s390-pci-vfio.c'))
+s390x_ss.add(when: 'CONFIG_VFIO_AP', if_false: files('ap-stub.c'))
 
 virtio_ss = ss.source_set()
 virtio_ss.add(files('virtio-ccw.c'))
diff --git a/target/s390x/ioinst.c b/target/s390x/ioinst.c
index fe62ba5b06..2320dd4c12 100644
--- a/target/s390x/ioinst.c
+++ b/target/s390x/ioinst.c
@@ -18,6 +18,7 @@
 #include "trace.h"
 #include "hw/s390x/s390-pci-bus.h"
 #include "target/s390x/kvm/pv.h"
+#include "hw/s390x/ap-bridge.h"
 
 /* All I/O instructions but chsc use the s format */
 static uint64_t get_address_from_regs(CPUS390XState *env, uint32_t ipb,
@@ -574,13 +575,19 @@ out:
 
 static int chsc_sei_nt0_get_event(void *res)
 {
-    /* no events yet */
+    if (s390_has_feat(S390_FEAT_AP)) {
+        return ap_chsc_sei_nt0_get_event(res);
+    }
+
     return 1;
 }
 
 static int chsc_sei_nt0_have_event(void)
 {
-    /* no events yet */
+    if (s390_has_feat(S390_FEAT_AP)) {
+        return ap_chsc_sei_nt0_have_event();
+    }
+
     return 0;
 }
 

From 7163c0bca72ae70a5be2d455c5348255a6016f04 Mon Sep 17 00:00:00 2001
From: John Levon <john.levon@nutanix.com>
Date: Fri, 6 Jun 2025 17:10:33 -0700
Subject: [PATCH 1522/2760] vfio: export PCI helpers needed for vfio-user
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The vfio-user code will need to re-use various parts of the vfio PCI
code. Export them in hw/vfio/pci.h, and rename them to the vfio_pci_*
namespace.

Signed-off-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250607001056.335310-2-john.levon@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/pci.c        | 48 ++++++++++++++++++++++----------------------
 hw/vfio/pci.h        | 11 ++++++++++
 hw/vfio/trace-events |  6 +++---
 3 files changed, 38 insertions(+), 27 deletions(-)

diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index 6748f4e876..2901cedf6f 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -103,7 +103,7 @@ static void vfio_intx_interrupt(void *opaque)
     }
 }
 
-static void vfio_intx_eoi(VFIODevice *vbasedev)
+void vfio_pci_intx_eoi(VFIODevice *vbasedev)
 {
     VFIOPCIDevice *vdev = container_of(vbasedev, VFIOPCIDevice, vbasedev);
 
@@ -111,7 +111,7 @@ static void vfio_intx_eoi(VFIODevice *vbasedev)
         return;
     }
 
-    trace_vfio_intx_eoi(vbasedev->name);
+    trace_vfio_pci_intx_eoi(vbasedev->name);
 
     vdev->intx.pending = false;
     pci_irq_deassert(&vdev->pdev);
@@ -236,7 +236,7 @@ static void vfio_intx_update(VFIOPCIDevice *vdev, PCIINTxRoute *route)
     }
 
     /* Re-enable the interrupt in cased we missed an EOI */
-    vfio_intx_eoi(&vdev->vbasedev);
+    vfio_pci_intx_eoi(&vdev->vbasedev);
 }
 
 static void vfio_intx_routing_notifier(PCIDevice *pdev)
@@ -1743,7 +1743,7 @@ static bool vfio_msix_setup(VFIOPCIDevice *vdev, int pos, Error **errp)
     return true;
 }
 
-static void vfio_teardown_msi(VFIOPCIDevice *vdev)
+void vfio_pci_teardown_msi(VFIOPCIDevice *vdev)
 {
     msi_uninit(&vdev->pdev);
 
@@ -1839,7 +1839,7 @@ static void vfio_bars_register(VFIOPCIDevice *vdev)
     }
 }
 
-static void vfio_bars_exit(VFIOPCIDevice *vdev)
+void vfio_pci_bars_exit(VFIOPCIDevice *vdev)
 {
     int i;
 
@@ -2430,7 +2430,7 @@ static void vfio_add_ext_cap(VFIOPCIDevice *vdev)
     g_free(config);
 }
 
-static bool vfio_add_capabilities(VFIOPCIDevice *vdev, Error **errp)
+bool vfio_pci_add_capabilities(VFIOPCIDevice *vdev, Error **errp)
 {
     PCIDevice *pdev = &vdev->pdev;
 
@@ -2706,7 +2706,7 @@ static int vfio_pci_load_config(VFIODevice *vbasedev, QEMUFile *f)
 static VFIODeviceOps vfio_pci_ops = {
     .vfio_compute_needs_reset = vfio_pci_compute_needs_reset,
     .vfio_hot_reset_multi = vfio_pci_hot_reset_multi,
-    .vfio_eoi = vfio_intx_eoi,
+    .vfio_eoi = vfio_pci_intx_eoi,
     .vfio_get_object = vfio_pci_get_object,
     .vfio_save_config = vfio_pci_save_config,
     .vfio_load_config = vfio_pci_load_config,
@@ -2777,7 +2777,7 @@ bool vfio_populate_vga(VFIOPCIDevice *vdev, Error **errp)
     return true;
 }
 
-static bool vfio_populate_device(VFIOPCIDevice *vdev, Error **errp)
+bool vfio_pci_populate_device(VFIOPCIDevice *vdev, Error **errp)
 {
     VFIODevice *vbasedev = &vdev->vbasedev;
     struct vfio_region_info *reg_info = NULL;
@@ -2823,7 +2823,7 @@ static bool vfio_populate_device(VFIOPCIDevice *vdev, Error **errp)
         return false;
     }
 
-    trace_vfio_populate_device_config(vdev->vbasedev.name,
+    trace_vfio_pci_populate_device_config(vdev->vbasedev.name,
                                       (unsigned long)reg_info->size,
                                       (unsigned long)reg_info->offset,
                                       (unsigned long)reg_info->flags);
@@ -2845,7 +2845,7 @@ static bool vfio_populate_device(VFIOPCIDevice *vdev, Error **errp)
     ret = vfio_device_get_irq_info(vbasedev, VFIO_PCI_ERR_IRQ_INDEX, &irq_info);
     if (ret) {
         /* This can fail for an old kernel or legacy PCI dev */
-        trace_vfio_populate_device_get_irq_info_failure(strerror(-ret));
+        trace_vfio_pci_populate_device_get_irq_info_failure(strerror(-ret));
     } else if (irq_info.count == 1) {
         vdev->pci_aer = true;
     } else {
@@ -2857,7 +2857,7 @@ static bool vfio_populate_device(VFIOPCIDevice *vdev, Error **errp)
     return true;
 }
 
-static void vfio_pci_put_device(VFIOPCIDevice *vdev)
+void vfio_pci_put_device(VFIOPCIDevice *vdev)
 {
     vfio_display_finalize(vdev);
     vfio_bars_finalize(vdev);
@@ -2905,7 +2905,7 @@ static void vfio_err_notifier_handler(void *opaque)
  * and continue after disabling error recovery support for the
  * device.
  */
-static void vfio_register_err_notifier(VFIOPCIDevice *vdev)
+void vfio_pci_register_err_notifier(VFIOPCIDevice *vdev)
 {
     Error *err = NULL;
     int32_t fd;
@@ -2964,7 +2964,7 @@ static void vfio_req_notifier_handler(void *opaque)
     }
 }
 
-static void vfio_register_req_notifier(VFIOPCIDevice *vdev)
+void vfio_pci_register_req_notifier(VFIOPCIDevice *vdev)
 {
     struct vfio_irq_info irq_info;
     Error *err = NULL;
@@ -3018,7 +3018,7 @@ static void vfio_unregister_req_notifier(VFIOPCIDevice *vdev)
     vdev->req_enabled = false;
 }
 
-static bool vfio_pci_config_setup(VFIOPCIDevice *vdev, Error **errp)
+bool vfio_pci_config_setup(VFIOPCIDevice *vdev, Error **errp)
 {
     PCIDevice *pdev = &vdev->pdev;
     VFIODevice *vbasedev = &vdev->vbasedev;
@@ -3124,7 +3124,7 @@ static bool vfio_pci_config_setup(VFIOPCIDevice *vdev, Error **errp)
     return true;
 }
 
-static bool vfio_interrupt_setup(VFIOPCIDevice *vdev, Error **errp)
+bool vfio_pci_interrupt_setup(VFIOPCIDevice *vdev, Error **errp)
 {
     PCIDevice *pdev = &vdev->pdev;
 
@@ -3214,7 +3214,7 @@ static void vfio_pci_realize(PCIDevice *pdev, Error **errp)
         goto error;
     }
 
-    if (!vfio_populate_device(vdev, errp)) {
+    if (!vfio_pci_populate_device(vdev, errp)) {
         goto error;
     }
 
@@ -3228,7 +3228,7 @@ static void vfio_pci_realize(PCIDevice *pdev, Error **errp)
         goto out_teardown;
     }
 
-    if (!vfio_add_capabilities(vdev, errp)) {
+    if (!vfio_pci_add_capabilities(vdev, errp)) {
         goto out_unset_idev;
     }
 
@@ -3244,7 +3244,7 @@ static void vfio_pci_realize(PCIDevice *pdev, Error **errp)
         vfio_bar_quirk_setup(vdev, i);
     }
 
-    if (!vfio_interrupt_setup(vdev, errp)) {
+    if (!vfio_pci_interrupt_setup(vdev, errp)) {
         goto out_unset_idev;
     }
 
@@ -3288,8 +3288,8 @@ static void vfio_pci_realize(PCIDevice *pdev, Error **errp)
         }
     }
 
-    vfio_register_err_notifier(vdev);
-    vfio_register_req_notifier(vdev);
+    vfio_pci_register_err_notifier(vdev);
+    vfio_pci_register_req_notifier(vdev);
     vfio_setup_resetfn_quirk(vdev);
 
     return;
@@ -3310,8 +3310,8 @@ out_unset_idev:
         pci_device_unset_iommu_device(pdev);
     }
 out_teardown:
-    vfio_teardown_msi(vdev);
-    vfio_bars_exit(vdev);
+    vfio_pci_teardown_msi(vdev);
+    vfio_pci_bars_exit(vdev);
 error:
     error_prepend(errp, VFIO_MSG_PREFIX, vbasedev->name);
 }
@@ -3338,9 +3338,9 @@ static void vfio_exitfn(PCIDevice *pdev)
     if (vdev->intx.mmap_timer) {
         timer_free(vdev->intx.mmap_timer);
     }
-    vfio_teardown_msi(vdev);
+    vfio_pci_teardown_msi(vdev);
     vfio_pci_disable_rp_atomics(vdev);
-    vfio_bars_exit(vdev);
+    vfio_pci_bars_exit(vdev);
     vfio_migration_exit(vbasedev);
     if (!vbasedev->mdev) {
         pci_device_unset_iommu_device(pdev);
diff --git a/hw/vfio/pci.h b/hw/vfio/pci.h
index 5ce0fb916f..d4c6b2e7b7 100644
--- a/hw/vfio/pci.h
+++ b/hw/vfio/pci.h
@@ -248,4 +248,15 @@ void vfio_display_finalize(VFIOPCIDevice *vdev);
 
 extern const VMStateDescription vfio_display_vmstate;
 
+void vfio_pci_bars_exit(VFIOPCIDevice *vdev);
+bool vfio_pci_add_capabilities(VFIOPCIDevice *vdev, Error **errp);
+bool vfio_pci_config_setup(VFIOPCIDevice *vdev, Error **errp);
+bool vfio_pci_interrupt_setup(VFIOPCIDevice *vdev, Error **errp);
+void vfio_pci_intx_eoi(VFIODevice *vbasedev);
+void vfio_pci_put_device(VFIOPCIDevice *vdev);
+bool vfio_pci_populate_device(VFIOPCIDevice *vdev, Error **errp);
+void vfio_pci_register_err_notifier(VFIOPCIDevice *vdev);
+void vfio_pci_register_req_notifier(VFIOPCIDevice *vdev);
+void vfio_pci_teardown_msi(VFIOPCIDevice *vdev);
+
 #endif /* HW_VFIO_VFIO_PCI_H */
diff --git a/hw/vfio/trace-events b/hw/vfio/trace-events
index e90ec9bff8..f06236f37b 100644
--- a/hw/vfio/trace-events
+++ b/hw/vfio/trace-events
@@ -2,7 +2,7 @@
 
 # pci.c
 vfio_intx_interrupt(const char *name, char line) " (%s) Pin %c"
-vfio_intx_eoi(const char *name) " (%s) EOI"
+vfio_pci_intx_eoi(const char *name) " (%s) EOI"
 vfio_intx_enable_kvm(const char *name) " (%s) KVM INTx accel enabled"
 vfio_intx_disable_kvm(const char *name) " (%s) KVM INTx accel disabled"
 vfio_intx_update(const char *name, int new_irq, int target_irq) " (%s) IRQ moved %d -> %d"
@@ -35,8 +35,8 @@ vfio_pci_hot_reset(const char *name, const char *type) " (%s) %s"
 vfio_pci_hot_reset_has_dep_devices(const char *name) "%s: hot reset dependent devices:"
 vfio_pci_hot_reset_dep_devices(int domain, int bus, int slot, int function, int group_id) "\t%04x:%02x:%02x.%x group %d"
 vfio_pci_hot_reset_result(const char *name, const char *result) "%s hot reset: %s"
-vfio_populate_device_config(const char *name, unsigned long size, unsigned long offset, unsigned long flags) "Device '%s' config: size: 0x%lx, offset: 0x%lx, flags: 0x%lx"
-vfio_populate_device_get_irq_info_failure(const char *errstr) "VFIO_DEVICE_GET_IRQ_INFO failure: %s"
+vfio_pci_populate_device_config(const char *name, unsigned long size, unsigned long offset, unsigned long flags) "Device '%s' config: size: 0x%lx, offset: 0x%lx, flags: 0x%lx"
+vfio_pci_populate_device_get_irq_info_failure(const char *errstr) "VFIO_DEVICE_GET_IRQ_INFO failure: %s"
 vfio_mdev(const char *name, bool is_mdev) " (%s) is_mdev %d"
 vfio_add_ext_cap_dropped(const char *name, uint16_t cap, uint16_t offset) "%s 0x%x@0x%x"
 vfio_pci_reset(const char *name) " (%s)"

From 59adfc6f1843538d78373296fd05a57ced1f3ecb Mon Sep 17 00:00:00 2001
From: John Levon <john.levon@nutanix.com>
Date: Fri, 6 Jun 2025 17:10:35 -0700
Subject: [PATCH 1523/2760] vfio: add per-region fd support
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

For vfio-user, each region has its own fd rather than sharing
vbasedev's. Add the necessary plumbing to support this, and use the
correct fd in vfio_region_mmap().

Signed-off-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250607001056.335310-4-john.levon@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/device.c              | 29 +++++++++++++++++++++++++----
 hw/vfio/region.c              |  9 +++++++--
 include/hw/vfio/vfio-device.h |  7 +++++--
 3 files changed, 37 insertions(+), 8 deletions(-)

diff --git a/hw/vfio/device.c b/hw/vfio/device.c
index 9fba2c7272..a4bdde8e8b 100644
--- a/hw/vfio/device.c
+++ b/hw/vfio/device.c
@@ -200,6 +200,7 @@ int vfio_device_get_region_info(VFIODevice *vbasedev, int index,
                                 struct vfio_region_info **info)
 {
     size_t argsz = sizeof(struct vfio_region_info);
+    int fd = -1;
     int ret;
 
     /* check cache */
@@ -214,7 +215,7 @@ int vfio_device_get_region_info(VFIODevice *vbasedev, int index,
 retry:
     (*info)->argsz = argsz;
 
-    ret = vbasedev->io_ops->get_region_info(vbasedev, *info);
+    ret = vbasedev->io_ops->get_region_info(vbasedev, *info, &fd);
     if (ret != 0) {
         g_free(*info);
         *info = NULL;
@@ -225,11 +226,19 @@ retry:
         argsz = (*info)->argsz;
         *info = g_realloc(*info, argsz);
 
+        if (fd != -1) {
+            close(fd);
+            fd = -1;
+        }
+
         goto retry;
     }
 
     /* fill cache */
     vbasedev->reginfo[index] = *info;
+    if (vbasedev->region_fds != NULL) {
+        vbasedev->region_fds[index] = fd;
+    }
 
     return 0;
 }
@@ -334,6 +343,7 @@ void vfio_device_init(VFIODevice *vbasedev, int type, VFIODeviceOps *ops,
     vbasedev->io_ops = &vfio_device_io_ops_ioctl;
     vbasedev->dev = dev;
     vbasedev->fd = -1;
+    vbasedev->use_region_fds = false;
 
     vbasedev->ram_block_discard_allowed = ram_discard;
 }
@@ -444,6 +454,9 @@ void vfio_device_prepare(VFIODevice *vbasedev, VFIOContainerBase *bcontainer,
 
     vbasedev->reginfo = g_new0(struct vfio_region_info *,
                                vbasedev->num_regions);
+    if (vbasedev->use_region_fds) {
+        vbasedev->region_fds = g_new0(int, vbasedev->num_regions);
+    }
 }
 
 void vfio_device_unprepare(VFIODevice *vbasedev)
@@ -452,9 +465,14 @@ void vfio_device_unprepare(VFIODevice *vbasedev)
 
     for (i = 0; i < vbasedev->num_regions; i++) {
         g_free(vbasedev->reginfo[i]);
+        if (vbasedev->region_fds != NULL && vbasedev->region_fds[i] != -1) {
+            close(vbasedev->region_fds[i]);
+        }
+
     }
-    g_free(vbasedev->reginfo);
-    vbasedev->reginfo = NULL;
+
+    g_clear_pointer(&vbasedev->reginfo, g_free);
+    g_clear_pointer(&vbasedev->region_fds, g_free);
 
     QLIST_REMOVE(vbasedev, container_next);
     QLIST_REMOVE(vbasedev, global_next);
@@ -476,10 +494,13 @@ static int vfio_device_io_device_feature(VFIODevice *vbasedev,
 }
 
 static int vfio_device_io_get_region_info(VFIODevice *vbasedev,
-                                          struct vfio_region_info *info)
+                                          struct vfio_region_info *info,
+                                          int *fd)
 {
     int ret;
 
+    *fd = -1;
+
     ret = ioctl(vbasedev->fd, VFIO_DEVICE_GET_REGION_INFO, info);
 
     return ret < 0 ? -errno : ret;
diff --git a/hw/vfio/region.c b/hw/vfio/region.c
index 34752c3f65..cb172f2136 100644
--- a/hw/vfio/region.c
+++ b/hw/vfio/region.c
@@ -241,6 +241,7 @@ int vfio_region_mmap(VFIORegion *region)
 {
     int i, ret, prot = 0;
     char *name;
+    int fd;
 
     if (!region->mem) {
         return 0;
@@ -271,14 +272,18 @@ int vfio_region_mmap(VFIORegion *region)
             goto no_mmap;
         }
 
+        /* Use the per-region fd if set, or the shared fd. */
+        fd = region->vbasedev->region_fds ?
+             region->vbasedev->region_fds[region->nr] :
+             region->vbasedev->fd,
+
         map_align = (void *)ROUND_UP((uintptr_t)map_base, (uintptr_t)align);
         munmap(map_base, map_align - map_base);
         munmap(map_align + region->mmaps[i].size,
                align - (map_align - map_base));
 
         region->mmaps[i].mmap = mmap(map_align, region->mmaps[i].size, prot,
-                                     MAP_SHARED | MAP_FIXED,
-                                     region->vbasedev->fd,
+                                     MAP_SHARED | MAP_FIXED, fd,
                                      region->fd_offset +
                                      region->mmaps[i].offset);
         if (region->mmaps[i].mmap == MAP_FAILED) {
diff --git a/include/hw/vfio/vfio-device.h b/include/hw/vfio/vfio-device.h
index 8bcb3c19f6..bf54fc6920 100644
--- a/include/hw/vfio/vfio-device.h
+++ b/include/hw/vfio/vfio-device.h
@@ -66,6 +66,7 @@ typedef struct VFIODevice {
     OnOffAuto enable_migration;
     OnOffAuto migration_multifd_transfer;
     bool migration_events;
+    bool use_region_fds;
     VFIODeviceOps *ops;
     VFIODeviceIOOps *io_ops;
     unsigned int num_irqs;
@@ -84,6 +85,7 @@ typedef struct VFIODevice {
     VFIOIOASHwpt *hwpt;
     QLIST_ENTRY(VFIODevice) hwpt_next;
     struct vfio_region_info **reginfo;
+    int *region_fds;
 } VFIODevice;
 
 struct VFIODeviceOps {
@@ -170,10 +172,11 @@ struct VFIODeviceIOOps {
     /**
      * @get_region_info
      *
-     * Fill in @info with information on the region given by @info->index.
+     * Fill in @info (and optionally @fd) with information on the region given
+     * by @info->index.
      */
     int (*get_region_info)(VFIODevice *vdev,
-                           struct vfio_region_info *info);
+                           struct vfio_region_info *info, int *fd);
 
     /**
      * @get_irq_info

From a574b0614449760a83310226b548e21b08a805fa Mon Sep 17 00:00:00 2001
From: John Levon <john.levon@nutanix.com>
Date: Fri, 6 Jun 2025 17:10:36 -0700
Subject: [PATCH 1524/2760] vfio: mark posted writes in region write callbacks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

For vfio-user, the region write implementation needs to know if the
write is posted; add the necessary plumbing to support this.

Signed-off-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250607001056.335310-5-john.levon@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/device.c              | 3 ++-
 hw/vfio/pci.c                 | 5 ++++-
 hw/vfio/region.c              | 3 ++-
 include/hw/vfio/vfio-device.h | 4 ++--
 include/hw/vfio/vfio-region.h | 1 +
 5 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/hw/vfio/device.c b/hw/vfio/device.c
index a4bdde8e8b..d32600eda1 100644
--- a/hw/vfio/device.c
+++ b/hw/vfio/device.c
@@ -543,7 +543,8 @@ static int vfio_device_io_region_read(VFIODevice *vbasedev, uint8_t index,
 }
 
 static int vfio_device_io_region_write(VFIODevice *vbasedev, uint8_t index,
-                                       off_t off, uint32_t size, void *data)
+                                       off_t off, uint32_t size, void *data,
+                                       bool post)
 {
     struct vfio_region_info *info;
     int ret;
diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index 2901cedf6f..89f9246416 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -989,7 +989,7 @@ static int vfio_pci_config_space_write(VFIOPCIDevice *vdev, off_t offset,
 {
     return vdev->vbasedev.io_ops->region_write(&vdev->vbasedev,
                                                VFIO_PCI_CONFIG_REGION_INDEX,
-                                               offset, size, data);
+                                               offset, size, data, false);
 }
 
 static uint64_t vfio_rom_read(void *opaque, hwaddr addr, unsigned size)
@@ -1793,6 +1793,9 @@ static void vfio_bar_prepare(VFIOPCIDevice *vdev, int nr)
     bar->type = pci_bar & (bar->ioport ? ~PCI_BASE_ADDRESS_IO_MASK :
                                          ~PCI_BASE_ADDRESS_MEM_MASK);
     bar->size = bar->region.size;
+
+    /* IO regions are sync, memory can be async */
+    bar->region.post_wr = (bar->ioport == 0);
 }
 
 static void vfio_bars_prepare(VFIOPCIDevice *vdev)
diff --git a/hw/vfio/region.c b/hw/vfio/region.c
index cb172f2136..f5b8e3cbf1 100644
--- a/hw/vfio/region.c
+++ b/hw/vfio/region.c
@@ -66,7 +66,7 @@ void vfio_region_write(void *opaque, hwaddr addr,
     }
 
     ret = vbasedev->io_ops->region_write(vbasedev, region->nr,
-                                         addr, size, &buf);
+                                         addr, size, &buf, region->post_wr);
     if (ret != size) {
         error_report("%s(%s:region%d+0x%"HWADDR_PRIx", 0x%"PRIx64
                      ",%d) failed: %s",
@@ -200,6 +200,7 @@ int vfio_region_setup(Object *obj, VFIODevice *vbasedev, VFIORegion *region,
     region->size = info->size;
     region->fd_offset = info->offset;
     region->nr = index;
+    region->post_wr = false;
 
     if (region->size) {
         region->mem = g_new0(MemoryRegion, 1);
diff --git a/include/hw/vfio/vfio-device.h b/include/hw/vfio/vfio-device.h
index bf54fc6920..9793b2dba0 100644
--- a/include/hw/vfio/vfio-device.h
+++ b/include/hw/vfio/vfio-device.h
@@ -205,10 +205,10 @@ struct VFIODeviceIOOps {
      * @region_write
      *
      * Write @size bytes to the region @nr at offset @off from the buffer
-     * @data.
+     * @data; if @post, the write is posted.
      */
     int (*region_write)(VFIODevice *vdev, uint8_t nr, off_t off, uint32_t size,
-                        void *data);
+                        void *data, bool post);
 };
 
 void vfio_device_prepare(VFIODevice *vbasedev, VFIOContainerBase *bcontainer,
diff --git a/include/hw/vfio/vfio-region.h b/include/hw/vfio/vfio-region.h
index cbffb26962..ede6e0c8f9 100644
--- a/include/hw/vfio/vfio-region.h
+++ b/include/hw/vfio/vfio-region.h
@@ -29,6 +29,7 @@ typedef struct VFIORegion {
     uint32_t nr_mmaps;
     VFIOMmap *mmaps;
     uint8_t nr; /* cache the region number for debug */
+    bool post_wr; /* writes can be posted */
 } VFIORegion;
 
 

From f95fd60ac164a75c586ce29ebcc94bb6df85b52a Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Tue, 10 Jun 2025 08:39:14 -0700
Subject: [PATCH 1525/2760] migration: cpr helpers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add the cpr_incoming_needed, cpr_open_fd, and cpr_resave_fd helpers,
for use when adding cpr support for vfio and iommufd.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/1749569991-25171-2-git-send-email-steven.sistare@oracle.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 include/migration/cpr.h |  5 +++++
 migration/cpr.c         | 36 ++++++++++++++++++++++++++++++++++++
 2 files changed, 41 insertions(+)

diff --git a/include/migration/cpr.h b/include/migration/cpr.h
index 7561fc75ad..07858e93fa 100644
--- a/include/migration/cpr.h
+++ b/include/migration/cpr.h
@@ -18,6 +18,9 @@
 void cpr_save_fd(const char *name, int id, int fd);
 void cpr_delete_fd(const char *name, int id);
 int cpr_find_fd(const char *name, int id);
+void cpr_resave_fd(const char *name, int id, int fd);
+int cpr_open_fd(const char *path, int flags, const char *name, int id,
+                Error **errp);
 
 MigMode cpr_get_incoming_mode(void);
 void cpr_set_incoming_mode(MigMode mode);
@@ -28,6 +31,8 @@ int cpr_state_load(MigrationChannel *channel, Error **errp);
 void cpr_state_close(void);
 struct QIOChannel *cpr_state_ioc(void);
 
+bool cpr_incoming_needed(void *opaque);
+
 QEMUFile *cpr_transfer_output(MigrationChannel *channel, Error **errp);
 QEMUFile *cpr_transfer_input(MigrationChannel *channel, Error **errp);
 
diff --git a/migration/cpr.c b/migration/cpr.c
index 42c46563e5..a50a57edca 100644
--- a/migration/cpr.c
+++ b/migration/cpr.c
@@ -95,6 +95,36 @@ int cpr_find_fd(const char *name, int id)
     trace_cpr_find_fd(name, id, fd);
     return fd;
 }
+
+void cpr_resave_fd(const char *name, int id, int fd)
+{
+    CprFd *elem = find_fd(&cpr_state.fds, name, id);
+    int old_fd = elem ? elem->fd : -1;
+
+    if (old_fd < 0) {
+        cpr_save_fd(name, id, fd);
+    } else if (old_fd != fd) {
+        error_setg(&error_fatal,
+                   "internal error: cpr fd '%s' id %d value %d "
+                   "already saved with a different value %d",
+                   name, id, fd, old_fd);
+    }
+}
+
+int cpr_open_fd(const char *path, int flags, const char *name, int id,
+                Error **errp)
+{
+    int fd = cpr_find_fd(name, id);
+
+    if (fd < 0) {
+        fd = qemu_open(path, flags, errp);
+        if (fd >= 0) {
+            cpr_save_fd(name, id, fd);
+        }
+    }
+    return fd;
+}
+
 /*************************************************************************/
 #define CPR_STATE "CprState"
 
@@ -228,3 +258,9 @@ void cpr_state_close(void)
         cpr_state_file = NULL;
     }
 }
+
+bool cpr_incoming_needed(void *opaque)
+{
+    MigMode mode = migrate_mode();
+    return mode == MIG_MODE_CPR_TRANSFER;
+}

From 081c09dc52bab0facfdd1d34fd466479af6ac531 Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Tue, 10 Jun 2025 08:39:15 -0700
Subject: [PATCH 1526/2760] migration: lower handler priority
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Define a vmstate priority that is lower than the default, so its handlers
run after all default priority handlers.  Since 0 is no longer the default
priority, translate an uninitialized priority of 0 to MIG_PRI_DEFAULT.

CPR for vfio will use this to install handlers for containers that run
after handlers for the devices that they contain.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Peter Xu <peterx@redhat.com>
Link: https://lore.kernel.org/qemu-devel/1749569991-25171-3-git-send-email-steven.sistare@oracle.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 include/migration/vmstate.h | 6 +++++-
 migration/savevm.c          | 4 ++--
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/include/migration/vmstate.h b/include/migration/vmstate.h
index a1dfab4460..1ff7bd9ac4 100644
--- a/include/migration/vmstate.h
+++ b/include/migration/vmstate.h
@@ -155,7 +155,11 @@ enum VMStateFlags {
 };
 
 typedef enum {
-    MIG_PRI_DEFAULT = 0,
+    MIG_PRI_UNINITIALIZED = 0,  /* An uninitialized priority field maps to */
+                                /* MIG_PRI_DEFAULT in save_state_priority */
+
+    MIG_PRI_LOW,                /* Must happen after default */
+    MIG_PRI_DEFAULT,
     MIG_PRI_IOMMU,              /* Must happen before PCI devices */
     MIG_PRI_PCI_BUS,            /* Must happen before IOMMU */
     MIG_PRI_VIRTIO_MEM,         /* Must happen before IOMMU */
diff --git a/migration/savevm.c b/migration/savevm.c
index 52105dd2f1..bb04a4520d 100644
--- a/migration/savevm.c
+++ b/migration/savevm.c
@@ -266,7 +266,7 @@ typedef struct SaveState {
 
 static SaveState savevm_state = {
     .handlers = QTAILQ_HEAD_INITIALIZER(savevm_state.handlers),
-    .handler_pri_head = { [MIG_PRI_DEFAULT ... MIG_PRI_MAX] = NULL },
+    .handler_pri_head = { [0 ... MIG_PRI_MAX] = NULL },
     .global_section_id = 0,
 };
 
@@ -737,7 +737,7 @@ static int calculate_compat_instance_id(const char *idstr)
 
 static inline MigrationPriority save_state_priority(SaveStateEntry *se)
 {
-    if (se->vmsd) {
+    if (se->vmsd && se->vmsd->priority) {
         return se->vmsd->priority;
     }
     return MIG_PRI_DEFAULT;

From 54857b08168a0a74711d1f773c16a7122499027b Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Tue, 10 Jun 2025 08:39:16 -0700
Subject: [PATCH 1527/2760] vfio/container: register container for cpr
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Register a legacy container for cpr-transfer, replacing the generic CPR
register call with a more specific legacy container register call.  Add a
blocker if the kernel does not support VFIO_UPDATE_VADDR or VFIO_UNMAP_ALL.

This is mostly boiler plate.  The fields to to saved and restored are added
in subsequent patches.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/1749569991-25171-4-git-send-email-steven.sistare@oracle.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/container.c              |  7 ++--
 hw/vfio/cpr-legacy.c             | 68 ++++++++++++++++++++++++++++++++
 hw/vfio/cpr.c                    |  5 +--
 hw/vfio/meson.build              |  1 +
 include/hw/vfio/vfio-container.h |  2 +
 include/hw/vfio/vfio-cpr.h       | 15 +++++++
 6 files changed, 91 insertions(+), 7 deletions(-)
 create mode 100644 hw/vfio/cpr-legacy.c

diff --git a/hw/vfio/container.c b/hw/vfio/container.c
index 0f948d0247..93cdf80e13 100644
--- a/hw/vfio/container.c
+++ b/hw/vfio/container.c
@@ -33,7 +33,6 @@
 #include "qapi/error.h"
 #include "pci.h"
 #include "hw/vfio/vfio-container.h"
-#include "hw/vfio/vfio-cpr.h"
 #include "vfio-helpers.h"
 #include "vfio-listener.h"
 
@@ -643,7 +642,7 @@ static bool vfio_container_connect(VFIOGroup *group, AddressSpace *as,
     new_container = true;
     bcontainer = &container->bcontainer;
 
-    if (!vfio_cpr_register_container(bcontainer, errp)) {
+    if (!vfio_legacy_cpr_register_container(container, errp)) {
         goto fail;
     }
 
@@ -679,7 +678,7 @@ fail:
         vioc->release(bcontainer);
     }
     if (new_container) {
-        vfio_cpr_unregister_container(bcontainer);
+        vfio_legacy_cpr_unregister_container(container);
         object_unref(container);
     }
     if (fd >= 0) {
@@ -720,7 +719,7 @@ static void vfio_container_disconnect(VFIOGroup *group)
         VFIOAddressSpace *space = bcontainer->space;
 
         trace_vfio_container_disconnect(container->fd);
-        vfio_cpr_unregister_container(bcontainer);
+        vfio_legacy_cpr_unregister_container(container);
         close(container->fd);
         object_unref(container);
 
diff --git a/hw/vfio/cpr-legacy.c b/hw/vfio/cpr-legacy.c
new file mode 100644
index 0000000000..dd7ac84074
--- /dev/null
+++ b/hw/vfio/cpr-legacy.c
@@ -0,0 +1,68 @@
+/*
+ * Copyright (c) 2021-2025 Oracle and/or its affiliates.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include <sys/ioctl.h>
+#include <linux/vfio.h>
+#include "qemu/osdep.h"
+#include "hw/vfio/vfio-container.h"
+#include "migration/blocker.h"
+#include "migration/cpr.h"
+#include "migration/migration.h"
+#include "migration/vmstate.h"
+#include "qapi/error.h"
+
+static bool vfio_cpr_supported(VFIOContainer *container, Error **errp)
+{
+    if (!ioctl(container->fd, VFIO_CHECK_EXTENSION, VFIO_UPDATE_VADDR)) {
+        error_setg(errp, "VFIO container does not support VFIO_UPDATE_VADDR");
+        return false;
+
+    } else if (!ioctl(container->fd, VFIO_CHECK_EXTENSION, VFIO_UNMAP_ALL)) {
+        error_setg(errp, "VFIO container does not support VFIO_UNMAP_ALL");
+        return false;
+
+    } else {
+        return true;
+    }
+}
+
+static const VMStateDescription vfio_container_vmstate = {
+    .name = "vfio-container",
+    .version_id = 0,
+    .minimum_version_id = 0,
+    .needed = cpr_incoming_needed,
+    .fields = (VMStateField[]) {
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+bool vfio_legacy_cpr_register_container(VFIOContainer *container, Error **errp)
+{
+    VFIOContainerBase *bcontainer = &container->bcontainer;
+    Error **cpr_blocker = &container->cpr.blocker;
+
+    migration_add_notifier_mode(&bcontainer->cpr_reboot_notifier,
+                                vfio_cpr_reboot_notifier,
+                                MIG_MODE_CPR_REBOOT);
+
+    if (!vfio_cpr_supported(container, cpr_blocker)) {
+        return migrate_add_blocker_modes(cpr_blocker, errp,
+                                         MIG_MODE_CPR_TRANSFER, -1) == 0;
+    }
+
+    vmstate_register(NULL, -1, &vfio_container_vmstate, container);
+
+    return true;
+}
+
+void vfio_legacy_cpr_unregister_container(VFIOContainer *container)
+{
+    VFIOContainerBase *bcontainer = &container->bcontainer;
+
+    migration_remove_notifier(&bcontainer->cpr_reboot_notifier);
+    migrate_del_blocker(&container->cpr.blocker);
+    vmstate_unregister(NULL, &vfio_container_vmstate, container);
+}
diff --git a/hw/vfio/cpr.c b/hw/vfio/cpr.c
index 0210e76a10..0e59612228 100644
--- a/hw/vfio/cpr.c
+++ b/hw/vfio/cpr.c
@@ -7,13 +7,12 @@
 
 #include "qemu/osdep.h"
 #include "hw/vfio/vfio-device.h"
-#include "migration/misc.h"
 #include "hw/vfio/vfio-cpr.h"
 #include "qapi/error.h"
 #include "system/runstate.h"
 
-static int vfio_cpr_reboot_notifier(NotifierWithReturn *notifier,
-                                    MigrationEvent *e, Error **errp)
+int vfio_cpr_reboot_notifier(NotifierWithReturn *notifier,
+                             MigrationEvent *e, Error **errp)
 {
     if (e->type == MIG_EVENT_PRECOPY_SETUP &&
         !runstate_check(RUN_STATE_SUSPENDED) && !vm_get_suspended()) {
diff --git a/hw/vfio/meson.build b/hw/vfio/meson.build
index bccb05098c..73d29f925f 100644
--- a/hw/vfio/meson.build
+++ b/hw/vfio/meson.build
@@ -21,6 +21,7 @@ system_ss.add(when: 'CONFIG_VFIO_XGMAC', if_true: files('calxeda-xgmac.c'))
 system_ss.add(when: 'CONFIG_VFIO_AMD_XGBE', if_true: files('amd-xgbe.c'))
 system_ss.add(when: 'CONFIG_VFIO', if_true: files(
   'cpr.c',
+  'cpr-legacy.c',
   'device.c',
   'migration.c',
   'migration-multifd.c',
diff --git a/include/hw/vfio/vfio-container.h b/include/hw/vfio/vfio-container.h
index afc498da49..21e5807e48 100644
--- a/include/hw/vfio/vfio-container.h
+++ b/include/hw/vfio/vfio-container.h
@@ -10,6 +10,7 @@
 #define HW_VFIO_CONTAINER_H
 
 #include "hw/vfio/vfio-container-base.h"
+#include "hw/vfio/vfio-cpr.h"
 
 typedef struct VFIOContainer VFIOContainer;
 typedef struct VFIODevice VFIODevice;
@@ -29,6 +30,7 @@ typedef struct VFIOContainer {
     int fd; /* /dev/vfio/vfio, empowered by the attached groups */
     unsigned iommu_type;
     QLIST_HEAD(, VFIOGroup) group_list;
+    VFIOContainerCPR cpr;
 } VFIOContainer;
 
 OBJECT_DECLARE_SIMPLE_TYPE(VFIOContainer, VFIO_IOMMU_LEGACY);
diff --git a/include/hw/vfio/vfio-cpr.h b/include/hw/vfio/vfio-cpr.h
index 750ea5bcea..d4e0bd53c9 100644
--- a/include/hw/vfio/vfio-cpr.h
+++ b/include/hw/vfio/vfio-cpr.h
@@ -9,8 +9,23 @@
 #ifndef HW_VFIO_VFIO_CPR_H
 #define HW_VFIO_VFIO_CPR_H
 
+#include "migration/misc.h"
+
+struct VFIOContainer;
 struct VFIOContainerBase;
 
+typedef struct VFIOContainerCPR {
+    Error *blocker;
+} VFIOContainerCPR;
+
+
+bool vfio_legacy_cpr_register_container(struct VFIOContainer *container,
+                                        Error **errp);
+void vfio_legacy_cpr_unregister_container(struct VFIOContainer *container);
+
+int vfio_cpr_reboot_notifier(NotifierWithReturn *notifier, MigrationEvent *e,
+                             Error **errp);
+
 bool vfio_cpr_register_container(struct VFIOContainerBase *bcontainer,
                                  Error **errp);
 void vfio_cpr_unregister_container(struct VFIOContainerBase *bcontainer);

From c29a65ed68535288551d2bf70ae32f3df371a57d Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Tue, 10 Jun 2025 08:39:17 -0700
Subject: [PATCH 1528/2760] vfio/container: preserve descriptors
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

At vfio creation time, save the value of vfio container, group, and device
descriptors in CPR state.  On qemu restart, vfio_realize() finds and uses
the saved descriptors.

During reuse, device and iommu state is already configured, so operations
in vfio_realize that would modify the configuration, such as vfio ioctl's,
are skipped.  The result is that vfio_realize constructs qemu data
structures that reflect the current state of the device.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Link: https://lore.kernel.org/qemu-devel/1749569991-25171-5-git-send-email-steven.sistare@oracle.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/container.c        | 67 +++++++++++++++++++++++++++++---------
 hw/vfio/cpr-legacy.c       | 42 ++++++++++++++++++++++++
 include/hw/vfio/vfio-cpr.h |  6 ++++
 3 files changed, 100 insertions(+), 15 deletions(-)

diff --git a/hw/vfio/container.c b/hw/vfio/container.c
index 93cdf80e13..5caae4ccae 100644
--- a/hw/vfio/container.c
+++ b/hw/vfio/container.c
@@ -31,6 +31,8 @@
 #include "system/reset.h"
 #include "trace.h"
 #include "qapi/error.h"
+#include "migration/cpr.h"
+#include "migration/blocker.h"
 #include "pci.h"
 #include "hw/vfio/vfio-container.h"
 #include "vfio-helpers.h"
@@ -425,7 +427,12 @@ static VFIOContainer *vfio_create_container(int fd, VFIOGroup *group,
         return NULL;
     }
 
-    if (!vfio_set_iommu(fd, group->fd, &iommu_type, errp)) {
+    /*
+     * During CPR, just set the container type and skip the ioctls, as the
+     * container and group are already configured in the kernel.
+     */
+    if (!cpr_is_incoming() &&
+        !vfio_set_iommu(fd, group->fd, &iommu_type, errp)) {
         return NULL;
     }
 
@@ -592,6 +599,11 @@ static bool vfio_container_group_add(VFIOContainer *container, VFIOGroup *group,
     group->container = container;
     QLIST_INSERT_HEAD(&container->group_list, group, container_next);
     vfio_group_add_kvm_device(group);
+    /*
+     * Remember the container fd for each group, so we can attach to the same
+     * container after CPR.
+     */
+    cpr_resave_fd("vfio_container_for_group", group->groupid, container->fd);
     return true;
 }
 
@@ -601,6 +613,7 @@ static void vfio_container_group_del(VFIOContainer *container, VFIOGroup *group)
     group->container = NULL;
     vfio_group_del_kvm_device(group);
     vfio_ram_block_discard_disable(container, false);
+    cpr_delete_fd("vfio_container_for_group", group->groupid);
 }
 
 static bool vfio_container_connect(VFIOGroup *group, AddressSpace *as,
@@ -615,17 +628,34 @@ static bool vfio_container_connect(VFIOGroup *group, AddressSpace *as,
     bool group_was_added = false;
 
     space = vfio_address_space_get(as);
+    fd = cpr_find_fd("vfio_container_for_group", group->groupid);
 
-    QLIST_FOREACH(bcontainer, &space->containers, next) {
-        container = container_of(bcontainer, VFIOContainer, bcontainer);
-        if (!ioctl(group->fd, VFIO_GROUP_SET_CONTAINER, &container->fd)) {
-            return vfio_container_group_add(container, group, errp);
+    if (!cpr_is_incoming()) {
+        QLIST_FOREACH(bcontainer, &space->containers, next) {
+            container = container_of(bcontainer, VFIOContainer, bcontainer);
+            if (!ioctl(group->fd, VFIO_GROUP_SET_CONTAINER, &container->fd)) {
+                return vfio_container_group_add(container, group, errp);
+            }
         }
-    }
 
-    fd = qemu_open("/dev/vfio/vfio", O_RDWR, errp);
-    if (fd < 0) {
-        goto fail;
+        fd = qemu_open("/dev/vfio/vfio", O_RDWR, errp);
+        if (fd < 0) {
+            goto fail;
+        }
+    } else {
+        /*
+         * For incoming CPR, the group is already attached in the kernel.
+         * If a container with matching fd is found, then update the
+         * userland group list and return.  If not, then after the loop,
+         * create the container struct and group list.
+         */
+        QLIST_FOREACH(bcontainer, &space->containers, next) {
+            container = container_of(bcontainer, VFIOContainer, bcontainer);
+
+            if (vfio_cpr_container_match(container, group, fd)) {
+                return vfio_container_group_add(container, group, errp);
+            }
+        }
     }
 
     ret = ioctl(fd, VFIO_GET_API_VERSION);
@@ -697,6 +727,7 @@ static void vfio_container_disconnect(VFIOGroup *group)
 
     QLIST_REMOVE(group, container_next);
     group->container = NULL;
+    cpr_delete_fd("vfio_container_for_group", group->groupid);
 
     /*
      * Explicitly release the listener first before unset container,
@@ -750,7 +781,7 @@ static VFIOGroup *vfio_group_get(int groupid, AddressSpace *as, Error **errp)
     group = g_malloc0(sizeof(*group));
 
     snprintf(path, sizeof(path), "/dev/vfio/%d", groupid);
-    group->fd = qemu_open(path, O_RDWR, errp);
+    group->fd = cpr_open_fd(path, O_RDWR, "vfio_group", groupid, errp);
     if (group->fd < 0) {
         goto free_group_exit;
     }
@@ -782,6 +813,7 @@ static VFIOGroup *vfio_group_get(int groupid, AddressSpace *as, Error **errp)
     return group;
 
 close_fd_exit:
+    cpr_delete_fd("vfio_group", groupid);
     close(group->fd);
 
 free_group_exit:
@@ -803,6 +835,7 @@ static void vfio_group_put(VFIOGroup *group)
     vfio_container_disconnect(group);
     QLIST_REMOVE(group, next);
     trace_vfio_group_put(group->fd);
+    cpr_delete_fd("vfio_group", group->groupid);
     close(group->fd);
     g_free(group);
 }
@@ -813,7 +846,7 @@ static bool vfio_device_get(VFIOGroup *group, const char *name,
     g_autofree struct vfio_device_info *info = NULL;
     int fd;
 
-    fd = ioctl(group->fd, VFIO_GROUP_GET_DEVICE_FD, name);
+    fd = vfio_cpr_group_get_device_fd(group->fd, name);
     if (fd < 0) {
         error_setg_errno(errp, errno, "error getting device from group %d",
                          group->groupid);
@@ -826,8 +859,7 @@ static bool vfio_device_get(VFIOGroup *group, const char *name,
     info = vfio_get_device_info(fd);
     if (!info) {
         error_setg_errno(errp, errno, "error getting device info");
-        close(fd);
-        return false;
+        goto fail;
     }
 
     /*
@@ -841,8 +873,7 @@ static bool vfio_device_get(VFIOGroup *group, const char *name,
         if (!QLIST_EMPTY(&group->device_list)) {
             error_setg(errp, "Inconsistent setting of support for discarding "
                        "RAM (e.g., balloon) within group");
-            close(fd);
-            return false;
+            goto fail;
         }
 
         if (!group->ram_block_discard_allowed) {
@@ -860,6 +891,11 @@ static bool vfio_device_get(VFIOGroup *group, const char *name,
     trace_vfio_device_get(name, info->flags, info->num_regions, info->num_irqs);
 
     return true;
+
+fail:
+    close(fd);
+    cpr_delete_fd(name, 0);
+    return false;
 }
 
 static void vfio_device_put(VFIODevice *vbasedev)
@@ -870,6 +906,7 @@ static void vfio_device_put(VFIODevice *vbasedev)
     QLIST_REMOVE(vbasedev, next);
     vbasedev->group = NULL;
     trace_vfio_device_put(vbasedev->fd);
+    cpr_delete_fd(vbasedev->name, 0);
     close(vbasedev->fd);
 }
 
diff --git a/hw/vfio/cpr-legacy.c b/hw/vfio/cpr-legacy.c
index dd7ac84074..ac4a9ab315 100644
--- a/hw/vfio/cpr-legacy.c
+++ b/hw/vfio/cpr-legacy.c
@@ -8,6 +8,7 @@
 #include <linux/vfio.h>
 #include "qemu/osdep.h"
 #include "hw/vfio/vfio-container.h"
+#include "hw/vfio/vfio-device.h"
 #include "migration/blocker.h"
 #include "migration/cpr.h"
 #include "migration/migration.h"
@@ -66,3 +67,44 @@ void vfio_legacy_cpr_unregister_container(VFIOContainer *container)
     migrate_del_blocker(&container->cpr.blocker);
     vmstate_unregister(NULL, &vfio_container_vmstate, container);
 }
+
+int vfio_cpr_group_get_device_fd(int d, const char *name)
+{
+    const int id = 0;
+    int fd = cpr_find_fd(name, id);
+
+    if (fd < 0) {
+        fd = ioctl(d, VFIO_GROUP_GET_DEVICE_FD, name);
+        if (fd >= 0) {
+            cpr_save_fd(name, id, fd);
+        }
+    }
+    return fd;
+}
+
+static bool same_device(int fd1, int fd2)
+{
+    struct stat st1, st2;
+
+    return !fstat(fd1, &st1) && !fstat(fd2, &st2) && st1.st_dev == st2.st_dev;
+}
+
+bool vfio_cpr_container_match(VFIOContainer *container, VFIOGroup *group,
+                              int fd)
+{
+    if (container->fd == fd) {
+        return true;
+    }
+    if (!same_device(container->fd, fd)) {
+        return false;
+    }
+    /*
+     * Same device, different fd.  This occurs when the container fd is
+     * cpr_save'd multiple times, once for each groupid, so SCM_RIGHTS
+     * produces duplicates.  De-dup it.
+     */
+    cpr_delete_fd("vfio_container_for_group", group->groupid);
+    close(fd);
+    cpr_save_fd("vfio_container_for_group", group->groupid, container->fd);
+    return true;
+}
diff --git a/include/hw/vfio/vfio-cpr.h b/include/hw/vfio/vfio-cpr.h
index d4e0bd53c9..5a2e5f6b21 100644
--- a/include/hw/vfio/vfio-cpr.h
+++ b/include/hw/vfio/vfio-cpr.h
@@ -13,6 +13,7 @@
 
 struct VFIOContainer;
 struct VFIOContainerBase;
+struct VFIOGroup;
 
 typedef struct VFIOContainerCPR {
     Error *blocker;
@@ -30,4 +31,9 @@ bool vfio_cpr_register_container(struct VFIOContainerBase *bcontainer,
                                  Error **errp);
 void vfio_cpr_unregister_container(struct VFIOContainerBase *bcontainer);
 
+int vfio_cpr_group_get_device_fd(int d, const char *name);
+
+bool vfio_cpr_container_match(struct VFIOContainer *container,
+                              struct VFIOGroup *group, int fd);
+
 #endif /* HW_VFIO_VFIO_CPR_H */

From 1faadd96306b428f2e8e35f71761c333a6777f55 Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Tue, 10 Jun 2025 08:39:18 -0700
Subject: [PATCH 1529/2760] vfio/container: discard old DMA vaddr
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In the container pre_save handler, discard the virtual addresses in DMA
mappings with VFIO_DMA_UNMAP_FLAG_VADDR, because guest RAM will be
remapped at a different VA after in new QEMU.  DMA to already-mapped
pages continues.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/1749569991-25171-6-git-send-email-steven.sistare@oracle.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/cpr-legacy.c | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/hw/vfio/cpr-legacy.c b/hw/vfio/cpr-legacy.c
index ac4a9ab315..ef106d0ea8 100644
--- a/hw/vfio/cpr-legacy.c
+++ b/hw/vfio/cpr-legacy.c
@@ -15,6 +15,22 @@
 #include "migration/vmstate.h"
 #include "qapi/error.h"
 
+static bool vfio_dma_unmap_vaddr_all(VFIOContainer *container, Error **errp)
+{
+    struct vfio_iommu_type1_dma_unmap unmap = {
+        .argsz = sizeof(unmap),
+        .flags = VFIO_DMA_UNMAP_FLAG_VADDR | VFIO_DMA_UNMAP_FLAG_ALL,
+        .iova = 0,
+        .size = 0,
+    };
+    if (ioctl(container->fd, VFIO_IOMMU_UNMAP_DMA, &unmap)) {
+        error_setg_errno(errp, errno, "vfio_dma_unmap_vaddr_all");
+        return false;
+    }
+    return true;
+}
+
+
 static bool vfio_cpr_supported(VFIOContainer *container, Error **errp)
 {
     if (!ioctl(container->fd, VFIO_CHECK_EXTENSION, VFIO_UPDATE_VADDR)) {
@@ -30,10 +46,23 @@ static bool vfio_cpr_supported(VFIOContainer *container, Error **errp)
     }
 }
 
+static int vfio_container_pre_save(void *opaque)
+{
+    VFIOContainer *container = opaque;
+    Error *local_err = NULL;
+
+    if (!vfio_dma_unmap_vaddr_all(container, &local_err)) {
+        error_report_err(local_err);
+        return -1;
+    }
+    return 0;
+}
+
 static const VMStateDescription vfio_container_vmstate = {
     .name = "vfio-container",
     .version_id = 0,
     .minimum_version_id = 0,
+    .pre_save = vfio_container_pre_save,
     .needed = cpr_incoming_needed,
     .fields = (VMStateField[]) {
         VMSTATE_END_OF_LIST()

From 7e9f21411302d823e9ee563ff6a2a40b1ffc1266 Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Tue, 10 Jun 2025 08:39:19 -0700
Subject: [PATCH 1530/2760] vfio/container: restore DMA vaddr
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In new QEMU, do not register the memory listener at device creation time.
Register it later, in the container post_load handler, after all vmstate
that may affect regions and mapping boundaries has been loaded.  The
post_load registration will cause the listener to invoke its callback on
each flat section, and the calls will match the mappings remembered by the
kernel.

The listener calls a special dma_map handler that passes the new VA of each
section to the kernel using VFIO_DMA_MAP_FLAG_VADDR.  Restore the normal
handler at the end.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/1749569991-25171-7-git-send-email-steven.sistare@oracle.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/container.c        | 15 ++++++++--
 hw/vfio/cpr-legacy.c       | 57 ++++++++++++++++++++++++++++++++++++++
 include/hw/vfio/vfio-cpr.h |  3 ++
 3 files changed, 73 insertions(+), 2 deletions(-)

diff --git a/hw/vfio/container.c b/hw/vfio/container.c
index 5caae4ccae..936ce37f19 100644
--- a/hw/vfio/container.c
+++ b/hw/vfio/container.c
@@ -136,6 +136,8 @@ static int vfio_legacy_dma_unmap_one(const VFIOContainerBase *bcontainer,
     int ret;
     Error *local_err = NULL;
 
+    g_assert(!cpr_is_incoming());
+
     if (iotlb && vfio_container_dirty_tracking_is_started(bcontainer)) {
         if (!vfio_container_devices_dirty_tracking_is_supported(bcontainer) &&
             bcontainer->dirty_pages_supported) {
@@ -690,8 +692,17 @@ static bool vfio_container_connect(VFIOGroup *group, AddressSpace *as,
     }
     group_was_added = true;
 
-    if (!vfio_listener_register(bcontainer, errp)) {
-        goto fail;
+    /*
+     * If CPR, register the listener later, after all state that may
+     * affect regions and mapping boundaries has been cpr load'ed.  Later,
+     * the listener will invoke its callback on each flat section and call
+     * dma_map to supply the new vaddr, and the calls will match the mappings
+     * remembered by the kernel.
+     */
+    if (!cpr_is_incoming()) {
+        if (!vfio_listener_register(bcontainer, errp)) {
+            goto fail;
+        }
     }
 
     bcontainer->initialized = true;
diff --git a/hw/vfio/cpr-legacy.c b/hw/vfio/cpr-legacy.c
index ef106d0ea8..2fd8348c7c 100644
--- a/hw/vfio/cpr-legacy.c
+++ b/hw/vfio/cpr-legacy.c
@@ -9,11 +9,13 @@
 #include "qemu/osdep.h"
 #include "hw/vfio/vfio-container.h"
 #include "hw/vfio/vfio-device.h"
+#include "hw/vfio/vfio-listener.h"
 #include "migration/blocker.h"
 #include "migration/cpr.h"
 #include "migration/migration.h"
 #include "migration/vmstate.h"
 #include "qapi/error.h"
+#include "qemu/error-report.h"
 
 static bool vfio_dma_unmap_vaddr_all(VFIOContainer *container, Error **errp)
 {
@@ -30,6 +32,32 @@ static bool vfio_dma_unmap_vaddr_all(VFIOContainer *container, Error **errp)
     return true;
 }
 
+/*
+ * Set the new @vaddr for any mappings registered during cpr load.
+ * The incoming state is cleared thereafter.
+ */
+static int vfio_legacy_cpr_dma_map(const VFIOContainerBase *bcontainer,
+                                   hwaddr iova, ram_addr_t size, void *vaddr,
+                                   bool readonly, MemoryRegion *mr)
+{
+    const VFIOContainer *container = container_of(bcontainer, VFIOContainer,
+                                                  bcontainer);
+    struct vfio_iommu_type1_dma_map map = {
+        .argsz = sizeof(map),
+        .flags = VFIO_DMA_MAP_FLAG_VADDR,
+        .vaddr = (__u64)(uintptr_t)vaddr,
+        .iova = iova,
+        .size = size,
+    };
+
+    g_assert(cpr_is_incoming());
+
+    if (ioctl(container->fd, VFIO_IOMMU_MAP_DMA, &map)) {
+        return -errno;
+    }
+
+    return 0;
+}
 
 static bool vfio_cpr_supported(VFIOContainer *container, Error **errp)
 {
@@ -58,11 +86,34 @@ static int vfio_container_pre_save(void *opaque)
     return 0;
 }
 
+static int vfio_container_post_load(void *opaque, int version_id)
+{
+    VFIOContainer *container = opaque;
+    VFIOContainerBase *bcontainer = &container->bcontainer;
+    VFIOGroup *group;
+    Error *local_err = NULL;
+
+    if (!vfio_listener_register(bcontainer, &local_err)) {
+        error_report_err(local_err);
+        return -1;
+    }
+
+    QLIST_FOREACH(group, &container->group_list, container_next) {
+        VFIOIOMMUClass *vioc = VFIO_IOMMU_GET_CLASS(bcontainer);
+
+        /* Restore original dma_map function */
+        vioc->dma_map = container->cpr.saved_dma_map;
+    }
+    return 0;
+}
+
 static const VMStateDescription vfio_container_vmstate = {
     .name = "vfio-container",
     .version_id = 0,
     .minimum_version_id = 0,
+    .priority = MIG_PRI_LOW,  /* Must happen after devices and groups */
     .pre_save = vfio_container_pre_save,
+    .post_load = vfio_container_post_load,
     .needed = cpr_incoming_needed,
     .fields = (VMStateField[]) {
         VMSTATE_END_OF_LIST()
@@ -85,6 +136,12 @@ bool vfio_legacy_cpr_register_container(VFIOContainer *container, Error **errp)
 
     vmstate_register(NULL, -1, &vfio_container_vmstate, container);
 
+    /* During incoming CPR, divert calls to dma_map. */
+    if (cpr_is_incoming()) {
+        VFIOIOMMUClass *vioc = VFIO_IOMMU_GET_CLASS(bcontainer);
+        container->cpr.saved_dma_map = vioc->dma_map;
+        vioc->dma_map = vfio_legacy_cpr_dma_map;
+    }
     return true;
 }
 
diff --git a/include/hw/vfio/vfio-cpr.h b/include/hw/vfio/vfio-cpr.h
index 5a2e5f6b21..04624475f8 100644
--- a/include/hw/vfio/vfio-cpr.h
+++ b/include/hw/vfio/vfio-cpr.h
@@ -17,6 +17,9 @@ struct VFIOGroup;
 
 typedef struct VFIOContainerCPR {
     Error *blocker;
+    int (*saved_dma_map)(const struct VFIOContainerBase *bcontainer,
+                         hwaddr iova, ram_addr_t size,
+                         void *vaddr, bool readonly, MemoryRegion *mr);
 } VFIOContainerCPR;
 
 

From dac0dd68d9b150a6aa334ab8ee9aeba011d54b32 Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Tue, 10 Jun 2025 08:39:20 -0700
Subject: [PATCH 1531/2760] vfio/container: mdev cpr blocker
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

During CPR, after VFIO_DMA_UNMAP_FLAG_VADDR, the vaddr is temporarily
invalid, so mediated devices cannot be supported.  Add a blocker for them.
This restriction will not apply to iommufd containers when CPR is added
for them in a future patch.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/1749569991-25171-8-git-send-email-steven.sistare@oracle.com
[ clg: Fixed context change in VFIODevice ]
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/container.c           | 8 ++++++++
 include/hw/vfio/vfio-cpr.h    | 3 +++
 include/hw/vfio/vfio-device.h | 2 ++
 3 files changed, 13 insertions(+)

diff --git a/hw/vfio/container.c b/hw/vfio/container.c
index 936ce37f19..3e8d645ebb 100644
--- a/hw/vfio/container.c
+++ b/hw/vfio/container.c
@@ -987,6 +987,13 @@ static bool vfio_legacy_attach_device(const char *name, VFIODevice *vbasedev,
         goto device_put_exit;
     }
 
+    if (vbasedev->mdev) {
+        error_setg(&vbasedev->cpr.mdev_blocker,
+                   "CPR does not support vfio mdev %s", vbasedev->name);
+        migrate_add_blocker_modes(&vbasedev->cpr.mdev_blocker, &error_fatal,
+                                  MIG_MODE_CPR_TRANSFER, -1);
+    }
+
     return true;
 
 device_put_exit:
@@ -1004,6 +1011,7 @@ static void vfio_legacy_detach_device(VFIODevice *vbasedev)
 
     vfio_device_unprepare(vbasedev);
 
+    migrate_del_blocker(&vbasedev->cpr.mdev_blocker);
     object_unref(vbasedev->hiod);
     vfio_device_put(vbasedev);
     vfio_group_put(group);
diff --git a/include/hw/vfio/vfio-cpr.h b/include/hw/vfio/vfio-cpr.h
index 04624475f8..b83dd42751 100644
--- a/include/hw/vfio/vfio-cpr.h
+++ b/include/hw/vfio/vfio-cpr.h
@@ -22,6 +22,9 @@ typedef struct VFIOContainerCPR {
                          void *vaddr, bool readonly, MemoryRegion *mr);
 } VFIOContainerCPR;
 
+typedef struct VFIODeviceCPR {
+    Error *mdev_blocker;
+} VFIODeviceCPR;
 
 bool vfio_legacy_cpr_register_container(struct VFIOContainer *container,
                                         Error **errp);
diff --git a/include/hw/vfio/vfio-device.h b/include/hw/vfio/vfio-device.h
index 9793b2dba0..f39259406b 100644
--- a/include/hw/vfio/vfio-device.h
+++ b/include/hw/vfio/vfio-device.h
@@ -28,6 +28,7 @@
 #endif
 #include "system/system.h"
 #include "hw/vfio/vfio-container-base.h"
+#include "hw/vfio/vfio-cpr.h"
 #include "system/host_iommu_device.h"
 #include "system/iommufd.h"
 
@@ -86,6 +87,7 @@ typedef struct VFIODevice {
     QLIST_ENTRY(VFIODevice) hwpt_next;
     struct vfio_region_info **reginfo;
     int *region_fds;
+    VFIODeviceCPR cpr;
 } VFIODevice;
 
 struct VFIODeviceOps {

From eba1f657cbb1b525e2b069626de655da21084e3e Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Tue, 10 Jun 2025 08:39:21 -0700
Subject: [PATCH 1532/2760] vfio/container: recover from unmap-all-vaddr
 failure
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

If there are multiple containers and unmap-all fails for some container, we
need to remap vaddr for the other containers for which unmap-all succeeded.
Recover by walking all address ranges of all containers to restore the vaddr
for each.  Do so by invoking the vfio listener callback, and passing a new
"remap" flag that tells it to restore a mapping without re-allocating new
userland data structures.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/1749569991-25171-9-git-send-email-steven.sistare@oracle.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/cpr-legacy.c                  | 91 +++++++++++++++++++++++++++
 hw/vfio/listener.c                    | 19 +++++-
 include/hw/vfio/vfio-container-base.h |  3 +
 include/hw/vfio/vfio-cpr.h            | 10 +++
 4 files changed, 122 insertions(+), 1 deletion(-)

diff --git a/hw/vfio/cpr-legacy.c b/hw/vfio/cpr-legacy.c
index 2fd8348c7c..a84c3247b7 100644
--- a/hw/vfio/cpr-legacy.c
+++ b/hw/vfio/cpr-legacy.c
@@ -29,6 +29,7 @@ static bool vfio_dma_unmap_vaddr_all(VFIOContainer *container, Error **errp)
         error_setg_errno(errp, errno, "vfio_dma_unmap_vaddr_all");
         return false;
     }
+    container->cpr.vaddr_unmapped = true;
     return true;
 }
 
@@ -59,6 +60,14 @@ static int vfio_legacy_cpr_dma_map(const VFIOContainerBase *bcontainer,
     return 0;
 }
 
+static void vfio_region_remap(MemoryListener *listener,
+                              MemoryRegionSection *section)
+{
+    VFIOContainer *container = container_of(listener, VFIOContainer,
+                                            cpr.remap_listener);
+    vfio_container_region_add(&container->bcontainer, section, true);
+}
+
 static bool vfio_cpr_supported(VFIOContainer *container, Error **errp)
 {
     if (!ioctl(container->fd, VFIO_CHECK_EXTENSION, VFIO_UPDATE_VADDR)) {
@@ -120,6 +129,40 @@ static const VMStateDescription vfio_container_vmstate = {
     }
 };
 
+static int vfio_cpr_fail_notifier(NotifierWithReturn *notifier,
+                                  MigrationEvent *e, Error **errp)
+{
+    VFIOContainer *container =
+        container_of(notifier, VFIOContainer, cpr.transfer_notifier);
+    VFIOContainerBase *bcontainer = &container->bcontainer;
+
+    if (e->type != MIG_EVENT_PRECOPY_FAILED) {
+        return 0;
+    }
+
+    if (container->cpr.vaddr_unmapped) {
+        /*
+         * Force a call to vfio_region_remap for each mapped section by
+         * temporarily registering a listener, and temporarily diverting
+         * dma_map to vfio_legacy_cpr_dma_map.  The latter restores vaddr.
+         */
+
+        VFIOIOMMUClass *vioc = VFIO_IOMMU_GET_CLASS(bcontainer);
+        vioc->dma_map = vfio_legacy_cpr_dma_map;
+
+        container->cpr.remap_listener = (MemoryListener) {
+            .name = "vfio cpr recover",
+            .region_add = vfio_region_remap
+        };
+        memory_listener_register(&container->cpr.remap_listener,
+                                 bcontainer->space->as);
+        memory_listener_unregister(&container->cpr.remap_listener);
+        container->cpr.vaddr_unmapped = false;
+        vioc->dma_map = container->cpr.saved_dma_map;
+    }
+    return 0;
+}
+
 bool vfio_legacy_cpr_register_container(VFIOContainer *container, Error **errp)
 {
     VFIOContainerBase *bcontainer = &container->bcontainer;
@@ -142,6 +185,10 @@ bool vfio_legacy_cpr_register_container(VFIOContainer *container, Error **errp)
         container->cpr.saved_dma_map = vioc->dma_map;
         vioc->dma_map = vfio_legacy_cpr_dma_map;
     }
+
+    migration_add_notifier_mode(&container->cpr.transfer_notifier,
+                                vfio_cpr_fail_notifier,
+                                MIG_MODE_CPR_TRANSFER);
     return true;
 }
 
@@ -152,6 +199,50 @@ void vfio_legacy_cpr_unregister_container(VFIOContainer *container)
     migration_remove_notifier(&bcontainer->cpr_reboot_notifier);
     migrate_del_blocker(&container->cpr.blocker);
     vmstate_unregister(NULL, &vfio_container_vmstate, container);
+    migration_remove_notifier(&container->cpr.transfer_notifier);
+}
+
+/*
+ * In old QEMU, VFIO_DMA_UNMAP_FLAG_VADDR may fail on some mapping after
+ * succeeding for others, so the latter have lost their vaddr.  Call this
+ * to restore vaddr for a section with a giommu.
+ *
+ * The giommu already exists.  Find it and replay it, which calls
+ * vfio_legacy_cpr_dma_map further down the stack.
+ */
+void vfio_cpr_giommu_remap(VFIOContainerBase *bcontainer,
+                           MemoryRegionSection *section)
+{
+    VFIOGuestIOMMU *giommu = NULL;
+    hwaddr as_offset = section->offset_within_address_space;
+    hwaddr iommu_offset = as_offset - section->offset_within_region;
+
+    QLIST_FOREACH(giommu, &bcontainer->giommu_list, giommu_next) {
+        if (giommu->iommu_mr == IOMMU_MEMORY_REGION(section->mr) &&
+            giommu->iommu_offset == iommu_offset) {
+            break;
+        }
+    }
+    g_assert(giommu);
+    memory_region_iommu_replay(giommu->iommu_mr, &giommu->n);
+}
+
+/*
+ * In old QEMU, VFIO_DMA_UNMAP_FLAG_VADDR may fail on some mapping after
+ * succeeding for others, so the latter have lost their vaddr.  Call this
+ * to restore vaddr for a section with a RamDiscardManager.
+ *
+ * The ram discard listener already exists.  Call its populate function
+ * directly, which calls vfio_legacy_cpr_dma_map.
+ */
+bool vfio_cpr_ram_discard_register_listener(VFIOContainerBase *bcontainer,
+                                            MemoryRegionSection *section)
+{
+    VFIORamDiscardListener *vrdl =
+        vfio_find_ram_discard_listener(bcontainer, section);
+
+    g_assert(vrdl);
+    return vrdl->listener.notify_populate(&vrdl->listener, section) == 0;
 }
 
 int vfio_cpr_group_get_device_fd(int d, const char *name)
diff --git a/hw/vfio/listener.c b/hw/vfio/listener.c
index 735b5f21b7..f498e23a93 100644
--- a/hw/vfio/listener.c
+++ b/hw/vfio/listener.c
@@ -481,6 +481,13 @@ static void vfio_listener_region_add(MemoryListener *listener,
 {
     VFIOContainerBase *bcontainer = container_of(listener, VFIOContainerBase,
                                                  listener);
+    vfio_container_region_add(bcontainer, section, false);
+}
+
+void vfio_container_region_add(VFIOContainerBase *bcontainer,
+                               MemoryRegionSection *section,
+                               bool cpr_remap)
+{
     hwaddr iova, end;
     Int128 llend, llsize;
     void *vaddr;
@@ -516,6 +523,11 @@ static void vfio_listener_region_add(MemoryListener *listener,
         int iommu_idx;
 
         trace_vfio_listener_region_add_iommu(section->mr->name, iova, end);
+
+        if (cpr_remap) {
+            vfio_cpr_giommu_remap(bcontainer, section);
+        }
+
         /*
          * FIXME: For VFIO iommu types which have KVM acceleration to
          * avoid bouncing all map/unmaps through qemu this way, this
@@ -558,7 +570,12 @@ static void vfio_listener_region_add(MemoryListener *listener,
      * about changes.
      */
     if (memory_region_has_ram_discard_manager(section->mr)) {
-        vfio_ram_discard_register_listener(bcontainer, section);
+        if (!cpr_remap) {
+            vfio_ram_discard_register_listener(bcontainer, section);
+        } else if (!vfio_cpr_ram_discard_register_listener(bcontainer,
+                                                           section)) {
+            goto fail;
+        }
         return;
     }
 
diff --git a/include/hw/vfio/vfio-container-base.h b/include/hw/vfio/vfio-container-base.h
index 9d37f86115..f0232654ee 100644
--- a/include/hw/vfio/vfio-container-base.h
+++ b/include/hw/vfio/vfio-container-base.h
@@ -256,4 +256,7 @@ struct VFIOIOMMUClass {
 VFIORamDiscardListener *vfio_find_ram_discard_listener(
     VFIOContainerBase *bcontainer, MemoryRegionSection *section);
 
+void vfio_container_region_add(VFIOContainerBase *bcontainer,
+                               MemoryRegionSection *section, bool cpr_remap);
+
 #endif /* HW_VFIO_VFIO_CONTAINER_BASE_H */
diff --git a/include/hw/vfio/vfio-cpr.h b/include/hw/vfio/vfio-cpr.h
index b83dd42751..56ede049ad 100644
--- a/include/hw/vfio/vfio-cpr.h
+++ b/include/hw/vfio/vfio-cpr.h
@@ -10,6 +10,7 @@
 #define HW_VFIO_VFIO_CPR_H
 
 #include "migration/misc.h"
+#include "system/memory.h"
 
 struct VFIOContainer;
 struct VFIOContainerBase;
@@ -17,6 +18,9 @@ struct VFIOGroup;
 
 typedef struct VFIOContainerCPR {
     Error *blocker;
+    bool vaddr_unmapped;
+    NotifierWithReturn transfer_notifier;
+    MemoryListener remap_listener;
     int (*saved_dma_map)(const struct VFIOContainerBase *bcontainer,
                          hwaddr iova, ram_addr_t size,
                          void *vaddr, bool readonly, MemoryRegion *mr);
@@ -42,4 +46,10 @@ int vfio_cpr_group_get_device_fd(int d, const char *name);
 bool vfio_cpr_container_match(struct VFIOContainer *container,
                               struct VFIOGroup *group, int fd);
 
+void vfio_cpr_giommu_remap(struct VFIOContainerBase *bcontainer,
+                           MemoryRegionSection *section);
+
+bool vfio_cpr_ram_discard_register_listener(
+    struct VFIOContainerBase *bcontainer, MemoryRegionSection *section);
+
 #endif /* HW_VFIO_VFIO_CPR_H */

From 8df3fa3d6753332a64eca53780517972075966e1 Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Tue, 10 Jun 2025 08:39:22 -0700
Subject: [PATCH 1533/2760] pci: export msix_is_pending
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Export msix_is_pending for use by cpr.  No functional change.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Link: https://lore.kernel.org/qemu-devel/1749569991-25171-10-git-send-email-steven.sistare@oracle.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/pci/msix.c         | 2 +-
 include/hw/pci/msix.h | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/pci/msix.c b/hw/pci/msix.c
index 66f27b9d71..8c7f6709e2 100644
--- a/hw/pci/msix.c
+++ b/hw/pci/msix.c
@@ -72,7 +72,7 @@ static uint8_t *msix_pending_byte(PCIDevice *dev, int vector)
     return dev->msix_pba + vector / 8;
 }
 
-static int msix_is_pending(PCIDevice *dev, int vector)
+int msix_is_pending(PCIDevice *dev, unsigned int vector)
 {
     return *msix_pending_byte(dev, vector) & msix_pending_mask(vector);
 }
diff --git a/include/hw/pci/msix.h b/include/hw/pci/msix.h
index 0e6f257e45..11ef9454c1 100644
--- a/include/hw/pci/msix.h
+++ b/include/hw/pci/msix.h
@@ -32,6 +32,7 @@ int msix_present(PCIDevice *dev);
 bool msix_is_masked(PCIDevice *dev, unsigned vector);
 void msix_set_pending(PCIDevice *dev, unsigned vector);
 void msix_clr_pending(PCIDevice *dev, int vector);
+int msix_is_pending(PCIDevice *dev, unsigned vector);
 
 void msix_vector_use(PCIDevice *dev, unsigned vector);
 void msix_vector_unuse(PCIDevice *dev, unsigned vector);

From 24c156dcd94299f64994170ce84efac9ae001f41 Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Tue, 10 Jun 2025 10:26:43 -0700
Subject: [PATCH 1534/2760] pci: skip reset during cpr
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Do not reset a vfio-pci device during CPR.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Link: https://lore.kernel.org/qemu-devel/1749576403-25355-1-git-send-email-steven.sistare@oracle.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/pci/pci.c         | 5 +++++
 hw/vfio/pci.c        | 7 +++++++
 include/hw/pci/pci.h | 2 ++
 3 files changed, 14 insertions(+)

diff --git a/hw/pci/pci.c b/hw/pci/pci.c
index 9b4bf48439..c70b5ceeba 100644
--- a/hw/pci/pci.c
+++ b/hw/pci/pci.c
@@ -32,6 +32,7 @@
 #include "hw/pci/pci_host.h"
 #include "hw/qdev-properties.h"
 #include "hw/qdev-properties-system.h"
+#include "migration/cpr.h"
 #include "migration/qemu-file-types.h"
 #include "migration/vmstate.h"
 #include "net/net.h"
@@ -537,6 +538,10 @@ static void pci_reset_regions(PCIDevice *dev)
 
 static void pci_do_device_reset(PCIDevice *dev)
 {
+    if ((dev->cap_present & QEMU_PCI_SKIP_RESET_ON_CPR) && cpr_is_incoming()) {
+        return;
+    }
+
     pci_device_deassert_intx(dev);
     assert(dev->irq_state == 0);
 
diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index 89f9246416..b97261c61b 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -3411,6 +3411,13 @@ static void vfio_instance_init(Object *obj)
     /* QEMU_PCI_CAP_EXPRESS initialization does not depend on QEMU command
      * line, therefore, no need to wait to realize like other devices */
     pci_dev->cap_present |= QEMU_PCI_CAP_EXPRESS;
+
+    /*
+     * A device that is resuming for cpr is already configured, so do not
+     * reset it during qemu_system_reset prior to cpr load, else interrupts
+     * may be lost.
+     */
+    pci_dev->cap_present |= QEMU_PCI_SKIP_RESET_ON_CPR;
 }
 
 static void vfio_pci_base_dev_class_init(ObjectClass *klass, const void *data)
diff --git a/include/hw/pci/pci.h b/include/hw/pci/pci.h
index 35d59d7672..df3cc7b875 100644
--- a/include/hw/pci/pci.h
+++ b/include/hw/pci/pci.h
@@ -222,6 +222,8 @@ enum {
     QEMU_PCIE_EXT_TAG = (1 << QEMU_PCIE_EXT_TAG_BITNR),
 #define QEMU_PCI_CAP_PM_BITNR 14
     QEMU_PCI_CAP_PM = (1 << QEMU_PCI_CAP_PM_BITNR),
+#define QEMU_PCI_SKIP_RESET_ON_CPR_BITNR 15
+    QEMU_PCI_SKIP_RESET_ON_CPR = (1 << QEMU_PCI_SKIP_RESET_ON_CPR_BITNR),
 };
 
 typedef struct PCIINTxRoute {

From 031fbb7110a183053b431fb667867a5244910e75 Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Tue, 10 Jun 2025 08:39:24 -0700
Subject: [PATCH 1535/2760] vfio-pci: skip reset during cpr
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Do not reset a vfio-pci device during CPR, and do not complain if the
kernel's PCI config space changes for non-emulated bits between the
vmstate save and load, which can happen due to ongoing interrupt activity.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/1749569991-25171-12-git-send-email-steven.sistare@oracle.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/cpr.c              | 31 +++++++++++++++++++++++++++++++
 hw/vfio/pci.c              |  7 +++++++
 include/hw/vfio/vfio-cpr.h |  2 ++
 3 files changed, 40 insertions(+)

diff --git a/hw/vfio/cpr.c b/hw/vfio/cpr.c
index 0e59612228..fdbb58e203 100644
--- a/hw/vfio/cpr.c
+++ b/hw/vfio/cpr.c
@@ -8,6 +8,8 @@
 #include "qemu/osdep.h"
 #include "hw/vfio/vfio-device.h"
 #include "hw/vfio/vfio-cpr.h"
+#include "hw/vfio/pci.h"
+#include "migration/cpr.h"
 #include "qapi/error.h"
 #include "system/runstate.h"
 
@@ -37,3 +39,32 @@ void vfio_cpr_unregister_container(VFIOContainerBase *bcontainer)
 {
     migration_remove_notifier(&bcontainer->cpr_reboot_notifier);
 }
+
+/*
+ * The kernel may change non-emulated config bits.  Exclude them from the
+ * changed-bits check in get_pci_config_device.
+ */
+static int vfio_cpr_pci_pre_load(void *opaque)
+{
+    VFIOPCIDevice *vdev = opaque;
+    PCIDevice *pdev = &vdev->pdev;
+    int size = MIN(pci_config_size(pdev), vdev->config_size);
+    int i;
+
+    for (i = 0; i < size; i++) {
+        pdev->cmask[i] &= vdev->emulated_config_bits[i];
+    }
+
+    return 0;
+}
+
+const VMStateDescription vfio_cpr_pci_vmstate = {
+    .name = "vfio-cpr-pci",
+    .version_id = 0,
+    .minimum_version_id = 0,
+    .pre_load = vfio_cpr_pci_pre_load,
+    .needed = cpr_incoming_needed,
+    .fields = (VMStateField[]) {
+        VMSTATE_END_OF_LIST()
+    }
+};
diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index b97261c61b..2da5989581 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -30,6 +30,7 @@
 #include "hw/qdev-properties.h"
 #include "hw/qdev-properties-system.h"
 #include "migration/vmstate.h"
+#include "migration/cpr.h"
 #include "qobject/qdict.h"
 #include "qemu/error-report.h"
 #include "qemu/main-loop.h"
@@ -3354,6 +3355,11 @@ static void vfio_pci_reset(DeviceState *dev)
 {
     VFIOPCIDevice *vdev = VFIO_PCI_BASE(dev);
 
+    /* Do not reset the device during qemu_system_reset prior to cpr load */
+    if (cpr_is_incoming()) {
+        return;
+    }
+
     trace_vfio_pci_reset(vdev->vbasedev.name);
 
     vfio_pci_pre_reset(vdev);
@@ -3530,6 +3536,7 @@ static void vfio_pci_dev_class_init(ObjectClass *klass, const void *data)
 #ifdef CONFIG_IOMMUFD
     object_class_property_add_str(klass, "fd", NULL, vfio_pci_set_fd);
 #endif
+    dc->vmsd = &vfio_cpr_pci_vmstate;
     dc->desc = "VFIO-based PCI device assignment";
     pdc->realize = vfio_pci_realize;
 
diff --git a/include/hw/vfio/vfio-cpr.h b/include/hw/vfio/vfio-cpr.h
index 56ede049ad..8bf85b9f4e 100644
--- a/include/hw/vfio/vfio-cpr.h
+++ b/include/hw/vfio/vfio-cpr.h
@@ -52,4 +52,6 @@ void vfio_cpr_giommu_remap(struct VFIOContainerBase *bcontainer,
 bool vfio_cpr_ram_discard_register_listener(
     struct VFIOContainerBase *bcontainer, MemoryRegionSection *section);
 
+extern const VMStateDescription vfio_cpr_pci_vmstate;
+
 #endif /* HW_VFIO_VFIO_CPR_H */

From 906f524ef19fa46140c3a5ae74d5e2e7d7b37ab2 Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Tue, 10 Jun 2025 08:39:25 -0700
Subject: [PATCH 1536/2760] vfio/pci: vfio_pci_vector_init
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Extract a subroutine vfio_pci_vector_init.  No functional change.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/1749569991-25171-13-git-send-email-steven.sistare@oracle.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/pci.c | 24 +++++++++++++++++-------
 1 file changed, 17 insertions(+), 7 deletions(-)

diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index 2da5989581..7a33c19ea2 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -531,6 +531,22 @@ static void set_irq_signalling(VFIODevice *vbasedev, VFIOMSIVector *vector,
     }
 }
 
+static void vfio_pci_vector_init(VFIOPCIDevice *vdev, int nr)
+{
+    VFIOMSIVector *vector = &vdev->msi_vectors[nr];
+    PCIDevice *pdev = &vdev->pdev;
+
+    vector->vdev = vdev;
+    vector->virq = -1;
+    if (event_notifier_init(&vector->interrupt, 0)) {
+        error_report("vfio: Error: event_notifier_init failed");
+    }
+    vector->use = true;
+    if (vdev->interrupt == VFIO_INT_MSIX) {
+        msix_vector_use(pdev, nr);
+    }
+}
+
 static int vfio_msix_vector_do_use(PCIDevice *pdev, unsigned int nr,
                                    MSIMessage *msg, IOHandler *handler)
 {
@@ -544,13 +560,7 @@ static int vfio_msix_vector_do_use(PCIDevice *pdev, unsigned int nr,
     vector = &vdev->msi_vectors[nr];
 
     if (!vector->use) {
-        vector->vdev = vdev;
-        vector->virq = -1;
-        if (event_notifier_init(&vector->interrupt, 0)) {
-            error_report("vfio: Error: event_notifier_init failed");
-        }
-        vector->use = true;
-        msix_vector_use(pdev, nr);
+        vfio_pci_vector_init(vdev, nr);
     }
 
     qemu_set_fd_handler(event_notifier_get_fd(&vector->interrupt),

From 8f5c6960269124674895032f344fa71f8be5d49c Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Tue, 10 Jun 2025 08:39:26 -0700
Subject: [PATCH 1537/2760] vfio/pci: vfio_notifier_init
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Move event_notifier_init calls to a helper vfio_notifier_init.
This version is trivial, but it will be expanded to support CPR
in subsequent patches.  No functional change.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/1749569991-25171-14-git-send-email-steven.sistare@oracle.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/pci.c | 40 +++++++++++++++++++++++++---------------
 1 file changed, 25 insertions(+), 15 deletions(-)

diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index 7a33c19ea2..dc0d9a7fbb 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -57,6 +57,16 @@ static void vfio_disable_interrupts(VFIOPCIDevice *vdev);
 static void vfio_mmap_set_enabled(VFIOPCIDevice *vdev, bool enabled);
 static void vfio_msi_disable_common(VFIOPCIDevice *vdev);
 
+static bool vfio_notifier_init(EventNotifier *e, const char *name, Error **errp)
+{
+    int ret = event_notifier_init(e, 0);
+
+    if (ret) {
+        error_setg_errno(errp, -ret, "vfio_notifier_init %s failed", name);
+    }
+    return !ret;
+}
+
 /*
  * Disabling BAR mmaping can be slow, but toggling it around INTx can
  * also be a huge overhead.  We try to get the best of both worlds by
@@ -137,8 +147,7 @@ static bool vfio_intx_enable_kvm(VFIOPCIDevice *vdev, Error **errp)
     pci_irq_deassert(&vdev->pdev);
 
     /* Get an eventfd for resample/unmask */
-    if (event_notifier_init(&vdev->intx.unmask, 0)) {
-        error_setg(errp, "event_notifier_init failed eoi");
+    if (!vfio_notifier_init(&vdev->intx.unmask, "intx-unmask", errp)) {
         goto fail;
     }
 
@@ -269,7 +278,6 @@ static bool vfio_intx_enable(VFIOPCIDevice *vdev, Error **errp)
     uint8_t pin = vfio_pci_read_config(&vdev->pdev, PCI_INTERRUPT_PIN, 1);
     Error *err = NULL;
     int32_t fd;
-    int ret;
 
 
     if (!pin) {
@@ -292,9 +300,7 @@ static bool vfio_intx_enable(VFIOPCIDevice *vdev, Error **errp)
     }
 #endif
 
-    ret = event_notifier_init(&vdev->intx.interrupt, 0);
-    if (ret) {
-        error_setg_errno(errp, -ret, "event_notifier_init failed");
+    if (!vfio_notifier_init(&vdev->intx.interrupt, "intx-interrupt", errp)) {
         return false;
     }
     fd = event_notifier_get_fd(&vdev->intx.interrupt);
@@ -474,11 +480,13 @@ static void vfio_add_kvm_msi_virq(VFIOPCIDevice *vdev, VFIOMSIVector *vector,
 
 static void vfio_connect_kvm_msi_virq(VFIOMSIVector *vector)
 {
+    const char *name = "kvm_interrupt";
+
     if (vector->virq < 0) {
         return;
     }
 
-    if (event_notifier_init(&vector->kvm_interrupt, 0)) {
+    if (!vfio_notifier_init(&vector->kvm_interrupt, name, NULL)) {
         goto fail_notifier;
     }
 
@@ -535,11 +543,12 @@ static void vfio_pci_vector_init(VFIOPCIDevice *vdev, int nr)
 {
     VFIOMSIVector *vector = &vdev->msi_vectors[nr];
     PCIDevice *pdev = &vdev->pdev;
+    Error *err = NULL;
 
     vector->vdev = vdev;
     vector->virq = -1;
-    if (event_notifier_init(&vector->interrupt, 0)) {
-        error_report("vfio: Error: event_notifier_init failed");
+    if (!vfio_notifier_init(&vector->interrupt, "interrupt", &err)) {
+        error_report_err(err);
     }
     vector->use = true;
     if (vdev->interrupt == VFIO_INT_MSIX) {
@@ -755,13 +764,14 @@ retry:
 
     for (i = 0; i < vdev->nr_vectors; i++) {
         VFIOMSIVector *vector = &vdev->msi_vectors[i];
+        Error *err = NULL;
 
         vector->vdev = vdev;
         vector->virq = -1;
         vector->use = true;
 
-        if (event_notifier_init(&vector->interrupt, 0)) {
-            error_report("vfio: Error: event_notifier_init failed");
+        if (!vfio_notifier_init(&vector->interrupt, "interrupt", &err)) {
+            error_report_err(err);
         }
 
         qemu_set_fd_handler(event_notifier_get_fd(&vector->interrupt),
@@ -2928,8 +2938,8 @@ void vfio_pci_register_err_notifier(VFIOPCIDevice *vdev)
         return;
     }
 
-    if (event_notifier_init(&vdev->err_notifier, 0)) {
-        error_report("vfio: Unable to init event notifier for error detection");
+    if (!vfio_notifier_init(&vdev->err_notifier, "err_notifier", &err)) {
+        error_report_err(err);
         vdev->pci_aer = false;
         return;
     }
@@ -2995,8 +3005,8 @@ void vfio_pci_register_req_notifier(VFIOPCIDevice *vdev)
         return;
     }
 
-    if (event_notifier_init(&vdev->req_notifier, 0)) {
-        error_report("vfio: Unable to init event notifier for device request");
+    if (!vfio_notifier_init(&vdev->req_notifier, "req_notifier", &err)) {
+        error_report_err(err);
         return;
     }
 

From d364d802fe4a5d73b2e88cb9b80799692f1ee8a5 Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Tue, 10 Jun 2025 08:39:27 -0700
Subject: [PATCH 1538/2760] vfio/pci: pass vector to virq functions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Pass the vector number to vfio_connect_kvm_msi_virq and
vfio_remove_kvm_msi_virq, so it can be passed to their subroutines in
a subsequent patch.  No functional change.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/1749569991-25171-15-git-send-email-steven.sistare@oracle.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/pci.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index dc0d9a7fbb..1d22c41efb 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -478,7 +478,7 @@ static void vfio_add_kvm_msi_virq(VFIOPCIDevice *vdev, VFIOMSIVector *vector,
                                              vector_n, &vdev->pdev);
 }
 
-static void vfio_connect_kvm_msi_virq(VFIOMSIVector *vector)
+static void vfio_connect_kvm_msi_virq(VFIOMSIVector *vector, int nr)
 {
     const char *name = "kvm_interrupt";
 
@@ -504,7 +504,8 @@ fail_notifier:
     vector->virq = -1;
 }
 
-static void vfio_remove_kvm_msi_virq(VFIOMSIVector *vector)
+static void vfio_remove_kvm_msi_virq(VFIOPCIDevice *vdev, VFIOMSIVector *vector,
+                                     int nr)
 {
     kvm_irqchip_remove_irqfd_notifier_gsi(kvm_state, &vector->kvm_interrupt,
                                           vector->virq);
@@ -581,7 +582,7 @@ static int vfio_msix_vector_do_use(PCIDevice *pdev, unsigned int nr,
      */
     if (vector->virq >= 0) {
         if (!msg) {
-            vfio_remove_kvm_msi_virq(vector);
+            vfio_remove_kvm_msi_virq(vdev, vector, nr);
         } else {
             vfio_update_kvm_msi_virq(vector, *msg, pdev);
         }
@@ -593,7 +594,7 @@ static int vfio_msix_vector_do_use(PCIDevice *pdev, unsigned int nr,
                 vfio_route_change = kvm_irqchip_begin_route_changes(kvm_state);
                 vfio_add_kvm_msi_virq(vdev, vector, nr, true);
                 kvm_irqchip_commit_route_changes(&vfio_route_change);
-                vfio_connect_kvm_msi_virq(vector);
+                vfio_connect_kvm_msi_virq(vector, nr);
             }
         }
     }
@@ -687,7 +688,7 @@ static void vfio_commit_kvm_msi_virq_batch(VFIOPCIDevice *vdev)
     kvm_irqchip_commit_route_changes(&vfio_route_change);
 
     for (i = 0; i < vdev->nr_vectors; i++) {
-        vfio_connect_kvm_msi_virq(&vdev->msi_vectors[i]);
+        vfio_connect_kvm_msi_virq(&vdev->msi_vectors[i], i);
     }
 }
 
@@ -827,7 +828,7 @@ static void vfio_msi_disable_common(VFIOPCIDevice *vdev)
         VFIOMSIVector *vector = &vdev->msi_vectors[i];
         if (vdev->msi_vectors[i].use) {
             if (vector->virq >= 0) {
-                vfio_remove_kvm_msi_virq(vector);
+                vfio_remove_kvm_msi_virq(vdev, vector, i);
             }
             qemu_set_fd_handler(event_notifier_get_fd(&vector->interrupt),
                                 NULL, NULL, NULL);

From c2559182c88ab997727e0f4ef2c0f7faeb24d5a9 Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Tue, 10 Jun 2025 08:39:28 -0700
Subject: [PATCH 1539/2760] vfio/pci: vfio_notifier_init cpr parameters
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Pass vdev and nr to vfio_notifier_init, for use by CPR in a subsequent
patch.  No functional change.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/1749569991-25171-16-git-send-email-steven.sistare@oracle.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/pci.c | 31 +++++++++++++++++++------------
 1 file changed, 19 insertions(+), 12 deletions(-)

diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index 1d22c41efb..9ee36da626 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -57,7 +57,8 @@ static void vfio_disable_interrupts(VFIOPCIDevice *vdev);
 static void vfio_mmap_set_enabled(VFIOPCIDevice *vdev, bool enabled);
 static void vfio_msi_disable_common(VFIOPCIDevice *vdev);
 
-static bool vfio_notifier_init(EventNotifier *e, const char *name, Error **errp)
+static bool vfio_notifier_init(VFIOPCIDevice *vdev, EventNotifier *e,
+                               const char *name, int nr, Error **errp)
 {
     int ret = event_notifier_init(e, 0);
 
@@ -147,7 +148,7 @@ static bool vfio_intx_enable_kvm(VFIOPCIDevice *vdev, Error **errp)
     pci_irq_deassert(&vdev->pdev);
 
     /* Get an eventfd for resample/unmask */
-    if (!vfio_notifier_init(&vdev->intx.unmask, "intx-unmask", errp)) {
+    if (!vfio_notifier_init(vdev, &vdev->intx.unmask, "intx-unmask", 0, errp)) {
         goto fail;
     }
 
@@ -300,7 +301,8 @@ static bool vfio_intx_enable(VFIOPCIDevice *vdev, Error **errp)
     }
 #endif
 
-    if (!vfio_notifier_init(&vdev->intx.interrupt, "intx-interrupt", errp)) {
+    if (!vfio_notifier_init(vdev, &vdev->intx.interrupt, "intx-interrupt", 0,
+                            errp)) {
         return false;
     }
     fd = event_notifier_get_fd(&vdev->intx.interrupt);
@@ -486,7 +488,8 @@ static void vfio_connect_kvm_msi_virq(VFIOMSIVector *vector, int nr)
         return;
     }
 
-    if (!vfio_notifier_init(&vector->kvm_interrupt, name, NULL)) {
+    if (!vfio_notifier_init(vector->vdev, &vector->kvm_interrupt, name, nr,
+                            NULL)) {
         goto fail_notifier;
     }
 
@@ -544,12 +547,13 @@ static void vfio_pci_vector_init(VFIOPCIDevice *vdev, int nr)
 {
     VFIOMSIVector *vector = &vdev->msi_vectors[nr];
     PCIDevice *pdev = &vdev->pdev;
-    Error *err = NULL;
+    Error *local_err = NULL;
 
     vector->vdev = vdev;
     vector->virq = -1;
-    if (!vfio_notifier_init(&vector->interrupt, "interrupt", &err)) {
-        error_report_err(err);
+    if (!vfio_notifier_init(vdev, &vector->interrupt, "interrupt", nr,
+                            &local_err)) {
+        error_report_err(local_err);
     }
     vector->use = true;
     if (vdev->interrupt == VFIO_INT_MSIX) {
@@ -765,14 +769,15 @@ retry:
 
     for (i = 0; i < vdev->nr_vectors; i++) {
         VFIOMSIVector *vector = &vdev->msi_vectors[i];
-        Error *err = NULL;
+        Error *local_err = NULL;
 
         vector->vdev = vdev;
         vector->virq = -1;
         vector->use = true;
 
-        if (!vfio_notifier_init(&vector->interrupt, "interrupt", &err)) {
-            error_report_err(err);
+        if (!vfio_notifier_init(vdev, &vector->interrupt, "interrupt", i,
+                                &local_err)) {
+            error_report_err(local_err);
         }
 
         qemu_set_fd_handler(event_notifier_get_fd(&vector->interrupt),
@@ -2939,7 +2944,8 @@ void vfio_pci_register_err_notifier(VFIOPCIDevice *vdev)
         return;
     }
 
-    if (!vfio_notifier_init(&vdev->err_notifier, "err_notifier", &err)) {
+    if (!vfio_notifier_init(vdev, &vdev->err_notifier, "err_notifier", 0,
+                            &err)) {
         error_report_err(err);
         vdev->pci_aer = false;
         return;
@@ -3006,7 +3012,8 @@ void vfio_pci_register_req_notifier(VFIOPCIDevice *vdev)
         return;
     }
 
-    if (!vfio_notifier_init(&vdev->req_notifier, "req_notifier", &err)) {
+    if (!vfio_notifier_init(vdev, &vdev->req_notifier, "req_notifier", 0,
+                            &err)) {
         error_report_err(err);
         return;
     }

From 6d7696f329c77332e4db1d18fc5ab5df23363e01 Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Tue, 10 Jun 2025 08:39:29 -0700
Subject: [PATCH 1540/2760] vfio/pci: vfio_notifier_cleanup
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Move event_notifier_cleanup calls to a helper vfio_notifier_cleanup.
This version is trivial, and does not yet use the vdev and nr parameters.
No functional change.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/1749569991-25171-17-git-send-email-steven.sistare@oracle.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/pci.c | 28 +++++++++++++++++-----------
 1 file changed, 17 insertions(+), 11 deletions(-)

diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index 9ee36da626..06a7a63cf5 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -68,6 +68,12 @@ static bool vfio_notifier_init(VFIOPCIDevice *vdev, EventNotifier *e,
     return !ret;
 }
 
+static void vfio_notifier_cleanup(VFIOPCIDevice *vdev, EventNotifier *e,
+                                  const char *name, int nr)
+{
+    event_notifier_cleanup(e);
+}
+
 /*
  * Disabling BAR mmaping can be slow, but toggling it around INTx can
  * also be a huge overhead.  We try to get the best of both worlds by
@@ -180,7 +186,7 @@ fail_vfio:
     kvm_irqchip_remove_irqfd_notifier_gsi(kvm_state, &vdev->intx.interrupt,
                                           vdev->intx.route.irq);
 fail_irqfd:
-    event_notifier_cleanup(&vdev->intx.unmask);
+    vfio_notifier_cleanup(vdev, &vdev->intx.unmask, "intx-unmask", 0);
 fail:
     qemu_set_fd_handler(irq_fd, vfio_intx_interrupt, NULL, vdev);
     vfio_device_irq_unmask(&vdev->vbasedev, VFIO_PCI_INTX_IRQ_INDEX);
@@ -212,7 +218,7 @@ static void vfio_intx_disable_kvm(VFIOPCIDevice *vdev)
     }
 
     /* We only need to close the eventfd for VFIO to cleanup the kernel side */
-    event_notifier_cleanup(&vdev->intx.unmask);
+    vfio_notifier_cleanup(vdev, &vdev->intx.unmask, "intx-unmask", 0);
 
     /* QEMU starts listening for interrupt events. */
     qemu_set_fd_handler(event_notifier_get_fd(&vdev->intx.interrupt),
@@ -311,7 +317,7 @@ static bool vfio_intx_enable(VFIOPCIDevice *vdev, Error **errp)
     if (!vfio_device_irq_set_signaling(&vdev->vbasedev, VFIO_PCI_INTX_IRQ_INDEX, 0,
                                 VFIO_IRQ_SET_ACTION_TRIGGER, fd, errp)) {
         qemu_set_fd_handler(fd, NULL, NULL, vdev);
-        event_notifier_cleanup(&vdev->intx.interrupt);
+        vfio_notifier_cleanup(vdev, &vdev->intx.interrupt, "intx-interrupt", 0);
         return false;
     }
 
@@ -338,7 +344,7 @@ static void vfio_intx_disable(VFIOPCIDevice *vdev)
 
     fd = event_notifier_get_fd(&vdev->intx.interrupt);
     qemu_set_fd_handler(fd, NULL, NULL, vdev);
-    event_notifier_cleanup(&vdev->intx.interrupt);
+    vfio_notifier_cleanup(vdev, &vdev->intx.interrupt, "intx-interrupt", 0);
 
     vdev->interrupt = VFIO_INT_NONE;
 
@@ -501,7 +507,7 @@ static void vfio_connect_kvm_msi_virq(VFIOMSIVector *vector, int nr)
     return;
 
 fail_kvm:
-    event_notifier_cleanup(&vector->kvm_interrupt);
+    vfio_notifier_cleanup(vector->vdev, &vector->kvm_interrupt, name, nr);
 fail_notifier:
     kvm_irqchip_release_virq(kvm_state, vector->virq);
     vector->virq = -1;
@@ -514,7 +520,7 @@ static void vfio_remove_kvm_msi_virq(VFIOPCIDevice *vdev, VFIOMSIVector *vector,
                                           vector->virq);
     kvm_irqchip_release_virq(kvm_state, vector->virq);
     vector->virq = -1;
-    event_notifier_cleanup(&vector->kvm_interrupt);
+    vfio_notifier_cleanup(vdev, &vector->kvm_interrupt, "kvm_interrupt", nr);
 }
 
 static void vfio_update_kvm_msi_virq(VFIOMSIVector *vector, MSIMessage msg,
@@ -837,7 +843,7 @@ static void vfio_msi_disable_common(VFIOPCIDevice *vdev)
             }
             qemu_set_fd_handler(event_notifier_get_fd(&vector->interrupt),
                                 NULL, NULL, NULL);
-            event_notifier_cleanup(&vector->interrupt);
+            vfio_notifier_cleanup(vdev, &vector->interrupt, "interrupt", i);
         }
     }
 
@@ -2958,7 +2964,7 @@ void vfio_pci_register_err_notifier(VFIOPCIDevice *vdev)
                                        VFIO_IRQ_SET_ACTION_TRIGGER, fd, &err)) {
         error_reportf_err(err, VFIO_MSG_PREFIX, vdev->vbasedev.name);
         qemu_set_fd_handler(fd, NULL, NULL, vdev);
-        event_notifier_cleanup(&vdev->err_notifier);
+        vfio_notifier_cleanup(vdev, &vdev->err_notifier, "err_notifier", 0);
         vdev->pci_aer = false;
     }
 }
@@ -2977,7 +2983,7 @@ static void vfio_unregister_err_notifier(VFIOPCIDevice *vdev)
     }
     qemu_set_fd_handler(event_notifier_get_fd(&vdev->err_notifier),
                         NULL, NULL, vdev);
-    event_notifier_cleanup(&vdev->err_notifier);
+    vfio_notifier_cleanup(vdev, &vdev->err_notifier, "err_notifier", 0);
 }
 
 static void vfio_req_notifier_handler(void *opaque)
@@ -3025,7 +3031,7 @@ void vfio_pci_register_req_notifier(VFIOPCIDevice *vdev)
                                        VFIO_IRQ_SET_ACTION_TRIGGER, fd, &err)) {
         error_reportf_err(err, VFIO_MSG_PREFIX, vdev->vbasedev.name);
         qemu_set_fd_handler(fd, NULL, NULL, vdev);
-        event_notifier_cleanup(&vdev->req_notifier);
+        vfio_notifier_cleanup(vdev, &vdev->req_notifier, "req_notifier", 0);
     } else {
         vdev->req_enabled = true;
     }
@@ -3045,7 +3051,7 @@ static void vfio_unregister_req_notifier(VFIOPCIDevice *vdev)
     }
     qemu_set_fd_handler(event_notifier_get_fd(&vdev->req_notifier),
                         NULL, NULL, vdev);
-    event_notifier_cleanup(&vdev->req_notifier);
+    vfio_notifier_cleanup(vdev, &vdev->req_notifier, "req_notifier", 0);
 
     vdev->req_enabled = false;
 }

From 6f06e3729a6a8b6fc3cae6e91321014ea4c7f85f Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Tue, 10 Jun 2025 08:39:30 -0700
Subject: [PATCH 1541/2760] vfio/pci: export MSI functions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Export various MSI functions, renamed with a vfio_pci prefix, for use by
CPR in subsequent patches.  No functional change.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/1749569991-25171-18-git-send-email-steven.sistare@oracle.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/pci.c | 29 +++++++++++++++++------------
 hw/vfio/pci.h |  8 ++++++++
 2 files changed, 25 insertions(+), 12 deletions(-)

diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index 06a7a63cf5..fa25bded25 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -351,6 +351,11 @@ static void vfio_intx_disable(VFIOPCIDevice *vdev)
     trace_vfio_intx_disable(vdev->vbasedev.name);
 }
 
+bool vfio_pci_intx_enable(VFIOPCIDevice *vdev, Error **errp)
+{
+    return vfio_intx_enable(vdev, errp);
+}
+
 /*
  * MSI/X
  */
@@ -475,8 +480,8 @@ static int vfio_enable_vectors(VFIOPCIDevice *vdev, bool msix)
     return ret;
 }
 
-static void vfio_add_kvm_msi_virq(VFIOPCIDevice *vdev, VFIOMSIVector *vector,
-                                  int vector_n, bool msix)
+void vfio_pci_add_kvm_msi_virq(VFIOPCIDevice *vdev, VFIOMSIVector *vector,
+                               int vector_n, bool msix)
 {
     if ((msix && vdev->no_kvm_msix) || (!msix && vdev->no_kvm_msi)) {
         return;
@@ -549,7 +554,7 @@ static void set_irq_signalling(VFIODevice *vbasedev, VFIOMSIVector *vector,
     }
 }
 
-static void vfio_pci_vector_init(VFIOPCIDevice *vdev, int nr)
+void vfio_pci_vector_init(VFIOPCIDevice *vdev, int nr)
 {
     VFIOMSIVector *vector = &vdev->msi_vectors[nr];
     PCIDevice *pdev = &vdev->pdev;
@@ -599,10 +604,10 @@ static int vfio_msix_vector_do_use(PCIDevice *pdev, unsigned int nr,
     } else {
         if (msg) {
             if (vdev->defer_kvm_irq_routing) {
-                vfio_add_kvm_msi_virq(vdev, vector, nr, true);
+                vfio_pci_add_kvm_msi_virq(vdev, vector, nr, true);
             } else {
                 vfio_route_change = kvm_irqchip_begin_route_changes(kvm_state);
-                vfio_add_kvm_msi_virq(vdev, vector, nr, true);
+                vfio_pci_add_kvm_msi_virq(vdev, vector, nr, true);
                 kvm_irqchip_commit_route_changes(&vfio_route_change);
                 vfio_connect_kvm_msi_virq(vector, nr);
             }
@@ -681,14 +686,14 @@ static void vfio_msix_vector_release(PCIDevice *pdev, unsigned int nr)
     }
 }
 
-static void vfio_prepare_kvm_msi_virq_batch(VFIOPCIDevice *vdev)
+void vfio_pci_prepare_kvm_msi_virq_batch(VFIOPCIDevice *vdev)
 {
     assert(!vdev->defer_kvm_irq_routing);
     vdev->defer_kvm_irq_routing = true;
     vfio_route_change = kvm_irqchip_begin_route_changes(kvm_state);
 }
 
-static void vfio_commit_kvm_msi_virq_batch(VFIOPCIDevice *vdev)
+void vfio_pci_commit_kvm_msi_virq_batch(VFIOPCIDevice *vdev)
 {
     int i;
 
@@ -718,14 +723,14 @@ static void vfio_msix_enable(VFIOPCIDevice *vdev)
      * routes once rather than per vector provides a substantial
      * performance improvement.
      */
-    vfio_prepare_kvm_msi_virq_batch(vdev);
+    vfio_pci_prepare_kvm_msi_virq_batch(vdev);
 
     if (msix_set_vector_notifiers(&vdev->pdev, vfio_msix_vector_use,
                                   vfio_msix_vector_release, NULL)) {
         error_report("vfio: msix_set_vector_notifiers failed");
     }
 
-    vfio_commit_kvm_msi_virq_batch(vdev);
+    vfio_pci_commit_kvm_msi_virq_batch(vdev);
 
     if (vdev->nr_vectors) {
         ret = vfio_enable_vectors(vdev, true);
@@ -769,7 +774,7 @@ retry:
      * Deferring to commit the KVM routes once rather than per vector
      * provides a substantial performance improvement.
      */
-    vfio_prepare_kvm_msi_virq_batch(vdev);
+    vfio_pci_prepare_kvm_msi_virq_batch(vdev);
 
     vdev->msi_vectors = g_new0(VFIOMSIVector, vdev->nr_vectors);
 
@@ -793,10 +798,10 @@ retry:
          * Attempt to enable route through KVM irqchip,
          * default to userspace handling if unavailable.
          */
-        vfio_add_kvm_msi_virq(vdev, vector, i, false);
+        vfio_pci_add_kvm_msi_virq(vdev, vector, i, false);
     }
 
-    vfio_commit_kvm_msi_virq_batch(vdev);
+    vfio_pci_commit_kvm_msi_virq_batch(vdev);
 
     /* Set interrupt type prior to possible interrupts */
     vdev->interrupt = VFIO_INT_MSI;
diff --git a/hw/vfio/pci.h b/hw/vfio/pci.h
index d4c6b2e7b7..d3dc2274a9 100644
--- a/hw/vfio/pci.h
+++ b/hw/vfio/pci.h
@@ -210,6 +210,14 @@ static inline bool vfio_is_vga(VFIOPCIDevice *vdev)
     return class == PCI_CLASS_DISPLAY_VGA;
 }
 
+/* MSI/MSI-X/INTx */
+void vfio_pci_vector_init(VFIOPCIDevice *vdev, int nr);
+void vfio_pci_add_kvm_msi_virq(VFIOPCIDevice *vdev, VFIOMSIVector *vector,
+                               int vector_n, bool msix);
+void vfio_pci_prepare_kvm_msi_virq_batch(VFIOPCIDevice *vdev);
+void vfio_pci_commit_kvm_msi_virq_batch(VFIOPCIDevice *vdev);
+bool vfio_pci_intx_enable(VFIOPCIDevice *vdev, Error **errp);
+
 uint32_t vfio_pci_read_config(PCIDevice *pdev, uint32_t addr, int len);
 void vfio_pci_write_config(PCIDevice *pdev,
                            uint32_t addr, uint32_t val, int len);

From 079e7216debd767e78a77aefc88e2e7335f49b26 Mon Sep 17 00:00:00 2001
From: John Levon <john.levon@nutanix.com>
Date: Wed, 11 Jun 2025 03:47:53 -0700
Subject: [PATCH 1542/2760] vfio: improve VFIODeviceIOOps docs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Explicitly describe every parameter rather than summarizing.

Signed-off-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250611104753.1199796-1-john.levon@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 include/hw/vfio/vfio-device.h | 52 +++++++++++++++++++++++++++++------
 1 file changed, 43 insertions(+), 9 deletions(-)

diff --git a/include/hw/vfio/vfio-device.h b/include/hw/vfio/vfio-device.h
index f39259406b..d45e5a68a2 100644
--- a/include/hw/vfio/vfio-device.h
+++ b/include/hw/vfio/vfio-device.h
@@ -168,14 +168,25 @@ struct VFIODeviceIOOps {
      * @device_feature
      *
      * Fill in feature info for the given device.
+     *
+     * @vdev: #VFIODevice to use
+     * @feat: feature information to fill in
+     *
+     * Returns 0 on success or -errno.
      */
-    int (*device_feature)(VFIODevice *vdev, struct vfio_device_feature *);
+    int (*device_feature)(VFIODevice *vdev, struct vfio_device_feature *feat);
 
     /**
      * @get_region_info
      *
-     * Fill in @info (and optionally @fd) with information on the region given
-     * by @info->index.
+     * Get the information for a given region on the device.
+     *
+     * @vdev: #VFIODevice to use
+     * @info: set @info->index to the region index to look up; the rest of the
+     *        struct will be filled in on success
+     * @fd: pointer to the fd for the region; will be -1 if not found
+     *
+     * Returns 0 on success or -errno.
      */
     int (*get_region_info)(VFIODevice *vdev,
                            struct vfio_region_info *info, int *fd);
@@ -183,22 +194,38 @@ struct VFIODeviceIOOps {
     /**
      * @get_irq_info
      *
-     * Fill in @irq with information on the IRQ given by @info->index.
+     * @vdev: #VFIODevice to use
+     * @irq: set @irq->index to the IRQ index to look up; the rest of the struct
+     *       will be filled in on success
+     *
+     * Returns 0 on success or -errno.
      */
     int (*get_irq_info)(VFIODevice *vdev, struct vfio_irq_info *irq);
 
     /**
      * @set_irqs
      *
-     * Configure IRQs as defined by @irqs.
+     * Configure IRQs.
+     *
+     * @vdev: #VFIODevice to use
+     * @irqs: IRQ configuration as defined by VFIO docs.
+     *
+     * Returns 0 on success or -errno.
      */
     int (*set_irqs)(VFIODevice *vdev, struct vfio_irq_set *irqs);
 
     /**
      * @region_read
      *
-     * Read @size bytes from the region @nr at offset @off into the buffer
-     * @data.
+     * Read part of a region.
+     *
+     * @vdev: #VFIODevice to use
+     * @nr: region index
+     * @off: offset within the region
+     * @size: size in bytes to read
+     * @data: buffer to read into
+     *
+     * Returns number of bytes read on success or -errno.
      */
     int (*region_read)(VFIODevice *vdev, uint8_t nr, off_t off, uint32_t size,
                        void *data);
@@ -206,8 +233,15 @@ struct VFIODeviceIOOps {
     /**
      * @region_write
      *
-     * Write @size bytes to the region @nr at offset @off from the buffer
-     * @data; if @post, the write is posted.
+     * Write part of a region.
+     *
+     * @vdev: #VFIODevice to use
+     * @nr: region index
+     * @off: offset within the region
+     * @size: size in bytes to write
+     * @data: buffer to write from
+     *
+     * Returns number of bytes write on success or -errno.
      */
     int (*region_write)(VFIODevice *vdev, uint8_t nr, off_t off, uint32_t size,
                         void *data, bool post);

From 6f0273d6ae21bb2e4222789af0e6d480aa9430b1 Mon Sep 17 00:00:00 2001
From: Konstantin Kostiuk <kkostiuk@redhat.com>
Date: Mon, 24 Mar 2025 15:17:28 +0200
Subject: [PATCH 1543/2760] qga-win: implement a 'guest-get-load' command
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Windows has no native equivalent API, but it would be possible to
simulate it as illustrated here (BSD-3-Clause):

  https://github.com/giampaolo/psutil/pull/1485

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Tested-by: Dehan Meng <demeng@redhat.com>
Reviewed-by: Yan Vugenfirer <yvugenfi@redhat.com>
Signed-off-by: Konstantin Kostiuk <kkostiuk@redhat.com>
---
 qga/commands-win32.c   | 148 +++++++++++++++++++++++++++++++++++++++++
 qga/guest-agent-core.h |  10 +++
 qga/main.c             |  39 +++++++++++
 qga/meson.build        |   2 +-
 qga/qapi-schema.json   |   9 ++-
 5 files changed, 205 insertions(+), 3 deletions(-)

diff --git a/qga/commands-win32.c b/qga/commands-win32.c
index d4482538ec..8227480810 100644
--- a/qga/commands-win32.c
+++ b/qga/commands-win32.c
@@ -27,6 +27,7 @@
 #include <lm.h>
 #include <wtsapi32.h>
 #include <wininet.h>
+#include <pdh.h>
 
 #include "guest-agent-core.h"
 #include "vss-win32.h"
@@ -119,6 +120,28 @@ static OpenFlags guest_file_open_modes[] = {
     {"a+b", FILE_GENERIC_APPEND | GENERIC_READ, OPEN_ALWAYS  }
 };
 
+/*
+ * We use an exponentially weighted moving average, just like Unix systems do
+ * https://en.wikipedia.org/wiki/Load_(computing)#Unix-style_load_calculation
+ *
+ * These constants serve as the damping factor and are calculated with
+ * 1 / exp(sampling interval in seconds / window size in seconds)
+ *
+ * This formula comes from linux's include/linux/sched/loadavg.h
+ * https://github.com/torvalds/linux/blob/345671ea0f9258f410eb057b9ced9cefbbe5dc78/include/linux/sched/loadavg.h#L20-L23
+ */
+#define LOADAVG_FACTOR_1F  0.9200444146293232478931553241
+#define LOADAVG_FACTOR_5F  0.9834714538216174894737477501
+#define LOADAVG_FACTOR_15F 0.9944598480048967508795473394
+/*
+ * The time interval in seconds between taking load counts, same as Linux
+ */
+#define LOADAVG_SAMPLING_INTERVAL 5
+
+double load_avg_1m;
+double load_avg_5m;
+double load_avg_15m;
+
 #define debug_error(msg) do { \
     char *suffix = g_win32_error_message(GetLastError()); \
     g_debug("%s: %s", (msg), suffix); \
@@ -2444,3 +2467,128 @@ char *qga_get_host_name(Error **errp)
 
     return g_utf16_to_utf8(tmp, size, NULL, NULL, NULL);
 }
+
+
+static VOID CALLBACK load_avg_callback(PVOID hCounter, BOOLEAN timedOut)
+{
+    PDH_FMT_COUNTERVALUE displayValue;
+    double currentLoad;
+    PDH_STATUS err;
+
+    err = PdhGetFormattedCounterValue(
+        (PDH_HCOUNTER)hCounter, PDH_FMT_DOUBLE, 0, &displayValue);
+    /* Skip updating the load if we can't get the value successfully */
+    if (err != ERROR_SUCCESS) {
+        slog("PdhGetFormattedCounterValue failed to get load value with 0x%lx",
+             err);
+        return;
+    }
+    currentLoad = displayValue.doubleValue;
+
+    load_avg_1m = load_avg_1m * LOADAVG_FACTOR_1F + currentLoad * \
+        (1.0 - LOADAVG_FACTOR_1F);
+    load_avg_5m = load_avg_5m * LOADAVG_FACTOR_5F + currentLoad * \
+        (1.0 - LOADAVG_FACTOR_5F);
+    load_avg_15m = load_avg_15m * LOADAVG_FACTOR_15F + currentLoad * \
+        (1.0 - LOADAVG_FACTOR_15F);
+}
+
+static BOOL init_load_avg_counter(Error **errp)
+{
+    CONST WCHAR *szCounterPath = L"\\System\\Processor Queue Length";
+    PDH_STATUS status;
+    BOOL ret;
+    HQUERY hQuery;
+    HCOUNTER hCounter;
+    HANDLE event;
+    HANDLE waitHandle;
+
+    status = PdhOpenQueryW(NULL, 0, &hQuery);
+    if (status != ERROR_SUCCESS) {
+        /*
+         * If the function fails, the return value is a system error code or
+         * a PDH error code. error_setg_win32 cant translate PDH error code
+         * properly, so just report it as is.
+         */
+        error_setg_win32(errp, (DWORD)status,
+                         "PdhOpenQueryW failed with 0x%lx", status);
+        return FALSE;
+    }
+
+    status = PdhAddEnglishCounterW(hQuery, szCounterPath, 0, &hCounter);
+    if (status != ERROR_SUCCESS) {
+        error_setg_win32(errp, (DWORD)status,
+            "PdhAddEnglishCounterW failed with 0x%lx. Performance counters may be disabled.",
+            status);
+        PdhCloseQuery(hQuery);
+        return FALSE;
+    }
+
+    event = CreateEventW(NULL, FALSE, FALSE, L"LoadUpdateEvent");
+    if (event == NULL) {
+        error_setg_win32(errp, GetLastError(), "Create LoadUpdateEvent failed");
+        PdhCloseQuery(hQuery);
+        return FALSE;
+    }
+
+    status = PdhCollectQueryDataEx(hQuery, LOADAVG_SAMPLING_INTERVAL, event);
+    if (status != ERROR_SUCCESS) {
+        error_setg_win32(errp, (DWORD)status,
+                         "PdhCollectQueryDataEx failed with 0x%lx", status);
+        CloseHandle(event);
+        PdhCloseQuery(hQuery);
+        return FALSE;
+    }
+
+    ret = RegisterWaitForSingleObject(
+        &waitHandle,
+        event,
+        (WAITORTIMERCALLBACK)load_avg_callback,
+        (PVOID)hCounter,
+        INFINITE,
+        WT_EXECUTEDEFAULT);
+
+    if (ret == 0) {
+        error_setg_win32(errp, GetLastError(),
+                         "RegisterWaitForSingleObject failed");
+        CloseHandle(event);
+        PdhCloseQuery(hQuery);
+        return FALSE;
+    }
+
+    ga_set_load_avg_wait_handle(ga_state, waitHandle);
+    ga_set_load_avg_event(ga_state, event);
+    ga_set_load_avg_pdh_query(ga_state, hQuery);
+
+    return TRUE;
+}
+
+GuestLoadAverage *qmp_guest_get_load(Error **errp)
+{
+    /*
+     * The load average logic calls PerformaceCounterAPI, which can result
+     * in a performance penalty. This avoids running the load average logic
+     * until a management application actually requests it. The load average
+     * will not initially be very accurate, but assuming that any interested
+     * management application will request it repeatedly throughout the lifetime
+     * of the VM, this seems like a good mitigation.
+     */
+    if (ga_get_load_avg_pdh_query(ga_state) == NULL) {
+        /* set initial values */
+        load_avg_1m = 0;
+        load_avg_5m = 0;
+        load_avg_15m = 0;
+
+        if (init_load_avg_counter(errp) == false) {
+            return NULL;
+        }
+    }
+
+    GuestLoadAverage *ret = NULL;
+
+    ret = g_new0(GuestLoadAverage, 1);
+    ret->load1m = load_avg_1m;
+    ret->load5m = load_avg_5m;
+    ret->load15m = load_avg_15m;
+    return ret;
+}
diff --git a/qga/guest-agent-core.h b/qga/guest-agent-core.h
index a536d07d0d..d9f3922adf 100644
--- a/qga/guest-agent-core.h
+++ b/qga/guest-agent-core.h
@@ -13,6 +13,10 @@
 #ifndef GUEST_AGENT_CORE_H
 #define GUEST_AGENT_CORE_H
 
+#ifdef _WIN32
+#include <pdh.h>
+#endif
+
 #include "qapi/qmp-registry.h"
 #include "qga-qapi-types.h"
 
@@ -41,6 +45,12 @@ void ga_set_response_delimited(GAState *s);
 bool ga_is_frozen(GAState *s);
 void ga_set_frozen(GAState *s);
 void ga_unset_frozen(GAState *s);
+#ifdef _WIN32
+void ga_set_load_avg_event(GAState *s, HANDLE event);
+void ga_set_load_avg_wait_handle(GAState *s, HANDLE wait_handle);
+void ga_set_load_avg_pdh_query(GAState *s, HQUERY query);
+HQUERY ga_get_load_avg_pdh_query(GAState *s);
+#endif
 const char *ga_fsfreeze_hook(GAState *s);
 int64_t ga_get_fd_handle(GAState *s, Error **errp);
 int ga_parse_whence(GuestFileWhence *whence, Error **errp);
diff --git a/qga/main.c b/qga/main.c
index 72c39b042f..6c02f3ec38 100644
--- a/qga/main.c
+++ b/qga/main.c
@@ -33,6 +33,7 @@
 #include "qemu-version.h"
 #ifdef _WIN32
 #include <dbt.h>
+#include <pdh.h>
 #include "qga/service-win32.h"
 #include "qga/vss-win32.h"
 #endif
@@ -105,6 +106,9 @@ struct GAState {
     GAService service;
     HANDLE wakeup_event;
     HANDLE event_log;
+    HANDLE load_avg_wait_handle;
+    HANDLE load_avg_event;
+    HQUERY load_avg_pdh_query;
 #endif
     bool delimit_response;
     bool frozen;
@@ -582,6 +586,25 @@ const char *ga_fsfreeze_hook(GAState *s)
 }
 #endif
 
+#ifdef _WIN32
+void ga_set_load_avg_wait_handle(GAState *s, HANDLE wait_handle)
+{
+    s->load_avg_wait_handle = wait_handle;
+}
+void ga_set_load_avg_event(GAState *s, HANDLE event)
+{
+    s->load_avg_event = event;
+}
+void ga_set_load_avg_pdh_query(GAState *s, HQUERY query)
+{
+    s->load_avg_pdh_query = query;
+}
+HQUERY ga_get_load_avg_pdh_query(GAState *s)
+{
+    return s->load_avg_pdh_query;
+}
+#endif
+
 static void become_daemon(const char *pidfile)
 {
 #ifndef _WIN32
@@ -1402,6 +1425,10 @@ static GAState *initialize_agent(GAConfig *config, int socket_activation)
     g_debug("Guest agent version %s started", QEMU_FULL_VERSION);
 
 #ifdef _WIN32
+    s->load_avg_wait_handle = INVALID_HANDLE_VALUE;
+    s->load_avg_event = INVALID_HANDLE_VALUE;
+    s->load_avg_pdh_query = NULL;
+
     s->event_log = RegisterEventSource(NULL, "qemu-ga");
     if (!s->event_log) {
         g_autofree gchar *errmsg = g_win32_error_message(GetLastError());
@@ -1506,6 +1533,18 @@ static void cleanup_agent(GAState *s)
 #ifdef _WIN32
     CloseHandle(s->wakeup_event);
     CloseHandle(s->event_log);
+
+    if (s->load_avg_wait_handle != INVALID_HANDLE_VALUE) {
+        UnregisterWait(s->load_avg_wait_handle);
+    }
+
+    if (s->load_avg_event != INVALID_HANDLE_VALUE) {
+        CloseHandle(s->load_avg_event);
+    }
+
+    if (s->load_avg_pdh_query) {
+        PdhCloseQuery(s->load_avg_pdh_query);
+    }
 #endif
     if (s->command_state) {
         ga_command_state_cleanup_all(s->command_state);
diff --git a/qga/meson.build b/qga/meson.build
index 587ec4e5e8..89a4a8f713 100644
--- a/qga/meson.build
+++ b/qga/meson.build
@@ -95,7 +95,7 @@ gen_tlb = []
 qga_libs = []
 if host_os == 'windows'
   qga_libs += ['-lws2_32', '-lwinmm', '-lpowrprof', '-lwtsapi32', '-lwininet', '-liphlpapi', '-lnetapi32',
-               '-lsetupapi', '-lcfgmgr32', '-luserenv']
+               '-lsetupapi', '-lcfgmgr32', '-luserenv', '-lpdh' ]
   if have_qga_vss
     qga_libs += ['-lole32', '-loleaut32', '-lshlwapi', '-lstdc++', '-Wl,--enable-stdcall-fixup']
     subdir('vss-win32')
diff --git a/qga/qapi-schema.json b/qga/qapi-schema.json
index 5316bfacbf..6d770f7b8e 100644
--- a/qga/qapi-schema.json
+++ b/qga/qapi-schema.json
@@ -1880,7 +1880,7 @@
       'load5m': 'number',
       'load15m': 'number'
   },
-  'if': 'CONFIG_GETLOADAVG'
+  'if': { 'any': ['CONFIG_WIN32', 'CONFIG_GETLOADAVG'] }
 }
 
 ##
@@ -1888,13 +1888,18 @@
 #
 # Retrieve CPU process load information
 #
+# .. note:: Windows does not have load average API, so QGA emulates it by
+#           calculating the average CPU usage in the last 1, 5, 15 minutes
+#           similar as Linux does this.
+#           Calculation starts from the first time this command is called.
+#
 # Returns: load information
 #
 # Since: 10.0
 ##
 { 'command': 'guest-get-load',
   'returns': 'GuestLoadAverage',
-  'if': 'CONFIG_GETLOADAVG'
+  'if': { 'any': ['CONFIG_WIN32', 'CONFIG_GETLOADAVG'] }
 }
 
 ##

From 1ebbc8b774d8b44697740b108ad060612828b58f Mon Sep 17 00:00:00 2001
From: Konstantin Kostiuk <kkostiuk@redhat.com>
Date: Mon, 24 Mar 2025 15:17:29 +0200
Subject: [PATCH 1544/2760] qga: Add tests for guest-get-load command

Tested-by: Dehan Meng <demeng@redhat.com>
Reviewed-by: Yan Vugenfirer <yvugenfi@redhat.com>
Signed-off-by: Konstantin Kostiuk <kkostiuk@redhat.com>
---
 tests/unit/test-qga.c | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/tests/unit/test-qga.c b/tests/unit/test-qga.c
index 541b08a5e7..587e30c7e4 100644
--- a/tests/unit/test-qga.c
+++ b/tests/unit/test-qga.c
@@ -332,6 +332,22 @@ static void test_qga_get_fsinfo(gconstpointer fix)
     }
 }
 
+static void test_qga_get_load(gconstpointer fix)
+{
+    const TestFixture *fixture = fix;
+    g_autoptr(QDict) ret = NULL;
+    QDict *load;
+
+    ret = qmp_fd(fixture->fd, "{'execute': 'guest-get-load'}");
+    g_assert_nonnull(ret);
+    qmp_assert_no_error(ret);
+
+    load = qdict_get_qdict(ret, "return");
+    g_assert(qdict_haskey(load, "load1m"));
+    g_assert(qdict_haskey(load, "load5m"));
+    g_assert(qdict_haskey(load, "load15m"));
+}
+
 static void test_qga_get_memory_block_info(gconstpointer fix)
 {
     const TestFixture *fixture = fix;
@@ -1105,6 +1121,7 @@ int main(int argc, char **argv)
         g_test_add_data_func("/qga/get-vcpus", &fix, test_qga_get_vcpus);
     }
     g_test_add_data_func("/qga/get-fsinfo", &fix, test_qga_get_fsinfo);
+    g_test_add_data_func("/qga/get-load", &fix, test_qga_get_load);
     g_test_add_data_func("/qga/get-memory-block-info", &fix,
                          test_qga_get_memory_block_info);
     g_test_add_data_func("/qga/get-memory-blocks", &fix,

From f5ec751ee70d7960a97c6c675f69e924d82dc60d Mon Sep 17 00:00:00 2001
From: Shameer Kolothum <shameerali.kolothum.thodi@huawei.com>
Date: Mon, 2 Jun 2025 12:46:55 +0100
Subject: [PATCH 1545/2760] hw/arm/virt: Check bypass iommu is not set for
 iommu-map DT property

default_bus_bypass_iommu tells us whether the bypass_iommu is set
for the default PCIe root bus. Make sure we check that before adding
the "iommu-map" DT property.

Cc: qemu-stable@nongnu.org
Fixes: 6d7a85483a06 ("hw/arm/virt: Add default_bus_bypass_iommu machine option")
Suggested-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Shameer Kolothum <shameerali.kolothum.thodi@huawei.com>
Reviewed-by: Donald Dutile <ddutile@redhat.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Message-id: 20250602114655.42920-1-shameerali.kolothum.thodi@huawei.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index 9a6cd085a3..99fde5836c 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -1487,9 +1487,12 @@ static void create_virtio_iommu_dt_bindings(VirtMachineState *vms)
     qemu_fdt_setprop_cell(ms->fdt, node, "phandle", vms->iommu_phandle);
     g_free(node);
 
-    qemu_fdt_setprop_cells(ms->fdt, vms->pciehb_nodename, "iommu-map",
-                           0x0, vms->iommu_phandle, 0x0, bdf,
-                           bdf + 1, vms->iommu_phandle, bdf + 1, 0xffff - bdf);
+    if (!vms->default_bus_bypass_iommu) {
+        qemu_fdt_setprop_cells(ms->fdt, vms->pciehb_nodename, "iommu-map",
+                               0x0, vms->iommu_phandle, 0x0, bdf,
+                               bdf + 1, vms->iommu_phandle, bdf + 1,
+                               0xffff - bdf);
+    }
 }
 
 static void create_pcie(VirtMachineState *vms)
@@ -1612,8 +1615,10 @@ static void create_pcie(VirtMachineState *vms)
         switch (vms->iommu) {
         case VIRT_IOMMU_SMMUV3:
             create_smmu(vms, vms->bus);
-            qemu_fdt_setprop_cells(ms->fdt, nodename, "iommu-map",
-                                   0x0, vms->iommu_phandle, 0x0, 0x10000);
+            if (!vms->default_bus_bypass_iommu) {
+                qemu_fdt_setprop_cells(ms->fdt, nodename, "iommu-map",
+                                       0x0, vms->iommu_phandle, 0x0, 0x10000);
+            }
             break;
         default:
             g_assert_not_reached();

From 16a9b55021519fb1d4a4585952e03eafd4ed1947 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Tue, 3 Jun 2025 12:15:26 +0200
Subject: [PATCH 1546/2760] tests/functional: Add a test for the
 realview-eb-mpcore machine

Check that we can boot a Linux kernel here and that we can at
least send one ping network packet.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-id: 20250603101526.21217-1-thuth@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 MAINTAINERS                           |  1 +
 tests/functional/meson.build          |  1 +
 tests/functional/test_arm_realview.py | 47 +++++++++++++++++++++++++++
 3 files changed, 49 insertions(+)
 create mode 100755 tests/functional/test_arm_realview.py

diff --git a/MAINTAINERS b/MAINTAINERS
index 28b3dd2684..84cfef835e 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -955,6 +955,7 @@ F: hw/cpu/realview_mpcore.c
 F: hw/intc/realview_gic.c
 F: include/hw/intc/realview_gic.h
 F: docs/system/arm/realview.rst
+F: tests/functional/test_arm_realview.py
 
 SABRELITE / i.MX6
 M: Peter Maydell <peter.maydell@linaro.org>
diff --git a/tests/functional/meson.build b/tests/functional/meson.build
index 7faa2b6e3c..e7e051ef3c 100644
--- a/tests/functional/meson.build
+++ b/tests/functional/meson.build
@@ -135,6 +135,7 @@ tests_arm_system_thorough = [
   'arm_orangepi',
   'arm_quanta_gsj',
   'arm_raspi2',
+  'arm_realview',
   'arm_replay',
   'arm_smdkc210',
   'arm_stellaris',
diff --git a/tests/functional/test_arm_realview.py b/tests/functional/test_arm_realview.py
new file mode 100755
index 0000000000..82cc964333
--- /dev/null
+++ b/tests/functional/test_arm_realview.py
@@ -0,0 +1,47 @@
+#!/usr/bin/env python3
+#
+# Functional test that boots a Linux kernel on a realview arm machine
+# and checks the console
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+from qemu_test import LinuxKernelTest, exec_command_and_wait_for_pattern
+from qemu_test import Asset
+
+
+class RealviewMachine(LinuxKernelTest):
+
+    ASSET_REALVIEW_MPCORE = Asset(
+        ('https://archive.openwrt.org/chaos_calmer/15.05.1/realview/generic/'
+         'openwrt-15.05.1-realview-vmlinux-initramfs.elf'),
+        'd3a01037f33e7512d46d50975588d5c3a0e0cbf25f37afab44775c2a2be523e6')
+
+    def test_realview_ep_mpcore(self):
+        self.require_netdev('user')
+        self.set_machine('realview-eb-mpcore')
+        kernel_path = self.ASSET_REALVIEW_MPCORE.fetch()
+        self.vm.set_console()
+        kernel_param = 'console=ttyAMA0 mem=128M quiet'
+        self.vm.add_args('-kernel', kernel_path,
+                         '-append', kernel_param)
+        self.vm.launch()
+        self.wait_for_console_pattern('Please press Enter to activate')
+        prompt = ':/#'
+        exec_command_and_wait_for_pattern(self, '', prompt)
+        exec_command_and_wait_for_pattern(self, 'dmesg', kernel_param)
+        self.wait_for_console_pattern(prompt)
+        exec_command_and_wait_for_pattern(self,
+                ('while ! dmesg | grep "br-lan: port 1(eth0) entered" ;'
+                 ' do sleep 1 ; done'),
+                'entered forwarding state')
+        self.wait_for_console_pattern(prompt)
+        exec_command_and_wait_for_pattern(self,
+                'while ! ifconfig | grep "10.0.2.15" ; do sleep 1 ; done',
+                'addr:10.0.2.15')
+        self.wait_for_console_pattern(prompt)
+        exec_command_and_wait_for_pattern(self, 'ping -c 1 10.0.2.2',
+                                          '1 packets received, 0% packet loss')
+
+
+if __name__ == '__main__':
+    LinuxKernelTest.main()

From c653b67d1863b7ebfa67f7c9f4aec209d7b5ced5 Mon Sep 17 00:00:00 2001
From: Stefan Hajnoczi <stefanha@redhat.com>
Date: Tue, 10 Jun 2025 13:36:39 +0100
Subject: [PATCH 1547/2760] include/qemu/compiler: add QEMU_UNINITIALIZED
 attribute macro
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The QEMU_UNINITIALIZED macro is to be used to skip the default compiler
variable initialization done by -ftrivial-auto-var-init=zero.

Use this in cases where there a method in the device I/O path (or other
important hot paths), that has large variables on the stack. A rule of
thumb is that "large" means a method with 4kb data in the local stack
frame. Any variables which are KB in size, should be annotated with this
attribute, to pre-emptively eliminate any potential overhead from the
compiler zero'ing memory.

Given that this turns off a security hardening feature, when using this
to flag variables, it is important that the code is double-checked to
ensure there is no possible use of uninitialized data in the method.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Message-id: 20250610123709.835102-2-berrange@redhat.com
[DB: split off patch & rewrite guidance on when to use the annotation]
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 include/qemu/compiler.h | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/include/qemu/compiler.h b/include/qemu/compiler.h
index 496dac5ac1..65b89958d3 100644
--- a/include/qemu/compiler.h
+++ b/include/qemu/compiler.h
@@ -207,6 +207,26 @@
 # define QEMU_USED
 #endif
 
+/*
+ * Disable -ftrivial-auto-var-init on a local variable.
+ *
+ * Use this in cases where there a method in the device I/O path (or other
+ * important hot paths), that has large variables on the stack. A rule of
+ * thumb is that "large" means a method with 4kb data in the local stack
+ * frame. Any variables which are KB in size, should be annotated with this
+ * attribute, to pre-emptively eliminate any potential overhead from the
+ * compiler's implicit zero'ing of memory.
+ *
+ * Given that this turns off a security hardening feature, when using this
+ * to flag variables, it is important that the code is double-checked to
+ * ensure there is no possible use of uninitialized data in the method.
+ */
+#if __has_attribute(uninitialized)
+# define QEMU_UNINITIALIZED __attribute__((uninitialized))
+#else
+# define QEMU_UNINITIALIZED
+#endif
+
 /*
  * http://clang.llvm.org/docs/ThreadSafetyAnalysis.html
  *

From ba2868ce091cd4abe4be6de4b7e44b3be303b352 Mon Sep 17 00:00:00 2001
From: Stefan Hajnoczi <stefanha@redhat.com>
Date: Tue, 10 Jun 2025 13:36:40 +0100
Subject: [PATCH 1548/2760] hw/virtio/virtio: avoid cost of
 -ftrivial-auto-var-init in hot path
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since commit 7ff9ff039380 ("meson: mitigate against use of uninitialize
stack for exploits") the -ftrivial-auto-var-init=zero compiler option is
used to zero local variables. While this reduces security risks
associated with uninitialized stack data, it introduced a measurable
bottleneck in the virtqueue_split_pop() and virtqueue_packed_pop()
functions.

These virtqueue functions are in the hot path. They are called for each
element (request) that is popped from a VIRTIO device's virtqueue. Using
__attribute__((uninitialized)) on large stack variables in these
functions improves fio randread bs=4k iodepth=64 performance from 304k
to 332k IOPS (+9%).

This issue was found using perf-top(1). virtqueue_split_pop() was one of
the top CPU consumers and the "annotate" feature showed that the memory
zeroing instructions at the beginning of the functions were hot.

Fixes: 7ff9ff039380 ("meson: mitigate against use of uninitialize stack for exploits")
Cc: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20250610123709.835102-3-berrange@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 hw/virtio/virtio.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
index 5534251e01..82a285a31d 100644
--- a/hw/virtio/virtio.c
+++ b/hw/virtio/virtio.c
@@ -1689,8 +1689,8 @@ static void *virtqueue_split_pop(VirtQueue *vq, size_t sz)
     VirtIODevice *vdev = vq->vdev;
     VirtQueueElement *elem = NULL;
     unsigned out_num, in_num, elem_entries;
-    hwaddr addr[VIRTQUEUE_MAX_SIZE];
-    struct iovec iov[VIRTQUEUE_MAX_SIZE];
+    hwaddr QEMU_UNINITIALIZED addr[VIRTQUEUE_MAX_SIZE];
+    struct iovec QEMU_UNINITIALIZED iov[VIRTQUEUE_MAX_SIZE];
     VRingDesc desc;
     int rc;
 
@@ -1836,8 +1836,8 @@ static void *virtqueue_packed_pop(VirtQueue *vq, size_t sz)
     VirtIODevice *vdev = vq->vdev;
     VirtQueueElement *elem = NULL;
     unsigned out_num, in_num, elem_entries;
-    hwaddr addr[VIRTQUEUE_MAX_SIZE];
-    struct iovec iov[VIRTQUEUE_MAX_SIZE];
+    hwaddr QEMU_UNINITIALIZED addr[VIRTQUEUE_MAX_SIZE];
+    struct iovec QEMU_UNINITIALIZED iov[VIRTQUEUE_MAX_SIZE];
     VRingPackedDesc desc;
     uint16_t id;
     int rc;

From 83750c1da807c973b0b11d977d61df7e41122d03 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 10 Jun 2025 13:36:41 +0100
Subject: [PATCH 1549/2760] block: skip automatic zero-init of large array in
 ioq_submit
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The 'ioq_submit' method has a struct array that is 8k in size.
Skip the automatic zero-init of this array to eliminate the
performance overhead in the I/O hot path.

The 'iocbs' array will selectively initialized when processing
the I/O data.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20250610123709.835102-4-berrange@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 block/linux-aio.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/block/linux-aio.c b/block/linux-aio.c
index 407369f5c9..c200e7ad20 100644
--- a/block/linux-aio.c
+++ b/block/linux-aio.c
@@ -291,7 +291,7 @@ static void ioq_submit(LinuxAioState *s)
 {
     int ret, len;
     struct qemu_laiocb *aiocb;
-    struct iocb *iocbs[MAX_EVENTS];
+    QEMU_UNINITIALIZED struct iocb *iocbs[MAX_EVENTS];
     QSIMPLEQ_HEAD(, qemu_laiocb) completed;
 
     do {

From a503bdc22b91869e3bf45522e36b122889465306 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 10 Jun 2025 13:36:42 +0100
Subject: [PATCH 1550/2760] chardev/char-fd: skip automatic zero-init of large
 array
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The 'fd_chr_read' method has a 4k byte array used for copying
data between the socket and device. Skip the automatic zero-init
of this array to eliminate the performance overhead in the I/O
hot path.

The 'buf' array will be fully initialized when reading data off
the network socket.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20250610123709.835102-5-berrange@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 chardev/char-fd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/chardev/char-fd.c b/chardev/char-fd.c
index 23bfe3c0b1..6f03adf872 100644
--- a/chardev/char-fd.c
+++ b/chardev/char-fd.c
@@ -50,7 +50,7 @@ static gboolean fd_chr_read(QIOChannel *chan, GIOCondition cond, void *opaque)
     Chardev *chr = CHARDEV(opaque);
     FDChardev *s = FD_CHARDEV(opaque);
     int len;
-    uint8_t buf[CHR_READ_BUF_LEN];
+    QEMU_UNINITIALIZED uint8_t buf[CHR_READ_BUF_LEN];
     ssize_t ret;
 
     len = sizeof(buf);

From 45bb7fb21c8d18294a9f92da99d01ab3c67c7df2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 10 Jun 2025 13:36:43 +0100
Subject: [PATCH 1551/2760] chardev/char-pty: skip automatic zero-init of large
 array
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The 'pty_chr_read' method has a 4k byte array used for copying
data between the PTY and device. Skip the automatic zero-init
of this array to eliminate the performance overhead in the I/O
hot path.

The 'buf' array will be fully initialized when reading data off
the PTY.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20250610123709.835102-6-berrange@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 chardev/char-pty.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/chardev/char-pty.c b/chardev/char-pty.c
index c28554e6e0..674e9b3f14 100644
--- a/chardev/char-pty.c
+++ b/chardev/char-pty.c
@@ -154,7 +154,7 @@ static gboolean pty_chr_read(QIOChannel *chan, GIOCondition cond, void *opaque)
     Chardev *chr = CHARDEV(opaque);
     PtyChardev *s = PTY_CHARDEV(opaque);
     gsize len;
-    uint8_t buf[CHR_READ_BUF_LEN];
+    QEMU_UNINITIALIZED uint8_t buf[CHR_READ_BUF_LEN];
     ssize_t ret;
 
     len = sizeof(buf);

From 9a23075cef1ac6e73a95a489ac72f41c573ceb9b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 10 Jun 2025 13:36:44 +0100
Subject: [PATCH 1552/2760] chardev/char-socket: skip automatic zero-init of
 large array
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The 'tcp_chr_read' method has a 4k byte array used for copying
data between the socket and device. Skip the automatic zero-init
of this array to eliminate the performance overhead in the I/O
hot path.

The 'buf' array will be fully initialized when reading data off
the network socket.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20250610123709.835102-7-berrange@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 chardev/char-socket.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/chardev/char-socket.c b/chardev/char-socket.c
index e8dd2931dc..1e8313915b 100644
--- a/chardev/char-socket.c
+++ b/chardev/char-socket.c
@@ -497,7 +497,7 @@ static gboolean tcp_chr_read(QIOChannel *chan, GIOCondition cond, void *opaque)
 {
     Chardev *chr = CHARDEV(opaque);
     SocketChardev *s = SOCKET_CHARDEV(opaque);
-    uint8_t buf[CHR_READ_BUF_LEN];
+    QEMU_UNINITIALIZED uint8_t buf[CHR_READ_BUF_LEN];
     int len, size;
 
     if ((s->state != TCP_CHARDEV_STATE_CONNECTED) ||

From 2553d2d26a9d0f46386bf8c37d184567e5cede6c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 10 Jun 2025 13:36:45 +0100
Subject: [PATCH 1553/2760] hw/audio/ac97: skip automatic zero-init of large
 arrays
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The 'read_audio' & 'write_audio' methods have a 4k byte array used
for copying data between the audio backend and device. Skip the
automatic zero-init of these arrays to eliminate the performance
overhead in the I/O hot path.

The 'tmpbuf' array will be fully initialized when reading data from
the audio backend and/or device memory.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20250610123709.835102-8-berrange@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 hw/audio/ac97.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/audio/ac97.c b/hw/audio/ac97.c
index 669a0463cc..eb7a847080 100644
--- a/hw/audio/ac97.c
+++ b/hw/audio/ac97.c
@@ -886,7 +886,7 @@ static void nabm_writel(void *opaque, uint32_t addr, uint32_t val)
 static int write_audio(AC97LinkState *s, AC97BusMasterRegs *r,
                        int max, int *stop)
 {
-    uint8_t tmpbuf[4096];
+    QEMU_UNINITIALIZED uint8_t tmpbuf[4096];
     uint32_t addr = r->bd.addr;
     uint32_t temp = r->picb << 1;
     uint32_t written = 0;
@@ -959,7 +959,7 @@ static void write_bup(AC97LinkState *s, int elapsed)
 static int read_audio(AC97LinkState *s, AC97BusMasterRegs *r,
                       int max, int *stop)
 {
-    uint8_t tmpbuf[4096];
+    QEMU_UNINITIALIZED uint8_t tmpbuf[4096];
     uint32_t addr = r->bd.addr;
     uint32_t temp = r->picb << 1;
     uint32_t nread = 0;

From ca2cc0385d97cea66cd54ee42553f385c403d4a6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 10 Jun 2025 13:36:46 +0100
Subject: [PATCH 1554/2760] hw/audio/cs4231a: skip automatic zero-init of large
 arrays
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The 'cs_write_audio' method has a pair of byte arrays, one 4k in size
and one 8k, which are used in converting audio samples. Skip the
automatic zero-init of these arrays to eliminate the performance
overhead in the I/O hot path.

The 'tmpbuf' array will be fully initialized when reading a block of
data from the guest. The 'linbuf' array will be fully initialized
when converting the audio samples.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20250610123709.835102-9-berrange@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 hw/audio/cs4231a.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/audio/cs4231a.c b/hw/audio/cs4231a.c
index eb9a45805b..6dfff202ff 100644
--- a/hw/audio/cs4231a.c
+++ b/hw/audio/cs4231a.c
@@ -528,7 +528,7 @@ static int cs_write_audio (CSState *s, int nchan, int dma_pos,
                            int dma_len, int len)
 {
     int temp, net;
-    uint8_t tmpbuf[4096];
+    QEMU_UNINITIALIZED uint8_t tmpbuf[4096];
     IsaDmaClass *k = ISADMA_GET_CLASS(s->isa_dma);
 
     temp = len;
@@ -547,7 +547,7 @@ static int cs_write_audio (CSState *s, int nchan, int dma_pos,
         copied = k->read_memory(s->isa_dma, nchan, tmpbuf, dma_pos, to_copy);
         if (s->tab) {
             int i;
-            int16_t linbuf[4096];
+            QEMU_UNINITIALIZED int16_t linbuf[4096];
 
             for (i = 0; i < copied; ++i)
                 linbuf[i] = s->tab[tmpbuf[i]];

From 8236e206084b832d1d7ec947a4798b818f4cdf1f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 10 Jun 2025 13:36:47 +0100
Subject: [PATCH 1555/2760] hw/audio/es1370: skip automatic zero-init of large
 array
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The 'es1370_transfer_audio' method has a 4k byte array used for
copying data between the audio backend and device. Skip the automatic
zero-init of this array to eliminate the performance overhead in
the I/O hot path.

The 'tmpbuf' array will be fully initialized when reading data from
the audio backend and/or device memory.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20250610123709.835102-10-berrange@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 hw/audio/es1370.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/audio/es1370.c b/hw/audio/es1370.c
index 8efb969212..a6a32a6348 100644
--- a/hw/audio/es1370.c
+++ b/hw/audio/es1370.c
@@ -604,7 +604,7 @@ static uint64_t es1370_read(void *opaque, hwaddr addr, unsigned size)
 static void es1370_transfer_audio (ES1370State *s, struct chan *d, int loop_sel,
                                    int max, bool *irq)
 {
-    uint8_t tmpbuf[4096];
+    QEMU_UNINITIALIZED uint8_t tmpbuf[4096];
     size_t to_transfer;
     uint32_t addr = d->frame_addr;
     int sc = d->scount & 0xffff;

From 2e438da4929018c62609381e1156aac0b2fe3de3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 10 Jun 2025 13:36:48 +0100
Subject: [PATCH 1556/2760] hw/audio/gus: skip automatic zero-init of large
 array
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The 'GUS_read_DMA' method has a 4k byte array used for copying
data between the audio backend and device. Skip the automatic
zero-init of this array to eliminate the performance overhead in
the I/O hot path.

The 'tmpbuf' array will be fully initialized when reading data
from device memory.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20250610123709.835102-11-berrange@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 hw/audio/gus.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/audio/gus.c b/hw/audio/gus.c
index 87e8634893..c36df0240f 100644
--- a/hw/audio/gus.c
+++ b/hw/audio/gus.c
@@ -183,7 +183,7 @@ static int GUS_read_DMA (void *opaque, int nchan, int dma_pos, int dma_len)
 {
     GUSState *s = opaque;
     IsaDmaClass *k = ISADMA_GET_CLASS(s->isa_dma);
-    char tmpbuf[4096];
+    QEMU_UNINITIALIZED char tmpbuf[4096];
     int pos = dma_pos, mode, left = dma_len - dma_pos;
 
     ldebug ("read DMA %#x %d\n", dma_pos, dma_len);

From 5b6cd5c5df4229972d8a0fd9dd9a089a1644d6ba Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 10 Jun 2025 13:36:49 +0100
Subject: [PATCH 1557/2760] hw/audio/marvell_88w8618: skip automatic zero-init
 of large array
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The 'mv88w8618_audio_callback' method has a 4k byte array used for
copying data between the audio backend and device. Skip the automatic
zero-init of this array to eliminate the performance overhead in
the I/O hot path.

The 'buf' array will be fully initialized when reading data from
device memory.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20250610123709.835102-12-berrange@redhat.com
[Fixed hw/audio/gus in commit message --Stefan]
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 hw/audio/marvell_88w8618.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/audio/marvell_88w8618.c b/hw/audio/marvell_88w8618.c
index 6d3ebbb0c8..c5c79d083a 100644
--- a/hw/audio/marvell_88w8618.c
+++ b/hw/audio/marvell_88w8618.c
@@ -66,7 +66,7 @@ static void mv88w8618_audio_callback(void *opaque, int free_out, int free_in)
 {
     mv88w8618_audio_state *s = opaque;
     int16_t *codec_buffer;
-    int8_t buf[4096];
+    QEMU_UNINITIALIZED int8_t buf[4096];
     int8_t *mem_buffer;
     int pos, block_size;
 

From 30c82f6657c1ee9fbb5473924b4d3273f214bd6f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 10 Jun 2025 13:36:50 +0100
Subject: [PATCH 1558/2760] hw/audio/sb16: skip automatic zero-init of large
 array
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The 'write_audio' method has a 4k byte array used for copying data
between the audio backend and device. Skip the automatic zero-init
of this array to eliminate the performance overhead in the I/O hot
path.

The 'tmpbuf' array will be fully initialized when reading data from
device memory.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20250610123709.835102-13-berrange@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 hw/audio/sb16.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/audio/sb16.c b/hw/audio/sb16.c
index 19fd3b9020..bac64118fe 100644
--- a/hw/audio/sb16.c
+++ b/hw/audio/sb16.c
@@ -1181,7 +1181,7 @@ static int write_audio (SB16State *s, int nchan, int dma_pos,
     IsaDma *isa_dma = nchan == s->dma ? s->isa_dma : s->isa_hdma;
     IsaDmaClass *k = ISADMA_GET_CLASS(isa_dma);
     int temp, net;
-    uint8_t tmpbuf[4096];
+    QEMU_UNINITIALIZED uint8_t tmpbuf[4096];
 
     temp = len;
     net = 0;

From bb71d9fe1419f44529c91d1b09464718d157e647 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 10 Jun 2025 13:36:51 +0100
Subject: [PATCH 1559/2760] hw/audio/via-ac97: skip automatic zero-init of
 large array
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The 'out_cb' method has a 4k byte array used for copying data
between the audio backend and device. Skip the automatic zero-init
of this array to eliminate the performance overhead in the I/O hot
path.

The 'tmpbuf' array will be fully initialized when reading data from
device memory.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20250610123709.835102-14-berrange@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 hw/audio/via-ac97.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/audio/via-ac97.c b/hw/audio/via-ac97.c
index 1e0a5c7398..d5231e1cf2 100644
--- a/hw/audio/via-ac97.c
+++ b/hw/audio/via-ac97.c
@@ -175,7 +175,7 @@ static void out_cb(void *opaque, int avail)
     ViaAC97SGDChannel *c = &s->aur;
     int temp, to_copy, copied;
     bool stop = false;
-    uint8_t tmpbuf[4096];
+    QEMU_UNINITIALIZED uint8_t tmpbuf[4096];
 
     if (c->stat & STAT_PAUSED) {
         return;

From 8b1dac1ad57082611419b0e2f347acd96115d25f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 10 Jun 2025 13:36:52 +0100
Subject: [PATCH 1560/2760] hw/char/sclpconsole-lm: skip automatic zero-init of
 large array
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The 'process_mdb' method has a 4k byte array used for copying data
between the guest and the chardev backend. Skip the automatic zero-init
of this array to eliminate the performance overhead in the I/O hot
path.

The 'buffer' array will be selectively initialized when data is converted
between EBCDIC and ASCII.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20250610123709.835102-15-berrange@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 hw/char/sclpconsole-lm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/char/sclpconsole-lm.c b/hw/char/sclpconsole-lm.c
index e9580aacba..3e40d5e434 100644
--- a/hw/char/sclpconsole-lm.c
+++ b/hw/char/sclpconsole-lm.c
@@ -214,7 +214,7 @@ static int process_mdb(SCLPEvent *event, MDBO *mdbo)
 {
     int rc;
     int len;
-    uint8_t buffer[SIZE_BUFFER];
+    QEMU_UNINITIALIZED uint8_t buffer[SIZE_BUFFER];
 
     len = be16_to_cpu(mdbo->length);
     len -= sizeof(mdbo->length) + sizeof(mdbo->type)

From ce14f24611aa0469b464a9512e192b4fd51dca2b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 10 Jun 2025 13:36:53 +0100
Subject: [PATCH 1561/2760] hw/dma/xlnx_csu_dma: skip automatic zero-init of
 large array
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The 'xlnx_csu_dma_src_notify' method has a 4k byte array used for
copying DMA data. Skip the automatic zero-init of this array to
eliminate the performance overhead in the I/O hot path.

The 'buf' array will be fully initialized when data is copied.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20250610123709.835102-16-berrange@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 hw/dma/xlnx_csu_dma.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/dma/xlnx_csu_dma.c b/hw/dma/xlnx_csu_dma.c
index 3db3904d83..d8c7da1a50 100644
--- a/hw/dma/xlnx_csu_dma.c
+++ b/hw/dma/xlnx_csu_dma.c
@@ -287,7 +287,7 @@ static uint32_t xlnx_csu_dma_advance(XlnxCSUDMA *s, uint32_t len)
 static void xlnx_csu_dma_src_notify(void *opaque)
 {
     XlnxCSUDMA *s = XLNX_CSU_DMA(opaque);
-    unsigned char buf[4 * 1024];
+    QEMU_UNINITIALIZED unsigned char buf[4 * 1024];
     size_t rlen = 0;
 
     ptimer_transaction_begin(s->src_timer);

From 7048e70f391df76d009eecca25f8027858f9f304 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 10 Jun 2025 13:36:54 +0100
Subject: [PATCH 1562/2760] hw/display/vmware_vga: skip automatic zero-init of
 large struct
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The 'vmsvga_fifo_run' method has a struct which is a little over 20k
in size, used for holding image data for cursor changes. Skip the
automatic zero-init of this struct to eliminate the performance
overhead in the I/O hot path.

The cursor variable will be fully initialized only when processing
a cursor definition message from the guest.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20250610123709.835102-17-berrange@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 hw/display/vmware_vga.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/display/vmware_vga.c b/hw/display/vmware_vga.c
index 544bb65320..bc1a8ed466 100644
--- a/hw/display/vmware_vga.c
+++ b/hw/display/vmware_vga.c
@@ -618,7 +618,7 @@ static void vmsvga_fifo_run(struct vmsvga_state_s *s)
     uint32_t cmd, colour;
     int args, len, maxloop = 1024;
     int x, y, dx, dy, width, height;
-    struct vmsvga_cursor_definition_s cursor;
+    QEMU_UNINITIALIZED struct vmsvga_cursor_definition_s cursor;
     uint32_t cmd_start;
 
     len = vmsvga_fifo_length(s);

From 5a1f614d0cd0bcc8e84e0b7ab6af63d56bd348a2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 10 Jun 2025 13:36:55 +0100
Subject: [PATCH 1563/2760] hw/hyperv/syndbg: skip automatic zero-init of large
 array
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The 'handle_recv_msg' method has a 4k byte array used for copying
data between the network socket and guest memory. Skip the automatic
zero-init of this array to eliminate the performance overhead in the
I/O hot path.

The 'data_buf' array will be fully initialized when data is read
off the network socket.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20250610123709.835102-18-berrange@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 hw/hyperv/syndbg.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/hyperv/syndbg.c b/hw/hyperv/syndbg.c
index 8b8a14750d..ac7e15f6f1 100644
--- a/hw/hyperv/syndbg.c
+++ b/hw/hyperv/syndbg.c
@@ -192,7 +192,7 @@ static uint16_t handle_recv_msg(HvSynDbg *syndbg, uint64_t outgpa,
 {
     uint16_t ret;
     g_assert(MSG_BUFSZ >= qemu_target_page_size());
-    uint8_t data_buf[MSG_BUFSZ];
+    QEMU_UNINITIALIZED uint8_t data_buf[MSG_BUFSZ];
     hwaddr out_len;
     void *out_data;
     ssize_t recv_byte_count;

From 6992c886838282f36b20deee44b666bbfc573a8f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 10 Jun 2025 13:36:56 +0100
Subject: [PATCH 1564/2760] hw/misc/aspeed_hace: skip automatic zero-init of
 large array
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The 'do_hash_operation' method has a 256 element iovec array used for
holding pointers to data that is to be hashed. Skip the automatic
zero-init of this array to eliminate the performance overhead in the
I/O hot path.

The 'iovec' array will be selectively initialized based on data that
needs to be hashed.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20250610123709.835102-19-berrange@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 hw/misc/aspeed_hace.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/misc/aspeed_hace.c b/hw/misc/aspeed_hace.c
index 8924a30eff..726368fbbc 100644
--- a/hw/misc/aspeed_hace.c
+++ b/hw/misc/aspeed_hace.c
@@ -419,7 +419,7 @@ static void hash_execute_acc_mode(AspeedHACEState *s, int algo,
 static void do_hash_operation(AspeedHACEState *s, int algo, bool sg_mode,
                               bool acc_mode)
 {
-    struct iovec iov[ASPEED_HACE_MAX_SG];
+    QEMU_UNINITIALIZED struct iovec iov[ASPEED_HACE_MAX_SG];
     bool acc_final_request = false;
     int iov_idx = -1;
 

From 3ccc6489dd4925ddd1f3066bd3751389169cd7aa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 10 Jun 2025 13:36:57 +0100
Subject: [PATCH 1565/2760] hw/net/rtl8139: skip automatic zero-init of large
 array
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The 'rtl8139_transmit_one' method has a 8k byte array used for
copying data between guest and host. Skip the automatic zero-init
of this array to eliminate the performance overhead in the I/O
hot path.

The 'txbuffer' will be fully initialized when reading PCI DMA
buffers.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20250610123709.835102-20-berrange@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 hw/net/rtl8139.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/net/rtl8139.c b/hw/net/rtl8139.c
index 15b8f7501a..654a087d80 100644
--- a/hw/net/rtl8139.c
+++ b/hw/net/rtl8139.c
@@ -1816,7 +1816,7 @@ static int rtl8139_transmit_one(RTL8139State *s, int descriptor)
 
     PCIDevice *d = PCI_DEVICE(s);
     int txsize = s->TxStatus[descriptor] & 0x1fff;
-    uint8_t txbuffer[0x2000];
+    QEMU_UNINITIALIZED uint8_t txbuffer[0x2000];
 
     DPRINTF("+++ transmit reading %d bytes from host memory at 0x%08x\n",
         txsize, s->TxAddr[descriptor]);

From e1afd5ee6eb2954f4baf3c97820e4aaf7de97d2a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 10 Jun 2025 13:36:58 +0100
Subject: [PATCH 1566/2760] hw/net/tulip: skip automatic zero-init of large
 array
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The 'tulip_setup_frame' method has a 4k byte array used for copynig
DMA data from the device. Skip the automatic zero-init of this array
to eliminate the performance overhead in the I/O hot path.

The 'buf' array will be fully initialized when reading data from the
device.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20250610123709.835102-21-berrange@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 hw/net/tulip.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/net/tulip.c b/hw/net/tulip.c
index 63fe513458..319af906c8 100644
--- a/hw/net/tulip.c
+++ b/hw/net/tulip.c
@@ -629,7 +629,7 @@ static void tulip_setup_filter_addr(TULIPState *s, uint8_t *buf, int n)
 static void tulip_setup_frame(TULIPState *s,
         struct tulip_descriptor *desc)
 {
-    uint8_t buf[4096];
+    QEMU_UNINITIALIZED uint8_t buf[4096];
     int len = (desc->control >> TDES1_BUF1_SIZE_SHIFT) & TDES1_BUF1_SIZE_MASK;
     int i;
 

From 21cf31c51a7aeff4270c9b30b37e019c536d54b2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 10 Jun 2025 13:36:59 +0100
Subject: [PATCH 1567/2760] hw/net/virtio-net: skip automatic zero-init of
 large arrays
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The 'virtio_net_receive_rcu' method has three arrays with
VIRTQUEUE_MAX_SIZE elements, which are apprixmately 32k in
size used for copying data between guest and host. Skip the
automatic zero-init of these arrays to eliminate the
performance overhead in the I/O hot path.

The three arrays will be selectively initialized as required
when processing network buffers.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20250610123709.835102-22-berrange@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 hw/net/virtio-net.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index 221252e00a..eb93607b8c 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -1911,9 +1911,9 @@ static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
     VirtIONet *n = qemu_get_nic_opaque(nc);
     VirtIONetQueue *q;
     VirtIODevice *vdev = VIRTIO_DEVICE(n);
-    VirtQueueElement *elems[VIRTQUEUE_MAX_SIZE];
-    size_t lens[VIRTQUEUE_MAX_SIZE];
-    struct iovec mhdr_sg[VIRTQUEUE_MAX_SIZE];
+    QEMU_UNINITIALIZED VirtQueueElement *elems[VIRTQUEUE_MAX_SIZE];
+    QEMU_UNINITIALIZED size_t lens[VIRTQUEUE_MAX_SIZE];
+    QEMU_UNINITIALIZED struct iovec mhdr_sg[VIRTQUEUE_MAX_SIZE];
     struct virtio_net_hdr_v1_hash extra_hdr;
     unsigned mhdr_cnt = 0;
     size_t offset, i, guest_offset, j;

From 8b723287b84a62bb5d1a7799ef0959ca8e6c293a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 10 Jun 2025 13:37:00 +0100
Subject: [PATCH 1568/2760] hw/net/xgamc: skip automatic zero-init of large
 array
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The 'xgmac_enet_send' method has a 8k byte array used for copying
data between guest and host. Skip the automatic zero-init of this
array to eliminate the performance overhead in the I/O hot path.

The 'frame' buffer will be fully initialized when reading guest
memory to fetch the data to send.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20250610123709.835102-23-berrange@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 hw/net/xgmac.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/net/xgmac.c b/hw/net/xgmac.c
index 9c87c4e70f..d45f872467 100644
--- a/hw/net/xgmac.c
+++ b/hw/net/xgmac.c
@@ -207,7 +207,7 @@ static void xgmac_enet_send(XgmacState *s)
     struct desc bd;
     int frame_size;
     int len;
-    uint8_t frame[8192];
+    QEMU_UNINITIALIZED uint8_t frame[8192];
     uint8_t *ptr;
 
     ptr = frame;

From 7eeb1d3acc175813ad3d5e824f26123e0992093a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 10 Jun 2025 13:37:01 +0100
Subject: [PATCH 1569/2760] hw/nvme/ctrl: skip automatic zero-init of large
 arrays
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The 'nvme_map_sgl' method has a 256 element array used for copying
data from the device. Skip the automatic zero-init of this array
to eliminate the performance overhead in the I/O hot path.

The 'segment' array will be fully initialized when reading data from
the device.

The 'nme_changed_nslist' method has a 4k byte array that is manually
initialized with memset(). The compiler ought to be intelligent
enough to turn the memset() into a static initialization operation,
and thus not duplicate the automatic zero-init. Replacing memset()
with '{}' makes it unambiguous that the array is statically initialized.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Klaus Jensen <k.jensen@samsung.com>
Message-id: 20250610123709.835102-24-berrange@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 hw/nvme/ctrl.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c
index fd935507bc..220002830d 100644
--- a/hw/nvme/ctrl.c
+++ b/hw/nvme/ctrl.c
@@ -1057,7 +1057,8 @@ static uint16_t nvme_map_sgl(NvmeCtrl *n, NvmeSg *sg, NvmeSglDescriptor sgl,
      */
 #define SEG_CHUNK_SIZE 256
 
-    NvmeSglDescriptor segment[SEG_CHUNK_SIZE], *sgld, *last_sgld;
+    QEMU_UNINITIALIZED NvmeSglDescriptor segment[SEG_CHUNK_SIZE];
+    NvmeSglDescriptor *sgld, *last_sgld;
     uint64_t nsgld;
     uint32_t seg_len;
     uint16_t status;
@@ -5128,7 +5129,7 @@ static uint16_t nvme_error_info(NvmeCtrl *n, uint8_t rae, uint32_t buf_len,
 static uint16_t nvme_changed_nslist(NvmeCtrl *n, uint8_t rae, uint32_t buf_len,
                                     uint64_t off, NvmeRequest *req)
 {
-    uint32_t nslist[1024];
+    uint32_t nslist[1024] = {};
     uint32_t trans_len;
     int i = 0;
     uint32_t nsid;
@@ -5138,7 +5139,6 @@ static uint16_t nvme_changed_nslist(NvmeCtrl *n, uint8_t rae, uint32_t buf_len,
         return NVME_INVALID_FIELD | NVME_DNR;
     }
 
-    memset(nslist, 0x0, sizeof(nslist));
     trans_len = MIN(sizeof(nslist) - off, buf_len);
 
     while ((nsid = find_first_bit(n->changed_nsids, NVME_CHANGED_NSID_SIZE)) !=

From 3438eabaf4f8ae58b6c47f1727938d1d7dac4823 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 10 Jun 2025 13:37:02 +0100
Subject: [PATCH 1570/2760] hw/ppc/pnv_occ: skip automatic zero-init of large
 struct
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The 'occ_model_tick' method has a 12k struct used for copying
data between guest and host. Skip the automatic zero-init of this
struct to eliminate the performance overhead in the I/O hot path.

The 'dynamic_data' buffer will be fully initialized when reading
data from the guest.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Klaus Jensen <k.jensen@samsung.com>
Reviewed-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Message-id: 20250610123709.835102-25-berrange@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 hw/ppc/pnv_occ.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/ppc/pnv_occ.c b/hw/ppc/pnv_occ.c
index fa6f31cb8d..24b789c191 100644
--- a/hw/ppc/pnv_occ.c
+++ b/hw/ppc/pnv_occ.c
@@ -789,7 +789,7 @@ static bool occ_opal_process_command(PnvOCC *occ,
 
 static bool occ_model_tick(PnvOCC *occ)
 {
-    struct occ_dynamic_data dynamic_data;
+    QEMU_UNINITIALIZED struct occ_dynamic_data dynamic_data;
 
     if (!occ_read_dynamic_data(occ, &dynamic_data, NULL)) {
         /* Can't move OCC state field to safe because we can't map it! */

From 5dd9087fff74b5672526cad254e76f790fb35c7a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 10 Jun 2025 13:37:03 +0100
Subject: [PATCH 1571/2760] hw/ppc/spapr_tpm_proxy: skip automatic zero-init of
 large arrays
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The 'tpm_execute' method has a pair of 4k arrays used for copying
data between guest and host. Skip the automatic zero-init of these
arrays to eliminate the performance overhead in the I/O hot path.

The two arrays will be fully initialized when reading data from
guest memory or reading data from the proxy FD.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Klaus Jensen <k.jensen@samsung.com>
Reviewed-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Message-id: 20250610123709.835102-26-berrange@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 hw/ppc/spapr_tpm_proxy.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/ppc/spapr_tpm_proxy.c b/hw/ppc/spapr_tpm_proxy.c
index 862eeaa50a..1297b3ad56 100644
--- a/hw/ppc/spapr_tpm_proxy.c
+++ b/hw/ppc/spapr_tpm_proxy.c
@@ -41,8 +41,8 @@ static ssize_t tpm_execute(SpaprTpmProxy *tpm_proxy, target_ulong *args)
     target_ulong data_in_size = args[2];
     uint64_t data_out = ppc64_phys_to_real(args[3]);
     target_ulong data_out_size = args[4];
-    uint8_t buf_in[TPM_SPAPR_BUFSIZE];
-    uint8_t buf_out[TPM_SPAPR_BUFSIZE];
+    QEMU_UNINITIALIZED uint8_t buf_in[TPM_SPAPR_BUFSIZE];
+    QEMU_UNINITIALIZED uint8_t buf_out[TPM_SPAPR_BUFSIZE];
     ssize_t ret;
 
     trace_spapr_tpm_execute(data_in, data_in_size, data_out, data_out_size);

From 14997d521d1cd0bb36c902ef1032f0d3f2a3c912 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 10 Jun 2025 13:37:04 +0100
Subject: [PATCH 1572/2760] hw/usb/hcd-ohci: skip automatic zero-init of large
 array
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The 'ohci_service_iso_td' method has a 8k byte array used for copying
data between guest and host. Skip the automatic zero-init of this
array to eliminate the performance overhead in the I/O hot path.

The 'buf' array will be fully initialized when reading data from guest
memory.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Klaus Jensen <k.jensen@samsung.com>
Reviewed-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Message-id: 20250610123709.835102-27-berrange@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 hw/usb/hcd-ohci.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/usb/hcd-ohci.c b/hw/usb/hcd-ohci.c
index 71b54914d3..72a9f9f474 100644
--- a/hw/usb/hcd-ohci.c
+++ b/hw/usb/hcd-ohci.c
@@ -577,7 +577,7 @@ static int ohci_service_iso_td(OHCIState *ohci, struct ohci_ed *ed)
     USBDevice *dev;
     USBEndpoint *ep;
     USBPacket *pkt;
-    uint8_t buf[8192];
+    QEMU_UNINITIALIZED uint8_t buf[8192];
     bool int_req;
     struct ohci_iso_td iso_td;
     uint32_t addr;

From 55243edf42ee87bce9f36ca251f3ab9cda1563e4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 10 Jun 2025 13:37:05 +0100
Subject: [PATCH 1573/2760] hw/scsi/lsi53c895a: skip automatic zero-init of
 large array
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The 'lsi_memcpy' method has a 4k byte array used for copying data
to/from the device. Skip the automatic zero-init of this array to
eliminate the performance overhead in the I/O hot path.

The 'buf' array will be fully initialized when data is copied.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Klaus Jensen <k.jensen@samsung.com>
Reviewed-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Message-id: 20250610123709.835102-28-berrange@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 hw/scsi/lsi53c895a.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/scsi/lsi53c895a.c b/hw/scsi/lsi53c895a.c
index f4f2ef321e..9ea4aa0a85 100644
--- a/hw/scsi/lsi53c895a.c
+++ b/hw/scsi/lsi53c895a.c
@@ -1112,7 +1112,7 @@ bad:
 static void lsi_memcpy(LSIState *s, uint32_t dest, uint32_t src, int count)
 {
     int n;
-    uint8_t buf[LSI_BUF_SIZE];
+    QEMU_UNINITIALIZED uint8_t buf[LSI_BUF_SIZE];
 
     trace_lsi_memcpy(dest, src, count);
     while (count) {

From ca0559e2350c618048f7caf80cb79c1259e7cfd2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 10 Jun 2025 13:37:06 +0100
Subject: [PATCH 1574/2760] hw/scsi/megasas: skip automatic zero-init of large
 arrays
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The 'megasas_dcmd_pd_get_list' and 'megasas_dcmd_get_properties'
methods have 4k structs used for copying data from the device.
Skip the automatic zero-init of this array to eliminate the
performance overhead in the I/O hot path.

The 'info' structs are manually initialized with memset(). The
compiler ought to be intelligent enough to turn the memset()
into a static initialization operation, and thus not duplicate
the automatic zero-init. Replacing memset() with '{}' makes it
unambiguous that the arrays are statically initialized.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Klaus Jensen <k.jensen@samsung.com>
Reviewed-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Message-id: 20250610123709.835102-29-berrange@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 hw/scsi/megasas.c | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c
index 55cd188bd5..844643d916 100644
--- a/hw/scsi/megasas.c
+++ b/hw/scsi/megasas.c
@@ -981,13 +981,11 @@ static int megasas_event_wait(MegasasState *s, MegasasCmd *cmd)
 
 static int megasas_dcmd_pd_get_list(MegasasState *s, MegasasCmd *cmd)
 {
-    struct mfi_pd_list info;
-    size_t dcmd_size = sizeof(info);
+    struct mfi_pd_list info = {};
     BusChild *kid;
     uint32_t offset, dcmd_limit, num_pd_disks = 0, max_pd_disks;
     dma_addr_t residual;
 
-    memset(&info, 0, dcmd_size);
     offset = 8;
     dcmd_limit = offset + sizeof(struct mfi_pd_address);
     if (cmd->iov_size < dcmd_limit) {
@@ -1429,11 +1427,10 @@ static int megasas_dcmd_cfg_read(MegasasState *s, MegasasCmd *cmd)
 
 static int megasas_dcmd_get_properties(MegasasState *s, MegasasCmd *cmd)
 {
-    struct mfi_ctrl_props info;
+    struct mfi_ctrl_props info = {};
     size_t dcmd_size = sizeof(info);
     dma_addr_t residual;
 
-    memset(&info, 0x0, dcmd_size);
     if (cmd->iov_size < dcmd_size) {
         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
                                             dcmd_size);

From 7708e298180550eac262c1fd742e6e80c711a5d8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 10 Jun 2025 13:37:07 +0100
Subject: [PATCH 1575/2760] hw/ufs/lu: skip automatic zero-init of large array
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The 'ufs_emulate_scsi_cmd' method has a 4k byte array used for
copying data from the device. Skip the automatic zero-init of
this array to eliminate the performance overhead in the I/O hot
path.

The 'outbuf' array will be fully initialized when data is copied
from the guest.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Klaus Jensen <k.jensen@samsung.com>
Reviewed-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Message-id: 20250610123709.835102-30-berrange@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 hw/ufs/lu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/ufs/lu.c b/hw/ufs/lu.c
index 57b307ea56..2d8ffd72c5 100644
--- a/hw/ufs/lu.c
+++ b/hw/ufs/lu.c
@@ -194,7 +194,7 @@ static int ufs_emulate_wlun_inquiry(UfsRequest *req, uint8_t *outbuf,
 static UfsReqResult ufs_emulate_scsi_cmd(UfsLu *lu, UfsRequest *req)
 {
     uint8_t lun = lu->lun;
-    uint8_t outbuf[4096];
+    QEMU_UNINITIALIZED uint8_t outbuf[4096];
     uint8_t sense_buf[UFS_SENSE_SIZE];
     uint8_t scsi_status;
     int len = 0;

From 751b0e79f1e0e7f88fad2fe2f22595ad03d78859 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 10 Jun 2025 13:37:08 +0100
Subject: [PATCH 1576/2760] net/socket: skip automatic zero-init of large array
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The 'net_socket_send' method has a 68k byte array used for copying
data between guest and host. Skip the automatic zero-init of this
array to eliminate the performance overhead in the I/O hot path.

The 'buf1' array will be fully initialized when reading data off
the network socket.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Klaus Jensen <k.jensen@samsung.com>
Reviewed-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Message-id: 20250610123709.835102-31-berrange@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 net/socket.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/socket.c b/net/socket.c
index 8e3702e1f3..784dda686f 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -157,7 +157,7 @@ static void net_socket_send(void *opaque)
     NetSocketState *s = opaque;
     int size;
     int ret;
-    uint8_t buf1[NET_BUFSIZE];
+    QEMU_UNINITIALIZED uint8_t buf1[NET_BUFSIZE];
     const uint8_t *buf;
 
     size = recv(s->fd, buf1, sizeof(buf1), 0);

From 837b87c4c5ba9ac7a255133c6642b8d578272a70 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 10 Jun 2025 13:37:09 +0100
Subject: [PATCH 1577/2760] net/stream: skip automatic zero-init of large array
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The 'net_stream_send' method has a 68k byte array used for copying
data between guest and host. Skip the automatic zero-init of this
array to eliminate the performance overhead in the I/O hot path.

The 'buf1' array will be fully initialized when reading data off
the network socket.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Klaus Jensen <k.jensen@samsung.com>
Reviewed-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Message-id: 20250610123709.835102-32-berrange@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 net/stream.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/stream.c b/net/stream.c
index 4de5613844..6152d2a05e 100644
--- a/net/stream.c
+++ b/net/stream.c
@@ -148,7 +148,7 @@ static gboolean net_stream_send(QIOChannel *ioc,
     NetStreamState *s = data;
     int size;
     int ret;
-    char buf1[NET_BUFSIZE];
+    QEMU_UNINITIALIZED char buf1[NET_BUFSIZE];
     const char *buf;
 
     size = qio_channel_read(s->ioc, buf1, sizeof(buf1), NULL);

From e372214e663a4370fe064f7867f402eade37357e Mon Sep 17 00:00:00 2001
From: Ethan Chen <ethan84@andestech.com>
Date: Fri, 6 Jun 2025 17:57:28 +0800
Subject: [PATCH 1578/2760] qemu-options.hx: Fix reversed description of icount
 sleep behavior

The documentation for the -icount option incorrectly describes the behavior
of the sleep suboption. Based on the actual implementation and system
behavior, the effects of sleep=on and sleep=off were inadvertently reversed.
This commit updates the description to reflect their intended functionality.

Cc: qemu-stable@nongnu.org
Fixes: fa647905e6ba ("qemu-options.hx: Fix minor issues in icount documentation")
Signed-off-by: Ethan Chen <ethan84@andestech.com>
Message-id: 20250606095728.3672832-1-ethan84@andestech.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 qemu-options.hx | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/qemu-options.hx b/qemu-options.hx
index 7eb8e02b4b..1f862b19a6 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -4936,13 +4936,13 @@ SRST
     with actual performance.
 
     When the virtual cpu is sleeping, the virtual time will advance at
-    default speed unless ``sleep=on`` is specified. With
-    ``sleep=on``, the virtual time will jump to the next timer
+    default speed unless ``sleep=off`` is specified. With
+    ``sleep=off``, the virtual time will jump to the next timer
     deadline instantly whenever the virtual cpu goes to sleep mode and
     will not advance if no timer is enabled. This behavior gives
     deterministic execution times from the guest point of view.
-    The default if icount is enabled is ``sleep=off``.
-    ``sleep=on`` cannot be used together with either ``shift=auto``
+    The default if icount is enabled is ``sleep=on``.
+    ``sleep=off`` cannot be used together with either ``shift=auto``
     or ``align=on``.
 
     ``align=on`` will activate the delay algorithm which will try to

From bedcc7465db867841a4c76e5a3aab8a7d51f22aa Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Date: Sat, 31 May 2025 21:11:06 +0900
Subject: [PATCH 1579/2760] target/arm: Define raw write for PMU CLR registers

Raw writes to PMCNTENCLR and PMCNTENCLR_EL0 incorrectly used their
default write function, which clears written bits instead of writes the
raw value.

PMINTENCLR and PMINTENCLR_EL1 are similar registers, but they instead
had ARM_CP_NO_RAW. Commit 7a0e58fa6487 ("target-arm: Split NO_MIGRATE
into ALIAS and NO_RAW") sugguests ARM_CP_ALIAS should be used instead of
ARM_CP_NO_RAW in such a case:

> We currently mark ARM coprocessor/system register definitions with
> the flag ARM_CP_NO_MIGRATE for two different reasons:
> 1) register is an alias on to state that's also visible via
>    some other register, and that other register is the one
>    responsible for migrating the state
> 2) register is not actually state at all (for instance the TLB
>    or cache maintenance operation "registers") and it makes no
>    sense to attempt to migrate it or otherwise access the raw state
>
> This works fine for identifying which registers should be ignored
> when performing migration, but we also use the same functions for
> synchronizing system register state between QEMU and the kernel
> when using KVM. In this case we don't want to try to sync state
> into registers in category 2, but we do want to sync into registers
> in category 1, because the kernel might have picked a different
> one of the aliases as its choice for which one to expose for
> migration.

These registers fall in category 1 (ARM_CP_ALIAS), not category 2
(ARM_CP_NO_RAW).

ARM_CP_NO_RAW also has another undesired side effect that hides
registers from GDB.

Properly set raw write functions and drop the ARM_CP_NO_RAW flag from
PMINTENCLR and PMINTENCLR_EL1; this fixes GDB/KVM state synchronization
of PMCNTENCLR and PMCNTENCLR_EL0, and exposes all these four registers
to GDB.

It is not necessary to add ARM_CP_ALIAS to these registers because the
flag is already set.

Signed-off-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Message-id: 20250531-clr-v3-1-377f9bf1746d@rsg.ci.i.u-tokyo.ac.jp
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index 7631210287..889d308807 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -1904,7 +1904,7 @@ static const ARMCPRegInfo v7_cp_reginfo[] = {
       .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmcnten),
       .accessfn = pmreg_access,
       .fgt = FGT_PMCNTEN,
-      .writefn = pmcntenclr_write,
+      .writefn = pmcntenclr_write, .raw_writefn = raw_write,
       .type = ARM_CP_ALIAS | ARM_CP_IO },
     { .name = "PMCNTENCLR_EL0", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 2,
@@ -1912,7 +1912,7 @@ static const ARMCPRegInfo v7_cp_reginfo[] = {
       .fgt = FGT_PMCNTEN,
       .type = ARM_CP_ALIAS | ARM_CP_IO,
       .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcnten),
-      .writefn = pmcntenclr_write },
+      .writefn = pmcntenclr_write, .raw_writefn = raw_write },
     { .name = "PMOVSR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 3,
       .access = PL0_RW, .type = ARM_CP_IO,
       .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmovsr),
@@ -2029,16 +2029,16 @@ static const ARMCPRegInfo v7_cp_reginfo[] = {
     { .name = "PMINTENCLR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 2,
       .access = PL1_RW, .accessfn = access_tpm,
       .fgt = FGT_PMINTEN,
-      .type = ARM_CP_ALIAS | ARM_CP_IO | ARM_CP_NO_RAW,
+      .type = ARM_CP_ALIAS | ARM_CP_IO,
       .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
-      .writefn = pmintenclr_write, },
+      .writefn = pmintenclr_write, .raw_writefn = raw_write },
     { .name = "PMINTENCLR_EL1", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 2,
       .access = PL1_RW, .accessfn = access_tpm,
       .fgt = FGT_PMINTEN,
-      .type = ARM_CP_ALIAS | ARM_CP_IO | ARM_CP_NO_RAW,
+      .type = ARM_CP_ALIAS | ARM_CP_IO,
       .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
-      .writefn = pmintenclr_write },
+      .writefn = pmintenclr_write, .raw_writefn = raw_write },
     { .name = "CCSIDR", .state = ARM_CP_STATE_BOTH,
       .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = 0,
       .access = PL1_R,

From 73cdd846adb80060fbdb2f2557aeafb41cb39064 Mon Sep 17 00:00:00 2001
From: Souleymane Conte <conte.souleymane@gmail.com>
Date: Mon, 9 Jun 2025 13:51:24 +0000
Subject: [PATCH 1580/2760] docs/interop: convert qed_spec.txt to
 reStructuredText format

Convert the qed_spec.txt file to reStructuredText and
include it in the manual.

buglink: https://gitlab.com/qemu-project/qemu/-/issues/527
Signed-off-by: Souleymane Conte <conte.souleymane@gmail.com>
Message-id: 20250609135124.45078-1-conte.souleymane@gmail.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: adjusted position of doc in the table of contents;
 bulked up commit message; added file to MAINTAINERS section
 for QED; made 'Consistency checking' a higher level section;
 fixed one preexisting grammar nit (s/by from/from/)]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 MAINTAINERS               |   1 +
 docs/interop/index.rst    |   1 +
 docs/interop/qed_spec.rst | 219 ++++++++++++++++++++++++++++++++++++++
 docs/interop/qed_spec.txt | 138 ------------------------
 4 files changed, 221 insertions(+), 138 deletions(-)
 create mode 100644 docs/interop/qed_spec.rst
 delete mode 100644 docs/interop/qed_spec.txt

diff --git a/MAINTAINERS b/MAINTAINERS
index 84cfef835e..94c4076127 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -4117,6 +4117,7 @@ M: Stefan Hajnoczi <stefanha@redhat.com>
 L: qemu-block@nongnu.org
 S: Supported
 F: block/qed.c
+F: docs/interop/qed_spec.rst
 
 raw
 M: Kevin Wolf <kwolf@redhat.com>
diff --git a/docs/interop/index.rst b/docs/interop/index.rst
index 4b951ae416..972f3e49ce 100644
--- a/docs/interop/index.rst
+++ b/docs/interop/index.rst
@@ -18,6 +18,7 @@ are useful for making QEMU interoperate with other software.
    parallels
    prl-xml
    qcow2
+   qed_spec
    pr-helper
    qmp-spec
    qemu-ga
diff --git a/docs/interop/qed_spec.rst b/docs/interop/qed_spec.rst
new file mode 100644
index 0000000000..cd6c7d9005
--- /dev/null
+++ b/docs/interop/qed_spec.rst
@@ -0,0 +1,219 @@
+===================================
+QED Image File Format Specification
+===================================
+
+The file format looks like this::
+
+ +----------+----------+----------+-----+
+ | cluster0 | cluster1 | cluster2 | ... |
+ +----------+----------+----------+-----+
+
+The first cluster begins with the ``header``. The header contains information
+about where regular clusters start; this allows the header to be extensible and
+store extra information about the image file. A regular cluster may be
+a ``data cluster``, an ``L2``, or an ``L1 table``. L1 and L2 tables are composed
+of one or more contiguous clusters.
+
+Normally the file size will be a multiple of the cluster size.  If the file size
+is not a multiple, extra information after the last cluster may not be preserved
+if data is written. Legitimate extra information should use space between the header
+and the first regular cluster.
+
+All fields are little-endian.
+
+Header
+------
+
+::
+
+  Header {
+     uint32_t magic;               /* QED\0 */
+
+     uint32_t cluster_size;        /* in bytes */
+     uint32_t table_size;          /* for L1 and L2 tables, in clusters */
+     uint32_t header_size;         /* in clusters */
+
+     uint64_t features;            /* format feature bits */
+     uint64_t compat_features;     /* compat feature bits */
+     uint64_t autoclear_features;  /* self-resetting feature bits */
+
+     uint64_t l1_table_offset;     /* in bytes */
+     uint64_t image_size;          /* total logical image size, in bytes */
+
+     /* if (features & QED_F_BACKING_FILE) */
+     uint32_t backing_filename_offset; /* in bytes from start of header */
+     uint32_t backing_filename_size;   /* in bytes */
+  }
+
+Field descriptions:
+~~~~~~~~~~~~~~~~~~~
+
+- ``cluster_size`` must be a power of 2 in range [2^12, 2^26].
+- ``table_size`` must be a power of 2 in range [1, 16].
+- ``header_size`` is the number of clusters used by the header and any additional
+  information stored before regular clusters.
+- ``features``, ``compat_features``, and ``autoclear_features`` are file format
+  extension bitmaps. They work as follows:
+
+  - An image with unknown ``features`` bits enabled must not be opened. File format
+    changes that are not backwards-compatible must use ``features`` bits.
+  - An image with unknown ``compat_features`` bits enabled can be opened safely.
+    The unknown features are simply ignored and represent backwards-compatible
+    changes to the file format.
+  - An image with unknown ``autoclear_features`` bits enable can be opened safely
+    after clearing the unknown bits. This allows for backwards-compatible changes
+    to the file format which degrade gracefully and can be re-enabled again by a
+    new program later.
+- ``l1_table_offset`` is the offset of the first byte of the L1 table in the image
+  file and must be a multiple of ``cluster_size``.
+- ``image_size`` is the block device size seen by the guest and must be a multiple
+  of 512 bytes.
+- ``backing_filename_offset`` and ``backing_filename_size`` describe a string in
+  (byte offset, byte size) form. It is not NUL-terminated and has no alignment constraints.
+  The string must be stored within the first ``header_size`` clusters. The backing filename
+  may be an absolute path or relative to the image file.
+
+Feature bits:
+~~~~~~~~~~~~~
+
+- ``QED_F_BACKING_FILE = 0x01``. The image uses a backing file.
+- ``QED_F_NEED_CHECK = 0x02``. The image needs a consistency check before use.
+- ``QED_F_BACKING_FORMAT_NO_PROBE = 0x04``. The backing file is a raw disk image
+  and no file format autodetection should be attempted.  This should be used to
+  ensure that raw backing files are never detected as an image format if they happen
+  to contain magic constants.
+
+There are currently no defined ``compat_features`` or ``autoclear_features`` bits.
+
+Fields predicated on a feature bit are only used when that feature is set.
+The fields always take up header space, regardless of whether or not the feature
+bit is set.
+
+Tables
+------
+
+Tables provide the translation from logical offsets in the block device to cluster
+offsets in the file.
+
+::
+
+ #define TABLE_NOFFSETS (table_size * cluster_size / sizeof(uint64_t))
+
+ Table {
+     uint64_t offsets[TABLE_NOFFSETS];
+ }
+
+The tables are organized as follows::
+
+                    +----------+
+                    | L1 table |
+                    +----------+
+               ,------'  |  '------.
+          +----------+   |    +----------+
+          | L2 table |  ...   | L2 table |
+          +----------+        +----------+
+      ,------'  |  '------.
+ +----------+   |    +----------+
+ |   Data   |  ...   |   Data   |
+ +----------+        +----------+
+
+A table is made up of one or more contiguous clusters.  The ``table_size`` header
+field determines table size for an image file. For example, ``cluster_size=64 KB``
+and ``table_size=4`` results in 256 KB tables.
+
+The logical image size must be less than or equal to the maximum possible size of
+clusters rooted by the L1 table:
+
+.. code::
+
+ header.image_size <= TABLE_NOFFSETS * TABLE_NOFFSETS * header.cluster_size
+
+L1, L2, and data cluster offsets must be aligned to ``header.cluster_size``.
+The following offsets have special meanings:
+
+L2 table offsets
+~~~~~~~~~~~~~~~~
+
+- 0 - unallocated. The L2 table is not yet allocated.
+
+Data cluster offsets
+~~~~~~~~~~~~~~~~~~~~
+
+- 0 - unallocated.  The data cluster is not yet allocated.
+- 1 - zero. The data cluster contents are all zeroes and no cluster is allocated.
+
+Future format extensions may wish to store per-offset information. The least
+significant 12 bits of an offset are reserved for this purpose and must be set
+to zero. Image files with ``cluster_size`` > 2^12 will have more unused bits
+which should also be zeroed.
+
+Unallocated L2 tables and data clusters
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Reads to an unallocated area of the image file access the backing file. If there
+is no backing file, then zeroes are produced. The backing file may be smaller
+than the image file and reads of unallocated areas beyond the end of the backing
+file produce zeroes.
+
+Writes to an unallocated area cause a new data clusters to be allocated, and a new
+L2 table if that is also unallocated. The new data cluster is populated with data
+from the backing file (or zeroes if no backing file) and the data being written.
+
+Zero data clusters
+~~~~~~~~~~~~~~~~~~
+
+Zero data clusters are a space-efficient way of storing zeroed regions of the image.
+
+Reads to a zero data cluster produce zeroes.
+
+.. note::
+    The difference between an unallocated and a zero data cluster is that zero data
+    clusters stop the reading of contents from the backing file.
+
+Writes to a zero data cluster cause a new data cluster to be allocated.  The new
+data cluster is populated with zeroes and the data being written.
+
+Logical offset translation
+~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Logical offsets are translated into cluster offsets as follows::
+
+  table_bits table_bits    cluster_bits
+  <--------> <--------> <--------------->
+ +----------+----------+-----------------+
+ | L1 index | L2 index |     byte offset |
+ +----------+----------+-----------------+
+
+       Structure of a logical offset
+
+ offset_mask = ~(cluster_size - 1) # mask for the image file byte offset
+
+ def logical_to_cluster_offset(l1_index, l2_index, byte_offset):
+   l2_offset = l1_table[l1_index]
+   l2_table = load_table(l2_offset)
+   cluster_offset = l2_table[l2_index] & offset_mask
+   return cluster_offset + byte_offset
+
+Consistency checking
+--------------------
+
+This section is informational and included to provide background on the use
+of the ``QED_F_NEED_CHECK features`` bit.
+
+The ``QED_F_NEED_CHECK`` bit is used to mark an image as dirty before starting
+an operation that could leave the image in an inconsistent state if interrupted
+by a crash or power failure.  A dirty image must be checked on open because its
+metadata may not be consistent.
+
+Consistency check includes the following invariants:
+
+- Each cluster is referenced once and only once. It is an inconsistency to have
+  a cluster referenced more than once by L1 or L2 tables. A cluster has been leaked
+  if it has no references.
+- Offsets must be within the image file size and must be ``cluster_size`` aligned.
+- Table offsets must at least ``table_size`` * ``cluster_size`` bytes from the end
+  of the image file so that there is space for the entire table.
+
+The consistency check process starts from ``l1_table_offset`` and scans all L2 tables.
+After the check completes with no other errors besides leaks, the ``QED_F_NEED_CHECK``
+bit can be cleared and the image can be accessed.
diff --git a/docs/interop/qed_spec.txt b/docs/interop/qed_spec.txt
deleted file mode 100644
index 7982e058b2..0000000000
--- a/docs/interop/qed_spec.txt
+++ /dev/null
@@ -1,138 +0,0 @@
-=Specification=
-
-The file format looks like this:
-
- +----------+----------+----------+-----+
- | cluster0 | cluster1 | cluster2 | ... |
- +----------+----------+----------+-----+
-
-The first cluster begins with the '''header'''.  The header contains information about where regular clusters start; this allows the header to be extensible and store extra information about the image file.  A regular cluster may be a '''data cluster''', an '''L2''', or an '''L1 table'''.  L1 and L2 tables are composed of one or more contiguous clusters.
-
-Normally the file size will be a multiple of the cluster size.  If the file size is not a multiple, extra information after the last cluster may not be preserved if data is written.  Legitimate extra information should use space between the header and the first regular cluster.
-
-All fields are little-endian.
-
-==Header==
- Header {
-     uint32_t magic;               /* QED\0 */
- 
-     uint32_t cluster_size;        /* in bytes */
-     uint32_t table_size;          /* for L1 and L2 tables, in clusters */
-     uint32_t header_size;         /* in clusters */
- 
-     uint64_t features;            /* format feature bits */
-     uint64_t compat_features;     /* compat feature bits */
-     uint64_t autoclear_features;  /* self-resetting feature bits */
-
-     uint64_t l1_table_offset;     /* in bytes */
-     uint64_t image_size;          /* total logical image size, in bytes */
- 
-     /* if (features & QED_F_BACKING_FILE) */
-     uint32_t backing_filename_offset; /* in bytes from start of header */
-     uint32_t backing_filename_size;   /* in bytes */
- }
-
-Field descriptions:
-* ''cluster_size'' must be a power of 2 in range [2^12, 2^26].
-* ''table_size'' must be a power of 2 in range [1, 16].
-* ''header_size'' is the number of clusters used by the header and any additional information stored before regular clusters.
-* ''features'', ''compat_features'', and ''autoclear_features'' are file format extension bitmaps.  They work as follows:
-** An image with unknown ''features'' bits enabled must not be opened.  File format changes that are not backwards-compatible must use ''features'' bits.
-** An image with unknown ''compat_features'' bits enabled can be opened safely.  The unknown features are simply ignored and represent backwards-compatible changes to the file format.
-** An image with unknown ''autoclear_features'' bits enable can be opened safely after clearing the unknown bits.  This allows for backwards-compatible changes to the file format which degrade gracefully and can be re-enabled again by a new program later.
-* ''l1_table_offset'' is the offset of the first byte of the L1 table in the image file and must be a multiple of ''cluster_size''.
-* ''image_size'' is the block device size seen by the guest and must be a multiple of 512 bytes.
-* ''backing_filename_offset'' and ''backing_filename_size'' describe a string in (byte offset, byte size) form.  It is not NUL-terminated and has no alignment constraints.  The string must be stored within the first ''header_size'' clusters.  The backing filename may be an absolute path or relative to the image file.
-
-Feature bits:
-* QED_F_BACKING_FILE = 0x01.  The image uses a backing file.
-* QED_F_NEED_CHECK = 0x02.  The image needs a consistency check before use.
-* QED_F_BACKING_FORMAT_NO_PROBE = 0x04.  The backing file is a raw disk image and no file format autodetection should be attempted.  This should be used to ensure that raw backing files are never detected as an image format if they happen to contain magic constants.
-
-There are currently no defined ''compat_features'' or ''autoclear_features'' bits.
-
-Fields predicated on a feature bit are only used when that feature is set.  The fields always take up header space, regardless of whether or not the feature bit is set.
-
-==Tables==
-
-Tables provide the translation from logical offsets in the block device to cluster offsets in the file.
-
- #define TABLE_NOFFSETS (table_size * cluster_size / sizeof(uint64_t))
-  
- Table {
-     uint64_t offsets[TABLE_NOFFSETS];
- }
-
-The tables are organized as follows:
-
-                    +----------+
-                    | L1 table |
-                    +----------+
-               ,------'  |  '------.
-          +----------+   |    +----------+
-          | L2 table |  ...   | L2 table |
-          +----------+        +----------+
-      ,------'  |  '------.
- +----------+   |    +----------+
- |   Data   |  ...   |   Data   |
- +----------+        +----------+
-
-A table is made up of one or more contiguous clusters.  The table_size header field determines table size for an image file.  For example, cluster_size=64 KB and table_size=4 results in 256 KB tables.
-
-The logical image size must be less than or equal to the maximum possible size of clusters rooted by the L1 table:
- header.image_size <= TABLE_NOFFSETS * TABLE_NOFFSETS * header.cluster_size
-
-L1, L2, and data cluster offsets must be aligned to header.cluster_size.  The following offsets have special meanings:
-
-===L2 table offsets===
-* 0 - unallocated.  The L2 table is not yet allocated.
-
-===Data cluster offsets===
-* 0 - unallocated.  The data cluster is not yet allocated.
-* 1 - zero.  The data cluster contents are all zeroes and no cluster is allocated.
-
-Future format extensions may wish to store per-offset information.  The least significant 12 bits of an offset are reserved for this purpose and must be set to zero.  Image files with cluster_size > 2^12 will have more unused bits which should also be zeroed.
-
-===Unallocated L2 tables and data clusters===
-Reads to an unallocated area of the image file access the backing file.  If there is no backing file, then zeroes are produced.  The backing file may be smaller than the image file and reads of unallocated areas beyond the end of the backing file produce zeroes.
-
-Writes to an unallocated area cause a new data clusters to be allocated, and a new L2 table if that is also unallocated.  The new data cluster is populated with data from the backing file (or zeroes if no backing file) and the data being written.
-
-===Zero data clusters===
-Zero data clusters are a space-efficient way of storing zeroed regions of the image.
-
-Reads to a zero data cluster produce zeroes.  Note that the difference between an unallocated and a zero data cluster is that zero data clusters stop the reading of contents from the backing file.
-
-Writes to a zero data cluster cause a new data cluster to be allocated.  The new data cluster is populated with zeroes and the data being written.
-
-===Logical offset translation===
-Logical offsets are translated into cluster offsets as follows:
-
-  table_bits table_bits    cluster_bits
-  <--------> <--------> <--------------->
- +----------+----------+-----------------+
- | L1 index | L2 index |     byte offset |
- +----------+----------+-----------------+
- 
-       Structure of a logical offset
-
- offset_mask = ~(cluster_size - 1) # mask for the image file byte offset
- 
- def logical_to_cluster_offset(l1_index, l2_index, byte_offset):
-   l2_offset = l1_table[l1_index]
-   l2_table = load_table(l2_offset)
-   cluster_offset = l2_table[l2_index] & offset_mask
-   return cluster_offset + byte_offset
-
-==Consistency checking==
-
-This section is informational and included to provide background on the use of the QED_F_NEED_CHECK ''features'' bit.
-
-The QED_F_NEED_CHECK bit is used to mark an image as dirty before starting an operation that could leave the image in an inconsistent state if interrupted by a crash or power failure.  A dirty image must be checked on open because its metadata may not be consistent.
-
-Consistency check includes the following invariants:
-# Each cluster is referenced once and only once.  It is an inconsistency to have a cluster referenced more than once by L1 or L2 tables.  A cluster has been leaked if it has no references.
-# Offsets must be within the image file size and must be ''cluster_size'' aligned.
-# Table offsets must at least ''table_size'' * ''cluster_size'' bytes from the end of the image file so that there is space for the entire table.
-
-The consistency check process starts by from ''l1_table_offset'' and scans all L2 tables.  After the check completes with no other errors besides leaks, the QED_F_NEED_CHECK bit can be cleared and the image can be accessed.

From 5dc8e4e892ba10e040d12afece0d36b8b6a269d6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cl=C3=A9ment=20Chigot?= <chigot@adacore.com>
Date: Mon, 26 May 2025 10:55:20 +0200
Subject: [PATCH 1581/2760] hw/arm: make cpu targeted by arm_load_kernel the
 primary CPU.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Currently, arm booting processus assumes that the first_cpu is the CPU
that will boot: `arm_load_kernel` is powering off all but the `first_cpu`;
`do_cpu_reset` is setting the loader address only for this `first_cpu`.

For most of the boards, this isn't an issue as the kernel is loaded and
booted on the first CPU anyway. However, for zynqmp, the option
"boot-cpu" allows to choose any CPUs.

Create a new arm_boot_info entry `primary_cpu` recording which CPU will
be boot first. This one is set when `arm_boot_kernel` is called.

Signed-off-by: Clément Chigot <chigot@adacore.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20250526085523.809003-2-chigot@adacore.com
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/boot.c         | 15 +++++++--------
 include/hw/arm/boot.h |  3 +++
 2 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index 79afb51b8a..3c93d87985 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -744,7 +744,7 @@ static void do_cpu_reset(void *opaque)
             } else {
                 if (arm_feature(env, ARM_FEATURE_EL3) &&
                     (info->secure_boot ||
-                     (info->secure_board_setup && cs == first_cpu))) {
+                     (info->secure_board_setup && cpu == info->primary_cpu))) {
                     /* Start this CPU in Secure SVC */
                     target_el = 3;
                 }
@@ -752,7 +752,7 @@ static void do_cpu_reset(void *opaque)
 
             arm_emulate_firmware_reset(cs, target_el);
 
-            if (cs == first_cpu) {
+            if (cpu == info->primary_cpu) {
                 AddressSpace *as = arm_boot_address_space(cpu, info);
 
                 cpu_set_pc(cs, info->loader_start);
@@ -1239,6 +1239,9 @@ void arm_load_kernel(ARMCPU *cpu, MachineState *ms, struct arm_boot_info *info)
     info->dtb_filename = ms->dtb;
     info->dtb_limit = 0;
 
+    /* We assume the CPU passed as argument is the primary CPU.  */
+    info->primary_cpu = cpu;
+
     /* Load the kernel.  */
     if (!info->kernel_filename || info->firmware_loaded) {
         arm_setup_firmware_boot(cpu, info);
@@ -1288,12 +1291,8 @@ void arm_load_kernel(ARMCPU *cpu, MachineState *ms, struct arm_boot_info *info)
 
             object_property_set_int(cpuobj, "psci-conduit", info->psci_conduit,
                                     &error_abort);
-            /*
-             * Secondary CPUs start in PSCI powered-down state. Like the
-             * code in do_cpu_reset(), we assume first_cpu is the primary
-             * CPU.
-             */
-            if (cs != first_cpu) {
+            /* Secondary CPUs start in PSCI powered-down state.  */
+            if (ARM_CPU(cs) != info->primary_cpu) {
                 object_property_set_bool(cpuobj, "start-powered-off", true,
                                          &error_abort);
             }
diff --git a/include/hw/arm/boot.h b/include/hw/arm/boot.h
index b12bf61ca8..a2e22bda8a 100644
--- a/include/hw/arm/boot.h
+++ b/include/hw/arm/boot.h
@@ -132,6 +132,9 @@ struct arm_boot_info {
     bool secure_board_setup;
 
     arm_endianness endianness;
+
+    /* CPU having load the kernel and that should be the first to boot.  */
+    ARMCPU *primary_cpu;
 };
 
 /**

From 6559e7ad8e535b70e34c79076e6cb6c09d626d0d Mon Sep 17 00:00:00 2001
From: Frederic Konrad <konrad.frederic@yahoo.fr>
Date: Mon, 26 May 2025 10:55:21 +0200
Subject: [PATCH 1582/2760] hw/intc/arm_gic: introduce a first-cpu-index
 property
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This introduces a first-cpu-index property to the arm-gic, as some SOCs
could have two separate GIC (ie: the zynqmp).

Signed-off-by: Clément Chigot <chigot@adacore.com>
Message-id: 20250526085523.809003-3-chigot@adacore.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: slightly expanded comment documenting GIC property]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/intc/arm_gic.c                | 2 +-
 hw/intc/arm_gic_common.c         | 1 +
 include/hw/intc/arm_gic.h        | 3 +++
 include/hw/intc/arm_gic_common.h | 2 ++
 4 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/hw/intc/arm_gic.c b/hw/intc/arm_gic.c
index d18bef40fc..899f133363 100644
--- a/hw/intc/arm_gic.c
+++ b/hw/intc/arm_gic.c
@@ -59,7 +59,7 @@ static const uint8_t gic_id_gicv2[] = {
 static inline int gic_get_current_cpu(GICState *s)
 {
     if (!qtest_enabled() && s->num_cpu > 1) {
-        return current_cpu->cpu_index;
+        return current_cpu->cpu_index - s->first_cpu_index;
     }
     return 0;
 }
diff --git a/hw/intc/arm_gic_common.c b/hw/intc/arm_gic_common.c
index 0f0c48d89a..ed5be05645 100644
--- a/hw/intc/arm_gic_common.c
+++ b/hw/intc/arm_gic_common.c
@@ -350,6 +350,7 @@ static void arm_gic_common_linux_init(ARMLinuxBootIf *obj,
 
 static const Property arm_gic_common_properties[] = {
     DEFINE_PROP_UINT32("num-cpu", GICState, num_cpu, 1),
+    DEFINE_PROP_UINT32("first-cpu-index", GICState, first_cpu_index, 0),
     DEFINE_PROP_UINT32("num-irq", GICState, num_irq, 32),
     /* Revision can be 1 or 2 for GIC architecture specification
      * versions 1 or 2, or 0 to indicate the legacy 11MPCore GIC.
diff --git a/include/hw/intc/arm_gic.h b/include/hw/intc/arm_gic.h
index 48f6a51a70..be923f7ed8 100644
--- a/include/hw/intc/arm_gic.h
+++ b/include/hw/intc/arm_gic.h
@@ -27,6 +27,9 @@
  *    implement the security extensions
  *  + QOM property "has-virtualization-extensions": set true if the GIC should
  *    implement the virtualization extensions
+ *  + QOM property "first-cpu-index": index of the first cpu attached to the
+ *    GIC (default 0). The CPUs connected to the GIC are assumed to be
+ *    first-cpu-index, first-cpu-index + 1, ... first-cpu-index + num-cpu - 1.
  *  + unnamed GPIO inputs: (where P is number of SPIs, i.e. num-irq - 32)
  *    [0..P-1]  SPIs
  *    [P..P+31] PPIs for CPU 0
diff --git a/include/hw/intc/arm_gic_common.h b/include/hw/intc/arm_gic_common.h
index 97fea4102d..93a3cc2bf8 100644
--- a/include/hw/intc/arm_gic_common.h
+++ b/include/hw/intc/arm_gic_common.h
@@ -129,6 +129,8 @@ struct GICState {
     uint32_t num_lrs;
 
     uint32_t num_cpu;
+    /* cpu_index of the first CPU, attached to this GIC.  */
+    uint32_t first_cpu_index;
 
     MemoryRegion iomem; /* Distributor */
     /* This is just so we can have an opaque pointer which identifies

From cd38e638c43e4d5d3fd65dd4529c2e6153c9c408 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Thu, 5 Jun 2025 15:18:01 +0100
Subject: [PATCH 1583/2760] hw/arm/mps2: Configure the AN500 CPU with 16 MPU
 regions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The AN500 application note documents that it configures the Cortex-M7
CPU to have 16 MPU regions. We weren't doing this in our emulation,
so the CPU had only the default 8 MPU regions. Set the mpu-ns-regions
property to 16 for this board.

This bug doesn't affect any of the other board types we model in
this source file, because they all use either the Cortex-M3 or
Cortex-M4. Those CPUs do not have an RTL configurable number of
MPU regions, and always provide 8 regions if the MPU is built in.

Cc: qemu-stable@nongnu.org
Reported-by: Corentin GENDRE <cocotroupe20@gmail.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20250605141801.1083266-1-peter.maydell@linaro.org
---
 hw/arm/mps2.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/hw/arm/mps2.c b/hw/arm/mps2.c
index 58efb41e6d..bd378e360b 100644
--- a/hw/arm/mps2.c
+++ b/hw/arm/mps2.c
@@ -224,7 +224,11 @@ static void mps2_common_init(MachineState *machine)
     switch (mmc->fpga_type) {
     case FPGA_AN385:
     case FPGA_AN386:
+        qdev_prop_set_uint32(armv7m, "num-irq", 32);
+        break;
     case FPGA_AN500:
+        /* The AN500 configures its Cortex-M7 with 16 MPU regions */
+        qdev_prop_set_uint32(armv7m, "mpu-ns-regions", 16);
         qdev_prop_set_uint32(armv7m, "num-irq", 32);
         break;
     case FPGA_AN511:

From 5ad2b1f443a96444cf3e7a2fbe17aae696201012 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=2E=20Neusch=C3=A4fer?= <j.neuschaefer@gmx.net>
Date: Fri, 13 Jun 2025 17:59:32 +0200
Subject: [PATCH 1584/2760] linux-user/arm: Fix return value of SYS_cacheflush
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Although the emulated cacheflush syscall does nothing, it still needs to
return zero to indicate success.

Cc: qemu-stable@nongnu.org
Signed-off-by: J. Neuschäfer <j.neuschaefer@gmx.net>
Message-id: 20250613-cache-v1-1-ee9f4a9ba81b@gmx.net
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 linux-user/arm/cpu_loop.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/linux-user/arm/cpu_loop.c b/linux-user/arm/cpu_loop.c
index e8417d0406..33f63951a9 100644
--- a/linux-user/arm/cpu_loop.c
+++ b/linux-user/arm/cpu_loop.c
@@ -363,6 +363,7 @@ void cpu_loop(CPUARMState *env)
                     switch (n) {
                     case ARM_NR_cacheflush:
                         /* nop */
+                        env->regs[0] = 0;
                         break;
                     case ARM_NR_set_tls:
                         cpu_set_tls(env, env->regs[0]);

From 9761ad5f65d23f080b5a3479e52196fbce2e1506 Mon Sep 17 00:00:00 2001
From: oltolm <oleg.tolmatcev@gmail.com>
Date: Fri, 13 Jun 2025 00:15:22 +0200
Subject: [PATCH 1585/2760] meson: fix Windows build
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The build fails on Windows. Replace calls to Unix programs like ´cat´,
´sed´ and ´true´ with calls to ´python´ and wrap calls to
´os.path.relpath´ in try-except because it can fail when the two paths
are on different drives. Make sure to convert the Windows paths to Unix
paths to prevent warnings in generated files.

Signed-off-by: oltolm <oleg.tolmatcev@gmail.com>
Message-id: 20250612221521.1109-2-oleg.tolmatcev@gmail.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 contrib/plugins/meson.build         |  2 +-
 plugins/meson.build                 |  2 +-
 scripts/tracetool/__init__.py       | 15 ++++++++++++---
 scripts/tracetool/backend/ftrace.py |  4 +---
 scripts/tracetool/backend/log.py    |  4 +---
 scripts/tracetool/backend/syslog.py |  4 +---
 tests/functional/meson.build        |  2 +-
 tests/include/meson.build           |  2 +-
 tests/tcg/plugins/meson.build       |  2 +-
 trace/meson.build                   |  5 +++--
 10 files changed, 23 insertions(+), 19 deletions(-)

diff --git a/contrib/plugins/meson.build b/contrib/plugins/meson.build
index fa8a426c8b..1876bc7843 100644
--- a/contrib/plugins/meson.build
+++ b/contrib/plugins/meson.build
@@ -24,7 +24,7 @@ endif
 if t.length() > 0
   alias_target('contrib-plugins', t)
 else
-  run_target('contrib-plugins', command: find_program('true'))
+  run_target('contrib-plugins', command: [python, '-c', ''])
 endif
 
 plugin_modules += t
diff --git a/plugins/meson.build b/plugins/meson.build
index b20edfbabc..62c991d87f 100644
--- a/plugins/meson.build
+++ b/plugins/meson.build
@@ -33,7 +33,7 @@ if host_os == 'windows'
     input: qemu_plugin_symbols,
     output: 'qemu_plugin_api.def',
     capture: true,
-    command: ['sed', '-e', '0,/^/s//EXPORTS/; s/[{};]//g', '@INPUT@'])
+    command: [python, '-c', 'import fileinput, re; print("EXPORTS", end=""); [print(re.sub(r"[{};]", "", line), end="") for line in fileinput.input()]', '@INPUT@'])
 
   # then use dlltool to assemble a delaylib.
   # The delaylib will have an "imaginary" name (qemu.exe), that is used by the
diff --git a/scripts/tracetool/__init__.py b/scripts/tracetool/__init__.py
index bc03238c0f..6dfcbf71e1 100644
--- a/scripts/tracetool/__init__.py
+++ b/scripts/tracetool/__init__.py
@@ -12,12 +12,14 @@ __maintainer__ = "Stefan Hajnoczi"
 __email__      = "stefanha@redhat.com"
 
 
+import os
 import re
 import sys
 import weakref
+from pathlib import PurePath
 
-import tracetool.format
 import tracetool.backend
+import tracetool.format
 
 
 def error_write(*lines):
@@ -36,7 +38,7 @@ out_fobj = sys.stdout
 
 def out_open(filename):
     global out_filename, out_fobj
-    out_filename = filename
+    out_filename = posix_relpath(filename)
     out_fobj = open(filename, 'wt')
 
 def out(*lines, **kwargs):
@@ -308,7 +310,7 @@ class Event(object):
             fmt = [fmt_trans, fmt]
         args = Arguments.build(groups["args"])
 
-        return Event(name, props, fmt, args, lineno, filename)
+        return Event(name, props, fmt, args, lineno, posix_relpath(filename))
 
     def __repr__(self):
         """Evaluable string representation for this object."""
@@ -447,3 +449,10 @@ def generate(events, group, format, backends,
     tracetool.backend.dtrace.PROBEPREFIX = probe_prefix
 
     tracetool.format.generate(events, format, backend, group)
+
+def posix_relpath(path, start=None):
+    try:
+        path = os.path.relpath(path, start)
+    except ValueError:
+        pass
+    return PurePath(path).as_posix()
diff --git a/scripts/tracetool/backend/ftrace.py b/scripts/tracetool/backend/ftrace.py
index baed2ae61c..5fa30ccc08 100644
--- a/scripts/tracetool/backend/ftrace.py
+++ b/scripts/tracetool/backend/ftrace.py
@@ -12,8 +12,6 @@ __maintainer__ = "Stefan Hajnoczi"
 __email__      = "stefanha@redhat.com"
 
 
-import os.path
-
 from tracetool import out
 
 
@@ -47,7 +45,7 @@ def generate_h(event, group):
         args=event.args,
         event_id="TRACE_" + event.name.upper(),
         event_lineno=event.lineno,
-        event_filename=os.path.relpath(event.filename),
+        event_filename=event.filename,
         fmt=event.fmt.rstrip("\n"),
         argnames=argnames)
 
diff --git a/scripts/tracetool/backend/log.py b/scripts/tracetool/backend/log.py
index de27b7e62e..17ba1cd90e 100644
--- a/scripts/tracetool/backend/log.py
+++ b/scripts/tracetool/backend/log.py
@@ -12,8 +12,6 @@ __maintainer__ = "Stefan Hajnoczi"
 __email__      = "stefanha@redhat.com"
 
 
-import os.path
-
 from tracetool import out
 
 
@@ -55,7 +53,7 @@ def generate_h(event, group):
         '    }',
         cond=cond,
         event_lineno=event.lineno,
-        event_filename=os.path.relpath(event.filename),
+        event_filename=event.filename,
         name=event.name,
         fmt=event.fmt.rstrip("\n"),
         argnames=argnames)
diff --git a/scripts/tracetool/backend/syslog.py b/scripts/tracetool/backend/syslog.py
index 012970f6cc..5a3a00fe31 100644
--- a/scripts/tracetool/backend/syslog.py
+++ b/scripts/tracetool/backend/syslog.py
@@ -12,8 +12,6 @@ __maintainer__ = "Stefan Hajnoczi"
 __email__      = "stefanha@redhat.com"
 
 
-import os.path
-
 from tracetool import out
 
 
@@ -43,7 +41,7 @@ def generate_h(event, group):
         '    }',
         cond=cond,
         event_lineno=event.lineno,
-        event_filename=os.path.relpath(event.filename),
+        event_filename=event.filename,
         name=event.name,
         fmt=event.fmt.rstrip("\n"),
         argnames=argnames)
diff --git a/tests/functional/meson.build b/tests/functional/meson.build
index 7faa2b6e3c..158a473c15 100644
--- a/tests/functional/meson.build
+++ b/tests/functional/meson.build
@@ -416,4 +416,4 @@ endforeach
 
 run_target('precache-functional',
            depends: precache_all,
-           command: ['true'])
+           command: [python, '-c', ''])
diff --git a/tests/include/meson.build b/tests/include/meson.build
index 9abba308fa..8e8d1ec4e6 100644
--- a/tests/include/meson.build
+++ b/tests/include/meson.build
@@ -13,4 +13,4 @@ test_qapi_outputs_extra = [
 test_qapi_files_extra = custom_target('QAPI test (include)',
                                       output: test_qapi_outputs_extra,
                                       input: test_qapi_files,
-                                      command: 'true')
+                                      command: [python, '-c', ''])
diff --git a/tests/tcg/plugins/meson.build b/tests/tcg/plugins/meson.build
index 41f02f2c7f..029342282a 100644
--- a/tests/tcg/plugins/meson.build
+++ b/tests/tcg/plugins/meson.build
@@ -17,7 +17,7 @@ endif
 if t.length() > 0
   alias_target('test-plugins', t)
 else
-  run_target('test-plugins', command: find_program('true'))
+  run_target('test-plugins', command: [python, '-c', ''])
 endif
 
 plugin_modules += t
diff --git a/trace/meson.build b/trace/meson.build
index 3df4549355..9c42a57a05 100644
--- a/trace/meson.build
+++ b/trace/meson.build
@@ -4,7 +4,7 @@ trace_events_files = []
 foreach item : [ '.' ] + trace_events_subdirs + qapi_trace_events
   if item in qapi_trace_events
     trace_events_file = item
-    group_name = item.full_path().split('/')[-1].underscorify()
+    group_name = fs.name(item).underscorify()
   else
     trace_events_file = meson.project_source_root() / item / 'trace-events'
     group_name = item == '.' ? 'root' : item.underscorify()
@@ -57,10 +57,11 @@ foreach item : [ '.' ] + trace_events_subdirs + qapi_trace_events
   endif
 endforeach
 
+cat = [ python, '-c', 'import fileinput; [print(line, end="") for line in fileinput.input()]', '@INPUT@' ]
 trace_events_all = custom_target('trace-events-all',
                                  output: 'trace-events-all',
                                  input: trace_events_files,
-                                 command: [ 'cat', '@INPUT@' ],
+                                 command: cat,
                                  capture: true,
                                  install: get_option('trace_backends') != [ 'nop' ],
                                  install_dir: qemu_datadir)

From 9a02932b059613f7c4bea273677811561a9237ff Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Mon, 9 Jun 2025 12:58:54 +0200
Subject: [PATCH 1586/2760] meson: cleanup win32 library detection

As pointed out by Akihiko Odaki, all Win32 libraries in MinGW have lowercase
names.  This means that on (case-insensitive) Windows you can use the mixed-case
names suggested by Microsoft or all-lowercase names, while on Linux you need to
make them lowercase.

QEMU was already using lowercase names, so there is no need to test the
mixed-case name version of libSynchronization.  Remove the unnecessary test
and while at it make all the tests use "required: true".

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 meson.build | 13 +++++--------
 1 file changed, 5 insertions(+), 8 deletions(-)

diff --git a/meson.build b/meson.build
index 34729c2a3d..ed60be2a2d 100644
--- a/meson.build
+++ b/meson.build
@@ -843,15 +843,12 @@ host_dsosuf = '.so'
 if host_os == 'windows'
   midl = find_program('midl', required: false)
   widl = find_program('widl', required: false)
-  pathcch = cc.find_library('pathcch')
-  synchronization = cc.find_library('Synchronization', required: false)
-  if not synchronization.found()
-    # The library name is lowercase on mingw
-    synchronization = cc.find_library('synchronization', required: true)
-  endif
 
-  socket = cc.find_library('ws2_32')
-  winmm = cc.find_library('winmm')
+  # MinGW uses lowercase for library names
+  pathcch = cc.find_library('pathcch', required: true)
+  synchronization = cc.find_library('synchronization', required: true)
+  socket = cc.find_library('ws2_32', required: true)
+  winmm = cc.find_library('winmm', required: true)
 
   win = import('windows')
   version_res = win.compile_resources('version.rc',

From 0f1d6606c28d0ae81a1b311972c5c54e5e867bf0 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Date: Wed, 11 Jun 2025 14:03:15 +0100
Subject: [PATCH 1587/2760] target/i386: fix TB exit logic in gen_movl_seg()
 when writing to SS

Before commit e54ef98c8a ("target/i386: do not trigger IRQ shadow for LSS"), any
write to SS in gen_movl_seg() would cause a TB exit. The changes introduced by
this commit were intended to restrict the DISAS_EOB_INHIBIT_IRQ exit to the case
where inhibit_irq is true, but missed that a DISAS_EOB_NEXT exit can still be
required when writing to SS and inhibit_irq is false.

Comparing the PE(s) && !VM86(s) section with the logic in x86_update_hflags(), we
can see that the DISAS_EOB_NEXT exit is still required for the !CODE32 case when
writing to SS in gen_movl_seg() because any change to the SS flags can affect
hflags. Similarly we can see that the existing CODE32 case is still correct since
a change to any of DS, ES and SS can affect hflags. Finally for the
gen_op_movl_seg_real() case an explicit TB exit is not needed because the segment
register selector does not affect hflags.

Update the logic in gen_movl_seg() so that a write to SS with inhibit_irq set to
false where PE(s) && !VM86(s) will generate a DISAS_EOB_NEXT exit along with the
inline comment. This has the effect of allowing Win98SE to boot in QEMU once
again.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Fixes: e54ef98c8a ("target/i386: do not trigger IRQ shadow for LSS")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2987
Link: https://lore.kernel.org/r/20250611130315.383151-1-mark.cave-ayland@ilande.co.uk
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/tcg/translate.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
index 0fcddc2ec0..0cb87d0201 100644
--- a/target/i386/tcg/translate.c
+++ b/target/i386/tcg/translate.c
@@ -2033,8 +2033,11 @@ static void gen_movl_seg(DisasContext *s, X86Seg seg_reg, TCGv src, bool inhibit
         tcg_gen_trunc_tl_i32(sel, src);
         gen_helper_load_seg(tcg_env, tcg_constant_i32(seg_reg), sel);
 
-        /* For move to DS/ES/SS, the addseg or ss32 flags may change.  */
-        if (CODE32(s) && seg_reg < R_FS) {
+        /*
+         * For moves to SS, the SS32 flag may change. For CODE32 only, changes
+         * to SS, DS and ES may change the ADDSEG flags.
+         */
+        if (seg_reg == R_SS || (CODE32(s) && seg_reg < R_FS)) {
             s->base.is_jmp = DISAS_EOB_NEXT;
         }
     } else {

From 5d353cce65142440251c014331c2f25f3af5e1b2 Mon Sep 17 00:00:00 2001
From: Bernhard Beschow <shentey@gmail.com>
Date: Tue, 10 Jun 2025 22:41:27 +0200
Subject: [PATCH 1588/2760] hw: Fix type constant for DTB files

Commit fcb1ad456c58 ("system/datadir: Add new type constant for DTB files")
introduced a new type constant for DTB files and converted the boards with
bundled device trees to use it. Convert the other boards for consistency.

Fixes: fcb1ad456c58 ("system/datadir: Add new type constant for DTB files")
Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Link: https://lore.kernel.org/r/20250610204131.2862-2-shentey@gmail.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/arm/boot.c | 2 +-
 hw/ppc/e500.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index 79afb51b8a..64040504a1 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -527,7 +527,7 @@ int arm_load_dtb(hwaddr addr, const struct arm_boot_info *binfo,
 
     if (binfo->dtb_filename) {
         char *filename;
-        filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, binfo->dtb_filename);
+        filename = qemu_find_file(QEMU_FILE_TYPE_DTB, binfo->dtb_filename);
         if (!filename) {
             fprintf(stderr, "Couldn't open dtb file %s\n", binfo->dtb_filename);
             goto fail;
diff --git a/hw/ppc/e500.c b/hw/ppc/e500.c
index 6899802bed..723c97fad2 100644
--- a/hw/ppc/e500.c
+++ b/hw/ppc/e500.c
@@ -408,7 +408,7 @@ static int ppce500_load_device_tree(PPCE500MachineState *pms,
 
     if (dtb_file) {
         char *filename;
-        filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, dtb_file);
+        filename = qemu_find_file(QEMU_FILE_TYPE_DTB, dtb_file);
         if (!filename) {
             goto out;
         }

From 6c2888dd0f9b7129943d53cacd6a7b7143a65cfb Mon Sep 17 00:00:00 2001
From: Bernhard Beschow <shentey@gmail.com>
Date: Tue, 10 Jun 2025 22:41:28 +0200
Subject: [PATCH 1589/2760] pc-bios/dtb/meson: Prefer target name to be
 outfile, not infile

Makes this custom_target() usage consistent with other ones in QEMU.

Fixes: 6e0dc9d2a88a ("meson: compile bundled device trees")
Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Link: https://lore.kernel.org/r/20250610204131.2862-3-shentey@gmail.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 pc-bios/dtb/meson.build | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pc-bios/dtb/meson.build b/pc-bios/dtb/meson.build
index 7a71835bca..993032949f 100644
--- a/pc-bios/dtb/meson.build
+++ b/pc-bios/dtb/meson.build
@@ -9,7 +9,7 @@ dtc = find_program('dtc', required: false)
 if dtc.found()
   foreach out : dtbs
     f = fs.replace_suffix(out, '.dts')
-    custom_target(f,
+    custom_target(out,
         build_by_default: have_system,
         input: files(f),
         output: out,

From abf18324240a3c8f3feafbe5a96d4b83cd044615 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 28 Feb 2025 09:41:42 +0100
Subject: [PATCH 1590/2760] rust: qemu_api: introduce MaybeUninit field
 projection

Add a macro that makes it possible to convert a MaybeUninit<> into
another MaybeUninit<> for a single field within it.  Furthermore, it is
possible to use the resulting MaybeUninitField<> in APIs that take the
parent object, such as memory_region_init_io().

This allows removing some of the undefined behavior from instance_init()
functions, though this may not be the definitive implementation.

Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/qemu-api/meson.build   |  1 +
 rust/qemu-api/src/lib.rs    |  1 +
 rust/qemu-api/src/uninit.rs | 85 +++++++++++++++++++++++++++++++++++++
 3 files changed, 87 insertions(+)
 create mode 100644 rust/qemu-api/src/uninit.rs

diff --git a/rust/qemu-api/meson.build b/rust/qemu-api/meson.build
index cac8595a14..33653b4a28 100644
--- a/rust/qemu-api/meson.build
+++ b/rust/qemu-api/meson.build
@@ -28,6 +28,7 @@ _qemu_api_rs = static_library(
       'src/qom.rs',
       'src/sysbus.rs',
       'src/timer.rs',
+      'src/uninit.rs',
       'src/vmstate.rs',
       'src/zeroable.rs',
     ],
diff --git a/rust/qemu-api/src/lib.rs b/rust/qemu-api/src/lib.rs
index 93902fc94b..c78198f0f4 100644
--- a/rust/qemu-api/src/lib.rs
+++ b/rust/qemu-api/src/lib.rs
@@ -27,6 +27,7 @@ pub mod qdev;
 pub mod qom;
 pub mod sysbus;
 pub mod timer;
+pub mod uninit;
 pub mod vmstate;
 pub mod zeroable;
 
diff --git a/rust/qemu-api/src/uninit.rs b/rust/qemu-api/src/uninit.rs
new file mode 100644
index 0000000000..04123b4ae9
--- /dev/null
+++ b/rust/qemu-api/src/uninit.rs
@@ -0,0 +1,85 @@
+//! Access fields of a [`MaybeUninit`]
+
+use std::{
+    mem::MaybeUninit,
+    ops::{Deref, DerefMut},
+};
+
+pub struct MaybeUninitField<'a, T, U> {
+    parent: &'a mut MaybeUninit<T>,
+    child: *mut U,
+}
+
+impl<'a, T, U> MaybeUninitField<'a, T, U> {
+    #[doc(hidden)]
+    pub fn new(parent: &'a mut MaybeUninit<T>, child: *mut U) -> Self {
+        MaybeUninitField { parent, child }
+    }
+
+    /// Return a constant pointer to the containing object of the field.
+    ///
+    /// Because the `MaybeUninitField` remembers the containing object,
+    /// it is possible to use it in foreign APIs that initialize the
+    /// child.
+    pub fn parent(f: &Self) -> *const T {
+        f.parent.as_ptr()
+    }
+
+    /// Return a mutable pointer to the containing object.
+    ///
+    /// Because the `MaybeUninitField` remembers the containing object,
+    /// it is possible to use it in foreign APIs that initialize the
+    /// child.
+    pub fn parent_mut(f: &mut Self) -> *mut T {
+        f.parent.as_mut_ptr()
+    }
+}
+
+impl<'a, T, U> Deref for MaybeUninitField<'a, T, U> {
+    type Target = MaybeUninit<U>;
+
+    fn deref(&self) -> &MaybeUninit<U> {
+        // SAFETY: self.child was obtained by dereferencing a valid mutable
+        // reference; the content of the memory may be invalid or uninitialized
+        // but MaybeUninit<_> makes no assumption on it
+        unsafe { &*(self.child.cast()) }
+    }
+}
+
+impl<'a, T, U> DerefMut for MaybeUninitField<'a, T, U> {
+    fn deref_mut(&mut self) -> &mut MaybeUninit<U> {
+        // SAFETY: self.child was obtained by dereferencing a valid mutable
+        // reference; the content of the memory may be invalid or uninitialized
+        // but MaybeUninit<_> makes no assumption on it
+        unsafe { &mut *(self.child.cast()) }
+    }
+}
+
+/// ```
+/// #[derive(Debug)]
+/// struct S {
+///     x: u32,
+///     y: u32,
+/// }
+///
+/// # use std::mem::MaybeUninit;
+/// # use qemu_api::{assert_match, uninit_field_mut};
+///
+/// let mut s: MaybeUninit<S> = MaybeUninit::zeroed();
+/// uninit_field_mut!(s, x).write(5);
+/// let s = unsafe { s.assume_init() };
+/// assert_match!(s, S { x: 5, y: 0 });
+/// ```
+#[macro_export]
+macro_rules! uninit_field_mut {
+    ($container:expr, $($field:tt)+) => {{
+        let container__: &mut ::std::mem::MaybeUninit<_> = &mut $container;
+        let container_ptr__ = container__.as_mut_ptr();
+
+        // SAFETY: the container is not used directly, only through a MaybeUninit<>,
+        // so the safety is delegated to the caller and to final invocation of
+        // assume_init()
+        let target__ = unsafe { std::ptr::addr_of_mut!((*container_ptr__).$($field)+) };
+        $crate::uninit::MaybeUninitField::new(container__, target__)
+    }};
+}

From eb64a0c6ae492f8ef37f31c9d4994bfc69f02e3d Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Tue, 15 Apr 2025 13:13:19 +0200
Subject: [PATCH 1591/2760] rust: hpet: fully initialize object during
 instance_init

The array of BqlRefCell<HPETTimer> is not initialized yet at the
end of instance_init.  In particular, the "state" field is NonNull
and therefore it is invalid to have it as zero bytes.

Note that MaybeUninit is necessary because assigning to self.timers[index]
would trigger Drop of the old value.

Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/hw/timer/hpet/src/device.rs | 42 +++++++++++++++++++-------------
 1 file changed, 25 insertions(+), 17 deletions(-)

diff --git a/rust/hw/timer/hpet/src/device.rs b/rust/hw/timer/hpet/src/device.rs
index 735b2fbef7..340ca1d355 100644
--- a/rust/hw/timer/hpet/src/device.rs
+++ b/rust/hw/timer/hpet/src/device.rs
@@ -4,6 +4,7 @@
 
 use std::{
     ffi::{c_int, c_void, CStr},
+    mem::MaybeUninit,
     pin::Pin,
     ptr::{addr_of_mut, null_mut, NonNull},
     slice::from_ref,
@@ -25,6 +26,7 @@ use qemu_api::{
     qom_isa,
     sysbus::{SysBusDevice, SysBusDeviceImpl},
     timer::{Timer, CLOCK_VIRTUAL, NANOSECONDS_PER_SECOND},
+    uninit_field_mut,
     vmstate::VMStateDescription,
     vmstate_fields, vmstate_of, vmstate_struct, vmstate_subsections, vmstate_validate,
     zeroable::Zeroable,
@@ -212,13 +214,13 @@ pub struct HPETTimer {
 }
 
 impl HPETTimer {
-    fn init(&mut self, index: u8, state: &HPETState) {
-        *self = HPETTimer {
+    fn new(index: u8, state: *const HPETState) -> HPETTimer {
+        HPETTimer {
             index,
             // SAFETY: the HPETTimer will only be used after the timer
             // is initialized below.
             qemu_timer: unsafe { Timer::new() },
-            state: NonNull::new((state as *const HPETState).cast_mut()).unwrap(),
+            state: NonNull::new(state.cast_mut()).unwrap(),
             config: 0,
             cmp: 0,
             fsb: 0,
@@ -226,19 +228,15 @@ impl HPETTimer {
             period: 0,
             wrap_flag: 0,
             last: 0,
-        };
+        }
+    }
 
+    fn init_timer_with_cell(cell: &BqlRefCell<Self>) {
+        let mut timer = cell.borrow_mut();
         // SAFETY: HPETTimer is only used as part of HPETState, which is
         // always pinned.
-        let qemu_timer = unsafe { Pin::new_unchecked(&mut self.qemu_timer) };
-        qemu_timer.init_full(
-            None,
-            CLOCK_VIRTUAL,
-            Timer::NS,
-            0,
-            timer_handler,
-            &state.timers[self.index as usize],
-        )
+        let qemu_timer = unsafe { Pin::new_unchecked(&mut timer.qemu_timer) };
+        qemu_timer.init_full(None, CLOCK_VIRTUAL, Timer::NS, 0, timer_handler, cell);
     }
 
     fn get_state(&self) -> &HPETState {
@@ -607,9 +605,18 @@ impl HPETState {
         }
     }
 
-    fn init_timer(&self) {
-        for (index, timer) in self.timers.iter().enumerate() {
-            timer.borrow_mut().init(index.try_into().unwrap(), self);
+    fn init_timers(this: &mut MaybeUninit<Self>) {
+        let state = this.as_ptr();
+        for index in 0..HPET_MAX_TIMERS {
+            let mut timer = uninit_field_mut!(*this, timers[index]);
+
+            // Initialize in two steps, to avoid calling Timer::init_full on a
+            // temporary that can be moved.
+            let timer = timer.write(BqlRefCell::new(HPETTimer::new(
+                index.try_into().unwrap(),
+                state,
+            )));
+            HPETTimer::init_timer_with_cell(timer);
         }
     }
 
@@ -710,6 +717,8 @@ impl HPETState {
             "hpet",
             HPET_REG_SPACE_LEN,
         );
+
+        Self::init_timers(unsafe { &mut *((self as *mut Self).cast::<MaybeUninit<Self>>()) });
     }
 
     fn post_init(&self) {
@@ -731,7 +740,6 @@ impl HPETState {
 
         self.hpet_id.set(HPETFwConfig::assign_hpet_id()?);
 
-        self.init_timer();
         // 64-bit General Capabilities and ID Register; LegacyReplacementRoute.
         self.capability.set(
             HPET_CAP_REV_ID_VALUE << HPET_CAP_REV_ID_SHIFT |

From a44122258328a33aaa776c21277e6d4f98ab3d1f Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 28 Feb 2025 09:40:30 +0100
Subject: [PATCH 1592/2760] rust: qom: introduce ParentInit

This is a smart pointer for MaybeUninit; it can be upcasted to the
already-initialized parent classes, or dereferenced to a MaybeUninit
for the class that is being initialized.

Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/qemu-api/src/qom.rs | 96 +++++++++++++++++++++++++++++++++++++++-
 1 file changed, 95 insertions(+), 1 deletion(-)

diff --git a/rust/qemu-api/src/qom.rs b/rust/qemu-api/src/qom.rs
index 14f98fee60..ef966e570c 100644
--- a/rust/qemu-api/src/qom.rs
+++ b/rust/qemu-api/src/qom.rs
@@ -95,7 +95,7 @@
 use std::{
     ffi::{c_void, CStr},
     fmt,
-    mem::ManuallyDrop,
+    mem::{ManuallyDrop, MaybeUninit},
     ops::{Deref, DerefMut},
     ptr::NonNull,
 };
@@ -206,6 +206,100 @@ impl<T: fmt::Display + ObjectType> fmt::Display for ParentField<T> {
     }
 }
 
+/// This struct knows that the superclasses of the object have already been
+/// initialized.
+pub struct ParentInit<'a, T>(&'a mut MaybeUninit<T>);
+
+impl<'a, T> ParentInit<'a, T> {
+    #[inline]
+    pub fn with(obj: &'a mut MaybeUninit<T>, f: impl FnOnce(ParentInit<'a, T>)) {
+        let parent_init = ParentInit(obj);
+        f(parent_init)
+    }
+}
+
+impl<T: ObjectType> ParentInit<'_, T> {
+    /// Return the receiver as a mutable raw pointer to Object.
+    ///
+    /// # Safety
+    ///
+    /// Fields beyond `Object` could be uninitialized and it's your
+    /// responsibility to avoid that they're used when the pointer is
+    /// dereferenced, either directly or through a cast.
+    pub fn as_object_mut_ptr(&self) -> *mut bindings::Object {
+        self.as_object_ptr().cast_mut()
+    }
+
+    /// Return the receiver as a mutable raw pointer to Object.
+    ///
+    /// # Safety
+    ///
+    /// Fields beyond `Object` could be uninitialized and it's your
+    /// responsibility to avoid that they're used when the pointer is
+    /// dereferenced, either directly or through a cast.
+    pub fn as_object_ptr(&self) -> *const bindings::Object {
+        self.0.as_ptr().cast()
+    }
+}
+
+impl<'a, T: ObjectImpl> ParentInit<'a, T> {
+    /// Convert from a derived type to one of its parent types, which
+    /// have already been initialized.
+    ///
+    /// # Safety
+    ///
+    /// Structurally this is always a safe operation; the [`IsA`] trait
+    /// provides static verification trait that `Self` dereferences to `U` or
+    /// a child of `U`, and only parent types of `T` are allowed.
+    ///
+    /// However, while the fields of the resulting reference are initialized,
+    /// calls might use uninitialized fields of the subclass.  It is your
+    /// responsibility to avoid this.
+    pub unsafe fn upcast<U: ObjectType>(&self) -> &'a U
+    where
+        T::ParentType: IsA<U>,
+    {
+        // SAFETY: soundness is declared via IsA<U>, which is an unsafe trait;
+        // the parent has been initialized before `instance_init `is called
+        unsafe { &*(self.0.as_ptr().cast::<U>()) }
+    }
+
+    /// Convert from a derived type to one of its parent types, which
+    /// have already been initialized.
+    ///
+    /// # Safety
+    ///
+    /// Structurally this is always a safe operation; the [`IsA`] trait
+    /// provides static verification trait that `Self` dereferences to `U` or
+    /// a child of `U`, and only parent types of `T` are allowed.
+    ///
+    /// However, while the fields of the resulting reference are initialized,
+    /// calls might use uninitialized fields of the subclass.  It is your
+    /// responsibility to avoid this.
+    pub unsafe fn upcast_mut<U: ObjectType>(&mut self) -> &'a mut U
+    where
+        T::ParentType: IsA<U>,
+    {
+        // SAFETY: soundness is declared via IsA<U>, which is an unsafe trait;
+        // the parent has been initialized before `instance_init `is called
+        unsafe { &mut *(self.0.as_mut_ptr().cast::<U>()) }
+    }
+}
+
+impl<T> Deref for ParentInit<'_, T> {
+    type Target = MaybeUninit<T>;
+
+    fn deref(&self) -> &Self::Target {
+        self.0
+    }
+}
+
+impl<T> DerefMut for ParentInit<'_, T> {
+    fn deref_mut(&mut self) -> &mut Self::Target {
+        self.0
+    }
+}
+
 unsafe extern "C" fn rust_instance_init<T: ObjectImpl>(obj: *mut bindings::Object) {
     let mut state = NonNull::new(obj).unwrap().cast::<T>();
     // SAFETY: obj is an instance of T, since rust_instance_init<T>

From 8d394f6cf0b50a82758b651e81a18dac13e70e7d Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 28 Feb 2025 10:20:48 +0100
Subject: [PATCH 1593/2760] rust: qom: make ParentInit lifetime-invariant

This is the trick that allows the parent-field initializer to be used
only for the object that it's meant to be initialized.  This way,
the owner of a MemoryRegion must be the object that embeds it.

More information is in the comments; it's best explained with a simplified
example.

Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/qemu-api/src/qom.rs | 89 ++++++++++++++++++++++++++++++++++++++--
 1 file changed, 85 insertions(+), 4 deletions(-)

diff --git a/rust/qemu-api/src/qom.rs b/rust/qemu-api/src/qom.rs
index ef966e570c..04d102591d 100644
--- a/rust/qemu-api/src/qom.rs
+++ b/rust/qemu-api/src/qom.rs
@@ -95,6 +95,7 @@
 use std::{
     ffi::{c_void, CStr},
     fmt,
+    marker::PhantomData,
     mem::{ManuallyDrop, MaybeUninit},
     ops::{Deref, DerefMut},
     ptr::NonNull,
@@ -208,12 +209,92 @@ impl<T: fmt::Display + ObjectType> fmt::Display for ParentField<T> {
 
 /// This struct knows that the superclasses of the object have already been
 /// initialized.
-pub struct ParentInit<'a, T>(&'a mut MaybeUninit<T>);
+///
+/// The declaration of `ParentInit` is.. *"a kind of magic"*.  It uses a
+/// technique that is found in several crates, the main ones probably being
+/// `ghost-cell` (in fact it was introduced by the [`GhostCell` paper](https://plv.mpi-sws.org/rustbelt/ghostcell/))
+/// and `generativity`.
+///
+/// The `PhantomData` makes the `ParentInit` type *invariant* with respect to
+/// the lifetime argument `'init`.  This, together with the `for<'...>` in
+/// `[ParentInit::with]`, block any attempt of the compiler to be creative when
+/// operating on types of type `ParentInit` and to extend their lifetimes.  In
+/// particular, it ensures that the `ParentInit` cannot be made to outlive the
+/// `rust_instance_init()` function that creates it, and therefore that the
+/// `&'init T` reference is valid.
+///
+/// This implementation of the same concept, without the QOM baggage, can help
+/// understanding the effect:
+///
+/// ```
+/// use std::marker::PhantomData;
+///
+/// #[derive(PartialEq, Eq)]
+/// pub struct Jail<'closure, T: Copy>(&'closure T, PhantomData<fn(&'closure ()) -> &'closure ()>);
+///
+/// impl<'closure, T: Copy> Jail<'closure, T> {
+///     fn get(&self) -> T {
+///         *self.0
+///     }
+///
+///     #[inline]
+///     fn with<U>(v: T, f: impl for<'id> FnOnce(Jail<'id, T>) -> U) -> U {
+///         let parent_init = Jail(&v, PhantomData);
+///         f(parent_init)
+///     }
+/// }
+/// ```
+///
+/// It's impossible to escape the `Jail`; `token1` cannot be moved out of the
+/// closure:
+///
+/// ```ignore
+/// let x = 42;
+/// let escape = Jail::with(&x, |token1| {
+///     println!("{}", token1.get());
+///     // fails to compile...
+///     token1
+/// });
+/// // ... so you cannot do this:
+/// println!("{}", escape.get());
+/// ```
+///
+/// Likewise, in the QOM case the `ParentInit` cannot be moved out of
+/// `instance_init()`. Without this trick it would be possible to stash a
+/// `ParentInit` and use it later to access uninitialized memory.
+///
+/// Here is another example, showing how separately-created "identities" stay
+/// isolated:
+///
+/// ```ignore
+/// impl<'closure, T: Copy> Clone for Jail<'closure, T> {
+///     fn clone(&self) -> Jail<'closure, T> {
+///         Jail(self.0, PhantomData)
+///     }
+/// }
+///
+/// fn main() {
+///     Jail::with(42, |token1| {
+///         // this works and returns true: the clone has the same "identity"
+///         println!("{}", token1 == token1.clone());
+///         Jail::with(42, |token2| {
+///             // here the outer token remains accessible...
+///             println!("{}", token1.get());
+///             // ... but the two are separate: this fails to compile:
+///             println!("{}", token1 == token2);
+///         });
+///     });
+/// }
+/// ```
+pub struct ParentInit<'init, T>(
+    &'init mut MaybeUninit<T>,
+    PhantomData<fn(&'init ()) -> &'init ()>,
+);
 
-impl<'a, T> ParentInit<'a, T> {
+impl<'init, T> ParentInit<'init, T> {
     #[inline]
-    pub fn with(obj: &'a mut MaybeUninit<T>, f: impl FnOnce(ParentInit<'a, T>)) {
-        let parent_init = ParentInit(obj);
+    pub fn with(obj: &'init mut MaybeUninit<T>, f: impl for<'id> FnOnce(ParentInit<'id, T>)) {
+        let parent_init = ParentInit(obj, PhantomData);
         f(parent_init)
     }
 }

From 345bef46a1b6765185bfe1450cc147f5feb5d0e7 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Tue, 4 Mar 2025 20:48:05 +0100
Subject: [PATCH 1594/2760] rust: qom: change instance_init to take a
 ParentInit<>

This removes undefined behavior associated to writing to uninitialized
fields, and makes it possible to remove "unsafe" from the instance_init
implementation.

However, the init function itself is still unsafe, because it must promise
(as a sort as MaybeUninit::assume_init) that all fields have been
initialized.

Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/hw/char/pl011/src/device.rs | 34 ++++++++++------------
 rust/hw/timer/hpet/src/device.rs | 16 ++++-------
 rust/qemu-api/src/memory.rs      | 12 ++++----
 rust/qemu-api/src/qdev.rs        | 49 +++++++++++++++++++-------------
 rust/qemu-api/src/qom.rs         |  9 ++++--
 5 files changed, 63 insertions(+), 57 deletions(-)

diff --git a/rust/hw/char/pl011/src/device.rs b/rust/hw/char/pl011/src/device.rs
index be8387f6f2..2d416cd9a3 100644
--- a/rust/hw/char/pl011/src/device.rs
+++ b/rust/hw/char/pl011/src/device.rs
@@ -2,7 +2,7 @@
 // Author(s): Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
 // SPDX-License-Identifier: GPL-2.0-or-later
 
-use std::{ffi::CStr, mem::size_of, ptr::addr_of_mut};
+use std::{ffi::CStr, mem::size_of};
 
 use qemu_api::{
     chardev::{CharBackend, Chardev, Event},
@@ -11,9 +11,10 @@ use qemu_api::{
     memory::{hwaddr, MemoryRegion, MemoryRegionOps, MemoryRegionOpsBuilder},
     prelude::*,
     qdev::{Clock, ClockEvent, DeviceImpl, DeviceState, Property, ResetType, ResettablePhasesImpl},
-    qom::{ObjectImpl, Owned, ParentField},
+    qom::{ObjectImpl, Owned, ParentField, ParentInit},
     static_assert,
     sysbus::{SysBusDevice, SysBusDeviceImpl},
+    uninit_field_mut,
     vmstate::VMStateDescription,
 };
 
@@ -163,7 +164,7 @@ impl PL011Impl for PL011State {
 impl ObjectImpl for PL011State {
     type ParentType = SysBusDevice;
 
-    const INSTANCE_INIT: Option<unsafe fn(&mut Self)> = Some(Self::init);
+    const INSTANCE_INIT: Option<unsafe fn(ParentInit<Self>)> = Some(Self::init);
     const INSTANCE_POST_INIT: Option<fn(&Self)> = Some(Self::post_init);
     const CLASS_INIT: fn(&mut Self::Class) = Self::Class::class_init::<Self>;
 }
@@ -488,7 +489,7 @@ impl PL011State {
     /// `PL011State` type. It must not be called more than once on the same
     /// location/instance. All its fields are expected to hold uninitialized
     /// values with the sole exception of `parent_obj`.
-    unsafe fn init(&mut self) {
+    unsafe fn init(mut this: ParentInit<Self>) {
         static PL011_OPS: MemoryRegionOps<PL011State> = MemoryRegionOpsBuilder::<PL011State>::new()
             .read(&PL011State::read)
             .write(&PL011State::write)
@@ -496,28 +497,23 @@ impl PL011State {
             .impl_sizes(4, 4)
             .build();
 
-        // SAFETY:
-        //
-        // self and self.iomem are guaranteed to be valid at this point since callers
-        // must make sure the `self` reference is valid.
+        // SAFETY: this and this.iomem are guaranteed to be valid at this point
         MemoryRegion::init_io(
-            unsafe { &mut *addr_of_mut!(self.iomem) },
-            addr_of_mut!(*self),
+            &mut uninit_field_mut!(*this, iomem),
             &PL011_OPS,
             "pl011",
             0x1000,
         );
 
-        self.regs = Default::default();
+        uninit_field_mut!(*this, regs).write(Default::default());
 
-        // SAFETY:
-        //
-        // self.clock is not initialized at this point; but since `Owned<_>` is
-        // not Drop, we can overwrite the undefined value without side effects;
-        // it's not sound but, because for all PL011State instances are created
-        // by QOM code which calls this function to initialize the fields, at
-        // leastno code is able to access an invalid self.clock value.
-        self.clock = self.init_clock_in("clk", &Self::clock_update, ClockEvent::ClockUpdate);
+        let clock = DeviceState::init_clock_in(
+            &mut this,
+            "clk",
+            &Self::clock_update,
+            ClockEvent::ClockUpdate,
+        );
+        uninit_field_mut!(*this, clock).write(clock);
     }
 
     const fn clock_update(&self, _event: ClockEvent) {
diff --git a/rust/hw/timer/hpet/src/device.rs b/rust/hw/timer/hpet/src/device.rs
index 340ca1d355..a281927781 100644
--- a/rust/hw/timer/hpet/src/device.rs
+++ b/rust/hw/timer/hpet/src/device.rs
@@ -21,8 +21,8 @@ use qemu_api::{
         hwaddr, MemoryRegion, MemoryRegionOps, MemoryRegionOpsBuilder, MEMTXATTRS_UNSPECIFIED,
     },
     prelude::*,
-    qdev::{DeviceImpl, DeviceMethods, DeviceState, Property, ResetType, ResettablePhasesImpl},
-    qom::{ObjectImpl, ObjectType, ParentField},
+    qdev::{DeviceImpl, DeviceState, Property, ResetType, ResettablePhasesImpl},
+    qom::{ObjectImpl, ObjectType, ParentField, ParentInit},
     qom_isa,
     sysbus::{SysBusDevice, SysBusDeviceImpl},
     timer::{Timer, CLOCK_VIRTUAL, NANOSECONDS_PER_SECOND},
@@ -697,7 +697,7 @@ impl HPETState {
             .set(self.counter.get().deposit(shift, len, val));
     }
 
-    unsafe fn init(&mut self) {
+    unsafe fn init(mut this: ParentInit<Self>) {
         static HPET_RAM_OPS: MemoryRegionOps<HPETState> =
             MemoryRegionOpsBuilder::<HPETState>::new()
                 .read(&HPETState::read)
@@ -707,18 +707,14 @@ impl HPETState {
                 .impl_sizes(4, 8)
                 .build();
 
-        // SAFETY:
-        // self and self.iomem are guaranteed to be valid at this point since callers
-        // must make sure the `self` reference is valid.
         MemoryRegion::init_io(
-            unsafe { &mut *addr_of_mut!(self.iomem) },
-            addr_of_mut!(*self),
+            &mut uninit_field_mut!(*this, iomem),
             &HPET_RAM_OPS,
             "hpet",
             HPET_REG_SPACE_LEN,
         );
 
-        Self::init_timers(unsafe { &mut *((self as *mut Self).cast::<MaybeUninit<Self>>()) });
+        Self::init_timers(&mut this);
     }
 
     fn post_init(&self) {
@@ -900,7 +896,7 @@ unsafe impl ObjectType for HPETState {
 impl ObjectImpl for HPETState {
     type ParentType = SysBusDevice;
 
-    const INSTANCE_INIT: Option<unsafe fn(&mut Self)> = Some(Self::init);
+    const INSTANCE_INIT: Option<unsafe fn(ParentInit<Self>)> = Some(Self::init);
     const INSTANCE_POST_INIT: Option<fn(&Self)> = Some(Self::post_init);
     const CLASS_INIT: fn(&mut Self::Class) = Self::Class::class_init::<Self>;
 }
diff --git a/rust/qemu-api/src/memory.rs b/rust/qemu-api/src/memory.rs
index 9ef2694bd6..e40fad6cf1 100644
--- a/rust/qemu-api/src/memory.rs
+++ b/rust/qemu-api/src/memory.rs
@@ -16,6 +16,7 @@ use crate::{
     callbacks::FnCall,
     cell::Opaque,
     prelude::*,
+    uninit::MaybeUninitField,
     zeroable::Zeroable,
 };
 
@@ -147,7 +148,7 @@ impl MemoryRegion {
     #[inline(always)]
     unsafe fn do_init_io(
         slot: *mut bindings::MemoryRegion,
-        owner: *mut Object,
+        owner: *mut bindings::Object,
         ops: &'static bindings::MemoryRegionOps,
         name: &'static str,
         size: u64,
@@ -156,7 +157,7 @@ impl MemoryRegion {
             let cstr = CString::new(name).unwrap();
             memory_region_init_io(
                 slot,
-                owner.cast::<bindings::Object>(),
+                owner,
                 ops,
                 owner.cast::<c_void>(),
                 cstr.as_ptr(),
@@ -166,16 +167,15 @@ impl MemoryRegion {
     }
 
     pub fn init_io<T: IsA<Object>>(
-        &mut self,
-        owner: *mut T,
+        this: &mut MaybeUninitField<'_, T, Self>,
         ops: &'static MemoryRegionOps<T>,
         name: &'static str,
         size: u64,
     ) {
         unsafe {
             Self::do_init_io(
-                self.0.as_mut_ptr(),
-                owner.cast::<Object>(),
+                this.as_mut_ptr().cast(),
+                MaybeUninitField::parent_mut(this).cast(),
                 &ops.0,
                 name,
                 size,
diff --git a/rust/qemu-api/src/qdev.rs b/rust/qemu-api/src/qdev.rs
index 0610959f46..36f02fb57d 100644
--- a/rust/qemu-api/src/qdev.rs
+++ b/rust/qemu-api/src/qdev.rs
@@ -19,7 +19,7 @@ use crate::{
     error::{Error, Result},
     irq::InterruptSource,
     prelude::*,
-    qom::{ObjectClass, ObjectImpl, Owned},
+    qom::{ObjectClass, ObjectImpl, Owned, ParentInit},
     vmstate::VMStateDescription,
 };
 
@@ -247,15 +247,9 @@ unsafe impl ObjectType for DeviceState {
 }
 qom_isa!(DeviceState: Object);
 
-/// Trait for methods exposed by the [`DeviceState`] class.  The methods can be
-/// called on all objects that have the trait `IsA<DeviceState>`.
-///
-/// The trait should only be used through the blanket implementation,
-/// which guarantees safety via `IsA`.
-pub trait DeviceMethods: ObjectDeref
-where
-    Self::Target: IsA<DeviceState>,
-{
+/// Initialization methods take a [`ParentInit`] and can be called as
+/// associated functions.
+impl DeviceState {
     /// Add an input clock named `name`.  Invoke the callback with
     /// `self` as the first parameter for the events that are requested.
     ///
@@ -266,12 +260,15 @@ where
     /// which Rust code has a reference to a child object) it would be
     /// possible for this function to return a `&Clock` too.
     #[inline]
-    fn init_clock_in<F: for<'a> FnCall<(&'a Self::Target, ClockEvent)>>(
-        &self,
+    pub fn init_clock_in<T: DeviceImpl, F: for<'a> FnCall<(&'a T, ClockEvent)>>(
+        this: &mut ParentInit<T>,
         name: &str,
         _cb: &F,
         events: ClockEvent,
-    ) -> Owned<Clock> {
+    ) -> Owned<Clock>
+    where
+        T::ParentType: IsA<DeviceState>,
+    {
         fn do_init_clock_in(
             dev: &DeviceState,
             name: &str,
@@ -287,10 +284,10 @@ where
             unsafe {
                 let cstr = CString::new(name).unwrap();
                 let clk = bindings::qdev_init_clock_in(
-                    dev.as_mut_ptr(),
+                    dev.0.as_mut_ptr(),
                     cstr.as_ptr(),
                     cb,
-                    dev.as_void_ptr(),
+                    dev.0.as_void_ptr(),
                     events.0,
                 );
 
@@ -307,12 +304,12 @@ where
                 // SAFETY: the opaque is "this", which is indeed a pointer to T
                 F::call((unsafe { &*(opaque.cast::<T>()) }, event))
             }
-            Some(rust_clock_cb::<Self::Target, F>)
+            Some(rust_clock_cb::<T, F>)
         } else {
             None
         };
 
-        do_init_clock_in(self.upcast(), name, cb, events)
+        do_init_clock_in(unsafe { this.upcast_mut() }, name, cb, events)
     }
 
     /// Add an output clock named `name`.
@@ -324,16 +321,30 @@ where
     /// which Rust code has a reference to a child object) it would be
     /// possible for this function to return a `&Clock` too.
     #[inline]
-    fn init_clock_out(&self, name: &str) -> Owned<Clock> {
+    pub fn init_clock_out<T: DeviceImpl>(this: &mut ParentInit<T>, name: &str) -> Owned<Clock>
+    where
+        T::ParentType: IsA<DeviceState>,
+    {
         unsafe {
             let cstr = CString::new(name).unwrap();
-            let clk = bindings::qdev_init_clock_out(self.upcast().as_mut_ptr(), cstr.as_ptr());
+            let dev: &mut DeviceState = this.upcast_mut();
+            let clk = bindings::qdev_init_clock_out(dev.0.as_mut_ptr(), cstr.as_ptr());
 
             let clk: &Clock = Clock::from_raw(clk);
             Owned::from(clk)
         }
     }
+}
 
+/// Trait for methods exposed by the [`DeviceState`] class.  The methods can be
+/// called on all objects that have the trait `IsA<DeviceState>`.
+///
+/// The trait should only be used through the blanket implementation,
+/// which guarantees safety via `IsA`.
+pub trait DeviceMethods: ObjectDeref
+where
+    Self::Target: IsA<DeviceState>,
+{
     fn prop_set_chr(&self, propname: &str, chr: &Owned<Chardev>) {
         assert!(bql_locked());
         let c_propname = CString::new(propname).unwrap();
diff --git a/rust/qemu-api/src/qom.rs b/rust/qemu-api/src/qom.rs
index 04d102591d..e20ee014cb 100644
--- a/rust/qemu-api/src/qom.rs
+++ b/rust/qemu-api/src/qom.rs
@@ -382,12 +382,15 @@ impl<T> DerefMut for ParentInit<'_, T> {
 }
 
 unsafe extern "C" fn rust_instance_init<T: ObjectImpl>(obj: *mut bindings::Object) {
-    let mut state = NonNull::new(obj).unwrap().cast::<T>();
+    let mut state = NonNull::new(obj).unwrap().cast::<MaybeUninit<T>>();
+
     // SAFETY: obj is an instance of T, since rust_instance_init<T>
     // is called from QOM core as the instance_init function
     // for class T
     unsafe {
-        T::INSTANCE_INIT.unwrap()(state.as_mut());
+        ParentInit::with(state.as_mut(), |parent_init| {
+            T::INSTANCE_INIT.unwrap()(parent_init);
+        });
     }
 }
 
@@ -654,7 +657,7 @@ pub trait ObjectImpl: ObjectType + IsA<Object> {
     ///
     /// FIXME: The argument is not really a valid reference. `&mut
     /// MaybeUninit<Self>` would be a better description.
-    const INSTANCE_INIT: Option<unsafe fn(&mut Self)> = None;
+    const INSTANCE_INIT: Option<unsafe fn(ParentInit<Self>)> = None;
 
     /// Function that is called to finish initialization of an object, once
     /// `INSTANCE_INIT` functions have been called.

From 8bf8814ab1aba0243127bcada19414dddbfe9e51 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Fri, 6 Jun 2025 14:30:21 +0800
Subject: [PATCH 1595/2760] hw/intc/loongarch_extioi: Add kernel irqchip
 realize function

Function kvm_extioi_realize() is added if kvm_irqchip_in_kernel is
set. It is to create and initialize ExtIOI device in kernel mode.

Reviewed-by: Song Gao <gaosong@loongson.cn>
Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Message-ID: <20250606063033.2557365-2-maobibo@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 hw/intc/loongarch_extioi.c         | 31 ++++++++++++--------
 hw/intc/loongarch_extioi_kvm.c     | 46 ++++++++++++++++++++++++++++++
 hw/intc/meson.build                |  2 ++
 include/hw/intc/loongarch_extioi.h |  3 ++
 4 files changed, 70 insertions(+), 12 deletions(-)
 create mode 100644 hw/intc/loongarch_extioi_kvm.c

diff --git a/hw/intc/loongarch_extioi.c b/hw/intc/loongarch_extioi.c
index 7c38c4c9b7..837f649d6c 100644
--- a/hw/intc/loongarch_extioi.c
+++ b/hw/intc/loongarch_extioi.c
@@ -12,6 +12,7 @@
 #include "hw/irq.h"
 #include "hw/loongarch/virt.h"
 #include "system/address-spaces.h"
+#include "system/kvm.h"
 #include "hw/intc/loongarch_extioi.h"
 #include "trace.h"
 
@@ -351,23 +352,29 @@ static void loongarch_extioi_realize(DeviceState *dev, Error **errp)
         return;
     }
 
-    for (i = 0; i < EXTIOI_IRQS; i++) {
-        sysbus_init_irq(sbd, &s->irq[i]);
-    }
-
-    qdev_init_gpio_in(dev, extioi_setirq, EXTIOI_IRQS);
-    memory_region_init_io(&s->extioi_system_mem, OBJECT(s), &extioi_ops,
-                          s, "extioi_system_mem", 0x900);
-    sysbus_init_mmio(sbd, &s->extioi_system_mem);
-
     if (s->features & BIT(EXTIOI_HAS_VIRT_EXTENSION)) {
-        memory_region_init_io(&s->virt_extend, OBJECT(s), &extioi_virt_ops,
-                              s, "extioi_virt", EXTIOI_VIRT_SIZE);
-        sysbus_init_mmio(sbd, &s->virt_extend);
         s->features |= EXTIOI_VIRT_HAS_FEATURES;
     } else {
         s->status |= BIT(EXTIOI_ENABLE);
     }
+
+    if (kvm_irqchip_in_kernel()) {
+        kvm_extioi_realize(dev, errp);
+    } else {
+        for (i = 0; i < EXTIOI_IRQS; i++) {
+            sysbus_init_irq(sbd, &s->irq[i]);
+        }
+
+        qdev_init_gpio_in(dev, extioi_setirq, EXTIOI_IRQS);
+        memory_region_init_io(&s->extioi_system_mem, OBJECT(s), &extioi_ops,
+                              s, "extioi_system_mem", 0x900);
+        sysbus_init_mmio(sbd, &s->extioi_system_mem);
+        if (s->features & BIT(EXTIOI_HAS_VIRT_EXTENSION)) {
+            memory_region_init_io(&s->virt_extend, OBJECT(s), &extioi_virt_ops,
+                                  s, "extioi_virt", EXTIOI_VIRT_SIZE);
+            sysbus_init_mmio(sbd, &s->virt_extend);
+        }
+    }
 }
 
 static void loongarch_extioi_unrealize(DeviceState *dev)
diff --git a/hw/intc/loongarch_extioi_kvm.c b/hw/intc/loongarch_extioi_kvm.c
new file mode 100644
index 0000000000..e6d5dd379a
--- /dev/null
+++ b/hw/intc/loongarch_extioi_kvm.c
@@ -0,0 +1,46 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * LoongArch EXTIOI interrupt kvm support
+ *
+ * Copyright (C) 2025 Loongson Technology Corporation Limited
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/typedefs.h"
+#include "hw/intc/loongarch_extioi.h"
+#include "linux/kvm.h"
+#include "qapi/error.h"
+#include "system/kvm.h"
+
+void kvm_extioi_realize(DeviceState *dev, Error **errp)
+{
+    LoongArchExtIOICommonState *lecs = LOONGARCH_EXTIOI_COMMON(dev);
+    LoongArchExtIOIState *les = LOONGARCH_EXTIOI(dev);
+    int ret;
+
+    ret = kvm_create_device(kvm_state, KVM_DEV_TYPE_LOONGARCH_EIOINTC, false);
+    if (ret < 0) {
+        fprintf(stderr, "create KVM_LOONGARCH_EIOINTC failed: %s\n",
+                strerror(-ret));
+        abort();
+    }
+
+    les->dev_fd = ret;
+    ret = kvm_device_access(les->dev_fd, KVM_DEV_LOONGARCH_EXTIOI_GRP_CTRL,
+                            KVM_DEV_LOONGARCH_EXTIOI_CTRL_INIT_NUM_CPU,
+                            &lecs->num_cpu, true, NULL);
+    if (ret < 0) {
+        fprintf(stderr, "KVM_LOONGARCH_EXTIOI_INIT_NUM_CPU failed: %s\n",
+                strerror(-ret));
+        abort();
+    }
+
+    ret = kvm_device_access(les->dev_fd, KVM_DEV_LOONGARCH_EXTIOI_GRP_CTRL,
+                            KVM_DEV_LOONGARCH_EXTIOI_CTRL_INIT_FEATURE,
+                            &lecs->features, true, NULL);
+    if (ret < 0) {
+        fprintf(stderr, "KVM_LOONGARCH_EXTIOI_INIT_FEATURE failed: %s\n",
+                strerror(-ret));
+        abort();
+    }
+}
diff --git a/hw/intc/meson.build b/hw/intc/meson.build
index 602da304b0..70e7548c52 100644
--- a/hw/intc/meson.build
+++ b/hw/intc/meson.build
@@ -74,3 +74,5 @@ specific_ss.add(when: 'CONFIG_LOONGARCH_IPI', if_true: files('loongarch_ipi.c'))
 specific_ss.add(when: 'CONFIG_LOONGARCH_PCH_PIC', if_true: files('loongarch_pch_pic.c', 'loongarch_pic_common.c'))
 specific_ss.add(when: 'CONFIG_LOONGARCH_PCH_MSI', if_true: files('loongarch_pch_msi.c'))
 specific_ss.add(when: 'CONFIG_LOONGARCH_EXTIOI', if_true: files('loongarch_extioi.c', 'loongarch_extioi_common.c'))
+specific_ss.add(when: ['CONFIG_KVM', 'CONFIG_LOONGARCH_EXTIOI'],
+               if_true: files('loongarch_extioi_kvm.c'))
diff --git a/include/hw/intc/loongarch_extioi.h b/include/hw/intc/loongarch_extioi.h
index 4a6ae903e9..69565e14ab 100644
--- a/include/hw/intc/loongarch_extioi.h
+++ b/include/hw/intc/loongarch_extioi.h
@@ -15,6 +15,7 @@ OBJECT_DECLARE_TYPE(LoongArchExtIOIState, LoongArchExtIOIClass, LOONGARCH_EXTIOI
 
 struct LoongArchExtIOIState {
     LoongArchExtIOICommonState parent_obj;
+    int dev_fd;
 };
 
 struct LoongArchExtIOIClass {
@@ -25,4 +26,6 @@ struct LoongArchExtIOIClass {
     ResettablePhases parent_phases;
 };
 
+void kvm_extioi_realize(DeviceState *dev, Error **errp);
+
 #endif /* LOONGARCH_EXTIOI_H */

From 228c5413fb50ab43644689f4959c3ef1ef7571ea Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Fri, 6 Jun 2025 14:30:22 +0800
Subject: [PATCH 1596/2760] hw/intc/loongarch_extioi: Add kernel irqchip save
 and restore function

Add save and store funtction if kvm_irqchip_in_kernel() return true,
it is to get and set ExtIOI irqchip state from KVM kernel.

Reviewed-by: Song Gao <gaosong@loongson.cn>
Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Message-ID: <20250606063033.2557365-3-maobibo@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 hw/intc/loongarch_extioi.c         | 14 +++++
 hw/intc/loongarch_extioi_kvm.c     | 90 ++++++++++++++++++++++++++++++
 include/hw/intc/loongarch_extioi.h |  2 +
 3 files changed, 106 insertions(+)

diff --git a/hw/intc/loongarch_extioi.c b/hw/intc/loongarch_extioi.c
index 837f649d6c..7be0685f36 100644
--- a/hw/intc/loongarch_extioi.c
+++ b/hw/intc/loongarch_extioi.c
@@ -393,11 +393,24 @@ static void loongarch_extioi_reset_hold(Object *obj, ResetType type)
     }
 }
 
+static int vmstate_extioi_pre_save(void *opaque)
+{
+    if (kvm_irqchip_in_kernel()) {
+        return kvm_extioi_get(opaque);
+    }
+
+    return 0;
+}
+
 static int vmstate_extioi_post_load(void *opaque, int version_id)
 {
     LoongArchExtIOICommonState *s = LOONGARCH_EXTIOI_COMMON(opaque);
     int i, start_irq;
 
+    if (kvm_irqchip_in_kernel()) {
+        return kvm_extioi_put(opaque, version_id);
+    }
+
     for (i = 0; i < (EXTIOI_IRQS / 4); i++) {
         start_irq = i * 4;
         extioi_update_sw_coremap(s, start_irq, s->coremap[i], false);
@@ -423,6 +436,7 @@ static void loongarch_extioi_class_init(ObjectClass *klass, const void *data)
                                       &lec->parent_unrealize);
     resettable_class_set_parent_phases(rc, NULL, loongarch_extioi_reset_hold,
                                        NULL, &lec->parent_phases);
+    lecc->pre_save  = vmstate_extioi_pre_save;
     lecc->post_load = vmstate_extioi_post_load;
 }
 
diff --git a/hw/intc/loongarch_extioi_kvm.c b/hw/intc/loongarch_extioi_kvm.c
index e6d5dd379a..f4c618ca4c 100644
--- a/hw/intc/loongarch_extioi_kvm.c
+++ b/hw/intc/loongarch_extioi_kvm.c
@@ -12,6 +12,96 @@
 #include "qapi/error.h"
 #include "system/kvm.h"
 
+static void kvm_extioi_access_reg(int fd, uint64_t addr, void *val, bool write)
+{
+    kvm_device_access(fd, KVM_DEV_LOONGARCH_EXTIOI_GRP_REGS,
+                      addr, val, write, &error_abort);
+}
+
+static void kvm_extioi_access_sw_state(int fd, uint64_t addr,
+                                       void *val, bool write)
+{
+    kvm_device_access(fd, KVM_DEV_LOONGARCH_EXTIOI_GRP_SW_STATUS,
+                      addr, val, write, &error_abort);
+}
+
+static void kvm_extioi_access_sw_status(void *opaque, bool write)
+{
+    LoongArchExtIOICommonState *lecs = LOONGARCH_EXTIOI_COMMON(opaque);
+    LoongArchExtIOIState *les = LOONGARCH_EXTIOI(opaque);
+    int addr;
+
+    addr = KVM_DEV_LOONGARCH_EXTIOI_SW_STATUS_STATE;
+    kvm_extioi_access_sw_state(les->dev_fd, addr, &lecs->status, write);
+}
+
+static void kvm_extioi_access_regs(void *opaque, bool write)
+{
+    LoongArchExtIOICommonState *lecs = LOONGARCH_EXTIOI_COMMON(opaque);
+    LoongArchExtIOIState *les = LOONGARCH_EXTIOI(opaque);
+    int fd = les->dev_fd;
+    int addr, offset, cpu;
+
+    for (addr = EXTIOI_NODETYPE_START; addr < EXTIOI_NODETYPE_END; addr += 4) {
+        offset = (addr - EXTIOI_NODETYPE_START) / 4;
+        kvm_extioi_access_reg(fd, addr, &lecs->nodetype[offset], write);
+    }
+
+    for (addr = EXTIOI_IPMAP_START; addr < EXTIOI_IPMAP_END; addr += 4) {
+        offset = (addr - EXTIOI_IPMAP_START) / 4;
+        kvm_extioi_access_reg(fd, addr, &lecs->ipmap[offset], write);
+    }
+
+    for (addr = EXTIOI_ENABLE_START; addr < EXTIOI_ENABLE_END; addr += 4) {
+        offset = (addr - EXTIOI_ENABLE_START) / 4;
+        kvm_extioi_access_reg(fd, addr, &lecs->enable[offset], write);
+    }
+
+    for (addr = EXTIOI_BOUNCE_START; addr < EXTIOI_BOUNCE_END; addr += 4) {
+        offset = (addr - EXTIOI_BOUNCE_START) / 4;
+        kvm_extioi_access_reg(fd, addr, &lecs->bounce[offset], write);
+    }
+
+    for (addr = EXTIOI_ISR_START; addr < EXTIOI_ISR_END; addr += 4) {
+        offset = (addr - EXTIOI_ISR_START) / 4;
+        kvm_extioi_access_reg(fd, addr, &lecs->isr[offset], write);
+    }
+
+    for (addr = EXTIOI_COREMAP_START; addr < EXTIOI_COREMAP_END; addr += 4) {
+        offset = (addr - EXTIOI_COREMAP_START) / 4;
+        kvm_extioi_access_reg(fd, addr, &lecs->coremap[offset], write);
+    }
+
+    for (cpu = 0; cpu < lecs->num_cpu; cpu++) {
+        for (addr = EXTIOI_COREISR_START;
+             addr < EXTIOI_COREISR_END; addr += 4) {
+            offset = (addr - EXTIOI_COREISR_START) / 4;
+            kvm_extioi_access_reg(fd, (cpu << 16) | addr,
+                                  &lecs->cpu[cpu].coreisr[offset], write);
+        }
+    }
+}
+
+int kvm_extioi_get(void *opaque)
+{
+    kvm_extioi_access_regs(opaque, false);
+    kvm_extioi_access_sw_status(opaque, false);
+    return 0;
+}
+
+int kvm_extioi_put(void *opaque, int version_id)
+{
+    LoongArchExtIOIState *les = LOONGARCH_EXTIOI(opaque);
+    int fd = les->dev_fd;
+
+    kvm_extioi_access_regs(opaque, true);
+    kvm_extioi_access_sw_status(opaque, true);
+    kvm_device_access(fd, KVM_DEV_LOONGARCH_EXTIOI_GRP_CTRL,
+                      KVM_DEV_LOONGARCH_EXTIOI_CTRL_LOAD_FINISHED,
+                      NULL, true, &error_abort);
+    return 0;
+}
+
 void kvm_extioi_realize(DeviceState *dev, Error **errp)
 {
     LoongArchExtIOICommonState *lecs = LOONGARCH_EXTIOI_COMMON(dev);
diff --git a/include/hw/intc/loongarch_extioi.h b/include/hw/intc/loongarch_extioi.h
index 69565e14ab..9be1d736ea 100644
--- a/include/hw/intc/loongarch_extioi.h
+++ b/include/hw/intc/loongarch_extioi.h
@@ -27,5 +27,7 @@ struct LoongArchExtIOIClass {
 };
 
 void kvm_extioi_realize(DeviceState *dev, Error **errp);
+int kvm_extioi_get(void *opaque);
+int kvm_extioi_put(void *opaque, int version_id);
 
 #endif /* LOONGARCH_EXTIOI_H */

From 412f655566bfadfe85d6f52a7e4420b418f261c3 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Fri, 6 Jun 2025 14:30:23 +0800
Subject: [PATCH 1597/2760] hw/intc/loongarch_ipi: Add kernel irqchip realize
 function

Function kvm_ipi_realize() is added if kvm_irqchip_in_kernel() return true.
It is to create and initialize IPI device in kernel mode.

Reviewed-by: Song Gao <gaosong@loongson.cn>
Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Message-ID: <20250606063033.2557365-4-maobibo@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 hw/intc/loongarch_ipi.c         |  5 +++++
 hw/intc/loongarch_ipi_kvm.c     | 27 +++++++++++++++++++++++++++
 hw/intc/loongson_ipi_common.c   |  5 +++++
 hw/intc/meson.build             |  2 ++
 include/hw/intc/loongarch_ipi.h |  3 +++
 5 files changed, 42 insertions(+)
 create mode 100644 hw/intc/loongarch_ipi_kvm.c

diff --git a/hw/intc/loongarch_ipi.c b/hw/intc/loongarch_ipi.c
index 74372a2039..159ba91fb6 100644
--- a/hw/intc/loongarch_ipi.c
+++ b/hw/intc/loongarch_ipi.c
@@ -11,6 +11,7 @@
 #include "qapi/error.h"
 #include "hw/intc/loongarch_ipi.h"
 #include "hw/qdev-properties.h"
+#include "system/kvm.h"
 #include "target/loongarch/cpu.h"
 
 static AddressSpace *get_iocsr_as(CPUState *cpu)
@@ -91,6 +92,10 @@ static void loongarch_ipi_realize(DeviceState *dev, Error **errp)
         lics->cpu[i].ipi = lics;
         qdev_init_gpio_out(dev, &lics->cpu[i].irq, 1);
     }
+
+    if (kvm_irqchip_in_kernel()) {
+        kvm_ipi_realize(dev, errp);
+    }
 }
 
 static void loongarch_ipi_reset_hold(Object *obj, ResetType type)
diff --git a/hw/intc/loongarch_ipi_kvm.c b/hw/intc/loongarch_ipi_kvm.c
new file mode 100644
index 0000000000..51e9c7ed1e
--- /dev/null
+++ b/hw/intc/loongarch_ipi_kvm.c
@@ -0,0 +1,27 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * LoongArch IPI interrupt KVM support
+ *
+ * Copyright (C) 2025 Loongson Technology Corporation Limited
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "hw/intc/loongarch_ipi.h"
+#include "system/kvm.h"
+#include "target/loongarch/cpu.h"
+
+void kvm_ipi_realize(DeviceState *dev, Error **errp)
+{
+    LoongarchIPIState *lis = LOONGARCH_IPI(dev);
+    int ret;
+
+    ret = kvm_create_device(kvm_state, KVM_DEV_TYPE_LOONGARCH_IPI, false);
+    if (ret < 0) {
+        fprintf(stderr, "IPI KVM_CREATE_DEVICE failed: %s\n",
+                strerror(-ret));
+        abort();
+    }
+
+    lis->dev_fd = ret;
+}
diff --git a/hw/intc/loongson_ipi_common.c b/hw/intc/loongson_ipi_common.c
index f32661c40f..ff2cc8bc91 100644
--- a/hw/intc/loongson_ipi_common.c
+++ b/hw/intc/loongson_ipi_common.c
@@ -11,6 +11,7 @@
 #include "hw/irq.h"
 #include "qemu/log.h"
 #include "migration/vmstate.h"
+#include "system/kvm.h"
 #include "trace.h"
 
 MemTxResult loongson_ipi_core_readl(void *opaque, hwaddr addr, uint64_t *data,
@@ -255,6 +256,10 @@ static void loongson_ipi_common_realize(DeviceState *dev, Error **errp)
     LoongsonIPICommonState *s = LOONGSON_IPI_COMMON(dev);
     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
 
+    if (kvm_irqchip_in_kernel()) {
+        return;
+    }
+
     memory_region_init_io(&s->ipi_iocsr_mem, OBJECT(dev),
                           &loongson_ipi_iocsr_ops,
                           s, "loongson_ipi_iocsr", 0x48);
diff --git a/hw/intc/meson.build b/hw/intc/meson.build
index 70e7548c52..1cc999771d 100644
--- a/hw/intc/meson.build
+++ b/hw/intc/meson.build
@@ -71,6 +71,8 @@ specific_ss.add(when: 'CONFIG_M68K_IRQC', if_true: files('m68k_irqc.c'))
 specific_ss.add(when: 'CONFIG_LOONGSON_IPI_COMMON', if_true: files('loongson_ipi_common.c'))
 specific_ss.add(when: 'CONFIG_LOONGSON_IPI', if_true: files('loongson_ipi.c'))
 specific_ss.add(when: 'CONFIG_LOONGARCH_IPI', if_true: files('loongarch_ipi.c'))
+specific_ss.add(when: ['CONFIG_KVM', 'CONFIG_LOONGARCH_IPI'],
+                if_true: files('loongarch_ipi_kvm.c'))
 specific_ss.add(when: 'CONFIG_LOONGARCH_PCH_PIC', if_true: files('loongarch_pch_pic.c', 'loongarch_pic_common.c'))
 specific_ss.add(when: 'CONFIG_LOONGARCH_PCH_MSI', if_true: files('loongarch_pch_msi.c'))
 specific_ss.add(when: 'CONFIG_LOONGARCH_EXTIOI', if_true: files('loongarch_extioi.c', 'loongarch_extioi_common.c'))
diff --git a/include/hw/intc/loongarch_ipi.h b/include/hw/intc/loongarch_ipi.h
index a7c6bf85d3..608cd09a78 100644
--- a/include/hw/intc/loongarch_ipi.h
+++ b/include/hw/intc/loongarch_ipi.h
@@ -16,6 +16,7 @@ OBJECT_DECLARE_TYPE(LoongarchIPIState, LoongarchIPIClass, LOONGARCH_IPI)
 
 struct LoongarchIPIState {
     LoongsonIPICommonState parent_obj;
+    int  dev_fd;
 };
 
 struct LoongarchIPIClass {
@@ -24,4 +25,6 @@ struct LoongarchIPIClass {
     ResettablePhases parent_phases;
 };
 
+void kvm_ipi_realize(DeviceState *dev, Error **errp);
+
 #endif

From 14be318c952ce2c29f2a69204a23c0008f779a3f Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Fri, 6 Jun 2025 14:30:24 +0800
Subject: [PATCH 1598/2760] hw/intc/loongson_ipi: Add load and save interface
 with ipi_common class

Add pre_save and post_load interfaces with ipi_common class, here only
framework ipi_common adds these interfaces. The defailed implementation
is LoongArchIPI child device in later.

Reviewed-by: Song Gao <gaosong@loongson.cn>
Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Message-ID: <20250606063033.2557365-5-maobibo@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 hw/intc/loongson_ipi_common.c         | 28 +++++++++++++++++++++++++++
 include/hw/intc/loongson_ipi_common.h |  2 ++
 2 files changed, 30 insertions(+)

diff --git a/hw/intc/loongson_ipi_common.c b/hw/intc/loongson_ipi_common.c
index ff2cc8bc91..8cd78d4858 100644
--- a/hw/intc/loongson_ipi_common.c
+++ b/hw/intc/loongson_ipi_common.c
@@ -282,10 +282,38 @@ static void loongson_ipi_common_unrealize(DeviceState *dev)
     g_free(s->cpu);
 }
 
+static int loongson_ipi_common_pre_save(void *opaque)
+{
+    IPICore *ipicore = (IPICore *)opaque;
+    LoongsonIPICommonState *s = ipicore->ipi;
+    LoongsonIPICommonClass *licc = LOONGSON_IPI_COMMON_GET_CLASS(s);
+
+    if (licc->pre_save) {
+        return licc->pre_save(s);
+    }
+
+    return 0;
+}
+
+static int loongson_ipi_common_post_load(void *opaque, int version_id)
+{
+    IPICore *ipicore = (IPICore *)opaque;
+    LoongsonIPICommonState *s = ipicore->ipi;
+    LoongsonIPICommonClass *licc = LOONGSON_IPI_COMMON_GET_CLASS(s);
+
+    if (licc->post_load) {
+        return licc->post_load(s, version_id);
+    }
+
+    return 0;
+}
+
 static const VMStateDescription vmstate_ipi_core = {
     .name = "ipi-single",
     .version_id = 2,
     .minimum_version_id = 2,
+    .pre_save  = loongson_ipi_common_pre_save,
+    .post_load = loongson_ipi_common_post_load,
     .fields = (const VMStateField[]) {
         VMSTATE_UINT32(status, IPICore),
         VMSTATE_UINT32(en, IPICore),
diff --git a/include/hw/intc/loongson_ipi_common.h b/include/hw/intc/loongson_ipi_common.h
index b587f9c571..e58ce2aa1c 100644
--- a/include/hw/intc/loongson_ipi_common.h
+++ b/include/hw/intc/loongson_ipi_common.h
@@ -48,6 +48,8 @@ struct LoongsonIPICommonClass {
     AddressSpace *(*get_iocsr_as)(CPUState *cpu);
     int (*cpu_by_arch_id)(LoongsonIPICommonState *lics, int64_t id,
                           int *index, CPUState **pcs);
+    int (*pre_save)(void *opaque);
+    int (*post_load)(void *opaque, int version_id);
 };
 
 MemTxResult loongson_ipi_core_readl(void *opaque, hwaddr addr, uint64_t *data,

From f936caa315750406f50feb1ac9c93770b47ebe96 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Fri, 6 Jun 2025 14:30:25 +0800
Subject: [PATCH 1599/2760] hw/intc/loongarch_ipi: Add kernel irqchip save and
 restore function

Add save and store funtction if kvm_irqchip_in_kernel() return true,
it is to get and set IPI irqchip state from KVM kernel.

Reviewed-by: Song Gao <gaosong@loongson.cn>
Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Message-ID: <20250606063033.2557365-6-maobibo@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 hw/intc/loongarch_ipi.c         | 20 ++++++++++++
 hw/intc/loongarch_ipi_kvm.c     | 54 +++++++++++++++++++++++++++++++++
 include/hw/intc/loongarch_ipi.h |  2 ++
 3 files changed, 76 insertions(+)

diff --git a/hw/intc/loongarch_ipi.c b/hw/intc/loongarch_ipi.c
index 159ba91fb6..0ea91ea054 100644
--- a/hw/intc/loongarch_ipi.c
+++ b/hw/intc/loongarch_ipi.c
@@ -171,6 +171,24 @@ static void loongarch_ipi_cpu_unplug(HotplugHandler *hotplug_dev,
     core->cpu = NULL;
 }
 
+static int loongarch_ipi_pre_save(void *opaque)
+{
+    if (kvm_irqchip_in_kernel()) {
+        return kvm_ipi_get(opaque);
+    }
+
+    return 0;
+}
+
+static int loongarch_ipi_post_load(void *opaque, int version_id)
+{
+    if (kvm_irqchip_in_kernel()) {
+        return kvm_ipi_put(opaque, version_id);
+    }
+
+    return 0;
+}
+
 static void loongarch_ipi_class_init(ObjectClass *klass, const void *data)
 {
     LoongsonIPICommonClass *licc = LOONGSON_IPI_COMMON_CLASS(klass);
@@ -187,6 +205,8 @@ static void loongarch_ipi_class_init(ObjectClass *klass, const void *data)
     licc->cpu_by_arch_id = loongarch_cpu_by_arch_id;
     hc->plug = loongarch_ipi_cpu_plug;
     hc->unplug = loongarch_ipi_cpu_unplug;
+    licc->pre_save = loongarch_ipi_pre_save;
+    licc->post_load = loongarch_ipi_post_load;
 }
 
 static const TypeInfo loongarch_ipi_types[] = {
diff --git a/hw/intc/loongarch_ipi_kvm.c b/hw/intc/loongarch_ipi_kvm.c
index 51e9c7ed1e..b615060d83 100644
--- a/hw/intc/loongarch_ipi_kvm.c
+++ b/hw/intc/loongarch_ipi_kvm.c
@@ -11,6 +11,60 @@
 #include "system/kvm.h"
 #include "target/loongarch/cpu.h"
 
+static void kvm_ipi_access_reg(int fd, uint64_t addr, uint32_t *val, bool write)
+{
+    kvm_device_access(fd, KVM_DEV_LOONGARCH_IPI_GRP_REGS,
+                      addr, val, write, &error_abort);
+}
+
+static void kvm_ipi_access_regs(void *opaque, bool write)
+{
+    LoongsonIPICommonState *ipi = (LoongsonIPICommonState *)opaque;
+    LoongarchIPIState *lis = LOONGARCH_IPI(opaque);
+    IPICore *core;
+    uint64_t attr;
+    int cpu, fd = lis->dev_fd;
+
+    for (cpu = 0; cpu < ipi->num_cpu; cpu++) {
+        core = &ipi->cpu[cpu];
+        attr = (cpu << 16) | CORE_STATUS_OFF;
+        kvm_ipi_access_reg(fd, attr, &core->status, write);
+
+        attr = (cpu << 16) | CORE_EN_OFF;
+        kvm_ipi_access_reg(fd, attr, &core->en, write);
+
+        attr = (cpu << 16) | CORE_SET_OFF;
+        kvm_ipi_access_reg(fd, attr, &core->set, write);
+
+        attr = (cpu << 16) | CORE_CLEAR_OFF;
+        kvm_ipi_access_reg(fd, attr, &core->clear, write);
+
+        attr = (cpu << 16) | CORE_BUF_20;
+        kvm_ipi_access_reg(fd, attr, &core->buf[0], write);
+
+        attr = (cpu << 16) | CORE_BUF_28;
+        kvm_ipi_access_reg(fd, attr, &core->buf[2], write);
+
+        attr = (cpu << 16) | CORE_BUF_30;
+        kvm_ipi_access_reg(fd, attr, &core->buf[4], write);
+
+        attr = (cpu << 16) | CORE_BUF_38;
+        kvm_ipi_access_reg(fd, attr, &core->buf[6], write);
+    }
+}
+
+int kvm_ipi_get(void *opaque)
+{
+    kvm_ipi_access_regs(opaque, false);
+    return 0;
+}
+
+int kvm_ipi_put(void *opaque, int version_id)
+{
+    kvm_ipi_access_regs(opaque, true);
+    return 0;
+}
+
 void kvm_ipi_realize(DeviceState *dev, Error **errp)
 {
     LoongarchIPIState *lis = LOONGARCH_IPI(dev);
diff --git a/include/hw/intc/loongarch_ipi.h b/include/hw/intc/loongarch_ipi.h
index 608cd09a78..5175a6b004 100644
--- a/include/hw/intc/loongarch_ipi.h
+++ b/include/hw/intc/loongarch_ipi.h
@@ -26,5 +26,7 @@ struct LoongarchIPIClass {
 };
 
 void kvm_ipi_realize(DeviceState *dev, Error **errp);
+int kvm_ipi_get(void *opaque);
+int kvm_ipi_put(void *opaque, int version_id);
 
 #endif

From 5b0e05b9023793197b82fd6feb275459adc9e10c Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Fri, 6 Jun 2025 14:30:26 +0800
Subject: [PATCH 1600/2760] hw/intc/loongarch_pch_msi: Inject MSI interrupt to
 kernel

If kvm_irqchip_in_kernel() return true, MSI interrupt can be injected
with API kvm_irqchip_send_msi() to KVM.

Reviewed-by: Song Gao <gaosong@loongson.cn>
Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Message-ID: <20250606063033.2557365-7-maobibo@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 hw/intc/loongarch_pch_msi.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/hw/intc/loongarch_pch_msi.c b/hw/intc/loongarch_pch_msi.c
index 06eb944da0..f6d163158d 100644
--- a/hw/intc/loongarch_pch_msi.c
+++ b/hw/intc/loongarch_pch_msi.c
@@ -13,6 +13,7 @@
 #include "hw/pci/msi.h"
 #include "hw/misc/unimp.h"
 #include "migration/vmstate.h"
+#include "system/kvm.h"
 #include "trace.h"
 
 static uint64_t loongarch_msi_mem_read(void *opaque, hwaddr addr, unsigned size)
@@ -26,6 +27,15 @@ static void loongarch_msi_mem_write(void *opaque, hwaddr addr,
     LoongArchPCHMSI *s = (LoongArchPCHMSI *)opaque;
     int irq_num;
 
+    if (kvm_irqchip_in_kernel()) {
+        MSIMessage msg;
+
+        msg.address = addr;
+        msg.data = val;
+        kvm_irqchip_send_msi(kvm_state, msg);
+        return;
+    }
+
     /*
      * vector number is irq number from upper extioi intc
      * need subtract irq base to get msi vector offset

From b758e28974614a15e70fbc983e28fe77852564ee Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Fri, 6 Jun 2025 14:30:27 +0800
Subject: [PATCH 1601/2760] hw/intc/loongarch_pch: Add kernel irqchip realize
 function

Function kvm_pic_realize() is added if kvm_irqchip_in_kernel() return true.
It is to notify KVM kernel to create and initialize PCH PCI device in
kernel mode.

Reviewed-by: Song Gao <gaosong@loongson.cn>
Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Message-ID: <20250606063033.2557365-8-maobibo@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 hw/intc/loongarch_pch_pic.c         | 14 ++++++++---
 hw/intc/loongarch_pic_kvm.c         | 38 +++++++++++++++++++++++++++++
 hw/intc/meson.build                 |  2 ++
 include/hw/intc/loongarch_pch_pic.h |  3 +++
 4 files changed, 53 insertions(+), 4 deletions(-)
 create mode 100644 hw/intc/loongarch_pic_kvm.c

diff --git a/hw/intc/loongarch_pch_pic.c b/hw/intc/loongarch_pch_pic.c
index ebb33ed0b0..6ac3a72c31 100644
--- a/hw/intc/loongarch_pch_pic.c
+++ b/hw/intc/loongarch_pch_pic.c
@@ -10,6 +10,7 @@
 #include "qemu/log.h"
 #include "hw/irq.h"
 #include "hw/intc/loongarch_pch_pic.h"
+#include "system/kvm.h"
 #include "trace.h"
 #include "qapi/error.h"
 
@@ -275,10 +276,15 @@ static void loongarch_pic_realize(DeviceState *dev, Error **errp)
 
     qdev_init_gpio_out(dev, s->parent_irq, s->irq_num);
     qdev_init_gpio_in(dev, pch_pic_irq_handler, s->irq_num);
-    memory_region_init_io(&s->iomem, OBJECT(dev),
-                          &loongarch_pch_pic_ops,
-                          s, TYPE_LOONGARCH_PIC, VIRT_PCH_REG_SIZE);
-    sysbus_init_mmio(sbd, &s->iomem);
+
+    if (kvm_irqchip_in_kernel()) {
+        kvm_pic_realize(dev, errp);
+    } else {
+        memory_region_init_io(&s->iomem, OBJECT(dev),
+                              &loongarch_pch_pic_ops,
+                              s, TYPE_LOONGARCH_PIC, VIRT_PCH_REG_SIZE);
+        sysbus_init_mmio(sbd, &s->iomem);
+    }
 }
 
 static void loongarch_pic_class_init(ObjectClass *klass, const void *data)
diff --git a/hw/intc/loongarch_pic_kvm.c b/hw/intc/loongarch_pic_kvm.c
new file mode 100644
index 0000000000..ee77f04a13
--- /dev/null
+++ b/hw/intc/loongarch_pic_kvm.c
@@ -0,0 +1,38 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * LoongArch kvm pch pic interrupt support
+ *
+ * Copyright (C) 2025 Loongson Technology Corporation Limited
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "hw/boards.h"
+#include "hw/intc/loongarch_pch_pic.h"
+#include "hw/loongarch/virt.h"
+#include "hw/pci-host/ls7a.h"
+#include "system/kvm.h"
+
+void kvm_pic_realize(DeviceState *dev, Error **errp)
+{
+    LoongarchPICState *lps = LOONGARCH_PIC(dev);
+    uint64_t pch_pic_base = VIRT_PCH_REG_BASE;
+    int ret;
+
+    ret = kvm_create_device(kvm_state, KVM_DEV_TYPE_LOONGARCH_PCHPIC, false);
+    if (ret < 0) {
+        fprintf(stderr, "Create KVM_LOONGARCH_PCHPIC failed: %s\n",
+                strerror(-ret));
+        abort();
+    }
+
+    lps->dev_fd = ret;
+    ret = kvm_device_access(lps->dev_fd, KVM_DEV_LOONGARCH_PCH_PIC_GRP_CTRL,
+                            KVM_DEV_LOONGARCH_PCH_PIC_CTRL_INIT,
+                            &pch_pic_base, true, NULL);
+    if (ret < 0) {
+        fprintf(stderr, "KVM_LOONGARCH_PCH_PIC_INIT failed: %s\n",
+                strerror(-ret));
+        abort();
+    }
+}
diff --git a/hw/intc/meson.build b/hw/intc/meson.build
index 1cc999771d..3137521a4a 100644
--- a/hw/intc/meson.build
+++ b/hw/intc/meson.build
@@ -74,6 +74,8 @@ specific_ss.add(when: 'CONFIG_LOONGARCH_IPI', if_true: files('loongarch_ipi.c'))
 specific_ss.add(when: ['CONFIG_KVM', 'CONFIG_LOONGARCH_IPI'],
                 if_true: files('loongarch_ipi_kvm.c'))
 specific_ss.add(when: 'CONFIG_LOONGARCH_PCH_PIC', if_true: files('loongarch_pch_pic.c', 'loongarch_pic_common.c'))
+specific_ss.add(when: ['CONFIG_KVM', 'CONFIG_LOONGARCH_PCH_PIC'],
+                if_true: files('loongarch_pic_kvm.c'))
 specific_ss.add(when: 'CONFIG_LOONGARCH_PCH_MSI', if_true: files('loongarch_pch_msi.c'))
 specific_ss.add(when: 'CONFIG_LOONGARCH_EXTIOI', if_true: files('loongarch_extioi.c', 'loongarch_extioi_common.c'))
 specific_ss.add(when: ['CONFIG_KVM', 'CONFIG_LOONGARCH_EXTIOI'],
diff --git a/include/hw/intc/loongarch_pch_pic.h b/include/hw/intc/loongarch_pch_pic.h
index 839a59a43b..4b52f1165f 100644
--- a/include/hw/intc/loongarch_pch_pic.h
+++ b/include/hw/intc/loongarch_pch_pic.h
@@ -16,6 +16,7 @@ OBJECT_DECLARE_TYPE(LoongarchPICState, LoongarchPICClass, LOONGARCH_PIC)
 
 struct LoongarchPICState {
     LoongArchPICCommonState parent_obj;
+    int dev_fd;
 };
 
 struct LoongarchPICClass {
@@ -25,4 +26,6 @@ struct LoongarchPICClass {
     ResettablePhases parent_phases;
 };
 
+void kvm_pic_realize(DeviceState *dev, Error **errp);
+
 #endif /* HW_LOONGARCH_PCH_PIC_H */

From 11a04c9f40ac479f68139f6801da314591e67ae1 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Fri, 6 Jun 2025 14:30:28 +0800
Subject: [PATCH 1602/2760] hw/intc/loongarch_pch: Add kernel irqchip save and
 restore function

Add save and store funtction if kvm_irqchip_in_kernel() return true,
it is to get and set PCH PCI irqchip state from KVM kernel.

Reviewed-by: Song Gao <gaosong@loongson.cn>
Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Message-ID: <20250606063033.2557365-9-maobibo@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 hw/intc/loongarch_pch_pic.c            | 22 ++++++++++++
 hw/intc/loongarch_pic_kvm.c            | 47 ++++++++++++++++++++++++++
 include/hw/intc/loongarch_pch_pic.h    |  2 ++
 include/hw/intc/loongarch_pic_common.h |  1 +
 4 files changed, 72 insertions(+)

diff --git a/hw/intc/loongarch_pch_pic.c b/hw/intc/loongarch_pch_pic.c
index 6ac3a72c31..13b5766444 100644
--- a/hw/intc/loongarch_pch_pic.c
+++ b/hw/intc/loongarch_pch_pic.c
@@ -287,16 +287,38 @@ static void loongarch_pic_realize(DeviceState *dev, Error **errp)
     }
 }
 
+static int loongarch_pic_pre_save(LoongArchPICCommonState *opaque)
+{
+    if (kvm_irqchip_in_kernel()) {
+        return kvm_pic_get(opaque);
+    }
+
+    return 0;
+}
+
+static int loongarch_pic_post_load(LoongArchPICCommonState *opaque,
+                                   int version_id)
+{
+    if (kvm_irqchip_in_kernel()) {
+        return kvm_pic_put(opaque, version_id);
+    }
+
+    return 0;
+}
+
 static void loongarch_pic_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     LoongarchPICClass *lpc = LOONGARCH_PIC_CLASS(klass);
+    LoongArchPICCommonClass *lpcc = LOONGARCH_PIC_COMMON_CLASS(klass);
     ResettableClass *rc = RESETTABLE_CLASS(klass);
 
     resettable_class_set_parent_phases(rc, NULL, loongarch_pic_reset_hold,
                                        NULL, &lpc->parent_phases);
     device_class_set_parent_realize(dc, loongarch_pic_realize,
                                     &lpc->parent_realize);
+    lpcc->pre_save = loongarch_pic_pre_save;
+    lpcc->post_load = loongarch_pic_post_load;
 }
 
 static const TypeInfo loongarch_pic_types[] = {
diff --git a/hw/intc/loongarch_pic_kvm.c b/hw/intc/loongarch_pic_kvm.c
index ee77f04a13..3eef81a9bb 100644
--- a/hw/intc/loongarch_pic_kvm.c
+++ b/hw/intc/loongarch_pic_kvm.c
@@ -13,6 +13,53 @@
 #include "hw/pci-host/ls7a.h"
 #include "system/kvm.h"
 
+static void kvm_pch_pic_access_reg(int fd, uint64_t addr, void *val, bool write)
+{
+    kvm_device_access(fd, KVM_DEV_LOONGARCH_PCH_PIC_GRP_REGS,
+                      addr, val, write, &error_abort);
+}
+
+static void kvm_pch_pic_access(void *opaque, bool write)
+{
+    LoongArchPICCommonState *s = LOONGARCH_PIC_COMMON(opaque);
+    LoongarchPICState *lps = LOONGARCH_PIC(opaque);
+    int fd = lps->dev_fd;
+    int addr, offset;
+
+    kvm_pch_pic_access_reg(fd, PCH_PIC_INT_MASK, &s->int_mask, write);
+    kvm_pch_pic_access_reg(fd, PCH_PIC_HTMSI_EN, &s->htmsi_en, write);
+    kvm_pch_pic_access_reg(fd, PCH_PIC_INT_EDGE, &s->intedge, write);
+    kvm_pch_pic_access_reg(fd, PCH_PIC_AUTO_CTRL0, &s->auto_crtl0, write);
+    kvm_pch_pic_access_reg(fd, PCH_PIC_AUTO_CTRL1, &s->auto_crtl1, write);
+
+    for (addr = PCH_PIC_ROUTE_ENTRY;
+        addr < PCH_PIC_ROUTE_ENTRY_END; addr++) {
+        offset = addr - PCH_PIC_ROUTE_ENTRY;
+        kvm_pch_pic_access_reg(fd, addr, &s->route_entry[offset], write);
+    }
+
+    for (addr = PCH_PIC_HTMSI_VEC; addr < PCH_PIC_HTMSI_VEC_END; addr++) {
+        offset = addr - PCH_PIC_HTMSI_VEC;
+        kvm_pch_pic_access_reg(fd, addr, &s->htmsi_vector[offset], write);
+    }
+
+    kvm_pch_pic_access_reg(fd, PCH_PIC_INT_REQUEST, &s->intirr, write);
+    kvm_pch_pic_access_reg(fd, PCH_PIC_INT_STATUS, &s->intisr, write);
+    kvm_pch_pic_access_reg(fd, PCH_PIC_INT_POL, &s->int_polarity, write);
+}
+
+int kvm_pic_get(void *opaque)
+{
+    kvm_pch_pic_access(opaque, false);
+    return 0;
+}
+
+int kvm_pic_put(void *opaque, int version_id)
+{
+    kvm_pch_pic_access(opaque, true);
+    return 0;
+}
+
 void kvm_pic_realize(DeviceState *dev, Error **errp)
 {
     LoongarchPICState *lps = LOONGARCH_PIC(dev);
diff --git a/include/hw/intc/loongarch_pch_pic.h b/include/hw/intc/loongarch_pch_pic.h
index 4b52f1165f..a46b6f8985 100644
--- a/include/hw/intc/loongarch_pch_pic.h
+++ b/include/hw/intc/loongarch_pch_pic.h
@@ -27,5 +27,7 @@ struct LoongarchPICClass {
 };
 
 void kvm_pic_realize(DeviceState *dev, Error **errp);
+int kvm_pic_get(void *opaque);
+int kvm_pic_put(void *opaque, int version_id);
 
 #endif /* HW_LOONGARCH_PCH_PIC_H */
diff --git a/include/hw/intc/loongarch_pic_common.h b/include/hw/intc/loongarch_pic_common.h
index 9349a055d0..f774c975d4 100644
--- a/include/hw/intc/loongarch_pic_common.h
+++ b/include/hw/intc/loongarch_pic_common.h
@@ -23,6 +23,7 @@
 #define PCH_PIC_ROUTE_ENTRY_END         0x13f
 #define PCH_PIC_HTMSI_VEC               0x200
 #define PCH_PIC_HTMSI_VEC_END           0x23f
+#define PCH_PIC_INT_REQUEST             0x380
 #define PCH_PIC_INT_STATUS              0x3a0
 #define PCH_PIC_INT_POL                 0x3e0
 

From 0dd6798a1adda03dcfa6304437faa8e62a193d9c Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Fri, 6 Jun 2025 14:30:29 +0800
Subject: [PATCH 1603/2760] hw/intc/loongarch_pch: Inject irq line interrupt to
 kernel

If kvm_irqchip_in_kernel() return true, irq line interrupt can be
injected with API kvm_set_irq() to KVM.

Reviewed-by: Song Gao <gaosong@loongson.cn>
Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Message-ID: <20250606063033.2557365-10-maobibo@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 hw/intc/loongarch_pch_pic.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/hw/intc/loongarch_pch_pic.c b/hw/intc/loongarch_pch_pic.c
index 13b5766444..1adef980d4 100644
--- a/hw/intc/loongarch_pch_pic.c
+++ b/hw/intc/loongarch_pch_pic.c
@@ -49,6 +49,11 @@ static void pch_pic_irq_handler(void *opaque, int irq, int level)
     assert(irq < s->irq_num);
     trace_loongarch_pch_pic_irq_handler(irq, level);
 
+    if (kvm_irqchip_in_kernel()) {
+        kvm_set_irq(kvm_state, irq, !!level);
+        return;
+    }
+
     if (s->intedge & mask) {
         /* Edge triggered */
         if (level) {

From c642ddf19b248bb668e40a8d15089b877e4057fa Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Fri, 6 Jun 2025 14:30:30 +0800
Subject: [PATCH 1604/2760] hw/loongarch/virt: Add reset support for kernel
 irqchip

When system reboot, interrupt controller is restored to initial
state. However if interrupt controller extioi/ipi/pch_pic is
emulated in kernel, it should notify kvm to do so. Here suspend
and restore API is used for reset, set initial state in qemu user
space and restore API is used to notify kvm to reload register
state.

Reviewed-by: Song Gao <gaosong@loongson.cn>
Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Message-ID: <20250606063033.2557365-11-maobibo@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 hw/intc/loongarch_extioi.c     | 4 ++++
 hw/intc/loongarch_extioi_kvm.c | 4 ++++
 hw/intc/loongarch_ipi.c        | 4 ++++
 hw/intc/loongarch_ipi_kvm.c    | 4 ++++
 hw/intc/loongarch_pch_pic.c    | 4 ++++
 hw/intc/loongarch_pic_kvm.c    | 4 ++++
 6 files changed, 24 insertions(+)

diff --git a/hw/intc/loongarch_extioi.c b/hw/intc/loongarch_extioi.c
index 7be0685f36..8b8ac6b187 100644
--- a/hw/intc/loongarch_extioi.c
+++ b/hw/intc/loongarch_extioi.c
@@ -391,6 +391,10 @@ static void loongarch_extioi_reset_hold(Object *obj, ResetType type)
     if (lec->parent_phases.hold) {
         lec->parent_phases.hold(obj, type);
     }
+
+    if (kvm_irqchip_in_kernel()) {
+        kvm_extioi_put(obj, 0);
+    }
 }
 
 static int vmstate_extioi_pre_save(void *opaque)
diff --git a/hw/intc/loongarch_extioi_kvm.c b/hw/intc/loongarch_extioi_kvm.c
index f4c618ca4c..0133540c45 100644
--- a/hw/intc/loongarch_extioi_kvm.c
+++ b/hw/intc/loongarch_extioi_kvm.c
@@ -94,6 +94,10 @@ int kvm_extioi_put(void *opaque, int version_id)
     LoongArchExtIOIState *les = LOONGARCH_EXTIOI(opaque);
     int fd = les->dev_fd;
 
+    if (fd == 0) {
+        return 0;
+    }
+
     kvm_extioi_access_regs(opaque, true);
     kvm_extioi_access_sw_status(opaque, true);
     kvm_device_access(fd, KVM_DEV_LOONGARCH_EXTIOI_GRP_CTRL,
diff --git a/hw/intc/loongarch_ipi.c b/hw/intc/loongarch_ipi.c
index 0ea91ea054..fc8005c944 100644
--- a/hw/intc/loongarch_ipi.c
+++ b/hw/intc/loongarch_ipi.c
@@ -122,6 +122,10 @@ static void loongarch_ipi_reset_hold(Object *obj, ResetType type)
         core->clear = 0;
         memset(core->buf, 0, sizeof(core->buf));
     }
+
+    if (kvm_irqchip_in_kernel()) {
+        kvm_ipi_put(obj, 0);
+    }
 }
 
 static void loongarch_ipi_cpu_plug(HotplugHandler *hotplug_dev,
diff --git a/hw/intc/loongarch_ipi_kvm.c b/hw/intc/loongarch_ipi_kvm.c
index b615060d83..4cb3acc921 100644
--- a/hw/intc/loongarch_ipi_kvm.c
+++ b/hw/intc/loongarch_ipi_kvm.c
@@ -25,6 +25,10 @@ static void kvm_ipi_access_regs(void *opaque, bool write)
     uint64_t attr;
     int cpu, fd = lis->dev_fd;
 
+    if (fd == 0) {
+        return;
+    }
+
     for (cpu = 0; cpu < ipi->num_cpu; cpu++) {
         core = &ipi->cpu[cpu];
         attr = (cpu << 16) | CORE_STATUS_OFF;
diff --git a/hw/intc/loongarch_pch_pic.c b/hw/intc/loongarch_pch_pic.c
index 1adef980d4..c4b242dbf4 100644
--- a/hw/intc/loongarch_pch_pic.c
+++ b/hw/intc/loongarch_pch_pic.c
@@ -264,6 +264,10 @@ static void loongarch_pic_reset_hold(Object *obj, ResetType type)
     if (lpc->parent_phases.hold) {
         lpc->parent_phases.hold(obj, type);
     }
+
+    if (kvm_irqchip_in_kernel()) {
+        kvm_pic_put(obj, 0);
+    }
 }
 
 static void loongarch_pic_realize(DeviceState *dev, Error **errp)
diff --git a/hw/intc/loongarch_pic_kvm.c b/hw/intc/loongarch_pic_kvm.c
index 3eef81a9bb..dd504ec6a6 100644
--- a/hw/intc/loongarch_pic_kvm.c
+++ b/hw/intc/loongarch_pic_kvm.c
@@ -26,6 +26,10 @@ static void kvm_pch_pic_access(void *opaque, bool write)
     int fd = lps->dev_fd;
     int addr, offset;
 
+    if (fd == 0) {
+        return;
+    }
+
     kvm_pch_pic_access_reg(fd, PCH_PIC_INT_MASK, &s->int_mask, write);
     kvm_pch_pic_access_reg(fd, PCH_PIC_HTMSI_EN, &s->htmsi_en, write);
     kvm_pch_pic_access_reg(fd, PCH_PIC_INT_EDGE, &s->intedge, write);

From 74586a2482575776fff5f5f75e0657524c60719d Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Fri, 6 Jun 2025 14:34:31 +0800
Subject: [PATCH 1605/2760] target/loongarch: Report error with split
 kernel_irqchip option

Option kernel_irqchip=split is not supported on LoongArch virt machine,
report error and exit if detect split kernel_irqchip option.

Reviewed-by: Song Gao <gaosong@loongson.cn>
Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Message-ID: <20250606063431.2557468-1-maobibo@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 target/loongarch/kvm/kvm.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/target/loongarch/kvm/kvm.c b/target/loongarch/kvm/kvm.c
index c66bdd5302..c5d488aa42 100644
--- a/target/loongarch/kvm/kvm.c
+++ b/target/loongarch/kvm/kvm.c
@@ -1253,7 +1253,12 @@ int kvm_arch_init(MachineState *ms, KVMState *s)
 
 int kvm_arch_irqchip_create(KVMState *s)
 {
-    return 0;
+    if (kvm_kernel_irqchip_split()) {
+        error_report("kernel_irqchip=split is not supported on LoongArch");
+        exit(1);
+    }
+
+    return kvm_check_extension(s, KVM_CAP_DEVICE_CTRL);
 }
 
 void kvm_arch_pre_run(CPUState *cs, struct kvm_run *run)

From 17fb88a0fa0a13b0e2976a2fe04756337d95fe1f Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Fri, 6 Jun 2025 14:35:23 +0800
Subject: [PATCH 1606/2760] hw/loongarch/virt: Disable emulation with IOCSR
 misc register

Register IOCSR MISC_FUNC_REG is to enable features about EXTIOI
irqchip. If EXTIOI is emulated in kernel, MISC_FUNC_REG register
should be emulated in kernel also.

Reviewed-by: Song Gao <gaosong@loongson.cn>
Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Message-ID: <20250606063523.2557513-1-maobibo@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 hw/loongarch/virt.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/hw/loongarch/virt.c b/hw/loongarch/virt.c
index 34dfbd13e5..e5468b6af9 100644
--- a/hw/loongarch/virt.c
+++ b/hw/loongarch/virt.c
@@ -522,6 +522,10 @@ static MemTxResult virt_iocsr_misc_write(void *opaque, hwaddr addr,
 
     switch (addr) {
     case MISC_FUNC_REG:
+        if (kvm_irqchip_in_kernel()) {
+            return MEMTX_OK;
+        }
+
         if (!virt_is_veiointc_enabled(lvms)) {
             return MEMTX_OK;
         }
@@ -572,6 +576,10 @@ static MemTxResult virt_iocsr_misc_read(void *opaque, hwaddr addr,
         ret = 0x303030354133ULL;     /* "3A5000" */
         break;
     case MISC_FUNC_REG:
+        if (kvm_irqchip_in_kernel()) {
+            return MEMTX_OK;
+        }
+
         if (!virt_is_veiointc_enabled(lvms)) {
             ret |= BIT_ULL(IOCSRM_EXTIOI_EN);
             break;

From 27f5d500c2259650076e3abd72f092b566fd81ac Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Fri, 6 Jun 2025 14:36:07 +0800
Subject: [PATCH 1607/2760] hw/loongarch/virt: Add kernel irqchip support

If kvm_irqchip_in_kernel() return true, interrupt controller
ExtIOI, IPI, PCH_PCI and PCH_MSI should be emlated in kernel. And
it is not necessary to create memory region for these devices in
user space.

Reviewed-by: Song Gao <gaosong@loongson.cn>
Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Message-ID: <20250606063607.2557540-1-maobibo@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 hw/loongarch/virt.c        | 57 ++++++++++++++++++++++----------------
 target/loongarch/cpu.h     |  1 +
 target/loongarch/kvm/kvm.c | 16 +++++++++++
 3 files changed, 50 insertions(+), 24 deletions(-)

diff --git a/hw/loongarch/virt.c b/hw/loongarch/virt.c
index e5468b6af9..b15ada2078 100644
--- a/hw/loongarch/virt.c
+++ b/hw/loongarch/virt.c
@@ -414,12 +414,6 @@ static void virt_irq_init(LoongArchVirtMachineState *lvms)
     lvms->ipi = ipi;
     sysbus_realize_and_unref(SYS_BUS_DEVICE(ipi), &error_fatal);
 
-    /* IPI iocsr memory region */
-    memory_region_add_subregion(&lvms->system_iocsr, SMP_IPI_MAILBOX,
-                   sysbus_mmio_get_region(SYS_BUS_DEVICE(ipi), 0));
-    memory_region_add_subregion(&lvms->system_iocsr, MAIL_SEND_ADDR,
-                   sysbus_mmio_get_region(SYS_BUS_DEVICE(ipi), 1));
-
     /* Create EXTIOI device */
     extioi = qdev_new(TYPE_LOONGARCH_EXTIOI);
     lvms->extioi = extioi;
@@ -427,12 +421,6 @@ static void virt_irq_init(LoongArchVirtMachineState *lvms)
         qdev_prop_set_bit(extioi, "has-virtualization-extension", true);
     }
     sysbus_realize_and_unref(SYS_BUS_DEVICE(extioi), &error_fatal);
-    memory_region_add_subregion(&lvms->system_iocsr, APIC_BASE,
-                    sysbus_mmio_get_region(SYS_BUS_DEVICE(extioi), 0));
-    if (virt_is_veiointc_enabled(lvms)) {
-        memory_region_add_subregion(&lvms->system_iocsr, EXTIOI_VIRT_BASE,
-                    sysbus_mmio_get_region(SYS_BUS_DEVICE(extioi), 1));
-    }
 
     virt_cpu_irq_init(lvms);
     pch_pic = qdev_new(TYPE_LOONGARCH_PIC);
@@ -440,13 +428,6 @@ static void virt_irq_init(LoongArchVirtMachineState *lvms)
     qdev_prop_set_uint32(pch_pic, "pch_pic_irq_num", num);
     d = SYS_BUS_DEVICE(pch_pic);
     sysbus_realize_and_unref(d, &error_fatal);
-    memory_region_add_subregion(get_system_memory(), VIRT_IOAPIC_REG_BASE,
-                            sysbus_mmio_get_region(d, 0));
-
-    /* Connect pch_pic irqs to extioi */
-    for (i = 0; i < num; i++) {
-        qdev_connect_gpio_out(DEVICE(d), i, qdev_get_gpio_in(extioi, i));
-    }
 
     pch_msi = qdev_new(TYPE_LOONGARCH_PCH_MSI);
     start   =  num;
@@ -456,12 +437,40 @@ static void virt_irq_init(LoongArchVirtMachineState *lvms)
     d = SYS_BUS_DEVICE(pch_msi);
     sysbus_realize_and_unref(d, &error_fatal);
     sysbus_mmio_map(d, 0, VIRT_PCH_MSI_ADDR_LOW);
-    for (i = 0; i < num; i++) {
-        /* Connect pch_msi irqs to extioi */
-        qdev_connect_gpio_out(DEVICE(d), i,
-                              qdev_get_gpio_in(extioi, i + start));
-    }
 
+    if (kvm_irqchip_in_kernel()) {
+        kvm_loongarch_init_irq_routing();
+    } else {
+        /* IPI iocsr memory region */
+        memory_region_add_subregion(&lvms->system_iocsr, SMP_IPI_MAILBOX,
+                       sysbus_mmio_get_region(SYS_BUS_DEVICE(ipi), 0));
+        memory_region_add_subregion(&lvms->system_iocsr, MAIL_SEND_ADDR,
+                       sysbus_mmio_get_region(SYS_BUS_DEVICE(ipi), 1));
+
+        /* EXTIOI iocsr memory region */
+        memory_region_add_subregion(&lvms->system_iocsr, APIC_BASE,
+                    sysbus_mmio_get_region(SYS_BUS_DEVICE(extioi), 0));
+        if (virt_is_veiointc_enabled(lvms)) {
+            memory_region_add_subregion(&lvms->system_iocsr, EXTIOI_VIRT_BASE,
+                    sysbus_mmio_get_region(SYS_BUS_DEVICE(extioi), 1));
+        }
+
+        /* PCH_PIC memory region */
+        memory_region_add_subregion(get_system_memory(), VIRT_IOAPIC_REG_BASE,
+                    sysbus_mmio_get_region(SYS_BUS_DEVICE(pch_pic), 0));
+
+        /* Connect pch_pic irqs to extioi */
+        for (i = 0; i < VIRT_PCH_PIC_IRQ_NUM; i++) {
+            qdev_connect_gpio_out(DEVICE(pch_pic), i,
+                                  qdev_get_gpio_in(extioi, i));
+        }
+
+        for (i = VIRT_PCH_PIC_IRQ_NUM; i < EXTIOI_IRQS; i++) {
+            /* Connect pch_msi irqs to extioi */
+            qdev_connect_gpio_out(DEVICE(pch_msi), i - VIRT_PCH_PIC_IRQ_NUM,
+                                  qdev_get_gpio_in(extioi, i));
+        }
+    }
     virt_devices_init(pch_pic, lvms);
 }
 
diff --git a/target/loongarch/cpu.h b/target/loongarch/cpu.h
index 262bf87f7b..9538e8d61d 100644
--- a/target/loongarch/cpu.h
+++ b/target/loongarch/cpu.h
@@ -503,5 +503,6 @@ static inline void kvm_loongarch_cpu_post_init(LoongArchCPU *cpu)
 {
 }
 #endif
+void kvm_loongarch_init_irq_routing(void);
 
 #endif /* LOONGARCH_CPU_H */
diff --git a/target/loongarch/kvm/kvm.c b/target/loongarch/kvm/kvm.c
index c5d488aa42..e5ea2dba9d 100644
--- a/target/loongarch/kvm/kvm.c
+++ b/target/loongarch/kvm/kvm.c
@@ -1240,6 +1240,22 @@ void kvm_arch_init_irq_routing(KVMState *s)
 {
 }
 
+void kvm_loongarch_init_irq_routing(void)
+{
+    int i;
+
+    kvm_async_interrupts_allowed = true;
+    kvm_msi_via_irqfd_allowed = kvm_irqfds_enabled();
+    if (kvm_has_gsi_routing()) {
+        for (i = 0; i < KVM_IRQCHIP_NUM_PINS; ++i) {
+            kvm_irqchip_add_irq_route(kvm_state, i, 0, i);
+        }
+
+        kvm_gsi_routing_allowed = true;
+        kvm_irqchip_commit_routes(kvm_state);
+    }
+}
+
 int kvm_arch_get_default_type(MachineState *ms)
 {
     return 0;

From c2a2e1ad2a749caa864281b1d4dc3f16c3f344f6 Mon Sep 17 00:00:00 2001
From: Song Gao <gaosong@loongson.cn>
Date: Wed, 4 Jun 2025 16:40:05 +0800
Subject: [PATCH 1608/2760] target/loongarch: fix vldi/xvldi raise wrong error

on qemu we got an aborted error
**
ERROR:../target/loongarch/tcg/insn_trans/trans_vec.c.inc:3574:vldi_get_value: code should not be reached
Bail out! ERROR:../target/loongarch/tcg/insn_trans/trans_vec.c.inc:3574:vldi_get_value: code should not be reached
Aborted (core dumped)
but on 3A600/3A5000 we got a "Illegal instruction" error.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2971

Fixes: 29bb5d727ff ("target/loongarch: Implement vldi")
 Cc: qemu-stable@nongnu.org
Reviewed-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 target/loongarch/tcg/insn_trans/trans_vec.c.inc | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/target/loongarch/tcg/insn_trans/trans_vec.c.inc b/target/loongarch/tcg/insn_trans/trans_vec.c.inc
index d6f0560349..78730029cb 100644
--- a/target/loongarch/tcg/insn_trans/trans_vec.c.inc
+++ b/target/loongarch/tcg/insn_trans/trans_vec.c.inc
@@ -3465,7 +3465,7 @@ TRANS(xvmsknz_b, LASX, gen_xx, gen_helper_vmsknz_b)
 static uint64_t vldi_get_value(DisasContext *ctx, uint32_t imm)
 {
     int mode;
-    uint64_t data, t;
+    uint64_t data = 0, t;
 
     /*
      * imm bit [11:8] is mode, mode value is 0-12.
@@ -3570,17 +3570,26 @@ static uint64_t vldi_get_value(DisasContext *ctx, uint32_t imm)
         }
         break;
     default:
-        generate_exception(ctx, EXCCODE_INE);
         g_assert_not_reached();
     }
     return data;
 }
 
+static bool check_valid_vldi_mode(arg_vldi *a)
+{
+   return  extract32(a->imm, 8, 4) <= 12;
+}
+
 static bool gen_vldi(DisasContext *ctx, arg_vldi *a, uint32_t oprsz)
 {
     int sel, vece;
     uint64_t value;
 
+    if (!check_valid_vldi_mode(a)) {
+        generate_exception(ctx, EXCCODE_INE);
+        return true;
+    }
+
     if (!check_vec(ctx, oprsz)) {
         return true;
     }

From 1548c5cdf010f6c89d577402c56eca7169936f48 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 13 Jun 2025 14:51:54 +0200
Subject: [PATCH 1609/2760] rust: prepare variable definitions for multiple
 bindgen invocations

When splitting the QEMU Rust bindings into multiple crates, the
bindgen-generated structs also have to be split so that it's
possible to add "impl" blocks (e.g. for Sync/Send or Default,
or even for utility methods in cases such as VMStateFlags).

Tweak various variable definitions in meson.build, to avoid naming
conflicts once there will be multiple bindgen invocations.

Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 meson.build               | 21 ++++++++++++---------
 rust/meson.build          |  2 +-
 rust/qemu-api/meson.build |  2 +-
 3 files changed, 14 insertions(+), 11 deletions(-)

diff --git a/meson.build b/meson.build
index ed60be2a2d..19ffa9cb34 100644
--- a/meson.build
+++ b/meson.build
@@ -4200,10 +4200,11 @@ foreach target_base_arch, config_base_arch : config_base_arch_mak
 endforeach
 
 if have_rust
+  bindings_incdir = include_directories('.', 'include')
   # We would like to use --generate-cstr, but it is only available
   # starting with bindgen 0.66.0.  The oldest supported versions
   # is 0.60.x (Debian 12 has 0.60.1) which introduces --allowlist-file.
-  bindgen_args = [
+  bindgen_args_common = [
     '--disable-header-comment',
     '--raw-line', '// @generated',
     '--ctypes-prefix', 'std::os::raw',
@@ -4219,20 +4220,22 @@ if have_rust
     ]
   if not rustfmt.found()
     if bindgen.version().version_compare('<0.65.0')
-      bindgen_args += ['--no-rustfmt-bindings']
+      bindgen_args_common += ['--no-rustfmt-bindings']
     else
-      bindgen_args += ['--formatter', 'none']
+      bindgen_args_common += ['--formatter', 'none']
     endif
   endif
   if bindgen.version().version_compare('>=0.66.0')
-    bindgen_args += ['--rust-target', '1.59']
+    bindgen_args_common += ['--rust-target', '1.59']
   endif
   if bindgen.version().version_compare('<0.61.0')
     # default in 0.61+
-    bindgen_args += ['--size_t-is-usize']
+    bindgen_args_common += ['--size_t-is-usize']
   else
-    bindgen_args += ['--merge-extern-blocks']
+    bindgen_args_common += ['--merge-extern-blocks']
   endif
+
+  bindgen_args = []
   c_enums = [
     'DeviceCategory',
     'GpioPolarity',
@@ -4264,13 +4267,13 @@ if have_rust
   # this case you must pass the path to `clang` and `libclang` to your build
   # command invocation using the environment variables CLANG_PATH and
   # LIBCLANG_PATH
-  bindings_rs = rust.bindgen(
+  _qemu_api_bindings_inc_rs = rust.bindgen(
     input: 'rust/wrapper.h',
     dependencies: common_ss.all_dependencies(),
     output: 'bindings.inc.rs',
-    include_directories: include_directories('.', 'include'),
+    include_directories: bindings_incdir,
     bindgen_version: ['>=0.60.0'],
-    args: bindgen_args,
+    args: bindgen_args_common + bindgen_args,
     )
   subdir('rust')
 endif
diff --git a/rust/meson.build b/rust/meson.build
index 99ae7956cd..e9f0879e29 100644
--- a/rust/meson.build
+++ b/rust/meson.build
@@ -33,5 +33,5 @@ if cargo.found()
     command: [config_host['MESON'], 'devenv',
               '--workdir', '@CURRENT_SOURCE_DIR@',
               cargo, 'fmt'],
-    depends: bindings_rs)
+    depends: _qemu_api_bindings_inc_rs)
 endif
diff --git a/rust/qemu-api/meson.build b/rust/qemu-api/meson.build
index 33653b4a28..64c04dfd74 100644
--- a/rust/qemu-api/meson.build
+++ b/rust/qemu-api/meson.build
@@ -32,7 +32,7 @@ _qemu_api_rs = static_library(
       'src/vmstate.rs',
       'src/zeroable.rs',
     ],
-    {'.' : bindings_rs},
+    {'.' : _qemu_api_bindings_inc_rs},
   ),
   override_options: ['rust_std=2021', 'build.rust_std=2021'],
   rust_abi: 'rust',

From 1ae4ca0463d737ead1162c35b267ef5882d42883 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 13 Jun 2025 14:49:27 +0200
Subject: [PATCH 1610/2760] rust: move rust.bindgen to qemu-api crate

Once qemu-api is split in multiple crates, each of them will have
its own invocation of bindgen.  There cannot be only one, because
there are occasional "impl" blocks for the bindgen-generated
structs (e.g. VMStateFlags or QOM classes) that have to
reside in the same crate as the bindgen-generated code.

For now, prepare for this new organization by invoking bindgen
within the qemu-api crate's build definitions; it's also a
much better place to list enums that need specific treatment
from bindgen.

Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 meson.build                   | 41 -----------------------------------
 rust/meson.build              |  4 +++-
 rust/qemu-api/build.rs        |  2 +-
 rust/qemu-api/meson.build     | 41 +++++++++++++++++++++++++++++++++++
 rust/{ => qemu-api}/wrapper.h |  0
 5 files changed, 45 insertions(+), 43 deletions(-)
 rename rust/{ => qemu-api}/wrapper.h (100%)

diff --git a/meson.build b/meson.build
index 19ffa9cb34..4676908dbb 100644
--- a/meson.build
+++ b/meson.build
@@ -4234,47 +4234,6 @@ if have_rust
   else
     bindgen_args_common += ['--merge-extern-blocks']
   endif
-
-  bindgen_args = []
-  c_enums = [
-    'DeviceCategory',
-    'GpioPolarity',
-    'MachineInitPhase',
-    'MemoryDeviceInfoKind',
-    'MigrationPolicy',
-    'MigrationPriority',
-    'QEMUChrEvent',
-    'QEMUClockType',
-    'ResetType',
-    'device_endian',
-    'module_init_type',
-  ]
-  foreach enum : c_enums
-    bindgen_args += ['--rustified-enum', enum]
-  endforeach
-  c_bitfields = [
-    'ClockEvent',
-    'VMStateFlags',
-  ]
-  foreach enum : c_bitfields
-    bindgen_args += ['--bitfield-enum', enum]
-  endforeach
-
-  # TODO: Remove this comment when the clang/libclang mismatch issue is solved.
-  #
-  # Rust bindings generation with `bindgen` might fail in some cases where the
-  # detected `libclang` does not match the expected `clang` version/target. In
-  # this case you must pass the path to `clang` and `libclang` to your build
-  # command invocation using the environment variables CLANG_PATH and
-  # LIBCLANG_PATH
-  _qemu_api_bindings_inc_rs = rust.bindgen(
-    input: 'rust/wrapper.h',
-    dependencies: common_ss.all_dependencies(),
-    output: 'bindings.inc.rs',
-    include_directories: bindings_incdir,
-    bindgen_version: ['>=0.60.0'],
-    args: bindgen_args_common + bindgen_args,
-    )
   subdir('rust')
 endif
 
diff --git a/rust/meson.build b/rust/meson.build
index e9f0879e29..331f11b7e7 100644
--- a/rust/meson.build
+++ b/rust/meson.build
@@ -20,6 +20,8 @@ proc_macro2_rs_native = dependency('proc-macro2-1-rs', native: true)
 
 qemuutil_rs = qemuutil.partial_dependency(link_args: true, links: true)
 
+genrs = []
+
 subdir('qemu-api-macros')
 subdir('bits')
 subdir('qemu-api')
@@ -33,5 +35,5 @@ if cargo.found()
     command: [config_host['MESON'], 'devenv',
               '--workdir', '@CURRENT_SOURCE_DIR@',
               cargo, 'fmt'],
-    depends: _qemu_api_bindings_inc_rs)
+    depends: genrs)
 endif
diff --git a/rust/qemu-api/build.rs b/rust/qemu-api/build.rs
index 1e720641d2..7849486c1b 100644
--- a/rust/qemu-api/build.rs
+++ b/rust/qemu-api/build.rs
@@ -14,7 +14,7 @@ fn main() -> Result<()> {
     let path = env::var("MESON_BUILD_ROOT")
         .unwrap_or_else(|_| format!("{}/src", env!("CARGO_MANIFEST_DIR")));
 
-    let file = format!("{path}/bindings.inc.rs");
+    let file = format!("{path}/rust/qemu-api/bindings.inc.rs");
     let file = Path::new(&file);
     if !Path::new(&file).exists() {
         panic!(concat!(
diff --git a/rust/qemu-api/meson.build b/rust/qemu-api/meson.build
index 64c04dfd74..5b8c7e5e8d 100644
--- a/rust/qemu-api/meson.build
+++ b/rust/qemu-api/meson.build
@@ -7,6 +7,47 @@ if get_option('debug_mutex')
   _qemu_api_cfg += ['--cfg', 'feature="debug_cell"']
 endif
 
+c_enums = [
+  'DeviceCategory',
+  'GpioPolarity',
+  'MachineInitPhase',
+  'MemoryDeviceInfoKind',
+  'MigrationPolicy',
+  'MigrationPriority',
+  'QEMUChrEvent',
+  'QEMUClockType',
+  'ResetType',
+  'device_endian',
+  'module_init_type',
+]
+_qemu_api_bindgen_args = []
+foreach enum : c_enums
+  _qemu_api_bindgen_args += ['--rustified-enum', enum]
+endforeach
+c_bitfields = [
+  'ClockEvent',
+  'VMStateFlags',
+]
+foreach enum : c_bitfields
+  _qemu_api_bindgen_args += ['--bitfield-enum', enum]
+endforeach
+
+# TODO: Remove this comment when the clang/libclang mismatch issue is solved.
+#
+# Rust bindings generation with `bindgen` might fail in some cases where the
+# detected `libclang` does not match the expected `clang` version/target. In
+# this case you must pass the path to `clang` and `libclang` to your build
+# command invocation using the environment variables CLANG_PATH and
+# LIBCLANG_PATH
+_qemu_api_bindings_inc_rs = rust.bindgen(
+  input: 'wrapper.h',
+  dependencies: common_ss.all_dependencies(),
+  output: 'bindings.inc.rs',
+  include_directories: bindings_incdir,
+  bindgen_version: ['>=0.60.0'],
+  args: bindgen_args_common + _qemu_api_bindgen_args,
+  )
+
 _qemu_api_rs = static_library(
   'qemu_api',
   structured_sources(
diff --git a/rust/wrapper.h b/rust/qemu-api/wrapper.h
similarity index 100%
rename from rust/wrapper.h
rename to rust/qemu-api/wrapper.h

From ab81002252af101068fca94bc82b31ba59ff154b Mon Sep 17 00:00:00 2001
From: Bernhard Beschow <shentey@gmail.com>
Date: Sun, 15 Jun 2025 13:20:34 +0200
Subject: [PATCH 1611/2760] rust/qemu-api: Add initial logging support based on
 C API

A log_mask_ln!() macro is provided which expects similar arguments as the
C version. However, the formatting works as one would expect from Rust.

To maximize code reuse the macro is just a thin wrapper around
qemu_log(). Also, just the bare minimum of logging masks is provided
which should suffice for the current use case of Rust in QEMU.

Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Link: https://lore.kernel.org/r/20250615112037.11992-2-shentey@gmail.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 docs/devel/rust.rst          |  1 +
 rust/qemu-api/meson.build    |  1 +
 rust/qemu-api/src/lib.rs     |  1 +
 rust/qemu-api/src/log.rs     | 73 ++++++++++++++++++++++++++++++++++++
 rust/qemu-api/src/prelude.rs |  2 +
 rust/qemu-api/wrapper.h      |  2 +
 6 files changed, 80 insertions(+)
 create mode 100644 rust/qemu-api/src/log.rs

diff --git a/docs/devel/rust.rst b/docs/devel/rust.rst
index 47e9677fcb..dc8c44109e 100644
--- a/docs/devel/rust.rst
+++ b/docs/devel/rust.rst
@@ -162,6 +162,7 @@ module           status
 ``errno``        complete
 ``error``        stable
 ``irq``          complete
+``log``          proof of concept
 ``memory``       stable
 ``module``       complete
 ``qdev``         stable
diff --git a/rust/qemu-api/meson.build b/rust/qemu-api/meson.build
index 5b8c7e5e8d..a090297c45 100644
--- a/rust/qemu-api/meson.build
+++ b/rust/qemu-api/meson.build
@@ -62,6 +62,7 @@ _qemu_api_rs = static_library(
       'src/errno.rs',
       'src/error.rs',
       'src/irq.rs',
+      'src/log.rs',
       'src/memory.rs',
       'src/module.rs',
       'src/prelude.rs',
diff --git a/rust/qemu-api/src/lib.rs b/rust/qemu-api/src/lib.rs
index c78198f0f4..86dcd8ef17 100644
--- a/rust/qemu-api/src/lib.rs
+++ b/rust/qemu-api/src/lib.rs
@@ -21,6 +21,7 @@ pub mod chardev;
 pub mod errno;
 pub mod error;
 pub mod irq;
+pub mod log;
 pub mod memory;
 pub mod module;
 pub mod qdev;
diff --git a/rust/qemu-api/src/log.rs b/rust/qemu-api/src/log.rs
new file mode 100644
index 0000000000..d6c3d6c1b6
--- /dev/null
+++ b/rust/qemu-api/src/log.rs
@@ -0,0 +1,73 @@
+// Copyright 2025 Bernhard Beschow <shentey@gmail.com>
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+//! Bindings for QEMU's logging infrastructure
+
+#[repr(u32)]
+/// Represents specific error categories within QEMU's logging system.
+///
+/// The `Log` enum provides a Rust abstraction for logging errors, corresponding
+/// to a subset of the error categories defined in the C implementation.
+pub enum Log {
+    /// Log invalid access caused by the guest.
+    /// Corresponds to `LOG_GUEST_ERROR` in the C implementation.
+    GuestError = crate::bindings::LOG_GUEST_ERROR,
+
+    /// Log guest access of unimplemented functionality.
+    /// Corresponds to `LOG_UNIMP` in the C implementation.
+    Unimp = crate::bindings::LOG_UNIMP,
+}
+
+/// A macro to log messages conditionally based on a provided mask.
+///
+/// The `log_mask_ln` macro checks whether the given mask matches the current
+/// log level and, if so, formats and logs the message. It is the Rust
+/// counterpart of the `qemu_log_mask()` macro in the C implementation.
+///
+/// # Parameters
+///
+/// - `$mask`: A log level mask. This should be a variant of the `Log` enum.
+/// - `$fmt`: A format string following the syntax and rules of the `format!`
+///   macro. It specifies the structure of the log message.
+/// - `$args`: Optional arguments to be interpolated into the format string.
+///
+/// # Example
+///
+/// ```
+/// use qemu_api::{log::Log, log_mask_ln};
+///
+/// let error_address = 0xbad;
+/// log_mask_ln!(Log::GuestError, "Address 0x{error_address:x} out of range");
+/// ```
+///
+/// It is also possible to use printf-style formatting, as well as having a
+/// trailing `,`:
+///
+/// ```
+/// use qemu_api::{log::Log, log_mask_ln};
+///
+/// let error_address = 0xbad;
+/// log_mask_ln!(
+///     Log::GuestError,
+///     "Address 0x{:x} out of range",
+///     error_address,
+/// );
+/// ```
+#[macro_export]
+macro_rules! log_mask_ln {
+    ($mask:expr, $fmt:tt $($args:tt)*) => {{
+        // Type assertion to enforce type `Log` for $mask
+        let _: Log = $mask;
+
+        if unsafe {
+            (::qemu_api::bindings::qemu_loglevel & ($mask as std::os::raw::c_int)) != 0
+        } {
+            let formatted_string = format!("{}\n", format_args!($fmt $($args)*));
+            let c_string = std::ffi::CString::new(formatted_string).unwrap();
+
+            unsafe {
+                ::qemu_api::bindings::qemu_log(c_string.as_ptr());
+            }
+        }
+    }};
+}
diff --git a/rust/qemu-api/src/prelude.rs b/rust/qemu-api/src/prelude.rs
index 43bfcd5fca..8f9e23ee2c 100644
--- a/rust/qemu-api/src/prelude.rs
+++ b/rust/qemu-api/src/prelude.rs
@@ -11,6 +11,8 @@ pub use crate::cell::BqlRefCell;
 
 pub use crate::errno;
 
+pub use crate::log_mask_ln;
+
 pub use crate::qdev::DeviceMethods;
 
 pub use crate::qom::InterfaceType;
diff --git a/rust/qemu-api/wrapper.h b/rust/qemu-api/wrapper.h
index 6060d3ba1a..15a1b19847 100644
--- a/rust/qemu-api/wrapper.h
+++ b/rust/qemu-api/wrapper.h
@@ -48,6 +48,8 @@ typedef enum memory_order {
 #endif /* __CLANG_STDATOMIC_H */
 
 #include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "qemu/log-for-trace.h"
 #include "qemu/module.h"
 #include "qemu-io.h"
 #include "system/system.h"

From 1563f287dc9c4bc6a50d380095e966ac039ac24a Mon Sep 17 00:00:00 2001
From: Bernhard Beschow <shentey@gmail.com>
Date: Sun, 15 Jun 2025 13:20:35 +0200
Subject: [PATCH 1612/2760] rust: pl011: Implement logging

Now that there is logging support in Rust for QEMU, use it in the pl011
device.

Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Link: https://lore.kernel.org/r/20250615112037.11992-3-shentey@gmail.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/hw/char/pl011/src/device.rs | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/rust/hw/char/pl011/src/device.rs b/rust/hw/char/pl011/src/device.rs
index 2d416cd9a3..92dc295540 100644
--- a/rust/hw/char/pl011/src/device.rs
+++ b/rust/hw/char/pl011/src/device.rs
@@ -8,6 +8,8 @@ use qemu_api::{
     chardev::{CharBackend, Chardev, Event},
     impl_vmstate_forward,
     irq::{IRQState, InterruptSource},
+    log::Log,
+    log_mask_ln,
     memory::{hwaddr, MemoryRegion, MemoryRegionOps, MemoryRegionOpsBuilder},
     prelude::*,
     qdev::{Clock, ClockEvent, DeviceImpl, DeviceState, Property, ResetType, ResettablePhasesImpl},
@@ -276,8 +278,7 @@ impl PL011Registers {
             DMACR => {
                 self.dmacr = value;
                 if value & 3 > 0 {
-                    // qemu_log_mask(LOG_UNIMP, "pl011: DMA not implemented\n");
-                    eprintln!("pl011: DMA not implemented");
+                    log_mask_ln!(Log::Unimp, "pl011: DMA not implemented");
                 }
             }
         }
@@ -534,7 +535,7 @@ impl PL011State {
                 u64::from(device_id[(offset - 0xfe0) >> 2])
             }
             Err(_) => {
-                // qemu_log_mask(LOG_GUEST_ERROR, "pl011_read: Bad offset 0x%x\n", (int)offset);
+                log_mask_ln!(Log::GuestError, "PL011State::read: Bad offset {offset}");
                 0
             }
             Ok(field) => {
@@ -566,7 +567,10 @@ impl PL011State {
                 .borrow_mut()
                 .write(field, value as u32, &self.char_backend);
         } else {
-            eprintln!("write bad offset {offset} value {value}");
+            log_mask_ln!(
+                Log::GuestError,
+                "PL011State::write: Bad offset {offset} value {value}"
+            );
         }
         if update_irq {
             self.update();

From b783601d1a3b3fd468035baf0ce2ead166e0abdc Mon Sep 17 00:00:00 2001
From: Bernhard Beschow <shentey@gmail.com>
Date: Sun, 15 Jun 2025 13:20:36 +0200
Subject: [PATCH 1613/2760] rust: pl011: Add missing logging to match C version

Co-developed-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Link: https://lore.kernel.org/r/20250615112037.11992-4-shentey@gmail.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/hw/char/pl011/src/device.rs | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/rust/hw/char/pl011/src/device.rs b/rust/hw/char/pl011/src/device.rs
index 92dc295540..5b53f2649f 100644
--- a/rust/hw/char/pl011/src/device.rs
+++ b/rust/hw/char/pl011/src/device.rs
@@ -305,6 +305,12 @@ impl PL011Registers {
     }
 
     fn write_data_register(&mut self, value: u32) -> bool {
+        if !self.control.enable_uart() {
+            log_mask_ln!(Log::GuestError, "PL011 data written to disabled UART");
+        }
+        if !self.control.enable_transmit() {
+            log_mask_ln!(Log::GuestError, "PL011 data written to disabled TX UART");
+        }
         // interrupts always checked
         let _ = self.loopback_tx(value.into());
         self.int_level |= Interrupt::TX;

From 6b3fad084fc4e13901e252fe6c2a2c46ecea999b Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Mon, 16 Jun 2025 18:56:49 +0200
Subject: [PATCH 1614/2760] rust: hpet: fix new warning

Nightly rustc complains that HPETAddrDecode has a lifetime but it is not
clearly noted that it comes from &self.  Apply the compiler's suggestion
to shut it up.

Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/hw/timer/hpet/src/device.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rust/hw/timer/hpet/src/device.rs b/rust/hw/timer/hpet/src/device.rs
index a281927781..acf7251029 100644
--- a/rust/hw/timer/hpet/src/device.rs
+++ b/rust/hw/timer/hpet/src/device.rs
@@ -771,7 +771,7 @@ impl HPETState {
         self.rtc_irq_level.set(0);
     }
 
-    fn decode(&self, mut addr: hwaddr, size: u32) -> HPETAddrDecode {
+    fn decode(&self, mut addr: hwaddr, size: u32) -> HPETAddrDecode<'_> {
         let shift = ((addr & 4) * 8) as u32;
         let len = std::cmp::min(size * 8, 64 - shift);
 

From e68ec2980901c8e7f948f3305770962806c53f0b Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Tue, 4 Mar 2025 00:24:49 -0500
Subject: [PATCH 1615/2760] i386/cpu: Move adjustment of CPUID_EXT_PDCM before
 feature_dependencies[] check

There is one entry relates to CPUID_EXT_PDCM in feature_dependencies[].
So it needs to get correct value of CPUID_EXT_PDCM before using
feature_dependencies[] to apply dependencies.

Besides, it also ensures CPUID_EXT_PDCM value is tracked in
env->features[FEAT_1_ECX].

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250304052450.465445-2-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 40aefb38f6..29bce67c3a 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -7349,9 +7349,6 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
         if (threads_per_pkg > 1) {
             *ebx |= threads_per_pkg << 16;
         }
-        if (!cpu->enable_pmu) {
-            *ecx &= ~CPUID_EXT_PDCM;
-        }
         break;
     case 2:
         /* cache info: needed for Pentium Pro compatibility */
@@ -8341,6 +8338,10 @@ void x86_cpu_expand_features(X86CPU *cpu, Error **errp)
         }
     }
 
+    if (!cpu->enable_pmu) {
+        env->features[FEAT_1_ECX] &= ~CPUID_EXT_PDCM;
+    }
+
     for (i = 0; i < ARRAY_SIZE(feature_dependencies); i++) {
         FeatureDep *d = &feature_dependencies[i];
         if (!(env->features[d->from.index] & d->from.mask)) {

From 00268e00027459abede448662f8794d78eb4b0a4 Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Tue, 4 Mar 2025 00:24:50 -0500
Subject: [PATCH 1616/2760] i386/cpu: Warn about why CPUID_EXT_PDCM is not
 available

When user requests PDCM explicitly via "+pdcm" without PMU enabled, emit
a warning to inform the user.

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250304052450.465445-3-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 29bce67c3a..0d35e95430 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -8339,6 +8339,9 @@ void x86_cpu_expand_features(X86CPU *cpu, Error **errp)
     }
 
     if (!cpu->enable_pmu) {
+        mark_unavailable_features(cpu, FEAT_1_ECX,
+                                  env->user_features[FEAT_1_ECX] & CPUID_EXT_PDCM,
+                                  "This feature is not available due to PMU being disabled");
         env->features[FEAT_1_ECX] &= ~CPUID_EXT_PDCM;
     }
 

From 750560f8a832361cf5cc4cd7bc4f56e1e76206f6 Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Thu, 12 Jun 2025 09:38:01 -0400
Subject: [PATCH 1617/2760] i386/tdx: Error and exit when named cpu model is
 requested

Currently, it gets below error when requesting any named cpu model with
"-cpu" to boot a TDX VM:

  qemu-system-x86_64: KVM_TDX_INIT_VM failed: Invalid argument

It misleads people to think it's the bug of KVM or QEMU. It is just that
current QEMU doesn't support named cpu model for TDX.

To support named cpu models for TDX guest, there are opens to be
finalized and needs a mount of additional work.

For now, explicitly check the case when named cpu model is requested.
Error report a hint and exit.

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Link: https://lore.kernel.org/r/20250612133801.2238342-1-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/kvm/tdx.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
index 820ca3614e..2b52de9d71 100644
--- a/target/i386/kvm/tdx.c
+++ b/target/i386/kvm/tdx.c
@@ -739,8 +739,14 @@ static int tdx_kvm_type(X86ConfidentialGuest *cg)
 
 static void tdx_cpu_instance_init(X86ConfidentialGuest *cg, CPUState *cpu)
 {
+    X86CPUClass *xcc = X86_CPU_GET_CLASS(cpu);
     X86CPU *x86cpu = X86_CPU(cpu);
 
+    if (xcc->model) {
+        error_report("Named cpu model is not supported for TDX yet!");
+        exit(1);
+    }
+
     object_property_set_bool(OBJECT(cpu), "pmu", false, &error_abort);
 
     /* invtsc is fixed1 for TD guest */

From 90d2bbd1f6edfa22a056070ee62ded55099cd56d Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Tue, 3 Jun 2025 01:03:03 -0400
Subject: [PATCH 1618/2760] i386/cpu: Rename enable_cpuid_0x1f to
 force_cpuid_0x1f
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The name of "enable_cpuid_0x1f" isn't right to its behavior because the
leaf 0x1f can be enabled even when "enable_cpuid_0x1f" is false.

Rename it to "force_cpuid_0x1f" to better reflect its behavior.

Suggested-by: Igor Mammedov <imammedo@redhat.com>
Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Link: https://lore.kernel.org/r/20250603050305.1704586-2-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.h     | 4 ++--
 target/i386/kvm/tdx.c | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index 5910dcf74d..51e10139df 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -2269,7 +2269,7 @@ struct ArchCPU {
     bool enable_cpuid_0xb;
 
     /* Force to enable cpuid 0x1f */
-    bool enable_cpuid_0x1f;
+    bool force_cpuid_0x1f;
 
     /* Enable auto level-increase for all CPUID leaves */
     bool full_cpuid_auto_level;
@@ -2539,7 +2539,7 @@ void mark_forced_on_features(X86CPU *cpu, FeatureWord w, uint64_t mask,
 
 static inline bool x86_has_cpuid_0x1f(X86CPU *cpu)
 {
-    return cpu->enable_cpuid_0x1f ||
+    return cpu->force_cpuid_0x1f ||
            x86_has_extended_topo(cpu->env.avail_cpu_topo);
 }
 
diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
index 2b52de9d71..acbe749754 100644
--- a/target/i386/kvm/tdx.c
+++ b/target/i386/kvm/tdx.c
@@ -752,7 +752,7 @@ static void tdx_cpu_instance_init(X86ConfidentialGuest *cg, CPUState *cpu)
     /* invtsc is fixed1 for TD guest */
     object_property_set_bool(OBJECT(cpu), "invtsc", true, &error_abort);
 
-    x86cpu->enable_cpuid_0x1f = true;
+    x86cpu->force_cpuid_0x1f = true;
 }
 
 static uint32_t tdx_adjust_cpuid_features(X86ConfidentialGuest *cg,

From a38da9f4876bb17d7ed9c6e24964b12b61877d38 Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Tue, 3 Jun 2025 01:03:04 -0400
Subject: [PATCH 1619/2760] i386/tdx: Fix the typo of the comment of struct
 TdxGuest
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Change sha348 to sha384.

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Link: https://lore.kernel.org/r/20250603050305.1704586-3-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/kvm/tdx.h | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/target/i386/kvm/tdx.h b/target/i386/kvm/tdx.h
index 04b5afe199..8dd66e9014 100644
--- a/target/i386/kvm/tdx.h
+++ b/target/i386/kvm/tdx.h
@@ -40,9 +40,9 @@ typedef struct TdxGuest {
     bool initialized;
     uint64_t attributes;    /* TD attributes */
     uint64_t xfam;
-    char *mrconfigid;       /* base64 encoded sha348 digest */
-    char *mrowner;          /* base64 encoded sha348 digest */
-    char *mrownerconfig;    /* base64 encoded sha348 digest */
+    char *mrconfigid;       /* base64 encoded sha384 digest */
+    char *mrowner;          /* base64 encoded sha384 digest */
+    char *mrownerconfig;    /* base64 encoded sha384 digest */
 
     MemoryRegion *tdvf_mr;
     TdxFirmware tdvf;

From 41cd354d350d3c64915be9c5decbf20abd84e486 Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Tue, 3 Jun 2025 01:03:05 -0400
Subject: [PATCH 1620/2760] i386/tdx: Clarify the error message of
 mrconfigid/mrowner/mrownerconfig
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The error message is misleading - we successfully decoded the data,
the decoded data was simply with the wrong length.

Change the error message to show it is an length check failure with both
the received and expected values.

Suggested-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Link: https://lore.kernel.org/r/20250603050305.1704586-4-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/kvm/tdx.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
index acbe749754..2284167141 100644
--- a/target/i386/kvm/tdx.c
+++ b/target/i386/kvm/tdx.c
@@ -1032,7 +1032,9 @@ int tdx_pre_create_vcpu(CPUState *cpu, Error **errp)
             return -1;
         }
         if (data_len != QCRYPTO_HASH_DIGEST_LEN_SHA384) {
-            error_setg(errp, "TDX: failed to decode mrconfigid");
+            error_setg(errp, "TDX 'mrconfigid' sha384 digest was %ld bytes, "
+                             "expected %d bytes", data_len,
+                             QCRYPTO_HASH_DIGEST_LEN_SHA384);
             return -1;
         }
         memcpy(init_vm->mrconfigid, data, data_len);
@@ -1045,7 +1047,9 @@ int tdx_pre_create_vcpu(CPUState *cpu, Error **errp)
             return -1;
         }
         if (data_len != QCRYPTO_HASH_DIGEST_LEN_SHA384) {
-            error_setg(errp, "TDX: failed to decode mrowner");
+            error_setg(errp, "TDX 'mrowner' sha384 digest was %ld bytes, "
+                             "expected %d bytes", data_len,
+                             QCRYPTO_HASH_DIGEST_LEN_SHA384);
             return -1;
         }
         memcpy(init_vm->mrowner, data, data_len);
@@ -1058,7 +1062,9 @@ int tdx_pre_create_vcpu(CPUState *cpu, Error **errp)
             return -1;
         }
         if (data_len != QCRYPTO_HASH_DIGEST_LEN_SHA384) {
-            error_setg(errp, "TDX: failed to decode mrownerconfig");
+            error_setg(errp, "TDX 'mrownerconfig' sha384 digest was %ld bytes, "
+                             "expected %d bytes", data_len,
+                             QCRYPTO_HASH_DIGEST_LEN_SHA384);
             return -1;
         }
         memcpy(init_vm->mrownerconfig, data, data_len);

From 688b0756ad2fdbe8effdb66f724a1129f62be7a2 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Thu, 19 Jun 2025 20:09:19 +0200
Subject: [PATCH 1621/2760] update Linux headers to v6.16-rc3

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 include/standard-headers/asm-x86/setup_data.h |  13 +-
 include/standard-headers/drm/drm_fourcc.h     |  45 +++++++
 include/standard-headers/linux/ethtool.h      | 124 +++++++++---------
 include/standard-headers/linux/fuse.h         |   6 +-
 .../linux/input-event-codes.h                 |   3 +-
 include/standard-headers/linux/pci_regs.h     |  12 +-
 include/standard-headers/linux/virtio_gpu.h   |   3 +-
 include/standard-headers/linux/virtio_pci.h   |   1 +
 linux-headers/asm-arm64/kvm.h                 |   9 +-
 linux-headers/asm-x86/kvm.h                   |   1 +
 linux-headers/linux/bits.h                    |   4 +-
 linux-headers/linux/kvm.h                     |  25 ++++
 linux-headers/linux/vhost.h                   |   4 +-
 13 files changed, 177 insertions(+), 73 deletions(-)

diff --git a/include/standard-headers/asm-x86/setup_data.h b/include/standard-headers/asm-x86/setup_data.h
index a483d72f42..2e446c1d85 100644
--- a/include/standard-headers/asm-x86/setup_data.h
+++ b/include/standard-headers/asm-x86/setup_data.h
@@ -13,7 +13,8 @@
 #define SETUP_CC_BLOB			7
 #define SETUP_IMA			8
 #define SETUP_RNG_SEED			9
-#define SETUP_ENUM_MAX			SETUP_RNG_SEED
+#define SETUP_KEXEC_KHO			10
+#define SETUP_ENUM_MAX			SETUP_KEXEC_KHO
 
 #define SETUP_INDIRECT			(1<<31)
 #define SETUP_TYPE_MAX			(SETUP_ENUM_MAX | SETUP_INDIRECT)
@@ -78,6 +79,16 @@ struct ima_setup_data {
 	uint64_t size;
 } QEMU_PACKED;
 
+/*
+ * Locations of kexec handover metadata
+ */
+struct kho_data {
+	uint64_t fdt_addr;
+	uint64_t fdt_size;
+	uint64_t scratch_addr;
+	uint64_t scratch_size;
+} QEMU_PACKED;
+
 #endif /* __ASSEMBLER__ */
 
 #endif /* _ASM_X86_SETUP_DATA_H */
diff --git a/include/standard-headers/drm/drm_fourcc.h b/include/standard-headers/drm/drm_fourcc.h
index a8b759dcbc..c8309d378b 100644
--- a/include/standard-headers/drm/drm_fourcc.h
+++ b/include/standard-headers/drm/drm_fourcc.h
@@ -421,6 +421,7 @@ extern "C" {
 #define DRM_FORMAT_MOD_VENDOR_ALLWINNER 0x09
 #define DRM_FORMAT_MOD_VENDOR_AMLOGIC 0x0a
 #define DRM_FORMAT_MOD_VENDOR_MTK     0x0b
+#define DRM_FORMAT_MOD_VENDOR_APPLE   0x0c
 
 /* add more to the end as needed */
 
@@ -1493,6 +1494,50 @@ drm_fourcc_canonicalize_nvidia_format_mod(uint64_t modifier)
 /* alias for the most common tiling format */
 #define DRM_FORMAT_MOD_MTK_16L_32S_TILE  DRM_FORMAT_MOD_MTK(MTK_FMT_MOD_TILE_16L32S)
 
+/*
+ * Apple GPU-tiled layouts.
+ *
+ * Apple GPUs support nonlinear tilings with optional lossless compression.
+ *
+ * GPU-tiled images are divided into 16KiB tiles:
+ *
+ *     Bytes per pixel  Tile size
+ *     ---------------  ---------
+ *                   1  128x128
+ *                   2  128x64
+ *                   4  64x64
+ *                   8  64x32
+ *                  16  32x32
+ *
+ * Tiles are raster-order. Pixels within a tile are interleaved (Morton order).
+ *
+ * Compressed images pad the body to 128-bytes and are immediately followed by a
+ * metadata section. The metadata section rounds the image dimensions to
+ * powers-of-two and contains 8 bytes for each 16x16 compression subtile.
+ * Subtiles are interleaved (Morton order).
+ *
+ * All images are 128-byte aligned.
+ *
+ * These layouts fundamentally do not have meaningful strides. No matter how we
+ * specify strides for these layouts, userspace unaware of Apple image layouts
+ * will be unable to use correctly the specified stride for any purpose.
+ * Userspace aware of the image layouts do not use strides. The most "correct"
+ * convention would be setting the image stride to 0. Unfortunately, some
+ * software assumes the stride is at least (width * bytes per pixel). We
+ * therefore require that stride equals (width * bytes per pixel). Since the
+ * stride is arbitrary here, we pick the simplest convention.
+ *
+ * Although containing two sections, compressed image layouts are treated in
+ * software as a single plane. This is modelled after AFBC, a similar
+ * scheme. Attempting to separate the sections to be "explicit" in DRM would
+ * only generate more confusion, as software does not treat the image this way.
+ *
+ * For detailed information on the hardware image layouts, see
+ * https://docs.mesa3d.org/drivers/asahi.html#image-layouts
+ */
+#define DRM_FORMAT_MOD_APPLE_GPU_TILED fourcc_mod_code(APPLE, 1)
+#define DRM_FORMAT_MOD_APPLE_GPU_TILED_COMPRESSED fourcc_mod_code(APPLE, 2)
+
 /*
  * AMD modifiers
  *
diff --git a/include/standard-headers/linux/ethtool.h b/include/standard-headers/linux/ethtool.h
index 5d1ad5fdea..cef0d207a6 100644
--- a/include/standard-headers/linux/ethtool.h
+++ b/include/standard-headers/linux/ethtool.h
@@ -2295,71 +2295,75 @@ static inline int ethtool_validate_duplex(uint8_t duplex)
 #define	RXH_XFRM_SYM_OR_XOR	(1 << 1)
 #define	RXH_XFRM_NO_CHANGE	0xff
 
-/* L2-L4 network traffic flow types */
-#define	TCP_V4_FLOW	0x01	/* hash or spec (tcp_ip4_spec) */
-#define	UDP_V4_FLOW	0x02	/* hash or spec (udp_ip4_spec) */
-#define	SCTP_V4_FLOW	0x03	/* hash or spec (sctp_ip4_spec) */
-#define	AH_ESP_V4_FLOW	0x04	/* hash only */
-#define	TCP_V6_FLOW	0x05	/* hash or spec (tcp_ip6_spec; nfc only) */
-#define	UDP_V6_FLOW	0x06	/* hash or spec (udp_ip6_spec; nfc only) */
-#define	SCTP_V6_FLOW	0x07	/* hash or spec (sctp_ip6_spec; nfc only) */
-#define	AH_ESP_V6_FLOW	0x08	/* hash only */
-#define	AH_V4_FLOW	0x09	/* hash or spec (ah_ip4_spec) */
-#define	ESP_V4_FLOW	0x0a	/* hash or spec (esp_ip4_spec) */
-#define	AH_V6_FLOW	0x0b	/* hash or spec (ah_ip6_spec; nfc only) */
-#define	ESP_V6_FLOW	0x0c	/* hash or spec (esp_ip6_spec; nfc only) */
-#define	IPV4_USER_FLOW	0x0d	/* spec only (usr_ip4_spec) */
-#define	IP_USER_FLOW	IPV4_USER_FLOW
-#define	IPV6_USER_FLOW	0x0e	/* spec only (usr_ip6_spec; nfc only) */
-#define	IPV4_FLOW	0x10	/* hash only */
-#define	IPV6_FLOW	0x11	/* hash only */
-#define	ETHER_FLOW	0x12	/* spec only (ether_spec) */
+enum {
+	/* L2-L4 network traffic flow types */
+	TCP_V4_FLOW	= 0x01,	/* hash or spec (tcp_ip4_spec) */
+	UDP_V4_FLOW	= 0x02,	/* hash or spec (udp_ip4_spec) */
+	SCTP_V4_FLOW	= 0x03,	/* hash or spec (sctp_ip4_spec) */
+	AH_ESP_V4_FLOW	= 0x04,	/* hash only */
+	TCP_V6_FLOW	= 0x05,	/* hash or spec (tcp_ip6_spec; nfc only) */
+	UDP_V6_FLOW	= 0x06,	/* hash or spec (udp_ip6_spec; nfc only) */
+	SCTP_V6_FLOW	= 0x07,	/* hash or spec (sctp_ip6_spec; nfc only) */
+	AH_ESP_V6_FLOW	= 0x08,	/* hash only */
+	AH_V4_FLOW	= 0x09,	/* hash or spec (ah_ip4_spec) */
+	ESP_V4_FLOW	= 0x0a,	/* hash or spec (esp_ip4_spec) */
+	AH_V6_FLOW	= 0x0b,	/* hash or spec (ah_ip6_spec; nfc only) */
+	ESP_V6_FLOW	= 0x0c,	/* hash or spec (esp_ip6_spec; nfc only) */
+	IPV4_USER_FLOW	= 0x0d,	/* spec only (usr_ip4_spec) */
+	IP_USER_FLOW	= IPV4_USER_FLOW,
+	IPV6_USER_FLOW	= 0x0e, /* spec only (usr_ip6_spec; nfc only) */
+	IPV4_FLOW	= 0x10, /* hash only */
+	IPV6_FLOW	= 0x11, /* hash only */
+	ETHER_FLOW	= 0x12, /* spec only (ether_spec) */
 
-/* Used for GTP-U IPv4 and IPv6.
- * The format of GTP packets only includes
- * elements such as TEID and GTP version.
- * It is primarily intended for data communication of the UE.
- */
-#define GTPU_V4_FLOW 0x13	/* hash only */
-#define GTPU_V6_FLOW 0x14	/* hash only */
+	/* Used for GTP-U IPv4 and IPv6.
+	 * The format of GTP packets only includes
+	 * elements such as TEID and GTP version.
+	 * It is primarily intended for data communication of the UE.
+	 */
+	GTPU_V4_FLOW	= 0x13,	/* hash only */
+	GTPU_V6_FLOW	= 0x14,	/* hash only */
 
-/* Use for GTP-C IPv4 and v6.
- * The format of these GTP packets does not include TEID.
- * Primarily expected to be used for communication
- * to create sessions for UE data communication,
- * commonly referred to as CSR (Create Session Request).
- */
-#define GTPC_V4_FLOW 0x15	/* hash only */
-#define GTPC_V6_FLOW 0x16	/* hash only */
+	/* Use for GTP-C IPv4 and v6.
+	 * The format of these GTP packets does not include TEID.
+	 * Primarily expected to be used for communication
+	 * to create sessions for UE data communication,
+	 * commonly referred to as CSR (Create Session Request).
+	 */
+	GTPC_V4_FLOW	= 0x15,	/* hash only */
+	GTPC_V6_FLOW	= 0x16,	/* hash only */
 
-/* Use for GTP-C IPv4 and v6.
- * Unlike GTPC_V4_FLOW, the format of these GTP packets includes TEID.
- * After session creation, it becomes this packet.
- * This is mainly used for requests to realize UE handover.
- */
-#define GTPC_TEID_V4_FLOW 0x17	/* hash only */
-#define GTPC_TEID_V6_FLOW 0x18	/* hash only */
+	/* Use for GTP-C IPv4 and v6.
+	 * Unlike GTPC_V4_FLOW, the format of these GTP packets includes TEID.
+	 * After session creation, it becomes this packet.
+	 * This is mainly used for requests to realize UE handover.
+	 */
+	GTPC_TEID_V4_FLOW	= 0x17,	/* hash only */
+	GTPC_TEID_V6_FLOW	= 0x18,	/* hash only */
 
-/* Use for GTP-U and extended headers for the PSC (PDU Session Container).
- * The format of these GTP packets includes TEID and QFI.
- * In 5G communication using UPF (User Plane Function),
- * data communication with this extended header is performed.
- */
-#define GTPU_EH_V4_FLOW 0x19	/* hash only */
-#define GTPU_EH_V6_FLOW 0x1a	/* hash only */
+	/* Use for GTP-U and extended headers for the PSC (PDU Session Container).
+	 * The format of these GTP packets includes TEID and QFI.
+	 * In 5G communication using UPF (User Plane Function),
+	 * data communication with this extended header is performed.
+	 */
+	GTPU_EH_V4_FLOW	= 0x19,	/* hash only */
+	GTPU_EH_V6_FLOW	= 0x1a,	/* hash only */
 
-/* Use for GTP-U IPv4 and v6 PSC (PDU Session Container) extended headers.
- * This differs from GTPU_EH_V(4|6)_FLOW in that it is distinguished by
- * UL/DL included in the PSC.
- * There are differences in the data included based on Downlink/Uplink,
- * and can be used to distinguish packets.
- * The functions described so far are useful when you want to
- * handle communication from the mobile network in UPF, PGW, etc.
- */
-#define GTPU_UL_V4_FLOW 0x1b	/* hash only */
-#define GTPU_UL_V6_FLOW 0x1c	/* hash only */
-#define GTPU_DL_V4_FLOW 0x1d	/* hash only */
-#define GTPU_DL_V6_FLOW 0x1e	/* hash only */
+	/* Use for GTP-U IPv4 and v6 PSC (PDU Session Container) extended headers.
+	 * This differs from GTPU_EH_V(4|6)_FLOW in that it is distinguished by
+	 * UL/DL included in the PSC.
+	 * There are differences in the data included based on Downlink/Uplink,
+	 * and can be used to distinguish packets.
+	 * The functions described so far are useful when you want to
+	 * handle communication from the mobile network in UPF, PGW, etc.
+	 */
+	GTPU_UL_V4_FLOW	= 0x1b,	/* hash only */
+	GTPU_UL_V6_FLOW	= 0x1c,	/* hash only */
+	GTPU_DL_V4_FLOW	= 0x1d,	/* hash only */
+	GTPU_DL_V6_FLOW	= 0x1e,	/* hash only */
+
+	__FLOW_TYPE_COUNT,
+};
 
 /* Flag to enable additional fields in struct ethtool_rx_flow_spec */
 #define	FLOW_EXT	0x80000000
diff --git a/include/standard-headers/linux/fuse.h b/include/standard-headers/linux/fuse.h
index a2b5815d89..d8b2fd67e1 100644
--- a/include/standard-headers/linux/fuse.h
+++ b/include/standard-headers/linux/fuse.h
@@ -232,6 +232,9 @@
  *
  *  7.43
  *  - add FUSE_REQUEST_TIMEOUT
+ *
+ *  7.44
+ *  - add FUSE_NOTIFY_INC_EPOCH
  */
 
 #ifndef _LINUX_FUSE_H
@@ -263,7 +266,7 @@
 #define FUSE_KERNEL_VERSION 7
 
 /** Minor version number of this interface */
-#define FUSE_KERNEL_MINOR_VERSION 43
+#define FUSE_KERNEL_MINOR_VERSION 44
 
 /** The node ID of the root inode */
 #define FUSE_ROOT_ID 1
@@ -667,6 +670,7 @@ enum fuse_notify_code {
 	FUSE_NOTIFY_RETRIEVE = 5,
 	FUSE_NOTIFY_DELETE = 6,
 	FUSE_NOTIFY_RESEND = 7,
+	FUSE_NOTIFY_INC_EPOCH = 8,
 	FUSE_NOTIFY_CODE_MAX,
 };
 
diff --git a/include/standard-headers/linux/input-event-codes.h b/include/standard-headers/linux/input-event-codes.h
index 09ba0ad878..a82ff795e0 100644
--- a/include/standard-headers/linux/input-event-codes.h
+++ b/include/standard-headers/linux/input-event-codes.h
@@ -925,7 +925,8 @@
 #define SW_MUTE_DEVICE		0x0e  /* set = device disabled */
 #define SW_PEN_INSERTED		0x0f  /* set = pen inserted */
 #define SW_MACHINE_COVER	0x10  /* set = cover closed */
-#define SW_MAX_			0x10
+#define SW_USB_INSERT		0x11  /* set = USB audio device connected */
+#define SW_MAX_			0x11
 #define SW_CNT			(SW_MAX_+1)
 
 /*
diff --git a/include/standard-headers/linux/pci_regs.h b/include/standard-headers/linux/pci_regs.h
index ba326710f9..a3a3e942de 100644
--- a/include/standard-headers/linux/pci_regs.h
+++ b/include/standard-headers/linux/pci_regs.h
@@ -750,7 +750,8 @@
 #define PCI_EXT_CAP_ID_NPEM	0x29	/* Native PCIe Enclosure Management */
 #define PCI_EXT_CAP_ID_PL_32GT  0x2A    /* Physical Layer 32.0 GT/s */
 #define PCI_EXT_CAP_ID_DOE	0x2E	/* Data Object Exchange */
-#define PCI_EXT_CAP_ID_MAX	PCI_EXT_CAP_ID_DOE
+#define PCI_EXT_CAP_ID_PL_64GT	0x31	/* Physical Layer 64.0 GT/s */
+#define PCI_EXT_CAP_ID_MAX	PCI_EXT_CAP_ID_PL_64GT
 
 #define PCI_EXT_CAP_DSN_SIZEOF	12
 #define PCI_EXT_CAP_MCAST_ENDPOINT_SIZEOF 40
@@ -1144,12 +1145,21 @@
 #define PCI_DLF_CAP		0x04	/* Capabilities Register */
 #define  PCI_DLF_EXCHANGE_ENABLE	0x80000000  /* Data Link Feature Exchange Enable */
 
+/* Secondary PCIe Capability 8.0 GT/s */
+#define PCI_SECPCI_LE_CTRL	0x0c /* Lane Equalization Control Register */
+
 /* Physical Layer 16.0 GT/s */
 #define PCI_PL_16GT_LE_CTRL	0x20	/* Lane Equalization Control Register */
 #define  PCI_PL_16GT_LE_CTRL_DSP_TX_PRESET_MASK		0x0000000F
 #define  PCI_PL_16GT_LE_CTRL_USP_TX_PRESET_MASK		0x000000F0
 #define  PCI_PL_16GT_LE_CTRL_USP_TX_PRESET_SHIFT	4
 
+/* Physical Layer 32.0 GT/s */
+#define PCI_PL_32GT_LE_CTRL	0x20	/* Lane Equalization Control Register */
+
+/* Physical Layer 64.0 GT/s */
+#define PCI_PL_64GT_LE_CTRL	0x20	/* Lane Equalization Control Register */
+
 /* Native PCIe Enclosure Management */
 #define PCI_NPEM_CAP     0x04 /* NPEM capability register */
 #define  PCI_NPEM_CAP_CAPABLE     0x00000001 /* NPEM Capable */
diff --git a/include/standard-headers/linux/virtio_gpu.h b/include/standard-headers/linux/virtio_gpu.h
index 6459fdb9fb..00cd3f04af 100644
--- a/include/standard-headers/linux/virtio_gpu.h
+++ b/include/standard-headers/linux/virtio_gpu.h
@@ -309,8 +309,9 @@ struct virtio_gpu_cmd_submit {
 
 #define VIRTIO_GPU_CAPSET_VIRGL 1
 #define VIRTIO_GPU_CAPSET_VIRGL2 2
-/* 3 is reserved for gfxstream */
+#define VIRTIO_GPU_CAPSET_GFXSTREAM_VULKAN 3
 #define VIRTIO_GPU_CAPSET_VENUS 4
+#define VIRTIO_GPU_CAPSET_CROSS_DOMAIN 5
 #define VIRTIO_GPU_CAPSET_DRM 6
 
 /* VIRTIO_GPU_CMD_GET_CAPSET_INFO */
diff --git a/include/standard-headers/linux/virtio_pci.h b/include/standard-headers/linux/virtio_pci.h
index 91fec6f502..09e964e6ee 100644
--- a/include/standard-headers/linux/virtio_pci.h
+++ b/include/standard-headers/linux/virtio_pci.h
@@ -246,6 +246,7 @@ struct virtio_pci_cfg_cap {
 #define VIRTIO_ADMIN_CMD_LIST_USE	0x1
 
 /* Admin command group type. */
+#define VIRTIO_ADMIN_GROUP_TYPE_SELF	0x0
 #define VIRTIO_ADMIN_GROUP_TYPE_SRIOV	0x1
 
 /* Transitional device admin command. */
diff --git a/linux-headers/asm-arm64/kvm.h b/linux-headers/asm-arm64/kvm.h
index 4e6aff08df..f4d9baafa1 100644
--- a/linux-headers/asm-arm64/kvm.h
+++ b/linux-headers/asm-arm64/kvm.h
@@ -419,10 +419,11 @@ enum {
 
 /* Device Control API on vcpu fd */
 #define KVM_ARM_VCPU_PMU_V3_CTRL	0
-#define   KVM_ARM_VCPU_PMU_V3_IRQ	0
-#define   KVM_ARM_VCPU_PMU_V3_INIT	1
-#define   KVM_ARM_VCPU_PMU_V3_FILTER	2
-#define   KVM_ARM_VCPU_PMU_V3_SET_PMU	3
+#define   KVM_ARM_VCPU_PMU_V3_IRQ		0
+#define   KVM_ARM_VCPU_PMU_V3_INIT		1
+#define   KVM_ARM_VCPU_PMU_V3_FILTER		2
+#define   KVM_ARM_VCPU_PMU_V3_SET_PMU		3
+#define   KVM_ARM_VCPU_PMU_V3_SET_NR_COUNTERS	4
 #define KVM_ARM_VCPU_TIMER_CTRL		1
 #define   KVM_ARM_VCPU_TIMER_IRQ_VTIMER		0
 #define   KVM_ARM_VCPU_TIMER_IRQ_PTIMER		1
diff --git a/linux-headers/asm-x86/kvm.h b/linux-headers/asm-x86/kvm.h
index 7fb57ccb2a..cd275ae76d 100644
--- a/linux-headers/asm-x86/kvm.h
+++ b/linux-headers/asm-x86/kvm.h
@@ -843,6 +843,7 @@ struct kvm_sev_snp_launch_start {
 };
 
 /* Kept in sync with firmware values for simplicity. */
+#define KVM_SEV_PAGE_TYPE_INVALID		0x0
 #define KVM_SEV_SNP_PAGE_TYPE_NORMAL		0x1
 #define KVM_SEV_SNP_PAGE_TYPE_ZERO		0x3
 #define KVM_SEV_SNP_PAGE_TYPE_UNMEASURED	0x4
diff --git a/linux-headers/linux/bits.h b/linux-headers/linux/bits.h
index 58596d18f4..9243f38975 100644
--- a/linux-headers/linux/bits.h
+++ b/linux-headers/linux/bits.h
@@ -4,9 +4,9 @@
 #ifndef _LINUX_BITS_H
 #define _LINUX_BITS_H
 
-#define __GENMASK(h, l) (((~_UL(0)) << (l)) & (~_UL(0) >> (BITS_PER_LONG - 1 - (h))))
+#define __GENMASK(h, l) (((~_UL(0)) << (l)) & (~_UL(0) >> (__BITS_PER_LONG - 1 - (h))))
 
-#define __GENMASK_ULL(h, l) (((~_ULL(0)) << (l)) & (~_ULL(0) >> (BITS_PER_LONG_LONG - 1 - (h))))
+#define __GENMASK_ULL(h, l) (((~_ULL(0)) << (l)) & (~_ULL(0) >> (__BITS_PER_LONG_LONG - 1 - (h))))
 
 #define __GENMASK_U128(h, l) \
 	((_BIT128((h)) << 1) - (_BIT128(l)))
diff --git a/linux-headers/linux/kvm.h b/linux-headers/linux/kvm.h
index 99cc82a275..0690743944 100644
--- a/linux-headers/linux/kvm.h
+++ b/linux-headers/linux/kvm.h
@@ -178,6 +178,7 @@ struct kvm_xen_exit {
 #define KVM_EXIT_NOTIFY           37
 #define KVM_EXIT_LOONGARCH_IOCSR  38
 #define KVM_EXIT_MEMORY_FAULT     39
+#define KVM_EXIT_TDX              40
 
 /* For KVM_EXIT_INTERNAL_ERROR */
 /* Emulate instruction failed. */
@@ -439,6 +440,27 @@ struct kvm_run {
 			__u64 gpa;
 			__u64 size;
 		} memory_fault;
+		/* KVM_EXIT_TDX */
+		struct {
+			__u64 flags;
+			__u64 nr;
+			union {
+				struct {
+					__u64 ret;
+					__u64 data[5];
+				} unknown;
+				struct {
+					__u64 ret;
+					__u64 gpa;
+					__u64 size;
+				} get_quote;
+				struct {
+					__u64 ret;
+					__u64 leaf;
+					__u64 r11, r12, r13, r14;
+				} get_tdvmcall_info;
+			};
+		} tdx;
 		/* Fix the size of the union. */
 		char padding[256];
 	};
@@ -923,6 +945,9 @@ struct kvm_enable_cap {
 #define KVM_CAP_X86_APIC_BUS_CYCLES_NS 237
 #define KVM_CAP_X86_GUEST_MODE 238
 #define KVM_CAP_ARM_WRITABLE_IMP_ID_REGS 239
+#define KVM_CAP_ARM_EL2 240
+#define KVM_CAP_ARM_EL2_E2H0 241
+#define KVM_CAP_RISCV_MP_STATE_RESET 242
 
 struct kvm_irq_routing_irqchip {
 	__u32 irqchip;
diff --git a/linux-headers/linux/vhost.h b/linux-headers/linux/vhost.h
index b95dd84eef..d4b3e2ae13 100644
--- a/linux-headers/linux/vhost.h
+++ b/linux-headers/linux/vhost.h
@@ -28,10 +28,10 @@
 
 /* Set current process as the (exclusive) owner of this file descriptor.  This
  * must be called before any other vhost command.  Further calls to
- * VHOST_OWNER_SET fail until VHOST_OWNER_RESET is called. */
+ * VHOST_SET_OWNER fail until VHOST_RESET_OWNER is called. */
 #define VHOST_SET_OWNER _IO(VHOST_VIRTIO, 0x01)
 /* Give up ownership, and reset the device to default values.
- * Allows subsequent call to VHOST_OWNER_SET to succeed. */
+ * Allows subsequent call to VHOST_SET_OWNER to succeed. */
 #define VHOST_RESET_OWNER _IO(VHOST_VIRTIO, 0x02)
 
 /* Set up/modify memory layout */

From 427b8cf47a6959cd8b0db12bcf66e9009afa2c07 Mon Sep 17 00:00:00 2001
From: Binbin Wu <binbin.wu@linux.intel.com>
Date: Wed, 30 Apr 2025 08:53:14 +0800
Subject: [PATCH 1622/2760] i386/tdx: handle TDG.VP.VMCALL<GetTdVmCallInfo>

Signed-off-by: Binbin Wu <binbin.wu@linux.intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/kvm/kvm.c      | 12 ++++++++++++
 target/i386/kvm/tdx-stub.c |  4 ++++
 target/i386/kvm/tdx.c      | 12 ++++++++++++
 target/i386/kvm/tdx.h      |  9 +++++++++
 4 files changed, 37 insertions(+)

diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
index 56a6b9b638..8ef29fc1fb 100644
--- a/target/i386/kvm/kvm.c
+++ b/target/i386/kvm/kvm.c
@@ -6170,6 +6170,18 @@ int kvm_arch_handle_exit(CPUState *cs, struct kvm_run *run)
             break;
         }
         break;
+    case KVM_EXIT_TDX:
+        /*
+         * run->tdx is already set up for the case where userspace
+         * does not handle the TDVMCALL.
+         */
+        switch (run->tdx.nr) {
+        case TDVMCALL_GET_TD_VM_CALL_INFO:
+            tdx_handle_get_tdvmcall_info(cpu, run);
+            break;
+        }
+        ret = 0;
+        break;
     default:
         fprintf(stderr, "KVM: unknown exit reason %d\n", run->exit_reason);
         ret = -1;
diff --git a/target/i386/kvm/tdx-stub.c b/target/i386/kvm/tdx-stub.c
index 720a4ff046..62a12a0677 100644
--- a/target/i386/kvm/tdx-stub.c
+++ b/target/i386/kvm/tdx-stub.c
@@ -18,3 +18,7 @@ int tdx_handle_report_fatal_error(X86CPU *cpu, struct kvm_run *run)
 {
     return -EINVAL;
 }
+
+void tdx_handle_get_tdvmcall_info(X86CPU *cpu, struct kvm_run *run)
+{
+}
diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
index 2284167141..ef10a19347 100644
--- a/target/i386/kvm/tdx.c
+++ b/target/i386/kvm/tdx.c
@@ -1120,6 +1120,18 @@ int tdx_parse_tdvf(void *flash_ptr, int size)
     return tdvf_parse_metadata(&tdx_guest->tdvf, flash_ptr, size);
 }
 
+void tdx_handle_get_tdvmcall_info(X86CPU *cpu, struct kvm_run *run)
+{
+    if (run->tdx.get_tdvmcall_info.leaf != 1) {
+	return;
+    }
+
+    run->tdx.get_tdvmcall_info.r11 = 0;
+    run->tdx.get_tdvmcall_info.r12 = 0;
+    run->tdx.get_tdvmcall_info.r13 = 0;
+    run->tdx.get_tdvmcall_info.r14 = 0;
+}
+
 static void tdx_panicked_on_fatal_error(X86CPU *cpu, uint64_t error_code,
                                         char *message, uint64_t gpa)
 {
diff --git a/target/i386/kvm/tdx.h b/target/i386/kvm/tdx.h
index 8dd66e9014..0dd41d5811 100644
--- a/target/i386/kvm/tdx.h
+++ b/target/i386/kvm/tdx.h
@@ -21,6 +21,14 @@ typedef struct TdxGuestClass {
 /* TDX requires bus frequency 25MHz */
 #define TDX_APIC_BUS_CYCLES_NS 40
 
+#define TDVMCALL_GET_TD_VM_CALL_INFO    0x10000
+
+#define TDG_VP_VMCALL_SUCCESS           0x0000000000000000ULL
+#define TDG_VP_VMCALL_RETRY             0x0000000000000001ULL
+#define TDG_VP_VMCALL_INVALID_OPERAND   0x8000000000000000ULL
+#define TDG_VP_VMCALL_GPA_INUSE         0x8000000000000001ULL
+#define TDG_VP_VMCALL_ALIGN_ERROR       0x8000000000000002ULL
+
 enum TdxRamType {
     TDX_RAM_UNACCEPTED,
     TDX_RAM_ADDED,
@@ -61,5 +69,6 @@ int tdx_pre_create_vcpu(CPUState *cpu, Error **errp);
 void tdx_set_tdvf_region(MemoryRegion *tdvf_mr);
 int tdx_parse_tdvf(void *flash_ptr, int size);
 int tdx_handle_report_fatal_error(X86CPU *cpu, struct kvm_run *run);
+void tdx_handle_get_tdvmcall_info(X86CPU *cpu, struct kvm_run *run);
 
 #endif /* QEMU_I386_TDX_H */

From 40da501d8989913935660dc24953ece02c9e98b8 Mon Sep 17 00:00:00 2001
From: Isaku Yamahata <isaku.yamahata@intel.com>
Date: Mon, 28 Nov 2022 17:43:52 +0800
Subject: [PATCH 1623/2760] i386/tdx: handle TDG.VP.VMCALL<GetQuote>

Add property "quote-generation-socket" to tdx-guest, which is a property
of type SocketAddress to specify Quote Generation Service(QGS).

On request of GetQuote, it connects to the QGS socket, read request
data from shared guest memory, send the request data to the QGS,
and store the response into shared guest memory, at last notify
TD guest by interrupt.

command line example:
  qemu-system-x86_64 \
    -object '{"qom-type":"tdx-guest","id":"tdx0","quote-generation-socket":{"type":"unix", "path":"/var/run/tdx-qgs/qgs.socket"}}' \
    -machine confidential-guest-support=tdx0

Note, above example uses the unix socket. It can be other types, like vsock,
which depends on the implementation of QGS.

To avoid no response from QGS server, setup a timer for the transaction.
If timeout, make it an error and interrupt guest. Define the threshold of
time to 30s at present, maybe change to other value if not appropriate.

Signed-off-by: Isaku Yamahata <isaku.yamahata@intel.com>
Co-developed-by: Chenyi Qiang <chenyi.qiang@intel.com>
Signed-off-by: Chenyi Qiang <chenyi.qiang@intel.com>
Co-developed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Tested-by: Xiaoyao Li <xiaoyao.li@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 qapi/qom.json                         |   8 +-
 target/i386/kvm/kvm.c                 |   3 +
 target/i386/kvm/meson.build           |   2 +-
 target/i386/kvm/tdx-quote-generator.c | 300 ++++++++++++++++++++++++++
 target/i386/kvm/tdx-quote-generator.h |  82 +++++++
 target/i386/kvm/tdx-stub.c            |   4 +
 target/i386/kvm/tdx.c                 | 176 ++++++++++++++-
 target/i386/kvm/tdx.h                 |  10 +
 8 files changed, 582 insertions(+), 3 deletions(-)
 create mode 100644 target/i386/kvm/tdx-quote-generator.c
 create mode 100644 target/i386/kvm/tdx-quote-generator.h

diff --git a/qapi/qom.json b/qapi/qom.json
index 3e8debf78c..b133b06447 100644
--- a/qapi/qom.json
+++ b/qapi/qom.json
@@ -1071,6 +1071,11 @@
 #     e.g., specific to the workload rather than the run-time or OS
 #     (base64 encoded SHA384 digest).  Defaults to all zeros.
 #
+# @quote-generation-socket: socket address for Quote Generation
+#     Service (QGS).  QGS is a daemon running on the host.  Without
+#     it, the guest will not be able to get a TD quote for
+#     attestation.
+#
 # Since: 10.1
 ##
 { 'struct': 'TdxGuestProperties',
@@ -1078,7 +1083,8 @@
             '*sept-ve-disable': 'bool',
             '*mrconfigid': 'str',
             '*mrowner': 'str',
-            '*mrownerconfig': 'str' } }
+            '*mrownerconfig': 'str',
+            '*quote-generation-socket': 'SocketAddress' } }
 
 ##
 # @ThreadContextProperties:
diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
index 8ef29fc1fb..234878c613 100644
--- a/target/i386/kvm/kvm.c
+++ b/target/i386/kvm/kvm.c
@@ -6176,6 +6176,9 @@ int kvm_arch_handle_exit(CPUState *cs, struct kvm_run *run)
          * does not handle the TDVMCALL.
          */
         switch (run->tdx.nr) {
+        case TDVMCALL_GET_QUOTE:
+            tdx_handle_get_quote(cpu, run);
+            break;
         case TDVMCALL_GET_TD_VM_CALL_INFO:
             tdx_handle_get_tdvmcall_info(cpu, run);
             break;
diff --git a/target/i386/kvm/meson.build b/target/i386/kvm/meson.build
index 3f44cdedb7..2675bf8902 100644
--- a/target/i386/kvm/meson.build
+++ b/target/i386/kvm/meson.build
@@ -8,7 +8,7 @@ i386_kvm_ss.add(files(
 
 i386_kvm_ss.add(when: 'CONFIG_XEN_EMU', if_true: files('xen-emu.c'))
 
-i386_kvm_ss.add(when: 'CONFIG_TDX', if_true: files('tdx.c'), if_false: files('tdx-stub.c'))
+i386_kvm_ss.add(when: 'CONFIG_TDX', if_true: files('tdx.c', 'tdx-quote-generator.c'), if_false: files('tdx-stub.c'))
 
 i386_system_ss.add(when: 'CONFIG_HYPERV', if_true: files('hyperv.c'), if_false: files('hyperv-stub.c'))
 
diff --git a/target/i386/kvm/tdx-quote-generator.c b/target/i386/kvm/tdx-quote-generator.c
new file mode 100644
index 0000000000..f59715f617
--- /dev/null
+++ b/target/i386/kvm/tdx-quote-generator.c
@@ -0,0 +1,300 @@
+/*
+ * QEMU TDX Quote Generation Support
+ *
+ * Copyright (c) 2025 Intel Corporation
+ *
+ * Author:
+ *      Xiaoyao Li <xiaoyao.li@intel.com>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/error-report.h"
+#include "qapi/error.h"
+#include "qapi/qapi-visit-sockets.h"
+
+#include "tdx-quote-generator.h"
+
+#define QGS_MSG_LIB_MAJOR_VER 1
+#define QGS_MSG_LIB_MINOR_VER 1
+
+typedef enum _qgs_msg_type_t {
+    GET_QUOTE_REQ = 0,
+    GET_QUOTE_RESP = 1,
+    GET_COLLATERAL_REQ = 2,
+    GET_COLLATERAL_RESP = 3,
+    GET_PLATFORM_INFO_REQ = 4,
+    GET_PLATFORM_INFO_RESP = 5,
+    QGS_MSG_TYPE_MAX
+} qgs_msg_type_t;
+
+typedef struct _qgs_msg_header_t {
+    uint16_t major_version;
+    uint16_t minor_version;
+    uint32_t type;
+    uint32_t size;              // size of the whole message, include this header, in byte
+    uint32_t error_code;        // used in response only
+} qgs_msg_header_t;
+
+typedef struct _qgs_msg_get_quote_req_t {
+    qgs_msg_header_t header;    // header.type = GET_QUOTE_REQ
+    uint32_t report_size;       // cannot be 0
+    uint32_t id_list_size;      // length of id_list, in byte, can be 0
+} qgs_msg_get_quote_req_t;
+
+typedef struct _qgs_msg_get_quote_resp_s {
+    qgs_msg_header_t header;    // header.type = GET_QUOTE_RESP
+    uint32_t selected_id_size;  // can be 0 in case only one id is sent in request
+    uint32_t quote_size;        // length of quote_data, in byte
+    uint8_t id_quote[];         // selected id followed by quote
+} qgs_msg_get_quote_resp_t;
+
+#define HEADER_SIZE 4
+
+static uint32_t decode_header(const char *buf, size_t len) {
+    if (len < HEADER_SIZE) {
+        return 0;
+    }
+    uint32_t msg_size = 0;
+    for (uint32_t i = 0; i < HEADER_SIZE; ++i) {
+        msg_size = msg_size * 256 + (buf[i] & 0xFF);
+    }
+    return msg_size;
+}
+
+static void encode_header(char *buf, size_t len, uint32_t size) {
+    assert(len >= HEADER_SIZE);
+    buf[0] = ((size >> 24) & 0xFF);
+    buf[1] = ((size >> 16) & 0xFF);
+    buf[2] = ((size >> 8) & 0xFF);
+    buf[3] = (size & 0xFF);
+}
+
+static void tdx_generate_quote_cleanup(TdxGenerateQuoteTask *task)
+{
+    timer_del(&task->timer);
+
+    g_source_remove(task->watch);
+    qio_channel_close(QIO_CHANNEL(task->sioc), NULL);
+    object_unref(OBJECT(task->sioc));
+
+    task->completion(task);
+}
+
+static gboolean tdx_get_quote_read(QIOChannel *ioc, GIOCondition condition,
+                                   gpointer opaque)
+{
+    TdxGenerateQuoteTask *task = opaque;
+    Error *err = NULL;
+    int ret;
+
+    ret = qio_channel_read(ioc, task->receive_buf + task->receive_buf_received,
+                           task->payload_len - task->receive_buf_received, &err);
+    if (ret < 0) {
+        if (ret == QIO_CHANNEL_ERR_BLOCK) {
+            return G_SOURCE_CONTINUE;
+        } else {
+            error_report_err(err);
+            task->status_code = TDX_VP_GET_QUOTE_ERROR;
+            goto end;
+        }
+    }
+
+    if (ret == 0) {
+        error_report("End of file before reply received");
+        task->status_code = TDX_VP_GET_QUOTE_ERROR;
+        goto end;
+    }
+
+    task->receive_buf_received += ret;
+    if (task->receive_buf_received >= HEADER_SIZE) {
+        uint32_t len = decode_header(task->receive_buf,
+                                     task->receive_buf_received);
+        if (len == 0 ||
+            len > (task->payload_len - HEADER_SIZE)) {
+            error_report("Message len %u must be non-zero & less than %zu",
+                         len, (task->payload_len - HEADER_SIZE));
+            task->status_code = TDX_VP_GET_QUOTE_ERROR;
+            goto end;
+        }
+
+        /* Now we know the size, shrink to fit */
+        task->payload_len = HEADER_SIZE + len;
+        task->receive_buf = g_renew(char,
+                                    task->receive_buf,
+                                    task->payload_len);
+    }
+
+    if (task->receive_buf_received >= (sizeof(qgs_msg_header_t) + HEADER_SIZE)) {
+        qgs_msg_header_t *hdr = (qgs_msg_header_t *)(task->receive_buf + HEADER_SIZE);
+        if (hdr->major_version != QGS_MSG_LIB_MAJOR_VER ||
+            hdr->minor_version != QGS_MSG_LIB_MINOR_VER) {
+            error_report("Invalid QGS message header version %d.%d",
+                         hdr->major_version,
+                         hdr->minor_version);
+            task->status_code = TDX_VP_GET_QUOTE_ERROR;
+            goto end;
+        }
+        if (hdr->type != GET_QUOTE_RESP) {
+            error_report("Invalid QGS message type %d",
+                         hdr->type);
+            task->status_code = TDX_VP_GET_QUOTE_ERROR;
+            goto end;
+        }
+        if (hdr->size > (task->payload_len - HEADER_SIZE)) {
+            error_report("QGS message size %d exceeds payload capacity %zu",
+                         hdr->size, task->payload_len);
+            task->status_code = TDX_VP_GET_QUOTE_ERROR;
+            goto end;
+        }
+        if (hdr->error_code != 0) {
+            error_report("QGS message error code %d",
+                         hdr->error_code);
+            task->status_code = TDX_VP_GET_QUOTE_ERROR;
+            goto end;
+        }
+    }
+    if (task->receive_buf_received >= (sizeof(qgs_msg_get_quote_resp_t) + HEADER_SIZE)) {
+        qgs_msg_get_quote_resp_t *msg = (qgs_msg_get_quote_resp_t *)(task->receive_buf + HEADER_SIZE);
+        if (msg->selected_id_size != 0) {
+            error_report("QGS message selected ID was %d not 0",
+                         msg->selected_id_size);
+            task->status_code = TDX_VP_GET_QUOTE_ERROR;
+            goto end;
+        }
+
+        if ((task->payload_len - HEADER_SIZE - sizeof(qgs_msg_get_quote_resp_t)) !=
+            msg->quote_size) {
+            error_report("QGS quote size %d should be %zu",
+                         msg->quote_size,
+                         (task->payload_len - sizeof(qgs_msg_get_quote_resp_t)));
+            task->status_code = TDX_VP_GET_QUOTE_ERROR;
+            goto end;
+        }
+    }
+
+    if (task->receive_buf_received == task->payload_len) {
+        size_t strip = HEADER_SIZE + sizeof(qgs_msg_get_quote_resp_t);
+        memmove(task->receive_buf,
+                task->receive_buf + strip,
+                task->receive_buf_received - strip);
+        task->receive_buf_received -= strip;
+        task->status_code = TDX_VP_GET_QUOTE_SUCCESS;
+        goto end;
+    }
+
+    return G_SOURCE_CONTINUE;
+
+end:
+    tdx_generate_quote_cleanup(task);
+    return G_SOURCE_REMOVE;
+}
+
+static gboolean tdx_send_report(QIOChannel *ioc, GIOCondition condition,
+                                gpointer opaque)
+{
+    TdxGenerateQuoteTask *task = opaque;
+    Error *err = NULL;
+    int ret;
+
+    ret = qio_channel_write(ioc, task->send_data + task->send_data_sent,
+                            task->send_data_size - task->send_data_sent, &err);
+    if (ret < 0) {
+        if (ret == QIO_CHANNEL_ERR_BLOCK) {
+            ret = 0;
+        } else {
+            error_report_err(err);
+            task->status_code = TDX_VP_GET_QUOTE_ERROR;
+            tdx_generate_quote_cleanup(task);
+            goto end;
+        }
+    }
+    task->send_data_sent += ret;
+
+    if (task->send_data_sent == task->send_data_size) {
+        task->watch = qio_channel_add_watch(QIO_CHANNEL(task->sioc), G_IO_IN,
+                                            tdx_get_quote_read, task, NULL);
+        goto end;
+    }
+
+    return G_SOURCE_CONTINUE;
+
+end:
+    return G_SOURCE_REMOVE;
+}
+
+static void tdx_quote_generator_connected(QIOTask *qio_task, gpointer opaque)
+{
+    TdxGenerateQuoteTask *task = opaque;
+    Error *err = NULL;
+    int ret;
+
+    ret = qio_task_propagate_error(qio_task, &err);
+    if (ret) {
+        error_report_err(err);
+        task->status_code = TDX_VP_GET_QUOTE_QGS_UNAVAILABLE;
+        tdx_generate_quote_cleanup(task);
+        return;
+    }
+
+    task->watch = qio_channel_add_watch(QIO_CHANNEL(task->sioc), G_IO_OUT,
+                                        tdx_send_report, task, NULL);
+}
+
+#define TRANSACTION_TIMEOUT 30000
+
+static void getquote_expired(void *opaque)
+{
+    TdxGenerateQuoteTask *task = opaque;
+
+    task->status_code = TDX_VP_GET_QUOTE_ERROR;
+    tdx_generate_quote_cleanup(task);
+}
+
+static void setup_get_quote_timer(TdxGenerateQuoteTask *task)
+{
+    int64_t time;
+
+    timer_init_ms(&task->timer, QEMU_CLOCK_VIRTUAL, getquote_expired, task);
+    time = qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL);
+    timer_mod(&task->timer, time + TRANSACTION_TIMEOUT);
+}
+
+void tdx_generate_quote(TdxGenerateQuoteTask *task,
+                        SocketAddress *qg_sock_addr)
+{
+    QIOChannelSocket *sioc;
+    qgs_msg_get_quote_req_t msg;
+
+    /* Prepare a QGS message prelude */
+    msg.header.major_version = QGS_MSG_LIB_MAJOR_VER;
+    msg.header.minor_version = QGS_MSG_LIB_MINOR_VER;
+    msg.header.type = GET_QUOTE_REQ;
+    msg.header.size = sizeof(msg) + task->send_data_size;
+    msg.header.error_code = 0;
+    msg.report_size = task->send_data_size;
+    msg.id_list_size = 0;
+
+    /* Make room to add the QGS message prelude */
+    task->send_data = g_renew(char,
+                              task->send_data,
+                              task->send_data_size + sizeof(msg) + HEADER_SIZE);
+    memmove(task->send_data + sizeof(msg) + HEADER_SIZE,
+            task->send_data,
+            task->send_data_size);
+    memcpy(task->send_data + HEADER_SIZE,
+           &msg,
+           sizeof(msg));
+    encode_header(task->send_data, HEADER_SIZE, task->send_data_size + sizeof(msg));
+    task->send_data_size += sizeof(msg) + HEADER_SIZE;
+
+    sioc = qio_channel_socket_new();
+    task->sioc = sioc;
+
+    setup_get_quote_timer(task);
+
+    qio_channel_socket_connect_async(sioc, qg_sock_addr,
+                                     tdx_quote_generator_connected, task,
+                                     NULL, NULL);
+}
diff --git a/target/i386/kvm/tdx-quote-generator.h b/target/i386/kvm/tdx-quote-generator.h
new file mode 100644
index 0000000000..3bd9b8ef33
--- /dev/null
+++ b/target/i386/kvm/tdx-quote-generator.h
@@ -0,0 +1,82 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#ifndef QEMU_I386_TDX_QUOTE_GENERATOR_H
+#define QEMU_I386_TDX_QUOTE_GENERATOR_H
+
+#include "qom/object_interfaces.h"
+#include "io/channel-socket.h"
+#include "exec/hwaddr.h"
+
+#define TDX_GET_QUOTE_STRUCTURE_VERSION         1ULL
+
+#define TDX_VP_GET_QUOTE_SUCCESS                0ULL
+#define TDX_VP_GET_QUOTE_IN_FLIGHT              (-1ULL)
+#define TDX_VP_GET_QUOTE_ERROR                  0x8000000000000000ULL
+#define TDX_VP_GET_QUOTE_QGS_UNAVAILABLE        0x8000000000000001ULL
+
+/* Limit to avoid resource starvation. */
+#define TDX_GET_QUOTE_MAX_BUF_LEN       (128 * 1024)
+#define TDX_MAX_GET_QUOTE_REQUEST       16
+
+#define TDX_GET_QUOTE_HDR_SIZE          24
+
+/* Format of pages shared with guest. */
+struct tdx_get_quote_header {
+    /* Format version: must be 1 in little endian. */
+    uint64_t structure_version;
+
+    /*
+     * GetQuote status code in little endian:
+     *   Guest must set error_code to 0 to avoid information leak.
+     *   Qemu sets this before interrupting guest.
+     */
+    uint64_t error_code;
+
+    /*
+     * in-message size in little endian: The message will follow this header.
+     * The in-message will be send to QGS.
+     */
+    uint32_t in_len;
+
+    /*
+     * out-message size in little endian:
+     * On request, out_len must be zero to avoid information leak.
+     * On return, message size from QGS. Qemu overwrites this field.
+     * The message will follows this header.  The in-message is overwritten.
+     */
+    uint32_t out_len;
+
+    /*
+     * Message buffer follows.
+     * Guest sets message that will be send to QGS.  If out_len > in_len, guest
+     * should zero remaining buffer to avoid information leak.
+     * Qemu overwrites this buffer with a message returned from QGS.
+     */
+};
+
+typedef struct TdxGenerateQuoteTask {
+    hwaddr buf_gpa;
+    hwaddr payload_gpa;
+    uint64_t payload_len;
+
+    char *send_data;
+    uint64_t send_data_size;
+    uint64_t send_data_sent;
+
+    char *receive_buf;
+    uint64_t receive_buf_received;
+
+    uint64_t status_code;
+    struct tdx_get_quote_header hdr;
+
+    QIOChannelSocket *sioc;
+    guint watch;
+    QEMUTimer timer;
+
+    void (*completion)(struct TdxGenerateQuoteTask *task);
+    void *opaque;
+} TdxGenerateQuoteTask;
+
+void tdx_generate_quote(TdxGenerateQuoteTask *task, SocketAddress *qg_sock_addr);
+
+#endif /* QEMU_I386_TDX_QUOTE_GENERATOR_H */
diff --git a/target/i386/kvm/tdx-stub.c b/target/i386/kvm/tdx-stub.c
index 62a12a0677..76fee49eff 100644
--- a/target/i386/kvm/tdx-stub.c
+++ b/target/i386/kvm/tdx-stub.c
@@ -19,6 +19,10 @@ int tdx_handle_report_fatal_error(X86CPU *cpu, struct kvm_run *run)
     return -EINVAL;
 }
 
+void tdx_handle_get_quote(X86CPU *cpu, struct kvm_run *run)
+{
+}
+
 void tdx_handle_get_tdvmcall_info(X86CPU *cpu, struct kvm_run *run)
 {
 }
diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
index ef10a19347..e809e4b2df 100644
--- a/target/i386/kvm/tdx.c
+++ b/target/i386/kvm/tdx.c
@@ -14,12 +14,14 @@
 #include "qemu/base64.h"
 #include "qemu/mmap-alloc.h"
 #include "qapi/error.h"
+#include "qapi/qapi-visit-sockets.h"
 #include "qom/object_interfaces.h"
 #include "crypto/hash.h"
 #include "system/kvm_int.h"
 #include "system/runstate.h"
 #include "system/system.h"
 #include "system/ramblock.h"
+#include "system/address-spaces.h"
 
 #include <linux/kvm_para.h>
 
@@ -32,6 +34,7 @@
 #include "hw/i386/tdvf-hob.h"
 #include "kvm_i386.h"
 #include "tdx.h"
+#include "tdx-quote-generator.h"
 
 #include "standard-headers/asm-x86/kvm_para.h"
 
@@ -1120,13 +1123,146 @@ int tdx_parse_tdvf(void *flash_ptr, int size)
     return tdvf_parse_metadata(&tdx_guest->tdvf, flash_ptr, size);
 }
 
+static void tdx_get_quote_completion(TdxGenerateQuoteTask *task)
+{
+    TdxGuest *tdx = task->opaque;
+    int ret;
+
+    /* Maintain the number of in-flight requests. */
+    qemu_mutex_lock(&tdx->lock);
+    tdx->num--;
+    qemu_mutex_unlock(&tdx->lock);
+
+    if (task->status_code == TDX_VP_GET_QUOTE_SUCCESS) {
+        ret = address_space_write(&address_space_memory, task->payload_gpa,
+                                  MEMTXATTRS_UNSPECIFIED, task->receive_buf,
+                                  task->receive_buf_received);
+        if (ret != MEMTX_OK) {
+            error_report("TDX: get-quote: failed to write quote data.");
+        } else {
+            task->hdr.out_len = cpu_to_le64(task->receive_buf_received);
+        }
+    }
+    task->hdr.error_code = cpu_to_le64(task->status_code);
+
+    /* Publish the response contents before marking this request completed. */
+    smp_wmb();
+    ret = address_space_write(&address_space_memory, task->buf_gpa,
+                              MEMTXATTRS_UNSPECIFIED, &task->hdr,
+                              TDX_GET_QUOTE_HDR_SIZE);
+    if (ret != MEMTX_OK) {
+        error_report("TDX: get-quote: failed to update GetQuote header.");
+    }
+
+    g_free(task->send_data);
+    g_free(task->receive_buf);
+    g_free(task);
+    object_unref(tdx);
+}
+
+void tdx_handle_get_quote(X86CPU *cpu, struct kvm_run *run)
+{
+    TdxGenerateQuoteTask *task;
+    struct tdx_get_quote_header hdr;
+    hwaddr buf_gpa = run->tdx.get_quote.gpa;
+    uint64_t buf_len = run->tdx.get_quote.size;
+
+    QEMU_BUILD_BUG_ON(sizeof(struct tdx_get_quote_header) != TDX_GET_QUOTE_HDR_SIZE);
+
+    run->tdx.get_quote.ret = TDG_VP_VMCALL_INVALID_OPERAND;
+
+    if (buf_len == 0) {
+        return;
+    }
+
+    if (!QEMU_IS_ALIGNED(buf_gpa, 4096) || !QEMU_IS_ALIGNED(buf_len, 4096)) {
+        run->tdx.get_quote.ret = TDG_VP_VMCALL_ALIGN_ERROR;
+        return;
+    }
+
+    if (address_space_read(&address_space_memory, buf_gpa, MEMTXATTRS_UNSPECIFIED,
+                           &hdr, TDX_GET_QUOTE_HDR_SIZE) != MEMTX_OK) {
+        error_report("TDX: get-quote: failed to read GetQuote header.");
+        return;
+    }
+
+    if (le64_to_cpu(hdr.structure_version) != TDX_GET_QUOTE_STRUCTURE_VERSION) {
+        return;
+    }
+
+    /* Only safe-guard check to avoid too large buffer size. */
+    if (buf_len > TDX_GET_QUOTE_MAX_BUF_LEN ||
+        le32_to_cpu(hdr.in_len) > buf_len - TDX_GET_QUOTE_HDR_SIZE) {
+        return;
+    }
+
+    if (!tdx_guest->qg_sock_addr) {
+        hdr.error_code = cpu_to_le64(TDX_VP_GET_QUOTE_QGS_UNAVAILABLE);
+        if (address_space_write(&address_space_memory, buf_gpa,
+                                MEMTXATTRS_UNSPECIFIED,
+                                &hdr, TDX_GET_QUOTE_HDR_SIZE) != MEMTX_OK) {
+            error_report("TDX: failed to update GetQuote header.");
+            return;
+        }
+        run->tdx.get_quote.ret = TDG_VP_VMCALL_SUCCESS;
+        return;
+    }
+
+    qemu_mutex_lock(&tdx_guest->lock);
+    if (tdx_guest->num >= TDX_MAX_GET_QUOTE_REQUEST) {
+        qemu_mutex_unlock(&tdx_guest->lock);
+        run->tdx.get_quote.ret = TDG_VP_VMCALL_RETRY;
+        return;
+    }
+    tdx_guest->num++;
+    qemu_mutex_unlock(&tdx_guest->lock);
+
+    task = g_new(TdxGenerateQuoteTask, 1);
+    task->buf_gpa = buf_gpa;
+    task->payload_gpa = buf_gpa + TDX_GET_QUOTE_HDR_SIZE;
+    task->payload_len = buf_len - TDX_GET_QUOTE_HDR_SIZE;
+    task->hdr = hdr;
+    task->completion = tdx_get_quote_completion;
+
+    task->send_data_size = le32_to_cpu(hdr.in_len);
+    task->send_data = g_malloc(task->send_data_size);
+    task->send_data_sent = 0;
+
+    if (address_space_read(&address_space_memory, task->payload_gpa,
+                           MEMTXATTRS_UNSPECIFIED, task->send_data,
+                           task->send_data_size) != MEMTX_OK) {
+        goto out_free;
+    }
+
+    /* Mark the buffer in-flight. */
+    hdr.error_code = cpu_to_le64(TDX_VP_GET_QUOTE_IN_FLIGHT);
+    if (address_space_write(&address_space_memory, buf_gpa,
+                            MEMTXATTRS_UNSPECIFIED,
+                            &hdr, TDX_GET_QUOTE_HDR_SIZE) != MEMTX_OK) {
+        goto out_free;
+    }
+
+    task->receive_buf = g_malloc0(task->payload_len);
+    task->receive_buf_received = 0;
+    task->opaque = tdx_guest;
+
+    object_ref(tdx_guest);
+    tdx_generate_quote(task, tdx_guest->qg_sock_addr);
+    run->tdx.get_quote.ret = TDG_VP_VMCALL_SUCCESS;
+    return;
+
+out_free:
+    g_free(task->send_data);
+    g_free(task);
+}
+
 void tdx_handle_get_tdvmcall_info(X86CPU *cpu, struct kvm_run *run)
 {
     if (run->tdx.get_tdvmcall_info.leaf != 1) {
 	return;
     }
 
-    run->tdx.get_tdvmcall_info.r11 = 0;
+    run->tdx.get_tdvmcall_info.r11 = TDG_VP_VMCALL_SUBFUNC_GET_QUOTE;
     run->tdx.get_tdvmcall_info.r12 = 0;
     run->tdx.get_tdvmcall_info.r13 = 0;
     run->tdx.get_tdvmcall_info.r14 = 0;
@@ -1263,6 +1399,37 @@ static void tdx_guest_set_mrownerconfig(Object *obj, const char *value, Error **
     tdx->mrownerconfig = g_strdup(value);
 }
 
+static void tdx_guest_get_qgs(Object *obj, Visitor *v,
+                              const char *name, void *opaque,
+                              Error **errp)
+{
+    TdxGuest *tdx = TDX_GUEST(obj);
+
+    if (!tdx->qg_sock_addr) {
+        error_setg(errp, "quote-generation-socket is not set");
+        return;
+    }
+    visit_type_SocketAddress(v, name, &tdx->qg_sock_addr, errp);
+}
+
+static void tdx_guest_set_qgs(Object *obj, Visitor *v,
+                              const char *name, void *opaque,
+                              Error **errp)
+{
+    TdxGuest *tdx = TDX_GUEST(obj);
+    SocketAddress *sock = NULL;
+
+    if (!visit_type_SocketAddress(v, name, &sock, errp)) {
+        return;
+    }
+
+    if (tdx->qg_sock_addr) {
+        qapi_free_SocketAddress(tdx->qg_sock_addr);
+    }
+
+    tdx->qg_sock_addr = sock;
+}
+
 /* tdx guest */
 OBJECT_DEFINE_TYPE_WITH_INTERFACES(TdxGuest,
                                    tdx_guest,
@@ -1294,6 +1461,13 @@ static void tdx_guest_init(Object *obj)
     object_property_add_str(obj, "mrownerconfig",
                             tdx_guest_get_mrownerconfig,
                             tdx_guest_set_mrownerconfig);
+
+    object_property_add(obj, "quote-generation-socket", "SocketAddress",
+                            tdx_guest_get_qgs,
+                            tdx_guest_set_qgs,
+                            NULL, NULL);
+
+    qemu_mutex_init(&tdx->lock);
 }
 
 static void tdx_guest_finalize(Object *obj)
diff --git a/target/i386/kvm/tdx.h b/target/i386/kvm/tdx.h
index 0dd41d5811..35a09c19c5 100644
--- a/target/i386/kvm/tdx.h
+++ b/target/i386/kvm/tdx.h
@@ -11,6 +11,8 @@
 #include "cpu.h"
 #include "hw/i386/tdvf.h"
 
+#include "tdx-quote-generator.h"
+
 #define TYPE_TDX_GUEST "tdx-guest"
 #define TDX_GUEST(obj)  OBJECT_CHECK(TdxGuest, (obj), TYPE_TDX_GUEST)
 
@@ -22,6 +24,7 @@ typedef struct TdxGuestClass {
 #define TDX_APIC_BUS_CYCLES_NS 40
 
 #define TDVMCALL_GET_TD_VM_CALL_INFO    0x10000
+#define TDVMCALL_GET_QUOTE		 0x10002
 
 #define TDG_VP_VMCALL_SUCCESS           0x0000000000000000ULL
 #define TDG_VP_VMCALL_RETRY             0x0000000000000001ULL
@@ -29,6 +32,8 @@ typedef struct TdxGuestClass {
 #define TDG_VP_VMCALL_GPA_INUSE         0x8000000000000001ULL
 #define TDG_VP_VMCALL_ALIGN_ERROR       0x8000000000000002ULL
 
+#define TDG_VP_VMCALL_SUBFUNC_GET_QUOTE 0x0000000000000001ULL
+
 enum TdxRamType {
     TDX_RAM_UNACCEPTED,
     TDX_RAM_ADDED,
@@ -57,6 +62,10 @@ typedef struct TdxGuest {
 
     uint32_t nr_ram_entries;
     TdxRamEntry *ram_entries;
+
+    /* GetQuote */
+    SocketAddress *qg_sock_addr;
+    int num;
 } TdxGuest;
 
 #ifdef CONFIG_TDX
@@ -69,6 +78,7 @@ int tdx_pre_create_vcpu(CPUState *cpu, Error **errp);
 void tdx_set_tdvf_region(MemoryRegion *tdvf_mr);
 int tdx_parse_tdvf(void *flash_ptr, int size);
 int tdx_handle_report_fatal_error(X86CPU *cpu, struct kvm_run *run);
+void tdx_handle_get_quote(X86CPU *cpu, struct kvm_run *run);
 void tdx_handle_get_tdvmcall_info(X86CPU *cpu, struct kvm_run *run);
 
 #endif /* QEMU_I386_TDX_H */

From e14236b30bc5c65ccf37daa63b8258ebb9a839f9 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 6 Mar 2024 11:44:59 -1000
Subject: [PATCH 1624/2760] tcg: Add dbase argument to do_dup_store

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tcg-op-gvec.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/tcg/tcg-op-gvec.c b/tcg/tcg-op-gvec.c
index d32a4f146d..1aad7b0864 100644
--- a/tcg/tcg-op-gvec.c
+++ b/tcg/tcg-op-gvec.c
@@ -483,8 +483,8 @@ static TCGType choose_vector_type(const TCGOpcode *list, unsigned vece,
     return 0;
 }
 
-static void do_dup_store(TCGType type, uint32_t dofs, uint32_t oprsz,
-                         uint32_t maxsz, TCGv_vec t_vec)
+static void do_dup_store(TCGType type, TCGv_ptr dbase, uint32_t dofs,
+                         uint32_t oprsz, uint32_t maxsz, TCGv_vec t_vec)
 {
     uint32_t i = 0;
 
@@ -496,7 +496,7 @@ static void do_dup_store(TCGType type, uint32_t dofs, uint32_t oprsz,
      * are misaligned wrt the maximum vector size, so do that first.
      */
     if (dofs & 8) {
-        tcg_gen_stl_vec(t_vec, tcg_env, dofs + i, TCG_TYPE_V64);
+        tcg_gen_stl_vec(t_vec, dbase, dofs + i, TCG_TYPE_V64);
         i += 8;
     }
 
@@ -508,17 +508,17 @@ static void do_dup_store(TCGType type, uint32_t dofs, uint32_t oprsz,
          * that e.g. size == 80 would be expanded with 2x32 + 1x16.
          */
         for (; i + 32 <= oprsz; i += 32) {
-            tcg_gen_stl_vec(t_vec, tcg_env, dofs + i, TCG_TYPE_V256);
+            tcg_gen_stl_vec(t_vec, dbase, dofs + i, TCG_TYPE_V256);
         }
         /* fallthru */
     case TCG_TYPE_V128:
         for (; i + 16 <= oprsz; i += 16) {
-            tcg_gen_stl_vec(t_vec, tcg_env, dofs + i, TCG_TYPE_V128);
+            tcg_gen_stl_vec(t_vec, dbase, dofs + i, TCG_TYPE_V128);
         }
         break;
     case TCG_TYPE_V64:
         for (; i < oprsz; i += 8) {
-            tcg_gen_stl_vec(t_vec, tcg_env, dofs + i, TCG_TYPE_V64);
+            tcg_gen_stl_vec(t_vec, dbase, dofs + i, TCG_TYPE_V64);
         }
         break;
     default:
@@ -574,7 +574,7 @@ static void do_dup(unsigned vece, uint32_t dofs, uint32_t oprsz,
         } else {
             tcg_gen_dupi_vec(vece, t_vec, in_c);
         }
-        do_dup_store(type, dofs, oprsz, maxsz, t_vec);
+        do_dup_store(type, tcg_env, dofs, oprsz, maxsz, t_vec);
         return;
     }
 
@@ -1731,7 +1731,7 @@ void tcg_gen_gvec_dup_mem(unsigned vece, uint32_t dofs, uint32_t aofs,
         if (type != 0) {
             TCGv_vec t_vec = tcg_temp_new_vec(type);
             tcg_gen_dup_mem_vec(vece, t_vec, tcg_env, aofs);
-            do_dup_store(type, dofs, oprsz, maxsz, t_vec);
+            do_dup_store(type, tcg_env, dofs, oprsz, maxsz, t_vec);
         } else if (vece <= MO_32) {
             TCGv_i32 in = tcg_temp_ebb_new_i32();
             switch (vece) {

From 731422ebbdaebd4a88c9df4072e19dee2ead70fe Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 6 Mar 2024 11:50:41 -1000
Subject: [PATCH 1625/2760] tcg: Add dbase argument to do_dup

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tcg-op-gvec.c | 33 +++++++++++++++++----------------
 1 file changed, 17 insertions(+), 16 deletions(-)

diff --git a/tcg/tcg-op-gvec.c b/tcg/tcg-op-gvec.c
index 1aad7b0864..b100dd66ab 100644
--- a/tcg/tcg-op-gvec.c
+++ b/tcg/tcg-op-gvec.c
@@ -530,13 +530,14 @@ static void do_dup_store(TCGType type, TCGv_ptr dbase, uint32_t dofs,
     }
 }
 
-/* Set OPRSZ bytes at DOFS to replications of IN_32, IN_64 or IN_C.
+/*
+ * Set OPRSZ bytes at DBASE + DOFS to replications of IN_32, IN_64 or IN_C.
  * Only one of IN_32 or IN_64 may be set;
  * IN_C is used if IN_32 and IN_64 are unset.
  */
-static void do_dup(unsigned vece, uint32_t dofs, uint32_t oprsz,
-                   uint32_t maxsz, TCGv_i32 in_32, TCGv_i64 in_64,
-                   uint64_t in_c)
+static void do_dup(unsigned vece, TCGv_ptr dbase, uint32_t dofs,
+                   uint32_t oprsz, uint32_t maxsz,
+                   TCGv_i32 in_32, TCGv_i64 in_64, uint64_t in_c)
 {
     TCGType type;
     TCGv_i64 t_64;
@@ -574,7 +575,7 @@ static void do_dup(unsigned vece, uint32_t dofs, uint32_t oprsz,
         } else {
             tcg_gen_dupi_vec(vece, t_vec, in_c);
         }
-        do_dup_store(type, tcg_env, dofs, oprsz, maxsz, t_vec);
+        do_dup_store(type, dbase, dofs, oprsz, maxsz, t_vec);
         return;
     }
 
@@ -618,14 +619,14 @@ static void do_dup(unsigned vece, uint32_t dofs, uint32_t oprsz,
         /* Implement inline if we picked an implementation size above.  */
         if (t_32) {
             for (i = 0; i < oprsz; i += 4) {
-                tcg_gen_st_i32(t_32, tcg_env, dofs + i);
+                tcg_gen_st_i32(t_32, dbase, dofs + i);
             }
             tcg_temp_free_i32(t_32);
             goto done;
         }
         if (t_64) {
             for (i = 0; i < oprsz; i += 8) {
-                tcg_gen_st_i64(t_64, tcg_env, dofs + i);
+                tcg_gen_st_i64(t_64, dbase, dofs + i);
             }
             tcg_temp_free_i64(t_64);
             goto done;
@@ -634,7 +635,7 @@ static void do_dup(unsigned vece, uint32_t dofs, uint32_t oprsz,
 
     /* Otherwise implement out of line.  */
     t_ptr = tcg_temp_ebb_new_ptr();
-    tcg_gen_addi_ptr(t_ptr, tcg_env, dofs);
+    tcg_gen_addi_ptr(t_ptr, dbase, dofs);
 
     /*
      * This may be expand_clr for the tail of an operation, e.g.
@@ -710,7 +711,7 @@ static void do_dup(unsigned vece, uint32_t dofs, uint32_t oprsz,
 /* Likewise, but with zero.  */
 static void expand_clr(uint32_t dofs, uint32_t maxsz)
 {
-    do_dup(MO_8, dofs, maxsz, maxsz, NULL, NULL, 0);
+    do_dup(MO_8, tcg_env, dofs, maxsz, maxsz, NULL, NULL, 0);
 }
 
 /* Expand OPSZ bytes worth of two-operand operations using i32 elements.  */
@@ -1711,7 +1712,7 @@ void tcg_gen_gvec_dup_i32(unsigned vece, uint32_t dofs, uint32_t oprsz,
 {
     check_size_align(oprsz, maxsz, dofs);
     tcg_debug_assert(vece <= MO_32);
-    do_dup(vece, dofs, oprsz, maxsz, in, NULL, 0);
+    do_dup(vece, tcg_env, dofs, oprsz, maxsz, in, NULL, 0);
 }
 
 void tcg_gen_gvec_dup_i64(unsigned vece, uint32_t dofs, uint32_t oprsz,
@@ -1719,7 +1720,7 @@ void tcg_gen_gvec_dup_i64(unsigned vece, uint32_t dofs, uint32_t oprsz,
 {
     check_size_align(oprsz, maxsz, dofs);
     tcg_debug_assert(vece <= MO_64);
-    do_dup(vece, dofs, oprsz, maxsz, NULL, in, 0);
+    do_dup(vece, tcg_env, dofs, oprsz, maxsz, NULL, in, 0);
 }
 
 void tcg_gen_gvec_dup_mem(unsigned vece, uint32_t dofs, uint32_t aofs,
@@ -1745,12 +1746,12 @@ void tcg_gen_gvec_dup_mem(unsigned vece, uint32_t dofs, uint32_t aofs,
                 tcg_gen_ld_i32(in, tcg_env, aofs);
                 break;
             }
-            do_dup(vece, dofs, oprsz, maxsz, in, NULL, 0);
+            do_dup(vece, tcg_env, dofs, oprsz, maxsz, in, NULL, 0);
             tcg_temp_free_i32(in);
         } else {
             TCGv_i64 in = tcg_temp_ebb_new_i64();
             tcg_gen_ld_i64(in, tcg_env, aofs);
-            do_dup(vece, dofs, oprsz, maxsz, NULL, in, 0);
+            do_dup(vece, tcg_env, dofs, oprsz, maxsz, NULL, in, 0);
             tcg_temp_free_i64(in);
         }
     } else if (vece == 4) {
@@ -1833,7 +1834,7 @@ void tcg_gen_gvec_dup_imm(unsigned vece, uint32_t dofs, uint32_t oprsz,
                           uint32_t maxsz, uint64_t x)
 {
     check_size_align(oprsz, maxsz, dofs);
-    do_dup(vece, dofs, oprsz, maxsz, NULL, NULL, x);
+    do_dup(vece, tcg_env, dofs, oprsz, maxsz, NULL, NULL, x);
 }
 
 void tcg_gen_gvec_not(unsigned vece, uint32_t dofs, uint32_t aofs,
@@ -3772,7 +3773,7 @@ void tcg_gen_gvec_cmp(TCGCond cond, unsigned vece, uint32_t dofs,
     check_overlap_3(dofs, aofs, bofs, maxsz);
 
     if (cond == TCG_COND_NEVER || cond == TCG_COND_ALWAYS) {
-        do_dup(MO_8, dofs, oprsz, maxsz,
+        do_dup(MO_8, tcg_env, dofs, oprsz, maxsz,
                NULL, NULL, -(cond == TCG_COND_ALWAYS));
         return;
     }
@@ -3892,7 +3893,7 @@ void tcg_gen_gvec_cmps(TCGCond cond, unsigned vece, uint32_t dofs,
     check_overlap_2(dofs, aofs, maxsz);
 
     if (cond == TCG_COND_NEVER || cond == TCG_COND_ALWAYS) {
-        do_dup(MO_8, dofs, oprsz, maxsz,
+        do_dup(MO_8, tcg_env, dofs, oprsz, maxsz,
                NULL, NULL, -(cond == TCG_COND_ALWAYS));
         return;
     }

From ca09b6b5e556f343b8a7bfd8913c51786844830e Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 6 Mar 2024 11:56:27 -1000
Subject: [PATCH 1626/2760] tcg: Add dbase argument to expand_clr

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tcg-op-gvec.c | 36 ++++++++++++++++++------------------
 1 file changed, 18 insertions(+), 18 deletions(-)

diff --git a/tcg/tcg-op-gvec.c b/tcg/tcg-op-gvec.c
index b100dd66ab..f5edadb992 100644
--- a/tcg/tcg-op-gvec.c
+++ b/tcg/tcg-op-gvec.c
@@ -380,7 +380,7 @@ static inline bool check_size_impl(uint32_t oprsz, uint32_t lnsz)
     return q <= MAX_UNROLL;
 }
 
-static void expand_clr(uint32_t dofs, uint32_t maxsz);
+static void expand_clr(TCGv_ptr dbase, uint32_t dofs, uint32_t maxsz);
 
 /* Duplicate C as per VECE.  */
 uint64_t (dup_const)(unsigned vece, uint64_t c)
@@ -526,7 +526,7 @@ static void do_dup_store(TCGType type, TCGv_ptr dbase, uint32_t dofs,
     }
 
     if (oprsz < maxsz) {
-        expand_clr(dofs + oprsz, maxsz - oprsz);
+        expand_clr(dbase, dofs + oprsz, maxsz - oprsz);
     }
 }
 
@@ -704,14 +704,14 @@ static void do_dup(unsigned vece, TCGv_ptr dbase, uint32_t dofs,
 
  done:
     if (oprsz < maxsz) {
-        expand_clr(dofs + oprsz, maxsz - oprsz);
+        expand_clr(dbase, dofs + oprsz, maxsz - oprsz);
     }
 }
 
 /* Likewise, but with zero.  */
-static void expand_clr(uint32_t dofs, uint32_t maxsz)
+static void expand_clr(TCGv_ptr dbase, uint32_t dofs, uint32_t maxsz)
 {
-    do_dup(MO_8, tcg_env, dofs, maxsz, maxsz, NULL, NULL, 0);
+    do_dup(MO_8, dbase, dofs, maxsz, maxsz, NULL, NULL, 0);
 }
 
 /* Expand OPSZ bytes worth of two-operand operations using i32 elements.  */
@@ -1256,7 +1256,7 @@ void tcg_gen_gvec_2(uint32_t dofs, uint32_t aofs,
     tcg_swap_vecop_list(hold_list);
 
     if (oprsz < maxsz) {
-        expand_clr(dofs + oprsz, maxsz - oprsz);
+        expand_clr(tcg_env, dofs + oprsz, maxsz - oprsz);
     }
 }
 
@@ -1325,7 +1325,7 @@ void tcg_gen_gvec_2i(uint32_t dofs, uint32_t aofs, uint32_t oprsz,
     tcg_swap_vecop_list(hold_list);
 
     if (oprsz < maxsz) {
-        expand_clr(dofs + oprsz, maxsz - oprsz);
+        expand_clr(tcg_env, dofs + oprsz, maxsz - oprsz);
     }
 }
 
@@ -1402,7 +1402,7 @@ void tcg_gen_gvec_2s(uint32_t dofs, uint32_t aofs, uint32_t oprsz,
     }
 
     if (oprsz < maxsz) {
-        expand_clr(dofs + oprsz, maxsz - oprsz);
+        expand_clr(tcg_env, dofs + oprsz, maxsz - oprsz);
     }
 }
 
@@ -1468,7 +1468,7 @@ void tcg_gen_gvec_3(uint32_t dofs, uint32_t aofs, uint32_t bofs,
     tcg_swap_vecop_list(hold_list);
 
     if (oprsz < maxsz) {
-        expand_clr(dofs + oprsz, maxsz - oprsz);
+        expand_clr(tcg_env, dofs + oprsz, maxsz - oprsz);
     }
 }
 
@@ -1537,7 +1537,7 @@ void tcg_gen_gvec_3i(uint32_t dofs, uint32_t aofs, uint32_t bofs,
     tcg_swap_vecop_list(hold_list);
 
     if (oprsz < maxsz) {
-        expand_clr(dofs + oprsz, maxsz - oprsz);
+        expand_clr(tcg_env, dofs + oprsz, maxsz - oprsz);
     }
 }
 
@@ -1606,7 +1606,7 @@ void tcg_gen_gvec_4(uint32_t dofs, uint32_t aofs, uint32_t bofs, uint32_t cofs,
     tcg_swap_vecop_list(hold_list);
 
     if (oprsz < maxsz) {
-        expand_clr(dofs + oprsz, maxsz - oprsz);
+        expand_clr(tcg_env, dofs + oprsz, maxsz - oprsz);
     }
 }
 
@@ -1675,7 +1675,7 @@ void tcg_gen_gvec_4i(uint32_t dofs, uint32_t aofs, uint32_t bofs, uint32_t cofs,
     tcg_swap_vecop_list(hold_list);
 
     if (oprsz < maxsz) {
-        expand_clr(dofs + oprsz, maxsz - oprsz);
+        expand_clr(tcg_env, dofs + oprsz, maxsz - oprsz);
     }
 }
 
@@ -1702,7 +1702,7 @@ void tcg_gen_gvec_mov(unsigned vece, uint32_t dofs, uint32_t aofs,
     } else {
         check_size_align(oprsz, maxsz, dofs);
         if (oprsz < maxsz) {
-            expand_clr(dofs + oprsz, maxsz - oprsz);
+            expand_clr(tcg_env, dofs + oprsz, maxsz - oprsz);
         }
     }
 }
@@ -1780,7 +1780,7 @@ void tcg_gen_gvec_dup_mem(unsigned vece, uint32_t dofs, uint32_t aofs,
             tcg_temp_free_i64(in1);
         }
         if (oprsz < maxsz) {
-            expand_clr(dofs + oprsz, maxsz - oprsz);
+            expand_clr(tcg_env, dofs + oprsz, maxsz - oprsz);
         }
     } else if (vece == 5) {
         /* 256-bit duplicate.  */
@@ -1823,7 +1823,7 @@ void tcg_gen_gvec_dup_mem(unsigned vece, uint32_t dofs, uint32_t aofs,
             }
         }
         if (oprsz < maxsz) {
-            expand_clr(dofs + oprsz, maxsz - oprsz);
+            expand_clr(tcg_env, dofs + oprsz, maxsz - oprsz);
         }
     } else {
         g_assert_not_reached();
@@ -3256,7 +3256,7 @@ do_gvec_shifts(unsigned vece, uint32_t dofs, uint32_t aofs, TCGv_i32 shift,
 
  clear_tail:
     if (oprsz < maxsz) {
-        expand_clr(dofs + oprsz, maxsz - oprsz);
+        expand_clr(tcg_env, dofs + oprsz, maxsz - oprsz);
     }
 }
 
@@ -3835,7 +3835,7 @@ void tcg_gen_gvec_cmp(TCGCond cond, unsigned vece, uint32_t dofs,
     tcg_swap_vecop_list(hold_list);
 
     if (oprsz < maxsz) {
-        expand_clr(dofs + oprsz, maxsz - oprsz);
+        expand_clr(tcg_env, dofs + oprsz, maxsz - oprsz);
     }
 }
 
@@ -3976,7 +3976,7 @@ void tcg_gen_gvec_cmps(TCGCond cond, unsigned vece, uint32_t dofs,
     }
 
     if (oprsz < maxsz) {
-        expand_clr(dofs + oprsz, maxsz - oprsz);
+        expand_clr(tcg_env, dofs + oprsz, maxsz - oprsz);
     }
 }
 

From 872dab5b7ec4722aaa7791820425e460466ddf71 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 6 Mar 2024 13:41:03 -1000
Subject: [PATCH 1627/2760] tcg: Add base arguments to check_overlap_[234]

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tcg-op-gvec.c | 61 ++++++++++++++++++++++++++++-------------------
 1 file changed, 36 insertions(+), 25 deletions(-)

diff --git a/tcg/tcg-op-gvec.c b/tcg/tcg-op-gvec.c
index f5edadb992..0e6b42476e 100644
--- a/tcg/tcg-op-gvec.c
+++ b/tcg/tcg-op-gvec.c
@@ -57,30 +57,39 @@ static void check_size_align(uint32_t oprsz, uint32_t maxsz, uint32_t ofs)
     tcg_debug_assert((ofs & max_align) == 0);
 }
 
-/* Verify vector overlap rules for two operands.  */
-static void check_overlap_2(uint32_t d, uint32_t a, uint32_t s)
+/*
+ * Verify vector overlap rules for two operands.
+ * When dbase and abase are not the same pointer, we cannot check for
+ * overlap at compile-time, but the runtime restrictions remain.
+ */
+static void check_overlap_2(TCGv_ptr dbase, uint32_t d,
+                            TCGv_ptr abase, uint32_t a, uint32_t s)
 {
-    tcg_debug_assert(d == a || d + s <= a || a + s <= d);
+    tcg_debug_assert(dbase != abase || d == a || d + s <= a || a + s <= d);
 }
 
 /* Verify vector overlap rules for three operands.  */
-static void check_overlap_3(uint32_t d, uint32_t a, uint32_t b, uint32_t s)
+static void check_overlap_3(TCGv_ptr dbase, uint32_t d,
+                            TCGv_ptr abase, uint32_t a,
+                            TCGv_ptr bbase, uint32_t b, uint32_t s)
 {
-    check_overlap_2(d, a, s);
-    check_overlap_2(d, b, s);
-    check_overlap_2(a, b, s);
+    check_overlap_2(dbase, d, abase, a, s);
+    check_overlap_2(dbase, d, bbase, b, s);
+    check_overlap_2(abase, a, bbase, b, s);
 }
 
 /* Verify vector overlap rules for four operands.  */
-static void check_overlap_4(uint32_t d, uint32_t a, uint32_t b,
-                            uint32_t c, uint32_t s)
+static void check_overlap_4(TCGv_ptr dbase, uint32_t d,
+                            TCGv_ptr abase, uint32_t a,
+                            TCGv_ptr bbase, uint32_t b,
+                            TCGv_ptr cbase, uint32_t c, uint32_t s)
 {
-    check_overlap_2(d, a, s);
-    check_overlap_2(d, b, s);
-    check_overlap_2(d, c, s);
-    check_overlap_2(a, b, s);
-    check_overlap_2(a, c, s);
-    check_overlap_2(b, c, s);
+    check_overlap_2(dbase, d, abase, a, s);
+    check_overlap_2(dbase, d, bbase, b, s);
+    check_overlap_2(dbase, d, cbase, c, s);
+    check_overlap_2(abase, a, bbase, b, s);
+    check_overlap_2(abase, a, cbase, c, s);
+    check_overlap_2(bbase, b, cbase, c, s);
 }
 
 /* Create a descriptor from components.  */
@@ -1206,7 +1215,7 @@ void tcg_gen_gvec_2(uint32_t dofs, uint32_t aofs,
     uint32_t some;
 
     check_size_align(oprsz, maxsz, dofs | aofs);
-    check_overlap_2(dofs, aofs, maxsz);
+    check_overlap_2(tcg_env, dofs, tcg_env, aofs, maxsz);
 
     type = 0;
     if (g->fniv) {
@@ -1270,7 +1279,7 @@ void tcg_gen_gvec_2i(uint32_t dofs, uint32_t aofs, uint32_t oprsz,
     uint32_t some;
 
     check_size_align(oprsz, maxsz, dofs | aofs);
-    check_overlap_2(dofs, aofs, maxsz);
+    check_overlap_2(tcg_env, dofs, tcg_env, aofs, maxsz);
 
     type = 0;
     if (g->fniv) {
@@ -1336,7 +1345,7 @@ void tcg_gen_gvec_2s(uint32_t dofs, uint32_t aofs, uint32_t oprsz,
     TCGType type;
 
     check_size_align(oprsz, maxsz, dofs | aofs);
-    check_overlap_2(dofs, aofs, maxsz);
+    check_overlap_2(tcg_env, dofs, tcg_env, aofs, maxsz);
 
     type = 0;
     if (g->fniv) {
@@ -1416,7 +1425,7 @@ void tcg_gen_gvec_3(uint32_t dofs, uint32_t aofs, uint32_t bofs,
     uint32_t some;
 
     check_size_align(oprsz, maxsz, dofs | aofs | bofs);
-    check_overlap_3(dofs, aofs, bofs, maxsz);
+    check_overlap_3(tcg_env, dofs, tcg_env, aofs, tcg_env, bofs, maxsz);
 
     type = 0;
     if (g->fniv) {
@@ -1483,7 +1492,7 @@ void tcg_gen_gvec_3i(uint32_t dofs, uint32_t aofs, uint32_t bofs,
     uint32_t some;
 
     check_size_align(oprsz, maxsz, dofs | aofs | bofs);
-    check_overlap_3(dofs, aofs, bofs, maxsz);
+    check_overlap_3(tcg_env, dofs, tcg_env, aofs, tcg_env, bofs, maxsz);
 
     type = 0;
     if (g->fniv) {
@@ -1551,7 +1560,8 @@ void tcg_gen_gvec_4(uint32_t dofs, uint32_t aofs, uint32_t bofs, uint32_t cofs,
     uint32_t some;
 
     check_size_align(oprsz, maxsz, dofs | aofs | bofs | cofs);
-    check_overlap_4(dofs, aofs, bofs, cofs, maxsz);
+    check_overlap_4(tcg_env, dofs, tcg_env, aofs,
+                    tcg_env, bofs, tcg_env, cofs, maxsz);
 
     type = 0;
     if (g->fniv) {
@@ -1621,7 +1631,8 @@ void tcg_gen_gvec_4i(uint32_t dofs, uint32_t aofs, uint32_t bofs, uint32_t cofs,
     uint32_t some;
 
     check_size_align(oprsz, maxsz, dofs | aofs | bofs | cofs);
-    check_overlap_4(dofs, aofs, bofs, cofs, maxsz);
+    check_overlap_4(tcg_env, dofs, tcg_env, aofs,
+                    tcg_env, bofs, tcg_env, cofs, maxsz);
 
     type = 0;
     if (g->fniv) {
@@ -3150,7 +3161,7 @@ do_gvec_shifts(unsigned vece, uint32_t dofs, uint32_t aofs, TCGv_i32 shift,
     uint32_t some;
 
     check_size_align(oprsz, maxsz, dofs | aofs);
-    check_overlap_2(dofs, aofs, maxsz);
+    check_overlap_2(tcg_env, dofs, tcg_env, aofs, maxsz);
 
     /* If the backend has a scalar expansion, great.  */
     type = choose_vector_type(g->s_list, vece, oprsz, vece == MO_64);
@@ -3770,7 +3781,7 @@ void tcg_gen_gvec_cmp(TCGCond cond, unsigned vece, uint32_t dofs,
     uint32_t some;
 
     check_size_align(oprsz, maxsz, dofs | aofs | bofs);
-    check_overlap_3(dofs, aofs, bofs, maxsz);
+    check_overlap_3(tcg_env, dofs, tcg_env, aofs, tcg_env, bofs, maxsz);
 
     if (cond == TCG_COND_NEVER || cond == TCG_COND_ALWAYS) {
         do_dup(MO_8, tcg_env, dofs, oprsz, maxsz,
@@ -3890,7 +3901,7 @@ void tcg_gen_gvec_cmps(TCGCond cond, unsigned vece, uint32_t dofs,
     TCGType type;
 
     check_size_align(oprsz, maxsz, dofs | aofs);
-    check_overlap_2(dofs, aofs, maxsz);
+    check_overlap_2(tcg_env, dofs, tcg_env, aofs, maxsz);
 
     if (cond == TCG_COND_NEVER || cond == TCG_COND_ALWAYS) {
         do_dup(MO_8, tcg_env, dofs, oprsz, maxsz,

From 7a74c13468e71a56147b75c2881ce3edaf7fbc19 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 6 Mar 2024 12:10:15 -1000
Subject: [PATCH 1628/2760] tcg: Split out tcg_gen_gvec_2_var

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/tcg/tcg-op-gvec-common.h | 14 ++++--
 tcg/tcg-op-gvec.c                | 85 ++++++++++++++++++++------------
 2 files changed, 64 insertions(+), 35 deletions(-)

diff --git a/include/tcg/tcg-op-gvec-common.h b/include/tcg/tcg-op-gvec-common.h
index 65553f5f97..f00af047c4 100644
--- a/include/tcg/tcg-op-gvec-common.h
+++ b/include/tcg/tcg-op-gvec-common.h
@@ -227,12 +227,20 @@ typedef struct {
     bool prefer_i64;
 } GVecGen4i;
 
+/* Expand (dbase+dofs) = op(abase+aofs), length @oprsz, clearing to @maxsz. */
+void tcg_gen_gvec_2_var(TCGv_ptr dbase, uint32_t dofs,
+                        TCGv_ptr abase, uint32_t aofs,
+                        uint32_t oprsz, uint32_t maxsz, const GVecGen2 *op);
+/* Similarly, expand (env+dofs) = op(env+aofs). */
 void tcg_gen_gvec_2(uint32_t dofs, uint32_t aofs,
-                    uint32_t oprsz, uint32_t maxsz, const GVecGen2 *);
+                    uint32_t oprsz, uint32_t maxsz, const GVecGen2 *op);
+/* Similarly, expand (env+dofs) = op(env+aofs, c). */
 void tcg_gen_gvec_2i(uint32_t dofs, uint32_t aofs, uint32_t oprsz,
-                     uint32_t maxsz, int64_t c, const GVecGen2i *);
+                     uint32_t maxsz, int64_t c, const GVecGen2i *op);
+/* Similarly, expand (env+dofs) = op(env+aofs, s). */
 void tcg_gen_gvec_2s(uint32_t dofs, uint32_t aofs, uint32_t oprsz,
-                     uint32_t maxsz, TCGv_i64 c, const GVecGen2s *);
+                     uint32_t maxsz, TCGv_i64 c, const GVecGen2s *op);
+
 void tcg_gen_gvec_3(uint32_t dofs, uint32_t aofs, uint32_t bofs,
                     uint32_t oprsz, uint32_t maxsz, const GVecGen3 *);
 void tcg_gen_gvec_3i(uint32_t dofs, uint32_t aofs, uint32_t bofs,
diff --git a/tcg/tcg-op-gvec.c b/tcg/tcg-op-gvec.c
index 0e6b42476e..ec926bdcd7 100644
--- a/tcg/tcg-op-gvec.c
+++ b/tcg/tcg-op-gvec.c
@@ -133,9 +133,10 @@ uint32_t simd_desc(uint32_t oprsz, uint32_t maxsz, int32_t data)
 }
 
 /* Generate a call to a gvec-style helper with two vector operands.  */
-void tcg_gen_gvec_2_ool(uint32_t dofs, uint32_t aofs,
-                        uint32_t oprsz, uint32_t maxsz, int32_t data,
-                        gen_helper_gvec_2 *fn)
+static void expand_2_ool(TCGv_ptr dbase, uint32_t dofs,
+                         TCGv_ptr abase, uint32_t aofs,
+                         uint32_t oprsz, uint32_t maxsz,
+                         int32_t data, gen_helper_gvec_2 *fn)
 {
     TCGv_ptr a0, a1;
     TCGv_i32 desc = tcg_constant_i32(simd_desc(oprsz, maxsz, data));
@@ -143,8 +144,8 @@ void tcg_gen_gvec_2_ool(uint32_t dofs, uint32_t aofs,
     a0 = tcg_temp_ebb_new_ptr();
     a1 = tcg_temp_ebb_new_ptr();
 
-    tcg_gen_addi_ptr(a0, tcg_env, dofs);
-    tcg_gen_addi_ptr(a1, tcg_env, aofs);
+    tcg_gen_addi_ptr(a0, dbase, dofs);
+    tcg_gen_addi_ptr(a1, abase, aofs);
 
     fn(a0, a1, desc);
 
@@ -152,6 +153,13 @@ void tcg_gen_gvec_2_ool(uint32_t dofs, uint32_t aofs,
     tcg_temp_free_ptr(a1);
 }
 
+void tcg_gen_gvec_2_ool(uint32_t dofs, uint32_t aofs,
+                        uint32_t oprsz, uint32_t maxsz, int32_t data,
+                        gen_helper_gvec_2 *fn)
+{
+    expand_2_ool(tcg_env, dofs, tcg_env, aofs, oprsz, maxsz, data, fn);
+}
+
 /* Generate a call to a gvec-style helper with two vector operands
    and one scalar operand.  */
 void tcg_gen_gvec_2i_ool(uint32_t dofs, uint32_t aofs, TCGv_i64 c,
@@ -724,20 +732,21 @@ static void expand_clr(TCGv_ptr dbase, uint32_t dofs, uint32_t maxsz)
 }
 
 /* Expand OPSZ bytes worth of two-operand operations using i32 elements.  */
-static void expand_2_i32(uint32_t dofs, uint32_t aofs, uint32_t oprsz,
-                         bool load_dest, void (*fni)(TCGv_i32, TCGv_i32))
+static void expand_2_i32(TCGv_ptr dbase, uint32_t dofs, TCGv_ptr abase,
+                         uint32_t aofs, uint32_t oprsz, bool load_dest,
+                         void (*fni)(TCGv_i32, TCGv_i32))
 {
     TCGv_i32 t0 = tcg_temp_new_i32();
     TCGv_i32 t1 = tcg_temp_new_i32();
     uint32_t i;
 
     for (i = 0; i < oprsz; i += 4) {
-        tcg_gen_ld_i32(t0, tcg_env, aofs + i);
+        tcg_gen_ld_i32(t0, abase, aofs + i);
         if (load_dest) {
-            tcg_gen_ld_i32(t1, tcg_env, dofs + i);
+            tcg_gen_ld_i32(t1, dbase, dofs + i);
         }
         fni(t1, t0);
-        tcg_gen_st_i32(t1, tcg_env, dofs + i);
+        tcg_gen_st_i32(t1, dbase, dofs + i);
     }
     tcg_temp_free_i32(t0);
     tcg_temp_free_i32(t1);
@@ -887,20 +896,21 @@ static void expand_4i_i32(uint32_t dofs, uint32_t aofs, uint32_t bofs,
 }
 
 /* Expand OPSZ bytes worth of two-operand operations using i64 elements.  */
-static void expand_2_i64(uint32_t dofs, uint32_t aofs, uint32_t oprsz,
-                         bool load_dest, void (*fni)(TCGv_i64, TCGv_i64))
+static void expand_2_i64(TCGv_ptr dbase, uint32_t dofs, TCGv_ptr abase,
+                         uint32_t aofs, uint32_t oprsz, bool load_dest,
+                         void (*fni)(TCGv_i64, TCGv_i64))
 {
     TCGv_i64 t0 = tcg_temp_new_i64();
     TCGv_i64 t1 = tcg_temp_new_i64();
     uint32_t i;
 
     for (i = 0; i < oprsz; i += 8) {
-        tcg_gen_ld_i64(t0, tcg_env, aofs + i);
+        tcg_gen_ld_i64(t0, abase, aofs + i);
         if (load_dest) {
-            tcg_gen_ld_i64(t1, tcg_env, dofs + i);
+            tcg_gen_ld_i64(t1, dbase, dofs + i);
         }
         fni(t1, t0);
-        tcg_gen_st_i64(t1, tcg_env, dofs + i);
+        tcg_gen_st_i64(t1, dbase, dofs + i);
     }
     tcg_temp_free_i64(t0);
     tcg_temp_free_i64(t1);
@@ -1050,7 +1060,8 @@ static void expand_4i_i64(uint32_t dofs, uint32_t aofs, uint32_t bofs,
 }
 
 /* Expand OPSZ bytes worth of two-operand operations using host vectors.  */
-static void expand_2_vec(unsigned vece, uint32_t dofs, uint32_t aofs,
+static void expand_2_vec(unsigned vece, TCGv_ptr dbase, uint32_t dofs,
+                         TCGv_ptr abase, uint32_t aofs,
                          uint32_t oprsz, uint32_t tysz, TCGType type,
                          bool load_dest,
                          void (*fni)(unsigned, TCGv_vec, TCGv_vec))
@@ -1059,12 +1070,12 @@ static void expand_2_vec(unsigned vece, uint32_t dofs, uint32_t aofs,
         TCGv_vec t0 = tcg_temp_new_vec(type);
         TCGv_vec t1 = tcg_temp_new_vec(type);
 
-        tcg_gen_ld_vec(t0, tcg_env, aofs + i);
+        tcg_gen_ld_vec(t0, abase, aofs + i);
         if (load_dest) {
-            tcg_gen_ld_vec(t1, tcg_env, dofs + i);
+            tcg_gen_ld_vec(t1, dbase, dofs + i);
         }
         fni(vece, t1, t0);
-        tcg_gen_st_vec(t1, tcg_env, dofs + i);
+        tcg_gen_st_vec(t1, dbase, dofs + i);
     }
 }
 
@@ -1206,8 +1217,9 @@ static void expand_4i_vec(unsigned vece, uint32_t dofs, uint32_t aofs,
 }
 
 /* Expand a vector two-operand operation.  */
-void tcg_gen_gvec_2(uint32_t dofs, uint32_t aofs,
-                    uint32_t oprsz, uint32_t maxsz, const GVecGen2 *g)
+void tcg_gen_gvec_2_var(TCGv_ptr dbase, uint32_t dofs,
+                        TCGv_ptr abase, uint32_t aofs,
+                        uint32_t oprsz, uint32_t maxsz, const GVecGen2 *g)
 {
     const TCGOpcode *this_list = g->opt_opc ? : vecop_list_empty;
     const TCGOpcode *hold_list = tcg_swap_vecop_list(this_list);
@@ -1215,7 +1227,7 @@ void tcg_gen_gvec_2(uint32_t dofs, uint32_t aofs,
     uint32_t some;
 
     check_size_align(oprsz, maxsz, dofs | aofs);
-    check_overlap_2(tcg_env, dofs, tcg_env, aofs, maxsz);
+    check_overlap_2(dbase, dofs, abase, aofs, maxsz);
 
     type = 0;
     if (g->fniv) {
@@ -1228,8 +1240,8 @@ void tcg_gen_gvec_2(uint32_t dofs, uint32_t aofs,
          * that e.g. size == 80 would be expanded with 2x32 + 1x16.
          */
         some = QEMU_ALIGN_DOWN(oprsz, 32);
-        expand_2_vec(g->vece, dofs, aofs, some, 32, TCG_TYPE_V256,
-                     g->load_dest, g->fniv);
+        expand_2_vec(g->vece, dbase, dofs, abase, aofs, some, 32,
+                     TCG_TYPE_V256, g->load_dest, g->fniv);
         if (some == oprsz) {
             break;
         }
@@ -1239,22 +1251,25 @@ void tcg_gen_gvec_2(uint32_t dofs, uint32_t aofs,
         maxsz -= some;
         /* fallthru */
     case TCG_TYPE_V128:
-        expand_2_vec(g->vece, dofs, aofs, oprsz, 16, TCG_TYPE_V128,
-                     g->load_dest, g->fniv);
+        expand_2_vec(g->vece, dbase, dofs, abase, aofs, oprsz, 16,
+                     TCG_TYPE_V128, g->load_dest, g->fniv);
         break;
     case TCG_TYPE_V64:
-        expand_2_vec(g->vece, dofs, aofs, oprsz, 8, TCG_TYPE_V64,
-                     g->load_dest, g->fniv);
+        expand_2_vec(g->vece, dbase, dofs, abase, aofs, oprsz, 8,
+                     TCG_TYPE_V64, g->load_dest, g->fniv);
         break;
 
     case 0:
         if (g->fni8 && check_size_impl(oprsz, 8)) {
-            expand_2_i64(dofs, aofs, oprsz, g->load_dest, g->fni8);
+            expand_2_i64(dbase, dofs, abase, aofs,
+                         oprsz, g->load_dest, g->fni8);
         } else if (g->fni4 && check_size_impl(oprsz, 4)) {
-            expand_2_i32(dofs, aofs, oprsz, g->load_dest, g->fni4);
+            expand_2_i32(dbase, dofs, abase, aofs,
+                         oprsz, g->load_dest, g->fni4);
         } else {
             assert(g->fno != NULL);
-            tcg_gen_gvec_2_ool(dofs, aofs, oprsz, maxsz, g->data, g->fno);
+            expand_2_ool(dbase, dofs, abase, aofs,
+                         oprsz, maxsz, g->data, g->fno);
             oprsz = maxsz;
         }
         break;
@@ -1265,10 +1280,16 @@ void tcg_gen_gvec_2(uint32_t dofs, uint32_t aofs,
     tcg_swap_vecop_list(hold_list);
 
     if (oprsz < maxsz) {
-        expand_clr(tcg_env, dofs + oprsz, maxsz - oprsz);
+        expand_clr(dbase, dofs + oprsz, maxsz - oprsz);
     }
 }
 
+void tcg_gen_gvec_2(uint32_t dofs, uint32_t aofs,
+                    uint32_t oprsz, uint32_t maxsz, const GVecGen2 *g)
+{
+    tcg_gen_gvec_2_var(tcg_env, dofs, tcg_env, aofs, oprsz, maxsz, g);
+}
+
 /* Expand a vector operation with two vectors and an immediate.  */
 void tcg_gen_gvec_2i(uint32_t dofs, uint32_t aofs, uint32_t oprsz,
                      uint32_t maxsz, int64_t c, const GVecGen2i *g)

From 465b21ffbef3de1888d535b37a2ad0b27438580e Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 6 Mar 2024 13:24:31 -1000
Subject: [PATCH 1629/2760] tcg: Split out tcg_gen_gvec_3_var

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/tcg/tcg-op-gvec-common.h |  33 +++++++++-
 tcg/tcg-op-gvec.c                | 102 +++++++++++++++++++------------
 2 files changed, 95 insertions(+), 40 deletions(-)

diff --git a/include/tcg/tcg-op-gvec-common.h b/include/tcg/tcg-op-gvec-common.h
index f00af047c4..29bcedb737 100644
--- a/include/tcg/tcg-op-gvec-common.h
+++ b/include/tcg/tcg-op-gvec-common.h
@@ -241,13 +241,42 @@ void tcg_gen_gvec_2i(uint32_t dofs, uint32_t aofs, uint32_t oprsz,
 void tcg_gen_gvec_2s(uint32_t dofs, uint32_t aofs, uint32_t oprsz,
                      uint32_t maxsz, TCGv_i64 c, const GVecGen2s *op);
 
+/*
+ * Expand (dbase+dofs) = op(abase+aofs, bbase+bofs),
+ * length @oprsz, clearing to @maxsz.
+ */
+void tcg_gen_gvec_3_var(TCGv_ptr dbase, uint32_t dofs,
+                        TCGv_ptr abase, uint32_t aofs,
+                        TCGv_ptr bbase, uint32_t bofs,
+                        uint32_t oprsz, uint32_t maxsz, const GVecGen3 *op);
+/* Similarly, expand (env+dofs) = op(env+aofs, env+bofs). */
 void tcg_gen_gvec_3(uint32_t dofs, uint32_t aofs, uint32_t bofs,
-                    uint32_t oprsz, uint32_t maxsz, const GVecGen3 *);
+                    uint32_t oprsz, uint32_t maxsz, const GVecGen3 *op);
+
+/*
+ * Depending on op->load_dest and op->write_aofs, expand
+ *    (env+dofs) = op(env+aofs, env+bofs, c)
+ * or
+ *    (env+dofs) = op(env+dofs, env+aofs, env+bofs, c)
+ * or
+ *    (env+dofs), (env+aofs) = op(env+aofs, env+bofs, c)
+ * or
+ *    (env+dofs), (env+aofs) = op(env+dofs, env+aofs, env+bofs, c)
+ */
 void tcg_gen_gvec_3i(uint32_t dofs, uint32_t aofs, uint32_t bofs,
                      uint32_t oprsz, uint32_t maxsz, int64_t c,
-                     const GVecGen3i *);
+                     const GVecGen3i *op);
+
+/*
+ * Depending on op->write_aofs, expand
+ *     (env+dofs) = op(env+aofs, env+bofs, env+cofs)
+ * or
+ *     (env+dofs), (env+aofs) = op(env+aofs, env+bofs, env+cofs)
+ */
 void tcg_gen_gvec_4(uint32_t dofs, uint32_t aofs, uint32_t bofs, uint32_t cofs,
                     uint32_t oprsz, uint32_t maxsz, const GVecGen4 *);
+
+/* Expand (env+dofs) = op(env+aofs, env+bofs, env+cofs, c). */
 void tcg_gen_gvec_4i(uint32_t dofs, uint32_t aofs, uint32_t bofs, uint32_t cofs,
                      uint32_t oprsz, uint32_t maxsz, int64_t c,
                      const GVecGen4i *);
diff --git a/tcg/tcg-op-gvec.c b/tcg/tcg-op-gvec.c
index ec926bdcd7..862cecf1bf 100644
--- a/tcg/tcg-op-gvec.c
+++ b/tcg/tcg-op-gvec.c
@@ -182,9 +182,11 @@ void tcg_gen_gvec_2i_ool(uint32_t dofs, uint32_t aofs, TCGv_i64 c,
 }
 
 /* Generate a call to a gvec-style helper with three vector operands.  */
-void tcg_gen_gvec_3_ool(uint32_t dofs, uint32_t aofs, uint32_t bofs,
-                        uint32_t oprsz, uint32_t maxsz, int32_t data,
-                        gen_helper_gvec_3 *fn)
+static void expand_3_ool(TCGv_ptr dbase, uint32_t dofs,
+                         TCGv_ptr abase, uint32_t aofs,
+                         TCGv_ptr bbase, uint32_t bofs,
+                         uint32_t oprsz, uint32_t maxsz,
+                         int32_t data, gen_helper_gvec_3 *fn)
 {
     TCGv_ptr a0, a1, a2;
     TCGv_i32 desc = tcg_constant_i32(simd_desc(oprsz, maxsz, data));
@@ -193,9 +195,9 @@ void tcg_gen_gvec_3_ool(uint32_t dofs, uint32_t aofs, uint32_t bofs,
     a1 = tcg_temp_ebb_new_ptr();
     a2 = tcg_temp_ebb_new_ptr();
 
-    tcg_gen_addi_ptr(a0, tcg_env, dofs);
-    tcg_gen_addi_ptr(a1, tcg_env, aofs);
-    tcg_gen_addi_ptr(a2, tcg_env, bofs);
+    tcg_gen_addi_ptr(a0, dbase, dofs);
+    tcg_gen_addi_ptr(a1, abase, aofs);
+    tcg_gen_addi_ptr(a2, bbase, bofs);
 
     fn(a0, a1, a2, desc);
 
@@ -204,6 +206,14 @@ void tcg_gen_gvec_3_ool(uint32_t dofs, uint32_t aofs, uint32_t bofs,
     tcg_temp_free_ptr(a2);
 }
 
+void tcg_gen_gvec_3_ool(uint32_t dofs, uint32_t aofs, uint32_t bofs,
+                        uint32_t oprsz, uint32_t maxsz, int32_t data,
+                        gen_helper_gvec_3 *fn)
+{
+    expand_3_ool(tcg_env, dofs, tcg_env, aofs, tcg_env, bofs,
+                 oprsz, maxsz, data, fn);
+}
+
 /* Generate a call to a gvec-style helper with four vector operands.  */
 void tcg_gen_gvec_4_ool(uint32_t dofs, uint32_t aofs, uint32_t bofs,
                         uint32_t cofs, uint32_t oprsz, uint32_t maxsz,
@@ -794,8 +804,10 @@ static void expand_2s_i32(uint32_t dofs, uint32_t aofs, uint32_t oprsz,
 }
 
 /* Expand OPSZ bytes worth of three-operand operations using i32 elements.  */
-static void expand_3_i32(uint32_t dofs, uint32_t aofs,
-                         uint32_t bofs, uint32_t oprsz, bool load_dest,
+static void expand_3_i32(TCGv_ptr dbase, uint32_t dofs,
+                         TCGv_ptr abase, uint32_t aofs,
+                         TCGv_ptr bbase, uint32_t bofs,
+                         uint32_t oprsz, bool load_dest,
                          void (*fni)(TCGv_i32, TCGv_i32, TCGv_i32))
 {
     TCGv_i32 t0 = tcg_temp_new_i32();
@@ -804,13 +816,13 @@ static void expand_3_i32(uint32_t dofs, uint32_t aofs,
     uint32_t i;
 
     for (i = 0; i < oprsz; i += 4) {
-        tcg_gen_ld_i32(t0, tcg_env, aofs + i);
-        tcg_gen_ld_i32(t1, tcg_env, bofs + i);
+        tcg_gen_ld_i32(t0, abase, aofs + i);
+        tcg_gen_ld_i32(t1, bbase, bofs + i);
         if (load_dest) {
-            tcg_gen_ld_i32(t2, tcg_env, dofs + i);
+            tcg_gen_ld_i32(t2, dbase, dofs + i);
         }
         fni(t2, t0, t1);
-        tcg_gen_st_i32(t2, tcg_env, dofs + i);
+        tcg_gen_st_i32(t2, dbase, dofs + i);
     }
     tcg_temp_free_i32(t2);
     tcg_temp_free_i32(t1);
@@ -958,8 +970,10 @@ static void expand_2s_i64(uint32_t dofs, uint32_t aofs, uint32_t oprsz,
 }
 
 /* Expand OPSZ bytes worth of three-operand operations using i64 elements.  */
-static void expand_3_i64(uint32_t dofs, uint32_t aofs,
-                         uint32_t bofs, uint32_t oprsz, bool load_dest,
+static void expand_3_i64(TCGv_ptr dbase, uint32_t dofs,
+                         TCGv_ptr abase, uint32_t aofs,
+                         TCGv_ptr bbase, uint32_t bofs,
+                         uint32_t oprsz, bool load_dest,
                          void (*fni)(TCGv_i64, TCGv_i64, TCGv_i64))
 {
     TCGv_i64 t0 = tcg_temp_new_i64();
@@ -968,13 +982,13 @@ static void expand_3_i64(uint32_t dofs, uint32_t aofs,
     uint32_t i;
 
     for (i = 0; i < oprsz; i += 8) {
-        tcg_gen_ld_i64(t0, tcg_env, aofs + i);
-        tcg_gen_ld_i64(t1, tcg_env, bofs + i);
+        tcg_gen_ld_i64(t0, abase, aofs + i);
+        tcg_gen_ld_i64(t1, bbase, bofs + i);
         if (load_dest) {
-            tcg_gen_ld_i64(t2, tcg_env, dofs + i);
+            tcg_gen_ld_i64(t2, dbase, dofs + i);
         }
         fni(t2, t0, t1);
-        tcg_gen_st_i64(t2, tcg_env, dofs + i);
+        tcg_gen_st_i64(t2, dbase, dofs + i);
     }
     tcg_temp_free_i64(t2);
     tcg_temp_free_i64(t1);
@@ -1119,8 +1133,9 @@ static void expand_2s_vec(unsigned vece, uint32_t dofs, uint32_t aofs,
 }
 
 /* Expand OPSZ bytes worth of three-operand operations using host vectors.  */
-static void expand_3_vec(unsigned vece, uint32_t dofs, uint32_t aofs,
-                         uint32_t bofs, uint32_t oprsz,
+static void expand_3_vec(unsigned vece, TCGv_ptr dbase, uint32_t dofs,
+                         TCGv_ptr abase, uint32_t aofs,
+                         TCGv_ptr bbase, uint32_t bofs, uint32_t oprsz,
                          uint32_t tysz, TCGType type, bool load_dest,
                          void (*fni)(unsigned, TCGv_vec, TCGv_vec, TCGv_vec))
 {
@@ -1129,13 +1144,13 @@ static void expand_3_vec(unsigned vece, uint32_t dofs, uint32_t aofs,
         TCGv_vec t1 = tcg_temp_new_vec(type);
         TCGv_vec t2 = tcg_temp_new_vec(type);
 
-        tcg_gen_ld_vec(t0, tcg_env, aofs + i);
-        tcg_gen_ld_vec(t1, tcg_env, bofs + i);
+        tcg_gen_ld_vec(t0, abase, aofs + i);
+        tcg_gen_ld_vec(t1, bbase, bofs + i);
         if (load_dest) {
-            tcg_gen_ld_vec(t2, tcg_env, dofs + i);
+            tcg_gen_ld_vec(t2, dbase, dofs + i);
         }
         fni(vece, t2, t0, t1);
-        tcg_gen_st_vec(t2, tcg_env, dofs + i);
+        tcg_gen_st_vec(t2, dbase, dofs + i);
     }
 }
 
@@ -1437,8 +1452,10 @@ void tcg_gen_gvec_2s(uint32_t dofs, uint32_t aofs, uint32_t oprsz,
 }
 
 /* Expand a vector three-operand operation.  */
-void tcg_gen_gvec_3(uint32_t dofs, uint32_t aofs, uint32_t bofs,
-                    uint32_t oprsz, uint32_t maxsz, const GVecGen3 *g)
+void tcg_gen_gvec_3_var(TCGv_ptr dbase, uint32_t dofs,
+                        TCGv_ptr abase, uint32_t aofs,
+                        TCGv_ptr bbase, uint32_t bofs,
+                        uint32_t oprsz, uint32_t maxsz, const GVecGen3 *g)
 {
     const TCGOpcode *this_list = g->opt_opc ? : vecop_list_empty;
     const TCGOpcode *hold_list = tcg_swap_vecop_list(this_list);
@@ -1446,7 +1463,7 @@ void tcg_gen_gvec_3(uint32_t dofs, uint32_t aofs, uint32_t bofs,
     uint32_t some;
 
     check_size_align(oprsz, maxsz, dofs | aofs | bofs);
-    check_overlap_3(tcg_env, dofs, tcg_env, aofs, tcg_env, bofs, maxsz);
+    check_overlap_3(dbase, dofs, abase, aofs, bbase, bofs, maxsz);
 
     type = 0;
     if (g->fniv) {
@@ -1459,8 +1476,8 @@ void tcg_gen_gvec_3(uint32_t dofs, uint32_t aofs, uint32_t bofs,
          * that e.g. size == 80 would be expanded with 2x32 + 1x16.
          */
         some = QEMU_ALIGN_DOWN(oprsz, 32);
-        expand_3_vec(g->vece, dofs, aofs, bofs, some, 32, TCG_TYPE_V256,
-                     g->load_dest, g->fniv);
+        expand_3_vec(g->vece, dbase, dofs, abase, aofs, bbase, bofs,
+                     some, 32, TCG_TYPE_V256, g->load_dest, g->fniv);
         if (some == oprsz) {
             break;
         }
@@ -1471,23 +1488,25 @@ void tcg_gen_gvec_3(uint32_t dofs, uint32_t aofs, uint32_t bofs,
         maxsz -= some;
         /* fallthru */
     case TCG_TYPE_V128:
-        expand_3_vec(g->vece, dofs, aofs, bofs, oprsz, 16, TCG_TYPE_V128,
-                     g->load_dest, g->fniv);
+        expand_3_vec(g->vece, dbase, dofs, abase, aofs, bbase, bofs,
+                     oprsz, 16, TCG_TYPE_V128, g->load_dest, g->fniv);
         break;
     case TCG_TYPE_V64:
-        expand_3_vec(g->vece, dofs, aofs, bofs, oprsz, 8, TCG_TYPE_V64,
-                     g->load_dest, g->fniv);
+        expand_3_vec(g->vece, dbase, dofs, abase, aofs, bbase, bofs,
+                     oprsz, 8, TCG_TYPE_V64, g->load_dest, g->fniv);
         break;
 
     case 0:
         if (g->fni8 && check_size_impl(oprsz, 8)) {
-            expand_3_i64(dofs, aofs, bofs, oprsz, g->load_dest, g->fni8);
+            expand_3_i64(dbase, dofs, abase, aofs, bbase, bofs,
+                         oprsz, g->load_dest, g->fni8);
         } else if (g->fni4 && check_size_impl(oprsz, 4)) {
-            expand_3_i32(dofs, aofs, bofs, oprsz, g->load_dest, g->fni4);
+            expand_3_i32(dbase, dofs, abase, aofs, bbase, bofs,
+                         oprsz, g->load_dest, g->fni4);
         } else {
             assert(g->fno != NULL);
-            tcg_gen_gvec_3_ool(dofs, aofs, bofs, oprsz,
-                               maxsz, g->data, g->fno);
+            expand_3_ool(dbase, dofs, abase, aofs, bbase, bofs,
+                         oprsz, maxsz, g->data, g->fno);
             oprsz = maxsz;
         }
         break;
@@ -1498,10 +1517,17 @@ void tcg_gen_gvec_3(uint32_t dofs, uint32_t aofs, uint32_t bofs,
     tcg_swap_vecop_list(hold_list);
 
     if (oprsz < maxsz) {
-        expand_clr(tcg_env, dofs + oprsz, maxsz - oprsz);
+        expand_clr(dbase, dofs + oprsz, maxsz - oprsz);
     }
 }
 
+void tcg_gen_gvec_3(uint32_t dofs, uint32_t aofs, uint32_t bofs,
+                    uint32_t oprsz, uint32_t maxsz, const GVecGen3 *g)
+{
+    tcg_gen_gvec_3_var(tcg_env, dofs, tcg_env, aofs, tcg_env, bofs,
+                       oprsz, maxsz, g);
+}
+
 /* Expand a vector operation with three vectors and an immediate.  */
 void tcg_gen_gvec_3i(uint32_t dofs, uint32_t aofs, uint32_t bofs,
                      uint32_t oprsz, uint32_t maxsz, int64_t c,

From ebba58c44db127d676b4ab2d00e7ad1aba9f6bc4 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 6 Mar 2024 12:24:04 -1000
Subject: [PATCH 1630/2760] tcg: Split out tcg_gen_gvec_mov_var

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/tcg/tcg-op-gvec-common.h |  4 ++++
 tcg/tcg-op-gvec.c                | 21 +++++++++++++++------
 2 files changed, 19 insertions(+), 6 deletions(-)

diff --git a/include/tcg/tcg-op-gvec-common.h b/include/tcg/tcg-op-gvec-common.h
index 29bcedb737..b2e797780d 100644
--- a/include/tcg/tcg-op-gvec-common.h
+++ b/include/tcg/tcg-op-gvec-common.h
@@ -283,6 +283,10 @@ void tcg_gen_gvec_4i(uint32_t dofs, uint32_t aofs, uint32_t bofs, uint32_t cofs,
 
 /* Expand a specific vector operation.  */
 
+void tcg_gen_gvec_mov_var(unsigned vece, TCGv_ptr dbase, uint32_t dofs,
+                          TCGv_ptr abase, uint32_t aofs,
+                          uint32_t oprsz, uint32_t maxsz);
+
 void tcg_gen_gvec_mov(unsigned vece, uint32_t dofs, uint32_t aofs,
                       uint32_t oprsz, uint32_t maxsz);
 void tcg_gen_gvec_not(unsigned vece, uint32_t dofs, uint32_t aofs,
diff --git a/tcg/tcg-op-gvec.c b/tcg/tcg-op-gvec.c
index 862cecf1bf..85e1807580 100644
--- a/tcg/tcg-op-gvec.c
+++ b/tcg/tcg-op-gvec.c
@@ -1746,8 +1746,9 @@ static void vec_mov2(unsigned vece, TCGv_vec a, TCGv_vec b)
     tcg_gen_mov_vec(a, b);
 }
 
-void tcg_gen_gvec_mov(unsigned vece, uint32_t dofs, uint32_t aofs,
-                      uint32_t oprsz, uint32_t maxsz)
+void tcg_gen_gvec_mov_var(unsigned vece, TCGv_ptr dbase, uint32_t dofs,
+                          TCGv_ptr abase, uint32_t aofs,
+                          uint32_t oprsz, uint32_t maxsz)
 {
     static const GVecGen2 g = {
         .fni8 = tcg_gen_mov_i64,
@@ -1755,14 +1756,22 @@ void tcg_gen_gvec_mov(unsigned vece, uint32_t dofs, uint32_t aofs,
         .fno = gen_helper_gvec_mov,
         .prefer_i64 = TCG_TARGET_REG_BITS == 64,
     };
-    if (dofs != aofs) {
-        tcg_gen_gvec_2(dofs, aofs, oprsz, maxsz, &g);
-    } else {
+
+    if (dofs == aofs && dbase == abase) {
         check_size_align(oprsz, maxsz, dofs);
         if (oprsz < maxsz) {
-            expand_clr(tcg_env, dofs + oprsz, maxsz - oprsz);
+            expand_clr(dbase, dofs + oprsz, maxsz - oprsz);
         }
+        return;
     }
+
+    tcg_gen_gvec_2_var(dbase, dofs, abase, aofs, oprsz, maxsz, &g);
+}
+
+void tcg_gen_gvec_mov(unsigned vece, uint32_t dofs, uint32_t aofs,
+                      uint32_t oprsz, uint32_t maxsz)
+{
+    tcg_gen_gvec_mov_var(vece, tcg_env, dofs, tcg_env, aofs, oprsz, maxsz);
 }
 
 void tcg_gen_gvec_dup_i32(unsigned vece, uint32_t dofs, uint32_t oprsz,

From 4474051821c994ca905b56ae1276bcc3ba14ccda Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 6 Mar 2024 14:12:11 -1000
Subject: [PATCH 1631/2760] tcg: Split out tcg_gen_gvec_{add,sub}_var

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/tcg/tcg-op-gvec-common.h |  9 +++++++++
 tcg/tcg-op-gvec.c                | 32 ++++++++++++++++++++++++++------
 2 files changed, 35 insertions(+), 6 deletions(-)

diff --git a/include/tcg/tcg-op-gvec-common.h b/include/tcg/tcg-op-gvec-common.h
index b2e797780d..c93d8b2356 100644
--- a/include/tcg/tcg-op-gvec-common.h
+++ b/include/tcg/tcg-op-gvec-common.h
@@ -296,6 +296,15 @@ void tcg_gen_gvec_neg(unsigned vece, uint32_t dofs, uint32_t aofs,
 void tcg_gen_gvec_abs(unsigned vece, uint32_t dofs, uint32_t aofs,
                       uint32_t oprsz, uint32_t maxsz);
 
+void tcg_gen_gvec_add_var(unsigned vece, TCGv_ptr dbase, uint32_t dofs,
+                          TCGv_ptr abase, uint32_t aofs,
+                          TCGv_ptr bbase, uint32_t bofs,
+                          uint32_t oprsz, uint32_t maxsz);
+void tcg_gen_gvec_sub_var(unsigned vece, TCGv_ptr dbase, uint32_t dofs,
+                          TCGv_ptr abase, uint32_t aofs,
+                          TCGv_ptr bbase, uint32_t bofs,
+                          uint32_t oprsz, uint32_t maxsz);
+
 void tcg_gen_gvec_add(unsigned vece, uint32_t dofs, uint32_t aofs,
                       uint32_t bofs, uint32_t oprsz, uint32_t maxsz);
 void tcg_gen_gvec_sub(unsigned vece, uint32_t dofs, uint32_t aofs,
diff --git a/tcg/tcg-op-gvec.c b/tcg/tcg-op-gvec.c
index 85e1807580..9714eb902b 100644
--- a/tcg/tcg-op-gvec.c
+++ b/tcg/tcg-op-gvec.c
@@ -1999,8 +1999,10 @@ void tcg_gen_vec_add32_i64(TCGv_i64 d, TCGv_i64 a, TCGv_i64 b)
 
 static const TCGOpcode vecop_list_add[] = { INDEX_op_add_vec, 0 };
 
-void tcg_gen_gvec_add(unsigned vece, uint32_t dofs, uint32_t aofs,
-                      uint32_t bofs, uint32_t oprsz, uint32_t maxsz)
+void tcg_gen_gvec_add_var(unsigned vece, TCGv_ptr dbase, uint32_t dofs,
+                          TCGv_ptr abase, uint32_t aofs,
+                          TCGv_ptr bbase, uint32_t bofs,
+                          uint32_t oprsz, uint32_t maxsz)
 {
     static const GVecGen3 g[4] = {
         { .fni8 = tcg_gen_vec_add8_i64,
@@ -2027,7 +2029,15 @@ void tcg_gen_gvec_add(unsigned vece, uint32_t dofs, uint32_t aofs,
     };
 
     tcg_debug_assert(vece <= MO_64);
-    tcg_gen_gvec_3(dofs, aofs, bofs, oprsz, maxsz, &g[vece]);
+    tcg_gen_gvec_3_var(dbase, dofs, abase, aofs, bbase, bofs,
+                       oprsz, maxsz, &g[vece]);
+}
+
+void tcg_gen_gvec_add(unsigned vece, uint32_t dofs, uint32_t aofs,
+                      uint32_t bofs, uint32_t oprsz, uint32_t maxsz)
+{
+    tcg_gen_gvec_add_var(vece, tcg_env, dofs, tcg_env, aofs, tcg_env, bofs,
+                         oprsz, maxsz);
 }
 
 void tcg_gen_gvec_adds(unsigned vece, uint32_t dofs, uint32_t aofs,
@@ -2180,8 +2190,10 @@ void tcg_gen_vec_sub32_i64(TCGv_i64 d, TCGv_i64 a, TCGv_i64 b)
     tcg_temp_free_i64(t2);
 }
 
-void tcg_gen_gvec_sub(unsigned vece, uint32_t dofs, uint32_t aofs,
-                      uint32_t bofs, uint32_t oprsz, uint32_t maxsz)
+void tcg_gen_gvec_sub_var(unsigned vece, TCGv_ptr dbase, uint32_t dofs,
+                          TCGv_ptr abase, uint32_t aofs,
+                          TCGv_ptr bbase, uint32_t bofs,
+                          uint32_t oprsz, uint32_t maxsz)
 {
     static const GVecGen3 g[4] = {
         { .fni8 = tcg_gen_vec_sub8_i64,
@@ -2208,7 +2220,15 @@ void tcg_gen_gvec_sub(unsigned vece, uint32_t dofs, uint32_t aofs,
     };
 
     tcg_debug_assert(vece <= MO_64);
-    tcg_gen_gvec_3(dofs, aofs, bofs, oprsz, maxsz, &g[vece]);
+    tcg_gen_gvec_3_var(dbase, dofs, abase, aofs, bbase, bofs,
+                       oprsz, maxsz, &g[vece]);
+}
+
+void tcg_gen_gvec_sub(unsigned vece, uint32_t dofs, uint32_t aofs,
+                      uint32_t bofs, uint32_t oprsz, uint32_t maxsz)
+{
+    tcg_gen_gvec_sub_var(vece, tcg_env, dofs, tcg_env, aofs, tcg_env, bofs,
+                         oprsz, maxsz);
 }
 
 static const TCGOpcode vecop_list_mul[] = { INDEX_op_mul_vec, 0 };

From aa1cc0d74dc48da3b90476fbcc7fa339c61c8045 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 6 Feb 2025 10:53:43 -0800
Subject: [PATCH 1632/2760] tcg: Split out tcg_gen_gvec_dup_imm_var

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/tcg/tcg-op-gvec-common.h |  3 +++
 tcg/tcg-op-gvec.c                | 10 ++++++++--
 2 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/include/tcg/tcg-op-gvec-common.h b/include/tcg/tcg-op-gvec-common.h
index c93d8b2356..ea0c87f4db 100644
--- a/include/tcg/tcg-op-gvec-common.h
+++ b/include/tcg/tcg-op-gvec-common.h
@@ -386,6 +386,9 @@ void tcg_gen_gvec_dup_i32(unsigned vece, uint32_t dofs, uint32_t s,
 void tcg_gen_gvec_dup_i64(unsigned vece, uint32_t dofs, uint32_t s,
                           uint32_t m, TCGv_i64);
 
+void tcg_gen_gvec_dup_imm_var(unsigned vece, TCGv_ptr dbase, uint32_t dofs,
+                              uint32_t oprsz, uint32_t maxsz, uint64_t imm);
+
 void tcg_gen_gvec_shli(unsigned vece, uint32_t dofs, uint32_t aofs,
                        int64_t shift, uint32_t oprsz, uint32_t maxsz);
 void tcg_gen_gvec_shri(unsigned vece, uint32_t dofs, uint32_t aofs,
diff --git a/tcg/tcg-op-gvec.c b/tcg/tcg-op-gvec.c
index 9714eb902b..2d184547ba 100644
--- a/tcg/tcg-op-gvec.c
+++ b/tcg/tcg-op-gvec.c
@@ -1897,11 +1897,17 @@ void tcg_gen_gvec_dup_mem(unsigned vece, uint32_t dofs, uint32_t aofs,
     }
 }
 
+void tcg_gen_gvec_dup_imm_var(unsigned vece, TCGv_ptr dbase, uint32_t dofs,
+                              uint32_t oprsz, uint32_t maxsz, uint64_t x)
+{
+    check_size_align(oprsz, maxsz, dofs);
+    do_dup(vece, dbase, dofs, oprsz, maxsz, NULL, NULL, x);
+}
+
 void tcg_gen_gvec_dup_imm(unsigned vece, uint32_t dofs, uint32_t oprsz,
                           uint32_t maxsz, uint64_t x)
 {
-    check_size_align(oprsz, maxsz, dofs);
-    do_dup(vece, tcg_env, dofs, oprsz, maxsz, NULL, NULL, x);
+    tcg_gen_gvec_dup_imm_var(vece, tcg_env, dofs, oprsz, maxsz, x);
 }
 
 void tcg_gen_gvec_not(unsigned vece, uint32_t dofs, uint32_t aofs,

From a9cd024c5822d08656127fde133975fde40f206c Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 18 Jun 2025 01:11:27 +0000
Subject: [PATCH 1633/2760] linux-user/aarch64: Update hwcap bits from 6.14

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c | 75 ++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 72 insertions(+), 3 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 82ebf6a212..2add1665c7 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -751,7 +751,23 @@ enum {
     ARM_HWCAP_A64_SSBS          = 1 << 28,
     ARM_HWCAP_A64_SB            = 1 << 29,
     ARM_HWCAP_A64_PACA          = 1 << 30,
-    ARM_HWCAP_A64_PACG          = 1UL << 31,
+    ARM_HWCAP_A64_PACG          = 1ULL << 31,
+    ARM_HWCAP_A64_GCS           = 1ULL << 32,
+    ARM_HWCAP_A64_CMPBR         = 1ULL << 33,
+    ARM_HWCAP_A64_FPRCVT        = 1ULL << 34,
+    ARM_HWCAP_A64_F8MM8         = 1ULL << 35,
+    ARM_HWCAP_A64_F8MM4         = 1ULL << 36,
+    ARM_HWCAP_A64_SVE_F16MM     = 1ULL << 37,
+    ARM_HWCAP_A64_SVE_ELTPERM   = 1ULL << 38,
+    ARM_HWCAP_A64_SVE_AES2      = 1ULL << 39,
+    ARM_HWCAP_A64_SVE_BFSCALE   = 1ULL << 40,
+    ARM_HWCAP_A64_SVE2P2        = 1ULL << 41,
+    ARM_HWCAP_A64_SME2P2        = 1ULL << 42,
+    ARM_HWCAP_A64_SME_SBITPERM  = 1ULL << 43,
+    ARM_HWCAP_A64_SME_AES       = 1ULL << 44,
+    ARM_HWCAP_A64_SME_SFEXPA    = 1ULL << 45,
+    ARM_HWCAP_A64_SME_STMOP     = 1ULL << 46,
+    ARM_HWCAP_A64_SME_SMOP4     = 1ULL << 47,
 
     ARM_HWCAP2_A64_DCPODP       = 1 << 0,
     ARM_HWCAP2_A64_SVE2         = 1 << 1,
@@ -798,6 +814,25 @@ enum {
     ARM_HWCAP2_A64_SME_F16F16   = 1ULL << 42,
     ARM_HWCAP2_A64_MOPS         = 1ULL << 43,
     ARM_HWCAP2_A64_HBC          = 1ULL << 44,
+    ARM_HWCAP2_A64_SVE_B16B16   = 1ULL << 45,
+    ARM_HWCAP2_A64_LRCPC3       = 1ULL << 46,
+    ARM_HWCAP2_A64_LSE128       = 1ULL << 47,
+    ARM_HWCAP2_A64_FPMR         = 1ULL << 48,
+    ARM_HWCAP2_A64_LUT          = 1ULL << 49,
+    ARM_HWCAP2_A64_FAMINMAX     = 1ULL << 50,
+    ARM_HWCAP2_A64_F8CVT        = 1ULL << 51,
+    ARM_HWCAP2_A64_F8FMA        = 1ULL << 52,
+    ARM_HWCAP2_A64_F8DP4        = 1ULL << 53,
+    ARM_HWCAP2_A64_F8DP2        = 1ULL << 54,
+    ARM_HWCAP2_A64_F8E4M3       = 1ULL << 55,
+    ARM_HWCAP2_A64_F8E5M2       = 1ULL << 56,
+    ARM_HWCAP2_A64_SME_LUTV2    = 1ULL << 57,
+    ARM_HWCAP2_A64_SME_F8F16    = 1ULL << 58,
+    ARM_HWCAP2_A64_SME_F8F32    = 1ULL << 59,
+    ARM_HWCAP2_A64_SME_SF8FMA   = 1ULL << 60,
+    ARM_HWCAP2_A64_SME_SF8DP4   = 1ULL << 61,
+    ARM_HWCAP2_A64_SME_SF8DP2   = 1ULL << 62,
+    ARM_HWCAP2_A64_POE          = 1ULL << 63,
 };
 
 #define ELF_HWCAP   get_elf_hwcap()
@@ -886,7 +921,7 @@ uint64_t get_elf_hwcap2(void)
 
 const char *elf_hwcap_str(uint32_t bit)
 {
-    static const char *hwcap_str[] = {
+    static const char * const hwcap_str[] = {
     [__builtin_ctz(ARM_HWCAP_A64_FP      )] = "fp",
     [__builtin_ctz(ARM_HWCAP_A64_ASIMD   )] = "asimd",
     [__builtin_ctz(ARM_HWCAP_A64_EVTSTRM )] = "evtstrm",
@@ -919,6 +954,22 @@ const char *elf_hwcap_str(uint32_t bit)
     [__builtin_ctz(ARM_HWCAP_A64_SB      )] = "sb",
     [__builtin_ctz(ARM_HWCAP_A64_PACA    )] = "paca",
     [__builtin_ctz(ARM_HWCAP_A64_PACG    )] = "pacg",
+    [__builtin_ctzll(ARM_HWCAP_A64_GCS   )] = "gcs",
+    [__builtin_ctzll(ARM_HWCAP_A64_CMPBR )] = "cmpbr",
+    [__builtin_ctzll(ARM_HWCAP_A64_FPRCVT)] = "fprcvt",
+    [__builtin_ctzll(ARM_HWCAP_A64_F8MM8 )] = "f8mm8",
+    [__builtin_ctzll(ARM_HWCAP_A64_F8MM4 )] = "f8mm4",
+    [__builtin_ctzll(ARM_HWCAP_A64_SVE_F16MM)] = "svef16mm",
+    [__builtin_ctzll(ARM_HWCAP_A64_SVE_ELTPERM)] = "sveeltperm",
+    [__builtin_ctzll(ARM_HWCAP_A64_SVE_AES2)] = "sveaes2",
+    [__builtin_ctzll(ARM_HWCAP_A64_SVE_BFSCALE)] = "svebfscale",
+    [__builtin_ctzll(ARM_HWCAP_A64_SVE2P2)] = "sve2p2",
+    [__builtin_ctzll(ARM_HWCAP_A64_SME2P2)] = "sme2p2",
+    [__builtin_ctzll(ARM_HWCAP_A64_SME_SBITPERM)] = "smesbitperm",
+    [__builtin_ctzll(ARM_HWCAP_A64_SME_AES)] = "smeaes",
+    [__builtin_ctzll(ARM_HWCAP_A64_SME_SFEXPA)] = "smesfexpa",
+    [__builtin_ctzll(ARM_HWCAP_A64_SME_STMOP)] = "smestmop",
+    [__builtin_ctzll(ARM_HWCAP_A64_SME_SMOP4)] = "smesmop4",
     };
 
     return bit < ARRAY_SIZE(hwcap_str) ? hwcap_str[bit] : NULL;
@@ -926,7 +977,7 @@ const char *elf_hwcap_str(uint32_t bit)
 
 const char *elf_hwcap2_str(uint32_t bit)
 {
-    static const char *hwcap_str[] = {
+    static const char * const hwcap_str[] = {
     [__builtin_ctz(ARM_HWCAP2_A64_DCPODP       )] = "dcpodp",
     [__builtin_ctz(ARM_HWCAP2_A64_SVE2         )] = "sve2",
     [__builtin_ctz(ARM_HWCAP2_A64_SVEAES       )] = "sveaes",
@@ -972,6 +1023,24 @@ const char *elf_hwcap2_str(uint32_t bit)
     [__builtin_ctzll(ARM_HWCAP2_A64_SME_F16F16 )] = "smef16f16",
     [__builtin_ctzll(ARM_HWCAP2_A64_MOPS       )] = "mops",
     [__builtin_ctzll(ARM_HWCAP2_A64_HBC        )] = "hbc",
+    [__builtin_ctzll(ARM_HWCAP2_A64_SVE_B16B16 )] = "sveb16b16",
+    [__builtin_ctzll(ARM_HWCAP2_A64_LRCPC3     )] = "lrcpc3",
+    [__builtin_ctzll(ARM_HWCAP2_A64_LSE128     )] = "lse128",
+    [__builtin_ctzll(ARM_HWCAP2_A64_FPMR       )] = "fpmr",
+    [__builtin_ctzll(ARM_HWCAP2_A64_LUT        )] = "lut",
+    [__builtin_ctzll(ARM_HWCAP2_A64_FAMINMAX   )] = "faminmax",
+    [__builtin_ctzll(ARM_HWCAP2_A64_F8CVT      )] = "f8cvt",
+    [__builtin_ctzll(ARM_HWCAP2_A64_F8FMA      )] = "f8fma",
+    [__builtin_ctzll(ARM_HWCAP2_A64_F8DP4      )] = "f8dp4",
+    [__builtin_ctzll(ARM_HWCAP2_A64_F8DP2      )] = "f8dp2",
+    [__builtin_ctzll(ARM_HWCAP2_A64_F8E4M3     )] = "f8e4m3",
+    [__builtin_ctzll(ARM_HWCAP2_A64_F8E5M2     )] = "f8e5m2",
+    [__builtin_ctzll(ARM_HWCAP2_A64_SME_LUTV2  )] = "smelutv2",
+    [__builtin_ctzll(ARM_HWCAP2_A64_SME_F8F16  )] = "smef8f16",
+    [__builtin_ctzll(ARM_HWCAP2_A64_SME_F8F32  )] = "smef8f32",
+    [__builtin_ctzll(ARM_HWCAP2_A64_SME_SF8DP4 )] = "smesf8dp4",
+    [__builtin_ctzll(ARM_HWCAP2_A64_SME_SF8DP2 )] = "smesf8dp2",
+    [__builtin_ctzll(ARM_HWCAP2_A64_POE        )] = "poe",
     };
 
     return bit < ARRAY_SIZE(hwcap_str) ? hwcap_str[bit] : NULL;

From 5171b794d4ac47efd81ef4da54137131e4ea550d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 13 May 2025 16:03:46 +0100
Subject: [PATCH 1634/2760] linux-user: fix resource leaks in gen-vdso
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

There are a number of resource leaks in gen-vdso. In theory they are
harmless because this is a short lived process, but when building QEMU
with --extra-cflags="-fsanitize=address" problems ensure. The gen-vdso
program is run as part of the build, and that aborts due to the
sanitizer identifying memory leaks, leaving QEMU unbuildable.

FAILED: libqemu-x86_64-linux-user.a.p/vdso.c.inc
/var/home/berrange/src/virt/qemu/build/linux-user/gen-vdso -o libqemu-x86_64-linux-user.a.p/vdso.c.inc ../linux-user/x86_64/vdso.so

=================================================================
==1696332==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 2968 byte(s) in 1 object(s) allocated from:
    #0 0x56495873f1f3  (/var/home/berrange/src/virt/qemu/build/linux-user/gen-vdso+0xa11f3) (BuildId: b69e241ad44719b6f3934f3c71dfc6727e8bdb12)
    #1 0x564958780b90  (/var/home/berrange/src/virt/qemu/build/linux-user/gen-vdso+0xe2b90) (BuildId: b69e241ad44719b6f3934f3c71dfc6727e8bdb12)

This complaint is about the 'buf' variable, however, the FILE objects
are also leaked in some error scenarios, so this fix refactors the
cleanup paths to fix all leaks. For completeness it also reports an
error if fclose() fails on 'inf'.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Tested-by: Arusekk <floss@arusekk.pl>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250513150346.1328217-1-berrange@redhat.com>
---
 linux-user/gen-vdso.c | 27 ++++++++++++++++-----------
 1 file changed, 16 insertions(+), 11 deletions(-)

diff --git a/linux-user/gen-vdso.c b/linux-user/gen-vdso.c
index 721f38d5a3..fce9d5cbc3 100644
--- a/linux-user/gen-vdso.c
+++ b/linux-user/gen-vdso.c
@@ -56,13 +56,14 @@ static unsigned rt_sigreturn_addr;
 
 int main(int argc, char **argv)
 {
-    FILE *inf, *outf;
+    FILE *inf = NULL, *outf = NULL;
     long total_len;
     const char *prefix = "vdso";
     const char *inf_name;
     const char *outf_name = NULL;
-    unsigned char *buf;
+    unsigned char *buf = NULL;
     bool need_bswap;
+    int ret = EXIT_FAILURE;
 
     while (1) {
         int opt = getopt(argc, argv, "o:p:r:s:");
@@ -129,7 +130,6 @@ int main(int argc, char **argv)
         fprintf(stderr, "%s: incomplete read\n", inf_name);
         return EXIT_FAILURE;
     }
-    fclose(inf);
 
     /*
      * Identify which elf flavor we're processing.
@@ -205,19 +205,24 @@ int main(int argc, char **argv)
     fprintf(outf, "    .rt_sigreturn_ofs = 0x%x,\n", rt_sigreturn_addr);
     fprintf(outf, "};\n");
 
-    /*
-     * Everything should have gone well.
-     */
-    if (fclose(outf)) {
-        goto perror_outf;
+    ret = EXIT_SUCCESS;
+
+ cleanup:
+    free(buf);
+
+    if (outf && fclose(outf) != 0) {
+        ret = EXIT_FAILURE;
     }
-    return EXIT_SUCCESS;
+    if (inf && fclose(inf) != 0) {
+        ret = EXIT_FAILURE;
+    }
+    return ret;
 
  perror_inf:
     perror(inf_name);
-    return EXIT_FAILURE;
+    goto cleanup;
 
  perror_outf:
     perror(outf_name);
-    return EXIT_FAILURE;
+    goto cleanup;
 }

From fd0377150d5dd4b02b2e7fbe9e8c1ab4dcbd16bb Mon Sep 17 00:00:00 2001
From: Yanfei Xu <yanfei.xu@bytedance.com>
Date: Wed, 14 May 2025 19:58:27 +0800
Subject: [PATCH 1635/2760] migration/ram: avoid to do log clear in the last
 round

There won't be any ram sync after the stage of save_complete, therefore
it's unnecessary to do manually protect for dirty pages being sent. Skip
to do this in last round can reduce noticeable downtime.

Signed-off-by: Yanfei Xu <yanfei.xu@bytedance.com>
Tested-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20250514115827.3216082-1-yanfei.xu@bytedance.com
[peterx: add comments]
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/ram.c | 22 +++++++++++++++-------
 1 file changed, 15 insertions(+), 7 deletions(-)

diff --git a/migration/ram.c b/migration/ram.c
index d26dbd37c4..fd8d83b63c 100644
--- a/migration/ram.c
+++ b/migration/ram.c
@@ -831,14 +831,22 @@ static inline bool migration_bitmap_clear_dirty(RAMState *rs,
     bool ret;
 
     /*
-     * Clear dirty bitmap if needed.  This _must_ be called before we
-     * send any of the page in the chunk because we need to make sure
-     * we can capture further page content changes when we sync dirty
-     * log the next time.  So as long as we are going to send any of
-     * the page in the chunk we clear the remote dirty bitmap for all.
-     * Clearing it earlier won't be a problem, but too late will.
+     * During the last stage (after source VM stopped), resetting the write
+     * protections isn't needed as we know there will be either (1) no
+     * further writes if migration will complete, or (2) migration fails
+     * at last then tracking isn't needed either.
      */
-    migration_clear_memory_region_dirty_bitmap(rb, page);
+    if (!rs->last_stage) {
+        /*
+         * Clear dirty bitmap if needed.  This _must_ be called before we
+         * send any of the page in the chunk because we need to make sure
+         * we can capture further page content changes when we sync dirty
+         * log the next time.  So as long as we are going to send any of
+         * the page in the chunk we clear the remote dirty bitmap for all.
+         * Clearing it earlier won't be a problem, but too late will.
+         */
+        migration_clear_memory_region_dirty_bitmap(rb, page);
+    }
 
     ret = test_and_clear_bit(page, rb->bmap);
     if (ret) {

From 8120decfb593c386e053a1ac9723e75bd181dbff Mon Sep 17 00:00:00 2001
From: Fabiano Rosas <farosas@suse.de>
Date: Fri, 23 May 2025 09:30:23 -0300
Subject: [PATCH 1636/2760] tests/qtest: Remove migration-helpers.c

Commit 407bc4bf90 ("qapi: Move include/qapi/qmp/ to include/qobject/")
brought the migration-helpers.c back by mistake. This file has been
replaced with migration/migration-qmp.c and
migration/migration-util.c.

Fixes: 407bc4bf90 ("qapi: Move include/qapi/qmp/ to include/qobject/")
Signed-off-by: Fabiano Rosas <farosas@suse.de>
Message-id: 20200310152141.13959-1-peter.maydell@linaro.org
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Link: https://lore.kernel.org/r/20250523123023.19284-1-farosas@suse.de
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 tests/qtest/migration-helpers.c | 530 --------------------------------
 1 file changed, 530 deletions(-)
 delete mode 100644 tests/qtest/migration-helpers.c

diff --git a/tests/qtest/migration-helpers.c b/tests/qtest/migration-helpers.c
deleted file mode 100644
index b08b49bd43..0000000000
--- a/tests/qtest/migration-helpers.c
+++ /dev/null
@@ -1,530 +0,0 @@
-/*
- * QTest migration helpers
- *
- * Copyright (c) 2016-2018 Red Hat, Inc. and/or its affiliates
- *   based on the vhost-user-test.c that is:
- *      Copyright (c) 2014 Virtual Open Systems Sarl.
- *
- * This work is licensed under the terms of the GNU GPL, version 2 or later.
- * See the COPYING file in the top-level directory.
- *
- */
-
-#include "qemu/osdep.h"
-#include "qemu/ctype.h"
-#include "qobject/qjson.h"
-#include "qapi/qapi-visit-sockets.h"
-#include "qapi/qobject-input-visitor.h"
-#include "qapi/error.h"
-#include "qobject/qlist.h"
-#include "qemu/cutils.h"
-#include "qemu/memalign.h"
-
-#include "migration-helpers.h"
-
-/*
- * Number of seconds we wait when looking for migration
- * status changes, to avoid test suite hanging forever
- * when things go wrong. Needs to be higher enough to
- * avoid false positives on loaded hosts.
- */
-#define MIGRATION_STATUS_WAIT_TIMEOUT 120
-
-static char *SocketAddress_to_str(SocketAddress *addr)
-{
-    switch (addr->type) {
-    case SOCKET_ADDRESS_TYPE_INET:
-        return g_strdup_printf("tcp:%s:%s",
-                               addr->u.inet.host,
-                               addr->u.inet.port);
-    case SOCKET_ADDRESS_TYPE_UNIX:
-        return g_strdup_printf("unix:%s",
-                               addr->u.q_unix.path);
-    case SOCKET_ADDRESS_TYPE_FD:
-        return g_strdup_printf("fd:%s", addr->u.fd.str);
-    case SOCKET_ADDRESS_TYPE_VSOCK:
-        return g_strdup_printf("vsock:%s:%s",
-                               addr->u.vsock.cid,
-                               addr->u.vsock.port);
-    default:
-        return g_strdup("unknown address type");
-    }
-}
-
-static QDict *SocketAddress_to_qdict(SocketAddress *addr)
-{
-    QDict *dict = qdict_new();
-
-    switch (addr->type) {
-    case SOCKET_ADDRESS_TYPE_INET:
-        qdict_put_str(dict, "type", "inet");
-        qdict_put_str(dict, "host", addr->u.inet.host);
-        qdict_put_str(dict, "port", addr->u.inet.port);
-        break;
-    case SOCKET_ADDRESS_TYPE_UNIX:
-        qdict_put_str(dict, "type", "unix");
-        qdict_put_str(dict, "path", addr->u.q_unix.path);
-        break;
-    case SOCKET_ADDRESS_TYPE_FD:
-        qdict_put_str(dict, "type", "fd");
-        qdict_put_str(dict, "str", addr->u.fd.str);
-        break;
-    case SOCKET_ADDRESS_TYPE_VSOCK:
-        qdict_put_str(dict, "type", "vsock");
-        qdict_put_str(dict, "cid", addr->u.vsock.cid);
-        qdict_put_str(dict, "port", addr->u.vsock.port);
-        break;
-    default:
-        g_assert_not_reached();
-    }
-
-    return dict;
-}
-
-static SocketAddressList *migrate_get_socket_address(QTestState *who)
-{
-    QDict *rsp;
-    SocketAddressList *addrs;
-    Visitor *iv = NULL;
-    QObject *object;
-
-    rsp = migrate_query(who);
-    object = qdict_get(rsp, "socket-address");
-
-    iv = qobject_input_visitor_new(object);
-    visit_type_SocketAddressList(iv, NULL, &addrs, &error_abort);
-    visit_free(iv);
-
-    qobject_unref(rsp);
-    return addrs;
-}
-
-static char *
-migrate_get_connect_uri(QTestState *who)
-{
-    SocketAddressList *addrs;
-    char *connect_uri;
-
-    addrs = migrate_get_socket_address(who);
-    connect_uri = SocketAddress_to_str(addrs->value);
-
-    qapi_free_SocketAddressList(addrs);
-    return connect_uri;
-}
-
-static QDict *
-migrate_get_connect_qdict(QTestState *who)
-{
-    SocketAddressList *addrs;
-    QDict *connect_qdict;
-
-    addrs = migrate_get_socket_address(who);
-    connect_qdict = SocketAddress_to_qdict(addrs->value);
-
-    qapi_free_SocketAddressList(addrs);
-    return connect_qdict;
-}
-
-static void migrate_set_ports(QTestState *to, QList *channel_list)
-{
-    QDict *addr;
-    QListEntry *entry;
-    const char *addr_port = NULL;
-
-    addr = migrate_get_connect_qdict(to);
-
-    QLIST_FOREACH_ENTRY(channel_list, entry) {
-        QDict *channel = qobject_to(QDict, qlist_entry_obj(entry));
-        QDict *addrdict = qdict_get_qdict(channel, "addr");
-
-        if (qdict_haskey(addrdict, "port") &&
-            qdict_haskey(addr, "port") &&
-            (strcmp(qdict_get_str(addrdict, "port"), "0") == 0)) {
-                addr_port = qdict_get_str(addr, "port");
-                qdict_put_str(addrdict, "port", addr_port);
-        }
-    }
-
-    qobject_unref(addr);
-}
-
-bool migrate_watch_for_events(QTestState *who, const char *name,
-                              QDict *event, void *opaque)
-{
-    QTestMigrationState *state = opaque;
-
-    if (g_str_equal(name, "STOP")) {
-        state->stop_seen = true;
-        return true;
-    } else if (g_str_equal(name, "SUSPEND")) {
-        state->suspend_seen = true;
-        return true;
-    } else if (g_str_equal(name, "RESUME")) {
-        state->resume_seen = true;
-        return true;
-    }
-
-    return false;
-}
-
-void migrate_qmp_fail(QTestState *who, const char *uri,
-                      const char *channels, const char *fmt, ...)
-{
-    va_list ap;
-    QDict *args, *err;
-
-    va_start(ap, fmt);
-    args = qdict_from_vjsonf_nofail(fmt, ap);
-    va_end(ap);
-
-    g_assert(!qdict_haskey(args, "uri"));
-    if (uri) {
-        qdict_put_str(args, "uri", uri);
-    }
-
-    g_assert(!qdict_haskey(args, "channels"));
-    if (channels) {
-        QObject *channels_obj = qobject_from_json(channels, &error_abort);
-        qdict_put_obj(args, "channels", channels_obj);
-    }
-
-    err = qtest_qmp_assert_failure_ref(
-        who, "{ 'execute': 'migrate', 'arguments': %p}", args);
-
-    g_assert(qdict_haskey(err, "desc"));
-
-    qobject_unref(err);
-}
-
-/*
- * Send QMP command "migrate".
- * Arguments are built from @fmt... (formatted like
- * qobject_from_jsonf_nofail()) with "uri": @uri spliced in.
- */
-void migrate_qmp(QTestState *who, QTestState *to, const char *uri,
-                 const char *channels, const char *fmt, ...)
-{
-    va_list ap;
-    QDict *args;
-    g_autofree char *connect_uri = NULL;
-
-    va_start(ap, fmt);
-    args = qdict_from_vjsonf_nofail(fmt, ap);
-    va_end(ap);
-
-    g_assert(!qdict_haskey(args, "uri"));
-    if (uri) {
-        qdict_put_str(args, "uri", uri);
-    } else if (!channels) {
-        connect_uri = migrate_get_connect_uri(to);
-        qdict_put_str(args, "uri", connect_uri);
-    }
-
-    g_assert(!qdict_haskey(args, "channels"));
-    if (channels) {
-        QObject *channels_obj = qobject_from_json(channels, &error_abort);
-        QList *channel_list = qobject_to(QList, channels_obj);
-        migrate_set_ports(to, channel_list);
-        qdict_put_obj(args, "channels", channels_obj);
-    }
-
-    qtest_qmp_assert_success(who,
-                             "{ 'execute': 'migrate', 'arguments': %p}", args);
-}
-
-void migrate_set_capability(QTestState *who, const char *capability,
-                            bool value)
-{
-    qtest_qmp_assert_success(who,
-                             "{ 'execute': 'migrate-set-capabilities',"
-                             "'arguments': { "
-                             "'capabilities': [ { "
-                             "'capability': %s, 'state': %i } ] } }",
-                             capability, value);
-}
-
-void migrate_incoming_qmp(QTestState *to, const char *uri, const char *fmt, ...)
-{
-    va_list ap;
-    QDict *args, *rsp;
-
-    va_start(ap, fmt);
-    args = qdict_from_vjsonf_nofail(fmt, ap);
-    va_end(ap);
-
-    g_assert(!qdict_haskey(args, "uri"));
-    qdict_put_str(args, "uri", uri);
-
-    /* This function relies on the event to work, make sure it's enabled */
-    migrate_set_capability(to, "events", true);
-
-    rsp = qtest_qmp(to, "{ 'execute': 'migrate-incoming', 'arguments': %p}",
-                    args);
-
-    if (!qdict_haskey(rsp, "return")) {
-        g_autoptr(GString) s = qobject_to_json_pretty(QOBJECT(rsp), true);
-        g_test_message("%s", s->str);
-    }
-
-    g_assert(qdict_haskey(rsp, "return"));
-    qobject_unref(rsp);
-
-    migration_event_wait(to, "setup");
-}
-
-/*
- * Note: caller is responsible to free the returned object via
- * qobject_unref() after use
- */
-QDict *migrate_query(QTestState *who)
-{
-    return qtest_qmp_assert_success_ref(who, "{ 'execute': 'query-migrate' }");
-}
-
-QDict *migrate_query_not_failed(QTestState *who)
-{
-    const char *status;
-    QDict *rsp = migrate_query(who);
-    status = qdict_get_str(rsp, "status");
-    if (g_str_equal(status, "failed")) {
-        g_printerr("query-migrate shows failed migration: %s\n",
-                   qdict_get_str(rsp, "error-desc"));
-    }
-    g_assert(!g_str_equal(status, "failed"));
-    return rsp;
-}
-
-/*
- * Note: caller is responsible to free the returned object via
- * g_free() after use
- */
-static gchar *migrate_query_status(QTestState *who)
-{
-    QDict *rsp_return = migrate_query(who);
-    gchar *status = g_strdup(qdict_get_str(rsp_return, "status"));
-
-    g_assert(status);
-    qobject_unref(rsp_return);
-
-    return status;
-}
-
-static bool check_migration_status(QTestState *who, const char *goal,
-                                   const char **ungoals)
-{
-    bool ready;
-    char *current_status;
-    const char **ungoal;
-
-    current_status = migrate_query_status(who);
-    ready = strcmp(current_status, goal) == 0;
-    if (!ungoals) {
-        g_assert_cmpstr(current_status, !=, "failed");
-        /*
-         * If looking for a state other than completed,
-         * completion of migration would cause the test to
-         * hang.
-         */
-        if (strcmp(goal, "completed") != 0) {
-            g_assert_cmpstr(current_status, !=, "completed");
-        }
-    } else {
-        for (ungoal = ungoals; *ungoal; ungoal++) {
-            g_assert_cmpstr(current_status, !=,  *ungoal);
-        }
-    }
-    g_free(current_status);
-    return ready;
-}
-
-void wait_for_migration_status(QTestState *who,
-                               const char *goal, const char **ungoals)
-{
-    g_test_timer_start();
-    while (!check_migration_status(who, goal, ungoals)) {
-        usleep(1000);
-
-        g_assert(g_test_timer_elapsed() < MIGRATION_STATUS_WAIT_TIMEOUT);
-    }
-}
-
-void wait_for_migration_complete(QTestState *who)
-{
-    wait_for_migration_status(who, "completed", NULL);
-}
-
-void wait_for_migration_fail(QTestState *from, bool allow_active)
-{
-    g_test_timer_start();
-    QDict *rsp_return;
-    char *status;
-    bool failed;
-
-    do {
-        status = migrate_query_status(from);
-        bool result = !strcmp(status, "setup") || !strcmp(status, "failed") ||
-            (allow_active && !strcmp(status, "active"));
-        if (!result) {
-            fprintf(stderr, "%s: unexpected status status=%s allow_active=%d\n",
-                    __func__, status, allow_active);
-        }
-        g_assert(result);
-        failed = !strcmp(status, "failed");
-        g_free(status);
-
-        g_assert(g_test_timer_elapsed() < MIGRATION_STATUS_WAIT_TIMEOUT);
-    } while (!failed);
-
-    /* Is the machine currently running? */
-    rsp_return = qtest_qmp_assert_success_ref(from,
-                                              "{ 'execute': 'query-status' }");
-    g_assert(qdict_haskey(rsp_return, "running"));
-    g_assert(qdict_get_bool(rsp_return, "running"));
-    qobject_unref(rsp_return);
-}
-
-char *find_common_machine_version(const char *mtype, const char *var1,
-                                  const char *var2)
-{
-    g_autofree char *type1 = qtest_resolve_machine_alias(var1, mtype);
-    g_autofree char *type2 = qtest_resolve_machine_alias(var2, mtype);
-
-    g_assert(type1 && type2);
-
-    if (g_str_equal(type1, type2)) {
-        /* either can be used */
-        return g_strdup(type1);
-    }
-
-    if (qtest_has_machine_with_env(var2, type1)) {
-        return g_strdup(type1);
-    }
-
-    if (qtest_has_machine_with_env(var1, type2)) {
-        return g_strdup(type2);
-    }
-
-    g_test_message("No common machine version for machine type '%s' between "
-                   "binaries %s and %s", mtype, getenv(var1), getenv(var2));
-    g_assert_not_reached();
-}
-
-char *resolve_machine_version(const char *alias, const char *var1,
-                              const char *var2)
-{
-    const char *mname = g_getenv("QTEST_QEMU_MACHINE_TYPE");
-    g_autofree char *machine_name = NULL;
-
-    if (mname) {
-        const char *dash = strrchr(mname, '-');
-        const char *dot = strrchr(mname, '.');
-
-        machine_name = g_strdup(mname);
-
-        if (dash && dot) {
-            assert(qtest_has_machine(machine_name));
-            return g_steal_pointer(&machine_name);
-        }
-        /* else: probably an alias, let it be resolved below */
-    } else {
-        /* use the hardcoded alias */
-        machine_name = g_strdup(alias);
-    }
-
-    return find_common_machine_version(machine_name, var1, var2);
-}
-
-typedef struct {
-    char *name;
-    void (*func)(void);
-} MigrationTest;
-
-static void migration_test_destroy(gpointer data)
-{
-    MigrationTest *test = (MigrationTest *)data;
-
-    g_free(test->name);
-    g_free(test);
-}
-
-static void migration_test_wrapper(const void *data)
-{
-    MigrationTest *test = (MigrationTest *)data;
-
-    g_test_message("Running /%s%s", qtest_get_arch(), test->name);
-    test->func();
-}
-
-void migration_test_add(const char *path, void (*fn)(void))
-{
-    MigrationTest *test = g_new0(MigrationTest, 1);
-
-    test->func = fn;
-    test->name = g_strdup(path);
-
-    qtest_add_data_func_full(path, test, migration_test_wrapper,
-                             migration_test_destroy);
-}
-
-#ifdef O_DIRECT
-/*
- * Probe for O_DIRECT support on the filesystem. Since this is used
- * for tests, be conservative, if anything fails, assume it's
- * unsupported.
- */
-bool probe_o_direct_support(const char *tmpfs)
-{
-    g_autofree char *filename = g_strdup_printf("%s/probe-o-direct", tmpfs);
-    int fd, flags = O_CREAT | O_RDWR | O_TRUNC | O_DIRECT;
-    void *buf;
-    ssize_t ret, len;
-    uint64_t offset;
-
-    fd = open(filename, flags, 0660);
-    if (fd < 0) {
-        unlink(filename);
-        return false;
-    }
-
-    /*
-     * Using 1MB alignment as conservative choice to satisfy any
-     * plausible architecture default page size, and/or filesystem
-     * alignment restrictions.
-     */
-    len = 0x100000;
-    offset = 0x100000;
-
-    buf = qemu_try_memalign(len, len);
-    g_assert(buf);
-
-    ret = pwrite(fd, buf, len, offset);
-    unlink(filename);
-    g_free(buf);
-
-    if (ret < 0) {
-        return false;
-    }
-
-    return true;
-}
-#endif
-
-/*
- * Wait for a "MIGRATION" event.  This is what Libvirt uses to track
- * migration status changes.
- */
-void migration_event_wait(QTestState *s, const char *target)
-{
-    QDict *response, *data;
-    const char *status;
-    bool found;
-
-    do {
-        response = qtest_qmp_eventwait_ref(s, "MIGRATION");
-        data = qdict_get_qdict(response, "data");
-        g_assert(data);
-        status = qdict_get_str(data, "status");
-        found = (strcmp(status, target) == 0);
-        qobject_unref(response);
-    } while (!found);
-}

From 0310d594d98b39f9dde79b87fd8b0ad16e7c5459 Mon Sep 17 00:00:00 2001
From: Juraj Marcin <jmarcin@redhat.com>
Date: Wed, 21 May 2025 17:16:13 +0200
Subject: [PATCH 1637/2760] ui/vnc: Update display update interval when VM
 state changes to RUNNING
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

If a virtual machine is paused for an extended period time, for example,
due to an incoming migration, there are also no changes on the screen.
VNC in such case increases the display update interval by
VNC_REFRESH_INTERVAL_INC (50 ms). The update interval can then grow up
to VNC_REFRESH_INTERVAL_MAX (3000 ms).

When the machine resumes, it can then take up to 3 seconds for the first
display update. Furthermore, the update interval is then halved with
each display update with changes on the screen. If there are moving
elements on the screen, such as a video, this can be perceived as
freezing and stuttering for few seconds before the movement is smooth
again.

This patch resolves this issue, by adding a listener to VM state changes
and changing the update interval when the VM state changes to RUNNING.
The update_displaychangelistener() function updates the internal timer,
and the display is refreshed immediately if the timer is expired.

Signed-off-by: Juraj Marcin <jmarcin@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Link: https://lore.kernel.org/r/20250521151616.3951178-1-jmarcin@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 ui/vnc.c | 12 ++++++++++++
 ui/vnc.h |  2 ++
 2 files changed, 14 insertions(+)

diff --git a/ui/vnc.c b/ui/vnc.c
index d095cd7da3..e9c30aad62 100644
--- a/ui/vnc.c
+++ b/ui/vnc.c
@@ -3385,6 +3385,16 @@ static const DisplayChangeListenerOps dcl_ops = {
     .dpy_cursor_define    = vnc_dpy_cursor_define,
 };
 
+static void vmstate_change_handler(void *opaque, bool running, RunState state)
+{
+    VncDisplay *vd = opaque;
+
+    if (state != RUN_STATE_RUNNING) {
+        return;
+    }
+    update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_BASE);
+}
+
 void vnc_display_init(const char *id, Error **errp)
 {
     VncDisplay *vd;
@@ -3421,6 +3431,8 @@ void vnc_display_init(const char *id, Error **errp)
     vd->dcl.ops = &dcl_ops;
     register_displaychangelistener(&vd->dcl);
     vd->kbd = qkbd_state_init(vd->dcl.con);
+    vd->vmstate_handler_entry = qemu_add_vm_change_state_handler(
+        &vmstate_change_handler, vd);
 }
 
 
diff --git a/ui/vnc.h b/ui/vnc.h
index 02613aa63a..b3e07269bb 100644
--- a/ui/vnc.h
+++ b/ui/vnc.h
@@ -185,6 +185,8 @@ struct VncDisplay
 #endif
 
     AudioState *audio_state;
+
+    VMChangeStateEntry *vmstate_handler_entry;
 };
 
 typedef struct VncTight {

From 8f87c87eca4bc62258251eade7016f8a084b0988 Mon Sep 17 00:00:00 2001
From: Jaehoon Kim <jhkim@linux.ibm.com>
Date: Wed, 11 Jun 2025 15:56:10 -0500
Subject: [PATCH 1638/2760] migration: Support fd-based socket address in
 cpr_transfer_input

Extend cpr_transfer_input to handle SOCKET_ADDRESS_TYPE_FD alongside
SOCKET_ADDRESS_TYPE_UNIX. This change supports the use of pre-listened
socket file descriptors for cpr migration channels.

This change is particularly useful in qtest environments, where the
socket may be created externally and passed via fd.

Reviewed-by: Jason J. Herne <jjherne@linux.ibm.com>
Reviewed-by: Steve Sistare <steven.sistare@oracle.com>
Signed-off-by: Jaehoon Kim <jhkim@linux.ibm.com>
Link: https://lore.kernel.org/r/20250611205610.147008-3-jhkim@linux.ibm.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/cpr-transfer.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/migration/cpr-transfer.c b/migration/cpr-transfer.c
index e1f140359c..00371d17c3 100644
--- a/migration/cpr-transfer.c
+++ b/migration/cpr-transfer.c
@@ -46,7 +46,8 @@ QEMUFile *cpr_transfer_input(MigrationChannel *channel, Error **errp)
     MigrationAddress *addr = channel->addr;
 
     if (addr->transport == MIGRATION_ADDRESS_TYPE_SOCKET &&
-        addr->u.socket.type == SOCKET_ADDRESS_TYPE_UNIX) {
+        (addr->u.socket.type == SOCKET_ADDRESS_TYPE_UNIX ||
+            addr->u.socket.type == SOCKET_ADDRESS_TYPE_FD)) {
 
         g_autoptr(QIOChannelSocket) sioc = NULL;
         SocketAddress *saddr = &addr->u.socket;
@@ -60,7 +61,9 @@ QEMUFile *cpr_transfer_input(MigrationChannel *channel, Error **errp)
 
         sioc = qio_net_listener_wait_client(listener);
         ioc = QIO_CHANNEL(sioc);
-        trace_cpr_transfer_input(addr->u.socket.u.q_unix.path);
+        trace_cpr_transfer_input(
+            addr->u.socket.type == SOCKET_ADDRESS_TYPE_UNIX ?
+            addr->u.socket.u.q_unix.path : addr->u.socket.u.fd.str);
         qio_channel_set_name(ioc, "cpr-in");
         return qemu_file_new_input(ioc);
 

From 430671f52669e84c176c4d3b9091b88b51f542fb Mon Sep 17 00:00:00 2001
From: Jaehoon Kim <jhkim@linux.ibm.com>
Date: Wed, 11 Jun 2025 15:56:09 -0500
Subject: [PATCH 1639/2760] tests/migration: Setup pre-listened cpr.sock to
 remove race-condition.

When the source VM attempts to connect to the destination VM's Unix
domain socket (cpr.sock) during a cpr-transfer test, race conditions can
occur if the socket file isn't ready. This can lead to connection
failures when running tests.

This patch creates and listens on the socket in advance, and passes the
pre-listened FD directly. This avoids timing issues and improves the
reliability of CPR tests.

Reviewed-by: Jason J. Herne <jjherne@linux.ibm.com>
Signed-off-by: Jaehoon Kim <jhkim@linux.ibm.com>
Reviewed-by: Steve Sistare <steven.sistare@oracle.com>
Link: https://lore.kernel.org/r/20250611205610.147008-2-jhkim@linux.ibm.com
[peterx: null-initialize opts_target, per Steve]
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 tests/qtest/migration/cpr-tests.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/tests/qtest/migration/cpr-tests.c b/tests/qtest/migration/cpr-tests.c
index 5536e14610..5e764a6787 100644
--- a/tests/qtest/migration/cpr-tests.c
+++ b/tests/qtest/migration/cpr-tests.c
@@ -60,13 +60,12 @@ static void test_mode_transfer_common(bool incoming_defer)
     g_autofree char *cpr_path = g_strdup_printf("%s/cpr.sock", tmpfs);
     g_autofree char *mig_path = g_strdup_printf("%s/migsocket", tmpfs);
     g_autofree char *uri = g_strdup_printf("unix:%s", mig_path);
+    g_autofree char *opts_target = NULL;
 
     const char *opts = "-machine aux-ram-share=on -nodefaults";
     g_autofree const char *cpr_channel = g_strdup_printf(
         "cpr,addr.transport=socket,addr.type=unix,addr.path=%s",
         cpr_path);
-    g_autofree char *opts_target = g_strdup_printf("-incoming %s %s",
-                                                   cpr_channel, opts);
 
     g_autofree char *connect_channels = g_strdup_printf(
         "[ { 'channel-type': 'main',"
@@ -75,6 +74,17 @@ static void test_mode_transfer_common(bool incoming_defer)
         "              'path': '%s' } } ]",
         mig_path);
 
+    /*
+     * Set up a UNIX domain socket for the CPR channel before
+     * launching the destination VM, to avoid timing issues
+     * during connection setup.
+     */
+    int cpr_sockfd = qtest_socket_server(cpr_path);
+    g_assert(cpr_sockfd >= 0);
+
+    opts_target = g_strdup_printf("-incoming cpr,addr.transport=socket,"
+                                  "addr.type=fd,addr.str=%d %s",
+                                  cpr_sockfd, opts);
     MigrateCommon args = {
         .start.opts_source = opts,
         .start.opts_target = opts_target,

From 983899eab4939dc4dff67fa4d822c5b4df7eae21 Mon Sep 17 00:00:00 2001
From: "Chaney, Ben" <bchaney@akamai.com>
Date: Mon, 16 Jun 2025 20:56:50 +0000
Subject: [PATCH 1640/2760] migration: Don't sync volatile memory after
 migration completes

Syncing volatile memory provides no benefit, instead it can cause
performance issues in some cases.  Only sync memory that is marked as
non-volatile after migration completes on destination.

Signed-off-by: Ben Chaney <bchaney@akamai.com>
Fixes: bd108a44bc29 (migration: ram: Switch to ram block writeback)
Link: https://lore.kernel.org/r/1CC43F59-336F-4A12-84AD-DB89E0A17A95@akamai.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/ram.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/migration/ram.c b/migration/ram.c
index fd8d83b63c..024d8b3d03 100644
--- a/migration/ram.c
+++ b/migration/ram.c
@@ -3680,7 +3680,9 @@ static int ram_load_cleanup(void *opaque)
     RAMBlock *rb;
 
     RAMBLOCK_FOREACH_NOT_IGNORED(rb) {
-        qemu_ram_block_writeback(rb);
+        if (memory_region_is_nonvolatile(rb->mr)) {
+            qemu_ram_block_writeback(rb);
+        }
     }
 
     xbzrle_load_cleanup();

From f47a672a72acd6e2712031f0bc4d4f3ae4b6302c Mon Sep 17 00:00:00 2001
From: Chenyi Qiang <chenyi.qiang@intel.com>
Date: Thu, 12 Jun 2025 16:27:42 +0800
Subject: [PATCH 1641/2760] memory: Export a helper to get intersection of a
 MemoryRegionSection with a given range

Rename the helper to memory_region_section_intersect_range() to make it
more generic. Meanwhile, define the @end as Int128 and replace the
related operations with Int128_* format since the helper is exported as
a wider API.

Suggested-by: Alexey Kardashevskiy <aik@amd.com>
Reviewed-by: Alexey Kardashevskiy <aik@amd.com>
Reviewed-by: Pankaj Gupta <pankaj.gupta@amd.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Signed-off-by: Chenyi Qiang <chenyi.qiang@intel.com>
Link: https://lore.kernel.org/r/20250612082747.51539-2-chenyi.qiang@intel.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 hw/virtio/virtio-mem.c  | 32 +++++---------------------------
 include/system/memory.h | 30 ++++++++++++++++++++++++++++++
 2 files changed, 35 insertions(+), 27 deletions(-)

diff --git a/hw/virtio/virtio-mem.c b/hw/virtio/virtio-mem.c
index a3d1a676e7..b3c126ea1e 100644
--- a/hw/virtio/virtio-mem.c
+++ b/hw/virtio/virtio-mem.c
@@ -244,28 +244,6 @@ static int virtio_mem_for_each_plugged_range(VirtIOMEM *vmem, void *arg,
     return ret;
 }
 
-/*
- * Adjust the memory section to cover the intersection with the given range.
- *
- * Returns false if the intersection is empty, otherwise returns true.
- */
-static bool virtio_mem_intersect_memory_section(MemoryRegionSection *s,
-                                                uint64_t offset, uint64_t size)
-{
-    uint64_t start = MAX(s->offset_within_region, offset);
-    uint64_t end = MIN(s->offset_within_region + int128_get64(s->size),
-                       offset + size);
-
-    if (end <= start) {
-        return false;
-    }
-
-    s->offset_within_address_space += start - s->offset_within_region;
-    s->offset_within_region = start;
-    s->size = int128_make64(end - start);
-    return true;
-}
-
 typedef int (*virtio_mem_section_cb)(MemoryRegionSection *s, void *arg);
 
 static int virtio_mem_for_each_plugged_section(const VirtIOMEM *vmem,
@@ -287,7 +265,7 @@ static int virtio_mem_for_each_plugged_section(const VirtIOMEM *vmem,
                                       first_bit + 1) - 1;
         size = (last_bit - first_bit + 1) * vmem->block_size;
 
-        if (!virtio_mem_intersect_memory_section(&tmp, offset, size)) {
+        if (!memory_region_section_intersect_range(&tmp, offset, size)) {
             break;
         }
         ret = cb(&tmp, arg);
@@ -319,7 +297,7 @@ static int virtio_mem_for_each_unplugged_section(const VirtIOMEM *vmem,
                                  first_bit + 1) - 1;
         size = (last_bit - first_bit + 1) * vmem->block_size;
 
-        if (!virtio_mem_intersect_memory_section(&tmp, offset, size)) {
+        if (!memory_region_section_intersect_range(&tmp, offset, size)) {
             break;
         }
         ret = cb(&tmp, arg);
@@ -355,7 +333,7 @@ static void virtio_mem_notify_unplug(VirtIOMEM *vmem, uint64_t offset,
     QLIST_FOREACH(rdl, &vmem->rdl_list, next) {
         MemoryRegionSection tmp = *rdl->section;
 
-        if (!virtio_mem_intersect_memory_section(&tmp, offset, size)) {
+        if (!memory_region_section_intersect_range(&tmp, offset, size)) {
             continue;
         }
         rdl->notify_discard(rdl, &tmp);
@@ -371,7 +349,7 @@ static int virtio_mem_notify_plug(VirtIOMEM *vmem, uint64_t offset,
     QLIST_FOREACH(rdl, &vmem->rdl_list, next) {
         MemoryRegionSection tmp = *rdl->section;
 
-        if (!virtio_mem_intersect_memory_section(&tmp, offset, size)) {
+        if (!memory_region_section_intersect_range(&tmp, offset, size)) {
             continue;
         }
         ret = rdl->notify_populate(rdl, &tmp);
@@ -388,7 +366,7 @@ static int virtio_mem_notify_plug(VirtIOMEM *vmem, uint64_t offset,
             if (rdl2 == rdl) {
                 break;
             }
-            if (!virtio_mem_intersect_memory_section(&tmp, offset, size)) {
+            if (!memory_region_section_intersect_range(&tmp, offset, size)) {
                 continue;
             }
             rdl2->notify_discard(rdl2, &tmp);
diff --git a/include/system/memory.h b/include/system/memory.h
index 0848690ea4..da97753e28 100644
--- a/include/system/memory.h
+++ b/include/system/memory.h
@@ -1211,6 +1211,36 @@ MemoryRegionSection *memory_region_section_new_copy(MemoryRegionSection *s);
  */
 void memory_region_section_free_copy(MemoryRegionSection *s);
 
+/**
+ * memory_region_section_intersect_range: Adjust the memory section to cover
+ * the intersection with the given range.
+ *
+ * @s: the #MemoryRegionSection to be adjusted
+ * @offset: the offset of the given range in the memory region
+ * @size: the size of the given range
+ *
+ * Returns false if the intersection is empty, otherwise returns true.
+ */
+static inline bool memory_region_section_intersect_range(MemoryRegionSection *s,
+                                                         uint64_t offset,
+                                                         uint64_t size)
+{
+    uint64_t start = MAX(s->offset_within_region, offset);
+    Int128 end = int128_min(int128_add(int128_make64(s->offset_within_region),
+                                       s->size),
+                            int128_add(int128_make64(offset),
+                                       int128_make64(size)));
+
+    if (int128_le(end, int128_make64(start))) {
+        return false;
+    }
+
+    s->offset_within_address_space += start - s->offset_within_region;
+    s->offset_within_region = start;
+    s->size = int128_sub(end, int128_make64(start));
+    return true;
+}
+
 /**
  * memory_region_init: Initialize a memory region
  *

From ff1211154c45c9f7f82116ae9a8c72a848e4a8b5 Mon Sep 17 00:00:00 2001
From: Chenyi Qiang <chenyi.qiang@intel.com>
Date: Thu, 12 Jun 2025 16:27:43 +0800
Subject: [PATCH 1642/2760] memory: Change
 memory_region_set_ram_discard_manager() to return the result

Modify memory_region_set_ram_discard_manager() to return -EBUSY if a
RamDiscardManager is already set in the MemoryRegion. The caller must
handle this failure, such as having virtio-mem undo its actions and fail
the realize() process. Opportunistically move the call earlier to avoid
complex error handling.

This change is beneficial when introducing a new RamDiscardManager
instance besides virtio-mem. After
ram_block_coordinated_discard_require(true) unlocks all
RamDiscardManager instances, only one instance is allowed to be set for
one MemoryRegion at present.

Suggested-by: David Hildenbrand <david@redhat.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Pankaj Gupta <pankaj.gupta@amd.com>
Tested-by: Alexey Kardashevskiy <aik@amd.com>
Reviewed-by: Alexey Kardashevskiy <aik@amd.com>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Signed-off-by: Chenyi Qiang <chenyi.qiang@intel.com>
Link: https://lore.kernel.org/r/20250612082747.51539-3-chenyi.qiang@intel.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 hw/virtio/virtio-mem.c  | 30 +++++++++++++++++-------------
 include/system/memory.h |  6 +++---
 system/memory.c         | 10 +++++++---
 3 files changed, 27 insertions(+), 19 deletions(-)

diff --git a/hw/virtio/virtio-mem.c b/hw/virtio/virtio-mem.c
index b3c126ea1e..2e491e8c44 100644
--- a/hw/virtio/virtio-mem.c
+++ b/hw/virtio/virtio-mem.c
@@ -1047,6 +1047,17 @@ static void virtio_mem_device_realize(DeviceState *dev, Error **errp)
         return;
     }
 
+    /*
+     * Set ourselves as RamDiscardManager before the plug handler maps the
+     * memory region and exposes it via an address space.
+     */
+    if (memory_region_set_ram_discard_manager(&vmem->memdev->mr,
+                                              RAM_DISCARD_MANAGER(vmem))) {
+        error_setg(errp, "Failed to set RamDiscardManager");
+        ram_block_coordinated_discard_require(false);
+        return;
+    }
+
     /*
      * We don't know at this point whether shared RAM is migrated using
      * QEMU or migrated using the file content. "x-ignore-shared" will be
@@ -1061,6 +1072,7 @@ static void virtio_mem_device_realize(DeviceState *dev, Error **errp)
         ret = ram_block_discard_range(rb, 0, qemu_ram_get_used_length(rb));
         if (ret) {
             error_setg_errno(errp, -ret, "Unexpected error discarding RAM");
+            memory_region_set_ram_discard_manager(&vmem->memdev->mr, NULL);
             ram_block_coordinated_discard_require(false);
             return;
         }
@@ -1122,13 +1134,6 @@ static void virtio_mem_device_realize(DeviceState *dev, Error **errp)
     vmem->system_reset = VIRTIO_MEM_SYSTEM_RESET(obj);
     vmem->system_reset->vmem = vmem;
     qemu_register_resettable(obj);
-
-    /*
-     * Set ourselves as RamDiscardManager before the plug handler maps the
-     * memory region and exposes it via an address space.
-     */
-    memory_region_set_ram_discard_manager(&vmem->memdev->mr,
-                                          RAM_DISCARD_MANAGER(vmem));
 }
 
 static void virtio_mem_device_unrealize(DeviceState *dev)
@@ -1136,12 +1141,6 @@ static void virtio_mem_device_unrealize(DeviceState *dev)
     VirtIODevice *vdev = VIRTIO_DEVICE(dev);
     VirtIOMEM *vmem = VIRTIO_MEM(dev);
 
-    /*
-     * The unplug handler unmapped the memory region, it cannot be
-     * found via an address space anymore. Unset ourselves.
-     */
-    memory_region_set_ram_discard_manager(&vmem->memdev->mr, NULL);
-
     qemu_unregister_resettable(OBJECT(vmem->system_reset));
     object_unref(OBJECT(vmem->system_reset));
 
@@ -1154,6 +1153,11 @@ static void virtio_mem_device_unrealize(DeviceState *dev)
     virtio_del_queue(vdev, 0);
     virtio_cleanup(vdev);
     g_free(vmem->bitmap);
+    /*
+     * The unplug handler unmapped the memory region, it cannot be
+     * found via an address space anymore. Unset ourselves.
+     */
+    memory_region_set_ram_discard_manager(&vmem->memdev->mr, NULL);
     ram_block_coordinated_discard_require(false);
 }
 
diff --git a/include/system/memory.h b/include/system/memory.h
index da97753e28..60983d4977 100644
--- a/include/system/memory.h
+++ b/include/system/memory.h
@@ -2499,13 +2499,13 @@ static inline bool memory_region_has_ram_discard_manager(MemoryRegion *mr)
  *
  * This function must not be called for a mapped #MemoryRegion, a #MemoryRegion
  * that does not cover RAM, or a #MemoryRegion that already has a
- * #RamDiscardManager assigned.
+ * #RamDiscardManager assigned. Return 0 if the rdm is set successfully.
  *
  * @mr: the #MemoryRegion
  * @rdm: #RamDiscardManager to set
  */
-void memory_region_set_ram_discard_manager(MemoryRegion *mr,
-                                           RamDiscardManager *rdm);
+int memory_region_set_ram_discard_manager(MemoryRegion *mr,
+                                          RamDiscardManager *rdm);
 
 /**
  * memory_region_find: translate an address/size relative to a
diff --git a/system/memory.c b/system/memory.c
index 306e9ff9eb..d0c186e9f6 100644
--- a/system/memory.c
+++ b/system/memory.c
@@ -2106,12 +2106,16 @@ RamDiscardManager *memory_region_get_ram_discard_manager(MemoryRegion *mr)
     return mr->rdm;
 }
 
-void memory_region_set_ram_discard_manager(MemoryRegion *mr,
-                                           RamDiscardManager *rdm)
+int memory_region_set_ram_discard_manager(MemoryRegion *mr,
+                                          RamDiscardManager *rdm)
 {
     g_assert(memory_region_is_ram(mr));
-    g_assert(!rdm || !mr->rdm);
+    if (mr->rdm && rdm) {
+        return -EBUSY;
+    }
+
     mr->rdm = rdm;
+    return 0;
 }
 
 uint64_t ram_discard_manager_get_min_granularity(const RamDiscardManager *rdm,

From 2205b8466733f8c6e3306c964f31c5a7cac69dfa Mon Sep 17 00:00:00 2001
From: Chenyi Qiang <chenyi.qiang@intel.com>
Date: Thu, 12 Jun 2025 16:27:44 +0800
Subject: [PATCH 1643/2760] memory: Unify the definiton of ReplayRamPopulate()
 and ReplayRamDiscard()

Update ReplayRamDiscard() function to return the result and unify the
ReplayRamPopulate() and ReplayRamDiscard() to ReplayRamDiscardState() at
the same time due to their identical definitions. This unification
simplifies related structures, such as VirtIOMEMReplayData, which makes
it cleaner.

Reviewed-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Pankaj Gupta <pankaj.gupta@amd.com>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Signed-off-by: Chenyi Qiang <chenyi.qiang@intel.com>
Link: https://lore.kernel.org/r/20250612082747.51539-4-chenyi.qiang@intel.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 hw/virtio/virtio-mem.c  | 21 ++++++------
 include/system/memory.h | 74 +++++++++++++++++++++++++++++++----------
 migration/ram.c         |  5 +--
 system/memory.c         | 12 +++----
 4 files changed, 76 insertions(+), 36 deletions(-)

diff --git a/hw/virtio/virtio-mem.c b/hw/virtio/virtio-mem.c
index 2e491e8c44..c46f6f9c3e 100644
--- a/hw/virtio/virtio-mem.c
+++ b/hw/virtio/virtio-mem.c
@@ -1732,7 +1732,7 @@ static bool virtio_mem_rdm_is_populated(const RamDiscardManager *rdm,
 }
 
 struct VirtIOMEMReplayData {
-    void *fn;
+    ReplayRamDiscardState fn;
     void *opaque;
 };
 
@@ -1740,12 +1740,12 @@ static int virtio_mem_rdm_replay_populated_cb(MemoryRegionSection *s, void *arg)
 {
     struct VirtIOMEMReplayData *data = arg;
 
-    return ((ReplayRamPopulate)data->fn)(s, data->opaque);
+    return data->fn(s, data->opaque);
 }
 
 static int virtio_mem_rdm_replay_populated(const RamDiscardManager *rdm,
                                            MemoryRegionSection *s,
-                                           ReplayRamPopulate replay_fn,
+                                           ReplayRamDiscardState replay_fn,
                                            void *opaque)
 {
     const VirtIOMEM *vmem = VIRTIO_MEM(rdm);
@@ -1764,14 +1764,13 @@ static int virtio_mem_rdm_replay_discarded_cb(MemoryRegionSection *s,
 {
     struct VirtIOMEMReplayData *data = arg;
 
-    ((ReplayRamDiscard)data->fn)(s, data->opaque);
-    return 0;
+    return data->fn(s, data->opaque);
 }
 
-static void virtio_mem_rdm_replay_discarded(const RamDiscardManager *rdm,
-                                            MemoryRegionSection *s,
-                                            ReplayRamDiscard replay_fn,
-                                            void *opaque)
+static int virtio_mem_rdm_replay_discarded(const RamDiscardManager *rdm,
+                                           MemoryRegionSection *s,
+                                           ReplayRamDiscardState replay_fn,
+                                           void *opaque)
 {
     const VirtIOMEM *vmem = VIRTIO_MEM(rdm);
     struct VirtIOMEMReplayData data = {
@@ -1780,8 +1779,8 @@ static void virtio_mem_rdm_replay_discarded(const RamDiscardManager *rdm,
     };
 
     g_assert(s->mr == &vmem->memdev->mr);
-    virtio_mem_for_each_unplugged_section(vmem, s, &data,
-                                          virtio_mem_rdm_replay_discarded_cb);
+    return virtio_mem_for_each_unplugged_section(vmem, s, &data,
+                                                 virtio_mem_rdm_replay_discarded_cb);
 }
 
 static void virtio_mem_rdm_register_listener(RamDiscardManager *rdm,
diff --git a/include/system/memory.h b/include/system/memory.h
index 60983d4977..46248d4a52 100644
--- a/include/system/memory.h
+++ b/include/system/memory.h
@@ -576,8 +576,20 @@ static inline void ram_discard_listener_init(RamDiscardListener *rdl,
     rdl->double_discard_supported = double_discard_supported;
 }
 
-typedef int (*ReplayRamPopulate)(MemoryRegionSection *section, void *opaque);
-typedef void (*ReplayRamDiscard)(MemoryRegionSection *section, void *opaque);
+/**
+ * typedef ReplayRamDiscardState:
+ *
+ * The callback handler for #RamDiscardManagerClass.replay_populated/
+ * #RamDiscardManagerClass.replay_discarded to invoke on populated/discarded
+ * parts.
+ *
+ * @section: the #MemoryRegionSection of populated/discarded part
+ * @opaque: pointer to forward to the callback
+ *
+ * Returns 0 on success, or a negative error if failed.
+ */
+typedef int (*ReplayRamDiscardState)(MemoryRegionSection *section,
+                                     void *opaque);
 
 /*
  * RamDiscardManagerClass:
@@ -651,36 +663,38 @@ struct RamDiscardManagerClass {
     /**
      * @replay_populated:
      *
-     * Call the #ReplayRamPopulate callback for all populated parts within the
-     * #MemoryRegionSection via the #RamDiscardManager.
+     * Call the #ReplayRamDiscardState callback for all populated parts within
+     * the #MemoryRegionSection via the #RamDiscardManager.
      *
      * In case any call fails, no further calls are made.
      *
      * @rdm: the #RamDiscardManager
      * @section: the #MemoryRegionSection
-     * @replay_fn: the #ReplayRamPopulate callback
+     * @replay_fn: the #ReplayRamDiscardState callback
      * @opaque: pointer to forward to the callback
      *
      * Returns 0 on success, or a negative error if any notification failed.
      */
     int (*replay_populated)(const RamDiscardManager *rdm,
                             MemoryRegionSection *section,
-                            ReplayRamPopulate replay_fn, void *opaque);
+                            ReplayRamDiscardState replay_fn, void *opaque);
 
     /**
      * @replay_discarded:
      *
-     * Call the #ReplayRamDiscard callback for all discarded parts within the
-     * #MemoryRegionSection via the #RamDiscardManager.
+     * Call the #ReplayRamDiscardState callback for all discarded parts within
+     * the #MemoryRegionSection via the #RamDiscardManager.
      *
      * @rdm: the #RamDiscardManager
      * @section: the #MemoryRegionSection
-     * @replay_fn: the #ReplayRamDiscard callback
+     * @replay_fn: the #ReplayRamDiscardState callback
      * @opaque: pointer to forward to the callback
+     *
+     * Returns 0 on success, or a negative error if any notification failed.
      */
-    void (*replay_discarded)(const RamDiscardManager *rdm,
-                             MemoryRegionSection *section,
-                             ReplayRamDiscard replay_fn, void *opaque);
+    int (*replay_discarded)(const RamDiscardManager *rdm,
+                            MemoryRegionSection *section,
+                            ReplayRamDiscardState replay_fn, void *opaque);
 
     /**
      * @register_listener:
@@ -721,15 +735,41 @@ uint64_t ram_discard_manager_get_min_granularity(const RamDiscardManager *rdm,
 bool ram_discard_manager_is_populated(const RamDiscardManager *rdm,
                                       const MemoryRegionSection *section);
 
+/**
+ * ram_discard_manager_replay_populated:
+ *
+ * A wrapper to call the #RamDiscardManagerClass.replay_populated callback
+ * of the #RamDiscardManager.
+ *
+ * @rdm: the #RamDiscardManager
+ * @section: the #MemoryRegionSection
+ * @replay_fn: the #ReplayRamDiscardState callback
+ * @opaque: pointer to forward to the callback
+ *
+ * Returns 0 on success, or a negative error if any notification failed.
+ */
 int ram_discard_manager_replay_populated(const RamDiscardManager *rdm,
                                          MemoryRegionSection *section,
-                                         ReplayRamPopulate replay_fn,
+                                         ReplayRamDiscardState replay_fn,
                                          void *opaque);
 
-void ram_discard_manager_replay_discarded(const RamDiscardManager *rdm,
-                                          MemoryRegionSection *section,
-                                          ReplayRamDiscard replay_fn,
-                                          void *opaque);
+/**
+ * ram_discard_manager_replay_discarded:
+ *
+ * A wrapper to call the #RamDiscardManagerClass.replay_discarded callback
+ * of the #RamDiscardManager.
+ *
+ * @rdm: the #RamDiscardManager
+ * @section: the #MemoryRegionSection
+ * @replay_fn: the #ReplayRamDiscardState callback
+ * @opaque: pointer to forward to the callback
+ *
+ * Returns 0 on success, or a negative error if any notification failed.
+ */
+int ram_discard_manager_replay_discarded(const RamDiscardManager *rdm,
+                                         MemoryRegionSection *section,
+                                         ReplayRamDiscardState replay_fn,
+                                         void *opaque);
 
 void ram_discard_manager_register_listener(RamDiscardManager *rdm,
                                            RamDiscardListener *rdl,
diff --git a/migration/ram.c b/migration/ram.c
index 024d8b3d03..2140785a05 100644
--- a/migration/ram.c
+++ b/migration/ram.c
@@ -856,8 +856,8 @@ static inline bool migration_bitmap_clear_dirty(RAMState *rs,
     return ret;
 }
 
-static void dirty_bitmap_clear_section(MemoryRegionSection *section,
-                                       void *opaque)
+static int dirty_bitmap_clear_section(MemoryRegionSection *section,
+                                      void *opaque)
 {
     const hwaddr offset = section->offset_within_region;
     const hwaddr size = int128_get64(section->size);
@@ -876,6 +876,7 @@ static void dirty_bitmap_clear_section(MemoryRegionSection *section,
     }
     *cleared_bits += bitmap_count_one_with_offset(rb->bmap, start, npages);
     bitmap_clear(rb->bmap, start, npages);
+    return 0;
 }
 
 /*
diff --git a/system/memory.c b/system/memory.c
index d0c186e9f6..76b44b8220 100644
--- a/system/memory.c
+++ b/system/memory.c
@@ -2138,7 +2138,7 @@ bool ram_discard_manager_is_populated(const RamDiscardManager *rdm,
 
 int ram_discard_manager_replay_populated(const RamDiscardManager *rdm,
                                          MemoryRegionSection *section,
-                                         ReplayRamPopulate replay_fn,
+                                         ReplayRamDiscardState replay_fn,
                                          void *opaque)
 {
     RamDiscardManagerClass *rdmc = RAM_DISCARD_MANAGER_GET_CLASS(rdm);
@@ -2147,15 +2147,15 @@ int ram_discard_manager_replay_populated(const RamDiscardManager *rdm,
     return rdmc->replay_populated(rdm, section, replay_fn, opaque);
 }
 
-void ram_discard_manager_replay_discarded(const RamDiscardManager *rdm,
-                                          MemoryRegionSection *section,
-                                          ReplayRamDiscard replay_fn,
-                                          void *opaque)
+int ram_discard_manager_replay_discarded(const RamDiscardManager *rdm,
+                                         MemoryRegionSection *section,
+                                         ReplayRamDiscardState replay_fn,
+                                         void *opaque)
 {
     RamDiscardManagerClass *rdmc = RAM_DISCARD_MANAGER_GET_CLASS(rdm);
 
     g_assert(rdmc->replay_discarded);
-    rdmc->replay_discarded(rdm, section, replay_fn, opaque);
+    return rdmc->replay_discarded(rdm, section, replay_fn, opaque);
 }
 
 void ram_discard_manager_register_listener(RamDiscardManager *rdm,

From 5d6483edaa9232d8f3709f68c8eab4bc2033fb70 Mon Sep 17 00:00:00 2001
From: Chenyi Qiang <chenyi.qiang@intel.com>
Date: Thu, 12 Jun 2025 16:27:45 +0800
Subject: [PATCH 1644/2760] ram-block-attributes: Introduce RamBlockAttributes
 to manage RAMBlock with guest_memfd

Commit 852f0048f3 ("RAMBlock: make guest_memfd require uncoordinated
discard") highlighted that subsystems like VFIO may disable RAM block
discard. However, guest_memfd relies on discard operations for page
conversion between private and shared memory, potentially leading to
the stale IOMMU mapping issue when assigning hardware devices to
confidential VMs via shared memory. To address this and allow shared
device assignement, it is crucial to ensure the VFIO system refreshes
its IOMMU mappings.

RamDiscardManager is an existing interface (used by virtio-mem) to
adjust VFIO mappings in relation to VM page assignment. Effectively page
conversion is similar to hot-removing a page in one mode and adding it
back in the other. Therefore, similar actions are required for page
conversion events. Introduce the RamDiscardManager to guest_memfd to
facilitate this process.

Since guest_memfd is not an object, it cannot directly implement the
RamDiscardManager interface. Implementing it in HostMemoryBackend is
not appropriate because guest_memfd is per RAMBlock, and some RAMBlocks
have a memory backend while others do not. Notably, virtual BIOS
RAMBlocks using memory_region_init_ram_guest_memfd() do not have a
backend.

To manage RAMBlocks with guest_memfd, define a new object named
RamBlockAttributes to implement the RamDiscardManager interface. This
object can store the guest_memfd information such as the bitmap for
shared memory and the registered listeners for event notifications. A
new state_change() helper function is provided to notify listeners, such
as VFIO, allowing VFIO to do dynamically DMA map and unmap for the shared
memory according to conversion events. Note that in the current context
of RamDiscardManager for guest_memfd, the shared state is analogous to
being populated, while the private state can be considered discarded for
simplicity. In the future, it would be more complicated if considering
more states like private/shared/discarded at the same time.

In current implementation, memory state tracking is performed at the
host page size granularity, as the minimum conversion size can be one
page per request. Additionally, VFIO expected the DMA mapping for a
specific IOVA to be mapped and unmapped with the same granularity.
Confidential VMs may perform partial conversions, such as conversions on
small regions within a larger one. To prevent such invalid cases and
until support for DMA mapping cut operations is available, all
operations are performed with 4K granularity.

In addition, memory conversion failures cause QEMU to quit rather than
resuming the guest or retrying the operation at present. It would be
future work to add more error handling or rollback mechanisms once
conversion failures are allowed. For example, in-place conversion of
guest_memfd could retry the unmap operation during the conversion from
shared to private. For now, keep the complex error handling out of the
picture as it is not required.

Tested-by: Alexey Kardashevskiy <aik@amd.com>
Reviewed-by: Alexey Kardashevskiy <aik@amd.com>
Reviewed-by: Pankaj Gupta <pankaj.gupta@amd.com>
Signed-off-by: Chenyi Qiang <chenyi.qiang@intel.com>
Link: https://lore.kernel.org/r/20250612082747.51539-5-chenyi.qiang@intel.com
[peterx: squash fixup from Chenyi to fix builds]
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 MAINTAINERS                   |   1 +
 include/system/ramblock.h     |  21 ++
 system/meson.build            |   1 +
 system/ram-block-attributes.c | 444 ++++++++++++++++++++++++++++++++++
 system/trace-events           |   3 +
 5 files changed, 470 insertions(+)
 create mode 100644 system/ram-block-attributes.c

diff --git a/MAINTAINERS b/MAINTAINERS
index 94c4076127..27f4fe3f25 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3175,6 +3175,7 @@ F: system/memory.c
 F: system/memory_mapping.c
 F: system/physmem.c
 F: system/memory-internal.h
+F: system/ram-block-attributes.c
 F: scripts/coccinelle/memory-region-housekeeping.cocci
 
 Memory devices
diff --git a/include/system/ramblock.h b/include/system/ramblock.h
index d8a116ba99..1bab9e2dac 100644
--- a/include/system/ramblock.h
+++ b/include/system/ramblock.h
@@ -22,6 +22,10 @@
 #include "exec/cpu-common.h"
 #include "qemu/rcu.h"
 #include "exec/ramlist.h"
+#include "system/hostmem.h"
+
+#define TYPE_RAM_BLOCK_ATTRIBUTES "ram-block-attributes"
+OBJECT_DECLARE_SIMPLE_TYPE(RamBlockAttributes, RAM_BLOCK_ATTRIBUTES)
 
 struct RAMBlock {
     struct rcu_head rcu;
@@ -91,4 +95,21 @@ struct RAMBlock {
     ram_addr_t postcopy_length;
 };
 
+struct RamBlockAttributes {
+    Object parent;
+
+    RAMBlock *ram_block;
+
+    /* 1-setting of the bitmap represents ram is populated (shared) */
+    unsigned bitmap_size;
+    unsigned long *bitmap;
+
+    QLIST_HEAD(, RamDiscardListener) rdl_list;
+};
+
+RamBlockAttributes *ram_block_attributes_create(RAMBlock *ram_block);
+void ram_block_attributes_destroy(RamBlockAttributes *attr);
+int ram_block_attributes_state_change(RamBlockAttributes *attr, uint64_t offset,
+                                      uint64_t size, bool to_discard);
+
 #endif
diff --git a/system/meson.build b/system/meson.build
index 7514bf3455..6d21ff9faa 100644
--- a/system/meson.build
+++ b/system/meson.build
@@ -17,6 +17,7 @@ system_ss.add(files(
   'dma-helpers.c',
   'globals.c',
   'ioport.c',
+  'ram-block-attributes.c',
   'memory_mapping.c',
   'memory.c',
   'physmem.c',
diff --git a/system/ram-block-attributes.c b/system/ram-block-attributes.c
new file mode 100644
index 0000000000..68e8a02703
--- /dev/null
+++ b/system/ram-block-attributes.c
@@ -0,0 +1,444 @@
+/*
+ * QEMU ram block attributes
+ *
+ * Copyright Intel
+ *
+ * Author:
+ *      Chenyi Qiang <chenyi.qiang@intel.com>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/error-report.h"
+#include "system/ramblock.h"
+#include "trace.h"
+
+OBJECT_DEFINE_SIMPLE_TYPE_WITH_INTERFACES(RamBlockAttributes,
+                                          ram_block_attributes,
+                                          RAM_BLOCK_ATTRIBUTES,
+                                          OBJECT,
+                                          { TYPE_RAM_DISCARD_MANAGER },
+                                          { })
+
+static size_t
+ram_block_attributes_get_block_size(const RamBlockAttributes *attr)
+{
+    /*
+     * Because page conversion could be manipulated in the size of at least 4K
+     * or 4K aligned, Use the host page size as the granularity to track the
+     * memory attribute.
+     */
+    g_assert(attr && attr->ram_block);
+    g_assert(attr->ram_block->page_size == qemu_real_host_page_size());
+    return attr->ram_block->page_size;
+}
+
+
+static bool
+ram_block_attributes_rdm_is_populated(const RamDiscardManager *rdm,
+                                      const MemoryRegionSection *section)
+{
+    const RamBlockAttributes *attr = RAM_BLOCK_ATTRIBUTES(rdm);
+    const size_t block_size = ram_block_attributes_get_block_size(attr);
+    const uint64_t first_bit = section->offset_within_region / block_size;
+    const uint64_t last_bit =
+        first_bit + int128_get64(section->size) / block_size - 1;
+    unsigned long first_discarded_bit;
+
+    first_discarded_bit = find_next_zero_bit(attr->bitmap, last_bit + 1,
+                                           first_bit);
+    return first_discarded_bit > last_bit;
+}
+
+typedef int (*ram_block_attributes_section_cb)(MemoryRegionSection *s,
+                                               void *arg);
+
+static int
+ram_block_attributes_notify_populate_cb(MemoryRegionSection *section,
+                                        void *arg)
+{
+    RamDiscardListener *rdl = arg;
+
+    return rdl->notify_populate(rdl, section);
+}
+
+static int
+ram_block_attributes_notify_discard_cb(MemoryRegionSection *section,
+                                       void *arg)
+{
+    RamDiscardListener *rdl = arg;
+
+    rdl->notify_discard(rdl, section);
+    return 0;
+}
+
+static int
+ram_block_attributes_for_each_populated_section(const RamBlockAttributes *attr,
+                                                MemoryRegionSection *section,
+                                                void *arg,
+                                                ram_block_attributes_section_cb cb)
+{
+    unsigned long first_bit, last_bit;
+    uint64_t offset, size;
+    const size_t block_size = ram_block_attributes_get_block_size(attr);
+    int ret = 0;
+
+    first_bit = section->offset_within_region / block_size;
+    first_bit = find_next_bit(attr->bitmap, attr->bitmap_size,
+                              first_bit);
+
+    while (first_bit < attr->bitmap_size) {
+        MemoryRegionSection tmp = *section;
+
+        offset = first_bit * block_size;
+        last_bit = find_next_zero_bit(attr->bitmap, attr->bitmap_size,
+                                      first_bit + 1) - 1;
+        size = (last_bit - first_bit + 1) * block_size;
+
+        if (!memory_region_section_intersect_range(&tmp, offset, size)) {
+            break;
+        }
+
+        ret = cb(&tmp, arg);
+        if (ret) {
+            error_report("%s: Failed to notify RAM discard listener: %s",
+                         __func__, strerror(-ret));
+            break;
+        }
+
+        first_bit = find_next_bit(attr->bitmap, attr->bitmap_size,
+                                  last_bit + 2);
+    }
+
+    return ret;
+}
+
+static int
+ram_block_attributes_for_each_discarded_section(const RamBlockAttributes *attr,
+                                                MemoryRegionSection *section,
+                                                void *arg,
+                                                ram_block_attributes_section_cb cb)
+{
+    unsigned long first_bit, last_bit;
+    uint64_t offset, size;
+    const size_t block_size = ram_block_attributes_get_block_size(attr);
+    int ret = 0;
+
+    first_bit = section->offset_within_region / block_size;
+    first_bit = find_next_zero_bit(attr->bitmap, attr->bitmap_size,
+                                   first_bit);
+
+    while (first_bit < attr->bitmap_size) {
+        MemoryRegionSection tmp = *section;
+
+        offset = first_bit * block_size;
+        last_bit = find_next_bit(attr->bitmap, attr->bitmap_size,
+                                 first_bit + 1) - 1;
+        size = (last_bit - first_bit + 1) * block_size;
+
+        if (!memory_region_section_intersect_range(&tmp, offset, size)) {
+            break;
+        }
+
+        ret = cb(&tmp, arg);
+        if (ret) {
+            error_report("%s: Failed to notify RAM discard listener: %s",
+                         __func__, strerror(-ret));
+            break;
+        }
+
+        first_bit = find_next_zero_bit(attr->bitmap,
+                                       attr->bitmap_size,
+                                       last_bit + 2);
+    }
+
+    return ret;
+}
+
+static uint64_t
+ram_block_attributes_rdm_get_min_granularity(const RamDiscardManager *rdm,
+                                             const MemoryRegion *mr)
+{
+    const RamBlockAttributes *attr = RAM_BLOCK_ATTRIBUTES(rdm);
+
+    g_assert(mr == attr->ram_block->mr);
+    return ram_block_attributes_get_block_size(attr);
+}
+
+static void
+ram_block_attributes_rdm_register_listener(RamDiscardManager *rdm,
+                                           RamDiscardListener *rdl,
+                                           MemoryRegionSection *section)
+{
+    RamBlockAttributes *attr = RAM_BLOCK_ATTRIBUTES(rdm);
+    int ret;
+
+    g_assert(section->mr == attr->ram_block->mr);
+    rdl->section = memory_region_section_new_copy(section);
+
+    QLIST_INSERT_HEAD(&attr->rdl_list, rdl, next);
+
+    ret = ram_block_attributes_for_each_populated_section(attr, section, rdl,
+                                    ram_block_attributes_notify_populate_cb);
+    if (ret) {
+        error_report("%s: Failed to register RAM discard listener: %s",
+                     __func__, strerror(-ret));
+        exit(1);
+    }
+}
+
+static void
+ram_block_attributes_rdm_unregister_listener(RamDiscardManager *rdm,
+                                             RamDiscardListener *rdl)
+{
+    RamBlockAttributes *attr = RAM_BLOCK_ATTRIBUTES(rdm);
+    int ret;
+
+    g_assert(rdl->section);
+    g_assert(rdl->section->mr == attr->ram_block->mr);
+
+    if (rdl->double_discard_supported) {
+        rdl->notify_discard(rdl, rdl->section);
+    } else {
+        ret = ram_block_attributes_for_each_populated_section(attr,
+                rdl->section, rdl, ram_block_attributes_notify_discard_cb);
+        if (ret) {
+            error_report("%s: Failed to unregister RAM discard listener: %s",
+                         __func__, strerror(-ret));
+            exit(1);
+        }
+    }
+
+    memory_region_section_free_copy(rdl->section);
+    rdl->section = NULL;
+    QLIST_REMOVE(rdl, next);
+}
+
+typedef struct RamBlockAttributesReplayData {
+    ReplayRamDiscardState fn;
+    void *opaque;
+} RamBlockAttributesReplayData;
+
+static int ram_block_attributes_rdm_replay_cb(MemoryRegionSection *section,
+                                              void *arg)
+{
+    RamBlockAttributesReplayData *data = arg;
+
+    return data->fn(section, data->opaque);
+}
+
+static int
+ram_block_attributes_rdm_replay_populated(const RamDiscardManager *rdm,
+                                          MemoryRegionSection *section,
+                                          ReplayRamDiscardState replay_fn,
+                                          void *opaque)
+{
+    RamBlockAttributes *attr = RAM_BLOCK_ATTRIBUTES(rdm);
+    RamBlockAttributesReplayData data = { .fn = replay_fn, .opaque = opaque };
+
+    g_assert(section->mr == attr->ram_block->mr);
+    return ram_block_attributes_for_each_populated_section(attr, section, &data,
+                                            ram_block_attributes_rdm_replay_cb);
+}
+
+static int
+ram_block_attributes_rdm_replay_discarded(const RamDiscardManager *rdm,
+                                          MemoryRegionSection *section,
+                                          ReplayRamDiscardState replay_fn,
+                                          void *opaque)
+{
+    RamBlockAttributes *attr = RAM_BLOCK_ATTRIBUTES(rdm);
+    RamBlockAttributesReplayData data = { .fn = replay_fn, .opaque = opaque };
+
+    g_assert(section->mr == attr->ram_block->mr);
+    return ram_block_attributes_for_each_discarded_section(attr, section, &data,
+                                            ram_block_attributes_rdm_replay_cb);
+}
+
+static bool
+ram_block_attributes_is_valid_range(RamBlockAttributes *attr, uint64_t offset,
+                                    uint64_t size)
+{
+    MemoryRegion *mr = attr->ram_block->mr;
+
+    g_assert(mr);
+
+    uint64_t region_size = memory_region_size(mr);
+    const size_t block_size = ram_block_attributes_get_block_size(attr);
+
+    if (!QEMU_IS_ALIGNED(offset, block_size) ||
+        !QEMU_IS_ALIGNED(size, block_size)) {
+        return false;
+    }
+    if (offset + size <= offset) {
+        return false;
+    }
+    if (offset + size > region_size) {
+        return false;
+    }
+    return true;
+}
+
+static void ram_block_attributes_notify_discard(RamBlockAttributes *attr,
+                                                uint64_t offset,
+                                                uint64_t size)
+{
+    RamDiscardListener *rdl;
+
+    QLIST_FOREACH(rdl, &attr->rdl_list, next) {
+        MemoryRegionSection tmp = *rdl->section;
+
+        if (!memory_region_section_intersect_range(&tmp, offset, size)) {
+            continue;
+        }
+        rdl->notify_discard(rdl, &tmp);
+    }
+}
+
+static int
+ram_block_attributes_notify_populate(RamBlockAttributes *attr,
+                                     uint64_t offset, uint64_t size)
+{
+    RamDiscardListener *rdl;
+    int ret = 0;
+
+    QLIST_FOREACH(rdl, &attr->rdl_list, next) {
+        MemoryRegionSection tmp = *rdl->section;
+
+        if (!memory_region_section_intersect_range(&tmp, offset, size)) {
+            continue;
+        }
+        ret = rdl->notify_populate(rdl, &tmp);
+        if (ret) {
+            break;
+        }
+    }
+
+    return ret;
+}
+
+int ram_block_attributes_state_change(RamBlockAttributes *attr,
+                                      uint64_t offset, uint64_t size,
+                                      bool to_discard)
+{
+    const size_t block_size = ram_block_attributes_get_block_size(attr);
+    const unsigned long first_bit = offset / block_size;
+    const unsigned long nbits = size / block_size;
+    const unsigned long last_bit = first_bit + nbits - 1;
+    const bool is_discarded = find_next_bit(attr->bitmap, attr->bitmap_size,
+                                            first_bit) > last_bit;
+    const bool is_populated = find_next_zero_bit(attr->bitmap,
+                                attr->bitmap_size, first_bit) > last_bit;
+    unsigned long bit;
+    int ret = 0;
+
+    if (!ram_block_attributes_is_valid_range(attr, offset, size)) {
+        error_report("%s, invalid range: offset 0x%" PRIx64 ", size "
+                     "0x%" PRIx64, __func__, offset, size);
+        return -EINVAL;
+    }
+
+    trace_ram_block_attributes_state_change(offset, size,
+                                            is_discarded ? "discarded" :
+                                            is_populated ? "populated" :
+                                            "mixture",
+                                            to_discard ? "discarded" :
+                                            "populated");
+    if (to_discard) {
+        if (is_discarded) {
+            /* Already private */
+        } else if (is_populated) {
+            /* Completely shared */
+            bitmap_clear(attr->bitmap, first_bit, nbits);
+            ram_block_attributes_notify_discard(attr, offset, size);
+        } else {
+            /* Unexpected mixture: process individual blocks */
+            for (bit = first_bit; bit < first_bit + nbits; bit++) {
+                if (!test_bit(bit, attr->bitmap)) {
+                    continue;
+                }
+                clear_bit(bit, attr->bitmap);
+                ram_block_attributes_notify_discard(attr, bit * block_size,
+                                                    block_size);
+            }
+        }
+    } else {
+        if (is_populated) {
+            /* Already shared */
+        } else if (is_discarded) {
+            /* Completely private */
+            bitmap_set(attr->bitmap, first_bit, nbits);
+            ret = ram_block_attributes_notify_populate(attr, offset, size);
+        } else {
+            /* Unexpected mixture: process individual blocks */
+            for (bit = first_bit; bit < first_bit + nbits; bit++) {
+                if (test_bit(bit, attr->bitmap)) {
+                    continue;
+                }
+                set_bit(bit, attr->bitmap);
+                ret = ram_block_attributes_notify_populate(attr,
+                                                           bit * block_size,
+                                                           block_size);
+                if (ret) {
+                    break;
+                }
+            }
+        }
+    }
+
+    return ret;
+}
+
+RamBlockAttributes *ram_block_attributes_create(RAMBlock *ram_block)
+{
+    const int block_size  = qemu_real_host_page_size();
+    RamBlockAttributes *attr;
+    MemoryRegion *mr = ram_block->mr;
+
+    attr = RAM_BLOCK_ATTRIBUTES(object_new(TYPE_RAM_BLOCK_ATTRIBUTES));
+
+    attr->ram_block = ram_block;
+    if (memory_region_set_ram_discard_manager(mr, RAM_DISCARD_MANAGER(attr))) {
+        object_unref(OBJECT(attr));
+        return NULL;
+    }
+    attr->bitmap_size =
+        ROUND_UP(int128_get64(mr->size), block_size) / block_size;
+    attr->bitmap = bitmap_new(attr->bitmap_size);
+
+    return attr;
+}
+
+void ram_block_attributes_destroy(RamBlockAttributes *attr)
+{
+    g_assert(attr);
+
+    g_free(attr->bitmap);
+    memory_region_set_ram_discard_manager(attr->ram_block->mr, NULL);
+    object_unref(OBJECT(attr));
+}
+
+static void ram_block_attributes_init(Object *obj)
+{
+    RamBlockAttributes *attr = RAM_BLOCK_ATTRIBUTES(obj);
+
+    QLIST_INIT(&attr->rdl_list);
+}
+
+static void ram_block_attributes_finalize(Object *obj)
+{
+}
+
+static void ram_block_attributes_class_init(ObjectClass *klass,
+                                            const void *data)
+{
+    RamDiscardManagerClass *rdmc = RAM_DISCARD_MANAGER_CLASS(klass);
+
+    rdmc->get_min_granularity = ram_block_attributes_rdm_get_min_granularity;
+    rdmc->register_listener = ram_block_attributes_rdm_register_listener;
+    rdmc->unregister_listener = ram_block_attributes_rdm_unregister_listener;
+    rdmc->is_populated = ram_block_attributes_rdm_is_populated;
+    rdmc->replay_populated = ram_block_attributes_rdm_replay_populated;
+    rdmc->replay_discarded = ram_block_attributes_rdm_replay_discarded;
+}
diff --git a/system/trace-events b/system/trace-events
index be12ebfb41..82856e44f2 100644
--- a/system/trace-events
+++ b/system/trace-events
@@ -52,3 +52,6 @@ dirtylimit_state_finalize(void)
 dirtylimit_throttle_pct(int cpu_index, uint64_t pct, int64_t time_us) "CPU[%d] throttle percent: %" PRIu64 ", throttle adjust time %"PRIi64 " us"
 dirtylimit_set_vcpu(int cpu_index, uint64_t quota) "CPU[%d] set dirty page rate limit %"PRIu64
 dirtylimit_vcpu_execute(int cpu_index, int64_t sleep_time_us) "CPU[%d] sleep %"PRIi64 " us"
+
+# ram-block-attributes.c
+ram_block_attributes_state_change(uint64_t offset, uint64_t size, const char *from, const char *to) "offset 0x%"PRIx64" size 0x%"PRIx64" from '%s' to '%s'"

From 2fde3fb916079ee0ff0fc26d9446c813b1d5cc28 Mon Sep 17 00:00:00 2001
From: Chenyi Qiang <chenyi.qiang@intel.com>
Date: Thu, 12 Jun 2025 16:27:46 +0800
Subject: [PATCH 1645/2760] physmem: Support coordinated discarding of RAM with
 guest_memfd

A new field, attributes, was introduced in RAMBlock to link to a
RamBlockAttributes object, which centralizes all guest_memfd related
information (such as fd and status bitmap) within a RAMBlock.

Create and initialize the RamBlockAttributes object upon ram_block_add().
Meanwhile, register the object in the target RAMBlock's MemoryRegion.
After that, guest_memfd-backed RAMBlock is associated with the
RamDiscardManager interface, and the users can execute RamDiscardManager
specific handling. For example, VFIO will register the
RamDiscardListener and get notifications when the state_change() helper
invokes.

As coordinate discarding of RAM with guest_memfd is now supported, only
block uncoordinated discard.

Tested-by: Alexey Kardashevskiy <aik@amd.com>
Reviewed-by: Alexey Kardashevskiy <aik@amd.com>
Acked-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Chenyi Qiang <chenyi.qiang@intel.com>
Link: https://lore.kernel.org/r/20250612082747.51539-6-chenyi.qiang@intel.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 accel/kvm/kvm-all.c       |  9 +++++++++
 include/system/ramblock.h |  1 +
 system/physmem.c          | 23 +++++++++++++++++++++--
 3 files changed, 31 insertions(+), 2 deletions(-)

diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index a31778341c..d095d1b98f 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -3091,6 +3091,15 @@ int kvm_convert_memory(hwaddr start, hwaddr size, bool to_private)
     addr = memory_region_get_ram_ptr(mr) + section.offset_within_region;
     rb = qemu_ram_block_from_host(addr, false, &offset);
 
+    ret = ram_block_attributes_state_change(RAM_BLOCK_ATTRIBUTES(mr->rdm),
+                                            offset, size, to_private);
+    if (ret) {
+        error_report("Failed to notify the listener the state change of "
+                     "(0x%"HWADDR_PRIx" + 0x%"HWADDR_PRIx") to %s",
+                     start, size, to_private ? "private" : "shared");
+        goto out_unref;
+    }
+
     if (to_private) {
         if (rb->page_size != qemu_real_host_page_size()) {
             /*
diff --git a/include/system/ramblock.h b/include/system/ramblock.h
index 1bab9e2dac..87e847e184 100644
--- a/include/system/ramblock.h
+++ b/include/system/ramblock.h
@@ -46,6 +46,7 @@ struct RAMBlock {
     int fd;
     uint64_t fd_offset;
     int guest_memfd;
+    RamBlockAttributes *attributes;
     size_t page_size;
     /* dirty bitmap used during migration */
     unsigned long *bmap;
diff --git a/system/physmem.c b/system/physmem.c
index a8a9ca309e..ff0ca40222 100644
--- a/system/physmem.c
+++ b/system/physmem.c
@@ -1916,7 +1916,7 @@ static void ram_block_add(RAMBlock *new_block, Error **errp)
         }
         assert(new_block->guest_memfd < 0);
 
-        ret = ram_block_discard_require(true);
+        ret = ram_block_coordinated_discard_require(true);
         if (ret < 0) {
             error_setg_errno(errp, -ret,
                              "cannot set up private guest memory: discard currently blocked");
@@ -1931,6 +1931,24 @@ static void ram_block_add(RAMBlock *new_block, Error **errp)
             goto out_free;
         }
 
+        /*
+         * The attribute bitmap of the RamBlockAttributes is default to
+         * discarded, which mimics the behavior of kvm_set_phys_mem() when it
+         * calls kvm_set_memory_attributes_private(). This leads to a brief
+         * period of inconsistency between the creation of the RAMBlock and its
+         * mapping into the physical address space. However, this is not
+         * problematic, as no users rely on the attribute status to perform
+         * any actions during this interval.
+         */
+        new_block->attributes = ram_block_attributes_create(new_block);
+        if (!new_block->attributes) {
+            error_setg(errp, "Failed to create ram block attribute");
+            close(new_block->guest_memfd);
+            ram_block_coordinated_discard_require(false);
+            qemu_mutex_unlock_ramlist();
+            goto out_free;
+        }
+
         /*
          * Add a specific guest_memfd blocker if a generic one would not be
          * added by ram_block_add_cpr_blocker.
@@ -2287,8 +2305,9 @@ static void reclaim_ramblock(RAMBlock *block)
     }
 
     if (block->guest_memfd >= 0) {
+        ram_block_attributes_destroy(block->attributes);
         close(block->guest_memfd);
-        ram_block_discard_require(false);
+        ram_block_coordinated_discard_require(false);
     }
 
     g_free(block);

From 2b0e4ecd9466d493664317ffcc95275406862390 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Mon, 16 Jun 2025 11:22:39 +0200
Subject: [PATCH 1646/2760] docs: introduce dedicated page about code
 provenance / sign-off
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Currently we have a short paragraph saying that patches must include
a Signed-off-by line, and merely link to the kernel documentation.
The linked kernel docs have a lot of content beyond the part about
sign-off an thus are misleading/distracting to QEMU contributors.

This introduces a dedicated 'code-provenance' page in QEMU talking
about why we require sign-off, explaining the other tags we commonly
use, and what to do in some edge cases.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 docs/devel/code-provenance.rst    | 230 ++++++++++++++++++++++++++++++
 docs/devel/index-process.rst      |   1 +
 docs/devel/submitting-a-patch.rst |  23 +--
 3 files changed, 233 insertions(+), 21 deletions(-)
 create mode 100644 docs/devel/code-provenance.rst

diff --git a/docs/devel/code-provenance.rst b/docs/devel/code-provenance.rst
new file mode 100644
index 0000000000..95b2dd34e2
--- /dev/null
+++ b/docs/devel/code-provenance.rst
@@ -0,0 +1,230 @@
+.. _code-provenance:
+
+Code provenance
+===============
+
+Certifying patch submissions
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+The QEMU community **mandates** all contributors to certify provenance of
+patch submissions they make to the project. To put it another way,
+contributors must indicate that they are legally permitted to contribute to
+the project.
+
+Certification is achieved with a low overhead by adding a single line to the
+bottom of every git commit::
+
+   Signed-off-by: YOUR NAME <YOUR@EMAIL>
+
+The addition of this line asserts that the author of the patch is contributing
+in accordance with the clauses specified in the
+`Developer's Certificate of Origin <https://developercertificate.org>`__:
+
+.. _dco:
+
+  Developer's Certificate of Origin 1.1
+
+  By making a contribution to this project, I certify that:
+
+  (a) The contribution was created in whole or in part by me and I
+      have the right to submit it under the open source license
+      indicated in the file; or
+
+  (b) The contribution is based upon previous work that, to the best
+      of my knowledge, is covered under an appropriate open source
+      license and I have the right under that license to submit that
+      work with modifications, whether created in whole or in part
+      by me, under the same open source license (unless I am
+      permitted to submit under a different license), as indicated
+      in the file; or
+
+  (c) The contribution was provided directly to me by some other
+      person who certified (a), (b) or (c) and I have not modified
+      it.
+
+  (d) I understand and agree that this project and the contribution
+      are public and that a record of the contribution (including all
+      personal information I submit with it, including my sign-off) is
+      maintained indefinitely and may be redistributed consistent with
+      this project or the open source license(s) involved.
+
+The name used with "Signed-off-by" does not need to be your legal name, nor
+birth name, nor appear on any government ID. It is the identity you choose to
+be known by in the community, but should not be anonymous, nor misrepresent
+whom you are.
+
+It is generally expected that the name and email addresses used in one of the
+``Signed-off-by`` lines, matches that of the git commit ``Author`` field.
+It's okay if you subscribe or contribute to the list via more than one
+address, but using multiple addresses in one commit just confuses
+things.
+
+If the person sending the mail is not one of the patch authors, they are
+nonetheless expected to add their own ``Signed-off-by`` to comply with the
+DCO clause (c).
+
+Multiple authorship
+~~~~~~~~~~~~~~~~~~~
+
+It is not uncommon for a patch to have contributions from multiple authors. In
+this scenario, git commits will usually be expected to have a ``Signed-off-by``
+line for each contributor involved in creation of the patch. Some edge cases:
+
+  * The non-primary author's contributions were so trivial that they can be
+    considered not subject to copyright. In this case the secondary authors
+    need not include a ``Signed-off-by``.
+
+    This case most commonly applies where QEMU reviewers give short snippets
+    of code as suggested fixes to a patch. The reviewers don't need to have
+    their own ``Signed-off-by`` added unless their code suggestion was
+    unusually large, but it is common to add ``Suggested-by`` as a credit
+    for non-trivial code.
+
+  * Both contributors work for the same employer and the employer requires
+    copyright assignment.
+
+    It can be said that in this case a ``Signed-off-by`` is indicating that
+    the person has permission to contribute from their employer who is the
+    copyright holder. It is nonetheless still preferable to include a
+    ``Signed-off-by`` for each contributor, as in some countries employees are
+    not able to assign copyright to their employer, and it also covers any
+    time invested outside working hours.
+
+When multiple ``Signed-off-by`` tags are present, they should be strictly kept
+in order of authorship, from oldest to newest.
+
+Other commit tags
+~~~~~~~~~~~~~~~~~
+
+While the ``Signed-off-by`` tag is mandatory, there are a number of other tags
+that are commonly used during QEMU development:
+
+ * **``Reviewed-by``**: when a QEMU community member reviews a patch on the
+   mailing list, if they consider the patch acceptable, they should send an
+   email reply containing a ``Reviewed-by`` tag. Subsystem maintainers who
+   review a patch should add this even if they are also adding their
+   ``Signed-off-by`` to the same commit.
+
+ * **``Acked-by``**: when a QEMU subsystem maintainer approves a patch that
+   touches their subsystem, but intends to allow a different maintainer to
+   queue it and send a pull request, they would send a mail containing a
+   ``Acked-by`` tag. Where a patch touches multiple subsystems, ``Acked-by``
+   only implies review of the maintainers' own areas of responsibility. If a
+   maintainer wants to indicate they have done a full review they should use
+   a ``Reviewed-by`` tag.
+
+ * **``Tested-by``**: when a QEMU community member has functionally tested the
+   behaviour of the patch in some manner, they should send an email reply
+   containing a ``Tested-by`` tag.
+
+ * **``Reported-by``**: when a QEMU community member reports a problem via the
+   mailing list, or some other informal channel that is not the issue tracker,
+   it is good practice to credit them by including a ``Reported-by`` tag on
+   any patch fixing the issue. When the problem is reported via the GitLab
+   issue tracker, however, it is sufficient to just include a link to the
+   issue.
+
+ * **``Suggested-by``**: when a reviewer or other 3rd party makes non-trivial
+   suggestions for how to change a patch, it is good practice to credit them
+   by including a ``Suggested-by`` tag.
+
+Subsystem maintainer requirements
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+When a subsystem maintainer accepts a patch from a contributor, in addition to
+the normal code review points, they are expected to validate the presence of
+suitable ``Signed-off-by`` tags.
+
+At the time they queue the patch in their subsystem tree, the maintainer
+**must** also then add their own ``Signed-off-by`` to indicate that they have
+done the aforementioned validation. This is in addition to any of their own
+``Reviewed-by`` tags the subsystem maintainer may wish to include.
+
+When the maintainer modifies the patch after pulling into their tree, they
+should record their contribution.  This is typically done via a note in the
+commit message, just prior to the maintainer's ``Signed-off-by``::
+
+    Signed-off-by: Cory Contributor <cory.contributor@example.com>
+    [Comment rephrased for clarity]
+    Signed-off-by: Mary Maintainer <mary.maintainer@mycorp.test>
+
+
+Tools for adding ``Signed-off-by``
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+There are a variety of ways tools can support adding ``Signed-off-by`` tags
+for patches, avoiding the need for contributors to manually type in this
+repetitive text each time.
+
+git commands
+^^^^^^^^^^^^
+
+When creating, or amending, a commit the ``-s`` flag to ``git commit`` will
+append a suitable line matching the configured git author details.
+
+If preparing patches using the ``git format-patch`` tool, the ``-s`` flag can
+be used to append a suitable line in the emails it creates, without modifying
+the local commits. Alternatively to modify all the local commits on a branch::
+
+  git rebase master -x 'git commit --amend --no-edit -s'
+
+emacs
+^^^^^
+
+In the file ``$HOME/.emacs.d/abbrev_defs`` add:
+
+.. code:: elisp
+
+  (define-abbrev-table 'global-abbrev-table
+    '(
+      ("8rev" "Reviewed-by: YOUR NAME <your@email.addr>" nil 1)
+      ("8ack" "Acked-by: YOUR NAME <your@email.addr>" nil 1)
+      ("8test" "Tested-by: YOUR NAME <your@email.addr>" nil 1)
+      ("8sob" "Signed-off-by: YOUR NAME <your@email.addr>" nil 1)
+     ))
+
+with this change, if you type (for example) ``8rev`` followed by ``<space>``
+or ``<enter>`` it will expand to the whole phrase.
+
+vim
+^^^
+
+In the file ``$HOME/.vimrc`` add::
+
+  iabbrev 8rev Reviewed-by: YOUR NAME <your@email.addr>
+  iabbrev 8ack Acked-by: YOUR NAME <your@email.addr>
+  iabbrev 8test Tested-by: YOUR NAME <your@email.addr>
+  iabbrev 8sob Signed-off-by: YOUR NAME <your@email.addr>
+
+with this change, if you type (for example) ``8rev`` followed by ``<space>``
+or ``<enter>`` it will expand to the whole phrase.
+
+Re-starting abandoned work
+~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+For a variety of reasons there are some patches that get submitted to QEMU but
+never merged. An unrelated contributor may decide (months or years later) to
+continue working from the abandoned patch and re-submit it with extra changes.
+
+The general principles when picking up abandoned work are:
+
+ * Continue to credit the original author for their work, by maintaining their
+   original ``Signed-off-by``
+ * Indicate where the original patch was obtained from (mailing list, bug
+   tracker, author's git repo, etc) when sending it for review
+ * Acknowledge the extra work of the new contributor by including their
+   ``Signed-off-by`` in the patch in addition to the orignal author's
+ * Indicate who is responsible for what parts of the patch. This is typically
+   done via a note in the commit message, just prior to the new contributor's
+   ``Signed-off-by``::
+
+    Signed-off-by: Some Person <some.person@example.com>
+    [Rebased and added support for 'foo']
+    Signed-off-by: New Person <new.person@mycorp.test>
+
+In complicated cases, or if otherwise unsure, ask for advice on the project
+mailing list.
+
+It is also recommended to attempt to contact the original author to let them
+know you are interested in taking over their work, in case they still intended
+to return to the work, or had any suggestions about the best way to continue.
diff --git a/docs/devel/index-process.rst b/docs/devel/index-process.rst
index cb7c6640fd..5807752d70 100644
--- a/docs/devel/index-process.rst
+++ b/docs/devel/index-process.rst
@@ -13,6 +13,7 @@ Notes about how to interact with the community and how and where to submit patch
    maintainers
    style
    submitting-a-patch
+   code-provenance
    trivial-patches
    stable-process
    submitting-a-pull-request
diff --git a/docs/devel/submitting-a-patch.rst b/docs/devel/submitting-a-patch.rst
index 65c64078cb..f7917b899f 100644
--- a/docs/devel/submitting-a-patch.rst
+++ b/docs/devel/submitting-a-patch.rst
@@ -344,28 +344,9 @@ Patch emails must include a ``Signed-off-by:`` line
 
 Your patches **must** include a Signed-off-by: line. This is a hard
 requirement because it's how you say "I'm legally okay to contribute
-this and happy for it to go into QEMU". The process is modelled after
-the `Linux kernel
-<http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/tree/Documentation/SubmittingPatches?id=f6f94e2ab1b33f0082ac22d71f66385a60d8157f#n297>`__
-policy.
+this and happy for it to go into QEMU". For full guidance, read the
+:ref:`code-provenance` documentation.
 
-If you wrote the patch, make sure your "From:" and "Signed-off-by:"
-lines use the same spelling. It's okay if you subscribe or contribute to
-the list via more than one address, but using multiple addresses in one
-commit just confuses things. If someone else wrote the patch, git will
-include a "From:" line in the body of the email (different from your
-envelope From:) that will give credit to the correct author; but again,
-that author's Signed-off-by: line is mandatory, with the same spelling.
-
-The name used with "Signed-off-by" does not need to be your legal name,
-nor birth name, nor appear on any government ID. It is the identity you
-choose to be known by in the community, but should not be anonymous,
-nor misrepresent whom you are.
-
-There are various tooling options for automatically adding these tags
-include using ``git commit -s`` or ``git format-patch -s``. For more
-information see `SubmittingPatches 1.12
-<http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/tree/Documentation/SubmittingPatches?id=f6f94e2ab1b33f0082ac22d71f66385a60d8157f#n297>`__.
 
 .. _include_a_meaningful_cover_letter:
 

From b5d00557722d46cb845c05e546474284870e440b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Mon, 16 Jun 2025 11:22:40 +0200
Subject: [PATCH 1647/2760] docs: define policy limiting the inclusion of
 generated files
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Files contributed to QEMU are generally expected to be provided in the
preferred format for manipulation. IOW, we generally don't expect to
have generated / compiled code included in the tree, rather, we expect
to run the code generator / compiler as part of the build process.

There are some obvious exceptions to this seen in our existing tree, the
biggest one being the inclusion of many binary firmware ROMs. A more
niche example is the inclusion of a generated eBPF program. Or the CI
dockerfiles which are mostly auto-generated. In these cases, however,
the preferred format source code is still required to be included,
alongside the generated output.

Tools which perform user defined algorithmic transformations on code are
not considered to be "code generators". ie, we permit use of coccinelle,
spell checkers, and sed/awk/etc to manipulate code. Such use of automated
manipulation should still be declared in the commit message.

One off generators which create a boilerplate file which the author then
fills in, are acceptable if their output has clear copyright and license
status. This could be where a contributor writes a throwaway python
script to automate creation of some mundane piece of code for example.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 docs/devel/code-provenance.rst | 55 ++++++++++++++++++++++++++++++++++
 1 file changed, 55 insertions(+)

diff --git a/docs/devel/code-provenance.rst b/docs/devel/code-provenance.rst
index 95b2dd34e2..c25afed98d 100644
--- a/docs/devel/code-provenance.rst
+++ b/docs/devel/code-provenance.rst
@@ -228,3 +228,58 @@ mailing list.
 It is also recommended to attempt to contact the original author to let them
 know you are interested in taking over their work, in case they still intended
 to return to the work, or had any suggestions about the best way to continue.
+
+Inclusion of generated files
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Files in patches contributed to QEMU are generally expected to be provided
+only in the preferred format for making modifications. The implication of
+this is that the output of code generators or compilers is usually not
+appropriate to contribute to QEMU.
+
+For reasons of practicality there are some exceptions to this rule, where
+generated code is permitted, provided it is also accompanied by the
+corresponding preferred source format. This is done where it is impractical
+to expect those building QEMU to run the code generation or compilation
+process. A non-exhaustive list of examples is:
+
+ * Images: where an bitmap image is created from a vector file it is common
+   to include the rendered bitmaps at desired resolution(s), since subtle
+   changes in the rasterization process / tools may affect quality. The
+   original vector file is expected to accompany any generated bitmaps.
+
+ * Firmware: QEMU includes pre-compiled binary ROMs for a variety of guest
+   firmwares. When such binary ROMs are contributed, the corresponding source
+   must also be provided, either directly, or through a git submodule link.
+
+ * Dockerfiles: the majority of the dockerfiles are automatically generated
+   from a canonical list of build dependencies maintained in tree, together
+   with the libvirt-ci git submodule link. The generated dockerfiles are
+   included in tree because it is desirable to be able to directly build
+   container images from a clean git checkout.
+
+ * eBPF: QEMU includes some generated eBPF machine code, since the required
+   eBPF compilation tools are not broadly available on all targetted OS
+   distributions. The corresponding eBPF C code for the binary is also
+   provided. This is a time-limited exception until the eBPF toolchain is
+   sufficiently broadly available in distros.
+
+In all cases above, the existence of generated files must be acknowledged
+and justified in the commit that introduces them.
+
+Tools which perform changes to existing code with deterministic algorithmic
+manipulation, driven by user specified inputs, are not generally considered
+to be "generators".
+
+For instance, using Coccinelle to convert code from one pattern to another
+pattern, or fixing documentation typos with a spell checker, or transforming
+code using sed / awk / etc, are not considered to be acts of code
+generation. Where an automated manipulation is performed on code, however,
+this should be declared in the commit message.
+
+At times contributors may use or create scripts/tools to generate an initial
+boilerplate code template which is then filled in to produce the final patch.
+The output of such a tool would still be considered the "preferred format",
+since it is intended to be a foundation for further human authored changes.
+Such tools are acceptable to use, provided there is clearly defined copyright
+and licensing for their output.

From 3d40db0efc22520fa6c399cf73960dced423b048 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Mon, 16 Jun 2025 11:22:41 +0200
Subject: [PATCH 1648/2760] docs: define policy forbidding use of AI code
 generators
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

There has been an explosion of interest in so called AI code
generators. Thus far though, this is has not been matched by a broadly
accepted legal interpretation of the licensing implications for code
generator outputs. While the vendors may claim there is no problem and
a free choice of license is possible, they have an inherent conflict
of interest in promoting this interpretation. More broadly there is,
as yet, no broad consensus on the licensing implications of code
generators trained on inputs under a wide variety of licenses

The DCO requires contributors to assert they have the right to
contribute under the designated project license. Given the lack of
consensus on the licensing of AI code generator output, it is not
considered credible to assert compliance with the DCO clause (b) or (c)
where a patch includes such generated code.

This patch thus defines a policy that the QEMU project will currently
not accept contributions where use of AI code generators is either
known, or suspected.

These are early days of AI-assisted software development. The legal
questions will be resolved eventually. The tools will mature, and we
can expect some to become safely usable in free software projects.
The policy we set now must be for today, and be open to revision. It's
best to start strict and safe, then relax.

Meanwhile requests for exceptions can also be considered on a case by
case basis.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 docs/devel/code-provenance.rst | 55 +++++++++++++++++++++++++++++++++-
 1 file changed, 54 insertions(+), 1 deletion(-)

diff --git a/docs/devel/code-provenance.rst b/docs/devel/code-provenance.rst
index c25afed98d..b5aae2e253 100644
--- a/docs/devel/code-provenance.rst
+++ b/docs/devel/code-provenance.rst
@@ -282,4 +282,57 @@ boilerplate code template which is then filled in to produce the final patch.
 The output of such a tool would still be considered the "preferred format",
 since it is intended to be a foundation for further human authored changes.
 Such tools are acceptable to use, provided there is clearly defined copyright
-and licensing for their output.
+and licensing for their output. Note in particular the caveats applying to AI
+content generators below.
+
+Use of AI content generators
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+TL;DR:
+
+  **Current QEMU project policy is to DECLINE any contributions which are
+  believed to include or derive from AI generated content. This includes
+  ChatGPT, Claude, Copilot, Llama and similar tools.**
+
+The increasing prevalence of AI-assisted software development results in a
+number of difficult legal questions and risks for software projects, including
+QEMU.  Of particular concern is content generated by `Large Language Models
+<https://en.wikipedia.org/wiki/Large_language_model>`__ (LLMs).
+
+The QEMU community requires that contributors certify their patch submissions
+are made in accordance with the rules of the `Developer's Certificate of
+Origin (DCO) <dco>`.
+
+To satisfy the DCO, the patch contributor has to fully understand the
+copyright and license status of content they are contributing to QEMU. With AI
+content generators, the copyright and license status of the output is
+ill-defined with no generally accepted, settled legal foundation.
+
+Where the training material is known, it is common for it to include large
+volumes of material under restrictive licensing/copyright terms. Even where
+the training material is all known to be under open source licenses, it is
+likely to be under a variety of terms, not all of which will be compatible
+with QEMU's licensing requirements.
+
+How contributors could comply with DCO terms (b) or (c) for the output of AI
+content generators commonly available today is unclear.  The QEMU project is
+not willing or able to accept the legal risks of non-compliance.
+
+The QEMU project thus requires that contributors refrain from using AI content
+generators on patches intended to be submitted to the project, and will
+decline any contribution if use of AI is either known or suspected.
+
+This policy does not apply to other uses of AI, such as researching APIs or
+algorithms, static analysis, or debugging, provided their output is not to be
+included in contributions.
+
+Examples of tools impacted by this policy includes GitHub's CoPilot, OpenAI's
+ChatGPT, Anthropic's Claude, and Meta's Code Llama, and code/content
+generation agents which are built on top of such tools.
+
+This policy may evolve as AI tools mature and the legal situation is
+clarifed. In the meanwhile, requests for exceptions to this policy will be
+evaluated by the QEMU project on a case by case basis. To be granted an
+exception, a contributor will need to demonstrate clarity of the license and
+copyright status for the tool's output in relation to its training model and
+code, to the satisfaction of the project maintainers.

From 3dc9951906af4d47dddd56afd4c27ac8b3ed3c24 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Fri, 6 Jun 2025 11:20:33 +0200
Subject: [PATCH 1649/2760] tests/functional/test_pc_cpu_hotplug_props: Set
 'pc' machine type explicitly

In case the default machine has not been compiled into the QEMU
binary, the cpu_hotplug_props test is currently failing. Add a
set_machine('pc') here to make sure that the tests are correctly
skipped in case the machine is not available.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250606092033.506736-1-thuth@redhat.com>
---
 tests/functional/test_pc_cpu_hotplug_props.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tests/functional/test_pc_cpu_hotplug_props.py b/tests/functional/test_pc_cpu_hotplug_props.py
index 9d5a37cb17..2bed8ada02 100755
--- a/tests/functional/test_pc_cpu_hotplug_props.py
+++ b/tests/functional/test_pc_cpu_hotplug_props.py
@@ -26,6 +26,7 @@ from qemu_test import QemuSystemTest
 class OmittedCPUProps(QemuSystemTest):
 
     def test_no_die_id(self):
+        self.set_machine('pc')
         self.vm.add_args('-nodefaults', '-S')
         self.vm.add_args('-smp', '1,sockets=2,cores=2,threads=2,maxcpus=8')
         self.vm.add_args('-device', 'qemu64-x86_64-cpu,socket-id=1,core-id=0,thread-id=0')

From 920f067347782e4737d0e4a89692b669b888fe0a Mon Sep 17 00:00:00 2001
From: Yoshinori Sato <yoshinori.sato@nifty.com>
Date: Thu, 12 Jun 2025 22:16:32 +0900
Subject: [PATCH 1650/2760] MAINTAINERS: Yoshinori Sato email address has been
 updated

The email address <ysato@users.sourceforge.jp> has been suspended.
I have prepared a new email address.

Signed-off-by: Yoshinori Sato <yoshinori.sato@nifty.com>
Message-ID: <20250612131632.137155-1-yoshinori.sato@nifty.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 MAINTAINERS | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/MAINTAINERS b/MAINTAINERS
index 27f4fe3f25..5b8b314c8c 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -352,7 +352,7 @@ F: target/riscv/insn_trans/trans_xventanacondops.c.inc
 F: disas/riscv-xventana*
 
 RENESAS RX CPUs
-R: Yoshinori Sato <ysato@users.sourceforge.jp>
+R: Yoshinori Sato <yoshinori.sato@nifty.com>
 S: Orphan
 F: target/rx/
 
@@ -368,7 +368,7 @@ F: tests/tcg/s390x/
 L: qemu-s390x@nongnu.org
 
 SH4 TCG CPUs
-R: Yoshinori Sato <ysato@users.sourceforge.jp>
+R: Yoshinori Sato <yoshinori.sato@nifty.com>
 S: Orphan
 F: target/sh4/
 F: hw/sh4/
@@ -1696,7 +1696,7 @@ F: docs/system/riscv/microblaze-v-generic.rst
 RX Machines
 -----------
 rx-gdbsim
-R: Yoshinori Sato <ysato@users.sourceforge.jp>
+R: Yoshinori Sato <yoshinori.sato@nifty.com>
 S: Orphan
 F: docs/system/target-rx.rst
 F: hw/rx/rx-gdbsim.c
@@ -1705,7 +1705,7 @@ F: tests/functional/test_rx_gdbsim.py
 SH4 Machines
 ------------
 R2D
-R: Yoshinori Sato <ysato@users.sourceforge.jp>
+R: Yoshinori Sato <yoshinori.sato@nifty.com>
 R: Magnus Damm <magnus.damm@gmail.com>
 S: Odd Fixes
 F: hw/char/sh_serial.c
@@ -2756,7 +2756,7 @@ F: tests/qtest/*xive*
 F: docs/*/*xive*
 
 Renesas peripherals
-R: Yoshinori Sato <ysato@users.sourceforge.jp>
+R: Yoshinori Sato <yoshinori.sato@nifty.com>
 R: Magnus Damm <magnus.damm@gmail.com>
 S: Odd Fixes
 F: hw/char/renesas_sci.c
@@ -2768,7 +2768,7 @@ F: include/hw/sh4/sh.h
 F: include/hw/timer/renesas_*.h
 
 Renesas RX peripherals
-R: Yoshinori Sato <ysato@users.sourceforge.jp>
+R: Yoshinori Sato <yoshinori.sato@nifty.com>
 S: Orphan
 F: hw/intc/rx_icu.c
 F: hw/rx/

From 435c758da161448447dc47e678a97b8df434d94c Mon Sep 17 00:00:00 2001
From: Shalini Chellathurai Saroja <shalini@linux.ibm.com>
Date: Mon, 16 Jun 2025 16:01:05 +0200
Subject: [PATCH 1651/2760] hw/s390x: add SCLP event type CPI

Implement the Service-Call Logical Processor (SCLP) event
type Control-Program Identification (CPI) in QEMU. This
event is used to send CPI identifiers from the guest to the
host. The CPI identifiers are: system type, system name,
system level and sysplex name.

System type: operating system of the guest (e.g. "LINUX   ").
System name: user configurable name of the guest (e.g. "TESTVM  ").
System level: distribution and kernel version, if the system type is Linux
(e.g. 74872343805430528).
Sysplex name: name of the cluster which the guest belongs to (if any)
(e.g. "PLEX").

The SCLP event CPI is supported only from "s390-ccw-virtio-10.1" machine
and higher.

Signed-off-by: Shalini Chellathurai Saroja <shalini@linux.ibm.com>
Reviewed-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250616140107.990538-2-shalini@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 hw/s390x/event-facility.c          |   2 +
 hw/s390x/meson.build               |   1 +
 hw/s390x/s390-virtio-ccw.c         |  22 ++++++
 hw/s390x/sclpcpi.c                 | 123 +++++++++++++++++++++++++++++
 include/hw/s390x/event-facility.h  |  12 +++
 include/hw/s390x/s390-virtio-ccw.h |   1 +
 6 files changed, 161 insertions(+)
 create mode 100644 hw/s390x/sclpcpi.c

diff --git a/hw/s390x/event-facility.c b/hw/s390x/event-facility.c
index 7b7bf237fe..fee286ea63 100644
--- a/hw/s390x/event-facility.c
+++ b/hw/s390x/event-facility.c
@@ -4,6 +4,7 @@
  *       handles SCLP event types
  *          - Signal Quiesce - system power down
  *          - ASCII Console Data - VT220 read and write
+ *          - Control-Program Identification - Send OS data from guest to host
  *
  * Copyright IBM, Corp. 2012
  *
@@ -40,6 +41,7 @@ struct SCLPEventFacility {
     SysBusDevice parent_obj;
     SCLPEventsBus sbus;
     SCLPEvent quiesce, cpu_hotplug;
+    SCLPEventCPI cpi;
     /* guest's receive mask */
     union {
         uint32_t receive_mask_pieces[2];
diff --git a/hw/s390x/meson.build b/hw/s390x/meson.build
index 99cbcbd7d6..1bc8583799 100644
--- a/hw/s390x/meson.build
+++ b/hw/s390x/meson.build
@@ -13,6 +13,7 @@ s390x_ss.add(files(
   's390-skeys.c',
   's390-stattrib.c',
   'sclp.c',
+  'sclpcpi.c',
   'sclpcpu.c',
   'sclpquiesce.c',
   'tod.c',
diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
index ce3c13defb..a79bd13275 100644
--- a/hw/s390x/s390-virtio-ccw.c
+++ b/hw/s390x/s390-virtio-ccw.c
@@ -260,9 +260,21 @@ static void s390_create_sclpconsole(SCLPDevice *sclp,
     qdev_realize_and_unref(dev, ev_fac_bus, &error_fatal);
 }
 
+static void s390_create_sclpcpi(SCLPDevice *sclp)
+{
+    SCLPEventFacility *ef = sclp->event_facility;
+    BusState *ev_fac_bus = sclp_get_event_facility_bus(ef);
+    DeviceState *dev;
+
+    dev = qdev_new(TYPE_SCLP_EVENT_CPI);
+    object_property_add_child(OBJECT(ef), "sclpcpi", OBJECT(dev));
+    qdev_realize_and_unref(dev, ev_fac_bus, &error_fatal);
+}
+
 static void ccw_init(MachineState *machine)
 {
     MachineClass *mc = MACHINE_GET_CLASS(machine);
+    S390CcwMachineClass *s390mc = S390_CCW_MACHINE_CLASS(mc);
     S390CcwMachineState *ms = S390_CCW_MACHINE(machine);
     int ret;
     VirtualCssBus *css_bus;
@@ -323,6 +335,12 @@ static void ccw_init(MachineState *machine)
 
     /* init the TOD clock */
     s390_init_tod();
+
+    /* init SCLP event Control-Program Identification */
+    if (s390mc->use_cpi) {
+        s390_create_sclpcpi(ms->sclp);
+    }
+
 }
 
 static void s390_cpu_plug(HotplugHandler *hotplug_dev,
@@ -783,6 +801,7 @@ static void ccw_machine_class_init(ObjectClass *oc, const void *data)
     DumpSKeysInterface *dsi = DUMP_SKEYS_INTERFACE_CLASS(oc);
 
     s390mc->max_threads = 1;
+    s390mc->use_cpi = true;
     mc->reset = s390_machine_reset;
     mc->block_default_type = IF_VIRTIO;
     mc->no_cdrom = 1;
@@ -908,6 +927,9 @@ static void ccw_machine_10_0_instance_options(MachineState *machine)
 
 static void ccw_machine_10_0_class_options(MachineClass *mc)
 {
+    S390CcwMachineClass *s390mc = S390_CCW_MACHINE_CLASS(mc);
+    s390mc->use_cpi = false;
+
     ccw_machine_10_1_class_options(mc);
     compat_props_add(mc->compat_props, hw_compat_10_0, hw_compat_10_0_len);
 }
diff --git a/hw/s390x/sclpcpi.c b/hw/s390x/sclpcpi.c
new file mode 100644
index 0000000000..6e2090b27f
--- /dev/null
+++ b/hw/s390x/sclpcpi.c
@@ -0,0 +1,123 @@
+ /*
+  * SPDX-License-Identifier: GPL-2.0-or-later
+  *
+  * SCLP event type 11 - Control-Program Identification (CPI):
+  *    CPI is used to send program identifiers from the guest to the
+  *    Service-Call Logical Processor (SCLP). It is not sent by the SCLP.
+  *
+  *    Control-program identifiers provide data about the guest operating
+  *    system.  The control-program identifiers are: system type, system name,
+  *    system level and sysplex name.
+  *
+  *    In Linux, all the control-program identifiers are user configurable. The
+  *    system type, system name, and sysplex name use EBCDIC characters from
+  *    this set: capital A-Z, 0-9, $, @, #, and blank.  In Linux, the system
+  *    type, system name and sysplex name are arbitrary free-form texts.
+  *
+  *    In Linux, the 8-byte hexadecimal system-level has the format
+  *    0x<a><b><cc><dd><eeee><ff><gg><hh>, where:
+  *    <a>: is a 4-bit digit, its most significant bit indicates hypervisor use
+  *    <b>: is one digit that represents Linux distributions as follows
+  *    0: generic Linux
+  *    1: Red Hat Enterprise Linux
+  *    2: SUSE Linux Enterprise Server
+  *    3: Canonical Ubuntu
+  *    4: Fedora
+  *    5: openSUSE Leap
+  *    6: Debian GNU/Linux
+  *    7: Red Hat Enterprise Linux CoreOS
+  *    <cc>: are two digits for a distribution-specific encoding of the major
+  *    version of the distribution
+  *    <dd>: are two digits for a distribution-specific encoding of the minor
+  *    version of the distribution
+  *    <eeee>: are four digits for the patch level of the distribution
+  *    <ff>: are two digits for the major version of the kernel
+  *    <gg>: are two digits for the minor version of the kernel
+  *    <hh>: are two digits for the stable version of the kernel
+  *    (e.g. 74872343805430528, when converted to hex is 0x010a000000060b00). On
+  *    machines prior to z16, some of the values are not available to display.
+  *
+  *    Sysplex refers to a cluster of logical partitions that communicates and
+  *    co-operates with each other.
+  *
+  *    The CPI feature is supported since 10.1.
+  *
+  * Copyright IBM, Corp. 2024
+  *
+  * Authors:
+  *  Shalini Chellathurai Saroja <shalini@linux.ibm.com>
+  *
+  */
+
+#include "qemu/osdep.h"
+#include "hw/s390x/event-facility.h"
+
+typedef struct Data {
+    uint8_t id_format;
+    uint8_t reserved0;
+    uint8_t system_type[8];
+    uint64_t reserved1;
+    uint8_t system_name[8];
+    uint64_t reserved2;
+    uint64_t system_level;
+    uint64_t reserved3;
+    uint8_t sysplex_name[8];
+    uint8_t reserved4[16];
+} QEMU_PACKED Data;
+
+typedef struct ControlProgramIdMsg {
+    EventBufferHeader ebh;
+    Data data;
+} QEMU_PACKED ControlProgramIdMsg;
+
+static bool can_handle_event(uint8_t type)
+{
+    return type == SCLP_EVENT_CTRL_PGM_ID;
+}
+
+static sccb_mask_t send_mask(void)
+{
+    return 0;
+}
+
+/* Enable SCLP to accept buffers of event type CPI from the control-program. */
+static sccb_mask_t receive_mask(void)
+{
+    return SCLP_EVENT_MASK_CTRL_PGM_ID;
+}
+
+static int write_event_data(SCLPEvent *event, EventBufferHeader *evt_buf_hdr)
+{
+    ControlProgramIdMsg *cpim = container_of(evt_buf_hdr, ControlProgramIdMsg,
+                                             ebh);
+
+    cpim->ebh.flags = SCLP_EVENT_BUFFER_ACCEPTED;
+    return SCLP_RC_NORMAL_COMPLETION;
+}
+
+static void cpi_class_init(ObjectClass *klass, const void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    SCLPEventClass *k = SCLP_EVENT_CLASS(klass);
+
+    dc->user_creatable = false;
+
+    k->can_handle_event = can_handle_event;
+    k->get_send_mask = send_mask;
+    k->get_receive_mask = receive_mask;
+    k->write_event_data = write_event_data;
+}
+
+static const TypeInfo sclp_cpi_info = {
+    .name          = TYPE_SCLP_EVENT_CPI,
+    .parent        = TYPE_SCLP_EVENT,
+    .instance_size = sizeof(SCLPEventCPI),
+    .class_init    = cpi_class_init,
+};
+
+static void sclp_cpi_register_types(void)
+{
+    type_register_static(&sclp_cpi_info);
+}
+
+type_init(sclp_cpi_register_types)
diff --git a/include/hw/s390x/event-facility.h b/include/hw/s390x/event-facility.h
index ff874e792d..e81bc80498 100644
--- a/include/hw/s390x/event-facility.h
+++ b/include/hw/s390x/event-facility.h
@@ -25,6 +25,7 @@
 #define SCLP_EVENT_MESSAGE                      0x02
 #define SCLP_EVENT_CONFIG_MGT_DATA              0x04
 #define SCLP_EVENT_PMSGCMD                      0x09
+#define SCLP_EVENT_CTRL_PGM_ID                  0x0b
 #define SCLP_EVENT_ASCII_CONSOLE_DATA           0x1a
 #define SCLP_EVENT_SIGNAL_QUIESCE               0x1d
 
@@ -35,6 +36,7 @@
 #define SCLP_EVENT_MASK_MSG             SCLP_EVMASK(SCLP_EVENT_MESSAGE)
 #define SCLP_EVENT_MASK_CONFIG_MGT_DATA SCLP_EVMASK(SCLP_EVENT_CONFIG_MGT_DATA)
 #define SCLP_EVENT_MASK_PMSGCMD         SCLP_EVMASK(SCLP_EVENT_PMSGCMD)
+#define SCLP_EVENT_MASK_CTRL_PGM_ID     SCLP_EVMASK(SCLP_EVENT_CTRL_PGM_ID)
 #define SCLP_EVENT_MASK_MSG_ASCII       SCLP_EVMASK(SCLP_EVENT_ASCII_CONSOLE_DATA)
 #define SCLP_EVENT_MASK_SIGNAL_QUIESCE  SCLP_EVMASK(SCLP_EVENT_SIGNAL_QUIESCE)
 
@@ -191,6 +193,16 @@ struct SCLPEventClass {
     bool (*can_handle_event)(uint8_t type);
 };
 
+#define TYPE_SCLP_EVENT_CPI "sclpcpi"
+typedef struct SCLPEventCPIClass SCLPEventCPIClass;
+typedef struct SCLPEventCPI SCLPEventCPI;
+OBJECT_DECLARE_TYPE(SCLPEventCPI, SCLPEventCPIClass,
+                    SCLP_EVENT_CPI)
+
+struct SCLPEventCPI {
+    SCLPEvent event;
+};
+
 #define TYPE_SCLP_EVENT_FACILITY "s390-sclp-event-facility"
 typedef struct SCLPEventFacility SCLPEventFacility;
 typedef struct SCLPEventFacilityClass SCLPEventFacilityClass;
diff --git a/include/hw/s390x/s390-virtio-ccw.h b/include/hw/s390x/s390-virtio-ccw.h
index 321b26df30..526078a4e2 100644
--- a/include/hw/s390x/s390-virtio-ccw.h
+++ b/include/hw/s390x/s390-virtio-ccw.h
@@ -54,6 +54,7 @@ struct S390CcwMachineClass {
 
     /*< public >*/
     int max_threads;
+    bool use_cpi;
 };
 
 #endif

From f345978f24becfab4445fbf1ed2519ee9101d1dd Mon Sep 17 00:00:00 2001
From: Shalini Chellathurai Saroja <shalini@linux.ibm.com>
Date: Mon, 16 Jun 2025 16:01:06 +0200
Subject: [PATCH 1652/2760] hw/s390x: add Control-Program Identification to QOM

Add Control-Program Identification (CPI) data to the QEMU Object
Model (QOM), along with the timestamp in which the data was received
as shown below.

virsh # qemu-monitor-command vm --pretty '{"execute":"qom-list",
"arguments":{"path":"/machine/sclp/s390-sclp-event-facility/sclpcpi"}}'
{
  "return": [
    [...]
    {
      "name": "system_level",
      "type": "uint64"
    },
    {
      "name": "system_name",
      "type": "string"
    },
    {
      "name": "system_type",
      "type": "string"
    },
    {
      "name": "timestamp",
      "type": "uint64"
    },
    {
      "name": "sysplex_name",
      "type": "string"
    }
  ],
  "id": "libvirt-14"
}

Example CPI data:
virsh # qemu-monitor-command vm --pretty '{"execute":"qom-get",
"arguments":{"path":"/machine/sclp/s390-sclp-event-facility/sclpcpi",
"property":"system_type"}}'
{
  "return": "LINUX   ",
  "id": "libvirt-18"
}
virsh # qemu-monitor-command vm --pretty '{"execute":"qom-get",
"arguments":{"path":"/machine/sclp/s390-sclp-event-facility/sclpcpi",
"property":"system_name"}}'
{
  "return": "TESTVM  ",
  "id": "libvirt-19"
}
virsh # qemu-monitor-command vm --pretty '{"execute":"qom-get",
"arguments":{"path":"/machine/sclp/s390-sclp-event-facility/sclpcpi",
"property":"sysplex_name"}}'
{
  "return": "PLEX    ",
  "id": "libvirt-20"
}
virsh # qemu-monitor-command vm --pretty '{"execute":"qom-get",
"arguments":{"path":"/machine/sclp/s390-sclp-event-facility/sclpcpi",
"property":"system_level"}}'
{
  "return": 74872343805430528,
  "id": "libvirt-21"
}
virsh # qemu-monitor-command vm --pretty '{"execute":"qom-get",
"arguments":{"path":"/machine/sclp/s390-sclp-event-facility/sclpcpi",
"property":"timestamp"}}'
{
  "return": 1748866753433923000,
  "id": "libvirt-22"
}

Signed-off-by: Shalini Chellathurai Saroja <shalini@linux.ibm.com>
Reviewed-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com>
Message-ID: <20250616140107.990538-3-shalini@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 hw/s390x/sclpcpi.c                | 74 +++++++++++++++++++++++++++++++
 include/hw/s390x/event-facility.h |  5 +++
 2 files changed, 79 insertions(+)

diff --git a/hw/s390x/sclpcpi.c b/hw/s390x/sclpcpi.c
index 6e2090b27f..440a5ff1eb 100644
--- a/hw/s390x/sclpcpi.c
+++ b/hw/s390x/sclpcpi.c
@@ -50,7 +50,10 @@
   */
 
 #include "qemu/osdep.h"
+#include "qemu/timer.h"
 #include "hw/s390x/event-facility.h"
+#include "hw/s390x/ebcdic.h"
+#include "qapi/qapi-visit-machine.h"
 
 typedef struct Data {
     uint8_t id_format;
@@ -90,11 +93,58 @@ static int write_event_data(SCLPEvent *event, EventBufferHeader *evt_buf_hdr)
 {
     ControlProgramIdMsg *cpim = container_of(evt_buf_hdr, ControlProgramIdMsg,
                                              ebh);
+    SCLPEventCPI *e = SCLP_EVENT_CPI(event);
+
+    ascii_put(e->system_type, (char *)cpim->data.system_type,
+              sizeof(cpim->data.system_type));
+    ascii_put(e->system_name, (char *)cpim->data.system_name,
+              sizeof(cpim->data.system_name));
+    ascii_put(e->sysplex_name, (char *)cpim->data.sysplex_name,
+              sizeof(cpim->data.sysplex_name));
+    e->system_level = ldq_be_p(&cpim->data.system_level);
+    e->timestamp = qemu_clock_get_ns(QEMU_CLOCK_HOST);
 
     cpim->ebh.flags = SCLP_EVENT_BUFFER_ACCEPTED;
     return SCLP_RC_NORMAL_COMPLETION;
 }
 
+static char *get_system_type(Object *obj, Error **errp)
+{
+    SCLPEventCPI *e = SCLP_EVENT_CPI(obj);
+
+    return g_strndup((char *) e->system_type, sizeof(e->system_type));
+}
+
+static char *get_system_name(Object *obj, Error **errp)
+{
+    SCLPEventCPI *e = SCLP_EVENT_CPI(obj);
+
+    return g_strndup((char *) e->system_name, sizeof(e->system_name));
+}
+
+static char *get_sysplex_name(Object *obj, Error **errp)
+{
+    SCLPEventCPI *e = SCLP_EVENT_CPI(obj);
+
+    return g_strndup((char *) e->sysplex_name, sizeof(e->sysplex_name));
+}
+
+static void get_system_level(Object *obj, Visitor *v, const char *name,
+                             void *opaque, Error **errp)
+{
+    SCLPEventCPI *e = SCLP_EVENT_CPI(obj);
+
+    visit_type_uint64(v, name, &e->system_level, errp);
+}
+
+static void get_timestamp(Object *obj, Visitor *v, const char *name,
+                             void *opaque, Error **errp)
+{
+    SCLPEventCPI *e = SCLP_EVENT_CPI(obj);
+
+    visit_type_uint64(v, name, &e->timestamp, errp);
+}
+
 static void cpi_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -106,6 +156,30 @@ static void cpi_class_init(ObjectClass *klass, const void *data)
     k->get_send_mask = send_mask;
     k->get_receive_mask = receive_mask;
     k->write_event_data = write_event_data;
+
+    object_class_property_add_str(klass, "system_type", get_system_type, NULL);
+    object_class_property_set_description(klass, "system_type",
+            "operating system e.g. \"LINUX   \"");
+
+    object_class_property_add_str(klass, "system_name", get_system_name, NULL);
+    object_class_property_set_description(klass, "system_name",
+            "user configurable name of the VM e.g. \"TESTVM  \"");
+
+    object_class_property_add_str(klass, "sysplex_name", get_sysplex_name,
+                                  NULL);
+    object_class_property_set_description(klass, "sysplex_name",
+            "name of the cluster which the VM belongs to, if any"
+            " e.g. \"PLEX    \"");
+
+    object_class_property_add(klass, "system_level", "uint64", get_system_level,
+                              NULL, NULL, NULL);
+    object_class_property_set_description(klass, "system_level",
+            "distribution and kernel version in Linux e.g. 74872343805430528");
+
+    object_class_property_add(klass, "timestamp", "uint64", get_timestamp,
+                              NULL, NULL, NULL);
+    object_class_property_set_description(klass, "timestamp",
+            "latest update of CPI data in nanoseconds since the UNIX EPOCH");
 }
 
 static const TypeInfo sclp_cpi_info = {
diff --git a/include/hw/s390x/event-facility.h b/include/hw/s390x/event-facility.h
index e81bc80498..eac7a51100 100644
--- a/include/hw/s390x/event-facility.h
+++ b/include/hw/s390x/event-facility.h
@@ -201,6 +201,11 @@ OBJECT_DECLARE_TYPE(SCLPEventCPI, SCLPEventCPIClass,
 
 struct SCLPEventCPI {
     SCLPEvent event;
+    uint8_t system_type[8];
+    uint8_t system_name[8];
+    uint64_t system_level;
+    uint8_t sysplex_name[8];
+    uint64_t timestamp;
 };
 
 #define TYPE_SCLP_EVENT_FACILITY "s390-sclp-event-facility"

From c61927ba8e4375fcb80aef9d9bc9e32b8130af01 Mon Sep 17 00:00:00 2001
From: Shalini Chellathurai Saroja <shalini@linux.ibm.com>
Date: Mon, 16 Jun 2025 16:01:07 +0200
Subject: [PATCH 1653/2760] hw/s390x: support migration of CPI data

Register Control-Program Identification data with the live
migration infrastructure.

Signed-off-by: Shalini Chellathurai Saroja <shalini@linux.ibm.com>
Reviewed-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250616140107.990538-4-shalini@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 hw/s390x/sclpcpi.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/hw/s390x/sclpcpi.c b/hw/s390x/sclpcpi.c
index 440a5ff1eb..7aa039d510 100644
--- a/hw/s390x/sclpcpi.c
+++ b/hw/s390x/sclpcpi.c
@@ -54,6 +54,7 @@
 #include "hw/s390x/event-facility.h"
 #include "hw/s390x/ebcdic.h"
 #include "qapi/qapi-visit-machine.h"
+#include "migration/vmstate.h"
 
 typedef struct Data {
     uint8_t id_format;
@@ -145,12 +146,26 @@ static void get_timestamp(Object *obj, Visitor *v, const char *name,
     visit_type_uint64(v, name, &e->timestamp, errp);
 }
 
+static const VMStateDescription vmstate_sclpcpi = {
+    .name = "s390_control_program_id",
+    .version_id = 0,
+    .fields = (const VMStateField[]) {
+        VMSTATE_UINT8_ARRAY(system_type, SCLPEventCPI, 8),
+        VMSTATE_UINT8_ARRAY(system_name, SCLPEventCPI, 8),
+        VMSTATE_UINT64(system_level, SCLPEventCPI),
+        VMSTATE_UINT8_ARRAY(sysplex_name, SCLPEventCPI, 8),
+        VMSTATE_UINT64(timestamp, SCLPEventCPI),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
 static void cpi_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     SCLPEventClass *k = SCLP_EVENT_CLASS(klass);
 
     dc->user_creatable = false;
+    dc->vmsd =  &vmstate_sclpcpi;
 
     k->can_handle_event = can_handle_event;
     k->get_send_mask = send_mask;

From a96011fefc2d9073569d51f481b656b65f552df7 Mon Sep 17 00:00:00 2001
From: Matthew Rosato <mjrosato@linux.ibm.com>
Date: Mon, 23 Jun 2025 12:00:30 -0400
Subject: [PATCH 1654/2760] MAINTAINERS: add reviewers for some s390 areas

To improve review coverage, assign additional people as reviewers for
multiple s390 sections.

Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com>
Acked-by: Jason J. Herne <jjherne@linux.ibm.com>
Acked-by: Collin Walling <walling@linux.ibm.com>
Acked-by: Jared Rossi <jrossi@linux.ibm.com>
Acked-by: Halil Pasic <pasic@linux.ibm.com>
Acked-by: Farhan Ali <alifm@linux.ibm.com>
Acked-by: Zhuoying Cai <zycai@linux.ibm.com>
Acked-by: Eric Farman <farman@linux.ibm.com>
Message-ID: <20250623160030.98281-1-mjrosato@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 MAINTAINERS | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/MAINTAINERS b/MAINTAINERS
index 5b8b314c8c..ebb8af7d5b 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -459,6 +459,8 @@ F: target/ppc/kvm.c
 S390 KVM CPUs
 M: Halil Pasic <pasic@linux.ibm.com>
 M: Christian Borntraeger <borntraeger@linux.ibm.com>
+R: Eric Farman <farman@linux.ibm.com>
+R: Matthew Rosato <mjrosato@linux.ibm.com>
 S: Supported
 F: target/s390x/kvm/
 F: target/s390x/machine.c
@@ -1771,6 +1773,7 @@ S390 Virtio-ccw
 M: Halil Pasic <pasic@linux.ibm.com>
 M: Christian Borntraeger <borntraeger@linux.ibm.com>
 M: Eric Farman <farman@linux.ibm.com>
+R: Matthew Rosato <mjrosato@linux.ibm.com>
 S: Supported
 F: hw/s390x/
 F: include/hw/s390x/
@@ -1782,6 +1785,8 @@ L: qemu-s390x@nongnu.org
 S390-ccw boot
 M: Christian Borntraeger <borntraeger@linux.ibm.com>
 M: Thomas Huth <thuth@redhat.com>
+R: Jared Rossi <jrossi@linux.ibm.com>
+R: Zhuoying Cai <zycai@linux.ibm.com>
 S: Supported
 F: hw/s390x/ipl.*
 F: pc-bios/s390-ccw/
@@ -1802,6 +1807,7 @@ S390 channel subsystem
 M: Halil Pasic <pasic@linux.ibm.com>
 M: Christian Borntraeger <borntraeger@linux.ibm.com>
 M: Eric Farman <farman@linux.ibm.com>
+R: Farhan Ali <alifm@linux.ibm.com>
 S: Supported
 F: hw/s390x/ccw-device.[ch]
 F: hw/s390x/css.c
@@ -1822,6 +1828,7 @@ L: qemu-s390x@nongnu.org
 S390 SCLP-backed devices
 M: Halil Pasic <pasic@linux.ibm.com>
 M: Christian Borntraeger <borntraeger@linux.ibm.com>
+R: Jason Herne <jjherne@linux.ibm.com>
 S: Supported
 F: include/hw/s390x/event-facility.h
 F: include/hw/s390x/sclp.h
@@ -2809,6 +2816,7 @@ F: include/hw/timer/mips_gictimer.h
 S390 3270 device
 M: Halil Pasic <pasic@linux.ibm.com>
 M: Christian Borntraeger <borntraeger@linux.ibm.com>
+R: Collin Walling <walling@linux.ibm.com>
 S: Odd fixes
 F: include/hw/s390x/3270-ccw.h
 F: hw/char/terminal3270.c
@@ -2818,6 +2826,7 @@ L: qemu-s390x@nongnu.org
 S390 diag 288 watchdog
 M: Halil Pasic <pasic@linux.ibm.com>
 M: Christian Borntraeger <borntraeger@linux.ibm.com>
+R: Collin Walling <walling@linux.ibm.com>
 S: Supported
 F: hw/watchdog/wdt_diag288.c
 F: include/hw/watchdog/wdt_diag288.h
@@ -2826,6 +2835,7 @@ L: qemu-s390x@nongnu.org
 S390 storage key device
 M: Halil Pasic <pasic@linux.ibm.com>
 M: Christian Borntraeger <borntraeger@linux.ibm.com>
+R: Jason Herne <jjherne@linux.ibm.com>
 S: Supported
 F: hw/s390x/storage-keys.h
 F: hw/s390x/s390-skeys*.c
@@ -2834,6 +2844,7 @@ L: qemu-s390x@nongnu.org
 S390 storage attribute device
 M: Halil Pasic <pasic@linux.ibm.com>
 M: Christian Borntraeger <borntraeger@linux.ibm.com>
+R: Jason Herne <jjherne@linux.ibm.com>
 S: Supported
 F: hw/s390x/storage-attributes.h
 F: hw/s390x/s390-stattrib*.c
@@ -2843,6 +2854,7 @@ S390 floating interrupt controller
 M: Halil Pasic <pasic@linux.ibm.com>
 M: Christian Borntraeger <borntraeger@linux.ibm.com>
 M: David Hildenbrand <david@redhat.com>
+R: Jason Herne <jjherne@linux.ibm.com>
 S: Supported
 F: hw/intc/s390_flic*.c
 F: include/hw/s390x/s390_flic.h

From 78e3781541209b3dcd6f4bb66adf3a3e504b88a4 Mon Sep 17 00:00:00 2001
From: Kevin Wolf <kwolf@redhat.com>
Date: Wed, 25 Jun 2025 10:27:51 +0200
Subject: [PATCH 1655/2760] hw/s390x/ccw-device: Fix memory leak in loadparm
 setter

Commit bdf12f2a fixed the setter for the "loadparm" machine property,
which gets a string from a visitor, passes it to s390_ipl_fmt_loadparm()
and then forgot to free it. It left another instance of the same problem
unfixed in the "loadparm" device property. Fix it.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20250625082751.24896-1-kwolf@redhat.com>
Reviewed-by: Eric Farman <farman@linux.ibm.com>
Reviewed-by: Halil Pasic <pasic@linux.ibm.com>
Tested-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 hw/s390x/ccw-device.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/s390x/ccw-device.c b/hw/s390x/ccw-device.c
index 19c2238f76..8be1813b9e 100644
--- a/hw/s390x/ccw-device.c
+++ b/hw/s390x/ccw-device.c
@@ -57,7 +57,7 @@ static void ccw_device_set_loadparm(Object *obj, Visitor *v,
                                  Error **errp)
 {
     CcwDevice *dev = CCW_DEVICE(obj);
-    char *val;
+    g_autofree char *val = NULL;
     int index;
 
     index = object_property_get_int(obj, "bootindex", NULL);

From 6e7cb5ff2071827ffac118bb3370b81397fe08d8 Mon Sep 17 00:00:00 2001
From: Haseung Bong <hasueng@gmail.com>
Date: Sun, 15 Jun 2025 09:32:49 +0900
Subject: [PATCH 1656/2760] tests/vm: update openbsd image to 7.7
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Update tests/vm/openbsd to release 7.7

Signed-off-by: Haseung Bong <hasueng@gmail.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20250615003249.310160-1-hasueng@gmail.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/vm/openbsd | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/vm/openbsd b/tests/vm/openbsd
index 5e4f76f398..2ea86a01ba 100755
--- a/tests/vm/openbsd
+++ b/tests/vm/openbsd
@@ -22,8 +22,8 @@ class OpenBSDVM(basevm.BaseVM):
     name = "openbsd"
     arch = "x86_64"
 
-    link = "https://cdn.openbsd.org/pub/OpenBSD/7.6/amd64/install76.iso"
-    csum = "60cba8cb391b50bba8fa10fc768bd0529636f5345d82133c93e22c798d8e5269"
+    link = "https://cdn.openbsd.org/pub/OpenBSD/7.7/amd64/install77.iso"
+    csum = "da0106e39463f015524dca806f407c37a9bdd17e6dfffe533b06a2dd2edd8a27"
     size = "20G"
     pkgs = [
         # tools

From 4db50be038a839d8332790db4d2d63ac247efad3 Mon Sep 17 00:00:00 2001
From: Sean Wei <me@sean.taipei>
Date: Fri, 13 Jun 2025 12:33:10 -0400
Subject: [PATCH 1657/2760] COPYING: replace FSF postal address with licenses
 URL

The license text in COPYING (GPLv2), COPYING.LIB (LGPLv2.1),
and the linux-headers/LICENSES/preferred/GPL-2.0 file are
referenced to the obsolete FSF postal address.

Replace it with the canonical GNU licenses URL recommended by the FSF:
https://www.gnu.org/licenses/

Signed-off-by: Sean Wei <me@sean.taipei>
Message-ID: <20250613.qemu.patch.01@sean.taipei>
[thuth: dropped the changes to the linux-headers folder]
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 COPYING     | 5 ++---
 COPYING.LIB | 5 ++---
 2 files changed, 4 insertions(+), 6 deletions(-)

diff --git a/COPYING b/COPYING
index 00ccfbb628..8095135d50 100644
--- a/COPYING
+++ b/COPYING
@@ -2,7 +2,7 @@
 		       Version 2, June 1991
 
  Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
- 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ <https://fsf.org/>
  Everyone is permitted to copy and distribute verbatim copies
  of this license document, but changing it is not allowed.
 
@@ -304,8 +304,7 @@ the "copyright" line and a pointer to where the full notice is found.
     GNU General Public License for more details.
 
     You should have received a copy of the GNU General Public License along
-    with this program; if not, write to the Free Software Foundation, Inc.,
-    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+    with this program; if not, see <https://www.gnu.org/licenses/>.
 
 Also add information on how to contact you by electronic and paper mail.
 
diff --git a/COPYING.LIB b/COPYING.LIB
index 4362b49151..99f47575b5 100644
--- a/COPYING.LIB
+++ b/COPYING.LIB
@@ -2,7 +2,7 @@
                        Version 2.1, February 1999
 
  Copyright (C) 1991, 1999 Free Software Foundation, Inc.
- 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ <https://fsf.org/>
  Everyone is permitted to copy and distribute verbatim copies
  of this license document, but changing it is not allowed.
 
@@ -484,8 +484,7 @@ convey the exclusion of warranty; and each file should have at least the
     Lesser General Public License for more details.
 
     You should have received a copy of the GNU Lesser General Public
-    License along with this library; if not, write to the Free Software
-    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+    License along with this library; if not, see <https://www.gnu.org/licenses/>.
 
 Also add information on how to contact you by electronic and paper mail.
 

From cf81c1c6b9761d319b37939b8608c2b7dc75ce13 Mon Sep 17 00:00:00 2001
From: Sean Wei <me@sean.taipei>
Date: Fri, 13 Jun 2025 12:39:50 -0400
Subject: [PATCH 1658/2760] libdecnumber: replace FSF postal address with
 licenses URL

Some of the GPLv2 boiler-plate still contained the
obsolete "51 Franklin Street" postal address.

Replace it with the canonical GNU licenses URL recommended by the FSF:
https://www.gnu.org/licenses/

Signed-off-by: Sean Wei <me@sean.taipei>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250613.qemu.patch.03@sean.taipei>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 libdecnumber/decContext.c     | 5 ++---
 libdecnumber/decNumber.c      | 5 ++---
 libdecnumber/dpd/decimal128.c | 5 ++---
 libdecnumber/dpd/decimal32.c  | 5 ++---
 libdecnumber/dpd/decimal64.c  | 5 ++---
 5 files changed, 10 insertions(+), 15 deletions(-)

diff --git a/libdecnumber/decContext.c b/libdecnumber/decContext.c
index 1956edf0a7..d99b08026c 100644
--- a/libdecnumber/decContext.c
+++ b/libdecnumber/decContext.c
@@ -24,9 +24,8 @@
    for more details.
 
    You should have received a copy of the GNU General Public License
-   along with GCC; see the file COPYING.  If not, write to the Free
-   Software Foundation, 51 Franklin Street, Fifth Floor, Boston, MA
-   02110-1301, USA.  */
+   along with GCC; see the file COPYING.  If not, see
+   <https://www.gnu.org/licenses/>.  */
 
 /* ------------------------------------------------------------------ */
 /* Decimal Context module					      */
diff --git a/libdecnumber/decNumber.c b/libdecnumber/decNumber.c
index 31282adafd..4b57d8a6fe 100644
--- a/libdecnumber/decNumber.c
+++ b/libdecnumber/decNumber.c
@@ -24,9 +24,8 @@
    for more details.
 
    You should have received a copy of the GNU General Public License
-   along with GCC; see the file COPYING.  If not, write to the Free
-   Software Foundation, 51 Franklin Street, Fifth Floor, Boston, MA
-   02110-1301, USA.  */
+   along with GCC; see the file COPYING.  If not, see
+   <https://www.gnu.org/licenses/>.  */
 
 /* ------------------------------------------------------------------ */
 /* Decimal Number arithmetic module				      */
diff --git a/libdecnumber/dpd/decimal128.c b/libdecnumber/dpd/decimal128.c
index ca4764e547..1064fb25e0 100644
--- a/libdecnumber/dpd/decimal128.c
+++ b/libdecnumber/dpd/decimal128.c
@@ -24,9 +24,8 @@
    for more details.
 
    You should have received a copy of the GNU General Public License
-   along with GCC; see the file COPYING.  If not, write to the Free
-   Software Foundation, 51 Franklin Street, Fifth Floor, Boston, MA
-   02110-1301, USA.  */
+   along with GCC; see the file COPYING.  If not, see
+   <https://www.gnu.org/licenses/>.  */
 
 /* ------------------------------------------------------------------ */
 /* Decimal 128-bit format module				      */
diff --git a/libdecnumber/dpd/decimal32.c b/libdecnumber/dpd/decimal32.c
index 53f29789d7..34ff0fe959 100644
--- a/libdecnumber/dpd/decimal32.c
+++ b/libdecnumber/dpd/decimal32.c
@@ -24,9 +24,8 @@
    for more details.
 
    You should have received a copy of the GNU General Public License
-   along with GCC; see the file COPYING.  If not, write to the Free
-   Software Foundation, 51 Franklin Street, Fifth Floor, Boston, MA
-   02110-1301, USA.  */
+   along with GCC; see the file COPYING.  If not, see
+   <https://www.gnu.org/licenses/>.  */
 
 /* ------------------------------------------------------------------ */
 /* Decimal 32-bit format module					      */
diff --git a/libdecnumber/dpd/decimal64.c b/libdecnumber/dpd/decimal64.c
index 290dbe8177..11e0674fa7 100644
--- a/libdecnumber/dpd/decimal64.c
+++ b/libdecnumber/dpd/decimal64.c
@@ -24,9 +24,8 @@
    for more details.
 
    You should have received a copy of the GNU General Public License
-   along with GCC; see the file COPYING.  If not, write to the Free
-   Software Foundation, 51 Franklin Street, Fifth Floor, Boston, MA
-   02110-1301, USA.  */
+   along with GCC; see the file COPYING.  If not, see
+   <https://www.gnu.org/licenses/>.  */
 
 /* ------------------------------------------------------------------ */
 /* Decimal 64-bit format module					      */

From 36d7484b0cbd6a6c9e6945d90e4298bec0ff661b Mon Sep 17 00:00:00 2001
From: Sean Wei <me@sean.taipei>
Date: Fri, 13 Jun 2025 12:43:40 -0400
Subject: [PATCH 1659/2760] include/libdecnumber: replace FSF postal address
 with licenses URL

Some of the GPLv2 boiler-plate still contained the
obsolete "51 Franklin Street" postal address.

Replace it with the canonical GNU licenses URL recommended by the FSF:
https://www.gnu.org/licenses/

Signed-off-by: Sean Wei <me@sean.taipei>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250613.qemu.patch.04@sean.taipei>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 include/libdecnumber/dconfig.h             | 5 ++---
 include/libdecnumber/decContext.h          | 5 ++---
 include/libdecnumber/decDPD.h              | 5 ++---
 include/libdecnumber/decNumber.h           | 5 ++---
 include/libdecnumber/decNumberLocal.h      | 5 ++---
 include/libdecnumber/dpd/decimal128.h      | 5 ++---
 include/libdecnumber/dpd/decimal128Local.h | 5 ++---
 include/libdecnumber/dpd/decimal32.h       | 5 ++---
 include/libdecnumber/dpd/decimal64.h       | 5 ++---
 9 files changed, 18 insertions(+), 27 deletions(-)

diff --git a/include/libdecnumber/dconfig.h b/include/libdecnumber/dconfig.h
index 2bc0ba7f14..e67ecc1b5f 100644
--- a/include/libdecnumber/dconfig.h
+++ b/include/libdecnumber/dconfig.h
@@ -23,9 +23,8 @@
    for more details.
 
    You should have received a copy of the GNU General Public License
-   along with GCC; see the file COPYING.  If not, write to the Free
-   Software Foundation, 51 Franklin Street, Fifth Floor, Boston, MA
-   02110-1301, USA.  */
+   along with GCC; see the file COPYING.  If not, see
+   <https://www.gnu.org/licenses/>.  */
 
 
 #if HOST_BIG_ENDIAN
diff --git a/include/libdecnumber/decContext.h b/include/libdecnumber/decContext.h
index cea6e4279e..5bb64e1332 100644
--- a/include/libdecnumber/decContext.h
+++ b/include/libdecnumber/decContext.h
@@ -24,9 +24,8 @@
    for more details.
 
    You should have received a copy of the GNU General Public License
-   along with GCC; see the file COPYING.  If not, write to the Free
-   Software Foundation, 51 Franklin Street, Fifth Floor, Boston, MA
-   02110-1301, USA.  */
+   along with GCC; see the file COPYING.  If not, see
+   <https://www.gnu.org/licenses/>.  */
 
 /* ------------------------------------------------------------------ */
 /* Decimal Context module header				      */
diff --git a/include/libdecnumber/decDPD.h b/include/libdecnumber/decDPD.h
index 26a21ec8ed..8eb455277b 100644
--- a/include/libdecnumber/decDPD.h
+++ b/include/libdecnumber/decDPD.h
@@ -24,9 +24,8 @@
    for more details.
 
    You should have received a copy of the GNU General Public License
-   along with GCC; see the file COPYING.  If not, write to the Free
-   Software Foundation, 51 Franklin Street, Fifth Floor, Boston, MA
-   02110-1301, USA.  */
+   along with GCC; see the file COPYING.  If not, see
+   <https://www.gnu.org/licenses/>.  */
 
 /* ------------------------------------------------------------------------ */
 /* Binary Coded Decimal and Densely Packed Decimal conversion lookup tables */
diff --git a/include/libdecnumber/decNumber.h b/include/libdecnumber/decNumber.h
index 41bc2a0d36..bf37af83e6 100644
--- a/include/libdecnumber/decNumber.h
+++ b/include/libdecnumber/decNumber.h
@@ -24,9 +24,8 @@
    for more details.
 
    You should have received a copy of the GNU General Public License
-   along with GCC; see the file COPYING.  If not, write to the Free
-   Software Foundation, 51 Franklin Street, Fifth Floor, Boston, MA
-   02110-1301, USA.  */
+   along with GCC; see the file COPYING.  If not, see
+   <https://www.gnu.org/licenses/>.  */
 
 /* ------------------------------------------------------------------ */
 /* Decimal Number arithmetic module header			      */
diff --git a/include/libdecnumber/decNumberLocal.h b/include/libdecnumber/decNumberLocal.h
index 6198ca8593..0959f6606b 100644
--- a/include/libdecnumber/decNumberLocal.h
+++ b/include/libdecnumber/decNumberLocal.h
@@ -24,9 +24,8 @@
    for more details.
 
    You should have received a copy of the GNU General Public License
-   along with GCC; see the file COPYING.  If not, write to the Free
-   Software Foundation, 51 Franklin Street, Fifth Floor, Boston, MA
-   02110-1301, USA.  */
+   along with GCC; see the file COPYING.  If not, see
+   <https://www.gnu.org/licenses/>.  */
 
 /* ------------------------------------------------------------------ */
 /* decNumber package local type, tuning, and macro definitions	      */
diff --git a/include/libdecnumber/dpd/decimal128.h b/include/libdecnumber/dpd/decimal128.h
index aff261e556..c57180baf8 100644
--- a/include/libdecnumber/dpd/decimal128.h
+++ b/include/libdecnumber/dpd/decimal128.h
@@ -24,9 +24,8 @@
    for more details.
 
    You should have received a copy of the GNU General Public License
-   along with GCC; see the file COPYING.  If not, write to the Free
-   Software Foundation, 51 Franklin Street, Fifth Floor, Boston, MA
-   02110-1301, USA.  */
+   along with GCC; see the file COPYING.  If not, see
+   <https://www.gnu.org/licenses/>.  */
 
 /* ------------------------------------------------------------------ */
 /* Decimal 128-bit format module header				      */
diff --git a/include/libdecnumber/dpd/decimal128Local.h b/include/libdecnumber/dpd/decimal128Local.h
index 9765427719..2948ab2534 100644
--- a/include/libdecnumber/dpd/decimal128Local.h
+++ b/include/libdecnumber/dpd/decimal128Local.h
@@ -23,9 +23,8 @@
    for more details.
 
    You should have received a copy of the GNU General Public License
-   along with GCC; see the file COPYING.  If not, write to the Free
-   Software Foundation, 51 Franklin Street, Fifth Floor, Boston, MA
-   02110-1301, USA.  */
+   along with GCC; see the file COPYING.  If not, see
+   <https://www.gnu.org/licenses/>.  */
 
 #if !defined(DECIMAL128LOCAL)
 
diff --git a/include/libdecnumber/dpd/decimal32.h b/include/libdecnumber/dpd/decimal32.h
index 6cb9e43620..9a17933497 100644
--- a/include/libdecnumber/dpd/decimal32.h
+++ b/include/libdecnumber/dpd/decimal32.h
@@ -24,9 +24,8 @@
    for more details.
 
    You should have received a copy of the GNU General Public License
-   along with GCC; see the file COPYING.  If not, write to the Free
-   Software Foundation, 51 Franklin Street, Fifth Floor, Boston, MA
-   02110-1301, USA.  */
+   along with GCC; see the file COPYING.  If not, see
+   <https://www.gnu.org/licenses/>.  */
 
 /* ------------------------------------------------------------------ */
 /* Decimal 32-bit format module header				      */
diff --git a/include/libdecnumber/dpd/decimal64.h b/include/libdecnumber/dpd/decimal64.h
index f29e57064d..5c3d0bb43c 100644
--- a/include/libdecnumber/dpd/decimal64.h
+++ b/include/libdecnumber/dpd/decimal64.h
@@ -24,9 +24,8 @@
    for more details.
 
    You should have received a copy of the GNU General Public License
-   along with GCC; see the file COPYING.  If not, write to the Free
-   Software Foundation, 51 Franklin Street, Fifth Floor, Boston, MA
-   02110-1301, USA.  */
+   along with GCC; see the file COPYING.  If not, see
+   <https://www.gnu.org/licenses/>.  */
 
 /* ------------------------------------------------------------------ */
 /* Decimal 64-bit format module header				      */

From e5308bc52d25da207fbb1cd7b557201b6612fd61 Mon Sep 17 00:00:00 2001
From: Sean Wei <me@sean.taipei>
Date: Fri, 13 Jun 2025 12:44:10 -0400
Subject: [PATCH 1660/2760] include/hw: replace FSF postal address with
 licenses URL
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Some of the GPLv2 boiler-plate still contained the
obsolete "51 Franklin Street" postal address.

Replace it with the canonical GNU licenses URL recommended by the FSF:
https://www.gnu.org/licenses/

Signed-off-by: Sean Wei <me@sean.taipei>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Message-ID: <20250613.qemu.patch.05@sean.taipei>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 include/hw/i2c/aspeed_i2c.h     | 3 +--
 include/hw/pci/pci_bridge.h     | 4 ++--
 include/hw/timer/aspeed_timer.h | 3 +--
 3 files changed, 4 insertions(+), 6 deletions(-)

diff --git a/include/hw/i2c/aspeed_i2c.h b/include/hw/i2c/aspeed_i2c.h
index 2c4c81bd20..2daacc10ce 100644
--- a/include/hw/i2c/aspeed_i2c.h
+++ b/include/hw/i2c/aspeed_i2c.h
@@ -14,8 +14,7 @@
  *  GNU General Public License for more details.
  *
  *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  with this program; if not, see <https://www.gnu.org/licenses/>.
  */
 
 #ifndef ASPEED_I2C_H
diff --git a/include/hw/pci/pci_bridge.h b/include/hw/pci/pci_bridge.h
index b0f5204d80..8cdacbc4e1 100644
--- a/include/hw/pci/pci_bridge.h
+++ b/include/hw/pci/pci_bridge.h
@@ -14,8 +14,8 @@
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ * along with this program; if not, see
+ * <https://www.gnu.org/licenses/>.
  *
  * split out pci bus specific stuff from pci.[hc] to pci_bridge.[hc]
  * Copyright (c) 2009 Isaku Yamahata <yamahata at valinux co jp>
diff --git a/include/hw/timer/aspeed_timer.h b/include/hw/timer/aspeed_timer.h
index 767cae4b05..a850625a05 100644
--- a/include/hw/timer/aspeed_timer.h
+++ b/include/hw/timer/aspeed_timer.h
@@ -16,8 +16,7 @@
  *  GNU General Public License for more details.
  *
  *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  with this program; if not, see <https://www.gnu.org/licenses/>.
  */
 #ifndef ASPEED_TIMER_H
 #define ASPEED_TIMER_H

From c61b807e625846871e3d142a9f101d58f7ee2522 Mon Sep 17 00:00:00 2001
From: Sean Wei <me@sean.taipei>
Date: Fri, 13 Jun 2025 12:46:15 -0400
Subject: [PATCH 1661/2760] include/qemu: replace FSF postal address with
 licenses URL

The LGPLv2.1 boiler-plate in rcu.h and rcu_queue.h still
contained the obsolete "51 Franklin Street" postal address.

Replace it with the canonical GNU licenses URL recommended by the FSF:
https://www.gnu.org/licenses/

Signed-off-by: Sean Wei <me@sean.taipei>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250613.qemu.patch.06@sean.taipei>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 include/qemu/rcu.h       | 4 ++--
 include/qemu/rcu_queue.h | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/include/qemu/rcu.h b/include/qemu/rcu.h
index fea058aa9f..020dbe4d8b 100644
--- a/include/qemu/rcu.h
+++ b/include/qemu/rcu.h
@@ -17,8 +17,8 @@
  * Lesser General Public License for more details.
  *
  * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ * License along with this library; if not, see
+ * <https://www.gnu.org/licenses/>.
  *
  * IBM's contributions to this file may be relicensed under LGPLv2 or later.
  */
diff --git a/include/qemu/rcu_queue.h b/include/qemu/rcu_queue.h
index 4e6298d473..bfd5900fda 100644
--- a/include/qemu/rcu_queue.h
+++ b/include/qemu/rcu_queue.h
@@ -17,8 +17,8 @@
  * Lesser General Public License for more details.
  *
  * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ * License along with this library; if not, see
+ * <https://www.gnu.org/licenses/>.
  *
  * Copyright (c) 2013 Mike D. Day, IBM Corporation.
  *

From 145c3e54be7fa5e4f0a2ac527db28e27940dab91 Mon Sep 17 00:00:00 2001
From: Sean Wei <me@sean.taipei>
Date: Fri, 13 Jun 2025 12:46:50 -0400
Subject: [PATCH 1662/2760] util/rcu.c: replace FSF postal address with
 licenses URL

The LGPLv2.1 boiler-plate in util/rcu.c still contained
the obsolete "51 Franklin Street" postal address.

Replace it with the canonical GNU licenses URL recommended by the FSF:
https://www.gnu.org/licenses/

Signed-off-by: Sean Wei <me@sean.taipei>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250613.qemu.patch.07@sean.taipei>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 util/rcu.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/util/rcu.c b/util/rcu.c
index fa32c942e4..b703c86f15 100644
--- a/util/rcu.c
+++ b/util/rcu.c
@@ -20,8 +20,8 @@
  * Lesser General Public License for more details.
  *
  * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ * License along with this library; if not, see
+ * <https://www.gnu.org/licenses/>.
  *
  * IBM's contributions to this file may be relicensed under LGPLv2 or later.
  */

From 49b91833cc671c30fd2a074a92c50c858d6ec055 Mon Sep 17 00:00:00 2001
From: Sean Wei <me@sean.taipei>
Date: Fri, 13 Jun 2025 12:50:20 -0400
Subject: [PATCH 1663/2760] hw: replace FSF postal address with licenses URL

The GPLv2 boiler-plate in vmxnet3.h and vmw_pvscsi.h still
contained the obsolete "51 Franklin Street" postal address.

Replace it with the canonical GNU licenses URL recommended by the FSF:
https://www.gnu.org/licenses/

Signed-off-by: Sean Wei <me@sean.taipei>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250613.qemu.patch.08@sean.taipei>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 hw/net/vmxnet3.h     | 4 ++--
 hw/scsi/vmw_pvscsi.h | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/hw/net/vmxnet3.h b/hw/net/vmxnet3.h
index f9283f9e7b..dbc69d5fb6 100644
--- a/hw/net/vmxnet3.h
+++ b/hw/net/vmxnet3.h
@@ -63,8 +63,8 @@
  * details.
  *
  * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ * along with this program; if not, see
+ * <https://www.gnu.org/licenses/>.
  *
  * The full GNU General Public License is included in this distribution in
  * the file called "COPYING".
diff --git a/hw/scsi/vmw_pvscsi.h b/hw/scsi/vmw_pvscsi.h
index 17fcf66273..a3ae517e19 100644
--- a/hw/scsi/vmw_pvscsi.h
+++ b/hw/scsi/vmw_pvscsi.h
@@ -14,8 +14,8 @@
  * details.
  *
  * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ * along with this program; if not, see
+ * <https://www.gnu.org/licenses/>.
  *
  * Maintained by: Arvind Kumar <arvindkumar@vmware.com>
  *

From 19f5891f2ee6bdebc4c522ea5744f4d4ea7365f1 Mon Sep 17 00:00:00 2001
From: Sean Wei <me@sean.taipei>
Date: Fri, 13 Jun 2025 12:51:45 -0400
Subject: [PATCH 1664/2760] scripts: replace FSF postal address with licenses
 URL

The GPLv2 boiler-plate in scripts/device-crash-test still
contained the obsolete "51 Franklin Street" postal address.

Replace it with the canonical GNU licenses URL recommended by the FSF:
https://www.gnu.org/licenses/

Signed-off-by: Sean Wei <me@sean.taipei>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250613.qemu.patch.09@sean.taipei>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 scripts/device-crash-test | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/scripts/device-crash-test b/scripts/device-crash-test
index da8b56edd9..1ecb9663ae 100755
--- a/scripts/device-crash-test
+++ b/scripts/device-crash-test
@@ -16,8 +16,7 @@
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License along
-# with this program; if not, write to the Free Software Foundation, Inc.,
-# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+# with this program; if not, see <https://www.gnu.org/licenses/>.
 
 """
 Run QEMU with all combinations of -machine and -device types,

From e656492766ce947cf0699e0e3d602a2587ac38d3 Mon Sep 17 00:00:00 2001
From: Sean Wei <me@sean.taipei>
Date: Fri, 13 Jun 2025 12:53:00 -0400
Subject: [PATCH 1665/2760] contrib: replace FSF postal address with licenses
 URL

The LGPLv2.1 boiler-plate in pdb.c file still contained
the obsolete "51 Franklin Street" postal address.

Replace it with the canonical GNU licenses URL recommended by the FSF:
https://www.gnu.org/licenses/

Signed-off-by: Sean Wei <me@sean.taipei>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Message-ID: <20250613.qemu.patch.10@sean.taipei>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 contrib/elf2dmp/pdb.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/contrib/elf2dmp/pdb.c b/contrib/elf2dmp/pdb.c
index 492aca4434..47c5126fb8 100644
--- a/contrib/elf2dmp/pdb.c
+++ b/contrib/elf2dmp/pdb.c
@@ -14,8 +14,8 @@
  * Lesser General Public License for more details.
  *
  * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ * License along with this library; if not, see
+ * <https://www.gnu.org/licenses/>.
  */
 
 #include "qemu/osdep.h"

From e38bdca0cab79a652ad4d619044857a2fe2a447b Mon Sep 17 00:00:00 2001
From: Sean Wei <me@sean.taipei>
Date: Fri, 13 Jun 2025 12:53:32 -0400
Subject: [PATCH 1666/2760] target/xtensa: replace FSF postal address with
 licenses URL

Some of the GPLv2 boiler-plate still contained the
obsolete "51 Franklin Street" postal address.

Replace it with the canonical GNU licenses URL recommended by the FSF:
https://www.gnu.org/licenses/

Signed-off-by: Sean Wei <me@sean.taipei>
Acked-by: Max Filippov <jcmvbkbc@gmail.com>
Message-ID: <20250613.qemu.patch.11@sean.taipei>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 target/xtensa/core-dc232b/gdb-config.c.inc     | 5 ++---
 target/xtensa/core-dc232b/xtensa-modules.c.inc | 5 ++---
 target/xtensa/core-fsf/xtensa-modules.c.inc    | 5 ++---
 3 files changed, 6 insertions(+), 9 deletions(-)

diff --git a/target/xtensa/core-dc232b/gdb-config.c.inc b/target/xtensa/core-dc232b/gdb-config.c.inc
index d87168628b..8c88caef59 100644
--- a/target/xtensa/core-dc232b/gdb-config.c.inc
+++ b/target/xtensa/core-dc232b/gdb-config.c.inc
@@ -15,9 +15,8 @@
    GNU General Public License for more details.
 
    You should have received a copy of the GNU General Public License
-   along with this program; if not, write to the Free Software
-   Foundation, Inc., 51 Franklin Street, Fifth Floor,
-   Boston, MA 02110-1301, USA.  */
+   along with this program; if not, see
+   <https://www.gnu.org/licenses/>.  */
 
   XTREG(0,   0, 32, 4, 4, 0x0020, 0x0006, -2, 9, 0x0100, pc,
           0, 0, 0, 0, 0, 0)
diff --git a/target/xtensa/core-dc232b/xtensa-modules.c.inc b/target/xtensa/core-dc232b/xtensa-modules.c.inc
index 164df3b1a4..bb9ebd24b8 100644
--- a/target/xtensa/core-dc232b/xtensa-modules.c.inc
+++ b/target/xtensa/core-dc232b/xtensa-modules.c.inc
@@ -14,9 +14,8 @@
    General Public License for more details.
 
    You should have received a copy of the GNU General Public License
-   along with this program; if not, write to the Free Software
-   Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA
-   02110-1301, USA.  */
+   along with this program; if not, see
+   <https://www.gnu.org/licenses/>.  */
 
 #include "qemu/osdep.h"
 #include "xtensa-isa.h"
diff --git a/target/xtensa/core-fsf/xtensa-modules.c.inc b/target/xtensa/core-fsf/xtensa-modules.c.inc
index c32683ff77..531f5e2b7e 100644
--- a/target/xtensa/core-fsf/xtensa-modules.c.inc
+++ b/target/xtensa/core-fsf/xtensa-modules.c.inc
@@ -14,9 +14,8 @@
    General Public License for more details.
 
    You should have received a copy of the GNU General Public License
-   along with this program; if not, write to the Free Software
-   Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA
-   02110-1301, USA.  */
+   along with this program; if not, see
+   <https://www.gnu.org/licenses/>.  */
 
 #include "qemu/osdep.h"
 #include "xtensa-isa.h"

From fd68168e0af14546117705176ace84d2c6c52416 Mon Sep 17 00:00:00 2001
From: Sean Wei <me@sean.taipei>
Date: Fri, 13 Jun 2025 12:54:20 -0400
Subject: [PATCH 1667/2760] target/i386/emulate: replace FSF postal address
 with licenses URL

Some of the LGPLv2.1 boiler-plate still contained the
obsolete "51 Franklin Street" postal address.

Replace it with the canonical GNU licenses URL recommended by the FSF:
https://www.gnu.org/licenses/

Signed-off-by: Sean Wei <me@sean.taipei>
Reviewed-by: Wei Liu <wei.liu@kernel.org>
Message-ID: <20250613.qemu.patch.12@sean.taipei>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 target/i386/emulate/x86_emu.c   | 4 ++--
 target/i386/emulate/x86_flags.c | 4 ++--
 target/i386/emulate/x86_flags.h | 4 ++--
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/target/i386/emulate/x86_emu.c b/target/i386/emulate/x86_emu.c
index 4890e0a4e5..db7a7f7437 100644
--- a/target/i386/emulate/x86_emu.c
+++ b/target/i386/emulate/x86_emu.c
@@ -31,8 +31,8 @@
 //  Lesser General Public License for more details.
 //
 //  You should have received a copy of the GNU Lesser General Public
-//  License along with this library; if not, write to the Free Software
-//  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA B 02110-1301 USA
+//  License along with this library; if not, see
+//  <https://www.gnu.org/licenses/>.
 /////////////////////////////////////////////////////////////////////////
 
 #include "qemu/osdep.h"
diff --git a/target/i386/emulate/x86_flags.c b/target/i386/emulate/x86_flags.c
index cc138c7749..6592193b5e 100644
--- a/target/i386/emulate/x86_flags.c
+++ b/target/i386/emulate/x86_flags.c
@@ -14,8 +14,8 @@
 //  Lesser General Public License for more details.
 //
 //  You should have received a copy of the GNU Lesser General Public
-//  License along with this library; if not, write to the Free Software
-//  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA B 02110-1301 USA
+//  License along with this library; if not, see
+//  <https://www.gnu.org/licenses/>.
 /////////////////////////////////////////////////////////////////////////
 /*
  * flags functions
diff --git a/target/i386/emulate/x86_flags.h b/target/i386/emulate/x86_flags.h
index 28b008e577..a395c837a0 100644
--- a/target/i386/emulate/x86_flags.h
+++ b/target/i386/emulate/x86_flags.h
@@ -14,8 +14,8 @@
 //  Lesser General Public License for more details.
 //
 //  You should have received a copy of the GNU Lesser General Public
-//  License along with this library; if not, write to the Free Software
-//  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA B 02110-1301 USA
+//  License along with this library; if not, see
+//  <https://www.gnu.org/licenses/>.
 /////////////////////////////////////////////////////////////////////////
 /*
  * x86 eflags functions

From 639ff87a1a823715f16edec34caacd8ef824fcfd Mon Sep 17 00:00:00 2001
From: Rorie Reyes <rreyes@linux.ibm.com>
Date: Wed, 11 Jun 2025 17:12:52 -0400
Subject: [PATCH 1668/2760] hw/vfio/ap: attribute constructor for
 cfg_chg_events_lock
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Created an attribute constructor for cfg_chg_events_lock for locking
mechanism when storing event information for an AP configuration change
event

Fixes: fd03360215 ("Storing event information for an AP configuration change event")
Signed-off-by: Rorie Reyes <rreyes@linux.ibm.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250611211252.82107-1-rreyes@linux.ibm.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/ap.c | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/hw/vfio/ap.c b/hw/vfio/ap.c
index 874e0d1eaf..1df4438149 100644
--- a/hw/vfio/ap.c
+++ b/hw/vfio/ap.c
@@ -52,6 +52,11 @@ static QTAILQ_HEAD(, APConfigChgEvent) cfg_chg_events =
 
 static QemuMutex cfg_chg_events_lock;
 
+static void __attribute__((constructor)) vfio_ap_global_init(void)
+{
+    qemu_mutex_init(&cfg_chg_events_lock);
+}
+
 OBJECT_DECLARE_SIMPLE_TYPE(VFIOAPDevice, VFIO_AP_DEVICE)
 
 static void vfio_ap_compute_needs_reset(VFIODevice *vdev)
@@ -230,13 +235,6 @@ static void vfio_ap_realize(DeviceState *dev, Error **errp)
     VFIOAPDevice *vapdev = VFIO_AP_DEVICE(dev);
     VFIODevice *vbasedev = &vapdev->vdev;
 
-    static bool lock_initialized;
-
-    if (!lock_initialized) {
-        qemu_mutex_init(&cfg_chg_events_lock);
-        lock_initialized = true;
-    }
-
     if (!vfio_device_get_name(vbasedev, errp)) {
         return;
     }

From b1f521de8b2f356f4ae7683c51aa8c3ba6c7931e Mon Sep 17 00:00:00 2001
From: John Levon <john.levon@nutanix.com>
Date: Mon, 16 Jun 2025 03:13:36 -0700
Subject: [PATCH 1669/2760] vfio: add vfio_device_get_region_fd()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This keeps the existence of ->region_fds private to hw/vfio/device.c.

Signed-off-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/qemu-devel/20250616101337.3190027-1-john.levon@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/device.c              |  7 +++++++
 hw/vfio/region.c              |  5 +----
 include/hw/vfio/vfio-device.h | 12 ++++++++++++
 3 files changed, 20 insertions(+), 4 deletions(-)

diff --git a/hw/vfio/device.c b/hw/vfio/device.c
index d32600eda1..d91c695b69 100644
--- a/hw/vfio/device.c
+++ b/hw/vfio/device.c
@@ -243,6 +243,13 @@ retry:
     return 0;
 }
 
+int vfio_device_get_region_fd(VFIODevice *vbasedev, int index)
+{
+        return vbasedev->region_fds ?
+               vbasedev->region_fds[index] :
+               vbasedev->fd;
+}
+
 int vfio_device_get_region_info_type(VFIODevice *vbasedev, uint32_t type,
                                      uint32_t subtype, struct vfio_region_info **info)
 {
diff --git a/hw/vfio/region.c b/hw/vfio/region.c
index f5b8e3cbf1..d04c57db63 100644
--- a/hw/vfio/region.c
+++ b/hw/vfio/region.c
@@ -273,10 +273,7 @@ int vfio_region_mmap(VFIORegion *region)
             goto no_mmap;
         }
 
-        /* Use the per-region fd if set, or the shared fd. */
-        fd = region->vbasedev->region_fds ?
-             region->vbasedev->region_fds[region->nr] :
-             region->vbasedev->fd,
+        fd = vfio_device_get_region_fd(region->vbasedev, region->nr);
 
         map_align = (void *)ROUND_UP((uintptr_t)map_base, (uintptr_t)align);
         munmap(map_base, map_align - map_base);
diff --git a/include/hw/vfio/vfio-device.h b/include/hw/vfio/vfio-device.h
index d45e5a68a2..1926adb0a3 100644
--- a/include/hw/vfio/vfio-device.h
+++ b/include/hw/vfio/vfio-device.h
@@ -256,6 +256,18 @@ int vfio_device_get_region_info(VFIODevice *vbasedev, int index,
                                 struct vfio_region_info **info);
 int vfio_device_get_region_info_type(VFIODevice *vbasedev, uint32_t type,
                                      uint32_t subtype, struct vfio_region_info **info);
+
+/**
+ * Return the fd for mapping this region. This is either the device's fd (for
+ * e.g. kernel vfio), or a per-region fd (for vfio-user).
+ *
+ * @vbasedev: #VFIODevice to use
+ * @index: region index
+ *
+ * Returns the fd.
+ */
+int vfio_device_get_region_fd(VFIODevice *vbasedev, int index);
+
 bool vfio_device_has_region_cap(VFIODevice *vbasedev, int region, uint16_t cap_type);
 
 int vfio_device_get_irq_info(VFIODevice *vbasedev, int index,

From 8d60d069d7027bc3121763d73b0c973a1e3f19f3 Mon Sep 17 00:00:00 2001
From: John Levon <john.levon@nutanix.com>
Date: Mon, 16 Jun 2025 03:13:14 -0700
Subject: [PATCH 1670/2760] vfio: add documentation for posted write argument
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250616101314.3189793-1-john.levon@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 include/hw/vfio/vfio-device.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/include/hw/vfio/vfio-device.h b/include/hw/vfio/vfio-device.h
index 1926adb0a3..959e458d7f 100644
--- a/include/hw/vfio/vfio-device.h
+++ b/include/hw/vfio/vfio-device.h
@@ -240,6 +240,7 @@ struct VFIODeviceIOOps {
      * @off: offset within the region
      * @size: size in bytes to write
      * @data: buffer to write from
+     * @post: true if this is a posted write
      *
      * Returns number of bytes write on success or -errno.
      */

From eafb408629d980dac7db24abe5b8fab2c7a67525 Mon Sep 17 00:00:00 2001
From: John Levon <john.levon@nutanix.com>
Date: Mon, 23 Jun 2025 10:30:53 +0100
Subject: [PATCH 1671/2760] vfio: add license tag to some files
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add SPDX-License-Identifier to some files missing it in hw/vfio/.

Signed-off-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250623093053.1495509-1-john.levon@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/Kconfig      | 2 ++
 hw/vfio/meson.build  | 2 ++
 hw/vfio/trace-events | 2 ++
 hw/vfio/trace.h      | 3 +++
 4 files changed, 9 insertions(+)

diff --git a/hw/vfio/Kconfig b/hw/vfio/Kconfig
index 7cdba0560a..91d9023b79 100644
--- a/hw/vfio/Kconfig
+++ b/hw/vfio/Kconfig
@@ -1,3 +1,5 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
 config VFIO
     bool
     depends on LINUX
diff --git a/hw/vfio/meson.build b/hw/vfio/meson.build
index 73d29f925f..63ea393076 100644
--- a/hw/vfio/meson.build
+++ b/hw/vfio/meson.build
@@ -1,3 +1,5 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
 vfio_ss = ss.source_set()
 vfio_ss.add(files(
   'listener.c',
diff --git a/hw/vfio/trace-events b/hw/vfio/trace-events
index f06236f37b..e1728c4ef6 100644
--- a/hw/vfio/trace-events
+++ b/hw/vfio/trace-events
@@ -1,4 +1,6 @@
 # See docs/devel/tracing.rst for syntax documentation.
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
 
 # pci.c
 vfio_intx_interrupt(const char *name, char line) " (%s) Pin %c"
diff --git a/hw/vfio/trace.h b/hw/vfio/trace.h
index 5a343aa59c..b34b61ddb2 100644
--- a/hw/vfio/trace.h
+++ b/hw/vfio/trace.h
@@ -1 +1,4 @@
+/*
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
 #include "trace/trace-hw_vfio.h"

From abc6249d42f9681d5b659716434ef374c6e0edef Mon Sep 17 00:00:00 2001
From: Zhenzhong Duan <zhenzhong.duan@intel.com>
Date: Mon, 23 Jun 2025 18:22:32 +0800
Subject: [PATCH 1672/2760] vfio/container: Fix SIGSEGV when open container
 file fails
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When open /dev/vfio/vfio fails, SIGSEGV triggers because
vfio_listener_unregister() doesn't support a NULL bcontainer
pointer.

Fixes: a1f267a7d4d9 ("vfio/container: reform vfio_container_connect cleanup")
Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250623102235.94877-2-zhenzhong.duan@intel.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/container.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/hw/vfio/container.c b/hw/vfio/container.c
index 3e8d645ebb..2853f6f08b 100644
--- a/hw/vfio/container.c
+++ b/hw/vfio/container.c
@@ -710,7 +710,9 @@ static bool vfio_container_connect(VFIOGroup *group, AddressSpace *as,
     return true;
 
 fail:
-    vfio_listener_unregister(bcontainer);
+    if (new_container) {
+        vfio_listener_unregister(bcontainer);
+    }
 
     if (group_was_added) {
         vfio_container_group_del(container, group);

From c72d6ebaadcaec1daa995d47716348e150757a51 Mon Sep 17 00:00:00 2001
From: Zhenzhong Duan <zhenzhong.duan@intel.com>
Date: Mon, 23 Jun 2025 18:22:33 +0800
Subject: [PATCH 1673/2760] vfio/container: fails mdev hotplug if add migration
 blocker failed
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

It's aggressive to abort a running QEMU process when hotplug a mdev
and it fails migration blocker adding.

Fix by just failing mdev hotplug itself.

Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250623102235.94877-3-zhenzhong.duan@intel.com
[ clg: Changed test on value returned by migrate_add_blocker_modes() ]
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/container.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/hw/vfio/container.c b/hw/vfio/container.c
index 2853f6f08b..3e13feaa74 100644
--- a/hw/vfio/container.c
+++ b/hw/vfio/container.c
@@ -992,12 +992,16 @@ static bool vfio_legacy_attach_device(const char *name, VFIODevice *vbasedev,
     if (vbasedev->mdev) {
         error_setg(&vbasedev->cpr.mdev_blocker,
                    "CPR does not support vfio mdev %s", vbasedev->name);
-        migrate_add_blocker_modes(&vbasedev->cpr.mdev_blocker, &error_fatal,
-                                  MIG_MODE_CPR_TRANSFER, -1);
+        if (migrate_add_blocker_modes(&vbasedev->cpr.mdev_blocker, errp,
+                                      MIG_MODE_CPR_TRANSFER, -1) < 0) {
+            goto hiod_unref_exit;
+        }
     }
 
     return true;
 
+hiod_unref_exit:
+    object_unref(vbasedev->hiod);
 device_put_exit:
     vfio_device_put(vbasedev);
 group_put_exit:

From 9fca2b7d702f7ba216c571504922b2f8994537cc Mon Sep 17 00:00:00 2001
From: John Levon <john.levon@nutanix.com>
Date: Wed, 25 Jun 2025 20:29:53 +0100
Subject: [PATCH 1674/2760] vfio-user: add vfio-user class and container
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Introduce basic plumbing for vfio-user with CONFIG_VFIO_USER.

We introduce VFIOUserContainer in hw/vfio-user/container.c, which is a
container type for the "IOMMU" type "vfio-iommu-user", and share some
common container code from hw/vfio/container.c.

Add hw/vfio-user/pci.c for instantiating VFIOUserPCIDevice objects,
sharing some common code from hw/vfio/pci.c.

Originally-by: John Johnson <john.g.johnson@oracle.com>
Signed-off-by: Elena Ufimtseva <elena.ufimtseva@oracle.com>
Signed-off-by: Jagannathan Raman <jag.raman@oracle.com>
Signed-off-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250625193012.2316242-2-john.levon@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 MAINTAINERS                           |   8 +
 hw/Kconfig                            |   1 +
 hw/meson.build                        |   1 +
 hw/vfio-user/Kconfig                  |   7 +
 hw/vfio-user/container.c              | 208 ++++++++++++++++++++++++++
 hw/vfio-user/container.h              |  21 +++
 hw/vfio-user/meson.build              |   9 ++
 hw/vfio-user/pci.c                    | 185 +++++++++++++++++++++++
 include/hw/vfio/vfio-container-base.h |   1 +
 9 files changed, 441 insertions(+)
 create mode 100644 hw/vfio-user/Kconfig
 create mode 100644 hw/vfio-user/container.c
 create mode 100644 hw/vfio-user/container.h
 create mode 100644 hw/vfio-user/meson.build
 create mode 100644 hw/vfio-user/pci.c

diff --git a/MAINTAINERS b/MAINTAINERS
index 27f4fe3f25..2369391004 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -4253,6 +4253,14 @@ F: hw/remote/iommu.c
 F: include/hw/remote/iommu.h
 F: tests/functional/test_multiprocess.py
 
+VFIO-USER:
+M: John Levon <john.levon@nutanix.com>
+M: Thanos Makatos <thanos.makatos@nutanix.com>
+S: Supported
+F: hw/vfio-user/*
+F: include/hw/vfio-user/*
+F: subprojects/libvfio-user
+
 EBPF:
 M: Jason Wang <jasowang@redhat.com>
 R: Andrew Melnychenko <andrew@daynix.com>
diff --git a/hw/Kconfig b/hw/Kconfig
index 9a86a6a28a..9e6c789ae7 100644
--- a/hw/Kconfig
+++ b/hw/Kconfig
@@ -42,6 +42,7 @@ source ufs/Kconfig
 source usb/Kconfig
 source virtio/Kconfig
 source vfio/Kconfig
+source vfio-user/Kconfig
 source vmapple/Kconfig
 source xen/Kconfig
 source watchdog/Kconfig
diff --git a/hw/meson.build b/hw/meson.build
index b91f761fe0..791ce21ab4 100644
--- a/hw/meson.build
+++ b/hw/meson.build
@@ -39,6 +39,7 @@ subdir('uefi')
 subdir('ufs')
 subdir('usb')
 subdir('vfio')
+subdir('vfio-user')
 subdir('virtio')
 subdir('vmapple')
 subdir('watchdog')
diff --git a/hw/vfio-user/Kconfig b/hw/vfio-user/Kconfig
new file mode 100644
index 0000000000..24bdf7af90
--- /dev/null
+++ b/hw/vfio-user/Kconfig
@@ -0,0 +1,7 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+config VFIO_USER
+    bool
+    default y
+    depends on VFIO_PCI
+
diff --git a/hw/vfio-user/container.c b/hw/vfio-user/container.c
new file mode 100644
index 0000000000..2367332177
--- /dev/null
+++ b/hw/vfio-user/container.c
@@ -0,0 +1,208 @@
+/*
+ * Container for vfio-user IOMMU type: rather than communicating with the kernel
+ * vfio driver, we communicate over a socket to a server using the vfio-user
+ * protocol.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include <sys/ioctl.h>
+#include <linux/vfio.h>
+#include "qemu/osdep.h"
+
+#include "hw/vfio-user/container.h"
+#include "hw/vfio/vfio-cpr.h"
+#include "hw/vfio/vfio-device.h"
+#include "hw/vfio/vfio-listener.h"
+#include "qapi/error.h"
+
+static int vfio_user_dma_unmap(const VFIOContainerBase *bcontainer,
+                               hwaddr iova, ram_addr_t size,
+                               IOMMUTLBEntry *iotlb, bool unmap_all)
+{
+    return -ENOTSUP;
+}
+
+static int vfio_user_dma_map(const VFIOContainerBase *bcontainer, hwaddr iova,
+                             ram_addr_t size, void *vaddr, bool readonly,
+                             MemoryRegion *mrp)
+{
+    return -ENOTSUP;
+}
+
+static int
+vfio_user_set_dirty_page_tracking(const VFIOContainerBase *bcontainer,
+                                    bool start, Error **errp)
+{
+    error_setg_errno(errp, ENOTSUP, "Not supported");
+    return -ENOTSUP;
+}
+
+static int vfio_user_query_dirty_bitmap(const VFIOContainerBase *bcontainer,
+                                         VFIOBitmap *vbmap, hwaddr iova,
+                                         hwaddr size, Error **errp)
+{
+    error_setg_errno(errp, ENOTSUP, "Not supported");
+    return -ENOTSUP;
+}
+
+static bool vfio_user_setup(VFIOContainerBase *bcontainer, Error **errp)
+{
+    error_setg_errno(errp, ENOTSUP, "Not supported");
+    return -ENOTSUP;
+}
+
+static VFIOUserContainer *vfio_user_create_container(Error **errp)
+{
+    VFIOUserContainer *container;
+
+    container = VFIO_IOMMU_USER(object_new(TYPE_VFIO_IOMMU_USER));
+    return container;
+}
+
+/*
+ * Try to mirror vfio_container_connect() as much as possible.
+ */
+static VFIOUserContainer *
+vfio_user_container_connect(AddressSpace *as, Error **errp)
+{
+    VFIOContainerBase *bcontainer;
+    VFIOUserContainer *container;
+    VFIOAddressSpace *space;
+    VFIOIOMMUClass *vioc;
+
+    space = vfio_address_space_get(as);
+
+    container = vfio_user_create_container(errp);
+    if (!container) {
+        goto put_space_exit;
+    }
+
+    bcontainer = &container->bcontainer;
+
+    if (!vfio_cpr_register_container(bcontainer, errp)) {
+        goto free_container_exit;
+    }
+
+    vioc = VFIO_IOMMU_GET_CLASS(bcontainer);
+    assert(vioc->setup);
+
+    if (!vioc->setup(bcontainer, errp)) {
+        goto unregister_container_exit;
+    }
+
+    vfio_address_space_insert(space, bcontainer);
+
+    if (!vfio_listener_register(bcontainer, errp)) {
+        goto listener_release_exit;
+    }
+
+    bcontainer->initialized = true;
+
+    return container;
+
+listener_release_exit:
+    vfio_listener_unregister(bcontainer);
+    if (vioc->release) {
+        vioc->release(bcontainer);
+    }
+
+unregister_container_exit:
+    vfio_cpr_unregister_container(bcontainer);
+
+free_container_exit:
+    object_unref(container);
+
+put_space_exit:
+    vfio_address_space_put(space);
+
+    return NULL;
+}
+
+static void vfio_user_container_disconnect(VFIOUserContainer *container)
+{
+    VFIOContainerBase *bcontainer = &container->bcontainer;
+    VFIOIOMMUClass *vioc = VFIO_IOMMU_GET_CLASS(bcontainer);
+
+    vfio_listener_unregister(bcontainer);
+    if (vioc->release) {
+        vioc->release(bcontainer);
+    }
+
+    VFIOAddressSpace *space = bcontainer->space;
+
+    vfio_cpr_unregister_container(bcontainer);
+    object_unref(container);
+
+    vfio_address_space_put(space);
+}
+
+static bool vfio_user_device_get(VFIOUserContainer *container,
+                                 VFIODevice *vbasedev, Error **errp)
+{
+    struct vfio_device_info info = { 0 };
+
+    vbasedev->fd = -1;
+
+    vfio_device_prepare(vbasedev, &container->bcontainer, &info);
+
+    return true;
+}
+
+/*
+ * vfio_user_device_attach: attach a device to a new container.
+ */
+static bool vfio_user_device_attach(const char *name, VFIODevice *vbasedev,
+                                    AddressSpace *as, Error **errp)
+{
+    VFIOUserContainer *container;
+
+    container = vfio_user_container_connect(as, errp);
+    if (container == NULL) {
+        error_prepend(errp, "failed to connect proxy");
+        return false;
+    }
+
+    return vfio_user_device_get(container, vbasedev, errp);
+}
+
+static void vfio_user_device_detach(VFIODevice *vbasedev)
+{
+    VFIOUserContainer *container = container_of(vbasedev->bcontainer,
+                                                VFIOUserContainer, bcontainer);
+
+    vfio_device_unprepare(vbasedev);
+
+    vfio_user_container_disconnect(container);
+}
+
+static int vfio_user_pci_hot_reset(VFIODevice *vbasedev, bool single)
+{
+    /* ->needs_reset is always false for vfio-user. */
+    return 0;
+}
+
+static void vfio_iommu_user_class_init(ObjectClass *klass, const void *data)
+{
+    VFIOIOMMUClass *vioc = VFIO_IOMMU_CLASS(klass);
+
+    vioc->setup = vfio_user_setup;
+    vioc->dma_map = vfio_user_dma_map;
+    vioc->dma_unmap = vfio_user_dma_unmap;
+    vioc->attach_device = vfio_user_device_attach;
+    vioc->detach_device = vfio_user_device_detach;
+    vioc->set_dirty_page_tracking = vfio_user_set_dirty_page_tracking;
+    vioc->query_dirty_bitmap = vfio_user_query_dirty_bitmap;
+    vioc->pci_hot_reset = vfio_user_pci_hot_reset;
+};
+
+static const TypeInfo types[] = {
+    {
+        .name = TYPE_VFIO_IOMMU_USER,
+        .parent = TYPE_VFIO_IOMMU,
+        .instance_size = sizeof(VFIOUserContainer),
+        .class_init = vfio_iommu_user_class_init,
+    },
+};
+
+DEFINE_TYPES(types)
diff --git a/hw/vfio-user/container.h b/hw/vfio-user/container.h
new file mode 100644
index 0000000000..e4a46d2c1b
--- /dev/null
+++ b/hw/vfio-user/container.h
@@ -0,0 +1,21 @@
+/*
+ * vfio-user specific definitions.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef HW_VFIO_USER_CONTAINER_H
+#define HW_VFIO_USER_CONTAINER_H
+
+#include "qemu/osdep.h"
+
+#include "hw/vfio/vfio-container-base.h"
+
+/* MMU container sub-class for vfio-user. */
+typedef struct VFIOUserContainer {
+    VFIOContainerBase bcontainer;
+} VFIOUserContainer;
+
+OBJECT_DECLARE_SIMPLE_TYPE(VFIOUserContainer, VFIO_IOMMU_USER);
+
+#endif /* HW_VFIO_USER_CONTAINER_H */
diff --git a/hw/vfio-user/meson.build b/hw/vfio-user/meson.build
new file mode 100644
index 0000000000..b82c558252
--- /dev/null
+++ b/hw/vfio-user/meson.build
@@ -0,0 +1,9 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+vfio_user_ss = ss.source_set()
+vfio_user_ss.add(files(
+  'container.c',
+  'pci.c',
+))
+
+system_ss.add_all(when: 'CONFIG_VFIO_USER', if_true: vfio_user_ss)
diff --git a/hw/vfio-user/pci.c b/hw/vfio-user/pci.c
new file mode 100644
index 0000000000..86d7055747
--- /dev/null
+++ b/hw/vfio-user/pci.c
@@ -0,0 +1,185 @@
+/*
+ * vfio PCI device over a UNIX socket.
+ *
+ * Copyright © 2018, 2021 Oracle and/or its affiliates.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include <sys/ioctl.h>
+#include "qemu/osdep.h"
+#include "qapi-visit-sockets.h"
+
+#include "hw/qdev-properties.h"
+#include "hw/vfio/pci.h"
+
+#define TYPE_VFIO_USER_PCI "vfio-user-pci"
+OBJECT_DECLARE_SIMPLE_TYPE(VFIOUserPCIDevice, VFIO_USER_PCI)
+
+struct VFIOUserPCIDevice {
+    VFIOPCIDevice device;
+    SocketAddress *socket;
+};
+
+/*
+ * Emulated devices don't use host hot reset
+ */
+static void vfio_user_compute_needs_reset(VFIODevice *vbasedev)
+{
+    vbasedev->needs_reset = false;
+}
+
+static Object *vfio_user_pci_get_object(VFIODevice *vbasedev)
+{
+    VFIOUserPCIDevice *vdev = container_of(vbasedev, VFIOUserPCIDevice,
+                                           device.vbasedev);
+
+    return OBJECT(vdev);
+}
+
+static VFIODeviceOps vfio_user_pci_ops = {
+    .vfio_compute_needs_reset = vfio_user_compute_needs_reset,
+    .vfio_eoi = vfio_pci_intx_eoi,
+    .vfio_get_object = vfio_user_pci_get_object,
+    /* No live migration support yet. */
+    .vfio_save_config = NULL,
+    .vfio_load_config = NULL,
+};
+
+static void vfio_user_pci_realize(PCIDevice *pdev, Error **errp)
+{
+    ERRP_GUARD();
+    VFIOUserPCIDevice *udev = VFIO_USER_PCI(pdev);
+    VFIOPCIDevice *vdev = VFIO_PCI_BASE(pdev);
+    VFIODevice *vbasedev = &vdev->vbasedev;
+    const char *sock_name;
+    AddressSpace *as;
+
+    if (!udev->socket) {
+        error_setg(errp, "No socket specified");
+        error_append_hint(errp, "e.g. -device '{"
+            "\"driver\":\"vfio-user-pci\", "
+            "\"socket\": {\"path\": \"/tmp/vfio-user.sock\", "
+            "\"type\": \"unix\"}'"
+            "}'\n");
+        return;
+    }
+
+    sock_name = udev->socket->u.q_unix.path;
+
+    vbasedev->name = g_strdup_printf("vfio-user:%s", sock_name);
+
+    /*
+     * vfio-user devices are effectively mdevs (don't use a host iommu).
+     */
+    vbasedev->mdev = true;
+
+    as = pci_device_iommu_address_space(pdev);
+    if (!vfio_device_attach_by_iommu_type(TYPE_VFIO_IOMMU_USER,
+                                          vbasedev->name, vbasedev,
+                                          as, errp)) {
+        error_prepend(errp, VFIO_MSG_PREFIX, vbasedev->name);
+        return;
+    }
+}
+
+static void vfio_user_instance_init(Object *obj)
+{
+    PCIDevice *pci_dev = PCI_DEVICE(obj);
+    VFIOPCIDevice *vdev = VFIO_PCI_BASE(obj);
+    VFIODevice *vbasedev = &vdev->vbasedev;
+
+    device_add_bootindex_property(obj, &vdev->bootindex,
+                                  "bootindex", NULL,
+                                  &pci_dev->qdev);
+    vdev->host.domain = ~0U;
+    vdev->host.bus = ~0U;
+    vdev->host.slot = ~0U;
+    vdev->host.function = ~0U;
+
+    vfio_device_init(vbasedev, VFIO_DEVICE_TYPE_PCI, &vfio_user_pci_ops,
+                     DEVICE(vdev), false);
+
+    vdev->nv_gpudirect_clique = 0xFF;
+
+    /*
+     * QEMU_PCI_CAP_EXPRESS initialization does not depend on QEMU command
+     * line, therefore, no need to wait to realize like other devices.
+     */
+    pci_dev->cap_present |= QEMU_PCI_CAP_EXPRESS;
+}
+
+static void vfio_user_instance_finalize(Object *obj)
+{
+    VFIOPCIDevice *vdev = VFIO_PCI_BASE(obj);
+
+    vfio_pci_put_device(vdev);
+}
+
+static const Property vfio_user_pci_dev_properties[] = {
+    DEFINE_PROP_UINT32("x-pci-vendor-id", VFIOPCIDevice,
+                       vendor_id, PCI_ANY_ID),
+    DEFINE_PROP_UINT32("x-pci-device-id", VFIOPCIDevice,
+                       device_id, PCI_ANY_ID),
+    DEFINE_PROP_UINT32("x-pci-sub-vendor-id", VFIOPCIDevice,
+                       sub_vendor_id, PCI_ANY_ID),
+    DEFINE_PROP_UINT32("x-pci-sub-device-id", VFIOPCIDevice,
+                       sub_device_id, PCI_ANY_ID),
+};
+
+static void vfio_user_pci_set_socket(Object *obj, Visitor *v, const char *name,
+                                     void *opaque, Error **errp)
+{
+    VFIOUserPCIDevice *udev = VFIO_USER_PCI(obj);
+    bool success;
+
+    qapi_free_SocketAddress(udev->socket);
+
+    udev->socket = NULL;
+
+    success = visit_type_SocketAddress(v, name, &udev->socket, errp);
+
+    if (!success) {
+        return;
+    }
+
+    if (udev->socket->type != SOCKET_ADDRESS_TYPE_UNIX) {
+        error_setg(errp, "Unsupported socket type %s",
+                   SocketAddressType_str(udev->socket->type));
+        qapi_free_SocketAddress(udev->socket);
+        udev->socket = NULL;
+        return;
+    }
+}
+
+static void vfio_user_pci_dev_class_init(ObjectClass *klass, const void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    PCIDeviceClass *pdc = PCI_DEVICE_CLASS(klass);
+
+    device_class_set_props(dc, vfio_user_pci_dev_properties);
+
+    object_class_property_add(klass, "socket", "SocketAddress", NULL,
+                              vfio_user_pci_set_socket, NULL, NULL);
+    object_class_property_set_description(klass, "socket",
+                                          "SocketAddress (UNIX sockets only)");
+
+    dc->desc = "VFIO over socket PCI device assignment";
+    pdc->realize = vfio_user_pci_realize;
+}
+
+static const TypeInfo vfio_user_pci_dev_info = {
+    .name = TYPE_VFIO_USER_PCI,
+    .parent = TYPE_VFIO_PCI_BASE,
+    .instance_size = sizeof(VFIOUserPCIDevice),
+    .class_init = vfio_user_pci_dev_class_init,
+    .instance_init = vfio_user_instance_init,
+    .instance_finalize = vfio_user_instance_finalize,
+};
+
+static void register_vfio_user_dev_type(void)
+{
+    type_register_static(&vfio_user_pci_dev_info);
+}
+
+ type_init(register_vfio_user_dev_type)
diff --git a/include/hw/vfio/vfio-container-base.h b/include/hw/vfio/vfio-container-base.h
index f0232654ee..3cd86ec59e 100644
--- a/include/hw/vfio/vfio-container-base.h
+++ b/include/hw/vfio/vfio-container-base.h
@@ -109,6 +109,7 @@ vfio_container_get_page_size_mask(const VFIOContainerBase *bcontainer)
 #define TYPE_VFIO_IOMMU_LEGACY TYPE_VFIO_IOMMU "-legacy"
 #define TYPE_VFIO_IOMMU_SPAPR TYPE_VFIO_IOMMU "-spapr"
 #define TYPE_VFIO_IOMMU_IOMMUFD TYPE_VFIO_IOMMU "-iommufd"
+#define TYPE_VFIO_IOMMU_USER TYPE_VFIO_IOMMU "-user"
 
 OBJECT_DECLARE_TYPE(VFIOContainerBase, VFIOIOMMUClass, VFIO_IOMMU)
 

From 438d863f1f40fbc2b57bf94cc6c998a6445c0932 Mon Sep 17 00:00:00 2001
From: John Levon <john.levon@nutanix.com>
Date: Wed, 25 Jun 2025 20:29:54 +0100
Subject: [PATCH 1675/2760] vfio-user: connect vfio proxy to remote server
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Introduce the vfio-user "proxy": this is the client code responsible for
sending and receiving vfio-user messages across the control socket.

The new files hw/vfio-user/proxy.[ch] contain some basic plumbing for
managing the proxy; initialize the proxy during realization of the
VFIOUserPCIDevice instance.

Originally-by: John Johnson <john.g.johnson@oracle.com>
Signed-off-by: Elena Ufimtseva <elena.ufimtseva@oracle.com>
Signed-off-by: Jagannathan Raman <jag.raman@oracle.com>
Signed-off-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250625193012.2316242-3-john.levon@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio-user/meson.build      |   1 +
 hw/vfio-user/pci.c            |  22 +++++
 hw/vfio-user/proxy.c          | 162 ++++++++++++++++++++++++++++++++++
 hw/vfio-user/proxy.h          |  79 +++++++++++++++++
 include/hw/vfio/vfio-device.h |   2 +
 5 files changed, 266 insertions(+)
 create mode 100644 hw/vfio-user/proxy.c
 create mode 100644 hw/vfio-user/proxy.h

diff --git a/hw/vfio-user/meson.build b/hw/vfio-user/meson.build
index b82c558252..9e85a8ea51 100644
--- a/hw/vfio-user/meson.build
+++ b/hw/vfio-user/meson.build
@@ -4,6 +4,7 @@ vfio_user_ss = ss.source_set()
 vfio_user_ss.add(files(
   'container.c',
   'pci.c',
+  'proxy.c',
 ))
 
 system_ss.add_all(when: 'CONFIG_VFIO_USER', if_true: vfio_user_ss)
diff --git a/hw/vfio-user/pci.c b/hw/vfio-user/pci.c
index 86d7055747..642421e791 100644
--- a/hw/vfio-user/pci.c
+++ b/hw/vfio-user/pci.c
@@ -12,6 +12,7 @@
 
 #include "hw/qdev-properties.h"
 #include "hw/vfio/pci.h"
+#include "hw/vfio-user/proxy.h"
 
 #define TYPE_VFIO_USER_PCI "vfio-user-pci"
 OBJECT_DECLARE_SIMPLE_TYPE(VFIOUserPCIDevice, VFIO_USER_PCI)
@@ -54,6 +55,8 @@ static void vfio_user_pci_realize(PCIDevice *pdev, Error **errp)
     VFIODevice *vbasedev = &vdev->vbasedev;
     const char *sock_name;
     AddressSpace *as;
+    SocketAddress addr;
+    VFIOUserProxy *proxy;
 
     if (!udev->socket) {
         error_setg(errp, "No socket specified");
@@ -69,6 +72,15 @@ static void vfio_user_pci_realize(PCIDevice *pdev, Error **errp)
 
     vbasedev->name = g_strdup_printf("vfio-user:%s", sock_name);
 
+    memset(&addr, 0, sizeof(addr));
+    addr.type = SOCKET_ADDRESS_TYPE_UNIX;
+    addr.u.q_unix.path = (char *)sock_name;
+    proxy = vfio_user_connect_dev(&addr, errp);
+    if (!proxy) {
+        return;
+    }
+    vbasedev->proxy = proxy;
+
     /*
      * vfio-user devices are effectively mdevs (don't use a host iommu).
      */
@@ -112,8 +124,13 @@ static void vfio_user_instance_init(Object *obj)
 static void vfio_user_instance_finalize(Object *obj)
 {
     VFIOPCIDevice *vdev = VFIO_PCI_BASE(obj);
+    VFIODevice *vbasedev = &vdev->vbasedev;
 
     vfio_pci_put_device(vdev);
+
+    if (vbasedev->proxy != NULL) {
+        vfio_user_disconnect(vbasedev->proxy);
+    }
 }
 
 static const Property vfio_user_pci_dev_properties[] = {
@@ -133,6 +150,11 @@ static void vfio_user_pci_set_socket(Object *obj, Visitor *v, const char *name,
     VFIOUserPCIDevice *udev = VFIO_USER_PCI(obj);
     bool success;
 
+    if (udev->device.vbasedev.proxy) {
+        error_setg(errp, "Proxy is connected");
+        return;
+    }
+
     qapi_free_SocketAddress(udev->socket);
 
     udev->socket = NULL;
diff --git a/hw/vfio-user/proxy.c b/hw/vfio-user/proxy.c
new file mode 100644
index 0000000000..bb436c9db9
--- /dev/null
+++ b/hw/vfio-user/proxy.c
@@ -0,0 +1,162 @@
+/*
+ * vfio protocol over a UNIX socket.
+ *
+ * Copyright © 2018, 2021 Oracle and/or its affiliates.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include <sys/ioctl.h>
+
+#include "hw/vfio/vfio-device.h"
+#include "hw/vfio-user/proxy.h"
+#include "qapi/error.h"
+#include "qemu/error-report.h"
+#include "qemu/lockable.h"
+#include "system/iothread.h"
+
+static IOThread *vfio_user_iothread;
+
+static void vfio_user_shutdown(VFIOUserProxy *proxy);
+
+
+/*
+ * Functions called by main, CPU, or iothread threads
+ */
+
+static void vfio_user_shutdown(VFIOUserProxy *proxy)
+{
+    qio_channel_shutdown(proxy->ioc, QIO_CHANNEL_SHUTDOWN_READ, NULL);
+    qio_channel_set_aio_fd_handler(proxy->ioc, proxy->ctx, NULL,
+                                   proxy->ctx, NULL, NULL);
+}
+
+/*
+ * Functions only called by iothread
+ */
+
+static void vfio_user_cb(void *opaque)
+{
+    VFIOUserProxy *proxy = opaque;
+
+    QEMU_LOCK_GUARD(&proxy->lock);
+
+    proxy->state = VFIO_PROXY_CLOSED;
+    qemu_cond_signal(&proxy->close_cv);
+}
+
+
+/*
+ * Functions called by main or CPU threads
+ */
+
+static QLIST_HEAD(, VFIOUserProxy) vfio_user_sockets =
+    QLIST_HEAD_INITIALIZER(vfio_user_sockets);
+
+VFIOUserProxy *vfio_user_connect_dev(SocketAddress *addr, Error **errp)
+{
+    VFIOUserProxy *proxy;
+    QIOChannelSocket *sioc;
+    QIOChannel *ioc;
+    char *sockname;
+
+    if (addr->type != SOCKET_ADDRESS_TYPE_UNIX) {
+        error_setg(errp, "vfio_user_connect - bad address family");
+        return NULL;
+    }
+    sockname = addr->u.q_unix.path;
+
+    sioc = qio_channel_socket_new();
+    ioc = QIO_CHANNEL(sioc);
+    if (qio_channel_socket_connect_sync(sioc, addr, errp)) {
+        object_unref(OBJECT(ioc));
+        return NULL;
+    }
+    qio_channel_set_blocking(ioc, false, NULL);
+
+    proxy = g_malloc0(sizeof(VFIOUserProxy));
+    proxy->sockname = g_strdup_printf("unix:%s", sockname);
+    proxy->ioc = ioc;
+    proxy->flags = VFIO_PROXY_CLIENT;
+    proxy->state = VFIO_PROXY_CONNECTED;
+
+    qemu_mutex_init(&proxy->lock);
+    qemu_cond_init(&proxy->close_cv);
+
+    if (vfio_user_iothread == NULL) {
+        vfio_user_iothread = iothread_create("VFIO user", errp);
+    }
+
+    proxy->ctx = iothread_get_aio_context(vfio_user_iothread);
+
+    QTAILQ_INIT(&proxy->outgoing);
+    QTAILQ_INIT(&proxy->incoming);
+    QTAILQ_INIT(&proxy->free);
+    QTAILQ_INIT(&proxy->pending);
+    QLIST_INSERT_HEAD(&vfio_user_sockets, proxy, next);
+
+    return proxy;
+}
+
+void vfio_user_disconnect(VFIOUserProxy *proxy)
+{
+    VFIOUserMsg *r1, *r2;
+
+    qemu_mutex_lock(&proxy->lock);
+
+    /* our side is quitting */
+    if (proxy->state == VFIO_PROXY_CONNECTED) {
+        vfio_user_shutdown(proxy);
+        if (!QTAILQ_EMPTY(&proxy->pending)) {
+            error_printf("vfio_user_disconnect: outstanding requests\n");
+        }
+    }
+    object_unref(OBJECT(proxy->ioc));
+    proxy->ioc = NULL;
+
+    proxy->state = VFIO_PROXY_CLOSING;
+    QTAILQ_FOREACH_SAFE(r1, &proxy->outgoing, next, r2) {
+        qemu_cond_destroy(&r1->cv);
+        QTAILQ_REMOVE(&proxy->outgoing, r1, next);
+        g_free(r1);
+    }
+    QTAILQ_FOREACH_SAFE(r1, &proxy->incoming, next, r2) {
+        qemu_cond_destroy(&r1->cv);
+        QTAILQ_REMOVE(&proxy->incoming, r1, next);
+        g_free(r1);
+    }
+    QTAILQ_FOREACH_SAFE(r1, &proxy->pending, next, r2) {
+        qemu_cond_destroy(&r1->cv);
+        QTAILQ_REMOVE(&proxy->pending, r1, next);
+        g_free(r1);
+    }
+    QTAILQ_FOREACH_SAFE(r1, &proxy->free, next, r2) {
+        qemu_cond_destroy(&r1->cv);
+        QTAILQ_REMOVE(&proxy->free, r1, next);
+        g_free(r1);
+    }
+
+    /*
+     * Make sure the iothread isn't blocking anywhere
+     * with a ref to this proxy by waiting for a BH
+     * handler to run after the proxy fd handlers were
+     * deleted above.
+     */
+    aio_bh_schedule_oneshot(proxy->ctx, vfio_user_cb, proxy);
+    qemu_cond_wait(&proxy->close_cv, &proxy->lock);
+
+    /* we now hold the only ref to proxy */
+    qemu_mutex_unlock(&proxy->lock);
+    qemu_cond_destroy(&proxy->close_cv);
+    qemu_mutex_destroy(&proxy->lock);
+
+    QLIST_REMOVE(proxy, next);
+    if (QLIST_EMPTY(&vfio_user_sockets)) {
+        iothread_destroy(vfio_user_iothread);
+        vfio_user_iothread = NULL;
+    }
+
+    g_free(proxy->sockname);
+    g_free(proxy);
+}
diff --git a/hw/vfio-user/proxy.h b/hw/vfio-user/proxy.h
new file mode 100644
index 0000000000..a9bce82239
--- /dev/null
+++ b/hw/vfio-user/proxy.h
@@ -0,0 +1,79 @@
+#ifndef VFIO_USER_PROXY_H
+#define VFIO_USER_PROXY_H
+
+/*
+ * vfio protocol over a UNIX socket.
+ *
+ * Copyright © 2018, 2021 Oracle and/or its affiliates.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "io/channel.h"
+#include "io/channel-socket.h"
+
+typedef struct {
+    int send_fds;
+    int recv_fds;
+    int *fds;
+} VFIOUserFDs;
+
+enum msg_type {
+    VFIO_MSG_NONE,
+    VFIO_MSG_ASYNC,
+    VFIO_MSG_WAIT,
+    VFIO_MSG_NOWAIT,
+    VFIO_MSG_REQ,
+};
+
+typedef struct VFIOUserMsg {
+    QTAILQ_ENTRY(VFIOUserMsg) next;
+    VFIOUserFDs *fds;
+    uint32_t rsize;
+    uint32_t id;
+    QemuCond cv;
+    bool complete;
+    enum msg_type type;
+} VFIOUserMsg;
+
+
+enum proxy_state {
+    VFIO_PROXY_CONNECTED = 1,
+    VFIO_PROXY_ERROR = 2,
+    VFIO_PROXY_CLOSING = 3,
+    VFIO_PROXY_CLOSED = 4,
+};
+
+typedef QTAILQ_HEAD(VFIOUserMsgQ, VFIOUserMsg) VFIOUserMsgQ;
+
+typedef struct VFIOUserProxy {
+    QLIST_ENTRY(VFIOUserProxy) next;
+    char *sockname;
+    struct QIOChannel *ioc;
+    void (*request)(void *opaque, VFIOUserMsg *msg);
+    void *req_arg;
+    int flags;
+    QemuCond close_cv;
+    AioContext *ctx;
+    QEMUBH *req_bh;
+
+    /*
+     * above only changed when BQL is held
+     * below are protected by per-proxy lock
+     */
+    QemuMutex lock;
+    VFIOUserMsgQ free;
+    VFIOUserMsgQ pending;
+    VFIOUserMsgQ incoming;
+    VFIOUserMsgQ outgoing;
+    VFIOUserMsg *last_nowait;
+    enum proxy_state state;
+} VFIOUserProxy;
+
+/* VFIOProxy flags */
+#define VFIO_PROXY_CLIENT        0x1
+
+VFIOUserProxy *vfio_user_connect_dev(SocketAddress *addr, Error **errp);
+void vfio_user_disconnect(VFIOUserProxy *proxy);
+
+#endif /* VFIO_USER_PROXY_H */
diff --git a/include/hw/vfio/vfio-device.h b/include/hw/vfio/vfio-device.h
index 959e458d7f..c616652ee7 100644
--- a/include/hw/vfio/vfio-device.h
+++ b/include/hw/vfio/vfio-device.h
@@ -47,6 +47,7 @@ typedef struct VFIOMigration VFIOMigration;
 
 typedef struct IOMMUFDBackend IOMMUFDBackend;
 typedef struct VFIOIOASHwpt VFIOIOASHwpt;
+typedef struct VFIOUserProxy VFIOUserProxy;
 
 typedef struct VFIODevice {
     QLIST_ENTRY(VFIODevice) next;
@@ -88,6 +89,7 @@ typedef struct VFIODevice {
     struct vfio_region_info **reginfo;
     int *region_fds;
     VFIODeviceCPR cpr;
+    VFIOUserProxy *proxy;
 } VFIODevice;
 
 struct VFIODeviceOps {

From 0b3d881a061b284a3db00d7fe9d33581fb424287 Mon Sep 17 00:00:00 2001
From: John Levon <john.levon@nutanix.com>
Date: Wed, 25 Jun 2025 20:29:55 +0100
Subject: [PATCH 1676/2760] vfio-user: implement message receive infrastructure
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add the basic implementation for receiving vfio-user messages from the
control socket.

Originally-by: John Johnson <john.g.johnson@oracle.com>
Signed-off-by: Elena Ufimtseva <elena.ufimtseva@oracle.com>
Signed-off-by: Jagannathan Raman <jag.raman@oracle.com>
Signed-off-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250625193012.2316242-4-john.levon@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio-user/pci.c        |  11 +
 hw/vfio-user/protocol.h   |  53 +++++
 hw/vfio-user/proxy.c      | 411 ++++++++++++++++++++++++++++++++++++++
 hw/vfio-user/proxy.h      |  11 +
 hw/vfio-user/trace-events |   8 +
 hw/vfio-user/trace.h      |   4 +
 meson.build               |   1 +
 7 files changed, 499 insertions(+)
 create mode 100644 hw/vfio-user/protocol.h
 create mode 100644 hw/vfio-user/trace-events
 create mode 100644 hw/vfio-user/trace.h

diff --git a/hw/vfio-user/pci.c b/hw/vfio-user/pci.c
index 642421e791..bad2829f5c 100644
--- a/hw/vfio-user/pci.c
+++ b/hw/vfio-user/pci.c
@@ -22,6 +22,16 @@ struct VFIOUserPCIDevice {
     SocketAddress *socket;
 };
 
+/*
+ * Incoming request message callback.
+ *
+ * Runs off main loop, so BQL held.
+ */
+static void vfio_user_pci_process_req(void *opaque, VFIOUserMsg *msg)
+{
+
+}
+
 /*
  * Emulated devices don't use host hot reset
  */
@@ -80,6 +90,7 @@ static void vfio_user_pci_realize(PCIDevice *pdev, Error **errp)
         return;
     }
     vbasedev->proxy = proxy;
+    vfio_user_set_handler(vbasedev, vfio_user_pci_process_req, vdev);
 
     /*
      * vfio-user devices are effectively mdevs (don't use a host iommu).
diff --git a/hw/vfio-user/protocol.h b/hw/vfio-user/protocol.h
new file mode 100644
index 0000000000..4ddfb5f222
--- /dev/null
+++ b/hw/vfio-user/protocol.h
@@ -0,0 +1,53 @@
+#ifndef VFIO_USER_PROTOCOL_H
+#define VFIO_USER_PROTOCOL_H
+
+/*
+ * vfio protocol over a UNIX socket.
+ *
+ * Copyright © 2018, 2021 Oracle and/or its affiliates.
+ *
+ * Each message has a standard header that describes the command
+ * being sent, which is almost always a VFIO ioctl().
+ *
+ * The header may be followed by command-specific data, such as the
+ * region and offset info for read and write commands.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+typedef struct {
+    uint16_t id;
+    uint16_t command;
+    uint32_t size;
+    uint32_t flags;
+    uint32_t error_reply;
+} VFIOUserHdr;
+
+/* VFIOUserHdr commands */
+enum vfio_user_command {
+    VFIO_USER_VERSION                   = 1,
+    VFIO_USER_DMA_MAP                   = 2,
+    VFIO_USER_DMA_UNMAP                 = 3,
+    VFIO_USER_DEVICE_GET_INFO           = 4,
+    VFIO_USER_DEVICE_GET_REGION_INFO    = 5,
+    VFIO_USER_DEVICE_GET_REGION_IO_FDS  = 6,
+    VFIO_USER_DEVICE_GET_IRQ_INFO       = 7,
+    VFIO_USER_DEVICE_SET_IRQS           = 8,
+    VFIO_USER_REGION_READ               = 9,
+    VFIO_USER_REGION_WRITE              = 10,
+    VFIO_USER_DMA_READ                  = 11,
+    VFIO_USER_DMA_WRITE                 = 12,
+    VFIO_USER_DEVICE_RESET              = 13,
+    VFIO_USER_DIRTY_PAGES               = 14,
+    VFIO_USER_MAX,
+};
+
+/* VFIOUserHdr flags */
+#define VFIO_USER_REQUEST       0x0
+#define VFIO_USER_REPLY         0x1
+#define VFIO_USER_TYPE          0xF
+
+#define VFIO_USER_NO_REPLY      0x10
+#define VFIO_USER_ERROR         0x20
+
+#endif /* VFIO_USER_PROTOCOL_H */
diff --git a/hw/vfio-user/proxy.c b/hw/vfio-user/proxy.c
index bb436c9db9..349ea2b27c 100644
--- a/hw/vfio-user/proxy.c
+++ b/hw/vfio-user/proxy.c
@@ -11,15 +11,31 @@
 
 #include "hw/vfio/vfio-device.h"
 #include "hw/vfio-user/proxy.h"
+#include "hw/vfio-user/trace.h"
 #include "qapi/error.h"
 #include "qemu/error-report.h"
 #include "qemu/lockable.h"
+#include "qemu/main-loop.h"
 #include "system/iothread.h"
 
 static IOThread *vfio_user_iothread;
 
 static void vfio_user_shutdown(VFIOUserProxy *proxy);
+static VFIOUserMsg *vfio_user_getmsg(VFIOUserProxy *proxy, VFIOUserHdr *hdr,
+                                     VFIOUserFDs *fds);
+static VFIOUserFDs *vfio_user_getfds(int numfds);
+static void vfio_user_recycle(VFIOUserProxy *proxy, VFIOUserMsg *msg);
 
+static void vfio_user_recv(void *opaque);
+static void vfio_user_cb(void *opaque);
+
+static void vfio_user_request(void *opaque);
+
+static inline void vfio_user_set_error(VFIOUserHdr *hdr, uint32_t err)
+{
+    hdr->flags |= VFIO_USER_ERROR;
+    hdr->error_reply = err;
+}
 
 /*
  * Functions called by main, CPU, or iothread threads
@@ -32,10 +48,343 @@ static void vfio_user_shutdown(VFIOUserProxy *proxy)
                                    proxy->ctx, NULL, NULL);
 }
 
+static VFIOUserMsg *vfio_user_getmsg(VFIOUserProxy *proxy, VFIOUserHdr *hdr,
+                                     VFIOUserFDs *fds)
+{
+    VFIOUserMsg *msg;
+
+    msg = QTAILQ_FIRST(&proxy->free);
+    if (msg != NULL) {
+        QTAILQ_REMOVE(&proxy->free, msg, next);
+    } else {
+        msg = g_malloc0(sizeof(*msg));
+        qemu_cond_init(&msg->cv);
+    }
+
+    msg->hdr = hdr;
+    msg->fds = fds;
+    return msg;
+}
+
+/*
+ * Recycle a message list entry to the free list.
+ */
+static void vfio_user_recycle(VFIOUserProxy *proxy, VFIOUserMsg *msg)
+{
+    if (msg->type == VFIO_MSG_NONE) {
+        error_printf("vfio_user_recycle - freeing free msg\n");
+        return;
+    }
+
+    /* free msg buffer if no one is waiting to consume the reply */
+    if (msg->type == VFIO_MSG_NOWAIT || msg->type == VFIO_MSG_ASYNC) {
+        g_free(msg->hdr);
+        if (msg->fds != NULL) {
+            g_free(msg->fds);
+        }
+    }
+
+    msg->type = VFIO_MSG_NONE;
+    msg->hdr = NULL;
+    msg->fds = NULL;
+    msg->complete = false;
+    QTAILQ_INSERT_HEAD(&proxy->free, msg, next);
+}
+
+static VFIOUserFDs *vfio_user_getfds(int numfds)
+{
+    VFIOUserFDs *fds = g_malloc0(sizeof(*fds) + (numfds * sizeof(int)));
+
+    fds->fds = (int *)((char *)fds + sizeof(*fds));
+
+    return fds;
+}
+
 /*
  * Functions only called by iothread
  */
 
+/*
+ * Process a received message.
+ */
+static void vfio_user_process(VFIOUserProxy *proxy, VFIOUserMsg *msg,
+                              bool isreply)
+{
+
+    /*
+     * Replies signal a waiter, if none just check for errors
+     * and free the message buffer.
+     *
+     * Requests get queued for the BH.
+     */
+    if (isreply) {
+        msg->complete = true;
+        if (msg->type == VFIO_MSG_WAIT) {
+            qemu_cond_signal(&msg->cv);
+        } else {
+            if (msg->hdr->flags & VFIO_USER_ERROR) {
+                error_printf("vfio_user_process: error reply on async ");
+                error_printf("request command %x error %s\n",
+                             msg->hdr->command,
+                             strerror(msg->hdr->error_reply));
+            }
+            /* youngest nowait msg has been ack'd */
+            if (proxy->last_nowait == msg) {
+                proxy->last_nowait = NULL;
+            }
+            vfio_user_recycle(proxy, msg);
+        }
+    } else {
+        QTAILQ_INSERT_TAIL(&proxy->incoming, msg, next);
+        qemu_bh_schedule(proxy->req_bh);
+    }
+}
+
+/*
+ * Complete a partial message read
+ */
+static int vfio_user_complete(VFIOUserProxy *proxy, Error **errp)
+{
+    VFIOUserMsg *msg = proxy->part_recv;
+    size_t msgleft = proxy->recv_left;
+    bool isreply;
+    char *data;
+    int ret;
+
+    data = (char *)msg->hdr + (msg->hdr->size - msgleft);
+    while (msgleft > 0) {
+        ret = qio_channel_read(proxy->ioc, data, msgleft, errp);
+
+        /* error or would block */
+        if (ret <= 0) {
+            /* try for rest on next iternation */
+            if (ret == QIO_CHANNEL_ERR_BLOCK) {
+                proxy->recv_left = msgleft;
+            }
+            return ret;
+        }
+        trace_vfio_user_recv_read(msg->hdr->id, ret);
+
+        msgleft -= ret;
+        data += ret;
+    }
+
+    /*
+     * Read complete message, process it.
+     */
+    proxy->part_recv = NULL;
+    proxy->recv_left = 0;
+    isreply = (msg->hdr->flags & VFIO_USER_TYPE) == VFIO_USER_REPLY;
+    vfio_user_process(proxy, msg, isreply);
+
+    /* return positive value */
+    return 1;
+}
+
+/*
+ * Receive and process one incoming message.
+ *
+ * For replies, find matching outgoing request and wake any waiters.
+ * For requests, queue in incoming list and run request BH.
+ */
+static int vfio_user_recv_one(VFIOUserProxy *proxy, Error **errp)
+{
+    VFIOUserMsg *msg = NULL;
+    g_autofree int *fdp = NULL;
+    VFIOUserFDs *reqfds;
+    VFIOUserHdr hdr;
+    struct iovec iov = {
+        .iov_base = &hdr,
+        .iov_len = sizeof(hdr),
+    };
+    bool isreply = false;
+    int i, ret;
+    size_t msgleft, numfds = 0;
+    char *data = NULL;
+    char *buf = NULL;
+
+    /*
+     * Complete any partial reads
+     */
+    if (proxy->part_recv != NULL) {
+        ret = vfio_user_complete(proxy, errp);
+
+        /* still not complete, try later */
+        if (ret == QIO_CHANNEL_ERR_BLOCK) {
+            return ret;
+        }
+
+        if (ret <= 0) {
+            goto fatal;
+        }
+        /* else fall into reading another msg */
+    }
+
+    /*
+     * Read header
+     */
+    ret = qio_channel_readv_full(proxy->ioc, &iov, 1, &fdp, &numfds, 0,
+                                 errp);
+    if (ret == QIO_CHANNEL_ERR_BLOCK) {
+        return ret;
+    }
+
+    /* read error or other side closed connection */
+    if (ret <= 0) {
+        goto fatal;
+    }
+
+    if (ret < sizeof(hdr)) {
+        error_setg(errp, "short read of header");
+        goto fatal;
+    }
+
+    /*
+     * Validate header
+     */
+    if (hdr.size < sizeof(VFIOUserHdr)) {
+        error_setg(errp, "bad header size");
+        goto fatal;
+    }
+    switch (hdr.flags & VFIO_USER_TYPE) {
+    case VFIO_USER_REQUEST:
+        isreply = false;
+        break;
+    case VFIO_USER_REPLY:
+        isreply = true;
+        break;
+    default:
+        error_setg(errp, "unknown message type");
+        goto fatal;
+    }
+    trace_vfio_user_recv_hdr(proxy->sockname, hdr.id, hdr.command, hdr.size,
+                             hdr.flags);
+
+    /*
+     * For replies, find the matching pending request.
+     * For requests, reap incoming FDs.
+     */
+    if (isreply) {
+        QTAILQ_FOREACH(msg, &proxy->pending, next) {
+            if (hdr.id == msg->id) {
+                break;
+            }
+        }
+        if (msg == NULL) {
+            error_setg(errp, "unexpected reply");
+            goto err;
+        }
+        QTAILQ_REMOVE(&proxy->pending, msg, next);
+
+        /*
+         * Process any received FDs
+         */
+        if (numfds != 0) {
+            if (msg->fds == NULL || msg->fds->recv_fds < numfds) {
+                error_setg(errp, "unexpected FDs");
+                goto err;
+            }
+            msg->fds->recv_fds = numfds;
+            memcpy(msg->fds->fds, fdp, numfds * sizeof(int));
+        }
+    } else {
+        if (numfds != 0) {
+            reqfds = vfio_user_getfds(numfds);
+            memcpy(reqfds->fds, fdp, numfds * sizeof(int));
+        } else {
+            reqfds = NULL;
+        }
+    }
+
+    /*
+     * Put the whole message into a single buffer.
+     */
+    if (isreply) {
+        if (hdr.size > msg->rsize) {
+            error_setg(errp, "reply larger than recv buffer");
+            goto err;
+        }
+        *msg->hdr = hdr;
+        data = (char *)msg->hdr + sizeof(hdr);
+    } else {
+        buf = g_malloc0(hdr.size);
+        memcpy(buf, &hdr, sizeof(hdr));
+        data = buf + sizeof(hdr);
+        msg = vfio_user_getmsg(proxy, (VFIOUserHdr *)buf, reqfds);
+        msg->type = VFIO_MSG_REQ;
+    }
+
+    /*
+     * Read rest of message.
+     */
+    msgleft = hdr.size - sizeof(hdr);
+    while (msgleft > 0) {
+        ret = qio_channel_read(proxy->ioc, data, msgleft, errp);
+
+        /* prepare to complete read on next iternation */
+        if (ret == QIO_CHANNEL_ERR_BLOCK) {
+            proxy->part_recv = msg;
+            proxy->recv_left = msgleft;
+            return ret;
+        }
+
+        if (ret <= 0) {
+            goto fatal;
+        }
+        trace_vfio_user_recv_read(hdr.id, ret);
+
+        msgleft -= ret;
+        data += ret;
+    }
+
+    vfio_user_process(proxy, msg, isreply);
+    return 0;
+
+    /*
+     * fatal means the other side closed or we don't trust the stream
+     * err means this message is corrupt
+     */
+fatal:
+    vfio_user_shutdown(proxy);
+    proxy->state = VFIO_PROXY_ERROR;
+
+    /* set error if server side closed */
+    if (ret == 0) {
+        error_setg(errp, "server closed socket");
+    }
+
+err:
+    for (i = 0; i < numfds; i++) {
+        close(fdp[i]);
+    }
+    if (isreply && msg != NULL) {
+        /* force an error to keep sending thread from hanging */
+        vfio_user_set_error(msg->hdr, EINVAL);
+        msg->complete = true;
+        qemu_cond_signal(&msg->cv);
+    }
+    return -1;
+}
+
+static void vfio_user_recv(void *opaque)
+{
+    VFIOUserProxy *proxy = opaque;
+
+    QEMU_LOCK_GUARD(&proxy->lock);
+
+    if (proxy->state == VFIO_PROXY_CONNECTED) {
+        Error *local_err = NULL;
+
+        while (vfio_user_recv_one(proxy, &local_err) == 0) {
+            ;
+        }
+
+        if (local_err != NULL) {
+            error_report_err(local_err);
+        }
+    }
+}
+
 static void vfio_user_cb(void *opaque)
 {
     VFIOUserProxy *proxy = opaque;
@@ -51,6 +400,53 @@ static void vfio_user_cb(void *opaque)
  * Functions called by main or CPU threads
  */
 
+/*
+ * Process incoming requests.
+ *
+ * The bus-specific callback has the form:
+ *    request(opaque, msg)
+ * where 'opaque' was specified in vfio_user_set_handler
+ * and 'msg' is the inbound message.
+ *
+ * The callback is responsible for disposing of the message buffer,
+ * usually by re-using it when calling vfio_send_reply or vfio_send_error,
+ * both of which free their message buffer when the reply is sent.
+ *
+ * If the callback uses a new buffer, it needs to free the old one.
+ */
+static void vfio_user_request(void *opaque)
+{
+    VFIOUserProxy *proxy = opaque;
+    VFIOUserMsgQ new, free;
+    VFIOUserMsg *msg, *m1;
+
+    /* reap all incoming */
+    QTAILQ_INIT(&new);
+    WITH_QEMU_LOCK_GUARD(&proxy->lock) {
+        QTAILQ_FOREACH_SAFE(msg, &proxy->incoming, next, m1) {
+            QTAILQ_REMOVE(&proxy->incoming, msg, next);
+            QTAILQ_INSERT_TAIL(&new, msg, next);
+        }
+    }
+
+    /* process list */
+    QTAILQ_INIT(&free);
+    QTAILQ_FOREACH_SAFE(msg, &new, next, m1) {
+        QTAILQ_REMOVE(&new, msg, next);
+        trace_vfio_user_recv_request(msg->hdr->command);
+        proxy->request(proxy->req_arg, msg);
+        QTAILQ_INSERT_HEAD(&free, msg, next);
+    }
+
+    /* free list */
+    WITH_QEMU_LOCK_GUARD(&proxy->lock) {
+        QTAILQ_FOREACH_SAFE(msg, &free, next, m1) {
+            vfio_user_recycle(proxy, msg);
+        }
+    }
+}
+
+
 static QLIST_HEAD(, VFIOUserProxy) vfio_user_sockets =
     QLIST_HEAD_INITIALIZER(vfio_user_sockets);
 
@@ -89,6 +485,7 @@ VFIOUserProxy *vfio_user_connect_dev(SocketAddress *addr, Error **errp)
     }
 
     proxy->ctx = iothread_get_aio_context(vfio_user_iothread);
+    proxy->req_bh = qemu_bh_new(vfio_user_request, proxy);
 
     QTAILQ_INIT(&proxy->outgoing);
     QTAILQ_INIT(&proxy->incoming);
@@ -99,6 +496,18 @@ VFIOUserProxy *vfio_user_connect_dev(SocketAddress *addr, Error **errp)
     return proxy;
 }
 
+void vfio_user_set_handler(VFIODevice *vbasedev,
+                           void (*handler)(void *opaque, VFIOUserMsg *msg),
+                           void *req_arg)
+{
+    VFIOUserProxy *proxy = vbasedev->proxy;
+
+    proxy->request = handler;
+    proxy->req_arg = req_arg;
+    qio_channel_set_aio_fd_handler(proxy->ioc, proxy->ctx,
+                                   vfio_user_recv, NULL, NULL, proxy);
+}
+
 void vfio_user_disconnect(VFIOUserProxy *proxy)
 {
     VFIOUserMsg *r1, *r2;
@@ -114,6 +523,8 @@ void vfio_user_disconnect(VFIOUserProxy *proxy)
     }
     object_unref(OBJECT(proxy->ioc));
     proxy->ioc = NULL;
+    qemu_bh_delete(proxy->req_bh);
+    proxy->req_bh = NULL;
 
     proxy->state = VFIO_PROXY_CLOSING;
     QTAILQ_FOREACH_SAFE(r1, &proxy->outgoing, next, r2) {
diff --git a/hw/vfio-user/proxy.h b/hw/vfio-user/proxy.h
index a9bce82239..ff553cad9d 100644
--- a/hw/vfio-user/proxy.h
+++ b/hw/vfio-user/proxy.h
@@ -12,6 +12,9 @@
 #include "io/channel.h"
 #include "io/channel-socket.h"
 
+#include "qemu/sockets.h"
+#include "hw/vfio-user/protocol.h"
+
 typedef struct {
     int send_fds;
     int recv_fds;
@@ -28,6 +31,7 @@ enum msg_type {
 
 typedef struct VFIOUserMsg {
     QTAILQ_ENTRY(VFIOUserMsg) next;
+    VFIOUserHdr *hdr;
     VFIOUserFDs *fds;
     uint32_t rsize;
     uint32_t id;
@@ -67,13 +71,20 @@ typedef struct VFIOUserProxy {
     VFIOUserMsgQ incoming;
     VFIOUserMsgQ outgoing;
     VFIOUserMsg *last_nowait;
+    VFIOUserMsg *part_recv;
+    size_t recv_left;
     enum proxy_state state;
 } VFIOUserProxy;
 
 /* VFIOProxy flags */
 #define VFIO_PROXY_CLIENT        0x1
 
+typedef struct VFIODevice VFIODevice;
+
 VFIOUserProxy *vfio_user_connect_dev(SocketAddress *addr, Error **errp);
 void vfio_user_disconnect(VFIOUserProxy *proxy);
+void vfio_user_set_handler(VFIODevice *vbasedev,
+                           void (*handler)(void *opaque, VFIOUserMsg *msg),
+                           void *reqarg);
 
 #endif /* VFIO_USER_PROXY_H */
diff --git a/hw/vfio-user/trace-events b/hw/vfio-user/trace-events
new file mode 100644
index 0000000000..ddeb9f4b2f
--- /dev/null
+++ b/hw/vfio-user/trace-events
@@ -0,0 +1,8 @@
+# See docs/devel/tracing.rst for syntax documentation.
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+# common.c
+vfio_user_recv_hdr(const char *name, uint16_t id, uint16_t cmd, uint32_t size, uint32_t flags) " (%s) id 0x%x cmd 0x%x size 0x%x flags 0x%x"
+vfio_user_recv_read(uint16_t id, int read) " id 0x%x read 0x%x"
+vfio_user_recv_request(uint16_t cmd) " command 0x%x"
diff --git a/hw/vfio-user/trace.h b/hw/vfio-user/trace.h
new file mode 100644
index 0000000000..9cf02d9506
--- /dev/null
+++ b/hw/vfio-user/trace.h
@@ -0,0 +1,4 @@
+/*
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+#include "trace/trace-hw_vfio_user.h"
diff --git a/meson.build b/meson.build
index 4676908dbb..dbc97bfdf7 100644
--- a/meson.build
+++ b/meson.build
@@ -3683,6 +3683,7 @@ if have_system
     'hw/ufs',
     'hw/usb',
     'hw/vfio',
+    'hw/vfio-user',
     'hw/virtio',
     'hw/vmapple',
     'hw/watchdog',

From 36227628d824f563fda95f9344176ca7263c7eaf Mon Sep 17 00:00:00 2001
From: John Levon <john.levon@nutanix.com>
Date: Wed, 25 Jun 2025 20:29:56 +0100
Subject: [PATCH 1677/2760] vfio-user: implement message send infrastructure
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add plumbing for sending vfio-user messages on the control socket.
Add initial version negotation on connection.

Originally-by: John Johnson <john.g.johnson@oracle.com>
Signed-off-by: Jagannathan Raman <jag.raman@oracle.com>
Signed-off-by: Elena Ufimtseva <elena.ufimtseva@oracle.com>
Signed-off-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250625193012.2316242-5-john.levon@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio-user/pci.c        |  20 +-
 hw/vfio-user/protocol.h   |  62 +++++
 hw/vfio-user/proxy.c      | 515 ++++++++++++++++++++++++++++++++++++++
 hw/vfio-user/proxy.h      |   9 +
 hw/vfio-user/trace-events |   2 +
 5 files changed, 606 insertions(+), 2 deletions(-)

diff --git a/hw/vfio-user/pci.c b/hw/vfio-user/pci.c
index bad2829f5c..61f525cf4a 100644
--- a/hw/vfio-user/pci.c
+++ b/hw/vfio-user/pci.c
@@ -20,6 +20,7 @@ OBJECT_DECLARE_SIMPLE_TYPE(VFIOUserPCIDevice, VFIO_USER_PCI)
 struct VFIOUserPCIDevice {
     VFIOPCIDevice device;
     SocketAddress *socket;
+    bool send_queued;   /* all sends are queued */
 };
 
 /*
@@ -92,6 +93,16 @@ static void vfio_user_pci_realize(PCIDevice *pdev, Error **errp)
     vbasedev->proxy = proxy;
     vfio_user_set_handler(vbasedev, vfio_user_pci_process_req, vdev);
 
+    vbasedev->name = g_strdup_printf("vfio-user:%s", sock_name);
+
+    if (udev->send_queued) {
+        proxy->flags |= VFIO_PROXY_FORCE_QUEUED;
+    }
+
+    if (!vfio_user_validate_version(proxy, errp)) {
+        goto error;
+    }
+
     /*
      * vfio-user devices are effectively mdevs (don't use a host iommu).
      */
@@ -101,9 +112,13 @@ static void vfio_user_pci_realize(PCIDevice *pdev, Error **errp)
     if (!vfio_device_attach_by_iommu_type(TYPE_VFIO_IOMMU_USER,
                                           vbasedev->name, vbasedev,
                                           as, errp)) {
-        error_prepend(errp, VFIO_MSG_PREFIX, vbasedev->name);
-        return;
+        goto error;
     }
+
+    return;
+
+error:
+    error_prepend(errp, VFIO_MSG_PREFIX, vdev->vbasedev.name);
 }
 
 static void vfio_user_instance_init(Object *obj)
@@ -153,6 +168,7 @@ static const Property vfio_user_pci_dev_properties[] = {
                        sub_vendor_id, PCI_ANY_ID),
     DEFINE_PROP_UINT32("x-pci-sub-device-id", VFIOPCIDevice,
                        sub_device_id, PCI_ANY_ID),
+    DEFINE_PROP_BOOL("x-send-queued", VFIOUserPCIDevice, send_queued, false),
 };
 
 static void vfio_user_pci_set_socket(Object *obj, Visitor *v, const char *name,
diff --git a/hw/vfio-user/protocol.h b/hw/vfio-user/protocol.h
index 4ddfb5f222..2d52d0fb10 100644
--- a/hw/vfio-user/protocol.h
+++ b/hw/vfio-user/protocol.h
@@ -50,4 +50,66 @@ enum vfio_user_command {
 #define VFIO_USER_NO_REPLY      0x10
 #define VFIO_USER_ERROR         0x20
 
+
+/*
+ * VFIO_USER_VERSION
+ */
+typedef struct {
+    VFIOUserHdr hdr;
+    uint16_t major;
+    uint16_t minor;
+    char capabilities[];
+} VFIOUserVersion;
+
+#define VFIO_USER_MAJOR_VER     0
+#define VFIO_USER_MINOR_VER     0
+
+#define VFIO_USER_CAP           "capabilities"
+
+/* "capabilities" members */
+#define VFIO_USER_CAP_MAX_FDS   "max_msg_fds"
+#define VFIO_USER_CAP_MAX_XFER  "max_data_xfer_size"
+#define VFIO_USER_CAP_PGSIZES   "pgsizes"
+#define VFIO_USER_CAP_MAP_MAX   "max_dma_maps"
+#define VFIO_USER_CAP_MIGR      "migration"
+
+/* "migration" members */
+#define VFIO_USER_CAP_PGSIZE            "pgsize"
+#define VFIO_USER_CAP_MAX_BITMAP        "max_bitmap_size"
+
+/*
+ * Max FDs mainly comes into play when a device supports multiple interrupts
+ * where each ones uses an eventfd to inject it into the guest.
+ * It is clamped by the the number of FDs the qio channel supports in a
+ * single message.
+ */
+#define VFIO_USER_DEF_MAX_FDS   8
+#define VFIO_USER_MAX_MAX_FDS   16
+
+/*
+ * Max transfer limits the amount of data in region and DMA messages.
+ * Region R/W will be very small (limited by how much a single instruction
+ * can process) so just use a reasonable limit here.
+ */
+#define VFIO_USER_DEF_MAX_XFER  (1024 * 1024)
+#define VFIO_USER_MAX_MAX_XFER  (64 * 1024 * 1024)
+
+/*
+ * Default pagesizes supported is 4k.
+ */
+#define VFIO_USER_DEF_PGSIZE    4096
+
+/*
+ * Default max number of DMA mappings is stolen from the
+ * linux kernel "dma_entry_limit"
+ */
+#define VFIO_USER_DEF_MAP_MAX   65535
+
+/*
+ * Default max bitmap size is also take from the linux kernel,
+ * where usage of signed ints limits the VA range to 2^31 bytes.
+ * Dividing that by the number of bits per byte yields 256MB
+ */
+#define VFIO_USER_DEF_MAX_BITMAP (256 * 1024 * 1024)
+
 #endif /* VFIO_USER_PROTOCOL_H */
diff --git a/hw/vfio-user/proxy.c b/hw/vfio-user/proxy.c
index 349ea2b27c..874142e9e5 100644
--- a/hw/vfio-user/proxy.c
+++ b/hw/vfio-user/proxy.c
@@ -13,11 +13,15 @@
 #include "hw/vfio-user/proxy.h"
 #include "hw/vfio-user/trace.h"
 #include "qapi/error.h"
+#include "qobject/qdict.h"
+#include "qobject/qjson.h"
+#include "qobject/qnum.h"
 #include "qemu/error-report.h"
 #include "qemu/lockable.h"
 #include "qemu/main-loop.h"
 #include "system/iothread.h"
 
+static int wait_time = 5000;   /* wait up to 5 sec for busy servers */
 static IOThread *vfio_user_iothread;
 
 static void vfio_user_shutdown(VFIOUserProxy *proxy);
@@ -27,9 +31,12 @@ static VFIOUserFDs *vfio_user_getfds(int numfds);
 static void vfio_user_recycle(VFIOUserProxy *proxy, VFIOUserMsg *msg);
 
 static void vfio_user_recv(void *opaque);
+static void vfio_user_send(void *opaque);
 static void vfio_user_cb(void *opaque);
 
 static void vfio_user_request(void *opaque);
+static void vfio_user_request_msg(VFIOUserHdr *hdr, uint16_t cmd,
+                                  uint32_t size, uint32_t flags);
 
 static inline void vfio_user_set_error(VFIOUserHdr *hdr, uint32_t err)
 {
@@ -48,6 +55,41 @@ static void vfio_user_shutdown(VFIOUserProxy *proxy)
                                    proxy->ctx, NULL, NULL);
 }
 
+/*
+ * Same return values as qio_channel_writev_full():
+ *
+ * QIO_CHANNEL_ERR_BLOCK: *errp not set
+ * -1: *errp will be populated
+ * otherwise: bytes written
+ */
+static ssize_t vfio_user_send_qio(VFIOUserProxy *proxy, VFIOUserMsg *msg,
+                                  Error **errp)
+{
+    VFIOUserFDs *fds =  msg->fds;
+    struct iovec iov = {
+        .iov_base = msg->hdr,
+        .iov_len = msg->hdr->size,
+    };
+    size_t numfds = 0;
+    int *fdp = NULL;
+    ssize_t ret;
+
+    if (fds != NULL && fds->send_fds != 0) {
+        numfds = fds->send_fds;
+        fdp = fds->fds;
+    }
+
+    ret = qio_channel_writev_full(proxy->ioc, &iov, 1, fdp, numfds, 0, errp);
+
+    if (ret == -1) {
+        vfio_user_set_error(msg->hdr, EIO);
+        vfio_user_shutdown(proxy);
+    }
+    trace_vfio_user_send_write(msg->hdr->id, ret);
+
+    return ret;
+}
+
 static VFIOUserMsg *vfio_user_getmsg(VFIOUserProxy *proxy, VFIOUserHdr *hdr,
                                      VFIOUserFDs *fds)
 {
@@ -88,6 +130,7 @@ static void vfio_user_recycle(VFIOUserProxy *proxy, VFIOUserMsg *msg)
     msg->hdr = NULL;
     msg->fds = NULL;
     msg->complete = false;
+    msg->pending = false;
     QTAILQ_INSERT_HEAD(&proxy->free, msg, next);
 }
 
@@ -385,6 +428,62 @@ static void vfio_user_recv(void *opaque)
     }
 }
 
+/*
+ * Send a single message, same return semantics as vfio_user_send_qio().
+ *
+ * Sent async messages are freed, others are moved to pending queue.
+ */
+static ssize_t vfio_user_send_one(VFIOUserProxy *proxy, Error **errp)
+{
+    VFIOUserMsg *msg;
+    ssize_t ret;
+
+    msg = QTAILQ_FIRST(&proxy->outgoing);
+    ret = vfio_user_send_qio(proxy, msg, errp);
+    if (ret < 0) {
+        return ret;
+    }
+
+    QTAILQ_REMOVE(&proxy->outgoing, msg, next);
+    if (msg->type == VFIO_MSG_ASYNC) {
+        vfio_user_recycle(proxy, msg);
+    } else {
+        QTAILQ_INSERT_TAIL(&proxy->pending, msg, next);
+        msg->pending = true;
+    }
+
+    return ret;
+}
+
+/*
+ * Send messages from outgoing queue when the socket buffer has space.
+ * If we deplete 'outgoing', remove ourselves from the poll list.
+ */
+static void vfio_user_send(void *opaque)
+{
+    VFIOUserProxy *proxy = opaque;
+
+    QEMU_LOCK_GUARD(&proxy->lock);
+
+    if (proxy->state == VFIO_PROXY_CONNECTED) {
+        while (!QTAILQ_EMPTY(&proxy->outgoing)) {
+            Error *local_err = NULL;
+            int ret;
+
+            ret = vfio_user_send_one(proxy, &local_err);
+
+            if (ret == QIO_CHANNEL_ERR_BLOCK) {
+                return;
+            } else if (ret == -1) {
+                error_report_err(local_err);
+                return;
+            }
+        }
+        qio_channel_set_aio_fd_handler(proxy->ioc, proxy->ctx,
+                                       vfio_user_recv, NULL, NULL, proxy);
+    }
+}
+
 static void vfio_user_cb(void *opaque)
 {
     VFIOUserProxy *proxy = opaque;
@@ -446,6 +545,128 @@ static void vfio_user_request(void *opaque)
     }
 }
 
+/*
+ * Messages are queued onto the proxy's outgoing list.
+ *
+ * It handles 3 types of messages:
+ *
+ * async messages - replies and posted writes
+ *
+ * There will be no reply from the server, so message
+ * buffers are freed after they're sent.
+ *
+ * nowait messages - map/unmap during address space transactions
+ *
+ * These are also sent async, but a reply is expected so that
+ * vfio_wait_reqs() can wait for the youngest nowait request.
+ * They transition from the outgoing list to the pending list
+ * when sent, and are freed when the reply is received.
+ *
+ * wait messages - all other requests
+ *
+ * The reply to these messages is waited for by their caller.
+ * They also transition from outgoing to pending when sent, but
+ * the message buffer is returned to the caller with the reply
+ * contents.  The caller is responsible for freeing these messages.
+ *
+ * As an optimization, if the outgoing list and the socket send
+ * buffer are empty, the message is sent inline instead of being
+ * added to the outgoing list.  The rest of the transitions are
+ * unchanged.
+ */
+static bool vfio_user_send_queued(VFIOUserProxy *proxy, VFIOUserMsg *msg,
+                                  Error **errp)
+{
+    int ret;
+
+    /*
+     * Unsent outgoing msgs - add to tail
+     */
+    if (!QTAILQ_EMPTY(&proxy->outgoing)) {
+        QTAILQ_INSERT_TAIL(&proxy->outgoing, msg, next);
+        return true;
+    }
+
+    /*
+     * Try inline - if blocked, queue it and kick send poller
+     */
+    if (proxy->flags & VFIO_PROXY_FORCE_QUEUED) {
+        ret = QIO_CHANNEL_ERR_BLOCK;
+    } else {
+        ret = vfio_user_send_qio(proxy, msg, errp);
+    }
+
+    if (ret == QIO_CHANNEL_ERR_BLOCK) {
+        QTAILQ_INSERT_HEAD(&proxy->outgoing, msg, next);
+        qio_channel_set_aio_fd_handler(proxy->ioc, proxy->ctx,
+                                       vfio_user_recv, proxy->ctx,
+                                       vfio_user_send, proxy);
+        return true;
+    }
+    if (ret == -1) {
+        return false;
+    }
+
+    /*
+     * Sent - free async, add others to pending
+     */
+    if (msg->type == VFIO_MSG_ASYNC) {
+        vfio_user_recycle(proxy, msg);
+    } else {
+        QTAILQ_INSERT_TAIL(&proxy->pending, msg, next);
+        msg->pending = true;
+    }
+
+    return true;
+}
+
+/*
+ * Returns false if we did not successfully receive a reply message, in which
+ * case @errp will be populated.
+ *
+ * In either case, the caller must free @hdr and @fds if needed.
+ */
+static bool vfio_user_send_wait(VFIOUserProxy *proxy, VFIOUserHdr *hdr,
+                                VFIOUserFDs *fds, int rsize, Error **errp)
+{
+    VFIOUserMsg *msg;
+    bool ok = false;
+
+    if (hdr->flags & VFIO_USER_NO_REPLY) {
+        error_setg_errno(errp, EINVAL, "%s on NO_REPLY message", __func__);
+        return false;
+    }
+
+    qemu_mutex_lock(&proxy->lock);
+
+    msg = vfio_user_getmsg(proxy, hdr, fds);
+    msg->id = hdr->id;
+    msg->rsize = rsize ? rsize : hdr->size;
+    msg->type = VFIO_MSG_WAIT;
+
+    ok = vfio_user_send_queued(proxy, msg, errp);
+
+    if (ok) {
+        while (!msg->complete) {
+            if (!qemu_cond_timedwait(&msg->cv, &proxy->lock, wait_time)) {
+                VFIOUserMsgQ *list;
+
+                list = msg->pending ? &proxy->pending : &proxy->outgoing;
+                QTAILQ_REMOVE(list, msg, next);
+                error_setg_errno(errp, ETIMEDOUT,
+                                 "timed out waiting for reply");
+                ok = false;
+                break;
+            }
+        }
+    }
+
+    vfio_user_recycle(proxy, msg);
+
+    qemu_mutex_unlock(&proxy->lock);
+
+    return ok;
+}
 
 static QLIST_HEAD(, VFIOUserProxy) vfio_user_sockets =
     QLIST_HEAD_INITIALIZER(vfio_user_sockets);
@@ -474,6 +695,15 @@ VFIOUserProxy *vfio_user_connect_dev(SocketAddress *addr, Error **errp)
     proxy = g_malloc0(sizeof(VFIOUserProxy));
     proxy->sockname = g_strdup_printf("unix:%s", sockname);
     proxy->ioc = ioc;
+
+    /* init defaults */
+    proxy->max_xfer_size = VFIO_USER_DEF_MAX_XFER;
+    proxy->max_send_fds = VFIO_USER_DEF_MAX_FDS;
+    proxy->max_dma = VFIO_USER_DEF_MAP_MAX;
+    proxy->dma_pgsizes = VFIO_USER_DEF_PGSIZE;
+    proxy->max_bitmap = VFIO_USER_DEF_MAX_BITMAP;
+    proxy->migr_pgsize = VFIO_USER_DEF_PGSIZE;
+
     proxy->flags = VFIO_PROXY_CLIENT;
     proxy->state = VFIO_PROXY_CONNECTED;
 
@@ -571,3 +801,288 @@ void vfio_user_disconnect(VFIOUserProxy *proxy)
     g_free(proxy->sockname);
     g_free(proxy);
 }
+
+static void vfio_user_request_msg(VFIOUserHdr *hdr, uint16_t cmd,
+                                  uint32_t size, uint32_t flags)
+{
+    static uint16_t next_id;
+
+    hdr->id = qatomic_fetch_inc(&next_id);
+    hdr->command = cmd;
+    hdr->size = size;
+    hdr->flags = (flags & ~VFIO_USER_TYPE) | VFIO_USER_REQUEST;
+    hdr->error_reply = 0;
+}
+
+struct cap_entry {
+    const char *name;
+    bool (*check)(VFIOUserProxy *proxy, QObject *qobj, Error **errp);
+};
+
+static bool caps_parse(VFIOUserProxy *proxy, QDict *qdict,
+                       struct cap_entry caps[], Error **errp)
+{
+    QObject *qobj;
+    struct cap_entry *p;
+
+    for (p = caps; p->name != NULL; p++) {
+        qobj = qdict_get(qdict, p->name);
+        if (qobj != NULL) {
+            if (!p->check(proxy, qobj, errp)) {
+                return false;
+            }
+            qdict_del(qdict, p->name);
+        }
+    }
+
+    /* warning, for now */
+    if (qdict_size(qdict) != 0) {
+        warn_report("spurious capabilities");
+    }
+    return true;
+}
+
+static bool check_migr_pgsize(VFIOUserProxy *proxy, QObject *qobj, Error **errp)
+{
+    QNum *qn = qobject_to(QNum, qobj);
+    uint64_t pgsize;
+
+    if (qn == NULL || !qnum_get_try_uint(qn, &pgsize)) {
+        error_setg(errp, "malformed %s", VFIO_USER_CAP_PGSIZE);
+        return false;
+    }
+
+    /* must be larger than default */
+    if (pgsize & (VFIO_USER_DEF_PGSIZE - 1)) {
+        error_setg(errp, "pgsize 0x%"PRIx64" too small", pgsize);
+        return false;
+    }
+
+    proxy->migr_pgsize = pgsize;
+    return true;
+}
+
+static bool check_bitmap(VFIOUserProxy *proxy, QObject *qobj, Error **errp)
+{
+    QNum *qn = qobject_to(QNum, qobj);
+    uint64_t bitmap_size;
+
+    if (qn == NULL || !qnum_get_try_uint(qn, &bitmap_size)) {
+        error_setg(errp, "malformed %s", VFIO_USER_CAP_MAX_BITMAP);
+        return false;
+    }
+
+    /* can only lower it */
+    if (bitmap_size > VFIO_USER_DEF_MAX_BITMAP) {
+        error_setg(errp, "%s too large", VFIO_USER_CAP_MAX_BITMAP);
+        return false;
+    }
+
+    proxy->max_bitmap = bitmap_size;
+    return true;
+}
+
+static struct cap_entry caps_migr[] = {
+    { VFIO_USER_CAP_PGSIZE, check_migr_pgsize },
+    { VFIO_USER_CAP_MAX_BITMAP, check_bitmap },
+    { NULL }
+};
+
+static bool check_max_fds(VFIOUserProxy *proxy, QObject *qobj, Error **errp)
+{
+    QNum *qn = qobject_to(QNum, qobj);
+    uint64_t max_send_fds;
+
+    if (qn == NULL || !qnum_get_try_uint(qn, &max_send_fds) ||
+        max_send_fds > VFIO_USER_MAX_MAX_FDS) {
+        error_setg(errp, "malformed %s", VFIO_USER_CAP_MAX_FDS);
+        return false;
+    }
+    proxy->max_send_fds = max_send_fds;
+    return true;
+}
+
+static bool check_max_xfer(VFIOUserProxy *proxy, QObject *qobj, Error **errp)
+{
+    QNum *qn = qobject_to(QNum, qobj);
+    uint64_t max_xfer_size;
+
+    if (qn == NULL || !qnum_get_try_uint(qn, &max_xfer_size) ||
+        max_xfer_size > VFIO_USER_MAX_MAX_XFER) {
+        error_setg(errp, "malformed %s", VFIO_USER_CAP_MAX_XFER);
+        return false;
+    }
+    proxy->max_xfer_size = max_xfer_size;
+    return true;
+}
+
+static bool check_pgsizes(VFIOUserProxy *proxy, QObject *qobj, Error **errp)
+{
+    QNum *qn = qobject_to(QNum, qobj);
+    uint64_t pgsizes;
+
+    if (qn == NULL || !qnum_get_try_uint(qn, &pgsizes)) {
+        error_setg(errp, "malformed %s", VFIO_USER_CAP_PGSIZES);
+        return false;
+    }
+
+    /* must be larger than default */
+    if (pgsizes & (VFIO_USER_DEF_PGSIZE - 1)) {
+        error_setg(errp, "pgsize 0x%"PRIx64" too small", pgsizes);
+        return false;
+    }
+
+    proxy->dma_pgsizes = pgsizes;
+    return true;
+}
+
+static bool check_max_dma(VFIOUserProxy *proxy, QObject *qobj, Error **errp)
+{
+    QNum *qn = qobject_to(QNum, qobj);
+    uint64_t max_dma;
+
+    if (qn == NULL || !qnum_get_try_uint(qn, &max_dma)) {
+        error_setg(errp, "malformed %s", VFIO_USER_CAP_MAP_MAX);
+        return false;
+    }
+
+    /* can only lower it */
+    if (max_dma > VFIO_USER_DEF_MAP_MAX) {
+        error_setg(errp, "%s too large", VFIO_USER_CAP_MAP_MAX);
+        return false;
+    }
+
+    proxy->max_dma = max_dma;
+    return true;
+}
+
+static bool check_migr(VFIOUserProxy *proxy, QObject *qobj, Error **errp)
+{
+    QDict *qdict = qobject_to(QDict, qobj);
+
+    if (qdict == NULL) {
+        error_setg(errp, "malformed %s", VFIO_USER_CAP_MAX_FDS);
+        return true;
+    }
+    return caps_parse(proxy, qdict, caps_migr, errp);
+}
+
+static struct cap_entry caps_cap[] = {
+    { VFIO_USER_CAP_MAX_FDS, check_max_fds },
+    { VFIO_USER_CAP_MAX_XFER, check_max_xfer },
+    { VFIO_USER_CAP_PGSIZES, check_pgsizes },
+    { VFIO_USER_CAP_MAP_MAX, check_max_dma },
+    { VFIO_USER_CAP_MIGR, check_migr },
+    { NULL }
+};
+
+static bool check_cap(VFIOUserProxy *proxy, QObject *qobj, Error **errp)
+{
+   QDict *qdict = qobject_to(QDict, qobj);
+
+    if (qdict == NULL) {
+        error_setg(errp, "malformed %s", VFIO_USER_CAP);
+        return false;
+    }
+    return caps_parse(proxy, qdict, caps_cap, errp);
+}
+
+static struct cap_entry ver_0_0[] = {
+    { VFIO_USER_CAP, check_cap },
+    { NULL }
+};
+
+static bool caps_check(VFIOUserProxy *proxy, int minor, const char *caps,
+                       Error **errp)
+{
+    QObject *qobj;
+    QDict *qdict;
+    bool ret;
+
+    qobj = qobject_from_json(caps, NULL);
+    if (qobj == NULL) {
+        error_setg(errp, "malformed capabilities %s", caps);
+        return false;
+    }
+    qdict = qobject_to(QDict, qobj);
+    if (qdict == NULL) {
+        error_setg(errp, "capabilities %s not an object", caps);
+        qobject_unref(qobj);
+        return false;
+    }
+    ret = caps_parse(proxy, qdict, ver_0_0, errp);
+
+    qobject_unref(qobj);
+    return ret;
+}
+
+static GString *caps_json(void)
+{
+    QDict *dict = qdict_new();
+    QDict *capdict = qdict_new();
+    QDict *migdict = qdict_new();
+    GString *str;
+
+    qdict_put_int(migdict, VFIO_USER_CAP_PGSIZE, VFIO_USER_DEF_PGSIZE);
+    qdict_put_int(migdict, VFIO_USER_CAP_MAX_BITMAP, VFIO_USER_DEF_MAX_BITMAP);
+    qdict_put_obj(capdict, VFIO_USER_CAP_MIGR, QOBJECT(migdict));
+
+    qdict_put_int(capdict, VFIO_USER_CAP_MAX_FDS, VFIO_USER_MAX_MAX_FDS);
+    qdict_put_int(capdict, VFIO_USER_CAP_MAX_XFER, VFIO_USER_DEF_MAX_XFER);
+    qdict_put_int(capdict, VFIO_USER_CAP_PGSIZES, VFIO_USER_DEF_PGSIZE);
+    qdict_put_int(capdict, VFIO_USER_CAP_MAP_MAX, VFIO_USER_DEF_MAP_MAX);
+
+    qdict_put_obj(dict, VFIO_USER_CAP, QOBJECT(capdict));
+
+    str = qobject_to_json(QOBJECT(dict));
+    qobject_unref(dict);
+    return str;
+}
+
+bool vfio_user_validate_version(VFIOUserProxy *proxy, Error **errp)
+{
+    g_autofree VFIOUserVersion *msgp = NULL;
+    GString *caps;
+    char *reply;
+    int size, caplen;
+
+    caps = caps_json();
+    caplen = caps->len + 1;
+    size = sizeof(*msgp) + caplen;
+    msgp = g_malloc0(size);
+
+    vfio_user_request_msg(&msgp->hdr, VFIO_USER_VERSION, size, 0);
+    msgp->major = VFIO_USER_MAJOR_VER;
+    msgp->minor = VFIO_USER_MINOR_VER;
+    memcpy(&msgp->capabilities, caps->str, caplen);
+    g_string_free(caps, true);
+    trace_vfio_user_version(msgp->major, msgp->minor, msgp->capabilities);
+
+    if (!vfio_user_send_wait(proxy, &msgp->hdr, NULL, 0, errp)) {
+        return false;
+    }
+
+    if (msgp->hdr.flags & VFIO_USER_ERROR) {
+        error_setg_errno(errp, msgp->hdr.error_reply, "version reply");
+        return false;
+    }
+
+    if (msgp->major != VFIO_USER_MAJOR_VER ||
+        msgp->minor > VFIO_USER_MINOR_VER) {
+        error_setg(errp, "incompatible server version");
+        return false;
+    }
+
+    reply = msgp->capabilities;
+    if (reply[msgp->hdr.size - sizeof(*msgp) - 1] != '\0') {
+        error_setg(errp, "corrupt version reply");
+        return false;
+    }
+
+    if (!caps_check(proxy, msgp->minor, reply, errp)) {
+        return false;
+    }
+
+    trace_vfio_user_version(msgp->major, msgp->minor, msgp->capabilities);
+    return true;
+}
diff --git a/hw/vfio-user/proxy.h b/hw/vfio-user/proxy.h
index ff553cad9d..5bc890a0f5 100644
--- a/hw/vfio-user/proxy.h
+++ b/hw/vfio-user/proxy.h
@@ -37,6 +37,7 @@ typedef struct VFIOUserMsg {
     uint32_t id;
     QemuCond cv;
     bool complete;
+    bool pending;
     enum msg_type type;
 } VFIOUserMsg;
 
@@ -56,6 +57,12 @@ typedef struct VFIOUserProxy {
     struct QIOChannel *ioc;
     void (*request)(void *opaque, VFIOUserMsg *msg);
     void *req_arg;
+    uint64_t max_xfer_size;
+    uint64_t max_send_fds;
+    uint64_t max_dma;
+    uint64_t dma_pgsizes;
+    uint64_t max_bitmap;
+    uint64_t migr_pgsize;
     int flags;
     QemuCond close_cv;
     AioContext *ctx;
@@ -78,6 +85,7 @@ typedef struct VFIOUserProxy {
 
 /* VFIOProxy flags */
 #define VFIO_PROXY_CLIENT        0x1
+#define VFIO_PROXY_FORCE_QUEUED  0x4
 
 typedef struct VFIODevice VFIODevice;
 
@@ -86,5 +94,6 @@ void vfio_user_disconnect(VFIOUserProxy *proxy);
 void vfio_user_set_handler(VFIODevice *vbasedev,
                            void (*handler)(void *opaque, VFIOUserMsg *msg),
                            void *reqarg);
+bool vfio_user_validate_version(VFIOUserProxy *proxy, Error **errp);
 
 #endif /* VFIO_USER_PROXY_H */
diff --git a/hw/vfio-user/trace-events b/hw/vfio-user/trace-events
index ddeb9f4b2f..a965c7b1f2 100644
--- a/hw/vfio-user/trace-events
+++ b/hw/vfio-user/trace-events
@@ -6,3 +6,5 @@
 vfio_user_recv_hdr(const char *name, uint16_t id, uint16_t cmd, uint32_t size, uint32_t flags) " (%s) id 0x%x cmd 0x%x size 0x%x flags 0x%x"
 vfio_user_recv_read(uint16_t id, int read) " id 0x%x read 0x%x"
 vfio_user_recv_request(uint16_t cmd) " command 0x%x"
+vfio_user_send_write(uint16_t id, int wrote) " id 0x%x wrote 0x%x"
+vfio_user_version(uint16_t major, uint16_t minor, const char *caps) " major %d minor %d caps: %s"

From 3bdb738b734c77f93f93f8119c8f6ba8a9c5947c Mon Sep 17 00:00:00 2001
From: John Levon <john.levon@nutanix.com>
Date: Wed, 25 Jun 2025 20:29:57 +0100
Subject: [PATCH 1678/2760] vfio-user: implement VFIO_USER_DEVICE_GET_INFO
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add support for getting basic device information.

Originally-by: John Johnson <john.g.johnson@oracle.com>
Signed-off-by: Elena Ufimtseva <elena.ufimtseva@oracle.com>
Signed-off-by: Jagannathan Raman <jag.raman@oracle.com>
Signed-off-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250625193012.2316242-6-john.levon@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio-user/container.c  |  8 +++++-
 hw/vfio-user/device.c     | 55 +++++++++++++++++++++++++++++++++++++++
 hw/vfio-user/device.h     | 20 ++++++++++++++
 hw/vfio-user/meson.build  |  1 +
 hw/vfio-user/protocol.h   | 12 +++++++++
 hw/vfio-user/proxy.c      | 10 +++----
 hw/vfio-user/proxy.h      |  7 +++++
 hw/vfio-user/trace-events |  1 +
 8 files changed, 107 insertions(+), 7 deletions(-)
 create mode 100644 hw/vfio-user/device.c
 create mode 100644 hw/vfio-user/device.h

diff --git a/hw/vfio-user/container.c b/hw/vfio-user/container.c
index 2367332177..f5bfd54316 100644
--- a/hw/vfio-user/container.c
+++ b/hw/vfio-user/container.c
@@ -11,6 +11,7 @@
 #include "qemu/osdep.h"
 
 #include "hw/vfio-user/container.h"
+#include "hw/vfio-user/device.h"
 #include "hw/vfio/vfio-cpr.h"
 #include "hw/vfio/vfio-device.h"
 #include "hw/vfio/vfio-listener.h"
@@ -140,7 +141,12 @@ static void vfio_user_container_disconnect(VFIOUserContainer *container)
 static bool vfio_user_device_get(VFIOUserContainer *container,
                                  VFIODevice *vbasedev, Error **errp)
 {
-    struct vfio_device_info info = { 0 };
+    struct vfio_device_info info = { .argsz = sizeof(info) };
+
+
+    if (!vfio_user_get_device_info(vbasedev->proxy, &info, errp)) {
+        return false;
+    }
 
     vbasedev->fd = -1;
 
diff --git a/hw/vfio-user/device.c b/hw/vfio-user/device.c
new file mode 100644
index 0000000000..4212fefd44
--- /dev/null
+++ b/hw/vfio-user/device.c
@@ -0,0 +1,55 @@
+/*
+ * vfio protocol over a UNIX socket device handling.
+ *
+ * Copyright © 2018, 2021 Oracle and/or its affiliates.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "qemu/error-report.h"
+
+#include "hw/vfio-user/device.h"
+#include "hw/vfio-user/trace.h"
+
+/*
+ * These are to defend against a malign server trying
+ * to force us to run out of memory.
+ */
+#define VFIO_USER_MAX_REGIONS   100
+#define VFIO_USER_MAX_IRQS      50
+
+bool vfio_user_get_device_info(VFIOUserProxy *proxy,
+                               struct vfio_device_info *info, Error **errp)
+{
+    VFIOUserDeviceInfo msg;
+    uint32_t argsz = sizeof(msg) - sizeof(msg.hdr);
+
+    memset(&msg, 0, sizeof(msg));
+    vfio_user_request_msg(&msg.hdr, VFIO_USER_DEVICE_GET_INFO, sizeof(msg), 0);
+    msg.argsz = argsz;
+
+    if (!vfio_user_send_wait(proxy, &msg.hdr, NULL, 0, errp)) {
+        return false;
+    }
+
+    if (msg.hdr.flags & VFIO_USER_ERROR) {
+        error_setg_errno(errp, -msg.hdr.error_reply,
+                         "VFIO_USER_DEVICE_GET_INFO failed");
+        return false;
+    }
+
+    trace_vfio_user_get_info(msg.num_regions, msg.num_irqs);
+
+    memcpy(info, &msg.argsz, argsz);
+
+    /* defend against a malicious server */
+    if (info->num_regions > VFIO_USER_MAX_REGIONS ||
+        info->num_irqs > VFIO_USER_MAX_IRQS) {
+        error_setg_errno(errp, EINVAL, "invalid reply");
+        return false;
+    }
+
+    return true;
+}
diff --git a/hw/vfio-user/device.h b/hw/vfio-user/device.h
new file mode 100644
index 0000000000..ef3f71ee69
--- /dev/null
+++ b/hw/vfio-user/device.h
@@ -0,0 +1,20 @@
+#ifndef VFIO_USER_DEVICE_H
+#define VFIO_USER_DEVICE_H
+
+/*
+ * vfio protocol over a UNIX socket device handling.
+ *
+ * Copyright © 2018, 2021 Oracle and/or its affiliates.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "linux/vfio.h"
+
+#include "hw/vfio-user/proxy.h"
+
+bool vfio_user_get_device_info(VFIOUserProxy *proxy,
+                               struct vfio_device_info *info, Error **errp);
+
+#endif /* VFIO_USER_DEVICE_H */
diff --git a/hw/vfio-user/meson.build b/hw/vfio-user/meson.build
index 9e85a8ea51..2ed0ae5b1d 100644
--- a/hw/vfio-user/meson.build
+++ b/hw/vfio-user/meson.build
@@ -3,6 +3,7 @@
 vfio_user_ss = ss.source_set()
 vfio_user_ss.add(files(
   'container.c',
+  'device.c',
   'pci.c',
   'proxy.c',
 ))
diff --git a/hw/vfio-user/protocol.h b/hw/vfio-user/protocol.h
index 2d52d0fb10..e0bba68739 100644
--- a/hw/vfio-user/protocol.h
+++ b/hw/vfio-user/protocol.h
@@ -112,4 +112,16 @@ typedef struct {
  */
 #define VFIO_USER_DEF_MAX_BITMAP (256 * 1024 * 1024)
 
+/*
+ * VFIO_USER_DEVICE_GET_INFO
+ * imported from struct vfio_device_info
+ */
+typedef struct {
+    VFIOUserHdr hdr;
+    uint32_t argsz;
+    uint32_t flags;
+    uint32_t num_regions;
+    uint32_t num_irqs;
+} VFIOUserDeviceInfo;
+
 #endif /* VFIO_USER_PROTOCOL_H */
diff --git a/hw/vfio-user/proxy.c b/hw/vfio-user/proxy.c
index 874142e9e5..aed7b22e2a 100644
--- a/hw/vfio-user/proxy.c
+++ b/hw/vfio-user/proxy.c
@@ -35,8 +35,6 @@ static void vfio_user_send(void *opaque);
 static void vfio_user_cb(void *opaque);
 
 static void vfio_user_request(void *opaque);
-static void vfio_user_request_msg(VFIOUserHdr *hdr, uint16_t cmd,
-                                  uint32_t size, uint32_t flags);
 
 static inline void vfio_user_set_error(VFIOUserHdr *hdr, uint32_t err)
 {
@@ -626,8 +624,8 @@ static bool vfio_user_send_queued(VFIOUserProxy *proxy, VFIOUserMsg *msg,
  *
  * In either case, the caller must free @hdr and @fds if needed.
  */
-static bool vfio_user_send_wait(VFIOUserProxy *proxy, VFIOUserHdr *hdr,
-                                VFIOUserFDs *fds, int rsize, Error **errp)
+bool vfio_user_send_wait(VFIOUserProxy *proxy, VFIOUserHdr *hdr,
+                         VFIOUserFDs *fds, int rsize, Error **errp)
 {
     VFIOUserMsg *msg;
     bool ok = false;
@@ -802,8 +800,8 @@ void vfio_user_disconnect(VFIOUserProxy *proxy)
     g_free(proxy);
 }
 
-static void vfio_user_request_msg(VFIOUserHdr *hdr, uint16_t cmd,
-                                  uint32_t size, uint32_t flags)
+void vfio_user_request_msg(VFIOUserHdr *hdr, uint16_t cmd,
+                           uint32_t size, uint32_t flags)
 {
     static uint16_t next_id;
 
diff --git a/hw/vfio-user/proxy.h b/hw/vfio-user/proxy.h
index 5bc890a0f5..837b02a8c4 100644
--- a/hw/vfio-user/proxy.h
+++ b/hw/vfio-user/proxy.h
@@ -12,7 +12,9 @@
 #include "io/channel.h"
 #include "io/channel-socket.h"
 
+#include "qemu/queue.h"
 #include "qemu/sockets.h"
+#include "qemu/thread.h"
 #include "hw/vfio-user/protocol.h"
 
 typedef struct {
@@ -96,4 +98,9 @@ void vfio_user_set_handler(VFIODevice *vbasedev,
                            void *reqarg);
 bool vfio_user_validate_version(VFIOUserProxy *proxy, Error **errp);
 
+void vfio_user_request_msg(VFIOUserHdr *hdr, uint16_t cmd,
+                           uint32_t size, uint32_t flags);
+bool vfio_user_send_wait(VFIOUserProxy *proxy, VFIOUserHdr *hdr,
+                         VFIOUserFDs *fds, int rsize, Error **errp);
+
 #endif /* VFIO_USER_PROXY_H */
diff --git a/hw/vfio-user/trace-events b/hw/vfio-user/trace-events
index a965c7b1f2..b7312d6d59 100644
--- a/hw/vfio-user/trace-events
+++ b/hw/vfio-user/trace-events
@@ -8,3 +8,4 @@ vfio_user_recv_read(uint16_t id, int read) " id 0x%x read 0x%x"
 vfio_user_recv_request(uint16_t cmd) " command 0x%x"
 vfio_user_send_write(uint16_t id, int wrote) " id 0x%x wrote 0x%x"
 vfio_user_version(uint16_t major, uint16_t minor, const char *caps) " major %d minor %d caps: %s"
+vfio_user_get_info(uint32_t nregions, uint32_t nirqs) " #regions %d #irqs %d"

From 667866d66620e9f545eb3bd4f065d9ab81bda727 Mon Sep 17 00:00:00 2001
From: John Levon <john.levon@nutanix.com>
Date: Wed, 25 Jun 2025 20:29:58 +0100
Subject: [PATCH 1679/2760] vfio-user: implement
 VFIO_USER_DEVICE_GET_REGION_INFO
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add support for getting region info for vfio-user. As vfio-user has one
fd per region, enable ->use_region_fds.

Originally-by: John Johnson <john.g.johnson@oracle.com>
Signed-off-by: Elena Ufimtseva <elena.ufimtseva@oracle.com>
Signed-off-by: Jagannathan Raman <jag.raman@oracle.com>
Signed-off-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250625193012.2316242-7-john.levon@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio-user/device.c     | 74 +++++++++++++++++++++++++++++++++++++++
 hw/vfio-user/device.h     |  2 ++
 hw/vfio-user/pci.c        | 11 ++++++
 hw/vfio-user/protocol.h   | 14 ++++++++
 hw/vfio-user/proxy.h      |  1 +
 hw/vfio-user/trace-events |  1 +
 6 files changed, 103 insertions(+)

diff --git a/hw/vfio-user/device.c b/hw/vfio-user/device.c
index 4212fefd44..d90232a08f 100644
--- a/hw/vfio-user/device.c
+++ b/hw/vfio-user/device.c
@@ -53,3 +53,77 @@ bool vfio_user_get_device_info(VFIOUserProxy *proxy,
 
     return true;
 }
+
+static int vfio_user_get_region_info(VFIOUserProxy *proxy,
+                                     struct vfio_region_info *info,
+                                     VFIOUserFDs *fds)
+{
+    g_autofree VFIOUserRegionInfo *msgp = NULL;
+    Error *local_err = NULL;
+    uint32_t size;
+
+    /* data returned can be larger than vfio_region_info */
+    if (info->argsz < sizeof(*info)) {
+        error_printf("vfio_user_get_region_info argsz too small\n");
+        return -E2BIG;
+    }
+    if (fds != NULL && fds->send_fds != 0) {
+        error_printf("vfio_user_get_region_info can't send FDs\n");
+        return -EINVAL;
+    }
+
+    size = info->argsz + sizeof(VFIOUserHdr);
+    msgp = g_malloc0(size);
+
+    vfio_user_request_msg(&msgp->hdr, VFIO_USER_DEVICE_GET_REGION_INFO,
+                          sizeof(*msgp), 0);
+    msgp->argsz = info->argsz;
+    msgp->index = info->index;
+
+    if (!vfio_user_send_wait(proxy, &msgp->hdr, fds, size, &local_err)) {
+        error_prepend(&local_err, "%s: ", __func__);
+        error_report_err(local_err);
+        return -EFAULT;
+    }
+
+    if (msgp->hdr.flags & VFIO_USER_ERROR) {
+        return -msgp->hdr.error_reply;
+    }
+    trace_vfio_user_get_region_info(msgp->index, msgp->flags, msgp->size);
+
+    memcpy(info, &msgp->argsz, info->argsz);
+    return 0;
+}
+
+
+static int vfio_user_device_io_get_region_info(VFIODevice *vbasedev,
+                                               struct vfio_region_info *info,
+                                               int *fd)
+{
+    VFIOUserFDs fds = { 0, 1, fd};
+    int ret;
+
+    if (info->index > vbasedev->num_regions) {
+        return -EINVAL;
+    }
+
+    ret = vfio_user_get_region_info(vbasedev->proxy, info, &fds);
+    if (ret) {
+        return ret;
+    }
+
+    /* cap_offset in valid area */
+    if ((info->flags & VFIO_REGION_INFO_FLAG_CAPS) &&
+        (info->cap_offset < sizeof(*info) || info->cap_offset > info->argsz)) {
+        return -EINVAL;
+    }
+
+    return 0;
+}
+
+/*
+ * Socket-based io_ops
+ */
+VFIODeviceIOOps vfio_user_device_io_ops_sock = {
+    .get_region_info = vfio_user_device_io_get_region_info,
+};
diff --git a/hw/vfio-user/device.h b/hw/vfio-user/device.h
index ef3f71ee69..619c0f3140 100644
--- a/hw/vfio-user/device.h
+++ b/hw/vfio-user/device.h
@@ -17,4 +17,6 @@
 bool vfio_user_get_device_info(VFIOUserProxy *proxy,
                                struct vfio_device_info *info, Error **errp);
 
+extern VFIODeviceIOOps vfio_user_device_io_ops_sock;
+
 #endif /* VFIO_USER_DEVICE_H */
diff --git a/hw/vfio-user/pci.c b/hw/vfio-user/pci.c
index 61f525cf4a..d704e3d390 100644
--- a/hw/vfio-user/pci.c
+++ b/hw/vfio-user/pci.c
@@ -12,6 +12,7 @@
 
 #include "hw/qdev-properties.h"
 #include "hw/vfio/pci.h"
+#include "hw/vfio-user/device.h"
 #include "hw/vfio-user/proxy.h"
 
 #define TYPE_VFIO_USER_PCI "vfio-user-pci"
@@ -103,11 +104,21 @@ static void vfio_user_pci_realize(PCIDevice *pdev, Error **errp)
         goto error;
     }
 
+    /*
+     * Use socket-based device I/O instead of vfio kernel driver.
+     */
+    vbasedev->io_ops = &vfio_user_device_io_ops_sock;
+
     /*
      * vfio-user devices are effectively mdevs (don't use a host iommu).
      */
     vbasedev->mdev = true;
 
+    /*
+     * Enable per-region fds.
+     */
+    vbasedev->use_region_fds = true;
+
     as = pci_device_iommu_address_space(pdev);
     if (!vfio_device_attach_by_iommu_type(TYPE_VFIO_IOMMU_USER,
                                           vbasedev->name, vbasedev,
diff --git a/hw/vfio-user/protocol.h b/hw/vfio-user/protocol.h
index e0bba68739..db88f5fcb1 100644
--- a/hw/vfio-user/protocol.h
+++ b/hw/vfio-user/protocol.h
@@ -124,4 +124,18 @@ typedef struct {
     uint32_t num_irqs;
 } VFIOUserDeviceInfo;
 
+/*
+ * VFIO_USER_DEVICE_GET_REGION_INFO
+ * imported from struct vfio_region_info
+ */
+typedef struct {
+    VFIOUserHdr hdr;
+    uint32_t argsz;
+    uint32_t flags;
+    uint32_t index;
+    uint32_t cap_offset;
+    uint64_t size;
+    uint64_t offset;
+} VFIOUserRegionInfo;
+
 #endif /* VFIO_USER_PROTOCOL_H */
diff --git a/hw/vfio-user/proxy.h b/hw/vfio-user/proxy.h
index 837b02a8c4..ba1c33aba8 100644
--- a/hw/vfio-user/proxy.h
+++ b/hw/vfio-user/proxy.h
@@ -15,6 +15,7 @@
 #include "qemu/queue.h"
 #include "qemu/sockets.h"
 #include "qemu/thread.h"
+#include "hw/vfio/vfio-device.h"
 #include "hw/vfio-user/protocol.h"
 
 typedef struct {
diff --git a/hw/vfio-user/trace-events b/hw/vfio-user/trace-events
index b7312d6d59..ef3f14c74d 100644
--- a/hw/vfio-user/trace-events
+++ b/hw/vfio-user/trace-events
@@ -9,3 +9,4 @@ vfio_user_recv_request(uint16_t cmd) " command 0x%x"
 vfio_user_send_write(uint16_t id, int wrote) " id 0x%x wrote 0x%x"
 vfio_user_version(uint16_t major, uint16_t minor, const char *caps) " major %d minor %d caps: %s"
 vfio_user_get_info(uint32_t nregions, uint32_t nirqs) " #regions %d #irqs %d"
+vfio_user_get_region_info(uint32_t index, uint32_t flags, uint64_t size) " index %d flags 0x%x size 0x%"PRIx64

From 1ed50fcb6a8b99312458b9653de2d1d5acfd7506 Mon Sep 17 00:00:00 2001
From: John Levon <john.levon@nutanix.com>
Date: Wed, 25 Jun 2025 20:29:59 +0100
Subject: [PATCH 1680/2760] vfio-user: implement VFIO_USER_REGION_READ/WRITE
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Originally-by: John Johnson <john.g.johnson@oracle.com>
Signed-off-by: Elena Ufimtseva <elena.ufimtseva@oracle.com>
Signed-off-by: Jagannathan Raman <jag.raman@oracle.com>
Signed-off-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250625193012.2316242-8-john.levon@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio-user/device.c     | 79 +++++++++++++++++++++++++++++++++++++++
 hw/vfio-user/protocol.h   | 12 ++++++
 hw/vfio-user/trace-events |  1 +
 3 files changed, 92 insertions(+)

diff --git a/hw/vfio-user/device.c b/hw/vfio-user/device.c
index d90232a08f..4ef6a2d850 100644
--- a/hw/vfio-user/device.c
+++ b/hw/vfio-user/device.c
@@ -121,9 +121,88 @@ static int vfio_user_device_io_get_region_info(VFIODevice *vbasedev,
     return 0;
 }
 
+static int vfio_user_device_io_region_read(VFIODevice *vbasedev, uint8_t index,
+                                           off_t off, uint32_t count,
+                                           void *data)
+{
+    g_autofree VFIOUserRegionRW *msgp = NULL;
+    VFIOUserProxy *proxy = vbasedev->proxy;
+    int size = sizeof(*msgp) + count;
+    Error *local_err = NULL;
+
+    if (count > proxy->max_xfer_size) {
+        return -EINVAL;
+    }
+
+    msgp = g_malloc0(size);
+    vfio_user_request_msg(&msgp->hdr, VFIO_USER_REGION_READ, sizeof(*msgp), 0);
+    msgp->offset = off;
+    msgp->region = index;
+    msgp->count = count;
+    trace_vfio_user_region_rw(msgp->region, msgp->offset, msgp->count);
+
+    if (!vfio_user_send_wait(proxy, &msgp->hdr, NULL, size, &local_err)) {
+        error_prepend(&local_err, "%s: ", __func__);
+        error_report_err(local_err);
+        return -EFAULT;
+    }
+
+    if (msgp->hdr.flags & VFIO_USER_ERROR) {
+        return -msgp->hdr.error_reply;
+    } else if (msgp->count > count) {
+        return -E2BIG;
+    } else {
+        memcpy(data, &msgp->data, msgp->count);
+    }
+
+    return msgp->count;
+}
+
+static int vfio_user_device_io_region_write(VFIODevice *vbasedev, uint8_t index,
+                                            off_t off, unsigned count,
+                                            void *data, bool post)
+{
+    g_autofree VFIOUserRegionRW *msgp = NULL;
+    VFIOUserProxy *proxy = vbasedev->proxy;
+    int size = sizeof(*msgp) + count;
+    Error *local_err = NULL;
+    int ret;
+
+    if (count > proxy->max_xfer_size) {
+        return -EINVAL;
+    }
+
+    msgp = g_malloc0(size);
+    vfio_user_request_msg(&msgp->hdr, VFIO_USER_REGION_WRITE, size, 0);
+    msgp->offset = off;
+    msgp->region = index;
+    msgp->count = count;
+    memcpy(&msgp->data, data, count);
+    trace_vfio_user_region_rw(msgp->region, msgp->offset, msgp->count);
+
+    /* Ignore post: all writes are synchronous/non-posted. */
+
+    if (!vfio_user_send_wait(proxy, &msgp->hdr, NULL, 0, &local_err)) {
+        error_prepend(&local_err, "%s: ", __func__);
+        error_report_err(local_err);
+        return -EFAULT;
+    }
+
+    if (msgp->hdr.flags & VFIO_USER_ERROR) {
+        ret = -msgp->hdr.error_reply;
+    } else {
+        ret = count;
+    }
+
+    return ret;
+}
+
 /*
  * Socket-based io_ops
  */
 VFIODeviceIOOps vfio_user_device_io_ops_sock = {
     .get_region_info = vfio_user_device_io_get_region_info,
+    .region_read = vfio_user_device_io_region_read,
+    .region_write = vfio_user_device_io_region_write,
+
 };
diff --git a/hw/vfio-user/protocol.h b/hw/vfio-user/protocol.h
index db88f5fcb1..0cd32ad71a 100644
--- a/hw/vfio-user/protocol.h
+++ b/hw/vfio-user/protocol.h
@@ -138,4 +138,16 @@ typedef struct {
     uint64_t offset;
 } VFIOUserRegionInfo;
 
+/*
+ * VFIO_USER_REGION_READ
+ * VFIO_USER_REGION_WRITE
+ */
+typedef struct {
+    VFIOUserHdr hdr;
+    uint64_t offset;
+    uint32_t region;
+    uint32_t count;
+    char data[];
+} VFIOUserRegionRW;
+
 #endif /* VFIO_USER_PROTOCOL_H */
diff --git a/hw/vfio-user/trace-events b/hw/vfio-user/trace-events
index ef3f14c74d..733313cd1f 100644
--- a/hw/vfio-user/trace-events
+++ b/hw/vfio-user/trace-events
@@ -10,3 +10,4 @@ vfio_user_send_write(uint16_t id, int wrote) " id 0x%x wrote 0x%x"
 vfio_user_version(uint16_t major, uint16_t minor, const char *caps) " major %d minor %d caps: %s"
 vfio_user_get_info(uint32_t nregions, uint32_t nirqs) " #regions %d #irqs %d"
 vfio_user_get_region_info(uint32_t index, uint32_t flags, uint64_t size) " index %d flags 0x%x size 0x%"PRIx64
+vfio_user_region_rw(uint32_t region, uint64_t off, uint32_t count) " region %d offset 0x%"PRIx64" count %d"

From 692e0ec50c2f38a7952f7e7c4c375c77b141f6b2 Mon Sep 17 00:00:00 2001
From: John Levon <john.levon@nutanix.com>
Date: Wed, 25 Jun 2025 20:30:00 +0100
Subject: [PATCH 1681/2760] vfio-user: set up PCI in vfio_user_pci_realize()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Re-use PCI setup functions from hw/vfio/pci.c to realize the vfio-user
PCI device.

Originally-by: John Johnson <john.g.johnson@oracle.com>
Signed-off-by: Elena Ufimtseva <elena.ufimtseva@oracle.com>
Signed-off-by: Jagannathan Raman <jag.raman@oracle.com>
Signed-off-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250625193012.2316242-9-john.levon@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio-user/pci.c | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/hw/vfio-user/pci.c b/hw/vfio-user/pci.c
index d704e3d390..b49f42b980 100644
--- a/hw/vfio-user/pci.c
+++ b/hw/vfio-user/pci.c
@@ -126,10 +126,39 @@ static void vfio_user_pci_realize(PCIDevice *pdev, Error **errp)
         goto error;
     }
 
+    if (!vfio_pci_populate_device(vdev, errp)) {
+        goto error;
+    }
+
+    if (!vfio_pci_config_setup(vdev, errp)) {
+        goto error;
+    }
+
+    /*
+     * vfio_pci_config_setup will have registered the device's BARs
+     * and setup any MSIX BARs, so errors after it succeeds must
+     * use out_teardown
+     */
+
+    if (!vfio_pci_add_capabilities(vdev, errp)) {
+        goto out_teardown;
+    }
+
+    if (!vfio_pci_interrupt_setup(vdev, errp)) {
+        goto out_teardown;
+    }
+
+    vfio_pci_register_err_notifier(vdev);
+    vfio_pci_register_req_notifier(vdev);
+
     return;
 
+out_teardown:
+    vfio_pci_teardown_msi(vdev);
+    vfio_pci_bars_exit(vdev);
 error:
     error_prepend(errp, VFIO_MSG_PREFIX, vdev->vbasedev.name);
+    vfio_pci_put_device(vdev);
 }
 
 static void vfio_user_instance_init(Object *obj)

From ca1add1696dd53f905c2a17f36159d54e9b6f527 Mon Sep 17 00:00:00 2001
From: John Levon <john.levon@nutanix.com>
Date: Wed, 25 Jun 2025 20:30:01 +0100
Subject: [PATCH 1682/2760] vfio-user: implement VFIO_USER_DEVICE_GET/SET_IRQ*
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

IRQ setup uses the same semantics as the traditional vfio path, but we
need to share the corresponding file descriptors with the server as
necessary.

Originally-by: John Johnson <john.g.johnson@oracle.com>
Signed-off-by: Elena Ufimtseva <elena.ufimtseva@oracle.com>
Signed-off-by: Jagannathan Raman <jag.raman@oracle.com>
Signed-off-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250625193012.2316242-10-john.levon@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio-user/device.c     | 138 ++++++++++++++++++++++++++++++++++++++
 hw/vfio-user/protocol.h   |  25 +++++++
 hw/vfio-user/trace-events |   2 +
 3 files changed, 165 insertions(+)

diff --git a/hw/vfio-user/device.c b/hw/vfio-user/device.c
index 4ef6a2d850..f01b3925c5 100644
--- a/hw/vfio-user/device.c
+++ b/hw/vfio-user/device.c
@@ -121,6 +121,142 @@ static int vfio_user_device_io_get_region_info(VFIODevice *vbasedev,
     return 0;
 }
 
+static int vfio_user_device_io_get_irq_info(VFIODevice *vbasedev,
+                                            struct vfio_irq_info *info)
+{
+    VFIOUserProxy *proxy = vbasedev->proxy;
+    Error *local_err = NULL;
+    VFIOUserIRQInfo msg;
+
+    memset(&msg, 0, sizeof(msg));
+    vfio_user_request_msg(&msg.hdr, VFIO_USER_DEVICE_GET_IRQ_INFO,
+                          sizeof(msg), 0);
+    msg.argsz = info->argsz;
+    msg.index = info->index;
+
+    if (!vfio_user_send_wait(proxy, &msg.hdr, NULL, 0, &local_err)) {
+        error_prepend(&local_err, "%s: ", __func__);
+        error_report_err(local_err);
+        return -EFAULT;
+    }
+
+    if (msg.hdr.flags & VFIO_USER_ERROR) {
+        return -msg.hdr.error_reply;
+    }
+    trace_vfio_user_get_irq_info(msg.index, msg.flags, msg.count);
+
+    memcpy(info, &msg.argsz, sizeof(*info));
+    return 0;
+}
+
+static int irq_howmany(int *fdp, uint32_t cur, uint32_t max)
+{
+    int n = 0;
+
+    if (fdp[cur] != -1) {
+        do {
+            n++;
+        } while (n < max && fdp[cur + n] != -1);
+    } else {
+        do {
+            n++;
+        } while (n < max && fdp[cur + n] == -1);
+    }
+
+    return n;
+}
+
+static int vfio_user_device_io_set_irqs(VFIODevice *vbasedev,
+                                        struct vfio_irq_set *irq)
+{
+    VFIOUserProxy *proxy = vbasedev->proxy;
+    g_autofree VFIOUserIRQSet *msgp = NULL;
+    uint32_t size, nfds, send_fds, sent_fds, max;
+    Error *local_err = NULL;
+
+    if (irq->argsz < sizeof(*irq)) {
+        error_printf("vfio_user_set_irqs argsz too small\n");
+        return -EINVAL;
+    }
+
+    /*
+     * Handle simple case
+     */
+    if ((irq->flags & VFIO_IRQ_SET_DATA_EVENTFD) == 0) {
+        size = sizeof(VFIOUserHdr) + irq->argsz;
+        msgp = g_malloc0(size);
+
+        vfio_user_request_msg(&msgp->hdr, VFIO_USER_DEVICE_SET_IRQS, size, 0);
+        msgp->argsz = irq->argsz;
+        msgp->flags = irq->flags;
+        msgp->index = irq->index;
+        msgp->start = irq->start;
+        msgp->count = irq->count;
+        trace_vfio_user_set_irqs(msgp->index, msgp->start, msgp->count,
+                                 msgp->flags);
+
+        if (!vfio_user_send_wait(proxy, &msgp->hdr, NULL, 0, &local_err)) {
+            error_prepend(&local_err, "%s: ", __func__);
+            error_report_err(local_err);
+            return -EFAULT;
+        }
+
+        if (msgp->hdr.flags & VFIO_USER_ERROR) {
+            return -msgp->hdr.error_reply;
+        }
+
+        return 0;
+    }
+
+    /*
+     * Calculate the number of FDs to send
+     * and adjust argsz
+     */
+    nfds = (irq->argsz - sizeof(*irq)) / sizeof(int);
+    irq->argsz = sizeof(*irq);
+    msgp = g_malloc0(sizeof(*msgp));
+    /*
+     * Send in chunks if over max_send_fds
+     */
+    for (sent_fds = 0; nfds > sent_fds; sent_fds += send_fds) {
+        VFIOUserFDs *arg_fds, loop_fds;
+
+        /* must send all valid FDs or all invalid FDs in single msg */
+        max = nfds - sent_fds;
+        if (max > proxy->max_send_fds) {
+            max = proxy->max_send_fds;
+        }
+        send_fds = irq_howmany((int *)irq->data, sent_fds, max);
+
+        vfio_user_request_msg(&msgp->hdr, VFIO_USER_DEVICE_SET_IRQS,
+                              sizeof(*msgp), 0);
+        msgp->argsz = irq->argsz;
+        msgp->flags = irq->flags;
+        msgp->index = irq->index;
+        msgp->start = irq->start + sent_fds;
+        msgp->count = send_fds;
+        trace_vfio_user_set_irqs(msgp->index, msgp->start, msgp->count,
+                                 msgp->flags);
+
+        loop_fds.send_fds = send_fds;
+        loop_fds.recv_fds = 0;
+        loop_fds.fds = (int *)irq->data + sent_fds;
+        arg_fds = loop_fds.fds[0] != -1 ? &loop_fds : NULL;
+
+        if (!vfio_user_send_wait(proxy, &msgp->hdr, arg_fds, 0, &local_err)) {
+            error_prepend(&local_err, "%s: ", __func__);
+            error_report_err(local_err);
+            return -EFAULT;
+        }
+
+        if (msgp->hdr.flags & VFIO_USER_ERROR) {
+            return -msgp->hdr.error_reply;
+        }
+    }
+
+    return 0;
+}
+
 static int vfio_user_device_io_region_read(VFIODevice *vbasedev, uint8_t index,
                                            off_t off, uint32_t count,
                                            void *data)
@@ -202,6 +338,8 @@ static int vfio_user_device_io_region_write(VFIODevice *vbasedev, uint8_t index,
  */
 VFIODeviceIOOps vfio_user_device_io_ops_sock = {
     .get_region_info = vfio_user_device_io_get_region_info,
+    .get_irq_info = vfio_user_device_io_get_irq_info,
+    .set_irqs = vfio_user_device_io_set_irqs,
     .region_read = vfio_user_device_io_region_read,
     .region_write = vfio_user_device_io_region_write,
 
diff --git a/hw/vfio-user/protocol.h b/hw/vfio-user/protocol.h
index 0cd32ad71a..48144b2c33 100644
--- a/hw/vfio-user/protocol.h
+++ b/hw/vfio-user/protocol.h
@@ -138,6 +138,31 @@ typedef struct {
     uint64_t offset;
 } VFIOUserRegionInfo;
 
+/*
+ * VFIO_USER_DEVICE_GET_IRQ_INFO
+ * imported from struct vfio_irq_info
+ */
+typedef struct {
+    VFIOUserHdr hdr;
+    uint32_t argsz;
+    uint32_t flags;
+    uint32_t index;
+    uint32_t count;
+} VFIOUserIRQInfo;
+
+/*
+ * VFIO_USER_DEVICE_SET_IRQS
+ * imported from struct vfio_irq_set
+ */
+typedef struct {
+    VFIOUserHdr hdr;
+    uint32_t argsz;
+    uint32_t flags;
+    uint32_t index;
+    uint32_t start;
+    uint32_t count;
+} VFIOUserIRQSet;
+
 /*
  * VFIO_USER_REGION_READ
  * VFIO_USER_REGION_WRITE
diff --git a/hw/vfio-user/trace-events b/hw/vfio-user/trace-events
index 733313cd1f..aa8f3c3d4d 100644
--- a/hw/vfio-user/trace-events
+++ b/hw/vfio-user/trace-events
@@ -11,3 +11,5 @@ vfio_user_version(uint16_t major, uint16_t minor, const char *caps) " major %d m
 vfio_user_get_info(uint32_t nregions, uint32_t nirqs) " #regions %d #irqs %d"
 vfio_user_get_region_info(uint32_t index, uint32_t flags, uint64_t size) " index %d flags 0x%x size 0x%"PRIx64
 vfio_user_region_rw(uint32_t region, uint64_t off, uint32_t count) " region %d offset 0x%"PRIx64" count %d"
+vfio_user_get_irq_info(uint32_t index, uint32_t flags, uint32_t count) " index %d flags 0x%x count %d"
+vfio_user_set_irqs(uint32_t index, uint32_t start, uint32_t count, uint32_t flags) " index %d start %d count %d flags 0x%x"

From 777e45c7b914583ca83ace7601d9cf90ddf1f3fd Mon Sep 17 00:00:00 2001
From: John Levon <john.levon@nutanix.com>
Date: Wed, 25 Jun 2025 20:30:02 +0100
Subject: [PATCH 1683/2760] vfio-user: forward MSI-X PBA BAR accesses to server
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

For vfio-user, the server holds the pending IRQ state; set up an I/O
region for the MSI-X PBA so we can ask the server for this state on a
PBA read.

Originally-by: John Johnson <john.g.johnson@oracle.com>
Signed-off-by: Elena Ufimtseva <elena.ufimtseva@oracle.com>
Signed-off-by: Jagannathan Raman <jag.raman@oracle.com>
Signed-off-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250625193012.2316242-11-john.levon@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio-user/pci.c | 64 ++++++++++++++++++++++++++++++++++++++++++++++
 hw/vfio/pci.h      |  1 +
 2 files changed, 65 insertions(+)

diff --git a/hw/vfio-user/pci.c b/hw/vfio-user/pci.c
index b49f42b980..c0f00f15b1 100644
--- a/hw/vfio-user/pci.c
+++ b/hw/vfio-user/pci.c
@@ -24,6 +24,62 @@ struct VFIOUserPCIDevice {
     bool send_queued;   /* all sends are queued */
 };
 
+/*
+ * The server maintains the device's pending interrupts,
+ * via its MSIX table and PBA, so we treat these accesses
+ * like PCI config space and forward them.
+ */
+static uint64_t vfio_user_pba_read(void *opaque, hwaddr addr,
+                                   unsigned size)
+{
+    VFIOPCIDevice *vdev = opaque;
+    VFIORegion *region = &vdev->bars[vdev->msix->pba_bar].region;
+    uint64_t data;
+
+    /* server copy is what matters */
+    data = vfio_region_read(region, addr + vdev->msix->pba_offset, size);
+    return data;
+}
+
+static void vfio_user_pba_write(void *opaque, hwaddr addr,
+                                  uint64_t data, unsigned size)
+{
+    /* dropped */
+}
+
+static const MemoryRegionOps vfio_user_pba_ops = {
+    .read = vfio_user_pba_read,
+    .write = vfio_user_pba_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+};
+
+static void vfio_user_msix_setup(VFIOPCIDevice *vdev)
+{
+    MemoryRegion *vfio_reg, *msix_reg, *pba_reg;
+
+    pba_reg = g_new0(MemoryRegion, 1);
+    vdev->msix->pba_region = pba_reg;
+
+    vfio_reg = vdev->bars[vdev->msix->pba_bar].mr;
+    msix_reg = &vdev->pdev.msix_pba_mmio;
+    memory_region_init_io(pba_reg, OBJECT(vdev), &vfio_user_pba_ops, vdev,
+                          "VFIO MSIX PBA", int128_get64(msix_reg->size));
+    memory_region_add_subregion_overlap(vfio_reg, vdev->msix->pba_offset,
+                                        pba_reg, 1);
+}
+
+static void vfio_user_msix_teardown(VFIOPCIDevice *vdev)
+{
+    MemoryRegion *mr, *sub;
+
+    mr = vdev->bars[vdev->msix->pba_bar].mr;
+    sub = vdev->msix->pba_region;
+    memory_region_del_subregion(mr, sub);
+
+    g_free(vdev->msix->pba_region);
+    vdev->msix->pba_region = NULL;
+}
+
 /*
  * Incoming request message callback.
  *
@@ -144,6 +200,10 @@ static void vfio_user_pci_realize(PCIDevice *pdev, Error **errp)
         goto out_teardown;
     }
 
+    if (vdev->msix != NULL) {
+        vfio_user_msix_setup(vdev);
+    }
+
     if (!vfio_pci_interrupt_setup(vdev, errp)) {
         goto out_teardown;
     }
@@ -192,6 +252,10 @@ static void vfio_user_instance_finalize(Object *obj)
     VFIOPCIDevice *vdev = VFIO_PCI_BASE(obj);
     VFIODevice *vbasedev = &vdev->vbasedev;
 
+    if (vdev->msix != NULL) {
+        vfio_user_msix_teardown(vdev);
+    }
+
     vfio_pci_put_device(vdev);
 
     if (vbasedev->proxy != NULL) {
diff --git a/hw/vfio/pci.h b/hw/vfio/pci.h
index d3dc2274a9..5ba7330b27 100644
--- a/hw/vfio/pci.h
+++ b/hw/vfio/pci.h
@@ -116,6 +116,7 @@ typedef struct VFIOMSIXInfo {
     uint32_t pba_offset;
     unsigned long *pending;
     bool noresize;
+    MemoryRegion *pba_region;
 } VFIOMSIXInfo;
 
 /*

From 52ce9c35f8e364e5823fc13f23929eb597bb69ac Mon Sep 17 00:00:00 2001
From: John Levon <john.levon@nutanix.com>
Date: Wed, 25 Jun 2025 20:30:03 +0100
Subject: [PATCH 1684/2760] vfio-user: set up container access to the proxy
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The user container will shortly need access to the underlying vfio-user
proxy; set this up.

Originally-by: John Johnson <john.g.johnson@oracle.com>
Signed-off-by: Elena Ufimtseva <elena.ufimtseva@oracle.com>
Signed-off-by: Jagannathan Raman <jag.raman@oracle.com>
Signed-off-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250625193012.2316242-12-john.levon@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio-user/container.c | 43 +++++++++++++++++++++++++++++++---------
 hw/vfio-user/container.h |  2 ++
 2 files changed, 36 insertions(+), 9 deletions(-)

diff --git a/hw/vfio-user/container.c b/hw/vfio-user/container.c
index f5bfd54316..b4a5a840b0 100644
--- a/hw/vfio-user/container.c
+++ b/hw/vfio-user/container.c
@@ -49,15 +49,28 @@ static int vfio_user_query_dirty_bitmap(const VFIOContainerBase *bcontainer,
 
 static bool vfio_user_setup(VFIOContainerBase *bcontainer, Error **errp)
 {
-    error_setg_errno(errp, ENOTSUP, "Not supported");
-    return -ENOTSUP;
+    VFIOUserContainer *container = container_of(bcontainer, VFIOUserContainer,
+                                                bcontainer);
+
+    assert(container->proxy->dma_pgsizes != 0);
+    bcontainer->pgsizes = container->proxy->dma_pgsizes;
+    bcontainer->dma_max_mappings = container->proxy->max_dma;
+
+    /* No live migration support yet. */
+    bcontainer->dirty_pages_supported = false;
+    bcontainer->max_dirty_bitmap_size = container->proxy->max_bitmap;
+    bcontainer->dirty_pgsizes = container->proxy->migr_pgsize;
+
+    return true;
 }
 
-static VFIOUserContainer *vfio_user_create_container(Error **errp)
+static VFIOUserContainer *vfio_user_create_container(VFIODevice *vbasedev,
+                                                     Error **errp)
 {
     VFIOUserContainer *container;
 
     container = VFIO_IOMMU_USER(object_new(TYPE_VFIO_IOMMU_USER));
+    container->proxy = vbasedev->proxy;
     return container;
 }
 
@@ -65,16 +78,18 @@ static VFIOUserContainer *vfio_user_create_container(Error **errp)
  * Try to mirror vfio_container_connect() as much as possible.
  */
 static VFIOUserContainer *
-vfio_user_container_connect(AddressSpace *as, Error **errp)
+vfio_user_container_connect(AddressSpace *as, VFIODevice *vbasedev,
+                            Error **errp)
 {
     VFIOContainerBase *bcontainer;
     VFIOUserContainer *container;
     VFIOAddressSpace *space;
     VFIOIOMMUClass *vioc;
+    int ret;
 
     space = vfio_address_space_get(as);
 
-    container = vfio_user_create_container(errp);
+    container = vfio_user_create_container(vbasedev, errp);
     if (!container) {
         goto put_space_exit;
     }
@@ -85,11 +100,17 @@ vfio_user_container_connect(AddressSpace *as, Error **errp)
         goto free_container_exit;
     }
 
+    ret = ram_block_uncoordinated_discard_disable(true);
+    if (ret) {
+        error_setg_errno(errp, -ret, "Cannot set discarding of RAM broken");
+        goto unregister_container_exit;
+    }
+
     vioc = VFIO_IOMMU_GET_CLASS(bcontainer);
     assert(vioc->setup);
 
     if (!vioc->setup(bcontainer, errp)) {
-        goto unregister_container_exit;
+        goto enable_discards_exit;
     }
 
     vfio_address_space_insert(space, bcontainer);
@@ -108,6 +129,9 @@ listener_release_exit:
         vioc->release(bcontainer);
     }
 
+enable_discards_exit:
+    ram_block_uncoordinated_discard_disable(false);
+
 unregister_container_exit:
     vfio_cpr_unregister_container(bcontainer);
 
@@ -124,14 +148,15 @@ static void vfio_user_container_disconnect(VFIOUserContainer *container)
 {
     VFIOContainerBase *bcontainer = &container->bcontainer;
     VFIOIOMMUClass *vioc = VFIO_IOMMU_GET_CLASS(bcontainer);
+    VFIOAddressSpace *space = bcontainer->space;
+
+    ram_block_uncoordinated_discard_disable(false);
 
     vfio_listener_unregister(bcontainer);
     if (vioc->release) {
         vioc->release(bcontainer);
     }
 
-    VFIOAddressSpace *space = bcontainer->space;
-
     vfio_cpr_unregister_container(bcontainer);
     object_unref(container);
 
@@ -163,7 +188,7 @@ static bool vfio_user_device_attach(const char *name, VFIODevice *vbasedev,
 {
     VFIOUserContainer *container;
 
-    container = vfio_user_container_connect(as, errp);
+    container = vfio_user_container_connect(as, vbasedev, errp);
     if (container == NULL) {
         error_prepend(errp, "failed to connect proxy");
         return false;
diff --git a/hw/vfio-user/container.h b/hw/vfio-user/container.h
index e4a46d2c1b..2bb1fa1343 100644
--- a/hw/vfio-user/container.h
+++ b/hw/vfio-user/container.h
@@ -10,10 +10,12 @@
 #include "qemu/osdep.h"
 
 #include "hw/vfio/vfio-container-base.h"
+#include "hw/vfio-user/proxy.h"
 
 /* MMU container sub-class for vfio-user. */
 typedef struct VFIOUserContainer {
     VFIOContainerBase bcontainer;
+    VFIOUserProxy *proxy;
 } VFIOUserContainer;
 
 OBJECT_DECLARE_SIMPLE_TYPE(VFIOUserContainer, VFIO_IOMMU_USER);

From 019232358124e4f4b929e40fa23253de60eec73e Mon Sep 17 00:00:00 2001
From: John Levon <john.levon@nutanix.com>
Date: Wed, 25 Jun 2025 20:30:04 +0100
Subject: [PATCH 1685/2760] vfio-user: implement VFIO_USER_DEVICE_RESET
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Hook this call up to the legacy reset handler for vfio-user-pci.

Originally-by: John Johnson <john.g.johnson@oracle.com>
Signed-off-by: Elena Ufimtseva <elena.ufimtseva@oracle.com>
Signed-off-by: Jagannathan Raman <jag.raman@oracle.com>
Signed-off-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250625193012.2316242-13-john.levon@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio-user/device.c | 18 ++++++++++++++++++
 hw/vfio-user/device.h |  2 ++
 hw/vfio-user/pci.c    | 15 +++++++++++++++
 3 files changed, 35 insertions(+)

diff --git a/hw/vfio-user/device.c b/hw/vfio-user/device.c
index f01b3925c5..3a118e7361 100644
--- a/hw/vfio-user/device.c
+++ b/hw/vfio-user/device.c
@@ -54,6 +54,24 @@ bool vfio_user_get_device_info(VFIOUserProxy *proxy,
     return true;
 }
 
+void vfio_user_device_reset(VFIOUserProxy *proxy)
+{
+    Error *local_err = NULL;
+    VFIOUserHdr hdr;
+
+    vfio_user_request_msg(&hdr, VFIO_USER_DEVICE_RESET, sizeof(hdr), 0);
+
+    if (!vfio_user_send_wait(proxy, &hdr, NULL, 0, &local_err)) {
+        error_prepend(&local_err, "%s: ", __func__);
+        error_report_err(local_err);
+        return;
+    }
+
+    if (hdr.flags & VFIO_USER_ERROR) {
+        error_printf("reset reply error %d\n", hdr.error_reply);
+    }
+}
+
 static int vfio_user_get_region_info(VFIOUserProxy *proxy,
                                      struct vfio_region_info *info,
                                      VFIOUserFDs *fds)
diff --git a/hw/vfio-user/device.h b/hw/vfio-user/device.h
index 619c0f3140..d183a3950e 100644
--- a/hw/vfio-user/device.h
+++ b/hw/vfio-user/device.h
@@ -17,6 +17,8 @@
 bool vfio_user_get_device_info(VFIOUserProxy *proxy,
                                struct vfio_device_info *info, Error **errp);
 
+void vfio_user_device_reset(VFIOUserProxy *proxy);
+
 extern VFIODeviceIOOps vfio_user_device_io_ops_sock;
 
 #endif /* VFIO_USER_DEVICE_H */
diff --git a/hw/vfio-user/pci.c b/hw/vfio-user/pci.c
index c0f00f15b1..49d12763ab 100644
--- a/hw/vfio-user/pci.c
+++ b/hw/vfio-user/pci.c
@@ -263,6 +263,20 @@ static void vfio_user_instance_finalize(Object *obj)
     }
 }
 
+static void vfio_user_pci_reset(DeviceState *dev)
+{
+    VFIOPCIDevice *vdev = VFIO_PCI_BASE(dev);
+    VFIODevice *vbasedev = &vdev->vbasedev;
+
+    vfio_pci_pre_reset(vdev);
+
+    if (vbasedev->reset_works) {
+        vfio_user_device_reset(vbasedev->proxy);
+    }
+
+    vfio_pci_post_reset(vdev);
+}
+
 static const Property vfio_user_pci_dev_properties[] = {
     DEFINE_PROP_UINT32("x-pci-vendor-id", VFIOPCIDevice,
                        vendor_id, PCI_ANY_ID),
@@ -310,6 +324,7 @@ static void vfio_user_pci_dev_class_init(ObjectClass *klass, const void *data)
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *pdc = PCI_DEVICE_CLASS(klass);
 
+    device_class_set_legacy_reset(dc, vfio_user_pci_reset);
     device_class_set_props(dc, vfio_user_pci_dev_properties);
 
     object_class_property_add(klass, "socket", "SocketAddress", NULL,

From 18e899e63dd9d05e567c081023ad7fc5b2c5dc9a Mon Sep 17 00:00:00 2001
From: John Levon <levon@movementarian.org>
Date: Wed, 25 Jun 2025 20:30:05 +0100
Subject: [PATCH 1686/2760] vfio-user: implement VFIO_USER_DMA_MAP/UNMAP
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When the vfio-user container gets mapping updates, share them with the
vfio-user by sending a message; this can include the region fd, allowing
the server to directly mmap() the region as needed.

For performance, we only wait for the message responses when we're doing
with a series of updates via the listener_commit() callback.

Originally-by: John Johnson <john.g.johnson@oracle.com>
Signed-off-by: Jagannathan Raman <jag.raman@oracle.com>
Signed-off-by: Elena Ufimtseva <elena.ufimtseva@oracle.com>
Signed-off-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250625193012.2316242-14-john.levon@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio-user/container.c  | 135 +++++++++++++++++++++++++++++++++++++-
 hw/vfio-user/protocol.h   |  32 +++++++++
 hw/vfio-user/proxy.c      |  84 +++++++++++++++++++++++-
 hw/vfio-user/proxy.h      |   6 ++
 hw/vfio-user/trace-events |   4 ++
 5 files changed, 257 insertions(+), 4 deletions(-)

diff --git a/hw/vfio-user/container.c b/hw/vfio-user/container.c
index b4a5a840b0..3133fef177 100644
--- a/hw/vfio-user/container.c
+++ b/hw/vfio-user/container.c
@@ -12,23 +12,152 @@
 
 #include "hw/vfio-user/container.h"
 #include "hw/vfio-user/device.h"
+#include "hw/vfio-user/trace.h"
 #include "hw/vfio/vfio-cpr.h"
 #include "hw/vfio/vfio-device.h"
 #include "hw/vfio/vfio-listener.h"
 #include "qapi/error.h"
 
+/*
+ * When DMA space is the physical address space, the region add/del listeners
+ * will fire during memory update transactions.  These depend on BQL being held,
+ * so do any resulting map/demap ops async while keeping BQL.
+ */
+static void vfio_user_listener_begin(VFIOContainerBase *bcontainer)
+{
+    VFIOUserContainer *container = container_of(bcontainer, VFIOUserContainer,
+                                                 bcontainer);
+
+    container->proxy->async_ops = true;
+}
+
+static void vfio_user_listener_commit(VFIOContainerBase *bcontainer)
+{
+    VFIOUserContainer *container = container_of(bcontainer, VFIOUserContainer,
+                                            bcontainer);
+
+    /* wait here for any async requests sent during the transaction */
+    container->proxy->async_ops = false;
+    vfio_user_wait_reqs(container->proxy);
+}
+
 static int vfio_user_dma_unmap(const VFIOContainerBase *bcontainer,
                                hwaddr iova, ram_addr_t size,
                                IOMMUTLBEntry *iotlb, bool unmap_all)
 {
-    return -ENOTSUP;
+    VFIOUserContainer *container = container_of(bcontainer, VFIOUserContainer,
+                                            bcontainer);
+    Error *local_err = NULL;
+    int ret = 0;
+
+    VFIOUserDMAUnmap *msgp = g_malloc(sizeof(*msgp));
+
+    vfio_user_request_msg(&msgp->hdr, VFIO_USER_DMA_UNMAP, sizeof(*msgp), 0);
+    msgp->argsz = sizeof(struct vfio_iommu_type1_dma_unmap);
+    msgp->flags = unmap_all ? VFIO_DMA_UNMAP_FLAG_ALL : 0;
+    msgp->iova = iova;
+    msgp->size = size;
+    trace_vfio_user_dma_unmap(msgp->iova, msgp->size, msgp->flags,
+                              container->proxy->async_ops);
+
+    if (container->proxy->async_ops) {
+        if (!vfio_user_send_nowait(container->proxy, &msgp->hdr, NULL,
+                              0, &local_err)) {
+            error_report_err(local_err);
+            ret = -EFAULT;
+        } else {
+            ret = 0;
+        }
+    } else {
+        if (!vfio_user_send_wait(container->proxy, &msgp->hdr, NULL,
+                                 0, &local_err)) {
+                error_report_err(local_err);
+                ret = -EFAULT;
+        }
+
+        if (msgp->hdr.flags & VFIO_USER_ERROR) {
+            ret = -msgp->hdr.error_reply;
+        }
+
+        g_free(msgp);
+    }
+
+    return ret;
 }
 
 static int vfio_user_dma_map(const VFIOContainerBase *bcontainer, hwaddr iova,
                              ram_addr_t size, void *vaddr, bool readonly,
                              MemoryRegion *mrp)
 {
-    return -ENOTSUP;
+    VFIOUserContainer *container = container_of(bcontainer, VFIOUserContainer,
+                                                bcontainer);
+    int fd = memory_region_get_fd(mrp);
+    Error *local_err = NULL;
+    int ret;
+
+    VFIOUserFDs *fds = NULL;
+    VFIOUserDMAMap *msgp = g_malloc0(sizeof(*msgp));
+
+    vfio_user_request_msg(&msgp->hdr, VFIO_USER_DMA_MAP, sizeof(*msgp), 0);
+    msgp->argsz = sizeof(struct vfio_iommu_type1_dma_map);
+    msgp->flags = VFIO_DMA_MAP_FLAG_READ;
+    msgp->offset = 0;
+    msgp->iova = iova;
+    msgp->size = size;
+
+    /*
+     * vaddr enters as a QEMU process address; make it either a file offset
+     * for mapped areas or leave as 0.
+     */
+    if (fd != -1) {
+        msgp->offset = qemu_ram_block_host_offset(mrp->ram_block, vaddr);
+    }
+
+    if (!readonly) {
+        msgp->flags |= VFIO_DMA_MAP_FLAG_WRITE;
+    }
+
+    trace_vfio_user_dma_map(msgp->iova, msgp->size, msgp->offset, msgp->flags,
+                            container->proxy->async_ops);
+
+    /*
+     * The async_ops case sends without blocking. They're later waited for in
+     * vfio_send_wait_reqs.
+     */
+    if (container->proxy->async_ops) {
+        /* can't use auto variable since we don't block */
+        if (fd != -1) {
+            fds = vfio_user_getfds(1);
+            fds->send_fds = 1;
+            fds->fds[0] = fd;
+        }
+
+        if (!vfio_user_send_nowait(container->proxy, &msgp->hdr, fds,
+                              0, &local_err)) {
+            error_report_err(local_err);
+            ret = -EFAULT;
+        } else {
+            ret = 0;
+        }
+    } else {
+        VFIOUserFDs local_fds = { 1, 0, &fd };
+
+        fds = fd != -1 ? &local_fds : NULL;
+
+        if (!vfio_user_send_wait(container->proxy, &msgp->hdr, fds,
+                                 0, &local_err)) {
+                error_report_err(local_err);
+                ret = -EFAULT;
+        }
+
+        if (msgp->hdr.flags & VFIO_USER_ERROR) {
+            ret = -msgp->hdr.error_reply;
+        }
+
+        g_free(msgp);
+    }
+
+    return ret;
 }
 
 static int
@@ -218,6 +347,8 @@ static void vfio_iommu_user_class_init(ObjectClass *klass, const void *data)
     VFIOIOMMUClass *vioc = VFIO_IOMMU_CLASS(klass);
 
     vioc->setup = vfio_user_setup;
+    vioc->listener_begin = vfio_user_listener_begin,
+    vioc->listener_commit = vfio_user_listener_commit,
     vioc->dma_map = vfio_user_dma_map;
     vioc->dma_unmap = vfio_user_dma_unmap;
     vioc->attach_device = vfio_user_device_attach;
diff --git a/hw/vfio-user/protocol.h b/hw/vfio-user/protocol.h
index 48144b2c33..524f3d633a 100644
--- a/hw/vfio-user/protocol.h
+++ b/hw/vfio-user/protocol.h
@@ -112,6 +112,31 @@ typedef struct {
  */
 #define VFIO_USER_DEF_MAX_BITMAP (256 * 1024 * 1024)
 
+/*
+ * VFIO_USER_DMA_MAP
+ * imported from struct vfio_iommu_type1_dma_map
+ */
+typedef struct {
+    VFIOUserHdr hdr;
+    uint32_t argsz;
+    uint32_t flags;
+    uint64_t offset;    /* FD offset */
+    uint64_t iova;
+    uint64_t size;
+} VFIOUserDMAMap;
+
+/*
+ * VFIO_USER_DMA_UNMAP
+ * imported from struct vfio_iommu_type1_dma_unmap
+ */
+typedef struct {
+    VFIOUserHdr hdr;
+    uint32_t argsz;
+    uint32_t flags;
+    uint64_t iova;
+    uint64_t size;
+} VFIOUserDMAUnmap;
+
 /*
  * VFIO_USER_DEVICE_GET_INFO
  * imported from struct vfio_device_info
@@ -175,4 +200,11 @@ typedef struct {
     char data[];
 } VFIOUserRegionRW;
 
+/*imported from struct vfio_bitmap */
+typedef struct {
+    uint64_t pgsize;
+    uint64_t size;
+    char data[];
+} VFIOUserBitmap;
+
 #endif /* VFIO_USER_PROTOCOL_H */
diff --git a/hw/vfio-user/proxy.c b/hw/vfio-user/proxy.c
index aed7b22e2a..c8ae8a59b4 100644
--- a/hw/vfio-user/proxy.c
+++ b/hw/vfio-user/proxy.c
@@ -27,7 +27,6 @@ static IOThread *vfio_user_iothread;
 static void vfio_user_shutdown(VFIOUserProxy *proxy);
 static VFIOUserMsg *vfio_user_getmsg(VFIOUserProxy *proxy, VFIOUserHdr *hdr,
                                      VFIOUserFDs *fds);
-static VFIOUserFDs *vfio_user_getfds(int numfds);
 static void vfio_user_recycle(VFIOUserProxy *proxy, VFIOUserMsg *msg);
 
 static void vfio_user_recv(void *opaque);
@@ -132,7 +131,7 @@ static void vfio_user_recycle(VFIOUserProxy *proxy, VFIOUserMsg *msg)
     QTAILQ_INSERT_HEAD(&proxy->free, msg, next);
 }
 
-static VFIOUserFDs *vfio_user_getfds(int numfds)
+VFIOUserFDs *vfio_user_getfds(int numfds)
 {
     VFIOUserFDs *fds = g_malloc0(sizeof(*fds) + (numfds * sizeof(int)));
 
@@ -618,6 +617,43 @@ static bool vfio_user_send_queued(VFIOUserProxy *proxy, VFIOUserMsg *msg,
     return true;
 }
 
+/*
+ * nowait send - vfio_wait_reqs() can wait for it later
+ *
+ * Returns false if we did not successfully receive a reply message, in which
+ * case @errp will be populated.
+ *
+ * In either case, ownership of @hdr and @fds is taken, and the caller must
+ * *not* free them itself.
+ */
+bool vfio_user_send_nowait(VFIOUserProxy *proxy, VFIOUserHdr *hdr,
+                           VFIOUserFDs *fds, int rsize, Error **errp)
+{
+    VFIOUserMsg *msg;
+
+    QEMU_LOCK_GUARD(&proxy->lock);
+
+    msg = vfio_user_getmsg(proxy, hdr, fds);
+    msg->id = hdr->id;
+    msg->rsize = rsize ? rsize : hdr->size;
+    msg->type = VFIO_MSG_NOWAIT;
+
+    if (hdr->flags & VFIO_USER_NO_REPLY) {
+        error_setg_errno(errp, EINVAL, "%s on NO_REPLY message", __func__);
+        vfio_user_recycle(proxy, msg);
+        return false;
+    }
+
+    if (!vfio_user_send_queued(proxy, msg, errp)) {
+        vfio_user_recycle(proxy, msg);
+        return false;
+    }
+
+    proxy->last_nowait = msg;
+
+    return true;
+}
+
 /*
  * Returns false if we did not successfully receive a reply message, in which
  * case @errp will be populated.
@@ -666,6 +702,50 @@ bool vfio_user_send_wait(VFIOUserProxy *proxy, VFIOUserHdr *hdr,
     return ok;
 }
 
+void vfio_user_wait_reqs(VFIOUserProxy *proxy)
+{
+    VFIOUserMsg *msg;
+
+    /*
+     * Any DMA map/unmap requests sent in the middle
+     * of a memory region transaction were sent nowait.
+     * Wait for them here.
+     */
+    qemu_mutex_lock(&proxy->lock);
+    if (proxy->last_nowait != NULL) {
+        /*
+         * Change type to WAIT to wait for reply
+         */
+        msg = proxy->last_nowait;
+        msg->type = VFIO_MSG_WAIT;
+        proxy->last_nowait = NULL;
+        while (!msg->complete) {
+            if (!qemu_cond_timedwait(&msg->cv, &proxy->lock, wait_time)) {
+                VFIOUserMsgQ *list;
+
+                list = msg->pending ? &proxy->pending : &proxy->outgoing;
+                QTAILQ_REMOVE(list, msg, next);
+                error_printf("vfio_wait_reqs - timed out\n");
+                break;
+            }
+        }
+
+        if (msg->hdr->flags & VFIO_USER_ERROR) {
+            error_printf("vfio_user_wait_reqs - error reply on async ");
+            error_printf("request: command %x error %s\n", msg->hdr->command,
+                         strerror(msg->hdr->error_reply));
+        }
+
+        /*
+         * Change type back to NOWAIT to free
+         */
+        msg->type = VFIO_MSG_NOWAIT;
+        vfio_user_recycle(proxy, msg);
+    }
+
+    qemu_mutex_unlock(&proxy->lock);
+}
+
 static QLIST_HEAD(, VFIOUserProxy) vfio_user_sockets =
     QLIST_HEAD_INITIALIZER(vfio_user_sockets);
 
diff --git a/hw/vfio-user/proxy.h b/hw/vfio-user/proxy.h
index ba1c33aba8..e2fc83ca3b 100644
--- a/hw/vfio-user/proxy.h
+++ b/hw/vfio-user/proxy.h
@@ -70,6 +70,7 @@ typedef struct VFIOUserProxy {
     QemuCond close_cv;
     AioContext *ctx;
     QEMUBH *req_bh;
+    bool async_ops;
 
     /*
      * above only changed when BQL is held
@@ -99,9 +100,14 @@ void vfio_user_set_handler(VFIODevice *vbasedev,
                            void *reqarg);
 bool vfio_user_validate_version(VFIOUserProxy *proxy, Error **errp);
 
+VFIOUserFDs *vfio_user_getfds(int numfds);
+
 void vfio_user_request_msg(VFIOUserHdr *hdr, uint16_t cmd,
                            uint32_t size, uint32_t flags);
+void vfio_user_wait_reqs(VFIOUserProxy *proxy);
 bool vfio_user_send_wait(VFIOUserProxy *proxy, VFIOUserHdr *hdr,
                          VFIOUserFDs *fds, int rsize, Error **errp);
+bool vfio_user_send_nowait(VFIOUserProxy *proxy, VFIOUserHdr *hdr,
+                           VFIOUserFDs *fds, int rsize, Error **errp);
 
 #endif /* VFIO_USER_PROXY_H */
diff --git a/hw/vfio-user/trace-events b/hw/vfio-user/trace-events
index aa8f3c3d4d..44dde020b3 100644
--- a/hw/vfio-user/trace-events
+++ b/hw/vfio-user/trace-events
@@ -13,3 +13,7 @@ vfio_user_get_region_info(uint32_t index, uint32_t flags, uint64_t size) " index
 vfio_user_region_rw(uint32_t region, uint64_t off, uint32_t count) " region %d offset 0x%"PRIx64" count %d"
 vfio_user_get_irq_info(uint32_t index, uint32_t flags, uint32_t count) " index %d flags 0x%x count %d"
 vfio_user_set_irqs(uint32_t index, uint32_t start, uint32_t count, uint32_t flags) " index %d start %d count %d flags 0x%x"
+
+# container.c
+vfio_user_dma_map(uint64_t iova, uint64_t size, uint64_t off, uint32_t flags, bool async_ops) " iova 0x%"PRIx64" size 0x%"PRIx64" off 0x%"PRIx64" flags 0x%x async_ops %d"
+vfio_user_dma_unmap(uint64_t iova, uint64_t size, uint32_t flags,  bool async_ops) " iova 0x%"PRIx64" size 0x%"PRIx64" flags 0x%x async_ops %d"

From c6ac52a4d8f7a7c03452454d36b60ac309f0b9ce Mon Sep 17 00:00:00 2001
From: John Levon <john.levon@nutanix.com>
Date: Wed, 25 Jun 2025 20:30:06 +0100
Subject: [PATCH 1687/2760] vfio-user: implement VFIO_USER_DMA_READ/WRITE
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Unlike most other messages, this is a server->client message, for when a
server wants to do "DMA"; this is slow, so normally the server has
memory directly mapped instead.

Originally-by: John Johnson <john.g.johnson@oracle.com>
Signed-off-by: Elena Ufimtseva <elena.ufimtseva@oracle.com>
Signed-off-by: Jagannathan Raman <jag.raman@oracle.com>
Signed-off-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250625193012.2316242-15-john.levon@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio-user/pci.c      | 111 ++++++++++++++++++++++++++++++++++++++++
 hw/vfio-user/protocol.h |  13 ++++-
 hw/vfio-user/proxy.c    |  97 +++++++++++++++++++++++++++++++++++
 hw/vfio-user/proxy.h    |   3 ++
 4 files changed, 223 insertions(+), 1 deletion(-)

diff --git a/hw/vfio-user/pci.c b/hw/vfio-user/pci.c
index 49d12763ab..040660d197 100644
--- a/hw/vfio-user/pci.c
+++ b/hw/vfio-user/pci.c
@@ -9,6 +9,7 @@
 #include <sys/ioctl.h>
 #include "qemu/osdep.h"
 #include "qapi-visit-sockets.h"
+#include "qemu/error-report.h"
 
 #include "hw/qdev-properties.h"
 #include "hw/vfio/pci.h"
@@ -80,6 +81,95 @@ static void vfio_user_msix_teardown(VFIOPCIDevice *vdev)
     vdev->msix->pba_region = NULL;
 }
 
+static void vfio_user_dma_read(VFIOPCIDevice *vdev, VFIOUserDMARW *msg)
+{
+    PCIDevice *pdev = &vdev->pdev;
+    VFIOUserProxy *proxy = vdev->vbasedev.proxy;
+    VFIOUserDMARW *res;
+    MemTxResult r;
+    size_t size;
+
+    if (msg->hdr.size < sizeof(*msg)) {
+        vfio_user_send_error(proxy, &msg->hdr, EINVAL);
+        return;
+    }
+    if (msg->count > proxy->max_xfer_size) {
+        vfio_user_send_error(proxy, &msg->hdr, E2BIG);
+        return;
+    }
+
+    /* switch to our own message buffer */
+    size = msg->count + sizeof(VFIOUserDMARW);
+    res = g_malloc0(size);
+    memcpy(res, msg, sizeof(*res));
+    g_free(msg);
+
+    r = pci_dma_read(pdev, res->offset, &res->data, res->count);
+
+    switch (r) {
+    case MEMTX_OK:
+        if (res->hdr.flags & VFIO_USER_NO_REPLY) {
+            g_free(res);
+            return;
+        }
+        vfio_user_send_reply(proxy, &res->hdr, size);
+        break;
+    case MEMTX_ERROR:
+        vfio_user_send_error(proxy, &res->hdr, EFAULT);
+        break;
+    case MEMTX_DECODE_ERROR:
+        vfio_user_send_error(proxy, &res->hdr, ENODEV);
+        break;
+    case MEMTX_ACCESS_ERROR:
+        vfio_user_send_error(proxy, &res->hdr, EPERM);
+        break;
+    default:
+        error_printf("vfio_user_dma_read unknown error %d\n", r);
+        vfio_user_send_error(vdev->vbasedev.proxy, &res->hdr, EINVAL);
+    }
+}
+
+static void vfio_user_dma_write(VFIOPCIDevice *vdev, VFIOUserDMARW *msg)
+{
+    PCIDevice *pdev = &vdev->pdev;
+    VFIOUserProxy *proxy = vdev->vbasedev.proxy;
+    MemTxResult r;
+
+    if (msg->hdr.size < sizeof(*msg)) {
+        vfio_user_send_error(proxy, &msg->hdr, EINVAL);
+        return;
+    }
+    /* make sure transfer count isn't larger than the message data */
+    if (msg->count > msg->hdr.size - sizeof(*msg)) {
+        vfio_user_send_error(proxy, &msg->hdr, E2BIG);
+        return;
+    }
+
+    r = pci_dma_write(pdev, msg->offset, &msg->data, msg->count);
+
+    switch (r) {
+    case MEMTX_OK:
+        if ((msg->hdr.flags & VFIO_USER_NO_REPLY) == 0) {
+            vfio_user_send_reply(proxy, &msg->hdr, sizeof(msg->hdr));
+        } else {
+            g_free(msg);
+        }
+        break;
+    case MEMTX_ERROR:
+        vfio_user_send_error(proxy, &msg->hdr, EFAULT);
+        break;
+    case MEMTX_DECODE_ERROR:
+        vfio_user_send_error(proxy, &msg->hdr, ENODEV);
+        break;
+    case MEMTX_ACCESS_ERROR:
+        vfio_user_send_error(proxy, &msg->hdr, EPERM);
+        break;
+    default:
+        error_printf("vfio_user_dma_write unknown error %d\n", r);
+        vfio_user_send_error(vdev->vbasedev.proxy, &msg->hdr, EINVAL);
+    }
+}
+
 /*
  * Incoming request message callback.
  *
@@ -87,7 +177,28 @@ static void vfio_user_msix_teardown(VFIOPCIDevice *vdev)
  */
 static void vfio_user_pci_process_req(void *opaque, VFIOUserMsg *msg)
 {
+    VFIOPCIDevice *vdev = opaque;
+    VFIOUserHdr *hdr = msg->hdr;
 
+    /* no incoming PCI requests pass FDs */
+    if (msg->fds != NULL) {
+        vfio_user_send_error(vdev->vbasedev.proxy, hdr, EINVAL);
+        vfio_user_putfds(msg);
+        return;
+    }
+
+    switch (hdr->command) {
+    case VFIO_USER_DMA_READ:
+        vfio_user_dma_read(vdev, (VFIOUserDMARW *)hdr);
+        break;
+    case VFIO_USER_DMA_WRITE:
+        vfio_user_dma_write(vdev, (VFIOUserDMARW *)hdr);
+        break;
+    default:
+        error_printf("vfio_user_pci_process_req unknown cmd %d\n",
+                     hdr->command);
+        vfio_user_send_error(vdev->vbasedev.proxy, hdr, ENOSYS);
+    }
 }
 
 /*
diff --git a/hw/vfio-user/protocol.h b/hw/vfio-user/protocol.h
index 524f3d633a..3e9d8e576b 100644
--- a/hw/vfio-user/protocol.h
+++ b/hw/vfio-user/protocol.h
@@ -200,7 +200,18 @@ typedef struct {
     char data[];
 } VFIOUserRegionRW;
 
-/*imported from struct vfio_bitmap */
+/*
+ * VFIO_USER_DMA_READ
+ * VFIO_USER_DMA_WRITE
+ */
+typedef struct {
+    VFIOUserHdr hdr;
+    uint64_t offset;
+    uint32_t count;
+    char data[];
+} VFIOUserDMARW;
+
+/* imported from struct vfio_bitmap */
 typedef struct {
     uint64_t pgsize;
     uint64_t size;
diff --git a/hw/vfio-user/proxy.c b/hw/vfio-user/proxy.c
index c8ae8a59b4..cb93d9a660 100644
--- a/hw/vfio-user/proxy.c
+++ b/hw/vfio-user/proxy.c
@@ -347,6 +347,10 @@ static int vfio_user_recv_one(VFIOUserProxy *proxy, Error **errp)
         *msg->hdr = hdr;
         data = (char *)msg->hdr + sizeof(hdr);
     } else {
+        if (hdr.size > proxy->max_xfer_size + sizeof(VFIOUserDMARW)) {
+            error_setg(errp, "vfio_user_recv request larger than max");
+            goto err;
+        }
         buf = g_malloc0(hdr.size);
         memcpy(buf, &hdr, sizeof(hdr));
         data = buf + sizeof(hdr);
@@ -702,6 +706,40 @@ bool vfio_user_send_wait(VFIOUserProxy *proxy, VFIOUserHdr *hdr,
     return ok;
 }
 
+/*
+ * async send - msg can be queued, but will be freed when sent
+ *
+ * Returns false on failure, in which case @errp will be populated.
+ *
+ * In either case, ownership of @hdr and @fds is taken, and the caller must
+ * *not* free them itself.
+ */
+static bool vfio_user_send_async(VFIOUserProxy *proxy, VFIOUserHdr *hdr,
+                                 VFIOUserFDs *fds, Error **errp)
+{
+    VFIOUserMsg *msg;
+
+    QEMU_LOCK_GUARD(&proxy->lock);
+
+    msg = vfio_user_getmsg(proxy, hdr, fds);
+    msg->id = hdr->id;
+    msg->rsize = 0;
+    msg->type = VFIO_MSG_ASYNC;
+
+    if (!(hdr->flags & (VFIO_USER_NO_REPLY | VFIO_USER_REPLY))) {
+        error_setg_errno(errp, EINVAL, "%s on sync message", __func__);
+        vfio_user_recycle(proxy, msg);
+        return false;
+    }
+
+    if (!vfio_user_send_queued(proxy, msg, errp)) {
+        vfio_user_recycle(proxy, msg);
+        return false;
+    }
+
+    return true;
+}
+
 void vfio_user_wait_reqs(VFIOUserProxy *proxy)
 {
     VFIOUserMsg *msg;
@@ -746,6 +784,65 @@ void vfio_user_wait_reqs(VFIOUserProxy *proxy)
     qemu_mutex_unlock(&proxy->lock);
 }
 
+/*
+ * Reply to an incoming request.
+ */
+void vfio_user_send_reply(VFIOUserProxy *proxy, VFIOUserHdr *hdr, int size)
+{
+    Error *local_err = NULL;
+
+    if (size < sizeof(VFIOUserHdr)) {
+        error_printf("%s: size too small", __func__);
+        g_free(hdr);
+        return;
+    }
+
+    /*
+     * convert header to associated reply
+     */
+    hdr->flags = VFIO_USER_REPLY;
+    hdr->size = size;
+
+    if (!vfio_user_send_async(proxy, hdr, NULL, &local_err)) {
+        error_report_err(local_err);
+    }
+}
+
+/*
+ * Send an error reply to an incoming request.
+ */
+void vfio_user_send_error(VFIOUserProxy *proxy, VFIOUserHdr *hdr, int error)
+{
+    Error *local_err = NULL;
+
+    /*
+     * convert header to associated reply
+     */
+    hdr->flags = VFIO_USER_REPLY;
+    hdr->flags |= VFIO_USER_ERROR;
+    hdr->error_reply = error;
+    hdr->size = sizeof(*hdr);
+
+    if (!vfio_user_send_async(proxy, hdr, NULL, &local_err)) {
+        error_report_err(local_err);
+    }
+}
+
+/*
+ * Close FDs erroneously received in an incoming request.
+ */
+void vfio_user_putfds(VFIOUserMsg *msg)
+{
+    VFIOUserFDs *fds = msg->fds;
+    int i;
+
+    for (i = 0; i < fds->recv_fds; i++) {
+        close(fds->fds[i]);
+    }
+    g_free(fds);
+    msg->fds = NULL;
+}
+
 static QLIST_HEAD(, VFIOUserProxy) vfio_user_sockets =
     QLIST_HEAD_INITIALIZER(vfio_user_sockets);
 
diff --git a/hw/vfio-user/proxy.h b/hw/vfio-user/proxy.h
index e2fc83ca3b..39092c08c8 100644
--- a/hw/vfio-user/proxy.h
+++ b/hw/vfio-user/proxy.h
@@ -101,6 +101,7 @@ void vfio_user_set_handler(VFIODevice *vbasedev,
 bool vfio_user_validate_version(VFIOUserProxy *proxy, Error **errp);
 
 VFIOUserFDs *vfio_user_getfds(int numfds);
+void vfio_user_putfds(VFIOUserMsg *msg);
 
 void vfio_user_request_msg(VFIOUserHdr *hdr, uint16_t cmd,
                            uint32_t size, uint32_t flags);
@@ -109,5 +110,7 @@ bool vfio_user_send_wait(VFIOUserProxy *proxy, VFIOUserHdr *hdr,
                          VFIOUserFDs *fds, int rsize, Error **errp);
 bool vfio_user_send_nowait(VFIOUserProxy *proxy, VFIOUserHdr *hdr,
                            VFIOUserFDs *fds, int rsize, Error **errp);
+void vfio_user_send_reply(VFIOUserProxy *proxy, VFIOUserHdr *hdr, int size);
+void vfio_user_send_error(VFIOUserProxy *proxy, VFIOUserHdr *hdr, int error);
 
 #endif /* VFIO_USER_PROXY_H */

From 3358d926addda99e9f29f57b40d6fd22d2c29472 Mon Sep 17 00:00:00 2001
From: John Levon <john.levon@nutanix.com>
Date: Wed, 25 Jun 2025 20:30:07 +0100
Subject: [PATCH 1688/2760] vfio-user: add 'x-msg-timeout' option
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

By default, the vfio-user subsystem will wait 5 seconds for a message
reply from the server. Add an option to allow this to be configurable.

Originally-by: John Johnson <john.g.johnson@oracle.com>
Signed-off-by: Elena Ufimtseva <elena.ufimtseva@oracle.com>
Signed-off-by: Jagannathan Raman <jag.raman@oracle.com>
Signed-off-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250625193012.2316242-16-john.levon@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio-user/pci.c   | 5 +++++
 hw/vfio-user/proxy.c | 7 ++++---
 hw/vfio-user/proxy.h | 1 +
 3 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/hw/vfio-user/pci.c b/hw/vfio-user/pci.c
index 040660d197..f260bea490 100644
--- a/hw/vfio-user/pci.c
+++ b/hw/vfio-user/pci.c
@@ -23,6 +23,7 @@ struct VFIOUserPCIDevice {
     VFIOPCIDevice device;
     SocketAddress *socket;
     bool send_queued;   /* all sends are queued */
+    uint32_t wait_time; /* timeout for message replies */
 };
 
 /*
@@ -267,6 +268,9 @@ static void vfio_user_pci_realize(PCIDevice *pdev, Error **errp)
         proxy->flags |= VFIO_PROXY_FORCE_QUEUED;
     }
 
+    /* user specified or 5 sec default */
+    proxy->wait_time = udev->wait_time;
+
     if (!vfio_user_validate_version(proxy, errp)) {
         goto error;
     }
@@ -398,6 +402,7 @@ static const Property vfio_user_pci_dev_properties[] = {
     DEFINE_PROP_UINT32("x-pci-sub-device-id", VFIOPCIDevice,
                        sub_device_id, PCI_ANY_ID),
     DEFINE_PROP_BOOL("x-send-queued", VFIOUserPCIDevice, send_queued, false),
+    DEFINE_PROP_UINT32("x-msg-timeout", VFIOUserPCIDevice, wait_time, 5000),
 };
 
 static void vfio_user_pci_set_socket(Object *obj, Visitor *v, const char *name,
diff --git a/hw/vfio-user/proxy.c b/hw/vfio-user/proxy.c
index cb93d9a660..c3724ba212 100644
--- a/hw/vfio-user/proxy.c
+++ b/hw/vfio-user/proxy.c
@@ -21,7 +21,6 @@
 #include "qemu/main-loop.h"
 #include "system/iothread.h"
 
-static int wait_time = 5000;   /* wait up to 5 sec for busy servers */
 static IOThread *vfio_user_iothread;
 
 static void vfio_user_shutdown(VFIOUserProxy *proxy);
@@ -686,7 +685,8 @@ bool vfio_user_send_wait(VFIOUserProxy *proxy, VFIOUserHdr *hdr,
 
     if (ok) {
         while (!msg->complete) {
-            if (!qemu_cond_timedwait(&msg->cv, &proxy->lock, wait_time)) {
+            if (!qemu_cond_timedwait(&msg->cv, &proxy->lock,
+                                     proxy->wait_time)) {
                 VFIOUserMsgQ *list;
 
                 list = msg->pending ? &proxy->pending : &proxy->outgoing;
@@ -758,7 +758,8 @@ void vfio_user_wait_reqs(VFIOUserProxy *proxy)
         msg->type = VFIO_MSG_WAIT;
         proxy->last_nowait = NULL;
         while (!msg->complete) {
-            if (!qemu_cond_timedwait(&msg->cv, &proxy->lock, wait_time)) {
+            if (!qemu_cond_timedwait(&msg->cv, &proxy->lock,
+                                     proxy->wait_time)) {
                 VFIOUserMsgQ *list;
 
                 list = msg->pending ? &proxy->pending : &proxy->outgoing;
diff --git a/hw/vfio-user/proxy.h b/hw/vfio-user/proxy.h
index 39092c08c8..6b29cd7cd3 100644
--- a/hw/vfio-user/proxy.h
+++ b/hw/vfio-user/proxy.h
@@ -67,6 +67,7 @@ typedef struct VFIOUserProxy {
     uint64_t max_bitmap;
     uint64_t migr_pgsize;
     int flags;
+    uint32_t wait_time;
     QemuCond close_cv;
     AioContext *ctx;
     QEMUBH *req_bh;

From 98a906d9e5827b18c51d7d7485be2f21f8900cc7 Mon Sep 17 00:00:00 2001
From: John Levon <john.levon@nutanix.com>
Date: Wed, 25 Jun 2025 20:30:08 +0100
Subject: [PATCH 1689/2760] vfio-user: support posted writes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Support an asynchronous send of a vfio-user socket message (no wait for
a reply) when the write is posted. This is only safe when no regions are
mappable by the VM. Add an option to explicitly disable this as well.

Signed-off-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250625193012.2316242-17-john.levon@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio-user/device.c | 45 +++++++++++++++++++++++++++++++++++++++----
 hw/vfio-user/pci.c    |  6 ++++++
 hw/vfio-user/proxy.c  | 12 ++++++++++--
 hw/vfio-user/proxy.h  |  6 ++++++
 4 files changed, 63 insertions(+), 6 deletions(-)

diff --git a/hw/vfio-user/device.c b/hw/vfio-user/device.c
index 3a118e7361..aa07eac330 100644
--- a/hw/vfio-user/device.c
+++ b/hw/vfio-user/device.c
@@ -110,10 +110,21 @@ static int vfio_user_get_region_info(VFIOUserProxy *proxy,
     trace_vfio_user_get_region_info(msgp->index, msgp->flags, msgp->size);
 
     memcpy(info, &msgp->argsz, info->argsz);
+
+    /*
+     * If at least one region is directly mapped into the VM, then we can no
+     * longer rely on the sequential nature of vfio-user request handling to
+     * ensure that posted writes are completed before a subsequent read. In this
+     * case, disable posted write support. This is a per-device property, not
+     * per-region.
+     */
+    if (info->flags & VFIO_REGION_INFO_FLAG_MMAP) {
+        vfio_user_disable_posted_writes(proxy);
+    }
+
     return 0;
 }
 
-
 static int vfio_user_device_io_get_region_info(VFIODevice *vbasedev,
                                                struct vfio_region_info *info,
                                                int *fd)
@@ -312,33 +323,58 @@ static int vfio_user_device_io_region_read(VFIODevice *vbasedev, uint8_t index,
     return msgp->count;
 }
 
+/*
+ * If this is a posted write, and VFIO_PROXY_NO_POST is not set, then we are OK
+ * to send the write to the socket without waiting for the server's reply:
+ * a subsequent read (of any region) will not pass the posted write, as all
+ * messages are handled sequentially.
+ */
 static int vfio_user_device_io_region_write(VFIODevice *vbasedev, uint8_t index,
                                             off_t off, unsigned count,
                                             void *data, bool post)
 {
-    g_autofree VFIOUserRegionRW *msgp = NULL;
+    VFIOUserRegionRW *msgp = NULL;
     VFIOUserProxy *proxy = vbasedev->proxy;
     int size = sizeof(*msgp) + count;
     Error *local_err = NULL;
+    int flags = 0;
     int ret;
 
     if (count > proxy->max_xfer_size) {
         return -EINVAL;
     }
 
+    if (proxy->flags & VFIO_PROXY_NO_POST) {
+        post = false;
+    }
+
+    if (post) {
+        flags |= VFIO_USER_NO_REPLY;
+    }
+
     msgp = g_malloc0(size);
-    vfio_user_request_msg(&msgp->hdr, VFIO_USER_REGION_WRITE, size, 0);
+    vfio_user_request_msg(&msgp->hdr, VFIO_USER_REGION_WRITE, size, flags);
     msgp->offset = off;
     msgp->region = index;
     msgp->count = count;
     memcpy(&msgp->data, data, count);
     trace_vfio_user_region_rw(msgp->region, msgp->offset, msgp->count);
 
-    /* Ignore post: all writes are synchronous/non-posted. */
+    /* async send will free msg after it's sent */
+    if (post) {
+        if (!vfio_user_send_async(proxy, &msgp->hdr, NULL, &local_err)) {
+            error_prepend(&local_err, "%s: ", __func__);
+            error_report_err(local_err);
+            return -EFAULT;
+        }
+
+        return count;
+    }
 
     if (!vfio_user_send_wait(proxy, &msgp->hdr, NULL, 0, &local_err)) {
         error_prepend(&local_err, "%s: ", __func__);
         error_report_err(local_err);
+        g_free(msgp);
         return -EFAULT;
     }
 
@@ -348,6 +384,7 @@ static int vfio_user_device_io_region_write(VFIODevice *vbasedev, uint8_t index,
         ret = count;
     }
 
+    g_free(msgp);
     return ret;
 }
 
diff --git a/hw/vfio-user/pci.c b/hw/vfio-user/pci.c
index f260bea490..be71c77729 100644
--- a/hw/vfio-user/pci.c
+++ b/hw/vfio-user/pci.c
@@ -24,6 +24,7 @@ struct VFIOUserPCIDevice {
     SocketAddress *socket;
     bool send_queued;   /* all sends are queued */
     uint32_t wait_time; /* timeout for message replies */
+    bool no_post;       /* all region writes are sync */
 };
 
 /*
@@ -268,6 +269,10 @@ static void vfio_user_pci_realize(PCIDevice *pdev, Error **errp)
         proxy->flags |= VFIO_PROXY_FORCE_QUEUED;
     }
 
+    if (udev->no_post) {
+        proxy->flags |= VFIO_PROXY_NO_POST;
+    }
+
     /* user specified or 5 sec default */
     proxy->wait_time = udev->wait_time;
 
@@ -403,6 +408,7 @@ static const Property vfio_user_pci_dev_properties[] = {
                        sub_device_id, PCI_ANY_ID),
     DEFINE_PROP_BOOL("x-send-queued", VFIOUserPCIDevice, send_queued, false),
     DEFINE_PROP_UINT32("x-msg-timeout", VFIOUserPCIDevice, wait_time, 5000),
+    DEFINE_PROP_BOOL("x-no-posted-writes", VFIOUserPCIDevice, no_post, false),
 };
 
 static void vfio_user_pci_set_socket(Object *obj, Visitor *v, const char *name,
diff --git a/hw/vfio-user/proxy.c b/hw/vfio-user/proxy.c
index c3724ba212..7ce8573abb 100644
--- a/hw/vfio-user/proxy.c
+++ b/hw/vfio-user/proxy.c
@@ -714,8 +714,8 @@ bool vfio_user_send_wait(VFIOUserProxy *proxy, VFIOUserHdr *hdr,
  * In either case, ownership of @hdr and @fds is taken, and the caller must
  * *not* free them itself.
  */
-static bool vfio_user_send_async(VFIOUserProxy *proxy, VFIOUserHdr *hdr,
-                                 VFIOUserFDs *fds, Error **errp)
+bool vfio_user_send_async(VFIOUserProxy *proxy, VFIOUserHdr *hdr,
+                          VFIOUserFDs *fds, Error **errp)
 {
     VFIOUserMsg *msg;
 
@@ -844,6 +844,14 @@ void vfio_user_putfds(VFIOUserMsg *msg)
     msg->fds = NULL;
 }
 
+void
+vfio_user_disable_posted_writes(VFIOUserProxy *proxy)
+{
+    WITH_QEMU_LOCK_GUARD(&proxy->lock) {
+         proxy->flags |= VFIO_PROXY_NO_POST;
+    }
+}
+
 static QLIST_HEAD(, VFIOUserProxy) vfio_user_sockets =
     QLIST_HEAD_INITIALIZER(vfio_user_sockets);
 
diff --git a/hw/vfio-user/proxy.h b/hw/vfio-user/proxy.h
index 6b29cd7cd3..0418f58bf1 100644
--- a/hw/vfio-user/proxy.h
+++ b/hw/vfio-user/proxy.h
@@ -91,6 +91,7 @@ typedef struct VFIOUserProxy {
 /* VFIOProxy flags */
 #define VFIO_PROXY_CLIENT        0x1
 #define VFIO_PROXY_FORCE_QUEUED  0x4
+#define VFIO_PROXY_NO_POST       0x8
 
 typedef struct VFIODevice VFIODevice;
 
@@ -104,6 +105,8 @@ bool vfio_user_validate_version(VFIOUserProxy *proxy, Error **errp);
 VFIOUserFDs *vfio_user_getfds(int numfds);
 void vfio_user_putfds(VFIOUserMsg *msg);
 
+void vfio_user_disable_posted_writes(VFIOUserProxy *proxy);
+
 void vfio_user_request_msg(VFIOUserHdr *hdr, uint16_t cmd,
                            uint32_t size, uint32_t flags);
 void vfio_user_wait_reqs(VFIOUserProxy *proxy);
@@ -111,6 +114,9 @@ bool vfio_user_send_wait(VFIOUserProxy *proxy, VFIOUserHdr *hdr,
                          VFIOUserFDs *fds, int rsize, Error **errp);
 bool vfio_user_send_nowait(VFIOUserProxy *proxy, VFIOUserHdr *hdr,
                            VFIOUserFDs *fds, int rsize, Error **errp);
+bool vfio_user_send_async(VFIOUserProxy *proxy, VFIOUserHdr *hdr,
+                          VFIOUserFDs *fds, Error **errp);
+
 void vfio_user_send_reply(VFIOUserProxy *proxy, VFIOUserHdr *hdr, int size);
 void vfio_user_send_error(VFIOUserProxy *proxy, VFIOUserHdr *hdr, int error);
 

From 1a0c32a9daa39738fffc7de086845b2e54ae7034 Mon Sep 17 00:00:00 2001
From: John Levon <john.levon@nutanix.com>
Date: Wed, 25 Jun 2025 20:30:09 +0100
Subject: [PATCH 1690/2760] vfio-user: add coalesced posted writes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add new message to send multiple writes to server in a single message.
Prevents the outgoing queue from overflowing when a long latency
operation is followed by a series of posted writes.

Originally-by: John Johnson <john.g.johnson@oracle.com>
Signed-off-by: Elena Ufimtseva <elena.ufimtseva@oracle.com>
Signed-off-by: Jagannathan Raman <jag.raman@oracle.com>
Signed-off-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250625193012.2316242-18-john.levon@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio-user/device.c     | 40 +++++++++++++++++++
 hw/vfio-user/protocol.h   | 21 ++++++++++
 hw/vfio-user/proxy.c      | 84 +++++++++++++++++++++++++++++++++++++++
 hw/vfio-user/proxy.h      | 12 ++++++
 hw/vfio-user/trace-events |  1 +
 5 files changed, 158 insertions(+)

diff --git a/hw/vfio-user/device.c b/hw/vfio-user/device.c
index aa07eac330..0609a7dc25 100644
--- a/hw/vfio-user/device.c
+++ b/hw/vfio-user/device.c
@@ -9,6 +9,8 @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "qemu/error-report.h"
+#include "qemu/lockable.h"
+#include "qemu/thread.h"
 
 #include "hw/vfio-user/device.h"
 #include "hw/vfio-user/trace.h"
@@ -337,6 +339,7 @@ static int vfio_user_device_io_region_write(VFIODevice *vbasedev, uint8_t index,
     VFIOUserProxy *proxy = vbasedev->proxy;
     int size = sizeof(*msgp) + count;
     Error *local_err = NULL;
+    bool can_multi;
     int flags = 0;
     int ret;
 
@@ -352,6 +355,43 @@ static int vfio_user_device_io_region_write(VFIODevice *vbasedev, uint8_t index,
         flags |= VFIO_USER_NO_REPLY;
     }
 
+    /* write eligible to be in a WRITE_MULTI msg ? */
+    can_multi = (proxy->flags & VFIO_PROXY_USE_MULTI) && post &&
+        count <= VFIO_USER_MULTI_DATA;
+
+    /*
+     * This should be a rare case, so first check without the lock,
+     * if we're wrong, vfio_send_queued() will flush any posted writes
+     * we missed here
+     */
+    if (proxy->wr_multi != NULL ||
+        (proxy->num_outgoing > VFIO_USER_OUT_HIGH && can_multi)) {
+
+        /*
+         * re-check with lock
+         *
+         * if already building a WRITE_MULTI msg,
+         *  add this one if possible else flush pending before
+         *  sending the current one
+         *
+         * else if outgoing queue is over the highwater,
+         *  start a new WRITE_MULTI message
+         */
+        WITH_QEMU_LOCK_GUARD(&proxy->lock) {
+            if (proxy->wr_multi != NULL) {
+                if (can_multi) {
+                    vfio_user_add_multi(proxy, index, off, count, data);
+                    return count;
+                }
+                vfio_user_flush_multi(proxy);
+            } else if (proxy->num_outgoing > VFIO_USER_OUT_HIGH && can_multi) {
+                vfio_user_create_multi(proxy);
+                vfio_user_add_multi(proxy, index, off, count, data);
+                return count;
+            }
+        }
+    }
+
     msgp = g_malloc0(size);
     vfio_user_request_msg(&msgp->hdr, VFIO_USER_REGION_WRITE, size, flags);
     msgp->offset = off;
diff --git a/hw/vfio-user/protocol.h b/hw/vfio-user/protocol.h
index 3e9d8e576b..3249a4a6b6 100644
--- a/hw/vfio-user/protocol.h
+++ b/hw/vfio-user/protocol.h
@@ -39,6 +39,7 @@ enum vfio_user_command {
     VFIO_USER_DMA_WRITE                 = 12,
     VFIO_USER_DEVICE_RESET              = 13,
     VFIO_USER_DIRTY_PAGES               = 14,
+    VFIO_USER_REGION_WRITE_MULTI        = 15,
     VFIO_USER_MAX,
 };
 
@@ -72,6 +73,7 @@ typedef struct {
 #define VFIO_USER_CAP_PGSIZES   "pgsizes"
 #define VFIO_USER_CAP_MAP_MAX   "max_dma_maps"
 #define VFIO_USER_CAP_MIGR      "migration"
+#define VFIO_USER_CAP_MULTI     "write_multiple"
 
 /* "migration" members */
 #define VFIO_USER_CAP_PGSIZE            "pgsize"
@@ -218,4 +220,23 @@ typedef struct {
     char data[];
 } VFIOUserBitmap;
 
+/*
+ * VFIO_USER_REGION_WRITE_MULTI
+ */
+#define VFIO_USER_MULTI_DATA  8
+#define VFIO_USER_MULTI_MAX   200
+
+typedef struct {
+    uint64_t offset;
+    uint32_t region;
+    uint32_t count;
+    char data[VFIO_USER_MULTI_DATA];
+} VFIOUserWROne;
+
+typedef struct {
+    VFIOUserHdr hdr;
+    uint64_t wr_cnt;
+    VFIOUserWROne wrs[VFIO_USER_MULTI_MAX];
+} VFIOUserWRMulti;
+
 #endif /* VFIO_USER_PROTOCOL_H */
diff --git a/hw/vfio-user/proxy.c b/hw/vfio-user/proxy.c
index 7ce8573abb..c418954440 100644
--- a/hw/vfio-user/proxy.c
+++ b/hw/vfio-user/proxy.c
@@ -13,12 +13,14 @@
 #include "hw/vfio-user/proxy.h"
 #include "hw/vfio-user/trace.h"
 #include "qapi/error.h"
+#include "qobject/qbool.h"
 #include "qobject/qdict.h"
 #include "qobject/qjson.h"
 #include "qobject/qnum.h"
 #include "qemu/error-report.h"
 #include "qemu/lockable.h"
 #include "qemu/main-loop.h"
+#include "qemu/thread.h"
 #include "system/iothread.h"
 
 static IOThread *vfio_user_iothread;
@@ -445,6 +447,7 @@ static ssize_t vfio_user_send_one(VFIOUserProxy *proxy, Error **errp)
     }
 
     QTAILQ_REMOVE(&proxy->outgoing, msg, next);
+    proxy->num_outgoing--;
     if (msg->type == VFIO_MSG_ASYNC) {
         vfio_user_recycle(proxy, msg);
     } else {
@@ -481,6 +484,11 @@ static void vfio_user_send(void *opaque)
         }
         qio_channel_set_aio_fd_handler(proxy->ioc, proxy->ctx,
                                        vfio_user_recv, NULL, NULL, proxy);
+
+        /* queue empty - send any pending multi write msgs */
+        if (proxy->wr_multi != NULL) {
+            vfio_user_flush_multi(proxy);
+        }
     }
 }
 
@@ -579,11 +587,18 @@ static bool vfio_user_send_queued(VFIOUserProxy *proxy, VFIOUserMsg *msg,
 {
     int ret;
 
+    /* older coalesced writes go first */
+    if (proxy->wr_multi != NULL &&
+        ((msg->hdr->flags & VFIO_USER_TYPE) == VFIO_USER_REQUEST)) {
+        vfio_user_flush_multi(proxy);
+    }
+
     /*
      * Unsent outgoing msgs - add to tail
      */
     if (!QTAILQ_EMPTY(&proxy->outgoing)) {
         QTAILQ_INSERT_TAIL(&proxy->outgoing, msg, next);
+        proxy->num_outgoing++;
         return true;
     }
 
@@ -598,6 +613,7 @@ static bool vfio_user_send_queued(VFIOUserProxy *proxy, VFIOUserMsg *msg,
 
     if (ret == QIO_CHANNEL_ERR_BLOCK) {
         QTAILQ_INSERT_HEAD(&proxy->outgoing, msg, next);
+        proxy->num_outgoing = 1;
         qio_channel_set_aio_fd_handler(proxy->ioc, proxy->ctx,
                                        vfio_user_recv, proxy->ctx,
                                        vfio_user_send, proxy);
@@ -1151,12 +1167,27 @@ static bool check_migr(VFIOUserProxy *proxy, QObject *qobj, Error **errp)
     return caps_parse(proxy, qdict, caps_migr, errp);
 }
 
+static bool check_multi(VFIOUserProxy *proxy, QObject *qobj, Error **errp)
+{
+    QBool *qb = qobject_to(QBool, qobj);
+
+    if (qb == NULL) {
+        error_setg(errp, "malformed %s", VFIO_USER_CAP_MULTI);
+        return false;
+    }
+    if (qbool_get_bool(qb)) {
+        proxy->flags |= VFIO_PROXY_USE_MULTI;
+    }
+    return true;
+}
+
 static struct cap_entry caps_cap[] = {
     { VFIO_USER_CAP_MAX_FDS, check_max_fds },
     { VFIO_USER_CAP_MAX_XFER, check_max_xfer },
     { VFIO_USER_CAP_PGSIZES, check_pgsizes },
     { VFIO_USER_CAP_MAP_MAX, check_max_dma },
     { VFIO_USER_CAP_MIGR, check_migr },
+    { VFIO_USER_CAP_MULTI, check_multi },
     { NULL }
 };
 
@@ -1215,6 +1246,7 @@ static GString *caps_json(void)
     qdict_put_int(capdict, VFIO_USER_CAP_MAX_XFER, VFIO_USER_DEF_MAX_XFER);
     qdict_put_int(capdict, VFIO_USER_CAP_PGSIZES, VFIO_USER_DEF_PGSIZE);
     qdict_put_int(capdict, VFIO_USER_CAP_MAP_MAX, VFIO_USER_DEF_MAP_MAX);
+    qdict_put_bool(capdict, VFIO_USER_CAP_MULTI, true);
 
     qdict_put_obj(dict, VFIO_USER_CAP, QOBJECT(capdict));
 
@@ -1270,3 +1302,55 @@ bool vfio_user_validate_version(VFIOUserProxy *proxy, Error **errp)
     trace_vfio_user_version(msgp->major, msgp->minor, msgp->capabilities);
     return true;
 }
+
+void vfio_user_flush_multi(VFIOUserProxy *proxy)
+{
+    VFIOUserMsg *msg;
+    VFIOUserWRMulti *wm = proxy->wr_multi;
+    Error *local_err = NULL;
+
+    proxy->wr_multi = NULL;
+
+    /* adjust size for actual # of writes */
+    wm->hdr.size -= (VFIO_USER_MULTI_MAX - wm->wr_cnt) * sizeof(VFIOUserWROne);
+
+    msg = vfio_user_getmsg(proxy, &wm->hdr, NULL);
+    msg->id = wm->hdr.id;
+    msg->rsize = 0;
+    msg->type = VFIO_MSG_ASYNC;
+    trace_vfio_user_wrmulti("flush", wm->wr_cnt);
+
+    if (!vfio_user_send_queued(proxy, msg, &local_err)) {
+        error_report_err(local_err);
+        vfio_user_recycle(proxy, msg);
+    }
+}
+
+void vfio_user_create_multi(VFIOUserProxy *proxy)
+{
+    VFIOUserWRMulti *wm;
+
+    wm = g_malloc0(sizeof(*wm));
+    vfio_user_request_msg(&wm->hdr, VFIO_USER_REGION_WRITE_MULTI,
+                          sizeof(*wm), VFIO_USER_NO_REPLY);
+    proxy->wr_multi = wm;
+}
+
+void vfio_user_add_multi(VFIOUserProxy *proxy, uint8_t index,
+                         off_t offset, uint32_t count, void *data)
+{
+    VFIOUserWRMulti *wm = proxy->wr_multi;
+    VFIOUserWROne *w1 = &wm->wrs[wm->wr_cnt];
+
+    w1->offset = offset;
+    w1->region = index;
+    w1->count = count;
+    memcpy(&w1->data, data, count);
+
+    wm->wr_cnt++;
+    trace_vfio_user_wrmulti("add", wm->wr_cnt);
+    if (wm->wr_cnt == VFIO_USER_MULTI_MAX ||
+        proxy->num_outgoing < VFIO_USER_OUT_LOW) {
+        vfio_user_flush_multi(proxy);
+    }
+}
diff --git a/hw/vfio-user/proxy.h b/hw/vfio-user/proxy.h
index 0418f58bf1..61e64a0020 100644
--- a/hw/vfio-user/proxy.h
+++ b/hw/vfio-user/proxy.h
@@ -85,6 +85,8 @@ typedef struct VFIOUserProxy {
     VFIOUserMsg *last_nowait;
     VFIOUserMsg *part_recv;
     size_t recv_left;
+    VFIOUserWRMulti *wr_multi;
+    int num_outgoing;
     enum proxy_state state;
 } VFIOUserProxy;
 
@@ -92,6 +94,11 @@ typedef struct VFIOUserProxy {
 #define VFIO_PROXY_CLIENT        0x1
 #define VFIO_PROXY_FORCE_QUEUED  0x4
 #define VFIO_PROXY_NO_POST       0x8
+#define VFIO_PROXY_USE_MULTI     0x16
+
+/* coalescing high and low water marks for VFIOProxy num_outgoing */
+#define VFIO_USER_OUT_HIGH       1024
+#define VFIO_USER_OUT_LOW        128
 
 typedef struct VFIODevice VFIODevice;
 
@@ -120,4 +127,9 @@ bool vfio_user_send_async(VFIOUserProxy *proxy, VFIOUserHdr *hdr,
 void vfio_user_send_reply(VFIOUserProxy *proxy, VFIOUserHdr *hdr, int size);
 void vfio_user_send_error(VFIOUserProxy *proxy, VFIOUserHdr *hdr, int error);
 
+void vfio_user_flush_multi(VFIOUserProxy *proxy);
+void vfio_user_create_multi(VFIOUserProxy *proxy);
+void vfio_user_add_multi(VFIOUserProxy *proxy, uint8_t index,
+                         off_t offset, uint32_t count, void *data);
+
 #endif /* VFIO_USER_PROXY_H */
diff --git a/hw/vfio-user/trace-events b/hw/vfio-user/trace-events
index 44dde020b3..abb67f4c11 100644
--- a/hw/vfio-user/trace-events
+++ b/hw/vfio-user/trace-events
@@ -13,6 +13,7 @@ vfio_user_get_region_info(uint32_t index, uint32_t flags, uint64_t size) " index
 vfio_user_region_rw(uint32_t region, uint64_t off, uint32_t count) " region %d offset 0x%"PRIx64" count %d"
 vfio_user_get_irq_info(uint32_t index, uint32_t flags, uint32_t count) " index %d flags 0x%x count %d"
 vfio_user_set_irqs(uint32_t index, uint32_t start, uint32_t count, uint32_t flags) " index %d start %d count %d flags 0x%x"
+vfio_user_wrmulti(const char *s, uint64_t wr_cnt) " %s count 0x%"PRIx64
 
 # container.c
 vfio_user_dma_map(uint64_t iova, uint64_t size, uint64_t off, uint32_t flags, bool async_ops) " iova 0x%"PRIx64" size 0x%"PRIx64" off 0x%"PRIx64" flags 0x%x async_ops %d"

From c688cc165b32c924a01a69d90ac9aac6fac8c64c Mon Sep 17 00:00:00 2001
From: John Levon <john.levon@nutanix.com>
Date: Wed, 25 Jun 2025 20:30:10 +0100
Subject: [PATCH 1691/2760] docs: add vfio-user documentation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add some basic documentation on vfio-user usage.

Signed-off-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250625193012.2316242-19-john.levon@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 docs/system/device-emulation.rst  |  1 +
 docs/system/devices/vfio-user.rst | 26 ++++++++++++++++++++++++++
 2 files changed, 27 insertions(+)
 create mode 100644 docs/system/devices/vfio-user.rst

diff --git a/docs/system/device-emulation.rst b/docs/system/device-emulation.rst
index a1b0d7997e..911381643f 100644
--- a/docs/system/device-emulation.rst
+++ b/docs/system/device-emulation.rst
@@ -85,6 +85,7 @@ Emulated Devices
    devices/can.rst
    devices/ccid.rst
    devices/cxl.rst
+   devices/vfio-user.rst
    devices/ivshmem.rst
    devices/ivshmem-flat.rst
    devices/keyboard.rst
diff --git a/docs/system/devices/vfio-user.rst b/docs/system/devices/vfio-user.rst
new file mode 100644
index 0000000000..b6dcaa5615
--- /dev/null
+++ b/docs/system/devices/vfio-user.rst
@@ -0,0 +1,26 @@
+.. SPDX-License-Identifier: GPL-2.0-or-later
+
+=========
+vfio-user
+=========
+
+QEMU includes a ``vfio-user`` client. The ``vfio-user`` specification allows for
+implementing (PCI) devices in userspace outside of QEMU; it is similar to
+``vhost-user`` in this respect (see :doc:`vhost-user`), but can emulate arbitrary
+PCI devices, not just ``virtio``. Whereas ``vfio`` is handled by the host
+kernel, ``vfio-user``, while similar in implementation, is handled entirely in
+userspace.
+
+For example, SPDK includes a virtual PCI NVMe controller implementation; by
+setting up a ``vfio-user`` UNIX socket between QEMU and SPDK, a VM can send NVMe
+I/O to the SPDK process.
+
+Presuming a suitable ``vfio-user`` server has opened a socket at
+``/tmp/vfio-user.sock``, a device can be configured with for example:
+
+.. code-block:: console
+
+-device '{"driver": "vfio-user-pci","socket": {"path": "/tmp/vfio-user.sock", "type": "unix"}}'
+
+See `libvfio-user <https://github.com/nutanix/libvfio-user/>`_ for further
+information.

From da198e8f0f99cd8539f3072ad2071f9dc01680d6 Mon Sep 17 00:00:00 2001
From: Thanos Makatos <thanos.makatos@nutanix.com>
Date: Wed, 25 Jun 2025 20:30:11 +0100
Subject: [PATCH 1692/2760] vfio-user: introduce vfio-user protocol
 specification
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This patch introduces the vfio-user protocol specification (formerly
known as VFIO-over-socket), which is designed to allow devices to be
emulated outside QEMU, in a separate process. vfio-user reuses the
existing VFIO defines, structs and concepts.

It has been earlier discussed as an RFC in:
"RFC: use VFIO over a UNIX domain socket to implement device offloading"

Signed-off-by: Thanos Makatos <thanos.makatos@nutanix.com>
Signed-off-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250625193012.2316242-20-john.levon@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 MAINTAINERS                |    3 +-
 docs/interop/index.rst     |    1 +
 docs/interop/vfio-user.rst | 1520 ++++++++++++++++++++++++++++++++++++
 3 files changed, 1523 insertions(+), 1 deletion(-)
 create mode 100644 docs/interop/vfio-user.rst

diff --git a/MAINTAINERS b/MAINTAINERS
index 2369391004..1b73b8b394 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -4246,7 +4246,6 @@ F: hw/remote/proxy-memory-listener.c
 F: include/hw/remote/proxy-memory-listener.h
 F: hw/remote/iohub.c
 F: include/hw/remote/iohub.h
-F: subprojects/libvfio-user
 F: hw/remote/vfio-user-obj.c
 F: include/hw/remote/vfio-user-obj.h
 F: hw/remote/iommu.c
@@ -4257,6 +4256,8 @@ VFIO-USER:
 M: John Levon <john.levon@nutanix.com>
 M: Thanos Makatos <thanos.makatos@nutanix.com>
 S: Supported
+F: docs/interop/vfio-user.rst
+F: docs/system/devices/vfio-user.rst
 F: hw/vfio-user/*
 F: include/hw/vfio-user/*
 F: subprojects/libvfio-user
diff --git a/docs/interop/index.rst b/docs/interop/index.rst
index 972f3e49ce..d830c5c410 100644
--- a/docs/interop/index.rst
+++ b/docs/interop/index.rst
@@ -25,6 +25,7 @@ are useful for making QEMU interoperate with other software.
    qemu-ga-ref
    qemu-qmp-ref
    qemu-storage-daemon-qmp-ref
+   vfio-user
    vhost-user
    vhost-user-gpu
    vhost-vdpa
diff --git a/docs/interop/vfio-user.rst b/docs/interop/vfio-user.rst
new file mode 100644
index 0000000000..0b06f026b0
--- /dev/null
+++ b/docs/interop/vfio-user.rst
@@ -0,0 +1,1520 @@
+.. include:: <isonum.txt>
+.. SPDX-License-Identifier: GPL-2.0-or-later
+
+================================
+vfio-user Protocol Specification
+================================
+
+.. contents:: Table of Contents
+
+Introduction
+============
+vfio-user is a protocol that allows a device to be emulated in a separate
+process outside of a Virtual Machine Monitor (VMM). vfio-user devices consist
+of a generic VFIO device type, living inside the VMM, which we call the client,
+and the core device implementation, living outside the VMM, which we call the
+server.
+
+The vfio-user specification is partly based on the
+`Linux VFIO ioctl interface <https://www.kernel.org/doc/html/latest/driver-api/vfio.html>`_.
+
+VFIO is a mature and stable API, backed by an extensively used framework. The
+existing VFIO client implementation in QEMU (``qemu/hw/vfio/``) can be largely
+re-used, though there is nothing in this specification that requires that
+particular implementation. None of the VFIO kernel modules are required for
+supporting the protocol, on either the client or server side. Some source
+definitions in VFIO are re-used for vfio-user.
+
+The main idea is to allow a virtual device to function in a separate process in
+the same host over a UNIX domain socket. A UNIX domain socket (``AF_UNIX``) is
+chosen because file descriptors can be trivially sent over it, which in turn
+allows:
+
+* Sharing of client memory for DMA with the server.
+* Sharing of server memory with the client for fast MMIO.
+* Efficient sharing of eventfd's for triggering interrupts.
+
+Other socket types could be used which allow the server to run in a separate
+guest in the same host (``AF_VSOCK``) or remotely (``AF_INET``). Theoretically
+the underlying transport does not necessarily have to be a socket, however we do
+not examine such alternatives. In this protocol version we focus on using a UNIX
+domain socket and introduce basic support for the other two types of sockets
+without considering performance implications.
+
+While passing of file descriptors is desirable for performance reasons, support
+is not necessary for either the client or the server in order to implement the
+protocol. There is always an in-band, message-passing fall back mechanism.
+
+Overview
+========
+
+VFIO is a framework that allows a physical device to be securely passed through
+to a user space process; the device-specific kernel driver does not drive the
+device at all.  Typically, the user space process is a VMM and the device is
+passed through to it in order to achieve high performance. VFIO provides an API
+and the required functionality in the kernel. QEMU has adopted VFIO to allow a
+guest to directly access physical devices, instead of emulating them in
+software.
+
+vfio-user reuses the core VFIO concepts defined in its API, but implements them
+as messages to be sent over a socket. It does not change the kernel-based VFIO
+in any way, in fact none of the VFIO kernel modules need to be loaded to use
+vfio-user. It is also possible for the client to concurrently use the current
+kernel-based VFIO for one device, and vfio-user for another device.
+
+VFIO Device Model
+-----------------
+
+A device under VFIO presents a standard interface to the user process. Many of
+the VFIO operations in the existing interface use the ``ioctl()`` system call, and
+references to the existing interface are called the ``ioctl()`` implementation in
+this document.
+
+The following sections describe the set of messages that implement the vfio-user
+interface over a socket. In many cases, the messages are analogous to data
+structures used in the ``ioctl()`` implementation. Messages derived from the
+``ioctl()`` will have a name derived from the ``ioctl()`` command name.  E.g., the
+``VFIO_DEVICE_GET_INFO`` ``ioctl()`` command becomes a
+``VFIO_USER_DEVICE_GET_INFO`` message.  The purpose of this reuse is to share as
+much code as feasible with the ``ioctl()`` implementation``.
+
+Connection Initiation
+^^^^^^^^^^^^^^^^^^^^^
+
+After the client connects to the server, the initial client message is
+``VFIO_USER_VERSION`` to propose a protocol version and set of capabilities to
+apply to the session. The server replies with a compatible version and set of
+capabilities it supports, or closes the connection if it cannot support the
+advertised version.
+
+Device Information
+^^^^^^^^^^^^^^^^^^
+
+The client uses a ``VFIO_USER_DEVICE_GET_INFO`` message to query the server for
+information about the device. This information includes:
+
+* The device type and whether it supports reset (``VFIO_DEVICE_FLAGS_``),
+* the number of device regions, and
+* the device presents to the client the number of interrupt types the device
+  supports.
+
+Region Information
+^^^^^^^^^^^^^^^^^^
+
+The client uses ``VFIO_USER_DEVICE_GET_REGION_INFO`` messages to query the
+server for information about the device's regions. This information describes:
+
+* Read and write permissions, whether it can be memory mapped, and whether it
+  supports additional capabilities (``VFIO_REGION_INFO_CAP_``).
+* Region index, size, and offset.
+
+When a device region can be mapped by the client, the server provides a file
+descriptor which the client can ``mmap()``. The server is responsible for
+polling for client updates to memory mapped regions.
+
+Region Capabilities
+"""""""""""""""""""
+
+Some regions have additional capabilities that cannot be described adequately
+by the region info data structure. These capabilities are returned in the
+region info reply in a list similar to PCI capabilities in a PCI device's
+configuration space.
+
+Sparse Regions
+""""""""""""""
+A region can be memory-mappable in whole or in part. When only a subset of a
+region can be mapped by the client, a ``VFIO_REGION_INFO_CAP_SPARSE_MMAP``
+capability is included in the region info reply. This capability describes
+which portions can be mapped by the client.
+
+.. Note::
+   For example, in a virtual NVMe controller, sparse regions can be used so
+   that accesses to the NVMe registers (found in the beginning of BAR0) are
+   trapped (an infrequent event), while allowing direct access to the doorbells
+   (an extremely frequent event as every I/O submission requires a write to
+   BAR0), found in the next page after the NVMe registers in BAR0.
+
+Device-Specific Regions
+"""""""""""""""""""""""
+
+A device can define regions additional to the standard ones (e.g. PCI indexes
+0-8). This is achieved by including a ``VFIO_REGION_INFO_CAP_TYPE`` capability
+in the region info reply of a device-specific region. Such regions are reflected
+in ``struct vfio_user_device_info.num_regions``. Thus, for PCI devices this
+value can be equal to, or higher than, ``VFIO_PCI_NUM_REGIONS``.
+
+Region I/O via file descriptors
+-------------------------------
+
+For unmapped regions, region I/O from the client is done via
+``VFIO_USER_REGION_READ/WRITE``.  As an optimization, ioeventfds or ioregionfds
+may be configured for sub-regions of some regions. A client may request
+information on these sub-regions via ``VFIO_USER_DEVICE_GET_REGION_IO_FDS``; by
+configuring the returned file descriptors as ioeventfds or ioregionfds, the
+server can be directly notified of I/O (for example, by KVM) without taking a
+trip through the client.
+
+Interrupts
+^^^^^^^^^^
+
+The client uses ``VFIO_USER_DEVICE_GET_IRQ_INFO`` messages to query the server
+for the device's interrupt types. The interrupt types are specific to the bus
+the device is attached to, and the client is expected to know the capabilities
+of each interrupt type. The server can signal an interrupt by directly injecting
+interrupts into the guest via an event file descriptor. The client configures
+how the server signals an interrupt with ``VFIO_USER_SET_IRQS`` messages.
+
+Device Read and Write
+^^^^^^^^^^^^^^^^^^^^^
+
+When the guest executes load or store operations to an unmapped device region,
+the client forwards these operations to the server with
+``VFIO_USER_REGION_READ`` or ``VFIO_USER_REGION_WRITE`` messages. The server
+will reply with data from the device on read operations or an acknowledgement on
+write operations. See `Read and Write Operations`_.
+
+Client memory access
+--------------------
+
+The client uses ``VFIO_USER_DMA_MAP`` and ``VFIO_USER_DMA_UNMAP`` messages to
+inform the server of the valid DMA ranges that the server can access on behalf
+of a device (typically, VM guest memory). DMA memory may be accessed by the
+server via ``VFIO_USER_DMA_READ`` and ``VFIO_USER_DMA_WRITE`` messages over the
+socket. In this case, the "DMA" part of the naming is a misnomer.
+
+Actual direct memory access of client memory from the server is possible if the
+client provides file descriptors the server can ``mmap()``. Note that ``mmap()``
+privileges cannot be revoked by the client, therefore file descriptors should
+only be exported in environments where the client trusts the server not to
+corrupt guest memory.
+
+See `Read and Write Operations`_.
+
+Client/server interactions
+==========================
+
+Socket
+------
+
+A server can serve:
+
+1) one or more clients, and/or
+2) one or more virtual devices, belonging to one or more clients.
+
+The current protocol specification requires a dedicated socket per
+client/server connection. It is a server-side implementation detail whether a
+single server handles multiple virtual devices from the same or multiple
+clients. The location of the socket is implementation-specific. Multiplexing
+clients, devices, and servers over the same socket is not supported in this
+version of the protocol.
+
+Authentication
+--------------
+
+For ``AF_UNIX``, we rely on OS mandatory access controls on the socket files,
+therefore it is up to the management layer to set up the socket as required.
+Socket types that span guests or hosts will require a proper authentication
+mechanism. Defining that mechanism is deferred to a future version of the
+protocol.
+
+Command Concurrency
+-------------------
+
+A client may pipeline multiple commands without waiting for previous command
+replies.  The server will process commands in the order they are received.  A
+consequence of this is if a client issues a command with the *No_reply* bit,
+then subsequently issues a command without *No_reply*, the older command will
+have been processed before the reply to the younger command is sent by the
+server.  The client must be aware of the device's capability to process
+concurrent commands if pipelining is used.  For example, pipelining allows
+multiple client threads to concurrently access device regions; the client must
+ensure these accesses obey device semantics.
+
+An example is a frame buffer device, where the device may allow concurrent
+access to different areas of video memory, but may have indeterminate behavior
+if concurrent accesses are performed to command or status registers.
+
+Note that unrelated messages sent from the server to the client can appear in
+between a client to server request/reply and vice versa.
+
+Implementers should be prepared for certain commands to exhibit potentially
+unbounded latencies.  For example, ``VFIO_USER_DEVICE_RESET`` may take an
+arbitrarily long time to complete; clients should take care not to block
+unnecessarily.
+
+Socket Disconnection Behavior
+-----------------------------
+The server and the client can disconnect from each other, either intentionally
+or unexpectedly. Both the client and the server need to know how to handle such
+events.
+
+Server Disconnection
+^^^^^^^^^^^^^^^^^^^^
+A server disconnecting from the client may indicate that:
+
+1) A virtual device has been restarted, either intentionally (e.g. because of a
+   device update) or unintentionally (e.g. because of a crash).
+2) A virtual device has been shut down with no intention to be restarted.
+
+It is impossible for the client to know whether or not a failure is
+intermittent or innocuous and should be retried, therefore the client should
+reset the VFIO device when it detects the socket has been disconnected.
+Error recovery will be driven by the guest's device error handling
+behavior.
+
+Client Disconnection
+^^^^^^^^^^^^^^^^^^^^
+The client disconnecting from the server primarily means that the client
+has exited. Currently, this means that the guest is shut down so the device is
+no longer needed therefore the server can automatically exit. However, there
+can be cases where a client disconnection should not result in a server exit:
+
+1) A single server serving multiple clients.
+2) A multi-process QEMU upgrading itself step by step, which is not yet
+   implemented.
+
+Therefore in order for the protocol to be forward compatible, the server should
+respond to a client disconnection as follows:
+
+ - all client memory regions are unmapped and cleaned up (including closing any
+   passed file descriptors)
+ - all IRQ file descriptors passed from the old client are closed
+ - the device state should otherwise be retained
+
+The expectation is that when a client reconnects, it will re-establish IRQ and
+client memory mappings.
+
+If anything happens to the client (such as qemu really did exit), the control
+stack will know about it and can clean up resources accordingly.
+
+Security Considerations
+-----------------------
+
+Speaking generally, vfio-user clients should not trust servers, and vice versa.
+Standard tools and mechanisms should be used on both sides to validate input and
+prevent against denial of service scenarios, buffer overflow, etc.
+
+Request Retry and Response Timeout
+----------------------------------
+A failed command is a command that has been successfully sent and has been
+responded to with an error code. Failure to send the command in the first place
+(e.g. because the socket is disconnected) is a different type of error examined
+earlier in the disconnect section.
+
+.. Note::
+   QEMU's VFIO retries certain operations if they fail. While this makes sense
+   for real HW, we don't know for sure whether it makes sense for virtual
+   devices.
+
+Defining a retry and timeout scheme is deferred to a future version of the
+protocol.
+
+Message sizes
+-------------
+
+Some requests have an ``argsz`` field. In a request, it defines the maximum
+expected reply payload size, which should be at least the size of the fixed
+reply payload headers defined here. The *request* payload size is defined by the
+usual ``msg_size`` field in the header, not the ``argsz`` field.
+
+In a reply, the server sets ``argsz`` field to the size needed for a full
+payload size. This may be less than the requested maximum size. This may be
+larger than the requested maximum size: in that case, the full payload is not
+included in the reply, but the ``argsz`` field in the reply indicates the needed
+size, allowing a client to allocate a larger buffer for holding the reply before
+trying again.
+
+In addition, during negotiation (see  `Version`_), the client and server may
+each specify a ``max_data_xfer_size`` value; this defines the maximum data that
+may be read or written via one of the ``VFIO_USER_DMA/REGION_READ/WRITE``
+messages; see `Read and Write Operations`_.
+
+Protocol Specification
+======================
+
+To distinguish from the base VFIO symbols, all vfio-user symbols are prefixed
+with ``vfio_user`` or ``VFIO_USER``. In this revision, all data is in the
+endianness of the host system, although this may be relaxed in future
+revisions in cases where the client and server run on different hosts
+with different endianness.
+
+Unless otherwise specified, all sizes should be presumed to be in bytes.
+
+.. _Commands:
+
+Commands
+--------
+The following table lists the VFIO message command IDs, and whether the
+message command is sent from the client or the server.
+
+======================================  =========  =================
+Name                                    Command    Request Direction
+======================================  =========  =================
+``VFIO_USER_VERSION``                   1          client -> server
+``VFIO_USER_DMA_MAP``                   2          client -> server
+``VFIO_USER_DMA_UNMAP``                 3          client -> server
+``VFIO_USER_DEVICE_GET_INFO``           4          client -> server
+``VFIO_USER_DEVICE_GET_REGION_INFO``    5          client -> server
+``VFIO_USER_DEVICE_GET_REGION_IO_FDS``  6          client -> server
+``VFIO_USER_DEVICE_GET_IRQ_INFO``       7          client -> server
+``VFIO_USER_DEVICE_SET_IRQS``           8          client -> server
+``VFIO_USER_REGION_READ``               9          client -> server
+``VFIO_USER_REGION_WRITE``              10         client -> server
+``VFIO_USER_DMA_READ``                  11         server -> client
+``VFIO_USER_DMA_WRITE``                 12         server -> client
+``VFIO_USER_DEVICE_RESET``              13         client -> server
+``VFIO_USER_REGION_WRITE_MULTI``        15         client -> server
+======================================  =========  =================
+
+Header
+------
+
+All messages, both command messages and reply messages, are preceded by a
+16-byte header that contains basic information about the message. The header is
+followed by message-specific data described in the sections below.
+
++----------------+--------+-------------+
+| Name           | Offset | Size        |
++================+========+=============+
+| Message ID     | 0      | 2           |
++----------------+--------+-------------+
+| Command        | 2      | 2           |
++----------------+--------+-------------+
+| Message size   | 4      | 4           |
++----------------+--------+-------------+
+| Flags          | 8      | 4           |
++----------------+--------+-------------+
+|                | +-----+------------+ |
+|                | | Bit | Definition | |
+|                | +=====+============+ |
+|                | | 0-3 | Type       | |
+|                | +-----+------------+ |
+|                | | 4   | No_reply   | |
+|                | +-----+------------+ |
+|                | | 5   | Error      | |
+|                | +-----+------------+ |
++----------------+--------+-------------+
+| Error          | 12     | 4           |
++----------------+--------+-------------+
+| <message data> | 16     | variable    |
++----------------+--------+-------------+
+
+* *Message ID* identifies the message, and is echoed in the command's reply
+  message. Message IDs belong entirely to the sender, can be re-used (even
+  concurrently) and the receiver must not make any assumptions about their
+  uniqueness.
+* *Command* specifies the command to be executed, listed in Commands_. It is
+  also set in the reply header.
+* *Message size* contains the size of the entire message, including the header.
+* *Flags* contains attributes of the message:
+
+  * The *Type* bits indicate the message type.
+
+    *  *Command* (value 0x0) indicates a command message.
+    *  *Reply* (value 0x1) indicates a reply message acknowledging a previous
+       command with the same message ID.
+  * *No_reply* in a command message indicates that no reply is needed for this
+    command.  This is commonly used when multiple commands are sent, and only
+    the last needs acknowledgement.
+  * *Error* in a reply message indicates the command being acknowledged had
+    an error. In this case, the *Error* field will be valid.
+
+* *Error* in a reply message is an optional UNIX errno value. It may be zero
+  even if the Error bit is set in Flags. It is reserved in a command message.
+
+Each command message in Commands_ must be replied to with a reply message,
+unless the message sets the *No_Reply* bit.  The reply consists of the header
+with the *Reply* bit set, plus any additional data.
+
+If an error occurs, the reply message must only include the reply header.
+
+As the header is standard in both requests and replies, it is not included in
+the command-specific specifications below; each message definition should be
+appended to the standard header, and the offsets are given from the end of the
+standard header.
+
+``VFIO_USER_VERSION``
+---------------------
+
+.. _Version:
+
+This is the initial message sent by the client after the socket connection is
+established; the same format is used for the server's reply.
+
+Upon establishing a connection, the client must send a ``VFIO_USER_VERSION``
+message proposing a protocol version and a set of capabilities. The server
+compares these with the versions and capabilities it supports and sends a
+``VFIO_USER_VERSION`` reply according to the following rules.
+
+* The major version in the reply must be the same as proposed. If the client
+  does not support the proposed major, it closes the connection.
+* The minor version in the reply must be equal to or less than the minor
+  version proposed.
+* The capability list must be a subset of those proposed. If the server
+  requires a capability the client did not include, it closes the connection.
+
+The protocol major version will only change when incompatible protocol changes
+are made, such as changing the message format. The minor version may change
+when compatible changes are made, such as adding new messages or capabilities,
+Both the client and server must support all minor versions less than the
+maximum minor version it supports. E.g., an implementation that supports
+version 1.3 must also support 1.0 through 1.2.
+
+When making a change to this specification, the protocol version number must
+be included in the form "added in version X.Y"
+
+Request
+^^^^^^^
+
+==============  ======  ====
+Name            Offset  Size
+==============  ======  ====
+version major   0       2
+version minor   2       2
+version data    4       variable (including terminating NUL). Optional.
+==============  ======  ====
+
+The version data is an optional UTF-8 encoded JSON byte array with the following
+format:
+
++--------------+--------+-----------------------------------+
+| Name         | Type   | Description                       |
++==============+========+===================================+
+| capabilities | object | Contains common capabilities that |
+|              |        | the sender supports. Optional.    |
++--------------+--------+-----------------------------------+
+
+Capabilities:
+
++--------------------+---------+------------------------------------------------+
+| Name               | Type    | Description                                    |
++====================+=========+================================================+
+| max_msg_fds        | number  | Maximum number of file descriptors that can be |
+|                    |         | received by the sender in one message.         |
+|                    |         | Optional. If not specified then the receiver   |
+|                    |         | must assume a value of ``1``.                  |
++--------------------+---------+------------------------------------------------+
+| max_data_xfer_size | number  | Maximum ``count`` for data transfer messages;  |
+|                    |         | see `Read and Write Operations`_. Optional,    |
+|                    |         | with a default value of 1048576 bytes.         |
++--------------------+---------+------------------------------------------------+
+| pgsizes            | number  | Page sizes supported in DMA map operations     |
+|                    |         | or'ed together. Optional, with a default value |
+|                    |         | of supporting only 4k pages.                   |
++--------------------+---------+------------------------------------------------+
+| max_dma_maps       | number  | Maximum number DMA map windows that can be     |
+|                    |         | valid simultaneously.  Optional, with a        |
+|                    |         | value of 65535 (64k-1).                        |
++--------------------+---------+------------------------------------------------+
+| migration          | object  | Migration capability parameters. If missing    |
+|                    |         | then migration is not supported by the sender. |
++--------------------+---------+------------------------------------------------+
+| write_multiple     | boolean | ``VFIO_USER_REGION_WRITE_MULTI`` messages      |
+|                    |         | are supported if the value is ``true``.        |
++--------------------+---------+------------------------------------------------+
+
+The migration capability contains the following name/value pairs:
+
++-----------------+--------+--------------------------------------------------+
+| Name            | Type   | Description                                      |
++=================+========+==================================================+
+| pgsize          | number | Page size of dirty pages bitmap. The smallest    |
+|                 |        | between the client and the server is used.       |
++-----------------+--------+--------------------------------------------------+
+| max_bitmap_size | number | Maximum bitmap size in ``VFIO_USER_DIRTY_PAGES`` |
+|                 |        | and ``VFIO_DMA_UNMAP`` messages.  Optional,      |
+|                 |        | with a default value of 256MB.                   |
++-----------------+--------+--------------------------------------------------+
+
+Reply
+^^^^^
+
+The same message format is used in the server's reply with the semantics
+described above.
+
+``VFIO_USER_DMA_MAP``
+---------------------
+
+This command message is sent by the client to the server to inform it of the
+memory regions the server can access. It must be sent before the server can
+perform any DMA to the client. It is normally sent directly after the version
+handshake is completed, but may also occur when memory is added to the client,
+or if the client uses a vIOMMU.
+
+Request
+^^^^^^^
+
+The request payload for this message is a structure of the following format:
+
++-------------+--------+-------------+
+| Name        | Offset | Size        |
++=============+========+=============+
+| argsz       | 0      | 4           |
++-------------+--------+-------------+
+| flags       | 4      | 4           |
++-------------+--------+-------------+
+|             | +-----+------------+ |
+|             | | Bit | Definition | |
+|             | +=====+============+ |
+|             | | 0   | readable   | |
+|             | +-----+------------+ |
+|             | | 1   | writeable  | |
+|             | +-----+------------+ |
++-------------+--------+-------------+
+| offset      | 8      | 8           |
++-------------+--------+-------------+
+| address     | 16     | 8           |
++-------------+--------+-------------+
+| size        | 24     | 8           |
++-------------+--------+-------------+
+
+* *argsz* is the size of the above structure. Note there is no reply payload,
+  so this field differs from other message types.
+* *flags* contains the following region attributes:
+
+  * *readable* indicates that the region can be read from.
+
+  * *writeable* indicates that the region can be written to.
+
+* *offset* is the file offset of the region with respect to the associated file
+  descriptor, or zero if the region is not mappable
+* *address* is the base DMA address of the region.
+* *size* is the size of the region.
+
+This structure is 32 bytes in size, so the message size is 16 + 32 bytes.
+
+If the DMA region being added can be directly mapped by the server, a file
+descriptor must be sent as part of the message meta-data. The region can be
+mapped via the mmap() system call. On ``AF_UNIX`` sockets, the file descriptor
+must be passed as ``SCM_RIGHTS`` type ancillary data.  Otherwise, if the DMA
+region cannot be directly mapped by the server, no file descriptor must be sent
+as part of the message meta-data and the DMA region can be accessed by the
+server using ``VFIO_USER_DMA_READ`` and ``VFIO_USER_DMA_WRITE`` messages,
+explained in `Read and Write Operations`_. A command to map over an existing
+region must be failed by the server with ``EEXIST`` set in error field in the
+reply.
+
+Reply
+^^^^^
+
+There is no payload in the reply message.
+
+``VFIO_USER_DMA_UNMAP``
+-----------------------
+
+This command message is sent by the client to the server to inform it that a
+DMA region, previously made available via a ``VFIO_USER_DMA_MAP`` command
+message, is no longer available for DMA. It typically occurs when memory is
+subtracted from the client or if the client uses a vIOMMU. The DMA region is
+described by the following structure:
+
+Request
+^^^^^^^
+
+The request payload for this message is a structure of the following format:
+
++--------------+--------+------------------------+
+| Name         | Offset | Size                   |
++==============+========+========================+
+| argsz        | 0      | 4                      |
++--------------+--------+------------------------+
+| flags        | 4      | 4                      |
++--------------+--------+------------------------+
+| address      | 8      | 8                      |
++--------------+--------+------------------------+
+| size         | 16     | 8                      |
++--------------+--------+------------------------+
+
+* *argsz* is the maximum size of the reply payload.
+* *flags* is unused in this version.
+* *address* is the base DMA address of the DMA region.
+* *size* is the size of the DMA region.
+
+The address and size of the DMA region being unmapped must match exactly a
+previous mapping.
+
+Reply
+^^^^^
+
+Upon receiving a ``VFIO_USER_DMA_UNMAP`` command, if the file descriptor is
+mapped then the server must release all references to that DMA region before
+replying, which potentially includes in-flight DMA transactions.
+
+The server responds with the original DMA entry in the request.
+
+
+``VFIO_USER_DEVICE_GET_INFO``
+-----------------------------
+
+This command message is sent by the client to the server to query for basic
+information about the device.
+
+Request
+^^^^^^^
+
++-------------+--------+--------------------------+
+| Name        | Offset | Size                     |
++=============+========+==========================+
+| argsz       | 0      | 4                        |
++-------------+--------+--------------------------+
+| flags       | 4      | 4                        |
++-------------+--------+--------------------------+
+|             | +-----+-------------------------+ |
+|             | | Bit | Definition              | |
+|             | +=====+=========================+ |
+|             | | 0   | VFIO_DEVICE_FLAGS_RESET | |
+|             | +-----+-------------------------+ |
+|             | | 1   | VFIO_DEVICE_FLAGS_PCI   | |
+|             | +-----+-------------------------+ |
++-------------+--------+--------------------------+
+| num_regions | 8      | 4                        |
++-------------+--------+--------------------------+
+| num_irqs    | 12     | 4                        |
++-------------+--------+--------------------------+
+
+* *argsz* is the maximum size of the reply payload
+* all other fields must be zero.
+
+Reply
+^^^^^
+
++-------------+--------+--------------------------+
+| Name        | Offset | Size                     |
++=============+========+==========================+
+| argsz       | 0      | 4                        |
++-------------+--------+--------------------------+
+| flags       | 4      | 4                        |
++-------------+--------+--------------------------+
+|             | +-----+-------------------------+ |
+|             | | Bit | Definition              | |
+|             | +=====+=========================+ |
+|             | | 0   | VFIO_DEVICE_FLAGS_RESET | |
+|             | +-----+-------------------------+ |
+|             | | 1   | VFIO_DEVICE_FLAGS_PCI   | |
+|             | +-----+-------------------------+ |
++-------------+--------+--------------------------+
+| num_regions | 8      | 4                        |
++-------------+--------+--------------------------+
+| num_irqs    | 12     | 4                        |
++-------------+--------+--------------------------+
+
+* *argsz* is the size required for the full reply payload (16 bytes today)
+* *flags* contains the following device attributes.
+
+  * ``VFIO_DEVICE_FLAGS_RESET`` indicates that the device supports the
+    ``VFIO_USER_DEVICE_RESET`` message.
+  * ``VFIO_DEVICE_FLAGS_PCI`` indicates that the device is a PCI device.
+
+* *num_regions* is the number of memory regions that the device exposes.
+* *num_irqs* is the number of distinct interrupt types that the device supports.
+
+This version of the protocol only supports PCI devices. Additional devices may
+be supported in future versions.
+
+``VFIO_USER_DEVICE_GET_REGION_INFO``
+------------------------------------
+
+This command message is sent by the client to the server to query for
+information about device regions. The VFIO region info structure is defined in
+``<linux/vfio.h>`` (``struct vfio_region_info``).
+
+Request
+^^^^^^^
+
++------------+--------+------------------------------+
+| Name       | Offset | Size                         |
++============+========+==============================+
+| argsz      | 0      | 4                            |
++------------+--------+------------------------------+
+| flags      | 4      | 4                            |
++------------+--------+------------------------------+
+| index      | 8      | 4                            |
++------------+--------+------------------------------+
+| cap_offset | 12     | 4                            |
++------------+--------+------------------------------+
+| size       | 16     | 8                            |
++------------+--------+------------------------------+
+| offset     | 24     | 8                            |
++------------+--------+------------------------------+
+
+* *argsz* the maximum size of the reply payload
+* *index* is the index of memory region being queried, it is the only field
+  that is required to be set in the command message.
+* all other fields must be zero.
+
+Reply
+^^^^^
+
++------------+--------+------------------------------+
+| Name       | Offset | Size                         |
++============+========+==============================+
+| argsz      | 0      | 4                            |
++------------+--------+------------------------------+
+| flags      | 4      | 4                            |
++------------+--------+------------------------------+
+|            | +-----+-----------------------------+ |
+|            | | Bit | Definition                  | |
+|            | +=====+=============================+ |
+|            | | 0   | VFIO_REGION_INFO_FLAG_READ  | |
+|            | +-----+-----------------------------+ |
+|            | | 1   | VFIO_REGION_INFO_FLAG_WRITE | |
+|            | +-----+-----------------------------+ |
+|            | | 2   | VFIO_REGION_INFO_FLAG_MMAP  | |
+|            | +-----+-----------------------------+ |
+|            | | 3   | VFIO_REGION_INFO_FLAG_CAPS  | |
+|            | +-----+-----------------------------+ |
++------------+--------+------------------------------+
++------------+--------+------------------------------+
+| index      | 8      | 4                            |
++------------+--------+------------------------------+
+| cap_offset | 12     | 4                            |
++------------+--------+------------------------------+
+| size       | 16     | 8                            |
++------------+--------+------------------------------+
+| offset     | 24     | 8                            |
++------------+--------+------------------------------+
+
+* *argsz* is the size required for the full reply payload (region info structure
+  plus the size of any region capabilities)
+* *flags* are attributes of the region:
+
+  * ``VFIO_REGION_INFO_FLAG_READ`` allows client read access to the region.
+  * ``VFIO_REGION_INFO_FLAG_WRITE`` allows client write access to the region.
+  * ``VFIO_REGION_INFO_FLAG_MMAP`` specifies the client can mmap() the region.
+    When this flag is set, the reply will include a file descriptor in its
+    meta-data. On ``AF_UNIX`` sockets, the file descriptors will be passed as
+    ``SCM_RIGHTS`` type ancillary data.
+  * ``VFIO_REGION_INFO_FLAG_CAPS`` indicates additional capabilities found in the
+    reply.
+
+* *index* is the index of memory region being queried, it is the only field
+  that is required to be set in the command message.
+* *cap_offset* describes where additional region capabilities can be found.
+  cap_offset is relative to the beginning of the VFIO region info structure.
+  The data structure it points is a VFIO cap header defined in
+  ``<linux/vfio.h>``.
+* *size* is the size of the region.
+* *offset* is the offset that should be given to the mmap() system call for
+  regions with the MMAP attribute. It is also used as the base offset when
+  mapping a VFIO sparse mmap area, described below.
+
+VFIO region capabilities
+""""""""""""""""""""""""
+
+The VFIO region information can also include a capabilities list. This list is
+similar to a PCI capability list - each entry has a common header that
+identifies a capability and where the next capability in the list can be found.
+The VFIO capability header format is defined in ``<linux/vfio.h>`` (``struct
+vfio_info_cap_header``).
+
+VFIO cap header format
+""""""""""""""""""""""
+
++---------+--------+------+
+| Name    | Offset | Size |
++=========+========+======+
+| id      | 0      | 2    |
++---------+--------+------+
+| version | 2      | 2    |
++---------+--------+------+
+| next    | 4      | 4    |
++---------+--------+------+
+
+* *id* is the capability identity.
+* *version* is a capability-specific version number.
+* *next* specifies the offset of the next capability in the capability list. It
+  is relative to the beginning of the VFIO region info structure.
+
+VFIO sparse mmap cap header
+"""""""""""""""""""""""""""
+
++------------------+----------------------------------+
+| Name             | Value                            |
++==================+==================================+
+| id               | VFIO_REGION_INFO_CAP_SPARSE_MMAP |
++------------------+----------------------------------+
+| version          | 0x1                              |
++------------------+----------------------------------+
+| next             | <next>                           |
++------------------+----------------------------------+
+| sparse mmap info | VFIO region info sparse mmap     |
++------------------+----------------------------------+
+
+This capability is defined when only a subrange of the region supports
+direct access by the client via mmap(). The VFIO sparse mmap area is defined in
+``<linux/vfio.h>`` (``struct vfio_region_sparse_mmap_area`` and ``struct
+vfio_region_info_cap_sparse_mmap``).
+
+VFIO region info cap sparse mmap
+""""""""""""""""""""""""""""""""
+
++----------+--------+------+
+| Name     | Offset | Size |
++==========+========+======+
+| nr_areas | 0      | 4    |
++----------+--------+------+
+| reserved | 4      | 4    |
++----------+--------+------+
+| offset   | 8      | 8    |
++----------+--------+------+
+| size     | 16     | 8    |
++----------+--------+------+
+| ...      |        |      |
++----------+--------+------+
+
+* *nr_areas* is the number of sparse mmap areas in the region.
+* *offset* and size describe a single area that can be mapped by the client.
+  There will be *nr_areas* pairs of offset and size. The offset will be added to
+  the base offset given in the ``VFIO_USER_DEVICE_GET_REGION_INFO`` to form the
+  offset argument of the subsequent mmap() call.
+
+The VFIO sparse mmap area is defined in ``<linux/vfio.h>`` (``struct
+vfio_region_info_cap_sparse_mmap``).
+
+
+``VFIO_USER_DEVICE_GET_REGION_IO_FDS``
+--------------------------------------
+
+Clients can access regions via ``VFIO_USER_REGION_READ/WRITE`` or, if provided, by
+``mmap()`` of a file descriptor provided by the server.
+
+``VFIO_USER_DEVICE_GET_REGION_IO_FDS`` provides an alternative access mechanism via
+file descriptors. This is an optional feature intended for performance
+improvements where an underlying sub-system (such as KVM) supports communication
+across such file descriptors to the vfio-user server, without needing to
+round-trip through the client.
+
+The server returns an array of sub-regions for the requested region. Each
+sub-region describes a span (offset and size) of a region, along with the
+requested file descriptor notification mechanism to use.  Each sub-region in the
+response message may choose to use a different method, as defined below.  The
+two mechanisms supported in this specification are ioeventfds and ioregionfds.
+
+The server in addition returns a file descriptor in the ancillary data; clients
+are expected to configure each sub-region's file descriptor with the requested
+notification method. For example, a client could configure KVM with the
+requested ioeventfd via a ``KVM_IOEVENTFD`` ``ioctl()``.
+
+Request
+^^^^^^^
+
++-------------+--------+------+
+| Name        | Offset | Size |
++=============+========+======+
+| argsz       | 0      | 4    |
++-------------+--------+------+
+| flags       | 4      | 4    |
++-------------+--------+------+
+| index       | 8      | 4    |
++-------------+--------+------+
+| count       | 12     | 4    |
++-------------+--------+------+
+
+* *argsz* the maximum size of the reply payload
+* *index* is the index of memory region being queried
+* all other fields must be zero
+
+The client must set ``flags`` to zero and specify the region being queried in
+the ``index``.
+
+Reply
+^^^^^
+
++-------------+--------+------+
+| Name        | Offset | Size |
++=============+========+======+
+| argsz       | 0      | 4    |
++-------------+--------+------+
+| flags       | 4      | 4    |
++-------------+--------+------+
+| index       | 8      | 4    |
++-------------+--------+------+
+| count       | 12     | 4    |
++-------------+--------+------+
+| sub-regions | 16     | ...  |
++-------------+--------+------+
+
+* *argsz* is the size of the region IO FD info structure plus the
+  total size of the sub-region array. Thus, each array entry "i" is at offset
+  i * ((argsz - 32) / count). Note that currently this is 40 bytes for both IO
+  FD types, but this is not to be relied on. As elsewhere, this indicates the
+  full reply payload size needed.
+* *flags* must be zero
+* *index* is the index of memory region being queried
+* *count* is the number of sub-regions in the array
+* *sub-regions* is the array of Sub-Region IO FD info structures
+
+The reply message will additionally include at least one file descriptor in the
+ancillary data. Note that more than one sub-region may share the same file
+descriptor.
+
+Note that it is the client's responsibility to verify the requested values (for
+example, that the requested offset does not exceed the region's bounds).
+
+Each sub-region given in the response has one of two possible structures,
+depending whether *type* is ``VFIO_USER_IO_FD_TYPE_IOEVENTFD`` or
+``VFIO_USER_IO_FD_TYPE_IOREGIONFD``:
+
+Sub-Region IO FD info format (ioeventfd)
+""""""""""""""""""""""""""""""""""""""""
+
++-----------+--------+------+
+| Name      | Offset | Size |
++===========+========+======+
+| offset    | 0      | 8    |
++-----------+--------+------+
+| size      | 8      | 8    |
++-----------+--------+------+
+| fd_index  | 16     | 4    |
++-----------+--------+------+
+| type      | 20     | 4    |
++-----------+--------+------+
+| flags     | 24     | 4    |
++-----------+--------+------+
+| padding   | 28     | 4    |
++-----------+--------+------+
+| datamatch | 32     | 8    |
++-----------+--------+------+
+
+* *offset* is the offset of the start of the sub-region within the region
+  requested ("physical address offset" for the region)
+* *size* is the length of the sub-region. This may be zero if the access size is
+  not relevant, which may allow for optimizations
+* *fd_index* is the index in the ancillary data of the FD to use for ioeventfd
+  notification; it may be shared.
+* *type* is ``VFIO_USER_IO_FD_TYPE_IOEVENTFD``
+* *flags* is any of:
+
+  * ``KVM_IOEVENTFD_FLAG_DATAMATCH``
+  * ``KVM_IOEVENTFD_FLAG_PIO``
+  * ``KVM_IOEVENTFD_FLAG_VIRTIO_CCW_NOTIFY`` (FIXME: makes sense?)
+
+* *datamatch* is the datamatch value if needed
+
+See https://www.kernel.org/doc/Documentation/virtual/kvm/api.txt, *4.59
+KVM_IOEVENTFD* for further context on the ioeventfd-specific fields.
+
+Sub-Region IO FD info format (ioregionfd)
+"""""""""""""""""""""""""""""""""""""""""
+
++-----------+--------+------+
+| Name      | Offset | Size |
++===========+========+======+
+| offset    | 0      | 8    |
++-----------+--------+------+
+| size      | 8      | 8    |
++-----------+--------+------+
+| fd_index  | 16     | 4    |
++-----------+--------+------+
+| type      | 20     | 4    |
++-----------+--------+------+
+| flags     | 24     | 4    |
++-----------+--------+------+
+| padding   | 28     | 4    |
++-----------+--------+------+
+| user_data | 32     | 8    |
++-----------+--------+------+
+
+* *offset* is the offset of the start of the sub-region within the region
+  requested ("physical address offset" for the region)
+* *size* is the length of the sub-region. This may be zero if the access size is
+  not relevant, which may allow for optimizations; ``KVM_IOREGION_POSTED_WRITES``
+  must be set in *flags* in this case
+* *fd_index* is the index in the ancillary data of the FD to use for ioregionfd
+  messages; it may be shared
+* *type* is ``VFIO_USER_IO_FD_TYPE_IOREGIONFD``
+* *flags* is any of:
+
+  * ``KVM_IOREGION_PIO``
+  * ``KVM_IOREGION_POSTED_WRITES``
+
+* *user_data* is an opaque value passed back to the server via a message on the
+  file descriptor
+
+For further information on the ioregionfd-specific fields, see:
+https://lore.kernel.org/kvm/cover.1613828726.git.eafanasova@gmail.com/
+
+(FIXME: update with final API docs.)
+
+``VFIO_USER_DEVICE_GET_IRQ_INFO``
+---------------------------------
+
+This command message is sent by the client to the server to query for
+information about device interrupt types. The VFIO IRQ info structure is
+defined in ``<linux/vfio.h>`` (``struct vfio_irq_info``).
+
+Request
+^^^^^^^
+
++-------+--------+---------------------------+
+| Name  | Offset | Size                      |
++=======+========+===========================+
+| argsz | 0      | 4                         |
++-------+--------+---------------------------+
+| flags | 4      | 4                         |
++-------+--------+---------------------------+
+|       | +-----+--------------------------+ |
+|       | | Bit | Definition               | |
+|       | +=====+==========================+ |
+|       | | 0   | VFIO_IRQ_INFO_EVENTFD    | |
+|       | +-----+--------------------------+ |
+|       | | 1   | VFIO_IRQ_INFO_MASKABLE   | |
+|       | +-----+--------------------------+ |
+|       | | 2   | VFIO_IRQ_INFO_AUTOMASKED | |
+|       | +-----+--------------------------+ |
+|       | | 3   | VFIO_IRQ_INFO_NORESIZE   | |
+|       | +-----+--------------------------+ |
++-------+--------+---------------------------+
+| index | 8      | 4                         |
++-------+--------+---------------------------+
+| count | 12     | 4                         |
++-------+--------+---------------------------+
+
+* *argsz* is the maximum size of the reply payload (16 bytes today)
+* index is the index of IRQ type being queried (e.g. ``VFIO_PCI_MSIX_IRQ_INDEX``)
+* all other fields must be zero
+
+Reply
+^^^^^
+
++-------+--------+---------------------------+
+| Name  | Offset | Size                      |
++=======+========+===========================+
+| argsz | 0      | 4                         |
++-------+--------+---------------------------+
+| flags | 4      | 4                         |
++-------+--------+---------------------------+
+|       | +-----+--------------------------+ |
+|       | | Bit | Definition               | |
+|       | +=====+==========================+ |
+|       | | 0   | VFIO_IRQ_INFO_EVENTFD    | |
+|       | +-----+--------------------------+ |
+|       | | 1   | VFIO_IRQ_INFO_MASKABLE   | |
+|       | +-----+--------------------------+ |
+|       | | 2   | VFIO_IRQ_INFO_AUTOMASKED | |
+|       | +-----+--------------------------+ |
+|       | | 3   | VFIO_IRQ_INFO_NORESIZE   | |
+|       | +-----+--------------------------+ |
++-------+--------+---------------------------+
+| index | 8      | 4                         |
++-------+--------+---------------------------+
+| count | 12     | 4                         |
++-------+--------+---------------------------+
+
+* *argsz* is the size required for the full reply payload (16 bytes today)
+* *flags* defines IRQ attributes:
+
+  * ``VFIO_IRQ_INFO_EVENTFD`` indicates the IRQ type can support server eventfd
+    signalling.
+  * ``VFIO_IRQ_INFO_MASKABLE`` indicates that the IRQ type supports the ``MASK``
+    and ``UNMASK`` actions in a ``VFIO_USER_DEVICE_SET_IRQS`` message.
+  * ``VFIO_IRQ_INFO_AUTOMASKED`` indicates the IRQ type masks itself after being
+    triggered, and the client must send an ``UNMASK`` action to receive new
+    interrupts.
+  * ``VFIO_IRQ_INFO_NORESIZE`` indicates ``VFIO_USER_SET_IRQS`` operations setup
+    interrupts as a set, and new sub-indexes cannot be enabled without disabling
+    the entire type.
+* index is the index of IRQ type being queried
+* count describes the number of interrupts of the queried type.
+
+``VFIO_USER_DEVICE_SET_IRQS``
+-----------------------------
+
+This command message is sent by the client to the server to set actions for
+device interrupt types. The VFIO IRQ set structure is defined in
+``<linux/vfio.h>`` (``struct vfio_irq_set``).
+
+Request
+^^^^^^^
+
++-------+--------+------------------------------+
+| Name  | Offset | Size                         |
++=======+========+==============================+
+| argsz | 0      | 4                            |
++-------+--------+------------------------------+
+| flags | 4      | 4                            |
++-------+--------+------------------------------+
+|       | +-----+-----------------------------+ |
+|       | | Bit | Definition                  | |
+|       | +=====+=============================+ |
+|       | | 0   | VFIO_IRQ_SET_DATA_NONE      | |
+|       | +-----+-----------------------------+ |
+|       | | 1   | VFIO_IRQ_SET_DATA_BOOL      | |
+|       | +-----+-----------------------------+ |
+|       | | 2   | VFIO_IRQ_SET_DATA_EVENTFD   | |
+|       | +-----+-----------------------------+ |
+|       | | 3   | VFIO_IRQ_SET_ACTION_MASK    | |
+|       | +-----+-----------------------------+ |
+|       | | 4   | VFIO_IRQ_SET_ACTION_UNMASK  | |
+|       | +-----+-----------------------------+ |
+|       | | 5   | VFIO_IRQ_SET_ACTION_TRIGGER | |
+|       | +-----+-----------------------------+ |
++-------+--------+------------------------------+
+| index | 8      | 4                            |
++-------+--------+------------------------------+
+| start | 12     | 4                            |
++-------+--------+------------------------------+
+| count | 16     | 4                            |
++-------+--------+------------------------------+
+| data  | 20     | variable                     |
++-------+--------+------------------------------+
+
+* *argsz* is the size of the VFIO IRQ set request payload, including any *data*
+  field. Note there is no reply payload, so this field differs from other
+  message types.
+* *flags* defines the action performed on the interrupt range. The ``DATA``
+  flags describe the data field sent in the message; the ``ACTION`` flags
+  describe the action to be performed. The flags are mutually exclusive for
+  both sets.
+
+  * ``VFIO_IRQ_SET_DATA_NONE`` indicates there is no data field in the command.
+    The action is performed unconditionally.
+  * ``VFIO_IRQ_SET_DATA_BOOL`` indicates the data field is an array of boolean
+    bytes. The action is performed if the corresponding boolean is true.
+  * ``VFIO_IRQ_SET_DATA_EVENTFD`` indicates an array of event file descriptors
+    was sent in the message meta-data. These descriptors will be signalled when
+    the action defined by the action flags occurs. In ``AF_UNIX`` sockets, the
+    descriptors are sent as ``SCM_RIGHTS`` type ancillary data.
+    If no file descriptors are provided, this de-assigns the specified
+    previously configured interrupts.
+  * ``VFIO_IRQ_SET_ACTION_MASK`` indicates a masking event. It can be used with
+    ``VFIO_IRQ_SET_DATA_BOOL`` or ``VFIO_IRQ_SET_DATA_NONE`` to mask an interrupt,
+    or with ``VFIO_IRQ_SET_DATA_EVENTFD`` to generate an event when the guest masks
+    the interrupt.
+  * ``VFIO_IRQ_SET_ACTION_UNMASK`` indicates an unmasking event. It can be used
+    with ``VFIO_IRQ_SET_DATA_BOOL`` or ``VFIO_IRQ_SET_DATA_NONE`` to unmask an
+    interrupt, or with ``VFIO_IRQ_SET_DATA_EVENTFD`` to generate an event when the
+    guest unmasks the interrupt.
+  * ``VFIO_IRQ_SET_ACTION_TRIGGER`` indicates a triggering event. It can be used
+    with ``VFIO_IRQ_SET_DATA_BOOL`` or ``VFIO_IRQ_SET_DATA_NONE`` to trigger an
+    interrupt, or with ``VFIO_IRQ_SET_DATA_EVENTFD`` to generate an event when the
+    server triggers the interrupt.
+
+* *index* is the index of IRQ type being setup.
+* *start* is the start of the sub-index being set.
+* *count* describes the number of sub-indexes being set. As a special case, a
+  count (and start) of 0, with data flags of ``VFIO_IRQ_SET_DATA_NONE`` disables
+  all interrupts of the index.
+* *data* is an optional field included when the
+  ``VFIO_IRQ_SET_DATA_BOOL`` flag is present. It contains an array of booleans
+  that specify whether the action is to be performed on the corresponding
+  index. It's used when the action is only performed on a subset of the range
+  specified.
+
+Not all interrupt types support every combination of data and action flags.
+The client must know the capabilities of the device and IRQ index before it
+sends a ``VFIO_USER_DEVICE_SET_IRQ`` message.
+
+In typical operation, a specific IRQ may operate as follows:
+
+1. The client sends a ``VFIO_USER_DEVICE_SET_IRQ`` message with
+   ``flags=(VFIO_IRQ_SET_DATA_EVENTFD|VFIO_IRQ_SET_ACTION_TRIGGER)`` along
+   with an eventfd. This associates the IRQ with a particular eventfd on the
+   server side.
+
+#. The client may send a ``VFIO_USER_DEVICE_SET_IRQ`` message with
+   ``flags=(VFIO_IRQ_SET_DATA_EVENTFD|VFIO_IRQ_SET_ACTION_MASK/UNMASK)`` along
+   with another eventfd. This associates the given eventfd with the
+   mask/unmask state on the server side.
+
+#. The server may trigger the IRQ by writing 1 to the eventfd.
+
+#. The server may mask/unmask an IRQ which will write 1 to the corresponding
+   mask/unmask eventfd, if there is one.
+
+5. A client may trigger a device IRQ itself, by sending a
+   ``VFIO_USER_DEVICE_SET_IRQ`` message with
+   ``flags=(VFIO_IRQ_SET_DATA_NONE/BOOL|VFIO_IRQ_SET_ACTION_TRIGGER)``.
+
+6. A client may mask or unmask the IRQ, by sending a
+   ``VFIO_USER_DEVICE_SET_IRQ`` message with
+   ``flags=(VFIO_IRQ_SET_DATA_NONE/BOOL|VFIO_IRQ_SET_ACTION_MASK/UNMASK)``.
+
+Reply
+^^^^^
+
+There is no payload in the reply.
+
+.. _Read and Write Operations:
+
+Note that all of these operations must be supported by the client and/or server,
+even if the corresponding memory or device region has been shared as mappable.
+
+The ``count`` field must not exceed the value of ``max_data_xfer_size`` of the
+peer, for both reads and writes.
+
+``VFIO_USER_REGION_READ``
+-------------------------
+
+If a device region is not mappable, it's not directly accessible by the client
+via ``mmap()`` of the underlying file descriptor. In this case, a client can
+read from a device region with this message.
+
+Request
+^^^^^^^
+
++--------+--------+----------+
+| Name   | Offset | Size     |
++========+========+==========+
+| offset | 0      | 8        |
++--------+--------+----------+
+| region | 8      | 4        |
++--------+--------+----------+
+| count  | 12     | 4        |
++--------+--------+----------+
+
+* *offset* into the region being accessed.
+* *region* is the index of the region being accessed.
+* *count* is the size of the data to be transferred.
+
+Reply
+^^^^^
+
++--------+--------+----------+
+| Name   | Offset | Size     |
++========+========+==========+
+| offset | 0      | 8        |
++--------+--------+----------+
+| region | 8      | 4        |
++--------+--------+----------+
+| count  | 12     | 4        |
++--------+--------+----------+
+| data   | 16     | variable |
++--------+--------+----------+
+
+* *offset* into the region accessed.
+* *region* is the index of the region accessed.
+* *count* is the size of the data transferred.
+* *data* is the data that was read from the device region.
+
+``VFIO_USER_REGION_WRITE``
+--------------------------
+
+If a device region is not mappable, it's not directly accessible by the client
+via mmap() of the underlying fd. In this case, a client can write to a device
+region with this message.
+
+Request
+^^^^^^^
+
++--------+--------+----------+
+| Name   | Offset | Size     |
++========+========+==========+
+| offset | 0      | 8        |
++--------+--------+----------+
+| region | 8      | 4        |
++--------+--------+----------+
+| count  | 12     | 4        |
++--------+--------+----------+
+| data   | 16     | variable |
++--------+--------+----------+
+
+* *offset* into the region being accessed.
+* *region* is the index of the region being accessed.
+* *count* is the size of the data to be transferred.
+* *data* is the data to write
+
+Reply
+^^^^^
+
++--------+--------+----------+
+| Name   | Offset | Size     |
++========+========+==========+
+| offset | 0      | 8        |
++--------+--------+----------+
+| region | 8      | 4        |
++--------+--------+----------+
+| count  | 12     | 4        |
++--------+--------+----------+
+
+* *offset* into the region accessed.
+* *region* is the index of the region accessed.
+* *count* is the size of the data transferred.
+
+``VFIO_USER_DMA_READ``
+-----------------------
+
+If the client has not shared mappable memory, the server can use this message to
+read from guest memory.
+
+Request
+^^^^^^^
+
++---------+--------+----------+
+| Name    | Offset | Size     |
++=========+========+==========+
+| address | 0      | 8        |
++---------+--------+----------+
+| count   | 8      | 8        |
++---------+--------+----------+
+
+* *address* is the client DMA memory address being accessed. This address must have
+  been previously exported to the server with a ``VFIO_USER_DMA_MAP`` message.
+* *count* is the size of the data to be transferred.
+
+Reply
+^^^^^
+
++---------+--------+----------+
+| Name    | Offset | Size     |
++=========+========+==========+
+| address | 0      | 8        |
++---------+--------+----------+
+| count   | 8      | 8        |
++---------+--------+----------+
+| data    | 16     | variable |
++---------+--------+----------+
+
+* *address* is the client DMA memory address being accessed.
+* *count* is the size of the data transferred.
+* *data* is the data read.
+
+``VFIO_USER_DMA_WRITE``
+-----------------------
+
+If the client has not shared mappable memory, the server can use this message to
+write to guest memory.
+
+Request
+^^^^^^^
+
++---------+--------+----------+
+| Name    | Offset | Size     |
++=========+========+==========+
+| address | 0      | 8        |
++---------+--------+----------+
+| count   | 8      | 8        |
++---------+--------+----------+
+| data    | 16     | variable |
++---------+--------+----------+
+
+* *address* is the client DMA memory address being accessed. This address must have
+  been previously exported to the server with a ``VFIO_USER_DMA_MAP`` message.
+* *count* is the size of the data to be transferred.
+* *data* is the data to write
+
+Reply
+^^^^^
+
++---------+--------+----------+
+| Name    | Offset | Size     |
++=========+========+==========+
+| address | 0      | 8        |
++---------+--------+----------+
+| count   | 8      | 4        |
++---------+--------+----------+
+
+* *address* is the client DMA memory address being accessed.
+* *count* is the size of the data transferred.
+
+``VFIO_USER_DEVICE_RESET``
+--------------------------
+
+This command message is sent from the client to the server to reset the device.
+Neither the request or reply have a payload.
+
+``VFIO_USER_REGION_WRITE_MULTI``
+--------------------------------
+
+This message can be used to coalesce multiple device write operations
+into a single messgage.  It is only used as an optimization when the
+outgoing message queue is relatively full.
+
+Request
+^^^^^^^
+
++---------+--------+----------+
+| Name    | Offset | Size     |
++=========+========+==========+
+| wr_cnt  | 0      | 8        |
++---------+--------+----------+
+| wrs     | 8      | variable |
++---------+--------+----------+
+
+* *wr_cnt* is the number of device writes coalesced in the message
+* *wrs* is an array of device writes defined below
+
+Single Device Write Format
+""""""""""""""""""""""""""
+
++--------+--------+----------+
+| Name   | Offset | Size     |
++========+========+==========+
+| offset | 0      | 8        |
++--------+--------+----------+
+| region | 8      | 4        |
++--------+--------+----------+
+| count  | 12     | 4        |
++--------+--------+----------+
+| data   | 16     | 8        |
++--------+--------+----------+
+
+* *offset* into the region being accessed.
+* *region* is the index of the region being accessed.
+* *count* is the size of the data to be transferred.  This format can
+  only describe writes of 8 bytes or less.
+* *data* is the data to write.
+
+Reply
+^^^^^
+
++---------+--------+----------+
+| Name    | Offset | Size     |
++=========+========+==========+
+| wr_cnt  | 0      | 8        |
++---------+--------+----------+
+
+* *wr_cnt* is the number of device writes completed.
+
+
+Appendices
+==========
+
+Unused VFIO ``ioctl()`` commands
+--------------------------------
+
+The following VFIO commands do not have an equivalent vfio-user command:
+
+* ``VFIO_GET_API_VERSION``
+* ``VFIO_CHECK_EXTENSION``
+* ``VFIO_SET_IOMMU``
+* ``VFIO_GROUP_GET_STATUS``
+* ``VFIO_GROUP_SET_CONTAINER``
+* ``VFIO_GROUP_UNSET_CONTAINER``
+* ``VFIO_GROUP_GET_DEVICE_FD``
+* ``VFIO_IOMMU_GET_INFO``
+
+However, once support for live migration for VFIO devices is finalized some
+of the above commands may have to be handled by the client in their
+corresponding vfio-user form. This will be addressed in a future protocol
+version.
+
+VFIO groups and containers
+^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+The current VFIO implementation includes group and container idioms that
+describe how a device relates to the host IOMMU. In the vfio-user
+implementation, the IOMMU is implemented in SW by the client, and is not
+visible to the server. The simplest idea would be that the client put each
+device into its own group and container.
+
+Backend Program Conventions
+---------------------------
+
+vfio-user backend program conventions are based on the vhost-user ones.
+
+* The backend program must not daemonize itself.
+* No assumptions must be made as to what access the backend program has on the
+  system.
+* File descriptors 0, 1 and 2 must exist, must have regular
+  stdin/stdout/stderr semantics, and can be redirected.
+* The backend program must honor the SIGTERM signal.
+* The backend program must accept the following commands line options:
+
+  * ``--socket-path=PATH``: path to UNIX domain socket,
+  * ``--fd=FDNUM``: file descriptor for UNIX domain socket, incompatible with
+    ``--socket-path``
+* The backend program must be accompanied with a JSON file stored under
+  ``/usr/share/vfio-user``.
+
+TODO add schema similar to docs/interop/vhost-user.json.

From 776bd01809fe0f524a578257ff82787d067dbe93 Mon Sep 17 00:00:00 2001
From: Kostiantyn Kostiuk <kkostiuk@redhat.com>
Date: Fri, 20 Jun 2025 13:21:40 +0300
Subject: [PATCH 1693/2760] MAINTAINERS: Update Kostiantyn Kostiuk
 transliteration

Reviewed-by: Yan Vugenfirer <yvugenfi@redhat.com>
Message-ID: <20250620102140.38556-1-kkostiuk@redhat.com>
Signed-off-by: Kostiantyn Kostiuk <kkostiuk@redhat.com>
---
 MAINTAINERS | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/MAINTAINERS b/MAINTAINERS
index d1672fda8d..4cfb587a0d 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3383,7 +3383,7 @@ T: git https://repo.or.cz/qemu/armbru.git qapi-next
 
 QEMU Guest Agent
 M: Michael Roth <michael.roth@amd.com>
-M: Konstantin Kostiuk <kkostiuk@redhat.com>
+M: Kostiantyn Kostiuk <kkostiuk@redhat.com>
 S: Maintained
 F: qga/
 F: contrib/systemd/qemu-guest-agent.service
@@ -3394,7 +3394,7 @@ F: tests/*/test-qga*
 T: git https://github.com/mdroth/qemu.git qga
 
 QEMU Guest Agent Win32
-M: Konstantin Kostiuk <kkostiuk@redhat.com>
+M: Kostiantyn Kostiuk <kkostiuk@redhat.com>
 S: Maintained
 F: qga/*win32*
 F: qga/vss-win32/

From 012bb70cd16512dbcc1ba423c3f7f260e177afe7 Mon Sep 17 00:00:00 2001
From: Kostiantyn Kostiuk <kkostiuk@redhat.com>
Date: Fri, 20 Jun 2025 11:31:32 +0300
Subject: [PATCH 1694/2760] qga-vss: Exit with non-zero code when register fail

QGA installer uses rundll32 to run the DLLCOMRegister function
from qga-vss.dll and perform VSS provider registration.
rundll32 ignores the return value of the function and always
exits with a zero exit code. This causes a situation where
the installer does not know the status of VSS provider registration.

This commit forces to change exit code when the VSS provider
registration fails.

https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/rundll32

Reviewed-by: Yan Vugenfirer <yvugenfi@redhat.com>
Tested-by: Dehan Meng <demeng@redhat.com>
Message-ID: <20250620083132.28347-1-kkostiuk@redhat.com>
Signed-off-by: Kostiantyn Kostiuk <kkostiuk@redhat.com>
---
 qga/vss-win32/install.cpp | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/qga/vss-win32/install.cpp b/qga/vss-win32/install.cpp
index 5cea5bcf74..6ee2f44a10 100644
--- a/qga/vss-win32/install.cpp
+++ b/qga/vss-win32/install.cpp
@@ -385,7 +385,10 @@ out:
 STDAPI_(void) CALLBACK DLLCOMRegister(HWND, HINSTANCE, LPSTR, int);
 STDAPI_(void) CALLBACK DLLCOMRegister(HWND, HINSTANCE, LPSTR, int)
 {
-    COMRegister();
+    HRESULT hr = COMRegister();
+    if (FAILED(hr)) {
+        exit(hr);
+    }
 }
 
 STDAPI_(void) CALLBACK DLLCOMUnregister(HWND, HINSTANCE, LPSTR, int);

From 1c90e89e64beb2bd72f8e437c56274c885df7b3f Mon Sep 17 00:00:00 2001
From: Elizabeth Ashurov <eashurov@redhat.com>
Date: Wed, 18 Jun 2025 12:18:06 +0300
Subject: [PATCH 1695/2760] qga/vss-win32: Add VSS provider unregistration
 retry

This commit improves the QGA VSS provider installation flow by attempting to unregister the VSS provider if it's already
found during installation. This allows for a retry of installation even if a previous unregistration failed or was not performed.
This will prevent inconsistencies between QGA and QGA-VSS versions.
Before this commit, QGA can use QGA-VSS from the previous installation.

Signed-off-by: Elizabeth Ashurov <eashurov@redhat.com>
Reviewed-by: Kostiantyn Kostiuk <kkostiuk@redhat.com>
Message-ID: <20250618091806.170110-1-eashurov@redhat.com>
Signed-off-by: Kostiantyn Kostiuk <kkostiuk@redhat.com>
---
 qga/vss-win32/install.cpp | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/qga/vss-win32/install.cpp b/qga/vss-win32/install.cpp
index 6ee2f44a10..7b25d9098b 100644
--- a/qga/vss-win32/install.cpp
+++ b/qga/vss-win32/install.cpp
@@ -287,9 +287,13 @@ STDAPI COMRegister(void)
 
     chk(QGAProviderFind(QGAProviderCount, (void *)&count));
     if (count) {
-        errmsg(E_ABORT, "QGA VSS Provider is already installed");
-        qga_debug_end;
-        return E_ABORT;
+        qga_debug("QGA VSS Provider is already installed. Attempting to unregister first.");
+        hr = COMUnregister();
+        if (FAILED(hr)) {
+            errmsg(hr, "Failed to unregister existing QGA VSS Provider. Aborting installation.");
+            qga_debug_end;
+            return E_ABORT;
+        }
     }
 
     chk(CoCreateInstance(CLSID_COMAdminCatalog, NULL, CLSCTX_INPROC_SERVER,

From c1fa1b30ec5da0659cf071481f19ed64c964ea6b Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 17 Feb 2025 15:17:47 -0800
Subject: [PATCH 1696/2760] tcg/optimize: Introduce arg_const_val

Use arg_const_val instead of direct access to the TempOptInfo val
member.  Rename both val and is_const to catch all direct accesses.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 78 ++++++++++++++++++++++++++------------------------
 1 file changed, 41 insertions(+), 37 deletions(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index 10a76c5461..73a272eeb3 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -39,11 +39,11 @@ typedef struct MemCopyInfo {
 } MemCopyInfo;
 
 typedef struct TempOptInfo {
-    bool is_const;
+    bool is_const_;
     TCGTemp *prev_copy;
     TCGTemp *next_copy;
     QSIMPLEQ_HEAD(, MemCopyInfo) mem_copy;
-    uint64_t val;
+    uint64_t val_;
     uint64_t z_mask;  /* mask bit is 0 if and only if value bit is 0 */
     uint64_t s_mask;  /* mask bit is 1 if value bit matches msb */
 } TempOptInfo;
@@ -73,12 +73,12 @@ static inline TempOptInfo *arg_info(TCGArg arg)
 
 static inline bool ti_is_const(TempOptInfo *ti)
 {
-    return ti->is_const;
+    return ti->is_const_;
 }
 
 static inline uint64_t ti_const_val(TempOptInfo *ti)
 {
-    return ti->val;
+    return ti->val_;
 }
 
 static inline bool ti_is_const_val(TempOptInfo *ti, uint64_t val)
@@ -101,6 +101,11 @@ static inline bool arg_is_const(TCGArg arg)
     return ts_is_const(arg_temp(arg));
 }
 
+static inline uint64_t arg_const_val(TCGArg arg)
+{
+    return ti_const_val(arg_info(arg));
+}
+
 static inline bool arg_is_const_val(TCGArg arg, uint64_t val)
 {
     return ts_is_const_val(arg_temp(arg), val);
@@ -137,12 +142,12 @@ static void init_ts_info(OptContext *ctx, TCGTemp *ts)
     ti->prev_copy = ts;
     QSIMPLEQ_INIT(&ti->mem_copy);
     if (ts->kind == TEMP_CONST) {
-        ti->is_const = true;
-        ti->val = ts->val;
+        ti->is_const_ = true;
+        ti->val_ = ts->val;
         ti->z_mask = ts->val;
         ti->s_mask = INT64_MIN >> clrsb64(ts->val);
     } else {
-        ti->is_const = false;
+        ti->is_const_ = false;
         ti->z_mask = -1;
         ti->s_mask = 0;
     }
@@ -229,7 +234,7 @@ static void reset_ts(OptContext *ctx, TCGTemp *ts)
     pi->next_copy = ti->next_copy;
     ti->next_copy = ts;
     ti->prev_copy = ts;
-    ti->is_const = false;
+    ti->is_const_ = false;
     ti->z_mask = -1;
     ti->s_mask = 0;
 
@@ -394,8 +399,8 @@ static bool tcg_opt_gen_mov(OptContext *ctx, TCGOp *op, TCGArg dst, TCGArg src)
         di->prev_copy = src_ts;
         ni->prev_copy = dst_ts;
         si->next_copy = dst_ts;
-        di->is_const = si->is_const;
-        di->val = si->val;
+        di->is_const_ = si->is_const_;
+        di->val_ = si->val_;
 
         if (!QSIMPLEQ_EMPTY(&si->mem_copy)
             && cmp_better_copy(src_ts, dst_ts) == dst_ts) {
@@ -687,8 +692,8 @@ static int do_constant_folding_cond(TCGType type, TCGArg x,
                                     TCGArg y, TCGCond c)
 {
     if (arg_is_const(x) && arg_is_const(y)) {
-        uint64_t xv = arg_info(x)->val;
-        uint64_t yv = arg_info(y)->val;
+        uint64_t xv = arg_const_val(x);
+        uint64_t yv = arg_const_val(y);
 
         switch (type) {
         case TCG_TYPE_I32:
@@ -801,14 +806,14 @@ static int do_constant_folding_cond1(OptContext *ctx, TCGOp *op, TCGArg dest,
      * TSTNE x,i -> NE x,0 if i includes all nonzero bits of x
      */
     if (args_are_copies(*p1, *p2) ||
-        (arg_is_const(*p2) && (i1->z_mask & ~arg_info(*p2)->val) == 0)) {
+        (arg_is_const(*p2) && (i1->z_mask & ~arg_const_val(*p2)) == 0)) {
         *p2 = arg_new_constant(ctx, 0);
         *pcond = tcg_tst_eqne_cond(cond);
         return -1;
     }
 
     /* TSTNE x,i -> LT x,0 if i only includes sign bit copies */
-    if (arg_is_const(*p2) && (arg_info(*p2)->val & ~i1->s_mask) == 0) {
+    if (arg_is_const(*p2) && (arg_const_val(*p2) & ~i1->s_mask) == 0) {
         *p2 = arg_new_constant(ctx, 0);
         *pcond = tcg_tst_ltge_cond(cond);
         return -1;
@@ -849,13 +854,13 @@ static int do_constant_folding_cond2(OptContext *ctx, TCGOp *op, TCGArg *args)
     bh = args[3];
 
     if (arg_is_const(bl) && arg_is_const(bh)) {
-        tcg_target_ulong blv = arg_info(bl)->val;
-        tcg_target_ulong bhv = arg_info(bh)->val;
+        tcg_target_ulong blv = arg_const_val(bl);
+        tcg_target_ulong bhv = arg_const_val(bh);
         uint64_t b = deposit64(blv, 32, 32, bhv);
 
         if (arg_is_const(al) && arg_is_const(ah)) {
-            tcg_target_ulong alv = arg_info(al)->val;
-            tcg_target_ulong ahv = arg_info(ah)->val;
+            tcg_target_ulong alv = arg_const_val(al);
+            tcg_target_ulong ahv = arg_const_val(ah);
             uint64_t a = deposit64(alv, 32, 32, ahv);
 
             r = do_constant_folding_cond_64(a, b, c);
@@ -989,9 +994,8 @@ static bool finish_folding(OptContext *ctx, TCGOp *op)
 static bool fold_const1(OptContext *ctx, TCGOp *op)
 {
     if (arg_is_const(op->args[1])) {
-        uint64_t t;
+        uint64_t t = arg_const_val(op->args[1]);
 
-        t = arg_info(op->args[1])->val;
         t = do_constant_folding(op->opc, ctx->type, t, 0);
         return tcg_opt_gen_movi(ctx, op, op->args[0], t);
     }
@@ -1001,8 +1005,8 @@ static bool fold_const1(OptContext *ctx, TCGOp *op)
 static bool fold_const2(OptContext *ctx, TCGOp *op)
 {
     if (arg_is_const(op->args[1]) && arg_is_const(op->args[2])) {
-        uint64_t t1 = arg_info(op->args[1])->val;
-        uint64_t t2 = arg_info(op->args[2])->val;
+        uint64_t t1 = arg_const_val(op->args[1]);
+        uint64_t t2 = arg_const_val(op->args[2]);
 
         t1 = do_constant_folding(op->opc, ctx->type, t1, t2);
         return tcg_opt_gen_movi(ctx, op, op->args[0], t1);
@@ -1486,8 +1490,8 @@ static bool fold_bitsel_vec(OptContext *ctx, TCGOp *op)
     }
 
     if (arg_is_const(op->args[2]) && arg_is_const(op->args[3])) {
-        uint64_t tv = arg_info(op->args[2])->val;
-        uint64_t fv = arg_info(op->args[3])->val;
+        uint64_t tv = arg_const_val(op->args[2]);
+        uint64_t fv = arg_const_val(op->args[3]);
 
         if (tv == -1 && fv == 0) {
             return tcg_opt_gen_mov(ctx, op, op->args[0], op->args[1]);
@@ -1504,7 +1508,7 @@ static bool fold_bitsel_vec(OptContext *ctx, TCGOp *op)
         }
     }
     if (arg_is_const(op->args[2])) {
-        uint64_t tv = arg_info(op->args[2])->val;
+        uint64_t tv = arg_const_val(op->args[2]);
         if (tv == -1) {
             op->opc = INDEX_op_or_vec;
             op->args[2] = op->args[3];
@@ -1518,7 +1522,7 @@ static bool fold_bitsel_vec(OptContext *ctx, TCGOp *op)
         }
     }
     if (arg_is_const(op->args[3])) {
-        uint64_t fv = arg_info(op->args[3])->val;
+        uint64_t fv = arg_const_val(op->args[3]);
         if (fv == 0) {
             op->opc = INDEX_op_and_vec;
             return fold_and(ctx, op);
@@ -1876,7 +1880,7 @@ static bool fold_divide(OptContext *ctx, TCGOp *op)
 static bool fold_dup(OptContext *ctx, TCGOp *op)
 {
     if (arg_is_const(op->args[1])) {
-        uint64_t t = arg_info(op->args[1])->val;
+        uint64_t t = arg_const_val(op->args[1]);
         t = dup_const(TCGOP_VECE(op), t);
         return tcg_opt_gen_movi(ctx, op, op->args[0], t);
     }
@@ -1886,8 +1890,8 @@ static bool fold_dup(OptContext *ctx, TCGOp *op)
 static bool fold_dup2(OptContext *ctx, TCGOp *op)
 {
     if (arg_is_const(op->args[1]) && arg_is_const(op->args[2])) {
-        uint64_t t = deposit64(arg_info(op->args[1])->val, 32, 32,
-                               arg_info(op->args[2])->val);
+        uint64_t t = deposit64(arg_const_val(op->args[1]), 32, 32,
+                               arg_const_val(op->args[2]));
         return tcg_opt_gen_movi(ctx, op, op->args[0], t);
     }
 
@@ -1958,8 +1962,8 @@ static bool fold_extract(OptContext *ctx, TCGOp *op)
 static bool fold_extract2(OptContext *ctx, TCGOp *op)
 {
     if (arg_is_const(op->args[1]) && arg_is_const(op->args[2])) {
-        uint64_t v1 = arg_info(op->args[1])->val;
-        uint64_t v2 = arg_info(op->args[2])->val;
+        uint64_t v1 = arg_const_val(op->args[1]);
+        uint64_t v2 = arg_const_val(op->args[2]);
         int shr = op->args[3];
 
         if (ctx->type == TCG_TYPE_I32) {
@@ -2127,8 +2131,8 @@ static bool fold_multiply2(OptContext *ctx, TCGOp *op)
     swap_commutative(op->args[0], &op->args[2], &op->args[3]);
 
     if (arg_is_const(op->args[2]) && arg_is_const(op->args[3])) {
-        uint64_t a = arg_info(op->args[2])->val;
-        uint64_t b = arg_info(op->args[3])->val;
+        uint64_t a = arg_const_val(op->args[2]);
+        uint64_t b = arg_const_val(op->args[3]);
         uint64_t h, l;
         TCGArg rl, rh;
         TCGOp *op2;
@@ -2330,7 +2334,7 @@ static int fold_setcond_zmask(OptContext *ctx, TCGOp *op, bool neg)
     }
 
     a_zmask = arg_info(op->args[1])->z_mask;
-    b_val = arg_info(op->args[2])->val;
+    b_val = arg_const_val(op->args[2]);
     cond = op->args[3];
 
     if (ctx->type == TCG_TYPE_I32) {
@@ -2418,7 +2422,7 @@ static void fold_setcond_tst_pow2(OptContext *ctx, TCGOp *op, bool neg)
     }
 
     src2 = op->args[2];
-    val = arg_info(src2)->val;
+    val = arg_const_val(src2);
     if (!is_power_of_2(val)) {
         return;
     }
@@ -2669,7 +2673,7 @@ static bool fold_sub_to_neg(OptContext *ctx, TCGOp *op)
     TCGOpcode neg_op;
     bool have_neg;
 
-    if (!arg_is_const(op->args[1]) || arg_info(op->args[1])->val != 0) {
+    if (!arg_is_const_val(op->args[1], 0)) {
         return false;
     }
 
@@ -2719,7 +2723,7 @@ static bool fold_sub(OptContext *ctx, TCGOp *op)
 
     /* Fold sub r,x,i to add r,x,-i */
     if (arg_is_const(op->args[2])) {
-        uint64_t val = arg_info(op->args[2])->val;
+        uint64_t val = arg_const_val(op->args[2]);
 
         op->opc = INDEX_op_add;
         op->args[2] = arg_new_constant(ctx, -val);

From 56f15f67ea116e96ea986a7cca9214f76af71433 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sun, 22 Dec 2024 15:07:31 -0800
Subject: [PATCH 1697/2760] tcg/optimize: Add one's mask to TempOptInfo

Add o_mask mirroring z_mask, but for 1's instead of 0's.
Drop is_const and val fields, which now logically overlap.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 51 ++++++++++++++++++++++++++++++++++----------------
 1 file changed, 35 insertions(+), 16 deletions(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index 73a272eeb3..ce3cb4d7bc 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -39,12 +39,11 @@ typedef struct MemCopyInfo {
 } MemCopyInfo;
 
 typedef struct TempOptInfo {
-    bool is_const_;
     TCGTemp *prev_copy;
     TCGTemp *next_copy;
     QSIMPLEQ_HEAD(, MemCopyInfo) mem_copy;
-    uint64_t val_;
     uint64_t z_mask;  /* mask bit is 0 if and only if value bit is 0 */
+    uint64_t o_mask;  /* mask bit is 1 if and only if value bit is 1 */
     uint64_t s_mask;  /* mask bit is 1 if value bit matches msb */
 } TempOptInfo;
 
@@ -73,12 +72,14 @@ static inline TempOptInfo *arg_info(TCGArg arg)
 
 static inline bool ti_is_const(TempOptInfo *ti)
 {
-    return ti->is_const_;
+    /* If all bits that are not known zeros are known ones, it's constant. */
+    return ti->z_mask == ti->o_mask;
 }
 
 static inline uint64_t ti_const_val(TempOptInfo *ti)
 {
-    return ti->val_;
+    /* If constant, both z_mask and o_mask contain the value. */
+    return ti->z_mask;
 }
 
 static inline bool ti_is_const_val(TempOptInfo *ti, uint64_t val)
@@ -142,13 +143,12 @@ static void init_ts_info(OptContext *ctx, TCGTemp *ts)
     ti->prev_copy = ts;
     QSIMPLEQ_INIT(&ti->mem_copy);
     if (ts->kind == TEMP_CONST) {
-        ti->is_const_ = true;
-        ti->val_ = ts->val;
         ti->z_mask = ts->val;
+        ti->o_mask = ts->val;
         ti->s_mask = INT64_MIN >> clrsb64(ts->val);
     } else {
-        ti->is_const_ = false;
         ti->z_mask = -1;
+        ti->o_mask = 0;
         ti->s_mask = 0;
     }
 }
@@ -234,8 +234,8 @@ static void reset_ts(OptContext *ctx, TCGTemp *ts)
     pi->next_copy = ti->next_copy;
     ti->next_copy = ts;
     ti->prev_copy = ts;
-    ti->is_const_ = false;
     ti->z_mask = -1;
+    ti->o_mask = 0;
     ti->s_mask = 0;
 
     if (!QSIMPLEQ_EMPTY(&ti->mem_copy)) {
@@ -390,6 +390,7 @@ static bool tcg_opt_gen_mov(OptContext *ctx, TCGOp *op, TCGArg dst, TCGArg src)
     op->args[1] = src;
 
     di->z_mask = si->z_mask;
+    di->o_mask = si->o_mask;
     di->s_mask = si->s_mask;
 
     if (src_ts->type == dst_ts->type) {
@@ -399,13 +400,19 @@ static bool tcg_opt_gen_mov(OptContext *ctx, TCGOp *op, TCGArg dst, TCGArg src)
         di->prev_copy = src_ts;
         ni->prev_copy = dst_ts;
         si->next_copy = dst_ts;
-        di->is_const_ = si->is_const_;
-        di->val_ = si->val_;
 
         if (!QSIMPLEQ_EMPTY(&si->mem_copy)
             && cmp_better_copy(src_ts, dst_ts) == dst_ts) {
             move_mem_copies(dst_ts, src_ts);
         }
+    } else if (dst_ts->type == TCG_TYPE_I32) {
+        di->z_mask = (int32_t)di->z_mask;
+        di->o_mask = (int32_t)di->o_mask;
+        di->s_mask |= INT32_MIN;
+    } else {
+        di->z_mask |= MAKE_64BIT_MASK(32, 32);
+        di->o_mask = (uint32_t)di->o_mask;
+        di->s_mask = INT64_MIN;
     }
     return true;
 }
@@ -1032,8 +1039,8 @@ static bool fold_const2_commutative(OptContext *ctx, TCGOp *op)
  * If z_mask allows, fold the output to constant zero.
  * The passed s_mask may be augmented by z_mask.
  */
-static bool fold_masks_zs(OptContext *ctx, TCGOp *op,
-                          uint64_t z_mask, int64_t s_mask)
+static bool fold_masks_zos(OptContext *ctx, TCGOp *op, uint64_t z_mask,
+                           uint64_t o_mask, int64_t s_mask)
 {
     const TCGOpDef *def = &tcg_op_defs[op->opc];
     TCGTemp *ts;
@@ -1052,11 +1059,16 @@ static bool fold_masks_zs(OptContext *ctx, TCGOp *op,
      */
     if (ctx->type == TCG_TYPE_I32) {
         z_mask = (int32_t)z_mask;
+        o_mask = (int32_t)o_mask;
         s_mask |= INT32_MIN;
     }
 
-    if (z_mask == 0) {
-        return tcg_opt_gen_movi(ctx, op, op->args[0], 0);
+    /* Bits that are known 1 and bits that are known 0 must not overlap. */
+    tcg_debug_assert((o_mask & ~z_mask) == 0);
+
+    /* All bits that are not known zero are known one is a constant. */
+    if (z_mask == o_mask) {
+        return tcg_opt_gen_movi(ctx, op, op->args[0], o_mask);
     }
 
     ts = arg_temp(op->args[0]);
@@ -1068,20 +1080,27 @@ static bool fold_masks_zs(OptContext *ctx, TCGOp *op,
     /* Canonicalize s_mask and incorporate data from z_mask. */
     rep = clz64(~s_mask);
     rep = MAX(rep, clz64(z_mask));
+    rep = MAX(rep, clz64(~o_mask));
     rep = MAX(rep - 1, 0);
     ti->s_mask = INT64_MIN >> rep;
 
     return true;
 }
 
+static bool fold_masks_zs(OptContext *ctx, TCGOp *op,
+                          uint64_t z_mask, uint64_t s_mask)
+{
+    return fold_masks_zos(ctx, op, z_mask, 0, s_mask);
+}
+
 static bool fold_masks_z(OptContext *ctx, TCGOp *op, uint64_t z_mask)
 {
-    return fold_masks_zs(ctx, op, z_mask, 0);
+    return fold_masks_zos(ctx, op, z_mask, 0, 0);
 }
 
 static bool fold_masks_s(OptContext *ctx, TCGOp *op, uint64_t s_mask)
 {
-    return fold_masks_zs(ctx, op, -1, s_mask);
+    return fold_masks_zos(ctx, op, -1, 0, s_mask);
 }
 
 /*

From 9e397cc0df9c642381e60f97ce37eafe5a2582b3 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 2 Jun 2025 14:11:51 +0100
Subject: [PATCH 1698/2760] tcg/optimize: Introduce fold_masks_zosa

Add a new function with an affected mask.  This will allow
folding to a constant to happen before folding to a copy,
without having to mind the ordering in all users.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index ce3cb4d7bc..49ef039932 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -1039,8 +1039,8 @@ static bool fold_const2_commutative(OptContext *ctx, TCGOp *op)
  * If z_mask allows, fold the output to constant zero.
  * The passed s_mask may be augmented by z_mask.
  */
-static bool fold_masks_zos(OptContext *ctx, TCGOp *op, uint64_t z_mask,
-                           uint64_t o_mask, int64_t s_mask)
+static bool fold_masks_zosa(OptContext *ctx, TCGOp *op, uint64_t z_mask,
+                            uint64_t o_mask, int64_t s_mask, uint64_t a_mask)
 {
     const TCGOpDef *def = &tcg_op_defs[op->opc];
     TCGTemp *ts;
@@ -1061,6 +1061,7 @@ static bool fold_masks_zos(OptContext *ctx, TCGOp *op, uint64_t z_mask,
         z_mask = (int32_t)z_mask;
         o_mask = (int32_t)o_mask;
         s_mask |= INT32_MIN;
+        a_mask = (uint32_t)a_mask;
     }
 
     /* Bits that are known 1 and bits that are known 0 must not overlap. */
@@ -1071,6 +1072,11 @@ static bool fold_masks_zos(OptContext *ctx, TCGOp *op, uint64_t z_mask,
         return tcg_opt_gen_movi(ctx, op, op->args[0], o_mask);
     }
 
+    /* If no bits are affected, the operation devolves to a copy. */
+    if (a_mask == 0) {
+        return tcg_opt_gen_mov(ctx, op, op->args[0], op->args[1]);
+    }
+
     ts = arg_temp(op->args[0]);
     reset_ts(ctx, ts);
 
@@ -1090,17 +1096,17 @@ static bool fold_masks_zos(OptContext *ctx, TCGOp *op, uint64_t z_mask,
 static bool fold_masks_zs(OptContext *ctx, TCGOp *op,
                           uint64_t z_mask, uint64_t s_mask)
 {
-    return fold_masks_zos(ctx, op, z_mask, 0, s_mask);
+    return fold_masks_zosa(ctx, op, z_mask, 0, s_mask, -1);
 }
 
 static bool fold_masks_z(OptContext *ctx, TCGOp *op, uint64_t z_mask)
 {
-    return fold_masks_zos(ctx, op, z_mask, 0, 0);
+    return fold_masks_zosa(ctx, op, z_mask, 0, 0, -1);
 }
 
 static bool fold_masks_s(OptContext *ctx, TCGOp *op, uint64_t s_mask)
 {
-    return fold_masks_zos(ctx, op, -1, 0, s_mask);
+    return fold_masks_zosa(ctx, op, -1, 0, s_mask, -1);
 }
 
 /*

From 1e2edf85cc4755c844f9c98cbe52ac63d7d1fb18 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 9 Dec 2024 16:48:36 -0600
Subject: [PATCH 1699/2760] tcg/optimize: Build and use o_bits in fold_and

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 20 +++++++-------------
 1 file changed, 7 insertions(+), 13 deletions(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index 49ef039932..d9ccbb36e2 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -1422,7 +1422,7 @@ static bool fold_addco(OptContext *ctx, TCGOp *op)
 
 static bool fold_and(OptContext *ctx, TCGOp *op)
 {
-    uint64_t z1, z2, z_mask, s_mask;
+    uint64_t z_mask, o_mask, s_mask, a_mask;
     TempOptInfo *t1, *t2;
 
     if (fold_const2_commutative(ctx, op) ||
@@ -1434,18 +1434,9 @@ static bool fold_and(OptContext *ctx, TCGOp *op)
 
     t1 = arg_info(op->args[1]);
     t2 = arg_info(op->args[2]);
-    z1 = t1->z_mask;
-    z2 = t2->z_mask;
 
-    /*
-     * Known-zeros does not imply known-ones.  Therefore unless
-     * arg2 is constant, we can't infer affected bits from it.
-     */
-    if (ti_is_const(t2) && fold_affected_mask(ctx, op, z1 & ~z2)) {
-        return true;
-    }
-
-    z_mask = z1 & z2;
+    z_mask = t1->z_mask & t2->z_mask;
+    o_mask = t1->o_mask & t2->o_mask;
 
     /*
      * Sign repetitions are perforce all identical, whether they are 1 or 0.
@@ -1453,7 +1444,10 @@ static bool fold_and(OptContext *ctx, TCGOp *op)
      */
     s_mask = t1->s_mask & t2->s_mask;
 
-    return fold_masks_zs(ctx, op, z_mask, s_mask);
+    /* Affected bits are those not known zero, masked by those known one. */
+    a_mask = t1->z_mask & ~t2->o_mask;
+
+    return fold_masks_zosa(ctx, op, z_mask, o_mask, s_mask, a_mask);
 }
 
 static bool fold_andc(OptContext *ctx, TCGOp *op)

From d4d441e3a1c9f485a27662890ec7c009a056fda8 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sun, 22 Dec 2024 16:08:42 -0800
Subject: [PATCH 1700/2760] tcg/optimize: Build and use o_bits in fold_andc

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 23 ++++++++---------------
 1 file changed, 8 insertions(+), 15 deletions(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index d9ccbb36e2..123734b167 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -1452,7 +1452,7 @@ static bool fold_and(OptContext *ctx, TCGOp *op)
 
 static bool fold_andc(OptContext *ctx, TCGOp *op)
 {
-    uint64_t z_mask, s_mask;
+    uint64_t z_mask, o_mask, s_mask, a_mask;
     TempOptInfo *t1, *t2;
 
     if (fold_const2(ctx, op) ||
@@ -1464,7 +1464,6 @@ static bool fold_andc(OptContext *ctx, TCGOp *op)
 
     t1 = arg_info(op->args[1]);
     t2 = arg_info(op->args[2]);
-    z_mask = t1->z_mask;
 
     if (ti_is_const(t2)) {
         /* Fold andc r,x,i to and r,x,~i. */
@@ -1485,20 +1484,14 @@ static bool fold_andc(OptContext *ctx, TCGOp *op)
         return fold_and(ctx, op);
     }
 
-    /*
-     * Known-zeros does not imply known-ones.  Therefore unless
-     * arg2 is constant, we can't infer anything from it.
-     */
-    if (ti_is_const(t2)) {
-        uint64_t v2 = ti_const_val(t2);
-        if (fold_affected_mask(ctx, op, z_mask & v2)) {
-            return true;
-        }
-        z_mask &= ~v2;
-    }
-
+    z_mask = t1->z_mask & ~t2->o_mask;
+    o_mask = t1->o_mask & ~t2->z_mask;
     s_mask = t1->s_mask & t2->s_mask;
-    return fold_masks_zs(ctx, op, z_mask, s_mask);
+
+    /* Affected bits are those not known zero, masked by those known zero. */
+    a_mask = t1->z_mask & t2->z_mask;
+
+    return fold_masks_zosa(ctx, op, z_mask, o_mask, s_mask, a_mask);
 }
 
 static bool fold_bitsel_vec(OptContext *ctx, TCGOp *op)

From 33fcebadd04ab420a485f864bda651b8b360472d Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 10 Dec 2024 08:26:56 -0600
Subject: [PATCH 1701/2760] tcg/optimize: Build and use z_bits and o_bits in
 fold_eqv

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index 123734b167..6d35a2e58b 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -1093,6 +1093,12 @@ static bool fold_masks_zosa(OptContext *ctx, TCGOp *op, uint64_t z_mask,
     return true;
 }
 
+static bool fold_masks_zos(OptContext *ctx, TCGOp *op,
+                           uint64_t z_mask, uint64_t o_mask, uint64_t s_mask)
+{
+    return fold_masks_zosa(ctx, op, z_mask, o_mask, s_mask, -1);
+}
+
 static bool fold_masks_zs(OptContext *ctx, TCGOp *op,
                           uint64_t z_mask, uint64_t s_mask)
 {
@@ -1916,7 +1922,7 @@ static bool fold_dup2(OptContext *ctx, TCGOp *op)
 
 static bool fold_eqv(OptContext *ctx, TCGOp *op)
 {
-    uint64_t s_mask;
+    uint64_t z_mask, o_mask, s_mask;
     TempOptInfo *t1, *t2;
 
     if (fold_const2_commutative(ctx, op) ||
@@ -1946,8 +1952,12 @@ static bool fold_eqv(OptContext *ctx, TCGOp *op)
     }
 
     t1 = arg_info(op->args[1]);
+
+    z_mask = (t1->z_mask | ~t2->o_mask) & (t2->z_mask | ~t1->o_mask);
+    o_mask = ~(t1->z_mask | t2->z_mask) | (t1->o_mask & t2->o_mask);
     s_mask = t1->s_mask & t2->s_mask;
-    return fold_masks_s(ctx, op, s_mask);
+
+    return fold_masks_zos(ctx, op, z_mask, o_mask, s_mask);
 }
 
 static bool fold_extract(OptContext *ctx, TCGOp *op)

From 16559c3ecbacab16d471a4a6f5a35f14325c3fe4 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 9 Dec 2024 18:13:15 -0600
Subject: [PATCH 1702/2760] tcg/optimize: Build and use z_bits and o_bits in
 fold_nand

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index 6d35a2e58b..758f7b142e 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -2197,16 +2197,22 @@ static bool fold_multiply2(OptContext *ctx, TCGOp *op)
 
 static bool fold_nand(OptContext *ctx, TCGOp *op)
 {
-    uint64_t s_mask;
+    uint64_t z_mask, o_mask, s_mask;
+    TempOptInfo *t1, *t2;
 
     if (fold_const2_commutative(ctx, op) ||
         fold_xi_to_not(ctx, op, -1)) {
         return true;
     }
 
-    s_mask = arg_info(op->args[1])->s_mask
-           & arg_info(op->args[2])->s_mask;
-    return fold_masks_s(ctx, op, s_mask);
+    t1 = arg_info(op->args[1]);
+    t2 = arg_info(op->args[2]);
+
+    z_mask = ~(t1->o_mask & t2->o_mask);
+    o_mask = ~(t1->z_mask & t2->z_mask);
+    s_mask = t1->s_mask & t2->s_mask;
+
+    return fold_masks_zos(ctx, op, z_mask, o_mask, s_mask);
 }
 
 static bool fold_neg_no_const(OptContext *ctx, TCGOp *op)

From 682d6d57baf43c8f7273c328efa3402943bd557f Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 9 Dec 2024 21:13:02 -0600
Subject: [PATCH 1703/2760] tcg/optimize: Build and use z_bits and o_bits in
 fold_nor

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index 758f7b142e..29d1f29124 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -2231,16 +2231,22 @@ static bool fold_neg(OptContext *ctx, TCGOp *op)
 
 static bool fold_nor(OptContext *ctx, TCGOp *op)
 {
-    uint64_t s_mask;
+    uint64_t z_mask, o_mask, s_mask;
+    TempOptInfo *t1, *t2;
 
     if (fold_const2_commutative(ctx, op) ||
         fold_xi_to_not(ctx, op, 0)) {
         return true;
     }
 
-    s_mask = arg_info(op->args[1])->s_mask
-           & arg_info(op->args[2])->s_mask;
-    return fold_masks_s(ctx, op, s_mask);
+    t1 = arg_info(op->args[1]);
+    t2 = arg_info(op->args[2]);
+
+    z_mask = ~(t1->o_mask | t2->o_mask);
+    o_mask = ~(t1->z_mask | t2->z_mask);
+    s_mask = t1->s_mask & t2->s_mask;
+
+    return fold_masks_zos(ctx, op, z_mask, o_mask, s_mask);
 }
 
 static bool fold_not(OptContext *ctx, TCGOp *op)

From d89504b0477df0ac6ff969b79065d9494cb0e6be Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 9 Dec 2024 21:15:37 -0600
Subject: [PATCH 1704/2760] tcg/optimize: Build and use z_bits and o_bits in
 fold_not

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index 29d1f29124..d22396f6d7 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -2251,10 +2251,14 @@ static bool fold_nor(OptContext *ctx, TCGOp *op)
 
 static bool fold_not(OptContext *ctx, TCGOp *op)
 {
+    TempOptInfo *t1;
+
     if (fold_const1(ctx, op)) {
         return true;
     }
-    return fold_masks_s(ctx, op, arg_info(op->args[1])->s_mask);
+
+    t1 = arg_info(op->args[1]);
+    return fold_masks_zos(ctx, op, ~t1->o_mask, ~t1->z_mask, t1->s_mask);
 }
 
 static bool fold_or(OptContext *ctx, TCGOp *op)

From 84b399df9abea985089d46fd94da559d83d0e085 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 9 Dec 2024 21:35:53 -0600
Subject: [PATCH 1705/2760] tcg/optimize: Build and use one and affected bits
 in fold_or

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index d22396f6d7..ce065d0e22 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -2263,7 +2263,7 @@ static bool fold_not(OptContext *ctx, TCGOp *op)
 
 static bool fold_or(OptContext *ctx, TCGOp *op)
 {
-    uint64_t z_mask, s_mask;
+    uint64_t z_mask, o_mask, s_mask, a_mask;
     TempOptInfo *t1, *t2;
 
     if (fold_const2_commutative(ctx, op) ||
@@ -2274,9 +2274,15 @@ static bool fold_or(OptContext *ctx, TCGOp *op)
 
     t1 = arg_info(op->args[1]);
     t2 = arg_info(op->args[2]);
+
     z_mask = t1->z_mask | t2->z_mask;
+    o_mask = t1->o_mask | t2->o_mask;
     s_mask = t1->s_mask & t2->s_mask;
-    return fold_masks_zs(ctx, op, z_mask, s_mask);
+
+    /* Affected bits are those not known one, masked by those known zero. */
+    a_mask = ~t1->o_mask & t2->z_mask;
+
+    return fold_masks_zosa(ctx, op, z_mask, o_mask, s_mask, a_mask);
 }
 
 static bool fold_orc(OptContext *ctx, TCGOp *op)

From cc4033ee47c39ca5668ca0ab9b23046cf029fc21 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 9 Dec 2024 22:22:27 -0600
Subject: [PATCH 1706/2760] tcg/optimize: Build and use zero, one and affected
 bits in fold_orc

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index ce065d0e22..795f1c900e 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -2287,7 +2287,7 @@ static bool fold_or(OptContext *ctx, TCGOp *op)
 
 static bool fold_orc(OptContext *ctx, TCGOp *op)
 {
-    uint64_t s_mask;
+    uint64_t z_mask, o_mask, s_mask, a_mask;
     TempOptInfo *t1, *t2;
 
     if (fold_const2(ctx, op) ||
@@ -2318,8 +2318,15 @@ static bool fold_orc(OptContext *ctx, TCGOp *op)
     }
 
     t1 = arg_info(op->args[1]);
+
+    z_mask = t1->z_mask | ~t2->o_mask;
+    o_mask = t1->o_mask | ~t2->z_mask;
     s_mask = t1->s_mask & t2->s_mask;
-    return fold_masks_s(ctx, op, s_mask);
+
+    /* Affected bits are those not known one, masked by those known one. */
+    a_mask = ~t1->o_mask & t2->o_mask;
+
+    return fold_masks_zosa(ctx, op, z_mask, o_mask, s_mask, a_mask);
 }
 
 static bool fold_qemu_ld_1reg(OptContext *ctx, TCGOp *op)

From 787190e3f433022d6fd2983f5e5efdb848439a41 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 10 Dec 2024 08:39:56 -0600
Subject: [PATCH 1707/2760] tcg/optimize: Build and use o_bits in fold_xor

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index 795f1c900e..572d314578 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -3039,7 +3039,7 @@ static bool fold_tcg_st_memcopy(OptContext *ctx, TCGOp *op)
 
 static bool fold_xor(OptContext *ctx, TCGOp *op)
 {
-    uint64_t z_mask, s_mask;
+    uint64_t z_mask, o_mask, s_mask;
     TempOptInfo *t1, *t2;
 
     if (fold_const2_commutative(ctx, op) ||
@@ -3051,9 +3051,12 @@ static bool fold_xor(OptContext *ctx, TCGOp *op)
 
     t1 = arg_info(op->args[1]);
     t2 = arg_info(op->args[2]);
-    z_mask = t1->z_mask | t2->z_mask;
+
+    z_mask = (t1->z_mask | t2->z_mask) & ~(t1->o_mask & t2->o_mask);
+    o_mask = (t1->o_mask & ~t2->z_mask) | (t2->o_mask & ~t1->z_mask);
     s_mask = t1->s_mask & t2->s_mask;
-    return fold_masks_zs(ctx, op, z_mask, s_mask);
+
+    return fold_masks_zos(ctx, op, z_mask, o_mask, s_mask);
 }
 
 /* Propagate constants and copies, fold constant expressions. */

From e6e3733bf19eacec7bcaf6343619237f84ff840a Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 10 Dec 2024 15:02:41 -0600
Subject: [PATCH 1708/2760] tcg/optimize: Build and use o_bits in fold_bswap

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 49 ++++++++++++++++++++++++-------------------------
 1 file changed, 24 insertions(+), 25 deletions(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index 572d314578..c9c53f796f 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -1671,53 +1671,52 @@ static bool fold_brcond2(OptContext *ctx, TCGOp *op)
 
 static bool fold_bswap(OptContext *ctx, TCGOp *op)
 {
-    uint64_t z_mask, s_mask, sign;
+    uint64_t z_mask, o_mask, s_mask;
     TempOptInfo *t1 = arg_info(op->args[1]);
+    int flags = op->args[2];
 
     if (ti_is_const(t1)) {
         return tcg_opt_gen_movi(ctx, op, op->args[0],
                                 do_constant_folding(op->opc, ctx->type,
-                                                    ti_const_val(t1),
-                                                    op->args[2]));
+                                                    ti_const_val(t1), flags));
     }
 
     z_mask = t1->z_mask;
+    o_mask = t1->o_mask;
+    s_mask = 0;
+
     switch (op->opc) {
     case INDEX_op_bswap16:
         z_mask = bswap16(z_mask);
-        sign = INT16_MIN;
+        o_mask = bswap16(o_mask);
+        if (flags & TCG_BSWAP_OS) {
+            z_mask = (int16_t)z_mask;
+            o_mask = (int16_t)o_mask;
+            s_mask = INT16_MIN;
+        } else if (!(flags & TCG_BSWAP_OZ)) {
+            z_mask |= MAKE_64BIT_MASK(16, 48);
+        }
         break;
     case INDEX_op_bswap32:
         z_mask = bswap32(z_mask);
-        sign = INT32_MIN;
+        o_mask = bswap32(o_mask);
+        if (flags & TCG_BSWAP_OS) {
+            z_mask = (int32_t)z_mask;
+            o_mask = (int32_t)o_mask;
+            s_mask = INT32_MIN;
+        } else if (!(flags & TCG_BSWAP_OZ)) {
+            z_mask |= MAKE_64BIT_MASK(32, 32);
+        }
         break;
     case INDEX_op_bswap64:
         z_mask = bswap64(z_mask);
-        sign = INT64_MIN;
+        o_mask = bswap64(o_mask);
         break;
     default:
         g_assert_not_reached();
     }
 
-    s_mask = 0;
-    switch (op->args[2] & (TCG_BSWAP_OZ | TCG_BSWAP_OS)) {
-    case TCG_BSWAP_OZ:
-        break;
-    case TCG_BSWAP_OS:
-        /* If the sign bit may be 1, force all the bits above to 1. */
-        if (z_mask & sign) {
-            z_mask |= sign;
-        }
-        /* The value and therefore s_mask is explicitly sign-extended. */
-        s_mask = sign;
-        break;
-    default:
-        /* The high bits are undefined: force all bits above the sign to 1. */
-        z_mask |= sign << 1;
-        break;
-    }
-
-    return fold_masks_zs(ctx, op, z_mask, s_mask);
+    return fold_masks_zos(ctx, op, z_mask, o_mask, s_mask);
 }
 
 static bool fold_call(OptContext *ctx, TCGOp *op)

From 9d80b3c89022279865220c23a1246a4e12786f27 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 10 Dec 2024 14:45:44 -0600
Subject: [PATCH 1709/2760] tcg/optimize: Build and use o_bits in fold_deposit

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index c9c53f796f..043568a10d 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -1847,7 +1847,7 @@ static bool fold_deposit(OptContext *ctx, TCGOp *op)
     int ofs = op->args[3];
     int len = op->args[4];
     int width = 8 * tcg_type_size(ctx->type);
-    uint64_t z_mask, s_mask;
+    uint64_t z_mask, o_mask, s_mask;
 
     if (ti_is_const(t1) && ti_is_const(t2)) {
         return tcg_opt_gen_movi(ctx, op, op->args[0],
@@ -1882,7 +1882,9 @@ static bool fold_deposit(OptContext *ctx, TCGOp *op)
     }
 
     z_mask = deposit64(t1->z_mask, ofs, len, t2->z_mask);
-    return fold_masks_zs(ctx, op, z_mask, s_mask);
+    o_mask = deposit64(t1->o_mask, ofs, len, t2->o_mask);
+
+    return fold_masks_zos(ctx, op, z_mask, o_mask, s_mask);
 }
 
 static bool fold_divide(OptContext *ctx, TCGOp *op)

From fcde7363d33744d14dc7e844752b53c4aa1d69ba Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 10 Dec 2024 15:34:12 -0600
Subject: [PATCH 1710/2760] tcg/optimize: Build and use o_bits in fold_extract

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index 043568a10d..f5fc0cfff9 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -1963,7 +1963,7 @@ static bool fold_eqv(OptContext *ctx, TCGOp *op)
 
 static bool fold_extract(OptContext *ctx, TCGOp *op)
 {
-    uint64_t z_mask_old, z_mask;
+    uint64_t z_mask, o_mask, a_mask;
     TempOptInfo *t1 = arg_info(op->args[1]);
     int pos = op->args[2];
     int len = op->args[3];
@@ -1973,13 +1973,11 @@ static bool fold_extract(OptContext *ctx, TCGOp *op)
                                 extract64(ti_const_val(t1), pos, len));
     }
 
-    z_mask_old = t1->z_mask;
-    z_mask = extract64(z_mask_old, pos, len);
-    if (pos == 0 && fold_affected_mask(ctx, op, z_mask_old ^ z_mask)) {
-        return true;
-    }
+    z_mask = extract64(t1->z_mask, pos, len);
+    o_mask = extract64(t1->o_mask, pos, len);
+    a_mask = pos ? -1 : t1->z_mask ^ z_mask;
 
-    return fold_masks_z(ctx, op, z_mask);
+    return fold_masks_zosa(ctx, op, z_mask, o_mask, 0, a_mask);
 }
 
 static bool fold_extract2(OptContext *ctx, TCGOp *op)

From 83c47c30278b130cade31c5e0dbbc08ac6258bad Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 10 Dec 2024 15:48:16 -0600
Subject: [PATCH 1711/2760] tcg/optimize: Build and use z_bits and o_bits in
 fold_extract2

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 38 +++++++++++++++++++++++++-------------
 1 file changed, 25 insertions(+), 13 deletions(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index f5fc0cfff9..86d958267a 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -1099,6 +1099,12 @@ static bool fold_masks_zos(OptContext *ctx, TCGOp *op,
     return fold_masks_zosa(ctx, op, z_mask, o_mask, s_mask, -1);
 }
 
+static bool fold_masks_zo(OptContext *ctx, TCGOp *op,
+                          uint64_t z_mask, uint64_t o_mask)
+{
+    return fold_masks_zosa(ctx, op, z_mask, o_mask, 0, -1);
+}
+
 static bool fold_masks_zs(OptContext *ctx, TCGOp *op,
                           uint64_t z_mask, uint64_t s_mask)
 {
@@ -1982,21 +1988,27 @@ static bool fold_extract(OptContext *ctx, TCGOp *op)
 
 static bool fold_extract2(OptContext *ctx, TCGOp *op)
 {
-    if (arg_is_const(op->args[1]) && arg_is_const(op->args[2])) {
-        uint64_t v1 = arg_const_val(op->args[1]);
-        uint64_t v2 = arg_const_val(op->args[2]);
-        int shr = op->args[3];
+    TempOptInfo *t1 = arg_info(op->args[1]);
+    TempOptInfo *t2 = arg_info(op->args[2]);
+    uint64_t z1 = t1->z_mask;
+    uint64_t z2 = t2->z_mask;
+    uint64_t o1 = t1->o_mask;
+    uint64_t o2 = t2->o_mask;
+    int shr = op->args[3];
 
-        if (ctx->type == TCG_TYPE_I32) {
-            v1 = (uint32_t)v1 >> shr;
-            v2 = (uint64_t)((int32_t)v2 << (32 - shr));
-        } else {
-            v1 >>= shr;
-            v2 <<= 64 - shr;
-        }
-        return tcg_opt_gen_movi(ctx, op, op->args[0], v1 | v2);
+    if (ctx->type == TCG_TYPE_I32) {
+        z1 = (uint32_t)z1 >> shr;
+        o1 = (uint32_t)o1 >> shr;
+        z2 = (uint64_t)((int32_t)z2 << (32 - shr));
+        o2 = (uint64_t)((int32_t)o2 << (32 - shr));
+    } else {
+        z1 >>= shr;
+        o1 >>= shr;
+        z2 <<= 64 - shr;
+        o2 <<= 64 - shr;
     }
-    return finish_folding(ctx, op);
+
+    return fold_masks_zo(ctx, op, z1 | z2, o1 | o2);
 }
 
 static bool fold_exts(OptContext *ctx, TCGOp *op)

From de85257f14a5b16edb754190e850de1e916ac37c Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 10 Dec 2024 15:55:33 -0600
Subject: [PATCH 1712/2760] tcg/optimize: Build and use o_bits in fold_exts

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index 86d958267a..103c94b12f 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -2013,7 +2013,7 @@ static bool fold_extract2(OptContext *ctx, TCGOp *op)
 
 static bool fold_exts(OptContext *ctx, TCGOp *op)
 {
-    uint64_t s_mask, z_mask;
+    uint64_t z_mask, o_mask, s_mask;
     TempOptInfo *t1;
 
     if (fold_const1(ctx, op)) {
@@ -2022,17 +2022,19 @@ static bool fold_exts(OptContext *ctx, TCGOp *op)
 
     t1 = arg_info(op->args[1]);
     z_mask = t1->z_mask;
+    o_mask = t1->o_mask;
     s_mask = t1->s_mask;
 
     switch (op->opc) {
     case INDEX_op_ext_i32_i64:
         s_mask |= INT32_MIN;
         z_mask = (int32_t)z_mask;
+        o_mask = (int32_t)o_mask;
         break;
     default:
         g_assert_not_reached();
     }
-    return fold_masks_zs(ctx, op, z_mask, s_mask);
+    return fold_masks_zos(ctx, op, z_mask, o_mask, s_mask);
 }
 
 static bool fold_extu(OptContext *ctx, TCGOp *op)

From f78342472fb4de10aa78e5cb5e2f502700d5a728 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 10 Dec 2024 15:58:04 -0600
Subject: [PATCH 1713/2760] tcg/optimize: Build and use o_bits in fold_extu

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index 103c94b12f..42d5ee23c0 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -2039,25 +2039,31 @@ static bool fold_exts(OptContext *ctx, TCGOp *op)
 
 static bool fold_extu(OptContext *ctx, TCGOp *op)
 {
-    uint64_t z_mask;
+    uint64_t z_mask, o_mask;
+    TempOptInfo *t1;
 
     if (fold_const1(ctx, op)) {
         return true;
     }
 
-    z_mask = arg_info(op->args[1])->z_mask;
+    t1 = arg_info(op->args[1]);
+    z_mask = t1->z_mask;
+    o_mask = t1->o_mask;
+
     switch (op->opc) {
     case INDEX_op_extrl_i64_i32:
     case INDEX_op_extu_i32_i64:
         z_mask = (uint32_t)z_mask;
+        o_mask = (uint32_t)o_mask;
         break;
     case INDEX_op_extrh_i64_i32:
         z_mask >>= 32;
+        o_mask >>= 32;
         break;
     default:
         g_assert_not_reached();
     }
-    return fold_masks_z(ctx, op, z_mask);
+    return fold_masks_zo(ctx, op, z_mask, o_mask);
 }
 
 static bool fold_mb(OptContext *ctx, TCGOp *op)

From 08d676a46b55a717447babab304a475e62b233ac Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 10 Dec 2024 16:30:12 -0600
Subject: [PATCH 1714/2760] tcg/optimize: Build and use o_bits in fold_movcond

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index 42d5ee23c0..abcbee9111 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -2097,7 +2097,7 @@ static bool fold_mov(OptContext *ctx, TCGOp *op)
 
 static bool fold_movcond(OptContext *ctx, TCGOp *op)
 {
-    uint64_t z_mask, s_mask;
+    uint64_t z_mask, o_mask, s_mask;
     TempOptInfo *tt, *ft;
     int i;
 
@@ -2123,6 +2123,7 @@ static bool fold_movcond(OptContext *ctx, TCGOp *op)
     tt = arg_info(op->args[3]);
     ft = arg_info(op->args[4]);
     z_mask = tt->z_mask | ft->z_mask;
+    o_mask = tt->o_mask & ft->o_mask;
     s_mask = tt->s_mask & ft->s_mask;
 
     if (ti_is_const(tt) && ti_is_const(ft)) {
@@ -2145,7 +2146,7 @@ static bool fold_movcond(OptContext *ctx, TCGOp *op)
         }
     }
 
-    return fold_masks_zs(ctx, op, z_mask, s_mask);
+    return fold_masks_zos(ctx, op, z_mask, o_mask, s_mask);
 }
 
 static bool fold_mul(OptContext *ctx, TCGOp *op)

From f4a818a08d86ba1fddc21391d9f9115ebef794db Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 10 Dec 2024 16:40:24 -0600
Subject: [PATCH 1715/2760] tcg/optimize: Build and use o_bits in fold_sextract

This was the last use of fold_affected_mask,
now fully replaced by fold_masks_zosa.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 30 ++++++------------------------
 1 file changed, 6 insertions(+), 24 deletions(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index abcbee9111..673849f07a 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -1121,22 +1121,6 @@ static bool fold_masks_s(OptContext *ctx, TCGOp *op, uint64_t s_mask)
     return fold_masks_zosa(ctx, op, -1, 0, s_mask, -1);
 }
 
-/*
- * An "affected" mask bit is 0 if and only if the result is identical
- * to the first input.  Thus if the entire mask is 0, the operation
- * is equivalent to a copy.
- */
-static bool fold_affected_mask(OptContext *ctx, TCGOp *op, uint64_t a_mask)
-{
-    if (ctx->type == TCG_TYPE_I32) {
-        a_mask = (uint32_t)a_mask;
-    }
-    if (a_mask == 0) {
-        return tcg_opt_gen_mov(ctx, op, op->args[0], op->args[1]);
-    }
-    return false;
-}
-
 /*
  * Convert @op to NOT, if NOT is supported by the host.
  * Return true f the conversion is successful, which will still
@@ -2669,7 +2653,7 @@ static bool fold_setcond2(OptContext *ctx, TCGOp *op)
 
 static bool fold_sextract(OptContext *ctx, TCGOp *op)
 {
-    uint64_t z_mask, s_mask, s_mask_old;
+    uint64_t z_mask, o_mask, s_mask, a_mask;
     TempOptInfo *t1 = arg_info(op->args[1]);
     int pos = op->args[2];
     int len = op->args[3];
@@ -2679,16 +2663,14 @@ static bool fold_sextract(OptContext *ctx, TCGOp *op)
                                 sextract64(ti_const_val(t1), pos, len));
     }
 
-    s_mask_old = t1->s_mask;
-    s_mask = s_mask_old >> pos;
+    s_mask = t1->s_mask >> pos;
     s_mask |= -1ull << (len - 1);
-
-    if (pos == 0 && fold_affected_mask(ctx, op, s_mask & ~s_mask_old)) {
-        return true;
-    }
+    a_mask = pos ? -1 : s_mask & ~t1->s_mask;
 
     z_mask = sextract64(t1->z_mask, pos, len);
-    return fold_masks_zs(ctx, op, z_mask, s_mask);
+    o_mask = sextract64(t1->o_mask, pos, len);
+
+    return fold_masks_zosa(ctx, op, z_mask, o_mask, s_mask, a_mask);
 }
 
 static bool fold_shift(OptContext *ctx, TCGOp *op)

From 03329e3ce4609d9d63f8786294eb724289f9b596 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 10 Dec 2024 16:49:02 -0600
Subject: [PATCH 1716/2760] tcg/optimize: Build and use o_bits in fold_shift

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index 673849f07a..0b441bc611 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -2675,7 +2675,7 @@ static bool fold_sextract(OptContext *ctx, TCGOp *op)
 
 static bool fold_shift(OptContext *ctx, TCGOp *op)
 {
-    uint64_t s_mask, z_mask;
+    uint64_t s_mask, z_mask, o_mask;
     TempOptInfo *t1, *t2;
 
     if (fold_const2(ctx, op) ||
@@ -2688,14 +2688,16 @@ static bool fold_shift(OptContext *ctx, TCGOp *op)
     t2 = arg_info(op->args[2]);
     s_mask = t1->s_mask;
     z_mask = t1->z_mask;
+    o_mask = t1->o_mask;
 
     if (ti_is_const(t2)) {
         int sh = ti_const_val(t2);
 
         z_mask = do_constant_folding(op->opc, ctx->type, z_mask, sh);
+        o_mask = do_constant_folding(op->opc, ctx->type, o_mask, sh);
         s_mask = do_constant_folding(op->opc, ctx->type, s_mask, sh);
 
-        return fold_masks_zs(ctx, op, z_mask, s_mask);
+        return fold_masks_zos(ctx, op, z_mask, o_mask, s_mask);
     }
 
     switch (op->opc) {

From e532a39352878c506966a0e4e19ee938fca194ec Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 9 Dec 2024 14:05:01 -0600
Subject: [PATCH 1717/2760] tcg/optimize: Use fold_and in
 do_constant_folding_cond[12]

When lowering tst comparisons, completely fold the and
opcode that we generate.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index 0b441bc611..aa64f15779 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -784,6 +784,7 @@ static bool swap_commutative2(TCGArg *p1, TCGArg *p2)
  * Return -1 if the condition can't be simplified,
  * and the result of the condition (0 or 1) if it can.
  */
+static bool fold_and(OptContext *ctx, TCGOp *op);
 static int do_constant_folding_cond1(OptContext *ctx, TCGOp *op, TCGArg dest,
                                      TCGArg *p1, TCGArg *p2, TCGArg *pcond)
 {
@@ -834,6 +835,7 @@ static int do_constant_folding_cond1(OptContext *ctx, TCGOp *op, TCGArg dest,
         op2->args[0] = tmp;
         op2->args[1] = *p1;
         op2->args[2] = *p2;
+        fold_and(ctx, op2);
 
         *p1 = tmp;
         *p2 = arg_new_constant(ctx, 0);
@@ -929,9 +931,12 @@ static int do_constant_folding_cond2(OptContext *ctx, TCGOp *op, TCGArg *args)
         op1->args[0] = t1;
         op1->args[1] = al;
         op1->args[2] = bl;
+        fold_and(ctx, op1);
+
         op2->args[0] = t2;
         op2->args[1] = ah;
         op2->args[2] = bh;
+        fold_and(ctx, op1);
 
         args[0] = t1;
         args[1] = t2;

From 932522a9ddc1f7c7866009cd73eaf79452951b81 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 23 Oct 2023 14:29:46 -0700
Subject: [PATCH 1718/2760] tcg/optimize: Fold and to extract during optimize

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 33 ++++++++++++++++++++++++++++++---
 1 file changed, 30 insertions(+), 3 deletions(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index aa64f15779..06ccf39d64 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -1044,8 +1044,9 @@ static bool fold_const2_commutative(OptContext *ctx, TCGOp *op)
  * If z_mask allows, fold the output to constant zero.
  * The passed s_mask may be augmented by z_mask.
  */
-static bool fold_masks_zosa(OptContext *ctx, TCGOp *op, uint64_t z_mask,
-                            uint64_t o_mask, int64_t s_mask, uint64_t a_mask)
+static bool fold_masks_zosa_int(OptContext *ctx, TCGOp *op,
+                                uint64_t z_mask, uint64_t o_mask,
+                                int64_t s_mask, uint64_t a_mask)
 {
     const TCGOpDef *def = &tcg_op_defs[op->opc];
     TCGTemp *ts;
@@ -1095,6 +1096,13 @@ static bool fold_masks_zosa(OptContext *ctx, TCGOp *op, uint64_t z_mask,
     rep = MAX(rep - 1, 0);
     ti->s_mask = INT64_MIN >> rep;
 
+    return false;
+}
+
+static bool fold_masks_zosa(OptContext *ctx, TCGOp *op, uint64_t z_mask,
+                            uint64_t o_mask, int64_t s_mask, uint64_t a_mask)
+{
+    fold_masks_zosa_int(ctx, op, z_mask, o_mask, s_mask, -1);
     return true;
 }
 
@@ -1448,7 +1456,26 @@ static bool fold_and(OptContext *ctx, TCGOp *op)
     /* Affected bits are those not known zero, masked by those known one. */
     a_mask = t1->z_mask & ~t2->o_mask;
 
-    return fold_masks_zosa(ctx, op, z_mask, o_mask, s_mask, a_mask);
+    if (!fold_masks_zosa_int(ctx, op, z_mask, o_mask, s_mask, a_mask)) {
+        if (ti_is_const(t2)) {
+            /*
+             * Canonicalize on extract, if valid.  This aids x86 with its
+             * 2 operand MOVZBL and 2 operand AND, selecting the TCGOpcode
+             * which does not require matching operands.  Other backends can
+             * trivially expand the extract to AND during code generation.
+             */
+            uint64_t val = ti_const_val(t2);
+            if (!(val & (val + 1))) {
+                unsigned len = ctz64(~val);
+                if (TCG_TARGET_extract_valid(ctx->type, 0, len)) {
+                    op->opc = INDEX_op_extract;
+                    op->args[2] = 0;
+                    op->args[3] = len;
+                }
+            }
+        }
+    }
+    return true;
 }
 
 static bool fold_andc(OptContext *ctx, TCGOp *op)

From 9ffa5420e927c327412c9e4ef113ad2f1a564aec Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 9 Dec 2024 17:48:02 -0600
Subject: [PATCH 1719/2760] tcg/optimize: Simplify fold_and constant checks

If operand 2 is constant, then the computation of z_mask
and a_mask will produce the same results as the explicit
checks via fold_xi_to_i and fold_xi_to_x.  Shift the call
of fold_xx_to_x down below the ti_is_const(t2) check.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index 06ccf39d64..f3a2328fe4 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -1434,10 +1434,7 @@ static bool fold_and(OptContext *ctx, TCGOp *op)
     uint64_t z_mask, o_mask, s_mask, a_mask;
     TempOptInfo *t1, *t2;
 
-    if (fold_const2_commutative(ctx, op) ||
-        fold_xi_to_i(ctx, op, 0) ||
-        fold_xi_to_x(ctx, op, -1) ||
-        fold_xx_to_x(ctx, op)) {
+    if (fold_const2_commutative(ctx, op)) {
         return true;
     }
 
@@ -1473,6 +1470,8 @@ static bool fold_and(OptContext *ctx, TCGOp *op)
                     op->args[3] = len;
                 }
             }
+        } else {
+            fold_xx_to_x(ctx, op);
         }
     }
     return true;

From 3c75cb4d64811cfba2c03d66328d838cc72f8355 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 9 Dec 2024 17:56:10 -0600
Subject: [PATCH 1720/2760] tcg/optimize: Simplify fold_andc constant checks

If operand 2 is constant, then the computation of z_mask and a_mask
will produce the same results as the explicit check via fold_xi_to_i.
Shift the calls of fold_xx_to_i and fold_ix_to_not down below the
i2->is_const check.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index f3a2328fe4..8d14a38f9d 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -1482,10 +1482,7 @@ static bool fold_andc(OptContext *ctx, TCGOp *op)
     uint64_t z_mask, o_mask, s_mask, a_mask;
     TempOptInfo *t1, *t2;
 
-    if (fold_const2(ctx, op) ||
-        fold_xx_to_i(ctx, op, 0) ||
-        fold_xi_to_x(ctx, op, 0) ||
-        fold_ix_to_not(ctx, op, -1)) {
+    if (fold_const2(ctx, op)) {
         return true;
     }
 
@@ -1510,6 +1507,10 @@ static bool fold_andc(OptContext *ctx, TCGOp *op)
         op->args[2] = arg_new_constant(ctx, ~ti_const_val(t2));
         return fold_and(ctx, op);
     }
+    if (fold_xx_to_i(ctx, op, 0) ||
+        fold_ix_to_not(ctx, op, -1)) {
+        return true;
+    }
 
     z_mask = t1->z_mask & ~t2->o_mask;
     o_mask = t1->o_mask & ~t2->z_mask;

From 61617f715ec26877cdda9e027ac43945910f4fe9 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 10 Dec 2024 08:14:35 -0600
Subject: [PATCH 1721/2760] tcg/optimize: Simplify fold_orc constant checks

If operand 2 is constant, then the computation of z_mask and a_mask
will produce the same results as the explicit check via fold_xi_to_i.
Shift the calls of fold_xx_to_i and fold_ix_to_not down below the
i2->is_const check.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index 8d14a38f9d..a48ddd9171 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -2326,10 +2326,7 @@ static bool fold_orc(OptContext *ctx, TCGOp *op)
     uint64_t z_mask, o_mask, s_mask, a_mask;
     TempOptInfo *t1, *t2;
 
-    if (fold_const2(ctx, op) ||
-        fold_xx_to_i(ctx, op, -1) ||
-        fold_xi_to_x(ctx, op, -1) ||
-        fold_ix_to_not(ctx, op, 0)) {
+    if (fold_const2(ctx, op)) {
         return true;
     }
 
@@ -2352,7 +2349,10 @@ static bool fold_orc(OptContext *ctx, TCGOp *op)
         op->args[2] = arg_new_constant(ctx, ~ti_const_val(t2));
         return fold_or(ctx, op);
     }
-
+    if (fold_xx_to_i(ctx, op, -1) ||
+        fold_ix_to_not(ctx, op, 0)) {
+        return true;
+    }
     t1 = arg_info(op->args[1]);
 
     z_mask = t1->z_mask | ~t2->o_mask;

From 7630de24bace80ec031c52e478605692f79ac08b Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 10 Dec 2024 08:30:50 -0600
Subject: [PATCH 1722/2760] tcg/optimize: Simplify fold_eqv constant checks

Both cases are handled by fold_xor after conversion.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index a48ddd9171..62a128bc9b 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -1948,9 +1948,7 @@ static bool fold_eqv(OptContext *ctx, TCGOp *op)
     uint64_t z_mask, o_mask, s_mask;
     TempOptInfo *t1, *t2;
 
-    if (fold_const2_commutative(ctx, op) ||
-        fold_xi_to_x(ctx, op, -1) ||
-        fold_xi_to_not(ctx, op, 0)) {
+    if (fold_const2_commutative(ctx, op)) {
         return true;
     }
 

From 169d253e1f25cc4adff6571e249222e422a4b07e Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 27 Jun 2025 06:22:27 -0700
Subject: [PATCH 1723/2760] tcg/riscv: Fix typo in tgen_extract
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fix the direction of the shift, introduced when converting
the codebase to TCGOutOp* and small tgen_* helpers.

Fixes: 5a4d034f3cb ("tcg: Convert extract to TCGOutOpExtract")
Reported-by: Andrea Bolognani <abologna@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Andrea Bolognani <abologna@redhat.com>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 tcg/riscv/tcg-target.c.inc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index 1800fd5077..31b9f7d87a 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -2502,7 +2502,7 @@ static void tgen_extract(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1,
         }
     }
     if (ofs + len == 32) {
-        tgen_shli(s, TCG_TYPE_I32, a0, a1, ofs);
+        tgen_shri(s, TCG_TYPE_I32, a0, a1, ofs);
         return;
     }
     if (len == 1) {

From 0d0fc3f4658937fb81fcc16a89738e83bd8d4795 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 28 Jun 2025 09:57:53 -0600
Subject: [PATCH 1724/2760] tcg: Fix constant propagation in tcg_reg_alloc_dup

The scalar constant must be replicated for dup.

Cc: qemu-stable@nongnu.org
Fixes: bab1671f0fa ("tcg: Manually expand INDEX_op_dup_vec")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3002
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tcg.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tcg/tcg.c b/tcg/tcg.c
index d714ae2889..50d40b9cbe 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -5154,7 +5154,7 @@ static void tcg_reg_alloc_dup(TCGContext *s, const TCGOp *op)
 
     if (its->val_type == TEMP_VAL_CONST) {
         /* Propagate constant via movi -> dupi.  */
-        tcg_target_ulong val = its->val;
+        tcg_target_ulong val = dup_const(vece, its->val);
         if (IS_DEAD_ARG(1)) {
             temp_dead(s, its);
         }

From a89d18919e4b9a3f8bc67c43e4577ae76ff9ee41 Mon Sep 17 00:00:00 2001
From: Mads Ynddal <mads@ynddal.dk>
Date: Tue, 1 Jul 2025 15:08:25 +0100
Subject: [PATCH 1725/2760] MAINTAINERS: add myself as reviewer for Apple
 Silicon HVF

I've both publicly and private been digging around the Apple Silicon HVF code,
and use it daily as part of my job. I feel I have a solid understanding of it,
so I thought I'd step up and assist.

I've added myself as reviewer to the common "HVF" as well, to be informed of
changes that might affect the Apple Silicon HVF code, which will be my primary
focus.

Signed-off-by: Mads Ynddal <mads@ynddal.dk>
Message-id: 20250617093001.70080-1-mads@ynddal.dk
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 MAINTAINERS | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/MAINTAINERS b/MAINTAINERS
index d1672fda8d..b3b2a11207 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -511,6 +511,7 @@ F: system/cpus.c
 
 Apple Silicon HVF CPUs
 M: Alexander Graf <agraf@csgraf.de>
+R: Mads Ynddal <mads@ynddal.dk>
 S: Maintained
 F: target/arm/hvf/
 F: target/arm/hvf-stub.c
@@ -527,6 +528,7 @@ HVF
 M: Cameron Esfahani <dirty@apple.com>
 M: Roman Bolshakov <rbolshakov@ddn.com>
 R: Phil Dennis-Jordan <phil@philjordan.eu>
+R: Mads Ynddal <mads@ynddal.dk>
 W: https://wiki.qemu.org/Features/HVF
 S: Maintained
 F: accel/hvf/

From 9a3bf0e0ab628de7051b41a88c4628aa9e4d311b Mon Sep 17 00:00:00 2001
From: Solomon Tan <root@wjsota.com>
Date: Tue, 1 Jul 2025 15:08:25 +0100
Subject: [PATCH 1726/2760] target/arm: Make RETA[AB] UNDEF when pauth is not
 implemented
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

According to the Arm A-profile A64 Instruction Set Architecture,
RETA[AB] should be decoded as UNDEF if the pauth feature is not
implemented.

We got this right in the initial implementation, but accidentally
dropped the feature-check when we converted these insns to
decodetree.

Cc: qemu-stable@nongnu.org
Fixes: 0ebbe9021254f ("target/arm: Convert BRA[AB]Z, BLR[AB]Z, RETA[AB] to decodetree")
Signed-off-by: Solomon Tan <root@wjsota.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250616171549.59190-1-root@wjsota.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/translate-a64.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index ac80f572a2..d0719b5665 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -1816,6 +1816,10 @@ static bool trans_RETA(DisasContext *s, arg_reta *a)
 {
     TCGv_i64 dst;
 
+    if (!dc_isar_feature(aa64_pauth, s)) {
+        return false;
+    }
+
     dst = auth_branch_target(s, cpu_reg(s, 30), cpu_X[31], !a->m);
     gen_a64_set_pc(s, dst);
     s->base.is_jmp = DISAS_JUMP;

From a2e3508ac0f2aeb27f859362bf8e6dcac96c88e7 Mon Sep 17 00:00:00 2001
From: Eric Auger <eric.auger@redhat.com>
Date: Tue, 1 Jul 2025 15:08:26 +0100
Subject: [PATCH 1727/2760] arm/cpu: Add sysreg definitions in cpu-sysregs.h

This new header contains macros that define aarch64 registers.
In a subsequent patch, this will be replaced by a more exhaustive
version that will be generated from linux arch/arm64/tools/sysreg
file. Those macros are sufficient to migrate the storage of those
ID regs from named fields in isar struct to an array cell.

[CH: reworked to use different structures]
[CH: moved accessors from the patches first using them to here,
     dropped interaction with writable registers, which will happen
     later]
[CH: use DEF magic suggested by rth]
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Sebastian Ott <sebott@redhat.com>
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Cornelia Huck <cohuck@redhat.com>
Message-id: 20250617153931.1330449-2-cohuck@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu-sysregs.h     | 42 +++++++++++++++++++++++++++++++
 target/arm/cpu-sysregs.h.inc | 36 ++++++++++++++++++++++++++
 target/arm/cpu.h             | 49 ++++++++++++++++++++++++++++++++++++
 target/arm/cpu64.c           | 22 ++++++++++++++++
 4 files changed, 149 insertions(+)
 create mode 100644 target/arm/cpu-sysregs.h
 create mode 100644 target/arm/cpu-sysregs.h.inc

diff --git a/target/arm/cpu-sysregs.h b/target/arm/cpu-sysregs.h
new file mode 100644
index 0000000000..7877a3b06a
--- /dev/null
+++ b/target/arm/cpu-sysregs.h
@@ -0,0 +1,42 @@
+/*
+ * Definitions for Arm ID system registers
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+#ifndef ARM_CPU_SYSREGS_H
+#define ARM_CPU_SYSREGS_H
+
+/*
+ * Following is similar to the coprocessor regs encodings, but with an argument
+ * ordering that matches the ARM ARM. We also reuse the various CP_REG_ defines
+ * that actually are the same as the equivalent KVM_REG_ values.
+ */
+#define ENCODE_ID_REG(op0, op1, crn, crm, op2)          \
+    (((op0) << CP_REG_ARM64_SYSREG_OP0_SHIFT) |         \
+     ((op1) << CP_REG_ARM64_SYSREG_OP1_SHIFT) |         \
+     ((crn) << CP_REG_ARM64_SYSREG_CRN_SHIFT) |         \
+     ((crm) << CP_REG_ARM64_SYSREG_CRM_SHIFT) |         \
+     ((op2) << CP_REG_ARM64_SYSREG_OP2_SHIFT))
+
+#define DEF(NAME, OP0, OP1, CRN, CRM, OP2) NAME##_IDX,
+
+typedef enum ARMIDRegisterIdx {
+#include "cpu-sysregs.h.inc"
+    NUM_ID_IDX,
+} ARMIDRegisterIdx;
+
+#undef DEF
+#define DEF(NAME, OP0, OP1, CRN, CRM, OP2) \
+    SYS_##NAME = ENCODE_ID_REG(OP0, OP1, CRN, CRM, OP2),
+
+typedef enum ARMSysRegs {
+#include "cpu-sysregs.h.inc"
+} ARMSysRegs;
+
+#undef DEF
+
+extern const uint32_t id_register_sysreg[NUM_ID_IDX];
+
+int get_sysreg_idx(ARMSysRegs sysreg);
+
+#endif /* ARM_CPU_SYSREGS_H */
diff --git a/target/arm/cpu-sysregs.h.inc b/target/arm/cpu-sysregs.h.inc
new file mode 100644
index 0000000000..cb99286f70
--- /dev/null
+++ b/target/arm/cpu-sysregs.h.inc
@@ -0,0 +1,36 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+DEF(ID_AA64PFR0_EL1, 3, 0, 0, 4, 0)
+DEF(ID_AA64PFR1_EL1, 3, 0, 0, 4, 1)
+DEF(ID_AA64SMFR0_EL1, 3, 0, 0, 4, 5)
+DEF(ID_AA64DFR0_EL1, 3, 0, 0, 5, 0)
+DEF(ID_AA64DFR1_EL1, 3, 0, 0, 5, 1)
+DEF(ID_AA64ISAR0_EL1, 3, 0, 0, 6, 0)
+DEF(ID_AA64ISAR1_EL1, 3, 0, 0, 6, 1)
+DEF(ID_AA64ISAR2_EL1, 3, 0, 0, 6, 2)
+DEF(ID_AA64MMFR0_EL1, 3, 0, 0, 7, 0)
+DEF(ID_AA64MMFR1_EL1, 3, 0, 0, 7, 1)
+DEF(ID_AA64MMFR2_EL1, 3, 0, 0, 7, 2)
+DEF(ID_AA64MMFR3_EL1, 3, 0, 0, 7, 3)
+DEF(ID_PFR0_EL1, 3, 0, 0, 1, 0)
+DEF(ID_PFR1_EL1, 3, 0, 0, 1, 1)
+DEF(ID_DFR0_EL1, 3, 0, 0, 1, 2)
+DEF(ID_MMFR0_EL1, 3, 0, 0, 1, 4)
+DEF(ID_MMFR1_EL1, 3, 0, 0, 1, 5)
+DEF(ID_MMFR2_EL1, 3, 0, 0, 1, 6)
+DEF(ID_MMFR3_EL1, 3, 0, 0, 1, 7)
+DEF(ID_ISAR0_EL1, 3, 0, 0, 2, 0)
+DEF(ID_ISAR1_EL1, 3, 0, 0, 2, 1)
+DEF(ID_ISAR2_EL1, 3, 0, 0, 2, 2)
+DEF(ID_ISAR3_EL1, 3, 0, 0, 2, 3)
+DEF(ID_ISAR4_EL1, 3, 0, 0, 2, 4)
+DEF(ID_ISAR5_EL1, 3, 0, 0, 2, 5)
+DEF(ID_MMFR4_EL1, 3, 0, 0, 2, 6)
+DEF(ID_ISAR6_EL1, 3, 0, 0, 2, 7)
+DEF(MVFR0_EL1, 3, 0, 0, 3, 0)
+DEF(MVFR1_EL1, 3, 0, 0, 3, 1)
+DEF(MVFR2_EL1, 3, 0, 0, 3, 2)
+DEF(ID_PFR2_EL1, 3, 0, 0, 3, 4)
+DEF(ID_DFR1_EL1, 3, 0, 0, 3, 5)
+DEF(ID_MMFR5_EL1, 3, 0, 0, 3, 6)
+DEF(ID_AA64ZFR0_EL1, 3, 0, 0, 4, 4)
+DEF(CTR_EL0, 3, 3, 0, 0, 1)
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index 302c24e232..45409f84ef 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -32,6 +32,7 @@
 #include "qapi/qapi-types-common.h"
 #include "target/arm/multiprocessing.h"
 #include "target/arm/gtimer.h"
+#include "target/arm/cpu-sysregs.h"
 
 #define EXCP_UDEF            1   /* undefined instruction */
 #define EXCP_SWI             2   /* software interrupt */
@@ -834,6 +835,53 @@ typedef struct {
     uint32_t map, init, supported;
 } ARMVQMap;
 
+/* REG is ID_XXX */
+#define FIELD_DP64_IDREG(ISAR, REG, FIELD, VALUE)                       \
+    ({                                                                  \
+        ARMISARegisters *i_ = (ISAR);                                   \
+        uint64_t regval = i_->idregs[REG ## _EL1_IDX];                  \
+        regval = FIELD_DP64(regval, REG, FIELD, VALUE);                 \
+        i_->idregs[REG ## _EL1_IDX] = regval;                           \
+    })
+
+#define FIELD_DP32_IDREG(ISAR, REG, FIELD, VALUE)                       \
+    ({                                                                  \
+        ARMISARegisters *i_ = (ISAR);                                   \
+        uint64_t regval = i_->idregs[REG ## _EL1_IDX];                  \
+        regval = FIELD_DP32(regval, REG, FIELD, VALUE);                 \
+        i_->idregs[REG ## _EL1_IDX] = regval;                           \
+    })
+
+#define FIELD_EX64_IDREG(ISAR, REG, FIELD)                              \
+    ({                                                                  \
+        const ARMISARegisters *i_ = (ISAR);                             \
+        FIELD_EX64(i_->idregs[REG ## _EL1_IDX], REG, FIELD);            \
+    })
+
+#define FIELD_EX32_IDREG(ISAR, REG, FIELD)                              \
+    ({                                                                  \
+        const ARMISARegisters *i_ = (ISAR);                             \
+        FIELD_EX32(i_->idregs[REG ## _EL1_IDX], REG, FIELD);            \
+    })
+
+#define FIELD_SEX64_IDREG(ISAR, REG, FIELD)                             \
+    ({                                                                  \
+        const ARMISARegisters *i_ = (ISAR);                             \
+        FIELD_SEX64(i_->idregs[REG ## _EL1_IDX], REG, FIELD);           \
+    })
+
+#define SET_IDREG(ISAR, REG, VALUE)                                     \
+    ({                                                                  \
+        ARMISARegisters *i_ = (ISAR);                                   \
+        i_->idregs[REG ## _EL1_IDX] = VALUE;                            \
+    })
+
+#define GET_IDREG(ISAR, REG)                                            \
+    ({                                                                  \
+        const ARMISARegisters *i_ = (ISAR);                             \
+        i_->idregs[REG ## _EL1_IDX];                                    \
+    })
+
 /**
  * ARMCPU:
  * @env: #CPUARMState
@@ -1040,6 +1088,7 @@ struct ArchCPU {
         uint64_t id_aa64zfr0;
         uint64_t id_aa64smfr0;
         uint64_t reset_pmcr_el0;
+        uint64_t idregs[NUM_ID_IDX];
     } isar;
     uint64_t midr;
     uint32_t revidr;
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index 200da1c489..77054e0ec3 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -36,6 +36,28 @@
 #include "cpu-features.h"
 #include "cpregs.h"
 
+/* convert between <register>_IDX and SYS_<register> */
+#define DEF(NAME, OP0, OP1, CRN, CRM, OP2)      \
+    [NAME##_IDX] = SYS_##NAME,
+
+const uint32_t id_register_sysreg[NUM_ID_IDX] = {
+#include "cpu-sysregs.h.inc"
+};
+
+#undef DEF
+#define DEF(NAME, OP0, OP1, CRN, CRM, OP2) \
+    case SYS_##NAME: return NAME##_IDX;
+
+int get_sysreg_idx(ARMSysRegs sysreg)
+{
+    switch (sysreg) {
+#include "cpu-sysregs.h.inc"
+    }
+    g_assert_not_reached();
+}
+
+#undef DEF
+
 void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp)
 {
     /*

From 804cfc7eedb7457b137282a528d8c3465760c2e6 Mon Sep 17 00:00:00 2001
From: Eric Auger <eric.auger@redhat.com>
Date: Tue, 1 Jul 2025 15:08:26 +0100
Subject: [PATCH 1728/2760] arm/cpu: Store aa64isar0/aa64zfr0 into the idregs
 arrays

Also add kvm accessors for storing host features into idregs.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Sebastian Ott <sebott@redhat.com>
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Cornelia Huck <cohuck@redhat.com>
Message-id: 20250617153931.1330449-3-cohuck@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu-features.h | 57 ++++++++++++++++++++-------------------
 target/arm/cpu.c          |  9 +++----
 target/arm/cpu.h          |  2 --
 target/arm/cpu64.c        |  8 +++---
 target/arm/helper.c       |  6 +++--
 target/arm/hvf/hvf.c      |  3 ++-
 target/arm/kvm.c          | 30 ++++++++++++++++++---
 target/arm/tcg/cpu64.c    | 44 ++++++++++++++++++------------
 8 files changed, 97 insertions(+), 62 deletions(-)

diff --git a/target/arm/cpu-features.h b/target/arm/cpu-features.h
index 4452e7c21e..6a47f1a6d2 100644
--- a/target/arm/cpu-features.h
+++ b/target/arm/cpu-features.h
@@ -23,6 +23,7 @@
 #include "hw/registerfields.h"
 #include "qemu/host-utils.h"
 #include "cpu.h"
+#include "cpu-sysregs.h"
 
 /*
  * Naming convention for isar_feature functions:
@@ -377,92 +378,92 @@ static inline bool isar_feature_aa32_doublelock(const ARMISARegisters *id)
  */
 static inline bool isar_feature_aa64_aes(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64isar0, ID_AA64ISAR0, AES) != 0;
+    return FIELD_EX64_IDREG(id, ID_AA64ISAR0, AES) != 0;
 }
 
 static inline bool isar_feature_aa64_pmull(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64isar0, ID_AA64ISAR0, AES) > 1;
+    return FIELD_EX64_IDREG(id, ID_AA64ISAR0, AES) > 1;
 }
 
 static inline bool isar_feature_aa64_sha1(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64isar0, ID_AA64ISAR0, SHA1) != 0;
+    return FIELD_EX64_IDREG(id, ID_AA64ISAR0, SHA1) != 0;
 }
 
 static inline bool isar_feature_aa64_sha256(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64isar0, ID_AA64ISAR0, SHA2) != 0;
+    return FIELD_EX64_IDREG(id, ID_AA64ISAR0, SHA2) != 0;
 }
 
 static inline bool isar_feature_aa64_sha512(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64isar0, ID_AA64ISAR0, SHA2) > 1;
+    return FIELD_EX64_IDREG(id, ID_AA64ISAR0, SHA2) > 1;
 }
 
 static inline bool isar_feature_aa64_crc32(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64isar0, ID_AA64ISAR0, CRC32) != 0;
+    return FIELD_EX64_IDREG(id, ID_AA64ISAR0, CRC32) != 0;
 }
 
 static inline bool isar_feature_aa64_atomics(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64isar0, ID_AA64ISAR0, ATOMIC) != 0;
+    return FIELD_EX64_IDREG(id, ID_AA64ISAR0, ATOMIC) != 0;
 }
 
 static inline bool isar_feature_aa64_rdm(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64isar0, ID_AA64ISAR0, RDM) != 0;
+    return FIELD_EX64_IDREG(id, ID_AA64ISAR0, RDM) != 0;
 }
 
 static inline bool isar_feature_aa64_sha3(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64isar0, ID_AA64ISAR0, SHA3) != 0;
+    return FIELD_EX64_IDREG(id, ID_AA64ISAR0, SHA3) != 0;
 }
 
 static inline bool isar_feature_aa64_sm3(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64isar0, ID_AA64ISAR0, SM3) != 0;
+    return FIELD_EX64_IDREG(id, ID_AA64ISAR0, SM3) != 0;
 }
 
 static inline bool isar_feature_aa64_sm4(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64isar0, ID_AA64ISAR0, SM4) != 0;
+    return FIELD_EX64_IDREG(id, ID_AA64ISAR0, SM4) != 0;
 }
 
 static inline bool isar_feature_aa64_dp(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64isar0, ID_AA64ISAR0, DP) != 0;
+    return FIELD_EX64_IDREG(id, ID_AA64ISAR0, DP) != 0;
 }
 
 static inline bool isar_feature_aa64_fhm(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64isar0, ID_AA64ISAR0, FHM) != 0;
+    return FIELD_EX64_IDREG(id, ID_AA64ISAR0, FHM) != 0;
 }
 
 static inline bool isar_feature_aa64_condm_4(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64isar0, ID_AA64ISAR0, TS) != 0;
+    return FIELD_EX64_IDREG(id, ID_AA64ISAR0, TS) != 0;
 }
 
 static inline bool isar_feature_aa64_condm_5(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64isar0, ID_AA64ISAR0, TS) >= 2;
+    return FIELD_EX64_IDREG(id, ID_AA64ISAR0, TS) >= 2;
 }
 
 static inline bool isar_feature_aa64_rndr(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64isar0, ID_AA64ISAR0, RNDR) != 0;
+    return FIELD_EX64_IDREG(id, ID_AA64ISAR0, RNDR) != 0;
 }
 
 static inline bool isar_feature_aa64_tlbirange(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64isar0, ID_AA64ISAR0, TLB) == 2;
+    return FIELD_EX64_IDREG(id, ID_AA64ISAR0, TLB) == 2;
 }
 
 static inline bool isar_feature_aa64_tlbios(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64isar0, ID_AA64ISAR0, TLB) != 0;
+    return FIELD_EX64_IDREG(id, ID_AA64ISAR0, TLB) != 0;
 }
 
 static inline bool isar_feature_aa64_jscvt(const ARMISARegisters *id)
@@ -928,52 +929,52 @@ static inline bool isar_feature_aa64_doublelock(const ARMISARegisters *id)
 
 static inline bool isar_feature_aa64_sve2(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64zfr0, ID_AA64ZFR0, SVEVER) != 0;
+    return FIELD_EX64_IDREG(id, ID_AA64ZFR0, SVEVER) != 0;
 }
 
 static inline bool isar_feature_aa64_sve2_aes(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64zfr0, ID_AA64ZFR0, AES) != 0;
+    return FIELD_EX64_IDREG(id, ID_AA64ZFR0, AES) != 0;
 }
 
 static inline bool isar_feature_aa64_sve2_pmull128(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64zfr0, ID_AA64ZFR0, AES) >= 2;
+    return FIELD_EX64_IDREG(id, ID_AA64ZFR0, AES) >= 2;
 }
 
 static inline bool isar_feature_aa64_sve2_bitperm(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64zfr0, ID_AA64ZFR0, BITPERM) != 0;
+    return FIELD_EX64_IDREG(id, ID_AA64ZFR0, BITPERM) != 0;
 }
 
 static inline bool isar_feature_aa64_sve_bf16(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64zfr0, ID_AA64ZFR0, BFLOAT16) != 0;
+    return FIELD_EX64_IDREG(id, ID_AA64ZFR0, BFLOAT16) != 0;
 }
 
 static inline bool isar_feature_aa64_sve2_sha3(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64zfr0, ID_AA64ZFR0, SHA3) != 0;
+    return FIELD_EX64_IDREG(id, ID_AA64ZFR0, SHA3) != 0;
 }
 
 static inline bool isar_feature_aa64_sve2_sm4(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64zfr0, ID_AA64ZFR0, SM4) != 0;
+    return FIELD_EX64_IDREG(id, ID_AA64ZFR0, SM4) != 0;
 }
 
 static inline bool isar_feature_aa64_sve_i8mm(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64zfr0, ID_AA64ZFR0, I8MM) != 0;
+    return FIELD_EX64_IDREG(id, ID_AA64ZFR0, I8MM) != 0;
 }
 
 static inline bool isar_feature_aa64_sve_f32mm(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64zfr0, ID_AA64ZFR0, F32MM) != 0;
+    return FIELD_EX64_IDREG(id, ID_AA64ZFR0, F32MM) != 0;
 }
 
 static inline bool isar_feature_aa64_sve_f64mm(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64zfr0, ID_AA64ZFR0, F64MM) != 0;
+    return FIELD_EX64_IDREG(id, ID_AA64ZFR0, F64MM) != 0;
 }
 
 static inline bool isar_feature_aa64_sme_f64f64(const ARMISARegisters *id)
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index e025e241ed..f033411b5d 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -1962,6 +1962,7 @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
 {
     CPUState *cs = CPU(dev);
     ARMCPU *cpu = ARM_CPU(dev);
+    ARMISARegisters *isar = &cpu->isar;
     ARMCPUClass *acc = ARM_CPU_GET_CLASS(dev);
     CPUARMState *env = &cpu->env;
     Error *local_err = NULL;
@@ -2167,7 +2168,7 @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
 
         unset_feature(env, ARM_FEATURE_NEON);
 
-        t = cpu->isar.id_aa64isar0;
+        t = GET_IDREG(isar, ID_AA64ISAR0);
         t = FIELD_DP64(t, ID_AA64ISAR0, AES, 0);
         t = FIELD_DP64(t, ID_AA64ISAR0, SHA1, 0);
         t = FIELD_DP64(t, ID_AA64ISAR0, SHA2, 0);
@@ -2175,7 +2176,7 @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
         t = FIELD_DP64(t, ID_AA64ISAR0, SM3, 0);
         t = FIELD_DP64(t, ID_AA64ISAR0, SM4, 0);
         t = FIELD_DP64(t, ID_AA64ISAR0, DP, 0);
-        cpu->isar.id_aa64isar0 = t;
+        SET_IDREG(isar, ID_AA64ISAR0, t);
 
         t = cpu->isar.id_aa64isar1;
         t = FIELD_DP64(t, ID_AA64ISAR1, FCMA, 0);
@@ -2220,9 +2221,7 @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
         uint64_t t;
         uint32_t u;
 
-        t = cpu->isar.id_aa64isar0;
-        t = FIELD_DP64(t, ID_AA64ISAR0, FHM, 0);
-        cpu->isar.id_aa64isar0 = t;
+        FIELD_DP64_IDREG(isar, ID_AA64ISAR0, FHM, 0);
 
         t = cpu->isar.id_aa64isar1;
         t = FIELD_DP64(t, ID_AA64ISAR1, FRINTTS, 0);
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index 45409f84ef..7b5c7a4abc 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -1074,7 +1074,6 @@ struct ArchCPU {
         uint32_t dbgdidr;
         uint32_t dbgdevid;
         uint32_t dbgdevid1;
-        uint64_t id_aa64isar0;
         uint64_t id_aa64isar1;
         uint64_t id_aa64isar2;
         uint64_t id_aa64pfr0;
@@ -1085,7 +1084,6 @@ struct ArchCPU {
         uint64_t id_aa64mmfr3;
         uint64_t id_aa64dfr0;
         uint64_t id_aa64dfr1;
-        uint64_t id_aa64zfr0;
         uint64_t id_aa64smfr0;
         uint64_t reset_pmcr_el0;
         uint64_t idregs[NUM_ID_IDX];
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index 77054e0ec3..c105fcc4ea 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -136,7 +136,7 @@ void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp)
              * SVE is disabled and so are all vector lengths.  Good.
              * Disable all SVE extensions as well.
              */
-            cpu->isar.id_aa64zfr0 = 0;
+            SET_IDREG(&cpu->isar, ID_AA64ZFR0, 0);
             return;
         }
 
@@ -639,6 +639,7 @@ void arm_cpu_lpa2_finalize(ARMCPU *cpu, Error **errp)
 static void aarch64_a57_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
+    ARMISARegisters *isar = &cpu->isar;
 
     cpu->dtb_compatible = "arm,cortex-a57";
     set_feature(&cpu->env, ARM_FEATURE_V8);
@@ -676,7 +677,7 @@ static void aarch64_a57_initfn(Object *obj)
     cpu->isar.id_isar6 = 0;
     cpu->isar.id_aa64pfr0 = 0x00002222;
     cpu->isar.id_aa64dfr0 = 0x10305106;
-    cpu->isar.id_aa64isar0 = 0x00011120;
+    SET_IDREG(isar, ID_AA64ISAR0, 0x00011120);
     cpu->isar.id_aa64mmfr0 = 0x00001124;
     cpu->isar.dbgdidr = 0x3516d000;
     cpu->isar.dbgdevid = 0x01110f13;
@@ -700,6 +701,7 @@ static void aarch64_a57_initfn(Object *obj)
 static void aarch64_a53_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
+    ARMISARegisters *isar = &cpu->isar;
 
     cpu->dtb_compatible = "arm,cortex-a53";
     set_feature(&cpu->env, ARM_FEATURE_V8);
@@ -737,7 +739,7 @@ static void aarch64_a53_initfn(Object *obj)
     cpu->isar.id_isar6 = 0;
     cpu->isar.id_aa64pfr0 = 0x00002222;
     cpu->isar.id_aa64dfr0 = 0x10305106;
-    cpu->isar.id_aa64isar0 = 0x00011120;
+    SET_IDREG(isar, ID_AA64ISAR0, 0x00011120);
     cpu->isar.id_aa64mmfr0 = 0x00001122; /* 40 bit physical addr */
     cpu->isar.dbgdidr = 0x3516d000;
     cpu->isar.dbgdevid = 0x00110f13;
diff --git a/target/arm/helper.c b/target/arm/helper.c
index 889d308807..638550e45a 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -7750,6 +7750,8 @@ void register_cp_regs_for_features(ARMCPU *cpu)
 {
     /* Register all the coprocessor registers based on feature bits */
     CPUARMState *env = &cpu->env;
+    ARMISARegisters *isar = &cpu->isar;
+
     if (arm_feature(env, ARM_FEATURE_M)) {
         /* M profile has no coprocessor registers */
         return;
@@ -7941,7 +7943,7 @@ void register_cp_regs_for_features(ARMCPU *cpu)
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 4,
               .access = PL1_R, .type = ARM_CP_CONST,
               .accessfn = access_aa64_tid3,
-              .resetvalue = cpu->isar.id_aa64zfr0 },
+              .resetvalue = GET_IDREG(isar, ID_AA64ZFR0)},
             { .name = "ID_AA64SMFR0_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 5,
               .access = PL1_R, .type = ARM_CP_CONST,
@@ -8001,7 +8003,7 @@ void register_cp_regs_for_features(ARMCPU *cpu)
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 0,
               .access = PL1_R, .type = ARM_CP_CONST,
               .accessfn = access_aa64_tid3,
-              .resetvalue = cpu->isar.id_aa64isar0 },
+              .resetvalue = GET_IDREG(isar, ID_AA64ISAR0)},
             { .name = "ID_AA64ISAR1_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 1,
               .access = PL1_R, .type = ARM_CP_CONST,
diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index 42258cc2d8..5d25260c5c 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -19,6 +19,7 @@
 #include "system/hw_accel.h"
 #include "hvf_arm.h"
 #include "cpregs.h"
+#include "cpu-sysregs.h"
 
 #include <mach/mach_time.h>
 
@@ -866,7 +867,7 @@ static bool hvf_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
         { HV_SYS_REG_ID_AA64PFR1_EL1, &host_isar.id_aa64pfr1 },
         { HV_SYS_REG_ID_AA64DFR0_EL1, &host_isar.id_aa64dfr0 },
         { HV_SYS_REG_ID_AA64DFR1_EL1, &host_isar.id_aa64dfr1 },
-        { HV_SYS_REG_ID_AA64ISAR0_EL1, &host_isar.id_aa64isar0 },
+        { HV_SYS_REG_ID_AA64ISAR0_EL1, &host_isar.idregs[ID_AA64ISAR0_EL1_IDX] },
         { HV_SYS_REG_ID_AA64ISAR1_EL1, &host_isar.id_aa64isar1 },
         /* Add ID_AA64ISAR2_EL1 here when HVF supports it */
         { HV_SYS_REG_ID_AA64MMFR0_EL1, &host_isar.id_aa64mmfr0 },
diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index 74fda8b809..bd33b0f656 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -26,6 +26,7 @@
 #include "system/kvm_int.h"
 #include "kvm_arm.h"
 #include "cpu.h"
+#include "cpu-sysregs.h"
 #include "trace.h"
 #include "internals.h"
 #include "hw/pci/pci.h"
@@ -218,6 +219,28 @@ static bool kvm_arm_pauth_supported(void)
             kvm_check_extension(kvm_state, KVM_CAP_ARM_PTRAUTH_GENERIC));
 }
 
+
+static uint64_t idregs_sysreg_to_kvm_reg(ARMSysRegs sysreg)
+{
+    return ARM64_SYS_REG((sysreg & CP_REG_ARM64_SYSREG_OP0_MASK) >> CP_REG_ARM64_SYSREG_OP0_SHIFT,
+                         (sysreg & CP_REG_ARM64_SYSREG_OP1_MASK) >> CP_REG_ARM64_SYSREG_OP1_SHIFT,
+                         (sysreg & CP_REG_ARM64_SYSREG_CRN_MASK) >> CP_REG_ARM64_SYSREG_CRN_SHIFT,
+                         (sysreg & CP_REG_ARM64_SYSREG_CRM_MASK) >> CP_REG_ARM64_SYSREG_CRM_SHIFT,
+                         (sysreg & CP_REG_ARM64_SYSREG_OP2_MASK) >> CP_REG_ARM64_SYSREG_OP2_SHIFT);
+}
+
+/* read a sysreg value and store it in the idregs */
+static int get_host_cpu_reg(int fd, ARMHostCPUFeatures *ahcf, ARMIDRegisterIdx index)
+{
+    uint64_t *reg;
+    int ret;
+
+    reg = &ahcf->isar.idregs[index];
+    ret = read_sys_reg64(fd, reg,
+                         idregs_sysreg_to_kvm_reg(id_register_sysreg[index]));
+    return ret;
+}
+
 static bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
 {
     /* Identify the feature bits corresponding to the host CPU, and
@@ -267,6 +290,7 @@ static bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
 
     ahcf->target = init.target;
     ahcf->dtb_compatible = "arm,arm-v8";
+    int fd = fdarray[2];
 
     err = read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64pfr0,
                          ARM64_SYS_REG(3, 0, 0, 4, 0));
@@ -298,8 +322,7 @@ static bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
                               ARM64_SYS_REG(3, 0, 0, 5, 0));
         err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64dfr1,
                               ARM64_SYS_REG(3, 0, 0, 5, 1));
-        err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64isar0,
-                              ARM64_SYS_REG(3, 0, 0, 6, 0));
+        err |= get_host_cpu_reg(fd, ahcf, ID_AA64ISAR0_EL1_IDX);
         err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64isar1,
                               ARM64_SYS_REG(3, 0, 0, 6, 1));
         err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64isar2,
@@ -408,8 +431,7 @@ static bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
              * enabled SVE support, which resulted in an error rather than RAZ.
              * So only read the register if we set KVM_ARM_VCPU_SVE above.
              */
-            err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64zfr0,
-                                  ARM64_SYS_REG(3, 0, 0, 4, 4));
+            err |= get_host_cpu_reg(fd, ahcf, ID_AA64ZFR0_EL1_IDX);
         }
     }
 
diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
index 5d8ed2794d..ed681ee08b 100644
--- a/target/arm/tcg/cpu64.c
+++ b/target/arm/tcg/cpu64.c
@@ -32,6 +32,7 @@
 static void aarch64_a35_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
+    ARMISARegisters *isar = &cpu->isar;
 
     cpu->dtb_compatible = "arm,cortex-a35";
     set_feature(&cpu->env, ARM_FEATURE_V8);
@@ -66,7 +67,7 @@ static void aarch64_a35_initfn(Object *obj)
     cpu->isar.id_aa64pfr1 = 0;
     cpu->isar.id_aa64dfr0 = 0x10305106;
     cpu->isar.id_aa64dfr1 = 0;
-    cpu->isar.id_aa64isar0 = 0x00011120;
+    SET_IDREG(isar, ID_AA64ISAR0, 0x00011120);
     cpu->isar.id_aa64isar1 = 0;
     cpu->isar.id_aa64mmfr0 = 0x00101122;
     cpu->isar.id_aa64mmfr1 = 0;
@@ -204,6 +205,7 @@ static const Property arm_cpu_lpa2_property =
 static void aarch64_a55_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
+    ARMISARegisters *isar = &cpu->isar;
 
     cpu->dtb_compatible = "arm,cortex-a55";
     set_feature(&cpu->env, ARM_FEATURE_V8);
@@ -221,7 +223,7 @@ static void aarch64_a55_initfn(Object *obj)
     cpu->ctr = 0x84448004; /* L1Ip = VIPT */
     cpu->dcz_blocksize = 4; /* 64 bytes */
     cpu->isar.id_aa64dfr0  = 0x0000000010305408ull;
-    cpu->isar.id_aa64isar0 = 0x0000100010211120ull;
+    SET_IDREG(isar, ID_AA64ISAR0, 0x0000100010211120ull);
     cpu->isar.id_aa64isar1 = 0x0000000000100001ull;
     cpu->isar.id_aa64mmfr0 = 0x0000000000101122ull;
     cpu->isar.id_aa64mmfr1 = 0x0000000010212122ull;
@@ -276,6 +278,7 @@ static void aarch64_a55_initfn(Object *obj)
 static void aarch64_a72_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
+    ARMISARegisters *isar = &cpu->isar;
 
     cpu->dtb_compatible = "arm,cortex-a72";
     set_feature(&cpu->env, ARM_FEATURE_V8);
@@ -311,7 +314,7 @@ static void aarch64_a72_initfn(Object *obj)
     cpu->isar.id_isar5 = 0x00011121;
     cpu->isar.id_aa64pfr0 = 0x00002222;
     cpu->isar.id_aa64dfr0 = 0x10305106;
-    cpu->isar.id_aa64isar0 = 0x00011120;
+    SET_IDREG(isar, ID_AA64ISAR0, 0x00011120);
     cpu->isar.id_aa64mmfr0 = 0x00001124;
     cpu->isar.dbgdidr = 0x3516d000;
     cpu->isar.dbgdevid = 0x01110f13;
@@ -335,6 +338,7 @@ static void aarch64_a72_initfn(Object *obj)
 static void aarch64_a76_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
+    ARMISARegisters *isar = &cpu->isar;
 
     cpu->dtb_compatible = "arm,cortex-a76";
     set_feature(&cpu->env, ARM_FEATURE_V8);
@@ -352,7 +356,7 @@ static void aarch64_a76_initfn(Object *obj)
     cpu->ctr = 0x8444C004;
     cpu->dcz_blocksize = 4;
     cpu->isar.id_aa64dfr0  = 0x0000000010305408ull;
-    cpu->isar.id_aa64isar0 = 0x0000100010211120ull;
+    SET_IDREG(isar, ID_AA64ISAR0, 0x0000100010211120ull);
     cpu->isar.id_aa64isar1 = 0x0000000000100001ull;
     cpu->isar.id_aa64mmfr0 = 0x0000000000101122ull;
     cpu->isar.id_aa64mmfr1 = 0x0000000010212122ull;
@@ -408,6 +412,7 @@ static void aarch64_a76_initfn(Object *obj)
 static void aarch64_a64fx_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
+    ARMISARegisters *isar = &cpu->isar;
 
     cpu->dtb_compatible = "arm,a64fx";
     set_feature(&cpu->env, ARM_FEATURE_V8);
@@ -431,9 +436,9 @@ static void aarch64_a64fx_initfn(Object *obj)
     cpu->isar.id_aa64mmfr0 = 0x0000000000001122;
     cpu->isar.id_aa64mmfr1 = 0x0000000011212100;
     cpu->isar.id_aa64mmfr2 = 0x0000000000001011;
-    cpu->isar.id_aa64isar0 = 0x0000000010211120;
+    SET_IDREG(isar, ID_AA64ISAR0, 0x0000000010211120);
     cpu->isar.id_aa64isar1 = 0x0000000000010001;
-    cpu->isar.id_aa64zfr0 = 0x0000000000000000;
+    SET_IDREG(isar, ID_AA64ZFR0, 0x0000000000000000);
     cpu->clidr = 0x0000000080000023;
     /* 64KB L1 dcache */
     cpu->ccsidr[0] = make_ccsidr(CCSIDR_FORMAT_LEGACY, 4, 256, 64 * KiB, 7);
@@ -581,6 +586,7 @@ static void define_neoverse_v1_cp_reginfo(ARMCPU *cpu)
 static void aarch64_neoverse_n1_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
+    ARMISARegisters *isar = &cpu->isar;
 
     cpu->dtb_compatible = "arm,neoverse-n1";
     set_feature(&cpu->env, ARM_FEATURE_V8);
@@ -598,7 +604,7 @@ static void aarch64_neoverse_n1_initfn(Object *obj)
     cpu->ctr = 0x8444c004;
     cpu->dcz_blocksize = 4;
     cpu->isar.id_aa64dfr0  = 0x0000000110305408ull;
-    cpu->isar.id_aa64isar0 = 0x0000100010211120ull;
+    SET_IDREG(isar, ID_AA64ISAR0, 0x0000100010211120ull);
     cpu->isar.id_aa64isar1 = 0x0000000000100001ull;
     cpu->isar.id_aa64mmfr0 = 0x0000000000101125ull;
     cpu->isar.id_aa64mmfr1 = 0x0000000010212122ull;
@@ -656,6 +662,7 @@ static void aarch64_neoverse_n1_initfn(Object *obj)
 static void aarch64_neoverse_v1_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
+    ARMISARegisters *isar = &cpu->isar;
 
     cpu->dtb_compatible = "arm,neoverse-v1";
     set_feature(&cpu->env, ARM_FEATURE_V8);
@@ -676,7 +683,7 @@ static void aarch64_neoverse_v1_initfn(Object *obj)
     cpu->id_aa64afr1 = 0x00000000;
     cpu->isar.id_aa64dfr0  = 0x000001f210305519ull;
     cpu->isar.id_aa64dfr1 = 0x00000000;
-    cpu->isar.id_aa64isar0 = 0x1011111110212120ull; /* with FEAT_RNG */
+    SET_IDREG(isar, ID_AA64ISAR0, 0x1011111110212120ull); /* with FEAT_RNG */
     cpu->isar.id_aa64isar1 = 0x0011100001211032ull;
     cpu->isar.id_aa64mmfr0 = 0x0000000000101125ull;
     cpu->isar.id_aa64mmfr1 = 0x0000000010212122ull;
@@ -735,7 +742,7 @@ static void aarch64_neoverse_v1_initfn(Object *obj)
     cpu->isar.mvfr2 = 0x00000043;
 
     /* From 3.7.5 ID_AA64ZFR0_EL1 */
-    cpu->isar.id_aa64zfr0 = 0x0000100000100000;
+    SET_IDREG(isar, ID_AA64ZFR0, 0x0000100000100000);
     cpu->sve_vq.supported = (1 << 0)  /* 128bit */
                             | (1 << 1);  /* 256bit */
 
@@ -882,6 +889,7 @@ static const ARMCPRegInfo cortex_a710_cp_reginfo[] = {
 static void aarch64_a710_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
+    ARMISARegisters *isar = &cpu->isar;
 
     cpu->dtb_compatible = "arm,cortex-a710";
     set_feature(&cpu->env, ARM_FEATURE_V8);
@@ -919,12 +927,12 @@ static void aarch64_a710_initfn(Object *obj)
     cpu->isar.id_pfr2  = 0x00000011;
     cpu->isar.id_aa64pfr0  = 0x1201111120111112ull; /* GIC filled in later */
     cpu->isar.id_aa64pfr1  = 0x0000000000000221ull;
-    cpu->isar.id_aa64zfr0  = 0x0000110100110021ull; /* with Crypto */
+    SET_IDREG(isar, ID_AA64ZFR0, 0x0000110100110021ull); /* with Crypto */
     cpu->isar.id_aa64dfr0  = 0x000011f010305619ull;
     cpu->isar.id_aa64dfr1  = 0;
     cpu->id_aa64afr0       = 0;
     cpu->id_aa64afr1       = 0;
-    cpu->isar.id_aa64isar0 = 0x0221111110212120ull; /* with Crypto */
+    SET_IDREG(isar, ID_AA64ISAR0, 0x0221111110212120ull); /* with Crypto */
     cpu->isar.id_aa64isar1 = 0x0010111101211052ull;
     cpu->isar.id_aa64mmfr0 = 0x0000022200101122ull;
     cpu->isar.id_aa64mmfr1 = 0x0000000010212122ull;
@@ -983,6 +991,7 @@ static const ARMCPRegInfo neoverse_n2_cp_reginfo[] = {
 static void aarch64_neoverse_n2_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
+    ARMISARegisters *isar = &cpu->isar;
 
     cpu->dtb_compatible = "arm,neoverse-n2";
     set_feature(&cpu->env, ARM_FEATURE_V8);
@@ -1020,12 +1029,12 @@ static void aarch64_neoverse_n2_initfn(Object *obj)
     cpu->isar.id_pfr2  = 0x00000011;
     cpu->isar.id_aa64pfr0  = 0x1201111120111112ull; /* GIC filled in later */
     cpu->isar.id_aa64pfr1  = 0x0000000000000221ull;
-    cpu->isar.id_aa64zfr0  = 0x0000110100110021ull; /* with Crypto */
+    SET_IDREG(isar, ID_AA64ZFR0, 0x0000110100110021ull); /* with Crypto */
     cpu->isar.id_aa64dfr0  = 0x000011f210305619ull;
     cpu->isar.id_aa64dfr1  = 0;
     cpu->id_aa64afr0       = 0;
     cpu->id_aa64afr1       = 0;
-    cpu->isar.id_aa64isar0 = 0x1221111110212120ull; /* with Crypto and FEAT_RNG */
+    SET_IDREG(isar, ID_AA64ISAR0, 0x1221111110212120ull); /* with Crypto and FEAT_RNG */
     cpu->isar.id_aa64isar1 = 0x0011111101211052ull;
     cpu->isar.id_aa64mmfr0 = 0x0000022200101125ull;
     cpu->isar.id_aa64mmfr1 = 0x0000000010212122ull;
@@ -1083,6 +1092,7 @@ static void aarch64_neoverse_n2_initfn(Object *obj)
 void aarch64_max_tcg_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
+    ARMISARegisters *isar = &cpu->isar;
     uint64_t t;
     uint32_t u;
 
@@ -1133,7 +1143,7 @@ void aarch64_max_tcg_initfn(Object *obj)
     t = FIELD_DP64(t, CTR_EL0, DIC, 1);
     cpu->ctr = t;
 
-    t = cpu->isar.id_aa64isar0;
+    t = GET_IDREG(isar, ID_AA64ISAR0);
     t = FIELD_DP64(t, ID_AA64ISAR0, AES, 2);      /* FEAT_PMULL */
     t = FIELD_DP64(t, ID_AA64ISAR0, SHA1, 1);     /* FEAT_SHA1 */
     t = FIELD_DP64(t, ID_AA64ISAR0, SHA2, 2);     /* FEAT_SHA512 */
@@ -1148,7 +1158,7 @@ void aarch64_max_tcg_initfn(Object *obj)
     t = FIELD_DP64(t, ID_AA64ISAR0, TS, 2);       /* FEAT_FlagM2 */
     t = FIELD_DP64(t, ID_AA64ISAR0, TLB, 2);      /* FEAT_TLBIRANGE */
     t = FIELD_DP64(t, ID_AA64ISAR0, RNDR, 1);     /* FEAT_RNG */
-    cpu->isar.id_aa64isar0 = t;
+    SET_IDREG(isar, ID_AA64ISAR0, t);
 
     t = cpu->isar.id_aa64isar1;
     t = FIELD_DP64(t, ID_AA64ISAR1, DPB, 2);      /* FEAT_DPB2 */
@@ -1244,7 +1254,7 @@ void aarch64_max_tcg_initfn(Object *obj)
     t = FIELD_DP64(t, ID_AA64MMFR3, SPEC_FPACC, 1); /* FEAT_FPACC_SPEC */
     cpu->isar.id_aa64mmfr3 = t;
 
-    t = cpu->isar.id_aa64zfr0;
+    t = GET_IDREG(isar, ID_AA64ZFR0);
     t = FIELD_DP64(t, ID_AA64ZFR0, SVEVER, 1);
     t = FIELD_DP64(t, ID_AA64ZFR0, AES, 2);       /* FEAT_SVE_PMULL128 */
     t = FIELD_DP64(t, ID_AA64ZFR0, BITPERM, 1);   /* FEAT_SVE_BitPerm */
@@ -1254,7 +1264,7 @@ void aarch64_max_tcg_initfn(Object *obj)
     t = FIELD_DP64(t, ID_AA64ZFR0, I8MM, 1);      /* FEAT_I8MM */
     t = FIELD_DP64(t, ID_AA64ZFR0, F32MM, 1);     /* FEAT_F32MM */
     t = FIELD_DP64(t, ID_AA64ZFR0, F64MM, 1);     /* FEAT_F64MM */
-    cpu->isar.id_aa64zfr0 = t;
+    SET_IDREG(isar, ID_AA64ZFR0, t);
 
     t = cpu->isar.id_aa64dfr0;
     t = FIELD_DP64(t, ID_AA64DFR0, DEBUGVER, 10); /* FEAT_Debugv8p8 */

From 03380dd993de1a31c596b417f6e8a9de7dd8c370 Mon Sep 17 00:00:00 2001
From: Eric Auger <eric.auger@redhat.com>
Date: Tue, 1 Jul 2025 15:08:26 +0100
Subject: [PATCH 1729/2760] arm/cpu: Store aa64isar1/2 into the idregs array

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Sebastian Ott <sebott@redhat.com>
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Cornelia Huck <cohuck@redhat.com>
Message-id: 20250617153931.1330449-4-cohuck@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu-features.h | 44 +++++++++++++++++++--------------------
 target/arm/cpu.c          | 13 ++++--------
 target/arm/cpu.h          |  2 --
 target/arm/cpu64.c        |  9 ++++----
 target/arm/helper.c       |  4 ++--
 target/arm/hvf/hvf.c      |  2 +-
 target/arm/kvm.c          |  6 ++----
 target/arm/tcg/cpu64.c    | 24 ++++++++++-----------
 8 files changed, 48 insertions(+), 56 deletions(-)

diff --git a/target/arm/cpu-features.h b/target/arm/cpu-features.h
index 6a47f1a6d2..43c9695be0 100644
--- a/target/arm/cpu-features.h
+++ b/target/arm/cpu-features.h
@@ -468,17 +468,17 @@ static inline bool isar_feature_aa64_tlbios(const ARMISARegisters *id)
 
 static inline bool isar_feature_aa64_jscvt(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64isar1, ID_AA64ISAR1, JSCVT) != 0;
+    return FIELD_EX64_IDREG(id, ID_AA64ISAR1, JSCVT) != 0;
 }
 
 static inline bool isar_feature_aa64_fcma(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64isar1, ID_AA64ISAR1, FCMA) != 0;
+    return FIELD_EX64_IDREG(id, ID_AA64ISAR1, FCMA) != 0;
 }
 
 static inline bool isar_feature_aa64_xs(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64isar1, ID_AA64ISAR1, XS) != 0;
+    return FIELD_EX64_IDREG(id, ID_AA64ISAR1, XS) != 0;
 }
 
 /*
@@ -502,9 +502,9 @@ isar_feature_pauth_feature(const ARMISARegisters *id)
      * Architecturally, only one of {APA,API,APA3} may be active (non-zero)
      * and the other two must be zero.  Thus we may avoid conditionals.
      */
-    return (FIELD_EX64(id->id_aa64isar1, ID_AA64ISAR1, APA) |
-            FIELD_EX64(id->id_aa64isar1, ID_AA64ISAR1, API) |
-            FIELD_EX64(id->id_aa64isar2, ID_AA64ISAR2, APA3));
+    return (FIELD_EX64_IDREG(id, ID_AA64ISAR1, APA) |
+            FIELD_EX64_IDREG(id, ID_AA64ISAR1, API) |
+            FIELD_EX64_IDREG(id, ID_AA64ISAR2, APA3));
 }
 
 static inline bool isar_feature_aa64_pauth(const ARMISARegisters *id)
@@ -522,7 +522,7 @@ static inline bool isar_feature_aa64_pauth_qarma5(const ARMISARegisters *id)
      * Return true if pauth is enabled with the architected QARMA5 algorithm.
      * QEMU will always enable or disable both APA and GPA.
      */
-    return FIELD_EX64(id->id_aa64isar1, ID_AA64ISAR1, APA) != 0;
+    return FIELD_EX64_IDREG(id, ID_AA64ISAR1, APA) != 0;
 }
 
 static inline bool isar_feature_aa64_pauth_qarma3(const ARMISARegisters *id)
@@ -531,77 +531,77 @@ static inline bool isar_feature_aa64_pauth_qarma3(const ARMISARegisters *id)
      * Return true if pauth is enabled with the architected QARMA3 algorithm.
      * QEMU will always enable or disable both APA3 and GPA3.
      */
-    return FIELD_EX64(id->id_aa64isar2, ID_AA64ISAR2, APA3) != 0;
+    return FIELD_EX64_IDREG(id, ID_AA64ISAR2, APA3) != 0;
 }
 
 static inline bool isar_feature_aa64_sb(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64isar1, ID_AA64ISAR1, SB) != 0;
+    return FIELD_EX64_IDREG(id, ID_AA64ISAR1, SB) != 0;
 }
 
 static inline bool isar_feature_aa64_predinv(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64isar1, ID_AA64ISAR1, SPECRES) != 0;
+    return FIELD_EX64_IDREG(id, ID_AA64ISAR1, SPECRES) != 0;
 }
 
 static inline bool isar_feature_aa64_frint(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64isar1, ID_AA64ISAR1, FRINTTS) != 0;
+    return FIELD_EX64_IDREG(id, ID_AA64ISAR1, FRINTTS) != 0;
 }
 
 static inline bool isar_feature_aa64_dcpop(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64isar1, ID_AA64ISAR1, DPB) != 0;
+    return FIELD_EX64_IDREG(id, ID_AA64ISAR1, DPB) != 0;
 }
 
 static inline bool isar_feature_aa64_dcpodp(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64isar1, ID_AA64ISAR1, DPB) >= 2;
+    return FIELD_EX64_IDREG(id, ID_AA64ISAR1, DPB) >= 2;
 }
 
 static inline bool isar_feature_aa64_bf16(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64isar1, ID_AA64ISAR1, BF16) != 0;
+    return FIELD_EX64_IDREG(id, ID_AA64ISAR1, BF16) != 0;
 }
 
 static inline bool isar_feature_aa64_ebf16(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64isar1, ID_AA64ISAR1, BF16) > 1;
+    return FIELD_EX64_IDREG(id, ID_AA64ISAR1, BF16) > 1;
 }
 
 static inline bool isar_feature_aa64_rcpc_8_3(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64isar1, ID_AA64ISAR1, LRCPC) != 0;
+    return FIELD_EX64_IDREG(id, ID_AA64ISAR1, LRCPC) != 0;
 }
 
 static inline bool isar_feature_aa64_rcpc_8_4(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64isar1, ID_AA64ISAR1, LRCPC) >= 2;
+    return FIELD_EX64_IDREG(id, ID_AA64ISAR1, LRCPC) >= 2;
 }
 
 static inline bool isar_feature_aa64_i8mm(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64isar1, ID_AA64ISAR1, I8MM) != 0;
+    return FIELD_EX64_IDREG(id, ID_AA64ISAR1, I8MM) != 0;
 }
 
 static inline bool isar_feature_aa64_wfxt(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64isar2, ID_AA64ISAR2, WFXT) >= 2;
+    return FIELD_EX64_IDREG(id, ID_AA64ISAR2, WFXT) >= 2;
 }
 
 static inline bool isar_feature_aa64_hbc(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64isar2, ID_AA64ISAR2, BC) != 0;
+    return FIELD_EX64_IDREG(id, ID_AA64ISAR2, BC) != 0;
 }
 
 static inline bool isar_feature_aa64_mops(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64isar2, ID_AA64ISAR2, MOPS);
+    return FIELD_EX64_IDREG(id, ID_AA64ISAR2, MOPS);
 }
 
 static inline bool isar_feature_aa64_rpres(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64isar2, ID_AA64ISAR2, RPRES);
+    return FIELD_EX64_IDREG(id, ID_AA64ISAR2, RPRES);
 }
 
 static inline bool isar_feature_aa64_fp_simd(const ARMISARegisters *id)
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index f033411b5d..2777de7294 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -2123,9 +2123,7 @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
         uint64_t t;
         uint32_t u;
 
-        t = cpu->isar.id_aa64isar1;
-        t = FIELD_DP64(t, ID_AA64ISAR1, JSCVT, 0);
-        cpu->isar.id_aa64isar1 = t;
+        FIELD_DP64_IDREG(isar, ID_AA64ISAR1, JSCVT, 0);
 
         t = cpu->isar.id_aa64pfr0;
         t = FIELD_DP64(t, ID_AA64PFR0, FP, 0xf);
@@ -2178,11 +2176,11 @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
         t = FIELD_DP64(t, ID_AA64ISAR0, DP, 0);
         SET_IDREG(isar, ID_AA64ISAR0, t);
 
-        t = cpu->isar.id_aa64isar1;
+        t = GET_IDREG(isar, ID_AA64ISAR1);
         t = FIELD_DP64(t, ID_AA64ISAR1, FCMA, 0);
         t = FIELD_DP64(t, ID_AA64ISAR1, BF16, 0);
         t = FIELD_DP64(t, ID_AA64ISAR1, I8MM, 0);
-        cpu->isar.id_aa64isar1 = t;
+        SET_IDREG(isar, ID_AA64ISAR1, t);
 
         t = cpu->isar.id_aa64pfr0;
         t = FIELD_DP64(t, ID_AA64PFR0, ADVSIMD, 0xf);
@@ -2218,14 +2216,11 @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
     }
 
     if (!cpu->has_neon && !cpu->has_vfp) {
-        uint64_t t;
         uint32_t u;
 
         FIELD_DP64_IDREG(isar, ID_AA64ISAR0, FHM, 0);
 
-        t = cpu->isar.id_aa64isar1;
-        t = FIELD_DP64(t, ID_AA64ISAR1, FRINTTS, 0);
-        cpu->isar.id_aa64isar1 = t;
+        FIELD_DP64_IDREG(isar, ID_AA64ISAR1, FRINTTS, 0);
 
         u = cpu->isar.mvfr0;
         u = FIELD_DP32(u, MVFR0, SIMDREG, 0);
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index 7b5c7a4abc..b81bc46966 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -1074,8 +1074,6 @@ struct ArchCPU {
         uint32_t dbgdidr;
         uint32_t dbgdevid;
         uint32_t dbgdevid1;
-        uint64_t id_aa64isar1;
-        uint64_t id_aa64isar2;
         uint64_t id_aa64pfr0;
         uint64_t id_aa64pfr1;
         uint64_t id_aa64mmfr0;
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index c105fcc4ea..e2b25b0043 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -502,6 +502,7 @@ void aarch64_add_sme_properties(Object *obj)
 void arm_cpu_pauth_finalize(ARMCPU *cpu, Error **errp)
 {
     ARMPauthFeature features = cpu_isar_feature(pauth_feature, cpu);
+    ARMISARegisters *isar = &cpu->isar;
     uint64_t isar1, isar2;
 
     /*
@@ -512,13 +513,13 @@ void arm_cpu_pauth_finalize(ARMCPU *cpu, Error **errp)
      *
      * Begin by disabling all fields.
      */
-    isar1 = cpu->isar.id_aa64isar1;
+    isar1 = GET_IDREG(isar, ID_AA64ISAR1);
     isar1 = FIELD_DP64(isar1, ID_AA64ISAR1, APA, 0);
     isar1 = FIELD_DP64(isar1, ID_AA64ISAR1, GPA, 0);
     isar1 = FIELD_DP64(isar1, ID_AA64ISAR1, API, 0);
     isar1 = FIELD_DP64(isar1, ID_AA64ISAR1, GPI, 0);
 
-    isar2 = cpu->isar.id_aa64isar2;
+    isar2 = GET_IDREG(isar, ID_AA64ISAR2);
     isar2 = FIELD_DP64(isar2, ID_AA64ISAR2, APA3, 0);
     isar2 = FIELD_DP64(isar2, ID_AA64ISAR2, GPA3, 0);
 
@@ -580,8 +581,8 @@ void arm_cpu_pauth_finalize(ARMCPU *cpu, Error **errp)
         }
     }
 
-    cpu->isar.id_aa64isar1 = isar1;
-    cpu->isar.id_aa64isar2 = isar2;
+    SET_IDREG(isar, ID_AA64ISAR1, isar1);
+    SET_IDREG(isar, ID_AA64ISAR2, isar2);
 }
 
 static const Property arm_cpu_pauth_property =
diff --git a/target/arm/helper.c b/target/arm/helper.c
index 638550e45a..fd2a86b6b0 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -8008,12 +8008,12 @@ void register_cp_regs_for_features(ARMCPU *cpu)
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 1,
               .access = PL1_R, .type = ARM_CP_CONST,
               .accessfn = access_aa64_tid3,
-              .resetvalue = cpu->isar.id_aa64isar1 },
+              .resetvalue = GET_IDREG(isar, ID_AA64ISAR1)},
             { .name = "ID_AA64ISAR2_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 2,
               .access = PL1_R, .type = ARM_CP_CONST,
               .accessfn = access_aa64_tid3,
-              .resetvalue = cpu->isar.id_aa64isar2 },
+              .resetvalue = GET_IDREG(isar, ID_AA64ISAR2)},
             { .name = "ID_AA64ISAR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 3,
               .access = PL1_R, .type = ARM_CP_CONST,
diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index 5d25260c5c..7554282410 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -868,7 +868,7 @@ static bool hvf_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
         { HV_SYS_REG_ID_AA64DFR0_EL1, &host_isar.id_aa64dfr0 },
         { HV_SYS_REG_ID_AA64DFR1_EL1, &host_isar.id_aa64dfr1 },
         { HV_SYS_REG_ID_AA64ISAR0_EL1, &host_isar.idregs[ID_AA64ISAR0_EL1_IDX] },
-        { HV_SYS_REG_ID_AA64ISAR1_EL1, &host_isar.id_aa64isar1 },
+        { HV_SYS_REG_ID_AA64ISAR1_EL1, &host_isar.idregs[ID_AA64ISAR1_EL1_IDX] },
         /* Add ID_AA64ISAR2_EL1 here when HVF supports it */
         { HV_SYS_REG_ID_AA64MMFR0_EL1, &host_isar.id_aa64mmfr0 },
         { HV_SYS_REG_ID_AA64MMFR1_EL1, &host_isar.id_aa64mmfr1 },
diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index bd33b0f656..6fa5bdff42 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -323,10 +323,8 @@ static bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
         err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64dfr1,
                               ARM64_SYS_REG(3, 0, 0, 5, 1));
         err |= get_host_cpu_reg(fd, ahcf, ID_AA64ISAR0_EL1_IDX);
-        err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64isar1,
-                              ARM64_SYS_REG(3, 0, 0, 6, 1));
-        err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64isar2,
-                              ARM64_SYS_REG(3, 0, 0, 6, 2));
+        err |= get_host_cpu_reg(fd, ahcf, ID_AA64ISAR1_EL1_IDX);
+        err |= get_host_cpu_reg(fd, ahcf, ID_AA64ISAR2_EL1_IDX);
         err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64mmfr0,
                               ARM64_SYS_REG(3, 0, 0, 7, 0));
         err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64mmfr1,
diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
index ed681ee08b..9175026472 100644
--- a/target/arm/tcg/cpu64.c
+++ b/target/arm/tcg/cpu64.c
@@ -68,7 +68,7 @@ static void aarch64_a35_initfn(Object *obj)
     cpu->isar.id_aa64dfr0 = 0x10305106;
     cpu->isar.id_aa64dfr1 = 0;
     SET_IDREG(isar, ID_AA64ISAR0, 0x00011120);
-    cpu->isar.id_aa64isar1 = 0;
+    SET_IDREG(isar, ID_AA64ISAR1, 0);
     cpu->isar.id_aa64mmfr0 = 0x00101122;
     cpu->isar.id_aa64mmfr1 = 0;
     cpu->clidr = 0x0a200023;
@@ -224,7 +224,7 @@ static void aarch64_a55_initfn(Object *obj)
     cpu->dcz_blocksize = 4; /* 64 bytes */
     cpu->isar.id_aa64dfr0  = 0x0000000010305408ull;
     SET_IDREG(isar, ID_AA64ISAR0, 0x0000100010211120ull);
-    cpu->isar.id_aa64isar1 = 0x0000000000100001ull;
+    SET_IDREG(isar, ID_AA64ISAR1, 0x0000000000100001ull);
     cpu->isar.id_aa64mmfr0 = 0x0000000000101122ull;
     cpu->isar.id_aa64mmfr1 = 0x0000000010212122ull;
     cpu->isar.id_aa64mmfr2 = 0x0000000000001011ull;
@@ -357,7 +357,7 @@ static void aarch64_a76_initfn(Object *obj)
     cpu->dcz_blocksize = 4;
     cpu->isar.id_aa64dfr0  = 0x0000000010305408ull;
     SET_IDREG(isar, ID_AA64ISAR0, 0x0000100010211120ull);
-    cpu->isar.id_aa64isar1 = 0x0000000000100001ull;
+    SET_IDREG(isar, ID_AA64ISAR1, 0x0000000000100001ull);
     cpu->isar.id_aa64mmfr0 = 0x0000000000101122ull;
     cpu->isar.id_aa64mmfr1 = 0x0000000010212122ull;
     cpu->isar.id_aa64mmfr2 = 0x0000000000001011ull;
@@ -437,7 +437,7 @@ static void aarch64_a64fx_initfn(Object *obj)
     cpu->isar.id_aa64mmfr1 = 0x0000000011212100;
     cpu->isar.id_aa64mmfr2 = 0x0000000000001011;
     SET_IDREG(isar, ID_AA64ISAR0, 0x0000000010211120);
-    cpu->isar.id_aa64isar1 = 0x0000000000010001;
+    SET_IDREG(isar, ID_AA64ISAR1, 0x0000000000010001);
     SET_IDREG(isar, ID_AA64ZFR0, 0x0000000000000000);
     cpu->clidr = 0x0000000080000023;
     /* 64KB L1 dcache */
@@ -605,7 +605,7 @@ static void aarch64_neoverse_n1_initfn(Object *obj)
     cpu->dcz_blocksize = 4;
     cpu->isar.id_aa64dfr0  = 0x0000000110305408ull;
     SET_IDREG(isar, ID_AA64ISAR0, 0x0000100010211120ull);
-    cpu->isar.id_aa64isar1 = 0x0000000000100001ull;
+    SET_IDREG(isar, ID_AA64ISAR1, 0x0000000000100001ull);
     cpu->isar.id_aa64mmfr0 = 0x0000000000101125ull;
     cpu->isar.id_aa64mmfr1 = 0x0000000010212122ull;
     cpu->isar.id_aa64mmfr2 = 0x0000000000001011ull;
@@ -684,7 +684,7 @@ static void aarch64_neoverse_v1_initfn(Object *obj)
     cpu->isar.id_aa64dfr0  = 0x000001f210305519ull;
     cpu->isar.id_aa64dfr1 = 0x00000000;
     SET_IDREG(isar, ID_AA64ISAR0, 0x1011111110212120ull); /* with FEAT_RNG */
-    cpu->isar.id_aa64isar1 = 0x0011100001211032ull;
+    SET_IDREG(isar, ID_AA64ISAR1, 0x0011000001211032ull);
     cpu->isar.id_aa64mmfr0 = 0x0000000000101125ull;
     cpu->isar.id_aa64mmfr1 = 0x0000000010212122ull;
     cpu->isar.id_aa64mmfr2 = 0x0220011102101011ull;
@@ -933,7 +933,7 @@ static void aarch64_a710_initfn(Object *obj)
     cpu->id_aa64afr0       = 0;
     cpu->id_aa64afr1       = 0;
     SET_IDREG(isar, ID_AA64ISAR0, 0x0221111110212120ull); /* with Crypto */
-    cpu->isar.id_aa64isar1 = 0x0010111101211052ull;
+    SET_IDREG(isar, ID_AA64ISAR1, 0x0010111101211052ull);
     cpu->isar.id_aa64mmfr0 = 0x0000022200101122ull;
     cpu->isar.id_aa64mmfr1 = 0x0000000010212122ull;
     cpu->isar.id_aa64mmfr2 = 0x1221011110101011ull;
@@ -1035,7 +1035,7 @@ static void aarch64_neoverse_n2_initfn(Object *obj)
     cpu->id_aa64afr0       = 0;
     cpu->id_aa64afr1       = 0;
     SET_IDREG(isar, ID_AA64ISAR0, 0x1221111110212120ull); /* with Crypto and FEAT_RNG */
-    cpu->isar.id_aa64isar1 = 0x0011111101211052ull;
+    SET_IDREG(isar, ID_AA64ISAR1, 0x0011111101211052ull);
     cpu->isar.id_aa64mmfr0 = 0x0000022200101125ull;
     cpu->isar.id_aa64mmfr1 = 0x0000000010212122ull;
     cpu->isar.id_aa64mmfr2 = 0x1221011112101011ull;
@@ -1160,7 +1160,7 @@ void aarch64_max_tcg_initfn(Object *obj)
     t = FIELD_DP64(t, ID_AA64ISAR0, RNDR, 1);     /* FEAT_RNG */
     SET_IDREG(isar, ID_AA64ISAR0, t);
 
-    t = cpu->isar.id_aa64isar1;
+    t = GET_IDREG(isar, ID_AA64ISAR1);
     t = FIELD_DP64(t, ID_AA64ISAR1, DPB, 2);      /* FEAT_DPB2 */
     t = FIELD_DP64(t, ID_AA64ISAR1, APA, PauthFeat_FPACCOMBINED);
     t = FIELD_DP64(t, ID_AA64ISAR1, API, 1);
@@ -1174,14 +1174,14 @@ void aarch64_max_tcg_initfn(Object *obj)
     t = FIELD_DP64(t, ID_AA64ISAR1, DGH, 1);      /* FEAT_DGH */
     t = FIELD_DP64(t, ID_AA64ISAR1, I8MM, 1);     /* FEAT_I8MM */
     t = FIELD_DP64(t, ID_AA64ISAR1, XS, 1);       /* FEAT_XS */
-    cpu->isar.id_aa64isar1 = t;
+    SET_IDREG(isar, ID_AA64ISAR1, t);
 
-    t = cpu->isar.id_aa64isar2;
+    t = GET_IDREG(isar, ID_AA64ISAR2);
     t = FIELD_DP64(t, ID_AA64ISAR2, RPRES, 1);    /* FEAT_RPRES */
     t = FIELD_DP64(t, ID_AA64ISAR2, MOPS, 1);     /* FEAT_MOPS */
     t = FIELD_DP64(t, ID_AA64ISAR2, BC, 1);       /* FEAT_HBC */
     t = FIELD_DP64(t, ID_AA64ISAR2, WFXT, 2);     /* FEAT_WFxT */
-    cpu->isar.id_aa64isar2 = t;
+    SET_IDREG(isar, ID_AA64ISAR2, t);
 
     t = cpu->isar.id_aa64pfr0;
     t = FIELD_DP64(t, ID_AA64PFR0, FP, 1);        /* FEAT_FP16 */

From d1a3cc9634548b8fe1398c6eb624aa2c7e9e265b Mon Sep 17 00:00:00 2001
From: Eric Auger <eric.auger@redhat.com>
Date: Tue, 1 Jul 2025 15:08:26 +0100
Subject: [PATCH 1730/2760] arm/cpu: Store aa64pfr0/1 into the idregs array

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Sebastian Ott <sebott@redhat.com>
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Cornelia Huck <cohuck@redhat.com>
Message-id: 20250617153931.1330449-5-cohuck@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu-features.h | 40 ++++++++++++++++-----------------
 target/arm/cpu.c          | 29 ++++++++----------------
 target/arm/cpu.h          |  2 --
 target/arm/cpu64.c        | 14 ++++--------
 target/arm/helper.c       |  6 ++---
 target/arm/hvf/hvf.c      |  9 ++++----
 target/arm/kvm.c          | 12 +++++-----
 target/arm/tcg/cpu64.c    | 47 ++++++++++++++++++---------------------
 8 files changed, 68 insertions(+), 91 deletions(-)

diff --git a/target/arm/cpu-features.h b/target/arm/cpu-features.h
index 43c9695be0..3adea85b79 100644
--- a/target/arm/cpu-features.h
+++ b/target/arm/cpu-features.h
@@ -607,68 +607,68 @@ static inline bool isar_feature_aa64_rpres(const ARMISARegisters *id)
 static inline bool isar_feature_aa64_fp_simd(const ARMISARegisters *id)
 {
     /* We always set the AdvSIMD and FP fields identically.  */
-    return FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, FP) != 0xf;
+    return FIELD_EX64_IDREG(id, ID_AA64PFR0, FP) != 0xf;
 }
 
 static inline bool isar_feature_aa64_fp16(const ARMISARegisters *id)
 {
     /* We always set the AdvSIMD and FP fields identically wrt FP16.  */
-    return FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, FP) == 1;
+    return FIELD_EX64_IDREG(id, ID_AA64PFR0, FP) == 1;
 }
 
 static inline bool isar_feature_aa64_aa32(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, EL0) >= 2;
+    return FIELD_EX64_IDREG(id, ID_AA64PFR0, EL0) >= 2;
 }
 
 static inline bool isar_feature_aa64_aa32_el1(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, EL1) >= 2;
+    return FIELD_EX64_IDREG(id, ID_AA64PFR0, EL1) >= 2;
 }
 
 static inline bool isar_feature_aa64_aa32_el2(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, EL2) >= 2;
+    return FIELD_EX64_IDREG(id, ID_AA64PFR0, EL2) >= 2;
 }
 
 static inline bool isar_feature_aa64_ras(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, RAS) != 0;
+    return FIELD_EX64_IDREG(id, ID_AA64PFR0, RAS) != 0;
 }
 
 static inline bool isar_feature_aa64_doublefault(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, RAS) >= 2;
+    return FIELD_EX64_IDREG(id, ID_AA64PFR0, RAS) >= 2;
 }
 
 static inline bool isar_feature_aa64_sve(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, SVE) != 0;
+    return FIELD_EX64_IDREG(id, ID_AA64PFR0, SVE) != 0;
 }
 
 static inline bool isar_feature_aa64_sel2(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, SEL2) != 0;
+    return FIELD_EX64_IDREG(id, ID_AA64PFR0, SEL2) != 0;
 }
 
 static inline bool isar_feature_aa64_rme(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, RME) != 0;
+    return FIELD_EX64_IDREG(id, ID_AA64PFR0, RME) != 0;
 }
 
 static inline bool isar_feature_aa64_dit(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, DIT) != 0;
+    return FIELD_EX64_IDREG(id, ID_AA64PFR0, DIT) != 0;
 }
 
 static inline bool isar_feature_aa64_scxtnum(const ARMISARegisters *id)
 {
-    int key = FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, CSV2);
+    int key = FIELD_EX64_IDREG(id, ID_AA64PFR0, CSV2);
     if (key >= 2) {
         return true;      /* FEAT_CSV2_2 */
     }
     if (key == 1) {
-        key = FIELD_EX64(id->id_aa64pfr1, ID_AA64PFR1, CSV2_FRAC);
+        key = FIELD_EX64_IDREG(id, ID_AA64PFR1, CSV2_FRAC);
         return key >= 2;  /* FEAT_CSV2_1p2 */
     }
     return false;
@@ -676,37 +676,37 @@ static inline bool isar_feature_aa64_scxtnum(const ARMISARegisters *id)
 
 static inline bool isar_feature_aa64_ssbs(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64pfr1, ID_AA64PFR1, SSBS) != 0;
+    return FIELD_EX64_IDREG(id, ID_AA64PFR1, SSBS) != 0;
 }
 
 static inline bool isar_feature_aa64_bti(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64pfr1, ID_AA64PFR1, BT) != 0;
+    return FIELD_EX64_IDREG(id, ID_AA64PFR1, BT) != 0;
 }
 
 static inline bool isar_feature_aa64_mte_insn_reg(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64pfr1, ID_AA64PFR1, MTE) != 0;
+    return FIELD_EX64_IDREG(id, ID_AA64PFR1, MTE) != 0;
 }
 
 static inline bool isar_feature_aa64_mte(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64pfr1, ID_AA64PFR1, MTE) >= 2;
+    return FIELD_EX64_IDREG(id, ID_AA64PFR1, MTE) >= 2;
 }
 
 static inline bool isar_feature_aa64_mte3(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64pfr1, ID_AA64PFR1, MTE) >= 3;
+    return FIELD_EX64_IDREG(id, ID_AA64PFR1, MTE) >= 3;
 }
 
 static inline bool isar_feature_aa64_sme(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64pfr1, ID_AA64PFR1, SME) != 0;
+    return FIELD_EX64_IDREG(id, ID_AA64PFR1, SME) != 0;
 }
 
 static inline bool isar_feature_aa64_nmi(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64pfr1, ID_AA64PFR1, NMI) != 0;
+    return FIELD_EX64_IDREG(id, ID_AA64PFR1, NMI) != 0;
 }
 
 static inline bool isar_feature_aa64_tgran4_lpa2(const ARMISARegisters *id)
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index 2777de7294..d39e8dc956 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -2120,14 +2120,11 @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
     }
 
     if (!cpu->has_vfp) {
-        uint64_t t;
         uint32_t u;
 
         FIELD_DP64_IDREG(isar, ID_AA64ISAR1, JSCVT, 0);
 
-        t = cpu->isar.id_aa64pfr0;
-        t = FIELD_DP64(t, ID_AA64PFR0, FP, 0xf);
-        cpu->isar.id_aa64pfr0 = t;
+        FIELD_DP64_IDREG(isar, ID_AA64PFR0, FP, 0xf);
 
         u = cpu->isar.id_isar6;
         u = FIELD_DP32(u, ID_ISAR6, JSCVT, 0);
@@ -2182,9 +2179,7 @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
         t = FIELD_DP64(t, ID_AA64ISAR1, I8MM, 0);
         SET_IDREG(isar, ID_AA64ISAR1, t);
 
-        t = cpu->isar.id_aa64pfr0;
-        t = FIELD_DP64(t, ID_AA64PFR0, ADVSIMD, 0xf);
-        cpu->isar.id_aa64pfr0 = t;
+        FIELD_DP64_IDREG(isar, ID_AA64PFR0, ADVSIMD, 0xf);
 
         u = cpu->isar.id_isar5;
         u = FIELD_DP32(u, ID_ISAR5, AES, 0);
@@ -2326,12 +2321,10 @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
          */
         cpu->isar.id_pfr1 = FIELD_DP32(cpu->isar.id_pfr1, ID_PFR1, SECURITY, 0);
         cpu->isar.id_dfr0 = FIELD_DP32(cpu->isar.id_dfr0, ID_DFR0, COPSDBG, 0);
-        cpu->isar.id_aa64pfr0 = FIELD_DP64(cpu->isar.id_aa64pfr0,
-                                           ID_AA64PFR0, EL3, 0);
+        FIELD_DP64_IDREG(isar, ID_AA64PFR0, EL3, 0);
 
         /* Disable the realm management extension, which requires EL3. */
-        cpu->isar.id_aa64pfr0 = FIELD_DP64(cpu->isar.id_aa64pfr0,
-                                           ID_AA64PFR0, RME, 0);
+        FIELD_DP64_IDREG(isar, ID_AA64PFR0, RME, 0);
     }
 
     if (!cpu->has_el2) {
@@ -2366,8 +2359,7 @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
          * Disable the hypervisor feature bits in the processor feature
          * registers if we don't have EL2.
          */
-        cpu->isar.id_aa64pfr0 = FIELD_DP64(cpu->isar.id_aa64pfr0,
-                                           ID_AA64PFR0, EL2, 0);
+        FIELD_DP64_IDREG(isar, ID_AA64PFR0, EL2, 0);
         cpu->isar.id_pfr1 = FIELD_DP32(cpu->isar.id_pfr1,
                                        ID_PFR1, VIRTUALIZATION, 0);
     }
@@ -2388,8 +2380,7 @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
          * This matches Cortex-A710 BROADCASTMTE input being LOW.
          */
         if (tcg_enabled() && cpu->tag_memory == NULL) {
-            cpu->isar.id_aa64pfr1 =
-                FIELD_DP64(cpu->isar.id_aa64pfr1, ID_AA64PFR1, MTE, 1);
+            FIELD_DP64_IDREG(isar, ID_AA64PFR1, MTE, 1);
         }
 
         /*
@@ -2397,7 +2388,7 @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
          * enabled on the guest (i.e mte=off), clear guest's MTE bits."
          */
         if (kvm_enabled() && !cpu->kvm_mte) {
-                FIELD_DP64(cpu->isar.id_aa64pfr1, ID_AA64PFR1, MTE, 0);
+                FIELD_DP64_IDREG(isar, ID_AA64PFR1, MTE, 0);
         }
 #endif
     }
@@ -2436,13 +2427,11 @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
         cpu->isar.id_dfr0 =
             FIELD_DP32(cpu->isar.id_dfr0, ID_DFR0, MMAPTRC, 0);
         /* FEAT_AMU (Activity Monitors Extension) */
-        cpu->isar.id_aa64pfr0 =
-            FIELD_DP64(cpu->isar.id_aa64pfr0, ID_AA64PFR0, AMU, 0);
+        FIELD_DP64_IDREG(isar, ID_AA64PFR0, AMU, 0);
         cpu->isar.id_pfr0 =
             FIELD_DP32(cpu->isar.id_pfr0, ID_PFR0, AMU, 0);
         /* FEAT_MPAM (Memory Partitioning and Monitoring Extension) */
-        cpu->isar.id_aa64pfr0 =
-            FIELD_DP64(cpu->isar.id_aa64pfr0, ID_AA64PFR0, MPAM, 0);
+        FIELD_DP64_IDREG(isar, ID_AA64PFR0, MPAM, 0);
     }
 
     /* MPU can be configured out of a PMSA CPU either by setting has-mpu
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index b81bc46966..05157a49d7 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -1074,8 +1074,6 @@ struct ArchCPU {
         uint32_t dbgdidr;
         uint32_t dbgdevid;
         uint32_t dbgdevid1;
-        uint64_t id_aa64pfr0;
-        uint64_t id_aa64pfr1;
         uint64_t id_aa64mmfr0;
         uint64_t id_aa64mmfr1;
         uint64_t id_aa64mmfr2;
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index e2b25b0043..502aac9173 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -310,16 +310,13 @@ static bool cpu_arm_get_sve(Object *obj, Error **errp)
 static void cpu_arm_set_sve(Object *obj, bool value, Error **errp)
 {
     ARMCPU *cpu = ARM_CPU(obj);
-    uint64_t t;
 
     if (value && kvm_enabled() && !kvm_arm_sve_supported()) {
         error_setg(errp, "'sve' feature not supported by KVM on this host");
         return;
     }
 
-    t = cpu->isar.id_aa64pfr0;
-    t = FIELD_DP64(t, ID_AA64PFR0, SVE, value);
-    cpu->isar.id_aa64pfr0 = t;
+    FIELD_DP64_IDREG(&cpu->isar, ID_AA64PFR0, SVE, value);
 }
 
 void arm_cpu_sme_finalize(ARMCPU *cpu, Error **errp)
@@ -370,11 +367,8 @@ static bool cpu_arm_get_sme(Object *obj, Error **errp)
 static void cpu_arm_set_sme(Object *obj, bool value, Error **errp)
 {
     ARMCPU *cpu = ARM_CPU(obj);
-    uint64_t t;
 
-    t = cpu->isar.id_aa64pfr1;
-    t = FIELD_DP64(t, ID_AA64PFR1, SME, value);
-    cpu->isar.id_aa64pfr1 = t;
+    FIELD_DP64_IDREG(&cpu->isar, ID_AA64PFR1, SME, value);
 }
 
 static bool cpu_arm_get_sme_fa64(Object *obj, Error **errp)
@@ -676,7 +670,7 @@ static void aarch64_a57_initfn(Object *obj)
     cpu->isar.id_isar4 = 0x00011142;
     cpu->isar.id_isar5 = 0x00011121;
     cpu->isar.id_isar6 = 0;
-    cpu->isar.id_aa64pfr0 = 0x00002222;
+    SET_IDREG(isar, ID_AA64PFR0, 0x00002222);
     cpu->isar.id_aa64dfr0 = 0x10305106;
     SET_IDREG(isar, ID_AA64ISAR0, 0x00011120);
     cpu->isar.id_aa64mmfr0 = 0x00001124;
@@ -738,7 +732,7 @@ static void aarch64_a53_initfn(Object *obj)
     cpu->isar.id_isar4 = 0x00011142;
     cpu->isar.id_isar5 = 0x00011121;
     cpu->isar.id_isar6 = 0;
-    cpu->isar.id_aa64pfr0 = 0x00002222;
+    SET_IDREG(isar, ID_AA64PFR0, 0x00002222);
     cpu->isar.id_aa64dfr0 = 0x10305106;
     SET_IDREG(isar, ID_AA64ISAR0, 0x00011120);
     cpu->isar.id_aa64mmfr0 = 0x00001122; /* 40 bit physical addr */
diff --git a/target/arm/helper.c b/target/arm/helper.c
index fd2a86b6b0..b221e8df6c 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -6943,7 +6943,7 @@ static uint64_t id_pfr1_read(CPUARMState *env, const ARMCPRegInfo *ri)
 static uint64_t id_aa64pfr0_read(CPUARMState *env, const ARMCPRegInfo *ri)
 {
     ARMCPU *cpu = env_archcpu(env);
-    uint64_t pfr0 = cpu->isar.id_aa64pfr0;
+    uint64_t pfr0 = GET_IDREG(&cpu->isar, ID_AA64PFR0);
 
     if (env->gicv3state) {
         pfr0 |= 1 << 24;
@@ -7916,7 +7916,7 @@ void register_cp_regs_for_features(ARMCPU *cpu)
               .access = PL1_R,
 #ifdef CONFIG_USER_ONLY
               .type = ARM_CP_CONST,
-              .resetvalue = cpu->isar.id_aa64pfr0
+              .resetvalue = GET_IDREG(isar, ID_AA64PFR0)
 #else
               .type = ARM_CP_NO_RAW,
               .accessfn = access_aa64_tid3,
@@ -7928,7 +7928,7 @@ void register_cp_regs_for_features(ARMCPU *cpu)
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 1,
               .access = PL1_R, .type = ARM_CP_CONST,
               .accessfn = access_aa64_tid3,
-              .resetvalue = cpu->isar.id_aa64pfr1},
+              .resetvalue = GET_IDREG(isar, ID_AA64PFR1)},
             { .name = "ID_AA64PFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 2,
               .access = PL1_R, .type = ARM_CP_CONST,
diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index 7554282410..e1bfca5947 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -863,8 +863,8 @@ static bool hvf_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
         int reg;
         uint64_t *val;
     } regs[] = {
-        { HV_SYS_REG_ID_AA64PFR0_EL1, &host_isar.id_aa64pfr0 },
-        { HV_SYS_REG_ID_AA64PFR1_EL1, &host_isar.id_aa64pfr1 },
+        { HV_SYS_REG_ID_AA64PFR0_EL1, &host_isar.idregs[ID_AA64PFR0_EL1_IDX] },
+        { HV_SYS_REG_ID_AA64PFR1_EL1, &host_isar.idregs[ID_AA64PFR1_EL1_IDX] },
         { HV_SYS_REG_ID_AA64DFR0_EL1, &host_isar.id_aa64dfr0 },
         { HV_SYS_REG_ID_AA64DFR1_EL1, &host_isar.id_aa64dfr1 },
         { HV_SYS_REG_ID_AA64ISAR0_EL1, &host_isar.idregs[ID_AA64ISAR0_EL1_IDX] },
@@ -911,7 +911,8 @@ static bool hvf_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
      * - fix any assumptions we made that SME implies SVE (since
      *   on the M4 there is SME but not SVE)
      */
-    host_isar.id_aa64pfr1 &= ~R_ID_AA64PFR1_SME_MASK;
+    SET_IDREG(&host_isar, ID_AA64PFR1,
+              GET_IDREG(&host_isar, ID_AA64PFR1) & ~R_ID_AA64PFR1_SME_MASK);
 
     ahcf->isar = host_isar;
 
@@ -928,7 +929,7 @@ static bool hvf_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
     ahcf->reset_sctlr |= 0x00800000;
 
     /* Make sure we don't advertise AArch32 support for EL0/EL1 */
-    if ((host_isar.id_aa64pfr0 & 0xff) != 0x11) {
+    if ((GET_IDREG(&host_isar, ID_AA64PFR0) & 0xff) != 0x11) {
         return false;
     }
 
diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index 6fa5bdff42..1e19dba4cb 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -292,8 +292,7 @@ static bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
     ahcf->dtb_compatible = "arm,arm-v8";
     int fd = fdarray[2];
 
-    err = read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64pfr0,
-                         ARM64_SYS_REG(3, 0, 0, 4, 0));
+    err = get_host_cpu_reg(fd, ahcf, ID_AA64PFR0_EL1_IDX);
     if (unlikely(err < 0)) {
         /*
          * Before v4.15, the kernel only exposed a limited number of system
@@ -311,11 +310,10 @@ static bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
          * ??? Either of these sounds like too much effort just
          *     to work around running a modern host kernel.
          */
-        ahcf->isar.id_aa64pfr0 = 0x00000011; /* EL1&0, AArch64 only */
+        SET_IDREG(&ahcf->isar, ID_AA64PFR0, 0x00000011); /* EL1&0, AArch64 only */
         err = 0;
     } else {
-        err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64pfr1,
-                              ARM64_SYS_REG(3, 0, 0, 4, 1));
+        err |= get_host_cpu_reg(fd, ahcf, ID_AA64PFR1_EL1_IDX);
         err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64smfr0,
                               ARM64_SYS_REG(3, 0, 0, 4, 5));
         err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64dfr0,
@@ -395,14 +393,14 @@ static bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
          * arch/arm64/kvm/sys_regs.c:trap_dbgidr() does.
          * We only do this if the CPU supports AArch32 at EL1.
          */
-        if (FIELD_EX32(ahcf->isar.id_aa64pfr0, ID_AA64PFR0, EL1) >= 2) {
+        if (FIELD_EX32_IDREG(&ahcf->isar, ID_AA64PFR0, EL1) >= 2) {
             int wrps = FIELD_EX64(ahcf->isar.id_aa64dfr0, ID_AA64DFR0, WRPS);
             int brps = FIELD_EX64(ahcf->isar.id_aa64dfr0, ID_AA64DFR0, BRPS);
             int ctx_cmps =
                 FIELD_EX64(ahcf->isar.id_aa64dfr0, ID_AA64DFR0, CTX_CMPS);
             int version = 6; /* ARMv8 debug architecture */
             bool has_el3 =
-                !!FIELD_EX32(ahcf->isar.id_aa64pfr0, ID_AA64PFR0, EL3);
+                !!FIELD_EX32_IDREG(&ahcf->isar, ID_AA64PFR0, EL3);
             uint32_t dbgdidr = 0;
 
             dbgdidr = FIELD_DP32(dbgdidr, DBGDIDR, WRPS, wrps);
diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
index 9175026472..7a730c7974 100644
--- a/target/arm/tcg/cpu64.c
+++ b/target/arm/tcg/cpu64.c
@@ -63,8 +63,8 @@ static void aarch64_a35_initfn(Object *obj)
     cpu->isar.id_isar3 = 0x01112131;
     cpu->isar.id_isar4 = 0x00011142;
     cpu->isar.id_isar5 = 0x00011121;
-    cpu->isar.id_aa64pfr0 = 0x00002222;
-    cpu->isar.id_aa64pfr1 = 0;
+    SET_IDREG(isar, ID_AA64PFR0, 0x00002222);
+    SET_IDREG(isar, ID_AA64PFR1, 0);
     cpu->isar.id_aa64dfr0 = 0x10305106;
     cpu->isar.id_aa64dfr1 = 0;
     SET_IDREG(isar, ID_AA64ISAR0, 0x00011120);
@@ -158,11 +158,8 @@ static bool cpu_arm_get_rme(Object *obj, Error **errp)
 static void cpu_arm_set_rme(Object *obj, bool value, Error **errp)
 {
     ARMCPU *cpu = ARM_CPU(obj);
-    uint64_t t;
 
-    t = cpu->isar.id_aa64pfr0;
-    t = FIELD_DP64(t, ID_AA64PFR0, RME, value);
-    cpu->isar.id_aa64pfr0 = t;
+    FIELD_DP64_IDREG(&cpu->isar, ID_AA64PFR0, RME, value);
 }
 
 static void cpu_max_set_l0gptsz(Object *obj, Visitor *v, const char *name,
@@ -228,8 +225,8 @@ static void aarch64_a55_initfn(Object *obj)
     cpu->isar.id_aa64mmfr0 = 0x0000000000101122ull;
     cpu->isar.id_aa64mmfr1 = 0x0000000010212122ull;
     cpu->isar.id_aa64mmfr2 = 0x0000000000001011ull;
-    cpu->isar.id_aa64pfr0  = 0x0000000010112222ull;
-    cpu->isar.id_aa64pfr1  = 0x0000000000000010ull;
+    SET_IDREG(isar, ID_AA64PFR0, 0x0000000010112222ull);
+    SET_IDREG(isar, ID_AA64PFR1, 0x0000000000000010ull);
     cpu->id_afr0       = 0x00000000;
     cpu->isar.id_dfr0  = 0x04010088;
     cpu->isar.id_isar0 = 0x02101110;
@@ -312,7 +309,7 @@ static void aarch64_a72_initfn(Object *obj)
     cpu->isar.id_isar3 = 0x01112131;
     cpu->isar.id_isar4 = 0x00011142;
     cpu->isar.id_isar5 = 0x00011121;
-    cpu->isar.id_aa64pfr0 = 0x00002222;
+    SET_IDREG(isar, ID_AA64PFR0, 0x00002222);
     cpu->isar.id_aa64dfr0 = 0x10305106;
     SET_IDREG(isar, ID_AA64ISAR0, 0x00011120);
     cpu->isar.id_aa64mmfr0 = 0x00001124;
@@ -361,8 +358,8 @@ static void aarch64_a76_initfn(Object *obj)
     cpu->isar.id_aa64mmfr0 = 0x0000000000101122ull;
     cpu->isar.id_aa64mmfr1 = 0x0000000010212122ull;
     cpu->isar.id_aa64mmfr2 = 0x0000000000001011ull;
-    cpu->isar.id_aa64pfr0  = 0x1100000010111112ull; /* GIC filled in later */
-    cpu->isar.id_aa64pfr1  = 0x0000000000000010ull;
+    SET_IDREG(isar, ID_AA64PFR0, 0x1100000010111112ull); /* GIC filled in later */
+    SET_IDREG(isar, ID_AA64PFR1, 0x0000000000000010ull);
     cpu->id_afr0       = 0x00000000;
     cpu->isar.id_dfr0  = 0x04010088;
     cpu->isar.id_isar0 = 0x02101110;
@@ -427,8 +424,8 @@ static void aarch64_a64fx_initfn(Object *obj)
     cpu->revidr = 0x00000000;
     cpu->ctr = 0x86668006;
     cpu->reset_sctlr = 0x30000180;
-    cpu->isar.id_aa64pfr0 =   0x0000000101111111; /* No RAS Extensions */
-    cpu->isar.id_aa64pfr1 = 0x0000000000000000;
+    SET_IDREG(isar, ID_AA64PFR0, 0x0000000101111111); /* No RAS Extensions */
+    SET_IDREG(isar, ID_AA64PFR1, 0x0000000000000000);
     cpu->isar.id_aa64dfr0 = 0x0000000010305408;
     cpu->isar.id_aa64dfr1 = 0x0000000000000000;
     cpu->id_aa64afr0 = 0x0000000000000000;
@@ -609,8 +606,8 @@ static void aarch64_neoverse_n1_initfn(Object *obj)
     cpu->isar.id_aa64mmfr0 = 0x0000000000101125ull;
     cpu->isar.id_aa64mmfr1 = 0x0000000010212122ull;
     cpu->isar.id_aa64mmfr2 = 0x0000000000001011ull;
-    cpu->isar.id_aa64pfr0  = 0x1100000010111112ull; /* GIC filled in later */
-    cpu->isar.id_aa64pfr1  = 0x0000000000000020ull;
+    SET_IDREG(isar, ID_AA64PFR0, 0x1100000010111112ull); /* GIC filled in later */
+    SET_IDREG(isar, ID_AA64PFR1, 0x0000000000000020ull);
     cpu->id_afr0       = 0x00000000;
     cpu->isar.id_dfr0  = 0x04010088;
     cpu->isar.id_isar0 = 0x02101110;
@@ -688,8 +685,8 @@ static void aarch64_neoverse_v1_initfn(Object *obj)
     cpu->isar.id_aa64mmfr0 = 0x0000000000101125ull;
     cpu->isar.id_aa64mmfr1 = 0x0000000010212122ull;
     cpu->isar.id_aa64mmfr2 = 0x0220011102101011ull;
-    cpu->isar.id_aa64pfr0  = 0x1101110120111112ull; /* GIC filled in later */
-    cpu->isar.id_aa64pfr1  = 0x0000000000000020ull;
+    SET_IDREG(isar, ID_AA64PFR0, 0x1101110120111112ull); /* GIC filled in later */
+    SET_IDREG(isar, ID_AA64PFR1, 0x0000000000000020ull);
     cpu->id_afr0       = 0x00000000;
     cpu->isar.id_dfr0  = 0x15011099;
     cpu->isar.id_isar0 = 0x02101110;
@@ -925,8 +922,8 @@ static void aarch64_a710_initfn(Object *obj)
     cpu->isar.mvfr1    = 0x13211111;
     cpu->isar.mvfr2    = 0x00000043;
     cpu->isar.id_pfr2  = 0x00000011;
-    cpu->isar.id_aa64pfr0  = 0x1201111120111112ull; /* GIC filled in later */
-    cpu->isar.id_aa64pfr1  = 0x0000000000000221ull;
+    SET_IDREG(isar, ID_AA64PFR0, 0x1201111120111112ull); /* GIC filled in later */
+    SET_IDREG(isar, ID_AA64PFR1, 0x0000000000000221ull);
     SET_IDREG(isar, ID_AA64ZFR0, 0x0000110100110021ull); /* with Crypto */
     cpu->isar.id_aa64dfr0  = 0x000011f010305619ull;
     cpu->isar.id_aa64dfr1  = 0;
@@ -1027,8 +1024,8 @@ static void aarch64_neoverse_n2_initfn(Object *obj)
     cpu->isar.mvfr1    = 0x13211111;
     cpu->isar.mvfr2    = 0x00000043;
     cpu->isar.id_pfr2  = 0x00000011;
-    cpu->isar.id_aa64pfr0  = 0x1201111120111112ull; /* GIC filled in later */
-    cpu->isar.id_aa64pfr1  = 0x0000000000000221ull;
+    SET_IDREG(isar, ID_AA64PFR0, 0x1201111120111112ull); /* GIC filled in later */
+    SET_IDREG(isar, ID_AA64PFR1, 0x0000000000000221ull);
     SET_IDREG(isar, ID_AA64ZFR0, 0x0000110100110021ull); /* with Crypto */
     cpu->isar.id_aa64dfr0  = 0x000011f210305619ull;
     cpu->isar.id_aa64dfr1  = 0;
@@ -1183,7 +1180,7 @@ void aarch64_max_tcg_initfn(Object *obj)
     t = FIELD_DP64(t, ID_AA64ISAR2, WFXT, 2);     /* FEAT_WFxT */
     SET_IDREG(isar, ID_AA64ISAR2, t);
 
-    t = cpu->isar.id_aa64pfr0;
+    t = GET_IDREG(isar, ID_AA64PFR0);
     t = FIELD_DP64(t, ID_AA64PFR0, FP, 1);        /* FEAT_FP16 */
     t = FIELD_DP64(t, ID_AA64PFR0, ADVSIMD, 1);   /* FEAT_FP16 */
     t = FIELD_DP64(t, ID_AA64PFR0, RAS, 2);       /* FEAT_RASv1p1 + FEAT_DoubleFault */
@@ -1192,9 +1189,9 @@ void aarch64_max_tcg_initfn(Object *obj)
     t = FIELD_DP64(t, ID_AA64PFR0, DIT, 1);       /* FEAT_DIT */
     t = FIELD_DP64(t, ID_AA64PFR0, CSV2, 3);      /* FEAT_CSV2_3 */
     t = FIELD_DP64(t, ID_AA64PFR0, CSV3, 1);      /* FEAT_CSV3 */
-    cpu->isar.id_aa64pfr0 = t;
+    SET_IDREG(isar, ID_AA64PFR0, t);
 
-    t = cpu->isar.id_aa64pfr1;
+    t = GET_IDREG(isar, ID_AA64PFR1);
     t = FIELD_DP64(t, ID_AA64PFR1, BT, 1);        /* FEAT_BTI */
     t = FIELD_DP64(t, ID_AA64PFR1, SSBS, 2);      /* FEAT_SSBS2 */
     /*
@@ -1207,7 +1204,7 @@ void aarch64_max_tcg_initfn(Object *obj)
     t = FIELD_DP64(t, ID_AA64PFR1, SME, 1);       /* FEAT_SME */
     t = FIELD_DP64(t, ID_AA64PFR1, CSV2_FRAC, 0); /* FEAT_CSV2_3 */
     t = FIELD_DP64(t, ID_AA64PFR1, NMI, 1);       /* FEAT_NMI */
-    cpu->isar.id_aa64pfr1 = t;
+    SET_IDREG(isar, ID_AA64PFR1, t);
 
     t = cpu->isar.id_aa64mmfr0;
     t = FIELD_DP64(t, ID_AA64MMFR0, PARANGE, 6); /* FEAT_LPA: 52 bits */

From f1fd81291c91b6d6954ad67729a3061ec84e643e Mon Sep 17 00:00:00 2001
From: Eric Auger <eric.auger@redhat.com>
Date: Tue, 1 Jul 2025 15:08:27 +0100
Subject: [PATCH 1731/2760] arm/cpu: Store aa64mmfr0-3 into the idregs array

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Sebastian Ott <sebott@redhat.com>
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Cornelia Huck <cohuck@redhat.com>
Message-id: 20250617153931.1330449-6-cohuck@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu-features.h | 74 +++++++++++++++++++--------------------
 target/arm/cpu.h          |  4 ---
 target/arm/cpu64.c        |  8 ++---
 target/arm/helper.c       |  8 ++---
 target/arm/hvf/hvf.c      | 21 ++++++-----
 target/arm/kvm.c          | 12 +++----
 target/arm/ptw.c          |  6 ++--
 target/arm/tcg/cpu64.c    | 64 ++++++++++++++++-----------------
 8 files changed, 95 insertions(+), 102 deletions(-)

diff --git a/target/arm/cpu-features.h b/target/arm/cpu-features.h
index 3adea85b79..89c9278639 100644
--- a/target/arm/cpu-features.h
+++ b/target/arm/cpu-features.h
@@ -711,192 +711,192 @@ static inline bool isar_feature_aa64_nmi(const ARMISARegisters *id)
 
 static inline bool isar_feature_aa64_tgran4_lpa2(const ARMISARegisters *id)
 {
-    return FIELD_SEX64(id->id_aa64mmfr0, ID_AA64MMFR0, TGRAN4) >= 1;
+    return FIELD_SEX64_IDREG(id, ID_AA64MMFR0, TGRAN4) >= 1;
 }
 
 static inline bool isar_feature_aa64_tgran4_2_lpa2(const ARMISARegisters *id)
 {
-    unsigned t = FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, TGRAN4_2);
+    unsigned t = FIELD_EX64_IDREG(id, ID_AA64MMFR0, TGRAN4_2);
     return t >= 3 || (t == 0 && isar_feature_aa64_tgran4_lpa2(id));
 }
 
 static inline bool isar_feature_aa64_tgran16_lpa2(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, TGRAN16) >= 2;
+    return FIELD_EX64_IDREG(id, ID_AA64MMFR0, TGRAN16) >= 2;
 }
 
 static inline bool isar_feature_aa64_tgran16_2_lpa2(const ARMISARegisters *id)
 {
-    unsigned t = FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, TGRAN16_2);
+    unsigned t = FIELD_EX64_IDREG(id, ID_AA64MMFR0, TGRAN16_2);
     return t >= 3 || (t == 0 && isar_feature_aa64_tgran16_lpa2(id));
 }
 
 static inline bool isar_feature_aa64_tgran4(const ARMISARegisters *id)
 {
-    return FIELD_SEX64(id->id_aa64mmfr0, ID_AA64MMFR0, TGRAN4) >= 0;
+    return FIELD_SEX64_IDREG(id, ID_AA64MMFR0, TGRAN4) >= 0;
 }
 
 static inline bool isar_feature_aa64_tgran16(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, TGRAN16) >= 1;
+    return FIELD_EX64_IDREG(id, ID_AA64MMFR0, TGRAN16) >= 1;
 }
 
 static inline bool isar_feature_aa64_tgran64(const ARMISARegisters *id)
 {
-    return FIELD_SEX64(id->id_aa64mmfr0, ID_AA64MMFR0, TGRAN64) >= 0;
+    return FIELD_SEX64_IDREG(id, ID_AA64MMFR0, TGRAN64) >= 0;
 }
 
 static inline bool isar_feature_aa64_tgran4_2(const ARMISARegisters *id)
 {
-    unsigned t = FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, TGRAN4_2);
+    unsigned t = FIELD_EX64_IDREG(id, ID_AA64MMFR0, TGRAN4_2);
     return t >= 2 || (t == 0 && isar_feature_aa64_tgran4(id));
 }
 
 static inline bool isar_feature_aa64_tgran16_2(const ARMISARegisters *id)
 {
-    unsigned t = FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, TGRAN16_2);
+    unsigned t = FIELD_EX64_IDREG(id, ID_AA64MMFR0, TGRAN16_2);
     return t >= 2 || (t == 0 && isar_feature_aa64_tgran16(id));
 }
 
 static inline bool isar_feature_aa64_tgran64_2(const ARMISARegisters *id)
 {
-    unsigned t = FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, TGRAN64_2);
+    unsigned t = FIELD_EX64_IDREG(id, ID_AA64MMFR0, TGRAN64_2);
     return t >= 2 || (t == 0 && isar_feature_aa64_tgran64(id));
 }
 
 static inline bool isar_feature_aa64_fgt(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, FGT) != 0;
+    return FIELD_EX64_IDREG(id, ID_AA64MMFR0, FGT) != 0;
 }
 
 static inline bool isar_feature_aa64_ecv_traps(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, ECV) > 0;
+    return FIELD_EX64_IDREG(id, ID_AA64MMFR0, ECV) > 0;
 }
 
 static inline bool isar_feature_aa64_ecv(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, ECV) > 1;
+    return FIELD_EX64_IDREG(id, ID_AA64MMFR0, ECV) > 1;
 }
 
 static inline bool isar_feature_aa64_vh(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64mmfr1, ID_AA64MMFR1, VH) != 0;
+    return FIELD_EX64_IDREG(id, ID_AA64MMFR1, VH) != 0;
 }
 
 static inline bool isar_feature_aa64_lor(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64mmfr1, ID_AA64MMFR1, LO) != 0;
+    return FIELD_EX64_IDREG(id, ID_AA64MMFR1, LO) != 0;
 }
 
 static inline bool isar_feature_aa64_pan(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64mmfr1, ID_AA64MMFR1, PAN) != 0;
+    return FIELD_EX64_IDREG(id, ID_AA64MMFR1, PAN) != 0;
 }
 
 static inline bool isar_feature_aa64_ats1e1(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64mmfr1, ID_AA64MMFR1, PAN) >= 2;
+    return FIELD_EX64_IDREG(id, ID_AA64MMFR1, PAN) >= 2;
 }
 
 static inline bool isar_feature_aa64_pan3(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64mmfr1, ID_AA64MMFR1, PAN) >= 3;
+    return FIELD_EX64_IDREG(id, ID_AA64MMFR1, PAN) >= 3;
 }
 
 static inline bool isar_feature_aa64_hcx(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64mmfr1, ID_AA64MMFR1, HCX) != 0;
+    return FIELD_EX64_IDREG(id, ID_AA64MMFR1, HCX) != 0;
 }
 
 static inline bool isar_feature_aa64_afp(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64mmfr1, ID_AA64MMFR1, AFP) != 0;
+    return FIELD_EX64_IDREG(id, ID_AA64MMFR1, AFP) != 0;
 }
 
 static inline bool isar_feature_aa64_tidcp1(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64mmfr1, ID_AA64MMFR1, TIDCP1) != 0;
+    return FIELD_EX64_IDREG(id, ID_AA64MMFR1, TIDCP1) != 0;
 }
 
 static inline bool isar_feature_aa64_cmow(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64mmfr1, ID_AA64MMFR1, CMOW) != 0;
+    return FIELD_EX64_IDREG(id, ID_AA64MMFR1, CMOW) != 0;
 }
 
 static inline bool isar_feature_aa64_hafs(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64mmfr1, ID_AA64MMFR1, HAFDBS) != 0;
+    return FIELD_EX64_IDREG(id, ID_AA64MMFR1, HAFDBS) != 0;
 }
 
 static inline bool isar_feature_aa64_hdbs(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64mmfr1, ID_AA64MMFR1, HAFDBS) >= 2;
+    return FIELD_EX64_IDREG(id, ID_AA64MMFR1, HAFDBS) >= 2;
 }
 
 static inline bool isar_feature_aa64_tts2uxn(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64mmfr1, ID_AA64MMFR1, XNX) != 0;
+    return FIELD_EX64_IDREG(id, ID_AA64MMFR1, XNX) != 0;
 }
 
 static inline bool isar_feature_aa64_uao(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64mmfr2, ID_AA64MMFR2, UAO) != 0;
+    return FIELD_EX64_IDREG(id, ID_AA64MMFR2, UAO) != 0;
 }
 
 static inline bool isar_feature_aa64_st(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64mmfr2, ID_AA64MMFR2, ST) != 0;
+    return FIELD_EX64_IDREG(id, ID_AA64MMFR2, ST) != 0;
 }
 
 static inline bool isar_feature_aa64_lse2(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64mmfr2, ID_AA64MMFR2, AT) != 0;
+    return FIELD_EX64_IDREG(id, ID_AA64MMFR2, AT) != 0;
 }
 
 static inline bool isar_feature_aa64_fwb(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64mmfr2, ID_AA64MMFR2, FWB) != 0;
+    return FIELD_EX64_IDREG(id, ID_AA64MMFR2, FWB) != 0;
 }
 
 static inline bool isar_feature_aa64_ids(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64mmfr2, ID_AA64MMFR2, IDS) != 0;
+    return FIELD_EX64_IDREG(id, ID_AA64MMFR2, IDS) != 0;
 }
 
 static inline bool isar_feature_aa64_half_evt(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64mmfr2, ID_AA64MMFR2, EVT) >= 1;
+    return FIELD_EX64_IDREG(id, ID_AA64MMFR2, EVT) >= 1;
 }
 
 static inline bool isar_feature_aa64_evt(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64mmfr2, ID_AA64MMFR2, EVT) >= 2;
+    return FIELD_EX64_IDREG(id, ID_AA64MMFR2, EVT) >= 2;
 }
 
 static inline bool isar_feature_aa64_ccidx(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64mmfr2, ID_AA64MMFR2, CCIDX) != 0;
+    return FIELD_EX64_IDREG(id, ID_AA64MMFR2, CCIDX) != 0;
 }
 
 static inline bool isar_feature_aa64_lva(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64mmfr2, ID_AA64MMFR2, VARANGE) != 0;
+    return FIELD_EX64_IDREG(id, ID_AA64MMFR2, VARANGE) != 0;
 }
 
 static inline bool isar_feature_aa64_e0pd(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64mmfr2, ID_AA64MMFR2, E0PD) != 0;
+    return FIELD_EX64_IDREG(id, ID_AA64MMFR2, E0PD) != 0;
 }
 
 static inline bool isar_feature_aa64_nv(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64mmfr2, ID_AA64MMFR2, NV) != 0;
+    return FIELD_EX64_IDREG(id, ID_AA64MMFR2, NV) != 0;
 }
 
 static inline bool isar_feature_aa64_nv2(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64mmfr2, ID_AA64MMFR2, NV) >= 2;
+    return FIELD_EX64_IDREG(id, ID_AA64MMFR2, NV) >= 2;
 }
 
 static inline bool isar_feature_aa64_pmuv3p1(const ARMISARegisters *id)
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index 05157a49d7..df9b7cc8c8 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -1074,10 +1074,6 @@ struct ArchCPU {
         uint32_t dbgdidr;
         uint32_t dbgdevid;
         uint32_t dbgdevid1;
-        uint64_t id_aa64mmfr0;
-        uint64_t id_aa64mmfr1;
-        uint64_t id_aa64mmfr2;
-        uint64_t id_aa64mmfr3;
         uint64_t id_aa64dfr0;
         uint64_t id_aa64dfr1;
         uint64_t id_aa64smfr0;
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index 502aac9173..500f3646bf 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -623,12 +623,12 @@ void arm_cpu_lpa2_finalize(ARMCPU *cpu, Error **errp)
         return;
     }
 
-    t = cpu->isar.id_aa64mmfr0;
+    t = GET_IDREG(&cpu->isar, ID_AA64MMFR0);
     t = FIELD_DP64(t, ID_AA64MMFR0, TGRAN16, 2);   /* 16k pages w/ LPA2 */
     t = FIELD_DP64(t, ID_AA64MMFR0, TGRAN4, 1);    /*  4k pages w/ LPA2 */
     t = FIELD_DP64(t, ID_AA64MMFR0, TGRAN16_2, 3); /* 16k stage2 w/ LPA2 */
     t = FIELD_DP64(t, ID_AA64MMFR0, TGRAN4_2, 3);  /*  4k stage2 w/ LPA2 */
-    cpu->isar.id_aa64mmfr0 = t;
+    SET_IDREG(&cpu->isar, ID_AA64MMFR0, t);
 }
 
 static void aarch64_a57_initfn(Object *obj)
@@ -673,7 +673,7 @@ static void aarch64_a57_initfn(Object *obj)
     SET_IDREG(isar, ID_AA64PFR0, 0x00002222);
     cpu->isar.id_aa64dfr0 = 0x10305106;
     SET_IDREG(isar, ID_AA64ISAR0, 0x00011120);
-    cpu->isar.id_aa64mmfr0 = 0x00001124;
+    SET_IDREG(isar, ID_AA64MMFR0, 0x00001124);
     cpu->isar.dbgdidr = 0x3516d000;
     cpu->isar.dbgdevid = 0x01110f13;
     cpu->isar.dbgdevid1 = 0x2;
@@ -735,7 +735,7 @@ static void aarch64_a53_initfn(Object *obj)
     SET_IDREG(isar, ID_AA64PFR0, 0x00002222);
     cpu->isar.id_aa64dfr0 = 0x10305106;
     SET_IDREG(isar, ID_AA64ISAR0, 0x00011120);
-    cpu->isar.id_aa64mmfr0 = 0x00001122; /* 40 bit physical addr */
+    SET_IDREG(isar, ID_AA64MMFR0, 0x00001122); /* 40 bit physical addr */
     cpu->isar.dbgdidr = 0x3516d000;
     cpu->isar.dbgdevid = 0x00110f13;
     cpu->isar.dbgdevid1 = 0x1;
diff --git a/target/arm/helper.c b/target/arm/helper.c
index b221e8df6c..fe0bda749f 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -8043,22 +8043,22 @@ void register_cp_regs_for_features(ARMCPU *cpu)
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 0,
               .access = PL1_R, .type = ARM_CP_CONST,
               .accessfn = access_aa64_tid3,
-              .resetvalue = cpu->isar.id_aa64mmfr0 },
+              .resetvalue = GET_IDREG(isar, ID_AA64MMFR0)},
             { .name = "ID_AA64MMFR1_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 1,
               .access = PL1_R, .type = ARM_CP_CONST,
               .accessfn = access_aa64_tid3,
-              .resetvalue = cpu->isar.id_aa64mmfr1 },
+              .resetvalue = GET_IDREG(isar, ID_AA64MMFR1) },
             { .name = "ID_AA64MMFR2_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 2,
               .access = PL1_R, .type = ARM_CP_CONST,
               .accessfn = access_aa64_tid3,
-              .resetvalue = cpu->isar.id_aa64mmfr2 },
+              .resetvalue = GET_IDREG(isar, ID_AA64MMFR2) },
             { .name = "ID_AA64MMFR3_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 3,
               .access = PL1_R, .type = ARM_CP_CONST,
               .accessfn = access_aa64_tid3,
-              .resetvalue = cpu->isar.id_aa64mmfr3 },
+              .resetvalue = GET_IDREG(isar, ID_AA64MMFR3) },
             { .name = "ID_AA64MMFR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 4,
               .access = PL1_R, .type = ARM_CP_CONST,
diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index e1bfca5947..37a6303ec2 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -846,14 +846,17 @@ static uint64_t hvf_get_reg(CPUState *cpu, int rt)
     return val;
 }
 
-static void clamp_id_aa64mmfr0_parange_to_ipa_size(uint64_t *id_aa64mmfr0)
+static void clamp_id_aa64mmfr0_parange_to_ipa_size(ARMISARegisters *isar)
 {
     uint32_t ipa_size = chosen_ipa_bit_size ?
             chosen_ipa_bit_size : hvf_arm_get_max_ipa_bit_size();
+    uint64_t id_aa64mmfr0;
 
     /* Clamp down the PARange to the IPA size the kernel supports. */
     uint8_t index = round_down_to_parange_index(ipa_size);
-    *id_aa64mmfr0 = (*id_aa64mmfr0 & ~R_ID_AA64MMFR0_PARANGE_MASK) | index;
+    id_aa64mmfr0 = GET_IDREG(isar, ID_AA64MMFR0);
+    id_aa64mmfr0 = (id_aa64mmfr0 & ~R_ID_AA64MMFR0_PARANGE_MASK) | index;
+    SET_IDREG(isar, ID_AA64MMFR0, id_aa64mmfr0);
 }
 
 static bool hvf_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
@@ -870,9 +873,9 @@ static bool hvf_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
         { HV_SYS_REG_ID_AA64ISAR0_EL1, &host_isar.idregs[ID_AA64ISAR0_EL1_IDX] },
         { HV_SYS_REG_ID_AA64ISAR1_EL1, &host_isar.idregs[ID_AA64ISAR1_EL1_IDX] },
         /* Add ID_AA64ISAR2_EL1 here when HVF supports it */
-        { HV_SYS_REG_ID_AA64MMFR0_EL1, &host_isar.id_aa64mmfr0 },
-        { HV_SYS_REG_ID_AA64MMFR1_EL1, &host_isar.id_aa64mmfr1 },
-        { HV_SYS_REG_ID_AA64MMFR2_EL1, &host_isar.id_aa64mmfr2 },
+        { HV_SYS_REG_ID_AA64MMFR0_EL1, &host_isar.idregs[ID_AA64MMFR0_EL1_IDX] },
+        { HV_SYS_REG_ID_AA64MMFR1_EL1, &host_isar.idregs[ID_AA64MMFR1_EL1_IDX] },
+        { HV_SYS_REG_ID_AA64MMFR2_EL1, &host_isar.idregs[ID_AA64MMFR2_EL1_IDX] },
         /* Add ID_AA64MMFR3_EL1 here when HVF supports it */
     };
     hv_vcpu_t fd;
@@ -899,7 +902,7 @@ static bool hvf_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
     r |= hv_vcpu_get_sys_reg(fd, HV_SYS_REG_MIDR_EL1, &ahcf->midr);
     r |= hv_vcpu_destroy(fd);
 
-    clamp_id_aa64mmfr0_parange_to_ipa_size(&host_isar.id_aa64mmfr0);
+    clamp_id_aa64mmfr0_parange_to_ipa_size(&host_isar);
 
     /*
      * Disable SME, which is not properly handled by QEMU hvf yet.
@@ -1067,12 +1070,12 @@ int hvf_arch_init_vcpu(CPUState *cpu)
 
     /* We're limited to underlying hardware caps, override internal versions */
     ret = hv_vcpu_get_sys_reg(cpu->accel->fd, HV_SYS_REG_ID_AA64MMFR0_EL1,
-                              &arm_cpu->isar.id_aa64mmfr0);
+                              &arm_cpu->isar.idregs[ID_AA64MMFR0_EL1_IDX]);
     assert_hvf_ok(ret);
 
-    clamp_id_aa64mmfr0_parange_to_ipa_size(&arm_cpu->isar.id_aa64mmfr0);
+    clamp_id_aa64mmfr0_parange_to_ipa_size(&arm_cpu->isar);
     ret = hv_vcpu_set_sys_reg(cpu->accel->fd, HV_SYS_REG_ID_AA64MMFR0_EL1,
-                              arm_cpu->isar.id_aa64mmfr0);
+                              arm_cpu->isar.idregs[ID_AA64MMFR0_EL1_IDX]);
     assert_hvf_ok(ret);
 
     return 0;
diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index 1e19dba4cb..1dde96fbbd 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -323,14 +323,10 @@ static bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
         err |= get_host_cpu_reg(fd, ahcf, ID_AA64ISAR0_EL1_IDX);
         err |= get_host_cpu_reg(fd, ahcf, ID_AA64ISAR1_EL1_IDX);
         err |= get_host_cpu_reg(fd, ahcf, ID_AA64ISAR2_EL1_IDX);
-        err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64mmfr0,
-                              ARM64_SYS_REG(3, 0, 0, 7, 0));
-        err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64mmfr1,
-                              ARM64_SYS_REG(3, 0, 0, 7, 1));
-        err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64mmfr2,
-                              ARM64_SYS_REG(3, 0, 0, 7, 2));
-        err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64mmfr3,
-                              ARM64_SYS_REG(3, 0, 0, 7, 3));
+        err |= get_host_cpu_reg(fd, ahcf, ID_AA64MMFR0_EL1_IDX);
+        err |= get_host_cpu_reg(fd, ahcf, ID_AA64MMFR1_EL1_IDX);
+        err |= get_host_cpu_reg(fd, ahcf, ID_AA64MMFR2_EL1_IDX);
+        err |= get_host_cpu_reg(fd, ahcf, ID_AA64MMFR3_EL1_IDX);
 
         /*
          * Note that if AArch32 support is not present in the host,
diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index 44170d831c..561bf2678e 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -122,7 +122,7 @@ unsigned int arm_pamax(ARMCPU *cpu)
 {
     if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
         unsigned int parange =
-            FIELD_EX64(cpu->isar.id_aa64mmfr0, ID_AA64MMFR0, PARANGE);
+            FIELD_EX64_IDREG(&cpu->isar, ID_AA64MMFR0, PARANGE);
 
         /*
          * id_aa64mmfr0 is a read-only register so values outside of the
@@ -332,7 +332,7 @@ static bool granule_protection_check(CPUARMState *env, uint64_t paddress,
      * physical address size is invalid.
      */
     pps = FIELD_EX64(gpccr, GPCCR, PPS);
-    if (pps > FIELD_EX64(cpu->isar.id_aa64mmfr0, ID_AA64MMFR0, PARANGE)) {
+    if (pps > FIELD_EX64_IDREG(&cpu->isar, ID_AA64MMFR0, PARANGE)) {
         goto fault_walk;
     }
     pps = pamax_map[pps];
@@ -1703,7 +1703,7 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
          * ID_AA64MMFR0 is a read-only register so values outside of the
          * supported mappings can be considered an implementation error.
          */
-        ps = FIELD_EX64(cpu->isar.id_aa64mmfr0, ID_AA64MMFR0, PARANGE);
+        ps = FIELD_EX64_IDREG(&cpu->isar, ID_AA64MMFR0, PARANGE);
         ps = MIN(ps, param.ps);
         assert(ps < ARRAY_SIZE(pamax_map));
         outputsize = pamax_map[ps];
diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
index 7a730c7974..9efb7f0ce8 100644
--- a/target/arm/tcg/cpu64.c
+++ b/target/arm/tcg/cpu64.c
@@ -69,8 +69,8 @@ static void aarch64_a35_initfn(Object *obj)
     cpu->isar.id_aa64dfr1 = 0;
     SET_IDREG(isar, ID_AA64ISAR0, 0x00011120);
     SET_IDREG(isar, ID_AA64ISAR1, 0);
-    cpu->isar.id_aa64mmfr0 = 0x00101122;
-    cpu->isar.id_aa64mmfr1 = 0;
+    SET_IDREG(isar, ID_AA64MMFR0, 0x00101122);
+    SET_IDREG(isar, ID_AA64MMFR1, 0);
     cpu->clidr = 0x0a200023;
     cpu->dcz_blocksize = 4;
 
@@ -222,9 +222,9 @@ static void aarch64_a55_initfn(Object *obj)
     cpu->isar.id_aa64dfr0  = 0x0000000010305408ull;
     SET_IDREG(isar, ID_AA64ISAR0, 0x0000100010211120ull);
     SET_IDREG(isar, ID_AA64ISAR1, 0x0000000000100001ull);
-    cpu->isar.id_aa64mmfr0 = 0x0000000000101122ull;
-    cpu->isar.id_aa64mmfr1 = 0x0000000010212122ull;
-    cpu->isar.id_aa64mmfr2 = 0x0000000000001011ull;
+    SET_IDREG(isar, ID_AA64MMFR0, 0x0000000000101122ull);
+    SET_IDREG(isar, ID_AA64MMFR1, 0x0000000010212122ull);
+    SET_IDREG(isar, ID_AA64MMFR2, 0x0000000000001011ull);
     SET_IDREG(isar, ID_AA64PFR0, 0x0000000010112222ull);
     SET_IDREG(isar, ID_AA64PFR1, 0x0000000000000010ull);
     cpu->id_afr0       = 0x00000000;
@@ -312,7 +312,7 @@ static void aarch64_a72_initfn(Object *obj)
     SET_IDREG(isar, ID_AA64PFR0, 0x00002222);
     cpu->isar.id_aa64dfr0 = 0x10305106;
     SET_IDREG(isar, ID_AA64ISAR0, 0x00011120);
-    cpu->isar.id_aa64mmfr0 = 0x00001124;
+    SET_IDREG(isar, ID_AA64MMFR0, 0x00001124);
     cpu->isar.dbgdidr = 0x3516d000;
     cpu->isar.dbgdevid = 0x01110f13;
     cpu->isar.dbgdevid1 = 0x2;
@@ -355,9 +355,9 @@ static void aarch64_a76_initfn(Object *obj)
     cpu->isar.id_aa64dfr0  = 0x0000000010305408ull;
     SET_IDREG(isar, ID_AA64ISAR0, 0x0000100010211120ull);
     SET_IDREG(isar, ID_AA64ISAR1, 0x0000000000100001ull);
-    cpu->isar.id_aa64mmfr0 = 0x0000000000101122ull;
-    cpu->isar.id_aa64mmfr1 = 0x0000000010212122ull;
-    cpu->isar.id_aa64mmfr2 = 0x0000000000001011ull;
+    SET_IDREG(isar, ID_AA64MMFR0, 0x0000000000101122ull);
+    SET_IDREG(isar, ID_AA64MMFR1, 0x0000000010212122ull);
+    SET_IDREG(isar, ID_AA64MMFR2, 0x0000000000001011ull);
     SET_IDREG(isar, ID_AA64PFR0, 0x1100000010111112ull); /* GIC filled in later */
     SET_IDREG(isar, ID_AA64PFR1, 0x0000000000000010ull);
     cpu->id_afr0       = 0x00000000;
@@ -430,9 +430,9 @@ static void aarch64_a64fx_initfn(Object *obj)
     cpu->isar.id_aa64dfr1 = 0x0000000000000000;
     cpu->id_aa64afr0 = 0x0000000000000000;
     cpu->id_aa64afr1 = 0x0000000000000000;
-    cpu->isar.id_aa64mmfr0 = 0x0000000000001122;
-    cpu->isar.id_aa64mmfr1 = 0x0000000011212100;
-    cpu->isar.id_aa64mmfr2 = 0x0000000000001011;
+    SET_IDREG(isar, ID_AA64MMFR0, 0x0000000000001122);
+    SET_IDREG(isar, ID_AA64MMFR1, 0x0000000011212100);
+    SET_IDREG(isar, ID_AA64MMFR2, 0x0000000000001011);
     SET_IDREG(isar, ID_AA64ISAR0, 0x0000000010211120);
     SET_IDREG(isar, ID_AA64ISAR1, 0x0000000000010001);
     SET_IDREG(isar, ID_AA64ZFR0, 0x0000000000000000);
@@ -603,9 +603,9 @@ static void aarch64_neoverse_n1_initfn(Object *obj)
     cpu->isar.id_aa64dfr0  = 0x0000000110305408ull;
     SET_IDREG(isar, ID_AA64ISAR0, 0x0000100010211120ull);
     SET_IDREG(isar, ID_AA64ISAR1, 0x0000000000100001ull);
-    cpu->isar.id_aa64mmfr0 = 0x0000000000101125ull;
-    cpu->isar.id_aa64mmfr1 = 0x0000000010212122ull;
-    cpu->isar.id_aa64mmfr2 = 0x0000000000001011ull;
+    SET_IDREG(isar, ID_AA64MMFR0, 0x0000000000101125ull);
+    SET_IDREG(isar, ID_AA64MMFR1, 0x0000000010212122ull);
+    SET_IDREG(isar, ID_AA64MMFR2, 0x0000000000001011ull);
     SET_IDREG(isar, ID_AA64PFR0, 0x1100000010111112ull); /* GIC filled in later */
     SET_IDREG(isar, ID_AA64PFR1, 0x0000000000000020ull);
     cpu->id_afr0       = 0x00000000;
@@ -682,9 +682,9 @@ static void aarch64_neoverse_v1_initfn(Object *obj)
     cpu->isar.id_aa64dfr1 = 0x00000000;
     SET_IDREG(isar, ID_AA64ISAR0, 0x1011111110212120ull); /* with FEAT_RNG */
     SET_IDREG(isar, ID_AA64ISAR1, 0x0011000001211032ull);
-    cpu->isar.id_aa64mmfr0 = 0x0000000000101125ull;
-    cpu->isar.id_aa64mmfr1 = 0x0000000010212122ull;
-    cpu->isar.id_aa64mmfr2 = 0x0220011102101011ull;
+    SET_IDREG(isar, ID_AA64MMFR0, 0x0000000000101125ull);
+    SET_IDREG(isar, ID_AA64MMFR1, 0x0000000010212122ull),
+    SET_IDREG(isar, ID_AA64MMFR2, 0x0220011102101011ull),
     SET_IDREG(isar, ID_AA64PFR0, 0x1101110120111112ull); /* GIC filled in later */
     SET_IDREG(isar, ID_AA64PFR1, 0x0000000000000020ull);
     cpu->id_afr0       = 0x00000000;
@@ -931,9 +931,9 @@ static void aarch64_a710_initfn(Object *obj)
     cpu->id_aa64afr1       = 0;
     SET_IDREG(isar, ID_AA64ISAR0, 0x0221111110212120ull); /* with Crypto */
     SET_IDREG(isar, ID_AA64ISAR1, 0x0010111101211052ull);
-    cpu->isar.id_aa64mmfr0 = 0x0000022200101122ull;
-    cpu->isar.id_aa64mmfr1 = 0x0000000010212122ull;
-    cpu->isar.id_aa64mmfr2 = 0x1221011110101011ull;
+    SET_IDREG(isar, ID_AA64MMFR0, 0x0000022200101122ull);
+    SET_IDREG(isar, ID_AA64MMFR1, 0x0000000010212122ull);
+    SET_IDREG(isar, ID_AA64MMFR2, 0x1221011110101011ull);
     cpu->clidr             = 0x0000001482000023ull;
     cpu->gm_blocksize      = 4;
     cpu->ctr               = 0x000000049444c004ull;
@@ -1033,9 +1033,9 @@ static void aarch64_neoverse_n2_initfn(Object *obj)
     cpu->id_aa64afr1       = 0;
     SET_IDREG(isar, ID_AA64ISAR0, 0x1221111110212120ull); /* with Crypto and FEAT_RNG */
     SET_IDREG(isar, ID_AA64ISAR1, 0x0011111101211052ull);
-    cpu->isar.id_aa64mmfr0 = 0x0000022200101125ull;
-    cpu->isar.id_aa64mmfr1 = 0x0000000010212122ull;
-    cpu->isar.id_aa64mmfr2 = 0x1221011112101011ull;
+    SET_IDREG(isar, ID_AA64MMFR0, 0x0000022200101125ull);
+    SET_IDREG(isar, ID_AA64MMFR1, 0x0000000010212122ull);
+    SET_IDREG(isar, ID_AA64MMFR2, 0x1221011112101011ull);
     cpu->clidr             = 0x0000001482000023ull;
     cpu->gm_blocksize      = 4;
     cpu->ctr               = 0x00000004b444c004ull;
@@ -1206,7 +1206,7 @@ void aarch64_max_tcg_initfn(Object *obj)
     t = FIELD_DP64(t, ID_AA64PFR1, NMI, 1);       /* FEAT_NMI */
     SET_IDREG(isar, ID_AA64PFR1, t);
 
-    t = cpu->isar.id_aa64mmfr0;
+    t = GET_IDREG(isar, ID_AA64MMFR0);
     t = FIELD_DP64(t, ID_AA64MMFR0, PARANGE, 6); /* FEAT_LPA: 52 bits */
     t = FIELD_DP64(t, ID_AA64MMFR0, TGRAN16, 1);   /* 16k pages supported */
     t = FIELD_DP64(t, ID_AA64MMFR0, TGRAN16_2, 2); /* 16k stage2 supported */
@@ -1214,9 +1214,9 @@ void aarch64_max_tcg_initfn(Object *obj)
     t = FIELD_DP64(t, ID_AA64MMFR0, TGRAN4_2, 2);  /*  4k stage2 supported */
     t = FIELD_DP64(t, ID_AA64MMFR0, FGT, 1);       /* FEAT_FGT */
     t = FIELD_DP64(t, ID_AA64MMFR0, ECV, 2);       /* FEAT_ECV */
-    cpu->isar.id_aa64mmfr0 = t;
+    SET_IDREG(isar, ID_AA64MMFR0, t);
 
-    t = cpu->isar.id_aa64mmfr1;
+    t = GET_IDREG(isar, ID_AA64MMFR1);
     t = FIELD_DP64(t, ID_AA64MMFR1, HAFDBS, 2);   /* FEAT_HAFDBS */
     t = FIELD_DP64(t, ID_AA64MMFR1, VMIDBITS, 2); /* FEAT_VMID16 */
     t = FIELD_DP64(t, ID_AA64MMFR1, VH, 1);       /* FEAT_VHE */
@@ -1229,9 +1229,9 @@ void aarch64_max_tcg_initfn(Object *obj)
     t = FIELD_DP64(t, ID_AA64MMFR1, AFP, 1);      /* FEAT_AFP */
     t = FIELD_DP64(t, ID_AA64MMFR1, TIDCP1, 1);   /* FEAT_TIDCP1 */
     t = FIELD_DP64(t, ID_AA64MMFR1, CMOW, 1);     /* FEAT_CMOW */
-    cpu->isar.id_aa64mmfr1 = t;
+    SET_IDREG(isar, ID_AA64MMFR1, t);
 
-    t = cpu->isar.id_aa64mmfr2;
+    t = GET_IDREG(isar, ID_AA64MMFR2);
     t = FIELD_DP64(t, ID_AA64MMFR2, CNP, 1);      /* FEAT_TTCNP */
     t = FIELD_DP64(t, ID_AA64MMFR2, UAO, 1);      /* FEAT_UAO */
     t = FIELD_DP64(t, ID_AA64MMFR2, IESB, 1);     /* FEAT_IESB */
@@ -1245,11 +1245,9 @@ void aarch64_max_tcg_initfn(Object *obj)
     t = FIELD_DP64(t, ID_AA64MMFR2, BBM, 2);      /* FEAT_BBM at level 2 */
     t = FIELD_DP64(t, ID_AA64MMFR2, EVT, 2);      /* FEAT_EVT */
     t = FIELD_DP64(t, ID_AA64MMFR2, E0PD, 1);     /* FEAT_E0PD */
-    cpu->isar.id_aa64mmfr2 = t;
+    SET_IDREG(isar, ID_AA64MMFR2, t);
 
-    t = cpu->isar.id_aa64mmfr3;
-    t = FIELD_DP64(t, ID_AA64MMFR3, SPEC_FPACC, 1); /* FEAT_FPACC_SPEC */
-    cpu->isar.id_aa64mmfr3 = t;
+    FIELD_DP64_IDREG(isar, ID_AA64MMFR3, SPEC_FPACC, 1); /* FEAT_FPACC_SPEC */
 
     t = GET_IDREG(isar, ID_AA64ZFR0);
     t = FIELD_DP64(t, ID_AA64ZFR0, SVEVER, 1);

From def3f1c1026af66d5672f10b3e6cbb87e4e20f73 Mon Sep 17 00:00:00 2001
From: Eric Auger <eric.auger@redhat.com>
Date: Tue, 1 Jul 2025 15:08:27 +0100
Subject: [PATCH 1732/2760] arm/cpu: Store aa64dfr0/1 into the idregs array

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Sebastian Ott <sebott@redhat.com>
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Cornelia Huck <cohuck@redhat.com>
Message-id: 20250617153931.1330449-7-cohuck@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu-features.h | 16 ++++++++--------
 target/arm/cpu.c          | 15 +++++----------
 target/arm/cpu.h          |  2 --
 target/arm/cpu64.c        |  4 ++--
 target/arm/helper.c       |  4 ++--
 target/arm/hvf/hvf.c      |  4 ++--
 target/arm/internals.h    |  6 +++---
 target/arm/kvm.c          | 12 +++++-------
 target/arm/tcg/cpu64.c    | 32 ++++++++++++++++----------------
 9 files changed, 43 insertions(+), 52 deletions(-)

diff --git a/target/arm/cpu-features.h b/target/arm/cpu-features.h
index 89c9278639..9517e8a74c 100644
--- a/target/arm/cpu-features.h
+++ b/target/arm/cpu-features.h
@@ -901,30 +901,30 @@ static inline bool isar_feature_aa64_nv2(const ARMISARegisters *id)
 
 static inline bool isar_feature_aa64_pmuv3p1(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64dfr0, ID_AA64DFR0, PMUVER) >= 4 &&
-        FIELD_EX64(id->id_aa64dfr0, ID_AA64DFR0, PMUVER) != 0xf;
+    return FIELD_EX64_IDREG(id, ID_AA64DFR0, PMUVER) >= 4 &&
+        FIELD_EX64_IDREG(id, ID_AA64DFR0, PMUVER) != 0xf;
 }
 
 static inline bool isar_feature_aa64_pmuv3p4(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64dfr0, ID_AA64DFR0, PMUVER) >= 5 &&
-        FIELD_EX64(id->id_aa64dfr0, ID_AA64DFR0, PMUVER) != 0xf;
+    return FIELD_EX64_IDREG(id, ID_AA64DFR0, PMUVER) >= 5 &&
+        FIELD_EX64_IDREG(id, ID_AA64DFR0, PMUVER) != 0xf;
 }
 
 static inline bool isar_feature_aa64_pmuv3p5(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64dfr0, ID_AA64DFR0, PMUVER) >= 6 &&
-        FIELD_EX64(id->id_aa64dfr0, ID_AA64DFR0, PMUVER) != 0xf;
+    return FIELD_EX64_IDREG(id, ID_AA64DFR0, PMUVER) >= 6 &&
+        FIELD_EX64_IDREG(id, ID_AA64DFR0, PMUVER) != 0xf;
 }
 
 static inline bool isar_feature_aa64_debugv8p2(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64dfr0, ID_AA64DFR0, DEBUGVER) >= 8;
+    return FIELD_EX64_IDREG(id, ID_AA64DFR0, DEBUGVER) >= 8;
 }
 
 static inline bool isar_feature_aa64_doublelock(const ARMISARegisters *id)
 {
-    return FIELD_SEX64(id->id_aa64dfr0, ID_AA64DFR0, DOUBLELOCK) >= 0;
+    return FIELD_SEX64_IDREG(id, ID_AA64DFR0, DOUBLELOCK) >= 0;
 }
 
 static inline bool isar_feature_aa64_sve2(const ARMISARegisters *id)
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index d39e8dc956..400bee8494 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -2347,8 +2347,7 @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
                 cpu);
 #endif
     } else {
-        cpu->isar.id_aa64dfr0 =
-            FIELD_DP64(cpu->isar.id_aa64dfr0, ID_AA64DFR0, PMUVER, 0);
+        FIELD_DP64_IDREG(isar, ID_AA64DFR0, PMUVER, 0);
         cpu->isar.id_dfr0 = FIELD_DP32(cpu->isar.id_dfr0, ID_DFR0, PERFMON, 0);
         cpu->pmceid0 = 0;
         cpu->pmceid1 = 0;
@@ -2408,19 +2407,15 @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
          * try to access the non-existent system registers for them.
          */
         /* FEAT_SPE (Statistical Profiling Extension) */
-        cpu->isar.id_aa64dfr0 =
-            FIELD_DP64(cpu->isar.id_aa64dfr0, ID_AA64DFR0, PMSVER, 0);
+        FIELD_DP64_IDREG(isar, ID_AA64DFR0, PMSVER, 0);
         /* FEAT_TRBE (Trace Buffer Extension) */
-        cpu->isar.id_aa64dfr0 =
-            FIELD_DP64(cpu->isar.id_aa64dfr0, ID_AA64DFR0, TRACEBUFFER, 0);
+        FIELD_DP64_IDREG(isar, ID_AA64DFR0, TRACEBUFFER, 0);
         /* FEAT_TRF (Self-hosted Trace Extension) */
-        cpu->isar.id_aa64dfr0 =
-            FIELD_DP64(cpu->isar.id_aa64dfr0, ID_AA64DFR0, TRACEFILT, 0);
+        FIELD_DP64_IDREG(isar, ID_AA64DFR0, TRACEFILT, 0);
         cpu->isar.id_dfr0 =
             FIELD_DP32(cpu->isar.id_dfr0, ID_DFR0, TRACEFILT, 0);
         /* Trace Macrocell system register access */
-        cpu->isar.id_aa64dfr0 =
-            FIELD_DP64(cpu->isar.id_aa64dfr0, ID_AA64DFR0, TRACEVER, 0);
+        FIELD_DP64_IDREG(isar, ID_AA64DFR0, TRACEVER, 0);
         cpu->isar.id_dfr0 =
             FIELD_DP32(cpu->isar.id_dfr0, ID_DFR0, COPTRC, 0);
         /* Memory mapped trace */
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index df9b7cc8c8..c7935377c6 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -1074,8 +1074,6 @@ struct ArchCPU {
         uint32_t dbgdidr;
         uint32_t dbgdevid;
         uint32_t dbgdevid1;
-        uint64_t id_aa64dfr0;
-        uint64_t id_aa64dfr1;
         uint64_t id_aa64smfr0;
         uint64_t reset_pmcr_el0;
         uint64_t idregs[NUM_ID_IDX];
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index 500f3646bf..a215ba8b47 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -671,7 +671,7 @@ static void aarch64_a57_initfn(Object *obj)
     cpu->isar.id_isar5 = 0x00011121;
     cpu->isar.id_isar6 = 0;
     SET_IDREG(isar, ID_AA64PFR0, 0x00002222);
-    cpu->isar.id_aa64dfr0 = 0x10305106;
+    SET_IDREG(isar, ID_AA64DFR0, 0x10305106);
     SET_IDREG(isar, ID_AA64ISAR0, 0x00011120);
     SET_IDREG(isar, ID_AA64MMFR0, 0x00001124);
     cpu->isar.dbgdidr = 0x3516d000;
@@ -733,7 +733,7 @@ static void aarch64_a53_initfn(Object *obj)
     cpu->isar.id_isar5 = 0x00011121;
     cpu->isar.id_isar6 = 0;
     SET_IDREG(isar, ID_AA64PFR0, 0x00002222);
-    cpu->isar.id_aa64dfr0 = 0x10305106;
+    SET_IDREG(isar, ID_AA64DFR0, 0x10305106);
     SET_IDREG(isar, ID_AA64ISAR0, 0x00011120);
     SET_IDREG(isar, ID_AA64MMFR0, 0x00001122); /* 40 bit physical addr */
     cpu->isar.dbgdidr = 0x3516d000;
diff --git a/target/arm/helper.c b/target/arm/helper.c
index fe0bda749f..2ac132c1db 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -7963,12 +7963,12 @@ void register_cp_regs_for_features(ARMCPU *cpu)
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 0,
               .access = PL1_R, .type = ARM_CP_CONST,
               .accessfn = access_aa64_tid3,
-              .resetvalue = cpu->isar.id_aa64dfr0 },
+              .resetvalue = GET_IDREG(isar, ID_AA64DFR0) },
             { .name = "ID_AA64DFR1_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 1,
               .access = PL1_R, .type = ARM_CP_CONST,
               .accessfn = access_aa64_tid3,
-              .resetvalue = cpu->isar.id_aa64dfr1 },
+              .resetvalue = GET_IDREG(isar, ID_AA64DFR1) },
             { .name = "ID_AA64DFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 2,
               .access = PL1_R, .type = ARM_CP_CONST,
diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index 37a6303ec2..5c95ccc5b8 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -868,8 +868,8 @@ static bool hvf_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
     } regs[] = {
         { HV_SYS_REG_ID_AA64PFR0_EL1, &host_isar.idregs[ID_AA64PFR0_EL1_IDX] },
         { HV_SYS_REG_ID_AA64PFR1_EL1, &host_isar.idregs[ID_AA64PFR1_EL1_IDX] },
-        { HV_SYS_REG_ID_AA64DFR0_EL1, &host_isar.id_aa64dfr0 },
-        { HV_SYS_REG_ID_AA64DFR1_EL1, &host_isar.id_aa64dfr1 },
+        { HV_SYS_REG_ID_AA64DFR0_EL1, &host_isar.idregs[ID_AA64DFR0_EL1_IDX] },
+        { HV_SYS_REG_ID_AA64DFR1_EL1, &host_isar.idregs[ID_AA64DFR1_EL1_IDX] },
         { HV_SYS_REG_ID_AA64ISAR0_EL1, &host_isar.idregs[ID_AA64ISAR0_EL1_IDX] },
         { HV_SYS_REG_ID_AA64ISAR1_EL1, &host_isar.idregs[ID_AA64ISAR1_EL1_IDX] },
         /* Add ID_AA64ISAR2_EL1 here when HVF supports it */
diff --git a/target/arm/internals.h b/target/arm/internals.h
index 3360de9150..6216f68c94 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -1175,7 +1175,7 @@ static inline bool regime_using_lpae_format(CPUARMState *env, ARMMMUIdx mmu_idx)
 static inline int arm_num_brps(ARMCPU *cpu)
 {
     if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
-        return FIELD_EX64(cpu->isar.id_aa64dfr0, ID_AA64DFR0, BRPS) + 1;
+        return FIELD_EX64_IDREG(&cpu->isar, ID_AA64DFR0, BRPS) + 1;
     } else {
         return FIELD_EX32(cpu->isar.dbgdidr, DBGDIDR, BRPS) + 1;
     }
@@ -1189,7 +1189,7 @@ static inline int arm_num_brps(ARMCPU *cpu)
 static inline int arm_num_wrps(ARMCPU *cpu)
 {
     if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
-        return FIELD_EX64(cpu->isar.id_aa64dfr0, ID_AA64DFR0, WRPS) + 1;
+        return FIELD_EX64_IDREG(&cpu->isar, ID_AA64DFR0, WRPS) + 1;
     } else {
         return FIELD_EX32(cpu->isar.dbgdidr, DBGDIDR, WRPS) + 1;
     }
@@ -1203,7 +1203,7 @@ static inline int arm_num_wrps(ARMCPU *cpu)
 static inline int arm_num_ctx_cmps(ARMCPU *cpu)
 {
     if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
-        return FIELD_EX64(cpu->isar.id_aa64dfr0, ID_AA64DFR0, CTX_CMPS) + 1;
+        return FIELD_EX64_IDREG(&cpu->isar, ID_AA64DFR0, CTX_CMPS) + 1;
     } else {
         return FIELD_EX32(cpu->isar.dbgdidr, DBGDIDR, CTX_CMPS) + 1;
     }
diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index 1dde96fbbd..479e5860e0 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -316,10 +316,8 @@ static bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
         err |= get_host_cpu_reg(fd, ahcf, ID_AA64PFR1_EL1_IDX);
         err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64smfr0,
                               ARM64_SYS_REG(3, 0, 0, 4, 5));
-        err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64dfr0,
-                              ARM64_SYS_REG(3, 0, 0, 5, 0));
-        err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64dfr1,
-                              ARM64_SYS_REG(3, 0, 0, 5, 1));
+        err |= get_host_cpu_reg(fd, ahcf, ID_AA64DFR0_EL1_IDX);
+        err |= get_host_cpu_reg(fd, ahcf, ID_AA64DFR1_EL1_IDX);
         err |= get_host_cpu_reg(fd, ahcf, ID_AA64ISAR0_EL1_IDX);
         err |= get_host_cpu_reg(fd, ahcf, ID_AA64ISAR1_EL1_IDX);
         err |= get_host_cpu_reg(fd, ahcf, ID_AA64ISAR2_EL1_IDX);
@@ -390,10 +388,10 @@ static bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
          * We only do this if the CPU supports AArch32 at EL1.
          */
         if (FIELD_EX32_IDREG(&ahcf->isar, ID_AA64PFR0, EL1) >= 2) {
-            int wrps = FIELD_EX64(ahcf->isar.id_aa64dfr0, ID_AA64DFR0, WRPS);
-            int brps = FIELD_EX64(ahcf->isar.id_aa64dfr0, ID_AA64DFR0, BRPS);
+            int wrps = FIELD_EX64_IDREG(&ahcf->isar, ID_AA64DFR0, WRPS);
+            int brps = FIELD_EX64_IDREG(&ahcf->isar, ID_AA64DFR0, BRPS);
             int ctx_cmps =
-                FIELD_EX64(ahcf->isar.id_aa64dfr0, ID_AA64DFR0, CTX_CMPS);
+                FIELD_EX64_IDREG(&ahcf->isar, ID_AA64DFR0, CTX_CMPS);
             int version = 6; /* ARMv8 debug architecture */
             bool has_el3 =
                 !!FIELD_EX32_IDREG(&ahcf->isar, ID_AA64PFR0, EL3);
diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
index 9efb7f0ce8..7e18d31a25 100644
--- a/target/arm/tcg/cpu64.c
+++ b/target/arm/tcg/cpu64.c
@@ -65,8 +65,8 @@ static void aarch64_a35_initfn(Object *obj)
     cpu->isar.id_isar5 = 0x00011121;
     SET_IDREG(isar, ID_AA64PFR0, 0x00002222);
     SET_IDREG(isar, ID_AA64PFR1, 0);
-    cpu->isar.id_aa64dfr0 = 0x10305106;
-    cpu->isar.id_aa64dfr1 = 0;
+    SET_IDREG(isar, ID_AA64DFR0, 0x10305106);
+    SET_IDREG(isar, ID_AA64DFR1, 0);
     SET_IDREG(isar, ID_AA64ISAR0, 0x00011120);
     SET_IDREG(isar, ID_AA64ISAR1, 0);
     SET_IDREG(isar, ID_AA64MMFR0, 0x00101122);
@@ -219,7 +219,7 @@ static void aarch64_a55_initfn(Object *obj)
     cpu->clidr = 0x82000023;
     cpu->ctr = 0x84448004; /* L1Ip = VIPT */
     cpu->dcz_blocksize = 4; /* 64 bytes */
-    cpu->isar.id_aa64dfr0  = 0x0000000010305408ull;
+    SET_IDREG(isar, ID_AA64DFR0, 0x0000000010305408ull);
     SET_IDREG(isar, ID_AA64ISAR0, 0x0000100010211120ull);
     SET_IDREG(isar, ID_AA64ISAR1, 0x0000000000100001ull);
     SET_IDREG(isar, ID_AA64MMFR0, 0x0000000000101122ull);
@@ -310,7 +310,7 @@ static void aarch64_a72_initfn(Object *obj)
     cpu->isar.id_isar4 = 0x00011142;
     cpu->isar.id_isar5 = 0x00011121;
     SET_IDREG(isar, ID_AA64PFR0, 0x00002222);
-    cpu->isar.id_aa64dfr0 = 0x10305106;
+    SET_IDREG(isar, ID_AA64DFR0, 0x10305106);
     SET_IDREG(isar, ID_AA64ISAR0, 0x00011120);
     SET_IDREG(isar, ID_AA64MMFR0, 0x00001124);
     cpu->isar.dbgdidr = 0x3516d000;
@@ -352,7 +352,7 @@ static void aarch64_a76_initfn(Object *obj)
     cpu->clidr = 0x82000023;
     cpu->ctr = 0x8444C004;
     cpu->dcz_blocksize = 4;
-    cpu->isar.id_aa64dfr0  = 0x0000000010305408ull;
+    SET_IDREG(isar, ID_AA64DFR0, 0x0000000010305408ull),
     SET_IDREG(isar, ID_AA64ISAR0, 0x0000100010211120ull);
     SET_IDREG(isar, ID_AA64ISAR1, 0x0000000000100001ull);
     SET_IDREG(isar, ID_AA64MMFR0, 0x0000000000101122ull);
@@ -426,8 +426,8 @@ static void aarch64_a64fx_initfn(Object *obj)
     cpu->reset_sctlr = 0x30000180;
     SET_IDREG(isar, ID_AA64PFR0, 0x0000000101111111); /* No RAS Extensions */
     SET_IDREG(isar, ID_AA64PFR1, 0x0000000000000000);
-    cpu->isar.id_aa64dfr0 = 0x0000000010305408;
-    cpu->isar.id_aa64dfr1 = 0x0000000000000000;
+    SET_IDREG(isar, ID_AA64DFR0, 0x0000000010305408),
+    SET_IDREG(isar, ID_AA64DFR1, 0x0000000000000000),
     cpu->id_aa64afr0 = 0x0000000000000000;
     cpu->id_aa64afr1 = 0x0000000000000000;
     SET_IDREG(isar, ID_AA64MMFR0, 0x0000000000001122);
@@ -600,7 +600,7 @@ static void aarch64_neoverse_n1_initfn(Object *obj)
     cpu->clidr = 0x82000023;
     cpu->ctr = 0x8444c004;
     cpu->dcz_blocksize = 4;
-    cpu->isar.id_aa64dfr0  = 0x0000000110305408ull;
+    SET_IDREG(isar, ID_AA64DFR0, 0x0000000110305408ull);
     SET_IDREG(isar, ID_AA64ISAR0, 0x0000100010211120ull);
     SET_IDREG(isar, ID_AA64ISAR1, 0x0000000000100001ull);
     SET_IDREG(isar, ID_AA64MMFR0, 0x0000000000101125ull);
@@ -678,8 +678,8 @@ static void aarch64_neoverse_v1_initfn(Object *obj)
     cpu->dcz_blocksize = 4;
     cpu->id_aa64afr0 = 0x00000000;
     cpu->id_aa64afr1 = 0x00000000;
-    cpu->isar.id_aa64dfr0  = 0x000001f210305519ull;
-    cpu->isar.id_aa64dfr1 = 0x00000000;
+    SET_IDREG(isar, ID_AA64DFR0, 0x000001f210305519ull),
+    SET_IDREG(isar, ID_AA64DFR1, 0x00000000),
     SET_IDREG(isar, ID_AA64ISAR0, 0x1011111110212120ull); /* with FEAT_RNG */
     SET_IDREG(isar, ID_AA64ISAR1, 0x0011000001211032ull);
     SET_IDREG(isar, ID_AA64MMFR0, 0x0000000000101125ull);
@@ -925,8 +925,8 @@ static void aarch64_a710_initfn(Object *obj)
     SET_IDREG(isar, ID_AA64PFR0, 0x1201111120111112ull); /* GIC filled in later */
     SET_IDREG(isar, ID_AA64PFR1, 0x0000000000000221ull);
     SET_IDREG(isar, ID_AA64ZFR0, 0x0000110100110021ull); /* with Crypto */
-    cpu->isar.id_aa64dfr0  = 0x000011f010305619ull;
-    cpu->isar.id_aa64dfr1  = 0;
+    SET_IDREG(isar, ID_AA64DFR0, 0x000011f010305619ull);
+    SET_IDREG(isar, ID_AA64DFR1, 0);
     cpu->id_aa64afr0       = 0;
     cpu->id_aa64afr1       = 0;
     SET_IDREG(isar, ID_AA64ISAR0, 0x0221111110212120ull); /* with Crypto */
@@ -1027,8 +1027,8 @@ static void aarch64_neoverse_n2_initfn(Object *obj)
     SET_IDREG(isar, ID_AA64PFR0, 0x1201111120111112ull); /* GIC filled in later */
     SET_IDREG(isar, ID_AA64PFR1, 0x0000000000000221ull);
     SET_IDREG(isar, ID_AA64ZFR0, 0x0000110100110021ull); /* with Crypto */
-    cpu->isar.id_aa64dfr0  = 0x000011f210305619ull;
-    cpu->isar.id_aa64dfr1  = 0;
+    SET_IDREG(isar, ID_AA64DFR0, 0x000011f210305619ull);
+    SET_IDREG(isar, ID_AA64DFR1, 0);
     cpu->id_aa64afr0       = 0;
     cpu->id_aa64afr1       = 0;
     SET_IDREG(isar, ID_AA64ISAR0, 0x1221111110212120ull); /* with Crypto and FEAT_RNG */
@@ -1261,11 +1261,11 @@ void aarch64_max_tcg_initfn(Object *obj)
     t = FIELD_DP64(t, ID_AA64ZFR0, F64MM, 1);     /* FEAT_F64MM */
     SET_IDREG(isar, ID_AA64ZFR0, t);
 
-    t = cpu->isar.id_aa64dfr0;
+    t = GET_IDREG(isar, ID_AA64DFR0);
     t = FIELD_DP64(t, ID_AA64DFR0, DEBUGVER, 10); /* FEAT_Debugv8p8 */
     t = FIELD_DP64(t, ID_AA64DFR0, PMUVER, 6);    /* FEAT_PMUv3p5 */
     t = FIELD_DP64(t, ID_AA64DFR0, HPMN0, 1);     /* FEAT_HPMN0 */
-    cpu->isar.id_aa64dfr0 = t;
+    SET_IDREG(isar, ID_AA64DFR0, t);
 
     t = cpu->isar.id_aa64smfr0;
     t = FIELD_DP64(t, ID_AA64SMFR0, F32F32, 1);   /* FEAT_SME */

From 29279773649a4757b2d7d9eddf98685068e11154 Mon Sep 17 00:00:00 2001
From: Eric Auger <eric.auger@redhat.com>
Date: Tue, 1 Jul 2025 15:08:27 +0100
Subject: [PATCH 1733/2760] arm/cpu: Store aa64smfr0 into the idregs array

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Sebastian Ott <sebott@redhat.com>
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Cornelia Huck <cohuck@redhat.com>
Message-id: 20250617153931.1330449-8-cohuck@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu-features.h | 6 +++---
 target/arm/cpu.h          | 1 -
 target/arm/cpu64.c        | 7 ++-----
 target/arm/helper.c       | 2 +-
 target/arm/kvm.c          | 3 +--
 target/arm/tcg/cpu64.c    | 4 ++--
 6 files changed, 9 insertions(+), 14 deletions(-)

diff --git a/target/arm/cpu-features.h b/target/arm/cpu-features.h
index 9517e8a74c..051ed7b884 100644
--- a/target/arm/cpu-features.h
+++ b/target/arm/cpu-features.h
@@ -979,17 +979,17 @@ static inline bool isar_feature_aa64_sve_f64mm(const ARMISARegisters *id)
 
 static inline bool isar_feature_aa64_sme_f64f64(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64smfr0, ID_AA64SMFR0, F64F64);
+    return FIELD_EX64_IDREG(id, ID_AA64SMFR0, F64F64);
 }
 
 static inline bool isar_feature_aa64_sme_i16i64(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64smfr0, ID_AA64SMFR0, I16I64) == 0xf;
+    return FIELD_EX64_IDREG(id, ID_AA64SMFR0, I16I64) == 0xf;
 }
 
 static inline bool isar_feature_aa64_sme_fa64(const ARMISARegisters *id)
 {
-    return FIELD_EX64(id->id_aa64smfr0, ID_AA64SMFR0, FA64);
+    return FIELD_EX64_IDREG(id, ID_AA64SMFR0, FA64);
 }
 
 /*
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index c7935377c6..1083ae7623 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -1074,7 +1074,6 @@ struct ArchCPU {
         uint32_t dbgdidr;
         uint32_t dbgdevid;
         uint32_t dbgdevid1;
-        uint64_t id_aa64smfr0;
         uint64_t reset_pmcr_el0;
         uint64_t idregs[NUM_ID_IDX];
     } isar;
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index a215ba8b47..0f938155d2 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -328,7 +328,7 @@ void arm_cpu_sme_finalize(ARMCPU *cpu, Error **errp)
 
     if (vq_map == 0) {
         if (!cpu_isar_feature(aa64_sme, cpu)) {
-            cpu->isar.id_aa64smfr0 = 0;
+            SET_IDREG(&cpu->isar, ID_AA64SMFR0, 0);
             return;
         }
 
@@ -381,11 +381,8 @@ static bool cpu_arm_get_sme_fa64(Object *obj, Error **errp)
 static void cpu_arm_set_sme_fa64(Object *obj, bool value, Error **errp)
 {
     ARMCPU *cpu = ARM_CPU(obj);
-    uint64_t t;
 
-    t = cpu->isar.id_aa64smfr0;
-    t = FIELD_DP64(t, ID_AA64SMFR0, FA64, value);
-    cpu->isar.id_aa64smfr0 = t;
+    FIELD_DP64_IDREG(&cpu->isar, ID_AA64SMFR0, FA64, value);
 }
 
 #ifdef CONFIG_USER_ONLY
diff --git a/target/arm/helper.c b/target/arm/helper.c
index 2ac132c1db..39729d3a8d 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -7948,7 +7948,7 @@ void register_cp_regs_for_features(ARMCPU *cpu)
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 5,
               .access = PL1_R, .type = ARM_CP_CONST,
               .accessfn = access_aa64_tid3,
-              .resetvalue = cpu->isar.id_aa64smfr0 },
+              .resetvalue = GET_IDREG(isar, ID_AA64SMFR0)},
             { .name = "ID_AA64PFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 6,
               .access = PL1_R, .type = ARM_CP_CONST,
diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index 479e5860e0..8736855861 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -314,8 +314,7 @@ static bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
         err = 0;
     } else {
         err |= get_host_cpu_reg(fd, ahcf, ID_AA64PFR1_EL1_IDX);
-        err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64smfr0,
-                              ARM64_SYS_REG(3, 0, 0, 4, 5));
+        err |= get_host_cpu_reg(fd, ahcf, ID_AA64SMFR0_EL1_IDX);
         err |= get_host_cpu_reg(fd, ahcf, ID_AA64DFR0_EL1_IDX);
         err |= get_host_cpu_reg(fd, ahcf, ID_AA64DFR1_EL1_IDX);
         err |= get_host_cpu_reg(fd, ahcf, ID_AA64ISAR0_EL1_IDX);
diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
index 7e18d31a25..80a99ab025 100644
--- a/target/arm/tcg/cpu64.c
+++ b/target/arm/tcg/cpu64.c
@@ -1267,7 +1267,7 @@ void aarch64_max_tcg_initfn(Object *obj)
     t = FIELD_DP64(t, ID_AA64DFR0, HPMN0, 1);     /* FEAT_HPMN0 */
     SET_IDREG(isar, ID_AA64DFR0, t);
 
-    t = cpu->isar.id_aa64smfr0;
+    t = GET_IDREG(isar, ID_AA64SMFR0);
     t = FIELD_DP64(t, ID_AA64SMFR0, F32F32, 1);   /* FEAT_SME */
     t = FIELD_DP64(t, ID_AA64SMFR0, B16F32, 1);   /* FEAT_SME */
     t = FIELD_DP64(t, ID_AA64SMFR0, F16F32, 1);   /* FEAT_SME */
@@ -1275,7 +1275,7 @@ void aarch64_max_tcg_initfn(Object *obj)
     t = FIELD_DP64(t, ID_AA64SMFR0, F64F64, 1);   /* FEAT_SME_F64F64 */
     t = FIELD_DP64(t, ID_AA64SMFR0, I16I64, 0xf); /* FEAT_SME_I16I64 */
     t = FIELD_DP64(t, ID_AA64SMFR0, FA64, 1);     /* FEAT_SME_FA64 */
-    cpu->isar.id_aa64smfr0 = t;
+    SET_IDREG(isar, ID_AA64SMFR0, t);
 
     /* Replicate the same data to the 32-bit id registers.  */
     aa32_max_features(cpu);

From c0c2344c4354180edf2476ae5764548a36fa9b67 Mon Sep 17 00:00:00 2001
From: Eric Auger <eric.auger@redhat.com>
Date: Tue, 1 Jul 2025 15:08:28 +0100
Subject: [PATCH 1734/2760] arm/cpu: Store id_isar0-7 into the idregs array

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Sebastian Ott <sebott@redhat.com>
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Cornelia Huck <cohuck@redhat.com>
Message-id: 20250617153931.1330449-9-cohuck@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/intc/armv7m_nvic.c     |  12 ++--
 target/arm/cpu-features.h |  36 +++++-----
 target/arm/cpu.c          |  24 +++----
 target/arm/cpu.h          |   7 --
 target/arm/cpu64.c        |  28 ++++----
 target/arm/helper.c       |  14 ++--
 target/arm/kvm.c          |  21 ++----
 target/arm/tcg/cpu-v7m.c  |  90 +++++++++++++-----------
 target/arm/tcg/cpu32.c    | 144 +++++++++++++++++++++-----------------
 target/arm/tcg/cpu64.c    | 108 ++++++++++++++--------------
 10 files changed, 243 insertions(+), 241 deletions(-)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index 83ff74f899..fdb7f58e36 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -1303,32 +1303,32 @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
         if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
             goto bad_offset;
         }
-        return cpu->isar.id_isar0;
+        return GET_IDREG(&cpu->isar, ID_ISAR0);
     case 0xd64: /* ISAR1.  */
         if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
             goto bad_offset;
         }
-        return cpu->isar.id_isar1;
+        return GET_IDREG(&cpu->isar, ID_ISAR1);
     case 0xd68: /* ISAR2.  */
         if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
             goto bad_offset;
         }
-        return cpu->isar.id_isar2;
+        return GET_IDREG(&cpu->isar, ID_ISAR2);
     case 0xd6c: /* ISAR3.  */
         if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
             goto bad_offset;
         }
-        return cpu->isar.id_isar3;
+        return GET_IDREG(&cpu->isar, ID_ISAR3);
     case 0xd70: /* ISAR4.  */
         if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
             goto bad_offset;
         }
-        return cpu->isar.id_isar4;
+        return GET_IDREG(&cpu->isar, ID_ISAR4);
     case 0xd74: /* ISAR5.  */
         if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
             goto bad_offset;
         }
-        return cpu->isar.id_isar5;
+        return GET_IDREG(&cpu->isar, ID_ISAR5);
     case 0xd78: /* CLIDR */
         return cpu->clidr;
     case 0xd7c: /* CTR */
diff --git a/target/arm/cpu-features.h b/target/arm/cpu-features.h
index 051ed7b884..75a2cc4077 100644
--- a/target/arm/cpu-features.h
+++ b/target/arm/cpu-features.h
@@ -46,93 +46,93 @@
  */
 static inline bool isar_feature_aa32_thumb_div(const ARMISARegisters *id)
 {
-    return FIELD_EX32(id->id_isar0, ID_ISAR0, DIVIDE) != 0;
+    return FIELD_EX32_IDREG(id, ID_ISAR0, DIVIDE) != 0;
 }
 
 static inline bool isar_feature_aa32_arm_div(const ARMISARegisters *id)
 {
-    return FIELD_EX32(id->id_isar0, ID_ISAR0, DIVIDE) > 1;
+    return FIELD_EX32_IDREG(id, ID_ISAR0, DIVIDE) > 1;
 }
 
 static inline bool isar_feature_aa32_lob(const ARMISARegisters *id)
 {
     /* (M-profile) low-overhead loops and branch future */
-    return FIELD_EX32(id->id_isar0, ID_ISAR0, CMPBRANCH) >= 3;
+    return FIELD_EX32_IDREG(id, ID_ISAR0, CMPBRANCH) >= 3;
 }
 
 static inline bool isar_feature_aa32_jazelle(const ARMISARegisters *id)
 {
-    return FIELD_EX32(id->id_isar1, ID_ISAR1, JAZELLE) != 0;
+    return FIELD_EX32_IDREG(id, ID_ISAR1, JAZELLE) != 0;
 }
 
 static inline bool isar_feature_aa32_aes(const ARMISARegisters *id)
 {
-    return FIELD_EX32(id->id_isar5, ID_ISAR5, AES) != 0;
+    return FIELD_EX32_IDREG(id, ID_ISAR5, AES) != 0;
 }
 
 static inline bool isar_feature_aa32_pmull(const ARMISARegisters *id)
 {
-    return FIELD_EX32(id->id_isar5, ID_ISAR5, AES) > 1;
+    return FIELD_EX32_IDREG(id, ID_ISAR5, AES) > 1;
 }
 
 static inline bool isar_feature_aa32_sha1(const ARMISARegisters *id)
 {
-    return FIELD_EX32(id->id_isar5, ID_ISAR5, SHA1) != 0;
+    return FIELD_EX32_IDREG(id, ID_ISAR5, SHA1) != 0;
 }
 
 static inline bool isar_feature_aa32_sha2(const ARMISARegisters *id)
 {
-    return FIELD_EX32(id->id_isar5, ID_ISAR5, SHA2) != 0;
+    return FIELD_EX32_IDREG(id, ID_ISAR5, SHA2) != 0;
 }
 
 static inline bool isar_feature_aa32_crc32(const ARMISARegisters *id)
 {
-    return FIELD_EX32(id->id_isar5, ID_ISAR5, CRC32) != 0;
+    return FIELD_EX32_IDREG(id, ID_ISAR5, CRC32) != 0;
 }
 
 static inline bool isar_feature_aa32_rdm(const ARMISARegisters *id)
 {
-    return FIELD_EX32(id->id_isar5, ID_ISAR5, RDM) != 0;
+    return FIELD_EX32_IDREG(id, ID_ISAR5, RDM) != 0;
 }
 
 static inline bool isar_feature_aa32_vcma(const ARMISARegisters *id)
 {
-    return FIELD_EX32(id->id_isar5, ID_ISAR5, VCMA) != 0;
+    return FIELD_EX32_IDREG(id, ID_ISAR5, VCMA) != 0;
 }
 
 static inline bool isar_feature_aa32_jscvt(const ARMISARegisters *id)
 {
-    return FIELD_EX32(id->id_isar6, ID_ISAR6, JSCVT) != 0;
+    return FIELD_EX32_IDREG(id, ID_ISAR6, JSCVT) != 0;
 }
 
 static inline bool isar_feature_aa32_dp(const ARMISARegisters *id)
 {
-    return FIELD_EX32(id->id_isar6, ID_ISAR6, DP) != 0;
+    return FIELD_EX32_IDREG(id, ID_ISAR6, DP) != 0;
 }
 
 static inline bool isar_feature_aa32_fhm(const ARMISARegisters *id)
 {
-    return FIELD_EX32(id->id_isar6, ID_ISAR6, FHM) != 0;
+    return FIELD_EX32_IDREG(id, ID_ISAR6, FHM) != 0;
 }
 
 static inline bool isar_feature_aa32_sb(const ARMISARegisters *id)
 {
-    return FIELD_EX32(id->id_isar6, ID_ISAR6, SB) != 0;
+    return FIELD_EX32_IDREG(id, ID_ISAR6, SB) != 0;
 }
 
 static inline bool isar_feature_aa32_predinv(const ARMISARegisters *id)
 {
-    return FIELD_EX32(id->id_isar6, ID_ISAR6, SPECRES) != 0;
+    return FIELD_EX32_IDREG(id, ID_ISAR6, SPECRES) != 0;
 }
 
 static inline bool isar_feature_aa32_bf16(const ARMISARegisters *id)
 {
-    return FIELD_EX32(id->id_isar6, ID_ISAR6, BF16) != 0;
+    return FIELD_EX32_IDREG(id, ID_ISAR6, BF16) != 0;
 }
 
 static inline bool isar_feature_aa32_i8mm(const ARMISARegisters *id)
 {
-    return FIELD_EX32(id->id_isar6, ID_ISAR6, I8MM) != 0;
+    return FIELD_EX32_IDREG(id, ID_ISAR6, I8MM) != 0;
 }
 
 static inline bool isar_feature_aa32_ras(const ARMISARegisters *id)
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index 400bee8494..cf811e47d9 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -2126,10 +2126,10 @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
 
         FIELD_DP64_IDREG(isar, ID_AA64PFR0, FP, 0xf);
 
-        u = cpu->isar.id_isar6;
+        u = GET_IDREG(isar, ID_ISAR6);
         u = FIELD_DP32(u, ID_ISAR6, JSCVT, 0);
         u = FIELD_DP32(u, ID_ISAR6, BF16, 0);
-        cpu->isar.id_isar6 = u;
+        SET_IDREG(isar, ID_ISAR6, u);
 
         u = cpu->isar.mvfr0;
         u = FIELD_DP32(u, MVFR0, FPSP, 0);
@@ -2181,20 +2181,20 @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
 
         FIELD_DP64_IDREG(isar, ID_AA64PFR0, ADVSIMD, 0xf);
 
-        u = cpu->isar.id_isar5;
+        u = GET_IDREG(isar, ID_ISAR5);
         u = FIELD_DP32(u, ID_ISAR5, AES, 0);
         u = FIELD_DP32(u, ID_ISAR5, SHA1, 0);
         u = FIELD_DP32(u, ID_ISAR5, SHA2, 0);
         u = FIELD_DP32(u, ID_ISAR5, RDM, 0);
         u = FIELD_DP32(u, ID_ISAR5, VCMA, 0);
-        cpu->isar.id_isar5 = u;
+        SET_IDREG(isar, ID_ISAR5, u);
 
-        u = cpu->isar.id_isar6;
+        u = GET_IDREG(isar, ID_ISAR6);
         u = FIELD_DP32(u, ID_ISAR6, DP, 0);
         u = FIELD_DP32(u, ID_ISAR6, FHM, 0);
         u = FIELD_DP32(u, ID_ISAR6, BF16, 0);
         u = FIELD_DP32(u, ID_ISAR6, I8MM, 0);
-        cpu->isar.id_isar6 = u;
+        SET_IDREG(isar, ID_ISAR6, u);
 
         if (!arm_feature(env, ARM_FEATURE_M)) {
             u = cpu->isar.mvfr1;
@@ -2232,19 +2232,17 @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
 
         unset_feature(env, ARM_FEATURE_THUMB_DSP);
 
-        u = cpu->isar.id_isar1;
-        u = FIELD_DP32(u, ID_ISAR1, EXTEND, 1);
-        cpu->isar.id_isar1 = u;
+        FIELD_DP32_IDREG(isar, ID_ISAR1, EXTEND, 1);
 
-        u = cpu->isar.id_isar2;
+        u = GET_IDREG(isar, ID_ISAR2);
         u = FIELD_DP32(u, ID_ISAR2, MULTU, 1);
         u = FIELD_DP32(u, ID_ISAR2, MULTS, 1);
-        cpu->isar.id_isar2 = u;
+        SET_IDREG(isar, ID_ISAR2, u);
 
-        u = cpu->isar.id_isar3;
+        u = GET_IDREG(isar, ID_ISAR3);
         u = FIELD_DP32(u, ID_ISAR3, SIMD, 1);
         u = FIELD_DP32(u, ID_ISAR3, SATURATE, 0);
-        cpu->isar.id_isar3 = u;
+        SET_IDREG(isar, ID_ISAR3, u);
     }
 
 
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index 1083ae7623..353c18e679 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -1050,13 +1050,6 @@ struct ArchCPU {
      * field by reading the value from the KVM vCPU.
      */
     struct ARMISARegisters {
-        uint32_t id_isar0;
-        uint32_t id_isar1;
-        uint32_t id_isar2;
-        uint32_t id_isar3;
-        uint32_t id_isar4;
-        uint32_t id_isar5;
-        uint32_t id_isar6;
         uint32_t id_mmfr0;
         uint32_t id_mmfr1;
         uint32_t id_mmfr2;
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index 0f938155d2..6be62c0711 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -660,13 +660,13 @@ static void aarch64_a57_initfn(Object *obj)
     cpu->isar.id_mmfr1 = 0x40000000;
     cpu->isar.id_mmfr2 = 0x01260000;
     cpu->isar.id_mmfr3 = 0x02102211;
-    cpu->isar.id_isar0 = 0x02101110;
-    cpu->isar.id_isar1 = 0x13112111;
-    cpu->isar.id_isar2 = 0x21232042;
-    cpu->isar.id_isar3 = 0x01112131;
-    cpu->isar.id_isar4 = 0x00011142;
-    cpu->isar.id_isar5 = 0x00011121;
-    cpu->isar.id_isar6 = 0;
+    SET_IDREG(isar, ID_ISAR0, 0x02101110);
+    SET_IDREG(isar, ID_ISAR1, 0x13112111);
+    SET_IDREG(isar, ID_ISAR2, 0x21232042);
+    SET_IDREG(isar, ID_ISAR3, 0x01112131);
+    SET_IDREG(isar, ID_ISAR4, 0x00011142);
+    SET_IDREG(isar, ID_ISAR5, 0x00011121);
+    SET_IDREG(isar, ID_ISAR6, 0);
     SET_IDREG(isar, ID_AA64PFR0, 0x00002222);
     SET_IDREG(isar, ID_AA64DFR0, 0x10305106);
     SET_IDREG(isar, ID_AA64ISAR0, 0x00011120);
@@ -722,13 +722,13 @@ static void aarch64_a53_initfn(Object *obj)
     cpu->isar.id_mmfr1 = 0x40000000;
     cpu->isar.id_mmfr2 = 0x01260000;
     cpu->isar.id_mmfr3 = 0x02102211;
-    cpu->isar.id_isar0 = 0x02101110;
-    cpu->isar.id_isar1 = 0x13112111;
-    cpu->isar.id_isar2 = 0x21232042;
-    cpu->isar.id_isar3 = 0x01112131;
-    cpu->isar.id_isar4 = 0x00011142;
-    cpu->isar.id_isar5 = 0x00011121;
-    cpu->isar.id_isar6 = 0;
+    SET_IDREG(isar, ID_ISAR0, 0x02101110);
+    SET_IDREG(isar, ID_ISAR1, 0x13112111);
+    SET_IDREG(isar, ID_ISAR2, 0x21232042);
+    SET_IDREG(isar, ID_ISAR3, 0x01112131);
+    SET_IDREG(isar, ID_ISAR4, 0x00011142);
+    SET_IDREG(isar, ID_ISAR5, 0x00011121);
+    SET_IDREG(isar, ID_ISAR6, 0);
     SET_IDREG(isar, ID_AA64PFR0, 0x00002222);
     SET_IDREG(isar, ID_AA64DFR0, 0x10305106);
     SET_IDREG(isar, ID_AA64ISAR0, 0x00011120);
diff --git a/target/arm/helper.c b/target/arm/helper.c
index 39729d3a8d..7e0b3f164e 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -7830,32 +7830,32 @@ void register_cp_regs_for_features(ARMCPU *cpu)
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 0,
               .access = PL1_R, .type = ARM_CP_CONST,
               .accessfn = access_aa32_tid3,
-              .resetvalue = cpu->isar.id_isar0 },
+              .resetvalue = GET_IDREG(isar, ID_ISAR0)},
             { .name = "ID_ISAR1", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 1,
               .access = PL1_R, .type = ARM_CP_CONST,
               .accessfn = access_aa32_tid3,
-              .resetvalue = cpu->isar.id_isar1 },
+              .resetvalue = GET_IDREG(isar, ID_ISAR1)},
             { .name = "ID_ISAR2", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 2,
               .access = PL1_R, .type = ARM_CP_CONST,
               .accessfn = access_aa32_tid3,
-              .resetvalue = cpu->isar.id_isar2 },
+              .resetvalue = GET_IDREG(isar, ID_ISAR2)},
             { .name = "ID_ISAR3", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 3,
               .access = PL1_R, .type = ARM_CP_CONST,
               .accessfn = access_aa32_tid3,
-              .resetvalue = cpu->isar.id_isar3 },
+              .resetvalue = GET_IDREG(isar, ID_ISAR3) },
             { .name = "ID_ISAR4", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 4,
               .access = PL1_R, .type = ARM_CP_CONST,
               .accessfn = access_aa32_tid3,
-              .resetvalue = cpu->isar.id_isar4 },
+              .resetvalue = GET_IDREG(isar, ID_ISAR4) },
             { .name = "ID_ISAR5", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 5,
               .access = PL1_R, .type = ARM_CP_CONST,
               .accessfn = access_aa32_tid3,
-              .resetvalue = cpu->isar.id_isar5 },
+              .resetvalue = GET_IDREG(isar, ID_ISAR5) },
             { .name = "ID_MMFR4", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 6,
               .access = PL1_R, .type = ARM_CP_CONST,
@@ -7865,7 +7865,7 @@ void register_cp_regs_for_features(ARMCPU *cpu)
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 7,
               .access = PL1_R, .type = ARM_CP_CONST,
               .accessfn = access_aa32_tid3,
-              .resetvalue = cpu->isar.id_isar6 },
+              .resetvalue = GET_IDREG(isar, ID_ISAR6) },
         };
         define_arm_cp_regs(cpu, v6_idregs);
         define_arm_cp_regs(cpu, v6_cp_reginfo);
diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index 8736855861..eef9481737 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -346,22 +346,15 @@ static bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
                               ARM64_SYS_REG(3, 0, 0, 1, 6));
         err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_mmfr3,
                               ARM64_SYS_REG(3, 0, 0, 1, 7));
-        err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar0,
-                              ARM64_SYS_REG(3, 0, 0, 2, 0));
-        err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar1,
-                              ARM64_SYS_REG(3, 0, 0, 2, 1));
-        err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar2,
-                              ARM64_SYS_REG(3, 0, 0, 2, 2));
-        err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar3,
-                              ARM64_SYS_REG(3, 0, 0, 2, 3));
-        err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar4,
-                              ARM64_SYS_REG(3, 0, 0, 2, 4));
-        err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar5,
-                              ARM64_SYS_REG(3, 0, 0, 2, 5));
+        err |= get_host_cpu_reg(fd, ahcf, ID_ISAR0_EL1_IDX);
+        err |= get_host_cpu_reg(fd, ahcf, ID_ISAR1_EL1_IDX);
+        err |= get_host_cpu_reg(fd, ahcf, ID_ISAR2_EL1_IDX);
+        err |= get_host_cpu_reg(fd, ahcf, ID_ISAR3_EL1_IDX);
+        err |= get_host_cpu_reg(fd, ahcf, ID_ISAR4_EL1_IDX);
+        err |= get_host_cpu_reg(fd, ahcf, ID_ISAR5_EL1_IDX);
+        err |= get_host_cpu_reg(fd, ahcf, ID_ISAR6_EL1_IDX);
         err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_mmfr4,
                               ARM64_SYS_REG(3, 0, 0, 2, 6));
-        err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar6,
-                              ARM64_SYS_REG(3, 0, 0, 2, 7));
 
         err |= read_sys_reg32(fdarray[2], &ahcf->isar.mvfr0,
                               ARM64_SYS_REG(3, 0, 0, 3, 0));
diff --git a/target/arm/tcg/cpu-v7m.c b/target/arm/tcg/cpu-v7m.c
index 8e1a083b91..198c9f3e98 100644
--- a/target/arm/tcg/cpu-v7m.c
+++ b/target/arm/tcg/cpu-v7m.c
@@ -45,6 +45,7 @@ static bool arm_v7m_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
 static void cortex_m0_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
+    ARMISARegisters *isar = &cpu->isar;
     set_feature(&cpu->env, ARM_FEATURE_V6);
     set_feature(&cpu->env, ARM_FEATURE_M);
 
@@ -66,18 +67,19 @@ static void cortex_m0_initfn(Object *obj)
     cpu->isar.id_mmfr1 = 0x00000000;
     cpu->isar.id_mmfr2 = 0x00000000;
     cpu->isar.id_mmfr3 = 0x00000000;
-    cpu->isar.id_isar0 = 0x01141110;
-    cpu->isar.id_isar1 = 0x02111000;
-    cpu->isar.id_isar2 = 0x21112231;
-    cpu->isar.id_isar3 = 0x01111110;
-    cpu->isar.id_isar4 = 0x01310102;
-    cpu->isar.id_isar5 = 0x00000000;
-    cpu->isar.id_isar6 = 0x00000000;
+    SET_IDREG(isar, ID_ISAR0, 0x01141110);
+    SET_IDREG(isar, ID_ISAR1, 0x02111000);
+    SET_IDREG(isar, ID_ISAR2, 0x21112231);
+    SET_IDREG(isar, ID_ISAR3, 0x01111110);
+    SET_IDREG(isar, ID_ISAR4, 0x01310102);
+    SET_IDREG(isar, ID_ISAR5, 0x00000000);
+    SET_IDREG(isar, ID_ISAR6, 0x00000000);
 }
 
 static void cortex_m3_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
+    ARMISARegisters *isar = &cpu->isar;
     set_feature(&cpu->env, ARM_FEATURE_V7);
     set_feature(&cpu->env, ARM_FEATURE_M);
     set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
@@ -91,18 +93,19 @@ static void cortex_m3_initfn(Object *obj)
     cpu->isar.id_mmfr1 = 0x00000000;
     cpu->isar.id_mmfr2 = 0x00000000;
     cpu->isar.id_mmfr3 = 0x00000000;
-    cpu->isar.id_isar0 = 0x01141110;
-    cpu->isar.id_isar1 = 0x02111000;
-    cpu->isar.id_isar2 = 0x21112231;
-    cpu->isar.id_isar3 = 0x01111110;
-    cpu->isar.id_isar4 = 0x01310102;
-    cpu->isar.id_isar5 = 0x00000000;
-    cpu->isar.id_isar6 = 0x00000000;
+    SET_IDREG(isar, ID_ISAR0, 0x01141110);
+    SET_IDREG(isar, ID_ISAR1, 0x02111000);
+    SET_IDREG(isar, ID_ISAR2, 0x21112231);
+    SET_IDREG(isar, ID_ISAR3, 0x01111110);
+    SET_IDREG(isar, ID_ISAR4, 0x01310102);
+    SET_IDREG(isar, ID_ISAR5, 0x00000000);
+    SET_IDREG(isar, ID_ISAR6, 0x00000000);
 }
 
 static void cortex_m4_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
+    ARMISARegisters *isar = &cpu->isar;
 
     set_feature(&cpu->env, ARM_FEATURE_V7);
     set_feature(&cpu->env, ARM_FEATURE_M);
@@ -121,18 +124,19 @@ static void cortex_m4_initfn(Object *obj)
     cpu->isar.id_mmfr1 = 0x00000000;
     cpu->isar.id_mmfr2 = 0x00000000;
     cpu->isar.id_mmfr3 = 0x00000000;
-    cpu->isar.id_isar0 = 0x01141110;
-    cpu->isar.id_isar1 = 0x02111000;
-    cpu->isar.id_isar2 = 0x21112231;
-    cpu->isar.id_isar3 = 0x01111110;
-    cpu->isar.id_isar4 = 0x01310102;
-    cpu->isar.id_isar5 = 0x00000000;
-    cpu->isar.id_isar6 = 0x00000000;
+    SET_IDREG(isar, ID_ISAR0, 0x01141110);
+    SET_IDREG(isar, ID_ISAR1, 0x02111000);
+    SET_IDREG(isar, ID_ISAR2, 0x21112231);
+    SET_IDREG(isar, ID_ISAR3, 0x01111110);
+    SET_IDREG(isar, ID_ISAR4, 0x01310102);
+    SET_IDREG(isar, ID_ISAR5, 0x00000000);
+    SET_IDREG(isar, ID_ISAR6, 0x00000000);
 }
 
 static void cortex_m7_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
+    ARMISARegisters *isar = &cpu->isar;
 
     set_feature(&cpu->env, ARM_FEATURE_V7);
     set_feature(&cpu->env, ARM_FEATURE_M);
@@ -151,18 +155,19 @@ static void cortex_m7_initfn(Object *obj)
     cpu->isar.id_mmfr1 = 0x00000000;
     cpu->isar.id_mmfr2 = 0x01000000;
     cpu->isar.id_mmfr3 = 0x00000000;
-    cpu->isar.id_isar0 = 0x01101110;
-    cpu->isar.id_isar1 = 0x02112000;
-    cpu->isar.id_isar2 = 0x20232231;
-    cpu->isar.id_isar3 = 0x01111131;
-    cpu->isar.id_isar4 = 0x01310132;
-    cpu->isar.id_isar5 = 0x00000000;
-    cpu->isar.id_isar6 = 0x00000000;
+    SET_IDREG(isar, ID_ISAR0, 0x01101110);
+    SET_IDREG(isar, ID_ISAR1, 0x02112000);
+    SET_IDREG(isar, ID_ISAR2, 0x20232231);
+    SET_IDREG(isar, ID_ISAR3, 0x01111131);
+    SET_IDREG(isar, ID_ISAR4, 0x01310132);
+    SET_IDREG(isar, ID_ISAR5, 0x00000000);
+    SET_IDREG(isar, ID_ISAR6, 0x00000000);
 }
 
 static void cortex_m33_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
+    ARMISARegisters *isar = &cpu->isar;
 
     set_feature(&cpu->env, ARM_FEATURE_V8);
     set_feature(&cpu->env, ARM_FEATURE_M);
@@ -183,13 +188,13 @@ static void cortex_m33_initfn(Object *obj)
     cpu->isar.id_mmfr1 = 0x00000000;
     cpu->isar.id_mmfr2 = 0x01000000;
     cpu->isar.id_mmfr3 = 0x00000000;
-    cpu->isar.id_isar0 = 0x01101110;
-    cpu->isar.id_isar1 = 0x02212000;
-    cpu->isar.id_isar2 = 0x20232232;
-    cpu->isar.id_isar3 = 0x01111131;
-    cpu->isar.id_isar4 = 0x01310132;
-    cpu->isar.id_isar5 = 0x00000000;
-    cpu->isar.id_isar6 = 0x00000000;
+    SET_IDREG(isar, ID_ISAR0, 0x01101110);
+    SET_IDREG(isar, ID_ISAR1, 0x02212000);
+    SET_IDREG(isar, ID_ISAR2, 0x20232232);
+    SET_IDREG(isar, ID_ISAR3, 0x01111131);
+    SET_IDREG(isar, ID_ISAR4, 0x01310132);
+    SET_IDREG(isar, ID_ISAR5, 0x00000000);
+    SET_IDREG(isar, ID_ISAR6, 0x00000000);
     cpu->clidr = 0x00000000;
     cpu->ctr = 0x8000c000;
 }
@@ -197,6 +202,7 @@ static void cortex_m33_initfn(Object *obj)
 static void cortex_m55_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
+    ARMISARegisters *isar = &cpu->isar;
 
     set_feature(&cpu->env, ARM_FEATURE_V8);
     set_feature(&cpu->env, ARM_FEATURE_V8_1M);
@@ -220,13 +226,13 @@ static void cortex_m55_initfn(Object *obj)
     cpu->isar.id_mmfr1 = 0x00000000;
     cpu->isar.id_mmfr2 = 0x01000000;
     cpu->isar.id_mmfr3 = 0x00000011;
-    cpu->isar.id_isar0 = 0x01103110;
-    cpu->isar.id_isar1 = 0x02212000;
-    cpu->isar.id_isar2 = 0x20232232;
-    cpu->isar.id_isar3 = 0x01111131;
-    cpu->isar.id_isar4 = 0x01310132;
-    cpu->isar.id_isar5 = 0x00000000;
-    cpu->isar.id_isar6 = 0x00000000;
+    SET_IDREG(isar, ID_ISAR0, 0x01103110);
+    SET_IDREG(isar, ID_ISAR1, 0x02212000);
+    SET_IDREG(isar, ID_ISAR2, 0x20232232);
+    SET_IDREG(isar, ID_ISAR3, 0x01111131);
+    SET_IDREG(isar, ID_ISAR4, 0x01310132);
+    SET_IDREG(isar, ID_ISAR5, 0x00000000);
+    SET_IDREG(isar, ID_ISAR6, 0x00000000);
     cpu->clidr = 0x00000000; /* caches not implemented */
     cpu->ctr = 0x8303c003;
 }
diff --git a/target/arm/tcg/cpu32.c b/target/arm/tcg/cpu32.c
index 2c45b7eddd..937a72b12c 100644
--- a/target/arm/tcg/cpu32.c
+++ b/target/arm/tcg/cpu32.c
@@ -23,18 +23,19 @@
 void aa32_max_features(ARMCPU *cpu)
 {
     uint32_t t;
+    ARMISARegisters *isar = &cpu->isar;
 
     /* Add additional features supported by QEMU */
-    t = cpu->isar.id_isar5;
+    t = GET_IDREG(isar, ID_ISAR5);
     t = FIELD_DP32(t, ID_ISAR5, AES, 2);          /* FEAT_PMULL */
     t = FIELD_DP32(t, ID_ISAR5, SHA1, 1);         /* FEAT_SHA1 */
     t = FIELD_DP32(t, ID_ISAR5, SHA2, 1);         /* FEAT_SHA256 */
     t = FIELD_DP32(t, ID_ISAR5, CRC32, 1);
     t = FIELD_DP32(t, ID_ISAR5, RDM, 1);          /* FEAT_RDM */
     t = FIELD_DP32(t, ID_ISAR5, VCMA, 1);         /* FEAT_FCMA */
-    cpu->isar.id_isar5 = t;
+    SET_IDREG(isar, ID_ISAR5, t);
 
-    t = cpu->isar.id_isar6;
+    t = GET_IDREG(isar, ID_ISAR6);
     t = FIELD_DP32(t, ID_ISAR6, JSCVT, 1);        /* FEAT_JSCVT */
     t = FIELD_DP32(t, ID_ISAR6, DP, 1);           /* Feat_DotProd */
     t = FIELD_DP32(t, ID_ISAR6, FHM, 1);          /* FEAT_FHM */
@@ -42,7 +43,7 @@ void aa32_max_features(ARMCPU *cpu)
     t = FIELD_DP32(t, ID_ISAR6, SPECRES, 1);      /* FEAT_SPECRES */
     t = FIELD_DP32(t, ID_ISAR6, BF16, 1);         /* FEAT_AA32BF16 */
     t = FIELD_DP32(t, ID_ISAR6, I8MM, 1);         /* FEAT_AA32I8MM */
-    cpu->isar.id_isar6 = t;
+    SET_IDREG(isar, ID_ISAR6, t);
 
     t = cpu->isar.mvfr1;
     t = FIELD_DP32(t, MVFR1, FPHP, 3);            /* FEAT_FP16 */
@@ -140,7 +141,7 @@ static void arm926_initfn(Object *obj)
      * ARMv5 does not have the ID_ISAR registers, but we can still
      * set the field to indicate Jazelle support within QEMU.
      */
-    cpu->isar.id_isar1 = FIELD_DP32(cpu->isar.id_isar1, ID_ISAR1, JAZELLE, 1);
+    FIELD_DP32_IDREG(&cpu->isar, ID_ISAR1, JAZELLE, 1);
     /*
      * Similarly, we need to set MVFR0 fields to enable vfp and short vector
      * support even though ARMv5 doesn't have this register.
@@ -182,7 +183,7 @@ static void arm1026_initfn(Object *obj)
      * ARMv5 does not have the ID_ISAR registers, but we can still
      * set the field to indicate Jazelle support within QEMU.
      */
-    cpu->isar.id_isar1 = FIELD_DP32(cpu->isar.id_isar1, ID_ISAR1, JAZELLE, 1);
+    FIELD_DP32_IDREG(&cpu->isar, ID_ISAR1, JAZELLE, 1);
     /*
      * Similarly, we need to set MVFR0 fields to enable vfp and short vector
      * support even though ARMv5 doesn't have this register.
@@ -206,6 +207,7 @@ static void arm1026_initfn(Object *obj)
 static void arm1136_r2_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
+    ARMISARegisters *isar = &cpu->isar;
     /*
      * What qemu calls "arm1136_r2" is actually the 1136 r0p2, ie an
      * older core than plain "arm1136". In particular this does not
@@ -233,17 +235,18 @@ static void arm1136_r2_initfn(Object *obj)
     cpu->isar.id_mmfr0 = 0x01130003;
     cpu->isar.id_mmfr1 = 0x10030302;
     cpu->isar.id_mmfr2 = 0x01222110;
-    cpu->isar.id_isar0 = 0x00140011;
-    cpu->isar.id_isar1 = 0x12002111;
-    cpu->isar.id_isar2 = 0x11231111;
-    cpu->isar.id_isar3 = 0x01102131;
-    cpu->isar.id_isar4 = 0x141;
+    SET_IDREG(isar, ID_ISAR0, 0x00140011);
+    SET_IDREG(isar, ID_ISAR1, 0x12002111);
+    SET_IDREG(isar, ID_ISAR2, 0x11231111);
+    SET_IDREG(isar, ID_ISAR3, 0x01102131);
+    SET_IDREG(isar, ID_ISAR4, 0x141);
     cpu->reset_auxcr = 7;
 }
 
 static void arm1136_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
+    ARMISARegisters *isar = &cpu->isar;
 
     cpu->dtb_compatible = "arm,arm1136";
     set_feature(&cpu->env, ARM_FEATURE_V6K);
@@ -264,17 +267,18 @@ static void arm1136_initfn(Object *obj)
     cpu->isar.id_mmfr0 = 0x01130003;
     cpu->isar.id_mmfr1 = 0x10030302;
     cpu->isar.id_mmfr2 = 0x01222110;
-    cpu->isar.id_isar0 = 0x00140011;
-    cpu->isar.id_isar1 = 0x12002111;
-    cpu->isar.id_isar2 = 0x11231111;
-    cpu->isar.id_isar3 = 0x01102131;
-    cpu->isar.id_isar4 = 0x141;
+    SET_IDREG(isar, ID_ISAR0, 0x00140011);
+    SET_IDREG(isar, ID_ISAR1, 0x12002111);
+    SET_IDREG(isar, ID_ISAR2, 0x11231111);
+    SET_IDREG(isar, ID_ISAR3, 0x01102131);
+    SET_IDREG(isar, ID_ISAR4, 0x141);
     cpu->reset_auxcr = 7;
 }
 
 static void arm1176_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
+    ARMISARegisters *isar = &cpu->isar;
 
     cpu->dtb_compatible = "arm,arm1176";
     set_feature(&cpu->env, ARM_FEATURE_V6K);
@@ -296,17 +300,18 @@ static void arm1176_initfn(Object *obj)
     cpu->isar.id_mmfr0 = 0x01130003;
     cpu->isar.id_mmfr1 = 0x10030302;
     cpu->isar.id_mmfr2 = 0x01222100;
-    cpu->isar.id_isar0 = 0x0140011;
-    cpu->isar.id_isar1 = 0x12002111;
-    cpu->isar.id_isar2 = 0x11231121;
-    cpu->isar.id_isar3 = 0x01102131;
-    cpu->isar.id_isar4 = 0x01141;
+    SET_IDREG(isar, ID_ISAR0, 0x0140011);
+    SET_IDREG(isar, ID_ISAR1, 0x12002111);
+    SET_IDREG(isar, ID_ISAR2, 0x11231121);
+    SET_IDREG(isar, ID_ISAR3, 0x01102131);
+    SET_IDREG(isar, ID_ISAR4, 0x01141);
     cpu->reset_auxcr = 7;
 }
 
 static void arm11mpcore_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
+    ARMISARegisters *isar = &cpu->isar;
 
     cpu->dtb_compatible = "arm,arm11mpcore";
     set_feature(&cpu->env, ARM_FEATURE_V6K);
@@ -325,11 +330,11 @@ static void arm11mpcore_initfn(Object *obj)
     cpu->isar.id_mmfr0 = 0x01100103;
     cpu->isar.id_mmfr1 = 0x10020302;
     cpu->isar.id_mmfr2 = 0x01222000;
-    cpu->isar.id_isar0 = 0x00100011;
-    cpu->isar.id_isar1 = 0x12002111;
-    cpu->isar.id_isar2 = 0x11221011;
-    cpu->isar.id_isar3 = 0x01102131;
-    cpu->isar.id_isar4 = 0x141;
+    SET_IDREG(isar, ID_ISAR0, 0x00100011);
+    SET_IDREG(isar, ID_ISAR1, 0x12002111);
+    SET_IDREG(isar, ID_ISAR2, 0x11221011);
+    SET_IDREG(isar, ID_ISAR3, 0x01102131);
+    SET_IDREG(isar, ID_ISAR4, 0x141);
     cpu->reset_auxcr = 1;
 }
 
@@ -343,6 +348,7 @@ static const ARMCPRegInfo cortexa8_cp_reginfo[] = {
 static void cortex_a8_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
+    ARMISARegisters *isar = &cpu->isar;
 
     cpu->dtb_compatible = "arm,cortex-a8";
     set_feature(&cpu->env, ARM_FEATURE_V7);
@@ -365,11 +371,11 @@ static void cortex_a8_initfn(Object *obj)
     cpu->isar.id_mmfr1 = 0x20000000;
     cpu->isar.id_mmfr2 = 0x01202000;
     cpu->isar.id_mmfr3 = 0x11;
-    cpu->isar.id_isar0 = 0x00101111;
-    cpu->isar.id_isar1 = 0x12112111;
-    cpu->isar.id_isar2 = 0x21232031;
-    cpu->isar.id_isar3 = 0x11112131;
-    cpu->isar.id_isar4 = 0x00111142;
+    SET_IDREG(isar, ID_ISAR0, 0x00101111);
+    SET_IDREG(isar, ID_ISAR1, 0x12112111);
+    SET_IDREG(isar, ID_ISAR2, 0x21232031);
+    SET_IDREG(isar, ID_ISAR3, 0x11112131);
+    SET_IDREG(isar, ID_ISAR4, 0x00111142);
     cpu->isar.dbgdidr = 0x15141000;
     cpu->clidr = (1 << 27) | (2 << 24) | 3;
     cpu->ccsidr[0] = 0xe007e01a; /* 16k L1 dcache. */
@@ -412,6 +418,7 @@ static const ARMCPRegInfo cortexa9_cp_reginfo[] = {
 static void cortex_a9_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
+    ARMISARegisters *isar = &cpu->isar;
 
     cpu->dtb_compatible = "arm,cortex-a9";
     set_feature(&cpu->env, ARM_FEATURE_V7);
@@ -440,11 +447,11 @@ static void cortex_a9_initfn(Object *obj)
     cpu->isar.id_mmfr1 = 0x20000000;
     cpu->isar.id_mmfr2 = 0x01230000;
     cpu->isar.id_mmfr3 = 0x00002111;
-    cpu->isar.id_isar0 = 0x00101111;
-    cpu->isar.id_isar1 = 0x13112111;
-    cpu->isar.id_isar2 = 0x21232041;
-    cpu->isar.id_isar3 = 0x11112131;
-    cpu->isar.id_isar4 = 0x00111142;
+    SET_IDREG(isar, ID_ISAR0, 0x00101111);
+    SET_IDREG(isar, ID_ISAR1, 0x13112111);
+    SET_IDREG(isar, ID_ISAR2, 0x21232041);
+    SET_IDREG(isar, ID_ISAR3, 0x11112131);
+    SET_IDREG(isar, ID_ISAR4, 0x00111142);
     cpu->isar.dbgdidr = 0x35141000;
     cpu->clidr = (1 << 27) | (1 << 24) | 3;
     cpu->ccsidr[0] = 0xe00fe019; /* 16k L1 dcache. */
@@ -479,6 +486,7 @@ static const ARMCPRegInfo cortexa15_cp_reginfo[] = {
 static void cortex_a7_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
+    ARMISARegisters *isar = &cpu->isar;
 
     cpu->dtb_compatible = "arm,cortex-a7";
     set_feature(&cpu->env, ARM_FEATURE_V7VE);
@@ -509,11 +517,11 @@ static void cortex_a7_initfn(Object *obj)
      * a7_mpcore_r0p5_trm, page 4-4 gives 0x01101110; but
      * table 4-41 gives 0x02101110, which includes the arm div insns.
      */
-    cpu->isar.id_isar0 = 0x02101110;
-    cpu->isar.id_isar1 = 0x13112111;
-    cpu->isar.id_isar2 = 0x21232041;
-    cpu->isar.id_isar3 = 0x11112131;
-    cpu->isar.id_isar4 = 0x10011142;
+    SET_IDREG(isar, ID_ISAR0, 0x02101110);
+    SET_IDREG(isar, ID_ISAR1, 0x13112111);
+    SET_IDREG(isar, ID_ISAR2, 0x21232041);
+    SET_IDREG(isar, ID_ISAR3, 0x11112131);
+    SET_IDREG(isar, ID_ISAR4, 0x10011142);
     cpu->isar.dbgdidr = 0x3515f005;
     cpu->isar.dbgdevid = 0x01110f13;
     cpu->isar.dbgdevid1 = 0x1;
@@ -528,6 +536,7 @@ static void cortex_a7_initfn(Object *obj)
 static void cortex_a15_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
+    ARMISARegisters *isar = &cpu->isar;
 
     cpu->dtb_compatible = "arm,cortex-a15";
     set_feature(&cpu->env, ARM_FEATURE_V7VE);
@@ -556,11 +565,11 @@ static void cortex_a15_initfn(Object *obj)
     cpu->isar.id_mmfr1 = 0x20000000;
     cpu->isar.id_mmfr2 = 0x01240000;
     cpu->isar.id_mmfr3 = 0x02102211;
-    cpu->isar.id_isar0 = 0x02101110;
-    cpu->isar.id_isar1 = 0x13112111;
-    cpu->isar.id_isar2 = 0x21232041;
-    cpu->isar.id_isar3 = 0x11112131;
-    cpu->isar.id_isar4 = 0x10011142;
+    SET_IDREG(isar, ID_ISAR0, 0x02101110);
+    SET_IDREG(isar, ID_ISAR1, 0x13112111);
+    SET_IDREG(isar, ID_ISAR2, 0x21232041);
+    SET_IDREG(isar, ID_ISAR3, 0x11112131);
+    SET_IDREG(isar, ID_ISAR4, 0x10011142);
     cpu->isar.dbgdidr = 0x3515f021;
     cpu->isar.dbgdevid = 0x01110f13;
     cpu->isar.dbgdevid1 = 0x0;
@@ -585,6 +594,7 @@ static const ARMCPRegInfo cortexr5_cp_reginfo[] = {
 static void cortex_r5_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
+    ARMISARegisters *isar = &cpu->isar;
 
     set_feature(&cpu->env, ARM_FEATURE_V7);
     set_feature(&cpu->env, ARM_FEATURE_V7MP);
@@ -599,13 +609,13 @@ static void cortex_r5_initfn(Object *obj)
     cpu->isar.id_mmfr1 = 0x00000000;
     cpu->isar.id_mmfr2 = 0x01200000;
     cpu->isar.id_mmfr3 = 0x0211;
-    cpu->isar.id_isar0 = 0x02101111;
-    cpu->isar.id_isar1 = 0x13112111;
-    cpu->isar.id_isar2 = 0x21232141;
-    cpu->isar.id_isar3 = 0x01112131;
-    cpu->isar.id_isar4 = 0x0010142;
-    cpu->isar.id_isar5 = 0x0;
-    cpu->isar.id_isar6 = 0x0;
+    SET_IDREG(isar, ID_ISAR0, 0x02101111);
+    SET_IDREG(isar, ID_ISAR1, 0x13112111);
+    SET_IDREG(isar, ID_ISAR2, 0x21232141);
+    SET_IDREG(isar, ID_ISAR3, 0x01112131);
+    SET_IDREG(isar, ID_ISAR4, 0x0010142);
+    SET_IDREG(isar, ID_ISAR5, 0x0);
+    SET_IDREG(isar, ID_ISAR6, 0x0);
     cpu->mp_is_up = true;
     cpu->pmsav7_dregion = 16;
     cpu->isar.reset_pmcr_el0 = 0x41151800;
@@ -720,6 +730,7 @@ static const ARMCPRegInfo cortex_r52_cp_reginfo[] = {
 static void cortex_r52_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
+    ARMISARegisters *isar = &cpu->isar;
 
     set_feature(&cpu->env, ARM_FEATURE_V8);
     set_feature(&cpu->env, ARM_FEATURE_EL2);
@@ -746,12 +757,12 @@ static void cortex_r52_initfn(Object *obj)
     cpu->isar.id_mmfr2 = 0x01200000;
     cpu->isar.id_mmfr3 = 0xf0102211;
     cpu->isar.id_mmfr4 = 0x00000010;
-    cpu->isar.id_isar0 = 0x02101110;
-    cpu->isar.id_isar1 = 0x13112111;
-    cpu->isar.id_isar2 = 0x21232142;
-    cpu->isar.id_isar3 = 0x01112131;
-    cpu->isar.id_isar4 = 0x00010142;
-    cpu->isar.id_isar5 = 0x00010001;
+    SET_IDREG(isar, ID_ISAR0, 0x02101110);
+    SET_IDREG(isar, ID_ISAR1, 0x13112111);
+    SET_IDREG(isar, ID_ISAR2, 0x21232142);
+    SET_IDREG(isar, ID_ISAR3, 0x01112131);
+    SET_IDREG(isar, ID_ISAR4, 0x00010142);
+    SET_IDREG(isar, ID_ISAR5, 0x00010001);
     cpu->isar.dbgdidr = 0x77168000;
     cpu->clidr = (1 << 27) | (1 << 24) | 0x3;
     cpu->ccsidr[0] = 0x700fe01a; /* 32KB L1 dcache */
@@ -949,6 +960,7 @@ static void pxa270c5_initfn(Object *obj)
 static void arm_max_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
+    ARMISARegisters *isar = &cpu->isar;
 
     /* aarch64_a57_initfn, advertising none of the aarch64 features */
     cpu->dtb_compatible = "arm,cortex-a57";
@@ -976,13 +988,13 @@ static void arm_max_initfn(Object *obj)
     cpu->isar.id_mmfr1 = 0x40000000;
     cpu->isar.id_mmfr2 = 0x01260000;
     cpu->isar.id_mmfr3 = 0x02102211;
-    cpu->isar.id_isar0 = 0x02101110;
-    cpu->isar.id_isar1 = 0x13112111;
-    cpu->isar.id_isar2 = 0x21232042;
-    cpu->isar.id_isar3 = 0x01112131;
-    cpu->isar.id_isar4 = 0x00011142;
-    cpu->isar.id_isar5 = 0x00011121;
-    cpu->isar.id_isar6 = 0;
+    SET_IDREG(isar, ID_ISAR0, 0x02101110);
+    SET_IDREG(isar, ID_ISAR1, 0x13112111);
+    SET_IDREG(isar, ID_ISAR2, 0x21232042);
+    SET_IDREG(isar, ID_ISAR3, 0x01112131);
+    SET_IDREG(isar, ID_ISAR4, 0x00011142);
+    SET_IDREG(isar, ID_ISAR5, 0x00011121);
+    SET_IDREG(isar, ID_ISAR6, 0);
     cpu->isar.reset_pmcr_el0 = 0x41013000;
     cpu->clidr = 0x0a200023;
     cpu->ccsidr[0] = 0x701fe00a; /* 32KB L1 dcache */
diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
index 80a99ab025..dd4dc8ada5 100644
--- a/target/arm/tcg/cpu64.c
+++ b/target/arm/tcg/cpu64.c
@@ -57,12 +57,12 @@ static void aarch64_a35_initfn(Object *obj)
     cpu->isar.id_mmfr1 = 0x40000000;
     cpu->isar.id_mmfr2 = 0x01260000;
     cpu->isar.id_mmfr3 = 0x02102211;
-    cpu->isar.id_isar0 = 0x02101110;
-    cpu->isar.id_isar1 = 0x13112111;
-    cpu->isar.id_isar2 = 0x21232042;
-    cpu->isar.id_isar3 = 0x01112131;
-    cpu->isar.id_isar4 = 0x00011142;
-    cpu->isar.id_isar5 = 0x00011121;
+    SET_IDREG(isar, ID_ISAR0, 0x02101110);
+    SET_IDREG(isar, ID_ISAR1, 0x13112111);
+    SET_IDREG(isar, ID_ISAR2, 0x21232042);
+    SET_IDREG(isar, ID_ISAR3, 0x01112131);
+    SET_IDREG(isar, ID_ISAR4, 0x00011142);
+    SET_IDREG(isar, ID_ISAR5, 0x00011121);
     SET_IDREG(isar, ID_AA64PFR0, 0x00002222);
     SET_IDREG(isar, ID_AA64PFR1, 0);
     SET_IDREG(isar, ID_AA64DFR0, 0x10305106);
@@ -229,13 +229,13 @@ static void aarch64_a55_initfn(Object *obj)
     SET_IDREG(isar, ID_AA64PFR1, 0x0000000000000010ull);
     cpu->id_afr0       = 0x00000000;
     cpu->isar.id_dfr0  = 0x04010088;
-    cpu->isar.id_isar0 = 0x02101110;
-    cpu->isar.id_isar1 = 0x13112111;
-    cpu->isar.id_isar2 = 0x21232042;
-    cpu->isar.id_isar3 = 0x01112131;
-    cpu->isar.id_isar4 = 0x00011142;
-    cpu->isar.id_isar5 = 0x01011121;
-    cpu->isar.id_isar6 = 0x00000010;
+    SET_IDREG(isar, ID_ISAR0, 0x02101110);
+    SET_IDREG(isar, ID_ISAR1, 0x13112111);
+    SET_IDREG(isar, ID_ISAR2, 0x21232042);
+    SET_IDREG(isar, ID_ISAR3, 0x01112131);
+    SET_IDREG(isar, ID_ISAR4, 0x00011142);
+    SET_IDREG(isar, ID_ISAR5, 0x01011121);
+    SET_IDREG(isar, ID_ISAR6, 0x00000010);
     cpu->isar.id_mmfr0 = 0x10201105;
     cpu->isar.id_mmfr1 = 0x40000000;
     cpu->isar.id_mmfr2 = 0x01260000;
@@ -303,12 +303,12 @@ static void aarch64_a72_initfn(Object *obj)
     cpu->isar.id_mmfr1 = 0x40000000;
     cpu->isar.id_mmfr2 = 0x01260000;
     cpu->isar.id_mmfr3 = 0x02102211;
-    cpu->isar.id_isar0 = 0x02101110;
-    cpu->isar.id_isar1 = 0x13112111;
-    cpu->isar.id_isar2 = 0x21232042;
-    cpu->isar.id_isar3 = 0x01112131;
-    cpu->isar.id_isar4 = 0x00011142;
-    cpu->isar.id_isar5 = 0x00011121;
+    SET_IDREG(isar, ID_ISAR0, 0x02101110);
+    SET_IDREG(isar, ID_ISAR1, 0x13112111);
+    SET_IDREG(isar, ID_ISAR2, 0x21232042);
+    SET_IDREG(isar, ID_ISAR3, 0x01112131);
+    SET_IDREG(isar, ID_ISAR4, 0x00011142);
+    SET_IDREG(isar, ID_ISAR5, 0x00011121);
     SET_IDREG(isar, ID_AA64PFR0, 0x00002222);
     SET_IDREG(isar, ID_AA64DFR0, 0x10305106);
     SET_IDREG(isar, ID_AA64ISAR0, 0x00011120);
@@ -362,13 +362,13 @@ static void aarch64_a76_initfn(Object *obj)
     SET_IDREG(isar, ID_AA64PFR1, 0x0000000000000010ull);
     cpu->id_afr0       = 0x00000000;
     cpu->isar.id_dfr0  = 0x04010088;
-    cpu->isar.id_isar0 = 0x02101110;
-    cpu->isar.id_isar1 = 0x13112111;
-    cpu->isar.id_isar2 = 0x21232042;
-    cpu->isar.id_isar3 = 0x01112131;
-    cpu->isar.id_isar4 = 0x00010142;
-    cpu->isar.id_isar5 = 0x01011121;
-    cpu->isar.id_isar6 = 0x00000010;
+    SET_IDREG(isar, ID_ISAR0, 0x02101110);
+    SET_IDREG(isar, ID_ISAR1, 0x13112111);
+    SET_IDREG(isar, ID_ISAR2, 0x21232042);
+    SET_IDREG(isar, ID_ISAR3, 0x01112131);
+    SET_IDREG(isar, ID_ISAR4, 0x00010142);
+    SET_IDREG(isar, ID_ISAR5, 0x01011121);
+    SET_IDREG(isar, ID_ISAR6, 0x00000010);
     cpu->isar.id_mmfr0 = 0x10201105;
     cpu->isar.id_mmfr1 = 0x40000000;
     cpu->isar.id_mmfr2 = 0x01260000;
@@ -610,13 +610,13 @@ static void aarch64_neoverse_n1_initfn(Object *obj)
     SET_IDREG(isar, ID_AA64PFR1, 0x0000000000000020ull);
     cpu->id_afr0       = 0x00000000;
     cpu->isar.id_dfr0  = 0x04010088;
-    cpu->isar.id_isar0 = 0x02101110;
-    cpu->isar.id_isar1 = 0x13112111;
-    cpu->isar.id_isar2 = 0x21232042;
-    cpu->isar.id_isar3 = 0x01112131;
-    cpu->isar.id_isar4 = 0x00010142;
-    cpu->isar.id_isar5 = 0x01011121;
-    cpu->isar.id_isar6 = 0x00000010;
+    SET_IDREG(isar, ID_ISAR0, 0x02101110);
+    SET_IDREG(isar, ID_ISAR1, 0x13112111);
+    SET_IDREG(isar, ID_ISAR2, 0x21232042);
+    SET_IDREG(isar, ID_ISAR3, 0x01112131);
+    SET_IDREG(isar, ID_ISAR4, 0x00010142);
+    SET_IDREG(isar, ID_ISAR5, 0x01011121);
+    SET_IDREG(isar, ID_ISAR6, 0x00000010);
     cpu->isar.id_mmfr0 = 0x10201105;
     cpu->isar.id_mmfr1 = 0x40000000;
     cpu->isar.id_mmfr2 = 0x01260000;
@@ -689,13 +689,13 @@ static void aarch64_neoverse_v1_initfn(Object *obj)
     SET_IDREG(isar, ID_AA64PFR1, 0x0000000000000020ull);
     cpu->id_afr0       = 0x00000000;
     cpu->isar.id_dfr0  = 0x15011099;
-    cpu->isar.id_isar0 = 0x02101110;
-    cpu->isar.id_isar1 = 0x13112111;
-    cpu->isar.id_isar2 = 0x21232042;
-    cpu->isar.id_isar3 = 0x01112131;
-    cpu->isar.id_isar4 = 0x00010142;
-    cpu->isar.id_isar5 = 0x11011121;
-    cpu->isar.id_isar6 = 0x01100111;
+    SET_IDREG(isar, ID_ISAR0, 0x02101110);
+    SET_IDREG(isar, ID_ISAR1, 0x13112111);
+    SET_IDREG(isar, ID_ISAR2, 0x21232042);
+    SET_IDREG(isar, ID_ISAR3, 0x01112131);
+    SET_IDREG(isar, ID_ISAR4, 0x00010142);
+    SET_IDREG(isar, ID_ISAR5, 0x11011121);
+    SET_IDREG(isar, ID_ISAR6, 0x01100111);
     cpu->isar.id_mmfr0 = 0x10201105;
     cpu->isar.id_mmfr1 = 0x40000000;
     cpu->isar.id_mmfr2 = 0x01260000;
@@ -910,14 +910,14 @@ static void aarch64_a710_initfn(Object *obj)
     cpu->isar.id_mmfr1 = 0x40000000;
     cpu->isar.id_mmfr2 = 0x01260000;
     cpu->isar.id_mmfr3 = 0x02122211;
-    cpu->isar.id_isar0 = 0x02101110;
-    cpu->isar.id_isar1 = 0x13112111;
-    cpu->isar.id_isar2 = 0x21232042;
-    cpu->isar.id_isar3 = 0x01112131;
-    cpu->isar.id_isar4 = 0x00010142;
-    cpu->isar.id_isar5 = 0x11011121; /* with Crypto */
+    SET_IDREG(isar, ID_ISAR0, 0x02101110);
+    SET_IDREG(isar, ID_ISAR1, 0x13112111);
+    SET_IDREG(isar, ID_ISAR2, 0x21232042);
+    SET_IDREG(isar, ID_ISAR3, 0x01112131);
+    SET_IDREG(isar, ID_ISAR4, 0x00010142);
+    SET_IDREG(isar, ID_ISAR5, 0x11011121); /* with Crypto */
     cpu->isar.id_mmfr4 = 0x21021110;
-    cpu->isar.id_isar6 = 0x01111111;
+    SET_IDREG(isar, ID_ISAR6, 0x01111111);
     cpu->isar.mvfr0    = 0x10110222;
     cpu->isar.mvfr1    = 0x13211111;
     cpu->isar.mvfr2    = 0x00000043;
@@ -1012,14 +1012,14 @@ static void aarch64_neoverse_n2_initfn(Object *obj)
     cpu->isar.id_mmfr1 = 0x40000000;
     cpu->isar.id_mmfr2 = 0x01260000;
     cpu->isar.id_mmfr3 = 0x02122211;
-    cpu->isar.id_isar0 = 0x02101110;
-    cpu->isar.id_isar1 = 0x13112111;
-    cpu->isar.id_isar2 = 0x21232042;
-    cpu->isar.id_isar3 = 0x01112131;
-    cpu->isar.id_isar4 = 0x00010142;
-    cpu->isar.id_isar5 = 0x11011121; /* with Crypto */
+    SET_IDREG(isar, ID_ISAR0, 0x02101110);
+    SET_IDREG(isar, ID_ISAR1, 0x13112111);
+    SET_IDREG(isar, ID_ISAR2, 0x21232042);
+    SET_IDREG(isar, ID_ISAR3, 0x01112131);
+    SET_IDREG(isar, ID_ISAR4, 0x00010142);
+    SET_IDREG(isar, ID_ISAR5, 0x11011121); /* with Crypto */
     cpu->isar.id_mmfr4 = 0x01021110;
-    cpu->isar.id_isar6 = 0x01111111;
+    SET_IDREG(isar, ID_ISAR6, 0x01111111);
     cpu->isar.mvfr0    = 0x10110222;
     cpu->isar.mvfr1    = 0x13211111;
     cpu->isar.mvfr2    = 0x00000043;

From 30ca689900c8c47bc4ca46be00ec9a7f1a78ccda Mon Sep 17 00:00:00 2001
From: Eric Auger <eric.auger@redhat.com>
Date: Tue, 1 Jul 2025 15:08:28 +0100
Subject: [PATCH 1735/2760] arm/cpu: Store id_pfr0/1/2 into the idregs array

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Sebastian Ott <sebott@redhat.com>
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Cornelia Huck <cohuck@redhat.com>
Message-id: 20250617153931.1330449-10-cohuck@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/intc/armv7m_nvic.c     |  5 ++--
 target/arm/cpu-features.h | 10 ++++----
 target/arm/cpu.c          |  8 +++---
 target/arm/cpu.h          |  3 ---
 target/arm/cpu64.c        |  8 +++---
 target/arm/helper.c       |  8 +++---
 target/arm/kvm.c          |  9 +++----
 target/arm/tcg/cpu-v7m.c  | 24 +++++++++---------
 target/arm/tcg/cpu32.c    | 52 +++++++++++++++++++--------------------
 target/arm/tcg/cpu64.c    | 44 ++++++++++++++++-----------------
 10 files changed, 82 insertions(+), 89 deletions(-)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index fdb7f58e36..330205fa34 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -988,6 +988,7 @@ static void nvic_nmi_trigger(void *opaque, int n, int level)
 static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
 {
     ARMCPU *cpu = s->cpu;
+    ARMISARegisters *isar = &cpu->isar;
     uint32_t val;
 
     switch (offset) {
@@ -1263,12 +1264,12 @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
         if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
             goto bad_offset;
         }
-        return cpu->isar.id_pfr0;
+        return GET_IDREG(isar, ID_PFR0);
     case 0xd44: /* PFR1.  */
         if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
             goto bad_offset;
         }
-        return cpu->isar.id_pfr1;
+        return GET_IDREG(isar, ID_PFR1);
     case 0xd48: /* DFR0.  */
         if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
             goto bad_offset;
diff --git a/target/arm/cpu-features.h b/target/arm/cpu-features.h
index 75a2cc4077..a34378577f 100644
--- a/target/arm/cpu-features.h
+++ b/target/arm/cpu-features.h
@@ -137,12 +137,12 @@ static inline bool isar_feature_aa32_i8mm(const ARMISARegisters *id)
 
 static inline bool isar_feature_aa32_ras(const ARMISARegisters *id)
 {
-    return FIELD_EX32(id->id_pfr0, ID_PFR0, RAS) != 0;
+    return FIELD_EX32_IDREG(id, ID_PFR0, RAS) != 0;
 }
 
 static inline bool isar_feature_aa32_mprofile(const ARMISARegisters *id)
 {
-    return FIELD_EX32(id->id_pfr1, ID_PFR1, MPROGMOD) != 0;
+    return FIELD_EX32_IDREG(id, ID_PFR1, MPROGMOD) != 0;
 }
 
 static inline bool isar_feature_aa32_m_sec_state(const ARMISARegisters *id)
@@ -151,7 +151,7 @@ static inline bool isar_feature_aa32_m_sec_state(const ARMISARegisters *id)
      * Return true if M-profile state handling insns
      * (VSCCLRM, CLRM, FPCTX access insns) are implemented
      */
-    return FIELD_EX32(id->id_pfr1, ID_PFR1, SECURITY) >= 3;
+    return FIELD_EX32_IDREG(id, ID_PFR1, SECURITY) >= 3;
 }
 
 static inline bool isar_feature_aa32_fp16_arith(const ARMISARegisters *id)
@@ -350,12 +350,12 @@ static inline bool isar_feature_aa32_evt(const ARMISARegisters *id)
 
 static inline bool isar_feature_aa32_dit(const ARMISARegisters *id)
 {
-    return FIELD_EX32(id->id_pfr0, ID_PFR0, DIT) != 0;
+    return FIELD_EX32_IDREG(id, ID_PFR0, DIT) != 0;
 }
 
 static inline bool isar_feature_aa32_ssbs(const ARMISARegisters *id)
 {
-    return FIELD_EX32(id->id_pfr2, ID_PFR2, SSBS) != 0;
+    return FIELD_EX32_IDREG(id, ID_PFR2, SSBS) != 0;
 }
 
 static inline bool isar_feature_aa32_debugv7p1(const ARMISARegisters *id)
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index cf811e47d9..62c06c7269 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -2317,7 +2317,7 @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
          * Disable the security extension feature bits in the processor
          * feature registers as well.
          */
-        cpu->isar.id_pfr1 = FIELD_DP32(cpu->isar.id_pfr1, ID_PFR1, SECURITY, 0);
+        FIELD_DP32_IDREG(isar, ID_PFR1, SECURITY, 0);
         cpu->isar.id_dfr0 = FIELD_DP32(cpu->isar.id_dfr0, ID_DFR0, COPSDBG, 0);
         FIELD_DP64_IDREG(isar, ID_AA64PFR0, EL3, 0);
 
@@ -2357,8 +2357,7 @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
          * registers if we don't have EL2.
          */
         FIELD_DP64_IDREG(isar, ID_AA64PFR0, EL2, 0);
-        cpu->isar.id_pfr1 = FIELD_DP32(cpu->isar.id_pfr1,
-                                       ID_PFR1, VIRTUALIZATION, 0);
+        FIELD_DP32_IDREG(isar, ID_PFR1, VIRTUALIZATION, 0);
     }
 
     if (cpu_isar_feature(aa64_mte, cpu)) {
@@ -2421,8 +2420,7 @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
             FIELD_DP32(cpu->isar.id_dfr0, ID_DFR0, MMAPTRC, 0);
         /* FEAT_AMU (Activity Monitors Extension) */
         FIELD_DP64_IDREG(isar, ID_AA64PFR0, AMU, 0);
-        cpu->isar.id_pfr0 =
-            FIELD_DP32(cpu->isar.id_pfr0, ID_PFR0, AMU, 0);
+        FIELD_DP32_IDREG(isar, ID_PFR0, AMU, 0);
         /* FEAT_MPAM (Memory Partitioning and Monitoring Extension) */
         FIELD_DP64_IDREG(isar, ID_AA64PFR0, MPAM, 0);
     }
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index 353c18e679..30401926e1 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -1056,9 +1056,6 @@ struct ArchCPU {
         uint32_t id_mmfr3;
         uint32_t id_mmfr4;
         uint32_t id_mmfr5;
-        uint32_t id_pfr0;
-        uint32_t id_pfr1;
-        uint32_t id_pfr2;
         uint32_t mvfr0;
         uint32_t mvfr1;
         uint32_t mvfr2;
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index 6be62c0711..5b628aa7eb 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -652,8 +652,8 @@ static void aarch64_a57_initfn(Object *obj)
     cpu->isar.mvfr2 = 0x00000043;
     cpu->ctr = 0x8444c004;
     cpu->reset_sctlr = 0x00c50838;
-    cpu->isar.id_pfr0 = 0x00000131;
-    cpu->isar.id_pfr1 = 0x00011011;
+    SET_IDREG(isar, ID_PFR0, 0x00000131);
+    SET_IDREG(isar, ID_PFR1, 0x00011011);
     cpu->isar.id_dfr0 = 0x03010066;
     cpu->id_afr0 = 0x00000000;
     cpu->isar.id_mmfr0 = 0x10101105;
@@ -714,8 +714,8 @@ static void aarch64_a53_initfn(Object *obj)
     cpu->isar.mvfr2 = 0x00000043;
     cpu->ctr = 0x84448004; /* L1Ip = VIPT */
     cpu->reset_sctlr = 0x00c50838;
-    cpu->isar.id_pfr0 = 0x00000131;
-    cpu->isar.id_pfr1 = 0x00011011;
+    SET_IDREG(isar, ID_PFR0, 0x00000131);
+    SET_IDREG(isar, ID_PFR1, 0x00011011);
     cpu->isar.id_dfr0 = 0x03010066;
     cpu->id_afr0 = 0x00000000;
     cpu->isar.id_mmfr0 = 0x10101105;
diff --git a/target/arm/helper.c b/target/arm/helper.c
index 7e0b3f164e..0329923822 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -6932,7 +6932,7 @@ static void define_pmu_regs(ARMCPU *cpu)
 static uint64_t id_pfr1_read(CPUARMState *env, const ARMCPRegInfo *ri)
 {
     ARMCPU *cpu = env_archcpu(env);
-    uint64_t pfr1 = cpu->isar.id_pfr1;
+    uint64_t pfr1 = GET_IDREG(&cpu->isar, ID_PFR1);
 
     if (env->gicv3state) {
         pfr1 |= 1 << 28;
@@ -7777,7 +7777,7 @@ void register_cp_regs_for_features(ARMCPU *cpu)
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0,
               .access = PL1_R, .type = ARM_CP_CONST,
               .accessfn = access_aa32_tid3,
-              .resetvalue = cpu->isar.id_pfr0 },
+              .resetvalue = GET_IDREG(isar, ID_PFR0)},
             /*
              * ID_PFR1 is not a plain ARM_CP_CONST because we don't know
              * the value of the GIC field until after we define these regs.
@@ -7788,7 +7788,7 @@ void register_cp_regs_for_features(ARMCPU *cpu)
               .accessfn = access_aa32_tid3,
 #ifdef CONFIG_USER_ONLY
               .type = ARM_CP_CONST,
-              .resetvalue = cpu->isar.id_pfr1,
+              .resetvalue = GET_IDREG(isar, ID_PFR1),
 #else
               .type = ARM_CP_NO_RAW,
               .accessfn = access_aa32_tid3,
@@ -8130,7 +8130,7 @@ void register_cp_regs_for_features(ARMCPU *cpu)
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 4,
               .access = PL1_R, .type = ARM_CP_CONST,
               .accessfn = access_aa64_tid3,
-              .resetvalue = cpu->isar.id_pfr2 },
+              .resetvalue = GET_IDREG(isar, ID_PFR2)},
             { .name = "ID_DFR1", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 5,
               .access = PL1_R, .type = ARM_CP_CONST,
diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index eef9481737..d945e652b3 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -332,10 +332,8 @@ static bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
          * than skipping the reads and leaving 0, as we must avoid
          * considering the values in every case.
          */
-        err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_pfr0,
-                              ARM64_SYS_REG(3, 0, 0, 1, 0));
-        err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_pfr1,
-                              ARM64_SYS_REG(3, 0, 0, 1, 1));
+        err |= get_host_cpu_reg(fd, ahcf, ID_PFR0_EL1_IDX);
+        err |= get_host_cpu_reg(fd, ahcf, ID_PFR1_EL1_IDX);
         err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_dfr0,
                               ARM64_SYS_REG(3, 0, 0, 1, 2));
         err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_mmfr0,
@@ -362,8 +360,7 @@ static bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
                               ARM64_SYS_REG(3, 0, 0, 3, 1));
         err |= read_sys_reg32(fdarray[2], &ahcf->isar.mvfr2,
                               ARM64_SYS_REG(3, 0, 0, 3, 2));
-        err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_pfr2,
-                              ARM64_SYS_REG(3, 0, 0, 3, 4));
+        err |= get_host_cpu_reg(fd, ahcf, ID_PFR2_EL1_IDX);
         err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_dfr1,
                               ARM64_SYS_REG(3, 0, 0, 3, 5));
         err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_mmfr5,
diff --git a/target/arm/tcg/cpu-v7m.c b/target/arm/tcg/cpu-v7m.c
index 198c9f3e98..4a2c3bd01a 100644
--- a/target/arm/tcg/cpu-v7m.c
+++ b/target/arm/tcg/cpu-v7m.c
@@ -59,8 +59,8 @@ static void cortex_m0_initfn(Object *obj)
      * by looking at ID register fields. We use the same values as
      * for the M3.
      */
-    cpu->isar.id_pfr0 = 0x00000030;
-    cpu->isar.id_pfr1 = 0x00000200;
+    SET_IDREG(isar, ID_PFR0, 0x00000030);
+    SET_IDREG(isar, ID_PFR1, 0x00000200);
     cpu->isar.id_dfr0 = 0x00100000;
     cpu->id_afr0 = 0x00000000;
     cpu->isar.id_mmfr0 = 0x00000030;
@@ -85,8 +85,8 @@ static void cortex_m3_initfn(Object *obj)
     set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
     cpu->midr = 0x410fc231;
     cpu->pmsav7_dregion = 8;
-    cpu->isar.id_pfr0 = 0x00000030;
-    cpu->isar.id_pfr1 = 0x00000200;
+    SET_IDREG(isar, ID_PFR0, 0x00000030);
+    SET_IDREG(isar, ID_PFR1, 0x00000200);
     cpu->isar.id_dfr0 = 0x00100000;
     cpu->id_afr0 = 0x00000000;
     cpu->isar.id_mmfr0 = 0x00000030;
@@ -116,8 +116,8 @@ static void cortex_m4_initfn(Object *obj)
     cpu->isar.mvfr0 = 0x10110021;
     cpu->isar.mvfr1 = 0x11000011;
     cpu->isar.mvfr2 = 0x00000000;
-    cpu->isar.id_pfr0 = 0x00000030;
-    cpu->isar.id_pfr1 = 0x00000200;
+    SET_IDREG(isar, ID_PFR0, 0x00000030);
+    SET_IDREG(isar, ID_PFR1, 0x00000200);
     cpu->isar.id_dfr0 = 0x00100000;
     cpu->id_afr0 = 0x00000000;
     cpu->isar.id_mmfr0 = 0x00000030;
@@ -147,8 +147,8 @@ static void cortex_m7_initfn(Object *obj)
     cpu->isar.mvfr0 = 0x10110221;
     cpu->isar.mvfr1 = 0x12000011;
     cpu->isar.mvfr2 = 0x00000040;
-    cpu->isar.id_pfr0 = 0x00000030;
-    cpu->isar.id_pfr1 = 0x00000200;
+    SET_IDREG(isar, ID_PFR0, 0x00000030);
+    SET_IDREG(isar, ID_PFR1, 0x00000200);
     cpu->isar.id_dfr0 = 0x00100000;
     cpu->id_afr0 = 0x00000000;
     cpu->isar.id_mmfr0 = 0x00100030;
@@ -180,8 +180,8 @@ static void cortex_m33_initfn(Object *obj)
     cpu->isar.mvfr0 = 0x10110021;
     cpu->isar.mvfr1 = 0x11000011;
     cpu->isar.mvfr2 = 0x00000040;
-    cpu->isar.id_pfr0 = 0x00000030;
-    cpu->isar.id_pfr1 = 0x00000210;
+    SET_IDREG(isar, ID_PFR0, 0x00000030);
+    SET_IDREG(isar, ID_PFR1, 0x00000210);
     cpu->isar.id_dfr0 = 0x00200000;
     cpu->id_afr0 = 0x00000000;
     cpu->isar.id_mmfr0 = 0x00101F40;
@@ -218,8 +218,8 @@ static void cortex_m55_initfn(Object *obj)
     cpu->isar.mvfr0 = 0x10110221;
     cpu->isar.mvfr1 = 0x12100211;
     cpu->isar.mvfr2 = 0x00000040;
-    cpu->isar.id_pfr0 = 0x20000030;
-    cpu->isar.id_pfr1 = 0x00000230;
+    SET_IDREG(isar, ID_PFR0, 0x20000030);
+    SET_IDREG(isar, ID_PFR1, 0x00000230);
     cpu->isar.id_dfr0 = 0x10200000;
     cpu->id_afr0 = 0x00000000;
     cpu->isar.id_mmfr0 = 0x00111040;
diff --git a/target/arm/tcg/cpu32.c b/target/arm/tcg/cpu32.c
index 937a72b12c..56374db269 100644
--- a/target/arm/tcg/cpu32.c
+++ b/target/arm/tcg/cpu32.c
@@ -71,16 +71,16 @@ void aa32_max_features(ARMCPU *cpu)
     t = FIELD_DP32(t, ID_MMFR5, ETS, 2);          /* FEAT_ETS2 */
     cpu->isar.id_mmfr5 = t;
 
-    t = cpu->isar.id_pfr0;
+    t = GET_IDREG(isar, ID_PFR0);
     t = FIELD_DP32(t, ID_PFR0, CSV2, 2);          /* FEAT_CSV2 */
     t = FIELD_DP32(t, ID_PFR0, DIT, 1);           /* FEAT_DIT */
     t = FIELD_DP32(t, ID_PFR0, RAS, 1);           /* FEAT_RAS */
-    cpu->isar.id_pfr0 = t;
+    SET_IDREG(isar, ID_PFR0, t);
 
-    t = cpu->isar.id_pfr2;
+    t = GET_IDREG(isar, ID_PFR2);
     t = FIELD_DP32(t, ID_PFR2, CSV3, 1);          /* FEAT_CSV3 */
     t = FIELD_DP32(t, ID_PFR2, SSBS, 1);          /* FEAT_SSBS */
-    cpu->isar.id_pfr2 = t;
+    SET_IDREG(isar, ID_PFR2, t);
 
     t = cpu->isar.id_dfr0;
     t = FIELD_DP32(t, ID_DFR0, COPDBG, 10);       /* FEAT_Debugv8p8 */
@@ -228,8 +228,8 @@ static void arm1136_r2_initfn(Object *obj)
     cpu->isar.mvfr1 = 0x00000000;
     cpu->ctr = 0x1dd20d2;
     cpu->reset_sctlr = 0x00050078;
-    cpu->isar.id_pfr0 = 0x111;
-    cpu->isar.id_pfr1 = 0x1;
+    SET_IDREG(isar, ID_PFR0, 0x111);
+    SET_IDREG(isar, ID_PFR1, 0x1);
     cpu->isar.id_dfr0 = 0x2;
     cpu->id_afr0 = 0x3;
     cpu->isar.id_mmfr0 = 0x01130003;
@@ -260,8 +260,8 @@ static void arm1136_initfn(Object *obj)
     cpu->isar.mvfr1 = 0x00000000;
     cpu->ctr = 0x1dd20d2;
     cpu->reset_sctlr = 0x00050078;
-    cpu->isar.id_pfr0 = 0x111;
-    cpu->isar.id_pfr1 = 0x1;
+    SET_IDREG(isar, ID_PFR0, 0x111);
+    SET_IDREG(isar, ID_PFR1, 0x1);
     cpu->isar.id_dfr0 = 0x2;
     cpu->id_afr0 = 0x3;
     cpu->isar.id_mmfr0 = 0x01130003;
@@ -293,8 +293,8 @@ static void arm1176_initfn(Object *obj)
     cpu->isar.mvfr1 = 0x00000000;
     cpu->ctr = 0x1dd20d2;
     cpu->reset_sctlr = 0x00050078;
-    cpu->isar.id_pfr0 = 0x111;
-    cpu->isar.id_pfr1 = 0x11;
+    SET_IDREG(isar, ID_PFR0, 0x111);
+    SET_IDREG(isar, ID_PFR1, 0x11);
     cpu->isar.id_dfr0 = 0x33;
     cpu->id_afr0 = 0;
     cpu->isar.id_mmfr0 = 0x01130003;
@@ -323,8 +323,8 @@ static void arm11mpcore_initfn(Object *obj)
     cpu->isar.mvfr0 = 0x11111111;
     cpu->isar.mvfr1 = 0x00000000;
     cpu->ctr = 0x1d192992; /* 32K icache 32K dcache */
-    cpu->isar.id_pfr0 = 0x111;
-    cpu->isar.id_pfr1 = 0x1;
+    SET_IDREG(isar, ID_PFR0, 0x111);
+    SET_IDREG(isar, ID_PFR1, 0x1);
     cpu->isar.id_dfr0 = 0;
     cpu->id_afr0 = 0x2;
     cpu->isar.id_mmfr0 = 0x01100103;
@@ -363,8 +363,8 @@ static void cortex_a8_initfn(Object *obj)
     cpu->isar.mvfr1 = 0x00011111;
     cpu->ctr = 0x82048004;
     cpu->reset_sctlr = 0x00c50078;
-    cpu->isar.id_pfr0 = 0x1031;
-    cpu->isar.id_pfr1 = 0x11;
+    SET_IDREG(isar, ID_PFR0, 0x1031);
+    SET_IDREG(isar, ID_PFR1, 0x11);
     cpu->isar.id_dfr0 = 0x400;
     cpu->id_afr0 = 0;
     cpu->isar.id_mmfr0 = 0x31100003;
@@ -439,8 +439,8 @@ static void cortex_a9_initfn(Object *obj)
     cpu->isar.mvfr1 = 0x01111111;
     cpu->ctr = 0x80038003;
     cpu->reset_sctlr = 0x00c50078;
-    cpu->isar.id_pfr0 = 0x1031;
-    cpu->isar.id_pfr1 = 0x11;
+    SET_IDREG(isar, ID_PFR0, 0x1031);
+    SET_IDREG(isar, ID_PFR1, 0x11);
     cpu->isar.id_dfr0 = 0x000;
     cpu->id_afr0 = 0;
     cpu->isar.id_mmfr0 = 0x00100103;
@@ -505,8 +505,8 @@ static void cortex_a7_initfn(Object *obj)
     cpu->isar.mvfr1 = 0x11111111;
     cpu->ctr = 0x84448003;
     cpu->reset_sctlr = 0x00c50078;
-    cpu->isar.id_pfr0 = 0x00001131;
-    cpu->isar.id_pfr1 = 0x00011011;
+    SET_IDREG(isar, ID_PFR0, 0x00001131);
+    SET_IDREG(isar, ID_PFR1, 0x00011011);
     cpu->isar.id_dfr0 = 0x02010555;
     cpu->id_afr0 = 0x00000000;
     cpu->isar.id_mmfr0 = 0x10101105;
@@ -557,8 +557,8 @@ static void cortex_a15_initfn(Object *obj)
     cpu->isar.mvfr1 = 0x11111111;
     cpu->ctr = 0x8444c004;
     cpu->reset_sctlr = 0x00c50078;
-    cpu->isar.id_pfr0 = 0x00001131;
-    cpu->isar.id_pfr1 = 0x00011011;
+    SET_IDREG(isar, ID_PFR0, 0x00001131);
+    SET_IDREG(isar, ID_PFR1, 0x00011011);
     cpu->isar.id_dfr0 = 0x02010555;
     cpu->id_afr0 = 0x00000000;
     cpu->isar.id_mmfr0 = 0x10201105;
@@ -601,8 +601,8 @@ static void cortex_r5_initfn(Object *obj)
     set_feature(&cpu->env, ARM_FEATURE_PMSA);
     set_feature(&cpu->env, ARM_FEATURE_PMU);
     cpu->midr = 0x411fc153; /* r1p3 */
-    cpu->isar.id_pfr0 = 0x0131;
-    cpu->isar.id_pfr1 = 0x001;
+    SET_IDREG(isar, ID_PFR0, 0x0131);
+    SET_IDREG(isar, ID_PFR1, 0x001);
     cpu->isar.id_dfr0 = 0x010400;
     cpu->id_afr0 = 0x0;
     cpu->isar.id_mmfr0 = 0x0210030;
@@ -748,8 +748,8 @@ static void cortex_r52_initfn(Object *obj)
     cpu->isar.mvfr2 = 0x00000043;
     cpu->ctr = 0x8144c004;
     cpu->reset_sctlr = 0x30c50838;
-    cpu->isar.id_pfr0 = 0x00000131;
-    cpu->isar.id_pfr1 = 0x10111001;
+    SET_IDREG(isar, ID_PFR0, 0x00000131);
+    SET_IDREG(isar, ID_PFR1, 0x10111001);
     cpu->isar.id_dfr0 = 0x03010006;
     cpu->id_afr0 = 0x00000000;
     cpu->isar.id_mmfr0 = 0x00211040;
@@ -980,8 +980,8 @@ static void arm_max_initfn(Object *obj)
     cpu->isar.mvfr2 = 0x00000043;
     cpu->ctr = 0x8444c004;
     cpu->reset_sctlr = 0x00c50838;
-    cpu->isar.id_pfr0 = 0x00000131;
-    cpu->isar.id_pfr1 = 0x00011011;
+    SET_IDREG(isar, ID_PFR0, 0x00000131);
+    SET_IDREG(isar, ID_PFR1, 0x00011011);
     cpu->isar.id_dfr0 = 0x03010066;
     cpu->id_afr0 = 0x00000000;
     cpu->isar.id_mmfr0 = 0x10101105;
diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
index dd4dc8ada5..c3f90e9d13 100644
--- a/target/arm/tcg/cpu64.c
+++ b/target/arm/tcg/cpu64.c
@@ -49,8 +49,8 @@ static void aarch64_a35_initfn(Object *obj)
     cpu->midr = 0x411fd040;
     cpu->revidr = 0;
     cpu->ctr = 0x84448004;
-    cpu->isar.id_pfr0 = 0x00000131;
-    cpu->isar.id_pfr1 = 0x00011011;
+    SET_IDREG(isar, ID_PFR0, 0x00000131);
+    SET_IDREG(isar, ID_PFR1, 0x00011011);
     cpu->isar.id_dfr0 = 0x03010066;
     cpu->id_afr0 = 0;
     cpu->isar.id_mmfr0 = 0x10201105;
@@ -241,9 +241,9 @@ static void aarch64_a55_initfn(Object *obj)
     cpu->isar.id_mmfr2 = 0x01260000;
     cpu->isar.id_mmfr3 = 0x02122211;
     cpu->isar.id_mmfr4 = 0x00021110;
-    cpu->isar.id_pfr0  = 0x10010131;
-    cpu->isar.id_pfr1  = 0x00011011;
-    cpu->isar.id_pfr2  = 0x00000011;
+    SET_IDREG(isar, ID_PFR0, 0x10010131);
+    SET_IDREG(isar, ID_PFR1, 0x00011011);
+    SET_IDREG(isar, ID_PFR2, 0x00000011);
     cpu->midr = 0x412FD050;          /* r2p0 */
     cpu->revidr = 0;
 
@@ -295,8 +295,8 @@ static void aarch64_a72_initfn(Object *obj)
     cpu->isar.mvfr2 = 0x00000043;
     cpu->ctr = 0x8444c004;
     cpu->reset_sctlr = 0x00c50838;
-    cpu->isar.id_pfr0 = 0x00000131;
-    cpu->isar.id_pfr1 = 0x00011011;
+    SET_IDREG(isar, ID_PFR0, 0x00000131);
+    SET_IDREG(isar, ID_PFR1, 0x00011011);
     cpu->isar.id_dfr0 = 0x03010066;
     cpu->id_afr0 = 0x00000000;
     cpu->isar.id_mmfr0 = 0x10201105;
@@ -374,9 +374,9 @@ static void aarch64_a76_initfn(Object *obj)
     cpu->isar.id_mmfr2 = 0x01260000;
     cpu->isar.id_mmfr3 = 0x02122211;
     cpu->isar.id_mmfr4 = 0x00021110;
-    cpu->isar.id_pfr0  = 0x10010131;
-    cpu->isar.id_pfr1  = 0x00010000; /* GIC filled in later */
-    cpu->isar.id_pfr2  = 0x00000011;
+    SET_IDREG(isar, ID_PFR0, 0x10010131);
+    SET_IDREG(isar, ID_PFR1, 0x00010000); /* GIC filled in later */
+    SET_IDREG(isar, ID_PFR2, 0x00000011);
     cpu->midr = 0x414fd0b1;          /* r4p1 */
     cpu->revidr = 0;
 
@@ -622,9 +622,9 @@ static void aarch64_neoverse_n1_initfn(Object *obj)
     cpu->isar.id_mmfr2 = 0x01260000;
     cpu->isar.id_mmfr3 = 0x02122211;
     cpu->isar.id_mmfr4 = 0x00021110;
-    cpu->isar.id_pfr0  = 0x10010131;
-    cpu->isar.id_pfr1  = 0x00010000; /* GIC filled in later */
-    cpu->isar.id_pfr2  = 0x00000011;
+    SET_IDREG(isar, ID_PFR0, 0x10010131);
+    SET_IDREG(isar, ID_PFR1, 0x00010000); /* GIC filled in later */
+    SET_IDREG(isar, ID_PFR2, 0x00000011);
     cpu->midr = 0x414fd0c1;          /* r4p1 */
     cpu->revidr = 0;
 
@@ -701,9 +701,9 @@ static void aarch64_neoverse_v1_initfn(Object *obj)
     cpu->isar.id_mmfr2 = 0x01260000;
     cpu->isar.id_mmfr3 = 0x02122211;
     cpu->isar.id_mmfr4 = 0x01021110;
-    cpu->isar.id_pfr0  = 0x21110131;
-    cpu->isar.id_pfr1  = 0x00010000; /* GIC filled in later */
-    cpu->isar.id_pfr2  = 0x00000011;
+    SET_IDREG(isar, ID_PFR0, 0x21110131);
+    SET_IDREG(isar, ID_PFR1, 0x00010000); /* GIC filled in later */
+    SET_IDREG(isar, ID_PFR2, 0x00000011);
     cpu->midr = 0x411FD402;          /* r1p2 */
     cpu->revidr = 0;
 
@@ -902,8 +902,8 @@ static void aarch64_a710_initfn(Object *obj)
     /* Ordered by Section B.4: AArch64 registers */
     cpu->midr          = 0x412FD471; /* r2p1 */
     cpu->revidr        = 0;
-    cpu->isar.id_pfr0  = 0x21110131;
-    cpu->isar.id_pfr1  = 0x00010000; /* GIC filled in later */
+    SET_IDREG(isar, ID_PFR0, 0x21110131);
+    SET_IDREG(isar, ID_PFR1, 0x00010000); /* GIC filled in later */
     cpu->isar.id_dfr0  = 0x16011099;
     cpu->id_afr0       = 0;
     cpu->isar.id_mmfr0 = 0x10201105;
@@ -921,7 +921,7 @@ static void aarch64_a710_initfn(Object *obj)
     cpu->isar.mvfr0    = 0x10110222;
     cpu->isar.mvfr1    = 0x13211111;
     cpu->isar.mvfr2    = 0x00000043;
-    cpu->isar.id_pfr2  = 0x00000011;
+    SET_IDREG(isar, ID_PFR2, 0x00000011);
     SET_IDREG(isar, ID_AA64PFR0, 0x1201111120111112ull); /* GIC filled in later */
     SET_IDREG(isar, ID_AA64PFR1, 0x0000000000000221ull);
     SET_IDREG(isar, ID_AA64ZFR0, 0x0000110100110021ull); /* with Crypto */
@@ -1004,8 +1004,8 @@ static void aarch64_neoverse_n2_initfn(Object *obj)
     /* Ordered by Section B.5: AArch64 ID registers */
     cpu->midr          = 0x410FD493; /* r0p3 */
     cpu->revidr        = 0;
-    cpu->isar.id_pfr0  = 0x21110131;
-    cpu->isar.id_pfr1  = 0x00010000; /* GIC filled in later */
+    SET_IDREG(isar, ID_PFR0, 0x21110131);
+    SET_IDREG(isar, ID_PFR1, 0x00010000); /* GIC filled in later */
     cpu->isar.id_dfr0  = 0x16011099;
     cpu->id_afr0       = 0;
     cpu->isar.id_mmfr0 = 0x10201105;
@@ -1023,7 +1023,7 @@ static void aarch64_neoverse_n2_initfn(Object *obj)
     cpu->isar.mvfr0    = 0x10110222;
     cpu->isar.mvfr1    = 0x13211111;
     cpu->isar.mvfr2    = 0x00000043;
-    cpu->isar.id_pfr2  = 0x00000011;
+    SET_IDREG(isar, ID_PFR2, 0x00000011);
     SET_IDREG(isar, ID_AA64PFR0, 0x1201111120111112ull); /* GIC filled in later */
     SET_IDREG(isar, ID_AA64PFR1, 0x0000000000000221ull);
     SET_IDREG(isar, ID_AA64ZFR0, 0x0000110100110021ull); /* with Crypto */

From 33801d9bd0947042f223966bbb04f7528e1443f2 Mon Sep 17 00:00:00 2001
From: Eric Auger <eric.auger@redhat.com>
Date: Tue, 1 Jul 2025 15:08:28 +0100
Subject: [PATCH 1736/2760] arm/cpu: Store id_dfr0/1 into the idregs array

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Sebastian Ott <sebott@redhat.com>
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Cornelia Huck <cohuck@redhat.com>
Message-id: 20250617153931.1330449-11-cohuck@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/intc/armv7m_nvic.c     |  2 +-
 target/arm/cpu-features.h | 16 ++++++++--------
 target/arm/cpu.c          | 13 +++++--------
 target/arm/cpu.h          |  2 --
 target/arm/cpu64.c        |  4 ++--
 target/arm/helper.c       |  4 ++--
 target/arm/kvm.c          |  6 ++----
 target/arm/tcg/cpu-v7m.c  | 12 ++++++------
 target/arm/tcg/cpu32.c    | 30 ++++++++++++++----------------
 target/arm/tcg/cpu64.c    | 16 ++++++++--------
 10 files changed, 48 insertions(+), 57 deletions(-)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index 330205fa34..2566dd6343 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -1274,7 +1274,7 @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
         if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
             goto bad_offset;
         }
-        return cpu->isar.id_dfr0;
+        return GET_IDREG(isar, ID_DFR0);
     case 0xd4c: /* AFR0.  */
         if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
             goto bad_offset;
diff --git a/target/arm/cpu-features.h b/target/arm/cpu-features.h
index a34378577f..0292a7cd6e 100644
--- a/target/arm/cpu-features.h
+++ b/target/arm/cpu-features.h
@@ -300,22 +300,22 @@ static inline bool isar_feature_aa32_ats1e1(const ARMISARegisters *id)
 static inline bool isar_feature_aa32_pmuv3p1(const ARMISARegisters *id)
 {
     /* 0xf means "non-standard IMPDEF PMU" */
-    return FIELD_EX32(id->id_dfr0, ID_DFR0, PERFMON) >= 4 &&
-        FIELD_EX32(id->id_dfr0, ID_DFR0, PERFMON) != 0xf;
+    return FIELD_EX32_IDREG(id, ID_DFR0, PERFMON) >= 4 &&
+        FIELD_EX32_IDREG(id, ID_DFR0, PERFMON) != 0xf;
 }
 
 static inline bool isar_feature_aa32_pmuv3p4(const ARMISARegisters *id)
 {
     /* 0xf means "non-standard IMPDEF PMU" */
-    return FIELD_EX32(id->id_dfr0, ID_DFR0, PERFMON) >= 5 &&
-        FIELD_EX32(id->id_dfr0, ID_DFR0, PERFMON) != 0xf;
+    return FIELD_EX32_IDREG(id, ID_DFR0, PERFMON) >= 5 &&
+        FIELD_EX32_IDREG(id, ID_DFR0, PERFMON) != 0xf;
 }
 
 static inline bool isar_feature_aa32_pmuv3p5(const ARMISARegisters *id)
 {
     /* 0xf means "non-standard IMPDEF PMU" */
-    return FIELD_EX32(id->id_dfr0, ID_DFR0, PERFMON) >= 6 &&
-        FIELD_EX32(id->id_dfr0, ID_DFR0, PERFMON) != 0xf;
+    return FIELD_EX32_IDREG(id, ID_DFR0, PERFMON) >= 6 &&
+        FIELD_EX32_IDREG(id, ID_DFR0, PERFMON) != 0xf;
 }
 
 static inline bool isar_feature_aa32_hpd(const ARMISARegisters *id)
@@ -360,12 +360,12 @@ static inline bool isar_feature_aa32_ssbs(const ARMISARegisters *id)
 
 static inline bool isar_feature_aa32_debugv7p1(const ARMISARegisters *id)
 {
-    return FIELD_EX32(id->id_dfr0, ID_DFR0, COPDBG) >= 5;
+    return FIELD_EX32_IDREG(id, ID_DFR0, COPDBG) >= 5;
 }
 
 static inline bool isar_feature_aa32_debugv8p2(const ARMISARegisters *id)
 {
-    return FIELD_EX32(id->id_dfr0, ID_DFR0, COPDBG) >= 8;
+    return FIELD_EX32_IDREG(id, ID_DFR0, COPDBG) >= 8;
 }
 
 static inline bool isar_feature_aa32_doublelock(const ARMISARegisters *id)
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index 62c06c7269..8e77414c2b 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -2318,7 +2318,7 @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
          * feature registers as well.
          */
         FIELD_DP32_IDREG(isar, ID_PFR1, SECURITY, 0);
-        cpu->isar.id_dfr0 = FIELD_DP32(cpu->isar.id_dfr0, ID_DFR0, COPSDBG, 0);
+        FIELD_DP32_IDREG(isar, ID_DFR0, COPSDBG, 0);
         FIELD_DP64_IDREG(isar, ID_AA64PFR0, EL3, 0);
 
         /* Disable the realm management extension, which requires EL3. */
@@ -2346,7 +2346,7 @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
 #endif
     } else {
         FIELD_DP64_IDREG(isar, ID_AA64DFR0, PMUVER, 0);
-        cpu->isar.id_dfr0 = FIELD_DP32(cpu->isar.id_dfr0, ID_DFR0, PERFMON, 0);
+        FIELD_DP32_IDREG(isar, ID_DFR0, PERFMON, 0);
         cpu->pmceid0 = 0;
         cpu->pmceid1 = 0;
     }
@@ -2409,15 +2409,12 @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
         FIELD_DP64_IDREG(isar, ID_AA64DFR0, TRACEBUFFER, 0);
         /* FEAT_TRF (Self-hosted Trace Extension) */
         FIELD_DP64_IDREG(isar, ID_AA64DFR0, TRACEFILT, 0);
-        cpu->isar.id_dfr0 =
-            FIELD_DP32(cpu->isar.id_dfr0, ID_DFR0, TRACEFILT, 0);
+        FIELD_DP32_IDREG(isar, ID_DFR0, TRACEFILT, 0);
         /* Trace Macrocell system register access */
         FIELD_DP64_IDREG(isar, ID_AA64DFR0, TRACEVER, 0);
-        cpu->isar.id_dfr0 =
-            FIELD_DP32(cpu->isar.id_dfr0, ID_DFR0, COPTRC, 0);
+        FIELD_DP32_IDREG(isar, ID_DFR0, COPTRC, 0);
         /* Memory mapped trace */
-        cpu->isar.id_dfr0 =
-            FIELD_DP32(cpu->isar.id_dfr0, ID_DFR0, MMAPTRC, 0);
+        FIELD_DP32_IDREG(isar, ID_DFR0, MMAPTRC, 0);
         /* FEAT_AMU (Activity Monitors Extension) */
         FIELD_DP64_IDREG(isar, ID_AA64PFR0, AMU, 0);
         FIELD_DP32_IDREG(isar, ID_PFR0, AMU, 0);
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index 30401926e1..c799105eeb 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -1059,8 +1059,6 @@ struct ArchCPU {
         uint32_t mvfr0;
         uint32_t mvfr1;
         uint32_t mvfr2;
-        uint32_t id_dfr0;
-        uint32_t id_dfr1;
         uint32_t dbgdidr;
         uint32_t dbgdevid;
         uint32_t dbgdevid1;
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index 5b628aa7eb..47c2eed3c9 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -654,7 +654,7 @@ static void aarch64_a57_initfn(Object *obj)
     cpu->reset_sctlr = 0x00c50838;
     SET_IDREG(isar, ID_PFR0, 0x00000131);
     SET_IDREG(isar, ID_PFR1, 0x00011011);
-    cpu->isar.id_dfr0 = 0x03010066;
+    SET_IDREG(isar, ID_DFR0, 0x03010066);
     cpu->id_afr0 = 0x00000000;
     cpu->isar.id_mmfr0 = 0x10101105;
     cpu->isar.id_mmfr1 = 0x40000000;
@@ -716,7 +716,7 @@ static void aarch64_a53_initfn(Object *obj)
     cpu->reset_sctlr = 0x00c50838;
     SET_IDREG(isar, ID_PFR0, 0x00000131);
     SET_IDREG(isar, ID_PFR1, 0x00011011);
-    cpu->isar.id_dfr0 = 0x03010066;
+    SET_IDREG(isar, ID_DFR0, 0x03010066);
     cpu->id_afr0 = 0x00000000;
     cpu->isar.id_mmfr0 = 0x10101105;
     cpu->isar.id_mmfr1 = 0x40000000;
diff --git a/target/arm/helper.c b/target/arm/helper.c
index 0329923822..4d90ff7fd5 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -7800,7 +7800,7 @@ void register_cp_regs_for_features(ARMCPU *cpu)
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 2,
               .access = PL1_R, .type = ARM_CP_CONST,
               .accessfn = access_aa32_tid3,
-              .resetvalue = cpu->isar.id_dfr0 },
+              .resetvalue = GET_IDREG(isar, ID_DFR0)},
             { .name = "ID_AFR0", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 3,
               .access = PL1_R, .type = ARM_CP_CONST,
@@ -8135,7 +8135,7 @@ void register_cp_regs_for_features(ARMCPU *cpu)
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 5,
               .access = PL1_R, .type = ARM_CP_CONST,
               .accessfn = access_aa64_tid3,
-              .resetvalue = cpu->isar.id_dfr1 },
+              .resetvalue = GET_IDREG(isar, ID_DFR1)},
             { .name = "ID_MMFR5", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 6,
               .access = PL1_R, .type = ARM_CP_CONST,
diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index d945e652b3..2a6a5329b4 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -334,8 +334,7 @@ static bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
          */
         err |= get_host_cpu_reg(fd, ahcf, ID_PFR0_EL1_IDX);
         err |= get_host_cpu_reg(fd, ahcf, ID_PFR1_EL1_IDX);
-        err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_dfr0,
-                              ARM64_SYS_REG(3, 0, 0, 1, 2));
+        err |= get_host_cpu_reg(fd, ahcf, ID_DFR0_EL1_IDX);
         err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_mmfr0,
                               ARM64_SYS_REG(3, 0, 0, 1, 4));
         err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_mmfr1,
@@ -361,8 +360,7 @@ static bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
         err |= read_sys_reg32(fdarray[2], &ahcf->isar.mvfr2,
                               ARM64_SYS_REG(3, 0, 0, 3, 2));
         err |= get_host_cpu_reg(fd, ahcf, ID_PFR2_EL1_IDX);
-        err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_dfr1,
-                              ARM64_SYS_REG(3, 0, 0, 3, 5));
+        err |= get_host_cpu_reg(fd, ahcf, ID_DFR1_EL1_IDX);
         err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_mmfr5,
                               ARM64_SYS_REG(3, 0, 0, 3, 6));
 
diff --git a/target/arm/tcg/cpu-v7m.c b/target/arm/tcg/cpu-v7m.c
index 4a2c3bd01a..9697c362c1 100644
--- a/target/arm/tcg/cpu-v7m.c
+++ b/target/arm/tcg/cpu-v7m.c
@@ -61,7 +61,7 @@ static void cortex_m0_initfn(Object *obj)
      */
     SET_IDREG(isar, ID_PFR0, 0x00000030);
     SET_IDREG(isar, ID_PFR1, 0x00000200);
-    cpu->isar.id_dfr0 = 0x00100000;
+    SET_IDREG(isar, ID_DFR0, 0x00100000);
     cpu->id_afr0 = 0x00000000;
     cpu->isar.id_mmfr0 = 0x00000030;
     cpu->isar.id_mmfr1 = 0x00000000;
@@ -87,7 +87,7 @@ static void cortex_m3_initfn(Object *obj)
     cpu->pmsav7_dregion = 8;
     SET_IDREG(isar, ID_PFR0, 0x00000030);
     SET_IDREG(isar, ID_PFR1, 0x00000200);
-    cpu->isar.id_dfr0 = 0x00100000;
+    SET_IDREG(isar, ID_DFR0, 0x00100000);
     cpu->id_afr0 = 0x00000000;
     cpu->isar.id_mmfr0 = 0x00000030;
     cpu->isar.id_mmfr1 = 0x00000000;
@@ -118,7 +118,7 @@ static void cortex_m4_initfn(Object *obj)
     cpu->isar.mvfr2 = 0x00000000;
     SET_IDREG(isar, ID_PFR0, 0x00000030);
     SET_IDREG(isar, ID_PFR1, 0x00000200);
-    cpu->isar.id_dfr0 = 0x00100000;
+    SET_IDREG(isar, ID_DFR0, 0x00100000);
     cpu->id_afr0 = 0x00000000;
     cpu->isar.id_mmfr0 = 0x00000030;
     cpu->isar.id_mmfr1 = 0x00000000;
@@ -149,7 +149,7 @@ static void cortex_m7_initfn(Object *obj)
     cpu->isar.mvfr2 = 0x00000040;
     SET_IDREG(isar, ID_PFR0, 0x00000030);
     SET_IDREG(isar, ID_PFR1, 0x00000200);
-    cpu->isar.id_dfr0 = 0x00100000;
+    SET_IDREG(isar, ID_DFR0, 0x00100000);
     cpu->id_afr0 = 0x00000000;
     cpu->isar.id_mmfr0 = 0x00100030;
     cpu->isar.id_mmfr1 = 0x00000000;
@@ -182,7 +182,7 @@ static void cortex_m33_initfn(Object *obj)
     cpu->isar.mvfr2 = 0x00000040;
     SET_IDREG(isar, ID_PFR0, 0x00000030);
     SET_IDREG(isar, ID_PFR1, 0x00000210);
-    cpu->isar.id_dfr0 = 0x00200000;
+    SET_IDREG(isar, ID_DFR0, 0x00200000);
     cpu->id_afr0 = 0x00000000;
     cpu->isar.id_mmfr0 = 0x00101F40;
     cpu->isar.id_mmfr1 = 0x00000000;
@@ -220,7 +220,7 @@ static void cortex_m55_initfn(Object *obj)
     cpu->isar.mvfr2 = 0x00000040;
     SET_IDREG(isar, ID_PFR0, 0x20000030);
     SET_IDREG(isar, ID_PFR1, 0x00000230);
-    cpu->isar.id_dfr0 = 0x10200000;
+    SET_IDREG(isar, ID_DFR0, 0x10200000);
     cpu->id_afr0 = 0x00000000;
     cpu->isar.id_mmfr0 = 0x00111040;
     cpu->isar.id_mmfr1 = 0x00000000;
diff --git a/target/arm/tcg/cpu32.c b/target/arm/tcg/cpu32.c
index 56374db269..bec69fe52e 100644
--- a/target/arm/tcg/cpu32.c
+++ b/target/arm/tcg/cpu32.c
@@ -82,11 +82,11 @@ void aa32_max_features(ARMCPU *cpu)
     t = FIELD_DP32(t, ID_PFR2, SSBS, 1);          /* FEAT_SSBS */
     SET_IDREG(isar, ID_PFR2, t);
 
-    t = cpu->isar.id_dfr0;
+    t = GET_IDREG(isar, ID_DFR0);
     t = FIELD_DP32(t, ID_DFR0, COPDBG, 10);       /* FEAT_Debugv8p8 */
     t = FIELD_DP32(t, ID_DFR0, COPSDBG, 10);      /* FEAT_Debugv8p8 */
     t = FIELD_DP32(t, ID_DFR0, PERFMON, 6);       /* FEAT_PMUv3p5 */
-    cpu->isar.id_dfr0 = t;
+    SET_IDREG(isar, ID_DFR0, t);
 
     /* Debug ID registers. */
 
@@ -116,9 +116,7 @@ void aa32_max_features(ARMCPU *cpu)
     t = FIELD_DP32(t, DBGDEVID1, PCSROFFSET, 2);
     cpu->isar.dbgdevid1 = t;
 
-    t = cpu->isar.id_dfr1;
-    t = FIELD_DP32(t, ID_DFR1, HPMN0, 1);         /* FEAT_HPMN0 */
-    cpu->isar.id_dfr1 = t;
+    FIELD_DP32_IDREG(isar, ID_DFR1, HPMN0, 1);         /* FEAT_HPMN0 */
 }
 
 /* CPU models. These are not needed for the AArch64 linux-user build. */
@@ -230,7 +228,7 @@ static void arm1136_r2_initfn(Object *obj)
     cpu->reset_sctlr = 0x00050078;
     SET_IDREG(isar, ID_PFR0, 0x111);
     SET_IDREG(isar, ID_PFR1, 0x1);
-    cpu->isar.id_dfr0 = 0x2;
+    SET_IDREG(isar, ID_DFR0, 0x2);
     cpu->id_afr0 = 0x3;
     cpu->isar.id_mmfr0 = 0x01130003;
     cpu->isar.id_mmfr1 = 0x10030302;
@@ -262,7 +260,7 @@ static void arm1136_initfn(Object *obj)
     cpu->reset_sctlr = 0x00050078;
     SET_IDREG(isar, ID_PFR0, 0x111);
     SET_IDREG(isar, ID_PFR1, 0x1);
-    cpu->isar.id_dfr0 = 0x2;
+    SET_IDREG(isar, ID_DFR0, 0x2);
     cpu->id_afr0 = 0x3;
     cpu->isar.id_mmfr0 = 0x01130003;
     cpu->isar.id_mmfr1 = 0x10030302;
@@ -295,7 +293,7 @@ static void arm1176_initfn(Object *obj)
     cpu->reset_sctlr = 0x00050078;
     SET_IDREG(isar, ID_PFR0, 0x111);
     SET_IDREG(isar, ID_PFR1, 0x11);
-    cpu->isar.id_dfr0 = 0x33;
+    SET_IDREG(isar, ID_DFR0, 0x33);
     cpu->id_afr0 = 0;
     cpu->isar.id_mmfr0 = 0x01130003;
     cpu->isar.id_mmfr1 = 0x10030302;
@@ -325,7 +323,7 @@ static void arm11mpcore_initfn(Object *obj)
     cpu->ctr = 0x1d192992; /* 32K icache 32K dcache */
     SET_IDREG(isar, ID_PFR0, 0x111);
     SET_IDREG(isar, ID_PFR1, 0x1);
-    cpu->isar.id_dfr0 = 0;
+    SET_IDREG(isar, ID_DFR0, 0);
     cpu->id_afr0 = 0x2;
     cpu->isar.id_mmfr0 = 0x01100103;
     cpu->isar.id_mmfr1 = 0x10020302;
@@ -365,7 +363,7 @@ static void cortex_a8_initfn(Object *obj)
     cpu->reset_sctlr = 0x00c50078;
     SET_IDREG(isar, ID_PFR0, 0x1031);
     SET_IDREG(isar, ID_PFR1, 0x11);
-    cpu->isar.id_dfr0 = 0x400;
+    SET_IDREG(isar, ID_DFR0, 0x400);
     cpu->id_afr0 = 0;
     cpu->isar.id_mmfr0 = 0x31100003;
     cpu->isar.id_mmfr1 = 0x20000000;
@@ -441,7 +439,7 @@ static void cortex_a9_initfn(Object *obj)
     cpu->reset_sctlr = 0x00c50078;
     SET_IDREG(isar, ID_PFR0, 0x1031);
     SET_IDREG(isar, ID_PFR1, 0x11);
-    cpu->isar.id_dfr0 = 0x000;
+    SET_IDREG(isar, ID_DFR0, 0x000);
     cpu->id_afr0 = 0;
     cpu->isar.id_mmfr0 = 0x00100103;
     cpu->isar.id_mmfr1 = 0x20000000;
@@ -507,7 +505,7 @@ static void cortex_a7_initfn(Object *obj)
     cpu->reset_sctlr = 0x00c50078;
     SET_IDREG(isar, ID_PFR0, 0x00001131);
     SET_IDREG(isar, ID_PFR1, 0x00011011);
-    cpu->isar.id_dfr0 = 0x02010555;
+    SET_IDREG(isar, ID_DFR0, 0x02010555);
     cpu->id_afr0 = 0x00000000;
     cpu->isar.id_mmfr0 = 0x10101105;
     cpu->isar.id_mmfr1 = 0x40000000;
@@ -559,7 +557,7 @@ static void cortex_a15_initfn(Object *obj)
     cpu->reset_sctlr = 0x00c50078;
     SET_IDREG(isar, ID_PFR0, 0x00001131);
     SET_IDREG(isar, ID_PFR1, 0x00011011);
-    cpu->isar.id_dfr0 = 0x02010555;
+    SET_IDREG(isar, ID_DFR0, 0x02010555);
     cpu->id_afr0 = 0x00000000;
     cpu->isar.id_mmfr0 = 0x10201105;
     cpu->isar.id_mmfr1 = 0x20000000;
@@ -603,7 +601,7 @@ static void cortex_r5_initfn(Object *obj)
     cpu->midr = 0x411fc153; /* r1p3 */
     SET_IDREG(isar, ID_PFR0, 0x0131);
     SET_IDREG(isar, ID_PFR1, 0x001);
-    cpu->isar.id_dfr0 = 0x010400;
+    SET_IDREG(isar, ID_DFR0, 0x010400);
     cpu->id_afr0 = 0x0;
     cpu->isar.id_mmfr0 = 0x0210030;
     cpu->isar.id_mmfr1 = 0x00000000;
@@ -750,7 +748,7 @@ static void cortex_r52_initfn(Object *obj)
     cpu->reset_sctlr = 0x30c50838;
     SET_IDREG(isar, ID_PFR0, 0x00000131);
     SET_IDREG(isar, ID_PFR1, 0x10111001);
-    cpu->isar.id_dfr0 = 0x03010006;
+    SET_IDREG(isar, ID_DFR0, 0x03010006);
     cpu->id_afr0 = 0x00000000;
     cpu->isar.id_mmfr0 = 0x00211040;
     cpu->isar.id_mmfr1 = 0x40000000;
@@ -982,7 +980,7 @@ static void arm_max_initfn(Object *obj)
     cpu->reset_sctlr = 0x00c50838;
     SET_IDREG(isar, ID_PFR0, 0x00000131);
     SET_IDREG(isar, ID_PFR1, 0x00011011);
-    cpu->isar.id_dfr0 = 0x03010066;
+    SET_IDREG(isar, ID_DFR0, 0x03010066);
     cpu->id_afr0 = 0x00000000;
     cpu->isar.id_mmfr0 = 0x10101105;
     cpu->isar.id_mmfr1 = 0x40000000;
diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
index c3f90e9d13..aeaade488f 100644
--- a/target/arm/tcg/cpu64.c
+++ b/target/arm/tcg/cpu64.c
@@ -51,7 +51,7 @@ static void aarch64_a35_initfn(Object *obj)
     cpu->ctr = 0x84448004;
     SET_IDREG(isar, ID_PFR0, 0x00000131);
     SET_IDREG(isar, ID_PFR1, 0x00011011);
-    cpu->isar.id_dfr0 = 0x03010066;
+    SET_IDREG(isar, ID_DFR0, 0x03010066);
     cpu->id_afr0 = 0;
     cpu->isar.id_mmfr0 = 0x10201105;
     cpu->isar.id_mmfr1 = 0x40000000;
@@ -228,7 +228,7 @@ static void aarch64_a55_initfn(Object *obj)
     SET_IDREG(isar, ID_AA64PFR0, 0x0000000010112222ull);
     SET_IDREG(isar, ID_AA64PFR1, 0x0000000000000010ull);
     cpu->id_afr0       = 0x00000000;
-    cpu->isar.id_dfr0  = 0x04010088;
+    SET_IDREG(isar, ID_DFR0, 0x04010088);
     SET_IDREG(isar, ID_ISAR0, 0x02101110);
     SET_IDREG(isar, ID_ISAR1, 0x13112111);
     SET_IDREG(isar, ID_ISAR2, 0x21232042);
@@ -297,7 +297,7 @@ static void aarch64_a72_initfn(Object *obj)
     cpu->reset_sctlr = 0x00c50838;
     SET_IDREG(isar, ID_PFR0, 0x00000131);
     SET_IDREG(isar, ID_PFR1, 0x00011011);
-    cpu->isar.id_dfr0 = 0x03010066;
+    SET_IDREG(isar, ID_DFR0, 0x03010066);
     cpu->id_afr0 = 0x00000000;
     cpu->isar.id_mmfr0 = 0x10201105;
     cpu->isar.id_mmfr1 = 0x40000000;
@@ -361,7 +361,7 @@ static void aarch64_a76_initfn(Object *obj)
     SET_IDREG(isar, ID_AA64PFR0, 0x1100000010111112ull); /* GIC filled in later */
     SET_IDREG(isar, ID_AA64PFR1, 0x0000000000000010ull);
     cpu->id_afr0       = 0x00000000;
-    cpu->isar.id_dfr0  = 0x04010088;
+    SET_IDREG(isar, ID_DFR0, 0x04010088);
     SET_IDREG(isar, ID_ISAR0, 0x02101110);
     SET_IDREG(isar, ID_ISAR1, 0x13112111);
     SET_IDREG(isar, ID_ISAR2, 0x21232042);
@@ -609,7 +609,7 @@ static void aarch64_neoverse_n1_initfn(Object *obj)
     SET_IDREG(isar, ID_AA64PFR0, 0x1100000010111112ull); /* GIC filled in later */
     SET_IDREG(isar, ID_AA64PFR1, 0x0000000000000020ull);
     cpu->id_afr0       = 0x00000000;
-    cpu->isar.id_dfr0  = 0x04010088;
+    SET_IDREG(isar, ID_DFR0, 0x04010088);
     SET_IDREG(isar, ID_ISAR0, 0x02101110);
     SET_IDREG(isar, ID_ISAR1, 0x13112111);
     SET_IDREG(isar, ID_ISAR2, 0x21232042);
@@ -688,7 +688,7 @@ static void aarch64_neoverse_v1_initfn(Object *obj)
     SET_IDREG(isar, ID_AA64PFR0, 0x1101110120111112ull); /* GIC filled in later */
     SET_IDREG(isar, ID_AA64PFR1, 0x0000000000000020ull);
     cpu->id_afr0       = 0x00000000;
-    cpu->isar.id_dfr0  = 0x15011099;
+    SET_IDREG(isar, ID_DFR0, 0x15011099);
     SET_IDREG(isar, ID_ISAR0, 0x02101110);
     SET_IDREG(isar, ID_ISAR1, 0x13112111);
     SET_IDREG(isar, ID_ISAR2, 0x21232042);
@@ -904,7 +904,7 @@ static void aarch64_a710_initfn(Object *obj)
     cpu->revidr        = 0;
     SET_IDREG(isar, ID_PFR0, 0x21110131);
     SET_IDREG(isar, ID_PFR1, 0x00010000); /* GIC filled in later */
-    cpu->isar.id_dfr0  = 0x16011099;
+    SET_IDREG(isar, ID_DFR0, 0x16011099);
     cpu->id_afr0       = 0;
     cpu->isar.id_mmfr0 = 0x10201105;
     cpu->isar.id_mmfr1 = 0x40000000;
@@ -1006,7 +1006,7 @@ static void aarch64_neoverse_n2_initfn(Object *obj)
     cpu->revidr        = 0;
     SET_IDREG(isar, ID_PFR0, 0x21110131);
     SET_IDREG(isar, ID_PFR1, 0x00010000); /* GIC filled in later */
-    cpu->isar.id_dfr0  = 0x16011099;
+    SET_IDREG(isar, ID_DFR0, 0x16011099);
     cpu->id_afr0       = 0;
     cpu->isar.id_mmfr0 = 0x10201105;
     cpu->isar.id_mmfr1 = 0x40000000;

From 987fa88a11cefe0058326c49dd190ab329635fe0 Mon Sep 17 00:00:00 2001
From: Eric Auger <eric.auger@redhat.com>
Date: Tue, 1 Jul 2025 15:08:29 +0100
Subject: [PATCH 1737/2760] arm/cpu: Store id_mmfr0-5 into the idregs array

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Sebastian Ott <sebott@redhat.com>
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Cornelia Huck <cohuck@redhat.com>
Message-id: 20250617153931.1330449-12-cohuck@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/intc/armv7m_nvic.c     |  8 ++--
 target/arm/cpu-features.h | 18 ++++----
 target/arm/cpu.h          |  6 ---
 target/arm/cpu64.c        | 16 +++----
 target/arm/helper.c       | 12 ++---
 target/arm/kvm.c          | 18 +++-----
 target/arm/tcg/cpu-v7m.c  | 48 ++++++++++----------
 target/arm/tcg/cpu32.c    | 94 +++++++++++++++++++--------------------
 target/arm/tcg/cpu64.c    | 76 +++++++++++++++----------------
 9 files changed, 140 insertions(+), 156 deletions(-)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index 2566dd6343..6d85720f1b 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -1284,22 +1284,22 @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
         if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
             goto bad_offset;
         }
-        return cpu->isar.id_mmfr0;
+        return GET_IDREG(isar, ID_MMFR0);
     case 0xd54: /* MMFR1.  */
         if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
             goto bad_offset;
         }
-        return cpu->isar.id_mmfr1;
+        return GET_IDREG(isar, ID_MMFR1);
     case 0xd58: /* MMFR2.  */
         if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
             goto bad_offset;
         }
-        return cpu->isar.id_mmfr2;
+        return GET_IDREG(isar, ID_MMFR2);
     case 0xd5c: /* MMFR3.  */
         if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
             goto bad_offset;
         }
-        return cpu->isar.id_mmfr3;
+        return GET_IDREG(isar, ID_MMFR3);
     case 0xd60: /* ISAR0.  */
         if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
             goto bad_offset;
diff --git a/target/arm/cpu-features.h b/target/arm/cpu-features.h
index 0292a7cd6e..5d8adfb73b 100644
--- a/target/arm/cpu-features.h
+++ b/target/arm/cpu-features.h
@@ -284,17 +284,17 @@ static inline bool isar_feature_aa32_vminmaxnm(const ARMISARegisters *id)
 
 static inline bool isar_feature_aa32_pxn(const ARMISARegisters *id)
 {
-    return FIELD_EX32(id->id_mmfr0, ID_MMFR0, VMSA) >= 4;
+    return FIELD_EX32_IDREG(id, ID_MMFR0, VMSA) >= 4;
 }
 
 static inline bool isar_feature_aa32_pan(const ARMISARegisters *id)
 {
-    return FIELD_EX32(id->id_mmfr3, ID_MMFR3, PAN) != 0;
+    return FIELD_EX32_IDREG(id, ID_MMFR3, PAN) != 0;
 }
 
 static inline bool isar_feature_aa32_ats1e1(const ARMISARegisters *id)
 {
-    return FIELD_EX32(id->id_mmfr3, ID_MMFR3, PAN) >= 2;
+    return FIELD_EX32_IDREG(id, ID_MMFR3, PAN) >= 2;
 }
 
 static inline bool isar_feature_aa32_pmuv3p1(const ARMISARegisters *id)
@@ -320,32 +320,32 @@ static inline bool isar_feature_aa32_pmuv3p5(const ARMISARegisters *id)
 
 static inline bool isar_feature_aa32_hpd(const ARMISARegisters *id)
 {
-    return FIELD_EX32(id->id_mmfr4, ID_MMFR4, HPDS) != 0;
+    return FIELD_EX32_IDREG(id, ID_MMFR4, HPDS) != 0;
 }
 
 static inline bool isar_feature_aa32_ac2(const ARMISARegisters *id)
 {
-    return FIELD_EX32(id->id_mmfr4, ID_MMFR4, AC2) != 0;
+    return FIELD_EX32_IDREG(id, ID_MMFR4, AC2) != 0;
 }
 
 static inline bool isar_feature_aa32_ccidx(const ARMISARegisters *id)
 {
-    return FIELD_EX32(id->id_mmfr4, ID_MMFR4, CCIDX) != 0;
+    return FIELD_EX32_IDREG(id, ID_MMFR4, CCIDX) != 0;
 }
 
 static inline bool isar_feature_aa32_tts2uxn(const ARMISARegisters *id)
 {
-    return FIELD_EX32(id->id_mmfr4, ID_MMFR4, XNX) != 0;
+    return FIELD_EX32_IDREG(id, ID_MMFR4, XNX) != 0;
 }
 
 static inline bool isar_feature_aa32_half_evt(const ARMISARegisters *id)
 {
-    return FIELD_EX32(id->id_mmfr4, ID_MMFR4, EVT) >= 1;
+    return FIELD_EX32_IDREG(id, ID_MMFR4, EVT) >= 1;
 }
 
 static inline bool isar_feature_aa32_evt(const ARMISARegisters *id)
 {
-    return FIELD_EX32(id->id_mmfr4, ID_MMFR4, EVT) >= 2;
+    return FIELD_EX32_IDREG(id, ID_MMFR4, EVT) >= 2;
 }
 
 static inline bool isar_feature_aa32_dit(const ARMISARegisters *id)
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index c799105eeb..8744922330 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -1050,12 +1050,6 @@ struct ArchCPU {
      * field by reading the value from the KVM vCPU.
      */
     struct ARMISARegisters {
-        uint32_t id_mmfr0;
-        uint32_t id_mmfr1;
-        uint32_t id_mmfr2;
-        uint32_t id_mmfr3;
-        uint32_t id_mmfr4;
-        uint32_t id_mmfr5;
         uint32_t mvfr0;
         uint32_t mvfr1;
         uint32_t mvfr2;
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index 47c2eed3c9..1f3406708b 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -656,10 +656,10 @@ static void aarch64_a57_initfn(Object *obj)
     SET_IDREG(isar, ID_PFR1, 0x00011011);
     SET_IDREG(isar, ID_DFR0, 0x03010066);
     cpu->id_afr0 = 0x00000000;
-    cpu->isar.id_mmfr0 = 0x10101105;
-    cpu->isar.id_mmfr1 = 0x40000000;
-    cpu->isar.id_mmfr2 = 0x01260000;
-    cpu->isar.id_mmfr3 = 0x02102211;
+    SET_IDREG(isar, ID_MMFR0, 0x10101105);
+    SET_IDREG(isar, ID_MMFR1, 0x40000000);
+    SET_IDREG(isar, ID_MMFR2, 0x01260000);
+    SET_IDREG(isar, ID_MMFR3, 0x02102211);
     SET_IDREG(isar, ID_ISAR0, 0x02101110);
     SET_IDREG(isar, ID_ISAR1, 0x13112111);
     SET_IDREG(isar, ID_ISAR2, 0x21232042);
@@ -718,10 +718,10 @@ static void aarch64_a53_initfn(Object *obj)
     SET_IDREG(isar, ID_PFR1, 0x00011011);
     SET_IDREG(isar, ID_DFR0, 0x03010066);
     cpu->id_afr0 = 0x00000000;
-    cpu->isar.id_mmfr0 = 0x10101105;
-    cpu->isar.id_mmfr1 = 0x40000000;
-    cpu->isar.id_mmfr2 = 0x01260000;
-    cpu->isar.id_mmfr3 = 0x02102211;
+    SET_IDREG(isar, ID_MMFR0, 0x10101105);
+    SET_IDREG(isar, ID_MMFR1, 0x40000000);
+    SET_IDREG(isar, ID_MMFR2, 0x01260000);
+    SET_IDREG(isar, ID_MMFR3, 0x02102211);
     SET_IDREG(isar, ID_ISAR0, 0x02101110);
     SET_IDREG(isar, ID_ISAR1, 0x13112111);
     SET_IDREG(isar, ID_ISAR2, 0x21232042);
diff --git a/target/arm/helper.c b/target/arm/helper.c
index 4d90ff7fd5..c311d2df21 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -7810,22 +7810,22 @@ void register_cp_regs_for_features(ARMCPU *cpu)
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 4,
               .access = PL1_R, .type = ARM_CP_CONST,
               .accessfn = access_aa32_tid3,
-              .resetvalue = cpu->isar.id_mmfr0 },
+              .resetvalue = GET_IDREG(isar, ID_MMFR0)},
             { .name = "ID_MMFR1", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 5,
               .access = PL1_R, .type = ARM_CP_CONST,
               .accessfn = access_aa32_tid3,
-              .resetvalue = cpu->isar.id_mmfr1 },
+              .resetvalue = GET_IDREG(isar, ID_MMFR1)},
             { .name = "ID_MMFR2", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 6,
               .access = PL1_R, .type = ARM_CP_CONST,
               .accessfn = access_aa32_tid3,
-              .resetvalue = cpu->isar.id_mmfr2 },
+              .resetvalue = GET_IDREG(isar, ID_MMFR2)},
             { .name = "ID_MMFR3", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 7,
               .access = PL1_R, .type = ARM_CP_CONST,
               .accessfn = access_aa32_tid3,
-              .resetvalue = cpu->isar.id_mmfr3 },
+              .resetvalue = GET_IDREG(isar, ID_MMFR3)},
             { .name = "ID_ISAR0", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 0,
               .access = PL1_R, .type = ARM_CP_CONST,
@@ -7860,7 +7860,7 @@ void register_cp_regs_for_features(ARMCPU *cpu)
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 6,
               .access = PL1_R, .type = ARM_CP_CONST,
               .accessfn = access_aa32_tid3,
-              .resetvalue = cpu->isar.id_mmfr4 },
+              .resetvalue = GET_IDREG(isar, ID_MMFR4)},
             { .name = "ID_ISAR6", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 7,
               .access = PL1_R, .type = ARM_CP_CONST,
@@ -8140,7 +8140,7 @@ void register_cp_regs_for_features(ARMCPU *cpu)
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 6,
               .access = PL1_R, .type = ARM_CP_CONST,
               .accessfn = access_aa64_tid3,
-              .resetvalue = cpu->isar.id_mmfr5 },
+              .resetvalue = GET_IDREG(isar, ID_MMFR5)},
             { .name = "RES_0_C0_C3_7", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 7,
               .access = PL1_R, .type = ARM_CP_CONST,
diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index 2a6a5329b4..3df046b2b9 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -335,14 +335,10 @@ static bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
         err |= get_host_cpu_reg(fd, ahcf, ID_PFR0_EL1_IDX);
         err |= get_host_cpu_reg(fd, ahcf, ID_PFR1_EL1_IDX);
         err |= get_host_cpu_reg(fd, ahcf, ID_DFR0_EL1_IDX);
-        err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_mmfr0,
-                              ARM64_SYS_REG(3, 0, 0, 1, 4));
-        err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_mmfr1,
-                              ARM64_SYS_REG(3, 0, 0, 1, 5));
-        err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_mmfr2,
-                              ARM64_SYS_REG(3, 0, 0, 1, 6));
-        err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_mmfr3,
-                              ARM64_SYS_REG(3, 0, 0, 1, 7));
+        err |= get_host_cpu_reg(fd, ahcf, ID_MMFR0_EL1_IDX);
+        err |= get_host_cpu_reg(fd, ahcf, ID_MMFR1_EL1_IDX);
+        err |= get_host_cpu_reg(fd, ahcf, ID_MMFR2_EL1_IDX);
+        err |= get_host_cpu_reg(fd, ahcf, ID_MMFR3_EL1_IDX);
         err |= get_host_cpu_reg(fd, ahcf, ID_ISAR0_EL1_IDX);
         err |= get_host_cpu_reg(fd, ahcf, ID_ISAR1_EL1_IDX);
         err |= get_host_cpu_reg(fd, ahcf, ID_ISAR2_EL1_IDX);
@@ -350,8 +346,7 @@ static bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
         err |= get_host_cpu_reg(fd, ahcf, ID_ISAR4_EL1_IDX);
         err |= get_host_cpu_reg(fd, ahcf, ID_ISAR5_EL1_IDX);
         err |= get_host_cpu_reg(fd, ahcf, ID_ISAR6_EL1_IDX);
-        err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_mmfr4,
-                              ARM64_SYS_REG(3, 0, 0, 2, 6));
+        err |= get_host_cpu_reg(fd, ahcf, ID_MMFR4_EL1_IDX);
 
         err |= read_sys_reg32(fdarray[2], &ahcf->isar.mvfr0,
                               ARM64_SYS_REG(3, 0, 0, 3, 0));
@@ -361,8 +356,7 @@ static bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
                               ARM64_SYS_REG(3, 0, 0, 3, 2));
         err |= get_host_cpu_reg(fd, ahcf, ID_PFR2_EL1_IDX);
         err |= get_host_cpu_reg(fd, ahcf, ID_DFR1_EL1_IDX);
-        err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_mmfr5,
-                              ARM64_SYS_REG(3, 0, 0, 3, 6));
+        err |= get_host_cpu_reg(fd, ahcf, ID_MMFR5_EL1_IDX);
 
         /*
          * DBGDIDR is a bit complicated because the kernel doesn't
diff --git a/target/arm/tcg/cpu-v7m.c b/target/arm/tcg/cpu-v7m.c
index 9697c362c1..eddd7117d5 100644
--- a/target/arm/tcg/cpu-v7m.c
+++ b/target/arm/tcg/cpu-v7m.c
@@ -63,10 +63,10 @@ static void cortex_m0_initfn(Object *obj)
     SET_IDREG(isar, ID_PFR1, 0x00000200);
     SET_IDREG(isar, ID_DFR0, 0x00100000);
     cpu->id_afr0 = 0x00000000;
-    cpu->isar.id_mmfr0 = 0x00000030;
-    cpu->isar.id_mmfr1 = 0x00000000;
-    cpu->isar.id_mmfr2 = 0x00000000;
-    cpu->isar.id_mmfr3 = 0x00000000;
+    SET_IDREG(isar, ID_MMFR0, 0x00000030);
+    SET_IDREG(isar, ID_MMFR1, 0x00000000);
+    SET_IDREG(isar, ID_MMFR2, 0x00000000);
+    SET_IDREG(isar, ID_MMFR3, 0x00000000);
     SET_IDREG(isar, ID_ISAR0, 0x01141110);
     SET_IDREG(isar, ID_ISAR1, 0x02111000);
     SET_IDREG(isar, ID_ISAR2, 0x21112231);
@@ -89,10 +89,10 @@ static void cortex_m3_initfn(Object *obj)
     SET_IDREG(isar, ID_PFR1, 0x00000200);
     SET_IDREG(isar, ID_DFR0, 0x00100000);
     cpu->id_afr0 = 0x00000000;
-    cpu->isar.id_mmfr0 = 0x00000030;
-    cpu->isar.id_mmfr1 = 0x00000000;
-    cpu->isar.id_mmfr2 = 0x00000000;
-    cpu->isar.id_mmfr3 = 0x00000000;
+    SET_IDREG(isar, ID_MMFR0, 0x00000030);
+    SET_IDREG(isar, ID_MMFR1, 0x00000000);
+    SET_IDREG(isar, ID_MMFR2, 0x00000000);
+    SET_IDREG(isar, ID_MMFR3, 0x00000000);
     SET_IDREG(isar, ID_ISAR0, 0x01141110);
     SET_IDREG(isar, ID_ISAR1, 0x02111000);
     SET_IDREG(isar, ID_ISAR2, 0x21112231);
@@ -120,10 +120,10 @@ static void cortex_m4_initfn(Object *obj)
     SET_IDREG(isar, ID_PFR1, 0x00000200);
     SET_IDREG(isar, ID_DFR0, 0x00100000);
     cpu->id_afr0 = 0x00000000;
-    cpu->isar.id_mmfr0 = 0x00000030;
-    cpu->isar.id_mmfr1 = 0x00000000;
-    cpu->isar.id_mmfr2 = 0x00000000;
-    cpu->isar.id_mmfr3 = 0x00000000;
+    SET_IDREG(isar, ID_MMFR0, 0x00000030);
+    SET_IDREG(isar, ID_MMFR1, 0x00000000);
+    SET_IDREG(isar, ID_MMFR2, 0x00000000);
+    SET_IDREG(isar, ID_MMFR3, 0x00000000);
     SET_IDREG(isar, ID_ISAR0, 0x01141110);
     SET_IDREG(isar, ID_ISAR1, 0x02111000);
     SET_IDREG(isar, ID_ISAR2, 0x21112231);
@@ -151,10 +151,10 @@ static void cortex_m7_initfn(Object *obj)
     SET_IDREG(isar, ID_PFR1, 0x00000200);
     SET_IDREG(isar, ID_DFR0, 0x00100000);
     cpu->id_afr0 = 0x00000000;
-    cpu->isar.id_mmfr0 = 0x00100030;
-    cpu->isar.id_mmfr1 = 0x00000000;
-    cpu->isar.id_mmfr2 = 0x01000000;
-    cpu->isar.id_mmfr3 = 0x00000000;
+    SET_IDREG(isar, ID_MMFR0, 0x00100030);
+    SET_IDREG(isar, ID_MMFR1, 0x00000000);
+    SET_IDREG(isar, ID_MMFR2, 0x01000000);
+    SET_IDREG(isar, ID_MMFR3, 0x00000000);
     SET_IDREG(isar, ID_ISAR0, 0x01101110);
     SET_IDREG(isar, ID_ISAR1, 0x02112000);
     SET_IDREG(isar, ID_ISAR2, 0x20232231);
@@ -184,10 +184,10 @@ static void cortex_m33_initfn(Object *obj)
     SET_IDREG(isar, ID_PFR1, 0x00000210);
     SET_IDREG(isar, ID_DFR0, 0x00200000);
     cpu->id_afr0 = 0x00000000;
-    cpu->isar.id_mmfr0 = 0x00101F40;
-    cpu->isar.id_mmfr1 = 0x00000000;
-    cpu->isar.id_mmfr2 = 0x01000000;
-    cpu->isar.id_mmfr3 = 0x00000000;
+    SET_IDREG(isar, ID_MMFR0, 0x00101F40);
+    SET_IDREG(isar, ID_MMFR1, 0x00000000);
+    SET_IDREG(isar, ID_MMFR2, 0x01000000);
+    SET_IDREG(isar, ID_MMFR3, 0x00000000);
     SET_IDREG(isar, ID_ISAR0, 0x01101110);
     SET_IDREG(isar, ID_ISAR1, 0x02212000);
     SET_IDREG(isar, ID_ISAR2, 0x20232232);
@@ -222,10 +222,10 @@ static void cortex_m55_initfn(Object *obj)
     SET_IDREG(isar, ID_PFR1, 0x00000230);
     SET_IDREG(isar, ID_DFR0, 0x10200000);
     cpu->id_afr0 = 0x00000000;
-    cpu->isar.id_mmfr0 = 0x00111040;
-    cpu->isar.id_mmfr1 = 0x00000000;
-    cpu->isar.id_mmfr2 = 0x01000000;
-    cpu->isar.id_mmfr3 = 0x00000011;
+    SET_IDREG(isar, ID_MMFR0, 0x00111040);
+    SET_IDREG(isar, ID_MMFR1, 0x00000000);
+    SET_IDREG(isar, ID_MMFR2, 0x01000000);
+    SET_IDREG(isar, ID_MMFR3, 0x00000011);
     SET_IDREG(isar, ID_ISAR0, 0x01103110);
     SET_IDREG(isar, ID_ISAR1, 0x02212000);
     SET_IDREG(isar, ID_ISAR2, 0x20232232);
diff --git a/target/arm/tcg/cpu32.c b/target/arm/tcg/cpu32.c
index bec69fe52e..942b636aa5 100644
--- a/target/arm/tcg/cpu32.c
+++ b/target/arm/tcg/cpu32.c
@@ -55,21 +55,17 @@ void aa32_max_features(ARMCPU *cpu)
     t = FIELD_DP32(t, MVFR2, FPMISC, 4);          /* FP MaxNum */
     cpu->isar.mvfr2 = t;
 
-    t = cpu->isar.id_mmfr3;
-    t = FIELD_DP32(t, ID_MMFR3, PAN, 2);          /* FEAT_PAN2 */
-    cpu->isar.id_mmfr3 = t;
+    FIELD_DP32_IDREG(isar, ID_MMFR3, PAN, 2);          /* FEAT_PAN2 */
 
-    t = cpu->isar.id_mmfr4;
+    t = GET_IDREG(isar, ID_MMFR4);
     t = FIELD_DP32(t, ID_MMFR4, HPDS, 2);         /* FEAT_HPDS2 */
     t = FIELD_DP32(t, ID_MMFR4, AC2, 1);          /* ACTLR2, HACTLR2 */
     t = FIELD_DP32(t, ID_MMFR4, CNP, 1);          /* FEAT_TTCNP */
     t = FIELD_DP32(t, ID_MMFR4, XNX, 1);          /* FEAT_XNX */
     t = FIELD_DP32(t, ID_MMFR4, EVT, 2);          /* FEAT_EVT */
-    cpu->isar.id_mmfr4 = t;
+    SET_IDREG(isar, ID_MMFR4, t);
 
-    t = cpu->isar.id_mmfr5;
-    t = FIELD_DP32(t, ID_MMFR5, ETS, 2);          /* FEAT_ETS2 */
-    cpu->isar.id_mmfr5 = t;
+    FIELD_DP32_IDREG(isar, ID_MMFR5, ETS, 2);          /* FEAT_ETS2 */
 
     t = GET_IDREG(isar, ID_PFR0);
     t = FIELD_DP32(t, ID_PFR0, CSV2, 2);          /* FEAT_CSV2 */
@@ -230,9 +226,9 @@ static void arm1136_r2_initfn(Object *obj)
     SET_IDREG(isar, ID_PFR1, 0x1);
     SET_IDREG(isar, ID_DFR0, 0x2);
     cpu->id_afr0 = 0x3;
-    cpu->isar.id_mmfr0 = 0x01130003;
-    cpu->isar.id_mmfr1 = 0x10030302;
-    cpu->isar.id_mmfr2 = 0x01222110;
+    SET_IDREG(isar, ID_MMFR0, 0x01130003);
+    SET_IDREG(isar, ID_MMFR1, 0x10030302);
+    SET_IDREG(isar, ID_MMFR2, 0x01222110);
     SET_IDREG(isar, ID_ISAR0, 0x00140011);
     SET_IDREG(isar, ID_ISAR1, 0x12002111);
     SET_IDREG(isar, ID_ISAR2, 0x11231111);
@@ -262,9 +258,9 @@ static void arm1136_initfn(Object *obj)
     SET_IDREG(isar, ID_PFR1, 0x1);
     SET_IDREG(isar, ID_DFR0, 0x2);
     cpu->id_afr0 = 0x3;
-    cpu->isar.id_mmfr0 = 0x01130003;
-    cpu->isar.id_mmfr1 = 0x10030302;
-    cpu->isar.id_mmfr2 = 0x01222110;
+    SET_IDREG(isar, ID_MMFR0, 0x01130003);
+    SET_IDREG(isar, ID_MMFR1, 0x10030302);
+    SET_IDREG(isar, ID_MMFR2, 0x01222110);
     SET_IDREG(isar, ID_ISAR0, 0x00140011);
     SET_IDREG(isar, ID_ISAR1, 0x12002111);
     SET_IDREG(isar, ID_ISAR2, 0x11231111);
@@ -295,9 +291,9 @@ static void arm1176_initfn(Object *obj)
     SET_IDREG(isar, ID_PFR1, 0x11);
     SET_IDREG(isar, ID_DFR0, 0x33);
     cpu->id_afr0 = 0;
-    cpu->isar.id_mmfr0 = 0x01130003;
-    cpu->isar.id_mmfr1 = 0x10030302;
-    cpu->isar.id_mmfr2 = 0x01222100;
+    SET_IDREG(isar, ID_MMFR0, 0x01130003);
+    SET_IDREG(isar, ID_MMFR1, 0x10030302);
+    SET_IDREG(isar, ID_MMFR2, 0x01222100);
     SET_IDREG(isar, ID_ISAR0, 0x0140011);
     SET_IDREG(isar, ID_ISAR1, 0x12002111);
     SET_IDREG(isar, ID_ISAR2, 0x11231121);
@@ -325,9 +321,9 @@ static void arm11mpcore_initfn(Object *obj)
     SET_IDREG(isar, ID_PFR1, 0x1);
     SET_IDREG(isar, ID_DFR0, 0);
     cpu->id_afr0 = 0x2;
-    cpu->isar.id_mmfr0 = 0x01100103;
-    cpu->isar.id_mmfr1 = 0x10020302;
-    cpu->isar.id_mmfr2 = 0x01222000;
+    SET_IDREG(isar, ID_MMFR0, 0x01100103);
+    SET_IDREG(isar, ID_MMFR1, 0x10020302);
+    SET_IDREG(isar, ID_MMFR2, 0x01222000);
     SET_IDREG(isar, ID_ISAR0, 0x00100011);
     SET_IDREG(isar, ID_ISAR1, 0x12002111);
     SET_IDREG(isar, ID_ISAR2, 0x11221011);
@@ -365,10 +361,10 @@ static void cortex_a8_initfn(Object *obj)
     SET_IDREG(isar, ID_PFR1, 0x11);
     SET_IDREG(isar, ID_DFR0, 0x400);
     cpu->id_afr0 = 0;
-    cpu->isar.id_mmfr0 = 0x31100003;
-    cpu->isar.id_mmfr1 = 0x20000000;
-    cpu->isar.id_mmfr2 = 0x01202000;
-    cpu->isar.id_mmfr3 = 0x11;
+    SET_IDREG(isar, ID_MMFR0, 0x31100003);
+    SET_IDREG(isar, ID_MMFR1, 0x20000000);
+    SET_IDREG(isar, ID_MMFR2, 0x01202000);
+    SET_IDREG(isar, ID_MMFR3, 0x11);
     SET_IDREG(isar, ID_ISAR0, 0x00101111);
     SET_IDREG(isar, ID_ISAR1, 0x12112111);
     SET_IDREG(isar, ID_ISAR2, 0x21232031);
@@ -441,10 +437,10 @@ static void cortex_a9_initfn(Object *obj)
     SET_IDREG(isar, ID_PFR1, 0x11);
     SET_IDREG(isar, ID_DFR0, 0x000);
     cpu->id_afr0 = 0;
-    cpu->isar.id_mmfr0 = 0x00100103;
-    cpu->isar.id_mmfr1 = 0x20000000;
-    cpu->isar.id_mmfr2 = 0x01230000;
-    cpu->isar.id_mmfr3 = 0x00002111;
+    SET_IDREG(isar, ID_MMFR0, 0x00100103);
+    SET_IDREG(isar, ID_MMFR1, 0x20000000);
+    SET_IDREG(isar, ID_MMFR2, 0x01230000);
+    SET_IDREG(isar, ID_MMFR3, 0x00002111);
     SET_IDREG(isar, ID_ISAR0, 0x00101111);
     SET_IDREG(isar, ID_ISAR1, 0x13112111);
     SET_IDREG(isar, ID_ISAR2, 0x21232041);
@@ -507,10 +503,10 @@ static void cortex_a7_initfn(Object *obj)
     SET_IDREG(isar, ID_PFR1, 0x00011011);
     SET_IDREG(isar, ID_DFR0, 0x02010555);
     cpu->id_afr0 = 0x00000000;
-    cpu->isar.id_mmfr0 = 0x10101105;
-    cpu->isar.id_mmfr1 = 0x40000000;
-    cpu->isar.id_mmfr2 = 0x01240000;
-    cpu->isar.id_mmfr3 = 0x02102211;
+    SET_IDREG(isar, ID_MMFR0, 0x10101105);
+    SET_IDREG(isar, ID_MMFR1, 0x40000000);
+    SET_IDREG(isar, ID_MMFR2, 0x01240000);
+    SET_IDREG(isar, ID_MMFR3, 0x02102211);
     /*
      * a7_mpcore_r0p5_trm, page 4-4 gives 0x01101110; but
      * table 4-41 gives 0x02101110, which includes the arm div insns.
@@ -559,10 +555,10 @@ static void cortex_a15_initfn(Object *obj)
     SET_IDREG(isar, ID_PFR1, 0x00011011);
     SET_IDREG(isar, ID_DFR0, 0x02010555);
     cpu->id_afr0 = 0x00000000;
-    cpu->isar.id_mmfr0 = 0x10201105;
-    cpu->isar.id_mmfr1 = 0x20000000;
-    cpu->isar.id_mmfr2 = 0x01240000;
-    cpu->isar.id_mmfr3 = 0x02102211;
+    SET_IDREG(isar, ID_MMFR0, 0x10201105);
+    SET_IDREG(isar, ID_MMFR1, 0x20000000);
+    SET_IDREG(isar, ID_MMFR2, 0x01240000);
+    SET_IDREG(isar, ID_MMFR3, 0x02102211);
     SET_IDREG(isar, ID_ISAR0, 0x02101110);
     SET_IDREG(isar, ID_ISAR1, 0x13112111);
     SET_IDREG(isar, ID_ISAR2, 0x21232041);
@@ -603,10 +599,10 @@ static void cortex_r5_initfn(Object *obj)
     SET_IDREG(isar, ID_PFR1, 0x001);
     SET_IDREG(isar, ID_DFR0, 0x010400);
     cpu->id_afr0 = 0x0;
-    cpu->isar.id_mmfr0 = 0x0210030;
-    cpu->isar.id_mmfr1 = 0x00000000;
-    cpu->isar.id_mmfr2 = 0x01200000;
-    cpu->isar.id_mmfr3 = 0x0211;
+    SET_IDREG(isar, ID_MMFR0, 0x0210030);
+    SET_IDREG(isar, ID_MMFR1, 0x00000000);
+    SET_IDREG(isar, ID_MMFR2, 0x01200000);
+    SET_IDREG(isar, ID_MMFR3, 0x0211);
     SET_IDREG(isar, ID_ISAR0, 0x02101111);
     SET_IDREG(isar, ID_ISAR1, 0x13112111);
     SET_IDREG(isar, ID_ISAR2, 0x21232141);
@@ -750,11 +746,11 @@ static void cortex_r52_initfn(Object *obj)
     SET_IDREG(isar, ID_PFR1, 0x10111001);
     SET_IDREG(isar, ID_DFR0, 0x03010006);
     cpu->id_afr0 = 0x00000000;
-    cpu->isar.id_mmfr0 = 0x00211040;
-    cpu->isar.id_mmfr1 = 0x40000000;
-    cpu->isar.id_mmfr2 = 0x01200000;
-    cpu->isar.id_mmfr3 = 0xf0102211;
-    cpu->isar.id_mmfr4 = 0x00000010;
+    SET_IDREG(isar, ID_MMFR0, 0x00211040);
+    SET_IDREG(isar, ID_MMFR1, 0x40000000);
+    SET_IDREG(isar, ID_MMFR2, 0x01200000);
+    SET_IDREG(isar, ID_MMFR3, 0xf0102211);
+    SET_IDREG(isar, ID_MMFR4, 0x00000010);
     SET_IDREG(isar, ID_ISAR0, 0x02101110);
     SET_IDREG(isar, ID_ISAR1, 0x13112111);
     SET_IDREG(isar, ID_ISAR2, 0x21232142);
@@ -982,10 +978,10 @@ static void arm_max_initfn(Object *obj)
     SET_IDREG(isar, ID_PFR1, 0x00011011);
     SET_IDREG(isar, ID_DFR0, 0x03010066);
     cpu->id_afr0 = 0x00000000;
-    cpu->isar.id_mmfr0 = 0x10101105;
-    cpu->isar.id_mmfr1 = 0x40000000;
-    cpu->isar.id_mmfr2 = 0x01260000;
-    cpu->isar.id_mmfr3 = 0x02102211;
+    SET_IDREG(isar, ID_MMFR0, 0x10101105);
+    SET_IDREG(isar, ID_MMFR1, 0x40000000);
+    SET_IDREG(isar, ID_MMFR2, 0x01260000);
+    SET_IDREG(isar, ID_MMFR3, 0x02102211);
     SET_IDREG(isar, ID_ISAR0, 0x02101110);
     SET_IDREG(isar, ID_ISAR1, 0x13112111);
     SET_IDREG(isar, ID_ISAR2, 0x21232042);
diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
index aeaade488f..937f29e253 100644
--- a/target/arm/tcg/cpu64.c
+++ b/target/arm/tcg/cpu64.c
@@ -53,10 +53,10 @@ static void aarch64_a35_initfn(Object *obj)
     SET_IDREG(isar, ID_PFR1, 0x00011011);
     SET_IDREG(isar, ID_DFR0, 0x03010066);
     cpu->id_afr0 = 0;
-    cpu->isar.id_mmfr0 = 0x10201105;
-    cpu->isar.id_mmfr1 = 0x40000000;
-    cpu->isar.id_mmfr2 = 0x01260000;
-    cpu->isar.id_mmfr3 = 0x02102211;
+    SET_IDREG(isar, ID_MMFR0, 0x10201105);
+    SET_IDREG(isar, ID_MMFR1, 0x40000000);
+    SET_IDREG(isar, ID_MMFR2, 0x01260000);
+    SET_IDREG(isar, ID_MMFR3, 0x02102211);
     SET_IDREG(isar, ID_ISAR0, 0x02101110);
     SET_IDREG(isar, ID_ISAR1, 0x13112111);
     SET_IDREG(isar, ID_ISAR2, 0x21232042);
@@ -236,11 +236,11 @@ static void aarch64_a55_initfn(Object *obj)
     SET_IDREG(isar, ID_ISAR4, 0x00011142);
     SET_IDREG(isar, ID_ISAR5, 0x01011121);
     SET_IDREG(isar, ID_ISAR6, 0x00000010);
-    cpu->isar.id_mmfr0 = 0x10201105;
-    cpu->isar.id_mmfr1 = 0x40000000;
-    cpu->isar.id_mmfr2 = 0x01260000;
-    cpu->isar.id_mmfr3 = 0x02122211;
-    cpu->isar.id_mmfr4 = 0x00021110;
+    SET_IDREG(isar, ID_MMFR0, 0x10201105);
+    SET_IDREG(isar, ID_MMFR1, 0x40000000);
+    SET_IDREG(isar, ID_MMFR2, 0x01260000);
+    SET_IDREG(isar, ID_MMFR3, 0x02122211);
+    SET_IDREG(isar, ID_MMFR4, 0x00021110);
     SET_IDREG(isar, ID_PFR0, 0x10010131);
     SET_IDREG(isar, ID_PFR1, 0x00011011);
     SET_IDREG(isar, ID_PFR2, 0x00000011);
@@ -299,10 +299,10 @@ static void aarch64_a72_initfn(Object *obj)
     SET_IDREG(isar, ID_PFR1, 0x00011011);
     SET_IDREG(isar, ID_DFR0, 0x03010066);
     cpu->id_afr0 = 0x00000000;
-    cpu->isar.id_mmfr0 = 0x10201105;
-    cpu->isar.id_mmfr1 = 0x40000000;
-    cpu->isar.id_mmfr2 = 0x01260000;
-    cpu->isar.id_mmfr3 = 0x02102211;
+    SET_IDREG(isar, ID_MMFR0, 0x10201105);
+    SET_IDREG(isar, ID_MMFR1, 0x40000000);
+    SET_IDREG(isar, ID_MMFR2, 0x01260000);
+    SET_IDREG(isar, ID_MMFR3, 0x02102211);
     SET_IDREG(isar, ID_ISAR0, 0x02101110);
     SET_IDREG(isar, ID_ISAR1, 0x13112111);
     SET_IDREG(isar, ID_ISAR2, 0x21232042);
@@ -369,11 +369,11 @@ static void aarch64_a76_initfn(Object *obj)
     SET_IDREG(isar, ID_ISAR4, 0x00010142);
     SET_IDREG(isar, ID_ISAR5, 0x01011121);
     SET_IDREG(isar, ID_ISAR6, 0x00000010);
-    cpu->isar.id_mmfr0 = 0x10201105;
-    cpu->isar.id_mmfr1 = 0x40000000;
-    cpu->isar.id_mmfr2 = 0x01260000;
-    cpu->isar.id_mmfr3 = 0x02122211;
-    cpu->isar.id_mmfr4 = 0x00021110;
+    SET_IDREG(isar, ID_MMFR0, 0x10201105);
+    SET_IDREG(isar, ID_MMFR1, 0x40000000);
+    SET_IDREG(isar, ID_MMFR2, 0x01260000);
+    SET_IDREG(isar, ID_MMFR3, 0x02122211);
+    SET_IDREG(isar, ID_MMFR4, 0x00021110);
     SET_IDREG(isar, ID_PFR0, 0x10010131);
     SET_IDREG(isar, ID_PFR1, 0x00010000); /* GIC filled in later */
     SET_IDREG(isar, ID_PFR2, 0x00000011);
@@ -617,11 +617,11 @@ static void aarch64_neoverse_n1_initfn(Object *obj)
     SET_IDREG(isar, ID_ISAR4, 0x00010142);
     SET_IDREG(isar, ID_ISAR5, 0x01011121);
     SET_IDREG(isar, ID_ISAR6, 0x00000010);
-    cpu->isar.id_mmfr0 = 0x10201105;
-    cpu->isar.id_mmfr1 = 0x40000000;
-    cpu->isar.id_mmfr2 = 0x01260000;
-    cpu->isar.id_mmfr3 = 0x02122211;
-    cpu->isar.id_mmfr4 = 0x00021110;
+    SET_IDREG(isar, ID_MMFR0, 0x10201105);
+    SET_IDREG(isar, ID_MMFR1, 0x40000000);
+    SET_IDREG(isar, ID_MMFR2, 0x01260000);
+    SET_IDREG(isar, ID_MMFR3, 0x02122211);
+    SET_IDREG(isar, ID_MMFR4, 0x00021110);
     SET_IDREG(isar, ID_PFR0, 0x10010131);
     SET_IDREG(isar, ID_PFR1, 0x00010000); /* GIC filled in later */
     SET_IDREG(isar, ID_PFR2, 0x00000011);
@@ -696,11 +696,11 @@ static void aarch64_neoverse_v1_initfn(Object *obj)
     SET_IDREG(isar, ID_ISAR4, 0x00010142);
     SET_IDREG(isar, ID_ISAR5, 0x11011121);
     SET_IDREG(isar, ID_ISAR6, 0x01100111);
-    cpu->isar.id_mmfr0 = 0x10201105;
-    cpu->isar.id_mmfr1 = 0x40000000;
-    cpu->isar.id_mmfr2 = 0x01260000;
-    cpu->isar.id_mmfr3 = 0x02122211;
-    cpu->isar.id_mmfr4 = 0x01021110;
+    SET_IDREG(isar, ID_MMFR0, 0x10201105);
+    SET_IDREG(isar, ID_MMFR1, 0x40000000);
+    SET_IDREG(isar, ID_MMFR2, 0x01260000);
+    SET_IDREG(isar, ID_MMFR3, 0x02122211);
+    SET_IDREG(isar, ID_MMFR4, 0x01021110);
     SET_IDREG(isar, ID_PFR0, 0x21110131);
     SET_IDREG(isar, ID_PFR1, 0x00010000); /* GIC filled in later */
     SET_IDREG(isar, ID_PFR2, 0x00000011);
@@ -906,17 +906,17 @@ static void aarch64_a710_initfn(Object *obj)
     SET_IDREG(isar, ID_PFR1, 0x00010000); /* GIC filled in later */
     SET_IDREG(isar, ID_DFR0, 0x16011099);
     cpu->id_afr0       = 0;
-    cpu->isar.id_mmfr0 = 0x10201105;
-    cpu->isar.id_mmfr1 = 0x40000000;
-    cpu->isar.id_mmfr2 = 0x01260000;
-    cpu->isar.id_mmfr3 = 0x02122211;
+    SET_IDREG(isar, ID_MMFR0, 0x10201105);
+    SET_IDREG(isar, ID_MMFR1, 0x40000000);
+    SET_IDREG(isar, ID_MMFR2, 0x01260000);
+    SET_IDREG(isar, ID_MMFR3, 0x02122211);
     SET_IDREG(isar, ID_ISAR0, 0x02101110);
     SET_IDREG(isar, ID_ISAR1, 0x13112111);
     SET_IDREG(isar, ID_ISAR2, 0x21232042);
     SET_IDREG(isar, ID_ISAR3, 0x01112131);
     SET_IDREG(isar, ID_ISAR4, 0x00010142);
     SET_IDREG(isar, ID_ISAR5, 0x11011121); /* with Crypto */
-    cpu->isar.id_mmfr4 = 0x21021110;
+    SET_IDREG(isar, ID_MMFR4, 0x21021110);
     SET_IDREG(isar, ID_ISAR6, 0x01111111);
     cpu->isar.mvfr0    = 0x10110222;
     cpu->isar.mvfr1    = 0x13211111;
@@ -1008,17 +1008,17 @@ static void aarch64_neoverse_n2_initfn(Object *obj)
     SET_IDREG(isar, ID_PFR1, 0x00010000); /* GIC filled in later */
     SET_IDREG(isar, ID_DFR0, 0x16011099);
     cpu->id_afr0       = 0;
-    cpu->isar.id_mmfr0 = 0x10201105;
-    cpu->isar.id_mmfr1 = 0x40000000;
-    cpu->isar.id_mmfr2 = 0x01260000;
-    cpu->isar.id_mmfr3 = 0x02122211;
+    SET_IDREG(isar, ID_MMFR0, 0x10201105);
+    SET_IDREG(isar, ID_MMFR1, 0x40000000);
+    SET_IDREG(isar, ID_MMFR2, 0x01260000);
+    SET_IDREG(isar, ID_MMFR3, 0x02122211);
     SET_IDREG(isar, ID_ISAR0, 0x02101110);
     SET_IDREG(isar, ID_ISAR1, 0x13112111);
     SET_IDREG(isar, ID_ISAR2, 0x21232042);
     SET_IDREG(isar, ID_ISAR3, 0x01112131);
     SET_IDREG(isar, ID_ISAR4, 0x00010142);
     SET_IDREG(isar, ID_ISAR5, 0x11011121); /* with Crypto */
-    cpu->isar.id_mmfr4 = 0x01021110;
+    SET_IDREG(isar, ID_MMFR4, 0x01021110);
     SET_IDREG(isar, ID_ISAR6, 0x01111111);
     cpu->isar.mvfr0    = 0x10110222;
     cpu->isar.mvfr1    = 0x13211111;

From 8776a0c289f86348ec11e1edb3150ef32d78100a Mon Sep 17 00:00:00 2001
From: Cornelia Huck <cohuck@redhat.com>
Date: Tue, 1 Jul 2025 15:08:29 +0100
Subject: [PATCH 1738/2760] arm/kvm: use fd instead of fdarray[2]

We have fd, so might as well neaten things up.

Suggested-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Cornelia Huck <cohuck@redhat.com>
Message-id: 20250617153931.1330449-15-cohuck@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/kvm.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index 3df046b2b9..70919aedd0 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -348,11 +348,11 @@ static bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
         err |= get_host_cpu_reg(fd, ahcf, ID_ISAR6_EL1_IDX);
         err |= get_host_cpu_reg(fd, ahcf, ID_MMFR4_EL1_IDX);
 
-        err |= read_sys_reg32(fdarray[2], &ahcf->isar.mvfr0,
+        err |= read_sys_reg32(fd, &ahcf->isar.mvfr0,
                               ARM64_SYS_REG(3, 0, 0, 3, 0));
-        err |= read_sys_reg32(fdarray[2], &ahcf->isar.mvfr1,
+        err |= read_sys_reg32(fd, &ahcf->isar.mvfr1,
                               ARM64_SYS_REG(3, 0, 0, 3, 1));
-        err |= read_sys_reg32(fdarray[2], &ahcf->isar.mvfr2,
+        err |= read_sys_reg32(fd, &ahcf->isar.mvfr2,
                               ARM64_SYS_REG(3, 0, 0, 3, 2));
         err |= get_host_cpu_reg(fd, ahcf, ID_PFR2_EL1_IDX);
         err |= get_host_cpu_reg(fd, ahcf, ID_DFR1_EL1_IDX);
@@ -390,7 +390,7 @@ static bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
 
         if (pmu_supported) {
             /* PMCR_EL0 is only accessible if the vCPU has feature PMU_V3 */
-            err |= read_sys_reg64(fdarray[2], &ahcf->isar.reset_pmcr_el0,
+            err |= read_sys_reg64(fd, &ahcf->isar.reset_pmcr_el0,
                                   ARM64_SYS_REG(3, 3, 9, 12, 0));
         }
 

From 374d766da75ab89749f59813f7ae55d913c37b58 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 1 Jul 2025 15:08:29 +0100
Subject: [PATCH 1739/2760] hw/intc/gicv3_its: Do not check its_class_name()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since commit cc5e719e2c8 ("kvm: require KVM_CAP_SIGNAL_MSI"), the single
implementation of its_class_name() no longer returns NULL (it now always
returns a valid char pointer). Hence, update the prototype docstring and
remove the tautological checks that use the its_class_name() returned
value.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Gustavo Romero <gustavo.romero@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Message-id: 20250628195722.977078-2-gustavo.romero@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt-acpi-build.c               | 32 +++++++++++---------------
 include/hw/intc/arm_gicv3_its_common.h |  2 +-
 2 files changed, 15 insertions(+), 19 deletions(-)

diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
index 7e8e0f0298..9eee284c80 100644
--- a/hw/arm/virt-acpi-build.c
+++ b/hw/arm/virt-acpi-build.c
@@ -737,20 +737,18 @@ build_madt(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
                                           memmap[VIRT_HIGH_GIC_REDIST2].size);
         }
 
-        if (its_class_name()) {
-            /*
-             * ACPI spec, Revision 6.0 Errata A
-             * (original 6.0 definition has invalid Length)
-             * 5.2.12.18 GIC ITS Structure
-             */
-            build_append_int_noprefix(table_data, 0xF, 1);  /* Type */
-            build_append_int_noprefix(table_data, 20, 1);   /* Length */
-            build_append_int_noprefix(table_data, 0, 2);    /* Reserved */
-            build_append_int_noprefix(table_data, 0, 4);    /* GIC ITS ID */
-            /* Physical Base Address */
-            build_append_int_noprefix(table_data, memmap[VIRT_GIC_ITS].base, 8);
-            build_append_int_noprefix(table_data, 0, 4);    /* Reserved */
-        }
+        /*
+         * ACPI spec, Revision 6.0 Errata A
+         * (original 6.0 definition has invalid Length)
+         * 5.2.12.18 GIC ITS Structure
+         */
+        build_append_int_noprefix(table_data, 0xF, 1);  /* Type */
+        build_append_int_noprefix(table_data, 20, 1);   /* Length */
+        build_append_int_noprefix(table_data, 0, 2);    /* Reserved */
+        build_append_int_noprefix(table_data, 0, 4);    /* GIC ITS ID */
+        /* Physical Base Address */
+        build_append_int_noprefix(table_data, memmap[VIRT_GIC_ITS].base, 8);
+        build_append_int_noprefix(table_data, 0, 4);    /* Reserved */
     } else {
         const uint16_t spi_base = vms->irqmap[VIRT_GIC_V2M] + ARM_SPI_BASE;
 
@@ -969,10 +967,8 @@ void virt_acpi_build(VirtMachineState *vms, AcpiBuildTables *tables)
                           vms->oem_table_id);
     }
 
-    if (its_class_name()) {
-        acpi_add_table(table_offsets, tables_blob);
-        build_iort(tables_blob, tables->linker, vms);
-    }
+    acpi_add_table(table_offsets, tables_blob);
+    build_iort(tables_blob, tables->linker, vms);
 
 #ifdef CONFIG_TPM
     if (tpm_get_version(tpm_find()) == TPM_VERSION_2_0) {
diff --git a/include/hw/intc/arm_gicv3_its_common.h b/include/hw/intc/arm_gicv3_its_common.h
index 7dc712b38d..3c7b543b01 100644
--- a/include/hw/intc/arm_gicv3_its_common.h
+++ b/include/hw/intc/arm_gicv3_its_common.h
@@ -128,7 +128,7 @@ struct GICv3ITSCommonClass {
  * Return the ITS class name to use depending on whether KVM acceleration
  * and KVM CAP_SIGNAL_MSI are supported
  *
- * Returns: class name to use or NULL
+ * Returns: class name to use
  */
 const char *its_class_name(void);
 

From 43eb1805437e1c904fcb5d8ce93096301128a4d0 Mon Sep 17 00:00:00 2001
From: Gustavo Romero <gustavo.romero@linaro.org>
Date: Tue, 1 Jul 2025 15:08:29 +0100
Subject: [PATCH 1740/2760] hw/arm/virt: Simplify logic for setting instance's
 'tcg_its' variable
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Because 'tcg_its' in the machine instance is set based on the machine
class’s negated variable 'no_tcg_its', 'tcg_its' is the opposite of
'no_tcg_its' and hence the code in question can be simplified as:
tcg_its = !no_tcg_its.

Signed-off-by: Gustavo Romero <gustavo.romero@linaro.org>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Message-id: 20250628195722.977078-3-gustavo.romero@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index 99fde5836c..6d9256a525 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -3342,12 +3342,8 @@ static void virt_instance_init(Object *obj)
 
     /* Default allows ITS instantiation */
     vms->its = true;
-
-    if (vmc->no_tcg_its) {
-        vms->tcg_its = false;
-    } else {
-        vms->tcg_its = true;
-    }
+    /* Allow ITS emulation if the machine version supports it */
+    vms->tcg_its = !vmc->no_tcg_its;
 
     /* Default disallows iommu instantiation */
     vms->iommu = VIRT_IOMMU_NONE;

From 029cd5d6d1b6fea5d3280c7093e2adbd7d9e32f4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 1 Jul 2025 15:08:30 +0100
Subject: [PATCH 1741/2760] hw/arm/virt: Simplify create_its()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

No need to strstr() check the class name when we can use
kvm_irqchip_in_kernel() to check if the ITS from the host can be used.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Gustavo Romero <gustavo.romero@linaro.org>
Message-id: 20250628195722.977078-4-gustavo.romero@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c | 17 +++++++----------
 1 file changed, 7 insertions(+), 10 deletions(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index 6d9256a525..ae419e8671 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -705,21 +705,18 @@ static inline DeviceState *create_acpi_ged(VirtMachineState *vms)
 
 static void create_its(VirtMachineState *vms)
 {
-    const char *itsclass = its_class_name();
     DeviceState *dev;
 
-    if (!strcmp(itsclass, "arm-gicv3-its")) {
-        if (!vms->tcg_its) {
-            itsclass = NULL;
-        }
-    }
-
-    if (!itsclass) {
-        /* Do nothing if not supported */
+    assert(vms->its);
+    if (!kvm_irqchip_in_kernel() && !vms->tcg_its) {
+        /*
+         * Do nothing if ITS is neither supported by the host nor emulated by
+         * the machine.
+         */
         return;
     }
 
-    dev = qdev_new(itsclass);
+    dev = qdev_new(its_class_name());
 
     object_property_set_link(OBJECT(dev), "parent-gicv3", OBJECT(vms->gic),
                              &error_abort);

From 67473d32f020a3c62e24790ab93eb6086a8c8283 Mon Sep 17 00:00:00 2001
From: Gustavo Romero <gustavo.romero@linaro.org>
Date: Tue, 1 Jul 2025 15:08:30 +0100
Subject: [PATCH 1742/2760] hw/arm/virt-acpi-build: Improve comment in
 build_iort

When building the Root Complex table, the comment about the code that
maps the RC node to SMMU node is misleading because it reads
"RC -> SMMUv3 -> ITS", but the code is only mapping the RCs IDs to the
SMMUv3 node. The step of mapping from the SMMUv3 IDs to the ITS Group
node is actually defined in another table (in the SMMUv3 node). So
change the comment to read "RC -> SMMUv3" instead.

Signed-off-by Gustavo Romero <gustavo.romero@linaro.org>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Message-id: 20250628195722.977078-5-gustavo.romero@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt-acpi-build.c | 25 +++++++++++++++++++------
 1 file changed, 19 insertions(+), 6 deletions(-)

diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
index 9eee284c80..e9cd3fb351 100644
--- a/hw/arm/virt-acpi-build.c
+++ b/hw/arm/virt-acpi-build.c
@@ -370,7 +370,7 @@ build_iort(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
         /* DeviceID mapping index (ignored since interrupts are GSIV based) */
         build_append_int_noprefix(table_data, 0, 4);
 
-        /* output IORT node is the ITS group node (the first node) */
+        /* Output IORT node is the ITS Group node (the first node) */
         build_iort_id_mapping(table_data, 0, 0x10000, IORT_NODE_OFFSET);
     }
 
@@ -407,23 +407,36 @@ build_iort(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
     if (vms->iommu == VIRT_IOMMU_SMMUV3) {
         AcpiIortIdMapping *range;
 
-        /* translated RIDs connect to SMMUv3 node: RC -> SMMUv3 -> ITS */
+        /*
+         * Map RIDs (input) from RC to SMMUv3 nodes: RC -> SMMUv3.
+         *
+         * N.B.: The mapping from SMMUv3 to ITS Group node (SMMUv3 -> ITS) is
+         * defined in the SMMUv3 table, where all SMMUv3 IDs are mapped to the
+         * ITS Group node.
+         */
         for (i = 0; i < smmu_idmaps->len; i++) {
             range = &g_array_index(smmu_idmaps, AcpiIortIdMapping, i);
-            /* output IORT node is the smmuv3 node */
+            /* Output IORT node is the SMMUv3 node. */
             build_iort_id_mapping(table_data, range->input_base,
                                   range->id_count, smmu_offset);
         }
 
-        /* bypassed RIDs connect to ITS group node directly: RC -> ITS */
+        /*
+         * Map bypassed (don't go throught the SMMU) RIDs (input) to ITS Group
+         * node directly: RC -> ITS.
+         */
         for (i = 0; i < its_idmaps->len; i++) {
             range = &g_array_index(its_idmaps, AcpiIortIdMapping, i);
-            /* output IORT node is the ITS group node (the first node) */
+            /* Output IORT node is the ITS Group node (the first node). */
             build_iort_id_mapping(table_data, range->input_base,
                                   range->id_count, IORT_NODE_OFFSET);
         }
     } else {
-        /* output IORT node is the ITS group node (the first node) */
+        /*
+         * Map all RIDs (input) to ITS Group node directly, since there is no
+         * SMMU: RC -> ITS.
+         * Output IORT node is the ITS Group node (the first node).
+         */
         build_iort_id_mapping(table_data, 0, 0x10000, IORT_NODE_OFFSET);
     }
 

From 1c41eaa5fe03cbe9f60edb8f0414c1ad6d7fd786 Mon Sep 17 00:00:00 2001
From: Gustavo Romero <gustavo.romero@linaro.org>
Date: Tue, 1 Jul 2025 15:08:30 +0100
Subject: [PATCH 1743/2760] hw/arm/virt-acpi-build: Factor out
 create_its_idmaps

Factor out a new function, create_its_idmaps(), from the current
build_iort code. Add proper comments to it clarifying how the ID ranges
that go directly to the ITS Group node are computed based on the ones
that are directed to the SMMU node.

Suggested-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Gustavo Romero <gustavo.romero@linaro.org>
Message-id: 20250628195722.977078-6-gustavo.romero@linaro.org
[PMM: drop hardcoded tabs]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt-acpi-build.c | 61 ++++++++++++++++++++++++++--------------
 1 file changed, 40 insertions(+), 21 deletions(-)

diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
index e9cd3fb351..5886192fe3 100644
--- a/hw/arm/virt-acpi-build.c
+++ b/hw/arm/virt-acpi-build.c
@@ -266,6 +266,43 @@ static int iort_idmap_compare(gconstpointer a, gconstpointer b)
     return idmap_a->input_base - idmap_b->input_base;
 }
 
+/* Compute ID ranges (RIDs) from RC that are directed to the ITS Group node */
+static void create_its_idmaps(GArray *its_idmaps, GArray *smmu_idmaps)
+{
+    AcpiIortIdMapping *idmap;
+    AcpiIortIdMapping next_range = {0};
+
+    /*
+     * Based on the RID ranges that are directed to the SMMU, determine the
+     * bypassed RID ranges, i.e., the ones that are directed to the ITS Group
+     * node and do not pass through the SMMU, by subtracting the SMMU-bound
+     * ranges from the full RID range (0x0000–0xFFFF).
+     */
+     for (int i = 0; i < smmu_idmaps->len; i++) {
+        idmap = &g_array_index(smmu_idmaps, AcpiIortIdMapping, i);
+
+        if (next_range.input_base < idmap->input_base) {
+            next_range.id_count = idmap->input_base - next_range.input_base;
+            g_array_append_val(its_idmaps, next_range);
+        }
+
+        next_range.input_base = idmap->input_base + idmap->id_count;
+    }
+
+    /*
+     * Append the last RC -> ITS ID mapping.
+     *
+     * RIDs are 16-bit, according to the PCI Express 2.0 Base Specification, rev
+     * 0.9, section 2.2.6.2, "Transaction Descriptor - Transaction ID Field",
+     * hence the end of the range is 0x10000.
+     */
+    if (next_range.input_base < 0x10000) {
+        next_range.id_count = 0x10000 - next_range.input_base;
+        g_array_append_val(its_idmaps, next_range);
+    }
+}
+
+
 /*
  * Input Output Remapping Table (IORT)
  * Conforms to "IO Remapping Table System Software on ARM Platforms",
@@ -276,7 +313,6 @@ build_iort(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
 {
     int i, nb_nodes, rc_mapping_count;
     size_t node_size, smmu_offset = 0;
-    AcpiIortIdMapping *idmap;
     uint32_t id = 0;
     GArray *smmu_idmaps = g_array_new(false, true, sizeof(AcpiIortIdMapping));
     GArray *its_idmaps = g_array_new(false, true, sizeof(AcpiIortIdMapping));
@@ -287,8 +323,6 @@ build_iort(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
     acpi_table_begin(&table, table_data);
 
     if (vms->iommu == VIRT_IOMMU_SMMUV3) {
-        AcpiIortIdMapping next_range = {0};
-
         object_child_foreach_recursive(object_get_root(),
                                        iort_host_bridges, smmu_idmaps);
 
@@ -296,25 +330,10 @@ build_iort(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
         g_array_sort(smmu_idmaps, iort_idmap_compare);
 
         /*
-         * Split the whole RIDs by mapping from RC to SMMU,
-         * build the ID mapping from RC to ITS directly.
+         * Knowing the ID ranges from the RC to the SMMU, it's possible to
+         * determine the ID ranges from RC that are directed to the ITS.
          */
-        for (i = 0; i < smmu_idmaps->len; i++) {
-            idmap = &g_array_index(smmu_idmaps, AcpiIortIdMapping, i);
-
-            if (next_range.input_base < idmap->input_base) {
-                next_range.id_count = idmap->input_base - next_range.input_base;
-                g_array_append_val(its_idmaps, next_range);
-            }
-
-            next_range.input_base = idmap->input_base + idmap->id_count;
-        }
-
-        /* Append the last RC -> ITS ID mapping */
-        if (next_range.input_base < 0x10000) {
-            next_range.id_count = 0x10000 - next_range.input_base;
-            g_array_append_val(its_idmaps, next_range);
-        }
+        create_its_idmaps(its_idmaps, smmu_idmaps);
 
         nb_nodes = 3; /* RC, ITS, SMMUv3 */
         rc_mapping_count = smmu_idmaps->len + its_idmaps->len;

From f63c6c23fba52b1496420e31299de42fd342a2c6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 1 Jul 2025 15:08:30 +0100
Subject: [PATCH 1744/2760] qtest/bios-tables-test: Add test for when ITS is
 off on aarch64
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Arm64 GIC ITS (Interrupt Translation Service) is an optional piece of
hardware introduced in GICv3 and, being optional, it can be disabled
in QEMU aarch64 VMs that support it using machine option "its=off",
like, for instance: "-M virt,its=off".

In ACPI, the ITS is advertised, if present, in the MADT (aka APIC)
table, while the ID mappings from the Root Complex (RC) and from the
SMMU nodes to the ITS Group nodes are described in the IORT table.

This new test verifies that when the "its=off" option is passed to the
machine the ITS-related data is correctly pruned from the ACPI tables.

The new blobs for this test will be added in a following commit.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Gustavo Romero <gustavo.romero@linaro.org>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Message-id: 20250628195722.977078-7-gustavo.romero@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/qtest/bios-tables-test-allowed-diff.h |  2 ++
 tests/qtest/bios-tables-test.c              | 21 +++++++++++++++++++++
 2 files changed, 23 insertions(+)

diff --git a/tests/qtest/bios-tables-test-allowed-diff.h b/tests/qtest/bios-tables-test-allowed-diff.h
index dfb8523c8b..a88198d5c2 100644
--- a/tests/qtest/bios-tables-test-allowed-diff.h
+++ b/tests/qtest/bios-tables-test-allowed-diff.h
@@ -1 +1,3 @@
 /* List of comma-separated changed AML files to ignore */
+"tests/data/acpi/aarch64/virt/APIC.its_off",
+"tests/data/acpi/aarch64/virt/IORT.its_off",
diff --git a/tests/qtest/bios-tables-test.c b/tests/qtest/bios-tables-test.c
index 0b2bdf9d0d..4dbc07ec5e 100644
--- a/tests/qtest/bios-tables-test.c
+++ b/tests/qtest/bios-tables-test.c
@@ -2146,6 +2146,25 @@ static void test_acpi_aarch64_virt_tcg_topology(void)
     free_test_data(&data);
 }
 
+static void test_acpi_aarch64_virt_tcg_its_off(void)
+{
+    test_data data = {
+        .machine = "virt",
+        .arch = "aarch64",
+        .variant = ".its_off",
+        .tcg_only = true,
+        .uefi_fl1 = "pc-bios/edk2-aarch64-code.fd",
+        .uefi_fl2 = "pc-bios/edk2-arm-vars.fd",
+        .cd = "tests/data/uefi-boot-images/bios-tables-test.aarch64.iso.qcow2",
+        .ram_start = 0x40000000ULL,
+        .scan_len = 128ULL * 1024 * 1024,
+    };
+
+    test_acpi_one("-cpu cortex-a57 "
+                  "-M gic-version=3,iommu=smmuv3,its=off", &data);
+    free_test_data(&data);
+}
+
 static void test_acpi_q35_viot(void)
 {
     test_data data = {
@@ -2577,6 +2596,8 @@ int main(int argc, char *argv[])
                            test_acpi_aarch64_virt_tcg_acpi_hmat);
             qtest_add_func("acpi/virt/topology",
                            test_acpi_aarch64_virt_tcg_topology);
+            qtest_add_func("acpi/virt/its_off",
+                           test_acpi_aarch64_virt_tcg_its_off);
             qtest_add_func("acpi/virt/numamem",
                            test_acpi_aarch64_virt_tcg_numamem);
             qtest_add_func("acpi/virt/memhp", test_acpi_aarch64_virt_tcg_memhp);

From 50b5fd232ebc1901b2e040a8394f50a63e3f24ec Mon Sep 17 00:00:00 2001
From: Gustavo Romero <gustavo.romero@linaro.org>
Date: Tue, 1 Jul 2025 15:08:31 +0100
Subject: [PATCH 1745/2760] qtest/bios-tables-test: Add blobs for its=off test
 on aarch64

Add blobs for test_acpi_aarch64_virt_tcg_its_off(), which introduces a
new variant, .its_off, that requires variations of the MADT and IORT
tables.

MADT (aka APIC) diff:

+[000h 0000   4]                    Signature : "APIC"    [Multiple APIC Description Table (MADT)]
+[004h 0004   4]                 Table Length : 000000B8
+[008h 0008   1]                     Revision : 04
+[009h 0009   1]                     Checksum : C1
+[00Ah 0010   6]                       Oem ID : "BOCHS "
+[010h 0016   8]                 Oem Table ID : "BXPC    "
+[018h 0024   4]                 Oem Revision : 00000001
+[01Ch 0028   4]              Asl Compiler ID : "BXPC"
+[020h 0032   4]        Asl Compiler Revision : 00000001
+
+[024h 0036   4]           Local Apic Address : 00000000
+[028h 0040   4]        Flags (decoded below) : 00000000
+                         PC-AT Compatibility : 0
+
+[02Ch 0044   1]                Subtable Type : 0C [Generic Interrupt Distributor]
+[02Dh 0045   1]                       Length : 18
+[02Eh 0046   2]                     Reserved : 0000
+[030h 0048   4]        Local GIC Hardware ID : 00000000
+[034h 0052   8]                 Base Address : 0000000008000000
+[03Ch 0060   4]               Interrupt Base : 00000000
+[040h 0064   1]                      Version : 03
+[041h 0065   3]                     Reserved : 000000
+
+[044h 0068   1]                Subtable Type : 0B [Generic Interrupt Controller]
+[045h 0069   1]                       Length : 50
+[046h 0070   2]                     Reserved : 0000
+[048h 0072   4]         CPU Interface Number : 00000000
+[04Ch 0076   4]                Processor UID : 00000000
+[050h 0080   4]        Flags (decoded below) : 00000001
+                           Processor Enabled : 1
+          Performance Interrupt Trigger Mode : 0
+          Virtual GIC Interrupt Trigger Mode : 0
+[054h 0084   4]     Parking Protocol Version : 00000000
+[058h 0088   4]        Performance Interrupt : 00000017
+[05Ch 0092   8]               Parked Address : 0000000000000000
+[064h 0100   8]                 Base Address : 0000000000000000
+[06Ch 0108   8]     Virtual GIC Base Address : 0000000000000000
+[074h 0116   8]  Hypervisor GIC Base Address : 0000000000000000
+[07Ch 0124   4]        Virtual GIC Interrupt : 00000000
+[080h 0128   8]   Redistributor Base Address : 0000000000000000
+[088h 0136   8]                    ARM MPIDR : 0000000000000000
+[090h 0144   1]             Efficiency Class : 00
+[091h 0145   1]                     Reserved : 00
+[092h 0146   2]       SPE Overflow Interrupt : 0000
+
+[094h 0148   1]                Subtable Type : 0E [Generic Interrupt Redistributor]
+[095h 0149   1]                       Length : 10
+[096h 0150   2]                     Reserved : 0000
+[098h 0152   8]                 Base Address : 00000000080A0000
+[0A0h 0160   4]                       Length : 00F60000
+
+[0A4h 0164   1]                Subtable Type : 0F [Generic Interrupt Translator]
+[0A5h 0165   1]                       Length : 14
+[0A6h 0166   2]                     Reserved : 0000
+[0A8h 0168   4]               Translation ID : 00000000
+[0ACh 0172   8]                 Base Address : 0000000008080000
+[0B4h 0180   4]                     Reserved : 00000000

IORT diff:

+[000h 0000   4]                    Signature : "IORT"    [IO Remapping Table]
+[004h 0004   4]                 Table Length : 000000EC
+[008h 0008   1]                     Revision : 03
+[009h 0009   1]                     Checksum : 57
+[00Ah 0010   6]                       Oem ID : "BOCHS "
+[010h 0016   8]                 Oem Table ID : "BXPC    "
+[018h 0024   4]                 Oem Revision : 00000001
+[01Ch 0028   4]              Asl Compiler ID : "BXPC"
+[020h 0032   4]        Asl Compiler Revision : 00000001
+
+[024h 0036   4]                   Node Count : 00000003
+[028h 0040   4]                  Node Offset : 00000030
+[02Ch 0044   4]                     Reserved : 00000000
+
+[030h 0048   1]                         Type : 00
+[031h 0049   2]                       Length : 0018
+[033h 0051   1]                     Revision : 01
+[034h 0052   4]                     Reserved : 00000000
+[038h 0056   4]                Mapping Count : 00000000
+[03Ch 0060   4]               Mapping Offset : 00000000
+
+[040h 0064   4]                     ItsCount : 00000001
+[044h 0068   4]                  Identifiers : 00000000
+
+[048h 0072   1]                         Type : 04
+[049h 0073   2]                       Length : 0058
+[04Bh 0075   1]                     Revision : 04
+[04Ch 0076   4]                     Reserved : 00000001
+[050h 0080   4]                Mapping Count : 00000001
+[054h 0084   4]               Mapping Offset : 00000044
+
+[058h 0088   8]                 Base Address : 0000000009050000
+[060h 0096   4]        Flags (decoded below) : 00000001
+                             COHACC Override : 1
+                               HTTU Override : 0
+                      Proximity Domain Valid : 0
+[064h 0100   4]                     Reserved : 00000000
+[068h 0104   8]                VATOS Address : 0000000000000000
+[070h 0112   4]                        Model : 00000000
+[074h 0116   4]                   Event GSIV : 0000006A
+[078h 0120   4]                     PRI GSIV : 0000006B
+[07Ch 0124   4]                    GERR GSIV : 0000006D
+[080h 0128   4]                    Sync GSIV : 0000006C
+[084h 0132   4]             Proximity Domain : 00000000
+[088h 0136   4]      Device ID Mapping Index : 00000000
+
+[08Ch 0140   4]                   Input base : 00000000
+[090h 0144   4]                     ID Count : 0000FFFF
+[094h 0148   4]                  Output Base : 00000000
+[098h 0152   4]             Output Reference : 00000030
+[09Ch 0156   4]        Flags (decoded below) : 00000000
+                              Single Mapping : 0
+
+[0A0h 0160   1]                         Type : 02
+[0A1h 0161   2]                       Length : 004C
+[0A3h 0163   1]                     Revision : 03
+[0A4h 0164   4]                     Reserved : 00000002
+[0A8h 0168   4]                Mapping Count : 00000002
+[0ACh 0172   4]               Mapping Offset : 00000024
+
+[0B0h 0176   8]            Memory Properties : [IORT Memory Access Properties]
+[0B0h 0176   4]              Cache Coherency : 00000001
+[0B4h 0180   1]        Hints (decoded below) : 00
+                                   Transient : 0
+                              Write Allocate : 0
+                               Read Allocate : 0
+                                    Override : 0
+[0B5h 0181   2]                     Reserved : 0000
+[0B7h 0183   1] Memory Flags (decoded below) : 03
+                                   Coherency : 1
+                            Device Attribute : 1
+[0B8h 0184   4]                ATS Attribute : 00000000
+[0BCh 0188   4]           PCI Segment Number : 00000000
+[0C0h 0192   1]            Memory Size Limit : 40
+[0C1h 0193   3]                     Reserved : 000000
+
+[0C4h 0196   4]                   Input base : 00000000
+[0C8h 0200   4]                     ID Count : 000000FF
+[0CCh 0204   4]                  Output Base : 00000000
+[0D0h 0208   4]             Output Reference : 00000048
+[0D4h 0212   4]        Flags (decoded below) : 00000000
+                              Single Mapping : 0
+
+[0D8h 0216   4]                   Input base : 00000100
+[0DCh 0220   4]                     ID Count : 0000FEFF
+[0E0h 0224   4]                  Output Base : 00000100
+[0E4h 0228   4]             Output Reference : 00000030
+[0E8h 0232   4]        Flags (decoded below) : 00000000
+                              Single Mapping : 0

Signed-off-by: Gustavo Romero <gustavo.romero@linaro.org>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Message-id: 20250628195722.977078-8-gustavo.romero@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/data/acpi/aarch64/virt/APIC.its_off   | Bin 0 -> 184 bytes
 tests/data/acpi/aarch64/virt/IORT.its_off   | Bin 0 -> 236 bytes
 tests/qtest/bios-tables-test-allowed-diff.h |   2 --
 3 files changed, 2 deletions(-)
 create mode 100644 tests/data/acpi/aarch64/virt/APIC.its_off
 create mode 100644 tests/data/acpi/aarch64/virt/IORT.its_off

diff --git a/tests/data/acpi/aarch64/virt/APIC.its_off b/tests/data/acpi/aarch64/virt/APIC.its_off
new file mode 100644
index 0000000000000000000000000000000000000000..37d82e970b1331cb5b259f0bd2d3654bacb2d623
GIT binary patch
literal 184
zcmZ<^@O0k6z`($A(8=G~BUr&HBEVTeK|z6$fq?<U2GI;qz#{==FfeeySj-Fz4BP=Q
h9s>hRy*NUMWEP(QNDCL#j&BV7A|O5pb3nxy7yuPs2>}2A

literal 0
HcmV?d00001

diff --git a/tests/data/acpi/aarch64/virt/IORT.its_off b/tests/data/acpi/aarch64/virt/IORT.its_off
new file mode 100644
index 0000000000000000000000000000000000000000..0fceb820d509e852ca0849baf568a8e93e426738
GIT binary patch
literal 236
zcmebD4+?q1z`(#9?&R<65v<@85#X$#prF9Wz`y`vgJ@<31_lELD3D+P2|+mwa1KiZ
z0}Dt3gk8Y0tehYU#0SyHIE#USA)A4LA(w%HAqQE4fq~)we~19gJ|-UqW+ny(1`t+Z
efZGRh5?G-Fm}FppYGd$#@<9&!{|}-8W)=Xj6c7Ob

literal 0
HcmV?d00001

diff --git a/tests/qtest/bios-tables-test-allowed-diff.h b/tests/qtest/bios-tables-test-allowed-diff.h
index a88198d5c2..dfb8523c8b 100644
--- a/tests/qtest/bios-tables-test-allowed-diff.h
+++ b/tests/qtest/bios-tables-test-allowed-diff.h
@@ -1,3 +1 @@
 /* List of comma-separated changed AML files to ignore */
-"tests/data/acpi/aarch64/virt/APIC.its_off",
-"tests/data/acpi/aarch64/virt/IORT.its_off",

From d6afe18b7242111a71916a962fbd1876a77dc755 Mon Sep 17 00:00:00 2001
From: Gustavo Romero <gustavo.romero@linaro.org>
Date: Tue, 1 Jul 2025 15:08:31 +0100
Subject: [PATCH 1746/2760] hw/arm/virt-acpi-build: Fix ACPI IORT and MADT
 tables when its=off
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Currently, the ITS Group nodes in the IORT table and the GIC ITS Struct
in the MADT table are always generated, even if GIC ITS is not available
on the machine.

This commit fixes it by not generating the ITS Group nodes, not mapping
any other node to them, and not advertising the GIC ITS in the MADT
table, when GIC ITS is not available on the machine.

Since the fix changes the MADT and IORT tables, add the blobs for the
"its=off" test to the allow list and update them in the next commit.

This commit also renames the smmu_idmaps and its_idmaps variables in
build_iort() to rc_smmu_idmaps and rc_its_idmaps, respectively, to make
it clearer which nodes are involved in the mappings associated with
these variables.

Reported-by: Udo Steinberg <udo@hypervisor.org>
Signed-off-by: Gustavo Romero <gustavo.romero@linaro.org>
Message-id: 20250628195722.977078-9-gustavo.romero@linaro.org
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2886
Signed-off-by: Gustavo Romero <gustavo.romero@linaro.org>
Co-authored-by: Philippe Mathieu-Daudé <philmd@linaro.org>
[PMM: wrapped an overlong comment]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt-acpi-build.c                    | 140 ++++++++++++--------
 tests/qtest/bios-tables-test-allowed-diff.h |   2 +
 2 files changed, 89 insertions(+), 53 deletions(-)

diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
index 5886192fe3..cd90c47976 100644
--- a/hw/arm/virt-acpi-build.c
+++ b/hw/arm/virt-acpi-build.c
@@ -267,7 +267,7 @@ static int iort_idmap_compare(gconstpointer a, gconstpointer b)
 }
 
 /* Compute ID ranges (RIDs) from RC that are directed to the ITS Group node */
-static void create_its_idmaps(GArray *its_idmaps, GArray *smmu_idmaps)
+static void create_rc_its_idmaps(GArray *its_idmaps, GArray *smmu_idmaps)
 {
     AcpiIortIdMapping *idmap;
     AcpiIortIdMapping next_range = {0};
@@ -314,8 +314,8 @@ build_iort(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
     int i, nb_nodes, rc_mapping_count;
     size_t node_size, smmu_offset = 0;
     uint32_t id = 0;
-    GArray *smmu_idmaps = g_array_new(false, true, sizeof(AcpiIortIdMapping));
-    GArray *its_idmaps = g_array_new(false, true, sizeof(AcpiIortIdMapping));
+    GArray *rc_smmu_idmaps = g_array_new(false, true, sizeof(AcpiIortIdMapping));
+    GArray *rc_its_idmaps = g_array_new(false, true, sizeof(AcpiIortIdMapping));
 
     AcpiTable table = { .sig = "IORT", .rev = 3, .oem_id = vms->oem_id,
                         .oem_table_id = vms->oem_table_id };
@@ -324,22 +324,38 @@ build_iort(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
 
     if (vms->iommu == VIRT_IOMMU_SMMUV3) {
         object_child_foreach_recursive(object_get_root(),
-                                       iort_host_bridges, smmu_idmaps);
+                                       iort_host_bridges, rc_smmu_idmaps);
 
         /* Sort the smmu idmap by input_base */
-        g_array_sort(smmu_idmaps, iort_idmap_compare);
+        g_array_sort(rc_smmu_idmaps, iort_idmap_compare);
 
         /*
          * Knowing the ID ranges from the RC to the SMMU, it's possible to
          * determine the ID ranges from RC that are directed to the ITS.
          */
-        create_its_idmaps(its_idmaps, smmu_idmaps);
+        create_rc_its_idmaps(rc_its_idmaps, rc_smmu_idmaps);
 
-        nb_nodes = 3; /* RC, ITS, SMMUv3 */
-        rc_mapping_count = smmu_idmaps->len + its_idmaps->len;
+        nb_nodes = 2; /* RC and SMMUv3 */
+        rc_mapping_count = rc_smmu_idmaps->len;
+
+        if (vms->its) {
+            /*
+             * Knowing the ID ranges from the RC to the SMMU, it's possible to
+             * determine the ID ranges from RC that go directly to ITS.
+             */
+            create_rc_its_idmaps(rc_its_idmaps, rc_smmu_idmaps);
+
+            nb_nodes++; /* ITS */
+            rc_mapping_count += rc_its_idmaps->len;
+        }
     } else {
-        nb_nodes = 2; /* RC, ITS */
-        rc_mapping_count = 1;
+        if (vms->its) {
+            nb_nodes = 2; /* RC and ITS */
+            rc_mapping_count = 1; /* Direct map to ITS */
+        } else {
+            nb_nodes = 1; /* RC only */
+            rc_mapping_count = 0; /* No output mapping */
+        }
     }
     /* Number of IORT Nodes */
     build_append_int_noprefix(table_data, nb_nodes, 4);
@@ -348,31 +364,43 @@ build_iort(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
     build_append_int_noprefix(table_data, IORT_NODE_OFFSET, 4);
     build_append_int_noprefix(table_data, 0, 4); /* Reserved */
 
-    /* Table 12 ITS Group Format */
-    build_append_int_noprefix(table_data, 0 /* ITS Group */, 1); /* Type */
-    node_size =  20 /* fixed header size */ + 4 /* 1 GIC ITS Identifier */;
-    build_append_int_noprefix(table_data, node_size, 2); /* Length */
-    build_append_int_noprefix(table_data, 1, 1); /* Revision */
-    build_append_int_noprefix(table_data, id++, 4); /* Identifier */
-    build_append_int_noprefix(table_data, 0, 4); /* Number of ID mappings */
-    build_append_int_noprefix(table_data, 0, 4); /* Reference to ID Array */
-    build_append_int_noprefix(table_data, 1, 4); /* Number of ITSs */
-    /* GIC ITS Identifier Array */
-    build_append_int_noprefix(table_data, 0 /* MADT translation_id */, 4);
+    if (vms->its) {
+        /* Table 12 ITS Group Format */
+        build_append_int_noprefix(table_data, 0 /* ITS Group */, 1); /* Type */
+        node_size =  20 /* fixed header size */ + 4 /* 1 GIC ITS Identifier */;
+        build_append_int_noprefix(table_data, node_size, 2); /* Length */
+        build_append_int_noprefix(table_data, 1, 1); /* Revision */
+        build_append_int_noprefix(table_data, id++, 4); /* Identifier */
+        build_append_int_noprefix(table_data, 0, 4); /* Number of ID mappings */
+        build_append_int_noprefix(table_data, 0, 4); /* Reference to ID Array */
+        build_append_int_noprefix(table_data, 1, 4); /* Number of ITSs */
+        /* GIC ITS Identifier Array */
+        build_append_int_noprefix(table_data, 0 /* MADT translation_id */, 4);
+    }
 
     if (vms->iommu == VIRT_IOMMU_SMMUV3) {
         int irq =  vms->irqmap[VIRT_SMMU] + ARM_SPI_BASE;
+        int smmu_mapping_count, offset_to_id_array;
 
+        if (vms->its) {
+            smmu_mapping_count = 1; /* ITS Group node */
+            offset_to_id_array = SMMU_V3_ENTRY_SIZE; /* Just after the header */
+        } else {
+            smmu_mapping_count = 0; /* No ID mappings */
+            offset_to_id_array = 0; /* No ID mappings array */
+        }
         smmu_offset = table_data->len - table.table_offset;
         /* Table 9 SMMUv3 Format */
         build_append_int_noprefix(table_data, 4 /* SMMUv3 */, 1); /* Type */
-        node_size =  SMMU_V3_ENTRY_SIZE + ID_MAPPING_ENTRY_SIZE;
+        node_size =  SMMU_V3_ENTRY_SIZE +
+                     (ID_MAPPING_ENTRY_SIZE * smmu_mapping_count);
         build_append_int_noprefix(table_data, node_size, 2); /* Length */
         build_append_int_noprefix(table_data, 4, 1); /* Revision */
         build_append_int_noprefix(table_data, id++, 4); /* Identifier */
-        build_append_int_noprefix(table_data, 1, 4); /* Number of ID mappings */
+        /* Number of ID mappings */
+        build_append_int_noprefix(table_data, smmu_mapping_count, 4);
         /* Reference to ID Array */
-        build_append_int_noprefix(table_data, SMMU_V3_ENTRY_SIZE, 4);
+        build_append_int_noprefix(table_data, offset_to_id_array, 4);
         /* Base address */
         build_append_int_noprefix(table_data, vms->memmap[VIRT_SMMU].base, 8);
         /* Flags */
@@ -388,9 +416,11 @@ build_iort(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
         build_append_int_noprefix(table_data, 0, 4); /* Proximity domain */
         /* DeviceID mapping index (ignored since interrupts are GSIV based) */
         build_append_int_noprefix(table_data, 0, 4);
-
-        /* Output IORT node is the ITS Group node (the first node) */
-        build_iort_id_mapping(table_data, 0, 0x10000, IORT_NODE_OFFSET);
+        /* Array of ID mappings */
+        if (smmu_mapping_count) {
+            /* Output IORT node is the ITS Group node (the first node). */
+            build_iort_id_mapping(table_data, 0, 0x10000, IORT_NODE_OFFSET);
+        }
     }
 
     /* Table 17 Root Complex Node */
@@ -431,24 +461,26 @@ build_iort(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
          *
          * N.B.: The mapping from SMMUv3 to ITS Group node (SMMUv3 -> ITS) is
          * defined in the SMMUv3 table, where all SMMUv3 IDs are mapped to the
-         * ITS Group node.
+         * ITS Group node, if ITS is available.
          */
-        for (i = 0; i < smmu_idmaps->len; i++) {
-            range = &g_array_index(smmu_idmaps, AcpiIortIdMapping, i);
+        for (i = 0; i < rc_smmu_idmaps->len; i++) {
+            range = &g_array_index(rc_smmu_idmaps, AcpiIortIdMapping, i);
             /* Output IORT node is the SMMUv3 node. */
             build_iort_id_mapping(table_data, range->input_base,
                                   range->id_count, smmu_offset);
         }
 
-        /*
-         * Map bypassed (don't go throught the SMMU) RIDs (input) to ITS Group
-         * node directly: RC -> ITS.
-         */
-        for (i = 0; i < its_idmaps->len; i++) {
-            range = &g_array_index(its_idmaps, AcpiIortIdMapping, i);
-            /* Output IORT node is the ITS Group node (the first node). */
-            build_iort_id_mapping(table_data, range->input_base,
-                                  range->id_count, IORT_NODE_OFFSET);
+        if (vms->its) {
+            /*
+             * Map bypassed (don't go through the SMMU) RIDs (input) to
+             * ITS Group node directly: RC -> ITS.
+             */
+            for (i = 0; i < rc_its_idmaps->len; i++) {
+                range = &g_array_index(rc_its_idmaps, AcpiIortIdMapping, i);
+                /* Output IORT node is the ITS Group node (the first node). */
+                build_iort_id_mapping(table_data, range->input_base,
+                                      range->id_count, IORT_NODE_OFFSET);
+            }
         }
     } else {
         /*
@@ -460,8 +492,8 @@ build_iort(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
     }
 
     acpi_table_end(linker, &table);
-    g_array_free(smmu_idmaps, true);
-    g_array_free(its_idmaps, true);
+    g_array_free(rc_smmu_idmaps, true);
+    g_array_free(rc_its_idmaps, true);
 }
 
 /*
@@ -769,18 +801,20 @@ build_madt(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
                                           memmap[VIRT_HIGH_GIC_REDIST2].size);
         }
 
-        /*
-         * ACPI spec, Revision 6.0 Errata A
-         * (original 6.0 definition has invalid Length)
-         * 5.2.12.18 GIC ITS Structure
-         */
-        build_append_int_noprefix(table_data, 0xF, 1);  /* Type */
-        build_append_int_noprefix(table_data, 20, 1);   /* Length */
-        build_append_int_noprefix(table_data, 0, 2);    /* Reserved */
-        build_append_int_noprefix(table_data, 0, 4);    /* GIC ITS ID */
-        /* Physical Base Address */
-        build_append_int_noprefix(table_data, memmap[VIRT_GIC_ITS].base, 8);
-        build_append_int_noprefix(table_data, 0, 4);    /* Reserved */
+        if (vms->its) {
+            /*
+             * ACPI spec, Revision 6.0 Errata A
+             * (original 6.0 definition has invalid Length)
+             * 5.2.12.18 GIC ITS Structure
+             */
+            build_append_int_noprefix(table_data, 0xF, 1);  /* Type */
+            build_append_int_noprefix(table_data, 20, 1);   /* Length */
+            build_append_int_noprefix(table_data, 0, 2);    /* Reserved */
+            build_append_int_noprefix(table_data, 0, 4);    /* GIC ITS ID */
+            /* Physical Base Address */
+            build_append_int_noprefix(table_data, memmap[VIRT_GIC_ITS].base, 8);
+            build_append_int_noprefix(table_data, 0, 4);    /* Reserved */
+        }
     } else {
         const uint16_t spi_base = vms->irqmap[VIRT_GIC_V2M] + ARM_SPI_BASE;
 
diff --git a/tests/qtest/bios-tables-test-allowed-diff.h b/tests/qtest/bios-tables-test-allowed-diff.h
index dfb8523c8b..a88198d5c2 100644
--- a/tests/qtest/bios-tables-test-allowed-diff.h
+++ b/tests/qtest/bios-tables-test-allowed-diff.h
@@ -1 +1,3 @@
 /* List of comma-separated changed AML files to ignore */
+"tests/data/acpi/aarch64/virt/APIC.its_off",
+"tests/data/acpi/aarch64/virt/IORT.its_off",

From 96791e69e644669bbc969424f0f31f0b6f522403 Mon Sep 17 00:00:00 2001
From: Gustavo Romero <gustavo.romero@linaro.org>
Date: Tue, 1 Jul 2025 15:08:31 +0100
Subject: [PATCH 1747/2760] qtest/bios-tables-test: Update blobs for its=off
 test on aarch64

Update blobs for the its=off test on aarch64 after fix.

Basically, all structs related to ITS are gone in MADT and IORT
tables after the fix (previously ITS was not properly disabled
when "its=off" option was passed to the machine).

MADT diff:

 [000h 0000   4]                    Signature : "APIC"    [Multiple APIC Description Table (MADT)]
-[004h 0004   4]                 Table Length : 000000B8
+[004h 0004   4]                 Table Length : 000000A4
 [008h 0008   1]                     Revision : 04
-[009h 0009   1]                     Checksum : C1
+[009h 0009   1]                     Checksum : 08
 [00Ah 0010   6]                       Oem ID : "BOCHS "
 [010h 0016   8]                 Oem Table ID : "BXPC    "
 [018h 0024   4]                 Oem Revision : 00000001
 [01Ch 0028   4]              Asl Compiler ID : "BXPC"
 [020h 0032   4]        Asl Compiler Revision : 00000001

 [024h 0036   4]           Local Apic Address : 00000000
 [028h 0040   4]        Flags (decoded below) : 00000000
                          PC-AT Compatibility : 0

 [02Ch 0044   1]                Subtable Type : 0C [Generic Interrupt Distributor]
 [02Dh 0045   1]                       Length : 18
 [02Eh 0046   2]                     Reserved : 0000
 [030h 0048   4]        Local GIC Hardware ID : 00000000
 [034h 0052   8]                 Base Address : 0000000008000000
 [03Ch 0060   4]               Interrupt Base : 00000000
@@ -48,37 +48,29 @@
 [064h 0100   8]                 Base Address : 0000000000000000
 [06Ch 0108   8]     Virtual GIC Base Address : 0000000000000000
 [074h 0116   8]  Hypervisor GIC Base Address : 0000000000000000
 [07Ch 0124   4]        Virtual GIC Interrupt : 00000000
 [080h 0128   8]   Redistributor Base Address : 0000000000000000
 [088h 0136   8]                    ARM MPIDR : 0000000000000000
 [090h 0144   1]             Efficiency Class : 00
 [091h 0145   1]                     Reserved : 00
 [092h 0146   2]       SPE Overflow Interrupt : 0000

 [094h 0148   1]                Subtable Type : 0E [Generic Interrupt Redistributor]
 [095h 0149   1]                       Length : 10
 [096h 0150   2]                     Reserved : 0000
 [098h 0152   8]                 Base Address : 00000000080A0000
 [0A0h 0160   4]                       Length : 00F60000

-[0A4h 0164   1]                Subtable Type : 0F [Generic Interrupt Translator]
-[0A5h 0165   1]                       Length : 14
-[0A6h 0166   2]                     Reserved : 0000
-[0A8h 0168   4]               Translation ID : 00000000
-[0ACh 0172   8]                 Base Address : 0000000008080000
-[0B4h 0180   4]                     Reserved : 00000000

IORT diff:

 [000h 0000   4]                    Signature : "IORT"    [IO Remapping Table]
-[004h 0004   4]                 Table Length : 000000EC
+[004h 0004   4]                 Table Length : 000000AC
 [008h 0008   1]                     Revision : 03
-[009h 0009   1]                     Checksum : 57
+[009h 0009   1]                     Checksum : 97
 [00Ah 0010   6]                       Oem ID : "BOCHS "
 [010h 0016   8]                 Oem Table ID : "BXPC    "
 [018h 0024   4]                 Oem Revision : 00000001
 [01Ch 0028   4]              Asl Compiler ID : "BXPC"
 [020h 0032   4]        Asl Compiler Revision : 00000001

-[024h 0036   4]                   Node Count : 00000003
+[024h 0036   4]                   Node Count : 00000002
 [028h 0040   4]                  Node Offset : 00000030
 [02Ch 0044   4]                     Reserved : 00000000

-[030h 0048   1]                         Type : 00
-[031h 0049   2]                       Length : 0018
-[033h 0051   1]                     Revision : 01
+[030h 0048   1]                         Type : 04
+[031h 0049   2]                       Length : 0044
+[033h 0051   1]                     Revision : 04
 [034h 0052   4]                     Reserved : 00000000
 [038h 0056   4]                Mapping Count : 00000000
 [03Ch 0060   4]               Mapping Offset : 00000000

-[040h 0064   4]                     ItsCount : 00000001
-[044h 0068   4]                  Identifiers : 00000000
-
-[048h 0072   1]                         Type : 04
-[049h 0073   2]                       Length : 0058
-[04Bh 0075   1]                     Revision : 04
-[04Ch 0076   4]                     Reserved : 00000001
-[050h 0080   4]                Mapping Count : 00000001
-[054h 0084   4]               Mapping Offset : 00000044
-
-[058h 0088   8]                 Base Address : 0000000009050000
-[060h 0096   4]        Flags (decoded below) : 00000001
+[040h 0064   8]                 Base Address : 0000000009050000
+[048h 0072   4]        Flags (decoded below) : 00000001
                              COHACC Override : 1
                                HTTU Override : 0
                       Proximity Domain Valid : 0
-[064h 0100   4]                     Reserved : 00000000
-[068h 0104   8]                VATOS Address : 0000000000000000
-[070h 0112   4]                        Model : 00000000
-[074h 0116   4]                   Event GSIV : 0000006A
-[078h 0120   4]                     PRI GSIV : 0000006B
-[07Ch 0124   4]                    GERR GSIV : 0000006D
-[080h 0128   4]                    Sync GSIV : 0000006C
-[084h 0132   4]             Proximity Domain : 00000000
-[088h 0136   4]      Device ID Mapping Index : 00000000
-
-[08Ch 0140   4]                   Input base : 00000000
-[090h 0144   4]                     ID Count : 0000FFFF
-[094h 0148   4]                  Output Base : 00000000
-[098h 0152   4]             Output Reference : 00000030
-[09Ch 0156   4]        Flags (decoded below) : 00000000
-                              Single Mapping : 0
-
-[0A0h 0160   1]                         Type : 02
-[0A1h 0161   2]                       Length : 004C
-[0A3h 0163   1]                     Revision : 03
-[0A4h 0164   4]                     Reserved : 00000002
-[0A8h 0168   4]                Mapping Count : 00000002
-[0ACh 0172   4]               Mapping Offset : 00000024
-
-[0B0h 0176   8]            Memory Properties : [IORT Memory Access Properties]
-[0B0h 0176   4]              Cache Coherency : 00000001
-[0B4h 0180   1]        Hints (decoded below) : 00
+[04Ch 0076   4]                     Reserved : 00000000
+[050h 0080   8]                VATOS Address : 0000000000000000
+[058h 0088   4]                        Model : 00000000
+[05Ch 0092   4]                   Event GSIV : 0000006A
+[060h 0096   4]                     PRI GSIV : 0000006B
+[064h 0100   4]                    GERR GSIV : 0000006D
+[068h 0104   4]                    Sync GSIV : 0000006C
+[06Ch 0108   4]             Proximity Domain : 00000000
+[070h 0112   4]      Device ID Mapping Index : 00000000
+
+[074h 0116   1]                         Type : 02
+[075h 0117   2]                       Length : 0038
+[077h 0119   1]                     Revision : 03
+[078h 0120   4]                     Reserved : 00000001
+[07Ch 0124   4]                Mapping Count : 00000001
+[080h 0128   4]               Mapping Offset : 00000024
+
+[084h 0132   8]            Memory Properties : [IORT Memory Access Properties]
+[084h 0132   4]              Cache Coherency : 00000001
+[088h 0136   1]        Hints (decoded below) : 00
                                    Transient : 0
                               Write Allocate : 0
                                Read Allocate : 0
                                     Override : 0
-[0B5h 0181   2]                     Reserved : 0000
-[0B7h 0183   1] Memory Flags (decoded below) : 03
+[089h 0137   2]                     Reserved : 0000
+[08Bh 0139   1] Memory Flags (decoded below) : 03
                                    Coherency : 1
                             Device Attribute : 1
-[0B8h 0184   4]                ATS Attribute : 00000000
-[0BCh 0188   4]           PCI Segment Number : 00000000
-[0C0h 0192   1]            Memory Size Limit : 40
-[0C1h 0193   3]                     Reserved : 000000
-
-[0C4h 0196   4]                   Input base : 00000000
-[0C8h 0200   4]                     ID Count : 000000FF
-[0CCh 0204   4]                  Output Base : 00000000
-[0D0h 0208   4]             Output Reference : 00000048
-[0D4h 0212   4]        Flags (decoded below) : 00000000
-                              Single Mapping : 0
-
-[0D8h 0216   4]                   Input base : 00000100
-[0DCh 0220   4]                     ID Count : 0000FEFF
-[0E0h 0224   4]                  Output Base : 00000100
-[0E4h 0228   4]             Output Reference : 00000030
-[0E8h 0232   4]        Flags (decoded below) : 00000000
+[08Ch 0140   4]                ATS Attribute : 00000000
+[090h 0144   4]           PCI Segment Number : 00000000
+[094h 0148   1]            Memory Size Limit : 40
+[095h 0149   3]                     Reserved : 000000
+
+[098h 0152   4]                   Input base : 00000000
+[09Ch 0156   4]                     ID Count : 000000FF
+[0A0h 0160   4]                  Output Base : 00000000
+[0A4h 0164   4]             Output Reference : 00000030
+[0A8h 0168   4]        Flags (decoded below) : 00000000
                               Single Mapping : 0

Signed-off-by: Gustavo Romero <gustavo.romero@linaro.org>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Message-id: 20250628195722.977078-10-gustavo.romero@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/data/acpi/aarch64/virt/APIC.its_off   | Bin 184 -> 164 bytes
 tests/data/acpi/aarch64/virt/IORT.its_off   | Bin 236 -> 172 bytes
 tests/qtest/bios-tables-test-allowed-diff.h |   2 --
 3 files changed, 2 deletions(-)

diff --git a/tests/data/acpi/aarch64/virt/APIC.its_off b/tests/data/acpi/aarch64/virt/APIC.its_off
index 37d82e970b1331cb5b259f0bd2d3654bacb2d623..6130cb7d07103b326feb4dcd7034f85808bebadf 100644
GIT binary patch
delta 18
ZcmdnNxP+0*F~HM#2?GNI3&%vRSpY2+1Zw~Q

delta 39
kcmZ3&xPy_)F~HM#2Ll5G%fX3Uvqbns7@&ZI1Il0k0HXl~e*gdg

diff --git a/tests/data/acpi/aarch64/virt/IORT.its_off b/tests/data/acpi/aarch64/virt/IORT.its_off
index 0fceb820d509e852ca0849baf568a8e93e426738..c10da4e61dd00e7eb062558a2735d49ca0b20620 100644
GIT binary patch
delta 69
zcmaFExQ3C-(?2L=4FdxM^Yn>aQj$yz3=9Sg5WwQXzye`0FfdFEHRoiqU|?osU|?XJ
KxKf=1rV0Re_y}_V

delta 133
zcmZ3(_=b_o(?2NW4FdxMbNECqDMMxk1_lELD3D-agtEXCjKdPazye}}u**bSb6Jq=
k|NkHop_$2tftiVcfq`jat-6c{M2-Pu-v56LU>ar%0P9K(ZvX%Q

diff --git a/tests/qtest/bios-tables-test-allowed-diff.h b/tests/qtest/bios-tables-test-allowed-diff.h
index a88198d5c2..dfb8523c8b 100644
--- a/tests/qtest/bios-tables-test-allowed-diff.h
+++ b/tests/qtest/bios-tables-test-allowed-diff.h
@@ -1,3 +1 @@
 /* List of comma-separated changed AML files to ignore */
-"tests/data/acpi/aarch64/virt/APIC.its_off",
-"tests/data/acpi/aarch64/virt/IORT.its_off",

From a5b94f6c7b3a6ae583ba07098bff810049262413 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 1 Jul 2025 15:08:31 +0100
Subject: [PATCH 1748/2760] target/arm: Remove arm_handle_psci_call() stub
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since commit 0c1aaa66c24 ("target/arm: wrap psci call with
tcg_enabled") the arm_handle_psci_call() call is elided
when TCG is disabled.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250623121845.7214-2-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/internals.h | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index 6216f68c94..21a8d67edd 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -650,16 +650,12 @@ static inline bool arm_is_psci_call(ARMCPU *cpu, int excp_type)
 {
     return false;
 }
-static inline void arm_handle_psci_call(ARMCPU *cpu)
-{
-    g_assert_not_reached();
-}
 #else
 /* Return true if the r0/x0 value indicates that this SMC/HVC is a PSCI call. */
 bool arm_is_psci_call(ARMCPU *cpu, int excp_type);
+#endif
 /* Actually handle a PSCI call */
 void arm_handle_psci_call(ARMCPU *cpu);
-#endif
 
 /**
  * arm_clear_exclusive: clear the exclusive monitor

From 4a94d8047d9dca2d7e73bbc863fabbea2df1bab6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 1 Jul 2025 15:08:32 +0100
Subject: [PATCH 1749/2760] target/arm: Reduce arm_cpu_post_init() declaration
 scope
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

arm_cpu_post_init() is only used within the same file unit.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250623121845.7214-3-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.c | 2 +-
 target/arm/cpu.h | 2 --
 2 files changed, 1 insertion(+), 3 deletions(-)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index 8e77414c2b..7030540f91 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -1713,7 +1713,7 @@ static void arm_cpu_propagate_feature_implications(ARMCPU *cpu)
     }
 }
 
-void arm_cpu_post_init(Object *obj)
+static void arm_cpu_post_init(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
 
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index 8744922330..0338153923 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -1168,8 +1168,6 @@ void arm_gt_sel2vtimer_cb(void *opaque);
 unsigned int gt_cntfrq_period_ns(ARMCPU *cpu);
 void gt_rme_post_el_change(ARMCPU *cpu, void *opaque);
 
-void arm_cpu_post_init(Object *obj);
-
 #define ARM_AFF0_SHIFT 0
 #define ARM_AFF0_MASK  (0xFFULL << ARM_AFF0_SHIFT)
 #define ARM_AFF1_SHIFT 8

From a74b63b3a4451bec2f0d77fc101cf066d1e0fdb1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 1 Jul 2025 15:08:32 +0100
Subject: [PATCH 1750/2760] target/arm: Unify gen_exception_internal()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Same code, use the generic variant.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250623121845.7214-4-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/translate-a64.c | 6 ------
 target/arm/tcg/translate.c     | 2 +-
 target/arm/tcg/translate.h     | 1 +
 3 files changed, 2 insertions(+), 7 deletions(-)

diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index d0719b5665..815225b130 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -433,12 +433,6 @@ static void gen_rebuild_hflags(DisasContext *s)
     gen_helper_rebuild_hflags_a64(tcg_env, tcg_constant_i32(s->current_el));
 }
 
-static void gen_exception_internal(int excp)
-{
-    assert(excp_is_internal(excp));
-    gen_helper_exception_internal(tcg_env, tcg_constant_i32(excp));
-}
-
 static void gen_exception_internal_insn(DisasContext *s, int excp)
 {
     gen_a64_update_pc(s, 0);
diff --git a/target/arm/tcg/translate.c b/target/arm/tcg/translate.c
index 9962f43b1d..f7d6d8ce19 100644
--- a/target/arm/tcg/translate.c
+++ b/target/arm/tcg/translate.c
@@ -372,7 +372,7 @@ static void gen_rebuild_hflags(DisasContext *s, bool new_el)
     }
 }
 
-static void gen_exception_internal(int excp)
+void gen_exception_internal(int excp)
 {
     assert(excp_is_internal(excp));
     gen_helper_exception_internal(tcg_env, tcg_constant_i32(excp));
diff --git a/target/arm/tcg/translate.h b/target/arm/tcg/translate.h
index 1bfdb0fb9b..0004a97219 100644
--- a/target/arm/tcg/translate.h
+++ b/target/arm/tcg/translate.h
@@ -347,6 +347,7 @@ void arm_jump_cc(DisasCompare *cmp, TCGLabel *label);
 void arm_gen_test_cc(int cc, TCGLabel *label);
 MemOp pow2_align(unsigned i);
 void unallocated_encoding(DisasContext *s);
+void gen_exception_internal(int excp);
 void gen_exception_insn_el(DisasContext *s, target_long pc_diff, int excp,
                            uint32_t syn, uint32_t target_el);
 void gen_exception_insn(DisasContext *s, target_long pc_diff,

From 30484a6635161e8bd62014542c5fd15bbf14834f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 1 Jul 2025 15:08:32 +0100
Subject: [PATCH 1751/2760] target/arm/hvf: Directly re-lock BQL after
 hv_vcpu_run()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Keep bql_unlock() / bql_lock() close.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Acked-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-id: 20250623121845.7214-6-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/hvf/hvf.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index 5c95ccc5b8..3c234f7b11 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -1915,7 +1915,9 @@ int hvf_vcpu_exec(CPUState *cpu)
     flush_cpu_state(cpu);
 
     bql_unlock();
-    assert_hvf_ok(hv_vcpu_run(cpu->accel->fd));
+    r = hv_vcpu_run(cpu->accel->fd);
+    bql_lock();
+    assert_hvf_ok(r);
 
     /* handle VMEXIT */
     uint64_t exit_reason = hvf_exit->reason;
@@ -1923,7 +1925,6 @@ int hvf_vcpu_exec(CPUState *cpu)
     uint32_t ec = syn_get_ec(syndrome);
 
     ret = 0;
-    bql_lock();
     switch (exit_reason) {
     case HV_EXIT_REASON_EXCEPTION:
         /* This is the main one, handle below. */

From 4dcba9072be2c1e32f3fb676e97b098d5a9b66ad Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 1 Jul 2025 15:08:32 +0100
Subject: [PATCH 1752/2760] target/arm/hvf: Trace hv_vcpu_run() failures
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Allow distinguishing HV_ILLEGAL_GUEST_STATE in trace events.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250623121845.7214-7-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/hvf/hvf.c        | 10 +++++++++-
 target/arm/hvf/trace-events |  1 +
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index 3c234f7b11..0943365a68 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -1917,7 +1917,15 @@ int hvf_vcpu_exec(CPUState *cpu)
     bql_unlock();
     r = hv_vcpu_run(cpu->accel->fd);
     bql_lock();
-    assert_hvf_ok(r);
+    switch (r) {
+    case HV_SUCCESS:
+        break;
+    case HV_ILLEGAL_GUEST_STATE:
+        trace_hvf_illegal_guest_state();
+        /* fall through */
+    default:
+        g_assert_not_reached();
+    }
 
     /* handle VMEXIT */
     uint64_t exit_reason = hvf_exit->reason;
diff --git a/target/arm/hvf/trace-events b/target/arm/hvf/trace-events
index 4fbbe4b45e..a4870e0a5c 100644
--- a/target/arm/hvf/trace-events
+++ b/target/arm/hvf/trace-events
@@ -11,3 +11,4 @@ hvf_exit(uint64_t syndrome, uint32_t ec, uint64_t pc) "exit: 0x%"PRIx64" [ec=0x%
 hvf_psci_call(uint64_t x0, uint64_t x1, uint64_t x2, uint64_t x3, uint32_t cpuid) "PSCI Call x0=0x%016"PRIx64" x1=0x%016"PRIx64" x2=0x%016"PRIx64" x3=0x%016"PRIx64" cpu=0x%x"
 hvf_vgic_write(const char *name, uint64_t val) "vgic write to %s [val=0x%016"PRIx64"]"
 hvf_vgic_read(const char *name, uint64_t val) "vgic read from %s [val=0x%016"PRIx64"]"
+hvf_illegal_guest_state(void) "HV_ILLEGAL_GUEST_STATE"

From d17d5cc0d68cc1dbce4a9086ce1cb8c3aebb085c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 1 Jul 2025 15:08:33 +0100
Subject: [PATCH 1753/2760] accel/hvf: Trace VM memory mapping
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Trace memory mapped / unmapped in the guest.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250623121845.7214-8-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 accel/hvf/hvf-accel-ops.c | 6 ++++++
 accel/hvf/trace-events    | 7 +++++++
 accel/hvf/trace.h         | 2 ++
 meson.build               | 1 +
 4 files changed, 16 insertions(+)
 create mode 100644 accel/hvf/trace-events
 create mode 100644 accel/hvf/trace.h

diff --git a/accel/hvf/hvf-accel-ops.c b/accel/hvf/hvf-accel-ops.c
index d60446b85b..b38977207d 100644
--- a/accel/hvf/hvf-accel-ops.c
+++ b/accel/hvf/hvf-accel-ops.c
@@ -59,6 +59,7 @@
 #include "system/hvf_int.h"
 #include "system/runstate.h"
 #include "qemu/guest-random.h"
+#include "trace.h"
 
 HVFState *hvf_state;
 
@@ -97,6 +98,7 @@ static int do_hvf_set_memory(hvf_slot *slot, hv_memory_flags_t flags)
     if (macslot->present) {
         if (macslot->size != slot->size) {
             macslot->present = 0;
+            trace_hvf_vm_unmap(macslot->gpa_start, macslot->size);
             ret = hv_vm_unmap(macslot->gpa_start, macslot->size);
             assert_hvf_ok(ret);
         }
@@ -109,6 +111,10 @@ static int do_hvf_set_memory(hvf_slot *slot, hv_memory_flags_t flags)
     macslot->present = 1;
     macslot->gpa_start = slot->start;
     macslot->size = slot->size;
+    trace_hvf_vm_map(slot->start, slot->size, slot->mem, flags,
+                     flags & HV_MEMORY_READ ?  'R' : '-',
+                     flags & HV_MEMORY_WRITE ? 'W' : '-',
+                     flags & HV_MEMORY_EXEC ?  'E' : '-');
     ret = hv_vm_map(slot->mem, slot->start, slot->size, flags);
     assert_hvf_ok(ret);
     return 0;
diff --git a/accel/hvf/trace-events b/accel/hvf/trace-events
new file mode 100644
index 0000000000..2fd3e127c7
--- /dev/null
+++ b/accel/hvf/trace-events
@@ -0,0 +1,7 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+#
+# See docs/devel/tracing.rst for syntax documentation.
+
+# hvf-accel-ops.c
+hvf_vm_map(uint64_t paddr, uint64_t size, void *vaddr, uint8_t flags, const char r, const char w, const char e) "paddr:0x%016"PRIx64" size:0x%08"PRIx64" vaddr:%p flags:0x%02x/%c%c%c"
+hvf_vm_unmap(uint64_t paddr, uint64_t size) "paddr:0x%016"PRIx64" size:0x%08"PRIx64
diff --git a/accel/hvf/trace.h b/accel/hvf/trace.h
new file mode 100644
index 0000000000..83a1883343
--- /dev/null
+++ b/accel/hvf/trace.h
@@ -0,0 +1,2 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+#include "trace/trace-accel_hvf.h"
diff --git a/meson.build b/meson.build
index dbc97bfdf7..b5f74aa37a 100644
--- a/meson.build
+++ b/meson.build
@@ -3630,6 +3630,7 @@ if have_block
 endif
 if have_system
   trace_events_subdirs += [
+    'accel/hvf',
     'accel/kvm',
     'audio',
     'backends',

From 9097c0cd611d0f1924041c85b9aeab41ecbd1a9a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 1 Jul 2025 15:08:33 +0100
Subject: [PATCH 1754/2760] target/arm/hvf: Log $pc in hvf_unknown_hvc() trace
 event
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Tracing $PC for unknown HVC instructions to not have to
look at the disassembled flow of instructions.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250623121845.7214-9-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/hvf/hvf.c        | 4 ++--
 target/arm/hvf/trace-events | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index 0943365a68..f36973a32e 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -2072,12 +2072,12 @@ int hvf_vcpu_exec(CPUState *cpu)
         cpu_synchronize_state(cpu);
         if (arm_cpu->psci_conduit == QEMU_PSCI_CONDUIT_HVC) {
             if (!hvf_handle_psci_call(cpu)) {
-                trace_hvf_unknown_hvc(env->xregs[0]);
+                trace_hvf_unknown_hvc(env->pc, env->xregs[0]);
                 /* SMCCC 1.3 section 5.2 says every unknown SMCCC call returns -1 */
                 env->xregs[0] = -1;
             }
         } else {
-            trace_hvf_unknown_hvc(env->xregs[0]);
+            trace_hvf_unknown_hvc(env->pc, env->xregs[0]);
             hvf_raise_exception(cpu, EXCP_UDEF, syn_uncategorized());
         }
         break;
diff --git a/target/arm/hvf/trace-events b/target/arm/hvf/trace-events
index a4870e0a5c..b49746f28d 100644
--- a/target/arm/hvf/trace-events
+++ b/target/arm/hvf/trace-events
@@ -5,10 +5,10 @@ hvf_inject_irq(void) "injecting IRQ"
 hvf_data_abort(uint64_t pc, uint64_t va, uint64_t pa, bool isv, bool iswrite, bool s1ptw, uint32_t len, uint32_t srt) "data abort: [pc=0x%"PRIx64" va=0x%016"PRIx64" pa=0x%016"PRIx64" isv=%d iswrite=%d s1ptw=%d len=%d srt=%d]"
 hvf_sysreg_read(uint32_t reg, uint32_t op0, uint32_t op1, uint32_t crn, uint32_t crm, uint32_t op2, uint64_t val) "sysreg read 0x%08x (op0=%d op1=%d crn=%d crm=%d op2=%d) = 0x%016"PRIx64
 hvf_sysreg_write(uint32_t reg, uint32_t op0, uint32_t op1, uint32_t crn, uint32_t crm, uint32_t op2, uint64_t val) "sysreg write 0x%08x (op0=%d op1=%d crn=%d crm=%d op2=%d, val=0x%016"PRIx64")"
-hvf_unknown_hvc(uint64_t x0) "unknown HVC! 0x%016"PRIx64
+hvf_unknown_hvc(uint64_t pc, uint64_t x0) "pc=0x%"PRIx64" unknown HVC! 0x%016"PRIx64
 hvf_unknown_smc(uint64_t x0) "unknown SMC! 0x%016"PRIx64
 hvf_exit(uint64_t syndrome, uint32_t ec, uint64_t pc) "exit: 0x%"PRIx64" [ec=0x%x pc=0x%"PRIx64"]"
-hvf_psci_call(uint64_t x0, uint64_t x1, uint64_t x2, uint64_t x3, uint32_t cpuid) "PSCI Call x0=0x%016"PRIx64" x1=0x%016"PRIx64" x2=0x%016"PRIx64" x3=0x%016"PRIx64" cpu=0x%x"
+hvf_psci_call(uint64_t x0, uint64_t x1, uint64_t x2, uint64_t x3, uint32_t cpuid) "PSCI Call x0=0x%016"PRIx64" x1=0x%016"PRIx64" x2=0x%016"PRIx64" x3=0x%016"PRIx64" cpuid=0x%x"
 hvf_vgic_write(const char *name, uint64_t val) "vgic write to %s [val=0x%016"PRIx64"]"
 hvf_vgic_read(const char *name, uint64_t val) "vgic read from %s [val=0x%016"PRIx64"]"
 hvf_illegal_guest_state(void) "HV_ILLEGAL_GUEST_STATE"

From a412575837b6a46584fba891e3706e87bd09a3e6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 1 Jul 2025 15:08:33 +0100
Subject: [PATCH 1755/2760] target/arm: Correct KVM & HVF dtb_compatible value
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Linux kernel knows how to parse "arm,armv8", not "arm,arm-v8".

See arch/arm64/boot/dts/foundation-v8.dts:

  https://github.com/torvalds/linux/commit/90556ca1ebdd

Cc: qemu-stable@nongnu.org
Fixes: 26861c7ce06 ("target-arm: Add minimal KVM AArch64 support")
Fixes: 585df85efea ("hvf: arm: Implement -cpu host")
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250623121845.7214-10-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/hvf/hvf.c | 2 +-
 target/arm/kvm.c     | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index f36973a32e..ebde4c6f18 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -883,7 +883,7 @@ static bool hvf_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
     hv_vcpu_exit_t *exit;
     int i;
 
-    ahcf->dtb_compatible = "arm,arm-v8";
+    ahcf->dtb_compatible = "arm,armv8";
     ahcf->features = (1ULL << ARM_FEATURE_V8) |
                      (1ULL << ARM_FEATURE_NEON) |
                      (1ULL << ARM_FEATURE_AARCH64) |
diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index 70919aedd0..426f8b159e 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -289,7 +289,7 @@ static bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
     }
 
     ahcf->target = init.target;
-    ahcf->dtb_compatible = "arm,arm-v8";
+    ahcf->dtb_compatible = "arm,armv8";
     int fd = fdarray[2];
 
     err = get_host_cpu_reg(fd, ahcf, ID_AA64PFR0_EL1_IDX);

From 38d4089c048a055f36d21ef009b09612e60ac226 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 1 Jul 2025 15:08:34 +0100
Subject: [PATCH 1756/2760] target/arm/hvf: Pass @target_el argument to
 hvf_raise_exception()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In preparation of raising exceptions at EL2, add the 'target_el'
argument to hvf_raise_exception().

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250623121845.7214-12-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/hvf/hvf.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index ebde4c6f18..7b6d291e79 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -1088,13 +1088,13 @@ void hvf_kick_vcpu_thread(CPUState *cpu)
 }
 
 static void hvf_raise_exception(CPUState *cpu, uint32_t excp,
-                                uint32_t syndrome)
+                                uint32_t syndrome, int target_el)
 {
     ARMCPU *arm_cpu = ARM_CPU(cpu);
     CPUARMState *env = &arm_cpu->env;
 
     cpu->exception_index = excp;
-    env->exception.target_el = 1;
+    env->exception.target_el = target_el;
     env->exception.syndrome = syndrome;
 
     arm_cpu_do_interrupt(cpu);
@@ -1454,7 +1454,7 @@ static int hvf_sysreg_read(CPUState *cpu, uint32_t reg, uint64_t *val)
                                     SYSREG_CRN(reg),
                                     SYSREG_CRM(reg),
                                     SYSREG_OP2(reg));
-    hvf_raise_exception(cpu, EXCP_UDEF, syn_uncategorized());
+    hvf_raise_exception(cpu, EXCP_UDEF, syn_uncategorized(), 1);
     return 1;
 }
 
@@ -1764,7 +1764,7 @@ static int hvf_sysreg_write(CPUState *cpu, uint32_t reg, uint64_t val)
                                      SYSREG_CRN(reg),
                                      SYSREG_CRM(reg),
                                      SYSREG_OP2(reg));
-    hvf_raise_exception(cpu, EXCP_UDEF, syn_uncategorized());
+    hvf_raise_exception(cpu, EXCP_UDEF, syn_uncategorized(), 1);
     return 1;
 }
 
@@ -1967,7 +1967,7 @@ int hvf_vcpu_exec(CPUState *cpu)
         if (!hvf_find_sw_breakpoint(cpu, env->pc)) {
             /* Re-inject into the guest */
             ret = 0;
-            hvf_raise_exception(cpu, EXCP_BKPT, syn_aa64_bkpt(0));
+            hvf_raise_exception(cpu, EXCP_BKPT, syn_aa64_bkpt(0), 1);
         }
         break;
     }
@@ -2078,7 +2078,7 @@ int hvf_vcpu_exec(CPUState *cpu)
             }
         } else {
             trace_hvf_unknown_hvc(env->pc, env->xregs[0]);
-            hvf_raise_exception(cpu, EXCP_UDEF, syn_uncategorized());
+            hvf_raise_exception(cpu, EXCP_UDEF, syn_uncategorized(), 1);
         }
         break;
     case EC_AA64_SMC:
@@ -2093,7 +2093,7 @@ int hvf_vcpu_exec(CPUState *cpu)
             }
         } else {
             trace_hvf_unknown_smc(env->xregs[0]);
-            hvf_raise_exception(cpu, EXCP_UDEF, syn_uncategorized());
+            hvf_raise_exception(cpu, EXCP_UDEF, syn_uncategorized(), 1);
         }
         break;
     default:

From 532884658d606160ff3ad73c73c05fddf3504d9b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 1 Jul 2025 15:08:34 +0100
Subject: [PATCH 1757/2760] target/arm: Restrict system register properties to
 system binary
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Do not expose the following system-specific properties on user-mode
binaries:

 - psci-conduit
 - cntfrq (ARM_FEATURE_GENERIC_TIMER)
 - rvbar (ARM_FEATURE_V8)
 - has-mpu (ARM_FEATURE_PMSA)
 - pmsav7-dregion (ARM_FEATURE_PMSA)
 - reset-cbar (ARM_FEATURE_CBAR)
 - reset-hivecs (ARM_FEATURE_M)
 - init-nsvtor (ARM_FEATURE_M)
 - init-svtor (ARM_FEATURE_M_SECURITY)
 - idau (ARM_FEATURE_M_SECURITY)

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250623121845.7214-13-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index 7030540f91..a59a5b57af 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -1500,6 +1500,7 @@ static void arm_cpu_initfn(Object *obj)
  * 0 means "unset, use the default value". That default might vary depending
  * on the CPU type, and is set in the realize fn.
  */
+#ifndef CONFIG_USER_ONLY
 static const Property arm_cpu_gt_cntfrq_property =
             DEFINE_PROP_UINT64("cntfrq", ARMCPU, gt_cntfrq_hz, 0);
 
@@ -1509,7 +1510,6 @@ static const Property arm_cpu_reset_cbar_property =
 static const Property arm_cpu_reset_hivecs_property =
             DEFINE_PROP_BOOL("reset-hivecs", ARMCPU, reset_hivecs, false);
 
-#ifndef CONFIG_USER_ONLY
 static const Property arm_cpu_has_el2_property =
             DEFINE_PROP_BOOL("has_el2", ARMCPU, has_el2, true);
 
@@ -1532,6 +1532,7 @@ static const Property arm_cpu_has_neon_property =
 static const Property arm_cpu_has_dsp_property =
             DEFINE_PROP_BOOL("dsp", ARMCPU, has_dsp, true);
 
+#ifndef CONFIG_USER_ONLY
 static const Property arm_cpu_has_mpu_property =
             DEFINE_PROP_BOOL("has-mpu", ARMCPU, has_mpu, true);
 
@@ -1544,6 +1545,7 @@ static const Property arm_cpu_pmsav7_dregion_property =
             DEFINE_PROP_UNSIGNED_NODEFAULT("pmsav7-dregion", ARMCPU,
                                            pmsav7_dregion,
                                            qdev_prop_uint32, uint32_t);
+#endif
 
 static bool arm_get_pmu(Object *obj, Error **errp)
 {
@@ -1731,6 +1733,7 @@ static void arm_cpu_post_init(Object *obj)
                                         "Set on/off to enable/disable aarch64 "
                                         "execution state ");
     }
+#ifndef CONFIG_USER_ONLY
     if (arm_feature(&cpu->env, ARM_FEATURE_CBAR) ||
         arm_feature(&cpu->env, ARM_FEATURE_CBAR_RO)) {
         qdev_property_add_static(DEVICE(obj), &arm_cpu_reset_cbar_property);
@@ -1746,7 +1749,6 @@ static void arm_cpu_post_init(Object *obj)
                                        OBJ_PROP_FLAG_READWRITE);
     }
 
-#ifndef CONFIG_USER_ONLY
     if (arm_feature(&cpu->env, ARM_FEATURE_EL3)) {
         /* Add the has_el3 state CPU property only if EL3 is allowed.  This will
          * prevent "has_el3" from existing on CPUs which cannot support EL3.
@@ -1818,6 +1820,7 @@ static void arm_cpu_post_init(Object *obj)
         qdev_property_add_static(DEVICE(obj), &arm_cpu_has_dsp_property);
     }
 
+#ifndef CONFIG_USER_ONLY
     if (arm_feature(&cpu->env, ARM_FEATURE_PMSA)) {
         qdev_property_add_static(DEVICE(obj), &arm_cpu_has_mpu_property);
         if (arm_feature(&cpu->env, ARM_FEATURE_V7)) {
@@ -1854,8 +1857,6 @@ static void arm_cpu_post_init(Object *obj)
                                    &cpu->psci_conduit,
                                    OBJ_PROP_FLAG_READWRITE);
 
-    qdev_property_add_static(DEVICE(obj), &arm_cpu_cfgend_property);
-
     if (arm_feature(&cpu->env, ARM_FEATURE_GENERIC_TIMER)) {
         qdev_property_add_static(DEVICE(cpu), &arm_cpu_gt_cntfrq_property);
     }
@@ -1864,7 +1865,6 @@ static void arm_cpu_post_init(Object *obj)
         kvm_arm_add_vcpu_properties(cpu);
     }
 
-#ifndef CONFIG_USER_ONLY
     if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64) &&
         cpu_isar_feature(aa64_mte, cpu)) {
         object_property_add_link(obj, "tag-memory",
@@ -1882,6 +1882,7 @@ static void arm_cpu_post_init(Object *obj)
         }
     }
 #endif
+    qdev_property_add_static(DEVICE(obj), &arm_cpu_cfgend_property);
 }
 
 static void arm_cpu_finalizefn(Object *obj)

From 1370fd56ec771f16197f255c25c910e9386ac587 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 1 Jul 2025 15:08:34 +0100
Subject: [PATCH 1758/2760] hw/arm/virt: Make EL3-guest accel check an
 accept-list
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Currently only the TCG and qtest accelerators can handle an EL3
guest.  Instead of making the condition check be "fail if KVM or HVF"
(an exclude-list), make it a be "allow if TCG or qtest" (an
accept-list).

This is better for if/when we add new accelerators, as it makes the
default be that we forbid an EL3 guest.  This is the most likely to
be correct and also "fails safe"; if the new accelerator really can
support EL3 guests then the implementor will see that they need to
add it to the accept-list.

Reported-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250623121845.7214-19-philmd@linaro.org
[PMM: rewrote commit message]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index ae419e8671..b3b1c6df7f 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -2200,7 +2200,7 @@ static void machvirt_init(MachineState *machine)
         exit(1);
     }
 
-    if (vms->secure && (kvm_enabled() || hvf_enabled())) {
+    if (vms->secure && !tcg_enabled() && !qtest_enabled()) {
         error_report("mach-virt: %s does not support providing "
                      "Security extensions (TrustZone) to the guest CPU",
                      current_accel_name());

From 164258da4a24464a502b6ece6fce9fc6ca1c0207 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 1 Jul 2025 15:08:34 +0100
Subject: [PATCH 1759/2760] hw/arm/virt: Make EL2 accelerator check an
 accept-list
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Currently only the TCG and qtest accelerators can handle an EL2
guest.  Instead of making the condition check be "fail if KVM or HVF"
(an exclude-list), make it a be "allow if TCG or qtest" (an
accept-list).

This is better for if/when we add new accelerators, as it makes the
default be that we forbid an EL2 guest.  This is the most likely to
be correct and also "fails safe"; if the new accelerator really can
support EL2 guests then the implementor will see that they need to
add it to the accept-list.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20250623121845.7214-20-philmd@linaro.org
[PMM: rewrote commit message]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index b3b1c6df7f..30f91bcfb3 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -2207,7 +2207,7 @@ static void machvirt_init(MachineState *machine)
         exit(1);
     }
 
-    if (vms->virt && (kvm_enabled() || hvf_enabled())) {
+    if (vms->virt && !tcg_enabled() && !qtest_enabled()) {
         error_report("mach-virt: %s does not support providing "
                      "Virtualization extensions to the guest CPU",
                      current_accel_name());

From c6a613094e48fc83ee5c65464dccd90fae637516 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 1 Jul 2025 15:08:35 +0100
Subject: [PATCH 1760/2760] hw/arm/virt: Rename cpu_post_init() ->
 post_cpus_gic_realized()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

QDev uses _post_init() during instance creation, before being
realized. Since here both vCPUs and GIC are REALIZED, rename
as virt_post_cpus_gic_realized() for clarity.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250623121845.7214-21-philmd@linaro.org
[PMM: also fixed up comment]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index 30f91bcfb3..3bcdf92e2f 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -2026,10 +2026,11 @@ static void finalize_gic_version(VirtMachineState *vms)
 }
 
 /*
- * virt_cpu_post_init() must be called after the CPUs have
- * been realized and the GIC has been created.
+ * virt_post_cpus_gic_realized() must be called after the CPUs and
+ * the GIC have both been realized.
  */
-static void virt_cpu_post_init(VirtMachineState *vms, MemoryRegion *sysmem)
+static void virt_post_cpus_gic_realized(VirtMachineState *vms,
+                                        MemoryRegion *sysmem)
 {
     int max_cpus = MACHINE(vms)->smp.max_cpus;
     bool aarch64, pmu, steal_time;
@@ -2346,7 +2347,7 @@ static void machvirt_init(MachineState *machine)
 
     create_gic(vms, sysmem);
 
-    virt_cpu_post_init(vms, sysmem);
+    virt_post_cpus_gic_realized(vms, sysmem);
 
     fdt_add_pmu_nodes(vms);
 

From 4e24ea43a126822d0c3d28d57b500ac9bbce5735 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 1 Jul 2025 15:08:35 +0100
Subject: [PATCH 1761/2760] hw/arm/sbsa-ref: Tidy up use of RAMLIMIT_GB
 definition
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Define RAMLIMIT_BYTES using the TiB definition and display
the error parsed with size_to_str():

  $ qemu-system-aarch64-unsigned -M sbsa-ref -m 9T
  qemu-system-aarch64-unsigned: sbsa-ref: cannot model more than 8 TiB of RAM

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250623121845.7214-22-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/sbsa-ref.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c
index deae5cf986..15c1ff4b14 100644
--- a/hw/arm/sbsa-ref.c
+++ b/hw/arm/sbsa-ref.c
@@ -19,6 +19,7 @@
  */
 
 #include "qemu/osdep.h"
+#include "qemu/cutils.h"
 #include "qemu/datadir.h"
 #include "qapi/error.h"
 #include "qemu/error-report.h"
@@ -53,8 +54,7 @@
 #include "target/arm/cpu-qom.h"
 #include "target/arm/gtimer.h"
 
-#define RAMLIMIT_GB 8192
-#define RAMLIMIT_BYTES (RAMLIMIT_GB * GiB)
+#define RAMLIMIT_BYTES (8 * TiB)
 
 #define NUM_IRQS        256
 #define NUM_SMMU_IRQS   4
@@ -756,7 +756,9 @@ static void sbsa_ref_init(MachineState *machine)
     sms->smp_cpus = smp_cpus;
 
     if (machine->ram_size > sbsa_ref_memmap[SBSA_MEM].size) {
-        error_report("sbsa-ref: cannot model more than %dGB RAM", RAMLIMIT_GB);
+        char *size_str = size_to_str(RAMLIMIT_BYTES);
+
+        error_report("sbsa-ref: cannot model more than %s of RAM", size_str);
         exit(1);
     }
 

From 9bc4c2a6118ab1713155dedd14ccdae8dde71de1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 1 Jul 2025 15:08:35 +0100
Subject: [PATCH 1762/2760] tests/functional: Set sbsa-ref machine type in each
 test function
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

fetch_firmware() is only about fetching firmware.
Set the machine type and its default console in
test_sbsaref_edk2_firmware().

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Leif Lindholm <leif.lindholm@oss.qualcomm.com>
Message-id: 20250623121845.7214-23-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/functional/test_aarch64_sbsaref.py         | 5 +++--
 tests/functional/test_aarch64_sbsaref_alpine.py  | 3 ++-
 tests/functional/test_aarch64_sbsaref_freebsd.py | 3 ++-
 3 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/tests/functional/test_aarch64_sbsaref.py b/tests/functional/test_aarch64_sbsaref.py
index e6a55aecfa..d3402f5080 100755
--- a/tests/functional/test_aarch64_sbsaref.py
+++ b/tests/functional/test_aarch64_sbsaref.py
@@ -40,8 +40,6 @@ def fetch_firmware(test):
         with open(path, "ab+") as fd:
             fd.truncate(256 << 20)  # Expand volumes to 256MiB
 
-    test.set_machine('sbsa-ref')
-    test.vm.set_console()
     test.vm.add_args(
         "-drive", f"if=pflash,file={fs0_path},format=raw",
         "-drive", f"if=pflash,file={fs1_path},format=raw",
@@ -68,8 +66,11 @@ class Aarch64SbsarefMachine(QemuSystemTest):
 
     def test_sbsaref_edk2_firmware(self):
 
+        self.set_machine('sbsa-ref')
+
         fetch_firmware(self)
 
+        self.vm.set_console()
         self.vm.add_args('-cpu', 'cortex-a57')
         self.vm.launch()
 
diff --git a/tests/functional/test_aarch64_sbsaref_alpine.py b/tests/functional/test_aarch64_sbsaref_alpine.py
index 6108ec65a5..8776999383 100755
--- a/tests/functional/test_aarch64_sbsaref_alpine.py
+++ b/tests/functional/test_aarch64_sbsaref_alpine.py
@@ -26,8 +26,9 @@ class Aarch64SbsarefAlpine(QemuSystemTest):
     # We only boot a whole OS for the current top level CPU and GIC
     # Other test profiles should use more minimal boots
     def boot_alpine_linux(self, cpu=None):
-        fetch_firmware(self)
+        self.set_machine('sbsa-ref')
 
+        fetch_firmware(self)
         iso_path = self.ASSET_ALPINE_ISO.fetch()
 
         self.vm.set_console()
diff --git a/tests/functional/test_aarch64_sbsaref_freebsd.py b/tests/functional/test_aarch64_sbsaref_freebsd.py
index 26dfc5878b..3cddc082f3 100755
--- a/tests/functional/test_aarch64_sbsaref_freebsd.py
+++ b/tests/functional/test_aarch64_sbsaref_freebsd.py
@@ -26,8 +26,9 @@ class Aarch64SbsarefFreeBSD(QemuSystemTest):
     # We only boot a whole OS for the current top level CPU and GIC
     # Other test profiles should use more minimal boots
     def boot_freebsd14(self, cpu=None):
-        fetch_firmware(self)
+        self.set_machine('sbsa-ref')
 
+        fetch_firmware(self)
         img_path = self.ASSET_FREEBSD_ISO.fetch()
 
         self.vm.set_console()

From 72846594b089f03bed1bb46958c910afcb859d49 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 1 Jul 2025 15:08:35 +0100
Subject: [PATCH 1763/2760] tests/functional: Restrict nested Aarch64 Xen test
 to TCG
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Currently QEMU only support accelerating EL0 and EL1, so features
requiring EL2 (like virtualization) or EL3 must be emulated with TCG.

On macOS this test fails:

  qemu-system-aarch64: mach-virt: HVF does not support providing Virtualization extensions to the guest CPU

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250623121845.7214-24-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/functional/test_aarch64_xen.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tests/functional/test_aarch64_xen.py b/tests/functional/test_aarch64_xen.py
index 339904221b..261d796540 100755
--- a/tests/functional/test_aarch64_xen.py
+++ b/tests/functional/test_aarch64_xen.py
@@ -33,6 +33,7 @@ class BootXen(LinuxKernelTest):
         """
         Launch Xen with a dom0 guest kernel
         """
+        self.require_accelerator("tcg") # virtualization=on
         self.set_machine('virt')
         self.cpu = "cortex-a57"
         self.kernel_path = self.ASSET_KERNEL.fetch()

From f4b5fbeff6be3797881e69cbf42cc689a4e316c4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 1 Jul 2025 15:08:36 +0100
Subject: [PATCH 1764/2760] tests/functional: Require TCG to run Aarch64
 imx8mp-evk test
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The imx8mp-evk machine can only run with the TCG accelerator.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-id: 20250623121845.7214-25-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/functional/test_aarch64_imx8mp_evk.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tests/functional/test_aarch64_imx8mp_evk.py b/tests/functional/test_aarch64_imx8mp_evk.py
index 638bf9e131..99ddcdef83 100755
--- a/tests/functional/test_aarch64_imx8mp_evk.py
+++ b/tests/functional/test_aarch64_imx8mp_evk.py
@@ -49,6 +49,7 @@ class Imx8mpEvkMachine(LinuxKernelTest):
                      self.DTB_OFFSET, self.DTB_SIZE)
 
     def test_aarch64_imx8mp_evk_usdhc(self):
+        self.require_accelerator("tcg")
         self.set_machine('imx8mp-evk')
         self.vm.set_console(console_index=1)
         self.vm.add_args('-m', '2G',

From 767df742fbc9e6cc06e9309685407beb2565c272 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Tue, 1 Jul 2025 17:22:27 +0100
Subject: [PATCH 1765/2760] tests/functional: Add hvf_available() helper
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-id: 20250623121845.7214-26-philmd@linaro.org
[PMM: tweaks to satisfy the python linter CI job]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 python/qemu/utils/__init__.py          | 8 +++++++-
 python/qemu/utils/accel.py             | 9 +++++++++
 tests/functional/qemu_test/testcase.py | 6 ++++--
 3 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/python/qemu/utils/__init__.py b/python/qemu/utils/__init__.py
index 017cfdcda7..be5daa8363 100644
--- a/python/qemu/utils/__init__.py
+++ b/python/qemu/utils/__init__.py
@@ -23,13 +23,19 @@ import textwrap
 from typing import Optional
 
 # pylint: disable=import-error
-from .accel import kvm_available, list_accel, tcg_available
+from .accel import (
+    hvf_available,
+    kvm_available,
+    list_accel,
+    tcg_available,
+)
 
 
 __all__ = (
     'VerboseProcessError',
     'add_visual_margin',
     'get_info_usernet_hostfwd_port',
+    'hvf_available',
     'kvm_available',
     'list_accel',
     'tcg_available',
diff --git a/python/qemu/utils/accel.py b/python/qemu/utils/accel.py
index 386ff640ca..f915b64669 100644
--- a/python/qemu/utils/accel.py
+++ b/python/qemu/utils/accel.py
@@ -82,3 +82,12 @@ def tcg_available(qemu_bin: str) -> bool:
     @param qemu_bin (str): path to the QEMU binary
     """
     return 'tcg' in list_accel(qemu_bin)
+
+
+def hvf_available(qemu_bin: str) -> bool:
+    """
+    Check if HVF is available.
+
+    @param qemu_bin (str): path to the QEMU binary
+    """
+    return 'hvf' in list_accel(qemu_bin)
diff --git a/tests/functional/qemu_test/testcase.py b/tests/functional/qemu_test/testcase.py
index 50c401b8c3..2082c6fce4 100644
--- a/tests/functional/qemu_test/testcase.py
+++ b/tests/functional/qemu_test/testcase.py
@@ -23,7 +23,7 @@ import unittest
 import uuid
 
 from qemu.machine import QEMUMachine
-from qemu.utils import kvm_available, tcg_available
+from qemu.utils import hvf_available, kvm_available, tcg_available
 
 from .archive import archive_extract
 from .asset import Asset
@@ -317,7 +317,9 @@ class QemuSystemTest(QemuBaseTest):
         :type accelerator: str
         """
         checker = {'tcg': tcg_available,
-                   'kvm': kvm_available}.get(accelerator)
+                   'kvm': kvm_available,
+                   'hvf': hvf_available,
+                  }.get(accelerator)
         if checker is None:
             self.skipTest("Don't know how to check for the presence "
                           "of accelerator %s" % accelerator)

From 9b4c8dd505b1630e3fdaca071886d1cd41019156 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 1 Jul 2025 15:08:36 +0100
Subject: [PATCH 1766/2760] tests/functional: Expand Aarch64 SMMU tests to run
 on HVF accelerator
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20250623121845.7214-27-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/functional/test_aarch64_smmu.py | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/tests/functional/test_aarch64_smmu.py b/tests/functional/test_aarch64_smmu.py
index c65d0f2817..e0f4a92217 100755
--- a/tests/functional/test_aarch64_smmu.py
+++ b/tests/functional/test_aarch64_smmu.py
@@ -17,7 +17,7 @@ import time
 
 from qemu_test import LinuxKernelTest, Asset, exec_command_and_wait_for_pattern
 from qemu_test import BUILD_DIR
-from qemu.utils import kvm_available
+from qemu.utils import kvm_available, hvf_available
 
 
 class SMMU(LinuxKernelTest):
@@ -45,11 +45,17 @@ class SMMU(LinuxKernelTest):
         self.vm.add_args('-device', 'virtio-net,netdev=n1' + self.IOMMU_ADDON)
 
     def common_vm_setup(self, kernel, initrd, disk):
-        self.require_accelerator("kvm")
+        if hvf_available(self.qemu_bin):
+            accel = "hvf"
+        elif kvm_available(self.qemu_bin):
+            accel = "kvm"
+        else:
+            self.skipTest("Neither HVF nor KVM accelerator is available")
+        self.require_accelerator(accel)
         self.require_netdev('user')
         self.set_machine("virt")
         self.vm.add_args('-m', '1G')
-        self.vm.add_args("-accel", "kvm")
+        self.vm.add_args("-accel", accel)
         self.vm.add_args("-cpu", "host")
         self.vm.add_args("-machine", "iommu=smmuv3")
         self.vm.add_args("-d", "guest_errors")

From 7bc86ccbb59f2022014e132327a33b94a7ed00fe Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Fri, 27 Jun 2025 13:02:22 -0700
Subject: [PATCH 1767/2760] tests/functional: test device passthrough on
 aarch64

This test allows to document and exercise device passthrough, using a
nested virtual machine setup. Two disks are generated and passed to the
VM, and their content is compared to original images.

Guest and nested guests commands are executed through two scripts, and
init used in both system is configured to trigger a kernel panic in case
any command fails. This is more reliable and readable than executing all
commands through prompt injection and trying to guess what failed.

Initially, this test was supposed to test smmuv3 nested emulation
(combining both stages of translation), but I could not find any setup
(kernel + vmm) able to do the passthrough correctly, despite several
tries.

Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-id: 20250627200222.5172-1-pierrick.bouvier@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/functional/meson.build                  |   2 +
 .../test_aarch64_device_passthrough.py        | 142 ++++++++++++++++++
 2 files changed, 144 insertions(+)
 create mode 100755 tests/functional/test_aarch64_device_passthrough.py

diff --git a/tests/functional/meson.build b/tests/functional/meson.build
index e9f19d54a2..85158562a2 100644
--- a/tests/functional/meson.build
+++ b/tests/functional/meson.build
@@ -13,6 +13,7 @@ endif
 test_timeouts = {
   'aarch64_aspeed_ast2700' : 600,
   'aarch64_aspeed_ast2700fc' : 600,
+  'aarch64_device_passthrough' : 720,
   'aarch64_imx8mp_evk' : 240,
   'aarch64_raspi4' : 480,
   'aarch64_reverse_debug' : 180,
@@ -83,6 +84,7 @@ tests_aarch64_system_quick = [
 tests_aarch64_system_thorough = [
   'aarch64_aspeed_ast2700',
   'aarch64_aspeed_ast2700fc',
+  'aarch64_device_passthrough',
   'aarch64_imx8mp_evk',
   'aarch64_raspi3',
   'aarch64_raspi4',
diff --git a/tests/functional/test_aarch64_device_passthrough.py b/tests/functional/test_aarch64_device_passthrough.py
new file mode 100755
index 0000000000..1f3f158a9f
--- /dev/null
+++ b/tests/functional/test_aarch64_device_passthrough.py
@@ -0,0 +1,142 @@
+#!/usr/bin/env python3
+#
+# Boots a nested guest and compare content of a device (passthrough) to a
+# reference image. Both vfio group and iommufd passthrough methods are tested.
+#
+# Copyright (c) 2025 Linaro Ltd.
+#
+# Author: Pierrick Bouvier <pierrick.bouvier@linaro.org>
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+import os
+
+from qemu_test import QemuSystemTest, Asset
+from qemu_test import exec_command, wait_for_console_pattern
+from qemu_test import exec_command_and_wait_for_pattern
+from random import randbytes
+
+guest_script = '''
+#!/usr/bin/env bash
+
+set -euo pipefail
+set -x
+
+# find disks from nvme serial
+dev_vfio=$(lsblk --nvme | grep vfio | cut -f 1 -d ' ')
+dev_iommufd=$(lsblk --nvme | grep iommufd | cut -f 1 -d ' ')
+pci_vfio=$(basename $(readlink -f /sys/block/$dev_vfio/../../../))
+pci_iommufd=$(basename $(readlink -f /sys/block/$dev_iommufd/../../../))
+
+# bind disks to vfio
+for p in "$pci_vfio" "$pci_iommufd"; do
+    if [ "$(cat /sys/bus/pci/devices/$p/driver_override)" == vfio-pci ]; then
+        continue
+    fi
+    echo $p > /sys/bus/pci/drivers/nvme/unbind
+    echo vfio-pci > /sys/bus/pci/devices/$p/driver_override
+    echo $p > /sys/bus/pci/drivers/vfio-pci/bind
+done
+
+# boot nested guest and execute /host/nested_guest.sh
+# one disk is passed through vfio group, the other, through iommufd
+qemu-system-aarch64 \
+-M virt \
+-display none \
+-serial stdio \
+-cpu host \
+-enable-kvm \
+-m 1G \
+-kernel /host/Image.gz \
+-drive format=raw,file=/host/guest.ext4,if=virtio \
+-append "root=/dev/vda init=/init -- bash /host/nested_guest.sh" \
+-virtfs local,path=/host,mount_tag=host,security_model=mapped,readonly=off \
+-device vfio-pci,host=$pci_vfio \
+-object iommufd,id=iommufd0 \
+-device vfio-pci,host=$pci_iommufd,iommufd=iommufd0
+'''
+
+nested_guest_script = '''
+#!/usr/bin/env bash
+
+set -euo pipefail
+set -x
+
+image_vfio=/host/disk_vfio
+image_iommufd=/host/disk_iommufd
+
+dev_vfio=$(lsblk --nvme | grep vfio | cut -f 1 -d ' ')
+dev_iommufd=$(lsblk --nvme | grep iommufd | cut -f 1 -d ' ')
+
+# compare if devices are identical to original images
+diff $image_vfio /dev/$dev_vfio
+diff $image_iommufd /dev/$dev_iommufd
+
+echo device_passthrough_test_ok
+'''
+
+class Aarch64DevicePassthrough(QemuSystemTest):
+
+    # https://github.com/pbo-linaro/qemu-linux-stack
+    #
+    # Linux kernel is compiled with defconfig +
+    # IOMMUFD + VFIO_DEVICE_CDEV + ARM_SMMU_V3_IOMMUFD
+    # https://docs.kernel.org/driver-api/vfio.html#vfio-device-cde
+    ASSET_DEVICE_PASSTHROUGH_STACK = Asset(
+        ('https://fileserver.linaro.org/s/fx5DXxBYme8dw2G/'
+         'download/device_passthrough.tar.xz'),
+         '812750b664d61c2986f2b149939ae28cafbd60d53e9c7e4b16e97143845e196d')
+
+    # This tests the device passthrough implementation, by booting a VM
+    # supporting it with two nvme disks attached, and launching a nested VM
+    # reading their content.
+    def test_aarch64_device_passthrough(self):
+        self.set_machine('virt')
+        self.require_accelerator('tcg')
+
+        self.vm.set_console()
+
+        stack_path_tar_gz = self.ASSET_DEVICE_PASSTHROUGH_STACK.fetch()
+        self.archive_extract(stack_path_tar_gz, format="tar")
+
+        stack = self.scratch_file('out')
+        kernel = os.path.join(stack, 'Image.gz')
+        rootfs_host = os.path.join(stack, 'host.ext4')
+        disk_vfio = os.path.join(stack, 'disk_vfio')
+        disk_iommufd = os.path.join(stack, 'disk_iommufd')
+        guest_cmd = os.path.join(stack, 'guest.sh')
+        nested_guest_cmd = os.path.join(stack, 'nested_guest.sh')
+        # we generate two random disks
+        with open(disk_vfio, "wb") as d: d.write(randbytes(512))
+        with open(disk_iommufd, "wb") as d: d.write(randbytes(1024))
+        with open(guest_cmd, 'w') as s: s.write(guest_script)
+        with open(nested_guest_cmd, 'w') as s: s.write(nested_guest_script)
+
+        self.vm.add_args('-cpu', 'max')
+        self.vm.add_args('-m', '2G')
+        self.vm.add_args('-M', 'virt,'
+                         'virtualization=on,'
+                         'gic-version=max,'
+                         'iommu=smmuv3')
+        self.vm.add_args('-kernel', kernel)
+        self.vm.add_args('-drive', f'format=raw,file={rootfs_host}')
+        self.vm.add_args('-drive',
+                         f'file={disk_vfio},if=none,id=vfio,format=raw')
+        self.vm.add_args('-device', 'nvme,serial=vfio,drive=vfio')
+        self.vm.add_args('-drive',
+                         f'file={disk_iommufd},if=none,id=iommufd,format=raw')
+        self.vm.add_args('-device', 'nvme,serial=iommufd,drive=iommufd')
+        self.vm.add_args('-virtfs',
+                         f'local,path={stack}/,mount_tag=host,'
+                         'security_model=mapped,readonly=off')
+        # boot and execute guest script
+        # init will trigger a kernel panic if script fails
+        self.vm.add_args('-append',
+                         'root=/dev/vda init=/init -- bash /host/guest.sh')
+
+        self.vm.launch()
+        wait_for_console_pattern(self, 'device_passthrough_test_ok',
+                                 failure_message='Kernel panic')
+
+if __name__ == '__main__':
+    QemuSystemTest.main()

From 6af9f88fff5baea33469d52b94c7e64bd596713e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Fri, 27 Jun 2025 12:24:57 +0100
Subject: [PATCH 1768/2760] gitlab: mark s390x-system to allow failures
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The system tests (usually qos-test or migration-test) prove to be very
susceptible on the s390x runners. Although we have boosted memory and
virtual CPUs on the runners problems persist. For now mark test as
allow_failure so the its clear on the CI UI when checking test
results.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250627112512.1880708-2-alex.bennee@linaro.org>
---
 .gitlab-ci.d/custom-runners/ubuntu-22.04-s390x.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.gitlab-ci.d/custom-runners/ubuntu-22.04-s390x.yml b/.gitlab-ci.d/custom-runners/ubuntu-22.04-s390x.yml
index ca374acb8c..e62ff1763f 100644
--- a/.gitlab-ci.d/custom-runners/ubuntu-22.04-s390x.yml
+++ b/.gitlab-ci.d/custom-runners/ubuntu-22.04-s390x.yml
@@ -31,7 +31,9 @@ ubuntu-22.04-s390x-all-system:
  timeout: 75m
  rules:
  - if: '$CI_PROJECT_NAMESPACE == "qemu-project" && $CI_COMMIT_BRANCH =~ /^staging/'
+   allow_failure: true
  - if: "$S390X_RUNNER_AVAILABLE"
+   allow_failure: true
  script:
  - mkdir build
  - cd build

From 374a245573b8da2d7fd91272868e173027adc7db Mon Sep 17 00:00:00 2001
From: Gustavo Romero <gustavo.romero@linaro.org>
Date: Fri, 27 Jun 2025 12:24:58 +0100
Subject: [PATCH 1769/2760] tests/functional: Add PCI hotplug test for aarch64
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add a functional test, aarch64_hotplug_pci, to exercise PCI hotplug and
hot-unplug on arm64.

Signed-off-by: Gustavo Romero <gustavo.romero@linaro.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Acked-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250528203137.1654964-1-gustavo.romero@linaro.org>
[AJB: trimmed boilerplate for checkpatch, simplified invocations]
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250627112512.1880708-3-alex.bennee@linaro.org>
---
 MAINTAINERS                                  |  6 ++
 tests/functional/meson.build                 |  1 +
 tests/functional/test_aarch64_hotplug_pci.py | 72 ++++++++++++++++++++
 3 files changed, 79 insertions(+)
 create mode 100755 tests/functional/test_aarch64_hotplug_pci.py

diff --git a/MAINTAINERS b/MAINTAINERS
index d1672fda8d..850588fb64 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2089,6 +2089,12 @@ S: Supported
 F: include/hw/pci/pcie_doe.h
 F: hw/pci/pcie_doe.c
 
+ARM PCI Hotplug
+M: Gustavo Romero <gustavo.romero@linaro.org>
+L: qemu-arm@nongnu.org
+S: Supported
+F: tests/functional/test_aarch64_hotplug_pci.py
+
 ACPI/SMBIOS
 M: Michael S. Tsirkin <mst@redhat.com>
 M: Igor Mammedov <imammedo@redhat.com>
diff --git a/tests/functional/meson.build b/tests/functional/meson.build
index e9f19d54a2..53721c97ec 100644
--- a/tests/functional/meson.build
+++ b/tests/functional/meson.build
@@ -83,6 +83,7 @@ tests_aarch64_system_quick = [
 tests_aarch64_system_thorough = [
   'aarch64_aspeed_ast2700',
   'aarch64_aspeed_ast2700fc',
+  'aarch64_hotplug_pci',
   'aarch64_imx8mp_evk',
   'aarch64_raspi3',
   'aarch64_raspi4',
diff --git a/tests/functional/test_aarch64_hotplug_pci.py b/tests/functional/test_aarch64_hotplug_pci.py
new file mode 100755
index 0000000000..c9bb7f1d97
--- /dev/null
+++ b/tests/functional/test_aarch64_hotplug_pci.py
@@ -0,0 +1,72 @@
+#!/usr/bin/env python3
+#
+# The test hotplugs a PCI device and checks it on a Linux guest.
+#
+# Copyright (c) 2025 Linaro Ltd.
+#
+# Author:
+#  Gustavo Romero <gustavo.romero@linaro.org>
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+from qemu_test import LinuxKernelTest, Asset, exec_command_and_wait_for_pattern
+from qemu_test import BUILD_DIR
+
+class HotplugPCI(LinuxKernelTest):
+
+    ASSET_KERNEL = Asset(
+        ('https://ftp.debian.org/debian/dists/stable/main/installer-arm64/'
+         '20230607+deb12u11/images/netboot/debian-installer/arm64/linux'),
+         'd92a60392ce1e379ca198a1a820899f8f0d39a62d047c41ab79492f81541a9d9')
+
+    ASSET_INITRD = Asset(
+        ('https://ftp.debian.org/debian/dists/stable/main/installer-arm64/'
+         '20230607+deb12u11/images/netboot/debian-installer/arm64/initrd.gz'),
+         '9f817f76951f3237bca8216bee35267bfb826815687f4b2fcdd5e6c2a917790c')
+
+    def test_hotplug_pci(self):
+
+        self.set_machine('virt')
+
+        self.vm.add_args('-m', '512M',
+                         '-cpu', 'cortex-a57',
+                         '-append',
+                         'console=ttyAMA0,115200 init=/bin/sh',
+                         '-device',
+                         'pcie-root-port,bus=pcie.0,chassis=1,slot=1,id=pcie.1',
+                         '-bios',
+                         self.build_file('pc-bios', 'edk2-aarch64-code.fd'))
+
+        # BusyBox prompt
+        prompt = "~ #"
+        self.launch_kernel(self.ASSET_KERNEL.fetch(),
+                           self.ASSET_INITRD.fetch(),
+                           wait_for=prompt)
+
+        # Check for initial state: 2 network adapters, lo and enp0s1.
+        exec_command_and_wait_for_pattern(self,
+                                          'ls /sys/class/net | wc -l',
+                                          '2')
+
+        # Hotplug one network adapter to the root port, i.e. pcie.1 bus.
+        self.vm.cmd('device_add',
+                    driver='virtio-net-pci',
+                    bus='pcie.1',
+                    addr=0,
+                    id='na')
+        # Wait for the kernel to recognize the new device.
+        self.wait_for_console_pattern('virtio-pci')
+        self.wait_for_console_pattern('virtio_net')
+
+        # Check if there is a new network adapter.
+        exec_command_and_wait_for_pattern(self,
+                                          'ls /sys/class/net | wc -l',
+                                          '3')
+
+        self.vm.cmd('device_del', id='na')
+        exec_command_and_wait_for_pattern(self,
+                                          'ls /sys/class/net | wc -l',
+                                          '2')
+
+if __name__ == '__main__':
+    LinuxKernelTest.main()

From 328c1a0b861e6c581880cf5831a0952ed92bcbf3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 27 Jun 2025 12:24:59 +0100
Subject: [PATCH 1770/2760] semihosting/uaccess: Remove uses of target_ulong
 type
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Replace target_ulong by vaddr or size_t types to match
cpu_memory_rw_debug() prototype in "exec/cpu-common.h":

 >  int cpu_memory_rw_debug(CPUState *cpu, vaddr addr,
 >                          void *ptr, size_t len,
 >                          bool is_write);

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250526095213.14113-2-philmd@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250627112512.1880708-4-alex.bennee@linaro.org>
---
 include/semihosting/uaccess.h | 12 ++++++------
 semihosting/uaccess.c         | 10 +++++-----
 2 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/include/semihosting/uaccess.h b/include/semihosting/uaccess.h
index 6bc90b12d6..2093a49827 100644
--- a/include/semihosting/uaccess.h
+++ b/include/semihosting/uaccess.h
@@ -15,9 +15,9 @@
 #endif
 
 #include "exec/cpu-common.h"
-#include "exec/cpu-defs.h"
 #include "exec/tswap.h"
 #include "exec/page-protection.h"
+#include "exec/vaddr.h"
 
 /**
  * get_user_u64:
@@ -89,8 +89,8 @@
  *
  * The returned pointer should be freed using uaccess_unlock_user().
  */
-void *uaccess_lock_user(CPUArchState *env, target_ulong addr,
-                        target_ulong len, bool copy);
+void *uaccess_lock_user(CPUArchState *env, vaddr addr,
+                        size_t len, bool copy);
 /**
  * lock_user:
  *
@@ -103,7 +103,7 @@ void *uaccess_lock_user(CPUArchState *env, target_ulong addr,
  *
  * The returned string should be freed using uaccess_unlock_user().
  */
-char *uaccess_lock_user_string(CPUArchState *env, target_ulong addr);
+char *uaccess_lock_user_string(CPUArchState *env, vaddr addr);
 /**
  * uaccess_lock_user_string:
  *
@@ -112,10 +112,10 @@ char *uaccess_lock_user_string(CPUArchState *env, target_ulong addr);
 #define lock_user_string(p) uaccess_lock_user_string(env, p)
 
 void uaccess_unlock_user(CPUArchState *env, void *p,
-                         target_ulong addr, target_ulong len);
+                         vaddr addr, size_t len);
 #define unlock_user(s, args, len) uaccess_unlock_user(env, s, args, len)
 
-ssize_t uaccess_strlen_user(CPUArchState *env, target_ulong addr);
+ssize_t uaccess_strlen_user(CPUArchState *env, vaddr addr);
 #define target_strlen(p) uaccess_strlen_user(env, p)
 
 #endif /* SEMIHOSTING_SOFTMMU_UACCESS_H */
diff --git a/semihosting/uaccess.c b/semihosting/uaccess.c
index 4554844e15..ff944d8c2f 100644
--- a/semihosting/uaccess.c
+++ b/semihosting/uaccess.c
@@ -14,8 +14,8 @@
 #include "exec/tlb-flags.h"
 #include "semihosting/uaccess.h"
 
-void *uaccess_lock_user(CPUArchState *env, target_ulong addr,
-                        target_ulong len, bool copy)
+void *uaccess_lock_user(CPUArchState *env, vaddr addr,
+                        size_t len, bool copy)
 {
     void *p = malloc(len);
     if (p && copy) {
@@ -27,7 +27,7 @@ void *uaccess_lock_user(CPUArchState *env, target_ulong addr,
     return p;
 }
 
-ssize_t uaccess_strlen_user(CPUArchState *env, target_ulong addr)
+ssize_t uaccess_strlen_user(CPUArchState *env, vaddr addr)
 {
     int mmu_idx = cpu_mmu_index(env_cpu(env), false);
     size_t len = 0;
@@ -75,7 +75,7 @@ ssize_t uaccess_strlen_user(CPUArchState *env, target_ulong addr)
     }
 }
 
-char *uaccess_lock_user_string(CPUArchState *env, target_ulong addr)
+char *uaccess_lock_user_string(CPUArchState *env, vaddr addr)
 {
     ssize_t len = uaccess_strlen_user(env, addr);
     if (len < 0) {
@@ -85,7 +85,7 @@ char *uaccess_lock_user_string(CPUArchState *env, target_ulong addr)
 }
 
 void uaccess_unlock_user(CPUArchState *env, void *p,
-                         target_ulong addr, target_ulong len)
+                         vaddr addr, size_t len)
 {
     if (len) {
         cpu_memory_rw_debug(env_cpu(env), addr, p, len, 1);

From b8e6bfd6695331c24a6a8c49db1321ef24ddecaf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 27 Jun 2025 12:25:00 +0100
Subject: [PATCH 1771/2760] semihosting/uaccess: Compile once
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250526095213.14113-3-philmd@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250627112512.1880708-5-alex.bennee@linaro.org>
---
 semihosting/meson.build | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/semihosting/meson.build b/semihosting/meson.build
index f3d38dda91..b1ab2506c6 100644
--- a/semihosting/meson.build
+++ b/semihosting/meson.build
@@ -3,15 +3,12 @@ specific_ss.add(when: 'CONFIG_SEMIHOSTING', if_true: files(
   'syscalls.c',
 ))
 
-specific_ss.add(when: ['CONFIG_SEMIHOSTING', 'CONFIG_SYSTEM_ONLY'], if_true: files(
-  'uaccess.c',
-))
-
 common_ss.add(when: 'CONFIG_SEMIHOSTING', if_false: files('stubs-all.c'))
 user_ss.add(when: 'CONFIG_SEMIHOSTING', if_true: files('user.c'))
 system_ss.add(when: 'CONFIG_SEMIHOSTING', if_true: files(
   'config.c',
   'console.c',
+  'uaccess.c',
 ), if_false: files(
   'stubs-system.c',
 ))

From 1bb6403a34b05a128fbaa27f392f3f78c98c59a9 Mon Sep 17 00:00:00 2001
From: Rowan Hart <rowanbhart@gmail.com>
Date: Fri, 27 Jun 2025 12:25:01 +0100
Subject: [PATCH 1772/2760] gdbstub: Expose gdb_write_register function to
 consumers of gdbstub
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This patch exposes the gdb_write_register function from
gdbstub/gdbstub.c via the exec/gdbstub.h header file to support use in
plugins to write register contents.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Julian Ganz <neither@nut.email>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Rowan Hart <rowanbhart@gmail.com>
Message-ID: <20250624175351.440780-2-rowanbhart@gmail.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250627112512.1880708-6-alex.bennee@linaro.org>
---
 gdbstub/gdbstub.c      |  2 +-
 include/exec/gdbstub.h | 14 ++++++++++++++
 2 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/gdbstub/gdbstub.c b/gdbstub/gdbstub.c
index def0b7e877..dd5fb5667c 100644
--- a/gdbstub/gdbstub.c
+++ b/gdbstub/gdbstub.c
@@ -535,7 +535,7 @@ int gdb_read_register(CPUState *cpu, GByteArray *buf, int reg)
     return 0;
 }
 
-static int gdb_write_register(CPUState *cpu, uint8_t *mem_buf, int reg)
+int gdb_write_register(CPUState *cpu, uint8_t *mem_buf, int reg)
 {
     GDBRegisterState *r;
 
diff --git a/include/exec/gdbstub.h b/include/exec/gdbstub.h
index 0675b0b646..a16c0051ce 100644
--- a/include/exec/gdbstub.h
+++ b/include/exec/gdbstub.h
@@ -124,6 +124,20 @@ const GDBFeature *gdb_find_static_feature(const char *xmlname);
  */
 int gdb_read_register(CPUState *cpu, GByteArray *buf, int reg);
 
+/**
+ * gdb_write_register() - Write a register associated with a CPU.
+ * @cpu: The CPU associated with the register.
+ * @buf: The buffer that the register contents will be set to.
+ * @reg: The register's number returned by gdb_find_feature_register().
+ *
+ * The size of @buf must be at least the size of the register being
+ * written.
+ *
+ * Return: The number of written bytes, or 0 if an error occurred (for
+ * example, an unknown register was provided).
+ */
+int gdb_write_register(CPUState *cpu, uint8_t *mem_buf, int reg);
+
 /**
  * typedef GDBRegDesc - a register description from gdbstub
  */

From 1a92b65859e2d58dbf4b8356940c42c5834e9710 Mon Sep 17 00:00:00 2001
From: Rowan Hart <rowanbhart@gmail.com>
Date: Fri, 27 Jun 2025 12:25:02 +0100
Subject: [PATCH 1773/2760] plugins: Add register write API
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This patch adds a function to the plugins API to allow plugins to write
register contents. It also moves the qemu_plugin_read_register function
so all the register-related functions are grouped together in the file.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Rowan Hart <rowanbhart@gmail.com>
Message-ID: <20250624175351.440780-3-rowanbhart@gmail.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250627112512.1880708-7-alex.bennee@linaro.org>
---
 include/qemu/qemu-plugin.h | 54 ++++++++++++++++++++++++++------------
 plugins/api.c              | 26 +++++++++++++-----
 2 files changed, 56 insertions(+), 24 deletions(-)

diff --git a/include/qemu/qemu-plugin.h b/include/qemu/qemu-plugin.h
index 3a850aa216..cfe1692ecb 100644
--- a/include/qemu/qemu-plugin.h
+++ b/include/qemu/qemu-plugin.h
@@ -871,7 +871,8 @@ struct qemu_plugin_register;
 /**
  * typedef qemu_plugin_reg_descriptor - register descriptions
  *
- * @handle: opaque handle for retrieving value with qemu_plugin_read_register
+ * @handle: opaque handle for retrieving value with qemu_plugin_read_register or
+ *          writing value with qemu_plugin_write_register
  * @name: register name
  * @feature: optional feature descriptor, can be NULL
  */
@@ -893,6 +894,41 @@ typedef struct {
 QEMU_PLUGIN_API
 GArray *qemu_plugin_get_registers(void);
 
+/**
+ * qemu_plugin_read_register() - read register for current vCPU
+ *
+ * @handle: a @qemu_plugin_reg_handle handle
+ * @buf: A GByteArray for the data owned by the plugin
+ *
+ * This function is only available in a context that register read access is
+ * explicitly requested via the QEMU_PLUGIN_CB_R_REGS flag.
+ *
+ * Returns the size of the read register. The content of @buf is in target byte
+ * order. On failure returns -1.
+ */
+QEMU_PLUGIN_API
+int qemu_plugin_read_register(struct qemu_plugin_register *handle,
+                              GByteArray *buf);
+
+/**
+ * qemu_plugin_write_register() - write register for current vCPU
+ *
+ * @handle: a @qemu_plugin_reg_handle handle
+ * @buf: A GByteArray for the data owned by the plugin
+ *
+ * This function is only available in a context that register write access is
+ * explicitly requested via the QEMU_PLUGIN_CB_RW_REGS flag.
+ *
+ * The size of @buf must be at least the size of the requested register.
+ * Attempting to write a register with @buf smaller than the register size
+ * will result in a crash or other undesired behavior.
+ *
+ * Returns the number of bytes written. On failure returns 0.
+ */
+QEMU_PLUGIN_API
+int qemu_plugin_write_register(struct qemu_plugin_register *handle,
+                              GByteArray *buf);
+
 /**
  * qemu_plugin_read_memory_vaddr() - read from memory using a virtual address
  *
@@ -915,22 +951,6 @@ QEMU_PLUGIN_API
 bool qemu_plugin_read_memory_vaddr(uint64_t addr,
                                    GByteArray *data, size_t len);
 
-/**
- * qemu_plugin_read_register() - read register for current vCPU
- *
- * @handle: a @qemu_plugin_reg_handle handle
- * @buf: A GByteArray for the data owned by the plugin
- *
- * This function is only available in a context that register read access is
- * explicitly requested via the QEMU_PLUGIN_CB_R_REGS flag.
- *
- * Returns the size of the read register. The content of @buf is in target byte
- * order. On failure returns -1.
- */
-QEMU_PLUGIN_API
-int qemu_plugin_read_register(struct qemu_plugin_register *handle,
-                              GByteArray *buf);
-
 /**
  * qemu_plugin_scoreboard_new() - alloc a new scoreboard
  *
diff --git a/plugins/api.c b/plugins/api.c
index 3c9d4832e9..6514f2c76a 100644
--- a/plugins/api.c
+++ b/plugins/api.c
@@ -433,6 +433,25 @@ GArray *qemu_plugin_get_registers(void)
     return create_register_handles(regs);
 }
 
+int qemu_plugin_read_register(struct qemu_plugin_register *reg, GByteArray *buf)
+{
+    g_assert(current_cpu);
+
+    return gdb_read_register(current_cpu, buf, GPOINTER_TO_INT(reg) - 1);
+}
+
+int qemu_plugin_write_register(struct qemu_plugin_register *reg,
+                               GByteArray *buf)
+{
+    g_assert(current_cpu);
+
+    if (buf->len == 0 || qemu_plugin_get_cb_flags() != QEMU_PLUGIN_CB_RW_REGS) {
+        return -1;
+    }
+
+    return gdb_write_register(current_cpu, buf->data, GPOINTER_TO_INT(reg) - 1);
+}
+
 bool qemu_plugin_read_memory_vaddr(uint64_t addr, GByteArray *data, size_t len)
 {
     g_assert(current_cpu);
@@ -453,13 +472,6 @@ bool qemu_plugin_read_memory_vaddr(uint64_t addr, GByteArray *data, size_t len)
     return true;
 }
 
-int qemu_plugin_read_register(struct qemu_plugin_register *reg, GByteArray *buf)
-{
-    g_assert(current_cpu);
-
-    return gdb_read_register(current_cpu, buf, GPOINTER_TO_INT(reg) - 1);
-}
-
 struct qemu_plugin_scoreboard *qemu_plugin_scoreboard_new(size_t element_size)
 {
     return plugin_scoreboard_new(element_size);

From 766e00bd570f54c8d08023a46cd3386e96ecd39f Mon Sep 17 00:00:00 2001
From: Rowan Hart <rowanbhart@gmail.com>
Date: Fri, 27 Jun 2025 12:25:03 +0100
Subject: [PATCH 1774/2760] plugins: Add enforcement of QEMU_PLUGIN_CB flags in
 register R/W callbacks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This patch adds functionality to enforce the requested QEMU_PLUGIN_CB_
flags level passed when registering a callback function using the
plugins API. Each time a callback is about to be invoked, a thread-local
variable will be updated with the level that callback requested. Then,
called API functions (in particular, the register read and write API)
will call qemu_plugin_get_cb_flags() to check the level is at least the
level they require.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Rowan Hart <rowanbhart@gmail.com>
Message-ID: <20250624175351.440780-4-rowanbhart@gmail.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250627112512.1880708-8-alex.bennee@linaro.org>
---
 accel/tcg/plugin-gen.c     | 30 ++++++++++++++++++++++++++++++
 include/hw/core/cpu.h      |  1 +
 include/qemu/plugin.h      | 15 +++++++++++++++
 include/qemu/qemu-plugin.h | 19 +++++++++++++------
 plugins/api.c              |  4 ++++
 plugins/core.c             | 33 +++++++++++++++++++++++++++++++++
 6 files changed, 96 insertions(+), 6 deletions(-)

diff --git a/accel/tcg/plugin-gen.c b/accel/tcg/plugin-gen.c
index c1da753894..9920381a84 100644
--- a/accel/tcg/plugin-gen.c
+++ b/accel/tcg/plugin-gen.c
@@ -117,10 +117,20 @@ static TCGv_i32 gen_cpu_index(void)
 static void gen_udata_cb(struct qemu_plugin_regular_cb *cb)
 {
     TCGv_i32 cpu_index = gen_cpu_index();
+    enum qemu_plugin_cb_flags cb_flags =
+        tcg_call_to_qemu_plugin_cb_flags(cb->info->flags);
+    TCGv_i32 flags = tcg_constant_i32(cb_flags);
+    TCGv_i32 clear_flags = tcg_constant_i32(QEMU_PLUGIN_CB_NO_REGS);
+    tcg_gen_st_i32(flags, tcg_env,
+           offsetof(CPUState, neg.plugin_cb_flags) - sizeof(CPUState));
     tcg_gen_call2(cb->f.vcpu_udata, cb->info, NULL,
                   tcgv_i32_temp(cpu_index),
                   tcgv_ptr_temp(tcg_constant_ptr(cb->userp)));
+    tcg_gen_st_i32(clear_flags, tcg_env,
+           offsetof(CPUState, neg.plugin_cb_flags) - sizeof(CPUState));
     tcg_temp_free_i32(cpu_index);
+    tcg_temp_free_i32(flags);
+    tcg_temp_free_i32(clear_flags);
 }
 
 static TCGv_ptr gen_plugin_u64_ptr(qemu_plugin_u64 entry)
@@ -173,10 +183,20 @@ static void gen_udata_cond_cb(struct qemu_plugin_conditional_cb *cb)
     tcg_gen_ld_i64(val, ptr, 0);
     tcg_gen_brcondi_i64(cond, val, cb->imm, after_cb);
     TCGv_i32 cpu_index = gen_cpu_index();
+    enum qemu_plugin_cb_flags cb_flags =
+        tcg_call_to_qemu_plugin_cb_flags(cb->info->flags);
+    TCGv_i32 flags = tcg_constant_i32(cb_flags);
+    TCGv_i32 clear_flags = tcg_constant_i32(QEMU_PLUGIN_CB_NO_REGS);
+    tcg_gen_st_i32(flags, tcg_env,
+           offsetof(CPUState, neg.plugin_cb_flags) - sizeof(CPUState));
     tcg_gen_call2(cb->f.vcpu_udata, cb->info, NULL,
                   tcgv_i32_temp(cpu_index),
                   tcgv_ptr_temp(tcg_constant_ptr(cb->userp)));
+    tcg_gen_st_i32(clear_flags, tcg_env,
+           offsetof(CPUState, neg.plugin_cb_flags) - sizeof(CPUState));
     tcg_temp_free_i32(cpu_index);
+    tcg_temp_free_i32(flags);
+    tcg_temp_free_i32(clear_flags);
     gen_set_label(after_cb);
 
     tcg_temp_free_i64(val);
@@ -210,12 +230,22 @@ static void gen_mem_cb(struct qemu_plugin_regular_cb *cb,
                        qemu_plugin_meminfo_t meminfo, TCGv_i64 addr)
 {
     TCGv_i32 cpu_index = gen_cpu_index();
+    enum qemu_plugin_cb_flags cb_flags =
+        tcg_call_to_qemu_plugin_cb_flags(cb->info->flags);
+    TCGv_i32 flags = tcg_constant_i32(cb_flags);
+    TCGv_i32 clear_flags = tcg_constant_i32(QEMU_PLUGIN_CB_NO_REGS);
+    tcg_gen_st_i32(flags, tcg_env,
+           offsetof(CPUState, neg.plugin_cb_flags) - sizeof(CPUState));
     tcg_gen_call4(cb->f.vcpu_mem, cb->info, NULL,
                   tcgv_i32_temp(cpu_index),
                   tcgv_i32_temp(tcg_constant_i32(meminfo)),
                   tcgv_i64_temp(addr),
                   tcgv_ptr_temp(tcg_constant_ptr(cb->userp)));
+    tcg_gen_st_i32(clear_flags, tcg_env,
+           offsetof(CPUState, neg.plugin_cb_flags) - sizeof(CPUState));
     tcg_temp_free_i32(cpu_index);
+    tcg_temp_free_i32(flags);
+    tcg_temp_free_i32(clear_flags);
 }
 
 static void inject_cb(struct qemu_plugin_dyn_cb *cb)
diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index 33296a1c08..162a56a5da 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -368,6 +368,7 @@ typedef struct CPUNegativeOffsetState {
     GArray *plugin_mem_cbs;
     uint64_t plugin_mem_value_low;
     uint64_t plugin_mem_value_high;
+    int32_t plugin_cb_flags;
 #endif
     IcountDecr icount_decr;
     bool can_do_io;
diff --git a/include/qemu/plugin.h b/include/qemu/plugin.h
index 9726a9ebf3..f355c7cb8a 100644
--- a/include/qemu/plugin.h
+++ b/include/qemu/plugin.h
@@ -209,6 +209,21 @@ void qemu_plugin_user_prefork_lock(void);
  */
 void qemu_plugin_user_postfork(bool is_child);
 
+enum qemu_plugin_cb_flags tcg_call_to_qemu_plugin_cb_flags(int flags);
+
+static inline void qemu_plugin_set_cb_flags(CPUState *cpu,
+                                            enum qemu_plugin_cb_flags flags)
+{
+    assert(cpu);
+    cpu->neg.plugin_cb_flags = flags;
+}
+
+static inline enum qemu_plugin_cb_flags qemu_plugin_get_cb_flags(void)
+{
+    assert(current_cpu);
+    return current_cpu->neg.plugin_cb_flags;
+}
+
 #else /* !CONFIG_PLUGIN */
 
 static inline void qemu_plugin_add_opts(void)
diff --git a/include/qemu/qemu-plugin.h b/include/qemu/qemu-plugin.h
index cfe1692ecb..9c9ebf6ce0 100644
--- a/include/qemu/qemu-plugin.h
+++ b/include/qemu/qemu-plugin.h
@@ -254,9 +254,6 @@ typedef struct {
  * @QEMU_PLUGIN_CB_NO_REGS: callback does not access the CPU's regs
  * @QEMU_PLUGIN_CB_R_REGS: callback reads the CPU's regs
  * @QEMU_PLUGIN_CB_RW_REGS: callback reads and writes the CPU's regs
- *
- * Note: currently QEMU_PLUGIN_CB_RW_REGS is unused, plugins cannot change
- * system register state.
  */
 enum qemu_plugin_cb_flags {
     QEMU_PLUGIN_CB_NO_REGS,
@@ -901,7 +898,12 @@ GArray *qemu_plugin_get_registers(void);
  * @buf: A GByteArray for the data owned by the plugin
  *
  * This function is only available in a context that register read access is
- * explicitly requested via the QEMU_PLUGIN_CB_R_REGS flag.
+ * explicitly requested via the QEMU_PLUGIN_CB_R_REGS flag, if called inside a
+ * callback that can be registered with a qemu_plugin_cb_flags argument. This
+ * function can also be used in any callback context that does not use a flags
+ * argument, such as in a callback registered with
+ * qemu_plugin_register_vcpu_init_cb(), except for callbacks registered with
+ * qemu_plugin_register_atexit_cb() and qemu_plugin_register_flush_cb().
  *
  * Returns the size of the read register. The content of @buf is in target byte
  * order. On failure returns -1.
@@ -916,8 +918,13 @@ int qemu_plugin_read_register(struct qemu_plugin_register *handle,
  * @handle: a @qemu_plugin_reg_handle handle
  * @buf: A GByteArray for the data owned by the plugin
  *
- * This function is only available in a context that register write access is
- * explicitly requested via the QEMU_PLUGIN_CB_RW_REGS flag.
+ * This function is only available in a context that register read access is
+ * explicitly requested via the QEMU_PLUGIN_CB_RW_REGS flag, if called inside a
+ * callback that can be registered with a qemu_plugin_cb_flags argument. This
+ * function can also be used in any callback context that does not use a flags
+ * argument, such as in a callback registered with
+ * qemu_plugin_register_vcpu_init_cb(), except for callbacks registered with
+ * qemu_plugin_register_atexit_cb() and qemu_plugin_register_flush_cb().
  *
  * The size of @buf must be at least the size of the requested register.
  * Attempting to write a register with @buf smaller than the register size
diff --git a/plugins/api.c b/plugins/api.c
index 6514f2c76a..3f04399c26 100644
--- a/plugins/api.c
+++ b/plugins/api.c
@@ -437,6 +437,10 @@ int qemu_plugin_read_register(struct qemu_plugin_register *reg, GByteArray *buf)
 {
     g_assert(current_cpu);
 
+    if (qemu_plugin_get_cb_flags() == QEMU_PLUGIN_CB_NO_REGS) {
+        return -1;
+    }
+
     return gdb_read_register(current_cpu, buf, GPOINTER_TO_INT(reg) - 1);
 }
 
diff --git a/plugins/core.c b/plugins/core.c
index eb9281fe54..c6e9ef1478 100644
--- a/plugins/core.c
+++ b/plugins/core.c
@@ -15,6 +15,7 @@
 #include "qemu/lockable.h"
 #include "qemu/option.h"
 #include "qemu/plugin.h"
+#include "qemu/qemu-plugin.h"
 #include "qemu/queue.h"
 #include "qemu/rcu_queue.h"
 #include "qemu/rcu.h"
@@ -266,7 +267,9 @@ static void qemu_plugin_vcpu_init__async(CPUState *cpu, run_on_cpu_data unused)
     plugin_grow_scoreboards__locked(cpu);
     qemu_rec_mutex_unlock(&plugin.lock);
 
+    qemu_plugin_set_cb_flags(cpu, QEMU_PLUGIN_CB_RW_REGS);
     plugin_vcpu_cb__simple(cpu, QEMU_PLUGIN_EV_VCPU_INIT);
+    qemu_plugin_set_cb_flags(cpu, QEMU_PLUGIN_CB_NO_REGS);
 }
 
 void qemu_plugin_vcpu_init_hook(CPUState *cpu)
@@ -279,7 +282,9 @@ void qemu_plugin_vcpu_exit_hook(CPUState *cpu)
 {
     bool success;
 
+    qemu_plugin_set_cb_flags(cpu, QEMU_PLUGIN_CB_RW_REGS);
     plugin_vcpu_cb__simple(cpu, QEMU_PLUGIN_EV_VCPU_EXIT);
+    qemu_plugin_set_cb_flags(cpu, QEMU_PLUGIN_CB_NO_REGS);
 
     assert(cpu->cpu_index != UNASSIGNED_CPU_INDEX);
     qemu_rec_mutex_lock(&plugin.lock);
@@ -367,6 +372,7 @@ void plugin_register_dyn_cb__udata(GArray **arr,
     static TCGHelperInfo info[3] = {
         [QEMU_PLUGIN_CB_NO_REGS].flags = TCG_CALL_NO_RWG,
         [QEMU_PLUGIN_CB_R_REGS].flags = TCG_CALL_NO_WG,
+        [QEMU_PLUGIN_CB_RW_REGS].flags = 0,
         /*
          * Match qemu_plugin_vcpu_udata_cb_t:
          *   void (*)(uint32_t, void *)
@@ -396,6 +402,7 @@ void plugin_register_dyn_cond_cb__udata(GArray **arr,
     static TCGHelperInfo info[3] = {
         [QEMU_PLUGIN_CB_NO_REGS].flags = TCG_CALL_NO_RWG,
         [QEMU_PLUGIN_CB_R_REGS].flags = TCG_CALL_NO_WG,
+        [QEMU_PLUGIN_CB_RW_REGS].flags = 0,
         /*
          * Match qemu_plugin_vcpu_udata_cb_t:
          *   void (*)(uint32_t, void *)
@@ -434,6 +441,7 @@ void plugin_register_vcpu_mem_cb(GArray **arr,
     static TCGHelperInfo info[3] = {
         [QEMU_PLUGIN_CB_NO_REGS].flags = TCG_CALL_NO_RWG,
         [QEMU_PLUGIN_CB_R_REGS].flags = TCG_CALL_NO_WG,
+        [QEMU_PLUGIN_CB_RW_REGS].flags = 0,
         /*
          * Match qemu_plugin_vcpu_mem_cb_t:
          *   void (*)(uint32_t, qemu_plugin_meminfo_t, uint64_t, void *)
@@ -473,7 +481,9 @@ void qemu_plugin_tb_trans_cb(CPUState *cpu, struct qemu_plugin_tb *tb)
     QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) {
         qemu_plugin_vcpu_tb_trans_cb_t func = cb->f.vcpu_tb_trans;
 
+        qemu_plugin_set_cb_flags(cpu, QEMU_PLUGIN_CB_RW_REGS);
         func(cb->ctx->id, tb);
+        qemu_plugin_set_cb_flags(cpu, QEMU_PLUGIN_CB_NO_REGS);
     }
 }
 
@@ -498,7 +508,9 @@ qemu_plugin_vcpu_syscall(CPUState *cpu, int64_t num, uint64_t a1, uint64_t a2,
     QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) {
         qemu_plugin_vcpu_syscall_cb_t func = cb->f.vcpu_syscall;
 
+        qemu_plugin_set_cb_flags(cpu, QEMU_PLUGIN_CB_RW_REGS);
         func(cb->ctx->id, cpu->cpu_index, num, a1, a2, a3, a4, a5, a6, a7, a8);
+        qemu_plugin_set_cb_flags(cpu, QEMU_PLUGIN_CB_NO_REGS);
     }
 }
 
@@ -520,7 +532,9 @@ void qemu_plugin_vcpu_syscall_ret(CPUState *cpu, int64_t num, int64_t ret)
     QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) {
         qemu_plugin_vcpu_syscall_ret_cb_t func = cb->f.vcpu_syscall_ret;
 
+        qemu_plugin_set_cb_flags(cpu, QEMU_PLUGIN_CB_RW_REGS);
         func(cb->ctx->id, cpu->cpu_index, num, ret);
+        qemu_plugin_set_cb_flags(cpu, QEMU_PLUGIN_CB_NO_REGS);
     }
 }
 
@@ -528,14 +542,18 @@ void qemu_plugin_vcpu_idle_cb(CPUState *cpu)
 {
     /* idle and resume cb may be called before init, ignore in this case */
     if (cpu->cpu_index < plugin.num_vcpus) {
+        qemu_plugin_set_cb_flags(cpu, QEMU_PLUGIN_CB_RW_REGS);
         plugin_vcpu_cb__simple(cpu, QEMU_PLUGIN_EV_VCPU_IDLE);
+        qemu_plugin_set_cb_flags(cpu, QEMU_PLUGIN_CB_NO_REGS);
     }
 }
 
 void qemu_plugin_vcpu_resume_cb(CPUState *cpu)
 {
     if (cpu->cpu_index < plugin.num_vcpus) {
+        qemu_plugin_set_cb_flags(cpu, QEMU_PLUGIN_CB_RW_REGS);
         plugin_vcpu_cb__simple(cpu, QEMU_PLUGIN_EV_VCPU_RESUME);
+        qemu_plugin_set_cb_flags(cpu, QEMU_PLUGIN_CB_NO_REGS);
     }
 }
 
@@ -615,9 +633,13 @@ void qemu_plugin_vcpu_mem_cb(CPUState *cpu, uint64_t vaddr,
         switch (cb->type) {
         case PLUGIN_CB_MEM_REGULAR:
             if (rw & cb->regular.rw) {
+                qemu_plugin_set_cb_flags(cpu,
+                    tcg_call_to_qemu_plugin_cb_flags(cb->regular.info->flags));
+
                 cb->regular.f.vcpu_mem(cpu->cpu_index,
                                        make_plugin_meminfo(oi, rw),
                                        vaddr, cb->regular.userp);
+                qemu_plugin_set_cb_flags(cpu, QEMU_PLUGIN_CB_NO_REGS);
             }
             break;
         case PLUGIN_CB_INLINE_ADD_U64:
@@ -760,3 +782,14 @@ void plugin_scoreboard_free(struct qemu_plugin_scoreboard *score)
     g_array_free(score->data, TRUE);
     g_free(score);
 }
+
+enum qemu_plugin_cb_flags tcg_call_to_qemu_plugin_cb_flags(int flags)
+{
+    if (flags & TCG_CALL_NO_RWG) {
+        return QEMU_PLUGIN_CB_NO_REGS;
+    } else if (flags & TCG_CALL_NO_WG) {
+        return QEMU_PLUGIN_CB_R_REGS;
+    } else {
+        return QEMU_PLUGIN_CB_RW_REGS;
+    }
+}

From f00373b895da830ef6d0ee9a518e336e8252a4a3 Mon Sep 17 00:00:00 2001
From: Rowan Hart <rowanbhart@gmail.com>
Date: Fri, 27 Jun 2025 12:25:04 +0100
Subject: [PATCH 1775/2760] plugins: Add memory virtual address write API
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This patch adds functions to the plugins API to allow reading and
writing memory via virtual addresses. These functions only permit doing
so on the current CPU, because there is no way to ensure consistency if
plugins are allowed to read or write to other CPUs that aren't currently
in the context of the plugin.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Rowan Hart <rowanbhart@gmail.com>
Message-ID: <20250624175351.440780-5-rowanbhart@gmail.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250627112512.1880708-9-alex.bennee@linaro.org>
---
 include/qemu/qemu-plugin.h | 21 +++++++++++++++++++++
 plugins/api.c              | 18 ++++++++++++++++++
 2 files changed, 39 insertions(+)

diff --git a/include/qemu/qemu-plugin.h b/include/qemu/qemu-plugin.h
index 9c9ebf6ce0..4167c46c2a 100644
--- a/include/qemu/qemu-plugin.h
+++ b/include/qemu/qemu-plugin.h
@@ -958,6 +958,27 @@ QEMU_PLUGIN_API
 bool qemu_plugin_read_memory_vaddr(uint64_t addr,
                                    GByteArray *data, size_t len);
 
+/**
+ * qemu_plugin_write_memory_vaddr() - write to memory using a virtual address
+ *
+ * @addr: A virtual address to write to
+ * @data: A byte array containing the data to write
+ *
+ * The contents of @data will be written to memory starting at the virtual
+ * address @addr.
+ *
+ * This function does not guarantee consistency of writes, nor does it ensure
+ * that pending writes are flushed either before or after the write takes place,
+ * so callers should take care to only call this function in vCPU context (i.e.
+ * in callbacks) and avoid depending on the existence of data written using this
+ * function which may be overwritten afterward.
+ *
+ * Returns true on success and false on failure.
+ */
+QEMU_PLUGIN_API
+bool qemu_plugin_write_memory_vaddr(uint64_t addr,
+                                   GByteArray *data);
+
 /**
  * qemu_plugin_scoreboard_new() - alloc a new scoreboard
  *
diff --git a/plugins/api.c b/plugins/api.c
index 3f04399c26..1f64a9ea64 100644
--- a/plugins/api.c
+++ b/plugins/api.c
@@ -476,6 +476,24 @@ bool qemu_plugin_read_memory_vaddr(uint64_t addr, GByteArray *data, size_t len)
     return true;
 }
 
+bool qemu_plugin_write_memory_vaddr(uint64_t addr, GByteArray *data)
+{
+    g_assert(current_cpu);
+
+    if (data->len == 0) {
+        return false;
+    }
+
+    int result = cpu_memory_rw_debug(current_cpu, addr, data->data,
+                                     data->len, true);
+
+    if (result < 0) {
+        return false;
+    }
+
+    return true;
+}
+
 struct qemu_plugin_scoreboard *qemu_plugin_scoreboard_new(size_t element_size)
 {
     return plugin_scoreboard_new(element_size);

From 30424b8d4299d7dc50f90a6909e41a3c7ce94ccb Mon Sep 17 00:00:00 2001
From: Rowan Hart <rowanbhart@gmail.com>
Date: Fri, 27 Jun 2025 12:25:05 +0100
Subject: [PATCH 1776/2760] plugins: Add memory hardware address read/write API
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This patch adds functions to the plugins API to allow plugins to read
and write memory via hardware addresses. The functions use the current
address space of the current CPU in order to avoid exposing address
space information to users. A later patch may want to add a function to
permit a specified address space, for example to facilitate
architecture-specific plugins that want to operate on them, for example
reading ARM secure memory.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Rowan Hart <rowanbhart@gmail.com>
Message-ID: <20250624175351.440780-6-rowanbhart@gmail.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250627112512.1880708-10-alex.bennee@linaro.org>
---
 include/qemu/qemu-plugin.h | 93 ++++++++++++++++++++++++++++++++++++
 plugins/api.c              | 97 ++++++++++++++++++++++++++++++++++++++
 2 files changed, 190 insertions(+)

diff --git a/include/qemu/qemu-plugin.h b/include/qemu/qemu-plugin.h
index 4167c46c2a..5eecdccc67 100644
--- a/include/qemu/qemu-plugin.h
+++ b/include/qemu/qemu-plugin.h
@@ -979,6 +979,99 @@ QEMU_PLUGIN_API
 bool qemu_plugin_write_memory_vaddr(uint64_t addr,
                                    GByteArray *data);
 
+/**
+ * enum qemu_plugin_hwaddr_operation_result - result of a memory operation
+ *
+ * @QEMU_PLUGIN_HWADDR_OPERATION_OK: hwaddr operation succeeded
+ * @QEMU_PLUGIN_HWADDR_OPERATION_ERROR: unexpected error occurred
+ * @QEMU_PLUGIN_HWADDR_OPERATION_DEVICE_ERROR: error in memory device
+ * @QEMU_PLUGIN_HWADDR_OPERATION_ACCESS_DENIED: permission error
+ * @QEMU_PLUGIN_HWADDR_OPERATION_INVALID_ADDRESS: address was invalid
+ * @QEMU_PLUGIN_HWADDR_OPERATION_INVALID_ADDRESS_SPACE: invalid address space
+ */
+enum qemu_plugin_hwaddr_operation_result {
+    QEMU_PLUGIN_HWADDR_OPERATION_OK,
+    QEMU_PLUGIN_HWADDR_OPERATION_ERROR,
+    QEMU_PLUGIN_HWADDR_OPERATION_DEVICE_ERROR,
+    QEMU_PLUGIN_HWADDR_OPERATION_ACCESS_DENIED,
+    QEMU_PLUGIN_HWADDR_OPERATION_INVALID_ADDRESS,
+    QEMU_PLUGIN_HWADDR_OPERATION_INVALID_ADDRESS_SPACE,
+};
+
+/**
+ * qemu_plugin_read_memory_hwaddr() - read from memory using a hardware address
+ *
+ * @addr: The physical address to read from
+ * @data: A byte array to store data into
+ * @len: The number of bytes to read, starting from @addr
+ *
+ * @len bytes of data is read from the current memory space for the current
+ * vCPU starting at @addr and stored into @data. If @data is not large enough to
+ * hold @len bytes, it will be expanded to the necessary size, reallocating if
+ * necessary. @len must be greater than 0.
+ *
+ * This function does not ensure writes are flushed prior to reading, so
+ * callers should take care when calling this function in plugin callbacks to
+ * avoid attempting to read data which may not yet be written and should use
+ * the memory callback API instead.
+ *
+ * This function is only valid for softmmu targets.
+ *
+ * Returns a qemu_plugin_hwaddr_operation_result indicating the result of the
+ * operation.
+ */
+QEMU_PLUGIN_API
+enum qemu_plugin_hwaddr_operation_result
+qemu_plugin_read_memory_hwaddr(uint64_t addr, GByteArray *data, size_t len);
+
+/**
+ * qemu_plugin_write_memory_hwaddr() - write to memory using a hardware address
+ *
+ * @addr: A physical address to write to
+ * @data: A byte array containing the data to write
+ *
+ * The contents of @data will be written to memory starting at the hardware
+ * address @addr in the current address space for the current vCPU.
+ *
+ * This function does not guarantee consistency of writes, nor does it ensure
+ * that pending writes are flushed either before or after the write takes place,
+ * so callers should take care when calling this function in plugin callbacks to
+ * avoid depending on the existence of data written using this function which
+ * may be overwritten afterward. In addition, this function requires that the
+ * pages containing the address are not locked. Practically, this means that you
+ * should not write instruction memory in a current translation block inside a
+ * callback registered with qemu_plugin_register_vcpu_tb_trans_cb.
+ *
+ * You can, for example, write instruction memory in a current translation block
+ * in a callback registered with qemu_plugin_register_vcpu_tb_exec_cb, although
+ * be aware that the write will not be flushed until after the translation block
+ * has finished executing.  In general, this function should be used to write
+ * data memory or to patch code at a known address, not in a current translation
+ * block.
+ *
+ * This function is only valid for softmmu targets.
+ *
+ * Returns a qemu_plugin_hwaddr_operation_result indicating the result of the
+ * operation.
+ */
+QEMU_PLUGIN_API
+enum qemu_plugin_hwaddr_operation_result
+qemu_plugin_write_memory_hwaddr(uint64_t addr, GByteArray *data);
+
+/**
+ * qemu_plugin_translate_vaddr() - translate virtual address for current vCPU
+ *
+ * @vaddr: virtual address to translate
+ * @hwaddr: pointer to store the physical address
+ *
+ * This function is only valid in vCPU context (i.e. in callbacks) and is only
+ * valid for softmmu targets.
+ *
+ * Returns true on success and false on failure.
+ */
+QEMU_PLUGIN_API
+bool qemu_plugin_translate_vaddr(uint64_t vaddr, uint64_t *hwaddr);
+
 /**
  * qemu_plugin_scoreboard_new() - alloc a new scoreboard
  *
diff --git a/plugins/api.c b/plugins/api.c
index 1f64a9ea64..eac04cc1f6 100644
--- a/plugins/api.c
+++ b/plugins/api.c
@@ -39,6 +39,7 @@
 #include "qemu/main-loop.h"
 #include "qemu/plugin.h"
 #include "qemu/log.h"
+#include "system/memory.h"
 #include "tcg/tcg.h"
 #include "exec/gdbstub.h"
 #include "exec/target_page.h"
@@ -494,6 +495,102 @@ bool qemu_plugin_write_memory_vaddr(uint64_t addr, GByteArray *data)
     return true;
 }
 
+enum qemu_plugin_hwaddr_operation_result
+qemu_plugin_read_memory_hwaddr(hwaddr addr, GByteArray *data, size_t len)
+{
+#ifdef CONFIG_SOFTMMU
+    if (len == 0) {
+        return QEMU_PLUGIN_HWADDR_OPERATION_ERROR;
+    }
+
+    g_assert(current_cpu);
+
+
+    int as_idx = cpu_asidx_from_attrs(current_cpu, MEMTXATTRS_UNSPECIFIED);
+    AddressSpace *as = cpu_get_address_space(current_cpu, as_idx);
+
+    if (as == NULL) {
+        return QEMU_PLUGIN_HWADDR_OPERATION_INVALID_ADDRESS_SPACE;
+    }
+
+    g_byte_array_set_size(data, len);
+    MemTxResult res = address_space_rw(as, addr,
+                                       MEMTXATTRS_UNSPECIFIED, data->data,
+                                       data->len, false);
+
+    switch (res) {
+    case MEMTX_OK:
+        return QEMU_PLUGIN_HWADDR_OPERATION_OK;
+    case MEMTX_ERROR:
+        return QEMU_PLUGIN_HWADDR_OPERATION_DEVICE_ERROR;
+    case MEMTX_DECODE_ERROR:
+        return QEMU_PLUGIN_HWADDR_OPERATION_INVALID_ADDRESS;
+    case MEMTX_ACCESS_ERROR:
+        return QEMU_PLUGIN_HWADDR_OPERATION_ACCESS_DENIED;
+    default:
+        return QEMU_PLUGIN_HWADDR_OPERATION_ERROR;
+    }
+#else
+    return QEMU_PLUGIN_HWADDR_OPERATION_ERROR;
+#endif
+}
+
+enum qemu_plugin_hwaddr_operation_result
+qemu_plugin_write_memory_hwaddr(hwaddr addr, GByteArray *data)
+{
+#ifdef CONFIG_SOFTMMU
+    if (data->len == 0) {
+        return QEMU_PLUGIN_HWADDR_OPERATION_ERROR;
+    }
+
+    g_assert(current_cpu);
+
+    int as_idx = cpu_asidx_from_attrs(current_cpu, MEMTXATTRS_UNSPECIFIED);
+    AddressSpace *as = cpu_get_address_space(current_cpu, as_idx);
+
+    if (as == NULL) {
+        return QEMU_PLUGIN_HWADDR_OPERATION_INVALID_ADDRESS_SPACE;
+    }
+
+    MemTxResult res = address_space_rw(as, addr,
+                                       MEMTXATTRS_UNSPECIFIED, data->data,
+                                       data->len, true);
+    switch (res) {
+    case MEMTX_OK:
+        return QEMU_PLUGIN_HWADDR_OPERATION_OK;
+    case MEMTX_ERROR:
+        return QEMU_PLUGIN_HWADDR_OPERATION_DEVICE_ERROR;
+    case MEMTX_DECODE_ERROR:
+        return QEMU_PLUGIN_HWADDR_OPERATION_INVALID_ADDRESS;
+    case MEMTX_ACCESS_ERROR:
+        return QEMU_PLUGIN_HWADDR_OPERATION_ACCESS_DENIED;
+    default:
+        return QEMU_PLUGIN_HWADDR_OPERATION_ERROR;
+    }
+#else
+    return QEMU_PLUGIN_HWADDR_OPERATION_ERROR;
+#endif
+}
+
+bool qemu_plugin_translate_vaddr(uint64_t vaddr, uint64_t *hwaddr)
+{
+#ifdef CONFIG_SOFTMMU
+    g_assert(current_cpu);
+
+    uint64_t res = cpu_get_phys_page_debug(current_cpu, vaddr);
+
+    if (res == (uint64_t)-1) {
+        return false;
+    }
+
+    *hwaddr = res | (vaddr & ~TARGET_PAGE_MASK);
+
+    return true;
+#else
+    return false;
+#endif
+}
+
 struct qemu_plugin_scoreboard *qemu_plugin_scoreboard_new(size_t element_size)
 {
     return plugin_scoreboard_new(element_size);

From 5ea2abf07ccd661c434249c4d08fce9c0f8529a1 Mon Sep 17 00:00:00 2001
From: Rowan Hart <rowanbhart@gmail.com>
Date: Fri, 27 Jun 2025 12:25:06 +0100
Subject: [PATCH 1777/2760] tests/tcg: Remove copy-pasted notes and from i386
 and add x86_64 system tests to tests
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The x86_64-softmmu Makefile seems to have been copy-pasted from the i386
Makefile at some point in the past. Cleaning up a vestigial unused
variable and removing some outdated comments.

Signed-off-by: Rowan Hart <rowanbhart@gmail.com>
Message-ID: <20250624175351.440780-7-rowanbhart@gmail.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250627112512.1880708-11-alex.bennee@linaro.org>
---
 tests/tcg/x86_64/Makefile.softmmu-target | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/tests/tcg/x86_64/Makefile.softmmu-target b/tests/tcg/x86_64/Makefile.softmmu-target
index ef6bcb4dc7..d3e09708a5 100644
--- a/tests/tcg/x86_64/Makefile.softmmu-target
+++ b/tests/tcg/x86_64/Makefile.softmmu-target
@@ -1,13 +1,11 @@
 #
-# x86 system tests
-#
-# This currently builds only for i386. The common C code is built
-# with standard compiler flags however so we can support both by
-# adding additional boot files for x86_64.
+# x86_64 system tests
 #
 
-I386_SYSTEM_SRC=$(SRC_PATH)/tests/tcg/i386/system
 X64_SYSTEM_SRC=$(SRC_PATH)/tests/tcg/x86_64/system
+X64_SYSTEM_TESTS=$(patsubst $(X64_SYSTEM_SRC)/%.c, %, $(wildcard $(X64_SYSTEM_SRC)/*.c))
+
+VPATH+=$(X64_SYSTEM_SRC)
 
 # These objects provide the basic boot code and helper functions for all tests
 CRT_OBJS=boot.o
@@ -18,7 +16,7 @@ LDFLAGS=-Wl,-T$(LINK_SCRIPT) -Wl,-melf_x86_64
 CFLAGS+=-nostdlib -ggdb -O0 $(MINILIB_INC)
 LDFLAGS+=-static -nostdlib $(CRT_OBJS) $(MINILIB_OBJS) -lgcc
 
-TESTS+=$(MULTIARCH_TESTS)
+TESTS+=$(MULTIARCH_TESTS) $(X64_SYSTEM_TESTS)
 EXTRA_RUNS+=$(MULTIARCH_RUNS)
 
 # building head blobs

From 71d337943870b30ed8a137fb14dbf4680ba9ccc7 Mon Sep 17 00:00:00 2001
From: Rowan Hart <rowanbhart@gmail.com>
Date: Fri, 27 Jun 2025 12:25:07 +0100
Subject: [PATCH 1778/2760] plugins: Add patcher plugin and test
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This patch adds a plugin that exercises the virtual and hardware memory
read-write API functions added in a previous patch. The plugin takes a
target and patch byte sequence, and will overwrite any instruction
matching the target byte sequence with the patch.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Rowan Hart <rowanbhart@gmail.com>
Message-ID: <20250624175351.440780-8-rowanbhart@gmail.com>
[AJB: tweak Makefile, use uintptr_t for pointer stuffing]
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250627112512.1880708-12-alex.bennee@linaro.org>
---
 tests/tcg/Makefile.target                 |   7 +-
 tests/tcg/plugins/meson.build             |   2 +-
 tests/tcg/plugins/patch.c                 | 251 ++++++++++++++++++++++
 tests/tcg/x86_64/Makefile.softmmu-target  |   9 +
 tests/tcg/x86_64/system/patch-target.c    |  22 ++
 tests/tcg/x86_64/system/validate-patch.py |  39 ++++
 6 files changed, 328 insertions(+), 2 deletions(-)
 create mode 100644 tests/tcg/plugins/patch.c
 create mode 100644 tests/tcg/x86_64/system/patch-target.c
 create mode 100755 tests/tcg/x86_64/system/validate-patch.py

diff --git a/tests/tcg/Makefile.target b/tests/tcg/Makefile.target
index 95ff76ea44..af68f11664 100644
--- a/tests/tcg/Makefile.target
+++ b/tests/tcg/Makefile.target
@@ -151,7 +151,12 @@ ifeq ($(CONFIG_PLUGIN),y)
 PLUGIN_SRC=$(SRC_PATH)/tests/tcg/plugins
 PLUGIN_LIB=../plugins
 VPATH+=$(PLUGIN_LIB)
-PLUGINS=$(patsubst %.c, lib%.so, $(notdir $(wildcard $(PLUGIN_SRC)/*.c)))
+# Some plugins need to be disabled for all tests to avoid exponential explosion.
+# For example, libpatch.so only needs to run against the arch-specific patch
+# target test, so we explicitly run it in the arch-specific Makefile.
+DISABLE_PLUGINS=libpatch.so
+PLUGINS=$(filter-out $(DISABLE_PLUGINS), \
+	$(patsubst %.c, lib%.so, $(notdir $(wildcard $(PLUGIN_SRC)/*.c))))
 
 # We need to ensure expand the run-plugin-TEST-with-PLUGIN
 # pre-requistes manually here as we can't use stems to handle it. We
diff --git a/tests/tcg/plugins/meson.build b/tests/tcg/plugins/meson.build
index 029342282a..61a007d9e7 100644
--- a/tests/tcg/plugins/meson.build
+++ b/tests/tcg/plugins/meson.build
@@ -1,6 +1,6 @@
 t = []
 if get_option('plugins')
-  foreach i : ['bb', 'empty', 'inline', 'insn', 'mem', 'reset', 'syscall']
+  foreach i : ['bb', 'empty', 'inline', 'insn', 'mem', 'reset', 'syscall', 'patch']
     if host_os == 'windows'
       t += shared_module(i, files(i + '.c') + '../../../contrib/plugins/win32_linker.c',
                         include_directories: '../../../include/qemu',
diff --git a/tests/tcg/plugins/patch.c b/tests/tcg/plugins/patch.c
new file mode 100644
index 0000000000..111c5c1f16
--- /dev/null
+++ b/tests/tcg/plugins/patch.c
@@ -0,0 +1,251 @@
+/*
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ *
+ * This plugin patches instructions matching a pattern to a different
+ * instruction as they execute
+ *
+ */
+
+#include "glib.h"
+#include "glibconfig.h"
+
+#include <qemu-plugin.h>
+#include <string.h>
+#include <stdio.h>
+
+QEMU_PLUGIN_EXPORT int qemu_plugin_version = QEMU_PLUGIN_VERSION;
+
+static bool use_hwaddr;
+static GByteArray *target_data;
+static GByteArray *patch_data;
+
+/**
+ * Parse a string of hexadecimal digits into a GByteArray. The string must be
+ * even length
+ */
+static GByteArray *str_to_bytes(const char *str)
+{
+    size_t len = strlen(str);
+
+    if (len == 0 || len % 2 != 0) {
+        return NULL;
+    }
+
+    GByteArray *bytes = g_byte_array_new();
+    char byte[3] = {0};
+    guint8 value = 0;
+
+    for (size_t i = 0; i < len; i += 2) {
+        byte[0] = str[i];
+        byte[1] = str[i + 1];
+        value = (guint8)g_ascii_strtoull(byte, NULL, 16);
+        g_byte_array_append(bytes, &value, 1);
+    }
+
+    return bytes;
+}
+
+static void patch_hwaddr(unsigned int vcpu_index, void *userdata)
+{
+    uintptr_t addr = (uintptr_t) userdata;
+    g_autoptr(GString) str = g_string_new(NULL);
+    g_string_printf(str, "patching: @0x%"
+                    PRIxPTR "\n",
+                    addr);
+    qemu_plugin_outs(str->str);
+
+    enum qemu_plugin_hwaddr_operation_result result =
+        qemu_plugin_write_memory_hwaddr(addr, patch_data);
+
+
+    if (result != QEMU_PLUGIN_HWADDR_OPERATION_OK) {
+        g_autoptr(GString) errmsg = g_string_new(NULL);
+        g_string_printf(errmsg, "Failed to write memory: %d\n", result);
+        qemu_plugin_outs(errmsg->str);
+        return;
+    }
+
+    GByteArray *read_data = g_byte_array_new();
+
+    result = qemu_plugin_read_memory_hwaddr(addr, read_data,
+                                            patch_data->len);
+
+    qemu_plugin_outs("Reading memory...\n");
+
+    if (result != QEMU_PLUGIN_HWADDR_OPERATION_OK) {
+        g_autoptr(GString) errmsg = g_string_new(NULL);
+        g_string_printf(errmsg, "Failed to read memory: %d\n", result);
+        qemu_plugin_outs(errmsg->str);
+        return;
+    }
+
+    if (memcmp(patch_data->data, read_data->data, patch_data->len) != 0) {
+        qemu_plugin_outs("Failed to read back written data\n");
+    }
+
+    qemu_plugin_outs("Success!\n");
+
+    return;
+}
+
+static void patch_vaddr(unsigned int vcpu_index, void *userdata)
+{
+    uintptr_t addr = (uintptr_t) userdata;
+    uint64_t hwaddr = 0;
+    if (!qemu_plugin_translate_vaddr(addr, &hwaddr)) {
+        qemu_plugin_outs("Failed to translate vaddr\n");
+        return;
+    }
+    g_autoptr(GString) str = g_string_new(NULL);
+    g_string_printf(str, "patching: @0x%"
+                    PRIxPTR " hw: @0x%" PRIx64 "\n",
+                    addr, hwaddr);
+    qemu_plugin_outs(str->str);
+
+    qemu_plugin_outs("Writing memory (vaddr)...\n");
+
+    if (!qemu_plugin_write_memory_vaddr(addr, patch_data)) {
+        qemu_plugin_outs("Failed to write memory\n");
+        return;
+    }
+
+    qemu_plugin_outs("Reading memory (vaddr)...\n");
+
+    g_autoptr(GByteArray) read_data = g_byte_array_new();
+
+    if (!qemu_plugin_read_memory_vaddr(addr, read_data, patch_data->len)) {
+        qemu_plugin_outs("Failed to read memory\n");
+        return;
+    }
+
+    if (memcmp(patch_data->data, read_data->data, patch_data->len) != 0) {
+        qemu_plugin_outs("Failed to read back written data\n");
+    }
+
+    qemu_plugin_outs("Success!\n");
+
+    return;
+}
+
+/*
+ * Callback on translation of a translation block.
+ */
+static void vcpu_tb_trans_cb(qemu_plugin_id_t id, struct qemu_plugin_tb *tb)
+{
+    g_autoptr(GByteArray) insn_data = g_byte_array_new();
+    uintptr_t addr = 0;
+
+    for (size_t i = 0; i < qemu_plugin_tb_n_insns(tb); i++) {
+        struct qemu_plugin_insn *insn = qemu_plugin_tb_get_insn(tb, i);
+        uint64_t vaddr = qemu_plugin_insn_vaddr(insn);
+
+        if (use_hwaddr) {
+            uint64_t hwaddr = 0;
+            if (!qemu_plugin_translate_vaddr(vaddr, &hwaddr)) {
+                qemu_plugin_outs("Failed to translate vaddr\n");
+                continue;
+            }
+            /*
+             * As we cannot emulate 64 bit systems on 32 bit hosts we
+             * should never see the top bits set, hence we can safely
+             * cast to uintptr_t.
+             */
+            g_assert(hwaddr <= UINTPTR_MAX);
+            addr = (uintptr_t) hwaddr;
+        } else {
+            g_assert(vaddr <= UINTPTR_MAX);
+            addr = (uintptr_t) vaddr;
+        }
+
+        g_byte_array_set_size(insn_data, qemu_plugin_insn_size(insn));
+        qemu_plugin_insn_data(insn, insn_data->data, insn_data->len);
+
+        if (insn_data->len >= target_data->len &&
+            !memcmp(insn_data->data, target_data->data,
+                    MIN(target_data->len, insn_data->len))) {
+            if (use_hwaddr) {
+                qemu_plugin_register_vcpu_tb_exec_cb(tb, patch_hwaddr,
+                                                     QEMU_PLUGIN_CB_NO_REGS,
+                                                     (void *) addr);
+            } else {
+                qemu_plugin_register_vcpu_tb_exec_cb(tb, patch_vaddr,
+                                                     QEMU_PLUGIN_CB_NO_REGS,
+                                                     (void *) addr);
+            }
+        }
+    }
+}
+
+static void usage(void)
+{
+    fprintf(stderr, "Usage: <lib>,target=<bytes>,patch=<new_bytes>"
+            "[,use_hwaddr=true|false]");
+}
+
+/*
+ * Called when the plugin is installed
+ */
+QEMU_PLUGIN_EXPORT int qemu_plugin_install(qemu_plugin_id_t id,
+                                           const qemu_info_t *info, int argc,
+                                           char **argv)
+{
+
+    use_hwaddr = true;
+    target_data = NULL;
+    patch_data = NULL;
+
+    if (argc > 4) {
+        usage();
+        return -1;
+    }
+
+    for (size_t i = 0; i < argc; i++) {
+        char *opt = argv[i];
+        g_auto(GStrv) tokens = g_strsplit(opt, "=", 2);
+        if (g_strcmp0(tokens[0], "use_hwaddr") == 0) {
+            if (!qemu_plugin_bool_parse(tokens[0], tokens[1], &use_hwaddr)) {
+                fprintf(stderr,
+                        "Failed to parse boolean argument use_hwaddr\n");
+                return -1;
+            }
+        } else if (g_strcmp0(tokens[0], "target") == 0) {
+            target_data = str_to_bytes(tokens[1]);
+            if (!target_data) {
+                fprintf(stderr,
+                         "Failed to parse target bytes.\n");
+                return -1;
+            }
+        } else if (g_strcmp0(tokens[0], "patch") == 0) {
+            patch_data = str_to_bytes(tokens[1]);
+            if (!patch_data) {
+                fprintf(stderr, "Failed to parse patch bytes.\n");
+                return -1;
+            }
+        } else {
+            fprintf(stderr, "Unknown argument: %s\n", tokens[0]);
+            usage();
+            return -1;
+        }
+    }
+
+    if (!target_data) {
+        fprintf(stderr, "target argument is required\n");
+        usage();
+        return -1;
+    }
+
+    if (!patch_data) {
+        fprintf(stderr, "patch argument is required\n");
+        usage();
+        return -1;
+    }
+
+    if (target_data->len != patch_data->len) {
+        fprintf(stderr, "Target and patch data must be the same length\n");
+        return -1;
+    }
+
+    qemu_plugin_register_vcpu_tb_trans_cb(id, vcpu_tb_trans_cb);
+
+    return 0;
+}
diff --git a/tests/tcg/x86_64/Makefile.softmmu-target b/tests/tcg/x86_64/Makefile.softmmu-target
index d3e09708a5..3e30ca9307 100644
--- a/tests/tcg/x86_64/Makefile.softmmu-target
+++ b/tests/tcg/x86_64/Makefile.softmmu-target
@@ -33,3 +33,12 @@ memory: CFLAGS+=-DCHECK_UNALIGNED=1
 
 # Running
 QEMU_OPTS+=-device isa-debugcon,chardev=output -device isa-debug-exit,iobase=0xf4,iosize=0x4 -kernel
+
+ifeq ($(CONFIG_PLUGIN),y)
+run-plugin-patch-target-with-libpatch.so:		\
+	PLUGIN_ARGS=$(COMMA)target=ffc0$(COMMA)patch=9090$(COMMA)use_hwaddr=true
+run-plugin-patch-target-with-libpatch.so:		\
+	CHECK_PLUGIN_OUTPUT_COMMAND=$(X64_SYSTEM_SRC)/validate-patch.py $@.out
+run-plugin-patch-target-with-libpatch.so: patch-target libpatch.so
+EXTRA_RUNS+=run-plugin-patch-target-with-libpatch.so
+endif
diff --git a/tests/tcg/x86_64/system/patch-target.c b/tests/tcg/x86_64/system/patch-target.c
new file mode 100644
index 0000000000..8c2b6f4ba7
--- /dev/null
+++ b/tests/tcg/x86_64/system/patch-target.c
@@ -0,0 +1,22 @@
+/*
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ *
+ * This test target increments a value 100 times. The patcher converts the
+ * inc instruction to a nop, so it only increments the value once.
+ *
+ */
+#include <minilib.h>
+
+int main(void)
+{
+    ml_printf("Running test...\n");
+    unsigned int x = 0;
+    for (int i = 0; i < 100; i++) {
+        asm volatile (
+            "inc %[x]"
+            : [x] "+a" (x)
+        );
+    }
+    ml_printf("Value: %d\n", x);
+    return 0;
+}
diff --git a/tests/tcg/x86_64/system/validate-patch.py b/tests/tcg/x86_64/system/validate-patch.py
new file mode 100755
index 0000000000..700950eae5
--- /dev/null
+++ b/tests/tcg/x86_64/system/validate-patch.py
@@ -0,0 +1,39 @@
+#!/usr/bin/env python3
+#
+# validate-patch.py: check the patch applies
+#
+# This program takes two inputs:
+#   - the plugin output
+#   - the binary output
+#
+# Copyright (C) 2024
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+import sys
+from argparse import ArgumentParser
+
+def main() -> None:
+    """
+    Process the arguments, injest the program and plugin out and
+    verify they match up and report if they do not.
+    """
+    parser = ArgumentParser(description="Validate patch")
+    parser.add_argument('test_output',
+                        help="The output from the test itself")
+    parser.add_argument('plugin_output',
+                        help="The output from plugin")
+    args = parser.parse_args()
+
+    with open(args.test_output, 'r') as f:
+        test_data = f.read()
+    with open(args.plugin_output, 'r') as f:
+        plugin_data = f.read()
+    if "Value: 1" in test_data:
+        sys.exit(0)
+    else:
+        sys.exit(1)
+
+if __name__ == "__main__":
+    main()
+

From 137d2f947f7ad5ca3190e481b2b0b210386f5b4e Mon Sep 17 00:00:00 2001
From: Rowan Hart <rowanbhart@gmail.com>
Date: Fri, 27 Jun 2025 12:25:08 +0100
Subject: [PATCH 1779/2760] plugins: Update plugin version and add notes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This patch updates the plugin version to gate new APIs and adds notes
describing what has been added.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Rowan Hart <rowanbhart@gmail.com>
Message-ID: <20250624175351.440780-9-rowanbhart@gmail.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250627112512.1880708-13-alex.bennee@linaro.org>
---
 include/qemu/qemu-plugin.h | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/include/qemu/qemu-plugin.h b/include/qemu/qemu-plugin.h
index 5eecdccc67..c450106af1 100644
--- a/include/qemu/qemu-plugin.h
+++ b/include/qemu/qemu-plugin.h
@@ -65,11 +65,18 @@ typedef uint64_t qemu_plugin_id_t;
  *
  * version 4:
  * - added qemu_plugin_read_memory_vaddr
+ *
+ * version 5:
+ * - added qemu_plugin_write_memory_vaddr
+ * - added qemu_plugin_read_memory_hwaddr
+ * - added qemu_plugin_write_memory_hwaddr
+ * - added qemu_plugin_write_register
+ * - added qemu_plugin_translate_vaddr
  */
 
 extern QEMU_PLUGIN_EXPORT int qemu_plugin_version;
 
-#define QEMU_PLUGIN_VERSION 4
+#define QEMU_PLUGIN_VERSION 5
 
 /**
  * struct qemu_info_t - system information for plugins

From ef10cb656c9c9349091cf7ba67bf120d230f0435 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Fri, 27 Jun 2025 12:25:09 +0100
Subject: [PATCH 1780/2760] MAINTAINERS: add myself to virtio-gpu for Odd Fixes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Seeing as I've taken a few patches to here now I might as well put
myself forward to maintain virtio-gpu. I've marked it as Odd Fixes as
it is not my core focus. If someone with more GPU experience comes
forward we can always update again.

Reviewed-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20250603110204.838117-8-alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250627112512.1880708-14-alex.bennee@linaro.org>
---
 MAINTAINERS | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/MAINTAINERS b/MAINTAINERS
index 850588fb64..52f0164edf 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2684,7 +2684,8 @@ F: hw/display/ramfb*.c
 F: include/hw/display/ramfb.h
 
 virtio-gpu
-S: Orphan
+M: Alex Bennée <alex.bennee@linaro.org>
+S: Odd Fixes
 F: hw/display/virtio-gpu*
 F: hw/display/virtio-vga.*
 F: include/hw/virtio/virtio-gpu.h

From 2882dfa57faad19c9f622eea67614b1215c24d8e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Fri, 27 Jun 2025 12:25:10 +0100
Subject: [PATCH 1781/2760] MAINTAINERS: add Akihiko and Dmitry as reviewers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Thanks for volunteering to help.

Cc: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Cc: Dmitry Osipenko <dmitry.osipenko@collabora.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20250603110204.838117-9-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250627112512.1880708-15-alex.bennee@linaro.org>
---
 MAINTAINERS | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/MAINTAINERS b/MAINTAINERS
index 52f0164edf..3932a6e56f 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2685,6 +2685,8 @@ F: include/hw/display/ramfb.h
 
 virtio-gpu
 M: Alex Bennée <alex.bennee@linaro.org>
+R: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
+R: Dmitry Osipenko <dmitry.osipenko@collabora.com>
 S: Odd Fixes
 F: hw/display/virtio-gpu*
 F: hw/display/virtio-vga.*

From 1fa2ffdbec55d84326e22f046bc3e26322836f5a Mon Sep 17 00:00:00 2001
From: Yiwei Zhang <zzyiwei@gmail.com>
Date: Fri, 27 Jun 2025 12:25:11 +0100
Subject: [PATCH 1782/2760] virtio-gpu: support context init multiple timeline
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Venus and later native contexts have their own fence context along with
multiple timelines within. Fences wtih VIRTIO_GPU_FLAG_INFO_RING_IDX in
the flags must be dispatched to be created on the target context. Fence
signaling also has to be handled on the specific timeline within that
target context.

Before this change, venus fencing is completely broken if the host
driver doesn't support implicit fencing with external memory objects.
Frames can go backwards along with random artifacts on screen if the
host driver doesn't attach an implicit fence to the render target. The
symptom could be hidden by certain guest wsi backend that waits on a
venus native VkFence object for the actual payload with limited present
modes or under special configs. e.g. x11 mailbox or xwayland.

After this change, everything related to venus fencing starts making
sense. Confirmed this via guest and host side perfetto tracing.

Cc: qemu-stable@nongnu.org
Fixes: 94d0ea1c1928 ("virtio-gpu: Support Venus context")
Signed-off-by: Yiwei Zhang <zzyiwei@gmail.com>
Reviewed-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
Message-Id: <20250518152651.334115-1-zzyiwei@gmail.com>
[AJB: remove version history from commit message]
Tested-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Message-ID: <20250627112512.1880708-16-alex.bennee@linaro.org>
---
 hw/display/virtio-gpu-virgl.c | 44 +++++++++++++++++++++++++++++++++++
 1 file changed, 44 insertions(+)

diff --git a/hw/display/virtio-gpu-virgl.c b/hw/display/virtio-gpu-virgl.c
index 145a0b3879..94ddc01f91 100644
--- a/hw/display/virtio-gpu-virgl.c
+++ b/hw/display/virtio-gpu-virgl.c
@@ -970,6 +970,15 @@ void virtio_gpu_virgl_process_cmd(VirtIOGPU *g,
     }
 
     trace_virtio_gpu_fence_ctrl(cmd->cmd_hdr.fence_id, cmd->cmd_hdr.type);
+#if VIRGL_VERSION_MAJOR >= 1
+    if (cmd->cmd_hdr.flags & VIRTIO_GPU_FLAG_INFO_RING_IDX) {
+        virgl_renderer_context_create_fence(cmd->cmd_hdr.ctx_id,
+                                            VIRGL_RENDERER_FENCE_FLAG_MERGEABLE,
+                                            cmd->cmd_hdr.ring_idx,
+                                            cmd->cmd_hdr.fence_id);
+        return;
+    }
+#endif
     virgl_renderer_create_fence(cmd->cmd_hdr.fence_id, cmd->cmd_hdr.type);
 }
 
@@ -983,6 +992,11 @@ static void virgl_write_fence(void *opaque, uint32_t fence)
          * the guest can end up emitting fences out of order
          * so we should check all fenced cmds not just the first one.
          */
+#if VIRGL_VERSION_MAJOR >= 1
+        if (cmd->cmd_hdr.flags & VIRTIO_GPU_FLAG_INFO_RING_IDX) {
+            continue;
+        }
+#endif
         if (cmd->cmd_hdr.fence_id > fence) {
             continue;
         }
@@ -997,6 +1011,29 @@ static void virgl_write_fence(void *opaque, uint32_t fence)
     }
 }
 
+#if VIRGL_VERSION_MAJOR >= 1
+static void virgl_write_context_fence(void *opaque, uint32_t ctx_id,
+                                      uint32_t ring_idx, uint64_t fence_id) {
+    VirtIOGPU *g = opaque;
+    struct virtio_gpu_ctrl_command *cmd, *tmp;
+
+    QTAILQ_FOREACH_SAFE(cmd, &g->fenceq, next, tmp) {
+        if (cmd->cmd_hdr.flags & VIRTIO_GPU_FLAG_INFO_RING_IDX &&
+            cmd->cmd_hdr.ctx_id == ctx_id && cmd->cmd_hdr.ring_idx == ring_idx &&
+            cmd->cmd_hdr.fence_id <= fence_id) {
+            trace_virtio_gpu_fence_resp(cmd->cmd_hdr.fence_id);
+            virtio_gpu_ctrl_response_nodata(g, cmd, VIRTIO_GPU_RESP_OK_NODATA);
+            QTAILQ_REMOVE(&g->fenceq, cmd, next);
+            g_free(cmd);
+            g->inflight--;
+            if (virtio_gpu_stats_enabled(g->parent_obj.conf)) {
+                trace_virtio_gpu_dec_inflight_fences(g->inflight);
+            }
+        }
+    }
+}
+#endif
+
 static virgl_renderer_gl_context
 virgl_create_context(void *opaque, int scanout_idx,
                      struct virgl_renderer_gl_ctx_param *params)
@@ -1031,11 +1068,18 @@ static int virgl_make_context_current(void *opaque, int scanout_idx,
 }
 
 static struct virgl_renderer_callbacks virtio_gpu_3d_cbs = {
+#if VIRGL_VERSION_MAJOR >= 1
+    .version             = 3,
+#else
     .version             = 1,
+#endif
     .write_fence         = virgl_write_fence,
     .create_gl_context   = virgl_create_context,
     .destroy_gl_context  = virgl_destroy_context,
     .make_current        = virgl_make_context_current,
+#if VIRGL_VERSION_MAJOR >= 1
+    .write_context_fence = virgl_write_context_fence,
+#endif
 };
 
 static void virtio_gpu_print_stats(void *opaque)

From 1d6045148f90c7427648b73dd97d37c4a1ad7418 Mon Sep 17 00:00:00 2001
From: Sean Wei <me@sean.taipei>
Date: Mon, 16 Jun 2025 11:47:30 -0400
Subject: [PATCH 1783/2760] MAINTAINERS: update docs file extensions (.txt ->
 .rst)

The documentation tree has been converted to reStructuredText, but
two entries in MAINTAINERS still point to the removed *.txt files.

This prevents scripts/get_maintainer.pl from matching the documents.

Update those entries to *.rst so the maintainer script works again.

Related commits:
  8472cc5dbe6 (Sep 2023): docs/specs/vmw_pvscsi-spec: Convert to rST
  8e72ceee5cd (Jun 2022): Rename docs/specs/fw_cfg.txt to .rst

Signed-off-by: Sean Wei <me@sean.taipei>
Message-ID: <20250616.qemu.relocated.01@sean.taipei>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 MAINTAINERS | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/MAINTAINERS b/MAINTAINERS
index 7128e0bc98..749799b0f8 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2541,7 +2541,7 @@ F: hw/net/net_tx_pkt*
 Vmware
 M: Dmitry Fleytman <dmitry.fleytman@gmail.com>
 S: Maintained
-F: docs/specs/vmw_pvscsi-spec.txt
+F: docs/specs/vmw_pvscsi-spec.rst
 F: hw/display/vmware_vga.c
 F: hw/net/vmxnet*
 F: hw/scsi/vmw_pvscsi*
@@ -2746,7 +2746,7 @@ Firmware configuration (fw_cfg)
 M: Philippe Mathieu-Daudé <philmd@linaro.org>
 R: Gerd Hoffmann <kraxel@redhat.com>
 S: Supported
-F: docs/specs/fw_cfg.txt
+F: docs/specs/fw_cfg.rst
 F: hw/nvram/fw_cfg*.c
 F: stubs/fw_cfg.c
 F: include/hw/nvram/fw_cfg.h

From 1ed84eb01f8f202191eb57a1bb4e1ce55f5164cf Mon Sep 17 00:00:00 2001
From: Sean Wei <me@sean.taipei>
Date: Mon, 16 Jun 2025 11:49:30 -0400
Subject: [PATCH 1784/2760] MAINTAINERS: fix vendor capitalization (Vmware ->
 VMware)

"VMware" is the vendor's official spelling.
Adjust the spelling in MAINTAINERS for consistency.

Signed-off-by: Sean Wei <me@sean.taipei>
Message-ID: <20250616.qemu.relocated.03@sean.taipei>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 MAINTAINERS | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/MAINTAINERS b/MAINTAINERS
index 749799b0f8..585f08e709 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2538,7 +2538,7 @@ F: net/eth.c
 F: hw/net/net_rx_pkt*
 F: hw/net/net_tx_pkt*
 
-Vmware
+VMware
 M: Dmitry Fleytman <dmitry.fleytman@gmail.com>
 S: Maintained
 F: docs/specs/vmw_pvscsi-spec.rst

From 8231feef53fb130b276797396749508d4fe1ec03 Mon Sep 17 00:00:00 2001
From: Sean Wei <me@sean.taipei>
Date: Mon, 16 Jun 2025 11:50:10 -0400
Subject: [PATCH 1785/2760] MAINTAINERS: fix VMware filename typo (vwm -> vmw)

The entry for the VMware PVSCSI spec uses "vwm" instead of "vmw",
which does not match any file in the tree.

Correct the path so scripts/get_maintainer.pl can match the file.

Signed-off-by: Sean Wei <me@sean.taipei>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250616.qemu.relocated.04@sean.taipei>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 MAINTAINERS | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/MAINTAINERS b/MAINTAINERS
index 585f08e709..8aa0fd33b7 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2549,7 +2549,7 @@ F: pc-bios/efi-vmxnet3.rom
 F: pc-bios/vgabios-vmware.bin
 F: roms/config.vga-vmware
 F: tests/qtest/vmxnet3-test.c
-F: docs/specs/vwm_pvscsi-spec.rst
+F: docs/specs/vmw_pvscsi-spec.rst
 
 Rocker
 M: Jiri Pirko <jiri@resnulli.us>

From e06cd791381383c6fa6041ad0758a86c5b1509e6 Mon Sep 17 00:00:00 2001
From: Sean Wei <me@sean.taipei>
Date: Mon, 16 Jun 2025 11:50:50 -0400
Subject: [PATCH 1786/2760] treewide: update docs file extensions (.txt ->
 .rst) in comments

Several source comments still refer to docs with the old .txt
extension that were previously converted to reStructuredText.

Update these references to use the correct .rst extensions to
maintain accurate in-tree documentation pointers.

No functional changes.

Related commits:
  50f8174c5c1 (Jul 2021): docs/specs/acpi_nvdimm: Convert to rST
  f054eb1c920 (Jul 2021): docs/specs/acpi_pci_hotplug: Convert to rST
  912fb3678b8 (Sep 2023): docs/specs/vmgenid: Convert to rST
  bb1cff6ee04 (Sep 2023): docs/specs/ivshmem-spec: Convert to rST
  55ff468f781 (Jan 2022): docs: Rename ppc-spapr-hotplug.txt to .rst

Signed-off-by: Sean Wei <me@sean.taipei>
Message-ID: <20250616.qemu.relocated.05@sean.taipei>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 hw/acpi/nvdimm.c               | 2 +-
 hw/acpi/pcihp.c                | 2 +-
 hw/acpi/vmgenid.c              | 6 +++---
 hw/misc/ivshmem-flat.c         | 2 +-
 hw/ppc/spapr.c                 | 2 +-
 include/hw/acpi/pcihp.h        | 2 +-
 include/hw/misc/ivshmem-flat.h | 2 +-
 tests/qtest/vmgenid-test.c     | 2 +-
 8 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/hw/acpi/nvdimm.c b/hw/acpi/nvdimm.c
index 9ba90806f2..732d613ac0 100644
--- a/hw/acpi/nvdimm.c
+++ b/hw/acpi/nvdimm.c
@@ -535,7 +535,7 @@ nvdimm_dsm_no_payload(uint32_t func_ret_status, hwaddr dsm_mem_addr)
 
 #define NVDIMM_QEMU_RSVD_HANDLE_ROOT         0x10000
 
-/* Read FIT data, defined in docs/specs/acpi_nvdimm.txt. */
+/* Read FIT data, defined in docs/specs/acpi_nvdimm.rst. */
 static void nvdimm_dsm_func_read_fit(NVDIMMState *state, NvdimmDsmIn *in,
                                      hwaddr dsm_mem_addr)
 {
diff --git a/hw/acpi/pcihp.c b/hw/acpi/pcihp.c
index aac90013d4..497281ae20 100644
--- a/hw/acpi/pcihp.c
+++ b/hw/acpi/pcihp.c
@@ -3,7 +3,7 @@
  *
  * QEMU supports PCI hotplug via ACPI. This module
  * implements the interface between QEMU and the ACPI BIOS.
- * Interface specification - see docs/specs/acpi_pci_hotplug.txt
+ * Interface specification - see docs/specs/acpi_pci_hotplug.rst
  *
  * Copyright (c) 2013, Red Hat Inc, Michael S. Tsirkin (mst@redhat.com)
  * Copyright (c) 2006 Fabrice Bellard
diff --git a/hw/acpi/vmgenid.c b/hw/acpi/vmgenid.c
index fac3d6d97e..33c35c85dd 100644
--- a/hw/acpi/vmgenid.c
+++ b/hw/acpi/vmgenid.c
@@ -38,7 +38,7 @@ void vmgenid_build_acpi(VmGenIdState *vms, GArray *table_data, GArray *guid,
     guid_le = qemu_uuid_bswap(vms->guid);
     /* The GUID is written at a fixed offset into the fw_cfg file
      * in order to implement the "OVMF SDT Header probe suppressor"
-     * see docs/specs/vmgenid.txt for more details
+     * see docs/specs/vmgenid.rst for more details
      */
     g_array_insert_vals(guid, VMGENID_GUID_OFFSET, guid_le.data,
                         ARRAY_SIZE(guid_le.data));
@@ -101,7 +101,7 @@ void vmgenid_build_acpi(VmGenIdState *vms, GArray *table_data, GArray *guid,
      * < 4GB, but write 64 bits anyway.
      * The address that is patched in is offset in order to implement
      * the "OVMF SDT Header probe suppressor"
-     * see docs/specs/vmgenid.txt for more details.
+     * see docs/specs/vmgenid.rst for more details.
      */
     bios_linker_loader_write_pointer(linker,
         VMGENID_ADDR_FW_CFG_FILE, 0, sizeof(uint64_t),
@@ -153,7 +153,7 @@ static void vmgenid_update_guest(VmGenIdState *vms)
             guid_le = qemu_uuid_bswap(vms->guid);
             /* The GUID is written at a fixed offset into the fw_cfg file
              * in order to implement the "OVMF SDT Header probe suppressor"
-             * see docs/specs/vmgenid.txt for more details.
+             * see docs/specs/vmgenid.rst for more details.
              */
             cpu_physical_memory_write(vmgenid_addr, guid_le.data,
                                       sizeof(guid_le.data));
diff --git a/hw/misc/ivshmem-flat.c b/hw/misc/ivshmem-flat.c
index be28c24d73..fe4be6be17 100644
--- a/hw/misc/ivshmem-flat.c
+++ b/hw/misc/ivshmem-flat.c
@@ -362,7 +362,7 @@ static bool ivshmem_flat_connect_server(DeviceState *dev, Error **errp)
      *
      *  ivshmem_flat_recv_msg() calls return 'msg' and 'fd'.
      *
-     *  See ./docs/specs/ivshmem-spec.txt for details on the protocol.
+     *  See docs/specs/ivshmem-spec.rst for details on the protocol.
      */
 
     /* Step 0 */
diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index 702f774cda..08615f6c90 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -577,7 +577,7 @@ static int spapr_dt_dynamic_memory(SpaprMachineState *spapr, void *fdt,
 
 /*
  * Adds ibm,dynamic-reconfiguration-memory node.
- * Refer to docs/specs/ppc-spapr-hotplug.txt for the documentation
+ * Refer to docs/specs/ppc-spapr-hotplug.rst for the documentation
  * of this device tree node.
  */
 static int spapr_dt_dynamic_reconfiguration_memory(SpaprMachineState *spapr,
diff --git a/include/hw/acpi/pcihp.h b/include/hw/acpi/pcihp.h
index a97904bada..cdc0cb8e43 100644
--- a/include/hw/acpi/pcihp.h
+++ b/include/hw/acpi/pcihp.h
@@ -3,7 +3,7 @@
  *
  * QEMU supports PCI hotplug via ACPI. This module
  * implements the interface between QEMU and the ACPI BIOS.
- * Interface specification - see docs/specs/acpi_pci_hotplug.txt
+ * Interface specification - see docs/specs/acpi_pci_hotplug.rst
  *
  * Copyright (c) 2013, Red Hat Inc, Michael S. Tsirkin (mst@redhat.com)
  * Copyright (c) 2006 Fabrice Bellard
diff --git a/include/hw/misc/ivshmem-flat.h b/include/hw/misc/ivshmem-flat.h
index 09bc3abcad..3eca99004e 100644
--- a/include/hw/misc/ivshmem-flat.h
+++ b/include/hw/misc/ivshmem-flat.h
@@ -36,7 +36,7 @@ typedef struct IvshmemFTState IvshmemFTState;
 
 DECLARE_INSTANCE_CHECKER(IvshmemFTState, IVSHMEM_FLAT, TYPE_IVSHMEM_FLAT)
 
-/* Ivshmem registers. See ./docs/specs/ivshmem-spec.txt for details. */
+/* Ivshmem registers. See docs/specs/ivshmem-spec.rst for details. */
 enum ivshmem_registers {
     INTMASK = 0,
     INTSTATUS = 4,
diff --git a/tests/qtest/vmgenid-test.c b/tests/qtest/vmgenid-test.c
index e613374665..33e96b7c55 100644
--- a/tests/qtest/vmgenid-test.c
+++ b/tests/qtest/vmgenid-test.c
@@ -61,7 +61,7 @@ static uint32_t acpi_find_vgia(QTestState *qts)
 
             /* The GUID is written at a fixed offset into the fw_cfg file
              * in order to implement the "OVMF SDT Header probe suppressor"
-             * see docs/specs/vmgenid.txt for more details
+             * see docs/specs/vmgenid.rst for more details
              */
             guid_offset = le32_to_cpu(vgia_val) + VMGENID_GUID_OFFSET;
             g_free(table_aml);

From c95b08106b4b47d511a91a1c41e79681588bef59 Mon Sep 17 00:00:00 2001
From: Sean Wei <me@sean.taipei>
Date: Mon, 16 Jun 2025 11:51:30 -0400
Subject: [PATCH 1787/2760] treewide: fix paths for relocated files in comments

After the docs directory restructuring, several comments
refer to paths that no longer exist.

Replace these references to the current file locations
so readers can find the correct files.

Related commits
---------------

  189c099f75f (Jul 2021)
    docs: collect the disparate device emulation docs into one section
    Rename  docs/system/{ => devices}/nvme.rst

  5f4c96b779f (Feb 2023)
    docs/system/loongarch: update loongson3.rst and rename it to virt.rst
    Rename  docs/system/loongarch/{loongson3.rst => virt.rst}

  fe0007f3c1d (Sep 2023)
    exec: Rename cpu.c -> cpu-target.c
    Rename  cpus-common.c => cpu-common.c

  42fa9665e59 (Apr 2025)
    exec: Restrict 'cpu_ldst.h' to accel/tcg/
    Rename  include/{exec/cpu_ldst.h => accel/tcg/cpu-ldst.h}

Signed-off-by: Sean Wei <me@sean.taipei>
Message-ID: <20250616.qemu.relocated.06@sean.taipei>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 docs/spin/tcg-exclusive.promela | 4 ++--
 hw/nvme/ctrl.c                  | 2 +-
 target/arm/cpu.c                | 2 +-
 target/loongarch/README         | 2 +-
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/docs/spin/tcg-exclusive.promela b/docs/spin/tcg-exclusive.promela
index c91cfca9f7..1d03af850b 100644
--- a/docs/spin/tcg-exclusive.promela
+++ b/docs/spin/tcg-exclusive.promela
@@ -1,6 +1,6 @@
 /*
  * This model describes the implementation of exclusive sections in
- * cpus-common.c (start_exclusive, end_exclusive, cpu_exec_start,
+ * cpu-common.c (start_exclusive, end_exclusive, cpu_exec_start,
  * cpu_exec_end).
  *
  * Author: Paolo Bonzini <pbonzini@redhat.com>
@@ -65,7 +65,7 @@
                              }
 #define COND_BROADCAST(c)    c++
 
-// this is the logic from cpus-common.c
+// this is the logic from cpu-common.c
 
 mutex_t mutex;
 cond_t exclusive_cond;
diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c
index 220002830d..e764ec7683 100644
--- a/hw/nvme/ctrl.c
+++ b/hw/nvme/ctrl.c
@@ -22,7 +22,7 @@
  *
  * Usage
  * -----
- * See docs/system/nvme.rst for extensive documentation.
+ * See docs/system/devices/nvme.rst for extensive documentation.
  *
  * Add options:
  *      -drive file=<file>,if=none,id=<drive_id>
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index a59a5b57af..ebac86f70d 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -2644,7 +2644,7 @@ static const char *arm_gdb_get_core_xml_file(CPUState *cs)
  * linux syscall TIF_TAGGED_ADDR setting, not TBI in general.
  *
  * There should be a better place to put this, but we need this in
- * include/exec/cpu_ldst.h, and not some place linux-user specific.
+ * include/accel/tcg/cpu-ldst.h, and not some place linux-user specific.
  *
  * Note that arm-*-user will never set tagged_addr_enable.
  */
diff --git a/target/loongarch/README b/target/loongarch/README
index 0b9dc0d40a..1ffd3422d2 100644
--- a/target/loongarch/README
+++ b/target/loongarch/README
@@ -11,7 +11,7 @@
 
 - System emulation
 
-  You can reference docs/system/loongarch/loongson3.rst to get the information about system emulation of LoongArch.
+  You can reference docs/system/loongarch/virt.rst to get the information about system emulation of LoongArch.
 
 - Linux-user emulation
 

From c6198abbb1ed80036f42523d885e1682b0bd9987 Mon Sep 17 00:00:00 2001
From: Sean Wei <me@sean.taipei>
Date: Tue, 1 Jul 2025 14:06:32 -0400
Subject: [PATCH 1788/2760] MAINTAINERS: fix paths for relocated files

Several files were renamed in previous commits, causing their entries
in MAINTAINERS to reference outdated paths.
This prevents scripts/get_maintainer.pl from correctly matching
these files to their maintainers.

Update the filenames to reflect their current locations so that
maintainer lookup works properly.

Related commits
---------------

  c45460decbd (Oct 2023)
    hw/input/stellaris_input: Rename to stellaris_gamepad
    Rename  include/hw/input/{gamepad.h => stellaris_gamepad.h}

  4faf359accb (Nov 2020)
    docs: Move virtio-net-failover.rst into the system manual
    Rename  docs/{ => system}/virtio-net-failover.rst

  89857312f32 (Apr 2024)
    hw/usb: move stubs out of stubs/
    Rename  stubs/usb-dev-stub.c => hw/usb/bus-stub.c

  f2604d8508a (Apr 2024)
    hw/virtio: move stubs out of stubs/
    Rename  stubs/virtio-md-pci.c => hw/virtio/virtio-md-stubs.c

  2c888febdfa (Apr 2024)
    memory-device: move stubs out of stubs/
    Rename  stubs/memory_device.c => hw/mem/memory-device-stubs.c

  d481cec7565 (Oct 2024)
    migration: Move cpu-throttle.c from system to migration
    Rename  {system => migration}/cpu-throttle.c

  864a3fa4392 (Jan 2023)
    monitor: Rename misc.c to hmp-target.c
    Rename  monitor/{misc.c => hmp-target.c}

Signed-off-by: Sean Wei <me@sean.taipei>
Message-ID: <374597a7-94e4-45b2-9617-35183db3ea9d@sean.taipei>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 MAINTAINERS | 15 ++++++---------
 1 file changed, 6 insertions(+), 9 deletions(-)

diff --git a/MAINTAINERS b/MAINTAINERS
index 8aa0fd33b7..a36f97ed00 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1007,7 +1007,7 @@ L: qemu-arm@nongnu.org
 S: Odd Fixes
 F: hw/*/stellaris*
 F: hw/display/ssd03*
-F: include/hw/input/gamepad.h
+F: include/hw/input/stellaris_gamepad.h
 F: include/hw/timer/stellaris-gptm.h
 F: docs/system/arm/stellaris.rst
 F: tests/functional/test_arm_stellaris.py
@@ -2173,7 +2173,7 @@ F: hw/net/
 F: include/hw/net/
 F: tests/qtest/virtio-net-test.c
 F: tests/functional/test_info_usernet.py
-F: docs/virtio-net-failover.rst
+F: docs/system/virtio-net-failover.rst
 T: git https://github.com/jasowang/qemu.git net
 
 Parallel NOR Flash devices
@@ -2224,7 +2224,6 @@ F: tests/qtest/sdhci-test.c
 USB
 S: Orphan
 F: hw/usb/*
-F: stubs/usb-dev-stub.c
 F: tests/qtest/usb-*-test.c
 F: docs/system/devices/usb.rst
 F: include/hw/usb.h
@@ -2477,9 +2476,8 @@ S: Supported
 F: hw/s390x/virtio-ccw-md.c
 F: hw/s390x/virtio-ccw-md.h
 F: hw/s390x/virtio-ccw-md-stubs.c
-F: hw/virtio/virtio-md-pci.c
+F: hw/virtio/virtio-md-*.c
 F: include/hw/virtio/virtio-md-pci.h
-F: stubs/virtio-md-pci.c
 
 virtio-mem
 M: David Hildenbrand <david@redhat.com>
@@ -3197,13 +3195,12 @@ M: David Hildenbrand <david@redhat.com>
 M: Igor Mammedov <imammedo@redhat.com>
 R: Xiao Guangrong <xiaoguangrong.eric@gmail.com>
 S: Supported
-F: hw/mem/memory-device.c
+F: hw/mem/memory-device*.c
 F: hw/mem/nvdimm.c
 F: hw/mem/pc-dimm.c
 F: include/hw/mem/memory-device.h
 F: include/hw/mem/nvdimm.h
 F: include/hw/mem/pc-dimm.h
-F: stubs/memory_device.c
 F: docs/nvdimm.txt
 
 SPICE
@@ -3244,9 +3241,9 @@ F: util/qemu-timer*.c
 F: system/vl.c
 F: system/main.c
 F: system/cpus.c
-F: system/cpu-throttle.c
 F: system/cpu-timers.c
 F: system/runstate*
+F: migration/cpu-throttle.c
 F: qapi/run-state.json
 
 Read, Copy, Update (RCU)
@@ -3265,7 +3262,7 @@ Human Monitor (HMP)
 M: Dr. David Alan Gilbert <dave@treblig.org>
 S: Maintained
 F: monitor/monitor-internal.h
-F: monitor/misc.c
+F: monitor/hmp-target.c
 F: monitor/monitor.c
 F: monitor/hmp*
 F: hmp.h

From 27aa790376c9b111f872445a17d660db5e881911 Mon Sep 17 00:00:00 2001
From: Collin Walling <walling@linux.ibm.com>
Date: Sun, 29 Jun 2025 22:44:04 -0400
Subject: [PATCH 1789/2760] target/s390x: set has_deprecated_props flag
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Now that the deprecated_props is an optional field, the expansion method
must now set the "has_deprecated_props" flag in order for the data to be
output from the response.

Fixes: 448553bb7c (qapi: Make CpuModelExpansionInfo::deprecated-props optional and generic)
Signed-off-by: Collin Walling <walling@linux.ibm.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250630024404.940882-1-walling@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 target/s390x/cpu_models_system.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/target/s390x/cpu_models_system.c b/target/s390x/cpu_models_system.c
index 9d84faa3c9..5b84604867 100644
--- a/target/s390x/cpu_models_system.c
+++ b/target/s390x/cpu_models_system.c
@@ -252,6 +252,9 @@ CpuModelExpansionInfo *qmp_query_cpu_model_expansion(CpuModelExpansionType type,
 
     s390_feat_bitmap_to_ascii(deprecated_feats,
                               &expansion_info->deprecated_props, list_add_feat);
+
+    expansion_info->has_deprecated_props = !!expansion_info->deprecated_props;
+
     return expansion_info;
 }
 

From 10d4365c9e161d363e21182b0613bdbe7cee538e Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Tue, 1 Jul 2025 21:42:41 +0200
Subject: [PATCH 1790/2760] target/s390x: A fix for the trouble with tribles
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

While Tribbles are cute, it should be "triple store" here,
not "trible store".

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250701194241.434183-1-thuth@redhat.com>
---
 target/s390x/cpu_features_def.h.inc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/s390x/cpu_features_def.h.inc b/target/s390x/cpu_features_def.h.inc
index e23e603a79..c017bffcdc 100644
--- a/target/s390x/cpu_features_def.h.inc
+++ b/target/s390x/cpu_features_def.h.inc
@@ -186,7 +186,7 @@ DEF_FEAT(PLO_CSO, "plo-cso", PLO, 25, "PLO Compare and swap (256 bit in paramete
 DEF_FEAT(PLO_DCSO, "plo-dcso", PLO, 26, "PLO Double compare and swap (256 bit in parameter list)")
 DEF_FEAT(PLO_CSSTO, "plo-cssto", PLO, 27, "PLO Compare and swap and store (256 bit in parameter list)")
 DEF_FEAT(PLO_CSDSTO, "plo-csdsto", PLO, 28, "PLO Compare and swap and double store (256 bit in parameter list)")
-DEF_FEAT(PLO_CSTSTO, "plo-cststo", PLO, 29, "PLO Compare and swap and trible store (256 bit in parameter list)")
+DEF_FEAT(PLO_CSTSTO, "plo-cststo", PLO, 29, "PLO Compare and swap and triple store (256 bit in parameter list)")
 DEF_FEAT(PLO_TCS, "plo-tcs", PLO, 30, "Triple compare and swap (32 bit in parameter list)")
 DEF_FEAT(PLO_TCSG, "plo-tcsg", PLO, 31, "Triple compare and swap (64 bit in parameter list)")
 DEF_FEAT(PLO_TCSX, "plo-tcsx", PLO, 32, "Triple compare and swap (128 bit in parameter list)")

From 01e2b1bc27bae874bfeb6978ce093deac5bb9639 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Tue, 1 Jul 2025 12:58:09 +0200
Subject: [PATCH 1791/2760] tests/functional/test_aarch64_sbsaref_freebsd: Fix
 the URL of the ISO image

The original image has been removed from the server, so the test
currently fails if it has to fetch the asset, but we can still
download the ISO from the archive server. While we're at it, prefer
the XZ compressed image, it's much smaller and thus the download
should be faster.

Message-ID: <20250701105809.366180-1-thuth@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/functional/test_aarch64_sbsaref_freebsd.py | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/tests/functional/test_aarch64_sbsaref_freebsd.py b/tests/functional/test_aarch64_sbsaref_freebsd.py
index 3cddc082f3..7ef016fba6 100755
--- a/tests/functional/test_aarch64_sbsaref_freebsd.py
+++ b/tests/functional/test_aarch64_sbsaref_freebsd.py
@@ -18,9 +18,9 @@ from test_aarch64_sbsaref import fetch_firmware
 class Aarch64SbsarefFreeBSD(QemuSystemTest):
 
     ASSET_FREEBSD_ISO = Asset(
-        ('https://download.freebsd.org/releases/arm64/aarch64/ISO-IMAGES/'
-         '14.1/FreeBSD-14.1-RELEASE-arm64-aarch64-bootonly.iso'),
-        '44cdbae275ef1bb6dab1d5fbb59473d4f741e1c8ea8a80fd9e906b531d6ad461')
+        ('http://ftp-archive.freebsd.org/pub/FreeBSD-Archive/old-releases/arm64'
+         '/aarch64/ISO-IMAGES/14.1/FreeBSD-14.1-RELEASE-arm64-aarch64-bootonly.iso.xz'),
+        '7313a4495ffd71ab77b49b1e83f571521c32756e1d75bf48bd890e0ab0f75827')
 
     # This tests the whole boot chain from EFI to Userspace
     # We only boot a whole OS for the current top level CPU and GIC
@@ -29,7 +29,7 @@ class Aarch64SbsarefFreeBSD(QemuSystemTest):
         self.set_machine('sbsa-ref')
 
         fetch_firmware(self)
-        img_path = self.ASSET_FREEBSD_ISO.fetch()
+        img_path = self.uncompress(self.ASSET_FREEBSD_ISO)
 
         self.vm.set_console()
         self.vm.add_args(

From 51ac481bff88723ef4c101925082fab03bba200a Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Wed, 18 Jun 2025 16:00:04 +0800
Subject: [PATCH 1792/2760] hw/misc/aspeed_sdmc: Skipping dram_init in u-boot
 for AST2700
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

On AST2700 SoC, QEMU now sets BIT6 in VGA0 SCRATCH register to indicate
that DDR training has completed, thus skipping the dram_init().

To align with the recent U-Boot changes, where the Main Control Register's
BIT16 is checked to skip the dram_init() process, this patch sets BIT16 in
the SDMC Main Control Register at reset time.

This allows both the main U-Boot stage to correctly detect and bypass DRAM
initialization when running under QEMU.

Reference:
- QEMU: https://github.com/qemu/qemu/commit/2d082fea485ee455a70ed3e963cdf9a70f34858a
- U-Boot: https://github.com/AspeedTech-BMC/u-boot/commit/94e5435504fb0d8888f5c1bfd3fa284cdd6aaf9b

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250618080006.846355-2-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/misc/aspeed_sdmc.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/hw/misc/aspeed_sdmc.c b/hw/misc/aspeed_sdmc.c
index f04d9930dd..dff7cc362d 100644
--- a/hw/misc/aspeed_sdmc.c
+++ b/hw/misc/aspeed_sdmc.c
@@ -570,6 +570,9 @@ static void aspeed_2700_sdmc_reset(DeviceState *dev)
     /* Set ram size bit and defaults values */
     s->regs[R_MAIN_CONF] = asc->compute_conf(s, 0);
 
+    /* Skipping dram init */
+    s->regs[R_MAIN_CONTROL] = BIT(16);
+
     if (s->unlocked) {
         s->regs[R_2700_PROT] = PROT_UNLOCKED;
     }

From a6ca5dfccc2b584d2f7bf31fb488fc178e967972 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Wed, 18 Jun 2025 16:00:05 +0800
Subject: [PATCH 1793/2760] hw/misc/aspeed_scu: Support the Frequency Counter
 Control register for AST2700
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

According to the datasheet:
BIT[1] (SCU_FREQ_OSC_EN) enables the oscillator frequency measurement counter.
BIT[6] (SCU_FREQ_DONE) indicates the measurement is finished.
Firmware polls BIT[6] to determine when measurement is complete.
The flag can be cleared by writing BIT[1] to 0.

To simulate this hardware behavior in QEMU:
If BIT[1] is set to 1, BIT[6] is immediately set to 1 to avoid
firmware hanging during polling.
If BIT[1] is cleared to 0, BIT[6] is also cleared to 0 to match
hardware semantics.

The initial value of this register is initialized to 0x80, reflecting the
default value confirmed from an EVB register dump.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250618080006.846355-3-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/misc/aspeed_scu.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/hw/misc/aspeed_scu.c b/hw/misc/aspeed_scu.c
index 4930e00fed..11d0739108 100644
--- a/hw/misc/aspeed_scu.c
+++ b/hw/misc/aspeed_scu.c
@@ -176,6 +176,7 @@
 #define AST2700_SCUIO_UARTCLK_GEN       TO_REG(0x330)
 #define AST2700_SCUIO_HUARTCLK_GEN      TO_REG(0x334)
 #define AST2700_SCUIO_CLK_DUTY_MEAS_RST TO_REG(0x388)
+#define AST2700_SCUIO_FREQ_CNT_CTL      TO_REG(0x3A0)
 
 #define SCU_IO_REGION_SIZE 0x1000
 
@@ -1022,6 +1023,10 @@ static void aspeed_ast2700_scuio_write(void *opaque, hwaddr offset,
         s->regs[reg - 1] ^= data;
         updated = true;
         break;
+    case AST2700_SCUIO_FREQ_CNT_CTL:
+        s->regs[reg] = deposit32(s->regs[reg], 6, 1, !!(data & BIT(1)));
+        updated = true;
+        break;
     default:
         qemu_log_mask(LOG_GUEST_ERROR,
                       "%s: Unhandled write at offset 0x%" HWADDR_PRIx "\n",
@@ -1066,6 +1071,7 @@ static const uint32_t ast2700_a0_resets_io[ASPEED_AST2700_SCU_NR_REGS] = {
     [AST2700_SCUIO_UARTCLK_GEN]         = 0x00014506,
     [AST2700_SCUIO_HUARTCLK_GEN]        = 0x000145c0,
     [AST2700_SCUIO_CLK_DUTY_MEAS_RST]   = 0x0c9100d2,
+    [AST2700_SCUIO_FREQ_CNT_CTL]        = 0x00000080,
 };
 
 static void aspeed_2700_scuio_class_init(ObjectClass *klass, const void *data)

From 126c56b067d6a68840542f8dc7afdec9b69caa83 Mon Sep 17 00:00:00 2001
From: Patrick Williams <patrick@stwcx.xyz>
Date: Wed, 18 Jun 2025 23:58:50 -0400
Subject: [PATCH 1794/2760] hw/arm/aspeed: bletchley: update hw strap values
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Update the Bletchley hardware strap register values
per actual hardware:
```
root@bmc:~# devmem 0x1e6e2500
0x00002000
root@bmc:~# devmem 0x1e6e2510
0x00000801
```

Signed-off-by: Patrick Williams <patrick@stwcx.xyz>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250619035850.2682690-1-patrick@stwcx.xyz
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index d0b333646e..5662cb2c4a 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -197,9 +197,8 @@ struct AspeedMachineState {
 #define FUJI_BMC_HW_STRAP2    0x00000000
 
 /* Bletchley hardware value */
-/* TODO: Leave same as EVB for now. */
-#define BLETCHLEY_BMC_HW_STRAP1 AST2600_EVB_HW_STRAP1
-#define BLETCHLEY_BMC_HW_STRAP2 AST2600_EVB_HW_STRAP2
+#define BLETCHLEY_BMC_HW_STRAP1 0x00002000
+#define BLETCHLEY_BMC_HW_STRAP2 0x00000801
 
 /* Qualcomm DC-SCM hardware value */
 #define QCOM_DC_SCM_V1_BMC_HW_STRAP1  0x00000000

From 8e076a3f1b1ed0fc009ee25796e45c44b4cf74f9 Mon Sep 17 00:00:00 2001
From: Patrick Williams <patrick@stwcx.xyz>
Date: Thu, 19 Jun 2025 11:14:58 -0400
Subject: [PATCH 1795/2760] hw/arm/aspeed: add Catalina machine type
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add the 'catalina-bmc' machine type based on the kernel DTS[1] as of
6.16-rc2.  The i2c model is as complete as the current QEMU models
support, but in some cases I substituted devices that are close enough
for present functionality.  Strap registers are were verified with
hardware.

This has been tested with an openbmc image built from [2].

Add a functional test in line with Bletchley, pointing at an image
obtained from the OpenBMC Jenkins server.

[1]: https://github.com/torvalds/linux/blob/v6.16-rc2/arch/arm/boot/dts/aspeed/aspeed-bmc-facebook-catalina.dts
[2]: https://github.com/openbmc/openbmc/commit/5bc73ec261f981d5e586bda5ac78eb0cbd5f92b0

Signed-off-by: Patrick Williams <patrick@stwcx.xyz>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250619151458.2831859-1-patrick@stwcx.xyz
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/Kconfig                               |   1 +
 hw/arm/aspeed.c                              | 200 +++++++++++++++++++
 tests/functional/meson.build                 |   2 +
 tests/functional/test_arm_aspeed_catalina.py |  25 +++
 4 files changed, 228 insertions(+)
 create mode 100755 tests/functional/test_arm_aspeed_catalina.py

diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
index f543d944c3..6ea86534d5 100644
--- a/hw/arm/Kconfig
+++ b/hw/arm/Kconfig
@@ -532,6 +532,7 @@ config ASPEED_SOC
     select I2C
     select DPS310
     select PCA9552
+    select PCA9554
     select SERIAL_MM
     select SMBUS_EEPROM
     select PCA954X
diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index 5662cb2c4a..94897505f8 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -19,6 +19,7 @@
 #include "hw/i2c/i2c_mux_pca954x.h"
 #include "hw/i2c/smbus_eeprom.h"
 #include "hw/gpio/pca9552.h"
+#include "hw/gpio/pca9554.h"
 #include "hw/nvram/eeprom_at24c.h"
 #include "hw/sensor/tmp105.h"
 #include "hw/misc/led.h"
@@ -1002,6 +1003,180 @@ static void fuji_bmc_i2c_init(AspeedMachineState *bmc)
 }
 
 #define TYPE_TMP421 "tmp421"
+#define TYPE_DS1338 "ds1338"
+
+/* Catalina hardware value */
+#define CATALINA_BMC_HW_STRAP1 0x00002002
+#define CATALINA_BMC_HW_STRAP2 0x00000800
+
+#define CATALINA_BMC_RAM_SIZE ASPEED_RAM_SIZE(2 * GiB)
+
+static void catalina_bmc_i2c_init(AspeedMachineState *bmc)
+{
+    /* Reference from v6.16-rc2 aspeed-bmc-facebook-catalina.dts */
+
+    AspeedSoCState *soc = bmc->soc;
+    I2CBus *i2c[16] = {};
+    I2CSlave *i2c_mux;
+
+    /* busses 0-15 are all used. */
+    for (int i = 0; i < ARRAY_SIZE(i2c); i++) {
+        i2c[i] = aspeed_i2c_get_bus(&soc->i2c, i);
+    }
+
+    /* &i2c0 */
+    /* i2c-mux@71 (PCA9546) on i2c0 */
+    i2c_slave_create_simple(i2c[0], TYPE_PCA9546, 0x71);
+
+    /* i2c-mux@72 (PCA9546) on i2c0 */
+    i2c_mux = i2c_slave_create_simple(i2c[0], TYPE_PCA9546, 0x72);
+
+    /* i2c0mux1ch1 */
+    /* io_expander7 - pca9535@20 */
+    i2c_slave_create_simple(pca954x_i2c_get_bus(i2c_mux, 1),
+                            TYPE_PCA9552, 0x20);
+    /* eeprom@50 */
+    at24c_eeprom_init(pca954x_i2c_get_bus(i2c_mux, 1), 0x50, 8 * KiB);
+
+    /* i2c-mux@73 (PCA9546) on i2c0 */
+    i2c_slave_create_simple(i2c[0], TYPE_PCA9546, 0x73);
+
+    /* i2c-mux@75 (PCA9546) on i2c0 */
+    i2c_slave_create_simple(i2c[0], TYPE_PCA9546, 0x75);
+
+    /* i2c-mux@76 (PCA9546) on i2c0 */
+    i2c_mux = i2c_slave_create_simple(i2c[0], TYPE_PCA9546, 0x76);
+
+    /* i2c0mux4ch1 */
+    /* io_expander8 - pca9535@21 */
+    i2c_slave_create_simple(pca954x_i2c_get_bus(i2c_mux, 1),
+                            TYPE_PCA9552, 0x21);
+    /* eeprom@50 */
+    at24c_eeprom_init(pca954x_i2c_get_bus(i2c_mux, 1), 0x50, 8 * KiB);
+
+    /* i2c-mux@77 (PCA9546) on i2c0 */
+    i2c_slave_create_simple(i2c[0], TYPE_PCA9546, 0x77);
+
+
+    /* &i2c1 */
+    /* i2c-mux@70 (PCA9548) on i2c1 */
+    i2c_mux = i2c_slave_create_simple(i2c[1], TYPE_PCA9548, 0x70);
+    /* i2c1mux0ch0 */
+    /* ina238@41 - no model */
+    /* ina238@42 - no model */
+    /* ina238@44 - no model */
+    /* i2c1mux0ch1 */
+    /* ina238@41 - no model */
+    /* ina238@43 - no model */
+    /* i2c1mux0ch4 */
+    /* ltc4287@42 - no model */
+    /* ltc4287@43 - no model */
+
+    /* i2c1mux0ch5 */
+    /* eeprom@54 */
+    at24c_eeprom_init(pca954x_i2c_get_bus(i2c_mux, 5), 0x54, 8 * KiB);
+    /* tpm75@4f */
+    i2c_slave_create_simple(pca954x_i2c_get_bus(i2c_mux, 5), TYPE_TMP75, 0x4f);
+
+    /* i2c1mux0ch6 */
+    /* io_expander5 - pca9554@27 */
+    i2c_slave_create_simple(pca954x_i2c_get_bus(i2c_mux, 6),
+                            TYPE_PCA9554, 0x27);
+    /* io_expander6 - pca9555@25 */
+    i2c_slave_create_simple(pca954x_i2c_get_bus(i2c_mux, 6),
+                            TYPE_PCA9552, 0x25);
+    /* eeprom@51 */
+    at24c_eeprom_init(pca954x_i2c_get_bus(i2c_mux, 6), 0x51, 8 * KiB);
+
+    /* i2c1mux0ch7 */
+    /* eeprom@53 */
+    at24c_eeprom_init(pca954x_i2c_get_bus(i2c_mux, 7), 0x53, 8 * KiB);
+    /* temperature-sensor@4b - tmp75 */
+    i2c_slave_create_simple(pca954x_i2c_get_bus(i2c_mux, 7), TYPE_TMP75, 0x4b);
+
+    /* &i2c2 */
+    /* io_expander0 - pca9555@20 */
+    i2c_slave_create_simple(i2c[2], TYPE_PCA9552, 0x20);
+    /* io_expander0 - pca9555@21 */
+    i2c_slave_create_simple(i2c[2], TYPE_PCA9552, 0x21);
+    /* io_expander0 - pca9555@27 */
+    i2c_slave_create_simple(i2c[2], TYPE_PCA9552, 0x27);
+    /* eeprom@50 */
+    at24c_eeprom_init(i2c[2], 0x50, 8 * KiB);
+    /* eeprom@51 */
+    at24c_eeprom_init(i2c[2], 0x51, 8 * KiB);
+
+    /* &i2c5 */
+    /* i2c-mux@70 (PCA9548) on i2c5 */
+    i2c_mux = i2c_slave_create_simple(i2c[5], TYPE_PCA9548, 0x70);
+    /* i2c5mux0ch6 */
+    /* eeprom@52 */
+    at24c_eeprom_init(pca954x_i2c_get_bus(i2c_mux, 6), 0x52, 8 * KiB);
+    /* i2c5mux0ch7 */
+    /* ina230@40 - no model */
+    /* ina230@41 - no model */
+    /* ina230@44 - no model */
+    /* ina230@45 - no model */
+
+    /* &i2c6 */
+    /* io_expander3 - pca9555@21 */
+    i2c_slave_create_simple(i2c[6], TYPE_PCA9552, 0x21);
+    /* rtc@6f - nct3018y */
+    i2c_slave_create_simple(i2c[6], TYPE_DS1338, 0x6f);
+
+    /* &i2c9 */
+    /* io_expander4 - pca9555@4f */
+    i2c_slave_create_simple(i2c[9], TYPE_PCA9552, 0x4f);
+    /* temperature-sensor@4b - tpm75 */
+    i2c_slave_create_simple(i2c[9], TYPE_TMP75, 0x4b);
+    /* eeprom@50 */
+    at24c_eeprom_init(i2c[9], 0x50, 8 * KiB);
+    /* eeprom@56 */
+    at24c_eeprom_init(i2c[9], 0x56, 8 * KiB);
+
+    /* &i2c10 */
+    /* temperature-sensor@1f - tpm421 */
+    i2c_slave_create_simple(i2c[10], TYPE_TMP421, 0x1f);
+    /* eeprom@50 */
+    at24c_eeprom_init(i2c[10], 0x50, 8 * KiB);
+
+    /* &i2c11 */
+    /* ssif-bmc@10 - no model */
+
+    /* &i2c12 */
+    /* eeprom@50 */
+    at24c_eeprom_init(i2c[12], 0x50, 8 * KiB);
+
+    /* &i2c13 */
+    /* eeprom@50 */
+    at24c_eeprom_init(i2c[13], 0x50, 8 * KiB);
+    /* eeprom@54 */
+    at24c_eeprom_init(i2c[13], 0x54, 256);
+    /* eeprom@55 */
+    at24c_eeprom_init(i2c[13], 0x55, 256);
+    /* eeprom@57 */
+    at24c_eeprom_init(i2c[13], 0x57, 256);
+
+    /* &i2c14 */
+    /* io_expander9 - pca9555@10 */
+    i2c_slave_create_simple(i2c[14], TYPE_PCA9552, 0x10);
+    /* io_expander10 - pca9555@11 */
+    i2c_slave_create_simple(i2c[14], TYPE_PCA9552, 0x11);
+    /* io_expander11 - pca9555@12 */
+    i2c_slave_create_simple(i2c[14], TYPE_PCA9552, 0x12);
+    /* io_expander12 - pca9555@13 */
+    i2c_slave_create_simple(i2c[14], TYPE_PCA9552, 0x13);
+    /* io_expander13 - pca9555@14 */
+    i2c_slave_create_simple(i2c[14], TYPE_PCA9552, 0x14);
+    /* io_expander14 - pca9555@15 */
+    i2c_slave_create_simple(i2c[14], TYPE_PCA9552, 0x15);
+
+    /* &i2c15 */
+    /* temperature-sensor@1f - tmp421 */
+    i2c_slave_create_simple(i2c[15], TYPE_TMP421, 0x1f);
+    /* eeprom@52 */
+    at24c_eeprom_init(i2c[15], 0x52, 8 * KiB);
+}
 
 static void bletchley_bmc_i2c_init(AspeedMachineState *bmc)
 {
@@ -1584,6 +1759,27 @@ static void aspeed_machine_bletchley_class_init(ObjectClass *oc,
     aspeed_machine_class_init_cpus_defaults(mc);
 }
 
+static void aspeed_machine_catalina_class_init(ObjectClass *oc,
+                                               const void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
+
+    mc->desc       = "Facebook Catalina BMC (Cortex-A7)";
+    amc->soc_name  = "ast2600-a3";
+    amc->hw_strap1 = CATALINA_BMC_HW_STRAP1;
+    amc->hw_strap2 = CATALINA_BMC_HW_STRAP2;
+    amc->fmc_model = "w25q01jvq";
+    amc->spi_model = NULL;
+    amc->num_cs    = 2;
+    amc->macs_mask = ASPEED_MAC2_ON;
+    amc->i2c_init  = catalina_bmc_i2c_init;
+    mc->auto_create_sdcard = true;
+    mc->default_ram_size = CATALINA_BMC_RAM_SIZE;
+    aspeed_machine_class_init_cpus_defaults(mc);
+    aspeed_machine_ast2600_class_emmc_init(oc);
+}
+
 static void fby35_reset(MachineState *state, ResetType type)
 {
     AspeedMachineState *bmc = ASPEED_MACHINE(state);
@@ -1876,6 +2072,10 @@ static const TypeInfo aspeed_machine_types[] = {
         .name          = MACHINE_TYPE_NAME("bletchley-bmc"),
         .parent        = TYPE_ASPEED_MACHINE,
         .class_init    = aspeed_machine_bletchley_class_init,
+    }, {
+        .name          = MACHINE_TYPE_NAME("catalina-bmc"),
+        .parent        = TYPE_ASPEED_MACHINE,
+        .class_init    = aspeed_machine_catalina_class_init,
     }, {
         .name          = MACHINE_TYPE_NAME("fby35-bmc"),
         .parent        = MACHINE_TYPE_NAME("ast2600-evb"),
diff --git a/tests/functional/meson.build b/tests/functional/meson.build
index b542b3a3af..fb87b957aa 100644
--- a/tests/functional/meson.build
+++ b/tests/functional/meson.build
@@ -32,6 +32,7 @@ test_timeouts = {
   'arm_aspeed_ast2500' : 720,
   'arm_aspeed_ast2600' : 1200,
   'arm_aspeed_bletchley' : 480,
+  'arm_aspeed_catalina' : 480,
   'arm_aspeed_rainier' : 480,
   'arm_bpim2u' : 500,
   'arm_collie' : 180,
@@ -127,6 +128,7 @@ tests_arm_system_thorough = [
   'arm_aspeed_ast2500',
   'arm_aspeed_ast2600',
   'arm_aspeed_bletchley',
+  'arm_aspeed_catalina',
   'arm_aspeed_rainier',
   'arm_bpim2u',
   'arm_canona1100',
diff --git a/tests/functional/test_arm_aspeed_catalina.py b/tests/functional/test_arm_aspeed_catalina.py
new file mode 100755
index 0000000000..dc2f24e7b4
--- /dev/null
+++ b/tests/functional/test_arm_aspeed_catalina.py
@@ -0,0 +1,25 @@
+#!/usr/bin/env python3
+#
+# Functional test that boots the ASPEED machines
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+from qemu_test import Asset
+from aspeed import AspeedTest
+
+
+class CatalinaMachine(AspeedTest):
+
+    ASSET_CATALINA_FLASH = Asset(
+        'https://github.com/legoater/qemu-aspeed-boot/raw/a866feb5ef81245b4827a214584bf6bcc72939f6/images/catalina-bmc/obmc-phosphor-image-catalina-20250619123021.static.mtd.xz',
+        '287402e1ba021991e06be1d098f509444a02a3d81a73a932f66528b159e864f9')
+
+    def test_arm_ast2600_catalina_openbmc(self):
+        image_path = self.uncompress(self.ASSET_CATALINA_FLASH)
+
+        self.do_test_arm_aspeed_openbmc('catalina-bmc', image=image_path,
+                                        uboot='2019.04', cpu_id='0xf00',
+                                        soc='AST2600 rev A3')
+
+if __name__ == '__main__':
+    AspeedTest.main()

From 10d1b6231b7fdbeb9c601af35f73c6353cbfe6c8 Mon Sep 17 00:00:00 2001
From: Tan Siewert <tan@siewert.io>
Date: Thu, 19 Jun 2025 10:53:27 +0200
Subject: [PATCH 1796/2760] hw/misc/aspeed_scu: Handle AST2600 protection key
 registers correctly
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The AST2600 SCU has two protection key registers (0x00 and 0x10) that
both need to be unlocked. (Un-)locking 0x00 modifies both protection key
registers, while modifying 0x10 only modifies itself.

This commit updates the SCU write logic to reject writes unless both
protection key registers are unlocked, matching the behaviour of
real hardware.

Signed-off-by: Tan Siewert <tan@siewert.io>
Reviewed-by: Jamin Lin <jamin_lin@aspeedtech.com>
Link: https://lore.kernel.org/qemu-devel/20250619085329.42125-1-tan@siewert.io
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/misc/aspeed_scu.c | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/hw/misc/aspeed_scu.c b/hw/misc/aspeed_scu.c
index 11d0739108..a0ab5eed8f 100644
--- a/hw/misc/aspeed_scu.c
+++ b/hw/misc/aspeed_scu.c
@@ -91,6 +91,7 @@
 #define BMC_DEV_ID           TO_REG(0x1A4)
 
 #define AST2600_PROT_KEY          TO_REG(0x00)
+#define AST2600_PROT_KEY2         TO_REG(0x10)
 #define AST2600_SILICON_REV       TO_REG(0x04)
 #define AST2600_SILICON_REV2      TO_REG(0x14)
 #define AST2600_SYS_RST_CTRL      TO_REG(0x40)
@@ -723,6 +724,8 @@ static void aspeed_ast2600_scu_write(void *opaque, hwaddr offset,
     int reg = TO_REG(offset);
     /* Truncate here so bitwise operations below behave as expected */
     uint32_t data = data64;
+    bool prot_data_state = data == ASPEED_SCU_PROT_KEY;
+    bool unlocked = s->regs[AST2600_PROT_KEY] && s->regs[AST2600_PROT_KEY2];
 
     if (reg >= ASPEED_AST2600_SCU_NR_REGS) {
         qemu_log_mask(LOG_GUEST_ERROR,
@@ -731,15 +734,24 @@ static void aspeed_ast2600_scu_write(void *opaque, hwaddr offset,
         return;
     }
 
-    if (reg > PROT_KEY && !s->regs[PROT_KEY]) {
+    if ((reg != AST2600_PROT_KEY && reg != AST2600_PROT_KEY2) && !unlocked) {
         qemu_log_mask(LOG_GUEST_ERROR, "%s: SCU is locked!\n", __func__);
+        return;
     }
 
     trace_aspeed_scu_write(offset, size, data);
 
     switch (reg) {
     case AST2600_PROT_KEY:
-        s->regs[reg] = (data == ASPEED_SCU_PROT_KEY) ? 1 : 0;
+        /*
+         * Writing a value to SCU000 will modify both protection
+         * registers to each protection register individually.
+         */
+        s->regs[AST2600_PROT_KEY] = prot_data_state;
+        s->regs[AST2600_PROT_KEY2] = prot_data_state;
+        return;
+    case AST2600_PROT_KEY2:
+        s->regs[AST2600_PROT_KEY2] = prot_data_state;
         return;
     case AST2600_HW_STRAP1:
     case AST2600_HW_STRAP2:

From 116bf243d9137a9101aa1a403b402b78313615bc Mon Sep 17 00:00:00 2001
From: Tan Siewert <tan@siewert.io>
Date: Mon, 30 Jun 2025 13:26:46 +0200
Subject: [PATCH 1797/2760] tests/qtest: Add test for ASPEED SCU
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This adds basic tests for the ASPEED System Control Unit (SCU) and its
protection mechanism on the AST2500 and AST2600 platforms.

The tests verify:
  - That SCU protection registers can be unlocked and locked again
  - That modifying the primary protection register on AST2600 also
    affects the secondary one
  - That writes to protected SCU registers are blocked unless
    protection registers are unlocked explicitly

These tests ensure proper emulation of hardware locking behaviour
and help catch regressions in SCU access logic.

Signed-off-by: Tan Siewert <tan@siewert.io>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250630112646.74944-1-tan@siewert.io
[ clg: Reordered file list in meson.build ]
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 tests/qtest/aspeed_scu-test.c | 231 ++++++++++++++++++++++++++++++++++
 tests/qtest/meson.build       |   1 +
 2 files changed, 232 insertions(+)
 create mode 100644 tests/qtest/aspeed_scu-test.c

diff --git a/tests/qtest/aspeed_scu-test.c b/tests/qtest/aspeed_scu-test.c
new file mode 100644
index 0000000000..ca09f9171f
--- /dev/null
+++ b/tests/qtest/aspeed_scu-test.c
@@ -0,0 +1,231 @@
+/*
+ * QTest testcase for the ASPEED AST2500 and AST2600 SCU.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ * Copyright (C) 2025 Tan Siewert
+ */
+
+#include "qemu/osdep.h"
+#include "libqtest-single.h"
+
+/*
+ * SCU base, as well as protection key are
+ * the same on AST2500 and 2600.
+ */
+#define AST_SCU_BASE                    0x1E6E2000
+#define AST_SCU_PROT_LOCK_STATE         0x0
+#define AST_SCU_PROT_LOCK_VALUE         0x2
+#define AST_SCU_PROT_UNLOCK_STATE       0x1
+#define AST_SCU_PROT_UNLOCK_VALUE       0x1688A8A8
+
+#define AST2500_MACHINE                 "-machine ast2500-evb"
+#define AST2500_SCU_PROT_REG            0x00
+#define AST2500_SCU_MISC_2_CONTROL_REG  0x4C
+
+#define AST2600_MACHINE                 "-machine ast2600-evb"
+/* AST2600 has two protection registers */
+#define AST2600_SCU_PROT_REG            0x000
+#define AST2600_SCU_PROT_REG2           0x010
+#define AST2600_SCU_MISC_2_CONTROL_REG  0x0C4
+
+#define TEST_LOCK_ARBITRARY_VALUE       0xABCDEFAB
+
+/**
+ * Assert that a given register matches an expected value.
+ *
+ * Reads the register and checks if its value equals the expected value.
+ *
+ * @param *s - QTest machine state
+ * @param reg - Address of the register to be checked
+ * @param expected - Expected register value
+ */
+static inline void assert_register_eq(QTestState *s,
+                                      uint32_t reg,
+                                      uint32_t expected)
+{
+    uint32_t value = qtest_readl(s, reg);
+    g_assert_cmphex(value, ==, expected);
+}
+
+/**
+ * Assert that a given register does not match a specific value.
+ *
+ * Reads the register and checks that its value is not equal to the
+ * provided value.
+ *
+ * @param *s - QTest machine state
+ * @param reg - Address of the register to be checked
+ * @param not_expected - Value the register must not contain
+ */
+static inline void assert_register_neq(QTestState *s,
+                                       uint32_t reg,
+                                       uint32_t not_expected)
+{
+    uint32_t value = qtest_readl(s, reg);
+    g_assert_cmphex(value, !=, not_expected);
+}
+
+/**
+ * Test whether the SCU can be locked and unlocked correctly.
+ *
+ * When testing multiple registers, this function assumes that writing
+ * to the first register also affects the others. However, writing to
+ * any other register only affects itself.
+ *
+ * @param *machine - input machine configuration, passed directly
+ *                   to QTest
+ * @param regs[] - List of registers to be checked
+ * @param regc - amount of arguments for registers to be checked
+ */
+static void test_protection_register(const char *machine,
+                                     const uint32_t regs[],
+                                     const int regc)
+{
+    QTestState *s = qtest_init(machine);
+
+    for (int i = 0; i < regc; i++) {
+        uint32_t reg = regs[i];
+
+        qtest_writel(s, reg, AST_SCU_PROT_UNLOCK_VALUE);
+        assert_register_eq(s, reg, AST_SCU_PROT_UNLOCK_STATE);
+
+        /**
+         * Check that other registers are unlocked too, if more
+         * than one is available.
+         */
+        if (regc > 1 && i == 0) {
+            /* Initialise at 1 instead of 0 to skip first */
+            for (int j = 1; j < regc; j++) {
+                uint32_t add_reg = regs[j];
+                assert_register_eq(s, add_reg, AST_SCU_PROT_UNLOCK_STATE);
+            }
+        }
+
+        /* Lock the register again */
+        qtest_writel(s, reg, AST_SCU_PROT_LOCK_VALUE);
+        assert_register_eq(s, reg, AST_SCU_PROT_LOCK_STATE);
+
+        /* And the same for locked state */
+        if (regc > 1 && i == 0) {
+            /* Initialise at 1 instead of 0 to skip first */
+            for (int j = 1; j < regc; j++) {
+                uint32_t add_reg = regs[j];
+                assert_register_eq(s, add_reg, AST_SCU_PROT_LOCK_STATE);
+            }
+        }
+    }
+
+    qtest_quit(s);
+}
+
+static void test_2500_protection_register(void)
+{
+    uint32_t regs[] = { AST_SCU_BASE + AST2500_SCU_PROT_REG };
+
+    test_protection_register(AST2500_MACHINE,
+                             regs,
+                             ARRAY_SIZE(regs));
+}
+
+static void test_2600_protection_register(void)
+{
+    /**
+     * The AST2600 has two protection registers, both
+     * being required to be unlocked to do any operation.
+     *
+     * Modifying SCU000 also modifies SCU010, but modifying
+     * SCU010 only will keep SCU000 untouched.
+     */
+    uint32_t regs[] = { AST_SCU_BASE + AST2600_SCU_PROT_REG,
+                        AST_SCU_BASE + AST2600_SCU_PROT_REG2 };
+
+    test_protection_register(AST2600_MACHINE,
+                             regs,
+                             ARRAY_SIZE(regs));
+}
+
+/**
+ * Test if SCU register writes are correctly allowed or blocked
+ * depending on the protection register state.
+ *
+ * The test first locks the protection register and verifies that
+ * writes to the target SCU register are rejected. It then unlocks
+ * the protection register and confirms that the written value is
+ * retained when unlocked.
+ *
+ * @param *machine - input machine configuration, passed directly
+ *                   to QTest
+ * @param protection_register - first SCU protection key register
+ *                              (only one for keeping it simple)
+ * @param test_register - Register to be used for writing arbitrary
+ *                        values
+ */
+static void test_write_permission_lock_state(const char *machine,
+                                             const uint32_t protection_register,
+                                             const uint32_t test_register)
+{
+    QTestState *s = qtest_init(machine);
+
+    /* Arbitrary value to lock provided SCU protection register */
+    qtest_writel(s, protection_register, AST_SCU_PROT_LOCK_VALUE);
+
+    /* Ensure that the SCU is really locked */
+    assert_register_eq(s, protection_register, AST_SCU_PROT_LOCK_STATE);
+
+    /* Write a known arbitrary value to test that the write is blocked */
+    qtest_writel(s, test_register, TEST_LOCK_ARBITRARY_VALUE);
+
+    /* We do not want to have the written value to be saved */
+    assert_register_neq(s, test_register, TEST_LOCK_ARBITRARY_VALUE);
+
+    /**
+     * Unlock the SCU and verify that it can be written to.
+     * Assumes that the first SCU protection register is sufficient to
+     * unlock all protection registers, if multiple are present.
+     */
+    qtest_writel(s, protection_register, AST_SCU_PROT_UNLOCK_VALUE);
+    assert_register_eq(s, protection_register, AST_SCU_PROT_UNLOCK_STATE);
+
+    /* Write a known arbitrary value to test that the write works */
+    qtest_writel(s, test_register, TEST_LOCK_ARBITRARY_VALUE);
+
+    /* Ensure that the written value is retained */
+    assert_register_eq(s, test_register, TEST_LOCK_ARBITRARY_VALUE);
+
+    qtest_quit(s);
+}
+
+static void test_2500_write_permission_lock_state(void)
+{
+    test_write_permission_lock_state(
+            AST2500_MACHINE,
+            AST_SCU_BASE + AST2500_SCU_PROT_REG,
+            AST_SCU_BASE + AST2500_SCU_MISC_2_CONTROL_REG
+    );
+}
+
+static void test_2600_write_permission_lock_state(void)
+{
+    test_write_permission_lock_state(
+            AST2600_MACHINE,
+            AST_SCU_BASE + AST2600_SCU_PROT_REG,
+            AST_SCU_BASE + AST2600_SCU_MISC_2_CONTROL_REG
+    );
+}
+
+int main(int argc, char **argv)
+{
+    g_test_init(&argc, &argv, NULL);
+
+    qtest_add_func("/ast2500/scu/protection_register",
+                   test_2500_protection_register);
+    qtest_add_func("/ast2600/scu/protection_register",
+                   test_2600_protection_register);
+
+    qtest_add_func("/ast2500/scu/write_permission_lock_state",
+                   test_2500_write_permission_lock_state);
+    qtest_add_func("/ast2600/scu/write_permission_lock_state",
+                   test_2600_write_permission_lock_state);
+
+    return g_test_run();
+}
diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
index 8ad849054f..91b4a71a18 100644
--- a/tests/qtest/meson.build
+++ b/tests/qtest/meson.build
@@ -215,6 +215,7 @@ qtests_npcm8xx = \
 qtests_aspeed = \
   ['aspeed_gpio-test',
    'aspeed_hace-test',
+   'aspeed_scu-test',
    'aspeed_smc-test']
 qtests_aspeed64 = \
   ['ast2700-gpio-test',

From e8c1128bf982f2e5f7c9ca6c1de632feec3d9e94 Mon Sep 17 00:00:00 2001
From: Zhenzhong Duan <zhenzhong.duan@intel.com>
Date: Fri, 27 Jun 2025 14:33:31 +0800
Subject: [PATCH 1798/2760] vfio/container: Fix potential SIGSEGV when recover
 from unmap-all-vaddr failure
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

CPR overrides then restores dma_map in both outgoing and incoming QEMU, for
different reasons. But it only sets saved_dma_map in the target.

Fix it by always setting saved_dma_map.

Fixes: eba1f657cbb1 ("vfio/container: recover from unmap-all-vaddr failure")
Suggested-by: Steven Sistare <steven.sistare@oracle.com>
Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: Steve Sistare <steven.sistare@oracle.com>
Link: https://lore.kernel.org/qemu-devel/20250627063332.5173-2-zhenzhong.duan@intel.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/cpr-legacy.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/vfio/cpr-legacy.c b/hw/vfio/cpr-legacy.c
index a84c3247b7..0a5d1bd480 100644
--- a/hw/vfio/cpr-legacy.c
+++ b/hw/vfio/cpr-legacy.c
@@ -180,9 +180,9 @@ bool vfio_legacy_cpr_register_container(VFIOContainer *container, Error **errp)
     vmstate_register(NULL, -1, &vfio_container_vmstate, container);
 
     /* During incoming CPR, divert calls to dma_map. */
+    VFIOIOMMUClass *vioc = VFIO_IOMMU_GET_CLASS(bcontainer);
+    container->cpr.saved_dma_map = vioc->dma_map;
     if (cpr_is_incoming()) {
-        VFIOIOMMUClass *vioc = VFIO_IOMMU_GET_CLASS(bcontainer);
-        container->cpr.saved_dma_map = vioc->dma_map;
         vioc->dma_map = vfio_legacy_cpr_dma_map;
     }
 

From 924c3ccb310e615bd350d4c77b269b19d95bf5e4 Mon Sep 17 00:00:00 2001
From: Zhenzhong Duan <zhenzhong.duan@intel.com>
Date: Fri, 27 Jun 2025 14:33:32 +0800
Subject: [PATCH 1799/2760] vfio/container: Fix vfio_container_post_load()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When there are multiple VFIO containers, vioc->dma_map is restored
multiple times, this made only first container work and remaining
containers using vioc->dma_map restored by first container.

Fix it by save and restore vioc->dma_map locally. saved_dma_map in
VFIOContainerCPR becomes useless and is removed.

Fixes: 7e9f21411302 ("vfio/container: restore DMA vaddr")
Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: Steve Sistare <steven.sistare@oracle.com>
Link: https://lore.kernel.org/qemu-devel/20250627063332.5173-3-zhenzhong.duan@intel.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/cpr-legacy.c       | 23 +++++++++--------------
 include/hw/vfio/vfio-cpr.h |  7 ++++---
 2 files changed, 13 insertions(+), 17 deletions(-)

diff --git a/hw/vfio/cpr-legacy.c b/hw/vfio/cpr-legacy.c
index 0a5d1bd480..1216717546 100644
--- a/hw/vfio/cpr-legacy.c
+++ b/hw/vfio/cpr-legacy.c
@@ -99,20 +99,21 @@ static int vfio_container_post_load(void *opaque, int version_id)
 {
     VFIOContainer *container = opaque;
     VFIOContainerBase *bcontainer = &container->bcontainer;
-    VFIOGroup *group;
+    VFIOIOMMUClass *vioc = VFIO_IOMMU_GET_CLASS(bcontainer);
+    dma_map_fn saved_dma_map = vioc->dma_map;
     Error *local_err = NULL;
 
+    /* During incoming CPR, divert calls to dma_map. */
+    vioc->dma_map = vfio_legacy_cpr_dma_map;
+
     if (!vfio_listener_register(bcontainer, &local_err)) {
         error_report_err(local_err);
         return -1;
     }
 
-    QLIST_FOREACH(group, &container->group_list, container_next) {
-        VFIOIOMMUClass *vioc = VFIO_IOMMU_GET_CLASS(bcontainer);
+    /* Restore original dma_map function */
+    vioc->dma_map = saved_dma_map;
 
-        /* Restore original dma_map function */
-        vioc->dma_map = container->cpr.saved_dma_map;
-    }
     return 0;
 }
 
@@ -148,6 +149,7 @@ static int vfio_cpr_fail_notifier(NotifierWithReturn *notifier,
          */
 
         VFIOIOMMUClass *vioc = VFIO_IOMMU_GET_CLASS(bcontainer);
+        dma_map_fn saved_dma_map = vioc->dma_map;
         vioc->dma_map = vfio_legacy_cpr_dma_map;
 
         container->cpr.remap_listener = (MemoryListener) {
@@ -158,7 +160,7 @@ static int vfio_cpr_fail_notifier(NotifierWithReturn *notifier,
                                  bcontainer->space->as);
         memory_listener_unregister(&container->cpr.remap_listener);
         container->cpr.vaddr_unmapped = false;
-        vioc->dma_map = container->cpr.saved_dma_map;
+        vioc->dma_map = saved_dma_map;
     }
     return 0;
 }
@@ -179,13 +181,6 @@ bool vfio_legacy_cpr_register_container(VFIOContainer *container, Error **errp)
 
     vmstate_register(NULL, -1, &vfio_container_vmstate, container);
 
-    /* During incoming CPR, divert calls to dma_map. */
-    VFIOIOMMUClass *vioc = VFIO_IOMMU_GET_CLASS(bcontainer);
-    container->cpr.saved_dma_map = vioc->dma_map;
-    if (cpr_is_incoming()) {
-        vioc->dma_map = vfio_legacy_cpr_dma_map;
-    }
-
     migration_add_notifier_mode(&container->cpr.transfer_notifier,
                                 vfio_cpr_fail_notifier,
                                 MIG_MODE_CPR_TRANSFER);
diff --git a/include/hw/vfio/vfio-cpr.h b/include/hw/vfio/vfio-cpr.h
index 8bf85b9f4e..dbb2a16b7a 100644
--- a/include/hw/vfio/vfio-cpr.h
+++ b/include/hw/vfio/vfio-cpr.h
@@ -16,14 +16,15 @@ struct VFIOContainer;
 struct VFIOContainerBase;
 struct VFIOGroup;
 
+typedef int (*dma_map_fn)(const struct VFIOContainerBase *bcontainer,
+                          hwaddr iova, ram_addr_t size, void *vaddr,
+                          bool readonly, MemoryRegion *mr);
+
 typedef struct VFIOContainerCPR {
     Error *blocker;
     bool vaddr_unmapped;
     NotifierWithReturn transfer_notifier;
     MemoryListener remap_listener;
-    int (*saved_dma_map)(const struct VFIOContainerBase *bcontainer,
-                         hwaddr iova, ram_addr_t size,
-                         void *vaddr, bool readonly, MemoryRegion *mr);
 } VFIOContainerCPR;
 
 typedef struct VFIODeviceCPR {

From f7c5dff26e0128246f5c220b38da51e56a756dbb Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Wed, 2 Jul 2025 12:59:49 +0100
Subject: [PATCH 1800/2760] vfio-user: do not register vfio-user container with
 cpr
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

As the full cpr implementation is yet to be merged upstream, do not register
the vfio-user container with cpr. Full vfio-user support for cpr can be
merged later as a follow-up series.

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Message-ID: <20250702120043.267634-1-mark.caveayland@nutanix.com>
[ clg: Removed now useless "hw/vfio/vfio-cpr.h" include ]
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio-user/container.c | 11 +----------
 1 file changed, 1 insertion(+), 10 deletions(-)

diff --git a/hw/vfio-user/container.c b/hw/vfio-user/container.c
index 3133fef177..d318e6a339 100644
--- a/hw/vfio-user/container.c
+++ b/hw/vfio-user/container.c
@@ -13,7 +13,6 @@
 #include "hw/vfio-user/container.h"
 #include "hw/vfio-user/device.h"
 #include "hw/vfio-user/trace.h"
-#include "hw/vfio/vfio-cpr.h"
 #include "hw/vfio/vfio-device.h"
 #include "hw/vfio/vfio-listener.h"
 #include "qapi/error.h"
@@ -225,14 +224,10 @@ vfio_user_container_connect(AddressSpace *as, VFIODevice *vbasedev,
 
     bcontainer = &container->bcontainer;
 
-    if (!vfio_cpr_register_container(bcontainer, errp)) {
-        goto free_container_exit;
-    }
-
     ret = ram_block_uncoordinated_discard_disable(true);
     if (ret) {
         error_setg_errno(errp, -ret, "Cannot set discarding of RAM broken");
-        goto unregister_container_exit;
+        goto free_container_exit;
     }
 
     vioc = VFIO_IOMMU_GET_CLASS(bcontainer);
@@ -261,9 +256,6 @@ listener_release_exit:
 enable_discards_exit:
     ram_block_uncoordinated_discard_disable(false);
 
-unregister_container_exit:
-    vfio_cpr_unregister_container(bcontainer);
-
 free_container_exit:
     object_unref(container);
 
@@ -286,7 +278,6 @@ static void vfio_user_container_disconnect(VFIOUserContainer *container)
         vioc->release(bcontainer);
     }
 
-    vfio_cpr_unregister_container(bcontainer);
     object_unref(container);
 
     vfio_address_space_put(space);

From 34ea448263a8dad7443bfeaf5eca75e49abc5865 Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Wed, 25 Jun 2025 15:33:10 +0800
Subject: [PATCH 1801/2760] i386/tdx: Build TDX only for 64-bit target
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Build errors related to TDX were reported when QEMU built on 32-bit
host[1][2].

Since TDX cannot work on 32-bit host and it's also not worth supporting
TDX with 32-bit QEMU, limit TDX to 64-bit target only.

[1] https://lore.kernel.org/qemu-devel/20250602173101.1052983-1-clg@redhat.com/
[2] https://lore.kernel.org/qemu-devel/b8171c39-6a92-4078-a59a-a63d7452e1e9@kaod.org/

Suggested-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Tested-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250625073310.2796298-1-xiaoyao.li@intel.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/i386/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/i386/Kconfig b/hw/i386/Kconfig
index eb65bda6e0..14d23e27b5 100644
--- a/hw/i386/Kconfig
+++ b/hw/i386/Kconfig
@@ -13,7 +13,7 @@ config SGX
 config TDX
     bool
     select X86_FW_OVMF
-    depends on KVM
+    depends on KVM && X86_64
 
 config PC
     bool

From 4ba5cdfdf70843d7a74a7cb9704688c4c6957dd6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Mon, 30 Jun 2025 19:23:01 +0200
Subject: [PATCH 1802/2760] b4: Drop linktrailermask
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When grabbing a patch series, the link trailer is replaced with a
Message-ID, which is not useful compared to an URL. Fix that by
dropping the linktrailermask config.

Cc: Philippe Mathieu-Daudé <philmd@linaro.org>
Cc: Jiaxun Yang <jiaxun.yang@flygoat.com>
Fixes: 838cf72b5d2c ("Add a b4 configuration file")
Link: https://lore.kernel.org/qemu-devel/20250630172301.519848-1-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 .b4-config | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.b4-config b/.b4-config
index 4b9b2fe290..126f503ded 100644
--- a/.b4-config
+++ b/.b4-config
@@ -11,4 +11,3 @@
     prep-perpatch-check-cmd = scripts/checkpatch.pl -q --terse --no-summary --mailback -
     searchmask = https://lore.kernel.org/qemu-devel/?x=m&t=1&q=%s
     linkmask = https://lore.kernel.org/qemu-devel/%s
-    linktrailermask = Message-ID: <%s>

From 3f2a36d0ef6339ce78e107959da81f76283582f7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Mon, 30 Jun 2025 19:20:48 +0200
Subject: [PATCH 1803/2760] Makefile: prune quilt source files for cscope
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Both quilt, to apply patches, and cscope, to navigate in the code, are
useful tools. Make sure source files that quilt saves when applying
patches are not taken into account when building the cscope database.

Link: https://lore.kernel.org/qemu-devel/20250630172048.519182-1-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 Makefile | 1 +
 1 file changed, 1 insertion(+)

diff --git a/Makefile b/Makefile
index c92a3cf785..74c2da2037 100644
--- a/Makefile
+++ b/Makefile
@@ -227,6 +227,7 @@ distclean: clean recurse-distclean
 	rm -Rf .sdk qemu-bundle
 
 find-src-path = find "$(SRC_PATH)" -path "$(SRC_PATH)/meson" -prune -o \
+	-path "$(SRC_PATH)/.pc" -prune -o \
 	-type l -prune -o \( -name "*.[chsS]" -o -name "*.[ch].inc" \)
 
 .PHONY: ctags

From 30edcb4d4e7a265c2912ca6978b150c7c75b654f Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Wed, 2 Jul 2025 14:58:38 -0700
Subject: [PATCH 1804/2760] vfio-pci: preserve MSI
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Save the MSI message area as part of vfio-pci vmstate, and preserve the
interrupt and notifier eventfd's.  migrate_incoming loads the MSI data,
then the vfio-pci post_load handler finds the eventfds in CPR state,
rebuilds vector data structures, and attaches the interrupts to the new
KVM instance.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/1751493538-202042-2-git-send-email-steven.sistare@oracle.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/cpr.c              | 97 ++++++++++++++++++++++++++++++++++++++
 hw/vfio/pci.c              | 52 +++++++++++++++++++-
 hw/vfio/pci.h              |  2 +
 include/hw/vfio/vfio-cpr.h |  8 ++++
 4 files changed, 157 insertions(+), 2 deletions(-)

diff --git a/hw/vfio/cpr.c b/hw/vfio/cpr.c
index fdbb58e203..e467373e8d 100644
--- a/hw/vfio/cpr.c
+++ b/hw/vfio/cpr.c
@@ -9,6 +9,8 @@
 #include "hw/vfio/vfio-device.h"
 #include "hw/vfio/vfio-cpr.h"
 #include "hw/vfio/pci.h"
+#include "hw/pci/msix.h"
+#include "hw/pci/msi.h"
 #include "migration/cpr.h"
 #include "qapi/error.h"
 #include "system/runstate.h"
@@ -40,6 +42,69 @@ void vfio_cpr_unregister_container(VFIOContainerBase *bcontainer)
     migration_remove_notifier(&bcontainer->cpr_reboot_notifier);
 }
 
+#define STRDUP_VECTOR_FD_NAME(vdev, name)   \
+    g_strdup_printf("%s_%s", (vdev)->vbasedev.name, (name))
+
+void vfio_cpr_save_vector_fd(VFIOPCIDevice *vdev, const char *name, int nr,
+                             int fd)
+{
+    g_autofree char *fdname = STRDUP_VECTOR_FD_NAME(vdev, name);
+    cpr_save_fd(fdname, nr, fd);
+}
+
+int vfio_cpr_load_vector_fd(VFIOPCIDevice *vdev, const char *name, int nr)
+{
+    g_autofree char *fdname = STRDUP_VECTOR_FD_NAME(vdev, name);
+    return cpr_find_fd(fdname, nr);
+}
+
+void vfio_cpr_delete_vector_fd(VFIOPCIDevice *vdev, const char *name, int nr)
+{
+    g_autofree char *fdname = STRDUP_VECTOR_FD_NAME(vdev, name);
+    cpr_delete_fd(fdname, nr);
+}
+
+static void vfio_cpr_claim_vectors(VFIOPCIDevice *vdev, int nr_vectors,
+                                   bool msix)
+{
+    int i, fd;
+    bool pending = false;
+    PCIDevice *pdev = &vdev->pdev;
+
+    vdev->nr_vectors = nr_vectors;
+    vdev->msi_vectors = g_new0(VFIOMSIVector, nr_vectors);
+    vdev->interrupt = msix ? VFIO_INT_MSIX : VFIO_INT_MSI;
+
+    vfio_pci_prepare_kvm_msi_virq_batch(vdev);
+
+    for (i = 0; i < nr_vectors; i++) {
+        VFIOMSIVector *vector = &vdev->msi_vectors[i];
+
+        fd = vfio_cpr_load_vector_fd(vdev, "interrupt", i);
+        if (fd >= 0) {
+            vfio_pci_vector_init(vdev, i);
+            vfio_pci_msi_set_handler(vdev, i);
+        }
+
+        if (vfio_cpr_load_vector_fd(vdev, "kvm_interrupt", i) >= 0) {
+            vfio_pci_add_kvm_msi_virq(vdev, vector, i, msix);
+        } else {
+            vdev->msi_vectors[i].virq = -1;
+        }
+
+        if (msix && msix_is_pending(pdev, i) && msix_is_masked(pdev, i)) {
+            set_bit(i, vdev->msix->pending);
+            pending = true;
+        }
+    }
+
+    vfio_pci_commit_kvm_msi_virq_batch(vdev);
+
+    if (msix) {
+        memory_region_set_enabled(&pdev->msix_pba_mmio, pending);
+    }
+}
+
 /*
  * The kernel may change non-emulated config bits.  Exclude them from the
  * changed-bits check in get_pci_config_device.
@@ -58,13 +123,45 @@ static int vfio_cpr_pci_pre_load(void *opaque)
     return 0;
 }
 
+static int vfio_cpr_pci_post_load(void *opaque, int version_id)
+{
+    VFIOPCIDevice *vdev = opaque;
+    PCIDevice *pdev = &vdev->pdev;
+    int nr_vectors;
+
+    if (msix_enabled(pdev)) {
+        vfio_pci_msix_set_notifiers(vdev);
+        nr_vectors = vdev->msix->entries;
+        vfio_cpr_claim_vectors(vdev, nr_vectors, true);
+
+    } else if (msi_enabled(pdev)) {
+        nr_vectors = msi_nr_vectors_allocated(pdev);
+        vfio_cpr_claim_vectors(vdev, nr_vectors, false);
+
+    } else if (vfio_pci_read_config(pdev, PCI_INTERRUPT_PIN, 1)) {
+        g_assert_not_reached();      /* completed in a subsequent patch */
+    }
+
+    return 0;
+}
+
+static bool pci_msix_present(void *opaque, int version_id)
+{
+    PCIDevice *pdev = opaque;
+
+    return msix_present(pdev);
+}
+
 const VMStateDescription vfio_cpr_pci_vmstate = {
     .name = "vfio-cpr-pci",
     .version_id = 0,
     .minimum_version_id = 0,
     .pre_load = vfio_cpr_pci_pre_load,
+    .post_load = vfio_cpr_pci_post_load,
     .needed = cpr_incoming_needed,
     .fields = (VMStateField[]) {
+        VMSTATE_PCI_DEVICE(pdev, VFIOPCIDevice),
+        VMSTATE_MSIX_TEST(pdev, VFIOPCIDevice, pci_msix_present),
         VMSTATE_END_OF_LIST()
     }
 };
diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index fa25bded25..5f9f2640e5 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -29,6 +29,7 @@
 #include "hw/pci/pci_bridge.h"
 #include "hw/qdev-properties.h"
 #include "hw/qdev-properties-system.h"
+#include "hw/vfio/vfio-cpr.h"
 #include "migration/vmstate.h"
 #include "migration/cpr.h"
 #include "qobject/qdict.h"
@@ -57,20 +58,33 @@ static void vfio_disable_interrupts(VFIOPCIDevice *vdev);
 static void vfio_mmap_set_enabled(VFIOPCIDevice *vdev, bool enabled);
 static void vfio_msi_disable_common(VFIOPCIDevice *vdev);
 
+/* Create new or reuse existing eventfd */
 static bool vfio_notifier_init(VFIOPCIDevice *vdev, EventNotifier *e,
                                const char *name, int nr, Error **errp)
 {
-    int ret = event_notifier_init(e, 0);
+    int fd, ret;
 
+    fd = vfio_cpr_load_vector_fd(vdev, name, nr);
+    if (fd >= 0) {
+        event_notifier_init_fd(e, fd);
+        return true;
+    }
+
+    ret = event_notifier_init(e, 0);
     if (ret) {
         error_setg_errno(errp, -ret, "vfio_notifier_init %s failed", name);
+        return false;
     }
-    return !ret;
+
+    fd = event_notifier_get_fd(e);
+    vfio_cpr_save_vector_fd(vdev, name, nr, fd);
+    return true;
 }
 
 static void vfio_notifier_cleanup(VFIOPCIDevice *vdev, EventNotifier *e,
                                   const char *name, int nr)
 {
+    vfio_cpr_delete_vector_fd(vdev, name, nr);
     event_notifier_cleanup(e);
 }
 
@@ -394,6 +408,14 @@ static void vfio_msi_interrupt(void *opaque)
     notify(&vdev->pdev, nr);
 }
 
+void vfio_pci_msi_set_handler(VFIOPCIDevice *vdev, int nr)
+{
+    VFIOMSIVector *vector = &vdev->msi_vectors[nr];
+    int fd = event_notifier_get_fd(&vector->interrupt);
+
+    qemu_set_fd_handler(fd, vfio_msi_interrupt, NULL, vector);
+}
+
 /*
  * Get MSI-X enabled, but no vector enabled, by setting vector 0 with an invalid
  * fd to kernel.
@@ -656,6 +678,15 @@ static int vfio_msix_vector_do_use(PCIDevice *pdev, unsigned int nr,
 static int vfio_msix_vector_use(PCIDevice *pdev,
                                 unsigned int nr, MSIMessage msg)
 {
+    /*
+     * Ignore the callback from msix_set_vector_notifiers during resume.
+     * The necessary subset of these actions is called from
+     * vfio_cpr_claim_vectors during post load.
+     */
+    if (cpr_is_incoming()) {
+        return 0;
+    }
+
     return vfio_msix_vector_do_use(pdev, nr, &msg, vfio_msi_interrupt);
 }
 
@@ -686,6 +717,12 @@ static void vfio_msix_vector_release(PCIDevice *pdev, unsigned int nr)
     }
 }
 
+void vfio_pci_msix_set_notifiers(VFIOPCIDevice *vdev)
+{
+    msix_set_vector_notifiers(&vdev->pdev, vfio_msix_vector_use,
+                              vfio_msix_vector_release, NULL);
+}
+
 void vfio_pci_prepare_kvm_msi_virq_batch(VFIOPCIDevice *vdev)
 {
     assert(!vdev->defer_kvm_irq_routing);
@@ -2965,6 +3002,11 @@ void vfio_pci_register_err_notifier(VFIOPCIDevice *vdev)
     fd = event_notifier_get_fd(&vdev->err_notifier);
     qemu_set_fd_handler(fd, vfio_err_notifier_handler, NULL, vdev);
 
+    /* Do not alter irq_signaling during vfio_realize for cpr */
+    if (cpr_is_incoming()) {
+        return;
+    }
+
     if (!vfio_device_irq_set_signaling(&vdev->vbasedev, VFIO_PCI_ERR_IRQ_INDEX, 0,
                                        VFIO_IRQ_SET_ACTION_TRIGGER, fd, &err)) {
         error_reportf_err(err, VFIO_MSG_PREFIX, vdev->vbasedev.name);
@@ -3032,6 +3074,12 @@ void vfio_pci_register_req_notifier(VFIOPCIDevice *vdev)
     fd = event_notifier_get_fd(&vdev->req_notifier);
     qemu_set_fd_handler(fd, vfio_req_notifier_handler, NULL, vdev);
 
+    /* Do not alter irq_signaling during vfio_realize for cpr */
+    if (cpr_is_incoming()) {
+        vdev->req_enabled = true;
+        return;
+    }
+
     if (!vfio_device_irq_set_signaling(&vdev->vbasedev, VFIO_PCI_REQ_IRQ_INDEX, 0,
                                        VFIO_IRQ_SET_ACTION_TRIGGER, fd, &err)) {
         error_reportf_err(err, VFIO_MSG_PREFIX, vdev->vbasedev.name);
diff --git a/hw/vfio/pci.h b/hw/vfio/pci.h
index 5ba7330b27..495fae737d 100644
--- a/hw/vfio/pci.h
+++ b/hw/vfio/pci.h
@@ -218,6 +218,8 @@ void vfio_pci_add_kvm_msi_virq(VFIOPCIDevice *vdev, VFIOMSIVector *vector,
 void vfio_pci_prepare_kvm_msi_virq_batch(VFIOPCIDevice *vdev);
 void vfio_pci_commit_kvm_msi_virq_batch(VFIOPCIDevice *vdev);
 bool vfio_pci_intx_enable(VFIOPCIDevice *vdev, Error **errp);
+void vfio_pci_msix_set_notifiers(VFIOPCIDevice *vdev);
+void vfio_pci_msi_set_handler(VFIOPCIDevice *vdev, int nr);
 
 uint32_t vfio_pci_read_config(PCIDevice *pdev, uint32_t addr, int len);
 void vfio_pci_write_config(PCIDevice *pdev,
diff --git a/include/hw/vfio/vfio-cpr.h b/include/hw/vfio/vfio-cpr.h
index dbb2a16b7a..f21578da3c 100644
--- a/include/hw/vfio/vfio-cpr.h
+++ b/include/hw/vfio/vfio-cpr.h
@@ -15,6 +15,7 @@
 struct VFIOContainer;
 struct VFIOContainerBase;
 struct VFIOGroup;
+struct VFIOPCIDevice;
 
 typedef int (*dma_map_fn)(const struct VFIOContainerBase *bcontainer,
                           hwaddr iova, ram_addr_t size, void *vaddr,
@@ -53,6 +54,13 @@ void vfio_cpr_giommu_remap(struct VFIOContainerBase *bcontainer,
 bool vfio_cpr_ram_discard_register_listener(
     struct VFIOContainerBase *bcontainer, MemoryRegionSection *section);
 
+void vfio_cpr_save_vector_fd(struct VFIOPCIDevice *vdev, const char *name,
+                             int nr, int fd);
+int vfio_cpr_load_vector_fd(struct VFIOPCIDevice *vdev, const char *name,
+                            int nr);
+void vfio_cpr_delete_vector_fd(struct VFIOPCIDevice *vdev, const char *name,
+                               int nr);
+
 extern const VMStateDescription vfio_cpr_pci_vmstate;
 
 #endif /* HW_VFIO_VFIO_CPR_H */

From 87aeaead5c75448d6e36bf6f9114862c8d523871 Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Wed, 2 Jul 2025 14:58:39 -0700
Subject: [PATCH 1805/2760] vfio-pci: preserve INTx
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Preserve vfio INTx state across cpr-transfer.  Preserve VFIOINTx fields as
follows:
  pin : Recover this from the vfio config in kernel space
  interrupt : Preserve its eventfd descriptor across exec.
  unmask : Ditto
  route.irq : This could perhaps be recovered in vfio_pci_post_load by
    calling pci_device_route_intx_to_irq(pin), whose implementation reads
    config space for a bridge device such as ich9.  However, there is no
    guarantee that the bridge vmstate is read before vfio vmstate.  Rather
    than fiddling with MigrationPriority for vmstate handlers, explicitly
    save route.irq in vfio vmstate.
  pending : save in vfio vmstate.
  mmap_timeout, mmap_timer : Re-initialize
  bool kvm_accel : Re-initialize

In vfio_realize, defer calling vfio_intx_enable until the vmstate
is available, in vfio_pci_post_load.  Modify vfio_intx_enable and
vfio_intx_kvm_enable to skip vfio initialization, but still perform
kvm initialization.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/1751493538-202042-3-git-send-email-steven.sistare@oracle.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/cpr.c | 27 ++++++++++++++++++++++++-
 hw/vfio/pci.c | 55 +++++++++++++++++++++++++++++++++++++++++++++++++--
 2 files changed, 79 insertions(+), 3 deletions(-)

diff --git a/hw/vfio/cpr.c b/hw/vfio/cpr.c
index e467373e8d..f5555cabe7 100644
--- a/hw/vfio/cpr.c
+++ b/hw/vfio/cpr.c
@@ -139,7 +139,11 @@ static int vfio_cpr_pci_post_load(void *opaque, int version_id)
         vfio_cpr_claim_vectors(vdev, nr_vectors, false);
 
     } else if (vfio_pci_read_config(pdev, PCI_INTERRUPT_PIN, 1)) {
-        g_assert_not_reached();      /* completed in a subsequent patch */
+        Error *local_err = NULL;
+        if (!vfio_pci_intx_enable(vdev, &local_err)) {
+            error_report_err(local_err);
+            return -1;
+        }
     }
 
     return 0;
@@ -152,6 +156,26 @@ static bool pci_msix_present(void *opaque, int version_id)
     return msix_present(pdev);
 }
 
+static const VMStateDescription vfio_intx_vmstate = {
+    .name = "vfio-cpr-intx",
+    .version_id = 0,
+    .minimum_version_id = 0,
+    .fields = (VMStateField[]) {
+        VMSTATE_BOOL(pending, VFIOINTx),
+        VMSTATE_UINT32(route.mode, VFIOINTx),
+        VMSTATE_INT32(route.irq, VFIOINTx),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+#define VMSTATE_VFIO_INTX(_field, _state) {                         \
+    .name       = (stringify(_field)),                              \
+    .size       = sizeof(VFIOINTx),                                 \
+    .vmsd       = &vfio_intx_vmstate,                               \
+    .flags      = VMS_STRUCT,                                       \
+    .offset     = vmstate_offset_value(_state, _field, VFIOINTx),   \
+}
+
 const VMStateDescription vfio_cpr_pci_vmstate = {
     .name = "vfio-cpr-pci",
     .version_id = 0,
@@ -162,6 +186,7 @@ const VMStateDescription vfio_cpr_pci_vmstate = {
     .fields = (VMStateField[]) {
         VMSTATE_PCI_DEVICE(pdev, VFIOPCIDevice),
         VMSTATE_MSIX_TEST(pdev, VFIOPCIDevice, pci_msix_present),
+        VMSTATE_VFIO_INTX(intx, VFIOPCIDevice),
         VMSTATE_END_OF_LIST()
     }
 };
diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index 5f9f2640e5..dd0b2a0b94 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -210,6 +210,36 @@ fail:
 #endif
 }
 
+static bool vfio_cpr_intx_enable_kvm(VFIOPCIDevice *vdev, Error **errp)
+{
+#ifdef CONFIG_KVM
+    if (vdev->no_kvm_intx || !kvm_irqfds_enabled() ||
+        vdev->intx.route.mode != PCI_INTX_ENABLED ||
+        !kvm_resamplefds_enabled()) {
+        return true;
+    }
+
+    if (!vfio_notifier_init(vdev, &vdev->intx.unmask, "intx-unmask", 0, errp)) {
+        return false;
+    }
+
+    if (kvm_irqchip_add_irqfd_notifier_gsi(kvm_state,
+                                           &vdev->intx.interrupt,
+                                           &vdev->intx.unmask,
+                                           vdev->intx.route.irq)) {
+        error_setg_errno(errp, errno, "failed to setup resample irqfd");
+        vfio_notifier_cleanup(vdev, &vdev->intx.unmask, "intx-unmask", 0);
+        return false;
+    }
+
+    vdev->intx.kvm_accel = true;
+    trace_vfio_intx_enable_kvm(vdev->vbasedev.name);
+    return true;
+#else
+    return true;
+#endif
+}
+
 static void vfio_intx_disable_kvm(VFIOPCIDevice *vdev)
 {
 #ifdef CONFIG_KVM
@@ -305,7 +335,13 @@ static bool vfio_intx_enable(VFIOPCIDevice *vdev, Error **errp)
         return true;
     }
 
-    vfio_disable_interrupts(vdev);
+    /*
+     * Do not alter interrupt state during vfio_realize and cpr load.
+     * The incoming state is cleared thereafter.
+     */
+    if (!cpr_is_incoming()) {
+        vfio_disable_interrupts(vdev);
+    }
 
     vdev->intx.pin = pin - 1; /* Pin A (1) -> irq[0] */
     pci_config_set_interrupt_pin(vdev->pdev.config, pin);
@@ -328,6 +364,14 @@ static bool vfio_intx_enable(VFIOPCIDevice *vdev, Error **errp)
     fd = event_notifier_get_fd(&vdev->intx.interrupt);
     qemu_set_fd_handler(fd, vfio_intx_interrupt, NULL, vdev);
 
+
+    if (cpr_is_incoming()) {
+        if (!vfio_cpr_intx_enable_kvm(vdev, &err)) {
+            warn_reportf_err(err, VFIO_MSG_PREFIX, vdev->vbasedev.name);
+        }
+        goto skip_signaling;
+    }
+
     if (!vfio_device_irq_set_signaling(&vdev->vbasedev, VFIO_PCI_INTX_IRQ_INDEX, 0,
                                 VFIO_IRQ_SET_ACTION_TRIGGER, fd, errp)) {
         qemu_set_fd_handler(fd, NULL, NULL, vdev);
@@ -339,6 +383,7 @@ static bool vfio_intx_enable(VFIOPCIDevice *vdev, Error **errp)
         warn_reportf_err(err, VFIO_MSG_PREFIX, vdev->vbasedev.name);
     }
 
+skip_signaling:
     vdev->interrupt = VFIO_INT_INTx;
 
     trace_vfio_intx_enable(vdev->vbasedev.name);
@@ -3237,7 +3282,13 @@ bool vfio_pci_interrupt_setup(VFIOPCIDevice *vdev, Error **errp)
                                              vfio_intx_routing_notifier);
         vdev->irqchip_change_notifier.notify = vfio_irqchip_change;
         kvm_irqchip_add_change_notifier(&vdev->irqchip_change_notifier);
-        if (!vfio_intx_enable(vdev, errp)) {
+
+        /*
+         * During CPR, do not call vfio_intx_enable at this time.  Instead,
+         * call it from vfio_pci_post_load after the intx routing data has
+         * been loaded from vmstate.
+         */
+        if (!cpr_is_incoming() && !vfio_intx_enable(vdev, errp)) {
             timer_free(vdev->intx.mmap_timer);
             pci_device_set_intx_routing_notifier(&vdev->pdev, NULL);
             kvm_irqchip_remove_change_notifier(&vdev->irqchip_change_notifier);

From 7ed0919119b0e7a6b7db1dcaca3a2cb30c771dd1 Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Wed, 2 Jul 2025 14:58:40 -0700
Subject: [PATCH 1806/2760] migration: close kvm after cpr
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

cpr-transfer breaks vfio network connectivity to and from the guest, and
the host system log shows:
  irq bypass consumer (token 00000000a03c32e5) registration fails: -16
which is EBUSY.  This occurs because KVM descriptors are still open in
the old QEMU process.  Close them.

Cc: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/qemu-devel/1751493538-202042-4-git-send-email-steven.sistare@oracle.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 accel/kvm/kvm-all.c           | 32 ++++++++++++++++++++++++++++++++
 hw/vfio/cpr-legacy.c          |  2 ++
 hw/vfio/cpr.c                 | 21 +++++++++++++++++++++
 hw/vfio/helpers.c             | 11 +++++++++++
 include/hw/vfio/vfio-cpr.h    |  2 ++
 include/hw/vfio/vfio-device.h |  2 ++
 include/system/kvm.h          |  1 +
 7 files changed, 71 insertions(+)

diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index d095d1b98f..8141854617 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -515,16 +515,23 @@ static int do_kvm_destroy_vcpu(CPUState *cpu)
         goto err;
     }
 
+    /* If I am the CPU that created coalesced_mmio_ring, then discard it */
+    if (s->coalesced_mmio_ring == (void *)cpu->kvm_run + PAGE_SIZE) {
+        s->coalesced_mmio_ring = NULL;
+    }
+
     ret = munmap(cpu->kvm_run, mmap_size);
     if (ret < 0) {
         goto err;
     }
+    cpu->kvm_run = NULL;
 
     if (cpu->kvm_dirty_gfns) {
         ret = munmap(cpu->kvm_dirty_gfns, s->kvm_dirty_ring_bytes);
         if (ret < 0) {
             goto err;
         }
+        cpu->kvm_dirty_gfns = NULL;
     }
 
     kvm_park_vcpu(cpu);
@@ -608,6 +615,31 @@ err:
     return ret;
 }
 
+void kvm_close(void)
+{
+    CPUState *cpu;
+
+    if (!kvm_state || kvm_state->fd == -1) {
+        return;
+    }
+
+    CPU_FOREACH(cpu) {
+        cpu_remove_sync(cpu);
+        close(cpu->kvm_fd);
+        cpu->kvm_fd = -1;
+        close(cpu->kvm_vcpu_stats_fd);
+        cpu->kvm_vcpu_stats_fd = -1;
+    }
+
+    if (kvm_state && kvm_state->fd != -1) {
+        close(kvm_state->vmfd);
+        kvm_state->vmfd = -1;
+        close(kvm_state->fd);
+        kvm_state->fd = -1;
+    }
+    kvm_state = NULL;
+}
+
 /*
  * dirty pages logging control
  */
diff --git a/hw/vfio/cpr-legacy.c b/hw/vfio/cpr-legacy.c
index 1216717546..553b203e9b 100644
--- a/hw/vfio/cpr-legacy.c
+++ b/hw/vfio/cpr-legacy.c
@@ -179,6 +179,8 @@ bool vfio_legacy_cpr_register_container(VFIOContainer *container, Error **errp)
                                          MIG_MODE_CPR_TRANSFER, -1) == 0;
     }
 
+    vfio_cpr_add_kvm_notifier();
+
     vmstate_register(NULL, -1, &vfio_container_vmstate, container);
 
     migration_add_notifier_mode(&container->cpr.transfer_notifier,
diff --git a/hw/vfio/cpr.c b/hw/vfio/cpr.c
index f5555cabe7..0e903cdd2f 100644
--- a/hw/vfio/cpr.c
+++ b/hw/vfio/cpr.c
@@ -190,3 +190,24 @@ const VMStateDescription vfio_cpr_pci_vmstate = {
         VMSTATE_END_OF_LIST()
     }
 };
+
+static NotifierWithReturn kvm_close_notifier;
+
+static int vfio_cpr_kvm_close_notifier(NotifierWithReturn *notifier,
+                                       MigrationEvent *e,
+                                       Error **errp)
+{
+    if (e->type == MIG_EVENT_PRECOPY_DONE) {
+        vfio_kvm_device_close();
+    }
+    return 0;
+}
+
+void vfio_cpr_add_kvm_notifier(void)
+{
+    if (!kvm_close_notifier.notify) {
+        migration_add_notifier_mode(&kvm_close_notifier,
+                                    vfio_cpr_kvm_close_notifier,
+                                    MIG_MODE_CPR_TRANSFER);
+    }
+}
diff --git a/hw/vfio/helpers.c b/hw/vfio/helpers.c
index d0dbab1d17..9a5f621545 100644
--- a/hw/vfio/helpers.c
+++ b/hw/vfio/helpers.c
@@ -117,6 +117,17 @@ bool vfio_get_info_dma_avail(struct vfio_iommu_type1_info *info,
 int vfio_kvm_device_fd = -1;
 #endif
 
+void vfio_kvm_device_close(void)
+{
+#ifdef CONFIG_KVM
+    kvm_close();
+    if (vfio_kvm_device_fd != -1) {
+        close(vfio_kvm_device_fd);
+        vfio_kvm_device_fd = -1;
+    }
+#endif
+}
+
 int vfio_kvm_device_add_fd(int fd, Error **errp)
 {
 #ifdef CONFIG_KVM
diff --git a/include/hw/vfio/vfio-cpr.h b/include/hw/vfio/vfio-cpr.h
index f21578da3c..d37acc4a0a 100644
--- a/include/hw/vfio/vfio-cpr.h
+++ b/include/hw/vfio/vfio-cpr.h
@@ -63,4 +63,6 @@ void vfio_cpr_delete_vector_fd(struct VFIOPCIDevice *vdev, const char *name,
 
 extern const VMStateDescription vfio_cpr_pci_vmstate;
 
+void vfio_cpr_add_kvm_notifier(void);
+
 #endif /* HW_VFIO_VFIO_CPR_H */
diff --git a/include/hw/vfio/vfio-device.h b/include/hw/vfio/vfio-device.h
index c616652ee7..f503837ccc 100644
--- a/include/hw/vfio/vfio-device.h
+++ b/include/hw/vfio/vfio-device.h
@@ -283,4 +283,6 @@ void vfio_device_set_fd(VFIODevice *vbasedev, const char *str, Error **errp);
 void vfio_device_init(VFIODevice *vbasedev, int type, VFIODeviceOps *ops,
                       DeviceState *dev, bool ram_discard);
 int vfio_device_get_aw_bits(VFIODevice *vdev);
+
+void vfio_kvm_device_close(void);
 #endif /* HW_VFIO_VFIO_COMMON_H */
diff --git a/include/system/kvm.h b/include/system/kvm.h
index 7cc60d26f2..4896a3c9c5 100644
--- a/include/system/kvm.h
+++ b/include/system/kvm.h
@@ -195,6 +195,7 @@ bool kvm_has_sync_mmu(void);
 int kvm_has_vcpu_events(void);
 int kvm_max_nested_state_length(void);
 int kvm_has_gsi_routing(void);
+void kvm_close(void);
 
 /**
  * kvm_arm_supports_user_irq

From ccfc6715cf54caafba4c2516af394b4ed979c615 Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Wed, 2 Jul 2025 14:58:41 -0700
Subject: [PATCH 1807/2760] migration: cpr_get_fd_param helper
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add the helper function cpr_get_fd_param, to use when preserving
a file descriptor that is opened externally and passed to QEMU.
cpr_get_fd_param returns a descriptor number either from a QEMU
command-line parameter, from a getfd command, or from CPR state.

When a descriptor is passed to new QEMU via SCM_RIGHTS, its number
changes.  Hence, during CPR, the command-line parameter is ignored
in new QEMU, and over-ridden by the value found in CPR state.

Similarly, if the descriptor was originally specified by a getfd
command in old QEMU, the fd number is not known outside of QEMU,
and it changes when sent to new QEMU via SCM_RIGHTS.  Hence the
user cannot send getfd to new QEMU, but when the user sends a
hotplug command that references the fd, cpr_get_fd_param finds
its value in CPR state.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/qemu-devel/1751493538-202042-5-git-send-email-steven.sistare@oracle.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 include/migration/cpr.h |  2 ++
 migration/cpr.c         | 37 +++++++++++++++++++++++++++++++++++++
 2 files changed, 39 insertions(+)

diff --git a/include/migration/cpr.h b/include/migration/cpr.h
index 07858e93fa..eb27a93301 100644
--- a/include/migration/cpr.h
+++ b/include/migration/cpr.h
@@ -32,6 +32,8 @@ void cpr_state_close(void);
 struct QIOChannel *cpr_state_ioc(void);
 
 bool cpr_incoming_needed(void *opaque);
+int cpr_get_fd_param(const char *name, const char *fdname, int index,
+                     Error **errp);
 
 QEMUFile *cpr_transfer_output(MigrationChannel *channel, Error **errp);
 QEMUFile *cpr_transfer_input(MigrationChannel *channel, Error **errp);
diff --git a/migration/cpr.c b/migration/cpr.c
index a50a57edca..535d587aee 100644
--- a/migration/cpr.c
+++ b/migration/cpr.c
@@ -13,6 +13,7 @@
 #include "migration/qemu-file.h"
 #include "migration/savevm.h"
 #include "migration/vmstate.h"
+#include "monitor/monitor.h"
 #include "system/runstate.h"
 #include "trace.h"
 
@@ -264,3 +265,39 @@ bool cpr_incoming_needed(void *opaque)
     MigMode mode = migrate_mode();
     return mode == MIG_MODE_CPR_TRANSFER;
 }
+
+/*
+ * cpr_get_fd_param: find a descriptor and return its value.
+ *
+ * @name: CPR name for the descriptor
+ * @fdname: An integer-valued string, or a name passed to a getfd command
+ * @index: CPR index of the descriptor
+ * @errp: returned error message
+ *
+ * If CPR is not being performed, then use @fdname to find the fd.
+ * If CPR is being performed, then ignore @fdname, and look for @name
+ * and @index in CPR state.
+ *
+ * On success returns the fd value, else returns -1.
+ */
+int cpr_get_fd_param(const char *name, const char *fdname, int index,
+                     Error **errp)
+{
+    ERRP_GUARD();
+    int fd;
+
+    if (cpr_is_incoming()) {
+        fd = cpr_find_fd(name, index);
+        if (fd < 0) {
+            error_setg(errp, "cannot find saved value for fd %s", fdname);
+        }
+    } else {
+        fd = monitor_fd_param(monitor_cur(), fdname, errp);
+        if (fd >= 0) {
+            cpr_save_fd(name, index, fd);
+        } else {
+            error_prepend(errp, "Could not parse object fd %s:", fdname);
+        }
+    }
+    return fd;
+}

From e563dc88c21915e111ecef0756cc291e9e473c35 Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Wed, 2 Jul 2025 14:58:42 -0700
Subject: [PATCH 1808/2760] backends/iommufd: iommufd_backend_map_file_dma
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Define iommufd_backend_map_file_dma to implement IOMMU_IOAS_MAP_FILE.
This will be called as a substitute for iommufd_backend_map_dma, so
the error conditions for BARs are copied as-is from that function.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Link: https://lore.kernel.org/qemu-devel/1751493538-202042-6-git-send-email-steven.sistare@oracle.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 backends/iommufd.c       | 34 ++++++++++++++++++++++++++++++++++
 backends/trace-events    |  1 +
 include/system/iommufd.h |  3 +++
 3 files changed, 38 insertions(+)

diff --git a/backends/iommufd.c b/backends/iommufd.c
index c2c47abf7e..3a2ecc7f5b 100644
--- a/backends/iommufd.c
+++ b/backends/iommufd.c
@@ -172,6 +172,40 @@ int iommufd_backend_map_dma(IOMMUFDBackend *be, uint32_t ioas_id, hwaddr iova,
     return ret;
 }
 
+int iommufd_backend_map_file_dma(IOMMUFDBackend *be, uint32_t ioas_id,
+                                 hwaddr iova, ram_addr_t size,
+                                 int mfd, unsigned long start, bool readonly)
+{
+    int ret, fd = be->fd;
+    struct iommu_ioas_map_file map = {
+        .size = sizeof(map),
+        .flags = IOMMU_IOAS_MAP_READABLE |
+                 IOMMU_IOAS_MAP_FIXED_IOVA,
+        .ioas_id = ioas_id,
+        .fd = mfd,
+        .start = start,
+        .iova = iova,
+        .length = size,
+    };
+
+    if (!readonly) {
+        map.flags |= IOMMU_IOAS_MAP_WRITEABLE;
+    }
+
+    ret = ioctl(fd, IOMMU_IOAS_MAP_FILE, &map);
+    trace_iommufd_backend_map_file_dma(fd, ioas_id, iova, size, mfd, start,
+                                       readonly, ret);
+    if (ret) {
+        ret = -errno;
+
+        /* TODO: Not support mapping hardware PCI BAR region for now. */
+        if (errno == EFAULT) {
+            warn_report("IOMMU_IOAS_MAP_FILE failed: %m, PCI BAR?");
+        }
+    }
+    return ret;
+}
+
 int iommufd_backend_unmap_dma(IOMMUFDBackend *be, uint32_t ioas_id,
                               hwaddr iova, ram_addr_t size)
 {
diff --git a/backends/trace-events b/backends/trace-events
index 7278214ea5..e5f3e70cd1 100644
--- a/backends/trace-events
+++ b/backends/trace-events
@@ -11,6 +11,7 @@ iommufd_backend_connect(int fd, bool owned, uint32_t users) "fd=%d owned=%d user
 iommufd_backend_disconnect(int fd, uint32_t users) "fd=%d users=%d"
 iommu_backend_set_fd(int fd) "pre-opened /dev/iommu fd=%d"
 iommufd_backend_map_dma(int iommufd, uint32_t ioas, uint64_t iova, uint64_t size, void *vaddr, bool readonly, int ret) " iommufd=%d ioas=%d iova=0x%"PRIx64" size=0x%"PRIx64" addr=%p readonly=%d (%d)"
+iommufd_backend_map_file_dma(int iommufd, uint32_t ioas, uint64_t iova, uint64_t size, int fd, unsigned long start, bool readonly, int ret) " iommufd=%d ioas=%d iova=0x%"PRIx64" size=0x%"PRIx64" fd=%d start=%ld readonly=%d (%d)"
 iommufd_backend_unmap_dma_non_exist(int iommufd, uint32_t ioas, uint64_t iova, uint64_t size, int ret) " Unmap nonexistent mapping: iommufd=%d ioas=%d iova=0x%"PRIx64" size=0x%"PRIx64" (%d)"
 iommufd_backend_unmap_dma(int iommufd, uint32_t ioas, uint64_t iova, uint64_t size, int ret) " iommufd=%d ioas=%d iova=0x%"PRIx64" size=0x%"PRIx64" (%d)"
 iommufd_backend_alloc_ioas(int iommufd, uint32_t ioas) " iommufd=%d ioas=%d"
diff --git a/include/system/iommufd.h b/include/system/iommufd.h
index 283861b924..2d24d93d17 100644
--- a/include/system/iommufd.h
+++ b/include/system/iommufd.h
@@ -43,6 +43,9 @@ void iommufd_backend_disconnect(IOMMUFDBackend *be);
 bool iommufd_backend_alloc_ioas(IOMMUFDBackend *be, uint32_t *ioas_id,
                                 Error **errp);
 void iommufd_backend_free_id(IOMMUFDBackend *be, uint32_t id);
+int iommufd_backend_map_file_dma(IOMMUFDBackend *be, uint32_t ioas_id,
+                                 hwaddr iova, ram_addr_t size, int fd,
+                                 unsigned long start, bool readonly);
 int iommufd_backend_map_dma(IOMMUFDBackend *be, uint32_t ioas_id, hwaddr iova,
                             ram_addr_t size, void *vaddr, bool readonly);
 int iommufd_backend_unmap_dma(IOMMUFDBackend *be, uint32_t ioas_id,

From ab48cedc648a60a3e51db73acf12148d90f19c4c Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Wed, 2 Jul 2025 14:58:43 -0700
Subject: [PATCH 1809/2760] backends/iommufd: change process ioctl
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Define the change process ioctl

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Link: https://lore.kernel.org/qemu-devel/1751493538-202042-7-git-send-email-steven.sistare@oracle.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 backends/iommufd.c       | 24 ++++++++++++++++++++++++
 backends/trace-events    |  1 +
 include/system/iommufd.h |  3 +++
 3 files changed, 28 insertions(+)

diff --git a/backends/iommufd.c b/backends/iommufd.c
index 3a2ecc7f5b..87f81a05f6 100644
--- a/backends/iommufd.c
+++ b/backends/iommufd.c
@@ -73,6 +73,30 @@ static void iommufd_backend_class_init(ObjectClass *oc, const void *data)
     object_class_property_add_str(oc, "fd", NULL, iommufd_backend_set_fd);
 }
 
+bool iommufd_change_process_capable(IOMMUFDBackend *be)
+{
+    struct iommu_ioas_change_process args = {.size = sizeof(args)};
+
+    /*
+     * Call IOMMU_IOAS_CHANGE_PROCESS to verify it is a recognized ioctl.
+     * This is a no-op if the process has not changed since DMA was mapped.
+     */
+    return !ioctl(be->fd, IOMMU_IOAS_CHANGE_PROCESS, &args);
+}
+
+bool iommufd_change_process(IOMMUFDBackend *be, Error **errp)
+{
+    struct iommu_ioas_change_process args = {.size = sizeof(args)};
+    bool ret = !ioctl(be->fd, IOMMU_IOAS_CHANGE_PROCESS, &args);
+
+    if (!ret) {
+        error_setg_errno(errp, errno, "IOMMU_IOAS_CHANGE_PROCESS fd %d failed",
+                         be->fd);
+    }
+    trace_iommufd_change_process(be->fd, ret);
+    return ret;
+}
+
 bool iommufd_backend_connect(IOMMUFDBackend *be, Error **errp)
 {
     int fd;
diff --git a/backends/trace-events b/backends/trace-events
index e5f3e70cd1..56132d3fd2 100644
--- a/backends/trace-events
+++ b/backends/trace-events
@@ -7,6 +7,7 @@ dbus_vmstate_loading(const char *id) "id: %s"
 dbus_vmstate_saving(const char *id) "id: %s"
 
 # iommufd.c
+iommufd_change_process(int fd, bool ret) "fd=%d (%d)"
 iommufd_backend_connect(int fd, bool owned, uint32_t users) "fd=%d owned=%d users=%d"
 iommufd_backend_disconnect(int fd, uint32_t users) "fd=%d users=%d"
 iommu_backend_set_fd(int fd) "pre-opened /dev/iommu fd=%d"
diff --git a/include/system/iommufd.h b/include/system/iommufd.h
index 2d24d93d17..db5f2c716c 100644
--- a/include/system/iommufd.h
+++ b/include/system/iommufd.h
@@ -69,6 +69,9 @@ bool iommufd_backend_invalidate_cache(IOMMUFDBackend *be, uint32_t id,
                                       uint32_t *entry_num, void *data,
                                       Error **errp);
 
+bool iommufd_change_process_capable(IOMMUFDBackend *be);
+bool iommufd_change_process(IOMMUFDBackend *be, Error **errp);
+
 #define TYPE_HOST_IOMMU_DEVICE_IOMMUFD TYPE_HOST_IOMMU_DEVICE "-iommufd"
 OBJECT_DECLARE_TYPE(HostIOMMUDeviceIOMMUFD, HostIOMMUDeviceIOMMUFDClass,
                     HOST_IOMMU_DEVICE_IOMMUFD)

From d7ae4a740c8e49962ccfbbf41da0b3b8314518ce Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Wed, 2 Jul 2025 14:58:44 -0700
Subject: [PATCH 1810/2760] physmem: qemu_ram_get_fd_offset
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Define qemu_ram_get_fd_offset, so CPR can map a memory region using
IOMMU_IOAS_MAP_FILE in a subsequent patch.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Link: https://lore.kernel.org/qemu-devel/1751493538-202042-8-git-send-email-steven.sistare@oracle.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 include/exec/cpu-common.h | 1 +
 system/physmem.c          | 5 +++++
 2 files changed, 6 insertions(+)

diff --git a/include/exec/cpu-common.h b/include/exec/cpu-common.h
index a68485547d..9b658a3f48 100644
--- a/include/exec/cpu-common.h
+++ b/include/exec/cpu-common.h
@@ -85,6 +85,7 @@ void qemu_ram_unset_idstr(RAMBlock *block);
 const char *qemu_ram_get_idstr(RAMBlock *rb);
 void *qemu_ram_get_host_addr(RAMBlock *rb);
 ram_addr_t qemu_ram_get_offset(RAMBlock *rb);
+ram_addr_t qemu_ram_get_fd_offset(RAMBlock *rb);
 ram_addr_t qemu_ram_get_used_length(RAMBlock *rb);
 ram_addr_t qemu_ram_get_max_length(RAMBlock *rb);
 bool qemu_ram_is_shared(RAMBlock *rb);
diff --git a/system/physmem.c b/system/physmem.c
index ff0ca40222..130c148ffb 100644
--- a/system/physmem.c
+++ b/system/physmem.c
@@ -1593,6 +1593,11 @@ ram_addr_t qemu_ram_get_offset(RAMBlock *rb)
     return rb->offset;
 }
 
+ram_addr_t qemu_ram_get_fd_offset(RAMBlock *rb)
+{
+    return rb->fd_offset;
+}
+
 ram_addr_t qemu_ram_get_used_length(RAMBlock *rb)
 {
     return rb->used_length;

From fb32965b6dd8a001815593642a5146fbd2e85651 Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Wed, 2 Jul 2025 14:58:45 -0700
Subject: [PATCH 1811/2760] vfio/iommufd: use IOMMU_IOAS_MAP_FILE
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Use IOMMU_IOAS_MAP_FILE when the mapped region is backed by a file.
Such a mapping can be preserved without modification during CPR,
because it depends on the file's address space, which does not change,
rather than on the process's address space, which does change.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Link: https://lore.kernel.org/qemu-devel/1751493538-202042-9-git-send-email-steven.sistare@oracle.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/container-base.c              |  9 +++++++++
 hw/vfio/iommufd.c                     | 13 +++++++++++++
 include/hw/vfio/vfio-container-base.h | 15 +++++++++++++++
 3 files changed, 37 insertions(+)

diff --git a/hw/vfio/container-base.c b/hw/vfio/container-base.c
index d834bd4822..56304978e1 100644
--- a/hw/vfio/container-base.c
+++ b/hw/vfio/container-base.c
@@ -78,7 +78,16 @@ int vfio_container_dma_map(VFIOContainerBase *bcontainer,
                            void *vaddr, bool readonly, MemoryRegion *mr)
 {
     VFIOIOMMUClass *vioc = VFIO_IOMMU_GET_CLASS(bcontainer);
+    RAMBlock *rb = mr->ram_block;
+    int mfd = rb ? qemu_ram_get_fd(rb) : -1;
 
+    if (mfd >= 0 && vioc->dma_map_file) {
+        unsigned long start = vaddr - qemu_ram_get_host_addr(rb);
+        unsigned long offset = qemu_ram_get_fd_offset(rb);
+
+        return vioc->dma_map_file(bcontainer, iova, size, mfd, start + offset,
+                                  readonly);
+    }
     g_assert(vioc->dma_map);
     return vioc->dma_map(bcontainer, iova, size, vaddr, readonly, mr);
 }
diff --git a/hw/vfio/iommufd.c b/hw/vfio/iommufd.c
index d3efef71af..962a1e2b1f 100644
--- a/hw/vfio/iommufd.c
+++ b/hw/vfio/iommufd.c
@@ -45,6 +45,18 @@ static int iommufd_cdev_map(const VFIOContainerBase *bcontainer, hwaddr iova,
                                    iova, size, vaddr, readonly);
 }
 
+static int iommufd_cdev_map_file(const VFIOContainerBase *bcontainer,
+                                 hwaddr iova, ram_addr_t size,
+                                 int fd, unsigned long start, bool readonly)
+{
+    const VFIOIOMMUFDContainer *container =
+        container_of(bcontainer, VFIOIOMMUFDContainer, bcontainer);
+
+    return iommufd_backend_map_file_dma(container->be,
+                                        container->ioas_id,
+                                        iova, size, fd, start, readonly);
+}
+
 static int iommufd_cdev_unmap(const VFIOContainerBase *bcontainer,
                               hwaddr iova, ram_addr_t size,
                               IOMMUTLBEntry *iotlb, bool unmap_all)
@@ -807,6 +819,7 @@ static void vfio_iommu_iommufd_class_init(ObjectClass *klass, const void *data)
     VFIOIOMMUClass *vioc = VFIO_IOMMU_CLASS(klass);
 
     vioc->dma_map = iommufd_cdev_map;
+    vioc->dma_map_file = iommufd_cdev_map_file;
     vioc->dma_unmap = iommufd_cdev_unmap;
     vioc->attach_device = iommufd_cdev_attach;
     vioc->detach_device = iommufd_cdev_detach;
diff --git a/include/hw/vfio/vfio-container-base.h b/include/hw/vfio/vfio-container-base.h
index 3cd86ec59e..bded6e993f 100644
--- a/include/hw/vfio/vfio-container-base.h
+++ b/include/hw/vfio/vfio-container-base.h
@@ -167,6 +167,21 @@ struct VFIOIOMMUClass {
     int (*dma_map)(const VFIOContainerBase *bcontainer,
                    hwaddr iova, ram_addr_t size,
                    void *vaddr, bool readonly, MemoryRegion *mr);
+    /**
+     * @dma_map_file
+     *
+     * Map a file range for the container.
+     *
+     * @bcontainer: #VFIOContainerBase to use for map
+     * @iova: start address to map
+     * @size: size of the range to map
+     * @fd: descriptor of the file to map
+     * @start: starting file offset of the range to map
+     * @readonly: map read only if true
+     */
+    int (*dma_map_file)(const VFIOContainerBase *bcontainer,
+                        hwaddr iova, ram_addr_t size,
+                        int fd, unsigned long start, bool readonly);
     /**
      * @dma_unmap
      *

From b9b389b9e0f08b207786d501b790dab9cb2c09de Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Wed, 2 Jul 2025 14:58:46 -0700
Subject: [PATCH 1812/2760] vfio/iommufd: invariant device name
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

cpr-transfer will use the device name as a key to find the value
of the device descriptor in new QEMU.  However, if the descriptor
number is specified by a command-line fd parameter, then
vfio_device_get_name creates a name that includes the fd number.
This causes a chicken-and-egg problem: new QEMU must know the fd
number to construct a name to find the fd number.

To fix, create an invariant name based on the id command-line parameter,
if id is defined.  The user will need to provide such an id to use CPR.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Link: https://lore.kernel.org/qemu-devel/1751493538-202042-10-git-send-email-steven.sistare@oracle.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/device.c | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/hw/vfio/device.c b/hw/vfio/device.c
index d91c695b69..3cd365fb8b 100644
--- a/hw/vfio/device.c
+++ b/hw/vfio/device.c
@@ -316,12 +316,17 @@ bool vfio_device_get_name(VFIODevice *vbasedev, Error **errp)
             error_setg(errp, "Use FD passing only with iommufd backend");
             return false;
         }
-        /*
-         * Give a name with fd so any function printing out vbasedev->name
-         * will not break.
-         */
         if (!vbasedev->name) {
-            vbasedev->name = g_strdup_printf("VFIO_FD%d", vbasedev->fd);
+
+            if (vbasedev->dev->id) {
+                vbasedev->name = g_strdup(vbasedev->dev->id);
+                return true;
+            } else {
+                /*
+                 * Assign a name so any function printing it will not break.
+                 */
+                vbasedev->name = g_strdup_printf("VFIO_FD%d", vbasedev->fd);
+            }
         }
     }
 

From 184053f04f6ad6b2950d4712063ffed43bb2720f Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Wed, 2 Jul 2025 14:58:47 -0700
Subject: [PATCH 1813/2760] vfio/iommufd: add vfio_device_free_name
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Define vfio_device_free_name to free the name created by
vfio_device_get_name.  A subsequent patch will do more there.
No functional change.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Link: https://lore.kernel.org/qemu-devel/1751493538-202042-11-git-send-email-steven.sistare@oracle.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/ap.c                  | 4 ++--
 hw/vfio/ccw.c                 | 4 ++--
 hw/vfio/device.c              | 5 +++++
 hw/vfio/pci.c                 | 2 +-
 hw/vfio/platform.c            | 2 +-
 include/hw/vfio/vfio-device.h | 1 +
 6 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/hw/vfio/ap.c b/hw/vfio/ap.c
index 1df4438149..7719f24579 100644
--- a/hw/vfio/ap.c
+++ b/hw/vfio/ap.c
@@ -265,7 +265,7 @@ static void vfio_ap_realize(DeviceState *dev, Error **errp)
 
 error:
     error_prepend(errp, VFIO_MSG_PREFIX, vbasedev->name);
-    g_free(vbasedev->name);
+    vfio_device_free_name(vbasedev);
 }
 
 static void vfio_ap_unrealize(DeviceState *dev)
@@ -275,7 +275,7 @@ static void vfio_ap_unrealize(DeviceState *dev)
     vfio_ap_unregister_irq_notifier(vapdev, VFIO_AP_REQ_IRQ_INDEX);
     vfio_ap_unregister_irq_notifier(vapdev, VFIO_AP_CFG_CHG_IRQ_INDEX);
     vfio_device_detach(&vapdev->vdev);
-    g_free(vapdev->vdev.name);
+    vfio_device_free_name(&vapdev->vdev);
 }
 
 static const Property vfio_ap_properties[] = {
diff --git a/hw/vfio/ccw.c b/hw/vfio/ccw.c
index cea9d6e005..9560b8d851 100644
--- a/hw/vfio/ccw.c
+++ b/hw/vfio/ccw.c
@@ -619,7 +619,7 @@ out_io_notifier_err:
 out_region_err:
     vfio_device_detach(vbasedev);
 out_attach_dev_err:
-    g_free(vbasedev->name);
+    vfio_device_free_name(vbasedev);
 out_unrealize:
     if (cdc->unrealize) {
         cdc->unrealize(cdev);
@@ -637,7 +637,7 @@ static void vfio_ccw_unrealize(DeviceState *dev)
     vfio_ccw_unregister_irq_notifier(vcdev, VFIO_CCW_IO_IRQ_INDEX);
     vfio_ccw_put_region(vcdev);
     vfio_device_detach(&vcdev->vdev);
-    g_free(vcdev->vdev.name);
+    vfio_device_free_name(&vcdev->vdev);
 
     if (cdc->unrealize) {
         cdc->unrealize(cdev);
diff --git a/hw/vfio/device.c b/hw/vfio/device.c
index 3cd365fb8b..97eddd04f5 100644
--- a/hw/vfio/device.c
+++ b/hw/vfio/device.c
@@ -333,6 +333,11 @@ bool vfio_device_get_name(VFIODevice *vbasedev, Error **errp)
     return true;
 }
 
+void vfio_device_free_name(VFIODevice *vbasedev)
+{
+    g_clear_pointer(&vbasedev->name, g_free);
+}
+
 void vfio_device_set_fd(VFIODevice *vbasedev, const char *str, Error **errp)
 {
     ERRP_GUARD();
diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index dd0b2a0b94..1093b28df7 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -2996,7 +2996,7 @@ void vfio_pci_put_device(VFIOPCIDevice *vdev)
 
     vfio_device_detach(&vdev->vbasedev);
 
-    g_free(vdev->vbasedev.name);
+    vfio_device_free_name(&vdev->vbasedev);
     g_free(vdev->msix);
 }
 
diff --git a/hw/vfio/platform.c b/hw/vfio/platform.c
index 9a21f2e50a..5c1795a26f 100644
--- a/hw/vfio/platform.c
+++ b/hw/vfio/platform.c
@@ -530,7 +530,7 @@ static bool vfio_base_device_init(VFIODevice *vbasedev, Error **errp)
 {
     /* @fd takes precedence over @sysfsdev which takes precedence over @host */
     if (vbasedev->fd < 0 && vbasedev->sysfsdev) {
-        g_free(vbasedev->name);
+        vfio_device_free_name(vbasedev);
         vbasedev->name = g_path_get_basename(vbasedev->sysfsdev);
     } else if (vbasedev->fd < 0) {
         if (!vbasedev->name || strchr(vbasedev->name, '/')) {
diff --git a/include/hw/vfio/vfio-device.h b/include/hw/vfio/vfio-device.h
index f503837ccc..1901a35aa9 100644
--- a/include/hw/vfio/vfio-device.h
+++ b/include/hw/vfio/vfio-device.h
@@ -279,6 +279,7 @@ int vfio_device_get_irq_info(VFIODevice *vbasedev, int index,
 
 /* Returns 0 on success, or a negative errno. */
 bool vfio_device_get_name(VFIODevice *vbasedev, Error **errp);
+void vfio_device_free_name(VFIODevice *vbasedev);
 void vfio_device_set_fd(VFIODevice *vbasedev, const char *str, Error **errp);
 void vfio_device_init(VFIODevice *vbasedev, int type, VFIODeviceOps *ops,
                       DeviceState *dev, bool ram_discard);

From a434fd8f6462c1541927d22e07c58425d6cbd84b Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Wed, 2 Jul 2025 14:58:48 -0700
Subject: [PATCH 1814/2760] vfio/iommufd: device name blocker
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

If an invariant device name cannot be created, block CPR.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Link: https://lore.kernel.org/qemu-devel/1751493538-202042-12-git-send-email-steven.sistare@oracle.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/device.c           | 11 +++++++++++
 include/hw/vfio/vfio-cpr.h |  1 +
 2 files changed, 12 insertions(+)

diff --git a/hw/vfio/device.c b/hw/vfio/device.c
index 97eddd04f5..0ae3f3c660 100644
--- a/hw/vfio/device.c
+++ b/hw/vfio/device.c
@@ -28,6 +28,8 @@
 #include "qapi/error.h"
 #include "qemu/error-report.h"
 #include "qemu/units.h"
+#include "migration/cpr.h"
+#include "migration/blocker.h"
 #include "monitor/monitor.h"
 #include "vfio-helpers.h"
 
@@ -324,8 +326,16 @@ bool vfio_device_get_name(VFIODevice *vbasedev, Error **errp)
             } else {
                 /*
                  * Assign a name so any function printing it will not break.
+                 * The fd number changes across processes, so this cannot be
+                 * used as an invariant name for CPR.
                  */
                 vbasedev->name = g_strdup_printf("VFIO_FD%d", vbasedev->fd);
+                error_setg(&vbasedev->cpr.id_blocker,
+                           "vfio device with fd=%d needs an id property",
+                           vbasedev->fd);
+                return migrate_add_blocker_modes(&vbasedev->cpr.id_blocker,
+                                                 errp, MIG_MODE_CPR_TRANSFER,
+                                                 -1) == 0;
             }
         }
     }
@@ -336,6 +346,7 @@ bool vfio_device_get_name(VFIODevice *vbasedev, Error **errp)
 void vfio_device_free_name(VFIODevice *vbasedev)
 {
     g_clear_pointer(&vbasedev->name, g_free);
+    migrate_del_blocker(&vbasedev->cpr.id_blocker);
 }
 
 void vfio_device_set_fd(VFIODevice *vbasedev, const char *str, Error **errp)
diff --git a/include/hw/vfio/vfio-cpr.h b/include/hw/vfio/vfio-cpr.h
index d37acc4a0a..fa7d43ddd8 100644
--- a/include/hw/vfio/vfio-cpr.h
+++ b/include/hw/vfio/vfio-cpr.h
@@ -30,6 +30,7 @@ typedef struct VFIOContainerCPR {
 
 typedef struct VFIODeviceCPR {
     Error *mdev_blocker;
+    Error *id_blocker;
 } VFIODeviceCPR;
 
 bool vfio_legacy_cpr_register_container(struct VFIOContainer *container,

From 06c6a65852af0b7648cdb6ff6cf2e66929a7b5f5 Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Wed, 2 Jul 2025 14:58:49 -0700
Subject: [PATCH 1815/2760] vfio/iommufd: register container for cpr
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Register a vfio iommufd container and device for CPR, replacing the generic
CPR register call with a more specific iommufd register call.  Add a
blocker if the kernel does not support IOMMU_IOAS_CHANGE_PROCESS.

This is mostly boiler plate.  The fields to to saved and restored are added
in subsequent patches.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Link: https://lore.kernel.org/qemu-devel/1751493538-202042-13-git-send-email-steven.sistare@oracle.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 backends/iommufd.c         | 10 +++++
 hw/vfio/cpr-iommufd.c      | 86 ++++++++++++++++++++++++++++++++++++++
 hw/vfio/iommufd.c          |  6 ++-
 hw/vfio/meson.build        |  1 +
 include/hw/vfio/vfio-cpr.h | 12 ++++++
 include/system/iommufd.h   |  1 +
 6 files changed, 114 insertions(+), 2 deletions(-)
 create mode 100644 hw/vfio/cpr-iommufd.c

diff --git a/backends/iommufd.c b/backends/iommufd.c
index 87f81a05f6..c554ce5385 100644
--- a/backends/iommufd.c
+++ b/backends/iommufd.c
@@ -108,6 +108,13 @@ bool iommufd_backend_connect(IOMMUFDBackend *be, Error **errp)
         }
         be->fd = fd;
     }
+    if (!be->users && !vfio_iommufd_cpr_register_iommufd(be, errp)) {
+        if (be->owned) {
+            close(be->fd);
+            be->fd = -1;
+        }
+        return false;
+    }
     be->users++;
 
     trace_iommufd_backend_connect(be->fd, be->owned, be->users);
@@ -125,6 +132,9 @@ void iommufd_backend_disconnect(IOMMUFDBackend *be)
         be->fd = -1;
     }
 out:
+    if (!be->users) {
+        vfio_iommufd_cpr_unregister_iommufd(be);
+    }
     trace_iommufd_backend_disconnect(be->fd, be->users);
 }
 
diff --git a/hw/vfio/cpr-iommufd.c b/hw/vfio/cpr-iommufd.c
new file mode 100644
index 0000000000..2f58b43793
--- /dev/null
+++ b/hw/vfio/cpr-iommufd.c
@@ -0,0 +1,86 @@
+/*
+ * Copyright (c) 2024-2025 Oracle and/or its affiliates.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "hw/vfio/vfio-cpr.h"
+#include "migration/blocker.h"
+#include "migration/cpr.h"
+#include "migration/migration.h"
+#include "migration/vmstate.h"
+#include "system/iommufd.h"
+#include "vfio-iommufd.h"
+
+static bool vfio_cpr_supported(IOMMUFDBackend *be, Error **errp)
+{
+    if (!iommufd_change_process_capable(be)) {
+        if (errp) {
+            error_setg(errp, "vfio iommufd backend does not support "
+                       "IOMMU_IOAS_CHANGE_PROCESS");
+        }
+        return false;
+    }
+    return true;
+}
+
+static const VMStateDescription iommufd_cpr_vmstate = {
+    .name = "iommufd",
+    .version_id = 0,
+    .minimum_version_id = 0,
+    .needed = cpr_incoming_needed,
+    .fields = (VMStateField[]) {
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+bool vfio_iommufd_cpr_register_iommufd(IOMMUFDBackend *be, Error **errp)
+{
+    Error **cpr_blocker = &be->cpr_blocker;
+
+    if (!vfio_cpr_supported(be, cpr_blocker)) {
+        return migrate_add_blocker_modes(cpr_blocker, errp,
+                                         MIG_MODE_CPR_TRANSFER, -1) == 0;
+    }
+
+    vmstate_register(NULL, -1, &iommufd_cpr_vmstate, be);
+
+    return true;
+}
+
+void vfio_iommufd_cpr_unregister_iommufd(IOMMUFDBackend *be)
+{
+    vmstate_unregister(NULL, &iommufd_cpr_vmstate, be);
+    migrate_del_blocker(&be->cpr_blocker);
+}
+
+bool vfio_iommufd_cpr_register_container(VFIOIOMMUFDContainer *container,
+                                         Error **errp)
+{
+    VFIOContainerBase *bcontainer = &container->bcontainer;
+
+    migration_add_notifier_mode(&bcontainer->cpr_reboot_notifier,
+                                vfio_cpr_reboot_notifier,
+                                MIG_MODE_CPR_REBOOT);
+
+    vfio_cpr_add_kvm_notifier();
+
+    return true;
+}
+
+void vfio_iommufd_cpr_unregister_container(VFIOIOMMUFDContainer *container)
+{
+    VFIOContainerBase *bcontainer = &container->bcontainer;
+
+    migration_remove_notifier(&bcontainer->cpr_reboot_notifier);
+}
+
+void vfio_iommufd_cpr_register_device(VFIODevice *vbasedev)
+{
+}
+
+void vfio_iommufd_cpr_unregister_device(VFIODevice *vbasedev)
+{
+}
diff --git a/hw/vfio/iommufd.c b/hw/vfio/iommufd.c
index 962a1e2b1f..ff291be235 100644
--- a/hw/vfio/iommufd.c
+++ b/hw/vfio/iommufd.c
@@ -446,7 +446,7 @@ static void iommufd_cdev_container_destroy(VFIOIOMMUFDContainer *container)
     if (!QLIST_EMPTY(&bcontainer->device_list)) {
         return;
     }
-    vfio_cpr_unregister_container(bcontainer);
+    vfio_iommufd_cpr_unregister_container(container);
     vfio_listener_unregister(bcontainer);
     iommufd_backend_free_id(container->be, container->ioas_id);
     object_unref(container);
@@ -592,7 +592,7 @@ static bool iommufd_cdev_attach(const char *name, VFIODevice *vbasedev,
         goto err_listener_register;
     }
 
-    if (!vfio_cpr_register_container(bcontainer, errp)) {
+    if (!vfio_iommufd_cpr_register_container(container, errp)) {
         goto err_listener_register;
     }
 
@@ -623,6 +623,7 @@ found_container:
     }
 
     vfio_device_prepare(vbasedev, bcontainer, &dev_info);
+    vfio_iommufd_cpr_register_device(vbasedev);
 
     trace_iommufd_cdev_device_info(vbasedev->name, devfd, vbasedev->num_irqs,
                                    vbasedev->num_regions, vbasedev->flags);
@@ -660,6 +661,7 @@ static void iommufd_cdev_detach(VFIODevice *vbasedev)
     iommufd_cdev_container_destroy(container);
     vfio_address_space_put(space);
 
+    vfio_iommufd_cpr_unregister_device(vbasedev);
     iommufd_cdev_unbind_and_disconnect(vbasedev);
     close(vbasedev->fd);
 }
diff --git a/hw/vfio/meson.build b/hw/vfio/meson.build
index 63ea393076..7a881740a6 100644
--- a/hw/vfio/meson.build
+++ b/hw/vfio/meson.build
@@ -31,6 +31,7 @@ system_ss.add(when: 'CONFIG_VFIO', if_true: files(
 ))
 system_ss.add(when: ['CONFIG_VFIO', 'CONFIG_IOMMUFD'], if_true: files(
   'iommufd.c',
+  'cpr-iommufd.c',
 ))
 system_ss.add(when: 'CONFIG_VFIO_PCI', if_true: files(
   'display.c',
diff --git a/include/hw/vfio/vfio-cpr.h b/include/hw/vfio/vfio-cpr.h
index fa7d43ddd8..87b4206d81 100644
--- a/include/hw/vfio/vfio-cpr.h
+++ b/include/hw/vfio/vfio-cpr.h
@@ -15,7 +15,10 @@
 struct VFIOContainer;
 struct VFIOContainerBase;
 struct VFIOGroup;
+struct VFIODevice;
 struct VFIOPCIDevice;
+struct VFIOIOMMUFDContainer;
+struct IOMMUFDBackend;
 
 typedef int (*dma_map_fn)(const struct VFIOContainerBase *bcontainer,
                           hwaddr iova, ram_addr_t size, void *vaddr,
@@ -44,6 +47,15 @@ bool vfio_cpr_register_container(struct VFIOContainerBase *bcontainer,
                                  Error **errp);
 void vfio_cpr_unregister_container(struct VFIOContainerBase *bcontainer);
 
+bool vfio_iommufd_cpr_register_container(struct VFIOIOMMUFDContainer *container,
+                                         Error **errp);
+void vfio_iommufd_cpr_unregister_container(
+    struct VFIOIOMMUFDContainer *container);
+bool vfio_iommufd_cpr_register_iommufd(struct IOMMUFDBackend *be, Error **errp);
+void vfio_iommufd_cpr_unregister_iommufd(struct IOMMUFDBackend *be);
+void vfio_iommufd_cpr_register_device(struct VFIODevice *vbasedev);
+void vfio_iommufd_cpr_unregister_device(struct VFIODevice *vbasedev);
+
 int vfio_cpr_group_get_device_fd(int d, const char *name);
 
 bool vfio_cpr_container_match(struct VFIOContainer *container,
diff --git a/include/system/iommufd.h b/include/system/iommufd.h
index db5f2c716c..c9c72ffc45 100644
--- a/include/system/iommufd.h
+++ b/include/system/iommufd.h
@@ -32,6 +32,7 @@ struct IOMMUFDBackend {
     /*< protected >*/
     int fd;            /* /dev/iommu file descriptor */
     bool owned;        /* is the /dev/iommu opened internally */
+    Error *cpr_blocker;/* set if be does not support CPR */
     uint32_t users;
 
     /*< public >*/

From a6f2f9c42f3a5418fc7000b1fd331b086b6133d9 Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Wed, 2 Jul 2025 14:58:50 -0700
Subject: [PATCH 1816/2760] migration: vfio cpr state hook
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Define a list of vfio devices in CPR state, in a subsection so that
older QEMU can be live updated to this version.  However, new QEMU
will not be live updateable to old QEMU.  This is acceptable because
CPR is not yet commonly used, and updates to older versions are unusual.

The contents of each device object will be defined by the vfio subsystem
in a subsequent patch.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Link: https://lore.kernel.org/qemu-devel/1751493538-202042-14-git-send-email-steven.sistare@oracle.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/cpr-iommufd.c      |  2 ++
 hw/vfio/iommufd-stubs.c    | 18 ++++++++++++++++++
 hw/vfio/meson.build        |  1 +
 include/hw/vfio/vfio-cpr.h |  1 +
 include/migration/cpr.h    | 12 ++++++++++++
 migration/cpr.c            | 15 ++++++---------
 6 files changed, 40 insertions(+), 9 deletions(-)
 create mode 100644 hw/vfio/iommufd-stubs.c

diff --git a/hw/vfio/cpr-iommufd.c b/hw/vfio/cpr-iommufd.c
index 2f58b43793..f95773b02c 100644
--- a/hw/vfio/cpr-iommufd.c
+++ b/hw/vfio/cpr-iommufd.c
@@ -14,6 +14,8 @@
 #include "system/iommufd.h"
 #include "vfio-iommufd.h"
 
+const VMStateDescription vmstate_cpr_vfio_devices;  /* TBD in a later patch */
+
 static bool vfio_cpr_supported(IOMMUFDBackend *be, Error **errp)
 {
     if (!iommufd_change_process_capable(be)) {
diff --git a/hw/vfio/iommufd-stubs.c b/hw/vfio/iommufd-stubs.c
new file mode 100644
index 0000000000..0be5276175
--- /dev/null
+++ b/hw/vfio/iommufd-stubs.c
@@ -0,0 +1,18 @@
+/*
+ * Copyright (c) 2025 Oracle and/or its affiliates.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "migration/cpr.h"
+#include "migration/vmstate.h"
+
+const VMStateDescription vmstate_cpr_vfio_devices = {
+    .name = CPR_STATE "/vfio devices",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (const VMStateField[]){
+        VMSTATE_END_OF_LIST()
+    }
+};
diff --git a/hw/vfio/meson.build b/hw/vfio/meson.build
index 7a881740a6..bfaf6be805 100644
--- a/hw/vfio/meson.build
+++ b/hw/vfio/meson.build
@@ -33,6 +33,7 @@ system_ss.add(when: ['CONFIG_VFIO', 'CONFIG_IOMMUFD'], if_true: files(
   'iommufd.c',
   'cpr-iommufd.c',
 ))
+system_ss.add(when: 'CONFIG_IOMMUFD', if_false: files('iommufd-stubs.c'))
 system_ss.add(when: 'CONFIG_VFIO_PCI', if_true: files(
   'display.c',
 ))
diff --git a/include/hw/vfio/vfio-cpr.h b/include/hw/vfio/vfio-cpr.h
index 87b4206d81..286e3d4e9a 100644
--- a/include/hw/vfio/vfio-cpr.h
+++ b/include/hw/vfio/vfio-cpr.h
@@ -75,6 +75,7 @@ void vfio_cpr_delete_vector_fd(struct VFIOPCIDevice *vdev, const char *name,
                                int nr);
 
 extern const VMStateDescription vfio_cpr_pci_vmstate;
+extern const VMStateDescription vmstate_cpr_vfio_devices;
 
 void vfio_cpr_add_kvm_notifier(void);
 
diff --git a/include/migration/cpr.h b/include/migration/cpr.h
index eb27a93301..3fc19a74ef 100644
--- a/include/migration/cpr.h
+++ b/include/migration/cpr.h
@@ -9,11 +9,23 @@
 #define MIGRATION_CPR_H
 
 #include "qapi/qapi-types-migration.h"
+#include "qemu/queue.h"
 
 #define MIG_MODE_NONE           -1
 
 #define QEMU_CPR_FILE_MAGIC     0x51435052
 #define QEMU_CPR_FILE_VERSION   0x00000001
+#define CPR_STATE "CprState"
+
+typedef QLIST_HEAD(CprFdList, CprFd) CprFdList;
+typedef QLIST_HEAD(CprVFIODeviceList, CprVFIODevice) CprVFIODeviceList;
+
+typedef struct CprState {
+    CprFdList fds;
+    CprVFIODeviceList vfio_devices;
+} CprState;
+
+extern CprState cpr_state;
 
 void cpr_save_fd(const char *name, int id, int fd);
 void cpr_delete_fd(const char *name, int id);
diff --git a/migration/cpr.c b/migration/cpr.c
index 535d587aee..42ad0b0d50 100644
--- a/migration/cpr.c
+++ b/migration/cpr.c
@@ -7,6 +7,7 @@
 
 #include "qemu/osdep.h"
 #include "qapi/error.h"
+#include "hw/vfio/vfio-device.h"
 #include "migration/cpr.h"
 #include "migration/misc.h"
 #include "migration/options.h"
@@ -20,13 +21,7 @@
 /*************************************************************************/
 /* cpr state container for all information to be saved. */
 
-typedef QLIST_HEAD(CprFdList, CprFd) CprFdList;
-
-typedef struct CprState {
-    CprFdList fds;
-} CprState;
-
-static CprState cpr_state;
+CprState cpr_state;
 
 /****************************************************************************/
 
@@ -127,8 +122,6 @@ int cpr_open_fd(const char *path, int flags, const char *name, int id,
 }
 
 /*************************************************************************/
-#define CPR_STATE "CprState"
-
 static const VMStateDescription vmstate_cpr_state = {
     .name = CPR_STATE,
     .version_id = 1,
@@ -136,6 +129,10 @@ static const VMStateDescription vmstate_cpr_state = {
     .fields = (VMStateField[]) {
         VMSTATE_QLIST_V(fds, CprState, 1, vmstate_cpr_fd, CprFd, next),
         VMSTATE_END_OF_LIST()
+    },
+    .subsections = (const VMStateDescription * const []) {
+        &vmstate_cpr_vfio_devices,
+        NULL
     }
 };
 /*************************************************************************/

From f2f3e4667e4d6026f39ab17f355f79b2f8431e19 Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Wed, 2 Jul 2025 14:58:51 -0700
Subject: [PATCH 1817/2760] vfio/iommufd: cpr state
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

VFIO iommufd devices will need access to ioas_id, devid, and hwpt_id in
new QEMU at realize time, so add them to CPR state.  Define CprVFIODevice
as the object which holds the state and is serialized to the vmstate file.
Define accessors to copy state between VFIODevice and CprVFIODevice.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Link: https://lore.kernel.org/qemu-devel/1751493538-202042-15-git-send-email-steven.sistare@oracle.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/cpr-iommufd.c      | 98 +++++++++++++++++++++++++++++++++++++-
 hw/vfio/iommufd.c          |  2 +
 hw/vfio/trace-events       |  3 ++
 include/hw/vfio/vfio-cpr.h |  3 ++
 4 files changed, 105 insertions(+), 1 deletion(-)

diff --git a/hw/vfio/cpr-iommufd.c b/hw/vfio/cpr-iommufd.c
index f95773b02c..4166201e3f 100644
--- a/hw/vfio/cpr-iommufd.c
+++ b/hw/vfio/cpr-iommufd.c
@@ -7,14 +7,98 @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "hw/vfio/vfio-cpr.h"
+#include "hw/vfio/vfio-device.h"
 #include "migration/blocker.h"
 #include "migration/cpr.h"
 #include "migration/migration.h"
 #include "migration/vmstate.h"
 #include "system/iommufd.h"
 #include "vfio-iommufd.h"
+#include "trace.h"
 
-const VMStateDescription vmstate_cpr_vfio_devices;  /* TBD in a later patch */
+typedef struct CprVFIODevice {
+    char *name;
+    unsigned int namelen;
+    uint32_t ioas_id;
+    int devid;
+    uint32_t hwpt_id;
+    QLIST_ENTRY(CprVFIODevice) next;
+} CprVFIODevice;
+
+static const VMStateDescription vmstate_cpr_vfio_device = {
+    .name = "cpr vfio device",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32(namelen, CprVFIODevice),
+        VMSTATE_VBUFFER_ALLOC_UINT32(name, CprVFIODevice, 0, NULL, namelen),
+        VMSTATE_INT32(devid, CprVFIODevice),
+        VMSTATE_UINT32(ioas_id, CprVFIODevice),
+        VMSTATE_UINT32(hwpt_id, CprVFIODevice),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+const VMStateDescription vmstate_cpr_vfio_devices = {
+    .name = CPR_STATE "/vfio devices",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (const VMStateField[]){
+        VMSTATE_QLIST_V(vfio_devices, CprState, 1, vmstate_cpr_vfio_device,
+                        CprVFIODevice, next),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static void vfio_cpr_save_device(VFIODevice *vbasedev)
+{
+    CprVFIODevice *elem = g_new0(CprVFIODevice, 1);
+
+    elem->name = g_strdup(vbasedev->name);
+    elem->namelen = strlen(vbasedev->name) + 1;
+    elem->ioas_id = vbasedev->cpr.ioas_id;
+    elem->devid = vbasedev->devid;
+    elem->hwpt_id = vbasedev->cpr.hwpt_id;
+    QLIST_INSERT_HEAD(&cpr_state.vfio_devices, elem, next);
+}
+
+static CprVFIODevice *find_device(const char *name)
+{
+    CprVFIODeviceList *head = &cpr_state.vfio_devices;
+    CprVFIODevice *elem;
+
+    QLIST_FOREACH(elem, head, next) {
+        if (!strcmp(elem->name, name)) {
+            return elem;
+        }
+    }
+    return NULL;
+}
+
+static void vfio_cpr_delete_device(const char *name)
+{
+    CprVFIODevice *elem = find_device(name);
+
+    if (elem) {
+        QLIST_REMOVE(elem, next);
+        g_free(elem->name);
+        g_free(elem);
+    }
+}
+
+static bool vfio_cpr_find_device(VFIODevice *vbasedev)
+{
+    CprVFIODevice *elem = find_device(vbasedev->name);
+
+    if (elem) {
+        vbasedev->cpr.ioas_id = elem->ioas_id;
+        vbasedev->devid = elem->devid;
+        vbasedev->cpr.hwpt_id = elem->hwpt_id;
+        trace_vfio_cpr_find_device(elem->ioas_id, elem->devid, elem->hwpt_id);
+        return true;
+    }
+    return false;
+}
 
 static bool vfio_cpr_supported(IOMMUFDBackend *be, Error **errp)
 {
@@ -81,8 +165,20 @@ void vfio_iommufd_cpr_unregister_container(VFIOIOMMUFDContainer *container)
 
 void vfio_iommufd_cpr_register_device(VFIODevice *vbasedev)
 {
+    if (!cpr_is_incoming()) {
+        vfio_cpr_save_device(vbasedev);
+    }
 }
 
 void vfio_iommufd_cpr_unregister_device(VFIODevice *vbasedev)
 {
+    vfio_cpr_delete_device(vbasedev->name);
+}
+
+void vfio_cpr_load_device(VFIODevice *vbasedev)
+{
+    if (cpr_is_incoming()) {
+        bool ret = vfio_cpr_find_device(vbasedev);
+        g_assert(ret);
+    }
 }
diff --git a/hw/vfio/iommufd.c b/hw/vfio/iommufd.c
index ff291be235..f0d57ea65f 100644
--- a/hw/vfio/iommufd.c
+++ b/hw/vfio/iommufd.c
@@ -515,6 +515,8 @@ static bool iommufd_cdev_attach(const char *name, VFIODevice *vbasedev,
     const VFIOIOMMUClass *iommufd_vioc =
         VFIO_IOMMU_CLASS(object_class_by_name(TYPE_VFIO_IOMMU_IOMMUFD));
 
+    vfio_cpr_load_device(vbasedev);
+
     if (vbasedev->fd < 0) {
         devfd = iommufd_cdev_getfd(vbasedev->sysfsdev, errp);
         if (devfd < 0) {
diff --git a/hw/vfio/trace-events b/hw/vfio/trace-events
index e1728c4ef6..8ec0ad0cde 100644
--- a/hw/vfio/trace-events
+++ b/hw/vfio/trace-events
@@ -197,6 +197,9 @@ iommufd_cdev_alloc_ioas(int iommufd, int ioas_id) " [iommufd=%d] new IOMMUFD con
 iommufd_cdev_device_info(char *name, int devfd, int num_irqs, int num_regions, int flags) " %s (%d) num_irqs=%d num_regions=%d flags=%d"
 iommufd_cdev_pci_hot_reset_dep_devices(int domain, int bus, int slot, int function, int dev_id) "\t%04x:%02x:%02x.%x devid %d"
 
+# cpr-iommufd.c
+vfio_cpr_find_device(uint32_t ioas_id, int devid, uint32_t hwpt_id) "ioas_id %u, devid %d, hwpt_id %u"
+
 # device.c
 vfio_device_get_region_info_type(const char *name, int index, uint32_t type, uint32_t subtype) "%s index %d, %08x/%08x"
 vfio_device_reset_handler(void) ""
diff --git a/include/hw/vfio/vfio-cpr.h b/include/hw/vfio/vfio-cpr.h
index 286e3d4e9a..2878372495 100644
--- a/include/hw/vfio/vfio-cpr.h
+++ b/include/hw/vfio/vfio-cpr.h
@@ -34,6 +34,8 @@ typedef struct VFIOContainerCPR {
 typedef struct VFIODeviceCPR {
     Error *mdev_blocker;
     Error *id_blocker;
+    uint32_t hwpt_id;
+    uint32_t ioas_id;
 } VFIODeviceCPR;
 
 bool vfio_legacy_cpr_register_container(struct VFIOContainer *container,
@@ -55,6 +57,7 @@ bool vfio_iommufd_cpr_register_iommufd(struct IOMMUFDBackend *be, Error **errp);
 void vfio_iommufd_cpr_unregister_iommufd(struct IOMMUFDBackend *be);
 void vfio_iommufd_cpr_register_device(struct VFIODevice *vbasedev);
 void vfio_iommufd_cpr_unregister_device(struct VFIODevice *vbasedev);
+void vfio_cpr_load_device(struct VFIODevice *vbasedev);
 
 int vfio_cpr_group_get_device_fd(int d, const char *name);
 

From 2a3f0a59bd6479f75fa5335f82b85b4f9cd7ed4e Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Wed, 2 Jul 2025 14:58:52 -0700
Subject: [PATCH 1818/2760] vfio/iommufd: preserve descriptors
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Save the iommu and vfio device fd in CPR state when it is created.
After CPR, the fd number is found in CPR state and reused.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Link: https://lore.kernel.org/qemu-devel/1751493538-202042-16-git-send-email-steven.sistare@oracle.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 backends/iommufd.c    | 35 +++++++++++++++++++++++++++++------
 hw/vfio/cpr-iommufd.c | 10 ++++++++++
 hw/vfio/device.c      |  9 +--------
 3 files changed, 40 insertions(+), 14 deletions(-)

diff --git a/backends/iommufd.c b/backends/iommufd.c
index c554ce5385..e0917923bf 100644
--- a/backends/iommufd.c
+++ b/backends/iommufd.c
@@ -16,12 +16,18 @@
 #include "qemu/module.h"
 #include "qom/object_interfaces.h"
 #include "qemu/error-report.h"
+#include "migration/cpr.h"
 #include "monitor/monitor.h"
 #include "trace.h"
 #include "hw/vfio/vfio-device.h"
 #include <sys/ioctl.h>
 #include <linux/iommufd.h>
 
+static const char *iommufd_fd_name(IOMMUFDBackend *be)
+{
+    return object_get_canonical_path_component(OBJECT(be));
+}
+
 static void iommufd_backend_init(Object *obj)
 {
     IOMMUFDBackend *be = IOMMUFD_BACKEND(obj);
@@ -64,11 +70,27 @@ static bool iommufd_backend_can_be_deleted(UserCreatable *uc)
     return !be->users;
 }
 
+static void iommufd_backend_complete(UserCreatable *uc, Error **errp)
+{
+    IOMMUFDBackend *be = IOMMUFD_BACKEND(uc);
+    const char *name = iommufd_fd_name(be);
+
+    if (!be->owned) {
+        /* fd came from the command line. Fetch updated value from cpr state. */
+        if (cpr_is_incoming()) {
+            be->fd = cpr_find_fd(name, 0);
+        } else {
+            cpr_save_fd(name, 0, be->fd);
+        }
+    }
+}
+
 static void iommufd_backend_class_init(ObjectClass *oc, const void *data)
 {
     UserCreatableClass *ucc = USER_CREATABLE_CLASS(oc);
 
     ucc->can_be_deleted = iommufd_backend_can_be_deleted;
+    ucc->complete = iommufd_backend_complete;
 
     object_class_property_add_str(oc, "fd", NULL, iommufd_backend_set_fd);
 }
@@ -102,7 +124,7 @@ bool iommufd_backend_connect(IOMMUFDBackend *be, Error **errp)
     int fd;
 
     if (be->owned && !be->users) {
-        fd = qemu_open("/dev/iommu", O_RDWR, errp);
+        fd = cpr_open_fd("/dev/iommu", O_RDWR, iommufd_fd_name(be), 0, errp);
         if (fd < 0) {
             return false;
         }
@@ -127,14 +149,15 @@ void iommufd_backend_disconnect(IOMMUFDBackend *be)
         goto out;
     }
     be->users--;
-    if (!be->users && be->owned) {
-        close(be->fd);
-        be->fd = -1;
-    }
-out:
     if (!be->users) {
         vfio_iommufd_cpr_unregister_iommufd(be);
+        if (be->owned) {
+            cpr_delete_fd(iommufd_fd_name(be), 0);
+            close(be->fd);
+            be->fd = -1;
+        }
     }
+out:
     trace_iommufd_backend_disconnect(be->fd, be->users);
 }
 
diff --git a/hw/vfio/cpr-iommufd.c b/hw/vfio/cpr-iommufd.c
index 4166201e3f..a72b68daa8 100644
--- a/hw/vfio/cpr-iommufd.c
+++ b/hw/vfio/cpr-iommufd.c
@@ -166,12 +166,18 @@ void vfio_iommufd_cpr_unregister_container(VFIOIOMMUFDContainer *container)
 void vfio_iommufd_cpr_register_device(VFIODevice *vbasedev)
 {
     if (!cpr_is_incoming()) {
+        /*
+         * Beware fd may have already been saved by vfio_device_set_fd,
+         * so call resave to avoid a duplicate entry.
+         */
+        cpr_resave_fd(vbasedev->name, 0, vbasedev->fd);
         vfio_cpr_save_device(vbasedev);
     }
 }
 
 void vfio_iommufd_cpr_unregister_device(VFIODevice *vbasedev)
 {
+    cpr_delete_fd(vbasedev->name, 0);
     vfio_cpr_delete_device(vbasedev->name);
 }
 
@@ -180,5 +186,9 @@ void vfio_cpr_load_device(VFIODevice *vbasedev)
     if (cpr_is_incoming()) {
         bool ret = vfio_cpr_find_device(vbasedev);
         g_assert(ret);
+
+        if (vbasedev->fd < 0) {
+            vbasedev->fd = cpr_find_fd(vbasedev->name, 0);
+        }
     }
 }
diff --git a/hw/vfio/device.c b/hw/vfio/device.c
index 0ae3f3c660..96cf21462c 100644
--- a/hw/vfio/device.c
+++ b/hw/vfio/device.c
@@ -351,14 +351,7 @@ void vfio_device_free_name(VFIODevice *vbasedev)
 
 void vfio_device_set_fd(VFIODevice *vbasedev, const char *str, Error **errp)
 {
-    ERRP_GUARD();
-    int fd = monitor_fd_param(monitor_cur(), str, errp);
-
-    if (fd < 0) {
-        error_prepend(errp, "Could not parse remote object fd %s:", str);
-        return;
-    }
-    vbasedev->fd = fd;
+    vbasedev->fd = cpr_get_fd_param(vbasedev->dev->id, str, 0, errp);
 }
 
 static VFIODeviceIOOps vfio_device_io_ops_ioctl;

From 4296ee07455e48c169eb110fbca6ef724c119381 Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Wed, 2 Jul 2025 14:58:53 -0700
Subject: [PATCH 1819/2760] vfio/iommufd: reconstruct device
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reconstruct userland device state after CPR.  During vfio_realize, skip all
ioctls that configure the device, as it was already configured in old QEMU.

Skip bind, and use the devid from CPR state.

Skip allocation of, and attachment to, ioas_id.  Recover ioas_id from CPR
state, and use it to find a matching container, if any, before creating a
new one.

This reconstruction is not complete.  hwpt_id is handled in a subsequent
patch.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Link: https://lore.kernel.org/qemu-devel/1751493538-202042-17-git-send-email-steven.sistare@oracle.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/iommufd.c | 30 ++++++++++++++++++++++++++++--
 1 file changed, 28 insertions(+), 2 deletions(-)

diff --git a/hw/vfio/iommufd.c b/hw/vfio/iommufd.c
index f0d57ea65f..a650517a1d 100644
--- a/hw/vfio/iommufd.c
+++ b/hw/vfio/iommufd.c
@@ -25,6 +25,7 @@
 #include "system/reset.h"
 #include "qemu/cutils.h"
 #include "qemu/chardev_open.h"
+#include "migration/cpr.h"
 #include "pci.h"
 #include "vfio-iommufd.h"
 #include "vfio-helpers.h"
@@ -121,6 +122,10 @@ static bool iommufd_cdev_connect_and_bind(VFIODevice *vbasedev, Error **errp)
         goto err_kvm_device_add;
     }
 
+    if (cpr_is_incoming()) {
+        goto skip_bind;
+    }
+
     /* Bind device to iommufd */
     bind.iommufd = iommufd->fd;
     if (ioctl(vbasedev->fd, VFIO_DEVICE_BIND_IOMMUFD, &bind)) {
@@ -132,6 +137,8 @@ static bool iommufd_cdev_connect_and_bind(VFIODevice *vbasedev, Error **errp)
     vbasedev->devid = bind.out_devid;
     trace_iommufd_cdev_connect_and_bind(bind.iommufd, vbasedev->name,
                                         vbasedev->fd, vbasedev->devid);
+
+skip_bind:
     return true;
 err_bind:
     iommufd_cdev_kvm_device_del(vbasedev);
@@ -421,7 +428,9 @@ static bool iommufd_cdev_attach_container(VFIODevice *vbasedev,
         return iommufd_cdev_autodomains_get(vbasedev, container, errp);
     }
 
-    return !iommufd_cdev_attach_ioas_hwpt(vbasedev, container->ioas_id, errp);
+    /* If CPR, we are already attached to ioas_id. */
+    return cpr_is_incoming() ||
+           !iommufd_cdev_attach_ioas_hwpt(vbasedev, container->ioas_id, errp);
 }
 
 static void iommufd_cdev_detach_container(VFIODevice *vbasedev,
@@ -510,6 +519,7 @@ static bool iommufd_cdev_attach(const char *name, VFIODevice *vbasedev,
     VFIOAddressSpace *space;
     struct vfio_device_info dev_info = { .argsz = sizeof(dev_info) };
     int ret, devfd;
+    bool res;
     uint32_t ioas_id;
     Error *err = NULL;
     const VFIOIOMMUClass *iommufd_vioc =
@@ -540,7 +550,16 @@ static bool iommufd_cdev_attach(const char *name, VFIODevice *vbasedev,
             vbasedev->iommufd != container->be) {
             continue;
         }
-        if (!iommufd_cdev_attach_container(vbasedev, container, &err)) {
+
+        if (!cpr_is_incoming()) {
+            res = iommufd_cdev_attach_container(vbasedev, container, &err);
+        } else if (vbasedev->cpr.ioas_id == container->ioas_id) {
+            res = true;
+        } else {
+            continue;
+        }
+
+        if (!res) {
             const char *msg = error_get_pretty(err);
 
             trace_iommufd_cdev_fail_attach_existing_container(msg);
@@ -557,6 +576,11 @@ static bool iommufd_cdev_attach(const char *name, VFIODevice *vbasedev,
         }
     }
 
+    if (cpr_is_incoming()) {
+        ioas_id = vbasedev->cpr.ioas_id;
+        goto skip_ioas_alloc;
+    }
+
     /* Need to allocate a new dedicated container */
     if (!iommufd_backend_alloc_ioas(vbasedev->iommufd, &ioas_id, errp)) {
         goto err_alloc_ioas;
@@ -564,10 +588,12 @@ static bool iommufd_cdev_attach(const char *name, VFIODevice *vbasedev,
 
     trace_iommufd_cdev_alloc_ioas(vbasedev->iommufd->fd, ioas_id);
 
+skip_ioas_alloc:
     container = VFIO_IOMMU_IOMMUFD(object_new(TYPE_VFIO_IOMMU_IOMMUFD));
     container->be = vbasedev->iommufd;
     container->ioas_id = ioas_id;
     QLIST_INIT(&container->hwpt_list);
+    vbasedev->cpr.ioas_id = ioas_id;
 
     bcontainer = &container->bcontainer;
     vfio_address_space_insert(space, bcontainer);

From 010643eeb1521c0240c83ee8678544de0cd30b78 Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Wed, 2 Jul 2025 14:58:54 -0700
Subject: [PATCH 1820/2760] vfio/iommufd: reconstruct hwpt
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Skip allocation of, and attachment to, hwpt_id.  Recover it from CPR state.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Link: https://lore.kernel.org/qemu-devel/1751493538-202042-18-git-send-email-steven.sistare@oracle.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/iommufd.c | 30 ++++++++++++++++++++++--------
 1 file changed, 22 insertions(+), 8 deletions(-)

diff --git a/hw/vfio/iommufd.c b/hw/vfio/iommufd.c
index a650517a1d..48c590b6a9 100644
--- a/hw/vfio/iommufd.c
+++ b/hw/vfio/iommufd.c
@@ -332,7 +332,14 @@ static bool iommufd_cdev_autodomains_get(VFIODevice *vbasedev,
 
     /* Try to find a domain */
     QLIST_FOREACH(hwpt, &container->hwpt_list, next) {
-        ret = iommufd_cdev_attach_ioas_hwpt(vbasedev, hwpt->hwpt_id, errp);
+        if (!cpr_is_incoming()) {
+            ret = iommufd_cdev_attach_ioas_hwpt(vbasedev, hwpt->hwpt_id, errp);
+        } else if (vbasedev->cpr.hwpt_id == hwpt->hwpt_id) {
+            ret = 0;
+        } else {
+            continue;
+        }
+
         if (ret) {
             /* -EINVAL means the domain is incompatible with the device. */
             if (ret == -EINVAL) {
@@ -349,6 +356,7 @@ static bool iommufd_cdev_autodomains_get(VFIODevice *vbasedev,
             return false;
         } else {
             vbasedev->hwpt = hwpt;
+            vbasedev->cpr.hwpt_id = hwpt->hwpt_id;
             QLIST_INSERT_HEAD(&hwpt->device_list, vbasedev, hwpt_next);
             vbasedev->iommu_dirty_tracking = iommufd_hwpt_dirty_tracking(hwpt);
             return true;
@@ -371,6 +379,11 @@ static bool iommufd_cdev_autodomains_get(VFIODevice *vbasedev,
         flags = IOMMU_HWPT_ALLOC_DIRTY_TRACKING;
     }
 
+    if (cpr_is_incoming()) {
+        hwpt_id = vbasedev->cpr.hwpt_id;
+        goto skip_alloc;
+    }
+
     if (!iommufd_backend_alloc_hwpt(iommufd, vbasedev->devid,
                                     container->ioas_id, flags,
                                     IOMMU_HWPT_DATA_NONE, 0, NULL,
@@ -378,19 +391,20 @@ static bool iommufd_cdev_autodomains_get(VFIODevice *vbasedev,
         return false;
     }
 
+    ret = iommufd_cdev_attach_ioas_hwpt(vbasedev, hwpt_id, errp);
+    if (ret) {
+        iommufd_backend_free_id(container->be, hwpt_id);
+        return false;
+    }
+
+skip_alloc:
     hwpt = g_malloc0(sizeof(*hwpt));
     hwpt->hwpt_id = hwpt_id;
     hwpt->hwpt_flags = flags;
     QLIST_INIT(&hwpt->device_list);
 
-    ret = iommufd_cdev_attach_ioas_hwpt(vbasedev, hwpt->hwpt_id, errp);
-    if (ret) {
-        iommufd_backend_free_id(container->be, hwpt->hwpt_id);
-        g_free(hwpt);
-        return false;
-    }
-
     vbasedev->hwpt = hwpt;
+    vbasedev->cpr.hwpt_id = hwpt->hwpt_id;
     vbasedev->iommu_dirty_tracking = iommufd_hwpt_dirty_tracking(hwpt);
     QLIST_INSERT_HEAD(&hwpt->device_list, vbasedev, hwpt_next);
     QLIST_INSERT_HEAD(&container->hwpt_list, hwpt, next);

From 5c066c4be2328c46f03e9166ea720b13bf68ea5d Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Wed, 2 Jul 2025 14:58:55 -0700
Subject: [PATCH 1821/2760] vfio/iommufd: change process
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Finish CPR by change the owning process of the iommufd device in
post load.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Link: https://lore.kernel.org/qemu-devel/1751493538-202042-19-git-send-email-steven.sistare@oracle.com
[ clg: Fixed missing "qemu/error-report.h" include ]
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/cpr-iommufd.c | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/hw/vfio/cpr-iommufd.c b/hw/vfio/cpr-iommufd.c
index a72b68daa8..148a06d552 100644
--- a/hw/vfio/cpr-iommufd.c
+++ b/hw/vfio/cpr-iommufd.c
@@ -5,6 +5,7 @@
  */
 
 #include "qemu/osdep.h"
+#include "qemu/error-report.h"
 #include "qapi/error.h"
 #include "hw/vfio/vfio-cpr.h"
 #include "hw/vfio/vfio-device.h"
@@ -112,10 +113,40 @@ static bool vfio_cpr_supported(IOMMUFDBackend *be, Error **errp)
     return true;
 }
 
+static int iommufd_cpr_pre_save(void *opaque)
+{
+    IOMMUFDBackend *be = opaque;
+
+    /*
+     * The process has not changed yet, but proactively try the ioctl,
+     * and it will fail if any DMA mappings are not supported.
+     */
+    if (!iommufd_change_process_capable(be)) {
+        error_report("some memory regions do not support "
+                     "IOMMU_IOAS_CHANGE_PROCESS");
+        return -1;
+    }
+    return 0;
+}
+
+static int iommufd_cpr_post_load(void *opaque, int version_id)
+{
+     IOMMUFDBackend *be = opaque;
+     Error *local_err = NULL;
+
+     if (!iommufd_change_process(be, &local_err)) {
+        error_report_err(local_err);
+        return -1;
+     }
+     return 0;
+}
+
 static const VMStateDescription iommufd_cpr_vmstate = {
     .name = "iommufd",
     .version_id = 0,
     .minimum_version_id = 0,
+    .pre_save = iommufd_cpr_pre_save,
+    .post_load = iommufd_cpr_post_load,
     .needed = cpr_incoming_needed,
     .fields = (VMStateField[]) {
         VMSTATE_END_OF_LIST()

From 6ff4cccd13155e718e630fe16a72d3cc9decde3b Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Wed, 2 Jul 2025 14:58:56 -0700
Subject: [PATCH 1822/2760] iommufd: preserve DMA mappings
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

During cpr-transfer load in new QEMU, the vfio_memory_listener causes
spurious calls to map and unmap DMA regions, as devices are created and
the address space is built.  This memory was already already mapped by the
device in old QEMU, so suppress the map and unmap callbacks during incoming
CPR.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Link: https://lore.kernel.org/qemu-devel/1751493538-202042-20-git-send-email-steven.sistare@oracle.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 backends/iommufd.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/backends/iommufd.c b/backends/iommufd.c
index e0917923bf..2a33c7ab0b 100644
--- a/backends/iommufd.c
+++ b/backends/iommufd.c
@@ -245,6 +245,10 @@ int iommufd_backend_map_file_dma(IOMMUFDBackend *be, uint32_t ioas_id,
         .length = size,
     };
 
+    if (cpr_is_incoming()) {
+        return 0;
+    }
+
     if (!readonly) {
         map.flags |= IOMMU_IOAS_MAP_WRITEABLE;
     }
@@ -274,6 +278,10 @@ int iommufd_backend_unmap_dma(IOMMUFDBackend *be, uint32_t ioas_id,
         .length = size,
     };
 
+    if (cpr_is_incoming()) {
+        return 0;
+    }
+
     ret = ioctl(fd, IOMMU_IOAS_UNMAP, &unmap);
     /*
      * IOMMUFD takes mapping as some kind of object, unmapping

From 99cedd5d552130b9b27743c40ca9012e1f4f0371 Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Wed, 2 Jul 2025 14:58:57 -0700
Subject: [PATCH 1823/2760] vfio/container: delete old cpr register
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

vfio_cpr_[un]register_container is no longer used since they were
subsumed by container type-specific registration.  Delete them.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/1751493538-202042-21-git-send-email-steven.sistare@oracle.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/cpr.c              | 13 -------------
 include/hw/vfio/vfio-cpr.h |  4 ----
 2 files changed, 17 deletions(-)

diff --git a/hw/vfio/cpr.c b/hw/vfio/cpr.c
index 0e903cdd2f..af0f12a7ad 100644
--- a/hw/vfio/cpr.c
+++ b/hw/vfio/cpr.c
@@ -29,19 +29,6 @@ int vfio_cpr_reboot_notifier(NotifierWithReturn *notifier,
     return 0;
 }
 
-bool vfio_cpr_register_container(VFIOContainerBase *bcontainer, Error **errp)
-{
-    migration_add_notifier_mode(&bcontainer->cpr_reboot_notifier,
-                                vfio_cpr_reboot_notifier,
-                                MIG_MODE_CPR_REBOOT);
-    return true;
-}
-
-void vfio_cpr_unregister_container(VFIOContainerBase *bcontainer)
-{
-    migration_remove_notifier(&bcontainer->cpr_reboot_notifier);
-}
-
 #define STRDUP_VECTOR_FD_NAME(vdev, name)   \
     g_strdup_printf("%s_%s", (vdev)->vbasedev.name, (name))
 
diff --git a/include/hw/vfio/vfio-cpr.h b/include/hw/vfio/vfio-cpr.h
index 2878372495..80ad20d216 100644
--- a/include/hw/vfio/vfio-cpr.h
+++ b/include/hw/vfio/vfio-cpr.h
@@ -45,10 +45,6 @@ void vfio_legacy_cpr_unregister_container(struct VFIOContainer *container);
 int vfio_cpr_reboot_notifier(NotifierWithReturn *notifier, MigrationEvent *e,
                              Error **errp);
 
-bool vfio_cpr_register_container(struct VFIOContainerBase *bcontainer,
-                                 Error **errp);
-void vfio_cpr_unregister_container(struct VFIOContainerBase *bcontainer);
-
 bool vfio_iommufd_cpr_register_container(struct VFIOIOMMUFDContainer *container,
                                          Error **errp);
 void vfio_iommufd_cpr_unregister_container(

From 7437caad2052d920452ff7b9b7bc84f5e8e55c90 Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Wed, 2 Jul 2025 14:58:58 -0700
Subject: [PATCH 1824/2760] vfio: doc changes for cpr
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Update documentation to say that cpr-transfer supports vfio and iommufd.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/qemu-devel/1751493538-202042-22-git-send-email-steven.sistare@oracle.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 docs/devel/migration/CPR.rst | 5 ++---
 qapi/migration.json          | 6 ++++--
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/docs/devel/migration/CPR.rst b/docs/devel/migration/CPR.rst
index 7897873c86..0a0fd4f6dc 100644
--- a/docs/devel/migration/CPR.rst
+++ b/docs/devel/migration/CPR.rst
@@ -152,8 +152,7 @@ cpr-transfer mode
 This mode allows the user to transfer a guest to a new QEMU instance
 on the same host with minimal guest pause time, by preserving guest
 RAM in place, albeit with new virtual addresses in new QEMU.  Devices
-and their pinned memory pages will also be preserved in a future QEMU
-release.
+and their pinned memory pages are also preserved for VFIO and IOMMUFD.
 
 The user starts new QEMU on the same host as old QEMU, with command-
 line arguments to create the same machine, plus the ``-incoming``
@@ -322,6 +321,6 @@ Futures
 
 cpr-transfer mode is based on a capability to transfer open file
 descriptors from old to new QEMU.  In the future, descriptors for
-vfio, iommufd, vhost, and char devices could be transferred,
+vhost, and char devices could be transferred,
 preserving those devices and their kernel state without interruption,
 even if they do not explicitly support live migration.
diff --git a/qapi/migration.json b/qapi/migration.json
index 4963f6ca12..e8a7d3b2a9 100644
--- a/qapi/migration.json
+++ b/qapi/migration.json
@@ -620,8 +620,10 @@
 #
 # @cpr-transfer: This mode allows the user to transfer a guest to a
 #     new QEMU instance on the same host with minimal guest pause
-#     time by preserving guest RAM in place.  Devices and their pinned
-#     pages will also be preserved in a future QEMU release.
+#     time by preserving guest RAM in place.
+#
+#     Devices and their pinned pages are also preserved for VFIO and
+#     IOMMUFD. (since 10.1)
 #
 #     The user starts new QEMU on the same host as old QEMU, with
 #     command-line arguments to create the same machine, plus the

From 6888a4a9c8601005a2329fee6487c3c0df1348c0 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Thu, 3 Jul 2025 13:24:00 +0800
Subject: [PATCH 1825/2760] aspeed: Deprecate the ast2700a0-evb machine
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The ast2700a0-evb machine represents the first revision of the AST2700 and
serves as the initial engineering sample rather than a production version.
A newer revision, A1, is now supported, and the ast2700a1-evb should replace
the older A0 version.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250703052400.2927831-1-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 docs/about/deprecated.rst | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst
index 42037131de..5a3ed71a64 100644
--- a/docs/about/deprecated.rst
+++ b/docs/about/deprecated.rst
@@ -315,6 +315,14 @@ deprecated; use the new name ``dtb-randomness`` instead. The new name
 better reflects the way this property affects all random data within
 the device tree blob, not just the ``kaslr-seed`` node.
 
+Arm ``ast2700a0-evb`` machine (since 10.1)
+''''''''''''''''''''''''''''''''''''''''''
+
+The ``ast2700a0-evb`` machine represents the first revision of the AST2700
+and serves as the initial engineering sample rather than a production version.
+A newer revision, A1, is now supported, and the ``ast2700a1-evb`` should
+replace the older A0 version.
+
 Mips ``mipssim`` machine (since 10.0)
 '''''''''''''''''''''''''''''''''''''
 

From 92096685a00414a813aa4735db1706e4e5c6917d Mon Sep 17 00:00:00 2001
From: Ed Tanous <etanous@nvidia.com>
Date: Thu, 3 Jul 2025 07:42:46 -0700
Subject: [PATCH 1826/2760] hw/arm/aspeed: Add second SPI chip to Aspeed model
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Aspeed2600 has two spi lanes;  Add a new struct that can mount the
second SPI.

Signed-off-by: Ed Tanous <etanous@nvidia.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250703144249.3348879-2-etanous@nvidia.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed.c         | 2 ++
 include/hw/arm/aspeed.h | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index 94897505f8..8d7757e11f 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -465,6 +465,8 @@ static void aspeed_machine_init(MachineState *machine)
         aspeed_board_init_flashes(&bmc->soc->spi[0],
                               bmc->spi_model ? bmc->spi_model : amc->spi_model,
                               1, amc->num_cs);
+        aspeed_board_init_flashes(&bmc->soc->spi[1],
+                                  amc->spi2_model, 1, amc->num_cs2);
     }
 
     if (machine->kernel_filename && sc->num_cpus > 1) {
diff --git a/include/hw/arm/aspeed.h b/include/hw/arm/aspeed.h
index 973277bea6..6c36455656 100644
--- a/include/hw/arm/aspeed.h
+++ b/include/hw/arm/aspeed.h
@@ -35,7 +35,9 @@ struct AspeedMachineClass {
     uint32_t hw_strap2;
     const char *fmc_model;
     const char *spi_model;
+    const char *spi2_model;
     uint32_t num_cs;
+    uint32_t num_cs2;
     uint32_t macs_mask;
     void (*i2c_init)(AspeedMachineState *bmc);
     uint32_t uart_default;

From ad8e0e8a0088b8e30582c65b739a7ee8bb0d71ee Mon Sep 17 00:00:00 2001
From: Ed Tanous <etanous@nvidia.com>
Date: Thu, 3 Jul 2025 07:42:47 -0700
Subject: [PATCH 1827/2760] docs: add support for gb200-bmc
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This patch updates the docs for support of gb200-bmc.

Signed-off-by: Ed Tanous <etanous@nvidia.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250703144249.3348879-3-etanous@nvidia.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 docs/system/arm/aspeed.rst | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/system/arm/aspeed.rst b/docs/system/arm/aspeed.rst
index 43d27d83cb..bec0a1dfa8 100644
--- a/docs/system/arm/aspeed.rst
+++ b/docs/system/arm/aspeed.rst
@@ -1,5 +1,4 @@
-Aspeed family boards (``ast2500-evb``, ``ast2600-evb``, ``ast2700-evb``, ``bletchley-bmc``, ``fuji-bmc``, ``fby35-bmc``, ``fp5280g2-bmc``, ``g220a-bmc``, ``palmetto-bmc``, ``qcom-dc-scm-v1-bmc``, ``qcom-firework-bmc``, ``quanta-q71l-bmc``, ``rainier-bmc``, ``romulus-bmc``, ``sonorapass-bmc``, ``supermicrox11-bmc``, ``supermicrox11spi-bmc``, ``tiogapass-bmc``, ``witherspoon-bmc``, ``yosemitev2-bmc``)
-=================================================================================================================================================================================================================================================================================================================================================================================================================================
+Aspeed family boards (``ast2500-evb``, ``ast2600-evb``, ``ast2700-evb``, ``bletchley-bmc``, ``fuji-bmc``, ``gb200nvl-bmc``, ``fby35-bmc``, ``fp5280g2-bmc``, ``g220a-bmc``, ``palmetto-bmc``, ``qcom-dc-scm-v1-bmc``, ``qcom-firework-bmc``, ``quanta-q71l-bmc``, ``rainier-bmc``, ``romulus-bmc``, ``sonorapass-bmc``, ``supermicrox11-bmc``, ``supermicrox11spi-bmc``, ``tiogapass-bmc``, ``witherspoon-bmc``, ``yosemitev2-bmc``)
 
 The QEMU Aspeed machines model BMCs of various OpenPOWER systems and
 Aspeed evaluation boards. They are based on different releases of the
@@ -35,6 +34,7 @@ AST2600 SoC based machines :
 - ``fuji-bmc``             Facebook Fuji BMC
 - ``bletchley-bmc``        Facebook Bletchley BMC
 - ``fby35-bmc``            Facebook fby35 BMC
+- ``gb200nvl-bmc``         Nvidia GB200nvl BMC
 - ``qcom-dc-scm-v1-bmc``   Qualcomm DC-SCM V1 BMC
 - ``qcom-firework-bmc``    Qualcomm Firework BMC
 

From becfaa10a2b554ac619fdd9ae0aa9cacdba73d67 Mon Sep 17 00:00:00 2001
From: Ed Tanous <etanous@nvidia.com>
Date: Thu, 3 Jul 2025 07:42:48 -0700
Subject: [PATCH 1828/2760] hw/arm/aspeed: Add GB200 BMC target
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

GB200nvl72 is a system for for accelerated compute.  This is a model for
the BMC target within the system.

This is based on the device tree aspeed-bmc-nvidia-gb200nvl-bmc.dts
from:

[1] https://github.com/openbmc/linux/blob/dev-6.6/arch/arm/boot/dts/aspeed/aspeed-bmc-nvidia-gb200nvl-bmc.dts

Signed-off-by: Ed Tanous <etanous@nvidia.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250703144249.3348879-4-etanous@nvidia.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed.c        | 78 ++++++++++++++++++++++++++++++++++++++++++
 hw/arm/aspeed_eeprom.c | 21 ++++++++++++
 hw/arm/aspeed_eeprom.h |  3 ++
 3 files changed, 102 insertions(+)

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index 8d7757e11f..c31bbe7701 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -201,6 +201,10 @@ struct AspeedMachineState {
 #define BLETCHLEY_BMC_HW_STRAP1 0x00002000
 #define BLETCHLEY_BMC_HW_STRAP2 0x00000801
 
+/* GB200NVL hardware value */
+#define GB200NVL_BMC_HW_STRAP1 AST2600_EVB_HW_STRAP1
+#define GB200NVL_BMC_HW_STRAP2 AST2600_EVB_HW_STRAP2
+
 /* Qualcomm DC-SCM hardware value */
 #define QCOM_DC_SCM_V1_BMC_HW_STRAP1  0x00000000
 #define QCOM_DC_SCM_V1_BMC_HW_STRAP2  0x00000041
@@ -647,6 +651,12 @@ static void create_pca9552(AspeedSoCState *soc, int bus_id, int addr)
                             TYPE_PCA9552, addr);
 }
 
+static I2CSlave *create_pca9554(AspeedSoCState *soc, int bus_id, int addr)
+{
+    return i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, bus_id),
+                            TYPE_PCA9554, addr);
+}
+
 static void sonorapass_bmc_i2c_init(AspeedMachineState *bmc)
 {
     AspeedSoCState *soc = bmc->soc;
@@ -1226,6 +1236,45 @@ static void bletchley_bmc_i2c_init(AspeedMachineState *bmc)
     i2c_slave_create_simple(i2c[12], TYPE_PCA9552, 0x67);
 }
 
+
+static void gb200nvl_bmc_i2c_init(AspeedMachineState *bmc)
+{
+    AspeedSoCState *soc = bmc->soc;
+    I2CBus *i2c[15] = {};
+    DeviceState *dev;
+    for (int i = 0; i < sizeof(i2c) / sizeof(i2c[0]); i++) {
+        if ((i == 11) || (i == 12) || (i == 13)) {
+            continue;
+        }
+        i2c[i] = aspeed_i2c_get_bus(&soc->i2c, i);
+    }
+
+    /* Bus 5 Expander */
+    create_pca9554(soc, 4, 0x21);
+
+    /* Mux I2c Expanders */
+    i2c_slave_create_simple(i2c[5], "pca9546", 0x71);
+    i2c_slave_create_simple(i2c[5], "pca9546", 0x72);
+    i2c_slave_create_simple(i2c[5], "pca9546", 0x73);
+    i2c_slave_create_simple(i2c[5], "pca9546", 0x75);
+    i2c_slave_create_simple(i2c[5], "pca9546", 0x76);
+    i2c_slave_create_simple(i2c[5], "pca9546", 0x77);
+
+    /* Bus 10 */
+    dev = DEVICE(create_pca9554(soc, 9, 0x20));
+
+    /* Set FPGA_READY */
+    object_property_set_str(OBJECT(dev), "pin1", "high", &error_fatal);
+
+    create_pca9554(soc, 9, 0x21);
+    at24c_eeprom_init(i2c[9], 0x50, 64 * KiB);
+    at24c_eeprom_init(i2c[9], 0x51, 64 * KiB);
+
+    /* Bus 11 */
+    at24c_eeprom_init_rom(i2c[10], 0x50, 256, gb200nvl_bmc_fruid,
+                          gb200nvl_bmc_fruid_len);
+}
+
 static void fby35_i2c_init(AspeedMachineState *bmc)
 {
     AspeedSoCState *soc = bmc->soc;
@@ -1782,6 +1831,31 @@ static void aspeed_machine_catalina_class_init(ObjectClass *oc,
     aspeed_machine_ast2600_class_emmc_init(oc);
 }
 
+#define GB200NVL_BMC_RAM_SIZE ASPEED_RAM_SIZE(1 * GiB)
+
+static void aspeed_machine_gb200nvl_class_init(ObjectClass *oc,
+                                               const void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
+
+    mc->desc       = "Nvidia GB200NVL BMC (Cortex-A7)";
+    amc->soc_name  = "ast2600-a3";
+    amc->hw_strap1 = GB200NVL_BMC_HW_STRAP1;
+    amc->hw_strap2 = GB200NVL_BMC_HW_STRAP2;
+    amc->fmc_model = "mx66u51235f";
+    amc->spi_model = "mx66u51235f";
+    amc->num_cs    = 2;
+
+    amc->spi2_model = "mx66u51235f";
+    amc->num_cs2   = 1;
+    amc->macs_mask = ASPEED_MAC0_ON | ASPEED_MAC1_ON;
+    amc->i2c_init  = gb200nvl_bmc_i2c_init;
+    mc->default_ram_size = GB200NVL_BMC_RAM_SIZE;
+    aspeed_machine_class_init_cpus_defaults(mc);
+    aspeed_machine_ast2600_class_emmc_init(oc);
+}
+
 static void fby35_reset(MachineState *state, ResetType type)
 {
     AspeedMachineState *bmc = ASPEED_MACHINE(state);
@@ -2074,6 +2148,10 @@ static const TypeInfo aspeed_machine_types[] = {
         .name          = MACHINE_TYPE_NAME("bletchley-bmc"),
         .parent        = TYPE_ASPEED_MACHINE,
         .class_init    = aspeed_machine_bletchley_class_init,
+    }, {
+        .name          = MACHINE_TYPE_NAME("gb200nvl-bmc"),
+        .parent        = TYPE_ASPEED_MACHINE,
+        .class_init    = aspeed_machine_gb200nvl_class_init,
     }, {
         .name          = MACHINE_TYPE_NAME("catalina-bmc"),
         .parent        = TYPE_ASPEED_MACHINE,
diff --git a/hw/arm/aspeed_eeprom.c b/hw/arm/aspeed_eeprom.c
index daa3d329d1..8bbbdec834 100644
--- a/hw/arm/aspeed_eeprom.c
+++ b/hw/arm/aspeed_eeprom.c
@@ -162,6 +162,25 @@ const uint8_t rainier_bmc_fruid[] = {
     0x31, 0x50, 0x46, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00,
 };
 
+const uint8_t gb200nvl_bmc_fruid[] = {
+    0x01, 0x00, 0x00, 0x01, 0x0b, 0x00, 0x00, 0xf3, 0x01, 0x0a, 0x19, 0x1f,
+    0x0f, 0xe6, 0xc6, 0x4e, 0x56, 0x49, 0x44, 0x49, 0x41, 0xc5, 0x50, 0x33,
+    0x38, 0x30, 0x39, 0xcd, 0x31, 0x35, 0x38, 0x33, 0x33, 0x32, 0x34, 0x38,
+    0x30, 0x30, 0x31, 0x35, 0x30, 0xd2, 0x36, 0x39, 0x39, 0x2d, 0x31, 0x33,
+    0x38, 0x30, 0x39, 0x2d, 0x30, 0x34, 0x30, 0x34, 0x2d, 0x36, 0x30, 0x30,
+    0xc0, 0x01, 0x01, 0xd6, 0x4d, 0x41, 0x43, 0x3a, 0x20, 0x33, 0x43, 0x3a,
+    0x36, 0x44, 0x3a, 0x36, 0x36, 0x3a, 0x31, 0x34, 0x3a, 0x43, 0x38, 0x3a,
+    0x37, 0x41, 0xc1, 0x3b, 0x01, 0x09, 0x19, 0xc6, 0x4e, 0x56, 0x49, 0x44,
+    0x49, 0x41, 0xc9, 0x50, 0x33, 0x38, 0x30, 0x39, 0x2d, 0x42, 0x4d, 0x43,
+    0xd2, 0x36, 0x39, 0x39, 0x2d, 0x31, 0x33, 0x38, 0x30, 0x39, 0x2d, 0x30,
+    0x34, 0x30, 0x34, 0x2d, 0x36, 0x30, 0x30, 0xc4, 0x41, 0x45, 0x2e, 0x31,
+    0xcd, 0x31, 0x35, 0x38, 0x33, 0x33, 0x32, 0x34, 0x38, 0x30, 0x30, 0x31,
+    0x35, 0x30, 0xc0, 0xc4, 0x76, 0x30, 0x2e, 0x31, 0xc1, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0xb4, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+
+};
+
 const size_t tiogapass_bmc_fruid_len = sizeof(tiogapass_bmc_fruid);
 const size_t fby35_nic_fruid_len = sizeof(fby35_nic_fruid);
 const size_t fby35_bb_fruid_len = sizeof(fby35_bb_fruid);
@@ -169,3 +188,5 @@ const size_t fby35_bmc_fruid_len = sizeof(fby35_bmc_fruid);
 const size_t yosemitev2_bmc_fruid_len = sizeof(yosemitev2_bmc_fruid);
 const size_t rainier_bb_fruid_len = sizeof(rainier_bb_fruid);
 const size_t rainier_bmc_fruid_len = sizeof(rainier_bmc_fruid);
+const size_t gb200nvl_bmc_fruid_len = sizeof(gb200nvl_bmc_fruid);
+
diff --git a/hw/arm/aspeed_eeprom.h b/hw/arm/aspeed_eeprom.h
index f08c16ef50..3ed9bc1d9a 100644
--- a/hw/arm/aspeed_eeprom.h
+++ b/hw/arm/aspeed_eeprom.h
@@ -26,4 +26,7 @@ extern const size_t rainier_bb_fruid_len;
 extern const uint8_t rainier_bmc_fruid[];
 extern const size_t rainier_bmc_fruid_len;
 
+extern const uint8_t gb200nvl_bmc_fruid[];
+extern const size_t gb200nvl_bmc_fruid_len;
+
 #endif

From 3a34dad2c0d25cebafed40696bbbdeb7ff4b9c7d Mon Sep 17 00:00:00 2001
From: Ed Tanous <etanous@nvidia.com>
Date: Thu, 3 Jul 2025 07:42:49 -0700
Subject: [PATCH 1829/2760] tests/functional: Add gb200 tests
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

To support the newly added gb200 machine, add appropriate tests and
extend do_test_arm_aspeed_openbmc() to support the hostname of this
new system: "gb200nvl-obmc".

Signed-off-by: Ed Tanous <etanous@nvidia.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250703144249.3348879-5-etanous@nvidia.com
[ clg: Adjust commit log to document do_test_arm_aspeed_openbmc() change ]
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 tests/functional/aspeed.py                    |  9 +++++--
 tests/functional/meson.build                  |  2 ++
 .../test_arm_aspeed_gb200nvl_bmc.py           | 26 +++++++++++++++++++
 3 files changed, 35 insertions(+), 2 deletions(-)
 create mode 100644 tests/functional/test_arm_aspeed_gb200nvl_bmc.py

diff --git a/tests/functional/aspeed.py b/tests/functional/aspeed.py
index 7a40d5dda7..b131703c52 100644
--- a/tests/functional/aspeed.py
+++ b/tests/functional/aspeed.py
@@ -8,8 +8,13 @@ from qemu_test import LinuxKernelTest
 class AspeedTest(LinuxKernelTest):
 
     def do_test_arm_aspeed_openbmc(self, machine, image, uboot='2019.04',
-                                   cpu_id='0x0', soc='AST2500 rev A1'):
-        hostname = machine.removesuffix('-bmc')
+                                   cpu_id='0x0', soc='AST2500 rev A1',
+                                   image_hostname=None):
+        # Allow for the image hostname to not end in "-bmc"
+        if image_hostname is not None:
+            hostname = image_hostname
+        else:
+            hostname = machine.removesuffix('-bmc')
 
         self.set_machine(machine)
         self.vm.set_console()
diff --git a/tests/functional/meson.build b/tests/functional/meson.build
index fb87b957aa..050c9000b9 100644
--- a/tests/functional/meson.build
+++ b/tests/functional/meson.build
@@ -33,6 +33,7 @@ test_timeouts = {
   'arm_aspeed_ast2600' : 1200,
   'arm_aspeed_bletchley' : 480,
   'arm_aspeed_catalina' : 480,
+  'arm_aspeed_gb200nvl_bmc' : 480,
   'arm_aspeed_rainier' : 480,
   'arm_bpim2u' : 500,
   'arm_collie' : 180,
@@ -129,6 +130,7 @@ tests_arm_system_thorough = [
   'arm_aspeed_ast2600',
   'arm_aspeed_bletchley',
   'arm_aspeed_catalina',
+  'arm_aspeed_gb200nvl_bmc',
   'arm_aspeed_rainier',
   'arm_bpim2u',
   'arm_canona1100',
diff --git a/tests/functional/test_arm_aspeed_gb200nvl_bmc.py b/tests/functional/test_arm_aspeed_gb200nvl_bmc.py
new file mode 100644
index 0000000000..8e8e3f05c1
--- /dev/null
+++ b/tests/functional/test_arm_aspeed_gb200nvl_bmc.py
@@ -0,0 +1,26 @@
+#!/usr/bin/env python3
+#
+# Functional test that boots the ASPEED machines
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+from qemu_test import Asset
+from aspeed import AspeedTest
+
+
+class GB200Machine(AspeedTest):
+
+    ASSET_GB200_FLASH = Asset(
+        'https://github.com/legoater/qemu-aspeed-boot/raw/refs/heads/master/images/gb200nvl-obmc/obmc-phosphor-image-gb200nvl-obmc-20250702182348.static.mtd.xz',
+        'b84819317cb3dc762895ad507705978ef000bfc77c50c33a63bdd37921db0dbc')
+
+    def test_arm_aspeed_gb200_openbmc(self):
+        image_path = self.uncompress(self.ASSET_GB200_FLASH)
+
+        self.do_test_arm_aspeed_openbmc('gb200nvl-bmc', image=image_path,
+                                        uboot='2019.04', cpu_id='0xf00',
+                                        soc='AST2600 rev A3',
+                                        image_hostname='gb200nvl-obmc')
+
+if __name__ == '__main__':
+    AspeedTest.main()

From d30245d3f54187d5ef4fbc9013386b98b22da2b5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 19 Jun 2025 07:56:13 +0200
Subject: [PATCH 1830/2760] system/cpus: Assert interrupt handling is done with
 BQL locked
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Message-Id: <20250703173248.44995-5-philmd@linaro.org>
---
 accel/tcg/tcg-accel-ops.c | 2 --
 system/cpus.c             | 2 ++
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/accel/tcg/tcg-accel-ops.c b/accel/tcg/tcg-accel-ops.c
index b24d6a7562..6116644d1c 100644
--- a/accel/tcg/tcg-accel-ops.c
+++ b/accel/tcg/tcg-accel-ops.c
@@ -93,8 +93,6 @@ static void tcg_cpu_reset_hold(CPUState *cpu)
 /* mask must never be zero, except for A20 change call */
 void tcg_handle_interrupt(CPUState *cpu, int mask)
 {
-    g_assert(bql_locked());
-
     cpu->interrupt_request |= mask;
 
     /*
diff --git a/system/cpus.c b/system/cpus.c
index d16b0dff98..a43e0e4e79 100644
--- a/system/cpus.c
+++ b/system/cpus.c
@@ -265,6 +265,8 @@ static void generic_handle_interrupt(CPUState *cpu, int mask)
 
 void cpu_interrupt(CPUState *cpu, int mask)
 {
+    g_assert(bql_locked());
+
     if (cpus_accel->handle_interrupt) {
         cpus_accel->handle_interrupt(cpu, mask);
     } else {

From f3fc87a14b601e7af727f556cf5a50df44d69839 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 16 Jun 2025 14:15:52 +0200
Subject: [PATCH 1831/2760] accel/kvm: Remove kvm_init_cpu_signals() stub
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since commit 57038a92bb0 ("cpus: extract out kvm-specific code
to accel/kvm") the kvm_init_cpu_signals() stub is not necessary.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Message-Id: <20250703173248.44995-6-philmd@linaro.org>
---
 accel/stubs/kvm-stub.c | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/accel/stubs/kvm-stub.c b/accel/stubs/kvm-stub.c
index ecfd7636f5..b9b4427c91 100644
--- a/accel/stubs/kvm-stub.c
+++ b/accel/stubs/kvm-stub.c
@@ -105,11 +105,6 @@ unsigned int kvm_get_free_memslots(void)
     return 0;
 }
 
-void kvm_init_cpu_signals(CPUState *cpu)
-{
-    abort();
-}
-
 bool kvm_arm_supports_user_irq(void)
 {
     return false;

From 06810394fdc013037811e317501902ed6ab9c276 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 17 Jun 2025 07:02:17 +0200
Subject: [PATCH 1832/2760] accel/kvm: Reduce kvm_create_vcpu() declaration
 scope
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

kvm_create_vcpu() is only used within the same file unit.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Message-Id: <20250703173248.44995-7-philmd@linaro.org>
---
 accel/kvm/kvm-all.c  | 8 +++++++-
 include/system/kvm.h | 8 --------
 2 files changed, 7 insertions(+), 9 deletions(-)

diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index d095d1b98f..17235f2646 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -453,7 +453,13 @@ static void kvm_reset_parked_vcpus(KVMState *s)
     }
 }
 
-int kvm_create_vcpu(CPUState *cpu)
+/**
+ * kvm_create_vcpu - Gets a parked KVM vCPU or creates a KVM vCPU
+ * @cpu: QOM CPUState object for which KVM vCPU has to be fetched/created.
+ *
+ * @returns: 0 when success, errno (<0) when failed.
+ */
+static int kvm_create_vcpu(CPUState *cpu)
 {
     unsigned long vcpu_id = kvm_arch_vcpu_id(cpu);
     KVMState *s = kvm_state;
diff --git a/include/system/kvm.h b/include/system/kvm.h
index 7cc60d26f2..e943df2c09 100644
--- a/include/system/kvm.h
+++ b/include/system/kvm.h
@@ -316,14 +316,6 @@ int kvm_create_device(KVMState *s, uint64_t type, bool test);
  */
 bool kvm_device_supported(int vmfd, uint64_t type);
 
-/**
- * kvm_create_vcpu - Gets a parked KVM vCPU or creates a KVM vCPU
- * @cpu: QOM CPUState object for which KVM vCPU has to be fetched/created.
- *
- * @returns: 0 when success, errno (<0) when failed.
- */
-int kvm_create_vcpu(CPUState *cpu);
-
 /**
  * kvm_park_vcpu - Park QEMU KVM vCPU context
  * @cpu: QOM CPUState object for which QEMU KVM vCPU context has to be parked.

From a8e49597d486123a62375eda6dbc939fffbfd31d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 3 Jul 2025 11:42:43 +0200
Subject: [PATCH 1833/2760] accel/tcg: Remove 'info opcount' and
 @x-query-opcount
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since commit 1b65b4f54c7 ("accel/tcg: remove CONFIG_PROFILER",
released with QEMU v8.1.0) we get pointless output:

  (qemu) info opcount
  [TCG profiler not compiled]

Remove that unstable and unuseful command.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Acked-by: Dr. David Alan Gilbert <dave@treblig.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Message-Id: <20250703173248.44995-8-philmd@linaro.org>
---
 accel/tcg/monitor.c        | 21 ---------------------
 hmp-commands-info.hx       | 14 --------------
 qapi/machine.json          | 18 ------------------
 tests/qtest/qmp-cmd-test.c |  1 -
 4 files changed, 54 deletions(-)

diff --git a/accel/tcg/monitor.c b/accel/tcg/monitor.c
index 1c182b6bfb..7c686226b2 100644
--- a/accel/tcg/monitor.c
+++ b/accel/tcg/monitor.c
@@ -215,30 +215,9 @@ HumanReadableText *qmp_x_query_jit(Error **errp)
     return human_readable_text_from_str(buf);
 }
 
-static void tcg_dump_op_count(GString *buf)
-{
-    g_string_append_printf(buf, "[TCG profiler not compiled]\n");
-}
-
-HumanReadableText *qmp_x_query_opcount(Error **errp)
-{
-    g_autoptr(GString) buf = g_string_new("");
-
-    if (!tcg_enabled()) {
-        error_setg(errp,
-                   "Opcode count information is only available with accel=tcg");
-        return NULL;
-    }
-
-    tcg_dump_op_count(buf);
-
-    return human_readable_text_from_str(buf);
-}
-
 static void hmp_tcg_register(void)
 {
     monitor_register_hmp_info_hrt("jit", qmp_x_query_jit);
-    monitor_register_hmp_info_hrt("opcount", qmp_x_query_opcount);
 }
 
 type_init(hmp_tcg_register);
diff --git a/hmp-commands-info.hx b/hmp-commands-info.hx
index 639a450ee5..d797922275 100644
--- a/hmp-commands-info.hx
+++ b/hmp-commands-info.hx
@@ -256,20 +256,6 @@ SRST
     Show dynamic compiler info.
 ERST
 
-#if defined(CONFIG_TCG)
-    {
-        .name       = "opcount",
-        .args_type  = "",
-        .params     = "",
-        .help       = "show dynamic compiler opcode counters",
-    },
-#endif
-
-SRST
-  ``info opcount``
-    Show dynamic compiler opcode counters
-ERST
-
     {
         .name       = "sync-profile",
         .args_type  = "mean:-m,no_coalesce:-n,max:i?",
diff --git a/qapi/machine.json b/qapi/machine.json
index 0650b8de71..f712e7da6d 100644
--- a/qapi/machine.json
+++ b/qapi/machine.json
@@ -1761,24 +1761,6 @@
   'returns': 'HumanReadableText',
   'features': [ 'unstable' ] }
 
-##
-# @x-query-opcount:
-#
-# Query TCG opcode counters
-#
-# Features:
-#
-# @unstable: This command is meant for debugging.
-#
-# Returns: TCG opcode counters
-#
-# Since: 6.2
-##
-{ 'command': 'x-query-opcount',
-  'returns': 'HumanReadableText',
-  'if': 'CONFIG_TCG',
-  'features': [ 'unstable' ] }
-
 ##
 # @x-query-ramblock:
 #
diff --git a/tests/qtest/qmp-cmd-test.c b/tests/qtest/qmp-cmd-test.c
index 040d042810..cf71876186 100644
--- a/tests/qtest/qmp-cmd-test.c
+++ b/tests/qtest/qmp-cmd-test.c
@@ -51,7 +51,6 @@ static int query_error_class(const char *cmd)
         { "x-query-usb", ERROR_CLASS_GENERIC_ERROR },
         /* Only valid with accel=tcg */
         { "x-query-jit", ERROR_CLASS_GENERIC_ERROR },
-        { "x-query-opcount", ERROR_CLASS_GENERIC_ERROR },
         { "xen-event-list", ERROR_CLASS_GENERIC_ERROR },
         { NULL, -1 }
     };

From f1e59f012de35310314a2a12ea9cb5f72019c976 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 3 Jul 2025 11:42:17 +0200
Subject: [PATCH 1834/2760] accel/tcg: Remove profiler leftover
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

TCG profiler was removed in commit 1b65b4f54c7.

Fixes: 1b65b4f54c7 ("accel/tcg: remove CONFIG_PROFILER")
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Message-Id: <20250703173248.44995-9-philmd@linaro.org>
---
 accel/tcg/monitor.c | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/accel/tcg/monitor.c b/accel/tcg/monitor.c
index 7c686226b2..344ec50047 100644
--- a/accel/tcg/monitor.c
+++ b/accel/tcg/monitor.c
@@ -141,11 +141,6 @@ static void tlb_flush_counts(size_t *pfull, size_t *ppart, size_t *pelide)
     *pelide = elide;
 }
 
-static void tcg_dump_info(GString *buf)
-{
-    g_string_append_printf(buf, "[TCG profiler not compiled]\n");
-}
-
 static void dump_exec_info(GString *buf)
 {
     struct tb_tree_stats tst = {};
@@ -196,7 +191,6 @@ static void dump_exec_info(GString *buf)
     g_string_append_printf(buf, "TLB full flushes    %zu\n", flush_full);
     g_string_append_printf(buf, "TLB partial flushes %zu\n", flush_part);
     g_string_append_printf(buf, "TLB elided flushes  %zu\n", flush_elide);
-    tcg_dump_info(buf);
 }
 
 HumanReadableText *qmp_x_query_jit(Error **errp)

From 04fbbeb7655372f500a7e1d610202a08a50cc364 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 17 Jun 2025 11:48:44 +0200
Subject: [PATCH 1835/2760] accel/tcg: Factor tcg_dump_flush_info() out
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Message-Id: <20250703173248.44995-10-philmd@linaro.org>
---
 accel/tcg/monitor.c | 27 +++++++++++++++++----------
 1 file changed, 17 insertions(+), 10 deletions(-)

diff --git a/accel/tcg/monitor.c b/accel/tcg/monitor.c
index 344ec50047..6d9cc11d94 100644
--- a/accel/tcg/monitor.c
+++ b/accel/tcg/monitor.c
@@ -141,11 +141,26 @@ static void tlb_flush_counts(size_t *pfull, size_t *ppart, size_t *pelide)
     *pelide = elide;
 }
 
+static void tcg_dump_flush_info(GString *buf)
+{
+    size_t flush_full, flush_part, flush_elide;
+
+    g_string_append_printf(buf, "TB flush count      %u\n",
+                           qatomic_read(&tb_ctx.tb_flush_count));
+    g_string_append_printf(buf, "TB invalidate count %u\n",
+                           qatomic_read(&tb_ctx.tb_phys_invalidate_count));
+
+    tlb_flush_counts(&flush_full, &flush_part, &flush_elide);
+    g_string_append_printf(buf, "TLB full flushes    %zu\n", flush_full);
+    g_string_append_printf(buf, "TLB partial flushes %zu\n", flush_part);
+    g_string_append_printf(buf, "TLB elided flushes  %zu\n", flush_elide);
+}
+
 static void dump_exec_info(GString *buf)
 {
     struct tb_tree_stats tst = {};
     struct qht_stats hst;
-    size_t nb_tbs, flush_full, flush_part, flush_elide;
+    size_t nb_tbs;
 
     tcg_tb_foreach(tb_tree_stats_iter, &tst);
     nb_tbs = tst.nb_tbs;
@@ -182,15 +197,7 @@ static void dump_exec_info(GString *buf)
     qht_statistics_destroy(&hst);
 
     g_string_append_printf(buf, "\nStatistics:\n");
-    g_string_append_printf(buf, "TB flush count      %u\n",
-                           qatomic_read(&tb_ctx.tb_flush_count));
-    g_string_append_printf(buf, "TB invalidate count %u\n",
-                           qatomic_read(&tb_ctx.tb_phys_invalidate_count));
-
-    tlb_flush_counts(&flush_full, &flush_part, &flush_elide);
-    g_string_append_printf(buf, "TLB full flushes    %zu\n", flush_full);
-    g_string_append_printf(buf, "TLB partial flushes %zu\n", flush_part);
-    g_string_append_printf(buf, "TLB elided flushes  %zu\n", flush_elide);
+    tcg_dump_flush_info(buf);
 }
 
 HumanReadableText *qmp_x_query_jit(Error **errp)

From a472390e800825f8544b7aa7a3503b6a4ae4bec2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 3 Jul 2025 12:16:27 +0200
Subject: [PATCH 1836/2760] accel/tcg: Factor tcg_dump_stats() out for re-use
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Message-Id: <20250703173248.44995-11-philmd@linaro.org>
---
 accel/tcg/internal-common.h |  2 ++
 accel/tcg/monitor.c         | 11 ++++++++---
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/accel/tcg/internal-common.h b/accel/tcg/internal-common.h
index 1dbc45dd95..77a3a0684a 100644
--- a/accel/tcg/internal-common.h
+++ b/accel/tcg/internal-common.h
@@ -139,4 +139,6 @@ G_NORETURN void cpu_io_recompile(CPUState *cpu, uintptr_t retaddr);
 void tb_phys_invalidate(TranslationBlock *tb, tb_page_addr_t page_addr);
 void tb_set_jmp_target(TranslationBlock *tb, int n, uintptr_t addr);
 
+void tcg_dump_stats(GString *buf);
+
 #endif
diff --git a/accel/tcg/monitor.c b/accel/tcg/monitor.c
index 6d9cc11d94..e7ed7281a4 100644
--- a/accel/tcg/monitor.c
+++ b/accel/tcg/monitor.c
@@ -200,6 +200,13 @@ static void dump_exec_info(GString *buf)
     tcg_dump_flush_info(buf);
 }
 
+void tcg_dump_stats(GString *buf)
+{
+    dump_accel_info(buf);
+    dump_exec_info(buf);
+    dump_drift_info(buf);
+}
+
 HumanReadableText *qmp_x_query_jit(Error **errp)
 {
     g_autoptr(GString) buf = g_string_new("");
@@ -209,9 +216,7 @@ HumanReadableText *qmp_x_query_jit(Error **errp)
         return NULL;
     }
 
-    dump_accel_info(buf);
-    dump_exec_info(buf);
-    dump_drift_info(buf);
+    tcg_dump_stats(buf);
 
     return human_readable_text_from_str(buf);
 }

From 0175310c385628de25a09905cb4bb35c2cd47d5f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 30 Jun 2025 11:17:43 +0200
Subject: [PATCH 1837/2760] accel/hvf: Restrict internal declarations
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Common code only needs to know whether HVF is enabled and
the QOM type. Move the rest to "hvf_int.h", removing the
need for COMPILING_PER_TARGET #ifdef'ry.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Message-Id: <20250703173248.44995-15-philmd@linaro.org>
---
 include/system/hvf.h     | 38 --------------------------------------
 include/system/hvf_int.h | 34 ++++++++++++++++++++++++++++++++++
 2 files changed, 34 insertions(+), 38 deletions(-)

diff --git a/include/system/hvf.h b/include/system/hvf.h
index a9a502f0c8..d3dcf088b3 100644
--- a/include/system/hvf.h
+++ b/include/system/hvf.h
@@ -14,10 +14,6 @@
 #define HVF_H
 
 #include "qemu/accel.h"
-#include "qemu/queue.h"
-#include "exec/vaddr.h"
-#include "qom/object.h"
-#include "exec/vaddr.h"
 
 #ifdef COMPILING_PER_TARGET
 # ifdef CONFIG_HVF
@@ -40,38 +36,4 @@ typedef struct HVFState HVFState;
 DECLARE_INSTANCE_CHECKER(HVFState, HVF_STATE,
                          TYPE_HVF_ACCEL)
 
-#ifdef COMPILING_PER_TARGET
-struct hvf_sw_breakpoint {
-    vaddr pc;
-    vaddr saved_insn;
-    int use_count;
-    QTAILQ_ENTRY(hvf_sw_breakpoint) entry;
-};
-
-struct hvf_sw_breakpoint *hvf_find_sw_breakpoint(CPUState *cpu,
-                                                 vaddr pc);
-int hvf_sw_breakpoints_active(CPUState *cpu);
-
-int hvf_arch_insert_sw_breakpoint(CPUState *cpu, struct hvf_sw_breakpoint *bp);
-int hvf_arch_remove_sw_breakpoint(CPUState *cpu, struct hvf_sw_breakpoint *bp);
-int hvf_arch_insert_hw_breakpoint(vaddr addr, vaddr len, int type);
-int hvf_arch_remove_hw_breakpoint(vaddr addr, vaddr len, int type);
-void hvf_arch_remove_all_hw_breakpoints(void);
-
-/*
- * hvf_update_guest_debug:
- * @cs: CPUState for the CPU to update
- *
- * Update guest to enable or disable debugging. Per-arch specifics will be
- * handled by calling down to hvf_arch_update_guest_debug.
- */
-int hvf_update_guest_debug(CPUState *cpu);
-void hvf_arch_update_guest_debug(CPUState *cpu);
-
-/*
- * Return whether the guest supports debugging.
- */
-bool hvf_arch_supports_guest_debug(void);
-#endif /* COMPILING_PER_TARGET */
-
 #endif
diff --git a/include/system/hvf_int.h b/include/system/hvf_int.h
index d774e58df9..4f6db40c34 100644
--- a/include/system/hvf_int.h
+++ b/include/system/hvf_int.h
@@ -12,6 +12,8 @@
 #define HVF_INT_H
 
 #include "qemu/queue.h"
+#include "exec/vaddr.h"
+#include "qom/object.h"
 
 #ifdef __aarch64__
 #include <Hypervisor/Hypervisor.h>
@@ -77,4 +79,36 @@ int hvf_put_registers(CPUState *);
 int hvf_get_registers(CPUState *);
 void hvf_kick_vcpu_thread(CPUState *cpu);
 
+struct hvf_sw_breakpoint {
+    vaddr pc;
+    vaddr saved_insn;
+    int use_count;
+    QTAILQ_ENTRY(hvf_sw_breakpoint) entry;
+};
+
+struct hvf_sw_breakpoint *hvf_find_sw_breakpoint(CPUState *cpu,
+                                                 vaddr pc);
+int hvf_sw_breakpoints_active(CPUState *cpu);
+
+int hvf_arch_insert_sw_breakpoint(CPUState *cpu, struct hvf_sw_breakpoint *bp);
+int hvf_arch_remove_sw_breakpoint(CPUState *cpu, struct hvf_sw_breakpoint *bp);
+int hvf_arch_insert_hw_breakpoint(vaddr addr, vaddr len, int type);
+int hvf_arch_remove_hw_breakpoint(vaddr addr, vaddr len, int type);
+void hvf_arch_remove_all_hw_breakpoints(void);
+
+/*
+ * hvf_update_guest_debug:
+ * @cs: CPUState for the CPU to update
+ *
+ * Update guest to enable or disable debugging. Per-arch specifics will be
+ * handled by calling down to hvf_arch_update_guest_debug.
+ */
+int hvf_update_guest_debug(CPUState *cpu);
+void hvf_arch_update_guest_debug(CPUState *cpu);
+
+/*
+ * Return whether the guest supports debugging.
+ */
+bool hvf_arch_supports_guest_debug(void);
+
 #endif

From c4b231cbd3198a05bcaaef5c0a6ee3ecebd12e21 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 30 Jun 2025 11:33:53 +0200
Subject: [PATCH 1838/2760] accel/hvf: Move per-cpu method declarations to
 hvf-accel-ops.c
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

hvf-all.c aims to contain the generic accel methods (TYPE_ACCEL),
while hvf-accel-ops.c the per-vcpu methods (TYPE_ACCEL_OPS).

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Message-Id: <20250703173248.44995-16-philmd@linaro.org>
---
 accel/hvf/hvf-accel-ops.c | 30 ++++++++++++++++++++++++++++++
 accel/hvf/hvf-all.c       | 28 ----------------------------
 2 files changed, 30 insertions(+), 28 deletions(-)

diff --git a/accel/hvf/hvf-accel-ops.c b/accel/hvf/hvf-accel-ops.c
index b38977207d..3752334688 100644
--- a/accel/hvf/hvf-accel-ops.c
+++ b/accel/hvf/hvf-accel-ops.c
@@ -50,9 +50,11 @@
 #include "qemu/osdep.h"
 #include "qemu/error-report.h"
 #include "qemu/main-loop.h"
+#include "qemu/queue.h"
 #include "system/address-spaces.h"
 #include "gdbstub/enums.h"
 #include "hw/boards.h"
+#include "hw/core/cpu.h"
 #include "system/accel-ops.h"
 #include "system/cpus.h"
 #include "system/hvf.h"
@@ -482,6 +484,34 @@ static void hvf_start_vcpu_thread(CPUState *cpu)
                        cpu, QEMU_THREAD_JOINABLE);
 }
 
+struct hvf_sw_breakpoint *hvf_find_sw_breakpoint(CPUState *cpu, vaddr pc)
+{
+    struct hvf_sw_breakpoint *bp;
+
+    QTAILQ_FOREACH(bp, &hvf_state->hvf_sw_breakpoints, entry) {
+        if (bp->pc == pc) {
+            return bp;
+        }
+    }
+    return NULL;
+}
+
+int hvf_sw_breakpoints_active(CPUState *cpu)
+{
+    return !QTAILQ_EMPTY(&hvf_state->hvf_sw_breakpoints);
+}
+
+static void do_hvf_update_guest_debug(CPUState *cpu, run_on_cpu_data arg)
+{
+    hvf_arch_update_guest_debug(cpu);
+}
+
+int hvf_update_guest_debug(CPUState *cpu)
+{
+    run_on_cpu(cpu, do_hvf_update_guest_debug, RUN_ON_CPU_NULL);
+    return 0;
+}
+
 static int hvf_insert_breakpoint(CPUState *cpu, int type, vaddr addr, vaddr len)
 {
     struct hvf_sw_breakpoint *bp;
diff --git a/accel/hvf/hvf-all.c b/accel/hvf/hvf-all.c
index 8c387fda24..1c72c43ddb 100644
--- a/accel/hvf/hvf-all.c
+++ b/accel/hvf/hvf-all.c
@@ -41,31 +41,3 @@ void assert_hvf_ok_impl(hv_return_t ret, const char *file, unsigned int line,
 
     abort();
 }
-
-struct hvf_sw_breakpoint *hvf_find_sw_breakpoint(CPUState *cpu, vaddr pc)
-{
-    struct hvf_sw_breakpoint *bp;
-
-    QTAILQ_FOREACH(bp, &hvf_state->hvf_sw_breakpoints, entry) {
-        if (bp->pc == pc) {
-            return bp;
-        }
-    }
-    return NULL;
-}
-
-int hvf_sw_breakpoints_active(CPUState *cpu)
-{
-    return !QTAILQ_EMPTY(&hvf_state->hvf_sw_breakpoints);
-}
-
-static void do_hvf_update_guest_debug(CPUState *cpu, run_on_cpu_data arg)
-{
-    hvf_arch_update_guest_debug(cpu);
-}
-
-int hvf_update_guest_debug(CPUState *cpu)
-{
-    run_on_cpu(cpu, do_hvf_update_guest_debug, RUN_ON_CPU_NULL);
-    return 0;
-}

From 5da232017a46a14f86cdbe70396b8051aacfed99 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 1 Jul 2025 14:57:25 +0200
Subject: [PATCH 1839/2760] accel/hvf: Move generic method declarations to
 hvf-all.c
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

hvf-all.c aims to contain the generic accel methods (TYPE_ACCEL),
while hvf-accel-ops.c the per-vcpu methods (TYPE_ACCEL_OPS).

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Message-Id: <20250703173248.44995-17-philmd@linaro.org>
---
 accel/hvf/hvf-accel-ops.c | 273 +-------------------------------------
 accel/hvf/hvf-all.c       | 267 +++++++++++++++++++++++++++++++++++++
 2 files changed, 271 insertions(+), 269 deletions(-)

diff --git a/accel/hvf/hvf-accel-ops.c b/accel/hvf/hvf-accel-ops.c
index 3752334688..2c0715a17f 100644
--- a/accel/hvf/hvf-accel-ops.c
+++ b/accel/hvf/hvf-accel-ops.c
@@ -48,20 +48,16 @@
  */
 
 #include "qemu/osdep.h"
-#include "qemu/error-report.h"
+#include "qemu/guest-random.h"
 #include "qemu/main-loop.h"
 #include "qemu/queue.h"
-#include "system/address-spaces.h"
 #include "gdbstub/enums.h"
-#include "hw/boards.h"
+#include "exec/cpu-common.h"
 #include "hw/core/cpu.h"
 #include "system/accel-ops.h"
 #include "system/cpus.h"
 #include "system/hvf.h"
 #include "system/hvf_int.h"
-#include "system/runstate.h"
-#include "qemu/guest-random.h"
-#include "trace.h"
 
 HVFState *hvf_state;
 
@@ -81,132 +77,6 @@ hvf_slot *hvf_find_overlap_slot(uint64_t start, uint64_t size)
     return NULL;
 }
 
-struct mac_slot {
-    int present;
-    uint64_t size;
-    uint64_t gpa_start;
-    uint64_t gva;
-};
-
-struct mac_slot mac_slots[32];
-
-static int do_hvf_set_memory(hvf_slot *slot, hv_memory_flags_t flags)
-{
-    struct mac_slot *macslot;
-    hv_return_t ret;
-
-    macslot = &mac_slots[slot->slot_id];
-
-    if (macslot->present) {
-        if (macslot->size != slot->size) {
-            macslot->present = 0;
-            trace_hvf_vm_unmap(macslot->gpa_start, macslot->size);
-            ret = hv_vm_unmap(macslot->gpa_start, macslot->size);
-            assert_hvf_ok(ret);
-        }
-    }
-
-    if (!slot->size) {
-        return 0;
-    }
-
-    macslot->present = 1;
-    macslot->gpa_start = slot->start;
-    macslot->size = slot->size;
-    trace_hvf_vm_map(slot->start, slot->size, slot->mem, flags,
-                     flags & HV_MEMORY_READ ?  'R' : '-',
-                     flags & HV_MEMORY_WRITE ? 'W' : '-',
-                     flags & HV_MEMORY_EXEC ?  'E' : '-');
-    ret = hv_vm_map(slot->mem, slot->start, slot->size, flags);
-    assert_hvf_ok(ret);
-    return 0;
-}
-
-static void hvf_set_phys_mem(MemoryRegionSection *section, bool add)
-{
-    hvf_slot *mem;
-    MemoryRegion *area = section->mr;
-    bool writable = !area->readonly && !area->rom_device;
-    hv_memory_flags_t flags;
-    uint64_t page_size = qemu_real_host_page_size();
-
-    if (!memory_region_is_ram(area)) {
-        if (writable) {
-            return;
-        } else if (!memory_region_is_romd(area)) {
-            /*
-             * If the memory device is not in romd_mode, then we actually want
-             * to remove the hvf memory slot so all accesses will trap.
-             */
-             add = false;
-        }
-    }
-
-    if (!QEMU_IS_ALIGNED(int128_get64(section->size), page_size) ||
-        !QEMU_IS_ALIGNED(section->offset_within_address_space, page_size)) {
-        /* Not page aligned, so we can not map as RAM */
-        add = false;
-    }
-
-    mem = hvf_find_overlap_slot(
-            section->offset_within_address_space,
-            int128_get64(section->size));
-
-    if (mem && add) {
-        if (mem->size == int128_get64(section->size) &&
-            mem->start == section->offset_within_address_space &&
-            mem->mem == (memory_region_get_ram_ptr(area) +
-            section->offset_within_region)) {
-            return; /* Same region was attempted to register, go away. */
-        }
-    }
-
-    /* Region needs to be reset. set the size to 0 and remap it. */
-    if (mem) {
-        mem->size = 0;
-        if (do_hvf_set_memory(mem, 0)) {
-            error_report("Failed to reset overlapping slot");
-            abort();
-        }
-    }
-
-    if (!add) {
-        return;
-    }
-
-    if (area->readonly ||
-        (!memory_region_is_ram(area) && memory_region_is_romd(area))) {
-        flags = HV_MEMORY_READ | HV_MEMORY_EXEC;
-    } else {
-        flags = HV_MEMORY_READ | HV_MEMORY_WRITE | HV_MEMORY_EXEC;
-    }
-
-    /* Now make a new slot. */
-    int x;
-
-    for (x = 0; x < hvf_state->num_slots; ++x) {
-        mem = &hvf_state->slots[x];
-        if (!mem->size) {
-            break;
-        }
-    }
-
-    if (x == hvf_state->num_slots) {
-        error_report("No free slots");
-        abort();
-    }
-
-    mem->size = int128_get64(section->size);
-    mem->mem = memory_region_get_ram_ptr(area) + section->offset_within_region;
-    mem->start = section->offset_within_address_space;
-    mem->region = area;
-
-    if (do_hvf_set_memory(mem, flags)) {
-        error_report("Error registering new memory slot");
-        abort();
-    }
-}
-
 static void do_hvf_cpu_synchronize_state(CPUState *cpu, run_on_cpu_data arg)
 {
     if (!cpu->accel->dirty) {
@@ -244,147 +114,10 @@ static void hvf_cpu_synchronize_pre_loadvm(CPUState *cpu)
     run_on_cpu(cpu, do_hvf_cpu_synchronize_set_dirty, RUN_ON_CPU_NULL);
 }
 
-static void hvf_set_dirty_tracking(MemoryRegionSection *section, bool on)
-{
-    hvf_slot *slot;
-
-    slot = hvf_find_overlap_slot(
-            section->offset_within_address_space,
-            int128_get64(section->size));
-
-    /* protect region against writes; begin tracking it */
-    if (on) {
-        slot->flags |= HVF_SLOT_LOG;
-        hv_vm_protect((uintptr_t)slot->start, (size_t)slot->size,
-                      HV_MEMORY_READ | HV_MEMORY_EXEC);
-    /* stop tracking region*/
-    } else {
-        slot->flags &= ~HVF_SLOT_LOG;
-        hv_vm_protect((uintptr_t)slot->start, (size_t)slot->size,
-                      HV_MEMORY_READ | HV_MEMORY_WRITE | HV_MEMORY_EXEC);
-    }
-}
-
-static void hvf_log_start(MemoryListener *listener,
-                          MemoryRegionSection *section, int old, int new)
-{
-    if (old != 0) {
-        return;
-    }
-
-    hvf_set_dirty_tracking(section, 1);
-}
-
-static void hvf_log_stop(MemoryListener *listener,
-                         MemoryRegionSection *section, int old, int new)
-{
-    if (new != 0) {
-        return;
-    }
-
-    hvf_set_dirty_tracking(section, 0);
-}
-
-static void hvf_log_sync(MemoryListener *listener,
-                         MemoryRegionSection *section)
-{
-    /*
-     * sync of dirty pages is handled elsewhere; just make sure we keep
-     * tracking the region.
-     */
-    hvf_set_dirty_tracking(section, 1);
-}
-
-static void hvf_region_add(MemoryListener *listener,
-                           MemoryRegionSection *section)
-{
-    hvf_set_phys_mem(section, true);
-}
-
-static void hvf_region_del(MemoryListener *listener,
-                           MemoryRegionSection *section)
-{
-    hvf_set_phys_mem(section, false);
-}
-
-static MemoryListener hvf_memory_listener = {
-    .name = "hvf",
-    .priority = MEMORY_LISTENER_PRIORITY_ACCEL,
-    .region_add = hvf_region_add,
-    .region_del = hvf_region_del,
-    .log_start = hvf_log_start,
-    .log_stop = hvf_log_stop,
-    .log_sync = hvf_log_sync,
-};
-
 static void dummy_signal(int sig)
 {
 }
 
-bool hvf_allowed;
-
-static int hvf_accel_init(MachineState *ms)
-{
-    int x;
-    hv_return_t ret;
-    HVFState *s;
-    int pa_range = 36;
-    MachineClass *mc = MACHINE_GET_CLASS(ms);
-
-    if (mc->hvf_get_physical_address_range) {
-        pa_range = mc->hvf_get_physical_address_range(ms);
-        if (pa_range < 0) {
-            return -EINVAL;
-        }
-    }
-
-    ret = hvf_arch_vm_create(ms, (uint32_t)pa_range);
-    assert_hvf_ok(ret);
-
-    s = g_new0(HVFState, 1);
-
-    s->num_slots = ARRAY_SIZE(s->slots);
-    for (x = 0; x < s->num_slots; ++x) {
-        s->slots[x].size = 0;
-        s->slots[x].slot_id = x;
-    }
-
-    QTAILQ_INIT(&s->hvf_sw_breakpoints);
-
-    hvf_state = s;
-    memory_listener_register(&hvf_memory_listener, &address_space_memory);
-
-    return hvf_arch_init();
-}
-
-static inline int hvf_gdbstub_sstep_flags(void)
-{
-    return SSTEP_ENABLE | SSTEP_NOIRQ;
-}
-
-static void hvf_accel_class_init(ObjectClass *oc, const void *data)
-{
-    AccelClass *ac = ACCEL_CLASS(oc);
-    ac->name = "HVF";
-    ac->init_machine = hvf_accel_init;
-    ac->allowed = &hvf_allowed;
-    ac->gdbstub_supported_sstep_flags = hvf_gdbstub_sstep_flags;
-}
-
-static const TypeInfo hvf_accel_type = {
-    .name = TYPE_HVF_ACCEL,
-    .parent = TYPE_ACCEL,
-    .instance_size = sizeof(HVFState),
-    .class_init = hvf_accel_class_init,
-};
-
-static void hvf_type_init(void)
-{
-    type_register_static(&hvf_accel_type);
-}
-
-type_init(hvf_type_init);
-
 static void hvf_vcpu_destroy(CPUState *cpu)
 {
     hv_return_t ret = hv_vcpu_destroy(cpu->accel->fd);
@@ -639,8 +372,10 @@ static const TypeInfo hvf_accel_ops_type = {
     .class_init = hvf_accel_ops_class_init,
     .abstract = true,
 };
+
 static void hvf_accel_ops_register_types(void)
 {
     type_register_static(&hvf_accel_ops_type);
 }
+
 type_init(hvf_accel_ops_register_types);
diff --git a/accel/hvf/hvf-all.c b/accel/hvf/hvf-all.c
index 1c72c43ddb..ddc77e629f 100644
--- a/accel/hvf/hvf-all.c
+++ b/accel/hvf/hvf-all.c
@@ -10,9 +10,24 @@
 
 #include "qemu/osdep.h"
 #include "qemu/error-report.h"
+#include "system/address-spaces.h"
+#include "system/memory.h"
 #include "system/hvf.h"
 #include "system/hvf_int.h"
 #include "hw/core/cpu.h"
+#include "hw/boards.h"
+#include "trace.h"
+
+bool hvf_allowed;
+
+struct mac_slot {
+    int present;
+    uint64_t size;
+    uint64_t gpa_start;
+    uint64_t gva;
+};
+
+struct mac_slot mac_slots[32];
 
 const char *hvf_return_string(hv_return_t ret)
 {
@@ -41,3 +56,255 @@ void assert_hvf_ok_impl(hv_return_t ret, const char *file, unsigned int line,
 
     abort();
 }
+
+static int do_hvf_set_memory(hvf_slot *slot, hv_memory_flags_t flags)
+{
+    struct mac_slot *macslot;
+    hv_return_t ret;
+
+    macslot = &mac_slots[slot->slot_id];
+
+    if (macslot->present) {
+        if (macslot->size != slot->size) {
+            macslot->present = 0;
+            trace_hvf_vm_unmap(macslot->gpa_start, macslot->size);
+            ret = hv_vm_unmap(macslot->gpa_start, macslot->size);
+            assert_hvf_ok(ret);
+        }
+    }
+
+    if (!slot->size) {
+        return 0;
+    }
+
+    macslot->present = 1;
+    macslot->gpa_start = slot->start;
+    macslot->size = slot->size;
+    trace_hvf_vm_map(slot->start, slot->size, slot->mem, flags,
+                     flags & HV_MEMORY_READ ?  'R' : '-',
+                     flags & HV_MEMORY_WRITE ? 'W' : '-',
+                     flags & HV_MEMORY_EXEC ?  'E' : '-');
+    ret = hv_vm_map(slot->mem, slot->start, slot->size, flags);
+    assert_hvf_ok(ret);
+    return 0;
+}
+
+static void hvf_set_phys_mem(MemoryRegionSection *section, bool add)
+{
+    hvf_slot *mem;
+    MemoryRegion *area = section->mr;
+    bool writable = !area->readonly && !area->rom_device;
+    hv_memory_flags_t flags;
+    uint64_t page_size = qemu_real_host_page_size();
+
+    if (!memory_region_is_ram(area)) {
+        if (writable) {
+            return;
+        } else if (!memory_region_is_romd(area)) {
+            /*
+             * If the memory device is not in romd_mode, then we actually want
+             * to remove the hvf memory slot so all accesses will trap.
+             */
+             add = false;
+        }
+    }
+
+    if (!QEMU_IS_ALIGNED(int128_get64(section->size), page_size) ||
+        !QEMU_IS_ALIGNED(section->offset_within_address_space, page_size)) {
+        /* Not page aligned, so we can not map as RAM */
+        add = false;
+    }
+
+    mem = hvf_find_overlap_slot(
+            section->offset_within_address_space,
+            int128_get64(section->size));
+
+    if (mem && add) {
+        if (mem->size == int128_get64(section->size) &&
+            mem->start == section->offset_within_address_space &&
+            mem->mem == (memory_region_get_ram_ptr(area) +
+            section->offset_within_region)) {
+            return; /* Same region was attempted to register, go away. */
+        }
+    }
+
+    /* Region needs to be reset. set the size to 0 and remap it. */
+    if (mem) {
+        mem->size = 0;
+        if (do_hvf_set_memory(mem, 0)) {
+            error_report("Failed to reset overlapping slot");
+            abort();
+        }
+    }
+
+    if (!add) {
+        return;
+    }
+
+    if (area->readonly ||
+        (!memory_region_is_ram(area) && memory_region_is_romd(area))) {
+        flags = HV_MEMORY_READ | HV_MEMORY_EXEC;
+    } else {
+        flags = HV_MEMORY_READ | HV_MEMORY_WRITE | HV_MEMORY_EXEC;
+    }
+
+    /* Now make a new slot. */
+    int x;
+
+    for (x = 0; x < hvf_state->num_slots; ++x) {
+        mem = &hvf_state->slots[x];
+        if (!mem->size) {
+            break;
+        }
+    }
+
+    if (x == hvf_state->num_slots) {
+        error_report("No free slots");
+        abort();
+    }
+
+    mem->size = int128_get64(section->size);
+    mem->mem = memory_region_get_ram_ptr(area) + section->offset_within_region;
+    mem->start = section->offset_within_address_space;
+    mem->region = area;
+
+    if (do_hvf_set_memory(mem, flags)) {
+        error_report("Error registering new memory slot");
+        abort();
+    }
+}
+
+static void hvf_set_dirty_tracking(MemoryRegionSection *section, bool on)
+{
+    hvf_slot *slot;
+
+    slot = hvf_find_overlap_slot(
+            section->offset_within_address_space,
+            int128_get64(section->size));
+
+    /* protect region against writes; begin tracking it */
+    if (on) {
+        slot->flags |= HVF_SLOT_LOG;
+        hv_vm_protect((uintptr_t)slot->start, (size_t)slot->size,
+                      HV_MEMORY_READ | HV_MEMORY_EXEC);
+    /* stop tracking region*/
+    } else {
+        slot->flags &= ~HVF_SLOT_LOG;
+        hv_vm_protect((uintptr_t)slot->start, (size_t)slot->size,
+                      HV_MEMORY_READ | HV_MEMORY_WRITE | HV_MEMORY_EXEC);
+    }
+}
+
+static void hvf_log_start(MemoryListener *listener,
+                          MemoryRegionSection *section, int old, int new)
+{
+    if (old != 0) {
+        return;
+    }
+
+    hvf_set_dirty_tracking(section, 1);
+}
+
+static void hvf_log_stop(MemoryListener *listener,
+                         MemoryRegionSection *section, int old, int new)
+{
+    if (new != 0) {
+        return;
+    }
+
+    hvf_set_dirty_tracking(section, 0);
+}
+
+static void hvf_log_sync(MemoryListener *listener,
+                         MemoryRegionSection *section)
+{
+    /*
+     * sync of dirty pages is handled elsewhere; just make sure we keep
+     * tracking the region.
+     */
+    hvf_set_dirty_tracking(section, 1);
+}
+
+static void hvf_region_add(MemoryListener *listener,
+                           MemoryRegionSection *section)
+{
+    hvf_set_phys_mem(section, true);
+}
+
+static void hvf_region_del(MemoryListener *listener,
+                           MemoryRegionSection *section)
+{
+    hvf_set_phys_mem(section, false);
+}
+
+static MemoryListener hvf_memory_listener = {
+    .name = "hvf",
+    .priority = MEMORY_LISTENER_PRIORITY_ACCEL,
+    .region_add = hvf_region_add,
+    .region_del = hvf_region_del,
+    .log_start = hvf_log_start,
+    .log_stop = hvf_log_stop,
+    .log_sync = hvf_log_sync,
+};
+
+static int hvf_accel_init(MachineState *ms)
+{
+    int x;
+    hv_return_t ret;
+    HVFState *s;
+    int pa_range = 36;
+    MachineClass *mc = MACHINE_GET_CLASS(ms);
+
+    if (mc->hvf_get_physical_address_range) {
+        pa_range = mc->hvf_get_physical_address_range(ms);
+        if (pa_range < 0) {
+            return -EINVAL;
+        }
+    }
+
+    ret = hvf_arch_vm_create(ms, (uint32_t)pa_range);
+    assert_hvf_ok(ret);
+
+    s = g_new0(HVFState, 1);
+
+    s->num_slots = ARRAY_SIZE(s->slots);
+    for (x = 0; x < s->num_slots; ++x) {
+        s->slots[x].size = 0;
+        s->slots[x].slot_id = x;
+    }
+
+    QTAILQ_INIT(&s->hvf_sw_breakpoints);
+
+    hvf_state = s;
+    memory_listener_register(&hvf_memory_listener, &address_space_memory);
+
+    return hvf_arch_init();
+}
+
+static int hvf_gdbstub_sstep_flags(void)
+{
+    return SSTEP_ENABLE | SSTEP_NOIRQ;
+}
+
+static void hvf_accel_class_init(ObjectClass *oc, const void *data)
+{
+    AccelClass *ac = ACCEL_CLASS(oc);
+    ac->name = "HVF";
+    ac->init_machine = hvf_accel_init;
+    ac->allowed = &hvf_allowed;
+    ac->gdbstub_supported_sstep_flags = hvf_gdbstub_sstep_flags;
+}
+
+static const TypeInfo hvf_accel_type = {
+    .name = TYPE_HVF_ACCEL,
+    .parent = TYPE_ACCEL,
+    .instance_size = sizeof(HVFState),
+    .class_init = hvf_accel_class_init,
+};
+
+static void hvf_type_init(void)
+{
+    type_register_static(&hvf_accel_type);
+}
+
+type_init(hvf_type_init);

From 332ad068a025056e2ffd0dc7605897254eb20e15 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 17 Jun 2025 06:47:28 +0200
Subject: [PATCH 1840/2760] cpus: Document CPUState::vcpu_dirty field
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Message-Id: <20250703173248.44995-18-philmd@linaro.org>
---
 include/hw/core/cpu.h | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index 162a56a5da..5eaf41a566 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -442,6 +442,7 @@ struct qemu_work_item;
  * @opaque: User data.
  * @mem_io_pc: Host Program Counter at which the memory was accessed.
  * @accel: Pointer to accelerator specific state.
+ * @vcpu_dirty: Hardware accelerator is not synchronized with QEMU state
  * @kvm_fd: vCPU file descriptor for KVM.
  * @work_mutex: Lock to prevent multiple access to @work_list.
  * @work_list: List of pending asynchronous work.
@@ -538,7 +539,6 @@ struct CPUState {
     uint32_t kvm_fetch_index;
     uint64_t dirty_pages;
     int kvm_vcpu_stats_fd;
-    bool vcpu_dirty;
 
     /* Use by accel-block: CPU is executing an ioctl() */
     QemuLockCnt in_ioctl_lock;
@@ -554,6 +554,7 @@ struct CPUState {
     uint32_t halted;
     int32_t exception_index;
 
+    bool vcpu_dirty;
     AccelCPUState *accel;
 
     /* Used to keep track of an outstanding cpu throttle thread for migration

From 93bbbcb8d6eb9325530da8c3c313220d45f27252 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 17 Jun 2025 06:54:32 +0200
Subject: [PATCH 1841/2760] accel/hvf: Replace @dirty field by generic
 CPUState::vcpu_dirty field
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

No need for accel-specific @dirty field when we have
a generic one in CPUState.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Message-Id: <20250703173248.44995-19-philmd@linaro.org>
---
 accel/hvf/hvf-accel-ops.c | 10 +++++-----
 include/system/hvf_int.h  |  1 -
 target/arm/hvf/hvf.c      |  4 ++--
 target/i386/hvf/hvf.c     |  4 ++--
 target/i386/hvf/x86hvf.c  |  2 +-
 5 files changed, 10 insertions(+), 11 deletions(-)

diff --git a/accel/hvf/hvf-accel-ops.c b/accel/hvf/hvf-accel-ops.c
index 2c0715a17f..395b5a8e1c 100644
--- a/accel/hvf/hvf-accel-ops.c
+++ b/accel/hvf/hvf-accel-ops.c
@@ -79,15 +79,15 @@ hvf_slot *hvf_find_overlap_slot(uint64_t start, uint64_t size)
 
 static void do_hvf_cpu_synchronize_state(CPUState *cpu, run_on_cpu_data arg)
 {
-    if (!cpu->accel->dirty) {
+    if (!cpu->vcpu_dirty) {
         hvf_get_registers(cpu);
-        cpu->accel->dirty = true;
+        cpu->vcpu_dirty = true;
     }
 }
 
 static void hvf_cpu_synchronize_state(CPUState *cpu)
 {
-    if (!cpu->accel->dirty) {
+    if (!cpu->vcpu_dirty) {
         run_on_cpu(cpu, do_hvf_cpu_synchronize_state, RUN_ON_CPU_NULL);
     }
 }
@@ -96,7 +96,7 @@ static void do_hvf_cpu_synchronize_set_dirty(CPUState *cpu,
                                              run_on_cpu_data arg)
 {
     /* QEMU state is the reference, push it to HVF now and on next entry */
-    cpu->accel->dirty = true;
+    cpu->vcpu_dirty = true;
 }
 
 static void hvf_cpu_synchronize_post_reset(CPUState *cpu)
@@ -150,8 +150,8 @@ static int hvf_init_vcpu(CPUState *cpu)
 #else
     r = hv_vcpu_create(&cpu->accel->fd, HV_VCPU_DEFAULT);
 #endif
-    cpu->accel->dirty = true;
     assert_hvf_ok(r);
+    cpu->vcpu_dirty = true;
 
     cpu->accel->guest_debug_enabled = false;
 
diff --git a/include/system/hvf_int.h b/include/system/hvf_int.h
index 4f6db40c34..5150c7dd9c 100644
--- a/include/system/hvf_int.h
+++ b/include/system/hvf_int.h
@@ -62,7 +62,6 @@ struct AccelCPUState {
     bool vtimer_masked;
     sigset_t unblock_ipi_mask;
     bool guest_debug_enabled;
-    bool dirty;
 };
 
 void assert_hvf_ok_impl(hv_return_t ret, const char *file, unsigned int line,
diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index 7b6d291e79..c9cfcdc08b 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -813,9 +813,9 @@ int hvf_put_registers(CPUState *cpu)
 
 static void flush_cpu_state(CPUState *cpu)
 {
-    if (cpu->accel->dirty) {
+    if (cpu->vcpu_dirty) {
         hvf_put_registers(cpu);
-        cpu->accel->dirty = false;
+        cpu->vcpu_dirty = false;
     }
 }
 
diff --git a/target/i386/hvf/hvf.c b/target/i386/hvf/hvf.c
index 99e37a33e5..818b50419f 100644
--- a/target/i386/hvf/hvf.c
+++ b/target/i386/hvf/hvf.c
@@ -733,9 +733,9 @@ int hvf_vcpu_exec(CPUState *cpu)
     }
 
     do {
-        if (cpu->accel->dirty) {
+        if (cpu->vcpu_dirty) {
             hvf_put_registers(cpu);
-            cpu->accel->dirty = false;
+            cpu->vcpu_dirty = false;
         }
 
         if (hvf_inject_interrupts(cpu)) {
diff --git a/target/i386/hvf/x86hvf.c b/target/i386/hvf/x86hvf.c
index 2057314892..17fce1d3cd 100644
--- a/target/i386/hvf/x86hvf.c
+++ b/target/i386/hvf/x86hvf.c
@@ -427,7 +427,7 @@ int hvf_process_events(CPUState *cs)
     X86CPU *cpu = X86_CPU(cs);
     CPUX86State *env = &cpu->env;
 
-    if (!cs->accel->dirty) {
+    if (!cs->vcpu_dirty) {
         /* light weight sync for CPU_INTERRUPT_HARD and IF_MASK */
         env->eflags = rreg(cs->accel->fd, HV_X86_RFLAGS);
     }

From 2098164a6bebe97b736cb1d657c2d750daf8eb76 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 17 Jun 2025 06:59:03 +0200
Subject: [PATCH 1842/2760] accel/nvmm: Replace @dirty field by generic
 CPUState::vcpu_dirty field
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

No need for accel-specific @dirty field when we have
a generic one in CPUState.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Message-Id: <20250703173248.44995-20-philmd@linaro.org>
---
 target/i386/nvmm/nvmm-all.c | 21 ++++++++++-----------
 1 file changed, 10 insertions(+), 11 deletions(-)

diff --git a/target/i386/nvmm/nvmm-all.c b/target/i386/nvmm/nvmm-all.c
index f1c6120ccf..aea61a6fd2 100644
--- a/target/i386/nvmm/nvmm-all.c
+++ b/target/i386/nvmm/nvmm-all.c
@@ -30,7 +30,6 @@ struct AccelCPUState {
     struct nvmm_vcpu vcpu;
     uint8_t tpr;
     bool stop;
-    bool dirty;
 
     /* Window-exiting for INTs/NMIs. */
     bool int_window_exit;
@@ -508,7 +507,7 @@ nvmm_io_callback(struct nvmm_io *io)
     }
 
     /* Needed, otherwise infinite loop. */
-    current_cpu->accel->dirty = false;
+    current_cpu->vcpu_dirty = false;
 }
 
 static void
@@ -517,7 +516,7 @@ nvmm_mem_callback(struct nvmm_mem *mem)
     cpu_physical_memory_rw(mem->gpa, mem->data, mem->size, mem->write);
 
     /* Needed, otherwise infinite loop. */
-    current_cpu->accel->dirty = false;
+    current_cpu->vcpu_dirty = false;
 }
 
 static struct nvmm_assist_callbacks nvmm_callbacks = {
@@ -727,9 +726,9 @@ nvmm_vcpu_loop(CPUState *cpu)
      * Inner VCPU loop.
      */
     do {
-        if (cpu->accel->dirty) {
+        if (cpu->vcpu_dirty) {
             nvmm_set_registers(cpu);
-            cpu->accel->dirty = false;
+            cpu->vcpu_dirty = false;
         }
 
         if (qcpu->stop) {
@@ -827,32 +826,32 @@ static void
 do_nvmm_cpu_synchronize_state(CPUState *cpu, run_on_cpu_data arg)
 {
     nvmm_get_registers(cpu);
-    cpu->accel->dirty = true;
+    cpu->vcpu_dirty = true;
 }
 
 static void
 do_nvmm_cpu_synchronize_post_reset(CPUState *cpu, run_on_cpu_data arg)
 {
     nvmm_set_registers(cpu);
-    cpu->accel->dirty = false;
+    cpu->vcpu_dirty = false;
 }
 
 static void
 do_nvmm_cpu_synchronize_post_init(CPUState *cpu, run_on_cpu_data arg)
 {
     nvmm_set_registers(cpu);
-    cpu->accel->dirty = false;
+    cpu->vcpu_dirty = false;
 }
 
 static void
 do_nvmm_cpu_synchronize_pre_loadvm(CPUState *cpu, run_on_cpu_data arg)
 {
-    cpu->accel->dirty = true;
+    cpu->vcpu_dirty = true;
 }
 
 void nvmm_cpu_synchronize_state(CPUState *cpu)
 {
-    if (!cpu->accel->dirty) {
+    if (!cpu->vcpu_dirty) {
         run_on_cpu(cpu, do_nvmm_cpu_synchronize_state, RUN_ON_CPU_NULL);
     }
 }
@@ -982,7 +981,7 @@ nvmm_init_vcpu(CPUState *cpu)
         }
     }
 
-    qcpu->dirty = true;
+    qcpu->vcpu_dirty = true;
     cpu->accel = qcpu;
 
     return 0;

From 29741712054aa8bd333d54dd88121ea3609ab386 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 17 Jun 2025 06:59:29 +0200
Subject: [PATCH 1843/2760] accel/whpx: Replace @dirty field by generic
 CPUState::vcpu_dirty field
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

No need for accel-specific @dirty field when we have
a generic one in CPUState.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Message-Id: <20250703173248.44995-21-philmd@linaro.org>
---
 target/i386/whpx/whpx-all.c | 23 +++++++++++------------
 1 file changed, 11 insertions(+), 12 deletions(-)

diff --git a/target/i386/whpx/whpx-all.c b/target/i386/whpx/whpx-all.c
index cf6d3e4cdd..5001afad3a 100644
--- a/target/i386/whpx/whpx-all.c
+++ b/target/i386/whpx/whpx-all.c
@@ -237,7 +237,6 @@ struct AccelCPUState {
     uint64_t tpr;
     uint64_t apic_base;
     bool interruption_pending;
-    bool dirty;
 
     /* Must be the last field as it may have a tail */
     WHV_RUN_VP_EXIT_CONTEXT exit_ctx;
@@ -836,7 +835,7 @@ static HRESULT CALLBACK whpx_emu_setreg_callback(
      * The emulator just successfully wrote the register state. We clear the
      * dirty state so we avoid the double write on resume of the VP.
      */
-    cpu->accel->dirty = false;
+    cpu->vcpu_dirty = false;
 
     return hr;
 }
@@ -1391,7 +1390,7 @@ static int whpx_last_vcpu_stopping(CPUState *cpu)
 /* Returns the address of the next instruction that is about to be executed. */
 static vaddr whpx_vcpu_get_pc(CPUState *cpu, bool exit_context_valid)
 {
-    if (cpu->accel->dirty) {
+    if (cpu->vcpu_dirty) {
         /* The CPU registers have been modified by other parts of QEMU. */
         return cpu_env(cpu)->eip;
     } else if (exit_context_valid) {
@@ -1704,9 +1703,9 @@ static int whpx_vcpu_run(CPUState *cpu)
     }
 
     do {
-        if (cpu->accel->dirty) {
+        if (cpu->vcpu_dirty) {
             whpx_set_registers(cpu, WHPX_SET_RUNTIME_STATE);
-            cpu->accel->dirty = false;
+            cpu->vcpu_dirty = false;
         }
 
         if (exclusive_step_mode == WHPX_STEP_NONE) {
@@ -2054,9 +2053,9 @@ static int whpx_vcpu_run(CPUState *cpu)
 
 static void do_whpx_cpu_synchronize_state(CPUState *cpu, run_on_cpu_data arg)
 {
-    if (!cpu->accel->dirty) {
+    if (!cpu->vcpu_dirty) {
         whpx_get_registers(cpu);
-        cpu->accel->dirty = true;
+        cpu->vcpu_dirty = true;
     }
 }
 
@@ -2064,20 +2063,20 @@ static void do_whpx_cpu_synchronize_post_reset(CPUState *cpu,
                                                run_on_cpu_data arg)
 {
     whpx_set_registers(cpu, WHPX_SET_RESET_STATE);
-    cpu->accel->dirty = false;
+    cpu->vcpu_dirty = false;
 }
 
 static void do_whpx_cpu_synchronize_post_init(CPUState *cpu,
                                               run_on_cpu_data arg)
 {
     whpx_set_registers(cpu, WHPX_SET_FULL_STATE);
-    cpu->accel->dirty = false;
+    cpu->vcpu_dirty = false;
 }
 
 static void do_whpx_cpu_synchronize_pre_loadvm(CPUState *cpu,
                                                run_on_cpu_data arg)
 {
-    cpu->accel->dirty = true;
+    cpu->vcpu_dirty = true;
 }
 
 /*
@@ -2086,7 +2085,7 @@ static void do_whpx_cpu_synchronize_pre_loadvm(CPUState *cpu,
 
 void whpx_cpu_synchronize_state(CPUState *cpu)
 {
-    if (!cpu->accel->dirty) {
+    if (!cpu->vcpu_dirty) {
         run_on_cpu(cpu, do_whpx_cpu_synchronize_state, RUN_ON_CPU_NULL);
     }
 }
@@ -2226,7 +2225,7 @@ int whpx_init_vcpu(CPUState *cpu)
     }
 
     vcpu->interruptable = true;
-    vcpu->dirty = true;
+    cpu->vcpu_dirty = true;
     cpu->accel = vcpu;
     max_vcpu_index = max(max_vcpu_index, cpu->cpu_index);
     qemu_add_vm_change_state_handler(whpx_cpu_update_state, env);

From 476e7379652d357f1053d340968e7f8d5c5b5281 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 16 Jun 2025 14:13:20 +0200
Subject: [PATCH 1844/2760] accel/kvm: Remove kvm_cpu_synchronize_state() stub
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since commit 57038a92bb0 ("cpus: extract out kvm-specific code
to accel/kvm") the kvm_cpu_synchronize_state() stub is not
necessary.

Fixes: e0715f6abce ("kvm: remove kvm specific functions from global includes")
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Message-Id: <20250703173248.44995-22-philmd@linaro.org>
---
 accel/stubs/kvm-stub.c | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/accel/stubs/kvm-stub.c b/accel/stubs/kvm-stub.c
index b9b4427c91..68cd33ba97 100644
--- a/accel/stubs/kvm-stub.c
+++ b/accel/stubs/kvm-stub.c
@@ -29,10 +29,6 @@ void kvm_flush_coalesced_mmio_buffer(void)
 {
 }
 
-void kvm_cpu_synchronize_state(CPUState *cpu)
-{
-}
-
 bool kvm_has_sync_mmu(void)
 {
     return false;

From 1f8b0b64736e978120753e63c51921573962a54c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 16 Jun 2025 16:09:08 +0200
Subject: [PATCH 1845/2760] accel/system: Document cpu_synchronize_state()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Message-Id: <20250703173248.44995-23-philmd@linaro.org>
---
 include/system/accel-ops.h |  8 ++++++++
 include/system/hw_accel.h  | 13 +++++++++++--
 2 files changed, 19 insertions(+), 2 deletions(-)

diff --git a/include/system/accel-ops.h b/include/system/accel-ops.h
index 4c99d25aef..55f91cea25 100644
--- a/include/system/accel-ops.h
+++ b/include/system/accel-ops.h
@@ -42,6 +42,14 @@ struct AccelOpsClass {
 
     void (*synchronize_post_reset)(CPUState *cpu);
     void (*synchronize_post_init)(CPUState *cpu);
+    /**
+     * synchronize_state:
+     * synchronize_pre_loadvm:
+     * @cpu: The vCPU to synchronize.
+     *
+     * Request to synchronize QEMU vCPU registers from the hardware accelerator
+     * (the hardware accelerator is the reference).
+     */
     void (*synchronize_state)(CPUState *cpu);
     void (*synchronize_pre_loadvm)(CPUState *cpu);
     void (*synchronize_pre_resume)(bool step_pending);
diff --git a/include/system/hw_accel.h b/include/system/hw_accel.h
index 380e9e640b..574c973840 100644
--- a/include/system/hw_accel.h
+++ b/include/system/hw_accel.h
@@ -17,9 +17,18 @@
 #include "system/whpx.h"
 #include "system/nvmm.h"
 
+/**
+ * cpu_synchronize_state:
+ * cpu_synchronize_pre_loadvm:
+ * @cpu: The vCPU to synchronize.
+ *
+ * Request to synchronize QEMU vCPU registers from the hardware accelerator
+ * (the hardware accelerator is the reference).
+ */
 void cpu_synchronize_state(CPUState *cpu);
-void cpu_synchronize_post_reset(CPUState *cpu);
-void cpu_synchronize_post_init(CPUState *cpu);
 void cpu_synchronize_pre_loadvm(CPUState *cpu);
 
+void cpu_synchronize_post_reset(CPUState *cpu);
+void cpu_synchronize_post_init(CPUState *cpu);
+
 #endif /* QEMU_HW_ACCEL_H */

From 60c9cec12c99e47fb2c82ad5dca36c9441b623dc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 16 Jun 2025 16:09:23 +0200
Subject: [PATCH 1846/2760] accel/system: Document
 cpu_synchronize_state_post_init/reset()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Message-Id: <20250703173248.44995-24-philmd@linaro.org>
---
 include/system/accel-ops.h | 8 ++++++++
 include/system/hw_accel.h  | 8 ++++++++
 2 files changed, 16 insertions(+)

diff --git a/include/system/accel-ops.h b/include/system/accel-ops.h
index 55f91cea25..a4e706b49c 100644
--- a/include/system/accel-ops.h
+++ b/include/system/accel-ops.h
@@ -40,6 +40,14 @@ struct AccelOpsClass {
     void (*kick_vcpu_thread)(CPUState *cpu);
     bool (*cpu_thread_is_idle)(CPUState *cpu);
 
+    /**
+     * synchronize_post_reset:
+     * synchronize_post_init:
+     * @cpu: The vCPU to synchronize.
+     *
+     * Request to synchronize QEMU vCPU registers to the hardware accelerator
+     * (QEMU is the reference).
+     */
     void (*synchronize_post_reset)(CPUState *cpu);
     void (*synchronize_post_init)(CPUState *cpu);
     /**
diff --git a/include/system/hw_accel.h b/include/system/hw_accel.h
index 574c973840..fa9228d5d2 100644
--- a/include/system/hw_accel.h
+++ b/include/system/hw_accel.h
@@ -28,6 +28,14 @@
 void cpu_synchronize_state(CPUState *cpu);
 void cpu_synchronize_pre_loadvm(CPUState *cpu);
 
+/**
+ * cpu_synchronize_post_reset:
+ * cpu_synchronize_post_init:
+ * @cpu: The vCPU to synchronize.
+ *
+ * Request to synchronize QEMU vCPU registers to the hardware accelerator
+ * (QEMU is the reference).
+ */
 void cpu_synchronize_post_reset(CPUState *cpu);
 void cpu_synchronize_post_init(CPUState *cpu);
 

From b6637bd5561d1d03f3a3d4335102cbf57fad5ad0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 16 Jun 2025 10:39:09 +0200
Subject: [PATCH 1847/2760] accel/nvmm: Expose nvmm_enabled() to common code
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Currently nvmm_enabled() is restricted to target-specific code.
By defining CONFIG_NVMM_IS_POSSIBLE we allow its use anywhere.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Message-Id: <20250703173248.44995-25-philmd@linaro.org>
---
 MAINTAINERS                 |  1 +
 accel/stubs/meson.build     |  1 +
 accel/stubs/nvmm-stub.c     | 12 ++++++++++++
 include/system/nvmm.h       | 23 ++++++++++++-----------
 target/i386/nvmm/nvmm-all.c |  8 +-------
 5 files changed, 27 insertions(+), 18 deletions(-)
 create mode 100644 accel/stubs/nvmm-stub.c

diff --git a/MAINTAINERS b/MAINTAINERS
index b1cbfe115b..c73468b242 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -586,6 +586,7 @@ NetBSD Virtual Machine Monitor (NVMM) CPU support
 M: Reinoud Zandijk <reinoud@netbsd.org>
 S: Maintained
 F: include/system/nvmm.h
+F: accel/stubs/nvmm-stub.c
 F: target/i386/nvmm/
 
 Hosts
diff --git a/accel/stubs/meson.build b/accel/stubs/meson.build
index 8ca1a4529e..4c34287215 100644
--- a/accel/stubs/meson.build
+++ b/accel/stubs/meson.build
@@ -3,5 +3,6 @@ system_stubs_ss.add(when: 'CONFIG_XEN', if_false: files('xen-stub.c'))
 system_stubs_ss.add(when: 'CONFIG_KVM', if_false: files('kvm-stub.c'))
 system_stubs_ss.add(when: 'CONFIG_TCG', if_false: files('tcg-stub.c'))
 system_stubs_ss.add(when: 'CONFIG_HVF', if_false: files('hvf-stub.c'))
+system_stubs_ss.add(when: 'CONFIG_NVMM', if_false: files('nvmm-stub.c'))
 
 specific_ss.add_all(when: ['CONFIG_SYSTEM_ONLY'], if_true: system_stubs_ss)
diff --git a/accel/stubs/nvmm-stub.c b/accel/stubs/nvmm-stub.c
new file mode 100644
index 0000000000..ec14837501
--- /dev/null
+++ b/accel/stubs/nvmm-stub.c
@@ -0,0 +1,12 @@
+/*
+ * NVMM stubs for QEMU
+ *
+ *  Copyright (c) Linaro
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "system/nvmm.h"
+
+bool nvmm_allowed;
diff --git a/include/system/nvmm.h b/include/system/nvmm.h
index 6971ddb3a5..7390def9ad 100644
--- a/include/system/nvmm.h
+++ b/include/system/nvmm.h
@@ -13,17 +13,18 @@
 #define QEMU_NVMM_H
 
 #ifdef COMPILING_PER_TARGET
-
-#ifdef CONFIG_NVMM
-
-int nvmm_enabled(void);
-
-#else /* CONFIG_NVMM */
-
-#define nvmm_enabled() (0)
-
-#endif /* CONFIG_NVMM */
-
+# ifdef CONFIG_NVMM
+#  define CONFIG_NVMM_IS_POSSIBLE
+# endif /* !CONFIG_NVMM */
+#else
+# define CONFIG_NVMM_IS_POSSIBLE
 #endif /* COMPILING_PER_TARGET */
 
+#ifdef CONFIG_NVMM_IS_POSSIBLE
+extern bool nvmm_allowed;
+#define nvmm_enabled() (nvmm_allowed)
+#else /* !CONFIG_NVMM_IS_POSSIBLE */
+#define nvmm_enabled() 0
+#endif /* !CONFIG_NVMM_IS_POSSIBLE */
+
 #endif /* QEMU_NVMM_H */
diff --git a/target/i386/nvmm/nvmm-all.c b/target/i386/nvmm/nvmm-all.c
index aea61a6fd2..2df49d7eeb 100644
--- a/target/i386/nvmm/nvmm-all.c
+++ b/target/i386/nvmm/nvmm-all.c
@@ -46,7 +46,7 @@ struct qemu_machine {
 
 /* -------------------------------------------------------------------------- */
 
-static bool nvmm_allowed;
+bool nvmm_allowed;
 static struct qemu_machine qemu_mach;
 
 static struct nvmm_machine *
@@ -1192,12 +1192,6 @@ nvmm_accel_init(MachineState *ms)
     return 0;
 }
 
-int
-nvmm_enabled(void)
-{
-    return nvmm_allowed;
-}
-
 static void
 nvmm_accel_class_init(ObjectClass *oc, const void *data)
 {

From d5a407a5763c4f5182124bb08c9157c0c667662f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 16 Jun 2025 10:40:00 +0200
Subject: [PATCH 1848/2760] accel/whpx: Expose whpx_enabled() to common code
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Currently whpx_enabled() is restricted to target-specific code.
By defining CONFIG_WHPX_IS_POSSIBLE we allow its use anywhere.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250703173248.44995-26-philmd@linaro.org>
---
 MAINTAINERS                 |  1 +
 accel/stubs/meson.build     |  1 +
 accel/stubs/whpx-stub.c     | 12 ++++++++++++
 include/system/whpx.h       | 27 ++++++++++++++-------------
 target/i386/whpx/whpx-all.c |  7 +------
 5 files changed, 29 insertions(+), 19 deletions(-)
 create mode 100644 accel/stubs/whpx-stub.c

diff --git a/MAINTAINERS b/MAINTAINERS
index c73468b242..0fd8b2a4e6 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -540,6 +540,7 @@ WHPX CPUs
 M: Sunil Muthuswamy <sunilmut@microsoft.com>
 S: Supported
 F: target/i386/whpx/
+F: accel/stubs/whpx-stub.c
 F: include/system/whpx.h
 
 X86 Instruction Emulator
diff --git a/accel/stubs/meson.build b/accel/stubs/meson.build
index 4c34287215..9dfc4f9dda 100644
--- a/accel/stubs/meson.build
+++ b/accel/stubs/meson.build
@@ -4,5 +4,6 @@ system_stubs_ss.add(when: 'CONFIG_KVM', if_false: files('kvm-stub.c'))
 system_stubs_ss.add(when: 'CONFIG_TCG', if_false: files('tcg-stub.c'))
 system_stubs_ss.add(when: 'CONFIG_HVF', if_false: files('hvf-stub.c'))
 system_stubs_ss.add(when: 'CONFIG_NVMM', if_false: files('nvmm-stub.c'))
+system_stubs_ss.add(when: 'CONFIG_WHPX', if_false: files('whpx-stub.c'))
 
 specific_ss.add_all(when: ['CONFIG_SYSTEM_ONLY'], if_true: system_stubs_ss)
diff --git a/accel/stubs/whpx-stub.c b/accel/stubs/whpx-stub.c
new file mode 100644
index 0000000000..c564c89fd0
--- /dev/null
+++ b/accel/stubs/whpx-stub.c
@@ -0,0 +1,12 @@
+/*
+ * WHPX stubs for QEMU
+ *
+ *  Copyright (c) Linaro
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "system/whpx.h"
+
+bool whpx_allowed;
diff --git a/include/system/whpx.h b/include/system/whpx.h
index 00ff409b68..00f6a3e523 100644
--- a/include/system/whpx.h
+++ b/include/system/whpx.h
@@ -16,19 +16,20 @@
 #define QEMU_WHPX_H
 
 #ifdef COMPILING_PER_TARGET
-
-#ifdef CONFIG_WHPX
-
-int whpx_enabled(void);
-bool whpx_apic_in_platform(void);
-
-#else /* CONFIG_WHPX */
-
-#define whpx_enabled() (0)
-#define whpx_apic_in_platform() (0)
-
-#endif /* CONFIG_WHPX */
-
+# ifdef CONFIG_WHPX
+#  define CONFIG_WHPX_IS_POSSIBLE
+# endif /* !CONFIG_WHPX */
+#else
+# define CONFIG_WHPX_IS_POSSIBLE
 #endif /* COMPILING_PER_TARGET */
 
+#ifdef CONFIG_WHPX_IS_POSSIBLE
+extern bool whpx_allowed;
+#define whpx_enabled() (whpx_allowed)
+bool whpx_apic_in_platform(void);
+#else /* !CONFIG_WHPX_IS_POSSIBLE */
+#define whpx_enabled() 0
+#define whpx_apic_in_platform() (0)
+#endif /* !CONFIG_WHPX_IS_POSSIBLE */
+
 #endif /* QEMU_WHPX_H */
diff --git a/target/i386/whpx/whpx-all.c b/target/i386/whpx/whpx-all.c
index 5001afad3a..94fd5fc784 100644
--- a/target/i386/whpx/whpx-all.c
+++ b/target/i386/whpx/whpx-all.c
@@ -242,7 +242,7 @@ struct AccelCPUState {
     WHV_RUN_VP_EXIT_CONTEXT exit_ctx;
 };
 
-static bool whpx_allowed;
+bool whpx_allowed;
 static bool whp_dispatch_initialized;
 static HMODULE hWinHvPlatform, hWinHvEmulation;
 static uint32_t max_vcpu_index;
@@ -2688,11 +2688,6 @@ error:
     return ret;
 }
 
-int whpx_enabled(void)
-{
-    return whpx_allowed;
-}
-
 bool whpx_apic_in_platform(void) {
     return whpx_global.apic_in_platform;
 }

From e8388158e62184cb567b7b97ab9e6738dec45348 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 30 Jun 2025 16:20:10 +0200
Subject: [PATCH 1849/2760] accel/dummy: Extract 'dummy-cpus.h' header from
 'system/cpus.h'
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

'dummy' helpers are specific to accelerator implementations,
no need to expose them via "system/cpus.h".

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Message-Id: <20250703173248.44995-27-philmd@linaro.org>
---
 MAINTAINERS           |  1 +
 accel/dummy-cpus.c    |  1 +
 accel/dummy-cpus.h    | 14 ++++++++++++++
 accel/qtest/qtest.c   |  1 +
 accel/xen/xen-all.c   |  1 +
 include/system/cpus.h |  5 -----
 6 files changed, 18 insertions(+), 5 deletions(-)
 create mode 100644 accel/dummy-cpus.h

diff --git a/MAINTAINERS b/MAINTAINERS
index 0fd8b2a4e6..fca98e1219 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -503,6 +503,7 @@ F: include/system/accel-*.h
 F: include/system/cpus.h
 F: include/accel/accel-cpu*.h
 F: accel/accel-*.?
+F: accel/dummy-cpus.?
 F: accel/Makefile.objs
 F: accel/stubs/Makefile.objs
 F: cpu-common.c
diff --git a/accel/dummy-cpus.c b/accel/dummy-cpus.c
index 867276144f..03cfc0fa01 100644
--- a/accel/dummy-cpus.c
+++ b/accel/dummy-cpus.c
@@ -17,6 +17,7 @@
 #include "qemu/guest-random.h"
 #include "qemu/main-loop.h"
 #include "hw/core/cpu.h"
+#include "accel/dummy-cpus.h"
 
 static void *dummy_cpu_thread_fn(void *arg)
 {
diff --git a/accel/dummy-cpus.h b/accel/dummy-cpus.h
new file mode 100644
index 0000000000..d18dd0fdc5
--- /dev/null
+++ b/accel/dummy-cpus.h
@@ -0,0 +1,14 @@
+/*
+ * Dummy cpu thread code
+ *
+ * Copyright IBM, Corp. 2011
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef ACCEL_DUMMY_CPUS_H
+#define ACCEL_DUMMY_CPUS_H
+
+void dummy_start_vcpu_thread(CPUState *cpu);
+
+#endif
diff --git a/accel/qtest/qtest.c b/accel/qtest/qtest.c
index 92bed9264c..612cede160 100644
--- a/accel/qtest/qtest.c
+++ b/accel/qtest/qtest.c
@@ -24,6 +24,7 @@
 #include "qemu/guest-random.h"
 #include "qemu/main-loop.h"
 #include "hw/core/cpu.h"
+#include "accel/dummy-cpus.h"
 
 static int64_t qtest_clock_counter;
 
diff --git a/accel/xen/xen-all.c b/accel/xen/xen-all.c
index de52a8f882..c150dd43ca 100644
--- a/accel/xen/xen-all.c
+++ b/accel/xen/xen-all.c
@@ -18,6 +18,7 @@
 #include "hw/xen/xen_igd.h"
 #include "chardev/char.h"
 #include "qemu/accel.h"
+#include "accel/dummy-cpus.h"
 #include "system/accel-ops.h"
 #include "system/cpus.h"
 #include "system/xen.h"
diff --git a/include/system/cpus.h b/include/system/cpus.h
index 3226c765d0..69be6a77a7 100644
--- a/include/system/cpus.h
+++ b/include/system/cpus.h
@@ -7,11 +7,6 @@ void cpus_register_accel(const AccelOpsClass *i);
 /* return registers ops */
 const AccelOpsClass *cpus_get_accel(void);
 
-/* accel/dummy-cpus.c */
-
-/* Create a dummy vcpu for AccelOpsClass->create_vcpu_thread */
-void dummy_start_vcpu_thread(CPUState *);
-
 /* interface available for cpus accelerator threads */
 
 /* For temporary buffers for forming a name */

From b9b8ce038497a18f4525e9b229f9090b1cec3b05 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 12 Jun 2025 14:45:19 +0200
Subject: [PATCH 1850/2760] accel: Expose and register
 generic_handle_interrupt()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In order to dispatch over AccelOpsClass::handle_interrupt(),
we need it always defined, not calling a hidden handler under
the hood. Make AccelOpsClass::handle_interrupt() mandatory.
Expose generic_handle_interrupt() prototype and register it
for each accelerator.

Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Message-Id: <20250703173248.44995-29-philmd@linaro.org>
---
 accel/hvf/hvf-accel-ops.c         |  1 +
 accel/kvm/kvm-accel-ops.c         |  1 +
 accel/qtest/qtest.c               |  1 +
 accel/xen/xen-all.c               |  1 +
 include/system/accel-ops.h        |  3 +++
 system/cpus.c                     | 10 ++++------
 target/i386/nvmm/nvmm-accel-ops.c |  1 +
 target/i386/whpx/whpx-accel-ops.c |  1 +
 8 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/accel/hvf/hvf-accel-ops.c b/accel/hvf/hvf-accel-ops.c
index 395b5a8e1c..be8724ac89 100644
--- a/accel/hvf/hvf-accel-ops.c
+++ b/accel/hvf/hvf-accel-ops.c
@@ -353,6 +353,7 @@ static void hvf_accel_ops_class_init(ObjectClass *oc, const void *data)
 
     ops->create_vcpu_thread = hvf_start_vcpu_thread;
     ops->kick_vcpu_thread = hvf_kick_vcpu_thread;
+    ops->handle_interrupt = generic_handle_interrupt;
 
     ops->synchronize_post_reset = hvf_cpu_synchronize_post_reset;
     ops->synchronize_post_init = hvf_cpu_synchronize_post_init;
diff --git a/accel/kvm/kvm-accel-ops.c b/accel/kvm/kvm-accel-ops.c
index e5c15449aa..0eafc902c3 100644
--- a/accel/kvm/kvm-accel-ops.c
+++ b/accel/kvm/kvm-accel-ops.c
@@ -101,6 +101,7 @@ static void kvm_accel_ops_class_init(ObjectClass *oc, const void *data)
     ops->synchronize_post_init = kvm_cpu_synchronize_post_init;
     ops->synchronize_state = kvm_cpu_synchronize_state;
     ops->synchronize_pre_loadvm = kvm_cpu_synchronize_pre_loadvm;
+    ops->handle_interrupt = generic_handle_interrupt;
 
 #ifdef TARGET_KVM_HAVE_GUEST_DEBUG
     ops->update_guest_debug = kvm_update_guest_debug_ops;
diff --git a/accel/qtest/qtest.c b/accel/qtest/qtest.c
index 612cede160..5474ce7313 100644
--- a/accel/qtest/qtest.c
+++ b/accel/qtest/qtest.c
@@ -67,6 +67,7 @@ static void qtest_accel_ops_class_init(ObjectClass *oc, const void *data)
     ops->create_vcpu_thread = dummy_start_vcpu_thread;
     ops->get_virtual_clock = qtest_get_virtual_clock;
     ops->set_virtual_clock = qtest_set_virtual_clock;
+    ops->handle_interrupt = generic_handle_interrupt;
 };
 
 static const TypeInfo qtest_accel_ops_type = {
diff --git a/accel/xen/xen-all.c b/accel/xen/xen-all.c
index c150dd43ca..c12c22de78 100644
--- a/accel/xen/xen-all.c
+++ b/accel/xen/xen-all.c
@@ -153,6 +153,7 @@ static void xen_accel_ops_class_init(ObjectClass *oc, const void *data)
     AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
 
     ops->create_vcpu_thread = dummy_start_vcpu_thread;
+    ops->handle_interrupt = generic_handle_interrupt;
 }
 
 static const TypeInfo xen_accel_ops_type = {
diff --git a/include/system/accel-ops.h b/include/system/accel-ops.h
index a4e706b49c..e775ecc348 100644
--- a/include/system/accel-ops.h
+++ b/include/system/accel-ops.h
@@ -62,6 +62,7 @@ struct AccelOpsClass {
     void (*synchronize_pre_loadvm)(CPUState *cpu);
     void (*synchronize_pre_resume)(bool step_pending);
 
+    /* handle_interrupt is mandatory. */
     void (*handle_interrupt)(CPUState *cpu, int mask);
 
     /**
@@ -86,4 +87,6 @@ struct AccelOpsClass {
     void (*remove_all_breakpoints)(CPUState *cpu);
 };
 
+void generic_handle_interrupt(CPUState *cpu, int mask);
+
 #endif /* ACCEL_OPS_H */
diff --git a/system/cpus.c b/system/cpus.c
index a43e0e4e79..0d0eec82a2 100644
--- a/system/cpus.c
+++ b/system/cpus.c
@@ -254,7 +254,7 @@ int64_t cpus_get_elapsed_ticks(void)
     return cpu_get_ticks();
 }
 
-static void generic_handle_interrupt(CPUState *cpu, int mask)
+void generic_handle_interrupt(CPUState *cpu, int mask)
 {
     cpu->interrupt_request |= mask;
 
@@ -267,11 +267,7 @@ void cpu_interrupt(CPUState *cpu, int mask)
 {
     g_assert(bql_locked());
 
-    if (cpus_accel->handle_interrupt) {
-        cpus_accel->handle_interrupt(cpu, mask);
-    } else {
-        generic_handle_interrupt(cpu, mask);
-    }
+    cpus_accel->handle_interrupt(cpu, mask);
 }
 
 /*
@@ -680,6 +676,8 @@ void cpus_register_accel(const AccelOpsClass *ops)
 {
     assert(ops != NULL);
     assert(ops->create_vcpu_thread != NULL); /* mandatory */
+    assert(ops->handle_interrupt);
+
     cpus_accel = ops;
 }
 
diff --git a/target/i386/nvmm/nvmm-accel-ops.c b/target/i386/nvmm/nvmm-accel-ops.c
index 21443078b7..a5517b0abf 100644
--- a/target/i386/nvmm/nvmm-accel-ops.c
+++ b/target/i386/nvmm/nvmm-accel-ops.c
@@ -87,6 +87,7 @@ static void nvmm_accel_ops_class_init(ObjectClass *oc, const void *data)
 
     ops->create_vcpu_thread = nvmm_start_vcpu_thread;
     ops->kick_vcpu_thread = nvmm_kick_vcpu_thread;
+    ops->handle_interrupt = generic_handle_interrupt;
 
     ops->synchronize_post_reset = nvmm_cpu_synchronize_post_reset;
     ops->synchronize_post_init = nvmm_cpu_synchronize_post_init;
diff --git a/target/i386/whpx/whpx-accel-ops.c b/target/i386/whpx/whpx-accel-ops.c
index b8bebe403c..31cf15f004 100644
--- a/target/i386/whpx/whpx-accel-ops.c
+++ b/target/i386/whpx/whpx-accel-ops.c
@@ -90,6 +90,7 @@ static void whpx_accel_ops_class_init(ObjectClass *oc, const void *data)
     ops->create_vcpu_thread = whpx_start_vcpu_thread;
     ops->kick_vcpu_thread = whpx_kick_vcpu_thread;
     ops->cpu_thread_is_idle = whpx_vcpu_thread_is_idle;
+    ops->handle_interrupt = generic_handle_interrupt;
 
     ops->synchronize_post_reset = whpx_cpu_synchronize_post_reset;
     ops->synchronize_post_init = whpx_cpu_synchronize_post_init;

From 38623a9f63395cecdd4138a305e1187e10964990 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 6 Jun 2025 12:07:47 +0200
Subject: [PATCH 1851/2760] accel: Keep reference to AccelOpsClass in
 AccelClass
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Allow dereferencing AccelOpsClass outside of accel/accel-system.c.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20250703173248.44995-30-philmd@linaro.org>
---
 accel/accel-system.c       | 3 ++-
 accel/tcg/tcg-accel-ops.c  | 4 +++-
 include/qemu/accel.h       | 3 +++
 include/system/accel-ops.h | 3 ++-
 4 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/accel/accel-system.c b/accel/accel-system.c
index a0f562ae9f..64bc991b1c 100644
--- a/accel/accel-system.c
+++ b/accel/accel-system.c
@@ -85,8 +85,9 @@ void accel_init_ops_interfaces(AccelClass *ac)
      * non-NULL create_vcpu_thread operation.
      */
     ops = ACCEL_OPS_CLASS(oc);
+    ac->ops = ops;
     if (ops->ops_init) {
-        ops->ops_init(ops);
+        ops->ops_init(ac);
     }
     cpus_register_accel(ops);
 }
diff --git a/accel/tcg/tcg-accel-ops.c b/accel/tcg/tcg-accel-ops.c
index 6116644d1c..37b4b21f88 100644
--- a/accel/tcg/tcg-accel-ops.c
+++ b/accel/tcg/tcg-accel-ops.c
@@ -196,8 +196,10 @@ static inline void tcg_remove_all_breakpoints(CPUState *cpu)
     cpu_watchpoint_remove_all(cpu, BP_GDB);
 }
 
-static void tcg_accel_ops_init(AccelOpsClass *ops)
+static void tcg_accel_ops_init(AccelClass *ac)
 {
+    AccelOpsClass *ops = ac->ops;
+
     if (qemu_tcg_mttcg_enabled()) {
         ops->create_vcpu_thread = mttcg_start_vcpu_thread;
         ops->kick_vcpu_thread = mttcg_kick_vcpu_thread;
diff --git a/include/qemu/accel.h b/include/qemu/accel.h
index fbd3d897fe..9dea314542 100644
--- a/include/qemu/accel.h
+++ b/include/qemu/accel.h
@@ -37,6 +37,9 @@ typedef struct AccelClass {
     /*< public >*/
 
     const char *name;
+    /* Cached by accel_init_ops_interfaces() when created */
+    AccelOpsClass *ops;
+
     int (*init_machine)(MachineState *ms);
     bool (*cpu_common_realize)(CPUState *cpu, Error **errp);
     void (*cpu_common_unrealize)(CPUState *cpu);
diff --git a/include/system/accel-ops.h b/include/system/accel-ops.h
index e775ecc348..a786c7d478 100644
--- a/include/system/accel-ops.h
+++ b/include/system/accel-ops.h
@@ -10,6 +10,7 @@
 #ifndef ACCEL_OPS_H
 #define ACCEL_OPS_H
 
+#include "qemu/accel.h"
 #include "exec/vaddr.h"
 #include "qom/object.h"
 
@@ -31,7 +32,7 @@ struct AccelOpsClass {
     /*< public >*/
 
     /* initialization function called when accel is chosen */
-    void (*ops_init)(AccelOpsClass *ops);
+    void (*ops_init)(AccelClass *ac);
 
     bool (*cpus_are_resettable)(void);
     void (*cpu_reset_hold)(CPUState *cpu);

From 51e189619992a08d529bf580f6bcf074f5a7af0d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 6 Jun 2025 12:24:41 +0200
Subject: [PATCH 1852/2760] accel: Propagate AccelState to
 AccelClass::init_machine()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In order to avoid init_machine() to call current_accel(),
pass AccelState along.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20250703173248.44995-31-philmd@linaro.org>
---
 accel/accel-system.c        | 2 +-
 accel/hvf/hvf-all.c         | 2 +-
 accel/kvm/kvm-all.c         | 2 +-
 accel/qtest/qtest.c         | 2 +-
 accel/tcg/tcg-all.c         | 2 +-
 accel/xen/xen-all.c         | 2 +-
 bsd-user/main.c             | 2 +-
 include/qemu/accel.h        | 2 +-
 linux-user/main.c           | 2 +-
 target/i386/nvmm/nvmm-all.c | 2 +-
 target/i386/whpx/whpx-all.c | 2 +-
 11 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/accel/accel-system.c b/accel/accel-system.c
index 64bc991b1c..913b7155d7 100644
--- a/accel/accel-system.c
+++ b/accel/accel-system.c
@@ -37,7 +37,7 @@ int accel_init_machine(AccelState *accel, MachineState *ms)
     int ret;
     ms->accelerator = accel;
     *(acc->allowed) = true;
-    ret = acc->init_machine(ms);
+    ret = acc->init_machine(accel, ms);
     if (ret < 0) {
         ms->accelerator = NULL;
         *(acc->allowed) = false;
diff --git a/accel/hvf/hvf-all.c b/accel/hvf/hvf-all.c
index ddc77e629f..68f1425fae 100644
--- a/accel/hvf/hvf-all.c
+++ b/accel/hvf/hvf-all.c
@@ -247,7 +247,7 @@ static MemoryListener hvf_memory_listener = {
     .log_sync = hvf_log_sync,
 };
 
-static int hvf_accel_init(MachineState *ms)
+static int hvf_accel_init(AccelState *as, MachineState *ms)
 {
     int x;
     hv_return_t ret;
diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index 17235f2646..264f288dc6 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -2573,7 +2573,7 @@ static int kvm_setup_dirty_ring(KVMState *s)
     return 0;
 }
 
-static int kvm_init(MachineState *ms)
+static int kvm_init(AccelState *as, MachineState *ms)
 {
     MachineClass *mc = MACHINE_GET_CLASS(ms);
     static const char upgrade_note[] =
diff --git a/accel/qtest/qtest.c b/accel/qtest/qtest.c
index 5474ce7313..2b83126020 100644
--- a/accel/qtest/qtest.c
+++ b/accel/qtest/qtest.c
@@ -38,7 +38,7 @@ static void qtest_set_virtual_clock(int64_t count)
     qatomic_set_i64(&qtest_clock_counter, count);
 }
 
-static int qtest_init_accel(MachineState *ms)
+static int qtest_init_accel(AccelState *as, MachineState *ms)
 {
     return 0;
 }
diff --git a/accel/tcg/tcg-all.c b/accel/tcg/tcg-all.c
index 6e5dc333d5..d68fbb2377 100644
--- a/accel/tcg/tcg-all.c
+++ b/accel/tcg/tcg-all.c
@@ -80,7 +80,7 @@ static void tcg_accel_instance_init(Object *obj)
 
 bool one_insn_per_tb;
 
-static int tcg_init_machine(MachineState *ms)
+static int tcg_init_machine(AccelState *as, MachineState *ms)
 {
     TCGState *s = TCG_STATE(current_accel());
     unsigned max_threads = 1;
diff --git a/accel/xen/xen-all.c b/accel/xen/xen-all.c
index c12c22de78..8279746f11 100644
--- a/accel/xen/xen-all.c
+++ b/accel/xen/xen-all.c
@@ -77,7 +77,7 @@ static void xen_setup_post(MachineState *ms, AccelState *accel)
     }
 }
 
-static int xen_init(MachineState *ms)
+static int xen_init(AccelState *as, MachineState *ms)
 {
     MachineClass *mc = MACHINE_GET_CLASS(ms);
 
diff --git a/bsd-user/main.c b/bsd-user/main.c
index 7c0a059c3b..d0cc8e0088 100644
--- a/bsd-user/main.c
+++ b/bsd-user/main.c
@@ -474,7 +474,7 @@ int main(int argc, char **argv)
                                  opt_one_insn_per_tb, &error_abort);
         object_property_set_int(OBJECT(accel), "tb-size",
                                 opt_tb_size, &error_abort);
-        ac->init_machine(NULL);
+        ac->init_machine(accel, NULL);
     }
 
     /*
diff --git a/include/qemu/accel.h b/include/qemu/accel.h
index 9dea314542..b9a9b3593d 100644
--- a/include/qemu/accel.h
+++ b/include/qemu/accel.h
@@ -40,7 +40,7 @@ typedef struct AccelClass {
     /* Cached by accel_init_ops_interfaces() when created */
     AccelOpsClass *ops;
 
-    int (*init_machine)(MachineState *ms);
+    int (*init_machine)(AccelState *as, MachineState *ms);
     bool (*cpu_common_realize)(CPUState *cpu, Error **errp);
     void (*cpu_common_unrealize)(CPUState *cpu);
 
diff --git a/linux-user/main.c b/linux-user/main.c
index 5ac5b55dc6..a9142ee726 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -820,7 +820,7 @@ int main(int argc, char **argv, char **envp)
                                  opt_one_insn_per_tb, &error_abort);
         object_property_set_int(OBJECT(accel), "tb-size",
                                 opt_tb_size, &error_abort);
-        ac->init_machine(NULL);
+        ac->init_machine(accel, NULL);
     }
 
     /*
diff --git a/target/i386/nvmm/nvmm-all.c b/target/i386/nvmm/nvmm-all.c
index 2df49d7eeb..b4a4d50e86 100644
--- a/target/i386/nvmm/nvmm-all.c
+++ b/target/i386/nvmm/nvmm-all.c
@@ -1152,7 +1152,7 @@ static struct RAMBlockNotifier nvmm_ram_notifier = {
 /* -------------------------------------------------------------------------- */
 
 static int
-nvmm_accel_init(MachineState *ms)
+nvmm_accel_init(AccelState *as, MachineState *ms)
 {
     int ret, err;
 
diff --git a/target/i386/whpx/whpx-all.c b/target/i386/whpx/whpx-all.c
index 94fd5fc784..721c4782b9 100644
--- a/target/i386/whpx/whpx-all.c
+++ b/target/i386/whpx/whpx-all.c
@@ -2504,7 +2504,7 @@ static void whpx_set_kernel_irqchip(Object *obj, Visitor *v,
  * Partition support
  */
 
-static int whpx_accel_init(MachineState *ms)
+static int whpx_accel_init(AccelState *as, MachineState *ms)
 {
     struct whpx_state *whpx;
     int ret;

From 0fdcfc3baf9af2f2e1903eebf23edc9dd8b0aec2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 6 Jun 2025 12:29:17 +0200
Subject: [PATCH 1853/2760] accel/tcg: Prefer local AccelState over global
 current_accel()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250703173248.44995-33-philmd@linaro.org>
---
 accel/tcg/tcg-all.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/accel/tcg/tcg-all.c b/accel/tcg/tcg-all.c
index d68fbb2377..c674d5bcf7 100644
--- a/accel/tcg/tcg-all.c
+++ b/accel/tcg/tcg-all.c
@@ -82,7 +82,7 @@ bool one_insn_per_tb;
 
 static int tcg_init_machine(AccelState *as, MachineState *ms)
 {
-    TCGState *s = TCG_STATE(current_accel());
+    TCGState *s = TCG_STATE(as);
     unsigned max_threads = 1;
 
 #ifndef CONFIG_USER_ONLY

From f0db25adcfa930a97b5192a6f59fd08c369c32e6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 6 Jun 2025 12:26:18 +0200
Subject: [PATCH 1854/2760] accel/kvm: Prefer local AccelState over global
 MachineState::accel
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250703173248.44995-32-philmd@linaro.org>
---
 accel/kvm/kvm-all.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index 264f288dc6..72fba12d9f 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -2588,15 +2588,13 @@ static int kvm_init(AccelState *as, MachineState *ms)
         { /* end of list */ }
     }, *nc = num_cpus;
     int soft_vcpus_limit, hard_vcpus_limit;
-    KVMState *s;
+    KVMState *s = KVM_STATE(as);
     const KVMCapabilityInfo *missing_cap;
     int ret;
     int type;
 
     qemu_mutex_init(&kml_slots_lock);
 
-    s = KVM_STATE(ms->accelerator);
-
     /*
      * On systems where the kernel can support different base page
      * sizes, host page size may be different from TARGET_PAGE_SIZE,

From 583d1c8f1652777e7d60f09eb58c1f6378d897f1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 30 Jun 2025 15:30:24 +0200
Subject: [PATCH 1855/2760] accel/kvm: Directly pass KVMState argument to
 do_kvm_create_vm()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250703173248.44995-35-philmd@linaro.org>
---
 accel/kvm/kvm-all.c | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index 72fba12d9f..007f82a50d 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -2470,13 +2470,10 @@ uint32_t kvm_dirty_ring_size(void)
     return kvm_state->kvm_dirty_ring_size;
 }
 
-static int do_kvm_create_vm(MachineState *ms, int type)
+static int do_kvm_create_vm(KVMState *s, int type)
 {
-    KVMState *s;
     int ret;
 
-    s = KVM_STATE(ms->accelerator);
-
     do {
         ret = kvm_ioctl(s, KVM_CREATE_VM, type);
     } while (ret == -EINTR);
@@ -2646,7 +2643,7 @@ static int kvm_init(AccelState *as, MachineState *ms)
         goto err;
     }
 
-    ret = do_kvm_create_vm(ms, type);
+    ret = do_kvm_create_vm(s, type);
     if (ret < 0) {
         goto err;
     }

From 8dd5e6befc86161598eace2bfeb090c2cfb179fd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 30 Jun 2025 15:28:08 +0200
Subject: [PATCH 1856/2760] accel: Directly pass AccelState argument to
 AccelClass::has_memory()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20250703173248.44995-34-philmd@linaro.org>
---
 accel/kvm/kvm-all.c  | 4 ++--
 include/qemu/accel.h | 2 +-
 system/memory.c      | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index 007f82a50d..6f6f9ef69b 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -3786,10 +3786,10 @@ int kvm_get_one_reg(CPUState *cs, uint64_t id, void *target)
     return r;
 }
 
-static bool kvm_accel_has_memory(MachineState *ms, AddressSpace *as,
+static bool kvm_accel_has_memory(AccelState *accel, AddressSpace *as,
                                  hwaddr start_addr, hwaddr size)
 {
-    KVMState *kvm = KVM_STATE(ms->accelerator);
+    KVMState *kvm = KVM_STATE(accel);
     int i;
 
     for (i = 0; i < kvm->nr_as; ++i) {
diff --git a/include/qemu/accel.h b/include/qemu/accel.h
index b9a9b3593d..f327a71282 100644
--- a/include/qemu/accel.h
+++ b/include/qemu/accel.h
@@ -46,7 +46,7 @@ typedef struct AccelClass {
 
     /* system related hooks */
     void (*setup_post)(MachineState *ms, AccelState *accel);
-    bool (*has_memory)(MachineState *ms, AddressSpace *as,
+    bool (*has_memory)(AccelState *accel, AddressSpace *as,
                        hwaddr start_addr, hwaddr size);
 
     /* gdbstub related hooks */
diff --git a/system/memory.c b/system/memory.c
index 76b44b8220..e8d9b15b28 100644
--- a/system/memory.c
+++ b/system/memory.c
@@ -3501,7 +3501,7 @@ static void mtree_print_flatview(gpointer key, gpointer value,
         if (fvi->ac) {
             for (i = 0; i < fv_address_spaces->len; ++i) {
                 as = g_array_index(fv_address_spaces, AddressSpace*, i);
-                if (fvi->ac->has_memory(current_machine, as,
+                if (fvi->ac->has_memory(current_machine->accelerator, as,
                                         int128_get64(range->addr.start),
                                         MR_SIZE(range->addr.size) + 1)) {
                     qemu_printf(" %s", fvi->ac->name);

From 1e9fb43d30c0526e164bebaab387b615edfa79ad Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 30 Jun 2025 15:33:25 +0200
Subject: [PATCH 1857/2760] accel: Remove unused MachineState argument of
 AccelClass::setup_post()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This method only accesses xen_domid/xen_domid_restrict, which are both
related to the 'accelerator', not the machine. Besides, xen_domid aims
to be in Xen AccelState and xen_domid_restrict a xen_domid_restrict
QOM property.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250703173248.44995-36-philmd@linaro.org>
---
 accel/accel-system.c | 2 +-
 accel/xen/xen-all.c  | 2 +-
 include/qemu/accel.h | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/accel/accel-system.c b/accel/accel-system.c
index 913b7155d7..af713cc902 100644
--- a/accel/accel-system.c
+++ b/accel/accel-system.c
@@ -58,7 +58,7 @@ void accel_setup_post(MachineState *ms)
     AccelState *accel = ms->accelerator;
     AccelClass *acc = ACCEL_GET_CLASS(accel);
     if (acc->setup_post) {
-        acc->setup_post(ms, accel);
+        acc->setup_post(accel);
     }
 }
 
diff --git a/accel/xen/xen-all.c b/accel/xen/xen-all.c
index 8279746f11..bd0ff64bef 100644
--- a/accel/xen/xen-all.c
+++ b/accel/xen/xen-all.c
@@ -64,7 +64,7 @@ static void xen_set_igd_gfx_passthru(Object *obj, bool value, Error **errp)
     xen_igd_gfx_pt_set(value, errp);
 }
 
-static void xen_setup_post(MachineState *ms, AccelState *accel)
+static void xen_setup_post(AccelState *as)
 {
     int rc;
 
diff --git a/include/qemu/accel.h b/include/qemu/accel.h
index f327a71282..a6a95ff0bc 100644
--- a/include/qemu/accel.h
+++ b/include/qemu/accel.h
@@ -45,7 +45,7 @@ typedef struct AccelClass {
     void (*cpu_common_unrealize)(CPUState *cpu);
 
     /* system related hooks */
-    void (*setup_post)(MachineState *ms, AccelState *accel);
+    void (*setup_post)(AccelState *as);
     bool (*has_memory)(AccelState *accel, AddressSpace *as,
                        hwaddr start_addr, hwaddr size);
 

From 842e7eecd4446957c5edf0c65e5e41fadea2f015 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 20 Jun 2025 10:59:21 +0200
Subject: [PATCH 1858/2760] accel: Pass AccelState argument to
 gdbstub_supported_sstep_flags()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In order to have AccelClass methods instrospect their state,
we need to pass AccelState by argument.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250703173248.44995-37-philmd@linaro.org>
---
 accel/accel-common.c | 2 +-
 accel/hvf/hvf-all.c  | 2 +-
 accel/kvm/kvm-all.c  | 2 +-
 accel/tcg/tcg-all.c  | 2 +-
 include/qemu/accel.h | 2 +-
 5 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/accel/accel-common.c b/accel/accel-common.c
index 4894b98d64..591ff4cbb6 100644
--- a/accel/accel-common.c
+++ b/accel/accel-common.c
@@ -124,7 +124,7 @@ int accel_supported_gdbstub_sstep_flags(void)
     AccelState *accel = current_accel();
     AccelClass *acc = ACCEL_GET_CLASS(accel);
     if (acc->gdbstub_supported_sstep_flags) {
-        return acc->gdbstub_supported_sstep_flags();
+        return acc->gdbstub_supported_sstep_flags(accel);
     }
     return 0;
 }
diff --git a/accel/hvf/hvf-all.c b/accel/hvf/hvf-all.c
index 68f1425fae..b6075c036e 100644
--- a/accel/hvf/hvf-all.c
+++ b/accel/hvf/hvf-all.c
@@ -281,7 +281,7 @@ static int hvf_accel_init(AccelState *as, MachineState *ms)
     return hvf_arch_init();
 }
 
-static int hvf_gdbstub_sstep_flags(void)
+static int hvf_gdbstub_sstep_flags(AccelState *as)
 {
     return SSTEP_ENABLE | SSTEP_NOIRQ;
 }
diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index 6f6f9ef69b..45579f80fa 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -3980,7 +3980,7 @@ static void kvm_accel_instance_init(Object *obj)
  * Returns: SSTEP_* flags that KVM supports for guest debug. The
  * support is probed during kvm_init()
  */
-static int kvm_gdbstub_sstep_flags(void)
+static int kvm_gdbstub_sstep_flags(AccelState *as)
 {
     return kvm_sstep_flags;
 }
diff --git a/accel/tcg/tcg-all.c b/accel/tcg/tcg-all.c
index c674d5bcf7..5904582a68 100644
--- a/accel/tcg/tcg-all.c
+++ b/accel/tcg/tcg-all.c
@@ -219,7 +219,7 @@ static void tcg_set_one_insn_per_tb(Object *obj, bool value, Error **errp)
     qatomic_set(&one_insn_per_tb, value);
 }
 
-static int tcg_gdbstub_supported_sstep_flags(void)
+static int tcg_gdbstub_supported_sstep_flags(AccelState *as)
 {
     /*
      * In replay mode all events will come from the log and can't be
diff --git a/include/qemu/accel.h b/include/qemu/accel.h
index a6a95ff0bc..1c097ac4df 100644
--- a/include/qemu/accel.h
+++ b/include/qemu/accel.h
@@ -50,7 +50,7 @@ typedef struct AccelClass {
                        hwaddr start_addr, hwaddr size);
 
     /* gdbstub related hooks */
-    int (*gdbstub_supported_sstep_flags)(void);
+    int (*gdbstub_supported_sstep_flags)(AccelState *as);
 
     bool *allowed;
     /*

From 0fd1d74080215571f2c8e2b85bfefb3c65238cfe Mon Sep 17 00:00:00 2001
From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Date: Mon, 23 Jun 2025 11:53:06 -0300
Subject: [PATCH 1859/2760] monitor/hmp-cmds-target: add CPU_DUMP_VPU in
 hmp_info_registers()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Commit b84694defb added the CPU_DUMP_VPU to allow vector registers to be
logged by log_cpu_exec() in TCG. This flag was then used in commit
b227f6a8a7 to print RISC-V vector registers using this flag. Note that
this change was done in riscv_cpu_dump_state(), the cpu_dump_state()
callback for RISC-V, the same callback used in hmp_info_registers().

Back then we forgot to change hmp_info_registers(), and 'info registers'
isn't showing RISC-V vector registers as a result. No other target is
impacted since only RISC-V is using CPU_DUMP_VPU.

There's no reason to not show VPU regs in info_registers(), so add
CPU_DUMP_VPU to hmp_info_registers(). This will print vector registers
for all RISC-V machines and, as said above, has no impact in other
archs.

Cc: Dr. David Alan Gilbert <dave@treblig.org>
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250623145306.991562-1-dbarboza@ventanamicro.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 monitor/hmp-cmds-target.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/monitor/hmp-cmds-target.c b/monitor/hmp-cmds-target.c
index 8eaf70d9c9..e982061146 100644
--- a/monitor/hmp-cmds-target.c
+++ b/monitor/hmp-cmds-target.c
@@ -102,7 +102,7 @@ void hmp_info_registers(Monitor *mon, const QDict *qdict)
     if (all_cpus) {
         CPU_FOREACH(cs) {
             monitor_printf(mon, "\nCPU#%d\n", cs->cpu_index);
-            cpu_dump_state(cs, NULL, CPU_DUMP_FPU);
+            cpu_dump_state(cs, NULL, CPU_DUMP_FPU | CPU_DUMP_VPU);
         }
     } else {
         cs = vcpu >= 0 ? qemu_get_cpu(vcpu) : mon_get_cpu(mon);
@@ -117,7 +117,7 @@ void hmp_info_registers(Monitor *mon, const QDict *qdict)
         }
 
         monitor_printf(mon, "\nCPU#%d\n", cs->cpu_index);
-        cpu_dump_state(cs, NULL, CPU_DUMP_FPU);
+        cpu_dump_state(cs, NULL, CPU_DUMP_FPU | CPU_DUMP_VPU);
     }
 }
 

From c8beb901be15c57d166574ecf660261f0f23209f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 3 Jul 2025 19:26:19 +0200
Subject: [PATCH 1860/2760] MAINTAINERS: Add me as reviewer of overall
 accelerators section
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

I'd like to be informed of overall changes of accelerators.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250703173248.44995-40-philmd@linaro.org>
---
 MAINTAINERS | 1 +
 1 file changed, 1 insertion(+)

diff --git a/MAINTAINERS b/MAINTAINERS
index fca98e1219..bfd59f6412 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -495,6 +495,7 @@ Guest CPU Cores (other accelerators)
 Overall
 M: Richard Henderson <richard.henderson@linaro.org>
 R: Paolo Bonzini <pbonzini@redhat.com>
+R: Philippe Mathieu-Daudé <philmd@linaro.org>
 S: Maintained
 F: include/exec/cpu*.h
 F: include/exec/target_long.h

From 6eba6fe967c3a2606ef5ec5ba9a283b21d09f85b Mon Sep 17 00:00:00 2001
From: Jim Shu <jim.shu@sifive.com>
Date: Mon, 19 May 2025 22:35:15 +0800
Subject: [PATCH 1861/2760] target/riscv: Add the checking into stimecmp write
 function.

Preparation commit to let aclint timer to use stimecmp write function.
Aclint timer doesn't call sstc() predicate so we need to check inside
the stimecmp write function.

Signed-off-by: Jim Shu <jim.shu@sifive.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250519143518.11086-2-jim.shu@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/time_helper.c | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/target/riscv/time_helper.c b/target/riscv/time_helper.c
index bc0d9a0c4c..aebf0798d0 100644
--- a/target/riscv/time_helper.c
+++ b/target/riscv/time_helper.c
@@ -46,8 +46,23 @@ void riscv_timer_write_timecmp(CPURISCVState *env, QEMUTimer *timer,
 {
     uint64_t diff, ns_diff, next;
     RISCVAclintMTimerState *mtimer = env->rdtime_fn_arg;
-    uint32_t timebase_freq = mtimer->timebase_freq;
-    uint64_t rtc_r = env->rdtime_fn(env->rdtime_fn_arg) + delta;
+    uint32_t timebase_freq;
+    uint64_t rtc_r;
+
+    if (!riscv_cpu_cfg(env)->ext_sstc || !env->rdtime_fn ||
+        !env->rdtime_fn_arg || !get_field(env->menvcfg, MENVCFG_STCE)) {
+        /* S/VS Timer IRQ depends on sstc extension, rdtime_fn(), and STCE. */
+        return;
+    }
+
+    if (timer_irq == MIP_VSTIP &&
+        (!riscv_has_ext(env, RVH) || !get_field(env->henvcfg, HENVCFG_STCE))) {
+        /* VS Timer IRQ also depends on RVH and henvcfg.STCE. */
+        return;
+    }
+
+    timebase_freq = mtimer->timebase_freq;
+    rtc_r = env->rdtime_fn(env->rdtime_fn_arg) + delta;
 
     if (timecmp <= rtc_r) {
         /*

From af27fc569af58e10d9e77afd10079809f05827bc Mon Sep 17 00:00:00 2001
From: Jim Shu <jim.shu@sifive.com>
Date: Mon, 19 May 2025 22:35:16 +0800
Subject: [PATCH 1862/2760] hw/intc: riscv_aclint: Fix mtime write for sstc
 extension

When changing the mtime value, the period of [s|vs]timecmp timers
should also be updated, similar to the period of mtimecmp timer.

The period of the stimecmp timer is the time until the next S-mode
timer IRQ. The value is calculated as "stimecmp - time". [1]
It is equal to "stimecmp - mtime" since the time CSR is a read-only
shadow of the memory-mapped mtime register.
Thus, changing mtime value will update the period of stimecmp timer.

Similarly, the period of vstimecmp timer is calculated as "vstimecmp -
(mtime + htimedelta)" [2], so changing mtime value will update the
period of vstimecmp timer.

[1] RISC-V Priv spec ch 9.1.1. Supervisor Timer (stimecmp) Register
A supervisor timer interrupt becomes pending, as reflected in the STIP
bit in the mip and sip registers whenever time contains a value
greater than or equal to stimecmp.
[2] RISC-V Priv spec ch19.2.1. Virtual Supervisor Timer (vstimecmp) Register
A virtual supervisor timer interrupt becomes pending, as reflected in
the VSTIP bit in the hip register, whenever (time + htimedelta),
truncated to 64 bits, contains a value greater than or equal to
vstimecmp

Signed-off-by: Jim Shu <jim.shu@sifive.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250519143518.11086-3-jim.shu@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/intc/riscv_aclint.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/hw/intc/riscv_aclint.c b/hw/intc/riscv_aclint.c
index b0139f03f5..4623cfa029 100644
--- a/hw/intc/riscv_aclint.c
+++ b/hw/intc/riscv_aclint.c
@@ -28,6 +28,7 @@
 #include "qemu/module.h"
 #include "hw/sysbus.h"
 #include "target/riscv/cpu.h"
+#include "target/riscv/time_helper.h"
 #include "hw/qdev-properties.h"
 #include "hw/intc/riscv_aclint.h"
 #include "qemu/timer.h"
@@ -240,6 +241,10 @@ static void riscv_aclint_mtimer_write(void *opaque, hwaddr addr,
             riscv_aclint_mtimer_write_timecmp(mtimer, RISCV_CPU(cpu),
                                               mtimer->hartid_base + i,
                                               mtimer->timecmp[i]);
+            riscv_timer_write_timecmp(env, env->stimer, env->stimecmp, 0, MIP_STIP);
+            riscv_timer_write_timecmp(env, env->vstimer, env->vstimecmp,
+                                      env->htimedelta, MIP_VSTIP);
+
         }
         return;
     }

From 3cb2edae740121cf5da3a9adb8190051e866eb01 Mon Sep 17 00:00:00 2001
From: Jim Shu <jim.shu@sifive.com>
Date: Mon, 19 May 2025 22:35:17 +0800
Subject: [PATCH 1863/2760] target/riscv: Fix VSTIP bit in sstc extension.

VSTIP is only writable when both [mh]envcfg.STCE is enabled, or it will
revert it's defined behavior as if sstc extension is not implemented.

Signed-off-by: Jim Shu <jim.shu@sifive.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250519143518.11086-4-jim.shu@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index fb14972169..d8102943dd 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -3651,7 +3651,14 @@ static RISCVException rmw_mip64(CPURISCVState *env, int csrno,
     if (riscv_cpu_cfg(env)->ext_sstc && (env->priv == PRV_M) &&
         get_field(env->menvcfg, MENVCFG_STCE)) {
         /* sstc extension forbids STIP & VSTIP to be writeable in mip */
-        mask = mask & ~(MIP_STIP | MIP_VSTIP);
+
+        /* STIP is not writable when menvcfg.STCE is enabled. */
+        mask = mask & ~MIP_STIP;
+
+        /* VSTIP is not writable when both [mh]envcfg.STCE are enabled. */
+        if (get_field(env->henvcfg, HENVCFG_STCE)) {
+            mask = mask & ~MIP_VSTIP;
+        }
     }
 
     if (mask) {

From dff5f515409f1c9c10df00160524b21381cbef26 Mon Sep 17 00:00:00 2001
From: Jim Shu <jim.shu@sifive.com>
Date: Mon, 19 May 2025 22:35:18 +0800
Subject: [PATCH 1864/2760] target/riscv: Enable/Disable S/VS-mode Timer when
 STCE bit is changed

Updating STCE will enable/disable SSTC in S-mode or/and VS-mode, so we
also need to update S/VS-mode Timer and S/VSTIP bits in $mip CSR.

Signed-off-by: Jim Shu <jim.shu@sifive.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250519143518.11086-5-jim.shu@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c         | 46 ++++++++++++++++++++++++++++++++++++++
 target/riscv/time_helper.c | 46 ++++++++++++++++++++++++++++++++++++++
 target/riscv/time_helper.h |  1 +
 3 files changed, 93 insertions(+)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index d8102943dd..1151ebb6ad 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -3181,6 +3181,7 @@ static RISCVException write_menvcfg(CPURISCVState *env, int csrno,
     const RISCVCPUConfig *cfg = riscv_cpu_cfg(env);
     uint64_t mask = MENVCFG_FIOM | MENVCFG_CBIE | MENVCFG_CBCFE |
                     MENVCFG_CBZE | MENVCFG_CDE;
+    bool stce_changed = false;
 
     if (riscv_cpu_mxl(env) == MXL_RV64) {
         mask |= (cfg->ext_svpbmt ? MENVCFG_PBMTE : 0) |
@@ -3206,8 +3207,18 @@ static RISCVException write_menvcfg(CPURISCVState *env, int csrno,
         if ((val & MENVCFG_DTE) == 0) {
             env->mstatus &= ~MSTATUS_SDT;
         }
+
+        if (cfg->ext_sstc &&
+            ((env->menvcfg & MENVCFG_STCE) != (val & MENVCFG_STCE))) {
+            stce_changed = true;
+        }
     }
     env->menvcfg = (env->menvcfg & ~mask) | (val & mask);
+
+    if (stce_changed) {
+        riscv_timer_stce_changed(env, true, !!(val & MENVCFG_STCE));
+    }
+
     return write_henvcfg(env, CSR_HENVCFG, env->henvcfg, ra);
 }
 
@@ -3230,12 +3241,23 @@ static RISCVException write_menvcfgh(CPURISCVState *env, int csrno,
                     (cfg->ext_smcdeleg ? MENVCFG_CDE : 0) |
                     (cfg->ext_ssdbltrp ? MENVCFG_DTE : 0);
     uint64_t valh = (uint64_t)val << 32;
+    bool stce_changed = false;
+
+    if (cfg->ext_sstc &&
+        ((env->menvcfg & MENVCFG_STCE) != (valh & MENVCFG_STCE))) {
+        stce_changed = true;
+    }
 
     if ((valh & MENVCFG_DTE) == 0) {
         env->mstatus &= ~MSTATUS_SDT;
     }
 
     env->menvcfg = (env->menvcfg & ~mask) | (valh & mask);
+
+    if (stce_changed) {
+        riscv_timer_stce_changed(env, true, !!(valh & MENVCFG_STCE));
+    }
+
     return write_henvcfgh(env, CSR_HENVCFGH, env->henvcfg >> 32, ra);
 }
 
@@ -3313,8 +3335,10 @@ static RISCVException read_henvcfg(CPURISCVState *env, int csrno,
 static RISCVException write_henvcfg(CPURISCVState *env, int csrno,
                                     target_ulong val, uintptr_t ra)
 {
+    const RISCVCPUConfig *cfg = riscv_cpu_cfg(env);
     uint64_t mask = HENVCFG_FIOM | HENVCFG_CBIE | HENVCFG_CBCFE | HENVCFG_CBZE;
     RISCVException ret;
+    bool stce_changed = false;
 
     ret = smstateen_acc_ok(env, 0, SMSTATEEN0_HSENVCFG);
     if (ret != RISCV_EXCP_NONE) {
@@ -3340,6 +3364,11 @@ static RISCVException write_henvcfg(CPURISCVState *env, int csrno,
             get_field(val, HENVCFG_PMM) != PMM_FIELD_RESERVED) {
             mask |= HENVCFG_PMM;
         }
+
+        if (cfg->ext_sstc &&
+            ((env->henvcfg & HENVCFG_STCE) != (val & HENVCFG_STCE))) {
+            stce_changed = true;
+        }
     }
 
     env->henvcfg = val & mask;
@@ -3347,6 +3376,10 @@ static RISCVException write_henvcfg(CPURISCVState *env, int csrno,
         env->vsstatus &= ~MSTATUS_SDT;
     }
 
+    if (stce_changed) {
+        riscv_timer_stce_changed(env, false, !!(val & HENVCFG_STCE));
+    }
+
     return RISCV_EXCP_NONE;
 }
 
@@ -3368,19 +3401,32 @@ static RISCVException read_henvcfgh(CPURISCVState *env, int csrno,
 static RISCVException write_henvcfgh(CPURISCVState *env, int csrno,
                                      target_ulong val, uintptr_t ra)
 {
+    const RISCVCPUConfig *cfg = riscv_cpu_cfg(env);
     uint64_t mask = env->menvcfg & (HENVCFG_PBMTE | HENVCFG_STCE |
                                     HENVCFG_ADUE | HENVCFG_DTE);
     uint64_t valh = (uint64_t)val << 32;
     RISCVException ret;
+    bool stce_changed = false;
 
     ret = smstateen_acc_ok(env, 0, SMSTATEEN0_HSENVCFG);
     if (ret != RISCV_EXCP_NONE) {
         return ret;
     }
+
+    if (cfg->ext_sstc &&
+        ((env->henvcfg & HENVCFG_STCE) != (valh & HENVCFG_STCE))) {
+        stce_changed = true;
+    }
+
     env->henvcfg = (env->henvcfg & 0xFFFFFFFF) | (valh & mask);
     if ((env->henvcfg & HENVCFG_DTE) == 0) {
         env->vsstatus &= ~MSTATUS_SDT;
     }
+
+    if (stce_changed) {
+        riscv_timer_stce_changed(env, false, !!(val & HENVCFG_STCE));
+    }
+
     return RISCV_EXCP_NONE;
 }
 
diff --git a/target/riscv/time_helper.c b/target/riscv/time_helper.c
index aebf0798d0..400e917354 100644
--- a/target/riscv/time_helper.c
+++ b/target/riscv/time_helper.c
@@ -140,6 +140,52 @@ void riscv_timer_write_timecmp(CPURISCVState *env, QEMUTimer *timer,
     timer_mod(timer, next);
 }
 
+/*
+ * When disabling xenvcfg.STCE, the S/VS Timer may be disabled at the same time.
+ * It is safe to call this function regardless of whether the timer has been
+ * deleted or not. timer_del() will do nothing if the timer has already
+ * been deleted.
+ */
+static void riscv_timer_disable_timecmp(CPURISCVState *env, QEMUTimer *timer,
+                                 uint32_t timer_irq)
+{
+    /* Disable S-mode Timer IRQ and HW-based STIP */
+    if ((timer_irq == MIP_STIP) && !get_field(env->menvcfg, MENVCFG_STCE)) {
+        riscv_cpu_update_mip(env, timer_irq, BOOL_TO_MASK(0));
+        timer_del(timer);
+        return;
+    }
+
+    /* Disable VS-mode Timer IRQ and HW-based VSTIP */
+    if ((timer_irq == MIP_VSTIP) &&
+        (!get_field(env->menvcfg, MENVCFG_STCE) ||
+         !get_field(env->henvcfg, HENVCFG_STCE))) {
+        env->vstime_irq = 0;
+        riscv_cpu_update_mip(env, 0, BOOL_TO_MASK(0));
+        timer_del(timer);
+        return;
+    }
+}
+
+/* Enable or disable S/VS-mode Timer when xenvcfg.STCE is changed */
+void riscv_timer_stce_changed(CPURISCVState *env, bool is_m_mode, bool enable)
+{
+    if (enable) {
+        riscv_timer_write_timecmp(env, env->vstimer, env->vstimecmp,
+                                  env->htimedelta, MIP_VSTIP);
+    } else {
+        riscv_timer_disable_timecmp(env, env->vstimer, MIP_VSTIP);
+    }
+
+    if (is_m_mode) {
+        if (enable) {
+            riscv_timer_write_timecmp(env, env->stimer, env->stimecmp, 0, MIP_STIP);
+        } else {
+            riscv_timer_disable_timecmp(env, env->stimer, MIP_STIP);
+        }
+    }
+}
+
 void riscv_timer_init(RISCVCPU *cpu)
 {
     CPURISCVState *env;
diff --git a/target/riscv/time_helper.h b/target/riscv/time_helper.h
index cacd79b80c..af1f634f89 100644
--- a/target/riscv/time_helper.h
+++ b/target/riscv/time_helper.h
@@ -25,6 +25,7 @@
 void riscv_timer_write_timecmp(CPURISCVState *env, QEMUTimer *timer,
                                uint64_t timecmp, uint64_t delta,
                                uint32_t timer_irq);
+void riscv_timer_stce_changed(CPURISCVState *env, bool is_m_mode, bool enable);
 void riscv_timer_init(RISCVCPU *cpu);
 
 #endif

From 148499b343a9aac62c5f5d55617a1c317127e2e3 Mon Sep 17 00:00:00 2001
From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Date: Thu, 22 May 2025 08:33:44 -0300
Subject: [PATCH 1865/2760] target/riscv/cpu.c: fix zama16b order in
 isa_edata_arr[]

Put it after zalrsc and before zawrs.

Cc: qemu-trivial@nongnu.org
Fixes: a60ce58fd9 ("target/riscv: Support Zama16b extension")
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250522113344.823294-1-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 629ac37501..fe21e0fb44 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -127,8 +127,8 @@ const RISCVIsaExtData isa_edata_arr[] = {
     ISA_EXT_DATA_ENTRY(zaamo, PRIV_VERSION_1_12_0, ext_zaamo),
     ISA_EXT_DATA_ENTRY(zabha, PRIV_VERSION_1_13_0, ext_zabha),
     ISA_EXT_DATA_ENTRY(zacas, PRIV_VERSION_1_12_0, ext_zacas),
-    ISA_EXT_DATA_ENTRY(zama16b, PRIV_VERSION_1_13_0, ext_zama16b),
     ISA_EXT_DATA_ENTRY(zalrsc, PRIV_VERSION_1_12_0, ext_zalrsc),
+    ISA_EXT_DATA_ENTRY(zama16b, PRIV_VERSION_1_13_0, ext_zama16b),
     ISA_EXT_DATA_ENTRY(zawrs, PRIV_VERSION_1_12_0, ext_zawrs),
     ISA_EXT_DATA_ENTRY(zfa, PRIV_VERSION_1_12_0, ext_zfa),
     ISA_EXT_DATA_ENTRY(zfbfmin, PRIV_VERSION_1_12_0, ext_zfbfmin),

From a429f9304d54e9a44773b753d0844204b4b3b22f Mon Sep 17 00:00:00 2001
From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Date: Wed, 28 May 2025 15:44:05 -0300
Subject: [PATCH 1866/2760] target/riscv/tcg: restrict satp_mode changes in
 cpu_set_profile
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We're changing 'mmu' to true regardless of whether the profile is
being enabled or not, and at the same time we're changing satp_mode to
profile->enabled.

This will promote a situation where we'll set mmu=on without a virtual
memory mode, which is a mistake.

Only touch 'mmu' and satp_mode if the profile is being enabled.

Suggested-by: Andrew Jones <ajones@ventanamicro.com>
Fixes: 55398025e7 ("target/riscv: add satp_mode profile support")
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Björn Töpel <bjorn@rivosinc.com>
Tested-by: Björn Töpel <bjorn@rivosinc.com>
Message-ID: <20250528184407.1451983-2-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/tcg/tcg-cpu.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index 55fd9e5584..39de32cf76 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -1365,16 +1365,16 @@ static void cpu_set_profile(Object *obj, Visitor *v, const char *name,
 
     if (profile->enabled) {
         cpu->env.priv_ver = profile->priv_spec;
-    }
 
 #ifndef CONFIG_USER_ONLY
-    if (profile->satp_mode != RISCV_PROFILE_ATTR_UNUSED) {
-        object_property_set_bool(obj, "mmu", true, NULL);
-        const char *satp_prop = satp_mode_str(profile->satp_mode,
-                                              riscv_cpu_is_32bit(cpu));
-        object_property_set_bool(obj, satp_prop, profile->enabled, NULL);
-    }
+        if (profile->satp_mode != RISCV_PROFILE_ATTR_UNUSED) {
+            object_property_set_bool(obj, "mmu", true, NULL);
+            const char *satp_prop = satp_mode_str(profile->satp_mode,
+                                                  riscv_cpu_is_32bit(cpu));
+            object_property_set_bool(obj, satp_prop, true, NULL);
+        }
 #endif
+    }
 
     for (i = 0; misa_bits[i] != 0; i++) {
         uint32_t bit = misa_bits[i];

From f655704c3dfefd57172e3347c22aca18283ee2b7 Mon Sep 17 00:00:00 2001
From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Date: Wed, 28 May 2025 15:44:06 -0300
Subject: [PATCH 1867/2760] target/riscv/tcg: decouple profile enablement from
 user prop
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We have code in riscv_cpu_add_profiles() to enable a profile right away
in case a CPU chose the profile during its cpu_init(). But we're using
the user callback option to do so, setting profile->user_set.

Create a new helper that does all the grunt work to enable/disable a
given profile. Use this new helper in the cases where we want a CPU to
be compatible to a certain profile, leaving the user callback to be used
exclusively by users.

Fixes: fba92a92e3 ("target/riscv: add 'rva22u64' CPU")
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Björn Töpel <bjorn@rivosinc.com>
Tested-by: Björn Töpel <bjorn@rivosinc.com>
Message-ID: <20250528184407.1451983-3-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/tcg/tcg-cpu.c | 127 +++++++++++++++++++------------------
 1 file changed, 67 insertions(+), 60 deletions(-)

diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index 39de32cf76..e10e03a577 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -1166,6 +1166,70 @@ static bool riscv_cpu_is_generic(Object *cpu_obj)
     return object_dynamic_cast(cpu_obj, TYPE_RISCV_DYNAMIC_CPU) != NULL;
 }
 
+static void riscv_cpu_set_profile(RISCVCPU *cpu,
+                                  RISCVCPUProfile *profile,
+                                  bool enabled)
+{
+    int i, ext_offset;
+
+    if (profile->u_parent != NULL) {
+        riscv_cpu_set_profile(cpu, profile->u_parent, enabled);
+    }
+
+    if (profile->s_parent != NULL) {
+        riscv_cpu_set_profile(cpu, profile->s_parent, enabled);
+    }
+
+    profile->enabled = enabled;
+
+    if (profile->enabled) {
+        cpu->env.priv_ver = profile->priv_spec;
+
+#ifndef CONFIG_USER_ONLY
+        if (profile->satp_mode != RISCV_PROFILE_ATTR_UNUSED) {
+            object_property_set_bool(OBJECT(cpu), "mmu", true, NULL);
+            const char *satp_prop = satp_mode_str(profile->satp_mode,
+                                                  riscv_cpu_is_32bit(cpu));
+            object_property_set_bool(OBJECT(cpu), satp_prop, true, NULL);
+        }
+#endif
+    }
+
+    for (i = 0; misa_bits[i] != 0; i++) {
+        uint32_t bit = misa_bits[i];
+
+        if  (!(profile->misa_ext & bit)) {
+            continue;
+        }
+
+        if (bit == RVI && !profile->enabled) {
+            /*
+             * Disabling profiles will not disable the base
+             * ISA RV64I.
+             */
+            continue;
+        }
+
+        cpu_misa_ext_add_user_opt(bit, profile->enabled);
+        riscv_cpu_write_misa_bit(cpu, bit, profile->enabled);
+    }
+
+    for (i = 0; profile->ext_offsets[i] != RISCV_PROFILE_EXT_LIST_END; i++) {
+        ext_offset = profile->ext_offsets[i];
+
+        if (profile->enabled) {
+            if (cpu_cfg_offset_is_named_feat(ext_offset)) {
+                riscv_cpu_enable_named_feat(cpu, ext_offset);
+            }
+
+            cpu_bump_multi_ext_priv_ver(&cpu->env, ext_offset);
+        }
+
+        cpu_cfg_ext_add_user_opt(ext_offset, profile->enabled);
+        isa_ext_update_enabled(cpu, ext_offset, profile->enabled);
+    }
+}
+
 /*
  * We'll get here via the following path:
  *
@@ -1332,7 +1396,6 @@ static void cpu_set_profile(Object *obj, Visitor *v, const char *name,
     RISCVCPUProfile *profile = opaque;
     RISCVCPU *cpu = RISCV_CPU(obj);
     bool value;
-    int i, ext_offset;
 
     if (riscv_cpu_is_vendor(obj)) {
         error_setg(errp, "Profile %s is not available for vendor CPUs",
@@ -1351,64 +1414,8 @@ static void cpu_set_profile(Object *obj, Visitor *v, const char *name,
     }
 
     profile->user_set = true;
-    profile->enabled = value;
 
-    if (profile->u_parent != NULL) {
-        object_property_set_bool(obj, profile->u_parent->name,
-                                 profile->enabled, NULL);
-    }
-
-    if (profile->s_parent != NULL) {
-        object_property_set_bool(obj, profile->s_parent->name,
-                                 profile->enabled, NULL);
-    }
-
-    if (profile->enabled) {
-        cpu->env.priv_ver = profile->priv_spec;
-
-#ifndef CONFIG_USER_ONLY
-        if (profile->satp_mode != RISCV_PROFILE_ATTR_UNUSED) {
-            object_property_set_bool(obj, "mmu", true, NULL);
-            const char *satp_prop = satp_mode_str(profile->satp_mode,
-                                                  riscv_cpu_is_32bit(cpu));
-            object_property_set_bool(obj, satp_prop, true, NULL);
-        }
-#endif
-    }
-
-    for (i = 0; misa_bits[i] != 0; i++) {
-        uint32_t bit = misa_bits[i];
-
-        if  (!(profile->misa_ext & bit)) {
-            continue;
-        }
-
-        if (bit == RVI && !profile->enabled) {
-            /*
-             * Disabling profiles will not disable the base
-             * ISA RV64I.
-             */
-            continue;
-        }
-
-        cpu_misa_ext_add_user_opt(bit, profile->enabled);
-        riscv_cpu_write_misa_bit(cpu, bit, profile->enabled);
-    }
-
-    for (i = 0; profile->ext_offsets[i] != RISCV_PROFILE_EXT_LIST_END; i++) {
-        ext_offset = profile->ext_offsets[i];
-
-        if (profile->enabled) {
-            if (cpu_cfg_offset_is_named_feat(ext_offset)) {
-                riscv_cpu_enable_named_feat(cpu, ext_offset);
-            }
-
-            cpu_bump_multi_ext_priv_ver(&cpu->env, ext_offset);
-        }
-
-        cpu_cfg_ext_add_user_opt(ext_offset, profile->enabled);
-        isa_ext_update_enabled(cpu, ext_offset, profile->enabled);
-    }
+    riscv_cpu_set_profile(cpu, profile, value);
 }
 
 static void cpu_get_profile(Object *obj, Visitor *v, const char *name,
@@ -1423,7 +1430,7 @@ static void cpu_get_profile(Object *obj, Visitor *v, const char *name,
 static void riscv_cpu_add_profiles(Object *cpu_obj)
 {
     for (int i = 0; riscv_profiles[i] != NULL; i++) {
-        const RISCVCPUProfile *profile = riscv_profiles[i];
+        RISCVCPUProfile *profile = riscv_profiles[i];
 
         object_property_add(cpu_obj, profile->name, "bool",
                             cpu_get_profile, cpu_set_profile,
@@ -1435,7 +1442,7 @@ static void riscv_cpu_add_profiles(Object *cpu_obj)
          * case.
          */
         if (profile->enabled) {
-            object_property_set_bool(cpu_obj, profile->name, true, NULL);
+            riscv_cpu_set_profile(RISCV_CPU(cpu_obj), profile, true);
         }
     }
 }

From cab6b5d8c351863b21d05eb8c9bb7920ad883b05 Mon Sep 17 00:00:00 2001
From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Date: Wed, 28 May 2025 15:44:07 -0300
Subject: [PATCH 1868/2760] target/riscv: add profile->present flag
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Björn reported in [1] a case where a rv64 CPU is going through the
profile code path to enable satp mode. In this case,the amount of
extensions on top of the rv64 CPU made it compliant with the RVA22S64
profile during the validation of CPU 0. When the subsequent CPUs were
initialized the static profile object has the 'enable' flag set,
enabling the profile code path for those CPUs.

This happens because we are initializing and realizing each CPU before
going to the next, i.e. init and realize CPU0, then init and realize
CPU1 and so on. If we change any persistent state during the validation
of CPU N it will interfere with the init/realization of CPU N+1.

We're using the 'enabled' profile flag to do two distinct things: inform
cpu_init() that we want profile extensions to be enabled, and telling
QMP that a profile is currently enabled in the CPU. We want to be
flexible enough to recognize profile support for all CPUs that has the
extension prerequisites, but we do not want to force the profile code
path if a profile wasn't set too.

Add a new 'present' flag for profiles that will coexist with the 'enabled'
flag. Enabling a profile means "we want to switch on all its mandatory
extensions". A profile is 'present' if we asserted during validation
that the CPU has the needed prerequisites.

This means that the case reported by Björn now results in
RVA22S64.enabled=false and RVA22S64.present=true. QMP will recognize it
as a RVA22 compliant CPU and we won't force the CPU into the profile
path.

[1] https://lore.kernel.org/qemu-riscv/87y0usiz22.fsf@all.your.base.are.belong.to.us/

Reported-by: Björn Töpel <bjorn@kernel.org>
Fixes: 2af005d610 ("target/riscv/tcg: validate profiles during finalize")
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Björn Töpel <bjorn@rivosinc.com>
Tested-by: Björn Töpel <bjorn@rivosinc.com>
Message-ID: <20250528184407.1451983-4-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h            | 15 +++++++++++++++
 target/riscv/riscv-qmp-cmds.c |  2 +-
 target/riscv/tcg/tcg-cpu.c    | 11 +++--------
 3 files changed, 19 insertions(+), 9 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index 229ade9ed9..2a6793e022 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -82,7 +82,22 @@ typedef struct riscv_cpu_profile {
     struct riscv_cpu_profile *s_parent;
     const char *name;
     uint32_t misa_ext;
+    /*
+     * The profile is enabled/disabled via command line or
+     * via cpu_init(). Enabling a profile will add all its
+     * mandatory extensions in the CPU during init().
+     */
     bool enabled;
+    /*
+     * The profile is present in the CPU, i.e. the current set of
+     * CPU extensions complies with it. A profile can be enabled
+     * and not present (e.g. the user disabled a mandatory extension)
+     * and the other way around (e.g. all mandatory extensions are
+     * present in a non-profile CPU).
+     *
+     * QMP uses this flag.
+     */
+    bool present;
     bool user_set;
     int priv_spec;
     int satp_mode;
diff --git a/target/riscv/riscv-qmp-cmds.c b/target/riscv/riscv-qmp-cmds.c
index 8ba8aa0d5f..8a1856c50e 100644
--- a/target/riscv/riscv-qmp-cmds.c
+++ b/target/riscv/riscv-qmp-cmds.c
@@ -121,7 +121,7 @@ static void riscv_obj_add_profiles_qdict(Object *obj, QDict *qdict_out)
 
     for (int i = 0; riscv_profiles[i] != NULL; i++) {
         profile = riscv_profiles[i];
-        value = QOBJECT(qbool_from_bool(profile->enabled));
+        value = QOBJECT(qbool_from_bool(profile->present));
 
         qdict_put_obj(qdict_out, profile->name, value);
     }
diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index e10e03a577..c5e260e360 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -867,16 +867,11 @@ static void riscv_cpu_check_parent_profile(RISCVCPU *cpu,
                                            RISCVCPUProfile *profile,
                                            RISCVCPUProfile *parent)
 {
-    const char *parent_name;
-    bool parent_enabled;
-
-    if (!profile->enabled || !parent) {
+    if (!profile->present || !parent) {
         return;
     }
 
-    parent_name = parent->name;
-    parent_enabled = object_property_get_bool(OBJECT(cpu), parent_name, NULL);
-    profile->enabled = parent_enabled;
+    profile->present = parent->present;
 }
 
 static void riscv_cpu_validate_profile(RISCVCPU *cpu,
@@ -937,7 +932,7 @@ static void riscv_cpu_validate_profile(RISCVCPU *cpu,
         }
     }
 
-    profile->enabled = profile_impl;
+    profile->present = profile_impl;
 
     riscv_cpu_check_parent_profile(cpu, profile, profile->u_parent);
     riscv_cpu_check_parent_profile(cpu, profile, profile->s_parent);

From 444cffd37b69b06f170aeaedadf1b52be96d4acd Mon Sep 17 00:00:00 2001
From: Jay Chang <jay.chang@sifive.com>
Date: Thu, 22 May 2025 16:12:35 +0800
Subject: [PATCH 1869/2760] target/riscv: Extend PMP region up to 64
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

According to the RISC-V Privileged Specification (version >1.12),
RV32 supports 16 CSRs (pmpcfg0–pmpcfg15) to configure 64 PMP regions
(pmpaddr0–pmpaddr63).

Signed-off-by: Jay Chang <jay.chang@sifive.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20250522081236.4050-2-jay.chang@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_bits.h |  60 +++++++++++++++++++
 target/riscv/csr.c      | 124 +++++++++++++++++++++++++++++++++++++++-
 2 files changed, 182 insertions(+), 2 deletions(-)

diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
index a30317c617..e6b3e28386 100644
--- a/target/riscv/cpu_bits.h
+++ b/target/riscv/cpu_bits.h
@@ -372,6 +372,18 @@
 #define CSR_PMPCFG1         0x3a1
 #define CSR_PMPCFG2         0x3a2
 #define CSR_PMPCFG3         0x3a3
+#define CSR_PMPCFG4         0x3a4
+#define CSR_PMPCFG5         0x3a5
+#define CSR_PMPCFG6         0x3a6
+#define CSR_PMPCFG7         0x3a7
+#define CSR_PMPCFG8         0x3a8
+#define CSR_PMPCFG9         0x3a9
+#define CSR_PMPCFG10        0x3aa
+#define CSR_PMPCFG11        0x3ab
+#define CSR_PMPCFG12        0x3ac
+#define CSR_PMPCFG13        0x3ad
+#define CSR_PMPCFG14        0x3ae
+#define CSR_PMPCFG15        0x3af
 #define CSR_PMPADDR0        0x3b0
 #define CSR_PMPADDR1        0x3b1
 #define CSR_PMPADDR2        0x3b2
@@ -388,6 +400,54 @@
 #define CSR_PMPADDR13       0x3bd
 #define CSR_PMPADDR14       0x3be
 #define CSR_PMPADDR15       0x3bf
+#define CSR_PMPADDR16       0x3c0
+#define CSR_PMPADDR17       0x3c1
+#define CSR_PMPADDR18       0x3c2
+#define CSR_PMPADDR19       0x3c3
+#define CSR_PMPADDR20       0x3c4
+#define CSR_PMPADDR21       0x3c5
+#define CSR_PMPADDR22       0x3c6
+#define CSR_PMPADDR23       0x3c7
+#define CSR_PMPADDR24       0x3c8
+#define CSR_PMPADDR25       0x3c9
+#define CSR_PMPADDR26       0x3ca
+#define CSR_PMPADDR27       0x3cb
+#define CSR_PMPADDR28       0x3cc
+#define CSR_PMPADDR29       0x3cd
+#define CSR_PMPADDR30       0x3ce
+#define CSR_PMPADDR31       0x3cf
+#define CSR_PMPADDR32       0x3d0
+#define CSR_PMPADDR33       0x3d1
+#define CSR_PMPADDR34       0x3d2
+#define CSR_PMPADDR35       0x3d3
+#define CSR_PMPADDR36       0x3d4
+#define CSR_PMPADDR37       0x3d5
+#define CSR_PMPADDR38       0x3d6
+#define CSR_PMPADDR39       0x3d7
+#define CSR_PMPADDR40       0x3d8
+#define CSR_PMPADDR41       0x3d9
+#define CSR_PMPADDR42       0x3da
+#define CSR_PMPADDR43       0x3db
+#define CSR_PMPADDR44       0x3dc
+#define CSR_PMPADDR45       0x3dd
+#define CSR_PMPADDR46       0x3de
+#define CSR_PMPADDR47       0x3df
+#define CSR_PMPADDR48       0x3e0
+#define CSR_PMPADDR49       0x3e1
+#define CSR_PMPADDR50       0x3e2
+#define CSR_PMPADDR51       0x3e3
+#define CSR_PMPADDR52       0x3e4
+#define CSR_PMPADDR53       0x3e5
+#define CSR_PMPADDR54       0x3e6
+#define CSR_PMPADDR55       0x3e7
+#define CSR_PMPADDR56       0x3e8
+#define CSR_PMPADDR57       0x3e9
+#define CSR_PMPADDR58       0x3ea
+#define CSR_PMPADDR59       0x3eb
+#define CSR_PMPADDR60       0x3ec
+#define CSR_PMPADDR61       0x3ed
+#define CSR_PMPADDR62       0x3ee
+#define CSR_PMPADDR63       0x3ef
 
 /* RNMI */
 #define CSR_MNSCRATCH       0x740
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index 1151ebb6ad..d6cd441133 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -6164,6 +6164,30 @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
     [CSR_PMPCFG1]    = { "pmpcfg1",   pmp, read_pmpcfg,  write_pmpcfg  },
     [CSR_PMPCFG2]    = { "pmpcfg2",   pmp, read_pmpcfg,  write_pmpcfg  },
     [CSR_PMPCFG3]    = { "pmpcfg3",   pmp, read_pmpcfg,  write_pmpcfg  },
+    [CSR_PMPCFG4]    = { "pmpcfg4",   pmp, read_pmpcfg,  write_pmpcfg,
+                         .min_priv_ver = PRIV_VERSION_1_12_0           },
+    [CSR_PMPCFG5]    = { "pmpcfg5",   pmp, read_pmpcfg,  write_pmpcfg,
+                         .min_priv_ver = PRIV_VERSION_1_12_0           },
+    [CSR_PMPCFG6]    = { "pmpcfg6",   pmp, read_pmpcfg,  write_pmpcfg,
+                         .min_priv_ver = PRIV_VERSION_1_12_0           },
+    [CSR_PMPCFG7]    = { "pmpcfg7",   pmp, read_pmpcfg,  write_pmpcfg,
+                         .min_priv_ver = PRIV_VERSION_1_12_0           },
+    [CSR_PMPCFG8]    = { "pmpcfg8",   pmp, read_pmpcfg,  write_pmpcfg,
+                         .min_priv_ver = PRIV_VERSION_1_12_0           },
+    [CSR_PMPCFG9]    = { "pmpcfg9",   pmp, read_pmpcfg,  write_pmpcfg,
+                         .min_priv_ver = PRIV_VERSION_1_12_0           },
+    [CSR_PMPCFG10]   = { "pmpcfg10",  pmp, read_pmpcfg,  write_pmpcfg,
+                         .min_priv_ver = PRIV_VERSION_1_12_0           },
+    [CSR_PMPCFG11]   = { "pmpcfg11",  pmp, read_pmpcfg,  write_pmpcfg,
+                         .min_priv_ver = PRIV_VERSION_1_12_0           },
+    [CSR_PMPCFG12]   = { "pmpcfg12",  pmp, read_pmpcfg,  write_pmpcfg,
+                         .min_priv_ver = PRIV_VERSION_1_12_0           },
+    [CSR_PMPCFG13]   = { "pmpcfg13",  pmp, read_pmpcfg,  write_pmpcfg,
+                         .min_priv_ver = PRIV_VERSION_1_12_0           },
+    [CSR_PMPCFG14]   = { "pmpcfg14",  pmp, read_pmpcfg,  write_pmpcfg,
+                         .min_priv_ver = PRIV_VERSION_1_12_0           },
+    [CSR_PMPCFG15]   = { "pmpcfg15",  pmp, read_pmpcfg,  write_pmpcfg,
+                         .min_priv_ver = PRIV_VERSION_1_12_0           },
     [CSR_PMPADDR0]   = { "pmpaddr0",  pmp, read_pmpaddr, write_pmpaddr },
     [CSR_PMPADDR1]   = { "pmpaddr1",  pmp, read_pmpaddr, write_pmpaddr },
     [CSR_PMPADDR2]   = { "pmpaddr2",  pmp, read_pmpaddr, write_pmpaddr },
@@ -6178,8 +6202,104 @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
     [CSR_PMPADDR11]  = { "pmpaddr11", pmp, read_pmpaddr, write_pmpaddr },
     [CSR_PMPADDR12]  = { "pmpaddr12", pmp, read_pmpaddr, write_pmpaddr },
     [CSR_PMPADDR13]  = { "pmpaddr13", pmp, read_pmpaddr, write_pmpaddr },
-    [CSR_PMPADDR14] =  { "pmpaddr14", pmp, read_pmpaddr, write_pmpaddr },
-    [CSR_PMPADDR15] =  { "pmpaddr15", pmp, read_pmpaddr, write_pmpaddr },
+    [CSR_PMPADDR14]  = { "pmpaddr14", pmp, read_pmpaddr, write_pmpaddr },
+    [CSR_PMPADDR15]  = { "pmpaddr15", pmp, read_pmpaddr, write_pmpaddr },
+    [CSR_PMPADDR16]  = { "pmpaddr16", pmp, read_pmpaddr, write_pmpaddr,
+                         .min_priv_ver = PRIV_VERSION_1_12_0           },
+    [CSR_PMPADDR17]  = { "pmpaddr17", pmp, read_pmpaddr, write_pmpaddr,
+                         .min_priv_ver = PRIV_VERSION_1_12_0           },
+    [CSR_PMPADDR18]  = { "pmpaddr18", pmp, read_pmpaddr, write_pmpaddr,
+                         .min_priv_ver = PRIV_VERSION_1_12_0           },
+    [CSR_PMPADDR19]  = { "pmpaddr19", pmp, read_pmpaddr, write_pmpaddr,
+                         .min_priv_ver = PRIV_VERSION_1_12_0           },
+    [CSR_PMPADDR20]  = { "pmpaddr20", pmp, read_pmpaddr, write_pmpaddr,
+                         .min_priv_ver = PRIV_VERSION_1_12_0           },
+    [CSR_PMPADDR21]  = { "pmpaddr21", pmp, read_pmpaddr, write_pmpaddr,
+                         .min_priv_ver = PRIV_VERSION_1_12_0           },
+    [CSR_PMPADDR22]  = { "pmpaddr22", pmp, read_pmpaddr, write_pmpaddr,
+                         .min_priv_ver = PRIV_VERSION_1_12_0           },
+    [CSR_PMPADDR23]  = { "pmpaddr23", pmp, read_pmpaddr, write_pmpaddr,
+                         .min_priv_ver = PRIV_VERSION_1_12_0           },
+    [CSR_PMPADDR24]  = { "pmpaddr24", pmp, read_pmpaddr, write_pmpaddr,
+                         .min_priv_ver = PRIV_VERSION_1_12_0           },
+    [CSR_PMPADDR25]  = { "pmpaddr25", pmp, read_pmpaddr, write_pmpaddr,
+                         .min_priv_ver = PRIV_VERSION_1_12_0           },
+    [CSR_PMPADDR26]  = { "pmpaddr26", pmp, read_pmpaddr, write_pmpaddr,
+                         .min_priv_ver = PRIV_VERSION_1_12_0           },
+    [CSR_PMPADDR27]  = { "pmpaddr27", pmp, read_pmpaddr, write_pmpaddr,
+                         .min_priv_ver = PRIV_VERSION_1_12_0           },
+    [CSR_PMPADDR28]  = { "pmpaddr28", pmp, read_pmpaddr, write_pmpaddr,
+                         .min_priv_ver = PRIV_VERSION_1_12_0           },
+    [CSR_PMPADDR29]  = { "pmpaddr29", pmp, read_pmpaddr, write_pmpaddr,
+                         .min_priv_ver = PRIV_VERSION_1_12_0           },
+    [CSR_PMPADDR30]  = { "pmpaddr30", pmp, read_pmpaddr, write_pmpaddr,
+                         .min_priv_ver = PRIV_VERSION_1_12_0           },
+    [CSR_PMPADDR31]  = { "pmpaddr31", pmp, read_pmpaddr, write_pmpaddr,
+                         .min_priv_ver = PRIV_VERSION_1_12_0           },
+    [CSR_PMPADDR32]  = { "pmpaddr32", pmp, read_pmpaddr, write_pmpaddr,
+                         .min_priv_ver = PRIV_VERSION_1_12_0           },
+    [CSR_PMPADDR33]  = { "pmpaddr33", pmp, read_pmpaddr, write_pmpaddr,
+                         .min_priv_ver = PRIV_VERSION_1_12_0           },
+    [CSR_PMPADDR34]  = { "pmpaddr34", pmp, read_pmpaddr, write_pmpaddr,
+                         .min_priv_ver = PRIV_VERSION_1_12_0           },
+    [CSR_PMPADDR35]  = { "pmpaddr35", pmp, read_pmpaddr, write_pmpaddr,
+                         .min_priv_ver = PRIV_VERSION_1_12_0           },
+    [CSR_PMPADDR36]  = { "pmpaddr36", pmp, read_pmpaddr, write_pmpaddr,
+                         .min_priv_ver = PRIV_VERSION_1_12_0           },
+    [CSR_PMPADDR37]  = { "pmpaddr37", pmp, read_pmpaddr, write_pmpaddr,
+                         .min_priv_ver = PRIV_VERSION_1_12_0           },
+    [CSR_PMPADDR38]  = { "pmpaddr38", pmp, read_pmpaddr, write_pmpaddr,
+                         .min_priv_ver = PRIV_VERSION_1_12_0           },
+    [CSR_PMPADDR39]  = { "pmpaddr39", pmp, read_pmpaddr, write_pmpaddr,
+                         .min_priv_ver = PRIV_VERSION_1_12_0           },
+    [CSR_PMPADDR40]  = { "pmpaddr40", pmp, read_pmpaddr, write_pmpaddr,
+                         .min_priv_ver = PRIV_VERSION_1_12_0           },
+    [CSR_PMPADDR41]  = { "pmpaddr41", pmp, read_pmpaddr, write_pmpaddr,
+                         .min_priv_ver = PRIV_VERSION_1_12_0           },
+    [CSR_PMPADDR42]  = { "pmpaddr42", pmp, read_pmpaddr, write_pmpaddr,
+                         .min_priv_ver = PRIV_VERSION_1_12_0           },
+    [CSR_PMPADDR43]  = { "pmpaddr43", pmp, read_pmpaddr, write_pmpaddr,
+                         .min_priv_ver = PRIV_VERSION_1_12_0           },
+    [CSR_PMPADDR44]  = { "pmpaddr44", pmp, read_pmpaddr, write_pmpaddr,
+                         .min_priv_ver = PRIV_VERSION_1_12_0           },
+    [CSR_PMPADDR45]  = { "pmpaddr45", pmp, read_pmpaddr, write_pmpaddr,
+                         .min_priv_ver = PRIV_VERSION_1_12_0           },
+    [CSR_PMPADDR46]  = { "pmpaddr46", pmp, read_pmpaddr, write_pmpaddr,
+                         .min_priv_ver = PRIV_VERSION_1_12_0           },
+    [CSR_PMPADDR47]  = { "pmpaddr47", pmp, read_pmpaddr, write_pmpaddr,
+                         .min_priv_ver = PRIV_VERSION_1_12_0           },
+    [CSR_PMPADDR48]  = { "pmpaddr48", pmp, read_pmpaddr, write_pmpaddr,
+                         .min_priv_ver = PRIV_VERSION_1_12_0           },
+    [CSR_PMPADDR49]  = { "pmpaddr49", pmp, read_pmpaddr, write_pmpaddr,
+                         .min_priv_ver = PRIV_VERSION_1_12_0           },
+    [CSR_PMPADDR50]  = { "pmpaddr50", pmp, read_pmpaddr, write_pmpaddr,
+                         .min_priv_ver = PRIV_VERSION_1_12_0           },
+    [CSR_PMPADDR51]  = { "pmpaddr51", pmp, read_pmpaddr, write_pmpaddr,
+                         .min_priv_ver = PRIV_VERSION_1_12_0           },
+    [CSR_PMPADDR52]  = { "pmpaddr52", pmp, read_pmpaddr, write_pmpaddr,
+                         .min_priv_ver = PRIV_VERSION_1_12_0           },
+    [CSR_PMPADDR53]  = { "pmpaddr53", pmp, read_pmpaddr, write_pmpaddr,
+                         .min_priv_ver = PRIV_VERSION_1_12_0           },
+    [CSR_PMPADDR54]  = { "pmpaddr54", pmp, read_pmpaddr, write_pmpaddr,
+                         .min_priv_ver = PRIV_VERSION_1_12_0           },
+    [CSR_PMPADDR55]  = { "pmpaddr55", pmp, read_pmpaddr, write_pmpaddr,
+                         .min_priv_ver = PRIV_VERSION_1_12_0           },
+    [CSR_PMPADDR56]  = { "pmpaddr56", pmp, read_pmpaddr, write_pmpaddr,
+                         .min_priv_ver = PRIV_VERSION_1_12_0           },
+    [CSR_PMPADDR57]  = { "pmpaddr57", pmp, read_pmpaddr, write_pmpaddr,
+                         .min_priv_ver = PRIV_VERSION_1_12_0           },
+    [CSR_PMPADDR58]  = { "pmpaddr58", pmp, read_pmpaddr, write_pmpaddr,
+                         .min_priv_ver = PRIV_VERSION_1_12_0           },
+    [CSR_PMPADDR59]  = { "pmpaddr59", pmp, read_pmpaddr, write_pmpaddr,
+                         .min_priv_ver = PRIV_VERSION_1_12_0           },
+    [CSR_PMPADDR60]  = { "pmpaddr60", pmp, read_pmpaddr, write_pmpaddr,
+                         .min_priv_ver = PRIV_VERSION_1_12_0           },
+    [CSR_PMPADDR61]  = { "pmpaddr61", pmp, read_pmpaddr, write_pmpaddr,
+                         .min_priv_ver = PRIV_VERSION_1_12_0           },
+    [CSR_PMPADDR62]  = { "pmpaddr62", pmp, read_pmpaddr, write_pmpaddr,
+                         .min_priv_ver = PRIV_VERSION_1_12_0           },
+    [CSR_PMPADDR63]  = { "pmpaddr63", pmp, read_pmpaddr, write_pmpaddr,
+                         .min_priv_ver = PRIV_VERSION_1_12_0           },
 
     /* Debug CSRs */
     [CSR_TSELECT]   =  { "tselect",  debug, read_tselect,  write_tselect  },

From 455c0fa9eef7f27e5b50ebd2b6fe3447c4f1ca51 Mon Sep 17 00:00:00 2001
From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Date: Fri, 30 May 2025 10:46:08 -0300
Subject: [PATCH 1870/2760] target/riscv: remove capital 'Z' CPU properties

These properties were deprecated in QEMU 8.2, commit 8043effd9b.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250530134608.1806922-1-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c         | 17 -----------------
 target/riscv/cpu.h         |  1 -
 target/riscv/tcg/tcg-cpu.c | 31 +------------------------------
 3 files changed, 1 insertion(+), 48 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index fe21e0fb44..7c6e0844d0 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -1387,23 +1387,6 @@ const RISCVCPUMultiExtConfig riscv_cpu_named_features[] = {
     { },
 };
 
-/* Deprecated entries marked for future removal */
-const RISCVCPUMultiExtConfig riscv_cpu_deprecated_exts[] = {
-    MULTI_EXT_CFG_BOOL("Zifencei", ext_zifencei, true),
-    MULTI_EXT_CFG_BOOL("Zicsr", ext_zicsr, true),
-    MULTI_EXT_CFG_BOOL("Zihintntl", ext_zihintntl, true),
-    MULTI_EXT_CFG_BOOL("Zihintpause", ext_zihintpause, true),
-    MULTI_EXT_CFG_BOOL("Zawrs", ext_zawrs, true),
-    MULTI_EXT_CFG_BOOL("Zfa", ext_zfa, true),
-    MULTI_EXT_CFG_BOOL("Zfh", ext_zfh, false),
-    MULTI_EXT_CFG_BOOL("Zfhmin", ext_zfhmin, false),
-    MULTI_EXT_CFG_BOOL("Zve32f", ext_zve32f, false),
-    MULTI_EXT_CFG_BOOL("Zve64f", ext_zve64f, false),
-    MULTI_EXT_CFG_BOOL("Zve64d", ext_zve64d, false),
-
-    { },
-};
-
 static void cpu_set_prop_err(RISCVCPU *cpu, const char *propname,
                              Error **errp)
 {
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index 2a6793e022..17bf4e7579 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -951,7 +951,6 @@ extern const RISCVCPUMultiExtConfig riscv_cpu_extensions[];
 extern const RISCVCPUMultiExtConfig riscv_cpu_vendor_exts[];
 extern const RISCVCPUMultiExtConfig riscv_cpu_experimental_exts[];
 extern const RISCVCPUMultiExtConfig riscv_cpu_named_features[];
-extern const RISCVCPUMultiExtConfig riscv_cpu_deprecated_exts[];
 
 typedef struct isa_ext_data {
     const char *name;
diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index c5e260e360..81174de409 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -1442,25 +1442,6 @@ static void riscv_cpu_add_profiles(Object *cpu_obj)
     }
 }
 
-static bool cpu_ext_is_deprecated(const char *ext_name)
-{
-    return isupper(ext_name[0]);
-}
-
-/*
- * String will be allocated in the heap. Caller is responsible
- * for freeing it.
- */
-static char *cpu_ext_to_lower(const char *ext_name)
-{
-    char *ret = g_malloc0(strlen(ext_name) + 1);
-
-    strcpy(ret, ext_name);
-    ret[0] = tolower(ret[0]);
-
-    return ret;
-}
-
 static void cpu_set_multi_ext_cfg(Object *obj, Visitor *v, const char *name,
                                   void *opaque, Error **errp)
 {
@@ -1473,13 +1454,6 @@ static void cpu_set_multi_ext_cfg(Object *obj, Visitor *v, const char *name,
         return;
     }
 
-    if (cpu_ext_is_deprecated(multi_ext_cfg->name)) {
-        g_autofree char *lower = cpu_ext_to_lower(multi_ext_cfg->name);
-
-        warn_report("CPU property '%s' is deprecated. Please use '%s' instead",
-                    multi_ext_cfg->name, lower);
-    }
-
     cpu_cfg_ext_add_user_opt(multi_ext_cfg->offset, value);
 
     prev_val = isa_ext_is_enabled(cpu, multi_ext_cfg->offset);
@@ -1515,14 +1489,13 @@ static void cpu_add_multi_ext_prop(Object *cpu_obj,
                                    const RISCVCPUMultiExtConfig *multi_cfg)
 {
     bool generic_cpu = riscv_cpu_is_generic(cpu_obj);
-    bool deprecated_ext = cpu_ext_is_deprecated(multi_cfg->name);
 
     object_property_add(cpu_obj, multi_cfg->name, "bool",
                         cpu_get_multi_ext_cfg,
                         cpu_set_multi_ext_cfg,
                         NULL, (void *)multi_cfg);
 
-    if (!generic_cpu || deprecated_ext) {
+    if (!generic_cpu) {
         return;
     }
 
@@ -1565,8 +1538,6 @@ static void riscv_cpu_add_user_properties(Object *obj)
     riscv_cpu_add_multiext_prop_array(obj, riscv_cpu_vendor_exts);
     riscv_cpu_add_multiext_prop_array(obj, riscv_cpu_experimental_exts);
 
-    riscv_cpu_add_multiext_prop_array(obj, riscv_cpu_deprecated_exts);
-
     riscv_cpu_add_profiles(obj);
 }
 

From f31ba686a9387640a905ac70fe682c15c461a134 Mon Sep 17 00:00:00 2001
From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Date: Wed, 4 Jun 2025 14:43:27 -0300
Subject: [PATCH 1871/2760] target/riscv/cpu.c: add 'sdtrig' in riscv,isa

We have support for sdtrig for awhile but we are not advertising it. It
is enabled by default via the 'debug' flag. Use the same flag to also
advertise sdtrig.

Add an exception in disable_priv_spec_isa_exts() to avoid spamming
warnings for 'sdtrig' for vendor CPUs like sifive_u.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250604174329.1147549-2-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c                |   1 +
 target/riscv/tcg/tcg-cpu.c        |   9 +++++++++
 tests/data/acpi/riscv64/virt/RHCT | Bin 400 -> 406 bytes
 3 files changed, 10 insertions(+)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 7c6e0844d0..b4e7eff331 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -189,6 +189,7 @@ const RISCVIsaExtData isa_edata_arr[] = {
     ISA_EXT_DATA_ENTRY(zvkt, PRIV_VERSION_1_12_0, ext_zvkt),
     ISA_EXT_DATA_ENTRY(zhinx, PRIV_VERSION_1_12_0, ext_zhinx),
     ISA_EXT_DATA_ENTRY(zhinxmin, PRIV_VERSION_1_12_0, ext_zhinxmin),
+    ISA_EXT_DATA_ENTRY(sdtrig, PRIV_VERSION_1_12_0, debug),
     ISA_EXT_DATA_ENTRY(shcounterenw, PRIV_VERSION_1_12_0, has_priv_1_12),
     ISA_EXT_DATA_ENTRY(sha, PRIV_VERSION_1_12_0, ext_sha),
     ISA_EXT_DATA_ENTRY(shgatpa, PRIV_VERSION_1_12_0, has_priv_1_12),
diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index 81174de409..163e7ce364 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -451,6 +451,15 @@ static void riscv_cpu_disable_priv_spec_isa_exts(RISCVCPU *cpu)
                 continue;
             }
 
+            /*
+             * cpu.debug = true is marked as 'sdtrig', priv spec 1.12.
+             * Skip this warning since existing CPUs with older priv
+             * spec and debug = true will be impacted.
+             */
+            if (!strcmp(edata->name, "sdtrig")) {
+                continue;
+            }
+
             isa_ext_update_enabled(cpu, edata->ext_enable_offset, false);
 
             /*
diff --git a/tests/data/acpi/riscv64/virt/RHCT b/tests/data/acpi/riscv64/virt/RHCT
index 13c8025b868051485be5ba62974a22971a07bc6a..156607dec45b0e63e5b3ebed62e81076dacd80d0 100644
GIT binary patch
delta 49
zcmbQhJdK$v$iq2g8Y2S(<Ex2W2COEGj0`#x?N_s=loVyAPkd23IgL??BZrZJp^TA%
F0RTq!4730M

delta 43
zcmbQnJb{@j$iq2g0wV(h<JXB?2CRCFj0~z1?N?9ySUowLQJEu+k%6Irk%0jK_Q(p3


From bab2be19239bc8e586a868eafd1c78a2d55a1a58 Mon Sep 17 00:00:00 2001
From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Date: Wed, 4 Jun 2025 14:43:28 -0300
Subject: [PATCH 1872/2760] target/riscv/cpu.c: add 'ssstrict' to riscv, isa

'ssstrict' is a RVA23 profile-defined extension defined as follows:

"No non-conforming extensions are present. Attempts to execute
unimplemented opcodes or access unimplemented CSRs in the standard or
reserved encoding spaces raises an illegal instruction exception that
results in a contained trap to the supervisor-mode trap handler."

In short, we need to throw an exception when accessing unimplemented
CSRs or opcodes. We do that, so let's advertise it.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-ID: <20250529202315.1684198-3-dbarboza@ventanamicro.com>
Message-ID: <20250604174329.1147549-3-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c                |   1 +
 tests/data/acpi/riscv64/virt/RHCT | Bin 406 -> 416 bytes
 2 files changed, 1 insertion(+)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index b4e7eff331..626b0b8b26 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -217,6 +217,7 @@ const RISCVIsaExtData isa_edata_arr[] = {
     ISA_EXT_DATA_ENTRY(ssnpm, PRIV_VERSION_1_13_0, ext_ssnpm),
     ISA_EXT_DATA_ENTRY(sspm, PRIV_VERSION_1_13_0, ext_sspm),
     ISA_EXT_DATA_ENTRY(ssstateen, PRIV_VERSION_1_12_0, ext_ssstateen),
+    ISA_EXT_DATA_ENTRY(ssstrict, PRIV_VERSION_1_12_0, has_priv_1_12),
     ISA_EXT_DATA_ENTRY(sstc, PRIV_VERSION_1_12_0, ext_sstc),
     ISA_EXT_DATA_ENTRY(sstvala, PRIV_VERSION_1_12_0, has_priv_1_12),
     ISA_EXT_DATA_ENTRY(sstvecd, PRIV_VERSION_1_12_0, has_priv_1_12),
diff --git a/tests/data/acpi/riscv64/virt/RHCT b/tests/data/acpi/riscv64/virt/RHCT
index 156607dec45b0e63e5b3ebed62e81076dacd80d0..52a4cc4b6380eee3299b965271a39e9e01f5a698 100644
GIT binary patch
delta 52
zcmbQnynvZ2$iq2g0V4wg<L!xD2CR0Bj0~n5?U@+aic5+zlS?MsG3rguW>n@VV`N}x
IU}Rtb08<(Z?f?J)

delta 45
zcmZ3$JdK$v$iq2g8Y2S(<Ex2W2COEGj0`#(?U@)SdogNHE@M>U$YEq)C}U(`008kX
B2|xe<


From 5ee4f21713d51fdf3d8756744ffe92365df8598b Mon Sep 17 00:00:00 2001
From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Date: Wed, 4 Jun 2025 14:43:29 -0300
Subject: [PATCH 1873/2760] target/riscv/cpu.c: do better with 'named features'
 doc

Most of the named features are added directly in isa_edata_arr[], some
of them are also added in riscv_cpu_named_features(). There is a reason
for that, and the existing docs can do better explaining it.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20250529202315.1684198-4-dbarboza@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250604174329.1147549-4-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 626b0b8b26..bf14256a61 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -1377,13 +1377,23 @@ const RISCVCPUMultiExtConfig riscv_cpu_experimental_exts[] = {
  * 'Named features' is the name we give to extensions that we
  * don't want to expose to users. They are either immutable
  * (always enabled/disable) or they'll vary depending on
- * the resulting CPU state. They have riscv,isa strings
- * and priv_ver like regular extensions.
+ * the resulting CPU state.
+ *
+ * Some of them are always enabled depending on priv version
+ * of the CPU and are declared directly in isa_edata_arr[].
+ * The ones listed here have special checks during finalize()
+ * time and require their own flags like regular extensions.
+ * See riscv_cpu_update_named_features() for more info.
  */
 const RISCVCPUMultiExtConfig riscv_cpu_named_features[] = {
     MULTI_EXT_CFG_BOOL("zic64b", ext_zic64b, true),
     MULTI_EXT_CFG_BOOL("ssstateen", ext_ssstateen, true),
     MULTI_EXT_CFG_BOOL("sha", ext_sha, true),
+
+    /*
+     * 'ziccrse' has its own flag because the KVM driver
+     * wants to enable/disable it on its own accord.
+     */
     MULTI_EXT_CFG_BOOL("ziccrse", ext_ziccrse, true),
 
     { },

From f9eaa1542be5f7273dec1111a1e17d8ff2a5bcba Mon Sep 17 00:00:00 2001
From: Jim Shu <jim.shu@sifive.com>
Date: Thu, 8 May 2025 17:48:38 +0800
Subject: [PATCH 1874/2760] target/riscv: support atomic instruction fetch
 (Ziccif)

Support 4-byte atomic instruction fetch when instruction is natural
aligned.

Current implementation is not atomic because it loads instruction twice
for first and last 2 bytes. We load 4 bytes at once to keep the
atomicity. This instruction preload method only applys when instruction
is 4-byte aligned. If instruction is unaligned, it could be across pages
so that preload will trigger additional page fault.

We encounter this issue when doing pressure test of enabling & disabling
Linux kernel ftrace. Ftrace with kernel preemption requires concurrent
modification and execution of instruction, so non-atomic instruction
fetch will cause the race condition. We may fetch the wrong instruction
which is the mixing of 2 instructions.

Also, RISC-V Profile wants to provide this feature by HW. RVA20U64
Ziccif protects the atomicity of instruction fetch when it is
natural aligned.

This commit depends on the atomic read support of translator_ld in
the commit 6a9dfe1984b0c593fb0ddb52d4e70832e6201dd6.

Signed-off-by: Jim Shu <jim.shu@sifive.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250508094838.19394-1-jim.shu@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/translate.c | 46 +++++++++++++++++++++++++++++-----------
 1 file changed, 34 insertions(+), 12 deletions(-)

diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index d7a6de02df..9ddef2d6e2 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -1217,13 +1217,35 @@ const RISCVDecoder decoder_table[] = {
 
 const size_t decoder_table_size = ARRAY_SIZE(decoder_table);
 
-static void decode_opc(CPURISCVState *env, DisasContext *ctx, uint16_t opcode)
+static void decode_opc(CPURISCVState *env, DisasContext *ctx)
 {
+    uint32_t opcode;
+    bool pc_is_4byte_align = ((ctx->base.pc_next % 4) == 0);
+
     ctx->virt_inst_excp = false;
-    ctx->cur_insn_len = insn_len(opcode);
+    if (pc_is_4byte_align) {
+        /*
+         * Load 4 bytes at once to make instruction fetch atomically.
+         *
+         * Note: When pc is 4-byte aligned, 4-byte instruction wouldn't be
+         * across pages. We could preload 4 bytes instruction no matter
+         * real one is 2 or 4 bytes. Instruction preload wouldn't trigger
+         * additional page fault.
+         */
+        opcode = translator_ldl(env, &ctx->base, ctx->base.pc_next);
+    } else {
+        /*
+         * For unaligned pc, instruction preload may trigger additional
+         * page fault so we only load 2 bytes here.
+         */
+        opcode = (uint32_t) translator_lduw(env, &ctx->base, ctx->base.pc_next);
+    }
+    ctx->ol = ctx->xl;
+
+    ctx->cur_insn_len = insn_len((uint16_t)opcode);
     /* Check for compressed insn */
     if (ctx->cur_insn_len == 2) {
-        ctx->opcode = opcode;
+        ctx->opcode = (uint16_t)opcode;
         /*
          * The Zca extension is added as way to refer to instructions in the C
          * extension that do not include the floating-point loads and stores
@@ -1233,15 +1255,17 @@ static void decode_opc(CPURISCVState *env, DisasContext *ctx, uint16_t opcode)
             return;
         }
     } else {
-        uint32_t opcode32 = opcode;
-        opcode32 = deposit32(opcode32, 16, 16,
-                             translator_lduw(env, &ctx->base,
-                                             ctx->base.pc_next + 2));
-        ctx->opcode = opcode32;
+        if (!pc_is_4byte_align) {
+            /* Load last 2 bytes of instruction here */
+            opcode = deposit32(opcode, 16, 16,
+                               translator_lduw(env, &ctx->base,
+                                               ctx->base.pc_next + 2));
+        }
+        ctx->opcode = opcode;
 
         for (guint i = 0; i < ctx->decoders->len; ++i) {
             riscv_cpu_decode_fn func = g_ptr_array_index(ctx->decoders, i);
-            if (func(ctx, opcode32)) {
+            if (func(ctx, opcode)) {
                 return;
             }
         }
@@ -1319,10 +1343,8 @@ static void riscv_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
 {
     DisasContext *ctx = container_of(dcbase, DisasContext, base);
     CPURISCVState *env = cpu_env(cpu);
-    uint16_t opcode16 = translator_lduw(env, &ctx->base, ctx->base.pc_next);
 
-    ctx->ol = ctx->xl;
-    decode_opc(env, ctx, opcode16);
+    decode_opc(env, ctx);
     ctx->base.pc_next += ctx->cur_insn_len;
 
     /*

From b0175841fa4f867b4b1219dba72c33392118dd43 Mon Sep 17 00:00:00 2001
From: Meng Zhuo <mengzhuo@iscas.ac.cn>
Date: Fri, 6 Jun 2025 11:42:51 +0800
Subject: [PATCH 1875/2760] target/riscv/kvm: add max_satp_mode from host cpu

This patch adds max_satp_mode from host kvm cpu setting.

Tested on: Milkv Megrez (Eswin 7700x)

Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2931
Signed-off-by: Meng Zhuo <mengzhuo@iscas.ac.cn>
Message-ID: <20250606034250.181707-1-mengzhuo@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm/kvm-cpu.c | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
index e1a04be20f..502d33f404 100644
--- a/target/riscv/kvm/kvm-cpu.c
+++ b/target/riscv/kvm/kvm-cpu.c
@@ -999,6 +999,19 @@ static void kvm_riscv_destroy_scratch_vcpu(KVMScratchCPU *scratch)
     close(scratch->kvmfd);
 }
 
+static void kvm_riscv_init_max_satp_mode(RISCVCPU *cpu, KVMScratchCPU *kvmcpu)
+{
+    struct kvm_one_reg reg;
+    int ret;
+
+    reg.id = RISCV_CONFIG_REG(satp_mode);
+    reg.addr = (uint64_t)&cpu->cfg.max_satp_mode;
+    ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
+    if (ret != 0) {
+        error_report("Unable to retrieve satp mode from host, error %d", ret);
+    }
+}
+
 static void kvm_riscv_init_machine_ids(RISCVCPU *cpu, KVMScratchCPU *kvmcpu)
 {
     struct kvm_one_reg reg;
@@ -1302,6 +1315,7 @@ static void riscv_init_kvm_registers(Object *cpu_obj)
     kvm_riscv_init_machine_ids(cpu, &kvmcpu);
     kvm_riscv_init_misa_ext_mask(cpu, &kvmcpu);
     kvm_riscv_init_cfg(cpu, &kvmcpu);
+    kvm_riscv_init_max_satp_mode(cpu, &kvmcpu);
 
     kvm_riscv_destroy_scratch_vcpu(&kvmcpu);
 }
@@ -1985,7 +1999,7 @@ static bool kvm_cpu_realize(CPUState *cs, Error **errp)
         }
     }
 
-   return true;
+    return true;
 }
 
 void riscv_kvm_cpu_finalize_features(RISCVCPU *cpu, Error **errp)

From cd633bea8b0d30f3418b0dd372116bf3e028e42f Mon Sep 17 00:00:00 2001
From: Jay Chang <jay.chang@sifive.com>
Date: Fri, 6 Jun 2025 15:25:25 +0800
Subject: [PATCH 1876/2760] target/riscv: Make PMP region count configurable

Previously, the number of PMP regions was hardcoded to 16 in QEMU.
This patch replaces the fixed value with a new `pmp_regions` field,
allowing platforms to configure the number of PMP regions.

If no specific value is provided, the default number of PMP regions
remains 16 to preserve the existing behavior.

A new CPU parameter num-pmp-regions has been introduced to the QEMU
command line. For example:

	-cpu rv64, g=true, c=true, pmp=true, num-pmp-regions=8

Signed-off-by: Jay Chang <jay.chang@sifive.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250606072525.17313-3-jay.chang@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c                | 48 +++++++++++++++++++++++++++++--
 target/riscv/cpu.h                |  3 +-
 target/riscv/cpu_cfg_fields.h.inc |  1 +
 target/riscv/csr.c                |  5 +++-
 target/riscv/machine.c            |  3 +-
 target/riscv/pmp.c                | 28 ++++++++++++------
 6 files changed, 74 insertions(+), 14 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index bf14256a61..758f254c15 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -1119,6 +1119,7 @@ static void riscv_cpu_init(Object *obj)
     cpu->cfg.cbom_blocksize = 64;
     cpu->cfg.cbop_blocksize = 64;
     cpu->cfg.cboz_blocksize = 64;
+    cpu->cfg.pmp_regions = 16;
     cpu->env.vext_ver = VEXT_VERSION_1_00_0;
     cpu->cfg.max_satp_mode = -1;
 
@@ -1563,6 +1564,46 @@ static const PropertyInfo prop_pmp = {
     .set = prop_pmp_set,
 };
 
+static void prop_num_pmp_regions_set(Object *obj, Visitor *v, const char *name,
+                                     void *opaque, Error **errp)
+{
+    RISCVCPU *cpu = RISCV_CPU(obj);
+    uint8_t value;
+
+    visit_type_uint8(v, name, &value, errp);
+
+    if (cpu->cfg.pmp_regions != value && riscv_cpu_is_vendor(obj)) {
+        cpu_set_prop_err(cpu, name, errp);
+        return;
+    }
+
+    if (cpu->env.priv_ver < PRIV_VERSION_1_12_0 && value > OLD_MAX_RISCV_PMPS) {
+        error_setg(errp, "Number of PMP regions exceeds maximum available");
+        return;
+    } else if (value > MAX_RISCV_PMPS) {
+        error_setg(errp, "Number of PMP regions exceeds maximum available");
+        return;
+    }
+
+    cpu_option_add_user_setting(name, value);
+    cpu->cfg.pmp_regions = value;
+}
+
+static void prop_num_pmp_regions_get(Object *obj, Visitor *v, const char *name,
+                                     void *opaque, Error **errp)
+{
+    uint8_t value = RISCV_CPU(obj)->cfg.pmp_regions;
+
+    visit_type_uint8(v, name, &value, errp);
+}
+
+static const PropertyInfo prop_num_pmp_regions = {
+    .type = "uint8",
+    .description = "num-pmp-regions",
+    .get = prop_num_pmp_regions_get,
+    .set = prop_num_pmp_regions_set,
+};
+
 static int priv_spec_from_str(const char *priv_spec_str)
 {
     int priv_version = -1;
@@ -2562,6 +2603,7 @@ static const Property riscv_cpu_properties[] = {
 
     {.name = "mmu", .info = &prop_mmu},
     {.name = "pmp", .info = &prop_pmp},
+    {.name = "num-pmp-regions", .info = &prop_num_pmp_regions},
 
     {.name = "priv_spec", .info = &prop_priv_spec},
     {.name = "vext_spec", .info = &prop_vext_spec},
@@ -2932,7 +2974,8 @@ static const TypeInfo riscv_cpu_type_infos[] = {
         .cfg.max_satp_mode = VM_1_10_MBARE,
         .cfg.ext_zifencei = true,
         .cfg.ext_zicsr = true,
-        .cfg.pmp = true
+        .cfg.pmp = true,
+        .cfg.pmp_regions = 8
     ),
 
     DEFINE_ABSTRACT_RISCV_CPU(TYPE_RISCV_CPU_SIFIVE_U, TYPE_RISCV_VENDOR_CPU,
@@ -2943,7 +2986,8 @@ static const TypeInfo riscv_cpu_type_infos[] = {
         .cfg.ext_zifencei = true,
         .cfg.ext_zicsr = true,
         .cfg.mmu = true,
-        .cfg.pmp = true
+        .cfg.pmp = true,
+        .cfg.pmp_regions = 8
     ),
 
 #if defined(TARGET_RISCV32) || \
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index 17bf4e7579..4a862da615 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -174,7 +174,8 @@ extern RISCVCPUImpliedExtsRule *riscv_multi_ext_implied_rules[];
 
 #define MMU_USER_IDX 3
 
-#define MAX_RISCV_PMPS (16)
+#define MAX_RISCV_PMPS (64)
+#define OLD_MAX_RISCV_PMPS (16)
 
 #if !defined(CONFIG_USER_ONLY)
 #include "pmp.h"
diff --git a/target/riscv/cpu_cfg_fields.h.inc b/target/riscv/cpu_cfg_fields.h.inc
index 59f134a419..33c4f9bac8 100644
--- a/target/riscv/cpu_cfg_fields.h.inc
+++ b/target/riscv/cpu_cfg_fields.h.inc
@@ -163,6 +163,7 @@ TYPED_FIELD(uint16_t, elen, 0)
 TYPED_FIELD(uint16_t, cbom_blocksize, 0)
 TYPED_FIELD(uint16_t, cbop_blocksize, 0)
 TYPED_FIELD(uint16_t, cboz_blocksize, 0)
+TYPED_FIELD(uint8_t,  pmp_regions, 0)
 
 TYPED_FIELD(int8_t, max_satp_mode, -1)
 
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index d6cd441133..6296ecd1e1 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -738,7 +738,10 @@ static RISCVException dbltrp_hmode(CPURISCVState *env, int csrno)
 static RISCVException pmp(CPURISCVState *env, int csrno)
 {
     if (riscv_cpu_cfg(env)->pmp) {
-        if (csrno <= CSR_PMPCFG3) {
+        int max_pmpcfg = (env->priv_ver >= PRIV_VERSION_1_12_0) ?
++                              CSR_PMPCFG15 : CSR_PMPCFG3;
+
+        if (csrno <= max_pmpcfg) {
             uint32_t reg_index = csrno - CSR_PMPCFG0;
 
             /* TODO: RV128 restriction check */
diff --git a/target/riscv/machine.c b/target/riscv/machine.c
index c97e9ce9df..1600ec44f0 100644
--- a/target/riscv/machine.c
+++ b/target/riscv/machine.c
@@ -36,8 +36,9 @@ static int pmp_post_load(void *opaque, int version_id)
     RISCVCPU *cpu = opaque;
     CPURISCVState *env = &cpu->env;
     int i;
+    uint8_t pmp_regions = riscv_cpu_cfg(env)->pmp_regions;
 
-    for (i = 0; i < MAX_RISCV_PMPS; i++) {
+    for (i = 0; i < pmp_regions; i++) {
         pmp_update_rule_addr(env, i);
     }
     pmp_update_rule_nums(env);
diff --git a/target/riscv/pmp.c b/target/riscv/pmp.c
index 5af295e410..3540327c9a 100644
--- a/target/riscv/pmp.c
+++ b/target/riscv/pmp.c
@@ -122,7 +122,9 @@ uint32_t pmp_get_num_rules(CPURISCVState *env)
  */
 static inline uint8_t pmp_read_cfg(CPURISCVState *env, uint32_t pmp_index)
 {
-    if (pmp_index < MAX_RISCV_PMPS) {
+    uint8_t pmp_regions = riscv_cpu_cfg(env)->pmp_regions;
+
+    if (pmp_index < pmp_regions) {
         return env->pmp_state.pmp[pmp_index].cfg_reg;
     }
 
@@ -136,7 +138,9 @@ static inline uint8_t pmp_read_cfg(CPURISCVState *env, uint32_t pmp_index)
  */
 static bool pmp_write_cfg(CPURISCVState *env, uint32_t pmp_index, uint8_t val)
 {
-    if (pmp_index < MAX_RISCV_PMPS) {
+    uint8_t pmp_regions = riscv_cpu_cfg(env)->pmp_regions;
+
+    if (pmp_index < pmp_regions) {
         if (env->pmp_state.pmp[pmp_index].cfg_reg == val) {
             /* no change */
             return false;
@@ -236,9 +240,10 @@ void pmp_update_rule_addr(CPURISCVState *env, uint32_t pmp_index)
 void pmp_update_rule_nums(CPURISCVState *env)
 {
     int i;
+    uint8_t pmp_regions = riscv_cpu_cfg(env)->pmp_regions;
 
     env->pmp_state.num_rules = 0;
-    for (i = 0; i < MAX_RISCV_PMPS; i++) {
+    for (i = 0; i < pmp_regions; i++) {
         const uint8_t a_field =
             pmp_get_a_field(env->pmp_state.pmp[i].cfg_reg);
         if (PMP_AMATCH_OFF != a_field) {
@@ -332,6 +337,7 @@ bool pmp_hart_has_privs(CPURISCVState *env, hwaddr addr,
     int pmp_size = 0;
     hwaddr s = 0;
     hwaddr e = 0;
+    uint8_t pmp_regions = riscv_cpu_cfg(env)->pmp_regions;
 
     /* Short cut if no rules */
     if (0 == pmp_get_num_rules(env)) {
@@ -356,7 +362,7 @@ bool pmp_hart_has_privs(CPURISCVState *env, hwaddr addr,
      * 1.10 draft priv spec states there is an implicit order
      * from low to high
      */
-    for (i = 0; i < MAX_RISCV_PMPS; i++) {
+    for (i = 0; i < pmp_regions; i++) {
         s = pmp_is_in_range(env, i, addr);
         e = pmp_is_in_range(env, i, addr + pmp_size - 1);
 
@@ -527,8 +533,9 @@ void pmpaddr_csr_write(CPURISCVState *env, uint32_t addr_index,
 {
     trace_pmpaddr_csr_write(env->mhartid, addr_index, val);
     bool is_next_cfg_tor = false;
+    uint8_t pmp_regions = riscv_cpu_cfg(env)->pmp_regions;
 
-    if (addr_index < MAX_RISCV_PMPS) {
+    if (addr_index < pmp_regions) {
         if (env->pmp_state.pmp[addr_index].addr_reg == val) {
             /* no change */
             return;
@@ -538,7 +545,7 @@ void pmpaddr_csr_write(CPURISCVState *env, uint32_t addr_index,
          * In TOR mode, need to check the lock bit of the next pmp
          * (if there is a next).
          */
-        if (addr_index + 1 < MAX_RISCV_PMPS) {
+        if (addr_index + 1 < pmp_regions) {
             uint8_t pmp_cfg = env->pmp_state.pmp[addr_index + 1].cfg_reg;
             is_next_cfg_tor = PMP_AMATCH_TOR == pmp_get_a_field(pmp_cfg);
 
@@ -573,8 +580,9 @@ void pmpaddr_csr_write(CPURISCVState *env, uint32_t addr_index,
 target_ulong pmpaddr_csr_read(CPURISCVState *env, uint32_t addr_index)
 {
     target_ulong val = 0;
+    uint8_t pmp_regions = riscv_cpu_cfg(env)->pmp_regions;
 
-    if (addr_index < MAX_RISCV_PMPS) {
+    if (addr_index < pmp_regions) {
         val = env->pmp_state.pmp[addr_index].addr_reg;
         trace_pmpaddr_csr_read(env->mhartid, addr_index, val);
     } else {
@@ -592,6 +600,7 @@ void mseccfg_csr_write(CPURISCVState *env, target_ulong val)
 {
     int i;
     uint64_t mask = MSECCFG_MMWP | MSECCFG_MML;
+    uint8_t pmp_regions = riscv_cpu_cfg(env)->pmp_regions;
     /* Update PMM field only if the value is valid according to Zjpm v1.0 */
     if (riscv_cpu_cfg(env)->ext_smmpm &&
         riscv_cpu_mxl(env) == MXL_RV64 &&
@@ -603,7 +612,7 @@ void mseccfg_csr_write(CPURISCVState *env, target_ulong val)
 
     /* RLB cannot be enabled if it's already 0 and if any regions are locked */
     if (!MSECCFG_RLB_ISSET(env)) {
-        for (i = 0; i < MAX_RISCV_PMPS; i++) {
+        for (i = 0; i < pmp_regions; i++) {
             if (pmp_is_locked(env, i)) {
                 val &= ~MSECCFG_RLB;
                 break;
@@ -659,6 +668,7 @@ target_ulong pmp_get_tlb_size(CPURISCVState *env, hwaddr addr)
     hwaddr tlb_sa = addr & ~(TARGET_PAGE_SIZE - 1);
     hwaddr tlb_ea = tlb_sa + TARGET_PAGE_SIZE - 1;
     int i;
+    uint8_t pmp_regions = riscv_cpu_cfg(env)->pmp_regions;
 
     /*
      * If PMP is not supported or there are no PMP rules, the TLB page will not
@@ -669,7 +679,7 @@ target_ulong pmp_get_tlb_size(CPURISCVState *env, hwaddr addr)
         return TARGET_PAGE_SIZE;
     }
 
-    for (i = 0; i < MAX_RISCV_PMPS; i++) {
+    for (i = 0; i < pmp_regions; i++) {
         if (pmp_get_a_field(env->pmp_state.pmp[i].cfg_reg) == PMP_AMATCH_OFF) {
             continue;
         }

From 5000ba0cb1c513283f0a2f2f9742cfe8053dab8d Mon Sep 17 00:00:00 2001
From: Nutty Liu <liujingqi@lanxincomputing.com>
Date: Thu, 5 Jun 2025 20:48:48 +0800
Subject: [PATCH 1877/2760] hw/riscv/riscv-iommu: Fix PPN field of
 Translation-reponse register

The original implementation incorrectly performed a bitwise AND
operation between the PPN of iova and PPN Mask, leading to an
incorrect PPN field in Translation-reponse register.

The PPN of iova should be set entirely in the PPN field of
Translation-reponse register.

Also remove the code that was used to clear S field since this
field is already zero.

Signed-off-by: Nutty Liu <liujingqi@lanxincomputing.com>
Reviewed-by: Tomasz Jeznach <tjeznach@rivosinc.com>
Message-ID: <20250605124848.1248-1-liujingqi@lanxincomputing.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/riscv-iommu.c | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c
index a877e5da84..d8b1cb03a8 100644
--- a/hw/riscv/riscv-iommu.c
+++ b/hw/riscv/riscv-iommu.c
@@ -1935,11 +1935,7 @@ static void riscv_iommu_process_dbg(RISCVIOMMUState *s)
             iova = RISCV_IOMMU_TR_RESPONSE_FAULT | (((uint64_t) fault) << 10);
         } else {
             iova = iotlb.translated_addr & ~iotlb.addr_mask;
-            iova >>= TARGET_PAGE_BITS;
-            iova &= RISCV_IOMMU_TR_RESPONSE_PPN;
-
-            /* We do not support superpages (> 4kbs) for now */
-            iova &= ~RISCV_IOMMU_TR_RESPONSE_S;
+            iova = set_field(0, RISCV_IOMMU_TR_RESPONSE_PPN, PPN_DOWN(iova));
         }
         riscv_iommu_reg_set64(s, RISCV_IOMMU_REG_TR_RESPONSE, iova);
     }

From 7ec39d0cc945dd81108e08ca37afcfb3c9e5e012 Mon Sep 17 00:00:00 2001
From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Date: Thu, 5 Jun 2025 06:44:56 -0300
Subject: [PATCH 1878/2760] target/riscv: use qemu_chr_fe_write_all() in
 DBCN_CONSOLE_WRITE_BYTE
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The SBI spec states, for console write byte:

"This is a blocking SBI call and it will only return after writing the
specified byte to the debug console. It will also return, with
SBI_ERR_FAILED, if there are I/O errors."

Being a blocker call will either succeed writing the byte or error out,
it's feasible to use the blocking qemu_chr_fe_write_all() instead of
qemu_chr_fe_write().

Last but not the least, we will duck possible changes in
qemu_chr_fe_write() where ret = 0 will have a 'zero byte written'
semantic [1] - something that we're not ready to deal in this current
state.

[1] https://lore.kernel.org/qemu-devel/CAFEAcA_kEndvNtw4EHySXWwQPoGs029yAzZGGBcV=zGHaj7KUQ@mail.gmail.com/

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250605094456.1385105-2-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm/kvm-cpu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
index 502d33f404..5c19062c19 100644
--- a/target/riscv/kvm/kvm-cpu.c
+++ b/target/riscv/kvm/kvm-cpu.c
@@ -1619,7 +1619,7 @@ static void kvm_riscv_handle_sbi_dbcn(CPUState *cs, struct kvm_run *run)
         break;
     case SBI_EXT_DBCN_CONSOLE_WRITE_BYTE:
         ch = run->riscv_sbi.args[0];
-        ret = qemu_chr_fe_write(serial_hd(0)->be, &ch, sizeof(ch));
+        ret = qemu_chr_fe_write_all(serial_hd(0)->be, &ch, sizeof(ch));
 
         if (ret < 0) {
             error_report("SBI_EXT_DBCN_CONSOLE_WRITE_BYTE: error when "

From 2b027e73eefab0f9d3a0048564d1b653ba1d7703 Mon Sep 17 00:00:00 2001
From: Anton Blanchard <antonb@tenstorrent.com>
Date: Thu, 1 May 2025 11:42:53 +0000
Subject: [PATCH 1879/2760] target/riscv: Fix fcvt.s.bf16 NaN box checking

fcvt.s.bf16 uses the FP16 check_nanbox_h() which returns an FP16
quiet NaN. Add check_nanbox_bf16() which returns a BF16 quiet NaN.

Signed-off-by: Anton Blanchard <antonb@tenstorrent.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250501114253.594887-1-antonb@tenstorrent.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/fpu_helper.c |  2 +-
 target/riscv/internals.h  | 16 ++++++++++++++++
 2 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/target/riscv/fpu_helper.c b/target/riscv/fpu_helper.c
index 706bdfa61d..af40561b31 100644
--- a/target/riscv/fpu_helper.c
+++ b/target/riscv/fpu_helper.c
@@ -755,6 +755,6 @@ uint64_t helper_fcvt_bf16_s(CPURISCVState *env, uint64_t rs1)
 
 uint64_t helper_fcvt_s_bf16(CPURISCVState *env, uint64_t rs1)
 {
-    float16 frs1 = check_nanbox_h(env, rs1);
+    float16 frs1 = check_nanbox_bf16(env, rs1);
     return nanbox_s(env, bfloat16_to_float32(frs1, &env->fp_status));
 }
diff --git a/target/riscv/internals.h b/target/riscv/internals.h
index 4570bd50be..9686bb6208 100644
--- a/target/riscv/internals.h
+++ b/target/riscv/internals.h
@@ -142,6 +142,22 @@ static inline float16 check_nanbox_h(CPURISCVState *env, uint64_t f)
     }
 }
 
+static inline float16 check_nanbox_bf16(CPURISCVState *env, uint64_t f)
+{
+    /* Disable nanbox check when enable zfinx */
+    if (env_archcpu(env)->cfg.ext_zfinx) {
+        return (uint16_t)f;
+    }
+
+    uint64_t mask = MAKE_64BIT_MASK(16, 48);
+
+    if (likely((f & mask) == mask)) {
+        return (uint16_t)f;
+    } else {
+        return 0x7FC0u; /* default qnan */
+    }
+}
+
 #ifndef CONFIG_USER_ONLY
 /* Our implementation of SysemuCPUOps::has_work */
 bool riscv_cpu_has_work(CPUState *cs);

From 61240e3a06dc622d249b530557d5ce03c5854592 Mon Sep 17 00:00:00 2001
From: Florian Lugou <florian.lugou@provenrun.com>
Date: Thu, 5 Jun 2025 12:12:54 +0200
Subject: [PATCH 1880/2760] hw/char: sifive_uart: Avoid infinite delay of async
 xmit function

The current handler for TXFIFO writes schedules an async callback to
pop characters from the queue. When software writes to TXFIFO faster
than the async callback delay (100ns), the timer may be pushed back
while the previous character has not be dequeued yet. This happens in
particular when using -icount with small shift values. This is
especially worrysome when software repetitively issues amoor.w
instructions (as suggested by SiFive specification) and the FIFO is
full, leading to the callback being infinitly pushed back.

This commit fixes the issue by never pushing back the timer, only
updating it if it is not already active.

Signed-off-by: Florian Lugou <florian.lugou@provenrun.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250605101255.797162-1-florian.lugou@provenrun.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/char/sifive_uart.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/hw/char/sifive_uart.c b/hw/char/sifive_uart.c
index 0fc89e76d1..9bc697a67b 100644
--- a/hw/char/sifive_uart.c
+++ b/hw/char/sifive_uart.c
@@ -128,8 +128,10 @@ static void sifive_uart_write_tx_fifo(SiFiveUARTState *s, const uint8_t *buf,
         s->txfifo |= SIFIVE_UART_TXFIFO_FULL;
     }
 
-    timer_mod(s->fifo_trigger_handle, current_time +
-                  TX_INTERRUPT_TRIGGER_DELAY_NS);
+    if (!timer_pending(s->fifo_trigger_handle)) {
+        timer_mod(s->fifo_trigger_handle, current_time +
+                      TX_INTERRUPT_TRIGGER_DELAY_NS);
+    }
 }
 
 static uint64_t

From 81a245091fff2651f14004d1820f7ee77dd4f0fc Mon Sep 17 00:00:00 2001
From: Joel Stanley <joel@jms.id.au>
Date: Wed, 4 Jun 2025 12:24:37 +0930
Subject: [PATCH 1881/2760] hw/riscv/virt: Fix clint base address type

The address is a hardware address, so use hwaddr for consistency with
the rest of the machine.

Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Joel Stanley <joel@jms.id.au>
Message-ID: <20250604025450.85327-2-joel@jms.id.au>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index cf280a92e5..875eb7155a 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -324,7 +324,7 @@ static void create_fdt_socket_clint(RISCVVirtState *s,
     int cpu;
     g_autofree char *clint_name = NULL;
     g_autofree uint32_t *clint_cells = NULL;
-    unsigned long clint_addr;
+    hwaddr clint_addr;
     MachineState *ms = MACHINE(s);
     static const char * const clint_compat[2] = {
         "sifive,clint0", "riscv,clint0"
@@ -340,8 +340,8 @@ static void create_fdt_socket_clint(RISCVVirtState *s,
     }
 
     clint_addr = s->memmap[VIRT_CLINT].base +
-                 (s->memmap[VIRT_CLINT].size * socket);
-    clint_name = g_strdup_printf("/soc/clint@%lx", clint_addr);
+                 s->memmap[VIRT_CLINT].size * socket;
+    clint_name = g_strdup_printf("/soc/clint@%"HWADDR_PRIx, clint_addr);
     qemu_fdt_add_subnode(ms->fdt, clint_name);
     qemu_fdt_setprop_string_array(ms->fdt, clint_name, "compatible",
                                   (char **)&clint_compat,

From 16adb1f5d7ac548983f1b59d8e15f2eb5e51ae2c Mon Sep 17 00:00:00 2001
From: Joel Stanley <joel@jms.id.au>
Date: Wed, 4 Jun 2025 12:24:38 +0930
Subject: [PATCH 1882/2760] hw/riscv/virt: Use setprop_sized_cells for clint

The current device tree property uses two cells for the address (and for
the size), but assumes the they are less than 32 bits by hard coding the
high cell to zero.

Use qemu_fdt_setprop_sized_cells to do the job of splitting the upper
and lower 32 bits across cells.

Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Joel Stanley <joel@jms.id.au>
Message-ID: <20250604025450.85327-3-joel@jms.id.au>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index 875eb7155a..5143a46555 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -346,8 +346,8 @@ static void create_fdt_socket_clint(RISCVVirtState *s,
     qemu_fdt_setprop_string_array(ms->fdt, clint_name, "compatible",
                                   (char **)&clint_compat,
                                   ARRAY_SIZE(clint_compat));
-    qemu_fdt_setprop_cells(ms->fdt, clint_name, "reg",
-        0x0, clint_addr, 0x0, s->memmap[VIRT_CLINT].size);
+    qemu_fdt_setprop_sized_cells(ms->fdt, clint_name, "reg",
+        2, clint_addr, 2, s->memmap[VIRT_CLINT].size);
     qemu_fdt_setprop(ms->fdt, clint_name, "interrupts-extended",
         clint_cells, s->soc[socket].num_harts * sizeof(uint32_t) * 4);
     riscv_socket_fdt_write_id(ms, clint_name, socket);

From 349500bfb8523c94f88da4bfc41a22ccbba19055 Mon Sep 17 00:00:00 2001
From: Joel Stanley <joel@jms.id.au>
Date: Wed, 4 Jun 2025 12:24:39 +0930
Subject: [PATCH 1883/2760] hw/riscv/virt: Use setprop_sized_cells for memory

Use qemu_fdt_setprop_sized_cells to do the job of splitting the upper
and lower 32 bits across cells.

Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Joel Stanley <joel@jms.id.au>
Message-ID: <20250604025450.85327-4-joel@jms.id.au>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index 5143a46555..e074a29675 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -311,8 +311,7 @@ static void create_fdt_socket_memory(RISCVVirtState *s, int socket)
     size = riscv_socket_mem_size(ms, socket);
     mem_name = g_strdup_printf("/memory@%"HWADDR_PRIx, addr);
     qemu_fdt_add_subnode(ms->fdt, mem_name);
-    qemu_fdt_setprop_cells(ms->fdt, mem_name, "reg",
-        addr >> 32, addr, size >> 32, size);
+    qemu_fdt_setprop_sized_cells(ms->fdt, mem_name, "reg", 2, addr, 2, size);
     qemu_fdt_setprop_string(ms->fdt, mem_name, "device_type", "memory");
     riscv_socket_fdt_write_id(ms, mem_name, socket);
 }

From 4b7b4f9cb4fd4b569661e690c593780332d7291a Mon Sep 17 00:00:00 2001
From: Joel Stanley <joel@jms.id.au>
Date: Wed, 4 Jun 2025 12:24:40 +0930
Subject: [PATCH 1884/2760] hw/riscv/virt: Use setprop_sized_cells for aplic

The current device tree property uses two cells for the address (and for
the size), but assumes the they are less than 32 bits by hard coding the
high cell to zero.

Use qemu_fdt_setprop_sized_cells to do the job of splitting the upper
and lower 32 bits across cells.

Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Joel Stanley <joel@jms.id.au>
Message-ID: <20250604025450.85327-5-joel@jms.id.au>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index e074a29675..205fa6e44f 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -655,8 +655,8 @@ static void create_fdt_one_aplic(RISCVVirtState *s, int socket,
         qemu_fdt_setprop_cell(ms->fdt, aplic_name, "msi-parent", msi_phandle);
     }
 
-    qemu_fdt_setprop_cells(ms->fdt, aplic_name, "reg",
-                           0x0, aplic_addr, 0x0, aplic_size);
+    qemu_fdt_setprop_sized_cells(ms->fdt, aplic_name, "reg",
+                                 2, aplic_addr, 2, aplic_size);
     qemu_fdt_setprop_cell(ms->fdt, aplic_name, "riscv,num-sources",
                           VIRT_IRQCHIP_NUM_SOURCES);
 

From dd3d4fd9923082d8d2ad6ed71b4be05dad36b601 Mon Sep 17 00:00:00 2001
From: Joel Stanley <joel@jms.id.au>
Date: Wed, 4 Jun 2025 12:24:41 +0930
Subject: [PATCH 1885/2760] hw/riscv/virt: Use setprop_sized_cells for aclint

The current device tree property uses two cells for the address (and for
the size), but assumes the they are less than 32 bits by hard coding the
high cell to zero.

Use qemu_fdt_setprop_sized_cells to do the job of splitting the upper
and lower 32 bits across cells.

Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Joel Stanley <joel@jms.id.au>
Message-ID: <20250604025450.85327-6-joel@jms.id.au>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index 205fa6e44f..4fd966a342 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -387,8 +387,8 @@ static void create_fdt_socket_aclint(RISCVVirtState *s,
         qemu_fdt_add_subnode(ms->fdt, name);
         qemu_fdt_setprop_string(ms->fdt, name, "compatible",
             "riscv,aclint-mswi");
-        qemu_fdt_setprop_cells(ms->fdt, name, "reg",
-            0x0, addr, 0x0, RISCV_ACLINT_SWI_SIZE);
+        qemu_fdt_setprop_sized_cells(ms->fdt, name, "reg",
+            2, addr, 2, RISCV_ACLINT_SWI_SIZE);
         qemu_fdt_setprop(ms->fdt, name, "interrupts-extended",
             aclint_mswi_cells, aclint_cells_size);
         qemu_fdt_setprop(ms->fdt, name, "interrupt-controller", NULL, 0);
@@ -410,11 +410,11 @@ static void create_fdt_socket_aclint(RISCVVirtState *s,
     qemu_fdt_add_subnode(ms->fdt, name);
     qemu_fdt_setprop_string(ms->fdt, name, "compatible",
         "riscv,aclint-mtimer");
-    qemu_fdt_setprop_cells(ms->fdt, name, "reg",
-        0x0, addr + RISCV_ACLINT_DEFAULT_MTIME,
-        0x0, size - RISCV_ACLINT_DEFAULT_MTIME,
-        0x0, addr + RISCV_ACLINT_DEFAULT_MTIMECMP,
-        0x0, RISCV_ACLINT_DEFAULT_MTIME);
+    qemu_fdt_setprop_sized_cells(ms->fdt, name, "reg",
+        2, addr + RISCV_ACLINT_DEFAULT_MTIME,
+        2, size - RISCV_ACLINT_DEFAULT_MTIME,
+        2, addr + RISCV_ACLINT_DEFAULT_MTIMECMP,
+        2, RISCV_ACLINT_DEFAULT_MTIME);
     qemu_fdt_setprop(ms->fdt, name, "interrupts-extended",
         aclint_mtimer_cells, aclint_cells_size);
     riscv_socket_fdt_write_id(ms, name, socket);
@@ -428,8 +428,8 @@ static void create_fdt_socket_aclint(RISCVVirtState *s,
         qemu_fdt_add_subnode(ms->fdt, name);
         qemu_fdt_setprop_string(ms->fdt, name, "compatible",
             "riscv,aclint-sswi");
-        qemu_fdt_setprop_cells(ms->fdt, name, "reg",
-            0x0, addr, 0x0, s->memmap[VIRT_ACLINT_SSWI].size);
+        qemu_fdt_setprop_sized_cells(ms->fdt, name, "reg",
+            2, addr, 2, s->memmap[VIRT_ACLINT_SSWI].size);
         qemu_fdt_setprop(ms->fdt, name, "interrupts-extended",
             aclint_sswi_cells, aclint_cells_size);
         qemu_fdt_setprop(ms->fdt, name, "interrupt-controller", NULL, 0);

From 507161b5f53ae37e2aeeb99e558485146546331e Mon Sep 17 00:00:00 2001
From: Joel Stanley <joel@jms.id.au>
Date: Wed, 4 Jun 2025 12:24:42 +0930
Subject: [PATCH 1886/2760] hw/riscv/virt: Use setprop_sized_cells for plic

The current device tree property uses two cells for the address (and for
the size), but assumes the they are less than 32 bits by hard coding the
high cell to zero.

Use qemu_fdt_setprop_sized_cells to do the job of splitting the upper
and lower 32 bits across cells.

Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Joel Stanley <joel@jms.id.au>
Message-ID: <20250604025450.85327-7-joel@jms.id.au>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index 4fd966a342..67e60eec1f 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -493,8 +493,8 @@ static void create_fdt_socket_plic(RISCVVirtState *s,
                          s->soc[socket].num_harts * sizeof(uint32_t) * 4);
     }
 
-    qemu_fdt_setprop_cells(ms->fdt, plic_name, "reg",
-        0x0, plic_addr, 0x0, s->memmap[VIRT_PLIC].size);
+    qemu_fdt_setprop_sized_cells(ms->fdt, plic_name, "reg",
+                                 2, plic_addr, 2, s->memmap[VIRT_PLIC].size);
     qemu_fdt_setprop_cell(ms->fdt, plic_name, "riscv,ndev",
                           VIRT_IRQCHIP_NUM_SOURCES - 1);
     riscv_socket_fdt_write_id(ms, plic_name, socket);

From ad41a7022bd10a2db922cd4e314af2b2f1b6caa0 Mon Sep 17 00:00:00 2001
From: Joel Stanley <joel@jms.id.au>
Date: Wed, 4 Jun 2025 12:24:43 +0930
Subject: [PATCH 1887/2760] hw/riscv/virt: Use setprop_sized_cells for virtio

The current device tree property uses two cells for the address (and for
the size), but assumes the they are less than 32 bits by hard coding the
high cell to zero.

Use qemu_fdt_setprop_sized_cells to do the job of splitting the upper
and lower 32 bits across cells.

Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Joel Stanley <joel@jms.id.au>
Message-ID: <20250604025450.85327-8-joel@jms.id.au>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index 67e60eec1f..851c7cc82a 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -856,9 +856,7 @@ static void create_fdt_virtio(RISCVVirtState *s, uint32_t irq_virtio_phandle)
 
         qemu_fdt_add_subnode(ms->fdt, name);
         qemu_fdt_setprop_string(ms->fdt, name, "compatible", "virtio,mmio");
-        qemu_fdt_setprop_cells(ms->fdt, name, "reg",
-                               0x0, addr,
-                               0x0, size);
+        qemu_fdt_setprop_sized_cells(ms->fdt, name, "reg", 2, addr, 2, size);
         qemu_fdt_setprop_cell(ms->fdt, name, "interrupt-parent",
             irq_virtio_phandle);
         if (s->aia_type == VIRT_AIA_TYPE_NONE) {

From 08454fc3f5e43338c2e13dc040a2ebe77834945f Mon Sep 17 00:00:00 2001
From: Joel Stanley <joel@jms.id.au>
Date: Wed, 4 Jun 2025 12:24:44 +0930
Subject: [PATCH 1888/2760] hw/riscv/virt: Use setprop_sized_cells for reset

The current device tree property uses two cells for the address (and for
the size), but assumes the they are less than 32 bits by hard coding the
high cell to zero.

Use qemu_fdt_setprop_sized_cells to do the job of splitting the upper
and lower 32 bits across cells.

Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Joel Stanley <joel@jms.id.au>
Message-ID: <20250604025450.85327-9-joel@jms.id.au>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index 851c7cc82a..b59f10dabe 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -932,8 +932,9 @@ static void create_fdt_reset(RISCVVirtState *s, uint32_t *phandle)
         qemu_fdt_setprop_string_array(ms->fdt, name, "compatible",
                                       (char **)&compat, ARRAY_SIZE(compat));
     }
-    qemu_fdt_setprop_cells(ms->fdt, name, "reg",
-        0x0, s->memmap[VIRT_TEST].base, 0x0, s->memmap[VIRT_TEST].size);
+    qemu_fdt_setprop_sized_cells(ms->fdt, name, "reg",
+                                 2, s->memmap[VIRT_TEST].base,
+                                 2, s->memmap[VIRT_TEST].size);
     qemu_fdt_setprop_cell(ms->fdt, name, "phandle", test_phandle);
     test_phandle = qemu_fdt_get_phandle(ms->fdt, name);
     g_free(name);

From 4f1572d6f191f4618b30be3fda7344461910a03f Mon Sep 17 00:00:00 2001
From: Joel Stanley <joel@jms.id.au>
Date: Wed, 4 Jun 2025 12:24:45 +0930
Subject: [PATCH 1889/2760] hw/riscv/virt: Use setprop_sized_cells for uart

The current device tree property uses two cells for the address (and for
the size), but assumes the they are less than 32 bits by hard coding the
high cell to zero.

Use qemu_fdt_setprop_sized_cells to do the job of splitting the upper
and lower 32 bits across cells.

Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Joel Stanley <joel@jms.id.au>
Message-ID: <20250604025450.85327-10-joel@jms.id.au>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index b59f10dabe..7c38a90480 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -966,9 +966,9 @@ static void create_fdt_uart(RISCVVirtState *s,
                            s->memmap[VIRT_UART0].base);
     qemu_fdt_add_subnode(ms->fdt, name);
     qemu_fdt_setprop_string(ms->fdt, name, "compatible", "ns16550a");
-    qemu_fdt_setprop_cells(ms->fdt, name, "reg",
-        0x0, s->memmap[VIRT_UART0].base,
-        0x0, s->memmap[VIRT_UART0].size);
+    qemu_fdt_setprop_sized_cells(ms->fdt, name, "reg",
+                                 2, s->memmap[VIRT_UART0].base,
+                                 2, s->memmap[VIRT_UART0].size);
     qemu_fdt_setprop_cell(ms->fdt, name, "clock-frequency", 3686400);
     qemu_fdt_setprop_cell(ms->fdt, name, "interrupt-parent", irq_mmio_phandle);
     if (s->aia_type == VIRT_AIA_TYPE_NONE) {

From faa991f67888ae25744f535ad73043900729c024 Mon Sep 17 00:00:00 2001
From: Joel Stanley <joel@jms.id.au>
Date: Wed, 4 Jun 2025 12:24:46 +0930
Subject: [PATCH 1890/2760] hw/riscv/virt: Use setprop_sized_cells for rtc

The current device tree property uses two cells for the address (and for
the size), but assumes the they are less than 32 bits by hard coding the
high cell to zero.

Use qemu_fdt_setprop_sized_cells to do the job of splitting the upper
and lower 32 bits across cells.

Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Joel Stanley <joel@jms.id.au>
Message-ID: <20250604025450.85327-11-joel@jms.id.au>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index 7c38a90480..4fa2bad248 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -992,8 +992,9 @@ static void create_fdt_rtc(RISCVVirtState *s,
     qemu_fdt_add_subnode(ms->fdt, name);
     qemu_fdt_setprop_string(ms->fdt, name, "compatible",
         "google,goldfish-rtc");
-    qemu_fdt_setprop_cells(ms->fdt, name, "reg",
-        0x0, s->memmap[VIRT_RTC].base, 0x0, s->memmap[VIRT_RTC].size);
+    qemu_fdt_setprop_sized_cells(ms->fdt, name, "reg",
+                                 2, s->memmap[VIRT_RTC].base,
+                                 2, s->memmap[VIRT_RTC].size);
     qemu_fdt_setprop_cell(ms->fdt, name, "interrupt-parent",
         irq_mmio_phandle);
     if (s->aia_type == VIRT_AIA_TYPE_NONE) {

From 0e7e0ee63939a09b098279a475698d73243ffc76 Mon Sep 17 00:00:00 2001
From: Joel Stanley <joel@jms.id.au>
Date: Wed, 4 Jun 2025 12:24:47 +0930
Subject: [PATCH 1891/2760] hw/riscv/virt: Use setprop_sized_cells for iommu

The current device tree property uses two cells for the address (and for
the size), but assumes the they are less than 32 bits by hard coding the
high cell to zero.

Use qemu_fdt_setprop_sized_cells to do the job of splitting the upper
and lower 32 bits across cells.

Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Joel Stanley <joel@jms.id.au>
Message-ID: <20250604025450.85327-12-joel@jms.id.au>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index 4fa2bad248..67490c5c69 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -1088,8 +1088,7 @@ static void create_fdt_iommu_sys(RISCVVirtState *s, uint32_t irq_chip,
     qemu_fdt_setprop_cell(fdt, iommu_node, "#iommu-cells", 1);
     qemu_fdt_setprop_cell(fdt, iommu_node, "phandle", iommu_phandle);
 
-    qemu_fdt_setprop_cells(fdt, iommu_node, "reg",
-                           addr >> 32, addr, size >> 32, size);
+    qemu_fdt_setprop_sized_cells(fdt, iommu_node, "reg", 2, addr, 2, size);
     qemu_fdt_setprop_cell(fdt, iommu_node, "interrupt-parent", irq_chip);
 
     qemu_fdt_setprop_cells(fdt, iommu_node, "interrupts",

From 2454fc95ece3c73f649e21621775bcbe859d28ec Mon Sep 17 00:00:00 2001
From: Joel Stanley <joel@jms.id.au>
Date: Wed, 4 Jun 2025 12:24:48 +0930
Subject: [PATCH 1892/2760] hw/riscv/virt: Use setprop_sized_cells for pcie

The current device tree property uses two cells for the address (and for
the size), but assumes the they are less than 32 bits by hard coding the
high cell to zero.

Use qemu_fdt_setprop_sized_cells to do the job of splitting the upper
and lower 32 bits across cells.

Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Joel Stanley <joel@jms.id.au>
Message-ID: <20250604025450.85327-13-joel@jms.id.au>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index 67490c5c69..47e573f85a 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -894,8 +894,8 @@ static void create_fdt_pcie(RISCVVirtState *s,
     if (s->aia_type == VIRT_AIA_TYPE_APLIC_IMSIC) {
         qemu_fdt_setprop_cell(ms->fdt, name, "msi-parent", msi_pcie_phandle);
     }
-    qemu_fdt_setprop_cells(ms->fdt, name, "reg", 0,
-        s->memmap[VIRT_PCIE_ECAM].base, 0, s->memmap[VIRT_PCIE_ECAM].size);
+    qemu_fdt_setprop_sized_cells(ms->fdt, name, "reg", 2,
+        s->memmap[VIRT_PCIE_ECAM].base, 2, s->memmap[VIRT_PCIE_ECAM].size);
     qemu_fdt_setprop_sized_cells(ms->fdt, name, "ranges",
         1, FDT_PCI_RANGE_IOPORT, 2, 0,
         2, s->memmap[VIRT_PCIE_PIO].base, 2, s->memmap[VIRT_PCIE_PIO].size,

From 60aab7ad11e6cd8a82420ed6a18416853c0fb762 Mon Sep 17 00:00:00 2001
From: Huang Borong <3543977024@qq.com>
Date: Fri, 25 Apr 2025 20:22:12 +0800
Subject: [PATCH 1893/2760] target/riscv: Add BOSC's Xiangshan Kunminghu CPU

Add a CPU entry for the Xiangshan Kunminghu CPU, an open-source,
high-performance RISC-V processor. More details can be found at:
https://github.com/OpenXiangShan/XiangShan

Note: The ISA extensions supported by the Xiangshan Kunminghu CPU are
categorized based on four RISC-V specifications: Volume I: Unprivileged
Architecture, Volume II: Privileged Architecture, AIA, and RVA23. The
extensions within each category are organized according to the chapter
order in the specifications.

Signed-off-by: Yu Hu <huyu@bosc.ac.cn>
Signed-off-by: Ran Wang <wangran@bosc.ac.cn>
Signed-off-by: Borong Huang <3543977024@qq.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250425122212.364-1-wangran@bosc.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu-qom.h |  1 +
 target/riscv/cpu.c     | 58 ++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 59 insertions(+)

diff --git a/target/riscv/cpu-qom.h b/target/riscv/cpu-qom.h
index 1ee05eb393..75f4e43408 100644
--- a/target/riscv/cpu-qom.h
+++ b/target/riscv/cpu-qom.h
@@ -55,6 +55,7 @@
 #define TYPE_RISCV_CPU_VEYRON_V1        RISCV_CPU_TYPE_NAME("veyron-v1")
 #define TYPE_RISCV_CPU_TT_ASCALON       RISCV_CPU_TYPE_NAME("tt-ascalon")
 #define TYPE_RISCV_CPU_XIANGSHAN_NANHU  RISCV_CPU_TYPE_NAME("xiangshan-nanhu")
+#define TYPE_RISCV_CPU_XIANGSHAN_KMH    RISCV_CPU_TYPE_NAME("xiangshan-kunminghu")
 #define TYPE_RISCV_CPU_HOST             RISCV_CPU_TYPE_NAME("host")
 
 OBJECT_DECLARE_CPU_TYPE(RISCVCPU, RISCVCPUClass, RISCV_CPU)
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 758f254c15..e3f8ecef68 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -3206,6 +3206,64 @@ static const TypeInfo riscv_cpu_type_infos[] = {
         .cfg.max_satp_mode = VM_1_10_SV39,
     ),
 
+    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_XIANGSHAN_KMH, TYPE_RISCV_VENDOR_CPU,
+        .misa_mxl_max = MXL_RV64,
+        .misa_ext = RVG | RVC | RVB | RVS | RVU | RVH | RVV,
+        .priv_spec = PRIV_VERSION_1_13_0,
+    /*
+     * The RISC-V Instruction Set Manual: Volume I
+     * Unprivileged Architecture
+     */
+    .cfg.ext_zicntr = true,
+    .cfg.ext_zihpm = true,
+    .cfg.ext_zihintntl = true,
+    .cfg.ext_zihintpause = true,
+    .cfg.ext_zimop = true,
+    .cfg.ext_zcmop = true,
+    .cfg.ext_zicond = true,
+    .cfg.ext_zawrs = true,
+    .cfg.ext_zacas = true,
+    .cfg.ext_zfh = true,
+    .cfg.ext_zfa = true,
+    .cfg.ext_zcb = true,
+    .cfg.ext_zbc = true,
+    .cfg.ext_zvfh = true,
+    .cfg.ext_zkn = true,
+    .cfg.ext_zks = true,
+    .cfg.ext_zkt = true,
+    .cfg.ext_zvbb = true,
+    .cfg.ext_zvkt = true,
+    /*
+     * The RISC-V Instruction Set Manual: Volume II
+     * Privileged Architecture
+     */
+    .cfg.ext_smstateen = true,
+    .cfg.ext_smcsrind = true,
+    .cfg.ext_sscsrind = true,
+    .cfg.ext_svnapot = true,
+    .cfg.ext_svpbmt = true,
+    .cfg.ext_svinval = true,
+    .cfg.ext_sstc = true,
+    .cfg.ext_sscofpmf = true,
+    .cfg.ext_ssdbltrp = true,
+    .cfg.ext_ssnpm = true,
+    .cfg.ext_smnpm = true,
+    .cfg.ext_smmpm = true,
+    .cfg.ext_sspm = true,
+    .cfg.ext_supm = true,
+    /* The RISC-V Advanced Interrupt Architecture */
+    .cfg.ext_smaia = true,
+    .cfg.ext_ssaia = true,
+    /* RVA23 Profiles */
+    .cfg.ext_zicbom = true,
+    .cfg.ext_zicbop = true,
+    .cfg.ext_zicboz = true,
+    .cfg.ext_svade = true,
+        .cfg.mmu = true,
+        .cfg.pmp = true,
+        .cfg.max_satp_mode = VM_1_10_SV48,
+    ),
+
 #if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
     DEFINE_RISCV_CPU(TYPE_RISCV_CPU_BASE128, TYPE_RISCV_DYNAMIC_CPU,
         .cfg.max_satp_mode = VM_1_10_SV57,

From 29abd3d112c380b8019a77ebad65f61addfb812d Mon Sep 17 00:00:00 2001
From: Huang Borong <3543977024@qq.com>
Date: Tue, 17 Jun 2025 15:42:22 +0800
Subject: [PATCH 1894/2760] hw/riscv: Initial support for BOSC's Xiangshan
 Kunminghu FPGA prototype

This implementation provides emulation for the Xiangshan Kunminghu
FPGA prototype platform, including support for UART, CLINT, IMSIC,
and APLIC devices. More details can be found at
https://github.com/OpenXiangShan/XiangShan

Signed-off-by: qinshaoqing <qinshaoqing@bosc.ac.cn>
Signed-off-by: Yang Wang <wangyang@bosc.ac.cn>
Signed-off-by: Yu Hu <819258943@qq.com>
Signed-off-by: Ran Wang <wangran@bosc.ac.cn>
Signed-off-by: Borong Huang <3543977024@qq.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20250617074222.17618-1-wangran@bosc.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 MAINTAINERS                                 |   7 +
 configs/devices/riscv64-softmmu/default.mak |   1 +
 docs/system/riscv/xiangshan-kunminghu.rst   |  39 ++++
 docs/system/target-riscv.rst                |   1 +
 hw/riscv/Kconfig                            |   9 +
 hw/riscv/meson.build                        |   1 +
 hw/riscv/xiangshan_kmh.c                    | 220 ++++++++++++++++++++
 include/hw/riscv/xiangshan_kmh.h            |  68 ++++++
 8 files changed, 346 insertions(+)
 create mode 100644 docs/system/riscv/xiangshan-kunminghu.rst
 create mode 100644 hw/riscv/xiangshan_kmh.c
 create mode 100644 include/hw/riscv/xiangshan_kmh.h

diff --git a/MAINTAINERS b/MAINTAINERS
index b1cbfe115b..12efc88aa7 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1697,6 +1697,13 @@ S: Maintained
 F: hw/riscv/microblaze-v-generic.c
 F: docs/system/riscv/microblaze-v-generic.rst
 
+Xiangshan Kunminghu
+M: Ran Wang <wangran@bosc.ac.cn>
+S: Maintained
+F: docs/system/riscv/xiangshan-kunminghu.rst
+F: hw/riscv/xiangshan_kmh.c
+F: include/hw/riscv/xiangshan_kmh.h
+
 RX Machines
 -----------
 rx-gdbsim
diff --git a/configs/devices/riscv64-softmmu/default.mak b/configs/devices/riscv64-softmmu/default.mak
index 39ed3a0061..e485bbd1a3 100644
--- a/configs/devices/riscv64-softmmu/default.mak
+++ b/configs/devices/riscv64-softmmu/default.mak
@@ -11,3 +11,4 @@
 # CONFIG_RISCV_VIRT=n
 # CONFIG_MICROCHIP_PFSOC=n
 # CONFIG_SHAKTI_C=n
+# CONFIG_XIANGSHAN_KUNMINGHU=n
diff --git a/docs/system/riscv/xiangshan-kunminghu.rst b/docs/system/riscv/xiangshan-kunminghu.rst
new file mode 100644
index 0000000000..46e7ceeda0
--- /dev/null
+++ b/docs/system/riscv/xiangshan-kunminghu.rst
@@ -0,0 +1,39 @@
+BOSC Xiangshan Kunminghu FPGA prototype platform (``xiangshan-kunminghu``)
+==========================================================================
+The ``xiangshan-kunminghu`` machine is compatible with our FPGA prototype
+platform.
+
+XiangShan is an open-source high-performance RISC-V processor project.
+The third generation processor is called Kunminghu. Kunminghu is a 64-bit
+RV64GCBSUHV processor core. More information can be found in our Github
+repository:
+https://github.com/OpenXiangShan/XiangShan
+
+Supported devices
+-----------------
+The ``xiangshan-kunminghu`` machine supports the following devices:
+
+* Up to 16 xiangshan-kunminghu cores
+* Core Local Interruptor (CLINT)
+* Incoming MSI Controller (IMSIC)
+* Advanced Platform-Level Interrupt Controller (APLIC)
+* 1 UART
+
+Boot options
+------------
+The ``xiangshan-kunminghu`` machine can start using the standard ``-bios``
+functionality for loading the boot image. You need to compile and link
+the firmware, kernel, and Device Tree (FDT) into a single binary file,
+such as ``fw_payload.bin``.
+
+Running
+-------
+Below is an example command line for running the ``xiangshan-kunminghu``
+machine:
+
+.. code-block:: bash
+
+   $ qemu-system-riscv64 -machine xiangshan-kunminghu \
+      -smp 16 -m 16G \
+      -bios path/to/opensbi/platform/generic/firmware/fw_payload.bin \
+      -nographic
diff --git a/docs/system/target-riscv.rst b/docs/system/target-riscv.rst
index 95457af130..89b2cb732c 100644
--- a/docs/system/target-riscv.rst
+++ b/docs/system/target-riscv.rst
@@ -71,6 +71,7 @@ undocumented; you can get a complete list by running
    riscv/shakti-c
    riscv/sifive_u
    riscv/virt
+   riscv/xiangshan-kunminghu
 
 RISC-V CPU firmware
 -------------------
diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
index e6a0ac1fa1..fc9c35bd98 100644
--- a/hw/riscv/Kconfig
+++ b/hw/riscv/Kconfig
@@ -119,3 +119,12 @@ config SPIKE
     select HTIF
     select RISCV_ACLINT
     select SIFIVE_PLIC
+
+config XIANGSHAN_KUNMINGHU
+    bool
+    default y
+    depends on RISCV64
+    select RISCV_ACLINT
+    select RISCV_APLIC
+    select RISCV_IMSIC
+    select SERIAL_MM
diff --git a/hw/riscv/meson.build b/hw/riscv/meson.build
index c22f3a7216..2a8d5b136c 100644
--- a/hw/riscv/meson.build
+++ b/hw/riscv/meson.build
@@ -13,5 +13,6 @@ riscv_ss.add(when: 'CONFIG_ACPI', if_true: files('virt-acpi-build.c'))
 riscv_ss.add(when: 'CONFIG_RISCV_IOMMU', if_true: files(
 	'riscv-iommu.c', 'riscv-iommu-pci.c', 'riscv-iommu-sys.c', 'riscv-iommu-hpm.c'))
 riscv_ss.add(when: 'CONFIG_MICROBLAZE_V', if_true: files('microblaze-v-generic.c'))
+riscv_ss.add(when: 'CONFIG_XIANGSHAN_KUNMINGHU', if_true: files('xiangshan_kmh.c'))
 
 hw_arch += {'riscv': riscv_ss}
diff --git a/hw/riscv/xiangshan_kmh.c b/hw/riscv/xiangshan_kmh.c
new file mode 100644
index 0000000000..a95fd6174f
--- /dev/null
+++ b/hw/riscv/xiangshan_kmh.c
@@ -0,0 +1,220 @@
+/*
+ * QEMU RISC-V Board Compatible with the Xiangshan Kunminghu
+ * FPGA prototype platform
+ *
+ * Copyright (c) 2025 Beijing Institute of Open Source Chip (BOSC)
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ *
+ * Provides a board compatible with the Xiangshan Kunminghu
+ * FPGA prototype platform:
+ *
+ * 0) UART (16550A)
+ * 1) CLINT (Core-Local Interruptor)
+ * 2) IMSIC (Incoming MSI Controller)
+ * 3) APLIC (Advanced Platform-Level Interrupt Controller)
+ *
+ * More information can be found in our Github repository:
+ * https://github.com/OpenXiangShan/XiangShan
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2 or later, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "system/address-spaces.h"
+#include "hw/boards.h"
+#include "hw/char/serial-mm.h"
+#include "hw/intc/riscv_aclint.h"
+#include "hw/intc/riscv_aplic.h"
+#include "hw/intc/riscv_imsic.h"
+#include "hw/qdev-properties.h"
+#include "hw/riscv/boot.h"
+#include "hw/riscv/xiangshan_kmh.h"
+#include "hw/riscv/riscv_hart.h"
+#include "system/system.h"
+
+static const MemMapEntry xiangshan_kmh_memmap[] = {
+    [XIANGSHAN_KMH_ROM] =          {     0x1000,        0xF000 },
+    [XIANGSHAN_KMH_UART0] =        { 0x310B0000,       0x10000 },
+    [XIANGSHAN_KMH_CLINT] =        { 0x38000000,       0x10000 },
+    [XIANGSHAN_KMH_APLIC_M] =      { 0x31100000,        0x4000 },
+    [XIANGSHAN_KMH_APLIC_S] =      { 0x31120000,        0x4000 },
+    [XIANGSHAN_KMH_IMSIC_M] =      { 0x3A800000,       0x10000 },
+    [XIANGSHAN_KMH_IMSIC_S] =      { 0x3B000000,       0x80000 },
+    [XIANGSHAN_KMH_DRAM] =         { 0x80000000,           0x0 },
+};
+
+static DeviceState *xiangshan_kmh_create_aia(uint32_t num_harts)
+{
+    int i;
+    const MemMapEntry *memmap = xiangshan_kmh_memmap;
+    hwaddr addr = 0;
+    DeviceState *aplic_m = NULL;
+
+    /* M-level IMSICs */
+    addr = memmap[XIANGSHAN_KMH_IMSIC_M].base;
+    for (i = 0; i < num_harts; i++) {
+        riscv_imsic_create(addr + i * IMSIC_HART_SIZE(0), i, true,
+                           1, XIANGSHAN_KMH_IMSIC_NUM_IDS);
+    }
+
+    /* S-level IMSICs */
+    addr = memmap[XIANGSHAN_KMH_IMSIC_S].base;
+    for (i = 0; i < num_harts; i++) {
+        riscv_imsic_create(addr +
+                           i * IMSIC_HART_SIZE(XIANGSHAN_KMH_IMSIC_GUEST_BITS),
+                           i, false, 1 + XIANGSHAN_KMH_IMSIC_GUEST_BITS,
+                           XIANGSHAN_KMH_IMSIC_NUM_IDS);
+    }
+
+    /* M-level APLIC */
+    aplic_m = riscv_aplic_create(memmap[XIANGSHAN_KMH_APLIC_M].base,
+                                 memmap[XIANGSHAN_KMH_APLIC_M].size,
+                                 0, 0, XIANGSHAN_KMH_APLIC_NUM_SOURCES,
+                                 1, true, true, NULL);
+
+    /* S-level APLIC */
+    riscv_aplic_create(memmap[XIANGSHAN_KMH_APLIC_S].base,
+                       memmap[XIANGSHAN_KMH_APLIC_S].size,
+                       0, 0, XIANGSHAN_KMH_APLIC_NUM_SOURCES,
+                       1, true, false, aplic_m);
+
+    return aplic_m;
+}
+
+static void xiangshan_kmh_soc_realize(DeviceState *dev, Error **errp)
+{
+    MachineState *ms = MACHINE(qdev_get_machine());
+    XiangshanKmhSoCState *s = XIANGSHAN_KMH_SOC(dev);
+    const MemMapEntry *memmap = xiangshan_kmh_memmap;
+    MemoryRegion *system_memory = get_system_memory();
+    uint32_t num_harts = ms->smp.cpus;
+
+    qdev_prop_set_uint32(DEVICE(&s->cpus), "num-harts", num_harts);
+    qdev_prop_set_uint32(DEVICE(&s->cpus), "hartid-base", 0);
+    qdev_prop_set_string(DEVICE(&s->cpus), "cpu-type",
+                         TYPE_RISCV_CPU_XIANGSHAN_KMH);
+    sysbus_realize(SYS_BUS_DEVICE(&s->cpus), &error_fatal);
+
+    /* AIA */
+    s->irqchip = xiangshan_kmh_create_aia(num_harts);
+
+    /* UART */
+    serial_mm_init(system_memory, memmap[XIANGSHAN_KMH_UART0].base, 2,
+                   qdev_get_gpio_in(s->irqchip, XIANGSHAN_KMH_UART0_IRQ),
+                   115200, serial_hd(0), DEVICE_LITTLE_ENDIAN);
+
+    /* CLINT */
+    riscv_aclint_swi_create(memmap[XIANGSHAN_KMH_CLINT].base,
+                            0, num_harts, false);
+    riscv_aclint_mtimer_create(memmap[XIANGSHAN_KMH_CLINT].base +
+                               RISCV_ACLINT_SWI_SIZE,
+                               RISCV_ACLINT_DEFAULT_MTIMER_SIZE,
+                               0, num_harts, RISCV_ACLINT_DEFAULT_MTIMECMP,
+                               RISCV_ACLINT_DEFAULT_MTIME,
+                               XIANGSHAN_KMH_CLINT_TIMEBASE_FREQ, true);
+
+    /* ROM */
+    memory_region_init_rom(&s->rom, OBJECT(dev), "xiangshan.kunminghu.rom",
+                           memmap[XIANGSHAN_KMH_ROM].size, &error_fatal);
+    memory_region_add_subregion(system_memory,
+                                memmap[XIANGSHAN_KMH_ROM].base, &s->rom);
+}
+
+static void xiangshan_kmh_soc_class_init(ObjectClass *klass, const void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->realize = xiangshan_kmh_soc_realize;
+    dc->user_creatable = false;
+}
+
+static void xiangshan_kmh_soc_instance_init(Object *obj)
+{
+    XiangshanKmhSoCState *s = XIANGSHAN_KMH_SOC(obj);
+
+    object_initialize_child(obj, "cpus", &s->cpus, TYPE_RISCV_HART_ARRAY);
+}
+
+static const TypeInfo xiangshan_kmh_soc_info = {
+    .name = TYPE_XIANGSHAN_KMH_SOC,
+    .parent = TYPE_DEVICE,
+    .instance_size = sizeof(XiangshanKmhSoCState),
+    .instance_init = xiangshan_kmh_soc_instance_init,
+    .class_init = xiangshan_kmh_soc_class_init,
+};
+
+static void xiangshan_kmh_soc_register_types(void)
+{
+    type_register_static(&xiangshan_kmh_soc_info);
+}
+type_init(xiangshan_kmh_soc_register_types)
+
+static void xiangshan_kmh_machine_init(MachineState *machine)
+{
+    XiangshanKmhState *s = XIANGSHAN_KMH_MACHINE(machine);
+    const MemMapEntry *memmap = xiangshan_kmh_memmap;
+    MemoryRegion *system_memory = get_system_memory();
+    hwaddr start_addr = memmap[XIANGSHAN_KMH_DRAM].base;
+
+    /* Initialize SoC */
+    object_initialize_child(OBJECT(machine), "soc", &s->soc,
+                            TYPE_XIANGSHAN_KMH_SOC);
+    qdev_realize(DEVICE(&s->soc), NULL, &error_fatal);
+
+    /* Register RAM */
+    memory_region_add_subregion(system_memory,
+                                memmap[XIANGSHAN_KMH_DRAM].base,
+                                machine->ram);
+
+    /* ROM reset vector */
+    riscv_setup_rom_reset_vec(machine, &s->soc.cpus,
+                              start_addr,
+                              memmap[XIANGSHAN_KMH_ROM].base,
+                              memmap[XIANGSHAN_KMH_ROM].size, 0, 0);
+    if (machine->firmware) {
+        riscv_load_firmware(machine->firmware, &start_addr, NULL);
+    }
+
+    /* Note: dtb has been integrated into firmware(OpenSBI) when compiling */
+}
+
+static void xiangshan_kmh_machine_class_init(ObjectClass *klass, const void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(klass);
+    static const char *const valid_cpu_types[] = {
+        TYPE_RISCV_CPU_XIANGSHAN_KMH,
+        NULL
+    };
+
+    mc->desc = "RISC-V Board compatible with the Xiangshan " \
+               "Kunminghu FPGA prototype platform";
+    mc->init = xiangshan_kmh_machine_init;
+    mc->max_cpus = XIANGSHAN_KMH_MAX_CPUS;
+    mc->default_cpu_type = TYPE_RISCV_CPU_XIANGSHAN_KMH;
+    mc->valid_cpu_types = valid_cpu_types;
+    mc->default_ram_id = "xiangshan.kunminghu.ram";
+}
+
+static const TypeInfo xiangshan_kmh_machine_info = {
+    .name = TYPE_XIANGSHAN_KMH_MACHINE,
+    .parent = TYPE_MACHINE,
+    .instance_size = sizeof(XiangshanKmhState),
+    .class_init = xiangshan_kmh_machine_class_init,
+};
+
+static void xiangshan_kmh_machine_register_types(void)
+{
+    type_register_static(&xiangshan_kmh_machine_info);
+}
+type_init(xiangshan_kmh_machine_register_types)
diff --git a/include/hw/riscv/xiangshan_kmh.h b/include/hw/riscv/xiangshan_kmh.h
new file mode 100644
index 0000000000..c5dc6b1a9a
--- /dev/null
+++ b/include/hw/riscv/xiangshan_kmh.h
@@ -0,0 +1,68 @@
+/* SPDX-License-Identifier: BSD-2-Clause */
+/*
+ * QEMU RISC-V Board Compatible with the Xiangshan Kunminghu
+ * FPGA prototype platform
+ *
+ * Copyright (c) 2025 Beijing Institute of Open Source Chip (BOSC)
+ *
+ */
+
+#ifndef HW_XIANGSHAN_KMH_H
+#define HW_XIANGSHAN_KMH_H
+
+#include "hw/boards.h"
+#include "hw/riscv/riscv_hart.h"
+
+#define XIANGSHAN_KMH_MAX_CPUS 16
+
+typedef struct XiangshanKmhSoCState {
+    /*< private >*/
+    DeviceState parent_obj;
+
+    /*< public >*/
+    RISCVHartArrayState cpus;
+    DeviceState *irqchip;
+    MemoryRegion rom;
+} XiangshanKmhSoCState;
+
+#define TYPE_XIANGSHAN_KMH_SOC "xiangshan.kunminghu.soc"
+DECLARE_INSTANCE_CHECKER(XiangshanKmhSoCState, XIANGSHAN_KMH_SOC,
+                         TYPE_XIANGSHAN_KMH_SOC)
+
+typedef struct XiangshanKmhState {
+    /*< private >*/
+    MachineState parent_obj;
+
+    /*< public >*/
+    XiangshanKmhSoCState soc;
+} XiangshanKmhState;
+
+#define TYPE_XIANGSHAN_KMH_MACHINE MACHINE_TYPE_NAME("xiangshan-kunminghu")
+DECLARE_INSTANCE_CHECKER(XiangshanKmhState, XIANGSHAN_KMH_MACHINE,
+                         TYPE_XIANGSHAN_KMH_MACHINE)
+
+enum {
+    XIANGSHAN_KMH_ROM,
+    XIANGSHAN_KMH_UART0,
+    XIANGSHAN_KMH_CLINT,
+    XIANGSHAN_KMH_APLIC_M,
+    XIANGSHAN_KMH_APLIC_S,
+    XIANGSHAN_KMH_IMSIC_M,
+    XIANGSHAN_KMH_IMSIC_S,
+    XIANGSHAN_KMH_DRAM,
+};
+
+enum {
+    XIANGSHAN_KMH_UART0_IRQ = 10,
+};
+
+/* Indicating Timebase-freq (1MHZ) */
+#define XIANGSHAN_KMH_CLINT_TIMEBASE_FREQ 1000000
+
+#define XIANGSHAN_KMH_IMSIC_NUM_IDS 255
+#define XIANGSHAN_KMH_IMSIC_NUM_GUESTS 7
+#define XIANGSHAN_KMH_IMSIC_GUEST_BITS 3
+
+#define XIANGSHAN_KMH_APLIC_NUM_SOURCES 96
+
+#endif

From b5092b3db23391d6ee770123715b76b85169d977 Mon Sep 17 00:00:00 2001
From: Max Chou <max.chou@sifive.com>
Date: Fri, 27 Jun 2025 21:30:13 +0800
Subject: [PATCH 1895/2760] target/riscv: rvv: Fix missing exit TB flow for
 ldff_trans

According to the V spec, the vector fault-only-first load instructions
may change the VL CSR.
So the ldff_trans TCG translation function should generate the
lookup_and_goto_ptr flow as the vsetvl/vsetvli translation function to
make sure the vl_eq_vlmax TB flag is correct.

Signed-off-by: Max Chou <max.chou@sifive.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250627133013.443997-1-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvv.c.inc | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
index 2b6077ac06..4cd030c7eb 100644
--- a/target/riscv/insn_trans/trans_rvv.c.inc
+++ b/target/riscv/insn_trans/trans_rvv.c.inc
@@ -1361,6 +1361,12 @@ static bool ldff_trans(uint32_t vd, uint32_t rs1, uint32_t data,
     fn(dest, mask, base, tcg_env, desc);
 
     finalize_rvv_inst(s);
+
+    /* vector unit-stride fault-only-first load may modify vl CSR */
+    gen_update_pc(s, s->cur_insn_len);
+    lookup_and_goto_ptr(s);
+    s->base.is_jmp = DISAS_NORETURN;
+
     return true;
 }
 

From bc2200134c1229a83bbcd8e75ab541ca110609f6 Mon Sep 17 00:00:00 2001
From: "liu.xuemei1@zte.com.cn" <liu.xuemei1@zte.com.cn>
Date: Mon, 16 Jun 2025 15:00:34 +0800
Subject: [PATCH 1896/2760] migration: Fix migration failure when aia is
 configured as aplic-imsic

Address an error in migration when aia is configured as 'aplic-imsic' in
riscv kvm vm by adding riscv_aplic_state_needed() and
riscv_imsic_state_needed() to determine whether the corresponding sates are
needed.

Previously, the fields in the vmsds of 'riscv_aplic' and 'riscv_imsic' can
only be initialized under certain special conditions in commit 95a97b3fd2.
However, the corresponding ses of these vmsds are inserted into the
savevm_state.handlers unconditionally. This led to migration failure
characterized by uninitialized fields when save vm state:
qemu-system-riscv64: ../migration/vmstate.c:433: vmstate_save_state_v:
Assertion 'first_elem || !n_elems || !size' failed.

Fixes: 95a97b3fd2 ("target/riscv: update APLIC and IMSIC to support KVM AIA")

Signed-off-by: Xuemei Liu <liu.xuemei1@zte.com.cn>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250616150034827wuHs_ffe3Qm8cqFXT7HeW@zte.com.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/intc/riscv_aplic.c | 12 ++++++++++--
 hw/intc/riscv_imsic.c | 10 ++++++++--
 2 files changed, 18 insertions(+), 4 deletions(-)

diff --git a/hw/intc/riscv_aplic.c b/hw/intc/riscv_aplic.c
index 8bcd9f4697..4fa5f7597b 100644
--- a/hw/intc/riscv_aplic.c
+++ b/hw/intc/riscv_aplic.c
@@ -962,10 +962,18 @@ static const Property riscv_aplic_properties[] = {
     DEFINE_PROP_BOOL("mmode", RISCVAPLICState, mmode, 0),
 };
 
+static bool riscv_aplic_state_needed(void *opaque)
+{
+    RISCVAPLICState *aplic = opaque;
+
+    return riscv_use_emulated_aplic(aplic->msimode);
+}
+
 static const VMStateDescription vmstate_riscv_aplic = {
     .name = "riscv_aplic",
-    .version_id = 2,
-    .minimum_version_id = 2,
+    .version_id = 3,
+    .minimum_version_id = 3,
+    .needed = riscv_aplic_state_needed,
     .fields = (const VMStateField[]) {
             VMSTATE_UINT32(domaincfg, RISCVAPLICState),
             VMSTATE_UINT32(mmsicfgaddr, RISCVAPLICState),
diff --git a/hw/intc/riscv_imsic.c b/hw/intc/riscv_imsic.c
index 2169988167..6174e1a05d 100644
--- a/hw/intc/riscv_imsic.c
+++ b/hw/intc/riscv_imsic.c
@@ -398,10 +398,16 @@ static const Property riscv_imsic_properties[] = {
     DEFINE_PROP_UINT32("num-irqs", RISCVIMSICState, num_irqs, 0),
 };
 
+static bool riscv_imsic_state_needed(void *opaque)
+{
+    return !kvm_irqchip_in_kernel();
+}
+
 static const VMStateDescription vmstate_riscv_imsic = {
     .name = "riscv_imsic",
-    .version_id = 1,
-    .minimum_version_id = 1,
+    .version_id = 2,
+    .minimum_version_id = 2,
+    .needed = riscv_imsic_state_needed,
     .fields = (const VMStateField[]) {
             VMSTATE_VARRAY_UINT32(eidelivery, RISCVIMSICState,
                                   num_pages, 0,

From b3452452e64be647fef98d2dce16c3f5c149235a Mon Sep 17 00:00:00 2001
From: Charalampos Mitrodimas <charmitro@posteo.net>
Date: Thu, 3 Jul 2025 18:21:43 +0000
Subject: [PATCH 1897/2760] target/riscv: Fix MEPC/SEPC bit masking for IALIGN

According to the RISC-V Privileged Architecture specification, the low
bit of MEPC/SEPC must always be zero. When IALIGN=32, the two low bits
must be zero.

This commit fixes the behavior of MEPC/SEPC CSR reads and writes, and
the implicit reads by MRET/SRET instructions to properly mask the
lowest bit(s) based on whether the C extension is enabled:
- When C extension is enabled (IALIGN=16): mask bit 0
- When C extension is disabled (IALIGN=32): mask bits [1:0]

Previously, when vectored mode bits from STVEC (which sets bit 0 for
vectored mode) were written to MEPC, the bits would not be cleared
correctly, causing incorrect behavior on MRET.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2855
Signed-off-by: Charalampos Mitrodimas <charmitro@posteo.net>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20250703182157.281320-2-charmitro@posteo.net>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c       |  8 ++++----
 target/riscv/internals.h | 11 +++++++++++
 target/riscv/op_helper.c |  4 ++--
 3 files changed, 17 insertions(+), 6 deletions(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index 6296ecd1e1..8631be97c5 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -3129,14 +3129,14 @@ static RISCVException write_mscratch(CPURISCVState *env, int csrno,
 static RISCVException read_mepc(CPURISCVState *env, int csrno,
                                 target_ulong *val)
 {
-    *val = env->mepc;
+    *val = env->mepc & get_xepc_mask(env);
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_mepc(CPURISCVState *env, int csrno,
                                  target_ulong val, uintptr_t ra)
 {
-    env->mepc = val;
+    env->mepc = val & get_xepc_mask(env);
     return RISCV_EXCP_NONE;
 }
 
@@ -4169,14 +4169,14 @@ static RISCVException write_sscratch(CPURISCVState *env, int csrno,
 static RISCVException read_sepc(CPURISCVState *env, int csrno,
                                 target_ulong *val)
 {
-    *val = env->sepc;
+    *val = env->sepc & get_xepc_mask(env);
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_sepc(CPURISCVState *env, int csrno,
                                  target_ulong val, uintptr_t ra)
 {
-    env->sepc = val;
+    env->sepc = val & get_xepc_mask(env);
     return RISCV_EXCP_NONE;
 }
 
diff --git a/target/riscv/internals.h b/target/riscv/internals.h
index 9686bb6208..172296f12e 100644
--- a/target/riscv/internals.h
+++ b/target/riscv/internals.h
@@ -158,6 +158,17 @@ static inline float16 check_nanbox_bf16(CPURISCVState *env, uint64_t f)
     }
 }
 
+static inline target_ulong get_xepc_mask(CPURISCVState *env)
+{
+    /* When IALIGN=32, both low bits must be zero.
+     * When IALIGN=16 (has C extension), only bit 0 must be zero. */
+    if (riscv_has_ext(env, RVC)) {
+        return ~(target_ulong)1;
+    } else {
+        return ~(target_ulong)3;
+    }
+}
+
 #ifndef CONFIG_USER_ONLY
 /* Our implementation of SysemuCPUOps::has_work */
 bool riscv_cpu_has_work(CPUState *cs);
diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
index 557807ba4b..15460bf84b 100644
--- a/target/riscv/op_helper.c
+++ b/target/riscv/op_helper.c
@@ -280,7 +280,7 @@ target_ulong helper_sret(CPURISCVState *env)
         riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC());
     }
 
-    target_ulong retpc = env->sepc;
+    target_ulong retpc = env->sepc & get_xepc_mask(env);
     if (!riscv_cpu_allow_16bit_insn(&env_archcpu(env)->cfg,
                                     env->priv_ver,
                                     env->misa_ext) && (retpc & 0x3)) {
@@ -391,7 +391,7 @@ static target_ulong ssdbltrp_mxret(CPURISCVState *env, target_ulong mstatus,
 
 target_ulong helper_mret(CPURISCVState *env)
 {
-    target_ulong retpc = env->mepc;
+    target_ulong retpc = env->mepc & get_xepc_mask(env);
     uint64_t mstatus = env->mstatus;
     target_ulong prev_priv = get_field(mstatus, MSTATUS_MPP);
 

From a1f44e0c59081afceb5e2b389b6de96602f73977 Mon Sep 17 00:00:00 2001
From: Charalampos Mitrodimas <charmitro@posteo.net>
Date: Thu, 3 Jul 2025 18:21:44 +0000
Subject: [PATCH 1898/2760] tests/tcg/riscv64: Add test for MEPC bit masking

Add a regression test to verify that MEPC properly masks the lower
bits when an address with mode bits is written to it, as required by
the RISC-V Privileged Architecture specification.

The test sets STVEC to an address with bit 0 set (vectored mode),
triggers an illegal instruction exception, copies STVEC to MEPC in the
trap handler, and verifies that MEPC masks bits [1:0] correctly for
IALIGN=32.

Without the fix, MEPC retains the mode bits (returns non-zero/FAIL).
With the fix, MEPC clears bits [1:0] (returns 0/PASS).

Signed-off-by: Charalampos Mitrodimas <charmitro@posteo.net>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20250703182157.281320-3-charmitro@posteo.net>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 tests/tcg/riscv64/Makefile.softmmu-target |  4 ++
 tests/tcg/riscv64/test-mepc-masking.S     | 73 +++++++++++++++++++++++
 2 files changed, 77 insertions(+)
 create mode 100644 tests/tcg/riscv64/test-mepc-masking.S

diff --git a/tests/tcg/riscv64/Makefile.softmmu-target b/tests/tcg/riscv64/Makefile.softmmu-target
index 7c1d44d3f4..3ca595335d 100644
--- a/tests/tcg/riscv64/Makefile.softmmu-target
+++ b/tests/tcg/riscv64/Makefile.softmmu-target
@@ -20,5 +20,9 @@ EXTRA_RUNS += run-issue1060
 run-issue1060: issue1060
 	$(call run-test, $<, $(QEMU) $(QEMU_OPTS)$<)
 
+EXTRA_RUNS += run-test-mepc-masking
+run-test-mepc-masking: test-mepc-masking
+	$(call run-test, $<, $(QEMU) $(QEMU_OPTS)$<)
+
 # We don't currently support the multiarch system tests
 undefine MULTIARCH_TESTS
diff --git a/tests/tcg/riscv64/test-mepc-masking.S b/tests/tcg/riscv64/test-mepc-masking.S
new file mode 100644
index 0000000000..fccd2a7ac4
--- /dev/null
+++ b/tests/tcg/riscv64/test-mepc-masking.S
@@ -0,0 +1,73 @@
+/*
+ * Test for MEPC masking bug fix
+ *
+ * This test verifies that MEPC properly masks the lower bits according
+ * to the RISC-V specification when vectored mode bits from STVEC are
+ * written to MEPC.
+ */
+
+	.option	norvc
+
+	.text
+	.global _start
+_start:
+	/* Set up machine trap vector */
+	lla	t0, machine_trap_handler
+	csrw	mtvec, t0
+
+	/* Set STVEC with vectored mode (mode bits = 01) */
+	li	t0, 0x80004001
+	csrw	stvec, t0
+
+	/* Clear medeleg to handle exceptions in M-mode */
+	csrw	medeleg, zero
+
+	/* Trigger illegal instruction exception */
+	.word	0xffffffff
+
+test_completed:
+	/* Exit with result in a0 */
+	/* a0 = 0: success (bits [1:0] were masked) */
+	/* a0 != 0: failure (some bits were not masked) */
+	j	_exit
+
+machine_trap_handler:
+	/* Check if illegal instruction (mcause = 2) */
+	csrr	t0, mcause
+	li	t1, 2
+	bne	t0, t1, skip_test
+
+	/* Test: Copy STVEC (with mode bits) to MEPC */
+	csrr	t0, stvec	/* t0 = 0x80004001 */
+	csrw	mepc, t0	/* Write to MEPC */
+	csrr	t1, mepc	/* Read back MEPC */
+
+	/* Check if bits [1:0] are masked (IALIGN=32 without RVC) */
+	andi	a0, t1, 3	/* a0 = 0 if both bits masked correctly */
+
+	/* Set correct return address */
+	lla	t0, test_completed
+	csrw	mepc, t0
+
+skip_test:
+	mret
+
+/* Exit with semihosting */
+_exit:
+	lla	a1, semiargs
+	li	t0, 0x20026	/* ADP_Stopped_ApplicationExit */
+	sd	t0, 0(a1)
+	sd	a0, 8(a1)
+	li	a0, 0x20	/* TARGET_SYS_EXIT_EXTENDED */
+
+	/* Semihosting call sequence */
+	.balign	16
+	slli	zero, zero, 0x1f
+	ebreak
+	srai	zero, zero, 0x7
+	j	.
+
+	.data
+	.balign	8
+semiargs:
+	.space	16

From 5625817e8b77715b18d0ce3bfcc59fb337e387d8 Mon Sep 17 00:00:00 2001
From: Vasilis Liaskovitis <vliaskovitis@suse.com>
Date: Wed, 18 Jun 2025 23:35:42 +0200
Subject: [PATCH 1899/2760] target/riscv: Add a property to set vill bit on
 reserved usage of vsetvli instruction

Usage of vsetvli instruction is reserved if VLMAX is changed when vsetvli rs1
and rd arguments are x0.

In this case, if the new property is true, only the vill bit will be set.

See https://github.com/riscv/riscv-isa-manual/blob/main/src/v-st-ext.adoc#avl-encoding
According to the spec, the above use cases are reserved, and
"Implementations may set vill in either case."

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2422
Signed-off-by: Vasilis Liaskovitis <vliaskovitis@suse.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20250618213542.22873-1-vliaskovitis@suse.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c                      |  1 +
 target/riscv/cpu_cfg_fields.h.inc       |  1 +
 target/riscv/helper.h                   |  2 +-
 target/riscv/insn_trans/trans_rvv.c.inc |  4 ++--
 target/riscv/vector_helper.c            | 12 +++++++++++-
 5 files changed, 16 insertions(+), 4 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index e3f8ecef68..6f1d0618f1 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -2632,6 +2632,7 @@ static const Property riscv_cpu_properties[] = {
     DEFINE_PROP_BOOL("rvv_ta_all_1s", RISCVCPU, cfg.rvv_ta_all_1s, false),
     DEFINE_PROP_BOOL("rvv_ma_all_1s", RISCVCPU, cfg.rvv_ma_all_1s, false),
     DEFINE_PROP_BOOL("rvv_vl_half_avl", RISCVCPU, cfg.rvv_vl_half_avl, false),
+    DEFINE_PROP_BOOL("rvv_vsetvl_x0_vill", RISCVCPU, cfg.rvv_vsetvl_x0_vill, false),
 
     /*
      * write_misa() is marked as experimental for now so mark
diff --git a/target/riscv/cpu_cfg_fields.h.inc b/target/riscv/cpu_cfg_fields.h.inc
index 33c4f9bac8..98ceb7b340 100644
--- a/target/riscv/cpu_cfg_fields.h.inc
+++ b/target/riscv/cpu_cfg_fields.h.inc
@@ -114,6 +114,7 @@ BOOL_FIELD(ext_supm)
 BOOL_FIELD(rvv_ta_all_1s)
 BOOL_FIELD(rvv_ma_all_1s)
 BOOL_FIELD(rvv_vl_half_avl)
+BOOL_FIELD(rvv_vsetvl_x0_vill)
 /* Named features  */
 BOOL_FIELD(ext_svade)
 BOOL_FIELD(ext_zic64b)
diff --git a/target/riscv/helper.h b/target/riscv/helper.h
index 85d73e492d..f712b1c368 100644
--- a/target/riscv/helper.h
+++ b/target/riscv/helper.h
@@ -159,7 +159,7 @@ DEF_HELPER_FLAGS_3(hyp_hsv_d, TCG_CALL_NO_WG, void, env, tl, tl)
 #endif
 
 /* Vector functions */
-DEF_HELPER_3(vsetvl, tl, env, tl, tl)
+DEF_HELPER_4(vsetvl, tl, env, tl, tl, tl)
 DEF_HELPER_5(vle8_v, void, ptr, ptr, tl, env, i32)
 DEF_HELPER_5(vle16_v, void, ptr, ptr, tl, env, i32)
 DEF_HELPER_5(vle32_v, void, ptr, ptr, tl, env, i32)
diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
index 4cd030c7eb..610bf9ff30 100644
--- a/target/riscv/insn_trans/trans_rvv.c.inc
+++ b/target/riscv/insn_trans/trans_rvv.c.inc
@@ -202,7 +202,7 @@ static bool do_vsetvl(DisasContext *s, int rd, int rs1, TCGv s2)
         s1 = get_gpr(s, rs1, EXT_ZERO);
     }
 
-    gen_helper_vsetvl(dst, tcg_env, s1, s2);
+    gen_helper_vsetvl(dst, tcg_env, s1, s2, tcg_constant_tl((int) (rd == 0 && rs1 == 0)));
     gen_set_gpr(s, rd, dst);
     finalize_rvv_inst(s);
 
@@ -222,7 +222,7 @@ static bool do_vsetivli(DisasContext *s, int rd, TCGv s1, TCGv s2)
 
     dst = dest_gpr(s, rd);
 
-    gen_helper_vsetvl(dst, tcg_env, s1, s2);
+    gen_helper_vsetvl(dst, tcg_env, s1, s2, tcg_constant_tl(0));
     gen_set_gpr(s, rd, dst);
     finalize_rvv_inst(s);
     gen_update_pc(s, s->cur_insn_len);
diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
index 5dc1c10012..b41c29da0b 100644
--- a/target/riscv/vector_helper.c
+++ b/target/riscv/vector_helper.c
@@ -35,7 +35,7 @@
 #include <math.h>
 
 target_ulong HELPER(vsetvl)(CPURISCVState *env, target_ulong s1,
-                            target_ulong s2)
+                            target_ulong s2, target_ulong x0)
 {
     int vlmax, vl;
     RISCVCPU *cpu = env_archcpu(env);
@@ -83,6 +83,16 @@ target_ulong HELPER(vsetvl)(CPURISCVState *env, target_ulong s1,
     } else {
         vl = vlmax;
     }
+
+    if (cpu->cfg.rvv_vsetvl_x0_vill && x0 && (env->vl != vl)) {
+        /* only set vill bit. */
+        env->vill = 1;
+        env->vtype = 0;
+        env->vl = 0;
+        env->vstart = 0;
+        return 0;
+    }
+
     env->vl = vl;
     env->vtype = s2;
     env->vstart = 0;

From dc8bffc4eb0a93d3266cea1b17f8848dea5b915c Mon Sep 17 00:00:00 2001
From: Alexandre Ghiti <alexghiti@rivosinc.com>
Date: Wed, 2 Jul 2025 07:28:52 +0000
Subject: [PATCH 1900/2760] target: riscv: Add Svrsw60t59b extension support

The Svrsw60t59b extension allows to free the PTE reserved bits 60 and 59
for software to use.

Reviewed-by: Deepak Gupta <debug@rivosinc.com>
Signed-off-by: Alexandre Ghiti <alexghiti@rivosinc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Nutty Liu<liujingqi@lanxincomputing.com>
Message-ID: <20250702-dev-alex-svrsw60b59b_v2-v2-1-504ddf0f8530@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/riscv-iommu-bits.h       | 1 +
 hw/riscv/riscv-iommu.c            | 3 ++-
 target/riscv/cpu.c                | 2 ++
 target/riscv/cpu_bits.h           | 3 ++-
 target/riscv/cpu_cfg_fields.h.inc | 1 +
 target/riscv/cpu_helper.c         | 3 ++-
 target/riscv/tcg/tcg-cpu.c        | 8 ++++++++
 7 files changed, 18 insertions(+), 3 deletions(-)

diff --git a/hw/riscv/riscv-iommu-bits.h b/hw/riscv/riscv-iommu-bits.h
index 1017d73fc6..47fe01bee5 100644
--- a/hw/riscv/riscv-iommu-bits.h
+++ b/hw/riscv/riscv-iommu-bits.h
@@ -79,6 +79,7 @@ struct riscv_iommu_pq_record {
 #define RISCV_IOMMU_CAP_SV39            BIT_ULL(9)
 #define RISCV_IOMMU_CAP_SV48            BIT_ULL(10)
 #define RISCV_IOMMU_CAP_SV57            BIT_ULL(11)
+#define RISCV_IOMMU_CAP_SVRSW60T59B     BIT_ULL(14)
 #define RISCV_IOMMU_CAP_SV32X4          BIT_ULL(16)
 #define RISCV_IOMMU_CAP_SV39X4          BIT_ULL(17)
 #define RISCV_IOMMU_CAP_SV48X4          BIT_ULL(18)
diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c
index d8b1cb03a8..96a7fbdefc 100644
--- a/hw/riscv/riscv-iommu.c
+++ b/hw/riscv/riscv-iommu.c
@@ -2351,7 +2351,8 @@ static void riscv_iommu_realize(DeviceState *dev, Error **errp)
     }
     if (s->enable_g_stage) {
         s->cap |= RISCV_IOMMU_CAP_SV32X4 | RISCV_IOMMU_CAP_SV39X4 |
-                  RISCV_IOMMU_CAP_SV48X4 | RISCV_IOMMU_CAP_SV57X4;
+                  RISCV_IOMMU_CAP_SV48X4 | RISCV_IOMMU_CAP_SV57X4 |
+                  RISCV_IOMMU_CAP_SVRSW60T59B;
     }
 
     if (s->hpm_cntrs > 0) {
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 6f1d0618f1..d055ddf462 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -230,6 +230,7 @@ const RISCVIsaExtData isa_edata_arr[] = {
     ISA_EXT_DATA_ENTRY(svinval, PRIV_VERSION_1_12_0, ext_svinval),
     ISA_EXT_DATA_ENTRY(svnapot, PRIV_VERSION_1_12_0, ext_svnapot),
     ISA_EXT_DATA_ENTRY(svpbmt, PRIV_VERSION_1_12_0, ext_svpbmt),
+    ISA_EXT_DATA_ENTRY(svrsw60t59b, PRIV_VERSION_1_13_0, ext_svrsw60t59b),
     ISA_EXT_DATA_ENTRY(svukte, PRIV_VERSION_1_13_0, ext_svukte),
     ISA_EXT_DATA_ENTRY(svvptc, PRIV_VERSION_1_13_0, ext_svvptc),
     ISA_EXT_DATA_ENTRY(xtheadba, PRIV_VERSION_1_11_0, ext_xtheadba),
@@ -1285,6 +1286,7 @@ const RISCVCPUMultiExtConfig riscv_cpu_extensions[] = {
     MULTI_EXT_CFG_BOOL("svinval", ext_svinval, false),
     MULTI_EXT_CFG_BOOL("svnapot", ext_svnapot, false),
     MULTI_EXT_CFG_BOOL("svpbmt", ext_svpbmt, false),
+    MULTI_EXT_CFG_BOOL("svrsw60t59b", ext_svrsw60t59b, false),
     MULTI_EXT_CFG_BOOL("svvptc", ext_svvptc, true),
 
     MULTI_EXT_CFG_BOOL("zicntr", ext_zicntr, true),
diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
index e6b3e28386..b62dd82fe7 100644
--- a/target/riscv/cpu_bits.h
+++ b/target/riscv/cpu_bits.h
@@ -735,7 +735,8 @@ typedef enum {
 #define PTE_SOFT            0x300 /* Reserved for Software */
 #define PTE_PBMT            0x6000000000000000ULL /* Page-based memory types */
 #define PTE_N               0x8000000000000000ULL /* NAPOT translation */
-#define PTE_RESERVED        0x1FC0000000000000ULL /* Reserved bits */
+#define PTE_RESERVED(svrsw60t59b)    \
+    (svrsw60t59b ? 0x07C0000000000000ULL : 0x1FC0000000000000ULL) /* Reserved bits */
 #define PTE_ATTR            (PTE_N | PTE_PBMT) /* All attributes bits */
 
 /* Page table PPN shift amount */
diff --git a/target/riscv/cpu_cfg_fields.h.inc b/target/riscv/cpu_cfg_fields.h.inc
index 98ceb7b340..e2d116f0df 100644
--- a/target/riscv/cpu_cfg_fields.h.inc
+++ b/target/riscv/cpu_cfg_fields.h.inc
@@ -57,6 +57,7 @@ BOOL_FIELD(ext_svadu)
 BOOL_FIELD(ext_svinval)
 BOOL_FIELD(ext_svnapot)
 BOOL_FIELD(ext_svpbmt)
+BOOL_FIELD(ext_svrsw60t59b)
 BOOL_FIELD(ext_svvptc)
 BOOL_FIELD(ext_svukte)
 BOOL_FIELD(ext_zdinx)
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index 2ed69d7c2d..3479a62cc7 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -1309,6 +1309,7 @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
     bool svade = riscv_cpu_cfg(env)->ext_svade;
     bool svadu = riscv_cpu_cfg(env)->ext_svadu;
     bool adue = svadu ? env->menvcfg & MENVCFG_ADUE : !svade;
+    bool svrsw60t59b = riscv_cpu_cfg(env)->ext_svrsw60t59b;
 
     if (first_stage && two_stage && env->virt_enabled) {
         pbmte = pbmte && (env->henvcfg & HENVCFG_PBMTE);
@@ -1376,7 +1377,7 @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
         if (riscv_cpu_sxl(env) == MXL_RV32) {
             ppn = pte >> PTE_PPN_SHIFT;
         } else {
-            if (pte & PTE_RESERVED) {
+            if (pte & PTE_RESERVED(svrsw60t59b)) {
                 qemu_log_mask(LOG_GUEST_ERROR, "%s: reserved bits set in PTE: "
                               "addr: 0x%" HWADDR_PRIx " pte: 0x" TARGET_FMT_lx "\n",
                               __func__, pte_addr, pte);
diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index 163e7ce364..78fb279184 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -839,6 +839,12 @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
         cpu->cfg.ext_ssctr = false;
     }
 
+    if (cpu->cfg.ext_svrsw60t59b &&
+        (!cpu->cfg.mmu || mcc->def->misa_mxl_max == MXL_RV32)) {
+        error_setg(errp, "svrsw60t59b is not supported on RV32 and MMU-less platforms");
+        return;
+    }
+
     /*
      * Disable isa extensions based on priv spec after we
      * validated and set everything we need.
@@ -1588,6 +1594,8 @@ static void riscv_init_max_cpu_extensions(Object *obj)
 
     if (env->misa_mxl != MXL_RV32) {
         isa_ext_update_enabled(cpu, CPU_CFG_OFFSET(ext_zcf), false);
+    } else {
+        isa_ext_update_enabled(cpu, CPU_CFG_OFFSET(ext_svrsw60t59b), false);
     }
 
     /*

From 9526b9b620c78a1336bca1b55a562fad23208392 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Wed, 2 Jul 2025 13:30:51 +0200
Subject: [PATCH 1901/2760] hw/arm/highbank: Mark the "highbank" and the
 "midway" machine as deprecated

We don't have any automatic regression tests for these machines and
when asking the usual suspects on the mailing list we came to the
conclusion that nobody tests these machines manually, too, so it seems
like this is currently just completely unused code. Mark them as depre-
cated to see whether anybody still speaks up during the deprecation
period, otherwise we can likely remove these two machines in a couple
of releases.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Acked-by: Rob Herring <robh@kernel.org>
Acked-by: Guenter Roeck <linux@roeck-us.net>
Message-id: 20250702113051.46483-1-thuth@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: tweaked deprecation.rst text]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/about/deprecated.rst | 7 +++++++
 hw/arm/highbank.c         | 2 ++
 2 files changed, 9 insertions(+)

diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst
index 42037131de..b24c278f70 100644
--- a/docs/about/deprecated.rst
+++ b/docs/about/deprecated.rst
@@ -344,6 +344,13 @@ they want to use and avoids confusion.  Existing users of the ``spike``
 machine must ensure that they're setting the ``spike`` machine in the
 command line (``-M spike``).
 
+Arm ``highbank`` and ``midway`` machines (since 10.1)
+'''''''''''''''''''''''''''''''''''''''''''''''''''''
+
+There are no known users left for these machines (if you still use it,
+please write a mail to the qemu-devel mailing list). If you just want to
+boot a Cortex-A15 or Cortex-A9 Linux, use the ``virt`` machine instead.
+
 
 System emulator binaries
 ------------------------
diff --git a/hw/arm/highbank.c b/hw/arm/highbank.c
index 3ae26ebebd..165c0b741a 100644
--- a/hw/arm/highbank.c
+++ b/hw/arm/highbank.c
@@ -357,6 +357,7 @@ static void highbank_class_init(ObjectClass *oc, const void *data)
     mc->max_cpus = 4;
     mc->ignore_memory_transaction_failures = true;
     mc->default_ram_id = "highbank.dram";
+    mc->deprecation_reason = "no known users left for this machine";
 }
 
 static const TypeInfo highbank_type = {
@@ -381,6 +382,7 @@ static void midway_class_init(ObjectClass *oc, const void *data)
     mc->max_cpus = 4;
     mc->ignore_memory_transaction_failures = true;
     mc->default_ram_id = "highbank.dram";
+    mc->deprecation_reason = "no known users left for this machine";
 }
 
 static const TypeInfo midway_type = {

From 597ae563ba2a46174a414a3d223db4aac9a76cd3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 16 Jun 2025 14:15:52 +0200
Subject: [PATCH 1902/2760] accel/kvm: Remove kvm_init_cpu_signals() stub
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since commit 57038a92bb0 ("cpus: extract out kvm-specific code
to accel/kvm") the kvm_init_cpu_signals() stub is not necessary.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Message-Id: <20250703173248.44995-6-philmd@linaro.org>
---
 accel/stubs/kvm-stub.c | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/accel/stubs/kvm-stub.c b/accel/stubs/kvm-stub.c
index ecfd7636f5..b9b4427c91 100644
--- a/accel/stubs/kvm-stub.c
+++ b/accel/stubs/kvm-stub.c
@@ -105,11 +105,6 @@ unsigned int kvm_get_free_memslots(void)
     return 0;
 }
 
-void kvm_init_cpu_signals(CPUState *cpu)
-{
-    abort();
-}
-
 bool kvm_arm_supports_user_irq(void)
 {
     return false;

From af065855ced71fdad6fc0fecec7dd65593b73413 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 17 Jun 2025 07:02:17 +0200
Subject: [PATCH 1903/2760] accel/kvm: Reduce kvm_create_vcpu() declaration
 scope
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

kvm_create_vcpu() is only used within the same file unit.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Message-Id: <20250703173248.44995-7-philmd@linaro.org>
---
 accel/kvm/kvm-all.c  | 8 +++++++-
 include/system/kvm.h | 8 --------
 2 files changed, 7 insertions(+), 9 deletions(-)

diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index d095d1b98f..17235f2646 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -453,7 +453,13 @@ static void kvm_reset_parked_vcpus(KVMState *s)
     }
 }
 
-int kvm_create_vcpu(CPUState *cpu)
+/**
+ * kvm_create_vcpu - Gets a parked KVM vCPU or creates a KVM vCPU
+ * @cpu: QOM CPUState object for which KVM vCPU has to be fetched/created.
+ *
+ * @returns: 0 when success, errno (<0) when failed.
+ */
+static int kvm_create_vcpu(CPUState *cpu)
 {
     unsigned long vcpu_id = kvm_arch_vcpu_id(cpu);
     KVMState *s = kvm_state;
diff --git a/include/system/kvm.h b/include/system/kvm.h
index 7cc60d26f2..e943df2c09 100644
--- a/include/system/kvm.h
+++ b/include/system/kvm.h
@@ -316,14 +316,6 @@ int kvm_create_device(KVMState *s, uint64_t type, bool test);
  */
 bool kvm_device_supported(int vmfd, uint64_t type);
 
-/**
- * kvm_create_vcpu - Gets a parked KVM vCPU or creates a KVM vCPU
- * @cpu: QOM CPUState object for which KVM vCPU has to be fetched/created.
- *
- * @returns: 0 when success, errno (<0) when failed.
- */
-int kvm_create_vcpu(CPUState *cpu);
-
 /**
  * kvm_park_vcpu - Park QEMU KVM vCPU context
  * @cpu: QOM CPUState object for which QEMU KVM vCPU context has to be parked.

From 7359f690095bea8466bef2b7b822bb4d2962dbb4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 3 Jul 2025 11:42:43 +0200
Subject: [PATCH 1904/2760] accel/tcg: Remove 'info opcount' and
 @x-query-opcount
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since commit 1b65b4f54c7 ("accel/tcg: remove CONFIG_PROFILER",
released with QEMU v8.1.0) we get pointless output:

  (qemu) info opcount
  [TCG profiler not compiled]

Remove that unstable and unuseful command.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Acked-by: Dr. David Alan Gilbert <dave@treblig.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Message-Id: <20250703173248.44995-8-philmd@linaro.org>
---
 accel/tcg/monitor.c        | 21 ---------------------
 hmp-commands-info.hx       | 14 --------------
 qapi/machine.json          | 18 ------------------
 tests/qtest/qmp-cmd-test.c |  1 -
 4 files changed, 54 deletions(-)

diff --git a/accel/tcg/monitor.c b/accel/tcg/monitor.c
index 1c182b6bfb..7c686226b2 100644
--- a/accel/tcg/monitor.c
+++ b/accel/tcg/monitor.c
@@ -215,30 +215,9 @@ HumanReadableText *qmp_x_query_jit(Error **errp)
     return human_readable_text_from_str(buf);
 }
 
-static void tcg_dump_op_count(GString *buf)
-{
-    g_string_append_printf(buf, "[TCG profiler not compiled]\n");
-}
-
-HumanReadableText *qmp_x_query_opcount(Error **errp)
-{
-    g_autoptr(GString) buf = g_string_new("");
-
-    if (!tcg_enabled()) {
-        error_setg(errp,
-                   "Opcode count information is only available with accel=tcg");
-        return NULL;
-    }
-
-    tcg_dump_op_count(buf);
-
-    return human_readable_text_from_str(buf);
-}
-
 static void hmp_tcg_register(void)
 {
     monitor_register_hmp_info_hrt("jit", qmp_x_query_jit);
-    monitor_register_hmp_info_hrt("opcount", qmp_x_query_opcount);
 }
 
 type_init(hmp_tcg_register);
diff --git a/hmp-commands-info.hx b/hmp-commands-info.hx
index 639a450ee5..d797922275 100644
--- a/hmp-commands-info.hx
+++ b/hmp-commands-info.hx
@@ -256,20 +256,6 @@ SRST
     Show dynamic compiler info.
 ERST
 
-#if defined(CONFIG_TCG)
-    {
-        .name       = "opcount",
-        .args_type  = "",
-        .params     = "",
-        .help       = "show dynamic compiler opcode counters",
-    },
-#endif
-
-SRST
-  ``info opcount``
-    Show dynamic compiler opcode counters
-ERST
-
     {
         .name       = "sync-profile",
         .args_type  = "mean:-m,no_coalesce:-n,max:i?",
diff --git a/qapi/machine.json b/qapi/machine.json
index 0650b8de71..f712e7da6d 100644
--- a/qapi/machine.json
+++ b/qapi/machine.json
@@ -1761,24 +1761,6 @@
   'returns': 'HumanReadableText',
   'features': [ 'unstable' ] }
 
-##
-# @x-query-opcount:
-#
-# Query TCG opcode counters
-#
-# Features:
-#
-# @unstable: This command is meant for debugging.
-#
-# Returns: TCG opcode counters
-#
-# Since: 6.2
-##
-{ 'command': 'x-query-opcount',
-  'returns': 'HumanReadableText',
-  'if': 'CONFIG_TCG',
-  'features': [ 'unstable' ] }
-
 ##
 # @x-query-ramblock:
 #
diff --git a/tests/qtest/qmp-cmd-test.c b/tests/qtest/qmp-cmd-test.c
index 040d042810..cf71876186 100644
--- a/tests/qtest/qmp-cmd-test.c
+++ b/tests/qtest/qmp-cmd-test.c
@@ -51,7 +51,6 @@ static int query_error_class(const char *cmd)
         { "x-query-usb", ERROR_CLASS_GENERIC_ERROR },
         /* Only valid with accel=tcg */
         { "x-query-jit", ERROR_CLASS_GENERIC_ERROR },
-        { "x-query-opcount", ERROR_CLASS_GENERIC_ERROR },
         { "xen-event-list", ERROR_CLASS_GENERIC_ERROR },
         { NULL, -1 }
     };

From 93d7064e594f442235d7d9442005f4404a7a5004 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 3 Jul 2025 11:42:17 +0200
Subject: [PATCH 1905/2760] accel/tcg: Remove profiler leftover
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

TCG profiler was removed in commit 1b65b4f54c7.

Fixes: 1b65b4f54c7 ("accel/tcg: remove CONFIG_PROFILER")
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Message-Id: <20250703173248.44995-9-philmd@linaro.org>
---
 accel/tcg/monitor.c | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/accel/tcg/monitor.c b/accel/tcg/monitor.c
index 7c686226b2..344ec50047 100644
--- a/accel/tcg/monitor.c
+++ b/accel/tcg/monitor.c
@@ -141,11 +141,6 @@ static void tlb_flush_counts(size_t *pfull, size_t *ppart, size_t *pelide)
     *pelide = elide;
 }
 
-static void tcg_dump_info(GString *buf)
-{
-    g_string_append_printf(buf, "[TCG profiler not compiled]\n");
-}
-
 static void dump_exec_info(GString *buf)
 {
     struct tb_tree_stats tst = {};
@@ -196,7 +191,6 @@ static void dump_exec_info(GString *buf)
     g_string_append_printf(buf, "TLB full flushes    %zu\n", flush_full);
     g_string_append_printf(buf, "TLB partial flushes %zu\n", flush_part);
     g_string_append_printf(buf, "TLB elided flushes  %zu\n", flush_elide);
-    tcg_dump_info(buf);
 }
 
 HumanReadableText *qmp_x_query_jit(Error **errp)

From 8becf103741bd1b50b827bc3cd60872e9f36e981 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 17 Jun 2025 11:48:44 +0200
Subject: [PATCH 1906/2760] accel/tcg: Factor tcg_dump_flush_info() out
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Message-Id: <20250703173248.44995-10-philmd@linaro.org>
---
 accel/tcg/monitor.c | 27 +++++++++++++++++----------
 1 file changed, 17 insertions(+), 10 deletions(-)

diff --git a/accel/tcg/monitor.c b/accel/tcg/monitor.c
index 344ec50047..6d9cc11d94 100644
--- a/accel/tcg/monitor.c
+++ b/accel/tcg/monitor.c
@@ -141,11 +141,26 @@ static void tlb_flush_counts(size_t *pfull, size_t *ppart, size_t *pelide)
     *pelide = elide;
 }
 
+static void tcg_dump_flush_info(GString *buf)
+{
+    size_t flush_full, flush_part, flush_elide;
+
+    g_string_append_printf(buf, "TB flush count      %u\n",
+                           qatomic_read(&tb_ctx.tb_flush_count));
+    g_string_append_printf(buf, "TB invalidate count %u\n",
+                           qatomic_read(&tb_ctx.tb_phys_invalidate_count));
+
+    tlb_flush_counts(&flush_full, &flush_part, &flush_elide);
+    g_string_append_printf(buf, "TLB full flushes    %zu\n", flush_full);
+    g_string_append_printf(buf, "TLB partial flushes %zu\n", flush_part);
+    g_string_append_printf(buf, "TLB elided flushes  %zu\n", flush_elide);
+}
+
 static void dump_exec_info(GString *buf)
 {
     struct tb_tree_stats tst = {};
     struct qht_stats hst;
-    size_t nb_tbs, flush_full, flush_part, flush_elide;
+    size_t nb_tbs;
 
     tcg_tb_foreach(tb_tree_stats_iter, &tst);
     nb_tbs = tst.nb_tbs;
@@ -182,15 +197,7 @@ static void dump_exec_info(GString *buf)
     qht_statistics_destroy(&hst);
 
     g_string_append_printf(buf, "\nStatistics:\n");
-    g_string_append_printf(buf, "TB flush count      %u\n",
-                           qatomic_read(&tb_ctx.tb_flush_count));
-    g_string_append_printf(buf, "TB invalidate count %u\n",
-                           qatomic_read(&tb_ctx.tb_phys_invalidate_count));
-
-    tlb_flush_counts(&flush_full, &flush_part, &flush_elide);
-    g_string_append_printf(buf, "TLB full flushes    %zu\n", flush_full);
-    g_string_append_printf(buf, "TLB partial flushes %zu\n", flush_part);
-    g_string_append_printf(buf, "TLB elided flushes  %zu\n", flush_elide);
+    tcg_dump_flush_info(buf);
 }
 
 HumanReadableText *qmp_x_query_jit(Error **errp)

From 3955a104bca098b820a0b57bb411281ae5cac498 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 3 Jul 2025 12:16:27 +0200
Subject: [PATCH 1907/2760] accel/tcg: Factor tcg_dump_stats() out for re-use
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Message-Id: <20250703173248.44995-11-philmd@linaro.org>
---
 accel/tcg/internal-common.h |  2 ++
 accel/tcg/monitor.c         | 11 ++++++++---
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/accel/tcg/internal-common.h b/accel/tcg/internal-common.h
index 1dbc45dd95..77a3a0684a 100644
--- a/accel/tcg/internal-common.h
+++ b/accel/tcg/internal-common.h
@@ -139,4 +139,6 @@ G_NORETURN void cpu_io_recompile(CPUState *cpu, uintptr_t retaddr);
 void tb_phys_invalidate(TranslationBlock *tb, tb_page_addr_t page_addr);
 void tb_set_jmp_target(TranslationBlock *tb, int n, uintptr_t addr);
 
+void tcg_dump_stats(GString *buf);
+
 #endif
diff --git a/accel/tcg/monitor.c b/accel/tcg/monitor.c
index 6d9cc11d94..e7ed7281a4 100644
--- a/accel/tcg/monitor.c
+++ b/accel/tcg/monitor.c
@@ -200,6 +200,13 @@ static void dump_exec_info(GString *buf)
     tcg_dump_flush_info(buf);
 }
 
+void tcg_dump_stats(GString *buf)
+{
+    dump_accel_info(buf);
+    dump_exec_info(buf);
+    dump_drift_info(buf);
+}
+
 HumanReadableText *qmp_x_query_jit(Error **errp)
 {
     g_autoptr(GString) buf = g_string_new("");
@@ -209,9 +216,7 @@ HumanReadableText *qmp_x_query_jit(Error **errp)
         return NULL;
     }
 
-    dump_accel_info(buf);
-    dump_exec_info(buf);
-    dump_drift_info(buf);
+    tcg_dump_stats(buf);
 
     return human_readable_text_from_str(buf);
 }

From 6bb8f2c51b28ce35c83ac4e53bbd85ef37d787c4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 1 Jul 2025 16:13:26 +0200
Subject: [PATCH 1908/2760] accel/tcg: Clear exit_request once in
 tcg_cpu_exec()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250701144017.43487-62-philmd@linaro.org>
---
 accel/tcg/tcg-accel-ops-mttcg.c | 1 -
 accel/tcg/tcg-accel-ops.c       | 3 +++
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/accel/tcg/tcg-accel-ops-mttcg.c b/accel/tcg/tcg-accel-ops-mttcg.c
index dfcee30947..337b993d3d 100644
--- a/accel/tcg/tcg-accel-ops-mttcg.c
+++ b/accel/tcg/tcg-accel-ops-mttcg.c
@@ -113,7 +113,6 @@ static void *mttcg_cpu_thread_fn(void *arg)
             }
         }
 
-        qatomic_set_mb(&cpu->exit_request, 0);
         qemu_wait_io_event(cpu);
     } while (!cpu->unplug || cpu_can_run(cpu));
 
diff --git a/accel/tcg/tcg-accel-ops.c b/accel/tcg/tcg-accel-ops.c
index 6116644d1c..71776bc29c 100644
--- a/accel/tcg/tcg-accel-ops.c
+++ b/accel/tcg/tcg-accel-ops.c
@@ -80,6 +80,9 @@ int tcg_cpu_exec(CPUState *cpu)
     cpu_exec_start(cpu);
     ret = cpu_exec(cpu);
     cpu_exec_end(cpu);
+
+    qatomic_set_mb(&cpu->exit_request, 0);
+
     return ret;
 }
 

From dd0b228552e4b1d3b680ff4e8033a110536fdc4c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 1 Jul 2025 16:04:35 +0200
Subject: [PATCH 1909/2760] accel/tcg: Unregister the RCU before exiting RR
 thread
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Although unreachable, still unregister the RCU before exiting
the thread, as documented in "qemu/rcu.h":

 /*
  * Important !
  *
  * Each thread containing read-side critical sections must be registered
  * with rcu_register_thread() before calling rcu_read_lock().
  * rcu_unregister_thread() should be called before the thread exits.
  */

Unregister the RCU to be on par with what is done for other
accelerators.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Acked-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Message-Id: <20250702185332.43650-66-philmd@linaro.org>
---
 accel/tcg/tcg-accel-ops-rr.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/accel/tcg/tcg-accel-ops-rr.c b/accel/tcg/tcg-accel-ops-rr.c
index 6eec5c9eee..a578698d07 100644
--- a/accel/tcg/tcg-accel-ops-rr.c
+++ b/accel/tcg/tcg-accel-ops-rr.c
@@ -302,6 +302,8 @@ static void *rr_cpu_thread_fn(void *arg)
         rr_deal_with_unplugged_cpus();
     }
 
+    rcu_unregister_thread();
+
     g_assert_not_reached();
 }
 

From 4dc480e7da9c389c069da250a6e9252ee9fa0659 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 30 Jun 2025 11:17:43 +0200
Subject: [PATCH 1910/2760] accel/hvf: Restrict internal declarations
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Common code only needs to know whether HVF is enabled and
the QOM type. Move the rest to "hvf_int.h", removing the
need for COMPILING_PER_TARGET #ifdef'ry.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Message-Id: <20250703173248.44995-15-philmd@linaro.org>
---
 include/system/hvf.h     | 38 --------------------------------------
 include/system/hvf_int.h | 34 ++++++++++++++++++++++++++++++++++
 2 files changed, 34 insertions(+), 38 deletions(-)

diff --git a/include/system/hvf.h b/include/system/hvf.h
index a9a502f0c8..d3dcf088b3 100644
--- a/include/system/hvf.h
+++ b/include/system/hvf.h
@@ -14,10 +14,6 @@
 #define HVF_H
 
 #include "qemu/accel.h"
-#include "qemu/queue.h"
-#include "exec/vaddr.h"
-#include "qom/object.h"
-#include "exec/vaddr.h"
 
 #ifdef COMPILING_PER_TARGET
 # ifdef CONFIG_HVF
@@ -40,38 +36,4 @@ typedef struct HVFState HVFState;
 DECLARE_INSTANCE_CHECKER(HVFState, HVF_STATE,
                          TYPE_HVF_ACCEL)
 
-#ifdef COMPILING_PER_TARGET
-struct hvf_sw_breakpoint {
-    vaddr pc;
-    vaddr saved_insn;
-    int use_count;
-    QTAILQ_ENTRY(hvf_sw_breakpoint) entry;
-};
-
-struct hvf_sw_breakpoint *hvf_find_sw_breakpoint(CPUState *cpu,
-                                                 vaddr pc);
-int hvf_sw_breakpoints_active(CPUState *cpu);
-
-int hvf_arch_insert_sw_breakpoint(CPUState *cpu, struct hvf_sw_breakpoint *bp);
-int hvf_arch_remove_sw_breakpoint(CPUState *cpu, struct hvf_sw_breakpoint *bp);
-int hvf_arch_insert_hw_breakpoint(vaddr addr, vaddr len, int type);
-int hvf_arch_remove_hw_breakpoint(vaddr addr, vaddr len, int type);
-void hvf_arch_remove_all_hw_breakpoints(void);
-
-/*
- * hvf_update_guest_debug:
- * @cs: CPUState for the CPU to update
- *
- * Update guest to enable or disable debugging. Per-arch specifics will be
- * handled by calling down to hvf_arch_update_guest_debug.
- */
-int hvf_update_guest_debug(CPUState *cpu);
-void hvf_arch_update_guest_debug(CPUState *cpu);
-
-/*
- * Return whether the guest supports debugging.
- */
-bool hvf_arch_supports_guest_debug(void);
-#endif /* COMPILING_PER_TARGET */
-
 #endif
diff --git a/include/system/hvf_int.h b/include/system/hvf_int.h
index d774e58df9..4f6db40c34 100644
--- a/include/system/hvf_int.h
+++ b/include/system/hvf_int.h
@@ -12,6 +12,8 @@
 #define HVF_INT_H
 
 #include "qemu/queue.h"
+#include "exec/vaddr.h"
+#include "qom/object.h"
 
 #ifdef __aarch64__
 #include <Hypervisor/Hypervisor.h>
@@ -77,4 +79,36 @@ int hvf_put_registers(CPUState *);
 int hvf_get_registers(CPUState *);
 void hvf_kick_vcpu_thread(CPUState *cpu);
 
+struct hvf_sw_breakpoint {
+    vaddr pc;
+    vaddr saved_insn;
+    int use_count;
+    QTAILQ_ENTRY(hvf_sw_breakpoint) entry;
+};
+
+struct hvf_sw_breakpoint *hvf_find_sw_breakpoint(CPUState *cpu,
+                                                 vaddr pc);
+int hvf_sw_breakpoints_active(CPUState *cpu);
+
+int hvf_arch_insert_sw_breakpoint(CPUState *cpu, struct hvf_sw_breakpoint *bp);
+int hvf_arch_remove_sw_breakpoint(CPUState *cpu, struct hvf_sw_breakpoint *bp);
+int hvf_arch_insert_hw_breakpoint(vaddr addr, vaddr len, int type);
+int hvf_arch_remove_hw_breakpoint(vaddr addr, vaddr len, int type);
+void hvf_arch_remove_all_hw_breakpoints(void);
+
+/*
+ * hvf_update_guest_debug:
+ * @cs: CPUState for the CPU to update
+ *
+ * Update guest to enable or disable debugging. Per-arch specifics will be
+ * handled by calling down to hvf_arch_update_guest_debug.
+ */
+int hvf_update_guest_debug(CPUState *cpu);
+void hvf_arch_update_guest_debug(CPUState *cpu);
+
+/*
+ * Return whether the guest supports debugging.
+ */
+bool hvf_arch_supports_guest_debug(void);
+
 #endif

From 3240b69f683865f0c098669608add5414e532da1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 30 Jun 2025 11:33:53 +0200
Subject: [PATCH 1911/2760] accel/hvf: Move per-cpu method declarations to
 hvf-accel-ops.c
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

hvf-all.c aims to contain the generic accel methods (TYPE_ACCEL),
while hvf-accel-ops.c the per-vcpu methods (TYPE_ACCEL_OPS).

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Message-Id: <20250703173248.44995-16-philmd@linaro.org>
---
 accel/hvf/hvf-accel-ops.c | 30 ++++++++++++++++++++++++++++++
 accel/hvf/hvf-all.c       | 28 ----------------------------
 2 files changed, 30 insertions(+), 28 deletions(-)

diff --git a/accel/hvf/hvf-accel-ops.c b/accel/hvf/hvf-accel-ops.c
index b38977207d..3752334688 100644
--- a/accel/hvf/hvf-accel-ops.c
+++ b/accel/hvf/hvf-accel-ops.c
@@ -50,9 +50,11 @@
 #include "qemu/osdep.h"
 #include "qemu/error-report.h"
 #include "qemu/main-loop.h"
+#include "qemu/queue.h"
 #include "system/address-spaces.h"
 #include "gdbstub/enums.h"
 #include "hw/boards.h"
+#include "hw/core/cpu.h"
 #include "system/accel-ops.h"
 #include "system/cpus.h"
 #include "system/hvf.h"
@@ -482,6 +484,34 @@ static void hvf_start_vcpu_thread(CPUState *cpu)
                        cpu, QEMU_THREAD_JOINABLE);
 }
 
+struct hvf_sw_breakpoint *hvf_find_sw_breakpoint(CPUState *cpu, vaddr pc)
+{
+    struct hvf_sw_breakpoint *bp;
+
+    QTAILQ_FOREACH(bp, &hvf_state->hvf_sw_breakpoints, entry) {
+        if (bp->pc == pc) {
+            return bp;
+        }
+    }
+    return NULL;
+}
+
+int hvf_sw_breakpoints_active(CPUState *cpu)
+{
+    return !QTAILQ_EMPTY(&hvf_state->hvf_sw_breakpoints);
+}
+
+static void do_hvf_update_guest_debug(CPUState *cpu, run_on_cpu_data arg)
+{
+    hvf_arch_update_guest_debug(cpu);
+}
+
+int hvf_update_guest_debug(CPUState *cpu)
+{
+    run_on_cpu(cpu, do_hvf_update_guest_debug, RUN_ON_CPU_NULL);
+    return 0;
+}
+
 static int hvf_insert_breakpoint(CPUState *cpu, int type, vaddr addr, vaddr len)
 {
     struct hvf_sw_breakpoint *bp;
diff --git a/accel/hvf/hvf-all.c b/accel/hvf/hvf-all.c
index 8c387fda24..1c72c43ddb 100644
--- a/accel/hvf/hvf-all.c
+++ b/accel/hvf/hvf-all.c
@@ -41,31 +41,3 @@ void assert_hvf_ok_impl(hv_return_t ret, const char *file, unsigned int line,
 
     abort();
 }
-
-struct hvf_sw_breakpoint *hvf_find_sw_breakpoint(CPUState *cpu, vaddr pc)
-{
-    struct hvf_sw_breakpoint *bp;
-
-    QTAILQ_FOREACH(bp, &hvf_state->hvf_sw_breakpoints, entry) {
-        if (bp->pc == pc) {
-            return bp;
-        }
-    }
-    return NULL;
-}
-
-int hvf_sw_breakpoints_active(CPUState *cpu)
-{
-    return !QTAILQ_EMPTY(&hvf_state->hvf_sw_breakpoints);
-}
-
-static void do_hvf_update_guest_debug(CPUState *cpu, run_on_cpu_data arg)
-{
-    hvf_arch_update_guest_debug(cpu);
-}
-
-int hvf_update_guest_debug(CPUState *cpu)
-{
-    run_on_cpu(cpu, do_hvf_update_guest_debug, RUN_ON_CPU_NULL);
-    return 0;
-}

From 81490432b667ada39d51247aa56f51110bcb595a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 1 Jul 2025 14:57:25 +0200
Subject: [PATCH 1912/2760] accel/hvf: Move generic method declarations to
 hvf-all.c
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

hvf-all.c aims to contain the generic accel methods (TYPE_ACCEL),
while hvf-accel-ops.c the per-vcpu methods (TYPE_ACCEL_OPS).

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Message-Id: <20250703173248.44995-17-philmd@linaro.org>
---
 accel/hvf/hvf-accel-ops.c | 273 +-------------------------------------
 accel/hvf/hvf-all.c       | 267 +++++++++++++++++++++++++++++++++++++
 2 files changed, 271 insertions(+), 269 deletions(-)

diff --git a/accel/hvf/hvf-accel-ops.c b/accel/hvf/hvf-accel-ops.c
index 3752334688..2c0715a17f 100644
--- a/accel/hvf/hvf-accel-ops.c
+++ b/accel/hvf/hvf-accel-ops.c
@@ -48,20 +48,16 @@
  */
 
 #include "qemu/osdep.h"
-#include "qemu/error-report.h"
+#include "qemu/guest-random.h"
 #include "qemu/main-loop.h"
 #include "qemu/queue.h"
-#include "system/address-spaces.h"
 #include "gdbstub/enums.h"
-#include "hw/boards.h"
+#include "exec/cpu-common.h"
 #include "hw/core/cpu.h"
 #include "system/accel-ops.h"
 #include "system/cpus.h"
 #include "system/hvf.h"
 #include "system/hvf_int.h"
-#include "system/runstate.h"
-#include "qemu/guest-random.h"
-#include "trace.h"
 
 HVFState *hvf_state;
 
@@ -81,132 +77,6 @@ hvf_slot *hvf_find_overlap_slot(uint64_t start, uint64_t size)
     return NULL;
 }
 
-struct mac_slot {
-    int present;
-    uint64_t size;
-    uint64_t gpa_start;
-    uint64_t gva;
-};
-
-struct mac_slot mac_slots[32];
-
-static int do_hvf_set_memory(hvf_slot *slot, hv_memory_flags_t flags)
-{
-    struct mac_slot *macslot;
-    hv_return_t ret;
-
-    macslot = &mac_slots[slot->slot_id];
-
-    if (macslot->present) {
-        if (macslot->size != slot->size) {
-            macslot->present = 0;
-            trace_hvf_vm_unmap(macslot->gpa_start, macslot->size);
-            ret = hv_vm_unmap(macslot->gpa_start, macslot->size);
-            assert_hvf_ok(ret);
-        }
-    }
-
-    if (!slot->size) {
-        return 0;
-    }
-
-    macslot->present = 1;
-    macslot->gpa_start = slot->start;
-    macslot->size = slot->size;
-    trace_hvf_vm_map(slot->start, slot->size, slot->mem, flags,
-                     flags & HV_MEMORY_READ ?  'R' : '-',
-                     flags & HV_MEMORY_WRITE ? 'W' : '-',
-                     flags & HV_MEMORY_EXEC ?  'E' : '-');
-    ret = hv_vm_map(slot->mem, slot->start, slot->size, flags);
-    assert_hvf_ok(ret);
-    return 0;
-}
-
-static void hvf_set_phys_mem(MemoryRegionSection *section, bool add)
-{
-    hvf_slot *mem;
-    MemoryRegion *area = section->mr;
-    bool writable = !area->readonly && !area->rom_device;
-    hv_memory_flags_t flags;
-    uint64_t page_size = qemu_real_host_page_size();
-
-    if (!memory_region_is_ram(area)) {
-        if (writable) {
-            return;
-        } else if (!memory_region_is_romd(area)) {
-            /*
-             * If the memory device is not in romd_mode, then we actually want
-             * to remove the hvf memory slot so all accesses will trap.
-             */
-             add = false;
-        }
-    }
-
-    if (!QEMU_IS_ALIGNED(int128_get64(section->size), page_size) ||
-        !QEMU_IS_ALIGNED(section->offset_within_address_space, page_size)) {
-        /* Not page aligned, so we can not map as RAM */
-        add = false;
-    }
-
-    mem = hvf_find_overlap_slot(
-            section->offset_within_address_space,
-            int128_get64(section->size));
-
-    if (mem && add) {
-        if (mem->size == int128_get64(section->size) &&
-            mem->start == section->offset_within_address_space &&
-            mem->mem == (memory_region_get_ram_ptr(area) +
-            section->offset_within_region)) {
-            return; /* Same region was attempted to register, go away. */
-        }
-    }
-
-    /* Region needs to be reset. set the size to 0 and remap it. */
-    if (mem) {
-        mem->size = 0;
-        if (do_hvf_set_memory(mem, 0)) {
-            error_report("Failed to reset overlapping slot");
-            abort();
-        }
-    }
-
-    if (!add) {
-        return;
-    }
-
-    if (area->readonly ||
-        (!memory_region_is_ram(area) && memory_region_is_romd(area))) {
-        flags = HV_MEMORY_READ | HV_MEMORY_EXEC;
-    } else {
-        flags = HV_MEMORY_READ | HV_MEMORY_WRITE | HV_MEMORY_EXEC;
-    }
-
-    /* Now make a new slot. */
-    int x;
-
-    for (x = 0; x < hvf_state->num_slots; ++x) {
-        mem = &hvf_state->slots[x];
-        if (!mem->size) {
-            break;
-        }
-    }
-
-    if (x == hvf_state->num_slots) {
-        error_report("No free slots");
-        abort();
-    }
-
-    mem->size = int128_get64(section->size);
-    mem->mem = memory_region_get_ram_ptr(area) + section->offset_within_region;
-    mem->start = section->offset_within_address_space;
-    mem->region = area;
-
-    if (do_hvf_set_memory(mem, flags)) {
-        error_report("Error registering new memory slot");
-        abort();
-    }
-}
-
 static void do_hvf_cpu_synchronize_state(CPUState *cpu, run_on_cpu_data arg)
 {
     if (!cpu->accel->dirty) {
@@ -244,147 +114,10 @@ static void hvf_cpu_synchronize_pre_loadvm(CPUState *cpu)
     run_on_cpu(cpu, do_hvf_cpu_synchronize_set_dirty, RUN_ON_CPU_NULL);
 }
 
-static void hvf_set_dirty_tracking(MemoryRegionSection *section, bool on)
-{
-    hvf_slot *slot;
-
-    slot = hvf_find_overlap_slot(
-            section->offset_within_address_space,
-            int128_get64(section->size));
-
-    /* protect region against writes; begin tracking it */
-    if (on) {
-        slot->flags |= HVF_SLOT_LOG;
-        hv_vm_protect((uintptr_t)slot->start, (size_t)slot->size,
-                      HV_MEMORY_READ | HV_MEMORY_EXEC);
-    /* stop tracking region*/
-    } else {
-        slot->flags &= ~HVF_SLOT_LOG;
-        hv_vm_protect((uintptr_t)slot->start, (size_t)slot->size,
-                      HV_MEMORY_READ | HV_MEMORY_WRITE | HV_MEMORY_EXEC);
-    }
-}
-
-static void hvf_log_start(MemoryListener *listener,
-                          MemoryRegionSection *section, int old, int new)
-{
-    if (old != 0) {
-        return;
-    }
-
-    hvf_set_dirty_tracking(section, 1);
-}
-
-static void hvf_log_stop(MemoryListener *listener,
-                         MemoryRegionSection *section, int old, int new)
-{
-    if (new != 0) {
-        return;
-    }
-
-    hvf_set_dirty_tracking(section, 0);
-}
-
-static void hvf_log_sync(MemoryListener *listener,
-                         MemoryRegionSection *section)
-{
-    /*
-     * sync of dirty pages is handled elsewhere; just make sure we keep
-     * tracking the region.
-     */
-    hvf_set_dirty_tracking(section, 1);
-}
-
-static void hvf_region_add(MemoryListener *listener,
-                           MemoryRegionSection *section)
-{
-    hvf_set_phys_mem(section, true);
-}
-
-static void hvf_region_del(MemoryListener *listener,
-                           MemoryRegionSection *section)
-{
-    hvf_set_phys_mem(section, false);
-}
-
-static MemoryListener hvf_memory_listener = {
-    .name = "hvf",
-    .priority = MEMORY_LISTENER_PRIORITY_ACCEL,
-    .region_add = hvf_region_add,
-    .region_del = hvf_region_del,
-    .log_start = hvf_log_start,
-    .log_stop = hvf_log_stop,
-    .log_sync = hvf_log_sync,
-};
-
 static void dummy_signal(int sig)
 {
 }
 
-bool hvf_allowed;
-
-static int hvf_accel_init(MachineState *ms)
-{
-    int x;
-    hv_return_t ret;
-    HVFState *s;
-    int pa_range = 36;
-    MachineClass *mc = MACHINE_GET_CLASS(ms);
-
-    if (mc->hvf_get_physical_address_range) {
-        pa_range = mc->hvf_get_physical_address_range(ms);
-        if (pa_range < 0) {
-            return -EINVAL;
-        }
-    }
-
-    ret = hvf_arch_vm_create(ms, (uint32_t)pa_range);
-    assert_hvf_ok(ret);
-
-    s = g_new0(HVFState, 1);
-
-    s->num_slots = ARRAY_SIZE(s->slots);
-    for (x = 0; x < s->num_slots; ++x) {
-        s->slots[x].size = 0;
-        s->slots[x].slot_id = x;
-    }
-
-    QTAILQ_INIT(&s->hvf_sw_breakpoints);
-
-    hvf_state = s;
-    memory_listener_register(&hvf_memory_listener, &address_space_memory);
-
-    return hvf_arch_init();
-}
-
-static inline int hvf_gdbstub_sstep_flags(void)
-{
-    return SSTEP_ENABLE | SSTEP_NOIRQ;
-}
-
-static void hvf_accel_class_init(ObjectClass *oc, const void *data)
-{
-    AccelClass *ac = ACCEL_CLASS(oc);
-    ac->name = "HVF";
-    ac->init_machine = hvf_accel_init;
-    ac->allowed = &hvf_allowed;
-    ac->gdbstub_supported_sstep_flags = hvf_gdbstub_sstep_flags;
-}
-
-static const TypeInfo hvf_accel_type = {
-    .name = TYPE_HVF_ACCEL,
-    .parent = TYPE_ACCEL,
-    .instance_size = sizeof(HVFState),
-    .class_init = hvf_accel_class_init,
-};
-
-static void hvf_type_init(void)
-{
-    type_register_static(&hvf_accel_type);
-}
-
-type_init(hvf_type_init);
-
 static void hvf_vcpu_destroy(CPUState *cpu)
 {
     hv_return_t ret = hv_vcpu_destroy(cpu->accel->fd);
@@ -639,8 +372,10 @@ static const TypeInfo hvf_accel_ops_type = {
     .class_init = hvf_accel_ops_class_init,
     .abstract = true,
 };
+
 static void hvf_accel_ops_register_types(void)
 {
     type_register_static(&hvf_accel_ops_type);
 }
+
 type_init(hvf_accel_ops_register_types);
diff --git a/accel/hvf/hvf-all.c b/accel/hvf/hvf-all.c
index 1c72c43ddb..ddc77e629f 100644
--- a/accel/hvf/hvf-all.c
+++ b/accel/hvf/hvf-all.c
@@ -10,9 +10,24 @@
 
 #include "qemu/osdep.h"
 #include "qemu/error-report.h"
+#include "system/address-spaces.h"
+#include "system/memory.h"
 #include "system/hvf.h"
 #include "system/hvf_int.h"
 #include "hw/core/cpu.h"
+#include "hw/boards.h"
+#include "trace.h"
+
+bool hvf_allowed;
+
+struct mac_slot {
+    int present;
+    uint64_t size;
+    uint64_t gpa_start;
+    uint64_t gva;
+};
+
+struct mac_slot mac_slots[32];
 
 const char *hvf_return_string(hv_return_t ret)
 {
@@ -41,3 +56,255 @@ void assert_hvf_ok_impl(hv_return_t ret, const char *file, unsigned int line,
 
     abort();
 }
+
+static int do_hvf_set_memory(hvf_slot *slot, hv_memory_flags_t flags)
+{
+    struct mac_slot *macslot;
+    hv_return_t ret;
+
+    macslot = &mac_slots[slot->slot_id];
+
+    if (macslot->present) {
+        if (macslot->size != slot->size) {
+            macslot->present = 0;
+            trace_hvf_vm_unmap(macslot->gpa_start, macslot->size);
+            ret = hv_vm_unmap(macslot->gpa_start, macslot->size);
+            assert_hvf_ok(ret);
+        }
+    }
+
+    if (!slot->size) {
+        return 0;
+    }
+
+    macslot->present = 1;
+    macslot->gpa_start = slot->start;
+    macslot->size = slot->size;
+    trace_hvf_vm_map(slot->start, slot->size, slot->mem, flags,
+                     flags & HV_MEMORY_READ ?  'R' : '-',
+                     flags & HV_MEMORY_WRITE ? 'W' : '-',
+                     flags & HV_MEMORY_EXEC ?  'E' : '-');
+    ret = hv_vm_map(slot->mem, slot->start, slot->size, flags);
+    assert_hvf_ok(ret);
+    return 0;
+}
+
+static void hvf_set_phys_mem(MemoryRegionSection *section, bool add)
+{
+    hvf_slot *mem;
+    MemoryRegion *area = section->mr;
+    bool writable = !area->readonly && !area->rom_device;
+    hv_memory_flags_t flags;
+    uint64_t page_size = qemu_real_host_page_size();
+
+    if (!memory_region_is_ram(area)) {
+        if (writable) {
+            return;
+        } else if (!memory_region_is_romd(area)) {
+            /*
+             * If the memory device is not in romd_mode, then we actually want
+             * to remove the hvf memory slot so all accesses will trap.
+             */
+             add = false;
+        }
+    }
+
+    if (!QEMU_IS_ALIGNED(int128_get64(section->size), page_size) ||
+        !QEMU_IS_ALIGNED(section->offset_within_address_space, page_size)) {
+        /* Not page aligned, so we can not map as RAM */
+        add = false;
+    }
+
+    mem = hvf_find_overlap_slot(
+            section->offset_within_address_space,
+            int128_get64(section->size));
+
+    if (mem && add) {
+        if (mem->size == int128_get64(section->size) &&
+            mem->start == section->offset_within_address_space &&
+            mem->mem == (memory_region_get_ram_ptr(area) +
+            section->offset_within_region)) {
+            return; /* Same region was attempted to register, go away. */
+        }
+    }
+
+    /* Region needs to be reset. set the size to 0 and remap it. */
+    if (mem) {
+        mem->size = 0;
+        if (do_hvf_set_memory(mem, 0)) {
+            error_report("Failed to reset overlapping slot");
+            abort();
+        }
+    }
+
+    if (!add) {
+        return;
+    }
+
+    if (area->readonly ||
+        (!memory_region_is_ram(area) && memory_region_is_romd(area))) {
+        flags = HV_MEMORY_READ | HV_MEMORY_EXEC;
+    } else {
+        flags = HV_MEMORY_READ | HV_MEMORY_WRITE | HV_MEMORY_EXEC;
+    }
+
+    /* Now make a new slot. */
+    int x;
+
+    for (x = 0; x < hvf_state->num_slots; ++x) {
+        mem = &hvf_state->slots[x];
+        if (!mem->size) {
+            break;
+        }
+    }
+
+    if (x == hvf_state->num_slots) {
+        error_report("No free slots");
+        abort();
+    }
+
+    mem->size = int128_get64(section->size);
+    mem->mem = memory_region_get_ram_ptr(area) + section->offset_within_region;
+    mem->start = section->offset_within_address_space;
+    mem->region = area;
+
+    if (do_hvf_set_memory(mem, flags)) {
+        error_report("Error registering new memory slot");
+        abort();
+    }
+}
+
+static void hvf_set_dirty_tracking(MemoryRegionSection *section, bool on)
+{
+    hvf_slot *slot;
+
+    slot = hvf_find_overlap_slot(
+            section->offset_within_address_space,
+            int128_get64(section->size));
+
+    /* protect region against writes; begin tracking it */
+    if (on) {
+        slot->flags |= HVF_SLOT_LOG;
+        hv_vm_protect((uintptr_t)slot->start, (size_t)slot->size,
+                      HV_MEMORY_READ | HV_MEMORY_EXEC);
+    /* stop tracking region*/
+    } else {
+        slot->flags &= ~HVF_SLOT_LOG;
+        hv_vm_protect((uintptr_t)slot->start, (size_t)slot->size,
+                      HV_MEMORY_READ | HV_MEMORY_WRITE | HV_MEMORY_EXEC);
+    }
+}
+
+static void hvf_log_start(MemoryListener *listener,
+                          MemoryRegionSection *section, int old, int new)
+{
+    if (old != 0) {
+        return;
+    }
+
+    hvf_set_dirty_tracking(section, 1);
+}
+
+static void hvf_log_stop(MemoryListener *listener,
+                         MemoryRegionSection *section, int old, int new)
+{
+    if (new != 0) {
+        return;
+    }
+
+    hvf_set_dirty_tracking(section, 0);
+}
+
+static void hvf_log_sync(MemoryListener *listener,
+                         MemoryRegionSection *section)
+{
+    /*
+     * sync of dirty pages is handled elsewhere; just make sure we keep
+     * tracking the region.
+     */
+    hvf_set_dirty_tracking(section, 1);
+}
+
+static void hvf_region_add(MemoryListener *listener,
+                           MemoryRegionSection *section)
+{
+    hvf_set_phys_mem(section, true);
+}
+
+static void hvf_region_del(MemoryListener *listener,
+                           MemoryRegionSection *section)
+{
+    hvf_set_phys_mem(section, false);
+}
+
+static MemoryListener hvf_memory_listener = {
+    .name = "hvf",
+    .priority = MEMORY_LISTENER_PRIORITY_ACCEL,
+    .region_add = hvf_region_add,
+    .region_del = hvf_region_del,
+    .log_start = hvf_log_start,
+    .log_stop = hvf_log_stop,
+    .log_sync = hvf_log_sync,
+};
+
+static int hvf_accel_init(MachineState *ms)
+{
+    int x;
+    hv_return_t ret;
+    HVFState *s;
+    int pa_range = 36;
+    MachineClass *mc = MACHINE_GET_CLASS(ms);
+
+    if (mc->hvf_get_physical_address_range) {
+        pa_range = mc->hvf_get_physical_address_range(ms);
+        if (pa_range < 0) {
+            return -EINVAL;
+        }
+    }
+
+    ret = hvf_arch_vm_create(ms, (uint32_t)pa_range);
+    assert_hvf_ok(ret);
+
+    s = g_new0(HVFState, 1);
+
+    s->num_slots = ARRAY_SIZE(s->slots);
+    for (x = 0; x < s->num_slots; ++x) {
+        s->slots[x].size = 0;
+        s->slots[x].slot_id = x;
+    }
+
+    QTAILQ_INIT(&s->hvf_sw_breakpoints);
+
+    hvf_state = s;
+    memory_listener_register(&hvf_memory_listener, &address_space_memory);
+
+    return hvf_arch_init();
+}
+
+static int hvf_gdbstub_sstep_flags(void)
+{
+    return SSTEP_ENABLE | SSTEP_NOIRQ;
+}
+
+static void hvf_accel_class_init(ObjectClass *oc, const void *data)
+{
+    AccelClass *ac = ACCEL_CLASS(oc);
+    ac->name = "HVF";
+    ac->init_machine = hvf_accel_init;
+    ac->allowed = &hvf_allowed;
+    ac->gdbstub_supported_sstep_flags = hvf_gdbstub_sstep_flags;
+}
+
+static const TypeInfo hvf_accel_type = {
+    .name = TYPE_HVF_ACCEL,
+    .parent = TYPE_ACCEL,
+    .instance_size = sizeof(HVFState),
+    .class_init = hvf_accel_class_init,
+};
+
+static void hvf_type_init(void)
+{
+    type_register_static(&hvf_accel_type);
+}
+
+type_init(hvf_type_init);

From 5f3bfbd8e2453671176e9759b9dc14584cd11e79 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 4 Jul 2025 00:26:05 +0200
Subject: [PATCH 1913/2760] accel/hvf: Report missing
 com.apple.security.hypervisor entitlement
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We need the QEMU binary signed to be able to use HVF.
Improve the following:

  $ ./qemu-system-aarch64-unsigned -M virt -accel hvf
  qemu-system-aarch64-unsigned: -accel hvf: Error: ret = HV_DENIED (0xfae94007, at ../../accel/hvf/hvf-accel-ops.c:339)
  Abort trap: 6

to:

  $ ./qemu-system-aarch64-unsigned -M virt -accel hvf
  qemu-system-aarch64-unsigned: -accel hvf: Could not access HVF. Is the executable signed with com.apple.security.hypervisor entitlement?

Suggested-by: Shatyuka <shatyuka@qq.com>
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2800
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Acked-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Mads Ynddal <mads@ynddal.dk>
Message-Id: <20250702185332.43650-29-philmd@linaro.org>
---
 accel/hvf/hvf-all.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/accel/hvf/hvf-all.c b/accel/hvf/hvf-all.c
index ddc77e629f..09fe3f2415 100644
--- a/accel/hvf/hvf-all.c
+++ b/accel/hvf/hvf-all.c
@@ -263,6 +263,11 @@ static int hvf_accel_init(MachineState *ms)
     }
 
     ret = hvf_arch_vm_create(ms, (uint32_t)pa_range);
+    if (ret == HV_DENIED) {
+        error_report("Could not access HVF. Is the executable signed"
+                     " with com.apple.security.hypervisor entitlement?");
+        exit(1);
+    }
     assert_hvf_ok(ret);
 
     s = g_new0(HVFState, 1);

From b6340f5866e19deadae8c19399907fed938d8d1f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 17 Jun 2025 06:47:28 +0200
Subject: [PATCH 1914/2760] cpus: Document CPUState::vcpu_dirty field
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Message-Id: <20250703173248.44995-18-philmd@linaro.org>
---
 include/hw/core/cpu.h | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index 162a56a5da..5eaf41a566 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -442,6 +442,7 @@ struct qemu_work_item;
  * @opaque: User data.
  * @mem_io_pc: Host Program Counter at which the memory was accessed.
  * @accel: Pointer to accelerator specific state.
+ * @vcpu_dirty: Hardware accelerator is not synchronized with QEMU state
  * @kvm_fd: vCPU file descriptor for KVM.
  * @work_mutex: Lock to prevent multiple access to @work_list.
  * @work_list: List of pending asynchronous work.
@@ -538,7 +539,6 @@ struct CPUState {
     uint32_t kvm_fetch_index;
     uint64_t dirty_pages;
     int kvm_vcpu_stats_fd;
-    bool vcpu_dirty;
 
     /* Use by accel-block: CPU is executing an ioctl() */
     QemuLockCnt in_ioctl_lock;
@@ -554,6 +554,7 @@ struct CPUState {
     uint32_t halted;
     int32_t exception_index;
 
+    bool vcpu_dirty;
     AccelCPUState *accel;
 
     /* Used to keep track of an outstanding cpu throttle thread for migration

From 6f13a0ada0160d420f1e4945ee53a1abdae33a1c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 17 Jun 2025 06:54:32 +0200
Subject: [PATCH 1915/2760] accel/hvf: Replace @dirty field by generic
 CPUState::vcpu_dirty field
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

No need for accel-specific @dirty field when we have
a generic one in CPUState.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Reviewed-by: Mads Ynddal <mads@ynddal.dk>
Message-Id: <20250703173248.44995-19-philmd@linaro.org>
---
 accel/hvf/hvf-accel-ops.c | 10 +++++-----
 include/system/hvf_int.h  |  1 -
 target/arm/hvf/hvf.c      |  4 ++--
 target/i386/hvf/hvf.c     |  4 ++--
 target/i386/hvf/x86hvf.c  |  2 +-
 5 files changed, 10 insertions(+), 11 deletions(-)

diff --git a/accel/hvf/hvf-accel-ops.c b/accel/hvf/hvf-accel-ops.c
index 2c0715a17f..395b5a8e1c 100644
--- a/accel/hvf/hvf-accel-ops.c
+++ b/accel/hvf/hvf-accel-ops.c
@@ -79,15 +79,15 @@ hvf_slot *hvf_find_overlap_slot(uint64_t start, uint64_t size)
 
 static void do_hvf_cpu_synchronize_state(CPUState *cpu, run_on_cpu_data arg)
 {
-    if (!cpu->accel->dirty) {
+    if (!cpu->vcpu_dirty) {
         hvf_get_registers(cpu);
-        cpu->accel->dirty = true;
+        cpu->vcpu_dirty = true;
     }
 }
 
 static void hvf_cpu_synchronize_state(CPUState *cpu)
 {
-    if (!cpu->accel->dirty) {
+    if (!cpu->vcpu_dirty) {
         run_on_cpu(cpu, do_hvf_cpu_synchronize_state, RUN_ON_CPU_NULL);
     }
 }
@@ -96,7 +96,7 @@ static void do_hvf_cpu_synchronize_set_dirty(CPUState *cpu,
                                              run_on_cpu_data arg)
 {
     /* QEMU state is the reference, push it to HVF now and on next entry */
-    cpu->accel->dirty = true;
+    cpu->vcpu_dirty = true;
 }
 
 static void hvf_cpu_synchronize_post_reset(CPUState *cpu)
@@ -150,8 +150,8 @@ static int hvf_init_vcpu(CPUState *cpu)
 #else
     r = hv_vcpu_create(&cpu->accel->fd, HV_VCPU_DEFAULT);
 #endif
-    cpu->accel->dirty = true;
     assert_hvf_ok(r);
+    cpu->vcpu_dirty = true;
 
     cpu->accel->guest_debug_enabled = false;
 
diff --git a/include/system/hvf_int.h b/include/system/hvf_int.h
index 4f6db40c34..5150c7dd9c 100644
--- a/include/system/hvf_int.h
+++ b/include/system/hvf_int.h
@@ -62,7 +62,6 @@ struct AccelCPUState {
     bool vtimer_masked;
     sigset_t unblock_ipi_mask;
     bool guest_debug_enabled;
-    bool dirty;
 };
 
 void assert_hvf_ok_impl(hv_return_t ret, const char *file, unsigned int line,
diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index 7b6d291e79..c9cfcdc08b 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -813,9 +813,9 @@ int hvf_put_registers(CPUState *cpu)
 
 static void flush_cpu_state(CPUState *cpu)
 {
-    if (cpu->accel->dirty) {
+    if (cpu->vcpu_dirty) {
         hvf_put_registers(cpu);
-        cpu->accel->dirty = false;
+        cpu->vcpu_dirty = false;
     }
 }
 
diff --git a/target/i386/hvf/hvf.c b/target/i386/hvf/hvf.c
index 99e37a33e5..818b50419f 100644
--- a/target/i386/hvf/hvf.c
+++ b/target/i386/hvf/hvf.c
@@ -733,9 +733,9 @@ int hvf_vcpu_exec(CPUState *cpu)
     }
 
     do {
-        if (cpu->accel->dirty) {
+        if (cpu->vcpu_dirty) {
             hvf_put_registers(cpu);
-            cpu->accel->dirty = false;
+            cpu->vcpu_dirty = false;
         }
 
         if (hvf_inject_interrupts(cpu)) {
diff --git a/target/i386/hvf/x86hvf.c b/target/i386/hvf/x86hvf.c
index 2057314892..17fce1d3cd 100644
--- a/target/i386/hvf/x86hvf.c
+++ b/target/i386/hvf/x86hvf.c
@@ -427,7 +427,7 @@ int hvf_process_events(CPUState *cs)
     X86CPU *cpu = X86_CPU(cs);
     CPUX86State *env = &cpu->env;
 
-    if (!cs->accel->dirty) {
+    if (!cs->vcpu_dirty) {
         /* light weight sync for CPU_INTERRUPT_HARD and IF_MASK */
         env->eflags = rreg(cs->accel->fd, HV_X86_RFLAGS);
     }

From ffd8ee9d7cbd220d15526d14d5b3402a63eab0ff Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 17 Jun 2025 06:59:03 +0200
Subject: [PATCH 1916/2760] accel/nvmm: Replace @dirty field by generic
 CPUState::vcpu_dirty field
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

No need for accel-specific @dirty field when we have
a generic one in CPUState.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Message-Id: <20250703173248.44995-20-philmd@linaro.org>
---
 target/i386/nvmm/nvmm-all.c | 21 ++++++++++-----------
 1 file changed, 10 insertions(+), 11 deletions(-)

diff --git a/target/i386/nvmm/nvmm-all.c b/target/i386/nvmm/nvmm-all.c
index f1c6120ccf..aea61a6fd2 100644
--- a/target/i386/nvmm/nvmm-all.c
+++ b/target/i386/nvmm/nvmm-all.c
@@ -30,7 +30,6 @@ struct AccelCPUState {
     struct nvmm_vcpu vcpu;
     uint8_t tpr;
     bool stop;
-    bool dirty;
 
     /* Window-exiting for INTs/NMIs. */
     bool int_window_exit;
@@ -508,7 +507,7 @@ nvmm_io_callback(struct nvmm_io *io)
     }
 
     /* Needed, otherwise infinite loop. */
-    current_cpu->accel->dirty = false;
+    current_cpu->vcpu_dirty = false;
 }
 
 static void
@@ -517,7 +516,7 @@ nvmm_mem_callback(struct nvmm_mem *mem)
     cpu_physical_memory_rw(mem->gpa, mem->data, mem->size, mem->write);
 
     /* Needed, otherwise infinite loop. */
-    current_cpu->accel->dirty = false;
+    current_cpu->vcpu_dirty = false;
 }
 
 static struct nvmm_assist_callbacks nvmm_callbacks = {
@@ -727,9 +726,9 @@ nvmm_vcpu_loop(CPUState *cpu)
      * Inner VCPU loop.
      */
     do {
-        if (cpu->accel->dirty) {
+        if (cpu->vcpu_dirty) {
             nvmm_set_registers(cpu);
-            cpu->accel->dirty = false;
+            cpu->vcpu_dirty = false;
         }
 
         if (qcpu->stop) {
@@ -827,32 +826,32 @@ static void
 do_nvmm_cpu_synchronize_state(CPUState *cpu, run_on_cpu_data arg)
 {
     nvmm_get_registers(cpu);
-    cpu->accel->dirty = true;
+    cpu->vcpu_dirty = true;
 }
 
 static void
 do_nvmm_cpu_synchronize_post_reset(CPUState *cpu, run_on_cpu_data arg)
 {
     nvmm_set_registers(cpu);
-    cpu->accel->dirty = false;
+    cpu->vcpu_dirty = false;
 }
 
 static void
 do_nvmm_cpu_synchronize_post_init(CPUState *cpu, run_on_cpu_data arg)
 {
     nvmm_set_registers(cpu);
-    cpu->accel->dirty = false;
+    cpu->vcpu_dirty = false;
 }
 
 static void
 do_nvmm_cpu_synchronize_pre_loadvm(CPUState *cpu, run_on_cpu_data arg)
 {
-    cpu->accel->dirty = true;
+    cpu->vcpu_dirty = true;
 }
 
 void nvmm_cpu_synchronize_state(CPUState *cpu)
 {
-    if (!cpu->accel->dirty) {
+    if (!cpu->vcpu_dirty) {
         run_on_cpu(cpu, do_nvmm_cpu_synchronize_state, RUN_ON_CPU_NULL);
     }
 }
@@ -982,7 +981,7 @@ nvmm_init_vcpu(CPUState *cpu)
         }
     }
 
-    qcpu->dirty = true;
+    qcpu->vcpu_dirty = true;
     cpu->accel = qcpu;
 
     return 0;

From 36ab216b81deaca2a6a39be803e870dead2b13f0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 17 Jun 2025 06:59:29 +0200
Subject: [PATCH 1917/2760] accel/whpx: Replace @dirty field by generic
 CPUState::vcpu_dirty field
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

No need for accel-specific @dirty field when we have
a generic one in CPUState.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Message-Id: <20250703173248.44995-21-philmd@linaro.org>
---
 target/i386/whpx/whpx-all.c | 23 +++++++++++------------
 1 file changed, 11 insertions(+), 12 deletions(-)

diff --git a/target/i386/whpx/whpx-all.c b/target/i386/whpx/whpx-all.c
index cf6d3e4cdd..5001afad3a 100644
--- a/target/i386/whpx/whpx-all.c
+++ b/target/i386/whpx/whpx-all.c
@@ -237,7 +237,6 @@ struct AccelCPUState {
     uint64_t tpr;
     uint64_t apic_base;
     bool interruption_pending;
-    bool dirty;
 
     /* Must be the last field as it may have a tail */
     WHV_RUN_VP_EXIT_CONTEXT exit_ctx;
@@ -836,7 +835,7 @@ static HRESULT CALLBACK whpx_emu_setreg_callback(
      * The emulator just successfully wrote the register state. We clear the
      * dirty state so we avoid the double write on resume of the VP.
      */
-    cpu->accel->dirty = false;
+    cpu->vcpu_dirty = false;
 
     return hr;
 }
@@ -1391,7 +1390,7 @@ static int whpx_last_vcpu_stopping(CPUState *cpu)
 /* Returns the address of the next instruction that is about to be executed. */
 static vaddr whpx_vcpu_get_pc(CPUState *cpu, bool exit_context_valid)
 {
-    if (cpu->accel->dirty) {
+    if (cpu->vcpu_dirty) {
         /* The CPU registers have been modified by other parts of QEMU. */
         return cpu_env(cpu)->eip;
     } else if (exit_context_valid) {
@@ -1704,9 +1703,9 @@ static int whpx_vcpu_run(CPUState *cpu)
     }
 
     do {
-        if (cpu->accel->dirty) {
+        if (cpu->vcpu_dirty) {
             whpx_set_registers(cpu, WHPX_SET_RUNTIME_STATE);
-            cpu->accel->dirty = false;
+            cpu->vcpu_dirty = false;
         }
 
         if (exclusive_step_mode == WHPX_STEP_NONE) {
@@ -2054,9 +2053,9 @@ static int whpx_vcpu_run(CPUState *cpu)
 
 static void do_whpx_cpu_synchronize_state(CPUState *cpu, run_on_cpu_data arg)
 {
-    if (!cpu->accel->dirty) {
+    if (!cpu->vcpu_dirty) {
         whpx_get_registers(cpu);
-        cpu->accel->dirty = true;
+        cpu->vcpu_dirty = true;
     }
 }
 
@@ -2064,20 +2063,20 @@ static void do_whpx_cpu_synchronize_post_reset(CPUState *cpu,
                                                run_on_cpu_data arg)
 {
     whpx_set_registers(cpu, WHPX_SET_RESET_STATE);
-    cpu->accel->dirty = false;
+    cpu->vcpu_dirty = false;
 }
 
 static void do_whpx_cpu_synchronize_post_init(CPUState *cpu,
                                               run_on_cpu_data arg)
 {
     whpx_set_registers(cpu, WHPX_SET_FULL_STATE);
-    cpu->accel->dirty = false;
+    cpu->vcpu_dirty = false;
 }
 
 static void do_whpx_cpu_synchronize_pre_loadvm(CPUState *cpu,
                                                run_on_cpu_data arg)
 {
-    cpu->accel->dirty = true;
+    cpu->vcpu_dirty = true;
 }
 
 /*
@@ -2086,7 +2085,7 @@ static void do_whpx_cpu_synchronize_pre_loadvm(CPUState *cpu,
 
 void whpx_cpu_synchronize_state(CPUState *cpu)
 {
-    if (!cpu->accel->dirty) {
+    if (!cpu->vcpu_dirty) {
         run_on_cpu(cpu, do_whpx_cpu_synchronize_state, RUN_ON_CPU_NULL);
     }
 }
@@ -2226,7 +2225,7 @@ int whpx_init_vcpu(CPUState *cpu)
     }
 
     vcpu->interruptable = true;
-    vcpu->dirty = true;
+    cpu->vcpu_dirty = true;
     cpu->accel = vcpu;
     max_vcpu_index = max(max_vcpu_index, cpu->cpu_index);
     qemu_add_vm_change_state_handler(whpx_cpu_update_state, env);

From 888a6be77560992d17ab823f27a8297ecd7893b6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 16 Jun 2025 14:13:20 +0200
Subject: [PATCH 1918/2760] accel/kvm: Remove kvm_cpu_synchronize_state() stub
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since commit 57038a92bb0 ("cpus: extract out kvm-specific code
to accel/kvm") the kvm_cpu_synchronize_state() stub is not
necessary.

Fixes: e0715f6abce ("kvm: remove kvm specific functions from global includes")
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Message-Id: <20250703173248.44995-22-philmd@linaro.org>
---
 accel/stubs/kvm-stub.c | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/accel/stubs/kvm-stub.c b/accel/stubs/kvm-stub.c
index b9b4427c91..68cd33ba97 100644
--- a/accel/stubs/kvm-stub.c
+++ b/accel/stubs/kvm-stub.c
@@ -29,10 +29,6 @@ void kvm_flush_coalesced_mmio_buffer(void)
 {
 }
 
-void kvm_cpu_synchronize_state(CPUState *cpu)
-{
-}
-
 bool kvm_has_sync_mmu(void)
 {
     return false;

From 8e825755c5ddcdfd91e585d850aecee434d2ff63 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 16 Jun 2025 16:09:08 +0200
Subject: [PATCH 1919/2760] accel/system: Document cpu_synchronize_state()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Message-Id: <20250703173248.44995-23-philmd@linaro.org>
---
 include/system/accel-ops.h |  8 ++++++++
 include/system/hw_accel.h  | 13 +++++++++++--
 2 files changed, 19 insertions(+), 2 deletions(-)

diff --git a/include/system/accel-ops.h b/include/system/accel-ops.h
index 4c99d25aef..55f91cea25 100644
--- a/include/system/accel-ops.h
+++ b/include/system/accel-ops.h
@@ -42,6 +42,14 @@ struct AccelOpsClass {
 
     void (*synchronize_post_reset)(CPUState *cpu);
     void (*synchronize_post_init)(CPUState *cpu);
+    /**
+     * synchronize_state:
+     * synchronize_pre_loadvm:
+     * @cpu: The vCPU to synchronize.
+     *
+     * Request to synchronize QEMU vCPU registers from the hardware accelerator
+     * (the hardware accelerator is the reference).
+     */
     void (*synchronize_state)(CPUState *cpu);
     void (*synchronize_pre_loadvm)(CPUState *cpu);
     void (*synchronize_pre_resume)(bool step_pending);
diff --git a/include/system/hw_accel.h b/include/system/hw_accel.h
index 380e9e640b..574c973840 100644
--- a/include/system/hw_accel.h
+++ b/include/system/hw_accel.h
@@ -17,9 +17,18 @@
 #include "system/whpx.h"
 #include "system/nvmm.h"
 
+/**
+ * cpu_synchronize_state:
+ * cpu_synchronize_pre_loadvm:
+ * @cpu: The vCPU to synchronize.
+ *
+ * Request to synchronize QEMU vCPU registers from the hardware accelerator
+ * (the hardware accelerator is the reference).
+ */
 void cpu_synchronize_state(CPUState *cpu);
-void cpu_synchronize_post_reset(CPUState *cpu);
-void cpu_synchronize_post_init(CPUState *cpu);
 void cpu_synchronize_pre_loadvm(CPUState *cpu);
 
+void cpu_synchronize_post_reset(CPUState *cpu);
+void cpu_synchronize_post_init(CPUState *cpu);
+
 #endif /* QEMU_HW_ACCEL_H */

From 04bd6c3631e0184dcafb0403e0248a2052585914 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 16 Jun 2025 16:09:23 +0200
Subject: [PATCH 1920/2760] accel/system: Document
 cpu_synchronize_state_post_init/reset()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Message-Id: <20250703173248.44995-24-philmd@linaro.org>
---
 include/system/accel-ops.h | 8 ++++++++
 include/system/hw_accel.h  | 8 ++++++++
 2 files changed, 16 insertions(+)

diff --git a/include/system/accel-ops.h b/include/system/accel-ops.h
index 55f91cea25..a4e706b49c 100644
--- a/include/system/accel-ops.h
+++ b/include/system/accel-ops.h
@@ -40,6 +40,14 @@ struct AccelOpsClass {
     void (*kick_vcpu_thread)(CPUState *cpu);
     bool (*cpu_thread_is_idle)(CPUState *cpu);
 
+    /**
+     * synchronize_post_reset:
+     * synchronize_post_init:
+     * @cpu: The vCPU to synchronize.
+     *
+     * Request to synchronize QEMU vCPU registers to the hardware accelerator
+     * (QEMU is the reference).
+     */
     void (*synchronize_post_reset)(CPUState *cpu);
     void (*synchronize_post_init)(CPUState *cpu);
     /**
diff --git a/include/system/hw_accel.h b/include/system/hw_accel.h
index 574c973840..fa9228d5d2 100644
--- a/include/system/hw_accel.h
+++ b/include/system/hw_accel.h
@@ -28,6 +28,14 @@
 void cpu_synchronize_state(CPUState *cpu);
 void cpu_synchronize_pre_loadvm(CPUState *cpu);
 
+/**
+ * cpu_synchronize_post_reset:
+ * cpu_synchronize_post_init:
+ * @cpu: The vCPU to synchronize.
+ *
+ * Request to synchronize QEMU vCPU registers to the hardware accelerator
+ * (QEMU is the reference).
+ */
 void cpu_synchronize_post_reset(CPUState *cpu);
 void cpu_synchronize_post_init(CPUState *cpu);
 

From 80a1efdedd3099cde51cabf91789e037a6af11df Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 16 Jun 2025 10:39:09 +0200
Subject: [PATCH 1921/2760] accel/nvmm: Expose nvmm_enabled() to common code
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Currently nvmm_enabled() is restricted to target-specific code.
By defining CONFIG_NVMM_IS_POSSIBLE we allow its use anywhere.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Message-Id: <20250703173248.44995-25-philmd@linaro.org>
---
 MAINTAINERS                 |  1 +
 accel/stubs/meson.build     |  1 +
 accel/stubs/nvmm-stub.c     | 12 ++++++++++++
 include/system/nvmm.h       | 23 ++++++++++++-----------
 target/i386/nvmm/nvmm-all.c |  8 +-------
 5 files changed, 27 insertions(+), 18 deletions(-)
 create mode 100644 accel/stubs/nvmm-stub.c

diff --git a/MAINTAINERS b/MAINTAINERS
index b1cbfe115b..c73468b242 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -586,6 +586,7 @@ NetBSD Virtual Machine Monitor (NVMM) CPU support
 M: Reinoud Zandijk <reinoud@netbsd.org>
 S: Maintained
 F: include/system/nvmm.h
+F: accel/stubs/nvmm-stub.c
 F: target/i386/nvmm/
 
 Hosts
diff --git a/accel/stubs/meson.build b/accel/stubs/meson.build
index 8ca1a4529e..4c34287215 100644
--- a/accel/stubs/meson.build
+++ b/accel/stubs/meson.build
@@ -3,5 +3,6 @@ system_stubs_ss.add(when: 'CONFIG_XEN', if_false: files('xen-stub.c'))
 system_stubs_ss.add(when: 'CONFIG_KVM', if_false: files('kvm-stub.c'))
 system_stubs_ss.add(when: 'CONFIG_TCG', if_false: files('tcg-stub.c'))
 system_stubs_ss.add(when: 'CONFIG_HVF', if_false: files('hvf-stub.c'))
+system_stubs_ss.add(when: 'CONFIG_NVMM', if_false: files('nvmm-stub.c'))
 
 specific_ss.add_all(when: ['CONFIG_SYSTEM_ONLY'], if_true: system_stubs_ss)
diff --git a/accel/stubs/nvmm-stub.c b/accel/stubs/nvmm-stub.c
new file mode 100644
index 0000000000..ec14837501
--- /dev/null
+++ b/accel/stubs/nvmm-stub.c
@@ -0,0 +1,12 @@
+/*
+ * NVMM stubs for QEMU
+ *
+ *  Copyright (c) Linaro
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "system/nvmm.h"
+
+bool nvmm_allowed;
diff --git a/include/system/nvmm.h b/include/system/nvmm.h
index 6971ddb3a5..7390def9ad 100644
--- a/include/system/nvmm.h
+++ b/include/system/nvmm.h
@@ -13,17 +13,18 @@
 #define QEMU_NVMM_H
 
 #ifdef COMPILING_PER_TARGET
-
-#ifdef CONFIG_NVMM
-
-int nvmm_enabled(void);
-
-#else /* CONFIG_NVMM */
-
-#define nvmm_enabled() (0)
-
-#endif /* CONFIG_NVMM */
-
+# ifdef CONFIG_NVMM
+#  define CONFIG_NVMM_IS_POSSIBLE
+# endif /* !CONFIG_NVMM */
+#else
+# define CONFIG_NVMM_IS_POSSIBLE
 #endif /* COMPILING_PER_TARGET */
 
+#ifdef CONFIG_NVMM_IS_POSSIBLE
+extern bool nvmm_allowed;
+#define nvmm_enabled() (nvmm_allowed)
+#else /* !CONFIG_NVMM_IS_POSSIBLE */
+#define nvmm_enabled() 0
+#endif /* !CONFIG_NVMM_IS_POSSIBLE */
+
 #endif /* QEMU_NVMM_H */
diff --git a/target/i386/nvmm/nvmm-all.c b/target/i386/nvmm/nvmm-all.c
index aea61a6fd2..2df49d7eeb 100644
--- a/target/i386/nvmm/nvmm-all.c
+++ b/target/i386/nvmm/nvmm-all.c
@@ -46,7 +46,7 @@ struct qemu_machine {
 
 /* -------------------------------------------------------------------------- */
 
-static bool nvmm_allowed;
+bool nvmm_allowed;
 static struct qemu_machine qemu_mach;
 
 static struct nvmm_machine *
@@ -1192,12 +1192,6 @@ nvmm_accel_init(MachineState *ms)
     return 0;
 }
 
-int
-nvmm_enabled(void)
-{
-    return nvmm_allowed;
-}
-
 static void
 nvmm_accel_class_init(ObjectClass *oc, const void *data)
 {

From a9c2afd74b887b4775f425b72be1888220594bb5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 16 Jun 2025 10:40:00 +0200
Subject: [PATCH 1922/2760] accel/whpx: Expose whpx_enabled() to common code
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Currently whpx_enabled() is restricted to target-specific code.
By defining CONFIG_WHPX_IS_POSSIBLE we allow its use anywhere.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250703173248.44995-26-philmd@linaro.org>
---
 MAINTAINERS                 |  1 +
 accel/stubs/meson.build     |  1 +
 accel/stubs/whpx-stub.c     | 12 ++++++++++++
 include/system/whpx.h       | 27 ++++++++++++++-------------
 target/i386/whpx/whpx-all.c |  7 +------
 5 files changed, 29 insertions(+), 19 deletions(-)
 create mode 100644 accel/stubs/whpx-stub.c

diff --git a/MAINTAINERS b/MAINTAINERS
index c73468b242..0fd8b2a4e6 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -540,6 +540,7 @@ WHPX CPUs
 M: Sunil Muthuswamy <sunilmut@microsoft.com>
 S: Supported
 F: target/i386/whpx/
+F: accel/stubs/whpx-stub.c
 F: include/system/whpx.h
 
 X86 Instruction Emulator
diff --git a/accel/stubs/meson.build b/accel/stubs/meson.build
index 4c34287215..9dfc4f9dda 100644
--- a/accel/stubs/meson.build
+++ b/accel/stubs/meson.build
@@ -4,5 +4,6 @@ system_stubs_ss.add(when: 'CONFIG_KVM', if_false: files('kvm-stub.c'))
 system_stubs_ss.add(when: 'CONFIG_TCG', if_false: files('tcg-stub.c'))
 system_stubs_ss.add(when: 'CONFIG_HVF', if_false: files('hvf-stub.c'))
 system_stubs_ss.add(when: 'CONFIG_NVMM', if_false: files('nvmm-stub.c'))
+system_stubs_ss.add(when: 'CONFIG_WHPX', if_false: files('whpx-stub.c'))
 
 specific_ss.add_all(when: ['CONFIG_SYSTEM_ONLY'], if_true: system_stubs_ss)
diff --git a/accel/stubs/whpx-stub.c b/accel/stubs/whpx-stub.c
new file mode 100644
index 0000000000..c564c89fd0
--- /dev/null
+++ b/accel/stubs/whpx-stub.c
@@ -0,0 +1,12 @@
+/*
+ * WHPX stubs for QEMU
+ *
+ *  Copyright (c) Linaro
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "system/whpx.h"
+
+bool whpx_allowed;
diff --git a/include/system/whpx.h b/include/system/whpx.h
index 00ff409b68..00f6a3e523 100644
--- a/include/system/whpx.h
+++ b/include/system/whpx.h
@@ -16,19 +16,20 @@
 #define QEMU_WHPX_H
 
 #ifdef COMPILING_PER_TARGET
-
-#ifdef CONFIG_WHPX
-
-int whpx_enabled(void);
-bool whpx_apic_in_platform(void);
-
-#else /* CONFIG_WHPX */
-
-#define whpx_enabled() (0)
-#define whpx_apic_in_platform() (0)
-
-#endif /* CONFIG_WHPX */
-
+# ifdef CONFIG_WHPX
+#  define CONFIG_WHPX_IS_POSSIBLE
+# endif /* !CONFIG_WHPX */
+#else
+# define CONFIG_WHPX_IS_POSSIBLE
 #endif /* COMPILING_PER_TARGET */
 
+#ifdef CONFIG_WHPX_IS_POSSIBLE
+extern bool whpx_allowed;
+#define whpx_enabled() (whpx_allowed)
+bool whpx_apic_in_platform(void);
+#else /* !CONFIG_WHPX_IS_POSSIBLE */
+#define whpx_enabled() 0
+#define whpx_apic_in_platform() (0)
+#endif /* !CONFIG_WHPX_IS_POSSIBLE */
+
 #endif /* QEMU_WHPX_H */
diff --git a/target/i386/whpx/whpx-all.c b/target/i386/whpx/whpx-all.c
index 5001afad3a..94fd5fc784 100644
--- a/target/i386/whpx/whpx-all.c
+++ b/target/i386/whpx/whpx-all.c
@@ -242,7 +242,7 @@ struct AccelCPUState {
     WHV_RUN_VP_EXIT_CONTEXT exit_ctx;
 };
 
-static bool whpx_allowed;
+bool whpx_allowed;
 static bool whp_dispatch_initialized;
 static HMODULE hWinHvPlatform, hWinHvEmulation;
 static uint32_t max_vcpu_index;
@@ -2688,11 +2688,6 @@ error:
     return ret;
 }
 
-int whpx_enabled(void)
-{
-    return whpx_allowed;
-}
-
 bool whpx_apic_in_platform(void) {
     return whpx_global.apic_in_platform;
 }

From 20a0181600d61f5e58a087be14bd63c40aca2cd4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 30 Jun 2025 16:20:10 +0200
Subject: [PATCH 1923/2760] accel/dummy: Extract 'dummy-cpus.h' header from
 'system/cpus.h'
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

'dummy' helpers are specific to accelerator implementations,
no need to expose them via "system/cpus.h".

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Message-Id: <20250703173248.44995-27-philmd@linaro.org>
---
 MAINTAINERS           |  1 +
 accel/dummy-cpus.c    |  1 +
 accel/dummy-cpus.h    | 14 ++++++++++++++
 accel/qtest/qtest.c   |  1 +
 accel/xen/xen-all.c   |  1 +
 include/system/cpus.h |  5 -----
 6 files changed, 18 insertions(+), 5 deletions(-)
 create mode 100644 accel/dummy-cpus.h

diff --git a/MAINTAINERS b/MAINTAINERS
index 0fd8b2a4e6..fca98e1219 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -503,6 +503,7 @@ F: include/system/accel-*.h
 F: include/system/cpus.h
 F: include/accel/accel-cpu*.h
 F: accel/accel-*.?
+F: accel/dummy-cpus.?
 F: accel/Makefile.objs
 F: accel/stubs/Makefile.objs
 F: cpu-common.c
diff --git a/accel/dummy-cpus.c b/accel/dummy-cpus.c
index 867276144f..03cfc0fa01 100644
--- a/accel/dummy-cpus.c
+++ b/accel/dummy-cpus.c
@@ -17,6 +17,7 @@
 #include "qemu/guest-random.h"
 #include "qemu/main-loop.h"
 #include "hw/core/cpu.h"
+#include "accel/dummy-cpus.h"
 
 static void *dummy_cpu_thread_fn(void *arg)
 {
diff --git a/accel/dummy-cpus.h b/accel/dummy-cpus.h
new file mode 100644
index 0000000000..d18dd0fdc5
--- /dev/null
+++ b/accel/dummy-cpus.h
@@ -0,0 +1,14 @@
+/*
+ * Dummy cpu thread code
+ *
+ * Copyright IBM, Corp. 2011
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef ACCEL_DUMMY_CPUS_H
+#define ACCEL_DUMMY_CPUS_H
+
+void dummy_start_vcpu_thread(CPUState *cpu);
+
+#endif
diff --git a/accel/qtest/qtest.c b/accel/qtest/qtest.c
index 92bed9264c..612cede160 100644
--- a/accel/qtest/qtest.c
+++ b/accel/qtest/qtest.c
@@ -24,6 +24,7 @@
 #include "qemu/guest-random.h"
 #include "qemu/main-loop.h"
 #include "hw/core/cpu.h"
+#include "accel/dummy-cpus.h"
 
 static int64_t qtest_clock_counter;
 
diff --git a/accel/xen/xen-all.c b/accel/xen/xen-all.c
index de52a8f882..c150dd43ca 100644
--- a/accel/xen/xen-all.c
+++ b/accel/xen/xen-all.c
@@ -18,6 +18,7 @@
 #include "hw/xen/xen_igd.h"
 #include "chardev/char.h"
 #include "qemu/accel.h"
+#include "accel/dummy-cpus.h"
 #include "system/accel-ops.h"
 #include "system/cpus.h"
 #include "system/xen.h"
diff --git a/include/system/cpus.h b/include/system/cpus.h
index 3226c765d0..69be6a77a7 100644
--- a/include/system/cpus.h
+++ b/include/system/cpus.h
@@ -7,11 +7,6 @@ void cpus_register_accel(const AccelOpsClass *i);
 /* return registers ops */
 const AccelOpsClass *cpus_get_accel(void);
 
-/* accel/dummy-cpus.c */
-
-/* Create a dummy vcpu for AccelOpsClass->create_vcpu_thread */
-void dummy_start_vcpu_thread(CPUState *);
-
 /* interface available for cpus accelerator threads */
 
 /* For temporary buffers for forming a name */

From b64bb17d14a62ea04b605f81daec8a5a4fad3be4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 12 Jun 2025 14:45:19 +0200
Subject: [PATCH 1924/2760] accel: Expose and register
 generic_handle_interrupt()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In order to dispatch over AccelOpsClass::handle_interrupt(),
we need it always defined, not calling a hidden handler under
the hood. Make AccelOpsClass::handle_interrupt() mandatory.
Expose generic_handle_interrupt() prototype and register it
for each accelerator.

Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Mads Ynddal <mads@ynddal.dk>
Message-Id: <20250703173248.44995-29-philmd@linaro.org>
---
 accel/hvf/hvf-accel-ops.c         |  1 +
 accel/kvm/kvm-accel-ops.c         |  1 +
 accel/qtest/qtest.c               |  1 +
 accel/xen/xen-all.c               |  1 +
 include/system/accel-ops.h        |  3 +++
 system/cpus.c                     | 10 ++++------
 target/i386/nvmm/nvmm-accel-ops.c |  1 +
 target/i386/whpx/whpx-accel-ops.c |  1 +
 8 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/accel/hvf/hvf-accel-ops.c b/accel/hvf/hvf-accel-ops.c
index 395b5a8e1c..be8724ac89 100644
--- a/accel/hvf/hvf-accel-ops.c
+++ b/accel/hvf/hvf-accel-ops.c
@@ -353,6 +353,7 @@ static void hvf_accel_ops_class_init(ObjectClass *oc, const void *data)
 
     ops->create_vcpu_thread = hvf_start_vcpu_thread;
     ops->kick_vcpu_thread = hvf_kick_vcpu_thread;
+    ops->handle_interrupt = generic_handle_interrupt;
 
     ops->synchronize_post_reset = hvf_cpu_synchronize_post_reset;
     ops->synchronize_post_init = hvf_cpu_synchronize_post_init;
diff --git a/accel/kvm/kvm-accel-ops.c b/accel/kvm/kvm-accel-ops.c
index e5c15449aa..0eafc902c3 100644
--- a/accel/kvm/kvm-accel-ops.c
+++ b/accel/kvm/kvm-accel-ops.c
@@ -101,6 +101,7 @@ static void kvm_accel_ops_class_init(ObjectClass *oc, const void *data)
     ops->synchronize_post_init = kvm_cpu_synchronize_post_init;
     ops->synchronize_state = kvm_cpu_synchronize_state;
     ops->synchronize_pre_loadvm = kvm_cpu_synchronize_pre_loadvm;
+    ops->handle_interrupt = generic_handle_interrupt;
 
 #ifdef TARGET_KVM_HAVE_GUEST_DEBUG
     ops->update_guest_debug = kvm_update_guest_debug_ops;
diff --git a/accel/qtest/qtest.c b/accel/qtest/qtest.c
index 612cede160..5474ce7313 100644
--- a/accel/qtest/qtest.c
+++ b/accel/qtest/qtest.c
@@ -67,6 +67,7 @@ static void qtest_accel_ops_class_init(ObjectClass *oc, const void *data)
     ops->create_vcpu_thread = dummy_start_vcpu_thread;
     ops->get_virtual_clock = qtest_get_virtual_clock;
     ops->set_virtual_clock = qtest_set_virtual_clock;
+    ops->handle_interrupt = generic_handle_interrupt;
 };
 
 static const TypeInfo qtest_accel_ops_type = {
diff --git a/accel/xen/xen-all.c b/accel/xen/xen-all.c
index c150dd43ca..c12c22de78 100644
--- a/accel/xen/xen-all.c
+++ b/accel/xen/xen-all.c
@@ -153,6 +153,7 @@ static void xen_accel_ops_class_init(ObjectClass *oc, const void *data)
     AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
 
     ops->create_vcpu_thread = dummy_start_vcpu_thread;
+    ops->handle_interrupt = generic_handle_interrupt;
 }
 
 static const TypeInfo xen_accel_ops_type = {
diff --git a/include/system/accel-ops.h b/include/system/accel-ops.h
index a4e706b49c..e775ecc348 100644
--- a/include/system/accel-ops.h
+++ b/include/system/accel-ops.h
@@ -62,6 +62,7 @@ struct AccelOpsClass {
     void (*synchronize_pre_loadvm)(CPUState *cpu);
     void (*synchronize_pre_resume)(bool step_pending);
 
+    /* handle_interrupt is mandatory. */
     void (*handle_interrupt)(CPUState *cpu, int mask);
 
     /**
@@ -86,4 +87,6 @@ struct AccelOpsClass {
     void (*remove_all_breakpoints)(CPUState *cpu);
 };
 
+void generic_handle_interrupt(CPUState *cpu, int mask);
+
 #endif /* ACCEL_OPS_H */
diff --git a/system/cpus.c b/system/cpus.c
index a43e0e4e79..0d0eec82a2 100644
--- a/system/cpus.c
+++ b/system/cpus.c
@@ -254,7 +254,7 @@ int64_t cpus_get_elapsed_ticks(void)
     return cpu_get_ticks();
 }
 
-static void generic_handle_interrupt(CPUState *cpu, int mask)
+void generic_handle_interrupt(CPUState *cpu, int mask)
 {
     cpu->interrupt_request |= mask;
 
@@ -267,11 +267,7 @@ void cpu_interrupt(CPUState *cpu, int mask)
 {
     g_assert(bql_locked());
 
-    if (cpus_accel->handle_interrupt) {
-        cpus_accel->handle_interrupt(cpu, mask);
-    } else {
-        generic_handle_interrupt(cpu, mask);
-    }
+    cpus_accel->handle_interrupt(cpu, mask);
 }
 
 /*
@@ -680,6 +676,8 @@ void cpus_register_accel(const AccelOpsClass *ops)
 {
     assert(ops != NULL);
     assert(ops->create_vcpu_thread != NULL); /* mandatory */
+    assert(ops->handle_interrupt);
+
     cpus_accel = ops;
 }
 
diff --git a/target/i386/nvmm/nvmm-accel-ops.c b/target/i386/nvmm/nvmm-accel-ops.c
index 21443078b7..a5517b0abf 100644
--- a/target/i386/nvmm/nvmm-accel-ops.c
+++ b/target/i386/nvmm/nvmm-accel-ops.c
@@ -87,6 +87,7 @@ static void nvmm_accel_ops_class_init(ObjectClass *oc, const void *data)
 
     ops->create_vcpu_thread = nvmm_start_vcpu_thread;
     ops->kick_vcpu_thread = nvmm_kick_vcpu_thread;
+    ops->handle_interrupt = generic_handle_interrupt;
 
     ops->synchronize_post_reset = nvmm_cpu_synchronize_post_reset;
     ops->synchronize_post_init = nvmm_cpu_synchronize_post_init;
diff --git a/target/i386/whpx/whpx-accel-ops.c b/target/i386/whpx/whpx-accel-ops.c
index b8bebe403c..31cf15f004 100644
--- a/target/i386/whpx/whpx-accel-ops.c
+++ b/target/i386/whpx/whpx-accel-ops.c
@@ -90,6 +90,7 @@ static void whpx_accel_ops_class_init(ObjectClass *oc, const void *data)
     ops->create_vcpu_thread = whpx_start_vcpu_thread;
     ops->kick_vcpu_thread = whpx_kick_vcpu_thread;
     ops->cpu_thread_is_idle = whpx_vcpu_thread_is_idle;
+    ops->handle_interrupt = generic_handle_interrupt;
 
     ops->synchronize_post_reset = whpx_cpu_synchronize_post_reset;
     ops->synchronize_post_init = whpx_cpu_synchronize_post_init;

From 487b25c9d93add2e0e58275d7c1ef89810fad763 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 6 Jun 2025 12:07:47 +0200
Subject: [PATCH 1925/2760] accel: Keep reference to AccelOpsClass in
 AccelClass
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Allow dereferencing AccelOpsClass outside of accel/accel-system.c.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Message-Id: <20250703173248.44995-30-philmd@linaro.org>
---
 accel/accel-system.c       | 3 ++-
 accel/tcg/tcg-accel-ops.c  | 4 +++-
 include/qemu/accel.h       | 3 +++
 include/system/accel-ops.h | 3 ++-
 4 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/accel/accel-system.c b/accel/accel-system.c
index a0f562ae9f..64bc991b1c 100644
--- a/accel/accel-system.c
+++ b/accel/accel-system.c
@@ -85,8 +85,9 @@ void accel_init_ops_interfaces(AccelClass *ac)
      * non-NULL create_vcpu_thread operation.
      */
     ops = ACCEL_OPS_CLASS(oc);
+    ac->ops = ops;
     if (ops->ops_init) {
-        ops->ops_init(ops);
+        ops->ops_init(ac);
     }
     cpus_register_accel(ops);
 }
diff --git a/accel/tcg/tcg-accel-ops.c b/accel/tcg/tcg-accel-ops.c
index 71776bc29c..279dbfa1cf 100644
--- a/accel/tcg/tcg-accel-ops.c
+++ b/accel/tcg/tcg-accel-ops.c
@@ -199,8 +199,10 @@ static inline void tcg_remove_all_breakpoints(CPUState *cpu)
     cpu_watchpoint_remove_all(cpu, BP_GDB);
 }
 
-static void tcg_accel_ops_init(AccelOpsClass *ops)
+static void tcg_accel_ops_init(AccelClass *ac)
 {
+    AccelOpsClass *ops = ac->ops;
+
     if (qemu_tcg_mttcg_enabled()) {
         ops->create_vcpu_thread = mttcg_start_vcpu_thread;
         ops->kick_vcpu_thread = mttcg_kick_vcpu_thread;
diff --git a/include/qemu/accel.h b/include/qemu/accel.h
index fbd3d897fe..9dea314542 100644
--- a/include/qemu/accel.h
+++ b/include/qemu/accel.h
@@ -37,6 +37,9 @@ typedef struct AccelClass {
     /*< public >*/
 
     const char *name;
+    /* Cached by accel_init_ops_interfaces() when created */
+    AccelOpsClass *ops;
+
     int (*init_machine)(MachineState *ms);
     bool (*cpu_common_realize)(CPUState *cpu, Error **errp);
     void (*cpu_common_unrealize)(CPUState *cpu);
diff --git a/include/system/accel-ops.h b/include/system/accel-ops.h
index e775ecc348..a786c7d478 100644
--- a/include/system/accel-ops.h
+++ b/include/system/accel-ops.h
@@ -10,6 +10,7 @@
 #ifndef ACCEL_OPS_H
 #define ACCEL_OPS_H
 
+#include "qemu/accel.h"
 #include "exec/vaddr.h"
 #include "qom/object.h"
 
@@ -31,7 +32,7 @@ struct AccelOpsClass {
     /*< public >*/
 
     /* initialization function called when accel is chosen */
-    void (*ops_init)(AccelOpsClass *ops);
+    void (*ops_init)(AccelClass *ac);
 
     bool (*cpus_are_resettable)(void);
     void (*cpu_reset_hold)(CPUState *cpu);

From fa8f6f25ea8dc3a1123deaf53cf4907005880e52 Mon Sep 17 00:00:00 2001
From: William Kosasih <kosasihwilliam4@gmail.com>
Date: Thu, 3 Jul 2025 18:25:54 +0930
Subject: [PATCH 1926/2760] target/arm: Bring VLSTM/VLLDM helper store/load
 closer to the ARM pseudocode

This patch brings the VLSTM and VLLDM helper functions closer to the ARM
pseudocode by adding MO_ALIGN to the MemOpIdx of the associated store
(`cpu_stl_mmu`) operations and load (`cpu_ldl_mmu`) operations.

Note that this is not a bug fix: an 8-byte alignment check already exists
and remains in place, enforcing stricter alignment than the 4 bytes
requirement in the individual loads and stores. This change merely makes the
helper implementations closer to the ARM pseudocode.

That said, as a side effect, the MMU index is now resolved once instead of
on every `cpu_*_data_ra` call, reducing redundant lookups

Signed-off-by: William Kosasih <kosasihwilliam4@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250703085604.154449-2-kosasihwilliam4@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/m_helper.c | 24 +++++++++++++++---------
 1 file changed, 15 insertions(+), 9 deletions(-)

diff --git a/target/arm/tcg/m_helper.c b/target/arm/tcg/m_helper.c
index 6614719832..251e12edf9 100644
--- a/target/arm/tcg/m_helper.c
+++ b/target/arm/tcg/m_helper.c
@@ -1048,6 +1048,9 @@ void HELPER(v7m_vlstm)(CPUARMState *env, uint32_t fptr)
     bool s = env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_S_MASK;
     bool lspact = env->v7m.fpccr[s] & R_V7M_FPCCR_LSPACT_MASK;
     uintptr_t ra = GETPC();
+    ARMMMUIdx mmu_idx = arm_mmu_idx(env);
+    MemOpIdx oi = make_memop_idx(MO_TEUL | MO_ALIGN,
+                                 arm_to_core_mmu_idx(mmu_idx));
 
     assert(env->v7m.secure);
 
@@ -1073,7 +1076,7 @@ void HELPER(v7m_vlstm)(CPUARMState *env, uint32_t fptr)
      * Note that we do not use v7m_stack_write() here, because the
      * accesses should not set the FSR bits for stacking errors if they
      * fail. (In pseudocode terms, they are AccType_NORMAL, not AccType_STACK
-     * or AccType_LAZYFP). Faults in cpu_stl_data_ra() will throw exceptions
+     * or AccType_LAZYFP). Faults in cpu_stl_mmu() will throw exceptions
      * and longjmp out.
      */
     if (!(env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_LSPEN_MASK)) {
@@ -1089,12 +1092,12 @@ void HELPER(v7m_vlstm)(CPUARMState *env, uint32_t fptr)
             if (i >= 16) {
                 faddr += 8; /* skip the slot for the FPSCR */
             }
-            cpu_stl_data_ra(env, faddr, slo, ra);
-            cpu_stl_data_ra(env, faddr + 4, shi, ra);
+            cpu_stl_mmu(env, faddr, slo, oi, ra);
+            cpu_stl_mmu(env, faddr + 4, shi, oi, ra);
         }
-        cpu_stl_data_ra(env, fptr + 0x40, vfp_get_fpscr(env), ra);
+        cpu_stl_mmu(env, fptr + 0x40, vfp_get_fpscr(env), oi, ra);
         if (cpu_isar_feature(aa32_mve, cpu)) {
-            cpu_stl_data_ra(env, fptr + 0x44, env->v7m.vpr, ra);
+            cpu_stl_mmu(env, fptr + 0x44, env->v7m.vpr, oi, ra);
         }
 
         /*
@@ -1121,6 +1124,9 @@ void HELPER(v7m_vlldm)(CPUARMState *env, uint32_t fptr)
 {
     ARMCPU *cpu = env_archcpu(env);
     uintptr_t ra = GETPC();
+    ARMMMUIdx mmu_idx = arm_mmu_idx(env);
+    MemOpIdx oi = make_memop_idx(MO_TEUL | MO_ALIGN,
+                                 arm_to_core_mmu_idx(mmu_idx));
 
     /* fptr is the value of Rn, the frame pointer we load the FP regs from */
     assert(env->v7m.secure);
@@ -1155,16 +1161,16 @@ void HELPER(v7m_vlldm)(CPUARMState *env, uint32_t fptr)
                 faddr += 8; /* skip the slot for the FPSCR and VPR */
             }
 
-            slo = cpu_ldl_data_ra(env, faddr, ra);
-            shi = cpu_ldl_data_ra(env, faddr + 4, ra);
+            slo = cpu_ldl_mmu(env, faddr, oi, ra);
+            shi = cpu_ldl_mmu(env, faddr + 4, oi, ra);
 
             dn = (uint64_t) shi << 32 | slo;
             *aa32_vfp_dreg(env, i / 2) = dn;
         }
-        fpscr = cpu_ldl_data_ra(env, fptr + 0x40, ra);
+        fpscr = cpu_ldl_mmu(env, fptr + 0x40, oi, ra);
         vfp_set_fpscr(env, fpscr);
         if (cpu_isar_feature(aa32_mve, cpu)) {
-            env->v7m.vpr = cpu_ldl_data_ra(env, fptr + 0x44, ra);
+            env->v7m.vpr = cpu_ldl_mmu(env, fptr + 0x44, oi, ra);
         }
     }
 

From 94b07a46d1dbf1c31373da14e14f88b65ff94181 Mon Sep 17 00:00:00 2001
From: William Kosasih <kosasihwilliam4@gmail.com>
Date: Thu, 3 Jul 2025 18:25:55 +0930
Subject: [PATCH 1927/2760] target/arm: Fix BLXNS helper store alignment checks

This patch adds alignment checks in the store operations (when stacking the
return pc and psr) in the BLXNS instruction.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1154
Signed-off-by: William Kosasih <kosasihwilliam4@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250703085604.154449-3-kosasihwilliam4@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/m_helper.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/target/arm/tcg/m_helper.c b/target/arm/tcg/m_helper.c
index 251e12edf9..f342d93489 100644
--- a/target/arm/tcg/m_helper.c
+++ b/target/arm/tcg/m_helper.c
@@ -632,8 +632,11 @@ void HELPER(v7m_blxns)(CPUARMState *env, uint32_t dest)
     }
 
     /* Note that these stores can throw exceptions on MPU faults */
-    cpu_stl_data_ra(env, sp, nextinst, GETPC());
-    cpu_stl_data_ra(env, sp + 4, saved_psr, GETPC());
+    ARMMMUIdx mmu_idx = arm_mmu_idx(env);
+    MemOpIdx oi = make_memop_idx(MO_TEUL | MO_ALIGN,
+                                 arm_to_core_mmu_idx(mmu_idx));
+    cpu_stl_mmu(env, sp, nextinst, oi, GETPC());
+    cpu_stl_mmu(env, sp + 4, saved_psr, oi, GETPC());
 
     env->regs[13] = sp;
     env->regs[14] = 0xfeffffff;

From c4940752ae12b82938c95a9cfe0864b725ac85f1 Mon Sep 17 00:00:00 2001
From: William Kosasih <kosasihwilliam4@gmail.com>
Date: Thu, 3 Jul 2025 18:25:56 +0930
Subject: [PATCH 1928/2760] target/arm: Fix function_return helper load
 alignment checks

This patch adds alignment checks in the load operations (when unstacking the
return pc and psr) in the FunctionReturn pseudocode.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1154
Signed-off-by: William Kosasih <kosasihwilliam4@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250703085604.154449-4-kosasihwilliam4@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/m_helper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/tcg/m_helper.c b/target/arm/tcg/m_helper.c
index f342d93489..28307b5615 100644
--- a/target/arm/tcg/m_helper.c
+++ b/target/arm/tcg/m_helper.c
@@ -1946,7 +1946,7 @@ static bool do_v7m_function_return(ARMCPU *cpu)
          * do them as secure, so work out what MMU index that is.
          */
         mmu_idx = arm_v7m_mmu_idx_for_secstate(env, true);
-        oi = make_memop_idx(MO_LEUL, arm_to_core_mmu_idx(mmu_idx));
+        oi = make_memop_idx(MO_LEUL | MO_ALIGN, arm_to_core_mmu_idx(mmu_idx));
         newpc = cpu_ldl_mmu(env, frameptr, oi, 0);
         newpsr = cpu_ldl_mmu(env, frameptr + 4, oi, 0);
 

From 56249f3e6ceb4076b9d1b2500450420cf18346e2 Mon Sep 17 00:00:00 2001
From: William Kosasih <kosasihwilliam4@gmail.com>
Date: Thu, 3 Jul 2025 18:25:57 +0930
Subject: [PATCH 1929/2760] target/arm: Fix VLDR helper load alignment checks

This patch adds alignment checks in the load operations in the VLDR
instruction.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1154
Signed-off-by: William Kosasih <kosasihwilliam4@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250703085604.154449-5-kosasihwilliam4@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/mve_helper.c | 24 +++++++++++++-----------
 1 file changed, 13 insertions(+), 11 deletions(-)

diff --git a/target/arm/tcg/mve_helper.c b/target/arm/tcg/mve_helper.c
index 506d1c3475..8834523c23 100644
--- a/target/arm/tcg/mve_helper.c
+++ b/target/arm/tcg/mve_helper.c
@@ -148,13 +148,15 @@ static void mve_advance_vpt(CPUARMState *env)
 }
 
 /* For loads, predicated lanes are zeroed instead of keeping their old values */
-#define DO_VLDR(OP, MSIZE, LDTYPE, ESIZE, TYPE)                         \
+#define DO_VLDR(OP, MFLAG, MSIZE, MTYPE, LDTYPE, ESIZE, TYPE)           \
     void HELPER(mve_##OP)(CPUARMState *env, void *vd, uint32_t addr)    \
     {                                                                   \
         TYPE *d = vd;                                                   \
         uint16_t mask = mve_element_mask(env);                          \
         uint16_t eci_mask = mve_eci_mask(env);                          \
         unsigned b, e;                                                  \
+        int mmu_idx = arm_to_core_mmu_idx(arm_mmu_idx(env));            \
+        MemOpIdx oi = make_memop_idx(MFLAG | MO_ALIGN, mmu_idx);        \
         /*                                                              \
          * R_SXTM allows the dest reg to become UNKNOWN for abandoned   \
          * beats so we don't care if we update part of the dest and     \
@@ -163,7 +165,7 @@ static void mve_advance_vpt(CPUARMState *env)
         for (b = 0, e = 0; b < 16; b += ESIZE, e++) {                   \
             if (eci_mask & (1 << b)) {                                  \
                 d[H##ESIZE(e)] = (mask & (1 << b)) ?                    \
-                    cpu_##LDTYPE##_data_ra(env, addr, GETPC()) : 0;     \
+                    (MTYPE)cpu_##LDTYPE##_mmu(env, addr, oi, GETPC()) : 0;\
             }                                                           \
             addr += MSIZE;                                              \
         }                                                               \
@@ -185,20 +187,20 @@ static void mve_advance_vpt(CPUARMState *env)
         mve_advance_vpt(env);                                           \
     }
 
-DO_VLDR(vldrb, 1, ldub, 1, uint8_t)
-DO_VLDR(vldrh, 2, lduw, 2, uint16_t)
-DO_VLDR(vldrw, 4, ldl, 4, uint32_t)
+DO_VLDR(vldrb, MO_UB, 1, uint8_t, ldb, 1, uint8_t)
+DO_VLDR(vldrh, MO_TEUW, 2, uint16_t, ldw, 2, uint16_t)
+DO_VLDR(vldrw, MO_TEUL, 4, uint32_t, ldl, 4, uint32_t)
 
 DO_VSTR(vstrb, 1, stb, 1, uint8_t)
 DO_VSTR(vstrh, 2, stw, 2, uint16_t)
 DO_VSTR(vstrw, 4, stl, 4, uint32_t)
 
-DO_VLDR(vldrb_sh, 1, ldsb, 2, int16_t)
-DO_VLDR(vldrb_sw, 1, ldsb, 4, int32_t)
-DO_VLDR(vldrb_uh, 1, ldub, 2, uint16_t)
-DO_VLDR(vldrb_uw, 1, ldub, 4, uint32_t)
-DO_VLDR(vldrh_sw, 2, ldsw, 4, int32_t)
-DO_VLDR(vldrh_uw, 2, lduw, 4, uint32_t)
+DO_VLDR(vldrb_sh, MO_SB, 1, int8_t, ldb, 2, int16_t)
+DO_VLDR(vldrb_sw, MO_SB, 1, int8_t, ldb, 4, int32_t)
+DO_VLDR(vldrb_uh, MO_UB, 1, uint8_t, ldb, 2, uint16_t)
+DO_VLDR(vldrb_uw, MO_UB, 1, uint8_t, ldb, 4, uint32_t)
+DO_VLDR(vldrh_sw, MO_TESW, 2, int16_t, ldw, 4, int32_t)
+DO_VLDR(vldrh_uw, MO_TEUW, 2, uint16_t, ldw, 4, uint32_t)
 
 DO_VSTR(vstrb_h, 1, stb, 2, int16_t)
 DO_VSTR(vstrb_w, 1, stb, 4, int32_t)

From c8bde49179be1196d8ccfcfdc6269ce3861053a5 Mon Sep 17 00:00:00 2001
From: William Kosasih <kosasihwilliam4@gmail.com>
Date: Thu, 3 Jul 2025 18:25:58 +0930
Subject: [PATCH 1930/2760] target/arm: Fix VSTR helper store alignment checks

This patch adds alignment checks in the store operations in the VSTR
instruction.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1154
Signed-off-by: William Kosasih <kosasihwilliam4@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250703085604.154449-6-kosasihwilliam4@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/mve_helper.c | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/target/arm/tcg/mve_helper.c b/target/arm/tcg/mve_helper.c
index 8834523c23..9587f2da7d 100644
--- a/target/arm/tcg/mve_helper.c
+++ b/target/arm/tcg/mve_helper.c
@@ -172,15 +172,17 @@ static void mve_advance_vpt(CPUARMState *env)
         mve_advance_vpt(env);                                           \
     }
 
-#define DO_VSTR(OP, MSIZE, STTYPE, ESIZE, TYPE)                         \
+#define DO_VSTR(OP, MFLAG, MSIZE, STTYPE, ESIZE, TYPE)                  \
     void HELPER(mve_##OP)(CPUARMState *env, void *vd, uint32_t addr)    \
     {                                                                   \
         TYPE *d = vd;                                                   \
         uint16_t mask = mve_element_mask(env);                          \
         unsigned b, e;                                                  \
+        int mmu_idx = arm_to_core_mmu_idx(arm_mmu_idx(env));            \
+        MemOpIdx oi = make_memop_idx(MFLAG | MO_ALIGN, mmu_idx);        \
         for (b = 0, e = 0; b < 16; b += ESIZE, e++) {                   \
             if (mask & (1 << b)) {                                      \
-                cpu_##STTYPE##_data_ra(env, addr, d[H##ESIZE(e)], GETPC()); \
+                cpu_##STTYPE##_mmu(env, addr, d[H##ESIZE(e)], oi, GETPC()); \
             }                                                           \
             addr += MSIZE;                                              \
         }                                                               \
@@ -191,9 +193,9 @@ DO_VLDR(vldrb, MO_UB, 1, uint8_t, ldb, 1, uint8_t)
 DO_VLDR(vldrh, MO_TEUW, 2, uint16_t, ldw, 2, uint16_t)
 DO_VLDR(vldrw, MO_TEUL, 4, uint32_t, ldl, 4, uint32_t)
 
-DO_VSTR(vstrb, 1, stb, 1, uint8_t)
-DO_VSTR(vstrh, 2, stw, 2, uint16_t)
-DO_VSTR(vstrw, 4, stl, 4, uint32_t)
+DO_VSTR(vstrb, MO_UB, 1, stb, 1, uint8_t)
+DO_VSTR(vstrh, MO_TEUW, 2, stw, 2, uint16_t)
+DO_VSTR(vstrw, MO_TEUL, 4, stl, 4, uint32_t)
 
 DO_VLDR(vldrb_sh, MO_SB, 1, int8_t, ldb, 2, int16_t)
 DO_VLDR(vldrb_sw, MO_SB, 1, int8_t, ldb, 4, int32_t)
@@ -202,9 +204,9 @@ DO_VLDR(vldrb_uw, MO_UB, 1, uint8_t, ldb, 4, uint32_t)
 DO_VLDR(vldrh_sw, MO_TESW, 2, int16_t, ldw, 4, int32_t)
 DO_VLDR(vldrh_uw, MO_TEUW, 2, uint16_t, ldw, 4, uint32_t)
 
-DO_VSTR(vstrb_h, 1, stb, 2, int16_t)
-DO_VSTR(vstrb_w, 1, stb, 4, int32_t)
-DO_VSTR(vstrh_w, 2, stw, 4, int32_t)
+DO_VSTR(vstrb_h, MO_UB, 1, stb, 2, int16_t)
+DO_VSTR(vstrb_w, MO_UB, 1, stb, 4, int32_t)
+DO_VSTR(vstrh_w, MO_TEUW, 2, stw, 4, int32_t)
 
 #undef DO_VLDR
 #undef DO_VSTR

From f8436889a0c8468b5cb7b881a5d62283a27c44b6 Mon Sep 17 00:00:00 2001
From: William Kosasih <kosasihwilliam4@gmail.com>
Date: Thu, 3 Jul 2025 18:25:59 +0930
Subject: [PATCH 1931/2760] target/arm: Fix VLDR_SG helper load alignment
 checks

This patch adds alignment checks in the load operations in the VLDR_SG
instructions.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1154
Signed-off-by: William Kosasih <kosasihwilliam4@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250703085604.154449-7-kosasihwilliam4@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/mve_helper.c | 42 ++++++++++++++++++++++---------------
 1 file changed, 25 insertions(+), 17 deletions(-)

diff --git a/target/arm/tcg/mve_helper.c b/target/arm/tcg/mve_helper.c
index 9587f2da7d..633f511a7e 100644
--- a/target/arm/tcg/mve_helper.c
+++ b/target/arm/tcg/mve_helper.c
@@ -218,7 +218,7 @@ DO_VSTR(vstrh_w, MO_TEUW, 2, stw, 4, int32_t)
  * For loads, predicated lanes are zeroed instead of retaining
  * their previous values.
  */
-#define DO_VLDR_SG(OP, LDTYPE, ESIZE, TYPE, OFFTYPE, ADDRFN, WB)        \
+#define DO_VLDR_SG(OP, MFLAG, MTYPE, LDTYPE, ESIZE, TYPE, OFFTYPE, ADDRFN, WB)\
     void HELPER(mve_##OP)(CPUARMState *env, void *vd, void *vm,         \
                           uint32_t base)                                \
     {                                                                   \
@@ -228,13 +228,15 @@ DO_VSTR(vstrh_w, MO_TEUW, 2, stw, 4, int32_t)
         uint16_t eci_mask = mve_eci_mask(env);                          \
         unsigned e;                                                     \
         uint32_t addr;                                                  \
+        int mmu_idx = arm_to_core_mmu_idx(arm_mmu_idx(env));            \
+        MemOpIdx oi = make_memop_idx(MFLAG | MO_ALIGN, mmu_idx);        \
         for (e = 0; e < 16 / ESIZE; e++, mask >>= ESIZE, eci_mask >>= ESIZE) { \
             if (!(eci_mask & 1)) {                                      \
                 continue;                                               \
             }                                                           \
             addr = ADDRFN(base, m[H##ESIZE(e)]);                        \
             d[H##ESIZE(e)] = (mask & 1) ?                               \
-                cpu_##LDTYPE##_data_ra(env, addr, GETPC()) : 0;         \
+                (MTYPE)cpu_##LDTYPE##_mmu(env, addr, oi, GETPC()) : 0;  \
             if (WB) {                                                   \
                 m[H##ESIZE(e)] = addr;                                  \
             }                                                           \
@@ -286,13 +288,15 @@ DO_VSTR(vstrh_w, MO_TEUW, 2, stw, 4, int32_t)
         uint16_t eci_mask = mve_eci_mask(env);                          \
         unsigned e;                                                     \
         uint32_t addr;                                                  \
+        int mmu_idx = arm_to_core_mmu_idx(arm_mmu_idx(env));            \
+        MemOpIdx oi = make_memop_idx(MO_TEUL | MO_ALIGN, mmu_idx);      \
         for (e = 0; e < 16 / 4; e++, mask >>= 4, eci_mask >>= 4) {      \
             if (!(eci_mask & 1)) {                                      \
                 continue;                                               \
             }                                                           \
             addr = ADDRFN(base, m[H4(e & ~1)]);                         \
             addr += 4 * (e & 1);                                        \
-            d[H4(e)] = (mask & 1) ? cpu_ldl_data_ra(env, addr, GETPC()) : 0; \
+            d[H4(e)] = (mask & 1) ? cpu_ldl_mmu(env, addr, oi, GETPC()) : 0; \
             if (WB && (e & 1)) {                                        \
                 m[H4(e & ~1)] = addr - 4;                               \
             }                                                           \
@@ -331,22 +335,26 @@ DO_VSTR(vstrh_w, MO_TEUW, 2, stw, 4, int32_t)
 #define ADDR_ADD_OSW(BASE, OFFSET) ((BASE) + ((OFFSET) << 2))
 #define ADDR_ADD_OSD(BASE, OFFSET) ((BASE) + ((OFFSET) << 3))
 
-DO_VLDR_SG(vldrb_sg_sh, ldsb, 2, int16_t, uint16_t, ADDR_ADD, false)
-DO_VLDR_SG(vldrb_sg_sw, ldsb, 4, int32_t, uint32_t, ADDR_ADD, false)
-DO_VLDR_SG(vldrh_sg_sw, ldsw, 4, int32_t, uint32_t, ADDR_ADD, false)
+DO_VLDR_SG(vldrb_sg_sh, MO_SB, int8_t, ldb, 2, int16_t, uint16_t, ADDR_ADD, false)
+DO_VLDR_SG(vldrb_sg_sw, MO_SB, int8_t, ldb, 4, int32_t, uint32_t, ADDR_ADD, false)
+DO_VLDR_SG(vldrh_sg_sw, MO_TESW, int16_t, ldw, 4, int32_t, uint32_t, ADDR_ADD, false)
 
-DO_VLDR_SG(vldrb_sg_ub, ldub, 1, uint8_t, uint8_t, ADDR_ADD, false)
-DO_VLDR_SG(vldrb_sg_uh, ldub, 2, uint16_t, uint16_t, ADDR_ADD, false)
-DO_VLDR_SG(vldrb_sg_uw, ldub, 4, uint32_t, uint32_t, ADDR_ADD, false)
-DO_VLDR_SG(vldrh_sg_uh, lduw, 2, uint16_t, uint16_t, ADDR_ADD, false)
-DO_VLDR_SG(vldrh_sg_uw, lduw, 4, uint32_t, uint32_t, ADDR_ADD, false)
-DO_VLDR_SG(vldrw_sg_uw, ldl, 4, uint32_t, uint32_t, ADDR_ADD, false)
+DO_VLDR_SG(vldrb_sg_ub, MO_UB, uint8_t, ldb, 1, uint8_t, uint8_t, ADDR_ADD, false)
+DO_VLDR_SG(vldrb_sg_uh, MO_UB, uint8_t, ldb, 2, uint16_t, uint16_t, ADDR_ADD, false)
+DO_VLDR_SG(vldrb_sg_uw, MO_UB, uint8_t, ldb, 4, uint32_t, uint32_t, ADDR_ADD, false)
+DO_VLDR_SG(vldrh_sg_uh, MO_TEUW, uint16_t, ldw, 2, uint16_t, uint16_t, ADDR_ADD, false)
+DO_VLDR_SG(vldrh_sg_uw, MO_TEUW, uint16_t, ldw, 4, uint32_t, uint32_t, ADDR_ADD, false)
+DO_VLDR_SG(vldrw_sg_uw, MO_TEUL, uint32_t, ldl, 4, uint32_t, uint32_t, ADDR_ADD, false)
 DO_VLDR64_SG(vldrd_sg_ud, ADDR_ADD, false)
 
-DO_VLDR_SG(vldrh_sg_os_sw, ldsw, 4, int32_t, uint32_t, ADDR_ADD_OSH, false)
-DO_VLDR_SG(vldrh_sg_os_uh, lduw, 2, uint16_t, uint16_t, ADDR_ADD_OSH, false)
-DO_VLDR_SG(vldrh_sg_os_uw, lduw, 4, uint32_t, uint32_t, ADDR_ADD_OSH, false)
-DO_VLDR_SG(vldrw_sg_os_uw, ldl, 4, uint32_t, uint32_t, ADDR_ADD_OSW, false)
+DO_VLDR_SG(vldrh_sg_os_sw, MO_TESW, int16_t, ldw, 4,
+           int32_t, uint32_t, ADDR_ADD_OSH, false)
+DO_VLDR_SG(vldrh_sg_os_uh, MO_TEUW, uint16_t, ldw, 2,
+           uint16_t, uint16_t, ADDR_ADD_OSH, false)
+DO_VLDR_SG(vldrh_sg_os_uw, MO_TEUW, uint16_t, ldw, 4,
+           uint32_t, uint32_t, ADDR_ADD_OSH, false)
+DO_VLDR_SG(vldrw_sg_os_uw, MO_TEUL, uint32_t, ldl, 4,
+           uint32_t, uint32_t, ADDR_ADD_OSW, false)
 DO_VLDR64_SG(vldrd_sg_os_ud, ADDR_ADD_OSD, false)
 
 DO_VSTR_SG(vstrb_sg_ub, stb, 1, uint8_t, ADDR_ADD, false)
@@ -362,7 +370,7 @@ DO_VSTR_SG(vstrh_sg_os_uw, stw, 4, uint32_t, ADDR_ADD_OSH, false)
 DO_VSTR_SG(vstrw_sg_os_uw, stl, 4, uint32_t, ADDR_ADD_OSW, false)
 DO_VSTR64_SG(vstrd_sg_os_ud, ADDR_ADD_OSD, false)
 
-DO_VLDR_SG(vldrw_sg_wb_uw, ldl, 4, uint32_t, uint32_t, ADDR_ADD, true)
+DO_VLDR_SG(vldrw_sg_wb_uw, MO_TEUL, uint32_t, ldl, 4, uint32_t, uint32_t, ADDR_ADD, true)
 DO_VLDR64_SG(vldrd_sg_wb_ud, ADDR_ADD, true)
 DO_VSTR_SG(vstrw_sg_wb_uw, stl, 4, uint32_t, ADDR_ADD, true)
 DO_VSTR64_SG(vstrd_sg_wb_ud, ADDR_ADD, true)

From 13ab3764ea0c0e43e2258e1755c08551c8eb8e60 Mon Sep 17 00:00:00 2001
From: William Kosasih <kosasihwilliam4@gmail.com>
Date: Thu, 3 Jul 2025 18:26:00 +0930
Subject: [PATCH 1932/2760] target/arm: Fix VSTR_SG helper store alignment
 checks

This patch adds alignment checks in the store operations in the VSTR_SG
instructions.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1154
Signed-off-by: William Kosasih <kosasihwilliam4@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250703085604.154449-8-kosasihwilliam4@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/mve_helper.c | 30 +++++++++++++++++-------------
 1 file changed, 17 insertions(+), 13 deletions(-)

diff --git a/target/arm/tcg/mve_helper.c b/target/arm/tcg/mve_helper.c
index 633f511a7e..2d21625f24 100644
--- a/target/arm/tcg/mve_helper.c
+++ b/target/arm/tcg/mve_helper.c
@@ -245,7 +245,7 @@ DO_VSTR(vstrh_w, MO_TEUW, 2, stw, 4, int32_t)
     }
 
 /* We know here TYPE is unsigned so always the same as the offset type */
-#define DO_VSTR_SG(OP, STTYPE, ESIZE, TYPE, ADDRFN, WB)                 \
+#define DO_VSTR_SG(OP, MFLAG, STTYPE, ESIZE, TYPE, ADDRFN, WB)          \
     void HELPER(mve_##OP)(CPUARMState *env, void *vd, void *vm,         \
                           uint32_t base)                                \
     {                                                                   \
@@ -255,13 +255,15 @@ DO_VSTR(vstrh_w, MO_TEUW, 2, stw, 4, int32_t)
         uint16_t eci_mask = mve_eci_mask(env);                          \
         unsigned e;                                                     \
         uint32_t addr;                                                  \
+        int mmu_idx = arm_to_core_mmu_idx(arm_mmu_idx(env));            \
+        MemOpIdx oi = make_memop_idx(MFLAG | MO_ALIGN, mmu_idx);        \
         for (e = 0; e < 16 / ESIZE; e++, mask >>= ESIZE, eci_mask >>= ESIZE) { \
             if (!(eci_mask & 1)) {                                      \
                 continue;                                               \
             }                                                           \
             addr = ADDRFN(base, m[H##ESIZE(e)]);                        \
             if (mask & 1) {                                             \
-                cpu_##STTYPE##_data_ra(env, addr, d[H##ESIZE(e)], GETPC()); \
+                cpu_##STTYPE##_mmu(env, addr, d[H##ESIZE(e)], oi, GETPC()); \
             }                                                           \
             if (WB) {                                                   \
                 m[H##ESIZE(e)] = addr;                                  \
@@ -314,6 +316,8 @@ DO_VSTR(vstrh_w, MO_TEUW, 2, stw, 4, int32_t)
         uint16_t eci_mask = mve_eci_mask(env);                          \
         unsigned e;                                                     \
         uint32_t addr;                                                  \
+        int mmu_idx = arm_to_core_mmu_idx(arm_mmu_idx(env));            \
+        MemOpIdx oi = make_memop_idx(MO_TEUL | MO_ALIGN, mmu_idx);      \
         for (e = 0; e < 16 / 4; e++, mask >>= 4, eci_mask >>= 4) {      \
             if (!(eci_mask & 1)) {                                      \
                 continue;                                               \
@@ -321,7 +325,7 @@ DO_VSTR(vstrh_w, MO_TEUW, 2, stw, 4, int32_t)
             addr = ADDRFN(base, m[H4(e & ~1)]);                         \
             addr += 4 * (e & 1);                                        \
             if (mask & 1) {                                             \
-                cpu_stl_data_ra(env, addr, d[H4(e)], GETPC());          \
+                cpu_stl_mmu(env, addr, d[H4(e)], oi, GETPC());          \
             }                                                           \
             if (WB && (e & 1)) {                                        \
                 m[H4(e & ~1)] = addr - 4;                               \
@@ -357,22 +361,22 @@ DO_VLDR_SG(vldrw_sg_os_uw, MO_TEUL, uint32_t, ldl, 4,
            uint32_t, uint32_t, ADDR_ADD_OSW, false)
 DO_VLDR64_SG(vldrd_sg_os_ud, ADDR_ADD_OSD, false)
 
-DO_VSTR_SG(vstrb_sg_ub, stb, 1, uint8_t, ADDR_ADD, false)
-DO_VSTR_SG(vstrb_sg_uh, stb, 2, uint16_t, ADDR_ADD, false)
-DO_VSTR_SG(vstrb_sg_uw, stb, 4, uint32_t, ADDR_ADD, false)
-DO_VSTR_SG(vstrh_sg_uh, stw, 2, uint16_t, ADDR_ADD, false)
-DO_VSTR_SG(vstrh_sg_uw, stw, 4, uint32_t, ADDR_ADD, false)
-DO_VSTR_SG(vstrw_sg_uw, stl, 4, uint32_t, ADDR_ADD, false)
+DO_VSTR_SG(vstrb_sg_ub, MO_UB, stb, 1, uint8_t, ADDR_ADD, false)
+DO_VSTR_SG(vstrb_sg_uh, MO_UB, stb, 2, uint16_t, ADDR_ADD, false)
+DO_VSTR_SG(vstrb_sg_uw, MO_UB, stb, 4, uint32_t, ADDR_ADD, false)
+DO_VSTR_SG(vstrh_sg_uh, MO_TEUW, stw, 2, uint16_t, ADDR_ADD, false)
+DO_VSTR_SG(vstrh_sg_uw, MO_TEUW, stw, 4, uint32_t, ADDR_ADD, false)
+DO_VSTR_SG(vstrw_sg_uw, MO_TEUL, stl, 4, uint32_t, ADDR_ADD, false)
 DO_VSTR64_SG(vstrd_sg_ud, ADDR_ADD, false)
 
-DO_VSTR_SG(vstrh_sg_os_uh, stw, 2, uint16_t, ADDR_ADD_OSH, false)
-DO_VSTR_SG(vstrh_sg_os_uw, stw, 4, uint32_t, ADDR_ADD_OSH, false)
-DO_VSTR_SG(vstrw_sg_os_uw, stl, 4, uint32_t, ADDR_ADD_OSW, false)
+DO_VSTR_SG(vstrh_sg_os_uh, MO_TEUW, stw, 2, uint16_t, ADDR_ADD_OSH, false)
+DO_VSTR_SG(vstrh_sg_os_uw, MO_TEUW, stw, 4, uint32_t, ADDR_ADD_OSH, false)
+DO_VSTR_SG(vstrw_sg_os_uw, MO_TEUL, stl, 4, uint32_t, ADDR_ADD_OSW, false)
 DO_VSTR64_SG(vstrd_sg_os_ud, ADDR_ADD_OSD, false)
 
 DO_VLDR_SG(vldrw_sg_wb_uw, MO_TEUL, uint32_t, ldl, 4, uint32_t, uint32_t, ADDR_ADD, true)
 DO_VLDR64_SG(vldrd_sg_wb_ud, ADDR_ADD, true)
-DO_VSTR_SG(vstrw_sg_wb_uw, stl, 4, uint32_t, ADDR_ADD, true)
+DO_VSTR_SG(vstrw_sg_wb_uw, MO_TEUL, stl, 4, uint32_t, ADDR_ADD, true)
 DO_VSTR64_SG(vstrd_sg_wb_ud, ADDR_ADD, true)
 
 /*

From a7498d625fb18d44a42b87af6051295259142437 Mon Sep 17 00:00:00 2001
From: William Kosasih <kosasihwilliam4@gmail.com>
Date: Thu, 3 Jul 2025 18:26:01 +0930
Subject: [PATCH 1933/2760] target/arm: Fix VLD4 helper load alignment checks

This patch adds alignment checks in the load operations in the VLD4
instruction.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1154
Signed-off-by: William Kosasih <kosasihwilliam4@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250703085604.154449-9-kosasihwilliam4@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/mve_helper.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/target/arm/tcg/mve_helper.c b/target/arm/tcg/mve_helper.c
index 2d21625f24..7069910db4 100644
--- a/target/arm/tcg/mve_helper.c
+++ b/target/arm/tcg/mve_helper.c
@@ -403,13 +403,15 @@ DO_VSTR64_SG(vstrd_sg_wb_ud, ADDR_ADD, true)
         uint16_t mask = mve_eci_mask(env);                              \
         static const uint8_t off[4] = { O1, O2, O3, O4 };               \
         uint32_t addr, data;                                            \
+        int mmu_idx = arm_to_core_mmu_idx(arm_mmu_idx(env));            \
+        MemOpIdx oi = make_memop_idx(MO_TEUL | MO_ALIGN, mmu_idx);      \
         for (beat = 0; beat < 4; beat++, mask >>= 4) {                  \
             if ((mask & 1) == 0) {                                      \
                 /* ECI says skip this beat */                           \
                 continue;                                               \
             }                                                           \
             addr = base + off[beat] * 4;                                \
-            data = cpu_ldl_le_data_ra(env, addr, GETPC());              \
+            data = cpu_ldl_mmu(env, addr, oi, GETPC());                 \
             for (e = 0; e < 4; e++, data >>= 8) {                       \
                 uint8_t *qd = (uint8_t *)aa32_vfp_qreg(env, qnidx + e); \
                 qd[H1(off[beat])] = data;                               \
@@ -427,13 +429,15 @@ DO_VSTR64_SG(vstrd_sg_wb_ud, ADDR_ADD, true)
         uint32_t addr, data;                                            \
         int y; /* y counts 0 2 0 2 */                                   \
         uint16_t *qd;                                                   \
+        int mmu_idx = arm_to_core_mmu_idx(arm_mmu_idx(env));            \
+        MemOpIdx oi = make_memop_idx(MO_TEUL | MO_ALIGN, mmu_idx);      \
         for (beat = 0, y = 0; beat < 4; beat++, mask >>= 4, y ^= 2) {   \
             if ((mask & 1) == 0) {                                      \
                 /* ECI says skip this beat */                           \
                 continue;                                               \
             }                                                           \
             addr = base + off[beat] * 8 + (beat & 1) * 4;               \
-            data = cpu_ldl_le_data_ra(env, addr, GETPC());              \
+            data = cpu_ldl_mmu(env, addr, oi, GETPC());                 \
             qd = (uint16_t *)aa32_vfp_qreg(env, qnidx + y);             \
             qd[H2(off[beat])] = data;                                   \
             data >>= 16;                                                \
@@ -452,13 +456,15 @@ DO_VSTR64_SG(vstrd_sg_wb_ud, ADDR_ADD, true)
         uint32_t addr, data;                                            \
         uint32_t *qd;                                                   \
         int y;                                                          \
+        int mmu_idx = arm_to_core_mmu_idx(arm_mmu_idx(env));            \
+        MemOpIdx oi = make_memop_idx(MO_TEUL | MO_ALIGN, mmu_idx);      \
         for (beat = 0; beat < 4; beat++, mask >>= 4) {                  \
             if ((mask & 1) == 0) {                                      \
                 /* ECI says skip this beat */                           \
                 continue;                                               \
             }                                                           \
             addr = base + off[beat] * 4;                                \
-            data = cpu_ldl_le_data_ra(env, addr, GETPC());              \
+            data = cpu_ldl_mmu(env, addr, oi, GETPC());                 \
             y = (beat + (O1 & 2)) & 3;                                  \
             qd = (uint32_t *)aa32_vfp_qreg(env, qnidx + y);             \
             qd[H4(off[beat] >> 2)] = data;                              \

From 26aa0e36bfdbbc0f4b07b4ea51e910c4dc43e890 Mon Sep 17 00:00:00 2001
From: William Kosasih <kosasihwilliam4@gmail.com>
Date: Thu, 3 Jul 2025 18:26:02 +0930
Subject: [PATCH 1934/2760] target/arm: Fix VLD2 helper load alignment checks

This patch adds alignment checks in the load operations in the VLD2
instruction.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1154
Signed-off-by: William Kosasih <kosasihwilliam4@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250703085604.154449-10-kosasihwilliam4@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/mve_helper.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/target/arm/tcg/mve_helper.c b/target/arm/tcg/mve_helper.c
index 7069910db4..7473dfad2d 100644
--- a/target/arm/tcg/mve_helper.c
+++ b/target/arm/tcg/mve_helper.c
@@ -495,13 +495,15 @@ DO_VLD4W(vld43w, 6, 7, 8, 9)
         static const uint8_t off[4] = { O1, O2, O3, O4 };               \
         uint32_t addr, data;                                            \
         uint8_t *qd;                                                    \
+        int mmu_idx = arm_to_core_mmu_idx(arm_mmu_idx(env));            \
+        MemOpIdx oi = make_memop_idx(MO_TEUL | MO_ALIGN, mmu_idx);      \
         for (beat = 0; beat < 4; beat++, mask >>= 4) {                  \
             if ((mask & 1) == 0) {                                      \
                 /* ECI says skip this beat */                           \
                 continue;                                               \
             }                                                           \
             addr = base + off[beat] * 2;                                \
-            data = cpu_ldl_le_data_ra(env, addr, GETPC());              \
+            data = cpu_ldl_mmu(env, addr, oi, GETPC());                 \
             for (e = 0; e < 4; e++, data >>= 8) {                       \
                 qd = (uint8_t *)aa32_vfp_qreg(env, qnidx + (e & 1));    \
                 qd[H1(off[beat] + (e >> 1))] = data;                    \
@@ -519,13 +521,15 @@ DO_VLD4W(vld43w, 6, 7, 8, 9)
         uint32_t addr, data;                                            \
         int e;                                                          \
         uint16_t *qd;                                                   \
+        int mmu_idx = arm_to_core_mmu_idx(arm_mmu_idx(env));            \
+        MemOpIdx oi = make_memop_idx(MO_TEUL | MO_ALIGN, mmu_idx);      \
         for (beat = 0; beat < 4; beat++, mask >>= 4) {                  \
             if ((mask & 1) == 0) {                                      \
                 /* ECI says skip this beat */                           \
                 continue;                                               \
             }                                                           \
             addr = base + off[beat] * 4;                                \
-            data = cpu_ldl_le_data_ra(env, addr, GETPC());              \
+            data = cpu_ldl_mmu(env, addr, oi, GETPC());                 \
             for (e = 0; e < 2; e++, data >>= 16) {                      \
                 qd = (uint16_t *)aa32_vfp_qreg(env, qnidx + e);         \
                 qd[H2(off[beat])] = data;                               \
@@ -542,13 +546,15 @@ DO_VLD4W(vld43w, 6, 7, 8, 9)
         static const uint8_t off[4] = { O1, O2, O3, O4 };               \
         uint32_t addr, data;                                            \
         uint32_t *qd;                                                   \
+        int mmu_idx = arm_to_core_mmu_idx(arm_mmu_idx(env));            \
+        MemOpIdx oi = make_memop_idx(MO_TEUL | MO_ALIGN, mmu_idx);      \
         for (beat = 0; beat < 4; beat++, mask >>= 4) {                  \
             if ((mask & 1) == 0) {                                      \
                 /* ECI says skip this beat */                           \
                 continue;                                               \
             }                                                           \
             addr = base + off[beat];                                    \
-            data = cpu_ldl_le_data_ra(env, addr, GETPC());              \
+            data = cpu_ldl_mmu(env, addr, oi, GETPC());                 \
             qd = (uint32_t *)aa32_vfp_qreg(env, qnidx + (beat & 1));    \
             qd[H4(off[beat] >> 3)] = data;                              \
         }                                                               \

From 28b3745991add8c3488c0c984bf17a235d70329b Mon Sep 17 00:00:00 2001
From: William Kosasih <kosasihwilliam4@gmail.com>
Date: Thu, 3 Jul 2025 18:26:03 +0930
Subject: [PATCH 1935/2760] target/arm: Fix VST4 helper store alignment checks

This patch adds alignment checks in the store operations in the VST4
instruction.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1154
Signed-off-by: William Kosasih <kosasihwilliam4@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250703085604.154449-11-kosasihwilliam4@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/mve_helper.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/target/arm/tcg/mve_helper.c b/target/arm/tcg/mve_helper.c
index 7473dfad2d..5273411389 100644
--- a/target/arm/tcg/mve_helper.c
+++ b/target/arm/tcg/mve_helper.c
@@ -577,6 +577,8 @@ DO_VLD2W(vld21w, 8, 12, 16, 20)
         uint16_t mask = mve_eci_mask(env);                              \
         static const uint8_t off[4] = { O1, O2, O3, O4 };               \
         uint32_t addr, data;                                            \
+        int mmu_idx = arm_to_core_mmu_idx(arm_mmu_idx(env));            \
+        MemOpIdx oi = make_memop_idx(MO_TEUL | MO_ALIGN, mmu_idx);      \
         for (beat = 0; beat < 4; beat++, mask >>= 4) {                  \
             if ((mask & 1) == 0) {                                      \
                 /* ECI says skip this beat */                           \
@@ -588,7 +590,7 @@ DO_VLD2W(vld21w, 8, 12, 16, 20)
                 uint8_t *qd = (uint8_t *)aa32_vfp_qreg(env, qnidx + e); \
                 data = (data << 8) | qd[H1(off[beat])];                 \
             }                                                           \
-            cpu_stl_le_data_ra(env, addr, data, GETPC());               \
+            cpu_stl_mmu(env, addr, data, oi, GETPC());                  \
         }                                                               \
     }
 
@@ -602,6 +604,8 @@ DO_VLD2W(vld21w, 8, 12, 16, 20)
         uint32_t addr, data;                                            \
         int y; /* y counts 0 2 0 2 */                                   \
         uint16_t *qd;                                                   \
+        int mmu_idx = arm_to_core_mmu_idx(arm_mmu_idx(env));            \
+        MemOpIdx oi = make_memop_idx(MO_TEUL | MO_ALIGN, mmu_idx);      \
         for (beat = 0, y = 0; beat < 4; beat++, mask >>= 4, y ^= 2) {   \
             if ((mask & 1) == 0) {                                      \
                 /* ECI says skip this beat */                           \
@@ -612,7 +616,7 @@ DO_VLD2W(vld21w, 8, 12, 16, 20)
             data = qd[H2(off[beat])];                                   \
             qd = (uint16_t *)aa32_vfp_qreg(env, qnidx + y + 1);         \
             data |= qd[H2(off[beat])] << 16;                            \
-            cpu_stl_le_data_ra(env, addr, data, GETPC());               \
+            cpu_stl_mmu(env, addr, data, oi, GETPC());                  \
         }                                                               \
     }
 
@@ -626,6 +630,8 @@ DO_VLD2W(vld21w, 8, 12, 16, 20)
         uint32_t addr, data;                                            \
         uint32_t *qd;                                                   \
         int y;                                                          \
+        int mmu_idx = arm_to_core_mmu_idx(arm_mmu_idx(env));            \
+        MemOpIdx oi = make_memop_idx(MO_TEUL | MO_ALIGN, mmu_idx);      \
         for (beat = 0; beat < 4; beat++, mask >>= 4) {                  \
             if ((mask & 1) == 0) {                                      \
                 /* ECI says skip this beat */                           \
@@ -635,7 +641,7 @@ DO_VLD2W(vld21w, 8, 12, 16, 20)
             y = (beat + (O1 & 2)) & 3;                                  \
             qd = (uint32_t *)aa32_vfp_qreg(env, qnidx + y);             \
             data = qd[H4(off[beat] >> 2)];                              \
-            cpu_stl_le_data_ra(env, addr, data, GETPC());               \
+            cpu_stl_mmu(env, addr, data, oi, GETPC());                  \
         }                                                               \
     }
 

From c9bc9f57ffbafea6bb9fe45610b9a1e9ff33e990 Mon Sep 17 00:00:00 2001
From: William Kosasih <kosasihwilliam4@gmail.com>
Date: Thu, 3 Jul 2025 18:26:04 +0930
Subject: [PATCH 1936/2760] target/arm: Fix VST2 helper store alignment checks

This patch adds alignment checks in the store operations in the VST2
instruction.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1154
Signed-off-by: William Kosasih <kosasihwilliam4@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250703085604.154449-12-kosasihwilliam4@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/mve_helper.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/target/arm/tcg/mve_helper.c b/target/arm/tcg/mve_helper.c
index 5273411389..42bb3b979b 100644
--- a/target/arm/tcg/mve_helper.c
+++ b/target/arm/tcg/mve_helper.c
@@ -669,6 +669,8 @@ DO_VST4W(vst43w, 6, 7, 8, 9)
         static const uint8_t off[4] = { O1, O2, O3, O4 };               \
         uint32_t addr, data;                                            \
         uint8_t *qd;                                                    \
+        int mmu_idx = arm_to_core_mmu_idx(arm_mmu_idx(env));            \
+        MemOpIdx oi = make_memop_idx(MO_TEUL | MO_ALIGN, mmu_idx);      \
         for (beat = 0; beat < 4; beat++, mask >>= 4) {                  \
             if ((mask & 1) == 0) {                                      \
                 /* ECI says skip this beat */                           \
@@ -680,7 +682,7 @@ DO_VST4W(vst43w, 6, 7, 8, 9)
                 qd = (uint8_t *)aa32_vfp_qreg(env, qnidx + (e & 1));    \
                 data = (data << 8) | qd[H1(off[beat] + (e >> 1))];      \
             }                                                           \
-            cpu_stl_le_data_ra(env, addr, data, GETPC());               \
+            cpu_stl_mmu(env, addr, data, oi, GETPC());                  \
         }                                                               \
     }
 
@@ -694,6 +696,8 @@ DO_VST4W(vst43w, 6, 7, 8, 9)
         uint32_t addr, data;                                            \
         int e;                                                          \
         uint16_t *qd;                                                   \
+        int mmu_idx = arm_to_core_mmu_idx(arm_mmu_idx(env));            \
+        MemOpIdx oi = make_memop_idx(MO_TEUL | MO_ALIGN, mmu_idx);      \
         for (beat = 0; beat < 4; beat++, mask >>= 4) {                  \
             if ((mask & 1) == 0) {                                      \
                 /* ECI says skip this beat */                           \
@@ -705,7 +709,7 @@ DO_VST4W(vst43w, 6, 7, 8, 9)
                 qd = (uint16_t *)aa32_vfp_qreg(env, qnidx + e);         \
                 data = (data << 16) | qd[H2(off[beat])];                \
             }                                                           \
-            cpu_stl_le_data_ra(env, addr, data, GETPC());               \
+            cpu_stl_mmu(env, addr, data, oi, GETPC());                  \
         }                                                               \
     }
 
@@ -718,6 +722,8 @@ DO_VST4W(vst43w, 6, 7, 8, 9)
         static const uint8_t off[4] = { O1, O2, O3, O4 };               \
         uint32_t addr, data;                                            \
         uint32_t *qd;                                                   \
+        int mmu_idx = arm_to_core_mmu_idx(arm_mmu_idx(env));            \
+        MemOpIdx oi = make_memop_idx(MO_TEUL | MO_ALIGN, mmu_idx);      \
         for (beat = 0; beat < 4; beat++, mask >>= 4) {                  \
             if ((mask & 1) == 0) {                                      \
                 /* ECI says skip this beat */                           \
@@ -726,7 +732,7 @@ DO_VST4W(vst43w, 6, 7, 8, 9)
             addr = base + off[beat];                                    \
             qd = (uint32_t *)aa32_vfp_qreg(env, qnidx + (beat & 1));    \
             data = qd[H4(off[beat] >> 3)];                              \
-            cpu_stl_le_data_ra(env, addr, data, GETPC());               \
+            cpu_stl_mmu(env, addr, data, oi, GETPC());                  \
         }                                                               \
     }
 

From 9d01d2e86d450f12f275bd64aeb022e8423e220c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 6 Jun 2025 12:24:41 +0200
Subject: [PATCH 1937/2760] accel: Propagate AccelState to
 AccelClass::init_machine()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In order to avoid init_machine() to call current_accel(),
pass AccelState along.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Message-Id: <20250703173248.44995-31-philmd@linaro.org>
---
 accel/accel-system.c        | 2 +-
 accel/hvf/hvf-all.c         | 2 +-
 accel/kvm/kvm-all.c         | 2 +-
 accel/qtest/qtest.c         | 2 +-
 accel/tcg/tcg-all.c         | 2 +-
 accel/xen/xen-all.c         | 2 +-
 bsd-user/main.c             | 2 +-
 include/qemu/accel.h        | 2 +-
 linux-user/main.c           | 2 +-
 target/i386/nvmm/nvmm-all.c | 2 +-
 target/i386/whpx/whpx-all.c | 2 +-
 11 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/accel/accel-system.c b/accel/accel-system.c
index 64bc991b1c..913b7155d7 100644
--- a/accel/accel-system.c
+++ b/accel/accel-system.c
@@ -37,7 +37,7 @@ int accel_init_machine(AccelState *accel, MachineState *ms)
     int ret;
     ms->accelerator = accel;
     *(acc->allowed) = true;
-    ret = acc->init_machine(ms);
+    ret = acc->init_machine(accel, ms);
     if (ret < 0) {
         ms->accelerator = NULL;
         *(acc->allowed) = false;
diff --git a/accel/hvf/hvf-all.c b/accel/hvf/hvf-all.c
index 09fe3f2415..9e4012e2d1 100644
--- a/accel/hvf/hvf-all.c
+++ b/accel/hvf/hvf-all.c
@@ -247,7 +247,7 @@ static MemoryListener hvf_memory_listener = {
     .log_sync = hvf_log_sync,
 };
 
-static int hvf_accel_init(MachineState *ms)
+static int hvf_accel_init(AccelState *as, MachineState *ms)
 {
     int x;
     hv_return_t ret;
diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index 17235f2646..264f288dc6 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -2573,7 +2573,7 @@ static int kvm_setup_dirty_ring(KVMState *s)
     return 0;
 }
 
-static int kvm_init(MachineState *ms)
+static int kvm_init(AccelState *as, MachineState *ms)
 {
     MachineClass *mc = MACHINE_GET_CLASS(ms);
     static const char upgrade_note[] =
diff --git a/accel/qtest/qtest.c b/accel/qtest/qtest.c
index 5474ce7313..2b83126020 100644
--- a/accel/qtest/qtest.c
+++ b/accel/qtest/qtest.c
@@ -38,7 +38,7 @@ static void qtest_set_virtual_clock(int64_t count)
     qatomic_set_i64(&qtest_clock_counter, count);
 }
 
-static int qtest_init_accel(MachineState *ms)
+static int qtest_init_accel(AccelState *as, MachineState *ms)
 {
     return 0;
 }
diff --git a/accel/tcg/tcg-all.c b/accel/tcg/tcg-all.c
index 6e5dc333d5..d68fbb2377 100644
--- a/accel/tcg/tcg-all.c
+++ b/accel/tcg/tcg-all.c
@@ -80,7 +80,7 @@ static void tcg_accel_instance_init(Object *obj)
 
 bool one_insn_per_tb;
 
-static int tcg_init_machine(MachineState *ms)
+static int tcg_init_machine(AccelState *as, MachineState *ms)
 {
     TCGState *s = TCG_STATE(current_accel());
     unsigned max_threads = 1;
diff --git a/accel/xen/xen-all.c b/accel/xen/xen-all.c
index c12c22de78..8279746f11 100644
--- a/accel/xen/xen-all.c
+++ b/accel/xen/xen-all.c
@@ -77,7 +77,7 @@ static void xen_setup_post(MachineState *ms, AccelState *accel)
     }
 }
 
-static int xen_init(MachineState *ms)
+static int xen_init(AccelState *as, MachineState *ms)
 {
     MachineClass *mc = MACHINE_GET_CLASS(ms);
 
diff --git a/bsd-user/main.c b/bsd-user/main.c
index 7c0a059c3b..d0cc8e0088 100644
--- a/bsd-user/main.c
+++ b/bsd-user/main.c
@@ -474,7 +474,7 @@ int main(int argc, char **argv)
                                  opt_one_insn_per_tb, &error_abort);
         object_property_set_int(OBJECT(accel), "tb-size",
                                 opt_tb_size, &error_abort);
-        ac->init_machine(NULL);
+        ac->init_machine(accel, NULL);
     }
 
     /*
diff --git a/include/qemu/accel.h b/include/qemu/accel.h
index 9dea314542..b9a9b3593d 100644
--- a/include/qemu/accel.h
+++ b/include/qemu/accel.h
@@ -40,7 +40,7 @@ typedef struct AccelClass {
     /* Cached by accel_init_ops_interfaces() when created */
     AccelOpsClass *ops;
 
-    int (*init_machine)(MachineState *ms);
+    int (*init_machine)(AccelState *as, MachineState *ms);
     bool (*cpu_common_realize)(CPUState *cpu, Error **errp);
     void (*cpu_common_unrealize)(CPUState *cpu);
 
diff --git a/linux-user/main.c b/linux-user/main.c
index 5ac5b55dc6..a9142ee726 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -820,7 +820,7 @@ int main(int argc, char **argv, char **envp)
                                  opt_one_insn_per_tb, &error_abort);
         object_property_set_int(OBJECT(accel), "tb-size",
                                 opt_tb_size, &error_abort);
-        ac->init_machine(NULL);
+        ac->init_machine(accel, NULL);
     }
 
     /*
diff --git a/target/i386/nvmm/nvmm-all.c b/target/i386/nvmm/nvmm-all.c
index 2df49d7eeb..b4a4d50e86 100644
--- a/target/i386/nvmm/nvmm-all.c
+++ b/target/i386/nvmm/nvmm-all.c
@@ -1152,7 +1152,7 @@ static struct RAMBlockNotifier nvmm_ram_notifier = {
 /* -------------------------------------------------------------------------- */
 
 static int
-nvmm_accel_init(MachineState *ms)
+nvmm_accel_init(AccelState *as, MachineState *ms)
 {
     int ret, err;
 
diff --git a/target/i386/whpx/whpx-all.c b/target/i386/whpx/whpx-all.c
index 94fd5fc784..721c4782b9 100644
--- a/target/i386/whpx/whpx-all.c
+++ b/target/i386/whpx/whpx-all.c
@@ -2504,7 +2504,7 @@ static void whpx_set_kernel_irqchip(Object *obj, Visitor *v,
  * Partition support
  */
 
-static int whpx_accel_init(MachineState *ms)
+static int whpx_accel_init(AccelState *as, MachineState *ms)
 {
     struct whpx_state *whpx;
     int ret;

From d8878e4fcaf3dfe591b18a06760831c041402d15 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 6 Jun 2025 12:26:56 +0200
Subject: [PATCH 1938/2760] accel/hvf: Re-use QOM allocated state
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250606164418.98655-8-philmd@linaro.org>
---
 accel/hvf/hvf-all.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/accel/hvf/hvf-all.c b/accel/hvf/hvf-all.c
index 9e4012e2d1..df95ba74d6 100644
--- a/accel/hvf/hvf-all.c
+++ b/accel/hvf/hvf-all.c
@@ -251,7 +251,7 @@ static int hvf_accel_init(AccelState *as, MachineState *ms)
 {
     int x;
     hv_return_t ret;
-    HVFState *s;
+    HVFState *s = HVF_STATE(as);
     int pa_range = 36;
     MachineClass *mc = MACHINE_GET_CLASS(ms);
 
@@ -270,8 +270,6 @@ static int hvf_accel_init(AccelState *as, MachineState *ms)
     }
     assert_hvf_ok(ret);
 
-    s = g_new0(HVFState, 1);
-
     s->num_slots = ARRAY_SIZE(s->slots);
     for (x = 0; x < s->num_slots; ++x) {
         s->slots[x].size = 0;

From 7bdeb984cd3a382ec2b22b8b8c4a5207c316482f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 6 Jun 2025 12:29:17 +0200
Subject: [PATCH 1939/2760] accel/tcg: Prefer local AccelState over global
 current_accel()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Message-Id: <20250703173248.44995-33-philmd@linaro.org>
---
 accel/tcg/tcg-all.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/accel/tcg/tcg-all.c b/accel/tcg/tcg-all.c
index d68fbb2377..c674d5bcf7 100644
--- a/accel/tcg/tcg-all.c
+++ b/accel/tcg/tcg-all.c
@@ -82,7 +82,7 @@ bool one_insn_per_tb;
 
 static int tcg_init_machine(AccelState *as, MachineState *ms)
 {
-    TCGState *s = TCG_STATE(current_accel());
+    TCGState *s = TCG_STATE(as);
     unsigned max_threads = 1;
 
 #ifndef CONFIG_USER_ONLY

From 4bc5c9ab62f28f66f83648c82508cce16d805a0d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 6 Jun 2025 12:26:18 +0200
Subject: [PATCH 1940/2760] accel/kvm: Prefer local AccelState over global
 MachineState::accel
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Message-Id: <20250703173248.44995-32-philmd@linaro.org>
---
 accel/kvm/kvm-all.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index 264f288dc6..72fba12d9f 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -2588,15 +2588,13 @@ static int kvm_init(AccelState *as, MachineState *ms)
         { /* end of list */ }
     }, *nc = num_cpus;
     int soft_vcpus_limit, hard_vcpus_limit;
-    KVMState *s;
+    KVMState *s = KVM_STATE(as);
     const KVMCapabilityInfo *missing_cap;
     int ret;
     int type;
 
     qemu_mutex_init(&kml_slots_lock);
 
-    s = KVM_STATE(ms->accelerator);
-
     /*
      * On systems where the kernel can support different base page
      * sizes, host page size may be different from TARGET_PAGE_SIZE,

From 6b1ce32fee6879d1d09070dfde0d14cbbeaced5c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 30 Jun 2025 15:30:24 +0200
Subject: [PATCH 1941/2760] accel/kvm: Directly pass KVMState argument to
 do_kvm_create_vm()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Message-Id: <20250703173248.44995-35-philmd@linaro.org>
---
 accel/kvm/kvm-all.c | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index 72fba12d9f..007f82a50d 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -2470,13 +2470,10 @@ uint32_t kvm_dirty_ring_size(void)
     return kvm_state->kvm_dirty_ring_size;
 }
 
-static int do_kvm_create_vm(MachineState *ms, int type)
+static int do_kvm_create_vm(KVMState *s, int type)
 {
-    KVMState *s;
     int ret;
 
-    s = KVM_STATE(ms->accelerator);
-
     do {
         ret = kvm_ioctl(s, KVM_CREATE_VM, type);
     } while (ret == -EINTR);
@@ -2646,7 +2643,7 @@ static int kvm_init(AccelState *as, MachineState *ms)
         goto err;
     }
 
-    ret = do_kvm_create_vm(ms, type);
+    ret = do_kvm_create_vm(s, type);
     if (ret < 0) {
         goto err;
     }

From 14784d00ce6643077d3b9f24c19cb2882c173ff2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 30 Jun 2025 15:28:08 +0200
Subject: [PATCH 1942/2760] accel: Directly pass AccelState argument to
 AccelClass::has_memory()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Message-Id: <20250703173248.44995-34-philmd@linaro.org>
---
 accel/kvm/kvm-all.c  | 4 ++--
 include/qemu/accel.h | 2 +-
 system/memory.c      | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index 007f82a50d..6f6f9ef69b 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -3786,10 +3786,10 @@ int kvm_get_one_reg(CPUState *cs, uint64_t id, void *target)
     return r;
 }
 
-static bool kvm_accel_has_memory(MachineState *ms, AddressSpace *as,
+static bool kvm_accel_has_memory(AccelState *accel, AddressSpace *as,
                                  hwaddr start_addr, hwaddr size)
 {
-    KVMState *kvm = KVM_STATE(ms->accelerator);
+    KVMState *kvm = KVM_STATE(accel);
     int i;
 
     for (i = 0; i < kvm->nr_as; ++i) {
diff --git a/include/qemu/accel.h b/include/qemu/accel.h
index b9a9b3593d..f327a71282 100644
--- a/include/qemu/accel.h
+++ b/include/qemu/accel.h
@@ -46,7 +46,7 @@ typedef struct AccelClass {
 
     /* system related hooks */
     void (*setup_post)(MachineState *ms, AccelState *accel);
-    bool (*has_memory)(MachineState *ms, AddressSpace *as,
+    bool (*has_memory)(AccelState *accel, AddressSpace *as,
                        hwaddr start_addr, hwaddr size);
 
     /* gdbstub related hooks */
diff --git a/system/memory.c b/system/memory.c
index 76b44b8220..e8d9b15b28 100644
--- a/system/memory.c
+++ b/system/memory.c
@@ -3501,7 +3501,7 @@ static void mtree_print_flatview(gpointer key, gpointer value,
         if (fvi->ac) {
             for (i = 0; i < fv_address_spaces->len; ++i) {
                 as = g_array_index(fv_address_spaces, AddressSpace*, i);
-                if (fvi->ac->has_memory(current_machine, as,
+                if (fvi->ac->has_memory(current_machine->accelerator, as,
                                         int128_get64(range->addr.start),
                                         MR_SIZE(range->addr.size) + 1)) {
                     qemu_printf(" %s", fvi->ac->name);

From c7212fd2ce9182ec205dd22ff5bc66864fb3cd10 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 30 Jun 2025 15:33:25 +0200
Subject: [PATCH 1943/2760] accel: Remove unused MachineState argument of
 AccelClass::setup_post()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This method only accesses xen_domid/xen_domid_restrict, which are both
related to the 'accelerator', not the machine. Besides, xen_domid aims
to be in Xen AccelState and xen_domid_restrict a xen_domid_restrict
QOM property.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Message-Id: <20250703173248.44995-36-philmd@linaro.org>
---
 accel/accel-system.c | 2 +-
 accel/xen/xen-all.c  | 2 +-
 include/qemu/accel.h | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/accel/accel-system.c b/accel/accel-system.c
index 913b7155d7..af713cc902 100644
--- a/accel/accel-system.c
+++ b/accel/accel-system.c
@@ -58,7 +58,7 @@ void accel_setup_post(MachineState *ms)
     AccelState *accel = ms->accelerator;
     AccelClass *acc = ACCEL_GET_CLASS(accel);
     if (acc->setup_post) {
-        acc->setup_post(ms, accel);
+        acc->setup_post(accel);
     }
 }
 
diff --git a/accel/xen/xen-all.c b/accel/xen/xen-all.c
index 8279746f11..bd0ff64bef 100644
--- a/accel/xen/xen-all.c
+++ b/accel/xen/xen-all.c
@@ -64,7 +64,7 @@ static void xen_set_igd_gfx_passthru(Object *obj, bool value, Error **errp)
     xen_igd_gfx_pt_set(value, errp);
 }
 
-static void xen_setup_post(MachineState *ms, AccelState *accel)
+static void xen_setup_post(AccelState *as)
 {
     int rc;
 
diff --git a/include/qemu/accel.h b/include/qemu/accel.h
index f327a71282..a6a95ff0bc 100644
--- a/include/qemu/accel.h
+++ b/include/qemu/accel.h
@@ -45,7 +45,7 @@ typedef struct AccelClass {
     void (*cpu_common_unrealize)(CPUState *cpu);
 
     /* system related hooks */
-    void (*setup_post)(MachineState *ms, AccelState *accel);
+    void (*setup_post)(AccelState *as);
     bool (*has_memory)(AccelState *accel, AddressSpace *as,
                        hwaddr start_addr, hwaddr size);
 

From 261573c7724ffca8795416eae8b435e175672491 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 20 Jun 2025 10:59:21 +0200
Subject: [PATCH 1944/2760] accel: Pass AccelState argument to
 gdbstub_supported_sstep_flags()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In order to have AccelClass methods instrospect their state,
we need to pass AccelState by argument.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Message-Id: <20250703173248.44995-37-philmd@linaro.org>
---
 accel/accel-common.c | 2 +-
 accel/hvf/hvf-all.c  | 2 +-
 accel/kvm/kvm-all.c  | 2 +-
 accel/tcg/tcg-all.c  | 2 +-
 include/qemu/accel.h | 2 +-
 5 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/accel/accel-common.c b/accel/accel-common.c
index 4894b98d64..591ff4cbb6 100644
--- a/accel/accel-common.c
+++ b/accel/accel-common.c
@@ -124,7 +124,7 @@ int accel_supported_gdbstub_sstep_flags(void)
     AccelState *accel = current_accel();
     AccelClass *acc = ACCEL_GET_CLASS(accel);
     if (acc->gdbstub_supported_sstep_flags) {
-        return acc->gdbstub_supported_sstep_flags();
+        return acc->gdbstub_supported_sstep_flags(accel);
     }
     return 0;
 }
diff --git a/accel/hvf/hvf-all.c b/accel/hvf/hvf-all.c
index df95ba74d6..1fa07c8b69 100644
--- a/accel/hvf/hvf-all.c
+++ b/accel/hvf/hvf-all.c
@@ -284,7 +284,7 @@ static int hvf_accel_init(AccelState *as, MachineState *ms)
     return hvf_arch_init();
 }
 
-static int hvf_gdbstub_sstep_flags(void)
+static int hvf_gdbstub_sstep_flags(AccelState *as)
 {
     return SSTEP_ENABLE | SSTEP_NOIRQ;
 }
diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index 6f6f9ef69b..45579f80fa 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -3980,7 +3980,7 @@ static void kvm_accel_instance_init(Object *obj)
  * Returns: SSTEP_* flags that KVM supports for guest debug. The
  * support is probed during kvm_init()
  */
-static int kvm_gdbstub_sstep_flags(void)
+static int kvm_gdbstub_sstep_flags(AccelState *as)
 {
     return kvm_sstep_flags;
 }
diff --git a/accel/tcg/tcg-all.c b/accel/tcg/tcg-all.c
index c674d5bcf7..5904582a68 100644
--- a/accel/tcg/tcg-all.c
+++ b/accel/tcg/tcg-all.c
@@ -219,7 +219,7 @@ static void tcg_set_one_insn_per_tb(Object *obj, bool value, Error **errp)
     qatomic_set(&one_insn_per_tb, value);
 }
 
-static int tcg_gdbstub_supported_sstep_flags(void)
+static int tcg_gdbstub_supported_sstep_flags(AccelState *as)
 {
     /*
      * In replay mode all events will come from the log and can't be
diff --git a/include/qemu/accel.h b/include/qemu/accel.h
index a6a95ff0bc..1c097ac4df 100644
--- a/include/qemu/accel.h
+++ b/include/qemu/accel.h
@@ -50,7 +50,7 @@ typedef struct AccelClass {
                        hwaddr start_addr, hwaddr size);
 
     /* gdbstub related hooks */
-    int (*gdbstub_supported_sstep_flags)(void);
+    int (*gdbstub_supported_sstep_flags)(AccelState *as);
 
     bool *allowed;
     /*

From 9a8e6b9ca1a6cf5aa66f0f7f9620a0b90320b064 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 23 Jun 2025 17:58:39 +0200
Subject: [PATCH 1945/2760] accel/system: Convert pre_resume() from
 AccelOpsClass to AccelClass
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Accelerators call pre_resume() once. Since it isn't a method to
call for each vCPU, move it from AccelOpsClass to AccelClass.
Adapt WHPX.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250702185332.43650-21-philmd@linaro.org>
---
 accel/accel-system.c              | 9 +++++++++
 include/qemu/accel.h              | 3 +++
 include/system/accel-ops.h        | 1 -
 system/cpus.c                     | 4 +---
 target/i386/whpx/whpx-accel-ops.c | 1 -
 target/i386/whpx/whpx-accel-ops.h | 1 -
 target/i386/whpx/whpx-all.c       | 3 ++-
 7 files changed, 15 insertions(+), 7 deletions(-)

diff --git a/accel/accel-system.c b/accel/accel-system.c
index af713cc902..c54c30f18b 100644
--- a/accel/accel-system.c
+++ b/accel/accel-system.c
@@ -62,6 +62,15 @@ void accel_setup_post(MachineState *ms)
     }
 }
 
+void accel_pre_resume(MachineState *ms, bool step_pending)
+{
+    AccelState *accel = ms->accelerator;
+    AccelClass *acc = ACCEL_GET_CLASS(accel);
+    if (acc->pre_resume_vm) {
+        acc->pre_resume_vm(accel, step_pending);
+    }
+}
+
 /* initialize the arch-independent accel operation interfaces */
 void accel_init_ops_interfaces(AccelClass *ac)
 {
diff --git a/include/qemu/accel.h b/include/qemu/accel.h
index 1c097ac4df..9e821d0fae 100644
--- a/include/qemu/accel.h
+++ b/include/qemu/accel.h
@@ -46,6 +46,7 @@ typedef struct AccelClass {
 
     /* system related hooks */
     void (*setup_post)(AccelState *as);
+    void (*pre_resume_vm)(AccelState *as, bool step_pending);
     bool (*has_memory)(AccelState *accel, AddressSpace *as,
                        hwaddr start_addr, hwaddr size);
 
@@ -86,6 +87,8 @@ int accel_init_machine(AccelState *accel, MachineState *ms);
 /* Called just before os_setup_post (ie just before drop OS privs) */
 void accel_setup_post(MachineState *ms);
 
+void accel_pre_resume(MachineState *ms, bool step_pending);
+
 /**
  * accel_cpu_instance_init:
  * @cpu: The CPU that needs to do accel-specific object initializations.
diff --git a/include/system/accel-ops.h b/include/system/accel-ops.h
index a786c7d478..bf7383511d 100644
--- a/include/system/accel-ops.h
+++ b/include/system/accel-ops.h
@@ -61,7 +61,6 @@ struct AccelOpsClass {
      */
     void (*synchronize_state)(CPUState *cpu);
     void (*synchronize_pre_loadvm)(CPUState *cpu);
-    void (*synchronize_pre_resume)(bool step_pending);
 
     /* handle_interrupt is mandatory. */
     void (*handle_interrupt)(CPUState *cpu, int mask);
diff --git a/system/cpus.c b/system/cpus.c
index 0d0eec82a2..8e6da2e060 100644
--- a/system/cpus.c
+++ b/system/cpus.c
@@ -768,9 +768,7 @@ int vm_prepare_start(bool step_pending)
      * WHPX accelerator needs to know whether we are going to step
      * any CPUs, before starting the first one.
      */
-    if (cpus_accel->synchronize_pre_resume) {
-        cpus_accel->synchronize_pre_resume(step_pending);
-    }
+    accel_pre_resume(MACHINE(qdev_get_machine()), step_pending);
 
     /* We are sending this now, but the CPUs will be resumed shortly later */
     qapi_event_send_resume();
diff --git a/target/i386/whpx/whpx-accel-ops.c b/target/i386/whpx/whpx-accel-ops.c
index 31cf15f004..5f4841c9fa 100644
--- a/target/i386/whpx/whpx-accel-ops.c
+++ b/target/i386/whpx/whpx-accel-ops.c
@@ -96,7 +96,6 @@ static void whpx_accel_ops_class_init(ObjectClass *oc, const void *data)
     ops->synchronize_post_init = whpx_cpu_synchronize_post_init;
     ops->synchronize_state = whpx_cpu_synchronize_state;
     ops->synchronize_pre_loadvm = whpx_cpu_synchronize_pre_loadvm;
-    ops->synchronize_pre_resume = whpx_cpu_synchronize_pre_resume;
 }
 
 static const TypeInfo whpx_accel_ops_type = {
diff --git a/target/i386/whpx/whpx-accel-ops.h b/target/i386/whpx/whpx-accel-ops.h
index e6cf15511d..54cfc25a14 100644
--- a/target/i386/whpx/whpx-accel-ops.h
+++ b/target/i386/whpx/whpx-accel-ops.h
@@ -21,7 +21,6 @@ void whpx_cpu_synchronize_state(CPUState *cpu);
 void whpx_cpu_synchronize_post_reset(CPUState *cpu);
 void whpx_cpu_synchronize_post_init(CPUState *cpu);
 void whpx_cpu_synchronize_pre_loadvm(CPUState *cpu);
-void whpx_cpu_synchronize_pre_resume(bool step_pending);
 
 /* state subset only touched by the VCPU itself during runtime */
 #define WHPX_SET_RUNTIME_STATE   1
diff --git a/target/i386/whpx/whpx-all.c b/target/i386/whpx/whpx-all.c
index 721c4782b9..faf56e1972 100644
--- a/target/i386/whpx/whpx-all.c
+++ b/target/i386/whpx/whpx-all.c
@@ -2105,7 +2105,7 @@ void whpx_cpu_synchronize_pre_loadvm(CPUState *cpu)
     run_on_cpu(cpu, do_whpx_cpu_synchronize_pre_loadvm, RUN_ON_CPU_NULL);
 }
 
-void whpx_cpu_synchronize_pre_resume(bool step_pending)
+static void whpx_pre_resume_vm(AccelState *as, bool step_pending)
 {
     whpx_global.step_pending = step_pending;
 }
@@ -2697,6 +2697,7 @@ static void whpx_accel_class_init(ObjectClass *oc, const void *data)
     AccelClass *ac = ACCEL_CLASS(oc);
     ac->name = "WHPX";
     ac->init_machine = whpx_accel_init;
+    ac->pre_resume_vm = whpx_pre_resume_vm;
     ac->allowed = &whpx_allowed;
 
     object_class_property_add(oc, "kernel-irqchip", "on|off|split",

From e4a4163ed21e8d88f6a0c2d17f9487ad83841653 Mon Sep 17 00:00:00 2001
From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Date: Mon, 23 Jun 2025 11:53:06 -0300
Subject: [PATCH 1946/2760] monitor/hmp-cmds-target: add CPU_DUMP_VPU in
 hmp_info_registers()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Commit b84694defb added the CPU_DUMP_VPU to allow vector registers to be
logged by log_cpu_exec() in TCG. This flag was then used in commit
b227f6a8a7 to print RISC-V vector registers using this flag. Note that
this change was done in riscv_cpu_dump_state(), the cpu_dump_state()
callback for RISC-V, the same callback used in hmp_info_registers().

Back then we forgot to change hmp_info_registers(), and 'info registers'
isn't showing RISC-V vector registers as a result. No other target is
impacted since only RISC-V is using CPU_DUMP_VPU.

There's no reason to not show VPU regs in info_registers(), so add
CPU_DUMP_VPU to hmp_info_registers(). This will print vector registers
for all RISC-V machines and, as said above, has no impact in other
archs.

Cc: Dr. David Alan Gilbert <dave@treblig.org>
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250623145306.991562-1-dbarboza@ventanamicro.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 monitor/hmp-cmds-target.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/monitor/hmp-cmds-target.c b/monitor/hmp-cmds-target.c
index 8eaf70d9c9..e982061146 100644
--- a/monitor/hmp-cmds-target.c
+++ b/monitor/hmp-cmds-target.c
@@ -102,7 +102,7 @@ void hmp_info_registers(Monitor *mon, const QDict *qdict)
     if (all_cpus) {
         CPU_FOREACH(cs) {
             monitor_printf(mon, "\nCPU#%d\n", cs->cpu_index);
-            cpu_dump_state(cs, NULL, CPU_DUMP_FPU);
+            cpu_dump_state(cs, NULL, CPU_DUMP_FPU | CPU_DUMP_VPU);
         }
     } else {
         cs = vcpu >= 0 ? qemu_get_cpu(vcpu) : mon_get_cpu(mon);
@@ -117,7 +117,7 @@ void hmp_info_registers(Monitor *mon, const QDict *qdict)
         }
 
         monitor_printf(mon, "\nCPU#%d\n", cs->cpu_index);
-        cpu_dump_state(cs, NULL, CPU_DUMP_FPU);
+        cpu_dump_state(cs, NULL, CPU_DUMP_FPU | CPU_DUMP_VPU);
     }
 }
 

From 431ac3b5d2b60c8bd8b34d417154060b9184dec1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 3 Jul 2025 19:26:19 +0200
Subject: [PATCH 1947/2760] MAINTAINERS: Add me as reviewer of overall
 accelerators section
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

I'd like to be informed of overall changes of accelerators.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250703173248.44995-40-philmd@linaro.org>
---
 MAINTAINERS | 1 +
 1 file changed, 1 insertion(+)

diff --git a/MAINTAINERS b/MAINTAINERS
index fca98e1219..bfd59f6412 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -495,6 +495,7 @@ Guest CPU Cores (other accelerators)
 Overall
 M: Richard Henderson <richard.henderson@linaro.org>
 R: Paolo Bonzini <pbonzini@redhat.com>
+R: Philippe Mathieu-Daudé <philmd@linaro.org>
 S: Maintained
 F: include/exec/cpu*.h
 F: include/exec/target_long.h

From f9b0f69304071384b12912bf9dd78e9ffd261cec Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:19:24 -0600
Subject: [PATCH 1948/2760] target/arm: Fix SME vs AdvSIMD exception priority

We failed to raise an exception when
sme_excp_el == 0 and fp_excp_el == 1.

Cc: qemu-stable@nongnu.org
Fixes: 3d74825f4d6 ("target/arm: Add SME enablement checks")
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-2-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/translate-a64.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index 815225b130..5c44a5dece 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -1488,7 +1488,8 @@ bool sme_enabled_check(DisasContext *s)
      * to be zero when fp_excp_el has priority.  This is because we need
      * sme_excp_el by itself for cpregs access checks.
      */
-    if (!s->fp_excp_el || s->sme_excp_el < s->fp_excp_el) {
+    if (s->sme_excp_el
+        && (!s->fp_excp_el || s->sme_excp_el <= s->fp_excp_el)) {
         bool ret = sme_access_check(s);
         s->fp_access_checked = (ret ? 1 : -1);
         return ret;

From b4b2e070f41dd8774a70c6186141678558d79a38 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:19:25 -0600
Subject: [PATCH 1949/2760] target/arm: Fix sve_access_check for SME

Do not assume SME implies SVE.  Ensure that the non-streaming
check is present along the SME path, since it is not implied
by sme_*_enabled_check.

Cc: qemu-stable@nongnu.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-3-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/translate-a64.c | 26 +++++++++++++++++++-------
 1 file changed, 19 insertions(+), 7 deletions(-)

diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index 5c44a5dece..b0caccca46 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -1381,11 +1381,8 @@ static bool fp_access_check_only(DisasContext *s)
     return true;
 }
 
-static bool fp_access_check(DisasContext *s)
+static bool nonstreaming_check(DisasContext *s)
 {
-    if (!fp_access_check_only(s)) {
-        return false;
-    }
     if (s->sme_trap_nonstreaming && s->is_nonstreaming) {
         gen_exception_insn(s, 0, EXCP_UDEF,
                            syn_smetrap(SME_ET_Streaming, false));
@@ -1394,6 +1391,11 @@ static bool fp_access_check(DisasContext *s)
     return true;
 }
 
+static bool fp_access_check(DisasContext *s)
+{
+    return fp_access_check_only(s) && nonstreaming_check(s);
+}
+
 /*
  * Return <0 for non-supported element sizes, with MO_16 controlled by
  * FEAT_FP16; return 0 for fp disabled; otherwise return >0 for success.
@@ -1444,14 +1446,24 @@ static int fp_access_check_vector_hsd(DisasContext *s, bool is_q, MemOp esz)
  */
 bool sve_access_check(DisasContext *s)
 {
-    if (s->pstate_sm || !dc_isar_feature(aa64_sve, s)) {
+    if (dc_isar_feature(aa64_sme, s)) {
         bool ret;
 
-        assert(dc_isar_feature(aa64_sme, s));
-        ret = sme_sm_enabled_check(s);
+        if (s->pstate_sm) {
+            ret = sme_enabled_check(s);
+        } else if (dc_isar_feature(aa64_sve, s)) {
+            goto continue_sve;
+        } else {
+            ret = sme_sm_enabled_check(s);
+        }
+        if (ret) {
+            ret = nonstreaming_check(s);
+        }
         s->sve_access_checked = (ret ? 1 : -1);
         return ret;
     }
+
+ continue_sve:
     if (s->sve_excp_el) {
         /* Assert that we only raise one exception per instruction. */
         assert(!s->sve_access_checked);

From e6ffd009c7710a8cc98094897fa0af609c114683 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:19:26 -0600
Subject: [PATCH 1950/2760] target/arm: Fix 128-bit element ZIP, UZP, TRN

We missed the instructions UDEF when the vector size is too small.
We missed marking the instructions non-streaming with SME.

Cc: qemu-stable@nongnu.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-4-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/translate-sve.c | 43 ++++++++++++++++++++++++----------
 1 file changed, 30 insertions(+), 13 deletions(-)

diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
index f3cf028cb9..588a5b006b 100644
--- a/target/arm/tcg/translate-sve.c
+++ b/target/arm/tcg/translate-sve.c
@@ -2352,6 +2352,23 @@ TRANS_FEAT(PUNPKHI, aa64_sve, do_perm_pred2, a, 1, gen_helper_sve_punpk_p)
  *** SVE Permute - Interleaving Group
  */
 
+static bool do_interleave_q(DisasContext *s, gen_helper_gvec_3 *fn,
+                            arg_rrr_esz *a, int data)
+{
+    if (sve_access_check(s)) {
+        unsigned vsz = vec_full_reg_size(s);
+        if (vsz < 32) {
+            unallocated_encoding(s);
+        } else {
+            tcg_gen_gvec_3_ool(vec_full_reg_offset(s, a->rd),
+                               vec_full_reg_offset(s, a->rn),
+                               vec_full_reg_offset(s, a->rm),
+                               vsz, vsz, data, fn);
+        }
+    }
+    return true;
+}
+
 static gen_helper_gvec_3 * const zip_fns[4] = {
     gen_helper_sve_zip_b, gen_helper_sve_zip_h,
     gen_helper_sve_zip_s, gen_helper_sve_zip_d,
@@ -2361,11 +2378,11 @@ TRANS_FEAT(ZIP1_z, aa64_sve, gen_gvec_ool_arg_zzz,
 TRANS_FEAT(ZIP2_z, aa64_sve, gen_gvec_ool_arg_zzz,
            zip_fns[a->esz], a, vec_full_reg_size(s) / 2)
 
-TRANS_FEAT(ZIP1_q, aa64_sve_f64mm, gen_gvec_ool_arg_zzz,
-           gen_helper_sve2_zip_q, a, 0)
-TRANS_FEAT(ZIP2_q, aa64_sve_f64mm, gen_gvec_ool_arg_zzz,
-           gen_helper_sve2_zip_q, a,
-           QEMU_ALIGN_DOWN(vec_full_reg_size(s), 32) / 2)
+TRANS_FEAT_NONSTREAMING(ZIP1_q, aa64_sve_f64mm, do_interleave_q,
+                        gen_helper_sve2_zip_q, a, 0)
+TRANS_FEAT_NONSTREAMING(ZIP2_q, aa64_sve_f64mm, do_interleave_q,
+                        gen_helper_sve2_zip_q, a,
+                        QEMU_ALIGN_DOWN(vec_full_reg_size(s), 32) / 2)
 
 static gen_helper_gvec_3 * const uzp_fns[4] = {
     gen_helper_sve_uzp_b, gen_helper_sve_uzp_h,
@@ -2377,10 +2394,10 @@ TRANS_FEAT(UZP1_z, aa64_sve, gen_gvec_ool_arg_zzz,
 TRANS_FEAT(UZP2_z, aa64_sve, gen_gvec_ool_arg_zzz,
            uzp_fns[a->esz], a, 1 << a->esz)
 
-TRANS_FEAT(UZP1_q, aa64_sve_f64mm, gen_gvec_ool_arg_zzz,
-           gen_helper_sve2_uzp_q, a, 0)
-TRANS_FEAT(UZP2_q, aa64_sve_f64mm, gen_gvec_ool_arg_zzz,
-           gen_helper_sve2_uzp_q, a, 16)
+TRANS_FEAT_NONSTREAMING(UZP1_q, aa64_sve_f64mm, do_interleave_q,
+                        gen_helper_sve2_uzp_q, a, 0)
+TRANS_FEAT_NONSTREAMING(UZP2_q, aa64_sve_f64mm, do_interleave_q,
+                        gen_helper_sve2_uzp_q, a, 16)
 
 static gen_helper_gvec_3 * const trn_fns[4] = {
     gen_helper_sve_trn_b, gen_helper_sve_trn_h,
@@ -2392,10 +2409,10 @@ TRANS_FEAT(TRN1_z, aa64_sve, gen_gvec_ool_arg_zzz,
 TRANS_FEAT(TRN2_z, aa64_sve, gen_gvec_ool_arg_zzz,
            trn_fns[a->esz], a, 1 << a->esz)
 
-TRANS_FEAT(TRN1_q, aa64_sve_f64mm, gen_gvec_ool_arg_zzz,
-           gen_helper_sve2_trn_q, a, 0)
-TRANS_FEAT(TRN2_q, aa64_sve_f64mm, gen_gvec_ool_arg_zzz,
-           gen_helper_sve2_trn_q, a, 16)
+TRANS_FEAT_NONSTREAMING(TRN1_q, aa64_sve_f64mm, do_interleave_q,
+                        gen_helper_sve2_trn_q, a, 0)
+TRANS_FEAT_NONSTREAMING(TRN2_q, aa64_sve_f64mm, do_interleave_q,
+                        gen_helper_sve2_trn_q, a, 16)
 
 /*
  *** SVE Permute Vector - Predicated Group

From 4f06e6eaeb2fe65b957be546c61ab2f11a87202c Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:19:27 -0600
Subject: [PATCH 1951/2760] target/arm: Replace @rda_rn_rm_e0 in sve.decode

Replace @rda_rn_rm_e0 with @rda_rn_rm_ex, and require
users to supply an explicit esz.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-5-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/sve.decode | 48 +++++++++++++++++++--------------------
 1 file changed, 24 insertions(+), 24 deletions(-)

diff --git a/target/arm/tcg/sve.decode b/target/arm/tcg/sve.decode
index 04b6fcc0cf..3a99eb7299 100644
--- a/target/arm/tcg/sve.decode
+++ b/target/arm/tcg/sve.decode
@@ -131,11 +131,11 @@
 @rda_rn_rm      ........ esz:2 . rm:5 ... ... rn:5 rd:5 \
                 &rrrr_esz ra=%reg_movprfx
 
-# Four operand with unused vector element size
-@rda_rn_rm_e0   ........ ... rm:5 ... ... rn:5 rd:5 \
-                &rrrr_esz esz=0 ra=%reg_movprfx
-@rdn_ra_rm_e0   ........ ... rm:5 ... ... ra:5 rd:5 \
-                &rrrr_esz esz=0 rn=%reg_movprfx
+# Four operand with explicit vector element size
+@rda_rn_rm_ex   ........ ... rm:5 ... ... rn:5 rd:5 \
+                &rrrr_esz ra=%reg_movprfx
+@rdn_ra_rm_ex   ........ ... rm:5 ... ... ra:5 rd:5 \
+                &rrrr_esz rn=%reg_movprfx
 
 # Three operand with "memory" size, aka immediate left shift
 @rd_rn_msz_rm   ........ ... rm:5 .... imm:2 rn:5 rd:5          &rrri
@@ -428,12 +428,12 @@ XAR             00000100 .. 1 ..... 001 101 rm:5  rd:5   &rrri_esz \
                 rn=%reg_movprfx esz=%tszimm16_esz imm=%tszimm16_shr
 
 # SVE2 bitwise ternary operations
-EOR3            00000100 00 1 ..... 001 110 ..... .....         @rdn_ra_rm_e0
-BSL             00000100 00 1 ..... 001 111 ..... .....         @rdn_ra_rm_e0
-BCAX            00000100 01 1 ..... 001 110 ..... .....         @rdn_ra_rm_e0
-BSL1N           00000100 01 1 ..... 001 111 ..... .....         @rdn_ra_rm_e0
-BSL2N           00000100 10 1 ..... 001 111 ..... .....         @rdn_ra_rm_e0
-NBSL            00000100 11 1 ..... 001 111 ..... .....         @rdn_ra_rm_e0
+EOR3            00000100 00 1 ..... 001 110 ..... .....     @rdn_ra_rm_ex esz=0
+BSL             00000100 00 1 ..... 001 111 ..... .....     @rdn_ra_rm_ex esz=0
+BCAX            00000100 01 1 ..... 001 110 ..... .....     @rdn_ra_rm_ex esz=0
+BSL1N           00000100 01 1 ..... 001 111 ..... .....     @rdn_ra_rm_ex esz=0
+BSL2N           00000100 10 1 ..... 001 111 ..... .....     @rdn_ra_rm_ex esz=0
+NBSL            00000100 11 1 ..... 001 111 ..... .....     @rdn_ra_rm_ex esz=0
 
 ### SVE Index Generation Group
 
@@ -1450,9 +1450,9 @@ EORTB           01000101 .. 0 ..... 10010 1 ..... .....  @rd_rn_rm
 
 ## SVE integer matrix multiply accumulate
 
-SMMLA           01000101 00 0 ..... 10011 0 ..... .....  @rda_rn_rm_e0
-USMMLA          01000101 10 0 ..... 10011 0 ..... .....  @rda_rn_rm_e0
-UMMLA           01000101 11 0 ..... 10011 0 ..... .....  @rda_rn_rm_e0
+SMMLA           01000101 00 0 ..... 10011 0 ..... .....  @rda_rn_rm_ex esz=2
+USMMLA          01000101 10 0 ..... 10011 0 ..... .....  @rda_rn_rm_ex esz=2
+UMMLA           01000101 11 0 ..... 10011 0 ..... .....  @rda_rn_rm_ex esz=2
 
 ## SVE2 bitwise permute
 
@@ -1602,9 +1602,9 @@ SQRDCMLAH_zzzz  01000100 esz:2 0 rm:5 0011 rot:2 rn:5 rd:5  ra=%reg_movprfx
 USDOT_zzzz      01000100 .. 0 ..... 011 110 ..... .....  @rda_rn_rm
 
 ### SVE2 floating point matrix multiply accumulate
-BFMMLA          01100100 01 1 ..... 111 001 ..... .....  @rda_rn_rm_e0
-FMMLA_s         01100100 10 1 ..... 111 001 ..... .....  @rda_rn_rm_e0
-FMMLA_d         01100100 11 1 ..... 111 001 ..... .....  @rda_rn_rm_e0
+BFMMLA          01100100 01 1 ..... 111 001 ..... .....  @rda_rn_rm_ex esz=1
+FMMLA_s         01100100 10 1 ..... 111 001 ..... .....  @rda_rn_rm_ex esz=2
+FMMLA_d         01100100 11 1 ..... 111 001 ..... .....  @rda_rn_rm_ex esz=3
 
 ### SVE2 Memory Gather Load Group
 
@@ -1654,16 +1654,16 @@ FCVTLT_sd       01100100 11 0010 11 101 ... ..... .....  @rd_pg_rn_e0
 FLOGB           01100101 00 011 esz:2 0101 pg:3 rn:5 rd:5  &rpr_esz
 
 ### SVE2 floating-point multiply-add long (vectors)
-FMLALB_zzzw     01100100 10 1 ..... 10 0 00 0 ..... .....  @rda_rn_rm_e0
-FMLALT_zzzw     01100100 10 1 ..... 10 0 00 1 ..... .....  @rda_rn_rm_e0
-FMLSLB_zzzw     01100100 10 1 ..... 10 1 00 0 ..... .....  @rda_rn_rm_e0
-FMLSLT_zzzw     01100100 10 1 ..... 10 1 00 1 ..... .....  @rda_rn_rm_e0
+FMLALB_zzzw     01100100 10 1 ..... 10 0 00 0 ..... .....  @rda_rn_rm_ex esz=2
+FMLALT_zzzw     01100100 10 1 ..... 10 0 00 1 ..... .....  @rda_rn_rm_ex esz=2
+FMLSLB_zzzw     01100100 10 1 ..... 10 1 00 0 ..... .....  @rda_rn_rm_ex esz=2
+FMLSLT_zzzw     01100100 10 1 ..... 10 1 00 1 ..... .....  @rda_rn_rm_ex esz=2
 
-BFMLALB_zzzw    01100100 11 1 ..... 10 0 00 0 ..... .....  @rda_rn_rm_e0
-BFMLALT_zzzw    01100100 11 1 ..... 10 0 00 1 ..... .....  @rda_rn_rm_e0
+BFMLALB_zzzw    01100100 11 1 ..... 10 0 00 0 ..... .....  @rda_rn_rm_ex esz=2
+BFMLALT_zzzw    01100100 11 1 ..... 10 0 00 1 ..... .....  @rda_rn_rm_ex esz=2
 
 ### SVE2 floating-point bfloat16 dot-product
-BFDOT_zzzz      01100100 01 1 ..... 10 0 00 0 ..... .....  @rda_rn_rm_e0
+BFDOT_zzzz      01100100 01 1 ..... 10 0 00 0 ..... .....  @rda_rn_rm_ex esz=2
 
 ### SVE2 floating-point multiply-add long (indexed)
 FMLALB_zzxw     01100100 10 1 ..... 0100.0 ..... .....     @rrxr_3a esz=2

From c60a52fc576c9e2f5b8c26ed7b49ebd173b5c1e3 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:19:28 -0600
Subject: [PATCH 1952/2760] target/arm: Fix FMMLA (64-bit element) for 128-bit
 VL

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-6-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/translate-sve.c | 23 ++++++++++++++++-------
 1 file changed, 16 insertions(+), 7 deletions(-)

diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
index 588a5b006b..a0de5b488d 100644
--- a/target/arm/tcg/translate-sve.c
+++ b/target/arm/tcg/translate-sve.c
@@ -7025,17 +7025,26 @@ DO_ZPZZ_FP(FMINNMP, aa64_sve2, sve2_fminnmp_zpzz)
 DO_ZPZZ_FP(FMAXP, aa64_sve2, sve2_fmaxp_zpzz)
 DO_ZPZZ_FP(FMINP, aa64_sve2, sve2_fminp_zpzz)
 
+static bool do_fmmla(DisasContext *s, arg_rrrr_esz *a,
+                     gen_helper_gvec_4_ptr *fn)
+{
+    if (sve_access_check(s)) {
+        if (vec_full_reg_size(s) < 4 * memop_size(a->esz)) {
+            unallocated_encoding(s);
+        } else {
+            gen_gvec_fpst_zzzz(s, fn, a->rd, a->rn, a->rm, a->ra, 0, FPST_A64);
+        }
+    }
+    return true;
+}
+
+TRANS_FEAT_NONSTREAMING(FMMLA_s, aa64_sve_f32mm, do_fmmla, a, gen_helper_fmmla_s)
+TRANS_FEAT_NONSTREAMING(FMMLA_d, aa64_sve_f64mm, do_fmmla, a, gen_helper_fmmla_d)
+
 /*
  * SVE Integer Multiply-Add (unpredicated)
  */
 
-TRANS_FEAT_NONSTREAMING(FMMLA_s, aa64_sve_f32mm, gen_gvec_fpst_zzzz,
-                        gen_helper_fmmla_s, a->rd, a->rn, a->rm, a->ra,
-                        0, FPST_A64)
-TRANS_FEAT_NONSTREAMING(FMMLA_d, aa64_sve_f64mm, gen_gvec_fpst_zzzz,
-                        gen_helper_fmmla_d, a->rd, a->rn, a->rm, a->ra,
-                        0, FPST_A64)
-
 static gen_helper_gvec_4 * const sqdmlal_zzzw_fns[] = {
     NULL,                           gen_helper_sve2_sqdmlal_zzzw_h,
     gen_helper_sve2_sqdmlal_zzzw_s, gen_helper_sve2_sqdmlal_zzzw_d,

From a827b94c67bab630499876e888f1ffe737d9f26b Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:19:29 -0600
Subject: [PATCH 1953/2760] target/arm: Disable FEAT_F64MM if maximum SVE
 vector size too small

All F64MM instructions operate on a 256-bit vector.
If only 128-bit vectors is supported by the cpu,
then the cpu cannot enable F64MM.

Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-7-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu64.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index 1f3406708b..77e7c4a6a5 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -259,6 +259,13 @@ void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp)
     /* From now on sve_max_vq is the actual maximum supported length. */
     cpu->sve_max_vq = max_vq;
     cpu->sve_vq.map = vq_map;
+
+    /* FEAT_F64MM requires the existence of a 256-bit vector size. */
+    if (max_vq < 2) {
+        uint64_t t = GET_IDREG(&cpu->isar, ID_AA64ZFR0);
+        t = FIELD_DP64(t, ID_AA64ZFR0, F64MM, 0);
+        SET_IDREG(&cpu->isar, ID_AA64ZFR0, t);
+    }
 }
 
 /*

From 3801c5b75ffc60957265513338e8fd5f8b6ce8a1 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:19:30 -0600
Subject: [PATCH 1954/2760] target/arm: Fix PSEL size operands to
 tcg_gen_gvec_ands

Gvec only operates on size 8 and multiples of 16.
Predicates may be any multiple of 2.
Round up the size using the appropriate function.

Cc: qemu-stable@nongnu.org
Fixes: 598ab0b24c0 ("target/arm: Implement PSEL")
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-8-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/translate-sve.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
index a0de5b488d..8403034a0e 100644
--- a/target/arm/tcg/translate-sve.c
+++ b/target/arm/tcg/translate-sve.c
@@ -7291,6 +7291,7 @@ static bool trans_PSEL(DisasContext *s, arg_psel *a)
     tcg_gen_neg_i64(tmp, tmp);
 
     /* Apply to either copy the source, or write zeros. */
+    pl = size_for_gvec(pl);
     tcg_gen_gvec_ands(MO_64, pred_full_reg_offset(s, a->pd),
                       pred_full_reg_offset(s, a->pn), tmp, pl, pl);
     return true;

From cfc688c00ade84f6b32c7814b52c217f1d3b5eb1 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:19:31 -0600
Subject: [PATCH 1955/2760] target/arm: Fix f16_dotadd vs nan selection

Implement FPProcessNaNs4 within f16_dotadd, rather than
simply letting NaNs propagate through the function.

Cc: qemu-stable@nongnu.org
Fixes: 3916841ac75 ("target/arm: Implement FMOPA, FMOPS (widening)")
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-9-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/sme_helper.c | 62 +++++++++++++++++++++++++++----------
 1 file changed, 46 insertions(+), 16 deletions(-)

diff --git a/target/arm/tcg/sme_helper.c b/target/arm/tcg/sme_helper.c
index de0c6e54d4..8f33387e4b 100644
--- a/target/arm/tcg/sme_helper.c
+++ b/target/arm/tcg/sme_helper.c
@@ -1005,25 +1005,55 @@ static float32 f16_dotadd(float32 sum, uint32_t e1, uint32_t e2,
      *  - we have pre-set-up copy of s_std which is set to round-to-odd,
      *    for the multiply (see below)
      */
-    float64 e1r = float16_to_float64(e1 & 0xffff, true, s_f16);
-    float64 e1c = float16_to_float64(e1 >> 16, true, s_f16);
-    float64 e2r = float16_to_float64(e2 & 0xffff, true, s_f16);
-    float64 e2c = float16_to_float64(e2 >> 16, true, s_f16);
-    float64 t64;
+    float16 h1r = e1 & 0xffff;
+    float16 h1c = e1 >> 16;
+    float16 h2r = e2 & 0xffff;
+    float16 h2c = e2 >> 16;
     float32 t32;
 
-    /*
-     * The ARM pseudocode function FPDot performs both multiplies
-     * and the add with a single rounding operation.  Emulate this
-     * by performing the first multiply in round-to-odd, then doing
-     * the second multiply as fused multiply-add, and rounding to
-     * float32 all in one step.
-     */
-    t64 = float64_mul(e1r, e2r, s_odd);
-    t64 = float64r32_muladd(e1c, e2c, t64, 0, s_std);
+    /* C.f. FPProcessNaNs4 */
+    if (float16_is_any_nan(h1r) || float16_is_any_nan(h1c) ||
+        float16_is_any_nan(h2r) || float16_is_any_nan(h2c)) {
+        float16 t16;
 
-    /* This conversion is exact, because we've already rounded. */
-    t32 = float64_to_float32(t64, s_std);
+        if (float16_is_signaling_nan(h1r, s_f16)) {
+            t16 = h1r;
+        } else if (float16_is_signaling_nan(h1c, s_f16)) {
+            t16 = h1c;
+        } else if (float16_is_signaling_nan(h2r, s_f16)) {
+            t16 = h2r;
+        } else if (float16_is_signaling_nan(h2c, s_f16)) {
+            t16 = h2c;
+        } else if (float16_is_any_nan(h1r)) {
+            t16 = h1r;
+        } else if (float16_is_any_nan(h1c)) {
+            t16 = h1c;
+        } else if (float16_is_any_nan(h2r)) {
+            t16 = h2r;
+        } else {
+            t16 = h2c;
+        }
+        t32 = float16_to_float32(t16, true, s_f16);
+    } else {
+        float64 e1r = float16_to_float64(h1r, true, s_f16);
+        float64 e1c = float16_to_float64(h1c, true, s_f16);
+        float64 e2r = float16_to_float64(h2r, true, s_f16);
+        float64 e2c = float16_to_float64(h2c, true, s_f16);
+        float64 t64;
+
+        /*
+         * The ARM pseudocode function FPDot performs both multiplies
+         * and the add with a single rounding operation.  Emulate this
+         * by performing the first multiply in round-to-odd, then doing
+         * the second multiply as fused multiply-add, and rounding to
+         * float32 all in one step.
+         */
+        t64 = float64_mul(e1r, e2r, s_odd);
+        t64 = float64r32_muladd(e1c, e2c, t64, 0, s_std);
+
+        /* This conversion is exact, because we've already rounded. */
+        t32 = float64_to_float32(t64, s_std);
+    }
 
     /* The final accumulation step is not fused. */
     return float32_add(sum, t32, s_std);

From bf020eaa6741711902a425016e2c7585f222562d Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:19:32 -0600
Subject: [PATCH 1956/2760] target/arm: Fix bfdotadd_ebf vs nan selection

Implement FPProcessNaNs4 within bfdotadd_ebf, rather than
simply letting NaNs propagate through the function.

Cc: qemu-stable@nongnu.org
Fixes: 0e1850182a1 ("target/arm: Implement FPCR.EBF=1 semantics for bfdotadd()")
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20250704142112.1018902-10-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/vec_helper.c | 75 ++++++++++++++++++++++++++-----------
 1 file changed, 53 insertions(+), 22 deletions(-)

diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
index 986eaf8ffa..3b7f308803 100644
--- a/target/arm/tcg/vec_helper.c
+++ b/target/arm/tcg/vec_helper.c
@@ -2989,31 +2989,62 @@ float32 bfdotadd(float32 sum, uint32_t e1, uint32_t e2, float_status *fpst)
 float32 bfdotadd_ebf(float32 sum, uint32_t e1, uint32_t e2,
                      float_status *fpst, float_status *fpst_odd)
 {
-    /*
-     * Compare f16_dotadd() in sme_helper.c, but here we have
-     * bfloat16 inputs. In particular that means that we do not
-     * want the FPCR.FZ16 flush semantics, so we use the normal
-     * float_status for the input handling here.
-     */
-    float64 e1r = float32_to_float64(e1 << 16, fpst);
-    float64 e1c = float32_to_float64(e1 & 0xffff0000u, fpst);
-    float64 e2r = float32_to_float64(e2 << 16, fpst);
-    float64 e2c = float32_to_float64(e2 & 0xffff0000u, fpst);
-    float64 t64;
+    float32 s1r = e1 << 16;
+    float32 s1c = e1 & 0xffff0000u;
+    float32 s2r = e2 << 16;
+    float32 s2c = e2 & 0xffff0000u;
     float32 t32;
 
-    /*
-     * The ARM pseudocode function FPDot performs both multiplies
-     * and the add with a single rounding operation.  Emulate this
-     * by performing the first multiply in round-to-odd, then doing
-     * the second multiply as fused multiply-add, and rounding to
-     * float32 all in one step.
-     */
-    t64 = float64_mul(e1r, e2r, fpst_odd);
-    t64 = float64r32_muladd(e1c, e2c, t64, 0, fpst);
+    /* C.f. FPProcessNaNs4 */
+    if (float32_is_any_nan(s1r) || float32_is_any_nan(s1c) ||
+        float32_is_any_nan(s2r) || float32_is_any_nan(s2c)) {
+        if (float32_is_signaling_nan(s1r, fpst)) {
+            t32 = s1r;
+        } else if (float32_is_signaling_nan(s1c, fpst)) {
+            t32 = s1c;
+        } else if (float32_is_signaling_nan(s2r, fpst)) {
+            t32 = s2r;
+        } else if (float32_is_signaling_nan(s2c, fpst)) {
+            t32 = s2c;
+        } else if (float32_is_any_nan(s1r)) {
+            t32 = s1r;
+        } else if (float32_is_any_nan(s1c)) {
+            t32 = s1c;
+        } else if (float32_is_any_nan(s2r)) {
+            t32 = s2r;
+        } else {
+            t32 = s2c;
+        }
+        /*
+         * FPConvertNaN(FPProcessNaN(t32)) will be done as part
+         * of the final addition below.
+         */
+    } else {
+        /*
+         * Compare f16_dotadd() in sme_helper.c, but here we have
+         * bfloat16 inputs. In particular that means that we do not
+         * want the FPCR.FZ16 flush semantics, so we use the normal
+         * float_status for the input handling here.
+         */
+        float64 e1r = float32_to_float64(s1r, fpst);
+        float64 e1c = float32_to_float64(s1c, fpst);
+        float64 e2r = float32_to_float64(s2r, fpst);
+        float64 e2c = float32_to_float64(s2c, fpst);
+        float64 t64;
 
-    /* This conversion is exact, because we've already rounded. */
-    t32 = float64_to_float32(t64, fpst);
+        /*
+         * The ARM pseudocode function FPDot performs both multiplies
+         * and the add with a single rounding operation.  Emulate this
+         * by performing the first multiply in round-to-odd, then doing
+         * the second multiply as fused multiply-add, and rounding to
+         * float32 all in one step.
+         */
+        t64 = float64_mul(e1r, e2r, fpst_odd);
+        t64 = float64r32_muladd(e1c, e2c, t64, 0, fpst);
+
+        /* This conversion is exact, because we've already rounded. */
+        t32 = float64_to_float32(t64, fpst);
+    }
 
     /* The final accumulation step is not fused. */
     return float32_add(sum, t32, fpst);

From afb1bd20df88edb553dbb70857a0b7f15c72c672 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:19:33 -0600
Subject: [PATCH 1957/2760] target/arm: Remove CPUARMState.vfp.scratch
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The last use of this field was removed in b2fc7be972b9.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-11-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index 0338153923..96a4907266 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -669,9 +669,6 @@ typedef struct CPUArchState {
 
         uint32_t xregs[16];
 
-        /* Scratch space for aa32 neon expansion.  */
-        uint32_t scratch[8];
-
         /* There are a number of distinct float control structures. */
         float_status fp_status[FPST_COUNT];
 

From c994c84d384b87cd862d12f6b9db4bcfd42b5a7b Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:19:34 -0600
Subject: [PATCH 1958/2760] target/arm: Introduce FPST_ZA, FPST_ZA_F16

Rather than repeatedly copying FPST_FPCR to locals
and setting default nan mode, create dedicated float_status.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-12-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.c            |  4 ++++
 target/arm/cpu.h            | 12 +++++++++++-
 target/arm/tcg/vfp_helper.c | 12 +++++++++++-
 3 files changed, 26 insertions(+), 2 deletions(-)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index ebac86f70d..7b207f2620 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -554,11 +554,15 @@ static void arm_cpu_reset_hold(Object *obj, ResetType type)
     set_flush_inputs_to_zero(1, &env->vfp.fp_status[FPST_STD]);
     set_default_nan_mode(1, &env->vfp.fp_status[FPST_STD]);
     set_default_nan_mode(1, &env->vfp.fp_status[FPST_STD_F16]);
+    set_default_nan_mode(1, &env->vfp.fp_status[FPST_ZA]);
+    set_default_nan_mode(1, &env->vfp.fp_status[FPST_ZA_F16]);
     arm_set_default_fp_behaviours(&env->vfp.fp_status[FPST_A32]);
     arm_set_default_fp_behaviours(&env->vfp.fp_status[FPST_A64]);
+    arm_set_default_fp_behaviours(&env->vfp.fp_status[FPST_ZA]);
     arm_set_default_fp_behaviours(&env->vfp.fp_status[FPST_STD]);
     arm_set_default_fp_behaviours(&env->vfp.fp_status[FPST_A32_F16]);
     arm_set_default_fp_behaviours(&env->vfp.fp_status[FPST_A64_F16]);
+    arm_set_default_fp_behaviours(&env->vfp.fp_status[FPST_ZA_F16]);
     arm_set_default_fp_behaviours(&env->vfp.fp_status[FPST_STD_F16]);
     arm_set_ah_fp_behaviours(&env->vfp.fp_status[FPST_AH]);
     set_flush_to_zero(1, &env->vfp.fp_status[FPST_AH]);
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index 96a4907266..2530aaca22 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -207,6 +207,8 @@ typedef struct NVICState NVICState;
  *       when FPCR.AH == 1 (bfloat16 conversions and multiplies,
  *       and the reciprocal and square root estimate/step insns);
  *       for half-precision
+ * ZA: the "streaming sve" fp status.
+ * ZA_F16: likewise for half-precision.
  *
  * Half-precision operations are governed by a separate
  * flush-to-zero control bit in FPSCR:FZ16. We pass a separate
@@ -227,6 +229,12 @@ typedef struct NVICState NVICState;
  * they ignore FPCR.RMode. But they don't ignore FPCR.FZ16,
  * which means we need an FPST_AH_F16 as well.
  *
+ * The "ZA" float_status are for Streaming SVE operations which use
+ * default-NaN and do not generate fp exceptions, which means that they
+ * do not accumulate exception bits back into FPCR.
+ * See e.g. FPAdd vs FPAdd_ZA pseudocode functions, and the setting
+ * of fpcr.DN and fpexec parameters.
+ *
  * To avoid having to transfer exception bits around, we simply
  * say that the FPSCR cumulative exception flags are the logical
  * OR of the flags in the four fp statuses. This relies on the
@@ -240,10 +248,12 @@ typedef enum ARMFPStatusFlavour {
     FPST_A64_F16,
     FPST_AH,
     FPST_AH_F16,
+    FPST_ZA,
+    FPST_ZA_F16,
     FPST_STD,
     FPST_STD_F16,
 } ARMFPStatusFlavour;
-#define FPST_COUNT  8
+#define FPST_COUNT  10
 
 typedef struct CPUArchState {
     /* Regs for current mode.  */
diff --git a/target/arm/tcg/vfp_helper.c b/target/arm/tcg/vfp_helper.c
index b1324c5c0a..e156e3774a 100644
--- a/target/arm/tcg/vfp_helper.c
+++ b/target/arm/tcg/vfp_helper.c
@@ -123,7 +123,7 @@ uint32_t vfp_get_fpsr_from_host(CPUARMState *env)
     a64_flags |= (get_float_exception_flags(&env->vfp.fp_status[FPST_A64_F16])
           & ~(float_flag_input_denormal_flushed | float_flag_input_denormal_used));
     /*
-     * We do not merge in flags from FPST_AH or FPST_AH_F16, because
+     * We do not merge in flags from FPST_{AH,ZA} or FPST_{AH,ZA}_F16, because
      * they are used for insns that must not set the cumulative exception bits.
      */
 
@@ -196,6 +196,8 @@ void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
         set_float_rounding_mode(i, &env->vfp.fp_status[FPST_A64]);
         set_float_rounding_mode(i, &env->vfp.fp_status[FPST_A32_F16]);
         set_float_rounding_mode(i, &env->vfp.fp_status[FPST_A64_F16]);
+        set_float_rounding_mode(i, &env->vfp.fp_status[FPST_ZA]);
+        set_float_rounding_mode(i, &env->vfp.fp_status[FPST_ZA_F16]);
     }
     if (changed & FPCR_FZ16) {
         bool ftz_enabled = val & FPCR_FZ16;
@@ -203,15 +205,18 @@ void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
         set_flush_to_zero(ftz_enabled, &env->vfp.fp_status[FPST_A64_F16]);
         set_flush_to_zero(ftz_enabled, &env->vfp.fp_status[FPST_STD_F16]);
         set_flush_to_zero(ftz_enabled, &env->vfp.fp_status[FPST_AH_F16]);
+        set_flush_to_zero(ftz_enabled, &env->vfp.fp_status[FPST_ZA_F16]);
         set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status[FPST_A32_F16]);
         set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status[FPST_A64_F16]);
         set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status[FPST_STD_F16]);
         set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status[FPST_AH_F16]);
+        set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status[FPST_ZA_F16]);
     }
     if (changed & FPCR_FZ) {
         bool ftz_enabled = val & FPCR_FZ;
         set_flush_to_zero(ftz_enabled, &env->vfp.fp_status[FPST_A32]);
         set_flush_to_zero(ftz_enabled, &env->vfp.fp_status[FPST_A64]);
+        set_flush_to_zero(ftz_enabled, &env->vfp.fp_status[FPST_ZA]);
         /* FIZ is A64 only so FZ always makes A32 code flush inputs to zero */
         set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status[FPST_A32]);
     }
@@ -223,6 +228,7 @@ void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
         bool fitz_enabled = (val & FPCR_FIZ) ||
             (val & (FPCR_FZ | FPCR_AH)) == FPCR_FZ;
         set_flush_inputs_to_zero(fitz_enabled, &env->vfp.fp_status[FPST_A64]);
+        set_flush_inputs_to_zero(fitz_enabled, &env->vfp.fp_status[FPST_ZA]);
     }
     if (changed & FPCR_DN) {
         bool dnan_enabled = val & FPCR_DN;
@@ -240,9 +246,13 @@ void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
             /* Change behaviours for A64 FP operations */
             arm_set_ah_fp_behaviours(&env->vfp.fp_status[FPST_A64]);
             arm_set_ah_fp_behaviours(&env->vfp.fp_status[FPST_A64_F16]);
+            arm_set_ah_fp_behaviours(&env->vfp.fp_status[FPST_ZA]);
+            arm_set_ah_fp_behaviours(&env->vfp.fp_status[FPST_ZA_F16]);
         } else {
             arm_set_default_fp_behaviours(&env->vfp.fp_status[FPST_A64]);
             arm_set_default_fp_behaviours(&env->vfp.fp_status[FPST_A64_F16]);
+            arm_set_default_fp_behaviours(&env->vfp.fp_status[FPST_ZA]);
+            arm_set_default_fp_behaviours(&env->vfp.fp_status[FPST_ZA_F16]);
         }
     }
     /*

From d74f0ceae557c35ee80bcc0afa20e4f95b6e3262 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:19:35 -0600
Subject: [PATCH 1959/2760] target/arm: Use FPST_ZA for sme_fmopa_[hsd]

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-13-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/sme_helper.c    | 37 ++++++++--------------------------
 target/arm/tcg/translate-sme.c |  4 ++--
 2 files changed, 10 insertions(+), 31 deletions(-)

diff --git a/target/arm/tcg/sme_helper.c b/target/arm/tcg/sme_helper.c
index 8f33387e4b..9942d717aa 100644
--- a/target/arm/tcg/sme_helper.c
+++ b/target/arm/tcg/sme_helper.c
@@ -904,20 +904,11 @@ void HELPER(sme_addva_d)(void *vzda, void *vzn, void *vpn,
 }
 
 void HELPER(sme_fmopa_s)(void *vza, void *vzn, void *vzm, void *vpn,
-                         void *vpm, float_status *fpst_in, uint32_t desc)
+                         void *vpm, float_status *fpst, uint32_t desc)
 {
     intptr_t row, col, oprsz = simd_maxsz(desc);
     uint32_t neg = simd_data(desc) << 31;
     uint16_t *pn = vpn, *pm = vpm;
-    float_status fpst;
-
-    /*
-     * Make a copy of float_status because this operation does not
-     * update the cumulative fp exception status.  It also produces
-     * default nans.
-     */
-    fpst = *fpst_in;
-    set_default_nan_mode(true, &fpst);
 
     for (row = 0; row < oprsz; ) {
         uint16_t pa = pn[H2(row >> 4)];
@@ -932,7 +923,7 @@ void HELPER(sme_fmopa_s)(void *vza, void *vzn, void *vzm, void *vpn,
                         if (pb & 1) {
                             uint32_t *a = vza_row + H1_4(col);
                             uint32_t *m = vzm + H1_4(col);
-                            *a = float32_muladd(n, *m, *a, 0, &fpst);
+                            *a = float32_muladd(n, *m, *a, 0, fpst);
                         }
                         col += 4;
                         pb >>= 4;
@@ -946,15 +937,12 @@ void HELPER(sme_fmopa_s)(void *vza, void *vzn, void *vzm, void *vpn,
 }
 
 void HELPER(sme_fmopa_d)(void *vza, void *vzn, void *vzm, void *vpn,
-                         void *vpm, float_status *fpst_in, uint32_t desc)
+                         void *vpm, float_status *fpst, uint32_t desc)
 {
     intptr_t row, col, oprsz = simd_oprsz(desc) / 8;
     uint64_t neg = (uint64_t)simd_data(desc) << 63;
     uint64_t *za = vza, *zn = vzn, *zm = vzm;
     uint8_t *pn = vpn, *pm = vpm;
-    float_status fpst = *fpst_in;
-
-    set_default_nan_mode(true, &fpst);
 
     for (row = 0; row < oprsz; ++row) {
         if (pn[H1(row)] & 1) {
@@ -964,7 +952,7 @@ void HELPER(sme_fmopa_d)(void *vza, void *vzn, void *vzm, void *vpn,
             for (col = 0; col < oprsz; ++col) {
                 if (pm[H1(col)] & 1) {
                     uint64_t *a = &za_row[col];
-                    *a = float64_muladd(n, zm[col], *a, 0, &fpst);
+                    *a = float64_muladd(n, zm[col], *a, 0, fpst);
                 }
             }
         }
@@ -1065,19 +1053,8 @@ void HELPER(sme_fmopa_h)(void *vza, void *vzn, void *vzm, void *vpn,
     intptr_t row, col, oprsz = simd_maxsz(desc);
     uint32_t neg = simd_data(desc) * 0x80008000u;
     uint16_t *pn = vpn, *pm = vpm;
-    float_status fpst_odd, fpst_std, fpst_f16;
+    float_status fpst_odd = env->vfp.fp_status[FPST_ZA];
 
-    /*
-     * Make copies of the fp status fields we use, because this operation
-     * does not update the cumulative fp exception status.  It also
-     * produces default NaNs. We also need a second copy of fp_status with
-     * round-to-odd -- see above.
-     */
-    fpst_f16 = env->vfp.fp_status[FPST_A64_F16];
-    fpst_std = env->vfp.fp_status[FPST_A64];
-    set_default_nan_mode(true, &fpst_std);
-    set_default_nan_mode(true, &fpst_f16);
-    fpst_odd = fpst_std;
     set_float_rounding_mode(float_round_to_odd, &fpst_odd);
 
     for (row = 0; row < oprsz; ) {
@@ -1097,7 +1074,9 @@ void HELPER(sme_fmopa_h)(void *vza, void *vzn, void *vzm, void *vpn,
 
                         m = f16mop_adj_pair(m, pcol, 0);
                         *a = f16_dotadd(*a, n, m,
-                                        &fpst_f16, &fpst_std, &fpst_odd);
+                                        &env->vfp.fp_status[FPST_ZA_F16],
+                                        &env->vfp.fp_status[FPST_ZA],
+                                        &fpst_odd);
                     }
                     col += 4;
                     pcol >>= 4;
diff --git a/target/arm/tcg/translate-sme.c b/target/arm/tcg/translate-sme.c
index fcbb350016..51175c923e 100644
--- a/target/arm/tcg/translate-sme.c
+++ b/target/arm/tcg/translate-sme.c
@@ -358,9 +358,9 @@ static bool do_outprod_env(DisasContext *s, arg_op *a, MemOp esz,
 TRANS_FEAT(FMOPA_h, aa64_sme, do_outprod_env, a,
            MO_32, gen_helper_sme_fmopa_h)
 TRANS_FEAT(FMOPA_s, aa64_sme, do_outprod_fpst, a,
-           MO_32, FPST_A64, gen_helper_sme_fmopa_s)
+           MO_32, FPST_ZA, gen_helper_sme_fmopa_s)
 TRANS_FEAT(FMOPA_d, aa64_sme_f64f64, do_outprod_fpst, a,
-           MO_64, FPST_A64, gen_helper_sme_fmopa_d)
+           MO_64, FPST_ZA, gen_helper_sme_fmopa_d)
 
 TRANS_FEAT(BFMOPA, aa64_sme, do_outprod_env, a, MO_32, gen_helper_sme_bfmopa)
 

From 81123324a56fecce275a9995ddc1593e880b43ef Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:19:36 -0600
Subject: [PATCH 1960/2760] target/arm: Rename zarray to za_state.za

The whole ZA state will also contain ZT0.
Make things easier in aarch64_set_svcr to zero both
by wrapping them in a common structure.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-14-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 linux-user/aarch64/signal.c    |  4 +--
 target/arm/cpu.c               |  4 +--
 target/arm/cpu.h               | 48 +++++++++++++++++++---------------
 target/arm/helper.c            |  2 +-
 target/arm/machine.c           |  2 +-
 target/arm/tcg/sme_helper.c    |  6 ++---
 target/arm/tcg/translate-sme.c |  4 +--
 7 files changed, 38 insertions(+), 32 deletions(-)

diff --git a/linux-user/aarch64/signal.c b/linux-user/aarch64/signal.c
index bc7a13800d..d50cab78d8 100644
--- a/linux-user/aarch64/signal.c
+++ b/linux-user/aarch64/signal.c
@@ -248,7 +248,7 @@ static void target_setup_za_record(struct target_za_context *za,
     for (i = 0; i < vl; ++i) {
         uint64_t *z = (void *)za + TARGET_ZA_SIG_ZAV_OFFSET(vq, i);
         for (j = 0; j < vq * 2; ++j) {
-            __put_user_e(env->zarray[i].d[j], z + j, le);
+            __put_user_e(env->za_state.za[i].d[j], z + j, le);
         }
     }
 }
@@ -397,7 +397,7 @@ static bool target_restore_za_record(CPUARMState *env,
     for (i = 0; i < vl; ++i) {
         uint64_t *z = (void *)za + TARGET_ZA_SIG_ZAV_OFFSET(vq, i);
         for (j = 0; j < vq * 2; ++j) {
-            __get_user_e(env->zarray[i].d[j], z + j, le);
+            __get_user_e(env->za_state.za[i].d[j], z + j, le);
         }
     }
     return true;
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index 7b207f2620..6265627762 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -1335,8 +1335,8 @@ static void aarch64_cpu_dump_state(CPUState *cs, FILE *f, int flags)
             qemu_fprintf(f, "ZA[%0*d]=", svl_lg10, i);
             for (j = zcr_len; j >= 0; --j) {
                 qemu_fprintf(f, "%016" PRIx64 ":%016" PRIx64 "%c",
-                             env->zarray[i].d[2 * j + 1],
-                             env->zarray[i].d[2 * j],
+                             env->za_state.za[i].d[2 * j + 1],
+                             env->za_state.za[i].d[2 * j],
                              j ? ':' : '\n');
             }
         }
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index 2530aaca22..7db97e8038 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -715,27 +715,33 @@ typedef struct CPUArchState {
 
     uint64_t scxtnum_el[4];
 
-    /*
-     * SME ZA storage -- 256 x 256 byte array, with bytes in host word order,
-     * as we do with vfp.zregs[].  This corresponds to the architectural ZA
-     * array, where ZA[N] is in the least-significant bytes of env->zarray[N].
-     * When SVL is less than the architectural maximum, the accessible
-     * storage is restricted, such that if the SVL is X bytes the guest can
-     * see only the bottom X elements of zarray[], and only the least
-     * significant X bytes of each element of the array. (In other words,
-     * the observable part is always square.)
-     *
-     * The ZA storage can also be considered as a set of square tiles of
-     * elements of different sizes. The mapping from tiles to the ZA array
-     * is architecturally defined, such that for tiles of elements of esz
-     * bytes, the Nth row (or "horizontal slice") of tile T is in
-     * ZA[T + N * esz]. Note that this means that each tile is not contiguous
-     * in the ZA storage, because its rows are striped through the ZA array.
-     *
-     * Because this is so large, keep this toward the end of the reset area,
-     * to keep the offsets into the rest of the structure smaller.
-     */
-    ARMVectorReg zarray[ARM_MAX_VQ * 16];
+    struct {
+        /*
+         * SME ZA storage -- 256 x 256 byte array, with bytes in host
+         * word order, as we do with vfp.zregs[].  This corresponds to
+         * the architectural ZA array, where ZA[N] is in the least
+         * significant bytes of env->za_state.za[N].
+         *
+         * When SVL is less than the architectural maximum, the accessible
+         * storage is restricted, such that if the SVL is X bytes the guest
+         * can see only the bottom X elements of zarray[], and only the least
+         * significant X bytes of each element of the array. (In other words,
+         * the observable part is always square.)
+         *
+         * The ZA storage can also be considered as a set of square tiles of
+         * elements of different sizes. The mapping from tiles to the ZA array
+         * is architecturally defined, such that for tiles of elements of esz
+         * bytes, the Nth row (or "horizontal slice") of tile T is in
+         * ZA[T + N * esz]. Note that this means that each tile is not
+         * contiguous in the ZA storage, because its rows are striped through
+         * the ZA array.
+         *
+         * Because this is so large, keep this toward the end of the
+         * reset area, to keep the offsets into the rest of the structure
+         * smaller.
+         */
+        ARMVectorReg za[ARM_MAX_VQ * 16];
+    } za_state;
 
     struct CPUBreakpoint *cpu_breakpoint[16];
     struct CPUWatchpoint *cpu_watchpoint[16];
diff --git a/target/arm/helper.c b/target/arm/helper.c
index c311d2df21..3879bce848 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -6663,7 +6663,7 @@ void aarch64_set_svcr(CPUARMState *env, uint64_t new, uint64_t mask)
      * when disabled either.
      */
     if (change & new & R_SVCR_ZA_MASK) {
-        memset(env->zarray, 0, sizeof(env->zarray));
+        memset(&env->za_state, 0, sizeof(env->za_state));
     }
 
     if (tcg_enabled()) {
diff --git a/target/arm/machine.c b/target/arm/machine.c
index e442d48524..6e73368ef9 100644
--- a/target/arm/machine.c
+++ b/target/arm/machine.c
@@ -315,7 +315,7 @@ static const VMStateDescription vmstate_za = {
     .minimum_version_id = 1,
     .needed = za_needed,
     .fields = (const VMStateField[]) {
-        VMSTATE_STRUCT_ARRAY(env.zarray, ARMCPU, ARM_MAX_VQ * 16, 0,
+        VMSTATE_STRUCT_ARRAY(env.za_state.za, ARMCPU, ARM_MAX_VQ * 16, 0,
                              vmstate_vreg, ARMVectorReg),
         VMSTATE_END_OF_LIST()
     }
diff --git a/target/arm/tcg/sme_helper.c b/target/arm/tcg/sme_helper.c
index 9942d717aa..7b0bc1b17c 100644
--- a/target/arm/tcg/sme_helper.c
+++ b/target/arm/tcg/sme_helper.c
@@ -39,12 +39,12 @@ void helper_sme_zero(CPUARMState *env, uint32_t imm, uint32_t svl)
     uint32_t i;
 
     /*
-     * Special case clearing the entire ZA space.
+     * Special case clearing the entire ZArray.
      * This falls into the CONSTRAINED UNPREDICTABLE zeroing of any
      * parts of the ZA storage outside of SVL.
      */
     if (imm == 0xff) {
-        memset(env->zarray, 0, sizeof(env->zarray));
+        memset(env->za_state.za, 0, sizeof(env->za_state.za));
         return;
     }
 
@@ -54,7 +54,7 @@ void helper_sme_zero(CPUARMState *env, uint32_t imm, uint32_t svl)
      */
     for (i = 0; i < svl; i++) {
         if (imm & (1 << (i % 8))) {
-            memset(&env->zarray[i], 0, svl);
+            memset(&env->za_state.za[i], 0, svl);
         }
     }
 }
diff --git a/target/arm/tcg/translate-sme.c b/target/arm/tcg/translate-sme.c
index 51175c923e..e8b3578174 100644
--- a/target/arm/tcg/translate-sme.c
+++ b/target/arm/tcg/translate-sme.c
@@ -92,7 +92,7 @@ static TCGv_ptr get_tile_rowcol(DisasContext *s, int esz, int rs,
     offset = tile * sizeof(ARMVectorReg);
 
     /* Include the byte offset of zarray to make this relative to env. */
-    offset += offsetof(CPUARMState, zarray);
+    offset += offsetof(CPUARMState, za_state.za);
     tcg_gen_addi_i32(tmp, tmp, offset);
 
     /* Add the byte offset to env to produce the final pointer. */
@@ -112,7 +112,7 @@ static TCGv_ptr get_tile(DisasContext *s, int esz, int tile)
     TCGv_ptr addr = tcg_temp_new_ptr();
     int offset;
 
-    offset = tile * sizeof(ARMVectorReg) + offsetof(CPUARMState, zarray);
+    offset = tile * sizeof(ARMVectorReg) + offsetof(CPUARMState, za_state.za);
 
     tcg_gen_addi_ptr(addr, tcg_env, offset);
     return addr;

From d8ff459b4021a4fdbd3bf0c4311bb24868188f0d Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:19:37 -0600
Subject: [PATCH 1961/2760] target/arm: Add isar feature tests for SME2p1,
 SVE2p1

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-15-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu-features.h | 63 +++++++++++++++++++++++++++++++++++++++
 target/arm/cpu.h          |  1 +
 2 files changed, 64 insertions(+)

diff --git a/target/arm/cpu-features.h b/target/arm/cpu-features.h
index 5d8adfb73b..5876162428 100644
--- a/target/arm/cpu-features.h
+++ b/target/arm/cpu-features.h
@@ -604,6 +604,11 @@ static inline bool isar_feature_aa64_rpres(const ARMISARegisters *id)
     return FIELD_EX64_IDREG(id, ID_AA64ISAR2, RPRES);
 }
 
+static inline bool isar_feature_aa64_lut(const ARMISARegisters *id)
+{
+    return FIELD_EX64_IDREG(id, ID_AA64ISAR2, LUT);
+}
+
 static inline bool isar_feature_aa64_fp_simd(const ARMISARegisters *id)
 {
     /* We always set the AdvSIMD and FP fields identically.  */
@@ -932,6 +937,11 @@ static inline bool isar_feature_aa64_sve2(const ARMISARegisters *id)
     return FIELD_EX64_IDREG(id, ID_AA64ZFR0, SVEVER) != 0;
 }
 
+static inline bool isar_feature_aa64_sve2p1(const ARMISARegisters *id)
+{
+    return FIELD_EX64_IDREG(id, ID_AA64ZFR0, SVEVER) >=2;
+}
+
 static inline bool isar_feature_aa64_sve2_aes(const ARMISARegisters *id)
 {
     return FIELD_EX64_IDREG(id, ID_AA64ZFR0, AES) != 0;
@@ -977,6 +987,21 @@ static inline bool isar_feature_aa64_sve_f64mm(const ARMISARegisters *id)
     return FIELD_EX64_IDREG(id, ID_AA64ZFR0, F64MM) != 0;
 }
 
+static inline bool isar_feature_aa64_sve_b16b16(const ARMISARegisters *id)
+{
+    return FIELD_EX64_IDREG(id, ID_AA64ZFR0, B16B16);
+}
+
+static inline bool isar_feature_aa64_sme_b16b16(const ARMISARegisters *id)
+{
+    return FIELD_EX64_IDREG(id, ID_AA64SMFR0, B16B16);
+}
+
+static inline bool isar_feature_aa64_sme_f16f16(const ARMISARegisters *id)
+{
+    return FIELD_EX64_IDREG(id, ID_AA64SMFR0, F16F16);
+}
+
 static inline bool isar_feature_aa64_sme_f64f64(const ARMISARegisters *id)
 {
     return FIELD_EX64_IDREG(id, ID_AA64SMFR0, F64F64);
@@ -992,6 +1017,44 @@ static inline bool isar_feature_aa64_sme_fa64(const ARMISARegisters *id)
     return FIELD_EX64_IDREG(id, ID_AA64SMFR0, FA64);
 }
 
+static inline bool isar_feature_aa64_sme2(const ARMISARegisters *id)
+{
+    return FIELD_EX64_IDREG(id, ID_AA64SMFR0, SMEVER) != 0;
+}
+
+static inline bool isar_feature_aa64_sme2p1(const ARMISARegisters *id)
+{
+    return FIELD_EX64_IDREG(id, ID_AA64SMFR0, SMEVER) >= 2;
+}
+
+/*
+ * Combinations of feature tests, for ease of use with TRANS_FEAT.
+ */
+static inline bool isar_feature_aa64_sme_or_sve2p1(const ARMISARegisters *id)
+{
+    return isar_feature_aa64_sme(id) || isar_feature_aa64_sve2p1(id);
+}
+
+static inline bool isar_feature_aa64_sme2_or_sve2p1(const ARMISARegisters *id)
+{
+    return isar_feature_aa64_sme2(id) || isar_feature_aa64_sve2p1(id);
+}
+
+static inline bool isar_feature_aa64_sme2p1_or_sve2p1(const ARMISARegisters *id)
+{
+    return isar_feature_aa64_sme2p1(id) || isar_feature_aa64_sve2p1(id);
+}
+
+static inline bool isar_feature_aa64_sme2_i16i64(const ARMISARegisters *id)
+{
+    return isar_feature_aa64_sme2(id) && isar_feature_aa64_sme_i16i64(id);
+}
+
+static inline bool isar_feature_aa64_sme2_f64f64(const ARMISARegisters *id)
+{
+    return isar_feature_aa64_sme2(id) && isar_feature_aa64_sme_f64f64(id);
+}
+
 /*
  * Feature tests for "does this exist in either 32-bit or 64-bit?"
  */
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index 7db97e8038..c6041a9357 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -2211,6 +2211,7 @@ FIELD(ID_AA64ISAR2, SYSINSTR_128, 36, 4)
 FIELD(ID_AA64ISAR2, PRFMSLC, 40, 4)
 FIELD(ID_AA64ISAR2, RPRFM, 48, 4)
 FIELD(ID_AA64ISAR2, CSSC, 52, 4)
+FIELD(ID_AA64ISAR2, LUT, 56, 4)
 FIELD(ID_AA64ISAR2, ATS1A, 60, 4)
 
 FIELD(ID_AA64PFR0, EL0, 0, 4)

From 694b2625dd4ac1d6f4aa4dfc8ed7380ec843cd9b Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:19:38 -0600
Subject: [PATCH 1962/2760] target/arm: Add ZT0

This is a 512-bit array introduced with SME2.
Save it only when ZA is in use.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-16-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h     |  3 +++
 target/arm/machine.c | 20 ++++++++++++++++++++
 2 files changed, 23 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index c6041a9357..cbc2043483 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -716,6 +716,9 @@ typedef struct CPUArchState {
     uint64_t scxtnum_el[4];
 
     struct {
+        /* SME2 ZT0 -- 512 bit array, with data ordered like ARMVectorReg. */
+        uint64_t zt0[512 / 64] QEMU_ALIGNED(16);
+
         /*
          * SME ZA storage -- 256 x 256 byte array, with bytes in host
          * word order, as we do with vfp.zregs[].  This corresponds to
diff --git a/target/arm/machine.c b/target/arm/machine.c
index 6e73368ef9..6986915bee 100644
--- a/target/arm/machine.c
+++ b/target/arm/machine.c
@@ -321,6 +321,25 @@ static const VMStateDescription vmstate_za = {
     }
 };
 
+static bool zt0_needed(void *opaque)
+{
+    ARMCPU *cpu = opaque;
+
+    return za_needed(cpu) && cpu_isar_feature(aa64_sme2, cpu);
+}
+
+static const VMStateDescription vmstate_zt0 = {
+    .name = "cpu/zt0",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .needed = zt0_needed,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT64_ARRAY(env.za_state.zt0, ARMCPU,
+                             ARRAY_SIZE(((CPUARMState *)0)->za_state.zt0)),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
 static bool serror_needed(void *opaque)
 {
     ARMCPU *cpu = opaque;
@@ -1096,6 +1115,7 @@ const VMStateDescription vmstate_arm_cpu = {
         &vmstate_m_security,
         &vmstate_sve,
         &vmstate_za,
+        &vmstate_zt0,
         &vmstate_serror,
         &vmstate_irq_line_state,
         &vmstate_wfxt_timer,

From 3aad4bc8beb9a3a8c1ea3dc6ca9bfc85d3c7c8a4 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:19:39 -0600
Subject: [PATCH 1963/2760] target/arm: Add zt0_excp_el to DisasContext

Pipe the value through from SMCR_ELx through hflags and into
the disassembly context.  Enable EZT0 in smcr_write.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-17-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.c               |  3 +++
 target/arm/cpu.h               |  2 ++
 target/arm/helper.c            |  6 +++++-
 target/arm/tcg/hflags.c        | 34 +++++++++++++++++++++++++++++++++-
 target/arm/tcg/translate-a64.c |  1 +
 target/arm/tcg/translate.h     |  1 +
 6 files changed, 45 insertions(+), 2 deletions(-)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index 6265627762..08c43f674a 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -635,6 +635,9 @@ void arm_emulate_firmware_reset(CPUState *cpustate, int target_el)
                 env->cp15.cptr_el[3] |= R_CPTR_EL3_ESM_MASK;
                 env->cp15.scr_el3 |= SCR_ENTP2;
                 env->vfp.smcr_el[3] = 0xf;
+                if (cpu_isar_feature(aa64_sme2, cpu)) {
+                    env->vfp.smcr_el[3] |= R_SMCR_EZT0_MASK;
+                }
             }
             if (cpu_isar_feature(aa64_hcx, cpu)) {
                 env->cp15.scr_el3 |= SCR_HXEN;
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index cbc2043483..39a9234ff2 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -1513,6 +1513,7 @@ FIELD(SVCR, ZA, 1, 1)
 
 /* Fields for SMCR_ELx. */
 FIELD(SMCR, LEN, 0, 4)
+FIELD(SMCR, EZT0, 30, 1)
 FIELD(SMCR, FA64, 31, 1)
 
 /* Write a new value to v7m.exception, thus transitioning into or out
@@ -3084,6 +3085,7 @@ FIELD(TBFLAG_A64, NV2_MEM_E20, 35, 1)
 FIELD(TBFLAG_A64, NV2_MEM_BE, 36, 1)
 FIELD(TBFLAG_A64, AH, 37, 1)   /* FPCR.AH */
 FIELD(TBFLAG_A64, NEP, 38, 1)   /* FPCR.NEP */
+FIELD(TBFLAG_A64, ZT0EXC_EL, 39, 2)
 
 /*
  * Helpers for using the above. Note that only the A64 accessors use
diff --git a/target/arm/helper.c b/target/arm/helper.c
index 3879bce848..b3f0d6f17a 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -6682,10 +6682,14 @@ static void smcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
 {
     int cur_el = arm_current_el(env);
     int old_len = sve_vqm1_for_el(env, cur_el);
+    uint64_t valid_mask = R_SMCR_LEN_MASK | R_SMCR_FA64_MASK;
     int new_len;
 
     QEMU_BUILD_BUG_ON(ARM_MAX_VQ > R_SMCR_LEN_MASK + 1);
-    value &= R_SMCR_LEN_MASK | R_SMCR_FA64_MASK;
+    if (cpu_isar_feature(aa64_sme2, env_archcpu(env))) {
+        valid_mask |= R_SMCR_EZT0_MASK;
+    }
+    value &= valid_mask;
     raw_write(env, ri, value);
 
     /*
diff --git a/target/arm/tcg/hflags.c b/target/arm/tcg/hflags.c
index 1ccec63bbd..59ab526375 100644
--- a/target/arm/tcg/hflags.c
+++ b/target/arm/tcg/hflags.c
@@ -214,6 +214,31 @@ static CPUARMTBFlags rebuild_hflags_a32(CPUARMState *env, int fp_el,
     return rebuild_hflags_common_32(env, fp_el, mmu_idx, flags);
 }
 
+/*
+ * Return the exception level to which exceptions should be taken for ZT0.
+ * C.f. the ARM pseudocode function CheckSMEZT0Enabled, after the ZA check.
+ */
+static int zt0_exception_el(CPUARMState *env, int el)
+{
+#ifndef CONFIG_USER_ONLY
+    if (el <= 1
+        && !el_is_in_host(env, el)
+        && !FIELD_EX64(env->vfp.smcr_el[1], SMCR, EZT0)) {
+        return 1;
+    }
+    if (el <= 2
+        && arm_is_el2_enabled(env)
+        && !FIELD_EX64(env->vfp.smcr_el[2], SMCR, EZT0)) {
+        return 2;
+    }
+    if (arm_feature(env, ARM_FEATURE_EL3)
+        && !FIELD_EX64(env->vfp.smcr_el[3], SMCR, EZT0)) {
+        return 3;
+    }
+#endif
+    return 0;
+}
+
 static CPUARMTBFlags rebuild_hflags_a64(CPUARMState *env, int el, int fp_el,
                                         ARMMMUIdx mmu_idx)
 {
@@ -269,7 +294,14 @@ static CPUARMTBFlags rebuild_hflags_a64(CPUARMState *env, int el, int fp_el,
             DP_TBFLAG_A64(flags, PSTATE_SM, 1);
             DP_TBFLAG_A64(flags, SME_TRAP_NONSTREAMING, !sme_fa64(env, el));
         }
-        DP_TBFLAG_A64(flags, PSTATE_ZA, FIELD_EX64(env->svcr, SVCR, ZA));
+
+        if (FIELD_EX64(env->svcr, SVCR, ZA)) {
+            DP_TBFLAG_A64(flags, PSTATE_ZA, 1);
+            if (cpu_isar_feature(aa64_sme2, env_archcpu(env))) {
+                int zt0_el = zt0_exception_el(env, el);
+                DP_TBFLAG_A64(flags, ZT0EXC_EL, zt0_el);
+            }
+        }
     }
 
     sctlr = regime_sctlr(env, stage1);
diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index b0caccca46..ad293c0885 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -10139,6 +10139,7 @@ static void aarch64_tr_init_disas_context(DisasContextBase *dcbase,
     dc->trap_eret = EX_TBFLAG_A64(tb_flags, TRAP_ERET);
     dc->sve_excp_el = EX_TBFLAG_A64(tb_flags, SVEEXC_EL);
     dc->sme_excp_el = EX_TBFLAG_A64(tb_flags, SMEEXC_EL);
+    dc->zt0_excp_el = EX_TBFLAG_A64(tb_flags, ZT0EXC_EL);
     dc->vl = (EX_TBFLAG_A64(tb_flags, VL) + 1) * 16;
     dc->svl = (EX_TBFLAG_A64(tb_flags, SVL) + 1) * 16;
     dc->pauth_active = EX_TBFLAG_A64(tb_flags, PAUTH_ACTIVE);
diff --git a/target/arm/tcg/translate.h b/target/arm/tcg/translate.h
index 0004a97219..b03956a793 100644
--- a/target/arm/tcg/translate.h
+++ b/target/arm/tcg/translate.h
@@ -70,6 +70,7 @@ typedef struct DisasContext {
     int fp_excp_el; /* FP exception EL or 0 if enabled */
     int sve_excp_el; /* SVE exception EL or 0 if enabled */
     int sme_excp_el; /* SME exception EL or 0 if enabled */
+    int zt0_excp_el; /* ZT0 exception EL or 0 if enabled */
     int vl;          /* current vector length in bytes */
     int svl;         /* current streaming vector length in bytes */
     bool vfp_enabled; /* FP enabled via FPSCR.EN */

From 10f02d0ced4e15343fd234d5c6b0e6725a4f7f16 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:19:40 -0600
Subject: [PATCH 1964/2760] target/arm: Implement SME2 ZERO ZT0

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-18-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/syndrome.h          |  1 +
 target/arm/tcg/sme.decode      |  1 +
 target/arm/tcg/translate-sme.c | 26 ++++++++++++++++++++++++++
 3 files changed, 28 insertions(+)

diff --git a/target/arm/syndrome.h b/target/arm/syndrome.h
index 3244e0740d..c48d3b8587 100644
--- a/target/arm/syndrome.h
+++ b/target/arm/syndrome.h
@@ -80,6 +80,7 @@ typedef enum {
     SME_ET_Streaming,
     SME_ET_NotStreaming,
     SME_ET_InactiveZA,
+    SME_ET_InaccessibleZT0,
 } SMEExceptionType;
 
 #define ARM_EL_EC_LENGTH 6
diff --git a/target/arm/tcg/sme.decode b/target/arm/tcg/sme.decode
index 628804e37a..dd1f983941 100644
--- a/target/arm/tcg/sme.decode
+++ b/target/arm/tcg/sme.decode
@@ -22,6 +22,7 @@
 ### SME Misc
 
 ZERO            11000000 00 001 00000000000 imm:8
+ZERO_zt0        11000000 01 001 00000000000 00000001
 
 ### SME Move into/from Array
 
diff --git a/target/arm/tcg/translate-sme.c b/target/arm/tcg/translate-sme.c
index e8b3578174..246f191eca 100644
--- a/target/arm/tcg/translate-sme.c
+++ b/target/arm/tcg/translate-sme.c
@@ -27,6 +27,19 @@
 
 #include "decode-sme.c.inc"
 
+static bool sme2_zt0_enabled_check(DisasContext *s)
+{
+    if (!sme_za_enabled_check(s)) {
+        return false;
+    }
+    if (s->zt0_excp_el) {
+        gen_exception_insn_el(s, 0, EXCP_UDEF,
+                              syn_smetrap(SME_ET_InaccessibleZT0, false),
+                              s->zt0_excp_el);
+        return false;
+    }
+    return true;
+}
 
 /*
  * Resolve tile.size[index] to a host pointer, where tile and index
@@ -130,6 +143,19 @@ static bool trans_ZERO(DisasContext *s, arg_ZERO *a)
     return true;
 }
 
+static bool trans_ZERO_zt0(DisasContext *s, arg_ZERO_zt0 *a)
+{
+    if (!dc_isar_feature(aa64_sme2, s)) {
+        return false;
+    }
+    if (sme_enabled_check(s) && sme2_zt0_enabled_check(s)) {
+        tcg_gen_gvec_dup_imm(MO_64, offsetof(CPUARMState, za_state.zt0),
+                             sizeof_field(CPUARMState, za_state.zt0),
+                             sizeof_field(CPUARMState, za_state.zt0), 0);
+    }
+    return true;
+}
+
 static bool trans_MOVA(DisasContext *s, arg_MOVA *a)
 {
     static gen_helper_gvec_4 * const h_fns[5] = {

From 83eae543efac1b2119eed5d888423fe9b87daa30 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:19:41 -0600
Subject: [PATCH 1965/2760] target/arm: Add alignment argument to gen_sve_{ldr,
 str}

Honor AlignmentEnforced() for LDR/STR (vector),
(predicate), and (array vector).

Within the expansion functions, clear @align when we're
done emitting loads at the largest size.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-19-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/translate-a64.h |  6 ++--
 target/arm/tcg/translate-sme.c |  5 ++--
 target/arm/tcg/translate-sve.c | 50 ++++++++++++++++++++++++----------
 3 files changed, 42 insertions(+), 19 deletions(-)

diff --git a/target/arm/tcg/translate-a64.h b/target/arm/tcg/translate-a64.h
index b2420f59eb..8a9f4b2053 100644
--- a/target/arm/tcg/translate-a64.h
+++ b/target/arm/tcg/translate-a64.h
@@ -225,7 +225,9 @@ void gen_gvec_usqadd_qc(unsigned vece, uint32_t rd_ofs,
                         uint32_t rn_ofs, uint32_t rm_ofs,
                         uint32_t opr_sz, uint32_t max_sz);
 
-void gen_sve_ldr(DisasContext *s, TCGv_ptr, int vofs, int len, int rn, int imm);
-void gen_sve_str(DisasContext *s, TCGv_ptr, int vofs, int len, int rn, int imm);
+void gen_sve_ldr(DisasContext *s, TCGv_ptr, int vofs,
+                 int len, int rn, int imm, MemOp align);
+void gen_sve_str(DisasContext *s, TCGv_ptr, int vofs,
+                 int len, int rn, int imm, MemOp align);
 
 #endif /* TARGET_ARM_TRANSLATE_A64_H */
diff --git a/target/arm/tcg/translate-sme.c b/target/arm/tcg/translate-sme.c
index 246f191eca..1dbd0199af 100644
--- a/target/arm/tcg/translate-sme.c
+++ b/target/arm/tcg/translate-sme.c
@@ -269,7 +269,7 @@ static bool trans_LDST1(DisasContext *s, arg_LDST1 *a)
     return true;
 }
 
-typedef void GenLdStR(DisasContext *, TCGv_ptr, int, int, int, int);
+typedef void GenLdStR(DisasContext *, TCGv_ptr, int, int, int, int, MemOp);
 
 static bool do_ldst_r(DisasContext *s, arg_ldstr *a, GenLdStR *fn)
 {
@@ -284,7 +284,8 @@ static bool do_ldst_r(DisasContext *s, arg_ldstr *a, GenLdStR *fn)
     /* ZA[n] equates to ZA0H.B[n]. */
     base = get_tile_rowcol(s, MO_8, a->rv, imm, false);
 
-    fn(s, base, 0, svl, a->rn, imm * svl);
+    fn(s, base, 0, svl, a->rn, imm * svl,
+       s->align_mem ? MO_ALIGN_16 : MO_UNALN);
     return true;
 }
 
diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
index 8403034a0e..d2cd298b5b 100644
--- a/target/arm/tcg/translate-sve.c
+++ b/target/arm/tcg/translate-sve.c
@@ -4160,7 +4160,7 @@ TRANS_FEAT(UCVTF_dd, aa64_sve, gen_gvec_fpst_arg_zpz,
  */
 
 void gen_sve_ldr(DisasContext *s, TCGv_ptr base, int vofs,
-                 int len, int rn, int imm)
+                 int len, int rn, int imm, MemOp align)
 {
     int len_align = QEMU_ALIGN_DOWN(len, 16);
     int len_remain = len % 16;
@@ -4189,12 +4189,15 @@ void gen_sve_ldr(DisasContext *s, TCGv_ptr base, int vofs,
 
         for (i = 0; i < len_align; i += 16) {
             tcg_gen_qemu_ld_i128(t16, clean_addr, midx,
-                                 MO_LE | MO_128 | MO_ATOM_NONE);
+                                 MO_LE | MO_128 | MO_ATOM_NONE | align);
             tcg_gen_extr_i128_i64(t0, t1, t16);
             tcg_gen_st_i64(t0, base, vofs + i);
             tcg_gen_st_i64(t1, base, vofs + i + 8);
             tcg_gen_addi_i64(clean_addr, clean_addr, 16);
         }
+        if (len_align) {
+            align = MO_UNALN;
+        }
     } else {
         TCGLabel *loop = gen_new_label();
         TCGv_ptr tp, i = tcg_temp_new_ptr();
@@ -4204,7 +4207,7 @@ void gen_sve_ldr(DisasContext *s, TCGv_ptr base, int vofs,
 
         t16 = tcg_temp_new_i128();
         tcg_gen_qemu_ld_i128(t16, clean_addr, midx,
-                             MO_LE | MO_128 | MO_ATOM_NONE);
+                             MO_LE | MO_128 | MO_ATOM_NONE | align);
         tcg_gen_addi_i64(clean_addr, clean_addr, 16);
 
         tp = tcg_temp_new_ptr();
@@ -4219,6 +4222,7 @@ void gen_sve_ldr(DisasContext *s, TCGv_ptr base, int vofs,
         tcg_gen_st_i64(t1, tp, vofs + 8);
 
         tcg_gen_brcondi_ptr(TCG_COND_LTU, i, len_align, loop);
+        align = MO_UNALN;
     }
 
     /*
@@ -4227,7 +4231,9 @@ void gen_sve_ldr(DisasContext *s, TCGv_ptr base, int vofs,
      */
     if (len_remain >= 8) {
         t0 = tcg_temp_new_i64();
-        tcg_gen_qemu_ld_i64(t0, clean_addr, midx, MO_LEUQ | MO_ATOM_NONE);
+        tcg_gen_qemu_ld_i64(t0, clean_addr, midx,
+                            MO_LEUQ | MO_ATOM_NONE | align);
+        align = MO_UNALN;
         tcg_gen_st_i64(t0, base, vofs + len_align);
         len_remain -= 8;
         len_align += 8;
@@ -4242,12 +4248,14 @@ void gen_sve_ldr(DisasContext *s, TCGv_ptr base, int vofs,
         case 4:
         case 8:
             tcg_gen_qemu_ld_i64(t0, clean_addr, midx,
-                                MO_LE | ctz32(len_remain) | MO_ATOM_NONE);
+                                MO_LE | ctz32(len_remain)
+                                | MO_ATOM_NONE | align);
             break;
 
         case 6:
             t1 = tcg_temp_new_i64();
-            tcg_gen_qemu_ld_i64(t0, clean_addr, midx, MO_LEUL | MO_ATOM_NONE);
+            tcg_gen_qemu_ld_i64(t0, clean_addr, midx,
+                                MO_LEUL | MO_ATOM_NONE | align);
             tcg_gen_addi_i64(clean_addr, clean_addr, 4);
             tcg_gen_qemu_ld_i64(t1, clean_addr, midx, MO_LEUW | MO_ATOM_NONE);
             tcg_gen_deposit_i64(t0, t0, t1, 32, 32);
@@ -4262,7 +4270,7 @@ void gen_sve_ldr(DisasContext *s, TCGv_ptr base, int vofs,
 
 /* Similarly for stores.  */
 void gen_sve_str(DisasContext *s, TCGv_ptr base, int vofs,
-                 int len, int rn, int imm)
+                 int len, int rn, int imm, MemOp align)
 {
     int len_align = QEMU_ALIGN_DOWN(len, 16);
     int len_remain = len % 16;
@@ -4294,9 +4302,12 @@ void gen_sve_str(DisasContext *s, TCGv_ptr base, int vofs,
             tcg_gen_ld_i64(t1, base, vofs + i + 8);
             tcg_gen_concat_i64_i128(t16, t0, t1);
             tcg_gen_qemu_st_i128(t16, clean_addr, midx,
-                                 MO_LE | MO_128 | MO_ATOM_NONE);
+                                 MO_LE | MO_128 | MO_ATOM_NONE | align);
             tcg_gen_addi_i64(clean_addr, clean_addr, 16);
         }
+        if (len_align) {
+            align = MO_UNALN;
+        }
     } else {
         TCGLabel *loop = gen_new_label();
         TCGv_ptr tp, i = tcg_temp_new_ptr();
@@ -4320,13 +4331,16 @@ void gen_sve_str(DisasContext *s, TCGv_ptr base, int vofs,
         tcg_gen_addi_i64(clean_addr, clean_addr, 16);
 
         tcg_gen_brcondi_ptr(TCG_COND_LTU, i, len_align, loop);
+        align = MO_UNALN;
     }
 
     /* Predicate register stores can be any multiple of 2.  */
     if (len_remain >= 8) {
         t0 = tcg_temp_new_i64();
         tcg_gen_ld_i64(t0, base, vofs + len_align);
-        tcg_gen_qemu_st_i64(t0, clean_addr, midx, MO_LEUQ | MO_ATOM_NONE);
+        tcg_gen_qemu_st_i64(t0, clean_addr, midx,
+                            MO_LEUQ | MO_ATOM_NONE | align);
+        align = MO_UNALN;
         len_remain -= 8;
         len_align += 8;
         if (len_remain) {
@@ -4342,11 +4356,13 @@ void gen_sve_str(DisasContext *s, TCGv_ptr base, int vofs,
         case 4:
         case 8:
             tcg_gen_qemu_st_i64(t0, clean_addr, midx,
-                                MO_LE | ctz32(len_remain) | MO_ATOM_NONE);
+                                MO_LE | ctz32(len_remain)
+                                | MO_ATOM_NONE | align);
             break;
 
         case 6:
-            tcg_gen_qemu_st_i64(t0, clean_addr, midx, MO_LEUL | MO_ATOM_NONE);
+            tcg_gen_qemu_st_i64(t0, clean_addr, midx,
+                                MO_LEUL | MO_ATOM_NONE | align);
             tcg_gen_addi_i64(clean_addr, clean_addr, 4);
             tcg_gen_shri_i64(t0, t0, 32);
             tcg_gen_qemu_st_i64(t0, clean_addr, midx, MO_LEUW | MO_ATOM_NONE);
@@ -4366,7 +4382,8 @@ static bool trans_LDR_zri(DisasContext *s, arg_rri *a)
     if (sve_access_check(s)) {
         int size = vec_full_reg_size(s);
         int off = vec_full_reg_offset(s, a->rd);
-        gen_sve_ldr(s, tcg_env, off, size, a->rn, a->imm * size);
+        gen_sve_ldr(s, tcg_env, off, size, a->rn, a->imm * size,
+                    s->align_mem ? MO_ALIGN_16 : MO_UNALN);
     }
     return true;
 }
@@ -4379,7 +4396,8 @@ static bool trans_LDR_pri(DisasContext *s, arg_rri *a)
     if (sve_access_check(s)) {
         int size = pred_full_reg_size(s);
         int off = pred_full_reg_offset(s, a->rd);
-        gen_sve_ldr(s, tcg_env, off, size, a->rn, a->imm * size);
+        gen_sve_ldr(s, tcg_env, off, size, a->rn, a->imm * size,
+                    s->align_mem ? MO_ALIGN_2 : MO_UNALN);
     }
     return true;
 }
@@ -4392,7 +4410,8 @@ static bool trans_STR_zri(DisasContext *s, arg_rri *a)
     if (sve_access_check(s)) {
         int size = vec_full_reg_size(s);
         int off = vec_full_reg_offset(s, a->rd);
-        gen_sve_str(s, tcg_env, off, size, a->rn, a->imm * size);
+        gen_sve_str(s, tcg_env, off, size, a->rn, a->imm * size,
+                    s->align_mem ? MO_ALIGN_16 : MO_UNALN);
     }
     return true;
 }
@@ -4405,7 +4424,8 @@ static bool trans_STR_pri(DisasContext *s, arg_rri *a)
     if (sve_access_check(s)) {
         int size = pred_full_reg_size(s);
         int off = pred_full_reg_offset(s, a->rd);
-        gen_sve_str(s, tcg_env, off, size, a->rn, a->imm * size);
+        gen_sve_str(s, tcg_env, off, size, a->rn, a->imm * size,
+                    s->align_mem ? MO_ALIGN_2 : MO_UNALN);
     }
     return true;
 }

From 12511e2a7621d7e812ef76c4b6f0846ce494f5b1 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:19:42 -0600
Subject: [PATCH 1966/2760] target/arm: Implement SME2 LDR/STR ZT0

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-20-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/sme.decode      |  6 ++++++
 target/arm/tcg/translate-sme.c | 13 +++++++++++++
 2 files changed, 19 insertions(+)

diff --git a/target/arm/tcg/sme.decode b/target/arm/tcg/sme.decode
index dd1f983941..cef49c3b29 100644
--- a/target/arm/tcg/sme.decode
+++ b/target/arm/tcg/sme.decode
@@ -55,6 +55,12 @@ LDST1           1110000 111     st:1 rm:5 v:1 .. pg:3 rn:5 0 za_imm:4  \
 LDR             1110000 100 0 000000 .. 000 ..... 0 ....        @ldstr
 STR             1110000 100 1 000000 .. 000 ..... 0 ....        @ldstr
 
+&ldstzt0        rn
+@ldstzt0        ....... ... . ...... .. ... rn:5  .....         &ldstzt0
+
+LDR_zt0         1110000 100 0 111111 00 000 ..... 00000         @ldstzt0
+STR_zt0         1110000 100 1 111111 00 000 ..... 00000         @ldstzt0
+
 ### SME Add Vector to Array
 
 &adda           zad zn pm pn
diff --git a/target/arm/tcg/translate-sme.c b/target/arm/tcg/translate-sme.c
index 1dbd0199af..9f25273992 100644
--- a/target/arm/tcg/translate-sme.c
+++ b/target/arm/tcg/translate-sme.c
@@ -292,6 +292,19 @@ static bool do_ldst_r(DisasContext *s, arg_ldstr *a, GenLdStR *fn)
 TRANS_FEAT(LDR, aa64_sme, do_ldst_r, a, gen_sve_ldr)
 TRANS_FEAT(STR, aa64_sme, do_ldst_r, a, gen_sve_str)
 
+static bool do_ldst_zt0(DisasContext *s, arg_ldstzt0 *a, GenLdStR *fn)
+{
+    if (sme2_zt0_enabled_check(s)) {
+        fn(s, tcg_env, offsetof(CPUARMState, za_state.zt0),
+           sizeof_field(CPUARMState, za_state.zt0), a->rn, 0,
+           s->align_mem ? MO_ALIGN_16 : MO_UNALN);
+    }
+    return true;
+}
+
+TRANS_FEAT(LDR_zt0, aa64_sme2, do_ldst_zt0, a, gen_sve_ldr)
+TRANS_FEAT(STR_zt0, aa64_sme2, do_ldst_zt0, a, gen_sve_str)
+
 static bool do_adda(DisasContext *s, arg_adda *a, MemOp esz,
                     gen_helper_gvec_4 *fn)
 {

From 4fc8b7f4bcb7d16b02afb9ca1ddae538bba03c17 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:19:43 -0600
Subject: [PATCH 1967/2760] target/arm: Implement SME2 MOVT

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-21-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/sme.decode      |  5 +++++
 target/arm/tcg/translate-sme.c | 13 +++++++++++++
 2 files changed, 18 insertions(+)

diff --git a/target/arm/tcg/sme.decode b/target/arm/tcg/sme.decode
index cef49c3b29..83ca6a9104 100644
--- a/target/arm/tcg/sme.decode
+++ b/target/arm/tcg/sme.decode
@@ -39,6 +39,11 @@ MOVA            11000000 esz:2 00001 0 v:1 .. pg:3 0 za_imm:4 zr:5  \
 MOVA            11000000 11    00001 1 v:1 .. pg:3 0 za_imm:4 zr:5  \
                 &mova to_vec=1 rs=%mova_rs esz=4
 
+### SME Move into/from ZT0
+
+MOVT_rzt        1100 0000 0100 1100 0 off:3 00 11111 rt:5
+MOVT_ztr        1100 0000 0100 1110 0 off:3 00 11111 rt:5
+
 ### SME Memory
 
 &ldst           esz rs pg rn rm za_imm v:bool st:bool
diff --git a/target/arm/tcg/translate-sme.c b/target/arm/tcg/translate-sme.c
index 9f25273992..797035e289 100644
--- a/target/arm/tcg/translate-sme.c
+++ b/target/arm/tcg/translate-sme.c
@@ -210,6 +210,19 @@ static bool trans_MOVA(DisasContext *s, arg_MOVA *a)
     return true;
 }
 
+static bool do_movt(DisasContext *s, arg_MOVT_rzt *a,
+                    void (*func)(TCGv_i64, TCGv_ptr, tcg_target_long))
+{
+    if (sme2_zt0_enabled_check(s)) {
+        func(cpu_reg(s, a->rt), tcg_env,
+             offsetof(CPUARMState, za_state.zt0) + a->off * 8);
+    }
+    return true;
+}
+
+TRANS_FEAT(MOVT_rzt, aa64_sme2, do_movt, a, tcg_gen_ld_i64)
+TRANS_FEAT(MOVT_ztr, aa64_sme2, do_movt, a, tcg_gen_st_i64)
+
 static bool trans_LDST1(DisasContext *s, arg_LDST1 *a)
 {
     typedef void GenLdSt1(TCGv_env, TCGv_ptr, TCGv_ptr, TCGv, TCGv_i32);

From 51a64f1e772746ad0581a3b0d7637995fa608540 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:19:44 -0600
Subject: [PATCH 1968/2760] target/arm: Split get_tile_rowcol argument
 tile_index

Decode tile number and index offset beforehand and separately.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-22-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/sme.decode      | 46 +++++++++++++++++++++++-----------
 target/arm/tcg/translate-sme.c | 17 +++++--------
 2 files changed, 38 insertions(+), 25 deletions(-)

diff --git a/target/arm/tcg/sme.decode b/target/arm/tcg/sme.decode
index 83ca6a9104..efe369e079 100644
--- a/target/arm/tcg/sme.decode
+++ b/target/arm/tcg/sme.decode
@@ -27,17 +27,29 @@ ZERO_zt0        11000000 01 001 00000000000 00000001
 ### SME Move into/from Array
 
 %mova_rs        13:2 !function=plus_12
-&mova           esz rs pg zr za_imm v:bool to_vec:bool
+&mova           esz rs pg zr za off v:bool to_vec:bool
 
-MOVA            11000000 esz:2 00000 0 v:1 .. pg:3 zr:5 0 za_imm:4  \
-                &mova to_vec=0 rs=%mova_rs
-MOVA            11000000 11    00000 1 v:1 .. pg:3 zr:5 0 za_imm:4  \
-                &mova to_vec=0 rs=%mova_rs esz=4
+MOVA            11000000 00 00000 0 v:1 .. pg:3 zr:5 0 off:4  \
+                &mova to_vec=0 rs=%mova_rs esz=0 za=0
+MOVA            11000000 01 00000 0 v:1 .. pg:3 zr:5 0 za:1 off:3  \
+                &mova to_vec=0 rs=%mova_rs esz=1
+MOVA            11000000 10 00000 0 v:1 .. pg:3 zr:5 0 za:2 off:2  \
+                &mova to_vec=0 rs=%mova_rs esz=2
+MOVA            11000000 11 00000 0 v:1 .. pg:3 zr:5 0 za:3 off:1  \
+                &mova to_vec=0 rs=%mova_rs esz=3
+MOVA            11000000 11 00000 1 v:1 .. pg:3 zr:5 0 za:4  \
+                &mova to_vec=0 rs=%mova_rs esz=4 off=0
 
-MOVA            11000000 esz:2 00001 0 v:1 .. pg:3 0 za_imm:4 zr:5  \
-                &mova to_vec=1 rs=%mova_rs
-MOVA            11000000 11    00001 1 v:1 .. pg:3 0 za_imm:4 zr:5  \
-                &mova to_vec=1 rs=%mova_rs esz=4
+MOVA            11000000 00 00001 0 v:1 .. pg:3 0 off:4      zr:5  \
+                &mova to_vec=1 rs=%mova_rs esz=0 za=0
+MOVA            11000000 01 00001 0 v:1 .. pg:3 0 za:1 off:3 zr:5  \
+                &mova to_vec=1 rs=%mova_rs esz=1
+MOVA            11000000 10 00001 0 v:1 .. pg:3 0 za:2 off:2 zr:5  \
+                &mova to_vec=1 rs=%mova_rs esz=2
+MOVA            11000000 11 00001 0 v:1 .. pg:3 0 za:3 off:1 zr:5  \
+                &mova to_vec=1 rs=%mova_rs esz=3
+MOVA            11000000 11 00001 1 v:1 .. pg:3 0 za:4       zr:5  \
+                &mova to_vec=1 rs=%mova_rs esz=4 off=0
 
 ### SME Move into/from ZT0
 
@@ -46,12 +58,18 @@ MOVT_ztr        1100 0000 0100 1110 0 off:3 00 11111 rt:5
 
 ### SME Memory
 
-&ldst           esz rs pg rn rm za_imm v:bool st:bool
+&ldst           esz rs pg rn rm za off v:bool st:bool
 
-LDST1           1110000 0 esz:2 st:1 rm:5 v:1 .. pg:3 rn:5 0 za_imm:4  \
-                &ldst rs=%mova_rs
-LDST1           1110000 111     st:1 rm:5 v:1 .. pg:3 rn:5 0 za_imm:4  \
-                &ldst esz=4 rs=%mova_rs
+LDST1           1110000 0 00 st:1 rm:5 v:1 .. pg:3 rn:5 0 off:4  \
+                &ldst rs=%mova_rs esz=0 za=0
+LDST1           1110000 0 01 st:1 rm:5 v:1 .. pg:3 rn:5 0 za:1 off:3  \
+                &ldst rs=%mova_rs esz=1
+LDST1           1110000 0 10 st:1 rm:5 v:1 .. pg:3 rn:5 0 za:2 off:2  \
+                &ldst rs=%mova_rs esz=2
+LDST1           1110000 0 11 st:1 rm:5 v:1 .. pg:3 rn:5 0 za:3 off:1  \
+                &ldst rs=%mova_rs esz=3
+LDST1           1110000 1 11 st:1 rm:5 v:1 .. pg:3 rn:5 0 za:4  \
+                &ldst rs=%mova_rs esz=4 off=0
 
 &ldstr          rv rn imm
 @ldstr          ....... ... . ...... .. ... rn:5 . imm:4 \
diff --git a/target/arm/tcg/translate-sme.c b/target/arm/tcg/translate-sme.c
index 797035e289..e22ec393fd 100644
--- a/target/arm/tcg/translate-sme.c
+++ b/target/arm/tcg/translate-sme.c
@@ -41,15 +41,10 @@ static bool sme2_zt0_enabled_check(DisasContext *s)
     return true;
 }
 
-/*
- * Resolve tile.size[index] to a host pointer, where tile and index
- * are always decoded together, dependent on the element size.
- */
+/* Resolve tile.size[rs+imm] to a host pointer. */
 static TCGv_ptr get_tile_rowcol(DisasContext *s, int esz, int rs,
-                                int tile_index, bool vertical)
+                                int tile, int imm, bool vertical)
 {
-    int tile = tile_index >> (4 - esz);
-    int index = esz == MO_128 ? 0 : extract32(tile_index, 0, 4 - esz);
     int pos, len, offset;
     TCGv_i32 tmp;
     TCGv_ptr addr;
@@ -57,7 +52,7 @@ static TCGv_ptr get_tile_rowcol(DisasContext *s, int esz, int rs,
     /* Compute the final index, which is Rs+imm. */
     tmp = tcg_temp_new_i32();
     tcg_gen_trunc_tl_i32(tmp, cpu_reg(s, rs));
-    tcg_gen_addi_i32(tmp, tmp, index);
+    tcg_gen_addi_i32(tmp, tmp, imm);
 
     /* Prepare a power-of-two modulo via extraction of @len bits. */
     len = ctz32(streaming_vec_reg_size(s)) - esz;
@@ -185,7 +180,7 @@ static bool trans_MOVA(DisasContext *s, arg_MOVA *a)
         return true;
     }
 
-    t_za = get_tile_rowcol(s, a->esz, a->rs, a->za_imm, a->v);
+    t_za = get_tile_rowcol(s, a->esz, a->rs, a->za, a->off, a->v);
     t_zr = vec_full_reg_ptr(s, a->zr);
     t_pg = pred_full_reg_ptr(s, a->pg);
 
@@ -264,7 +259,7 @@ static bool trans_LDST1(DisasContext *s, arg_LDST1 *a)
         return true;
     }
 
-    t_za = get_tile_rowcol(s, a->esz, a->rs, a->za_imm, a->v);
+    t_za = get_tile_rowcol(s, a->esz, a->rs, a->za, a->off, a->v);
     t_pg = pred_full_reg_ptr(s, a->pg);
     addr = tcg_temp_new_i64();
 
@@ -295,7 +290,7 @@ static bool do_ldst_r(DisasContext *s, arg_ldstr *a, GenLdStR *fn)
     }
 
     /* ZA[n] equates to ZA0H.B[n]. */
-    base = get_tile_rowcol(s, MO_8, a->rv, imm, false);
+    base = get_tile_rowcol(s, MO_8, a->rv, 0, imm, false);
 
     fn(s, base, 0, svl, a->rn, imm * svl,
        s->align_mem ? MO_ALIGN_16 : MO_UNALN);

From 2c43bee917bbb2c1844c30a21baaceee7874265c Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:19:45 -0600
Subject: [PATCH 1969/2760] target/arm: Rename MOVA for translate

Prepare for more kinds of MOVA from SME2 by renaming the
existing SME1 MOVA to indicate tile to/from vector.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-23-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/sme.decode      | 42 +++++++++++++++++-----------------
 target/arm/tcg/translate-sme.c | 12 +++++-----
 2 files changed, 27 insertions(+), 27 deletions(-)

diff --git a/target/arm/tcg/sme.decode b/target/arm/tcg/sme.decode
index efe369e079..459b96805f 100644
--- a/target/arm/tcg/sme.decode
+++ b/target/arm/tcg/sme.decode
@@ -27,29 +27,29 @@ ZERO_zt0        11000000 01 001 00000000000 00000001
 ### SME Move into/from Array
 
 %mova_rs        13:2 !function=plus_12
-&mova           esz rs pg zr za off v:bool to_vec:bool
+&mova_p         esz rs pg zr za off v:bool
 
-MOVA            11000000 00 00000 0 v:1 .. pg:3 zr:5 0 off:4  \
-                &mova to_vec=0 rs=%mova_rs esz=0 za=0
-MOVA            11000000 01 00000 0 v:1 .. pg:3 zr:5 0 za:1 off:3  \
-                &mova to_vec=0 rs=%mova_rs esz=1
-MOVA            11000000 10 00000 0 v:1 .. pg:3 zr:5 0 za:2 off:2  \
-                &mova to_vec=0 rs=%mova_rs esz=2
-MOVA            11000000 11 00000 0 v:1 .. pg:3 zr:5 0 za:3 off:1  \
-                &mova to_vec=0 rs=%mova_rs esz=3
-MOVA            11000000 11 00000 1 v:1 .. pg:3 zr:5 0 za:4  \
-                &mova to_vec=0 rs=%mova_rs esz=4 off=0
+MOVA_tz         11000000 00 00000 0 v:1 .. pg:3 zr:5 0 off:4  \
+                &mova_p rs=%mova_rs esz=0 za=0
+MOVA_tz         11000000 01 00000 0 v:1 .. pg:3 zr:5 0 za:1 off:3  \
+                &mova_p rs=%mova_rs esz=1
+MOVA_tz         11000000 10 00000 0 v:1 .. pg:3 zr:5 0 za:2 off:2  \
+                &mova_p rs=%mova_rs esz=2
+MOVA_tz         11000000 11 00000 0 v:1 .. pg:3 zr:5 0 za:3 off:1  \
+                &mova_p rs=%mova_rs esz=3
+MOVA_tz         11000000 11 00000 1 v:1 .. pg:3 zr:5 0 za:4  \
+                &mova_p rs=%mova_rs esz=4 off=0
 
-MOVA            11000000 00 00001 0 v:1 .. pg:3 0 off:4      zr:5  \
-                &mova to_vec=1 rs=%mova_rs esz=0 za=0
-MOVA            11000000 01 00001 0 v:1 .. pg:3 0 za:1 off:3 zr:5  \
-                &mova to_vec=1 rs=%mova_rs esz=1
-MOVA            11000000 10 00001 0 v:1 .. pg:3 0 za:2 off:2 zr:5  \
-                &mova to_vec=1 rs=%mova_rs esz=2
-MOVA            11000000 11 00001 0 v:1 .. pg:3 0 za:3 off:1 zr:5  \
-                &mova to_vec=1 rs=%mova_rs esz=3
-MOVA            11000000 11 00001 1 v:1 .. pg:3 0 za:4       zr:5  \
-                &mova to_vec=1 rs=%mova_rs esz=4 off=0
+MOVA_zt         11000000 00 00001 0 v:1 .. pg:3 0 off:4      zr:5  \
+                &mova_p rs=%mova_rs esz=0 za=0
+MOVA_zt         11000000 01 00001 0 v:1 .. pg:3 0 za:1 off:3 zr:5  \
+                &mova_p rs=%mova_rs esz=1
+MOVA_zt         11000000 10 00001 0 v:1 .. pg:3 0 za:2 off:2 zr:5  \
+                &mova_p rs=%mova_rs esz=2
+MOVA_zt         11000000 11 00001 0 v:1 .. pg:3 0 za:3 off:1 zr:5  \
+                &mova_p rs=%mova_rs esz=3
+MOVA_zt         11000000 11 00001 1 v:1 .. pg:3 0 za:4       zr:5  \
+                &mova_p rs=%mova_rs esz=4 off=0
 
 ### SME Move into/from ZT0
 
diff --git a/target/arm/tcg/translate-sme.c b/target/arm/tcg/translate-sme.c
index e22ec393fd..2c8cb24b7c 100644
--- a/target/arm/tcg/translate-sme.c
+++ b/target/arm/tcg/translate-sme.c
@@ -151,7 +151,7 @@ static bool trans_ZERO_zt0(DisasContext *s, arg_ZERO_zt0 *a)
     return true;
 }
 
-static bool trans_MOVA(DisasContext *s, arg_MOVA *a)
+static bool do_mova_tile(DisasContext *s, arg_mova_p *a, bool to_vec)
 {
     static gen_helper_gvec_4 * const h_fns[5] = {
         gen_helper_sve_sel_zpzz_b, gen_helper_sve_sel_zpzz_h,
@@ -173,9 +173,6 @@ static bool trans_MOVA(DisasContext *s, arg_MOVA *a)
     TCGv_i32 t_desc;
     int svl;
 
-    if (!dc_isar_feature(aa64_sme, s)) {
-        return false;
-    }
     if (!sme_smza_enabled_check(s)) {
         return true;
     }
@@ -189,14 +186,14 @@ static bool trans_MOVA(DisasContext *s, arg_MOVA *a)
 
     if (a->v) {
         /* Vertical slice -- use sme mova helpers. */
-        if (a->to_vec) {
+        if (to_vec) {
             zc_fns[a->esz](t_zr, t_za, t_pg, t_desc);
         } else {
             cz_fns[a->esz](t_za, t_zr, t_pg, t_desc);
         }
     } else {
         /* Horizontal slice -- reuse sve sel helpers. */
-        if (a->to_vec) {
+        if (to_vec) {
             h_fns[a->esz](t_zr, t_za, t_zr, t_pg, t_desc);
         } else {
             h_fns[a->esz](t_za, t_zr, t_za, t_pg, t_desc);
@@ -205,6 +202,9 @@ static bool trans_MOVA(DisasContext *s, arg_MOVA *a)
     return true;
 }
 
+TRANS_FEAT(MOVA_tz, aa64_sme, do_mova_tile, a, false)
+TRANS_FEAT(MOVA_zt, aa64_sme, do_mova_tile, a, true)
+
 static bool do_movt(DisasContext *s, arg_MOVT_rzt *a,
                     void (*func)(TCGv_i64, TCGv_ptr, tcg_target_long))
 {

From 7afb9855fc81a0ac138b398aa645aff552d52ea5 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:19:46 -0600
Subject: [PATCH 1970/2760] target/arm: Split out get_zarray

Prepare for MOVA array to/from vector with multiple registers
by adding a div_len parameter, herein always 1, and a vec_mod
parameter, herein always 0.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-24-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/translate-sme.c | 47 +++++++++++++++++++++++-----------
 1 file changed, 32 insertions(+), 15 deletions(-)

diff --git a/target/arm/tcg/translate-sme.c b/target/arm/tcg/translate-sme.c
index 2c8cb24b7c..ea0e5a7cb5 100644
--- a/target/arm/tcg/translate-sme.c
+++ b/target/arm/tcg/translate-sme.c
@@ -43,7 +43,8 @@ static bool sme2_zt0_enabled_check(DisasContext *s)
 
 /* Resolve tile.size[rs+imm] to a host pointer. */
 static TCGv_ptr get_tile_rowcol(DisasContext *s, int esz, int rs,
-                                int tile, int imm, bool vertical)
+                                int tile, int imm, int div_len,
+                                int vec_mod, bool vertical)
 {
     int pos, len, offset;
     TCGv_i32 tmp;
@@ -52,10 +53,23 @@ static TCGv_ptr get_tile_rowcol(DisasContext *s, int esz, int rs,
     /* Compute the final index, which is Rs+imm. */
     tmp = tcg_temp_new_i32();
     tcg_gen_trunc_tl_i32(tmp, cpu_reg(s, rs));
+    /*
+     * Round the vector index down to a multiple of vec_mod if necessary.
+     * We do this before adding the offset, to handle cases like
+     * MOVA (tile to vector, 2 registers) where we want to call this
+     * several times in a loop with an increasing offset. We rely on
+     * the instruction encodings always forcing the initial offset in
+     * [rs + offset] to be a multiple of vec_mod. The pseudocode usually
+     * does the round-down after adding the offset rather than before,
+     * but MOVA is an exception.
+     */
+    if (vec_mod > 1) {
+        tcg_gen_andc_i32(tmp, tmp, tcg_constant_i32(vec_mod - 1));
+    }
     tcg_gen_addi_i32(tmp, tmp, imm);
 
     /* Prepare a power-of-two modulo via extraction of @len bits. */
-    len = ctz32(streaming_vec_reg_size(s)) - esz;
+    len = ctz32(streaming_vec_reg_size(s) / div_len) - esz;
 
     if (!len) {
         /*
@@ -111,6 +125,14 @@ static TCGv_ptr get_tile_rowcol(DisasContext *s, int esz, int rs,
     return addr;
 }
 
+/* Resolve ZArray[rs+imm] to a host pointer. */
+static TCGv_ptr get_zarray(DisasContext *s, int rs, int imm,
+                           int div_len, int vec_mod)
+{
+    /* ZA[n] equates to ZA0H.B[n]. */
+    return get_tile_rowcol(s, MO_8, rs, 0, imm, div_len, vec_mod, false);
+}
+
 /*
  * Resolve tile.size[0] to a host pointer.
  * Used by e.g. outer product insns where we require the entire tile.
@@ -177,7 +199,7 @@ static bool do_mova_tile(DisasContext *s, arg_mova_p *a, bool to_vec)
         return true;
     }
 
-    t_za = get_tile_rowcol(s, a->esz, a->rs, a->za, a->off, a->v);
+    t_za = get_tile_rowcol(s, a->esz, a->rs, a->za, a->off, 1, 0, a->v);
     t_zr = vec_full_reg_ptr(s, a->zr);
     t_pg = pred_full_reg_ptr(s, a->pg);
 
@@ -259,7 +281,7 @@ static bool trans_LDST1(DisasContext *s, arg_LDST1 *a)
         return true;
     }
 
-    t_za = get_tile_rowcol(s, a->esz, a->rs, a->za, a->off, a->v);
+    t_za = get_tile_rowcol(s, a->esz, a->rs, a->za, a->off, 1, 0, a->v);
     t_pg = pred_full_reg_ptr(s, a->pg);
     addr = tcg_temp_new_i64();
 
@@ -281,19 +303,14 @@ typedef void GenLdStR(DisasContext *, TCGv_ptr, int, int, int, int, MemOp);
 
 static bool do_ldst_r(DisasContext *s, arg_ldstr *a, GenLdStR *fn)
 {
-    int svl = streaming_vec_reg_size(s);
-    int imm = a->imm;
-    TCGv_ptr base;
+    if (sme_za_enabled_check(s)) {
+        int svl = streaming_vec_reg_size(s);
+        int imm = a->imm;
+        TCGv_ptr base = get_zarray(s, a->rv, imm, 1, 0);
 
-    if (!sme_za_enabled_check(s)) {
-        return true;
+        fn(s, base, 0, svl, a->rn, imm * svl,
+           s->align_mem ? MO_ALIGN_16 : MO_UNALN);
     }
-
-    /* ZA[n] equates to ZA0H.B[n]. */
-    base = get_tile_rowcol(s, MO_8, a->rv, 0, imm, false);
-
-    fn(s, base, 0, svl, a->rn, imm * svl,
-       s->align_mem ? MO_ALIGN_16 : MO_UNALN);
     return true;
 }
 

From c48d0471beb0cb197efda0b2be3fa75b4628a673 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:19:47 -0600
Subject: [PATCH 1971/2760] target/arm: Introduce ARMCPU.sme_max_vq

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-25-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h   | 1 +
 target/arm/cpu64.c | 1 +
 2 files changed, 2 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index 39a9234ff2..c8cf0ab417 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -1136,6 +1136,7 @@ struct ArchCPU {
 
     /* Used to set the maximum vector length the cpu will support.  */
     uint32_t sve_max_vq;
+    uint32_t sme_max_vq;
 
 #ifdef CONFIG_USER_ONLY
     /* Used to set the default vector length at process start. */
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index 77e7c4a6a5..bd33d6cc6e 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -363,6 +363,7 @@ void arm_cpu_sme_finalize(ARMCPU *cpu, Error **errp)
     }
 
     cpu->sme_vq.map = vq_map;
+    cpu->sme_max_vq = 32 - clz32(vq_map);
 }
 
 static bool cpu_arm_get_sme(Object *obj, Error **errp)

From 72cd08eb7614af79c7ef9fd66ff4e51352ad103b Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:19:48 -0600
Subject: [PATCH 1972/2760] target/arm: Implement SME2 MOVA to/from tile,
 multiple registers

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-26-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/helper-sme.h    |  9 +++++
 target/arm/tcg/sme.decode      | 37 ++++++++++++++++++
 target/arm/tcg/sme_helper.c    | 64 ++++++++++++++++++++++++++++++
 target/arm/tcg/translate-a64.c |  1 +
 target/arm/tcg/translate-sme.c | 71 ++++++++++++++++++++++++++++++++++
 target/arm/tcg/translate.h     |  1 +
 6 files changed, 183 insertions(+)

diff --git a/target/arm/tcg/helper-sme.h b/target/arm/tcg/helper-sme.h
index 858d69188f..8246ce774c 100644
--- a/target/arm/tcg/helper-sme.h
+++ b/target/arm/tcg/helper-sme.h
@@ -33,6 +33,15 @@ DEF_HELPER_FLAGS_4(sme_mova_zc_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(sme_mova_cz_q, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(sme_mova_zc_q, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 
+DEF_HELPER_FLAGS_3(sme2_mova_cz_b, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(sme2_mova_zc_b, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(sme2_mova_cz_h, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(sme2_mova_zc_h, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(sme2_mova_cz_s, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(sme2_mova_zc_s, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(sme2_mova_cz_d, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(sme2_mova_zc_d, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+
 DEF_HELPER_FLAGS_5(sme_ld1b_h, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
 DEF_HELPER_FLAGS_5(sme_ld1b_v, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
 DEF_HELPER_FLAGS_5(sme_ld1b_h_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
diff --git a/target/arm/tcg/sme.decode b/target/arm/tcg/sme.decode
index 459b96805f..5eca5f4acf 100644
--- a/target/arm/tcg/sme.decode
+++ b/target/arm/tcg/sme.decode
@@ -28,6 +28,7 @@ ZERO_zt0        11000000 01 001 00000000000 00000001
 
 %mova_rs        13:2 !function=plus_12
 &mova_p         esz rs pg zr za off v:bool
+&mova_t         esz rs zr za off v:bool
 
 MOVA_tz         11000000 00 00000 0 v:1 .. pg:3 zr:5 0 off:4  \
                 &mova_p rs=%mova_rs esz=0 za=0
@@ -51,6 +52,42 @@ MOVA_zt         11000000 11 00001 0 v:1 .. pg:3 0 za:3 off:1 zr:5  \
 MOVA_zt         11000000 11 00001 1 v:1 .. pg:3 0 za:4       zr:5  \
                 &mova_p rs=%mova_rs esz=4 off=0
 
+MOVA_tz2        11000000 00 00010 0 v:1 .. 000  zr:4 0 00      off:3  \
+                &mova_t rs=%mova_rs esz=0 za=0
+MOVA_tz2        11000000 01 00010 0 v:1 .. 000  zr:4 0 00 za:1 off:2  \
+                &mova_t rs=%mova_rs esz=1
+MOVA_tz2        11000000 10 00010 0 v:1 .. 000  zr:4 0 00 za:2 off:1  \
+                &mova_t rs=%mova_rs esz=2
+MOVA_tz2        11000000 11 00010 0 v:1 .. 000  zr:4 0 00 za:3        \
+                &mova_t rs=%mova_rs esz=3 off=0
+
+MOVA_zt2        11000000 00 00011 0 v:1 .. 000 00      off:3 zr:4 0 \
+                &mova_t rs=%mova_rs esz=0 za=0
+MOVA_zt2        11000000 01 00011 0 v:1 .. 000 00 za:1 off:2 zr:4 0 \
+                &mova_t rs=%mova_rs esz=1
+MOVA_zt2        11000000 10 00011 0 v:1 .. 000 00 za:2 off:1 zr:4 0 \
+                &mova_t rs=%mova_rs esz=2
+MOVA_zt2        11000000 11 00011 0 v:1 .. 000 00 za:3       zr:4 0 \
+                &mova_t rs=%mova_rs esz=3 off=0
+
+MOVA_tz4        11000000 00 00010 0 v:1 .. 001 zr:3 00 000      off:2  \
+                &mova_t rs=%mova_rs esz=0 za=0
+MOVA_tz4        11000000 01 00010 0 v:1 .. 001 zr:3 00 000 za:1 off:1  \
+                &mova_t rs=%mova_rs esz=1
+MOVA_tz4        11000000 10 00010 0 v:1 .. 001 zr:3 00 000 za:2        \
+                &mova_t rs=%mova_rs esz=2 off=0
+MOVA_tz4        11000000 11 00010 0 v:1 .. 001 zr:3 00 00 za:3         \
+                &mova_t rs=%mova_rs esz=3 off=0
+
+MOVA_zt4        11000000 00 00011 0 v:1 .. 001 000      off:2 zr:3 00 \
+                &mova_t rs=%mova_rs esz=0 za=0
+MOVA_zt4        11000000 01 00011 0 v:1 .. 001 000 za:1 off:1 zr:3 00 \
+                &mova_t rs=%mova_rs esz=1
+MOVA_zt4        11000000 10 00011 0 v:1 .. 001 000 za:2       zr:3 00 \
+                &mova_t rs=%mova_rs esz=2 off=0
+MOVA_zt4        11000000 11 00011 0 v:1 .. 001 00 za:3        zr:3 00 \
+                &mova_t rs=%mova_rs esz=3 off=0
+
 ### SME Move into/from ZT0
 
 MOVT_rzt        1100 0000 0100 1100 0 off:3 00 11111 rt:5
diff --git a/target/arm/tcg/sme_helper.c b/target/arm/tcg/sme_helper.c
index 7b0bc1b17c..baeaa3e069 100644
--- a/target/arm/tcg/sme_helper.c
+++ b/target/arm/tcg/sme_helper.c
@@ -206,6 +206,50 @@ void HELPER(sme_mova_zc_q)(void *vd, void *za, void *vg, uint32_t desc)
 
 #undef DO_MOVA_Z
 
+void HELPER(sme2_mova_zc_b)(void *vdst, void *vsrc, uint32_t desc)
+{
+    const uint8_t *src = vsrc;
+    uint8_t *dst = vdst;
+    size_t i, n = simd_oprsz(desc);
+
+    for (i = 0; i < n; ++i) {
+        dst[i] = src[tile_vslice_index(i)];
+    }
+}
+
+void HELPER(sme2_mova_zc_h)(void *vdst, void *vsrc, uint32_t desc)
+{
+    const uint16_t *src = vsrc;
+    uint16_t *dst = vdst;
+    size_t i, n = simd_oprsz(desc) / 2;
+
+    for (i = 0; i < n; ++i) {
+        dst[i] = src[tile_vslice_index(i)];
+    }
+}
+
+void HELPER(sme2_mova_zc_s)(void *vdst, void *vsrc, uint32_t desc)
+{
+    const uint32_t *src = vsrc;
+    uint32_t *dst = vdst;
+    size_t i, n = simd_oprsz(desc) / 4;
+
+    for (i = 0; i < n; ++i) {
+        dst[i] = src[tile_vslice_index(i)];
+    }
+}
+
+void HELPER(sme2_mova_zc_d)(void *vdst, void *vsrc, uint32_t desc)
+{
+    const uint64_t *src = vsrc;
+    uint64_t *dst = vdst;
+    size_t i, n = simd_oprsz(desc) / 8;
+
+    for (i = 0; i < n; ++i) {
+        dst[i] = src[tile_vslice_index(i)];
+    }
+}
+
 /*
  * Clear elements in a tile slice comprising len bytes.
  */
@@ -314,6 +358,26 @@ static void copy_vertical_q(void *vdst, const void *vsrc, size_t len)
     }
 }
 
+void HELPER(sme2_mova_cz_b)(void *vdst, void *vsrc, uint32_t desc)
+{
+    copy_vertical_b(vdst, vsrc, simd_oprsz(desc));
+}
+
+void HELPER(sme2_mova_cz_h)(void *vdst, void *vsrc, uint32_t desc)
+{
+    copy_vertical_h(vdst, vsrc, simd_oprsz(desc));
+}
+
+void HELPER(sme2_mova_cz_s)(void *vdst, void *vsrc, uint32_t desc)
+{
+    copy_vertical_s(vdst, vsrc, simd_oprsz(desc));
+}
+
+void HELPER(sme2_mova_cz_d)(void *vdst, void *vsrc, uint32_t desc)
+{
+    copy_vertical_d(vdst, vsrc, simd_oprsz(desc));
+}
+
 /*
  * Host and TLB primitives for vertical tile slice addressing.
  */
diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index ad293c0885..d823036c96 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -10142,6 +10142,7 @@ static void aarch64_tr_init_disas_context(DisasContextBase *dcbase,
     dc->zt0_excp_el = EX_TBFLAG_A64(tb_flags, ZT0EXC_EL);
     dc->vl = (EX_TBFLAG_A64(tb_flags, VL) + 1) * 16;
     dc->svl = (EX_TBFLAG_A64(tb_flags, SVL) + 1) * 16;
+    dc->max_svl = arm_cpu->sme_max_vq * 16;
     dc->pauth_active = EX_TBFLAG_A64(tb_flags, PAUTH_ACTIVE);
     dc->bt = EX_TBFLAG_A64(tb_flags, BT);
     dc->btype = EX_TBFLAG_A64(tb_flags, BTYPE);
diff --git a/target/arm/tcg/translate-sme.c b/target/arm/tcg/translate-sme.c
index ea0e5a7cb5..7d4c7d7e85 100644
--- a/target/arm/tcg/translate-sme.c
+++ b/target/arm/tcg/translate-sme.c
@@ -227,6 +227,77 @@ static bool do_mova_tile(DisasContext *s, arg_mova_p *a, bool to_vec)
 TRANS_FEAT(MOVA_tz, aa64_sme, do_mova_tile, a, false)
 TRANS_FEAT(MOVA_zt, aa64_sme, do_mova_tile, a, true)
 
+static bool do_mova_tile_n(DisasContext *s, arg_mova_t *a, int n, bool to_vec)
+{
+    static gen_helper_gvec_2 * const cz_fns[] = {
+        gen_helper_sme2_mova_cz_b, gen_helper_sme2_mova_cz_h,
+        gen_helper_sme2_mova_cz_s, gen_helper_sme2_mova_cz_d,
+    };
+    static gen_helper_gvec_2 * const zc_fns[] = {
+        gen_helper_sme2_mova_zc_b, gen_helper_sme2_mova_zc_h,
+        gen_helper_sme2_mova_zc_s, gen_helper_sme2_mova_zc_d,
+    };
+    TCGv_ptr t_za;
+    int svl, bytes_per_op = n << a->esz;
+
+    /*
+     * The MaxImplementedSVL check happens in the decode pseudocode,
+     * before the SM+ZA enabled check in the operation pseudocode.
+     * This will (currently) only fail for NREG=4, ESZ=MO_64.
+     */
+    if (s->max_svl < bytes_per_op) {
+        unallocated_encoding(s);
+        return true;
+    }
+
+    if (!sme_smza_enabled_check(s)) {
+        return true;
+    }
+
+    svl = streaming_vec_reg_size(s);
+
+    /*
+     * The CurrentVL check happens in the operation pseudocode,
+     * after the SM+ZA enabled check.
+     */
+    if (svl < bytes_per_op) {
+        unallocated_encoding(s);
+        return true;
+    }
+
+    if (a->v) {
+        TCGv_i32 t_desc = tcg_constant_i32(simd_desc(svl, svl, 0));
+
+        for (int i = 0; i < n; ++i) {
+            TCGv_ptr t_zr = vec_full_reg_ptr(s, a->zr * n + i);
+            t_za = get_tile_rowcol(s, a->esz, a->rs, a->za,
+                                   a->off * n + i, 1, n, a->v);
+            if (to_vec) {
+                zc_fns[a->esz](t_zr, t_za, t_desc);
+            } else {
+                cz_fns[a->esz](t_za, t_zr, t_desc);
+            }
+        }
+    } else {
+        for (int i = 0; i < n; ++i) {
+            int o_zr = vec_full_reg_offset(s, a->zr * n + i);
+            t_za = get_tile_rowcol(s, a->esz, a->rs, a->za,
+                                   a->off * n + i, 1, n, a->v);
+            if (to_vec) {
+                tcg_gen_gvec_mov_var(MO_8, tcg_env, o_zr, t_za, 0, svl, svl);
+            } else {
+                tcg_gen_gvec_mov_var(MO_8, t_za, 0, tcg_env, o_zr, svl, svl);
+            }
+        }
+    }
+    return true;
+}
+
+TRANS_FEAT(MOVA_tz2, aa64_sme2, do_mova_tile_n, a, 2, false)
+TRANS_FEAT(MOVA_tz4, aa64_sme2, do_mova_tile_n, a, 4, false)
+TRANS_FEAT(MOVA_zt2, aa64_sme2, do_mova_tile_n, a, 2, true)
+TRANS_FEAT(MOVA_zt4, aa64_sme2, do_mova_tile_n, a, 4, true)
+
 static bool do_movt(DisasContext *s, arg_MOVT_rzt *a,
                     void (*func)(TCGv_i64, TCGv_ptr, tcg_target_long))
 {
diff --git a/target/arm/tcg/translate.h b/target/arm/tcg/translate.h
index b03956a793..7336b7db72 100644
--- a/target/arm/tcg/translate.h
+++ b/target/arm/tcg/translate.h
@@ -73,6 +73,7 @@ typedef struct DisasContext {
     int zt0_excp_el; /* ZT0 exception EL or 0 if enabled */
     int vl;          /* current vector length in bytes */
     int svl;         /* current streaming vector length in bytes */
+    int max_svl;     /* maximum implemented streaming vector length */
     bool vfp_enabled; /* FP enabled via FPSCR.EN */
     int vec_len;
     int vec_stride;

From e9de40e53821d4c2adbb115a412991b15cd59a76 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:19:49 -0600
Subject: [PATCH 1973/2760] target/arm: Implement SME2 MOVA to/from array,
 multiple registers

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-27-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/sme.decode      | 12 ++++++++++++
 target/arm/tcg/translate-sme.c | 30 ++++++++++++++++++++++++++++++
 target/arm/tcg/translate.h     |  5 +++++
 3 files changed, 47 insertions(+)

diff --git a/target/arm/tcg/sme.decode b/target/arm/tcg/sme.decode
index 5eca5f4acf..37bd0c6198 100644
--- a/target/arm/tcg/sme.decode
+++ b/target/arm/tcg/sme.decode
@@ -27,6 +27,8 @@ ZERO_zt0        11000000 01 001 00000000000 00000001
 ### SME Move into/from Array
 
 %mova_rs        13:2 !function=plus_12
+%mova_rv        13:2 !function=plus_8
+&mova_a         rv zr off
 &mova_p         esz rs pg zr za off v:bool
 &mova_t         esz rs zr za off v:bool
 
@@ -88,6 +90,16 @@ MOVA_zt4        11000000 10 00011 0 v:1 .. 001 000 za:2       zr:3 00 \
 MOVA_zt4        11000000 11 00011 0 v:1 .. 001 00 za:3        zr:3 00 \
                 &mova_t rs=%mova_rs esz=3 off=0
 
+MOVA_az2        11000000 00 00010 00 .. 010 zr:4  000 off:3  \
+                &mova_a rv=%mova_rv
+MOVA_az4        11000000 00 00010 00 .. 011 zr:3 0000 off:3  \
+                &mova_a rv=%mova_rv
+
+MOVA_za2        11000000 00 00011 00 .. 010 00 off:3 zr:4 0  \
+                &mova_a rv=%mova_rv
+MOVA_za4        11000000 00 00011 00 .. 011 00 off:3 zr:3 00 \
+                &mova_a rv=%mova_rv
+
 ### SME Move into/from ZT0
 
 MOVT_rzt        1100 0000 0100 1100 0 off:3 00 11111 rt:5
diff --git a/target/arm/tcg/translate-sme.c b/target/arm/tcg/translate-sme.c
index 7d4c7d7e85..7b275dd2b8 100644
--- a/target/arm/tcg/translate-sme.c
+++ b/target/arm/tcg/translate-sme.c
@@ -298,6 +298,36 @@ TRANS_FEAT(MOVA_tz4, aa64_sme2, do_mova_tile_n, a, 4, false)
 TRANS_FEAT(MOVA_zt2, aa64_sme2, do_mova_tile_n, a, 2, true)
 TRANS_FEAT(MOVA_zt4, aa64_sme2, do_mova_tile_n, a, 4, true)
 
+static bool do_mova_array_n(DisasContext *s, arg_mova_a *a, int n, bool to_vec)
+{
+    TCGv_ptr t_za;
+    int svl;
+
+    if (!sme_smza_enabled_check(s)) {
+        return true;
+    }
+
+    svl = streaming_vec_reg_size(s);
+    t_za = get_zarray(s, a->rv, a->off, n, 0);
+
+    for (int i = 0; i < n; ++i) {
+        int o_za = (svl / n * sizeof(ARMVectorReg)) * i;
+        int o_zr = vec_full_reg_offset(s, a->zr * n + i);
+
+        if (to_vec) {
+            tcg_gen_gvec_mov_var(MO_8, tcg_env, o_zr, t_za, o_za, svl, svl);
+        } else {
+            tcg_gen_gvec_mov_var(MO_8, t_za, o_za, tcg_env, o_zr, svl, svl);
+        }
+    }
+    return true;
+}
+
+TRANS_FEAT(MOVA_az2, aa64_sme2, do_mova_array_n, a, 2, false)
+TRANS_FEAT(MOVA_az4, aa64_sme2, do_mova_array_n, a, 4, false)
+TRANS_FEAT(MOVA_za2, aa64_sme2, do_mova_array_n, a, 2, true)
+TRANS_FEAT(MOVA_za4, aa64_sme2, do_mova_array_n, a, 4, true)
+
 static bool do_movt(DisasContext *s, arg_MOVT_rzt *a,
                     void (*func)(TCGv_i64, TCGv_ptr, tcg_target_long))
 {
diff --git a/target/arm/tcg/translate.h b/target/arm/tcg/translate.h
index 7336b7db72..a18d07540e 100644
--- a/target/arm/tcg/translate.h
+++ b/target/arm/tcg/translate.h
@@ -210,6 +210,11 @@ static inline int plus_2(DisasContext *s, int x)
     return x + 2;
 }
 
+static inline int plus_8(DisasContext *s, int x)
+{
+    return x + 8;
+}
+
 static inline int plus_12(DisasContext *s, int x)
 {
     return x + 12;

From 24b5220f4c9d168b1acbbba71044d7848c90c8b5 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:19:50 -0600
Subject: [PATCH 1974/2760] target/arm: Implement SME2 BMOPA

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-28-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/helper-sme.h    |  3 +++
 target/arm/tcg/sme.decode      |  2 ++
 target/arm/tcg/sme_helper.c    | 34 ++++++++++++++++++++++++----------
 target/arm/tcg/translate-sme.c |  2 ++
 4 files changed, 31 insertions(+), 10 deletions(-)

diff --git a/target/arm/tcg/helper-sme.h b/target/arm/tcg/helper-sme.h
index 8246ce774c..17d1a7c102 100644
--- a/target/arm/tcg/helper-sme.h
+++ b/target/arm/tcg/helper-sme.h
@@ -153,3 +153,6 @@ DEF_HELPER_FLAGS_6(sme_sumopa_d, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_6(sme_usmopa_d, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_6(sme2_bmopa_s, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, ptr, i32)
diff --git a/target/arm/tcg/sme.decode b/target/arm/tcg/sme.decode
index 37bd0c6198..de8d04cb87 100644
--- a/target/arm/tcg/sme.decode
+++ b/target/arm/tcg/sme.decode
@@ -165,3 +165,5 @@ SMOPA_d         1010000 0 11 0 ..... ... ... ..... . 0 ...      @op_64
 SUMOPA_d        1010000 0 11 1 ..... ... ... ..... . 0 ...      @op_64
 USMOPA_d        1010000 1 11 0 ..... ... ... ..... . 0 ...      @op_64
 UMOPA_d         1010000 1 11 1 ..... ... ... ..... . 0 ...      @op_64
+
+BMOPA           1000000 0 10 0 ..... ... ... ..... . 10 ..      @op_32
diff --git a/target/arm/tcg/sme_helper.c b/target/arm/tcg/sme_helper.c
index baeaa3e069..6122a5b5d9 100644
--- a/target/arm/tcg/sme_helper.c
+++ b/target/arm/tcg/sme_helper.c
@@ -1297,17 +1297,31 @@ DEF_IMOP_64(umopa_d, uint16_t, uint16_t)
 DEF_IMOP_64(sumopa_d, int16_t, uint16_t)
 DEF_IMOP_64(usmopa_d, uint16_t, int16_t)
 
-#define DEF_IMOPH(NAME, S) \
-    void HELPER(sme_##NAME##_##S)(void *vza, void *vzn, void *vzm,          \
+#define DEF_IMOPH(P, NAME, S) \
+    void HELPER(P##_##NAME##_##S)(void *vza, void *vzn, void *vzm,          \
                                   void *vpn, void *vpm, uint32_t desc)      \
     { do_imopa_##S(vza, vzn, vzm, vpn, vpm, desc, NAME##_##S); }
 
-DEF_IMOPH(smopa, s)
-DEF_IMOPH(umopa, s)
-DEF_IMOPH(sumopa, s)
-DEF_IMOPH(usmopa, s)
+DEF_IMOPH(sme, smopa, s)
+DEF_IMOPH(sme, umopa, s)
+DEF_IMOPH(sme, sumopa, s)
+DEF_IMOPH(sme, usmopa, s)
 
-DEF_IMOPH(smopa, d)
-DEF_IMOPH(umopa, d)
-DEF_IMOPH(sumopa, d)
-DEF_IMOPH(usmopa, d)
+DEF_IMOPH(sme, smopa, d)
+DEF_IMOPH(sme, umopa, d)
+DEF_IMOPH(sme, sumopa, d)
+DEF_IMOPH(sme, usmopa, d)
+
+static uint32_t bmopa_s(uint32_t n, uint32_t m, uint32_t a, uint8_t p, bool neg)
+{
+    uint32_t sum = ctpop32(~(n ^ m));
+    if (neg) {
+        sum = -sum;
+    }
+    if (!(p & 1)) {
+        sum = 0;
+    }
+    return a + sum;
+}
+
+DEF_IMOPH(sme2, bmopa, s)
diff --git a/target/arm/tcg/translate-sme.c b/target/arm/tcg/translate-sme.c
index 7b275dd2b8..c2615f06ae 100644
--- a/target/arm/tcg/translate-sme.c
+++ b/target/arm/tcg/translate-sme.c
@@ -539,3 +539,5 @@ TRANS_FEAT(SMOPA_d, aa64_sme_i16i64, do_outprod, a, MO_64, gen_helper_sme_smopa_
 TRANS_FEAT(UMOPA_d, aa64_sme_i16i64, do_outprod, a, MO_64, gen_helper_sme_umopa_d)
 TRANS_FEAT(SUMOPA_d, aa64_sme_i16i64, do_outprod, a, MO_64, gen_helper_sme_sumopa_d)
 TRANS_FEAT(USMOPA_d, aa64_sme_i16i64, do_outprod, a, MO_64, gen_helper_sme_usmopa_d)
+
+TRANS_FEAT(BMOPA, aa64_sme2, do_outprod, a, MO_32, gen_helper_sme2_bmopa_s)

From e129ceae820a1b4dc1d10cc55ba98d421afe824a Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:19:51 -0600
Subject: [PATCH 1975/2760] target/arm: Implement SME2 SMOPS, UMOPS (2-way)

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-29-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/helper-sme.h    |  4 ++++
 target/arm/tcg/sme.decode      |  2 ++
 target/arm/tcg/sme_helper.c    | 37 +++++++++++++++++++++++++---------
 target/arm/tcg/translate-sme.c |  2 ++
 4 files changed, 35 insertions(+), 10 deletions(-)

diff --git a/target/arm/tcg/helper-sme.h b/target/arm/tcg/helper-sme.h
index 17d1a7c102..ecd06f2cd1 100644
--- a/target/arm/tcg/helper-sme.h
+++ b/target/arm/tcg/helper-sme.h
@@ -156,3 +156,7 @@ DEF_HELPER_FLAGS_6(sme_usmopa_d, TCG_CALL_NO_RWG,
 
 DEF_HELPER_FLAGS_6(sme2_bmopa_s, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_6(sme2_smopa2_s, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_6(sme2_umopa2_s, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, ptr, i32)
diff --git a/target/arm/tcg/sme.decode b/target/arm/tcg/sme.decode
index de8d04cb87..36f369d02a 100644
--- a/target/arm/tcg/sme.decode
+++ b/target/arm/tcg/sme.decode
@@ -167,3 +167,5 @@ USMOPA_d        1010000 1 11 0 ..... ... ... ..... . 0 ...      @op_64
 UMOPA_d         1010000 1 11 1 ..... ... ... ..... . 0 ...      @op_64
 
 BMOPA           1000000 0 10 0 ..... ... ... ..... . 10 ..      @op_32
+SMOPA2_s        1010000 0 10 0 ..... ... ... ..... . 10 ..      @op_32
+UMOPA2_s        1010000 1 10 0 ..... ... ... ..... . 10 ..      @op_32
diff --git a/target/arm/tcg/sme_helper.c b/target/arm/tcg/sme_helper.c
index 6122a5b5d9..8ce50653b4 100644
--- a/target/arm/tcg/sme_helper.c
+++ b/target/arm/tcg/sme_helper.c
@@ -1261,7 +1261,7 @@ static inline void do_imopa_d(uint64_t *za, uint64_t *zn, uint64_t *zm,
     }
 }
 
-#define DEF_IMOP_32(NAME, NTYPE, MTYPE) \
+#define DEF_IMOP_8x4_32(NAME, NTYPE, MTYPE) \
 static uint32_t NAME(uint32_t n, uint32_t m, uint32_t a, uint8_t p, bool neg) \
 {                                                                           \
     uint32_t sum = 0;                                                       \
@@ -1274,7 +1274,7 @@ static uint32_t NAME(uint32_t n, uint32_t m, uint32_t a, uint8_t p, bool neg) \
     return neg ? a - sum : a + sum;                                         \
 }
 
-#define DEF_IMOP_64(NAME, NTYPE, MTYPE) \
+#define DEF_IMOP_16x4_64(NAME, NTYPE, MTYPE) \
 static uint64_t NAME(uint64_t n, uint64_t m, uint64_t a, uint8_t p, bool neg) \
 {                                                                           \
     uint64_t sum = 0;                                                       \
@@ -1287,15 +1287,15 @@ static uint64_t NAME(uint64_t n, uint64_t m, uint64_t a, uint8_t p, bool neg) \
     return neg ? a - sum : a + sum;                                         \
 }
 
-DEF_IMOP_32(smopa_s, int8_t, int8_t)
-DEF_IMOP_32(umopa_s, uint8_t, uint8_t)
-DEF_IMOP_32(sumopa_s, int8_t, uint8_t)
-DEF_IMOP_32(usmopa_s, uint8_t, int8_t)
+DEF_IMOP_8x4_32(smopa_s, int8_t, int8_t)
+DEF_IMOP_8x4_32(umopa_s, uint8_t, uint8_t)
+DEF_IMOP_8x4_32(sumopa_s, int8_t, uint8_t)
+DEF_IMOP_8x4_32(usmopa_s, uint8_t, int8_t)
 
-DEF_IMOP_64(smopa_d, int16_t, int16_t)
-DEF_IMOP_64(umopa_d, uint16_t, uint16_t)
-DEF_IMOP_64(sumopa_d, int16_t, uint16_t)
-DEF_IMOP_64(usmopa_d, uint16_t, int16_t)
+DEF_IMOP_16x4_64(smopa_d, int16_t, int16_t)
+DEF_IMOP_16x4_64(umopa_d, uint16_t, uint16_t)
+DEF_IMOP_16x4_64(sumopa_d, int16_t, uint16_t)
+DEF_IMOP_16x4_64(usmopa_d, uint16_t, int16_t)
 
 #define DEF_IMOPH(P, NAME, S) \
     void HELPER(P##_##NAME##_##S)(void *vza, void *vzn, void *vzm,          \
@@ -1325,3 +1325,20 @@ static uint32_t bmopa_s(uint32_t n, uint32_t m, uint32_t a, uint8_t p, bool neg)
 }
 
 DEF_IMOPH(sme2, bmopa, s)
+
+#define DEF_IMOP_16x2_32(NAME, NTYPE, MTYPE) \
+static uint32_t NAME(uint32_t n, uint32_t m, uint32_t a, uint8_t p, bool neg) \
+{                                                                           \
+    uint32_t sum = 0;                                                       \
+    /* Apply P to N as a mask, making the inactive elements 0. */           \
+    n &= expand_pred_h(p);                                                  \
+    sum += (NTYPE)(n >> 0) * (MTYPE)(m >> 0);                               \
+    sum += (NTYPE)(n >> 16) * (MTYPE)(m >> 16);                             \
+    return neg ? a - sum : a + sum;                                         \
+}
+
+DEF_IMOP_16x2_32(smopa2_s, int16_t, int16_t)
+DEF_IMOP_16x2_32(umopa2_s, uint16_t, uint16_t)
+
+DEF_IMOPH(sme2, smopa2, s)
+DEF_IMOPH(sme2, umopa2, s)
diff --git a/target/arm/tcg/translate-sme.c b/target/arm/tcg/translate-sme.c
index c2615f06ae..0a863a50bf 100644
--- a/target/arm/tcg/translate-sme.c
+++ b/target/arm/tcg/translate-sme.c
@@ -541,3 +541,5 @@ TRANS_FEAT(SUMOPA_d, aa64_sme_i16i64, do_outprod, a, MO_64, gen_helper_sme_sumop
 TRANS_FEAT(USMOPA_d, aa64_sme_i16i64, do_outprod, a, MO_64, gen_helper_sme_usmopa_d)
 
 TRANS_FEAT(BMOPA, aa64_sme2, do_outprod, a, MO_32, gen_helper_sme2_bmopa_s)
+TRANS_FEAT(SMOPA2_s, aa64_sme2, do_outprod, a, MO_32, gen_helper_sme2_smopa2_s)
+TRANS_FEAT(UMOPA2_s, aa64_sme2, do_outprod, a, MO_32, gen_helper_sme2_umopa2_s)

From baf450ef83b27394358e294d2bd7f64899e0ef45 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:19:52 -0600
Subject: [PATCH 1976/2760] target/arm: Introduce gen_gvec_sve2_sqdmulh

To be used by both SVE2 and SME2.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-30-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/gengvec64.c     | 11 +++++++++++
 target/arm/tcg/translate-a64.h |  4 ++++
 target/arm/tcg/translate-sve.c |  8 +-------
 3 files changed, 16 insertions(+), 7 deletions(-)

diff --git a/target/arm/tcg/gengvec64.c b/target/arm/tcg/gengvec64.c
index 2617cde0a5..2429cab1b8 100644
--- a/target/arm/tcg/gengvec64.c
+++ b/target/arm/tcg/gengvec64.c
@@ -369,3 +369,14 @@ void gen_gvec_usqadd_qc(unsigned vece, uint32_t rd_ofs,
     tcg_gen_gvec_4(rd_ofs, offsetof(CPUARMState, vfp.qc),
                    rn_ofs, rm_ofs, opr_sz, max_sz, &ops[vece]);
 }
+
+void gen_gvec_sve2_sqdmulh(unsigned vece, uint32_t rd_ofs,
+                           uint32_t rn_ofs, uint32_t rm_ofs,
+                           uint32_t opr_sz, uint32_t max_sz)
+{
+    static gen_helper_gvec_3 * const fns[4] = {
+        gen_helper_sve2_sqdmulh_b, gen_helper_sve2_sqdmulh_h,
+        gen_helper_sve2_sqdmulh_s, gen_helper_sve2_sqdmulh_d,
+    };
+    tcg_gen_gvec_3_ool(rd_ofs, rn_ofs, rm_ofs, opr_sz, max_sz, 0, fns[vece]);
+}
diff --git a/target/arm/tcg/translate-a64.h b/target/arm/tcg/translate-a64.h
index 8a9f4b2053..993dde61a4 100644
--- a/target/arm/tcg/translate-a64.h
+++ b/target/arm/tcg/translate-a64.h
@@ -225,6 +225,10 @@ void gen_gvec_usqadd_qc(unsigned vece, uint32_t rd_ofs,
                         uint32_t rn_ofs, uint32_t rm_ofs,
                         uint32_t opr_sz, uint32_t max_sz);
 
+void gen_gvec_sve2_sqdmulh(unsigned vece, uint32_t rd_ofs,
+                           uint32_t rn_ofs, uint32_t rm_ofs,
+                           uint32_t opr_sz, uint32_t max_sz);
+
 void gen_sve_ldr(DisasContext *s, TCGv_ptr, int vofs,
                  int len, int rn, int imm, MemOp align);
 void gen_sve_str(DisasContext *s, TCGv_ptr, int vofs,
diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
index d2cd298b5b..7e304245c6 100644
--- a/target/arm/tcg/translate-sve.c
+++ b/target/arm/tcg/translate-sve.c
@@ -5948,6 +5948,7 @@ TRANS_FEAT(MOVPRFX_z, aa64_sve, do_movz_zpz, a->rd, a->rn, a->pg, a->esz, false)
  */
 
 TRANS_FEAT(MUL_zzz, aa64_sve2, gen_gvec_fn_arg_zzz, tcg_gen_gvec_mul, a)
+TRANS_FEAT(SQDMULH_zzz, aa64_sve2, gen_gvec_fn_arg_zzz, gen_gvec_sve2_sqdmulh, a)
 
 static gen_helper_gvec_3 * const smulh_zzz_fns[4] = {
     gen_helper_gvec_smulh_b, gen_helper_gvec_smulh_h,
@@ -5966,13 +5967,6 @@ TRANS_FEAT(UMULH_zzz, aa64_sve2, gen_gvec_ool_arg_zzz,
 TRANS_FEAT(PMUL_zzz, aa64_sve2, gen_gvec_ool_arg_zzz,
            gen_helper_gvec_pmul_b, a, 0)
 
-static gen_helper_gvec_3 * const sqdmulh_zzz_fns[4] = {
-    gen_helper_sve2_sqdmulh_b, gen_helper_sve2_sqdmulh_h,
-    gen_helper_sve2_sqdmulh_s, gen_helper_sve2_sqdmulh_d,
-};
-TRANS_FEAT(SQDMULH_zzz, aa64_sve2, gen_gvec_ool_arg_zzz,
-           sqdmulh_zzz_fns[a->esz], a, 0)
-
 static gen_helper_gvec_3 * const sqrdmulh_zzz_fns[4] = {
     gen_helper_sve2_sqrdmulh_b, gen_helper_sve2_sqrdmulh_h,
     gen_helper_sve2_sqrdmulh_s, gen_helper_sve2_sqrdmulh_d,

From bc65d2bd1cbffff6e0616a1417acf35ad2e10f29 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:19:53 -0600
Subject: [PATCH 1977/2760] target/arm: Implement SME2 Multiple and Single SVE
 Destructive

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-31-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/helper-a64.c    |   2 +
 target/arm/tcg/helper-sme.h    |  13 ++++
 target/arm/tcg/helper.h        |   8 ++
 target/arm/tcg/neon_helper.c   |  30 ++++++++
 target/arm/tcg/sme.decode      |  40 ++++++++++
 target/arm/tcg/translate-sme.c | 137 +++++++++++++++++++++++++++++++++
 target/arm/tcg/vec_helper.c    |   7 ++
 target/arm/tcg/vec_internal.h  |   4 +
 8 files changed, 241 insertions(+)

diff --git a/target/arm/tcg/helper-a64.c b/target/arm/tcg/helper-a64.c
index 4f618ae390..c66d521278 100644
--- a/target/arm/tcg/helper-a64.c
+++ b/target/arm/tcg/helper-a64.c
@@ -402,6 +402,8 @@ AH_MINMAX_HELPER(vfp_ah_mind, float64, float64, min)
 AH_MINMAX_HELPER(vfp_ah_maxh, dh_ctype_f16, float16, max)
 AH_MINMAX_HELPER(vfp_ah_maxs, float32, float32, max)
 AH_MINMAX_HELPER(vfp_ah_maxd, float64, float64, max)
+AH_MINMAX_HELPER(sme2_ah_fmax_b16, bfloat16, bfloat16, max)
+AH_MINMAX_HELPER(sme2_ah_fmin_b16, bfloat16, bfloat16, min)
 
 /* 64-bit versions of the CRC helpers. Note that although the operation
  * (and the prototypes of crc32c() and crc32() mean that only the bottom
diff --git a/target/arm/tcg/helper-sme.h b/target/arm/tcg/helper-sme.h
index ecd06f2cd1..cdd7058aed 100644
--- a/target/arm/tcg/helper-sme.h
+++ b/target/arm/tcg/helper-sme.h
@@ -160,3 +160,16 @@ DEF_HELPER_FLAGS_6(sme2_smopa2_s, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_6(sme2_umopa2_s, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_5(gvec_fmax_b16, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_fmin_b16, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_ah_fmax_b16, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_ah_fmin_b16, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_fmaxnum_b16, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_fminnum_b16, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, fpst, i32)
diff --git a/target/arm/tcg/helper.h b/target/arm/tcg/helper.h
index 80db7c2c37..8c4705fc53 100644
--- a/target/arm/tcg/helper.h
+++ b/target/arm/tcg/helper.h
@@ -353,6 +353,14 @@ DEF_HELPER_FLAGS_4(gvec_urshl_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_urshl_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_urshl_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 
+DEF_HELPER_FLAGS_4(sme2_srshl_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sme2_srshl_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sme2_srshl_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(sme2_urshl_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sme2_urshl_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sme2_urshl_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
 DEF_HELPER_2(neon_add_u8, i32, i32, i32)
 DEF_HELPER_2(neon_add_u16, i32, i32, i32)
 DEF_HELPER_2(neon_sub_u8, i32, i32, i32)
diff --git a/target/arm/tcg/neon_helper.c b/target/arm/tcg/neon_helper.c
index 2cc8241f1e..8d288f3a70 100644
--- a/target/arm/tcg/neon_helper.c
+++ b/target/arm/tcg/neon_helper.c
@@ -228,16 +228,31 @@ NEON_VOP(rshl_s16, neon_s16, 2)
 NEON_GVEC_VOP2(gvec_srshl_h, int16_t)
 #undef NEON_FN
 
+#define NEON_FN(dest, src1, src2) \
+    (dest = do_sqrshl_bhs(src1, src2, 16, true, NULL))
+NEON_GVEC_VOP2(sme2_srshl_h, int16_t)
+#undef NEON_FN
+
 #define NEON_FN(dest, src1, src2) \
     (dest = do_sqrshl_bhs(src1, (int8_t)src2, 32, true, NULL))
 NEON_GVEC_VOP2(gvec_srshl_s, int32_t)
 #undef NEON_FN
 
+#define NEON_FN(dest, src1, src2) \
+    (dest = do_sqrshl_bhs(src1, src2, 32, true, NULL))
+NEON_GVEC_VOP2(sme2_srshl_s, int32_t)
+#undef NEON_FN
+
 #define NEON_FN(dest, src1, src2) \
     (dest = do_sqrshl_d(src1, (int8_t)src2, true, NULL))
 NEON_GVEC_VOP2(gvec_srshl_d, int64_t)
 #undef NEON_FN
 
+#define NEON_FN(dest, src1, src2) \
+    (dest = do_sqrshl_d(src1, src2, true, NULL))
+NEON_GVEC_VOP2(sme2_srshl_d, int64_t)
+#undef NEON_FN
+
 uint32_t HELPER(neon_rshl_s32)(uint32_t val, uint32_t shift)
 {
     return do_sqrshl_bhs(val, (int8_t)shift, 32, true, NULL);
@@ -260,16 +275,31 @@ NEON_VOP(rshl_u16, neon_u16, 2)
 NEON_GVEC_VOP2(gvec_urshl_h, uint16_t)
 #undef NEON_FN
 
+#define NEON_FN(dest, src1, src2) \
+    (dest = do_uqrshl_bhs(src1, (int16_t)src2, 16, true, NULL))
+NEON_GVEC_VOP2(sme2_urshl_h, uint16_t)
+#undef NEON_FN
+
 #define NEON_FN(dest, src1, src2) \
     (dest = do_uqrshl_bhs(src1, (int8_t)src2, 32, true, NULL))
 NEON_GVEC_VOP2(gvec_urshl_s, int32_t)
 #undef NEON_FN
 
+#define NEON_FN(dest, src1, src2) \
+    (dest = do_uqrshl_bhs(src1, src2, 32, true, NULL))
+NEON_GVEC_VOP2(sme2_urshl_s, int32_t)
+#undef NEON_FN
+
 #define NEON_FN(dest, src1, src2) \
     (dest = do_uqrshl_d(src1, (int8_t)src2, true, NULL))
 NEON_GVEC_VOP2(gvec_urshl_d, int64_t)
 #undef NEON_FN
 
+#define NEON_FN(dest, src1, src2) \
+    (dest = do_uqrshl_d(src1, src2, true, NULL))
+NEON_GVEC_VOP2(sme2_urshl_d, int64_t)
+#undef NEON_FN
+
 uint32_t HELPER(neon_rshl_u32)(uint32_t val, uint32_t shift)
 {
     return do_uqrshl_bhs(val, (int8_t)shift, 32, true, NULL);
diff --git a/target/arm/tcg/sme.decode b/target/arm/tcg/sme.decode
index 36f369d02a..005f87777b 100644
--- a/target/arm/tcg/sme.decode
+++ b/target/arm/tcg/sme.decode
@@ -169,3 +169,43 @@ UMOPA_d         1010000 1 11 1 ..... ... ... ..... . 0 ...      @op_64
 BMOPA           1000000 0 10 0 ..... ... ... ..... . 10 ..      @op_32
 SMOPA2_s        1010000 0 10 0 ..... ... ... ..... . 10 ..      @op_32
 UMOPA2_s        1010000 1 10 0 ..... ... ... ..... . 10 ..      @op_32
+
+### SME2 Multi-vector Multiple and Single SVE Destructive
+
+%zd_ax2         1:4 !function=times_2
+%zd_ax4         2:3 !function=times_4
+
+&z2z_en         zdn zm esz n
+@z2z_2x1        ....... . esz:2 .. zm:4 ....0. ..... .... . \
+                &z2z_en n=2 zdn=%zd_ax2
+@z2z_4x1        ....... . esz:2 .. zm:4 ....1. ..... ...0 . \
+                &z2z_en n=4 zdn=%zd_ax4
+
+SMAX_n1        1100000 1 .. 10 .... 1010.0 00000 .... 0    @z2z_2x1
+SMAX_n1        1100000 1 .. 10 .... 1010.0 00000 .... 0    @z2z_4x1
+UMAX_n1        1100000 1 .. 10 .... 1010.0 00000 .... 1    @z2z_2x1
+UMAX_n1        1100000 1 .. 10 .... 1010.0 00000 .... 1    @z2z_4x1
+SMIN_n1        1100000 1 .. 10 .... 1010.0 00001 .... 0    @z2z_2x1
+SMIN_n1        1100000 1 .. 10 .... 1010.0 00001 .... 0    @z2z_4x1
+UMIN_n1        1100000 1 .. 10 .... 1010.0 00001 .... 1    @z2z_2x1
+UMIN_n1        1100000 1 .. 10 .... 1010.0 00001 .... 1    @z2z_4x1
+
+FMAX_n1        1100000 1 .. 10 .... 1010.0 01000 .... 0    @z2z_2x1
+FMAX_n1        1100000 1 .. 10 .... 1010.0 01000 .... 0    @z2z_4x1
+FMIN_n1        1100000 1 .. 10 .... 1010.0 01000 .... 1    @z2z_2x1
+FMIN_n1        1100000 1 .. 10 .... 1010.0 01000 .... 1    @z2z_4x1
+FMAXNM_n1      1100000 1 .. 10 .... 1010.0 01001 .... 0    @z2z_2x1
+FMAXNM_n1      1100000 1 .. 10 .... 1010.0 01001 .... 0    @z2z_4x1
+FMINNM_n1      1100000 1 .. 10 .... 1010.0 01001 .... 1    @z2z_2x1
+FMINNM_n1      1100000 1 .. 10 .... 1010.0 01001 .... 1    @z2z_4x1
+
+SRSHL_n1       1100000 1 .. 10 .... 1010.0 10001 .... 0    @z2z_2x1
+SRSHL_n1       1100000 1 .. 10 .... 1010.0 10001 .... 0    @z2z_4x1
+URSHL_n1       1100000 1 .. 10 .... 1010.0 10001 .... 1    @z2z_2x1
+URSHL_n1       1100000 1 .. 10 .... 1010.0 10001 .... 1    @z2z_4x1
+
+ADD_n1         1100000 1 .. 10 .... 1010.0 11000 .... 0    @z2z_2x1
+ADD_n1         1100000 1 .. 10 .... 1010.0 11000 .... 0    @z2z_4x1
+
+SQDMULH_n1     1100000 1 .. 10 .... 1010.1 00000 .... 0    @z2z_2x1
+SQDMULH_n1     1100000 1 .. 10 .... 1010.1 00000 .... 0    @z2z_4x1
diff --git a/target/arm/tcg/translate-sme.c b/target/arm/tcg/translate-sme.c
index 0a863a50bf..954da18ff0 100644
--- a/target/arm/tcg/translate-sme.c
+++ b/target/arm/tcg/translate-sme.c
@@ -543,3 +543,140 @@ TRANS_FEAT(USMOPA_d, aa64_sme_i16i64, do_outprod, a, MO_64, gen_helper_sme_usmop
 TRANS_FEAT(BMOPA, aa64_sme2, do_outprod, a, MO_32, gen_helper_sme2_bmopa_s)
 TRANS_FEAT(SMOPA2_s, aa64_sme2, do_outprod, a, MO_32, gen_helper_sme2_smopa2_s)
 TRANS_FEAT(UMOPA2_s, aa64_sme2, do_outprod, a, MO_32, gen_helper_sme2_umopa2_s)
+
+static bool do_z2z_n1(DisasContext *s, arg_z2z_en *a, GVecGen3Fn *fn)
+{
+    int esz, dn, vsz, mofs, n;
+    bool overlap = false;
+
+    if (!sme_sm_enabled_check(s)) {
+        return true;
+    }
+
+    esz = a->esz;
+    n = a->n;
+    dn = a->zdn;
+    mofs = vec_full_reg_offset(s, a->zm);
+    vsz = streaming_vec_reg_size(s);
+
+    for (int i = 0; i < n; i++) {
+        int dofs = vec_full_reg_offset(s, dn + i);
+        if (dofs == mofs) {
+            overlap = true;
+        } else {
+            fn(esz, dofs, dofs, mofs, vsz, vsz);
+        }
+    }
+    if (overlap) {
+        fn(esz, mofs, mofs, mofs, vsz, vsz);
+    }
+    return true;
+}
+
+static void gen_sme2_srshl(unsigned vece, uint32_t rd_ofs, uint32_t rn_ofs,
+                           uint32_t rm_ofs, uint32_t opr_sz, uint32_t max_sz)
+{
+    static gen_helper_gvec_3 * const fns[] = {
+        gen_helper_gvec_srshl_b, gen_helper_sme2_srshl_h,
+        gen_helper_sme2_srshl_s, gen_helper_sme2_srshl_d,
+    };
+    tcg_debug_assert(vece <= MO_64);
+    tcg_gen_gvec_3_ool(rd_ofs, rn_ofs, rm_ofs, opr_sz, max_sz, 0, fns[vece]);
+}
+
+static void gen_sme2_urshl(unsigned vece, uint32_t rd_ofs, uint32_t rn_ofs,
+                           uint32_t rm_ofs, uint32_t opr_sz, uint32_t max_sz)
+{
+    static gen_helper_gvec_3 * const fns[] = {
+        gen_helper_gvec_urshl_b, gen_helper_sme2_urshl_h,
+        gen_helper_sme2_urshl_s, gen_helper_sme2_urshl_d,
+    };
+    tcg_debug_assert(vece <= MO_64);
+    tcg_gen_gvec_3_ool(rd_ofs, rn_ofs, rm_ofs, opr_sz, max_sz, 0, fns[vece]);
+}
+
+TRANS_FEAT(ADD_n1, aa64_sme2, do_z2z_n1, a, tcg_gen_gvec_add)
+TRANS_FEAT(SMAX_n1, aa64_sme2, do_z2z_n1, a, tcg_gen_gvec_smax)
+TRANS_FEAT(SMIN_n1, aa64_sme2, do_z2z_n1, a, tcg_gen_gvec_smin)
+TRANS_FEAT(UMAX_n1, aa64_sme2, do_z2z_n1, a, tcg_gen_gvec_umax)
+TRANS_FEAT(UMIN_n1, aa64_sme2, do_z2z_n1, a, tcg_gen_gvec_umin)
+TRANS_FEAT(SRSHL_n1, aa64_sme2, do_z2z_n1, a, gen_sme2_srshl)
+TRANS_FEAT(URSHL_n1, aa64_sme2, do_z2z_n1, a, gen_sme2_urshl)
+TRANS_FEAT(SQDMULH_n1, aa64_sme2, do_z2z_n1, a, gen_gvec_sve2_sqdmulh)
+
+static bool do_z2z_n1_fpst(DisasContext *s, arg_z2z_en *a,
+                           gen_helper_gvec_3_ptr * const fns[4])
+{
+    int esz = a->esz, n, dn, vsz, mofs;
+    bool overlap = false;
+    gen_helper_gvec_3_ptr *fn;
+    TCGv_ptr fpst;
+
+    /* These insns use MO_8 to encode BFloat16. */
+    if (esz == MO_8 && !dc_isar_feature(aa64_sme_b16b16, s)) {
+        return false;
+    }
+    if (!sme_sm_enabled_check(s)) {
+        return true;
+    }
+
+    fpst = fpstatus_ptr(esz == MO_16 ? FPST_A64_F16 : FPST_A64);
+    fn = fns[esz];
+    n = a->n;
+    dn = a->zdn;
+    mofs = vec_full_reg_offset(s, a->zm);
+    vsz = streaming_vec_reg_size(s);
+
+    for (int i = 0; i < n; i++) {
+        int dofs = vec_full_reg_offset(s, dn + i);
+        if (dofs == mofs) {
+            overlap = true;
+        } else {
+            tcg_gen_gvec_3_ptr(dofs, dofs, mofs, fpst, vsz, vsz, 0, fn);
+        }
+    }
+    if (overlap) {
+        tcg_gen_gvec_3_ptr(mofs, mofs, mofs, fpst, vsz, vsz, 0, fn);
+    }
+    return true;
+}
+
+static gen_helper_gvec_3_ptr * const f_vector_fmax[2][4] = {
+    { gen_helper_gvec_fmax_b16,
+      gen_helper_gvec_fmax_h,
+      gen_helper_gvec_fmax_s,
+      gen_helper_gvec_fmax_d },
+    { gen_helper_gvec_ah_fmax_b16,
+      gen_helper_gvec_ah_fmax_h,
+      gen_helper_gvec_ah_fmax_s,
+      gen_helper_gvec_ah_fmax_d },
+};
+TRANS_FEAT(FMAX_n1, aa64_sme2, do_z2z_n1_fpst, a, f_vector_fmax[s->fpcr_ah])
+
+static gen_helper_gvec_3_ptr * const f_vector_fmin[2][4] = {
+    { gen_helper_gvec_fmin_b16,
+      gen_helper_gvec_fmin_h,
+      gen_helper_gvec_fmin_s,
+      gen_helper_gvec_fmin_d },
+    { gen_helper_gvec_ah_fmin_b16,
+      gen_helper_gvec_ah_fmin_h,
+      gen_helper_gvec_ah_fmin_s,
+      gen_helper_gvec_ah_fmin_d },
+};
+TRANS_FEAT(FMIN_n1, aa64_sme2, do_z2z_n1_fpst, a, f_vector_fmin[s->fpcr_ah])
+
+static gen_helper_gvec_3_ptr * const f_vector_fmaxnm[4] = {
+    gen_helper_gvec_fmaxnum_b16,
+    gen_helper_gvec_fmaxnum_h,
+    gen_helper_gvec_fmaxnum_s,
+    gen_helper_gvec_fmaxnum_d,
+};
+TRANS_FEAT(FMAXNM_n1, aa64_sme2, do_z2z_n1_fpst, a, f_vector_fmaxnm)
+
+static gen_helper_gvec_3_ptr * const f_vector_fminnm[4] = {
+    gen_helper_gvec_fminnum_b16,
+    gen_helper_gvec_fminnum_h,
+    gen_helper_gvec_fminnum_s,
+    gen_helper_gvec_fminnum_d,
+};
+TRANS_FEAT(FMINNM_n1, aa64_sme2, do_z2z_n1_fpst, a, f_vector_fminnm)
diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
index 3b7f308803..8b49577e2f 100644
--- a/target/arm/tcg/vec_helper.c
+++ b/target/arm/tcg/vec_helper.c
@@ -1515,6 +1515,13 @@ DO_3OP(gvec_ah_fmin_h, helper_vfp_ah_minh, float16)
 DO_3OP(gvec_ah_fmin_s, helper_vfp_ah_mins, float32)
 DO_3OP(gvec_ah_fmin_d, helper_vfp_ah_mind, float64)
 
+DO_3OP(gvec_fmax_b16, bfloat16_max, bfloat16)
+DO_3OP(gvec_fmin_b16, bfloat16_min, bfloat16)
+DO_3OP(gvec_fmaxnum_b16, bfloat16_maxnum, bfloat16)
+DO_3OP(gvec_fminnum_b16, bfloat16_minnum, bfloat16)
+DO_3OP(gvec_ah_fmax_b16, helper_sme2_ah_fmax_b16, bfloat16)
+DO_3OP(gvec_ah_fmin_b16, helper_sme2_ah_fmin_b16, bfloat16)
+
 #endif
 #undef DO_3OP
 
diff --git a/target/arm/tcg/vec_internal.h b/target/arm/tcg/vec_internal.h
index c02f9c37f8..64a7249d01 100644
--- a/target/arm/tcg/vec_internal.h
+++ b/target/arm/tcg/vec_internal.h
@@ -302,4 +302,8 @@ static inline float64 float64_maybe_ah_chs(float64 a, bool fpcr_ah)
     return fpcr_ah && float64_is_any_nan(a) ? a : float64_chs(a);
 }
 
+/* Not actually called directly as a helper, but uses similar machinery. */
+bfloat16 helper_sme2_ah_fmax_b16(bfloat16 a, bfloat16 b, float_status *fpst);
+bfloat16 helper_sme2_ah_fmin_b16(bfloat16 a, bfloat16 b, float_status *fpst);
+
 #endif /* TARGET_ARM_VEC_INTERNAL_H */

From 930760eb753d3beead00920cbb0187f755c06dd9 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:19:54 -0600
Subject: [PATCH 1978/2760] target/arm: Implement SME2 Multiple Vectors SVE
 Destructive

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-32-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/sme.decode      | 36 +++++++++++++++++++
 target/arm/tcg/translate-sme.c | 65 ++++++++++++++++++++++++++++++++++
 2 files changed, 101 insertions(+)

diff --git a/target/arm/tcg/sme.decode b/target/arm/tcg/sme.decode
index 005f87777b..470592f4c0 100644
--- a/target/arm/tcg/sme.decode
+++ b/target/arm/tcg/sme.decode
@@ -209,3 +209,39 @@ ADD_n1         1100000 1 .. 10 .... 1010.0 11000 .... 0    @z2z_4x1
 
 SQDMULH_n1     1100000 1 .. 10 .... 1010.1 00000 .... 0    @z2z_2x1
 SQDMULH_n1     1100000 1 .. 10 .... 1010.1 00000 .... 0    @z2z_4x1
+
+### SME2 Multi-vector Multiple Vectors SVE Destructive
+
+%zm_ax2         17:4 !function=times_2
+%zm_ax4         18:3 !function=times_4
+
+@z2z_2x2        ....... . esz:2 . ....0 ....0. ..... .... . \
+                &z2z_en n=2 zdn=%zd_ax2 zm=%zm_ax2
+@z2z_4x4        ....... . esz:2 . ...00 ....1. ..... ...0 . \
+                &z2z_en n=4 zdn=%zd_ax4 zm=%zm_ax4
+
+SMAX_nn        1100000 1 .. 1 ..... 1011.0 00000 .... 0    @z2z_2x2
+SMAX_nn        1100000 1 .. 1 ..... 1011.0 00000 .... 0    @z2z_4x4
+UMAX_nn        1100000 1 .. 1 ..... 1011.0 00000 .... 1    @z2z_2x2
+UMAX_nn        1100000 1 .. 1 ..... 1011.0 00000 .... 1    @z2z_4x4
+SMIN_nn        1100000 1 .. 1 ..... 1011.0 00001 .... 0    @z2z_2x2
+SMIN_nn        1100000 1 .. 1 ..... 1011.0 00001 .... 0    @z2z_4x4
+UMIN_nn        1100000 1 .. 1 ..... 1011.0 00001 .... 1    @z2z_2x2
+UMIN_nn        1100000 1 .. 1 ..... 1011.0 00001 .... 1    @z2z_4x4
+
+FMAX_nn        1100000 1 .. 1 ..... 1011.0 01000 .... 0    @z2z_2x2
+FMAX_nn        1100000 1 .. 1 ..... 1011.0 01000 .... 0    @z2z_4x4
+FMIN_nn        1100000 1 .. 1 ..... 1011.0 01000 .... 1    @z2z_2x2
+FMIN_nn        1100000 1 .. 1 ..... 1011.0 01000 .... 1    @z2z_4x4
+FMAXNM_nn      1100000 1 .. 1 ..... 1011.0 01001 .... 0    @z2z_2x2
+FMAXNM_nn      1100000 1 .. 1 ..... 1011.0 01001 .... 0    @z2z_4x4
+FMINNM_nn      1100000 1 .. 1 ..... 1011.0 01001 .... 1    @z2z_2x2
+FMINNM_nn      1100000 1 .. 1 ..... 1011.0 01001 .... 1    @z2z_4x4
+
+SRSHL_nn       1100000 1 .. 1 ..... 1011.0 10001 .... 0    @z2z_2x2
+SRSHL_nn       1100000 1 .. 1 ..... 1011.0 10001 .... 0    @z2z_4x4
+URSHL_nn       1100000 1 .. 1 ..... 1011.0 10001 .... 1    @z2z_2x2
+URSHL_nn       1100000 1 .. 1 ..... 1011.0 10001 .... 1    @z2z_4x4
+
+SQDMULH_nn     1100000 1 .. 1 ..... 1011.1 00000 .... 0    @z2z_2x2
+SQDMULH_nn     1100000 1 .. 1 ..... 1011.1 00000 .... 0    @z2z_4x4
diff --git a/target/arm/tcg/translate-sme.c b/target/arm/tcg/translate-sme.c
index 954da18ff0..0a6a10b63d 100644
--- a/target/arm/tcg/translate-sme.c
+++ b/target/arm/tcg/translate-sme.c
@@ -604,6 +604,37 @@ TRANS_FEAT(SRSHL_n1, aa64_sme2, do_z2z_n1, a, gen_sme2_srshl)
 TRANS_FEAT(URSHL_n1, aa64_sme2, do_z2z_n1, a, gen_sme2_urshl)
 TRANS_FEAT(SQDMULH_n1, aa64_sme2, do_z2z_n1, a, gen_gvec_sve2_sqdmulh)
 
+static bool do_z2z_nn(DisasContext *s, arg_z2z_en *a, GVecGen3Fn *fn)
+{
+    int esz, dn, dm, vsz, n;
+
+    if (!sme_sm_enabled_check(s)) {
+        return true;
+    }
+
+    esz = a->esz;
+    n = a->n;
+    dn = a->zdn;
+    dm = a->zm;
+    vsz = streaming_vec_reg_size(s);
+
+    for (int i = 0; i < n; i++) {
+        int dofs = vec_full_reg_offset(s, dn + i);
+        int mofs = vec_full_reg_offset(s, dm + i);
+
+        fn(esz, dofs, dofs, mofs, vsz, vsz);
+    }
+    return true;
+}
+
+TRANS_FEAT(SMAX_nn, aa64_sme2, do_z2z_nn, a, tcg_gen_gvec_smax)
+TRANS_FEAT(SMIN_nn, aa64_sme2, do_z2z_nn, a, tcg_gen_gvec_smin)
+TRANS_FEAT(UMAX_nn, aa64_sme2, do_z2z_nn, a, tcg_gen_gvec_umax)
+TRANS_FEAT(UMIN_nn, aa64_sme2, do_z2z_nn, a, tcg_gen_gvec_umin)
+TRANS_FEAT(SRSHL_nn, aa64_sme2, do_z2z_nn, a, gen_sme2_srshl)
+TRANS_FEAT(URSHL_nn, aa64_sme2, do_z2z_nn, a, gen_sme2_urshl)
+TRANS_FEAT(SQDMULH_nn, aa64_sme2, do_z2z_nn, a, gen_gvec_sve2_sqdmulh)
+
 static bool do_z2z_n1_fpst(DisasContext *s, arg_z2z_en *a,
                            gen_helper_gvec_3_ptr * const fns[4])
 {
@@ -641,6 +672,36 @@ static bool do_z2z_n1_fpst(DisasContext *s, arg_z2z_en *a,
     return true;
 }
 
+static bool do_z2z_nn_fpst(DisasContext *s, arg_z2z_en *a,
+                           gen_helper_gvec_3_ptr * const fns[4])
+{
+    int esz = a->esz, n, dn, dm, vsz;
+    gen_helper_gvec_3_ptr *fn;
+    TCGv_ptr fpst;
+
+    if (esz == MO_8 && !dc_isar_feature(aa64_sme_b16b16, s)) {
+        return false;
+    }
+    if (!sme_sm_enabled_check(s)) {
+        return true;
+    }
+
+    fpst = fpstatus_ptr(esz == MO_16 ? FPST_A64_F16 : FPST_A64);
+    fn = fns[esz];
+    n = a->n;
+    dn = a->zdn;
+    dm = a->zm;
+    vsz = streaming_vec_reg_size(s);
+
+    for (int i = 0; i < n; i++) {
+        int dofs = vec_full_reg_offset(s, dn + i);
+        int mofs = vec_full_reg_offset(s, dm + i);
+
+        tcg_gen_gvec_3_ptr(dofs, dofs, mofs, fpst, vsz, vsz, 0, fn);
+    }
+    return true;
+}
+
 static gen_helper_gvec_3_ptr * const f_vector_fmax[2][4] = {
     { gen_helper_gvec_fmax_b16,
       gen_helper_gvec_fmax_h,
@@ -652,6 +713,7 @@ static gen_helper_gvec_3_ptr * const f_vector_fmax[2][4] = {
       gen_helper_gvec_ah_fmax_d },
 };
 TRANS_FEAT(FMAX_n1, aa64_sme2, do_z2z_n1_fpst, a, f_vector_fmax[s->fpcr_ah])
+TRANS_FEAT(FMAX_nn, aa64_sme2, do_z2z_nn_fpst, a, f_vector_fmax[s->fpcr_ah])
 
 static gen_helper_gvec_3_ptr * const f_vector_fmin[2][4] = {
     { gen_helper_gvec_fmin_b16,
@@ -664,6 +726,7 @@ static gen_helper_gvec_3_ptr * const f_vector_fmin[2][4] = {
       gen_helper_gvec_ah_fmin_d },
 };
 TRANS_FEAT(FMIN_n1, aa64_sme2, do_z2z_n1_fpst, a, f_vector_fmin[s->fpcr_ah])
+TRANS_FEAT(FMIN_nn, aa64_sme2, do_z2z_nn_fpst, a, f_vector_fmin[s->fpcr_ah])
 
 static gen_helper_gvec_3_ptr * const f_vector_fmaxnm[4] = {
     gen_helper_gvec_fmaxnum_b16,
@@ -672,6 +735,7 @@ static gen_helper_gvec_3_ptr * const f_vector_fmaxnm[4] = {
     gen_helper_gvec_fmaxnum_d,
 };
 TRANS_FEAT(FMAXNM_n1, aa64_sme2, do_z2z_n1_fpst, a, f_vector_fmaxnm)
+TRANS_FEAT(FMAXNM_nn, aa64_sme2, do_z2z_nn_fpst, a, f_vector_fmaxnm)
 
 static gen_helper_gvec_3_ptr * const f_vector_fminnm[4] = {
     gen_helper_gvec_fminnum_b16,
@@ -680,3 +744,4 @@ static gen_helper_gvec_3_ptr * const f_vector_fminnm[4] = {
     gen_helper_gvec_fminnum_d,
 };
 TRANS_FEAT(FMINNM_n1, aa64_sme2, do_z2z_n1_fpst, a, f_vector_fminnm)
+TRANS_FEAT(FMINNM_nn, aa64_sme2, do_z2z_nn_fpst, a, f_vector_fminnm)

From d636130fbba61956d49a139c5690c3dc569dfb9a Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:19:55 -0600
Subject: [PATCH 1979/2760] target/arm: Implement SME2 ADD/SUB (array results,
 multiple and single vector)

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-33-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/sme.decode      | 15 +++++++++++++++
 target/arm/tcg/translate-sme.c | 30 ++++++++++++++++++++++++++++++
 target/arm/tcg/translate.h     |  2 ++
 3 files changed, 47 insertions(+)

diff --git a/target/arm/tcg/sme.decode b/target/arm/tcg/sme.decode
index 470592f4c0..8b81c0a0ce 100644
--- a/target/arm/tcg/sme.decode
+++ b/target/arm/tcg/sme.decode
@@ -245,3 +245,18 @@ URSHL_nn       1100000 1 .. 1 ..... 1011.0 10001 .... 1    @z2z_4x4
 
 SQDMULH_nn     1100000 1 .. 1 ..... 1011.1 00000 .... 0    @z2z_2x2
 SQDMULH_nn     1100000 1 .. 1 ..... 1011.1 00000 .... 0    @z2z_4x4
+
+### SME2 Multi-vector Multiple and Single Array Vectors
+
+&azz_n          n off rv zn zm
+@azz_nx1_o3     ........ .... zm:4 ...... zn:5 .. off:3     &azz_n rv=%mova_rv
+
+ADD_azz_n1_s    11000001 0010 .... 0 .. 110 ..... 10 ...    @azz_nx1_o3 n=2
+ADD_azz_n1_s    11000001 0011 .... 0 .. 110 ..... 10 ...    @azz_nx1_o3 n=4
+ADD_azz_n1_d    11000001 0110 .... 0 .. 110 ..... 10 ...    @azz_nx1_o3 n=2
+ADD_azz_n1_d    11000001 0111 .... 0 .. 110 ..... 10 ...    @azz_nx1_o3 n=4
+
+SUB_azz_n1_s    11000001 0010 .... 0 .. 110 ..... 11 ...    @azz_nx1_o3 n=2
+SUB_azz_n1_s    11000001 0011 .... 0 .. 110 ..... 11 ...    @azz_nx1_o3 n=4
+SUB_azz_n1_d    11000001 0110 .... 0 .. 110 ..... 11 ...    @azz_nx1_o3 n=2
+SUB_azz_n1_d    11000001 0111 .... 0 .. 110 ..... 11 ...    @azz_nx1_o3 n=4
diff --git a/target/arm/tcg/translate-sme.c b/target/arm/tcg/translate-sme.c
index 0a6a10b63d..4bb880d9ef 100644
--- a/target/arm/tcg/translate-sme.c
+++ b/target/arm/tcg/translate-sme.c
@@ -745,3 +745,33 @@ static gen_helper_gvec_3_ptr * const f_vector_fminnm[4] = {
 };
 TRANS_FEAT(FMINNM_n1, aa64_sme2, do_z2z_n1_fpst, a, f_vector_fminnm)
 TRANS_FEAT(FMINNM_nn, aa64_sme2, do_z2z_nn_fpst, a, f_vector_fminnm)
+
+/* Add/Sub vector Z[m] to each Z[n*N] with result in ZA[d*N]. */
+static bool do_azz_n1(DisasContext *s, arg_azz_n *a, int esz,
+                      GVecGen3FnVar *fn)
+{
+    TCGv_ptr t_za;
+    int svl, n, o_zm;
+
+    if (!sme_smza_enabled_check(s)) {
+        return true;
+    }
+
+    n = a->n;
+    t_za = get_zarray(s, a->rv, a->off, n, 0);
+    o_zm = vec_full_reg_offset(s, a->zm);
+    svl = streaming_vec_reg_size(s);
+
+    for (int i = 0; i < n; ++i) {
+        int o_za = (svl / n * sizeof(ARMVectorReg)) * i;
+        int o_zn = vec_full_reg_offset(s, (a->zn + i) % 32);
+
+        fn(esz, t_za, o_za, tcg_env, o_zn, tcg_env, o_zm, svl, svl);
+    }
+    return true;
+}
+
+TRANS_FEAT(ADD_azz_n1_s, aa64_sme2, do_azz_n1, a, MO_32, tcg_gen_gvec_add_var)
+TRANS_FEAT(SUB_azz_n1_s, aa64_sme2, do_azz_n1, a, MO_32, tcg_gen_gvec_sub_var)
+TRANS_FEAT(ADD_azz_n1_d, aa64_sme2_i16i64, do_azz_n1, a, MO_64, tcg_gen_gvec_add_var)
+TRANS_FEAT(SUB_azz_n1_d, aa64_sme2_i16i64, do_azz_n1, a, MO_64, tcg_gen_gvec_sub_var)
diff --git a/target/arm/tcg/translate.h b/target/arm/tcg/translate.h
index a18d07540e..f974996f3f 100644
--- a/target/arm/tcg/translate.h
+++ b/target/arm/tcg/translate.h
@@ -643,6 +643,8 @@ typedef void GVecGen3Fn(unsigned, uint32_t, uint32_t,
                         uint32_t, uint32_t, uint32_t);
 typedef void GVecGen4Fn(unsigned, uint32_t, uint32_t, uint32_t,
                         uint32_t, uint32_t, uint32_t);
+typedef void GVecGen3FnVar(unsigned, TCGv_ptr, uint32_t, TCGv_ptr, uint32_t,
+                           TCGv_ptr, uint32_t, uint32_t, uint32_t);
 
 /* Function prototype for gen_ functions for calling Neon helpers */
 typedef void NeonGenOneOpFn(TCGv_i32, TCGv_i32);

From 9fbc9bd4861971b717181872ec9c578b42f5bcf8 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:19:56 -0600
Subject: [PATCH 1980/2760] target/arm: Implement SME2 ADD/SUB (array results,
 multiple vectors)

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-34-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/sme.decode      | 20 ++++++++++++++++++++
 target/arm/tcg/translate-sme.c | 30 ++++++++++++++++++++++++++++++
 2 files changed, 50 insertions(+)

diff --git a/target/arm/tcg/sme.decode b/target/arm/tcg/sme.decode
index 8b81c0a0ce..a6dee08661 100644
--- a/target/arm/tcg/sme.decode
+++ b/target/arm/tcg/sme.decode
@@ -260,3 +260,23 @@ SUB_azz_n1_s    11000001 0010 .... 0 .. 110 ..... 11 ...    @azz_nx1_o3 n=2
 SUB_azz_n1_s    11000001 0011 .... 0 .. 110 ..... 11 ...    @azz_nx1_o3 n=4
 SUB_azz_n1_d    11000001 0110 .... 0 .. 110 ..... 11 ...    @azz_nx1_o3 n=2
 SUB_azz_n1_d    11000001 0111 .... 0 .. 110 ..... 11 ...    @azz_nx1_o3 n=4
+
+### SME2 Multi-vector Multiple Array Vectors
+
+%zn_ax2         6:4 !function=times_2
+%zn_ax4         7:3 !function=times_4
+
+@azz_2x2_o3     ........ ... ..... . .. ... ..... .. off:3  \
+                &azz_n n=2 rv=%mova_rv zn=%zn_ax2 zm=%zm_ax2
+@azz_4x4_o3     ........ ... ..... . .. ... ..... .. off:3  \
+                &azz_n n=4 rv=%mova_rv zn=%zn_ax4 zm=%zm_ax4
+
+ADD_azz_nn_s    11000001 101 ....0 0 .. 110 ....0 10 ...    @azz_2x2_o3
+ADD_azz_nn_s    11000001 101 ...01 0 .. 110 ...00 10 ...    @azz_4x4_o3
+ADD_azz_nn_d    11000001 111 ....0 0 .. 110 ....0 10 ...    @azz_2x2_o3
+ADD_azz_nn_d    11000001 111 ...01 0 .. 110 ...00 10 ...    @azz_4x4_o3
+
+SUB_azz_nn_s    11000001 101 ....0 0 .. 110 ....0 11 ...    @azz_2x2_o3
+SUB_azz_nn_s    11000001 101 ...01 0 .. 110 ...00 11 ...    @azz_4x4_o3
+SUB_azz_nn_d    11000001 111 ....0 0 .. 110 ....0 11 ...    @azz_2x2_o3
+SUB_azz_nn_d    11000001 111 ...01 0 .. 110 ...00 11 ...    @azz_4x4_o3
diff --git a/target/arm/tcg/translate-sme.c b/target/arm/tcg/translate-sme.c
index 4bb880d9ef..aabdb96675 100644
--- a/target/arm/tcg/translate-sme.c
+++ b/target/arm/tcg/translate-sme.c
@@ -775,3 +775,33 @@ TRANS_FEAT(ADD_azz_n1_s, aa64_sme2, do_azz_n1, a, MO_32, tcg_gen_gvec_add_var)
 TRANS_FEAT(SUB_azz_n1_s, aa64_sme2, do_azz_n1, a, MO_32, tcg_gen_gvec_sub_var)
 TRANS_FEAT(ADD_azz_n1_d, aa64_sme2_i16i64, do_azz_n1, a, MO_64, tcg_gen_gvec_add_var)
 TRANS_FEAT(SUB_azz_n1_d, aa64_sme2_i16i64, do_azz_n1, a, MO_64, tcg_gen_gvec_sub_var)
+
+/* Add/Sub each vector Z[m*N] to each Z[n*N] with result in ZA[d*N]. */
+static bool do_azz_nn(DisasContext *s, arg_azz_n *a, int esz,
+                      GVecGen3FnVar *fn)
+{
+    TCGv_ptr t_za;
+    int svl, n;
+
+    if (!sme_smza_enabled_check(s)) {
+        return true;
+    }
+
+    n = a->n;
+    t_za = get_zarray(s, a->rv, a->off, n, 1);
+    svl = streaming_vec_reg_size(s);
+
+    for (int i = 0; i < n; ++i) {
+        int o_za = (svl / n * sizeof(ARMVectorReg)) * i;
+        int o_zn = vec_full_reg_offset(s, a->zn + i);
+        int o_zm = vec_full_reg_offset(s, a->zm + i);
+
+        fn(esz, t_za, o_za, tcg_env, o_zn, tcg_env, o_zm, svl, svl);
+    }
+    return true;
+}
+
+TRANS_FEAT(ADD_azz_nn_s, aa64_sme2, do_azz_nn, a, MO_32, tcg_gen_gvec_add_var)
+TRANS_FEAT(SUB_azz_nn_s, aa64_sme2, do_azz_nn, a, MO_32, tcg_gen_gvec_sub_var)
+TRANS_FEAT(ADD_azz_nn_d, aa64_sme2_i16i64, do_azz_nn, a, MO_64, tcg_gen_gvec_add_var)
+TRANS_FEAT(SUB_azz_nn_d, aa64_sme2_i16i64, do_azz_nn, a, MO_64, tcg_gen_gvec_sub_var)

From a476ef9652793f1932605737adb8bce89ee069b2 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:19:57 -0600
Subject: [PATCH 1981/2760] target/arm: Pass ZA to helper_sve2_fmlal_zz[zx]w_s

Indicate whether to use FPST_FPCR or FPST_ZA via bit 2 of
simd_data(desc).  For SVE, this bit remains zero.
For do_FMLAL_zzzw, this requires no change.
For do_FMLAL_zzxw, move the index up one bit.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-35-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/translate-sve.c | 2 +-
 target/arm/tcg/vec_helper.c    | 8 +++++---
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
index 7e304245c6..b85bd885f9 100644
--- a/target/arm/tcg/translate-sve.c
+++ b/target/arm/tcg/translate-sve.c
@@ -7214,7 +7214,7 @@ static bool do_FMLAL_zzxw(DisasContext *s, arg_rrxr_esz *a, bool sub, bool sel)
 {
     return gen_gvec_ptr_zzzz(s, gen_helper_sve2_fmlal_zzxw_s,
                              a->rd, a->rn, a->rm, a->ra,
-                             (a->index << 2) | (sel << 1) | sub, tcg_env);
+                             (a->index << 3) | (sel << 1) | sub, tcg_env);
 }
 
 TRANS_FEAT(FMLALB_zzxw, aa64_sve2, do_FMLAL_zzxw, a, false, false)
diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
index 8b49577e2f..e8467823f2 100644
--- a/target/arm/tcg/vec_helper.c
+++ b/target/arm/tcg/vec_helper.c
@@ -2191,7 +2191,8 @@ void HELPER(sve2_fmlal_zzzw_s)(void *vd, void *vn, void *vm, void *va,
     intptr_t i, oprsz = simd_oprsz(desc);
     bool is_s = extract32(desc, SIMD_DATA_SHIFT, 1);
     intptr_t sel = extract32(desc, SIMD_DATA_SHIFT + 1, 1) * sizeof(float16);
-    float_status *status = &env->vfp.fp_status[FPST_A64];
+    bool za = extract32(desc, SIMD_DATA_SHIFT + 2, 1);
+    float_status *status = &env->vfp.fp_status[za ? FPST_ZA : FPST_A64];
     bool fz16 = env->vfp.fpcr & FPCR_FZ16;
     int negx = 0, negf = 0;
 
@@ -2274,8 +2275,9 @@ void HELPER(sve2_fmlal_zzxw_s)(void *vd, void *vn, void *vm, void *va,
     intptr_t i, j, oprsz = simd_oprsz(desc);
     bool is_s = extract32(desc, SIMD_DATA_SHIFT, 1);
     intptr_t sel = extract32(desc, SIMD_DATA_SHIFT + 1, 1) * sizeof(float16);
-    intptr_t idx = extract32(desc, SIMD_DATA_SHIFT + 2, 3) * sizeof(float16);
-    float_status *status = &env->vfp.fp_status[FPST_A64];
+    bool za = extract32(desc, SIMD_DATA_SHIFT + 2, 1);
+    intptr_t idx = extract32(desc, SIMD_DATA_SHIFT + 3, 3) * sizeof(float16);
+    float_status *status = &env->vfp.fp_status[za ? FPST_ZA : FPST_A64];
     bool fz16 = env->vfp.fpcr & FPCR_FZ16;
     int negx = 0, negf = 0;
 

From 04afb926711924b41a84058851f285460ccb16c8 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:19:58 -0600
Subject: [PATCH 1982/2760] target/arm: Add helper_gvec{_ah}_bfmlsl{_nx}

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-36-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/helper.h     |  8 +++++
 target/arm/tcg/vec_helper.c | 58 ++++++++++++++++++++++++++++---------
 2 files changed, 53 insertions(+), 13 deletions(-)

diff --git a/target/arm/tcg/helper.h b/target/arm/tcg/helper.h
index 8c4705fc53..a05b63380c 100644
--- a/target/arm/tcg/helper.h
+++ b/target/arm/tcg/helper.h
@@ -1095,8 +1095,16 @@ DEF_HELPER_FLAGS_6(gvec_bfmmla, TCG_CALL_NO_RWG,
 
 DEF_HELPER_FLAGS_6(gvec_bfmlal, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_6(gvec_bfmlsl, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_6(gvec_ah_bfmlsl, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_6(gvec_bfmlal_idx, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_6(gvec_bfmlsl_idx, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_6(gvec_ah_bfmlsl_idx, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, fpst, i32)
 
 DEF_HELPER_FLAGS_5(gvec_sclamp_b, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, i32)
diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
index e8467823f2..5dcd6f9282 100644
--- a/target/arm/tcg/vec_helper.c
+++ b/target/arm/tcg/vec_helper.c
@@ -3186,44 +3186,76 @@ void HELPER(gvec_bfmmla)(void *vd, void *vn, void *vm, void *va,
     clear_tail(d, opr_sz, simd_maxsz(desc));
 }
 
-void HELPER(gvec_bfmlal)(void *vd, void *vn, void *vm, void *va,
-                         float_status *stat, uint32_t desc)
+static void do_bfmlal(float32 *d, bfloat16 *n, bfloat16 *m, float32 *a,
+                      float_status *stat, uint32_t desc, int negx, int negf)
 {
     intptr_t i, opr_sz = simd_oprsz(desc);
-    intptr_t sel = simd_data(desc);
-    float32 *d = vd, *a = va;
-    bfloat16 *n = vn, *m = vm;
+    intptr_t sel = extract32(desc, SIMD_DATA_SHIFT, 1);
 
     for (i = 0; i < opr_sz / 4; ++i) {
-        float32 nn = n[H2(i * 2 + sel)] << 16;
+        float32 nn = (negx ^ n[H2(i * 2 + sel)]) << 16;
         float32 mm = m[H2(i * 2 + sel)] << 16;
-        d[H4(i)] = float32_muladd(nn, mm, a[H4(i)], 0, stat);
+        d[H4(i)] = float32_muladd(nn, mm, a[H4(i)], negf, stat);
     }
     clear_tail(d, opr_sz, simd_maxsz(desc));
 }
 
-void HELPER(gvec_bfmlal_idx)(void *vd, void *vn, void *vm,
-                             void *va, float_status *stat, uint32_t desc)
+void HELPER(gvec_bfmlal)(void *vd, void *vn, void *vm, void *va,
+                         float_status *stat, uint32_t desc)
+{
+    do_bfmlal(vd, vn, vm, va, stat, desc, 0, 0);
+}
+
+void HELPER(gvec_bfmlsl)(void *vd, void *vn, void *vm, void *va,
+                         float_status *stat, uint32_t desc)
+{
+    do_bfmlal(vd, vn, vm, va, stat, desc, 0x8000, 0);
+}
+
+void HELPER(gvec_ah_bfmlsl)(void *vd, void *vn, void *vm, void *va,
+                            float_status *stat, uint32_t desc)
+{
+    do_bfmlal(vd, vn, vm, va, stat, desc, 0, float_muladd_negate_product);
+}
+
+static void do_bfmlal_idx(float32 *d, bfloat16 *n, bfloat16 *m, float32 *a,
+                          float_status *stat, uint32_t desc, int negx, int negf)
 {
     intptr_t i, j, opr_sz = simd_oprsz(desc);
     intptr_t sel = extract32(desc, SIMD_DATA_SHIFT, 1);
     intptr_t index = extract32(desc, SIMD_DATA_SHIFT + 1, 3);
     intptr_t elements = opr_sz / 4;
     intptr_t eltspersegment = MIN(16 / 4, elements);
-    float32 *d = vd, *a = va;
-    bfloat16 *n = vn, *m = vm;
 
     for (i = 0; i < elements; i += eltspersegment) {
         float32 m_idx = m[H2(2 * i + index)] << 16;
 
         for (j = i; j < i + eltspersegment; j++) {
-            float32 n_j = n[H2(2 * j + sel)] << 16;
-            d[H4(j)] = float32_muladd(n_j, m_idx, a[H4(j)], 0, stat);
+            float32 n_j = (negx ^ n[H2(2 * j + sel)]) << 16;
+            d[H4(j)] = float32_muladd(n_j, m_idx, a[H4(j)], negf, stat);
         }
     }
     clear_tail(d, opr_sz, simd_maxsz(desc));
 }
 
+void HELPER(gvec_bfmlal_idx)(void *vd, void *vn, void *vm, void *va,
+                             float_status *stat, uint32_t desc)
+{
+    do_bfmlal_idx(vd, vn, vm, va, stat, desc, 0, 0);
+}
+
+void HELPER(gvec_bfmlsl_idx)(void *vd, void *vn, void *vm, void *va,
+                             float_status *stat, uint32_t desc)
+{
+    do_bfmlal_idx(vd, vn, vm, va, stat, desc, 0x8000, 0);
+}
+
+void HELPER(gvec_ah_bfmlsl_idx)(void *vd, void *vn, void *vm, void *va,
+                                float_status *stat, uint32_t desc)
+{
+    do_bfmlal_idx(vd, vn, vm, va, stat, desc, 0, float_muladd_negate_product);
+}
+
 #define DO_CLAMP(NAME, TYPE) \
 void HELPER(NAME)(void *d, void *n, void *m, void *a, uint32_t desc)    \
 {                                                                       \

From 50548277bd1be465bb7e8e575d67d20836552e31 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:19:59 -0600
Subject: [PATCH 1983/2760] target/arm: Implement SME2 FMLAL, BFMLAL

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-37-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/sme.decode      | 71 ++++++++++++++++++++++++
 target/arm/tcg/translate-sme.c | 98 ++++++++++++++++++++++++++++++++++
 2 files changed, 169 insertions(+)

diff --git a/target/arm/tcg/sme.decode b/target/arm/tcg/sme.decode
index a6dee08661..9850c19d90 100644
--- a/target/arm/tcg/sme.decode
+++ b/target/arm/tcg/sme.decode
@@ -261,6 +261,30 @@ SUB_azz_n1_s    11000001 0011 .... 0 .. 110 ..... 11 ...    @azz_nx1_o3 n=4
 SUB_azz_n1_d    11000001 0110 .... 0 .. 110 ..... 11 ...    @azz_nx1_o3 n=2
 SUB_azz_n1_d    11000001 0111 .... 0 .. 110 ..... 11 ...    @azz_nx1_o3 n=4
 
+%off3_x2        0:3 !function=times_2
+%off2_x2        0:2 !function=times_2
+
+@azz_nx1_o3x2   ........ ... . zm:4 . .. ... zn:5 .. ...    \
+                &azz_n off=%off3_x2 rv=%mova_rv
+@azz_nx1_o2x2   ........ ... . zm:4 . .. ... zn:5 ... ..    \
+                &azz_n off=%off2_x2 rv=%mova_rv
+
+FMLAL_n1        11000001 001 0 .... 0 .. 011 ..... 00 ...   @azz_nx1_o3x2 n=1
+FMLAL_n1        11000001 001 0 .... 0 .. 010 ..... 000 ..   @azz_nx1_o2x2 n=2
+FMLAL_n1        11000001 001 1 .... 0 .. 010 ..... 000 ..   @azz_nx1_o2x2 n=4
+
+FMLSL_n1        11000001 001 0 .... 0 .. 011 ..... 01 ...   @azz_nx1_o3x2 n=1
+FMLSL_n1        11000001 001 0 .... 0 .. 010 ..... 010 ..   @azz_nx1_o2x2 n=2
+FMLSL_n1        11000001 001 1 .... 0 .. 010 ..... 010 ..   @azz_nx1_o2x2 n=4
+
+BFMLAL_n1       11000001 001 0 .... 0 .. 011 ..... 10 ...   @azz_nx1_o3x2 n=1
+BFMLAL_n1       11000001 001 0 .... 0 .. 010 ..... 100 ..   @azz_nx1_o2x2 n=2
+BFMLAL_n1       11000001 001 1 .... 0 .. 010 ..... 100 ..   @azz_nx1_o2x2 n=4
+
+BFMLSL_n1       11000001 001 0 .... 0 .. 011 ..... 11 ...   @azz_nx1_o3x2 n=1
+BFMLSL_n1       11000001 001 0 .... 0 .. 010 ..... 110 ..   @azz_nx1_o2x2 n=2
+BFMLSL_n1       11000001 001 1 .... 0 .. 010 ..... 110 ..   @azz_nx1_o2x2 n=4
+
 ### SME2 Multi-vector Multiple Array Vectors
 
 %zn_ax2         6:4 !function=times_2
@@ -280,3 +304,50 @@ SUB_azz_nn_s    11000001 101 ....0 0 .. 110 ....0 11 ...    @azz_2x2_o3
 SUB_azz_nn_s    11000001 101 ...01 0 .. 110 ...00 11 ...    @azz_4x4_o3
 SUB_azz_nn_d    11000001 111 ....0 0 .. 110 ....0 11 ...    @azz_2x2_o3
 SUB_azz_nn_d    11000001 111 ...01 0 .. 110 ...00 11 ...    @azz_4x4_o3
+
+@azz_2x2_o2x2   ........ ... ..... . .. ... ..... ... ..    \
+                &azz_n n=2 rv=%mova_rv zn=%zn_ax2 zm=%zm_ax2 off=%off2_x2
+@azz_4x4_o2x2   ........ ... ..... . .. ... ..... ... ..    \
+                &azz_n n=4 rv=%mova_rv zn=%zn_ax4 zm=%zm_ax4 off=%off2_x2
+
+FMLAL_nn        11000001 101 ....0 0 .. 010 ....0 000 ..    @azz_2x2_o2x2
+FMLAL_nn        11000001 101 ...01 0 .. 010 ...00 000 ..    @azz_4x4_o2x2
+
+FMLSL_nn        11000001 101 ....0 0 .. 010 ....0 010 ..    @azz_2x2_o2x2
+FMLSL_nn        11000001 101 ...01 0 .. 010 ...00 010 ..    @azz_4x4_o2x2
+
+BFMLAL_nn       11000001 101 ....0 0 .. 010 ....0 100 ..    @azz_2x2_o2x2
+BFMLAL_nn       11000001 101 ...01 0 .. 010 ...00 100 ..    @azz_4x4_o2x2
+
+BFMLSL_nn       11000001 101 ....0 0 .. 010 ....0 110 ..    @azz_2x2_o2x2
+BFMLSL_nn       11000001 101 ...01 0 .. 010 ...00 110 ..    @azz_4x4_o2x2
+
+### SME2 Multi-vector Indexed
+
+&azx_n          n off rv zn zm idx
+
+%idx3_15_10     15:1 10:2
+%idx2_10_2      10:2 2:1
+
+@azx_1x1_o3x2   ........ .... zm:4 . .. . .. zn:5 .. ...    \
+                &azx_n n=1 rv=%mova_rv off=%off3_x2 idx=%idx3_15_10
+@azx_2x1_o2x2   ........ .... zm:4 . .. . .. ..... .. ...   \
+                &azx_n n=2 rv=%mova_rv off=%off2_x2 zn=%zn_ax2 idx=%idx2_10_2
+@azx_4x1_o2x2   ........ .... zm:4 . .. . .. ..... .. ...   \
+                &azx_n n=4 rv=%mova_rv off=%off2_x2 zn=%zn_ax4 idx=%idx2_10_2
+
+FMLAL_nx        11000001 1000 .... . .. 1 .. ..... 00 ...   @azx_1x1_o3x2
+FMLAL_nx        11000001 1001 .... 0 .. 1 .. ....0 00 ...   @azx_2x1_o2x2
+FMLAL_nx        11000001 1001 .... 1 .. 1 .. ...00 00 ...   @azx_4x1_o2x2
+
+FMLSL_nx        11000001 1000 .... . .. 1 .. ..... 01 ...   @azx_1x1_o3x2
+FMLSL_nx        11000001 1001 .... 0 .. 1 .. ....0 01 ...   @azx_2x1_o2x2
+FMLSL_nx        11000001 1001 .... 1 .. 1 .. ...00 01 ...   @azx_4x1_o2x2
+
+BFMLAL_nx       11000001 1000 .... . .. 1 .. ..... 10 ...   @azx_1x1_o3x2
+BFMLAL_nx       11000001 1001 .... 0 .. 1 .. ....0 10 ...   @azx_2x1_o2x2
+BFMLAL_nx       11000001 1001 .... 1 .. 1 .. ...00 10 ...   @azx_4x1_o2x2
+
+BFMLSL_nx       11000001 1000 .... . .. 1 .. ..... 11 ...   @azx_1x1_o3x2
+BFMLSL_nx       11000001 1001 .... 0 .. 1 .. ....0 11 ...   @azx_2x1_o2x2
+BFMLSL_nx       11000001 1001 .... 1 .. 1 .. ...00 11 ...   @azx_4x1_o2x2
diff --git a/target/arm/tcg/translate-sme.c b/target/arm/tcg/translate-sme.c
index aabdb96675..9ec02d960d 100644
--- a/target/arm/tcg/translate-sme.c
+++ b/target/arm/tcg/translate-sme.c
@@ -805,3 +805,101 @@ TRANS_FEAT(ADD_azz_nn_s, aa64_sme2, do_azz_nn, a, MO_32, tcg_gen_gvec_add_var)
 TRANS_FEAT(SUB_azz_nn_s, aa64_sme2, do_azz_nn, a, MO_32, tcg_gen_gvec_sub_var)
 TRANS_FEAT(ADD_azz_nn_d, aa64_sme2_i16i64, do_azz_nn, a, MO_64, tcg_gen_gvec_add_var)
 TRANS_FEAT(SUB_azz_nn_d, aa64_sme2_i16i64, do_azz_nn, a, MO_64, tcg_gen_gvec_sub_var)
+
+/*
+ * Expand array multi-vector single (n1), array multi-vector (nn),
+ * and array multi-vector indexed (nx), for floating-point accumulate.
+ *   multi: true for nn, false for n1.
+ *   fpst: >= 0 to set ptr argument for FPST_*, < 0 for ENV.
+ *   data: stuff for simd_data, including any index.
+ */
+#define FPST_ENV  -1
+
+static bool do_azz_acc_fp(DisasContext *s, int nreg, int nsel,
+                          int rv, int off, int zn, int zm,
+                          int data, int shsel, bool multi, int fpst,
+                          gen_helper_gvec_4_ptr *fn)
+{
+    if (sme_smza_enabled_check(s)) {
+        int svl = streaming_vec_reg_size(s);
+        int vstride = svl / nreg;
+        TCGv_ptr t_za = get_zarray(s, rv, off, nreg, nsel);
+        TCGv_ptr t, ptr;
+
+        if (fpst >= 0) {
+            ptr = fpstatus_ptr(fpst);
+        } else {
+            ptr = tcg_env;
+        }
+        t = tcg_temp_new_ptr();
+
+        for (int r = 0; r < nreg; ++r) {
+            TCGv_ptr t_zn = vec_full_reg_ptr(s, zn);
+            TCGv_ptr t_zm = vec_full_reg_ptr(s, zm);
+
+            for (int i = 0; i < nsel; ++i) {
+                int o_za = (r * vstride + i) * sizeof(ARMVectorReg);
+                int desc = simd_desc(svl, svl, data | (i << shsel));
+
+                tcg_gen_addi_ptr(t, t_za, o_za);
+                fn(t, t_zn, t_zm, t, ptr, tcg_constant_i32(desc));
+            }
+
+            /*
+             * For multiple-and-single vectors, Zn may wrap.
+             * For multiple vectors, both Zn and Zm are aligned.
+             */
+            zn = (zn + 1) % 32;
+            zm += multi;
+        }
+    }
+    return true;
+}
+
+static bool do_fmlal(DisasContext *s, arg_azz_n *a, bool sub, bool multi)
+{
+    return do_azz_acc_fp(s, a->n, 2, a->rv, a->off, a->zn, a->zm,
+                         (1 << 2) | sub, 1,
+                         multi, FPST_ENV, gen_helper_sve2_fmlal_zzzw_s);
+}
+
+TRANS_FEAT(FMLAL_n1, aa64_sme2, do_fmlal, a, false, false)
+TRANS_FEAT(FMLSL_n1, aa64_sme2, do_fmlal, a, true, false)
+TRANS_FEAT(FMLAL_nn, aa64_sme2, do_fmlal, a, false, true)
+TRANS_FEAT(FMLSL_nn, aa64_sme2, do_fmlal, a, true, true)
+
+static bool do_fmlal_nx(DisasContext *s, arg_azx_n *a, bool sub)
+{
+    return do_azz_acc_fp(s, a->n, 2, a->rv, a->off, a->zn, a->zm,
+                         (a->idx << 3) | (1 << 2) | sub, 1,
+                         false, FPST_ENV, gen_helper_sve2_fmlal_zzxw_s);
+}
+
+TRANS_FEAT(FMLAL_nx, aa64_sme2, do_fmlal_nx, a, false)
+TRANS_FEAT(FMLSL_nx, aa64_sme2, do_fmlal_nx, a, true)
+
+static bool do_bfmlal(DisasContext *s, arg_azz_n *a, bool sub, bool multi)
+{
+    return do_azz_acc_fp(s, a->n, 2, a->rv, a->off, a->zn, a->zm,
+                         0, 0, multi, FPST_ZA,
+                         (!sub ? gen_helper_gvec_bfmlal
+                          : s->fpcr_ah ? gen_helper_gvec_ah_bfmlsl
+                          : gen_helper_gvec_bfmlsl));
+}
+
+TRANS_FEAT(BFMLAL_n1, aa64_sme2, do_bfmlal, a, false, false)
+TRANS_FEAT(BFMLSL_n1, aa64_sme2, do_bfmlal, a, true, false)
+TRANS_FEAT(BFMLAL_nn, aa64_sme2, do_bfmlal, a, false, true)
+TRANS_FEAT(BFMLSL_nn, aa64_sme2, do_bfmlal, a, true, true)
+
+static bool do_bfmlal_nx(DisasContext *s, arg_azx_n *a, bool sub)
+{
+    return do_azz_acc_fp(s, a->n, 2, a->rv, a->off, a->zn, a->zm,
+                         a->idx << 1, 0, false, FPST_ZA,
+                         !sub ? gen_helper_gvec_bfmlal_idx
+                         : s->fpcr_ah ? gen_helper_gvec_ah_bfmlsl_idx
+                         : gen_helper_gvec_bfmlsl_idx);
+}
+
+TRANS_FEAT(BFMLAL_nx, aa64_sme2, do_bfmlal_nx, a, false)
+TRANS_FEAT(BFMLSL_nx, aa64_sme2, do_bfmlal_nx, a, true)

From 05cad66f103f4ac0d937d31ada5dcd5a550e6304 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:20:00 -0600
Subject: [PATCH 1984/2760] target/arm: Implement SME2 FDOT

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-38-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/helper-sme.h    |  5 ++++
 target/arm/tcg/sme.decode      | 14 +++++++++++
 target/arm/tcg/sme_helper.c    | 44 ++++++++++++++++++++++++++++++++++
 target/arm/tcg/sve.decode      |  7 ++++--
 target/arm/tcg/translate-sme.c | 18 ++++++++++++++
 target/arm/tcg/translate-sve.c |  5 ++++
 6 files changed, 91 insertions(+), 2 deletions(-)

diff --git a/target/arm/tcg/helper-sme.h b/target/arm/tcg/helper-sme.h
index cdd7058aed..ec93ff57ff 100644
--- a/target/arm/tcg/helper-sme.h
+++ b/target/arm/tcg/helper-sme.h
@@ -173,3 +173,8 @@ DEF_HELPER_FLAGS_5(gvec_fmaxnum_b16, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_5(gvec_fminnum_b16, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, fpst, i32)
+
+DEF_HELPER_FLAGS_6(sme2_fdot_h, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_6(sme2_fdot_idx_h, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, env, i32)
diff --git a/target/arm/tcg/sme.decode b/target/arm/tcg/sme.decode
index 9850c19d90..a2b93519c4 100644
--- a/target/arm/tcg/sme.decode
+++ b/target/arm/tcg/sme.decode
@@ -285,6 +285,9 @@ BFMLSL_n1       11000001 001 0 .... 0 .. 011 ..... 11 ...   @azz_nx1_o3x2 n=1
 BFMLSL_n1       11000001 001 0 .... 0 .. 010 ..... 110 ..   @azz_nx1_o2x2 n=2
 BFMLSL_n1       11000001 001 1 .... 0 .. 010 ..... 110 ..   @azz_nx1_o2x2 n=4
 
+FDOT_n1         11000001 001 0 .... 0 .. 100 ..... 00 ...   @azz_nx1_o3 n=2
+FDOT_n1         11000001 001 1 .... 0 .. 100 ..... 00 ...   @azz_nx1_o3 n=4
+
 ### SME2 Multi-vector Multiple Array Vectors
 
 %zn_ax2         6:4 !function=times_2
@@ -322,6 +325,9 @@ BFMLAL_nn       11000001 101 ...01 0 .. 010 ...00 100 ..    @azz_4x4_o2x2
 BFMLSL_nn       11000001 101 ....0 0 .. 010 ....0 110 ..    @azz_2x2_o2x2
 BFMLSL_nn       11000001 101 ...01 0 .. 010 ...00 110 ..    @azz_4x4_o2x2
 
+FDOT_nn         11000001 101 ....0 0 .. 100 ....0 00 ...    @azz_2x2_o3
+FDOT_nn         11000001 101 ...01 0 .. 100 ...00 00 ...    @azz_4x4_o3
+
 ### SME2 Multi-vector Indexed
 
 &azx_n          n off rv zn zm idx
@@ -351,3 +357,11 @@ BFMLAL_nx       11000001 1001 .... 1 .. 1 .. ...00 10 ...   @azx_4x1_o2x2
 BFMLSL_nx       11000001 1000 .... . .. 1 .. ..... 11 ...   @azx_1x1_o3x2
 BFMLSL_nx       11000001 1001 .... 0 .. 1 .. ....0 11 ...   @azx_2x1_o2x2
 BFMLSL_nx       11000001 1001 .... 1 .. 1 .. ...00 11 ...   @azx_4x1_o2x2
+
+@azx_2x1_i2_o3  ........ .... zm:4 . .. . idx:2 .... ... off:3 \
+                &azx_n n=2 rv=%mova_rv zn=%zn_ax2
+@azx_4x1_i2_o3  ........ .... zm:4 . .. . idx:2 .... ... off:3 \
+                &azx_n n=2 rv=%mova_rv zn=%zn_ax4
+
+FDOT_nx         11000001 0101 .... 0 .. 1 .. ....0 01 ...   @azx_2x1_i2_o3
+FDOT_nx         11000001 0101 .... 1 .. 1 .. ...00 01 ...   @azx_4x1_i2_o3
diff --git a/target/arm/tcg/sme_helper.c b/target/arm/tcg/sme_helper.c
index 8ce50653b4..60322be3d0 100644
--- a/target/arm/tcg/sme_helper.c
+++ b/target/arm/tcg/sme_helper.c
@@ -1152,6 +1152,50 @@ void HELPER(sme_fmopa_h)(void *vza, void *vzn, void *vzm, void *vpn,
     }
 }
 
+void HELPER(sme2_fdot_h)(void *vd, void *vn, void *vm, void *va,
+                         CPUARMState *env, uint32_t desc)
+{
+    intptr_t i, oprsz = simd_maxsz(desc);
+    bool za = extract32(desc, SIMD_DATA_SHIFT, 1);
+    float_status *fpst_std = &env->vfp.fp_status[za ? FPST_ZA : FPST_A64];
+    float_status *fpst_f16 = &env->vfp.fp_status[za ? FPST_ZA_F16 : FPST_A64_F16];
+    float_status fpst_odd = *fpst_std;
+    float32 *d = vd, *a = va;
+    uint32_t *n = vn, *m = vm;
+
+    set_float_rounding_mode(float_round_to_odd, &fpst_odd);
+
+    for (i = 0; i < oprsz / sizeof(float32); ++i) {
+        d[H4(i)] = f16_dotadd(a[H4(i)], n[H4(i)], m[H4(i)],
+                              fpst_f16, fpst_std, &fpst_odd);
+    }
+}
+
+void HELPER(sme2_fdot_idx_h)(void *vd, void *vn, void *vm, void *va,
+                             CPUARMState *env, uint32_t desc)
+{
+    intptr_t i, j, oprsz = simd_maxsz(desc);
+    intptr_t elements = oprsz / sizeof(float32);
+    intptr_t eltspersegment = MIN(4, elements);
+    int idx = extract32(desc, SIMD_DATA_SHIFT, 2);
+    bool za = extract32(desc, SIMD_DATA_SHIFT + 2, 1);
+    float_status *fpst_std = &env->vfp.fp_status[za ? FPST_ZA : FPST_A64];
+    float_status *fpst_f16 = &env->vfp.fp_status[za ? FPST_ZA_F16 : FPST_A64_F16];
+    float_status fpst_odd = *fpst_std;
+    float32 *d = vd, *a = va;
+    uint32_t *n = vn, *m = (uint32_t *)vm + H4(idx);
+
+    set_float_rounding_mode(float_round_to_odd, &fpst_odd);
+
+    for (i = 0; i < elements; i += eltspersegment) {
+        uint32_t mm = m[i];
+        for (j = 0; j < eltspersegment; ++j) {
+            d[H4(i + j)] = f16_dotadd(a[H4(i + j)], n[H4(i + j)], mm,
+                                      fpst_f16, fpst_std, &fpst_odd);
+        }
+    }
+}
+
 void HELPER(sme_bfmopa)(void *vza, void *vzn, void *vzm,
                         void *vpn, void *vpm, CPUARMState *env, uint32_t desc)
 {
diff --git a/target/arm/tcg/sve.decode b/target/arm/tcg/sve.decode
index 3a99eb7299..5970ed9ac4 100644
--- a/target/arm/tcg/sve.decode
+++ b/target/arm/tcg/sve.decode
@@ -1662,7 +1662,8 @@ FMLSLT_zzzw     01100100 10 1 ..... 10 1 00 1 ..... .....  @rda_rn_rm_ex esz=2
 BFMLALB_zzzw    01100100 11 1 ..... 10 0 00 0 ..... .....  @rda_rn_rm_ex esz=2
 BFMLALT_zzzw    01100100 11 1 ..... 10 0 00 1 ..... .....  @rda_rn_rm_ex esz=2
 
-### SVE2 floating-point bfloat16 dot-product
+### SVE2 floating-point dot-product
+FDOT_zzzz       01100100 00 1 ..... 10 0 00 0 ..... .....  @rda_rn_rm_ex esz=2
 BFDOT_zzzz      01100100 01 1 ..... 10 0 00 0 ..... .....  @rda_rn_rm_ex esz=2
 
 ### SVE2 floating-point multiply-add long (indexed)
@@ -1673,7 +1674,9 @@ FMLSLT_zzxw     01100100 10 1 ..... 0110.1 ..... .....     @rrxr_3a esz=2
 BFMLALB_zzxw    01100100 11 1 ..... 0100.0 ..... .....     @rrxr_3a esz=2
 BFMLALT_zzxw    01100100 11 1 ..... 0100.1 ..... .....     @rrxr_3a esz=2
 
-### SVE2 floating-point bfloat16 dot-product (indexed)
+### SVE2 floating-point dot-product (indexed)
+
+FDOT_zzxz       01100100 00 1 ..... 010000 ..... .....     @rrxr_2 esz=2
 BFDOT_zzxz      01100100 01 1 ..... 010000 ..... .....     @rrxr_2 esz=2
 
 ### SVE broadcast predicate element
diff --git a/target/arm/tcg/translate-sme.c b/target/arm/tcg/translate-sme.c
index 9ec02d960d..761584c90b 100644
--- a/target/arm/tcg/translate-sme.c
+++ b/target/arm/tcg/translate-sme.c
@@ -903,3 +903,21 @@ static bool do_bfmlal_nx(DisasContext *s, arg_azx_n *a, bool sub)
 
 TRANS_FEAT(BFMLAL_nx, aa64_sme2, do_bfmlal_nx, a, false)
 TRANS_FEAT(BFMLSL_nx, aa64_sme2, do_bfmlal_nx, a, true)
+
+static bool do_fdot(DisasContext *s, arg_azz_n *a, bool multi)
+{
+    return do_azz_acc_fp(s, a->n, 1, a->rv, a->off, a->zn, a->zm, 1, 0,
+                         multi, FPST_ENV, gen_helper_sme2_fdot_h);
+}
+
+TRANS_FEAT(FDOT_n1, aa64_sme2, do_fdot, a, false)
+TRANS_FEAT(FDOT_nn, aa64_sme2, do_fdot, a, true)
+
+static bool do_fdot_nx(DisasContext *s, arg_azx_n *a)
+{
+    return do_azz_acc_fp(s, a->n, 1, a->rv, a->off, a->zn, a->zm,
+                         a->idx | (1 << 2), 0, false, FPST_ENV,
+                         gen_helper_sme2_fdot_idx_h);
+}
+
+TRANS_FEAT(FDOT_nx, aa64_sme2, do_fdot_nx, a)
diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
index b85bd885f9..4acd22f55e 100644
--- a/target/arm/tcg/translate-sve.c
+++ b/target/arm/tcg/translate-sve.c
@@ -7229,6 +7229,11 @@ TRANS_FEAT_NONSTREAMING(USMMLA, aa64_sve_i8mm, gen_gvec_ool_arg_zzzz,
 TRANS_FEAT_NONSTREAMING(UMMLA, aa64_sve_i8mm, gen_gvec_ool_arg_zzzz,
                         gen_helper_gvec_ummla_b, a, 0)
 
+TRANS_FEAT(FDOT_zzzz, aa64_sme2_or_sve2p1, gen_gvec_env_arg_zzzz,
+           gen_helper_sme2_fdot_h, a, 0)
+TRANS_FEAT(FDOT_zzxz, aa64_sme2_or_sve2p1, gen_gvec_env_arg_zzxz,
+           gen_helper_sme2_fdot_idx_h, a)
+
 TRANS_FEAT(BFDOT_zzzz, aa64_sve_bf16, gen_gvec_env_arg_zzzz,
            gen_helper_gvec_bfdot, a, 0)
 TRANS_FEAT(BFDOT_zzxz, aa64_sve_bf16, gen_gvec_env_arg_zzxz,

From be0b56851a56da8ef4410cd936a351bd4070caaa Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:20:01 -0600
Subject: [PATCH 1985/2760] target/arm: Implement SME2 BFDOT

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-39-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/sme.decode      |  9 +++++++++
 target/arm/tcg/translate-sme.c | 17 +++++++++++++++++
 2 files changed, 26 insertions(+)

diff --git a/target/arm/tcg/sme.decode b/target/arm/tcg/sme.decode
index a2b93519c4..18e625605f 100644
--- a/target/arm/tcg/sme.decode
+++ b/target/arm/tcg/sme.decode
@@ -288,6 +288,9 @@ BFMLSL_n1       11000001 001 1 .... 0 .. 010 ..... 110 ..   @azz_nx1_o2x2 n=4
 FDOT_n1         11000001 001 0 .... 0 .. 100 ..... 00 ...   @azz_nx1_o3 n=2
 FDOT_n1         11000001 001 1 .... 0 .. 100 ..... 00 ...   @azz_nx1_o3 n=4
 
+BFDOT_n1        11000001 001 0 .... 0 .. 100 ..... 10 ...   @azz_nx1_o3 n=2
+BFDOT_n1        11000001 001 1 .... 0 .. 100 ..... 10 ...   @azz_nx1_o3 n=4
+
 ### SME2 Multi-vector Multiple Array Vectors
 
 %zn_ax2         6:4 !function=times_2
@@ -328,6 +331,9 @@ BFMLSL_nn       11000001 101 ...01 0 .. 010 ...00 110 ..    @azz_4x4_o2x2
 FDOT_nn         11000001 101 ....0 0 .. 100 ....0 00 ...    @azz_2x2_o3
 FDOT_nn         11000001 101 ...01 0 .. 100 ...00 00 ...    @azz_4x4_o3
 
+BFDOT_nn        11000001 101 ....0 0 .. 100 ....0 10 ...    @azz_2x2_o3
+BFDOT_nn        11000001 101 ...01 0 .. 100 ...00 10 ...    @azz_4x4_o3
+
 ### SME2 Multi-vector Indexed
 
 &azx_n          n off rv zn zm idx
@@ -365,3 +371,6 @@ BFMLSL_nx       11000001 1001 .... 1 .. 1 .. ...00 11 ...   @azx_4x1_o2x2
 
 FDOT_nx         11000001 0101 .... 0 .. 1 .. ....0 01 ...   @azx_2x1_i2_o3
 FDOT_nx         11000001 0101 .... 1 .. 1 .. ...00 01 ...   @azx_4x1_i2_o3
+
+BFDOT_nx        11000001 0101 .... 0 .. 1 .. ....0 11 ...   @azx_2x1_i2_o3
+BFDOT_nx        11000001 0101 .... 1 .. 1 .. ...00 11 ...   @azx_4x1_i2_o3
diff --git a/target/arm/tcg/translate-sme.c b/target/arm/tcg/translate-sme.c
index 761584c90b..965a49465e 100644
--- a/target/arm/tcg/translate-sme.c
+++ b/target/arm/tcg/translate-sme.c
@@ -921,3 +921,20 @@ static bool do_fdot_nx(DisasContext *s, arg_azx_n *a)
 }
 
 TRANS_FEAT(FDOT_nx, aa64_sme2, do_fdot_nx, a)
+
+static bool do_bfdot(DisasContext *s, arg_azz_n *a, bool multi)
+{
+    return do_azz_acc_fp(s, a->n, 1, a->rv, a->off, a->zn, a->zm, 0, 0,
+                         multi, FPST_ENV, gen_helper_gvec_bfdot);
+}
+
+TRANS_FEAT(BFDOT_n1, aa64_sme2, do_bfdot, a, false)
+TRANS_FEAT(BFDOT_nn, aa64_sme2, do_bfdot, a, true)
+
+static bool do_bfdot_nx(DisasContext *s, arg_azx_n *a)
+{
+    return do_azz_acc_fp(s, a->n, 1, a->rv, a->off, a->zn, a->zm, a->idx, 0,
+                         false, FPST_ENV, gen_helper_gvec_bfdot_idx);
+}
+
+TRANS_FEAT(BFDOT_nx, aa64_sme2, do_bfdot_nx, a)

From 7bca70e01a3b2e89b265254a468ecc3c150eade9 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:20:02 -0600
Subject: [PATCH 1986/2760] target/arm: Implement SME2 FVDOT, BFVDOT

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-40-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/helper-sme.h    |  2 ++
 target/arm/tcg/helper.h        |  2 ++
 target/arm/tcg/sme.decode      |  3 +++
 target/arm/tcg/sme_helper.c    | 30 ++++++++++++++++++++++++++
 target/arm/tcg/translate-sme.c | 24 +++++++++++++++++++++
 target/arm/tcg/vec_helper.c    | 39 ++++++++++++++++++++++++++++++++++
 6 files changed, 100 insertions(+)

diff --git a/target/arm/tcg/helper-sme.h b/target/arm/tcg/helper-sme.h
index ec93ff57ff..8f5a1b3c90 100644
--- a/target/arm/tcg/helper-sme.h
+++ b/target/arm/tcg/helper-sme.h
@@ -178,3 +178,5 @@ DEF_HELPER_FLAGS_6(sme2_fdot_h, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, env, i32)
 DEF_HELPER_FLAGS_6(sme2_fdot_idx_h, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_6(sme2_fvdot_idx_h, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, env, i32)
diff --git a/target/arm/tcg/helper.h b/target/arm/tcg/helper.h
index a05b63380c..d8d389af2b 100644
--- a/target/arm/tcg/helper.h
+++ b/target/arm/tcg/helper.h
@@ -1089,6 +1089,8 @@ DEF_HELPER_FLAGS_6(gvec_bfdot, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, env, i32)
 DEF_HELPER_FLAGS_6(gvec_bfdot_idx, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_6(sme2_bfvdot_idx, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, env, i32)
 
 DEF_HELPER_FLAGS_6(gvec_bfmmla, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, env, i32)
diff --git a/target/arm/tcg/sme.decode b/target/arm/tcg/sme.decode
index 18e625605f..7c057bcad2 100644
--- a/target/arm/tcg/sme.decode
+++ b/target/arm/tcg/sme.decode
@@ -374,3 +374,6 @@ FDOT_nx         11000001 0101 .... 1 .. 1 .. ...00 01 ...   @azx_4x1_i2_o3
 
 BFDOT_nx        11000001 0101 .... 0 .. 1 .. ....0 11 ...   @azx_2x1_i2_o3
 BFDOT_nx        11000001 0101 .... 1 .. 1 .. ...00 11 ...   @azx_4x1_i2_o3
+
+FVDOT           11000001 0101 .... 0 .. 0 .. ....0 01 ...   @azx_2x1_i2_o3
+BFVDOT          11000001 0101 .... 0 .. 0 .. ....0 11 ...   @azx_2x1_i2_o3
diff --git a/target/arm/tcg/sme_helper.c b/target/arm/tcg/sme_helper.c
index 60322be3d0..8b45865461 100644
--- a/target/arm/tcg/sme_helper.c
+++ b/target/arm/tcg/sme_helper.c
@@ -1196,6 +1196,36 @@ void HELPER(sme2_fdot_idx_h)(void *vd, void *vn, void *vm, void *va,
     }
 }
 
+void HELPER(sme2_fvdot_idx_h)(void *vd, void *vn, void *vm, void *va,
+                              CPUARMState *env, uint32_t desc)
+{
+    intptr_t i, j, oprsz = simd_maxsz(desc);
+    intptr_t elements = oprsz / sizeof(float32);
+    intptr_t eltspersegment = MIN(4, elements);
+    int idx = extract32(desc, SIMD_DATA_SHIFT, 2);
+    int sel = extract32(desc, SIMD_DATA_SHIFT + 2, 1);
+    float_status fpst_odd, *fpst_std, *fpst_f16;
+    float32 *d = vd, *a = va;
+    uint16_t *n0 = vn;
+    uint16_t *n1 = vn + sizeof(ARMVectorReg);
+    uint32_t *m = (uint32_t *)vm + H4(idx);
+
+    fpst_std = &env->vfp.fp_status[FPST_ZA];
+    fpst_f16 = &env->vfp.fp_status[FPST_ZA_F16];
+    fpst_odd = *fpst_std;
+    set_float_rounding_mode(float_round_to_odd, &fpst_odd);
+
+    for (i = 0; i < elements; i += eltspersegment) {
+        uint32_t mm = m[i];
+        for (j = 0; j < eltspersegment; ++j) {
+            uint32_t nn = (n0[H2(2 * (i + j) + sel)])
+                        | (n1[H2(2 * (i + j) + sel)] << 16);
+            d[i + H4(j)] = f16_dotadd(a[i + H4(j)], nn, mm,
+                                      fpst_f16, fpst_std, &fpst_odd);
+        }
+    }
+}
+
 void HELPER(sme_bfmopa)(void *vza, void *vzn, void *vzm,
                         void *vpn, void *vpm, CPUARMState *env, uint32_t desc)
 {
diff --git a/target/arm/tcg/translate-sme.c b/target/arm/tcg/translate-sme.c
index 965a49465e..410a8d037c 100644
--- a/target/arm/tcg/translate-sme.c
+++ b/target/arm/tcg/translate-sme.c
@@ -938,3 +938,27 @@ static bool do_bfdot_nx(DisasContext *s, arg_azx_n *a)
 }
 
 TRANS_FEAT(BFDOT_nx, aa64_sme2, do_bfdot_nx, a)
+
+static bool do_vdot(DisasContext *s, arg_azx_n *a, gen_helper_gvec_4_ptr *fn)
+{
+    if (sme_smza_enabled_check(s)) {
+        int svl = streaming_vec_reg_size(s);
+        int vstride = svl / 2;
+        TCGv_ptr t_za = get_zarray(s, a->rv, a->off, 2, 1);
+        TCGv_ptr t_zn = vec_full_reg_ptr(s, a->zn);
+        TCGv_ptr t_zm = vec_full_reg_ptr(s, a->zm);
+        TCGv_ptr t = tcg_temp_new_ptr();
+
+        for (int i = 0; i < 2; ++i) {
+            int o_za = i * vstride * sizeof(ARMVectorReg);
+            int desc = simd_desc(svl, svl, a->idx | (i << 2));
+
+            tcg_gen_addi_ptr(t, t_za, o_za);
+            fn(t, t_zn, t_zm, t, tcg_env, tcg_constant_i32(desc));
+        }
+    }
+    return true;
+}
+
+TRANS_FEAT(FVDOT, aa64_sme, do_vdot, a, gen_helper_sme2_fvdot_idx_h)
+TRANS_FEAT(BFVDOT, aa64_sme, do_vdot, a, gen_helper_sme2_bfvdot_idx)
diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
index 5dcd6f9282..616f4050e4 100644
--- a/target/arm/tcg/vec_helper.c
+++ b/target/arm/tcg/vec_helper.c
@@ -3110,6 +3110,45 @@ void HELPER(gvec_bfdot_idx)(void *vd, void *vn, void *vm,
     clear_tail(d, opr_sz, simd_maxsz(desc));
 }
 
+void HELPER(sme2_bfvdot_idx)(void *vd, void *vn, void *vm,
+                             void *va, CPUARMState *env, uint32_t desc)
+{
+    intptr_t i, j, opr_sz = simd_oprsz(desc);
+    intptr_t idx = extract32(desc, SIMD_DATA_SHIFT, 2);
+    intptr_t sel = extract32(desc, SIMD_DATA_SHIFT + 2, 1);
+    intptr_t elements = opr_sz / 4;
+    intptr_t eltspersegment = MIN(16 / 4, elements);
+    float32 *d = vd, *a = va;
+    uint16_t *n0 = vn;
+    uint16_t *n1 = vn + sizeof(ARMVectorReg);
+    uint32_t *m = vm;
+    float_status fpst, fpst_odd;
+
+    if (is_ebf(env, &fpst, &fpst_odd)) {
+        for (i = 0; i < elements; i += eltspersegment) {
+            uint32_t m_idx = m[i + H4(idx)];
+
+            for (j = 0; j < eltspersegment; j++) {
+                uint32_t nn = (n0[H2(2 * (i + j) + sel)])
+                            | (n1[H2(2 * (i + j) + sel)] << 16);
+                d[i + H4(j)] = bfdotadd_ebf(a[i + H4(j)], nn, m_idx,
+                                            &fpst, &fpst_odd);
+            }
+        }
+    } else {
+        for (i = 0; i < elements; i += eltspersegment) {
+            uint32_t m_idx = m[i + H4(idx)];
+
+            for (j = 0; j < eltspersegment; j++) {
+                uint32_t nn = (n0[H2(2 * (i + j) + sel)])
+                            | (n1[H2(2 * (i + j) + sel)] << 16);
+                d[i + H4(j)] = bfdotadd(a[i + H4(j)], nn, m_idx, &fpst);
+            }
+        }
+    }
+    clear_tail(d, opr_sz, simd_maxsz(desc));
+}
+
 void HELPER(gvec_bfmmla)(void *vd, void *vn, void *vm, void *va,
                          CPUARMState *env, uint32_t desc)
 {

From f7186b4288d88c529c5cb3eb813146092a37cfce Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:20:03 -0600
Subject: [PATCH 1987/2760] target/arm: Rename helper_gvec_*dot_[bh] to *_4[bh]

Emphasize that these are 4-way dot products.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-41-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/helper.h         | 22 +++++++++++-----------
 target/arm/tcg/translate-a64.c  | 14 +++++++-------
 target/arm/tcg/translate-neon.c | 14 +++++++-------
 target/arm/tcg/translate-sve.c  | 18 +++++++++---------
 target/arm/tcg/vec_helper.c     | 22 +++++++++++-----------
 5 files changed, 45 insertions(+), 45 deletions(-)

diff --git a/target/arm/tcg/helper.h b/target/arm/tcg/helper.h
index d8d389af2b..a19955b872 100644
--- a/target/arm/tcg/helper.h
+++ b/target/arm/tcg/helper.h
@@ -616,23 +616,23 @@ DEF_HELPER_FLAGS_5(sve2_sqrdmlah_d, TCG_CALL_NO_RWG,
 DEF_HELPER_FLAGS_5(sve2_sqrdmlsh_d, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, i32)
 
-DEF_HELPER_FLAGS_5(gvec_sdot_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(gvec_udot_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(gvec_sdot_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(gvec_udot_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(gvec_usdot_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_sdot_4b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_udot_4b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_sdot_4h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_udot_4h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_usdot_4b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
 
-DEF_HELPER_FLAGS_5(gvec_sdot_idx_b, TCG_CALL_NO_RWG,
+DEF_HELPER_FLAGS_5(gvec_sdot_idx_4b, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(gvec_udot_idx_b, TCG_CALL_NO_RWG,
+DEF_HELPER_FLAGS_5(gvec_udot_idx_4b, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(gvec_sdot_idx_h, TCG_CALL_NO_RWG,
+DEF_HELPER_FLAGS_5(gvec_sdot_idx_4h, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(gvec_udot_idx_h, TCG_CALL_NO_RWG,
+DEF_HELPER_FLAGS_5(gvec_udot_idx_4h, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(gvec_sudot_idx_b, TCG_CALL_NO_RWG,
+DEF_HELPER_FLAGS_5(gvec_sudot_idx_4b, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_5(gvec_usdot_idx_b, TCG_CALL_NO_RWG,
+DEF_HELPER_FLAGS_5(gvec_usdot_idx_4b, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, i32)
 
 DEF_HELPER_FLAGS_5(gvec_fcaddh, TCG_CALL_NO_RWG,
diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index d823036c96..dbf47595db 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -6114,9 +6114,9 @@ static bool do_dot_vector_env(DisasContext *s, arg_qrrr_e *a,
     return true;
 }
 
-TRANS_FEAT(SDOT_v, aa64_dp, do_dot_vector, a, gen_helper_gvec_sdot_b)
-TRANS_FEAT(UDOT_v, aa64_dp, do_dot_vector, a, gen_helper_gvec_udot_b)
-TRANS_FEAT(USDOT_v, aa64_i8mm, do_dot_vector, a, gen_helper_gvec_usdot_b)
+TRANS_FEAT(SDOT_v, aa64_dp, do_dot_vector, a, gen_helper_gvec_sdot_4b)
+TRANS_FEAT(UDOT_v, aa64_dp, do_dot_vector, a, gen_helper_gvec_udot_4b)
+TRANS_FEAT(USDOT_v, aa64_i8mm, do_dot_vector, a, gen_helper_gvec_usdot_4b)
 TRANS_FEAT(BFDOT_v, aa64_bf16, do_dot_vector_env, a, gen_helper_gvec_bfdot)
 TRANS_FEAT(BFMMLA, aa64_bf16, do_dot_vector_env, a, gen_helper_gvec_bfmmla)
 TRANS_FEAT(SMMLA, aa64_i8mm, do_dot_vector, a, gen_helper_gvec_smmla_b)
@@ -6876,12 +6876,12 @@ static bool do_dot_vector_idx_env(DisasContext *s, arg_qrrx_e *a,
     return true;
 }
 
-TRANS_FEAT(SDOT_vi, aa64_dp, do_dot_vector_idx, a, gen_helper_gvec_sdot_idx_b)
-TRANS_FEAT(UDOT_vi, aa64_dp, do_dot_vector_idx, a, gen_helper_gvec_udot_idx_b)
+TRANS_FEAT(SDOT_vi, aa64_dp, do_dot_vector_idx, a, gen_helper_gvec_sdot_idx_4b)
+TRANS_FEAT(UDOT_vi, aa64_dp, do_dot_vector_idx, a, gen_helper_gvec_udot_idx_4b)
 TRANS_FEAT(SUDOT_vi, aa64_i8mm, do_dot_vector_idx, a,
-           gen_helper_gvec_sudot_idx_b)
+           gen_helper_gvec_sudot_idx_4b)
 TRANS_FEAT(USDOT_vi, aa64_i8mm, do_dot_vector_idx, a,
-           gen_helper_gvec_usdot_idx_b)
+           gen_helper_gvec_usdot_idx_4b)
 TRANS_FEAT(BFDOT_vi, aa64_bf16, do_dot_vector_idx_env, a,
            gen_helper_gvec_bfdot_idx)
 
diff --git a/target/arm/tcg/translate-neon.c b/target/arm/tcg/translate-neon.c
index c4fecb8fd6..ea04336797 100644
--- a/target/arm/tcg/translate-neon.c
+++ b/target/arm/tcg/translate-neon.c
@@ -271,7 +271,7 @@ static bool trans_VSDOT(DisasContext *s, arg_VSDOT *a)
         return false;
     }
     return do_neon_ddda(s, a->q * 7, a->vd, a->vn, a->vm, 0,
-                        gen_helper_gvec_sdot_b);
+                        gen_helper_gvec_sdot_4b);
 }
 
 static bool trans_VUDOT(DisasContext *s, arg_VUDOT *a)
@@ -280,7 +280,7 @@ static bool trans_VUDOT(DisasContext *s, arg_VUDOT *a)
         return false;
     }
     return do_neon_ddda(s, a->q * 7, a->vd, a->vn, a->vm, 0,
-                        gen_helper_gvec_udot_b);
+                        gen_helper_gvec_udot_4b);
 }
 
 static bool trans_VUSDOT(DisasContext *s, arg_VUSDOT *a)
@@ -289,7 +289,7 @@ static bool trans_VUSDOT(DisasContext *s, arg_VUSDOT *a)
         return false;
     }
     return do_neon_ddda(s, a->q * 7, a->vd, a->vn, a->vm, 0,
-                        gen_helper_gvec_usdot_b);
+                        gen_helper_gvec_usdot_4b);
 }
 
 static bool trans_VDOT_b16(DisasContext *s, arg_VDOT_b16 *a)
@@ -356,7 +356,7 @@ static bool trans_VSDOT_scalar(DisasContext *s, arg_VSDOT_scalar *a)
         return false;
     }
     return do_neon_ddda(s, a->q * 6, a->vd, a->vn, a->vm, a->index,
-                        gen_helper_gvec_sdot_idx_b);
+                        gen_helper_gvec_sdot_idx_4b);
 }
 
 static bool trans_VUDOT_scalar(DisasContext *s, arg_VUDOT_scalar *a)
@@ -365,7 +365,7 @@ static bool trans_VUDOT_scalar(DisasContext *s, arg_VUDOT_scalar *a)
         return false;
     }
     return do_neon_ddda(s, a->q * 6, a->vd, a->vn, a->vm, a->index,
-                        gen_helper_gvec_udot_idx_b);
+                        gen_helper_gvec_udot_idx_4b);
 }
 
 static bool trans_VUSDOT_scalar(DisasContext *s, arg_VUSDOT_scalar *a)
@@ -374,7 +374,7 @@ static bool trans_VUSDOT_scalar(DisasContext *s, arg_VUSDOT_scalar *a)
         return false;
     }
     return do_neon_ddda(s, a->q * 6, a->vd, a->vn, a->vm, a->index,
-                        gen_helper_gvec_usdot_idx_b);
+                        gen_helper_gvec_usdot_idx_4b);
 }
 
 static bool trans_VSUDOT_scalar(DisasContext *s, arg_VSUDOT_scalar *a)
@@ -383,7 +383,7 @@ static bool trans_VSUDOT_scalar(DisasContext *s, arg_VSUDOT_scalar *a)
         return false;
     }
     return do_neon_ddda(s, a->q * 6, a->vd, a->vn, a->vm, a->index,
-                        gen_helper_gvec_sudot_idx_b);
+                        gen_helper_gvec_sudot_idx_4b);
 }
 
 static bool trans_VDOT_b16_scal(DisasContext *s, arg_VDOT_b16_scal *a)
diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
index 4acd22f55e..1564ee2558 100644
--- a/target/arm/tcg/translate-sve.c
+++ b/target/arm/tcg/translate-sve.c
@@ -3402,8 +3402,8 @@ DO_ZZI(UMIN, umin)
 #undef DO_ZZI
 
 static gen_helper_gvec_4 * const dot_fns[2][2] = {
-    { gen_helper_gvec_sdot_b, gen_helper_gvec_sdot_h },
-    { gen_helper_gvec_udot_b, gen_helper_gvec_udot_h }
+    { gen_helper_gvec_sdot_4b, gen_helper_gvec_sdot_4h },
+    { gen_helper_gvec_udot_4b, gen_helper_gvec_udot_4h }
 };
 TRANS_FEAT(DOT_zzzz, aa64_sve, gen_gvec_ool_zzzz,
            dot_fns[a->u][a->sz], a->rd, a->rn, a->rm, a->ra, 0)
@@ -3413,18 +3413,18 @@ TRANS_FEAT(DOT_zzzz, aa64_sve, gen_gvec_ool_zzzz,
  */
 
 TRANS_FEAT(SDOT_zzxw_s, aa64_sve, gen_gvec_ool_arg_zzxz,
-           gen_helper_gvec_sdot_idx_b, a)
+           gen_helper_gvec_sdot_idx_4b, a)
 TRANS_FEAT(SDOT_zzxw_d, aa64_sve, gen_gvec_ool_arg_zzxz,
-           gen_helper_gvec_sdot_idx_h, a)
+           gen_helper_gvec_sdot_idx_4h, a)
 TRANS_FEAT(UDOT_zzxw_s, aa64_sve, gen_gvec_ool_arg_zzxz,
-           gen_helper_gvec_udot_idx_b, a)
+           gen_helper_gvec_udot_idx_4b, a)
 TRANS_FEAT(UDOT_zzxw_d, aa64_sve, gen_gvec_ool_arg_zzxz,
-           gen_helper_gvec_udot_idx_h, a)
+           gen_helper_gvec_udot_idx_4h, a)
 
 TRANS_FEAT(SUDOT_zzxw_s, aa64_sve_i8mm, gen_gvec_ool_arg_zzxz,
-           gen_helper_gvec_sudot_idx_b, a)
+           gen_helper_gvec_sudot_idx_4b, a)
 TRANS_FEAT(USDOT_zzxw_s, aa64_sve_i8mm, gen_gvec_ool_arg_zzxz,
-           gen_helper_gvec_usdot_idx_b, a)
+           gen_helper_gvec_usdot_idx_4b, a)
 
 #define DO_SVE2_RRX(NAME, FUNC) \
     TRANS_FEAT(NAME, aa64_sve, gen_gvec_ool_zzz, FUNC,          \
@@ -7152,7 +7152,7 @@ TRANS_FEAT(SQRDCMLAH_zzzz, aa64_sve2, gen_gvec_ool_zzzz,
            sqrdcmlah_fns[a->esz], a->rd, a->rn, a->rm, a->ra, a->rot)
 
 TRANS_FEAT(USDOT_zzzz, aa64_sve_i8mm, gen_gvec_ool_arg_zzzz,
-           a->esz == 2 ? gen_helper_gvec_usdot_b : NULL, a, 0)
+           a->esz == 2 ? gen_helper_gvec_usdot_4b : NULL, a, 0)
 
 TRANS_FEAT_NONSTREAMING(AESMC, aa64_sve2_aes, gen_gvec_ool_zz,
                         gen_helper_crypto_aesmc, a->rd, a->rd, 0)
diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
index 616f4050e4..f18d1675b5 100644
--- a/target/arm/tcg/vec_helper.c
+++ b/target/arm/tcg/vec_helper.c
@@ -825,11 +825,11 @@ void HELPER(NAME)(void *vd, void *vn, void *vm, void *va, uint32_t desc)  \
     clear_tail(d, opr_sz, simd_maxsz(desc));                              \
 }
 
-DO_DOT(gvec_sdot_b, int32_t, int8_t, int8_t)
-DO_DOT(gvec_udot_b, uint32_t, uint8_t, uint8_t)
-DO_DOT(gvec_usdot_b, uint32_t, uint8_t, int8_t)
-DO_DOT(gvec_sdot_h, int64_t, int16_t, int16_t)
-DO_DOT(gvec_udot_h, uint64_t, uint16_t, uint16_t)
+DO_DOT(gvec_sdot_4b, int32_t, int8_t, int8_t)
+DO_DOT(gvec_udot_4b, uint32_t, uint8_t, uint8_t)
+DO_DOT(gvec_usdot_4b, uint32_t, uint8_t, int8_t)
+DO_DOT(gvec_sdot_4h, int64_t, int16_t, int16_t)
+DO_DOT(gvec_udot_4h, uint64_t, uint16_t, uint16_t)
 
 #define DO_DOT_IDX(NAME, TYPED, TYPEN, TYPEM, HD) \
 void HELPER(NAME)(void *vd, void *vn, void *vm, void *va, uint32_t desc)  \
@@ -865,12 +865,12 @@ void HELPER(NAME)(void *vd, void *vn, void *vm, void *va, uint32_t desc)  \
     clear_tail(d, opr_sz, simd_maxsz(desc));                              \
 }
 
-DO_DOT_IDX(gvec_sdot_idx_b, int32_t, int8_t, int8_t, H4)
-DO_DOT_IDX(gvec_udot_idx_b, uint32_t, uint8_t, uint8_t, H4)
-DO_DOT_IDX(gvec_sudot_idx_b, int32_t, int8_t, uint8_t, H4)
-DO_DOT_IDX(gvec_usdot_idx_b, int32_t, uint8_t, int8_t, H4)
-DO_DOT_IDX(gvec_sdot_idx_h, int64_t, int16_t, int16_t, H8)
-DO_DOT_IDX(gvec_udot_idx_h, uint64_t, uint16_t, uint16_t, H8)
+DO_DOT_IDX(gvec_sdot_idx_4b, int32_t, int8_t, int8_t, H4)
+DO_DOT_IDX(gvec_udot_idx_4b, uint32_t, uint8_t, uint8_t, H4)
+DO_DOT_IDX(gvec_sudot_idx_4b, int32_t, int8_t, uint8_t, H4)
+DO_DOT_IDX(gvec_usdot_idx_4b, int32_t, uint8_t, int8_t, H4)
+DO_DOT_IDX(gvec_sdot_idx_4h, int64_t, int16_t, int16_t, H8)
+DO_DOT_IDX(gvec_udot_idx_4h, uint64_t, uint16_t, uint16_t, H8)
 
 void HELPER(gvec_fcaddh)(void *vd, void *vn, void *vm,
                          float_status *fpst, uint32_t desc)

From 9fce675a8e3c216db3a9dd029d4e655295125110 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:20:04 -0600
Subject: [PATCH 1988/2760] target/arm: Implemement SME2 SDOT, UDOT, USDOT,
 SUDOT

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20250704142112.1018902-42-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/helper.h        |  8 ++++
 target/arm/tcg/sme.decode      | 63 ++++++++++++++++++++++++-
 target/arm/tcg/translate-sme.c | 85 ++++++++++++++++++++++++++++++++++
 target/arm/tcg/vec_helper.c    | 51 ++++++++++++++++++++
 4 files changed, 206 insertions(+), 1 deletion(-)

diff --git a/target/arm/tcg/helper.h b/target/arm/tcg/helper.h
index a19955b872..c4a208e3ba 100644
--- a/target/arm/tcg/helper.h
+++ b/target/arm/tcg/helper.h
@@ -622,6 +622,9 @@ DEF_HELPER_FLAGS_5(gvec_sdot_4h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_5(gvec_udot_4h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_5(gvec_usdot_4b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
 
+DEF_HELPER_FLAGS_5(gvec_sdot_2h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_udot_2h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
+
 DEF_HELPER_FLAGS_5(gvec_sdot_idx_4b, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_5(gvec_udot_idx_4b, TCG_CALL_NO_RWG,
@@ -635,6 +638,11 @@ DEF_HELPER_FLAGS_5(gvec_sudot_idx_4b, TCG_CALL_NO_RWG,
 DEF_HELPER_FLAGS_5(gvec_usdot_idx_4b, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, i32)
 
+DEF_HELPER_FLAGS_5(gvec_sdot_idx_2h, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_udot_idx_2h, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+
 DEF_HELPER_FLAGS_5(gvec_fcaddh, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_5(gvec_fcadds, TCG_CALL_NO_RWG,
diff --git a/target/arm/tcg/sme.decode b/target/arm/tcg/sme.decode
index 7c057bcad2..338637decd 100644
--- a/target/arm/tcg/sme.decode
+++ b/target/arm/tcg/sme.decode
@@ -291,6 +291,26 @@ FDOT_n1         11000001 001 1 .... 0 .. 100 ..... 00 ...   @azz_nx1_o3 n=4
 BFDOT_n1        11000001 001 0 .... 0 .. 100 ..... 10 ...   @azz_nx1_o3 n=2
 BFDOT_n1        11000001 001 1 .... 0 .. 100 ..... 10 ...   @azz_nx1_o3 n=4
 
+USDOT_n1        11000001 001 0 .... 0 .. 101 ..... 01 ...   @azz_nx1_o3 n=2
+USDOT_n1        11000001 001 1 .... 0 .. 101 ..... 01 ...   @azz_nx1_o3 n=4
+
+SUDOT_n1        11000001 001 0 .... 0 .. 101 ..... 11 ...   @azz_nx1_o3 n=2
+SUDOT_n1        11000001 001 1 .... 0 .. 101 ..... 11 ...   @azz_nx1_o3 n=4
+
+SDOT_n1_4b      11000001 001 0 .... 0 .. 101 ..... 00 ...   @azz_nx1_o3 n=2
+SDOT_n1_4b      11000001 001 1 .... 0 .. 101 ..... 00 ...   @azz_nx1_o3 n=4
+SDOT_n1_4h      11000001 011 0 .... 0 .. 101 ..... 00 ...   @azz_nx1_o3 n=2
+SDOT_n1_4h      11000001 011 1 .... 0 .. 101 ..... 00 ...   @azz_nx1_o3 n=4
+SDOT_n1_2h      11000001 011 0 .... 0 .. 101 ..... 01 ...   @azz_nx1_o3 n=2
+SDOT_n1_2h      11000001 011 1 .... 0 .. 101 ..... 01 ...   @azz_nx1_o3 n=4
+
+UDOT_n1_4b      11000001 001 0 .... 0 .. 101 ..... 10 ...   @azz_nx1_o3 n=2
+UDOT_n1_4b      11000001 001 1 .... 0 .. 101 ..... 10 ...   @azz_nx1_o3 n=4
+UDOT_n1_4h      11000001 011 0 .... 0 .. 101 ..... 10 ...   @azz_nx1_o3 n=2
+UDOT_n1_4h      11000001 011 1 .... 0 .. 101 ..... 10 ...   @azz_nx1_o3 n=4
+UDOT_n1_2h      11000001 011 0 .... 0 .. 101 ..... 11 ...   @azz_nx1_o3 n=2
+UDOT_n1_2h      11000001 011 1 .... 0 .. 101 ..... 11 ...   @azz_nx1_o3 n=4
+
 ### SME2 Multi-vector Multiple Array Vectors
 
 %zn_ax2         6:4 !function=times_2
@@ -334,6 +354,23 @@ FDOT_nn         11000001 101 ...01 0 .. 100 ...00 00 ...    @azz_4x4_o3
 BFDOT_nn        11000001 101 ....0 0 .. 100 ....0 10 ...    @azz_2x2_o3
 BFDOT_nn        11000001 101 ...01 0 .. 100 ...00 10 ...    @azz_4x4_o3
 
+USDOT_nn        11000001 101 ....0 0 .. 101 ....0 01 ...    @azz_2x2_o3
+USDOT_nn        11000001 101 ...01 0 .. 101 ...00 01 ...    @azz_4x4_o3
+
+SDOT_nn_4b      11000001 101 ....0 0 .. 101 ....0 00 ...    @azz_2x2_o3
+SDOT_nn_4b      11000001 101 ...01 0 .. 101 ...00 00 ...    @azz_4x4_o3
+SDOT_nn_4h      11000001 111 ....0 0 .. 101 ....0 00 ...    @azz_2x2_o3
+SDOT_nn_4h      11000001 111 ...01 0 .. 101 ...00 00 ...    @azz_4x4_o3
+SDOT_nn_2h      11000001 111 ....0 0 .. 101 ....0 01 ...    @azz_2x2_o3
+SDOT_nn_2h      11000001 111 ...01 0 .. 101 ...00 01 ...    @azz_4x4_o3
+
+UDOT_nn_4b      11000001 101 ....0 0 .. 101 ....0 10 ...    @azz_2x2_o3
+UDOT_nn_4b      11000001 101 ...01 0 .. 101 ...00 10 ...    @azz_4x4_o3
+UDOT_nn_4h      11000001 111 ....0 0 .. 101 ....0 10 ...    @azz_2x2_o3
+UDOT_nn_4h      11000001 111 ...01 0 .. 101 ...00 10 ...    @azz_4x4_o3
+UDOT_nn_2h      11000001 111 ....0 0 .. 101 ....0 11 ...    @azz_2x2_o3
+UDOT_nn_2h      11000001 111 ...01 0 .. 101 ...00 11 ...    @azz_4x4_o3
+
 ### SME2 Multi-vector Indexed
 
 &azx_n          n off rv zn zm idx
@@ -367,7 +404,11 @@ BFMLSL_nx       11000001 1001 .... 1 .. 1 .. ...00 11 ...   @azx_4x1_o2x2
 @azx_2x1_i2_o3  ........ .... zm:4 . .. . idx:2 .... ... off:3 \
                 &azx_n n=2 rv=%mova_rv zn=%zn_ax2
 @azx_4x1_i2_o3  ........ .... zm:4 . .. . idx:2 .... ... off:3 \
-                &azx_n n=2 rv=%mova_rv zn=%zn_ax4
+                &azx_n n=4 rv=%mova_rv zn=%zn_ax4
+@azx_2x1_i1_o3  ........ .... zm:4 . .. .. idx:1 .... ... off:3 \
+                &azx_n n=2 rv=%mova_rv zn=%zn_ax2
+@azx_4x1_i1_o3  ........ .... zm:4 . .. .. idx:1 .... ... off:3 \
+                &azx_n n=4 rv=%mova_rv zn=%zn_ax4
 
 FDOT_nx         11000001 0101 .... 0 .. 1 .. ....0 01 ...   @azx_2x1_i2_o3
 FDOT_nx         11000001 0101 .... 1 .. 1 .. ...00 01 ...   @azx_4x1_i2_o3
@@ -377,3 +418,23 @@ BFDOT_nx        11000001 0101 .... 1 .. 1 .. ...00 11 ...   @azx_4x1_i2_o3
 
 FVDOT           11000001 0101 .... 0 .. 0 .. ....0 01 ...   @azx_2x1_i2_o3
 BFVDOT          11000001 0101 .... 0 .. 0 .. ....0 11 ...   @azx_2x1_i2_o3
+
+SDOT_nx_2h      11000001 0101 .... 0 .. 1 .. ....0 00 ...   @azx_2x1_i2_o3
+SDOT_nx_2h      11000001 0101 .... 1 .. 1 .. ...00 00 ...   @azx_4x1_i2_o3
+SDOT_nx_4b      11000001 0101 .... 0 .. 1 .. ....1 00 ...   @azx_2x1_i2_o3
+SDOT_nx_4b      11000001 0101 .... 1 .. 1 .. ...01 00 ...   @azx_4x1_i2_o3
+SDOT_nx_4h      11000001 1101 .... 0 .. 00 . ....0 01 ...   @azx_2x1_i1_o3
+SDOT_nx_4h      11000001 1101 .... 1 .. 00 . ...00 01 ...   @azx_4x1_i1_o3
+
+UDOT_nx_2h      11000001 0101 .... 0 .. 1 .. ....0 10 ...   @azx_2x1_i2_o3
+UDOT_nx_2h      11000001 0101 .... 1 .. 1 .. ...00 10 ...   @azx_4x1_i2_o3
+UDOT_nx_4b      11000001 0101 .... 0 .. 1 .. ....1 10 ...   @azx_2x1_i2_o3
+UDOT_nx_4b      11000001 0101 .... 1 .. 1 .. ...01 10 ...   @azx_4x1_i2_o3
+UDOT_nx_4h      11000001 1101 .... 0 .. 00 . ....0 11 ...   @azx_2x1_i1_o3
+UDOT_nx_4h      11000001 1101 .... 1 .. 00 . ...00 11 ...   @azx_4x1_i1_o3
+
+USDOT_nx        11000001 0101 .... 0 .. 1 .. ....1 01 ...   @azx_2x1_i2_o3
+USDOT_nx        11000001 0101 .... 1 .. 1 .. ...01 01 ...   @azx_4x1_i2_o3
+
+SUDOT_nx        11000001 0101 .... 0 .. 1 .. ....1 11 ...   @azx_2x1_i2_o3
+SUDOT_nx        11000001 0101 .... 1 .. 1 .. ...01 11 ...   @azx_4x1_i2_o3
diff --git a/target/arm/tcg/translate-sme.c b/target/arm/tcg/translate-sme.c
index 410a8d037c..341f4495e9 100644
--- a/target/arm/tcg/translate-sme.c
+++ b/target/arm/tcg/translate-sme.c
@@ -962,3 +962,88 @@ static bool do_vdot(DisasContext *s, arg_azx_n *a, gen_helper_gvec_4_ptr *fn)
 
 TRANS_FEAT(FVDOT, aa64_sme, do_vdot, a, gen_helper_sme2_fvdot_idx_h)
 TRANS_FEAT(BFVDOT, aa64_sme, do_vdot, a, gen_helper_sme2_bfvdot_idx)
+
+/*
+ * Expand array multi-vector single (n1), array multi-vector (nn),
+ * and array multi-vector indexed (nx), for integer accumulate.
+ *   multi: true for nn, false for n1.
+ *   data: stuff for simd_data, including any index.
+ */
+static bool do_azz_acc(DisasContext *s, int nreg, int nsel,
+                       int rv, int off, int zn, int zm,
+                       int data, int shsel, bool multi,
+                       gen_helper_gvec_4 *fn)
+{
+    if (sme_smza_enabled_check(s)) {
+        int svl = streaming_vec_reg_size(s);
+        int vstride = svl / nreg;
+        TCGv_ptr t_za = get_zarray(s, rv, off, nreg, nsel);
+        TCGv_ptr t = tcg_temp_new_ptr();
+
+        for (int r = 0; r < nreg; ++r) {
+            TCGv_ptr t_zn = vec_full_reg_ptr(s, zn);
+            TCGv_ptr t_zm = vec_full_reg_ptr(s, zm);
+
+            for (int i = 0; i < nsel; ++i) {
+                int o_za = (r * vstride + i) * sizeof(ARMVectorReg);
+                int desc = simd_desc(svl, svl, data | (i << shsel));
+
+                tcg_gen_addi_ptr(t, t_za, o_za);
+                fn(t, t_zn, t_zm, t, tcg_constant_i32(desc));
+            }
+
+            /*
+             * For multiple-and-single vectors, Zn may wrap.
+             * For multiple vectors, both Zn and Zm are aligned.
+             */
+            zn = (zn + 1) % 32;
+            zm += multi;
+        }
+    }
+    return true;
+}
+
+static bool do_dot(DisasContext *s, arg_azz_n *a, bool multi,
+                   gen_helper_gvec_4 *fn)
+{
+    return do_azz_acc(s, a->n, 1, a->rv, a->off, a->zn, a->zm,
+                      0, 0, multi, fn);
+}
+
+static void gen_helper_gvec_sudot_4b(TCGv_ptr d, TCGv_ptr n, TCGv_ptr m,
+                                     TCGv_ptr a, TCGv_i32 desc)
+{
+    gen_helper_gvec_usdot_4b(d, m, n, a, desc);
+}
+
+TRANS_FEAT(USDOT_n1, aa64_sme2, do_dot, a, false, gen_helper_gvec_usdot_4b)
+TRANS_FEAT(SUDOT_n1, aa64_sme2, do_dot, a, false, gen_helper_gvec_sudot_4b)
+TRANS_FEAT(SDOT_n1_2h, aa64_sme2, do_dot, a, false, gen_helper_gvec_sdot_2h)
+TRANS_FEAT(UDOT_n1_2h, aa64_sme2, do_dot, a, false, gen_helper_gvec_udot_2h)
+TRANS_FEAT(SDOT_n1_4b, aa64_sme2, do_dot, a, false, gen_helper_gvec_sdot_4b)
+TRANS_FEAT(UDOT_n1_4b, aa64_sme2, do_dot, a, false, gen_helper_gvec_udot_4b)
+TRANS_FEAT(SDOT_n1_4h, aa64_sme2_i16i64, do_dot, a, false, gen_helper_gvec_sdot_4h)
+TRANS_FEAT(UDOT_n1_4h, aa64_sme2_i16i64, do_dot, a, false, gen_helper_gvec_udot_4h)
+
+TRANS_FEAT(USDOT_nn, aa64_sme2, do_dot, a, true, gen_helper_gvec_usdot_4b)
+TRANS_FEAT(SDOT_nn_2h, aa64_sme2, do_dot, a, true, gen_helper_gvec_sdot_2h)
+TRANS_FEAT(UDOT_nn_2h, aa64_sme2, do_dot, a, true, gen_helper_gvec_udot_2h)
+TRANS_FEAT(SDOT_nn_4b, aa64_sme2, do_dot, a, true, gen_helper_gvec_sdot_4b)
+TRANS_FEAT(UDOT_nn_4b, aa64_sme2, do_dot, a, true, gen_helper_gvec_udot_4b)
+TRANS_FEAT(SDOT_nn_4h, aa64_sme2_i16i64, do_dot, a, true, gen_helper_gvec_sdot_4h)
+TRANS_FEAT(UDOT_nn_4h, aa64_sme2_i16i64, do_dot, a, true, gen_helper_gvec_udot_4h)
+
+static bool do_dot_nx(DisasContext *s, arg_azx_n *a, gen_helper_gvec_4 *fn)
+{
+    return do_azz_acc(s, a->n, 1, a->rv, a->off, a->zn, a->zm,
+                      a->idx, 0, false, fn);
+}
+
+TRANS_FEAT(USDOT_nx, aa64_sme2, do_dot_nx, a, gen_helper_gvec_usdot_idx_4b)
+TRANS_FEAT(SUDOT_nx, aa64_sme2, do_dot_nx, a, gen_helper_gvec_sudot_idx_4b)
+TRANS_FEAT(SDOT_nx_2h, aa64_sme2, do_dot_nx, a, gen_helper_gvec_sdot_idx_2h)
+TRANS_FEAT(UDOT_nx_2h, aa64_sme2, do_dot_nx, a, gen_helper_gvec_udot_idx_2h)
+TRANS_FEAT(SDOT_nx_4b, aa64_sme2, do_dot_nx, a, gen_helper_gvec_sdot_idx_4b)
+TRANS_FEAT(UDOT_nx_4b, aa64_sme2, do_dot_nx, a, gen_helper_gvec_udot_idx_4b)
+TRANS_FEAT(SDOT_nx_4h, aa64_sme2_i16i64, do_dot_nx, a, gen_helper_gvec_sdot_idx_4h)
+TRANS_FEAT(UDOT_nx_4h, aa64_sme2_i16i64, do_dot_nx, a, gen_helper_gvec_udot_idx_4h)
diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
index f18d1675b5..baea6d8b89 100644
--- a/target/arm/tcg/vec_helper.c
+++ b/target/arm/tcg/vec_helper.c
@@ -872,6 +872,57 @@ DO_DOT_IDX(gvec_usdot_idx_4b, int32_t, uint8_t, int8_t, H4)
 DO_DOT_IDX(gvec_sdot_idx_4h, int64_t, int16_t, int16_t, H8)
 DO_DOT_IDX(gvec_udot_idx_4h, uint64_t, uint16_t, uint16_t, H8)
 
+#undef DO_DOT
+#undef DO_DOT_IDX
+
+/* Similar for 2-way dot product */
+#define DO_DOT(NAME, TYPED, TYPEN, TYPEM) \
+void HELPER(NAME)(void *vd, void *vn, void *vm, void *va, uint32_t desc)  \
+{                                                                         \
+    intptr_t i, opr_sz = simd_oprsz(desc);                                \
+    TYPED *d = vd, *a = va;                                               \
+    TYPEN *n = vn;                                                        \
+    TYPEM *m = vm;                                                        \
+    for (i = 0; i < opr_sz / sizeof(TYPED); ++i) {                        \
+        d[i] = (a[i] +                                                    \
+                (TYPED)n[i * 2 + 0] * m[i * 2 + 0] +                      \
+                (TYPED)n[i * 2 + 1] * m[i * 2 + 1]);                      \
+    }                                                                     \
+    clear_tail(d, opr_sz, simd_maxsz(desc));                              \
+}
+
+#define DO_DOT_IDX(NAME, TYPED, TYPEN, TYPEM, HD) \
+void HELPER(NAME)(void *vd, void *vn, void *vm, void *va, uint32_t desc)  \
+{                                                                         \
+    intptr_t i = 0, opr_sz = simd_oprsz(desc);                            \
+    intptr_t opr_sz_n = opr_sz / sizeof(TYPED);                           \
+    intptr_t segend = MIN(16 / sizeof(TYPED), opr_sz_n);                  \
+    intptr_t index = simd_data(desc);                                     \
+    TYPED *d = vd, *a = va;                                               \
+    TYPEN *n = vn;                                                        \
+    TYPEM *m_indexed = (TYPEM *)vm + HD(index) * 2;                       \
+    do {                                                                  \
+        TYPED m0 = m_indexed[i * 2 + 0];                                  \
+        TYPED m1 = m_indexed[i * 2 + 1];                                  \
+        do {                                                              \
+            d[i] = (a[i] +                                                \
+                    n[i * 2 + 0] * m0 +                                   \
+                    n[i * 2 + 1] * m1);                                   \
+        } while (++i < segend);                                           \
+        segend = i + (16 / sizeof(TYPED));                                \
+    } while (i < opr_sz_n);                                               \
+    clear_tail(d, opr_sz, simd_maxsz(desc));                              \
+}
+
+DO_DOT(gvec_sdot_2h, int32_t, int16_t, int16_t)
+DO_DOT(gvec_udot_2h, uint32_t, uint16_t, uint16_t)
+
+DO_DOT_IDX(gvec_sdot_idx_2h, int32_t, int16_t, int16_t, H4)
+DO_DOT_IDX(gvec_udot_idx_2h, uint32_t, uint16_t, uint16_t, H4)
+
+#undef DO_DOT
+#undef DO_DOT_IDX
+
 void HELPER(gvec_fcaddh)(void *vd, void *vn, void *vm,
                          float_status *fpst, uint32_t desc)
 {

From a49089cd60667123cfdb949a8bd0b672575d0eb2 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:20:05 -0600
Subject: [PATCH 1989/2760] target/arm: Rename SVE SDOT and UDOT patterns

Emphasize the 4-way nature of these dot products.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-43-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/sve.decode      | 12 ++++++------
 target/arm/tcg/translate-sve.c | 12 ++++++------
 2 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/target/arm/tcg/sve.decode b/target/arm/tcg/sve.decode
index 5970ed9ac4..51847ea56e 100644
--- a/target/arm/tcg/sve.decode
+++ b/target/arm/tcg/sve.decode
@@ -851,10 +851,10 @@ CDOT_zzzz       01000100 esz:2 0 rm:5 0001 rot:2 rn:5 rd:5  ra=%reg_movprfx
 #### SVE Multiply - Indexed
 
 # SVE integer dot product (indexed)
-SDOT_zzxw_s     01000100 10 1 ..... 000000 ..... .....   @rrxr_2 esz=2
-SDOT_zzxw_d     01000100 11 1 ..... 000000 ..... .....   @rrxr_1 esz=3
-UDOT_zzxw_s     01000100 10 1 ..... 000001 ..... .....   @rrxr_2 esz=2
-UDOT_zzxw_d     01000100 11 1 ..... 000001 ..... .....   @rrxr_1 esz=3
+SDOT_zzxw_4s    01000100 10 1 ..... 000000 ..... .....   @rrxr_2 esz=2
+SDOT_zzxw_4d    01000100 11 1 ..... 000000 ..... .....   @rrxr_1 esz=3
+UDOT_zzxw_4s    01000100 10 1 ..... 000001 ..... .....   @rrxr_2 esz=2
+UDOT_zzxw_4d    01000100 11 1 ..... 000001 ..... .....   @rrxr_1 esz=3
 
 # SVE2 integer multiply-add (indexed)
 MLA_zzxz_h      01000100 0. 1 ..... 000010 ..... .....   @rrxr_3 esz=1
@@ -873,8 +873,8 @@ SQRDMLSH_zzxz_s 01000100 10 1 ..... 000101 ..... .....   @rrxr_2 esz=2
 SQRDMLSH_zzxz_d 01000100 11 1 ..... 000101 ..... .....   @rrxr_1 esz=3
 
 # SVE mixed sign dot product (indexed)
-USDOT_zzxw_s    01000100 10 1 ..... 000110 ..... .....   @rrxr_2 esz=2
-SUDOT_zzxw_s    01000100 10 1 ..... 000111 ..... .....   @rrxr_2 esz=2
+USDOT_zzxw_4s   01000100 10 1 ..... 000110 ..... .....   @rrxr_2 esz=2
+SUDOT_zzxw_4s   01000100 10 1 ..... 000111 ..... .....   @rrxr_2 esz=2
 
 # SVE2 saturating multiply-add (indexed)
 SQDMLALB_zzxw_s 01000100 10 1 ..... 0010.0 ..... .....   @rrxr_3a esz=2
diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
index 1564ee2558..56353b3bb4 100644
--- a/target/arm/tcg/translate-sve.c
+++ b/target/arm/tcg/translate-sve.c
@@ -3412,18 +3412,18 @@ TRANS_FEAT(DOT_zzzz, aa64_sve, gen_gvec_ool_zzzz,
  * SVE Multiply - Indexed
  */
 
-TRANS_FEAT(SDOT_zzxw_s, aa64_sve, gen_gvec_ool_arg_zzxz,
+TRANS_FEAT(SDOT_zzxw_4s, aa64_sve, gen_gvec_ool_arg_zzxz,
            gen_helper_gvec_sdot_idx_4b, a)
-TRANS_FEAT(SDOT_zzxw_d, aa64_sve, gen_gvec_ool_arg_zzxz,
+TRANS_FEAT(SDOT_zzxw_4d, aa64_sve, gen_gvec_ool_arg_zzxz,
            gen_helper_gvec_sdot_idx_4h, a)
-TRANS_FEAT(UDOT_zzxw_s, aa64_sve, gen_gvec_ool_arg_zzxz,
+TRANS_FEAT(UDOT_zzxw_4s, aa64_sve, gen_gvec_ool_arg_zzxz,
            gen_helper_gvec_udot_idx_4b, a)
-TRANS_FEAT(UDOT_zzxw_d, aa64_sve, gen_gvec_ool_arg_zzxz,
+TRANS_FEAT(UDOT_zzxw_4d, aa64_sve, gen_gvec_ool_arg_zzxz,
            gen_helper_gvec_udot_idx_4h, a)
 
-TRANS_FEAT(SUDOT_zzxw_s, aa64_sve_i8mm, gen_gvec_ool_arg_zzxz,
+TRANS_FEAT(SUDOT_zzxw_4s, aa64_sve_i8mm, gen_gvec_ool_arg_zzxz,
            gen_helper_gvec_sudot_idx_4b, a)
-TRANS_FEAT(USDOT_zzxw_s, aa64_sve_i8mm, gen_gvec_ool_arg_zzxz,
+TRANS_FEAT(USDOT_zzxw_4s, aa64_sve_i8mm, gen_gvec_ool_arg_zzxz,
            gen_helper_gvec_usdot_idx_4b, a)
 
 #define DO_SVE2_RRX(NAME, FUNC) \

From 050ce4fb6468d485cb906e0315eb8725266f5b0e Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:20:06 -0600
Subject: [PATCH 1990/2760] target/arm: Tighten USDOT (vectors) decode

Rename to USDOT_zzzz_4s and force size=2 during decode.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-44-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/sve.decode      | 2 +-
 target/arm/tcg/translate-sve.c | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/target/arm/tcg/sve.decode b/target/arm/tcg/sve.decode
index 51847ea56e..401c025852 100644
--- a/target/arm/tcg/sve.decode
+++ b/target/arm/tcg/sve.decode
@@ -1599,7 +1599,7 @@ SQRDCMLAH_zzzz  01000100 esz:2 0 rm:5 0011 rot:2 rn:5 rd:5  ra=%reg_movprfx
 
 ## SVE mixed sign dot product
 
-USDOT_zzzz      01000100 .. 0 ..... 011 110 ..... .....  @rda_rn_rm
+USDOT_zzzz_4s   01000100 10 0 ..... 011 110 ..... .....  @rda_rn_rm_ex esz=2
 
 ### SVE2 floating point matrix multiply accumulate
 BFMMLA          01100100 01 1 ..... 111 001 ..... .....  @rda_rn_rm_ex esz=1
diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
index 56353b3bb4..c82a0f771d 100644
--- a/target/arm/tcg/translate-sve.c
+++ b/target/arm/tcg/translate-sve.c
@@ -7151,8 +7151,8 @@ static gen_helper_gvec_4 * const sqrdcmlah_fns[] = {
 TRANS_FEAT(SQRDCMLAH_zzzz, aa64_sve2, gen_gvec_ool_zzzz,
            sqrdcmlah_fns[a->esz], a->rd, a->rn, a->rm, a->ra, a->rot)
 
-TRANS_FEAT(USDOT_zzzz, aa64_sve_i8mm, gen_gvec_ool_arg_zzzz,
-           a->esz == 2 ? gen_helper_gvec_usdot_4b : NULL, a, 0)
+TRANS_FEAT(USDOT_zzzz_4s, aa64_sve_i8mm, gen_gvec_ool_arg_zzzz,
+           gen_helper_gvec_usdot_4b, a, 0)
 
 TRANS_FEAT_NONSTREAMING(AESMC, aa64_sve2_aes, gen_gvec_ool_zz,
                         gen_helper_crypto_aesmc, a->rd, a->rd, 0)

From 26c3bafbf355f8aa8cb9197ccc4136c878c8bbfb Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:20:07 -0600
Subject: [PATCH 1991/2760] target/arm: Implement SDOT, UDOT (2-way) for
 SME2/SVE2p1

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-45-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/sve.decode      |  8 +++++++-
 target/arm/tcg/translate-sve.c | 10 ++++++++++
 2 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/target/arm/tcg/sve.decode b/target/arm/tcg/sve.decode
index 401c025852..83c259def6 100644
--- a/target/arm/tcg/sve.decode
+++ b/target/arm/tcg/sve.decode
@@ -856,6 +856,9 @@ SDOT_zzxw_4d    01000100 11 1 ..... 000000 ..... .....   @rrxr_1 esz=3
 UDOT_zzxw_4s    01000100 10 1 ..... 000001 ..... .....   @rrxr_2 esz=2
 UDOT_zzxw_4d    01000100 11 1 ..... 000001 ..... .....   @rrxr_1 esz=3
 
+SDOT_zzxw_2s    01000100 10 0 ..... 110010 ..... .....   @rrxr_2 esz=2
+UDOT_zzxw_2s    01000100 10 0 ..... 110011 ..... .....   @rrxr_2 esz=2
+
 # SVE2 integer multiply-add (indexed)
 MLA_zzxz_h      01000100 0. 1 ..... 000010 ..... .....   @rrxr_3 esz=1
 MLA_zzxz_s      01000100 10 1 ..... 000010 ..... .....   @rrxr_2 esz=2
@@ -1597,7 +1600,10 @@ UMLSLT_zzzw     01000100 .. 0 ..... 010 111 ..... .....  @rda_rn_rm
 CMLA_zzzz       01000100 esz:2 0 rm:5 0010 rot:2 rn:5 rd:5  ra=%reg_movprfx
 SQRDCMLAH_zzzz  01000100 esz:2 0 rm:5 0011 rot:2 rn:5 rd:5  ra=%reg_movprfx
 
-## SVE mixed sign dot product
+## SVE dot product
+
+SDOT_zzzz_2s    01000100 00 0 ..... 110 010 ..... .....  @rda_rn_rm_ex esz=2
+UDOT_zzzz_2s    01000100 00 0 ..... 110 011 ..... .....  @rda_rn_rm_ex esz=2
 
 USDOT_zzzz_4s   01000100 10 0 ..... 011 110 ..... .....  @rda_rn_rm_ex esz=2
 
diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
index c82a0f771d..10261e25f9 100644
--- a/target/arm/tcg/translate-sve.c
+++ b/target/arm/tcg/translate-sve.c
@@ -3426,6 +3426,11 @@ TRANS_FEAT(SUDOT_zzxw_4s, aa64_sve_i8mm, gen_gvec_ool_arg_zzxz,
 TRANS_FEAT(USDOT_zzxw_4s, aa64_sve_i8mm, gen_gvec_ool_arg_zzxz,
            gen_helper_gvec_usdot_idx_4b, a)
 
+TRANS_FEAT(SDOT_zzxw_2s, aa64_sme2_or_sve2p1, gen_gvec_ool_arg_zzxz,
+           gen_helper_gvec_sdot_idx_2h, a)
+TRANS_FEAT(UDOT_zzxw_2s, aa64_sme2_or_sve2p1, gen_gvec_ool_arg_zzxz,
+           gen_helper_gvec_udot_idx_2h, a)
+
 #define DO_SVE2_RRX(NAME, FUNC) \
     TRANS_FEAT(NAME, aa64_sve, gen_gvec_ool_zzz, FUNC,          \
                a->rd, a->rn, a->rm, a->index)
@@ -7154,6 +7159,11 @@ TRANS_FEAT(SQRDCMLAH_zzzz, aa64_sve2, gen_gvec_ool_zzzz,
 TRANS_FEAT(USDOT_zzzz_4s, aa64_sve_i8mm, gen_gvec_ool_arg_zzzz,
            gen_helper_gvec_usdot_4b, a, 0)
 
+TRANS_FEAT(SDOT_zzzz_2s, aa64_sme2_or_sve2p1, gen_gvec_ool_arg_zzzz,
+           gen_helper_gvec_sdot_2h, a, 0)
+TRANS_FEAT(UDOT_zzzz_2s, aa64_sme2_or_sve2p1, gen_gvec_ool_arg_zzzz,
+           gen_helper_gvec_udot_2h, a, 0)
+
 TRANS_FEAT_NONSTREAMING(AESMC, aa64_sve2_aes, gen_gvec_ool_zz,
                         gen_helper_crypto_aesmc, a->rd, a->rd, 0)
 TRANS_FEAT_NONSTREAMING(AESIMC, aa64_sve2_aes, gen_gvec_ool_zz,

From 279cd4d3123b52764c5e320b0e5a41b6cf7b4510 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:20:08 -0600
Subject: [PATCH 1992/2760] target/arm: Implement SME2 SVDOT, UVDOT, SUVDOT,
 USVDOT

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-46-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/helper-sme.h    | 11 +++++++++
 target/arm/tcg/sme.decode      | 11 +++++++++
 target/arm/tcg/sme_helper.c    | 42 ++++++++++++++++++++++++++++++++++
 target/arm/tcg/translate-sme.c | 23 +++++++++++++++++++
 4 files changed, 87 insertions(+)

diff --git a/target/arm/tcg/helper-sme.h b/target/arm/tcg/helper-sme.h
index 8f5a1b3c90..464877516b 100644
--- a/target/arm/tcg/helper-sme.h
+++ b/target/arm/tcg/helper-sme.h
@@ -180,3 +180,14 @@ DEF_HELPER_FLAGS_6(sme2_fdot_idx_h, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, env, i32)
 DEF_HELPER_FLAGS_6(sme2_fvdot_idx_h, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, env, i32)
+
+DEF_HELPER_FLAGS_4(sme2_svdot_idx_4b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sme2_uvdot_idx_4b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sme2_suvdot_idx_4b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sme2_usvdot_idx_4b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(sme2_svdot_idx_4h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sme2_uvdot_idx_4h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(sme2_svdot_idx_2h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sme2_uvdot_idx_2h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
diff --git a/target/arm/tcg/sme.decode b/target/arm/tcg/sme.decode
index 338637decd..4146744a46 100644
--- a/target/arm/tcg/sme.decode
+++ b/target/arm/tcg/sme.decode
@@ -438,3 +438,14 @@ USDOT_nx        11000001 0101 .... 1 .. 1 .. ...01 01 ...   @azx_4x1_i2_o3
 
 SUDOT_nx        11000001 0101 .... 0 .. 1 .. ....1 11 ...   @azx_2x1_i2_o3
 SUDOT_nx        11000001 0101 .... 1 .. 1 .. ...01 11 ...   @azx_4x1_i2_o3
+
+SVDOT_nx_2h     11000001 0101 .... 0 .. 0 .. ....1 00 ...   @azx_2x1_i2_o3
+SVDOT_nx_4b     11000001 0101 .... 1 .. 0 .. ...01 00 ...   @azx_4x1_i2_o3
+SVDOT_nx_4h     11000001 1101 .... 1 .. 01 . ...00 01 ...   @azx_4x1_i1_o3
+
+UVDOT_nx_2h     11000001 0101 .... 0 .. 0 .. ....1 10 ...   @azx_2x1_i2_o3
+UVDOT_nx_4b     11000001 0101 .... 1 .. 0 .. ...01 10 ...   @azx_4x1_i2_o3
+UVDOT_nx_4h     11000001 1101 .... 1 .. 01 . ...00 11 ...   @azx_4x1_i1_o3
+
+SUVDOT_nx_4b    11000001 0101 .... 1 .. 0 .. ...01 11 ...   @azx_4x1_i2_o3
+USVDOT_nx_4b    11000001 0101 .... 1 .. 0 .. ...01 01 ...   @azx_4x1_i2_o3
diff --git a/target/arm/tcg/sme_helper.c b/target/arm/tcg/sme_helper.c
index 8b45865461..f5242d99be 100644
--- a/target/arm/tcg/sme_helper.c
+++ b/target/arm/tcg/sme_helper.c
@@ -1416,3 +1416,45 @@ DEF_IMOP_16x2_32(umopa2_s, uint16_t, uint16_t)
 
 DEF_IMOPH(sme2, smopa2, s)
 DEF_IMOPH(sme2, umopa2, s)
+
+#define DO_VDOT_IDX(NAME, TYPED, TYPEN, TYPEM, HD, HN) \
+void HELPER(NAME)(void *vd, void *vn, void *vm, uint32_t desc)            \
+{                                                                         \
+    intptr_t svl = simd_oprsz(desc);                                      \
+    intptr_t elements = svl / sizeof(TYPED);                              \
+    intptr_t eltperseg = 16 / sizeof(TYPED);                              \
+    intptr_t nreg = sizeof(TYPED) / sizeof(TYPEN);                        \
+    intptr_t vstride = (svl / nreg) * sizeof(ARMVectorReg);               \
+    intptr_t zstride = sizeof(ARMVectorReg) / sizeof(TYPEN);              \
+    intptr_t idx = extract32(desc, SIMD_DATA_SHIFT, 2);                   \
+    TYPEN *n = vn;                                                        \
+    TYPEM *m = vm;                                                        \
+    for (intptr_t r = 0; r < nreg; r++) {                                 \
+        TYPED *d = vd + r * vstride;                                      \
+        for (intptr_t seg = 0; seg < elements; seg += eltperseg) {        \
+            intptr_t s = seg + idx;                                       \
+            for (intptr_t e = seg; e < seg + eltperseg; e++) {            \
+                TYPED sum = d[HD(e)];                                     \
+                for (intptr_t i = 0; i < nreg; i++) {                     \
+                    TYPED nn = n[i * zstride + HN(nreg * e + r)];         \
+                    TYPED mm = m[HN(nreg * s + i)];                       \
+                    sum += nn * mm;                                       \
+                }                                                         \
+                d[HD(e)] = sum;                                           \
+            }                                                             \
+        }                                                                 \
+    }                                                                     \
+}
+
+DO_VDOT_IDX(sme2_svdot_idx_4b, int32_t, int8_t, int8_t, H4, H1)
+DO_VDOT_IDX(sme2_uvdot_idx_4b, uint32_t, uint8_t, uint8_t, H4, H1)
+DO_VDOT_IDX(sme2_suvdot_idx_4b, int32_t, int8_t, uint8_t, H4, H1)
+DO_VDOT_IDX(sme2_usvdot_idx_4b, int32_t, uint8_t, int8_t, H4, H1)
+
+DO_VDOT_IDX(sme2_svdot_idx_4h, int64_t, int16_t, int16_t, H8, H2)
+DO_VDOT_IDX(sme2_uvdot_idx_4h, uint64_t, uint16_t, uint16_t, H8, H2)
+
+DO_VDOT_IDX(sme2_svdot_idx_2h, int32_t, int16_t, int16_t, H4, H2)
+DO_VDOT_IDX(sme2_uvdot_idx_2h, uint32_t, uint16_t, uint16_t, H4, H2)
+
+#undef DO_VDOT_IDX
diff --git a/target/arm/tcg/translate-sme.c b/target/arm/tcg/translate-sme.c
index 341f4495e9..b88f439ef9 100644
--- a/target/arm/tcg/translate-sme.c
+++ b/target/arm/tcg/translate-sme.c
@@ -1047,3 +1047,26 @@ TRANS_FEAT(SDOT_nx_4b, aa64_sme2, do_dot_nx, a, gen_helper_gvec_sdot_idx_4b)
 TRANS_FEAT(UDOT_nx_4b, aa64_sme2, do_dot_nx, a, gen_helper_gvec_udot_idx_4b)
 TRANS_FEAT(SDOT_nx_4h, aa64_sme2_i16i64, do_dot_nx, a, gen_helper_gvec_sdot_idx_4h)
 TRANS_FEAT(UDOT_nx_4h, aa64_sme2_i16i64, do_dot_nx, a, gen_helper_gvec_udot_idx_4h)
+
+static bool do_vdot_nx(DisasContext *s, arg_azx_n *a, gen_helper_gvec_3 *fn)
+{
+    if (sme_smza_enabled_check(s)) {
+        int svl = streaming_vec_reg_size(s);
+        fn(get_zarray(s, a->rv, a->off, a->n, 0),
+           vec_full_reg_ptr(s, a->zn),
+           vec_full_reg_ptr(s, a->zm),
+           tcg_constant_i32(simd_desc(svl, svl, a->idx)));
+    }
+    return true;
+}
+
+TRANS_FEAT(SVDOT_nx_2h, aa64_sme2, do_vdot_nx, a, gen_helper_sme2_svdot_idx_2h)
+TRANS_FEAT(SVDOT_nx_4b, aa64_sme2, do_vdot_nx, a, gen_helper_sme2_svdot_idx_4b)
+TRANS_FEAT(SVDOT_nx_4h, aa64_sme2, do_vdot_nx, a, gen_helper_sme2_svdot_idx_4h)
+
+TRANS_FEAT(UVDOT_nx_2h, aa64_sme2, do_vdot_nx, a, gen_helper_sme2_uvdot_idx_2h)
+TRANS_FEAT(UVDOT_nx_4b, aa64_sme2, do_vdot_nx, a, gen_helper_sme2_uvdot_idx_4b)
+TRANS_FEAT(UVDOT_nx_4h, aa64_sme2, do_vdot_nx, a, gen_helper_sme2_uvdot_idx_4h)
+
+TRANS_FEAT(SUVDOT_nx_4b, aa64_sme2, do_vdot_nx, a, gen_helper_sme2_suvdot_idx_4b)
+TRANS_FEAT(USVDOT_nx_4b, aa64_sme2, do_vdot_nx, a, gen_helper_sme2_usvdot_idx_4b)

From 0a151896ebba73b1fa75bbfdbf25a2f32e09fa19 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:20:09 -0600
Subject: [PATCH 1993/2760] target/arm: Implement SME2 SMLAL, SMLSL, UMLAL,
 UMLSL

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-47-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/helper-sme.h    |  21 +++++
 target/arm/tcg/sme.decode      | 168 +++++++++++++++++++++++++++++++++
 target/arm/tcg/sme_helper.c    |  59 ++++++++++++
 target/arm/tcg/translate-sme.c |  84 +++++++++++++++++
 4 files changed, 332 insertions(+)

diff --git a/target/arm/tcg/helper-sme.h b/target/arm/tcg/helper-sme.h
index 464877516b..0bb8af194b 100644
--- a/target/arm/tcg/helper-sme.h
+++ b/target/arm/tcg/helper-sme.h
@@ -191,3 +191,24 @@ DEF_HELPER_FLAGS_4(sme2_uvdot_idx_4h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 
 DEF_HELPER_FLAGS_4(sme2_svdot_idx_2h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(sme2_uvdot_idx_2h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_5(sme2_smlall_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(sme2_smlall_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(sme2_smlsll_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(sme2_smlsll_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(sme2_umlall_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(sme2_umlall_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(sme2_umlsll_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(sme2_umlsll_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(sme2_usmlall_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_5(sme2_smlall_idx_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(sme2_smlall_idx_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(sme2_smlsll_idx_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(sme2_smlsll_idx_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(sme2_umlall_idx_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(sme2_umlall_idx_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(sme2_umlsll_idx_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(sme2_umlsll_idx_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(sme2_usmlall_idx_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(sme2_sumlall_idx_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
diff --git a/target/arm/tcg/sme.decode b/target/arm/tcg/sme.decode
index 4146744a46..934e4a802e 100644
--- a/target/arm/tcg/sme.decode
+++ b/target/arm/tcg/sme.decode
@@ -311,6 +311,65 @@ UDOT_n1_4h      11000001 011 1 .... 0 .. 101 ..... 10 ...   @azz_nx1_o3 n=4
 UDOT_n1_2h      11000001 011 0 .... 0 .. 101 ..... 11 ...   @azz_nx1_o3 n=2
 UDOT_n1_2h      11000001 011 1 .... 0 .. 101 ..... 11 ...   @azz_nx1_o3 n=4
 
+SMLAL_n1        11000001 011 0 .... 0 .. 011 ..... 00 ...   @azz_nx1_o3x2 n=1
+SMLAL_n1        11000001 011 0 .... 0 .. 010 ..... 000 ..   @azz_nx1_o2x2 n=2
+SMLAL_n1        11000001 011 1 .... 0 .. 010 ..... 000 ..   @azz_nx1_o2x2 n=4
+
+SMLSL_n1        11000001 011 0 .... 0 .. 011 ..... 01 ...   @azz_nx1_o3x2 n=1
+SMLSL_n1        11000001 011 0 .... 0 .. 010 ..... 010 ..   @azz_nx1_o2x2 n=2
+SMLSL_n1        11000001 011 1 .... 0 .. 010 ..... 010 ..   @azz_nx1_o2x2 n=4
+
+UMLAL_n1        11000001 011 0 .... 0 .. 011 ..... 10 ...   @azz_nx1_o3x2 n=1
+UMLAL_n1        11000001 011 0 .... 0 .. 010 ..... 100 ..   @azz_nx1_o2x2 n=2
+UMLAL_n1        11000001 011 1 .... 0 .. 010 ..... 100 ..   @azz_nx1_o2x2 n=4
+
+UMLSL_n1        11000001 011 0 .... 0 .. 011 ..... 11 ...   @azz_nx1_o3x2 n=1
+UMLSL_n1        11000001 011 0 .... 0 .. 010 ..... 110 ..   @azz_nx1_o2x2 n=2
+UMLSL_n1        11000001 011 1 .... 0 .. 010 ..... 110 ..   @azz_nx1_o2x2 n=4
+
+%off2_x4        0:2 !function=times_4
+%off1_x4        0:1 !function=times_4
+
+@azz_nx1_o2x4   ........ ... . zm:4 . .. ... zn:5 ... ..    \
+                &azz_n off=%off2_x4 rv=%mova_rv
+@azz_nx1_o1x4   ........ ... . zm:4 . .. ... zn:5 .... .    \
+                &azz_n off=%off1_x4 rv=%mova_rv
+
+SMLALL_n1_s     11000001 001 0 .... 0 .. 001 ..... 000 ..   @azz_nx1_o2x4 n=1
+SMLALL_n1_d     11000001 011 0 .... 0 .. 001 ..... 000 ..   @azz_nx1_o2x4 n=1
+SMLALL_n1_s     11000001 001 0 .... 0 .. 000 ..... 0000 .   @azz_nx1_o1x4 n=2
+SMLALL_n1_d     11000001 011 0 .... 0 .. 000 ..... 0000 .   @azz_nx1_o1x4 n=2
+SMLALL_n1_s     11000001 001 1 .... 0 .. 000 ..... 0000 .   @azz_nx1_o1x4 n=4
+SMLALL_n1_d     11000001 011 1 .... 0 .. 000 ..... 0000 .   @azz_nx1_o1x4 n=4
+
+SMLSLL_n1_s     11000001 001 0 .... 0 .. 001 ..... 010 ..   @azz_nx1_o2x4 n=1
+SMLSLL_n1_d     11000001 011 0 .... 0 .. 001 ..... 010 ..   @azz_nx1_o2x4 n=1
+SMLSLL_n1_s     11000001 001 0 .... 0 .. 000 ..... 0100 .   @azz_nx1_o1x4 n=2
+SMLSLL_n1_d     11000001 011 0 .... 0 .. 000 ..... 0100 .   @azz_nx1_o1x4 n=2
+SMLSLL_n1_s     11000001 001 1 .... 0 .. 000 ..... 0100 .   @azz_nx1_o1x4 n=4
+SMLSLL_n1_d     11000001 011 1 .... 0 .. 000 ..... 0100 .   @azz_nx1_o1x4 n=4
+
+UMLALL_n1_s     11000001 001 0 .... 0 .. 001 ..... 100 ..   @azz_nx1_o2x4 n=1
+UMLALL_n1_d     11000001 011 0 .... 0 .. 001 ..... 100 ..   @azz_nx1_o2x4 n=1
+UMLALL_n1_s     11000001 001 0 .... 0 .. 000 ..... 1000 .   @azz_nx1_o1x4 n=2
+UMLALL_n1_d     11000001 011 0 .... 0 .. 000 ..... 1000 .   @azz_nx1_o1x4 n=2
+UMLALL_n1_s     11000001 001 1 .... 0 .. 000 ..... 1000 .   @azz_nx1_o1x4 n=4
+UMLALL_n1_d     11000001 011 1 .... 0 .. 000 ..... 1000 .   @azz_nx1_o1x4 n=4
+
+UMLSLL_n1_s     11000001 001 0 .... 0 .. 001 ..... 110 ..   @azz_nx1_o2x4 n=1
+UMLSLL_n1_d     11000001 011 0 .... 0 .. 001 ..... 110 ..   @azz_nx1_o2x4 n=1
+UMLSLL_n1_s     11000001 001 0 .... 0 .. 000 ..... 1100 .   @azz_nx1_o1x4 n=2
+UMLSLL_n1_d     11000001 011 0 .... 0 .. 000 ..... 1100 .   @azz_nx1_o1x4 n=2
+UMLSLL_n1_s     11000001 001 1 .... 0 .. 000 ..... 1100 .   @azz_nx1_o1x4 n=4
+UMLSLL_n1_d     11000001 011 1 .... 0 .. 000 ..... 1100 .   @azz_nx1_o1x4 n=4
+
+USMLALL_n1_s    11000001 001 0 .... 0 .. 001 ..... 001 ..   @azz_nx1_o2x4 n=1
+USMLALL_n1_s    11000001 001 0 .... 0 .. 000 ..... 0010 .   @azz_nx1_o1x4 n=2
+USMLALL_n1_s    11000001 001 1 .... 0 .. 000 ..... 0010 .   @azz_nx1_o1x4 n=4
+
+SUMLALL_n1_s    11000001 001 0 .... 0 .. 000 ..... 1010 .   @azz_nx1_o1x4 n=2
+SUMLALL_n1_s    11000001 001 1 .... 0 .. 000 ..... 1010 .   @azz_nx1_o1x4 n=4
+
 ### SME2 Multi-vector Multiple Array Vectors
 
 %zn_ax2         6:4 !function=times_2
@@ -371,6 +430,46 @@ UDOT_nn_4h      11000001 111 ...01 0 .. 101 ...00 10 ...    @azz_4x4_o3
 UDOT_nn_2h      11000001 111 ....0 0 .. 101 ....0 11 ...    @azz_2x2_o3
 UDOT_nn_2h      11000001 111 ...01 0 .. 101 ...00 11 ...    @azz_4x4_o3
 
+SMLAL_nn        11000001 111 ....0 0 .. 010 ....0 000 ..    @azz_2x2_o2x2
+SMLAL_nn        11000001 111 ...01 0 .. 010 ...00 000 ..    @azz_4x4_o2x2
+
+SMLSL_nn        11000001 111 ....0 0 .. 010 ....0 010 ..    @azz_2x2_o2x2
+SMLSL_nn        11000001 111 ...01 0 .. 010 ...00 010 ..    @azz_4x4_o2x2
+
+UMLAL_nn        11000001 111 ....0 0 .. 010 ....0 100 ..    @azz_2x2_o2x2
+UMLAL_nn        11000001 111 ...01 0 .. 010 ...00 100 ..    @azz_4x4_o2x2
+
+UMLSL_nn        11000001 111 ....0 0 .. 010 ....0 110 ..    @azz_2x2_o2x2
+UMLSL_nn        11000001 111 ...01 0 .. 010 ...00 110 ..    @azz_4x4_o2x2
+
+@azz_2x2_o1x4   ........ ... ..... . .. ... ..... ... ..    \
+                &azz_n n=2 rv=%mova_rv zn=%zn_ax2 zm=%zm_ax2 off=%off1_x4
+@azz_4x4_o1x4   ........ ... ..... . .. ... ..... ... ..    \
+                &azz_n n=4 rv=%mova_rv zn=%zn_ax4 zm=%zm_ax4 off=%off1_x4
+
+SMLALL_nn_s     11000001 101 ....0 0 .. 000 ....0 0000 .    @azz_2x2_o1x4
+SMLALL_nn_d     11000001 111 ....0 0 .. 000 ....0 0000 .    @azz_2x2_o1x4
+SMLALL_nn_s     11000001 101 ...01 0 .. 000 ...00 0000 .    @azz_4x4_o1x4
+SMLALL_nn_d     11000001 111 ...01 0 .. 000 ...00 0000 .    @azz_4x4_o1x4
+
+SMLSLL_nn_s     11000001 101 ....0 0 .. 000 ....0 0100 .    @azz_2x2_o1x4
+SMLSLL_nn_d     11000001 111 ....0 0 .. 000 ....0 0100 .    @azz_2x2_o1x4
+SMLSLL_nn_s     11000001 101 ...01 0 .. 000 ...00 0100 .    @azz_4x4_o1x4
+SMLSLL_nn_d     11000001 111 ...01 0 .. 000 ...00 0100 .    @azz_4x4_o1x4
+
+UMLALL_nn_s     11000001 101 ....0 0 .. 000 ....0 1000 .    @azz_2x2_o1x4
+UMLALL_nn_d     11000001 111 ....0 0 .. 000 ....0 1000 .    @azz_2x2_o1x4
+UMLALL_nn_s     11000001 101 ...01 0 .. 000 ...00 1000 .    @azz_4x4_o1x4
+UMLALL_nn_d     11000001 111 ...01 0 .. 000 ...00 1000 .    @azz_4x4_o1x4
+
+UMLSLL_nn_s     11000001 101 ....0 0 .. 000 ....0 1100 .    @azz_2x2_o1x4
+UMLSLL_nn_d     11000001 111 ....0 0 .. 000 ....0 1100 .    @azz_2x2_o1x4
+UMLSLL_nn_s     11000001 101 ...01 0 .. 000 ...00 1100 .    @azz_4x4_o1x4
+UMLSLL_nn_d     11000001 111 ...01 0 .. 000 ...00 1100 .    @azz_4x4_o1x4
+
+USMLALL_nn_s    11000001 101 ....0 0 .. 000 ....0 0010 .    @azz_2x2_o1x4
+USMLALL_nn_s    11000001 101 ...01 0 .. 000 ...00 0010 .    @azz_4x4_o1x4
+
 ### SME2 Multi-vector Indexed
 
 &azx_n          n off rv zn zm idx
@@ -449,3 +548,72 @@ UVDOT_nx_4h     11000001 1101 .... 1 .. 01 . ...00 11 ...   @azx_4x1_i1_o3
 
 SUVDOT_nx_4b    11000001 0101 .... 1 .. 0 .. ...01 11 ...   @azx_4x1_i2_o3
 USVDOT_nx_4b    11000001 0101 .... 1 .. 0 .. ...01 01 ...   @azx_4x1_i2_o3
+
+SMLAL_nx        11000001 1100 .... . .. 1 .. ..... 00 ...   @azx_1x1_o3x2
+SMLAL_nx        11000001 1101 .... 0 .. 1 .. ....0 00 ...   @azx_2x1_o2x2
+SMLAL_nx        11000001 1101 .... 1 .. 1 .. ...00 00 ...   @azx_4x1_o2x2
+
+SMLSL_nx        11000001 1100 .... . .. 1 .. ..... 01 ...   @azx_1x1_o3x2
+SMLSL_nx        11000001 1101 .... 0 .. 1 .. ....0 01 ...   @azx_2x1_o2x2
+SMLSL_nx        11000001 1101 .... 1 .. 1 .. ...00 01 ...   @azx_4x1_o2x2
+
+UMLAL_nx        11000001 1100 .... . .. 1 .. ..... 10 ...   @azx_1x1_o3x2
+UMLAL_nx        11000001 1101 .... 0 .. 1 .. ....0 10 ...   @azx_2x1_o2x2
+UMLAL_nx        11000001 1101 .... 1 .. 1 .. ...00 10 ...   @azx_4x1_o2x2
+
+UMLSL_nx        11000001 1100 .... . .. 1 .. ..... 11 ...   @azx_1x1_o3x2
+UMLSL_nx        11000001 1101 .... 0 .. 1 .. ....0 11 ...   @azx_2x1_o2x2
+UMLSL_nx        11000001 1101 .... 1 .. 1 .. ...00 11 ...   @azx_4x1_o2x2
+
+%idx4_15_10     15:1 10:3
+%idx4_10_1      10:2 1:2
+%idx3_10_1      10:1 1:2
+
+@azx_1x1_i4_o2  ........ .... zm:4 . .. ... zn:5 ... ..     \
+                &azx_n n=1 rv=%mova_rv off=%off2_x4 idx=%idx4_15_10
+@azx_1x1_i3_o2  ........ .... zm:4 . .. ... zn:5 ... ..     \
+                &azx_n n=1 rv=%mova_rv off=%off2_x4 idx=%idx3_15_10
+@azx_2x1_i4_o1  ........ .... zm:4 . .. ... ..... ... ..     \
+                &azx_n n=2 rv=%mova_rv off=%off1_x4 zn=%zn_ax2 idx=%idx4_10_1
+@azx_2x1_i3_o1  ........ .... zm:4 . .. ... ..... ... ..     \
+                &azx_n n=2 rv=%mova_rv off=%off1_x4 zn=%zn_ax2 idx=%idx3_10_1
+@azx_4x1_i4_o1  ........ .... zm:4 . .. ... ..... ... ..     \
+                &azx_n n=4 rv=%mova_rv off=%off1_x4 zn=%zn_ax4 idx=%idx4_10_1
+@azx_4x1_i3_o1  ........ .... zm:4 . .. ... ..... ... ..     \
+                &azx_n n=4 rv=%mova_rv off=%off1_x4 zn=%zn_ax4 idx=%idx3_10_1
+
+SMLALL_nx_s     11000001 0000 .... . .. ... ..... 000 ..    @azx_1x1_i4_o2
+SMLALL_nx_d     11000001 1000 .... . .. 0.. ..... 000 ..    @azx_1x1_i3_o2
+SMLALL_nx_s     11000001 0001 .... 0 .. 0.. ....0 00 ...    @azx_2x1_i4_o1
+SMLALL_nx_d     11000001 1001 .... 0 .. 00. ....0 00 ...    @azx_2x1_i3_o1
+SMLALL_nx_s     11000001 0001 .... 1 .. 0.. ...00 00 ...    @azx_4x1_i4_o1
+SMLALL_nx_d     11000001 1001 .... 1 .. 00. ...00 00 ...    @azx_4x1_i3_o1
+
+SMLSLL_nx_s     11000001 0000 .... . .. ... ..... 010 ..    @azx_1x1_i4_o2
+SMLSLL_nx_d     11000001 1000 .... . .. 0.. ..... 010 ..    @azx_1x1_i3_o2
+SMLSLL_nx_s     11000001 0001 .... 0 .. 0.. ....0 01 ...    @azx_2x1_i4_o1
+SMLSLL_nx_d     11000001 1001 .... 0 .. 00. ....0 01 ...    @azx_2x1_i3_o1
+SMLSLL_nx_s     11000001 0001 .... 1 .. 0.. ...00 01 ...    @azx_4x1_i4_o1
+SMLSLL_nx_d     11000001 1001 .... 1 .. 00. ...00 01 ...    @azx_4x1_i3_o1
+
+UMLALL_nx_s     11000001 0000 .... . .. ... ..... 100 ..    @azx_1x1_i4_o2
+UMLALL_nx_d     11000001 1000 .... . .. 0.. ..... 100 ..    @azx_1x1_i3_o2
+UMLALL_nx_s     11000001 0001 .... 0 .. 0.. ....0 10 ...    @azx_2x1_i4_o1
+UMLALL_nx_d     11000001 1001 .... 0 .. 00. ....0 10 ...    @azx_2x1_i3_o1
+UMLALL_nx_s     11000001 0001 .... 1 .. 0.. ...00 10 ...    @azx_4x1_i4_o1
+UMLALL_nx_d     11000001 1001 .... 1 .. 00. ...00 10 ...    @azx_4x1_i3_o1
+
+UMLSLL_nx_s     11000001 0000 .... . .. ... ..... 110 ..    @azx_1x1_i4_o2
+UMLSLL_nx_d     11000001 1000 .... . .. 0.. ..... 110 ..    @azx_1x1_i3_o2
+UMLSLL_nx_s     11000001 0001 .... 0 .. 0.. ....0 11 ...    @azx_2x1_i4_o1
+UMLSLL_nx_d     11000001 1001 .... 0 .. 00. ....0 11 ...    @azx_2x1_i3_o1
+UMLSLL_nx_s     11000001 0001 .... 1 .. 0.. ...00 11 ...    @azx_4x1_i4_o1
+UMLSLL_nx_d     11000001 1001 .... 1 .. 00. ...00 11 ...    @azx_4x1_i3_o1
+
+USMLALL_nx_s    11000001 0000 .... . .. ... ..... 001 ..    @azx_1x1_i4_o2
+USMLALL_nx_s    11000001 0001 .... 0 .. 0.. ....1 00 ...    @azx_2x1_i4_o1
+USMLALL_nx_s    11000001 0001 .... 1 .. 0.. ...01 00 ...    @azx_4x1_i4_o1
+
+SUMLALL_nx_s    11000001 0000 .... . .. ... ..... 101 ..    @azx_1x1_i4_o2
+SUMLALL_nx_s    11000001 0001 .... 0 .. 0.. ....1 10 ...    @azx_2x1_i4_o1
+SUMLALL_nx_s    11000001 0001 .... 1 .. 0.. ...01 10 ...    @azx_4x1_i4_o1
diff --git a/target/arm/tcg/sme_helper.c b/target/arm/tcg/sme_helper.c
index f5242d99be..0f79d7cb6e 100644
--- a/target/arm/tcg/sme_helper.c
+++ b/target/arm/tcg/sme_helper.c
@@ -1458,3 +1458,62 @@ DO_VDOT_IDX(sme2_svdot_idx_2h, int32_t, int16_t, int16_t, H4, H2)
 DO_VDOT_IDX(sme2_uvdot_idx_2h, uint32_t, uint16_t, uint16_t, H4, H2)
 
 #undef DO_VDOT_IDX
+
+#define DO_MLALL(NAME, TYPEW, TYPEN, TYPEM, HW, HN, OP) \
+void HELPER(NAME)(void *vd, void *vn, void *vm, void *va, uint32_t desc) \
+{                                                               \
+    intptr_t elements = simd_oprsz(desc) / sizeof(TYPEW);       \
+    intptr_t sel = extract32(desc, SIMD_DATA_SHIFT, 2);         \
+    TYPEW *d = vd, *a = va; TYPEN *n = vn; TYPEM *m = vm;       \
+    for (intptr_t i = 0; i < elements; ++i) {                   \
+        TYPEW nn = n[HN(i * 4 + sel)];                          \
+        TYPEM mm = m[HN(i * 4 + sel)];                          \
+        d[HW(i)] = a[HW(i)] OP (nn * mm);                       \
+    }                                                           \
+}
+
+DO_MLALL(sme2_smlall_s, int32_t, int8_t, int8_t, H4, H1, +)
+DO_MLALL(sme2_smlall_d, int64_t, int16_t, int16_t, H8, H2, +)
+DO_MLALL(sme2_smlsll_s, int32_t, int8_t, int8_t, H4, H1, -)
+DO_MLALL(sme2_smlsll_d, int64_t, int16_t, int16_t, H8, H2, -)
+
+DO_MLALL(sme2_umlall_s, uint32_t, uint8_t, uint8_t, H4, H1, +)
+DO_MLALL(sme2_umlall_d, uint64_t, uint16_t, uint16_t, H8, H2, +)
+DO_MLALL(sme2_umlsll_s, uint32_t, uint8_t, uint8_t, H4, H1, -)
+DO_MLALL(sme2_umlsll_d, uint64_t, uint16_t, uint16_t, H8, H2, -)
+
+DO_MLALL(sme2_usmlall_s, uint32_t, uint8_t, int8_t, H4, H1, +)
+
+#undef DO_MLALL
+
+#define DO_MLALL_IDX(NAME, TYPEW, TYPEN, TYPEM, HW, HN, OP) \
+void HELPER(NAME)(void *vd, void *vn, void *vm, void *va, uint32_t desc) \
+{                                                               \
+    intptr_t elements = simd_oprsz(desc) / sizeof(TYPEW);       \
+    intptr_t eltspersegment = 16 / sizeof(TYPEW);               \
+    intptr_t sel = extract32(desc, SIMD_DATA_SHIFT, 2);         \
+    intptr_t idx = extract32(desc, SIMD_DATA_SHIFT + 2, 4);     \
+    TYPEW *d = vd, *a = va; TYPEN *n = vn; TYPEM *m = vm;       \
+    for (intptr_t i = 0; i < elements; i += eltspersegment) {   \
+        TYPEW mm = m[HN(i * 4 + idx)];                          \
+        for (intptr_t j = 0; j < eltspersegment; ++j) {         \
+            TYPEN nn = n[HN((i + j) * 4 + sel)];                \
+            d[HW(i + j)] = a[HW(i + j)] OP (nn * mm);           \
+        }                                                       \
+    }                                                           \
+}
+
+DO_MLALL_IDX(sme2_smlall_idx_s, int32_t, int8_t, int8_t, H4, H1, +)
+DO_MLALL_IDX(sme2_smlall_idx_d, int64_t, int16_t, int16_t, H8, H2, +)
+DO_MLALL_IDX(sme2_smlsll_idx_s, int32_t, int8_t, int8_t, H4, H1, -)
+DO_MLALL_IDX(sme2_smlsll_idx_d, int64_t, int16_t, int16_t, H8, H2, -)
+
+DO_MLALL_IDX(sme2_umlall_idx_s, uint32_t, uint8_t, uint8_t, H4, H1, +)
+DO_MLALL_IDX(sme2_umlall_idx_d, uint64_t, uint16_t, uint16_t, H8, H2, +)
+DO_MLALL_IDX(sme2_umlsll_idx_s, uint32_t, uint8_t, uint8_t, H4, H1, -)
+DO_MLALL_IDX(sme2_umlsll_idx_d, uint64_t, uint16_t, uint16_t, H8, H2, -)
+
+DO_MLALL_IDX(sme2_usmlall_idx_s, uint32_t, uint8_t, int8_t, H4, H1, +)
+DO_MLALL_IDX(sme2_sumlall_idx_s, uint32_t, int8_t, uint8_t, H4, H1, +)
+
+#undef DO_MLALL_IDX
diff --git a/target/arm/tcg/translate-sme.c b/target/arm/tcg/translate-sme.c
index b88f439ef9..070cebc573 100644
--- a/target/arm/tcg/translate-sme.c
+++ b/target/arm/tcg/translate-sme.c
@@ -1070,3 +1070,87 @@ TRANS_FEAT(UVDOT_nx_4h, aa64_sme2, do_vdot_nx, a, gen_helper_sme2_uvdot_idx_4h)
 
 TRANS_FEAT(SUVDOT_nx_4b, aa64_sme2, do_vdot_nx, a, gen_helper_sme2_suvdot_idx_4b)
 TRANS_FEAT(USVDOT_nx_4b, aa64_sme2, do_vdot_nx, a, gen_helper_sme2_usvdot_idx_4b)
+
+static bool do_smlal(DisasContext *s, arg_azz_n *a, bool multi,
+                     gen_helper_gvec_4 *fn)
+{
+    return do_azz_acc(s, a->n, 2, a->rv, a->off, a->zn, a->zm,
+                      0, 0, multi, fn);
+}
+
+TRANS_FEAT(SMLAL_n1, aa64_sme2, do_smlal, a, false, gen_helper_sve2_smlal_zzzw_s)
+TRANS_FEAT(SMLSL_n1, aa64_sme2, do_smlal, a, false, gen_helper_sve2_smlsl_zzzw_s)
+TRANS_FEAT(UMLAL_n1, aa64_sme2, do_smlal, a, false, gen_helper_sve2_umlal_zzzw_s)
+TRANS_FEAT(UMLSL_n1, aa64_sme2, do_smlal, a, false, gen_helper_sve2_umlsl_zzzw_s)
+
+TRANS_FEAT(SMLAL_nn, aa64_sme2, do_smlal, a, true, gen_helper_sve2_smlal_zzzw_s)
+TRANS_FEAT(SMLSL_nn, aa64_sme2, do_smlal, a, true, gen_helper_sve2_smlsl_zzzw_s)
+TRANS_FEAT(UMLAL_nn, aa64_sme2, do_smlal, a, true, gen_helper_sve2_umlal_zzzw_s)
+TRANS_FEAT(UMLSL_nn, aa64_sme2, do_smlal, a, true, gen_helper_sve2_umlsl_zzzw_s)
+
+static bool do_smlal_nx(DisasContext *s, arg_azx_n *a,
+                         gen_helper_gvec_4 *fn)
+{
+    return do_azz_acc(s, a->n, 2, a->rv, a->off, a->zn, a->zm,
+                      a->idx << 1, 0, false, fn);
+}
+
+TRANS_FEAT(SMLAL_nx, aa64_sme2, do_smlal_nx, a, gen_helper_sve2_smlal_idx_s)
+TRANS_FEAT(SMLSL_nx, aa64_sme2, do_smlal_nx, a, gen_helper_sve2_smlsl_idx_s)
+TRANS_FEAT(UMLAL_nx, aa64_sme2, do_smlal_nx, a, gen_helper_sve2_umlal_idx_s)
+TRANS_FEAT(UMLSL_nx, aa64_sme2, do_smlal_nx, a, gen_helper_sve2_umlsl_idx_s)
+
+static bool do_smlall(DisasContext *s, arg_azz_n *a, bool multi,
+                     gen_helper_gvec_4 *fn)
+{
+    return do_azz_acc(s, a->n, 4, a->rv, a->off, a->zn, a->zm,
+                      0, 0, multi, fn);
+}
+
+static void gen_helper_sme2_sumlall_s(TCGv_ptr d, TCGv_ptr n, TCGv_ptr m,
+                                      TCGv_ptr a, TCGv_i32 desc)
+{
+    gen_helper_sme2_usmlall_s(d, m, n, a, desc);
+}
+
+TRANS_FEAT(SMLALL_n1_s, aa64_sme2, do_smlall, a, false, gen_helper_sme2_smlall_s)
+TRANS_FEAT(SMLSLL_n1_s, aa64_sme2, do_smlall, a, false, gen_helper_sme2_smlsll_s)
+TRANS_FEAT(UMLALL_n1_s, aa64_sme2, do_smlall, a, false, gen_helper_sme2_umlall_s)
+TRANS_FEAT(UMLSLL_n1_s, aa64_sme2, do_smlall, a, false, gen_helper_sme2_umlsll_s)
+TRANS_FEAT(USMLALL_n1_s, aa64_sme2, do_smlall, a, false, gen_helper_sme2_usmlall_s)
+TRANS_FEAT(SUMLALL_n1_s, aa64_sme2, do_smlall, a, false, gen_helper_sme2_sumlall_s)
+
+TRANS_FEAT(SMLALL_n1_d, aa64_sme2_i16i64, do_smlall, a, false, gen_helper_sme2_smlall_d)
+TRANS_FEAT(SMLSLL_n1_d, aa64_sme2_i16i64, do_smlall, a, false, gen_helper_sme2_smlsll_d)
+TRANS_FEAT(UMLALL_n1_d, aa64_sme2_i16i64, do_smlall, a, false, gen_helper_sme2_umlall_d)
+TRANS_FEAT(UMLSLL_n1_d, aa64_sme2_i16i64, do_smlall, a, false, gen_helper_sme2_umlsll_d)
+
+TRANS_FEAT(SMLALL_nn_s, aa64_sme2, do_smlall, a, true, gen_helper_sme2_smlall_s)
+TRANS_FEAT(SMLSLL_nn_s, aa64_sme2, do_smlall, a, true, gen_helper_sme2_smlsll_s)
+TRANS_FEAT(UMLALL_nn_s, aa64_sme2, do_smlall, a, true, gen_helper_sme2_umlall_s)
+TRANS_FEAT(UMLSLL_nn_s, aa64_sme2, do_smlall, a, true, gen_helper_sme2_umlsll_s)
+TRANS_FEAT(USMLALL_nn_s, aa64_sme2, do_smlall, a, true, gen_helper_sme2_usmlall_s)
+
+TRANS_FEAT(SMLALL_nn_d, aa64_sme2_i16i64, do_smlall, a, true, gen_helper_sme2_smlall_d)
+TRANS_FEAT(SMLSLL_nn_d, aa64_sme2_i16i64, do_smlall, a, true, gen_helper_sme2_smlsll_d)
+TRANS_FEAT(UMLALL_nn_d, aa64_sme2_i16i64, do_smlall, a, true, gen_helper_sme2_umlall_d)
+TRANS_FEAT(UMLSLL_nn_d, aa64_sme2_i16i64, do_smlall, a, true, gen_helper_sme2_umlsll_d)
+
+static bool do_smlall_nx(DisasContext *s, arg_azx_n *a,
+                        gen_helper_gvec_4 *fn)
+{
+    return do_azz_acc(s, a->n, 4, a->rv, a->off, a->zn, a->zm,
+                      a->idx << 2, 0, false, fn);
+}
+
+TRANS_FEAT(SMLALL_nx_s, aa64_sme2, do_smlall_nx, a, gen_helper_sme2_smlall_idx_s)
+TRANS_FEAT(SMLSLL_nx_s, aa64_sme2, do_smlall_nx, a, gen_helper_sme2_smlsll_idx_s)
+TRANS_FEAT(UMLALL_nx_s, aa64_sme2, do_smlall_nx, a, gen_helper_sme2_umlall_idx_s)
+TRANS_FEAT(UMLSLL_nx_s, aa64_sme2, do_smlall_nx, a, gen_helper_sme2_umlsll_idx_s)
+TRANS_FEAT(USMLALL_nx_s, aa64_sme2, do_smlall_nx, a, gen_helper_sme2_usmlall_idx_s)
+TRANS_FEAT(SUMLALL_nx_s, aa64_sme2, do_smlall_nx, a, gen_helper_sme2_sumlall_idx_s)
+
+TRANS_FEAT(SMLALL_nx_d, aa64_sme2_i16i64, do_smlall_nx, a, gen_helper_sme2_smlall_idx_d)
+TRANS_FEAT(SMLSLL_nx_d, aa64_sme2_i16i64, do_smlall_nx, a, gen_helper_sme2_smlsll_idx_d)
+TRANS_FEAT(UMLALL_nx_d, aa64_sme2_i16i64, do_smlall_nx, a, gen_helper_sme2_umlall_idx_d)
+TRANS_FEAT(UMLSLL_nx_d, aa64_sme2_i16i64, do_smlall_nx, a, gen_helper_sme2_umlsll_idx_d)

From e0646fc93e40d32462ee2b87be187e088dba8593 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:20:10 -0600
Subject: [PATCH 1994/2760] target/arm: Rename gvec_fml[as]_[hs] with _nf_
 infix

Emphasize the non-fused nature of these multiply-add.
Matches other helpers such as gvec_rsqrts_nf_[hs].

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-48-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/helper.h         | 8 ++++----
 target/arm/tcg/translate-neon.c | 4 ++--
 target/arm/tcg/vec_helper.c     | 8 ++++----
 3 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/target/arm/tcg/helper.h b/target/arm/tcg/helper.h
index c4a208e3ba..b741470b51 100644
--- a/target/arm/tcg/helper.h
+++ b/target/arm/tcg/helper.h
@@ -790,11 +790,11 @@ DEF_HELPER_FLAGS_5(gvec_recps_nf_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst,
 DEF_HELPER_FLAGS_5(gvec_rsqrts_nf_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_5(gvec_rsqrts_nf_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
 
-DEF_HELPER_FLAGS_5(gvec_fmla_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_5(gvec_fmla_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_fmla_nf_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_fmla_nf_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
 
-DEF_HELPER_FLAGS_5(gvec_fmls_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_5(gvec_fmls_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_fmls_nf_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_fmls_nf_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
 
 DEF_HELPER_FLAGS_5(gvec_vfma_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_5(gvec_vfma_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
diff --git a/target/arm/tcg/translate-neon.c b/target/arm/tcg/translate-neon.c
index ea04336797..844d2e29e4 100644
--- a/target/arm/tcg/translate-neon.c
+++ b/target/arm/tcg/translate-neon.c
@@ -1010,8 +1010,8 @@ DO_3S_FP_GVEC(VACGE, gen_helper_gvec_facge_s, gen_helper_gvec_facge_h)
 DO_3S_FP_GVEC(VACGT, gen_helper_gvec_facgt_s, gen_helper_gvec_facgt_h)
 DO_3S_FP_GVEC(VMAX, gen_helper_gvec_fmax_s, gen_helper_gvec_fmax_h)
 DO_3S_FP_GVEC(VMIN, gen_helper_gvec_fmin_s, gen_helper_gvec_fmin_h)
-DO_3S_FP_GVEC(VMLA, gen_helper_gvec_fmla_s, gen_helper_gvec_fmla_h)
-DO_3S_FP_GVEC(VMLS, gen_helper_gvec_fmls_s, gen_helper_gvec_fmls_h)
+DO_3S_FP_GVEC(VMLA, gen_helper_gvec_fmla_nf_s, gen_helper_gvec_fmla_nf_h)
+DO_3S_FP_GVEC(VMLS, gen_helper_gvec_fmls_nf_s, gen_helper_gvec_fmls_nf_h)
 DO_3S_FP_GVEC(VFMA, gen_helper_gvec_vfma_s, gen_helper_gvec_vfma_h)
 DO_3S_FP_GVEC(VFMS, gen_helper_gvec_vfms_s, gen_helper_gvec_vfms_h)
 DO_3S_FP_GVEC(VRECPS, gen_helper_gvec_recps_nf_s, gen_helper_gvec_recps_nf_h)
diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
index baea6d8b89..4b7de5016e 100644
--- a/target/arm/tcg/vec_helper.c
+++ b/target/arm/tcg/vec_helper.c
@@ -1668,11 +1668,11 @@ void HELPER(NAME)(void *vd, void *vn, void *vm,                            \
     clear_tail(d, oprsz, simd_maxsz(desc));                                \
 }
 
-DO_MULADD(gvec_fmla_h, float16_muladd_nf, float16)
-DO_MULADD(gvec_fmla_s, float32_muladd_nf, float32)
+DO_MULADD(gvec_fmla_nf_h, float16_muladd_nf, float16)
+DO_MULADD(gvec_fmla_nf_s, float32_muladd_nf, float32)
 
-DO_MULADD(gvec_fmls_h, float16_mulsub_nf, float16)
-DO_MULADD(gvec_fmls_s, float32_mulsub_nf, float32)
+DO_MULADD(gvec_fmls_nf_h, float16_mulsub_nf, float16)
+DO_MULADD(gvec_fmls_nf_s, float32_mulsub_nf, float32)
 
 DO_MULADD(gvec_vfma_h, float16_muladd_f, float16)
 DO_MULADD(gvec_vfma_s, float32_muladd_f, float32)

From 77a15fa72a0e9b0d5d78da0a482c57edcac67216 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:20:11 -0600
Subject: [PATCH 1995/2760] target/arm: Implement SME2 FMLA, FMLS

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-49-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/sme.decode      | 48 +++++++++++++++++
 target/arm/tcg/translate-sme.c | 95 ++++++++++++++++++++++++++++++++++
 2 files changed, 143 insertions(+)

diff --git a/target/arm/tcg/sme.decode b/target/arm/tcg/sme.decode
index 934e4a802e..962ffae3d6 100644
--- a/target/arm/tcg/sme.decode
+++ b/target/arm/tcg/sme.decode
@@ -370,6 +370,20 @@ USMLALL_n1_s    11000001 001 1 .... 0 .. 000 ..... 0010 .   @azz_nx1_o1x4 n=4
 SUMLALL_n1_s    11000001 001 0 .... 0 .. 000 ..... 1010 .   @azz_nx1_o1x4 n=2
 SUMLALL_n1_s    11000001 001 1 .... 0 .. 000 ..... 1010 .   @azz_nx1_o1x4 n=4
 
+FMLA_n1_h       11000001 001 0 .... 0 .. 111 ..... 00 ...   @azz_nx1_o3 n=2
+FMLA_n1_s       11000001 001 0 .... 0 .. 110 ..... 00 ...   @azz_nx1_o3 n=2
+FMLA_n1_d       11000001 011 0 .... 0 .. 110 ..... 00 ...   @azz_nx1_o3 n=2
+FMLA_n1_h       11000001 001 1 .... 0 .. 111 ..... 00 ...   @azz_nx1_o3 n=4
+FMLA_n1_s       11000001 001 1 .... 0 .. 110 ..... 00 ...   @azz_nx1_o3 n=4
+FMLA_n1_d       11000001 011 1 .... 0 .. 110 ..... 00 ...   @azz_nx1_o3 n=4
+
+FMLS_n1_h       11000001 001 0 .... 0 .. 111 ..... 01 ...   @azz_nx1_o3 n=2
+FMLS_n1_s       11000001 001 0 .... 0 .. 110 ..... 01 ...   @azz_nx1_o3 n=2
+FMLS_n1_d       11000001 011 0 .... 0 .. 110 ..... 01 ...   @azz_nx1_o3 n=2
+FMLS_n1_h       11000001 001 1 .... 0 .. 111 ..... 01 ...   @azz_nx1_o3 n=4
+FMLS_n1_s       11000001 001 1 .... 0 .. 110 ..... 01 ...   @azz_nx1_o3 n=4
+FMLS_n1_d       11000001 011 1 .... 0 .. 110 ..... 01 ...   @azz_nx1_o3 n=4
+
 ### SME2 Multi-vector Multiple Array Vectors
 
 %zn_ax2         6:4 !function=times_2
@@ -470,6 +484,20 @@ UMLSLL_nn_d     11000001 111 ...01 0 .. 000 ...00 1100 .    @azz_4x4_o1x4
 USMLALL_nn_s    11000001 101 ....0 0 .. 000 ....0 0010 .    @azz_2x2_o1x4
 USMLALL_nn_s    11000001 101 ...01 0 .. 000 ...00 0010 .    @azz_4x4_o1x4
 
+FMLA_nn_h       11000001 101 ....0 0 .. 100 ....0 01 ...    @azz_2x2_o3
+FMLA_nn_s       11000001 101 ....0 0 .. 110 ....0 00 ...    @azz_2x2_o3
+FMLA_nn_d       11000001 111 ....0 0 .. 110 ....0 00 ...    @azz_2x2_o3
+FMLA_nn_h       11000001 101 ...01 0 .. 100 ...00 01 ...    @azz_4x4_o3
+FMLA_nn_s       11000001 101 ...01 0 .. 110 ...00 00 ...    @azz_4x4_o3
+FMLA_nn_d       11000001 111 ...01 0 .. 110 ...00 00 ...    @azz_4x4_o3
+
+FMLS_nn_h       11000001 101 ....0 0 .. 100 ....0 11 ...    @azz_2x2_o3
+FMLS_nn_s       11000001 101 ....0 0 .. 110 ....0 01 ...    @azz_2x2_o3
+FMLS_nn_d       11000001 111 ....0 0 .. 110 ....0 01 ...    @azz_2x2_o3
+FMLS_nn_h       11000001 101 ...01 0 .. 100 ...00 11 ...    @azz_4x4_o3
+FMLS_nn_s       11000001 101 ...01 0 .. 110 ...00 01 ...    @azz_4x4_o3
+FMLS_nn_d       11000001 111 ...01 0 .. 110 ...00 01 ...    @azz_4x4_o3
+
 ### SME2 Multi-vector Indexed
 
 &azx_n          n off rv zn zm idx
@@ -617,3 +645,23 @@ USMLALL_nx_s    11000001 0001 .... 1 .. 0.. ...01 00 ...    @azx_4x1_i4_o1
 SUMLALL_nx_s    11000001 0000 .... . .. ... ..... 101 ..    @azx_1x1_i4_o2
 SUMLALL_nx_s    11000001 0001 .... 0 .. 0.. ....1 10 ...    @azx_2x1_i4_o1
 SUMLALL_nx_s    11000001 0001 .... 1 .. 0.. ...01 10 ...    @azx_4x1_i4_o1
+
+%idx3_10_3      10:2 3:1
+@azx_2x1_i3_o3  ........ .... zm:4 . .. ... ..... .. off:3  \
+                &azx_n n=2 rv=%mova_rv zn=%zn_ax2 idx=%idx3_10_3
+@azx_4x1_i3_o3  ........ .... zm:4 . .. ... ..... .. off:3  \
+                &azx_n n=4 rv=%mova_rv zn=%zn_ax4 idx=%idx3_10_3
+
+FMLA_nx_h       11000001 0001 .... 0 .. 1.. ....0 0 ....    @azx_2x1_i3_o3
+FMLA_nx_s       11000001 0101 .... 0 .. 0.. ....0 00 ...    @azx_2x1_i2_o3
+FMLA_nx_d       11000001 1101 .... 0 .. 00. ....0 00 ...    @azx_2x1_i1_o3
+FMLA_nx_h       11000001 0001 .... 1 .. 1.. ...00 0 ....    @azx_4x1_i3_o3
+FMLA_nx_s       11000001 0101 .... 1 .. 0.. ...00 00 ...    @azx_4x1_i2_o3
+FMLA_nx_d       11000001 1101 .... 1 .. 00. ...00 00 ...    @azx_4x1_i1_o3
+
+FMLS_nx_h       11000001 0001 .... 0 .. 1.. ....0 1 ....    @azx_2x1_i3_o3
+FMLS_nx_s       11000001 0101 .... 0 .. 0.. ....0 10 ...    @azx_2x1_i2_o3
+FMLS_nx_d       11000001 1101 .... 0 .. 00. ....0 10 ...    @azx_2x1_i1_o3
+FMLS_nx_h       11000001 0001 .... 1 .. 1.. ...00 1 ....    @azx_4x1_i3_o3
+FMLS_nx_s       11000001 0101 .... 1 .. 0.. ...00 10 ...    @azx_4x1_i2_o3
+FMLS_nx_d       11000001 1101 .... 1 .. 00. ...00 10 ...    @azx_4x1_i1_o3
diff --git a/target/arm/tcg/translate-sme.c b/target/arm/tcg/translate-sme.c
index 070cebc573..5f51369609 100644
--- a/target/arm/tcg/translate-sme.c
+++ b/target/arm/tcg/translate-sme.c
@@ -815,6 +815,47 @@ TRANS_FEAT(SUB_azz_nn_d, aa64_sme2_i16i64, do_azz_nn, a, MO_64, tcg_gen_gvec_sub
  */
 #define FPST_ENV  -1
 
+static bool do_azz_fp(DisasContext *s, int nreg, int nsel,
+                      int rv, int off, int zn, int zm,
+                      int data, int shsel, bool multi, int fpst,
+                      gen_helper_gvec_3_ptr *fn)
+{
+    if (sme_smza_enabled_check(s)) {
+        int svl = streaming_vec_reg_size(s);
+        int vstride = svl / nreg;
+        TCGv_ptr t_za = get_zarray(s, rv, off, nreg, nsel);
+        TCGv_ptr t, ptr;
+
+        if (fpst >= 0) {
+            ptr = fpstatus_ptr(fpst);
+        } else {
+            ptr = tcg_env;
+        }
+        t = tcg_temp_new_ptr();
+
+        for (int r = 0; r < nreg; ++r) {
+            TCGv_ptr t_zn = vec_full_reg_ptr(s, zn);
+            TCGv_ptr t_zm = vec_full_reg_ptr(s, zm);
+
+            for (int i = 0; i < nsel; ++i) {
+                int o_za = (r * vstride + i) * sizeof(ARMVectorReg);
+                int desc = simd_desc(svl, svl, data | (i << shsel));
+
+                tcg_gen_addi_ptr(t, t_za, o_za);
+                fn(t, t_zn, t_zm, ptr, tcg_constant_i32(desc));
+            }
+
+            /*
+             * For multiple-and-single vectors, Zn may wrap.
+             * For multiple vectors, both Zn and Zm are aligned.
+             */
+            zn = (zn + 1) % 32;
+            zm += multi;
+        }
+    }
+    return true;
+}
+
 static bool do_azz_acc_fp(DisasContext *s, int nreg, int nsel,
                           int rv, int off, int zn, int zm,
                           int data, int shsel, bool multi, int fpst,
@@ -963,6 +1004,60 @@ static bool do_vdot(DisasContext *s, arg_azx_n *a, gen_helper_gvec_4_ptr *fn)
 TRANS_FEAT(FVDOT, aa64_sme, do_vdot, a, gen_helper_sme2_fvdot_idx_h)
 TRANS_FEAT(BFVDOT, aa64_sme, do_vdot, a, gen_helper_sme2_bfvdot_idx)
 
+static bool do_fmla(DisasContext *s, arg_azz_n *a, bool multi,
+                    ARMFPStatusFlavour fpst, gen_helper_gvec_3_ptr *fn)
+{
+    return do_azz_fp(s, a->n, 1, a->rv, a->off, a->zn, a->zm,
+                     0, 0, multi, fpst, fn);
+}
+
+TRANS_FEAT(FMLA_n1_h, aa64_sme_f16f16, do_fmla, a, false, FPST_ZA_F16,
+           gen_helper_gvec_vfma_h)
+TRANS_FEAT(FMLS_n1_h, aa64_sme_f16f16, do_fmla, a, false, FPST_ZA_F16,
+           s->fpcr_ah ? gen_helper_gvec_ah_vfms_h : gen_helper_gvec_vfms_h)
+TRANS_FEAT(FMLA_nn_h, aa64_sme_f16f16, do_fmla, a, true, FPST_ZA_F16,
+           gen_helper_gvec_vfma_h)
+TRANS_FEAT(FMLS_nn_h, aa64_sme_f16f16, do_fmla, a, true, FPST_ZA_F16,
+           s->fpcr_ah ? gen_helper_gvec_ah_vfms_h : gen_helper_gvec_vfms_h)
+
+TRANS_FEAT(FMLA_n1_s, aa64_sme2, do_fmla, a, false, FPST_ZA,
+           gen_helper_gvec_vfma_s)
+TRANS_FEAT(FMLS_n1_s, aa64_sme2, do_fmla, a, false, FPST_ZA,
+           s->fpcr_ah ? gen_helper_gvec_ah_vfms_s : gen_helper_gvec_vfms_s)
+TRANS_FEAT(FMLA_nn_s, aa64_sme2, do_fmla, a, true, FPST_ZA,
+           gen_helper_gvec_vfma_s)
+TRANS_FEAT(FMLS_nn_s, aa64_sme2, do_fmla, a, true, FPST_ZA,
+           s->fpcr_ah ? gen_helper_gvec_ah_vfms_s : gen_helper_gvec_vfms_s)
+
+TRANS_FEAT(FMLA_n1_d, aa64_sme2_f64f64, do_fmla, a, false, FPST_ZA,
+           gen_helper_gvec_vfma_d)
+TRANS_FEAT(FMLS_n1_d, aa64_sme2_f64f64, do_fmla, a, false, FPST_ZA,
+           s->fpcr_ah ? gen_helper_gvec_ah_vfms_d : gen_helper_gvec_vfms_d)
+TRANS_FEAT(FMLA_nn_d, aa64_sme2_f64f64, do_fmla, a, true, FPST_ZA,
+           gen_helper_gvec_vfma_d)
+TRANS_FEAT(FMLS_nn_d, aa64_sme2_f64f64, do_fmla, a, true, FPST_ZA,
+           s->fpcr_ah ? gen_helper_gvec_ah_vfms_d : gen_helper_gvec_vfms_d)
+
+static bool do_fmla_nx(DisasContext *s, arg_azx_n *a,
+                       ARMFPStatusFlavour fpst, gen_helper_gvec_4_ptr *fn)
+{
+    return do_azz_acc_fp(s, a->n, 1, a->rv, a->off, a->zn, a->zm,
+                         a->idx, 0, false, fpst, fn);
+}
+
+TRANS_FEAT(FMLA_nx_h, aa64_sme_f16f16, do_fmla_nx, a, FPST_ZA_F16,
+           gen_helper_gvec_fmla_idx_h)
+TRANS_FEAT(FMLS_nx_h, aa64_sme_f16f16, do_fmla_nx, a, FPST_ZA_F16,
+           s->fpcr_ah ? gen_helper_gvec_ah_fmls_idx_h : gen_helper_gvec_fmls_idx_h)
+TRANS_FEAT(FMLA_nx_s, aa64_sme2, do_fmla_nx, a, FPST_ZA,
+           gen_helper_gvec_fmla_idx_s)
+TRANS_FEAT(FMLS_nx_s, aa64_sme2, do_fmla_nx, a, FPST_ZA,
+           s->fpcr_ah ? gen_helper_gvec_ah_fmls_idx_s : gen_helper_gvec_fmls_idx_s)
+TRANS_FEAT(FMLA_nx_d, aa64_sme2_f64f64, do_fmla_nx, a, FPST_ZA,
+           gen_helper_gvec_fmla_idx_d)
+TRANS_FEAT(FMLS_nx_d, aa64_sme2_f64f64, do_fmla_nx, a, FPST_ZA,
+           s->fpcr_ah ? gen_helper_gvec_ah_fmls_idx_d : gen_helper_gvec_fmls_idx_d)
+
 /*
  * Expand array multi-vector single (n1), array multi-vector (nn),
  * and array multi-vector indexed (nx), for integer accumulate.

From 57ef00819ef46188f803e4f59382044c75073d34 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:20:12 -0600
Subject: [PATCH 1996/2760] target/arm: Implement SME2 BFMLA, BFMLS

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-50-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/helper.h        |  9 +++++++++
 target/arm/tcg/sme.decode      | 18 ++++++++++++++++++
 target/arm/tcg/translate-sme.c | 14 ++++++++++++++
 target/arm/tcg/vec_helper.c    | 26 ++++++++++++++++++++++++++
 4 files changed, 67 insertions(+)

diff --git a/target/arm/tcg/helper.h b/target/arm/tcg/helper.h
index b741470b51..37dd384659 100644
--- a/target/arm/tcg/helper.h
+++ b/target/arm/tcg/helper.h
@@ -799,14 +799,17 @@ DEF_HELPER_FLAGS_5(gvec_fmls_nf_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i
 DEF_HELPER_FLAGS_5(gvec_vfma_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_5(gvec_vfma_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_5(gvec_vfma_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_bfmla, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
 
 DEF_HELPER_FLAGS_5(gvec_vfms_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_5(gvec_vfms_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_5(gvec_vfms_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_bfmls, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
 
 DEF_HELPER_FLAGS_5(gvec_ah_vfms_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_5(gvec_ah_vfms_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_5(gvec_ah_vfms_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_ah_bfmls, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
 
 DEF_HELPER_FLAGS_5(gvec_ftsmul_h, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, fpst, i32)
@@ -838,6 +841,8 @@ DEF_HELPER_FLAGS_6(gvec_fmla_idx_s, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_6(gvec_fmla_idx_d, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_6(gvec_bfmla_idx, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, fpst, i32)
 
 DEF_HELPER_FLAGS_6(gvec_fmls_idx_h, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, fpst, i32)
@@ -845,6 +850,8 @@ DEF_HELPER_FLAGS_6(gvec_fmls_idx_s, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_6(gvec_fmls_idx_d, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_6(gvec_bfmls_idx, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, fpst, i32)
 
 DEF_HELPER_FLAGS_6(gvec_ah_fmls_idx_h, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, fpst, i32)
@@ -852,6 +859,8 @@ DEF_HELPER_FLAGS_6(gvec_ah_fmls_idx_s, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_6(gvec_ah_fmls_idx_d, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_6(gvec_ah_bfmls_idx, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, fpst, i32)
 
 DEF_HELPER_FLAGS_5(gvec_uqadd_b, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, i32)
diff --git a/target/arm/tcg/sme.decode b/target/arm/tcg/sme.decode
index 962ffae3d6..b3dd3bffc3 100644
--- a/target/arm/tcg/sme.decode
+++ b/target/arm/tcg/sme.decode
@@ -370,16 +370,22 @@ USMLALL_n1_s    11000001 001 1 .... 0 .. 000 ..... 0010 .   @azz_nx1_o1x4 n=4
 SUMLALL_n1_s    11000001 001 0 .... 0 .. 000 ..... 1010 .   @azz_nx1_o1x4 n=2
 SUMLALL_n1_s    11000001 001 1 .... 0 .. 000 ..... 1010 .   @azz_nx1_o1x4 n=4
 
+BFMLA_n1        11000001 011 0 .... 0 .. 111 ..... 00 ...   @azz_nx1_o3 n=2
 FMLA_n1_h       11000001 001 0 .... 0 .. 111 ..... 00 ...   @azz_nx1_o3 n=2
 FMLA_n1_s       11000001 001 0 .... 0 .. 110 ..... 00 ...   @azz_nx1_o3 n=2
 FMLA_n1_d       11000001 011 0 .... 0 .. 110 ..... 00 ...   @azz_nx1_o3 n=2
+
+BFMLA_n1        11000001 011 1 .... 0 .. 111 ..... 00 ...   @azz_nx1_o3 n=4
 FMLA_n1_h       11000001 001 1 .... 0 .. 111 ..... 00 ...   @azz_nx1_o3 n=4
 FMLA_n1_s       11000001 001 1 .... 0 .. 110 ..... 00 ...   @azz_nx1_o3 n=4
 FMLA_n1_d       11000001 011 1 .... 0 .. 110 ..... 00 ...   @azz_nx1_o3 n=4
 
+BFMLS_n1        11000001 011 0 .... 0 .. 111 ..... 01 ...   @azz_nx1_o3 n=2
 FMLS_n1_h       11000001 001 0 .... 0 .. 111 ..... 01 ...   @azz_nx1_o3 n=2
 FMLS_n1_s       11000001 001 0 .... 0 .. 110 ..... 01 ...   @azz_nx1_o3 n=2
 FMLS_n1_d       11000001 011 0 .... 0 .. 110 ..... 01 ...   @azz_nx1_o3 n=2
+
+BFMLS_n1        11000001 011 1 .... 0 .. 111 ..... 01 ...   @azz_nx1_o3 n=4
 FMLS_n1_h       11000001 001 1 .... 0 .. 111 ..... 01 ...   @azz_nx1_o3 n=4
 FMLS_n1_s       11000001 001 1 .... 0 .. 110 ..... 01 ...   @azz_nx1_o3 n=4
 FMLS_n1_d       11000001 011 1 .... 0 .. 110 ..... 01 ...   @azz_nx1_o3 n=4
@@ -484,16 +490,22 @@ UMLSLL_nn_d     11000001 111 ...01 0 .. 000 ...00 1100 .    @azz_4x4_o1x4
 USMLALL_nn_s    11000001 101 ....0 0 .. 000 ....0 0010 .    @azz_2x2_o1x4
 USMLALL_nn_s    11000001 101 ...01 0 .. 000 ...00 0010 .    @azz_4x4_o1x4
 
+BFMLA_nn        11000001 111 ....0 0 .. 100 ....0 01 ...    @azz_2x2_o3
 FMLA_nn_h       11000001 101 ....0 0 .. 100 ....0 01 ...    @azz_2x2_o3
 FMLA_nn_s       11000001 101 ....0 0 .. 110 ....0 00 ...    @azz_2x2_o3
 FMLA_nn_d       11000001 111 ....0 0 .. 110 ....0 00 ...    @azz_2x2_o3
+
+BFMLA_nn        11000001 111 ...01 0 .. 100 ...00 01 ...    @azz_4x4_o3
 FMLA_nn_h       11000001 101 ...01 0 .. 100 ...00 01 ...    @azz_4x4_o3
 FMLA_nn_s       11000001 101 ...01 0 .. 110 ...00 00 ...    @azz_4x4_o3
 FMLA_nn_d       11000001 111 ...01 0 .. 110 ...00 00 ...    @azz_4x4_o3
 
+BFMLS_nn        11000001 111 ....0 0 .. 100 ....0 11 ...    @azz_2x2_o3
 FMLS_nn_h       11000001 101 ....0 0 .. 100 ....0 11 ...    @azz_2x2_o3
 FMLS_nn_s       11000001 101 ....0 0 .. 110 ....0 01 ...    @azz_2x2_o3
 FMLS_nn_d       11000001 111 ....0 0 .. 110 ....0 01 ...    @azz_2x2_o3
+
+BFMLS_nn        11000001 111 ...01 0 .. 100 ...00 11 ...    @azz_4x4_o3
 FMLS_nn_h       11000001 101 ...01 0 .. 100 ...00 11 ...    @azz_4x4_o3
 FMLS_nn_s       11000001 101 ...01 0 .. 110 ...00 01 ...    @azz_4x4_o3
 FMLS_nn_d       11000001 111 ...01 0 .. 110 ...00 01 ...    @azz_4x4_o3
@@ -652,16 +664,22 @@ SUMLALL_nx_s    11000001 0001 .... 1 .. 0.. ...01 10 ...    @azx_4x1_i4_o1
 @azx_4x1_i3_o3  ........ .... zm:4 . .. ... ..... .. off:3  \
                 &azx_n n=4 rv=%mova_rv zn=%zn_ax4 idx=%idx3_10_3
 
+BFMLA_nx        11000001 0001 .... 0 .. 1.. ....1 0 ....    @azx_2x1_i3_o3
 FMLA_nx_h       11000001 0001 .... 0 .. 1.. ....0 0 ....    @azx_2x1_i3_o3
 FMLA_nx_s       11000001 0101 .... 0 .. 0.. ....0 00 ...    @azx_2x1_i2_o3
 FMLA_nx_d       11000001 1101 .... 0 .. 00. ....0 00 ...    @azx_2x1_i1_o3
+
+BFMLA_nx        11000001 0001 .... 1 .. 1.. ...01 0 ....    @azx_4x1_i3_o3
 FMLA_nx_h       11000001 0001 .... 1 .. 1.. ...00 0 ....    @azx_4x1_i3_o3
 FMLA_nx_s       11000001 0101 .... 1 .. 0.. ...00 00 ...    @azx_4x1_i2_o3
 FMLA_nx_d       11000001 1101 .... 1 .. 00. ...00 00 ...    @azx_4x1_i1_o3
 
+BFMLS_nx        11000001 0001 .... 0 .. 1.. ....1 1 ....    @azx_2x1_i3_o3
 FMLS_nx_h       11000001 0001 .... 0 .. 1.. ....0 1 ....    @azx_2x1_i3_o3
 FMLS_nx_s       11000001 0101 .... 0 .. 0.. ....0 10 ...    @azx_2x1_i2_o3
 FMLS_nx_d       11000001 1101 .... 0 .. 00. ....0 10 ...    @azx_2x1_i1_o3
+
+BFMLS_nx        11000001 0001 .... 1 .. 1.. ...01 1 ....    @azx_4x1_i3_o3
 FMLS_nx_h       11000001 0001 .... 1 .. 1.. ...00 1 ....    @azx_4x1_i3_o3
 FMLS_nx_s       11000001 0101 .... 1 .. 0.. ...00 10 ...    @azx_4x1_i2_o3
 FMLS_nx_d       11000001 1101 .... 1 .. 00. ...00 10 ...    @azx_4x1_i1_o3
diff --git a/target/arm/tcg/translate-sme.c b/target/arm/tcg/translate-sme.c
index 5f51369609..3f9a80248a 100644
--- a/target/arm/tcg/translate-sme.c
+++ b/target/arm/tcg/translate-sme.c
@@ -1038,6 +1038,15 @@ TRANS_FEAT(FMLA_nn_d, aa64_sme2_f64f64, do_fmla, a, true, FPST_ZA,
 TRANS_FEAT(FMLS_nn_d, aa64_sme2_f64f64, do_fmla, a, true, FPST_ZA,
            s->fpcr_ah ? gen_helper_gvec_ah_vfms_d : gen_helper_gvec_vfms_d)
 
+TRANS_FEAT(BFMLA_n1, aa64_sme_b16b16, do_fmla, a, false, FPST_ZA,
+           gen_helper_gvec_bfmla)
+TRANS_FEAT(BFMLS_n1, aa64_sme_b16b16, do_fmla, a, false, FPST_ZA,
+           s->fpcr_ah ? gen_helper_gvec_ah_bfmls : gen_helper_gvec_bfmls)
+TRANS_FEAT(BFMLA_nn, aa64_sme_b16b16, do_fmla, a, true, FPST_ZA,
+           gen_helper_gvec_bfmla)
+TRANS_FEAT(BFMLS_nn, aa64_sme_b16b16, do_fmla, a, true, FPST_ZA,
+           s->fpcr_ah ? gen_helper_gvec_ah_bfmls : gen_helper_gvec_bfmls)
+
 static bool do_fmla_nx(DisasContext *s, arg_azx_n *a,
                        ARMFPStatusFlavour fpst, gen_helper_gvec_4_ptr *fn)
 {
@@ -1058,6 +1067,11 @@ TRANS_FEAT(FMLA_nx_d, aa64_sme2_f64f64, do_fmla_nx, a, FPST_ZA,
 TRANS_FEAT(FMLS_nx_d, aa64_sme2_f64f64, do_fmla_nx, a, FPST_ZA,
            s->fpcr_ah ? gen_helper_gvec_ah_fmls_idx_d : gen_helper_gvec_fmls_idx_d)
 
+TRANS_FEAT(BFMLA_nx, aa64_sme_b16b16, do_fmla_nx, a, FPST_ZA,
+           gen_helper_gvec_bfmla_idx)
+TRANS_FEAT(BFMLS_nx, aa64_sme_b16b16, do_fmla_nx, a, FPST_ZA,
+           s->fpcr_ah ? gen_helper_gvec_ah_bfmls_idx : gen_helper_gvec_bfmls_idx)
+
 /*
  * Expand array multi-vector single (n1), array multi-vector (nn),
  * and array multi-vector indexed (nx), for integer accumulate.
diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
index 4b7de5016e..51bfd767a3 100644
--- a/target/arm/tcg/vec_helper.c
+++ b/target/arm/tcg/vec_helper.c
@@ -1608,6 +1608,12 @@ static float16 float16_muladd_f(float16 dest, float16 op1, float16 op2,
     return float16_muladd(op1, op2, dest, 0, stat);
 }
 
+static bfloat16 bfloat16_muladd_f(bfloat16 dest, bfloat16 op1, bfloat16 op2,
+                                  float_status *stat)
+{
+    return bfloat16_muladd(op1, op2, dest, 0, stat);
+}
+
 static float32 float32_muladd_f(float32 dest, float32 op1, float32 op2,
                                  float_status *stat)
 {
@@ -1626,6 +1632,12 @@ static float16 float16_mulsub_f(float16 dest, float16 op1, float16 op2,
     return float16_muladd(float16_chs(op1), op2, dest, 0, stat);
 }
 
+static bfloat16 bfloat16_mulsub_f(bfloat16 dest, bfloat16 op1, bfloat16 op2,
+                                  float_status *stat)
+{
+    return bfloat16_muladd(bfloat16_chs(op1), op2, dest, 0, stat);
+}
+
 static float32 float32_mulsub_f(float32 dest, float32 op1, float32 op2,
                                  float_status *stat)
 {
@@ -1644,6 +1656,12 @@ static float16 float16_ah_mulsub_f(float16 dest, float16 op1, float16 op2,
     return float16_muladd(op1, op2, dest, float_muladd_negate_product, stat);
 }
 
+static bfloat16 bfloat16_ah_mulsub_f(bfloat16 dest, bfloat16 op1, bfloat16 op2,
+                                     float_status *stat)
+{
+    return bfloat16_muladd(op1, op2, dest, float_muladd_negate_product, stat);
+}
+
 static float32 float32_ah_mulsub_f(float32 dest, float32 op1, float32 op2,
                                  float_status *stat)
 {
@@ -1677,14 +1695,19 @@ DO_MULADD(gvec_fmls_nf_s, float32_mulsub_nf, float32)
 DO_MULADD(gvec_vfma_h, float16_muladd_f, float16)
 DO_MULADD(gvec_vfma_s, float32_muladd_f, float32)
 DO_MULADD(gvec_vfma_d, float64_muladd_f, float64)
+DO_MULADD(gvec_bfmla, bfloat16_muladd_f, bfloat16)
 
 DO_MULADD(gvec_vfms_h, float16_mulsub_f, float16)
 DO_MULADD(gvec_vfms_s, float32_mulsub_f, float32)
 DO_MULADD(gvec_vfms_d, float64_mulsub_f, float64)
+DO_MULADD(gvec_bfmls, bfloat16_mulsub_f, bfloat16)
 
 DO_MULADD(gvec_ah_vfms_h, float16_ah_mulsub_f, float16)
 DO_MULADD(gvec_ah_vfms_s, float32_ah_mulsub_f, float32)
 DO_MULADD(gvec_ah_vfms_d, float64_ah_mulsub_f, float64)
+DO_MULADD(gvec_ah_bfmls, bfloat16_ah_mulsub_f, bfloat16)
+
+#undef DO_MULADD
 
 /* For the indexed ops, SVE applies the index per 128-bit vector segment.
  * For AdvSIMD, there is of course only one such vector segment.
@@ -1803,14 +1826,17 @@ void HELPER(NAME)(void *vd, void *vn, void *vm, void *va,                  \
 DO_FMLA_IDX(gvec_fmla_idx_h, float16, H2, 0, 0)
 DO_FMLA_IDX(gvec_fmla_idx_s, float32, H4, 0, 0)
 DO_FMLA_IDX(gvec_fmla_idx_d, float64, H8, 0, 0)
+DO_FMLA_IDX(gvec_bfmla_idx, bfloat16, H2, 0, 0)
 
 DO_FMLA_IDX(gvec_fmls_idx_h, float16, H2, INT16_MIN, 0)
 DO_FMLA_IDX(gvec_fmls_idx_s, float32, H4, INT32_MIN, 0)
 DO_FMLA_IDX(gvec_fmls_idx_d, float64, H8, INT64_MIN, 0)
+DO_FMLA_IDX(gvec_bfmls_idx, bfloat16, H2, INT16_MIN, 0)
 
 DO_FMLA_IDX(gvec_ah_fmls_idx_h, float16, H2, 0, float_muladd_negate_product)
 DO_FMLA_IDX(gvec_ah_fmls_idx_s, float32, H4, 0, float_muladd_negate_product)
 DO_FMLA_IDX(gvec_ah_fmls_idx_d, float64, H8, 0, float_muladd_negate_product)
+DO_FMLA_IDX(gvec_ah_bfmls_idx, bfloat16, H2, 0, float_muladd_negate_product)
 
 #undef DO_FMLA_IDX
 

From c4f514e2b005038d4bb9edc14b3878632f043458 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:20:13 -0600
Subject: [PATCH 1997/2760] target/arm: Implement SME2 FADD, FSUB, BFADD, BFSUB

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-51-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/helper.h        |  2 ++
 target/arm/tcg/sme.decode      | 25 +++++++++++++++++++
 target/arm/tcg/translate-sme.c | 44 ++++++++++++++++++++++++++++++++++
 target/arm/tcg/vec_helper.c    |  2 ++
 4 files changed, 73 insertions(+)

diff --git a/target/arm/tcg/helper.h b/target/arm/tcg/helper.h
index 37dd384659..392bf7b9b5 100644
--- a/target/arm/tcg/helper.h
+++ b/target/arm/tcg/helper.h
@@ -731,10 +731,12 @@ DEF_HELPER_FLAGS_4(gvec_fclt0_d, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_5(gvec_fadd_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_5(gvec_fadd_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_5(gvec_fadd_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_bfadd, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
 
 DEF_HELPER_FLAGS_5(gvec_fsub_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_5(gvec_fsub_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_5(gvec_fsub_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(gvec_bfsub, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
 
 DEF_HELPER_FLAGS_5(gvec_fmul_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_5(gvec_fmul_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
diff --git a/target/arm/tcg/sme.decode b/target/arm/tcg/sme.decode
index b3dd3bffc3..0badc8f9fa 100644
--- a/target/arm/tcg/sme.decode
+++ b/target/arm/tcg/sme.decode
@@ -510,6 +510,31 @@ FMLS_nn_h       11000001 101 ...01 0 .. 100 ...00 11 ...    @azz_4x4_o3
 FMLS_nn_s       11000001 101 ...01 0 .. 110 ...00 01 ...    @azz_4x4_o3
 FMLS_nn_d       11000001 111 ...01 0 .. 110 ...00 01 ...    @azz_4x4_o3
 
+&az_n           n off rv zm
+@az_2x2_o3      ........ ... ..... . .. ... ..... .. off:3  \
+                &az_n n=2 rv=%mova_rv zm=%zn_ax2
+@az_4x4_o3      ........ ... ..... . .. ... ..... .. off:3  \
+                &az_n n=4 rv=%mova_rv zm=%zn_ax4
+
+FADD_nn_h       11000001 101 00100 0 .. 111 ....0 00 ...    @az_2x2_o3
+FADD_nn_s       11000001 101 00000 0 .. 111 ....0 00 ...    @az_2x2_o3
+FADD_nn_d       11000001 111 00000 0 .. 111 ....0 00 ...    @az_2x2_o3
+FADD_nn_h       11000001 101 00101 0 .. 111 ...00 00 ...    @az_4x4_o3
+FADD_nn_s       11000001 101 00001 0 .. 111 ...00 00 ...    @az_4x4_o3
+FADD_nn_d       11000001 111 00001 0 .. 111 ...00 00 ...    @az_4x4_o3
+
+FSUB_nn_h       11000001 101 00100 0 .. 111 ....0 01 ...    @az_2x2_o3
+FSUB_nn_s       11000001 101 00000 0 .. 111 ....0 01 ...    @az_2x2_o3
+FSUB_nn_d       11000001 111 00000 0 .. 111 ....0 01 ...    @az_2x2_o3
+FSUB_nn_h       11000001 101 00101 0 .. 111 ...00 01 ...    @az_4x4_o3
+FSUB_nn_s       11000001 101 00001 0 .. 111 ...00 01 ...    @az_4x4_o3
+FSUB_nn_d       11000001 111 00001 0 .. 111 ...00 01 ...    @az_4x4_o3
+
+BFADD_nn        11000001 111 00100 0 .. 111 ....0 00 ...    @az_2x2_o3
+BFADD_nn        11000001 111 00101 0 .. 111 ...00 00 ...    @az_4x4_o3
+BFSUB_nn        11000001 111 00100 0 .. 111 ....0 01 ...    @az_2x2_o3
+BFSUB_nn        11000001 111 00101 0 .. 111 ...00 01 ...    @az_4x4_o3
+
 ### SME2 Multi-vector Indexed
 
 &azx_n          n off rv zn zm idx
diff --git a/target/arm/tcg/translate-sme.c b/target/arm/tcg/translate-sme.c
index 3f9a80248a..664fdd86aa 100644
--- a/target/arm/tcg/translate-sme.c
+++ b/target/arm/tcg/translate-sme.c
@@ -1072,6 +1072,50 @@ TRANS_FEAT(BFMLA_nx, aa64_sme_b16b16, do_fmla_nx, a, FPST_ZA,
 TRANS_FEAT(BFMLS_nx, aa64_sme_b16b16, do_fmla_nx, a, FPST_ZA,
            s->fpcr_ah ? gen_helper_gvec_ah_bfmls_idx : gen_helper_gvec_bfmls_idx)
 
+static bool do_faddsub(DisasContext *s, arg_az_n *a, ARMFPStatusFlavour fpst,
+                       gen_helper_gvec_3_ptr *fn)
+{
+    if (sme_smza_enabled_check(s)) {
+        int svl = streaming_vec_reg_size(s);
+        int n = a->n;
+        int zm = a->zm;
+        int vstride = svl / n;
+        TCGv_ptr t_za = get_zarray(s, a->rv, a->off, n, 0);
+        TCGv_ptr ptr = fpstatus_ptr(fpst);
+        TCGv_ptr t = tcg_temp_new_ptr();
+
+        for (int r = 0; r < n; ++r) {
+            TCGv_ptr t_zm = vec_full_reg_ptr(s, zm + r);
+            int o_za = r * vstride * sizeof(ARMVectorReg);
+            int desc = simd_desc(svl, svl, 0);
+
+            tcg_gen_addi_ptr(t, t_za, o_za);
+            fn(t, t, t_zm, ptr, tcg_constant_i32(desc));
+        }
+    }
+    return true;
+}
+
+TRANS_FEAT(FADD_nn_h, aa64_sme_f16f16, do_faddsub, a,
+           FPST_ZA_F16, gen_helper_gvec_fadd_h)
+TRANS_FEAT(FSUB_nn_h, aa64_sme_f16f16, do_faddsub, a,
+           FPST_ZA_F16, gen_helper_gvec_fsub_h)
+
+TRANS_FEAT(FADD_nn_s, aa64_sme2, do_faddsub, a,
+           FPST_ZA, gen_helper_gvec_fadd_s)
+TRANS_FEAT(FSUB_nn_s, aa64_sme2, do_faddsub, a,
+           FPST_ZA, gen_helper_gvec_fsub_s)
+
+TRANS_FEAT(FADD_nn_d, aa64_sme2_f64f64, do_faddsub, a,
+           FPST_ZA, gen_helper_gvec_fadd_d)
+TRANS_FEAT(FSUB_nn_d, aa64_sme2_f64f64, do_faddsub, a,
+           FPST_ZA, gen_helper_gvec_fsub_d)
+
+TRANS_FEAT(BFADD_nn, aa64_sme_b16b16, do_faddsub, a,
+           FPST_ZA, gen_helper_gvec_bfadd)
+TRANS_FEAT(BFSUB_nn, aa64_sme_b16b16, do_faddsub, a,
+           FPST_ZA, gen_helper_gvec_bfsub)
+
 /*
  * Expand array multi-vector single (n1), array multi-vector (nn),
  * and array multi-vector indexed (nx), for integer accumulate.
diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
index 51bfd767a3..d4ee6f4d29 100644
--- a/target/arm/tcg/vec_helper.c
+++ b/target/arm/tcg/vec_helper.c
@@ -1470,10 +1470,12 @@ void HELPER(NAME)(void *vd, void *vn, void *vm,                            \
 DO_3OP(gvec_fadd_h, float16_add, float16)
 DO_3OP(gvec_fadd_s, float32_add, float32)
 DO_3OP(gvec_fadd_d, float64_add, float64)
+DO_3OP(gvec_bfadd, bfloat16_add, bfloat16)
 
 DO_3OP(gvec_fsub_h, float16_sub, float16)
 DO_3OP(gvec_fsub_s, float32_sub, float32)
 DO_3OP(gvec_fsub_d, float64_sub, float64)
+DO_3OP(gvec_bfsub, bfloat16_sub, bfloat16)
 
 DO_3OP(gvec_fmul_h, float16_mul, float16)
 DO_3OP(gvec_fmul_s, float32_mul, float32)

From ccb512d5b504d21ab59c28e3e41757b88779c890 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:20:14 -0600
Subject: [PATCH 1998/2760] target/arm: Implement SME2 ADD/SUB (array
 accumulator)

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-52-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/sme.decode      | 12 ++++++++++++
 target/arm/tcg/translate-sme.c | 28 ++++++++++++++++++++++++++++
 2 files changed, 40 insertions(+)

diff --git a/target/arm/tcg/sme.decode b/target/arm/tcg/sme.decode
index 0badc8f9fa..22e2a68b1b 100644
--- a/target/arm/tcg/sme.decode
+++ b/target/arm/tcg/sme.decode
@@ -708,3 +708,15 @@ BFMLS_nx        11000001 0001 .... 1 .. 1.. ...01 1 ....    @azx_4x1_i3_o3
 FMLS_nx_h       11000001 0001 .... 1 .. 1.. ...00 1 ....    @azx_4x1_i3_o3
 FMLS_nx_s       11000001 0101 .... 1 .. 0.. ...00 10 ...    @azx_4x1_i2_o3
 FMLS_nx_d       11000001 1101 .... 1 .. 00. ...00 10 ...    @azx_4x1_i1_o3
+
+### SME2 Add / Sub array accumulators
+
+ADD_aaz_s       11000001 101 000000 .. 111 ....0 10 ...     @az_2x2_o3
+ADD_aaz_s       11000001 101 000010 .. 111 ...00 10 ...     @az_4x4_o3
+ADD_aaz_d       11000001 111 000000 .. 111 ....0 10 ...     @az_2x2_o3
+ADD_aaz_d       11000001 111 000010 .. 111 ...00 10 ...     @az_4x4_o3
+
+SUB_aaz_s       11000001 101 000000 .. 111 ....0 11 ...     @az_2x2_o3
+SUB_aaz_s       11000001 101 000010 .. 111 ...00 11 ...     @az_4x4_o3
+SUB_aaz_d       11000001 111 000000 .. 111 ....0 11 ...     @az_2x2_o3
+SUB_aaz_d       11000001 111 000010 .. 111 ...00 11 ...     @az_4x4_o3
diff --git a/target/arm/tcg/translate-sme.c b/target/arm/tcg/translate-sme.c
index 664fdd86aa..4c3b9aa7d6 100644
--- a/target/arm/tcg/translate-sme.c
+++ b/target/arm/tcg/translate-sme.c
@@ -806,6 +806,34 @@ TRANS_FEAT(SUB_azz_nn_s, aa64_sme2, do_azz_nn, a, MO_32, tcg_gen_gvec_sub_var)
 TRANS_FEAT(ADD_azz_nn_d, aa64_sme2_i16i64, do_azz_nn, a, MO_64, tcg_gen_gvec_add_var)
 TRANS_FEAT(SUB_azz_nn_d, aa64_sme2_i16i64, do_azz_nn, a, MO_64, tcg_gen_gvec_sub_var)
 
+/* Add/Sub each ZA[d*N] += Z[m*N] */
+static bool do_aaz(DisasContext *s, arg_az_n *a, int esz, GVecGen3FnVar *fn)
+{
+    TCGv_ptr t_za;
+    int svl, n;
+
+    if (!sme_smza_enabled_check(s)) {
+        return true;
+    }
+
+    n = a->n;
+    t_za = get_zarray(s, a->rv, a->off, n, 0);
+    svl = streaming_vec_reg_size(s);
+
+    for (int i = 0; i < n; ++i) {
+        int o_za = (svl / n * sizeof(ARMVectorReg)) * i;
+        int o_zm = vec_full_reg_offset(s, a->zm + i);
+
+        fn(esz, t_za, o_za, t_za, o_za, tcg_env, o_zm, svl, svl);
+    }
+    return true;
+}
+
+TRANS_FEAT(ADD_aaz_s, aa64_sme2, do_aaz, a, MO_32, tcg_gen_gvec_add_var)
+TRANS_FEAT(SUB_aaz_s, aa64_sme2, do_aaz, a, MO_32, tcg_gen_gvec_sub_var)
+TRANS_FEAT(ADD_aaz_d, aa64_sme2_i16i64, do_aaz, a, MO_64, tcg_gen_gvec_add_var)
+TRANS_FEAT(SUB_aaz_d, aa64_sme2_i16i64, do_aaz, a, MO_64, tcg_gen_gvec_sub_var)
+
 /*
  * Expand array multi-vector single (n1), array multi-vector (nn),
  * and array multi-vector indexed (nx), for floating-point accumulate.

From 465d36db0e12cf9eb8a08e3ba1c6b306f356ba52 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:20:15 -0600
Subject: [PATCH 1999/2760] target/arm: Implement SME2 BFCVT, BFCVTN, FCVT,
 FCVTN

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-53-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/helper-sme.h    |  5 +++
 target/arm/tcg/sme.decode      | 12 ++++++
 target/arm/tcg/sme_helper.c    | 74 ++++++++++++++++++++++++++++++++++
 target/arm/tcg/sve_helper.c    |  2 +-
 target/arm/tcg/translate-sme.c | 25 ++++++++++++
 target/arm/tcg/vec_internal.h  |  2 +
 6 files changed, 119 insertions(+), 1 deletion(-)

diff --git a/target/arm/tcg/helper-sme.h b/target/arm/tcg/helper-sme.h
index 0bb8af194b..97e70959e8 100644
--- a/target/arm/tcg/helper-sme.h
+++ b/target/arm/tcg/helper-sme.h
@@ -212,3 +212,8 @@ DEF_HELPER_FLAGS_5(sme2_umlsll_idx_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr,
 DEF_HELPER_FLAGS_5(sme2_umlsll_idx_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_5(sme2_usmlall_idx_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_5(sme2_sumlall_idx_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(sme2_bfcvt, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_4(sme2_bfcvtn, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_4(sme2_fcvt_n, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_4(sme2_fcvtn, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
diff --git a/target/arm/tcg/sme.decode b/target/arm/tcg/sme.decode
index 22e2a68b1b..831179c0ee 100644
--- a/target/arm/tcg/sme.decode
+++ b/target/arm/tcg/sme.decode
@@ -720,3 +720,15 @@ SUB_aaz_s       11000001 101 000000 .. 111 ....0 11 ...     @az_2x2_o3
 SUB_aaz_s       11000001 101 000010 .. 111 ...00 11 ...     @az_4x4_o3
 SUB_aaz_d       11000001 111 000000 .. 111 ....0 11 ...     @az_2x2_o3
 SUB_aaz_d       11000001 111 000010 .. 111 ...00 11 ...     @az_4x4_o3
+
+### SME2 Multi-vector SVE Constructive Unary
+
+&zz_n           zd zn n
+@zz_1x2         ........ ... ..... ...... ..... zd:5        \
+                &zz_n n=1 zn=%zn_ax2
+
+BFCVT           11000001 011 00000 111000 ....0 .....       @zz_1x2
+BFCVTN          11000001 011 00000 111000 ....1 .....       @zz_1x2
+
+FCVT_n          11000001 001 00000 111000 ....0 .....       @zz_1x2
+FCVTN           11000001 001 00000 111000 ....1 .....       @zz_1x2
diff --git a/target/arm/tcg/sme_helper.c b/target/arm/tcg/sme_helper.c
index 0f79d7cb6e..d97afdb69c 100644
--- a/target/arm/tcg/sme_helper.c
+++ b/target/arm/tcg/sme_helper.c
@@ -1517,3 +1517,77 @@ DO_MLALL_IDX(sme2_usmlall_idx_s, uint32_t, uint8_t, int8_t, H4, H1, +)
 DO_MLALL_IDX(sme2_sumlall_idx_s, uint32_t, int8_t, uint8_t, H4, H1, +)
 
 #undef DO_MLALL_IDX
+
+/* Convert and compress */
+void HELPER(sme2_bfcvt)(void *vd, void *vs, float_status *fpst, uint32_t desc)
+{
+    ARMVectorReg scratch;
+    size_t oprsz = simd_oprsz(desc);
+    size_t i, n = oprsz / 4;
+    float32 *s0 = vs;
+    float32 *s1 = vs + sizeof(ARMVectorReg);
+    bfloat16 *d = vd;
+
+    if (vd == s1) {
+        s1 = memcpy(&scratch, s1, oprsz);
+    }
+
+    for (i = 0; i < n; ++i) {
+        d[H2(i)] = float32_to_bfloat16(s0[H4(i)], fpst);
+    }
+    for (i = 0; i < n; ++i) {
+        d[H2(i) + n] = float32_to_bfloat16(s1[H4(i)], fpst);
+    }
+}
+
+void HELPER(sme2_fcvt_n)(void *vd, void *vs, float_status *fpst, uint32_t desc)
+{
+    ARMVectorReg scratch;
+    size_t oprsz = simd_oprsz(desc);
+    size_t i, n = oprsz / 4;
+    float32 *s0 = vs;
+    float32 *s1 = vs + sizeof(ARMVectorReg);
+    float16 *d = vd;
+
+    if (vd == s1) {
+        s1 = memcpy(&scratch, s1, oprsz);
+    }
+
+    for (i = 0; i < n; ++i) {
+        d[H2(i)] = sve_f32_to_f16(s0[H4(i)], fpst);
+    }
+    for (i = 0; i < n; ++i) {
+        d[H2(i) + n] = sve_f32_to_f16(s1[H4(i)], fpst);
+    }
+}
+
+/* Convert and interleave */
+void HELPER(sme2_bfcvtn)(void *vd, void *vs, float_status *fpst, uint32_t desc)
+{
+    size_t i, n = simd_oprsz(desc) / 4;
+    float32 *s0 = vs;
+    float32 *s1 = vs + sizeof(ARMVectorReg);
+    bfloat16 *d = vd;
+
+    for (i = 0; i < n; ++i) {
+        bfloat16 d0 = float32_to_bfloat16(s0[H4(i)], fpst);
+        bfloat16 d1 = float32_to_bfloat16(s1[H4(i)], fpst);
+        d[H2(i * 2 + 0)] = d0;
+        d[H2(i * 2 + 1)] = d1;
+    }
+}
+
+void HELPER(sme2_fcvtn)(void *vd, void *vs, float_status *fpst, uint32_t desc)
+{
+    size_t i, n = simd_oprsz(desc) / 4;
+    float32 *s0 = vs;
+    float32 *s1 = vs + sizeof(ARMVectorReg);
+    bfloat16 *d = vd;
+
+    for (i = 0; i < n; ++i) {
+        bfloat16 d0 = sve_f32_to_f16(s0[H4(i)], fpst);
+        bfloat16 d1 = sve_f32_to_f16(s1[H4(i)], fpst);
+        d[H2(i * 2 + 0)] = d0;
+        d[H2(i * 2 + 1)] = d1;
+    }
+}
diff --git a/target/arm/tcg/sve_helper.c b/target/arm/tcg/sve_helper.c
index a2c363a4e1..b522ddaf7c 100644
--- a/target/arm/tcg/sve_helper.c
+++ b/target/arm/tcg/sve_helper.c
@@ -4576,7 +4576,7 @@ static inline float64 sve_f16_to_f64(float16 f, float_status *fpst)
     return ret;
 }
 
-static inline float16 sve_f32_to_f16(float32 f, float_status *fpst)
+float16 sve_f32_to_f16(float32 f, float_status *fpst)
 {
     bool save = get_flush_to_zero(fpst);
     float16 ret;
diff --git a/target/arm/tcg/translate-sme.c b/target/arm/tcg/translate-sme.c
index 4c3b9aa7d6..10e5b77040 100644
--- a/target/arm/tcg/translate-sme.c
+++ b/target/arm/tcg/translate-sme.c
@@ -1335,3 +1335,28 @@ TRANS_FEAT(SMLALL_nx_d, aa64_sme2_i16i64, do_smlall_nx, a, gen_helper_sme2_smlal
 TRANS_FEAT(SMLSLL_nx_d, aa64_sme2_i16i64, do_smlall_nx, a, gen_helper_sme2_smlsll_idx_d)
 TRANS_FEAT(UMLALL_nx_d, aa64_sme2_i16i64, do_smlall_nx, a, gen_helper_sme2_umlall_idx_d)
 TRANS_FEAT(UMLSLL_nx_d, aa64_sme2_i16i64, do_smlall_nx, a, gen_helper_sme2_umlsll_idx_d)
+
+static bool do_zz_fpst(DisasContext *s, arg_zz_n *a, int data,
+                       ARMFPStatusFlavour type, gen_helper_gvec_2_ptr *fn)
+{
+    if (sme_sm_enabled_check(s)) {
+        int svl = streaming_vec_reg_size(s);
+        TCGv_ptr fpst = fpstatus_ptr(type);
+
+        for (int i = 0, n = a->n; i < n; ++i) {
+            tcg_gen_gvec_2_ptr(vec_full_reg_offset(s, a->zd + i),
+                               vec_full_reg_offset(s, a->zn + i),
+                               fpst, svl, svl, data, fn);
+        }
+    }
+    return true;
+}
+
+TRANS_FEAT(BFCVT, aa64_sme2, do_zz_fpst, a, 0,
+           FPST_A64, gen_helper_sme2_bfcvt)
+TRANS_FEAT(BFCVTN, aa64_sme2, do_zz_fpst, a, 0,
+           FPST_A64, gen_helper_sme2_bfcvtn)
+TRANS_FEAT(FCVT_n, aa64_sme2, do_zz_fpst, a, 0,
+           FPST_A64, gen_helper_sme2_fcvt_n)
+TRANS_FEAT(FCVTN, aa64_sme2, do_zz_fpst, a, 0,
+           FPST_A64, gen_helper_sme2_fcvtn)
diff --git a/target/arm/tcg/vec_internal.h b/target/arm/tcg/vec_internal.h
index 64a7249d01..c8199a3ef8 100644
--- a/target/arm/tcg/vec_internal.h
+++ b/target/arm/tcg/vec_internal.h
@@ -306,4 +306,6 @@ static inline float64 float64_maybe_ah_chs(float64 a, bool fpcr_ah)
 bfloat16 helper_sme2_ah_fmax_b16(bfloat16 a, bfloat16 b, float_status *fpst);
 bfloat16 helper_sme2_ah_fmin_b16(bfloat16 a, bfloat16 b, float_status *fpst);
 
+float16 sve_f32_to_f16(float32 f, float_status *fpst);
+
 #endif /* TARGET_ARM_VEC_INTERNAL_H */

From f73ef7f90f5c99111383f1005c0d7c72d9cb9247 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:20:16 -0600
Subject: [PATCH 2000/2760] target/arm: Implement SME2 FCVT (widening), FCVTL

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-54-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/helper-sme.h    |  2 ++
 target/arm/tcg/sme.decode      |  5 ++++
 target/arm/tcg/sme_helper.c    | 45 ++++++++++++++++++++++++++++++++++
 target/arm/tcg/sve_helper.c    |  2 +-
 target/arm/tcg/translate-sme.c |  5 ++++
 target/arm/tcg/vec_internal.h  |  1 +
 6 files changed, 59 insertions(+), 1 deletion(-)

diff --git a/target/arm/tcg/helper-sme.h b/target/arm/tcg/helper-sme.h
index 97e70959e8..be4621f2d9 100644
--- a/target/arm/tcg/helper-sme.h
+++ b/target/arm/tcg/helper-sme.h
@@ -217,3 +217,5 @@ DEF_HELPER_FLAGS_4(sme2_bfcvt, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_4(sme2_bfcvtn, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_4(sme2_fcvt_n, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_4(sme2_fcvtn, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_4(sme2_fcvt_w, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_4(sme2_fcvtl, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
diff --git a/target/arm/tcg/sme.decode b/target/arm/tcg/sme.decode
index 831179c0ee..5100ebaeba 100644
--- a/target/arm/tcg/sme.decode
+++ b/target/arm/tcg/sme.decode
@@ -726,9 +726,14 @@ SUB_aaz_d       11000001 111 000010 .. 111 ...00 11 ...     @az_4x4_o3
 &zz_n           zd zn n
 @zz_1x2         ........ ... ..... ...... ..... zd:5        \
                 &zz_n n=1 zn=%zn_ax2
+@zz_2x1         ........ ... ..... ...... zn:5  .....       \
+                &zz_n n=1 zd=%zd_ax2
 
 BFCVT           11000001 011 00000 111000 ....0 .....       @zz_1x2
 BFCVTN          11000001 011 00000 111000 ....1 .....       @zz_1x2
 
 FCVT_n          11000001 001 00000 111000 ....0 .....       @zz_1x2
 FCVTN           11000001 001 00000 111000 ....1 .....       @zz_1x2
+
+FCVT_w          11000001 101 00000 111000 ..... ....0       @zz_2x1
+FCVTL           11000001 101 00000 111000 ..... ....1       @zz_2x1
diff --git a/target/arm/tcg/sme_helper.c b/target/arm/tcg/sme_helper.c
index d97afdb69c..c696246d15 100644
--- a/target/arm/tcg/sme_helper.c
+++ b/target/arm/tcg/sme_helper.c
@@ -29,6 +29,13 @@
 #include "vec_internal.h"
 #include "sve_ldst_internal.h"
 
+
+static bool vectors_overlap(ARMVectorReg *x, unsigned nx,
+                            ARMVectorReg *y, unsigned ny)
+{
+    return !(x + nx <= y || y + ny <= x);
+}
+
 void helper_set_svcr(CPUARMState *env, uint32_t val, uint32_t mask)
 {
     aarch64_set_svcr(env, val, mask);
@@ -1591,3 +1598,41 @@ void HELPER(sme2_fcvtn)(void *vd, void *vs, float_status *fpst, uint32_t desc)
         d[H2(i * 2 + 1)] = d1;
     }
 }
+
+/* Expand and convert */
+void HELPER(sme2_fcvt_w)(void *vd, void *vs, float_status *fpst, uint32_t desc)
+{
+    ARMVectorReg scratch;
+    size_t oprsz = simd_oprsz(desc);
+    size_t i, n = oprsz / 4;
+    float16 *s = vs;
+    float32 *d0 = vd;
+    float32 *d1 = vd + sizeof(ARMVectorReg);
+
+    if (vectors_overlap(vd, 1, vs, 2)) {
+        s = memcpy(&scratch, s, oprsz);
+    }
+
+    for (i = 0; i < n; ++i) {
+        d0[H4(i)] = sve_f16_to_f32(s[H2(i)], fpst);
+    }
+    for (i = 0; i < n; ++i) {
+        d1[H4(i)] = sve_f16_to_f32(s[H2(n + i)], fpst);
+    }
+}
+
+/* Deinterleave and convert. */
+void HELPER(sme2_fcvtl)(void *vd, void *vs, float_status *fpst, uint32_t desc)
+{
+    size_t i, n = simd_oprsz(desc) / 4;
+    float16 *s = vs;
+    float32 *d0 = vd;
+    float32 *d1 = vd + sizeof(ARMVectorReg);
+
+    for (i = 0; i < n; ++i) {
+        float32 v0 = sve_f16_to_f32(s[H2(i * 2 + 0)], fpst);
+        float32 v1 = sve_f16_to_f32(s[H2(i * 2 + 1)], fpst);
+        d0[H4(i)] = v0;
+        d1[H4(i)] = v1;
+    }
+}
diff --git a/target/arm/tcg/sve_helper.c b/target/arm/tcg/sve_helper.c
index b522ddaf7c..4f12723afe 100644
--- a/target/arm/tcg/sve_helper.c
+++ b/target/arm/tcg/sve_helper.c
@@ -4554,7 +4554,7 @@ void HELPER(NAME)(void *vd, void *vn, void *vg,                       \
  * FZ16.  When converting from fp16, this affects flushing input denormals;
  * when converting to fp16, this affects flushing output denormals.
  */
-static inline float32 sve_f16_to_f32(float16 f, float_status *fpst)
+float32 sve_f16_to_f32(float16 f, float_status *fpst)
 {
     bool save = get_flush_inputs_to_zero(fpst);
     float32 ret;
diff --git a/target/arm/tcg/translate-sme.c b/target/arm/tcg/translate-sme.c
index 10e5b77040..d6167eafe1 100644
--- a/target/arm/tcg/translate-sme.c
+++ b/target/arm/tcg/translate-sme.c
@@ -1360,3 +1360,8 @@ TRANS_FEAT(FCVT_n, aa64_sme2, do_zz_fpst, a, 0,
            FPST_A64, gen_helper_sme2_fcvt_n)
 TRANS_FEAT(FCVTN, aa64_sme2, do_zz_fpst, a, 0,
            FPST_A64, gen_helper_sme2_fcvtn)
+
+TRANS_FEAT(FCVT_w, aa64_sme_f16f16, do_zz_fpst, a, 0,
+           FPST_A64_F16, gen_helper_sme2_fcvt_w)
+TRANS_FEAT(FCVTL, aa64_sme_f16f16, do_zz_fpst, a, 0,
+           FPST_A64_F16, gen_helper_sme2_fcvtl)
diff --git a/target/arm/tcg/vec_internal.h b/target/arm/tcg/vec_internal.h
index c8199a3ef8..bbf76f63b1 100644
--- a/target/arm/tcg/vec_internal.h
+++ b/target/arm/tcg/vec_internal.h
@@ -306,6 +306,7 @@ static inline float64 float64_maybe_ah_chs(float64 a, bool fpcr_ah)
 bfloat16 helper_sme2_ah_fmax_b16(bfloat16 a, bfloat16 b, float_status *fpst);
 bfloat16 helper_sme2_ah_fmin_b16(bfloat16 a, bfloat16 b, float_status *fpst);
 
+float32 sve_f16_to_f32(float16 f, float_status *fpst);
 float16 sve_f32_to_f16(float32 f, float_status *fpst);
 
 #endif /* TARGET_ARM_VEC_INTERNAL_H */

From 91a11f74683f7a873be5908601999239fb7ba363 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:20:17 -0600
Subject: [PATCH 2001/2760] target/arm: Implement SME2 FCVTZS, FCVTZU

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-55-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/sme.decode      | 9 +++++++++
 target/arm/tcg/translate-sme.c | 5 +++++
 2 files changed, 14 insertions(+)

diff --git a/target/arm/tcg/sme.decode b/target/arm/tcg/sme.decode
index 5100ebaeba..79df2dcd2b 100644
--- a/target/arm/tcg/sme.decode
+++ b/target/arm/tcg/sme.decode
@@ -728,6 +728,10 @@ SUB_aaz_d       11000001 111 000010 .. 111 ...00 11 ...     @az_4x4_o3
                 &zz_n n=1 zn=%zn_ax2
 @zz_2x1         ........ ... ..... ...... zn:5  .....       \
                 &zz_n n=1 zd=%zd_ax2
+@zz_2x2         ........ ... ..... ...... .... . .....      \
+                &zz_n n=2 zd=%zd_ax2 zn=%zn_ax2
+@zz_4x4         ........ ... ..... ...... .... . .....      \
+                &zz_n n=4 zd=%zd_ax4 zn=%zn_ax4
 
 BFCVT           11000001 011 00000 111000 ....0 .....       @zz_1x2
 BFCVTN          11000001 011 00000 111000 ....1 .....       @zz_1x2
@@ -737,3 +741,8 @@ FCVTN           11000001 001 00000 111000 ....1 .....       @zz_1x2
 
 FCVT_w          11000001 101 00000 111000 ..... ....0       @zz_2x1
 FCVTL           11000001 101 00000 111000 ..... ....1       @zz_2x1
+
+FCVTZS          11000001 001 00001 111000 ....0 ....0       @zz_2x2
+FCVTZS          11000001 001 10001 111000 ...00 ...00       @zz_4x4
+FCVTZU          11000001 001 00001 111000 ....1 ....0       @zz_2x2
+FCVTZU          11000001 001 10001 111000 ...01 ...00       @zz_4x4
diff --git a/target/arm/tcg/translate-sme.c b/target/arm/tcg/translate-sme.c
index d6167eafe1..3bf2b6935f 100644
--- a/target/arm/tcg/translate-sme.c
+++ b/target/arm/tcg/translate-sme.c
@@ -1365,3 +1365,8 @@ TRANS_FEAT(FCVT_w, aa64_sme_f16f16, do_zz_fpst, a, 0,
            FPST_A64_F16, gen_helper_sme2_fcvt_w)
 TRANS_FEAT(FCVTL, aa64_sme_f16f16, do_zz_fpst, a, 0,
            FPST_A64_F16, gen_helper_sme2_fcvtl)
+
+TRANS_FEAT(FCVTZS, aa64_sme2, do_zz_fpst, a, 0,
+           FPST_A64, gen_helper_gvec_vcvt_rz_fs)
+TRANS_FEAT(FCVTZU, aa64_sme2, do_zz_fpst, a, 0,
+           FPST_A64, gen_helper_gvec_vcvt_rz_fu)

From 41167be4290124052f28d719994572269d7b3ec1 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:20:18 -0600
Subject: [PATCH 2002/2760] target/arm: Implement SME2 SCVTF, UCVTF

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-56-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/helper-sme.h    |  2 ++
 target/arm/tcg/sme.decode      |  5 +++++
 target/arm/tcg/sme_helper.c    | 22 ++++++++++++++++++++++
 target/arm/tcg/translate-sme.c |  5 +++++
 4 files changed, 34 insertions(+)

diff --git a/target/arm/tcg/helper-sme.h b/target/arm/tcg/helper-sme.h
index be4621f2d9..6314ad7e01 100644
--- a/target/arm/tcg/helper-sme.h
+++ b/target/arm/tcg/helper-sme.h
@@ -219,3 +219,5 @@ DEF_HELPER_FLAGS_4(sme2_fcvt_n, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_4(sme2_fcvtn, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_4(sme2_fcvt_w, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_4(sme2_fcvtl, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_4(sme2_scvtf, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_4(sme2_ucvtf, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
diff --git a/target/arm/tcg/sme.decode b/target/arm/tcg/sme.decode
index 79df2dcd2b..449d97bd28 100644
--- a/target/arm/tcg/sme.decode
+++ b/target/arm/tcg/sme.decode
@@ -746,3 +746,8 @@ FCVTZS          11000001 001 00001 111000 ....0 ....0       @zz_2x2
 FCVTZS          11000001 001 10001 111000 ...00 ...00       @zz_4x4
 FCVTZU          11000001 001 00001 111000 ....1 ....0       @zz_2x2
 FCVTZU          11000001 001 10001 111000 ...01 ...00       @zz_4x4
+
+SCVTF           11000001 001 00010 111000 ....0 ....0       @zz_2x2
+SCVTF           11000001 001 10010 111000 ...00 ...00       @zz_4x4
+UCVTF           11000001 001 00010 111000 ....1 ....0       @zz_2x2
+UCVTF           11000001 001 10010 111000 ...01 ...00       @zz_4x4
diff --git a/target/arm/tcg/sme_helper.c b/target/arm/tcg/sme_helper.c
index c696246d15..d3841400ee 100644
--- a/target/arm/tcg/sme_helper.c
+++ b/target/arm/tcg/sme_helper.c
@@ -1636,3 +1636,25 @@ void HELPER(sme2_fcvtl)(void *vd, void *vs, float_status *fpst, uint32_t desc)
         d1[H4(i)] = v1;
     }
 }
+
+void HELPER(sme2_scvtf)(void *vd, void *vs, float_status *fpst, uint32_t desc)
+{
+    size_t i, n = simd_oprsz(desc) / 4;
+    int32_t *d = vd;
+    float32 *s = vs;
+
+    for (i = 0; i < n; ++i) {
+        d[i] = int32_to_float32(s[i], fpst);
+    }
+}
+
+void HELPER(sme2_ucvtf)(void *vd, void *vs, float_status *fpst, uint32_t desc)
+{
+    size_t i, n = simd_oprsz(desc) / 4;
+    uint32_t *d = vd;
+    float32 *s = vs;
+
+    for (i = 0; i < n; ++i) {
+        d[i] = uint32_to_float32(s[i], fpst);
+    }
+}
diff --git a/target/arm/tcg/translate-sme.c b/target/arm/tcg/translate-sme.c
index 3bf2b6935f..dce3b56de2 100644
--- a/target/arm/tcg/translate-sme.c
+++ b/target/arm/tcg/translate-sme.c
@@ -1370,3 +1370,8 @@ TRANS_FEAT(FCVTZS, aa64_sme2, do_zz_fpst, a, 0,
            FPST_A64, gen_helper_gvec_vcvt_rz_fs)
 TRANS_FEAT(FCVTZU, aa64_sme2, do_zz_fpst, a, 0,
            FPST_A64, gen_helper_gvec_vcvt_rz_fu)
+
+TRANS_FEAT(SCVTF, aa64_sme2, do_zz_fpst, a, 0,
+           FPST_A64, gen_helper_sme2_scvtf)
+TRANS_FEAT(UCVTF, aa64_sme2, do_zz_fpst, a, 0,
+           FPST_A64, gen_helper_sme2_ucvtf)

From 2065b1420d701b95dfed7e9d76bf7f011c3da9b3 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:20:19 -0600
Subject: [PATCH 2003/2760] target/arm: Implement SME2 FRINTN, FRINTP, FRINTM,
 FRINTA

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-57-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/sme.decode      | 9 +++++++++
 target/arm/tcg/translate-sme.c | 9 +++++++++
 2 files changed, 18 insertions(+)

diff --git a/target/arm/tcg/sme.decode b/target/arm/tcg/sme.decode
index 449d97bd28..9cc25622d4 100644
--- a/target/arm/tcg/sme.decode
+++ b/target/arm/tcg/sme.decode
@@ -751,3 +751,12 @@ SCVTF           11000001 001 00010 111000 ....0 ....0       @zz_2x2
 SCVTF           11000001 001 10010 111000 ...00 ...00       @zz_4x4
 UCVTF           11000001 001 00010 111000 ....1 ....0       @zz_2x2
 UCVTF           11000001 001 10010 111000 ...01 ...00       @zz_4x4
+
+FRINTN          11000001 101 01000 111000 ....0 ....0       @zz_2x2
+FRINTN          11000001 101 11000 111000 ...00 ...00       @zz_4x4
+FRINTP          11000001 101 01001 111000 ....0 ....0       @zz_2x2
+FRINTP          11000001 101 11001 111000 ...00 ...00       @zz_4x4
+FRINTM          11000001 101 01010 111000 ....0 ....0       @zz_2x2
+FRINTM          11000001 101 11010 111000 ...00 ...00       @zz_4x4
+FRINTA          11000001 101 01100 111000 ....0 ....0       @zz_2x2
+FRINTA          11000001 101 11100 111000 ...00 ...00       @zz_4x4
diff --git a/target/arm/tcg/translate-sme.c b/target/arm/tcg/translate-sme.c
index dce3b56de2..4fbc61ae27 100644
--- a/target/arm/tcg/translate-sme.c
+++ b/target/arm/tcg/translate-sme.c
@@ -1375,3 +1375,12 @@ TRANS_FEAT(SCVTF, aa64_sme2, do_zz_fpst, a, 0,
            FPST_A64, gen_helper_sme2_scvtf)
 TRANS_FEAT(UCVTF, aa64_sme2, do_zz_fpst, a, 0,
            FPST_A64, gen_helper_sme2_ucvtf)
+
+TRANS_FEAT(FRINTN, aa64_sme2, do_zz_fpst, a, float_round_nearest_even,
+           FPST_A64, gen_helper_gvec_vrint_rm_s)
+TRANS_FEAT(FRINTP, aa64_sme2, do_zz_fpst, a, float_round_up,
+           FPST_A64, gen_helper_gvec_vrint_rm_s)
+TRANS_FEAT(FRINTM, aa64_sme2, do_zz_fpst, a, float_round_down,
+           FPST_A64, gen_helper_gvec_vrint_rm_s)
+TRANS_FEAT(FRINTA, aa64_sme2, do_zz_fpst, a, float_round_ties_away,
+           FPST_A64, gen_helper_gvec_vrint_rm_s)

From 88b73373110bbc60c9d5238fd387d213e91933af Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:20:20 -0600
Subject: [PATCH 2004/2760] target/arm: Introduce do_[us]sat_[bhs] macros

Inputs are a wider type of indeterminate sign.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-58-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/vec_internal.h | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/target/arm/tcg/vec_internal.h b/target/arm/tcg/vec_internal.h
index bbf76f63b1..a1c10c60a1 100644
--- a/target/arm/tcg/vec_internal.h
+++ b/target/arm/tcg/vec_internal.h
@@ -223,6 +223,13 @@ int16_t do_sqrdmlah_h(int16_t, int16_t, int16_t, bool, bool, uint32_t *);
 int32_t do_sqrdmlah_s(int32_t, int32_t, int32_t, bool, bool, uint32_t *);
 int64_t do_sqrdmlah_d(int64_t, int64_t, int64_t, bool, bool);
 
+#define do_ssat_b(val)  MIN(MAX(val, INT8_MIN), INT8_MAX)
+#define do_ssat_h(val)  MIN(MAX(val, INT16_MIN), INT16_MAX)
+#define do_ssat_s(val)  MIN(MAX(val, INT32_MIN), INT32_MAX)
+#define do_usat_b(val)  MIN(MAX(val, 0), UINT8_MAX)
+#define do_usat_h(val)  MIN(MAX(val, 0), UINT16_MAX)
+#define do_usat_s(val)  MIN(MAX(val, 0), UINT32_MAX)
+
 /**
  * bfdotadd:
  * @sum: addend

From 63b2c8de713933f42f1999cd003f12f90bdc5249 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:20:21 -0600
Subject: [PATCH 2005/2760] target/arm: Use do_[us]sat_[bhs] in sve_helper.c

Replace and remove do_sat_bhs.
This avoids multiple repetitions of INT*_MIN/MAX.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-59-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/sve_helper.c | 116 +++++++++++++++---------------------
 1 file changed, 48 insertions(+), 68 deletions(-)

diff --git a/target/arm/tcg/sve_helper.c b/target/arm/tcg/sve_helper.c
index 4f12723afe..f9052f2164 100644
--- a/target/arm/tcg/sve_helper.c
+++ b/target/arm/tcg/sve_helper.c
@@ -527,14 +527,9 @@ DO_ZPZZ(sve2_uhsub_zpzz_h, uint16_t, H1_2, DO_HSUB_BHS)
 DO_ZPZZ(sve2_uhsub_zpzz_s, uint32_t, H1_4, DO_HSUB_BHS)
 DO_ZPZZ_D(sve2_uhsub_zpzz_d, uint64_t, DO_HSUB_D)
 
-static inline int32_t do_sat_bhs(int64_t val, int64_t min, int64_t max)
-{
-    return val >= max ? max : val <= min ? min : val;
-}
-
-#define DO_SQADD_B(n, m) do_sat_bhs((int64_t)n + m, INT8_MIN, INT8_MAX)
-#define DO_SQADD_H(n, m) do_sat_bhs((int64_t)n + m, INT16_MIN, INT16_MAX)
-#define DO_SQADD_S(n, m) do_sat_bhs((int64_t)n + m, INT32_MIN, INT32_MAX)
+#define DO_SQADD_B(n, m) do_ssat_b((int64_t)n + m)
+#define DO_SQADD_H(n, m) do_ssat_h((int64_t)n + m)
+#define DO_SQADD_S(n, m) do_ssat_s((int64_t)n + m)
 
 static inline int64_t do_sqadd_d(int64_t n, int64_t m)
 {
@@ -551,9 +546,9 @@ DO_ZPZZ(sve2_sqadd_zpzz_h, int16_t, H1_2, DO_SQADD_H)
 DO_ZPZZ(sve2_sqadd_zpzz_s, int32_t, H1_4, DO_SQADD_S)
 DO_ZPZZ_D(sve2_sqadd_zpzz_d, int64_t, do_sqadd_d)
 
-#define DO_UQADD_B(n, m) do_sat_bhs((int64_t)n + m, 0, UINT8_MAX)
-#define DO_UQADD_H(n, m) do_sat_bhs((int64_t)n + m, 0, UINT16_MAX)
-#define DO_UQADD_S(n, m) do_sat_bhs((int64_t)n + m, 0, UINT32_MAX)
+#define DO_UQADD_B(n, m) do_usat_b((int64_t)n + m)
+#define DO_UQADD_H(n, m) do_usat_h((int64_t)n + m)
+#define DO_UQADD_S(n, m) do_usat_s((int64_t)n + m)
 
 static inline uint64_t do_uqadd_d(uint64_t n, uint64_t m)
 {
@@ -566,9 +561,9 @@ DO_ZPZZ(sve2_uqadd_zpzz_h, uint16_t, H1_2, DO_UQADD_H)
 DO_ZPZZ(sve2_uqadd_zpzz_s, uint32_t, H1_4, DO_UQADD_S)
 DO_ZPZZ_D(sve2_uqadd_zpzz_d, uint64_t, do_uqadd_d)
 
-#define DO_SQSUB_B(n, m) do_sat_bhs((int64_t)n - m, INT8_MIN, INT8_MAX)
-#define DO_SQSUB_H(n, m) do_sat_bhs((int64_t)n - m, INT16_MIN, INT16_MAX)
-#define DO_SQSUB_S(n, m) do_sat_bhs((int64_t)n - m, INT32_MIN, INT32_MAX)
+#define DO_SQSUB_B(n, m) do_ssat_b((int64_t)n - m)
+#define DO_SQSUB_H(n, m) do_ssat_h((int64_t)n - m)
+#define DO_SQSUB_S(n, m) do_ssat_s((int64_t)n - m)
 
 static inline int64_t do_sqsub_d(int64_t n, int64_t m)
 {
@@ -585,9 +580,9 @@ DO_ZPZZ(sve2_sqsub_zpzz_h, int16_t, H1_2, DO_SQSUB_H)
 DO_ZPZZ(sve2_sqsub_zpzz_s, int32_t, H1_4, DO_SQSUB_S)
 DO_ZPZZ_D(sve2_sqsub_zpzz_d, int64_t, do_sqsub_d)
 
-#define DO_UQSUB_B(n, m) do_sat_bhs((int64_t)n - m, 0, UINT8_MAX)
-#define DO_UQSUB_H(n, m) do_sat_bhs((int64_t)n - m, 0, UINT16_MAX)
-#define DO_UQSUB_S(n, m) do_sat_bhs((int64_t)n - m, 0, UINT32_MAX)
+#define DO_UQSUB_B(n, m) do_usat_b((int64_t)n - m)
+#define DO_UQSUB_H(n, m) do_usat_h((int64_t)n - m)
+#define DO_UQSUB_S(n, m) do_usat_s((int64_t)n - m)
 
 static inline uint64_t do_uqsub_d(uint64_t n, uint64_t m)
 {
@@ -599,12 +594,9 @@ DO_ZPZZ(sve2_uqsub_zpzz_h, uint16_t, H1_2, DO_UQSUB_H)
 DO_ZPZZ(sve2_uqsub_zpzz_s, uint32_t, H1_4, DO_UQSUB_S)
 DO_ZPZZ_D(sve2_uqsub_zpzz_d, uint64_t, do_uqsub_d)
 
-#define DO_SUQADD_B(n, m) \
-    do_sat_bhs((int64_t)(int8_t)n + m, INT8_MIN, INT8_MAX)
-#define DO_SUQADD_H(n, m) \
-    do_sat_bhs((int64_t)(int16_t)n + m, INT16_MIN, INT16_MAX)
-#define DO_SUQADD_S(n, m) \
-    do_sat_bhs((int64_t)(int32_t)n + m, INT32_MIN, INT32_MAX)
+#define DO_SUQADD_B(n, m) do_ssat_b((int64_t)(int8_t)n + m)
+#define DO_SUQADD_H(n, m) do_ssat_h((int64_t)(int16_t)n + m)
+#define DO_SUQADD_S(n, m) do_ssat_s((int64_t)(int32_t)n + m)
 
 static inline int64_t do_suqadd_d(int64_t n, uint64_t m)
 {
@@ -634,12 +626,9 @@ DO_ZPZZ(sve2_suqadd_zpzz_h, uint16_t, H1_2, DO_SUQADD_H)
 DO_ZPZZ(sve2_suqadd_zpzz_s, uint32_t, H1_4, DO_SUQADD_S)
 DO_ZPZZ_D(sve2_suqadd_zpzz_d, uint64_t, do_suqadd_d)
 
-#define DO_USQADD_B(n, m) \
-    do_sat_bhs((int64_t)n + (int8_t)m, 0, UINT8_MAX)
-#define DO_USQADD_H(n, m) \
-    do_sat_bhs((int64_t)n + (int16_t)m, 0, UINT16_MAX)
-#define DO_USQADD_S(n, m) \
-    do_sat_bhs((int64_t)n + (int32_t)m, 0, UINT32_MAX)
+#define DO_USQADD_B(n, m) do_usat_b((int64_t)n + (int8_t)m)
+#define DO_USQADD_H(n, m) do_usat_h((int64_t)n + (int16_t)m)
+#define DO_USQADD_S(n, m) do_usat_s((int64_t)n + (int32_t)m)
 
 static inline uint64_t do_usqadd_d(uint64_t n, int64_t m)
 {
@@ -1226,37 +1215,29 @@ void HELPER(NAME)(void *vd, void *vn, uint32_t desc)                    \
     }                                                                   \
 }
 
-#define DO_SQXTN_H(n)  do_sat_bhs(n, INT8_MIN, INT8_MAX)
-#define DO_SQXTN_S(n)  do_sat_bhs(n, INT16_MIN, INT16_MAX)
-#define DO_SQXTN_D(n)  do_sat_bhs(n, INT32_MIN, INT32_MAX)
+DO_XTNB(sve2_sqxtnb_h, int16_t, do_ssat_b)
+DO_XTNB(sve2_sqxtnb_s, int32_t, do_ssat_h)
+DO_XTNB(sve2_sqxtnb_d, int64_t, do_ssat_s)
 
-DO_XTNB(sve2_sqxtnb_h, int16_t, DO_SQXTN_H)
-DO_XTNB(sve2_sqxtnb_s, int32_t, DO_SQXTN_S)
-DO_XTNB(sve2_sqxtnb_d, int64_t, DO_SQXTN_D)
+DO_XTNT(sve2_sqxtnt_h, int16_t, int8_t, H1, do_ssat_b)
+DO_XTNT(sve2_sqxtnt_s, int32_t, int16_t, H1_2, do_ssat_h)
+DO_XTNT(sve2_sqxtnt_d, int64_t, int32_t, H1_4, do_ssat_s)
 
-DO_XTNT(sve2_sqxtnt_h, int16_t, int8_t, H1, DO_SQXTN_H)
-DO_XTNT(sve2_sqxtnt_s, int32_t, int16_t, H1_2, DO_SQXTN_S)
-DO_XTNT(sve2_sqxtnt_d, int64_t, int32_t, H1_4, DO_SQXTN_D)
+DO_XTNB(sve2_uqxtnb_h, uint16_t, do_usat_b)
+DO_XTNB(sve2_uqxtnb_s, uint32_t, do_usat_h)
+DO_XTNB(sve2_uqxtnb_d, uint64_t, do_usat_s)
 
-#define DO_UQXTN_H(n)  do_sat_bhs(n, 0, UINT8_MAX)
-#define DO_UQXTN_S(n)  do_sat_bhs(n, 0, UINT16_MAX)
-#define DO_UQXTN_D(n)  do_sat_bhs(n, 0, UINT32_MAX)
+DO_XTNT(sve2_uqxtnt_h, uint16_t, uint8_t, H1, do_usat_b)
+DO_XTNT(sve2_uqxtnt_s, uint32_t, uint16_t, H1_2, do_usat_h)
+DO_XTNT(sve2_uqxtnt_d, uint64_t, uint32_t, H1_4, do_usat_s)
 
-DO_XTNB(sve2_uqxtnb_h, uint16_t, DO_UQXTN_H)
-DO_XTNB(sve2_uqxtnb_s, uint32_t, DO_UQXTN_S)
-DO_XTNB(sve2_uqxtnb_d, uint64_t, DO_UQXTN_D)
+DO_XTNB(sve2_sqxtunb_h, int16_t, do_usat_b)
+DO_XTNB(sve2_sqxtunb_s, int32_t, do_usat_h)
+DO_XTNB(sve2_sqxtunb_d, int64_t, do_usat_s)
 
-DO_XTNT(sve2_uqxtnt_h, uint16_t, uint8_t, H1, DO_UQXTN_H)
-DO_XTNT(sve2_uqxtnt_s, uint32_t, uint16_t, H1_2, DO_UQXTN_S)
-DO_XTNT(sve2_uqxtnt_d, uint64_t, uint32_t, H1_4, DO_UQXTN_D)
-
-DO_XTNB(sve2_sqxtunb_h, int16_t, DO_UQXTN_H)
-DO_XTNB(sve2_sqxtunb_s, int32_t, DO_UQXTN_S)
-DO_XTNB(sve2_sqxtunb_d, int64_t, DO_UQXTN_D)
-
-DO_XTNT(sve2_sqxtunt_h, int16_t, int8_t, H1, DO_UQXTN_H)
-DO_XTNT(sve2_sqxtunt_s, int32_t, int16_t, H1_2, DO_UQXTN_S)
-DO_XTNT(sve2_sqxtunt_d, int64_t, int32_t, H1_4, DO_UQXTN_D)
+DO_XTNT(sve2_sqxtunt_h, int16_t, int8_t, H1, do_usat_b)
+DO_XTNT(sve2_sqxtunt_s, int32_t, int16_t, H1_2, do_usat_h)
+DO_XTNT(sve2_sqxtunt_d, int64_t, int32_t, H1_4, do_usat_s)
 
 #undef DO_XTNB
 #undef DO_XTNT
@@ -2187,10 +2168,9 @@ DO_SHRNT(sve2_rshrnt_h, uint16_t, uint8_t, H1_2, H1, do_urshr)
 DO_SHRNT(sve2_rshrnt_s, uint32_t, uint16_t, H1_4, H1_2, do_urshr)
 DO_SHRNT(sve2_rshrnt_d, uint64_t, uint32_t, H1_8, H1_4, do_urshr)
 
-#define DO_SQSHRUN_H(x, sh) do_sat_bhs((int64_t)(x) >> sh, 0, UINT8_MAX)
-#define DO_SQSHRUN_S(x, sh) do_sat_bhs((int64_t)(x) >> sh, 0, UINT16_MAX)
-#define DO_SQSHRUN_D(x, sh) \
-    do_sat_bhs((int64_t)(x) >> (sh < 64 ? sh : 63), 0, UINT32_MAX)
+#define DO_SQSHRUN_H(x, sh) do_usat_b((int64_t)(x) >> sh)
+#define DO_SQSHRUN_S(x, sh) do_usat_h((int64_t)(x) >> sh)
+#define DO_SQSHRUN_D(x, sh) do_usat_s((int64_t)(x) >> (sh < 64 ? sh : 63))
 
 DO_SHRNB(sve2_sqshrunb_h, int16_t, uint8_t, DO_SQSHRUN_H)
 DO_SHRNB(sve2_sqshrunb_s, int32_t, uint16_t, DO_SQSHRUN_S)
@@ -2200,9 +2180,9 @@ DO_SHRNT(sve2_sqshrunt_h, int16_t, uint8_t, H1_2, H1, DO_SQSHRUN_H)
 DO_SHRNT(sve2_sqshrunt_s, int32_t, uint16_t, H1_4, H1_2, DO_SQSHRUN_S)
 DO_SHRNT(sve2_sqshrunt_d, int64_t, uint32_t, H1_8, H1_4, DO_SQSHRUN_D)
 
-#define DO_SQRSHRUN_H(x, sh) do_sat_bhs(do_srshr(x, sh), 0, UINT8_MAX)
-#define DO_SQRSHRUN_S(x, sh) do_sat_bhs(do_srshr(x, sh), 0, UINT16_MAX)
-#define DO_SQRSHRUN_D(x, sh) do_sat_bhs(do_srshr(x, sh), 0, UINT32_MAX)
+#define DO_SQRSHRUN_H(x, sh) do_usat_b(do_srshr(x, sh))
+#define DO_SQRSHRUN_S(x, sh) do_usat_h(do_srshr(x, sh))
+#define DO_SQRSHRUN_D(x, sh) do_usat_s(do_srshr(x, sh))
 
 DO_SHRNB(sve2_sqrshrunb_h, int16_t, uint8_t, DO_SQRSHRUN_H)
 DO_SHRNB(sve2_sqrshrunb_s, int32_t, uint16_t, DO_SQRSHRUN_S)
@@ -2212,9 +2192,9 @@ DO_SHRNT(sve2_sqrshrunt_h, int16_t, uint8_t, H1_2, H1, DO_SQRSHRUN_H)
 DO_SHRNT(sve2_sqrshrunt_s, int32_t, uint16_t, H1_4, H1_2, DO_SQRSHRUN_S)
 DO_SHRNT(sve2_sqrshrunt_d, int64_t, uint32_t, H1_8, H1_4, DO_SQRSHRUN_D)
 
-#define DO_SQSHRN_H(x, sh) do_sat_bhs(x >> sh, INT8_MIN, INT8_MAX)
-#define DO_SQSHRN_S(x, sh) do_sat_bhs(x >> sh, INT16_MIN, INT16_MAX)
-#define DO_SQSHRN_D(x, sh) do_sat_bhs(x >> sh, INT32_MIN, INT32_MAX)
+#define DO_SQSHRN_H(x, sh) do_ssat_b(x >> sh)
+#define DO_SQSHRN_S(x, sh) do_ssat_h(x >> sh)
+#define DO_SQSHRN_D(x, sh) do_ssat_s(x >> sh)
 
 DO_SHRNB(sve2_sqshrnb_h, int16_t, uint8_t, DO_SQSHRN_H)
 DO_SHRNB(sve2_sqshrnb_s, int32_t, uint16_t, DO_SQSHRN_S)
@@ -2224,9 +2204,9 @@ DO_SHRNT(sve2_sqshrnt_h, int16_t, uint8_t, H1_2, H1, DO_SQSHRN_H)
 DO_SHRNT(sve2_sqshrnt_s, int32_t, uint16_t, H1_4, H1_2, DO_SQSHRN_S)
 DO_SHRNT(sve2_sqshrnt_d, int64_t, uint32_t, H1_8, H1_4, DO_SQSHRN_D)
 
-#define DO_SQRSHRN_H(x, sh) do_sat_bhs(do_srshr(x, sh), INT8_MIN, INT8_MAX)
-#define DO_SQRSHRN_S(x, sh) do_sat_bhs(do_srshr(x, sh), INT16_MIN, INT16_MAX)
-#define DO_SQRSHRN_D(x, sh) do_sat_bhs(do_srshr(x, sh), INT32_MIN, INT32_MAX)
+#define DO_SQRSHRN_H(x, sh) do_ssat_b(do_srshr(x, sh))
+#define DO_SQRSHRN_S(x, sh) do_ssat_h(do_srshr(x, sh))
+#define DO_SQRSHRN_D(x, sh) do_ssat_s(do_srshr(x, sh))
 
 DO_SHRNB(sve2_sqrshrnb_h, int16_t, uint8_t, DO_SQRSHRN_H)
 DO_SHRNB(sve2_sqrshrnb_s, int32_t, uint16_t, DO_SQRSHRN_S)

From bde57978ce3794b8ebaab99307a4899cf4bedd55 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:20:22 -0600
Subject: [PATCH 2006/2760] target/arm: Implement SME2 SQCVT, UQCVT, SQCVTU

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20250704142112.1018902-60-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/helper-sme.h    |  20 ++++++
 target/arm/tcg/sme.decode      |  22 +++++++
 target/arm/tcg/sme_helper.c    | 116 +++++++++++++++++++++++++++++++++
 target/arm/tcg/translate-sme.c |  35 ++++++++++
 4 files changed, 193 insertions(+)

diff --git a/target/arm/tcg/helper-sme.h b/target/arm/tcg/helper-sme.h
index 6314ad7e01..792b993695 100644
--- a/target/arm/tcg/helper-sme.h
+++ b/target/arm/tcg/helper-sme.h
@@ -221,3 +221,23 @@ DEF_HELPER_FLAGS_4(sme2_fcvt_w, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_4(sme2_fcvtl, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_4(sme2_scvtf, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_4(sme2_ucvtf, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
+
+DEF_HELPER_FLAGS_3(sme2_sqcvt_sb, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(sme2_uqcvt_sb, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(sme2_sqcvtu_sb, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(sme2_sqcvt_sh, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(sme2_uqcvt_sh, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(sme2_sqcvtu_sh, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(sme2_sqcvt_dh, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(sme2_uqcvt_dh, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(sme2_sqcvtu_dh, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_3(sme2_sqcvtn_sb, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(sme2_uqcvtn_sb, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(sme2_sqcvtun_sb, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(sme2_sqcvtn_sh, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(sme2_uqcvtn_sh, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(sme2_sqcvtun_sh, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(sme2_sqcvtn_dh, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(sme2_uqcvtn_dh, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(sme2_sqcvtun_dh, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
diff --git a/target/arm/tcg/sme.decode b/target/arm/tcg/sme.decode
index 9cc25622d4..e005f6e6ed 100644
--- a/target/arm/tcg/sme.decode
+++ b/target/arm/tcg/sme.decode
@@ -726,6 +726,8 @@ SUB_aaz_d       11000001 111 000010 .. 111 ...00 11 ...     @az_4x4_o3
 &zz_n           zd zn n
 @zz_1x2         ........ ... ..... ...... ..... zd:5        \
                 &zz_n n=1 zn=%zn_ax2
+@zz_1x4         ........ ... ..... ...... ..... zd:5        \
+                &zz_n n=1 zn=%zn_ax4
 @zz_2x1         ........ ... ..... ...... zn:5  .....       \
                 &zz_n n=1 zd=%zd_ax2
 @zz_2x2         ........ ... ..... ...... .... . .....      \
@@ -760,3 +762,23 @@ FRINTM          11000001 101 01010 111000 ....0 ....0       @zz_2x2
 FRINTM          11000001 101 11010 111000 ...00 ...00       @zz_4x4
 FRINTA          11000001 101 01100 111000 ....0 ....0       @zz_2x2
 FRINTA          11000001 101 11100 111000 ...00 ...00       @zz_4x4
+
+SQCVT_sh        11000001 001 00011 111000 ....0 .....       @zz_1x2
+UQCVT_sh        11000001 001 00011 111000 ....1 .....       @zz_1x2
+SQCVTU_sh       11000001 011 00011 111000 ....0 .....       @zz_1x2
+
+SQCVT_sb        11000001 001 10011 111000 ...00 .....       @zz_1x4
+UQCVT_sb        11000001 001 10011 111000 ...01 .....       @zz_1x4
+SQCVTU_sb       11000001 011 10011 111000 ...00 .....       @zz_1x4
+
+SQCVT_dh        11000001 101 10011 111000 ...00 .....       @zz_1x4
+UQCVT_dh        11000001 101 10011 111000 ...01 .....       @zz_1x4
+SQCVTU_dh       11000001 111 10011 111000 ...00 .....       @zz_1x4
+
+SQCVTN_sb       11000001 001 10011 111000 ...10 .....       @zz_1x4
+UQCVTN_sb       11000001 001 10011 111000 ...11 .....       @zz_1x4
+SQCVTUN_sb      11000001 011 10011 111000 ...10 .....       @zz_1x4
+
+SQCVTN_dh       11000001 101 10011 111000 ...10 .....       @zz_1x4
+UQCVTN_dh       11000001 101 10011 111000 ...11 .....       @zz_1x4
+SQCVTUN_dh      11000001 111 10011 111000 ...10 .....       @zz_1x4
diff --git a/target/arm/tcg/sme_helper.c b/target/arm/tcg/sme_helper.c
index d3841400ee..094a1e57f3 100644
--- a/target/arm/tcg/sme_helper.c
+++ b/target/arm/tcg/sme_helper.c
@@ -1568,6 +1568,64 @@ void HELPER(sme2_fcvt_n)(void *vd, void *vs, float_status *fpst, uint32_t desc)
     }
 }
 
+#define SQCVT2(NAME, TW, TN, HW, HN, SAT)                       \
+void HELPER(NAME)(void *vd, void *vs, uint32_t desc)            \
+{                                                               \
+    ARMVectorReg scratch;                                       \
+    size_t oprsz = simd_oprsz(desc), n = oprsz / sizeof(TW);    \
+    TW *s0 = vs, *s1 = vs + sizeof(ARMVectorReg);               \
+    TN *d = vd;                                                 \
+    if (vectors_overlap(vd, 1, vs, 2)) {                        \
+        d = (TN *)&scratch;                                     \
+    }                                                           \
+    for (size_t i = 0; i < n; ++i) {                            \
+        d[HN(i)] = SAT(s0[HW(i)]);                              \
+        d[HN(i + n)] = SAT(s1[HW(i)]);                          \
+    }                                                           \
+    if (d != vd) {                                              \
+        memcpy(vd, d, oprsz);                                   \
+    }                                                           \
+}
+
+SQCVT2(sme2_sqcvt_sh, int32_t, int16_t, H4, H2, do_ssat_h)
+SQCVT2(sme2_uqcvt_sh, uint32_t, uint16_t, H4, H2, do_usat_h)
+SQCVT2(sme2_sqcvtu_sh, int32_t, uint16_t, H4, H2, do_usat_h)
+
+#undef SQCVT2
+
+#define SQCVT4(NAME, TW, TN, HW, HN, SAT)                       \
+void HELPER(NAME)(void *vd, void *vs, uint32_t desc)            \
+{                                                               \
+    ARMVectorReg scratch;                                       \
+    size_t oprsz = simd_oprsz(desc), n = oprsz / sizeof(TW);    \
+    TW *s0 = vs, *s1 = vs + sizeof(ARMVectorReg);               \
+    TW *s2 = vs + 2 * sizeof(ARMVectorReg);                     \
+    TW *s3 = vs + 3 * sizeof(ARMVectorReg);                     \
+    TN *d = vd;                                                 \
+    if (vectors_overlap(vd, 1, vs, 4)) {                        \
+        d = (TN *)&scratch;                                     \
+    }                                                           \
+    for (size_t i = 0; i < n; ++i) {                            \
+        d[HN(i)] = SAT(s0[HW(i)]);                              \
+        d[HN(i + n)] = SAT(s1[HW(i)]);                          \
+        d[HN(i + 2 * n)] = SAT(s2[HW(i)]);                      \
+        d[HN(i + 3 * n)] = SAT(s3[HW(i)]);                      \
+    }                                                           \
+    if (d != vd) {                                              \
+        memcpy(vd, d, oprsz);                                   \
+    }                                                           \
+}
+
+SQCVT4(sme2_sqcvt_sb, int32_t, int8_t, H4, H2, do_ssat_b)
+SQCVT4(sme2_uqcvt_sb, uint32_t, uint8_t, H4, H2, do_usat_b)
+SQCVT4(sme2_sqcvtu_sb, int32_t, uint8_t, H4, H2, do_usat_b)
+
+SQCVT4(sme2_sqcvt_dh, int64_t, int16_t, H8, H2, do_ssat_h)
+SQCVT4(sme2_uqcvt_dh, uint64_t, uint16_t, H8, H2, do_usat_h)
+SQCVT4(sme2_sqcvtu_dh, int64_t, uint16_t, H8, H2, do_usat_h)
+
+#undef SQCVT4
+
 /* Convert and interleave */
 void HELPER(sme2_bfcvtn)(void *vd, void *vs, float_status *fpst, uint32_t desc)
 {
@@ -1599,6 +1657,64 @@ void HELPER(sme2_fcvtn)(void *vd, void *vs, float_status *fpst, uint32_t desc)
     }
 }
 
+#define SQCVTN2(NAME, TW, TN, HW, HN, SAT)                      \
+void HELPER(NAME)(void *vd, void *vs, uint32_t desc)            \
+{                                                               \
+    ARMVectorReg scratch;                                       \
+    size_t oprsz = simd_oprsz(desc), n = oprsz / sizeof(TW);    \
+    TW *s0 = vs, *s1 = vs + sizeof(ARMVectorReg);               \
+    TN *d = vd;                                                 \
+    if (vectors_overlap(vd, 1, vs, 2)) {                        \
+        d = (TN *)&scratch;                                     \
+    }                                                           \
+    for (size_t i = 0; i < n; ++i) {                            \
+        d[HN(2 * i + 0)] = SAT(s0[HW(i)]);                      \
+        d[HN(2 * i + 1)] = SAT(s1[HW(i)]);                      \
+    }                                                           \
+    if (d != vd) {                                              \
+        memcpy(vd, d, oprsz);                                   \
+    }                                                           \
+}
+
+SQCVTN2(sme2_sqcvtn_sh, int32_t, int16_t, H4, H2, do_ssat_h)
+SQCVTN2(sme2_uqcvtn_sh, uint32_t, uint16_t, H4, H2, do_usat_h)
+SQCVTN2(sme2_sqcvtun_sh, int32_t, uint16_t, H4, H2, do_usat_h)
+
+#undef SQCVTN2
+
+#define SQCVTN4(NAME, TW, TN, HW, HN, SAT)                      \
+void HELPER(NAME)(void *vd, void *vs, uint32_t desc)            \
+{                                                               \
+    ARMVectorReg scratch;                                       \
+    size_t oprsz = simd_oprsz(desc), n = oprsz / sizeof(TW);    \
+    TW *s0 = vs, *s1 = vs + sizeof(ARMVectorReg);               \
+    TW *s2 = vs + 2 * sizeof(ARMVectorReg);                     \
+    TW *s3 = vs + 3 * sizeof(ARMVectorReg);                     \
+    TN *d = vd;                                                 \
+    if (vectors_overlap(vd, 1, vs, 4)) {                        \
+        d = (TN *)&scratch;                                     \
+    }                                                           \
+    for (size_t i = 0; i < n; ++i) {                            \
+        d[HN(4 * i + 0)] = SAT(s0[HW(i)]);                      \
+        d[HN(4 * i + 1)] = SAT(s1[HW(i)]);                      \
+        d[HN(4 * i + 2)] = SAT(s2[HW(i)]);                      \
+        d[HN(4 * i + 3)] = SAT(s3[HW(i)]);                      \
+    }                                                           \
+    if (d != vd) {                                              \
+        memcpy(vd, d, oprsz);                                   \
+    }                                                           \
+}
+
+SQCVTN4(sme2_sqcvtn_sb, int32_t, int8_t, H4, H1, do_ssat_b)
+SQCVTN4(sme2_uqcvtn_sb, uint32_t, uint8_t, H4, H1, do_usat_b)
+SQCVTN4(sme2_sqcvtun_sb, int32_t, uint8_t, H4, H1, do_usat_b)
+
+SQCVTN4(sme2_sqcvtn_dh, int64_t, int16_t, H8, H2, do_ssat_h)
+SQCVTN4(sme2_uqcvtn_dh, uint64_t, uint16_t, H8, H2, do_usat_h)
+SQCVTN4(sme2_sqcvtun_dh, int64_t, uint16_t, H8, H2, do_usat_h)
+
+#undef SQCVTN4
+
 /* Expand and convert */
 void HELPER(sme2_fcvt_w)(void *vd, void *vs, float_status *fpst, uint32_t desc)
 {
diff --git a/target/arm/tcg/translate-sme.c b/target/arm/tcg/translate-sme.c
index 4fbc61ae27..dd1a6668fb 100644
--- a/target/arm/tcg/translate-sme.c
+++ b/target/arm/tcg/translate-sme.c
@@ -1384,3 +1384,38 @@ TRANS_FEAT(FRINTM, aa64_sme2, do_zz_fpst, a, float_round_down,
            FPST_A64, gen_helper_gvec_vrint_rm_s)
 TRANS_FEAT(FRINTA, aa64_sme2, do_zz_fpst, a, float_round_ties_away,
            FPST_A64, gen_helper_gvec_vrint_rm_s)
+
+static bool do_zz(DisasContext *s, arg_zz_n *a, int data,
+                  gen_helper_gvec_2 *fn)
+{
+    if (sme_sm_enabled_check(s)) {
+        int svl = streaming_vec_reg_size(s);
+
+        for (int i = 0, n = a->n; i < n; ++i) {
+            tcg_gen_gvec_2_ool(vec_full_reg_offset(s, a->zd + i),
+                               vec_full_reg_offset(s, a->zn + i),
+                               svl, svl, data, fn);
+        }
+    }
+    return true;
+}
+
+TRANS_FEAT(SQCVT_sh, aa64_sme2, do_zz, a, 0, gen_helper_sme2_sqcvt_sh)
+TRANS_FEAT(UQCVT_sh, aa64_sme2, do_zz, a, 0, gen_helper_sme2_uqcvt_sh)
+TRANS_FEAT(SQCVTU_sh, aa64_sme2, do_zz, a, 0, gen_helper_sme2_sqcvtu_sh)
+
+TRANS_FEAT(SQCVT_sb, aa64_sme2, do_zz, a, 0, gen_helper_sme2_sqcvt_sb)
+TRANS_FEAT(UQCVT_sb, aa64_sme2, do_zz, a, 0, gen_helper_sme2_uqcvt_sb)
+TRANS_FEAT(SQCVTU_sb, aa64_sme2, do_zz, a, 0, gen_helper_sme2_sqcvtu_sb)
+
+TRANS_FEAT(SQCVT_dh, aa64_sme2, do_zz, a, 0, gen_helper_sme2_sqcvt_dh)
+TRANS_FEAT(UQCVT_dh, aa64_sme2, do_zz, a, 0, gen_helper_sme2_uqcvt_dh)
+TRANS_FEAT(SQCVTU_dh, aa64_sme2, do_zz, a, 0, gen_helper_sme2_sqcvtu_dh)
+
+TRANS_FEAT(SQCVTN_sb, aa64_sme2, do_zz, a, 0, gen_helper_sme2_sqcvtn_sb)
+TRANS_FEAT(UQCVTN_sb, aa64_sme2, do_zz, a, 0, gen_helper_sme2_uqcvtn_sb)
+TRANS_FEAT(SQCVTUN_sb, aa64_sme2, do_zz, a, 0, gen_helper_sme2_sqcvtun_sb)
+
+TRANS_FEAT(SQCVTN_dh, aa64_sme2, do_zz, a, 0, gen_helper_sme2_sqcvtn_dh)
+TRANS_FEAT(UQCVTN_dh, aa64_sme2, do_zz, a, 0, gen_helper_sme2_uqcvtn_dh)
+TRANS_FEAT(SQCVTUN_dh, aa64_sme2, do_zz, a, 0, gen_helper_sme2_sqcvtun_dh)

From 10168d3912d46d075724dd485aee5eabced7b99f Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:20:23 -0600
Subject: [PATCH 2007/2760] target/arm: Implement SQCVTN, UQCVTN, SQCVTUN for
 SME2/SVE2p1

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-61-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/sve.decode      | 20 ++++++++++++++++----
 target/arm/tcg/translate-sve.c |  7 +++++++
 2 files changed, 23 insertions(+), 4 deletions(-)

diff --git a/target/arm/tcg/sve.decode b/target/arm/tcg/sve.decode
index 83c259def6..f808362f23 100644
--- a/target/arm/tcg/sve.decode
+++ b/target/arm/tcg/sve.decode
@@ -57,6 +57,8 @@
 # as propagated via the MOVPRFX instruction.
 %reg_movprfx    0:5
 
+%rn_ax2         6:4 !function=times_2
+
 ###########################################################################
 # Named attribute sets.  These are used to make nice(er) names
 # when creating helpers common to those for the individual
@@ -102,6 +104,7 @@
 # Two operand
 @pd_pn          ........ esz:2 .. .... ....... rn:4 . rd:4      &rr_esz
 @rd_rn          ........ esz:2 ...... ...... rn:5 rd:5          &rr_esz
+@rd_rnx2        ........ ... ..... ...... ..... rd:5            &rr_esz rn=%rn_ax2
 
 # Two operand with governing predicate, flags setting
 @pd_pg_pn_s     ........ . s:1 ...... .. pg:4 . rn:4 . rd:4     &rpr_s
@@ -1507,13 +1510,22 @@ UABA            01000101 .. 0 ..... 11111 1 ..... .....  @rd_rn_rm
 #### SVE2 Narrowing
 
 ## SVE2 saturating extract narrow
-
 # Bits 23, 18-16 are zero, limited in the translator via esz < 3 & imm == 0.
-SQXTNB          01000101 .. 1 ..... 010 000 ..... .....  @rd_rn_tszimm_shl
+
+{
+  SQCVTN_sh     01000101 00 1 10001 010 000 ....0 .....  @rd_rnx2 esz=1
+  SQXTNB        01000101 .. 1 ..... 010 000 ..... .....  @rd_rn_tszimm_shl
+}
 SQXTNT          01000101 .. 1 ..... 010 001 ..... .....  @rd_rn_tszimm_shl
-UQXTNB          01000101 .. 1 ..... 010 010 ..... .....  @rd_rn_tszimm_shl
+{
+  UQCVTN_sh     01000101 00 1 10001 010 010 ....0 .....  @rd_rnx2 esz=1
+  UQXTNB        01000101 .. 1 ..... 010 010 ..... .....  @rd_rn_tszimm_shl
+}
 UQXTNT          01000101 .. 1 ..... 010 011 ..... .....  @rd_rn_tszimm_shl
-SQXTUNB         01000101 .. 1 ..... 010 100 ..... .....  @rd_rn_tszimm_shl
+{
+  SQCVTUN_sh    01000101 00 1 10001 010 100 ....0 .....  @rd_rnx2 esz=1
+  SQXTUNB       01000101 .. 1 ..... 010 100 ..... .....  @rd_rn_tszimm_shl
+}
 SQXTUNT         01000101 .. 1 ..... 010 101 ..... .....  @rd_rn_tszimm_shl
 
 ## SVE2 bitwise shift right narrow
diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
index 10261e25f9..ac4dc7db46 100644
--- a/target/arm/tcg/translate-sve.c
+++ b/target/arm/tcg/translate-sve.c
@@ -7427,3 +7427,10 @@ static void gen_uclamp(unsigned vece, uint32_t d, uint32_t n, uint32_t m,
 }
 
 TRANS_FEAT(UCLAMP, aa64_sme, gen_gvec_fn_arg_zzzz, gen_uclamp, a)
+
+TRANS_FEAT(SQCVTN_sh, aa64_sme2_or_sve2p1, gen_gvec_ool_zz,
+           gen_helper_sme2_sqcvtn_sh, a->rd, a->rn, 0)
+TRANS_FEAT(UQCVTN_sh, aa64_sme2_or_sve2p1, gen_gvec_ool_zz,
+           gen_helper_sme2_uqcvtn_sh, a->rd, a->rn, 0)
+TRANS_FEAT(SQCVTUN_sh, aa64_sme2_or_sve2p1, gen_gvec_ool_zz,
+           gen_helper_sme2_sqcvtun_sh, a->rd, a->rn, 0)

From 2ccea621573dd8c2aa23583947d598fe8382b93c Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:20:24 -0600
Subject: [PATCH 2008/2760] target/arm: Implement SME2 SUNPK, UUNPK

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20250704142112.1018902-62-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/helper-sme.h    | 13 ++++++++++++
 target/arm/tcg/sme.decode      | 18 ++++++++++++++++
 target/arm/tcg/sme_helper.c    | 38 ++++++++++++++++++++++++++++++++++
 target/arm/tcg/translate-sme.c | 16 ++++++++++++++
 4 files changed, 85 insertions(+)

diff --git a/target/arm/tcg/helper-sme.h b/target/arm/tcg/helper-sme.h
index 792b993695..893b23aa3b 100644
--- a/target/arm/tcg/helper-sme.h
+++ b/target/arm/tcg/helper-sme.h
@@ -241,3 +241,16 @@ DEF_HELPER_FLAGS_3(sme2_sqcvtun_sh, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 DEF_HELPER_FLAGS_3(sme2_sqcvtn_dh, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 DEF_HELPER_FLAGS_3(sme2_uqcvtn_dh, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 DEF_HELPER_FLAGS_3(sme2_sqcvtun_dh, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_3(sme2_sunpk2_bh, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(sme2_sunpk2_hs, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(sme2_sunpk2_sd, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(sme2_sunpk4_bh, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(sme2_sunpk4_hs, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(sme2_sunpk4_sd, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(sme2_uunpk2_bh, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(sme2_uunpk2_hs, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(sme2_uunpk2_sd, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(sme2_uunpk4_bh, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(sme2_uunpk4_hs, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(sme2_uunpk4_sd, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
diff --git a/target/arm/tcg/sme.decode b/target/arm/tcg/sme.decode
index e005f6e6ed..38c210cd4f 100644
--- a/target/arm/tcg/sme.decode
+++ b/target/arm/tcg/sme.decode
@@ -734,6 +734,8 @@ SUB_aaz_d       11000001 111 000010 .. 111 ...00 11 ...     @az_4x4_o3
                 &zz_n n=2 zd=%zd_ax2 zn=%zn_ax2
 @zz_4x4         ........ ... ..... ...... .... . .....      \
                 &zz_n n=4 zd=%zd_ax4 zn=%zn_ax4
+@zz_4x2_n1      ........ ... ..... ...... .... . .....      \
+                &zz_n n=1 zd=%zd_ax4 zn=%zn_ax2
 
 BFCVT           11000001 011 00000 111000 ....0 .....       @zz_1x2
 BFCVTN          11000001 011 00000 111000 ....1 .....       @zz_1x2
@@ -782,3 +784,19 @@ SQCVTUN_sb      11000001 011 10011 111000 ...10 .....       @zz_1x4
 SQCVTN_dh       11000001 101 10011 111000 ...10 .....       @zz_1x4
 UQCVTN_dh       11000001 101 10011 111000 ...11 .....       @zz_1x4
 SQCVTUN_dh      11000001 111 10011 111000 ...10 .....       @zz_1x4
+
+SUNPK_2bh       11000001 011 00101 111000 ..... ....0       @zz_2x1
+SUNPK_2hs       11000001 101 00101 111000 ..... ....0       @zz_2x1
+SUNPK_2sd       11000001 111 00101 111000 ..... ....0       @zz_2x1
+
+UUNPK_2bh       11000001 011 00101 111000 ..... ....1       @zz_2x1
+UUNPK_2hs       11000001 101 00101 111000 ..... ....1       @zz_2x1
+UUNPK_2sd       11000001 111 00101 111000 ..... ....1       @zz_2x1
+
+SUNPK_4bh       11000001 011 10101 111000 ....0 ...00       @zz_4x2_n1
+SUNPK_4hs       11000001 101 10101 111000 ....0 ...00       @zz_4x2_n1
+SUNPK_4sd       11000001 111 10101 111000 ....0 ...00       @zz_4x2_n1
+
+UUNPK_4bh       11000001 011 10101 111000 ....0 ...01       @zz_4x2_n1
+UUNPK_4hs       11000001 101 10101 111000 ....0 ...01       @zz_4x2_n1
+UUNPK_4sd       11000001 111 10101 111000 ....0 ...01       @zz_4x2_n1
diff --git a/target/arm/tcg/sme_helper.c b/target/arm/tcg/sme_helper.c
index 094a1e57f3..ee4596e066 100644
--- a/target/arm/tcg/sme_helper.c
+++ b/target/arm/tcg/sme_helper.c
@@ -1737,6 +1737,44 @@ void HELPER(sme2_fcvt_w)(void *vd, void *vs, float_status *fpst, uint32_t desc)
     }
 }
 
+#define UNPK(NAME, SREG, TW, TN, HW, HN)                        \
+void HELPER(NAME)(void *vd, void *vs, uint32_t desc)            \
+{                                                               \
+    ARMVectorReg scratch[SREG];                                 \
+    size_t oprsz = simd_oprsz(desc);                            \
+    size_t n = oprsz / sizeof(TW);                              \
+    if (vectors_overlap(vd, 2 * SREG, vs, SREG)) {              \
+        vs = memcpy(scratch, vs, sizeof(scratch));              \
+    }                                                           \
+    for (size_t r = 0; r < SREG; ++r) {                         \
+        TN *s = vs + r * sizeof(ARMVectorReg);                  \
+        for (size_t i = 0; i < 2; ++i) {                        \
+            TW *d = vd + (2 * r + i) * sizeof(ARMVectorReg);    \
+            for (size_t e = 0; e < n; ++e) {                    \
+                d[HW(e)] = s[HN(i * n + e)];                    \
+            }                                                   \
+        }                                                       \
+    }                                                           \
+}
+
+UNPK(sme2_sunpk2_bh, 1, int16_t, int8_t, H2, H1)
+UNPK(sme2_sunpk2_hs, 1, int32_t, int16_t, H4, H2)
+UNPK(sme2_sunpk2_sd, 1, int64_t, int32_t, H8, H4)
+
+UNPK(sme2_sunpk4_bh, 2, int16_t, int8_t, H2, H1)
+UNPK(sme2_sunpk4_hs, 2, int32_t, int16_t, H4, H2)
+UNPK(sme2_sunpk4_sd, 2, int64_t, int32_t, H8, H4)
+
+UNPK(sme2_uunpk2_bh, 1, uint16_t, uint8_t, H2, H1)
+UNPK(sme2_uunpk2_hs, 1, uint32_t, uint16_t, H4, H2)
+UNPK(sme2_uunpk2_sd, 1, uint64_t, uint32_t, H8, H4)
+
+UNPK(sme2_uunpk4_bh, 2, uint16_t, uint8_t, H2, H1)
+UNPK(sme2_uunpk4_hs, 2, uint32_t, uint16_t, H4, H2)
+UNPK(sme2_uunpk4_sd, 2, uint64_t, uint32_t, H8, H4)
+
+#undef UNPK
+
 /* Deinterleave and convert. */
 void HELPER(sme2_fcvtl)(void *vd, void *vs, float_status *fpst, uint32_t desc)
 {
diff --git a/target/arm/tcg/translate-sme.c b/target/arm/tcg/translate-sme.c
index dd1a6668fb..b45e68750d 100644
--- a/target/arm/tcg/translate-sme.c
+++ b/target/arm/tcg/translate-sme.c
@@ -1419,3 +1419,19 @@ TRANS_FEAT(SQCVTUN_sb, aa64_sme2, do_zz, a, 0, gen_helper_sme2_sqcvtun_sb)
 TRANS_FEAT(SQCVTN_dh, aa64_sme2, do_zz, a, 0, gen_helper_sme2_sqcvtn_dh)
 TRANS_FEAT(UQCVTN_dh, aa64_sme2, do_zz, a, 0, gen_helper_sme2_uqcvtn_dh)
 TRANS_FEAT(SQCVTUN_dh, aa64_sme2, do_zz, a, 0, gen_helper_sme2_sqcvtun_dh)
+
+TRANS_FEAT(SUNPK_2bh, aa64_sme2, do_zz, a, 0, gen_helper_sme2_sunpk2_bh)
+TRANS_FEAT(SUNPK_2hs, aa64_sme2, do_zz, a, 0, gen_helper_sme2_sunpk2_hs)
+TRANS_FEAT(SUNPK_2sd, aa64_sme2, do_zz, a, 0, gen_helper_sme2_sunpk2_sd)
+
+TRANS_FEAT(SUNPK_4bh, aa64_sme2, do_zz, a, 0, gen_helper_sme2_sunpk4_bh)
+TRANS_FEAT(SUNPK_4hs, aa64_sme2, do_zz, a, 0, gen_helper_sme2_sunpk4_hs)
+TRANS_FEAT(SUNPK_4sd, aa64_sme2, do_zz, a, 0, gen_helper_sme2_sunpk4_sd)
+
+TRANS_FEAT(UUNPK_2bh, aa64_sme2, do_zz, a, 0, gen_helper_sme2_uunpk2_bh)
+TRANS_FEAT(UUNPK_2hs, aa64_sme2, do_zz, a, 0, gen_helper_sme2_uunpk2_hs)
+TRANS_FEAT(UUNPK_2sd, aa64_sme2, do_zz, a, 0, gen_helper_sme2_uunpk2_sd)
+
+TRANS_FEAT(UUNPK_4bh, aa64_sme2, do_zz, a, 0, gen_helper_sme2_uunpk4_bh)
+TRANS_FEAT(UUNPK_4hs, aa64_sme2, do_zz, a, 0, gen_helper_sme2_uunpk4_hs)
+TRANS_FEAT(UUNPK_4sd, aa64_sme2, do_zz, a, 0, gen_helper_sme2_uunpk4_sd)

From a3a019c0efc06e63c648c416484ed5083678c93d Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:20:25 -0600
Subject: [PATCH 2009/2760] target/arm: Implement SME2 ZIP, UZP (four
 registers)

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-63-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/helper-sme.h    | 12 ++++++
 target/arm/tcg/sme.decode      | 11 ++++++
 target/arm/tcg/sme_helper.c    | 68 ++++++++++++++++++++++++++++++++++
 target/arm/tcg/translate-sme.c | 39 +++++++++++++++++++
 4 files changed, 130 insertions(+)

diff --git a/target/arm/tcg/helper-sme.h b/target/arm/tcg/helper-sme.h
index 893b23aa3b..7e21f1095a 100644
--- a/target/arm/tcg/helper-sme.h
+++ b/target/arm/tcg/helper-sme.h
@@ -254,3 +254,15 @@ DEF_HELPER_FLAGS_3(sme2_uunpk2_sd, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 DEF_HELPER_FLAGS_3(sme2_uunpk4_bh, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 DEF_HELPER_FLAGS_3(sme2_uunpk4_hs, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 DEF_HELPER_FLAGS_3(sme2_uunpk4_sd, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_3(sme2_zip4_b, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(sme2_zip4_h, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(sme2_zip4_s, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(sme2_zip4_d, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(sme2_zip4_q, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_3(sme2_uzp4_b, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(sme2_uzp4_h, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(sme2_uzp4_s, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(sme2_uzp4_d, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(sme2_uzp4_q, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
diff --git a/target/arm/tcg/sme.decode b/target/arm/tcg/sme.decode
index 38c210cd4f..81783b4705 100644
--- a/target/arm/tcg/sme.decode
+++ b/target/arm/tcg/sme.decode
@@ -723,6 +723,7 @@ SUB_aaz_d       11000001 111 000010 .. 111 ...00 11 ...     @az_4x4_o3
 
 ### SME2 Multi-vector SVE Constructive Unary
 
+&zz_e           zd zn esz
 &zz_n           zd zn n
 @zz_1x2         ........ ... ..... ...... ..... zd:5        \
                 &zz_n n=1 zn=%zn_ax2
@@ -800,3 +801,13 @@ SUNPK_4sd       11000001 111 10101 111000 ....0 ...00       @zz_4x2_n1
 UUNPK_4bh       11000001 011 10101 111000 ....0 ...01       @zz_4x2_n1
 UUNPK_4hs       11000001 101 10101 111000 ....0 ...01       @zz_4x2_n1
 UUNPK_4sd       11000001 111 10101 111000 ....0 ...01       @zz_4x2_n1
+
+ZIP_4           11000001 esz:2 1 10110 111000 ...00 ... 00   \
+                &zz_e zd=%zd_ax4 zn=%zn_ax4
+ZIP_4           11000001 001     10111 111000 ...00 ... 00   \
+                &zz_e esz=4 zd=%zd_ax4 zn=%zn_ax4
+
+UZP_4           11000001 esz:2 1 10110 111000 ...00 ... 10   \
+                &zz_e zd=%zd_ax4 zn=%zn_ax4
+UZP_4           11000001 001     10111 111000 ...00 ... 10   \
+                &zz_e esz=4 zd=%zd_ax4 zn=%zn_ax4
diff --git a/target/arm/tcg/sme_helper.c b/target/arm/tcg/sme_helper.c
index ee4596e066..4a05fff5fe 100644
--- a/target/arm/tcg/sme_helper.c
+++ b/target/arm/tcg/sme_helper.c
@@ -1812,3 +1812,71 @@ void HELPER(sme2_ucvtf)(void *vd, void *vs, float_status *fpst, uint32_t desc)
         d[i] = uint32_to_float32(s[i], fpst);
     }
 }
+
+#define ZIP4(NAME, TYPE, H)                                     \
+void HELPER(NAME)(void *vd, void *vs, uint32_t desc)            \
+{                                                               \
+    ARMVectorReg scratch[4];                                    \
+    size_t oprsz = simd_oprsz(desc);                            \
+    size_t quads = oprsz / (sizeof(TYPE) * 4);                  \
+    TYPE *s0, *s1, *s2, *s3;                                    \
+    if (vs == vd) {                                             \
+        vs = memcpy(scratch, vs, sizeof(scratch));              \
+    }                                                           \
+    s0 = vs;                                                    \
+    s1 = vs + sizeof(ARMVectorReg);                             \
+    s2 = vs + 2 * sizeof(ARMVectorReg);                         \
+    s3 = vs + 3 * sizeof(ARMVectorReg);                         \
+    for (size_t r = 0; r < 4; ++r) {                            \
+        TYPE *d = vd + r * sizeof(ARMVectorReg);                \
+        size_t base = r * quads;                                \
+        for (size_t q = 0; q < quads; ++q) {                    \
+            d[H(4 * q + 0)] = s0[base + H(q)];                  \
+            d[H(4 * q + 1)] = s1[base + H(q)];                  \
+            d[H(4 * q + 2)] = s2[base + H(q)];                  \
+            d[H(4 * q + 3)] = s3[base + H(q)];                  \
+        }                                                       \
+    }                                                           \
+}
+
+ZIP4(sme2_zip4_b, uint8_t, H1)
+ZIP4(sme2_zip4_h, uint16_t, H2)
+ZIP4(sme2_zip4_s, uint32_t, H4)
+ZIP4(sme2_zip4_d, uint64_t, )
+ZIP4(sme2_zip4_q, Int128, )
+
+#undef ZIP4
+
+#define UZP4(NAME, TYPE, H)                                     \
+void HELPER(NAME)(void *vd, void *vs, uint32_t desc)            \
+{                                                               \
+    ARMVectorReg scratch[4];                                    \
+    size_t oprsz = simd_oprsz(desc);                            \
+    size_t quads = oprsz / (sizeof(TYPE) * 4);                  \
+    TYPE *d0, *d1, *d2, *d3;                                    \
+    if (vs == vd) {                                             \
+        vs = memcpy(scratch, vs, sizeof(scratch));              \
+    }                                                           \
+    d0 = vd;                                                    \
+    d1 = vd + sizeof(ARMVectorReg);                             \
+    d2 = vd + 2 * sizeof(ARMVectorReg);                         \
+    d3 = vd + 3 * sizeof(ARMVectorReg);                         \
+    for (size_t r = 0; r < 4; ++r) {                            \
+        TYPE *s = vs + r * sizeof(ARMVectorReg);                \
+        size_t base = r * quads;                                \
+        for (size_t q = 0; q < quads; ++q) {                    \
+            d0[base + H(q)] = s[H(4 * q + 0)];                  \
+            d1[base + H(q)] = s[H(4 * q + 1)];                  \
+            d2[base + H(q)] = s[H(4 * q + 2)];                  \
+            d3[base + H(q)] = s[H(4 * q + 3)];                  \
+        }                                                       \
+    }                                                           \
+}
+
+UZP4(sme2_uzp4_b, uint8_t, H1)
+UZP4(sme2_uzp4_h, uint16_t, H2)
+UZP4(sme2_uzp4_s, uint32_t, H4)
+UZP4(sme2_uzp4_d, uint64_t, )
+UZP4(sme2_uzp4_q, Int128, )
+
+#undef UZP4
diff --git a/target/arm/tcg/translate-sme.c b/target/arm/tcg/translate-sme.c
index b45e68750d..de9545ee6d 100644
--- a/target/arm/tcg/translate-sme.c
+++ b/target/arm/tcg/translate-sme.c
@@ -1435,3 +1435,42 @@ TRANS_FEAT(UUNPK_2sd, aa64_sme2, do_zz, a, 0, gen_helper_sme2_uunpk2_sd)
 TRANS_FEAT(UUNPK_4bh, aa64_sme2, do_zz, a, 0, gen_helper_sme2_uunpk4_bh)
 TRANS_FEAT(UUNPK_4hs, aa64_sme2, do_zz, a, 0, gen_helper_sme2_uunpk4_hs)
 TRANS_FEAT(UUNPK_4sd, aa64_sme2, do_zz, a, 0, gen_helper_sme2_uunpk4_sd)
+
+static bool do_zipuzp_4(DisasContext *s, arg_zz_e *a,
+                        gen_helper_gvec_2 * const fn[5])
+{
+    int bytes_per_op = 4 << a->esz;
+
+    /* Both MO_64 and MO_128 can fail the size test. */
+    if (s->max_svl < bytes_per_op) {
+        unallocated_encoding(s);
+    } else if (sme_sm_enabled_check(s)) {
+        int svl = streaming_vec_reg_size(s);
+        if (svl < bytes_per_op) {
+            unallocated_encoding(s);
+        } else {
+            tcg_gen_gvec_2_ool(vec_full_reg_offset(s, a->zd),
+                               vec_full_reg_offset(s, a->zn),
+                               svl, svl, 0, fn[a->esz]);
+        }
+    }
+    return true;
+}
+
+static gen_helper_gvec_2 * const zip4_fns[] = {
+    gen_helper_sme2_zip4_b,
+    gen_helper_sme2_zip4_h,
+    gen_helper_sme2_zip4_s,
+    gen_helper_sme2_zip4_d,
+    gen_helper_sme2_zip4_q,
+};
+TRANS_FEAT(ZIP_4, aa64_sme2, do_zipuzp_4, a, zip4_fns)
+
+static gen_helper_gvec_2 * const uzp4_fns[] = {
+    gen_helper_sme2_uzp4_b,
+    gen_helper_sme2_uzp4_h,
+    gen_helper_sme2_uzp4_s,
+    gen_helper_sme2_uzp4_d,
+    gen_helper_sme2_uzp4_q,
+};
+TRANS_FEAT(UZP_4, aa64_sme2, do_zipuzp_4, a, uzp4_fns)

From 9a7d445c09aa79a14bc4c5eede635b043622cbf0 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:20:26 -0600
Subject: [PATCH 2010/2760] target/arm: Move do_urshr, do_srshr to
 vec_internal.h

Unify two copies of these inline functions.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-64-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/mve_helper.c   | 21 ---------------------
 target/arm/tcg/sve_helper.c   | 21 ---------------------
 target/arm/tcg/vec_internal.h | 21 +++++++++++++++++++++
 3 files changed, 21 insertions(+), 42 deletions(-)

diff --git a/target/arm/tcg/mve_helper.c b/target/arm/tcg/mve_helper.c
index 42bb3b979b..63ddcf3fec 100644
--- a/target/arm/tcg/mve_helper.c
+++ b/target/arm/tcg/mve_helper.c
@@ -2204,27 +2204,6 @@ DO_VSHLL_ALL(vshllt, true)
     DO_VSHRN(OP##tb, true, 1, uint8_t, 2, uint16_t, FN)         \
     DO_VSHRN(OP##th, true, 2, uint16_t, 4, uint32_t, FN)
 
-static inline uint64_t do_urshr(uint64_t x, unsigned sh)
-{
-    if (likely(sh < 64)) {
-        return (x >> sh) + ((x >> (sh - 1)) & 1);
-    } else if (sh == 64) {
-        return x >> 63;
-    } else {
-        return 0;
-    }
-}
-
-static inline int64_t do_srshr(int64_t x, unsigned sh)
-{
-    if (likely(sh < 64)) {
-        return (x >> sh) + ((x >> (sh - 1)) & 1);
-    } else {
-        /* Rounding the sign bit always produces 0. */
-        return 0;
-    }
-}
-
 DO_VSHRN_ALL(vshrn, DO_SHR)
 DO_VSHRN_ALL(vrshrn, do_urshr)
 
diff --git a/target/arm/tcg/sve_helper.c b/target/arm/tcg/sve_helper.c
index f9052f2164..0e59ad2262 100644
--- a/target/arm/tcg/sve_helper.c
+++ b/target/arm/tcg/sve_helper.c
@@ -2050,27 +2050,6 @@ void HELPER(NAME)(void *vd, void *vn, void *vg, uint32_t desc)  \
    when N is negative, add 2**M-1.  */
 #define DO_ASRD(N, M) ((N + (N < 0 ? ((__typeof(N))1 << M) - 1 : 0)) >> M)
 
-static inline uint64_t do_urshr(uint64_t x, unsigned sh)
-{
-    if (likely(sh < 64)) {
-        return (x >> sh) + ((x >> (sh - 1)) & 1);
-    } else if (sh == 64) {
-        return x >> 63;
-    } else {
-        return 0;
-    }
-}
-
-static inline int64_t do_srshr(int64_t x, unsigned sh)
-{
-    if (likely(sh < 64)) {
-        return (x >> sh) + ((x >> (sh - 1)) & 1);
-    } else {
-        /* Rounding the sign bit always produces 0. */
-        return 0;
-    }
-}
-
 DO_ZPZI(sve_asr_zpzi_b, int8_t, H1, DO_SHR)
 DO_ZPZI(sve_asr_zpzi_h, int16_t, H1_2, DO_SHR)
 DO_ZPZI(sve_asr_zpzi_s, int32_t, H1_4, DO_SHR)
diff --git a/target/arm/tcg/vec_internal.h b/target/arm/tcg/vec_internal.h
index a1c10c60a1..5efd257c50 100644
--- a/target/arm/tcg/vec_internal.h
+++ b/target/arm/tcg/vec_internal.h
@@ -230,6 +230,27 @@ int64_t do_sqrdmlah_d(int64_t, int64_t, int64_t, bool, bool);
 #define do_usat_h(val)  MIN(MAX(val, 0), UINT16_MAX)
 #define do_usat_s(val)  MIN(MAX(val, 0), UINT32_MAX)
 
+static inline uint64_t do_urshr(uint64_t x, unsigned sh)
+{
+    if (likely(sh < 64)) {
+        return (x >> sh) + ((x >> (sh - 1)) & 1);
+    } else if (sh == 64) {
+        return x >> 63;
+    } else {
+        return 0;
+    }
+}
+
+static inline int64_t do_srshr(int64_t x, unsigned sh)
+{
+    if (likely(sh < 64)) {
+        return (x >> sh) + ((x >> (sh - 1)) & 1);
+    } else {
+        /* Rounding the sign bit always produces 0. */
+        return 0;
+    }
+}
+
 /**
  * bfdotadd:
  * @sum: addend

From 70ad5b9fb172709d1e8bb8718c4e180e46967b8b Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:20:27 -0600
Subject: [PATCH 2011/2760] target/arm: Implement SME2 SQRSHR, UQRSHR, SQRSHRN

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20250704142112.1018902-65-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/helper-sme.h    |  20 ++++++
 target/arm/tcg/sme.decode      |  37 ++++++++++
 target/arm/tcg/sme_helper.c    | 120 +++++++++++++++++++++++++++++++++
 target/arm/tcg/translate-sme.c |  33 +++++++++
 4 files changed, 210 insertions(+)

diff --git a/target/arm/tcg/helper-sme.h b/target/arm/tcg/helper-sme.h
index 7e21f1095a..97428bcd6b 100644
--- a/target/arm/tcg/helper-sme.h
+++ b/target/arm/tcg/helper-sme.h
@@ -266,3 +266,23 @@ DEF_HELPER_FLAGS_3(sme2_uzp4_h, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 DEF_HELPER_FLAGS_3(sme2_uzp4_s, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 DEF_HELPER_FLAGS_3(sme2_uzp4_d, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 DEF_HELPER_FLAGS_3(sme2_uzp4_q, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_3(sme2_sqrshr_sh, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(sme2_uqrshr_sh, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(sme2_sqrshru_sh, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(sme2_sqrshr_sb, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(sme2_uqrshr_sb, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(sme2_sqrshru_sb, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(sme2_sqrshr_dh, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(sme2_uqrshr_dh, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(sme2_sqrshru_dh, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_3(sme2_sqrshrn_sh, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(sme2_uqrshrn_sh, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(sme2_sqrshrun_sh, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(sme2_sqrshrn_sb, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(sme2_uqrshrn_sb, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(sme2_sqrshrun_sb, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(sme2_sqrshrn_dh, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(sme2_uqrshrn_dh, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(sme2_sqrshrun_dh, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
diff --git a/target/arm/tcg/sme.decode b/target/arm/tcg/sme.decode
index 81783b4705..05d513efba 100644
--- a/target/arm/tcg/sme.decode
+++ b/target/arm/tcg/sme.decode
@@ -811,3 +811,40 @@ UZP_4           11000001 esz:2 1 10110 111000 ...00 ... 10   \
                 &zz_e zd=%zd_ax4 zn=%zn_ax4
 UZP_4           11000001 001     10111 111000 ...00 ... 10   \
                 &zz_e esz=4 zd=%zd_ax4 zn=%zn_ax4
+
+### SME2 Multi-vector SVE Constructive Binary
+
+&rshr           zd zn shift
+
+%rshr_sh_shift  16:4 !function=rsub_16
+%rshr_sb_shift  16:5 !function=rsub_32
+%rshr_dh_shift  22:1 16:5 !function=rsub_64
+
+@rshr_sh        ........ .... .... ...... ..... zd:5        \
+                &rshr zn=%zn_ax2 shift=%rshr_sh_shift
+@rshr_sb        ........ ... ..... ...... ..... zd:5        \
+                &rshr zn=%zn_ax4 shift=%rshr_sb_shift
+@rshr_dh        ........ ... ..... ...... ..... zd:5        \
+                &rshr zn=%zn_ax4 shift=%rshr_dh_shift
+
+SQRSHR_sh       11000001 1110 .... 110101 ....0 .....       @rshr_sh
+UQRSHR_sh       11000001 1110 .... 110101 ....1 .....       @rshr_sh
+SQRSHRU_sh      11000001 1111 .... 110101 ....0 .....       @rshr_sh
+
+SQRSHR_sb       11000001 011 ..... 110110 ...00 .....       @rshr_sb
+SQRSHR_dh       11000001 1.1 ..... 110110 ...00 .....       @rshr_dh
+UQRSHR_sb       11000001 011 ..... 110110 ...01 .....       @rshr_sb
+UQRSHR_dh       11000001 1.1 ..... 110110 ...01 .....       @rshr_dh
+SQRSHRU_sb      11000001 011 ..... 110110 ...10 .....       @rshr_sb
+SQRSHRU_dh      11000001 1.1 ..... 110110 ...10 .....       @rshr_dh
+
+SQRSHRN_sh      01000101 1011 .... 001010 ....0 .....       @rshr_sh
+UQRSHRN_sh      01000101 1011 .... 001110 ....0 .....       @rshr_sh
+SQRSHRUN_sh     01000101 1011 .... 000010 ....0 .....       @rshr_sh
+
+SQRSHRN_sb      11000001 011 ..... 110111 ...00 .....       @rshr_sb
+SQRSHRN_dh      11000001 1.1 ..... 110111 ...00 .....       @rshr_dh
+UQRSHRN_sb      11000001 011 ..... 110111 ...01 .....       @rshr_sb
+UQRSHRN_dh      11000001 1.1 ..... 110111 ...01 .....       @rshr_dh
+SQRSHRUN_sb     11000001 011 ..... 110111 ...10 .....       @rshr_sb
+SQRSHRUN_dh     11000001 1.1 ..... 110111 ...10 .....       @rshr_dh
diff --git a/target/arm/tcg/sme_helper.c b/target/arm/tcg/sme_helper.c
index 4a05fff5fe..2e95fe38cd 100644
--- a/target/arm/tcg/sme_helper.c
+++ b/target/arm/tcg/sme_helper.c
@@ -1626,6 +1626,66 @@ SQCVT4(sme2_sqcvtu_dh, int64_t, uint16_t, H8, H2, do_usat_h)
 
 #undef SQCVT4
 
+#define SQRSHR2(NAME, TW, TN, HW, HN, RSHR, SAT)                \
+void HELPER(NAME)(void *vd, void *vs, uint32_t desc)            \
+{                                                               \
+    ARMVectorReg scratch;                                       \
+    size_t oprsz = simd_oprsz(desc), n = oprsz / sizeof(TW);    \
+    int shift = simd_data(desc);                                \
+    TW *s0 = vs, *s1 = vs + sizeof(ARMVectorReg);               \
+    TN *d = vd;                                                 \
+    if (vectors_overlap(vd, 1, vs, 2)) {                        \
+        d = (TN *)&scratch;                                     \
+    }                                                           \
+    for (size_t i = 0; i < n; ++i) {                            \
+        d[HN(i)] = SAT(RSHR(s0[HW(i)], shift));                 \
+        d[HN(i + n)] = SAT(RSHR(s1[HW(i)], shift));             \
+    }                                                           \
+    if (d != vd) {                                              \
+        memcpy(vd, d, oprsz);                                   \
+    }                                                           \
+}
+
+SQRSHR2(sme2_sqrshr_sh, int32_t, int16_t, H4, H2, do_srshr, do_ssat_h)
+SQRSHR2(sme2_uqrshr_sh, uint32_t, uint16_t, H4, H2, do_urshr, do_usat_h)
+SQRSHR2(sme2_sqrshru_sh, int32_t, uint16_t, H4, H2, do_srshr, do_usat_h)
+
+#undef SQRSHR2
+
+#define SQRSHR4(NAME, TW, TN, HW, HN, RSHR, SAT)                \
+void HELPER(NAME)(void *vd, void *vs, uint32_t desc)            \
+{                                                               \
+    ARMVectorReg scratch;                                       \
+    size_t oprsz = simd_oprsz(desc), n = oprsz / sizeof(TW);    \
+    int shift = simd_data(desc);                                \
+    TW *s0 = vs, *s1 = vs + sizeof(ARMVectorReg);               \
+    TW *s2 = vs + 2 * sizeof(ARMVectorReg);                     \
+    TW *s3 = vs + 3 * sizeof(ARMVectorReg);                     \
+    TN *d = vd;                                                 \
+    if (vectors_overlap(vd, 1, vs, 4)) {                        \
+        d = (TN *)&scratch;                                     \
+    }                                                           \
+    for (size_t i = 0; i < n; ++i) {                            \
+        d[HN(i)] = SAT(RSHR(s0[HW(i)], shift));                 \
+        d[HN(i + n)] = SAT(RSHR(s1[HW(i)], shift));             \
+        d[HN(i + 2 * n)] = SAT(RSHR(s2[HW(i)], shift));         \
+        d[HN(i + 3 * n)] = SAT(RSHR(s3[HW(i)], shift));         \
+    }                                                           \
+    if (d != vd) {                                              \
+        memcpy(vd, d, oprsz);                                   \
+    }                                                           \
+}
+
+SQRSHR4(sme2_sqrshr_sb, int32_t, int8_t, H4, H2, do_srshr, do_ssat_b)
+SQRSHR4(sme2_uqrshr_sb, uint32_t, uint8_t, H4, H2, do_urshr, do_usat_b)
+SQRSHR4(sme2_sqrshru_sb, int32_t, uint8_t, H4, H2, do_srshr, do_usat_b)
+
+SQRSHR4(sme2_sqrshr_dh, int64_t, int16_t, H8, H2, do_srshr, do_ssat_h)
+SQRSHR4(sme2_uqrshr_dh, uint64_t, uint16_t, H8, H2, do_urshr, do_usat_h)
+SQRSHR4(sme2_sqrshru_dh, int64_t, uint16_t, H8, H2, do_srshr, do_usat_h)
+
+#undef SQRSHR4
+
 /* Convert and interleave */
 void HELPER(sme2_bfcvtn)(void *vd, void *vs, float_status *fpst, uint32_t desc)
 {
@@ -1715,6 +1775,66 @@ SQCVTN4(sme2_sqcvtun_dh, int64_t, uint16_t, H8, H2, do_usat_h)
 
 #undef SQCVTN4
 
+#define SQRSHRN2(NAME, TW, TN, HW, HN, RSHR, SAT)               \
+void HELPER(NAME)(void *vd, void *vs, uint32_t desc)            \
+{                                                               \
+    ARMVectorReg scratch;                                       \
+    size_t oprsz = simd_oprsz(desc), n = oprsz / sizeof(TW);    \
+    int shift = simd_data(desc);                                \
+    TW *s0 = vs, *s1 = vs + sizeof(ARMVectorReg);               \
+    TN *d = vd;                                                 \
+    if (vectors_overlap(vd, 1, vs, 2)) {                        \
+        d = (TN *)&scratch;                                     \
+    }                                                           \
+    for (size_t i = 0; i < n; ++i) {                            \
+        d[HN(2 * i + 0)] = SAT(RSHR(s0[HW(i)], shift));         \
+        d[HN(2 * i + 1)] = SAT(RSHR(s1[HW(i)], shift));         \
+    }                                                           \
+    if (d != vd) {                                              \
+        memcpy(vd, d, oprsz);                                   \
+    }                                                           \
+}
+
+SQRSHRN2(sme2_sqrshrn_sh, int32_t, int16_t, H4, H2, do_srshr, do_ssat_h)
+SQRSHRN2(sme2_uqrshrn_sh, uint32_t, uint16_t, H4, H2, do_urshr, do_usat_h)
+SQRSHRN2(sme2_sqrshrun_sh, int32_t, uint16_t, H4, H2, do_srshr, do_usat_h)
+
+#undef SQRSHRN2
+
+#define SQRSHRN4(NAME, TW, TN, HW, HN, RSHR, SAT)               \
+void HELPER(NAME)(void *vd, void *vs, uint32_t desc)            \
+{                                                               \
+    ARMVectorReg scratch;                                       \
+    size_t oprsz = simd_oprsz(desc), n = oprsz / sizeof(TW);    \
+    int shift = simd_data(desc);                                \
+    TW *s0 = vs, *s1 = vs + sizeof(ARMVectorReg);               \
+    TW *s2 = vs + 2 * sizeof(ARMVectorReg);                     \
+    TW *s3 = vs + 3 * sizeof(ARMVectorReg);                     \
+    TN *d = vd;                                                 \
+    if (vectors_overlap(vd, 1, vs, 4)) {                        \
+        d = (TN *)&scratch;                                     \
+    }                                                           \
+    for (size_t i = 0; i < n; ++i) {                            \
+        d[HN(4 * i + 0)] = SAT(RSHR(s0[HW(i)], shift));         \
+        d[HN(4 * i + 1)] = SAT(RSHR(s1[HW(i)], shift));         \
+        d[HN(4 * i + 2)] = SAT(RSHR(s2[HW(i)], shift));         \
+        d[HN(4 * i + 3)] = SAT(RSHR(s3[HW(i)], shift));         \
+    }                                                           \
+    if (d != vd) {                                              \
+        memcpy(vd, d, oprsz);                                   \
+    }                                                           \
+}
+
+SQRSHRN4(sme2_sqrshrn_sb, int32_t, int8_t, H4, H1, do_srshr, do_ssat_b)
+SQRSHRN4(sme2_uqrshrn_sb, uint32_t, uint8_t, H4, H1, do_urshr, do_usat_b)
+SQRSHRN4(sme2_sqrshrun_sb, int32_t, uint8_t, H4, H1, do_srshr, do_usat_b)
+
+SQRSHRN4(sme2_sqrshrn_dh, int64_t, int16_t, H8, H2, do_srshr, do_ssat_h)
+SQRSHRN4(sme2_uqrshrn_dh, uint64_t, uint16_t, H8, H2, do_urshr, do_usat_h)
+SQRSHRN4(sme2_sqrshrun_dh, int64_t, uint16_t, H8, H2, do_srshr, do_usat_h)
+
+#undef SQRSHRN4
+
 /* Expand and convert */
 void HELPER(sme2_fcvt_w)(void *vd, void *vs, float_status *fpst, uint32_t desc)
 {
diff --git a/target/arm/tcg/translate-sme.c b/target/arm/tcg/translate-sme.c
index de9545ee6d..d413efd20e 100644
--- a/target/arm/tcg/translate-sme.c
+++ b/target/arm/tcg/translate-sme.c
@@ -1474,3 +1474,36 @@ static gen_helper_gvec_2 * const uzp4_fns[] = {
     gen_helper_sme2_uzp4_q,
 };
 TRANS_FEAT(UZP_4, aa64_sme2, do_zipuzp_4, a, uzp4_fns)
+
+static bool do_zz_rshr(DisasContext *s, arg_rshr *a, gen_helper_gvec_2 *fn)
+{
+    if (sve_access_check(s)) {
+        int vl = vec_full_reg_size(s);
+        tcg_gen_gvec_2_ool(vec_full_reg_offset(s, a->zd),
+                           vec_full_reg_offset(s, a->zn),
+                           vl, vl, a->shift, fn);
+    }
+    return true;
+}
+
+TRANS_FEAT(SQRSHR_sh, aa64_sme2, do_zz_rshr, a, gen_helper_sme2_sqrshr_sh)
+TRANS_FEAT(UQRSHR_sh, aa64_sme2, do_zz_rshr, a, gen_helper_sme2_uqrshr_sh)
+TRANS_FEAT(SQRSHRU_sh, aa64_sme2, do_zz_rshr, a, gen_helper_sme2_sqrshru_sh)
+
+TRANS_FEAT(SQRSHR_sb, aa64_sme2, do_zz_rshr, a, gen_helper_sme2_sqrshr_sb)
+TRANS_FEAT(SQRSHR_dh, aa64_sme2, do_zz_rshr, a, gen_helper_sme2_sqrshr_dh)
+TRANS_FEAT(UQRSHR_sb, aa64_sme2, do_zz_rshr, a, gen_helper_sme2_uqrshr_sb)
+TRANS_FEAT(UQRSHR_dh, aa64_sme2, do_zz_rshr, a, gen_helper_sme2_uqrshr_dh)
+TRANS_FEAT(SQRSHRU_sb, aa64_sme2, do_zz_rshr, a, gen_helper_sme2_sqrshru_sb)
+TRANS_FEAT(SQRSHRU_dh, aa64_sme2, do_zz_rshr, a, gen_helper_sme2_sqrshru_dh)
+
+TRANS_FEAT(SQRSHRN_sh, aa64_sme2_or_sve2p1, do_zz_rshr, a, gen_helper_sme2_sqrshrn_sh)
+TRANS_FEAT(UQRSHRN_sh, aa64_sme2_or_sve2p1, do_zz_rshr, a, gen_helper_sme2_uqrshrn_sh)
+TRANS_FEAT(SQRSHRUN_sh, aa64_sme2_or_sve2p1, do_zz_rshr, a, gen_helper_sme2_sqrshrun_sh)
+
+TRANS_FEAT(SQRSHRN_sb, aa64_sme2, do_zz_rshr, a, gen_helper_sme2_sqrshrn_sb)
+TRANS_FEAT(SQRSHRN_dh, aa64_sme2, do_zz_rshr, a, gen_helper_sme2_sqrshrn_dh)
+TRANS_FEAT(UQRSHRN_sb, aa64_sme2, do_zz_rshr, a, gen_helper_sme2_uqrshrn_sb)
+TRANS_FEAT(UQRSHRN_dh, aa64_sme2, do_zz_rshr, a, gen_helper_sme2_uqrshrn_dh)
+TRANS_FEAT(SQRSHRUN_sb, aa64_sme2, do_zz_rshr, a, gen_helper_sme2_sqrshrun_sb)
+TRANS_FEAT(SQRSHRUN_dh, aa64_sme2, do_zz_rshr, a, gen_helper_sme2_sqrshrun_dh)

From 7e27088cfc3506c402ea50198cc317315258cadd Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:20:28 -0600
Subject: [PATCH 2012/2760] target/arm: Implement SME2 ZIP, UZP (two registers)

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-66-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/helper-sme.h    | 12 +++++++
 target/arm/tcg/sme.decode      | 12 +++++++
 target/arm/tcg/sme_helper.c    | 62 ++++++++++++++++++++++++++++++++++
 target/arm/tcg/translate-sme.c | 40 ++++++++++++++++++++++
 4 files changed, 126 insertions(+)

diff --git a/target/arm/tcg/helper-sme.h b/target/arm/tcg/helper-sme.h
index 97428bcd6b..06b95da3c3 100644
--- a/target/arm/tcg/helper-sme.h
+++ b/target/arm/tcg/helper-sme.h
@@ -255,6 +255,18 @@ DEF_HELPER_FLAGS_3(sme2_uunpk4_bh, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 DEF_HELPER_FLAGS_3(sme2_uunpk4_hs, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 DEF_HELPER_FLAGS_3(sme2_uunpk4_sd, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 
+DEF_HELPER_FLAGS_4(sme2_zip2_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sme2_zip2_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sme2_zip2_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sme2_zip2_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sme2_zip2_q, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(sme2_uzp2_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sme2_uzp2_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sme2_uzp2_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sme2_uzp2_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sme2_uzp2_q, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
 DEF_HELPER_FLAGS_3(sme2_zip4_b, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 DEF_HELPER_FLAGS_3(sme2_zip4_h, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 DEF_HELPER_FLAGS_3(sme2_zip4_s, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
diff --git a/target/arm/tcg/sme.decode b/target/arm/tcg/sme.decode
index 05d513efba..c1f73d9f63 100644
--- a/target/arm/tcg/sme.decode
+++ b/target/arm/tcg/sme.decode
@@ -848,3 +848,15 @@ UQRSHRN_sb      11000001 011 ..... 110111 ...01 .....       @rshr_sb
 UQRSHRN_dh      11000001 1.1 ..... 110111 ...01 .....       @rshr_dh
 SQRSHRUN_sb     11000001 011 ..... 110111 ...10 .....       @rshr_sb
 SQRSHRUN_dh     11000001 1.1 ..... 110111 ...10 .....       @rshr_dh
+
+&zzz_e          zd zn zm esz
+
+ZIP_2           11000001 esz:2 1 zm:5 110100 zn:5 .... 0    \
+                &zzz_e zd=%zd_ax2
+ZIP_2           11000001 00    1 zm:5 110101 zn:5 .... 0    \
+                &zzz_e zd=%zd_ax2 esz=4
+
+UZP_2           11000001 esz:2 1 zm:5 110100 zn:5 .... 1    \
+                &zzz_e zd=%zd_ax2
+UZP_2           11000001 00    1 zm:5 110101 zn:5 .... 1    \
+                &zzz_e zd=%zd_ax2 esz=4
diff --git a/target/arm/tcg/sme_helper.c b/target/arm/tcg/sme_helper.c
index 2e95fe38cd..cf0e655bdd 100644
--- a/target/arm/tcg/sme_helper.c
+++ b/target/arm/tcg/sme_helper.c
@@ -1933,6 +1933,37 @@ void HELPER(sme2_ucvtf)(void *vd, void *vs, float_status *fpst, uint32_t desc)
     }
 }
 
+#define ZIP2(NAME, TYPE, H)                                     \
+void HELPER(NAME)(void *vd, void *vn, void *vm, uint32_t desc)  \
+{                                                               \
+    ARMVectorReg scratch[2];                                    \
+    size_t oprsz = simd_oprsz(desc);                            \
+    size_t pairs = oprsz / (sizeof(TYPE) * 2);                  \
+    TYPE *n = vn, *m = vm;                                      \
+    if (vectors_overlap(vd, 2, vn, 1)) {                        \
+        n = memcpy(&scratch[0], vn, oprsz);                     \
+    }                                                           \
+    if (vectors_overlap(vd, 2, vm, 1)) {                        \
+        m = memcpy(&scratch[1], vm, oprsz);                     \
+    }                                                           \
+    for (size_t r = 0; r < 2; ++r) {                            \
+        TYPE *d = vd + r * sizeof(ARMVectorReg);                \
+        size_t base = r * pairs;                                \
+        for (size_t p = 0; p < pairs; ++p) {                    \
+            d[H(2 * p + 0)] = n[base + H(p)];                   \
+            d[H(2 * p + 1)] = m[base + H(p)];                   \
+        }                                                       \
+    }                                                           \
+}
+
+ZIP2(sme2_zip2_b, uint8_t, H1)
+ZIP2(sme2_zip2_h, uint16_t, H2)
+ZIP2(sme2_zip2_s, uint32_t, H4)
+ZIP2(sme2_zip2_d, uint64_t, )
+ZIP2(sme2_zip2_q, Int128, )
+
+#undef ZIP2
+
 #define ZIP4(NAME, TYPE, H)                                     \
 void HELPER(NAME)(void *vd, void *vs, uint32_t desc)            \
 {                                                               \
@@ -1967,6 +1998,37 @@ ZIP4(sme2_zip4_q, Int128, )
 
 #undef ZIP4
 
+#define UZP2(NAME, TYPE, H)                                     \
+void HELPER(NAME)(void *vd, void *vn, void *vm, uint32_t desc)  \
+{                                                               \
+    ARMVectorReg scratch[2];                                    \
+    size_t oprsz = simd_oprsz(desc);                            \
+    size_t pairs = oprsz / (sizeof(TYPE) * 2);                  \
+    TYPE *d0 = vd, *d1 = vd + sizeof(ARMVectorReg);             \
+    if (vectors_overlap(vd, 2, vn, 1)) {                        \
+        vn = memcpy(&scratch[0], vn, oprsz);                    \
+    }                                                           \
+    if (vectors_overlap(vd, 2, vm, 1)) {                        \
+        vm = memcpy(&scratch[1], vm, oprsz);                    \
+    }                                                           \
+    for (size_t r = 0; r < 2; ++r) {                            \
+        TYPE *s = r ? vm : vn;                                  \
+        size_t base = r * pairs;                                \
+        for (size_t p = 0; p < pairs; ++p) {                    \
+            d0[base + H(p)] = s[H(2 * p + 0)];                  \
+            d1[base + H(p)] = s[H(2 * p + 1)];                  \
+        }                                                       \
+    }                                                           \
+}
+
+UZP2(sme2_uzp2_b, uint8_t, H1)
+UZP2(sme2_uzp2_h, uint16_t, H2)
+UZP2(sme2_uzp2_s, uint32_t, H4)
+UZP2(sme2_uzp2_d, uint64_t, )
+UZP2(sme2_uzp2_q, Int128, )
+
+#undef UZP2
+
 #define UZP4(NAME, TYPE, H)                                     \
 void HELPER(NAME)(void *vd, void *vs, uint32_t desc)            \
 {                                                               \
diff --git a/target/arm/tcg/translate-sme.c b/target/arm/tcg/translate-sme.c
index d413efd20e..d52ccf2ac5 100644
--- a/target/arm/tcg/translate-sme.c
+++ b/target/arm/tcg/translate-sme.c
@@ -1507,3 +1507,43 @@ TRANS_FEAT(UQRSHRN_sb, aa64_sme2, do_zz_rshr, a, gen_helper_sme2_uqrshrn_sb)
 TRANS_FEAT(UQRSHRN_dh, aa64_sme2, do_zz_rshr, a, gen_helper_sme2_uqrshrn_dh)
 TRANS_FEAT(SQRSHRUN_sb, aa64_sme2, do_zz_rshr, a, gen_helper_sme2_sqrshrun_sb)
 TRANS_FEAT(SQRSHRUN_dh, aa64_sme2, do_zz_rshr, a, gen_helper_sme2_sqrshrun_dh)
+
+static bool do_zipuzp_2(DisasContext *s, arg_zzz_e *a,
+                        gen_helper_gvec_3 * const fn[5])
+{
+    int bytes_per_op = 2 << a->esz;
+
+    /* MO_128 can fail the size test. */
+    if (s->max_svl < bytes_per_op) {
+        unallocated_encoding(s);
+    } else if (sme_sm_enabled_check(s)) {
+        int svl = streaming_vec_reg_size(s);
+        if (svl < bytes_per_op) {
+            unallocated_encoding(s);
+        } else {
+            tcg_gen_gvec_3_ool(vec_full_reg_offset(s, a->zd),
+                               vec_full_reg_offset(s, a->zn),
+                               vec_full_reg_offset(s, a->zm),
+                               svl, svl, 0, fn[a->esz]);
+        }
+    }
+    return true;
+}
+
+static gen_helper_gvec_3 * const zip2_fns[] = {
+    gen_helper_sme2_zip2_b,
+    gen_helper_sme2_zip2_h,
+    gen_helper_sme2_zip2_s,
+    gen_helper_sme2_zip2_d,
+    gen_helper_sme2_zip2_q,
+};
+TRANS_FEAT(ZIP_2, aa64_sme2, do_zipuzp_2, a, zip2_fns)
+
+static gen_helper_gvec_3 * const uzp2_fns[] = {
+    gen_helper_sme2_uzp2_b,
+    gen_helper_sme2_uzp2_h,
+    gen_helper_sme2_uzp2_s,
+    gen_helper_sme2_uzp2_d,
+    gen_helper_sme2_uzp2_q,
+};
+TRANS_FEAT(UZP_2, aa64_sme2, do_zipuzp_2, a, uzp2_fns)

From 8b61eff8e72fee0d5b0cb937674d77fc99674e6c Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:20:29 -0600
Subject: [PATCH 2013/2760] target/arm: Implement SME2 FCLAMP, SCLAMP, UCLAMP

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-67-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/helper-sme.h    | 15 +++++++
 target/arm/tcg/sme.decode      | 17 ++++++++
 target/arm/tcg/sme_helper.c    | 56 +++++++++++++++++++++++++
 target/arm/tcg/translate-sme.c | 75 ++++++++++++++++++++++++++++++++++
 4 files changed, 163 insertions(+)

diff --git a/target/arm/tcg/helper-sme.h b/target/arm/tcg/helper-sme.h
index 06b95da3c3..78ba3d1f20 100644
--- a/target/arm/tcg/helper-sme.h
+++ b/target/arm/tcg/helper-sme.h
@@ -298,3 +298,18 @@ DEF_HELPER_FLAGS_3(sme2_sqrshrun_sb, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 DEF_HELPER_FLAGS_3(sme2_sqrshrn_dh, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 DEF_HELPER_FLAGS_3(sme2_uqrshrn_dh, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 DEF_HELPER_FLAGS_3(sme2_sqrshrun_dh, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(sme2_sclamp_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sme2_sclamp_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sme2_sclamp_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sme2_sclamp_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(sme2_uclamp_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sme2_uclamp_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sme2_uclamp_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sme2_uclamp_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_5(sme2_fclamp_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(sme2_fclamp_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(sme2_fclamp_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(sme2_bfclamp, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
diff --git a/target/arm/tcg/sme.decode b/target/arm/tcg/sme.decode
index c1f73d9f63..47adcb5a15 100644
--- a/target/arm/tcg/sme.decode
+++ b/target/arm/tcg/sme.decode
@@ -860,3 +860,20 @@ UZP_2           11000001 esz:2 1 zm:5 110100 zn:5 .... 1    \
                 &zzz_e zd=%zd_ax2
 UZP_2           11000001 00    1 zm:5 110101 zn:5 .... 1    \
                 &zzz_e zd=%zd_ax2 esz=4
+
+&zzz_en         zd zn zm esz n
+
+FCLAMP          11000001 esz:2 1 zm:5 110000 zn:5 .... 0    \
+                &zzz_en zd=%zd_ax2 n=2
+FCLAMP          11000001 esz:2 1 zm:5 110010 zn:5 ...0 0    \
+                &zzz_en zd=%zd_ax4 n=4
+
+SCLAMP          11000001 esz:2 1 zm:5 110001 zn:5 .... 0    \
+                &zzz_en zd=%zd_ax2 n=2
+SCLAMP          11000001 esz:2 1 zm:5 110011 zn:5 ...0 0    \
+                &zzz_en zd=%zd_ax4 n=4
+
+UCLAMP          11000001 esz:2 1 zm:5 110001 zn:5 .... 1    \
+                &zzz_en zd=%zd_ax2 n=2
+UCLAMP          11000001 esz:2 1 zm:5 110011 zn:5 ...0 1    \
+                &zzz_en zd=%zd_ax4 n=4
diff --git a/target/arm/tcg/sme_helper.c b/target/arm/tcg/sme_helper.c
index cf0e655bdd..8a1f9fbf3d 100644
--- a/target/arm/tcg/sme_helper.c
+++ b/target/arm/tcg/sme_helper.c
@@ -2062,3 +2062,59 @@ UZP4(sme2_uzp4_d, uint64_t, )
 UZP4(sme2_uzp4_q, Int128, )
 
 #undef UZP4
+
+#define ICLAMP(NAME, TYPE, H) \
+void HELPER(NAME)(void *vd, void *vn, void *vm, uint32_t desc)  \
+{                                                               \
+    size_t stride = sizeof(ARMVectorReg) / sizeof(TYPE);        \
+    size_t elements = simd_oprsz(desc) / sizeof(TYPE);          \
+    size_t nreg = simd_data(desc);                              \
+    TYPE *d = vd, *n = vn, *m = vm;                             \
+    for (size_t e = 0; e < elements; e++) {                     \
+        TYPE nn = n[H(e)], mm = m[H(e)];                        \
+        for (size_t r = 0; r < nreg; r++) {                     \
+            TYPE *dd = &d[r * stride + H(e)];                   \
+            *dd = MIN(MAX(*dd, nn), mm);                        \
+        }                                                       \
+    }                                                           \
+}
+
+ICLAMP(sme2_sclamp_b, int8_t, H1)
+ICLAMP(sme2_sclamp_h, int16_t, H2)
+ICLAMP(sme2_sclamp_s, int32_t, H4)
+ICLAMP(sme2_sclamp_d, int64_t, H8)
+
+ICLAMP(sme2_uclamp_b, uint8_t, H1)
+ICLAMP(sme2_uclamp_h, uint16_t, H2)
+ICLAMP(sme2_uclamp_s, uint32_t, H4)
+ICLAMP(sme2_uclamp_d, uint64_t, H8)
+
+#undef ICLAMP
+
+/*
+ * Note the argument ordering to minnum and maxnum must match
+ * the ARM pseudocode so that NaNs are propagated properly.
+ */
+#define FCLAMP(NAME, TYPE, H) \
+void HELPER(NAME)(void *vd, void *vn, void *vm,                 \
+                  float_status *fpst, uint32_t desc)            \
+{                                                               \
+    size_t stride = sizeof(ARMVectorReg) / sizeof(TYPE);        \
+    size_t elements = simd_oprsz(desc) / sizeof(TYPE);          \
+    size_t nreg = simd_data(desc);                              \
+    TYPE *d = vd, *n = vn, *m = vm;                             \
+    for (size_t e = 0; e < elements; e++) {                     \
+        TYPE nn = n[H(e)], mm = m[H(e)];                        \
+        for (size_t r = 0; r < nreg; r++) {                     \
+            TYPE *dd = &d[r * stride + H(e)];                   \
+            *dd = TYPE##_minnum(TYPE##_maxnum(nn, *dd, fpst), mm, fpst); \
+        }                                                       \
+    }                                                           \
+}
+
+FCLAMP(sme2_fclamp_h, float16, H2)
+FCLAMP(sme2_fclamp_s, float32, H4)
+FCLAMP(sme2_fclamp_d, float64, H8)
+FCLAMP(sme2_bfclamp, bfloat16, H2)
+
+#undef FCLAMP
diff --git a/target/arm/tcg/translate-sme.c b/target/arm/tcg/translate-sme.c
index d52ccf2ac5..99e4056316 100644
--- a/target/arm/tcg/translate-sme.c
+++ b/target/arm/tcg/translate-sme.c
@@ -1547,3 +1547,78 @@ static gen_helper_gvec_3 * const uzp2_fns[] = {
     gen_helper_sme2_uzp2_q,
 };
 TRANS_FEAT(UZP_2, aa64_sme2, do_zipuzp_2, a, uzp2_fns)
+
+static bool trans_FCLAMP(DisasContext *s, arg_zzz_en *a)
+{
+    static gen_helper_gvec_3_ptr * const fn[] = {
+        gen_helper_sme2_bfclamp,
+        gen_helper_sme2_fclamp_h,
+        gen_helper_sme2_fclamp_s,
+        gen_helper_sme2_fclamp_d,
+    };
+    TCGv_ptr fpst;
+    int vl;
+
+    if (!dc_isar_feature(aa64_sme2, s)) {
+        return false;
+    }
+    /* This insn uses MO_8 to encode BFloat16. */
+    if (a->esz == MO_8 && !dc_isar_feature(aa64_sme_b16b16, s)) {
+        return false;
+    }
+    if (!sme_sm_enabled_check(s)) {
+        return true;
+    }
+
+    fpst = fpstatus_ptr(a->esz == MO_16 ? FPST_A64_F16 : FPST_A64);
+    vl = vec_full_reg_size(s);
+
+    tcg_gen_gvec_3_ptr(vec_full_reg_offset(s, a->zd),
+                       vec_full_reg_offset(s, a->zn),
+                       vec_full_reg_offset(s, a->zm),
+                       fpst, vl, vl, a->n, fn[a->esz]);
+    return true;
+}
+
+static bool do_clamp(DisasContext *s, arg_zzz_en *a,
+                     gen_helper_gvec_3 * const fn[4])
+{
+    int vl;
+
+    if (!dc_isar_feature(aa64_sme2, s)) {
+        return false;
+    }
+    if (!sme_sm_enabled_check(s)) {
+        return true;
+    }
+
+    /*
+     * Clamp is just a min+max, easily supported by most host
+     * vector operations -- we already have such an expansion in
+     * translate-sve.c for a single output.
+     * TODO: Add support in gvec for multiple simultaneous output,
+     * and/or copy to temporary upon overlap.
+     */
+    vl = vec_full_reg_size(s);
+    tcg_gen_gvec_3_ool(vec_full_reg_offset(s, a->zd),
+                       vec_full_reg_offset(s, a->zn),
+                       vec_full_reg_offset(s, a->zm),
+                       vl, vl, a->n, fn[a->esz]);
+    return true;
+}
+
+static gen_helper_gvec_3 * const sclamp_fns[] = {
+    gen_helper_sme2_sclamp_b,
+    gen_helper_sme2_sclamp_h,
+    gen_helper_sme2_sclamp_s,
+    gen_helper_sme2_sclamp_d,
+};
+TRANS(SCLAMP, do_clamp, a, sclamp_fns)
+
+static gen_helper_gvec_3 * const uclamp_fns[] = {
+    gen_helper_sme2_uclamp_b,
+    gen_helper_sme2_uclamp_h,
+    gen_helper_sme2_uclamp_s,
+    gen_helper_sme2_uclamp_d,
+};
+TRANS(UCLAMP, do_clamp, a, uclamp_fns)

From c1317025d83a298be82a2d05586a6a23684ad877 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:20:30 -0600
Subject: [PATCH 2014/2760] target/arm: Enable SCLAMP, UCLAMP for SVE2p1

These instructions are present in both SME(1) and SVE2.1 extensions.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-68-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/translate-sve.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
index ac4dc7db46..ff70bf27b0 100644
--- a/target/arm/tcg/translate-sve.c
+++ b/target/arm/tcg/translate-sve.c
@@ -7375,7 +7375,7 @@ static void gen_sclamp(unsigned vece, uint32_t d, uint32_t n, uint32_t m,
     tcg_gen_gvec_4(d, n, m, a, oprsz, maxsz, &ops[vece]);
 }
 
-TRANS_FEAT(SCLAMP, aa64_sme, gen_gvec_fn_arg_zzzz, gen_sclamp, a)
+TRANS_FEAT(SCLAMP, aa64_sme_or_sve2p1, gen_gvec_fn_arg_zzzz, gen_sclamp, a)
 
 static void gen_uclamp_i32(TCGv_i32 d, TCGv_i32 n, TCGv_i32 m, TCGv_i32 a)
 {
@@ -7426,7 +7426,7 @@ static void gen_uclamp(unsigned vece, uint32_t d, uint32_t n, uint32_t m,
     tcg_gen_gvec_4(d, n, m, a, oprsz, maxsz, &ops[vece]);
 }
 
-TRANS_FEAT(UCLAMP, aa64_sme, gen_gvec_fn_arg_zzzz, gen_uclamp, a)
+TRANS_FEAT(UCLAMP, aa64_sme_or_sve2p1, gen_gvec_fn_arg_zzzz, gen_uclamp, a)
 
 TRANS_FEAT(SQCVTN_sh, aa64_sme2_or_sve2p1, gen_gvec_ool_zz,
            gen_helper_sme2_sqcvtn_sh, a->rd, a->rn, 0)

From e9b743947b154b51dad778e31e323c8ef3133a52 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:20:31 -0600
Subject: [PATCH 2015/2760] target/arm: Implement FCLAMP for SME2, SVE2p1
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This is the single vector version within SVE decode space.

Tested-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-69-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/sve.decode      |  2 ++
 target/arm/tcg/translate-sve.c | 22 ++++++++++++++++++++++
 2 files changed, 24 insertions(+)

diff --git a/target/arm/tcg/sve.decode b/target/arm/tcg/sve.decode
index f808362f23..dcfc40ef44 100644
--- a/target/arm/tcg/sve.decode
+++ b/target/arm/tcg/sve.decode
@@ -1721,3 +1721,5 @@ PSEL            00100101 .1 1 000 .. 01 .... 0 .... 0 ....  \
 
 SCLAMP          01000100 .. 0 ..... 110000 ..... .....          @rda_rn_rm
 UCLAMP          01000100 .. 0 ..... 110001 ..... .....          @rda_rn_rm
+
+FCLAMP          01100100 .. 1 ..... 001001 ..... .....          @rda_rn_rm
diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
index ff70bf27b0..210a029ab8 100644
--- a/target/arm/tcg/translate-sve.c
+++ b/target/arm/tcg/translate-sve.c
@@ -7428,6 +7428,28 @@ static void gen_uclamp(unsigned vece, uint32_t d, uint32_t n, uint32_t m,
 
 TRANS_FEAT(UCLAMP, aa64_sme_or_sve2p1, gen_gvec_fn_arg_zzzz, gen_uclamp, a)
 
+static bool trans_FCLAMP(DisasContext *s, arg_FCLAMP *a)
+{
+    static gen_helper_gvec_3_ptr * const fn[] = {
+        gen_helper_sme2_bfclamp,
+        gen_helper_sme2_fclamp_h,
+        gen_helper_sme2_fclamp_s,
+        gen_helper_sme2_fclamp_d,
+    };
+
+    /* This insn uses MO_8 to encode BFloat16. */
+    if (a->esz == MO_8
+        ? !dc_isar_feature(aa64_sve_b16b16, s)
+        : !dc_isar_feature(aa64_sme2_or_sve2p1, s)) {
+        return false;
+    }
+
+    /* So far we never optimize rda with MOVPRFX */
+    assert(a->rd == a->ra);
+    return gen_gvec_fpst_zzz(s, fn[a->esz], a->rd, a->rn, a->rm, 1,
+                             a->esz == MO_16 ? FPST_A64_F16 : FPST_A64);
+}
+
 TRANS_FEAT(SQCVTN_sh, aa64_sme2_or_sve2p1, gen_gvec_ool_zz,
            gen_helper_sme2_sqcvtn_sh, a->rd, a->rn, 0)
 TRANS_FEAT(UQCVTN_sh, aa64_sme2_or_sve2p1, gen_gvec_ool_zz,

From f8f65ebc0ab747cd233ace17318b268593f56910 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:20:32 -0600
Subject: [PATCH 2016/2760] target/arm: Implement SME2p1 Multiple Zero

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-70-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/sme.decode      | 23 +++++++++++++++++++++++
 target/arm/tcg/translate-sme.c | 20 ++++++++++++++++++++
 2 files changed, 43 insertions(+)

diff --git a/target/arm/tcg/sme.decode b/target/arm/tcg/sme.decode
index 47adcb5a15..c4b85a36d0 100644
--- a/target/arm/tcg/sme.decode
+++ b/target/arm/tcg/sme.decode
@@ -877,3 +877,26 @@ UCLAMP          11000001 esz:2 1 zm:5 110001 zn:5 .... 1    \
                 &zzz_en zd=%zd_ax2 n=2
 UCLAMP          11000001 esz:2 1 zm:5 110011 zn:5 ...0 1    \
                 &zzz_en zd=%zd_ax4 n=4
+
+### SME Multiple Zero
+
+&zero_za        rv off ngrp nvec
+
+ZERO_za         11000000 000011 000 .. 0000000000 off:3 \
+                &zero_za ngrp=2 nvec=1 rv=%mova_rv
+ZERO_za         11000000 000011 100 .. 0000000000 off:3 \
+                &zero_za ngrp=4 nvec=1 rv=%mova_rv
+
+ZERO_za         11000000 000011 001 .. 0000000000 ...   \
+                &zero_za ngrp=1 nvec=2 rv=%mova_rv off=%off3_x2
+ZERO_za         11000000 000011 010 .. 0000000000 0..   \
+                &zero_za ngrp=2 nvec=2 rv=%mova_rv off=%off2_x2
+ZERO_za         11000000 000011 011 .. 0000000000 0..   \
+                &zero_za ngrp=4 nvec=2 rv=%mova_rv off=%off2_x2
+
+ZERO_za         11000000 000011 101 .. 0000000000 0..   \
+                &zero_za ngrp=1 nvec=4 rv=%mova_rv off=%off2_x4
+ZERO_za         11000000 000011 110 .. 0000000000 00.   \
+                &zero_za ngrp=2 nvec=4 rv=%mova_rv off=%off1_x4
+ZERO_za         11000000 000011 111 .. 0000000000 00.   \
+                &zero_za ngrp=4 nvec=4 rv=%mova_rv off=%off1_x4
diff --git a/target/arm/tcg/translate-sme.c b/target/arm/tcg/translate-sme.c
index 99e4056316..b6316ac716 100644
--- a/target/arm/tcg/translate-sme.c
+++ b/target/arm/tcg/translate-sme.c
@@ -173,6 +173,26 @@ static bool trans_ZERO_zt0(DisasContext *s, arg_ZERO_zt0 *a)
     return true;
 }
 
+static bool trans_ZERO_za(DisasContext *s, arg_ZERO_za *a)
+{
+    if (!dc_isar_feature(aa64_sme2p1, s)) {
+        return false;
+    }
+    if (sme_smza_enabled_check(s)) {
+        int svl = streaming_vec_reg_size(s);
+        int vstride = svl / a->ngrp;
+        TCGv_ptr t_za = get_zarray(s, a->rv, a->off, a->ngrp, a->nvec);
+
+        for (int r = 0; r < a->ngrp; ++r) {
+            for (int i = 0; i < a->nvec; ++i) {
+                int o_za = (r * vstride + i) * sizeof(ARMVectorReg);
+                tcg_gen_gvec_dup_imm_var(MO_64, t_za, o_za, svl, svl, 0);
+            }
+        }
+    }
+    return true;
+}
+
 static bool do_mova_tile(DisasContext *s, arg_mova_p *a, bool to_vec)
 {
     static gen_helper_gvec_4 * const h_fns[5] = {

From bcbe82a29396e9f007e1575da0bb4e7e57451c71 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:20:33 -0600
Subject: [PATCH 2017/2760] target/arm: Introduce pred_count_test

For WHILE, we have the count of enabled predicates, so we don't
need to search to compute the PredTest result.  Reuse the logic
that will shortly be required for counted predicates.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20250704142112.1018902-71-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/sve_helper.c | 81 +++++++++++++++++++++----------------
 1 file changed, 46 insertions(+), 35 deletions(-)

diff --git a/target/arm/tcg/sve_helper.c b/target/arm/tcg/sve_helper.c
index 0e59ad2262..5b5871ba13 100644
--- a/target/arm/tcg/sve_helper.c
+++ b/target/arm/tcg/sve_helper.c
@@ -4102,30 +4102,46 @@ uint64_t HELPER(sve_cntp)(void *vn, void *vg, uint32_t pred_desc)
     return sum;
 }
 
+/* C.f. Arm pseudocode PredCountTest */
+static uint32_t pred_count_test(uint32_t elements, uint32_t count, bool invert)
+{
+    uint32_t flags;
+
+    if (count == 0) {
+        flags = 1;                              /* !N, Z, C */
+    } else if (!invert) {
+        flags = (1u << 31) | 2;                 /* N, !Z */
+        flags |= count != elements;             /* C */
+    } else {
+        flags = 2;                              /* !Z, !C */
+        flags |= (count == elements) << 31;     /* N */
+    }
+    return flags;
+}
+
 uint32_t HELPER(sve_whilel)(void *vd, uint32_t count, uint32_t pred_desc)
 {
     intptr_t oprsz = FIELD_EX32(pred_desc, PREDDESC, OPRSZ);
     intptr_t esz = FIELD_EX32(pred_desc, PREDDESC, ESZ);
     uint64_t esz_mask = pred_esz_masks[esz];
     ARMPredicateReg *d = vd;
-    uint32_t flags;
-    intptr_t i;
+    intptr_t i, oprbits = oprsz * 8;
+
+    tcg_debug_assert(count <= oprbits);
 
     /* Begin with a zero predicate register.  */
-    flags = do_zero(d, oprsz);
-    if (count == 0) {
-        return flags;
+    do_zero(d, oprsz);
+    if (count) {
+        /* Set all of the requested bits.  */
+        for (i = 0; i < count / 64; ++i) {
+            d->p[i] = esz_mask;
+        }
+        if (count & 63) {
+            d->p[i] = MAKE_64BIT_MASK(0, count & 63) & esz_mask;
+        }
     }
 
-    /* Set all of the requested bits.  */
-    for (i = 0; i < count / 64; ++i) {
-        d->p[i] = esz_mask;
-    }
-    if (count & 63) {
-        d->p[i] = MAKE_64BIT_MASK(0, count & 63) & esz_mask;
-    }
-
-    return predtest_ones(d, oprsz, esz_mask);
+    return pred_count_test(oprbits, count, false);
 }
 
 uint32_t HELPER(sve_whileg)(void *vd, uint32_t count, uint32_t pred_desc)
@@ -4134,34 +4150,29 @@ uint32_t HELPER(sve_whileg)(void *vd, uint32_t count, uint32_t pred_desc)
     intptr_t esz = FIELD_EX32(pred_desc, PREDDESC, ESZ);
     uint64_t esz_mask = pred_esz_masks[esz];
     ARMPredicateReg *d = vd;
-    intptr_t i, invcount, oprbits;
+    intptr_t i, invcount, oprbits = oprsz * 8;
     uint64_t bits;
 
-    if (count == 0) {
-        return do_zero(d, oprsz);
-    }
-
-    oprbits = oprsz * 8;
     tcg_debug_assert(count <= oprbits);
 
-    bits = esz_mask;
-    if (oprbits & 63) {
-        bits &= MAKE_64BIT_MASK(0, oprbits & 63);
-    }
-
-    invcount = oprbits - count;
-    for (i = (oprsz - 1) / 8; i > invcount / 64; --i) {
-        d->p[i] = bits;
+    /* Begin with a zero predicate register.  */
+    do_zero(d, oprsz);
+    if (count) {
+        /* Set all of the requested bits.  */
         bits = esz_mask;
+        if (oprbits & 63) {
+            bits &= MAKE_64BIT_MASK(0, oprbits & 63);
+        }
+
+        invcount = oprbits - count;
+        for (i = (oprsz - 1) / 8; i > invcount / 64; --i) {
+            d->p[i] = bits;
+            bits = esz_mask;
+        }
+        d->p[i] = bits & MAKE_64BIT_MASK(invcount & 63, 64);
     }
 
-    d->p[i] = bits & MAKE_64BIT_MASK(invcount & 63, 64);
-
-    while (--i >= 0) {
-        d->p[i] = 0;
-    }
-
-    return predtest_ones(d, oprsz, esz_mask);
+    return pred_count_test(oprbits, count, true);
 }
 
 /* Recursive reduction on a function;

From 18914dfba78e64148219ba9611b0019c0a81ff52 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:20:34 -0600
Subject: [PATCH 2018/2760] target/arm: Fold predtest_ones into
 helper_sve_brkns

Merge predtest_ones into its only caller.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-72-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/sve_helper.c | 34 ++++++++++++++--------------------
 1 file changed, 14 insertions(+), 20 deletions(-)

diff --git a/target/arm/tcg/sve_helper.c b/target/arm/tcg/sve_helper.c
index 5b5871ba13..492e42acc8 100644
--- a/target/arm/tcg/sve_helper.c
+++ b/target/arm/tcg/sve_helper.c
@@ -4061,31 +4061,25 @@ void HELPER(sve_brkn)(void *vd, void *vn, void *vg, uint32_t pred_desc)
     }
 }
 
-/* As if PredTest(Ones(PL), D, esz).  */
-static uint32_t predtest_ones(ARMPredicateReg *d, intptr_t oprsz,
-                              uint64_t esz_mask)
-{
-    uint32_t flags = PREDTEST_INIT;
-    intptr_t i;
-
-    for (i = 0; i < oprsz / 8; i++) {
-        flags = iter_predtest_fwd(d->p[i], esz_mask, flags);
-    }
-    if (oprsz & 7) {
-        uint64_t mask = ~(-1ULL << (8 * (oprsz & 7)));
-        flags = iter_predtest_fwd(d->p[i], esz_mask & mask, flags);
-    }
-    return flags;
-}
-
 uint32_t HELPER(sve_brkns)(void *vd, void *vn, void *vg, uint32_t pred_desc)
 {
     intptr_t oprsz = FIELD_EX32(pred_desc, PREDDESC, OPRSZ);
     if (last_active_pred(vn, vg, oprsz)) {
-        return predtest_ones(vd, oprsz, -1);
-    } else {
-        return do_zero(vd, oprsz);
+        ARMPredicateReg *d = vd;
+        uint32_t flags = PREDTEST_INIT;
+        intptr_t i;
+
+        /* As if PredTest(Ones(PL), D, MO_8).  */
+        for (i = 0; i < oprsz / 8; i++) {
+            flags = iter_predtest_fwd(d->p[i], -1, flags);
+        }
+        if (oprsz & 7) {
+            uint64_t mask = ~(-1ULL << (8 * (oprsz & 7)));
+            flags = iter_predtest_fwd(d->p[i], mask, flags);
+        }
+        return flags;
     }
+    return do_zero(vd, oprsz);
 }
 
 uint64_t HELPER(sve_cntp)(void *vn, void *vg, uint32_t pred_desc)

From 91afd009bab55b0b479e6fb0aadc9366e9bd6209 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:20:35 -0600
Subject: [PATCH 2019/2760] target/arm: Expand do_zero inline

Expand to memset plus the return value, when used.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20250704142112.1018902-73-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/sve_helper.c | 28 +++++++++++-----------------
 1 file changed, 11 insertions(+), 17 deletions(-)

diff --git a/target/arm/tcg/sve_helper.c b/target/arm/tcg/sve_helper.c
index 492e42acc8..a62a647f3a 100644
--- a/target/arm/tcg/sve_helper.c
+++ b/target/arm/tcg/sve_helper.c
@@ -3952,15 +3952,6 @@ static uint32_t compute_brks_m(uint64_t *d, uint64_t *n, uint64_t *g,
     return flags;
 }
 
-static uint32_t do_zero(ARMPredicateReg *d, intptr_t oprsz)
-{
-    /* It is quicker to zero the whole predicate than loop on OPRSZ.
-     * The compiler should turn this into 4 64-bit integer stores.
-     */
-    memset(d, 0, sizeof(ARMPredicateReg));
-    return PREDTEST_INIT;
-}
-
 void HELPER(sve_brkpa)(void *vd, void *vn, void *vm, void *vg,
                        uint32_t pred_desc)
 {
@@ -3968,7 +3959,7 @@ void HELPER(sve_brkpa)(void *vd, void *vn, void *vm, void *vg,
     if (last_active_pred(vn, vg, oprsz)) {
         compute_brk_z(vd, vm, vg, oprsz, true);
     } else {
-        do_zero(vd, oprsz);
+        memset(vd, 0, sizeof(ARMPredicateReg));
     }
 }
 
@@ -3979,7 +3970,8 @@ uint32_t HELPER(sve_brkpas)(void *vd, void *vn, void *vm, void *vg,
     if (last_active_pred(vn, vg, oprsz)) {
         return compute_brks_z(vd, vm, vg, oprsz, true);
     } else {
-        return do_zero(vd, oprsz);
+        memset(vd, 0, sizeof(ARMPredicateReg));
+        return PREDTEST_INIT;
     }
 }
 
@@ -3990,7 +3982,7 @@ void HELPER(sve_brkpb)(void *vd, void *vn, void *vm, void *vg,
     if (last_active_pred(vn, vg, oprsz)) {
         compute_brk_z(vd, vm, vg, oprsz, false);
     } else {
-        do_zero(vd, oprsz);
+        memset(vd, 0, sizeof(ARMPredicateReg));
     }
 }
 
@@ -4001,7 +3993,8 @@ uint32_t HELPER(sve_brkpbs)(void *vd, void *vn, void *vm, void *vg,
     if (last_active_pred(vn, vg, oprsz)) {
         return compute_brks_z(vd, vm, vg, oprsz, false);
     } else {
-        return do_zero(vd, oprsz);
+        memset(vd, 0, sizeof(ARMPredicateReg));
+        return PREDTEST_INIT;
     }
 }
 
@@ -4057,7 +4050,7 @@ void HELPER(sve_brkn)(void *vd, void *vn, void *vg, uint32_t pred_desc)
 {
     intptr_t oprsz = FIELD_EX32(pred_desc, PREDDESC, OPRSZ);
     if (!last_active_pred(vn, vg, oprsz)) {
-        do_zero(vd, oprsz);
+        memset(vd, 0, sizeof(ARMPredicateReg));
     }
 }
 
@@ -4079,7 +4072,8 @@ uint32_t HELPER(sve_brkns)(void *vd, void *vn, void *vg, uint32_t pred_desc)
         }
         return flags;
     }
-    return do_zero(vd, oprsz);
+    memset(vd, 0, sizeof(ARMPredicateReg));
+    return PREDTEST_INIT;
 }
 
 uint64_t HELPER(sve_cntp)(void *vn, void *vg, uint32_t pred_desc)
@@ -4124,7 +4118,7 @@ uint32_t HELPER(sve_whilel)(void *vd, uint32_t count, uint32_t pred_desc)
     tcg_debug_assert(count <= oprbits);
 
     /* Begin with a zero predicate register.  */
-    do_zero(d, oprsz);
+    memset(d, 0, sizeof(*d));
     if (count) {
         /* Set all of the requested bits.  */
         for (i = 0; i < count / 64; ++i) {
@@ -4150,7 +4144,7 @@ uint32_t HELPER(sve_whileg)(void *vd, uint32_t count, uint32_t pred_desc)
     tcg_debug_assert(count <= oprbits);
 
     /* Begin with a zero predicate register.  */
-    do_zero(d, oprsz);
+    memset(d, 0, sizeof(*d));
     if (count) {
         /* Set all of the requested bits.  */
         bits = esz_mask;

From 56ddef77944b4441f199b5e15c8fc1a058fd3335 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:20:36 -0600
Subject: [PATCH 2020/2760] target/arm: Split out do_whilel from
 helper_sve_whilel

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-74-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/sve_helper.c | 26 ++++++++++++++++----------
 1 file changed, 16 insertions(+), 10 deletions(-)

diff --git a/target/arm/tcg/sve_helper.c b/target/arm/tcg/sve_helper.c
index a62a647f3a..741d04309c 100644
--- a/target/arm/tcg/sve_helper.c
+++ b/target/arm/tcg/sve_helper.c
@@ -4107,19 +4107,14 @@ static uint32_t pred_count_test(uint32_t elements, uint32_t count, bool invert)
     return flags;
 }
 
-uint32_t HELPER(sve_whilel)(void *vd, uint32_t count, uint32_t pred_desc)
+/* D must be cleared on entry. */
+static void do_whilel(ARMPredicateReg *d, uint64_t esz_mask,
+                      uint32_t count, uint32_t oprbits)
 {
-    intptr_t oprsz = FIELD_EX32(pred_desc, PREDDESC, OPRSZ);
-    intptr_t esz = FIELD_EX32(pred_desc, PREDDESC, ESZ);
-    uint64_t esz_mask = pred_esz_masks[esz];
-    ARMPredicateReg *d = vd;
-    intptr_t i, oprbits = oprsz * 8;
-
     tcg_debug_assert(count <= oprbits);
-
-    /* Begin with a zero predicate register.  */
-    memset(d, 0, sizeof(*d));
     if (count) {
+        uint32_t i;
+
         /* Set all of the requested bits.  */
         for (i = 0; i < count / 64; ++i) {
             d->p[i] = esz_mask;
@@ -4128,7 +4123,18 @@ uint32_t HELPER(sve_whilel)(void *vd, uint32_t count, uint32_t pred_desc)
             d->p[i] = MAKE_64BIT_MASK(0, count & 63) & esz_mask;
         }
     }
+}
 
+uint32_t HELPER(sve_whilel)(void *vd, uint32_t count, uint32_t pred_desc)
+{
+    uint32_t oprsz = FIELD_EX32(pred_desc, PREDDESC, OPRSZ);
+    uint32_t esz = FIELD_EX32(pred_desc, PREDDESC, ESZ);
+    uint32_t oprbits = oprsz * 8;
+    uint64_t esz_mask = pred_esz_masks[esz];
+    ARMPredicateReg *d = vd;
+
+    memset(d, 0, sizeof(*d));
+    do_whilel(d, esz_mask, count, oprbits);
     return pred_count_test(oprbits, count, false);
 }
 

From 3fd8ce429447db5d1c1302887c68bc23a73a8a81 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:20:37 -0600
Subject: [PATCH 2021/2760] target/arm: Split out do_whileg from
 helper_sve_whileg

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20250704142112.1018902-75-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/sve_helper.c | 39 +++++++++++++++++++------------------
 1 file changed, 20 insertions(+), 19 deletions(-)

diff --git a/target/arm/tcg/sve_helper.c b/target/arm/tcg/sve_helper.c
index 741d04309c..5e11e86e5e 100644
--- a/target/arm/tcg/sve_helper.c
+++ b/target/arm/tcg/sve_helper.c
@@ -4138,34 +4138,35 @@ uint32_t HELPER(sve_whilel)(void *vd, uint32_t count, uint32_t pred_desc)
     return pred_count_test(oprbits, count, false);
 }
 
-uint32_t HELPER(sve_whileg)(void *vd, uint32_t count, uint32_t pred_desc)
+/* D must be cleared on entry. */
+static void do_whileg(ARMPredicateReg *d, uint64_t esz_mask,
+                      uint32_t count, uint32_t oprbits)
 {
-    intptr_t oprsz = FIELD_EX32(pred_desc, PREDDESC, OPRSZ);
-    intptr_t esz = FIELD_EX32(pred_desc, PREDDESC, ESZ);
-    uint64_t esz_mask = pred_esz_masks[esz];
-    ARMPredicateReg *d = vd;
-    intptr_t i, invcount, oprbits = oprsz * 8;
-    uint64_t bits;
-
     tcg_debug_assert(count <= oprbits);
-
-    /* Begin with a zero predicate register.  */
-    memset(d, 0, sizeof(*d));
     if (count) {
-        /* Set all of the requested bits.  */
-        bits = esz_mask;
-        if (oprbits & 63) {
-            bits &= MAKE_64BIT_MASK(0, oprbits & 63);
-        }
+        uint32_t i, invcount = oprbits - count;
+        uint64_t bits = esz_mask & MAKE_64BIT_MASK(invcount & 63, 64);
 
-        invcount = oprbits - count;
-        for (i = (oprsz - 1) / 8; i > invcount / 64; --i) {
+        for (i = invcount / 64; i < oprbits / 64; ++i) {
             d->p[i] = bits;
             bits = esz_mask;
         }
-        d->p[i] = bits & MAKE_64BIT_MASK(invcount & 63, 64);
+        if (oprbits & 63) {
+            d->p[i] = bits & MAKE_64BIT_MASK(0, oprbits & 63);
+        }
     }
+}
 
+uint32_t HELPER(sve_whileg)(void *vd, uint32_t count, uint32_t pred_desc)
+{
+    uint32_t oprsz = FIELD_EX32(pred_desc, PREDDESC, OPRSZ);
+    uint32_t esz = FIELD_EX32(pred_desc, PREDDESC, ESZ);
+    uint32_t oprbits = oprsz * 8;
+    uint64_t esz_mask = pred_esz_masks[esz];
+    ARMPredicateReg *d = vd;
+
+    memset(d, 0, sizeof(*d));
+    do_whileg(d, esz_mask, count, oprbits);
     return pred_count_test(oprbits, count, true);
 }
 

From f96fd13c6ea030871e114c0d274e61d0cd5ff3ca Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:20:38 -0600
Subject: [PATCH 2022/2760] target/arm: Move scale by esz into
 helper_sve_while*

Change the API to pass element count rather than bit count.
This will be helpful later for predicate as counter.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-76-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/sve_helper.c    |  2 ++
 target/arm/tcg/translate-sve.c | 13 +++++--------
 2 files changed, 7 insertions(+), 8 deletions(-)

diff --git a/target/arm/tcg/sve_helper.c b/target/arm/tcg/sve_helper.c
index 5e11e86e5e..b8f3fbb816 100644
--- a/target/arm/tcg/sve_helper.c
+++ b/target/arm/tcg/sve_helper.c
@@ -4133,6 +4133,7 @@ uint32_t HELPER(sve_whilel)(void *vd, uint32_t count, uint32_t pred_desc)
     uint64_t esz_mask = pred_esz_masks[esz];
     ARMPredicateReg *d = vd;
 
+    count <<= esz;
     memset(d, 0, sizeof(*d));
     do_whilel(d, esz_mask, count, oprbits);
     return pred_count_test(oprbits, count, false);
@@ -4165,6 +4166,7 @@ uint32_t HELPER(sve_whileg)(void *vd, uint32_t count, uint32_t pred_desc)
     uint64_t esz_mask = pred_esz_masks[esz];
     ARMPredicateReg *d = vd;
 
+    count <<= esz;
     memset(d, 0, sizeof(*d));
     do_whileg(d, esz_mask, count, oprbits);
     return pred_count_test(oprbits, count, true);
diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
index 210a029ab8..f74f2bb1b3 100644
--- a/target/arm/tcg/translate-sve.c
+++ b/target/arm/tcg/translate-sve.c
@@ -3198,9 +3198,6 @@ static bool trans_WHILE(DisasContext *s, arg_WHILE *a)
     t2 = tcg_temp_new_i32();
     tcg_gen_extrl_i64_i32(t2, t0);
 
-    /* Scale elements to bits.  */
-    tcg_gen_shli_i32(t2, t2, a->esz);
-
     desc = FIELD_DP32(desc, PREDDESC, OPRSZ, vsz / 8);
     desc = FIELD_DP32(desc, PREDDESC, ESZ, a->esz);
 
@@ -3234,7 +3231,7 @@ static bool trans_WHILE_ptr(DisasContext *s, arg_WHILE_ptr *a)
     op0 = read_cpu_reg(s, a->rn, 1);
     op1 = read_cpu_reg(s, a->rm, 1);
 
-    tmax = tcg_constant_i64(vsz);
+    tmax = tcg_constant_i64(vsz >> a->esz);
     diff = tcg_temp_new_i64();
 
     if (a->rw) {
@@ -3244,15 +3241,15 @@ static bool trans_WHILE_ptr(DisasContext *s, arg_WHILE_ptr *a)
         tcg_gen_sub_i64(diff, op0, op1);
         tcg_gen_sub_i64(t1, op1, op0);
         tcg_gen_movcond_i64(TCG_COND_GEU, diff, op0, op1, diff, t1);
-        /* Round down to a multiple of ESIZE.  */
-        tcg_gen_andi_i64(diff, diff, -1 << a->esz);
+        /* Divide, rounding down, by ESIZE.  */
+        tcg_gen_shri_i64(diff, diff, a->esz);
         /* If op1 == op0, diff == 0, and the condition is always true. */
         tcg_gen_movcond_i64(TCG_COND_EQ, diff, op0, op1, tmax, diff);
     } else {
         /* WHILEWR */
         tcg_gen_sub_i64(diff, op1, op0);
-        /* Round down to a multiple of ESIZE.  */
-        tcg_gen_andi_i64(diff, diff, -1 << a->esz);
+        /* Divide, rounding down, by ESIZE.  */
+        tcg_gen_shri_i64(diff, diff, a->esz);
         /* If op0 >= op1, diff <= 0, the condition is always true. */
         tcg_gen_movcond_i64(TCG_COND_GEU, diff, op0, op1, tmax, diff);
     }

From 54e260bbfc3fb4c6817d9a2457bdc9ef4d142f3a Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:20:39 -0600
Subject: [PATCH 2023/2760] target/arm: Split trans_WHILE to lt and gt

Use TRANS_FEAT to select the correct predicate.
Pass the helper and a boolean to do_WHILE.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-77-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/sve.decode      |  4 +++-
 target/arm/tcg/translate-sve.c | 23 +++++++++--------------
 2 files changed, 12 insertions(+), 15 deletions(-)

diff --git a/target/arm/tcg/sve.decode b/target/arm/tcg/sve.decode
index dcfc40ef44..c90d975ebf 100644
--- a/target/arm/tcg/sve.decode
+++ b/target/arm/tcg/sve.decode
@@ -789,7 +789,9 @@ SINCDECP_z      00100101 .. 1010 d:1 u:1 10000 00 .... .....    @incdec2_pred
 CTERM           00100101 1 sf:1 1 rm:5 001000 rn:5 ne:1 0000
 
 # SVE integer compare scalar count and limit
-WHILE           00100101 esz:2 1 rm:5 000 sf:1 u:1 lt:1 rn:5 eq:1 rd:4
+&while          esz rd rn rm sf u eq
+WHILE_lt        00100101 esz:2 1 rm:5 000 sf:1 u:1 1 rn:5 eq:1 rd:4  &while
+WHILE_gt        00100101 esz:2 1 rm:5 000 sf:1 u:1 0 rn:5 eq:1 rd:4  &while
 
 # SVE2 pointer conflict compare
 WHILE_ptr       00100101 esz:2 1 rm:5 001 100 rn:5 rw:1 rd:4
diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
index f74f2bb1b3..62d3e2efd6 100644
--- a/target/arm/tcg/translate-sve.c
+++ b/target/arm/tcg/translate-sve.c
@@ -3108,7 +3108,8 @@ static bool trans_CTERM(DisasContext *s, arg_CTERM *a)
     return true;
 }
 
-static bool trans_WHILE(DisasContext *s, arg_WHILE *a)
+typedef void gen_while_fn(TCGv_i32, TCGv_ptr, TCGv_i32, TCGv_i32);
+static bool do_WHILE(DisasContext *s, arg_while *a, bool lt, gen_while_fn *fn)
 {
     TCGv_i64 op0, op1, t0, t1, tmax;
     TCGv_i32 t2;
@@ -3118,14 +3119,8 @@ static bool trans_WHILE(DisasContext *s, arg_WHILE *a)
     TCGCond cond;
     uint64_t maxval;
     /* Note that GE/HS has a->eq == 0 and GT/HI has a->eq == 1. */
-    bool eq = a->eq == a->lt;
+    bool eq = a->eq == lt;
 
-    /* The greater-than conditions are all SVE2. */
-    if (a->lt
-        ? !dc_isar_feature(aa64_sve, s)
-        : !dc_isar_feature(aa64_sve2, s)) {
-        return false;
-    }
     if (!sve_access_check(s)) {
         return true;
     }
@@ -3149,7 +3144,7 @@ static bool trans_WHILE(DisasContext *s, arg_WHILE *a)
     t0 = tcg_temp_new_i64();
     t1 = tcg_temp_new_i64();
 
-    if (a->lt) {
+    if (lt) {
         tcg_gen_sub_i64(t0, op1, op0);
         if (a->u) {
             maxval = a->sf ? UINT64_MAX : UINT32_MAX;
@@ -3204,15 +3199,15 @@ static bool trans_WHILE(DisasContext *s, arg_WHILE *a)
     ptr = tcg_temp_new_ptr();
     tcg_gen_addi_ptr(ptr, tcg_env, pred_full_reg_offset(s, a->rd));
 
-    if (a->lt) {
-        gen_helper_sve_whilel(t2, ptr, t2, tcg_constant_i32(desc));
-    } else {
-        gen_helper_sve_whileg(t2, ptr, t2, tcg_constant_i32(desc));
-    }
+    fn(t2, ptr, t2, tcg_constant_i32(desc));
+
     do_pred_flags(t2);
     return true;
 }
 
+TRANS_FEAT(WHILE_lt, aa64_sve, do_WHILE, a, true, gen_helper_sve_whilel)
+TRANS_FEAT(WHILE_gt, aa64_sve2, do_WHILE, a, false, gen_helper_sve_whileg)
+
 static bool trans_WHILE_ptr(DisasContext *s, arg_WHILE_ptr *a)
 {
     TCGv_i64 op0, op1, diff, t1, tmax;

From b61f4530535a483688e76a925f6203fa22e332e8 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:20:40 -0600
Subject: [PATCH 2024/2760] target/arm: Enable PSEL for SVE2p1

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-78-richard.henderson@linaro.org
This instruction is present in both SME(1) and SVE2.1 extensions.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/translate-sve.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
index 62d3e2efd6..cb60b533e9 100644
--- a/target/arm/tcg/translate-sve.c
+++ b/target/arm/tcg/translate-sve.c
@@ -7273,7 +7273,7 @@ static bool trans_PSEL(DisasContext *s, arg_psel *a)
     TCGv_i64 tmp, didx, dbit;
     TCGv_ptr ptr;
 
-    if (!dc_isar_feature(aa64_sme, s)) {
+    if (!dc_isar_feature(aa64_sme_or_sve2p1, s)) {
         return false;
     }
     if (!sve_access_check(s)) {

From a3dde8e382cd90e5b48c363255bd9d8ef31d4232 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:20:41 -0600
Subject: [PATCH 2025/2760] target/arm: Implement SVE2p1 WHILE (predicate pair)

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-79-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/helper-sve.h    |  3 +++
 target/arm/tcg/sve.decode      |  8 +++++++
 target/arm/tcg/sve_helper.c    | 40 ++++++++++++++++++++++++++++++++++
 target/arm/tcg/translate-sve.c | 14 ++++++++----
 4 files changed, 61 insertions(+), 4 deletions(-)

diff --git a/target/arm/tcg/helper-sve.h b/target/arm/tcg/helper-sve.h
index 0b1b588783..eac23e75b9 100644
--- a/target/arm/tcg/helper-sve.h
+++ b/target/arm/tcg/helper-sve.h
@@ -941,6 +941,9 @@ DEF_HELPER_FLAGS_3(sve_cntp, TCG_CALL_NO_RWG, i64, ptr, ptr, i32)
 DEF_HELPER_FLAGS_3(sve_whilel, TCG_CALL_NO_RWG, i32, ptr, i32, i32)
 DEF_HELPER_FLAGS_3(sve_whileg, TCG_CALL_NO_RWG, i32, ptr, i32, i32)
 
+DEF_HELPER_FLAGS_3(sve_while2l, TCG_CALL_NO_RWG, i32, ptr, i32, i32)
+DEF_HELPER_FLAGS_3(sve_while2g, TCG_CALL_NO_RWG, i32, ptr, i32, i32)
+
 DEF_HELPER_FLAGS_4(sve_subri_b, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
 DEF_HELPER_FLAGS_4(sve_subri_h, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
 DEF_HELPER_FLAGS_4(sve_subri_s, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
diff --git a/target/arm/tcg/sve.decode b/target/arm/tcg/sve.decode
index c90d975ebf..968b2a57e9 100644
--- a/target/arm/tcg/sve.decode
+++ b/target/arm/tcg/sve.decode
@@ -796,6 +796,14 @@ WHILE_gt        00100101 esz:2 1 rm:5 000 sf:1 u:1 0 rn:5 eq:1 rd:4  &while
 # SVE2 pointer conflict compare
 WHILE_ptr       00100101 esz:2 1 rm:5 001 100 rn:5 rw:1 rd:4
 
+# SVE2.1 predicate pair
+%pd_pair        1:3 !function=times_2
+@while_pair     ........ esz:2 . rm:5 .... u:1 . rn:5 . ... eq:1 \
+                &while rd=%pd_pair sf=1
+
+WHILE_lt_pair   00100101 .. 1 ..... 0101 . 1 ..... 1 ... .  @while_pair
+WHILE_gt_pair   00100101 .. 1 ..... 0101 . 0 ..... 1 ... .  @while_pair
+
 ### SVE Integer Wide Immediate - Unpredicated Group
 
 # SVE broadcast floating-point immediate (unpredicated)
diff --git a/target/arm/tcg/sve_helper.c b/target/arm/tcg/sve_helper.c
index b8f3fbb816..30394f4880 100644
--- a/target/arm/tcg/sve_helper.c
+++ b/target/arm/tcg/sve_helper.c
@@ -4139,6 +4139,26 @@ uint32_t HELPER(sve_whilel)(void *vd, uint32_t count, uint32_t pred_desc)
     return pred_count_test(oprbits, count, false);
 }
 
+uint32_t HELPER(sve_while2l)(void *vd, uint32_t count, uint32_t pred_desc)
+{
+    uint32_t oprsz = FIELD_EX32(pred_desc, PREDDESC, OPRSZ);
+    uint32_t esz = FIELD_EX32(pred_desc, PREDDESC, ESZ);
+    uint32_t oprbits = oprsz * 8;
+    uint64_t esz_mask = pred_esz_masks[esz];
+    ARMPredicateReg *d = vd;
+
+    count <<= esz;
+    memset(d, 0, 2 * sizeof(*d));
+    if (count <= oprbits) {
+        do_whilel(&d[0], esz_mask, count, oprbits);
+    } else {
+        do_whilel(&d[0], esz_mask, oprbits, oprbits);
+        do_whilel(&d[1], esz_mask, count - oprbits, oprbits);
+    }
+
+    return pred_count_test(2 * oprbits, count, false);
+}
+
 /* D must be cleared on entry. */
 static void do_whileg(ARMPredicateReg *d, uint64_t esz_mask,
                       uint32_t count, uint32_t oprbits)
@@ -4172,6 +4192,26 @@ uint32_t HELPER(sve_whileg)(void *vd, uint32_t count, uint32_t pred_desc)
     return pred_count_test(oprbits, count, true);
 }
 
+uint32_t HELPER(sve_while2g)(void *vd, uint32_t count, uint32_t pred_desc)
+{
+    uint32_t oprsz = FIELD_EX32(pred_desc, PREDDESC, OPRSZ);
+    uint32_t esz = FIELD_EX32(pred_desc, PREDDESC, ESZ);
+    uint32_t oprbits = oprsz * 8;
+    uint64_t esz_mask = pred_esz_masks[esz];
+    ARMPredicateReg *d = vd;
+
+    count <<= esz;
+    memset(d, 0, 2 * sizeof(*d));
+    if (count <= oprbits) {
+        do_whileg(&d[1], esz_mask, count, oprbits);
+    } else {
+        do_whilel(&d[1], esz_mask, oprbits, oprbits);
+        do_whileg(&d[0], esz_mask, count - oprbits, oprbits);
+    }
+
+    return pred_count_test(2 * oprbits, count, true);
+}
+
 /* Recursive reduction on a function;
  * C.f. the ARM ARM function ReducePredicated.
  *
diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
index cb60b533e9..de6ffe7511 100644
--- a/target/arm/tcg/translate-sve.c
+++ b/target/arm/tcg/translate-sve.c
@@ -3109,7 +3109,8 @@ static bool trans_CTERM(DisasContext *s, arg_CTERM *a)
 }
 
 typedef void gen_while_fn(TCGv_i32, TCGv_ptr, TCGv_i32, TCGv_i32);
-static bool do_WHILE(DisasContext *s, arg_while *a, bool lt, gen_while_fn *fn)
+static bool do_WHILE(DisasContext *s, arg_while *a,
+                     bool lt, int scale, gen_while_fn *fn)
 {
     TCGv_i64 op0, op1, t0, t1, tmax;
     TCGv_i32 t2;
@@ -3164,7 +3165,7 @@ static bool do_WHILE(DisasContext *s, arg_while *a, bool lt, gen_while_fn *fn)
         }
     }
 
-    tmax = tcg_constant_i64(vsz >> a->esz);
+    tmax = tcg_constant_i64((vsz << scale) >> a->esz);
     if (eq) {
         /* Equality means one more iteration.  */
         tcg_gen_addi_i64(t0, t0, 1);
@@ -3205,8 +3206,13 @@ static bool do_WHILE(DisasContext *s, arg_while *a, bool lt, gen_while_fn *fn)
     return true;
 }
 
-TRANS_FEAT(WHILE_lt, aa64_sve, do_WHILE, a, true, gen_helper_sve_whilel)
-TRANS_FEAT(WHILE_gt, aa64_sve2, do_WHILE, a, false, gen_helper_sve_whileg)
+TRANS_FEAT(WHILE_lt, aa64_sve, do_WHILE, a, true, 0, gen_helper_sve_whilel)
+TRANS_FEAT(WHILE_gt, aa64_sve2, do_WHILE, a, false, 0, gen_helper_sve_whileg)
+
+TRANS_FEAT(WHILE_lt_pair, aa64_sme2_or_sve2p1, do_WHILE,
+           a, true, 1, gen_helper_sve_while2l)
+TRANS_FEAT(WHILE_gt_pair, aa64_sme2_or_sve2p1, do_WHILE,
+           a, false, 1, gen_helper_sve_while2g)
 
 static bool trans_WHILE_ptr(DisasContext *s, arg_WHILE_ptr *a)
 {

From f9cb0ac8ba387f7da6153d39d77b24271eb7d49c Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:20:42 -0600
Subject: [PATCH 2026/2760] target/arm: Implement SVE2p1 WHILE (predicate as
 counter)

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-80-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/helper-sve.h    |  3 ++
 target/arm/tcg/sve.decode      | 11 +++++++
 target/arm/tcg/sve_helper.c    | 53 ++++++++++++++++++++++++++++++++++
 target/arm/tcg/translate-sve.c | 22 ++++++++++----
 4 files changed, 84 insertions(+), 5 deletions(-)

diff --git a/target/arm/tcg/helper-sve.h b/target/arm/tcg/helper-sve.h
index eac23e75b9..74029c641b 100644
--- a/target/arm/tcg/helper-sve.h
+++ b/target/arm/tcg/helper-sve.h
@@ -944,6 +944,9 @@ DEF_HELPER_FLAGS_3(sve_whileg, TCG_CALL_NO_RWG, i32, ptr, i32, i32)
 DEF_HELPER_FLAGS_3(sve_while2l, TCG_CALL_NO_RWG, i32, ptr, i32, i32)
 DEF_HELPER_FLAGS_3(sve_while2g, TCG_CALL_NO_RWG, i32, ptr, i32, i32)
 
+DEF_HELPER_FLAGS_3(sve_whilecl, TCG_CALL_NO_RWG, i32, ptr, i32, i32)
+DEF_HELPER_FLAGS_3(sve_whilecg, TCG_CALL_NO_RWG, i32, ptr, i32, i32)
+
 DEF_HELPER_FLAGS_4(sve_subri_b, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
 DEF_HELPER_FLAGS_4(sve_subri_h, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
 DEF_HELPER_FLAGS_4(sve_subri_s, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
diff --git a/target/arm/tcg/sve.decode b/target/arm/tcg/sve.decode
index 968b2a57e9..389a72d824 100644
--- a/target/arm/tcg/sve.decode
+++ b/target/arm/tcg/sve.decode
@@ -59,6 +59,8 @@
 
 %rn_ax2         6:4 !function=times_2
 
+%pnd            0:3 !function=plus_8
+
 ###########################################################################
 # Named attribute sets.  These are used to make nice(er) names
 # when creating helpers common to those for the individual
@@ -804,6 +806,15 @@ WHILE_ptr       00100101 esz:2 1 rm:5 001 100 rn:5 rw:1 rd:4
 WHILE_lt_pair   00100101 .. 1 ..... 0101 . 1 ..... 1 ... .  @while_pair
 WHILE_gt_pair   00100101 .. 1 ..... 0101 . 0 ..... 1 ... .  @while_pair
 
+# SVE2.1 predicate as count
+@while_cnt      ........ esz:2 . rm:5 .... u:1 . rn:5 . eq:1 ... \
+                &while rd=%pnd sf=1
+
+WHILE_lt_cnt2   00100101 .. 1 ..... 0100 . 1 ..... 1 . ...  @while_cnt
+WHILE_lt_cnt4   00100101 .. 1 ..... 0110 . 1 ..... 1 . ...  @while_cnt
+WHILE_gt_cnt2   00100101 .. 1 ..... 0100 . 0 ..... 1 . ...  @while_cnt
+WHILE_gt_cnt4   00100101 .. 1 ..... 0110 . 0 ..... 1 . ...  @while_cnt
+
 ### SVE Integer Wide Immediate - Unpredicated Group
 
 # SVE broadcast floating-point immediate (unpredicated)
diff --git a/target/arm/tcg/sve_helper.c b/target/arm/tcg/sve_helper.c
index 30394f4880..713642d4c8 100644
--- a/target/arm/tcg/sve_helper.c
+++ b/target/arm/tcg/sve_helper.c
@@ -4090,6 +4090,29 @@ uint64_t HELPER(sve_cntp)(void *vn, void *vg, uint32_t pred_desc)
     return sum;
 }
 
+/* C.f. Arm pseudocode EncodePredCount */
+static uint64_t encode_pred_count(uint32_t elements, uint32_t count,
+                                  uint32_t esz, bool invert)
+{
+    uint32_t pred;
+
+    if (count == 0) {
+        return 0;
+    }
+    if (invert) {
+        count = elements - count;
+    } else if (count == elements) {
+        count = 0;
+        invert = true;
+    }
+
+    pred = (count << 1) | 1;
+    pred <<= esz;
+    pred |= invert << 15;
+
+    return pred;
+}
+
 /* C.f. Arm pseudocode PredCountTest */
 static uint32_t pred_count_test(uint32_t elements, uint32_t count, bool invert)
 {
@@ -4159,6 +4182,21 @@ uint32_t HELPER(sve_while2l)(void *vd, uint32_t count, uint32_t pred_desc)
     return pred_count_test(2 * oprbits, count, false);
 }
 
+uint32_t HELPER(sve_whilecl)(void *vd, uint32_t count, uint32_t pred_desc)
+{
+    uint32_t pl = FIELD_EX32(pred_desc, PREDDESC, OPRSZ);
+    uint32_t esz = FIELD_EX32(pred_desc, PREDDESC, ESZ);
+    uint32_t scale = FIELD_EX32(pred_desc, PREDDESC, DATA);
+    uint32_t vl = pl * 8;
+    uint32_t elements = (vl >> esz) << scale;
+    ARMPredicateReg *d = vd;
+
+    *d = (ARMPredicateReg) {
+        .p[0] = encode_pred_count(elements, count, esz, false)
+    };
+    return pred_count_test(elements, count, false);
+}
+
 /* D must be cleared on entry. */
 static void do_whileg(ARMPredicateReg *d, uint64_t esz_mask,
                       uint32_t count, uint32_t oprbits)
@@ -4212,6 +4250,21 @@ uint32_t HELPER(sve_while2g)(void *vd, uint32_t count, uint32_t pred_desc)
     return pred_count_test(2 * oprbits, count, true);
 }
 
+uint32_t HELPER(sve_whilecg)(void *vd, uint32_t count, uint32_t pred_desc)
+{
+    uint32_t pl = FIELD_EX32(pred_desc, PREDDESC, OPRSZ);
+    uint32_t esz = FIELD_EX32(pred_desc, PREDDESC, ESZ);
+    uint32_t scale = FIELD_EX32(pred_desc, PREDDESC, DATA);
+    uint32_t vl = pl * 8;
+    uint32_t elements = (vl >> esz) << scale;
+    ARMPredicateReg *d = vd;
+
+    *d = (ARMPredicateReg) {
+        .p[0] = encode_pred_count(elements, count, esz, true)
+    };
+    return pred_count_test(elements, count, true);
+}
+
 /* Recursive reduction on a function;
  * C.f. the ARM ARM function ReducePredicated.
  *
diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
index de6ffe7511..c93dca224c 100644
--- a/target/arm/tcg/translate-sve.c
+++ b/target/arm/tcg/translate-sve.c
@@ -3110,7 +3110,7 @@ static bool trans_CTERM(DisasContext *s, arg_CTERM *a)
 
 typedef void gen_while_fn(TCGv_i32, TCGv_ptr, TCGv_i32, TCGv_i32);
 static bool do_WHILE(DisasContext *s, arg_while *a,
-                     bool lt, int scale, gen_while_fn *fn)
+                     bool lt, int scale, int data, gen_while_fn *fn)
 {
     TCGv_i64 op0, op1, t0, t1, tmax;
     TCGv_i32 t2;
@@ -3196,6 +3196,7 @@ static bool do_WHILE(DisasContext *s, arg_while *a,
 
     desc = FIELD_DP32(desc, PREDDESC, OPRSZ, vsz / 8);
     desc = FIELD_DP32(desc, PREDDESC, ESZ, a->esz);
+    desc = FIELD_DP32(desc, PREDDESC, DATA, data);
 
     ptr = tcg_temp_new_ptr();
     tcg_gen_addi_ptr(ptr, tcg_env, pred_full_reg_offset(s, a->rd));
@@ -3206,13 +3207,24 @@ static bool do_WHILE(DisasContext *s, arg_while *a,
     return true;
 }
 
-TRANS_FEAT(WHILE_lt, aa64_sve, do_WHILE, a, true, 0, gen_helper_sve_whilel)
-TRANS_FEAT(WHILE_gt, aa64_sve2, do_WHILE, a, false, 0, gen_helper_sve_whileg)
+TRANS_FEAT(WHILE_lt, aa64_sve, do_WHILE,
+           a, true, 0, 0, gen_helper_sve_whilel)
+TRANS_FEAT(WHILE_gt, aa64_sve2, do_WHILE,
+           a, false, 0, 0, gen_helper_sve_whileg)
 
 TRANS_FEAT(WHILE_lt_pair, aa64_sme2_or_sve2p1, do_WHILE,
-           a, true, 1, gen_helper_sve_while2l)
+           a, true, 1, 0, gen_helper_sve_while2l)
 TRANS_FEAT(WHILE_gt_pair, aa64_sme2_or_sve2p1, do_WHILE,
-           a, false, 1, gen_helper_sve_while2g)
+           a, false, 1, 0, gen_helper_sve_while2g)
+
+TRANS_FEAT(WHILE_lt_cnt2, aa64_sme2_or_sve2p1, do_WHILE,
+           a, true, 1, 1, gen_helper_sve_whilecl)
+TRANS_FEAT(WHILE_lt_cnt4, aa64_sme2_or_sve2p1, do_WHILE,
+           a, true, 2, 2, gen_helper_sve_whilecl)
+TRANS_FEAT(WHILE_gt_cnt2, aa64_sme2_or_sve2p1, do_WHILE,
+           a, false, 1, 1, gen_helper_sve_whilecg)
+TRANS_FEAT(WHILE_gt_cnt4, aa64_sme2_or_sve2p1, do_WHILE,
+           a, false, 2, 2, gen_helper_sve_whilecg)
 
 static bool trans_WHILE_ptr(DisasContext *s, arg_WHILE_ptr *a)
 {

From b7094bc2528ee310ccabc05a494fe68ce9c06ce7 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:20:43 -0600
Subject: [PATCH 2027/2760] target/arm: Implement SVE2p1 PTRUE (predicate as
 counter)

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-81-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/sve.decode      |  1 +
 target/arm/tcg/translate-sve.c | 16 ++++++++++++++++
 2 files changed, 17 insertions(+)

diff --git a/target/arm/tcg/sve.decode b/target/arm/tcg/sve.decode
index 389a72d824..3517efb31b 100644
--- a/target/arm/tcg/sve.decode
+++ b/target/arm/tcg/sve.decode
@@ -730,6 +730,7 @@ PTEST           00100101 01 010000 11 pg:4 0 rn:4 0 0000
 
 # SVE predicate initialize
 PTRUE           00100101 esz:2 01100 s:1 111000 pat:5 0 rd:4
+PTRUE_cnt       00100101 esz:2 1000000111100000010 ...          rd=%pnd
 
 # SVE initialize FFR
 SETFFR          00100101 0010 1100 1001 0000 0000 0000
diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
index c93dca224c..651b4aa378 100644
--- a/target/arm/tcg/translate-sve.c
+++ b/target/arm/tcg/translate-sve.c
@@ -1679,6 +1679,22 @@ static bool do_predset(DisasContext *s, int esz, int rd, int pat, bool setflag)
 
 TRANS_FEAT(PTRUE, aa64_sve, do_predset, a->esz, a->rd, a->pat, a->s)
 
+static bool trans_PTRUE_cnt(DisasContext *s, arg_PTRUE_cnt *a)
+{
+    if (!dc_isar_feature(aa64_sme2_or_sve2p1, s)) {
+        return false;
+    }
+    if (sve_access_check(s)) {
+        /* Canonical TRUE is 0 count, invert bit, plus element size. */
+        int val = (1 << 15) | (1 << a->esz);
+
+        /* Write val to the first uint64_t; clear all of the rest. */
+        tcg_gen_gvec_dup_imm(MO_64, pred_full_reg_offset(s, a->rd),
+                             8, size_for_gvec(pred_full_reg_size(s)), val);
+    }
+    return true;
+}
+
 /* Note pat == 31 is #all, to set all elements.  */
 TRANS_FEAT_NONSTREAMING(SETFFR, aa64_sve,
                         do_predset, 0, FFR_PRED_NUM, 31, false)

From 8f7e127b66d0e51b3940c779695bc698138060d4 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:20:44 -0600
Subject: [PATCH 2028/2760] target/arm: Implement {ADD, SMIN, SMAX, UMIN,
 UMAX}QV for SVE2p1

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-82-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/helper-sve.h    | 25 ++++++++++++++++++
 target/arm/tcg/sve.decode      |  7 ++++++
 target/arm/tcg/sve_helper.c    | 46 ++++++++++++++++++++++++++++++++++
 target/arm/tcg/translate-sve.c | 35 ++++++++++++++++++++++++++
 4 files changed, 113 insertions(+)

diff --git a/target/arm/tcg/helper-sve.h b/target/arm/tcg/helper-sve.h
index 74029c641b..5f5ecc2e0d 100644
--- a/target/arm/tcg/helper-sve.h
+++ b/target/arm/tcg/helper-sve.h
@@ -2928,3 +2928,28 @@ DEF_HELPER_FLAGS_4(sve2_sqshlu_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(sve2_sqshlu_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(sve2_sqshlu_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(sve2_sqshlu_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(sve2p1_addqv_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sve2p1_addqv_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sve2p1_addqv_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sve2p1_addqv_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(sve2p1_smaxqv_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sve2p1_smaxqv_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sve2p1_smaxqv_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sve2p1_smaxqv_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(sve2p1_sminqv_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sve2p1_sminqv_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sve2p1_sminqv_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sve2p1_sminqv_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(sve2p1_umaxqv_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sve2p1_umaxqv_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sve2p1_umaxqv_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sve2p1_umaxqv_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(sve2p1_uminqv_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sve2p1_uminqv_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sve2p1_uminqv_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sve2p1_uminqv_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
diff --git a/target/arm/tcg/sve.decode b/target/arm/tcg/sve.decode
index 3517efb31b..a3221308ad 100644
--- a/target/arm/tcg/sve.decode
+++ b/target/arm/tcg/sve.decode
@@ -340,6 +340,13 @@ UMAXV           00000100 .. 001 001 001 ... ..... .....         @rd_pg_rn
 SMINV           00000100 .. 001 010 001 ... ..... .....         @rd_pg_rn
 UMINV           00000100 .. 001 011 001 ... ..... .....         @rd_pg_rn
 
+# SVE2.1 segment reduction
+ADDQV           00000100 .. 000 101 001 ... ..... .....         @rd_pg_rn
+SMAXQV          00000100 .. 001 100 001 ... ..... .....         @rd_pg_rn
+SMINQV          00000100 .. 001 110 001 ... ..... .....         @rd_pg_rn
+UMAXQV          00000100 .. 001 101 001 ... ..... .....         @rd_pg_rn
+UMINQV          00000100 .. 001 111 001 ... ..... .....         @rd_pg_rn
+
 ### SVE Shift by Immediate - Predicated Group
 
 # SVE bitwise shift by immediate (predicated)
diff --git a/target/arm/tcg/sve_helper.c b/target/arm/tcg/sve_helper.c
index 713642d4c8..625734fff9 100644
--- a/target/arm/tcg/sve_helper.c
+++ b/target/arm/tcg/sve_helper.c
@@ -1814,6 +1814,52 @@ DO_VPZ_D(sve_uminv_d, uint64_t, uint64_t, -1, DO_MIN)
 #undef DO_VPZ
 #undef DO_VPZ_D
 
+#define DO_VPQ(NAME, TYPE, H, INIT, OP) \
+void HELPER(NAME)(void *vd, void *vn, void *vg, uint32_t desc)          \
+{                                                                       \
+    TYPE tmp[16 / sizeof(TYPE)] = { [0 ... 16 / sizeof(TYPE) - 1] = INIT }; \
+    TYPE *n = vn; uint16_t *g = vg;                                     \
+    uintptr_t oprsz = simd_oprsz(desc);                                 \
+    uintptr_t nseg = oprsz / 16, nsegelt = 16 / sizeof(TYPE);           \
+    for (uintptr_t s = 0; s < nseg; s++) {                              \
+        uint16_t pg = g[H2(s)];                                         \
+        for (uintptr_t e = 0; e < nsegelt; e++, pg >>= sizeof(TYPE)) {  \
+            if (pg & 1) {                                               \
+                tmp[e] = OP(tmp[H(e)], n[s * nsegelt + H(e)]);          \
+            }                                                           \
+        }                                                               \
+    }                                                                   \
+    memcpy(vd, tmp, 16);                                                \
+    clear_tail(vd, 16, simd_maxsz(desc));                               \
+}
+
+DO_VPQ(sve2p1_addqv_b, uint8_t, H1, 0, DO_ADD)
+DO_VPQ(sve2p1_addqv_h, uint16_t, H2, 0, DO_ADD)
+DO_VPQ(sve2p1_addqv_s, uint32_t, H4, 0, DO_ADD)
+DO_VPQ(sve2p1_addqv_d, uint64_t, H8, 0, DO_ADD)
+
+DO_VPQ(sve2p1_smaxqv_b, int8_t, H1, INT8_MIN, DO_MAX)
+DO_VPQ(sve2p1_smaxqv_h, int16_t, H2, INT16_MIN, DO_MAX)
+DO_VPQ(sve2p1_smaxqv_s, int32_t, H4, INT32_MIN, DO_MAX)
+DO_VPQ(sve2p1_smaxqv_d, int64_t, H8, INT64_MIN, DO_MAX)
+
+DO_VPQ(sve2p1_sminqv_b, int8_t, H1, INT8_MAX, DO_MIN)
+DO_VPQ(sve2p1_sminqv_h, int16_t, H2, INT16_MAX, DO_MIN)
+DO_VPQ(sve2p1_sminqv_s, int32_t, H4, INT32_MAX, DO_MIN)
+DO_VPQ(sve2p1_sminqv_d, int64_t, H8, INT64_MAX, DO_MIN)
+
+DO_VPQ(sve2p1_umaxqv_b, uint8_t, H1, 0, DO_MAX)
+DO_VPQ(sve2p1_umaxqv_h, uint16_t, H2, 0, DO_MAX)
+DO_VPQ(sve2p1_umaxqv_s, uint32_t, H4, 0, DO_MAX)
+DO_VPQ(sve2p1_umaxqv_d, uint64_t, H8, 0, DO_MAX)
+
+DO_VPQ(sve2p1_uminqv_b, uint8_t, H1, -1, DO_MIN)
+DO_VPQ(sve2p1_uminqv_h, uint16_t, H2, -1, DO_MIN)
+DO_VPQ(sve2p1_uminqv_s, uint32_t, H4, -1, DO_MIN)
+DO_VPQ(sve2p1_uminqv_d, uint64_t, H8, -1, DO_MIN)
+
+#undef DO_VPQ
+
 /* Two vector operand, one scalar operand, unpredicated.  */
 #define DO_ZZI(NAME, TYPE, OP)                                       \
 void HELPER(NAME)(void *vd, void *vn, uint64_t s64, uint32_t desc)   \
diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
index 651b4aa378..2e29dff989 100644
--- a/target/arm/tcg/translate-sve.c
+++ b/target/arm/tcg/translate-sve.c
@@ -828,6 +828,41 @@ TRANS_FEAT(SXTW, aa64_sve, gen_gvec_ool_arg_zpz,
 TRANS_FEAT(UXTW, aa64_sve, gen_gvec_ool_arg_zpz,
            a->esz == 3 ? gen_helper_sve_uxtw_d : NULL, a, 0)
 
+static gen_helper_gvec_3 * const addqv_fns[4] = {
+    gen_helper_sve2p1_addqv_b, gen_helper_sve2p1_addqv_h,
+    gen_helper_sve2p1_addqv_s, gen_helper_sve2p1_addqv_d,
+};
+TRANS_FEAT(ADDQV, aa64_sme2p1_or_sve2p1,
+           gen_gvec_ool_arg_zpz, addqv_fns[a->esz], a, 0)
+
+static gen_helper_gvec_3 * const smaxqv_fns[4] = {
+    gen_helper_sve2p1_smaxqv_b, gen_helper_sve2p1_smaxqv_h,
+    gen_helper_sve2p1_smaxqv_s, gen_helper_sve2p1_smaxqv_d,
+};
+TRANS_FEAT(SMAXQV, aa64_sme2p1_or_sve2p1,
+           gen_gvec_ool_arg_zpz, smaxqv_fns[a->esz], a, 0)
+
+static gen_helper_gvec_3 * const sminqv_fns[4] = {
+    gen_helper_sve2p1_sminqv_b, gen_helper_sve2p1_sminqv_h,
+    gen_helper_sve2p1_sminqv_s, gen_helper_sve2p1_sminqv_d,
+};
+TRANS_FEAT(SMINQV, aa64_sme2p1_or_sve2p1,
+           gen_gvec_ool_arg_zpz, sminqv_fns[a->esz], a, 0)
+
+static gen_helper_gvec_3 * const umaxqv_fns[4] = {
+    gen_helper_sve2p1_umaxqv_b, gen_helper_sve2p1_umaxqv_h,
+    gen_helper_sve2p1_umaxqv_s, gen_helper_sve2p1_umaxqv_d,
+};
+TRANS_FEAT(UMAXQV, aa64_sme2p1_or_sve2p1,
+           gen_gvec_ool_arg_zpz, umaxqv_fns[a->esz], a, 0)
+
+static gen_helper_gvec_3 * const uminqv_fns[4] = {
+    gen_helper_sve2p1_uminqv_b, gen_helper_sve2p1_uminqv_h,
+    gen_helper_sve2p1_uminqv_s, gen_helper_sve2p1_uminqv_d,
+};
+TRANS_FEAT(UMINQV, aa64_sme2p1_or_sve2p1,
+           gen_gvec_ool_arg_zpz, uminqv_fns[a->esz], a, 0)
+
 /*
  *** SVE Integer Reduction Group
  */

From 16fe3bb942e80ae0a2cd0690629bb73cc131092b Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:20:45 -0600
Subject: [PATCH 2029/2760] target/arm: Implement SVE2p1 PEXT

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-83-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/helper-sve.h    |  2 +
 target/arm/tcg/sve.decode      |  6 +++
 target/arm/tcg/sve_helper.c    | 28 +++++++++++++
 target/arm/tcg/translate-sve.c | 36 +++++++++++++++++
 target/arm/tcg/vec_internal.h  | 74 ++++++++++++++++++++++++++++++++++
 5 files changed, 146 insertions(+)

diff --git a/target/arm/tcg/helper-sve.h b/target/arm/tcg/helper-sve.h
index 5f5ecc2e0d..ec82d0a4e7 100644
--- a/target/arm/tcg/helper-sve.h
+++ b/target/arm/tcg/helper-sve.h
@@ -2953,3 +2953,5 @@ DEF_HELPER_FLAGS_4(sve2p1_uminqv_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(sve2p1_uminqv_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(sve2p1_uminqv_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(sve2p1_uminqv_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_3(pext, TCG_CALL_NO_RWG, void, ptr, i32, i32)
diff --git a/target/arm/tcg/sve.decode b/target/arm/tcg/sve.decode
index a3221308ad..b762257759 100644
--- a/target/arm/tcg/sve.decode
+++ b/target/arm/tcg/sve.decode
@@ -60,6 +60,7 @@
 %rn_ax2         6:4 !function=times_2
 
 %pnd            0:3 !function=plus_8
+%pnn            5:3 !function=plus_8
 
 ###########################################################################
 # Named attribute sets.  These are used to make nice(er) names
@@ -823,6 +824,11 @@ WHILE_lt_cnt4   00100101 .. 1 ..... 0110 . 1 ..... 1 . ...  @while_cnt
 WHILE_gt_cnt2   00100101 .. 1 ..... 0100 . 0 ..... 1 . ...  @while_cnt
 WHILE_gt_cnt4   00100101 .. 1 ..... 0110 . 0 ..... 1 . ...  @while_cnt
 
+# SVE2.1 extract mask predicate from predicate-as-counter
+&pext           rd rn esz imm
+PEXT_1          00100101 esz:2 1 00000 0111 00 imm:2 ... 1 rd:4  &pext rn=%pnn
+PEXT_2          00100101 esz:2 1 00000 0111 010 imm:1 ... 1 rd:4 &pext rn=%pnn
+
 ### SVE Integer Wide Immediate - Unpredicated Group
 
 # SVE broadcast floating-point immediate (unpredicated)
diff --git a/target/arm/tcg/sve_helper.c b/target/arm/tcg/sve_helper.c
index 625734fff9..866f85ba30 100644
--- a/target/arm/tcg/sve_helper.c
+++ b/target/arm/tcg/sve_helper.c
@@ -7821,3 +7821,31 @@ DO_FCVTLT(sve2_fcvtlt_sd, uint64_t, uint32_t, H1_8, H1_4, float32_to_float64)
 
 #undef DO_FCVTLT
 #undef DO_FCVTNT
+
+void HELPER(pext)(void *vd, uint32_t png, uint32_t desc)
+{
+    int pl = FIELD_EX32(desc, PREDDESC, OPRSZ);
+    int vl = pl * 8;
+    unsigned v_esz = FIELD_EX32(desc, PREDDESC, ESZ);
+    int part = FIELD_EX32(desc, PREDDESC, DATA);
+    DecodeCounter p = decode_counter(png, vl, v_esz);
+    uint64_t mask = pred_esz_masks[v_esz + p.lg2_stride];
+    ARMPredicateReg *d = vd;
+
+    /*
+     * Convert from element count to byte count and adjust
+     * for the portion of the 4*VL counter to be extracted.
+     */
+    int b_count = (p.count << v_esz) - vl * part;
+
+    memset(d, 0, sizeof(*d));
+    if (p.invert) {
+        if (b_count <= 0) {
+            do_whilel(vd, mask, vl, vl);
+        } else if (b_count < vl) {
+            do_whileg(vd, mask, vl - b_count, vl);
+        }
+    } else if (b_count > 0) {
+        do_whilel(vd, mask, MIN(b_count, vl), vl);
+    }
+}
diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
index 2e29dff989..6ad4d1e289 100644
--- a/target/arm/tcg/translate-sve.c
+++ b/target/arm/tcg/translate-sve.c
@@ -3336,6 +3336,42 @@ static bool trans_WHILE_ptr(DisasContext *s, arg_WHILE_ptr *a)
     return true;
 }
 
+static bool do_pext(DisasContext *s, arg_pext *a, int n)
+{
+    TCGv_i32 t_png;
+    TCGv_ptr t_pd;
+    int pl;
+
+    if (!sve_access_check(s)) {
+        return true;
+    }
+
+    t_png = tcg_temp_new_i32();
+    tcg_gen_ld16u_i32(t_png, tcg_env,
+                      pred_full_reg_offset(s, a->rn) ^
+                      (HOST_BIG_ENDIAN ? 6 : 0));
+
+    t_pd = tcg_temp_new_ptr();
+    pl = pred_full_reg_size(s);
+
+    for (int i = 0; i < n; ++i) {
+        int rd = (a->rd + i) % 16;
+        int part = a->imm * n + i;
+        unsigned desc = 0;
+
+        desc = FIELD_DP32(desc, PREDDESC, OPRSZ, pl);
+        desc = FIELD_DP32(desc, PREDDESC, ESZ, a->esz);
+        desc = FIELD_DP32(desc, PREDDESC, DATA, part);
+
+        tcg_gen_addi_ptr(t_pd, tcg_env, pred_full_reg_offset(s, rd));
+        gen_helper_pext(t_pd, t_png, tcg_constant_i32(desc));
+    }
+    return true;
+}
+
+TRANS_FEAT(PEXT_1, aa64_sme2_or_sve2p1, do_pext, a, 1)
+TRANS_FEAT(PEXT_2, aa64_sme2_or_sve2p1, do_pext, a, 2)
+
 /*
  *** SVE Integer Wide Immediate - Unpredicated Group
  */
diff --git a/target/arm/tcg/vec_internal.h b/target/arm/tcg/vec_internal.h
index 5efd257c50..61c67bb35e 100644
--- a/target/arm/tcg/vec_internal.h
+++ b/target/arm/tcg/vec_internal.h
@@ -337,4 +337,78 @@ bfloat16 helper_sme2_ah_fmin_b16(bfloat16 a, bfloat16 b, float_status *fpst);
 float32 sve_f16_to_f32(float16 f, float_status *fpst);
 float16 sve_f32_to_f16(float32 f, float_status *fpst);
 
+/*
+ * Decode helper functions for predicate as counter.
+ */
+
+typedef struct {
+    unsigned count;
+    unsigned lg2_stride;
+    bool invert;
+} DecodeCounter;
+
+static inline DecodeCounter
+decode_counter(unsigned png, unsigned vl, unsigned v_esz)
+{
+    DecodeCounter ret = { };
+
+    /* C.f. Arm pseudocode CounterToPredicate. */
+    if (likely(png & 0xf)) {
+        unsigned p_esz = ctz32(png);
+
+        /*
+         * maxbit = log2(pl(bits) * 4)
+         *        = log2(vl(bytes) * 4)
+         *        = log2(vl) + 2
+         * maxbit_mask = ones<maxbit:0>
+         *             = (1 << (maxbit + 1)) - 1
+         *             = (1 << (log2(vl) + 2 + 1)) - 1
+         *             = (1 << (log2(vl) + 3)) - 1
+         *             = (pow2ceil(vl) << 3) - 1
+         */
+        ret.count = png & (((unsigned)pow2ceil(vl) << 3) - 1);
+        ret.count >>= p_esz + 1;
+
+        ret.invert = (png >> 15) & 1;
+
+        /*
+         * The Arm pseudocode for CounterToPredicate expands the count to
+         * a set of bits, and then the operation proceeds as for the original
+         * interpretation of predicates as a set of bits.
+         *
+         * We can avoid the expansion by adjusting the count and supplying
+         * an element stride.
+         */
+        if (unlikely(p_esz != v_esz)) {
+            if (p_esz < v_esz) {
+                /*
+                 * For predicate esz < vector esz, the expanded predicate
+                 * will have more bits set than will be consumed.
+                 * Adjust the count down, rounding up.
+                 * Consider p_esz = MO_8, v_esz = MO_64, count 14:
+                 * The expanded predicate would be
+                 *    0011 1111 1111 1111
+                 * The significant bits are
+                 *    ...1 ...1 ...1 ...1
+                 */
+                unsigned shift = v_esz - p_esz;
+                unsigned trunc = ret.count >> shift;
+                ret.count = trunc + (ret.count != (trunc << shift));
+            } else {
+                /*
+                 * For predicate esz > vector esz, the expanded predicate
+                 * will have bits set only at power-of-two multiples of
+                 * the vector esz.  Bits at other multiples will all be
+                 * false.  Adjust the count up, and supply the caller
+                 * with a stride of elements to skip.
+                 */
+                unsigned shift = p_esz - v_esz;
+                ret.count <<= shift;
+                ret.lg2_stride = shift;
+            }
+        }
+    }
+    return ret;
+}
+
 #endif /* TARGET_ARM_VEC_INTERNAL_H */

From ab6bf3d93d3296b46c106c5867db09e9d3bd8880 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:20:46 -0600
Subject: [PATCH 2030/2760] target/arm: Implement SME2 SEL

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-84-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/helper-sme.h    |   5 +
 target/arm/tcg/sme.decode      |   9 +
 target/arm/tcg/sme_helper.c    | 317 +++++++++++++++++++++++++++++++++
 target/arm/tcg/translate-sme.c |  31 ++++
 4 files changed, 362 insertions(+)

diff --git a/target/arm/tcg/helper-sme.h b/target/arm/tcg/helper-sme.h
index 78ba3d1f20..467073ea25 100644
--- a/target/arm/tcg/helper-sme.h
+++ b/target/arm/tcg/helper-sme.h
@@ -313,3 +313,8 @@ DEF_HELPER_FLAGS_5(sme2_fclamp_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i3
 DEF_HELPER_FLAGS_5(sme2_fclamp_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_5(sme2_fclamp_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_5(sme2_bfclamp, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+
+DEF_HELPER_FLAGS_5(sme2_sel_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32, i32)
+DEF_HELPER_FLAGS_5(sme2_sel_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32, i32)
+DEF_HELPER_FLAGS_5(sme2_sel_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32, i32)
+DEF_HELPER_FLAGS_5(sme2_sel_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32, i32)
diff --git a/target/arm/tcg/sme.decode b/target/arm/tcg/sme.decode
index c4b85a36d0..0a2ceea8be 100644
--- a/target/arm/tcg/sme.decode
+++ b/target/arm/tcg/sme.decode
@@ -878,6 +878,15 @@ UCLAMP          11000001 esz:2 1 zm:5 110001 zn:5 .... 1    \
 UCLAMP          11000001 esz:2 1 zm:5 110011 zn:5 ...0 1    \
                 &zzz_en zd=%zd_ax4 n=4
 
+### SME2 Multi-vector SVE Select
+
+%sel_pg         10:3 !function=plus_8
+
+SEL             11000001 esz:2 1 ....0 100 ... ....0 ....0  \
+                n=2 zd=%zd_ax2 zn=%zn_ax2 zm=%zm_ax2 pg=%sel_pg
+SEL             11000001 esz:2 1 ...01 100 ... ...00 ...00  \
+                n=4 zd=%zd_ax4 zn=%zn_ax4 zm=%zm_ax4 pg=%sel_pg
+
 ### SME Multiple Zero
 
 &zero_za        rv off ngrp nvec
diff --git a/target/arm/tcg/sme_helper.c b/target/arm/tcg/sme_helper.c
index 8a1f9fbf3d..c1166e4ffa 100644
--- a/target/arm/tcg/sme_helper.c
+++ b/target/arm/tcg/sme_helper.c
@@ -2118,3 +2118,320 @@ FCLAMP(sme2_fclamp_d, float64, H8)
 FCLAMP(sme2_bfclamp, bfloat16, H2)
 
 #undef FCLAMP
+
+void HELPER(sme2_sel_b)(void *vd, void *vn, void *vm,
+                        uint32_t png, uint32_t desc)
+{
+    int vl = simd_oprsz(desc);
+    int nreg = simd_data(desc);
+    int elements = vl / sizeof(uint8_t);
+    DecodeCounter p = decode_counter(png, vl, MO_8);
+
+    if (p.lg2_stride == 0) {
+        if (p.invert) {
+            for (int r = 0; r < nreg; r++) {
+                uint8_t *d = vd + r * sizeof(ARMVectorReg);
+                uint8_t *n = vn + r * sizeof(ARMVectorReg);
+                uint8_t *m = vm + r * sizeof(ARMVectorReg);
+                int split = p.count - r * elements;
+
+                if (split <= 0) {
+                    memcpy(d, n, vl);  /* all true */
+                } else if (elements <= split) {
+                    memcpy(d, m, vl);  /* all false */
+                } else {
+                    for (int e = 0; e < split; e++) {
+                        d[H1(e)] = m[H1(e)];
+                    }
+                    for (int e = split; e < elements; e++) {
+                        d[H1(e)] = n[H1(e)];
+                    }
+                }
+            }
+        } else {
+            for (int r = 0; r < nreg; r++) {
+                uint8_t *d = vd + r * sizeof(ARMVectorReg);
+                uint8_t *n = vn + r * sizeof(ARMVectorReg);
+                uint8_t *m = vm + r * sizeof(ARMVectorReg);
+                int split = p.count - r * elements;
+
+                if (split <= 0) {
+                    memcpy(d, m, vl);  /* all false */
+                } else if (elements <= split) {
+                    memcpy(d, n, vl);  /* all true */
+                } else {
+                    for (int e = 0; e < split; e++) {
+                        d[H1(e)] = n[H1(e)];
+                    }
+                    for (int e = split; e < elements; e++) {
+                        d[H1(e)] = m[H1(e)];
+                    }
+                }
+            }
+        }
+    } else {
+        int estride = 1 << p.lg2_stride;
+        if (p.invert) {
+            for (int r = 0; r < nreg; r++) {
+                uint8_t *d = vd + r * sizeof(ARMVectorReg);
+                uint8_t *n = vn + r * sizeof(ARMVectorReg);
+                uint8_t *m = vm + r * sizeof(ARMVectorReg);
+                int split = p.count - r * elements;
+                int e = 0;
+
+                for (; e < MIN(split, elements); e++) {
+                    d[H1(e)] = m[H1(e)];
+                }
+                for (; e < elements; e += estride) {
+                    d[H1(e)] = n[H1(e)];
+                    for (int i = 1; i < estride; i++) {
+                        d[H1(e + i)] = m[H1(e + i)];
+                    }
+                }
+            }
+        } else {
+            for (int r = 0; r < nreg; r++) {
+                uint8_t *d = vd + r * sizeof(ARMVectorReg);
+                uint8_t *n = vn + r * sizeof(ARMVectorReg);
+                uint8_t *m = vm + r * sizeof(ARMVectorReg);
+                int split = p.count - r * elements;
+                int e = 0;
+
+                for (; e < MIN(split, elements); e += estride) {
+                    d[H1(e)] = n[H1(e)];
+                    for (int i = 1; i < estride; i++) {
+                        d[H1(e + i)] = m[H1(e + i)];
+                    }
+                }
+                for (; e < elements; e++) {
+                    d[H1(e)] = m[H1(e)];
+                }
+            }
+        }
+    }
+}
+
+void HELPER(sme2_sel_h)(void *vd, void *vn, void *vm,
+                        uint32_t png, uint32_t desc)
+{
+    int vl = simd_oprsz(desc);
+    int nreg = simd_data(desc);
+    int elements = vl / sizeof(uint16_t);
+    DecodeCounter p = decode_counter(png, vl, MO_16);
+
+    if (p.lg2_stride == 0) {
+        if (p.invert) {
+            for (int r = 0; r < nreg; r++) {
+                uint16_t *d = vd + r * sizeof(ARMVectorReg);
+                uint16_t *n = vn + r * sizeof(ARMVectorReg);
+                uint16_t *m = vm + r * sizeof(ARMVectorReg);
+                int split = p.count - r * elements;
+
+                if (split <= 0) {
+                    memcpy(d, n, vl);  /* all true */
+                } else if (elements <= split) {
+                    memcpy(d, m, vl);  /* all false */
+                } else {
+                    for (int e = 0; e < split; e++) {
+                        d[H2(e)] = m[H2(e)];
+                    }
+                    for (int e = split; e < elements; e++) {
+                        d[H2(e)] = n[H2(e)];
+                    }
+                }
+            }
+        } else {
+            for (int r = 0; r < nreg; r++) {
+                uint16_t *d = vd + r * sizeof(ARMVectorReg);
+                uint16_t *n = vn + r * sizeof(ARMVectorReg);
+                uint16_t *m = vm + r * sizeof(ARMVectorReg);
+                int split = p.count - r * elements;
+
+                if (split <= 0) {
+                    memcpy(d, m, vl);  /* all false */
+                } else if (elements <= split) {
+                    memcpy(d, n, vl);  /* all true */
+                } else {
+                    for (int e = 0; e < split; e++) {
+                        d[H2(e)] = n[H2(e)];
+                    }
+                    for (int e = split; e < elements; e++) {
+                        d[H2(e)] = m[H2(e)];
+                    }
+                }
+            }
+        }
+    } else {
+        int estride = 1 << p.lg2_stride;
+        if (p.invert) {
+            for (int r = 0; r < nreg; r++) {
+                uint16_t *d = vd + r * sizeof(ARMVectorReg);
+                uint16_t *n = vn + r * sizeof(ARMVectorReg);
+                uint16_t *m = vm + r * sizeof(ARMVectorReg);
+                int split = p.count - r * elements;
+                int e = 0;
+
+                for (; e < MIN(split, elements); e++) {
+                    d[H2(e)] = m[H2(e)];
+                }
+                for (; e < elements; e += estride) {
+                    d[H2(e)] = n[H2(e)];
+                    for (int i = 1; i < estride; i++) {
+                        d[H2(e + i)] = m[H2(e + i)];
+                    }
+                }
+            }
+        } else {
+            for (int r = 0; r < nreg; r++) {
+                uint16_t *d = vd + r * sizeof(ARMVectorReg);
+                uint16_t *n = vn + r * sizeof(ARMVectorReg);
+                uint16_t *m = vm + r * sizeof(ARMVectorReg);
+                int split = p.count - r * elements;
+                int e = 0;
+
+                for (; e < MIN(split, elements); e += estride) {
+                    d[H2(e)] = n[H2(e)];
+                    for (int i = 1; i < estride; i++) {
+                        d[H2(e + i)] = m[H2(e + i)];
+                    }
+                }
+                for (; e < elements; e++) {
+                    d[H2(e)] = m[H2(e)];
+                }
+            }
+        }
+    }
+}
+
+void HELPER(sme2_sel_s)(void *vd, void *vn, void *vm,
+                        uint32_t png, uint32_t desc)
+{
+    int vl = simd_oprsz(desc);
+    int nreg = simd_data(desc);
+    int elements = vl / sizeof(uint32_t);
+    DecodeCounter p = decode_counter(png, vl, MO_32);
+
+    if (p.lg2_stride == 0) {
+        if (p.invert) {
+            for (int r = 0; r < nreg; r++) {
+                uint32_t *d = vd + r * sizeof(ARMVectorReg);
+                uint32_t *n = vn + r * sizeof(ARMVectorReg);
+                uint32_t *m = vm + r * sizeof(ARMVectorReg);
+                int split = p.count - r * elements;
+
+                if (split <= 0) {
+                    memcpy(d, n, vl);  /* all true */
+                } else if (elements <= split) {
+                    memcpy(d, m, vl);  /* all false */
+                } else {
+                    for (int e = 0; e < split; e++) {
+                        d[H4(e)] = m[H4(e)];
+                    }
+                    for (int e = split; e < elements; e++) {
+                        d[H4(e)] = n[H4(e)];
+                    }
+                }
+            }
+        } else {
+            for (int r = 0; r < nreg; r++) {
+                uint32_t *d = vd + r * sizeof(ARMVectorReg);
+                uint32_t *n = vn + r * sizeof(ARMVectorReg);
+                uint32_t *m = vm + r * sizeof(ARMVectorReg);
+                int split = p.count - r * elements;
+
+                if (split <= 0) {
+                    memcpy(d, m, vl);  /* all false */
+                } else if (elements <= split) {
+                    memcpy(d, n, vl);  /* all true */
+                } else {
+                    for (int e = 0; e < split; e++) {
+                        d[H4(e)] = n[H4(e)];
+                    }
+                    for (int e = split; e < elements; e++) {
+                        d[H4(e)] = m[H4(e)];
+                    }
+                }
+            }
+        }
+    } else {
+        /* p.esz must be MO_64, so stride must be 2. */
+        if (p.invert) {
+            for (int r = 0; r < nreg; r++) {
+                uint32_t *d = vd + r * sizeof(ARMVectorReg);
+                uint32_t *n = vn + r * sizeof(ARMVectorReg);
+                uint32_t *m = vm + r * sizeof(ARMVectorReg);
+                int split = p.count - r * elements;
+                int e = 0;
+
+                for (; e < MIN(split, elements); e++) {
+                    d[H4(e)] = m[H4(e)];
+                }
+                for (; e < elements; e += 2) {
+                    d[H4(e)] = n[H4(e)];
+                    d[H4(e + 1)] = m[H4(e + 1)];
+                }
+            }
+        } else {
+            for (int r = 0; r < nreg; r++) {
+                uint32_t *d = vd + r * sizeof(ARMVectorReg);
+                uint32_t *n = vn + r * sizeof(ARMVectorReg);
+                uint32_t *m = vm + r * sizeof(ARMVectorReg);
+                int split = p.count - r * elements;
+                int e = 0;
+
+                for (; e < MIN(split, elements); e += 2) {
+                    d[H4(e)] = n[H4(e)];
+                    d[H4(e + 1)] = m[H4(e + 1)];
+                }
+                for (; e < elements; e++) {
+                    d[H4(e)] = m[H4(e)];
+                }
+            }
+        }
+    }
+}
+
+void HELPER(sme2_sel_d)(void *vd, void *vn, void *vm,
+                        uint32_t png, uint32_t desc)
+{
+    int vl = simd_oprsz(desc);
+    int nreg = simd_data(desc);
+    int elements = vl / sizeof(uint64_t);
+    DecodeCounter p = decode_counter(png, vl, MO_64);
+
+    if (p.invert) {
+        for (int r = 0; r < nreg; r++) {
+            uint64_t *d = vd + r * sizeof(ARMVectorReg);
+            uint64_t *n = vn + r * sizeof(ARMVectorReg);
+            uint64_t *m = vm + r * sizeof(ARMVectorReg);
+            int split = p.count - r * elements;
+
+            if (split <= 0) {
+                memcpy(d, n, vl);  /* all true */
+            } else if (elements <= split) {
+                memcpy(d, m, vl);  /* all false */
+            } else {
+                memcpy(d, m, split * sizeof(uint64_t));
+                memcpy(d + split, n + split,
+                       (elements - split) * sizeof(uint64_t));
+            }
+        }
+    } else {
+        for (int r = 0; r < nreg; r++) {
+            uint64_t *d = vd + r * sizeof(ARMVectorReg);
+            uint64_t *n = vn + r * sizeof(ARMVectorReg);
+            uint64_t *m = vm + r * sizeof(ARMVectorReg);
+            int split = p.count - r * elements;
+
+            if (split <= 0) {
+                memcpy(d, m, vl);  /* all false */
+            } else if (elements <= split) {
+                memcpy(d, n, vl);  /* all true */
+            } else {
+                memcpy(d, n, split * sizeof(uint64_t));
+                memcpy(d + split, m + split,
+                       (elements - split) * sizeof(uint64_t));
+            }
+        }
+    }
+}
diff --git a/target/arm/tcg/translate-sme.c b/target/arm/tcg/translate-sme.c
index b6316ac716..7407597177 100644
--- a/target/arm/tcg/translate-sme.c
+++ b/target/arm/tcg/translate-sme.c
@@ -1642,3 +1642,34 @@ static gen_helper_gvec_3 * const uclamp_fns[] = {
     gen_helper_sme2_uclamp_d,
 };
 TRANS(UCLAMP, do_clamp, a, uclamp_fns)
+
+static bool trans_SEL(DisasContext *s, arg_SEL *a)
+{
+    typedef void sme_sel_fn(TCGv_ptr, TCGv_ptr, TCGv_ptr, TCGv_i32, TCGv_i32);
+    static sme_sel_fn * const fns[4] = {
+        gen_helper_sme2_sel_b, gen_helper_sme2_sel_h,
+        gen_helper_sme2_sel_s, gen_helper_sme2_sel_d
+    };
+
+    if (!dc_isar_feature(aa64_sme2, s)) {
+        return false;
+    }
+    if (sme_sm_enabled_check(s)) {
+        int svl = streaming_vec_reg_size(s);
+        uint32_t desc = simd_desc(svl, svl, a->n);
+        TCGv_ptr t_d = tcg_temp_new_ptr();
+        TCGv_ptr t_n = tcg_temp_new_ptr();
+        TCGv_ptr t_m = tcg_temp_new_ptr();
+        TCGv_i32 png = tcg_temp_new_i32();
+
+        tcg_gen_addi_ptr(t_d, tcg_env, vec_full_reg_offset(s, a->zd));
+        tcg_gen_addi_ptr(t_n, tcg_env, vec_full_reg_offset(s, a->zn));
+        tcg_gen_addi_ptr(t_m, tcg_env, vec_full_reg_offset(s, a->zm));
+
+        tcg_gen_ld16u_i32(png, tcg_env, pred_full_reg_offset(s, a->pg)
+                          ^ (HOST_BIG_ENDIAN ? 6 : 0));
+
+        fns[a->esz](t_d, t_n, t_m, png, tcg_constant_i32(desc));
+    }
+    return true;
+}

From 5b334d17e639799904b2aa873b9cbd7c08b7ab8f Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:20:47 -0600
Subject: [PATCH 2031/2760] target/arm: Implement ANDQV, ORQV, EORQV for SVE2p1

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-85-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/helper-sve.h    | 15 ++++++++++++
 target/arm/tcg/sve.decode      |  5 ++++
 target/arm/tcg/sve_helper.c    | 42 ++++++++++++++++++++++++++++++++++
 target/arm/tcg/translate-sve.c |  3 +++
 4 files changed, 65 insertions(+)

diff --git a/target/arm/tcg/helper-sve.h b/target/arm/tcg/helper-sve.h
index ec82d0a4e7..9758613b2d 100644
--- a/target/arm/tcg/helper-sve.h
+++ b/target/arm/tcg/helper-sve.h
@@ -2955,3 +2955,18 @@ DEF_HELPER_FLAGS_4(sve2p1_uminqv_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(sve2p1_uminqv_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 
 DEF_HELPER_FLAGS_3(pext, TCG_CALL_NO_RWG, void, ptr, i32, i32)
+
+DEF_HELPER_FLAGS_4(sve2p1_orqv_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sve2p1_orqv_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sve2p1_orqv_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sve2p1_orqv_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(sve2p1_eorqv_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sve2p1_eorqv_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sve2p1_eorqv_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sve2p1_eorqv_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(sve2p1_andqv_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sve2p1_andqv_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sve2p1_andqv_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sve2p1_andqv_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
diff --git a/target/arm/tcg/sve.decode b/target/arm/tcg/sve.decode
index b762257759..ff740f7b40 100644
--- a/target/arm/tcg/sve.decode
+++ b/target/arm/tcg/sve.decode
@@ -326,6 +326,11 @@ ORV             00000100 .. 011 000 001 ... ..... .....         @rd_pg_rn
 EORV            00000100 .. 011 001 001 ... ..... .....         @rd_pg_rn
 ANDV            00000100 .. 011 010 001 ... ..... .....         @rd_pg_rn
 
+# SVE2.1 bitwise logical reduction (quadwords)
+ORQV            00000100 .. 011 100 001 ... ..... .....         @rd_pg_rn
+EORQV           00000100 .. 011 101 001 ... ..... .....         @rd_pg_rn
+ANDQV           00000100 .. 011 110 001 ... ..... .....         @rd_pg_rn
+
 # SVE constructive prefix (predicated)
 MOVPRFX_z       00000100 .. 010 000 001 ... ..... .....         @rd_pg_rn
 MOVPRFX_m       00000100 .. 010 001 001 ... ..... .....         @rd_pg_rn
diff --git a/target/arm/tcg/sve_helper.c b/target/arm/tcg/sve_helper.c
index 866f85ba30..f47e719fbe 100644
--- a/target/arm/tcg/sve_helper.c
+++ b/target/arm/tcg/sve_helper.c
@@ -123,6 +123,11 @@ static inline uint64_t expand_pred_s(uint8_t byte)
     return word[byte & 0x11];
 }
 
+static inline uint64_t expand_pred_d(uint8_t byte)
+{
+    return -(uint64_t)(byte & 1);
+}
+
 #define LOGICAL_PPPP(NAME, FUNC) \
 void HELPER(NAME)(void *vd, void *vn, void *vm, void *vg, uint32_t desc)  \
 {                                                                         \
@@ -206,6 +211,7 @@ void HELPER(NAME)(void *vd, void *vn, void *vm, void *vg, uint32_t desc) \
 #define DO_EOR(N, M)  (N ^ M)
 #define DO_ORR(N, M)  (N | M)
 #define DO_BIC(N, M)  (N & ~M)
+#define DO_ORC(N, M)  (N | ~M)
 #define DO_ADD(N, M)  (N + M)
 #define DO_SUB(N, M)  (N - M)
 #define DO_MAX(N, M)  ((N) >= (M) ? (N) : (M))
@@ -1900,10 +1906,46 @@ DO_ZZI(sve_umini_d, uint64_t, DO_MIN)
 
 #undef DO_ZZI
 
+#define DO_LOGIC_QV(NAME, SUFF, INIT, VOP, POP)                         \
+void HELPER(NAME ## _ ## SUFF)(void *vd, void *vn, void *vg, uint32_t desc) \
+{                                                                       \
+    unsigned seg = simd_oprsz(desc) / 16;                               \
+    uint64_t r0 = INIT, r1 = INIT;                                      \
+    for (unsigned s = 0; s < seg; s++) {                                \
+        uint64_t p0 = expand_pred_##SUFF(*(uint8_t *)(vg + H1(s * 2))); \
+        uint64_t p1 = expand_pred_##SUFF(*(uint8_t *)(vg + H1(s * 2 + 1))); \
+        uint64_t v0 = *(uint64_t *)(vn + s * 16);                       \
+        uint64_t v1 = *(uint64_t *)(vn + s * 16 + 8);                   \
+        v0 = POP(v0, p0), v1 = POP(v1, p1);                             \
+        r0 = VOP(r0, v0), r1 = VOP(r1, v1);                             \
+    }                                                                   \
+    *(uint64_t *)(vd + 0) = r0;                                         \
+    *(uint64_t *)(vd + 8) = r1;                                         \
+    clear_tail(vd, 16, simd_maxsz(desc));                               \
+}
+
+DO_LOGIC_QV(sve2p1_orqv, b, 0, DO_ORR, DO_AND)
+DO_LOGIC_QV(sve2p1_orqv, h, 0, DO_ORR, DO_AND)
+DO_LOGIC_QV(sve2p1_orqv, s, 0, DO_ORR, DO_AND)
+DO_LOGIC_QV(sve2p1_orqv, d, 0, DO_ORR, DO_AND)
+
+DO_LOGIC_QV(sve2p1_eorqv, b, 0, DO_EOR, DO_AND)
+DO_LOGIC_QV(sve2p1_eorqv, h, 0, DO_EOR, DO_AND)
+DO_LOGIC_QV(sve2p1_eorqv, s, 0, DO_EOR, DO_AND)
+DO_LOGIC_QV(sve2p1_eorqv, d, 0, DO_EOR, DO_AND)
+
+DO_LOGIC_QV(sve2p1_andqv, b, -1, DO_AND, DO_ORC)
+DO_LOGIC_QV(sve2p1_andqv, h, -1, DO_AND, DO_ORC)
+DO_LOGIC_QV(sve2p1_andqv, s, -1, DO_AND, DO_ORC)
+DO_LOGIC_QV(sve2p1_andqv, d, -1, DO_AND, DO_ORC)
+
+#undef DO_LOGIC_QV
+
 #undef DO_AND
 #undef DO_ORR
 #undef DO_EOR
 #undef DO_BIC
+#undef DO_ORC
 #undef DO_ADD
 #undef DO_SUB
 #undef DO_MAX
diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
index 6ad4d1e289..2114b2ecca 100644
--- a/target/arm/tcg/translate-sve.c
+++ b/target/arm/tcg/translate-sve.c
@@ -778,6 +778,9 @@ DO_ZPZ(NOT_zpz, aa64_sve, sve_not_zpz)
 DO_ZPZ(ABS, aa64_sve, sve_abs)
 DO_ZPZ(NEG, aa64_sve, sve_neg)
 DO_ZPZ(RBIT, aa64_sve, sve_rbit)
+DO_ZPZ(ORQV, aa64_sme2p1_or_sve2p1, sve2p1_orqv)
+DO_ZPZ(EORQV, aa64_sme2p1_or_sve2p1, sve2p1_eorqv)
+DO_ZPZ(ANDQV, aa64_sme2p1_or_sve2p1, sve2p1_andqv)
 
 static gen_helper_gvec_3 * const fabs_fns[4] = {
     NULL,                  gen_helper_sve_fabs_h,

From 1de7ecfc12d05d5c7929c22ccdaf7c834f6f2305 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:20:48 -0600
Subject: [PATCH 2032/2760] target/arm: Implement FADDQV, F{MIN, MAX}{NM}QV for
 SVE2p1

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-86-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/helper-sve.h    | 49 ++++++++++++++++++++++++
 target/arm/tcg/sve.decode      |  8 ++++
 target/arm/tcg/sve_helper.c    | 70 +++++++++++++++++++++-------------
 target/arm/tcg/translate-sve.c | 48 +++++++++++++++++++++++
 4 files changed, 148 insertions(+), 27 deletions(-)

diff --git a/target/arm/tcg/helper-sve.h b/target/arm/tcg/helper-sve.h
index 9758613b2d..906da384dc 100644
--- a/target/arm/tcg/helper-sve.h
+++ b/target/arm/tcg/helper-sve.h
@@ -1077,6 +1077,55 @@ DEF_HELPER_FLAGS_4(sve_ah_fminv_s, TCG_CALL_NO_RWG,
 DEF_HELPER_FLAGS_4(sve_ah_fminv_d, TCG_CALL_NO_RWG,
                    i64, ptr, ptr, fpst, i32)
 
+DEF_HELPER_FLAGS_5(sve2p1_faddqv_h, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(sve2p1_faddqv_s, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(sve2p1_faddqv_d, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, fpst, i32)
+
+DEF_HELPER_FLAGS_5(sve2p1_fmaxnmqv_h, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(sve2p1_fmaxnmqv_s, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(sve2p1_fmaxnmqv_d, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, fpst, i32)
+
+DEF_HELPER_FLAGS_5(sve2p1_fminnmqv_h, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(sve2p1_fminnmqv_s, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(sve2p1_fminnmqv_d, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, fpst, i32)
+
+DEF_HELPER_FLAGS_5(sve2p1_fmaxqv_h, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(sve2p1_fmaxqv_s, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(sve2p1_fmaxqv_d, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, fpst, i32)
+
+DEF_HELPER_FLAGS_5(sve2p1_fminqv_h, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(sve2p1_fminqv_s, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(sve2p1_fminqv_d, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, fpst, i32)
+
+DEF_HELPER_FLAGS_5(sve2p1_ah_fmaxqv_h, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(sve2p1_ah_fmaxqv_s, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(sve2p1_ah_fmaxqv_d, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, fpst, i32)
+
+DEF_HELPER_FLAGS_5(sve2p1_ah_fminqv_h, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(sve2p1_ah_fminqv_s, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_5(sve2p1_ah_fminqv_d, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, fpst, i32)
+
 DEF_HELPER_FLAGS_5(sve_fadda_h, TCG_CALL_NO_RWG,
                    i64, i64, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_5(sve_fadda_s, TCG_CALL_NO_RWG,
diff --git a/target/arm/tcg/sve.decode b/target/arm/tcg/sve.decode
index ff740f7b40..10cac2de22 100644
--- a/target/arm/tcg/sve.decode
+++ b/target/arm/tcg/sve.decode
@@ -1036,6 +1036,14 @@ FMINNMV         01100101 .. 000 101 001 ... ..... .....         @rd_pg_rn
 FMAXV           01100101 .. 000 110 001 ... ..... .....         @rd_pg_rn
 FMINV           01100101 .. 000 111 001 ... ..... .....         @rd_pg_rn
 
+### SVE FP recursive reduction (quadwords)
+
+FADDQV          01100100 .. 010 000 101 ... ..... .....         @rd_pg_rn
+FMAXNMQV        01100100 .. 010 100 101 ... ..... .....         @rd_pg_rn
+FMINNMQV        01100100 .. 010 101 101 ... ..... .....         @rd_pg_rn
+FMAXQV          01100100 .. 010 110 101 ... ..... .....         @rd_pg_rn
+FMINQV          01100100 .. 010 111 101 ... ..... .....         @rd_pg_rn
+
 ## SVE Floating Point Unary Operations - Unpredicated Group
 
 FRECPE          01100101 .. 001 110 001100 ..... .....          @rd_rn
diff --git a/target/arm/tcg/sve_helper.c b/target/arm/tcg/sve_helper.c
index f47e719fbe..6512df54e6 100644
--- a/target/arm/tcg/sve_helper.c
+++ b/target/arm/tcg/sve_helper.c
@@ -4361,19 +4361,20 @@ uint32_t HELPER(sve_whilecg)(void *vd, uint32_t count, uint32_t pred_desc)
  * The recursion is bounded to depth 7 (128 fp16 elements), so there's
  * little to gain with a more complex non-recursive form.
  */
-#define DO_REDUCE(NAME, TYPE, H, FUNC, IDENT)                         \
-static TYPE NAME##_reduce(TYPE *data, float_status *status, uintptr_t n) \
+#define DO_REDUCE(NAME, SUF, TYPE, H, FUNC, IDENT)                      \
+static TYPE FUNC##_reduce(TYPE *data, float_status *status, uintptr_t n) \
 {                                                                     \
     if (n == 1) {                                                     \
         return *data;                                                 \
     } else {                                                          \
         uintptr_t half = n / 2;                                       \
-        TYPE lo = NAME##_reduce(data, status, half);                  \
-        TYPE hi = NAME##_reduce(data + half, status, half);           \
+        TYPE lo = FUNC##_reduce(data, status, half);                  \
+        TYPE hi = FUNC##_reduce(data + half, status, half);           \
         return FUNC(lo, hi, status);                                  \
     }                                                                 \
 }                                                                     \
-uint64_t HELPER(NAME)(void *vn, void *vg, float_status *s, uint32_t desc) \
+uint64_t helper_sve_##NAME##v_##SUF(void *vn, void *vg,               \
+                                    float_status *s, uint32_t desc)   \
 {                                                                     \
     uintptr_t i, oprsz = simd_oprsz(desc), maxsz = simd_data(desc);   \
     TYPE data[sizeof(ARMVectorReg) / sizeof(TYPE)];                   \
@@ -4388,39 +4389,54 @@ uint64_t HELPER(NAME)(void *vn, void *vg, float_status *s, uint32_t desc) \
     for (; i < maxsz; i += sizeof(TYPE)) {                            \
         *(TYPE *)((void *)data + i) = IDENT;                          \
     }                                                                 \
-    return NAME##_reduce(data, s, maxsz / sizeof(TYPE));              \
+    return FUNC##_reduce(data, s, maxsz / sizeof(TYPE));              \
+}                                                                     \
+void helper_sve2p1_##NAME##qv_##SUF(void *vd, void *vn, void *vg,     \
+                                    float_status *status, uint32_t desc) \
+{                                                                     \
+    unsigned oprsz = simd_oprsz(desc), segments = oprsz / 16;         \
+    for (unsigned e = 0; e < 16; e += sizeof(TYPE)) {                 \
+        TYPE data[ARM_MAX_VQ];                                        \
+        for (unsigned s = 0; s < segments; s++) {                     \
+            uint16_t pg = *(uint16_t *)(vg + H1_2(s * 2));            \
+            TYPE nn = *(TYPE *)(vn + H(s * 16 + H(e)));               \
+            data[s] = (pg >> e) & 1 ? nn : IDENT;                     \
+        }                                                             \
+        *(TYPE *)(vd + H(e)) = FUNC##_reduce(data, status, segments); \
+    }                                                                 \
+    clear_tail(vd, 16, simd_maxsz(desc));                             \
 }
 
-DO_REDUCE(sve_faddv_h, float16, H1_2, float16_add, float16_zero)
-DO_REDUCE(sve_faddv_s, float32, H1_4, float32_add, float32_zero)
-DO_REDUCE(sve_faddv_d, float64, H1_8, float64_add, float64_zero)
+DO_REDUCE(fadd,h, float16, H1_2, float16_add, float16_zero)
+DO_REDUCE(fadd,s, float32, H1_4, float32_add, float32_zero)
+DO_REDUCE(fadd,d, float64, H1_8, float64_add, float64_zero)
 
 /* Identity is floatN_default_nan, without the function call.  */
-DO_REDUCE(sve_fminnmv_h, float16, H1_2, float16_minnum, 0x7E00)
-DO_REDUCE(sve_fminnmv_s, float32, H1_4, float32_minnum, 0x7FC00000)
-DO_REDUCE(sve_fminnmv_d, float64, H1_8, float64_minnum, 0x7FF8000000000000ULL)
+DO_REDUCE(fminnm,h, float16, H1_2, float16_minnum, 0x7E00)
+DO_REDUCE(fminnm,s, float32, H1_4, float32_minnum, 0x7FC00000)
+DO_REDUCE(fminnm,d, float64, H1_8, float64_minnum, 0x7FF8000000000000ULL)
 
-DO_REDUCE(sve_fmaxnmv_h, float16, H1_2, float16_maxnum, 0x7E00)
-DO_REDUCE(sve_fmaxnmv_s, float32, H1_4, float32_maxnum, 0x7FC00000)
-DO_REDUCE(sve_fmaxnmv_d, float64, H1_8, float64_maxnum, 0x7FF8000000000000ULL)
+DO_REDUCE(fmaxnm,h, float16, H1_2, float16_maxnum, 0x7E00)
+DO_REDUCE(fmaxnm,s, float32, H1_4, float32_maxnum, 0x7FC00000)
+DO_REDUCE(fmaxnm,d, float64, H1_8, float64_maxnum, 0x7FF8000000000000ULL)
 
-DO_REDUCE(sve_fminv_h, float16, H1_2, float16_min, float16_infinity)
-DO_REDUCE(sve_fminv_s, float32, H1_4, float32_min, float32_infinity)
-DO_REDUCE(sve_fminv_d, float64, H1_8, float64_min, float64_infinity)
+DO_REDUCE(fmin,h, float16, H1_2, float16_min, float16_infinity)
+DO_REDUCE(fmin,s, float32, H1_4, float32_min, float32_infinity)
+DO_REDUCE(fmin,d, float64, H1_8, float64_min, float64_infinity)
 
-DO_REDUCE(sve_fmaxv_h, float16, H1_2, float16_max, float16_chs(float16_infinity))
-DO_REDUCE(sve_fmaxv_s, float32, H1_4, float32_max, float32_chs(float32_infinity))
-DO_REDUCE(sve_fmaxv_d, float64, H1_8, float64_max, float64_chs(float64_infinity))
+DO_REDUCE(fmax,h, float16, H1_2, float16_max, float16_chs(float16_infinity))
+DO_REDUCE(fmax,s, float32, H1_4, float32_max, float32_chs(float32_infinity))
+DO_REDUCE(fmax,d, float64, H1_8, float64_max, float64_chs(float64_infinity))
 
-DO_REDUCE(sve_ah_fminv_h, float16, H1_2, helper_vfp_ah_minh, float16_infinity)
-DO_REDUCE(sve_ah_fminv_s, float32, H1_4, helper_vfp_ah_mins, float32_infinity)
-DO_REDUCE(sve_ah_fminv_d, float64, H1_8, helper_vfp_ah_mind, float64_infinity)
+DO_REDUCE(ah_fmin,h, float16, H1_2, helper_vfp_ah_minh, float16_infinity)
+DO_REDUCE(ah_fmin,s, float32, H1_4, helper_vfp_ah_mins, float32_infinity)
+DO_REDUCE(ah_fmin,d, float64, H1_8, helper_vfp_ah_mind, float64_infinity)
 
-DO_REDUCE(sve_ah_fmaxv_h, float16, H1_2, helper_vfp_ah_maxh,
+DO_REDUCE(ah_fmax,h, float16, H1_2, helper_vfp_ah_maxh,
           float16_chs(float16_infinity))
-DO_REDUCE(sve_ah_fmaxv_s, float32, H1_4, helper_vfp_ah_maxs,
+DO_REDUCE(ah_fmax,s, float32, H1_4, helper_vfp_ah_maxs,
           float32_chs(float32_infinity))
-DO_REDUCE(sve_ah_fmaxv_d, float64, H1_8, helper_vfp_ah_maxd,
+DO_REDUCE(ah_fmax,d, float64, H1_8, helper_vfp_ah_maxd,
           float64_chs(float64_infinity))
 
 #undef DO_REDUCE
diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
index 2114b2ecca..05c0fc948a 100644
--- a/target/arm/tcg/translate-sve.c
+++ b/target/arm/tcg/translate-sve.c
@@ -3743,6 +3743,54 @@ DO_VPZ_AH(FMAXV, fmaxv)
 
 #undef DO_VPZ
 
+static gen_helper_gvec_3_ptr * const faddqv_fns[4] = {
+    NULL,                       gen_helper_sve2p1_faddqv_h,
+    gen_helper_sve2p1_faddqv_s, gen_helper_sve2p1_faddqv_d,
+};
+TRANS_FEAT(FADDQV, aa64_sme2p1_or_sve2p1, gen_gvec_fpst_arg_zpz,
+           faddqv_fns[a->esz], a, 0,
+           a->esz == MO_16 ? FPST_A64_F16 : FPST_A64)
+
+static gen_helper_gvec_3_ptr * const fmaxnmqv_fns[4] = {
+    NULL,                         gen_helper_sve2p1_fmaxnmqv_h,
+    gen_helper_sve2p1_fmaxnmqv_s, gen_helper_sve2p1_fmaxnmqv_d,
+};
+TRANS_FEAT(FMAXNMQV, aa64_sme2p1_or_sve2p1, gen_gvec_fpst_arg_zpz,
+           fmaxnmqv_fns[a->esz], a, 0,
+           a->esz == MO_16 ? FPST_A64_F16 : FPST_A64)
+
+static gen_helper_gvec_3_ptr * const fminnmqv_fns[4] = {
+    NULL,                         gen_helper_sve2p1_fminnmqv_h,
+    gen_helper_sve2p1_fminnmqv_s, gen_helper_sve2p1_fminnmqv_d,
+};
+TRANS_FEAT(FMINNMQV, aa64_sme2p1_or_sve2p1, gen_gvec_fpst_arg_zpz,
+           fminnmqv_fns[a->esz], a, 0,
+           a->esz == MO_16 ? FPST_A64_F16 : FPST_A64)
+
+static gen_helper_gvec_3_ptr * const fmaxqv_fns[4] = {
+    NULL,                       gen_helper_sve2p1_fmaxqv_h,
+    gen_helper_sve2p1_fmaxqv_s, gen_helper_sve2p1_fmaxqv_d,
+};
+static gen_helper_gvec_3_ptr * const fmaxqv_ah_fns[4] = {
+    NULL,                          gen_helper_sve2p1_ah_fmaxqv_h,
+    gen_helper_sve2p1_ah_fmaxqv_s, gen_helper_sve2p1_ah_fmaxqv_d,
+};
+TRANS_FEAT(FMAXQV, aa64_sme2p1_or_sve2p1, gen_gvec_fpst_arg_zpz,
+           (s->fpcr_ah ? fmaxqv_fns : fmaxqv_ah_fns)[a->esz], a, 0,
+           a->esz == MO_16 ? FPST_A64_F16 : FPST_A64)
+
+static gen_helper_gvec_3_ptr * const fminqv_fns[4] = {
+    NULL,                       gen_helper_sve2p1_fminqv_h,
+    gen_helper_sve2p1_fminqv_s, gen_helper_sve2p1_fminqv_d,
+};
+static gen_helper_gvec_3_ptr * const fminqv_ah_fns[4] = {
+    NULL,                          gen_helper_sve2p1_ah_fminqv_h,
+    gen_helper_sve2p1_ah_fminqv_s, gen_helper_sve2p1_ah_fminqv_d,
+};
+TRANS_FEAT(FMINQV, aa64_sme2p1_or_sve2p1, gen_gvec_fpst_arg_zpz,
+           (s->fpcr_ah ? fminqv_fns : fminqv_ah_fns)[a->esz], a, 0,
+           a->esz == MO_16 ? FPST_A64_F16 : FPST_A64)
+
 /*
  *** SVE Floating Point Unary Operations - Unpredicated Group
  */

From 4fddbdf934937d0043d0601262809df14bd14abb Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:20:49 -0600
Subject: [PATCH 2033/2760] target/arm: Implement BFMLSLB{L, T} for SME2/SVE2p1

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-87-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/sve.decode      |  6 ++++++
 target/arm/tcg/translate-sve.c | 30 ++++++++++++++++++++++++++++++
 2 files changed, 36 insertions(+)

diff --git a/target/arm/tcg/sve.decode b/target/arm/tcg/sve.decode
index 10cac2de22..0df3312739 100644
--- a/target/arm/tcg/sve.decode
+++ b/target/arm/tcg/sve.decode
@@ -1727,18 +1727,24 @@ FMLSLT_zzzw     01100100 10 1 ..... 10 1 00 1 ..... .....  @rda_rn_rm_ex esz=2
 
 BFMLALB_zzzw    01100100 11 1 ..... 10 0 00 0 ..... .....  @rda_rn_rm_ex esz=2
 BFMLALT_zzzw    01100100 11 1 ..... 10 0 00 1 ..... .....  @rda_rn_rm_ex esz=2
+BFMLSLB_zzzw    01100100 11 1 ..... 10 1 00 0 ..... .....  @rda_rn_rm_ex esz=2
+BFMLSLT_zzzw    01100100 11 1 ..... 10 1 00 1 ..... .....  @rda_rn_rm_ex esz=2
 
 ### SVE2 floating-point dot-product
 FDOT_zzzz       01100100 00 1 ..... 10 0 00 0 ..... .....  @rda_rn_rm_ex esz=2
 BFDOT_zzzz      01100100 01 1 ..... 10 0 00 0 ..... .....  @rda_rn_rm_ex esz=2
 
 ### SVE2 floating-point multiply-add long (indexed)
+
 FMLALB_zzxw     01100100 10 1 ..... 0100.0 ..... .....     @rrxr_3a esz=2
 FMLALT_zzxw     01100100 10 1 ..... 0100.1 ..... .....     @rrxr_3a esz=2
 FMLSLB_zzxw     01100100 10 1 ..... 0110.0 ..... .....     @rrxr_3a esz=2
 FMLSLT_zzxw     01100100 10 1 ..... 0110.1 ..... .....     @rrxr_3a esz=2
+
 BFMLALB_zzxw    01100100 11 1 ..... 0100.0 ..... .....     @rrxr_3a esz=2
 BFMLALT_zzxw    01100100 11 1 ..... 0100.1 ..... .....     @rrxr_3a esz=2
+BFMLSLB_zzxw    01100100 11 1 ..... 0110.0 ..... .....     @rrxr_3a esz=2
+BFMLSLT_zzxw    01100100 11 1 ..... 0110.1 ..... .....     @rrxr_3a esz=2
 
 ### SVE2 floating-point dot-product (indexed)
 
diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
index 05c0fc948a..079d310960 100644
--- a/target/arm/tcg/translate-sve.c
+++ b/target/arm/tcg/translate-sve.c
@@ -7421,6 +7421,36 @@ static bool do_BFMLAL_zzxw(DisasContext *s, arg_rrxr_esz *a, bool sel)
 TRANS_FEAT(BFMLALB_zzxw, aa64_sve_bf16, do_BFMLAL_zzxw, a, false)
 TRANS_FEAT(BFMLALT_zzxw, aa64_sve_bf16, do_BFMLAL_zzxw, a, true)
 
+static bool do_BFMLSL_zzzw(DisasContext *s, arg_rrrr_esz *a, bool sel)
+{
+    if (s->fpcr_ah) {
+        return gen_gvec_fpst_zzzz(s, gen_helper_gvec_ah_bfmlsl,
+                                  a->rd, a->rn, a->rm, a->ra, sel, FPST_AH);
+    } else {
+        return gen_gvec_fpst_zzzz(s, gen_helper_gvec_bfmlsl,
+                                  a->rd, a->rn, a->rm, a->ra, sel, FPST_A64);
+    }
+}
+
+TRANS_FEAT(BFMLSLB_zzzw, aa64_sme2_or_sve2p1, do_BFMLSL_zzzw, a, false)
+TRANS_FEAT(BFMLSLT_zzzw, aa64_sme2_or_sve2p1, do_BFMLSL_zzzw, a, true)
+
+static bool do_BFMLSL_zzxw(DisasContext *s, arg_rrxr_esz *a, bool sel)
+{
+    if (s->fpcr_ah) {
+        return gen_gvec_fpst_zzzz(s, gen_helper_gvec_ah_bfmlsl_idx,
+                                  a->rd, a->rn, a->rm, a->ra,
+                                  (a->index << 1) | sel, FPST_AH);
+    } else {
+        return gen_gvec_fpst_zzzz(s, gen_helper_gvec_bfmlsl_idx,
+                                  a->rd, a->rn, a->rm, a->ra,
+                                  (a->index << 1) | sel, FPST_A64);
+    }
+}
+
+TRANS_FEAT(BFMLSLB_zzxw, aa64_sme2_or_sve2p1, do_BFMLSL_zzxw, a, false)
+TRANS_FEAT(BFMLSLT_zzxw, aa64_sme2_or_sve2p1, do_BFMLSL_zzxw, a, true)
+
 static bool trans_PSEL(DisasContext *s, arg_psel *a)
 {
     int vl = vec_full_reg_size(s);

From 47810f99e846501c817fb77ebd03b6914342f7e5 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:20:50 -0600
Subject: [PATCH 2034/2760] target/arm: Implement CNTP (predicate as counter)
 for SME2/SVE2p1

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-88-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/helper-sve.h    |  1 +
 target/arm/tcg/sve.decode      |  3 ++-
 target/arm/tcg/sve_helper.c    | 21 +++++++++++++++++++++
 target/arm/tcg/translate-sve.c | 30 ++++++++++++++++++++++++++++++
 4 files changed, 54 insertions(+), 1 deletion(-)

diff --git a/target/arm/tcg/helper-sve.h b/target/arm/tcg/helper-sve.h
index 906da384dc..733828a880 100644
--- a/target/arm/tcg/helper-sve.h
+++ b/target/arm/tcg/helper-sve.h
@@ -937,6 +937,7 @@ DEF_HELPER_FLAGS_4(sve_brkn, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(sve_brkns, TCG_CALL_NO_RWG, i32, ptr, ptr, ptr, i32)
 
 DEF_HELPER_FLAGS_3(sve_cntp, TCG_CALL_NO_RWG, i64, ptr, ptr, i32)
+DEF_HELPER_FLAGS_2(sve2p1_cntp_c, TCG_CALL_NO_RWG_SE, i64, i32, i32)
 
 DEF_HELPER_FLAGS_3(sve_whilel, TCG_CALL_NO_RWG, i32, ptr, i32, i32)
 DEF_HELPER_FLAGS_3(sve_whileg, TCG_CALL_NO_RWG, i32, ptr, i32, i32)
diff --git a/target/arm/tcg/sve.decode b/target/arm/tcg/sve.decode
index 0df3312739..db16849731 100644
--- a/target/arm/tcg/sve.decode
+++ b/target/arm/tcg/sve.decode
@@ -784,7 +784,8 @@ BRKN            00100101 0. 01100001 .... 0 .... 0 ....         @pd_pg_pn_s
 ### SVE Predicate Count Group
 
 # SVE predicate count
-CNTP            00100101 .. 100 000 10 .... 0 .... .....        @rd_pg4_pn
+CNTP            00100101 ..    100 000 10 ....     0 .... ..... @rd_pg4_pn
+CNTP_c          00100101 esz:2 100 000 10 000 vl:1 1 rn:4 rd:5
 
 # SVE inc/dec register by predicate count
 INCDECP_r       00100101 .. 10110 d:1 10001 00 .... .....     @incdec_pred u=1
diff --git a/target/arm/tcg/sve_helper.c b/target/arm/tcg/sve_helper.c
index 6512df54e6..def841fd52 100644
--- a/target/arm/tcg/sve_helper.c
+++ b/target/arm/tcg/sve_helper.c
@@ -4178,6 +4178,27 @@ uint64_t HELPER(sve_cntp)(void *vn, void *vg, uint32_t pred_desc)
     return sum;
 }
 
+uint64_t HELPER(sve2p1_cntp_c)(uint32_t png, uint32_t desc)
+{
+    int pl = FIELD_EX32(desc, PREDDESC, OPRSZ);
+    int vl = pl * 8;
+    unsigned v_esz = FIELD_EX32(desc, PREDDESC, ESZ);
+    int lg2_width = FIELD_EX32(desc, PREDDESC, DATA) + 1;
+    DecodeCounter p = decode_counter(png, vl, v_esz);
+    unsigned maxelem = (vl << lg2_width) >> v_esz;
+    unsigned count = p.count;
+
+    if (p.invert) {
+        if (count >= maxelem) {
+            return 0;
+        }
+        count = maxelem - count;
+    } else {
+        count = MIN(count, maxelem);
+    }
+    return count >> p.lg2_stride;
+}
+
 /* C.f. Arm pseudocode EncodePredCount */
 static uint64_t encode_pred_count(uint32_t elements, uint32_t count,
                                   uint32_t esz, bool invert)
diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
index 079d310960..53db8851bf 100644
--- a/target/arm/tcg/translate-sve.c
+++ b/target/arm/tcg/translate-sve.c
@@ -3052,6 +3052,36 @@ static bool trans_CNTP(DisasContext *s, arg_CNTP *a)
     return true;
 }
 
+static bool trans_CNTP_c(DisasContext *s, arg_CNTP_c *a)
+{
+    TCGv_i32 t_png;
+    uint32_t desc = 0;
+
+    if (dc_isar_feature(aa64_sve2p1, s)) {
+        if (!sve_access_check(s)) {
+            return true;
+        }
+    } else if (dc_isar_feature(aa64_sme2, s)) {
+        if (!sme_sm_enabled_check(s)) {
+            return true;
+        }
+    } else {
+        return false;
+    }
+
+    t_png = tcg_temp_new_i32();
+    tcg_gen_ld16u_i32(t_png, tcg_env,
+                      pred_full_reg_offset(s, a->rn) ^
+                      (HOST_BIG_ENDIAN ? 6 : 0));
+
+    desc = FIELD_DP32(desc, PREDDESC, OPRSZ, pred_full_reg_size(s));
+    desc = FIELD_DP32(desc, PREDDESC, ESZ, a->esz);
+    desc = FIELD_DP32(desc, PREDDESC, DATA, a->vl);
+
+    gen_helper_sve2p1_cntp_c(cpu_reg(s, a->rd), t_png, tcg_constant_i32(desc));
+    return true;
+}
+
 static bool trans_INCDECP_r(DisasContext *s, arg_incdec_pred *a)
 {
     if (!dc_isar_feature(aa64_sve, s)) {

From a4a49a31f499adb8ba2fca6b048d4f51f41e178a Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:20:51 -0600
Subject: [PATCH 2035/2760] target/arm: Implement DUPQ for SME2p1/SVE2p1

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-89-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/sve.decode      |  6 ++++++
 target/arm/tcg/translate-sve.c | 21 +++++++++++++++++++++
 2 files changed, 27 insertions(+)

diff --git a/target/arm/tcg/sve.decode b/target/arm/tcg/sve.decode
index db16849731..2650e00f80 100644
--- a/target/arm/tcg/sve.decode
+++ b/target/arm/tcg/sve.decode
@@ -577,6 +577,12 @@ DUP_s           00000101 .. 1 00000 001110 ..... .....          @rd_rn
 DUP_x           00000101 .. 1 ..... 001000 rn:5 rd:5 \
                 &rri imm=%imm7_22_16
 
+# SVE Permute Vector - one source quadwords
+DUPQ            00000101 001 imm:4    1 001001 rn:5 rd:5        &rri_esz esz=0
+DUPQ            00000101 001 imm:3   10 001001 rn:5 rd:5        &rri_esz esz=1
+DUPQ            00000101 001 imm:2  100 001001 rn:5 rd:5        &rri_esz esz=2
+DUPQ            00000101 001 imm:1 1000 001001 rn:5 rd:5        &rri_esz esz=3
+
 # SVE insert SIMD&FP scalar register
 INSR_f          00000101 .. 1 10100 001110 ..... .....          @rdn_rm
 
diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
index 53db8851bf..e33b2eb2a4 100644
--- a/target/arm/tcg/translate-sve.c
+++ b/target/arm/tcg/translate-sve.c
@@ -2249,6 +2249,27 @@ static bool trans_DUP_x(DisasContext *s, arg_DUP_x *a)
     return true;
 }
 
+static bool trans_DUPQ(DisasContext *s, arg_DUPQ *a)
+{
+    unsigned vl, dofs, nofs;
+
+    if (!dc_isar_feature(aa64_sme2p1_or_sve2p1, s)) {
+        return false;
+    }
+    if (!sve_access_check(s)) {
+        return true;
+    }
+
+    vl = vec_full_reg_size(s);
+    dofs = vec_full_reg_offset(s, a->rd);
+    nofs = vec_reg_offset(s, a->rn, a->imm, a->esz);
+
+    for (unsigned i = 0; i < vl; i += 16) {
+        tcg_gen_gvec_dup_mem(a->esz, dofs + i, nofs + i, 16, 16);
+    }
+    return true;
+}
+
 static void do_insr_i64(DisasContext *s, arg_rrr_esz *a, TCGv_i64 val)
 {
     typedef void gen_insr(TCGv_ptr, TCGv_ptr, TCGv_i64, TCGv_i32);

From 3b5257c8602b3002540c4dbdd3929251bd3acc85 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:20:52 -0600
Subject: [PATCH 2036/2760] target/arm: Implement EXTQ for SME2p1/SVE2p1

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-90-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/sve.decode      |  2 ++
 target/arm/tcg/translate-sve.c | 49 ++++++++++++++++++++++++++++++++++
 2 files changed, 51 insertions(+)

diff --git a/target/arm/tcg/sve.decode b/target/arm/tcg/sve.decode
index 2650e00f80..af4fb966bf 100644
--- a/target/arm/tcg/sve.decode
+++ b/target/arm/tcg/sve.decode
@@ -583,6 +583,8 @@ DUPQ            00000101 001 imm:3   10 001001 rn:5 rd:5        &rri_esz esz=1
 DUPQ            00000101 001 imm:2  100 001001 rn:5 rd:5        &rri_esz esz=2
 DUPQ            00000101 001 imm:1 1000 001001 rn:5 rd:5        &rri_esz esz=3
 
+EXTQ            00000101 0110 imm:4 001001 rn:5 rd:5            &rri
+
 # SVE insert SIMD&FP scalar register
 INSR_f          00000101 .. 1 10100 001110 ..... .....          @rdn_rm
 
diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
index e33b2eb2a4..a918da31fe 100644
--- a/target/arm/tcg/translate-sve.c
+++ b/target/arm/tcg/translate-sve.c
@@ -2202,6 +2202,55 @@ static bool do_EXT(DisasContext *s, int rd, int rn, int rm, int imm)
 TRANS_FEAT(EXT, aa64_sve, do_EXT, a->rd, a->rn, a->rm, a->imm)
 TRANS_FEAT(EXT_sve2, aa64_sve2, do_EXT, a->rd, a->rn, (a->rn + 1) % 32, a->imm)
 
+static bool trans_EXTQ(DisasContext *s, arg_EXTQ *a)
+{
+    unsigned vl, dofs, sofs0, sofs1, sofs2, imm;
+
+    if (!dc_isar_feature(aa64_sme2p1_or_sve2p1, s)) {
+        return false;
+    }
+    if (!sve_access_check(s)) {
+        return true;
+    }
+
+    imm = a->imm;
+    if (imm == 0) {
+        /* So far we never optimize Zdn with MOVPRFX, so zd = zn is a nop. */
+        return true;
+    }
+
+    vl = vec_full_reg_size(s);
+    dofs = vec_full_reg_offset(s, a->rd);
+    sofs2 = vec_full_reg_offset(s, a->rn);
+
+    if (imm & 8) {
+        sofs0 = dofs + 8;
+        sofs1 = sofs2;
+        sofs2 += 8;
+    } else {
+        sofs0 = dofs;
+        sofs1 = dofs + 8;
+    }
+    imm = (imm & 7) << 3;
+
+    for (unsigned i = 0; i < vl; i += 16) {
+        TCGv_i64 s0 = tcg_temp_new_i64();
+        TCGv_i64 s1 = tcg_temp_new_i64();
+        TCGv_i64 s2 = tcg_temp_new_i64();
+
+        tcg_gen_ld_i64(s0, tcg_env, sofs0 + i);
+        tcg_gen_ld_i64(s1, tcg_env, sofs1 + i);
+        tcg_gen_ld_i64(s2, tcg_env, sofs2 + i);
+
+        tcg_gen_extract2_i64(s0, s0, s1, imm);
+        tcg_gen_extract2_i64(s1, s1, s2, imm);
+
+        tcg_gen_st_i64(s0, tcg_env, dofs + i);
+        tcg_gen_st_i64(s1, tcg_env, dofs + i + 8);
+    }
+    return true;
+}
+
 /*
  *** SVE Permute - Unpredicated Group
  */

From e421e4e9727c2b835a09b9d43777f3a56b252899 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:20:53 -0600
Subject: [PATCH 2037/2760] target/arm: Implement PMOV for SME2p1/SVE2p1

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-91-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/helper-sve.h    |  8 +++
 target/arm/tcg/sve.decode      | 17 ++++++
 target/arm/tcg/sve_helper.c    | 50 +++++++++++++++++
 target/arm/tcg/translate-sve.c | 98 ++++++++++++++++++++++++++++++++++
 target/arm/tcg/vec_internal.h  | 34 ++++++++++++
 5 files changed, 207 insertions(+)

diff --git a/target/arm/tcg/helper-sve.h b/target/arm/tcg/helper-sve.h
index 733828a880..04b9545c11 100644
--- a/target/arm/tcg/helper-sve.h
+++ b/target/arm/tcg/helper-sve.h
@@ -3020,3 +3020,11 @@ DEF_HELPER_FLAGS_4(sve2p1_andqv_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(sve2p1_andqv_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(sve2p1_andqv_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(sve2p1_andqv_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_3(pmov_pv_h, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(pmov_pv_s, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(pmov_pv_d, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_3(pmov_vp_h, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(pmov_vp_s, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(pmov_vp_d, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
diff --git a/target/arm/tcg/sve.decode b/target/arm/tcg/sve.decode
index af4fb966bf..3271c9cf78 100644
--- a/target/arm/tcg/sve.decode
+++ b/target/arm/tcg/sve.decode
@@ -30,6 +30,7 @@
 %size_23        23:2
 %dtype_23_13    23:2 13:2
 %index3_22_19   22:1 19:2
+%index3_22_17   22:1 17:2
 %index3_19_11   19:2 11:1
 %index2_20_11   20:1 11:1
 
@@ -594,6 +595,22 @@ INSR_r          00000101 .. 1 00100 001110 ..... .....          @rdn_rm
 # SVE reverse vector elements
 REV_v           00000101 .. 1 11000 001110 ..... .....          @rd_rn
 
+# SVE move predicate to/from vector
+
+PMOV_pv         00000101 00 101 01 0001110 rn:5 0 rd:4          \
+                &rri_esz esz=0 imm=0
+PMOV_pv         00000101 00 101 1 imm:1 0001110 rn:5 0 rd:4     &rri_esz esz=1
+PMOV_pv         00000101 01 101 imm:2 0001110 rn:5 0 rd:4       &rri_esz esz=2
+PMOV_pv         00000101 1. 101 .. 0001110 rn:5 0 rd:4          \
+                &rri_esz esz=3 imm=%index3_22_17
+
+PMOV_vp         00000101 00 101 01 1001110 0 rn:4 rd:5          \
+                &rri_esz esz=0 imm=0
+PMOV_vp         00000101 00 101 1 imm:1 1001110 0 rn:4 rd:5     &rri_esz esz=1
+PMOV_vp         00000101 01 101 imm:2 1001110 0 rn:4 rd:5       &rri_esz esz=2
+PMOV_vp         00000101 1. 101 .. 1001110 0 rn:4 rd:5          \
+                &rri_esz esz=3 imm=%index3_22_17
+
 # SVE vector table lookup
 TBL             00000101 .. 1 ..... 001100 ..... .....          @rd_rn_rm
 
diff --git a/target/arm/tcg/sve_helper.c b/target/arm/tcg/sve_helper.c
index def841fd52..a9dc3c44b2 100644
--- a/target/arm/tcg/sve_helper.c
+++ b/target/arm/tcg/sve_helper.c
@@ -3035,6 +3035,56 @@ void HELPER(sve_rev_d)(void *vd, void *vn, uint32_t desc)
     }
 }
 
+/*
+ * TODO: This could use half_shuffle64 and similar bit tricks to
+ * expand blocks of bits at once.
+ */
+#define DO_PMOV_PV(NAME, ESIZE)                                 \
+void HELPER(NAME)(void *vd, void *vs, uint32_t desc)            \
+{                                                               \
+    unsigned vl = simd_oprsz(desc);                             \
+    unsigned idx = simd_data(desc);                             \
+    unsigned elements = vl / ESIZE;                             \
+    ARMPredicateReg *d = vd;                                    \
+    ARMVectorReg *s = vs;                                       \
+    memset(d, 0, sizeof(*d));                                   \
+    for (unsigned e = 0; e < elements; ++e) {                   \
+        depositn(d->p, e * ESIZE, 1, extractn(s->d, elements * idx + e, 1)); \
+    }                                                           \
+}
+
+DO_PMOV_PV(pmov_pv_h, 2)
+DO_PMOV_PV(pmov_pv_s, 4)
+DO_PMOV_PV(pmov_pv_d, 8)
+
+#undef DO_PMOV_PV
+
+/*
+ * TODO: This could use half_unshuffle64 and similar bit tricks to
+ * compress blocks of bits at once.
+ */
+#define DO_PMOV_VP(NAME, ESIZE)                                 \
+void HELPER(NAME)(void *vd, void *vs, uint32_t desc)            \
+{                                                               \
+    unsigned vl = simd_oprsz(desc);                             \
+    unsigned idx = simd_data(desc);                             \
+    unsigned elements = vl / ESIZE;                             \
+    ARMVectorReg *d = vd;                                       \
+    ARMPredicateReg *s = vs;                                    \
+    if (idx == 0) {                                             \
+        memset(d, 0, vl);                                       \
+    }                                                           \
+    for (unsigned e = 0; e < elements; ++e) {                   \
+        depositn(d->d, elements * idx + e, 1, extractn(s->p, e * ESIZE, 1)); \
+    }                                                           \
+}
+
+DO_PMOV_VP(pmov_vp_h, 2)
+DO_PMOV_VP(pmov_vp_s, 4)
+DO_PMOV_VP(pmov_vp_d, 8)
+
+#undef DO_PMOV_VP
+
 typedef void tb_impl_fn(void *, void *, void *, void *, uintptr_t, bool);
 
 static inline void do_tbl1(void *vd, void *vn, void *vm, uint32_t desc,
diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
index a918da31fe..01c4eaa585 100644
--- a/target/arm/tcg/translate-sve.c
+++ b/target/arm/tcg/translate-sve.c
@@ -2386,6 +2386,104 @@ static gen_helper_gvec_3 * const tbx_fns[4] = {
 };
 TRANS_FEAT(TBX, aa64_sve2, gen_gvec_ool_arg_zzz, tbx_fns[a->esz], a, 0)
 
+static bool trans_PMOV_pv(DisasContext *s, arg_PMOV_pv *a)
+{
+    static gen_helper_gvec_2 * const fns[4] = {
+        NULL,                 gen_helper_pmov_pv_h,
+        gen_helper_pmov_pv_s, gen_helper_pmov_pv_d
+    };
+    unsigned vl, pl, vofs, pofs;
+    TCGv_i64 tmp;
+
+    if (!dc_isar_feature(aa64_sme2p1_or_sve2p1, s)) {
+        return false;
+    }
+    if (!sve_access_check(s)) {
+        return true;
+    }
+
+    vl = vec_full_reg_size(s);
+    if (a->esz != MO_8) {
+        tcg_gen_gvec_2_ool(pred_full_reg_offset(s, a->rd),
+                           vec_full_reg_offset(s, a->rn),
+                           vl, vl, a->imm, fns[a->esz]);
+        return true;
+    }
+
+    /*
+     * Copy the low PL bytes from vector Zn, zero-extending to a
+     * multiple of 8 bytes, so that Pd is properly cleared.
+     */
+
+    pl = vl / 8;
+    pofs = pred_full_reg_offset(s, a->rd);
+    vofs = vec_full_reg_offset(s, a->rn);
+
+    QEMU_BUILD_BUG_ON(sizeof(ARMPredicateReg) != 32);
+    for (unsigned i = 32; i >= 8; i >>= 1) {
+        if (pl & i) {
+            tcg_gen_gvec_mov(MO_64, pofs, vofs, i, i);
+            pofs += i;
+            vofs += i;
+        }
+    }
+    switch (pl & 7) {
+    case 0:
+        return true;
+    case 2:
+        tmp = tcg_temp_new_i64();
+        tcg_gen_ld16u_i64(tmp, tcg_env, vofs + (HOST_BIG_ENDIAN ? 6 : 0));
+        break;
+    case 4:
+        tmp = tcg_temp_new_i64();
+        tcg_gen_ld32u_i64(tmp, tcg_env, vofs + (HOST_BIG_ENDIAN ? 4 : 0));
+        break;
+    case 6:
+        tmp = tcg_temp_new_i64();
+        tcg_gen_ld_i64(tmp, tcg_env, vofs);
+        tcg_gen_extract_i64(tmp, tmp, 0, 48);
+        break;
+    default:
+        g_assert_not_reached();
+    }
+    tcg_gen_st_i64(tmp, tcg_env, pofs);
+    return true;
+}
+
+static bool trans_PMOV_vp(DisasContext *s, arg_PMOV_pv *a)
+{
+    static gen_helper_gvec_2 * const fns[4] = {
+        NULL,                 gen_helper_pmov_vp_h,
+        gen_helper_pmov_vp_s, gen_helper_pmov_vp_d
+    };
+    unsigned vl;
+
+    if (!dc_isar_feature(aa64_sme2p1_or_sve2p1, s)) {
+        return false;
+    }
+    if (!sve_access_check(s)) {
+        return true;
+    }
+
+    vl = vec_full_reg_size(s);
+
+    if (a->esz == MO_8) {
+        /*
+         * The low PL bytes are copied from Pn to Zd unchanged.
+         * We know that the unused portion of Pn is zero, and
+         * that imm == 0, so the balance of Zd must be zeroed.
+         */
+        tcg_gen_gvec_mov(MO_64, vec_full_reg_offset(s, a->rd),
+                         pred_full_reg_offset(s, a->rn),
+                         size_for_gvec(vl / 8), vl);
+    } else {
+        tcg_gen_gvec_2_ool(vec_full_reg_offset(s, a->rd),
+                           pred_full_reg_offset(s, a->rn),
+                           vl, vl, a->imm, fns[a->esz]);
+    }
+    return true;
+}
+
 static bool trans_UNPK(DisasContext *s, arg_UNPK *a)
 {
     static gen_helper_gvec_2 * const fns[4][2] = {
diff --git a/target/arm/tcg/vec_internal.h b/target/arm/tcg/vec_internal.h
index 61c67bb35e..957bf6d9fc 100644
--- a/target/arm/tcg/vec_internal.h
+++ b/target/arm/tcg/vec_internal.h
@@ -411,4 +411,38 @@ decode_counter(unsigned png, unsigned vl, unsigned v_esz)
     return ret;
 }
 
+/* Extract @len bits from an array of uint64_t at offset @pos bits. */
+static inline uint64_t extractn(uint64_t *p, unsigned pos, unsigned len)
+{
+    uint64_t x;
+
+    p += pos / 64;
+    pos = pos % 64;
+
+    x = p[0];
+    if (pos + len > 64) {
+        x = (x >> pos) | (p[1] << (-pos & 63));
+        pos = 0;
+    }
+    return extract64(x, pos, len);
+}
+
+/* Deposit @len bits into an array of uint64_t at offset @pos bits. */
+static inline void depositn(uint64_t *p, unsigned pos,
+                            unsigned len, uint64_t val)
+{
+    p += pos / 64;
+    pos = pos % 64;
+
+    if (pos + len <= 64) {
+        p[0] = deposit64(p[0], pos, len, val);
+    } else {
+        unsigned len0 = 64 - pos;
+        unsigned len1 = len - len0;
+
+        p[0] = deposit64(p[0], pos, len0, val);
+        p[1] = deposit64(p[1], 0, len1, val >> len0);
+    }
+}
+
 #endif /* TARGET_ARM_VEC_INTERNAL_H */

From 945a379438736571d9bb6086f1e264452c5427f1 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:20:54 -0600
Subject: [PATCH 2038/2760] target/arm: Implement ZIPQ, UZPQ for SME2p1/SVE2p1

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-92-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/helper-sve.h    | 10 ++++++++++
 target/arm/tcg/sve.decode      |  6 ++++++
 target/arm/tcg/sve_helper.c    | 29 +++++++++++++++++++++++++++++
 target/arm/tcg/translate-sve.c | 19 ++++++++++++++++++-
 4 files changed, 63 insertions(+), 1 deletion(-)

diff --git a/target/arm/tcg/helper-sve.h b/target/arm/tcg/helper-sve.h
index 04b9545c11..0f510ea610 100644
--- a/target/arm/tcg/helper-sve.h
+++ b/target/arm/tcg/helper-sve.h
@@ -701,12 +701,22 @@ DEF_HELPER_FLAGS_4(sve_zip_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(sve_zip_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(sve2_zip_q, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 
+DEF_HELPER_FLAGS_4(sve2p1_zipq_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sve2p1_zipq_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sve2p1_zipq_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sve2p1_zipq_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
 DEF_HELPER_FLAGS_4(sve_uzp_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(sve_uzp_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(sve_uzp_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(sve_uzp_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(sve2_uzp_q, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 
+DEF_HELPER_FLAGS_4(sve2p1_uzpq_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sve2p1_uzpq_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sve2p1_uzpq_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sve2p1_uzpq_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
 DEF_HELPER_FLAGS_4(sve_trn_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(sve_trn_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(sve_trn_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
diff --git a/target/arm/tcg/sve.decode b/target/arm/tcg/sve.decode
index 3271c9cf78..e98275eec1 100644
--- a/target/arm/tcg/sve.decode
+++ b/target/arm/tcg/sve.decode
@@ -657,6 +657,12 @@ UZP2_q          00000101 10 1 ..... 000 011 ..... .....         @rd_rn_rm_e0
 TRN1_q          00000101 10 1 ..... 000 110 ..... .....         @rd_rn_rm_e0
 TRN2_q          00000101 10 1 ..... 000 111 ..... .....         @rd_rn_rm_e0
 
+# SVE2.1 permute vector elements (quadwords)
+ZIPQ1           01000100 .. 0 ..... 111 000 ..... .....         @rd_rn_rm
+ZIPQ2           01000100 .. 0 ..... 111 001 ..... .....         @rd_rn_rm
+UZPQ1           01000100 .. 0 ..... 111 010 ..... .....         @rd_rn_rm
+UZPQ2           01000100 .. 0 ..... 111 011 ..... .....         @rd_rn_rm
+
 ### SVE Permute - Predicated Group
 
 # SVE compress active elements
diff --git a/target/arm/tcg/sve_helper.c b/target/arm/tcg/sve_helper.c
index a9dc3c44b2..dbbfbc12b9 100644
--- a/target/arm/tcg/sve_helper.c
+++ b/target/arm/tcg/sve_helper.c
@@ -3550,6 +3550,35 @@ DO_UZP(sve_uzp_s, uint32_t, H1_4)
 DO_UZP(sve_uzp_d, uint64_t, H1_8)
 DO_UZP(sve2_uzp_q, Int128, )
 
+typedef void perseg_zzz_fn(void *vd, void *vn, void *vm, uint32_t desc);
+
+static void do_perseg_zzz(void *vd, void *vn, void *vm,
+                          uint32_t desc, perseg_zzz_fn *fn)
+{
+    intptr_t oprsz = simd_oprsz(desc);
+
+    desc = simd_desc(16, 16, simd_data(desc));
+    for (intptr_t i = 0; i < oprsz; i += 16) {
+        fn(vd + i, vn + i, vm + i, desc);
+    }
+}
+
+#define DO_PERSEG_ZZZ(NAME, FUNC) \
+    void HELPER(NAME)(void *vd, void *vn, void *vm, uint32_t desc) \
+    { do_perseg_zzz(vd, vn, vm, desc, FUNC); }
+
+DO_PERSEG_ZZZ(sve2p1_uzpq_b, helper_sve_uzp_b)
+DO_PERSEG_ZZZ(sve2p1_uzpq_h, helper_sve_uzp_h)
+DO_PERSEG_ZZZ(sve2p1_uzpq_s, helper_sve_uzp_s)
+DO_PERSEG_ZZZ(sve2p1_uzpq_d, helper_sve_uzp_d)
+
+DO_PERSEG_ZZZ(sve2p1_zipq_b, helper_sve_zip_b)
+DO_PERSEG_ZZZ(sve2p1_zipq_h, helper_sve_zip_h)
+DO_PERSEG_ZZZ(sve2p1_zipq_s, helper_sve_zip_s)
+DO_PERSEG_ZZZ(sve2p1_zipq_d, helper_sve_zip_d)
+
+#undef DO_PERSEG_ZZZ
+
 #define DO_TRN(NAME, TYPE, H) \
 void HELPER(NAME)(void *vd, void *vn, void *vm, uint32_t desc)         \
 {                                                                      \
diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
index 01c4eaa585..28cfcb9cb4 100644
--- a/target/arm/tcg/translate-sve.c
+++ b/target/arm/tcg/translate-sve.c
@@ -2606,11 +2606,19 @@ TRANS_FEAT_NONSTREAMING(ZIP2_q, aa64_sve_f64mm, do_interleave_q,
                         gen_helper_sve2_zip_q, a,
                         QEMU_ALIGN_DOWN(vec_full_reg_size(s), 32) / 2)
 
+static gen_helper_gvec_3 * const zipq_fns[4] = {
+    gen_helper_sve2p1_zipq_b, gen_helper_sve2p1_zipq_h,
+    gen_helper_sve2p1_zipq_s, gen_helper_sve2p1_zipq_d,
+};
+TRANS_FEAT(ZIPQ1, aa64_sme2p1_or_sve2p1, gen_gvec_ool_arg_zzz,
+           zipq_fns[a->esz], a, 0)
+TRANS_FEAT(ZIPQ2, aa64_sme2p1_or_sve2p1, gen_gvec_ool_arg_zzz,
+           zipq_fns[a->esz], a, 16 / 2)
+
 static gen_helper_gvec_3 * const uzp_fns[4] = {
     gen_helper_sve_uzp_b, gen_helper_sve_uzp_h,
     gen_helper_sve_uzp_s, gen_helper_sve_uzp_d,
 };
-
 TRANS_FEAT(UZP1_z, aa64_sve, gen_gvec_ool_arg_zzz,
            uzp_fns[a->esz], a, 0)
 TRANS_FEAT(UZP2_z, aa64_sve, gen_gvec_ool_arg_zzz,
@@ -2621,6 +2629,15 @@ TRANS_FEAT_NONSTREAMING(UZP1_q, aa64_sve_f64mm, do_interleave_q,
 TRANS_FEAT_NONSTREAMING(UZP2_q, aa64_sve_f64mm, do_interleave_q,
                         gen_helper_sve2_uzp_q, a, 16)
 
+static gen_helper_gvec_3 * const uzpq_fns[4] = {
+    gen_helper_sve2p1_uzpq_b, gen_helper_sve2p1_uzpq_h,
+    gen_helper_sve2p1_uzpq_s, gen_helper_sve2p1_uzpq_d,
+};
+TRANS_FEAT(UZPQ1, aa64_sme2p1_or_sve2p1, gen_gvec_ool_arg_zzz,
+           uzpq_fns[a->esz], a, 0)
+TRANS_FEAT(UZPQ2, aa64_sme2p1_or_sve2p1, gen_gvec_ool_arg_zzz,
+           uzpq_fns[a->esz], a, 1 << a->esz)
+
 static gen_helper_gvec_3 * const trn_fns[4] = {
     gen_helper_sve_trn_b, gen_helper_sve_trn_h,
     gen_helper_sve_trn_s, gen_helper_sve_trn_d,

From 47f4cdd6c28755c7f1415ac38bc3350afaaee330 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:20:55 -0600
Subject: [PATCH 2039/2760] target/arm: Implement TBLQ, TBXQ for SME2p1/SVE2p1

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-93-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/helper-sve.h    | 10 ++++++++++
 target/arm/tcg/sve.decode      |  3 +++
 target/arm/tcg/sve_helper.c    | 10 ++++++++++
 target/arm/tcg/translate-sve.c | 14 ++++++++++++++
 4 files changed, 37 insertions(+)

diff --git a/target/arm/tcg/helper-sve.h b/target/arm/tcg/helper-sve.h
index 0f510ea610..5f4b4aa036 100644
--- a/target/arm/tcg/helper-sve.h
+++ b/target/arm/tcg/helper-sve.h
@@ -676,11 +676,21 @@ DEF_HELPER_FLAGS_5(sve2_tbl_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_5(sve2_tbl_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_5(sve2_tbl_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
 
+DEF_HELPER_FLAGS_4(sve2p1_tblq_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sve2p1_tblq_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sve2p1_tblq_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sve2p1_tblq_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
 DEF_HELPER_FLAGS_4(sve2_tbx_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(sve2_tbx_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(sve2_tbx_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(sve2_tbx_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 
+DEF_HELPER_FLAGS_4(sve2p1_tbxq_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sve2p1_tbxq_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sve2p1_tbxq_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sve2p1_tbxq_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
 DEF_HELPER_FLAGS_3(sve_sunpk_h, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 DEF_HELPER_FLAGS_3(sve_sunpk_s, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 DEF_HELPER_FLAGS_3(sve_sunpk_d, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
diff --git a/target/arm/tcg/sve.decode b/target/arm/tcg/sve.decode
index e98275eec1..52a56d3341 100644
--- a/target/arm/tcg/sve.decode
+++ b/target/arm/tcg/sve.decode
@@ -663,6 +663,9 @@ ZIPQ2           01000100 .. 0 ..... 111 001 ..... .....         @rd_rn_rm
 UZPQ1           01000100 .. 0 ..... 111 010 ..... .....         @rd_rn_rm
 UZPQ2           01000100 .. 0 ..... 111 011 ..... .....         @rd_rn_rm
 
+TBLQ            01000100 .. 0 ..... 111 110 ..... .....         @rd_rn_rm
+TBXQ            00000101 .. 1 ..... 001 101 ..... .....         @rd_rn_rm
+
 ### SVE Permute - Predicated Group
 
 # SVE compress active elements
diff --git a/target/arm/tcg/sve_helper.c b/target/arm/tcg/sve_helper.c
index dbbfbc12b9..42b05756a9 100644
--- a/target/arm/tcg/sve_helper.c
+++ b/target/arm/tcg/sve_helper.c
@@ -3577,6 +3577,16 @@ DO_PERSEG_ZZZ(sve2p1_zipq_h, helper_sve_zip_h)
 DO_PERSEG_ZZZ(sve2p1_zipq_s, helper_sve_zip_s)
 DO_PERSEG_ZZZ(sve2p1_zipq_d, helper_sve_zip_d)
 
+DO_PERSEG_ZZZ(sve2p1_tblq_b, helper_sve_tbl_b)
+DO_PERSEG_ZZZ(sve2p1_tblq_h, helper_sve_tbl_h)
+DO_PERSEG_ZZZ(sve2p1_tblq_s, helper_sve_tbl_s)
+DO_PERSEG_ZZZ(sve2p1_tblq_d, helper_sve_tbl_d)
+
+DO_PERSEG_ZZZ(sve2p1_tbxq_b, helper_sve2_tbx_b)
+DO_PERSEG_ZZZ(sve2p1_tbxq_h, helper_sve2_tbx_h)
+DO_PERSEG_ZZZ(sve2p1_tbxq_s, helper_sve2_tbx_s)
+DO_PERSEG_ZZZ(sve2p1_tbxq_d, helper_sve2_tbx_d)
+
 #undef DO_PERSEG_ZZZ
 
 #define DO_TRN(NAME, TYPE, H) \
diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
index 28cfcb9cb4..02f885dd48 100644
--- a/target/arm/tcg/translate-sve.c
+++ b/target/arm/tcg/translate-sve.c
@@ -2380,12 +2380,26 @@ static gen_helper_gvec_4 * const sve2_tbl_fns[4] = {
 TRANS_FEAT(TBL_sve2, aa64_sve2, gen_gvec_ool_zzzz, sve2_tbl_fns[a->esz],
            a->rd, a->rn, (a->rn + 1) % 32, a->rm, 0)
 
+static gen_helper_gvec_3 * const tblq_fns[4] = {
+    gen_helper_sve2p1_tblq_b, gen_helper_sve2p1_tblq_h,
+    gen_helper_sve2p1_tblq_s, gen_helper_sve2p1_tblq_d
+};
+TRANS_FEAT(TBLQ, aa64_sme2p1_or_sve2p1, gen_gvec_ool_arg_zzz,
+           tblq_fns[a->esz], a, 0)
+
 static gen_helper_gvec_3 * const tbx_fns[4] = {
     gen_helper_sve2_tbx_b, gen_helper_sve2_tbx_h,
     gen_helper_sve2_tbx_s, gen_helper_sve2_tbx_d
 };
 TRANS_FEAT(TBX, aa64_sve2, gen_gvec_ool_arg_zzz, tbx_fns[a->esz], a, 0)
 
+static gen_helper_gvec_3 * const tbxq_fns[4] = {
+    gen_helper_sve2p1_tbxq_b, gen_helper_sve2p1_tbxq_h,
+    gen_helper_sve2p1_tbxq_s, gen_helper_sve2p1_tbxq_d
+};
+TRANS_FEAT(TBXQ, aa64_sme2p1_or_sve2p1, gen_gvec_ool_arg_zzz,
+           tbxq_fns[a->esz], a, 0)
+
 static bool trans_PMOV_pv(DisasContext *s, arg_PMOV_pv *a)
 {
     static gen_helper_gvec_2 * const fns[4] = {

From b0b0818a4a41ab10f1bd5fb5e2c0cd815ae3fee9 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:20:56 -0600
Subject: [PATCH 2040/2760] target/arm: Implement SME2 counted predicate
 register load/store

Implement the SVE2p1 consecutive register LD1/ST1,
and the SME2 strided register LD1/ST1.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-94-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/helper-sve.h    |  16 ++
 target/arm/tcg/sve.decode      |  50 ++++
 target/arm/tcg/sve_helper.c    | 493 +++++++++++++++++++++++++++++++++
 target/arm/tcg/translate-sve.c | 103 +++++++
 4 files changed, 662 insertions(+)

diff --git a/target/arm/tcg/helper-sve.h b/target/arm/tcg/helper-sve.h
index 5f4b4aa036..c4736d7510 100644
--- a/target/arm/tcg/helper-sve.h
+++ b/target/arm/tcg/helper-sve.h
@@ -3048,3 +3048,19 @@ DEF_HELPER_FLAGS_3(pmov_pv_d, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 DEF_HELPER_FLAGS_3(pmov_vp_h, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 DEF_HELPER_FLAGS_3(pmov_vp_s, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 DEF_HELPER_FLAGS_3(pmov_vp_d, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_5(sve2p1_ld1bb_c, TCG_CALL_NO_WG, void, env, ptr, tl, i32, i32)
+DEF_HELPER_FLAGS_5(sve2p1_ld1hh_le_c, TCG_CALL_NO_WG, void, env, ptr, tl, i32, i32)
+DEF_HELPER_FLAGS_5(sve2p1_ld1hh_be_c, TCG_CALL_NO_WG, void, env, ptr, tl, i32, i32)
+DEF_HELPER_FLAGS_5(sve2p1_ld1ss_le_c, TCG_CALL_NO_WG, void, env, ptr, tl, i32, i32)
+DEF_HELPER_FLAGS_5(sve2p1_ld1ss_be_c, TCG_CALL_NO_WG, void, env, ptr, tl, i32, i32)
+DEF_HELPER_FLAGS_5(sve2p1_ld1dd_le_c, TCG_CALL_NO_WG, void, env, ptr, tl, i32, i32)
+DEF_HELPER_FLAGS_5(sve2p1_ld1dd_be_c, TCG_CALL_NO_WG, void, env, ptr, tl, i32, i32)
+
+DEF_HELPER_FLAGS_5(sve2p1_st1bb_c, TCG_CALL_NO_WG, void, env, ptr, tl, i32, i32)
+DEF_HELPER_FLAGS_5(sve2p1_st1hh_le_c, TCG_CALL_NO_WG, void, env, ptr, tl, i32, i32)
+DEF_HELPER_FLAGS_5(sve2p1_st1hh_be_c, TCG_CALL_NO_WG, void, env, ptr, tl, i32, i32)
+DEF_HELPER_FLAGS_5(sve2p1_st1ss_le_c, TCG_CALL_NO_WG, void, env, ptr, tl, i32, i32)
+DEF_HELPER_FLAGS_5(sve2p1_st1ss_be_c, TCG_CALL_NO_WG, void, env, ptr, tl, i32, i32)
+DEF_HELPER_FLAGS_5(sve2p1_st1dd_le_c, TCG_CALL_NO_WG, void, env, ptr, tl, i32, i32)
+DEF_HELPER_FLAGS_5(sve2p1_st1dd_be_c, TCG_CALL_NO_WG, void, env, ptr, tl, i32, i32)
diff --git a/target/arm/tcg/sve.decode b/target/arm/tcg/sve.decode
index 52a56d3341..bf3d4f4853 100644
--- a/target/arm/tcg/sve.decode
+++ b/target/arm/tcg/sve.decode
@@ -1812,3 +1812,53 @@ SCLAMP          01000100 .. 0 ..... 110000 ..... .....          @rda_rn_rm
 UCLAMP          01000100 .. 0 ..... 110001 ..... .....          @rda_rn_rm
 
 FCLAMP          01100100 .. 1 ..... 001001 ..... .....          @rda_rn_rm
+
+### SVE2p1 multi-vec contiguous load
+
+&zcrr_ldst      rd png rn rm esz nreg
+&zcri_ldst      rd png rn imm esz nreg
+%png            10:3 !function=plus_8
+%zd_ax2         1:4 !function=times_2
+%zd_ax4         2:3 !function=times_4
+
+LD1_zcrr        10100000000 rm:5 0 esz:2 ... rn:5 .... - \
+                &zcrr_ldst %png rd=%zd_ax2 nreg=2
+LD1_zcrr        10100000000 rm:5 1 esz:2 ... rn:5 ... 0- \
+                &zcrr_ldst %png rd=%zd_ax4 nreg=4
+
+ST1_zcrr        10100000001 rm:5 0 esz:2 ... rn:5 .... - \
+                &zcrr_ldst %png rd=%zd_ax2 nreg=2
+ST1_zcrr        10100000001 rm:5 1 esz:2 ... rn:5 ... 0- \
+                &zcrr_ldst %png rd=%zd_ax4 nreg=4
+
+LD1_zcri        101000000100 imm:s4 0 esz:2 ... rn:5 .... - \
+                &zcri_ldst %png rd=%zd_ax2 nreg=2
+LD1_zcri        101000000100 imm:s4 1 esz:2 ... rn:5 ... 0- \
+                &zcri_ldst %png rd=%zd_ax4 nreg=4
+
+ST1_zcri        101000000110 imm:s4 0 esz:2 ... rn:5 .... - \
+                &zcri_ldst %png rd=%zd_ax2 nreg=2
+ST1_zcri        101000000110 imm:s4 1 esz:2 ... rn:5 ... 0- \
+                &zcri_ldst %png rd=%zd_ax4 nreg=4
+
+# Note: N bit and 0 bit (for nreg4) still mashed in rd.
+# This is handled within gen_ldst_c().
+LD1_zcrr_stride 10100001000 rm:5 0 esz:2 ... rn:5 rd:5 \
+                &zcrr_ldst %png nreg=2
+LD1_zcrr_stride 10100001000 rm:5 1 esz:2 ... rn:5 rd:5 \
+                &zcrr_ldst %png nreg=4
+
+ST1_zcrr_stride 10100001001 rm:5 0 esz:2 ... rn:5 rd:5 \
+                &zcrr_ldst %png nreg=2
+ST1_zcrr_stride 10100001001 rm:5 1 esz:2 ... rn:5 rd:5 \
+                &zcrr_ldst %png nreg=4
+
+LD1_zcri_stride 101000010100 imm:s4 0 esz:2 ... rn:5 rd:5 \
+                &zcri_ldst %png nreg=2
+LD1_zcri_stride 101000010100 imm:s4 1 esz:2 ... rn:5 rd:5 \
+                &zcri_ldst %png nreg=4
+
+ST1_zcri_stride 101000010110 imm:s4 0 esz:2 ... rn:5 rd:5 \
+                &zcri_ldst %png nreg=2
+ST1_zcri_stride 101000010110 imm:s4 1 esz:2 ... rn:5 rd:5 \
+                &zcri_ldst %png nreg=4
diff --git a/target/arm/tcg/sve_helper.c b/target/arm/tcg/sve_helper.c
index 42b05756a9..e6342990fa 100644
--- a/target/arm/tcg/sve_helper.c
+++ b/target/arm/tcg/sve_helper.c
@@ -7586,6 +7586,499 @@ DO_ST1_ZPZ_D(dd_be, zd, MO_64)
 #undef DO_ST1_ZPZ_S
 #undef DO_ST1_ZPZ_D
 
+/*
+ * SVE2.1 consecutive register load/store
+ */
+
+static unsigned sve2p1_cont_ldst_elements(SVEContLdSt *info, vaddr addr,
+                                          uint32_t png, intptr_t reg_max,
+                                          int N, int v_esz)
+{
+    const int esize = 1 << v_esz;
+    intptr_t reg_off_first = -1, reg_off_last = -1, reg_off_split;
+    DecodeCounter p = decode_counter(png, reg_max, v_esz);
+    unsigned b_count = p.count << v_esz;
+    unsigned b_stride = 1 << (v_esz + p.lg2_stride);
+    intptr_t page_split;
+
+    /* Set all of the element indices to -1, and the TLB data to 0. */
+    memset(info, -1, offsetof(SVEContLdSt, page));
+    memset(info->page, 0, sizeof(info->page));
+
+    if (p.invert) {
+        if (b_count >= reg_max * N) {
+            return 0;
+        }
+        reg_off_first = b_count;
+        reg_off_last = reg_max * N - b_stride;
+    } else {
+        if (b_count == 0) {
+            return 0;
+        }
+        reg_off_first = 0;
+        reg_off_last = MIN(b_count - esize, reg_max * N - b_stride);
+    }
+
+    info->reg_off_first[0] = reg_off_first;
+    info->mem_off_first[0] = reg_off_first;
+
+    page_split = -(addr | TARGET_PAGE_MASK);
+    if (reg_off_last + esize <= page_split || reg_off_first >= page_split) {
+        /* The entire operation fits within a single page. */
+        info->reg_off_last[0] = reg_off_last;
+        return b_stride;
+    }
+
+    info->page_split = page_split;
+    reg_off_split = ROUND_DOWN(page_split, esize);
+
+    /*
+     * This is the last full element on the first page, but it is not
+     * necessarily active.  If there is no full element, i.e. the first
+     * active element is the one that's split, this value remains -1.
+     * It is useful as iteration bounds.
+     */
+    if (reg_off_split != 0) {
+        info->reg_off_last[0] = ROUND_DOWN(reg_off_split - esize, b_stride);
+    }
+
+    /* Determine if an unaligned element spans the pages.  */
+    if (page_split & (esize - 1)) {
+        /* It is helpful to know if the split element is active. */
+        if ((reg_off_split & (b_stride - 1)) == 0) {
+            info->reg_off_split = reg_off_split;
+            info->mem_off_split = reg_off_split;
+        }
+        reg_off_split += esize;
+    }
+
+    /*
+     * We do want the first active element on the second page, because
+     * this may affect the address reported in an exception.
+     */
+    reg_off_split = ROUND_UP(reg_off_split, b_stride);
+    if (reg_off_split <= reg_off_last) {
+        info->reg_off_first[1] = reg_off_split;
+        info->mem_off_first[1] = reg_off_split;
+        info->reg_off_last[1] = reg_off_last;
+    }
+    return b_stride;
+}
+
+static void sve2p1_cont_ldst_watchpoints(SVEContLdSt *info, CPUARMState *env,
+                                         target_ulong addr, unsigned estride,
+                                         int esize, int wp_access, uintptr_t ra)
+{
+#ifndef CONFIG_USER_ONLY
+    intptr_t count_off, count_last;
+    int flags0 = info->page[0].flags;
+    int flags1 = info->page[1].flags;
+
+    if (likely(!((flags0 | flags1) & TLB_WATCHPOINT))) {
+        return;
+    }
+
+    /* Indicate that watchpoints are handled. */
+    info->page[0].flags = flags0 & ~TLB_WATCHPOINT;
+    info->page[1].flags = flags1 & ~TLB_WATCHPOINT;
+
+    if (flags0 & TLB_WATCHPOINT) {
+        count_off = info->reg_off_first[0];
+        count_last = info->reg_off_split;
+        if (count_last < 0) {
+            count_last = info->reg_off_last[0];
+        }
+        do {
+            cpu_check_watchpoint(env_cpu(env), addr + count_off,
+                                 esize, info->page[0].attrs, wp_access, ra);
+            count_off += estride;
+        } while (count_off <= count_last);
+    }
+
+    count_off = info->reg_off_first[1];
+    if ((flags1 & TLB_WATCHPOINT) && count_off >= 0) {
+        count_last = info->reg_off_last[1];
+        do {
+            cpu_check_watchpoint(env_cpu(env), addr + count_off,
+                                 esize, info->page[1].attrs,
+                                 wp_access, ra);
+            count_off += estride;
+        } while (count_off <= count_last);
+    }
+#endif
+}
+
+static void sve2p1_cont_ldst_mte_check(SVEContLdSt *info, CPUARMState *env,
+                                       target_ulong addr, unsigned estride,
+                                       int esize, uint32_t mtedesc,
+                                       uintptr_t ra)
+{
+    intptr_t count_off, count_last;
+
+    /*
+     * TODO: estride is always a small power of two, <= 8.
+     * Manipulate the stride within the loops such that
+     *   - first iteration hits addr + off, as required,
+     *   - second iteration hits ALIGN_UP(addr, 16),
+     *   - other iterations advance addr by 16.
+     * This will minimize the probing to once per MTE granule.
+     */
+
+    /* Process the page only if MemAttr == Tagged. */
+    if (info->page[0].tagged) {
+        count_off = info->reg_off_first[0];
+        count_last = info->reg_off_split;
+        if (count_last < 0) {
+            count_last = info->reg_off_last[0];
+        }
+
+        do {
+            mte_check(env, mtedesc, addr + count_off, ra);
+            count_off += estride;
+        } while (count_off <= count_last);
+    }
+
+    count_off = info->reg_off_first[1];
+    if (count_off >= 0 && info->page[1].tagged) {
+        count_last = info->reg_off_last[1];
+        do {
+            mte_check(env, mtedesc, addr + count_off, ra);
+            count_off += estride;
+        } while (count_off <= count_last);
+    }
+}
+
+static inline QEMU_ALWAYS_INLINE
+void sve2p1_ld1_c(CPUARMState *env, ARMVectorReg *zd, const vaddr addr,
+                  uint32_t png, uint32_t desc,
+                  const uintptr_t ra, const MemOp esz,
+                  sve_ldst1_host_fn *host_fn,
+                  sve_ldst1_tlb_fn *tlb_fn)
+{
+    const unsigned N = (desc >> SIMD_DATA_SHIFT) & 1 ? 4 : 2;
+    const unsigned rstride = 1 << ((desc >> (SIMD_DATA_SHIFT + 1)) % 4);
+    uint32_t mtedesc = desc >> (SIMD_DATA_SHIFT + SVE_MTEDESC_SHIFT);
+    const intptr_t reg_max = simd_oprsz(desc);
+    const unsigned esize = 1 << esz;
+    intptr_t count_off, count_last;
+    intptr_t reg_off, reg_last, reg_n;
+    SVEContLdSt info;
+    unsigned estride, flags;
+    void *host;
+
+    estride = sve2p1_cont_ldst_elements(&info, addr, png, reg_max, N, esz);
+    if (estride == 0) {
+        /* The entire predicate was false; no load occurs.  */
+        for (unsigned n = 0; n < N; n++) {
+            memset(zd + n * rstride, 0, reg_max);
+        }
+        return;
+    }
+
+    /* Probe the page(s).  Exit with exception for any invalid page. */
+    sve_cont_ldst_pages(&info, FAULT_ALL, env, addr, MMU_DATA_LOAD, ra);
+
+    /* Handle watchpoints for all active elements. */
+    sve2p1_cont_ldst_watchpoints(&info, env, addr, estride,
+                                 esize, BP_MEM_READ, ra);
+
+    /*
+     * Handle mte checks for all active elements.
+     * Since TBI must be set for MTE, !mtedesc => !mte_active.
+     */
+    if (mtedesc) {
+        sve2p1_cont_ldst_mte_check(&info, env, estride, addr,
+                                   esize, mtedesc, ra);
+    }
+
+    flags = info.page[0].flags | info.page[1].flags;
+    if (unlikely(flags != 0)) {
+        /*
+         * At least one page includes MMIO.
+         * Any bus operation can fail with cpu_transaction_failed,
+         * which for ARM will raise SyncExternal.  Perform the load
+         * into scratch memory to preserve register state until the end.
+         */
+        ARMVectorReg scratch[4] = { };
+
+        count_off = info.reg_off_first[0];
+        count_last = info.reg_off_last[1];
+        if (count_last < 0) {
+            count_last = info.reg_off_split;
+            if (count_last < 0) {
+                count_last = info.reg_off_last[0];
+            }
+        }
+        reg_off = count_off % reg_max;
+        reg_n = count_off / reg_max;
+
+        do {
+            reg_last = MIN(count_last - count_off, reg_max - esize);
+            do {
+                tlb_fn(env, &scratch[reg_n], reg_off, addr + count_off, ra);
+                reg_off += estride;
+                count_off += estride;
+            } while (reg_off <= reg_last);
+            reg_off = 0;
+            reg_n++;
+        } while (count_off <= count_last);
+
+        for (unsigned n = 0; n < N; ++n) {
+            memcpy(&zd[n * rstride], &scratch[n], reg_max);
+        }
+        return;
+    }
+
+    /* The entire operation is in RAM, on valid pages. */
+
+    for (unsigned n = 0; n < N; ++n) {
+        memset(&zd[n * rstride], 0, reg_max);
+    }
+
+    count_off = info.reg_off_first[0];
+    count_last = info.reg_off_last[0];
+    reg_off = count_off % reg_max;
+    reg_n = count_off / reg_max;
+    host = info.page[0].host;
+
+    set_helper_retaddr(ra);
+
+    do {
+        reg_last = MIN(count_last - reg_n * reg_max, reg_max - esize);
+        do {
+            host_fn(&zd[reg_n * rstride], reg_off, host + count_off);
+            reg_off += estride;
+            count_off += estride;
+        } while (reg_off <= reg_last);
+        reg_off = 0;
+        reg_n++;
+    } while (count_off <= count_last);
+
+    clear_helper_retaddr();
+
+    /*
+     * Use the slow path to manage the cross-page misalignment.
+     * But we know this is RAM and cannot trap.
+     */
+    count_off = info.reg_off_split;
+    if (unlikely(count_off >= 0)) {
+        reg_off = count_off % reg_max;
+        reg_n = count_off / reg_max;
+        tlb_fn(env, &zd[reg_n * rstride], reg_off, addr + count_off, ra);
+    }
+
+    count_off = info.reg_off_first[1];
+    if (unlikely(count_off >= 0)) {
+        count_last = info.reg_off_last[1];
+        reg_off = count_off % reg_max;
+        reg_n = count_off / reg_max;
+        host = info.page[1].host;
+
+        set_helper_retaddr(ra);
+
+        do {
+            reg_last = MIN(count_last - reg_n * reg_max, reg_max - esize);
+            do {
+                host_fn(&zd[reg_n * rstride], reg_off, host + count_off);
+                reg_off += estride;
+                count_off += estride;
+            } while (reg_off <= reg_last);
+            reg_off = 0;
+            reg_n++;
+        } while (count_off <= count_last);
+
+        clear_helper_retaddr();
+    }
+}
+
+void HELPER(sve2p1_ld1bb_c)(CPUARMState *env, void *vd, target_ulong addr,
+                            uint32_t png, uint32_t desc)
+{
+    sve2p1_ld1_c(env, vd, addr, png, desc, GETPC(), MO_8,
+                 sve_ld1bb_host, sve_ld1bb_tlb);
+}
+
+#define DO_LD1_2(NAME, ESZ)                                             \
+void HELPER(sve2p1_##NAME##_le_c)(CPUARMState *env, void *vd,           \
+                                  target_ulong addr, uint32_t png,      \
+                                  uint32_t desc)                        \
+{                                                                       \
+    sve2p1_ld1_c(env, vd, addr, png, desc, GETPC(), ESZ,                \
+                 sve_##NAME##_le_host, sve_##NAME##_le_tlb);            \
+}                                                                       \
+void HELPER(sve2p1_##NAME##_be_c)(CPUARMState *env, void *vd,           \
+                                  target_ulong addr, uint32_t png,      \
+                                  uint32_t desc)                        \
+{                                                                       \
+    sve2p1_ld1_c(env, vd, addr, png, desc, GETPC(), ESZ,                \
+                 sve_##NAME##_be_host, sve_##NAME##_be_tlb);            \
+}
+
+DO_LD1_2(ld1hh, MO_16)
+DO_LD1_2(ld1ss, MO_32)
+DO_LD1_2(ld1dd, MO_64)
+
+#undef DO_LD1_2
+
+static inline QEMU_ALWAYS_INLINE
+void sve2p1_st1_c(CPUARMState *env, ARMVectorReg *zd, const vaddr addr,
+                  uint32_t png, uint32_t desc,
+                  const uintptr_t ra, const int esz,
+                  sve_ldst1_host_fn *host_fn,
+                  sve_ldst1_tlb_fn *tlb_fn)
+{
+    const unsigned N = (desc >> SIMD_DATA_SHIFT) & 1 ? 4 : 2;
+    const unsigned rstride = 1 << ((desc >> (SIMD_DATA_SHIFT + 1)) % 4);
+    uint32_t mtedesc = desc >> (SIMD_DATA_SHIFT + SVE_MTEDESC_SHIFT);
+    const intptr_t reg_max = simd_oprsz(desc);
+    const unsigned esize = 1 << esz;
+    intptr_t count_off, count_last;
+    intptr_t reg_off, reg_last, reg_n;
+    SVEContLdSt info;
+    unsigned estride, flags;
+    void *host;
+
+    estride = sve2p1_cont_ldst_elements(&info, addr, png, reg_max, N, esz);
+    if (estride == 0) {
+        /* The entire predicate was false; no store occurs.  */
+        return;
+    }
+
+    /* Probe the page(s).  Exit with exception for any invalid page. */
+    sve_cont_ldst_pages(&info, FAULT_ALL, env, addr, MMU_DATA_STORE, ra);
+
+    /* Handle watchpoints for all active elements. */
+    sve2p1_cont_ldst_watchpoints(&info, env, addr, estride,
+                                 esize, BP_MEM_WRITE, ra);
+
+    /*
+     * Handle mte checks for all active elements.
+     * Since TBI must be set for MTE, !mtedesc => !mte_active.
+     */
+    if (mtedesc) {
+        sve2p1_cont_ldst_mte_check(&info, env, estride, addr,
+                                   esize, mtedesc, ra);
+    }
+
+    flags = info.page[0].flags | info.page[1].flags;
+    if (unlikely(flags != 0)) {
+        /*
+         * At least one page includes MMIO.
+         * Any bus operation can fail with cpu_transaction_failed,
+         * which for ARM will raise SyncExternal.  Perform the load
+         * into scratch memory to preserve register state until the end.
+         */
+        count_off = info.reg_off_first[0];
+        count_last = info.reg_off_last[1];
+        if (count_last < 0) {
+            count_last = info.reg_off_split;
+            if (count_last < 0) {
+                count_last = info.reg_off_last[0];
+            }
+        }
+        reg_off = count_off % reg_max;
+        reg_n = count_off / reg_max;
+
+        do {
+            reg_last = MIN(count_last - count_off, reg_max - esize);
+            do {
+                tlb_fn(env, &zd[reg_n * rstride], reg_off, addr + count_off, ra);
+                reg_off += estride;
+                count_off += estride;
+            } while (reg_off <= reg_last);
+            reg_off = 0;
+            reg_n++;
+        } while (count_off <= count_last);
+        return;
+    }
+
+    /* The entire operation is in RAM, on valid pages. */
+
+    count_off = info.reg_off_first[0];
+    count_last = info.reg_off_last[0];
+    reg_off = count_off % reg_max;
+    reg_n = count_off / reg_max;
+    host = info.page[0].host;
+
+    set_helper_retaddr(ra);
+
+    do {
+        reg_last = MIN(count_last - reg_n * reg_max, reg_max - esize);
+        do {
+            host_fn(&zd[reg_n * rstride], reg_off, host + count_off);
+            reg_off += estride;
+            count_off += estride;
+        } while (reg_off <= reg_last);
+        reg_off = 0;
+        reg_n++;
+    } while (count_off <= count_last);
+
+    clear_helper_retaddr();
+
+    /*
+     * Use the slow path to manage the cross-page misalignment.
+     * But we know this is RAM and cannot trap.
+     */
+    count_off = info.reg_off_split;
+    if (unlikely(count_off >= 0)) {
+        reg_off = count_off % reg_max;
+        reg_n = count_off / reg_max;
+        tlb_fn(env, &zd[reg_n * rstride], reg_off, addr + count_off, ra);
+    }
+
+    count_off = info.reg_off_first[1];
+    if (unlikely(count_off >= 0)) {
+        count_last = info.reg_off_last[1];
+        reg_off = count_off % reg_max;
+        reg_n = count_off / reg_max;
+        host = info.page[1].host;
+
+        set_helper_retaddr(ra);
+
+        do {
+            reg_last = MIN(count_last - reg_n * reg_max, reg_max - esize);
+            do {
+                host_fn(&zd[reg_n * rstride], reg_off, host + count_off);
+                reg_off += estride;
+                count_off += estride;
+            } while (reg_off <= reg_last);
+            reg_off = 0;
+            reg_n++;
+        } while (count_off <= count_last);
+
+        clear_helper_retaddr();
+    }
+}
+
+void HELPER(sve2p1_st1bb_c)(CPUARMState *env, void *vd, target_ulong addr,
+                           uint32_t png, uint32_t desc)
+{
+    sve2p1_st1_c(env, vd, addr, png, desc, GETPC(), MO_8,
+                 sve_st1bb_host, sve_st1bb_tlb);
+}
+
+#define DO_ST1_2(NAME, ESZ)                                             \
+void HELPER(sve2p1_##NAME##_le_c)(CPUARMState *env, void *vd,           \
+                                  target_ulong addr, uint32_t png,      \
+                                  uint32_t desc)                        \
+{                                                                       \
+    sve2p1_st1_c(env, vd, addr, png, desc, GETPC(), ESZ,                \
+                 sve_##NAME##_le_host, sve_##NAME##_le_tlb);            \
+}                                                                       \
+void HELPER(sve2p1_##NAME##_be_c)(CPUARMState *env, void *vd,           \
+                                  target_ulong addr, uint32_t png,      \
+                                  uint32_t desc)                        \
+{                                                                       \
+    sve2p1_st1_c(env, vd, addr, png, desc, GETPC(), ESZ,                \
+                 sve_##NAME##_be_host, sve_##NAME##_be_tlb);            \
+}
+
+DO_ST1_2(st1hh, MO_16)
+DO_ST1_2(st1ss, MO_32)
+DO_ST1_2(st1dd, MO_64)
+
+#undef DO_ST1_2
+
 void HELPER(sve2_eor3)(void *vd, void *vn, void *vm, void *vk, uint32_t desc)
 {
     intptr_t i, opr_sz = simd_oprsz(desc) / 8;
diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
index 02f885dd48..dfb53e4bf4 100644
--- a/target/arm/tcg/translate-sve.c
+++ b/target/arm/tcg/translate-sve.c
@@ -7863,3 +7863,106 @@ TRANS_FEAT(UQCVTN_sh, aa64_sme2_or_sve2p1, gen_gvec_ool_zz,
            gen_helper_sme2_uqcvtn_sh, a->rd, a->rn, 0)
 TRANS_FEAT(SQCVTUN_sh, aa64_sme2_or_sve2p1, gen_gvec_ool_zz,
            gen_helper_sme2_sqcvtun_sh, a->rd, a->rn, 0)
+
+static bool gen_ldst_c(DisasContext *s, TCGv_i64 addr, int zd, int png,
+                       MemOp esz, bool is_write, int n, bool strided)
+{
+    typedef void ldst_c_fn(TCGv_env, TCGv_ptr, TCGv_i64,
+                           TCGv_i32, TCGv_i32);
+    static ldst_c_fn * const f_ldst[2][2][4] = {
+        { { gen_helper_sve2p1_ld1bb_c,
+            gen_helper_sve2p1_ld1hh_le_c,
+            gen_helper_sve2p1_ld1ss_le_c,
+            gen_helper_sve2p1_ld1dd_le_c, },
+          { gen_helper_sve2p1_ld1bb_c,
+            gen_helper_sve2p1_ld1hh_be_c,
+            gen_helper_sve2p1_ld1ss_be_c,
+            gen_helper_sve2p1_ld1dd_be_c, } },
+
+        { { gen_helper_sve2p1_st1bb_c,
+            gen_helper_sve2p1_st1hh_le_c,
+            gen_helper_sve2p1_st1ss_le_c,
+            gen_helper_sve2p1_st1dd_le_c, },
+          { gen_helper_sve2p1_st1bb_c,
+            gen_helper_sve2p1_st1hh_be_c,
+            gen_helper_sve2p1_st1ss_be_c,
+            gen_helper_sve2p1_st1dd_be_c, } }
+    };
+
+    TCGv_i32 t_png, t_desc;
+    TCGv_ptr t_zd;
+    uint32_t desc, lg2_rstride = 0;
+    bool be = s->be_data == MO_BE;
+
+    assert(n == 2 || n == 4);
+    if (strided) {
+        lg2_rstride = 3;
+        if (n == 4) {
+            /* Validate ZD alignment. */
+            if (zd & 4) {
+                return false;
+            }
+            lg2_rstride = 2;
+        }
+        /* Ignore non-temporal bit */
+        zd &= ~8;
+    }
+
+    if (strided || !dc_isar_feature(aa64_sve2p1, s)
+        ? !sme_sm_enabled_check(s)
+        : !sve_access_check(s)) {
+        return true;
+    }
+
+    if (!s->mte_active[0]) {
+        addr = clean_data_tbi(s, addr);
+    }
+
+    desc = n == 2 ? 0 : 1;
+    desc = desc | (lg2_rstride << 1);
+    desc = make_svemte_desc(s, vec_full_reg_size(s), 1, esz, is_write, desc);
+    t_desc = tcg_constant_i32(desc);
+
+    t_png = tcg_temp_new_i32();
+    tcg_gen_ld16u_i32(t_png, tcg_env,
+                      pred_full_reg_offset(s, png) ^
+                      (HOST_BIG_ENDIAN ? 6 : 0));
+
+    t_zd = tcg_temp_new_ptr();
+    tcg_gen_addi_ptr(t_zd, tcg_env, vec_full_reg_offset(s, zd));
+
+    f_ldst[is_write][be][esz](tcg_env, t_zd, addr, t_png, t_desc);
+    return true;
+}
+
+static bool gen_ldst_zcrr_c(DisasContext *s, arg_zcrr_ldst *a,
+                            bool is_write, bool strided)
+{
+    TCGv_i64 addr = tcg_temp_new_i64();
+
+    tcg_gen_shli_i64(addr, cpu_reg(s, a->rm), a->esz);
+    tcg_gen_add_i64(addr, addr, cpu_reg_sp(s, a->rn));
+    return gen_ldst_c(s, addr, a->rd, a->png, a->esz, is_write,
+                      a->nreg, strided);
+}
+
+static bool gen_ldst_zcri_c(DisasContext *s, arg_zcri_ldst *a,
+                            bool is_write, bool strided)
+{
+    TCGv_i64 addr = tcg_temp_new_i64();
+
+    tcg_gen_addi_i64(addr, cpu_reg_sp(s, a->rn),
+                     a->imm * a->nreg * vec_full_reg_size(s));
+    return gen_ldst_c(s, addr, a->rd, a->png, a->esz, is_write,
+                      a->nreg, strided);
+}
+
+TRANS_FEAT(LD1_zcrr, aa64_sme2_or_sve2p1, gen_ldst_zcrr_c, a, false, false)
+TRANS_FEAT(LD1_zcri, aa64_sme2_or_sve2p1, gen_ldst_zcri_c, a, false, false)
+TRANS_FEAT(ST1_zcrr, aa64_sme2_or_sve2p1, gen_ldst_zcrr_c, a, true, false)
+TRANS_FEAT(ST1_zcri, aa64_sme2_or_sve2p1, gen_ldst_zcri_c, a, true, false)
+
+TRANS_FEAT(LD1_zcrr_stride, aa64_sme2, gen_ldst_zcrr_c, a, false, true)
+TRANS_FEAT(LD1_zcri_stride, aa64_sme2, gen_ldst_zcri_c, a, false, true)
+TRANS_FEAT(ST1_zcrr_stride, aa64_sme2, gen_ldst_zcrr_c, a, true, true)
+TRANS_FEAT(ST1_zcri_stride, aa64_sme2, gen_ldst_zcri_c, a, true, true)

From 0af0c9bbb94b5049354cd7a102929b1fbf097c20 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:20:57 -0600
Subject: [PATCH 2041/2760] target/arm: Split the ST_zpri and ST_zprr patterns

The msz > esz encodings are reserved, and some of
them are about to be reused.  Split these patterns
so that the new insns do not overlap.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-95-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/sve.decode | 26 ++++++++++++++++++--------
 1 file changed, 18 insertions(+), 8 deletions(-)

diff --git a/target/arm/tcg/sve.decode b/target/arm/tcg/sve.decode
index bf3d4f4853..7020771898 100644
--- a/target/arm/tcg/sve.decode
+++ b/target/arm/tcg/sve.decode
@@ -252,7 +252,7 @@
 
 # Stores; user must fill in ESZ, MSZ, NREG as needed.
 @rprr_store         ....... ..    ..     rm:5 ... pg:3 rn:5 rd:5    &rprr_store
-@rpri_store_msz     ....... msz:2 .. . imm:s4 ... pg:3 rn:5 rd:5    &rpri_store
+@rpri_store         ....... ..    .. . imm:s4 ... pg:3 rn:5 rd:5    &rpri_store
 @rprr_store_esz_n0  ....... ..    esz:2  rm:5 ... pg:3 rn:5 rd:5 \
                     &rprr_store nreg=0
 @rprr_scatter_store ....... msz:2 ..     rm:5 ... pg:3 rn:5 rd:5 \
@@ -1334,8 +1334,16 @@ STR_zri         1110010 11 0.     ..... 010 ... ..... .....     @rd_rn_i9
 
 # SVE contiguous store (scalar plus immediate)
 # ST1B, ST1H, ST1W, ST1D; require msz <= esz
-ST_zpri         1110010 .. esz:2  0.... 111 ... ..... ..... \
-                @rpri_store_msz nreg=0
+ST_zpri         1110010 00 esz:2  0.... 111 ... ..... ..... \
+                @rpri_store msz=0 nreg=0
+ST_zpri         1110010 01 esz:2  0.... 111 ... ..... ..... \
+                @rpri_store msz=1 nreg=0
+ST_zpri         1110010 10 10     0.... 111 ... ..... ..... \
+                @rpri_store msz=2 esz=2 nreg=0
+ST_zpri         1110010 10 11     0.... 111 ... ..... ..... \
+                @rpri_store msz=2 esz=3 nreg=0
+ST_zpri         1110010 11 11     0.... 111 ... ..... ..... \
+                @rpri_store msz=3 esz=3 nreg=0
 
 # SVE contiguous store (scalar plus scalar)
 # ST1B, ST1H, ST1W, ST1D; require msz <= esz
@@ -1344,20 +1352,22 @@ ST_zprr         1110010 00 ..     ..... 010 ... ..... ..... \
                 @rprr_store_esz_n0 msz=0
 ST_zprr         1110010 01 ..     ..... 010 ... ..... ..... \
                 @rprr_store_esz_n0 msz=1
-ST_zprr         1110010 10 ..     ..... 010 ... ..... ..... \
-                @rprr_store_esz_n0 msz=2
+ST_zprr         1110010 10 10     ..... 010 ... ..... ..... \
+                @rprr_store msz=2 esz=2 nreg=0
+ST_zprr         1110010 10 11     ..... 010 ... ..... ..... \
+                @rprr_store msz=2 esz=3 nreg=0
 ST_zprr         1110010 11 11     ..... 010 ... ..... ..... \
                 @rprr_store msz=3 esz=3 nreg=0
 
 # SVE contiguous non-temporal store (scalar plus immediate)  (nreg == 0)
 # SVE store multiple structures (scalar plus immediate)      (nreg != 0)
 ST_zpri         1110010 .. nreg:2 1.... 111 ... ..... ..... \
-                @rpri_store_msz esz=%size_23
+                @rpri_store msz=%size_23 esz=%size_23
 
 # SVE contiguous non-temporal store (scalar plus scalar)     (nreg == 0)
 # SVE store multiple structures (scalar plus scalar)         (nreg != 0)
-ST_zprr         1110010 msz:2 nreg:2 ..... 011 ... ..... ..... \
-                @rprr_store esz=%size_23
+ST_zprr         1110010 .. nreg:2 ..... 011 ... ..... ..... \
+                @rprr_store msz=%size_23 esz=%size_23
 
 # SVE 32-bit scatter store (scalar plus 32-bit scaled offsets)
 # Require msz > 0 && msz <= esz.

From fc5f060bcb7b45d8e330e294947cac7dffa0ea82 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:20:58 -0600
Subject: [PATCH 2042/2760] target/arm: Implement {LD1, ST1}{W, D} (128-bit
 element) for SVE2p1

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-96-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/helper-sve.h        |  22 +++++
 target/arm/tcg/sve.decode          |  20 +++++
 target/arm/tcg/sve_helper.c        |   6 ++
 target/arm/tcg/sve_ldst_internal.h |  26 ++++++
 target/arm/tcg/translate-sve.c     | 136 +++++++++++++++++++++++------
 5 files changed, 183 insertions(+), 27 deletions(-)

diff --git a/target/arm/tcg/helper-sve.h b/target/arm/tcg/helper-sve.h
index c4736d7510..1999c4bb1f 100644
--- a/target/arm/tcg/helper-sve.h
+++ b/target/arm/tcg/helper-sve.h
@@ -1678,9 +1678,15 @@ DEF_HELPER_FLAGS_4(sve_ld1hds_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
 DEF_HELPER_FLAGS_4(sve_ld1sdu_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
 DEF_HELPER_FLAGS_4(sve_ld1sds_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
 
+DEF_HELPER_FLAGS_4(sve_ld1squ_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_ld1dqu_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+
 DEF_HELPER_FLAGS_4(sve_ld1sdu_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
 DEF_HELPER_FLAGS_4(sve_ld1sds_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
 
+DEF_HELPER_FLAGS_4(sve_ld1squ_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_ld1dqu_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+
 DEF_HELPER_FLAGS_4(sve_ld1bb_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
 DEF_HELPER_FLAGS_4(sve_ld2bb_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
 DEF_HELPER_FLAGS_4(sve_ld3bb_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
@@ -1736,9 +1742,15 @@ DEF_HELPER_FLAGS_4(sve_ld1hds_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
 DEF_HELPER_FLAGS_4(sve_ld1sdu_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
 DEF_HELPER_FLAGS_4(sve_ld1sds_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
 
+DEF_HELPER_FLAGS_4(sve_ld1squ_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_ld1dqu_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+
 DEF_HELPER_FLAGS_4(sve_ld1sdu_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
 DEF_HELPER_FLAGS_4(sve_ld1sds_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
 
+DEF_HELPER_FLAGS_4(sve_ld1squ_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_ld1dqu_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+
 DEF_HELPER_FLAGS_4(sve_ldff1bb_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
 DEF_HELPER_FLAGS_4(sve_ldff1bhu_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
 DEF_HELPER_FLAGS_4(sve_ldff1bsu_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
@@ -1946,6 +1958,11 @@ DEF_HELPER_FLAGS_4(sve_st1hd_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
 DEF_HELPER_FLAGS_4(sve_st1sd_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
 DEF_HELPER_FLAGS_4(sve_st1sd_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
 
+DEF_HELPER_FLAGS_4(sve_st1sq_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_st1sq_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_st1dq_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_st1dq_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+
 DEF_HELPER_FLAGS_4(sve_st1bb_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
 DEF_HELPER_FLAGS_4(sve_st2bb_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
 DEF_HELPER_FLAGS_4(sve_st3bb_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
@@ -1993,6 +2010,11 @@ DEF_HELPER_FLAGS_4(sve_st1hd_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
 DEF_HELPER_FLAGS_4(sve_st1sd_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
 DEF_HELPER_FLAGS_4(sve_st1sd_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
 
+DEF_HELPER_FLAGS_4(sve_st1sq_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_st1sq_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_st1dq_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_st1dq_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+
 DEF_HELPER_FLAGS_6(sve_ldbsu_zsu, TCG_CALL_NO_WG,
                    void, env, ptr, ptr, ptr, tl, i32)
 DEF_HELPER_FLAGS_6(sve_ldhsu_le_zsu, TCG_CALL_NO_WG,
diff --git a/target/arm/tcg/sve.decode b/target/arm/tcg/sve.decode
index 7020771898..bf33bc305f 100644
--- a/target/arm/tcg/sve.decode
+++ b/target/arm/tcg/sve.decode
@@ -1240,12 +1240,24 @@ LD1_zpiz        1000010 .. 01 ..... 1.. ... ..... ..... \
 
 # SVE contiguous load (scalar plus scalar)
 LD_zprr         1010010 .... ..... 010 ... ..... .....    @rprr_load_dt nreg=0
+# LD1W (128-bit element)
+LD_zprr         1010010 1000 rm:5  100 pg:3 rn:5 rd:5     \
+                &rprr_load dtype=16 nreg=0
+# LD1D (128-bit element)
+LD_zprr         1010010 1100 rm:5  100 pg:3 rn:5 rd:5     \
+                &rprr_load dtype=17 nreg=0
 
 # SVE contiguous first-fault load (scalar plus scalar)
 LDFF1_zprr      1010010 .... ..... 011 ... ..... .....    @rprr_load_dt nreg=0
 
 # SVE contiguous load (scalar plus immediate)
 LD_zpri         1010010 .... 0.... 101 ... ..... .....    @rpri_load_dt nreg=0
+# LD1W (128-bit element)
+LD_zpri         1010010 1000 1 imm:s4 001 pg:3 rn:5 rd:5  \
+                &rpri_load dtype=16 nreg=0
+# LD1D (128-bit element)
+LD_zpri         1010010 1100 1 imm:s4 001 pg:3 rn:5 rd:5  \
+                &rpri_load dtype=17 nreg=0
 
 # SVE contiguous non-fault load (scalar plus immediate)
 LDNF1_zpri      1010010 .... 1.... 101 ... ..... .....    @rpri_load_dt nreg=0
@@ -1344,6 +1356,10 @@ ST_zpri         1110010 10 11     0.... 111 ... ..... ..... \
                 @rpri_store msz=2 esz=3 nreg=0
 ST_zpri         1110010 11 11     0.... 111 ... ..... ..... \
                 @rpri_store msz=3 esz=3 nreg=0
+ST_zpri         1110010 10 00     0.... 111 ... ..... ..... \
+                @rpri_store msz=2 esz=4 nreg=0
+ST_zpri         1110010 11 10     0.... 111 ... ..... ..... \
+                @rpri_store msz=3 esz=4 nreg=0
 
 # SVE contiguous store (scalar plus scalar)
 # ST1B, ST1H, ST1W, ST1D; require msz <= esz
@@ -1358,6 +1374,10 @@ ST_zprr         1110010 10 11     ..... 010 ... ..... ..... \
                 @rprr_store msz=2 esz=3 nreg=0
 ST_zprr         1110010 11 11     ..... 010 ... ..... ..... \
                 @rprr_store msz=3 esz=3 nreg=0
+ST_zprr         1110010 10 00     ..... 010 ... ..... ..... \
+                @rprr_store msz=2 esz=4 nreg=0
+ST_zprr         1110010 11 10     ..... 010 ... ..... ..... \
+                @rprr_store msz=3 esz=4 nreg=0
 
 # SVE contiguous non-temporal store (scalar plus immediate)  (nreg == 0)
 # SVE store multiple structures (scalar plus immediate)      (nreg != 0)
diff --git a/target/arm/tcg/sve_helper.c b/target/arm/tcg/sve_helper.c
index e6342990fa..91cd5970ee 100644
--- a/target/arm/tcg/sve_helper.c
+++ b/target/arm/tcg/sve_helper.c
@@ -6359,6 +6359,9 @@ DO_LD1_2(ld1sds, MO_64, MO_32)
 
 DO_LD1_2(ld1dd,  MO_64, MO_64)
 
+DO_LD1_2(ld1squ, MO_32, MO_128)
+DO_LD1_2(ld1dqu, MO_64, MO_128)
+
 #undef DO_LD1_1
 #undef DO_LD1_2
 
@@ -6981,6 +6984,9 @@ DO_STN_2(2, dd, MO_64, MO_64)
 DO_STN_2(3, dd, MO_64, MO_64)
 DO_STN_2(4, dd, MO_64, MO_64)
 
+DO_STN_2(1, sq, MO_128, MO_32)
+DO_STN_2(1, dq, MO_128, MO_64)
+
 #undef DO_STN_1
 #undef DO_STN_2
 
diff --git a/target/arm/tcg/sve_ldst_internal.h b/target/arm/tcg/sve_ldst_internal.h
index f2243daf37..e87beba435 100644
--- a/target/arm/tcg/sve_ldst_internal.h
+++ b/target/arm/tcg/sve_ldst_internal.h
@@ -116,6 +116,31 @@ DO_ST_PRIM_2(sd, H1_8, uint64_t, uint32_t, stl)
 DO_LD_PRIM_2(dd, H1_8, uint64_t, uint64_t, ldq)
 DO_ST_PRIM_2(dd, H1_8, uint64_t, uint64_t, stq)
 
+#define DO_LD_PRIM_3(NAME, FUNC) \
+    static inline void sve_##NAME##_host(void *vd,                      \
+        intptr_t reg_off, void *host)                                   \
+    { sve_##FUNC##_host(vd, reg_off, host);                             \
+      *(uint64_t *)(vd + reg_off + 8) = 0; }                            \
+    static inline void sve_##NAME##_tlb(CPUARMState *env, void *vd,     \
+        intptr_t reg_off, target_ulong addr, uintptr_t ra)              \
+    { sve_##FUNC##_tlb(env, vd, reg_off, addr, ra);                     \
+      *(uint64_t *)(vd + reg_off + 8) = 0; }
+
+DO_LD_PRIM_3(ld1squ_be, ld1sdu_be)
+DO_LD_PRIM_3(ld1squ_le, ld1sdu_le)
+DO_LD_PRIM_3(ld1dqu_be, ld1dd_be)
+DO_LD_PRIM_3(ld1dqu_le, ld1dd_le)
+
+#define sve_st1sq_be_host  sve_st1sd_be_host
+#define sve_st1sq_le_host  sve_st1sd_le_host
+#define sve_st1sq_be_tlb   sve_st1sd_be_tlb
+#define sve_st1sq_le_tlb   sve_st1sd_le_tlb
+
+#define sve_st1dq_be_host  sve_st1dd_be_host
+#define sve_st1dq_le_host  sve_st1dd_le_host
+#define sve_st1dq_be_tlb   sve_st1dd_be_tlb
+#define sve_st1dq_le_tlb   sve_st1dd_le_tlb
+
 #undef DO_LD_TLB
 #undef DO_ST_TLB
 #undef DO_LD_HOST
@@ -123,6 +148,7 @@ DO_ST_PRIM_2(dd, H1_8, uint64_t, uint64_t, stq)
 #undef DO_ST_PRIM_1
 #undef DO_LD_PRIM_2
 #undef DO_ST_PRIM_2
+#undef DO_LD_PRIM_3
 
 /*
  * Resolve the guest virtual address to info->host and info->flags.
diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
index dfb53e4bf4..8e945c5d2d 100644
--- a/target/arm/tcg/translate-sve.c
+++ b/target/arm/tcg/translate-sve.c
@@ -4817,21 +4817,25 @@ static bool trans_STR_pri(DisasContext *s, arg_rri *a)
  */
 
 /* The memory mode of the dtype.  */
-static const MemOp dtype_mop[16] = {
+static const MemOp dtype_mop[19] = {
     MO_UB, MO_UB, MO_UB, MO_UB,
     MO_SL, MO_UW, MO_UW, MO_UW,
     MO_SW, MO_SW, MO_UL, MO_UL,
-    MO_SB, MO_SB, MO_SB, MO_UQ
+    MO_SB, MO_SB, MO_SB, MO_UQ,
+    /* Artificial values used by decode */
+    MO_UL, MO_UQ, MO_128,
 };
 
 #define dtype_msz(x)  (dtype_mop[x] & MO_SIZE)
 
 /* The vector element size of dtype.  */
-static const uint8_t dtype_esz[16] = {
+static const uint8_t dtype_esz[19] = {
     0, 1, 2, 3,
     3, 1, 2, 3,
     3, 2, 2, 3,
-    3, 2, 1, 3
+    3, 2, 1, 3,
+    /* Artificial values used by decode */
+    4, 4, 4,
 };
 
 uint32_t make_svemte_desc(DisasContext *s, unsigned vsz, uint32_t nregs,
@@ -4882,7 +4886,7 @@ static void do_mem_zpa(DisasContext *s, int zt, int pg, TCGv_i64 addr,
 }
 
 /* Indexed by [mte][be][dtype][nreg] */
-static gen_helper_gvec_mem * const ldr_fns[2][2][16][4] = {
+static gen_helper_gvec_mem * const ldr_fns[2][2][18][4] = {
     { /* mte inactive, little-endian */
       { { gen_helper_sve_ld1bb_r, gen_helper_sve_ld2bb_r,
           gen_helper_sve_ld3bb_r, gen_helper_sve_ld4bb_r },
@@ -4906,7 +4910,11 @@ static gen_helper_gvec_mem * const ldr_fns[2][2][16][4] = {
         { gen_helper_sve_ld1bss_r, NULL, NULL, NULL },
         { gen_helper_sve_ld1bhs_r, NULL, NULL, NULL },
         { gen_helper_sve_ld1dd_le_r, gen_helper_sve_ld2dd_le_r,
-          gen_helper_sve_ld3dd_le_r, gen_helper_sve_ld4dd_le_r } },
+          gen_helper_sve_ld3dd_le_r, gen_helper_sve_ld4dd_le_r },
+
+        { gen_helper_sve_ld1squ_le_r, NULL, NULL, NULL },
+        { gen_helper_sve_ld1dqu_le_r, NULL, NULL, NULL },
+      },
 
       /* mte inactive, big-endian */
       { { gen_helper_sve_ld1bb_r, gen_helper_sve_ld2bb_r,
@@ -4931,7 +4939,12 @@ static gen_helper_gvec_mem * const ldr_fns[2][2][16][4] = {
         { gen_helper_sve_ld1bss_r, NULL, NULL, NULL },
         { gen_helper_sve_ld1bhs_r, NULL, NULL, NULL },
         { gen_helper_sve_ld1dd_be_r, gen_helper_sve_ld2dd_be_r,
-          gen_helper_sve_ld3dd_be_r, gen_helper_sve_ld4dd_be_r } } },
+          gen_helper_sve_ld3dd_be_r, gen_helper_sve_ld4dd_be_r },
+
+        { gen_helper_sve_ld1squ_be_r, NULL, NULL, NULL },
+        { gen_helper_sve_ld1dqu_be_r, NULL, NULL, NULL },
+      },
+    },
 
     { /* mte active, little-endian */
       { { gen_helper_sve_ld1bb_r_mte,
@@ -4964,7 +4977,11 @@ static gen_helper_gvec_mem * const ldr_fns[2][2][16][4] = {
         { gen_helper_sve_ld1dd_le_r_mte,
           gen_helper_sve_ld2dd_le_r_mte,
           gen_helper_sve_ld3dd_le_r_mte,
-          gen_helper_sve_ld4dd_le_r_mte } },
+          gen_helper_sve_ld4dd_le_r_mte },
+
+        { gen_helper_sve_ld1squ_le_r_mte, NULL, NULL, NULL },
+        { gen_helper_sve_ld1dqu_le_r_mte, NULL, NULL, NULL },
+      },
 
       /* mte active, big-endian */
       { { gen_helper_sve_ld1bb_r_mte,
@@ -4997,7 +5014,12 @@ static gen_helper_gvec_mem * const ldr_fns[2][2][16][4] = {
         { gen_helper_sve_ld1dd_be_r_mte,
           gen_helper_sve_ld2dd_be_r_mte,
           gen_helper_sve_ld3dd_be_r_mte,
-          gen_helper_sve_ld4dd_be_r_mte } } },
+          gen_helper_sve_ld4dd_be_r_mte },
+
+        { gen_helper_sve_ld1squ_be_r_mte, NULL, NULL, NULL },
+        { gen_helper_sve_ld1dqu_be_r_mte, NULL, NULL, NULL },
+      },
+    },
 };
 
 static void do_ld_zpa(DisasContext *s, int zt, int pg,
@@ -5016,9 +5038,22 @@ static void do_ld_zpa(DisasContext *s, int zt, int pg,
 
 static bool trans_LD_zprr(DisasContext *s, arg_rprr_load *a)
 {
-    if (a->rm == 31 || !dc_isar_feature(aa64_sve, s)) {
+    if (a->rm == 31) {
         return false;
     }
+
+    /* dtypes 16 and 17 are artificial, representing 128-bit element */
+    if (a->dtype < 16) {
+        if (!dc_isar_feature(aa64_sve, s)) {
+            return false;
+        }
+    } else {
+        if (!dc_isar_feature(aa64_sve2p1, s)) {
+            return false;
+        }
+        s->is_nonstreaming = true;
+    }
+
     if (sve_access_check(s)) {
         TCGv_i64 addr = tcg_temp_new_i64();
         tcg_gen_shli_i64(addr, cpu_reg(s, a->rm), dtype_msz(a->dtype));
@@ -5030,9 +5065,18 @@ static bool trans_LD_zprr(DisasContext *s, arg_rprr_load *a)
 
 static bool trans_LD_zpri(DisasContext *s, arg_rpri_load *a)
 {
-    if (!dc_isar_feature(aa64_sve, s)) {
-        return false;
+    /* dtypes 16 and 17 are artificial, representing 128-bit element */
+    if (a->dtype < 16) {
+        if (!dc_isar_feature(aa64_sve, s)) {
+            return false;
+        }
+    } else {
+        if (!dc_isar_feature(aa64_sve2p1, s)) {
+            return false;
+        }
+        s->is_nonstreaming = true;
     }
+
     if (sve_access_check(s)) {
         int vsz = vec_full_reg_size(s);
         int elements = vsz >> dtype_esz[a->dtype];
@@ -5479,7 +5523,7 @@ static bool trans_LD1R_zpri(DisasContext *s, arg_rpri_load *a)
 static void do_st_zpa(DisasContext *s, int zt, int pg, TCGv_i64 addr,
                       int msz, int esz, int nreg)
 {
-    static gen_helper_gvec_mem * const fn_single[2][2][4][4] = {
+    static gen_helper_gvec_mem * const fn_single[2][2][4][5] = {
         { { { gen_helper_sve_st1bb_r,
               gen_helper_sve_st1bh_r,
               gen_helper_sve_st1bs_r,
@@ -5490,9 +5534,11 @@ static void do_st_zpa(DisasContext *s, int zt, int pg, TCGv_i64 addr,
               gen_helper_sve_st1hd_le_r },
             { NULL, NULL,
               gen_helper_sve_st1ss_le_r,
-              gen_helper_sve_st1sd_le_r },
+              gen_helper_sve_st1sd_le_r,
+              gen_helper_sve_st1sq_le_r, },
             { NULL, NULL, NULL,
-              gen_helper_sve_st1dd_le_r } },
+              gen_helper_sve_st1dd_le_r,
+              gen_helper_sve_st1dq_le_r, } },
           { { gen_helper_sve_st1bb_r,
               gen_helper_sve_st1bh_r,
               gen_helper_sve_st1bs_r,
@@ -5503,9 +5549,11 @@ static void do_st_zpa(DisasContext *s, int zt, int pg, TCGv_i64 addr,
               gen_helper_sve_st1hd_be_r },
             { NULL, NULL,
               gen_helper_sve_st1ss_be_r,
-              gen_helper_sve_st1sd_be_r },
+              gen_helper_sve_st1sd_be_r,
+              gen_helper_sve_st1sq_be_r },
             { NULL, NULL, NULL,
-              gen_helper_sve_st1dd_be_r } } },
+              gen_helper_sve_st1dd_be_r,
+              gen_helper_sve_st1dq_be_r } } },
 
         { { { gen_helper_sve_st1bb_r_mte,
               gen_helper_sve_st1bh_r_mte,
@@ -5517,9 +5565,11 @@ static void do_st_zpa(DisasContext *s, int zt, int pg, TCGv_i64 addr,
               gen_helper_sve_st1hd_le_r_mte },
             { NULL, NULL,
               gen_helper_sve_st1ss_le_r_mte,
-              gen_helper_sve_st1sd_le_r_mte },
+              gen_helper_sve_st1sd_le_r_mte,
+              gen_helper_sve_st1sq_le_r_mte },
             { NULL, NULL, NULL,
-              gen_helper_sve_st1dd_le_r_mte } },
+              gen_helper_sve_st1dd_le_r_mte,
+              gen_helper_sve_st1dq_le_r_mte } },
           { { gen_helper_sve_st1bb_r_mte,
               gen_helper_sve_st1bh_r_mte,
               gen_helper_sve_st1bs_r_mte,
@@ -5530,9 +5580,11 @@ static void do_st_zpa(DisasContext *s, int zt, int pg, TCGv_i64 addr,
               gen_helper_sve_st1hd_be_r_mte },
             { NULL, NULL,
               gen_helper_sve_st1ss_be_r_mte,
-              gen_helper_sve_st1sd_be_r_mte },
+              gen_helper_sve_st1sd_be_r_mte,
+              gen_helper_sve_st1sq_be_r_mte },
             { NULL, NULL, NULL,
-              gen_helper_sve_st1dd_be_r_mte } } },
+              gen_helper_sve_st1dd_be_r_mte,
+              gen_helper_sve_st1dq_be_r_mte } } },
     };
     static gen_helper_gvec_mem * const fn_multiple[2][2][3][4] = {
         { { { gen_helper_sve_st2bb_r,
@@ -5601,12 +5653,27 @@ static void do_st_zpa(DisasContext *s, int zt, int pg, TCGv_i64 addr,
 
 static bool trans_ST_zprr(DisasContext *s, arg_rprr_store *a)
 {
-    if (!dc_isar_feature(aa64_sve, s)) {
-        return false;
-    }
     if (a->rm == 31 || a->msz > a->esz) {
         return false;
     }
+    switch (a->esz) {
+    case MO_8 ... MO_64:
+        if (!dc_isar_feature(aa64_sve, s)) {
+            return false;
+        }
+        break;
+    case MO_128:
+        assert(a->msz < a->esz);
+        assert(a->nreg == 0);
+        if (!dc_isar_feature(aa64_sve2p1, s)) {
+            return false;
+        }
+        s->is_nonstreaming = true;
+        break;
+    default:
+        g_assert_not_reached();
+    }
+
     if (sve_access_check(s)) {
         TCGv_i64 addr = tcg_temp_new_i64();
         tcg_gen_shli_i64(addr, cpu_reg(s, a->rm), a->msz);
@@ -5618,12 +5685,27 @@ static bool trans_ST_zprr(DisasContext *s, arg_rprr_store *a)
 
 static bool trans_ST_zpri(DisasContext *s, arg_rpri_store *a)
 {
-    if (!dc_isar_feature(aa64_sve, s)) {
-        return false;
-    }
     if (a->msz > a->esz) {
         return false;
     }
+    switch (a->esz) {
+    case MO_8 ... MO_64:
+        if (!dc_isar_feature(aa64_sve, s)) {
+            return false;
+        }
+        break;
+    case MO_128:
+        assert(a->msz < a->esz);
+        assert(a->nreg == 0);
+        if (!dc_isar_feature(aa64_sve2p1, s)) {
+            return false;
+        }
+        s->is_nonstreaming = true;
+        break;
+    default:
+        g_assert_not_reached();
+    }
+
     if (sve_access_check(s)) {
         int vsz = vec_full_reg_size(s);
         int elements = vsz >> a->esz;

From 697fe75202f56135b74940ec41deecd3357bda23 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:20:59 -0600
Subject: [PATCH 2043/2760] target/arm: Move ld1qq and st1qq primitives to
 sve_ldst_internal.h

Move from sme_helper.c to the shared header.
Add a comment noting the lack of atomicity.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-97-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/sme_helper.c        | 44 +++------------------
 target/arm/tcg/sve_ldst_internal.h | 63 ++++++++++++++++++++++++++++++
 2 files changed, 69 insertions(+), 38 deletions(-)

diff --git a/target/arm/tcg/sme_helper.c b/target/arm/tcg/sme_helper.c
index c1166e4ffa..df16bb2f9c 100644
--- a/target/arm/tcg/sme_helper.c
+++ b/target/arm/tcg/sme_helper.c
@@ -415,54 +415,22 @@ static inline void sme_##NAME##_v_tlb(CPUARMState *env, void *za,           \
     TLB(env, useronly_clean_ptr(addr), val, ra);                            \
 }
 
-/*
- * The ARMVectorReg elements are stored in host-endian 64-bit units.
- * For 128-bit quantities, the sequence defined by the Elem[] pseudocode
- * corresponds to storing the two 64-bit pieces in little-endian order.
- */
-#define DO_LDQ(HNAME, VNAME, BE, HOST, TLB)                                 \
-static inline void HNAME##_host(void *za, intptr_t off, void *host)         \
-{                                                                           \
-    uint64_t val0 = HOST(host), val1 = HOST(host + 8);                      \
-    uint64_t *ptr = za + off;                                               \
-    ptr[0] = BE ? val1 : val0, ptr[1] = BE ? val0 : val1;                   \
-}                                                                           \
+#define DO_LDQ(HNAME, VNAME) \
 static inline void VNAME##_v_host(void *za, intptr_t off, void *host)       \
 {                                                                           \
     HNAME##_host(za, tile_vslice_offset(off), host);                        \
 }                                                                           \
-static inline void HNAME##_tlb(CPUARMState *env, void *za, intptr_t off,    \
-                               target_ulong addr, uintptr_t ra)             \
-{                                                                           \
-    uint64_t val0 = TLB(env, useronly_clean_ptr(addr), ra);                 \
-    uint64_t val1 = TLB(env, useronly_clean_ptr(addr + 8), ra);             \
-    uint64_t *ptr = za + off;                                               \
-    ptr[0] = BE ? val1 : val0, ptr[1] = BE ? val0 : val1;                   \
-}                                                                           \
 static inline void VNAME##_v_tlb(CPUARMState *env, void *za, intptr_t off,  \
                                target_ulong addr, uintptr_t ra)             \
 {                                                                           \
     HNAME##_tlb(env, za, tile_vslice_offset(off), addr, ra);                \
 }
 
-#define DO_STQ(HNAME, VNAME, BE, HOST, TLB)                                 \
-static inline void HNAME##_host(void *za, intptr_t off, void *host)         \
-{                                                                           \
-    uint64_t *ptr = za + off;                                               \
-    HOST(host, ptr[BE]);                                                    \
-    HOST(host + 8, ptr[!BE]);                                               \
-}                                                                           \
+#define DO_STQ(HNAME, VNAME) \
 static inline void VNAME##_v_host(void *za, intptr_t off, void *host)       \
 {                                                                           \
     HNAME##_host(za, tile_vslice_offset(off), host);                        \
 }                                                                           \
-static inline void HNAME##_tlb(CPUARMState *env, void *za, intptr_t off,    \
-                               target_ulong addr, uintptr_t ra)             \
-{                                                                           \
-    uint64_t *ptr = za + off;                                               \
-    TLB(env, useronly_clean_ptr(addr), ptr[BE], ra);                        \
-    TLB(env, useronly_clean_ptr(addr + 8), ptr[!BE], ra);                   \
-}                                                                           \
 static inline void VNAME##_v_tlb(CPUARMState *env, void *za, intptr_t off,  \
                                target_ulong addr, uintptr_t ra)             \
 {                                                                           \
@@ -477,8 +445,8 @@ DO_LD(ld1s_le, uint32_t, ldl_le_p, cpu_ldl_le_data_ra)
 DO_LD(ld1d_be, uint64_t, ldq_be_p, cpu_ldq_be_data_ra)
 DO_LD(ld1d_le, uint64_t, ldq_le_p, cpu_ldq_le_data_ra)
 
-DO_LDQ(sve_ld1qq_be, sme_ld1q_be, 1, ldq_be_p, cpu_ldq_be_data_ra)
-DO_LDQ(sve_ld1qq_le, sme_ld1q_le, 0, ldq_le_p, cpu_ldq_le_data_ra)
+DO_LDQ(sve_ld1qq_be, sme_ld1q_be)
+DO_LDQ(sve_ld1qq_le, sme_ld1q_le)
 
 DO_ST(st1b, uint8_t, stb_p, cpu_stb_data_ra)
 DO_ST(st1h_be, uint16_t, stw_be_p, cpu_stw_be_data_ra)
@@ -488,8 +456,8 @@ DO_ST(st1s_le, uint32_t, stl_le_p, cpu_stl_le_data_ra)
 DO_ST(st1d_be, uint64_t, stq_be_p, cpu_stq_be_data_ra)
 DO_ST(st1d_le, uint64_t, stq_le_p, cpu_stq_le_data_ra)
 
-DO_STQ(sve_st1qq_be, sme_st1q_be, 1, stq_be_p, cpu_stq_be_data_ra)
-DO_STQ(sve_st1qq_le, sme_st1q_le, 0, stq_le_p, cpu_stq_le_data_ra)
+DO_STQ(sve_st1qq_be, sme_st1q_be)
+DO_STQ(sve_st1qq_le, sme_st1q_le)
 
 #undef DO_LD
 #undef DO_ST
diff --git a/target/arm/tcg/sve_ldst_internal.h b/target/arm/tcg/sve_ldst_internal.h
index e87beba435..c67cda9d3b 100644
--- a/target/arm/tcg/sve_ldst_internal.h
+++ b/target/arm/tcg/sve_ldst_internal.h
@@ -141,6 +141,69 @@ DO_LD_PRIM_3(ld1dqu_le, ld1dd_le)
 #define sve_st1dq_be_tlb   sve_st1dd_be_tlb
 #define sve_st1dq_le_tlb   sve_st1dd_le_tlb
 
+/*
+ * The ARMVectorReg elements are stored in host-endian 64-bit units.
+ * For 128-bit quantities, the sequence defined by the Elem[] pseudocode
+ * corresponds to storing the two 64-bit pieces in little-endian order.
+ */
+/* FIXME: Nothing in this file makes any effort at atomicity. */
+
+static inline void sve_ld1qq_be_host(void *vd, intptr_t reg_off, void *host)
+{
+    sve_ld1dd_be_host(vd, reg_off + 8, host);
+    sve_ld1dd_be_host(vd, reg_off, host + 8);
+}
+
+static inline void sve_ld1qq_le_host(void *vd, intptr_t reg_off, void *host)
+{
+    sve_ld1dd_le_host(vd, reg_off, host);
+    sve_ld1dd_le_host(vd, reg_off + 8, host + 8);
+}
+
+static inline void
+sve_ld1qq_be_tlb(CPUARMState *env, void *vd, intptr_t reg_off,
+                 target_ulong addr, uintptr_t ra)
+{
+    sve_ld1dd_be_tlb(env, vd, reg_off + 8, addr, ra);
+    sve_ld1dd_be_tlb(env, vd, reg_off, addr + 8, ra);
+}
+
+static inline void
+sve_ld1qq_le_tlb(CPUARMState *env, void *vd, intptr_t reg_off,
+                 target_ulong addr, uintptr_t ra)
+{
+    sve_ld1dd_le_tlb(env, vd, reg_off, addr, ra);
+    sve_ld1dd_le_tlb(env, vd, reg_off + 8, addr + 8, ra);
+}
+
+static inline void sve_st1qq_be_host(void *vd, intptr_t reg_off, void *host)
+{
+    sve_st1dd_be_host(vd, reg_off + 8, host);
+    sve_st1dd_be_host(vd, reg_off, host + 8);
+}
+
+static inline void sve_st1qq_le_host(void *vd, intptr_t reg_off, void *host)
+{
+    sve_st1dd_le_host(vd, reg_off, host);
+    sve_st1dd_le_host(vd, reg_off + 8, host + 8);
+}
+
+static inline void
+sve_st1qq_be_tlb(CPUARMState *env, void *vd, intptr_t reg_off,
+                 target_ulong addr, uintptr_t ra)
+{
+    sve_st1dd_be_tlb(env, vd, reg_off + 8, addr, ra);
+    sve_st1dd_be_tlb(env, vd, reg_off, addr + 8, ra);
+}
+
+static inline void
+sve_st1qq_le_tlb(CPUARMState *env, void *vd, intptr_t reg_off,
+                 target_ulong addr, uintptr_t ra)
+{
+    sve_st1dd_le_tlb(env, vd, reg_off, addr, ra);
+    sve_st1dd_le_tlb(env, vd, reg_off + 8, addr + 8, ra);
+}
+
 #undef DO_LD_TLB
 #undef DO_ST_TLB
 #undef DO_LD_HOST

From 0e4ba0607b74c82525dcfc6ed1c4b89bb4cbb39b Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:21:00 -0600
Subject: [PATCH 2044/2760] target/arm: Implement {LD, ST}[234]Q for
 SME2p1/SVE2p1

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-98-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/helper-sve.h    |  32 +++++++++
 target/arm/tcg/sve.decode      |  31 +++++++++
 target/arm/tcg/sve_helper.c    |   8 +++
 target/arm/tcg/translate-sve.c | 116 ++++++++++++++++++++++++---------
 4 files changed, 156 insertions(+), 31 deletions(-)

diff --git a/target/arm/tcg/helper-sve.h b/target/arm/tcg/helper-sve.h
index 1999c4bb1f..ade76ff664 100644
--- a/target/arm/tcg/helper-sve.h
+++ b/target/arm/tcg/helper-sve.h
@@ -1658,6 +1658,14 @@ DEF_HELPER_FLAGS_4(sve_ld2dd_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
 DEF_HELPER_FLAGS_4(sve_ld3dd_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
 DEF_HELPER_FLAGS_4(sve_ld4dd_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
 
+DEF_HELPER_FLAGS_4(sve_ld2qq_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_ld3qq_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_ld4qq_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+
+DEF_HELPER_FLAGS_4(sve_ld2qq_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_ld3qq_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_ld4qq_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+
 DEF_HELPER_FLAGS_4(sve_ld1bhu_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
 DEF_HELPER_FLAGS_4(sve_ld1bsu_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
 DEF_HELPER_FLAGS_4(sve_ld1bdu_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
@@ -1722,6 +1730,14 @@ DEF_HELPER_FLAGS_4(sve_ld2dd_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
 DEF_HELPER_FLAGS_4(sve_ld3dd_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
 DEF_HELPER_FLAGS_4(sve_ld4dd_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
 
+DEF_HELPER_FLAGS_4(sve_ld2qq_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_ld3qq_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_ld4qq_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+
+DEF_HELPER_FLAGS_4(sve_ld2qq_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_ld3qq_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_ld4qq_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+
 DEF_HELPER_FLAGS_4(sve_ld1bhu_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
 DEF_HELPER_FLAGS_4(sve_ld1bsu_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
 DEF_HELPER_FLAGS_4(sve_ld1bdu_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
@@ -1946,6 +1962,14 @@ DEF_HELPER_FLAGS_4(sve_st2dd_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
 DEF_HELPER_FLAGS_4(sve_st3dd_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
 DEF_HELPER_FLAGS_4(sve_st4dd_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
 
+DEF_HELPER_FLAGS_4(sve_st2qq_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_st3qq_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_st4qq_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+
+DEF_HELPER_FLAGS_4(sve_st2qq_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_st3qq_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_st4qq_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+
 DEF_HELPER_FLAGS_4(sve_st1bh_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
 DEF_HELPER_FLAGS_4(sve_st1bs_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
 DEF_HELPER_FLAGS_4(sve_st1bd_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
@@ -1998,6 +2022,14 @@ DEF_HELPER_FLAGS_4(sve_st2dd_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
 DEF_HELPER_FLAGS_4(sve_st3dd_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
 DEF_HELPER_FLAGS_4(sve_st4dd_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
 
+DEF_HELPER_FLAGS_4(sve_st2qq_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_st3qq_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_st4qq_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+
+DEF_HELPER_FLAGS_4(sve_st2qq_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_st3qq_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_st4qq_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+
 DEF_HELPER_FLAGS_4(sve_st1bh_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
 DEF_HELPER_FLAGS_4(sve_st1bs_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
 DEF_HELPER_FLAGS_4(sve_st1bd_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
diff --git a/target/arm/tcg/sve.decode b/target/arm/tcg/sve.decode
index bf33bc305f..3eda029146 100644
--- a/target/arm/tcg/sve.decode
+++ b/target/arm/tcg/sve.decode
@@ -229,6 +229,9 @@
 @rprr_load_dt   ....... dtype:4 rm:5 ... pg:3 rn:5 rd:5         &rprr_load
 @rpri_load_dt   ....... dtype:4 . imm:s4 ... pg:3 rn:5 rd:5     &rpri_load
 
+@rprr_load      ....... .... rm:5 ... pg:3 rn:5 rd:5            &rprr_load
+@rpri_load      ....... .... . imm:s4 ... pg:3 rn:5 rd:5        &rpri_load
+
 @rprr_load_msz  ....... .... rm:5 ... pg:3 rn:5 rd:5 \
                 &rprr_load dtype=%msz_dtype
 @rpri_load_msz  ....... .... . imm:s4 ... pg:3 rn:5 rd:5 \
@@ -1267,12 +1270,26 @@ LDNF1_zpri      1010010 .... 1.... 101 ... ..... .....    @rpri_load_dt nreg=0
 # SVE load multiple structures (scalar plus scalar)
 # LD2B, LD2H, LD2W, LD2D; etc.
 LD_zprr         1010010 .. nreg:2 ..... 110 ... ..... .....     @rprr_load_msz
+# LD[234]Q
+LD_zprr         1010010 01 01     ..... 100 ... ..... ..... \
+                @rprr_load dtype=18 nreg=1
+LD_zprr         1010010 10 01     ..... 100 ... ..... ..... \
+                @rprr_load dtype=18 nreg=2
+LD_zprr         1010010 11 01     ..... 100 ... ..... ..... \
+                @rprr_load dtype=18 nreg=3
 
 # SVE contiguous non-temporal load (scalar plus immediate)
 # LDNT1B, LDNT1H, LDNT1W, LDNT1D
 # SVE load multiple structures (scalar plus immediate)
 # LD2B, LD2H, LD2W, LD2D; etc.
 LD_zpri         1010010 .. nreg:2 0.... 111 ... ..... .....     @rpri_load_msz
+# LD[234]Q
+LD_zpri         1010010 01 001 .... 111 ... ..... .....         \
+                @rpri_load dtype=18 nreg=1
+LD_zpri         1010010 10 001 .... 111 ... ..... .....         \
+                @rpri_load dtype=18 nreg=2
+LD_zpri         1010010 11 001 .... 111 ... ..... .....         \
+                @rpri_load dtype=18 nreg=3
 
 # SVE load and broadcast quadword (scalar plus scalar)
 LD1RQ_zprr      1010010 .. 00 ..... 000 ... ..... ..... \
@@ -1383,11 +1400,25 @@ ST_zprr         1110010 11 10     ..... 010 ... ..... ..... \
 # SVE store multiple structures (scalar plus immediate)      (nreg != 0)
 ST_zpri         1110010 .. nreg:2 1.... 111 ... ..... ..... \
                 @rpri_store msz=%size_23 esz=%size_23
+# ST[234]Q
+ST_zpri         11100100 01 00 .... 000 ... ..... ..... \
+                @rpri_store msz=4 esz=4 nreg=1
+ST_zpri         11100100 10 00 .... 000 ... ..... ..... \
+                @rpri_store msz=4 esz=4 nreg=2
+ST_zpri         11100100 11 00 .... 000 ... ..... ..... \
+                @rpri_store msz=4 esz=4 nreg=3
 
 # SVE contiguous non-temporal store (scalar plus scalar)     (nreg == 0)
 # SVE store multiple structures (scalar plus scalar)         (nreg != 0)
 ST_zprr         1110010 .. nreg:2 ..... 011 ... ..... ..... \
                 @rprr_store msz=%size_23 esz=%size_23
+# ST[234]Q
+ST_zprr         11100100 01 1 ..... 000 ... ..... ..... \
+                @rprr_store msz=4 esz=4 nreg=1
+ST_zprr         11100100 10 1 ..... 000 ... ..... ..... \
+                @rprr_store msz=4 esz=4 nreg=2
+ST_zprr         11100100 11 1 ..... 000 ... ..... ..... \
+                @rprr_store msz=4 esz=4 nreg=3
 
 # SVE 32-bit scatter store (scalar plus 32-bit scaled offsets)
 # Require msz > 0 && msz <= esz.
diff --git a/target/arm/tcg/sve_helper.c b/target/arm/tcg/sve_helper.c
index 91cd5970ee..360114ece2 100644
--- a/target/arm/tcg/sve_helper.c
+++ b/target/arm/tcg/sve_helper.c
@@ -6421,6 +6421,10 @@ DO_LDN_2(2, dd, MO_64)
 DO_LDN_2(3, dd, MO_64)
 DO_LDN_2(4, dd, MO_64)
 
+DO_LDN_2(2, qq, MO_128)
+DO_LDN_2(3, qq, MO_128)
+DO_LDN_2(4, qq, MO_128)
+
 #undef DO_LDN_1
 #undef DO_LDN_2
 
@@ -6987,6 +6991,10 @@ DO_STN_2(4, dd, MO_64, MO_64)
 DO_STN_2(1, sq, MO_128, MO_32)
 DO_STN_2(1, dq, MO_128, MO_64)
 
+DO_STN_2(2, qq, MO_128, MO_128)
+DO_STN_2(3, qq, MO_128, MO_128)
+DO_STN_2(4, qq, MO_128, MO_128)
+
 #undef DO_STN_1
 #undef DO_STN_2
 
diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
index 8e945c5d2d..7dff028569 100644
--- a/target/arm/tcg/translate-sve.c
+++ b/target/arm/tcg/translate-sve.c
@@ -89,7 +89,7 @@ static inline int expand_imm_sh8u(DisasContext *s, int x)
  */
 static inline int msz_dtype(DisasContext *s, int msz)
 {
-    static const uint8_t dtype[4] = { 0, 5, 10, 15 };
+    static const uint8_t dtype[5] = { 0, 5, 10, 15, 18 };
     return dtype[msz];
 }
 
@@ -4886,7 +4886,7 @@ static void do_mem_zpa(DisasContext *s, int zt, int pg, TCGv_i64 addr,
 }
 
 /* Indexed by [mte][be][dtype][nreg] */
-static gen_helper_gvec_mem * const ldr_fns[2][2][18][4] = {
+static gen_helper_gvec_mem * const ldr_fns[2][2][19][4] = {
     { /* mte inactive, little-endian */
       { { gen_helper_sve_ld1bb_r, gen_helper_sve_ld2bb_r,
           gen_helper_sve_ld3bb_r, gen_helper_sve_ld4bb_r },
@@ -4914,6 +4914,8 @@ static gen_helper_gvec_mem * const ldr_fns[2][2][18][4] = {
 
         { gen_helper_sve_ld1squ_le_r, NULL, NULL, NULL },
         { gen_helper_sve_ld1dqu_le_r, NULL, NULL, NULL },
+        { NULL,                      gen_helper_sve_ld2qq_le_r,
+          gen_helper_sve_ld3qq_le_r, gen_helper_sve_ld4qq_le_r },
       },
 
       /* mte inactive, big-endian */
@@ -4943,6 +4945,8 @@ static gen_helper_gvec_mem * const ldr_fns[2][2][18][4] = {
 
         { gen_helper_sve_ld1squ_be_r, NULL, NULL, NULL },
         { gen_helper_sve_ld1dqu_be_r, NULL, NULL, NULL },
+        { NULL,                      gen_helper_sve_ld2qq_be_r,
+          gen_helper_sve_ld3qq_be_r, gen_helper_sve_ld4qq_be_r },
       },
     },
 
@@ -4981,6 +4985,10 @@ static gen_helper_gvec_mem * const ldr_fns[2][2][18][4] = {
 
         { gen_helper_sve_ld1squ_le_r_mte, NULL, NULL, NULL },
         { gen_helper_sve_ld1dqu_le_r_mte, NULL, NULL, NULL },
+        { NULL,
+          gen_helper_sve_ld2qq_le_r_mte,
+          gen_helper_sve_ld3qq_le_r_mte,
+          gen_helper_sve_ld4qq_le_r_mte },
       },
 
       /* mte active, big-endian */
@@ -5018,6 +5026,10 @@ static gen_helper_gvec_mem * const ldr_fns[2][2][18][4] = {
 
         { gen_helper_sve_ld1squ_be_r_mte, NULL, NULL, NULL },
         { gen_helper_sve_ld1dqu_be_r_mte, NULL, NULL, NULL },
+        { NULL,
+          gen_helper_sve_ld2qq_be_r_mte,
+          gen_helper_sve_ld3qq_be_r_mte,
+          gen_helper_sve_ld4qq_be_r_mte },
       },
     },
 };
@@ -5042,16 +5054,26 @@ static bool trans_LD_zprr(DisasContext *s, arg_rprr_load *a)
         return false;
     }
 
-    /* dtypes 16 and 17 are artificial, representing 128-bit element */
-    if (a->dtype < 16) {
+    /* dtypes 16-18 are artificial, representing 128-bit element */
+    switch (a->dtype) {
+    case 0 ... 15:
         if (!dc_isar_feature(aa64_sve, s)) {
             return false;
         }
-    } else {
+        break;
+    case 16: case 17:
         if (!dc_isar_feature(aa64_sve2p1, s)) {
             return false;
         }
         s->is_nonstreaming = true;
+        break;
+    case 18:
+        if (!dc_isar_feature(aa64_sme2p1_or_sve2p1, s)) {
+            return false;
+        }
+        break;
+    default:
+        g_assert_not_reached();
     }
 
     if (sve_access_check(s)) {
@@ -5065,16 +5087,26 @@ static bool trans_LD_zprr(DisasContext *s, arg_rprr_load *a)
 
 static bool trans_LD_zpri(DisasContext *s, arg_rpri_load *a)
 {
-    /* dtypes 16 and 17 are artificial, representing 128-bit element */
-    if (a->dtype < 16) {
+    /* dtypes 16-18 are artificial, representing 128-bit element */
+    switch (a->dtype) {
+    case 0 ... 15:
         if (!dc_isar_feature(aa64_sve, s)) {
             return false;
         }
-    } else {
+        break;
+    case 16: case 17:
         if (!dc_isar_feature(aa64_sve2p1, s)) {
             return false;
         }
         s->is_nonstreaming = true;
+        break;
+    case 18:
+        if (!dc_isar_feature(aa64_sme2p1_or_sve2p1, s)) {
+            return false;
+        }
+        break;
+    default:
+        g_assert_not_reached();
     }
 
     if (sve_access_check(s)) {
@@ -5586,55 +5618,67 @@ static void do_st_zpa(DisasContext *s, int zt, int pg, TCGv_i64 addr,
               gen_helper_sve_st1dd_be_r_mte,
               gen_helper_sve_st1dq_be_r_mte } } },
     };
-    static gen_helper_gvec_mem * const fn_multiple[2][2][3][4] = {
+    static gen_helper_gvec_mem * const fn_multiple[2][2][3][5] = {
         { { { gen_helper_sve_st2bb_r,
               gen_helper_sve_st2hh_le_r,
               gen_helper_sve_st2ss_le_r,
-              gen_helper_sve_st2dd_le_r },
+              gen_helper_sve_st2dd_le_r,
+              gen_helper_sve_st2qq_le_r },
             { gen_helper_sve_st3bb_r,
               gen_helper_sve_st3hh_le_r,
               gen_helper_sve_st3ss_le_r,
-              gen_helper_sve_st3dd_le_r },
+              gen_helper_sve_st3dd_le_r,
+              gen_helper_sve_st3qq_le_r },
             { gen_helper_sve_st4bb_r,
               gen_helper_sve_st4hh_le_r,
               gen_helper_sve_st4ss_le_r,
-              gen_helper_sve_st4dd_le_r } },
+              gen_helper_sve_st4dd_le_r,
+              gen_helper_sve_st4qq_le_r } },
           { { gen_helper_sve_st2bb_r,
               gen_helper_sve_st2hh_be_r,
               gen_helper_sve_st2ss_be_r,
-              gen_helper_sve_st2dd_be_r },
+              gen_helper_sve_st2dd_be_r,
+              gen_helper_sve_st2qq_be_r },
             { gen_helper_sve_st3bb_r,
               gen_helper_sve_st3hh_be_r,
               gen_helper_sve_st3ss_be_r,
-              gen_helper_sve_st3dd_be_r },
+              gen_helper_sve_st3dd_be_r,
+              gen_helper_sve_st3qq_be_r },
             { gen_helper_sve_st4bb_r,
               gen_helper_sve_st4hh_be_r,
               gen_helper_sve_st4ss_be_r,
-              gen_helper_sve_st4dd_be_r } } },
+              gen_helper_sve_st4dd_be_r,
+              gen_helper_sve_st4qq_be_r } } },
         { { { gen_helper_sve_st2bb_r_mte,
               gen_helper_sve_st2hh_le_r_mte,
               gen_helper_sve_st2ss_le_r_mte,
-              gen_helper_sve_st2dd_le_r_mte },
+              gen_helper_sve_st2dd_le_r_mte,
+              gen_helper_sve_st2qq_le_r_mte },
             { gen_helper_sve_st3bb_r_mte,
               gen_helper_sve_st3hh_le_r_mte,
               gen_helper_sve_st3ss_le_r_mte,
-              gen_helper_sve_st3dd_le_r_mte },
+              gen_helper_sve_st3dd_le_r_mte,
+              gen_helper_sve_st3qq_le_r_mte },
             { gen_helper_sve_st4bb_r_mte,
               gen_helper_sve_st4hh_le_r_mte,
               gen_helper_sve_st4ss_le_r_mte,
-              gen_helper_sve_st4dd_le_r_mte } },
+              gen_helper_sve_st4dd_le_r_mte,
+              gen_helper_sve_st4qq_le_r_mte } },
           { { gen_helper_sve_st2bb_r_mte,
               gen_helper_sve_st2hh_be_r_mte,
               gen_helper_sve_st2ss_be_r_mte,
-              gen_helper_sve_st2dd_be_r_mte },
+              gen_helper_sve_st2dd_be_r_mte,
+              gen_helper_sve_st2qq_be_r_mte },
             { gen_helper_sve_st3bb_r_mte,
               gen_helper_sve_st3hh_be_r_mte,
               gen_helper_sve_st3ss_be_r_mte,
-              gen_helper_sve_st3dd_be_r_mte },
+              gen_helper_sve_st3dd_be_r_mte,
+              gen_helper_sve_st3qq_be_r_mte },
             { gen_helper_sve_st4bb_r_mte,
               gen_helper_sve_st4hh_be_r_mte,
               gen_helper_sve_st4ss_be_r_mte,
-              gen_helper_sve_st4dd_be_r_mte } } },
+              gen_helper_sve_st4dd_be_r_mte,
+              gen_helper_sve_st4qq_be_r_mte } } },
     };
     gen_helper_gvec_mem *fn;
     int be = s->be_data == MO_BE;
@@ -5663,12 +5707,17 @@ static bool trans_ST_zprr(DisasContext *s, arg_rprr_store *a)
         }
         break;
     case MO_128:
-        assert(a->msz < a->esz);
-        assert(a->nreg == 0);
-        if (!dc_isar_feature(aa64_sve2p1, s)) {
-            return false;
+        if (a->nreg == 0) {
+            assert(a->msz < a->esz);
+            if (!dc_isar_feature(aa64_sve2p1, s)) {
+                return false;
+            }
+            s->is_nonstreaming = true;
+        } else {
+            if (!dc_isar_feature(aa64_sme2p1_or_sve2p1, s)) {
+                return false;
+            }
         }
-        s->is_nonstreaming = true;
         break;
     default:
         g_assert_not_reached();
@@ -5695,12 +5744,17 @@ static bool trans_ST_zpri(DisasContext *s, arg_rpri_store *a)
         }
         break;
     case MO_128:
-        assert(a->msz < a->esz);
-        assert(a->nreg == 0);
-        if (!dc_isar_feature(aa64_sve2p1, s)) {
-            return false;
+        if (a->nreg == 0) {
+            assert(a->msz < a->esz);
+            if (!dc_isar_feature(aa64_sve2p1, s)) {
+                return false;
+            }
+            s->is_nonstreaming = true;
+        } else {
+            if (!dc_isar_feature(aa64_sme2p1_or_sve2p1, s)) {
+                return false;
+            }
         }
-        s->is_nonstreaming = true;
         break;
     default:
         g_assert_not_reached();

From d2aa9a804ee678f0327bc5c6018a814caa424b77 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:21:01 -0600
Subject: [PATCH 2045/2760] target/arm: Implement LD1Q, ST1Q for SVE2p1

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-99-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/helper-sve.h    | 16 ++++++++++++++++
 target/arm/tcg/sve.decode      |  8 ++++++++
 target/arm/tcg/sve_helper.c    |  6 ++++++
 target/arm/tcg/translate-sve.c | 34 ++++++++++++++++++++++++++++++++--
 4 files changed, 62 insertions(+), 2 deletions(-)

diff --git a/target/arm/tcg/helper-sve.h b/target/arm/tcg/helper-sve.h
index ade76ff664..c36090d13d 100644
--- a/target/arm/tcg/helper-sve.h
+++ b/target/arm/tcg/helper-sve.h
@@ -2155,6 +2155,10 @@ DEF_HELPER_FLAGS_6(sve_ldsds_le_zd, TCG_CALL_NO_WG,
                    void, env, ptr, ptr, ptr, tl, i32)
 DEF_HELPER_FLAGS_6(sve_ldsds_be_zd, TCG_CALL_NO_WG,
                    void, env, ptr, ptr, ptr, tl, i32)
+DEF_HELPER_FLAGS_6(sve_ldqq_le_zd, TCG_CALL_NO_WG,
+                   void, env, ptr, ptr, ptr, tl, i32)
+DEF_HELPER_FLAGS_6(sve_ldqq_be_zd, TCG_CALL_NO_WG,
+                   void, env, ptr, ptr, ptr, tl, i32)
 
 DEF_HELPER_FLAGS_6(sve_ldbsu_zsu_mte, TCG_CALL_NO_WG,
                    void, env, ptr, ptr, ptr, tl, i32)
@@ -2264,6 +2268,10 @@ DEF_HELPER_FLAGS_6(sve_ldsds_le_zd_mte, TCG_CALL_NO_WG,
                    void, env, ptr, ptr, ptr, tl, i32)
 DEF_HELPER_FLAGS_6(sve_ldsds_be_zd_mte, TCG_CALL_NO_WG,
                    void, env, ptr, ptr, ptr, tl, i32)
+DEF_HELPER_FLAGS_6(sve_ldqq_le_zd_mte, TCG_CALL_NO_WG,
+                   void, env, ptr, ptr, ptr, tl, i32)
+DEF_HELPER_FLAGS_6(sve_ldqq_be_zd_mte, TCG_CALL_NO_WG,
+                   void, env, ptr, ptr, ptr, tl, i32)
 
 DEF_HELPER_FLAGS_6(sve_ldffbsu_zsu, TCG_CALL_NO_WG,
                    void, env, ptr, ptr, ptr, tl, i32)
@@ -2549,6 +2557,10 @@ DEF_HELPER_FLAGS_6(sve_stdd_le_zd, TCG_CALL_NO_WG,
                    void, env, ptr, ptr, ptr, tl, i32)
 DEF_HELPER_FLAGS_6(sve_stdd_be_zd, TCG_CALL_NO_WG,
                    void, env, ptr, ptr, ptr, tl, i32)
+DEF_HELPER_FLAGS_6(sve_stqq_le_zd, TCG_CALL_NO_WG,
+                   void, env, ptr, ptr, ptr, tl, i32)
+DEF_HELPER_FLAGS_6(sve_stqq_be_zd, TCG_CALL_NO_WG,
+                   void, env, ptr, ptr, ptr, tl, i32)
 
 DEF_HELPER_FLAGS_6(sve_stbs_zsu_mte, TCG_CALL_NO_WG,
                    void, env, ptr, ptr, ptr, tl, i32)
@@ -2616,6 +2628,10 @@ DEF_HELPER_FLAGS_6(sve_stdd_le_zd_mte, TCG_CALL_NO_WG,
                    void, env, ptr, ptr, ptr, tl, i32)
 DEF_HELPER_FLAGS_6(sve_stdd_be_zd_mte, TCG_CALL_NO_WG,
                    void, env, ptr, ptr, ptr, tl, i32)
+DEF_HELPER_FLAGS_6(sve_stqq_le_zd_mte, TCG_CALL_NO_WG,
+                   void, env, ptr, ptr, ptr, tl, i32)
+DEF_HELPER_FLAGS_6(sve_stqq_be_zd_mte, TCG_CALL_NO_WG,
+                   void, env, ptr, ptr, ptr, tl, i32)
 
 DEF_HELPER_FLAGS_4(sve2_sqdmull_zzz_h, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, i32)
diff --git a/target/arm/tcg/sve.decode b/target/arm/tcg/sve.decode
index 3eda029146..2efd5f57e4 100644
--- a/target/arm/tcg/sve.decode
+++ b/target/arm/tcg/sve.decode
@@ -1340,6 +1340,10 @@ LD1_zprz        1100010 10 1. ..... 1.. ... ..... ..... \
 LD1_zprz        1100010 11 1. ..... 11. ... ..... ..... \
                 @rprr_g_load_sc esz=3 msz=3 u=1
 
+# LD1Q
+LD1_zprz        1100 0100 000 rm:5 101 pg:3 rn:5 rd:5 \
+                &rprr_gather_load u=0 ff=0 xs=2 esz=4 msz=4 scale=0
+
 # SVE 64-bit gather load (vector plus immediate)
 LD1_zpiz        1100010 .. 01 ..... 1.. ... ..... ..... \
                 @rpri_g_load esz=3
@@ -1443,6 +1447,10 @@ ST1_zprz        1110010 .. 01 ..... 101 ... ..... ..... \
 ST1_zprz        1110010 .. 00 ..... 101 ... ..... ..... \
                 @rprr_scatter_store xs=2 esz=3 scale=0
 
+# ST1Q
+ST1_zprz        1110 0100 001 rm:5 001 pg:3 rn:5 rd:5 \
+                &rprr_scatter_store xs=2 msz=4 esz=4 scale=0
+
 # SVE 64-bit scatter store (vector plus immediate)
 ST1_zpiz        1110010 .. 10 ..... 101 ... ..... ..... \
                 @rpri_scatter_store esz=3
diff --git a/target/arm/tcg/sve_helper.c b/target/arm/tcg/sve_helper.c
index 360114ece2..43b872c7fd 100644
--- a/target/arm/tcg/sve_helper.c
+++ b/target/arm/tcg/sve_helper.c
@@ -7211,6 +7211,9 @@ DO_LD1_ZPZ_D(dd_be, zsu, MO_64)
 DO_LD1_ZPZ_D(dd_be, zss, MO_64)
 DO_LD1_ZPZ_D(dd_be, zd, MO_64)
 
+DO_LD1_ZPZ_D(qq_le, zd, MO_128)
+DO_LD1_ZPZ_D(qq_be, zd, MO_128)
+
 #undef DO_LD1_ZPZ_S
 #undef DO_LD1_ZPZ_D
 
@@ -7597,6 +7600,9 @@ DO_ST1_ZPZ_D(sd_be, zd, MO_32)
 DO_ST1_ZPZ_D(dd_le, zd, MO_64)
 DO_ST1_ZPZ_D(dd_be, zd, MO_64)
 
+DO_ST1_ZPZ_D(qq_le, zd, MO_128)
+DO_ST1_ZPZ_D(qq_be, zd, MO_128)
+
 #undef DO_ST1_ZPZ_S
 #undef DO_ST1_ZPZ_D
 
diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
index 7dff028569..7b575734fd 100644
--- a/target/arm/tcg/translate-sve.c
+++ b/target/arm/tcg/translate-sve.c
@@ -6121,13 +6121,23 @@ gather_load_fn64[2][2][2][3][2][4] = {
                   gen_helper_sve_ldffdd_be_zd_mte, } } } } },
 };
 
+static gen_helper_gvec_mem_scatter * const
+gather_load_fn128[2][2] = {
+    { gen_helper_sve_ldqq_le_zd,
+      gen_helper_sve_ldqq_be_zd },
+    { gen_helper_sve_ldqq_le_zd_mte,
+      gen_helper_sve_ldqq_be_zd_mte }
+};
+
 static bool trans_LD1_zprz(DisasContext *s, arg_LD1_zprz *a)
 {
     gen_helper_gvec_mem_scatter *fn = NULL;
     bool be = s->be_data == MO_BE;
     bool mte = s->mte_active[0];
 
-    if (!dc_isar_feature(aa64_sve, s)) {
+    if (a->esz < MO_128
+        ? !dc_isar_feature(aa64_sve, s)
+        : !dc_isar_feature(aa64_sve2p1, s)) {
         return false;
     }
     s->is_nonstreaming = true;
@@ -6142,6 +6152,12 @@ static bool trans_LD1_zprz(DisasContext *s, arg_LD1_zprz *a)
     case MO_64:
         fn = gather_load_fn64[mte][be][a->ff][a->xs][a->u][a->msz];
         break;
+    case MO_128:
+        assert(!a->ff && a->u && a->xs == 2 && a->msz == MO_128);
+        fn = gather_load_fn128[mte][be];
+        break;
+    default:
+        g_assert_not_reached();
     }
     assert(fn != NULL);
 
@@ -6309,6 +6325,14 @@ static gen_helper_gvec_mem_scatter * const scatter_store_fn64[2][2][3][4] = {
                gen_helper_sve_stdd_be_zd_mte, } } },
 };
 
+static gen_helper_gvec_mem_scatter * const
+scatter_store_fn128[2][2] = {
+    { gen_helper_sve_stqq_le_zd,
+      gen_helper_sve_stqq_be_zd },
+    { gen_helper_sve_stqq_le_zd_mte,
+      gen_helper_sve_stqq_be_zd_mte }
+};
+
 static bool trans_ST1_zprz(DisasContext *s, arg_ST1_zprz *a)
 {
     gen_helper_gvec_mem_scatter *fn;
@@ -6318,7 +6342,9 @@ static bool trans_ST1_zprz(DisasContext *s, arg_ST1_zprz *a)
     if (a->esz < a->msz || (a->msz == 0 && a->scale)) {
         return false;
     }
-    if (!dc_isar_feature(aa64_sve, s)) {
+    if (a->esz < MO_128
+        ? !dc_isar_feature(aa64_sve, s)
+        : !dc_isar_feature(aa64_sve2p1, s)) {
         return false;
     }
     s->is_nonstreaming = true;
@@ -6332,6 +6358,10 @@ static bool trans_ST1_zprz(DisasContext *s, arg_ST1_zprz *a)
     case MO_64:
         fn = scatter_store_fn64[mte][be][a->xs][a->msz];
         break;
+    case MO_128:
+        assert(a->xs == 2 && a->msz == MO_128);
+        fn = scatter_store_fn128[mte][be];
+        break;
     default:
         g_assert_not_reached();
     }

From ec2d9709653f5c0c5503f177e5cdf6ba3e8f2627 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:21:02 -0600
Subject: [PATCH 2046/2760] target/arm: Implement MOVAZ for SME2p1

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-100-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/helper-sme.h    |  6 ++++
 target/arm/tcg/sme.decode      | 36 ++++++++++++++++++++
 target/arm/tcg/sme_helper.c    | 60 ++++++++++++++++++++++++++++++++++
 target/arm/tcg/translate-sme.c | 46 +++++++++++++++++++-------
 4 files changed, 137 insertions(+), 11 deletions(-)

diff --git a/target/arm/tcg/helper-sme.h b/target/arm/tcg/helper-sme.h
index 467073ea25..c9961d6b7f 100644
--- a/target/arm/tcg/helper-sme.h
+++ b/target/arm/tcg/helper-sme.h
@@ -42,6 +42,12 @@ DEF_HELPER_FLAGS_3(sme2_mova_zc_s, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 DEF_HELPER_FLAGS_3(sme2_mova_cz_d, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 DEF_HELPER_FLAGS_3(sme2_mova_zc_d, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 
+DEF_HELPER_FLAGS_3(sme2p1_movaz_zc_b, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(sme2p1_movaz_zc_h, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(sme2p1_movaz_zc_s, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(sme2p1_movaz_zc_d, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(sme2p1_movaz_zc_q, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+
 DEF_HELPER_FLAGS_5(sme_ld1b_h, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
 DEF_HELPER_FLAGS_5(sme_ld1b_v, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
 DEF_HELPER_FLAGS_5(sme_ld1b_h_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
diff --git a/target/arm/tcg/sme.decode b/target/arm/tcg/sme.decode
index 0a2ceea8be..f7e4143b7d 100644
--- a/target/arm/tcg/sme.decode
+++ b/target/arm/tcg/sme.decode
@@ -100,6 +100,42 @@ MOVA_za2        11000000 00 00011 00 .. 010 00 off:3 zr:4 0  \
 MOVA_za4        11000000 00 00011 00 .. 011 00 off:3 zr:3 00 \
                 &mova_a rv=%mova_rv
 
+### SME Move and Zero
+
+MOVAZ_za2       11000000 00000110 0 .. 01010 off:3 zr:4 0    \
+                &mova_a rv=%mova_rv
+MOVAZ_za4       11000000 00000110 0 .. 01110 off:3 zr:3 00   \
+                &mova_a rv=%mova_rv
+
+MOVAZ_zt        11000000 00 00001 0 v:1 .. 0001 off:4 zr:5    \
+                &mova_t rs=%mova_rs esz=0 za=0
+MOVAZ_zt        11000000 01 00001 0 v:1 .. 0001 za:1 off:3 zr:5    \
+                &mova_t rs=%mova_rs esz=1
+MOVAZ_zt        11000000 10 00001 0 v:1 .. 0001 za:2 off:2 zr:5    \
+                &mova_t rs=%mova_rs esz=2
+MOVAZ_zt        11000000 11 00001 0 v:1 .. 0001 za:3 off:1 zr:5    \
+                &mova_t rs=%mova_rs esz=3
+MOVAZ_zt        11000000 11 00001 1 v:1 .. 0001 za:4 zr:5    \
+                &mova_t rs=%mova_rs esz=4 off=0
+
+MOVAZ_zt2       11000000 00 00011 0 v:1 .. 00010 off:3 zr:4 0 \
+                &mova_t rs=%mova_rs esz=0 za=0
+MOVAZ_zt2       11000000 01 00011 0 v:1 .. 00010 za:1 off:2 zr:4 0 \
+                &mova_t rs=%mova_rs esz=1
+MOVAZ_zt2       11000000 10 00011 0 v:1 .. 00010 za:2 off:1 zr:4 0 \
+                &mova_t rs=%mova_rs esz=2
+MOVAZ_zt2       11000000 11 00011 0 v:1 .. 00010 za:3 zr:4 0 \
+                &mova_t rs=%mova_rs esz=3 off=0
+
+MOVAZ_zt4       11000000 00 00011 0 v:1 .. 001100 off:2 zr:3 00 \
+                &mova_t rs=%mova_rs esz=0 za=0
+MOVAZ_zt4       11000000 01 00011 0 v:1 .. 001100 za:1 off:1 zr:3 00 \
+                &mova_t rs=%mova_rs esz=1
+MOVAZ_zt4       11000000 10 00011 0 v:1 .. 001100 za:2 zr:3 00 \
+                &mova_t rs=%mova_rs esz=2 off=0
+MOVAZ_zt4       11000000 11 00011 0 v:1 .. 00110 za:3 zr:3 00 \
+                &mova_t rs=%mova_rs esz=3 off=0
+
 ### SME Move into/from ZT0
 
 MOVT_rzt        1100 0000 0100 1100 0 off:3 00 11111 rt:5
diff --git a/target/arm/tcg/sme_helper.c b/target/arm/tcg/sme_helper.c
index df16bb2f9c..424fc006be 100644
--- a/target/arm/tcg/sme_helper.c
+++ b/target/arm/tcg/sme_helper.c
@@ -257,6 +257,66 @@ void HELPER(sme2_mova_zc_d)(void *vdst, void *vsrc, uint32_t desc)
     }
 }
 
+void HELPER(sme2p1_movaz_zc_b)(void *vdst, void *vsrc, uint32_t desc)
+{
+    uint8_t *src = vsrc;
+    uint8_t *dst = vdst;
+    size_t i, n = simd_oprsz(desc);
+
+    for (i = 0; i < n; ++i) {
+        dst[i] = src[tile_vslice_index(i)];
+        src[tile_vslice_index(i)] = 0;
+    }
+}
+
+void HELPER(sme2p1_movaz_zc_h)(void *vdst, void *vsrc, uint32_t desc)
+{
+    uint16_t *src = vsrc;
+    uint16_t *dst = vdst;
+    size_t i, n = simd_oprsz(desc) / 2;
+
+    for (i = 0; i < n; ++i) {
+        dst[i] = src[tile_vslice_index(i)];
+        src[tile_vslice_index(i)] = 0;
+    }
+}
+
+void HELPER(sme2p1_movaz_zc_s)(void *vdst, void *vsrc, uint32_t desc)
+{
+    uint32_t *src = vsrc;
+    uint32_t *dst = vdst;
+    size_t i, n = simd_oprsz(desc) / 4;
+
+    for (i = 0; i < n; ++i) {
+        dst[i] = src[tile_vslice_index(i)];
+        src[tile_vslice_index(i)] = 0;
+    }
+}
+
+void HELPER(sme2p1_movaz_zc_d)(void *vdst, void *vsrc, uint32_t desc)
+{
+    uint64_t *src = vsrc;
+    uint64_t *dst = vdst;
+    size_t i, n = simd_oprsz(desc) / 8;
+
+    for (i = 0; i < n; ++i) {
+        dst[i] = src[tile_vslice_index(i)];
+        src[tile_vslice_index(i)] = 0;
+    }
+}
+
+void HELPER(sme2p1_movaz_zc_q)(void *vdst, void *vsrc, uint32_t desc)
+{
+    Int128 *src = vsrc;
+    Int128 *dst = vdst;
+    size_t i, n = simd_oprsz(desc) / 16;
+
+    for (i = 0; i < n; ++i) {
+        dst[i] = src[tile_vslice_index(i)];
+        memset(&src[tile_vslice_index(i)], 0, 16);
+    }
+}
+
 /*
  * Clear elements in a tile slice comprising len bytes.
  */
diff --git a/target/arm/tcg/translate-sme.c b/target/arm/tcg/translate-sme.c
index 7407597177..9592f6a996 100644
--- a/target/arm/tcg/translate-sme.c
+++ b/target/arm/tcg/translate-sme.c
@@ -247,7 +247,8 @@ static bool do_mova_tile(DisasContext *s, arg_mova_p *a, bool to_vec)
 TRANS_FEAT(MOVA_tz, aa64_sme, do_mova_tile, a, false)
 TRANS_FEAT(MOVA_zt, aa64_sme, do_mova_tile, a, true)
 
-static bool do_mova_tile_n(DisasContext *s, arg_mova_t *a, int n, bool to_vec)
+static bool do_mova_tile_n(DisasContext *s, arg_mova_t *a, int n,
+                           bool to_vec, bool zero)
 {
     static gen_helper_gvec_2 * const cz_fns[] = {
         gen_helper_sme2_mova_cz_b, gen_helper_sme2_mova_cz_h,
@@ -257,6 +258,11 @@ static bool do_mova_tile_n(DisasContext *s, arg_mova_t *a, int n, bool to_vec)
         gen_helper_sme2_mova_zc_b, gen_helper_sme2_mova_zc_h,
         gen_helper_sme2_mova_zc_s, gen_helper_sme2_mova_zc_d,
     };
+    static gen_helper_gvec_2 * const zc_z_fns[] = {
+        gen_helper_sme2p1_movaz_zc_b, gen_helper_sme2p1_movaz_zc_h,
+        gen_helper_sme2p1_movaz_zc_s, gen_helper_sme2p1_movaz_zc_d,
+        gen_helper_sme2p1_movaz_zc_q,
+    };
     TCGv_ptr t_za;
     int svl, bytes_per_op = n << a->esz;
 
@@ -270,6 +276,8 @@ static bool do_mova_tile_n(DisasContext *s, arg_mova_t *a, int n, bool to_vec)
         return true;
     }
 
+    assert(a->esz <= MO_64 + zero);
+
     if (!sme_smza_enabled_check(s)) {
         return true;
     }
@@ -292,7 +300,9 @@ static bool do_mova_tile_n(DisasContext *s, arg_mova_t *a, int n, bool to_vec)
             TCGv_ptr t_zr = vec_full_reg_ptr(s, a->zr * n + i);
             t_za = get_tile_rowcol(s, a->esz, a->rs, a->za,
                                    a->off * n + i, 1, n, a->v);
-            if (to_vec) {
+            if (zero) {
+                zc_z_fns[a->esz](t_zr, t_za, t_desc);
+            } else if (to_vec) {
                 zc_fns[a->esz](t_zr, t_za, t_desc);
             } else {
                 cz_fns[a->esz](t_za, t_zr, t_desc);
@@ -305,6 +315,9 @@ static bool do_mova_tile_n(DisasContext *s, arg_mova_t *a, int n, bool to_vec)
                                    a->off * n + i, 1, n, a->v);
             if (to_vec) {
                 tcg_gen_gvec_mov_var(MO_8, tcg_env, o_zr, t_za, 0, svl, svl);
+                if (zero) {
+                    tcg_gen_gvec_dup_imm_var(MO_8, t_za, 0, svl, svl, 0);
+                }
             } else {
                 tcg_gen_gvec_mov_var(MO_8, t_za, 0, tcg_env, o_zr, svl, svl);
             }
@@ -313,12 +326,17 @@ static bool do_mova_tile_n(DisasContext *s, arg_mova_t *a, int n, bool to_vec)
     return true;
 }
 
-TRANS_FEAT(MOVA_tz2, aa64_sme2, do_mova_tile_n, a, 2, false)
-TRANS_FEAT(MOVA_tz4, aa64_sme2, do_mova_tile_n, a, 4, false)
-TRANS_FEAT(MOVA_zt2, aa64_sme2, do_mova_tile_n, a, 2, true)
-TRANS_FEAT(MOVA_zt4, aa64_sme2, do_mova_tile_n, a, 4, true)
+TRANS_FEAT(MOVA_tz2, aa64_sme2, do_mova_tile_n, a, 2, false, false)
+TRANS_FEAT(MOVA_tz4, aa64_sme2, do_mova_tile_n, a, 4, false, false)
+TRANS_FEAT(MOVA_zt2, aa64_sme2, do_mova_tile_n, a, 2, true, false)
+TRANS_FEAT(MOVA_zt4, aa64_sme2, do_mova_tile_n, a, 4, true, false)
 
-static bool do_mova_array_n(DisasContext *s, arg_mova_a *a, int n, bool to_vec)
+TRANS_FEAT(MOVAZ_zt, aa64_sme2p1, do_mova_tile_n, a, 1, true, true)
+TRANS_FEAT(MOVAZ_zt2, aa64_sme2p1, do_mova_tile_n, a, 2, true, true)
+TRANS_FEAT(MOVAZ_zt4, aa64_sme2p1, do_mova_tile_n, a, 4, true, true)
+
+static bool do_mova_array_n(DisasContext *s, arg_mova_a *a, int n,
+                            bool to_vec, bool zero)
 {
     TCGv_ptr t_za;
     int svl;
@@ -336,6 +354,9 @@ static bool do_mova_array_n(DisasContext *s, arg_mova_a *a, int n, bool to_vec)
 
         if (to_vec) {
             tcg_gen_gvec_mov_var(MO_8, tcg_env, o_zr, t_za, o_za, svl, svl);
+            if (zero) {
+                tcg_gen_gvec_dup_imm_var(MO_8, t_za, o_za, svl, svl, 0);
+            }
         } else {
             tcg_gen_gvec_mov_var(MO_8, t_za, o_za, tcg_env, o_zr, svl, svl);
         }
@@ -343,10 +364,13 @@ static bool do_mova_array_n(DisasContext *s, arg_mova_a *a, int n, bool to_vec)
     return true;
 }
 
-TRANS_FEAT(MOVA_az2, aa64_sme2, do_mova_array_n, a, 2, false)
-TRANS_FEAT(MOVA_az4, aa64_sme2, do_mova_array_n, a, 4, false)
-TRANS_FEAT(MOVA_za2, aa64_sme2, do_mova_array_n, a, 2, true)
-TRANS_FEAT(MOVA_za4, aa64_sme2, do_mova_array_n, a, 4, true)
+TRANS_FEAT(MOVA_az2, aa64_sme2, do_mova_array_n, a, 2, false, false)
+TRANS_FEAT(MOVA_az4, aa64_sme2, do_mova_array_n, a, 4, false, false)
+TRANS_FEAT(MOVA_za2, aa64_sme2, do_mova_array_n, a, 2, true, false)
+TRANS_FEAT(MOVA_za4, aa64_sme2, do_mova_array_n, a, 4, true, false)
+
+TRANS_FEAT(MOVAZ_za2, aa64_sme2p1, do_mova_array_n, a, 2, true, true)
+TRANS_FEAT(MOVAZ_za4, aa64_sme2p1, do_mova_array_n, a, 4, true, true)
 
 static bool do_movt(DisasContext *s, arg_MOVT_rzt *a,
                     void (*func)(TCGv_i64, TCGv_ptr, tcg_target_long))

From a19b104f849a0ab6f781755f76e567960629a69c Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:21:03 -0600
Subject: [PATCH 2047/2760] target/arm: Implement LUTI2, LUTI4 for SME2/SME2p1

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-101-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/helper.h        | 24 ++++++++++
 target/arm/tcg/sme.decode      | 42 ++++++++++++++++
 target/arm/tcg/translate-sme.c | 56 ++++++++++++++++++++++
 target/arm/tcg/vec_helper.c    | 88 ++++++++++++++++++++++++++++++++++
 4 files changed, 210 insertions(+)

diff --git a/target/arm/tcg/helper.h b/target/arm/tcg/helper.h
index 392bf7b9b5..d9565c8069 100644
--- a/target/arm/tcg/helper.h
+++ b/target/arm/tcg/helper.h
@@ -1188,3 +1188,27 @@ DEF_HELPER_FLAGS_4(gvec_uminp_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 
 DEF_HELPER_FLAGS_3(gvec_urecpe_s, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 DEF_HELPER_FLAGS_3(gvec_ursqrte_s, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(sme2_luti2_1b, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(sme2_luti2_1h, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(sme2_luti2_1s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+
+DEF_HELPER_FLAGS_4(sme2_luti2_2b, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(sme2_luti2_2h, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(sme2_luti2_2s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+
+DEF_HELPER_FLAGS_4(sme2_luti2_4b, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(sme2_luti2_4h, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(sme2_luti2_4s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+
+DEF_HELPER_FLAGS_4(sme2_luti4_1b, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(sme2_luti4_1h, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(sme2_luti4_1s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+
+DEF_HELPER_FLAGS_4(sme2_luti4_2b, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(sme2_luti4_2h, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(sme2_luti4_2s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+
+DEF_HELPER_FLAGS_4(sme2_luti4_4b, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(sme2_luti4_4h, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_4(sme2_luti4_4s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
diff --git a/target/arm/tcg/sme.decode b/target/arm/tcg/sme.decode
index f7e4143b7d..5a5b8ff8a5 100644
--- a/target/arm/tcg/sme.decode
+++ b/target/arm/tcg/sme.decode
@@ -945,3 +945,45 @@ ZERO_za         11000000 000011 110 .. 0000000000 00.   \
                 &zero_za ngrp=2 nvec=4 rv=%mova_rv off=%off1_x4
 ZERO_za         11000000 000011 111 .. 0000000000 00.   \
                 &zero_za ngrp=4 nvec=4 rv=%mova_rv off=%off1_x4
+
+### SME Lookup Table Read
+
+&lut            zd zn idx
+
+# LUTI2, consecutive
+LUTI2_c_1b      1100 0000 1100 11 idx:4    00 00 zn:5 zd:5      &lut
+LUTI2_c_1h      1100 0000 1100 11 idx:4    01 00 zn:5 zd:5      &lut
+LUTI2_c_1s      1100 0000 1100 11 idx:4    10 00 zn:5 zd:5      &lut
+
+LUTI2_c_2b      1100 0000 1000 11 idx:3  1 00 00 zn:5 .... 0    &lut zd=%zd_ax2
+LUTI2_c_2h      1100 0000 1000 11 idx:3  1 01 00 zn:5 .... 0    &lut zd=%zd_ax2
+LUTI2_c_2s      1100 0000 1000 11 idx:3  1 10 00 zn:5 .... 0    &lut zd=%zd_ax2
+
+LUTI2_c_4b      1100 0000 1000 11 idx:2 10 00 00 zn:5 ... 00    &lut zd=%zd_ax4
+LUTI2_c_4h      1100 0000 1000 11 idx:2 10 01 00 zn:5 ... 00    &lut zd=%zd_ax4
+LUTI2_c_4s      1100 0000 1000 11 idx:2 10 10 00 zn:5 ... 00    &lut zd=%zd_ax4
+
+# LUTI2, strided (must check zd alignment)
+LUTI2_s_2b      1100 0000 1001 11 idx:3  1 00 00 zn:5 zd:5      &lut
+LUTI2_s_2h      1100 0000 1001 11 idx:3  1 01 00 zn:5 zd:5      &lut
+
+LUTI2_s_4b      1100 0000 1001 11 idx:2 10 00 00 zn:5 zd:5      &lut
+LUTI2_s_4h      1100 0000 1001 11 idx:2 10 01 00 zn:5 zd:5      &lut
+
+# LUTI4, consecutive
+LUTI4_c_1b      1100 0000 1100 101 idx:3    00 00 zn:5 zd:5     &lut
+LUTI4_c_1h      1100 0000 1100 101 idx:3    01 00 zn:5 zd:5     &lut
+LUTI4_c_1s      1100 0000 1100 101 idx:3    10 00 zn:5 zd:5     &lut
+
+LUTI4_c_2b      1100 0000 1000 101 idx:2  1 00 00 zn:5 .... 0   &lut zd=%zd_ax2
+LUTI4_c_2h      1100 0000 1000 101 idx:2  1 01 00 zn:5 .... 0   &lut zd=%zd_ax2
+LUTI4_c_2s      1100 0000 1000 101 idx:2  1 10 00 zn:5 .... 0   &lut zd=%zd_ax2
+
+LUTI4_c_4h      1100 0000 1000 101 idx:1 10 01 00 zn:5 ... 00   &lut zd=%zd_ax4
+LUTI4_c_4s      1100 0000 1000 101 idx:1 10 10 00 zn:5 ... 00   &lut zd=%zd_ax4
+
+# LUTI4, strided (must check zd alignment)
+LUTI4_s_2b      1100 0000 1001 101 idx:2  1 00 00 zn:5 zd:5     &lut
+LUTI4_s_2h      1100 0000 1001 101 idx:2  1 01 00 zn:5 zd:5     &lut
+
+LUTI4_s_4h      1100 0000 1001 101 idx:1 10 01 00 zn:5 zd:5     &lut
diff --git a/target/arm/tcg/translate-sme.c b/target/arm/tcg/translate-sme.c
index 9592f6a996..d38b8a5ca2 100644
--- a/target/arm/tcg/translate-sme.c
+++ b/target/arm/tcg/translate-sme.c
@@ -1697,3 +1697,59 @@ static bool trans_SEL(DisasContext *s, arg_SEL *a)
     }
     return true;
 }
+
+static bool do_lut(DisasContext *s, arg_lut *a,
+                   gen_helper_gvec_2_ptr *fn, bool strided)
+{
+    if (sme_sm_enabled_check(s) && sme2_zt0_enabled_check(s)) {
+        int svl = streaming_vec_reg_size(s);
+        tcg_gen_gvec_2_ptr(vec_full_reg_offset(s, a->zd),
+                           vec_full_reg_offset(s, a->zn),
+                           tcg_env, svl, svl, strided | (a->idx << 1), fn);
+    }
+    return true;
+}
+
+TRANS_FEAT(LUTI2_c_1b, aa64_sme2, do_lut, a, gen_helper_sme2_luti2_1b, false)
+TRANS_FEAT(LUTI2_c_1h, aa64_sme2, do_lut, a, gen_helper_sme2_luti2_1h, false)
+TRANS_FEAT(LUTI2_c_1s, aa64_sme2, do_lut, a, gen_helper_sme2_luti2_1s, false)
+
+TRANS_FEAT(LUTI2_c_2b, aa64_sme2, do_lut, a, gen_helper_sme2_luti2_2b, false)
+TRANS_FEAT(LUTI2_c_2h, aa64_sme2, do_lut, a, gen_helper_sme2_luti2_2h, false)
+TRANS_FEAT(LUTI2_c_2s, aa64_sme2, do_lut, a, gen_helper_sme2_luti2_2s, false)
+
+TRANS_FEAT(LUTI2_c_4b, aa64_sme2, do_lut, a, gen_helper_sme2_luti2_4b, false)
+TRANS_FEAT(LUTI2_c_4h, aa64_sme2, do_lut, a, gen_helper_sme2_luti2_4h, false)
+TRANS_FEAT(LUTI2_c_4s, aa64_sme2, do_lut, a, gen_helper_sme2_luti2_4s, false)
+
+TRANS_FEAT(LUTI4_c_1b, aa64_sme2, do_lut, a, gen_helper_sme2_luti4_1b, false)
+TRANS_FEAT(LUTI4_c_1h, aa64_sme2, do_lut, a, gen_helper_sme2_luti4_1h, false)
+TRANS_FEAT(LUTI4_c_1s, aa64_sme2, do_lut, a, gen_helper_sme2_luti4_1s, false)
+
+TRANS_FEAT(LUTI4_c_2b, aa64_sme2, do_lut, a, gen_helper_sme2_luti4_2b, false)
+TRANS_FEAT(LUTI4_c_2h, aa64_sme2, do_lut, a, gen_helper_sme2_luti4_2h, false)
+TRANS_FEAT(LUTI4_c_2s, aa64_sme2, do_lut, a, gen_helper_sme2_luti4_2s, false)
+
+TRANS_FEAT(LUTI4_c_4h, aa64_sme2, do_lut, a, gen_helper_sme2_luti4_4h, false)
+TRANS_FEAT(LUTI4_c_4s, aa64_sme2, do_lut, a, gen_helper_sme2_luti4_4s, false)
+
+static bool do_lut_s4(DisasContext *s, arg_lut *a, gen_helper_gvec_2_ptr *fn)
+{
+    return !(a->zd & 0b01100) && do_lut(s, a, fn, true);
+}
+
+static bool do_lut_s8(DisasContext *s, arg_lut *a, gen_helper_gvec_2_ptr *fn)
+{
+    return !(a->zd & 0b01000) && do_lut(s, a, fn, true);
+}
+
+TRANS_FEAT(LUTI2_s_2b, aa64_sme2p1, do_lut_s8, a, gen_helper_sme2_luti2_2b)
+TRANS_FEAT(LUTI2_s_2h, aa64_sme2p1, do_lut_s8, a, gen_helper_sme2_luti2_2h)
+
+TRANS_FEAT(LUTI2_s_4b, aa64_sme2p1, do_lut_s4, a, gen_helper_sme2_luti2_4b)
+TRANS_FEAT(LUTI2_s_4h, aa64_sme2p1, do_lut_s4, a, gen_helper_sme2_luti2_4h)
+
+TRANS_FEAT(LUTI4_s_2b, aa64_sme2p1, do_lut_s8, a, gen_helper_sme2_luti4_2b)
+TRANS_FEAT(LUTI4_s_2h, aa64_sme2p1, do_lut_s8, a, gen_helper_sme2_luti4_2h)
+
+TRANS_FEAT(LUTI4_s_4h, aa64_sme2p1, do_lut_s4, a, gen_helper_sme2_luti4_4h)
diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
index d4ee6f4d29..0603db0909 100644
--- a/target/arm/tcg/vec_helper.c
+++ b/target/arm/tcg/vec_helper.c
@@ -3443,3 +3443,91 @@ void HELPER(gvec_ursqrte_s)(void *vd, void *vn, uint32_t desc)
     }
     clear_tail(d, opr_sz, simd_maxsz(desc));
 }
+
+static inline void do_lut_b(void *zd, uint64_t *indexes, uint64_t *table,
+                            unsigned elements, unsigned segbase,
+                            unsigned dstride, unsigned isize,
+                            unsigned tsize, unsigned nreg)
+{
+    for (unsigned r = 0; r < nreg; ++r) {
+        uint8_t *dst = zd + dstride * r;
+        unsigned base = segbase + r * elements;
+
+        for (unsigned e = 0; e < elements; ++e) {
+            unsigned index = extractn(indexes, (base + e) * isize, isize);
+            dst[H1(e)] = extractn(table, index * tsize, 8);
+        }
+    }
+}
+
+static inline void do_lut_h(void *zd, uint64_t *indexes, uint64_t *table,
+                            unsigned elements, unsigned segbase,
+                            unsigned dstride, unsigned isize,
+                            unsigned tsize, unsigned nreg)
+{
+    for (unsigned r = 0; r < nreg; ++r) {
+        uint16_t *dst = zd + dstride * r;
+        unsigned base = segbase + r * elements;
+
+        for (unsigned e = 0; e < elements; ++e) {
+            unsigned index = extractn(indexes, (base + e) * isize, isize);
+            dst[H2(e)] = extractn(table, index * tsize, 16);
+        }
+    }
+}
+
+static inline void do_lut_s(void *zd, uint64_t *indexes, uint32_t *table,
+                            unsigned elements, unsigned segbase,
+                            unsigned dstride, unsigned isize,
+                            unsigned tsize, unsigned nreg)
+{
+    for (unsigned r = 0; r < nreg; ++r) {
+        uint32_t *dst = zd + dstride * r;
+        unsigned base = segbase + r * elements;
+
+        for (unsigned e = 0; e < elements; ++e) {
+            unsigned index = extractn(indexes, (base + e) * isize, isize);
+            dst[H4(e)] = table[H4(index)];
+        }
+    }
+}
+
+#define DO_SME2_LUT(ISIZE, NREG, SUFF, ESIZE) \
+void helper_sme2_luti##ISIZE##_##NREG##SUFF                             \
+    (void *zd, void *zn, CPUARMState *env, uint32_t desc)               \
+{                                                                       \
+    unsigned vl = simd_oprsz(desc);                                     \
+    unsigned strided = extract32(desc, SIMD_DATA_SHIFT, 1);             \
+    unsigned idx = extract32(desc, SIMD_DATA_SHIFT + 1, 4);             \
+    unsigned elements = vl / ESIZE;                                     \
+    unsigned dstride = (!strided ? 1 : NREG == 4 ? 4 : 8);              \
+    unsigned segments = (ESIZE * 8) / (ISIZE * NREG);                   \
+    unsigned segment = idx & (segments - 1);                            \
+    ARMVectorReg indexes;                                               \
+    memcpy(&indexes, zn, vl);                                           \
+    do_lut_##SUFF(zd, indexes.d, (void *)env->za_state.zt0, elements,   \
+                  segment * NREG * elements,                            \
+                  dstride * sizeof(ARMVectorReg), ISIZE, 32, NREG);     \
+}
+
+DO_SME2_LUT(2,1,b, 1)
+DO_SME2_LUT(2,1,h, 2)
+DO_SME2_LUT(2,1,s, 4)
+DO_SME2_LUT(2,2,b, 1)
+DO_SME2_LUT(2,2,h, 2)
+DO_SME2_LUT(2,2,s, 4)
+DO_SME2_LUT(2,4,b, 1)
+DO_SME2_LUT(2,4,h, 2)
+DO_SME2_LUT(2,4,s, 4)
+
+DO_SME2_LUT(4,1,b, 1)
+DO_SME2_LUT(4,1,h, 2)
+DO_SME2_LUT(4,1,s, 4)
+DO_SME2_LUT(4,2,b, 1)
+DO_SME2_LUT(4,2,h, 2)
+DO_SME2_LUT(4,2,s, 4)
+DO_SME2_LUT(4,4,b, 1)
+DO_SME2_LUT(4,4,h, 2)
+DO_SME2_LUT(4,4,s, 4)
+
+#undef DO_SME2_LUT

From 960bf1a032d1edbff6b1f2ea716e6e8d539e3468 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Fri, 4 Jul 2025 08:21:04 -0600
Subject: [PATCH 2048/2760] target/arm: Rename FMOPA_h to FMOPA_w_h

The pattern we currently have as FMOPA_h is the "widening" insn
that takes fp16 inputs and produces single-precision outputs.
This is unlike FMOPA_s and FMOPA_d, which are non-widening
produce outputs the same size as their inputs.

SME2 introduces a non-widening fp16 FMOPA operation; rename
FMOPA_h to FMOPA_w_h (for 'widening'), so we can use FMOPA_h
for the non-widening version, giving it a name in line with
the other non-widening ops FMOPA_s and FMOPA_d.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-102-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/helper-sme.h    | 2 +-
 target/arm/tcg/sme.decode      | 2 +-
 target/arm/tcg/sme_helper.c    | 4 ++--
 target/arm/tcg/translate-sme.c | 4 ++--
 4 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/target/arm/tcg/helper-sme.h b/target/arm/tcg/helper-sme.h
index c9961d6b7f..67d620e456 100644
--- a/target/arm/tcg/helper-sme.h
+++ b/target/arm/tcg/helper-sme.h
@@ -135,7 +135,7 @@ DEF_HELPER_FLAGS_5(sme_addva_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_5(sme_addha_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_5(sme_addva_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
 
-DEF_HELPER_FLAGS_7(sme_fmopa_h, TCG_CALL_NO_RWG,
+DEF_HELPER_FLAGS_7(sme_fmopa_w_h, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, ptr, env, i32)
 DEF_HELPER_FLAGS_7(sme_fmopa_s, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, ptr, fpst, i32)
diff --git a/target/arm/tcg/sme.decode b/target/arm/tcg/sme.decode
index 5a5b8ff8a5..77744eef4f 100644
--- a/target/arm/tcg/sme.decode
+++ b/target/arm/tcg/sme.decode
@@ -190,7 +190,7 @@ FMOPA_s         10000000 100 ..... ... ... ..... . 00 ..        @op_32
 FMOPA_d         10000000 110 ..... ... ... ..... . 0 ...        @op_64
 
 BFMOPA          10000001 100 ..... ... ... ..... . 00 ..        @op_32
-FMOPA_h         10000001 101 ..... ... ... ..... . 00 ..        @op_32
+FMOPA_w_h       10000001 101 ..... ... ... ..... . 00 ..        @op_32
 
 SMOPA_s         1010000 0 10 0 ..... ... ... ..... . 00 ..      @op_32
 SUMOPA_s        1010000 0 10 1 ..... ... ... ..... . 00 ..      @op_32
diff --git a/target/arm/tcg/sme_helper.c b/target/arm/tcg/sme_helper.c
index 424fc006be..1575a2f20c 100644
--- a/target/arm/tcg/sme_helper.c
+++ b/target/arm/tcg/sme_helper.c
@@ -1146,8 +1146,8 @@ static float32 f16_dotadd(float32 sum, uint32_t e1, uint32_t e2,
     return float32_add(sum, t32, s_std);
 }
 
-void HELPER(sme_fmopa_h)(void *vza, void *vzn, void *vzm, void *vpn,
-                         void *vpm, CPUARMState *env, uint32_t desc)
+void HELPER(sme_fmopa_w_h)(void *vza, void *vzn, void *vzm, void *vpn,
+                           void *vpm, CPUARMState *env, uint32_t desc)
 {
     intptr_t row, col, oprsz = simd_maxsz(desc);
     uint32_t neg = simd_data(desc) * 0x80008000u;
diff --git a/target/arm/tcg/translate-sme.c b/target/arm/tcg/translate-sme.c
index d38b8a5ca2..1167aa4964 100644
--- a/target/arm/tcg/translate-sme.c
+++ b/target/arm/tcg/translate-sme.c
@@ -565,8 +565,8 @@ static bool do_outprod_env(DisasContext *s, arg_op *a, MemOp esz,
     return true;
 }
 
-TRANS_FEAT(FMOPA_h, aa64_sme, do_outprod_env, a,
-           MO_32, gen_helper_sme_fmopa_h)
+TRANS_FEAT(FMOPA_w_h, aa64_sme, do_outprod_env, a,
+           MO_32, gen_helper_sme_fmopa_w_h)
 TRANS_FEAT(FMOPA_s, aa64_sme, do_outprod_fpst, a,
            MO_32, FPST_ZA, gen_helper_sme_fmopa_s)
 TRANS_FEAT(FMOPA_d, aa64_sme_f64f64, do_outprod_fpst, a,

From 99548ad2475435bd73dc6dfb008475c1b670fe2a Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Fri, 4 Jul 2025 08:21:05 -0600
Subject: [PATCH 2049/2760] target/arm: Rename BFMOPA to BFMOPA_w

Our current BFMOPA opcode pattern is the widening version
of the insn. Rename it to BFMOPA_w, to make way for
the non-widening version added in SME2.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-103-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/helper-sme.h    | 2 +-
 target/arm/tcg/sme.decode      | 2 +-
 target/arm/tcg/sme_helper.c    | 4 ++--
 target/arm/tcg/translate-sme.c | 2 +-
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/target/arm/tcg/helper-sme.h b/target/arm/tcg/helper-sme.h
index 67d620e456..16083660e2 100644
--- a/target/arm/tcg/helper-sme.h
+++ b/target/arm/tcg/helper-sme.h
@@ -141,7 +141,7 @@ DEF_HELPER_FLAGS_7(sme_fmopa_s, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_7(sme_fmopa_d, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, ptr, fpst, i32)
-DEF_HELPER_FLAGS_7(sme_bfmopa, TCG_CALL_NO_RWG,
+DEF_HELPER_FLAGS_7(sme_bfmopa_w, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, ptr, env, i32)
 DEF_HELPER_FLAGS_6(sme_smopa_s, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, ptr, i32)
diff --git a/target/arm/tcg/sme.decode b/target/arm/tcg/sme.decode
index 77744eef4f..8ad86f707e 100644
--- a/target/arm/tcg/sme.decode
+++ b/target/arm/tcg/sme.decode
@@ -189,7 +189,7 @@ ADDVA_d         11000000 11 01000 1 ... ... ..... 00 ...        @adda_64
 FMOPA_s         10000000 100 ..... ... ... ..... . 00 ..        @op_32
 FMOPA_d         10000000 110 ..... ... ... ..... . 0 ...        @op_64
 
-BFMOPA          10000001 100 ..... ... ... ..... . 00 ..        @op_32
+BFMOPA_w        10000001 100 ..... ... ... ..... . 00 ..        @op_32
 FMOPA_w_h       10000001 101 ..... ... ... ..... . 00 ..        @op_32
 
 SMOPA_s         1010000 0 10 0 ..... ... ... ..... . 00 ..      @op_32
diff --git a/target/arm/tcg/sme_helper.c b/target/arm/tcg/sme_helper.c
index 1575a2f20c..4772c97deb 100644
--- a/target/arm/tcg/sme_helper.c
+++ b/target/arm/tcg/sme_helper.c
@@ -1261,8 +1261,8 @@ void HELPER(sme2_fvdot_idx_h)(void *vd, void *vn, void *vm, void *va,
     }
 }
 
-void HELPER(sme_bfmopa)(void *vza, void *vzn, void *vzm,
-                        void *vpn, void *vpm, CPUARMState *env, uint32_t desc)
+void HELPER(sme_bfmopa_w)(void *vza, void *vzn, void *vzm,
+                          void *vpn, void *vpm, CPUARMState *env, uint32_t desc)
 {
     intptr_t row, col, oprsz = simd_maxsz(desc);
     uint32_t neg = simd_data(desc) * 0x80008000u;
diff --git a/target/arm/tcg/translate-sme.c b/target/arm/tcg/translate-sme.c
index 1167aa4964..38d0231b0a 100644
--- a/target/arm/tcg/translate-sme.c
+++ b/target/arm/tcg/translate-sme.c
@@ -572,7 +572,7 @@ TRANS_FEAT(FMOPA_s, aa64_sme, do_outprod_fpst, a,
 TRANS_FEAT(FMOPA_d, aa64_sme_f64f64, do_outprod_fpst, a,
            MO_64, FPST_ZA, gen_helper_sme_fmopa_d)
 
-TRANS_FEAT(BFMOPA, aa64_sme, do_outprod_env, a, MO_32, gen_helper_sme_bfmopa)
+TRANS_FEAT(BFMOPA_w, aa64_sme, do_outprod_env, a, MO_32, gen_helper_sme_bfmopa_w)
 
 TRANS_FEAT(SMOPA_s, aa64_sme, do_outprod, a, MO_32, gen_helper_sme_smopa_s)
 TRANS_FEAT(UMOPA_s, aa64_sme, do_outprod, a, MO_32, gen_helper_sme_umopa_s)

From eba6a6f88279f00525bc9f35d758ba0f163fc9f8 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:21:06 -0600
Subject: [PATCH 2050/2760] target/arm: Support FPCR.AH in SME FMOPS, BFMOPS

For non-widening, we can use float_muladd_negate_product,
For widening, which uses dot-product, we need to handle
the negation explicitly.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-104-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/helper-sme.h    |  19 +++++
 target/arm/tcg/sme_helper.c    | 141 +++++++++++++++++++++++++++------
 target/arm/tcg/translate-sme.c |  27 ++++---
 target/arm/tcg/vec_internal.h  |   5 ++
 4 files changed, 160 insertions(+), 32 deletions(-)

diff --git a/target/arm/tcg/helper-sme.h b/target/arm/tcg/helper-sme.h
index 16083660e2..2b22c6aee5 100644
--- a/target/arm/tcg/helper-sme.h
+++ b/target/arm/tcg/helper-sme.h
@@ -143,6 +143,25 @@ DEF_HELPER_FLAGS_7(sme_fmopa_d, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_7(sme_bfmopa_w, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, ptr, env, i32)
+
+DEF_HELPER_FLAGS_7(sme_fmops_w_h, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_7(sme_fmops_s, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_7(sme_fmops_d, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_7(sme_bfmops_w, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, ptr, env, i32)
+
+DEF_HELPER_FLAGS_7(sme_ah_fmops_w_h, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_7(sme_ah_fmops_s, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_7(sme_ah_fmops_d, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_7(sme_ah_bfmops_w, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, ptr, env, i32)
+
 DEF_HELPER_FLAGS_6(sme_smopa_s, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_6(sme_umopa_s, TCG_CALL_NO_RWG,
diff --git a/target/arm/tcg/sme_helper.c b/target/arm/tcg/sme_helper.c
index 4772c97deb..eff0ce7480 100644
--- a/target/arm/tcg/sme_helper.c
+++ b/target/arm/tcg/sme_helper.c
@@ -1002,19 +1002,18 @@ void HELPER(sme_addva_d)(void *vzda, void *vzn, void *vpn,
     }
 }
 
-void HELPER(sme_fmopa_s)(void *vza, void *vzn, void *vzm, void *vpn,
-                         void *vpm, float_status *fpst, uint32_t desc)
+static void do_fmopa_s(void *vza, void *vzn, void *vzm, uint16_t *pn,
+                       uint16_t *pm, float_status *fpst, uint32_t desc,
+                       uint32_t negx, int negf)
 {
     intptr_t row, col, oprsz = simd_maxsz(desc);
-    uint32_t neg = simd_data(desc) << 31;
-    uint16_t *pn = vpn, *pm = vpm;
 
     for (row = 0; row < oprsz; ) {
         uint16_t pa = pn[H2(row >> 4)];
         do {
             if (pa & 1) {
                 void *vza_row = vza + tile_vslice_offset(row);
-                uint32_t n = *(uint32_t *)(vzn + H1_4(row)) ^ neg;
+                uint32_t n = *(uint32_t *)(vzn + H1_4(row)) ^ negx;
 
                 for (col = 0; col < oprsz; ) {
                     uint16_t pb = pm[H2(col >> 4)];
@@ -1022,7 +1021,7 @@ void HELPER(sme_fmopa_s)(void *vza, void *vzn, void *vzm, void *vpn,
                         if (pb & 1) {
                             uint32_t *a = vza_row + H1_4(col);
                             uint32_t *m = vzm + H1_4(col);
-                            *a = float32_muladd(n, *m, *a, 0, fpst);
+                            *a = float32_muladd(n, *m, *a, negf, fpst);
                         }
                         col += 4;
                         pb >>= 4;
@@ -1035,29 +1034,65 @@ void HELPER(sme_fmopa_s)(void *vza, void *vzn, void *vzm, void *vpn,
     }
 }
 
-void HELPER(sme_fmopa_d)(void *vza, void *vzn, void *vzm, void *vpn,
+void HELPER(sme_fmopa_s)(void *vza, void *vzn, void *vzm, void *vpn,
                          void *vpm, float_status *fpst, uint32_t desc)
+{
+    do_fmopa_s(vza, vzn, vzm, vpn, vpm, fpst, desc, 0, 0);
+}
+
+void HELPER(sme_fmops_s)(void *vza, void *vzn, void *vzm, void *vpn,
+                         void *vpm, float_status *fpst, uint32_t desc)
+{
+    do_fmopa_s(vza, vzn, vzm, vpn, vpm, fpst, desc, 1u << 31, 0);
+}
+
+void HELPER(sme_ah_fmops_s)(void *vza, void *vzn, void *vzm, void *vpn,
+                            void *vpm, float_status *fpst, uint32_t desc)
+{
+    do_fmopa_s(vza, vzn, vzm, vpn, vpm, fpst, desc, 0,
+               float_muladd_negate_product);
+}
+
+static void do_fmopa_d(uint64_t *za, uint64_t *zn, uint64_t *zm, uint8_t *pn,
+                       uint8_t *pm, float_status *fpst, uint32_t desc,
+                       uint64_t negx, int negf)
 {
     intptr_t row, col, oprsz = simd_oprsz(desc) / 8;
-    uint64_t neg = (uint64_t)simd_data(desc) << 63;
-    uint64_t *za = vza, *zn = vzn, *zm = vzm;
-    uint8_t *pn = vpn, *pm = vpm;
 
     for (row = 0; row < oprsz; ++row) {
         if (pn[H1(row)] & 1) {
             uint64_t *za_row = &za[tile_vslice_index(row)];
-            uint64_t n = zn[row] ^ neg;
+            uint64_t n = zn[row] ^ negx;
 
             for (col = 0; col < oprsz; ++col) {
                 if (pm[H1(col)] & 1) {
                     uint64_t *a = &za_row[col];
-                    *a = float64_muladd(n, zm[col], *a, 0, fpst);
+                    *a = float64_muladd(n, zm[col], *a, negf, fpst);
                 }
             }
         }
     }
 }
 
+void HELPER(sme_fmopa_d)(void *vza, void *vzn, void *vzm, void *vpn,
+                         void *vpm, float_status *fpst, uint32_t desc)
+{
+    do_fmopa_d(vza, vzn, vzm, vpn, vpm, fpst, desc, 0, 0);
+}
+
+void HELPER(sme_fmops_d)(void *vza, void *vzn, void *vzm, void *vpn,
+                         void *vpm, float_status *fpst, uint32_t desc)
+{
+    do_fmopa_d(vza, vzn, vzm, vpn, vpm, fpst, desc, 1ull << 63, 0);
+}
+
+void HELPER(sme_ah_fmops_d)(void *vza, void *vzn, void *vzm, void *vpn,
+                            void *vpm, float_status *fpst, uint32_t desc)
+{
+    do_fmopa_d(vza, vzn, vzm, vpn, vpm, fpst, desc, 0,
+               float_muladd_negate_product);
+}
+
 /*
  * Alter PAIR as needed for controlling predicates being false,
  * and for NEG on an enabled row element.
@@ -1078,6 +1113,20 @@ static inline uint32_t f16mop_adj_pair(uint32_t pair, uint32_t pg, uint32_t neg)
     return pair;
 }
 
+static inline uint32_t f16mop_ah_neg_adj_pair(uint32_t pair, uint32_t pg)
+{
+    uint32_t l = pg & 1 ? float16_ah_chs(pair) : 0;
+    uint32_t h = pg & 4 ? float16_ah_chs(pair >> 16) : 0;
+    return l | (h << 16);
+}
+
+static inline uint32_t bf16mop_ah_neg_adj_pair(uint32_t pair, uint32_t pg)
+{
+    uint32_t l = pg & 1 ? bfloat16_ah_chs(pair) : 0;
+    uint32_t h = pg & 4 ? bfloat16_ah_chs(pair >> 16) : 0;
+    return l | (h << 16);
+}
+
 static float32 f16_dotadd(float32 sum, uint32_t e1, uint32_t e2,
                           float_status *s_f16, float_status *s_std,
                           float_status *s_odd)
@@ -1146,12 +1195,11 @@ static float32 f16_dotadd(float32 sum, uint32_t e1, uint32_t e2,
     return float32_add(sum, t32, s_std);
 }
 
-void HELPER(sme_fmopa_w_h)(void *vza, void *vzn, void *vzm, void *vpn,
-                           void *vpm, CPUARMState *env, uint32_t desc)
+static void do_fmopa_w_h(void *vza, void *vzn, void *vzm, uint16_t *pn,
+                         uint16_t *pm, CPUARMState *env, uint32_t desc,
+                         uint32_t negx, bool ah_neg)
 {
     intptr_t row, col, oprsz = simd_maxsz(desc);
-    uint32_t neg = simd_data(desc) * 0x80008000u;
-    uint16_t *pn = vpn, *pm = vpm;
     float_status fpst_odd = env->vfp.fp_status[FPST_ZA];
 
     set_float_rounding_mode(float_round_to_odd, &fpst_odd);
@@ -1162,7 +1210,11 @@ void HELPER(sme_fmopa_w_h)(void *vza, void *vzn, void *vzm, void *vpn,
             void *vza_row = vza + tile_vslice_offset(row);
             uint32_t n = *(uint32_t *)(vzn + H1_4(row));
 
-            n = f16mop_adj_pair(n, prow, neg);
+            if (ah_neg) {
+                n = f16mop_ah_neg_adj_pair(n, prow);
+            } else {
+                n = f16mop_adj_pair(n, prow, negx);
+            }
 
             for (col = 0; col < oprsz; ) {
                 uint16_t pcol = pm[H2(col >> 4)];
@@ -1187,6 +1239,24 @@ void HELPER(sme_fmopa_w_h)(void *vza, void *vzn, void *vzm, void *vpn,
     }
 }
 
+void HELPER(sme_fmopa_w_h)(void *vza, void *vzn, void *vzm, void *vpn,
+                           void *vpm, CPUARMState *env, uint32_t desc)
+{
+    do_fmopa_w_h(vza, vzn, vzm, vpn, vpm, env, desc, 0, false);
+}
+
+void HELPER(sme_fmops_w_h)(void *vza, void *vzn, void *vzm, void *vpn,
+                           void *vpm, CPUARMState *env, uint32_t desc)
+{
+    do_fmopa_w_h(vza, vzn, vzm, vpn, vpm, env, desc, 0x80008000u, false);
+}
+
+void HELPER(sme_ah_fmops_w_h)(void *vza, void *vzn, void *vzm, void *vpn,
+                              void *vpm, CPUARMState *env, uint32_t desc)
+{
+    do_fmopa_w_h(vza, vzn, vzm, vpn, vpm, env, desc, 0, true);
+}
+
 void HELPER(sme2_fdot_h)(void *vd, void *vn, void *vm, void *va,
                          CPUARMState *env, uint32_t desc)
 {
@@ -1261,12 +1331,11 @@ void HELPER(sme2_fvdot_idx_h)(void *vd, void *vn, void *vm, void *va,
     }
 }
 
-void HELPER(sme_bfmopa_w)(void *vza, void *vzn, void *vzm,
-                          void *vpn, void *vpm, CPUARMState *env, uint32_t desc)
+static void do_bfmopa_w(void *vza, void *vzn, void *vzm,
+                        uint16_t *pn, uint16_t *pm, CPUARMState *env,
+                        uint32_t desc, uint32_t negx, bool ah_neg)
 {
     intptr_t row, col, oprsz = simd_maxsz(desc);
-    uint32_t neg = simd_data(desc) * 0x80008000u;
-    uint16_t *pn = vpn, *pm = vpm;
     float_status fpst, fpst_odd;
 
     if (is_ebf(env, &fpst, &fpst_odd)) {
@@ -1276,7 +1345,11 @@ void HELPER(sme_bfmopa_w)(void *vza, void *vzn, void *vzm,
                 void *vza_row = vza + tile_vslice_offset(row);
                 uint32_t n = *(uint32_t *)(vzn + H1_4(row));
 
-                n = f16mop_adj_pair(n, prow, neg);
+                if (ah_neg) {
+                    n = bf16mop_ah_neg_adj_pair(n, prow);
+                } else {
+                    n = f16mop_adj_pair(n, prow, negx);
+                }
 
                 for (col = 0; col < oprsz; ) {
                     uint16_t pcol = pm[H2(col >> 4)];
@@ -1303,7 +1376,11 @@ void HELPER(sme_bfmopa_w)(void *vza, void *vzn, void *vzm,
                 void *vza_row = vza + tile_vslice_offset(row);
                 uint32_t n = *(uint32_t *)(vzn + H1_4(row));
 
-                n = f16mop_adj_pair(n, prow, neg);
+                if (ah_neg) {
+                    n = bf16mop_ah_neg_adj_pair(n, prow);
+                } else {
+                    n = f16mop_adj_pair(n, prow, negx);
+                }
 
                 for (col = 0; col < oprsz; ) {
                     uint16_t pcol = pm[H2(col >> 4)];
@@ -1326,6 +1403,24 @@ void HELPER(sme_bfmopa_w)(void *vza, void *vzn, void *vzm,
     }
 }
 
+void HELPER(sme_bfmopa_w)(void *vza, void *vzn, void *vzm, void *vpn,
+                          void *vpm, CPUARMState *env, uint32_t desc)
+{
+    do_bfmopa_w(vza, vzn, vzm, vpn, vpm, env, desc, 0, false);
+}
+
+void HELPER(sme_bfmops_w)(void *vza, void *vzn, void *vzm, void *vpn,
+                          void *vpm, CPUARMState *env, uint32_t desc)
+{
+    do_bfmopa_w(vza, vzn, vzm, vpn, vpm, env, desc, 0x80008000u, false);
+}
+
+void HELPER(sme_ah_bfmops_w)(void *vza, void *vzn, void *vzm, void *vpn,
+                             void *vpm, CPUARMState *env, uint32_t desc)
+{
+    do_bfmopa_w(vza, vzn, vzm, vpn, vpm, env, desc, 0, true);
+}
+
 typedef uint32_t IMOPFn32(uint32_t, uint32_t, uint32_t, uint8_t, bool);
 static inline void do_imopa_s(uint32_t *za, uint32_t *zn, uint32_t *zm,
                               uint8_t *pn, uint8_t *pm,
diff --git a/target/arm/tcg/translate-sme.c b/target/arm/tcg/translate-sme.c
index 38d0231b0a..782f408061 100644
--- a/target/arm/tcg/translate-sme.c
+++ b/target/arm/tcg/translate-sme.c
@@ -526,7 +526,7 @@ static bool do_outprod_fpst(DisasContext *s, arg_op *a, MemOp esz,
                             gen_helper_gvec_5_ptr *fn)
 {
     int svl = streaming_vec_reg_size(s);
-    uint32_t desc = simd_desc(svl, svl, a->sub);
+    uint32_t desc = simd_desc(svl, svl, 0);
     TCGv_ptr za, zn, zm, pn, pm, fpst;
 
     if (!sme_smza_enabled_check(s)) {
@@ -548,7 +548,7 @@ static bool do_outprod_env(DisasContext *s, arg_op *a, MemOp esz,
                            gen_helper_gvec_5_ptr *fn)
 {
     int svl = streaming_vec_reg_size(s);
-    uint32_t desc = simd_desc(svl, svl, a->sub);
+    uint32_t desc = simd_desc(svl, svl, 0);
     TCGv_ptr za, zn, zm, pn, pm;
 
     if (!sme_smza_enabled_check(s)) {
@@ -565,14 +565,23 @@ static bool do_outprod_env(DisasContext *s, arg_op *a, MemOp esz,
     return true;
 }
 
-TRANS_FEAT(FMOPA_w_h, aa64_sme, do_outprod_env, a,
-           MO_32, gen_helper_sme_fmopa_w_h)
-TRANS_FEAT(FMOPA_s, aa64_sme, do_outprod_fpst, a,
-           MO_32, FPST_ZA, gen_helper_sme_fmopa_s)
-TRANS_FEAT(FMOPA_d, aa64_sme_f64f64, do_outprod_fpst, a,
-           MO_64, FPST_ZA, gen_helper_sme_fmopa_d)
+TRANS_FEAT(FMOPA_w_h, aa64_sme, do_outprod_env, a, MO_32,
+           !a->sub ? gen_helper_sme_fmopa_w_h
+           : !s->fpcr_ah ? gen_helper_sme_fmops_w_h
+           : gen_helper_sme_ah_fmops_w_h)
+TRANS_FEAT(FMOPA_s, aa64_sme, do_outprod_fpst, a, MO_32, FPST_ZA,
+           !a->sub ? gen_helper_sme_fmopa_s
+           : !s->fpcr_ah ? gen_helper_sme_fmops_s
+           : gen_helper_sme_ah_fmops_s)
+TRANS_FEAT(FMOPA_d, aa64_sme_f64f64, do_outprod_fpst, a, MO_64, FPST_ZA,
+           !a->sub ? gen_helper_sme_fmopa_d
+           : !s->fpcr_ah ? gen_helper_sme_fmops_d
+           : gen_helper_sme_ah_fmops_d)
 
-TRANS_FEAT(BFMOPA_w, aa64_sme, do_outprod_env, a, MO_32, gen_helper_sme_bfmopa_w)
+TRANS_FEAT(BFMOPA_w, aa64_sme, do_outprod_env, a, MO_32,
+           !a->sub ? gen_helper_sme_bfmopa_w
+           : !s->fpcr_ah ? gen_helper_sme_bfmops_w
+           : gen_helper_sme_ah_bfmops_w)
 
 TRANS_FEAT(SMOPA_s, aa64_sme, do_outprod, a, MO_32, gen_helper_sme_smopa_s)
 TRANS_FEAT(UMOPA_s, aa64_sme, do_outprod, a, MO_32, gen_helper_sme_umopa_s)
diff --git a/target/arm/tcg/vec_internal.h b/target/arm/tcg/vec_internal.h
index 957bf6d9fc..cf41b03dbc 100644
--- a/target/arm/tcg/vec_internal.h
+++ b/target/arm/tcg/vec_internal.h
@@ -300,6 +300,11 @@ bool is_ebf(CPUARMState *env, float_status *statusp, float_status *oddstatusp);
 /*
  * Negate as for FPCR.AH=1 -- do not negate NaNs.
  */
+static inline float16 bfloat16_ah_chs(float16 a)
+{
+    return bfloat16_is_any_nan(a) ? a : bfloat16_chs(a);
+}
+
 static inline float16 float16_ah_chs(float16 a)
 {
     return float16_is_any_nan(a) ? a : float16_chs(a);

From 1a039f94d355b615237221c72b81fe6bd2018210 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Fri, 4 Jul 2025 08:21:07 -0600
Subject: [PATCH 2051/2760] target/arm: Implement FMOPA (non-widening) for fp16
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-105-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/helper-sme.h    |  6 ++++
 target/arm/tcg/sme.decode      |  2 ++
 target/arm/tcg/sme_helper.c    | 51 ++++++++++++++++++++++++++++++++++
 target/arm/tcg/translate-sme.c |  4 +++
 4 files changed, 63 insertions(+)

diff --git a/target/arm/tcg/helper-sme.h b/target/arm/tcg/helper-sme.h
index 2b22c6aee5..fac70a82b9 100644
--- a/target/arm/tcg/helper-sme.h
+++ b/target/arm/tcg/helper-sme.h
@@ -137,6 +137,8 @@ DEF_HELPER_FLAGS_5(sme_addva_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
 
 DEF_HELPER_FLAGS_7(sme_fmopa_w_h, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_7(sme_fmopa_h, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_7(sme_fmopa_s, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_7(sme_fmopa_d, TCG_CALL_NO_RWG,
@@ -146,6 +148,8 @@ DEF_HELPER_FLAGS_7(sme_bfmopa_w, TCG_CALL_NO_RWG,
 
 DEF_HELPER_FLAGS_7(sme_fmops_w_h, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_7(sme_fmops_h, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_7(sme_fmops_s, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_7(sme_fmops_d, TCG_CALL_NO_RWG,
@@ -155,6 +159,8 @@ DEF_HELPER_FLAGS_7(sme_bfmops_w, TCG_CALL_NO_RWG,
 
 DEF_HELPER_FLAGS_7(sme_ah_fmops_w_h, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_7(sme_ah_fmops_h, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_7(sme_ah_fmops_s, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_7(sme_ah_fmops_d, TCG_CALL_NO_RWG,
diff --git a/target/arm/tcg/sme.decode b/target/arm/tcg/sme.decode
index 8ad86f707e..3c58fdd2a0 100644
--- a/target/arm/tcg/sme.decode
+++ b/target/arm/tcg/sme.decode
@@ -183,9 +183,11 @@ ADDVA_d         11000000 11 01000 1 ... ... ..... 00 ...        @adda_64
 ### SME Outer Product
 
 &op             zad zn zm pm pn sub:bool
+@op_16          ........ ... zm:5 pm:3 pn:3 zn:5 sub:1 ... zad:1 &op
 @op_32          ........ ... zm:5 pm:3 pn:3 zn:5 sub:1 .. zad:2 &op
 @op_64          ........ ... zm:5 pm:3 pn:3 zn:5 sub:1 .  zad:3 &op
 
+FMOPA_h         10000001 100 ..... ... ... ..... . 100 .        @op_16
 FMOPA_s         10000000 100 ..... ... ... ..... . 00 ..        @op_32
 FMOPA_d         10000000 110 ..... ... ... ..... . 0 ...        @op_64
 
diff --git a/target/arm/tcg/sme_helper.c b/target/arm/tcg/sme_helper.c
index eff0ce7480..d23d9f08d2 100644
--- a/target/arm/tcg/sme_helper.c
+++ b/target/arm/tcg/sme_helper.c
@@ -1002,6 +1002,57 @@ void HELPER(sme_addva_d)(void *vzda, void *vzn, void *vpn,
     }
 }
 
+static void do_fmopa_h(void *vza, void *vzn, void *vzm, uint16_t *pn,
+                       uint16_t *pm, float_status *fpst, uint32_t desc,
+                       uint16_t negx, int negf)
+{
+    intptr_t row, col, oprsz = simd_maxsz(desc);
+
+    for (row = 0; row < oprsz; ) {
+        uint16_t pa = pn[H2(row >> 4)];
+        do {
+            if (pa & 1) {
+                void *vza_row = vza + tile_vslice_offset(row);
+                uint16_t n = *(uint32_t *)(vzn + H1_2(row)) ^ negx;
+
+                for (col = 0; col < oprsz; ) {
+                    uint16_t pb = pm[H2(col >> 4)];
+                    do {
+                        if (pb & 1) {
+                            uint16_t *a = vza_row + H1_2(col);
+                            uint16_t *m = vzm + H1_2(col);
+                            *a = float16_muladd(n, *m, *a, negf, fpst);
+                        }
+                        col += 2;
+                        pb >>= 2;
+                    } while (col & 15);
+                }
+            }
+            row += 2;
+            pa >>= 2;
+        } while (row & 15);
+    }
+}
+
+void HELPER(sme_fmopa_h)(void *vza, void *vzn, void *vzm, void *vpn,
+                         void *vpm, float_status *fpst, uint32_t desc)
+{
+    do_fmopa_h(vza, vzn, vzm, vpn, vpm, fpst, desc, 0, 0);
+}
+
+void HELPER(sme_fmops_h)(void *vza, void *vzn, void *vzm, void *vpn,
+                         void *vpm, float_status *fpst, uint32_t desc)
+{
+    do_fmopa_h(vza, vzn, vzm, vpn, vpm, fpst, desc, 1u << 15, 0);
+}
+
+void HELPER(sme_ah_fmops_h)(void *vza, void *vzn, void *vzm, void *vpn,
+                            void *vpm, float_status *fpst, uint32_t desc)
+{
+    do_fmopa_h(vza, vzn, vzm, vpn, vpm, fpst, desc, 0,
+               float_muladd_negate_product);
+}
+
 static void do_fmopa_s(void *vza, void *vzn, void *vzm, uint16_t *pn,
                        uint16_t *pm, float_status *fpst, uint32_t desc,
                        uint32_t negx, int negf)
diff --git a/target/arm/tcg/translate-sme.c b/target/arm/tcg/translate-sme.c
index 782f408061..119a5665e6 100644
--- a/target/arm/tcg/translate-sme.c
+++ b/target/arm/tcg/translate-sme.c
@@ -569,6 +569,10 @@ TRANS_FEAT(FMOPA_w_h, aa64_sme, do_outprod_env, a, MO_32,
            !a->sub ? gen_helper_sme_fmopa_w_h
            : !s->fpcr_ah ? gen_helper_sme_fmops_w_h
            : gen_helper_sme_ah_fmops_w_h)
+TRANS_FEAT(FMOPA_h, aa64_sme_f16f16, do_outprod_fpst, a, MO_16, FPST_ZA_F16,
+           !a->sub ? gen_helper_sme_fmopa_h
+           : !s->fpcr_ah ? gen_helper_sme_fmops_h
+           : gen_helper_sme_ah_fmops_h)
 TRANS_FEAT(FMOPA_s, aa64_sme, do_outprod_fpst, a, MO_32, FPST_ZA,
            !a->sub ? gen_helper_sme_fmopa_s
            : !s->fpcr_ah ? gen_helper_sme_fmops_s

From 4805911a925ffbf798b29dce50cbb9585fd8e87e Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Fri, 4 Jul 2025 08:21:08 -0600
Subject: [PATCH 2052/2760] target/arm: Implement SME2 BFMOPA (non-widening)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-106-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/helper-sme.h    |  6 ++++
 target/arm/tcg/sme.decode      |  2 ++
 target/arm/tcg/sme_helper.c    | 51 ++++++++++++++++++++++++++++++++++
 target/arm/tcg/translate-sme.c |  5 ++++
 4 files changed, 64 insertions(+)

diff --git a/target/arm/tcg/helper-sme.h b/target/arm/tcg/helper-sme.h
index fac70a82b9..1fc756bec6 100644
--- a/target/arm/tcg/helper-sme.h
+++ b/target/arm/tcg/helper-sme.h
@@ -145,6 +145,8 @@ DEF_HELPER_FLAGS_7(sme_fmopa_d, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_7(sme_bfmopa_w, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_7(sme_bfmopa, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, ptr, fpst, i32)
 
 DEF_HELPER_FLAGS_7(sme_fmops_w_h, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, ptr, env, i32)
@@ -156,6 +158,8 @@ DEF_HELPER_FLAGS_7(sme_fmops_d, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_7(sme_bfmops_w, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_7(sme_bfmops, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, ptr, fpst, i32)
 
 DEF_HELPER_FLAGS_7(sme_ah_fmops_w_h, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, ptr, env, i32)
@@ -167,6 +171,8 @@ DEF_HELPER_FLAGS_7(sme_ah_fmops_d, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_7(sme_ah_bfmops_w, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_FLAGS_7(sme_ah_bfmops, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, ptr, fpst, i32)
 
 DEF_HELPER_FLAGS_6(sme_smopa_s, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, ptr, i32)
diff --git a/target/arm/tcg/sme.decode b/target/arm/tcg/sme.decode
index 3c58fdd2a0..6bb9aa2a90 100644
--- a/target/arm/tcg/sme.decode
+++ b/target/arm/tcg/sme.decode
@@ -191,6 +191,8 @@ FMOPA_h         10000001 100 ..... ... ... ..... . 100 .        @op_16
 FMOPA_s         10000000 100 ..... ... ... ..... . 00 ..        @op_32
 FMOPA_d         10000000 110 ..... ... ... ..... . 0 ...        @op_64
 
+BFMOPA          10000001 101 ..... ... ... ..... . 100 .        @op_16
+
 BFMOPA_w        10000001 100 ..... ... ... ..... . 00 ..        @op_32
 FMOPA_w_h       10000001 101 ..... ... ... ..... . 00 ..        @op_32
 
diff --git a/target/arm/tcg/sme_helper.c b/target/arm/tcg/sme_helper.c
index d23d9f08d2..bb8ed1ed0e 100644
--- a/target/arm/tcg/sme_helper.c
+++ b/target/arm/tcg/sme_helper.c
@@ -1144,6 +1144,57 @@ void HELPER(sme_ah_fmops_d)(void *vza, void *vzn, void *vzm, void *vpn,
                float_muladd_negate_product);
 }
 
+static void do_bfmopa(void *vza, void *vzn, void *vzm, uint16_t *pn,
+                      uint16_t *pm, float_status *fpst, uint32_t desc,
+                      uint16_t negx, int negf)
+{
+    intptr_t row, col, oprsz = simd_maxsz(desc);
+
+    for (row = 0; row < oprsz; ) {
+        uint16_t pa = pn[H2(row >> 4)];
+        do {
+            if (pa & 1) {
+                void *vza_row = vza + tile_vslice_offset(row);
+                uint16_t n = *(uint32_t *)(vzn + H1_2(row)) ^ negx;
+
+                for (col = 0; col < oprsz; ) {
+                    uint16_t pb = pm[H2(col >> 4)];
+                    do {
+                        if (pb & 1) {
+                            uint16_t *a = vza_row + H1_2(col);
+                            uint16_t *m = vzm + H1_2(col);
+                            *a = bfloat16_muladd(n, *m, *a, negf, fpst);
+                        }
+                        col += 2;
+                        pb >>= 2;
+                    } while (col & 15);
+                }
+            }
+            row += 2;
+            pa >>= 2;
+        } while (row & 15);
+    }
+}
+
+void HELPER(sme_bfmopa)(void *vza, void *vzn, void *vzm, void *vpn,
+                        void *vpm, float_status *fpst, uint32_t desc)
+{
+    do_bfmopa(vza, vzn, vzm, vpn, vpm, fpst, desc, 0, 0);
+}
+
+void HELPER(sme_bfmops)(void *vza, void *vzn, void *vzm, void *vpn,
+                        void *vpm, float_status *fpst, uint32_t desc)
+{
+    do_bfmopa(vza, vzn, vzm, vpn, vpm, fpst, desc, 1u << 15, 0);
+}
+
+void HELPER(sme_ah_bfmops)(void *vza, void *vzn, void *vzm, void *vpn,
+                           void *vpm, float_status *fpst, uint32_t desc)
+{
+    do_bfmopa(vza, vzn, vzm, vpn, vpm, fpst, desc, 0,
+              float_muladd_negate_product);
+}
+
 /*
  * Alter PAIR as needed for controlling predicates being false,
  * and for NEG on an enabled row element.
diff --git a/target/arm/tcg/translate-sme.c b/target/arm/tcg/translate-sme.c
index 119a5665e6..65fc8bc9b2 100644
--- a/target/arm/tcg/translate-sme.c
+++ b/target/arm/tcg/translate-sme.c
@@ -582,6 +582,11 @@ TRANS_FEAT(FMOPA_d, aa64_sme_f64f64, do_outprod_fpst, a, MO_64, FPST_ZA,
            : !s->fpcr_ah ? gen_helper_sme_fmops_d
            : gen_helper_sme_ah_fmops_d)
 
+TRANS_FEAT(BFMOPA, aa64_sme_b16b16, do_outprod_fpst, a, MO_16, FPST_ZA,
+           !a->sub ? gen_helper_sme_bfmopa
+           : !s->fpcr_ah ? gen_helper_sme_bfmops
+           : gen_helper_sme_ah_bfmops)
+
 TRANS_FEAT(BFMOPA_w, aa64_sme, do_outprod_env, a, MO_32,
            !a->sub ? gen_helper_sme_bfmopa_w
            : !s->fpcr_ah ? gen_helper_sme_bfmops_w

From 7b1613a1020d294219867a2cad6b41c46acec8f2 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:21:09 -0600
Subject: [PATCH 2053/2760] target/arm: Enable FEAT_SME2p1 on -cpu max

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-107-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/emulation.rst |  6 ++++++
 target/arm/tcg/cpu64.c        | 10 ++++++++--
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
index 78c2fd2113..890dc6fee2 100644
--- a/docs/system/arm/emulation.rst
+++ b/docs/system/arm/emulation.rst
@@ -129,16 +129,22 @@ the following architecture extensions:
 - FEAT_SM3 (Advanced SIMD SM3 instructions)
 - FEAT_SM4 (Advanced SIMD SM4 instructions)
 - FEAT_SME (Scalable Matrix Extension)
+- FEAT_SME2 (Scalable Matrix Extension version 2)
+- FEAT_SME2p1 (Scalable Matrix Extension version 2.1)
+- FEAT_SME_B16B16 (Non-widening BFloat16 arithmetic for SME2)
 - FEAT_SME_FA64 (Full A64 instruction set in Streaming SVE mode)
+- FEAT_SME_F16F16 (Non-widening half-precision FP16 arithmetic for SME2)
 - FEAT_SME_F64F64 (Double-precision floating-point outer product instructions)
 - FEAT_SME_I16I64 (16-bit to 64-bit integer widening outer product instructions)
 - FEAT_SVE (Scalable Vector Extension)
 - FEAT_SVE_AES (Scalable Vector AES instructions)
+- FEAT_SVE_B16B16 (Non-widening BFloat16 arithmetic for SVE2)
 - FEAT_SVE_BitPerm (Scalable Vector Bit Permutes instructions)
 - FEAT_SVE_PMULL128 (Scalable Vector PMULL instructions)
 - FEAT_SVE_SHA3 (Scalable Vector SHA3 instructions)
 - FEAT_SVE_SM4 (Scalable Vector SM4 instructions)
 - FEAT_SVE2 (Scalable Vector Extension version 2)
+- FEAT_SVE2p1 (Scalable Vector Extension version 2.1)
 - FEAT_SPECRES (Speculation restriction instructions)
 - FEAT_SSBS (Speculative Store Bypass Safe)
 - FEAT_SSBS2 (MRS and MSR instructions for SSBS version 2)
diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
index 937f29e253..d0df50a2f3 100644
--- a/target/arm/tcg/cpu64.c
+++ b/target/arm/tcg/cpu64.c
@@ -1201,7 +1201,7 @@ void aarch64_max_tcg_initfn(Object *obj)
      */
     t = FIELD_DP64(t, ID_AA64PFR1, MTE, 3);       /* FEAT_MTE3 */
     t = FIELD_DP64(t, ID_AA64PFR1, RAS_FRAC, 0);  /* FEAT_RASv1p1 + FEAT_DoubleFault */
-    t = FIELD_DP64(t, ID_AA64PFR1, SME, 1);       /* FEAT_SME */
+    t = FIELD_DP64(t, ID_AA64PFR1, SME, 2);       /* FEAT_SME2 */
     t = FIELD_DP64(t, ID_AA64PFR1, CSV2_FRAC, 0); /* FEAT_CSV2_3 */
     t = FIELD_DP64(t, ID_AA64PFR1, NMI, 1);       /* FEAT_NMI */
     SET_IDREG(isar, ID_AA64PFR1, t);
@@ -1250,10 +1250,11 @@ void aarch64_max_tcg_initfn(Object *obj)
     FIELD_DP64_IDREG(isar, ID_AA64MMFR3, SPEC_FPACC, 1); /* FEAT_FPACC_SPEC */
 
     t = GET_IDREG(isar, ID_AA64ZFR0);
-    t = FIELD_DP64(t, ID_AA64ZFR0, SVEVER, 1);
+    t = FIELD_DP64(t, ID_AA64ZFR0, SVEVER, 2);    /* FEAT_SVE2p1 */
     t = FIELD_DP64(t, ID_AA64ZFR0, AES, 2);       /* FEAT_SVE_PMULL128 */
     t = FIELD_DP64(t, ID_AA64ZFR0, BITPERM, 1);   /* FEAT_SVE_BitPerm */
     t = FIELD_DP64(t, ID_AA64ZFR0, BFLOAT16, 2);  /* FEAT_BF16, FEAT_EBF16 */
+    t = FIELD_DP64(t, ID_AA64ZFR0, B16B16, 1);    /* FEAT_SVE_B16B16 */
     t = FIELD_DP64(t, ID_AA64ZFR0, SHA3, 1);      /* FEAT_SVE_SHA3 */
     t = FIELD_DP64(t, ID_AA64ZFR0, SM4, 1);       /* FEAT_SVE_SM4 */
     t = FIELD_DP64(t, ID_AA64ZFR0, I8MM, 1);      /* FEAT_I8MM */
@@ -1269,11 +1270,16 @@ void aarch64_max_tcg_initfn(Object *obj)
 
     t = GET_IDREG(isar, ID_AA64SMFR0);
     t = FIELD_DP64(t, ID_AA64SMFR0, F32F32, 1);   /* FEAT_SME */
+    t = FIELD_DP64(t, ID_AA64SMFR0, BI32I32, 1);  /* FEAT_SME2 */
     t = FIELD_DP64(t, ID_AA64SMFR0, B16F32, 1);   /* FEAT_SME */
     t = FIELD_DP64(t, ID_AA64SMFR0, F16F32, 1);   /* FEAT_SME */
     t = FIELD_DP64(t, ID_AA64SMFR0, I8I32, 0xf);  /* FEAT_SME */
+    t = FIELD_DP64(t, ID_AA64SMFR0, F16F16, 1);   /* FEAT_SME_F16F16 */
+    t = FIELD_DP64(t, ID_AA64SMFR0, B16B16, 1);   /* FEAT_SME_B16B16 */
+    t = FIELD_DP64(t, ID_AA64SMFR0, I16I32, 5);   /* FEAT_SME2 */
     t = FIELD_DP64(t, ID_AA64SMFR0, F64F64, 1);   /* FEAT_SME_F64F64 */
     t = FIELD_DP64(t, ID_AA64SMFR0, I16I64, 0xf); /* FEAT_SME_I16I64 */
+    t = FIELD_DP64(t, ID_AA64SMFR0, SMEVER, 2);   /* FEAT_SME2p1 */
     t = FIELD_DP64(t, ID_AA64SMFR0, FA64, 1);     /* FEAT_SME_FA64 */
     SET_IDREG(isar, ID_AA64SMFR0, t);
 

From 083fef73585dfa03f72055ace6de8dec4912d0b0 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Jul 2025 08:21:10 -0600
Subject: [PATCH 2054/2760] linux-user/aarch64: Set hwcap bits for
 SME2p1/SVE2p1

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704142112.1018902-108-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 linux-user/elfload.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 2add1665c7..ea214105ff 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -915,6 +915,14 @@ uint64_t get_elf_hwcap2(void)
     GET_FEATURE_ID(aa64_sme_fa64, ARM_HWCAP2_A64_SME_FA64);
     GET_FEATURE_ID(aa64_hbc, ARM_HWCAP2_A64_HBC);
     GET_FEATURE_ID(aa64_mops, ARM_HWCAP2_A64_MOPS);
+    GET_FEATURE_ID(aa64_sve2p1, ARM_HWCAP2_A64_SVE2P1);
+    GET_FEATURE_ID(aa64_sme2, (ARM_HWCAP2_A64_SME2 |
+                               ARM_HWCAP2_A64_SME_I16I32 |
+                               ARM_HWCAP2_A64_SME_BI32I32));
+    GET_FEATURE_ID(aa64_sme2p1, ARM_HWCAP2_A64_SME2P1);
+    GET_FEATURE_ID(aa64_sme_b16b16, ARM_HWCAP2_A64_SME_B16B16);
+    GET_FEATURE_ID(aa64_sme_f16f16, ARM_HWCAP2_A64_SME_F16F16);
+    GET_FEATURE_ID(aa64_sve_b16b16, ARM_HWCAP2_A64_SVE_B16B16);
 
     return hwcaps;
 }

From 51eb283dd0e29f29adf1943c063614156ca7cbd7 Mon Sep 17 00:00:00 2001
From: Jackson Donaldson <jackson88044@gmail.com>
Date: Fri, 4 Jul 2025 18:32:29 -0400
Subject: [PATCH 2055/2760] MAX78000: Add MAX78000FTHR Machine

This patch adds support for the MAX78000FTHR machine.

The MAX78000FTHR contains a MAX78000 and a RISC-V core. This patch
implements only the MAX78000, which is Cortex-M4 based.
Details can be found at:
https://www.analog.com/media/en/technical-documentation/user-guides/max78000-user-guide.pdf

Signed-off-by: Jackson Donaldson <jcksn@duck.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20250704223239.248781-2-jcksn@duck.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/Kconfig                |  10 ++
 hw/arm/max78000_soc.c         | 172 ++++++++++++++++++++++++++++++++++
 hw/arm/max78000fthr.c         |  50 ++++++++++
 hw/arm/meson.build            |   2 +
 include/hw/arm/max78000_soc.h |  35 +++++++
 5 files changed, 269 insertions(+)
 create mode 100644 hw/arm/max78000_soc.c
 create mode 100644 hw/arm/max78000fthr.c
 create mode 100644 include/hw/arm/max78000_soc.h

diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
index 6ea86534d5..44815af41f 100644
--- a/hw/arm/Kconfig
+++ b/hw/arm/Kconfig
@@ -95,6 +95,12 @@ config INTEGRATOR
     select PL181 # display
     select SMC91C111
 
+config MAX78000FTHR
+    bool
+    default y
+    depends on TCG && ARM
+    select MAX78000_SOC
+
 config MPS3R
     bool
     default y
@@ -357,6 +363,10 @@ config ALLWINNER_R40
     select USB_EHCI_SYSBUS
     select SD
 
+config MAX78000_SOC
+    bool
+    select ARM_V7M
+
 config RASPI
     bool
     default y
diff --git a/hw/arm/max78000_soc.c b/hw/arm/max78000_soc.c
new file mode 100644
index 0000000000..9676ada6a2
--- /dev/null
+++ b/hw/arm/max78000_soc.c
@@ -0,0 +1,172 @@
+/*
+ * MAX78000 SOC
+ *
+ * Copyright (c) 2025 Jackson Donaldson <jcksn@duck.com>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ *
+ * Implementation based on stm32f205 and Max78000 user guide at
+ * https://www.analog.com/media/en/technical-documentation/user-guides/max78000-user-guide.pdf
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "system/address-spaces.h"
+#include "system/system.h"
+#include "hw/arm/max78000_soc.h"
+#include "hw/qdev-clock.h"
+#include "hw/misc/unimp.h"
+
+static void max78000_soc_initfn(Object *obj)
+{
+    MAX78000State *s = MAX78000_SOC(obj);
+
+    object_initialize_child(obj, "armv7m", &s->armv7m, TYPE_ARMV7M);
+
+    s->sysclk = qdev_init_clock_in(DEVICE(s), "sysclk", NULL, NULL, 0);
+}
+
+static void max78000_soc_realize(DeviceState *dev_soc, Error **errp)
+{
+    MAX78000State *s = MAX78000_SOC(dev_soc);
+    MemoryRegion *system_memory = get_system_memory();
+    DeviceState *armv7m;
+    Error *err = NULL;
+
+    if (!clock_has_source(s->sysclk)) {
+        error_setg(errp, "sysclk clock must be wired up by the board code");
+        return;
+    }
+
+    memory_region_init_rom(&s->flash, OBJECT(dev_soc), "MAX78000.flash",
+                           FLASH_SIZE, &err);
+    if (err != NULL) {
+        error_propagate(errp, err);
+        return;
+    }
+
+    memory_region_add_subregion(system_memory, FLASH_BASE_ADDRESS, &s->flash);
+
+    memory_region_init_ram(&s->sram, NULL, "MAX78000.sram", SRAM_SIZE,
+                           &err);
+    if (err != NULL) {
+        error_propagate(errp, err);
+        return;
+    }
+    memory_region_add_subregion(system_memory, SRAM_BASE_ADDRESS, &s->sram);
+
+    armv7m = DEVICE(&s->armv7m);
+
+    /*
+     * The MAX78000 user guide's Interrupt Vector Table section
+     * suggests that there are 120 IRQs in the text, while only listing
+     * 104 in table 5-1. Implement the more generous of the two.
+     * This has not been tested in hardware.
+     */
+    qdev_prop_set_uint32(armv7m, "num-irq", 120);
+    qdev_prop_set_uint8(armv7m, "num-prio-bits", 3);
+    qdev_prop_set_string(armv7m, "cpu-type", ARM_CPU_TYPE_NAME("cortex-m4"));
+    qdev_prop_set_bit(armv7m, "enable-bitband", true);
+    qdev_connect_clock_in(armv7m, "cpuclk", s->sysclk);
+    object_property_set_link(OBJECT(&s->armv7m), "memory",
+                             OBJECT(system_memory), &error_abort);
+    if (!sysbus_realize(SYS_BUS_DEVICE(&s->armv7m), errp)) {
+        return;
+    }
+
+    create_unimplemented_device("globalControl",        0x40000000, 0x400);
+    create_unimplemented_device("systemInterface",      0x40000400, 0x400);
+    create_unimplemented_device("functionControl",      0x40000800, 0x400);
+    create_unimplemented_device("watchdogTimer0",       0x40003000, 0x400);
+    create_unimplemented_device("dynamicVoltScale",     0x40003c00, 0x40);
+    create_unimplemented_device("SIMO",                 0x40004400, 0x400);
+    create_unimplemented_device("trimSystemInit",       0x40005400, 0x400);
+    create_unimplemented_device("generalCtrlFunc",      0x40005800, 0x400);
+    create_unimplemented_device("wakeupTimer",          0x40006400, 0x400);
+    create_unimplemented_device("powerSequencer",       0x40006800, 0x400);
+    create_unimplemented_device("miscControl",          0x40006c00, 0x400);
+
+    create_unimplemented_device("aes",                  0x40007400, 0x400);
+    create_unimplemented_device("aesKey",               0x40007800, 0x400);
+
+    create_unimplemented_device("gpio0",                0x40008000, 0x1000);
+    create_unimplemented_device("gpio1",                0x40009000, 0x1000);
+
+    create_unimplemented_device("parallelCamInterface", 0x4000e000, 0x1000);
+    create_unimplemented_device("CRC",                  0x4000f000, 0x1000);
+
+    create_unimplemented_device("timer0",               0x40010000, 0x1000);
+    create_unimplemented_device("timer1",               0x40011000, 0x1000);
+    create_unimplemented_device("timer2",               0x40012000, 0x1000);
+    create_unimplemented_device("timer3",               0x40013000, 0x1000);
+
+    create_unimplemented_device("i2c0",                 0x4001d000, 0x1000);
+    create_unimplemented_device("i2c1",                 0x4001e000, 0x1000);
+    create_unimplemented_device("i2c2",                 0x4001f000, 0x1000);
+
+    create_unimplemented_device("standardDMA",          0x40028000, 0x1000);
+    create_unimplemented_device("flashController0",     0x40029000, 0x400);
+
+    create_unimplemented_device("icc0",                 0x4002a000, 0x800);
+    create_unimplemented_device("icc1",                 0x4002a800, 0x800);
+
+    create_unimplemented_device("adc",                  0x40034000, 0x1000);
+    create_unimplemented_device("pulseTrainEngine",     0x4003c000, 0xa0);
+    create_unimplemented_device("oneWireMaster",        0x4003d000, 0x1000);
+    create_unimplemented_device("semaphore",            0x4003e000, 0x1000);
+
+    create_unimplemented_device("uart0",                0x40042000, 0x1000);
+    create_unimplemented_device("uart1",                0x40043000, 0x1000);
+    create_unimplemented_device("uart2",                0x40044000, 0x1000);
+
+    create_unimplemented_device("spi1",                 0x40046000, 0x2000);
+    create_unimplemented_device("trng",                 0x4004d000, 0x1000);
+    create_unimplemented_device("i2s",                  0x40060000, 0x1000);
+    create_unimplemented_device("lowPowerControl",      0x40080000, 0x400);
+    create_unimplemented_device("gpio2",                0x40080400, 0x200);
+    create_unimplemented_device("lowPowerWatchdogTimer",    0x40080800, 0x400);
+    create_unimplemented_device("lowPowerTimer4",       0x40080c00, 0x400);
+
+    create_unimplemented_device("lowPowerTimer5",       0x40081000, 0x400);
+    create_unimplemented_device("lowPowerUART0",        0x40081400, 0x400);
+    create_unimplemented_device("lowPowerComparator",   0x40088000, 0x400);
+
+    create_unimplemented_device("spi0",                 0x400be000, 0x400);
+
+    /*
+     * The MAX78000 user guide's base address map lists the CNN TX FIFO as
+     * beginning at 0x400c0400 and ending at 0x400c0400. Given that CNN_FIFO
+     * is listed as having data accessible up to offset 0x1000, the user
+     * guide is likely incorrect.
+     */
+    create_unimplemented_device("cnnTxFIFO",            0x400c0400, 0x2000);
+
+    create_unimplemented_device("cnnGlobalControl",     0x50000000, 0x10000);
+    create_unimplemented_device("cnnx16quad0",          0x50100000, 0x40000);
+    create_unimplemented_device("cnnx16quad1",          0x50500000, 0x40000);
+    create_unimplemented_device("cnnx16quad2",          0x50900000, 0x40000);
+    create_unimplemented_device("cnnx16quad3",          0x50d00000, 0x40000);
+
+}
+
+static void max78000_soc_class_init(ObjectClass *klass, const void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->realize = max78000_soc_realize;
+}
+
+static const TypeInfo max78000_soc_info = {
+    .name          = TYPE_MAX78000_SOC,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(MAX78000State),
+    .instance_init = max78000_soc_initfn,
+    .class_init    = max78000_soc_class_init,
+};
+
+static void max78000_soc_types(void)
+{
+    type_register_static(&max78000_soc_info);
+}
+
+type_init(max78000_soc_types)
diff --git a/hw/arm/max78000fthr.c b/hw/arm/max78000fthr.c
new file mode 100644
index 0000000000..c4f6b5b1b0
--- /dev/null
+++ b/hw/arm/max78000fthr.c
@@ -0,0 +1,50 @@
+/*
+ * MAX78000FTHR Evaluation Board
+ *
+ * Copyright (c) 2025 Jackson Donaldson <jcksn@duck.com>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "hw/boards.h"
+#include "hw/qdev-properties.h"
+#include "hw/qdev-clock.h"
+#include "qemu/error-report.h"
+#include "hw/arm/max78000_soc.h"
+#include "hw/arm/boot.h"
+
+/* 60MHz is the default, but other clocks can be selected. */
+#define SYSCLK_FRQ 60000000ULL
+static void max78000_init(MachineState *machine)
+{
+    DeviceState *dev;
+    Clock *sysclk;
+
+    sysclk = clock_new(OBJECT(machine), "SYSCLK");
+    clock_set_hz(sysclk, SYSCLK_FRQ);
+
+    dev = qdev_new(TYPE_MAX78000_SOC);
+    object_property_add_child(OBJECT(machine), "soc", OBJECT(dev));
+    qdev_connect_clock_in(dev, "sysclk", sysclk);
+    sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
+
+    armv7m_load_kernel(ARM_CPU(first_cpu),
+                       machine->kernel_filename,
+                       0x00000000, FLASH_SIZE);
+}
+
+static void max78000_machine_init(MachineClass *mc)
+{
+    static const char * const valid_cpu_types[] = {
+        ARM_CPU_TYPE_NAME("cortex-m4"),
+        NULL
+    };
+
+    mc->desc = "MAX78000FTHR Board (Cortex-M4 / (Unimplemented) RISC-V)";
+    mc->init = max78000_init;
+    mc->valid_cpu_types = valid_cpu_types;
+}
+
+DEFINE_MACHINE("max78000fthr", max78000_machine_init)
diff --git a/hw/arm/meson.build b/hw/arm/meson.build
index d90be8f4c9..dc68391305 100644
--- a/hw/arm/meson.build
+++ b/hw/arm/meson.build
@@ -27,6 +27,7 @@ arm_common_ss.add(when: 'CONFIG_OMAP', if_true: files('omap1.c'))
 arm_common_ss.add(when: 'CONFIG_ALLWINNER_A10', if_true: files('allwinner-a10.c', 'cubieboard.c'))
 arm_common_ss.add(when: 'CONFIG_ALLWINNER_H3', if_true: files('allwinner-h3.c', 'orangepi.c'))
 arm_common_ss.add(when: 'CONFIG_ALLWINNER_R40', if_true: files('allwinner-r40.c', 'bananapi_m2u.c'))
+arm_common_ss.add(when: 'CONFIG_MAX78000_SOC', if_true: files('max78000_soc.c'))
 arm_ss.add(when: 'CONFIG_RASPI', if_true: files('bcm2836.c', 'raspi.c'))
 arm_common_ss.add(when: ['CONFIG_RASPI', 'TARGET_AARCH64'], if_true: files('bcm2838.c', 'raspi4b.c'))
 arm_common_ss.add(when: 'CONFIG_STM32F100_SOC', if_true: files('stm32f100_soc.c'))
@@ -71,6 +72,7 @@ arm_ss.add(when: 'CONFIG_XEN', if_true: files(
 arm_common_ss.add(when: 'CONFIG_ARM_SMMUV3', if_true: files('smmu-common.c'))
 arm_common_ss.add(when: 'CONFIG_COLLIE', if_true: files('collie.c'))
 arm_common_ss.add(when: 'CONFIG_EXYNOS4', if_true: files('exynos4_boards.c'))
+arm_common_ss.add(when: 'CONFIG_MAX78000FTHR', if_true: files('max78000fthr.c'))
 arm_common_ss.add(when: 'CONFIG_NETDUINO2', if_true: files('netduino2.c'))
 arm_common_ss.add(when: 'CONFIG_RASPI', if_true: files('bcm2835_peripherals.c'))
 arm_common_ss.add(when: 'CONFIG_RASPI', if_true: files('bcm2838_peripherals.c'))
diff --git a/include/hw/arm/max78000_soc.h b/include/hw/arm/max78000_soc.h
new file mode 100644
index 0000000000..97bf4099c9
--- /dev/null
+++ b/include/hw/arm/max78000_soc.h
@@ -0,0 +1,35 @@
+/*
+ * MAX78000 SOC
+ *
+ * Copyright (c) 2025 Jackson Donaldson <jcksn@duck.com>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef HW_ARM_MAX78000_SOC_H
+#define HW_ARM_MAX78000_SOC_H
+
+#include "hw/or-irq.h"
+#include "hw/arm/armv7m.h"
+#include "qom/object.h"
+
+#define TYPE_MAX78000_SOC "max78000-soc"
+OBJECT_DECLARE_SIMPLE_TYPE(MAX78000State, MAX78000_SOC)
+
+#define FLASH_BASE_ADDRESS 0x10000000
+#define FLASH_SIZE (512 * 1024)
+#define SRAM_BASE_ADDRESS 0x20000000
+#define SRAM_SIZE (128 * 1024)
+
+struct MAX78000State {
+    SysBusDevice parent_obj;
+
+    ARMv7MState armv7m;
+
+    MemoryRegion sram;
+    MemoryRegion flash;
+
+    Clock *sysclk;
+};
+
+#endif

From 3ec680e64c6d0686c518f25fdadf8866d7cd12a1 Mon Sep 17 00:00:00 2001
From: Jackson Donaldson <jackson88044@gmail.com>
Date: Fri, 4 Jul 2025 18:32:30 -0400
Subject: [PATCH 2056/2760] MAX78000: ICC Implementation

This commit implements the Instruction Cache Controller
for the MAX78000

Signed-off-by: Jackson Donaldson <jcksn@duck.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20250704223239.248781-3-jcksn@duck.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/Kconfig                 |   1 +
 hw/misc/Kconfig                |   3 +
 hw/misc/max78000_icc.c         | 120 +++++++++++++++++++++++++++++++++
 hw/misc/meson.build            |   1 +
 include/hw/misc/max78000_icc.h |  33 +++++++++
 5 files changed, 158 insertions(+)
 create mode 100644 hw/misc/max78000_icc.c
 create mode 100644 include/hw/misc/max78000_icc.h

diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
index 44815af41f..035568a085 100644
--- a/hw/arm/Kconfig
+++ b/hw/arm/Kconfig
@@ -366,6 +366,7 @@ config ALLWINNER_R40
 config MAX78000_SOC
     bool
     select ARM_V7M
+    select MAX78000_ICC
 
 config RASPI
     bool
diff --git a/hw/misc/Kconfig b/hw/misc/Kconfig
index ec0fa5aa9f..781bcf74cc 100644
--- a/hw/misc/Kconfig
+++ b/hw/misc/Kconfig
@@ -47,6 +47,9 @@ config A9SCU
 config ARM11SCU
     bool
 
+config MAX78000_ICC
+    bool
+
 config MOS6522
     bool
 
diff --git a/hw/misc/max78000_icc.c b/hw/misc/max78000_icc.c
new file mode 100644
index 0000000000..6f7d2b20bf
--- /dev/null
+++ b/hw/misc/max78000_icc.c
@@ -0,0 +1,120 @@
+/*
+ * MAX78000 Instruction Cache
+ *
+ * Copyright (c) 2025 Jackson Donaldson <jcksn@duck.com>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "trace.h"
+#include "hw/irq.h"
+#include "migration/vmstate.h"
+#include "hw/misc/max78000_icc.h"
+
+
+static uint64_t max78000_icc_read(void *opaque, hwaddr addr,
+                                    unsigned int size)
+{
+    Max78000IccState *s = opaque;
+    switch (addr) {
+    case ICC_INFO:
+        return s->info;
+
+    case ICC_SZ:
+        return s->sz;
+
+    case ICC_CTRL:
+        return s->ctrl;
+
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: Bad offset 0x%" HWADDR_PRIx "\n",
+                      __func__, addr);
+        return 0;
+
+    }
+}
+
+static void max78000_icc_write(void *opaque, hwaddr addr,
+                    uint64_t val64, unsigned int size)
+{
+    Max78000IccState *s = opaque;
+
+    switch (addr) {
+    case ICC_CTRL:
+        s->ctrl = 0x10000 | (val64 & 1);
+        break;
+
+    case ICC_INVALIDATE:
+        break;
+
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: Bad offset 0x%" HWADDR_PRIx "\n",
+                      __func__, addr);
+        break;
+    }
+}
+
+static const MemoryRegionOps max78000_icc_ops = {
+    .read = max78000_icc_read,
+    .write = max78000_icc_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+    .valid.min_access_size = 4,
+    .valid.max_access_size = 4,
+};
+
+static const VMStateDescription max78000_icc_vmstate = {
+    .name = TYPE_MAX78000_ICC,
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (const VMStateField[]) {
+        VMSTATE_UINT32(info, Max78000IccState),
+        VMSTATE_UINT32(sz, Max78000IccState),
+        VMSTATE_UINT32(ctrl, Max78000IccState),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static void max78000_icc_reset_hold(Object *obj, ResetType type)
+{
+    Max78000IccState *s = MAX78000_ICC(obj);
+    s->info = 0;
+    s->sz = 0x10000010;
+    s->ctrl = 0x10000;
+}
+
+static void max78000_icc_init(Object *obj)
+{
+    Max78000IccState *s = MAX78000_ICC(obj);
+
+    memory_region_init_io(&s->mmio, obj, &max78000_icc_ops, s,
+                        TYPE_MAX78000_ICC, 0x800);
+    sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
+}
+
+static void max78000_icc_class_init(ObjectClass *klass, const void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    ResettableClass *rc = RESETTABLE_CLASS(klass);
+
+    rc->phases.hold = max78000_icc_reset_hold;
+    dc->vmsd = &max78000_icc_vmstate;
+}
+
+static const TypeInfo max78000_icc_info = {
+    .name          = TYPE_MAX78000_ICC,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(Max78000IccState),
+    .instance_init = max78000_icc_init,
+    .class_init    = max78000_icc_class_init,
+};
+
+static void max78000_icc_register_types(void)
+{
+    type_register_static(&max78000_icc_info);
+}
+
+type_init(max78000_icc_register_types)
diff --git a/hw/misc/meson.build b/hw/misc/meson.build
index 6d47de482c..a21a994ff8 100644
--- a/hw/misc/meson.build
+++ b/hw/misc/meson.build
@@ -70,6 +70,7 @@ system_ss.add(when: 'CONFIG_IMX', if_true: files(
   'imx_ccm.c',
   'imx_rngc.c',
 ))
+system_ss.add(when: 'CONFIG_MAX78000_ICC', if_true: files('max78000_icc.c'))
 system_ss.add(when: 'CONFIG_NPCM7XX', if_true: files(
   'npcm_clk.c',
   'npcm_gcr.c',
diff --git a/include/hw/misc/max78000_icc.h b/include/hw/misc/max78000_icc.h
new file mode 100644
index 0000000000..6fe2bb7a15
--- /dev/null
+++ b/include/hw/misc/max78000_icc.h
@@ -0,0 +1,33 @@
+/*
+ * MAX78000 Instruction Cache
+ *
+ * Copyright (c) 2025 Jackson Donaldson <jcksn@duck.com>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef HW_MAX78000_ICC_H
+#define HW_MAX78000_ICC_H
+
+#include "hw/sysbus.h"
+#include "qom/object.h"
+
+#define TYPE_MAX78000_ICC "max78000-icc"
+OBJECT_DECLARE_SIMPLE_TYPE(Max78000IccState, MAX78000_ICC)
+
+#define ICC_INFO       0x0
+#define ICC_SZ         0x4
+#define ICC_CTRL       0x100
+#define ICC_INVALIDATE 0x700
+
+struct Max78000IccState {
+    SysBusDevice parent_obj;
+
+    MemoryRegion mmio;
+
+    uint32_t info;
+    uint32_t sz;
+    uint32_t ctrl;
+};
+
+#endif

From 65714d3e6c384956537c43ee9a58f2e4ebfdd883 Mon Sep 17 00:00:00 2001
From: Jackson Donaldson <jackson88044@gmail.com>
Date: Fri, 4 Jul 2025 18:32:31 -0400
Subject: [PATCH 2057/2760] MAX78000: Add ICC to SOC

This commit adds the instruction cache controller
to max78000_soc

Signed-off-by: Jackson Donaldson <jcksn@duck.com>
Reviewed-by: Peter Maydell <petermaydell@linaro.org>
Message-id: 20250704223239.248781-4-jcksn@duck.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/max78000_soc.c         | 20 ++++++++++++++++----
 include/hw/arm/max78000_soc.h |  6 ++++++
 2 files changed, 22 insertions(+), 4 deletions(-)

diff --git a/hw/arm/max78000_soc.c b/hw/arm/max78000_soc.c
index 9676ada6a2..0c83b08eca 100644
--- a/hw/arm/max78000_soc.c
+++ b/hw/arm/max78000_soc.c
@@ -17,12 +17,20 @@
 #include "hw/qdev-clock.h"
 #include "hw/misc/unimp.h"
 
+static const uint32_t max78000_icc_addr[] = {0x4002a000, 0x4002a800};
+
 static void max78000_soc_initfn(Object *obj)
 {
     MAX78000State *s = MAX78000_SOC(obj);
+    int i;
 
     object_initialize_child(obj, "armv7m", &s->armv7m, TYPE_ARMV7M);
 
+    for (i = 0; i < MAX78000_NUM_ICC; i++) {
+        g_autofree char *name = g_strdup_printf("icc%d", i);
+        object_initialize_child(obj, name, &s->icc[i], TYPE_MAX78000_ICC);
+    }
+
     s->sysclk = qdev_init_clock_in(DEVICE(s), "sysclk", NULL, NULL, 0);
 }
 
@@ -30,8 +38,9 @@ static void max78000_soc_realize(DeviceState *dev_soc, Error **errp)
 {
     MAX78000State *s = MAX78000_SOC(dev_soc);
     MemoryRegion *system_memory = get_system_memory();
-    DeviceState *armv7m;
+    DeviceState *dev, *armv7m;
     Error *err = NULL;
+    int i;
 
     if (!clock_has_source(s->sysclk)) {
         error_setg(errp, "sysclk clock must be wired up by the board code");
@@ -74,6 +83,12 @@ static void max78000_soc_realize(DeviceState *dev_soc, Error **errp)
         return;
     }
 
+    for (i = 0; i < MAX78000_NUM_ICC; i++) {
+        dev = DEVICE(&(s->icc[i]));
+        sysbus_realize(SYS_BUS_DEVICE(dev), errp);
+        sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, max78000_icc_addr[i]);
+    }
+
     create_unimplemented_device("globalControl",        0x40000000, 0x400);
     create_unimplemented_device("systemInterface",      0x40000400, 0x400);
     create_unimplemented_device("functionControl",      0x40000800, 0x400);
@@ -107,9 +122,6 @@ static void max78000_soc_realize(DeviceState *dev_soc, Error **errp)
     create_unimplemented_device("standardDMA",          0x40028000, 0x1000);
     create_unimplemented_device("flashController0",     0x40029000, 0x400);
 
-    create_unimplemented_device("icc0",                 0x4002a000, 0x800);
-    create_unimplemented_device("icc1",                 0x4002a800, 0x800);
-
     create_unimplemented_device("adc",                  0x40034000, 0x1000);
     create_unimplemented_device("pulseTrainEngine",     0x4003c000, 0xa0);
     create_unimplemented_device("oneWireMaster",        0x4003d000, 0x1000);
diff --git a/include/hw/arm/max78000_soc.h b/include/hw/arm/max78000_soc.h
index 97bf4099c9..27b506d6ee 100644
--- a/include/hw/arm/max78000_soc.h
+++ b/include/hw/arm/max78000_soc.h
@@ -11,6 +11,7 @@
 
 #include "hw/or-irq.h"
 #include "hw/arm/armv7m.h"
+#include "hw/misc/max78000_icc.h"
 #include "qom/object.h"
 
 #define TYPE_MAX78000_SOC "max78000-soc"
@@ -21,6 +22,9 @@ OBJECT_DECLARE_SIMPLE_TYPE(MAX78000State, MAX78000_SOC)
 #define SRAM_BASE_ADDRESS 0x20000000
 #define SRAM_SIZE (128 * 1024)
 
+/* The MAX78k has 2 instruction caches; only icc0 matters, icc1 is for RISC */
+#define MAX78000_NUM_ICC 2
+
 struct MAX78000State {
     SysBusDevice parent_obj;
 
@@ -29,6 +33,8 @@ struct MAX78000State {
     MemoryRegion sram;
     MemoryRegion flash;
 
+    Max78000IccState icc[MAX78000_NUM_ICC];
+
     Clock *sysclk;
 };
 

From d447e4b70295bb7a11715230f56ccea7d8b3b797 Mon Sep 17 00:00:00 2001
From: Jackson Donaldson <jackson88044@gmail.com>
Date: Fri, 4 Jul 2025 18:32:32 -0400
Subject: [PATCH 2058/2760] MAX78000: UART Implementation

This commit implements UART support for the MAX78000

Signed-off-by: Jackson Donaldson <jcksn@duck.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20250704223239.248781-5-jcksn@duck.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/Kconfig                  |   1 +
 hw/char/Kconfig                 |   3 +
 hw/char/max78000_uart.c         | 285 ++++++++++++++++++++++++++++++++
 hw/char/meson.build             |   1 +
 include/hw/char/max78000_uart.h |  78 +++++++++
 5 files changed, 368 insertions(+)
 create mode 100644 hw/char/max78000_uart.c
 create mode 100644 include/hw/char/max78000_uart.h

diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
index 035568a085..7e3610dca8 100644
--- a/hw/arm/Kconfig
+++ b/hw/arm/Kconfig
@@ -367,6 +367,7 @@ config MAX78000_SOC
     bool
     select ARM_V7M
     select MAX78000_ICC
+    select MAX78000_UART
 
 config RASPI
     bool
diff --git a/hw/char/Kconfig b/hw/char/Kconfig
index 9d517f3e28..020c0a84bb 100644
--- a/hw/char/Kconfig
+++ b/hw/char/Kconfig
@@ -48,6 +48,9 @@ config VIRTIO_SERIAL
     default y
     depends on VIRTIO
 
+config MAX78000_UART
+    bool
+
 config STM32F2XX_USART
     bool
 
diff --git a/hw/char/max78000_uart.c b/hw/char/max78000_uart.c
new file mode 100644
index 0000000000..19506d52ef
--- /dev/null
+++ b/hw/char/max78000_uart.c
@@ -0,0 +1,285 @@
+/*
+ * MAX78000 UART
+ *
+ * Copyright (c) 2025 Jackson Donaldson <jcksn@duck.com>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "hw/char/max78000_uart.h"
+#include "hw/irq.h"
+#include "hw/qdev-properties.h"
+#include "hw/qdev-properties-system.h"
+#include "qemu/log.h"
+#include "qemu/module.h"
+#include "migration/vmstate.h"
+#include "trace.h"
+
+
+static int max78000_uart_can_receive(void *opaque)
+{
+    Max78000UartState *s = opaque;
+    if (!(s->ctrl & UART_BCLKEN)) {
+        return 0;
+    }
+    return fifo8_num_free(&s->rx_fifo);
+}
+
+static void max78000_update_irq(Max78000UartState *s)
+{
+    int interrupt_level;
+
+    interrupt_level = s->int_fl & s->int_en;
+    qemu_set_irq(s->irq, interrupt_level);
+}
+
+static void max78000_uart_receive(void *opaque, const uint8_t *buf, int size)
+{
+    Max78000UartState *s = opaque;
+
+    assert(size <= fifo8_num_free(&s->rx_fifo));
+
+    fifo8_push_all(&s->rx_fifo, buf, size);
+
+    uint32_t rx_threshold = s->ctrl & 0xf;
+
+    if (fifo8_num_used(&s->rx_fifo) >= rx_threshold) {
+        s->int_fl |= UART_RX_THD;
+    }
+
+    max78000_update_irq(s);
+}
+
+static void max78000_uart_reset_hold(Object *obj, ResetType type)
+{
+    Max78000UartState *s = MAX78000_UART(obj);
+
+    s->ctrl = 0;
+    s->status = UART_TX_EM | UART_RX_EM;
+    s->int_en = 0;
+    s->int_fl = 0;
+    s->osr = 0;
+    s->txpeek = 0;
+    s->pnr = UART_RTS;
+    s->fifo = 0;
+    s->dma = 0;
+    s->wken = 0;
+    s->wkfl = 0;
+    fifo8_reset(&s->rx_fifo);
+}
+
+static uint64_t max78000_uart_read(void *opaque, hwaddr addr,
+                                       unsigned int size)
+{
+    Max78000UartState *s = opaque;
+    uint64_t retvalue = 0;
+    switch (addr) {
+    case UART_CTRL:
+        retvalue = s->ctrl;
+        break;
+    case UART_STATUS:
+        retvalue = (fifo8_num_used(&s->rx_fifo) << UART_RX_LVL) |
+                    UART_TX_EM |
+                    (fifo8_is_empty(&s->rx_fifo) ? UART_RX_EM : 0);
+        break;
+    case UART_INT_EN:
+        retvalue = s->int_en;
+        break;
+    case UART_INT_FL:
+        retvalue = s->int_fl;
+        break;
+    case UART_CLKDIV:
+        retvalue = s->clkdiv;
+        break;
+    case UART_OSR:
+        retvalue = s->osr;
+        break;
+    case UART_TXPEEK:
+        if (!fifo8_is_empty(&s->rx_fifo)) {
+            retvalue = fifo8_peek(&s->rx_fifo);
+        }
+        break;
+    case UART_PNR:
+        retvalue = s->pnr;
+        break;
+    case UART_FIFO:
+        if (!fifo8_is_empty(&s->rx_fifo)) {
+            retvalue = fifo8_pop(&s->rx_fifo);
+            max78000_update_irq(s);
+        }
+        break;
+    case UART_DMA:
+        /* DMA not implemented */
+        retvalue = s->dma;
+        break;
+    case UART_WKEN:
+        retvalue = s->wken;
+        break;
+    case UART_WKFL:
+        retvalue = s->wkfl;
+        break;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+            "%s: Bad offset 0x%"HWADDR_PRIx"\n", __func__, addr);
+        break;
+    }
+
+    return retvalue;
+}
+
+static void max78000_uart_write(void *opaque, hwaddr addr,
+                                  uint64_t val64, unsigned int size)
+{
+    Max78000UartState *s = opaque;
+
+    uint32_t value = val64;
+    uint8_t data;
+
+    switch (addr) {
+    case UART_CTRL:
+        if (value & UART_FLUSH_RX) {
+            fifo8_reset(&s->rx_fifo);
+        }
+        if (value & UART_BCLKEN) {
+            value = value | UART_BCLKRDY;
+        }
+        s->ctrl = value & ~(UART_FLUSH_RX | UART_FLUSH_TX);
+
+        /*
+         * Software can manage UART flow control manually by setting hfc_en
+         * in UART_CTRL. This would require emulating uart at a lower level,
+         * and is currently unimplemented.
+         */
+
+        return;
+    case UART_STATUS:
+        /* UART_STATUS is read only */
+        return;
+    case UART_INT_EN:
+        s->int_en = value;
+        return;
+    case UART_INT_FL:
+        s->int_fl = s->int_fl & ~(value);
+        max78000_update_irq(s);
+        return;
+    case UART_CLKDIV:
+        s->clkdiv = value;
+        return;
+    case UART_OSR:
+        s->osr = value;
+        return;
+    case UART_PNR:
+        s->pnr = value;
+        return;
+    case UART_FIFO:
+        data = value & 0xff;
+        /*
+         * XXX this blocks entire thread. Rewrite to use
+         * qemu_chr_fe_write and background I/O callbacks
+         */
+        qemu_chr_fe_write_all(&s->chr, &data, 1);
+
+        /* TX is always empty */
+        s->int_fl |= UART_TX_HE;
+        max78000_update_irq(s);
+
+        return;
+    case UART_DMA:
+        /* DMA not implemented */
+        s->dma = value;
+        return;
+    case UART_WKEN:
+        s->wken = value;
+        return;
+    case UART_WKFL:
+        s->wkfl = value;
+        return;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%"
+            HWADDR_PRIx "\n", __func__, addr);
+    }
+}
+
+static const MemoryRegionOps max78000_uart_ops = {
+    .read = max78000_uart_read,
+    .write = max78000_uart_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+    .valid.min_access_size = 4,
+    .valid.max_access_size = 4,
+};
+
+static const Property max78000_uart_properties[] = {
+    DEFINE_PROP_CHR("chardev", Max78000UartState, chr),
+};
+
+static const VMStateDescription max78000_uart_vmstate = {
+    .name = TYPE_MAX78000_UART,
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32(ctrl, Max78000UartState),
+        VMSTATE_UINT32(status, Max78000UartState),
+        VMSTATE_UINT32(int_en, Max78000UartState),
+        VMSTATE_UINT32(int_fl, Max78000UartState),
+        VMSTATE_UINT32(clkdiv, Max78000UartState),
+        VMSTATE_UINT32(osr, Max78000UartState),
+        VMSTATE_UINT32(txpeek, Max78000UartState),
+        VMSTATE_UINT32(pnr, Max78000UartState),
+        VMSTATE_UINT32(fifo, Max78000UartState),
+        VMSTATE_UINT32(dma, Max78000UartState),
+        VMSTATE_UINT32(wken, Max78000UartState),
+        VMSTATE_UINT32(wkfl, Max78000UartState),
+        VMSTATE_FIFO8(rx_fifo, Max78000UartState),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static void max78000_uart_init(Object *obj)
+{
+    Max78000UartState *s = MAX78000_UART(obj);
+    fifo8_create(&s->rx_fifo, 8);
+
+    sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->irq);
+
+    memory_region_init_io(&s->mmio, obj, &max78000_uart_ops, s,
+                          TYPE_MAX78000_UART, 0x400);
+    sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
+}
+
+static void max78000_uart_realize(DeviceState *dev, Error **errp)
+{
+    Max78000UartState *s = MAX78000_UART(dev);
+
+    qemu_chr_fe_set_handlers(&s->chr, max78000_uart_can_receive,
+                             max78000_uart_receive, NULL, NULL,
+                             s, NULL, true);
+}
+
+static void max78000_uart_class_init(ObjectClass *klass, const void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    ResettableClass *rc = RESETTABLE_CLASS(klass);
+
+    rc->phases.hold = max78000_uart_reset_hold;
+
+    device_class_set_props(dc, max78000_uart_properties);
+    dc->realize = max78000_uart_realize;
+
+    dc->vmsd = &max78000_uart_vmstate;
+}
+
+static const TypeInfo max78000_uart_info = {
+    .name          = TYPE_MAX78000_UART,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(Max78000UartState),
+    .instance_init = max78000_uart_init,
+    .class_init    = max78000_uart_class_init,
+};
+
+static void max78000_uart_register_types(void)
+{
+    type_register_static(&max78000_uart_info);
+}
+
+type_init(max78000_uart_register_types)
diff --git a/hw/char/meson.build b/hw/char/meson.build
index 4e439da8b9..a9e1dc26c0 100644
--- a/hw/char/meson.build
+++ b/hw/char/meson.build
@@ -26,6 +26,7 @@ system_ss.add(when: 'CONFIG_AVR_USART', if_true: files('avr_usart.c'))
 system_ss.add(when: 'CONFIG_COLDFIRE', if_true: files('mcf_uart.c'))
 system_ss.add(when: 'CONFIG_DIGIC', if_true: files('digic-uart.c'))
 system_ss.add(when: 'CONFIG_EXYNOS4', if_true: files('exynos4210_uart.c'))
+system_ss.add(when: 'CONFIG_MAX78000_UART', if_true: files('max78000_uart.c'))
 system_ss.add(when: 'CONFIG_OMAP', if_true: files('omap_uart.c'))
 system_ss.add(when: 'CONFIG_RASPI', if_true: files('bcm2835_aux.c'))
 system_ss.add(when: 'CONFIG_RENESAS_SCI', if_true: files('renesas_sci.c'))
diff --git a/include/hw/char/max78000_uart.h b/include/hw/char/max78000_uart.h
new file mode 100644
index 0000000000..cf90d51dbf
--- /dev/null
+++ b/include/hw/char/max78000_uart.h
@@ -0,0 +1,78 @@
+/*
+ * MAX78000 UART
+ *
+ * Copyright (c) 2025 Jackson Donaldson <jcksn@duck.com>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef HW_MAX78000_UART_H
+#define HW_MAX78000_UART_H
+
+#include "hw/sysbus.h"
+#include "chardev/char-fe.h"
+#include "qemu/fifo8.h"
+#include "qom/object.h"
+
+#define UART_CTRL       0x0
+#define UART_STATUS     0x4
+#define UART_INT_EN     0x8
+#define UART_INT_FL     0xc
+#define UART_CLKDIV     0x10
+#define UART_OSR        0x14
+#define UART_TXPEEK     0x18
+#define UART_PNR        0x1c
+#define UART_FIFO       0x20
+#define UART_DMA        0x30
+#define UART_WKEN       0x34
+#define UART_WKFL       0x38
+
+/* CTRL */
+#define UART_CTF_DIS    (1 << 7)
+#define UART_FLUSH_TX   (1 << 8)
+#define UART_FLUSH_RX   (1 << 9)
+#define UART_BCLKEN     (1 << 15)
+#define UART_BCLKRDY    (1 << 19)
+
+/* STATUS */
+#define UART_RX_LVL     8
+#define UART_TX_EM      (1 << 6)
+#define UART_RX_FULL    (1 << 5)
+#define UART_RX_EM      (1 << 4)
+
+/* PNR (Pin Control Register) */
+#define UART_CTS        1
+#define UART_RTS        (1 << 1)
+
+/* INT_EN / INT_FL */
+#define UART_RX_THD     (1 << 4)
+#define UART_TX_HE      (1 << 6)
+
+#define UART_RXBUFLEN   0x100
+#define TYPE_MAX78000_UART "max78000-uart"
+OBJECT_DECLARE_SIMPLE_TYPE(Max78000UartState, MAX78000_UART)
+
+struct Max78000UartState {
+    SysBusDevice parent_obj;
+
+    MemoryRegion mmio;
+
+    uint32_t ctrl;
+    uint32_t status;
+    uint32_t int_en;
+    uint32_t int_fl;
+    uint32_t clkdiv;
+    uint32_t osr;
+    uint32_t txpeek;
+    uint32_t pnr;
+    uint32_t fifo;
+    uint32_t dma;
+    uint32_t wken;
+    uint32_t wkfl;
+
+    Fifo8 rx_fifo;
+
+    CharBackend chr;
+    qemu_irq irq;
+};
+#endif /* HW_STM32F2XX_USART_H */

From a670bb8a729945117fc0e8b357e02a311945cb74 Mon Sep 17 00:00:00 2001
From: Jackson Donaldson <jackson88044@gmail.com>
Date: Fri, 4 Jul 2025 18:32:33 -0400
Subject: [PATCH 2059/2760] MAX78000: Add UART to SOC

This commit adds UART to max78000_soc

Signed-off-by: Jackson Donaldson <jcksn@duck.com>
Reviewed-by: Peter Maydell <petermaydell@linaro.org>
Message-id: 20250704223239.248781-6-jcksn@duck.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/max78000_soc.c         | 28 ++++++++++++++++++++++++----
 include/hw/arm/max78000_soc.h |  3 +++
 2 files changed, 27 insertions(+), 4 deletions(-)

diff --git a/hw/arm/max78000_soc.c b/hw/arm/max78000_soc.c
index 0c83b08eca..2f93ab882d 100644
--- a/hw/arm/max78000_soc.c
+++ b/hw/arm/max78000_soc.c
@@ -18,6 +18,10 @@
 #include "hw/misc/unimp.h"
 
 static const uint32_t max78000_icc_addr[] = {0x4002a000, 0x4002a800};
+static const uint32_t max78000_uart_addr[] = {0x40042000, 0x40043000,
+                                              0x40044000};
+
+static const int max78000_uart_irq[] = {14, 15, 34};
 
 static void max78000_soc_initfn(Object *obj)
 {
@@ -31,6 +35,12 @@ static void max78000_soc_initfn(Object *obj)
         object_initialize_child(obj, name, &s->icc[i], TYPE_MAX78000_ICC);
     }
 
+    for (i = 0; i < MAX78000_NUM_UART; i++) {
+        g_autofree char *name = g_strdup_printf("uart%d", i);
+        object_initialize_child(obj, name, &s->uart[i],
+                                TYPE_MAX78000_UART);
+    }
+
     s->sysclk = qdev_init_clock_in(DEVICE(s), "sysclk", NULL, NULL, 0);
 }
 
@@ -39,6 +49,7 @@ static void max78000_soc_realize(DeviceState *dev_soc, Error **errp)
     MAX78000State *s = MAX78000_SOC(dev_soc);
     MemoryRegion *system_memory = get_system_memory();
     DeviceState *dev, *armv7m;
+    SysBusDevice *busdev;
     Error *err = NULL;
     int i;
 
@@ -89,6 +100,19 @@ static void max78000_soc_realize(DeviceState *dev_soc, Error **errp)
         sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, max78000_icc_addr[i]);
     }
 
+    for (i = 0; i < MAX78000_NUM_UART; i++) {
+        dev = DEVICE(&(s->uart[i]));
+        qdev_prop_set_chr(dev, "chardev", serial_hd(i));
+        if (!sysbus_realize(SYS_BUS_DEVICE(&s->uart[i]), errp)) {
+            return;
+        }
+
+        busdev = SYS_BUS_DEVICE(dev);
+        sysbus_mmio_map(busdev, 0, max78000_uart_addr[i]);
+        sysbus_connect_irq(busdev, 0, qdev_get_gpio_in(armv7m,
+                                                       max78000_uart_irq[i]));
+    }
+
     create_unimplemented_device("globalControl",        0x40000000, 0x400);
     create_unimplemented_device("systemInterface",      0x40000400, 0x400);
     create_unimplemented_device("functionControl",      0x40000800, 0x400);
@@ -127,10 +151,6 @@ static void max78000_soc_realize(DeviceState *dev_soc, Error **errp)
     create_unimplemented_device("oneWireMaster",        0x4003d000, 0x1000);
     create_unimplemented_device("semaphore",            0x4003e000, 0x1000);
 
-    create_unimplemented_device("uart0",                0x40042000, 0x1000);
-    create_unimplemented_device("uart1",                0x40043000, 0x1000);
-    create_unimplemented_device("uart2",                0x40044000, 0x1000);
-
     create_unimplemented_device("spi1",                 0x40046000, 0x2000);
     create_unimplemented_device("trng",                 0x4004d000, 0x1000);
     create_unimplemented_device("i2s",                  0x40060000, 0x1000);
diff --git a/include/hw/arm/max78000_soc.h b/include/hw/arm/max78000_soc.h
index 27b506d6ee..57894f0035 100644
--- a/include/hw/arm/max78000_soc.h
+++ b/include/hw/arm/max78000_soc.h
@@ -12,6 +12,7 @@
 #include "hw/or-irq.h"
 #include "hw/arm/armv7m.h"
 #include "hw/misc/max78000_icc.h"
+#include "hw/char/max78000_uart.h"
 #include "qom/object.h"
 
 #define TYPE_MAX78000_SOC "max78000-soc"
@@ -24,6 +25,7 @@ OBJECT_DECLARE_SIMPLE_TYPE(MAX78000State, MAX78000_SOC)
 
 /* The MAX78k has 2 instruction caches; only icc0 matters, icc1 is for RISC */
 #define MAX78000_NUM_ICC 2
+#define MAX78000_NUM_UART 3
 
 struct MAX78000State {
     SysBusDevice parent_obj;
@@ -34,6 +36,7 @@ struct MAX78000State {
     MemoryRegion flash;
 
     Max78000IccState icc[MAX78000_NUM_ICC];
+    Max78000UartState uart[MAX78000_NUM_UART];
 
     Clock *sysclk;
 };

From a017f53e093a9018e33fb33bbdaa322c2de3dbe7 Mon Sep 17 00:00:00 2001
From: Jackson Donaldson <jackson88044@gmail.com>
Date: Fri, 4 Jul 2025 18:32:34 -0400
Subject: [PATCH 2060/2760] MAX78000: GCR Implementation

This commit implements the Global Control Register
for the MAX78000

Signed-off-by: Jackson Donaldson <jcksn@duck.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20250704223239.248781-7-jcksn@duck.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/Kconfig                 |   1 +
 hw/misc/Kconfig                |   3 +
 hw/misc/max78000_gcr.c         | 339 +++++++++++++++++++++++++++++++++
 hw/misc/meson.build            |   1 +
 include/hw/misc/max78000_gcr.h | 129 +++++++++++++
 5 files changed, 473 insertions(+)
 create mode 100644 hw/misc/max78000_gcr.c
 create mode 100644 include/hw/misc/max78000_gcr.h

diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
index 7e3610dca8..a96349ee11 100644
--- a/hw/arm/Kconfig
+++ b/hw/arm/Kconfig
@@ -368,6 +368,7 @@ config MAX78000_SOC
     select ARM_V7M
     select MAX78000_ICC
     select MAX78000_UART
+    select MAX78000_GCR
 
 config RASPI
     bool
diff --git a/hw/misc/Kconfig b/hw/misc/Kconfig
index 781bcf74cc..fde2266b8f 100644
--- a/hw/misc/Kconfig
+++ b/hw/misc/Kconfig
@@ -47,6 +47,9 @@ config A9SCU
 config ARM11SCU
     bool
 
+config MAX78000_GCR
+    bool
+
 config MAX78000_ICC
     bool
 
diff --git a/hw/misc/max78000_gcr.c b/hw/misc/max78000_gcr.c
new file mode 100644
index 0000000000..8c282f3916
--- /dev/null
+++ b/hw/misc/max78000_gcr.c
@@ -0,0 +1,339 @@
+/*
+ * MAX78000 Global Control Registers
+ *
+ * Copyright (c) 2025 Jackson Donaldson <jcksn@duck.com>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "trace.h"
+#include "hw/irq.h"
+#include "system/runstate.h"
+#include "migration/vmstate.h"
+#include "hw/qdev-properties.h"
+#include "hw/char/max78000_uart.h"
+#include "hw/misc/max78000_gcr.h"
+
+
+static void max78000_gcr_reset_hold(Object *obj, ResetType type)
+{
+    DeviceState *dev = DEVICE(obj);
+    Max78000GcrState *s = MAX78000_GCR(dev);
+    s->sysctrl = 0x21002;
+    s->rst0 = 0;
+    /* All clocks are always ready */
+    s->clkctrl = 0x3e140008;
+    s->pm = 0x3f000;
+    s->pclkdiv = 0;
+    s->pclkdis0 = 0xffffffff;
+    s->memctrl = 0x5;
+    s->memz = 0;
+    s->sysst = 0;
+    s->rst1 = 0;
+    s->pckdis1 = 0xffffffff;
+    s->eventen = 0;
+    s->revision = 0xa1;
+    s->sysie = 0;
+    s->eccerr = 0;
+    s->ecced = 0;
+    s->eccie = 0;
+    s->eccaddr = 0;
+}
+
+static uint64_t max78000_gcr_read(void *opaque, hwaddr addr,
+                                     unsigned int size)
+{
+    Max78000GcrState *s = opaque;
+
+    switch (addr) {
+    case SYSCTRL:
+        return s->sysctrl;
+
+    case RST0:
+        return s->rst0;
+
+    case CLKCTRL:
+        return s->clkctrl;
+
+    case PM:
+        return s->pm;
+
+    case PCLKDIV:
+        return s->pclkdiv;
+
+    case PCLKDIS0:
+        return s->pclkdis0;
+
+    case MEMCTRL:
+        return s->memctrl;
+
+    case MEMZ:
+        return s->memz;
+
+    case SYSST:
+        return s->sysst;
+
+    case RST1:
+        return s->rst1;
+
+    case PCKDIS1:
+        return s->pckdis1;
+
+    case EVENTEN:
+        return s->eventen;
+
+    case REVISION:
+        return s->revision;
+
+    case SYSIE:
+        return s->sysie;
+
+    case ECCERR:
+        return s->eccerr;
+
+    case ECCED:
+        return s->ecced;
+
+    case ECCIE:
+        return s->eccie;
+
+    case ECCADDR:
+        return s->eccaddr;
+
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%"
+            HWADDR_PRIx "\n", __func__, addr);
+        return 0;
+
+    }
+}
+
+static void max78000_gcr_write(void *opaque, hwaddr addr,
+                       uint64_t val64, unsigned int size)
+{
+    Max78000GcrState *s = opaque;
+    uint32_t val = val64;
+    uint8_t zero[0xc000] = {0};
+    switch (addr) {
+    case SYSCTRL:
+        /* Checksum calculations always pass immediately */
+        s->sysctrl = (val & 0x30000) | 0x1002;
+        break;
+
+    case RST0:
+        if (val & SYSTEM_RESET) {
+            qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
+        }
+        if (val & PERIPHERAL_RESET) {
+            /*
+             * Peripheral reset resets all peripherals. The CPU
+             * retains its state. The GPIO, watchdog timers, AoD,
+             * RAM retention, and general control registers (GCR),
+             * including the clock configuration, are unaffected.
+             */
+            val = UART2_RESET | UART1_RESET | UART0_RESET |
+                    ADC_RESET | CNN_RESET | TRNG_RESET |
+                    RTC_RESET | I2C0_RESET | SPI1_RESET |
+                    TMR3_RESET | TMR2_RESET | TMR1_RESET |
+                    TMR0_RESET | WDT0_RESET | DMA_RESET;
+        }
+        if (val & SOFT_RESET) {
+            /* Soft reset also resets GPIO */
+            val = UART2_RESET | UART1_RESET | UART0_RESET |
+                    ADC_RESET | CNN_RESET | TRNG_RESET |
+                    RTC_RESET | I2C0_RESET | SPI1_RESET |
+                    TMR3_RESET | TMR2_RESET | TMR1_RESET |
+                    TMR0_RESET | GPIO1_RESET | GPIO0_RESET |
+                    DMA_RESET;
+        }
+        if (val & UART2_RESET) {
+            device_cold_reset(s->uart2);
+        }
+        if (val & UART1_RESET) {
+            device_cold_reset(s->uart1);
+        }
+        if (val & UART0_RESET) {
+            device_cold_reset(s->uart0);
+        }
+        /* TODO: As other devices are implemented, add them here */
+        break;
+
+    case CLKCTRL:
+        s->clkctrl = val | SYSCLK_RDY;
+        break;
+
+    case PM:
+        s->pm = val;
+        break;
+
+    case PCLKDIV:
+        s->pclkdiv = val;
+        break;
+
+    case PCLKDIS0:
+        s->pclkdis0 = val;
+        break;
+
+    case MEMCTRL:
+        s->memctrl = val;
+        break;
+
+    case MEMZ:
+        if (val & ram0) {
+            address_space_write(&s->sram_as, SYSRAM0_START,
+                                MEMTXATTRS_UNSPECIFIED, zero, 0x8000);
+        }
+        if (val & ram1) {
+            address_space_write(&s->sram_as, SYSRAM1_START,
+                                MEMTXATTRS_UNSPECIFIED, zero, 0x8000);
+        }
+        if (val & ram2) {
+            address_space_write(&s->sram_as, SYSRAM2_START,
+                                MEMTXATTRS_UNSPECIFIED, zero, 0xC000);
+        }
+        if (val & ram3) {
+            address_space_write(&s->sram_as, SYSRAM3_START,
+                                MEMTXATTRS_UNSPECIFIED, zero, 0x4000);
+        }
+        break;
+
+    case SYSST:
+        s->sysst = val;
+        break;
+
+    case RST1:
+        /* TODO: As other devices are implemented, add them here */
+        s->rst1 = val;
+        break;
+
+    case PCKDIS1:
+        s->pckdis1 = val;
+        break;
+
+    case EVENTEN:
+        s->eventen = val;
+        break;
+
+    case REVISION:
+        s->revision = val;
+        break;
+
+    case SYSIE:
+        s->sysie = val;
+        break;
+
+    case ECCERR:
+        s->eccerr = val;
+        break;
+
+    case ECCED:
+        s->ecced = val;
+        break;
+
+    case ECCIE:
+        s->eccie = val;
+        break;
+
+    case ECCADDR:
+        s->eccaddr = val;
+        break;
+
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%" HWADDR_PRIx "\n",
+                      __func__, addr);
+        break;
+
+    }
+}
+
+static const Property max78000_gcr_properties[] = {
+    DEFINE_PROP_LINK("sram", Max78000GcrState, sram,
+                     TYPE_MEMORY_REGION, MemoryRegion*),
+    DEFINE_PROP_LINK("uart0", Max78000GcrState, uart0,
+                     TYPE_MAX78000_UART, DeviceState*),
+    DEFINE_PROP_LINK("uart1", Max78000GcrState, uart1,
+                     TYPE_MAX78000_UART, DeviceState*),
+    DEFINE_PROP_LINK("uart2", Max78000GcrState, uart2,
+                     TYPE_MAX78000_UART, DeviceState*),
+};
+
+static const MemoryRegionOps max78000_gcr_ops = {
+    .read = max78000_gcr_read,
+    .write = max78000_gcr_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+    .valid.min_access_size = 4,
+    .valid.max_access_size = 4,
+};
+
+static const VMStateDescription vmstate_max78000_gcr = {
+    .name = TYPE_MAX78000_GCR,
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (const VMStateField[]) {
+        VMSTATE_UINT32(sysctrl, Max78000GcrState),
+        VMSTATE_UINT32(rst0, Max78000GcrState),
+        VMSTATE_UINT32(clkctrl, Max78000GcrState),
+        VMSTATE_UINT32(pm, Max78000GcrState),
+        VMSTATE_UINT32(pclkdiv, Max78000GcrState),
+        VMSTATE_UINT32(pclkdis0, Max78000GcrState),
+        VMSTATE_UINT32(memctrl, Max78000GcrState),
+        VMSTATE_UINT32(memz, Max78000GcrState),
+        VMSTATE_UINT32(sysst, Max78000GcrState),
+        VMSTATE_UINT32(rst1, Max78000GcrState),
+        VMSTATE_UINT32(pckdis1, Max78000GcrState),
+        VMSTATE_UINT32(eventen, Max78000GcrState),
+        VMSTATE_UINT32(revision, Max78000GcrState),
+        VMSTATE_UINT32(sysie, Max78000GcrState),
+        VMSTATE_UINT32(eccerr, Max78000GcrState),
+        VMSTATE_UINT32(ecced, Max78000GcrState),
+        VMSTATE_UINT32(eccie, Max78000GcrState),
+        VMSTATE_UINT32(eccaddr, Max78000GcrState),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static void max78000_gcr_init(Object *obj)
+{
+    Max78000GcrState *s = MAX78000_GCR(obj);
+
+    memory_region_init_io(&s->mmio, obj, &max78000_gcr_ops, s,
+                          TYPE_MAX78000_GCR, 0x400);
+    sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
+
+}
+
+static void max78000_gcr_realize(DeviceState *dev, Error **errp)
+{
+    Max78000GcrState *s = MAX78000_GCR(dev);
+
+    address_space_init(&s->sram_as, s->sram, "sram");
+}
+
+static void max78000_gcr_class_init(ObjectClass *klass, const void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    ResettableClass *rc = RESETTABLE_CLASS(klass);
+
+    device_class_set_props(dc, max78000_gcr_properties);
+
+    dc->realize = max78000_gcr_realize;
+    dc->vmsd = &vmstate_max78000_gcr;
+    rc->phases.hold = max78000_gcr_reset_hold;
+}
+
+static const TypeInfo max78000_gcr_info = {
+    .name          = TYPE_MAX78000_GCR,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(Max78000GcrState),
+    .instance_init = max78000_gcr_init,
+    .class_init     = max78000_gcr_class_init,
+};
+
+static void max78000_gcr_register_types(void)
+{
+    type_register_static(&max78000_gcr_info);
+}
+
+type_init(max78000_gcr_register_types)
diff --git a/hw/misc/meson.build b/hw/misc/meson.build
index a21a994ff8..283d06dad4 100644
--- a/hw/misc/meson.build
+++ b/hw/misc/meson.build
@@ -70,6 +70,7 @@ system_ss.add(when: 'CONFIG_IMX', if_true: files(
   'imx_ccm.c',
   'imx_rngc.c',
 ))
+system_ss.add(when: 'CONFIG_MAX78000_GCR', if_true: files('max78000_gcr.c'))
 system_ss.add(when: 'CONFIG_MAX78000_ICC', if_true: files('max78000_icc.c'))
 system_ss.add(when: 'CONFIG_NPCM7XX', if_true: files(
   'npcm_clk.c',
diff --git a/include/hw/misc/max78000_gcr.h b/include/hw/misc/max78000_gcr.h
new file mode 100644
index 0000000000..f04c8a3ee7
--- /dev/null
+++ b/include/hw/misc/max78000_gcr.h
@@ -0,0 +1,129 @@
+/*
+ * MAX78000 Global Control Register
+ *
+ * Copyright (c) 2025 Jackson Donaldson <jcksn@duck.com>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+#ifndef HW_MAX78000_GCR_H
+#define HW_MAX78000_GCR_H
+
+#include "hw/sysbus.h"
+#include "qom/object.h"
+
+#define TYPE_MAX78000_GCR "max78000-gcr"
+OBJECT_DECLARE_SIMPLE_TYPE(Max78000GcrState, MAX78000_GCR)
+
+#define SYSCTRL     0x0
+#define RST0        0x4
+#define CLKCTRL     0x8
+#define PM          0xc
+#define PCLKDIV     0x18
+#define PCLKDIS0    0x24
+#define MEMCTRL     0x28
+#define MEMZ        0x2c
+#define SYSST       0x40
+#define RST1        0x44
+#define PCKDIS1     0x48
+#define EVENTEN     0x4c
+#define REVISION    0x50
+#define SYSIE       0x54
+#define ECCERR      0x64
+#define ECCED       0x68
+#define ECCIE       0x6c
+#define ECCADDR     0x70
+
+/* RST0 */
+#define SYSTEM_RESET (1 << 31)
+#define PERIPHERAL_RESET (1 << 30)
+#define SOFT_RESET (1 << 29)
+#define UART2_RESET (1 << 28)
+
+#define ADC_RESET (1 << 26)
+#define CNN_RESET (1 << 25)
+#define TRNG_RESET (1 << 24)
+
+#define RTC_RESET (1 << 17)
+#define I2C0_RESET (1 << 16)
+
+#define SPI1_RESET (1 << 13)
+#define UART1_RESET (1 << 12)
+#define UART0_RESET (1 << 11)
+
+#define TMR3_RESET (1 << 8)
+#define TMR2_RESET (1 << 7)
+#define TMR1_RESET (1 << 6)
+#define TMR0_RESET (1 << 5)
+
+#define GPIO1_RESET (1 << 3)
+#define GPIO0_RESET (1 << 2)
+#define WDT0_RESET (1 << 1)
+#define DMA_RESET (1 << 0)
+
+/* CLKCTRL */
+#define SYSCLK_RDY (1 << 13)
+
+/* MEMZ */
+#define ram0 (1 << 0)
+#define ram1 (1 << 1)
+#define ram2 (1 << 2)
+#define ram3 (1 << 3)
+
+/* RST1 */
+#define CPU1_RESET (1 << 31)
+
+#define SIMO_RESET (1 << 25)
+#define DVS_RESET (1 << 24)
+
+#define I2C2_RESET (1 << 20)
+#define I2S_RESET (1 << 19)
+
+#define SMPHR_RESET (1 << 16)
+
+#define SPI0_RESET (1 << 11)
+#define AES_RESET (1 << 10)
+#define CRC_RESET (1 << 9)
+
+#define PT_RESET (1 << 1)
+#define I2C1_RESET (1 << 0)
+
+
+#define SYSRAM0_START 0x20000000
+#define SYSRAM1_START 0x20008000
+#define SYSRAM2_START 0x20010000
+#define SYSRAM3_START 0x2001C000
+
+struct Max78000GcrState {
+    SysBusDevice parent_obj;
+
+    MemoryRegion mmio;
+
+    uint32_t sysctrl;
+    uint32_t rst0;
+    uint32_t clkctrl;
+    uint32_t pm;
+    uint32_t pclkdiv;
+    uint32_t pclkdis0;
+    uint32_t memctrl;
+    uint32_t memz;
+    uint32_t sysst;
+    uint32_t rst1;
+    uint32_t pckdis1;
+    uint32_t eventen;
+    uint32_t revision;
+    uint32_t sysie;
+    uint32_t eccerr;
+    uint32_t ecced;
+    uint32_t eccie;
+    uint32_t eccaddr;
+
+    MemoryRegion *sram;
+    AddressSpace sram_as;
+
+    DeviceState *uart0;
+    DeviceState *uart1;
+    DeviceState *uart2;
+
+};
+
+#endif

From 035a38fa97d07b80ff5b9fa6c3da43528770899d Mon Sep 17 00:00:00 2001
From: Jackson Donaldson <jackson88044@gmail.com>
Date: Fri, 4 Jul 2025 18:32:35 -0400
Subject: [PATCH 2061/2760] MAX78000: Add GCR to SOC

This commit adds the Global Control Register to
max78000_soc

Signed-off-by: Jackson Donaldson <jcksn@duck.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20250704223239.248781-8-jcksn@duck.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/max78000_soc.c         | 18 ++++++++++++++++--
 include/hw/arm/max78000_soc.h |  2 ++
 2 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/hw/arm/max78000_soc.c b/hw/arm/max78000_soc.c
index 2f93ab882d..45c6088312 100644
--- a/hw/arm/max78000_soc.c
+++ b/hw/arm/max78000_soc.c
@@ -30,6 +30,8 @@ static void max78000_soc_initfn(Object *obj)
 
     object_initialize_child(obj, "armv7m", &s->armv7m, TYPE_ARMV7M);
 
+    object_initialize_child(obj, "gcr", &s->gcr, TYPE_MAX78000_GCR);
+
     for (i = 0; i < MAX78000_NUM_ICC; i++) {
         g_autofree char *name = g_strdup_printf("icc%d", i);
         object_initialize_child(obj, name, &s->icc[i], TYPE_MAX78000_ICC);
@@ -48,7 +50,7 @@ static void max78000_soc_realize(DeviceState *dev_soc, Error **errp)
 {
     MAX78000State *s = MAX78000_SOC(dev_soc);
     MemoryRegion *system_memory = get_system_memory();
-    DeviceState *dev, *armv7m;
+    DeviceState *dev, *gcrdev, *armv7m;
     SysBusDevice *busdev;
     Error *err = NULL;
     int i;
@@ -69,6 +71,11 @@ static void max78000_soc_realize(DeviceState *dev_soc, Error **errp)
 
     memory_region_init_ram(&s->sram, NULL, "MAX78000.sram", SRAM_SIZE,
                            &err);
+
+    gcrdev = DEVICE(&s->gcr);
+    object_property_set_link(OBJECT(gcrdev), "sram", OBJECT(&s->sram),
+                                 &err);
+
     if (err != NULL) {
         error_propagate(errp, err);
         return;
@@ -101,19 +108,26 @@ static void max78000_soc_realize(DeviceState *dev_soc, Error **errp)
     }
 
     for (i = 0; i < MAX78000_NUM_UART; i++) {
+        g_autofree char *link = g_strdup_printf("uart%d", i);
         dev = DEVICE(&(s->uart[i]));
         qdev_prop_set_chr(dev, "chardev", serial_hd(i));
         if (!sysbus_realize(SYS_BUS_DEVICE(&s->uart[i]), errp)) {
             return;
         }
 
+        object_property_set_link(OBJECT(gcrdev), link, OBJECT(dev),
+                                 &err);
+
         busdev = SYS_BUS_DEVICE(dev);
         sysbus_mmio_map(busdev, 0, max78000_uart_addr[i]);
         sysbus_connect_irq(busdev, 0, qdev_get_gpio_in(armv7m,
                                                        max78000_uart_irq[i]));
     }
 
-    create_unimplemented_device("globalControl",        0x40000000, 0x400);
+    dev = DEVICE(&s->gcr);
+    sysbus_realize(SYS_BUS_DEVICE(dev), errp);
+    sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, 0x40000000);
+
     create_unimplemented_device("systemInterface",      0x40000400, 0x400);
     create_unimplemented_device("functionControl",      0x40000800, 0x400);
     create_unimplemented_device("watchdogTimer0",       0x40003000, 0x400);
diff --git a/include/hw/arm/max78000_soc.h b/include/hw/arm/max78000_soc.h
index 57894f0035..919aca0855 100644
--- a/include/hw/arm/max78000_soc.h
+++ b/include/hw/arm/max78000_soc.h
@@ -11,6 +11,7 @@
 
 #include "hw/or-irq.h"
 #include "hw/arm/armv7m.h"
+#include "hw/misc/max78000_gcr.h"
 #include "hw/misc/max78000_icc.h"
 #include "hw/char/max78000_uart.h"
 #include "qom/object.h"
@@ -35,6 +36,7 @@ struct MAX78000State {
     MemoryRegion sram;
     MemoryRegion flash;
 
+    Max78000GcrState gcr;
     Max78000IccState icc[MAX78000_NUM_ICC];
     Max78000UartState uart[MAX78000_NUM_UART];
 

From 069852d159a18219eb19281b146d612849a84e03 Mon Sep 17 00:00:00 2001
From: Jackson Donaldson <jackson88044@gmail.com>
Date: Fri, 4 Jul 2025 18:32:36 -0400
Subject: [PATCH 2062/2760] MAX78000: TRNG Implementation

This commit implements the True Random Number
Generator for the MAX78000

Signed-off-by: Jackson Donaldson <jcksn@duck.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20250704223239.248781-9-jcksn@duck.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/Kconfig                  |   1 +
 hw/misc/Kconfig                 |   3 +
 hw/misc/max78000_gcr.c          |   6 ++
 hw/misc/max78000_trng.c         | 139 ++++++++++++++++++++++++++++++++
 hw/misc/meson.build             |   1 +
 include/hw/misc/max78000_gcr.h  |   1 +
 include/hw/misc/max78000_trng.h |  35 ++++++++
 7 files changed, 186 insertions(+)
 create mode 100644 hw/misc/max78000_trng.c
 create mode 100644 include/hw/misc/max78000_trng.h

diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
index a96349ee11..c7aae4c9e7 100644
--- a/hw/arm/Kconfig
+++ b/hw/arm/Kconfig
@@ -369,6 +369,7 @@ config MAX78000_SOC
     select MAX78000_ICC
     select MAX78000_UART
     select MAX78000_GCR
+    select MAX78000_TRNG
 
 config RASPI
     bool
diff --git a/hw/misc/Kconfig b/hw/misc/Kconfig
index fde2266b8f..dd6a6e54da 100644
--- a/hw/misc/Kconfig
+++ b/hw/misc/Kconfig
@@ -53,6 +53,9 @@ config MAX78000_GCR
 config MAX78000_ICC
     bool
 
+config MAX78000_TRNG
+    bool
+
 config MOS6522
     bool
 
diff --git a/hw/misc/max78000_gcr.c b/hw/misc/max78000_gcr.c
index 8c282f3916..5916ee615a 100644
--- a/hw/misc/max78000_gcr.c
+++ b/hw/misc/max78000_gcr.c
@@ -14,6 +14,7 @@
 #include "migration/vmstate.h"
 #include "hw/qdev-properties.h"
 #include "hw/char/max78000_uart.h"
+#include "hw/misc/max78000_trng.h"
 #include "hw/misc/max78000_gcr.h"
 
 
@@ -157,6 +158,9 @@ static void max78000_gcr_write(void *opaque, hwaddr addr,
         if (val & UART0_RESET) {
             device_cold_reset(s->uart0);
         }
+        if (val & TRNG_RESET) {
+            device_cold_reset(s->trng);
+        }
         /* TODO: As other devices are implemented, add them here */
         break;
 
@@ -257,6 +261,8 @@ static const Property max78000_gcr_properties[] = {
                      TYPE_MAX78000_UART, DeviceState*),
     DEFINE_PROP_LINK("uart2", Max78000GcrState, uart2,
                      TYPE_MAX78000_UART, DeviceState*),
+    DEFINE_PROP_LINK("trng", Max78000GcrState, trng,
+                        TYPE_MAX78000_TRNG, DeviceState*),
 };
 
 static const MemoryRegionOps max78000_gcr_ops = {
diff --git a/hw/misc/max78000_trng.c b/hw/misc/max78000_trng.c
new file mode 100644
index 0000000000..ecdaef53b6
--- /dev/null
+++ b/hw/misc/max78000_trng.c
@@ -0,0 +1,139 @@
+/*
+ * MAX78000 True Random Number Generator
+ *
+ * Copyright (c) 2025 Jackson Donaldson <jcksn@duck.com>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "trace.h"
+#include "hw/irq.h"
+#include "migration/vmstate.h"
+#include "hw/misc/max78000_trng.h"
+#include "qemu/guest-random.h"
+
+static uint64_t max78000_trng_read(void *opaque, hwaddr addr,
+                                    unsigned int size)
+{
+    uint32_t data;
+
+    Max78000TrngState *s = opaque;
+    switch (addr) {
+    case CTRL:
+        return s->ctrl;
+
+    case STATUS:
+        return 1;
+
+    case DATA:
+        /*
+         * When interrupts are enabled, reading random data should cause a
+         * new interrupt to be generated; since there's always a random number
+         * available, we could qemu_set_irq(s->irq, s->ctrl & RND_IE). Because
+         * of how trng_write is set up, this is always a noop, so don't
+         */
+        qemu_guest_getrandom_nofail(&data, sizeof(data));
+        return data;
+
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%"
+            HWADDR_PRIx "\n", __func__, addr);
+        break;
+    }
+    return 0;
+}
+
+static void max78000_trng_write(void *opaque, hwaddr addr,
+                    uint64_t val64, unsigned int size)
+{
+    Max78000TrngState *s = opaque;
+    uint32_t val = val64;
+    switch (addr) {
+    case CTRL:
+        /* TODO: implement AES keygen */
+        s->ctrl = val;
+
+        /*
+         * This device models random number generation as taking 0 time.
+         * A new random number is always available, so the condition for the
+         * RND interrupt is always fulfilled; we can just set irq to 1.
+         */
+        if (val & RND_IE) {
+            qemu_set_irq(s->irq, 1);
+        } else{
+            qemu_set_irq(s->irq, 0);
+        }
+        break;
+
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%"
+            HWADDR_PRIx "\n", __func__, addr);
+        break;
+    }
+}
+
+static void max78000_trng_reset_hold(Object *obj, ResetType type)
+{
+    Max78000TrngState *s = MAX78000_TRNG(obj);
+    s->ctrl = 0;
+    s->status = 0;
+    s->data = 0;
+}
+
+static const MemoryRegionOps max78000_trng_ops = {
+    .read = max78000_trng_read,
+    .write = max78000_trng_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+    .valid.min_access_size = 4,
+    .valid.max_access_size = 4,
+};
+
+static const VMStateDescription max78000_trng_vmstate = {
+    .name = TYPE_MAX78000_TRNG,
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (const VMStateField[]) {
+        VMSTATE_UINT32(ctrl, Max78000TrngState),
+        VMSTATE_UINT32(status, Max78000TrngState),
+        VMSTATE_UINT32(data, Max78000TrngState),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static void max78000_trng_init(Object *obj)
+{
+    Max78000TrngState *s = MAX78000_TRNG(obj);
+    sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->irq);
+
+    memory_region_init_io(&s->mmio, obj, &max78000_trng_ops, s,
+                        TYPE_MAX78000_TRNG, 0x1000);
+    sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
+
+}
+
+static void max78000_trng_class_init(ObjectClass *klass, const void *data)
+{
+    ResettableClass *rc = RESETTABLE_CLASS(klass);
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    rc->phases.hold = max78000_trng_reset_hold;
+    dc->vmsd = &max78000_trng_vmstate;
+
+}
+
+static const TypeInfo max78000_trng_info = {
+    .name          = TYPE_MAX78000_TRNG,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(Max78000TrngState),
+    .instance_init = max78000_trng_init,
+    .class_init    = max78000_trng_class_init,
+};
+
+static void max78000_trng_register_types(void)
+{
+    type_register_static(&max78000_trng_info);
+}
+
+type_init(max78000_trng_register_types)
diff --git a/hw/misc/meson.build b/hw/misc/meson.build
index 283d06dad4..c7c57d924b 100644
--- a/hw/misc/meson.build
+++ b/hw/misc/meson.build
@@ -72,6 +72,7 @@ system_ss.add(when: 'CONFIG_IMX', if_true: files(
 ))
 system_ss.add(when: 'CONFIG_MAX78000_GCR', if_true: files('max78000_gcr.c'))
 system_ss.add(when: 'CONFIG_MAX78000_ICC', if_true: files('max78000_icc.c'))
+system_ss.add(when: 'CONFIG_MAX78000_TRNG', if_true: files('max78000_trng.c'))
 system_ss.add(when: 'CONFIG_NPCM7XX', if_true: files(
   'npcm_clk.c',
   'npcm_gcr.c',
diff --git a/include/hw/misc/max78000_gcr.h b/include/hw/misc/max78000_gcr.h
index f04c8a3ee7..23ddf0885b 100644
--- a/include/hw/misc/max78000_gcr.h
+++ b/include/hw/misc/max78000_gcr.h
@@ -123,6 +123,7 @@ struct Max78000GcrState {
     DeviceState *uart0;
     DeviceState *uart1;
     DeviceState *uart2;
+    DeviceState *trng;
 
 };
 
diff --git a/include/hw/misc/max78000_trng.h b/include/hw/misc/max78000_trng.h
new file mode 100644
index 0000000000..c5a8129b6a
--- /dev/null
+++ b/include/hw/misc/max78000_trng.h
@@ -0,0 +1,35 @@
+/*
+ * MAX78000 True Random Number Generator
+ *
+ * Copyright (c) 2025 Jackson Donaldson <jcksn@duck.com>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+#ifndef HW_MAX78000_TRNG_H
+#define HW_MAX78000_TRNG_H
+
+#include "hw/sysbus.h"
+#include "qom/object.h"
+
+#define TYPE_MAX78000_TRNG "max78000-trng"
+OBJECT_DECLARE_SIMPLE_TYPE(Max78000TrngState, MAX78000_TRNG)
+
+#define CTRL 0
+#define STATUS 4
+#define DATA 8
+
+#define RND_IE (1 << 1)
+
+struct Max78000TrngState {
+    SysBusDevice parent_obj;
+
+    MemoryRegion mmio;
+
+    uint32_t ctrl;
+    uint32_t status;
+    uint32_t data;
+
+    qemu_irq irq;
+};
+
+#endif

From 5adeb160322ff827f3e81f38e9481fb4896670e8 Mon Sep 17 00:00:00 2001
From: Jackson Donaldson <jackson88044@gmail.com>
Date: Fri, 4 Jul 2025 18:32:37 -0400
Subject: [PATCH 2063/2760] MAX78000: Add TRNG to SOC

This commit adds TRNG to max78000_soc

Signed-off-by: Jackson Donaldson
Message-id: 20250704223239.248781-10-jcksn@duck.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/max78000_soc.c         | 10 +++++++++-
 include/hw/arm/max78000_soc.h |  2 ++
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/hw/arm/max78000_soc.c b/hw/arm/max78000_soc.c
index 45c6088312..3f2069fb03 100644
--- a/hw/arm/max78000_soc.c
+++ b/hw/arm/max78000_soc.c
@@ -43,6 +43,8 @@ static void max78000_soc_initfn(Object *obj)
                                 TYPE_MAX78000_UART);
     }
 
+    object_initialize_child(obj, "trng", &s->trng, TYPE_MAX78000_TRNG);
+
     s->sysclk = qdev_init_clock_in(DEVICE(s), "sysclk", NULL, NULL, 0);
 }
 
@@ -124,6 +126,13 @@ static void max78000_soc_realize(DeviceState *dev_soc, Error **errp)
                                                        max78000_uart_irq[i]));
     }
 
+    dev = DEVICE(&s->trng);
+    sysbus_realize(SYS_BUS_DEVICE(dev), errp);
+    sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, 0x4004d000);
+    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, qdev_get_gpio_in(armv7m, 4));
+
+    object_property_set_link(OBJECT(gcrdev), "trng", OBJECT(dev), &err);
+
     dev = DEVICE(&s->gcr);
     sysbus_realize(SYS_BUS_DEVICE(dev), errp);
     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, 0x40000000);
@@ -166,7 +175,6 @@ static void max78000_soc_realize(DeviceState *dev_soc, Error **errp)
     create_unimplemented_device("semaphore",            0x4003e000, 0x1000);
 
     create_unimplemented_device("spi1",                 0x40046000, 0x2000);
-    create_unimplemented_device("trng",                 0x4004d000, 0x1000);
     create_unimplemented_device("i2s",                  0x40060000, 0x1000);
     create_unimplemented_device("lowPowerControl",      0x40080000, 0x400);
     create_unimplemented_device("gpio2",                0x40080400, 0x200);
diff --git a/include/hw/arm/max78000_soc.h b/include/hw/arm/max78000_soc.h
index 919aca0855..528598cfcb 100644
--- a/include/hw/arm/max78000_soc.h
+++ b/include/hw/arm/max78000_soc.h
@@ -14,6 +14,7 @@
 #include "hw/misc/max78000_gcr.h"
 #include "hw/misc/max78000_icc.h"
 #include "hw/char/max78000_uart.h"
+#include "hw/misc/max78000_trng.h"
 #include "qom/object.h"
 
 #define TYPE_MAX78000_SOC "max78000-soc"
@@ -39,6 +40,7 @@ struct MAX78000State {
     Max78000GcrState gcr;
     Max78000IccState icc[MAX78000_NUM_ICC];
     Max78000UartState uart[MAX78000_NUM_UART];
+    Max78000TrngState trng;
 
     Clock *sysclk;
 };

From 33dfff7e3405e9c7e877556d5f7050da4af0304f Mon Sep 17 00:00:00 2001
From: Jackson Donaldson <jackson88044@gmail.com>
Date: Fri, 4 Jul 2025 18:32:38 -0400
Subject: [PATCH 2064/2760] MAX78000: AES implementation

This commit implements AES for the MAX78000

Signed-off-by: Jackson Donaldson <jcksn@duck.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20250704223239.248781-11-jcksn@duck.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/Kconfig                 |   1 +
 hw/misc/Kconfig                |   3 +
 hw/misc/max78000_aes.c         | 223 +++++++++++++++++++++++++++++++++
 hw/misc/max78000_gcr.c         |   6 +
 hw/misc/meson.build            |   1 +
 include/hw/misc/max78000_aes.h |  68 ++++++++++
 include/hw/misc/max78000_gcr.h |   1 +
 7 files changed, 303 insertions(+)
 create mode 100644 hw/misc/max78000_aes.c
 create mode 100644 include/hw/misc/max78000_aes.h

diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
index c7aae4c9e7..1634e26fcc 100644
--- a/hw/arm/Kconfig
+++ b/hw/arm/Kconfig
@@ -370,6 +370,7 @@ config MAX78000_SOC
     select MAX78000_UART
     select MAX78000_GCR
     select MAX78000_TRNG
+    select MAX78000_AES
 
 config RASPI
     bool
diff --git a/hw/misc/Kconfig b/hw/misc/Kconfig
index dd6a6e54da..c27285b47a 100644
--- a/hw/misc/Kconfig
+++ b/hw/misc/Kconfig
@@ -47,6 +47,9 @@ config A9SCU
 config ARM11SCU
     bool
 
+config MAX78000_AES
+    bool
+
 config MAX78000_GCR
     bool
 
diff --git a/hw/misc/max78000_aes.c b/hw/misc/max78000_aes.c
new file mode 100644
index 0000000000..0bfb2f02b5
--- /dev/null
+++ b/hw/misc/max78000_aes.c
@@ -0,0 +1,223 @@
+/*
+ * MAX78000 AES
+ *
+ * Copyright (c) 2025 Jackson Donaldson <jcksn@duck.com>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "trace.h"
+#include "hw/irq.h"
+#include "migration/vmstate.h"
+#include "hw/misc/max78000_aes.h"
+#include "crypto/aes.h"
+
+static void max78000_aes_set_status(Max78000AesState *s)
+{
+    s->status = 0;
+    if (s->result_index >= 16) {
+        s->status |= OUTPUT_FULL;
+    }
+    if (s->result_index == 0) {
+        s->status |= OUTPUT_EMPTY;
+    }
+    if (s->data_index >= 16) {
+        s->status |= INPUT_FULL;
+    }
+    if (s->data_index == 0) {
+        s->status |= INPUT_EMPTY;
+    }
+}
+
+static uint64_t max78000_aes_read(void *opaque, hwaddr addr,
+                                    unsigned int size)
+{
+    Max78000AesState *s = opaque;
+    switch (addr) {
+    case CTRL:
+        return s->ctrl;
+
+    case STATUS:
+        return s->status;
+
+    case INTFL:
+        return s->intfl;
+
+    case INTEN:
+        return s->inten;
+
+    case FIFO:
+        if (s->result_index >= 4) {
+            s->intfl &= ~DONE;
+            s->result_index -= 4;
+            max78000_aes_set_status(s);
+            return ldl_be_p(&s->result[s->result_index]);
+        } else{
+            return 0;
+        }
+
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%"
+            HWADDR_PRIx "\n", __func__, addr);
+        break;
+
+    }
+    return 0;
+}
+
+static void max78000_aes_do_crypto(Max78000AesState *s)
+{
+    int keylen = 256;
+    uint8_t *keydata = s->key;
+    if ((s->ctrl & KEY_SIZE) == 0) {
+        keylen = 128;
+        keydata += 16;
+    } else if ((s->ctrl & KEY_SIZE) == 1 << 6) {
+        keylen = 192;
+        keydata += 8;
+    }
+
+    AES_KEY key;
+    if ((s->ctrl & TYPE) == 0) {
+        AES_set_encrypt_key(keydata, keylen, &key);
+        AES_set_decrypt_key(keydata, keylen, &s->internal_key);
+        AES_encrypt(s->data, s->result, &key);
+        s->result_index = 16;
+    } else if ((s->ctrl & TYPE) == 1 << 8) {
+        AES_set_decrypt_key(keydata, keylen, &key);
+        AES_set_decrypt_key(keydata, keylen, &s->internal_key);
+        AES_decrypt(s->data, s->result, &key);
+        s->result_index = 16;
+    } else{
+        AES_decrypt(s->data, s->result, &s->internal_key);
+        s->result_index = 16;
+    }
+    s->intfl |= DONE;
+}
+
+static void max78000_aes_write(void *opaque, hwaddr addr,
+                    uint64_t val64, unsigned int size)
+{
+    Max78000AesState *s = opaque;
+    uint32_t val = val64;
+    switch (addr) {
+    case CTRL:
+        if (val & OUTPUT_FLUSH) {
+            s->result_index = 0;
+            val &= ~OUTPUT_FLUSH;
+        }
+        if (val & INPUT_FLUSH) {
+            s->data_index = 0;
+            val &= ~INPUT_FLUSH;
+        }
+        if (val & START) {
+            max78000_aes_do_crypto(s);
+        }
+
+        /* Hardware appears to stay enabled even if 0 written */
+        s->ctrl = val | (s->ctrl & AES_EN);
+        break;
+
+    case FIFO:
+        assert(s->data_index <= 12);
+        stl_be_p(&s->data[12 - s->data_index], val);
+        s->data_index += 4;
+        if (s->data_index >= 16) {
+            s->data_index = 0;
+            max78000_aes_do_crypto(s);
+        }
+        break;
+
+    case KEY_BASE ... KEY_END - 4:
+        stl_be_p(&s->key[(KEY_END - KEY_BASE - 4) - (addr - KEY_BASE)], val);
+        break;
+
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%"
+            HWADDR_PRIx "\n", __func__, addr);
+        break;
+
+    }
+    max78000_aes_set_status(s);
+}
+
+static void max78000_aes_reset_hold(Object *obj, ResetType type)
+{
+    Max78000AesState *s = MAX78000_AES(obj);
+    s->ctrl = 0;
+    s->status = 0;
+    s->intfl = 0;
+    s->inten = 0;
+
+    s->data_index = 0;
+    s->result_index = 0;
+
+    memset(s->data, 0, sizeof(s->data));
+    memset(s->key, 0, sizeof(s->key));
+    memset(s->result, 0, sizeof(s->result));
+    memset(&s->internal_key, 0, sizeof(s->internal_key));
+}
+
+static const MemoryRegionOps max78000_aes_ops = {
+    .read = max78000_aes_read,
+    .write = max78000_aes_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+    .valid.min_access_size = 4,
+    .valid.max_access_size = 4,
+};
+
+static const VMStateDescription vmstate_max78000_aes = {
+    .name = TYPE_MAX78000_AES,
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (const VMStateField[]) {
+        VMSTATE_UINT32(ctrl, Max78000AesState),
+        VMSTATE_UINT32(status, Max78000AesState),
+        VMSTATE_UINT32(intfl, Max78000AesState),
+        VMSTATE_UINT32(inten, Max78000AesState),
+        VMSTATE_UINT8_ARRAY(data, Max78000AesState, 16),
+        VMSTATE_UINT8_ARRAY(key, Max78000AesState, 32),
+        VMSTATE_UINT8_ARRAY(result, Max78000AesState, 16),
+        VMSTATE_UINT32_ARRAY(internal_key.rd_key, Max78000AesState, 60),
+        VMSTATE_INT32(internal_key.rounds, Max78000AesState),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static void max78000_aes_init(Object *obj)
+{
+    Max78000AesState *s = MAX78000_AES(obj);
+    sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->irq);
+
+    memory_region_init_io(&s->mmio, obj, &max78000_aes_ops, s,
+                        TYPE_MAX78000_AES, 0xc00);
+    sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
+
+}
+
+static void max78000_aes_class_init(ObjectClass *klass, const void *data)
+{
+    ResettableClass *rc = RESETTABLE_CLASS(klass);
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    rc->phases.hold = max78000_aes_reset_hold;
+    dc->vmsd = &vmstate_max78000_aes;
+
+}
+
+static const TypeInfo max78000_aes_info = {
+    .name          = TYPE_MAX78000_AES,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(Max78000AesState),
+    .instance_init = max78000_aes_init,
+    .class_init    = max78000_aes_class_init,
+};
+
+static void max78000_aes_register_types(void)
+{
+    type_register_static(&max78000_aes_info);
+}
+
+type_init(max78000_aes_register_types)
diff --git a/hw/misc/max78000_gcr.c b/hw/misc/max78000_gcr.c
index 5916ee615a..fbbc92cca3 100644
--- a/hw/misc/max78000_gcr.c
+++ b/hw/misc/max78000_gcr.c
@@ -15,6 +15,7 @@
 #include "hw/qdev-properties.h"
 #include "hw/char/max78000_uart.h"
 #include "hw/misc/max78000_trng.h"
+#include "hw/misc/max78000_aes.h"
 #include "hw/misc/max78000_gcr.h"
 
 
@@ -161,6 +162,9 @@ static void max78000_gcr_write(void *opaque, hwaddr addr,
         if (val & TRNG_RESET) {
             device_cold_reset(s->trng);
         }
+        if (val & AES_RESET) {
+            device_cold_reset(s->aes);
+        }
         /* TODO: As other devices are implemented, add them here */
         break;
 
@@ -263,6 +267,8 @@ static const Property max78000_gcr_properties[] = {
                      TYPE_MAX78000_UART, DeviceState*),
     DEFINE_PROP_LINK("trng", Max78000GcrState, trng,
                         TYPE_MAX78000_TRNG, DeviceState*),
+    DEFINE_PROP_LINK("aes", Max78000GcrState, aes,
+                        TYPE_MAX78000_AES, DeviceState*),
 };
 
 static const MemoryRegionOps max78000_gcr_ops = {
diff --git a/hw/misc/meson.build b/hw/misc/meson.build
index c7c57d924b..b1d8d8e5d2 100644
--- a/hw/misc/meson.build
+++ b/hw/misc/meson.build
@@ -70,6 +70,7 @@ system_ss.add(when: 'CONFIG_IMX', if_true: files(
   'imx_ccm.c',
   'imx_rngc.c',
 ))
+system_ss.add(when: 'CONFIG_MAX78000_AES', if_true: files('max78000_aes.c'))
 system_ss.add(when: 'CONFIG_MAX78000_GCR', if_true: files('max78000_gcr.c'))
 system_ss.add(when: 'CONFIG_MAX78000_ICC', if_true: files('max78000_icc.c'))
 system_ss.add(when: 'CONFIG_MAX78000_TRNG', if_true: files('max78000_trng.c'))
diff --git a/include/hw/misc/max78000_aes.h b/include/hw/misc/max78000_aes.h
new file mode 100644
index 0000000000..407c45ef61
--- /dev/null
+++ b/include/hw/misc/max78000_aes.h
@@ -0,0 +1,68 @@
+/*
+ * MAX78000 AES
+ *
+ * Copyright (c) 2025 Jackson Donaldson <jcksn@duck.com>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+#ifndef HW_MAX78000_AES_H
+#define HW_MAX78000_AES_H
+
+#include "hw/sysbus.h"
+#include "crypto/aes.h"
+#include "qom/object.h"
+
+#define TYPE_MAX78000_AES "max78000-aes"
+OBJECT_DECLARE_SIMPLE_TYPE(Max78000AesState, MAX78000_AES)
+
+#define CTRL 0
+#define STATUS 4
+#define INTFL 8
+#define INTEN 0xc
+#define FIFO 0x10
+
+#define KEY_BASE 0x400
+#define KEY_END 0x420
+
+/* CTRL */
+#define TYPE (1 << 9 | 1 << 8)
+#define KEY_SIZE (1 << 7 | 1 << 6)
+#define OUTPUT_FLUSH (1 << 5)
+#define INPUT_FLUSH (1 << 4)
+#define START (1 << 3)
+
+#define AES_EN (1 << 0)
+
+/* STATUS */
+#define OUTPUT_FULL (1 << 4)
+#define OUTPUT_EMPTY (1 << 3)
+#define INPUT_FULL (1 << 2)
+#define INPUT_EMPTY (1 << 1)
+#define BUSY (1 << 0)
+
+/* INTFL*/
+#define DONE (1 << 0)
+
+struct Max78000AesState {
+    SysBusDevice parent_obj;
+
+    MemoryRegion mmio;
+
+    uint32_t ctrl;
+    uint32_t status;
+    uint32_t intfl;
+    uint32_t inten;
+    uint32_t data_index;
+    uint8_t data[16];
+
+    uint8_t key[32];
+    AES_KEY internal_key;
+
+    uint32_t result_index;
+    uint8_t result[16];
+
+
+    qemu_irq irq;
+};
+
+#endif
diff --git a/include/hw/misc/max78000_gcr.h b/include/hw/misc/max78000_gcr.h
index 23ddf0885b..d5858a40f3 100644
--- a/include/hw/misc/max78000_gcr.h
+++ b/include/hw/misc/max78000_gcr.h
@@ -124,6 +124,7 @@ struct Max78000GcrState {
     DeviceState *uart1;
     DeviceState *uart2;
     DeviceState *trng;
+    DeviceState *aes;
 
 };
 

From 4b3a1eb0664db2df02ff4f8affe6e7bda1edaa85 Mon Sep 17 00:00:00 2001
From: Jackson Donaldson <jackson88044@gmail.com>
Date: Fri, 4 Jul 2025 18:32:39 -0400
Subject: [PATCH 2065/2760] MAX78000: Add AES to SOC

This commit adds AES to max78000_soc

Signed-off-by: Jackson Donaldson <jcksn@duck.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20250704223239.248781-12-jcksn@duck.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/max78000_soc.c         | 12 +++++++++---
 include/hw/arm/max78000_soc.h |  2 ++
 2 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/hw/arm/max78000_soc.c b/hw/arm/max78000_soc.c
index 3f2069fb03..7f1856f5ba 100644
--- a/hw/arm/max78000_soc.c
+++ b/hw/arm/max78000_soc.c
@@ -45,6 +45,8 @@ static void max78000_soc_initfn(Object *obj)
 
     object_initialize_child(obj, "trng", &s->trng, TYPE_MAX78000_TRNG);
 
+    object_initialize_child(obj, "aes", &s->aes, TYPE_MAX78000_AES);
+
     s->sysclk = qdev_init_clock_in(DEVICE(s), "sysclk", NULL, NULL, 0);
 }
 
@@ -133,6 +135,13 @@ static void max78000_soc_realize(DeviceState *dev_soc, Error **errp)
 
     object_property_set_link(OBJECT(gcrdev), "trng", OBJECT(dev), &err);
 
+    dev = DEVICE(&s->aes);
+    sysbus_realize(SYS_BUS_DEVICE(dev), errp);
+    sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, 0x40007400);
+    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, qdev_get_gpio_in(armv7m, 5));
+
+    object_property_set_link(OBJECT(gcrdev), "aes", OBJECT(dev), &err);
+
     dev = DEVICE(&s->gcr);
     sysbus_realize(SYS_BUS_DEVICE(dev), errp);
     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, 0x40000000);
@@ -148,9 +157,6 @@ static void max78000_soc_realize(DeviceState *dev_soc, Error **errp)
     create_unimplemented_device("powerSequencer",       0x40006800, 0x400);
     create_unimplemented_device("miscControl",          0x40006c00, 0x400);
 
-    create_unimplemented_device("aes",                  0x40007400, 0x400);
-    create_unimplemented_device("aesKey",               0x40007800, 0x400);
-
     create_unimplemented_device("gpio0",                0x40008000, 0x1000);
     create_unimplemented_device("gpio1",                0x40009000, 0x1000);
 
diff --git a/include/hw/arm/max78000_soc.h b/include/hw/arm/max78000_soc.h
index 528598cfcb..a203079ee9 100644
--- a/include/hw/arm/max78000_soc.h
+++ b/include/hw/arm/max78000_soc.h
@@ -11,6 +11,7 @@
 
 #include "hw/or-irq.h"
 #include "hw/arm/armv7m.h"
+#include "hw/misc/max78000_aes.h"
 #include "hw/misc/max78000_gcr.h"
 #include "hw/misc/max78000_icc.h"
 #include "hw/char/max78000_uart.h"
@@ -41,6 +42,7 @@ struct MAX78000State {
     Max78000IccState icc[MAX78000_NUM_ICC];
     Max78000UartState uart[MAX78000_NUM_UART];
     Max78000TrngState trng;
+    Max78000AesState aes;
 
     Clock *sysclk;
 };

From 35566583d86e167b617f0b55e485fc4ef1ae5dc3 Mon Sep 17 00:00:00 2001
From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Date: Thu, 3 Jul 2025 11:41:06 +0100
Subject: [PATCH 2066/2760] hw/cxl-host: Add an index field to
 CXLFixedMemoryWindow

To enable these to be found in a fixed order, that order needs to be known.
This will later be used to sort a list of these structures so that address
map and ACPI table entries are predictable.

Tested-by: Li Zhijian <lizhijian@fujitsu.com>
Reviewed-by: Li Zhijian <lizhijian@fujitsu.com>
Reviewed-by: Fan Ni <fan.ni@samsung.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Tested-by: Itaru Kitayama <itaru.kitayama@fujitsu.com>
Message-id: 20250703104110.992379-2-Jonathan.Cameron@huawei.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/cxl/cxl-host.c    | 9 ++++++---
 include/hw/cxl/cxl.h | 1 +
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/hw/cxl/cxl-host.c b/hw/cxl/cxl-host.c
index e010163174..b7aa429ddf 100644
--- a/hw/cxl/cxl-host.c
+++ b/hw/cxl/cxl-host.c
@@ -24,13 +24,15 @@
 
 static void cxl_fixed_memory_window_config(CXLState *cxl_state,
                                            CXLFixedMemoryWindowOptions *object,
-                                           Error **errp)
+                                           int index, Error **errp)
 {
     ERRP_GUARD();
     g_autofree CXLFixedWindow *fw = g_malloc0(sizeof(*fw));
     strList *target;
     int i;
 
+    fw->index = index;
+
     for (target = object->targets; target; target = target->next) {
         fw->num_targets++;
     }
@@ -325,14 +327,15 @@ static void machine_set_cfmw(Object *obj, Visitor *v, const char *name,
     CXLState *state = opaque;
     CXLFixedMemoryWindowOptionsList *cfmw_list = NULL;
     CXLFixedMemoryWindowOptionsList *it;
+    int index;
 
     visit_type_CXLFixedMemoryWindowOptionsList(v, name, &cfmw_list, errp);
     if (!cfmw_list) {
         return;
     }
 
-    for (it = cfmw_list; it; it = it->next) {
-        cxl_fixed_memory_window_config(state, it->value, errp);
+    for (it = cfmw_list, index = 0; it; it = it->next, index++) {
+        cxl_fixed_memory_window_config(state, it->value, index, errp);
     }
     state->cfmw_list = cfmw_list;
 }
diff --git a/include/hw/cxl/cxl.h b/include/hw/cxl/cxl.h
index 75e47b6864..b2bcce7ed6 100644
--- a/include/hw/cxl/cxl.h
+++ b/include/hw/cxl/cxl.h
@@ -27,6 +27,7 @@
 typedef struct PXBCXLDev PXBCXLDev;
 
 typedef struct CXLFixedWindow {
+    int index;
     uint64_t size;
     char **targets;
     PXBCXLDev *target_hbs[16];

From 584f722eb3ab4896ce9e3913c49f4f22e8b51f2b Mon Sep 17 00:00:00 2001
From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Date: Thu, 3 Jul 2025 11:41:07 +0100
Subject: [PATCH 2067/2760] hw/cxl: Make the CXL fixed memory windows devices.

Previously these somewhat device like structures were tracked using a list
in the CXLState in each machine. This is proving restrictive in a few
cases where we need to iterate through these without being aware of the
machine type. Just make them sysbus devices.

Restrict them to not user created as they need to be visible to early
stages of machine init given effects on the memory map.

This change both simplifies state tracking and enables features needed
for performance optimization and hotness tracking by making it possible
to retrieve the fixed memory window on actions elsewhere in the topology.

In some cases the ordering of the Fixed Memory Windows matters.
For those utility functions provide a GSList sorted by the window index.
This ensures that we get consistency across:
- ordering in the command line
- ordering of the host PA ranges
- ordering of ACPI CEDT structures describing the CFMWS.

Other aspects don't have this constraint. For those direct iteration
of the underlying hash structures is fine.

In the setup path for the memory map in pc_memory_init() split the
operations into two calls. The first, cxl_fmws_set_mmemap(), loops over
fixed memory windows in order and assigns their addresses.  The second,
cxl_fmws_update_mmio() actually sets up the mmio for each window.
This is obviously less efficient than a single loop but this split design
is needed to put the logic in two different places in the arm64 support
and it is not a hot enough path to justify an x86 only implementation.

Reviewed-by: Li Zhijian <lizhijian@fujitsu.com>
Tested-by: Li Zhijian <lizhijian@fujitsu.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Tested-by: Itaru Kitayama <itaru.kitayama@fujitsu.com>
Message-id: 20250703104110.992379-3-Jonathan.Cameron@huawei.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/acpi/cxl.c             |  76 +++++++++--------
 hw/cxl/cxl-host-stubs.c   |   7 +-
 hw/cxl/cxl-host.c         | 167 +++++++++++++++++++++++++++++++-------
 hw/i386/pc.c              |  50 +++++-------
 include/hw/cxl/cxl.h      |   4 +-
 include/hw/cxl/cxl_host.h |   5 +-
 6 files changed, 214 insertions(+), 95 deletions(-)

diff --git a/hw/acpi/cxl.c b/hw/acpi/cxl.c
index 9cd7905ea2..75d5b30bb8 100644
--- a/hw/acpi/cxl.c
+++ b/hw/acpi/cxl.c
@@ -22,6 +22,7 @@
 #include "hw/pci/pci_bridge.h"
 #include "hw/pci/pci_host.h"
 #include "hw/cxl/cxl.h"
+#include "hw/cxl/cxl_host.h"
 #include "hw/mem/memory-device.h"
 #include "hw/acpi/acpi.h"
 #include "hw/acpi/aml-build.h"
@@ -135,55 +136,52 @@ static void cedt_build_chbs(GArray *table_data, PXBCXLDev *cxl)
  * Interleave ways encoding in CXL 2.0 ECN: 3, 6, 12 and 16-way memory
  * interleaving.
  */
-static void cedt_build_cfmws(GArray *table_data, CXLState *cxls)
+static void cedt_build_cfmws(CXLFixedWindow *fw, Aml *cedt)
 {
-    GList *it;
+    GArray *table_data = cedt->buf;
+    int i;
 
-    for (it = cxls->fixed_windows; it; it = it->next) {
-        CXLFixedWindow *fw = it->data;
-        int i;
+    /* Type */
+    build_append_int_noprefix(table_data, 1, 1);
 
-        /* Type */
-        build_append_int_noprefix(table_data, 1, 1);
+    /* Reserved */
+    build_append_int_noprefix(table_data, 0, 1);
 
-        /* Reserved */
-        build_append_int_noprefix(table_data, 0, 1);
+    /* Record Length */
+    build_append_int_noprefix(table_data, 36 + 4 * fw->num_targets, 2);
 
-        /* Record Length */
-        build_append_int_noprefix(table_data, 36 + 4 * fw->num_targets, 2);
+    /* Reserved */
+    build_append_int_noprefix(table_data, 0, 4);
 
-        /* Reserved */
-        build_append_int_noprefix(table_data, 0, 4);
+    /* Base HPA */
+    build_append_int_noprefix(table_data, fw->mr.addr, 8);
 
-        /* Base HPA */
-        build_append_int_noprefix(table_data, fw->mr.addr, 8);
+    /* Window Size */
+    build_append_int_noprefix(table_data, fw->size, 8);
 
-        /* Window Size */
-        build_append_int_noprefix(table_data, fw->size, 8);
+    /* Host Bridge Interleave Ways */
+    build_append_int_noprefix(table_data, fw->enc_int_ways, 1);
 
-        /* Host Bridge Interleave Ways */
-        build_append_int_noprefix(table_data, fw->enc_int_ways, 1);
+    /* Host Bridge Interleave Arithmetic */
+    build_append_int_noprefix(table_data, 0, 1);
 
-        /* Host Bridge Interleave Arithmetic */
-        build_append_int_noprefix(table_data, 0, 1);
+    /* Reserved */
+    build_append_int_noprefix(table_data, 0, 2);
 
-        /* Reserved */
-        build_append_int_noprefix(table_data, 0, 2);
+    /* Host Bridge Interleave Granularity */
+    build_append_int_noprefix(table_data, fw->enc_int_gran, 4);
 
-        /* Host Bridge Interleave Granularity */
-        build_append_int_noprefix(table_data, fw->enc_int_gran, 4);
+    /* Window Restrictions */
+    build_append_int_noprefix(table_data, 0x0f, 2);
 
-        /* Window Restrictions */
-        build_append_int_noprefix(table_data, 0x0f, 2); /* No restrictions */
+    /* QTG ID */
+    build_append_int_noprefix(table_data, 0, 2);
 
-        /* QTG ID */
-        build_append_int_noprefix(table_data, 0, 2);
-
-        /* Host Bridge List (list of UIDs - currently bus_nr) */
-        for (i = 0; i < fw->num_targets; i++) {
-            g_assert(fw->target_hbs[i]);
-            build_append_int_noprefix(table_data, PXB_DEV(fw->target_hbs[i])->bus_nr, 4);
-        }
+    /* Host Bridge List (list of UIDs - currently bus_nr) */
+    for (i = 0; i < fw->num_targets; i++) {
+        g_assert(fw->target_hbs[i]);
+        build_append_int_noprefix(table_data,
+                                  PXB_DEV(fw->target_hbs[i])->bus_nr, 4);
     }
 }
 
@@ -202,6 +200,7 @@ void cxl_build_cedt(GArray *table_offsets, GArray *table_data,
                     BIOSLinker *linker, const char *oem_id,
                     const char *oem_table_id, CXLState *cxl_state)
 {
+    GSList *cfmws_list, *iter;
     Aml *cedt;
     AcpiTable table = { .sig = "CEDT", .rev = 1, .oem_id = oem_id,
                         .oem_table_id = oem_table_id };
@@ -213,7 +212,12 @@ void cxl_build_cedt(GArray *table_offsets, GArray *table_data,
     /* reserve space for CEDT header */
 
     object_child_foreach_recursive(object_get_root(), cxl_foreach_pxb_hb, cedt);
-    cedt_build_cfmws(cedt->buf, cxl_state);
+
+    cfmws_list = cxl_fmws_get_all_sorted();
+    for (iter = cfmws_list; iter; iter = iter->next) {
+        cedt_build_cfmws(CXL_FMW(iter->data), cedt);
+    }
+    g_slist_free(cfmws_list);
 
     /* copy AML table into ACPI tables blob and patch header there */
     g_array_append_vals(table_data, cedt->buf->data, cedt->buf->len);
diff --git a/hw/cxl/cxl-host-stubs.c b/hw/cxl/cxl-host-stubs.c
index cae4afcdde..c015baac81 100644
--- a/hw/cxl/cxl-host-stubs.c
+++ b/hw/cxl/cxl-host-stubs.c
@@ -8,8 +8,13 @@
 #include "hw/cxl/cxl.h"
 #include "hw/cxl/cxl_host.h"
 
-void cxl_fmws_link_targets(CXLState *stat, Error **errp) {};
+void cxl_fmws_link_targets(Error **errp) {};
 void cxl_machine_init(Object *obj, CXLState *state) {};
 void cxl_hook_up_pxb_registers(PCIBus *bus, CXLState *state, Error **errp) {};
+hwaddr cxl_fmws_set_memmap(hwaddr base, hwaddr max_addr)
+{
+    return base;
+};
+void cxl_fmws_update_mmio(void) {};
 
 const MemoryRegionOps cfmws_ops;
diff --git a/hw/cxl/cxl-host.c b/hw/cxl/cxl-host.c
index b7aa429ddf..5c2ce25a19 100644
--- a/hw/cxl/cxl-host.c
+++ b/hw/cxl/cxl-host.c
@@ -22,12 +22,12 @@
 #include "hw/pci/pcie_port.h"
 #include "hw/pci-bridge/pci_expander_bridge.h"
 
-static void cxl_fixed_memory_window_config(CXLState *cxl_state,
-                                           CXLFixedMemoryWindowOptions *object,
+static void cxl_fixed_memory_window_config(CXLFixedMemoryWindowOptions *object,
                                            int index, Error **errp)
 {
     ERRP_GUARD();
-    g_autofree CXLFixedWindow *fw = g_malloc0(sizeof(*fw));
+    DeviceState *dev = qdev_new(TYPE_CXL_FMW);
+    CXLFixedWindow *fw = CXL_FMW(dev);
     strList *target;
     int i;
 
@@ -67,35 +67,39 @@ static void cxl_fixed_memory_window_config(CXLState *cxl_state,
         fw->targets[i] = g_strdup(target->value);
     }
 
-    cxl_state->fixed_windows = g_list_append(cxl_state->fixed_windows,
-                                             g_steal_pointer(&fw));
+    sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), errp);
 }
 
-void cxl_fmws_link_targets(CXLState *cxl_state, Error **errp)
+static int cxl_fmws_link(Object *obj, void *opaque)
 {
-    if (cxl_state && cxl_state->fixed_windows) {
-        GList *it;
+    struct CXLFixedWindow *fw;
+    int i;
 
-        for (it = cxl_state->fixed_windows; it; it = it->next) {
-            CXLFixedWindow *fw = it->data;
-            int i;
-
-            for (i = 0; i < fw->num_targets; i++) {
-                Object *o;
-                bool ambig;
-
-                o = object_resolve_path_type(fw->targets[i],
-                                             TYPE_PXB_CXL_DEV,
-                                             &ambig);
-                if (!o) {
-                    error_setg(errp, "Could not resolve CXLFM target %s",
-                               fw->targets[i]);
-                    return;
-                }
-                fw->target_hbs[i] = PXB_CXL_DEV(o);
-            }
-        }
+    if (!object_dynamic_cast(obj, TYPE_CXL_FMW)) {
+        return 0;
     }
+    fw = CXL_FMW(obj);
+
+    for (i = 0; i < fw->num_targets; i++) {
+        Object *o;
+        bool ambig;
+
+        o = object_resolve_path_type(fw->targets[i], TYPE_PXB_CXL_DEV,
+                                     &ambig);
+        if (!o) {
+            error_setg(&error_fatal, "Could not resolve CXLFM target %s",
+                       fw->targets[i]);
+            return 1;
+        }
+        fw->target_hbs[i] = PXB_CXL_DEV(o);
+    }
+    return 0;
+}
+
+void cxl_fmws_link_targets(Error **errp)
+{
+    /* Order doesn't matter for this, so no need to build list */
+    object_child_foreach_recursive(object_get_root(), cxl_fmws_link, NULL);
 }
 
 static bool cxl_hdm_find_target(uint32_t *cache_mem, hwaddr addr,
@@ -335,7 +339,7 @@ static void machine_set_cfmw(Object *obj, Visitor *v, const char *name,
     }
 
     for (it = cfmw_list, index = 0; it; it = it->next, index++) {
-        cxl_fixed_memory_window_config(state, it->value, index, errp);
+        cxl_fixed_memory_window_config(it->value, index, errp);
     }
     state->cfmw_list = cfmw_list;
 }
@@ -373,3 +377,110 @@ void cxl_hook_up_pxb_registers(PCIBus *bus, CXLState *state, Error **errp)
         }
     }
 }
+
+static int cxl_fmws_find(Object *obj, void *opaque)
+{
+    GSList **list = opaque;
+
+    if (!object_dynamic_cast(obj, TYPE_CXL_FMW)) {
+        return 0;
+    }
+    *list = g_slist_prepend(*list, obj);
+
+    return 0;
+}
+
+static GSList *cxl_fmws_get_all(void)
+{
+    GSList *list = NULL;
+
+    object_child_foreach_recursive(object_get_root(), cxl_fmws_find, &list);
+
+    return list;
+}
+
+static gint cfmws_cmp(gconstpointer a, gconstpointer b, gpointer d)
+{
+    const struct CXLFixedWindow *ap = a;
+    const struct CXLFixedWindow *bp = b;
+
+    return ap->index > bp->index;
+}
+
+GSList *cxl_fmws_get_all_sorted(void)
+{
+    return g_slist_sort_with_data(cxl_fmws_get_all(), cfmws_cmp, NULL);
+}
+
+static int cxl_fmws_mmio_map(Object *obj, void *opaque)
+{
+    struct CXLFixedWindow *fw;
+
+    if (!object_dynamic_cast(obj, TYPE_CXL_FMW)) {
+        return 0;
+    }
+    fw = CXL_FMW(obj);
+    sysbus_mmio_map(SYS_BUS_DEVICE(fw), 0, fw->base);
+
+    return 0;
+}
+
+void cxl_fmws_update_mmio(void)
+{
+    /* Ordering is not required for this */
+    object_child_foreach_recursive(object_get_root(), cxl_fmws_mmio_map, NULL);
+}
+
+hwaddr cxl_fmws_set_memmap(hwaddr base, hwaddr max_addr)
+{
+    GSList *cfmws_list, *iter;
+    CXLFixedWindow *fw;
+
+    cfmws_list = cxl_fmws_get_all_sorted();
+    for (iter = cfmws_list; iter; iter = iter->next) {
+        fw = CXL_FMW(iter->data);
+        if (base + fw->size <= max_addr) {
+            fw->base = base;
+            base += fw->size;
+        }
+    }
+    g_slist_free(cfmws_list);
+
+    return base;
+}
+
+static void cxl_fmw_realize(DeviceState *dev, Error **errp)
+{
+    CXLFixedWindow *fw = CXL_FMW(dev);
+
+    memory_region_init_io(&fw->mr, OBJECT(dev), &cfmws_ops, fw,
+                          "cxl-fixed-memory-region", fw->size);
+    sysbus_init_mmio(SYS_BUS_DEVICE(dev), &fw->mr);
+}
+
+/*
+ * Note: Fixed memory windows represent fixed address decoders on the host and
+ * as such have no dynamic state to reset or migrate
+ */
+static void cxl_fmw_class_init(ObjectClass *klass, const void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->desc = "CXL Fixed Memory Window";
+    dc->realize = cxl_fmw_realize;
+    /* Reason - created by machines as tightly coupled to machine memory map */
+    dc->user_creatable = false;
+}
+
+static const TypeInfo cxl_fmw_info = {
+    .name = TYPE_CXL_FMW,
+    .parent = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(CXLFixedWindow),
+    .class_init = cxl_fmw_class_init,
+};
+
+static void cxl_host_register_types(void)
+{
+    type_register_static(&cxl_fmw_info);
+}
+type_init(cxl_host_register_types)
diff --git a/hw/i386/pc.c b/hw/i386/pc.c
index b211633575..860346d6b7 100644
--- a/hw/i386/pc.c
+++ b/hw/i386/pc.c
@@ -609,7 +609,7 @@ void pc_machine_done(Notifier *notifier, void *data)
                               &error_fatal);
 
     if (pcms->cxl_devices_state.is_enabled) {
-        cxl_fmws_link_targets(&pcms->cxl_devices_state, &error_fatal);
+        cxl_fmws_link_targets(&error_fatal);
     }
 
     /* set the number of CPUs */
@@ -718,20 +718,28 @@ static uint64_t pc_get_cxl_range_start(PCMachineState *pcms)
     return cxl_base;
 }
 
+static int cxl_get_fmw_end(Object *obj, void *opaque)
+{
+    struct CXLFixedWindow *fw;
+    uint64_t *start = opaque;
+
+    if (!object_dynamic_cast(obj, TYPE_CXL_FMW)) {
+        return 0;
+    }
+    fw = CXL_FMW(obj);
+
+    *start += fw->size;
+
+    return 0;
+}
+
 static uint64_t pc_get_cxl_range_end(PCMachineState *pcms)
 {
     uint64_t start = pc_get_cxl_range_start(pcms) + MiB;
 
-    if (pcms->cxl_devices_state.fixed_windows) {
-        GList *it;
-
-        start = ROUND_UP(start, 256 * MiB);
-        for (it = pcms->cxl_devices_state.fixed_windows; it; it = it->next) {
-            CXLFixedWindow *fw = it->data;
-            start += fw->size;
-        }
-    }
-
+    /* Ordering doesn't matter so no need to build a sorted list */
+    object_child_foreach_recursive(object_get_root(), cxl_get_fmw_end,
+                                   &start);
     return start;
 }
 
@@ -933,23 +941,9 @@ void pc_memory_init(PCMachineState *pcms,
         cxl_base = pc_get_cxl_range_start(pcms);
         memory_region_init(mr, OBJECT(machine), "cxl_host_reg", cxl_size);
         memory_region_add_subregion(system_memory, cxl_base, mr);
-        cxl_resv_end = cxl_base + cxl_size;
-        if (pcms->cxl_devices_state.fixed_windows) {
-            hwaddr cxl_fmw_base;
-            GList *it;
-
-            cxl_fmw_base = ROUND_UP(cxl_base + cxl_size, 256 * MiB);
-            for (it = pcms->cxl_devices_state.fixed_windows; it; it = it->next) {
-                CXLFixedWindow *fw = it->data;
-
-                fw->base = cxl_fmw_base;
-                memory_region_init_io(&fw->mr, OBJECT(machine), &cfmws_ops, fw,
-                                      "cxl-fixed-memory-region", fw->size);
-                memory_region_add_subregion(system_memory, fw->base, &fw->mr);
-                cxl_fmw_base += fw->size;
-                cxl_resv_end = cxl_fmw_base;
-            }
-        }
+        cxl_base = ROUND_UP(cxl_base + cxl_size, 256 * MiB);
+        cxl_resv_end = cxl_fmws_set_memmap(cxl_base, maxphysaddr);
+        cxl_fmws_update_mmio();
     }
 
     /* Initialize PC system firmware */
diff --git a/include/hw/cxl/cxl.h b/include/hw/cxl/cxl.h
index b2bcce7ed6..de66ab8c35 100644
--- a/include/hw/cxl/cxl.h
+++ b/include/hw/cxl/cxl.h
@@ -27,6 +27,7 @@
 typedef struct PXBCXLDev PXBCXLDev;
 
 typedef struct CXLFixedWindow {
+    SysBusDevice parent_obj;
     int index;
     uint64_t size;
     char **targets;
@@ -38,12 +39,13 @@ typedef struct CXLFixedWindow {
     MemoryRegion mr;
     hwaddr base;
 } CXLFixedWindow;
+#define TYPE_CXL_FMW "cxl-fmw"
+OBJECT_DECLARE_SIMPLE_TYPE(CXLFixedWindow, CXL_FMW)
 
 typedef struct CXLState {
     bool is_enabled;
     MemoryRegion host_mr;
     unsigned int next_mr_idx;
-    GList *fixed_windows;
     CXLFixedMemoryWindowOptionsList *cfmw_list;
 } CXLState;
 
diff --git a/include/hw/cxl/cxl_host.h b/include/hw/cxl/cxl_host.h
index c9bc9c7c50..cd3c368c86 100644
--- a/include/hw/cxl/cxl_host.h
+++ b/include/hw/cxl/cxl_host.h
@@ -14,8 +14,11 @@
 #define CXL_HOST_H
 
 void cxl_machine_init(Object *obj, CXLState *state);
-void cxl_fmws_link_targets(CXLState *stat, Error **errp);
+void cxl_fmws_link_targets(Error **errp);
 void cxl_hook_up_pxb_registers(PCIBus *bus, CXLState *state, Error **errp);
+hwaddr cxl_fmws_set_memmap(hwaddr base, hwaddr max_addr);
+void cxl_fmws_update_mmio(void);
+GSList *cxl_fmws_get_all_sorted(void);
 
 extern const MemoryRegionOps cfmws_ops;
 

From 9d8ade51a20d15f3be70c821c274b081ba65cea8 Mon Sep 17 00:00:00 2001
From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Date: Thu, 3 Jul 2025 11:41:08 +0100
Subject: [PATCH 2068/2760] hw/arm/virt: Basic CXL enablement on
 pci_expander_bridge instances pxb-cxl

Code based on i386/pc enablement.
The memory layout places space for 16 host bridge register regions after
the GIC_REDIST2 in the extended memmap. This is a hole in the current
map so adding them here has no impact on placement of other memory regions
(tested with enough CPUs for GIC_REDIST2 to be in use.)
The high memory map is GiB aligned so the hole is there whatever the
size of memory or device_memory below this point.

The CFMWs are placed above the extended memmap. Note the existing
variable highest_gpa is the highest GPA that has been allocated at
a particular point in setting up the memory map. Whilst this caused
some confusion in review there are existing comments explaining this
so nothing is added.

The cxl_devices_state.host_mr provides a small space in which to place
the individual host bridge register regions for whatever host bridges are
allocated via -device pxb-cxl on the command line. The existing dynamic
sysbus infrastructure is not reused because pxb-cxl is a PCI device not
a sysbus one but these registers are directly in the main memory map,
not the PCI address space.

Only create the CEDT table if cxl=on set for the machine. Default to off.

Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Tested-by: Itaru Kitayama <itaru.kitayama@fujitsu.com>
Tested-by: Li Zhijian <lizhijian@fujitsu.com>
Message-id: 20250703104110.992379-4-Jonathan.Cameron@huawei.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/virt.rst |  9 +++++++++
 hw/arm/virt-acpi-build.c | 34 ++++++++++++++++++++++++++++++++++
 hw/arm/virt.c            | 30 ++++++++++++++++++++++++++++++
 include/hw/arm/virt.h    |  4 ++++
 4 files changed, 77 insertions(+)

diff --git a/docs/system/arm/virt.rst b/docs/system/arm/virt.rst
index 6a719b9586..10cbffc8a7 100644
--- a/docs/system/arm/virt.rst
+++ b/docs/system/arm/virt.rst
@@ -31,6 +31,7 @@ Supported devices
 The virt board supports:
 
 - PCI/PCIe devices
+- CXL Fixed memory windows, root bridges and devices.
 - Flash memory
 - Either one or two PL011 UARTs for the NonSecure World
 - An RTC
@@ -189,6 +190,14 @@ ras
 acpi
   Set ``on``/``off``/``auto`` to enable/disable ACPI.
 
+cxl
+  Set  ``on``/``off`` to enable/disable CXL. More details in
+  :doc:`../devices/cxl`. The default is off.
+
+cxl-fmw
+  Array of CXL fixed memory windows describing fixed address routing to
+  target CXL host bridges. See :doc:`../devices/cxl`.
+
 dtb-randomness
   Set ``on``/``off`` to pass random seeds via the guest DTB
   rng-seed and kaslr-seed nodes (in both "/chosen" and
diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
index cd90c47976..c3b9b3f6ea 100644
--- a/hw/arm/virt-acpi-build.c
+++ b/hw/arm/virt-acpi-build.c
@@ -39,10 +39,12 @@
 #include "hw/acpi/aml-build.h"
 #include "hw/acpi/utils.h"
 #include "hw/acpi/pci.h"
+#include "hw/acpi/cxl.h"
 #include "hw/acpi/memory_hotplug.h"
 #include "hw/acpi/generic_event_device.h"
 #include "hw/acpi/tpm.h"
 #include "hw/acpi/hmat.h"
+#include "hw/cxl/cxl.h"
 #include "hw/pci/pcie_host.h"
 #include "hw/pci/pci.h"
 #include "hw/pci/pci_bus.h"
@@ -119,10 +121,29 @@ static void acpi_dsdt_add_flash(Aml *scope, const MemMapEntry *flash_memmap)
     aml_append(scope, dev);
 }
 
+static void build_acpi0017(Aml *table)
+{
+    Aml *dev, *scope, *method;
+
+    scope =  aml_scope("_SB");
+    dev = aml_device("CXLM");
+    aml_append(dev, aml_name_decl("_HID", aml_string("ACPI0017")));
+
+    method = aml_method("_STA", 0, AML_NOTSERIALIZED);
+    aml_append(method, aml_return(aml_int(0x0B)));
+    aml_append(dev, method);
+    build_cxl_dsm_method(dev);
+
+    aml_append(scope, dev);
+    aml_append(table, scope);
+}
+
 static void acpi_dsdt_add_pci(Aml *scope, const MemMapEntry *memmap,
                               uint32_t irq, VirtMachineState *vms)
 {
     int ecam_id = VIRT_ECAM_ID(vms->highmem_ecam);
+    bool cxl_present = false;
+    PCIBus *bus = vms->bus;
     struct GPEXConfig cfg = {
         .mmio32 = memmap[VIRT_PCIE_MMIO],
         .pio    = memmap[VIRT_PCIE_PIO],
@@ -136,6 +157,14 @@ static void acpi_dsdt_add_pci(Aml *scope, const MemMapEntry *memmap,
     }
 
     acpi_dsdt_add_gpex(scope, &cfg);
+    QLIST_FOREACH(bus, &vms->bus->child, sibling) {
+        if (pci_bus_is_cxl(bus)) {
+            cxl_present = true;
+        }
+    }
+    if (cxl_present) {
+        build_acpi0017(scope);
+    }
 }
 
 static void acpi_dsdt_add_gpio(Aml *scope, const MemMapEntry *gpio_memmap,
@@ -1027,6 +1056,11 @@ void virt_acpi_build(VirtMachineState *vms, AcpiBuildTables *tables)
         }
     }
 
+    if (vms->cxl_devices_state.is_enabled) {
+        cxl_build_cedt(table_offsets, tables_blob, tables->linker,
+                       vms->oem_id, vms->oem_table_id, &vms->cxl_devices_state);
+    }
+
     if (ms->nvdimms_state->is_enabled) {
         nvdimm_build_acpi(table_offsets, tables_blob, tables->linker,
                           ms->nvdimms_state, ms->ram_slots, vms->oem_id,
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index 3bcdf92e2f..394e8b5301 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -57,6 +57,7 @@
 #include "qemu/error-report.h"
 #include "qemu/module.h"
 #include "hw/pci-host/gpex.h"
+#include "hw/pci-bridge/pci_expander_bridge.h"
 #include "hw/virtio/virtio-pci.h"
 #include "hw/core/sysbus-fdt.h"
 #include "hw/platform-bus.h"
@@ -86,6 +87,8 @@
 #include "hw/virtio/virtio-md-pci.h"
 #include "hw/virtio/virtio-iommu.h"
 #include "hw/char/pl011.h"
+#include "hw/cxl/cxl.h"
+#include "hw/cxl/cxl_host.h"
 #include "qemu/guest-random.h"
 
 static GlobalProperty arm_virt_compat[] = {
@@ -220,9 +223,11 @@ static const MemMapEntry base_memmap[] = {
 static MemMapEntry extended_memmap[] = {
     /* Additional 64 MB redist region (can contain up to 512 redistributors) */
     [VIRT_HIGH_GIC_REDIST2] =   { 0x0, 64 * MiB },
+    [VIRT_CXL_HOST] =           { 0x0, 64 * KiB * 16 }, /* 16 UID */
     [VIRT_HIGH_PCIE_ECAM] =     { 0x0, 256 * MiB },
     /* Second PCIe window */
     [VIRT_HIGH_PCIE_MMIO] =     { 0x0, DEFAULT_HIGH_PCIE_MMIO_SIZE },
+    /* Any CXL Fixed memory windows come here */
 };
 
 static const int a15irqmap[] = {
@@ -1623,6 +1628,17 @@ static void create_pcie(VirtMachineState *vms)
     }
 }
 
+static void create_cxl_host_reg_region(VirtMachineState *vms)
+{
+    MemoryRegion *sysmem = get_system_memory();
+    MemoryRegion *mr = &vms->cxl_devices_state.host_mr;
+
+    memory_region_init(mr, OBJECT(vms), "cxl_host_reg",
+                       vms->memmap[VIRT_CXL_HOST].size);
+    memory_region_add_subregion(sysmem, vms->memmap[VIRT_CXL_HOST].base, mr);
+    vms->highmem_cxl = true;
+}
+
 static void create_platform_bus(VirtMachineState *vms)
 {
     DeviceState *dev;
@@ -1739,6 +1755,12 @@ void virt_machine_done(Notifier *notifier, void *data)
     struct arm_boot_info *info = &vms->bootinfo;
     AddressSpace *as = arm_boot_address_space(cpu, info);
 
+    cxl_hook_up_pxb_registers(vms->bus, &vms->cxl_devices_state,
+                              &error_fatal);
+
+    if (vms->cxl_devices_state.is_enabled) {
+        cxl_fmws_link_targets(&error_fatal);
+    }
     /*
      * If the user provided a dtb, we assume the dynamic sysbus nodes
      * already are integrated there. This corresponds to a use case where
@@ -1785,6 +1807,7 @@ static inline bool *virt_get_high_memmap_enabled(VirtMachineState *vms,
 {
     bool *enabled_array[] = {
         &vms->highmem_redists,
+        &vms->highmem_cxl,
         &vms->highmem_ecam,
         &vms->highmem_mmio,
     };
@@ -1892,6 +1915,9 @@ static void virt_set_memmap(VirtMachineState *vms, int pa_bits)
     if (device_memory_size > 0) {
         machine_memory_devices_init(ms, device_memory_base, device_memory_size);
     }
+    vms->highest_gpa = cxl_fmws_set_memmap(ROUND_UP(vms->highest_gpa + 1,
+                                                    256 * MiB),
+                                           BIT_ULL(pa_bits)) - 1;
 }
 
 static VirtGICType finalize_gic_version_do(const char *accel_name,
@@ -2343,6 +2369,8 @@ static void machvirt_init(MachineState *machine)
     memory_region_add_subregion(sysmem, vms->memmap[VIRT_MEM].base,
                                 machine->ram);
 
+    cxl_fmws_update_mmio();
+
     virt_flash_fdt(vms, sysmem, secure_sysmem ?: sysmem);
 
     create_gic(vms, sysmem);
@@ -2398,6 +2426,7 @@ static void machvirt_init(MachineState *machine)
     create_rtc(vms);
 
     create_pcie(vms);
+    create_cxl_host_reg_region(vms);
 
     if (has_ged && aarch64 && firmware_loaded && virt_is_acpi_enabled(vms)) {
         vms->acpi_dev = create_acpi_ged(vms);
@@ -3364,6 +3393,7 @@ static void virt_instance_init(Object *obj)
 
     vms->oem_id = g_strndup(ACPI_BUILD_APPNAME6, 6);
     vms->oem_table_id = g_strndup(ACPI_BUILD_APPNAME8, 8);
+    cxl_machine_init(obj, &vms->cxl_devices_state);
 }
 
 static const TypeInfo virt_machine_info = {
diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
index 9a1b0f53d2..4375819ea0 100644
--- a/include/hw/arm/virt.h
+++ b/include/hw/arm/virt.h
@@ -36,6 +36,7 @@
 #include "hw/arm/boot.h"
 #include "hw/arm/bsa.h"
 #include "hw/block/flash.h"
+#include "hw/cxl/cxl.h"
 #include "system/kvm.h"
 #include "hw/intc/arm_gicv3_common.h"
 #include "qom/object.h"
@@ -85,6 +86,7 @@ enum {
 /* indices of IO regions located after the RAM */
 enum {
     VIRT_HIGH_GIC_REDIST2 =  VIRT_LOWMEMMAP_LAST,
+    VIRT_CXL_HOST,
     VIRT_HIGH_PCIE_ECAM,
     VIRT_HIGH_PCIE_MMIO,
 };
@@ -140,6 +142,7 @@ struct VirtMachineState {
     bool secure;
     bool highmem;
     bool highmem_compact;
+    bool highmem_cxl;
     bool highmem_ecam;
     bool highmem_mmio;
     bool highmem_redists;
@@ -174,6 +177,7 @@ struct VirtMachineState {
     char *oem_id;
     char *oem_table_id;
     bool ns_el2_virt_timer_irq;
+    CXLState cxl_devices_state;
 };
 
 #define VIRT_ECAM_ID(high) (high ? VIRT_HIGH_PCIE_ECAM : VIRT_PCIE_ECAM)

From 3fd8426aefa946ac6ab86103f68c9b526a0de237 Mon Sep 17 00:00:00 2001
From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Date: Thu, 3 Jul 2025 11:41:09 +0100
Subject: [PATCH 2069/2760] docs/cxl: Add an arm/virt example.

Only add one very simple example as all the i386/pc examples will work
for arm/virt with a change to appropriate executable and appropriate
standard launch line for arm/virt. Note that max cpu is used to
ensure we have plenty of physical address space.

Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Tested-by: Itaru Kitayama <itaru.kitayama@fujitsu.com>
Tested-by: Li Zhijian <lizhijian@fujitsu.com>
Message-id: 20250703104110.992379-5-Jonathan.Cameron@huawei.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/devices/cxl.rst | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/docs/system/devices/cxl.rst b/docs/system/devices/cxl.rst
index e307caf3f8..ca15a0da1c 100644
--- a/docs/system/devices/cxl.rst
+++ b/docs/system/devices/cxl.rst
@@ -384,6 +384,17 @@ An example of 4 devices below a switch suitable for 1, 2 or 4 way interleave::
   -device cxl-type3,bus=swport3,persistent-memdev=cxl-mem3,lsa=cxl-lsa3,id=cxl-pmem3,sn=0x4 \
   -M cxl-fmw.0.targets.0=cxl.1,cxl-fmw.0.size=4G,cxl-fmw.0.interleave-granularity=4k
 
+A simple arm/virt example featuring a single direct connected CXL Type 3
+Volatile Memory device::
+
+  qemu-system-aarch64 -M virt,gic-version=3,cxl=on -m 4g,maxmem=8g,slots=4 -cpu max -smp 4 \
+  ...
+  -object memory-backend-ram,id=vmem0,share=on,size=256M \
+  -device pxb-cxl,bus_nr=12,bus=pcie.0,id=cxl.1 \
+  -device cxl-rp,port=0,bus=cxl.1,id=root_port13,chassis=0,slot=2 \
+  -device cxl-type3,bus=root_port13,volatile-memdev=vmem0,id=cxl-vmem0 \
+  -M cxl-fmw.0.targets.0=cxl.1,cxl-fmw.0.size=4G
+
 Deprecations
 ------------
 

From 67fe3c8a73876ff727f301a306a03eb3230b58ee Mon Sep 17 00:00:00 2001
From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Date: Thu, 3 Jul 2025 11:41:10 +0100
Subject: [PATCH 2070/2760] qtest/cxl: Add aarch64 virt test for CXL

Add a single complex case for aarch64 virt machine.

Given existing much more comprehensive tests for x86 cover the common
functionality, a single test should be enough to verify that the aarch64
part continues to work.

Tested-by: Itaru Kitayama <itaru.kitayama@fujitsu.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Tested-by: Li Zhijian <lizhijian@fujitsu.com>
Message-id: 20250703104110.992379-6-Jonathan.Cameron@huawei.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/qtest/cxl-test.c  | 58 ++++++++++++++++++++++++++++++++---------
 tests/qtest/meson.build |  1 +
 2 files changed, 46 insertions(+), 13 deletions(-)

diff --git a/tests/qtest/cxl-test.c b/tests/qtest/cxl-test.c
index a600331843..8fb7e58d4f 100644
--- a/tests/qtest/cxl-test.c
+++ b/tests/qtest/cxl-test.c
@@ -19,6 +19,12 @@
     "-device pxb-cxl,id=cxl.1,bus=pcie.0,bus_nr=53 " \
     "-M cxl-fmw.0.targets.0=cxl.0,cxl-fmw.0.targets.1=cxl.1,cxl-fmw.0.size=4G "
 
+#define QEMU_VIRT_2PXB_CMD \
+    "-machine virt,cxl=on -cpu max " \
+    "-device pxb-cxl,id=cxl.0,bus=pcie.0,bus_nr=52 " \
+    "-device pxb-cxl,id=cxl.1,bus=pcie.0,bus_nr=53 " \
+    "-M cxl-fmw.0.targets.0=cxl.0,cxl-fmw.0.targets.1=cxl.1,cxl-fmw.0.size=4G "
+
 #define QEMU_RP \
     "-device cxl-rp,id=rp0,bus=cxl.0,chassis=0,slot=0 "
 
@@ -197,25 +203,51 @@ static void cxl_2pxb_4rp_4t3d(void)
     qtest_end();
     rmdir(tmpfs);
 }
+
+static void cxl_virt_2pxb_4rp_4t3d(void)
+{
+    g_autoptr(GString) cmdline = g_string_new(NULL);
+    g_autofree const char *tmpfs = NULL;
+
+    tmpfs = g_dir_make_tmp("cxl-test-XXXXXX", NULL);
+
+    g_string_printf(cmdline, QEMU_VIRT_2PXB_CMD QEMU_4RP QEMU_4T3D,
+                    tmpfs, tmpfs, tmpfs, tmpfs, tmpfs, tmpfs,
+                    tmpfs, tmpfs);
+
+    qtest_start(cmdline->str);
+    qtest_end();
+    rmdir(tmpfs);
+}
 #endif /* CONFIG_POSIX */
 
 int main(int argc, char **argv)
 {
-    g_test_init(&argc, &argv, NULL);
+    const char *arch = qtest_get_arch();
 
-    qtest_add_func("/pci/cxl/basic_hostbridge", cxl_basic_hb);
-    qtest_add_func("/pci/cxl/basic_pxb", cxl_basic_pxb);
-    qtest_add_func("/pci/cxl/pxb_with_window", cxl_pxb_with_window);
-    qtest_add_func("/pci/cxl/pxb_x2_with_window", cxl_2pxb_with_window);
-    qtest_add_func("/pci/cxl/rp", cxl_root_port);
-    qtest_add_func("/pci/cxl/rp_x2", cxl_2root_port);
+    g_test_init(&argc, &argv, NULL);
+    if (strcmp(arch, "i386") == 0 || strcmp(arch, "x86_64") == 0) {
+        qtest_add_func("/pci/cxl/basic_hostbridge", cxl_basic_hb);
+        qtest_add_func("/pci/cxl/basic_pxb", cxl_basic_pxb);
+        qtest_add_func("/pci/cxl/pxb_with_window", cxl_pxb_with_window);
+        qtest_add_func("/pci/cxl/pxb_x2_with_window", cxl_2pxb_with_window);
+        qtest_add_func("/pci/cxl/rp", cxl_root_port);
+        qtest_add_func("/pci/cxl/rp_x2", cxl_2root_port);
 #ifdef CONFIG_POSIX
-    qtest_add_func("/pci/cxl/type3_device", cxl_t3d_deprecated);
-    qtest_add_func("/pci/cxl/type3_device_pmem", cxl_t3d_persistent);
-    qtest_add_func("/pci/cxl/type3_device_vmem", cxl_t3d_volatile);
-    qtest_add_func("/pci/cxl/type3_device_vmem_lsa", cxl_t3d_volatile_lsa);
-    qtest_add_func("/pci/cxl/rp_x2_type3_x2", cxl_1pxb_2rp_2t3d);
-    qtest_add_func("/pci/cxl/pxb_x2_root_port_x4_type3_x4", cxl_2pxb_4rp_4t3d);
+        qtest_add_func("/pci/cxl/type3_device", cxl_t3d_deprecated);
+        qtest_add_func("/pci/cxl/type3_device_pmem", cxl_t3d_persistent);
+        qtest_add_func("/pci/cxl/type3_device_vmem", cxl_t3d_volatile);
+        qtest_add_func("/pci/cxl/type3_device_vmem_lsa", cxl_t3d_volatile_lsa);
+        qtest_add_func("/pci/cxl/rp_x2_type3_x2", cxl_1pxb_2rp_2t3d);
+        qtest_add_func("/pci/cxl/pxb_x2_root_port_x4_type3_x4",
+                       cxl_2pxb_4rp_4t3d);
 #endif
+    } else if (strcmp(arch, "aarch64") == 0) {
+#ifdef CONFIG_POSIX
+        qtest_add_func("/pci/cxl/virt/pxb_x2_root_port_x4_type3_x4",
+                       cxl_virt_2pxb_4rp_4t3d);
+#endif
+    }
+
     return g_test_run();
 }
diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
index 91b4a71a18..5ad969f616 100644
--- a/tests/qtest/meson.build
+++ b/tests/qtest/meson.build
@@ -262,6 +262,7 @@ qtests_aarch64 = \
    config_all_devices.has_key('CONFIG_TPM_TIS_I2C') ? ['tpm-tis-i2c-test'] : []) + \
   (config_all_devices.has_key('CONFIG_ASPEED_SOC') ? qtests_aspeed64 : []) + \
   (config_all_devices.has_key('CONFIG_NPCM8XX') ? qtests_npcm8xx : []) + \
+  qtests_cxl +                                                                                  \
   ['arm-cpu-features',
    'numa-test',
    'boot-serial-test',

From 1fea334eeed2b747d1c91ee0099401595ba697f8 Mon Sep 17 00:00:00 2001
From: Cornelia Huck <cohuck@redhat.com>
Date: Fri, 4 Jul 2025 16:19:23 +0200
Subject: [PATCH 2071/2760] arm/cpu: store id_afr0 into the idregs array
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Cornelia Huck <cohuck@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Message-id: 20250704141927.38963-2-cohuck@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/intc/armv7m_nvic.c        |  2 +-
 target/arm/cpu-sysregs.h.inc |  1 +
 target/arm/cpu.h             |  1 -
 target/arm/cpu64.c           |  4 ++--
 target/arm/helper.c          |  2 +-
 target/arm/tcg/cpu-v7m.c     | 12 ++++++------
 target/arm/tcg/cpu32.c       | 22 +++++++++++-----------
 target/arm/tcg/cpu64.c       | 16 ++++++++--------
 8 files changed, 30 insertions(+), 30 deletions(-)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index 6d85720f1b..d93e593fcb 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -1279,7 +1279,7 @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
         if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
             goto bad_offset;
         }
-        return cpu->id_afr0;
+        return GET_IDREG(isar, ID_AFR0);
     case 0xd50: /* MMFR0.  */
         if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
             goto bad_offset;
diff --git a/target/arm/cpu-sysregs.h.inc b/target/arm/cpu-sysregs.h.inc
index cb99286f70..b96a358804 100644
--- a/target/arm/cpu-sysregs.h.inc
+++ b/target/arm/cpu-sysregs.h.inc
@@ -14,6 +14,7 @@ DEF(ID_AA64MMFR3_EL1, 3, 0, 0, 7, 3)
 DEF(ID_PFR0_EL1, 3, 0, 0, 1, 0)
 DEF(ID_PFR1_EL1, 3, 0, 0, 1, 1)
 DEF(ID_DFR0_EL1, 3, 0, 0, 1, 2)
+DEF(ID_AFR0_EL1, 3, 0, 0, 1, 3)
 DEF(ID_MMFR0_EL1, 3, 0, 0, 1, 4)
 DEF(ID_MMFR1_EL1, 3, 0, 0, 1, 5)
 DEF(ID_MMFR2_EL1, 3, 0, 0, 1, 6)
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index c8cf0ab417..835700cfab 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -1082,7 +1082,6 @@ struct ArchCPU {
     uint32_t reset_sctlr;
     uint64_t pmceid0;
     uint64_t pmceid1;
-    uint32_t id_afr0;
     uint64_t id_aa64afr0;
     uint64_t id_aa64afr1;
     uint64_t clidr;
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index bd33d6cc6e..d648ea066c 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -663,7 +663,7 @@ static void aarch64_a57_initfn(Object *obj)
     SET_IDREG(isar, ID_PFR0, 0x00000131);
     SET_IDREG(isar, ID_PFR1, 0x00011011);
     SET_IDREG(isar, ID_DFR0, 0x03010066);
-    cpu->id_afr0 = 0x00000000;
+    SET_IDREG(isar, ID_AFR0, 0x00000000);
     SET_IDREG(isar, ID_MMFR0, 0x10101105);
     SET_IDREG(isar, ID_MMFR1, 0x40000000);
     SET_IDREG(isar, ID_MMFR2, 0x01260000);
@@ -725,7 +725,7 @@ static void aarch64_a53_initfn(Object *obj)
     SET_IDREG(isar, ID_PFR0, 0x00000131);
     SET_IDREG(isar, ID_PFR1, 0x00011011);
     SET_IDREG(isar, ID_DFR0, 0x03010066);
-    cpu->id_afr0 = 0x00000000;
+    SET_IDREG(isar, ID_AFR0, 0x00000000);
     SET_IDREG(isar, ID_MMFR0, 0x10101105);
     SET_IDREG(isar, ID_MMFR1, 0x40000000);
     SET_IDREG(isar, ID_MMFR2, 0x01260000);
diff --git a/target/arm/helper.c b/target/arm/helper.c
index b3f0d6f17a..ae6231803e 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -7809,7 +7809,7 @@ void register_cp_regs_for_features(ARMCPU *cpu)
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 3,
               .access = PL1_R, .type = ARM_CP_CONST,
               .accessfn = access_aa32_tid3,
-              .resetvalue = cpu->id_afr0 },
+              .resetvalue = GET_IDREG(isar, ID_AFR0)},
             { .name = "ID_MMFR0", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 4,
               .access = PL1_R, .type = ARM_CP_CONST,
diff --git a/target/arm/tcg/cpu-v7m.c b/target/arm/tcg/cpu-v7m.c
index eddd7117d5..a65b83fe99 100644
--- a/target/arm/tcg/cpu-v7m.c
+++ b/target/arm/tcg/cpu-v7m.c
@@ -62,7 +62,7 @@ static void cortex_m0_initfn(Object *obj)
     SET_IDREG(isar, ID_PFR0, 0x00000030);
     SET_IDREG(isar, ID_PFR1, 0x00000200);
     SET_IDREG(isar, ID_DFR0, 0x00100000);
-    cpu->id_afr0 = 0x00000000;
+    SET_IDREG(isar, ID_AFR0, 0x00000000);
     SET_IDREG(isar, ID_MMFR0, 0x00000030);
     SET_IDREG(isar, ID_MMFR1, 0x00000000);
     SET_IDREG(isar, ID_MMFR2, 0x00000000);
@@ -88,7 +88,7 @@ static void cortex_m3_initfn(Object *obj)
     SET_IDREG(isar, ID_PFR0, 0x00000030);
     SET_IDREG(isar, ID_PFR1, 0x00000200);
     SET_IDREG(isar, ID_DFR0, 0x00100000);
-    cpu->id_afr0 = 0x00000000;
+    SET_IDREG(isar, ID_AFR0, 0x00000000);
     SET_IDREG(isar, ID_MMFR0, 0x00000030);
     SET_IDREG(isar, ID_MMFR1, 0x00000000);
     SET_IDREG(isar, ID_MMFR2, 0x00000000);
@@ -119,7 +119,7 @@ static void cortex_m4_initfn(Object *obj)
     SET_IDREG(isar, ID_PFR0, 0x00000030);
     SET_IDREG(isar, ID_PFR1, 0x00000200);
     SET_IDREG(isar, ID_DFR0, 0x00100000);
-    cpu->id_afr0 = 0x00000000;
+    SET_IDREG(isar, ID_AFR0, 0x00000000);
     SET_IDREG(isar, ID_MMFR0, 0x00000030);
     SET_IDREG(isar, ID_MMFR1, 0x00000000);
     SET_IDREG(isar, ID_MMFR2, 0x00000000);
@@ -150,7 +150,7 @@ static void cortex_m7_initfn(Object *obj)
     SET_IDREG(isar, ID_PFR0, 0x00000030);
     SET_IDREG(isar, ID_PFR1, 0x00000200);
     SET_IDREG(isar, ID_DFR0, 0x00100000);
-    cpu->id_afr0 = 0x00000000;
+    SET_IDREG(isar, ID_AFR0, 0x00000000);
     SET_IDREG(isar, ID_MMFR0, 0x00100030);
     SET_IDREG(isar, ID_MMFR1, 0x00000000);
     SET_IDREG(isar, ID_MMFR2, 0x01000000);
@@ -183,7 +183,7 @@ static void cortex_m33_initfn(Object *obj)
     SET_IDREG(isar, ID_PFR0, 0x00000030);
     SET_IDREG(isar, ID_PFR1, 0x00000210);
     SET_IDREG(isar, ID_DFR0, 0x00200000);
-    cpu->id_afr0 = 0x00000000;
+    SET_IDREG(isar, ID_AFR0, 0x00000000);
     SET_IDREG(isar, ID_MMFR0, 0x00101F40);
     SET_IDREG(isar, ID_MMFR1, 0x00000000);
     SET_IDREG(isar, ID_MMFR2, 0x01000000);
@@ -221,7 +221,7 @@ static void cortex_m55_initfn(Object *obj)
     SET_IDREG(isar, ID_PFR0, 0x20000030);
     SET_IDREG(isar, ID_PFR1, 0x00000230);
     SET_IDREG(isar, ID_DFR0, 0x10200000);
-    cpu->id_afr0 = 0x00000000;
+    SET_IDREG(isar, ID_AFR0, 0x00000000);
     SET_IDREG(isar, ID_MMFR0, 0x00111040);
     SET_IDREG(isar, ID_MMFR1, 0x00000000);
     SET_IDREG(isar, ID_MMFR2, 0x01000000);
diff --git a/target/arm/tcg/cpu32.c b/target/arm/tcg/cpu32.c
index 942b636aa5..03cbe42f22 100644
--- a/target/arm/tcg/cpu32.c
+++ b/target/arm/tcg/cpu32.c
@@ -225,7 +225,7 @@ static void arm1136_r2_initfn(Object *obj)
     SET_IDREG(isar, ID_PFR0, 0x111);
     SET_IDREG(isar, ID_PFR1, 0x1);
     SET_IDREG(isar, ID_DFR0, 0x2);
-    cpu->id_afr0 = 0x3;
+    SET_IDREG(isar, ID_AFR0, 0x3);
     SET_IDREG(isar, ID_MMFR0, 0x01130003);
     SET_IDREG(isar, ID_MMFR1, 0x10030302);
     SET_IDREG(isar, ID_MMFR2, 0x01222110);
@@ -257,7 +257,7 @@ static void arm1136_initfn(Object *obj)
     SET_IDREG(isar, ID_PFR0, 0x111);
     SET_IDREG(isar, ID_PFR1, 0x1);
     SET_IDREG(isar, ID_DFR0, 0x2);
-    cpu->id_afr0 = 0x3;
+    SET_IDREG(isar, ID_AFR0, 0x3);
     SET_IDREG(isar, ID_MMFR0, 0x01130003);
     SET_IDREG(isar, ID_MMFR1, 0x10030302);
     SET_IDREG(isar, ID_MMFR2, 0x01222110);
@@ -290,7 +290,7 @@ static void arm1176_initfn(Object *obj)
     SET_IDREG(isar, ID_PFR0, 0x111);
     SET_IDREG(isar, ID_PFR1, 0x11);
     SET_IDREG(isar, ID_DFR0, 0x33);
-    cpu->id_afr0 = 0;
+    SET_IDREG(isar, ID_AFR0, 0);
     SET_IDREG(isar, ID_MMFR0, 0x01130003);
     SET_IDREG(isar, ID_MMFR1, 0x10030302);
     SET_IDREG(isar, ID_MMFR2, 0x01222100);
@@ -320,7 +320,7 @@ static void arm11mpcore_initfn(Object *obj)
     SET_IDREG(isar, ID_PFR0, 0x111);
     SET_IDREG(isar, ID_PFR1, 0x1);
     SET_IDREG(isar, ID_DFR0, 0);
-    cpu->id_afr0 = 0x2;
+    SET_IDREG(isar, ID_AFR0, 0x2);
     SET_IDREG(isar, ID_MMFR0, 0x01100103);
     SET_IDREG(isar, ID_MMFR1, 0x10020302);
     SET_IDREG(isar, ID_MMFR2, 0x01222000);
@@ -360,7 +360,7 @@ static void cortex_a8_initfn(Object *obj)
     SET_IDREG(isar, ID_PFR0, 0x1031);
     SET_IDREG(isar, ID_PFR1, 0x11);
     SET_IDREG(isar, ID_DFR0, 0x400);
-    cpu->id_afr0 = 0;
+    SET_IDREG(isar, ID_AFR0, 0);
     SET_IDREG(isar, ID_MMFR0, 0x31100003);
     SET_IDREG(isar, ID_MMFR1, 0x20000000);
     SET_IDREG(isar, ID_MMFR2, 0x01202000);
@@ -436,7 +436,7 @@ static void cortex_a9_initfn(Object *obj)
     SET_IDREG(isar, ID_PFR0, 0x1031);
     SET_IDREG(isar, ID_PFR1, 0x11);
     SET_IDREG(isar, ID_DFR0, 0x000);
-    cpu->id_afr0 = 0;
+    SET_IDREG(isar, ID_AFR0, 0);
     SET_IDREG(isar, ID_MMFR0, 0x00100103);
     SET_IDREG(isar, ID_MMFR1, 0x20000000);
     SET_IDREG(isar, ID_MMFR2, 0x01230000);
@@ -502,7 +502,7 @@ static void cortex_a7_initfn(Object *obj)
     SET_IDREG(isar, ID_PFR0, 0x00001131);
     SET_IDREG(isar, ID_PFR1, 0x00011011);
     SET_IDREG(isar, ID_DFR0, 0x02010555);
-    cpu->id_afr0 = 0x00000000;
+    SET_IDREG(isar, ID_AFR0, 0x00000000);
     SET_IDREG(isar, ID_MMFR0, 0x10101105);
     SET_IDREG(isar, ID_MMFR1, 0x40000000);
     SET_IDREG(isar, ID_MMFR2, 0x01240000);
@@ -554,7 +554,7 @@ static void cortex_a15_initfn(Object *obj)
     SET_IDREG(isar, ID_PFR0, 0x00001131);
     SET_IDREG(isar, ID_PFR1, 0x00011011);
     SET_IDREG(isar, ID_DFR0, 0x02010555);
-    cpu->id_afr0 = 0x00000000;
+    SET_IDREG(isar, ID_AFR0, 0x00000000);
     SET_IDREG(isar, ID_MMFR0, 0x10201105);
     SET_IDREG(isar, ID_MMFR1, 0x20000000);
     SET_IDREG(isar, ID_MMFR2, 0x01240000);
@@ -598,7 +598,7 @@ static void cortex_r5_initfn(Object *obj)
     SET_IDREG(isar, ID_PFR0, 0x0131);
     SET_IDREG(isar, ID_PFR1, 0x001);
     SET_IDREG(isar, ID_DFR0, 0x010400);
-    cpu->id_afr0 = 0x0;
+    SET_IDREG(isar, ID_AFR0, 0x0);
     SET_IDREG(isar, ID_MMFR0, 0x0210030);
     SET_IDREG(isar, ID_MMFR1, 0x00000000);
     SET_IDREG(isar, ID_MMFR2, 0x01200000);
@@ -745,7 +745,7 @@ static void cortex_r52_initfn(Object *obj)
     SET_IDREG(isar, ID_PFR0, 0x00000131);
     SET_IDREG(isar, ID_PFR1, 0x10111001);
     SET_IDREG(isar, ID_DFR0, 0x03010006);
-    cpu->id_afr0 = 0x00000000;
+    SET_IDREG(isar, ID_AFR0, 0x00000000);
     SET_IDREG(isar, ID_MMFR0, 0x00211040);
     SET_IDREG(isar, ID_MMFR1, 0x40000000);
     SET_IDREG(isar, ID_MMFR2, 0x01200000);
@@ -977,7 +977,7 @@ static void arm_max_initfn(Object *obj)
     SET_IDREG(isar, ID_PFR0, 0x00000131);
     SET_IDREG(isar, ID_PFR1, 0x00011011);
     SET_IDREG(isar, ID_DFR0, 0x03010066);
-    cpu->id_afr0 = 0x00000000;
+    SET_IDREG(isar, ID_AFR0, 0x00000000);
     SET_IDREG(isar, ID_MMFR0, 0x10101105);
     SET_IDREG(isar, ID_MMFR1, 0x40000000);
     SET_IDREG(isar, ID_MMFR2, 0x01260000);
diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
index d0df50a2f3..e3183c53bb 100644
--- a/target/arm/tcg/cpu64.c
+++ b/target/arm/tcg/cpu64.c
@@ -52,7 +52,7 @@ static void aarch64_a35_initfn(Object *obj)
     SET_IDREG(isar, ID_PFR0, 0x00000131);
     SET_IDREG(isar, ID_PFR1, 0x00011011);
     SET_IDREG(isar, ID_DFR0, 0x03010066);
-    cpu->id_afr0 = 0;
+    SET_IDREG(isar, ID_AFR0, 0);
     SET_IDREG(isar, ID_MMFR0, 0x10201105);
     SET_IDREG(isar, ID_MMFR1, 0x40000000);
     SET_IDREG(isar, ID_MMFR2, 0x01260000);
@@ -227,7 +227,7 @@ static void aarch64_a55_initfn(Object *obj)
     SET_IDREG(isar, ID_AA64MMFR2, 0x0000000000001011ull);
     SET_IDREG(isar, ID_AA64PFR0, 0x0000000010112222ull);
     SET_IDREG(isar, ID_AA64PFR1, 0x0000000000000010ull);
-    cpu->id_afr0       = 0x00000000;
+    SET_IDREG(isar, ID_AFR0, 0x00000000);
     SET_IDREG(isar, ID_DFR0, 0x04010088);
     SET_IDREG(isar, ID_ISAR0, 0x02101110);
     SET_IDREG(isar, ID_ISAR1, 0x13112111);
@@ -298,7 +298,7 @@ static void aarch64_a72_initfn(Object *obj)
     SET_IDREG(isar, ID_PFR0, 0x00000131);
     SET_IDREG(isar, ID_PFR1, 0x00011011);
     SET_IDREG(isar, ID_DFR0, 0x03010066);
-    cpu->id_afr0 = 0x00000000;
+    SET_IDREG(isar, ID_AFR0, 0x00000000);
     SET_IDREG(isar, ID_MMFR0, 0x10201105);
     SET_IDREG(isar, ID_MMFR1, 0x40000000);
     SET_IDREG(isar, ID_MMFR2, 0x01260000);
@@ -360,7 +360,7 @@ static void aarch64_a76_initfn(Object *obj)
     SET_IDREG(isar, ID_AA64MMFR2, 0x0000000000001011ull);
     SET_IDREG(isar, ID_AA64PFR0, 0x1100000010111112ull); /* GIC filled in later */
     SET_IDREG(isar, ID_AA64PFR1, 0x0000000000000010ull);
-    cpu->id_afr0       = 0x00000000;
+    SET_IDREG(isar, ID_AFR0, 0x00000000);
     SET_IDREG(isar, ID_DFR0, 0x04010088);
     SET_IDREG(isar, ID_ISAR0, 0x02101110);
     SET_IDREG(isar, ID_ISAR1, 0x13112111);
@@ -608,7 +608,7 @@ static void aarch64_neoverse_n1_initfn(Object *obj)
     SET_IDREG(isar, ID_AA64MMFR2, 0x0000000000001011ull);
     SET_IDREG(isar, ID_AA64PFR0, 0x1100000010111112ull); /* GIC filled in later */
     SET_IDREG(isar, ID_AA64PFR1, 0x0000000000000020ull);
-    cpu->id_afr0       = 0x00000000;
+    SET_IDREG(isar, ID_AFR0, 0x00000000);
     SET_IDREG(isar, ID_DFR0, 0x04010088);
     SET_IDREG(isar, ID_ISAR0, 0x02101110);
     SET_IDREG(isar, ID_ISAR1, 0x13112111);
@@ -687,7 +687,7 @@ static void aarch64_neoverse_v1_initfn(Object *obj)
     SET_IDREG(isar, ID_AA64MMFR2, 0x0220011102101011ull),
     SET_IDREG(isar, ID_AA64PFR0, 0x1101110120111112ull); /* GIC filled in later */
     SET_IDREG(isar, ID_AA64PFR1, 0x0000000000000020ull);
-    cpu->id_afr0       = 0x00000000;
+    SET_IDREG(isar, ID_AFR0, 0x00000000);
     SET_IDREG(isar, ID_DFR0, 0x15011099);
     SET_IDREG(isar, ID_ISAR0, 0x02101110);
     SET_IDREG(isar, ID_ISAR1, 0x13112111);
@@ -905,7 +905,7 @@ static void aarch64_a710_initfn(Object *obj)
     SET_IDREG(isar, ID_PFR0, 0x21110131);
     SET_IDREG(isar, ID_PFR1, 0x00010000); /* GIC filled in later */
     SET_IDREG(isar, ID_DFR0, 0x16011099);
-    cpu->id_afr0       = 0;
+    SET_IDREG(isar, ID_AFR0, 0);
     SET_IDREG(isar, ID_MMFR0, 0x10201105);
     SET_IDREG(isar, ID_MMFR1, 0x40000000);
     SET_IDREG(isar, ID_MMFR2, 0x01260000);
@@ -1007,7 +1007,7 @@ static void aarch64_neoverse_n2_initfn(Object *obj)
     SET_IDREG(isar, ID_PFR0, 0x21110131);
     SET_IDREG(isar, ID_PFR1, 0x00010000); /* GIC filled in later */
     SET_IDREG(isar, ID_DFR0, 0x16011099);
-    cpu->id_afr0       = 0;
+    SET_IDREG(isar, ID_AFR0, 0);
     SET_IDREG(isar, ID_MMFR0, 0x10201105);
     SET_IDREG(isar, ID_MMFR1, 0x40000000);
     SET_IDREG(isar, ID_MMFR2, 0x01260000);

From a7e1c62d075d48f0d05e5758471d9caf97e330df Mon Sep 17 00:00:00 2001
From: Cornelia Huck <cohuck@redhat.com>
Date: Fri, 4 Jul 2025 16:19:24 +0200
Subject: [PATCH 2072/2760] arm/cpu: store id_aa64afr{0,1} into the idregs
 array
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Cornelia Huck <cohuck@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Message-id: 20250704141927.38963-3-cohuck@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu-sysregs.h.inc |  2 ++
 target/arm/cpu.h             |  2 --
 target/arm/helper.c          |  4 ++--
 target/arm/tcg/cpu64.c       | 16 ++++++++--------
 4 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/target/arm/cpu-sysregs.h.inc b/target/arm/cpu-sysregs.h.inc
index b96a358804..44c877245e 100644
--- a/target/arm/cpu-sysregs.h.inc
+++ b/target/arm/cpu-sysregs.h.inc
@@ -4,6 +4,8 @@ DEF(ID_AA64PFR1_EL1, 3, 0, 0, 4, 1)
 DEF(ID_AA64SMFR0_EL1, 3, 0, 0, 4, 5)
 DEF(ID_AA64DFR0_EL1, 3, 0, 0, 5, 0)
 DEF(ID_AA64DFR1_EL1, 3, 0, 0, 5, 1)
+DEF(ID_AA64AFR0_EL1, 3, 0, 0, 5, 4)
+DEF(ID_AA64AFR1_EL1, 3, 0, 0, 5, 5)
 DEF(ID_AA64ISAR0_EL1, 3, 0, 0, 6, 0)
 DEF(ID_AA64ISAR1_EL1, 3, 0, 0, 6, 1)
 DEF(ID_AA64ISAR2_EL1, 3, 0, 0, 6, 2)
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index 835700cfab..008e530578 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -1082,8 +1082,6 @@ struct ArchCPU {
     uint32_t reset_sctlr;
     uint64_t pmceid0;
     uint64_t pmceid1;
-    uint64_t id_aa64afr0;
-    uint64_t id_aa64afr1;
     uint64_t clidr;
     uint64_t mp_affinity; /* MP ID without feature bits */
     /* The elements of this array are the CCSIDR values for each cache,
diff --git a/target/arm/helper.c b/target/arm/helper.c
index ae6231803e..93da8f170e 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -7987,12 +7987,12 @@ void register_cp_regs_for_features(ARMCPU *cpu)
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 4,
               .access = PL1_R, .type = ARM_CP_CONST,
               .accessfn = access_aa64_tid3,
-              .resetvalue = cpu->id_aa64afr0 },
+              .resetvalue = GET_IDREG(isar, ID_AA64AFR0) },
             { .name = "ID_AA64AFR1_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 5,
               .access = PL1_R, .type = ARM_CP_CONST,
               .accessfn = access_aa64_tid3,
-              .resetvalue = cpu->id_aa64afr1 },
+              .resetvalue = GET_IDREG(isar, ID_AA64AFR1) },
             { .name = "ID_AA64AFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 6,
               .access = PL1_R, .type = ARM_CP_CONST,
diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
index e3183c53bb..3a65d3903b 100644
--- a/target/arm/tcg/cpu64.c
+++ b/target/arm/tcg/cpu64.c
@@ -428,8 +428,8 @@ static void aarch64_a64fx_initfn(Object *obj)
     SET_IDREG(isar, ID_AA64PFR1, 0x0000000000000000);
     SET_IDREG(isar, ID_AA64DFR0, 0x0000000010305408),
     SET_IDREG(isar, ID_AA64DFR1, 0x0000000000000000),
-    cpu->id_aa64afr0 = 0x0000000000000000;
-    cpu->id_aa64afr1 = 0x0000000000000000;
+    SET_IDREG(isar, ID_AA64AFR0, 0x0000000000000000);
+    SET_IDREG(isar, ID_AA64AFR1, 0x0000000000000000);
     SET_IDREG(isar, ID_AA64MMFR0, 0x0000000000001122);
     SET_IDREG(isar, ID_AA64MMFR1, 0x0000000011212100);
     SET_IDREG(isar, ID_AA64MMFR2, 0x0000000000001011);
@@ -676,8 +676,8 @@ static void aarch64_neoverse_v1_initfn(Object *obj)
     cpu->clidr = 0x82000023;
     cpu->ctr = 0xb444c004; /* With DIC and IDC set */
     cpu->dcz_blocksize = 4;
-    cpu->id_aa64afr0 = 0x00000000;
-    cpu->id_aa64afr1 = 0x00000000;
+    SET_IDREG(isar, ID_AA64AFR0, 0x00000000);
+    SET_IDREG(isar, ID_AA64AFR1, 0x00000000);
     SET_IDREG(isar, ID_AA64DFR0, 0x000001f210305519ull),
     SET_IDREG(isar, ID_AA64DFR1, 0x00000000),
     SET_IDREG(isar, ID_AA64ISAR0, 0x1011111110212120ull); /* with FEAT_RNG */
@@ -927,8 +927,8 @@ static void aarch64_a710_initfn(Object *obj)
     SET_IDREG(isar, ID_AA64ZFR0, 0x0000110100110021ull); /* with Crypto */
     SET_IDREG(isar, ID_AA64DFR0, 0x000011f010305619ull);
     SET_IDREG(isar, ID_AA64DFR1, 0);
-    cpu->id_aa64afr0       = 0;
-    cpu->id_aa64afr1       = 0;
+    SET_IDREG(isar, ID_AA64AFR0, 0);
+    SET_IDREG(isar, ID_AA64AFR1, 0);
     SET_IDREG(isar, ID_AA64ISAR0, 0x0221111110212120ull); /* with Crypto */
     SET_IDREG(isar, ID_AA64ISAR1, 0x0010111101211052ull);
     SET_IDREG(isar, ID_AA64MMFR0, 0x0000022200101122ull);
@@ -1029,8 +1029,8 @@ static void aarch64_neoverse_n2_initfn(Object *obj)
     SET_IDREG(isar, ID_AA64ZFR0, 0x0000110100110021ull); /* with Crypto */
     SET_IDREG(isar, ID_AA64DFR0, 0x000011f210305619ull);
     SET_IDREG(isar, ID_AA64DFR1, 0);
-    cpu->id_aa64afr0       = 0;
-    cpu->id_aa64afr1       = 0;
+    SET_IDREG(isar, ID_AA64AFR0, 0);
+    SET_IDREG(isar, ID_AA64AFR1, 0);
     SET_IDREG(isar, ID_AA64ISAR0, 0x1221111110212120ull); /* with Crypto and FEAT_RNG */
     SET_IDREG(isar, ID_AA64ISAR1, 0x0011111101211052ull);
     SET_IDREG(isar, ID_AA64MMFR0, 0x0000022200101125ull);

From e61aa4a5ffb5e849a25454c3f5fa1ae1b036bb29 Mon Sep 17 00:00:00 2001
From: Cornelia Huck <cohuck@redhat.com>
Date: Fri, 4 Jul 2025 16:19:25 +0200
Subject: [PATCH 2073/2760] arm/cpu: fix trailing ',' for SET_IDREG
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

While a trailing comma is not broken for SET_IDREG invocations, it
does look odd; use a semicolon instead.

Fixes: f1fd81291c91 ("arm/cpu: Store aa64mmfr0-3 into the idregs array")
Fixes: def3f1c1026a ("arm/cpu: Store aa64dfr0/1 into the idregs array")
Signed-off-by: Cornelia Huck <cohuck@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Message-id: 20250704141927.38963-4-cohuck@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/cpu64.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
index 3a65d3903b..bcc8e2dfaf 100644
--- a/target/arm/tcg/cpu64.c
+++ b/target/arm/tcg/cpu64.c
@@ -352,7 +352,7 @@ static void aarch64_a76_initfn(Object *obj)
     cpu->clidr = 0x82000023;
     cpu->ctr = 0x8444C004;
     cpu->dcz_blocksize = 4;
-    SET_IDREG(isar, ID_AA64DFR0, 0x0000000010305408ull),
+    SET_IDREG(isar, ID_AA64DFR0, 0x0000000010305408ull);
     SET_IDREG(isar, ID_AA64ISAR0, 0x0000100010211120ull);
     SET_IDREG(isar, ID_AA64ISAR1, 0x0000000000100001ull);
     SET_IDREG(isar, ID_AA64MMFR0, 0x0000000000101122ull);
@@ -426,8 +426,8 @@ static void aarch64_a64fx_initfn(Object *obj)
     cpu->reset_sctlr = 0x30000180;
     SET_IDREG(isar, ID_AA64PFR0, 0x0000000101111111); /* No RAS Extensions */
     SET_IDREG(isar, ID_AA64PFR1, 0x0000000000000000);
-    SET_IDREG(isar, ID_AA64DFR0, 0x0000000010305408),
-    SET_IDREG(isar, ID_AA64DFR1, 0x0000000000000000),
+    SET_IDREG(isar, ID_AA64DFR0, 0x0000000010305408);
+    SET_IDREG(isar, ID_AA64DFR1, 0x0000000000000000);
     SET_IDREG(isar, ID_AA64AFR0, 0x0000000000000000);
     SET_IDREG(isar, ID_AA64AFR1, 0x0000000000000000);
     SET_IDREG(isar, ID_AA64MMFR0, 0x0000000000001122);
@@ -678,13 +678,13 @@ static void aarch64_neoverse_v1_initfn(Object *obj)
     cpu->dcz_blocksize = 4;
     SET_IDREG(isar, ID_AA64AFR0, 0x00000000);
     SET_IDREG(isar, ID_AA64AFR1, 0x00000000);
-    SET_IDREG(isar, ID_AA64DFR0, 0x000001f210305519ull),
-    SET_IDREG(isar, ID_AA64DFR1, 0x00000000),
+    SET_IDREG(isar, ID_AA64DFR0, 0x000001f210305519ull);
+    SET_IDREG(isar, ID_AA64DFR1, 0x00000000);
     SET_IDREG(isar, ID_AA64ISAR0, 0x1011111110212120ull); /* with FEAT_RNG */
     SET_IDREG(isar, ID_AA64ISAR1, 0x0011000001211032ull);
     SET_IDREG(isar, ID_AA64MMFR0, 0x0000000000101125ull);
-    SET_IDREG(isar, ID_AA64MMFR1, 0x0000000010212122ull),
-    SET_IDREG(isar, ID_AA64MMFR2, 0x0220011102101011ull),
+    SET_IDREG(isar, ID_AA64MMFR1, 0x0000000010212122ull);
+    SET_IDREG(isar, ID_AA64MMFR2, 0x0220011102101011ull);
     SET_IDREG(isar, ID_AA64PFR0, 0x1101110120111112ull); /* GIC filled in later */
     SET_IDREG(isar, ID_AA64PFR1, 0x0000000000000020ull);
     SET_IDREG(isar, ID_AFR0, 0x00000000);

From f73632932bf19788dfd0ff406c2a8fe98e827c14 Mon Sep 17 00:00:00 2001
From: Cornelia Huck <cohuck@redhat.com>
Date: Fri, 4 Jul 2025 16:19:26 +0200
Subject: [PATCH 2074/2760] arm/cpu: store clidr into the idregs array
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Cornelia Huck <cohuck@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Message-id: 20250704141927.38963-5-cohuck@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/intc/armv7m_nvic.c        |  2 +-
 target/arm/cpu-sysregs.h.inc |  1 +
 target/arm/cpu.h             |  3 +--
 target/arm/cpu64.c           |  4 ++--
 target/arm/helper.c          |  2 +-
 target/arm/tcg/cpu-v7m.c     |  4 ++--
 target/arm/tcg/cpu32.c       | 12 ++++++------
 target/arm/tcg/cpu64.c       | 22 +++++++++++-----------
 8 files changed, 25 insertions(+), 25 deletions(-)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index d93e593fcb..7c78961040 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -1331,7 +1331,7 @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
         }
         return GET_IDREG(&cpu->isar, ID_ISAR5);
     case 0xd78: /* CLIDR */
-        return cpu->clidr;
+        return GET_IDREG(&cpu->isar, CLIDR);
     case 0xd7c: /* CTR */
         return cpu->ctr;
     case 0xd80: /* CSSIDR */
diff --git a/target/arm/cpu-sysregs.h.inc b/target/arm/cpu-sysregs.h.inc
index 44c877245e..f48a9daa7c 100644
--- a/target/arm/cpu-sysregs.h.inc
+++ b/target/arm/cpu-sysregs.h.inc
@@ -35,5 +35,6 @@ DEF(MVFR2_EL1, 3, 0, 0, 3, 2)
 DEF(ID_PFR2_EL1, 3, 0, 0, 3, 4)
 DEF(ID_DFR1_EL1, 3, 0, 0, 3, 5)
 DEF(ID_MMFR5_EL1, 3, 0, 0, 3, 6)
+DEF(CLIDR_EL1, 3, 1, 0, 0, 1)
 DEF(ID_AA64ZFR0_EL1, 3, 0, 0, 4, 4)
 DEF(CTR_EL0, 3, 3, 0, 0, 1)
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index 008e530578..dc9b6dce4c 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -1082,7 +1082,6 @@ struct ArchCPU {
     uint32_t reset_sctlr;
     uint64_t pmceid0;
     uint64_t pmceid1;
-    uint64_t clidr;
     uint64_t mp_affinity; /* MP ID without feature bits */
     /* The elements of this array are the CCSIDR values for each cache,
      * in the order L1DCache, L1ICache, L2DCache, L2ICache, etc.
@@ -2945,7 +2944,7 @@ static inline bool arm_v7m_csselr_razwi(ARMCPU *cpu)
     /* If all the CLIDR.Ctypem bits are 0 there are no caches, and
      * CSSELR is RAZ/WI.
      */
-    return (cpu->clidr & R_V7M_CLIDR_CTYPE_ALL_MASK) != 0;
+    return (GET_IDREG(&cpu->isar, CLIDR) & R_V7M_CLIDR_CTYPE_ALL_MASK) != 0;
 }
 
 static inline bool arm_sctlr_b(CPUARMState *env)
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index d648ea066c..26cf7e6dfa 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -683,7 +683,7 @@ static void aarch64_a57_initfn(Object *obj)
     cpu->isar.dbgdevid = 0x01110f13;
     cpu->isar.dbgdevid1 = 0x2;
     cpu->isar.reset_pmcr_el0 = 0x41013000;
-    cpu->clidr = 0x0a200023;
+    SET_IDREG(isar, CLIDR, 0x0a200023);
     /* 32KB L1 dcache */
     cpu->ccsidr[0] = make_ccsidr(CCSIDR_FORMAT_LEGACY, 4, 64, 32 * KiB, 7);
     /* 48KB L1 icache */
@@ -745,7 +745,7 @@ static void aarch64_a53_initfn(Object *obj)
     cpu->isar.dbgdevid = 0x00110f13;
     cpu->isar.dbgdevid1 = 0x1;
     cpu->isar.reset_pmcr_el0 = 0x41033000;
-    cpu->clidr = 0x0a200023;
+    SET_IDREG(isar, CLIDR, 0x0a200023);
     /* 32KB L1 dcache */
     cpu->ccsidr[0] = make_ccsidr(CCSIDR_FORMAT_LEGACY, 4, 64, 32 * KiB, 7);
     /* 32KB L1 icache */
diff --git a/target/arm/helper.c b/target/arm/helper.c
index 93da8f170e..3ea9958ea7 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -7889,7 +7889,7 @@ void register_cp_regs_for_features(ARMCPU *cpu)
             .access = PL1_R, .type = ARM_CP_CONST,
             .accessfn = access_tid4,
             .fgt = FGT_CLIDR_EL1,
-            .resetvalue = cpu->clidr
+            .resetvalue = GET_IDREG(isar, CLIDR)
         };
         define_one_arm_cp_reg(cpu, &clidr);
         define_arm_cp_regs(cpu, v7_cp_reginfo);
diff --git a/target/arm/tcg/cpu-v7m.c b/target/arm/tcg/cpu-v7m.c
index a65b83fe99..dc249ce1f1 100644
--- a/target/arm/tcg/cpu-v7m.c
+++ b/target/arm/tcg/cpu-v7m.c
@@ -195,7 +195,7 @@ static void cortex_m33_initfn(Object *obj)
     SET_IDREG(isar, ID_ISAR4, 0x01310132);
     SET_IDREG(isar, ID_ISAR5, 0x00000000);
     SET_IDREG(isar, ID_ISAR6, 0x00000000);
-    cpu->clidr = 0x00000000;
+    SET_IDREG(isar, CLIDR, 0x00000000);
     cpu->ctr = 0x8000c000;
 }
 
@@ -233,7 +233,7 @@ static void cortex_m55_initfn(Object *obj)
     SET_IDREG(isar, ID_ISAR4, 0x01310132);
     SET_IDREG(isar, ID_ISAR5, 0x00000000);
     SET_IDREG(isar, ID_ISAR6, 0x00000000);
-    cpu->clidr = 0x00000000; /* caches not implemented */
+    SET_IDREG(isar, CLIDR, 0x00000000); /* caches not implemented */
     cpu->ctr = 0x8303c003;
 }
 
diff --git a/target/arm/tcg/cpu32.c b/target/arm/tcg/cpu32.c
index 03cbe42f22..a2a23eae0d 100644
--- a/target/arm/tcg/cpu32.c
+++ b/target/arm/tcg/cpu32.c
@@ -371,7 +371,7 @@ static void cortex_a8_initfn(Object *obj)
     SET_IDREG(isar, ID_ISAR3, 0x11112131);
     SET_IDREG(isar, ID_ISAR4, 0x00111142);
     cpu->isar.dbgdidr = 0x15141000;
-    cpu->clidr = (1 << 27) | (2 << 24) | 3;
+    SET_IDREG(isar, CLIDR, (1 << 27) | (2 << 24) | 3);
     cpu->ccsidr[0] = 0xe007e01a; /* 16k L1 dcache. */
     cpu->ccsidr[1] = 0x2007e01a; /* 16k L1 icache. */
     cpu->ccsidr[2] = 0xf0000000; /* No L2 icache. */
@@ -447,7 +447,7 @@ static void cortex_a9_initfn(Object *obj)
     SET_IDREG(isar, ID_ISAR3, 0x11112131);
     SET_IDREG(isar, ID_ISAR4, 0x00111142);
     cpu->isar.dbgdidr = 0x35141000;
-    cpu->clidr = (1 << 27) | (1 << 24) | 3;
+    SET_IDREG(isar, CLIDR, (1 << 27) | (1 << 24) | 3);
     cpu->ccsidr[0] = 0xe00fe019; /* 16k L1 dcache. */
     cpu->ccsidr[1] = 0x200fe019; /* 16k L1 icache. */
     cpu->isar.reset_pmcr_el0 = 0x41093000;
@@ -519,7 +519,7 @@ static void cortex_a7_initfn(Object *obj)
     cpu->isar.dbgdidr = 0x3515f005;
     cpu->isar.dbgdevid = 0x01110f13;
     cpu->isar.dbgdevid1 = 0x1;
-    cpu->clidr = 0x0a200023;
+    SET_IDREG(isar, CLIDR, 0x0a200023);
     cpu->ccsidr[0] = 0x701fe00a; /* 32K L1 dcache */
     cpu->ccsidr[1] = 0x201fe00a; /* 32K L1 icache */
     cpu->ccsidr[2] = 0x711fe07a; /* 4096K L2 unified cache */
@@ -567,7 +567,7 @@ static void cortex_a15_initfn(Object *obj)
     cpu->isar.dbgdidr = 0x3515f021;
     cpu->isar.dbgdevid = 0x01110f13;
     cpu->isar.dbgdevid1 = 0x0;
-    cpu->clidr = 0x0a200023;
+    SET_IDREG(isar, CLIDR, 0x0a200023);
     cpu->ccsidr[0] = 0x701fe00a; /* 32K L1 dcache */
     cpu->ccsidr[1] = 0x201fe00a; /* 32K L1 icache */
     cpu->ccsidr[2] = 0x711fe07a; /* 4096K L2 unified cache */
@@ -758,7 +758,7 @@ static void cortex_r52_initfn(Object *obj)
     SET_IDREG(isar, ID_ISAR4, 0x00010142);
     SET_IDREG(isar, ID_ISAR5, 0x00010001);
     cpu->isar.dbgdidr = 0x77168000;
-    cpu->clidr = (1 << 27) | (1 << 24) | 0x3;
+    SET_IDREG(isar, CLIDR, (1 << 27) | (1 << 24) | 0x3);
     cpu->ccsidr[0] = 0x700fe01a; /* 32KB L1 dcache */
     cpu->ccsidr[1] = 0x201fe00a; /* 32KB L1 icache */
 
@@ -990,7 +990,7 @@ static void arm_max_initfn(Object *obj)
     SET_IDREG(isar, ID_ISAR5, 0x00011121);
     SET_IDREG(isar, ID_ISAR6, 0);
     cpu->isar.reset_pmcr_el0 = 0x41013000;
-    cpu->clidr = 0x0a200023;
+    SET_IDREG(isar, CLIDR, 0x0a200023);
     cpu->ccsidr[0] = 0x701fe00a; /* 32KB L1 dcache */
     cpu->ccsidr[1] = 0x201fe012; /* 48KB L1 icache */
     cpu->ccsidr[2] = 0x70ffe07a; /* 2048KB L2 cache */
diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
index bcc8e2dfaf..35cddbafa4 100644
--- a/target/arm/tcg/cpu64.c
+++ b/target/arm/tcg/cpu64.c
@@ -71,7 +71,7 @@ static void aarch64_a35_initfn(Object *obj)
     SET_IDREG(isar, ID_AA64ISAR1, 0);
     SET_IDREG(isar, ID_AA64MMFR0, 0x00101122);
     SET_IDREG(isar, ID_AA64MMFR1, 0);
-    cpu->clidr = 0x0a200023;
+    SET_IDREG(isar, CLIDR, 0x0a200023);
     cpu->dcz_blocksize = 4;
 
     /* From B2.4 AArch64 Virtual Memory control registers */
@@ -216,7 +216,7 @@ static void aarch64_a55_initfn(Object *obj)
     set_feature(&cpu->env, ARM_FEATURE_PMU);
 
     /* Ordered by B2.4 AArch64 registers by functional group */
-    cpu->clidr = 0x82000023;
+    SET_IDREG(isar, CLIDR, 0x82000023);
     cpu->ctr = 0x84448004; /* L1Ip = VIPT */
     cpu->dcz_blocksize = 4; /* 64 bytes */
     SET_IDREG(isar, ID_AA64DFR0, 0x0000000010305408ull);
@@ -317,7 +317,7 @@ static void aarch64_a72_initfn(Object *obj)
     cpu->isar.dbgdevid = 0x01110f13;
     cpu->isar.dbgdevid1 = 0x2;
     cpu->isar.reset_pmcr_el0 = 0x41023000;
-    cpu->clidr = 0x0a200023;
+    SET_IDREG(isar, CLIDR, 0x0a200023);
     /* 32KB L1 dcache */
     cpu->ccsidr[0] = make_ccsidr(CCSIDR_FORMAT_LEGACY, 4, 64, 32 * KiB, 7);
     /* 48KB L1 dcache */
@@ -349,7 +349,7 @@ static void aarch64_a76_initfn(Object *obj)
     set_feature(&cpu->env, ARM_FEATURE_PMU);
 
     /* Ordered by B2.4 AArch64 registers by functional group */
-    cpu->clidr = 0x82000023;
+    SET_IDREG(isar, CLIDR, 0x82000023);
     cpu->ctr = 0x8444C004;
     cpu->dcz_blocksize = 4;
     SET_IDREG(isar, ID_AA64DFR0, 0x0000000010305408ull);
@@ -436,7 +436,7 @@ static void aarch64_a64fx_initfn(Object *obj)
     SET_IDREG(isar, ID_AA64ISAR0, 0x0000000010211120);
     SET_IDREG(isar, ID_AA64ISAR1, 0x0000000000010001);
     SET_IDREG(isar, ID_AA64ZFR0, 0x0000000000000000);
-    cpu->clidr = 0x0000000080000023;
+    SET_IDREG(isar, CLIDR, 0x0000000080000023);
     /* 64KB L1 dcache */
     cpu->ccsidr[0] = make_ccsidr(CCSIDR_FORMAT_LEGACY, 4, 256, 64 * KiB, 7);
     /* 64KB L1 icache */
@@ -597,7 +597,7 @@ static void aarch64_neoverse_n1_initfn(Object *obj)
     set_feature(&cpu->env, ARM_FEATURE_PMU);
 
     /* Ordered by B2.4 AArch64 registers by functional group */
-    cpu->clidr = 0x82000023;
+    SET_IDREG(isar, CLIDR, 0x82000023);
     cpu->ctr = 0x8444c004;
     cpu->dcz_blocksize = 4;
     SET_IDREG(isar, ID_AA64DFR0, 0x0000000110305408ull);
@@ -673,7 +673,7 @@ static void aarch64_neoverse_v1_initfn(Object *obj)
     set_feature(&cpu->env, ARM_FEATURE_PMU);
 
     /* Ordered by 3.2.4 AArch64 registers by functional group */
-    cpu->clidr = 0x82000023;
+    SET_IDREG(isar, CLIDR, 0x82000023);
     cpu->ctr = 0xb444c004; /* With DIC and IDC set */
     cpu->dcz_blocksize = 4;
     SET_IDREG(isar, ID_AA64AFR0, 0x00000000);
@@ -934,7 +934,7 @@ static void aarch64_a710_initfn(Object *obj)
     SET_IDREG(isar, ID_AA64MMFR0, 0x0000022200101122ull);
     SET_IDREG(isar, ID_AA64MMFR1, 0x0000000010212122ull);
     SET_IDREG(isar, ID_AA64MMFR2, 0x1221011110101011ull);
-    cpu->clidr             = 0x0000001482000023ull;
+    SET_IDREG(isar, CLIDR, 0x0000001482000023ull);
     cpu->gm_blocksize      = 4;
     cpu->ctr               = 0x000000049444c004ull;
     cpu->dcz_blocksize     = 4;
@@ -1036,7 +1036,7 @@ static void aarch64_neoverse_n2_initfn(Object *obj)
     SET_IDREG(isar, ID_AA64MMFR0, 0x0000022200101125ull);
     SET_IDREG(isar, ID_AA64MMFR1, 0x0000000010212122ull);
     SET_IDREG(isar, ID_AA64MMFR2, 0x1221011112101011ull);
-    cpu->clidr             = 0x0000001482000023ull;
+    SET_IDREG(isar, CLIDR, 0x0000001482000023ull);
     cpu->gm_blocksize      = 4;
     cpu->ctr               = 0x00000004b444c004ull;
     cpu->dcz_blocksize     = 4;
@@ -1125,10 +1125,10 @@ void aarch64_max_tcg_initfn(Object *obj)
      * We're going to set FEAT_S2FWB, which mandates that CLIDR_EL1.{LoUU,LoUIS}
      * are zero.
      */
-    u = cpu->clidr;
+    u = GET_IDREG(isar, CLIDR);
     u = FIELD_DP32(u, CLIDR_EL1, LOUIS, 0);
     u = FIELD_DP32(u, CLIDR_EL1, LOUU, 0);
-    cpu->clidr = u;
+    SET_IDREG(isar, CLIDR, u);
 
     /*
      * Set CTR_EL0.DIC and IDC to tell the guest it doesnt' need to

From 3f1772cbdc152125d84d2f6e75ec06799a498b4e Mon Sep 17 00:00:00 2001
From: Cornelia Huck <cohuck@redhat.com>
Date: Fri, 4 Jul 2025 16:19:27 +0200
Subject: [PATCH 2075/2760] arm/kvm: shorten one overly long line
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fixes: 804cfc7eedb7 ("arm/cpu: Store aa64isar0/aa64zfr0 into the idregs arrays")
Signed-off-by: Cornelia Huck <cohuck@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250704141927.38963-6-cohuck@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/kvm.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index 426f8b159e..8ab0d692d3 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -230,7 +230,8 @@ static uint64_t idregs_sysreg_to_kvm_reg(ARMSysRegs sysreg)
 }
 
 /* read a sysreg value and store it in the idregs */
-static int get_host_cpu_reg(int fd, ARMHostCPUFeatures *ahcf, ARMIDRegisterIdx index)
+static int get_host_cpu_reg(int fd, ARMHostCPUFeatures *ahcf,
+                            ARMIDRegisterIdx index)
 {
     uint64_t *reg;
     int ret;

From dcef48a56556235578b9e4ea3b4a13e01d9d95e8 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 7 Jul 2025 09:15:45 -0600
Subject: [PATCH 2076/2760] target/arm: Drop stub for define_tlb_insn_regs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Allow the call to be compiled out by protecting it
with tcg_enabled.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250707151547.196393-2-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c    | 4 +++-
 target/arm/tcg-stubs.c | 5 -----
 2 files changed, 3 insertions(+), 6 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index 3ea9958ea7..c1b684e3d1 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -7771,7 +7771,9 @@ void register_cp_regs_for_features(ARMCPU *cpu)
     }
 
 #ifndef CONFIG_USER_ONLY
-    define_tlb_insn_regs(cpu);
+    if (tcg_enabled()) {
+        define_tlb_insn_regs(cpu);
+    }
 #endif
 
     if (arm_feature(env, ARM_FEATURE_V6)) {
diff --git a/target/arm/tcg-stubs.c b/target/arm/tcg-stubs.c
index 5e5166c049..aac99b2672 100644
--- a/target/arm/tcg-stubs.c
+++ b/target/arm/tcg-stubs.c
@@ -22,11 +22,6 @@ void raise_exception_ra(CPUARMState *env, uint32_t excp, uint32_t syndrome,
     g_assert_not_reached();
 }
 
-/* TLBI insns are only used by TCG, so we don't need to do anything for KVM */
-void define_tlb_insn_regs(ARMCPU *cpu)
-{
-}
-
 /* With KVM, we never use float_status, so these can be no-ops */
 void arm_set_default_fp_behaviours(float_status *s)
 {

From a62fa0c7a00fab51459c68986e9259c389f1e5d6 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 7 Jul 2025 09:15:46 -0600
Subject: [PATCH 2077/2760] target/arm: Split out AT insns to tcg/cpregs-at.c

Split out all "system instructions for address translation".
While mapped into "cpregs", these are instructions, and thus
are handled in hardware by virtualization.  They are all
priviledged, and thus not reachable for user-only.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250707151547.196393-3-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c        | 514 +-----------------------------------
 target/arm/internals.h     |   3 +
 target/arm/tcg/cpregs-at.c | 519 +++++++++++++++++++++++++++++++++++++
 target/arm/tcg/meson.build |   1 +
 4 files changed, 525 insertions(+), 512 deletions(-)
 create mode 100644 target/arm/tcg/cpregs-at.c

diff --git a/target/arm/helper.c b/target/arm/helper.c
index c1b684e3d1..0883246905 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -270,7 +270,7 @@ void init_cpreg_list(ARMCPU *cpu)
     g_list_free(keys);
 }
 
-static bool arm_pan_enabled(CPUARMState *env)
+bool arm_pan_enabled(CPUARMState *env)
 {
     if (is_a64(env)) {
         if ((arm_hcr_el2_eff(env) & (HCR_NV | HCR_NV1)) == (HCR_NV | HCR_NV1)) {
@@ -3448,402 +3448,6 @@ static void par_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
     }
 }
 
-#ifndef CONFIG_USER_ONLY
-/* get_phys_addr() isn't present for user-mode-only targets */
-
-static CPAccessResult ats_access(CPUARMState *env, const ARMCPRegInfo *ri,
-                                 bool isread)
-{
-    if (ri->opc2 & 4) {
-        /*
-         * The ATS12NSO* operations must trap to EL3 or EL2 if executed in
-         * Secure EL1 (which can only happen if EL3 is AArch64).
-         * They are simply UNDEF if executed from NS EL1.
-         * They function normally from EL2 or EL3.
-         */
-        if (arm_current_el(env) == 1) {
-            if (arm_is_secure_below_el3(env)) {
-                if (env->cp15.scr_el3 & SCR_EEL2) {
-                    return CP_ACCESS_TRAP_EL2;
-                }
-                return CP_ACCESS_TRAP_EL3;
-            }
-            return CP_ACCESS_UNDEFINED;
-        }
-    }
-    return CP_ACCESS_OK;
-}
-
-#ifdef CONFIG_TCG
-static int par_el1_shareability(GetPhysAddrResult *res)
-{
-    /*
-     * The PAR_EL1.SH field must be 0b10 for Device or Normal-NC
-     * memory -- see pseudocode PAREncodeShareability().
-     */
-    if (((res->cacheattrs.attrs & 0xf0) == 0) ||
-        res->cacheattrs.attrs == 0x44 || res->cacheattrs.attrs == 0x40) {
-        return 2;
-    }
-    return res->cacheattrs.shareability;
-}
-
-static uint64_t do_ats_write(CPUARMState *env, uint64_t value,
-                             MMUAccessType access_type, ARMMMUIdx mmu_idx,
-                             ARMSecuritySpace ss)
-{
-    bool ret;
-    uint64_t par64;
-    bool format64 = false;
-    ARMMMUFaultInfo fi = {};
-    GetPhysAddrResult res = {};
-
-    /*
-     * I_MXTJT: Granule protection checks are not performed on the final
-     * address of a successful translation.  This is a translation not a
-     * memory reference, so "memop = none = 0".
-     */
-    ret = get_phys_addr_with_space_nogpc(env, value, access_type, 0,
-                                         mmu_idx, ss, &res, &fi);
-
-    /*
-     * ATS operations only do S1 or S1+S2 translations, so we never
-     * have to deal with the ARMCacheAttrs format for S2 only.
-     */
-    assert(!res.cacheattrs.is_s2_format);
-
-    if (ret) {
-        /*
-         * Some kinds of translation fault must cause exceptions rather
-         * than being reported in the PAR.
-         */
-        int current_el = arm_current_el(env);
-        int target_el;
-        uint32_t syn, fsr, fsc;
-        bool take_exc = false;
-
-        if (fi.s1ptw && current_el == 1
-            && arm_mmu_idx_is_stage1_of_2(mmu_idx)) {
-            /*
-             * Synchronous stage 2 fault on an access made as part of the
-             * translation table walk for AT S1E0* or AT S1E1* insn
-             * executed from NS EL1. If this is a synchronous external abort
-             * and SCR_EL3.EA == 1, then we take a synchronous external abort
-             * to EL3. Otherwise the fault is taken as an exception to EL2,
-             * and HPFAR_EL2 holds the faulting IPA.
-             */
-            if (fi.type == ARMFault_SyncExternalOnWalk &&
-                (env->cp15.scr_el3 & SCR_EA)) {
-                target_el = 3;
-            } else {
-                env->cp15.hpfar_el2 = extract64(fi.s2addr, 12, 47) << 4;
-                if (arm_is_secure_below_el3(env) && fi.s1ns) {
-                    env->cp15.hpfar_el2 |= HPFAR_NS;
-                }
-                target_el = 2;
-            }
-            take_exc = true;
-        } else if (fi.type == ARMFault_SyncExternalOnWalk) {
-            /*
-             * Synchronous external aborts during a translation table walk
-             * are taken as Data Abort exceptions.
-             */
-            if (fi.stage2) {
-                if (current_el == 3) {
-                    target_el = 3;
-                } else {
-                    target_el = 2;
-                }
-            } else {
-                target_el = exception_target_el(env);
-            }
-            take_exc = true;
-        }
-
-        if (take_exc) {
-            /* Construct FSR and FSC using same logic as arm_deliver_fault() */
-            if (target_el == 2 || arm_el_is_aa64(env, target_el) ||
-                arm_s1_regime_using_lpae_format(env, mmu_idx)) {
-                fsr = arm_fi_to_lfsc(&fi);
-                fsc = extract32(fsr, 0, 6);
-            } else {
-                fsr = arm_fi_to_sfsc(&fi);
-                fsc = 0x3f;
-            }
-            /*
-             * Report exception with ESR indicating a fault due to a
-             * translation table walk for a cache maintenance instruction.
-             */
-            syn = syn_data_abort_no_iss(current_el == target_el, 0,
-                                        fi.ea, 1, fi.s1ptw, 1, fsc);
-            env->exception.vaddress = value;
-            env->exception.fsr = fsr;
-            raise_exception(env, EXCP_DATA_ABORT, syn, target_el);
-        }
-    }
-
-    if (is_a64(env)) {
-        format64 = true;
-    } else if (arm_feature(env, ARM_FEATURE_LPAE)) {
-        /*
-         * ATS1Cxx:
-         * * TTBCR.EAE determines whether the result is returned using the
-         *   32-bit or the 64-bit PAR format
-         * * Instructions executed in Hyp mode always use the 64bit format
-         *
-         * ATS1S2NSOxx uses the 64bit format if any of the following is true:
-         * * The Non-secure TTBCR.EAE bit is set to 1
-         * * The implementation includes EL2, and the value of HCR.VM is 1
-         *
-         * (Note that HCR.DC makes HCR.VM behave as if it is 1.)
-         *
-         * ATS1Hx always uses the 64bit format.
-         */
-        format64 = arm_s1_regime_using_lpae_format(env, mmu_idx);
-
-        if (arm_feature(env, ARM_FEATURE_EL2)) {
-            if (mmu_idx == ARMMMUIdx_E10_0 ||
-                mmu_idx == ARMMMUIdx_E10_1 ||
-                mmu_idx == ARMMMUIdx_E10_1_PAN) {
-                format64 |= env->cp15.hcr_el2 & (HCR_VM | HCR_DC);
-            } else {
-                format64 |= arm_current_el(env) == 2;
-            }
-        }
-    }
-
-    if (format64) {
-        /* Create a 64-bit PAR */
-        par64 = (1 << 11); /* LPAE bit always set */
-        if (!ret) {
-            par64 |= res.f.phys_addr & ~0xfffULL;
-            if (!res.f.attrs.secure) {
-                par64 |= (1 << 9); /* NS */
-            }
-            par64 |= (uint64_t)res.cacheattrs.attrs << 56; /* ATTR */
-            par64 |= par_el1_shareability(&res) << 7; /* SH */
-        } else {
-            uint32_t fsr = arm_fi_to_lfsc(&fi);
-
-            par64 |= 1; /* F */
-            par64 |= (fsr & 0x3f) << 1; /* FS */
-            if (fi.stage2) {
-                par64 |= (1 << 9); /* S */
-            }
-            if (fi.s1ptw) {
-                par64 |= (1 << 8); /* PTW */
-            }
-        }
-    } else {
-        /*
-         * fsr is a DFSR/IFSR value for the short descriptor
-         * translation table format (with WnR always clear).
-         * Convert it to a 32-bit PAR.
-         */
-        if (!ret) {
-            /* We do not set any attribute bits in the PAR */
-            if (res.f.lg_page_size == 24
-                && arm_feature(env, ARM_FEATURE_V7)) {
-                par64 = (res.f.phys_addr & 0xff000000) | (1 << 1);
-            } else {
-                par64 = res.f.phys_addr & 0xfffff000;
-            }
-            if (!res.f.attrs.secure) {
-                par64 |= (1 << 9); /* NS */
-            }
-        } else {
-            uint32_t fsr = arm_fi_to_sfsc(&fi);
-
-            par64 = ((fsr & (1 << 10)) >> 5) | ((fsr & (1 << 12)) >> 6) |
-                    ((fsr & 0xf) << 1) | 1;
-        }
-    }
-    return par64;
-}
-#endif /* CONFIG_TCG */
-
-static void ats_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
-{
-#ifdef CONFIG_TCG
-    MMUAccessType access_type = ri->opc2 & 1 ? MMU_DATA_STORE : MMU_DATA_LOAD;
-    uint64_t par64;
-    ARMMMUIdx mmu_idx;
-    int el = arm_current_el(env);
-    ARMSecuritySpace ss = arm_security_space(env);
-
-    switch (ri->opc2 & 6) {
-    case 0:
-        /* stage 1 current state PL1: ATS1CPR, ATS1CPW, ATS1CPRP, ATS1CPWP */
-        switch (el) {
-        case 3:
-            if (ri->crm == 9 && arm_pan_enabled(env)) {
-                mmu_idx = ARMMMUIdx_E30_3_PAN;
-            } else {
-                mmu_idx = ARMMMUIdx_E3;
-            }
-            break;
-        case 2:
-            g_assert(ss != ARMSS_Secure);  /* ARMv8.4-SecEL2 is 64-bit only */
-            /* fall through */
-        case 1:
-            if (ri->crm == 9 && arm_pan_enabled(env)) {
-                mmu_idx = ARMMMUIdx_Stage1_E1_PAN;
-            } else {
-                mmu_idx = ARMMMUIdx_Stage1_E1;
-            }
-            break;
-        default:
-            g_assert_not_reached();
-        }
-        break;
-    case 2:
-        /* stage 1 current state PL0: ATS1CUR, ATS1CUW */
-        switch (el) {
-        case 3:
-            mmu_idx = ARMMMUIdx_E30_0;
-            break;
-        case 2:
-            g_assert(ss != ARMSS_Secure);  /* ARMv8.4-SecEL2 is 64-bit only */
-            mmu_idx = ARMMMUIdx_Stage1_E0;
-            break;
-        case 1:
-            mmu_idx = ARMMMUIdx_Stage1_E0;
-            break;
-        default:
-            g_assert_not_reached();
-        }
-        break;
-    case 4:
-        /* stage 1+2 NonSecure PL1: ATS12NSOPR, ATS12NSOPW */
-        mmu_idx = ARMMMUIdx_E10_1;
-        ss = ARMSS_NonSecure;
-        break;
-    case 6:
-        /* stage 1+2 NonSecure PL0: ATS12NSOUR, ATS12NSOUW */
-        mmu_idx = ARMMMUIdx_E10_0;
-        ss = ARMSS_NonSecure;
-        break;
-    default:
-        g_assert_not_reached();
-    }
-
-    par64 = do_ats_write(env, value, access_type, mmu_idx, ss);
-
-    A32_BANKED_CURRENT_REG_SET(env, par, par64);
-#else
-    /* Handled by hardware accelerator. */
-    g_assert_not_reached();
-#endif /* CONFIG_TCG */
-}
-
-static void ats1h_write(CPUARMState *env, const ARMCPRegInfo *ri,
-                        uint64_t value)
-{
-#ifdef CONFIG_TCG
-    MMUAccessType access_type = ri->opc2 & 1 ? MMU_DATA_STORE : MMU_DATA_LOAD;
-    uint64_t par64;
-
-    /* There is no SecureEL2 for AArch32. */
-    par64 = do_ats_write(env, value, access_type, ARMMMUIdx_E2,
-                         ARMSS_NonSecure);
-
-    A32_BANKED_CURRENT_REG_SET(env, par, par64);
-#else
-    /* Handled by hardware accelerator. */
-    g_assert_not_reached();
-#endif /* CONFIG_TCG */
-}
-
-static CPAccessResult at_e012_access(CPUARMState *env, const ARMCPRegInfo *ri,
-                                     bool isread)
-{
-    /*
-     * R_NYXTL: instruction is UNDEFINED if it applies to an Exception level
-     * lower than EL3 and the combination SCR_EL3.{NSE,NS} is reserved. This can
-     * only happen when executing at EL3 because that combination also causes an
-     * illegal exception return. We don't need to check FEAT_RME either, because
-     * scr_write() ensures that the NSE bit is not set otherwise.
-     */
-    if ((env->cp15.scr_el3 & (SCR_NSE | SCR_NS)) == SCR_NSE) {
-        return CP_ACCESS_UNDEFINED;
-    }
-    return CP_ACCESS_OK;
-}
-
-static CPAccessResult at_s1e2_access(CPUARMState *env, const ARMCPRegInfo *ri,
-                                     bool isread)
-{
-    if (arm_current_el(env) == 3 &&
-        !(env->cp15.scr_el3 & (SCR_NS | SCR_EEL2))) {
-        return CP_ACCESS_UNDEFINED;
-    }
-    return at_e012_access(env, ri, isread);
-}
-
-static CPAccessResult at_s1e01_access(CPUARMState *env, const ARMCPRegInfo *ri,
-                                      bool isread)
-{
-    if (arm_current_el(env) == 1 && (arm_hcr_el2_eff(env) & HCR_AT)) {
-        return CP_ACCESS_TRAP_EL2;
-    }
-    return at_e012_access(env, ri, isread);
-}
-
-static void ats_write64(CPUARMState *env, const ARMCPRegInfo *ri,
-                        uint64_t value)
-{
-#ifdef CONFIG_TCG
-    MMUAccessType access_type = ri->opc2 & 1 ? MMU_DATA_STORE : MMU_DATA_LOAD;
-    ARMMMUIdx mmu_idx;
-    uint64_t hcr_el2 = arm_hcr_el2_eff(env);
-    bool regime_e20 = (hcr_el2 & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE);
-    bool for_el3 = false;
-    ARMSecuritySpace ss;
-
-    switch (ri->opc2 & 6) {
-    case 0:
-        switch (ri->opc1) {
-        case 0: /* AT S1E1R, AT S1E1W, AT S1E1RP, AT S1E1WP */
-            if (ri->crm == 9 && arm_pan_enabled(env)) {
-                mmu_idx = regime_e20 ?
-                          ARMMMUIdx_E20_2_PAN : ARMMMUIdx_Stage1_E1_PAN;
-            } else {
-                mmu_idx = regime_e20 ? ARMMMUIdx_E20_2 : ARMMMUIdx_Stage1_E1;
-            }
-            break;
-        case 4: /* AT S1E2R, AT S1E2W */
-            mmu_idx = hcr_el2 & HCR_E2H ? ARMMMUIdx_E20_2 : ARMMMUIdx_E2;
-            break;
-        case 6: /* AT S1E3R, AT S1E3W */
-            mmu_idx = ARMMMUIdx_E3;
-            for_el3 = true;
-            break;
-        default:
-            g_assert_not_reached();
-        }
-        break;
-    case 2: /* AT S1E0R, AT S1E0W */
-        mmu_idx = regime_e20 ? ARMMMUIdx_E20_0 : ARMMMUIdx_Stage1_E0;
-        break;
-    case 4: /* AT S12E1R, AT S12E1W */
-        mmu_idx = regime_e20 ? ARMMMUIdx_E20_2 : ARMMMUIdx_E10_1;
-        break;
-    case 6: /* AT S12E0R, AT S12E0W */
-        mmu_idx = regime_e20 ? ARMMMUIdx_E20_0 : ARMMMUIdx_E10_0;
-        break;
-    default:
-        g_assert_not_reached();
-    }
-
-    ss = for_el3 ? arm_security_space(env) : arm_security_space_below_el3(env);
-    env->cp15.par_el[1] = do_ats_write(env, value, access_type, mmu_idx, ss);
-#else
-    /* Handled by hardware accelerator. */
-    g_assert_not_reached();
-#endif /* CONFIG_TCG */
-}
-#endif
-
 /* Return basic MPU access permission bits.  */
 static uint32_t simple_mpu_ap_bits(uint32_t val)
 {
@@ -5094,53 +4698,6 @@ static const ARMCPRegInfo v8_cp_reginfo[] = {
       .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 2,
       .fgt = FGT_DCCISW,
       .access = PL1_W, .accessfn = access_tsw, .type = ARM_CP_NOP },
-#ifndef CONFIG_USER_ONLY
-    /* 64 bit address translation operations */
-    { .name = "AT_S1E1R", .state = ARM_CP_STATE_AA64,
-      .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 0,
-      .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
-      .fgt = FGT_ATS1E1R,
-      .accessfn = at_s1e01_access, .writefn = ats_write64 },
-    { .name = "AT_S1E1W", .state = ARM_CP_STATE_AA64,
-      .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 1,
-      .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
-      .fgt = FGT_ATS1E1W,
-      .accessfn = at_s1e01_access, .writefn = ats_write64 },
-    { .name = "AT_S1E0R", .state = ARM_CP_STATE_AA64,
-      .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 2,
-      .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
-      .fgt = FGT_ATS1E0R,
-      .accessfn = at_s1e01_access, .writefn = ats_write64 },
-    { .name = "AT_S1E0W", .state = ARM_CP_STATE_AA64,
-      .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 3,
-      .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
-      .fgt = FGT_ATS1E0W,
-      .accessfn = at_s1e01_access, .writefn = ats_write64 },
-    { .name = "AT_S12E1R", .state = ARM_CP_STATE_AA64,
-      .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 4,
-      .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
-      .accessfn = at_e012_access, .writefn = ats_write64 },
-    { .name = "AT_S12E1W", .state = ARM_CP_STATE_AA64,
-      .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 5,
-      .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
-      .accessfn = at_e012_access, .writefn = ats_write64 },
-    { .name = "AT_S12E0R", .state = ARM_CP_STATE_AA64,
-      .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 6,
-      .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
-      .accessfn = at_e012_access, .writefn = ats_write64 },
-    { .name = "AT_S12E0W", .state = ARM_CP_STATE_AA64,
-      .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 7,
-      .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
-      .accessfn = at_e012_access, .writefn = ats_write64 },
-    /* AT S1E2* are elsewhere as they UNDEF from EL3 if EL2 is not present */
-    { .name = "AT_S1E3R", .state = ARM_CP_STATE_AA64,
-      .opc0 = 1, .opc1 = 6, .crn = 7, .crm = 8, .opc2 = 0,
-      .access = PL3_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
-      .writefn = ats_write64 },
-    { .name = "AT_S1E3W", .state = ARM_CP_STATE_AA64,
-      .opc0 = 1, .opc1 = 6, .crn = 7, .crm = 8, .opc2 = 1,
-      .access = PL3_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
-      .writefn = ats_write64 },
     { .name = "PAR_EL1", .state = ARM_CP_STATE_AA64,
       .type = ARM_CP_ALIAS,
       .opc0 = 3, .opc1 = 0, .crn = 7, .crm = 4, .opc2 = 0,
@@ -5148,7 +4705,6 @@ static const ARMCPRegInfo v8_cp_reginfo[] = {
       .fgt = FGT_PAR_EL1,
       .fieldoffset = offsetof(CPUARMState, cp15.par_el[1]),
       .writefn = par_write },
-#endif
     /* 32 bit cache operations */
     { .name = "ICIALLUIS", .cp = 15, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 0,
       .type = ARM_CP_NOP, .access = PL1_W, .accessfn = access_ticab },
@@ -5751,33 +5307,6 @@ static const ARMCPRegInfo el2_cp_reginfo[] = {
       .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_ALIAS,
       .fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el[2]) },
 #ifndef CONFIG_USER_ONLY
-    /*
-     * Unlike the other EL2-related AT operations, these must
-     * UNDEF from EL3 if EL2 is not implemented, which is why we
-     * define them here rather than with the rest of the AT ops.
-     */
-    { .name = "AT_S1E2R", .state = ARM_CP_STATE_AA64,
-      .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 0,
-      .access = PL2_W, .accessfn = at_s1e2_access,
-      .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC | ARM_CP_EL3_NO_EL2_UNDEF,
-      .writefn = ats_write64 },
-    { .name = "AT_S1E2W", .state = ARM_CP_STATE_AA64,
-      .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 1,
-      .access = PL2_W, .accessfn = at_s1e2_access,
-      .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC | ARM_CP_EL3_NO_EL2_UNDEF,
-      .writefn = ats_write64 },
-    /*
-     * The AArch32 ATS1H* operations are CONSTRAINED UNPREDICTABLE
-     * if EL2 is not implemented; we choose to UNDEF. Behaviour at EL3
-     * with SCR.NS == 0 outside Monitor mode is UNPREDICTABLE; we choose
-     * to behave as if SCR.NS was 1.
-     */
-    { .name = "ATS1HR", .cp = 15, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 0,
-      .access = PL2_W,
-      .writefn = ats1h_write, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC },
-    { .name = "ATS1HW", .cp = 15, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 1,
-      .access = PL2_W,
-      .writefn = ats1h_write, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC },
     { .name = "CNTHCTL_EL2", .state = ARM_CP_STATE_BOTH,
       .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 1, .opc2 = 0,
       /*
@@ -7704,32 +7233,6 @@ static const ARMCPRegInfo vhe_reginfo[] = {
 #endif
 };
 
-#ifndef CONFIG_USER_ONLY
-static const ARMCPRegInfo ats1e1_reginfo[] = {
-    { .name = "AT_S1E1RP", .state = ARM_CP_STATE_AA64,
-      .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 9, .opc2 = 0,
-      .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
-      .fgt = FGT_ATS1E1RP,
-      .accessfn = at_s1e01_access, .writefn = ats_write64 },
-    { .name = "AT_S1E1WP", .state = ARM_CP_STATE_AA64,
-      .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 9, .opc2 = 1,
-      .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
-      .fgt = FGT_ATS1E1WP,
-      .accessfn = at_s1e01_access, .writefn = ats_write64 },
-};
-
-static const ARMCPRegInfo ats1cp_reginfo[] = {
-    { .name = "ATS1CPRP",
-      .cp = 15, .opc1 = 0, .crn = 7, .crm = 9, .opc2 = 0,
-      .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
-      .writefn = ats_write },
-    { .name = "ATS1CPWP",
-      .cp = 15, .opc1 = 0, .crn = 7, .crm = 9, .opc2 = 1,
-      .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
-      .writefn = ats_write },
-};
-#endif
-
 /*
  * ACTLR2 and HACTLR2 map to ACTLR_EL1[63:32] and
  * ACTLR_EL2[63:32]. They exist only if the ID_MMFR4.AC2 field
@@ -7773,6 +7276,7 @@ void register_cp_regs_for_features(ARMCPU *cpu)
 #ifndef CONFIG_USER_ONLY
     if (tcg_enabled()) {
         define_tlb_insn_regs(cpu);
+        define_at_insn_regs(cpu);
     }
 #endif
 
@@ -8506,12 +8010,6 @@ void register_cp_regs_for_features(ARMCPU *cpu)
               .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.par_s),
                                      offsetoflow32(CPUARMState, cp15.par_ns) },
               .writefn = par_write},
-#ifndef CONFIG_USER_ONLY
-            /* This underdecoding is safe because the reginfo is NO_RAW. */
-            { .name = "ATS", .cp = 15, .crn = 7, .crm = 8, .opc1 = 0, .opc2 = CP_ANY,
-              .access = PL1_W, .accessfn = ats_access,
-              .writefn = ats_write, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC },
-#endif
         };
 
         /*
@@ -8917,14 +8415,6 @@ void register_cp_regs_for_features(ARMCPU *cpu)
     if (cpu_isar_feature(aa64_pan, cpu)) {
         define_one_arm_cp_reg(cpu, &pan_reginfo);
     }
-#ifndef CONFIG_USER_ONLY
-    if (cpu_isar_feature(aa64_ats1e1, cpu)) {
-        define_arm_cp_regs(cpu, ats1e1_reginfo);
-    }
-    if (cpu_isar_feature(aa32_ats1e1, cpu)) {
-        define_arm_cp_regs(cpu, ats1cp_reginfo);
-    }
-#endif
     if (cpu_isar_feature(aa64_uao, cpu)) {
         define_one_arm_cp_reg(cpu, &uao_reginfo);
     }
diff --git a/target/arm/internals.h b/target/arm/internals.h
index 21a8d67edd..bcaf8965fc 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -1871,6 +1871,8 @@ void define_debug_regs(ARMCPU *cpu);
 
 /* Add the cpreg definitions for TLBI instructions */
 void define_tlb_insn_regs(ARMCPU *cpu);
+/* Add the cpreg definitions for AT instructions */
+void define_at_insn_regs(ARMCPU *cpu);
 
 /* Effective value of MDCR_EL2 */
 static inline uint64_t arm_mdcr_el2_eff(CPUARMState *env)
@@ -1981,5 +1983,6 @@ void vfp_clear_float_status_exc_flags(CPUARMState *env);
  * specified by mask changing to the values in val.
  */
 void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask);
+bool arm_pan_enabled(CPUARMState *env);
 
 #endif
diff --git a/target/arm/tcg/cpregs-at.c b/target/arm/tcg/cpregs-at.c
new file mode 100644
index 0000000000..398a61d398
--- /dev/null
+++ b/target/arm/tcg/cpregs-at.c
@@ -0,0 +1,519 @@
+/*
+ * System instructions for address translation
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "cpu.h"
+#include "cpu-features.h"
+#include "internals.h"
+#include "cpregs.h"
+
+
+static int par_el1_shareability(GetPhysAddrResult *res)
+{
+    /*
+     * The PAR_EL1.SH field must be 0b10 for Device or Normal-NC
+     * memory -- see pseudocode PAREncodeShareability().
+     */
+    if (((res->cacheattrs.attrs & 0xf0) == 0) ||
+        res->cacheattrs.attrs == 0x44 || res->cacheattrs.attrs == 0x40) {
+        return 2;
+    }
+    return res->cacheattrs.shareability;
+}
+
+static uint64_t do_ats_write(CPUARMState *env, uint64_t value,
+                             MMUAccessType access_type, ARMMMUIdx mmu_idx,
+                             ARMSecuritySpace ss)
+{
+    bool ret;
+    uint64_t par64;
+    bool format64 = false;
+    ARMMMUFaultInfo fi = {};
+    GetPhysAddrResult res = {};
+
+    /*
+     * I_MXTJT: Granule protection checks are not performed on the final
+     * address of a successful translation.  This is a translation not a
+     * memory reference, so "memop = none = 0".
+     */
+    ret = get_phys_addr_with_space_nogpc(env, value, access_type, 0,
+                                         mmu_idx, ss, &res, &fi);
+
+    /*
+     * ATS operations only do S1 or S1+S2 translations, so we never
+     * have to deal with the ARMCacheAttrs format for S2 only.
+     */
+    assert(!res.cacheattrs.is_s2_format);
+
+    if (ret) {
+        /*
+         * Some kinds of translation fault must cause exceptions rather
+         * than being reported in the PAR.
+         */
+        int current_el = arm_current_el(env);
+        int target_el;
+        uint32_t syn, fsr, fsc;
+        bool take_exc = false;
+
+        if (fi.s1ptw && current_el == 1
+            && arm_mmu_idx_is_stage1_of_2(mmu_idx)) {
+            /*
+             * Synchronous stage 2 fault on an access made as part of the
+             * translation table walk for AT S1E0* or AT S1E1* insn
+             * executed from NS EL1. If this is a synchronous external abort
+             * and SCR_EL3.EA == 1, then we take a synchronous external abort
+             * to EL3. Otherwise the fault is taken as an exception to EL2,
+             * and HPFAR_EL2 holds the faulting IPA.
+             */
+            if (fi.type == ARMFault_SyncExternalOnWalk &&
+                (env->cp15.scr_el3 & SCR_EA)) {
+                target_el = 3;
+            } else {
+                env->cp15.hpfar_el2 = extract64(fi.s2addr, 12, 47) << 4;
+                if (arm_is_secure_below_el3(env) && fi.s1ns) {
+                    env->cp15.hpfar_el2 |= HPFAR_NS;
+                }
+                target_el = 2;
+            }
+            take_exc = true;
+        } else if (fi.type == ARMFault_SyncExternalOnWalk) {
+            /*
+             * Synchronous external aborts during a translation table walk
+             * are taken as Data Abort exceptions.
+             */
+            if (fi.stage2) {
+                if (current_el == 3) {
+                    target_el = 3;
+                } else {
+                    target_el = 2;
+                }
+            } else {
+                target_el = exception_target_el(env);
+            }
+            take_exc = true;
+        }
+
+        if (take_exc) {
+            /* Construct FSR and FSC using same logic as arm_deliver_fault() */
+            if (target_el == 2 || arm_el_is_aa64(env, target_el) ||
+                arm_s1_regime_using_lpae_format(env, mmu_idx)) {
+                fsr = arm_fi_to_lfsc(&fi);
+                fsc = extract32(fsr, 0, 6);
+            } else {
+                fsr = arm_fi_to_sfsc(&fi);
+                fsc = 0x3f;
+            }
+            /*
+             * Report exception with ESR indicating a fault due to a
+             * translation table walk for a cache maintenance instruction.
+             */
+            syn = syn_data_abort_no_iss(current_el == target_el, 0,
+                                        fi.ea, 1, fi.s1ptw, 1, fsc);
+            env->exception.vaddress = value;
+            env->exception.fsr = fsr;
+            raise_exception(env, EXCP_DATA_ABORT, syn, target_el);
+        }
+    }
+
+    if (is_a64(env)) {
+        format64 = true;
+    } else if (arm_feature(env, ARM_FEATURE_LPAE)) {
+        /*
+         * ATS1Cxx:
+         * * TTBCR.EAE determines whether the result is returned using the
+         *   32-bit or the 64-bit PAR format
+         * * Instructions executed in Hyp mode always use the 64bit format
+         *
+         * ATS1S2NSOxx uses the 64bit format if any of the following is true:
+         * * The Non-secure TTBCR.EAE bit is set to 1
+         * * The implementation includes EL2, and the value of HCR.VM is 1
+         *
+         * (Note that HCR.DC makes HCR.VM behave as if it is 1.)
+         *
+         * ATS1Hx always uses the 64bit format.
+         */
+        format64 = arm_s1_regime_using_lpae_format(env, mmu_idx);
+
+        if (arm_feature(env, ARM_FEATURE_EL2)) {
+            if (mmu_idx == ARMMMUIdx_E10_0 ||
+                mmu_idx == ARMMMUIdx_E10_1 ||
+                mmu_idx == ARMMMUIdx_E10_1_PAN) {
+                format64 |= env->cp15.hcr_el2 & (HCR_VM | HCR_DC);
+            } else {
+                format64 |= arm_current_el(env) == 2;
+            }
+        }
+    }
+
+    if (format64) {
+        /* Create a 64-bit PAR */
+        par64 = (1 << 11); /* LPAE bit always set */
+        if (!ret) {
+            par64 |= res.f.phys_addr & ~0xfffULL;
+            if (!res.f.attrs.secure) {
+                par64 |= (1 << 9); /* NS */
+            }
+            par64 |= (uint64_t)res.cacheattrs.attrs << 56; /* ATTR */
+            par64 |= par_el1_shareability(&res) << 7; /* SH */
+        } else {
+            uint32_t fsr = arm_fi_to_lfsc(&fi);
+
+            par64 |= 1; /* F */
+            par64 |= (fsr & 0x3f) << 1; /* FS */
+            if (fi.stage2) {
+                par64 |= (1 << 9); /* S */
+            }
+            if (fi.s1ptw) {
+                par64 |= (1 << 8); /* PTW */
+            }
+        }
+    } else {
+        /*
+         * fsr is a DFSR/IFSR value for the short descriptor
+         * translation table format (with WnR always clear).
+         * Convert it to a 32-bit PAR.
+         */
+        if (!ret) {
+            /* We do not set any attribute bits in the PAR */
+            if (res.f.lg_page_size == 24
+                && arm_feature(env, ARM_FEATURE_V7)) {
+                par64 = (res.f.phys_addr & 0xff000000) | (1 << 1);
+            } else {
+                par64 = res.f.phys_addr & 0xfffff000;
+            }
+            if (!res.f.attrs.secure) {
+                par64 |= (1 << 9); /* NS */
+            }
+        } else {
+            uint32_t fsr = arm_fi_to_sfsc(&fi);
+
+            par64 = ((fsr & (1 << 10)) >> 5) | ((fsr & (1 << 12)) >> 6) |
+                    ((fsr & 0xf) << 1) | 1;
+        }
+    }
+    return par64;
+}
+
+static void ats_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
+{
+    MMUAccessType access_type = ri->opc2 & 1 ? MMU_DATA_STORE : MMU_DATA_LOAD;
+    uint64_t par64;
+    ARMMMUIdx mmu_idx;
+    int el = arm_current_el(env);
+    ARMSecuritySpace ss = arm_security_space(env);
+
+    switch (ri->opc2 & 6) {
+    case 0:
+        /* stage 1 current state PL1: ATS1CPR, ATS1CPW, ATS1CPRP, ATS1CPWP */
+        switch (el) {
+        case 3:
+            if (ri->crm == 9 && arm_pan_enabled(env)) {
+                mmu_idx = ARMMMUIdx_E30_3_PAN;
+            } else {
+                mmu_idx = ARMMMUIdx_E3;
+            }
+            break;
+        case 2:
+            g_assert(ss != ARMSS_Secure);  /* ARMv8.4-SecEL2 is 64-bit only */
+            /* fall through */
+        case 1:
+            if (ri->crm == 9 && arm_pan_enabled(env)) {
+                mmu_idx = ARMMMUIdx_Stage1_E1_PAN;
+            } else {
+                mmu_idx = ARMMMUIdx_Stage1_E1;
+            }
+            break;
+        default:
+            g_assert_not_reached();
+        }
+        break;
+    case 2:
+        /* stage 1 current state PL0: ATS1CUR, ATS1CUW */
+        switch (el) {
+        case 3:
+            mmu_idx = ARMMMUIdx_E30_0;
+            break;
+        case 2:
+            g_assert(ss != ARMSS_Secure);  /* ARMv8.4-SecEL2 is 64-bit only */
+            mmu_idx = ARMMMUIdx_Stage1_E0;
+            break;
+        case 1:
+            mmu_idx = ARMMMUIdx_Stage1_E0;
+            break;
+        default:
+            g_assert_not_reached();
+        }
+        break;
+    case 4:
+        /* stage 1+2 NonSecure PL1: ATS12NSOPR, ATS12NSOPW */
+        mmu_idx = ARMMMUIdx_E10_1;
+        ss = ARMSS_NonSecure;
+        break;
+    case 6:
+        /* stage 1+2 NonSecure PL0: ATS12NSOUR, ATS12NSOUW */
+        mmu_idx = ARMMMUIdx_E10_0;
+        ss = ARMSS_NonSecure;
+        break;
+    default:
+        g_assert_not_reached();
+    }
+
+    par64 = do_ats_write(env, value, access_type, mmu_idx, ss);
+
+    A32_BANKED_CURRENT_REG_SET(env, par, par64);
+}
+
+static void ats1h_write(CPUARMState *env, const ARMCPRegInfo *ri,
+                        uint64_t value)
+{
+    MMUAccessType access_type = ri->opc2 & 1 ? MMU_DATA_STORE : MMU_DATA_LOAD;
+    uint64_t par64;
+
+    /* There is no SecureEL2 for AArch32. */
+    par64 = do_ats_write(env, value, access_type, ARMMMUIdx_E2,
+                         ARMSS_NonSecure);
+
+    A32_BANKED_CURRENT_REG_SET(env, par, par64);
+}
+
+static CPAccessResult at_e012_access(CPUARMState *env, const ARMCPRegInfo *ri,
+                                     bool isread)
+{
+    /*
+     * R_NYXTL: instruction is UNDEFINED if it applies to an Exception level
+     * lower than EL3 and the combination SCR_EL3.{NSE,NS} is reserved. This can
+     * only happen when executing at EL3 because that combination also causes an
+     * illegal exception return. We don't need to check FEAT_RME either, because
+     * scr_write() ensures that the NSE bit is not set otherwise.
+     */
+    if ((env->cp15.scr_el3 & (SCR_NSE | SCR_NS)) == SCR_NSE) {
+        return CP_ACCESS_UNDEFINED;
+    }
+    return CP_ACCESS_OK;
+}
+
+static CPAccessResult at_s1e2_access(CPUARMState *env, const ARMCPRegInfo *ri,
+                                     bool isread)
+{
+    if (arm_current_el(env) == 3 &&
+        !(env->cp15.scr_el3 & (SCR_NS | SCR_EEL2))) {
+        return CP_ACCESS_UNDEFINED;
+    }
+    return at_e012_access(env, ri, isread);
+}
+
+static CPAccessResult at_s1e01_access(CPUARMState *env, const ARMCPRegInfo *ri,
+                                      bool isread)
+{
+    if (arm_current_el(env) == 1 && (arm_hcr_el2_eff(env) & HCR_AT)) {
+        return CP_ACCESS_TRAP_EL2;
+    }
+    return at_e012_access(env, ri, isread);
+}
+
+static void ats_write64(CPUARMState *env, const ARMCPRegInfo *ri,
+                        uint64_t value)
+{
+    MMUAccessType access_type = ri->opc2 & 1 ? MMU_DATA_STORE : MMU_DATA_LOAD;
+    ARMMMUIdx mmu_idx;
+    uint64_t hcr_el2 = arm_hcr_el2_eff(env);
+    bool regime_e20 = (hcr_el2 & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE);
+    bool for_el3 = false;
+    ARMSecuritySpace ss;
+
+    switch (ri->opc2 & 6) {
+    case 0:
+        switch (ri->opc1) {
+        case 0: /* AT S1E1R, AT S1E1W, AT S1E1RP, AT S1E1WP */
+            if (ri->crm == 9 && arm_pan_enabled(env)) {
+                mmu_idx = regime_e20 ?
+                          ARMMMUIdx_E20_2_PAN : ARMMMUIdx_Stage1_E1_PAN;
+            } else {
+                mmu_idx = regime_e20 ? ARMMMUIdx_E20_2 : ARMMMUIdx_Stage1_E1;
+            }
+            break;
+        case 4: /* AT S1E2R, AT S1E2W */
+            mmu_idx = hcr_el2 & HCR_E2H ? ARMMMUIdx_E20_2 : ARMMMUIdx_E2;
+            break;
+        case 6: /* AT S1E3R, AT S1E3W */
+            mmu_idx = ARMMMUIdx_E3;
+            for_el3 = true;
+            break;
+        default:
+            g_assert_not_reached();
+        }
+        break;
+    case 2: /* AT S1E0R, AT S1E0W */
+        mmu_idx = regime_e20 ? ARMMMUIdx_E20_0 : ARMMMUIdx_Stage1_E0;
+        break;
+    case 4: /* AT S12E1R, AT S12E1W */
+        mmu_idx = regime_e20 ? ARMMMUIdx_E20_2 : ARMMMUIdx_E10_1;
+        break;
+    case 6: /* AT S12E0R, AT S12E0W */
+        mmu_idx = regime_e20 ? ARMMMUIdx_E20_0 : ARMMMUIdx_E10_0;
+        break;
+    default:
+        g_assert_not_reached();
+    }
+
+    ss = for_el3 ? arm_security_space(env) : arm_security_space_below_el3(env);
+    env->cp15.par_el[1] = do_ats_write(env, value, access_type, mmu_idx, ss);
+}
+
+static CPAccessResult ats_access(CPUARMState *env, const ARMCPRegInfo *ri,
+                                 bool isread)
+{
+    if (ri->opc2 & 4) {
+        /*
+         * The ATS12NSO* operations must trap to EL3 or EL2 if executed in
+         * Secure EL1 (which can only happen if EL3 is AArch64).
+         * They are simply UNDEF if executed from NS EL1.
+         * They function normally from EL2 or EL3.
+         */
+        if (arm_current_el(env) == 1) {
+            if (arm_is_secure_below_el3(env)) {
+                if (env->cp15.scr_el3 & SCR_EEL2) {
+                    return CP_ACCESS_TRAP_EL2;
+                }
+                return CP_ACCESS_TRAP_EL3;
+            }
+            return CP_ACCESS_UNDEFINED;
+        }
+    }
+    return CP_ACCESS_OK;
+}
+
+static const ARMCPRegInfo vapa_ats_reginfo[] = {
+    /* This underdecoding is safe because the reginfo is NO_RAW. */
+    { .name = "ATS", .cp = 15, .crn = 7, .crm = 8, .opc1 = 0, .opc2 = CP_ANY,
+      .access = PL1_W, .accessfn = ats_access,
+      .writefn = ats_write, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC },
+};
+
+static const ARMCPRegInfo v8_ats_reginfo[] = {
+    /* 64 bit address translation operations */
+    { .name = "AT_S1E1R", .state = ARM_CP_STATE_AA64,
+      .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 0,
+      .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
+      .fgt = FGT_ATS1E1R,
+      .accessfn = at_s1e01_access, .writefn = ats_write64 },
+    { .name = "AT_S1E1W", .state = ARM_CP_STATE_AA64,
+      .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 1,
+      .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
+      .fgt = FGT_ATS1E1W,
+      .accessfn = at_s1e01_access, .writefn = ats_write64 },
+    { .name = "AT_S1E0R", .state = ARM_CP_STATE_AA64,
+      .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 2,
+      .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
+      .fgt = FGT_ATS1E0R,
+      .accessfn = at_s1e01_access, .writefn = ats_write64 },
+    { .name = "AT_S1E0W", .state = ARM_CP_STATE_AA64,
+      .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 3,
+      .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
+      .fgt = FGT_ATS1E0W,
+      .accessfn = at_s1e01_access, .writefn = ats_write64 },
+    { .name = "AT_S12E1R", .state = ARM_CP_STATE_AA64,
+      .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 4,
+      .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
+      .accessfn = at_e012_access, .writefn = ats_write64 },
+    { .name = "AT_S12E1W", .state = ARM_CP_STATE_AA64,
+      .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 5,
+      .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
+      .accessfn = at_e012_access, .writefn = ats_write64 },
+    { .name = "AT_S12E0R", .state = ARM_CP_STATE_AA64,
+      .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 6,
+      .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
+      .accessfn = at_e012_access, .writefn = ats_write64 },
+    { .name = "AT_S12E0W", .state = ARM_CP_STATE_AA64,
+      .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 7,
+      .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
+      .accessfn = at_e012_access, .writefn = ats_write64 },
+    /* AT S1E2* are elsewhere as they UNDEF from EL3 if EL2 is not present */
+    { .name = "AT_S1E3R", .state = ARM_CP_STATE_AA64,
+      .opc0 = 1, .opc1 = 6, .crn = 7, .crm = 8, .opc2 = 0,
+      .access = PL3_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
+      .writefn = ats_write64 },
+    { .name = "AT_S1E3W", .state = ARM_CP_STATE_AA64,
+      .opc0 = 1, .opc1 = 6, .crn = 7, .crm = 8, .opc2 = 1,
+      .access = PL3_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
+      .writefn = ats_write64 },
+};
+
+static const ARMCPRegInfo el2_ats_reginfo[] = {
+    /*
+     * Unlike the other EL2-related AT operations, these must
+     * UNDEF from EL3 if EL2 is not implemented, which is why we
+     * define them here rather than with the rest of the AT ops.
+     */
+    { .name = "AT_S1E2R", .state = ARM_CP_STATE_AA64,
+      .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 0,
+      .access = PL2_W, .accessfn = at_s1e2_access,
+      .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC | ARM_CP_EL3_NO_EL2_UNDEF,
+      .writefn = ats_write64 },
+    { .name = "AT_S1E2W", .state = ARM_CP_STATE_AA64,
+      .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 1,
+      .access = PL2_W, .accessfn = at_s1e2_access,
+      .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC | ARM_CP_EL3_NO_EL2_UNDEF,
+      .writefn = ats_write64 },
+    /*
+     * The AArch32 ATS1H* operations are CONSTRAINED UNPREDICTABLE
+     * if EL2 is not implemented; we choose to UNDEF. Behaviour at EL3
+     * with SCR.NS == 0 outside Monitor mode is UNPREDICTABLE; we choose
+     * to behave as if SCR.NS was 1.
+     */
+    { .name = "ATS1HR", .cp = 15, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 0,
+      .access = PL2_W,
+      .writefn = ats1h_write, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC },
+    { .name = "ATS1HW", .cp = 15, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 1,
+      .access = PL2_W,
+      .writefn = ats1h_write, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC },
+};
+
+static const ARMCPRegInfo ats1e1_reginfo[] = {
+    { .name = "AT_S1E1RP", .state = ARM_CP_STATE_AA64,
+      .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 9, .opc2 = 0,
+      .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
+      .fgt = FGT_ATS1E1RP,
+      .accessfn = at_s1e01_access, .writefn = ats_write64 },
+    { .name = "AT_S1E1WP", .state = ARM_CP_STATE_AA64,
+      .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 9, .opc2 = 1,
+      .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
+      .fgt = FGT_ATS1E1WP,
+      .accessfn = at_s1e01_access, .writefn = ats_write64 },
+};
+
+static const ARMCPRegInfo ats1cp_reginfo[] = {
+    { .name = "ATS1CPRP",
+      .cp = 15, .opc1 = 0, .crn = 7, .crm = 9, .opc2 = 0,
+      .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
+      .writefn = ats_write },
+    { .name = "ATS1CPWP",
+      .cp = 15, .opc1 = 0, .crn = 7, .crm = 9, .opc2 = 1,
+      .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
+      .writefn = ats_write },
+};
+
+void define_at_insn_regs(ARMCPU *cpu)
+{
+    CPUARMState *env = &cpu->env;
+
+    if (arm_feature(env, ARM_FEATURE_VAPA)) {
+        define_arm_cp_regs(cpu, vapa_ats_reginfo);
+    }
+    if (arm_feature(env, ARM_FEATURE_V8)) {
+        define_arm_cp_regs(cpu, v8_ats_reginfo);
+    }
+    if (arm_feature(env, ARM_FEATURE_EL2)
+        || (arm_feature(env, ARM_FEATURE_EL3)
+            && arm_feature(env, ARM_FEATURE_V8))) {
+        define_arm_cp_regs(cpu, el2_ats_reginfo);
+    }
+    if (cpu_isar_feature(aa64_ats1e1, cpu)) {
+        define_arm_cp_regs(cpu, ats1e1_reginfo);
+    }
+    if (cpu_isar_feature(aa32_ats1e1, cpu)) {
+        define_arm_cp_regs(cpu, ats1cp_reginfo);
+    }
+}
diff --git a/target/arm/tcg/meson.build b/target/arm/tcg/meson.build
index c59f0f03a1..895facdc30 100644
--- a/target/arm/tcg/meson.build
+++ b/target/arm/tcg/meson.build
@@ -64,6 +64,7 @@ arm_common_ss.add(files(
 ))
 
 arm_common_system_ss.add(files(
+  'cpregs-at.c',
   'hflags.c',
   'iwmmxt_helper.c',
   'neon_helper.c',

From ae2086426d3784cf66e5b0b7ac823c08e87b4c57 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 7 Jul 2025 09:15:47 -0600
Subject: [PATCH 2078/2760] target/arm: Split out performance monitor regs to
 cpregs-pmu.c
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250707151547.196393-4-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpregs-pmu.c | 1309 +++++++++++++++++++++++++++++++++++++++
 target/arm/cpregs.h     |    3 +
 target/arm/helper.c     | 1287 +-------------------------------------
 target/arm/internals.h  |    2 +
 target/arm/meson.build  |    2 +
 5 files changed, 1319 insertions(+), 1284 deletions(-)
 create mode 100644 target/arm/cpregs-pmu.c

diff --git a/target/arm/cpregs-pmu.c b/target/arm/cpregs-pmu.c
new file mode 100644
index 0000000000..0f295b1376
--- /dev/null
+++ b/target/arm/cpregs-pmu.c
@@ -0,0 +1,1309 @@
+/*
+ * QEMU ARM CP Register PMU insns
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/timer.h"
+#include "exec/icount.h"
+#include "hw/irq.h"
+#include "cpu.h"
+#include "cpu-features.h"
+#include "cpregs.h"
+#include "internals.h"
+
+
+#define ARM_CPU_FREQ 1000000000 /* FIXME: 1 GHz, should be configurable */
+
+/*
+ * Check for traps to performance monitor registers, which are controlled
+ * by MDCR_EL2.TPM for EL2 and MDCR_EL3.TPM for EL3.
+ */
+static CPAccessResult access_tpm(CPUARMState *env, const ARMCPRegInfo *ri,
+                                 bool isread)
+{
+    int el = arm_current_el(env);
+    uint64_t mdcr_el2 = arm_mdcr_el2_eff(env);
+
+    if (el < 2 && (mdcr_el2 & MDCR_TPM)) {
+        return CP_ACCESS_TRAP_EL2;
+    }
+    if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TPM)) {
+        return CP_ACCESS_TRAP_EL3;
+    }
+    return CP_ACCESS_OK;
+}
+
+typedef struct pm_event {
+    uint16_t number; /* PMEVTYPER.evtCount is 16 bits wide */
+    /* If the event is supported on this CPU (used to generate PMCEID[01]) */
+    bool (*supported)(CPUARMState *);
+    /*
+     * Retrieve the current count of the underlying event. The programmed
+     * counters hold a difference from the return value from this function
+     */
+    uint64_t (*get_count)(CPUARMState *);
+    /*
+     * Return how many nanoseconds it will take (at a minimum) for count events
+     * to occur. A negative value indicates the counter will never overflow, or
+     * that the counter has otherwise arranged for the overflow bit to be set
+     * and the PMU interrupt to be raised on overflow.
+     */
+    int64_t (*ns_per_count)(uint64_t);
+} pm_event;
+
+static bool event_always_supported(CPUARMState *env)
+{
+    return true;
+}
+
+static uint64_t swinc_get_count(CPUARMState *env)
+{
+    /*
+     * SW_INCR events are written directly to the pmevcntr's by writes to
+     * PMSWINC, so there is no underlying count maintained by the PMU itself
+     */
+    return 0;
+}
+
+static int64_t swinc_ns_per(uint64_t ignored)
+{
+    return -1;
+}
+
+/*
+ * Return the underlying cycle count for the PMU cycle counters. If we're in
+ * usermode, simply return 0.
+ */
+static uint64_t cycles_get_count(CPUARMState *env)
+{
+#ifndef CONFIG_USER_ONLY
+    return muldiv64(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL),
+                   ARM_CPU_FREQ, NANOSECONDS_PER_SECOND);
+#else
+    return cpu_get_host_ticks();
+#endif
+}
+
+#ifndef CONFIG_USER_ONLY
+static int64_t cycles_ns_per(uint64_t cycles)
+{
+    return (ARM_CPU_FREQ / NANOSECONDS_PER_SECOND) * cycles;
+}
+
+static bool instructions_supported(CPUARMState *env)
+{
+    /* Precise instruction counting */
+    return icount_enabled() == ICOUNT_PRECISE;
+}
+
+static uint64_t instructions_get_count(CPUARMState *env)
+{
+    assert(icount_enabled() == ICOUNT_PRECISE);
+    return (uint64_t)icount_get_raw();
+}
+
+static int64_t instructions_ns_per(uint64_t icount)
+{
+    assert(icount_enabled() == ICOUNT_PRECISE);
+    return icount_to_ns((int64_t)icount);
+}
+#endif
+
+static bool pmuv3p1_events_supported(CPUARMState *env)
+{
+    /* For events which are supported in any v8.1 PMU */
+    return cpu_isar_feature(any_pmuv3p1, env_archcpu(env));
+}
+
+static bool pmuv3p4_events_supported(CPUARMState *env)
+{
+    /* For events which are supported in any v8.1 PMU */
+    return cpu_isar_feature(any_pmuv3p4, env_archcpu(env));
+}
+
+static uint64_t zero_event_get_count(CPUARMState *env)
+{
+    /* For events which on QEMU never fire, so their count is always zero */
+    return 0;
+}
+
+static int64_t zero_event_ns_per(uint64_t cycles)
+{
+    /* An event which never fires can never overflow */
+    return -1;
+}
+
+static const pm_event pm_events[] = {
+    { .number = 0x000, /* SW_INCR */
+      .supported = event_always_supported,
+      .get_count = swinc_get_count,
+      .ns_per_count = swinc_ns_per,
+    },
+#ifndef CONFIG_USER_ONLY
+    { .number = 0x008, /* INST_RETIRED, Instruction architecturally executed */
+      .supported = instructions_supported,
+      .get_count = instructions_get_count,
+      .ns_per_count = instructions_ns_per,
+    },
+    { .number = 0x011, /* CPU_CYCLES, Cycle */
+      .supported = event_always_supported,
+      .get_count = cycles_get_count,
+      .ns_per_count = cycles_ns_per,
+    },
+#endif
+    { .number = 0x023, /* STALL_FRONTEND */
+      .supported = pmuv3p1_events_supported,
+      .get_count = zero_event_get_count,
+      .ns_per_count = zero_event_ns_per,
+    },
+    { .number = 0x024, /* STALL_BACKEND */
+      .supported = pmuv3p1_events_supported,
+      .get_count = zero_event_get_count,
+      .ns_per_count = zero_event_ns_per,
+    },
+    { .number = 0x03c, /* STALL */
+      .supported = pmuv3p4_events_supported,
+      .get_count = zero_event_get_count,
+      .ns_per_count = zero_event_ns_per,
+    },
+};
+
+/*
+ * Note: Before increasing MAX_EVENT_ID beyond 0x3f into the 0x40xx range of
+ * events (i.e. the statistical profiling extension), this implementation
+ * should first be updated to something sparse instead of the current
+ * supported_event_map[] array.
+ */
+#define MAX_EVENT_ID 0x3c
+#define UNSUPPORTED_EVENT UINT16_MAX
+static uint16_t supported_event_map[MAX_EVENT_ID + 1];
+
+/*
+ * Called upon CPU initialization to initialize PMCEID[01]_EL0 and build a map
+ * of ARM event numbers to indices in our pm_events array.
+ *
+ * Note: Events in the 0x40XX range are not currently supported.
+ */
+void pmu_init(ARMCPU *cpu)
+{
+    unsigned int i;
+
+    /*
+     * Empty supported_event_map and cpu->pmceid[01] before adding supported
+     * events to them
+     */
+    for (i = 0; i < ARRAY_SIZE(supported_event_map); i++) {
+        supported_event_map[i] = UNSUPPORTED_EVENT;
+    }
+    cpu->pmceid0 = 0;
+    cpu->pmceid1 = 0;
+
+    for (i = 0; i < ARRAY_SIZE(pm_events); i++) {
+        const pm_event *cnt = &pm_events[i];
+        assert(cnt->number <= MAX_EVENT_ID);
+        /* We do not currently support events in the 0x40xx range */
+        assert(cnt->number <= 0x3f);
+
+        if (cnt->supported(&cpu->env)) {
+            supported_event_map[cnt->number] = i;
+            uint64_t event_mask = 1ULL << (cnt->number & 0x1f);
+            if (cnt->number & 0x20) {
+                cpu->pmceid1 |= event_mask;
+            } else {
+                cpu->pmceid0 |= event_mask;
+            }
+        }
+    }
+}
+
+/*
+ * Check at runtime whether a PMU event is supported for the current machine
+ */
+static bool event_supported(uint16_t number)
+{
+    if (number > MAX_EVENT_ID) {
+        return false;
+    }
+    return supported_event_map[number] != UNSUPPORTED_EVENT;
+}
+
+static CPAccessResult pmreg_access(CPUARMState *env, const ARMCPRegInfo *ri,
+                                   bool isread)
+{
+    /*
+     * Performance monitor registers user accessibility is controlled
+     * by PMUSERENR. MDCR_EL2.TPM and MDCR_EL3.TPM allow configurable
+     * trapping to EL2 or EL3 for other accesses.
+     */
+    int el = arm_current_el(env);
+    uint64_t mdcr_el2 = arm_mdcr_el2_eff(env);
+
+    if (el == 0 && !(env->cp15.c9_pmuserenr & 1)) {
+        return CP_ACCESS_TRAP_EL1;
+    }
+    if (el < 2 && (mdcr_el2 & MDCR_TPM)) {
+        return CP_ACCESS_TRAP_EL2;
+    }
+    if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TPM)) {
+        return CP_ACCESS_TRAP_EL3;
+    }
+
+    return CP_ACCESS_OK;
+}
+
+static CPAccessResult pmreg_access_xevcntr(CPUARMState *env,
+                                           const ARMCPRegInfo *ri,
+                                           bool isread)
+{
+    /* ER: event counter read trap control */
+    if (arm_feature(env, ARM_FEATURE_V8)
+        && arm_current_el(env) == 0
+        && (env->cp15.c9_pmuserenr & (1 << 3)) != 0
+        && isread) {
+        return CP_ACCESS_OK;
+    }
+
+    return pmreg_access(env, ri, isread);
+}
+
+static CPAccessResult pmreg_access_swinc(CPUARMState *env,
+                                         const ARMCPRegInfo *ri,
+                                         bool isread)
+{
+    /* SW: software increment write trap control */
+    if (arm_feature(env, ARM_FEATURE_V8)
+        && arm_current_el(env) == 0
+        && (env->cp15.c9_pmuserenr & (1 << 1)) != 0
+        && !isread) {
+        return CP_ACCESS_OK;
+    }
+
+    return pmreg_access(env, ri, isread);
+}
+
+static CPAccessResult pmreg_access_selr(CPUARMState *env,
+                                        const ARMCPRegInfo *ri,
+                                        bool isread)
+{
+    /* ER: event counter read trap control */
+    if (arm_feature(env, ARM_FEATURE_V8)
+        && arm_current_el(env) == 0
+        && (env->cp15.c9_pmuserenr & (1 << 3)) != 0) {
+        return CP_ACCESS_OK;
+    }
+
+    return pmreg_access(env, ri, isread);
+}
+
+static CPAccessResult pmreg_access_ccntr(CPUARMState *env,
+                                         const ARMCPRegInfo *ri,
+                                         bool isread)
+{
+    /* CR: cycle counter read trap control */
+    if (arm_feature(env, ARM_FEATURE_V8)
+        && arm_current_el(env) == 0
+        && (env->cp15.c9_pmuserenr & (1 << 2)) != 0
+        && isread) {
+        return CP_ACCESS_OK;
+    }
+
+    return pmreg_access(env, ri, isread);
+}
+
+/*
+ * Returns true if the counter (pass 31 for PMCCNTR) should count events using
+ * the current EL, security state, and register configuration.
+ */
+static bool pmu_counter_enabled(CPUARMState *env, uint8_t counter)
+{
+    uint64_t filter;
+    bool e, p, u, nsk, nsu, nsh, m;
+    bool enabled, prohibited = false, filtered;
+    bool secure = arm_is_secure(env);
+    int el = arm_current_el(env);
+    uint64_t mdcr_el2;
+    uint8_t hpmn;
+
+    /*
+     * We might be called for M-profile cores where MDCR_EL2 doesn't
+     * exist and arm_mdcr_el2_eff() will assert, so this early-exit check
+     * must be before we read that value.
+     */
+    if (!arm_feature(env, ARM_FEATURE_PMU)) {
+        return false;
+    }
+
+    mdcr_el2 = arm_mdcr_el2_eff(env);
+    hpmn = mdcr_el2 & MDCR_HPMN;
+
+    if (!arm_feature(env, ARM_FEATURE_EL2) ||
+            (counter < hpmn || counter == 31)) {
+        e = env->cp15.c9_pmcr & PMCRE;
+    } else {
+        e = mdcr_el2 & MDCR_HPME;
+    }
+    enabled = e && (env->cp15.c9_pmcnten & (1 << counter));
+
+    /* Is event counting prohibited? */
+    if (el == 2 && (counter < hpmn || counter == 31)) {
+        prohibited = mdcr_el2 & MDCR_HPMD;
+    }
+    if (secure) {
+        prohibited = prohibited || !(env->cp15.mdcr_el3 & MDCR_SPME);
+    }
+
+    if (counter == 31) {
+        /*
+         * The cycle counter defaults to running. PMCR.DP says "disable
+         * the cycle counter when event counting is prohibited".
+         * Some MDCR bits disable the cycle counter specifically.
+         */
+        prohibited = prohibited && env->cp15.c9_pmcr & PMCRDP;
+        if (cpu_isar_feature(any_pmuv3p5, env_archcpu(env))) {
+            if (secure) {
+                prohibited = prohibited || (env->cp15.mdcr_el3 & MDCR_SCCD);
+            }
+            if (el == 2) {
+                prohibited = prohibited || (mdcr_el2 & MDCR_HCCD);
+            }
+        }
+    }
+
+    if (counter == 31) {
+        filter = env->cp15.pmccfiltr_el0;
+    } else {
+        filter = env->cp15.c14_pmevtyper[counter];
+    }
+
+    p   = filter & PMXEVTYPER_P;
+    u   = filter & PMXEVTYPER_U;
+    nsk = arm_feature(env, ARM_FEATURE_EL3) && (filter & PMXEVTYPER_NSK);
+    nsu = arm_feature(env, ARM_FEATURE_EL3) && (filter & PMXEVTYPER_NSU);
+    nsh = arm_feature(env, ARM_FEATURE_EL2) && (filter & PMXEVTYPER_NSH);
+    m   = arm_el_is_aa64(env, 1) &&
+              arm_feature(env, ARM_FEATURE_EL3) && (filter & PMXEVTYPER_M);
+
+    if (el == 0) {
+        filtered = secure ? u : u != nsu;
+    } else if (el == 1) {
+        filtered = secure ? p : p != nsk;
+    } else if (el == 2) {
+        filtered = !nsh;
+    } else { /* EL3 */
+        filtered = m != p;
+    }
+
+    if (counter != 31) {
+        /*
+         * If not checking PMCCNTR, ensure the counter is setup to an event we
+         * support
+         */
+        uint16_t event = filter & PMXEVTYPER_EVTCOUNT;
+        if (!event_supported(event)) {
+            return false;
+        }
+    }
+
+    return enabled && !prohibited && !filtered;
+}
+
+static void pmu_update_irq(CPUARMState *env)
+{
+    ARMCPU *cpu = env_archcpu(env);
+    qemu_set_irq(cpu->pmu_interrupt, (env->cp15.c9_pmcr & PMCRE) &&
+            (env->cp15.c9_pminten & env->cp15.c9_pmovsr));
+}
+
+static bool pmccntr_clockdiv_enabled(CPUARMState *env)
+{
+    /*
+     * Return true if the clock divider is enabled and the cycle counter
+     * is supposed to tick only once every 64 clock cycles. This is
+     * controlled by PMCR.D, but if PMCR.LC is set to enable the long
+     * (64-bit) cycle counter PMCR.D has no effect.
+     */
+    return (env->cp15.c9_pmcr & (PMCRD | PMCRLC)) == PMCRD;
+}
+
+static bool pmevcntr_is_64_bit(CPUARMState *env, int counter)
+{
+    /* Return true if the specified event counter is configured to be 64 bit */
+
+    /* This isn't intended to be used with the cycle counter */
+    assert(counter < 31);
+
+    if (!cpu_isar_feature(any_pmuv3p5, env_archcpu(env))) {
+        return false;
+    }
+
+    if (arm_feature(env, ARM_FEATURE_EL2)) {
+        /*
+         * MDCR_EL2.HLP still applies even when EL2 is disabled in the
+         * current security state, so we don't use arm_mdcr_el2_eff() here.
+         */
+        bool hlp = env->cp15.mdcr_el2 & MDCR_HLP;
+        int hpmn = env->cp15.mdcr_el2 & MDCR_HPMN;
+
+        if (counter >= hpmn) {
+            return hlp;
+        }
+    }
+    return env->cp15.c9_pmcr & PMCRLP;
+}
+
+/*
+ * Ensure c15_ccnt is the guest-visible count so that operations such as
+ * enabling/disabling the counter or filtering, modifying the count itself,
+ * etc. can be done logically. This is essentially a no-op if the counter is
+ * not enabled at the time of the call.
+ */
+static void pmccntr_op_start(CPUARMState *env)
+{
+    uint64_t cycles = cycles_get_count(env);
+
+    if (pmu_counter_enabled(env, 31)) {
+        uint64_t eff_cycles = cycles;
+        if (pmccntr_clockdiv_enabled(env)) {
+            eff_cycles /= 64;
+        }
+
+        uint64_t new_pmccntr = eff_cycles - env->cp15.c15_ccnt_delta;
+
+        uint64_t overflow_mask = env->cp15.c9_pmcr & PMCRLC ? \
+                                 1ull << 63 : 1ull << 31;
+        if (env->cp15.c15_ccnt & ~new_pmccntr & overflow_mask) {
+            env->cp15.c9_pmovsr |= (1ULL << 31);
+            pmu_update_irq(env);
+        }
+
+        env->cp15.c15_ccnt = new_pmccntr;
+    }
+    env->cp15.c15_ccnt_delta = cycles;
+}
+
+/*
+ * If PMCCNTR is enabled, recalculate the delta between the clock and the
+ * guest-visible count. A call to pmccntr_op_finish should follow every call to
+ * pmccntr_op_start.
+ */
+static void pmccntr_op_finish(CPUARMState *env)
+{
+    if (pmu_counter_enabled(env, 31)) {
+#ifndef CONFIG_USER_ONLY
+        /* Calculate when the counter will next overflow */
+        uint64_t remaining_cycles = -env->cp15.c15_ccnt;
+        if (!(env->cp15.c9_pmcr & PMCRLC)) {
+            remaining_cycles = (uint32_t)remaining_cycles;
+        }
+        int64_t overflow_in = cycles_ns_per(remaining_cycles);
+
+        if (overflow_in > 0) {
+            int64_t overflow_at;
+
+            if (!sadd64_overflow(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL),
+                                 overflow_in, &overflow_at)) {
+                ARMCPU *cpu = env_archcpu(env);
+                timer_mod_anticipate_ns(cpu->pmu_timer, overflow_at);
+            }
+        }
+#endif
+
+        uint64_t prev_cycles = env->cp15.c15_ccnt_delta;
+        if (pmccntr_clockdiv_enabled(env)) {
+            prev_cycles /= 64;
+        }
+        env->cp15.c15_ccnt_delta = prev_cycles - env->cp15.c15_ccnt;
+    }
+}
+
+static void pmevcntr_op_start(CPUARMState *env, uint8_t counter)
+{
+
+    uint16_t event = env->cp15.c14_pmevtyper[counter] & PMXEVTYPER_EVTCOUNT;
+    uint64_t count = 0;
+    if (event_supported(event)) {
+        uint16_t event_idx = supported_event_map[event];
+        count = pm_events[event_idx].get_count(env);
+    }
+
+    if (pmu_counter_enabled(env, counter)) {
+        uint64_t new_pmevcntr = count - env->cp15.c14_pmevcntr_delta[counter];
+        uint64_t overflow_mask = pmevcntr_is_64_bit(env, counter) ?
+            1ULL << 63 : 1ULL << 31;
+
+        if (env->cp15.c14_pmevcntr[counter] & ~new_pmevcntr & overflow_mask) {
+            env->cp15.c9_pmovsr |= (1 << counter);
+            pmu_update_irq(env);
+        }
+        env->cp15.c14_pmevcntr[counter] = new_pmevcntr;
+    }
+    env->cp15.c14_pmevcntr_delta[counter] = count;
+}
+
+static void pmevcntr_op_finish(CPUARMState *env, uint8_t counter)
+{
+    if (pmu_counter_enabled(env, counter)) {
+#ifndef CONFIG_USER_ONLY
+        uint16_t event = env->cp15.c14_pmevtyper[counter] & PMXEVTYPER_EVTCOUNT;
+        uint16_t event_idx = supported_event_map[event];
+        uint64_t delta = -(env->cp15.c14_pmevcntr[counter] + 1);
+        int64_t overflow_in;
+
+        if (!pmevcntr_is_64_bit(env, counter)) {
+            delta = (uint32_t)delta;
+        }
+        overflow_in = pm_events[event_idx].ns_per_count(delta);
+
+        if (overflow_in > 0) {
+            int64_t overflow_at;
+
+            if (!sadd64_overflow(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL),
+                                 overflow_in, &overflow_at)) {
+                ARMCPU *cpu = env_archcpu(env);
+                timer_mod_anticipate_ns(cpu->pmu_timer, overflow_at);
+            }
+        }
+#endif
+
+        env->cp15.c14_pmevcntr_delta[counter] -=
+            env->cp15.c14_pmevcntr[counter];
+    }
+}
+
+void pmu_op_start(CPUARMState *env)
+{
+    unsigned int i;
+    pmccntr_op_start(env);
+    for (i = 0; i < pmu_num_counters(env); i++) {
+        pmevcntr_op_start(env, i);
+    }
+}
+
+void pmu_op_finish(CPUARMState *env)
+{
+    unsigned int i;
+    pmccntr_op_finish(env);
+    for (i = 0; i < pmu_num_counters(env); i++) {
+        pmevcntr_op_finish(env, i);
+    }
+}
+
+void pmu_pre_el_change(ARMCPU *cpu, void *ignored)
+{
+    pmu_op_start(&cpu->env);
+}
+
+void pmu_post_el_change(ARMCPU *cpu, void *ignored)
+{
+    pmu_op_finish(&cpu->env);
+}
+
+void arm_pmu_timer_cb(void *opaque)
+{
+    ARMCPU *cpu = opaque;
+
+    /*
+     * Update all the counter values based on the current underlying counts,
+     * triggering interrupts to be raised, if necessary. pmu_op_finish() also
+     * has the effect of setting the cpu->pmu_timer to the next earliest time a
+     * counter may expire.
+     */
+    pmu_op_start(&cpu->env);
+    pmu_op_finish(&cpu->env);
+}
+
+static void pmcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
+                       uint64_t value)
+{
+    pmu_op_start(env);
+
+    if (value & PMCRC) {
+        /* The counter has been reset */
+        env->cp15.c15_ccnt = 0;
+    }
+
+    if (value & PMCRP) {
+        unsigned int i;
+        for (i = 0; i < pmu_num_counters(env); i++) {
+            env->cp15.c14_pmevcntr[i] = 0;
+        }
+    }
+
+    env->cp15.c9_pmcr &= ~PMCR_WRITABLE_MASK;
+    env->cp15.c9_pmcr |= (value & PMCR_WRITABLE_MASK);
+
+    pmu_op_finish(env);
+}
+
+static uint64_t pmcr_read(CPUARMState *env, const ARMCPRegInfo *ri)
+{
+    uint64_t pmcr = env->cp15.c9_pmcr;
+
+    /*
+     * If EL2 is implemented and enabled for the current security state, reads
+     * of PMCR.N from EL1 or EL0 return the value of MDCR_EL2.HPMN or HDCR.HPMN.
+     */
+    if (arm_current_el(env) <= 1 && arm_is_el2_enabled(env)) {
+        pmcr &= ~PMCRN_MASK;
+        pmcr |= (env->cp15.mdcr_el2 & MDCR_HPMN) << PMCRN_SHIFT;
+    }
+
+    return pmcr;
+}
+
+static void pmswinc_write(CPUARMState *env, const ARMCPRegInfo *ri,
+                          uint64_t value)
+{
+    unsigned int i;
+    uint64_t overflow_mask, new_pmswinc;
+
+    for (i = 0; i < pmu_num_counters(env); i++) {
+        /* Increment a counter's count iff: */
+        if ((value & (1 << i)) && /* counter's bit is set */
+                /* counter is enabled and not filtered */
+                pmu_counter_enabled(env, i) &&
+                /* counter is SW_INCR */
+                (env->cp15.c14_pmevtyper[i] & PMXEVTYPER_EVTCOUNT) == 0x0) {
+            pmevcntr_op_start(env, i);
+
+            /*
+             * Detect if this write causes an overflow since we can't predict
+             * PMSWINC overflows like we can for other events
+             */
+            new_pmswinc = env->cp15.c14_pmevcntr[i] + 1;
+
+            overflow_mask = pmevcntr_is_64_bit(env, i) ?
+                1ULL << 63 : 1ULL << 31;
+
+            if (env->cp15.c14_pmevcntr[i] & ~new_pmswinc & overflow_mask) {
+                env->cp15.c9_pmovsr |= (1 << i);
+                pmu_update_irq(env);
+            }
+
+            env->cp15.c14_pmevcntr[i] = new_pmswinc;
+
+            pmevcntr_op_finish(env, i);
+        }
+    }
+}
+
+static uint64_t pmccntr_read(CPUARMState *env, const ARMCPRegInfo *ri)
+{
+    uint64_t ret;
+    pmccntr_op_start(env);
+    ret = env->cp15.c15_ccnt;
+    pmccntr_op_finish(env);
+    return ret;
+}
+
+static void pmselr_write(CPUARMState *env, const ARMCPRegInfo *ri,
+                         uint64_t value)
+{
+    /*
+     * The value of PMSELR.SEL affects the behavior of PMXEVTYPER and
+     * PMXEVCNTR. We allow [0..31] to be written to PMSELR here; in the
+     * meanwhile, we check PMSELR.SEL when PMXEVTYPER and PMXEVCNTR are
+     * accessed.
+     */
+    env->cp15.c9_pmselr = value & 0x1f;
+}
+
+static void pmccntr_write(CPUARMState *env, const ARMCPRegInfo *ri,
+                        uint64_t value)
+{
+    pmccntr_op_start(env);
+    env->cp15.c15_ccnt = value;
+    pmccntr_op_finish(env);
+}
+
+static void pmccntr_write32(CPUARMState *env, const ARMCPRegInfo *ri,
+                            uint64_t value)
+{
+    uint64_t cur_val = pmccntr_read(env, NULL);
+
+    pmccntr_write(env, ri, deposit64(cur_val, 0, 32, value));
+}
+
+static void pmccfiltr_write(CPUARMState *env, const ARMCPRegInfo *ri,
+                            uint64_t value)
+{
+    pmccntr_op_start(env);
+    env->cp15.pmccfiltr_el0 = value & PMCCFILTR_EL0;
+    pmccntr_op_finish(env);
+}
+
+static void pmccfiltr_write_a32(CPUARMState *env, const ARMCPRegInfo *ri,
+                            uint64_t value)
+{
+    pmccntr_op_start(env);
+    /* M is not accessible from AArch32 */
+    env->cp15.pmccfiltr_el0 = (env->cp15.pmccfiltr_el0 & PMCCFILTR_M) |
+        (value & PMCCFILTR);
+    pmccntr_op_finish(env);
+}
+
+static uint64_t pmccfiltr_read_a32(CPUARMState *env, const ARMCPRegInfo *ri)
+{
+    /* M is not visible in AArch32 */
+    return env->cp15.pmccfiltr_el0 & PMCCFILTR;
+}
+
+static void pmcntenset_write(CPUARMState *env, const ARMCPRegInfo *ri,
+                            uint64_t value)
+{
+    pmu_op_start(env);
+    value &= pmu_counter_mask(env);
+    env->cp15.c9_pmcnten |= value;
+    pmu_op_finish(env);
+}
+
+static void pmcntenclr_write(CPUARMState *env, const ARMCPRegInfo *ri,
+                             uint64_t value)
+{
+    pmu_op_start(env);
+    value &= pmu_counter_mask(env);
+    env->cp15.c9_pmcnten &= ~value;
+    pmu_op_finish(env);
+}
+
+static void pmovsr_write(CPUARMState *env, const ARMCPRegInfo *ri,
+                         uint64_t value)
+{
+    value &= pmu_counter_mask(env);
+    env->cp15.c9_pmovsr &= ~value;
+    pmu_update_irq(env);
+}
+
+static void pmovsset_write(CPUARMState *env, const ARMCPRegInfo *ri,
+                         uint64_t value)
+{
+    value &= pmu_counter_mask(env);
+    env->cp15.c9_pmovsr |= value;
+    pmu_update_irq(env);
+}
+
+static void pmevtyper_write(CPUARMState *env, const ARMCPRegInfo *ri,
+                             uint64_t value, const uint8_t counter)
+{
+    if (counter == 31) {
+        pmccfiltr_write(env, ri, value);
+    } else if (counter < pmu_num_counters(env)) {
+        pmevcntr_op_start(env, counter);
+
+        /*
+         * If this counter's event type is changing, store the current
+         * underlying count for the new type in c14_pmevcntr_delta[counter] so
+         * pmevcntr_op_finish has the correct baseline when it converts back to
+         * a delta.
+         */
+        uint16_t old_event = env->cp15.c14_pmevtyper[counter] &
+            PMXEVTYPER_EVTCOUNT;
+        uint16_t new_event = value & PMXEVTYPER_EVTCOUNT;
+        if (old_event != new_event) {
+            uint64_t count = 0;
+            if (event_supported(new_event)) {
+                uint16_t event_idx = supported_event_map[new_event];
+                count = pm_events[event_idx].get_count(env);
+            }
+            env->cp15.c14_pmevcntr_delta[counter] = count;
+        }
+
+        env->cp15.c14_pmevtyper[counter] = value & PMXEVTYPER_MASK;
+        pmevcntr_op_finish(env, counter);
+    }
+    /*
+     * Attempts to access PMXEVTYPER are CONSTRAINED UNPREDICTABLE when
+     * PMSELR value is equal to or greater than the number of implemented
+     * counters, but not equal to 0x1f. We opt to behave as a RAZ/WI.
+     */
+}
+
+static uint64_t pmevtyper_read(CPUARMState *env, const ARMCPRegInfo *ri,
+                               const uint8_t counter)
+{
+    if (counter == 31) {
+        return env->cp15.pmccfiltr_el0;
+    } else if (counter < pmu_num_counters(env)) {
+        return env->cp15.c14_pmevtyper[counter];
+    } else {
+      /*
+       * We opt to behave as a RAZ/WI when attempts to access PMXEVTYPER
+       * are CONSTRAINED UNPREDICTABLE. See comments in pmevtyper_write().
+       */
+        return 0;
+    }
+}
+
+static void pmevtyper_writefn(CPUARMState *env, const ARMCPRegInfo *ri,
+                              uint64_t value)
+{
+    uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7);
+    pmevtyper_write(env, ri, value, counter);
+}
+
+static void pmevtyper_rawwrite(CPUARMState *env, const ARMCPRegInfo *ri,
+                               uint64_t value)
+{
+    uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7);
+    env->cp15.c14_pmevtyper[counter] = value;
+
+    /*
+     * pmevtyper_rawwrite is called between a pair of pmu_op_start and
+     * pmu_op_finish calls when loading saved state for a migration. Because
+     * we're potentially updating the type of event here, the value written to
+     * c14_pmevcntr_delta by the preceding pmu_op_start call may be for a
+     * different counter type. Therefore, we need to set this value to the
+     * current count for the counter type we're writing so that pmu_op_finish
+     * has the correct count for its calculation.
+     */
+    uint16_t event = value & PMXEVTYPER_EVTCOUNT;
+    if (event_supported(event)) {
+        uint16_t event_idx = supported_event_map[event];
+        env->cp15.c14_pmevcntr_delta[counter] =
+            pm_events[event_idx].get_count(env);
+    }
+}
+
+static uint64_t pmevtyper_readfn(CPUARMState *env, const ARMCPRegInfo *ri)
+{
+    uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7);
+    return pmevtyper_read(env, ri, counter);
+}
+
+static void pmxevtyper_write(CPUARMState *env, const ARMCPRegInfo *ri,
+                             uint64_t value)
+{
+    pmevtyper_write(env, ri, value, env->cp15.c9_pmselr & 31);
+}
+
+static uint64_t pmxevtyper_read(CPUARMState *env, const ARMCPRegInfo *ri)
+{
+    return pmevtyper_read(env, ri, env->cp15.c9_pmselr & 31);
+}
+
+static void pmevcntr_write(CPUARMState *env, const ARMCPRegInfo *ri,
+                             uint64_t value, uint8_t counter)
+{
+    if (!cpu_isar_feature(any_pmuv3p5, env_archcpu(env))) {
+        /* Before FEAT_PMUv3p5, top 32 bits of event counters are RES0 */
+        value &= MAKE_64BIT_MASK(0, 32);
+    }
+    if (counter < pmu_num_counters(env)) {
+        pmevcntr_op_start(env, counter);
+        env->cp15.c14_pmevcntr[counter] = value;
+        pmevcntr_op_finish(env, counter);
+    }
+    /*
+     * We opt to behave as a RAZ/WI when attempts to access PM[X]EVCNTR
+     * are CONSTRAINED UNPREDICTABLE.
+     */
+}
+
+static uint64_t pmevcntr_read(CPUARMState *env, const ARMCPRegInfo *ri,
+                              uint8_t counter)
+{
+    if (counter < pmu_num_counters(env)) {
+        uint64_t ret;
+        pmevcntr_op_start(env, counter);
+        ret = env->cp15.c14_pmevcntr[counter];
+        pmevcntr_op_finish(env, counter);
+        if (!cpu_isar_feature(any_pmuv3p5, env_archcpu(env))) {
+            /* Before FEAT_PMUv3p5, top 32 bits of event counters are RES0 */
+            ret &= MAKE_64BIT_MASK(0, 32);
+        }
+        return ret;
+    } else {
+      /*
+       * We opt to behave as a RAZ/WI when attempts to access PM[X]EVCNTR
+       * are CONSTRAINED UNPREDICTABLE.
+       */
+        return 0;
+    }
+}
+
+static void pmevcntr_writefn(CPUARMState *env, const ARMCPRegInfo *ri,
+                             uint64_t value)
+{
+    uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7);
+    pmevcntr_write(env, ri, value, counter);
+}
+
+static uint64_t pmevcntr_readfn(CPUARMState *env, const ARMCPRegInfo *ri)
+{
+    uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7);
+    return pmevcntr_read(env, ri, counter);
+}
+
+static void pmevcntr_rawwrite(CPUARMState *env, const ARMCPRegInfo *ri,
+                             uint64_t value)
+{
+    uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7);
+    assert(counter < pmu_num_counters(env));
+    env->cp15.c14_pmevcntr[counter] = value;
+    pmevcntr_write(env, ri, value, counter);
+}
+
+static uint64_t pmevcntr_rawread(CPUARMState *env, const ARMCPRegInfo *ri)
+{
+    uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7);
+    assert(counter < pmu_num_counters(env));
+    return env->cp15.c14_pmevcntr[counter];
+}
+
+static void pmxevcntr_write(CPUARMState *env, const ARMCPRegInfo *ri,
+                             uint64_t value)
+{
+    pmevcntr_write(env, ri, value, env->cp15.c9_pmselr & 31);
+}
+
+static uint64_t pmxevcntr_read(CPUARMState *env, const ARMCPRegInfo *ri)
+{
+    return pmevcntr_read(env, ri, env->cp15.c9_pmselr & 31);
+}
+
+static void pmuserenr_write(CPUARMState *env, const ARMCPRegInfo *ri,
+                            uint64_t value)
+{
+    if (arm_feature(env, ARM_FEATURE_V8)) {
+        env->cp15.c9_pmuserenr = value & 0xf;
+    } else {
+        env->cp15.c9_pmuserenr = value & 1;
+    }
+}
+
+static void pmintenset_write(CPUARMState *env, const ARMCPRegInfo *ri,
+                             uint64_t value)
+{
+    /* We have no event counters so only the C bit can be changed */
+    value &= pmu_counter_mask(env);
+    env->cp15.c9_pminten |= value;
+    pmu_update_irq(env);
+}
+
+static void pmintenclr_write(CPUARMState *env, const ARMCPRegInfo *ri,
+                             uint64_t value)
+{
+    value &= pmu_counter_mask(env);
+    env->cp15.c9_pminten &= ~value;
+    pmu_update_irq(env);
+}
+
+static const ARMCPRegInfo v7_pm_reginfo[] = {
+    /*
+     * Performance monitors are implementation defined in v7,
+     * but with an ARM recommended set of registers, which we
+     * follow.
+     *
+     * Performance registers fall into three categories:
+     *  (a) always UNDEF in PL0, RW in PL1 (PMINTENSET, PMINTENCLR)
+     *  (b) RO in PL0 (ie UNDEF on write), RW in PL1 (PMUSERENR)
+     *  (c) UNDEF in PL0 if PMUSERENR.EN==0, otherwise accessible (all others)
+     * For the cases controlled by PMUSERENR we must set .access to PL0_RW
+     * or PL0_RO as appropriate and then check PMUSERENR in the helper fn.
+     */
+    { .name = "PMCNTENSET", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 1,
+      .access = PL0_RW, .type = ARM_CP_ALIAS | ARM_CP_IO,
+      .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmcnten),
+      .writefn = pmcntenset_write,
+      .accessfn = pmreg_access,
+      .fgt = FGT_PMCNTEN,
+      .raw_writefn = raw_write },
+    { .name = "PMCNTENSET_EL0", .state = ARM_CP_STATE_AA64, .type = ARM_CP_IO,
+      .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 1,
+      .access = PL0_RW, .accessfn = pmreg_access,
+      .fgt = FGT_PMCNTEN,
+      .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcnten), .resetvalue = 0,
+      .writefn = pmcntenset_write, .raw_writefn = raw_write },
+    { .name = "PMCNTENCLR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 2,
+      .access = PL0_RW,
+      .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmcnten),
+      .accessfn = pmreg_access,
+      .fgt = FGT_PMCNTEN,
+      .writefn = pmcntenclr_write, .raw_writefn = raw_write,
+      .type = ARM_CP_ALIAS | ARM_CP_IO },
+    { .name = "PMCNTENCLR_EL0", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 2,
+      .access = PL0_RW, .accessfn = pmreg_access,
+      .fgt = FGT_PMCNTEN,
+      .type = ARM_CP_ALIAS | ARM_CP_IO,
+      .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcnten),
+      .writefn = pmcntenclr_write, .raw_writefn = raw_write },
+    { .name = "PMOVSR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 3,
+      .access = PL0_RW, .type = ARM_CP_IO,
+      .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmovsr),
+      .accessfn = pmreg_access,
+      .fgt = FGT_PMOVS,
+      .writefn = pmovsr_write,
+      .raw_writefn = raw_write },
+    { .name = "PMOVSCLR_EL0", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 3,
+      .access = PL0_RW, .accessfn = pmreg_access,
+      .fgt = FGT_PMOVS,
+      .type = ARM_CP_ALIAS | ARM_CP_IO,
+      .fieldoffset = offsetof(CPUARMState, cp15.c9_pmovsr),
+      .writefn = pmovsr_write,
+      .raw_writefn = raw_write },
+    { .name = "PMSWINC", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 4,
+      .access = PL0_W, .accessfn = pmreg_access_swinc,
+      .fgt = FGT_PMSWINC_EL0,
+      .type = ARM_CP_NO_RAW | ARM_CP_IO,
+      .writefn = pmswinc_write },
+    { .name = "PMSWINC_EL0", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 4,
+      .access = PL0_W, .accessfn = pmreg_access_swinc,
+      .fgt = FGT_PMSWINC_EL0,
+      .type = ARM_CP_NO_RAW | ARM_CP_IO,
+      .writefn = pmswinc_write },
+    { .name = "PMSELR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 5,
+      .access = PL0_RW, .type = ARM_CP_ALIAS,
+      .fgt = FGT_PMSELR_EL0,
+      .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmselr),
+      .accessfn = pmreg_access_selr, .writefn = pmselr_write,
+      .raw_writefn = raw_write},
+    { .name = "PMSELR_EL0", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 5,
+      .access = PL0_RW, .accessfn = pmreg_access_selr,
+      .fgt = FGT_PMSELR_EL0,
+      .fieldoffset = offsetof(CPUARMState, cp15.c9_pmselr),
+      .writefn = pmselr_write, .raw_writefn = raw_write, },
+    { .name = "PMCCNTR", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 0,
+      .access = PL0_RW, .resetvalue = 0, .type = ARM_CP_ALIAS | ARM_CP_IO,
+      .fgt = FGT_PMCCNTR_EL0,
+      .readfn = pmccntr_read, .writefn = pmccntr_write32,
+      .accessfn = pmreg_access_ccntr },
+    { .name = "PMCCNTR_EL0", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 13, .opc2 = 0,
+      .access = PL0_RW, .accessfn = pmreg_access_ccntr,
+      .fgt = FGT_PMCCNTR_EL0,
+      .type = ARM_CP_IO,
+      .fieldoffset = offsetof(CPUARMState, cp15.c15_ccnt),
+      .readfn = pmccntr_read, .writefn = pmccntr_write,
+      .raw_readfn = raw_read, .raw_writefn = raw_write, },
+    { .name = "PMCCFILTR", .cp = 15, .opc1 = 0, .crn = 14, .crm = 15, .opc2 = 7,
+      .writefn = pmccfiltr_write_a32, .readfn = pmccfiltr_read_a32,
+      .access = PL0_RW, .accessfn = pmreg_access,
+      .fgt = FGT_PMCCFILTR_EL0,
+      .type = ARM_CP_ALIAS | ARM_CP_IO,
+      .resetvalue = 0, },
+    { .name = "PMCCFILTR_EL0", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 15, .opc2 = 7,
+      .writefn = pmccfiltr_write, .raw_writefn = raw_write,
+      .access = PL0_RW, .accessfn = pmreg_access,
+      .fgt = FGT_PMCCFILTR_EL0,
+      .type = ARM_CP_IO,
+      .fieldoffset = offsetof(CPUARMState, cp15.pmccfiltr_el0),
+      .resetvalue = 0, },
+    { .name = "PMXEVTYPER", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 1,
+      .access = PL0_RW, .type = ARM_CP_NO_RAW | ARM_CP_IO,
+      .accessfn = pmreg_access,
+      .fgt = FGT_PMEVTYPERN_EL0,
+      .writefn = pmxevtyper_write, .readfn = pmxevtyper_read },
+    { .name = "PMXEVTYPER_EL0", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 13, .opc2 = 1,
+      .access = PL0_RW, .type = ARM_CP_NO_RAW | ARM_CP_IO,
+      .accessfn = pmreg_access,
+      .fgt = FGT_PMEVTYPERN_EL0,
+      .writefn = pmxevtyper_write, .readfn = pmxevtyper_read },
+    { .name = "PMXEVCNTR", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 2,
+      .access = PL0_RW, .type = ARM_CP_NO_RAW | ARM_CP_IO,
+      .accessfn = pmreg_access_xevcntr,
+      .fgt = FGT_PMEVCNTRN_EL0,
+      .writefn = pmxevcntr_write, .readfn = pmxevcntr_read },
+    { .name = "PMXEVCNTR_EL0", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 13, .opc2 = 2,
+      .access = PL0_RW, .type = ARM_CP_NO_RAW | ARM_CP_IO,
+      .accessfn = pmreg_access_xevcntr,
+      .fgt = FGT_PMEVCNTRN_EL0,
+      .writefn = pmxevcntr_write, .readfn = pmxevcntr_read },
+    { .name = "PMUSERENR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 0,
+      .access = PL0_R | PL1_RW, .accessfn = access_tpm,
+      .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmuserenr),
+      .resetvalue = 0,
+      .writefn = pmuserenr_write, .raw_writefn = raw_write },
+    { .name = "PMUSERENR_EL0", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 14, .opc2 = 0,
+      .access = PL0_R | PL1_RW, .accessfn = access_tpm, .type = ARM_CP_ALIAS,
+      .fieldoffset = offsetof(CPUARMState, cp15.c9_pmuserenr),
+      .resetvalue = 0,
+      .writefn = pmuserenr_write, .raw_writefn = raw_write },
+    { .name = "PMINTENSET", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 1,
+      .access = PL1_RW, .accessfn = access_tpm,
+      .fgt = FGT_PMINTEN,
+      .type = ARM_CP_ALIAS | ARM_CP_IO,
+      .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pminten),
+      .resetvalue = 0,
+      .writefn = pmintenset_write, .raw_writefn = raw_write },
+    { .name = "PMINTENSET_EL1", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 1,
+      .access = PL1_RW, .accessfn = access_tpm,
+      .fgt = FGT_PMINTEN,
+      .type = ARM_CP_IO,
+      .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
+      .writefn = pmintenset_write, .raw_writefn = raw_write,
+      .resetvalue = 0x0 },
+    { .name = "PMINTENCLR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 2,
+      .access = PL1_RW, .accessfn = access_tpm,
+      .fgt = FGT_PMINTEN,
+      .type = ARM_CP_ALIAS | ARM_CP_IO,
+      .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
+      .writefn = pmintenclr_write, .raw_writefn = raw_write },
+    { .name = "PMINTENCLR_EL1", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 2,
+      .access = PL1_RW, .accessfn = access_tpm,
+      .fgt = FGT_PMINTEN,
+      .type = ARM_CP_ALIAS | ARM_CP_IO,
+      .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
+      .writefn = pmintenclr_write, .raw_writefn = raw_write },
+};
+
+static const ARMCPRegInfo pmovsset_cp_reginfo[] = {
+    /* PMOVSSET is not implemented in v7 before v7ve */
+    { .name = "PMOVSSET", .cp = 15, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 3,
+      .access = PL0_RW, .accessfn = pmreg_access,
+      .fgt = FGT_PMOVS,
+      .type = ARM_CP_ALIAS | ARM_CP_IO,
+      .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmovsr),
+      .writefn = pmovsset_write,
+      .raw_writefn = raw_write },
+    { .name = "PMOVSSET_EL0", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 14, .opc2 = 3,
+      .access = PL0_RW, .accessfn = pmreg_access,
+      .fgt = FGT_PMOVS,
+      .type = ARM_CP_ALIAS | ARM_CP_IO,
+      .fieldoffset = offsetof(CPUARMState, cp15.c9_pmovsr),
+      .writefn = pmovsset_write,
+      .raw_writefn = raw_write },
+};
+
+void define_pm_cpregs(ARMCPU *cpu)
+{
+    CPUARMState *env = &cpu->env;
+
+    if (arm_feature(env, ARM_FEATURE_V7)) {
+        /*
+         * v7 performance monitor control register: same implementor
+         * field as main ID register, and we implement four counters in
+         * addition to the cycle count register.
+         */
+        static const ARMCPRegInfo pmcr = {
+            .name = "PMCR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 0,
+            .access = PL0_RW,
+            .fgt = FGT_PMCR_EL0,
+            .type = ARM_CP_IO | ARM_CP_ALIAS,
+            .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmcr),
+            .accessfn = pmreg_access,
+            .readfn = pmcr_read, .raw_readfn = raw_read,
+            .writefn = pmcr_write, .raw_writefn = raw_write,
+        };
+        const ARMCPRegInfo pmcr64 = {
+            .name = "PMCR_EL0", .state = ARM_CP_STATE_AA64,
+            .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 0,
+            .access = PL0_RW, .accessfn = pmreg_access,
+            .fgt = FGT_PMCR_EL0,
+            .type = ARM_CP_IO,
+            .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcr),
+            .resetvalue = cpu->isar.reset_pmcr_el0,
+            .readfn = pmcr_read, .raw_readfn = raw_read,
+            .writefn = pmcr_write, .raw_writefn = raw_write,
+        };
+
+        define_one_arm_cp_reg(cpu, &pmcr);
+        define_one_arm_cp_reg(cpu, &pmcr64);
+        define_arm_cp_regs(cpu, v7_pm_reginfo);
+
+        for (unsigned i = 0, pmcrn = pmu_num_counters(env); i < pmcrn; i++) {
+            g_autofree char *pmevcntr_name = g_strdup_printf("PMEVCNTR%d", i);
+            g_autofree char *pmevcntr_el0_name = g_strdup_printf("PMEVCNTR%d_EL0", i);
+            g_autofree char *pmevtyper_name = g_strdup_printf("PMEVTYPER%d", i);
+            g_autofree char *pmevtyper_el0_name = g_strdup_printf("PMEVTYPER%d_EL0", i);
+
+            ARMCPRegInfo pmev_regs[] = {
+                { .name = pmevcntr_name, .cp = 15, .crn = 14,
+                  .crm = 8 | (3 & (i >> 3)), .opc1 = 0, .opc2 = i & 7,
+                  .access = PL0_RW, .type = ARM_CP_IO | ARM_CP_ALIAS,
+                  .fgt = FGT_PMEVCNTRN_EL0,
+                  .readfn = pmevcntr_readfn, .writefn = pmevcntr_writefn,
+                  .accessfn = pmreg_access_xevcntr },
+                { .name = pmevcntr_el0_name, .state = ARM_CP_STATE_AA64,
+                  .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 8 | (3 & (i >> 3)),
+                  .opc2 = i & 7, .access = PL0_RW, .accessfn = pmreg_access_xevcntr,
+                  .type = ARM_CP_IO,
+                  .fgt = FGT_PMEVCNTRN_EL0,
+                  .readfn = pmevcntr_readfn, .writefn = pmevcntr_writefn,
+                  .raw_readfn = pmevcntr_rawread,
+                  .raw_writefn = pmevcntr_rawwrite },
+                { .name = pmevtyper_name, .cp = 15, .crn = 14,
+                  .crm = 12 | (3 & (i >> 3)), .opc1 = 0, .opc2 = i & 7,
+                  .access = PL0_RW, .type = ARM_CP_IO | ARM_CP_ALIAS,
+                  .fgt = FGT_PMEVTYPERN_EL0,
+                  .readfn = pmevtyper_readfn, .writefn = pmevtyper_writefn,
+                  .accessfn = pmreg_access },
+                { .name = pmevtyper_el0_name, .state = ARM_CP_STATE_AA64,
+                  .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 12 | (3 & (i >> 3)),
+                  .opc2 = i & 7, .access = PL0_RW, .accessfn = pmreg_access,
+                  .fgt = FGT_PMEVTYPERN_EL0,
+                  .type = ARM_CP_IO,
+                  .readfn = pmevtyper_readfn, .writefn = pmevtyper_writefn,
+                  .raw_writefn = pmevtyper_rawwrite },
+            };
+            define_arm_cp_regs(cpu, pmev_regs);
+        }
+    }
+    if (arm_feature(env, ARM_FEATURE_V7VE)) {
+        define_arm_cp_regs(cpu, pmovsset_cp_reginfo);
+    }
+
+    if (arm_feature(env, ARM_FEATURE_V8)) {
+        const ARMCPRegInfo v8_pm_reginfo[] = {
+            { .name = "PMCEID0", .state = ARM_CP_STATE_AA32,
+              .cp = 15, .opc1 = 0, .crn = 9, .crm = 12, .opc2 = 6,
+              .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST,
+              .fgt = FGT_PMCEIDN_EL0,
+              .resetvalue = extract64(cpu->pmceid0, 0, 32) },
+            { .name = "PMCEID0_EL0", .state = ARM_CP_STATE_AA64,
+              .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 6,
+              .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST,
+              .fgt = FGT_PMCEIDN_EL0,
+              .resetvalue = cpu->pmceid0 },
+            { .name = "PMCEID1", .state = ARM_CP_STATE_AA32,
+              .cp = 15, .opc1 = 0, .crn = 9, .crm = 12, .opc2 = 7,
+              .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST,
+              .fgt = FGT_PMCEIDN_EL0,
+              .resetvalue = extract64(cpu->pmceid1, 0, 32) },
+            { .name = "PMCEID1_EL0", .state = ARM_CP_STATE_AA64,
+              .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 7,
+              .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST,
+              .fgt = FGT_PMCEIDN_EL0,
+              .resetvalue = cpu->pmceid1 },
+        };
+        define_arm_cp_regs(cpu, v8_pm_reginfo);
+    }
+
+    if (cpu_isar_feature(aa32_pmuv3p1, cpu)) {
+        ARMCPRegInfo v81_pmu_regs[] = {
+            { .name = "PMCEID2", .state = ARM_CP_STATE_AA32,
+              .cp = 15, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 4,
+              .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST,
+              .fgt = FGT_PMCEIDN_EL0,
+              .resetvalue = extract64(cpu->pmceid0, 32, 32) },
+            { .name = "PMCEID3", .state = ARM_CP_STATE_AA32,
+              .cp = 15, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 5,
+              .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST,
+              .fgt = FGT_PMCEIDN_EL0,
+              .resetvalue = extract64(cpu->pmceid1, 32, 32) },
+        };
+        define_arm_cp_regs(cpu, v81_pmu_regs);
+    }
+
+    if (cpu_isar_feature(any_pmuv3p4, cpu)) {
+        static const ARMCPRegInfo v84_pmmir = {
+            .name = "PMMIR_EL1", .state = ARM_CP_STATE_BOTH,
+            .opc0 = 3, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 6,
+            .access = PL1_R, .accessfn = pmreg_access, .type = ARM_CP_CONST,
+            .fgt = FGT_PMMIR_EL1,
+            .resetvalue = 0
+        };
+        define_one_arm_cp_reg(cpu, &v84_pmmir);
+    }
+}
diff --git a/target/arm/cpregs.h b/target/arm/cpregs.h
index c1a7ae3735..c9506aa6d5 100644
--- a/target/arm/cpregs.h
+++ b/target/arm/cpregs.h
@@ -1065,6 +1065,9 @@ void arm_cp_write_ignore(CPUARMState *env, const ARMCPRegInfo *ri,
 /* CPReadFn that can be used for read-as-zero behaviour */
 uint64_t arm_cp_read_zero(CPUARMState *env, const ARMCPRegInfo *ri);
 
+/* CPReadFn that just reads the value from ri->fieldoffset */
+uint64_t raw_read(CPUARMState *env, const ARMCPRegInfo *ri);
+
 /* CPWriteFn that just writes the value to ri->fieldoffset */
 void raw_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value);
 
diff --git a/target/arm/helper.c b/target/arm/helper.c
index 0883246905..0c1299ff84 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -38,11 +38,9 @@
 #define HELPER_H "tcg/helper.h"
 #include "exec/helper-proto.h.inc"
 
-#define ARM_CPU_FREQ 1000000000 /* FIXME: 1 GHz, should be configurable */
-
 static void switch_mode(CPUARMState *env, int mode);
 
-static uint64_t raw_read(CPUARMState *env, const ARMCPRegInfo *ri)
+uint64_t raw_read(CPUARMState *env, const ARMCPRegInfo *ri)
 {
     assert(ri->fieldoffset);
     if (cpreg_field_is_64bit(ri)) {
@@ -319,25 +317,6 @@ static CPAccessResult access_trap_aa32s_el1(CPUARMState *env,
     return CP_ACCESS_UNDEFINED;
 }
 
-/*
- * Check for traps to performance monitor registers, which are controlled
- * by MDCR_EL2.TPM for EL2 and MDCR_EL3.TPM for EL3.
- */
-static CPAccessResult access_tpm(CPUARMState *env, const ARMCPRegInfo *ri,
-                                 bool isread)
-{
-    int el = arm_current_el(env);
-    uint64_t mdcr_el2 = arm_mdcr_el2_eff(env);
-
-    if (el < 2 && (mdcr_el2 & MDCR_TPM)) {
-        return CP_ACCESS_TRAP_EL2;
-    }
-    if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TPM)) {
-        return CP_ACCESS_TRAP_EL3;
-    }
-    return CP_ACCESS_OK;
-}
-
 /* Check for traps from EL1 due to HCR_EL2.TVM and HCR_EL2.TRVM.  */
 CPAccessResult access_tvm_trvm(CPUARMState *env, const ARMCPRegInfo *ri,
                                bool isread)
@@ -681,283 +660,6 @@ static const ARMCPRegInfo v6_cp_reginfo[] = {
       .resetfn = cpacr_reset, .writefn = cpacr_write, .readfn = cpacr_read },
 };
 
-typedef struct pm_event {
-    uint16_t number; /* PMEVTYPER.evtCount is 16 bits wide */
-    /* If the event is supported on this CPU (used to generate PMCEID[01]) */
-    bool (*supported)(CPUARMState *);
-    /*
-     * Retrieve the current count of the underlying event. The programmed
-     * counters hold a difference from the return value from this function
-     */
-    uint64_t (*get_count)(CPUARMState *);
-    /*
-     * Return how many nanoseconds it will take (at a minimum) for count events
-     * to occur. A negative value indicates the counter will never overflow, or
-     * that the counter has otherwise arranged for the overflow bit to be set
-     * and the PMU interrupt to be raised on overflow.
-     */
-    int64_t (*ns_per_count)(uint64_t);
-} pm_event;
-
-static bool event_always_supported(CPUARMState *env)
-{
-    return true;
-}
-
-static uint64_t swinc_get_count(CPUARMState *env)
-{
-    /*
-     * SW_INCR events are written directly to the pmevcntr's by writes to
-     * PMSWINC, so there is no underlying count maintained by the PMU itself
-     */
-    return 0;
-}
-
-static int64_t swinc_ns_per(uint64_t ignored)
-{
-    return -1;
-}
-
-/*
- * Return the underlying cycle count for the PMU cycle counters. If we're in
- * usermode, simply return 0.
- */
-static uint64_t cycles_get_count(CPUARMState *env)
-{
-#ifndef CONFIG_USER_ONLY
-    return muldiv64(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL),
-                   ARM_CPU_FREQ, NANOSECONDS_PER_SECOND);
-#else
-    return cpu_get_host_ticks();
-#endif
-}
-
-#ifndef CONFIG_USER_ONLY
-static int64_t cycles_ns_per(uint64_t cycles)
-{
-    return (ARM_CPU_FREQ / NANOSECONDS_PER_SECOND) * cycles;
-}
-
-static bool instructions_supported(CPUARMState *env)
-{
-    /* Precise instruction counting */
-    return icount_enabled() == ICOUNT_PRECISE;
-}
-
-static uint64_t instructions_get_count(CPUARMState *env)
-{
-    assert(icount_enabled() == ICOUNT_PRECISE);
-    return (uint64_t)icount_get_raw();
-}
-
-static int64_t instructions_ns_per(uint64_t icount)
-{
-    assert(icount_enabled() == ICOUNT_PRECISE);
-    return icount_to_ns((int64_t)icount);
-}
-#endif
-
-static bool pmuv3p1_events_supported(CPUARMState *env)
-{
-    /* For events which are supported in any v8.1 PMU */
-    return cpu_isar_feature(any_pmuv3p1, env_archcpu(env));
-}
-
-static bool pmuv3p4_events_supported(CPUARMState *env)
-{
-    /* For events which are supported in any v8.1 PMU */
-    return cpu_isar_feature(any_pmuv3p4, env_archcpu(env));
-}
-
-static uint64_t zero_event_get_count(CPUARMState *env)
-{
-    /* For events which on QEMU never fire, so their count is always zero */
-    return 0;
-}
-
-static int64_t zero_event_ns_per(uint64_t cycles)
-{
-    /* An event which never fires can never overflow */
-    return -1;
-}
-
-static const pm_event pm_events[] = {
-    { .number = 0x000, /* SW_INCR */
-      .supported = event_always_supported,
-      .get_count = swinc_get_count,
-      .ns_per_count = swinc_ns_per,
-    },
-#ifndef CONFIG_USER_ONLY
-    { .number = 0x008, /* INST_RETIRED, Instruction architecturally executed */
-      .supported = instructions_supported,
-      .get_count = instructions_get_count,
-      .ns_per_count = instructions_ns_per,
-    },
-    { .number = 0x011, /* CPU_CYCLES, Cycle */
-      .supported = event_always_supported,
-      .get_count = cycles_get_count,
-      .ns_per_count = cycles_ns_per,
-    },
-#endif
-    { .number = 0x023, /* STALL_FRONTEND */
-      .supported = pmuv3p1_events_supported,
-      .get_count = zero_event_get_count,
-      .ns_per_count = zero_event_ns_per,
-    },
-    { .number = 0x024, /* STALL_BACKEND */
-      .supported = pmuv3p1_events_supported,
-      .get_count = zero_event_get_count,
-      .ns_per_count = zero_event_ns_per,
-    },
-    { .number = 0x03c, /* STALL */
-      .supported = pmuv3p4_events_supported,
-      .get_count = zero_event_get_count,
-      .ns_per_count = zero_event_ns_per,
-    },
-};
-
-/*
- * Note: Before increasing MAX_EVENT_ID beyond 0x3f into the 0x40xx range of
- * events (i.e. the statistical profiling extension), this implementation
- * should first be updated to something sparse instead of the current
- * supported_event_map[] array.
- */
-#define MAX_EVENT_ID 0x3c
-#define UNSUPPORTED_EVENT UINT16_MAX
-static uint16_t supported_event_map[MAX_EVENT_ID + 1];
-
-/*
- * Called upon CPU initialization to initialize PMCEID[01]_EL0 and build a map
- * of ARM event numbers to indices in our pm_events array.
- *
- * Note: Events in the 0x40XX range are not currently supported.
- */
-void pmu_init(ARMCPU *cpu)
-{
-    unsigned int i;
-
-    /*
-     * Empty supported_event_map and cpu->pmceid[01] before adding supported
-     * events to them
-     */
-    for (i = 0; i < ARRAY_SIZE(supported_event_map); i++) {
-        supported_event_map[i] = UNSUPPORTED_EVENT;
-    }
-    cpu->pmceid0 = 0;
-    cpu->pmceid1 = 0;
-
-    for (i = 0; i < ARRAY_SIZE(pm_events); i++) {
-        const pm_event *cnt = &pm_events[i];
-        assert(cnt->number <= MAX_EVENT_ID);
-        /* We do not currently support events in the 0x40xx range */
-        assert(cnt->number <= 0x3f);
-
-        if (cnt->supported(&cpu->env)) {
-            supported_event_map[cnt->number] = i;
-            uint64_t event_mask = 1ULL << (cnt->number & 0x1f);
-            if (cnt->number & 0x20) {
-                cpu->pmceid1 |= event_mask;
-            } else {
-                cpu->pmceid0 |= event_mask;
-            }
-        }
-    }
-}
-
-/*
- * Check at runtime whether a PMU event is supported for the current machine
- */
-static bool event_supported(uint16_t number)
-{
-    if (number > MAX_EVENT_ID) {
-        return false;
-    }
-    return supported_event_map[number] != UNSUPPORTED_EVENT;
-}
-
-static CPAccessResult pmreg_access(CPUARMState *env, const ARMCPRegInfo *ri,
-                                   bool isread)
-{
-    /*
-     * Performance monitor registers user accessibility is controlled
-     * by PMUSERENR. MDCR_EL2.TPM and MDCR_EL3.TPM allow configurable
-     * trapping to EL2 or EL3 for other accesses.
-     */
-    int el = arm_current_el(env);
-    uint64_t mdcr_el2 = arm_mdcr_el2_eff(env);
-
-    if (el == 0 && !(env->cp15.c9_pmuserenr & 1)) {
-        return CP_ACCESS_TRAP_EL1;
-    }
-    if (el < 2 && (mdcr_el2 & MDCR_TPM)) {
-        return CP_ACCESS_TRAP_EL2;
-    }
-    if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TPM)) {
-        return CP_ACCESS_TRAP_EL3;
-    }
-
-    return CP_ACCESS_OK;
-}
-
-static CPAccessResult pmreg_access_xevcntr(CPUARMState *env,
-                                           const ARMCPRegInfo *ri,
-                                           bool isread)
-{
-    /* ER: event counter read trap control */
-    if (arm_feature(env, ARM_FEATURE_V8)
-        && arm_current_el(env) == 0
-        && (env->cp15.c9_pmuserenr & (1 << 3)) != 0
-        && isread) {
-        return CP_ACCESS_OK;
-    }
-
-    return pmreg_access(env, ri, isread);
-}
-
-static CPAccessResult pmreg_access_swinc(CPUARMState *env,
-                                         const ARMCPRegInfo *ri,
-                                         bool isread)
-{
-    /* SW: software increment write trap control */
-    if (arm_feature(env, ARM_FEATURE_V8)
-        && arm_current_el(env) == 0
-        && (env->cp15.c9_pmuserenr & (1 << 1)) != 0
-        && !isread) {
-        return CP_ACCESS_OK;
-    }
-
-    return pmreg_access(env, ri, isread);
-}
-
-static CPAccessResult pmreg_access_selr(CPUARMState *env,
-                                        const ARMCPRegInfo *ri,
-                                        bool isread)
-{
-    /* ER: event counter read trap control */
-    if (arm_feature(env, ARM_FEATURE_V8)
-        && arm_current_el(env) == 0
-        && (env->cp15.c9_pmuserenr & (1 << 3)) != 0) {
-        return CP_ACCESS_OK;
-    }
-
-    return pmreg_access(env, ri, isread);
-}
-
-static CPAccessResult pmreg_access_ccntr(CPUARMState *env,
-                                         const ARMCPRegInfo *ri,
-                                         bool isread)
-{
-    /* CR: cycle counter read trap control */
-    if (arm_feature(env, ARM_FEATURE_V8)
-        && arm_current_el(env) == 0
-        && (env->cp15.c9_pmuserenr & (1 << 2)) != 0
-        && isread) {
-        return CP_ACCESS_OK;
-    }
-
-    return pmreg_access(env, ri, isread);
-}
-
 /*
  * Bits in MDCR_EL2 and MDCR_EL3 which pmu_counter_enabled() looks at.
  * We use these to decide whether we need to wrap a write to MDCR_EL2
@@ -967,684 +669,6 @@ static CPAccessResult pmreg_access_ccntr(CPUARMState *env,
     (MDCR_HPME | MDCR_HPMD | MDCR_HPMN | MDCR_HCCD | MDCR_HLP)
 #define MDCR_EL3_PMU_ENABLE_BITS (MDCR_SPME | MDCR_SCCD)
 
-/*
- * Returns true if the counter (pass 31 for PMCCNTR) should count events using
- * the current EL, security state, and register configuration.
- */
-static bool pmu_counter_enabled(CPUARMState *env, uint8_t counter)
-{
-    uint64_t filter;
-    bool e, p, u, nsk, nsu, nsh, m;
-    bool enabled, prohibited = false, filtered;
-    bool secure = arm_is_secure(env);
-    int el = arm_current_el(env);
-    uint64_t mdcr_el2;
-    uint8_t hpmn;
-
-    /*
-     * We might be called for M-profile cores where MDCR_EL2 doesn't
-     * exist and arm_mdcr_el2_eff() will assert, so this early-exit check
-     * must be before we read that value.
-     */
-    if (!arm_feature(env, ARM_FEATURE_PMU)) {
-        return false;
-    }
-
-    mdcr_el2 = arm_mdcr_el2_eff(env);
-    hpmn = mdcr_el2 & MDCR_HPMN;
-
-    if (!arm_feature(env, ARM_FEATURE_EL2) ||
-            (counter < hpmn || counter == 31)) {
-        e = env->cp15.c9_pmcr & PMCRE;
-    } else {
-        e = mdcr_el2 & MDCR_HPME;
-    }
-    enabled = e && (env->cp15.c9_pmcnten & (1 << counter));
-
-    /* Is event counting prohibited? */
-    if (el == 2 && (counter < hpmn || counter == 31)) {
-        prohibited = mdcr_el2 & MDCR_HPMD;
-    }
-    if (secure) {
-        prohibited = prohibited || !(env->cp15.mdcr_el3 & MDCR_SPME);
-    }
-
-    if (counter == 31) {
-        /*
-         * The cycle counter defaults to running. PMCR.DP says "disable
-         * the cycle counter when event counting is prohibited".
-         * Some MDCR bits disable the cycle counter specifically.
-         */
-        prohibited = prohibited && env->cp15.c9_pmcr & PMCRDP;
-        if (cpu_isar_feature(any_pmuv3p5, env_archcpu(env))) {
-            if (secure) {
-                prohibited = prohibited || (env->cp15.mdcr_el3 & MDCR_SCCD);
-            }
-            if (el == 2) {
-                prohibited = prohibited || (mdcr_el2 & MDCR_HCCD);
-            }
-        }
-    }
-
-    if (counter == 31) {
-        filter = env->cp15.pmccfiltr_el0;
-    } else {
-        filter = env->cp15.c14_pmevtyper[counter];
-    }
-
-    p   = filter & PMXEVTYPER_P;
-    u   = filter & PMXEVTYPER_U;
-    nsk = arm_feature(env, ARM_FEATURE_EL3) && (filter & PMXEVTYPER_NSK);
-    nsu = arm_feature(env, ARM_FEATURE_EL3) && (filter & PMXEVTYPER_NSU);
-    nsh = arm_feature(env, ARM_FEATURE_EL2) && (filter & PMXEVTYPER_NSH);
-    m   = arm_el_is_aa64(env, 1) &&
-              arm_feature(env, ARM_FEATURE_EL3) && (filter & PMXEVTYPER_M);
-
-    if (el == 0) {
-        filtered = secure ? u : u != nsu;
-    } else if (el == 1) {
-        filtered = secure ? p : p != nsk;
-    } else if (el == 2) {
-        filtered = !nsh;
-    } else { /* EL3 */
-        filtered = m != p;
-    }
-
-    if (counter != 31) {
-        /*
-         * If not checking PMCCNTR, ensure the counter is setup to an event we
-         * support
-         */
-        uint16_t event = filter & PMXEVTYPER_EVTCOUNT;
-        if (!event_supported(event)) {
-            return false;
-        }
-    }
-
-    return enabled && !prohibited && !filtered;
-}
-
-static void pmu_update_irq(CPUARMState *env)
-{
-    ARMCPU *cpu = env_archcpu(env);
-    qemu_set_irq(cpu->pmu_interrupt, (env->cp15.c9_pmcr & PMCRE) &&
-            (env->cp15.c9_pminten & env->cp15.c9_pmovsr));
-}
-
-static bool pmccntr_clockdiv_enabled(CPUARMState *env)
-{
-    /*
-     * Return true if the clock divider is enabled and the cycle counter
-     * is supposed to tick only once every 64 clock cycles. This is
-     * controlled by PMCR.D, but if PMCR.LC is set to enable the long
-     * (64-bit) cycle counter PMCR.D has no effect.
-     */
-    return (env->cp15.c9_pmcr & (PMCRD | PMCRLC)) == PMCRD;
-}
-
-static bool pmevcntr_is_64_bit(CPUARMState *env, int counter)
-{
-    /* Return true if the specified event counter is configured to be 64 bit */
-
-    /* This isn't intended to be used with the cycle counter */
-    assert(counter < 31);
-
-    if (!cpu_isar_feature(any_pmuv3p5, env_archcpu(env))) {
-        return false;
-    }
-
-    if (arm_feature(env, ARM_FEATURE_EL2)) {
-        /*
-         * MDCR_EL2.HLP still applies even when EL2 is disabled in the
-         * current security state, so we don't use arm_mdcr_el2_eff() here.
-         */
-        bool hlp = env->cp15.mdcr_el2 & MDCR_HLP;
-        int hpmn = env->cp15.mdcr_el2 & MDCR_HPMN;
-
-        if (counter >= hpmn) {
-            return hlp;
-        }
-    }
-    return env->cp15.c9_pmcr & PMCRLP;
-}
-
-/*
- * Ensure c15_ccnt is the guest-visible count so that operations such as
- * enabling/disabling the counter or filtering, modifying the count itself,
- * etc. can be done logically. This is essentially a no-op if the counter is
- * not enabled at the time of the call.
- */
-static void pmccntr_op_start(CPUARMState *env)
-{
-    uint64_t cycles = cycles_get_count(env);
-
-    if (pmu_counter_enabled(env, 31)) {
-        uint64_t eff_cycles = cycles;
-        if (pmccntr_clockdiv_enabled(env)) {
-            eff_cycles /= 64;
-        }
-
-        uint64_t new_pmccntr = eff_cycles - env->cp15.c15_ccnt_delta;
-
-        uint64_t overflow_mask = env->cp15.c9_pmcr & PMCRLC ? \
-                                 1ull << 63 : 1ull << 31;
-        if (env->cp15.c15_ccnt & ~new_pmccntr & overflow_mask) {
-            env->cp15.c9_pmovsr |= (1ULL << 31);
-            pmu_update_irq(env);
-        }
-
-        env->cp15.c15_ccnt = new_pmccntr;
-    }
-    env->cp15.c15_ccnt_delta = cycles;
-}
-
-/*
- * If PMCCNTR is enabled, recalculate the delta between the clock and the
- * guest-visible count. A call to pmccntr_op_finish should follow every call to
- * pmccntr_op_start.
- */
-static void pmccntr_op_finish(CPUARMState *env)
-{
-    if (pmu_counter_enabled(env, 31)) {
-#ifndef CONFIG_USER_ONLY
-        /* Calculate when the counter will next overflow */
-        uint64_t remaining_cycles = -env->cp15.c15_ccnt;
-        if (!(env->cp15.c9_pmcr & PMCRLC)) {
-            remaining_cycles = (uint32_t)remaining_cycles;
-        }
-        int64_t overflow_in = cycles_ns_per(remaining_cycles);
-
-        if (overflow_in > 0) {
-            int64_t overflow_at;
-
-            if (!sadd64_overflow(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL),
-                                 overflow_in, &overflow_at)) {
-                ARMCPU *cpu = env_archcpu(env);
-                timer_mod_anticipate_ns(cpu->pmu_timer, overflow_at);
-            }
-        }
-#endif
-
-        uint64_t prev_cycles = env->cp15.c15_ccnt_delta;
-        if (pmccntr_clockdiv_enabled(env)) {
-            prev_cycles /= 64;
-        }
-        env->cp15.c15_ccnt_delta = prev_cycles - env->cp15.c15_ccnt;
-    }
-}
-
-static void pmevcntr_op_start(CPUARMState *env, uint8_t counter)
-{
-
-    uint16_t event = env->cp15.c14_pmevtyper[counter] & PMXEVTYPER_EVTCOUNT;
-    uint64_t count = 0;
-    if (event_supported(event)) {
-        uint16_t event_idx = supported_event_map[event];
-        count = pm_events[event_idx].get_count(env);
-    }
-
-    if (pmu_counter_enabled(env, counter)) {
-        uint64_t new_pmevcntr = count - env->cp15.c14_pmevcntr_delta[counter];
-        uint64_t overflow_mask = pmevcntr_is_64_bit(env, counter) ?
-            1ULL << 63 : 1ULL << 31;
-
-        if (env->cp15.c14_pmevcntr[counter] & ~new_pmevcntr & overflow_mask) {
-            env->cp15.c9_pmovsr |= (1 << counter);
-            pmu_update_irq(env);
-        }
-        env->cp15.c14_pmevcntr[counter] = new_pmevcntr;
-    }
-    env->cp15.c14_pmevcntr_delta[counter] = count;
-}
-
-static void pmevcntr_op_finish(CPUARMState *env, uint8_t counter)
-{
-    if (pmu_counter_enabled(env, counter)) {
-#ifndef CONFIG_USER_ONLY
-        uint16_t event = env->cp15.c14_pmevtyper[counter] & PMXEVTYPER_EVTCOUNT;
-        uint16_t event_idx = supported_event_map[event];
-        uint64_t delta = -(env->cp15.c14_pmevcntr[counter] + 1);
-        int64_t overflow_in;
-
-        if (!pmevcntr_is_64_bit(env, counter)) {
-            delta = (uint32_t)delta;
-        }
-        overflow_in = pm_events[event_idx].ns_per_count(delta);
-
-        if (overflow_in > 0) {
-            int64_t overflow_at;
-
-            if (!sadd64_overflow(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL),
-                                 overflow_in, &overflow_at)) {
-                ARMCPU *cpu = env_archcpu(env);
-                timer_mod_anticipate_ns(cpu->pmu_timer, overflow_at);
-            }
-        }
-#endif
-
-        env->cp15.c14_pmevcntr_delta[counter] -=
-            env->cp15.c14_pmevcntr[counter];
-    }
-}
-
-void pmu_op_start(CPUARMState *env)
-{
-    unsigned int i;
-    pmccntr_op_start(env);
-    for (i = 0; i < pmu_num_counters(env); i++) {
-        pmevcntr_op_start(env, i);
-    }
-}
-
-void pmu_op_finish(CPUARMState *env)
-{
-    unsigned int i;
-    pmccntr_op_finish(env);
-    for (i = 0; i < pmu_num_counters(env); i++) {
-        pmevcntr_op_finish(env, i);
-    }
-}
-
-void pmu_pre_el_change(ARMCPU *cpu, void *ignored)
-{
-    pmu_op_start(&cpu->env);
-}
-
-void pmu_post_el_change(ARMCPU *cpu, void *ignored)
-{
-    pmu_op_finish(&cpu->env);
-}
-
-void arm_pmu_timer_cb(void *opaque)
-{
-    ARMCPU *cpu = opaque;
-
-    /*
-     * Update all the counter values based on the current underlying counts,
-     * triggering interrupts to be raised, if necessary. pmu_op_finish() also
-     * has the effect of setting the cpu->pmu_timer to the next earliest time a
-     * counter may expire.
-     */
-    pmu_op_start(&cpu->env);
-    pmu_op_finish(&cpu->env);
-}
-
-static void pmcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
-                       uint64_t value)
-{
-    pmu_op_start(env);
-
-    if (value & PMCRC) {
-        /* The counter has been reset */
-        env->cp15.c15_ccnt = 0;
-    }
-
-    if (value & PMCRP) {
-        unsigned int i;
-        for (i = 0; i < pmu_num_counters(env); i++) {
-            env->cp15.c14_pmevcntr[i] = 0;
-        }
-    }
-
-    env->cp15.c9_pmcr &= ~PMCR_WRITABLE_MASK;
-    env->cp15.c9_pmcr |= (value & PMCR_WRITABLE_MASK);
-
-    pmu_op_finish(env);
-}
-
-static uint64_t pmcr_read(CPUARMState *env, const ARMCPRegInfo *ri)
-{
-    uint64_t pmcr = env->cp15.c9_pmcr;
-
-    /*
-     * If EL2 is implemented and enabled for the current security state, reads
-     * of PMCR.N from EL1 or EL0 return the value of MDCR_EL2.HPMN or HDCR.HPMN.
-     */
-    if (arm_current_el(env) <= 1 && arm_is_el2_enabled(env)) {
-        pmcr &= ~PMCRN_MASK;
-        pmcr |= (env->cp15.mdcr_el2 & MDCR_HPMN) << PMCRN_SHIFT;
-    }
-
-    return pmcr;
-}
-
-static void pmswinc_write(CPUARMState *env, const ARMCPRegInfo *ri,
-                          uint64_t value)
-{
-    unsigned int i;
-    uint64_t overflow_mask, new_pmswinc;
-
-    for (i = 0; i < pmu_num_counters(env); i++) {
-        /* Increment a counter's count iff: */
-        if ((value & (1 << i)) && /* counter's bit is set */
-                /* counter is enabled and not filtered */
-                pmu_counter_enabled(env, i) &&
-                /* counter is SW_INCR */
-                (env->cp15.c14_pmevtyper[i] & PMXEVTYPER_EVTCOUNT) == 0x0) {
-            pmevcntr_op_start(env, i);
-
-            /*
-             * Detect if this write causes an overflow since we can't predict
-             * PMSWINC overflows like we can for other events
-             */
-            new_pmswinc = env->cp15.c14_pmevcntr[i] + 1;
-
-            overflow_mask = pmevcntr_is_64_bit(env, i) ?
-                1ULL << 63 : 1ULL << 31;
-
-            if (env->cp15.c14_pmevcntr[i] & ~new_pmswinc & overflow_mask) {
-                env->cp15.c9_pmovsr |= (1 << i);
-                pmu_update_irq(env);
-            }
-
-            env->cp15.c14_pmevcntr[i] = new_pmswinc;
-
-            pmevcntr_op_finish(env, i);
-        }
-    }
-}
-
-static uint64_t pmccntr_read(CPUARMState *env, const ARMCPRegInfo *ri)
-{
-    uint64_t ret;
-    pmccntr_op_start(env);
-    ret = env->cp15.c15_ccnt;
-    pmccntr_op_finish(env);
-    return ret;
-}
-
-static void pmselr_write(CPUARMState *env, const ARMCPRegInfo *ri,
-                         uint64_t value)
-{
-    /*
-     * The value of PMSELR.SEL affects the behavior of PMXEVTYPER and
-     * PMXEVCNTR. We allow [0..31] to be written to PMSELR here; in the
-     * meanwhile, we check PMSELR.SEL when PMXEVTYPER and PMXEVCNTR are
-     * accessed.
-     */
-    env->cp15.c9_pmselr = value & 0x1f;
-}
-
-static void pmccntr_write(CPUARMState *env, const ARMCPRegInfo *ri,
-                        uint64_t value)
-{
-    pmccntr_op_start(env);
-    env->cp15.c15_ccnt = value;
-    pmccntr_op_finish(env);
-}
-
-static void pmccntr_write32(CPUARMState *env, const ARMCPRegInfo *ri,
-                            uint64_t value)
-{
-    uint64_t cur_val = pmccntr_read(env, NULL);
-
-    pmccntr_write(env, ri, deposit64(cur_val, 0, 32, value));
-}
-
-static void pmccfiltr_write(CPUARMState *env, const ARMCPRegInfo *ri,
-                            uint64_t value)
-{
-    pmccntr_op_start(env);
-    env->cp15.pmccfiltr_el0 = value & PMCCFILTR_EL0;
-    pmccntr_op_finish(env);
-}
-
-static void pmccfiltr_write_a32(CPUARMState *env, const ARMCPRegInfo *ri,
-                            uint64_t value)
-{
-    pmccntr_op_start(env);
-    /* M is not accessible from AArch32 */
-    env->cp15.pmccfiltr_el0 = (env->cp15.pmccfiltr_el0 & PMCCFILTR_M) |
-        (value & PMCCFILTR);
-    pmccntr_op_finish(env);
-}
-
-static uint64_t pmccfiltr_read_a32(CPUARMState *env, const ARMCPRegInfo *ri)
-{
-    /* M is not visible in AArch32 */
-    return env->cp15.pmccfiltr_el0 & PMCCFILTR;
-}
-
-static void pmcntenset_write(CPUARMState *env, const ARMCPRegInfo *ri,
-                            uint64_t value)
-{
-    pmu_op_start(env);
-    value &= pmu_counter_mask(env);
-    env->cp15.c9_pmcnten |= value;
-    pmu_op_finish(env);
-}
-
-static void pmcntenclr_write(CPUARMState *env, const ARMCPRegInfo *ri,
-                             uint64_t value)
-{
-    pmu_op_start(env);
-    value &= pmu_counter_mask(env);
-    env->cp15.c9_pmcnten &= ~value;
-    pmu_op_finish(env);
-}
-
-static void pmovsr_write(CPUARMState *env, const ARMCPRegInfo *ri,
-                         uint64_t value)
-{
-    value &= pmu_counter_mask(env);
-    env->cp15.c9_pmovsr &= ~value;
-    pmu_update_irq(env);
-}
-
-static void pmovsset_write(CPUARMState *env, const ARMCPRegInfo *ri,
-                         uint64_t value)
-{
-    value &= pmu_counter_mask(env);
-    env->cp15.c9_pmovsr |= value;
-    pmu_update_irq(env);
-}
-
-static void pmevtyper_write(CPUARMState *env, const ARMCPRegInfo *ri,
-                             uint64_t value, const uint8_t counter)
-{
-    if (counter == 31) {
-        pmccfiltr_write(env, ri, value);
-    } else if (counter < pmu_num_counters(env)) {
-        pmevcntr_op_start(env, counter);
-
-        /*
-         * If this counter's event type is changing, store the current
-         * underlying count for the new type in c14_pmevcntr_delta[counter] so
-         * pmevcntr_op_finish has the correct baseline when it converts back to
-         * a delta.
-         */
-        uint16_t old_event = env->cp15.c14_pmevtyper[counter] &
-            PMXEVTYPER_EVTCOUNT;
-        uint16_t new_event = value & PMXEVTYPER_EVTCOUNT;
-        if (old_event != new_event) {
-            uint64_t count = 0;
-            if (event_supported(new_event)) {
-                uint16_t event_idx = supported_event_map[new_event];
-                count = pm_events[event_idx].get_count(env);
-            }
-            env->cp15.c14_pmevcntr_delta[counter] = count;
-        }
-
-        env->cp15.c14_pmevtyper[counter] = value & PMXEVTYPER_MASK;
-        pmevcntr_op_finish(env, counter);
-    }
-    /*
-     * Attempts to access PMXEVTYPER are CONSTRAINED UNPREDICTABLE when
-     * PMSELR value is equal to or greater than the number of implemented
-     * counters, but not equal to 0x1f. We opt to behave as a RAZ/WI.
-     */
-}
-
-static uint64_t pmevtyper_read(CPUARMState *env, const ARMCPRegInfo *ri,
-                               const uint8_t counter)
-{
-    if (counter == 31) {
-        return env->cp15.pmccfiltr_el0;
-    } else if (counter < pmu_num_counters(env)) {
-        return env->cp15.c14_pmevtyper[counter];
-    } else {
-      /*
-       * We opt to behave as a RAZ/WI when attempts to access PMXEVTYPER
-       * are CONSTRAINED UNPREDICTABLE. See comments in pmevtyper_write().
-       */
-        return 0;
-    }
-}
-
-static void pmevtyper_writefn(CPUARMState *env, const ARMCPRegInfo *ri,
-                              uint64_t value)
-{
-    uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7);
-    pmevtyper_write(env, ri, value, counter);
-}
-
-static void pmevtyper_rawwrite(CPUARMState *env, const ARMCPRegInfo *ri,
-                               uint64_t value)
-{
-    uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7);
-    env->cp15.c14_pmevtyper[counter] = value;
-
-    /*
-     * pmevtyper_rawwrite is called between a pair of pmu_op_start and
-     * pmu_op_finish calls when loading saved state for a migration. Because
-     * we're potentially updating the type of event here, the value written to
-     * c14_pmevcntr_delta by the preceding pmu_op_start call may be for a
-     * different counter type. Therefore, we need to set this value to the
-     * current count for the counter type we're writing so that pmu_op_finish
-     * has the correct count for its calculation.
-     */
-    uint16_t event = value & PMXEVTYPER_EVTCOUNT;
-    if (event_supported(event)) {
-        uint16_t event_idx = supported_event_map[event];
-        env->cp15.c14_pmevcntr_delta[counter] =
-            pm_events[event_idx].get_count(env);
-    }
-}
-
-static uint64_t pmevtyper_readfn(CPUARMState *env, const ARMCPRegInfo *ri)
-{
-    uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7);
-    return pmevtyper_read(env, ri, counter);
-}
-
-static void pmxevtyper_write(CPUARMState *env, const ARMCPRegInfo *ri,
-                             uint64_t value)
-{
-    pmevtyper_write(env, ri, value, env->cp15.c9_pmselr & 31);
-}
-
-static uint64_t pmxevtyper_read(CPUARMState *env, const ARMCPRegInfo *ri)
-{
-    return pmevtyper_read(env, ri, env->cp15.c9_pmselr & 31);
-}
-
-static void pmevcntr_write(CPUARMState *env, const ARMCPRegInfo *ri,
-                             uint64_t value, uint8_t counter)
-{
-    if (!cpu_isar_feature(any_pmuv3p5, env_archcpu(env))) {
-        /* Before FEAT_PMUv3p5, top 32 bits of event counters are RES0 */
-        value &= MAKE_64BIT_MASK(0, 32);
-    }
-    if (counter < pmu_num_counters(env)) {
-        pmevcntr_op_start(env, counter);
-        env->cp15.c14_pmevcntr[counter] = value;
-        pmevcntr_op_finish(env, counter);
-    }
-    /*
-     * We opt to behave as a RAZ/WI when attempts to access PM[X]EVCNTR
-     * are CONSTRAINED UNPREDICTABLE.
-     */
-}
-
-static uint64_t pmevcntr_read(CPUARMState *env, const ARMCPRegInfo *ri,
-                              uint8_t counter)
-{
-    if (counter < pmu_num_counters(env)) {
-        uint64_t ret;
-        pmevcntr_op_start(env, counter);
-        ret = env->cp15.c14_pmevcntr[counter];
-        pmevcntr_op_finish(env, counter);
-        if (!cpu_isar_feature(any_pmuv3p5, env_archcpu(env))) {
-            /* Before FEAT_PMUv3p5, top 32 bits of event counters are RES0 */
-            ret &= MAKE_64BIT_MASK(0, 32);
-        }
-        return ret;
-    } else {
-      /*
-       * We opt to behave as a RAZ/WI when attempts to access PM[X]EVCNTR
-       * are CONSTRAINED UNPREDICTABLE.
-       */
-        return 0;
-    }
-}
-
-static void pmevcntr_writefn(CPUARMState *env, const ARMCPRegInfo *ri,
-                             uint64_t value)
-{
-    uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7);
-    pmevcntr_write(env, ri, value, counter);
-}
-
-static uint64_t pmevcntr_readfn(CPUARMState *env, const ARMCPRegInfo *ri)
-{
-    uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7);
-    return pmevcntr_read(env, ri, counter);
-}
-
-static void pmevcntr_rawwrite(CPUARMState *env, const ARMCPRegInfo *ri,
-                             uint64_t value)
-{
-    uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7);
-    assert(counter < pmu_num_counters(env));
-    env->cp15.c14_pmevcntr[counter] = value;
-    pmevcntr_write(env, ri, value, counter);
-}
-
-static uint64_t pmevcntr_rawread(CPUARMState *env, const ARMCPRegInfo *ri)
-{
-    uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7);
-    assert(counter < pmu_num_counters(env));
-    return env->cp15.c14_pmevcntr[counter];
-}
-
-static void pmxevcntr_write(CPUARMState *env, const ARMCPRegInfo *ri,
-                             uint64_t value)
-{
-    pmevcntr_write(env, ri, value, env->cp15.c9_pmselr & 31);
-}
-
-static uint64_t pmxevcntr_read(CPUARMState *env, const ARMCPRegInfo *ri)
-{
-    return pmevcntr_read(env, ri, env->cp15.c9_pmselr & 31);
-}
-
-static void pmuserenr_write(CPUARMState *env, const ARMCPRegInfo *ri,
-                            uint64_t value)
-{
-    if (arm_feature(env, ARM_FEATURE_V8)) {
-        env->cp15.c9_pmuserenr = value & 0xf;
-    } else {
-        env->cp15.c9_pmuserenr = value & 1;
-    }
-}
-
-static void pmintenset_write(CPUARMState *env, const ARMCPRegInfo *ri,
-                             uint64_t value)
-{
-    /* We have no event counters so only the C bit can be changed */
-    value &= pmu_counter_mask(env);
-    env->cp15.c9_pminten |= value;
-    pmu_update_irq(env);
-}
-
-static void pmintenclr_write(CPUARMState *env, const ARMCPRegInfo *ri,
-                             uint64_t value)
-{
-    value &= pmu_counter_mask(env);
-    env->cp15.c9_pminten &= ~value;
-    pmu_update_irq(env);
-}
-
 static void vbar_write(CPUARMState *env, const ARMCPRegInfo *ri,
                        uint64_t value)
 {
@@ -1874,171 +898,6 @@ static const ARMCPRegInfo v7_cp_reginfo[] = {
     /* the old v6 WFI, UNPREDICTABLE in v7 but we choose to NOP */
     { .name = "NOP", .cp = 15, .crn = 7, .crm = 0, .opc1 = 0, .opc2 = 4,
       .access = PL1_W, .type = ARM_CP_NOP },
-    /*
-     * Performance monitors are implementation defined in v7,
-     * but with an ARM recommended set of registers, which we
-     * follow.
-     *
-     * Performance registers fall into three categories:
-     *  (a) always UNDEF in PL0, RW in PL1 (PMINTENSET, PMINTENCLR)
-     *  (b) RO in PL0 (ie UNDEF on write), RW in PL1 (PMUSERENR)
-     *  (c) UNDEF in PL0 if PMUSERENR.EN==0, otherwise accessible (all others)
-     * For the cases controlled by PMUSERENR we must set .access to PL0_RW
-     * or PL0_RO as appropriate and then check PMUSERENR in the helper fn.
-     */
-    { .name = "PMCNTENSET", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 1,
-      .access = PL0_RW, .type = ARM_CP_ALIAS | ARM_CP_IO,
-      .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmcnten),
-      .writefn = pmcntenset_write,
-      .accessfn = pmreg_access,
-      .fgt = FGT_PMCNTEN,
-      .raw_writefn = raw_write },
-    { .name = "PMCNTENSET_EL0", .state = ARM_CP_STATE_AA64, .type = ARM_CP_IO,
-      .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 1,
-      .access = PL0_RW, .accessfn = pmreg_access,
-      .fgt = FGT_PMCNTEN,
-      .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcnten), .resetvalue = 0,
-      .writefn = pmcntenset_write, .raw_writefn = raw_write },
-    { .name = "PMCNTENCLR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 2,
-      .access = PL0_RW,
-      .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmcnten),
-      .accessfn = pmreg_access,
-      .fgt = FGT_PMCNTEN,
-      .writefn = pmcntenclr_write, .raw_writefn = raw_write,
-      .type = ARM_CP_ALIAS | ARM_CP_IO },
-    { .name = "PMCNTENCLR_EL0", .state = ARM_CP_STATE_AA64,
-      .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 2,
-      .access = PL0_RW, .accessfn = pmreg_access,
-      .fgt = FGT_PMCNTEN,
-      .type = ARM_CP_ALIAS | ARM_CP_IO,
-      .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcnten),
-      .writefn = pmcntenclr_write, .raw_writefn = raw_write },
-    { .name = "PMOVSR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 3,
-      .access = PL0_RW, .type = ARM_CP_IO,
-      .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmovsr),
-      .accessfn = pmreg_access,
-      .fgt = FGT_PMOVS,
-      .writefn = pmovsr_write,
-      .raw_writefn = raw_write },
-    { .name = "PMOVSCLR_EL0", .state = ARM_CP_STATE_AA64,
-      .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 3,
-      .access = PL0_RW, .accessfn = pmreg_access,
-      .fgt = FGT_PMOVS,
-      .type = ARM_CP_ALIAS | ARM_CP_IO,
-      .fieldoffset = offsetof(CPUARMState, cp15.c9_pmovsr),
-      .writefn = pmovsr_write,
-      .raw_writefn = raw_write },
-    { .name = "PMSWINC", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 4,
-      .access = PL0_W, .accessfn = pmreg_access_swinc,
-      .fgt = FGT_PMSWINC_EL0,
-      .type = ARM_CP_NO_RAW | ARM_CP_IO,
-      .writefn = pmswinc_write },
-    { .name = "PMSWINC_EL0", .state = ARM_CP_STATE_AA64,
-      .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 4,
-      .access = PL0_W, .accessfn = pmreg_access_swinc,
-      .fgt = FGT_PMSWINC_EL0,
-      .type = ARM_CP_NO_RAW | ARM_CP_IO,
-      .writefn = pmswinc_write },
-    { .name = "PMSELR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 5,
-      .access = PL0_RW, .type = ARM_CP_ALIAS,
-      .fgt = FGT_PMSELR_EL0,
-      .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmselr),
-      .accessfn = pmreg_access_selr, .writefn = pmselr_write,
-      .raw_writefn = raw_write},
-    { .name = "PMSELR_EL0", .state = ARM_CP_STATE_AA64,
-      .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 5,
-      .access = PL0_RW, .accessfn = pmreg_access_selr,
-      .fgt = FGT_PMSELR_EL0,
-      .fieldoffset = offsetof(CPUARMState, cp15.c9_pmselr),
-      .writefn = pmselr_write, .raw_writefn = raw_write, },
-    { .name = "PMCCNTR", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 0,
-      .access = PL0_RW, .resetvalue = 0, .type = ARM_CP_ALIAS | ARM_CP_IO,
-      .fgt = FGT_PMCCNTR_EL0,
-      .readfn = pmccntr_read, .writefn = pmccntr_write32,
-      .accessfn = pmreg_access_ccntr },
-    { .name = "PMCCNTR_EL0", .state = ARM_CP_STATE_AA64,
-      .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 13, .opc2 = 0,
-      .access = PL0_RW, .accessfn = pmreg_access_ccntr,
-      .fgt = FGT_PMCCNTR_EL0,
-      .type = ARM_CP_IO,
-      .fieldoffset = offsetof(CPUARMState, cp15.c15_ccnt),
-      .readfn = pmccntr_read, .writefn = pmccntr_write,
-      .raw_readfn = raw_read, .raw_writefn = raw_write, },
-    { .name = "PMCCFILTR", .cp = 15, .opc1 = 0, .crn = 14, .crm = 15, .opc2 = 7,
-      .writefn = pmccfiltr_write_a32, .readfn = pmccfiltr_read_a32,
-      .access = PL0_RW, .accessfn = pmreg_access,
-      .fgt = FGT_PMCCFILTR_EL0,
-      .type = ARM_CP_ALIAS | ARM_CP_IO,
-      .resetvalue = 0, },
-    { .name = "PMCCFILTR_EL0", .state = ARM_CP_STATE_AA64,
-      .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 15, .opc2 = 7,
-      .writefn = pmccfiltr_write, .raw_writefn = raw_write,
-      .access = PL0_RW, .accessfn = pmreg_access,
-      .fgt = FGT_PMCCFILTR_EL0,
-      .type = ARM_CP_IO,
-      .fieldoffset = offsetof(CPUARMState, cp15.pmccfiltr_el0),
-      .resetvalue = 0, },
-    { .name = "PMXEVTYPER", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 1,
-      .access = PL0_RW, .type = ARM_CP_NO_RAW | ARM_CP_IO,
-      .accessfn = pmreg_access,
-      .fgt = FGT_PMEVTYPERN_EL0,
-      .writefn = pmxevtyper_write, .readfn = pmxevtyper_read },
-    { .name = "PMXEVTYPER_EL0", .state = ARM_CP_STATE_AA64,
-      .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 13, .opc2 = 1,
-      .access = PL0_RW, .type = ARM_CP_NO_RAW | ARM_CP_IO,
-      .accessfn = pmreg_access,
-      .fgt = FGT_PMEVTYPERN_EL0,
-      .writefn = pmxevtyper_write, .readfn = pmxevtyper_read },
-    { .name = "PMXEVCNTR", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 2,
-      .access = PL0_RW, .type = ARM_CP_NO_RAW | ARM_CP_IO,
-      .accessfn = pmreg_access_xevcntr,
-      .fgt = FGT_PMEVCNTRN_EL0,
-      .writefn = pmxevcntr_write, .readfn = pmxevcntr_read },
-    { .name = "PMXEVCNTR_EL0", .state = ARM_CP_STATE_AA64,
-      .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 13, .opc2 = 2,
-      .access = PL0_RW, .type = ARM_CP_NO_RAW | ARM_CP_IO,
-      .accessfn = pmreg_access_xevcntr,
-      .fgt = FGT_PMEVCNTRN_EL0,
-      .writefn = pmxevcntr_write, .readfn = pmxevcntr_read },
-    { .name = "PMUSERENR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 0,
-      .access = PL0_R | PL1_RW, .accessfn = access_tpm,
-      .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmuserenr),
-      .resetvalue = 0,
-      .writefn = pmuserenr_write, .raw_writefn = raw_write },
-    { .name = "PMUSERENR_EL0", .state = ARM_CP_STATE_AA64,
-      .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 14, .opc2 = 0,
-      .access = PL0_R | PL1_RW, .accessfn = access_tpm, .type = ARM_CP_ALIAS,
-      .fieldoffset = offsetof(CPUARMState, cp15.c9_pmuserenr),
-      .resetvalue = 0,
-      .writefn = pmuserenr_write, .raw_writefn = raw_write },
-    { .name = "PMINTENSET", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 1,
-      .access = PL1_RW, .accessfn = access_tpm,
-      .fgt = FGT_PMINTEN,
-      .type = ARM_CP_ALIAS | ARM_CP_IO,
-      .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pminten),
-      .resetvalue = 0,
-      .writefn = pmintenset_write, .raw_writefn = raw_write },
-    { .name = "PMINTENSET_EL1", .state = ARM_CP_STATE_AA64,
-      .opc0 = 3, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 1,
-      .access = PL1_RW, .accessfn = access_tpm,
-      .fgt = FGT_PMINTEN,
-      .type = ARM_CP_IO,
-      .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
-      .writefn = pmintenset_write, .raw_writefn = raw_write,
-      .resetvalue = 0x0 },
-    { .name = "PMINTENCLR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 2,
-      .access = PL1_RW, .accessfn = access_tpm,
-      .fgt = FGT_PMINTEN,
-      .type = ARM_CP_ALIAS | ARM_CP_IO,
-      .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
-      .writefn = pmintenclr_write, .raw_writefn = raw_write },
-    { .name = "PMINTENCLR_EL1", .state = ARM_CP_STATE_AA64,
-      .opc0 = 3, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 2,
-      .access = PL1_RW, .accessfn = access_tpm,
-      .fgt = FGT_PMINTEN,
-      .type = ARM_CP_ALIAS | ARM_CP_IO,
-      .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
-      .writefn = pmintenclr_write, .raw_writefn = raw_write },
     { .name = "CCSIDR", .state = ARM_CP_STATE_BOTH,
       .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = 0,
       .access = PL1_R,
@@ -2121,25 +980,6 @@ static const ARMCPRegInfo v7_cp_reginfo[] = {
       .type = ARM_CP_NO_RAW, .access = PL1_R, .readfn = isr_read },
 };
 
-static const ARMCPRegInfo pmovsset_cp_reginfo[] = {
-    /* PMOVSSET is not implemented in v7 before v7ve */
-    { .name = "PMOVSSET", .cp = 15, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 3,
-      .access = PL0_RW, .accessfn = pmreg_access,
-      .fgt = FGT_PMOVS,
-      .type = ARM_CP_ALIAS | ARM_CP_IO,
-      .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmovsr),
-      .writefn = pmovsset_write,
-      .raw_writefn = raw_write },
-    { .name = "PMOVSSET_EL0", .state = ARM_CP_STATE_AA64,
-      .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 14, .opc2 = 3,
-      .access = PL0_RW, .accessfn = pmreg_access,
-      .fgt = FGT_PMOVS,
-      .type = ARM_CP_ALIAS | ARM_CP_IO,
-      .fieldoffset = offsetof(CPUARMState, cp15.c9_pmovsr),
-      .writefn = pmovsset_write,
-      .raw_writefn = raw_write },
-};
-
 static void teecr_write(CPUARMState *env, const ARMCPRegInfo *ri,
                         uint64_t value)
 {
@@ -6356,105 +5196,6 @@ static const ARMCPRegInfo nmi_reginfo[] = {
       .resetfn = arm_cp_reset_ignore },
 };
 
-static void define_pmu_regs(ARMCPU *cpu)
-{
-    /*
-     * v7 performance monitor control register: same implementor
-     * field as main ID register, and we implement four counters in
-     * addition to the cycle count register.
-     */
-    unsigned int i, pmcrn = pmu_num_counters(&cpu->env);
-    ARMCPRegInfo pmcr = {
-        .name = "PMCR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 0,
-        .access = PL0_RW,
-        .fgt = FGT_PMCR_EL0,
-        .type = ARM_CP_IO | ARM_CP_ALIAS,
-        .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmcr),
-        .accessfn = pmreg_access,
-        .readfn = pmcr_read, .raw_readfn = raw_read,
-        .writefn = pmcr_write, .raw_writefn = raw_write,
-    };
-    ARMCPRegInfo pmcr64 = {
-        .name = "PMCR_EL0", .state = ARM_CP_STATE_AA64,
-        .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 0,
-        .access = PL0_RW, .accessfn = pmreg_access,
-        .fgt = FGT_PMCR_EL0,
-        .type = ARM_CP_IO,
-        .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcr),
-        .resetvalue = cpu->isar.reset_pmcr_el0,
-        .readfn = pmcr_read, .raw_readfn = raw_read,
-        .writefn = pmcr_write, .raw_writefn = raw_write,
-    };
-
-    define_one_arm_cp_reg(cpu, &pmcr);
-    define_one_arm_cp_reg(cpu, &pmcr64);
-    for (i = 0; i < pmcrn; i++) {
-        char *pmevcntr_name = g_strdup_printf("PMEVCNTR%d", i);
-        char *pmevcntr_el0_name = g_strdup_printf("PMEVCNTR%d_EL0", i);
-        char *pmevtyper_name = g_strdup_printf("PMEVTYPER%d", i);
-        char *pmevtyper_el0_name = g_strdup_printf("PMEVTYPER%d_EL0", i);
-        ARMCPRegInfo pmev_regs[] = {
-            { .name = pmevcntr_name, .cp = 15, .crn = 14,
-              .crm = 8 | (3 & (i >> 3)), .opc1 = 0, .opc2 = i & 7,
-              .access = PL0_RW, .type = ARM_CP_IO | ARM_CP_ALIAS,
-              .fgt = FGT_PMEVCNTRN_EL0,
-              .readfn = pmevcntr_readfn, .writefn = pmevcntr_writefn,
-              .accessfn = pmreg_access_xevcntr },
-            { .name = pmevcntr_el0_name, .state = ARM_CP_STATE_AA64,
-              .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 8 | (3 & (i >> 3)),
-              .opc2 = i & 7, .access = PL0_RW, .accessfn = pmreg_access_xevcntr,
-              .type = ARM_CP_IO,
-              .fgt = FGT_PMEVCNTRN_EL0,
-              .readfn = pmevcntr_readfn, .writefn = pmevcntr_writefn,
-              .raw_readfn = pmevcntr_rawread,
-              .raw_writefn = pmevcntr_rawwrite },
-            { .name = pmevtyper_name, .cp = 15, .crn = 14,
-              .crm = 12 | (3 & (i >> 3)), .opc1 = 0, .opc2 = i & 7,
-              .access = PL0_RW, .type = ARM_CP_IO | ARM_CP_ALIAS,
-              .fgt = FGT_PMEVTYPERN_EL0,
-              .readfn = pmevtyper_readfn, .writefn = pmevtyper_writefn,
-              .accessfn = pmreg_access },
-            { .name = pmevtyper_el0_name, .state = ARM_CP_STATE_AA64,
-              .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 12 | (3 & (i >> 3)),
-              .opc2 = i & 7, .access = PL0_RW, .accessfn = pmreg_access,
-              .fgt = FGT_PMEVTYPERN_EL0,
-              .type = ARM_CP_IO,
-              .readfn = pmevtyper_readfn, .writefn = pmevtyper_writefn,
-              .raw_writefn = pmevtyper_rawwrite },
-        };
-        define_arm_cp_regs(cpu, pmev_regs);
-        g_free(pmevcntr_name);
-        g_free(pmevcntr_el0_name);
-        g_free(pmevtyper_name);
-        g_free(pmevtyper_el0_name);
-    }
-    if (cpu_isar_feature(aa32_pmuv3p1, cpu)) {
-        ARMCPRegInfo v81_pmu_regs[] = {
-            { .name = "PMCEID2", .state = ARM_CP_STATE_AA32,
-              .cp = 15, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 4,
-              .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST,
-              .fgt = FGT_PMCEIDN_EL0,
-              .resetvalue = extract64(cpu->pmceid0, 32, 32) },
-            { .name = "PMCEID3", .state = ARM_CP_STATE_AA32,
-              .cp = 15, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 5,
-              .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST,
-              .fgt = FGT_PMCEIDN_EL0,
-              .resetvalue = extract64(cpu->pmceid1, 32, 32) },
-        };
-        define_arm_cp_regs(cpu, v81_pmu_regs);
-    }
-    if (cpu_isar_feature(any_pmuv3p4, cpu)) {
-        static const ARMCPRegInfo v84_pmmir = {
-            .name = "PMMIR_EL1", .state = ARM_CP_STATE_BOTH,
-            .opc0 = 3, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 6,
-            .access = PL1_R, .accessfn = pmreg_access, .type = ARM_CP_CONST,
-            .fgt = FGT_PMMIR_EL1,
-            .resetvalue = 0
-        };
-        define_one_arm_cp_reg(cpu, &v84_pmmir);
-    }
-}
-
 #ifndef CONFIG_USER_ONLY
 /*
  * We don't know until after realize whether there's a GICv3
@@ -7385,9 +6126,6 @@ void register_cp_regs_for_features(ARMCPU *cpu)
     if (arm_feature(env, ARM_FEATURE_V6K)) {
         define_arm_cp_regs(cpu, v6k_cp_reginfo);
     }
-    if (arm_feature(env, ARM_FEATURE_V7VE)) {
-        define_arm_cp_regs(cpu, pmovsset_cp_reginfo);
-    }
     if (arm_feature(env, ARM_FEATURE_V7)) {
         ARMCPRegInfo clidr = {
             .name = "CLIDR", .state = ARM_CP_STATE_BOTH,
@@ -7400,7 +6138,6 @@ void register_cp_regs_for_features(ARMCPU *cpu)
         define_one_arm_cp_reg(cpu, &clidr);
         define_arm_cp_regs(cpu, v7_cp_reginfo);
         define_debug_regs(cpu);
-        define_pmu_regs(cpu);
     } else {
         define_arm_cp_regs(cpu, not_v7_cp_reginfo);
     }
@@ -7656,26 +6393,6 @@ void register_cp_regs_for_features(ARMCPU *cpu)
               .access = PL1_R, .type = ARM_CP_CONST,
               .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
-            { .name = "PMCEID0", .state = ARM_CP_STATE_AA32,
-              .cp = 15, .opc1 = 0, .crn = 9, .crm = 12, .opc2 = 6,
-              .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST,
-              .fgt = FGT_PMCEIDN_EL0,
-              .resetvalue = extract64(cpu->pmceid0, 0, 32) },
-            { .name = "PMCEID0_EL0", .state = ARM_CP_STATE_AA64,
-              .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 6,
-              .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST,
-              .fgt = FGT_PMCEIDN_EL0,
-              .resetvalue = cpu->pmceid0 },
-            { .name = "PMCEID1", .state = ARM_CP_STATE_AA32,
-              .cp = 15, .opc1 = 0, .crn = 9, .crm = 12, .opc2 = 7,
-              .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST,
-              .fgt = FGT_PMCEIDN_EL0,
-              .resetvalue = extract64(cpu->pmceid1, 0, 32) },
-            { .name = "PMCEID1_EL0", .state = ARM_CP_STATE_AA64,
-              .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 7,
-              .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST,
-              .fgt = FGT_PMCEIDN_EL0,
-              .resetvalue = cpu->pmceid1 },
         };
 #ifdef CONFIG_USER_ONLY
         static const ARMCPRegUserSpaceInfo v8_user_idregs[] = {
@@ -8514,6 +7231,8 @@ void register_cp_regs_for_features(ARMCPU *cpu)
         define_arm_cp_regs(cpu, ccsidr2_reginfo);
     }
 
+    define_pm_cpregs(cpu);
+
 #ifndef CONFIG_USER_ONLY
     /*
      * Register redirections and aliases must be done last,
diff --git a/target/arm/internals.h b/target/arm/internals.h
index bcaf8965fc..c4765e4489 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -1873,6 +1873,8 @@ void define_debug_regs(ARMCPU *cpu);
 void define_tlb_insn_regs(ARMCPU *cpu);
 /* Add the cpreg definitions for AT instructions */
 void define_at_insn_regs(ARMCPU *cpu);
+/* Add the cpreg definitions for PM cpregs */
+void define_pm_cpregs(ARMCPU *cpu);
 
 /* Effective value of MDCR_EL2 */
 static inline uint64_t arm_mdcr_el2_eff(CPUARMState *env)
diff --git a/target/arm/meson.build b/target/arm/meson.build
index 7aa81e30ab..07d9271aa4 100644
--- a/target/arm/meson.build
+++ b/target/arm/meson.build
@@ -22,6 +22,7 @@ arm_user_ss.add(when: 'TARGET_AARCH64', if_false: files(
   'cpu32-stubs.c',
 ))
 arm_user_ss.add(files(
+  'cpregs-pmu.c',
   'debug_helper.c',
   'helper.c',
   'vfp_fpscr.c',
@@ -36,6 +37,7 @@ arm_common_system_ss.add(files(
   'arch_dump.c',
   'arm-powerctl.c',
   'cortex-regs.c',
+  'cpregs-pmu.c',
   'debug_helper.c',
   'helper.c',
   'machine.c',

From c563cd7e61d074f58eef413322144461dd243716 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Fri, 4 Jul 2025 17:56:36 +0100
Subject: [PATCH 2079/2760] target/arm: Don't enforce NSE,NS check for EL3->EL3
 returns

In the Arm ARM, rule R_TYTWB that defines illegal exception return cases
includes the case:
 If FEAT_RME is implemented, then if SCR_EL3.{NSE, NS} is {1, 0}, an
 exception return from EL3 to a lower Exception level

Our implementation of this check fails to check that the
return is to a lower exception level, so it will incorrectly fire on
EL3->EL3 exception returns.

Fix the check condition. This requires us to move it further
down in the function to a point where we know the new_el value.

Fixes: 35aa6715ddcd9 ("target/arm: Catch illegal-exception-return from EL3 with bad NSE/NS")
Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3016
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250704165636.261888-1-peter.maydell@linaro.org
---
 target/arm/tcg/helper-a64.c | 20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/target/arm/tcg/helper-a64.c b/target/arm/tcg/helper-a64.c
index c66d521278..71c6c44ee8 100644
--- a/target/arm/tcg/helper-a64.c
+++ b/target/arm/tcg/helper-a64.c
@@ -658,15 +658,6 @@ void HELPER(exception_return)(CPUARMState *env, uint64_t new_pc)
         spsr &= ~PSTATE_SS;
     }
 
-    /*
-     * FEAT_RME forbids return from EL3 with an invalid security state.
-     * We don't need an explicit check for FEAT_RME here because we enforce
-     * in scr_write() that you can't set the NSE bit without it.
-     */
-    if (cur_el == 3 && (env->cp15.scr_el3 & (SCR_NS | SCR_NSE)) == SCR_NSE) {
-        goto illegal_return;
-    }
-
     new_el = el_from_spsr(spsr);
     if (new_el == -1) {
         goto illegal_return;
@@ -678,6 +669,17 @@ void HELPER(exception_return)(CPUARMState *env, uint64_t new_pc)
         goto illegal_return;
     }
 
+    /*
+     * FEAT_RME forbids return from EL3 to a lower exception level
+     * with an invalid security state.
+     * We don't need an explicit check for FEAT_RME here because we enforce
+     * in scr_write() that you can't set the NSE bit without it.
+     */
+    if (cur_el == 3 && new_el < 3 &&
+        (env->cp15.scr_el3 & (SCR_NS | SCR_NSE)) == SCR_NSE) {
+        goto illegal_return;
+    }
+
     if (new_el != 0 && arm_el_is_aa64(env, new_el) != return_to_aa64) {
         /* Return to an EL which is configured for a different register width */
         goto illegal_return;

From 930180f3b9a292639eb894f1ca846683834ed4b7 Mon Sep 17 00:00:00 2001
From: Bernhard Beschow <shentey@gmail.com>
Date: Sun, 29 Jun 2025 22:48:50 +0200
Subject: [PATCH 2080/2760] hw/arm/fsl-imx8mp: Wire VIRQ and VFIQ
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Allows to run KVM guests inside the imx8mp-evk machine.

Fixes: a4eefc69b237 ("hw/arm: Add i.MX 8M Plus EVK board")
CC: qemu-stable
Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/fsl-imx8mp.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/hw/arm/fsl-imx8mp.c b/hw/arm/fsl-imx8mp.c
index 23e662c16c..866f4d1d74 100644
--- a/hw/arm/fsl-imx8mp.c
+++ b/hw/arm/fsl-imx8mp.c
@@ -356,6 +356,10 @@ static void fsl_imx8mp_realize(DeviceState *dev, Error **errp)
                                qdev_get_gpio_in(cpudev, ARM_CPU_IRQ));
             sysbus_connect_irq(gicsbd, i + ms->smp.cpus,
                                qdev_get_gpio_in(cpudev, ARM_CPU_FIQ));
+            sysbus_connect_irq(gicsbd, i + 2 * ms->smp.cpus,
+                               qdev_get_gpio_in(cpudev, ARM_CPU_VIRQ));
+            sysbus_connect_irq(gicsbd, i + 3 * ms->smp.cpus,
+                               qdev_get_gpio_in(cpudev, ARM_CPU_VFIQ));
         }
     }
 

From 66ba6d1367d7e81d705430ff611af01280953992 Mon Sep 17 00:00:00 2001
From: Haibo Xu <haibo.xu@linaro.org>
Date: Mon, 7 Jul 2025 18:40:27 +0200
Subject: [PATCH 2081/2760] hw/arm: Allow setting KVM vGIC maintenance IRQ

Allow virt arm machine to set the interrupt ID for the KVM
GIC maintenance interrupt.

This setting must be done before the KVM_DEV_ARM_VGIC_CTRL_INIT
hence the choice to perform the setting in the GICv3 realize
instead of proceeding the same way as kvm_arm_pmu_set_irq().

Signed-off-by: Haibo Xu <haibo.xu@linaro.org>
Signed-off-by: Miguel Luis <miguel.luis@oracle.com>
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Message-id: 20250707164129.1167837-2-eric.auger@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c                      |  3 +++
 hw/intc/arm_gicv3_common.c         |  1 +
 hw/intc/arm_gicv3_kvm.c            | 21 +++++++++++++++++++++
 include/hw/intc/arm_gicv3_common.h |  1 +
 4 files changed, 26 insertions(+)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index 394e8b5301..c9f3991937 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -833,6 +833,9 @@ static void create_gic(VirtMachineState *vms, MemoryRegion *mem)
                                          OBJECT(mem), &error_fatal);
                 qdev_prop_set_bit(vms->gic, "has-lpi", true);
             }
+        } else if (vms->virt) {
+            qdev_prop_set_uint32(vms->gic, "maintenance-interrupt-id",
+                                 ARCH_GIC_MAINT_IRQ);
         }
     } else {
         if (!kvm_irqchip_in_kernel()) {
diff --git a/hw/intc/arm_gicv3_common.c b/hw/intc/arm_gicv3_common.c
index 1cee68193c..e438d8c042 100644
--- a/hw/intc/arm_gicv3_common.c
+++ b/hw/intc/arm_gicv3_common.c
@@ -612,6 +612,7 @@ static const Property arm_gicv3_common_properties[] = {
     DEFINE_PROP_BOOL("has-lpi", GICv3State, lpi_enable, 0),
     DEFINE_PROP_BOOL("has-nmi", GICv3State, nmi_support, 0),
     DEFINE_PROP_BOOL("has-security-extensions", GICv3State, security_extn, 0),
+    DEFINE_PROP_UINT32("maintenance-interrupt-id", GICv3State, maint_irq, 0),
     /*
      * Compatibility property: force 8 bits of physical priority, even
      * if the CPU being emulated should have fewer.
diff --git a/hw/intc/arm_gicv3_kvm.c b/hw/intc/arm_gicv3_kvm.c
index 3be3bf6c28..b30aac7aee 100644
--- a/hw/intc/arm_gicv3_kvm.c
+++ b/hw/intc/arm_gicv3_kvm.c
@@ -22,6 +22,7 @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "hw/intc/arm_gicv3_common.h"
+#include "hw/arm/virt.h"
 #include "qemu/error-report.h"
 #include "qemu/module.h"
 #include "system/kvm.h"
@@ -825,6 +826,26 @@ static void kvm_arm_gicv3_realize(DeviceState *dev, Error **errp)
         return;
     }
 
+    if (s->maint_irq) {
+        int ret;
+
+        ret = kvm_device_check_attr(s->dev_fd,
+                                    KVM_DEV_ARM_VGIC_GRP_MAINT_IRQ, 0);
+        if (!ret) {
+            error_setg_errno(errp, errno,
+                             "VGICv3 setting maintenance IRQ is not "
+                             "supported by this host kernel");
+            return;
+        }
+
+        ret = kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_MAINT_IRQ, 0,
+                                &s->maint_irq, true, errp);
+        if (ret) {
+            error_setg_errno(errp, errno, "Failed to set VGIC maintenance IRQ");
+            return;
+       }
+    }
+
     multiple_redist_region_allowed =
         kvm_device_check_attr(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ADDR,
                               KVM_VGIC_V3_ADDR_TYPE_REDIST_REGION);
diff --git a/include/hw/intc/arm_gicv3_common.h b/include/hw/intc/arm_gicv3_common.h
index a3d6a0e507..c18503869f 100644
--- a/include/hw/intc/arm_gicv3_common.h
+++ b/include/hw/intc/arm_gicv3_common.h
@@ -231,6 +231,7 @@ struct GICv3State {
     uint32_t num_cpu;
     uint32_t num_irq;
     uint32_t revision;
+    uint32_t maint_irq;
     bool lpi_enable;
     bool nmi_support;
     bool security_extn;

From 776aac5653cd9b072c735fcd65a3e58bd59370f4 Mon Sep 17 00:00:00 2001
From: Haibo Xu <haibo.xu@linaro.org>
Date: Mon, 7 Jul 2025 18:40:28 +0200
Subject: [PATCH 2082/2760] target/arm/kvm: Add helper to detect EL2 when using
 KVM
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Introduce query support for KVM_CAP_ARM_EL2.

Signed-off-by: Haibo Xu <haibo.xu@linaro.org>
Signed-off-by: Miguel Luis <miguel.luis@oracle.com>
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250707164129.1167837-3-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/kvm-stub.c | 5 +++++
 target/arm/kvm.c      | 5 +++++
 target/arm/kvm_arm.h  | 7 +++++++
 3 files changed, 17 insertions(+)

diff --git a/target/arm/kvm-stub.c b/target/arm/kvm-stub.c
index 34e57fab01..c93462c5b9 100644
--- a/target/arm/kvm-stub.c
+++ b/target/arm/kvm-stub.c
@@ -47,6 +47,11 @@ bool kvm_arm_mte_supported(void)
     return false;
 }
 
+bool kvm_arm_el2_supported(void)
+{
+    return false;
+}
+
 /*
  * These functions should never actually be called without KVM support.
  */
diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index 8ab0d692d3..9fdf354f3b 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -1763,6 +1763,11 @@ bool kvm_arm_aarch32_supported(void)
     return kvm_check_extension(kvm_state, KVM_CAP_ARM_EL1_32BIT);
 }
 
+bool kvm_arm_el2_supported(void)
+{
+    return kvm_check_extension(kvm_state, KVM_CAP_ARM_EL2);
+}
+
 bool kvm_arm_sve_supported(void)
 {
     return kvm_check_extension(kvm_state, KVM_CAP_ARM_SVE);
diff --git a/target/arm/kvm_arm.h b/target/arm/kvm_arm.h
index 7dc83caed5..b4cad05155 100644
--- a/target/arm/kvm_arm.h
+++ b/target/arm/kvm_arm.h
@@ -191,6 +191,13 @@ bool kvm_arm_sve_supported(void);
  */
 bool kvm_arm_mte_supported(void);
 
+/**
+ * kvm_arm_el2_supported:
+ *
+ * Returns true if KVM can enable EL2 and false otherwise.
+ */
+bool kvm_arm_el2_supported(void);
+
 /**
  * kvm_arm_get_max_vm_ipa_size:
  * @ms: Machine state handle

From 4ee1efc9871936e2561212e409ad094c2ae83cad Mon Sep 17 00:00:00 2001
From: Haibo Xu <haibo.xu@linaro.org>
Date: Mon, 7 Jul 2025 18:40:29 +0200
Subject: [PATCH 2083/2760] target/arm: Enable feature ARM_FEATURE_EL2 if EL2
 is supported

KVM_CAP_ARM_EL2 must be supported by the cpu to enable ARM_FEATURE_EL2.
In case the host does support NV, expose the feature.

Signed-off-by: Haibo Xu <haibo.xu@linaro.org>
Signed-off-by: Miguel Luis <miguel.luis@oracle.com>
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250707164129.1167837-4-eric.auger@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/kvm.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index 9fdf354f3b..6672344855 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -251,6 +251,7 @@ static bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
      */
     int fdarray[3];
     bool sve_supported;
+    bool el2_supported;
     bool pmu_supported = false;
     uint64_t features = 0;
     int err;
@@ -270,6 +271,14 @@ static bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
         init.features[0] |= 1 << KVM_ARM_VCPU_SVE;
     }
 
+    /*
+     * Ask for EL2 if supported.
+     */
+    el2_supported = kvm_arm_el2_supported();
+    if (el2_supported) {
+        init.features[0] |= 1 << KVM_ARM_VCPU_HAS_EL2;
+    }
+
     /*
      * Ask for Pointer Authentication if supported, so that we get
      * the unsanitized field values for AA64ISAR1_EL1.
@@ -423,6 +432,10 @@ static bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
     features |= 1ULL << ARM_FEATURE_AARCH64;
     features |= 1ULL << ARM_FEATURE_GENERIC_TIMER;
 
+    if (el2_supported) {
+        features |= 1ULL << ARM_FEATURE_EL2;
+    }
+
     ahcf->features = features;
 
     return true;
@@ -1888,6 +1901,9 @@ int kvm_arch_init_vcpu(CPUState *cs)
         cpu->kvm_init_features[0] |= (1 << KVM_ARM_VCPU_PTRAUTH_ADDRESS |
                                       1 << KVM_ARM_VCPU_PTRAUTH_GENERIC);
     }
+    if (cpu->has_el2 && kvm_arm_el2_supported()) {
+        cpu->kvm_init_features[0] |= 1 << KVM_ARM_VCPU_HAS_EL2;
+    }
 
     /* Do KVM_ARM_VCPU_INIT ioctl */
     ret = kvm_arm_vcpu_init(cpu);

From f36032440f5dd7ceb90833dd44600363b1472757 Mon Sep 17 00:00:00 2001
From: Eric Auger <eric.auger@redhat.com>
Date: Mon, 7 Jul 2025 18:40:30 +0200
Subject: [PATCH 2084/2760] hw/arm/arm_gicv3_kvm: Add a migration blocker with
 kvm nested virt

We may be miss some NV related GIC register save/restore. Until
we complete the study, let's add a migration blocker when the
maintenance IRQ is set.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Message-id: 20250707164129.1167837-5-eric.auger@redhat.com
Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/intc/arm_gicv3_kvm.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/hw/intc/arm_gicv3_kvm.c b/hw/intc/arm_gicv3_kvm.c
index b30aac7aee..8ed88e7429 100644
--- a/hw/intc/arm_gicv3_kvm.c
+++ b/hw/intc/arm_gicv3_kvm.c
@@ -827,8 +827,16 @@ static void kvm_arm_gicv3_realize(DeviceState *dev, Error **errp)
     }
 
     if (s->maint_irq) {
+        Error *kvm_nv_migration_blocker = NULL;
         int ret;
 
+        error_setg(&kvm_nv_migration_blocker,
+                   "Live migration disabled because KVM nested virt is enabled");
+        if (migrate_add_blocker(&kvm_nv_migration_blocker, errp)) {
+            error_free(kvm_nv_migration_blocker);
+            return;
+        }
+
         ret = kvm_device_check_attr(s->dev_fd,
                                     KVM_DEV_ARM_VGIC_GRP_MAINT_IRQ, 0);
         if (!ret) {

From 851dcb8355cb3c37fbbf8cc99ae5fac4871d1a44 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Thu, 10 Jul 2025 11:39:33 +0100
Subject: [PATCH 2085/2760] hw/arm/virt: Allow virt extensions with KVM

Up to now virt support on guest has been only supported with TCG.
Now it becomes feasible to use it with KVM acceleration.

Check neither in-kernel GICv3 nor aarch64=off is used along with KVM
EL2.

Signed-off-by: Haibo Xu <haibo.xu@linaro.org>
Signed-off-by: Miguel Luis <miguel.luis@oracle.com>
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250707164129.1167837-6-eric.auger@redhat.com
[PMM: make "kernel doesn't have EL2 support" error message
 distinct from the old "QEMU doesn't have KVM EL2 support" one]
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index c9f3991937..8070ff7b11 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -797,6 +797,13 @@ static void create_gic(VirtMachineState *vms, MemoryRegion *mem)
     default:
         g_assert_not_reached();
     }
+
+    if (kvm_enabled() && vms->virt &&
+        (revision != 3 || !kvm_irqchip_in_kernel())) {
+        error_report("KVM EL2 is only supported with in-kernel GICv3");
+        exit(1);
+    }
+
     vms->gic = qdev_new(gictype);
     qdev_prop_set_uint32(vms->gic, "revision", revision);
     qdev_prop_set_uint32(vms->gic, "num-cpu", smp_cpus);
@@ -2092,6 +2099,10 @@ static void virt_post_cpus_gic_realized(VirtMachineState *vms,
             memory_region_init_ram(pvtime, NULL, "pvtime", pvtime_size, NULL);
             memory_region_add_subregion(sysmem, pvtime_reg_base, pvtime);
         }
+        if (!aarch64 && vms->virt) {
+            error_report("KVM does not support EL2 on an AArch32 vCPU");
+            exit(1);
+        }
 
         CPU_FOREACH(cpu) {
             if (pmu) {
@@ -2237,7 +2248,13 @@ static void machvirt_init(MachineState *machine)
         exit(1);
     }
 
-    if (vms->virt && !tcg_enabled() && !qtest_enabled()) {
+    if (vms->virt && kvm_enabled() && !kvm_arm_el2_supported()) {
+        error_report("mach-virt: host kernel KVM does not support providing "
+                     "Virtualization extensions to the guest CPU");
+        exit(1);
+    }
+
+    if (vms->virt && !kvm_enabled() && !tcg_enabled() && !qtest_enabled()) {
         error_report("mach-virt: %s does not support providing "
                      "Virtualization extensions to the guest CPU",
                      current_accel_name());

From 677bb509bfbe5f94bb15a62d8490cbad89aa9b94 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 10 Feb 2025 13:10:45 +0100
Subject: [PATCH 2086/2760] system/qdev: Remove pointless NULL check in
 qdev_device_add_from_qdict
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Coverity reported a unnecessary NULL check:

  qemu/system/qdev-monitor.c: 720 in qdev_device_add_from_qdict()
  683     /* create device */
  684     dev = qdev_new(driver);
  ...
  719     err_del_dev:
  >>>     CID 1590192:  Null pointer dereferences  (REVERSE_INULL)
  >>>     Null-checking "dev" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
  720         if (dev) {
  721             object_unparent(OBJECT(dev));
  722             object_unref(OBJECT(dev));
  723         }
  724         return NULL;
  725     }

Indeed, unlike qdev_try_new() which can return NULL,
qdev_new() always returns a heap pointer (or aborts).

Remove the unnecessary assignment and check.

Fixes: f3a85056569 ("qdev/qbus: add hidden device support")
Resolves: Coverity CID 1590192 (Null pointer dereferences)
Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 system/qdev-monitor.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/system/qdev-monitor.c b/system/qdev-monitor.c
index 5588ed2047..2ac92d0a07 100644
--- a/system/qdev-monitor.c
+++ b/system/qdev-monitor.c
@@ -628,7 +628,7 @@ DeviceState *qdev_device_add_from_qdict(const QDict *opts,
     DeviceClass *dc;
     const char *driver, *path;
     char *id;
-    DeviceState *dev = NULL;
+    DeviceState *dev;
     BusState *bus = NULL;
     QDict *properties;
 
@@ -717,10 +717,9 @@ DeviceState *qdev_device_add_from_qdict(const QDict *opts,
     return dev;
 
 err_del_dev:
-    if (dev) {
-        object_unparent(OBJECT(dev));
-        object_unref(OBJECT(dev));
-    }
+    object_unparent(OBJECT(dev));
+    object_unref(OBJECT(dev));
+
     return NULL;
 }
 

From 47a4f6a900e1d0764cb973b7140f471859de4128 Mon Sep 17 00:00:00 2001
From: Shameer Kolothum <shameerali.kolothum.thodi@huawei.com>
Date: Tue, 8 Jul 2025 16:40:44 +0100
Subject: [PATCH 2087/2760] hw/arm/virt-acpi-build: Don't create ITS id
 mappings by default

Commit d6afe18b7242 ("hw/arm/virt-acpi-build: Fix ACPI IORT and MADT tables
when its=off") moved ITS group node generation under the its=on condition.
However, it still creates rc_its_idmaps unconditionally, which results in
duplicate ID mappings in the IORT table.

Fixes:d6afe18b7242 ("hw/arm/virt-acpi-build: Fix ACPI IORT and MADT tables when its=off")
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Donald Dutile <ddutile@redhat.com>
Tested-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Shameer Kolothum <shameerali.kolothum.thodi@huawei.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt-acpi-build.c | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
index c3b9b3f6ea..0dfb8ec2c3 100644
--- a/hw/arm/virt-acpi-build.c
+++ b/hw/arm/virt-acpi-build.c
@@ -358,12 +358,6 @@ build_iort(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
         /* Sort the smmu idmap by input_base */
         g_array_sort(rc_smmu_idmaps, iort_idmap_compare);
 
-        /*
-         * Knowing the ID ranges from the RC to the SMMU, it's possible to
-         * determine the ID ranges from RC that are directed to the ITS.
-         */
-        create_rc_its_idmaps(rc_its_idmaps, rc_smmu_idmaps);
-
         nb_nodes = 2; /* RC and SMMUv3 */
         rc_mapping_count = rc_smmu_idmaps->len;
 

From bffbb430ee045c616dfe13ad4fd44823f18e6b21 Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Mon, 23 Jun 2025 15:34:36 +0800
Subject: [PATCH 2088/2760] rust/qemu-api: Fix binding path in source directory

The build.rs had supported placing bindings.inc.rs in rust/qemu-api/src,
but this "not encouraged" feature is broken.

Considering that manually copying bindings.inc.rs to the development
directory is also useful, fix the bindings.inc.rs path generation to
give this feature another chance.

Fixes: commit 1ae4ca0463d7 ("rust: move rust.bindgen to qemu-api crate")
Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250623073436.1833357-1-zhao1.liu@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/qemu-api/build.rs | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/rust/qemu-api/build.rs b/rust/qemu-api/build.rs
index 7849486c1b..29d0945625 100644
--- a/rust/qemu-api/build.rs
+++ b/rust/qemu-api/build.rs
@@ -9,12 +9,14 @@ use std::os::windows::fs::symlink_file;
 use std::{env, fs::remove_file, io::Result, path::Path};
 
 fn main() -> Result<()> {
-    // Placing bindings.inc.rs in the source directory is supported
-    // but not documented or encouraged.
-    let path = env::var("MESON_BUILD_ROOT")
-        .unwrap_or_else(|_| format!("{}/src", env!("CARGO_MANIFEST_DIR")));
+    let file = if let Ok(root) = env::var("MESON_BUILD_ROOT") {
+        format!("{root}/rust/qemu-api/bindings.inc.rs")
+    } else {
+        // Placing bindings.inc.rs in the source directory is supported
+        // but not documented or encouraged.
+        format!("{}/src/bindings.inc.rs", env!("CARGO_MANIFEST_DIR"))
+    };
 
-    let file = format!("{path}/rust/qemu-api/bindings.inc.rs");
     let file = Path::new(&file);
     if !Path::new(&file).exists() {
         panic!(concat!(

From caa08d30f240c07f2b6fd08c6ffb9ae28d187f09 Mon Sep 17 00:00:00 2001
From: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Date: Thu, 3 Jul 2025 16:33:43 +0300
Subject: [PATCH 2089/2760] rust/qemu-api-macros: use syn::Error directly

Our MacroError type wraps syn::Error as a variant, and uses another
variant for custom errors. Fortunately syn::Error can be used directly,
avoiding extra code on our side, so change the proc macro crate to use
it.

Signed-off-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Link: https://lore.kernel.org/r/20250703-rust_macros-v1-1-b99f82febbbf@linaro.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 docs/devel/rust.rst               | 11 ++--
 rust/qemu-api-macros/src/bits.rs  | 58 ++++++++-------------
 rust/qemu-api-macros/src/lib.rs   | 86 +++++++++++++++----------------
 rust/qemu-api-macros/src/utils.rs | 26 ----------
 4 files changed, 70 insertions(+), 111 deletions(-)
 delete mode 100644 rust/qemu-api-macros/src/utils.rs

diff --git a/docs/devel/rust.rst b/docs/devel/rust.rst
index dc8c44109e..b6737536c6 100644
--- a/docs/devel/rust.rst
+++ b/docs/devel/rust.rst
@@ -351,7 +351,7 @@ Writing procedural macros
 '''''''''''''''''''''''''
 
 By conventions, procedural macros are split in two functions, one
-returning ``Result<proc_macro2::TokenStream, MacroError>`` with the body of
+returning ``Result<proc_macro2::TokenStream, syn::Error>`` with the body of
 the procedural macro, and the second returning ``proc_macro::TokenStream``
 which is the actual procedural macro.  The former's name is the same as
 the latter with the ``_or_error`` suffix.  The code for the latter is more
@@ -361,18 +361,19 @@ from the type after ``as`` in the invocation of ``parse_macro_input!``::
     #[proc_macro_derive(Object)]
     pub fn derive_object(input: TokenStream) -> TokenStream {
         let input = parse_macro_input!(input as DeriveInput);
-        let expanded = derive_object_or_error(input).unwrap_or_else(Into::into);
 
-        TokenStream::from(expanded)
+        derive_object_or_error(input)
+            .unwrap_or_else(syn::Error::into_compile_error)
+            .into()
     }
 
 The ``qemu_api_macros`` crate has utility functions to examine a
 ``DeriveInput`` and perform common checks (e.g. looking for a struct
-with named fields).  These functions return ``Result<..., MacroError>``
+with named fields).  These functions return ``Result<..., syn::Error>``
 and can be used easily in the procedural macro function::
 
     fn derive_object_or_error(input: DeriveInput) ->
-        Result<proc_macro2::TokenStream, MacroError>
+        Result<proc_macro2::TokenStream, Error>
     {
         is_c_repr(&input, "#[derive(Object)]")?;
 
diff --git a/rust/qemu-api-macros/src/bits.rs b/rust/qemu-api-macros/src/bits.rs
index 5ba84757ee..a80a3b9fee 100644
--- a/rust/qemu-api-macros/src/bits.rs
+++ b/rust/qemu-api-macros/src/bits.rs
@@ -6,8 +6,7 @@
 use proc_macro2::{
     Delimiter, Group, Ident, Punct, Spacing, Span, TokenStream, TokenTree, TokenTree as TT,
 };
-
-use crate::utils::MacroError;
+use syn::Error;
 
 pub struct BitsConstInternal {
     typ: TokenTree,
@@ -36,27 +35,21 @@ impl BitsConstInternal {
         tok: TokenTree,
         it: &mut dyn Iterator<Item = TokenTree>,
         out: &mut TokenStream,
-    ) -> Result<Option<TokenTree>, MacroError> {
+    ) -> Result<Option<TokenTree>, Error> {
         let next = match tok {
             TT::Group(ref g) => {
                 if g.delimiter() != Delimiter::Parenthesis && g.delimiter() != Delimiter::None {
-                    return Err(MacroError::Message("expected parenthesis".into(), g.span()));
+                    return Err(Error::new(g.span(), "expected parenthesis"));
                 }
                 let mut stream = g.stream().into_iter();
                 let Some(first_tok) = stream.next() else {
-                    return Err(MacroError::Message(
-                        "expected operand, found ')'".into(),
-                        g.span(),
-                    ));
+                    return Err(Error::new(g.span(), "expected operand, found ')'"));
                 };
                 let mut output = TokenStream::new();
                 // start from the lowest precedence
                 let next = self.parse_or(first_tok, &mut stream, &mut output)?;
                 if let Some(tok) = next {
-                    return Err(MacroError::Message(
-                        format!("unexpected token {tok}"),
-                        tok.span(),
-                    ));
+                    return Err(Error::new(tok.span(), format!("unexpected token {tok}")));
                 }
                 out.extend(Some(paren(output)));
                 it.next()
@@ -74,20 +67,17 @@ impl BitsConstInternal {
             }
             TT::Punct(ref p) => {
                 if p.as_char() != '!' {
-                    return Err(MacroError::Message("expected operand".into(), p.span()));
+                    return Err(Error::new(p.span(), "expected operand"));
                 }
                 let Some(rhs_tok) = it.next() else {
-                    return Err(MacroError::Message(
-                        "expected operand at end of input".into(),
-                        p.span(),
-                    ));
+                    return Err(Error::new(p.span(), "expected operand at end of input"));
                 };
                 let next = self.parse_primary(rhs_tok, it, out)?;
                 out.extend([punct('.'), ident("invert"), paren(TokenStream::new())]);
                 next
             }
             _ => {
-                return Err(MacroError::Message("unexpected literal".into(), tok.span()));
+                return Err(Error::new(tok.span(), "unexpected literal"));
             }
         };
         Ok(next)
@@ -99,7 +89,7 @@ impl BitsConstInternal {
             TokenTree,
             &mut dyn Iterator<Item = TokenTree>,
             &mut TokenStream,
-        ) -> Result<Option<TokenTree>, MacroError>,
+        ) -> Result<Option<TokenTree>, Error>,
     >(
         &self,
         tok: TokenTree,
@@ -108,7 +98,7 @@ impl BitsConstInternal {
         ch: char,
         f: F,
         method: &'static str,
-    ) -> Result<Option<TokenTree>, MacroError> {
+    ) -> Result<Option<TokenTree>, Error> {
         let mut next = f(self, tok, it, out)?;
         while next.is_some() {
             let op = next.as_ref().unwrap();
@@ -118,10 +108,7 @@ impl BitsConstInternal {
             }
 
             let Some(rhs_tok) = it.next() else {
-                return Err(MacroError::Message(
-                    "expected operand at end of input".into(),
-                    p.span(),
-                ));
+                return Err(Error::new(p.span(), "expected operand at end of input"));
             };
             let mut rhs = TokenStream::new();
             next = f(self, rhs_tok, it, &mut rhs)?;
@@ -136,7 +123,7 @@ impl BitsConstInternal {
         tok: TokenTree,
         it: &mut dyn Iterator<Item = TokenTree>,
         out: &mut TokenStream,
-    ) -> Result<Option<TokenTree>, MacroError> {
+    ) -> Result<Option<TokenTree>, Error> {
         self.parse_binop(tok, it, out, '-', Self::parse_primary, "difference")
     }
 
@@ -146,7 +133,7 @@ impl BitsConstInternal {
         tok: TokenTree,
         it: &mut dyn Iterator<Item = TokenTree>,
         out: &mut TokenStream,
-    ) -> Result<Option<TokenTree>, MacroError> {
+    ) -> Result<Option<TokenTree>, Error> {
         self.parse_binop(tok, it, out, '&', Self::parse_sub, "intersection")
     }
 
@@ -156,7 +143,7 @@ impl BitsConstInternal {
         tok: TokenTree,
         it: &mut dyn Iterator<Item = TokenTree>,
         out: &mut TokenStream,
-    ) -> Result<Option<TokenTree>, MacroError> {
+    ) -> Result<Option<TokenTree>, Error> {
         self.parse_binop(tok, it, out, '^', Self::parse_and, "symmetric_difference")
     }
 
@@ -166,13 +153,13 @@ impl BitsConstInternal {
         tok: TokenTree,
         it: &mut dyn Iterator<Item = TokenTree>,
         out: &mut TokenStream,
-    ) -> Result<Option<TokenTree>, MacroError> {
+    ) -> Result<Option<TokenTree>, Error> {
         self.parse_binop(tok, it, out, '|', Self::parse_xor, "union")
     }
 
     pub fn parse(
         it: &mut dyn Iterator<Item = TokenTree>,
-    ) -> Result<proc_macro2::TokenStream, MacroError> {
+    ) -> Result<proc_macro2::TokenStream, Error> {
         let mut pos = Span::call_site();
         let mut typ = proc_macro2::TokenStream::new();
 
@@ -198,15 +185,15 @@ impl BitsConstInternal {
         };
 
         let Some(tok) = next else {
-            return Err(MacroError::Message(
-                "expected expression, do not call this macro directly".into(),
+            return Err(Error::new(
                 pos,
+                "expected expression, do not call this macro directly",
             ));
         };
         let TT::Group(ref _group) = tok else {
-            return Err(MacroError::Message(
-                "expected parenthesis, do not call this macro directly".into(),
+            return Err(Error::new(
                 tok.span(),
+                "expected parenthesis, do not call this macro directly",
             ));
         };
         let mut out = TokenStream::new();
@@ -219,10 +206,7 @@ impl BitsConstInternal {
         // A parenthesized expression is a single production of the grammar,
         // so the input must have reached the last token.
         if let Some(tok) = next {
-            return Err(MacroError::Message(
-                format!("unexpected token {tok}"),
-                tok.span(),
-            ));
+            return Err(Error::new(tok.span(), format!("unexpected token {tok}")));
         }
         Ok(out)
     }
diff --git a/rust/qemu-api-macros/src/lib.rs b/rust/qemu-api-macros/src/lib.rs
index c18bb4e036..2cb79c799a 100644
--- a/rust/qemu-api-macros/src/lib.rs
+++ b/rust/qemu-api-macros/src/lib.rs
@@ -6,83 +6,79 @@ use proc_macro::TokenStream;
 use quote::quote;
 use syn::{
     parse_macro_input, parse_quote, punctuated::Punctuated, spanned::Spanned, token::Comma, Data,
-    DeriveInput, Field, Fields, FieldsUnnamed, Ident, Meta, Path, Token, Variant,
+    DeriveInput, Error, Field, Fields, FieldsUnnamed, Ident, Meta, Path, Token, Variant,
 };
-
-mod utils;
-use utils::MacroError;
-
 mod bits;
 use bits::BitsConstInternal;
 
 fn get_fields<'a>(
     input: &'a DeriveInput,
     msg: &str,
-) -> Result<&'a Punctuated<Field, Comma>, MacroError> {
+) -> Result<&'a Punctuated<Field, Comma>, Error> {
     let Data::Struct(ref s) = &input.data else {
-        return Err(MacroError::Message(
-            format!("Struct required for {msg}"),
+        return Err(Error::new(
             input.ident.span(),
+            format!("Struct required for {msg}"),
         ));
     };
     let Fields::Named(ref fs) = &s.fields else {
-        return Err(MacroError::Message(
-            format!("Named fields required for {msg}"),
+        return Err(Error::new(
             input.ident.span(),
+            format!("Named fields required for {msg}"),
         ));
     };
     Ok(&fs.named)
 }
 
-fn get_unnamed_field<'a>(input: &'a DeriveInput, msg: &str) -> Result<&'a Field, MacroError> {
+fn get_unnamed_field<'a>(input: &'a DeriveInput, msg: &str) -> Result<&'a Field, Error> {
     let Data::Struct(ref s) = &input.data else {
-        return Err(MacroError::Message(
-            format!("Struct required for {msg}"),
+        return Err(Error::new(
             input.ident.span(),
+            format!("Struct required for {msg}"),
         ));
     };
     let Fields::Unnamed(FieldsUnnamed { ref unnamed, .. }) = &s.fields else {
-        return Err(MacroError::Message(
-            format!("Tuple struct required for {msg}"),
+        return Err(Error::new(
             s.fields.span(),
+            format!("Tuple struct required for {msg}"),
         ));
     };
     if unnamed.len() != 1 {
-        return Err(MacroError::Message(
-            format!("A single field is required for {msg}"),
+        return Err(Error::new(
             s.fields.span(),
+            format!("A single field is required for {msg}"),
         ));
     }
     Ok(&unnamed[0])
 }
 
-fn is_c_repr(input: &DeriveInput, msg: &str) -> Result<(), MacroError> {
+fn is_c_repr(input: &DeriveInput, msg: &str) -> Result<(), Error> {
     let expected = parse_quote! { #[repr(C)] };
 
     if input.attrs.iter().any(|attr| attr == &expected) {
         Ok(())
     } else {
-        Err(MacroError::Message(
-            format!("#[repr(C)] required for {msg}"),
+        Err(Error::new(
             input.ident.span(),
+            format!("#[repr(C)] required for {msg}"),
         ))
     }
 }
 
-fn is_transparent_repr(input: &DeriveInput, msg: &str) -> Result<(), MacroError> {
+fn is_transparent_repr(input: &DeriveInput, msg: &str) -> Result<(), Error> {
     let expected = parse_quote! { #[repr(transparent)] };
 
     if input.attrs.iter().any(|attr| attr == &expected) {
         Ok(())
     } else {
-        Err(MacroError::Message(
-            format!("#[repr(transparent)] required for {msg}"),
+        Err(Error::new(
             input.ident.span(),
+            format!("#[repr(transparent)] required for {msg}"),
         ))
     }
 }
 
-fn derive_object_or_error(input: DeriveInput) -> Result<proc_macro2::TokenStream, MacroError> {
+fn derive_object_or_error(input: DeriveInput) -> Result<proc_macro2::TokenStream, Error> {
     is_c_repr(&input, "#[derive(Object)]")?;
 
     let name = &input.ident;
@@ -103,12 +99,13 @@ fn derive_object_or_error(input: DeriveInput) -> Result<proc_macro2::TokenStream
 #[proc_macro_derive(Object)]
 pub fn derive_object(input: TokenStream) -> TokenStream {
     let input = parse_macro_input!(input as DeriveInput);
-    let expanded = derive_object_or_error(input).unwrap_or_else(Into::into);
 
-    TokenStream::from(expanded)
+    derive_object_or_error(input)
+        .unwrap_or_else(syn::Error::into_compile_error)
+        .into()
 }
 
-fn derive_opaque_or_error(input: DeriveInput) -> Result<proc_macro2::TokenStream, MacroError> {
+fn derive_opaque_or_error(input: DeriveInput) -> Result<proc_macro2::TokenStream, Error> {
     is_transparent_repr(&input, "#[derive(Wrapper)]")?;
 
     let name = &input.ident;
@@ -149,13 +146,14 @@ fn derive_opaque_or_error(input: DeriveInput) -> Result<proc_macro2::TokenStream
 #[proc_macro_derive(Wrapper)]
 pub fn derive_opaque(input: TokenStream) -> TokenStream {
     let input = parse_macro_input!(input as DeriveInput);
-    let expanded = derive_opaque_or_error(input).unwrap_or_else(Into::into);
 
-    TokenStream::from(expanded)
+    derive_opaque_or_error(input)
+        .unwrap_or_else(syn::Error::into_compile_error)
+        .into()
 }
 
 #[allow(non_snake_case)]
-fn get_repr_uN(input: &DeriveInput, msg: &str) -> Result<Path, MacroError> {
+fn get_repr_uN(input: &DeriveInput, msg: &str) -> Result<Path, Error> {
     let repr = input.attrs.iter().find(|attr| attr.path().is_ident("repr"));
     if let Some(repr) = repr {
         let nested = repr.parse_args_with(Punctuated::<Meta, Token![,]>::parse_terminated)?;
@@ -170,23 +168,23 @@ fn get_repr_uN(input: &DeriveInput, msg: &str) -> Result<Path, MacroError> {
         }
     }
 
-    Err(MacroError::Message(
-        format!("#[repr(u8/u16/u32/u64) required for {msg}"),
+    Err(Error::new(
         input.ident.span(),
+        format!("#[repr(u8/u16/u32/u64) required for {msg}"),
     ))
 }
 
-fn get_variants(input: &DeriveInput) -> Result<&Punctuated<Variant, Comma>, MacroError> {
+fn get_variants(input: &DeriveInput) -> Result<&Punctuated<Variant, Comma>, Error> {
     let Data::Enum(ref e) = &input.data else {
-        return Err(MacroError::Message(
-            "Cannot derive TryInto for union or struct.".to_string(),
+        return Err(Error::new(
             input.ident.span(),
+            "Cannot derive TryInto for union or struct.",
         ));
     };
     if let Some(v) = e.variants.iter().find(|v| v.fields != Fields::Unit) {
-        return Err(MacroError::Message(
-            "Cannot derive TryInto for enum with non-unit variants.".to_string(),
+        return Err(Error::new(
             v.fields.span(),
+            "Cannot derive TryInto for enum with non-unit variants.",
         ));
     }
     Ok(&e.variants)
@@ -197,7 +195,7 @@ fn derive_tryinto_body(
     name: &Ident,
     variants: &Punctuated<Variant, Comma>,
     repr: &Path,
-) -> Result<proc_macro2::TokenStream, MacroError> {
+) -> Result<proc_macro2::TokenStream, Error> {
     let discriminants: Vec<&Ident> = variants.iter().map(|f| &f.ident).collect();
 
     Ok(quote! {
@@ -210,7 +208,7 @@ fn derive_tryinto_body(
 }
 
 #[rustfmt::skip::macros(quote)]
-fn derive_tryinto_or_error(input: DeriveInput) -> Result<proc_macro2::TokenStream, MacroError> {
+fn derive_tryinto_or_error(input: DeriveInput) -> Result<proc_macro2::TokenStream, Error> {
     let repr = get_repr_uN(&input, "#[derive(TryInto)]")?;
     let name = &input.ident;
     let body = derive_tryinto_body(name, get_variants(&input)?, &repr)?;
@@ -247,9 +245,10 @@ fn derive_tryinto_or_error(input: DeriveInput) -> Result<proc_macro2::TokenStrea
 #[proc_macro_derive(TryInto)]
 pub fn derive_tryinto(input: TokenStream) -> TokenStream {
     let input = parse_macro_input!(input as DeriveInput);
-    let expanded = derive_tryinto_or_error(input).unwrap_or_else(Into::into);
 
-    TokenStream::from(expanded)
+    derive_tryinto_or_error(input)
+        .unwrap_or_else(syn::Error::into_compile_error)
+        .into()
 }
 
 #[proc_macro]
@@ -257,6 +256,7 @@ pub fn bits_const_internal(ts: TokenStream) -> TokenStream {
     let ts = proc_macro2::TokenStream::from(ts);
     let mut it = ts.into_iter();
 
-    let expanded = BitsConstInternal::parse(&mut it).unwrap_or_else(Into::into);
-    TokenStream::from(expanded)
+    BitsConstInternal::parse(&mut it)
+        .unwrap_or_else(syn::Error::into_compile_error)
+        .into()
 }
diff --git a/rust/qemu-api-macros/src/utils.rs b/rust/qemu-api-macros/src/utils.rs
deleted file mode 100644
index 02c91aed7f..0000000000
--- a/rust/qemu-api-macros/src/utils.rs
+++ /dev/null
@@ -1,26 +0,0 @@
-// Procedural macro utilities.
-// Author(s): Paolo Bonzini <pbonzini@redhat.com>
-// SPDX-License-Identifier: GPL-2.0-or-later
-
-use proc_macro2::Span;
-use quote::quote_spanned;
-
-pub enum MacroError {
-    Message(String, Span),
-    ParseError(syn::Error),
-}
-
-impl From<syn::Error> for MacroError {
-    fn from(err: syn::Error) -> Self {
-        MacroError::ParseError(err)
-    }
-}
-
-impl From<MacroError> for proc_macro2::TokenStream {
-    fn from(err: MacroError) -> Self {
-        match err {
-            MacroError::Message(msg, span) => quote_spanned! { span => compile_error!(#msg); },
-            MacroError::ParseError(err) => err.into_compile_error(),
-        }
-    }
-}

From dab63b8a710c2c489276d60d51e21e82b91a92f5 Mon Sep 17 00:00:00 2001
From: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Date: Thu, 3 Jul 2025 17:20:22 +0300
Subject: [PATCH 2090/2760] rust/bindings: allow unnecessary_transmutes (1.88)

This is a new lint introduced in Rust 1.88. It does not affect
compilation when using a previous version or our MSRV, 1.77. But with
1.88 compilation fails because we deny all warnings:

  error: unnecessary transmute
     --> rust/qemu-api/libqemu_api.rlib.p/structured/bindings.inc.rs:729:18
      |
  729 |         unsafe { ::std::mem::transmute(self._bitfield_1.get(0usize, 24u8) as u32) }
      |                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ help: replace this with: `u32::cast_signed(self._bitfield_1.get(0usize, 24u8) as u32)`
      |
      = note: `-D unnecessary-transmutes` implied by `-D warnings`
      = help: to override `-D warnings` add `#[allow(unnecessary_transmutes)]`

Allow this lint, which even though it does not exist in previous
versions, it works because we allow for `unknown_lints` in
rust/Cargo.toml.

Signed-off-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Link: https://lore.kernel.org/r/20250703-rust_bindings_allow_unnecessary_transmutes-v1-1-692ca210d331@linaro.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/qemu-api/src/bindings.rs | 1 +
 1 file changed, 1 insertion(+)

diff --git a/rust/qemu-api/src/bindings.rs b/rust/qemu-api/src/bindings.rs
index 057de4b646..3cdad0f0ec 100644
--- a/rust/qemu-api/src/bindings.rs
+++ b/rust/qemu-api/src/bindings.rs
@@ -6,6 +6,7 @@
     non_camel_case_types,
     non_snake_case,
     non_upper_case_globals,
+    unnecessary_transmutes,
     unsafe_op_in_unsafe_fn,
     clippy::pedantic,
     clippy::restriction,

From c3a08c8dcbe568d9e7f8a66d300a668bcb8673c0 Mon Sep 17 00:00:00 2001
From: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Date: Fri, 4 Jul 2025 13:26:57 +0300
Subject: [PATCH 2091/2760] rust/qemu-api-macros: normalize TryInto output

Remove extraneous `;` and add missing trailing comma to TryInto derive
macro to match rustfmt style. We will add a test in the followup commit
and we would like the inlined output in the test body to be properly
formatted as well.

No functional changes intended.

Signed-off-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250704-rust_add_derive_macro_unit_tests-v1-1-ebd47fa7f78f@linaro.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/qemu-api-macros/src/lib.rs | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/rust/qemu-api-macros/src/lib.rs b/rust/qemu-api-macros/src/lib.rs
index 2cb79c799a..5bbf8c6127 100644
--- a/rust/qemu-api-macros/src/lib.rs
+++ b/rust/qemu-api-macros/src/lib.rs
@@ -199,7 +199,7 @@ fn derive_tryinto_body(
     let discriminants: Vec<&Ident> = variants.iter().map(|f| &f.ident).collect();
 
     Ok(quote! {
-        #(const #discriminants: #repr = #name::#discriminants as #repr;)*;
+        #(const #discriminants: #repr = #name::#discriminants as #repr;)*
         match value {
             #(#discriminants => core::result::Result::Ok(#name::#discriminants),)*
             _ => core::result::Result::Err(value),
@@ -227,7 +227,7 @@ fn derive_tryinto_or_error(input: DeriveInput) -> Result<proc_macro2::TokenStrea
                     #body
                 }) {
                     Ok(x) => x,
-                    Err(_) => panic!(#errmsg)
+                    Err(_) => panic!(#errmsg),
                 }
             }
         }

From a721d9a9f3dd7bb9d6ed81ea1a11a1157755741c Mon Sep 17 00:00:00 2001
From: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Date: Fri, 4 Jul 2025 13:26:58 +0300
Subject: [PATCH 2092/2760] rust/qemu-api-macros: add unit tests

Add unit tests to check Derive macro output for expected error messages,
or for expected correct codegen output.

Signed-off-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250704-rust_add_derive_macro_unit_tests-v1-2-ebd47fa7f78f@linaro.org
[Remove usage of MacroError. - Paolo]
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/qemu-api-macros/meson.build  |   3 +
 rust/qemu-api-macros/src/lib.rs   |   3 +
 rust/qemu-api-macros/src/tests.rs | 137 ++++++++++++++++++++++++++++++
 3 files changed, 143 insertions(+)
 create mode 100644 rust/qemu-api-macros/src/tests.rs

diff --git a/rust/qemu-api-macros/meson.build b/rust/qemu-api-macros/meson.build
index 8610ce1c84..2152bcb99b 100644
--- a/rust/qemu-api-macros/meson.build
+++ b/rust/qemu-api-macros/meson.build
@@ -17,3 +17,6 @@ _qemu_api_macros_rs = rust.proc_macro(
 qemu_api_macros = declare_dependency(
   link_with: _qemu_api_macros_rs,
 )
+
+rust.test('rust-qemu-api-macros-tests', _qemu_api_macros_rs,
+          suite: ['unit', 'rust'])
diff --git a/rust/qemu-api-macros/src/lib.rs b/rust/qemu-api-macros/src/lib.rs
index 5bbf8c6127..b525d89c09 100644
--- a/rust/qemu-api-macros/src/lib.rs
+++ b/rust/qemu-api-macros/src/lib.rs
@@ -11,6 +11,9 @@ use syn::{
 mod bits;
 use bits::BitsConstInternal;
 
+#[cfg(test)]
+mod tests;
+
 fn get_fields<'a>(
     input: &'a DeriveInput,
     msg: &str,
diff --git a/rust/qemu-api-macros/src/tests.rs b/rust/qemu-api-macros/src/tests.rs
new file mode 100644
index 0000000000..d6dcd62fcf
--- /dev/null
+++ b/rust/qemu-api-macros/src/tests.rs
@@ -0,0 +1,137 @@
+// Copyright 2025, Linaro Limited
+// Author(s): Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+use quote::quote;
+
+use super::*;
+
+macro_rules! derive_compile_fail {
+    ($derive_fn:ident, $input:expr, $error_msg:expr) => {{
+        let input: proc_macro2::TokenStream = $input;
+        let error_msg: &str = $error_msg;
+        let derive_fn: fn(input: syn::DeriveInput) -> Result<proc_macro2::TokenStream, syn::Error> =
+            $derive_fn;
+
+        let input: syn::DeriveInput = syn::parse2(input).unwrap();
+        let result = derive_fn(input);
+        let err = result.unwrap_err().into_compile_error();
+        assert_eq!(
+            err.to_string(),
+            quote! { ::core::compile_error! { #error_msg } }.to_string()
+        );
+    }};
+}
+
+macro_rules! derive_compile {
+    ($derive_fn:ident, $input:expr, $($expected:tt)*) => {{
+        let input: proc_macro2::TokenStream = $input;
+        let expected: proc_macro2::TokenStream = $($expected)*;
+        let derive_fn: fn(input: syn::DeriveInput) -> Result<proc_macro2::TokenStream, syn::Error> =
+            $derive_fn;
+
+        let input: syn::DeriveInput = syn::parse2(input).unwrap();
+        let result = derive_fn(input).unwrap();
+        assert_eq!(result.to_string(), expected.to_string());
+    }};
+}
+
+#[test]
+fn test_derive_object() {
+    derive_compile_fail!(
+        derive_object_or_error,
+        quote! {
+            #[derive(Object)]
+            struct Foo {
+                _unused: [u8; 0],
+            }
+        },
+        "#[repr(C)] required for #[derive(Object)]"
+    );
+    derive_compile!(
+        derive_object_or_error,
+        quote! {
+            #[derive(Object)]
+            #[repr(C)]
+            struct Foo {
+                _unused: [u8; 0],
+            }
+        },
+        quote! {
+            ::qemu_api::assert_field_type!(
+                Foo,
+                _unused,
+                ::qemu_api::qom::ParentField<<Foo as ::qemu_api::qom::ObjectImpl>::ParentType>
+            );
+            ::qemu_api::module_init! {
+                MODULE_INIT_QOM => unsafe {
+                    ::qemu_api::bindings::type_register_static(&<Foo as ::qemu_api::qom::ObjectImpl>::TYPE_INFO);
+                }
+            }
+        }
+    );
+}
+
+#[test]
+fn test_derive_tryinto() {
+    derive_compile_fail!(
+        derive_tryinto_or_error,
+        quote! {
+            #[derive(TryInto)]
+            struct Foo {
+                _unused: [u8; 0],
+            }
+        },
+        "#[repr(u8/u16/u32/u64) required for #[derive(TryInto)]"
+    );
+    derive_compile!(
+        derive_tryinto_or_error,
+        quote! {
+            #[derive(TryInto)]
+            #[repr(u8)]
+            enum Foo {
+                First = 0,
+                Second,
+            }
+        },
+        quote! {
+            impl Foo {
+                #[allow(dead_code)]
+                pub const fn into_bits(self) -> u8 {
+                    self as u8
+                }
+
+                #[allow(dead_code)]
+                pub const fn from_bits(value: u8) -> Self {
+                    match ({
+                        const First: u8 = Foo::First as u8;
+                        const Second: u8 = Foo::Second as u8;
+                        match value {
+                            First => core::result::Result::Ok(Foo::First),
+                            Second => core::result::Result::Ok(Foo::Second),
+                            _ => core::result::Result::Err(value),
+                        }
+                    }) {
+                        Ok(x) => x,
+                        Err(_) => panic!("invalid value for Foo"),
+                    }
+                }
+            }
+
+            impl core::convert::TryFrom<u8> for Foo {
+                type Error = u8;
+
+                #[allow(ambiguous_associated_items)]
+                fn try_from(value: u8) -> Result<Self, u8> {
+                    const First: u8 = Foo::First as u8;
+                    const Second: u8 = Foo::Second as u8;
+                    match value {
+                        First => core::result::Result::Ok(Foo::First),
+                        Second => core::result::Result::Ok(Foo::Second),
+                        _ => core::result::Result::Err(value),
+                    }
+                }
+            }
+        }
+    );
+}

From ed7f6da282e263403badb507b2532f51f8ed31cf Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Wed, 11 Jun 2025 10:16:10 +0200
Subject: [PATCH 2093/2760] rust/qemu-api: log: implement io::Write

This makes it possible to lock the log file; it also makes log_mask_ln!
not allocate memory when logging a constant string.

Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 include/qemu/log.h       |  2 +
 rust/qemu-api/src/log.rs | 92 ++++++++++++++++++++++++++++++++++++----
 util/log.c               | 12 ++++++
 3 files changed, 98 insertions(+), 8 deletions(-)

diff --git a/include/qemu/log.h b/include/qemu/log.h
index 60da703e67..aae72985f0 100644
--- a/include/qemu/log.h
+++ b/include/qemu/log.h
@@ -84,6 +84,8 @@ typedef struct QEMULogItem {
 
 extern const QEMULogItem qemu_log_items[];
 
+ssize_t rust_fwrite(const void *ptr, size_t size, size_t nmemb, FILE *stream);
+
 bool qemu_set_log(int log_flags, Error **errp);
 bool qemu_set_log_filename(const char *filename, Error **errp);
 bool qemu_set_log_filename_flags(const char *name, int flags, Error **errp);
diff --git a/rust/qemu-api/src/log.rs b/rust/qemu-api/src/log.rs
index d6c3d6c1b6..a441b8c1f2 100644
--- a/rust/qemu-api/src/log.rs
+++ b/rust/qemu-api/src/log.rs
@@ -3,6 +3,13 @@
 
 //! Bindings for QEMU's logging infrastructure
 
+use std::{
+    io::{self, Write},
+    ptr::NonNull,
+};
+
+use crate::{bindings, errno};
+
 #[repr(u32)]
 /// Represents specific error categories within QEMU's logging system.
 ///
@@ -11,11 +18,82 @@
 pub enum Log {
     /// Log invalid access caused by the guest.
     /// Corresponds to `LOG_GUEST_ERROR` in the C implementation.
-    GuestError = crate::bindings::LOG_GUEST_ERROR,
+    GuestError = bindings::LOG_GUEST_ERROR,
 
     /// Log guest access of unimplemented functionality.
     /// Corresponds to `LOG_UNIMP` in the C implementation.
-    Unimp = crate::bindings::LOG_UNIMP,
+    Unimp = bindings::LOG_UNIMP,
+}
+
+/// A RAII guard for QEMU's logging infrastructure.  Creating the guard
+/// locks the log file, and dropping it (letting it go out of scope) unlocks
+/// the file.
+///
+/// As long as the guard lives, it can be written to using [`std::io::Write`].
+///
+/// The locking is recursive, therefore owning a guard does not prevent
+/// using [`log_mask_ln!()`](crate::log_mask_ln).
+pub struct LogGuard(NonNull<bindings::FILE>);
+
+impl LogGuard {
+    /// Return a RAII guard that writes to QEMU's logging infrastructure.
+    /// The log file is locked while the guard exists, ensuring that there
+    /// is no tearing of the messages.
+    ///
+    /// Return `None` if the log file is closed and could not be opened.
+    /// Do *not* use `unwrap()` on the result; failure can be handled simply
+    /// by not logging anything.
+    ///
+    /// # Examples
+    ///
+    /// ```
+    /// # use qemu_api::log::LogGuard;
+    /// # use std::io::Write;
+    /// if let Some(mut log) = LogGuard::new() {
+    ///     writeln!(log, "test");
+    /// }
+    /// ```
+    pub fn new() -> Option<Self> {
+        let f = unsafe { bindings::qemu_log_trylock() }.cast();
+        NonNull::new(f).map(Self)
+    }
+
+    /// Writes a formatted string into the log, returning any error encountered.
+    ///
+    /// This method is primarily used by the
+    /// [`log_mask_ln!()`](crate::log_mask_ln) macro, and it is rare for it
+    /// to be called explicitly.  It is public because it is the only way to
+    /// examine the error, which `log_mask_ln!()` ignores
+    ///
+    /// Unlike `log_mask_ln!()`, it does *not* append a newline at the end.
+    pub fn log_fmt(args: std::fmt::Arguments) -> io::Result<()> {
+        if let Some(mut log) = Self::new() {
+            log.write_fmt(args)?;
+        }
+        Ok(())
+    }
+}
+
+impl Write for LogGuard {
+    fn write(&mut self, bytes: &[u8]) -> io::Result<usize> {
+        let ret = unsafe {
+            bindings::rust_fwrite(bytes.as_ptr().cast(), 1, bytes.len(), self.0.as_ptr())
+        };
+        errno::into_io_result(ret)
+    }
+
+    fn flush(&mut self) -> io::Result<()> {
+        // Do nothing, dropping the guard takes care of flushing
+        Ok(())
+    }
+}
+
+impl Drop for LogGuard {
+    fn drop(&mut self) {
+        unsafe {
+            bindings::qemu_log_unlock(self.0.as_ptr());
+        }
+    }
 }
 
 /// A macro to log messages conditionally based on a provided mask.
@@ -24,6 +102,8 @@ pub enum Log {
 /// log level and, if so, formats and logs the message. It is the Rust
 /// counterpart of the `qemu_log_mask()` macro in the C implementation.
 ///
+/// Errors from writing to the log are ignored.
+///
 /// # Parameters
 ///
 /// - `$mask`: A log level mask. This should be a variant of the `Log` enum.
@@ -62,12 +142,8 @@ macro_rules! log_mask_ln {
         if unsafe {
             (::qemu_api::bindings::qemu_loglevel & ($mask as std::os::raw::c_int)) != 0
         } {
-            let formatted_string = format!("{}\n", format_args!($fmt $($args)*));
-            let c_string = std::ffi::CString::new(formatted_string).unwrap();
-
-            unsafe {
-                ::qemu_api::bindings::qemu_log(c_string.as_ptr());
-            }
+            _ = ::qemu_api::log::LogGuard::log_fmt(
+                format_args!("{}\n", format_args!($fmt $($args)*)));
         }
     }};
 }
diff --git a/util/log.c b/util/log.c
index b87d399e4c..58d24de48a 100644
--- a/util/log.c
+++ b/util/log.c
@@ -558,3 +558,15 @@ void qemu_print_log_usage(FILE *f)
     fprintf(f, "\nUse \"-d trace:help\" to get a list of trace events.\n\n");
 #endif
 }
+
+#ifdef CONFIG_HAVE_RUST
+ssize_t rust_fwrite(const void *ptr, size_t size, size_t nmemb, FILE *stream)
+{
+    /*
+     * Same as fwrite, but return -errno because Rust libc does not provide
+     * portable access to errno. :(
+     */
+    int ret = fwrite(ptr, size, nmemb, stream);
+    return ret < 0 ? -errno : 0;
+}
+#endif

From abbeb42c1762a529cfbae52845c279b648a7acb4 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 6 May 2025 19:25:54 +0000
Subject: [PATCH 2094/2760] fpu: Process float_muladd_negate_result after
 rounding
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Changing the sign before rounding affects the correctness of
the asymmetric rouding modes: float_round_up and float_round_down.

Reported-by: WANG Rui <wangrui@loongson.cn>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 fpu/softfloat-parts.c.inc           |  4 ---
 fpu/softfloat.c                     | 54 +++++++++++++++++++++++------
 tests/tcg/multiarch/Makefile.target |  1 +
 tests/tcg/multiarch/fnmsub.c        | 37 ++++++++++++++++++++
 4 files changed, 82 insertions(+), 14 deletions(-)
 create mode 100644 tests/tcg/multiarch/fnmsub.c

diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
index 171bfd06e3..5e0438fc0b 100644
--- a/fpu/softfloat-parts.c.inc
+++ b/fpu/softfloat-parts.c.inc
@@ -708,10 +708,6 @@ static FloatPartsN *partsN(muladd_scalbn)(FloatPartsN *a, FloatPartsN *b,
  return_normal:
     a->exp += scale;
  finish_sign:
-    if (flags & float_muladd_negate_result) {
-        a->sign ^= 1;
-    }
-
     /*
      * All result types except for "return the default NaN
      * because this is an Invalid Operation" go through here;
diff --git a/fpu/softfloat.c b/fpu/softfloat.c
index 34c962d6bd..8094358c2e 100644
--- a/fpu/softfloat.c
+++ b/fpu/softfloat.c
@@ -1731,11 +1731,8 @@ static float64 float64_round_pack_canonical(FloatParts64 *p,
     return float64_pack_raw(p);
 }
 
-static float64 float64r32_round_pack_canonical(FloatParts64 *p,
-                                               float_status *s)
+static float64 float64r32_pack_raw(FloatParts64 *p)
 {
-    parts_uncanon(p, s, &float32_params);
-
     /*
      * In parts_uncanon, we placed the fraction for float32 at the lsb.
      * We need to adjust the fraction higher so that the least N bits are
@@ -1776,6 +1773,13 @@ static float64 float64r32_round_pack_canonical(FloatParts64 *p,
     return float64_pack_raw(p);
 }
 
+static float64 float64r32_round_pack_canonical(FloatParts64 *p,
+                                               float_status *s)
+{
+    parts_uncanon(p, s, &float32_params);
+    return float64r32_pack_raw(p);
+}
+
 static void float128_unpack_canonical(FloatParts128 *p, float128 f,
                                       float_status *s)
 {
@@ -2240,7 +2244,12 @@ float16_muladd_scalbn(float16 a, float16 b, float16 c,
     float16_unpack_canonical(&pc, c, status);
     pr = parts_muladd_scalbn(&pa, &pb, &pc, scale, flags, status);
 
-    return float16_round_pack_canonical(pr, status);
+    /* Round before applying negate result. */
+    parts_uncanon(pr, status, &float16_params);
+    if ((flags & float_muladd_negate_result) && !is_nan(pr->cls)) {
+        pr->sign ^= 1;
+    }
+    return float16_pack_raw(pr);
 }
 
 float16 float16_muladd(float16 a, float16 b, float16 c,
@@ -2260,7 +2269,12 @@ float32_muladd_scalbn(float32 a, float32 b, float32 c,
     float32_unpack_canonical(&pc, c, status);
     pr = parts_muladd_scalbn(&pa, &pb, &pc, scale, flags, status);
 
-    return float32_round_pack_canonical(pr, status);
+    /* Round before applying negate result. */
+    parts_uncanon(pr, status, &float32_params);
+    if ((flags & float_muladd_negate_result) && !is_nan(pr->cls)) {
+        pr->sign ^= 1;
+    }
+    return float32_pack_raw(pr);
 }
 
 float64 QEMU_SOFTFLOAT_ATTR
@@ -2274,7 +2288,12 @@ float64_muladd_scalbn(float64 a, float64 b, float64 c,
     float64_unpack_canonical(&pc, c, status);
     pr = parts_muladd_scalbn(&pa, &pb, &pc, scale, flags, status);
 
-    return float64_round_pack_canonical(pr, status);
+    /* Round before applying negate result. */
+    parts_uncanon(pr, status, &float64_params);
+    if ((flags & float_muladd_negate_result) && !is_nan(pr->cls)) {
+        pr->sign ^= 1;
+    }
+    return float64_pack_raw(pr);
 }
 
 static bool force_soft_fma;
@@ -2428,7 +2447,12 @@ float64 float64r32_muladd(float64 a, float64 b, float64 c,
     float64_unpack_canonical(&pc, c, status);
     pr = parts_muladd_scalbn(&pa, &pb, &pc, 0, flags, status);
 
-    return float64r32_round_pack_canonical(pr, status);
+    /* Round before applying negate result. */
+    parts_uncanon(pr, status, &float32_params);
+    if ((flags & float_muladd_negate_result) && !is_nan(pr->cls)) {
+        pr->sign ^= 1;
+    }
+    return float64r32_pack_raw(pr);
 }
 
 bfloat16 QEMU_FLATTEN bfloat16_muladd(bfloat16 a, bfloat16 b, bfloat16 c,
@@ -2441,7 +2465,12 @@ bfloat16 QEMU_FLATTEN bfloat16_muladd(bfloat16 a, bfloat16 b, bfloat16 c,
     bfloat16_unpack_canonical(&pc, c, status);
     pr = parts_muladd_scalbn(&pa, &pb, &pc, 0, flags, status);
 
-    return bfloat16_round_pack_canonical(pr, status);
+    /* Round before applying negate result. */
+    parts_uncanon(pr, status, &bfloat16_params);
+    if ((flags & float_muladd_negate_result) && !is_nan(pr->cls)) {
+        pr->sign ^= 1;
+    }
+    return bfloat16_pack_raw(pr);
 }
 
 float128 QEMU_FLATTEN float128_muladd(float128 a, float128 b, float128 c,
@@ -2454,7 +2483,12 @@ float128 QEMU_FLATTEN float128_muladd(float128 a, float128 b, float128 c,
     float128_unpack_canonical(&pc, c, status);
     pr = parts_muladd_scalbn(&pa, &pb, &pc, 0, flags, status);
 
-    return float128_round_pack_canonical(pr, status);
+    /* Round before applying negate result. */
+    parts_uncanon(pr, status, &float128_params);
+    if ((flags & float_muladd_negate_result) && !is_nan(pr->cls)) {
+        pr->sign ^= 1;
+    }
+    return float128_pack_raw(pr);
 }
 
 /*
diff --git a/tests/tcg/multiarch/Makefile.target b/tests/tcg/multiarch/Makefile.target
index 45c9cfe18c..bfdf7197a7 100644
--- a/tests/tcg/multiarch/Makefile.target
+++ b/tests/tcg/multiarch/Makefile.target
@@ -29,6 +29,7 @@ run-float_%: float_%
 	$(call run-test,$<, $(QEMU) $(QEMU_OPTS) $<)
 	$(call conditional-diff-out,$<,$(SRC_PATH)/tests/tcg/$(TARGET_NAME)/$<.ref)
 
+fnmsub: LDFLAGS+=-lm
 
 testthread: LDFLAGS+=-lpthread
 
diff --git a/tests/tcg/multiarch/fnmsub.c b/tests/tcg/multiarch/fnmsub.c
new file mode 100644
index 0000000000..15dd41d3bd
--- /dev/null
+++ b/tests/tcg/multiarch/fnmsub.c
@@ -0,0 +1,37 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#include <stdio.h>
+#include <math.h>
+#include <fenv.h>
+
+union U {
+  double d;
+  unsigned long long l;
+};
+
+union U x = { .l = 0x4ff0000000000000ULL };
+union U y = { .l = 0x2ff0000000000000ULL };
+union U r;
+
+int main()
+{
+#ifdef FE_DOWNWARD
+    fesetround(FE_DOWNWARD);
+
+#if defined(__loongarch__)
+    asm("fnmsub.d %0, %1, %1, %2" : "=f"(r.d) : "f"(x.d), "f"(y.d));
+#elif defined(__powerpc64__)
+    asm("fnmsub %0,%1,%1,%2" : "=f"(r.d) : "f"(x.d), "f"(y.d));
+#elif defined(__s390x__) && 0 /* need -march=z14 */
+    asm("vfnms %0,%1,%1,%2,0,3" : "=f"(r.d) : "f"(x.d), "f"(y.d));
+#else
+    r.d = -fma(x.d, x.d, -y.d);
+#endif
+
+    if (r.l != 0xdfefffffffffffffULL) {
+        printf("r = %.18a (%016llx)\n", r.d, r.l);
+        return 1;
+    }
+#endif
+    return 0;
+}

From 6a3e132a1be8c9e649967a4eb341d00731be7f51 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Thu, 10 Jul 2025 12:31:23 +0100
Subject: [PATCH 2095/2760] linux-user: Implement fchmodat2 syscall
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The fchmodat2 syscall is new from Linux 6.6; it is like the
existing fchmodat syscall except that it takes a flags parameter.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3019
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250710113123.1109461-1-peter.maydell@linaro.org>
---
 linux-user/syscall.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index fc37028597..e1b1476936 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -790,6 +790,10 @@ safe_syscall6(ssize_t, copy_file_range, int, infd, loff_t *, pinoff,
               int, outfd, loff_t *, poutoff, size_t, length,
               unsigned int, flags)
 #endif
+#if defined(TARGET_NR_fchmodat2) && defined(__NR_fchmodat2)
+safe_syscall4(int, fchmodat2, int, dfd, const char *, filename,
+              unsigned short, mode, unsigned int, flags)
+#endif
 
 /* We do ioctl like this rather than via safe_syscall3 to preserve the
  * "third argument might be integer or pointer or not present" behaviour of
@@ -10713,6 +10717,15 @@ static abi_long do_syscall1(CPUArchState *cpu_env, int num, abi_long arg1,
         ret = get_errno(fchmodat(arg1, p, arg3, 0));
         unlock_user(p, arg2, 0);
         return ret;
+#endif
+#if defined(TARGET_NR_fchmodat2) && defined(__NR_fchmodat2)
+    case TARGET_NR_fchmodat2:
+        if (!(p = lock_user_string(arg2))) {
+            return -TARGET_EFAULT;
+        }
+        ret = get_errno(safe_fchmodat2(arg1, p, arg3, arg4));
+        unlock_user(p, arg2, 0);
+        return ret;
 #endif
     case TARGET_NR_getpriority:
         /* Note that negative values are valid for getpriority, so we must

From c4828cb8502d0b2adc39b9cde93df7d2886df897 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Thu, 10 Jul 2025 17:43:54 +0100
Subject: [PATCH 2096/2760] linux-user: Check for EFAULT failure in nanosleep

target_to_host_timespec() returns an error if the memory the guest
passed us isn't actually readable.  We check for this everywhere
except the callsite in the TARGET_NR_nanosleep case, so this mistake
was caught by a Coverity heuristic.

Add the missing error checks to the calls that convert between the
host and target timespec structs.

Coverity: CID 1507104
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250710164355.1296648-1-peter.maydell@linaro.org>
---
 linux-user/syscall.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index e1b1476936..38dd563166 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -11643,10 +11643,14 @@ static abi_long do_syscall1(CPUArchState *cpu_env, int num, abi_long arg1,
     case TARGET_NR_nanosleep:
         {
             struct timespec req, rem;
-            target_to_host_timespec(&req, arg1);
+            if (target_to_host_timespec(&req, arg1)) {
+                return -TARGET_EFAULT;
+            }
             ret = get_errno(safe_nanosleep(&req, &rem));
             if (is_error(ret) && arg2) {
-                host_to_target_timespec(arg2, &rem);
+                if (host_to_target_timespec(arg2, &rem)) {
+                    return -TARGET_EFAULT;
+                }
             }
         }
         return ret;

From ff3b0e8d326155e45574dd14de5db6702a32d06e Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Thu, 10 Jul 2025 18:07:06 +0100
Subject: [PATCH 2097/2760] linux-user/gen-vdso: Handle fseek() failure

Coverity points out that we don't check for fseek() failure in gen-vdso.c,
and so we might pass -1 to malloc(). Add the error checking.

(This is a standalone executable that doesn't link against glib, so
we can't do the easy thing and use g_file_get_contents().)

Coverity: CID 1523742
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250710170707.1299926-2-peter.maydell@linaro.org>
---
 linux-user/gen-vdso.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/linux-user/gen-vdso.c b/linux-user/gen-vdso.c
index fce9d5cbc3..1c406d1b10 100644
--- a/linux-user/gen-vdso.c
+++ b/linux-user/gen-vdso.c
@@ -113,9 +113,16 @@ int main(int argc, char **argv)
      * We expect the vdso to be small, on the order of one page,
      * therefore we do not expect a partial read.
      */
-    fseek(inf, 0, SEEK_END);
+    if (fseek(inf, 0, SEEK_END) < 0) {
+        goto perror_inf;
+    }
     total_len = ftell(inf);
-    fseek(inf, 0, SEEK_SET);
+    if (total_len < 0) {
+        goto perror_inf;
+    }
+    if (fseek(inf, 0, SEEK_SET) < 0) {
+        goto perror_inf;
+    }
 
     buf = malloc(total_len);
     if (buf == NULL) {

From cb8607b89ffbba905eac3af595d1db974d2ffc5d Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Thu, 10 Jul 2025 18:07:07 +0100
Subject: [PATCH 2098/2760] linux-user/gen-vdso: Don't read off the end of
 buf[]

In gen-vdso we load in a file and assume it's a valid ELF file.  In
particular we assume it's big enough to be able to read the ELF
information in e_ident in the ELF header.

Add a check that the total file length is at least big enough for all
the e_ident bytes, which is good enough for the code in gen-vdso.c.
This will catch the most obvious possible bad input file (truncated)
and allow us to run the sanity checks like "not actually an ELF file"
without potentially crashing.

The code in elf32_process() and elf64_process() still makes
assumptions about the file being well-formed, but this is OK because
we only run it on the vdso binaries that we create ourselves in the
build process by running the compiler.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250710170707.1299926-3-peter.maydell@linaro.org>
---
 linux-user/gen-vdso.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/linux-user/gen-vdso.c b/linux-user/gen-vdso.c
index 1c406d1b10..aeaa927db8 100644
--- a/linux-user/gen-vdso.c
+++ b/linux-user/gen-vdso.c
@@ -124,6 +124,11 @@ int main(int argc, char **argv)
         goto perror_inf;
     }
 
+    if (total_len < EI_NIDENT) {
+        fprintf(stderr, "%s: file too small (truncated?)\n", inf_name);
+        return EXIT_FAILURE;
+    }
+
     buf = malloc(total_len);
     if (buf == NULL) {
         goto perror_inf;

From 91748d50c7ef4addcc9302160a4b8b3c63d5d024 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= <thomas@t-8ch.de>
Date: Wed, 9 Jul 2025 22:57:16 +0200
Subject: [PATCH 2099/2760] linux-user/mips/o32: Drop sa_restorer functionality
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The Linux kernel dropped support for sa_restorer on O32 MIPS in the
release 2.5.48 because it was unused. See the comment in
arch/mips/include/uapi/asm/signal.h.

Applications using the kernels UAPI headers will not reserve enough
space for qemu-user to copy the sigaction.sa_restorer field to.
Unrelated data may be overwritten.

Align qemu-user with the kernel by also dropping sa_restorer support.

Signed-off-by: Thomas Weißschuh <thomas@t-8ch.de>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250709-mips-sa-restorer-v1-1-fc17120e4afe@t-8ch.de>
---
 linux-user/mips/target_signal.h | 1 -
 linux-user/syscall_defs.h       | 4 ----
 2 files changed, 5 deletions(-)

diff --git a/linux-user/mips/target_signal.h b/linux-user/mips/target_signal.h
index fa542c1f4e..4481426b99 100644
--- a/linux-user/mips/target_signal.h
+++ b/linux-user/mips/target_signal.h
@@ -64,7 +64,6 @@ typedef struct target_sigaltstack {
 #define TARGET_SA_NODEFER       0x40000000
 #define TARGET_SA_RESTART       0x10000000
 #define TARGET_SA_RESETHAND     0x80000000
-#define TARGET_SA_RESTORER      0x04000000      /* Only for O32 */
 
 #define TARGET_MINSIGSTKSZ    2048
 
diff --git a/linux-user/syscall_defs.h b/linux-user/syscall_defs.h
index 5d22759992..df26a2d28f 100644
--- a/linux-user/syscall_defs.h
+++ b/linux-user/syscall_defs.h
@@ -515,10 +515,6 @@ struct target_sigaction {
     abi_ulong       _sa_handler;
 #endif
     target_sigset_t sa_mask;
-#ifdef TARGET_ARCH_HAS_SA_RESTORER
-    /* ??? This is always present, but ignored unless O32.  */
-    abi_ulong sa_restorer;
-#endif
 };
 #else
 struct target_old_sigaction {

From e4e839b2eeea5745c48ce47144c7842eb7cd455f Mon Sep 17 00:00:00 2001
From: Geoffrey Thomas <geofft@ldpreload.com>
Date: Fri, 14 Mar 2025 08:47:42 -0400
Subject: [PATCH 2100/2760] linux-user: Hold the fd-trans lock across fork

If another thread is holding target_fd_trans_lock during a fork,
then the lock becomes permanently locked in the child and the
emulator deadlocks at the next interaction with the fd-trans table.
As with other locks, acquire the lock in fork_start() and release
it in fork_end().

Cc: qemu-stable@nongnu.org
Signed-off-by: Geoffrey Thomas <geofft@ldpreload.com>
Fixes: c093364f4d91 "fd-trans: Fix race condition on reallocation of the translation table."
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2846
Buglink: https://github.com/astral-sh/uv/issues/6105
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250314124742.4965-1-geofft@ldpreload.com>
---
 linux-user/fd-trans.h | 10 ++++++++++
 linux-user/main.c     |  2 ++
 2 files changed, 12 insertions(+)

diff --git a/linux-user/fd-trans.h b/linux-user/fd-trans.h
index 910faaf237..e14f96059c 100644
--- a/linux-user/fd-trans.h
+++ b/linux-user/fd-trans.h
@@ -36,6 +36,16 @@ static inline void fd_trans_init(void)
     qemu_mutex_init(&target_fd_trans_lock);
 }
 
+static inline void fd_trans_prefork(void)
+{
+    qemu_mutex_lock(&target_fd_trans_lock);
+}
+
+static inline void fd_trans_postfork(void)
+{
+    qemu_mutex_unlock(&target_fd_trans_lock);
+}
+
 static inline TargetFdDataFunc fd_trans_target_to_host_data(int fd)
 {
     if (fd < 0) {
diff --git a/linux-user/main.c b/linux-user/main.c
index a9142ee726..f4f2007439 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -149,12 +149,14 @@ void fork_start(void)
     cpu_list_lock();
     qemu_plugin_user_prefork_lock();
     gdbserver_fork_start();
+    fd_trans_prefork();
 }
 
 void fork_end(pid_t pid)
 {
     bool child = pid == 0;
 
+    fd_trans_postfork();
     qemu_plugin_user_postfork(child);
     mmap_fork_end(child);
     if (child) {

From 90cff30d72d4f63fbfa637140b9e06e9894220c2 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Thu, 10 Jul 2025 16:21:31 +0800
Subject: [PATCH 2101/2760] hw/intc/loongarch_extioi: Move unrealize function
 to common code

Memory about LoongArchExtIOICommonState::cpu is allocated in common
code, it had better be freed in common code also.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
---
 hw/intc/loongarch_extioi.c                | 9 ---------
 hw/intc/loongarch_extioi_common.c         | 9 +++++++++
 include/hw/intc/loongarch_extioi.h        | 1 -
 include/hw/intc/loongarch_extioi_common.h | 1 +
 4 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/hw/intc/loongarch_extioi.c b/hw/intc/loongarch_extioi.c
index 8b8ac6b187..3e9c88d1d9 100644
--- a/hw/intc/loongarch_extioi.c
+++ b/hw/intc/loongarch_extioi.c
@@ -377,13 +377,6 @@ static void loongarch_extioi_realize(DeviceState *dev, Error **errp)
     }
 }
 
-static void loongarch_extioi_unrealize(DeviceState *dev)
-{
-    LoongArchExtIOICommonState *s = LOONGARCH_EXTIOI_COMMON(dev);
-
-    g_free(s->cpu);
-}
-
 static void loongarch_extioi_reset_hold(Object *obj, ResetType type)
 {
     LoongArchExtIOIClass *lec = LOONGARCH_EXTIOI_GET_CLASS(obj);
@@ -436,8 +429,6 @@ static void loongarch_extioi_class_init(ObjectClass *klass, const void *data)
 
     device_class_set_parent_realize(dc, loongarch_extioi_realize,
                                     &lec->parent_realize);
-    device_class_set_parent_unrealize(dc, loongarch_extioi_unrealize,
-                                      &lec->parent_unrealize);
     resettable_class_set_parent_phases(rc, NULL, loongarch_extioi_reset_hold,
                                        NULL, &lec->parent_phases);
     lecc->pre_save  = vmstate_extioi_pre_save;
diff --git a/hw/intc/loongarch_extioi_common.c b/hw/intc/loongarch_extioi_common.c
index 4a904b3bc1..ba03383ed1 100644
--- a/hw/intc/loongarch_extioi_common.c
+++ b/hw/intc/loongarch_extioi_common.c
@@ -108,6 +108,13 @@ static void loongarch_extioi_common_realize(DeviceState *dev, Error **errp)
     }
 }
 
+static void loongarch_extioi_common_unrealize(DeviceState *dev)
+{
+    LoongArchExtIOICommonState *s = LOONGARCH_EXTIOI_COMMON(dev);
+
+    g_free(s->cpu);
+}
+
 static void loongarch_extioi_common_reset_hold(Object *obj, ResetType type)
 {
     LoongArchExtIOICommonClass *lecc = LOONGARCH_EXTIOI_COMMON_GET_CLASS(obj);
@@ -221,6 +228,8 @@ static void loongarch_extioi_common_class_init(ObjectClass *klass,
 
     device_class_set_parent_realize(dc, loongarch_extioi_common_realize,
                                     &lecc->parent_realize);
+    device_class_set_parent_unrealize(dc, loongarch_extioi_common_unrealize,
+                                      &lecc->parent_unrealize);
     resettable_class_set_parent_phases(rc, NULL,
                                        loongarch_extioi_common_reset_hold,
                                        NULL, &lecc->parent_phases);
diff --git a/include/hw/intc/loongarch_extioi.h b/include/hw/intc/loongarch_extioi.h
index 9be1d736ea..4795bdc15f 100644
--- a/include/hw/intc/loongarch_extioi.h
+++ b/include/hw/intc/loongarch_extioi.h
@@ -22,7 +22,6 @@ struct LoongArchExtIOIClass {
     LoongArchExtIOICommonClass parent_class;
 
     DeviceRealize parent_realize;
-    DeviceUnrealize parent_unrealize;
     ResettablePhases parent_phases;
 };
 
diff --git a/include/hw/intc/loongarch_extioi_common.h b/include/hw/intc/loongarch_extioi_common.h
index dca25ff893..c021ccee0f 100644
--- a/include/hw/intc/loongarch_extioi_common.h
+++ b/include/hw/intc/loongarch_extioi_common.h
@@ -94,6 +94,7 @@ struct LoongArchExtIOICommonClass {
     SysBusDeviceClass parent_class;
 
     DeviceRealize parent_realize;
+    DeviceUnrealize parent_unrealize;
     ResettablePhases parent_phases;
     int (*pre_save)(void *s);
     int (*post_load)(void *s, int version_id);

From e5de64ae0233a13f5a623a62aec0b95d66ab7ce6 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Wed, 18 Jun 2025 10:30:55 +0800
Subject: [PATCH 2102/2760] target/loongarch: Correct spelling in
 helper_csrwr_pwcl()

There is small typo issue in function helper_csrwr_pwcl(), this patch
corrects this issue.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
---
 target/loongarch/tcg/csr_helper.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/loongarch/tcg/csr_helper.c b/target/loongarch/tcg/csr_helper.c
index 2942d7feb8..46d331ce8a 100644
--- a/target/loongarch/tcg/csr_helper.c
+++ b/target/loongarch/tcg/csr_helper.c
@@ -131,8 +131,8 @@ target_ulong helper_csrwr_pwcl(CPULoongArchState *env, target_ulong val)
     }
     if (!check_ps(env, ptbase)) {
          qemu_log_mask(LOG_GUEST_ERROR,
-                      "Attrmpted set ptbase 2^%d\n", ptbase);
+                      "Attempted set ptbase 2^%d\n", ptbase);
     }
-    env->CSR_PWCL =val;
+    env->CSR_PWCL = val;
     return old_v;
 }

From 5a2e76fc8786760a8fbb42af5cd8a61ecb6aba87 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Wed, 18 Jun 2025 10:51:34 +0800
Subject: [PATCH 2103/2760] target/loongarch: Fix CSR STLBPS register write
 emulation

Function helper_csrwr_stlbps() is emulation with CSR STLBPS register
write operation. However there is only parameter checking action, and
no register updating action. Here update value of CSR_STLBPS when
parameter passes to check.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
---
 target/loongarch/tcg/csr_helper.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/target/loongarch/tcg/csr_helper.c b/target/loongarch/tcg/csr_helper.c
index 46d331ce8a..28b1bb86bd 100644
--- a/target/loongarch/tcg/csr_helper.c
+++ b/target/loongarch/tcg/csr_helper.c
@@ -29,7 +29,11 @@ target_ulong helper_csrwr_stlbps(CPULoongArchState *env, target_ulong val)
     if (!check_ps(env, tlb_ps)) {
         qemu_log_mask(LOG_GUEST_ERROR,
                       "Attempted set ps %d\n", tlb_ps);
+    } else {
+        /* Only update PS field, reserved bit keeps zero */
+        env->CSR_STLBPS = FIELD_DP64(old_v, CSR_STLBPS, PS, tlb_ps);
     }
+
     return old_v;
 }
 

From 94c874f0f2bdc048bacf9873d8d9ee9a68d44ea5 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Wed, 18 Jun 2025 11:53:28 +0800
Subject: [PATCH 2104/2760] target/loongarch: Remove unnecessary page size
 validity checking

Page size of TLB entry comes from CSR STLBPS and pwcl register. With
huge page, it is dir_base + dir_width from pwcl register. With normal
page, it is field of PTBASE from pwcl register.

So it is ok to check validity in function helper_ldpte() and function
helper_csrwr_stlbps(). And it is unnecessary in tlb entry fill path.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
---
 target/loongarch/tcg/tlb_helper.c | 27 ++++++++++-----------------
 1 file changed, 10 insertions(+), 17 deletions(-)

diff --git a/target/loongarch/tcg/tlb_helper.c b/target/loongarch/tcg/tlb_helper.c
index dc48b0f4d2..8872593ff0 100644
--- a/target/loongarch/tcg/tlb_helper.c
+++ b/target/loongarch/tcg/tlb_helper.c
@@ -173,12 +173,6 @@ static void fill_tlb_entry(CPULoongArchState *env, int index)
         lo1 = env->CSR_TLBELO1;
     }
 
-    /*check csr_ps */
-    if (!check_ps(env, csr_ps)) {
-        qemu_log_mask(LOG_GUEST_ERROR, "csr_ps %d is illegal\n", csr_ps);
-        return;
-    }
-
     /* Only MTLB has the ps fields */
     if (index >= LOONGARCH_STLB) {
         tlb->tlb_misc = FIELD_DP64(tlb->tlb_misc, TLB_MISC, PS, csr_ps);
@@ -340,23 +334,16 @@ void helper_tlbfill(CPULoongArchState *env)
 
     if (FIELD_EX64(env->CSR_TLBRERA, CSR_TLBRERA, ISTLBR)) {
         entryhi = env->CSR_TLBREHI;
+        /* Validity of pagesize is checked in helper_ldpte() */
         pagesize = FIELD_EX64(env->CSR_TLBREHI, CSR_TLBREHI, PS);
     } else {
         entryhi = env->CSR_TLBEHI;
+        /* Validity of pagesize is checked in helper_tlbrd() */
         pagesize = FIELD_EX64(env->CSR_TLBIDX, CSR_TLBIDX, PS);
     }
 
-    if (!check_ps(env, pagesize)) {
-        qemu_log_mask(LOG_GUEST_ERROR, "pagesize %d is illegal\n", pagesize);
-        return;
-    }
-
+    /* Validity of stlb_ps is checked in helper_csrwr_stlbps() */
     stlb_ps = FIELD_EX64(env->CSR_STLBPS, CSR_STLBPS, PS);
-    if (!check_ps(env, stlb_ps)) {
-        qemu_log_mask(LOG_GUEST_ERROR, "stlb_ps %d is illegal\n", stlb_ps);
-        return;
-    }
-
     if (pagesize == stlb_ps) {
         /* Only write into STLB bits [47:13] */
         address = entryhi & ~MAKE_64BIT_MASK(0, R_CSR_TLBEHI_64_VPPN_SHIFT);
@@ -611,10 +598,11 @@ void helper_ldpte(CPULoongArchState *env, target_ulong base, target_ulong odd,
                   uint32_t mem_idx)
 {
     CPUState *cs = env_cpu(env);
-    target_ulong phys, tmp0, ptindex, ptoffset0, ptoffset1, ps, badv;
+    target_ulong phys, tmp0, ptindex, ptoffset0, ptoffset1, badv;
     uint64_t ptbase = FIELD_EX64(env->CSR_PWCL, CSR_PWCL, PTBASE);
     uint64_t ptwidth = FIELD_EX64(env->CSR_PWCL, CSR_PWCL, PTWIDTH);
     uint64_t dir_base, dir_width;
+    uint8_t  ps;
 
     /*
      * The parameter "base" has only two types,
@@ -651,6 +639,11 @@ void helper_ldpte(CPULoongArchState *env, target_ulong base, target_ulong odd,
         if (odd) {
             tmp0 += MAKE_64BIT_MASK(ps, 1);
         }
+
+        if (!check_ps(env, ps)) {
+            qemu_log_mask(LOG_GUEST_ERROR, "Illegal huge pagesize %d\n", ps);
+            return;
+        }
     } else {
         badv = env->CSR_TLBRBADV;
 

From cb2273edf5df57cb270bc19d7e92d8be5870c17a Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Sat, 5 Jul 2025 14:05:42 +0200
Subject: [PATCH 2105/2760] target/i386: move max_features to class

max_features is always set to true for instances created by -cpu max or
-cpu host; it's always false for other classes.  Therefore it can be
turned into a field in the X86CPUClass.

Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c         | 7 ++++---
 target/i386/cpu.h         | 2 +-
 target/i386/hvf/hvf-cpu.c | 3 ++-
 target/i386/kvm/kvm-cpu.c | 5 +++--
 4 files changed, 10 insertions(+), 7 deletions(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 0d35e95430..4d4e523424 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -6187,6 +6187,7 @@ static void max_x86_cpu_class_init(ObjectClass *oc, const void *data)
 
     xcc->ordering = 9;
 
+    xcc->max_features = true;
     xcc->model_description =
         "Enables all features supported by the accelerator in the current host";
 
@@ -6201,7 +6202,6 @@ static void max_x86_cpu_initfn(Object *obj)
     /* We can't fill the features array here because we don't know yet if
      * "migratable" is true or false.
      */
-    cpu->max_features = true;
     object_property_set_bool(OBJECT(cpu), "pmu", true, &error_abort);
 
     /*
@@ -8282,6 +8282,7 @@ static void x86_cpu_enable_xsave_components(X86CPU *cpu)
  */
 void x86_cpu_expand_features(X86CPU *cpu, Error **errp)
 {
+    X86CPUClass *xcc = X86_CPU_GET_CLASS(cpu);
     CPUX86State *env = &cpu->env;
     FeatureWord w;
     int i;
@@ -8301,12 +8302,12 @@ void x86_cpu_expand_features(X86CPU *cpu, Error **errp)
         }
     }
 
-    /*TODO: Now cpu->max_features doesn't overwrite features
+    /* TODO: Now xcc->max_features doesn't overwrite features
      * set using QOM properties, and we can convert
      * plus_features & minus_features to global properties
      * inside x86_cpu_parse_featurestr() too.
      */
-    if (cpu->max_features) {
+    if (xcc->max_features) {
         for (w = 0; w < FEATURE_WORDS; w++) {
             /* Override only features that weren't set explicitly
              * by the user.
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index 51e10139df..be3ae6d546 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -2196,7 +2196,6 @@ struct ArchCPU {
     bool expose_tcg;
     bool migratable;
     bool migrate_smi_count;
-    bool max_features; /* Enable all supported features automatically */
     uint32_t apic_id;
 
     /* Enables publishing of TSC increment and Local APIC bus frequencies to
@@ -2349,6 +2348,7 @@ struct X86CPUClass {
      */
     const X86CPUModel *model;
 
+    bool max_features; /* Enable all supported features automatically */
     bool host_cpuid_required;
     int ordering;
     bool migration_safe;
diff --git a/target/i386/hvf/hvf-cpu.c b/target/i386/hvf/hvf-cpu.c
index dfdda70126..2b991f2fc8 100644
--- a/target/i386/hvf/hvf-cpu.c
+++ b/target/i386/hvf/hvf-cpu.c
@@ -61,13 +61,14 @@ static void hvf_cpu_xsave_init(void)
 static void hvf_cpu_instance_init(CPUState *cs)
 {
     X86CPU *cpu = X86_CPU(cs);
+    X86CPUClass *xcc = X86_CPU_GET_CLASS(cpu);
 
     host_cpu_instance_init(cpu);
 
     /* Special cases not set in the X86CPUDefinition structs: */
     /* TODO: in-kernel irqchip for hvf */
 
-    if (cpu->max_features) {
+    if (xcc->max_features) {
         hvf_cpu_max_instance_init(cpu);
     }
 
diff --git a/target/i386/kvm/kvm-cpu.c b/target/i386/kvm/kvm-cpu.c
index 16bde4de01..0fb88a239d 100644
--- a/target/i386/kvm/kvm-cpu.c
+++ b/target/i386/kvm/kvm-cpu.c
@@ -41,6 +41,7 @@ static void kvm_set_guest_phys_bits(CPUState *cs)
 static bool kvm_cpu_realizefn(CPUState *cs, Error **errp)
 {
     X86CPU *cpu = X86_CPU(cs);
+    X86CPUClass *xcc = X86_CPU_GET_CLASS(cpu);
     CPUX86State *env = &cpu->env;
     bool ret;
 
@@ -63,7 +64,7 @@ static bool kvm_cpu_realizefn(CPUState *cs, Error **errp)
      *   check/update ucode_rev, phys_bits, guest_phys_bits, mwait
      *   cpu_common_realizefn() (via xcc->parent_realize)
      */
-    if (cpu->max_features) {
+    if (xcc->max_features) {
         if (enable_cpu_pm) {
             if (kvm_has_waitpkg()) {
                 env->features[FEAT_7_0_ECX] |= CPUID_7_0_ECX_WAITPKG;
@@ -216,7 +217,7 @@ static void kvm_cpu_instance_init(CPUState *cs)
         x86_cpu_apply_props(cpu, kvm_default_props);
     }
 
-    if (cpu->max_features) {
+    if (xcc->max_features) {
         kvm_cpu_max_instance_init(cpu);
     }
 

From 0492c8929f4cb58372273b956e2f8b3d93bd7e33 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 7 Jul 2025 19:10:58 +0200
Subject: [PATCH 2106/2760] target/s390x/kvm: Use vaddr in
 find/insert_hw_breakpoint()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since commit b8a6eb1862a both kvm_arch_insert_hw_breakpoint()
and kvm_arch_remove_hw_breakpoint() use a vaddr type. Use the
same type for the callees.

Fixes: b8a6eb1862a ("sysemu/kvm: Use vaddr for kvm_arch_[insert|remove]_hw_breakpoint")
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250707171059.3064-2-philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 target/s390x/kvm/kvm.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/s390x/kvm/kvm.c b/target/s390x/kvm/kvm.c
index 67d9a1977c..491cc5f975 100644
--- a/target/s390x/kvm/kvm.c
+++ b/target/s390x/kvm/kvm.c
@@ -889,7 +889,7 @@ int kvm_arch_remove_sw_breakpoint(CPUState *cs, struct kvm_sw_breakpoint *bp)
     return 0;
 }
 
-static struct kvm_hw_breakpoint *find_hw_breakpoint(target_ulong addr,
+static struct kvm_hw_breakpoint *find_hw_breakpoint(vaddr addr,
                                                     int len, int type)
 {
     int n;
@@ -904,7 +904,7 @@ static struct kvm_hw_breakpoint *find_hw_breakpoint(target_ulong addr,
     return NULL;
 }
 
-static int insert_hw_breakpoint(target_ulong addr, int len, int type)
+static int insert_hw_breakpoint(vaddr addr, int len, int type)
 {
     int size;
 

From 79d7e60c326bcb9d165e5d52a29b238937bedd8d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 7 Jul 2025 19:10:59 +0200
Subject: [PATCH 2107/2760] target/s390x/tcg: Use vaddr in s390_probe_access()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Commit 70ebd9ce1cb ("s390x/tcg: Fault-safe memset") passed
vaddr type to access_prepare(), and commit b6c636f2cd6
("s390x/tcg: Fault-safe memmove") to do_access_get_byte(),
but declared S390Access::vaddr[1,2] as target_ulong.
Directly declare these as vaddr type, and have
s390_probe_access() use that type as argument.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250707171059.3064-3-philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 target/s390x/tcg/mem_helper.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/target/s390x/tcg/mem_helper.c b/target/s390x/tcg/mem_helper.c
index a03609a140..f1acb1618f 100644
--- a/target/s390x/tcg/mem_helper.c
+++ b/target/s390x/tcg/mem_helper.c
@@ -126,8 +126,8 @@ static inline void cpu_stsize_data_ra(CPUS390XState *env, uint64_t addr,
 
 /* An access covers at most 4096 bytes and therefore at most two pages. */
 typedef struct S390Access {
-    target_ulong vaddr1;
-    target_ulong vaddr2;
+    vaddr vaddr1;
+    vaddr vaddr2;
     void *haddr1;
     void *haddr2;
     uint16_t size1;
@@ -148,7 +148,7 @@ typedef struct S390Access {
  * For !CONFIG_USER_ONLY, the TEC is stored stored to env->tlb_fill_tec.
  * For CONFIG_USER_ONLY, the faulting address is stored to env->__excp_addr.
  */
-static inline int s390_probe_access(CPUArchState *env, target_ulong addr,
+static inline int s390_probe_access(CPUArchState *env, vaddr addr,
                                     int size, MMUAccessType access_type,
                                     int mmu_idx, bool nonfault,
                                     void **phost, uintptr_t ra)
@@ -258,7 +258,7 @@ static void access_memset(CPUS390XState *env, S390Access *desta,
 static uint8_t access_get_byte(CPUS390XState *env, S390Access *access,
                                int offset, uintptr_t ra)
 {
-    target_ulong vaddr = access->vaddr1;
+    vaddr vaddr = access->vaddr1;
     void *haddr = access->haddr1;
 
     if (unlikely(offset >= access->size1)) {
@@ -278,7 +278,7 @@ static uint8_t access_get_byte(CPUS390XState *env, S390Access *access,
 static void access_set_byte(CPUS390XState *env, S390Access *access,
                             int offset, uint8_t byte, uintptr_t ra)
 {
-    target_ulong vaddr = access->vaddr1;
+    vaddr vaddr = access->vaddr1;
     void *haddr = access->haddr1;
 
     if (unlikely(offset >= access->size1)) {

From 3ffa21d293bf5e4f997ba117ee3e943344b71044 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Thu, 10 Jul 2025 17:15:52 +0100
Subject: [PATCH 2108/2760] hw/s390x/s390-pci-bus.c: Use g_assert_not_reached()
 in functions taking an ett

The s390-pci-bus.c code, Coverity complains about a possible overflow
because get_table_index() can return -1 if the ett value passed in is
not one of the three permitted ZPCI_ETT_PT, ZPCI_ETT_ST, ZPCI_ETT_RT,
but the caller in table_translate() doesn't check this and instead
uses the return value directly in a calculation of the guest address
to read from.

In fact this case cannot happen, because:
 * get_table_index() is called only from table_translate()
 * the only caller of table_translate() loops through the ett values
   in the order RT, ST, PT until table_translate() returns 0
 * table_translate() will return 0 for the error cases and when
   translate_iscomplete() returns true
 * translate_iscomplete() is always true for ZPCI_ETT_PT

So table_translate() is always called with a valid ett value.

Instead of having the various functions called from table_translate()
return a default or dummy value when the ett argument is out of range,
use g_assert_not_reached() to indicate that this is impossible.

Coverity: CID 1547609
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
Reviewed-by: Halil Pasic <pasic@linux.ibm.com>
Message-ID: <20250710161552.1287399-1-peter.maydell@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 hw/s390x/s390-pci-bus.c | 26 ++++++++++++++------------
 1 file changed, 14 insertions(+), 12 deletions(-)

diff --git a/hw/s390x/s390-pci-bus.c b/hw/s390x/s390-pci-bus.c
index e6aa44531f..f87d2748b6 100644
--- a/hw/s390x/s390-pci-bus.c
+++ b/hw/s390x/s390-pci-bus.c
@@ -384,9 +384,9 @@ static uint64_t get_table_index(uint64_t iova, int8_t ett)
         return calc_sx(iova);
     case ZPCI_ETT_RT:
         return calc_rtx(iova);
+    default:
+        g_assert_not_reached();
     }
-
-    return -1;
 }
 
 static bool entry_isvalid(uint64_t entry, int8_t ett)
@@ -397,22 +397,24 @@ static bool entry_isvalid(uint64_t entry, int8_t ett)
     case ZPCI_ETT_ST:
     case ZPCI_ETT_RT:
         return rt_entry_isvalid(entry);
+    default:
+        g_assert_not_reached();
     }
-
-    return false;
 }
 
 /* Return true if address translation is done */
 static bool translate_iscomplete(uint64_t entry, int8_t ett)
 {
     switch (ett) {
-    case 0:
+    case ZPCI_ETT_ST:
         return (entry & ZPCI_TABLE_FC) ? true : false;
-    case 1:
+    case ZPCI_ETT_RT:
         return false;
+    case ZPCI_ETT_PT:
+        return true;
+    default:
+        g_assert_not_reached();
     }
-
-    return true;
 }
 
 static uint64_t get_frame_size(int8_t ett)
@@ -424,9 +426,9 @@ static uint64_t get_frame_size(int8_t ett)
         return 1ULL << 20;
     case ZPCI_ETT_RT:
         return 1ULL << 31;
+    default:
+        g_assert_not_reached();
     }
-
-    return 0;
 }
 
 static uint64_t get_next_table_origin(uint64_t entry, int8_t ett)
@@ -438,9 +440,9 @@ static uint64_t get_next_table_origin(uint64_t entry, int8_t ett)
         return get_st_pto(entry);
     case ZPCI_ETT_RT:
         return get_rt_sto(entry);
+    default:
+        g_assert_not_reached();
     }
-
-    return 0;
 }
 
 /**

From a4adf071dc7ee615c2ed4517ad77b125e2e70066 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Wed, 9 Jul 2025 10:34:39 +0200
Subject: [PATCH 2109/2760] pc-bios/s390-ccw: Allow to select a different
 pxelinux.cfg entry via loadparm

Since we're linking the network booting code into the main firmware
binary nowadays, we can support the "loadparm" parameter now quite
easily for pxelinux.cfg config files that contain multiple entries.

Reviewed-by: Jared Rossi <jrossi@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250709083443.41574-2-thuth@redhat.com>
---
 pc-bios/s390-ccw/netmain.c | 32 ++++++++++++++++++++++++--------
 1 file changed, 24 insertions(+), 8 deletions(-)

diff --git a/pc-bios/s390-ccw/netmain.c b/pc-bios/s390-ccw/netmain.c
index 719a547ada..c0aafca22d 100644
--- a/pc-bios/s390-ccw/netmain.c
+++ b/pc-bios/s390-ccw/netmain.c
@@ -332,6 +332,27 @@ static int load_kernel_with_initrd(filename_ip_t *fn_ip,
     return rc;
 }
 
+static int net_select_and_load_kernel(filename_ip_t *fn_ip,
+                                      int num_ent, int selected,
+                                      struct pl_cfg_entry *entries)
+{
+    unsigned int loadparm = get_loadparm_index();
+
+    if (num_ent <= 0) {
+        return -1;
+    }
+
+    IPL_assert(loadparm <= num_ent,
+               "loadparm is set to an entry that is not available in the "
+               "pxelinux.cfg file!");
+
+    if (loadparm > 0) {
+        selected = loadparm - 1;
+    }
+
+    return load_kernel_with_initrd(fn_ip, &entries[selected]);
+}
+
 #define MAX_PXELINUX_ENTRIES 16
 
 static int net_try_pxelinux_cfg(filename_ip_t *fn_ip)
@@ -343,11 +364,8 @@ static int net_try_pxelinux_cfg(filename_ip_t *fn_ip)
                                       DEFAULT_TFTP_RETRIES,
                                       cfgbuf, sizeof(cfgbuf),
                                       entries, MAX_PXELINUX_ENTRIES, &def_ent);
-    if (num_ent > 0) {
-        return load_kernel_with_initrd(fn_ip, &entries[def_ent]);
-    }
 
-    return -1;
+    return net_select_and_load_kernel(fn_ip, num_ent, def_ent, entries);
 }
 
 /**
@@ -433,10 +451,8 @@ static int net_try_direct_tftp_load(filename_ip_t *fn_ip)
 
             num_ent = pxelinux_parse_cfg(cfgbuf, sizeof(cfgbuf), entries,
                                          MAX_PXELINUX_ENTRIES, &def_ent);
-            if (num_ent <= 0) {
-                return -1;
-            }
-            return load_kernel_with_initrd(fn_ip, &entries[def_ent]);
+            return net_select_and_load_kernel(fn_ip, num_ent, def_ent,
+                                              entries);
         }
     }
 

From 108977796fbb765c7bcf040500ae9711cb2fa596 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Wed, 9 Jul 2025 10:34:40 +0200
Subject: [PATCH 2110/2760] pc-bios/s390-ccw: Allow up to 31 entries for
 pxelinux.cfg

We're going to support a menu for the pxelinux.cfg code, and to be able
to reuse some functionality from menu.c, we should align the maximum
amount of possible entries with the MAX_BOOT_ENTRIES constant that is
used there. Thus replace MAX_PXELINUX_ENTRIES with MAX_BOOT_ENTRIES.

Reviewed-by: Jared Rossi <jrossi@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250709083443.41574-3-thuth@redhat.com>
---
 pc-bios/s390-ccw/netmain.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/pc-bios/s390-ccw/netmain.c b/pc-bios/s390-ccw/netmain.c
index c0aafca22d..6f64323cd8 100644
--- a/pc-bios/s390-ccw/netmain.c
+++ b/pc-bios/s390-ccw/netmain.c
@@ -353,17 +353,15 @@ static int net_select_and_load_kernel(filename_ip_t *fn_ip,
     return load_kernel_with_initrd(fn_ip, &entries[selected]);
 }
 
-#define MAX_PXELINUX_ENTRIES 16
-
 static int net_try_pxelinux_cfg(filename_ip_t *fn_ip)
 {
-    struct pl_cfg_entry entries[MAX_PXELINUX_ENTRIES];
+    struct pl_cfg_entry entries[MAX_BOOT_ENTRIES];
     int num_ent, def_ent = 0;
 
     num_ent = pxelinux_load_parse_cfg(fn_ip, mac, get_uuid(),
                                       DEFAULT_TFTP_RETRIES,
                                       cfgbuf, sizeof(cfgbuf),
-                                      entries, MAX_PXELINUX_ENTRIES, &def_ent);
+                                      entries, MAX_BOOT_ENTRIES, &def_ent);
 
     return net_select_and_load_kernel(fn_ip, num_ent, def_ent, entries);
 }
@@ -446,11 +444,11 @@ static int net_try_direct_tftp_load(filename_ip_t *fn_ip)
          * a magic comment string.
          */
         if (!strncasecmp("# pxelinux", cfgbuf, 10)) {
-            struct pl_cfg_entry entries[MAX_PXELINUX_ENTRIES];
+            struct pl_cfg_entry entries[MAX_BOOT_ENTRIES];
             int num_ent, def_ent = 0;
 
             num_ent = pxelinux_parse_cfg(cfgbuf, sizeof(cfgbuf), entries,
-                                         MAX_PXELINUX_ENTRIES, &def_ent);
+                                         MAX_BOOT_ENTRIES, &def_ent);
             return net_select_and_load_kernel(fn_ip, num_ent, def_ent,
                                               entries);
         }

From 47d68f7475feb86c9347f7013066b3b05b545cfc Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Wed, 9 Jul 2025 10:34:41 +0200
Subject: [PATCH 2111/2760] pc-bios/s390-ccw: Make get_boot_index() from menu.c
 global

We are going to reuse this function for selecting an entry from
the pxelinux.cfg menu, so rename this function with a "menu_"
prefix and make it available globally.

Reviewed-by: Jared Rossi <jrossi@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250709083443.41574-4-thuth@redhat.com>
---
 pc-bios/s390-ccw/menu.c     | 6 +++---
 pc-bios/s390-ccw/s390-ccw.h | 1 +
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/pc-bios/s390-ccw/menu.c b/pc-bios/s390-ccw/menu.c
index 84062e94af..eeaff78f87 100644
--- a/pc-bios/s390-ccw/menu.c
+++ b/pc-bios/s390-ccw/menu.c
@@ -159,7 +159,7 @@ static void boot_menu_prompt(bool retry)
     }
 }
 
-static int get_boot_index(bool *valid_entries)
+int menu_get_boot_index(bool *valid_entries)
 {
     int boot_index;
     bool retry = false;
@@ -224,7 +224,7 @@ int menu_get_zipl_boot_index(const char *menu_data)
     }
 
     printf("\n");
-    return get_boot_index(valid_entries);
+    return menu_get_boot_index(valid_entries);
 }
 
 int menu_get_enum_boot_index(bool *valid_entries)
@@ -247,7 +247,7 @@ int menu_get_enum_boot_index(bool *valid_entries)
     }
 
     printf("\n");
-    return get_boot_index(valid_entries);
+    return menu_get_boot_index(valid_entries);
 }
 
 void menu_set_parms(uint8_t boot_menu_flag, uint32_t boot_menu_timeout)
diff --git a/pc-bios/s390-ccw/s390-ccw.h b/pc-bios/s390-ccw/s390-ccw.h
index 6cdce3e5e5..b1dc35cded 100644
--- a/pc-bios/s390-ccw/s390-ccw.h
+++ b/pc-bios/s390-ccw/s390-ccw.h
@@ -87,6 +87,7 @@ int menu_get_zipl_boot_index(const char *menu_data);
 bool menu_is_enabled_zipl(void);
 int menu_get_enum_boot_index(bool *valid_entries);
 bool menu_is_enabled_enum(void);
+int menu_get_boot_index(bool *valid_entries);
 
 #define MAX_BOOT_ENTRIES  31
 

From fc24fd9342ec5ddaeecdf2a28f7fc4c2cdf6b014 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Wed, 9 Jul 2025 10:34:42 +0200
Subject: [PATCH 2112/2760] pc-bios/s390-ccw: Add a boot menu for booting via
 pxelinux.cfg

Show a simple boot menu for pxelinux.cfg, too, if the user requested it.

Reviewed-by: Jared Rossi <jrossi@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250709083443.41574-5-thuth@redhat.com>
---
 pc-bios/s390-ccw/netmain.c | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/pc-bios/s390-ccw/netmain.c b/pc-bios/s390-ccw/netmain.c
index 6f64323cd8..a9521dff41 100644
--- a/pc-bios/s390-ccw/netmain.c
+++ b/pc-bios/s390-ccw/netmain.c
@@ -332,6 +332,28 @@ static int load_kernel_with_initrd(filename_ip_t *fn_ip,
     return rc;
 }
 
+static int net_boot_menu(int num_ent, int def_ent,
+                         struct pl_cfg_entry *entries)
+{
+    bool valid_entries[MAX_BOOT_ENTRIES] = { false };
+    int idx;
+
+    puts("\ns390-ccw pxelinux.cfg boot menu:\n");
+    printf(" [0] default (%d)\n", def_ent + 1);
+    valid_entries[0] = true;
+
+    for (idx = 1; idx <= num_ent; idx++) {
+        printf(" [%d] %s\n", idx, entries[idx - 1].label);
+        valid_entries[idx] = true;
+    }
+    putchar('\n');
+
+    idx = menu_get_boot_index(valid_entries);
+    putchar('\n');
+
+    return idx;
+}
+
 static int net_select_and_load_kernel(filename_ip_t *fn_ip,
                                       int num_ent, int selected,
                                       struct pl_cfg_entry *entries)
@@ -342,6 +364,10 @@ static int net_select_and_load_kernel(filename_ip_t *fn_ip,
         return -1;
     }
 
+    if (menu_is_enabled_enum() && num_ent > 1) {
+        loadparm = net_boot_menu(num_ent, selected, entries);
+    }
+
     IPL_assert(loadparm <= num_ent,
                "loadparm is set to an entry that is not available in the "
                "pxelinux.cfg file!");

From c784de966b154810a4c97eb0e4a658ec6457dd4c Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Wed, 9 Jul 2025 10:34:43 +0200
Subject: [PATCH 2113/2760] tests/functional: Add a test for s390x pxelinux.cfg
 network booting

Check the various ways of booting a kernel via pxelinux.cfg file,
e.g. by specifying the config file name via the MAC address or the
UUID of the guest. Also check whether we can successfully load an
alternate kernel via the "loadparm" parameter here and whether the
boot menu shows up with "-boot menu=on".

Reviewed-by: Jared Rossi <jrossi@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250709083443.41574-6-thuth@redhat.com>
---
 MAINTAINERS                             |   1 +
 tests/functional/meson.build            |   1 +
 tests/functional/test_s390x_pxelinux.py | 119 ++++++++++++++++++++++++
 3 files changed, 121 insertions(+)
 create mode 100755 tests/functional/test_s390x_pxelinux.py

diff --git a/MAINTAINERS b/MAINTAINERS
index 1842c3dd83..e88ed2c0a9 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1805,6 +1805,7 @@ F: hw/s390x/ipl.*
 F: pc-bios/s390-ccw/
 F: pc-bios/s390-ccw.img
 F: docs/devel/s390-dasd-ipl.rst
+F: tests/functional/test_s390x_pxelinux.py
 T: git https://github.com/borntraeger/qemu.git s390-next
 L: qemu-s390x@nongnu.org
 
diff --git a/tests/functional/meson.build b/tests/functional/meson.build
index 050c9000b9..1ae5f02fb3 100644
--- a/tests/functional/meson.build
+++ b/tests/functional/meson.build
@@ -281,6 +281,7 @@ tests_rx_system_thorough = [
 
 tests_s390x_system_thorough = [
   's390x_ccw_virtio',
+  's390x_pxelinux',
   's390x_replay',
   's390x_topology',
   's390x_tuxrun',
diff --git a/tests/functional/test_s390x_pxelinux.py b/tests/functional/test_s390x_pxelinux.py
new file mode 100755
index 0000000000..4fc33b8c46
--- /dev/null
+++ b/tests/functional/test_s390x_pxelinux.py
@@ -0,0 +1,119 @@
+#!/usr/bin/env python3
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+#
+# Functional test that checks the pxelinux.cfg network booting of a s390x VM
+# (TFTP booting without config file is already tested by the pxe qtest, so
+#  we don't repeat that here).
+
+import os
+import shutil
+
+from qemu_test import QemuSystemTest, Asset, wait_for_console_pattern
+
+
+pxelinux_cfg_contents='''# pxelinux.cfg style config file
+default Debian
+label Nonexisting
+kernel kernel.notavailable
+initrd initrd.notavailable
+label Debian
+kernel kernel.debian
+initrd initrd.debian
+append testoption=teststring
+label Fedora
+kernel kernel.fedora
+'''
+
+class S390PxeLinux(QemuSystemTest):
+
+    ASSET_DEBIAN_KERNEL = Asset(
+        ('https://snapshot.debian.org/archive/debian/'
+         '20201126T092837Z/dists/buster/main/installer-s390x/'
+         '20190702+deb10u6/images/generic/kernel.debian'),
+        'd411d17c39ae7ad38d27534376cbe88b68b403c325739364122c2e6f1537e818')
+
+    ASSET_DEBIAN_INITRD = Asset(
+        ('https://snapshot.debian.org/archive/debian/'
+         '20201126T092837Z/dists/buster/main/installer-s390x/'
+         '20190702+deb10u6/images/generic/initrd.debian'),
+        '836bbd0fe6a5ca81274c28c2b063ea315ce1868660866e9b60180c575fef9fd5')
+
+    ASSET_FEDORA_KERNEL = Asset(
+        ('https://archives.fedoraproject.org/pub/archive'
+         '/fedora-secondary/releases/31/Server/s390x/os'
+         '/images/kernel.img'),
+        '480859574f3f44caa6cd35c62d70e1ac0609134e22ce2a954bbed9b110c06e0b')
+
+    def pxelinux_launch(self, pl_name='default', extra_opts=None):
+        self.require_netdev('user')
+        self.set_machine('s390-ccw-virtio')
+
+        debian_kernel = self.ASSET_DEBIAN_KERNEL.fetch()
+        debian_initrd = self.ASSET_DEBIAN_INITRD.fetch()
+        fedora_kernel = self.ASSET_FEDORA_KERNEL.fetch()
+
+        # Prepare a folder for the TFTP "server":
+        tftpdir = self.scratch_file('tftp')
+        shutil.rmtree(tftpdir, ignore_errors=True)   # Remove stale stuff
+        os.mkdir(tftpdir)
+        shutil.copy(debian_kernel, os.path.join(tftpdir, 'kernel.debian'))
+        shutil.copy(debian_initrd, os.path.join(tftpdir, 'initrd.debian'))
+        shutil.copy(fedora_kernel, os.path.join(tftpdir, 'kernel.fedora'))
+
+        pxelinuxdir = self.scratch_file('tftp', 'pxelinux.cfg')
+        os.mkdir(pxelinuxdir)
+
+        cfg_fname = self.scratch_file('tftp', 'pxelinux.cfg', pl_name)
+        with open(cfg_fname, 'w', encoding='utf-8') as f:
+            f.write(pxelinux_cfg_contents)
+
+        virtio_net_dev = 'virtio-net-ccw,netdev=n1,bootindex=1'
+        if extra_opts:
+                virtio_net_dev += ',' + extra_opts
+
+        self.vm.add_args('-m', '384',
+                         '-netdev', f'user,id=n1,tftp={tftpdir}',
+                         '-device', virtio_net_dev)
+        self.vm.set_console()
+        self.vm.launch()
+
+
+    def test_default(self):
+        self.pxelinux_launch()
+        # The kernel prints its arguments to the console, so we can use
+        # this to check whether the kernel parameters are correctly handled:
+        wait_for_console_pattern(self, 'testoption=teststring')
+        # Now also check that we've successfully loaded the initrd:
+        wait_for_console_pattern(self, 'Unpacking initramfs...')
+        wait_for_console_pattern(self, 'Run /init as init process')
+
+    def test_mac(self):
+        self.pxelinux_launch(pl_name='01-02-ca-fe-ba-be-42',
+                             extra_opts='mac=02:ca:fe:ba:be:42,loadparm=3')
+        wait_for_console_pattern(self, 'Linux version 5.3.7-301.fc31.s390x')
+
+    def test_uuid(self):
+        # Also add a non-bootable disk to check the fallback to network boot:
+        self.vm.add_args('-blockdev', 'null-co,size=65536,node-name=d1',
+                         '-device', 'virtio-blk,drive=d1,bootindex=0,loadparm=1',
+                         '-uuid', '550e8400-e29b-11d4-a716-446655441234')
+        self.pxelinux_launch(pl_name='550e8400-e29b-11d4-a716-446655441234')
+        wait_for_console_pattern(self, 'Debian 4.19.146-1 (2020-09-17)')
+
+    def test_ip(self):
+        self.vm.add_args('-M', 'loadparm=3')
+        self.pxelinux_launch(pl_name='0A00020F')
+        wait_for_console_pattern(self, 'Linux version 5.3.7-301.fc31.s390x')
+
+    def test_menu(self):
+        self.vm.add_args('-boot', 'menu=on,splash-time=10')
+        self.pxelinux_launch(pl_name='0A00')
+        wait_for_console_pattern(self, '[1] Nonexisting')
+        wait_for_console_pattern(self, '[2] Debian')
+        wait_for_console_pattern(self, '[3] Fedora')
+        wait_for_console_pattern(self, 'Debian 4.19.146-1 (2020-09-17)')
+
+
+if __name__ == '__main__':
+    QemuSystemTest.main()

From acb00a7aae47e9f6e9a955f4c83e2295c7271837 Mon Sep 17 00:00:00 2001
From: Sertonix <sertonix@posteo.net>
Date: Tue, 10 Jun 2025 17:58:06 +0000
Subject: [PATCH 2114/2760] pc-bios/s390-ccw: link statically

Adding -pie to LDFLAGS caused s390-ccw.img to become dynamically linked.
By using -static-pie it will be linked statically like other bios.

This ensures that the build output doesn't change depending on the
default dynamic loader path of the toolchain.

Fixes: d884c86dcd3b ("s390/bios: Make the s390-ccw.img relocatable")
Signed-off-by: Sertonix <sertonix@posteo.net>
Message-ID: <DAJ1QOSAP9LS.342SQSM0UZU80@posteo.net>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 pc-bios/s390-ccw/Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pc-bios/s390-ccw/Makefile b/pc-bios/s390-ccw/Makefile
index dc69dd484f..a0f24c94a8 100644
--- a/pc-bios/s390-ccw/Makefile
+++ b/pc-bios/s390-ccw/Makefile
@@ -47,7 +47,7 @@ EXTRA_CFLAGS += -fwrapv -fno-strict-aliasing -fno-asynchronous-unwind-tables
 EXTRA_CFLAGS += -msoft-float
 EXTRA_CFLAGS += -std=gnu99
 EXTRA_CFLAGS += $(LIBC_INC) $(LIBNET_INC)
-EXTRA_LDFLAGS += -Wl,-pie -nostdlib -z noexecstack -z text
+EXTRA_LDFLAGS += -static-pie -nostdlib -z noexecstack -z text
 
 cc-test = $(CC) -Werror $1 -c -o /dev/null -xc /dev/null >/dev/null 2>/dev/null
 cc-option = if $(call cc-test, $1); then \

From 21820b4b479842c7fa67ec65f9b0b62c286b86f4 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Fri, 11 Jul 2025 10:18:23 +0200
Subject: [PATCH 2115/2760] pc-bios: Update the s390 bios images with the
 pxelinux.cfg loadparm changes

This new s390-ccw.img binary contains the addition of the loadparm
feature to the pxelinux.cfg network booting code.

Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 pc-bios/s390-ccw.img | Bin 96000 -> 87824 bytes
 1 file changed, 0 insertions(+), 0 deletions(-)

diff --git a/pc-bios/s390-ccw.img b/pc-bios/s390-ccw.img
index 47240f0a74eec17b0da3ad334157d1b0e62632b4..ff60978d28c59a3d9ee706e48ff268aad6476ddc 100644
GIT binary patch
delta 39259
zcmZp8$2wsh>jXI^HU=ng0Mm@Y0btsJ!GeLE!GVFFfp6jlH7=(aU{OY=8519fDfxLo
zcyXvS1B(V&oPkAS;sepi%{-!J5I&exS=j-m85BSi69WSS#A-&r43Gc=V;r2G?7*ld
z#CQTM%z&ULS1`u;;j)`?2UIzfW?*DsU|?ZjU=U$oU|@Fl3uVw#P7@J}eqvJ0;aJ%C
zC1lO?oq9_rn=lnyLfip$4#X4&AwdQPb}*aK;sKZj8_1v{0CP738^h!WOyZ0jlYcPj
zF(nyH)?jvHQV^J2z$_-2BmmI@_N$a20|Pgh&zLZIKC?KJ0?*_f%z5?D&|_fW0ZXzp
zT7YTBxCk%}7jJ+B1Y>*yia4W%IGE2E4-HqSIgA!MQ1J<18fFfoMKqYt7!QfddW1v{
zRAK>`Mu@{StUwWGQh@l5F@6JzI3v{8jPbB2fOrfRfQ<16kk!{SFeX41#6x@tvltc=
zjPVzcH83zSaDe%Y@i)LUOg+ne2$wM)8dI>4NHPFRFvh<C(=hc+3Ltw~7#JAiC;w*=
zuaEzMDh=@-17iYI7;anvSb#A>0!+h<V}ZsCV*)h!L)9}wRWT+(vKCA|n+C+0j7bm+
zl;IMZ1_wScF#OqYK!Jf_&ELlg3JeS^2Mid51$R$w;Pzl*csThK_xbww9|{;$mjC{r
za6o{8;ZO3@Pyq%Dqva_Kya%2#Fvv5%QDfj>tUDsXz_7-2`4<LOkg7EyM>H51{sdlP
zRM;WF;K3lk<iMb?>#2{z9tMWj?>`DKu(1DQhl1Cr<{QJ!mjszFce(zJ27?G=-2ny$
zMi$lA3=9ekJa5<-_!(+IR{l`{i%SMD2#CN82KlBv0i>DfEyxZe3lta_d6+>m6*G2<
zF(|=wfK(yy>;4Z8P!B6GFml&_UT(>7X1OPW%z*<8jNETP+Di|DNTGWm(t!EE1_nmv
z8_P8r*mkloa4(l+U}$Dy=2$Mzz_>|?f#DG62L=X)4h9DKBm4}E+^611Ftjt)fOImt
z9bsZ%SiOHK`~ROu*cljB?^=F?fnoU<2F~TT7#I)T1(g8HTk07^c8W0AF4z43AEb$C
z${Q61Zic!yYX9Fe)`3O1mw);H5^U5gkWovy8JNJvO~z&%nrXS{rZGN&n^p`qt)82K
z1#Dan5yrV;7`GQ>94JcK)`1+`dh&n(10%P`(-=^yU*5v7`@jMQMsA1YGZ+{_@(g>Q
z#(;{2<t+^5AinI``o|0#co?QE=VSQ4yoJH=4I4u$Q{7{R4Y>?cjtDU@tX6#Lqu9W}
z@K|9(9>df(0=9OHp-03S7*>le?_glqDaLSVrwD_^P8J4Tka3LP-l#BmGt|A&U?^g&
zTi(UMc&HZ~%qjohE&sw`7s0SW<~0L@0E27*gJKKVmU^%?tKNaFVZ6kw*s(zZ-Lh5p
zv08TEjS7P(*fJX|mT`bX#R253R{N)+2ZR_HmbWnIKV~?<$WZp!;D87N%W^IT#`*&a
z42(>xmwO5@I58Xm2U1DPa*qH1y%-J%EteEvcr0*0gn`3>;eZgBrE+9G10&bW<zN0s
zgN$bQ2Q@n7|JCIj3=E(|$khe1x^*u|o-q!R@?YQokO5Bh9-w@+%J`DVhs6R62Lu@E
z8M%t#u@!aT0s|vcs-waMfdd8%4AWLE_hjGz8B==wjRq)SA1hoCV3+_lLeJ4ifZ?&j
z1wn=hATMxvU1CsRFkpCWa6yP+f}@K7!zBg<MhB1zVTK8g#$Y}ZSY8A!&+NcZ|JdPz
zC|m&xSb-Qs!Q+4n;tUfmF(|M)FhC7pGhlEO1slaK0Ln_BKxX6u7ga)Bprpse3-^pK
z$XT5KK^|$1fP19)jRu1pLmgP|;{gMPdWKeixMb=Z4F)lWI*>t}uOBlAFfdGbqhPh4
zA#}MVIOi%Z*JNmbvZX<)7%x0#5I`hf);DYnLQD|-ry=?u8wl_)h`mv;*vSwI3Q19Z
zM}-e-4;U~oa&7|ITMrT}?sZi7uo%Q@(K(>Vz{tP>w#1Wx4J1}9_WJ%u1>`~%8mI80
z6;wL>>|V}iIbnGV1J`ms3!~*N41&w~6xo-jFjyVYWnfs@uv3h|08%0z_`<+oQUWqr
zM(}YxgMu-`l&3z52@DKxI2ddg>)voM=x~4nh@n;d4I6_fQytg<aFMH<_(qLEjR9OR
z>14lAW6%NzB}1zq!szDHAge%0u;nb0=mfASwjgU&_1<Xwf51=&lC1~%3#|AONUC`)
zNRWXA<VJ>WMA^QRg~14{3S2-pXB~L@|NkF%c&gR_RZA=R9Sj7Rj>s}FtmJYu_^<?&
zi#C}UFo25b4h9C9<v0HSeZ#>J_8;WMVCK4sj2~7muLqUMEet+8Sr{&XT)5&b$QinR
zVD@t`JL8Bt1H+HIZ!{Pr8Ngw&;x<TJ;mw;X3?dA5j~PC!Vwfs<VUrTWg+n*NwZR1j
z`Q=|2l$PK4|9|-x202jl{MZYQjvEY&%Uc*kp;0BcoUa~S*>b<pVBmxVt90NSH3nA3
zI#6-EQ-neH_5F_ypfG~QdHx3jP(FUw0dj)0@zWSk#4T@O-~;iQnZaR{_&WdN3Px}k
zHiJ`;wE7!027X9=BH{^F69-jO|Am2}=?geGQ$b;Hz52tG4^KeZLm+jzCBv%ao(>Ek
zqYJMs*JNM-rCWhW5MS%r8x00w21q)w1c@|V1RLxOW}k)_&;IWKXO(Aw&oN#GMgiO9
zDGWLwHLcoUH9J8yZoPof)0hJ+;9%hfORfXwSQW66ipL5E1Q?i>w=igdt(F0aYOQ>u
z!C()y+Hm=o|A#@MQrq5WFvxJ!y-{P(U;-yltz3|Ymfz!GSf0X=4pPHZ@<xqeIz!#^
zFAObUyEvEEfBC-zB&8L;To0@eTz4}iyisFl1}iK9DQtcN@ee3jHpL<Q#D8UZ3PS~`
z;9V~HA6yRdpI&akz_|Pi1Dm6OfPkZdg2U4YPz!f?3j<q#;l~hAng28b)E0w?)PIbC
z3K@Va2#}%}kjNVehCqgzrx6McAo2gV0}MYVfW()7`F|DUV9oz;G#Hc^>XynkFzl3N
zVA?6dpa=>h{%%mP@`KZdmgpNb1_6dTM}q^5AaAq=E%#(#1?evO@<xLpo1t!b{XGFt
zy#xt*6OdHndl0E*0U}vMLE4(D5x#GH01|0wUH;`i=Nk?NQ%Ir}I{8L}fs3KeQQ^ZA
zkUk+xP|&}*#kfqqey13N?Q3BMCI((d!4FSh#WUml*TM`e47}j_kKgFAqJjVei=)9u
za51B~>x~8jFC>Or)-V6^?+Vz`=;dGjoreT|B*Vvq<tYpTQyD&{fXX_s{D$RU{_O`@
zueoXYm;Ycdwai-n<=@sLD;OA-9a+AULE$m?$8v@#Z#WpZnCjlJF)U}UuXEh6L1Foq
z|6ecZeb~By;j#9|1O}GJw?9@eu<T@EI0VWGe2<ZHLO}>9nE7t*WMP=IlZ8PCY+=$H
zHHL`{bw@N982Qe;(O}47s9AoJ;opG?42*n7o`z1~VgMyVr>UzZ2rN%wu$#JSf*`19
zp1P`jg3$652D7QFCI~N2VKADyYJ$k}6b8Mit0sspPhrrSx@v;h@)QQOsjDW4FHd1m
zn!0L&#PSpdxv8rrNG?xdkea$`g4FU92C=EDCP*(&VGx?SYJ$x26b8Pjt0u@UPhsGi
zx@v;l@)QQPsjDW)FK=Oxdu%X)gMnqaCj-My7KYdZPZ{bNG)muSFvv61fMV>i!UO>Z
zmP1Dv7#J9rA7Nm3oG?M)joSZ33^i}m{#P^99NNdgz<+SL%l`~;fHN-t@()x6Gqmt5
z|MHLd4I9I1#=6Japs)jl3XcJ}%y`Pcz+=4p%inKDI2ag~fm+d;uO%657<hJaFbLE?
z7Wi1esPabAW<N(LNZ_%+#|#Lc2gXleRCyC=vtIzj4|wy^X1@rC_2A7-oBa|X)`d4G
zZT8E6SO?zhwArr!Vr_V{(q_L3h_&F&Oq=~0Al8I8O*Z>=K&*y0MK=2lK&<+LH%T`8
zO+d_qH%2!5EkG=TH$pc1Z9pu6H%d1989*$B#||Ge7+Eece7FK?)qG3<v#&ZZTw?fe
zEdWGbe*hwHTmX?b4}i#98$jgk1t9Xy1Q2<*0Yu&_0Fn0-7%nl?e|TU3;yeVkYCb$t
zU;u{)$ePOn42}vPwl4qjHv$yc&7sS`{0#=Nn!s6%$r{Z52MXx=mmqdCxE;i#52-2G
z*<VBJivJ$VH5ot+I!4~c<(>?Tpz?tiT+FGR1lNC%$_HH8<bQYps%)0;U=Td8fPtae
zZuu7m{+(hB+MqPgo3wlvq#dvR_Kg}t0z=&;)(^`TFgPk4V01M2unbnX6r6ga_Wu^B
zW<0>gP_}al1H&7(|Cbo+9y1(Z0P_Xj2>n0BT(_K&;eY+|lK+<+6%Me2O8to-_bGsU
zRIu`m+W%varWmjKV+H|t2BGCG|2OQEXE*?=tbU4ulIu<}1|6`&#K3+M2I*8^@J53{
z8d7#NhJ!@vyFsDTs0L=YLMr9|5HXVj^-mcX>Z_N3`QJR1@c_f}l>cuaEp)J}nf^b8
zwB~r8O$`;0Tb}a&?qdc4d9WWCmh&;JTAuR%3aJ0Pobmtv<t6{mEkDU%59%-SoCD>2
zp3}>}Fz_K+?!Nr=|No8?CMYa#`M+ao#{`AtDfRz<Ol6p$x;*9om#3i<)WBu^`^O9u
zG#KP|iZLiS8ted9zv^ah)c)TE6|g%vz#+xB+>=29<f8)7H){W{G1R@e!obc{zx)=c
z$?^Z32g3xV0EQ219y3f(V~~H$@L>ak%HsndQ(<X=rxxtQ`YMni>g)$DFfcT-zfohj
z35vG~^B7n_T?w6RP~8S*m4V6T<rxeNV6`l7+T`{!g@RhaIu#Kd0t|=v85lSima8!A
zaNHrl0P6SY`0V6hSOHcMzLSHYai<tV!5cOPJ%+l+3JVw*#2gJ~Fo4^?YA4>PG0bA9
zdl~~8{D@%K04gk{AB)dmV3;Ds2nvVCN+5QG`3ycOA!)+^g9ZjECWwUrAk|0yUs?Wz
zq2{qVNYxt+1`UR~<$N5VicL8}d<NT_gA5f7Wf2Aq4AMqYOglLkDkm~kNP<iWsAt%~
zAi=!6g+cmF8iO%AxINRb0~988MG*`QpiTx~6hi~UYsLi(3|Y&$elP?uG%!5%0S#8Y
zVPi02s9T=(|Nl-A2DaA%pgImzUua)^tf&C>AIK!N$Tu1cvf$Q)#_}u%MzCrHuxf*P
z21e~&0YU~0pnwJimG<QTCUDP;QF|YV^(O1TA1F#bY+zt{bHQl8T_`9)HOMXh!k_?(
zh=yQT@3&40EF-x5%fEh*N!)#p#U=O{#NJ5!f5cGZ$RPgz^#ulQ1|E>AdT=FQ$N0FO
z;lmmRxi<y|pyE)BL1(8JgD=R<DhJ+ZFmOP!QG@I9FaOd&qMUb^fBBb!*(|RI*MhaH
zKw0x!`|J51JV1@q_W?&vFfc3@zohnI!vSzIR$VK>w4Cez|3mx?jBWFlt1!H)U(U&(
zv|N%wd8Y`2(M}cy=R*!@X=&-NLm2ECcwW0OC^2wJxk`jAk73}FcqILF`6~v4<ys7!
zP7gn<f1|?CBwW8!ghAzy0$5KFSdS8e5(AHv>T(?hE{PE7pyg2v2Ftw|IGqANtb60a
zP#|2tlZ8R~kV4?=R{7UX4D}#ulo(VQxTI8eiZD1~SkEKny4;6>OCm@*1Z)(@^1u&k
z->5Kzz>E?|^1b{TV!0E88py#!Ig0!LAE&_j4{Ht?WZdpv`#KoxdSwP31}-U8kc%G+
z$p86Y_{QshDcB;#<=X%M?_^<M+{wZq^oEN;M!shG7Y6_3(*OUx;bIU4^E{Sw|Np;S
z`v2cITns#55&Pxb|NkwQ{{QC<3xlORsFG)VBf`KcSG$~(L2f4tL%rfoP6h=>1_j3D
zj0~WBAo_;E4%FlIU{H8$Apie=p_Ai>4LeyFgqO4b|M^CXfs46z`4<L}oh%H7Z&Vlr
zm}?yc3>Xh^Dkvx@1TcPB19h~}|KD=8js_pVgO5F?ptMsn7nC=++~94g3k-~0_Tc=V
zy=A#30~4qu=Q0N=RXKua|22SnFg5F6&;Rg)k%j%AqrwG0Q12L|j`6@74aPc1Ex{%A
zc!Pi+!^Fo61OgZ)KAs>D#4rJ*Ms*&jrU0`F-|SM+=Lvhm1+LP07&h(XV5r})lZRpN
zW9|9>{}+PY`;>t}r4^C(>+diB^8X;L(fMJ+@)SnH#~VHzVVLlE!H1&^6W+|$S<e&t
zc*2JR3{qfA(&5%wz2Syhq`8xWL18BkgYM%?>;L~Rd~<`5|9=fQ8!iI-zs7O7B{*&&
zqgdPCs4*%*vR?g6kfAk<h%BVSkCufVQIvz~>q*W+S>WV|$U@}jAaCJ%Xl|q=3z3(D
zmVaRoST6m){@?O13_P%G1M0USWf(Io83sMS2;s{w%fEno5qNS+{Tr05(ghv`ss{C4
z7&*4Uv&vHjhAdTB9^qI4N)yVaZ`A&kFw`C4Wnko(e~9<#waXuur!eq?<d{KyLw1Hb
zSe^l^={>}I`RenJ%Uc+@5Ahzp@(8SYdA%mMx5@%G{3!zi%O#km<(drO!E~0BkfsON
z;L9*scq0=&oc_iF)Mb0T0aWunUZB9jFk!hQ1MBiH3|wHbiH{d3FfmMAF3G_1c%lLW
zBy%dSu3vtFf#J;}2Ezp@APbaFFQ5JY|C>n+nhR1ve5KQG)EE>YolNDuu&kv#;Z2vy
zdT{@s8=jk+c5*N@?BrqS-O0hw3DT>4_DvH5>w?tfCm29&2%XpcA0B`jw=k!J>3T#n
z88nRCypx4t5vUgX{C+13!=~l^|Nn!Ak3dZ+kdfRWj~hN5U{HC}!SLyS%^MAd_Y8H9
z7l0a9pt6nqE^>rr`hf~G_RBk27&Jh7mEzv0F^hw<HKYCsh)M&7deD%oK6t_*(`<Pq
z187W^QGe%hY0${;haC(m2Ue~;dHwQJj}HsLLy%mK1qF<c8$K*xP<d0qG+m<R^>GGf
z23}Bo&pz*Qk1!L%#K&`lSr{fh&JkvV2C@>!D_|#lebWgp0Xd-sQ`63RNT78)awIUk
zVPVQ=s(IXz|Nnm>$kmSxKI~v%0c&JDuz`W0cJUiErd^Q8P`t2Q>;IqSF8_CdT7)}A
z7}6duyTHI02^xw5wQ)eY6!(GDyh-~1=|I`?FaMW5R`{?0Jeb1`3K@NOkeYhMD{s`8
zCNR{!sbH`auX!V*u!jNE!eL~$czjWri(%s9iOM_-6CWQ`=7ab~X%8fd7#NiL-`qs;
z&83|j3>S9tFx+zFJ;3mWg+Y+1=CSVi|NjfY)(I@PRsc6b6lcFtV+x1V8v6CDkJSVi
z7z;se;dl-TC~yq3fMb>A%_b%fInW5kZBYEOy@$k_0|ThL!S({ACnFYQINPJ0EDTy8
zzG5z-?x?xE{0l?aYgy1Zhoj&Dfj1oty#H$+Ul3pbS5u(epjpqr0?r~JL9xdR1VGtF
zlY#Z|B+%e9$Ur4m@G!(v1_mXGH&W14FAGogLZCkLP96rC#|J@G*qalK-@sK1Bil^4
zV=pi;vP}Y+l>zEyF|zf*hAkAu-_&a`2!hijLrphGNhQ;A4RCu_>2>~xAE4~=nBjss
z!xRaD1JVo(4F8tPF)%p_Tu@k^!k8N&@L|m%N$`lL0E2vhz=t)UWXKllC?KE!N)^k$
zFi3#X0=T^^z`)AD3l1ya$BYIb6BQ0<GceRM{BsmEP<W%p=*CnB?sRedf5BXbEvRsW
z)Bynr1{OqkDXs%WBFHO>jd;RK8Wf>!9Lwv$W1I>Mk2ivX52P)<4CG4J-#b|tz~ht(
zZOio-7(lgkP2lnrMxEt5!5L8!WPs}nNFYNJR(d2@=e?aQ44NR56f!|-->5PCW~h6;
z8k7n^)0wX4c5*N*fO)Wf0VpvPEC3}2Nth2ooukJE3qWZ>l7aPc;{s@Lspz<qg#jFs
ziXv~s;c0;#nww#1LGtm${{R0AAqn}-jQ@`RYnJb4{J*^A|B5#q4050(xPX;mD#(fQ
z^&j5oGHgsJ12w52Y54#DzjALh7&bE0J-)DjongwG8=yIn<zE<l9vggE!ypD%#r;O(
ze*;(*7sJ#y*BERV>ZYz*02<#ipSo%RXnf0f>Z%2x;Vu2Cs}_KUx3s6OS^yf}QlGkN
z0cdzjdFrbA1)%XQ`KhZGfX27LvEpiv9H?m<z=3KC3sm_7;6T;*9|i7EMS><%L7f(m
z{7x1I8<4N$^4_R1gh2`_`G!qF47xid7!EmZ*uc2_%YQpiR8|Lp)Ro6AuiwGIu>2+i
z10=8@xqkVVe|&G+7&!jdEY|>yUHq#B&x-Ief_sP6;2E*<!sQzO|1AIVFaNOuC;@_u
zV>%5R?_xT){L8-tutk=j)-sr73mQuSv;09>9?Y_<2T!UiFfdeyfQ%@2gH|~ThcrR!
z1G*F#<d=W>XA3HRt3X4J;3QdY4ANZr>A=(f|9^V!6k`C71yyl@Oep&blB<#g%UQ$6
zfC50G)p{Tm<szV@%hC%D<$BQg{sjg`mNt-7>hI;642+-vX8{kP%Y!B+paZehLLe1o
z-$2tU%fB#az}mzYVwR^ch&(=UArq3M<W9cPVGv9xo62w@X?Y6+xKmoK2lp{(Y@8MB
z7#@&$^=0QkJ>Q)o3<|IFA@%cPfeR@N6CVqJ>bS=Y7t$CeK4$o^f<fi+f(sc8;5NPd
z0a%$RKlyRN1yHL$;R2}Df8jz9!-SnI3{4=T<=4VW0{I4TzENOcWDy4Y8szDx3=F9)
zp!N^A<H5oX(jqqnQF>Q>SpMaIC%DdHc^vRz1p~_gPEaEYG?&5r0W^9GD(#qGM=}Vo
zEKdPXLVN6FVd#0I3a*q`p_x(z+V<CYd<fk3F9XZ6L1ioJcXBWk?Brpnc2p4Hczpdn
zsJ42_z`&RQDx-I@FxWyu<-nK!|9@`-1zXkj<zN1%fmuhFfBB!t&i=aog9WI&{XYQI
zK6-P5p@q5b0H?hk7X!H2qQJmV_4v&V1~y3Yt-25LXenrlhoR~=c>JsM9@r=Cj~N8~
z!Bg>{mbWl)zF}kFcBq?V_+icRFATzyjKDN#EKmSs`D~xZ0tyTa9G4hAtPx<CWdC8U
zqrrzYAemMlumxMdX2w2N099#6EEpJO8$WgsU}c!#s01GHT%y46SV4fT9yHer7FY@z
zRuy1}D_90rzyXneEFi!MnhXB0+<^gVzzPKhM?tX8l>!W)`96^4RX&p#KCA*e05oyK
z$SjK--zk0I3~Io@$Sep_BRdaN|3TAtl^IB=v=dbSE&swW{mnH7QD*R5F4J#VS{En)
zl?cmI7&^d~8G>~bfPBjI5}^hxX96C+XA}TAgQ3cDc?yH_R0e@ku$;~E6b6~83<6~b
z6zUlms_d7iFo;fN6etHvI)cXUA72otg=8mLRY_g2xZUy=$lOh-1*rMKwDIwV0~HJt
zA1^pi1?uk}sDb1SIZ#Ono=cVEK=1E9UT`3ZVdCS41EBm>a3GCg0;v55=>gxK4^4V<
zprO@6AfL&;c(VeWS~;MpbrGoM+R4MP=CM^hq>ZQxDrSD=>=a>8dR-40I|eta+2LbE
z5#V$(0h9t}nLs0K0jP1Sz{oJcQLr8ygA2g|OdtU;e-W6^4CgNf^I72hC15@%F+ozm
zQg8}b01Br{-$@J~mVumKQu_M+M+s092IQp2poM}eNDGr7D<bND{|9BYOCW!|T?i)6
zfz~(7{6F=-01s#i<%k9Y!^{hh859^9rZ_MN<bh>hz~-?S_&~E7GhZy%WMGA@4SFNS
zV8B@O<_3c}L(OB*vMrV)+zgC?x4;Y5><{oTa4;|~<!WF6$<;Hc9J$TF7<d8X_R=1(
zyQP*(GB7p^GJ~g9D#87r5(m%<q1X36a)A5;QpLaw4`OgdQ(6Za7p`;x$rb+udF0JC
zkiQWaq5g;j17qOyBODBjf%OwWu3%8%eaMc8vjoT@1h9dI%c08<Qoe)Mf-%%B)dS4|
z{Qv(y`2Z&e17kx7Xs)P*!5U=cTShRc2M(inln^vP3qj}_p?Xk<0UU&&SqkJJlx74E
zk(7cvp~aw%BRoth?tp!{9pn_)dV&A{|4V}`|6hUd@p29ZnIr5BjFEDnEE*~O)J1@c
zfh9mefG5B}K;Qr;Lj^-U>m~*8N-l*C1qK;VG5f|D(}0M7AOj+PLkxK8A;81n0M?GF
zTLqz;o&ELt4*}q!Ibpfh|G$Uy|NsC04-}EhT^P>qWMa4iTK_e9Co_ZY@<;}T<&q4{
z2OJm}BTg*mVBlT;g+a)P&w=mpMgs<hGRJ@iOpXr~SR4feSe*7a@V$A#(9c}sxFLWM
zJSF#ixe7z&<AwHr|4(_djDd%%&WY8556mxfd=S6{8rIm!!ti=03&U1W&AF3<;h@uM
z2fjBa80w>#Y8*E_Ko}GCc%l72xG^9HfcRhsK#hss$-=M?s@<2d#_>P^<Dqj54E!KR
zI6mHJ|NsA#H{0Nj0P&F>@n$Cr!%?soE;7h8q|`eec!1C@2lnlhH#`2fa@Fl*VTjqu
z!f<Z+m;bGxCff1{aKjrk^cV*nz4;4jR)9u8cd{^m#8{R~gU8V>O0X{HV&DVCeS{J?
z>f|Re2rw;=VqkL!5a0ksqZGpdPKGk{_<#EU|7%c(OZWBq4<A5Tjh+4V{tpq5I0RL%
zpr%v!Pf%-lxhI1Hs2~pi1WJsF>B~6;7(f<=zdFFlz{J3~Nr8c9lM=&*jtvYlpoIBa
za`~?Re-7>c|NsBr<thxWj|C1$FifZi<@*-L$BYUL3}sFX7eMR1BpD{a`HYVR4oD&K
znI3~WVhDNW#{vgrkmOk&3mlL|;<G*$I3S0_XL~GgKpu%-5Aq+lpNB}dC_cV?$c}-5
z{|6}9EO%jGS$>oM2i&J+pt-K_;z<k}m=16<lrw;G1NSB+27wL%h@W3Aa5UJ!4{geT
z=M@rd9y4s<V3@j`>;F$sqp$w;en>YHVLdxLe2u0DsEmqt2L=2a4hBhvn%4ph%nUpS
z^c0TFUV1?Haq#!^JKGqTUK=p5K;|{dH9?V42wLF*E<MYw!2D&)Pckro92>8=d<8fa
zfo02nf!jZY>5d8?)<ENw8>AtjX}KnY!*WXo2T;uYef%^6G~e^o<-;n_1RaCICe{xN
z4lpv<fy(d=3=BMv89ppv-~f{<o7g@qfDG5X28pUp<M^-)%+fz{nt?IyA;`p6qEAB^
z+Cc5bdIl9_#Z$h+6oXnSAO}oh_^<|~<?ljJ)8ma0Xwq#b2ZJoE0{TC1`4@(^<uky(
z;(f!$pdeibQvdP^)QXn>7abKotXggfEw)9$3znw5Vfz1Cs_soa$N$$1paoIJyr4h>
zulTC3TRsuI98-1qtpERawlIMDx(sFWoECzd!oW~)VfmN;7j{lzkbEQb{|sjxNX7D5
z44^sSRiNbD5bDGTRk?flm;bvVj{CnIn@8&z^kF^)x%#g@#OnV&J6jlLF7ISuc&zbZ
z4Wwn0H200he+`B@$A$*RH#7c!O-KPn8z{Px&b(3jFD+NU{LBBMogxgEK#nNA4{AMw
zWD6=mGi0y(QPUYTk=OtJ_uzW<hb14DfQpGYfvFAxprsL)mZvZX?_^<+T`v8<1hi%u
z9Pbg28Sa<;pSYZt`30y(kNpd_Xe-!~a*!n;R@5{{p$iOC83aHpz4RO}U0__k13bpc
z<tPIYcf0_WQvm4zkN-#2g0dHg3+ur$=)4vJO%Mib{IKMW+W)7JA)3M#kOc)o%fI};
z1G2ghJd0nz<*4vs2`KdbWr7=G`#}pZ*#Cjj%knS(f537UqB7da!mxiQ3xm8PgF!v#
zQuhBpc5*TZI9?D~u#<)1<4!RK;WrWtQ4BS2n87na@(e7Xmd$b(2Gb)R3=C7F-vle{
zWeDBL!tfU4?8gfZFfdGTTm@PQ@ql3g!(&j+fbki@d{Dy<BF_ZogBo@aK6Cv722h>m
zc;Enw<AVn*Zvy|{N=SLb!5|G@km9?OgTZkp2ZJJLecx31#{r;$<HrF4;Esm_LjZ%L
zg9D?Zf&$}m_Wz%kb8vx&Y3d~$m@j}L5xm$izh<h!1@IccL*S*_ZxrnJD}okufah8g
z>o>k$zX4j(V=3zyO2CV)^1GhKfOZcoZ()!D1$@CZP(<YWgV-fkKqUv5?+)gl2eTbP
z?1Hsmw)OIp;Ay+P%fB#)?-XIM0m+qsXPN8s!L9oO@H|hxy5oTZjE);Nu)I0JAS_?=
zG-d+}DB=D8_U6$4XPmVlZBUh<G;kNp2d9C2E>P-$l%=3X%-=Lftb-DD%nBz30fr;i
z42&_$5$#{7e7yhzW6TW5TGcn;RjQ~;zy@@{<##ZIqRKD-{XYU!8iLC{me&Fd{0uw?
z?3j2wcO9^eGqtbX*~Y-UlY@Z?lwV?Umj7m0fvUeAWB{m?kBI{t1M2m&yfy?IBL_A{
z7HSM=;svzIO##)A<(kYdkd1_mc>L@D<%r+fpfD-{4>jkl1Vx5~7pQSMMHpIs)~7&P
z@Kc0AEBry}9JIRsjTpl}M(`GdDeP03K>Yw#lgA7Kphf9Q3=C7)Jp=^u-Y9?<qpLG8
zO#TmAta;!71H<HBjvGE@?3~K55Ph9L;~Iwx2f&L{C%*uVplmYP08W(kpp~g_I2h-G
zR;4n|0<B8@l)Jp;{}a#x)XA5@E;a(Q&w|+8ciw1#R(pWhY-w-Q{$F6Mi(vSavvVo~
z!<z;FPbQQ(Dtr_GCCKHTj1eGJvC5z(OZ1il7Z@0$H-bcXjNYg)7BbX5Hn_mRP(R_Z
z!v#i$36BFVFfmMc%y5B~VZ!5t3(O1?9t&JxVVDr0@F@W@`~nV0LCCNS$e7&AV1vO6
z4J~aqv3|;U%y5B;LF6&RrwoQB@S+V63%rmssS&Ijyw)UlJ4m;x2Z%JkS-<=S0~crq
z1Xuxh&?$HMp{op_PQ?+%I7fqz0-*Zgsn4er$W(-?#~U?9x&L*K6+R^}h=6<wmIKcc
z8}EXt2OEC+jmG~g|LfkUF|t9%0u9SR>xdl{K1wY2WDo$UiKz#d;U(ap%FPDF<MJ;I
zzm705FiaK$ZIA%%jhHM55(mdG4=8@o<Cehy7PpiBAjd5vY8ezkQOh8Q8nu(aYm3F*
z>OpZk=^@B1Tpti|%UT7A+vQ*WOM@IU=>o_xu)QCXPQn~C=?DP_Z6V;GdU#@+G#}&$
zv43C(fr}%q6-W*;f;s5lWw3)fpbi4>9+}h#cTf!h2j!qTsGdRQ4F`@O3I{uA8`wdC
zAU0P5!a*#r;0^+><thR%P|4X1>R!Fh|F#0ucn77aBJgZ!&U!FAY5AA`??A0d5U)5M
zy#6t#=*<<-*mVTMrxehb7fan^g^vOZVjv4`rhr8`7`)j)%SFRk>K-$I<lY!q?AHi=
z<6yDhAoNXu1!&b^3j??tUIeZ$ay*uQVQ>IjBE8&_0X#6910HxT0+;$Z8Oy&gNWQto
zaJ&8=$Vd$aF+4_s*XrlUgB-*?17v97|K(r)cZ1Tgqrs;PkhqBpn5DqLP_!Jx&jGh@
zi@=+5a+si=kO6x_1MCTyjrG`l0nUio&z65-5Oh@dXaF|+DFcIvAeg1Vz)%Ao<;%Y6
zsPHiWWMP=f8x00-h8jnMkKm!^B5<{oeH8566>qNnHvuhPgR13wqXSw623pVpnp_id
z6#OVKRbRkic?*LwsHUH2wVd+-1Gv)R*eSx`04dWTlPpXVK+8@T>fR_ZMzVue|2V;|
zggClqxuyccQ=gAK4B*+mgn&01494Kr#39EG`u~@1|G)q$H9$LVmfvKk2Q?JHgX&RJ
z4saSUFfc8bU|`x*3n`tUIarPX)ENb@aY}r+{0qayrPu%edvoo-^dInyK;gdSU;ayg
zd|Ips3XAM&aCh|!!`{aU8v+@oJZ9Jsz%b>pz=j}(DUTI41T#ztNcdI~!0@d=ETKL?
z;9HJZVt~T846&rg3>!kg3PZsP!x*MKHrNo(FeQNDTZ&jhfWWr|u*w**qyU3&5n{=Y
z88$?K)klKWM=?x!+^``UtUd&+J^-xVM=VJ!<8i@;7=|g27i@@SnDThShB$^Pk2h?H
zXQ-bdmM)ehmMNAE>ZO5PpIG=NgCUWjZl@Rn_f9be$(>>hT06xU%y)`0csvgH=EETN
z_`$aT2C>H%zJ)M|JwEU)f<f%@hHo(pVviSmOJERt%<z$cLFKW)haU_oj}<<AU{HB%
z@Zkl6%43HQ4;WM)2Yk4}pz`>^hYJiUk1u>UQO}_A_yA~1{qY9SY&UoUM&&WXw-k^;
z;8A~uZy8|r0+12k3K+y52Yf4G5PO{PEr&r2R0YKZfCj3H%0V?;j2GAo3XTjPL7lQ4
z3@VNcpE4j7*i(-W8yMt4X$dsJ5n;4El0oD^eF6hxgaN2$!U0MN;6AF)(#H-TdBAI&
zj6ljA10b1<aqH6<P&EW9K$fR4a6qackcG<Nq{eyn%^e0FNK?JQ5hR{f0cwPN%LJv3
z0^j9d{%$#>&%nU`543S@xe9|mX#AHk{Nr*<1#s^)95grrc0%M1(5whZTcHNXwc+=d
zdonON@ooTH6vp{R1Ge?1Pzo%6ez_;4m<jiOqrtF=p>DY*0|Ut1oh*<AeNo&H$D=x2
zsUE!hfwOS=m;cK_ff>FUTwYCJU<?Njq6XW%(O_5)%|2^4FgO}aU;;Z!YZ3!wO<(49
zM}Y&3Z>0WtE=Yx}odvDyUEcB!+yd^8h?t<jvit;OSO#P^sG$l9n_&K(ObnYq<9{rZ
z7&d?cAKW4jVR@qlnv!<Buz~T-Erwi>p&J+(%D{$}{0C*fWYE0Ma!Uqq2MT0V(5p8Z
z45?5@DtruB?#ajiavrP)82kyeL>Z(q`YxyiAi*ik3@umc!OZ}MEKpD8&6&S180tW4
zoIyRmoe~VvZ>0WbEJ)oc!l3<_=>h}X5p$P+`5)ux@F~MF;Uf<?)C8AXaxg59WROP`
zJf11oQxU@yuw94#TZ1Mr>;HmlrULK+gv{jSU;cukfuR7rf+aJ0`Io=*LBX95PEHJv
zMmsz5P%X$mAQf3tK>o`V0wuVI?_sUr{|=4`A2xteI>=Ix3YXfQLJXIdyD$iXk|Ikz
z<8l`U5l4dq4sV>a_M3s0UNGeUhRs>#e*tO9cmb*h-e@rJgSV1^>$Ut}u!NOy6SNc+
zw06!h;KKsPgb!;#xrqT3p*k=%Zr2|hfY*McFtCC$YyM}Dlk;C3cv{cEkg*e#Bwpvk
z2HYT?g!$m#1L&yblASCJlOewN|NoIQXdU;PISkjqMROC#*FSf@nZXdq2-^MW$53~@
z{KJY5D?rv1$bvnwO@a%we`co$g8^6++%V0kuYT(DVF?4{@(KpV<rxf&5^SLLsXIj&
z7+!-{EIfAHz`($=Q-q-ntO+#u2;Lc!5&v2O)IkTWZwM&-u;fkV|0f5^mTN*XVa66%
zm;Bp$&~zkRe8rnih8BhLL#>boE(3GD#EP9F3|y}#Ft9T4KDGo|2C^vsDcH@rk1aQF
zfS1g~IW9Qh07}=8>30T(pl(o2*}LYkg8&Pp9SkYJ|Ns9F+G26(%@qbOhC0WY8yFrN
zOb`H@p}YJR|No`eKQMsJ5n%wWr>Y09S_w)88`c)VAiyHc3(6WG!*;SjM)m)JRy2SN
zRAQ)myn%&7KxL;G1FzKH#|$h20xA->9~(@N09zmgnm1r+SnkQ(0CIki)$%V4;D$(k
zKZu|H4YJ4JV*spimakn8in)LDAaM@zd2a@yHwSi9!ea#iV}=PJ(dEDYGhC1Vu;9Z2
z2_Z*?4+}P#Du6ptkZSt>FYr3)6%1vM1wO1~m;zc&asYJd0*@Huay|yI%0rx>S#|I}
zbKchq4E7B5T+4qmGJp&RIbkOYL(pRb1q%j|#|{bx3@nco6f_vbKm+s5Dy$4UnHiXt
zbN~PUngO&__pw5N0fWj;76t{FZg%$9=RYJcs4Nd;WLRFpAo5s1L4tuLf<b}h@dW`U
zhN(->GcY^``EmN2H}d-!Lml`8Sn3}$D6oK)3NWy|egIk|^4LxQRDmLkgT^;`1Dpjo
zkX1{V9<XL$`1k*{14x&Hi2x6>EO<<m*MV7p4^wnG2Lq!QvjCq1vp_xHYeoeYhOFg*
z42&S*<s}T95O;fl_w@@ff&B#E(f?RLL4kqgF$2gykqinP%TpL+Q9_IX7Gj{V1ceSL
z<RD?y%)sCRs@6b#L-v1<1wdQA>H`=QIG*|_urM$@^%3A;V1NiebrIlU0Ii7!t=vNj
zV0L!c;&SM)1E^SGIl$*EeXr>N@AYjaw|BNND7+40kYnIE@PL7#$N6!<0|f>SQ1|3%
z4CthU<wqDoL2C{{t4NlwWT*$N@Rxh64chk<AU%O2;PwQTr#=cGhe(6Opbn8>V3a!O
zxL^U}u{8_~J(7+aHaIL_!l3$i!UGNlmdDZ)Kw%;P4io7K9LrPw-+XL60hEfoCxB9s
z_5`F<^jLd>0fP!SEF>5hKx39yL7X?oK)d;#Mm$geZxsXW`d<YShl;fPUkn}}0s9y1
zM<I|O--!O7?vM(OxGxMWu)uviAGs`rkES!czRbYJ!29@u0tW*JNbOR6i2u191sxbb
zh2um<0siGJ47EE&7zADmf|6B4paak2gANP~ED;YKICioyEQr`}f#uCob908UH_I5r
zLF*qcfEHjGEMQ`o3M%VB#q{Hb3k(d?-^>7~@|_D<Kzbf8xF7&7Nq4{A4Kn%h=>-f7
zD)o;KTmYs24Is(aXFw7GZ#Hl|egGCd01}nhdSEv=oxcOgI_x{ZgDm@cA6WGD0X`H_
zuv*Z-tJl5*d=C2#@V#cd088d2|GORsfE>O21w%cf*Mk5i2k<1>e@J0;B|_kW2Besw
zQX#|jx*vHHFH-d#QNL8in8A_Z!-CfaptCO^!z*vh7(^Iq9vdhaGE9t6P|$hfps<G_
zba^Cb1fPL{e+g_}8&s$=yMhWX_}p#;r1Et#_^=?r;lmP#fDen_WH7KY)J;<Oun=sI
z0LY#<Vo)3Ev0G7$Vuc9OW-<d%>o<ZyK?k%XscX99fei+b?i3?K0K*1QjSuc81^+t0
z_e6n_0kZYTk>SIJ*I<hS4t&`1MvSQm<h>1s3=``k6gHsy&-9HNLlQ%s2g3$K(6|<O
zKYI#8B&as%ihnF1V9YS(jSxd1M;$2LcQObtEN5h7Ti(Lp@zm#{3#c5qpuxZZ4c85?
zH-P;6SOBz0_supYH;}~_z@EMUvbP>7VEKMdV*GII0G}ZP10&Sk2R<AFyLcOu7P3Z=
ze^4WZ@AexF1|dk>Kc{5*7ly3|6c`wCVn9)p(zu-CKWM6Q!()L9#tc(HS?`SmgE(W|
z8;N=b9*(*<VhlM<b<0;UC@z-(PZjVjU%{ZV98~j5FffCrU6-$5U;}kbr!jpvc0dp8
zKn0MG934Jvc&!5RVSvB|h5&{O0$}H=F<wS??i&~6^uyPNSmcyb@3j02LxSUk4=X@^
zdg}9G1p@<k%1KU$fq@kgY=`*%|Ns9#V8Vwj%T*YcKQ@2`-%c@x1E55?lZ6318o(EY
z*tU_Qx%>-*2{;T`mVfzQ{}{A{OD=@r;)DQ(ixa>+y90cJ4D}4G(4c1cumQ!QVib!&
zZCKFG7jIC2@~OSi0QC{T#)H=fBwqv#EA0fYBKyd|z{36y>J`QhYY^rf-~)RKyc-VW
z@PG*)>bJmL&->?%+W)1{CIrZ(Qx3=p!ovVzNC3mdDd4b(1gDY}40bzN7{Jcrz5Pb*
z{|<&aM}~_AOJ$T8AfXq)@L>xmY$562VZnz@Z^Rf`VbN0`p#V;YNXd|Q2O@s57cc+v
ze-d=^;RwS~M}`k490fj{SYFA%@OlC$-a(PDQ;cCFXs!%Ax0%TR+GfcZadf8y0~aK0
zpZa{*A;92}@L|tWmk;|GK&&NCT|O*hU^r0EXT$)i&p(_1b(KFX31Ike=FK#QZ7}zN
zoCgXjcqnDPQDd0PQ1@8i0;uL=_^^jz>Ltbx`#vmt3`&qJ0UQDrj~PDfW0)GiA;9oh
zLqLE*1<aoaX^=QFD=<9f5Rd?M=0EIXm{|Wf;KL3Ek=HH^j10UxIT#!qSsj>#U3ZEx
zxa@3TaCqz?pa9MZ3=SZT8la_?PhAw4K=XnE3JfeyT@*l>RRhWfiB|})FsMAP5HJ7@
zLVz3z@<M=yfW`qnVFm_)#|%)fZUB3=ej0-#%&$;?g5#10wAw|Vq0TWOf$`8v28ITP
z#|al07z`X68XT6p{12MO^5K}H!-r$bEg1|!`j%&cdpzLvP=6f}5t#LD`Imp2K{<Z;
zmw#J82{!A(@-P3u^Q2k#mVc@Lw-l7388SenI0S<mT%aSFA`Tp2U}%5sc;Nt|h*dZM
zDq_Js<v>4p5xW2!c?%#(Ea1Y2C2zzSOhMi{050hcfJ!=~6vopDa?l$!23dxB&<Zz(
z_MJ~d1q{JQQ3$~cSYEUOmV<$Dc?nV@<2=%0Bu<FaAtbyq0*{C$hk<&0Nf$ugOuPtc
z?%!GmQ3oRHK?HOz7P1uU5J<@{PEa2o+)@FzYL2ioFp2Mf>Z3S;K>;NH=io$zjgyy`
zKxX~3qQHh<29*KJzc6Sz8f-KGEn5P0Vn8y1O3P0$I4sv>{Q=^IMT56vg7(50EwA@v
z{jofffeF+F1sVKHclojZpm|MjO#Wg61r)egfi6=38Nl!xK9veua(QJZ3&UoR-k<9q
zFHqoMU~yFVunbZsGH^K_SO7i)D4-I$Lz)YeS|ASl|NrN=`sI;~u&%N-q`Un8|4-0L
z9UYL7zrx<AF|ae#fm(vgzx@9ep|BtWB>uAtJlqN%e#`<7VI+ovdc@!k)_O<@2ntyk
zhV`bwi`_s)-eIsQ;g9P<jX{>j0v8k*SdJ($Fp2X)+V-G1`!@;<1r22p3>O%dt_P=X
zFL0ZFI)lR-6@@*_q049d{}we#fI~v%&1?p-17)Dpoe7>9P2>mZf|_c?z$Eq<)NS24
zok2lj_8TSHJ<OpIMFODn6|(AgPG?AXEC6cffwu`LfLe2)VWP)IpjqCXA`G68z+zws
zaC|HPYPCH!05!Bh20m5*H#3#M&CDbLkT)d236v4kc>(SFabOUDN9|A0EHabWJg)-+
z3`dSLFp16FDZ)^%`8xl@1yF^7lxm;;|NrAOVqw{DQ&2D>$ty50B)$Ws>P$OOdPv9w
z1?EjRkSYX*2RTCogQCS_1<-hC#05pr=8K~{Sr|Z(uvkK%{tYh!i$l4Dtc1dw8w@NA
zbrOniIKcEJ@DM7?CFT!H1T&WMG8ixA23I&67*v+>GUP1fW?%+aqbiRJKr0)Te_;SG
z%*_Png@k~eQVctHN-?aEKJn%ZLkmNl1kanZV4HX)WS}+)Nc6s`KLNI^5#$dJDbO-$
z362Pb4@))$F)(ckVweD`Ff<q>q&5XH2n7gyI53If!x0CD4@W04d^mo9fq_ZP1X7@0
zV*haA!v@e{Eux<v3xLLWFR_1k@L|Q{4WO~#fC(Qy>=a|jbTs&|4>VBu)aSz&aGp~K
z?f(OxWX1Z#(cuGVTNEh1)IkCIbMqSw*l=pb2ap39wBBg^p8(#u!z6m(F@pd%!<5GY
z0$dDbZx}7?8N%Lh{BMUe!7{+JJ`6%{)c)5o)IrMya7hBr%=sS;z)`;cLp@||7pP~$
z1YYZ{a=?LsNp#X<0S9gd@T%38AE0!dvGuV6XgK<{B50}6P7Vg;0|5*St?w=|1aK%Y
zyio+NkmX=dzQho~30k=9zy+F91vSy0dVJWy0BQ#xU{G1E$Z!y(FJlULF>e3^Lw&}?
z#{r-k=}nLw<j9F&P`|bH#3hCY>;VjKf^7DIkDmy>#PEP4fB`aa4pNb@^^FDtD^uO_
zmkbP#0~~l5rW^nruvq^z26R5);|HK9Sl+_m_4t7UAH#$<??4WGe8EA2VZ!4B4w4KL
z-fUF?*;miOu=#)k14HZ7OAHRI8yMbf1u5Lg!La!fg9F<JhMgP?k1sJe@IGL8{TAwT
z5MSg0!<)BIl_0+81BTackmO|^FuZw#Brp4bVUmFZ4|ubK0|P^bEMzv|fB|UyPwq_w
z16u)j{c45`WU}C?$A=FL3~wYD)S>YyxRZqeT!qAKdvgO+WrN0cm)~FjpKFr`9vzKa
zxl@FJ7ra7@_p#xJ1q>{py&-SR{(oQq?UYsr&jW!=%=A}q)9U-*++dIb4;|aWjRWuG
zjcY<N?f|lJpcIjQ3X~+{=7VbpF$RU#`yu06piT+OvK#0z9RDOFz*XC~MW7y3zySqt
z0bl<!`Dx5W7Y5L2HqlRGE_yI1EKgyG23wF1wjlp$%*6%<(3UeMk&}-PTm&W976$*v
z0vB5trg|`3Y`esKfaPMx5pf14k(~|<2bkVSz}m)%fuKSv9Xz`n2Rg8fNn{1+xQfRD
z7yTHfg8Ei(>KPe$ASHLAHCXXYu%)b^oGda4G#(hra4}%{5k@PJlM*$-YR-Yw#C~4>
zg;5_Qn$EEN3sWDM#ku?oQ|EyO1||_5)FSIZ0RxlptEIUNIZLw{n3wKl;#j(yfob`S
zdIkn?s};1RT!g_AY{&+%@kbsrfLytJ6$9hWsSLB;OkiHEPzDNYP+LI6)nUN_rl&p!
zK;uR(A9gHYn8fs9m!rUk-A`RWM-PHldp`B~u#bu3smq5$;O#vx7*sB?fB5iW1Gv0Y
zd7J>6raDm1z`!K3_%Xvr4hEIS4HqLASPm#KFbSW7*5AgDH+&Re01p-WEQnxeU|G&+
z&#+tqv?zyx{f&Utev8nh(hLrd6&jcsCcGA8&|u(wBOoEK5cWohf!`o(sRSbfC^UqZ
zIVv;=I~si0vD}k^=ZG`|lki-SCw=aL)_*by$3v~l0So4UoFEbj5d-<4fD3Xuq))t~
z!w1loGf)``ZlHVz^@N~PPU*IwQuFWJHyX@}pl(b7H)tfZfQz9_OklYnctM{8XiW4C
z$Nx~~x}A{Fu4hOGPbtNM&nZcJ0XCxMjRrF-cxy3}h}avB|7Hwz5}-Am%x@%^{xa6R
zVfk;$0h+jF1g8?##|i?Vu4)Q{(i@Kd8jLlM6$C&7&M6F1Z#e!dFoF1>@!=E(p*I}=
zC73~c1qLS2+WO_(_5c5Xw+oj12W_<Hdd<XOz`z4CRyZsGw6W#{1Ly!whQ|H_3mBM$
zSq@BKU=licpwAgJ-q#Bn?|bU<VGpR!4=Q9Y$$xmUf#GohEE<L0K*Es07!<DF2O}5?
z&?B%O9)krqW6)7y0W9v=KyfDo-mdEdng?SNYKB??jymrNun2nUGJy*`=LL?YZy}Ev
zCV(re2}qR{=n%8|r!k;|b(gm=ynAzk;TI_0CV<Lv&=J4&Z`c?<7Sugvn83#{<p4;8
z{|y_%3%0sVtRG%H765Ix0JA{Tt1LU)7&u-tfW`!upZfoQXB&gYYsd(p!2d#p6j1vS
zp?3L~{~w{wu4gz9z`!K5ba^HtXbO@^2($(e+`VAx2JL%XeuQDyV}=dPNDep%J`;yY
zs2e;%4{@0M8xDqg*1D;I0-*hWJ0CL$2trQDdBeuA$+hk=gMbj6zseWH7l!abeq0m^
z5)gq1ykTRQr2yiK!ugY&L3}Ydzsm*07l-qkbU}OxIKL_g#FvEgi~K=+DL6k1>;P#n
zzn<X@8$%M<LK(0Ch#v*!%fk6VV7?rj?*-;V&jEVF#^9s?u2xdMgOXYFoTa=Bj7zyW
z7#=fR1kDC~fgD|!vI{KRyZpreKRZPjbYACwl3-w|Xa5H(^HRX4bw<~NCQ6ro`Tq$_
zr~H2hmfH`?l)tyWQTuNPnlk(ko<oSs1Qo@p;MwA6W6<he(5YUa$Q0~bp2?taU;_h_
zU?-$o!@$6}3>umLm#_T)AC!v(yO(D&*etI<0Xi^<f%g*g#hwWqj~O;FF-!!FbH7;t
z-hwZ{z$BQylY>EO>IMPU<tgA~13G$W1K1+atSLCHFqVUjSNVT$dCLDOU`O|X9Uc8f
z?f(_9qdOxQF7`+WESLKJ|B(Fu|34U(F99{x>p2(#7%uiab@{Mhp1@O&4~xKgc@-nW
zQ<o3xz-zXd1bHEA1CT0|0}Lt$4lpnYoIq*`UjX-kUp!_2wS1QHGBSWxOFd=)FFIHN
zD-i^qL({$S;{%{p7kK@*=gtU*1?U9>yj)m-r(D<oDi;=j7L$R>1%aKQ820=HD!v7(
zp%#J51<wvg1#rO)o_c%gasXPOd)CxDI(*o%+!EXv1{W1yoDr?wlzdPi{sNtb7XoSZ
z3It$l^}<@o$xp!Q7roJ7&}OK+#D1~h!;4GI7gIib0MB@Q`F8@6uKpbXMN#tF15f|g
z|NqtfM(y8EP#pc+2@*~L9}pO2v-|{T%<><2dOAf6Jc<EMEB}^(if2KA#|#1-3{ydD
zfi`ea{pBxsVl_o{`Imol5&a;fDVv0yEDTq7vM?M0^_U+|P>f(;0oQ*5a?rps29@#x
z;-Fyk_z=M`0cWI4z!ND8gh7$P{{=LC2^+TZGz3Ko|0bwCIiS?TzZ$&$%VQ5DKHl75
z5Mro#lL4CL-YLcaI;RHIG1q-PA5_qSPJZ-Q4q>zZdkvZA`~6=7)Rvnh^x=||!H3IE
z4j-;KBz(9!iQ&U_P~V7uGk8@jsJjO1ysdyFT>iYr2S9y;rM&g<p4<-b;+O*rDgg-}
zPB<ETxC9!(c<S@v3<DD=R{tkDI(%4woKij;AW}-wE|8j^%im~#r(_rofGe8=@X7`;
z{|Vl%&%huL+BtJTfuWuu3EUEibOUvgz@4M>A1y$gBjgxF+Q|gk;|hvD(76`ilQKTK
zJ_es5`-X!-gQIRa9|IG}q~$3LJ&zd_1Q<kKZvam^Z2(O=fhQ-DK~DXs1<_Rx+SkDZ
z(#Elz6Fl>!uw0Tc1=O3}DFWXAV+9%&dA%Mq*aTYH{3C6-B%@0NqXL73K$if6e1`yo
zxD<%Rxl@FJaVHN0=<HW;mIMv7KzhhK!CU$N{|7BU`~UyLTZq+fI2d@D>LFHhfUV|&
zTFnBpVp9+U4`?=gc_bq<$PiGc1MGSoM}rUBK!@oqk7NWj#<anrieU0wgu(_55bMK9
z$d0+k3?H^JOaYw*1L_-q!x-!x(7Z8t{0kD)@IfV5HrWhX?eKarxJC5z|Njq@klc;e
z*^*q#SAsoc{${tqeg*KNjs$Md!WK}@ickVoKRd-3yg}zbfg6qgMVBiw{9j(eAP;tT
z9I+N{3S!{iDZy}ICkq2;v$Ymt*A&Q0NFyd7=Nn@)wI19Igv2;J*ug=Bc91;CKu~~#
z(!jrcARf{*S_0VF%#i7N$iNLKa8Vub{xjSGq8y;*oT5y1PwRaYG#Hql`Y5_^Fic`l
z^myu{n8CmTGvcX_VhRV+nf7P~o`x9s6l4Y?SSKUMj5iz%JmBL+1vu&=7!*?i7!+NW
ze_`MT*&@II+C2qI3lShuuKItVg(l(*vXl4~o!&?>@N?963NSD)<>6sCz$?n2X!sg*
z3^l0Z3?993Vo-F3ISv#CuOYiwLC5z${r~@cGsHm<2Y}|hK?_<r>QIvPMbJ9R|Nr0T
zF6Uri3ae*O&{)pLzzj;6prv7;xp~+&Q>bBV4BSk0%kMFPrsElwyZrwEJ~4?8GKIW6
z<^PN2_Za^#Kl1;{q5BLB0^n2e-!RzkR|#GI<^L_T5JRK^0Z68=2leQdr!eq5jZx45
zFG2XfJOwl-r0B#@wzGvn0ok`;AHz?*2F3Y%Zm1(U7@!7Xm<QTj&H9)@(HX0G_3WrY
z_zpBu3EmC-?jGD|UWi+v1(XO%aN;P4ATxb$BtR))xh4a{8!-kUa6}Y<;(oa#qrqdt
z3k(b_^-J{`7<RUU*Rm<Y0v_Z~1V%Ve0^+bq;BoMPfD4czgpWa>YC9nVl()k&K$fAJ
zgU}DE1BEX`>OcX|F^){a^=ClZTpbT^vM?|h9^q$T5<dLY<pLW6)24U^(3#etyA5PK
z1g<dcoXQ}00CY(RqnN;QIppOupx9On-O0?LfNC+!3(J51*N^}$*jWOq88(?97VRwM
zt7m8kWB9NlfZ@Z6O-2Zb<-ZwjfO0Uz2v{Qe7jb|SG^y+;@L|PkLD1}10K<m`Z^Rh%
z7-~Rb;Q4LvJbHk@hb3>!7?c=lpwqOV1KgqW=M2h-Y0CKe>mdJ!f)Akp#f%5Thm|{9
zLCFr(I)^mQ!@wuwuxUUX10rE#yMI87)3!j?3cQ)Bu|hobz+48W|Dff^3JeSZ6F#a0
zZ1|}0CWy6(5j4<wSmM&5{S5#A|5)zA!1^YFwU(i-et8E2gJZ!*1;>OB3qX5*C1f|5
zCV<x}fmStv?l5@j^AX9g<tzUGmyq3LTmVwDpko1pj06{G$=Vy1|4*3e->d)~!@N_3
z0X$q2zZJZY@9F>l=k(y_g7v&v0Xi2NH2w`yxE>q|GH+J=Kl#6I`4^@+j~PHqs2&S^
zSiw;Ch7EKQ<jyG!ilCE%dFqx6GB7PKVc=fQ2wwFi^`_<jI%d%BLD4r&48lxxjt(Co
zOROUq6ePg?16JYXU;fX54D>MNfs$)Hc%x>><N7zYcKh|gH563n)*D-k{TdJvb&#_{
zF79k)umx)ZpWzyEa;F$%3spRXe-I=W2DT_<_hW$%OF#>f1sE7umP`Hru~Upe@bLl=
z52PyI6KvuQM}?0Hp#D>QJ$Pe*?Ulz29~Lo8UC!vhu)KsxWjUh)h}K)q2tFN~3$7g8
z-Ll;a=09a%2-yN=889%!yG~;G2tK;jb{)(t4v-l#%NbcfwAyk;CJ=3~oDsA-jLB*_
zBSXXTl6oeW<%|pt%S)L2mNPOafX?rS8wnm4w`~XWL6+5lSs=?o;g(gvEMpK@UczLv
z9CUX;36tA$Mh2GUB}@U}C@Nu!TFwYQVIAQS@ZJjBNXL3mK!6MnfEykRH{1){d@6gx
z!sNwJ2X$r$*qJ3v@yi*(R%Su1EQMOx0JX9k!%FZ$2DS=ddq6gdgIM+8SV)9hDF{w@
zAS-L&R<=Q{oCvjY4%Eu!P%Ae<t=x-YWgjTEZJvWH0<nVcJvIQP4sc2UudofSUkc`Q
z?_^;BZxs%n3+DHMIuBqiQ$ZQ-%?Z$@EX&V<FIZq(ehzf80wXVGI%i(=Mvak?q3&tO
zM=8jeQSt4|moR|OyNL%6=LXLOI|dYqy&&`JZDxWO%!7QK5BG5;)W<DQANNCjJPYdM
zr5HY412W8}_%XvrMh1{sOW|g%hnlquYSvMxSr@=&)t4~ch6dj=3`4==yf&VX89p+B
z4SfbT^aIq;-w;EY*}#UiFd!1xGq8iS!M=UUz!0qT*x(~G_^uF!c<_L9(96dLA6e?5
zLg2&Hf*w3J_{a(s0iRGCbp5fxN6<NT3JeVK-#|tNoqKHXksYe$FIeR0V*_ySK!JfF
z0eoCt(4NNzplgUgQJDZfW+-U$V}p;95M2o(U|p*o8+?>vsGkT{Bn=i?_}Jj13{;U4
zSY*aygO9RM5panW)c@Gvqa0Mk0Ia6%vB5`qs0jG@(jd_KIjz_EpTX-~!69J4zz_>w
zX=}aMgW<y>aQV{m_nM<ZJ)|6p1#cX&o(ho^U|3%A_ssGye=or`gNLB4TOsl+49i>o
z-h<15cLrIPL*$r1a#!GT;HeDjOo$vKNbVF|4ipac4A#*QNrr~yEq@QdCBX+tTKhuf
z9G18I-3FHf?`N{Mhsr4|FZsJ>`Io<&;PT*uxUKb}@*K-s{_cazLG&s@<yh*MxBP_{
zqOsuEvlfO*GA(cUy9%Z;<_{>aty!URjLS>@E?EBM?=qNtEO-Z?)mKQ71um>w{%(ND
z#(>XBw|WMbRaoBgcd4Vo$9ixz5c3mcxYc#Iw7~L~zq8<)KZ9jYz-2)`>W9mMldjcH
zxGc-^mcK1<S#VmnS_PK{d8!gFd$S&F^lZ2^$X|KOzx*wMD|rl7(FG|Nq5gu`1ThfV
zYPc-OU&U~};47@Ga^SKcZ)Lz`Z-B=?tYYEPAb-WerNNs|t^DA!Ab$nHWx>0gt?c2l
zAb+{TWlw`0Z2*@AdCO+`m%mOh6_5mPC0`FI{h<B=?P&u?NG$kzFe?GLEXZFCaLwQm
zA}dC?EXZG_a9L2gX0ZGOmj!t%3oZ*z*p`o>vh|>fvgL0)TpD~1nB^6yG^pAv`5UtQ
z%ikz86^9{3E!5$ma9Jjh&n>sWWkC-2g2_UXq2*GztN<we+ry>7C7k6nxHQP+CU9AB
ziD=mlmjy+LCS3Lv*y0MfEGR<c;IiO511vM)vY-eNUjF58y(C--ct@&b1f;Zw`bz{Z
z3r=X3(7FIz`nUY$gv)|cxuq3cufXz_KmXve;NyBMwc)ZX%S--zUjF6JPtg7+hA8lb
zGLRctqCj_2Ffi1C8rg{L`2Svj#)nxLUbBGO{NOdMY@q!<;PyWF&N$Fo*Eeho(F`>b
zmkuy89QqHMa9;x+5ncdZfCoC@V+W+=4DMxsk7beIUS7}j|37F@^bHdOA7j0v!iOE8
zhB8<QxaYI{3xoEX9SnR7pb0bZF?&(qouU2{B|xY9%Yr(gC%RGe9q2f~AoJz~=rml|
zUjHa?spnq~>S2I}VnG8iulIi}fRFzNfOoGVpXmhK*AoB^JpU-LMdt9c-XeCgFdUY+
z1nTWU`g4$ry6mzhF@e|3?*|>r6ad;q?a2Vzn8fhZg@KJhLP8gE!o>goKi7hLLG|F7
zix}`3HvSQy{@L;`4B1oJ7(grg<EL^kfaY_eA8%j~WDr}f$)K>@l7Ry>-VI7@c5{|<
z{0CX27{I`wIEfuRA^_rZE|*}~zm(g+A%KB_^Qj919|PM{7X||ckRy!1qzMDVBtr&)
z5P^CI!KKm`4gmrTf=^u-#28qgx-eLPl~^$_Ok!fNnZ&^$0U9!KW?+!nDF(i(j{|gC
zQUC*kB$993-$1VJQea?+S-bqp|5>1FJ!Uq@nSO7VbAYE@6kgYV0G|MSXg>o3Bg1kR
zhFh=er5QLFc&36D5w|d023-_WVg>4wfu=}Ae0Pd5D1ze5Q9(iAv4H{u!<08>3=$l5
zubDsz@eLcpDTbN|1_ee5hYkk@4vC=UQU8Cuab@64D04JW-~e^LK(dg$#9+77nxSF2
z9YY&f4s<CChXDg<|C`xk2Lq7NZVZwfb%*Rgi*1*yFwBi$P~emZ=m=ooka)cO)&C!F
z;{NYz0PTZwSYE=wwfqZ%7)S-waDk=X3=PZu7}`KiU7qrP^;8Z8&~+BeL0fRZo14Bc
z@PX1)M1uimM*{=LQuhD*0~ieIK|7y77wK&T2bdGA-Rr0F*kA$Z!bs3;_$kn4Sx`{g
zE`7}j^|>EIO~8Z?OEw97SOSU;NK`;p!v6pNqw%Q^=)mGl0v{GE=VaLNm|+0}1Bau*
z1n~SfXldV07SKXI28Mdun&taog9)&)=>z4UFc2w_kXY{W-|@{3P*wstFZ$u~FOUg|
z==00J{1;uy*T4|Qz`zm!a_H0l|8Krq{^j2ykV6^pEJ*Y>1NAxlz^e>=**AhR*0H|L
zNo`DwOvNWAr?ty*#9uj(z`zi{b#hPp2PP$-&2=41n3xoPPFCq|6NoDWU6u(xgIIup
zNnzdOUEMlNiW-|=bgyA#l0UI|TCWb1N=)YR-@iSUdop@}GACHE0t1sAct@p$FlcH{
zZpP$i{c22dD<<<z(BR0A2Mx{0{g`YwA%aORaPo`^a$<7ewxnbVXrUX(qyq*FOme!D
z&rC35lH;7rGEram4@i^3C(u|&#Ds<5ZP-TTAiqVv2gxXcJ6uM2AnRmrPfnO<$le9=
z>`nK{GbXAq-3*z$Z=xBKqR8ZL6ZM!BY9^~qir`c52Zf&D4Um3?laqTUNiiwxp1fj`
z6_di;$xkM^@yURj+-6xILuKAiwwSENB=dK2%47qMT+mtnOtPMn=S=otl36kN)nqv_
z8E^+od^fTmWLhT6O;Kgko$NBjNKVH8D)R=GWuWa+QymjFfcC$tE%yZ9Q_7HQxOvKy
z3PvV*j>UY_7@6eQCksqBW0HD5*<-o|lhnJ(P19ARWOq6$e7iD<`5U-?GnoL@%Otmb
z@`3469NE1fk4URcel$HnN~#*<H@+-Ta$WApAh_I;(E}tcl{z_QhJ>6H_zVca%t=fu
z1eSmKXTOt$!ECuFLjy>OtlQ*CGv3L`fICEb?UNXmbu9n#4|Hme`EpP2Mt>$*hspD1
zYUs&;CY2cUOqPH77vpH~=^R)$xN)ziwfxKf^&sVr1{*;4pfSmcPX03UE~D<`OS2r9
z!cI;WnQg%&^JTK%Y$+yLmdRPOZNy~2H_h?v01pm<j;t_XV3OZCdCzPuv5aQW+Q`SC
z?LsV|-~}ZQnYoky%+`>T>DbA_Pz3U<;cL*I#)yCmp!IDQAh*c$O?H}N#Uzt9xo(b`
zf{a6eg6IcOCBps>I>_e9AOK3>Ahq(kldsHCV+y@H`Oh4w`Vg*33<977c9`V*9y@>z
zXWhxd08U~$O`t><2-+J7-brtuw3CTJ33RX@XwC#A7XYr-4aAmfgC{ySfyF>42tm|y
zVW<Zm*rNY$xi<LR9FTfxhJdGF<DN1w=zoG}U{nGdbaV2Cx#E(W;Ig-%vdkb^pJkID
z%=HS9=LCg^juEI_mj(|y1eZHXOb6{wWRj}}`|K$LgZ3wozvaN~eI3v>S^sw`GN>$9
zVQ>SbcRA4c;ML2k85lvc-*O3)>*l2kgN|2Wk^}b*wHJX3DgPOhf6R0A{s}Tko_i9*
z4Dh9O+GWdkFvx+$z?Xb#w}BkFlZC-;c?*LNDDvdKg4Z9ifU@Y{(;)KF6fhY$xn;fv
z)1{cn>*gynDo(yMUx!I{{-g!6j3$%i7D$N6HG_O+;IkYweE#J>c+Iun@5w$3BrN2>
zCr22VLZv)G6*s6r0y#r24x~+g|MD;Y!$7Sq$i6zzjWQvEljkfbQIZ3#Q_}>w;7=uJ
zr}pxa|F4$M0Ie4Ie;(vsDW=Ir3k{g$DkrBbRN#=g12!~ua?e6L56P_&4>oWGJcy83
z{^dWYL}HTN1C|C~6sSE<NNIV?|7**?{D0zTuz?HYDv+$~Jg|$>mw)*m3tEIJyJ)h|
zB27lu%{GfTn3!ZcCc7>9#U#r$*=gw|37I7zwR%5=Kxf;}U0%Yl7vv<FnUi&v$uP-u
zP4-&mA#|P-<oI*PKs6wk^>Ff%Wj=l~W;+!a<}Ghw0EZjL<DD!Fkvmx!oR-?R-32*A
z27C@IC+L7I&;%K1e3VHBynsmO>hfI-d^<(J6K9}p`AjkjlkJwLF-hOqylgoi6O+`1
z&D&PKV`P%Nv3c3*5=JK9yOU+sPGFL_GI`zF1xymnlLOWnh{c<M3LtQm&$4vQfAA_I
z>5|FQ)`bh+0Xg&3OqhdDZQ1;9T`41@>Ex0Phb4D_bNN#S1~pLj+O)idAsUpv-PUam
z*vP_YWfioOg+X(t82Df=&*d!)$zWOV2&$eHi0u>wQn4Jg>~1-O*-jRQl^{_!$;o}2
zY#Dz|KC{V}@$_V=&E|}&CkJiTXIwD3X|u9B=rm<;;#S%%q_n)`|1^*pAbqYSkcHEr
ziE%|!kccB_3J|PTL3R0;{|6xR4xkj}RlE7kW&uVf&mWWjZLwkUygS)us}7Td*5s_M
z222u$ljm%0U=qJDS#FyNk7q2n^bufS65lX6ZkvHrjOlU<2DSi$4Gha?KxV>^gXhDK
z?Vr42n<?Xw$@jJeFo~y6HrOtq6n!H=L4aX-)&D=BGqjc;VK8xQ_^<$!<;8VD*O_@-
z+nlxCjxj-O6UfynptGRC1)A6@5MOyQDEh^gu>XV1#DZMz(Fi)93RHnF_hfws%R6Gz
zK&el;8!Q$HUK$U&pOQ%oT)$p+pUkmSSuzZ48n_r%%?5=X_<lwvvDC>fI~`P_z!^f!
z6=aaA9XLZ=T@E^F)qsIX%nYp6eDaE&GE8C`laKAxU=ov>{9&gNhZuOV9^0?Ual2$D
zyX_KS5`8u~VwVBaCB4aAyCMW6CW6-{f~EsEFfh%VH2Kr6L`K)iA-i>$B%CHU?Ow$+
z_se9xJuw1vkM87P*aWqZ!R_kgS$m9_=B}K4ZjTbv+<B8f?FnIWtDfw!SB}XodveC!
z9UODOt6Jv#oUE}=&%^Z_D8qn`JODcsyz1m1=-6P;T77Va5d(J!6}6YoV&DsyP$mIN
z*oS#Q<e`(W<bCML<azrlIOfzJXkcJ)ov>MMzXuc3?C{BYd#oleI%vf)TLzS>!ulsa
zIcVV_@+Ck)Kms)R`zIQ-=0xNT_}q0d&?M303!ux5LDA)Wcd48LgOpIHzy;7vWO5Ql
zpiP5eAsq$`0-z#A<l^L%Lt0ECyC+XLBoY;-2iC~~ihQ|MphA$H9c=cJ#|i>63}Cat
z{5b&%0xDp;nZf)ij}-(|kmP#;6a*AN^1nZW<y$8IJG56)6`FMRFPC5t7Ij>Hgkd=-
zDT+vLzH&H#kx8s!vf5D_Cb7iHDMyW%#M~#(I2yquCbjv~Q3EC>ho6&GPG~U+-kuzA
zB8F-DmdWc*B#BIK0Y#W&wgPBfiW(?z941UwIcX**m<dWo(z~E}lSwe~u|t~#g9ymF
zS>BT?P8Kjtm!ACUq#e_Arpa2T3V7^KF8}@S11LlUHf&yYN{o?7KxOj2(_&0p6eeFg
z{f=q#ipj^$tYX?6G`Z-k6Vqmc$=l98W7@Q5^1O4)m^Nihb~~?QWt+SF_rD*Y^*Wnk
zB!nXz7BEPQL<)e<-P?R%0t18p-sMLa6!yz6U;*9h{o0y=i-8MNJ(~AVUUNR3F?zDd
z1#QNV$qpBc_%?zMI}kqxS}D8n_T+{OW=ww4lXqNDVcNK1^1TZxLL29TQqE7i<rNGH
z2ND>VHqM_ca#6)+Bly^dH?x;lFqnXa`<8$CzY=M$Y6K|u&Gvy>L!cuMVA*$L+9lQx
ziv++~N!$hGg^iJuTQ2$vH%fs!1wwA1RXw1jy>aX0Cl^;TDo^gaBpxdcYhZ{AgFIpe
z9!L@dt!Huqt95Zq*#NHF1y4iUEl!|HX(Q-f8Sq4v*muy{e_w{3A`Bjn8$g|woh%IM
zAT=B2O=h}mEeIYp6P&n{g&_%SBEw|A%LaTK;z7Ru!2t5&hUCdTmo<g^r8a|NTrdQb
z4?#*d9G-mQvRVBG@cNC{7R$RB%)rXEmw)+p7L>9fGnSw{Vr>dam!Lf7Tku$*0dyUx
z{D08p>jj{YSPwea1GMmD(qn^#3JfBkw&6||h7^z!{(_Ix+W}tXvi+Wi!v+Qqh7BAJ
z4hvP5^D(eVlq}y|dqsm$dpgKz0<lP8z+lq5lZ62s2I8uqqVPZXu3(d<$rrAsFs)~q
zY<A6s$=h;r%{3LKb>}88x|YXexoEP`^*Ma&+(8z9eF18It@EC|=lTY|wcs_%FF`lb
zFs=PIx$1@#)7lG@r`=HDv3LuvJ2o&dt=%#C*bQ68>62M*sxYk+nyhtGllM5tSt>@L
zdcf=Y<b<1&?9)JIZw;Q@aMO=ztM}v!H%mCS8i2&Myq)ZGOPkSta>XrQ#@CaN-Ku4L
zHQD8MDC5J;vu^t{GR9ASbw^gR7G$7O1ZdmU@-P2E`+30QLxxI|74FJ1{+MicSDaC1
za@bu(M$5?+cNG~WC(pX8$asJ9p1ZA*dXJwNFfg#V|1)4%&SAhDz>olnUIs(?$x-(-
z8H*;j+|y+AnY`|vCZpcu8}~Gr40$Fq-PdG%Jz3|zCgbVJVfS^#K_|L`j@n{c1s)j}
zzYEIFtG-R1bzi|?mF@Bf1D1e*1P0LF4ue9+1O<o30fG+TgF+yhu7F%Gz7>>8R-K#t
z>b}0B>2eMOR<KJ97#Ivddli{hfv1(kBSG!mRm&z@J&?6@e=Pg}<noUXz-H?|T>j<%
zO^_}6PnUoBe+A5Xz5L7n^I+Ed<zN1v0<(@zp720MWK|BR*fId0Q6?@1O8TpkCm(pA
zAhIe5EKv$_mDnFpDZ0vY@)wYV1z5rfEb$2JT>Z%!4@((yCeM4Q$Y?$Jz(ZMa@JXNY
zZ<l}h{{WHDO?o$fd1%YTXfxU9NwX+;cvP-&`IrC4!DAc>3=Dc-CZBo|&v<;Y)>COk
z@B&<J&^8lrEb4*Ra&m*VAwu|DC#O9%W}G~E)>CK3(#iLpT1$hcP`Q>b|MDMvd<nv0
zqr%B1&zcz%C+~Rnm{Dx<oac^=X_N0guaa;AHT}LnR+s=9uW(>sFpL8EP50R3f)}BT
z!IO`@uxBiq%=R)+6TB!xCSkb+xVc>bDsFVa!;UgxP%-cg5IUzeH@sA2lKccKnK<5p
zdKJrC80LWtR(iI1*Xt%GCi{rVcJItM>_JUd25qj%HSZ)O7B6@Vx|Ui5RDU8|uID;=
z&AUxZcE=|tyf@>pn+`HXt8eqX_ZCb{w%wC&e9U9Ajo<9?iI0(Kq5b5D&lwyx;J%+m
z|K<~)4+$|TMQ-n5W8BBcq*%M%hlBAT6FYb`--va(2sfjFk|C(lW?%rH!jG_2{_pbN
z{{ui#KGkM>8aJaS6Jz=G4ZMuDj1k-4@iKm3VUm>E{y>OPg^@{i&2%;q#)FLB+fRrv
z&R}GcJ~ur{j4_fiaQYrG#wSeD_qHz*XN+f2oCM0nZ}oR7G88Re!jKDE8NE}HVaxI(
z4C$aML8NKAk_@B1JNO#;x9m`5t{~rvBsfl(!04!Mz_7fMf$0)M0;2-M;|U)X7*s%!
zAQA{N_{}@04joW=F5*6Yh76-MqvrH0GK}H;e;pr8V008u05vQbguhL<l4UexygNNd
zmQj-N!t^#-Mn&%Zj$#TB>0Q$|$ujCPF5dn?mNA=|QFpqJB4aq?!s$yC8I_n+r%ykj
z$Y?EH_}BroUG4RI5Xt@pRGNd^DGaJP)8&*H_3C>-?E=s$L{LAOK`<SByQ&Dtr9I`3
z9Y7PIpcAa1Ygdu=TRb)ZFO2xYz`y|R1hRuJh+^ve1G-}Ju>z=sf~F@SM@9uuei!Qe
zv{R9RWw{Ci+hfpxt_u6V<=mS8|AQCGFm*nezE6qKkTHGw2PH<atRCsd4xa+RH{fZ%
zp8rXMfd%Gz$XEmTR>|N0BS6dgoD@DRcQp909Fi(QZtwoHTpzsSnD4Q|hvf_t9y@?8
za{wQ347t|f%W@5H_V~)qKD|MOQDeH03ZsN@K#;$0K!}0@0|V$vN)Tq4ZmPoQJ^hX{
zquKN(WyUBj*PtN(AS(scVy@|O+Kf)q?X(#sraR~`@=wpzVbq?kr^aY7{elW(*7O8b
zMiI`k)S}F^%+wTy>G7(J+S9F68P%qDsWN6w7gA%CnVz7{7%}~rHe=HCN$QLa)8DBx
z+VF-u2KjmVxr1$Bn4YZ0XghtE8l&p;rD}|#)BSW9<yf6v3=9mXzt>_koPI-#QDyo)
zbw+{dm(&?Wr`u~VvQOWm!6-dlR-LhQx|;@L+4cjPj1r8~UuZD82|D`*Gx)gpFesFz
z78Pga=P69r)nuGJeTELB@pMOB#@OknbQsH~+vzb%P0!O~l$kDLz^E|Y!I05Q)HA>*
zJ|r^0HQw1dTp_ihAT_xpHD!9I9%JNm2Ytpn(;w+E#!a^|VASAORw$@Q&B@Fwtzcl_
zQc#$FQI}D2`Uzb|E8fz)?7aN)JcZPvqWq%i$p(z+^*Q;8DFul|xeA%Z3dN}<3MKgp
ziFpdCc_l@a3MCndB_Q#<{1S!4vc$}s#H5^5h0HvKl8jWi9eT-W=?ZC?IjM>aT*bzg
z2D-_~<*1TL`S~RZxv6=jR$L4W3eg6!3Mr{+iKRIu3L2_hDVktG)s)!je{~rhr(ZK*
z%-Y^%$oP+OdYdU@f@o1{Vv2^LfhGfkl|oT!aY24wajL@fc4J0Ob}mH)1_eci>DeZX
zvD1H;FosQ!F=bSke#Ds3WIBrpV+MCoYC(Qci9$|kUh(wfCXDj(Aj1@r6AKcPGfOHN
zLW?u=(iO@wi%K%{b(3<k^``%~VU(U8Va6CS{g)|Y-1c>5j0tShHEbD+rpMSa3Qj+1
z%P2g3mMx>)_B*zW?Cd&*M#d(lX66=_iAl*Rsc8%h1{Dkpyj%=E{*EpIjzPY*(eY3a
z%QgL`8l!=L0h*TS%T*XP*+5r}FfdFHab<Ly{?L`te!9FH<H35+5c>cBPDN1K4MIEI
zfzVD;5E{mZ(T?vR;?Aoew8Ihz?OX$;Ss=6%)Et;R23-%;h#^6wxYH!4MII2ERCDS{
z)j(zS(*JQ8=<G86h9_fReclv^&jyIL{!g;SM_>+~uHensR^JQtKyMF3yr%#{_d?T3
zZwZ7C7jI!;W#C|)%)s#fKj{2B5Dii>`5uV;|9=Vxls1CWF;Kb<N^gMDx4^XV|EY3d
z#{bD%AoSD)P<k4ahB|C&6O_MddV~*SSpCT=2>+zXfY9~-2gqWmz4ia04C>KW>PQGl
zP|<`d1g^x9V9<Z!J#Ym)t@{7}6}kWaLG}|2fy@6$bI4_ABEGy2yS~fw;NoEW|6j%x
zWSgK0p#|Xa4-h`N^eHuT{Sf>AlWQPM-zjJnZ~~gmVdCiY1s#Y3;Ogqpd~|^eq5xgv
zNoWY1g=S-P`O^-l`rsCznSV+TRUOl*W7}5*FtYM^vou;TFfbTH3L^#v29|~s3=9l8
z3=9lRph`9W|G%#wnt_24G&K!kvVsT(2IdL~%>b=@nH;7c$YZn<V!i<t=YY^m8q)>x
z8TA>(r!xjJhB7n8WlUbkD4NY^0a{4Uz`$ss16Idq0Xn+@#0S|8q9J@HP#+ECx+Ku1
zc91ye2t&~IfIMJ*aO)W$_OaZD2s0)bfEi2*JkvkqGm2>@6)-S@%mIsnSYQSNO9O<4
zk<1L+^$Qp)8AZc_6@pxY18gHA7#M;>9795bZ6hM4FE3<NWMW{L&QZiTp*}e$5!C#F
zwnL2!^bGY(6f}ZTQxrTBOLP=G^OE%xAfmd4dZ{^}HkiA!vz3B|yI-iLf}x3?k)EM~
zk%5t^fuW%RTq9IM*Ibi<L9aNYxTL5gF^NGhFTW&JFFmhRFR3&$Cq*|ig<<-eB1RLg
z#F9k4qSPF{qWtNy#f({!pyNJ4o&iT60|O%{Izj$EG5tX?qjJ4m{{R2qK=QB{M#L;U
zh65NF7?`1IKolfoK`aIa4F(1V&^~Ms4{8My=(r7#aZs8Ol%iNb0w6^U4A7WiV2}W9
z&IUyb%y6gyu%yIXF?~S^qjEh=KS(=F2{cu~QWq1*9WY}+>R@h^U|?Wy0{Ist$iM(g
z9?(Pz<1z}sQZG~)Xp0eysm9=eWB|kgjA9TCFq%O}VY)^sqk28W4UBOhEes5deh?b8
zA`505goe2f#EV6^3mVRhaTy>921Y*!4Nj^IpfCgrBZVO-7o;JaH=VDHk)u8yqKnZV
zLNhSTfN6u$Fxx?NHbOVd_5_GBMo`3qm`tD}VnGZT2I+&b3z1v{@jW*qG!ro<FicM<
nV^mfxL$U)D;V``n42(fAvlFMUC}T8J3c3iDtcTJt3Z6#+tz%p6

delta 42894
zcmbQRj<w+(>jb%a?hFP9Z~#+`#Sq$o!GeK<!GVFFfscWKfsKKIfdwqjzyOiQpcxN9
z<Y6=e2Ll5GGeRE|M4ADO7G_}JhswZc#)%GUTme78qKpAQCKiY(<xPO_&}ar0kR=QZ
zD!YD6d>|%-Cd-&NVKN7!nh=u!STh5Hp6tLF7l)}DqKvTsm1bbn&&f>E&q*;e(JRi^
zGX%?m0z(AkL3h7UhSSH=KEGFdA()=)$<#5e=S^c8>*~pG7>fhh!D<;;FF<H8DI~}M
z4jKjqM%M>m5e7yOr6Rz<096l<5|FsIAOiyrh{3?bU@&<DlO9u1#N-D|Zc+?FU{MAJ
z8BhcXGB9w1`HV#tlO34FqzWLKAo1poWC+XT0_ME>{1sr;2(uxkG3IYT5oav20P`91
zcYtY_dYIc8^P$lWbt5CxTE_enDC!xYeqzjrghdq0ASMO_utLWC8(<nH&T=2ZWz2^L
z63l|42(ScW{tGY-Q_loVpN#pF<5|V)^C8IxE(=Wpu(*YZGZxJNo5ENi0j6Q%Ebug-
zfg;ZI0m5Z0M75oz0g@0I3nBK_!wqV%0qbBaf@L#Ew6JMFyv1150hWiUXVWxzo&Ujr
zL1noogUs^Z{}Yy5GMqV}z`*cV;=oe|hT0MkDfSmcS_B<fz`*dA`2Yh0BP+vlNd|`H
znhb2sOw1h1IqMl1cQ!FF?qpyvSZ@9Q|7&Lkdj_5WhXpLl<rx^4moOdz8NhsMzx)E0
z0}Tv}EDx8LFgWZNUZAqPgh6O|2LnSu!vdBA1`G`SA|T8Ao`KZ&t^$!vo1Fs|2rrLf
zU|jAg!0^~$ff@tL0R;v|mi<lv3xq)`YLz_dCoE8TtN@Z)t}Vc@eAfT}%PSZd!6GUF
z1q)alCM-|^DP`^iIbnIr|05ut@}sFt4Lpwv8h98cEN@}pTVBWTe|ZbTCa@EZgH-g+
zT>j<%x&s>+7`F5*mtbHB5KwGb9>Ku;SfL@8VS>km4GbcxOQ-+;S>LI^z$iA!VZsK6
z#}gXz7$z>?!N9P*LV;nY2!r)b76wg_VN9Eal$N{vZ(pv*z_`4H(L^G9c@_iXP7ww(
zxQaz!6=hHr$`Y@azhYq8DZ*d}S1}Q+A{DAaNP>Gg7X$OodJzT#xRM62k`Sm8#^t*h
zSWui%0G4-w$TNJDFk5Z~R$&Y`As(#47^>odgxhj22G*S-3?^_Deqa?!P!;FvCAKZ!
z#lVJQjV)M-AXLddunP9&W&bOefBDb$SfD|UVPdBMgFr+<gT#K}2AKl^3=ErZFQ37{
z7%)MxA)r99BS1j0W%&zuU?&7Hi0Ca%|Nj#l)=3Tt0Sur}28Vb3MD)OB{0FlB-zBK^
z^_YRp_!g|<AXG&jI4D7Z4G&4iJ75(XpekY|te0CcFz*y$fQJ<0X|Rg<^-v`~=z-0+
z8?2xoDsKZ0N>FsbgOYI-SVbLFg*G^xK!FWUH;gmEDsrJJq$I?aOM%1M5EdPb^&Ma(
zF;FF(U_+pR{Vx!l_%1L1^3Mm%;sRy30|g8Wn^l)<Ffe-v6flTrfC6=?`2U|`LJk52
z;DB8|1Co4~YySTa(#IGEvV)-kYDeGlUEsuP4U(@1D{uoVD1a(xmWT%B+MOZ{rXVF?
z6{cVn@lX}z;79=lxfxuA3Rs07R7Ey82Y`ay4z5BNtil$mA|4!V^`Ia%fGc4FE75@}
z2?oa-C`gTADi}V3RY*fsxJ!61_W}p030%bkunI1y3hU*&7}%Fj`(L%Zi-B=@9|QC9
zlK&~7a-wH8$Yb^0kb<S;@1*5l{w@LuG080d^1l$w5?}u1e+`%=wEWBe4ls*%`IrAw
zz$}jCU;ZxuvzV8E`M(ClV*I!K%l{o<*3ac%{vSE;fq~)YACPsMJRd74Fff41N@0HX
zo!ksYJDC`amrqt?vuFCtIys5$eEs|n9t<i6E-)~3J1+nIUjtNlZQS7K@L`FA!3L%X
zfej4HE&l)CWa7ZENr}Or!+=3%xg7)Z@)m~T<#zu;#b5qJ#t$o(moV^xbC<wJ4{+h2
z{d)dK1qK%Ok2_fy7D*_A+-Axfp|F7g#IkyGU;+cf&&r)l3`+G53KJNXw=e|2B$b{m
zUk5f=<gvnsRSXlwwFEXT-}V20#|8%Z#~8+Y2uxs*U|h<^z_3^N0>~V(<$RW)(ph2o
z3q^Kuxz~ma1`NEfof!-mc$Rzr|NnXmsH$21<^NhCrR6RER~)E+%D|vdyF7w{QCwAU
z6UdU~U;fWuzJq~r`IrB*m+$!hclnq9)0gk~|9|<H|C8C-+1X$3{}2HQv97htfB*M5
zAi%)TbqW-2KLs!Ge^@NQaEax^W&wfy@*7x|w=f7S_hjGz)m2@~LG=(LJ17LI8HALU
zmoVrZP^f2M`0)!QBvK64P{QB})9~Y+qr!)^Ah}9k#|<AA?_^=n2Jt#yJyy8Dz`(NH
zlYwoyB?CA}E3P~i_^83a@_PSA0Z_1mB7eiO<u4f+9tVIEfCB@=k7LU@!A@ahIO-^8
z!0=c>fPtZYg0oQogOi;D!}8Y*jLX^oe*!zB<^O(|GrEF7hW%Ipvbt(1DA*Wu;BsDI
zxmjSj>0m#pA9%pP$k02L=>gB<fCrGOl5Ke$!~f+a|ED@DY!F)R$#7t21B1$AgAH;F
zV&I}c{M7O<|Jy-+S+2>@05VMc;PNm3>%hu)GT85IV9*B1f@QXVG72an*x6s-|BwNR
ziq5y7)(9vnegt?h2rx((EHz_b*vkw~6Kc!tz-dBoxt${W@)ic(onj2eAcuEpysp3h
zk%NKdz!wIFPJsgs3=A7gUo(J{i~%UgL?}2gyoRf=d=7Gee9CeU28I9!#e}I$3dWBE
z6pX>m0gdHx3>?c_7=)I`f!Z((S|AHLPlI%H3M0(mdwSpj1H%TU2!#jWh^yCw1gXqp
z0Z`0A6taH=X<q*!LO}tn$S8mLm;diTVx5~HDnJhIcmXop;4UZ|Eid_h0W7}}N&W_M
zV(m->htLKFhVKWiGHzf1hm82+dVviF;1&|Y`kfIB3Jd`Z0y~z!U|<M%Ag~AOr2QX$
zfRofy1_rs;%k@FN`~M7-qSx0v2J3$8V8Fn@5)t6Q5D*}+WBHf=4^b@Egj?JKwipyj
zoR1yA-rZjhHv9|7CvtnihPV9x0*c4~d5;AyFfb@SRscD0xe5b!fPjJsOdC{}0Ruy4
zGT7faAQL(a4m|z;|F0z|b-aH6p@2aJB=_AH?0}~X3{@!*{X4}NlwQ9FIe@+X3q;{g
z76v1*G6e>PPB*Y&Twue5U$6fV07+ys=Pv*K-vZ>g&XP-N9~KILBgddff@wL||No&3
z7dV!yFf4Qw_;C0!11N*;6k$->$-)q{vyH)FCkw--<(3RwJ9!xvzgA+fXW&{c{r~@C
zgL<&S1_q;@oD9ydT^N`cxR$SCFxbh-;N-MGfKkXrLS=c$|GSO~ANKE5WDr{J!cgew
z@L}Ih7KXr`oD3n$Eg9H%HZYhjZ(*=nZVzfGGUzS0XJA_1!l1U?9$Zk%Ew^U?6+~jo
z?HO3X?N)mRw&g7hY?BlO7?#&d|NjqW5J7`nyi<WeWRija<MI{;-PcPQm>GC>vM@Yc
z{`&vFoh%HB%eDXi-O0kRaVHCd<MQ4A|A0;Q{{MTD!UM+TuR(kT#^u`o|16jO|6`KE
z2F6JW^$v_6$w>+dj9_Dz|G(vE@L?e+-lm-bMMJyCV}Xwr3@oqLf0O_vLvY;oe{f(>
z0Yw+6I(xi9fd!le6&_DeU|<k?yg-4KVFF06{;lPb4F7jFFevU+WYAu&!l1NVgMnfB
zO9n<r(%#v?P_Os8|HA{2!8=(PR)Y<g_;`Z?6T?KX0lQEPIP(7ySoHgHPOz~GI~5tU
zmb?7FzLSYz)$*4AmqD_6HsB1|!oUx*Xt@TGWpKMd>h!PdWMOCmmw)>0ue}*~7<iZ3
z@q=9JygU+Yyy{L42G5;53{J~68TfZLFl<^rli~kP4u&l|8yGrw@-Tp_eEpxxSN{iz
z?gIN!gMne^3<jm;U;g)lLkiqm16A)cJeU9eAF$k$f$@L=1EcAo<(dov2c9z2Gw6V-
z!V(7M0}B`!O}8)K!64{Zuz=AqVFCMr1_p+XyN(k+tXl5Lz`B!#!Ez@HgZd@b533r$
zDZhLPxWs3h%D4cOpdc-P08qWZQ-neLbv`&;zfNUd!0=dL0RzK?<tqO_2njCtWKaN=
z9y4@zvM{LCFE3%>00l>R9k^-{-zmnR4R&D>NL05U)NTaH{67Fn6Yb|gqHP7szx+SF
zfBypa<t_h@gR<#A{+%ogNjv2kv_W|rtUm~(Qa2y$M2V@43mBG{FmO#}TEMtmg@J8q
z=mNRrEes+D>J=CmIzm87+uWeFJUH>SuLFzOEdTQV!_-v^<d>KHf3shB0n_r5|1S<q
zU|=*gUS7$-Ikf}ac(K{Z!qB<An?YeG3&V`59Ssc2TNpt(e#Y|I3<^^_8WfhdFx&&l
zEuYQcFtww>VR;K9GlXBykTA8QAz^t7!$ODvL&MaLhKA)W3^`E#f~g%13zoMqm@n^U
zH~<za|9@=xm;XzrGE87yUh@CQe&Gph%Uk{*c+4<?gF$Ym7&v$tEx?IU=L5+9Ou@@N
z86-e~KD`6f2(dT`@?6<5A*JQ@CI6Q!w_sotO<sP4QDk`*xScZ_YV=8{(MKOYfEuj_
z3R;V0AniJb!A6_GjgAHzJqILL2I_;9{9n0Tf`L&qarqI3=TMUuKuw+kHF-k)V+W|w
zDqy24LE3eufsAIn2{&2~Y;-<It}F*6_rC<xWD`wYeuQBc)aY!e(eY5DqtU_x+?&zK
z1nFkn12?&z5p1***l2r@<bQiucrf%rjW&ZCtpqh%4lO+7LArHpK)M;*VMb580ybF`
zBv&Q`lKamD503<h$^U-VLyZ3S7h?3kpN}^{!vmZP%s+v&>+plLGiJe!1~(<m!S#RX
zQ;^)hyP$$bG->$}24kqvSEe#Fur4q8cVNG81KaYJe|sJ~G(ge^IHb*wf=t$~e+1Ib
z=nFTx3gl|@-5|-*9U!@X3*bS`1~q!RN5TXqP;?nD1{EV71ryjD5<V=8m@omHm9=*W
zDM>UfZ($GuW!W}8kXbFWz-((UdkQ3{{e6F6Lp=i{b0cW1Bx1pWMUN+ZSioQxuwVm2
zfWQWY0D%n-%fB$#Etlf}wd}nfJ4|3=V2O12uwZ!$qw`J?h83@)7?>D%r33;*H#kIy
zZcva0u@ojUO^{sP!r-yIj{(%$n*-{DfmOc(sRr2<Ah*FGKyHIVfZv9C2BD7SE)4Hp
zOMxX<a4<v&Zg3ElTCT!yWv3X!L~v*r?&M&YBqX@Jg~8=9!vqF~2|^6ZOa5;I8#)WD
zFN1+0LUV&cgyjZ?<yt=&q=c4RF)#*XZg2>&+`teZxj{ilaCyo9^UJ&b{|D>x0_g&U
zV7)o>W0egI3}T>w(Ut|5bUQ&o)p`yj(!u~{F9flhe?fyS6l_Em$Ourg<*^z}zt&$+
zg#CZyXtqHiLTrP>etiRwLsvY00CKbxsBAC<dC2VKP7Vg6#}g)SG1Rk2&jYvLCP+__
z5(${LK_Ng46zu;&>42dX++A(nw_kpP&GM4}1t1rjt$wVqK?34nt)pNIS1s>gU|YVD
zfo=Jh|8ZaktAic9X!)1Fi@|(w4r!jX{L9~FFkc)jKWX`w`oG;^0e-MR*YYoatHFG5
zH>tU4`Io<uAbtyYOrg1I`Io<-VuqpRJ6L@YT)i5Yp9NCe$_-|xKtk)!ey|uLSS)I%
zJVSd&1B1ZQHU@@{1_q|b^$Z`DFvxW<FbKR30JZxcJ6zykVA<Kg;PKiN)B|{|@L>VO
zubK)VzcPS*!o3e__{7H>Kn=LZ8zyiuG%RoVe`fh^_W!S|8Mqm^z}5;#w1X{{TmI!g
zc%ZZu9MR2UQ2mAVpjw)p9Wts4s;8&4F8}?W!O`F&1GMY@lz~ADG>B2cXnvLX0>ej!
z<t2<7QyD(8EH7bnb`JPxE}^<y>;FF|g%1m+GJaU#=<rctxeCKQM~06IjtL(f9y5Gc
zz@W0c^8<rZz=su6nLn&p-oo(vvB8H03@ir(80r~XjT{|5?6{=&;i3S;;|-veyko$J
z_m4Mx*ukLkc!7Zg1IuHF4;vU%9tV6_!Jq;f2x>K4?&-j=+>&7xC@~o>1^KXW(ejxL
z9FG+~Y+zt{Ebw6k1Is1;4+jbuoF6DKTw?fep+Mj@hXMmb!)pTu8wQ@`p5O+}ljYj=
z42+J!9}YOa`*7eAg8)MS!zBg*#s>_`r5Tu(Pyhb_+~+l5U^FZSS)w@s90iLHY+ztC
z%zCV_fq{YLu>#1U&?c87SSA(JPI8p)|FvIO090})?_^<!TJFif@YuTl2LlVpB#qxY
znHUx=Z(*oU!D5Wu^4$yqAnU=Qz_R?y|E}ec3=GRT83Y`y0~n^R0%xo1%cH?P<{xlX
z<;!0Rya2UomTQCC0&b3SA0(j7_Dbh~1aS%0#|fZ-U(WUa-|}n*1t*634=cbzDpMIh
ztN^uPmLK`A?-T%u%jGQ$?x1AU5)E>5<G<w=|NkuiEeIMWR(|a8p@4w}oNidyzkpR4
zfmOW*sQ?Yy>=a=@Q?-+Y!Oc-2L1Foq|GOO(K3oL1{~9kZ|MLF@$bja5U;|Ert@-l*
zELiLnSPax1zxG(cK>`wdoO_pRLIxf<_bmVN|0G!DYp}{SP~GdmV&A}Gi=bjlpotx+
z`CiXp{CI%^r2TI3xB=XL-vDdBYx(VDVVDFmLW}XW6jBRW7~TNqV363!!yp80Aun3)
z32r%0*~!5mwUdWI5|n<HYybcMH~`e!+sVP82yO0v-O0kR>v02U{AJ?f1)%o+@-P2S
zfP)h}8aC<V^56eKL%WL~8-UXNV}%a~7*s$_%^y#eOaA}Avxz}!Cj$fHa_;~CUmJi1
zl^z>>IKiMIkrZI?VGqd3{58--$+mp`|NqNN7@L=`V2~5dTCT!$2$6s485j+~m1Y4e
zsBkr40$T)0qcWh>&a_G5+45Hmj61~`^j<45urTm~rbP7L?c`w409(lda@7B*<@*2s
z?_^;pTHeC65n((7qy9~hWAd+oOxM2*YQTf|>hA&+KAZu!|ClBnaA086KlXUThdm5p
z&J7Oc5)sRz{{LIf!2l{U_B?g~`TX$)P%#p~@L|JL#t(azA7PMP{)KUSM8by+%OSH8
z(_XJ+U}fNaT=3xl14}@{hYikM1?CbjmcRP{&*{O3Jz!lbjPsltKJ1yw{9(`Xmj90*
z3w+p6&mi(T5v*|mNFylofL+?ZlY>DSQc68eTVMf7cK`qX17)tJ<(>-g!bd(E<eU5q
zkRJKeoh%F*Aig?iPNRh32&kbh9|h{z$j2|QWMY7r2N?$c|Nq~?<@*2YL4nq^yygGg
z<>d^ZoPPQ715oL;{5^OO((3Vs39OL5phlnMrsX9JlRyJeFe84PfyQzD;|&wo872tr
zUf#lB2<oytb^z52I~y3hL5|wV!e9n+m>SFS*$e{9S2GBJqL#t^z|(pL292amK@6LA
zN-$(E|MGw1a!UqAxbbr##{cgGS1=QWb}ujae;HJgE!Sk=aEx+bn7S$eRKuTK?#;ls
zT>bwK<gk&u2eLBnHYjZ5Zh)Kt;;VfIw=qh=*;4>K{#k!*`4<KbumHGTu0OY&^Z)<H
z3?Ei7H0@+$5O{3}8m|B+HkHQ)A05Dj?imJ=*ZChA7+BapgLF3C2N_<!aru}3kHP#i
zVE)SGU;f_)^T933`i0BCfINVxJ?iy(Knn9ZL9Wzm+sVS91>&nM6jG8XT3*6vx7^bJ
z9@}hXAi2Ea<sA$X((Rzw)ql4<lY!x}!vq$F36B>{U|^W&v0(xeq{0HJ)i4BC;NaOj
z^~bNH!DWaXxR)IWE<@@Y7!-DLFhuR-VF+4o39gkkFV|%F57ySOlY=1|B=b1n!v+Qp
zNI|`mg&}o$_W%FOS28f}RAh)+euO~><aj;}aN>Q+z@X+Vq$IHk)c#%mh2hjr5r);E
zF;PB=og577t}<WXSOBV&f<dVS9RKPm%eDUhk=(TW$p1IXs~8xU&t~9Q-u8b6DA*do
z1N?Q@muE0AEdTQN)#DAI#Oc)VVZrkK-~=iJs`EisfmAoSg8W?fVY$cuKLHLO&Mg1(
zUmGl6@?RZXHH*9s0_QaWP+ohiDqz7-4=!rhZo|rRwp+_N{{IhP0Bh!b9001Vb}})9
zE-zt-mJnYq#lX0{jzN5R3xm&25m4#Jknq}ofti69)DqBLv2-8*e~)GbmdDAU67_Mh
z0vlu?Mm--^kgF@b_5ei!IA?G$xYa|)I)ZkxFsSV0VNhKz366wDaO^ZNOaPU0J9!v1
z!TExNL4BtpgYxnt47{LH9Te=Mc_2Tlc7rpNC@lSO9hXR2{^c*I{!j&}Vg=Wrsuke0
zKMxdE4Ie=I>gvJG$wpC7A^J@aB+;l3mhfNx<$o=R-vCa@b?(c*{C@-DH+qBR?U#S~
zpSx3x!3->>3>ISrvyDJzeSQ79{(}W%+^~Nmc<4nBG!4X{iCj4A3V_Fda(O{+)a8Oj
zf~u;Jl7!Im5{3#;dq(HqRptvU8w!@UFjPHufDW%HzOMi9f`NtoO9aCOh5&{SOCU2(
zjNokC2p;>W-3NA#AINF7JHRI0oa(T_|FOabfADzO_vLyF^`DlPFx;JF^kE5Tx_-%0
zM}rSbK-zl2?cCbA%PSce9ycstU|?}H_^@L6Oa?YkTGrX_DE<I4fiS_Dse!?X-GE_v
zH3Q@F>Hj~0bT>*)V)y_aL8+}l_OH%NkYjSDfxN3T8RT8C|5et3;sw%OY-9#0shzl7
z0z4Ga1vZWsEY=PUhZ2TOQyDjuEH7bLHkDyR>GBeWT~ir0lr1k|*f*7NLpi9Be!O5q
zEu`31-66SXc?rWpkAe+Vj~8sHV3_!L!iE}1vQ$&sS<k}I1TtLpCTQ^OwL3IzA`ihW
z*~!DO2%0PlL1n|v28O1c91P2M@-VDeKKuXw#|;~j7$)xIU|8ufVMEH}4I9!R#;bk@
zRmfn|SH0#0nY`2wT=cLkw`2g-I{`Zz>KT-Gaxg@I3K^&s6QNcV?c`vH+{wcbzLSN)
z8njFTl(u(rFqlGO{=k?2|9@`=McU#sJ4G0b9y@>{X_EbirH;W4peFZ{0EXpX{!4?x
zufc2imw&$|8A2j?F=z&bA1po@T>jVGS^njJF<1bcnQE>q|MEW@%#Q-Oz6Ml~fQQ)|
zTEP4x%fI{w=bMHEFdx(g1kVyRB!T%L3%sFiJ@^1*pDB2L5!4B&0IOOEN*VRAZiIFp
zNHDt_lr*$EmTNMAdu+;!LHU|d9h7>tYb6$eQ$Wn}5{B5v6E<W*Vp!#*<fP>#4B1l|
zHY6=CVJP!x*pT9pup#Xd!-wq~GC-!Pnm~F9Ahyag4}lE<4gw#Rfm>SjDjo$J{4Ozk
zSib?BX;kGOD}dT@V5Jv9E(AFcTzV-mFlyU?#Ir5Ijx<}Y$-o5SD+huc$#5UkJ=*{p
zW|RZ7K!fh~;83gusjAU})v^uX<Xofl*x{o`J$SlQ>vcY88Vb^mZwLk}7heA5KX@Lf
zfep;(1}Vp)8r*ZP{)1h1(ShYFVRL|v1|Kdgf62h+!SG=jsL7{w%W;=OJ;P&x4Gatu
zoD~BYoU{xWmak@DT>c!Ai|ef<7EEIJa1CUA^_<t`p#Cu^1;4ferRCS`p#Jge4v^^U
zFp$X31_qPYJ3yj4IT#FfHZX*MM$e(iSrQ!F4LeyFCc|pgojeQ^>z7wDfW~gUb~Z4$
z?`&X5U%ryz|ME_T|Bn}ZIKj~HxZ%SN22eE&YSE|e<Y8F3lZPP#+$3jt%mC_az7A%v
zVBmed0Zd9WSTOLsRt1ru`T;ay;b^76;HW0R0107GuK6Vmij;aQu(#?Hm#+X9G`3*D
zR<K|=RLuA_xTgZ@miOFU{`);>xf5tWhEXdKRL1{Y?P%};JQuGN1Wo}ypm+xjPciT=
z|1Gcpv^e0g0Jxh5GKYoz<Ku=88yLi#Cw$oQc*BRSpi-iqfk7G6ss%3sP@er-5)_b2
z?Z9=Q@J<c}31~gY1e#vi$-|%k?K)3^)|*RraxiG_<YCYPTeurM6QGT1DcED+TA=DR
zSe54ge{dD`4xqUY<oUXuT+qY{$bX*}z|udccGo-z3Y*M*ptP^K8<zGJuYrA@0csV4
zRb2(?{Ok>GxRx*|f-<h=63{w=NP!EWnZKAwfeWCVkrF8Ynu4rn$XKq)zzov#rx0S)
zYw(04D5n0t0Ez#1T&@qEUII0#BA4rf+dbeotOL)SS2ZrT1owTkL8^c1flYA*`MT~S
z$jMcXAn{LDD4qeg2QniL)Eh7`YKFpnQvj-n{;vRQJ_K_J14C5+$cVoS!A46!eZ#W6
z<o^OtK?PIy|NkEWkV!~<4#<QfM1=hds7yr6Cw3oP{=5F)1CSd9BKFHGCM+*u2nF*(
zAv2+j$slV#?t-}-G>HfbWR1Vqt3NFHumq$w<2xuqG`@f;QxIPfGFH4A)a%iB2}+RQ
z=B6n~PC#?H9s?6-^mMr%1IO|bMlEppucWtJ4>ZKe=nM8YxX)gB1EfI_9CZJ_fyC?C
zUa$XH0GTVVJPC5xC-9VXoja2FUXaQ<aG_hdJwjjs%W^r;d@-ZOV}%6*3@qSO(ZZMu
zb~1Quv0ec*SS+->gs~Xv))K}vupg&5F8HwIu>olH0%(>Gw2n{{G^ot6+=GEJz+nLc
zs4)sw+3pyyfaUQ6sLFTCTNpS%L-+v(0bn&dSr{JeWMOb!{+dBxxi_fuq9DM)vRt15
z)C{kODP;i}_c-7I#Fe37Lo^r|0~8z}G6oM6!0tB&%S13R1_U^8fb}RmFn}8eHO+ws
zEEDj+0jvkvGy$-T!Gi#>jB!1ZaUx(Tg$D^3#z}x>0v;5AH6a@(1C}v(&;XV}cANr8
zW+w}S-g0jSmF3zD6Lu;vfJ%{&<t6`fz=PR~!Q(&duHaZHVMtys!5}BPak&b^_MKu3
zyI-#c4KO>t`mkib`~y%>ZF;Q@9)4h8U{pW8lY>D4lm@=;0>yakX+#>R0H=Z4CrBb&
zKxv7y60Fh@Nqhyk|D*5`l>9(x8#Fr&QmXI*oY9n*?*onB{X4Y$%fIa)%RYi8BwGG$
zT>j<XZqRI2tpnIdaGt3MTK?tVMNk_FWCEMJ#HQt6{?A<M-@vewg+XK|F9UeOLOpq>
z2m^RIl6)P=j{o%+91RvQg620tMpZR~G-rl_r4EDG^6g-YYry5guH|3;)q~X4fIANr
zp3A@d2ajjhg6EGa9G8Fj4<5d*1+O%%u!Oa%YL!4{RT#qBRkb`|zUJ~T_5Z;QtEz_}
zYu?`lwe>(2RD;LA%U^=oVqm%R2Lu=x-B}>Z6~JqESROM7a4@iditEP=3=9k^ypKQy
z%wq)*oBbbRp;G5gkQz`3gH4hGlfj^c4D;%5K#ej`0Ik)r1Fh3x;632Lz%Xy|;{XTH
z04qZPBf|s-28BG(%9VLL9xFUxU|`v=uK-FD{Ery~KueJ<8CXF}e4Ck>IUs9z8BBIE
zF@Q!x#6e9Bx0R0rKx^#}2>k#5e?E9&N8{rF2Mz|6`p2NP&nk~MI50p~YgB;eeamx~
zOENGv3o?WIGd18cvV8Jm1JEcQs9J><sGmWppyoIzlqz~bL0TRN^4pszP&lw7uMe^X
zg#c*96j;aM#|offesKEFNC3qxgAmwNEMVs}EH7aYU#iEz2wP0^|NsA35Fcdt{|FS7
zE&ty_ir)YK|9gYfAn9=ity1me07aai=5h`OmH-6-p5+=0G7bs?3=RweTmc640s;{Z
z0SucI7#v{>>_9c&8%Br^Kn8TY0UN*x(zuj|fn~V`g9FHb#|#2o3@Q!=0z%kKc>Mrm
z0-^!aad!Fd{}Icz{{IJ0LMkp-VT{_z#8B_DyoC`oM#Tae$y~mYfq7>G1E^MG0FQV}
zGBAQ_aNpC*TNomo6$}`h6h17U%JpIS@)kxZP>h2XqBtpT;9CwF3kMC_&*cBUQ;|Uu
zR4*=9VYt71J$O-y)$;YAiibhQxygXRsR3pN!@v5SEDWGtd!SR}2EOIm42*DtUV;sh
zTdu;e*LjiwgVO}KrZ;ds6Vdc^g7ru&S7BKEnt_3dfoC~41EcdJ0|uuDaNYAkx<NL9
zonHTN10QIOBG_7X2DRl<4E)QZ7}$2QFtjYUkYaEU*uXG}VFQyxzy=NngAH5}4i`X?
z<-JLXL7_u|K?al}Uh6y#04+`d4Y9rM2Y1WAf+sLwVWGkh<J^VfZ_rRB*xMlgKLnLp
zU<bTrU;?=e92SybzdT&7!eHk-%YYHd|Nc8!7@qEAVTjww!q5lT+YQ#s<TP&s-*QOU
z^(|LnP;j1Qz=Wh1w1lG-q-Q4!L&Q!NhI)zR+6>HK%R#ZXlK;EYj17D{6&a+KANijq
zA-Y_Ofe#uUP0PRhuXGIEz&D9EfB_V!%fI}OcT@%O6&OJN0~NS%`B?^_6_o4Y^0N$>
zmVfzwbQ13dK2SPZ{^j2@klK2%VNC|0zAA&`QjlQ_7(ns8{L6o#<(&)+%Oe=rmP;`3
zfs&z5*YYp_EtYqJ8|<F!?1-jRdnzb@gGxBi@)B5M)CXLaq~wG0k5A5W4FLvFz5$Jx
zY*Jug+@!>?prd{PBo1HsEMN8iAE?<Nx_J2!21!ur2bFj2j>{z(I6!5XPlThY1H<D5
z3ZUK+*8>J8)(s5ca1;Ok2~se<UjN|(Xgrji{WW}5ZM!VUVW7sCkIr%l0Z?T$X(tQA
zW(R=<43iiZFx5j{!-brnUa>9L<o~f#kzv#FBMdUjJ^6n)8Y}?ylE51SQoz%&KCF;A
zjmHiK91Ihed;R~pQ-nd~^?XS3+sVS<z5L7nXNU=n_SogW|2rHgU|<Xe^*53p3luOg
zu<Wd7Vh~*3!f5zf5xSNu2vWN3Y-4Z)4avPWVqjt50WD$&6|z+xphC7}iDScut&S5u
zEL-l$zzqs)P|63%B!l_|4$CbW96<TvZ^vT=kR_lgcTk5L+|FoW(A>oOVa01E&_Lu)
z&Uyx>*9M@5253h5wKD@h1Mg#p4=Wfrz@*A1wht>nQSlf&`S=<%B&|A)<HI^IOaE~|
z0Rw{yXyGx)x|cau85!EZoea>Z0(=zxzpb;vhh@tp82*b0E$3j678O|D^8e*>6$T$6
z!R7TW|DP<EW8ht0!Y~aqunw^nY`p4}?=Xu%K7y6<f8~}(F#H$Uy1a!U3A8X7)K=Qb
z!mz?|_lIpeIT?05RsgMa0)<AJB)Db~1ox@8{|8Mufu|?ZJePAY$cZXQ2rWNS&j21|
ztOR#Fi$Tk`BbUoDfL2BMFW(5-U-Ew{$dctR!Sh<LL6K0o!qM)-)=3No;6+%)_d$Mt
z@gC~;lK-vX9{&Q+q!li2Ok()36{PFWPSE(*Gf@2O*9W!n{_oi-!jK4_tx#ZKs00tU
z7q5S8@X>&Q1vI+-Iv<k4Uq^$w+e>{o8Fnf%guGq~?r^L8cW~1BuyrR3gC)qB%|eh7
zZU%<pzU5#38-c_sok8JJylwfHe~(@(fug<M@lgUO?;ir!R^Y*+<-h;k0Oi=A>7asn
zCkw;=>(v|9Y*;hZL4ad<34_RT%?}KYM(a!V8ykQYTKPU^T3^O6aXAn3i=8424v!rK
zpe>0?a67LUG~@uDQ;41KIB5anR0hzJEk^zW2@DLgoF3OFY*@gc0-11OV2A}3r$x)F
z890}g|NpU*g`s~ZC&PCk&?-(RiA#<Pz<vAOj|Da?U|@M109sTbVFYPEEw}prfB6dr
zcE?l&29d|hIT#o(F??8%z#!@XYRD`<!mvOH)G>)&{tjFp`YwM5t`8mRm%jtA(llQF
z4!lZJZTUO!Dox4d@4%}xc^(%`U}TuET#|vw@i}NJeF5VGhR1;*tDRF77@QIpfab~>
z9~Xi}*cBL@Kr7v(85kcw1dGHeFgOK5)g*#N$`lx!3ZWtoC)9&VGd?737)Fa;Tz-VX
zsl$MQ8Dh!fM393X2TovOnDCf!0yD#e#}`4<FV4>u7@W%#7@R{D7@Qt109gWZ1S`XY
z$B7fz7$!IcE&z2u3LXc7X3CuJDlj;|Q(&lfPE%lTW`}BHT)^yfaRH0d!v(BPi3`}A
z0vE6^muBEtZub9(qsamWN0kMPlei2RK(k$w7!*K-sTC+$HQwLJ!T{cTRunx|VF5^7
zYk3QUF(|R6Oxr2KAoO}6D6u&@Y}DAv!LVfc%?}_oKbChe)H4bxIZmIz5YTnMWqAvO
zA~<=J{QC_uw%8nGK#`H7!iF`V?D9A9alpnI44};;O0V-bMli6je|1z?03N7JNnQ?}
zF)x+@>jLfKxD8rvim3;b)M0f5sQ#Y>t|Al|7|Ow&?jkKviMEr4Vde5K3=*JCQXt2a
z-vSw12%dr{0#CIUJ_BX2<*ON3mhWSb2dx#@FAwVL|Npjp9|PxdmH$sb`icd?`oOEh
z%XffHd&<C2ctU75NVdElG^Yt3>n{W^lquQ=R=#s53xm{hX;3?V0SkCHL<s}O^3@C+
z%Xct<>hZHXSr|Zbc^5&36oCgK3g^R}^W{Id4_Gt<Y}RB@?t)ZIpr-Ag{h-Vpu*OM2
zfa9@2Jt()b|APbxSYp9)PKE={3IZHE8yFNIGGOs3%Q+buP{kp&8z}TZHUCZ)hUDcl
z7#Kif;xn3;cYt>FIWRa(Silq^uz*3rW0T1S&?Xj#4hIIA<$mB?cYS%iA9y(F@<hfB
zpvBRO65v8Z`c;I&0&wxlc@bJ`iGcjVJ_|I>B4M<=gn?&y9$4p&#|j(R7$!=pfwlrJ
zpT)okx6lG=A@Z)7`OsZ6vtjntLoM6{w{Rwkg-I9|HaunkTL@ZmTO}b0>g78KK>Zj2
zwKAY1fI((?9N3R(%j3WfO@dhowXqUxBWV8%X99|qpg|%=6hFE@egL-e+42?!M+wj6
zUJOhQ4p1vKpjLug!^=T)TrCW`%k{ukYNA=`0Jice0|Tcz%trA158DR}U-BXOl4JQS
z2Il2u|K*ljFfcq80QCWPiZLj^&i`-$GI$9}J@B;Puso7M1XOc4CVbcciZt(w-~xQp
zau)`p<$5d(%T*X8z!kHhqrrlD&^lcwP%19-2PrPFhu3zX70lrFoP<-C0|S?%!2*Y!
zA`C8IwcvWZKoe6fSQb2sULXakN1=TrEysipOB@5hOMJY+>!ZL^(tZ;4kg;sg2-or!
z2Ji%AnKZ~D`M<FkZot4$`Utca1mR=Q;B-?XG!KCG2u*ry09wQaa!4t7K~Mg*#|8^P
zi`qb2zgiel9SbHnEcavtm4NEt@xLe|&``j%)1Z9%xB=9k-zmc20czKQO1=N#LP`=z
z%Uu{89veW%@Ib>%TFbTgL2DT|!Hs&#z!1f|bo&Pe>28pIkZIuIjHmzq|2Ku2A@|te
zf&gem8L0a$mHl`_y#WJ*%3}pk@BgvE0txsi7T0o5<_5?<Cs1faK7_P(cZx8mLF4@^
z*oX5$viZ}NXMp<z??K@L?-v*_Ff=iOdcB)iKP-6c0Gi5v?ZUv%!1GuD6hb>$7`E)J
zZv!v9_5u|#e)+Fmz^z>l1}8`};`Ms)Mw5Tgj)nmPL*reLfne1U5efn<=thGKg&Gev
z8Dgfi3dAhXo)Gqb%Qcx_fQq))`Sl+RAd|$6TbKX--2e*k9}-}nIe>izZn;RNgCmFs
zBtA{>u>mNG_RE77p)ojt64+w~(AXzvbfcLCIsntcU<#^5KpX9*F*z>y)BxVQ$uNOI
zL>s(!ll}isF{b5~ko7NG4h$0*Kvw^a2j|NY26u2-z7I5G{r@S*+EQ>elK1$r!IuvV
zEZ`xS{4X0oy&cE~v#Cr0Jj+X1zJi)nQxAYv2~Iu!xFG>FHnak=Y4ou}LoUMv5igGi
z0ePJc42+=dqf4LFGcbsWfZVrJ47_bw3$&jU>=Y@mQ(FEXcHHn$W4R||1Smm*)^mZv
zC3Z4s<kxpSh|N_fqy$<M<vS5HO}E^IrTVc!gE7N|#|jNbAQH5237pGR9tSiSFid#t
z(4fyS;jux39>avk^$87z3==>;EIAl3;S+dfGS3lgcq7Pg%hj7$KQ%mNXfR+9dCc$$
zH1jLQpa5opb8ymou-?5OwRx%_Qgs`Mv~XXZ!N4ss4Yav@rwF7)Tmr6J^Mr(EE^lG7
zT^<2yQ`a+CgE|%g0iVEIK2^7XicX25<t>chMsx{y*-Y+Fq4MP}OfC@&pK6x#f!c}8
z%***e?L%e@koBeDMI5=$A`Cv&EVl#6Gu>Zq2bLFiobWLNlodgaiqHgyX$jLYq4MP=
zOuRc;80x`Y$_UWH<0A|_py8pNA`C%}svk3^f=2jCm}EhP?s829h5&<)5Fgj?WCATS
zW8UI8q5l8U>ENc6CTO=kD1t!N#2f>4YL`neFm0-x0IG5uIvN;cggTa&FoVWbqIPmJ
zL@tm1zhU`ohJbp|qRPh#pq8nV>I4R{rscCCiz;C&)lxtUv|E_oKTi16&oJTfgHL^+
z82r=&ios9a3=<v)d};^9@~0Mt36Bdt^)gI&JmFIp!-U5PA3-IHz^6_S`%^1O?}r}@
zDvujJbudhL%<!oVB=V`g8D!jt7oh!!A0B{LxgKCpd7J=V@u~poL_K!+)BrO2!v_YH
z#}hu>U{HB1@Zkc;AkaMVV}=i)b+Qk@i7eq$6WBqG3==@Zj3uBgD~vwijR(nV!D9$+
z%PkoMmP>LlI2L?Vah&j}0aX5j7S|SljhO(pPyl4ufdmFdA9qk)2AVAKv4y34e_bJ^
z<wuwqA3J<hVGw!U0`5k$FlakkfEq0S|Nr?L5%8&Ic^oKlF>G4i!W0gQ60S=^yO*ml
z9t5S967ZhVTt;wKu1Cqspcs6t@Tr19WO)SxTR;IMQ5t~;+`!2cWR%%o@Y1XnCO%M7
zU0(8U189Nb|9_x!2SCObgQpsE7A=<ml@ko0YQ{Q10AiAgJ4g>`Vb{N@%RNBbSL+!V
zAQlEVK$IA5163NJJOQ@sIK(o>8z7C#Oa4_Y&-(utbO-|2DoK!<oZRIZNLD34%ux{n
z=>S`mu$%*A72GBUhzg@dQ2IysYZBC|#UPE#Oa8e^ST45$TL#`NTJ#ufnK>xmf}96(
zCM?@3-vQ|XTc(903_)Y82)kmScIDQCG%hds$G?2m|39#Tq6oZnCWlEP6K2u!84N4|
z6CmzZUIx+wvh44d<u6ct_5h;72sE^auuKhVnK?+`@|M55mw)+t9kdzofC583LlL;(
z$p)`ZF9L5V%LdN?a)LVuMc@r6*>Ay#1vRbI{r|VTh4J0;Dh6;5L9}|g%K!VIXek2E
zqGW^C72gHb2a}d9w^U$wEC8wv9t(WrU{F~u{Q$Ix*>NXJJ!nt!|Np;r!ELmn<t~5E
zE!SgUUw(vf-SQXg|3vkctAJO)IDw1+70X@+K+zD*=-A$1vD}jZJgeii4Q%cHNem6(
zMteADI=+SB>2gm7E>Q0AS_YPX0@4{V1vI(CpbP3LI3|3oS6Lp(Ah45#!E3oC2Y7DZ
zYeK*TNJ-}%4a#bN+n`y^1fJE5AzAIWcYwl2nTQ7;WrW@>S7G2?{^f7MP8J4tkW)bs
z2eK|&Gs59h&2m3bq09iz8Jq%O$AFjRW;@k`>blRzmw)+Z0UJ0e0&kefW?lZ}ugT+t
zkItYX<)ag*nEL1lD)l}(Kq{=l-yjRJJ}&?ASM;&MM-2w>)&grucr8)#=j-EykJ@1U
zT44Q}VEr0U{TIOVA6XZdfBEwik_kZuDwl!|G1<w&VCAUr5j@^!^aaENxw;yh;j(rt
z|MKS!NX${;qX9^d(PIz~q@oa<g0hw`|MCZ1b?MDp?g<WGBbeGKRj@knq+QnJ`sH8#
z%!QTpiJ;B$pmmNVNY2q){^jpdXliBj1W(EZgO=SUEpK7CG>IXB0TjcYJHUos1vw@w
zb1Fjuqhmt?<MNh2D?#(do-1~8Fcd70`2YWL!AAiGm4JYcGN8pcjtvR*j8hpv`}O`S
zJXQdAEEE|umLK^q39=A2su?_WCldq6Iu?+1Fwu}MXp(LDe{Z=Zc)dTkR}fqWRqX+7
z8CyVgfos~3c1MK-@Q6W75hyQ!*8gxa2!ZzT>=XeHxk6SktN<k~Q1biZ30f1nQ-Yx#
zeB6Tq14Cga*q7>{;mYM-{@jmP@Tq3`I&cC5FGFO1wEW9oVNiG!fD>Gn(DE<;<U#zx
zV6aZE<zN2D?POta0+oN@W=0`+zB2RN@-Kgc5J9h0wEWBeoA{Do0eHJ!=BDLe{=Na#
zc=>-p)?|T8%FN}Uq<wD#NTdL~T?b_T??>$HAdv}2*#ChVwe=GYJXR1eW|#nK4nO|z
zp#r?Gmq9}4di;k49~OWX*laR205u}O{dOUj<t_hzPGtZeIRQE$Vg-0?jAv&PgW^tR
z2By~mpry(?MHo~cfB0Czz{36y6zj{s{Qm*!8GtrpFP8)z5u>2NAokcGz=EM(<gr75
z0Rv033h0m`@Vb7X#|i-k3@Wb`L96;f&SGbOy&AL!e0d-vXmyvw;|&U+T`{1U0I}tq
zpf2eKCWeVS+ZniaiZL*}7GPjx;PqIbz~-=U0}FU_vdC*`(9HSc1)zlo60A$v|NVb#
zxB%2VF{oEyVGwz}87wUTk`C||;CSo+7F_}sH2{e^a2fDKFereAo;E-Y15IVHI50Z!
zf%i{{yxs*?y+J{Mfy2XK10QGunuEaxK9H{ETnvl>3<@mE13`;17`PuRfIQ$4pun`e
zK8k_SAwYo%>_Zmze~$$e6u?b~pvMdXObinv85BUPcBBIs6gVCm1b`M!XfQAYC<L%T
zPC+o>cpLy0m1JN9Z9#N!2;c#2xMu%{7SKrH3<=+61_qbqlJ#J13=l1#I6_RFRD<Sh
zBfuRj&?YRF*GddL;O*u}Qxu?MH~K+4XH{NLVi02Bc|2i*0t3f>`3(%qk1&*gB4_yu
z(8_5B*~boGXIg+A&k<k{zycba3#eCcfcan*cs(;CXmyW+LI97X!15yu+OGo`*cf;p
z2W;SA;CL($pa5Dv0uC320FLD)|F1)Q830R8*nP>(05(-pV7bcwn;?G+ty*5fp!t|#
zg90f3Gl5p3{9l3Jr#o2~R9-8A{J2w*VbXGy{}VvL4JySz27;E^gZ#66CIjQn1_sU7
z^T7l4;BmFrpv7k@uP1{%vi$e|gvS#UI2br~vM?-JzJsA2R1ZtPRs<y;!RU?v2Kmka
z1`bf~&#`F%Ls-xPp2toLI2c5BiZFyeHfR7%8G+BI`v3o5^+d)7{^ceA!AlqZYeXna
z&;aH5f69VPT?`EJkd;q6MHm!bLw4AIc@00Vqbd~Ci*|JQu%Ldaj4{JwaElkb^-j^l
zK*4ai3WMZpX3)Yy@HPt2rZEEso(Kg6o#l~`b)iDFj~zf$uCMQd3T^f;pu#6(0jOZf
zSP3fQ(sMyhxl;y8QSkAA3k(cZilC*~pj6Y>AtAKfld+xw)LsK=?3)1^Gzt*dpaU`>
ztkBWn!-@!o3jzTPKCB5~_^<-zybU1d#l2PrIq$U*Xtg86kszl<C_r=zK^CF0UuE22
zctK=2=qv!x!2^~Ipk_NLe>E^Dzg`d8JyFm8#o1wlv6I7x<x`nHEC-EEy%qsYuDo6d
znpD}z%)s?p0aOry*1tnnf5SDie_0;Ez#;DX`UzOaK9G*(yZ`@xt&Lj;IHbTM2^pZR
z$@L6rH$g#l8@zM`c_U)w%;mrTfi~c60tGxs&41`PA=3=djFF?mhYL%2j2Qw1Ho61|
zY|wbj0PYom_D?E$7=S{FsSgrLknn+o6>=yE&T$N=|FGN9;lqiDgbNDbO%^JX7(eU|
zNceCfAmGCpXpk3x4a<1l4hnLpVHTi(M=`8SNJ(PS@)D+msZ1M;A3JO?W|*+Nh4II7
zKk%_E0?YkC6EBRfKvA6so)=E*UB2Rf{omzZ7*8%=!N9zH1_RUb3<i~HOkgM7h<NZ}
zON77$1@Ly{2^$0g9(=eHAn@S^)KLszN6EbgofE?gb(ArNqjW%xO(uEA2_FtSHhg#h
z%Ayeg7i0nyJ{+FJ@ZoqsK>ddY0TVtvdE9V;gF(>)Y$)Rw$AS+pc8W2$J3iPr<8i|U
z28IUk=#`4&f{hcv+mlpY3xL7`e7X@2C=_<GFnGWcpTH-OrHtDn7(N^Z4Y=-<XE4|)
z&k!VHBoYwea6ux#U;#tGgb!~596r1Vs1NvX_;CT)@&_OvF>ZS;hiWv~Y8JTRN5F<p
z1Wh|UUhrWBg96ymC5(m=)yu0G4ICXld|2M0#1K&M;fq7VhYt=3A3i}sY`F?!$Lj=;
z+0f831BDi7{|6)7aLB&@iJ<ZuoP>@rDmW&5*yA|i!w>Kj`l_Y60-zNE3=s|&L>?~y
zwdEcwe3W2N2?+SGC&1yukAQ>^e;!W&d1tu_W1wTfM~0nZ49_1=0EZ!HW0wkOcGR)q
zqrmbn3|n8nVyI_h01bo4Jr)3!@E!^u_Bkkglv}FC!0?y>RJ1%c_$b3LF+f3p;jzL;
zIfjX^gFq$aa%~2tog54S0R|ryyfy;W_Yn>sB_1;f2r#HbFnm}Lz#w4Zs2l*Y+yu0A
zU)TjSy}eV6L1kwHgVAFH0R_-VgMb8sN<C<J#lawe;c<WfsKe~RzyO*&bZ`h@daNLz
z0AB6G0BY$uFerf3fGQwxbU7FVFg<n<U|~>s>>ywO8kE?;!2ph?fQFAO0eS)&5f3g1
z1U&f20FEFPhSQJ@&d_bmpgDGy<&g~a@WAK435r>UX`tEa2!{;}l3tJ~U`UXV>J(t$
z-zmcI5HyD2{Sve@aJhy6Lqxy@k)0e2PXZJ^N;oX|DC5BJQO;q(hdmAqANGMFA|T+y
zkH-%{k@Q*^6z?d>)e{ow^$ZOBb3vo=|G^8ebHFQlQ;vWZU_TD{H~~D_23j2-0GezA
zg;j*W1(^VY4~Hi)emD-wIROG69xVUzuV(oQaQ0<e{^g&_@)Zn>%QF}hmw)*uH;o09
zoj-C!O!%+`RLTTQ_{bBG@R0+WDC<=i99|cLTn9~+=AcvwavLaHfocMNKOrTFMax_M
zgI7A{90!S|lq~=9AKbFd*$U?8EdK&oHJp<P=BI#9X;WZe$N?W(krK1~3uHrA4(QMo
zhLn)yE5Ij<O{fQz$EjYRQYjVOI!_S?6}2}NKq5KdjRGll%fCRj<L7`o7%67Uzx*!(
z%Y&yZQuLO8`JV-wPz2TRJHfkV|Ns9Lxm<!l;eZ1JlQ5`@y9gA10RoB>91I*79&b<p
z9eh>)^#A|Ad=nKGPF~)^up2Z`=xDIe05p^g@<(v&@)-;q%QablfOrwpb}}&-EpK6%
zy*!eEX}KpWXoeizUHMfDSJMJj(}|%b8?L4Zs-}E-WIdWek#I$z$_8XvDuzMsa5a8V
zgMu;Cn8MY7j^hED<A|X~dATNQJ;Y~PP=oX_6bZr&l7Om_MOX9l|MF@7K|OzPSp2*L
z${+CQ3I)i_C;L}WL}%XxMOzAZ*Gw{aH*x(9U64@rW>5epdoSkz&tp7>wAnyy74U`$
z7KSCDRPnQTCkum+W5b7KpiU@gbOY3QdAtF%3KXP2NZxV72GE2SXe>b+lz>5Mz&h70
zj|9*7fYyI`LB<mQ|NpsodHoj#7El8cCiIIBoEd*aC~N??=6-@sX)IyjhBiG!7_?sZ
zgPWG%E$7+b&6`OdK-qQqm;di!?FXpCLC&25wq6{X+!in}37&oIumMzz87yF6m{@<6
zaRGw^=)9`Vonj22eccS;4f$d_+ZmW3XBR-G%N`4SSi&IoIuNwkFoNO3l896Xj^$bZ
zze#2;S78VRcf1~e<Uni29vf@`E#nqpNP9fbfrSBNR?|)qh8eFVL4`MH7d&Xh;jy6s
z14BK_a%%=IP~Zi=dR(vp)UOKw9j5{6Iy@FAfb{EFL5J$Rb^?|2pm1_%DPVcr08;C*
zp@9k1R(9CXzy$K=j|UzM3m8D%Ee8hBsYl?=dMw~6s|TQ|N>Eg1{Ri2W6b?QUX(DL+
z8_CBKnUKI){^kEn@Xl5NbR*c=AuE7E`5bIzHsmBT(A4^`SWtTxl6F9iS&$lN`e^~B
zl;xh_bMKf01$VMAfD5j`dX5N%1uPOq9R>^>%Ox1>MGTi4GT1vaEC8MH$g<R$!QnON
ztZm-qFB$50HZa(|4q@P6-~nyY+1bFLwKReeG~Lc5@ba}Wg9Zcd&PImd*GdcuU>0ag
zCn&jjI4Ud<ejEVm?}B_DXujN&AqV7~0}2dG^#b6-djpOxpYi{{!-NHPJ0Z)4*>*B9
zq%ALD;DpTgLc0*4<0Q2~@dwfl5d)os7qATEZ$#qz_u+s51Csz~rRS#C76SGR4X=|y
z$4)?YfjKh>*n`&9rhrD9>cJb~vf_3&FgSpBD5+fH|8OG!w1MtLfWYIj4>uSlbQUmh
zfYt(bx;vMAxB*&T&>7_HAYcbhYM^aODvuk$ZQl)`*#U=w2O7&A84iNBq=Ba2vSgNL
zF#H!ukud83?Gw-hudp>*Udh0>vw@+c{_zCRw8JI-56c4>9GgEZ2klx55OAFSVL8|$
zwMz^S%o`XUF91zZTw-`&F@a%u9(d`{K4%31hvgOw^`LYjV)QrxG(oX{zJST{5(dx`
z3x>=W%U>}37qNRR0Gjt$ZpQ%HL7D_AhBBXlw{;qPWMHUQd0YS<k!1w0{7zc#2&P4r
zzXW&886O*b1Z^#7V9<M=58C<7{u$(_%&nkPF+r(0^8_eP6AnY8O#$59o(Y~4vIfZ)
zfH$5bY+k+!eEjRK*WRE^>d5d>U?&HI!{aUW^G|^1e0PHn)>2?#$OP|%N;nN_DuWz>
z#Q_Ek44F-EA0T_6<^Lj(rI~eLM}ZC)-3{J3-T8rGdCUJxpdovZd_H*nOhV@JEQWf}
ziOOoPg}|-~0J}=`@y7lYXpV{i8`ubT)R+I;U_lQW-A-&l3H+A-uFF?~w{K}dB6WEt
z1N-aApn2uj6#_mC4US5%NZ#4NFs=R)!vi)22Im9;*eP#Gjx#?jf87pBuONe*3j};F
zF+5<Mz_7D{p$cN8<1&~Lmlz)KE?{^)L%^4z0U`%UKd&=E`kfU7d>?mwSPmW|1DznJ
z*xA6q;oSaVIb3c1_5gv$VIU=-e!p|jhvkzD9`HCcJP>gRcpw8Bp=&?C{L8=lpbYjJ
zx;*cH0%(?dCkq2;xq;hG76wyLgX3`kD1AIu0IiF9obb^HG#vf^|6kCNW#9^Dxg`U*
zjQkEd1Q~Q*tOjV~em$s>y;Foi2|B9}8fw-Am23YLAaj-f-+>w>px}=`yj<h|fB3Kh
zTn8-QgH}Qmflj%U*a<50S-?luft<Jnyp0_+skZ{W)X(WL1304!eApULFYw`k(}EA1
zoi=>fa^L|26JO_J2GH6BPyxa>_wfSIDGtjs8Q2^HK5TL{_y8Ve&bSO(1vQD`!}du+
zA2vOH0G_&I0H2Z}0G<<E04favHhg#j^2q-TaJyRWfB^#&U({oPj}Z(k&JG6l&H)B?
zVy^YCQ^0-qXW+j3>;L~>>w)_2kPrclaIk*_`x>kbSril@$UZN8yZrY*2C%a$9t$W&
zFsSU8R|KtnoOECV0~4Rz@)D*)j-b<nIv5xn3qD)`@19gyUa!dnI-Qn@FX=I4wi9$P
z5U2so06GQqvA_ib1{Q|}8x{mS*sx?N9}~yp2NyILSPm>;VB-A>nFkGE_;BO#0`O$(
z15il<b^_yLh6@T1b$q6eA6x*{s|!9VFsLlg1P|eXHZ^-bHu$ii9&-3-`f-Pb4U52K
zy~<+-P>=5MgO3`J16Tf?6aqECOBfj*J8ZCLm>}e`yoBN5RE7<9AbNlP2GEH{e>)Nw
zn3v~)`uNPoLTR9=<o&z6g<*$;nY7h%4F+}*<>f65u%o1XA^YGM?3UL<RxIf+*8>lr
zD=gOoFTVtxL(aCmgvsME18BF)PS6lt3BzMhDYpDIXmK(~bh$qRXgv4^Tr>bA3Oz01
zEL;@4Uj~wx84kfk1t4nc83dP?Fl>hlBU`ryCMub=yoDhIyaY1=q77U(&XI@$9hv>u
z;Q?qDkUs;1#M0#@3==`R9xFgMvVo2n?vPlzd=&%JV}S>d^)(<H>%giQ9@K+IqaeO3
z1q&rS&;XZxpvpG~EaCv(-v;q(GFU|6fdyC%$Z(Jo*d>-Of6d^q-0c4*&|zy59H0Z4
zA16%oW0)w)w*1IH@G8MH@T_9&ljR+to)3d8WC>pV|CbUGOT!pIU1d{H*_?I<l-Fay
zhcKoc0cD^+@{qv$&j(u5_gLT)XcwFagU0LpPX?eym4w7nF|dBn*=7uB;N=&wjaVJh
zyZj4yiF4O$3s8ao`0<AN4Ga@OX&Y48w#GkR0LshDI~Z6VF95Amy3YFH!iNjs91iL%
zGdxz97y&xj>LbGg2T&hrCkuo5CH{{B4+21yFvzjLeL>|M_y7{nifM3B_BGtuV1vDL
zzy>=p)8&TX`gPOtOh$$S0Srv_ylX+ddr*4@QqKMV|91gsH5_Qr5L9sd2c6i+kTw-;
z_-t@UwEVAgZrHSWxdsEjNYnB@2BzgDj2oR7Y}&B=1%tfEy5;M@Nf^96XL$!h;DH1N
zCf+L0It$0Z1cAMc0iZ-HzFZo75@<a`T8pEj0mE{32JpEpX>H)(7lv$*daN)p0i0(Q
zKyKx|0d*>TY5iYs6sLmc$<qqJPIZGiRTDJea-e~MiFfDnFAQ9u(S^qhn>R5`l;m3O
z!f?Od@l^xM)C~_nr`UX1p2=VXwrI<8PlgSk5l?uSh=Y1Qpv|P<G!n49g@Ffjq~5<@
zV9Nv`mi_x2k+AtjK*Gcx&|=*E@*7N+w=gVO-Ud00EfqZf8?y{lojHTf7UW>47pWIm
zF2_)?yyX8!=Y$PT%RLzQMN*dMF|dJ}Bb!)3hp>T0X%SNoJKGpQwVBFmA<$4fC=i!J
zdr){)!v^k!maF`Kz5L6+>yHZ*TNqd(9O@NY9v6U?pzl|n*s{EYL2a+|M8D-K42D;k
zH!PVLuv`T^4GSr;L5HiUEdTOv-D7a!v0NTh{QR2>%95b+j=OL9m%r<r8yrCE>G?qI
zyj1X1TLO3$VDxVfhYgFsrXTr#87#{Np8rpH4~p^VH&6?Y{67VfO!*HA=!A!0xqHjM
z{0FZNP6aQij$vEg@&C{AFaPZK+fVFSUc!*K+=7E4z+hs}(skfYruovEc><u>Pe+B1
z439x4LaBha^Q(Z;0oQ$K9U{QM#PzuzQc*xETF`hMWCI5H_#J4odU+;;fMdW1P(#8K
z<fzo7#}7dD_hSK2%lR<_sAc@P0Mz<@ya3eF1*eFu;3FtY{=RVz*kJFxVS}Am^zuLk
z(1G>fvF}uOkgA{GK>J^mmbd)9`54p~W{Gh4$nn@<VgZ9nfWyR;<zN1uUmn51AZoh&
z$p6WpBXz+c^8n<C1n~TIG-%Ul>EnP6pi(4Y!;<A+{yqd%%#fB6s6mqF3LQlkdaM9y
z6+|c~f|g@72Pk|v62TzYQy;+a;lO@-K~Rr<$xarAsmog!ZV7>M=&HvKAC54H1Q>ic
z@Yn&=tk}uKFmrhc_%I<RE;~no56>JGK75GS@ZrGnnG6i@FafP50-uQoiaO@HO+gIW
z5d|NPYzksff6VX!)Y|4@;JD85;rWN>64IOMgBZj?<99p77(hcxOk5y$f>t_#H%LBK
z00*c70}~f$ejGGo2|jxMu>z>3U#`Kx1e&IPTmW9Sv;eeh=`rY}B+!Y07Z_L`8+_Qo
zz_L6OlKoQVPty4C3^HgN!0_RPgTRNk2cFjd|NrYDsGMVv0Q-Q&+2Db_v%>>BF%xi6
z*}?#huaq`$d_mfTEe!S&nbO%iB^bJe(j1pB08L>{TOPpxn)5S>2>5V72(&|5D<a{;
z0nup^JC`5%Un{W<G=?V1yj<mfI3!%5VOkFg)RzB|pkjw}s$;^3XO0CQK0FQpCosq=
zF!0i><zN2alGwTY%l`<_gz{qn=+LC<>->+Pp~;VrH-IAR@dju_g)VRTuYZ7nfr&HQ
z(cr@~(5N`1(FtnvfQD?r^~{(5tLtI2Q=q=O#3GO{KTHCxW)E1PpabH44vrAm=(1dn
z0dzWmY6QbZkL7#}3d>6vz{^Ndz{}O6KwGu6A=}SD;{d-whuSivfX@wyGKRF6muvq2
z15p7vWhD6}D1AiLtALIf0i{`XcF4d1=uQLZpuwh{(1E89p5U|Y4WMV;%PzMAPpa@P
ze*rqf9CY!(P7wys>DE6$D?&lXE$(Dt@C0?YUiX7m(1INGuNqW@KW<PEU=VrT0iKN1
zWJs=uHai;xI6&t>|Ns9%1Z))p)T)f-e4vvG7((~^E2b=WVMyt6VBp*-!>|Q9x+MTQ
zmIyQ&_ILwm$sQ=gK6r!3_aDIKz>eqlfgaEA1L~me6ag3Fmdhg<>zP5CK^i_7ERSSl
zay0m`9CS!FTvQb-cP&Dp0X!b|{vtTB3O#-R>N7nyK==FdouKLF|C^V;U;y=<L2W6d
zklF9A=(2pt{{_pv7(w?*%qd(@ujsP;%l}=43lu>^#@irK04g|gK*!~PI$E1SovWQJ
z3`<`(gNCL-&UxPq_L~4SjC_{Mfx}2Bf<ZAw5_ER75UA3H#5-uOCuF3A{R?PdQnF!r
z3FLT}1km=3dWMLvuXi&jFz_th#=rm?%L0#sgHAy8-YLSM30~Lp^#A{V-<B(aS}y;=
z=X<<&20H+j9t6PYq2&L`!VQWkJ0%!aFaPrYa0CO?Ya0|@pkh1O*+F3oP7UWEX|5i1
zH0!-M#MO@#Kr1vLBU{j8Gr;HhgK`Nt1en1NfQ5hrI0RZ4I3bI8p!z<63h#gb#S}DA
z4hCjWg|*y+fhC}xK|v$HK+$CqgQ7=(gJK4%Qji-_9r*4zX!~@4fPzMVfMNzn7uX@N
z<Z1;?u1XOOiYZ|09TZ(eU6;2ofDUE#T<*sN+BI*n+>ZrR#0M>ZQO}?_iC@vl>4Bm%
zs?`w=iY_1nL|vDc{C~3i1%oJdb;~UT7(gCa{(^xAhl&>rhB##W1nR;4yyY$bAK_5)
zf`I|M4D8GpSd_f828RSJN*usZQo^7bu|Y8f6lL$UBMcNYmYV<nyW9@cO=I8(sjq(w
z3p!D7(6ulKf@Ue8!{?w~9^lhp*uR2SvoHVh|L*c#{}`5Q@G*#P0xdw<Ig`Of*aTB`
z#0GHUI|hnC^bymy&p{SHhB&mog+T`DQr-v!Mc4%qpaF^ZprHx&FQ73WNTLLHzoDWL
z3W_e6qNr)*?Pes4S{Ssz_JBO7!NBm^2-NL=>;NABc&!ZT{X<jjmk0(0jpcmcAQD`z
z!SElZ6yzLKmCg!^PPk=3en)dqHim=hL92T}*1%naX$_i#>~UM^tf1(OTNdmf@a;LU
zH1k#&wEt}rD0#e<LvfomG_WK<v-zNI$72P^j6Q=L`0Sb%1~bT}>*bmZ46xH6_Va`5
z2*oZ222RjkP>^1zzLNjX9vf_g48St%YzL16DL*#&ST6v&GzU~iv47sr4=$Y_FXv+X
z4>Mx<m;d)48*D6KU;$Z#q!CFU$Y030K?3ZdH`|t5fM$plCj@MORORo%hi)cBf-2sy
zd`Rl42N?@>KlpecSZW2W2m}X{0s})h_*k_tHBdO6)<>+6%G3o-v`C0_3NVN-<zr|N
z5dgIW!vrp{Jf84j2?J;thcUq5!<qnr4=Y5yma8yi?_^?dkpQ(XmM(8$&|ALafBk<6
zNk@ebOEwuRfEL+p=-9v@1G?Vo|9|jac<1Fu7~Da}j)FE*{{MekP(pH(=>m|-0MHgQ
zp{>hH7(^dKCMiI7KFkM)<i}8h3k=JT{J#WhDaU^WIs5+%@YX{G28IMykpDvuKy=lE
zuZn<bgDHsz&k2OChbTc-0kvG9Lx4dBa)kE(!(dBxf-OmdMg@GKQO3gMpj!$(1z^j3
zn0UY!8M!P44O8(fil|q(0Ge=T0?qI{FbJ@1if0gj9mFAI3_1toaexRD!$i<f^v))R
zxSh-lqOTo6iwq&j54`Cfd_xfX=j9&Y$-A%Y?C^z*8WKXF;XBZ&iknQp%NW7?<fb)z
zSh>jv#II)n`{nTma5M5BVu@6S=knkGek_$?fv%2n2>7rFI%loIAOl(#8Q=gq9|^M7
zfkF7O!373}2GABWa1{%xvOhd_0Ih+1eIIme6QtD_W(*3af0yAMlzN5?+2z0g%#fHQ
zA@tY)G=}M@@Zm;>0D~Z8&~&*41G5C@_4tn*A2~p0Vu%QLFfd3+WbPDWa0(Fka3+A^
z!xe`KA1*CT`_Bd*^#CP0(C!A%S>QVuRF=ju{1llgu~Q7RtlvTcG<gGRfP)Sn2RRXR
z72f~<60;?YmbWl&1U0P~>-P(O6m)*@QDAuq;~J+2AJ$Lh`LKR@3uE!}hv1Qp3Q&B<
zeFi0>kOj*v8JNKb(>8!b!RLL2Onq$d;R=HoSOna;4e5zU_;6uq8hDfld|+oB_*m<Z
zhR5|FKeK?9f*Zsk<sfz_c;|aaVMM`49*OqlUH^aV6k{;oDaHUk87%IBW5LIa#}h!C
z$Q~zvj$H&hrVBKw2<jomfsd=PZSzq0$hBP20d!z{#BxOi5S_GKQ2<1PF82VRkzXH@
z57q+O!K^-s;UoCyEZa;EhL2p!896{o6PGiB8Viis%NdzK{L<x&pk=6x^~)I<8kUzZ
zb}naRa9Cc#IC(iEs9(ScUrin21U4BoNslnu#>3$w*K$V&Q0Put?#NINItFacaz_Tx
zaq`QSJA#9F!*WN^LQ%$DU>`kYU<i=~8}%Q=hdWYyf5b<Dt^fuJp->6Y<t|K_%LTy>
zS-D&g?2ygN1;N(rT`mY}o-!U^E(o^e;&MT-Ew`5oGBDOJFJT0oWdaV2;8!4P;)Ri|
zv3at;<D+0#1A~N6hs28IE=+FA7lN(1vV0-fntRI^f~|S6d?DDHPs<mAt@*QjA;=mg
zw&e>!o?!y5fPmPt{jtGE9!UC#ueS%qU2xq_&<V{73=HuQei>{remwYOr{Fwr-e7@V
zB*q23NDMSd2`VGh93Omm@puAg#1Jx__xJ%MTQc8sH2Cl!;K7F{j}4$AS0Nb{k`tDD
z)`QkF{{R114m9n~_;R@gXolnS4e+`b<=6S2XMoOlUA~TiX}QY34zM)}U~3e>9aNY#
ztHIllSU^kEz|$9s%T<^cN@zO<e9Qoq2H;L7_?+-RuRx<k%fI}ygyg3G^;f{L(ef_}
zYDpMWfhH&_Vmm-l0SX}-B}i%po%-}|5m*jXb%O)cMg$@UKCEj7SgsVV540es4=h#%
z6SMvUN!~0B%UkOI%>+xrHCVrcNP-&5|N6mlprsXHi>x0&<QN&2xBP1b%Voh0y#$d1
zUBmFN8Y~AoWCx<}2vp8tdCR{-upFpo1(K_0u-*ohR9N2fFC8oy4L5Yf@-P2l!D66O
zF+ds^tmi?q5XbVCe;Hso&_Oy7xd~7?mgOz~;=ppCS#XG46I70AdCR{Lu$&iY{|iL2
z1S-k6yyc%4Skf8ph_vNj{yBifg5hE@&H^6=z!|OOUm#cxbSe<UEI+86!19)V?qE64
zkR?RU0V)S_yzK!4hI)or(1H<&q!CmS<a%SUMk~05Do{C)>mg|abgd~wpBPjQ<al|o
zJ{`C|j^$teiGsykVPaPQoELl)1ZUrt`hRL*Nze!e*f6UPP)U&MWx#Tv>y;pKkDziO
z*9(E=K;vc*xhqgPkmEs9S`4wEX-SCOF{m8V@|M5<!1|1!j;Uv`+5wehT;B2*ypT8+
zbnZVy<0{ah+aL`w6QCLxtQJ6h>#)4#@5JR_{+og2Pr&6TK+OZmgHFP2nb`1=X?Y0)
zc<E^@_ypO&Dv+L7Pk8)WmF?g0;YHU51_`0v657jM7<VmK1eJ0OH<l}cOS!(~ir`YN
zZn+}3l*?PL2rlK~mMelvH^zYd93NhGF)&C7F-SNpcVX;X?g-M)XtCT8tRJ)_0aWHo
zEO!L!=YSOX4D~-CWj@0TNSV)YYk$OtSBO%bF%D9yGaLdZwi1R-kW!st5u`L{m;&>6
zpx|SJ53eCxi(<iB3<GXFHu&%cDzXJsiUgd0Z1CYNR0O;~s6OD>V}lRxphDn_p9A(j
zHu&%!DgwT#DqzcF1JI%)P}Lj@+O@<Gu==q9sHq7S0iT)?u;{VDM@FbFa0MJN^RdB4
z&_!+v3=Fa0s~ZC*JT~~q0#)-4?4bJg#|9rk*TsPpeFY2EJvR6VI=37o@&_zZ`q<zj
zJ49O?Ggu@CR8TMf@)tbi6ypdMo3#APfAA$+F(t4tvFveH`0!%+m;c}!&tgF*0)W$%
zWyA6>|I<KepgxujuDHxu;KQrsU;c-IBw{|m#j~K|Zea22aPc^(I3xjr8dwm+gJ2fM
zEP|``aCZ3ca`~740$?+G;o|i+PzlgBDu$SHxP$>j{ND$#hGe+73RL_7SUdnOE&&z4
z02T+W`++!y2P%F5EDoBQhln#Q|MG9u0fTx5h8R%85-e!(4H8`cW`Pt(gAPoBh`)l0
zcY(#hZ6#2UTik<+gR@igahPK)E<we!K<Z;amnTEaIR*(asQIAN7V9AryP&QFYl!ZL
z8?+8;kR2$Y1uOtHo_{*9BONT5G<Es!e-VxXA67&dTo3@Q2YxI7sp%PPK>Hg41U@W*
zH`|TDV`~lIp-b?^t^fbm|MCR2dKm;g6h5qc4Z3cg_p!q#2?mze3ZT)x*Y`hx?sEk%
zwu=F$bN@upfCPS(0X`sy{&<7DJ|GEn3#NwzXh?T4==xUBjN@`mhI;UZNjvSOa!jCp
zki?Yz3@iZx3=9qo;4|>7BtXju!3&T<M*aj{9#O)udMX=u{1?2*EC#$;)n9D+ivNG$
z<Dpuw^T7v^eV)nzDz^T=1?>V{ZV6gT%AgQ2fdRY<)-GasMm+;-gu(>@&{$4Hzy+S=
z77T0=4Hr0;S1>S4+0UR7puoT}&4Gc(!GM7;z=6TQ!GXafAb>$&ngfG~Ljr?XKmmir
zBqj!%fCdIo(n2_w1MJ*6OQ$jX2Z!$=A<pG33<*2M7#>Vz03CJ35CvM?Qd&P9biFlX
ziQ!H$22d#<>C6zo;KcA@`BV<jIfo2#6CDCr9xDW}fHo8`Xn~eoi9ojBmoTtR<p=<c
zpx8Jw1aK^mX5fJ9EBXH{!XbcRsT;%p#{r;=OqZ)L%#}!8p7sBSWD4j2GLWguOX~kW
z1^IRP7Y0>O5{m{GL4Jjx1(leA2~rUQK3v2vVfmN;UQ5;g?~iB*;BZn1U|HJ60KUZ@
z)^Lph2eF?F*lR4H?fIbPcDxpk6F{d&JT?Gr#s%;Hw4Dx``{31qyV5%#;KP<p0v|v_
z?4aG-pmBUF3Gmw1A74S+W&<XC*a8}q2B~?h05WK~Hp7nPo(wz(3>cVrlR;V2Hb)3F
zStTu04w}f80Nq**J|R9De0QK9Bglixzx<zIH?0A3x68E#s8Bn|m(k$ErhVT*#cDzM
z*bjW3k>6X8@xB{D@q1|3=AcR@MyAq`$zfG;90@g`^;ik9lWVFzFi9WToL9YsiAkz(
zvPfN<K)fVqAON%|@_+yXla$)zRdqT{QVTZUs9VFxB<ZlZtwD!LC020x@86(po8ZGw
zz={<Zm?Y#tHd+XS*3n1^Oup8n#w4LI`CpR;M*-+OHYSOJ$$HHZOyVaecQnh1iG$Ci
zkW2xMyD#@-^Z*5k_|nOHn$4KR8z+Bh*4G8C0cMiQ0+kFA6BY)53^ytVc`y=mNE4IP
zU9d<V$U5=h$pI~f>|7wv-q=35qeX@3#+k|MTFjWFdL}<>(PNVQGFhxOf=?2>D&6n~
zD2k;VC)cz}F-aLup3!Q>BqcieN~;^6SSiR*vn-IIV(F7L+O(L&N+*Z38F1v=fHa96
zoZQpq!z89K`Bs~pm>78GNF1~rTnpw0(La;<+Ep2^PBv*bk`q0Cm3afpGSC?IRL6u3
zpz{ILmV1Kl8E44bySb&kf{{t0Ve!8XMkew4NnK`4BI%PYx-6JP(k2&msYr<%Ix2j-
zGKu*cct+l20#qxLg#P3WT~Zvmk{~CE%$t0vD?v&a+|%dF0-XZ5+>=3Yxh10qNLu*r
zWS?#cIbm>fKrnL>(+UC5j5Mepx7?EfG#tPrwr_G%_d7W;H;~`;+9xqA>sbEfUoB|S
z#&S;v(AmLEVml`H^=Rmcfj7?TnJoYEFUHZ}(>ag@V&J<f^t6_L`M(~d+|giz4p_W*
z@{^vsjC_+1^*S(x7fxpBvtSa-nQYf5#UxfUIjYY_Obon`pJ#_-!iNQ*au1XQBn>C8
z>C+O+{Jm3z!4rB`HR!Gz0|q8B(aCT6G~~oUc@4ZV$?)~^3<k!CfD53C5p=)@lNj4%
zqkbzU(R-8g`ppzXcLXSiegF*|vj2k)@Om-`fYLX}eG*G2AL&<P3TvJGreCT)`1K?P
z0nom7CP~ov4CJi4R8WBEG=b7w0O;Oc@U`LwN{~eq450H+L6=W51h|9L8Hj;*yRa~9
z0;{(Nt$+rLb781A1c~ea107)sn!-F_z#z>Ka2}>X{}V(5qY~Jl!;=?G5SIj1wP5S@
zZ$V|5L9#y0lP^s03XuSx!J=byU;+b^2<V`5hTsTCiRqw2ftkcVgMIdtfk7K|=LnMo
z_$nwJ(6#9QcPcWdELUN010{Ef_?;{a)yu0H7(wNn_>IYV6Vru3BR)*x3qkJH1}_=)
zZ<_pKqNDdMa0oU}VweFw#Z9|x`3?p-uo!r!vvwQEk>CZ$Eet-Oc$LTnFI50{uK%6}
z<<m<dAoAkD$t9CCm@ZzKJa3XRBlqM(lXRHG#V3E5B+Do_nQyX$m^gU%zJU*97w7*3
zP^stlbh6E42@CNzAa@y<LZv)GX$VwZgWMqwzKubDKd6}q8tg<228ZmN+%vgENdnZ!
z1TQ=K16u#OX?e;2SD>}k%fI|T4|1?@)nuh922A1~Cx=W?;1CM|8+vzg%@jKiVcm!a
z8@K`<L`W?E@*h+pF^QXir8k1yqdgBaMDhRH@-P3NI2vr=0=Wt-3qE#0KYjU^|FNL0
zCgM_)nWkzozTK=dm4k^%oME!r^j}P3O_PmgT#^t2hpOIB@Xq<U%S#ycf}A8KI9X<<
z43iksWUHATLgzX`;djmqw6zt?ikv)UrjMWKx}6FP^Om<TfDf1803A3G3EIQH)V>W|
zpo)T<A)Na`C!c~REfpA;L|20xu5)$yE(X4xA`GA-I5a>Oiq4p<H!F=vG-UI%S$s@P
zA|9KU&3VVjBpk4L+Po4*CcoCnJPRf;3HeN(w_pL2;P1%}3k}2))`3bO@Ku>COV|8o
z0(o8J&E&R);es(BXP)AOIrx;$=64HA85!?RPFZ|d64V3-AL672%3qt7w=hJ561dxp
z%??Xg7_DqThZbq>6k`b8$->~dyoDhdEDJtuNzV$zb}|Pof?B?tfob`22D6<k3@bsR
zZp@SGmfA8tnY?GIFXPt9T+7TEr%rZSrq9?lxoDZPJ7}y0eBOZ4Zcy{*|1^*pAbqZJ
zkcGCOW%G)rAQ4B<xFuMvg6i@w{|_LBpuJT$-&rQW$mF$P^1J0WOkS;%bynyw2`-u(
zwZec&aOLEl6%9;+9+UZ2n(%nBf{Pyk1|~s`$$l#hq+$<(nsNaK8yG<QDnS8stO-o&
zPoA;Tl+kALxs?G-0{15?tddZQO$h*9MPBv)kK=|7EX$8Dm^e0kSOCiN0!u;b@;vJ{
zN3F7BOc2llxmraSmKOw+KzwD;4Wmo~GVHKZx-Kv<c!KVnj{sHR%RO1&!PWDDl7n(L
zSS%8JGL04}IS4R;Ty}Bs<R7b*CI5jUmLEJkteOo9I|fCN8veVJP1ZQ5#DMD_e(-Tm
zs&?QEaTT->5Ud1r<slRQ`pGla$T0CQn7nO`1{43J$q&{TaqxrBm16rf*>A1PWV5vb
zO#E?^J=Pj9U1*zJwKhUPh!eD-794^b7?@^oO@6dCk@4+hmvuT!g1aUcty{%3J!i7q
z`WS)fwmUf(HbE_9aIc-*wcdzny5i)0>y?<Mi%ovCK7`3#d9uX@IVN}E$q^fNa7+U)
z>X}wJSz@D}hub_*hFK0d=Y&ZBoNWJrj*0=d@Id|+0MAV+YA>I~z!xx~Oac@xhkC%I
zB`kR#ikaNEv4UgjchL3VZWf#QHhC~HO*ubVZoSpyNn5Nqrc42)stD=HSGHJq@Z|(3
z2uOe?{QpFQ8eV)Uj}-(Y7{oxwDm=dMAp>&unM><ZIRyqOp-|A3ASw)U65s>r!XI=P
zFbIH(6h6<%AzQVW_>3nvY!!(L-v!pm0*ZXORiHwUogHkp%wq)s8Hm|nzDR(AfC|`d
zW-y=Uv4VgKk~~X*f`9@@{`Y5)Jnx^$@3!uh1fP=*I(2rr1cR`s<MJa6%RxzzcjD$F
z+X5Jw_<u|m+hN1Re{*uk4kIT1{gXR(L@@DB+WcsT0TYws!pS1LwV1erCp+wpVVbBj
zdEV|MkqLi55$2c;KCcu!+U005S!9oy92a<Xoiu2a9W<iG#C7wrLz@JH2*|q0hbL$3
zDPWo~dGf72c1#nhCQI!t;BhEi{`=ntP>678Y@W7PjFE|R&g6Cb#F*C3n0##CJEpY?
zleg_(#kA(s<fH>mOlww5UUuLa(;Ab>eFv8@t$r}s?2wL?ohWEp3ABED^%V)>2!{m>
z(juUnSU_h|gLZZVdM-c0ps-(l0qBkv!`IdfT#(gU=9QD@97<<&oy>Aro6&Bv!C@o5
z)v=)LBz_FEsBd-f<buOyO#YK6uQ;s2v|3~Gxx*?#tHHOb{j^(N!Jq(Igt}UMGRqMa
zpH<*Bn{Q?>uV63%3xlo=UJ2`~f(`}%^~}sbx1kn+77@a-@2Y#3SU)Th0C!l$T|iz~
zb#ZdZ5nthKDeyUuLZGb(peaYD)w+|f99hZ8JGt(tcr0kKD!7Fq4(_g+{sg&N@G2-P
zfRg;GJ&q|Gzz4Djo`yDDK=UR{t2TfRJO-&1`wrSI<W~VY)bMdb0OSY+bx@99B{uof
zQENf)PAWlAL7oIQv0}2_F$2Dp*FpK_2Ls59D{oJ(Ii@LGDFxo<Cl~^^+<NkkV`lX$
zr-PKfwpiZ9U<Ovcc=?xqXF(|&K2OJB4LNwQfq}vA&triG(28&Q|Dg4Z1)z{vSp<qe
zP^av%!9oSl8Oh+{4ZQH;ZwJWq?F+%ApNGQ+(2igZ2Zx0!pfltoN|tZVJ+8s14Q^@)
z#3F?Og9&Ij2z;}$xGJb9{10BpZIUzjz=;&56*ZI9PP#DpY@D2PQiW-S+vG_n^O&r>
zCNrIy!?%1t$g;05K<%&PhbON&wSjMW0!Zj3=sE$W<$05{PD?Q@_n6#vT7}1QDy-yN
zZZLV<X<Np|$zM*ZFfH$zEOkbc7u@zxF#^>CKFN~<&PcL@ufy1KcyhrRKc+2*Cm%Rd
z!m(uo$nY((lWopwGipxGIP1$;H+kFHTE;7rP0ocfp5EMb&YzLdbMme8vXbebI8};R
zegiyN3+l*%H!2zOOcuBx%lK%r-UV?+w#jZ66d9E#XIxNZWS-o0L6Py~<TV#sC9gex
z0-E%5|7XCkoWp=Q0Cf6L0t15~=VY&onv5}%OD<|MnoXW}QIk<(@`;NYOa|X3f4Zp2
zcy+SOB~8Yylie=qiceW?$q)caCQHBv7K`5nW#=V%le;b{7%bkpJi>q_ARvJObODD!
zv}1yT!{Y!!2L=(iCLfUN#kYb|$r888w=U@`$}i_IU<JFxfPujPbhjbX67WHN;^0M%
zOXMbNU6!?c|5zBbbHM%M1F+fpr$I;ifNaq}zx>PpD`3`Da2wHqfkFS~@-P2SfyLHO
zZn!KXviJ$8OgESawp<L9^cUZryy3Ef$YStfVS{*(gxDWYDZ2RJ<R>7B4PYJMvoypW
zft<T|`DBSJrHo;d`>rT5s!rZ;MOGX<_9p*!`Ir9>5DDGXbn}xdwoHs_la;PFi(Ubl
zEZ4aF%YV@59yq4-?oHlxJ)UvnWT_j{ipxRr+@Sr85INADHVoXHprwbP7Pa2|$zeB)
z8EYqZ-Ed}%pM36ywX`Eh2iNlDU;fWS&0)rplT~guGkQ;6aq}@F!{nY@j*J15&)uq$
za0WH~zJm`bWB~<=5$Mn{2Hg#l6K;nx+D_hf+nzCI^0(W8n%h7|%OpU?hW{6U9H0v>
zu4KZXVrd{Toh_RS?kF-zu7mZAINpM~70X)~=79oDY0>6Y_nMfP94<`OduYbtumB{e
z^<{F-LkWqw65!*;ML_i@BFOaKPM-5{6O)7e<bX$J91i?o4HcXF9$7Fk*)vZ*@g$GQ
z?)qknr+kb|v$jw6c$UFo`wOH-qjK|(XNQEClo>bI{M^ULq@=pp=J!D+_7fmU<B5}5
z{uwA4SAcC)LA6m~DQM*hD8Bo)Y!3V9$;6mFbpfL-qtDiRj2~E-xFoh;U}aQcWReS+
z{*8_CAmiulJJ=a#Ffz%MO%LK^jAZ;deGMn$6DFCq?UT3|<5?7oLHYNs{!T@PqUB2%
zazP7zb}BM#S$>28eDtYE@^m47Mtyhi%Feg!P-U(lXNovFPME;xsBXZpypn<G5<>!`
z0>k48pshxrpcVmN#`)$QREG|zBp1<`-oejk&B!(V2tQ*u|2@YC6Br%E6Bt11g|AQ7
z5@0lB+&4W&fKifh<Mc8CMn&!gj$#TB>Dkj42{7t1wrsy3z?jX<cy+ps2xB<o)ag@1
z7?qgR`KRv?VYHS`ee3`_F#q*?5D8hm2yUS;s6Cm^C(5X2)$svzavijb%pm9izA^yZ
zZR~gqSr!Cc^8&u%6O>BX*+H4ExnX*rD5DfpbJ_G&U^-*^F;PZCNzguP(7-OJgJX$g
z*yQN~VvG{;7Dk}kfuNX?fdj^e(IA=s|Ns9-=7Yong8Y30LKGAj7!;s@fx*Y$(Ivn!
z$k#SH9tvWodx|s0P8SnrG@HIaj8THyH7LkG$Vx%Am`h>$X)#9c=@nv(8q;$u7&WGs
zNHAtiSCeE^oBl_FQER%7BxBa}dlHOt(r$^FIjJcMCHV?Psfj5HN%{FD3Yocy>8Xkg
z)14(44OyLC3=9mXi%K)vPA`&Xl$stS&8Rxv(1KA*h{3?n$k@cx%-q5<F)2AEHH~4q
zrwn8H^d2cjhv`408D*xQkz%xwc23O8%P)Z#?*ua5H?cq=IJqdZpk(@fka`0dMri@x
zU<Mx-9|nc8)S}|d{5*x}zH*H2)0fFHPTFoJ%P7G({ed*2%Jh4ZjBL{nNi)h#-z3iH
zF#VDwV+2pQW00SxpF7y!(>0_RQ>K3sXH=iwE6pf7T|$CUXS#(vqw(~U@{Fa^v*a1$
zgi7<W^YY8{6jF<d@{1U_6ciYyE1EJ&OuweYXf<6(h0$iZodToO^m_`7V$&lO7-gn^
zQDBUiuA#&jH{C~(@y_%T1xAJGZAy$9)8&*I)3}ut3Mx`_GV@9+7^eHGFlJAmqQL02
zeTNF;KgQ`g>Wmt~RtiO_#Rd6!#i<GmT#5<|3W^NVbu}1Gxr<T@@{39oa!T`xrzdJK
zW=@Y$XN;MCO@mQRFwoUERKeLrH^|=?oB$Z6Z&zmw=LJVma$-SZa%M^8bY2ZcMGlaV
zhM|Gx^et+PNz<7$8HJ{|Xfh^D*VAN-*#1nDF^-KpI5n?0)zd}6**Sc=sR3i-^jiju
za?{NW82P3jF<=zi{=<NgoxQ$-fq|C`l=wh64Fb{`7~AH7_#g~Qs34lb{{R0f&j24V
z8$>Yv|G)C&^~)fpy&e|>Nbc#i%O62B2!q5gUw!`Z@Rdg&LE<1jOx)E+A;dq(GsItE
z`U(q13pbD)0|NsG17ib-38O)5Mg|Us3I<jX6Hb>w`AiIqVDWMYfBHiUM*HdVmW&7M
z6^_ha`Z)Oec>xx%0tms#0ydq2kp*-G76St#3kOUcj5YvWV#L6};4FQw>H0R4+aQhq
z|Ns91rT;@|IRA+PBZCDrw<D>m|1ZqIAYjD6z#_=Nz$(PRz-q_<bt?ly4g&)NGXn#I
zF#}i(>;)zWn*+&WCJqLOV^GvDU;rrvIRo7skO}|)GyMPmox!R8KLZN`gCSTM0|Nt+
z%P@Sv!oUE!z6`7sSsln{U_prf{~Qbq0)`9>7VHcR1|V@zviSesQ3*mje1p*TJz%>2
zzr!go<3CgYPCLwlh&x3=X!{Td?W6;t9k)Pfh(Z5h@}$xA{|Rbzbb?sq@B>1VW&r{7
z>;Dr_Ktp-QFR@J1tE?G&>T_KnUK=3V`aj7Qm%to6{eTT)TYV4I13fkn@oohO-2+W5
zJt`1BTpV;_EC=gkP>Kg-2M`TXF{uwk{{KH|2b6vUp(pb|X)`FD0HwRYwDJGR=fI5r
zlTsk`lmIC02Bo16n_>jzM@|1>%NSOFLJPt_{$xPt`u_uDG1T7r|4;_?=*xN}gd`~Y
z;R=Dvd?Xn3pLh>kdIvH0(z*ZtLG}|2flKQk8gMxjUHlR>5nsx~uJ4i`TpVow|4TT6
z>_ieo;R$F7cx(ZLPcD7p8oGXn{r|}|5T@@Wv<^59&E_z1bo$&Khy&p2>d}03ZWlxW
zx<*(CoPlOzborAXQ1!trKr{cuJydl}C(E{bI5D#FY~SF-IF}nlda>!`|Nr+DRC6*g
zFj+uoNVA23f%yQG&jz8HI;PL?W3&@ufz`~QrU0lw+c5owAEQ2_(Da2)jG@eoc@ril
zGKxAgF$jV6F&070WpsT2;TQ0LX$I~LFb!Jl0%EY-2aya6j71S(1``9z^bh`wVwy!W
zz>O4eiv-L9OEa((Kxi1r^kKVx0AnTN^nHPh3Jzhx3PG;H0k#nk!x(}?9795b;arF&
zmIja)pe-KI#iR{343L%()AR>{j1wH(ot>=|G~E3{H5Cj^^o;Zj6^smwObiVTOcXSN
zQd1N>5=)>Gx@MXT40^>G#U({0iAfB4nRz9tMFrDu2Qhj~Hwb1-kAyfM(sqJ2p+Js+
zx10DuJR}TL4-yh)U|?VeF%TM=AdN)^CV}Z2f*F<T)$;%U|AwXn67Gn21>e02RRf|x
zo(It&3~D`bgBVCwbU^q_P?`~B9;nF+b2Ci81OtN{14t6oegx@(Du5**<^$6ULKu}(
z9Y8@0l1JD9OG_}CaRZVXkWwT&7`#A<4J63GzyM8?tQR1BD9tDvFx?`QQN14G0!C#>
zQiahBx;G%o;Uvs>kN_y9K#c{rgc%qZ^Co~K;4~!lfr0=m4DK61SfJQQL^#g~W<WmF
z04UACfR<<(U=HAzej$`m%nK^b2&EaAW<bn`lQ8ul0Z<bh#)kwwq@x1LLo=oqgfS|s
m79!jPX&{62fiYtd%xJyoJHi;vl!}gl#Tgi?pfrqvr$hkAWzFXR


From 06fcf87f56ac47b89932b3698e86224ea7bc5a93 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Tue, 1 Jul 2025 12:48:27 +0200
Subject: [PATCH 2116/2760] tests/functional: Add dependency to the
 keymap_targets

When doing a "configure" in a an empty build directory, followed by
a "make check" without a normal build in between, the vnc functional
test currently fails since the keymaps have not been built yet.
Thus add a dependency to the keymap_targets here to make sure that
the keymaps are built before running the functional tests.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250701104827.363904-1-thuth@redhat.com>
---
 tests/functional/meson.build | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/functional/meson.build b/tests/functional/meson.build
index 1ae5f02fb3..ae5c52d79f 100644
--- a/tests/functional/meson.build
+++ b/tests/functional/meson.build
@@ -374,7 +374,7 @@ foreach speed : ['quick', 'thorough']
       target_tests = get_variable('tests_' + target_base + '_' + sysmode + '_' + speed, [])
     endif
 
-    test_deps = roms
+    test_deps = [roms, keymap_targets]
     test_env = environment()
     if have_tools
       test_env.set('QEMU_TEST_QEMU_IMG', meson.global_build_root() / 'qemu-img')

From 3b1cf40dd665a0c4c38bc339fea6eacf1742b46c Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Mon, 7 Jul 2025 20:47:36 +0200
Subject: [PATCH 2117/2760] tests/functional/test_ppc_bamboo: Replace broken
 link with working assets
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The old image that we used for testing the bamboo machine has disappeared
from the internet. Fortunately there is another kernel + initrd provided
by Cédric that can be used for testing this machine, too.

Reported-by: Stefan Hajnoczi <stefanha@gmail.com>
Suggested-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250707184736.88660-1-thuth@redhat.com>
---
 tests/functional/test_ppc_bamboo.py | 34 ++++++++++++++++-------------
 1 file changed, 19 insertions(+), 15 deletions(-)

diff --git a/tests/functional/test_ppc_bamboo.py b/tests/functional/test_ppc_bamboo.py
index fddcc24d0d..c634ae7b4a 100755
--- a/tests/functional/test_ppc_bamboo.py
+++ b/tests/functional/test_ppc_bamboo.py
@@ -16,28 +16,32 @@ class BambooMachine(QemuSystemTest):
 
     timeout = 90
 
-    ASSET_IMAGE = Asset(
-        ('http://landley.net/aboriginal/downloads/binaries/'
-         'system-image-powerpc-440fp.tar.gz'),
-        'c12b58f841c775a0e6df4832a55afe6b74814d1565d08ddeafc1fb949a075c5e')
+    ASSET_KERNEL = Asset(
+        ('https://github.com/legoater/qemu-ppc-boot/raw/refs/heads/main/'
+         'buildroot/qemu_ppc_bamboo-2023.11-8-gdcd9f0f6eb-20240105/vmlinux'),
+        'a2e12eb45b73491ac62fc0bbeb68dead0dc5c0f22cf83146558389209b420ad1')
+    ASSET_INITRD = Asset(
+        ('https://github.com/legoater/qemu-ppc-boot/raw/refs/heads/main/'
+         'buildroot/qemu_ppc_bamboo-2023.11-8-gdcd9f0f6eb-20240105/rootfs.cpio'),
+        'd2a36bdb8763b389765dc8c29d4904cec2bd001c587f92e85ab9eb10d5ddda54')
 
     def test_ppc_bamboo(self):
         self.set_machine('bamboo')
         self.require_accelerator("tcg")
         self.require_netdev('user')
-        self.archive_extract(self.ASSET_IMAGE)
+
+        kernel = self.ASSET_KERNEL.fetch()
+        initrd = self.ASSET_INITRD.fetch()
+
         self.vm.set_console()
-        self.vm.add_args('-kernel',
-                         self.scratch_file('system-image-powerpc-440fp',
-                                           'linux'),
-                         '-initrd',
-                         self.scratch_file('system-image-powerpc-440fp',
-                                           'rootfs.cpio.gz'),
-                         '-nic', 'user,model=rtl8139,restrict=on')
+        self.vm.add_args('-kernel', kernel,
+                         '-initrd', initrd,
+                         '-nic', 'user,model=virtio-net-pci,restrict=on')
         self.vm.launch()
-        wait_for_console_pattern(self, 'Type exit when done')
-        exec_command_and_wait_for_pattern(self, 'ping 10.0.2.2',
-                                          '10.0.2.2 is alive!')
+        wait_for_console_pattern(self, 'buildroot login:')
+        exec_command_and_wait_for_pattern(self, 'root', '#')
+        exec_command_and_wait_for_pattern(self, 'ping -c1 10.0.2.2',
+                '1 packets transmitted, 1 packets received, 0% packet loss')
         exec_command_and_wait_for_pattern(self, 'halt', 'System Halted')
 
 if __name__ == '__main__':

From 40c94731c4495e78f0f7402890eb01a0f43a64ca Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 8 Jul 2025 11:57:43 +0200
Subject: [PATCH 2118/2760] target/s390x: Remove unused s390_cpu_[un]halt()
 user stubs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since commit da944885469 ("target/s390x: make helper.c
sysemu-only") target/s390x/helper.c is only built for
system mode, so s390_cpu_halt() and s390_cpu_unhalt()
are never called from user mode.

Fixes: da944885469 ("target/s390x: make helper.c sysemu-only")
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250708095746.12697-2-philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 target/s390x/s390x-internal.h | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/target/s390x/s390x-internal.h b/target/s390x/s390x-internal.h
index a4ba6227ab..6894f0a256 100644
--- a/target/s390x/s390x-internal.h
+++ b/target/s390x/s390x-internal.h
@@ -246,16 +246,6 @@ void s390_cpu_finalize(Object *obj);
 void s390_cpu_system_class_init(CPUClass *cc);
 void s390_cpu_machine_reset_cb(void *opaque);
 bool s390_cpu_has_work(CPUState *cs);
-
-#else
-static inline unsigned int s390_cpu_halt(S390CPU *cpu)
-{
-    return 0;
-}
-
-static inline void s390_cpu_unhalt(S390CPU *cpu)
-{
-}
 #endif /* CONFIG_USER_ONLY */
 
 

From b1180352f1c758ba4270cdaa3c41ceead3a43aad Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 8 Jul 2025 11:57:44 +0200
Subject: [PATCH 2119/2760] target/s390x: Expose s390_count_running_cpus()
 method
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In order to simplify the next commit where s390_count_running_cpus()
is split out of s390_cpu_halt(), make its prototype public as a
preliminary step.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250708095746.12697-3-philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 target/s390x/cpu-system.c     | 2 +-
 target/s390x/s390x-internal.h | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/target/s390x/cpu-system.c b/target/s390x/cpu-system.c
index 9b380e343c..2fa8c4d75d 100644
--- a/target/s390x/cpu-system.c
+++ b/target/s390x/cpu-system.c
@@ -196,7 +196,7 @@ static bool disabled_wait(CPUState *cpu)
                             (PSW_MASK_IO | PSW_MASK_EXT | PSW_MASK_MCHECK));
 }
 
-static unsigned s390_count_running_cpus(void)
+unsigned s390_count_running_cpus(void)
 {
     CPUState *cpu;
     int nr_running = 0;
diff --git a/target/s390x/s390x-internal.h b/target/s390x/s390x-internal.h
index 6894f0a256..145e472edf 100644
--- a/target/s390x/s390x-internal.h
+++ b/target/s390x/s390x-internal.h
@@ -238,6 +238,7 @@ uint32_t calc_cc(CPUS390XState *env, uint32_t cc_op, uint64_t src, uint64_t dst,
 
 /* cpu.c */
 #ifndef CONFIG_USER_ONLY
+unsigned int s390_count_running_cpus(void);
 unsigned int s390_cpu_halt(S390CPU *cpu);
 void s390_cpu_unhalt(S390CPU *cpu);
 void s390_cpu_system_init(Object *obj);

From 693b3039d77195953e70f008991c80bf9c5b9691 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 8 Jul 2025 11:57:45 +0200
Subject: [PATCH 2120/2760] target/s390x: Have s390_cpu_halt() not return
 anything
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since halting a vCPU and how many left running do not need
to be tied together, split the s390_count_running_cpus()
call out of s390_cpu_halt() to the single caller using it:
s390_handle_wait().

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250708095746.12697-4-philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 target/s390x/cpu-system.c     | 4 +---
 target/s390x/helper.c         | 4 +++-
 target/s390x/s390x-internal.h | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/target/s390x/cpu-system.c b/target/s390x/cpu-system.c
index 2fa8c4d75d..709ccd5299 100644
--- a/target/s390x/cpu-system.c
+++ b/target/s390x/cpu-system.c
@@ -214,7 +214,7 @@ unsigned s390_count_running_cpus(void)
     return nr_running;
 }
 
-unsigned int s390_cpu_halt(S390CPU *cpu)
+void s390_cpu_halt(S390CPU *cpu)
 {
     CPUState *cs = CPU(cpu);
     trace_cpu_halt(cs->cpu_index);
@@ -223,8 +223,6 @@ unsigned int s390_cpu_halt(S390CPU *cpu)
         cs->halted = 1;
         cs->exception_index = EXCP_HLT;
     }
-
-    return s390_count_running_cpus();
 }
 
 void s390_cpu_unhalt(S390CPU *cpu)
diff --git a/target/s390x/helper.c b/target/s390x/helper.c
index 3c57c32e47..5c127da1a6 100644
--- a/target/s390x/helper.c
+++ b/target/s390x/helper.c
@@ -91,7 +91,9 @@ void s390_handle_wait(S390CPU *cpu)
 {
     CPUState *cs = CPU(cpu);
 
-    if (s390_cpu_halt(cpu) == 0) {
+    s390_cpu_halt(cpu);
+
+    if (s390_count_running_cpus() == 0) {
         if (is_special_wait_psw(cpu->env.psw.addr)) {
             qemu_system_shutdown_request(SHUTDOWN_CAUSE_GUEST_SHUTDOWN);
         } else {
diff --git a/target/s390x/s390x-internal.h b/target/s390x/s390x-internal.h
index 145e472edf..56cce2e7f5 100644
--- a/target/s390x/s390x-internal.h
+++ b/target/s390x/s390x-internal.h
@@ -239,7 +239,7 @@ uint32_t calc_cc(CPUS390XState *env, uint32_t cc_op, uint64_t src, uint64_t dst,
 /* cpu.c */
 #ifndef CONFIG_USER_ONLY
 unsigned int s390_count_running_cpus(void);
-unsigned int s390_cpu_halt(S390CPU *cpu);
+void s390_cpu_halt(S390CPU *cpu);
 void s390_cpu_unhalt(S390CPU *cpu);
 void s390_cpu_system_init(Object *obj);
 bool s390_cpu_system_realize(DeviceState *dev, Error **errp);

From 34fc927b9138b7c4b91e58d29e26d27e04510a4b Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 10 Jul 2025 11:39:45 -0600
Subject: [PATCH 2121/2760] target/arm: Remove helper_sme2_luti4_4b

This function isn't used.

Resolves: Coverity CID 1612139
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250710173945.115428-1-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/helper.h     | 1 -
 target/arm/tcg/vec_helper.c | 1 -
 2 files changed, 2 deletions(-)

diff --git a/target/arm/tcg/helper.h b/target/arm/tcg/helper.h
index d9565c8069..0a006d9514 100644
--- a/target/arm/tcg/helper.h
+++ b/target/arm/tcg/helper.h
@@ -1209,6 +1209,5 @@ DEF_HELPER_FLAGS_4(sme2_luti4_2b, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
 DEF_HELPER_FLAGS_4(sme2_luti4_2h, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
 DEF_HELPER_FLAGS_4(sme2_luti4_2s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
 
-DEF_HELPER_FLAGS_4(sme2_luti4_4b, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
 DEF_HELPER_FLAGS_4(sme2_luti4_4h, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
 DEF_HELPER_FLAGS_4(sme2_luti4_4s, TCG_CALL_NO_RWG, void, ptr, ptr, env, i32)
diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
index 0603db0909..bae6165b50 100644
--- a/target/arm/tcg/vec_helper.c
+++ b/target/arm/tcg/vec_helper.c
@@ -3526,7 +3526,6 @@ DO_SME2_LUT(4,1,s, 4)
 DO_SME2_LUT(4,2,b, 1)
 DO_SME2_LUT(4,2,h, 2)
 DO_SME2_LUT(4,2,s, 4)
-DO_SME2_LUT(4,4,b, 1)
 DO_SME2_LUT(4,4,h, 2)
 DO_SME2_LUT(4,4,s, 4)
 

From 26bab49db56acf8ef767a60fa1feb27a3556d3ec Mon Sep 17 00:00:00 2001
From: Jackson Donaldson <jackson88044@gmail.com>
Date: Fri, 11 Jul 2025 07:06:25 -0400
Subject: [PATCH 2122/2760] docs/system: arm: Add max78000 board description

This adds the target guide for the max78000FTHR

Signed-off-by: Jackson Donaldson <jcksn@duck.com>
Message-id: 20250711110626.624534-2-jcksn@duck.com
[PMM: Moved doc to correct place in index; made underlines correct
 length; added missing trailing newline; added SPDX]
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/max78000.rst | 37 ++++++++++++++++++++++++++++++++++++
 docs/system/target-arm.rst   |  1 +
 2 files changed, 38 insertions(+)
 create mode 100644 docs/system/arm/max78000.rst

diff --git a/docs/system/arm/max78000.rst b/docs/system/arm/max78000.rst
new file mode 100644
index 0000000000..3d95011fef
--- /dev/null
+++ b/docs/system/arm/max78000.rst
@@ -0,0 +1,37 @@
+.. SPDX-License-Identifier: GPL-2.0-or-later
+
+Analog Devices max78000 board (``max78000fthr``)
+================================================
+
+The max78000 is a Cortex-M4 based SOC with a RISC-V coprocessor. The RISC-V coprocessor is not supported.
+
+Supported devices
+-----------------
+
+ * Instruction Cache Controller
+ * UART
+ * Global Control Register
+ * True Random Number Generator
+ * AES
+
+Notable unsupported devices
+---------------------------
+
+ * I2C
+ * CNN
+ * CRC
+ * SPI
+
+Boot options
+------------
+
+The max78000 can be started using the ``-kernel`` option to load a
+firmware at address 0 as the ROM. As the ROM normally jumps to software loaded
+from the internal flash at address 0x10000000, loading your program there is
+generally advisable. If you don't have a copy of the ROM, the interrupt
+vector table from user firmware will do.
+Example:
+
+.. code-block:: bash
+
+  $ qemu-system-arm -machine max78000fthr -kernel max78000.bin -device loader,file=max78000.bin,addr=0x10000000
diff --git a/docs/system/target-arm.rst b/docs/system/target-arm.rst
index b96a05a920..a96d1867df 100644
--- a/docs/system/target-arm.rst
+++ b/docs/system/target-arm.rst
@@ -71,6 +71,7 @@ Board-specific documentation
 .. toctree::
    :maxdepth: 1
 
+   arm/max78000
    arm/integratorcp
    arm/mps2
    arm/musca

From 3a323a813fd42fc7c37ef09bc7a714d8e31691ce Mon Sep 17 00:00:00 2001
From: Jackson Donaldson <jackson88044@gmail.com>
Date: Fri, 11 Jul 2025 07:06:26 -0400
Subject: [PATCH 2123/2760] tests/functional: Add a test for the MAX78000 arm
 machine

Runs a binary from the max78000test repo used in
developing the qemu implementation of the max78000
to verify that the machine and implemented devices
generally still work.

Signed-off-by: Jackson Donaldson <jcksn@duck.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-id: 20250711110626.624534-3-jcksn@duck.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/functional/meson.build              |  1 +
 tests/functional/test_arm_max78000fthr.py | 48 +++++++++++++++++++++++
 2 files changed, 49 insertions(+)
 create mode 100755 tests/functional/test_arm_max78000fthr.py

diff --git a/tests/functional/meson.build b/tests/functional/meson.build
index 050c9000b9..cd67e6d734 100644
--- a/tests/functional/meson.build
+++ b/tests/functional/meson.build
@@ -138,6 +138,7 @@ tests_arm_system_thorough = [
   'arm_cubieboard',
   'arm_emcraft_sf2',
   'arm_integratorcp',
+  'arm_max78000fthr',
   'arm_microbit',
   'arm_orangepi',
   'arm_quanta_gsj',
diff --git a/tests/functional/test_arm_max78000fthr.py b/tests/functional/test_arm_max78000fthr.py
new file mode 100755
index 0000000000..a82980b0f7
--- /dev/null
+++ b/tests/functional/test_arm_max78000fthr.py
@@ -0,0 +1,48 @@
+#!/usr/bin/env python3
+#
+# Functional test that checks the max78000fthr machine.
+# Tests ICC, GCR, TRNG, AES, and UART
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+from qemu_test import QemuSystemTest, Asset, exec_command_and_wait_for_pattern
+from qemu_test import wait_for_console_pattern
+
+
+class Max78000Machine(QemuSystemTest):
+
+    ASSET_FW = Asset(
+        'https://github.com/JacksonDonaldson/max78000Test/raw/main/build/max78000.bin',
+        '86940b4bf60931bc6a8aa5db4b9f7f3cf8f64dbbd7ac534647980e536cf3adf7')
+
+    def test_fthr(self):
+        self.set_machine('max78000fthr')
+        fw_path = self.ASSET_FW.fetch()
+        self.vm.set_console()
+        self.vm.add_args('-kernel', fw_path)
+        self.vm.add_args('-device', "loader,file=" + fw_path + ",addr=0x10000000")
+        self.vm.launch()
+
+        wait_for_console_pattern(self, 'started')
+
+        # i -> prints instruction cache values
+        exec_command_and_wait_for_pattern(self, 'i', 'CTRL: 00010001')
+
+        # r -> gcr resets the machine
+        exec_command_and_wait_for_pattern(self, 'r', 'started')
+
+        # z -> sets some memory, then has gcr zero it
+        exec_command_and_wait_for_pattern(self, 'z', 'initial value: 12345678')
+        wait_for_console_pattern(self, "after memz: 00000000")
+
+        # t -> runs trng
+        exec_command_and_wait_for_pattern(self, 't', 'random data:')
+
+        # a -> runs aes
+        exec_command_and_wait_for_pattern(self, 'a',
+                'encrypted to : a47ca9dd e0df4c86 a070af6e 91710dec')
+        wait_for_console_pattern(self,
+                'encrypted to : cab7a28e bf456751 9049fcea 8960494b')
+
+if __name__ == '__main__':
+    QemuSystemTest.main()

From 31a90360fd8209fb479964a37c4329d5dbc3fb07 Mon Sep 17 00:00:00 2001
From: Peter Xu <peterx@redhat.com>
Date: Fri, 13 Jun 2025 10:07:51 -0400
Subject: [PATCH 2124/2760] migration/hmp: Reorg "info migrate" once more

Dave suggested the HMP output for "info migrate" can not only leverage the
lines but also better grouping:

  https://lore.kernel.org/r/aC4_-nMc7FwsMf9p@gallifrey

I followed Dave's suggestion, and some more modifications on top:

  - Added all elements into the picture

  - Use size_to_str() and drop most of the units: benefit is more friendly
  to most human eyes, bad side effect is lose of details, but that should
  be corner case per my uses, and one can still leverage the QMP interface
  when necessary.

  - Sub-grouping for "Transfers" ("Channels" and "Page Types").

  - Better indentations

Sample output:

(qemu) info migrate
Status:                 postcopy-active
Time (ms):              total=47317, setup=5, down=8
RAM info:
  Throughput (Mbps):    1342.83
  Sizes:                pagesize=4 KiB, total=4.02 GiB
  Transfers:            transferred=1.41 GiB, remain=2.46 GiB
    Channels:           precopy=15.2 MiB, multifd=0 B, postcopy=1.39 GiB
    Page Types:         normal=367713, zero=41195
  Page Rates (pps):     transfer=40900, dirty=4
  Others:               dirty_syncs=2, postcopy_req=57503

Suggested-by: Dr. David Alan Gilbert <dave@treblig.org>
Tested-by: Li Zhijian <lizhijian@fujitsu.com>
Reviewed-by: Li Zhijian <lizhijian@fujitsu.com>
Acked-by: Dr. David Alan Gilbert <dave@treblig.org>
Reviewed-by: Juraj Marcin <jmarcin@redhat.com>
Tested-by: Mario Casquero <mcasquer@redhat.com>
Link: https://lore.kernel.org/r/20250613140801.474264-2-peterx@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Fabiano Rosas <farosas@suse.de>
---
 migration/migration-hmp-cmds.c | 59 ++++++++++++++++++----------------
 1 file changed, 31 insertions(+), 28 deletions(-)

diff --git a/migration/migration-hmp-cmds.c b/migration/migration-hmp-cmds.c
index e8a563c7d8..367ff6037f 100644
--- a/migration/migration-hmp-cmds.c
+++ b/migration/migration-hmp-cmds.c
@@ -69,7 +69,7 @@ void hmp_info_migrate(Monitor *mon, const QDict *qdict)
     }
 
     if (info->has_status) {
-        monitor_printf(mon, "Status: %s",
+        monitor_printf(mon, "Status: \t\t%s",
                        MigrationStatus_str(info->status));
         if (info->status == MIGRATION_STATUS_FAILED && info->error_desc) {
             monitor_printf(mon, " (%s)\n", info->error_desc);
@@ -78,7 +78,7 @@ void hmp_info_migrate(Monitor *mon, const QDict *qdict)
         }
 
         if (info->total_time) {
-            monitor_printf(mon, "Time (ms): total=%" PRIu64,
+            monitor_printf(mon, "Time (ms): \t\ttotal=%" PRIu64,
                            info->total_time);
             if (info->has_setup_time) {
                 monitor_printf(mon, ", setup=%" PRIu64,
@@ -110,48 +110,51 @@ void hmp_info_migrate(Monitor *mon, const QDict *qdict)
     }
 
     if (info->ram) {
+        g_autofree char *str_psize = size_to_str(info->ram->page_size);
+        g_autofree char *str_total = size_to_str(info->ram->total);
+        g_autofree char *str_transferred = size_to_str(info->ram->transferred);
+        g_autofree char *str_remaining = size_to_str(info->ram->remaining);
+        g_autofree char *str_precopy = size_to_str(info->ram->precopy_bytes);
+        g_autofree char *str_multifd = size_to_str(info->ram->multifd_bytes);
+        g_autofree char *str_postcopy = size_to_str(info->ram->postcopy_bytes);
+
         monitor_printf(mon, "RAM info:\n");
-        monitor_printf(mon, "  Throughput (Mbps): %0.2f\n",
+        monitor_printf(mon, "  Throughput (Mbps): \t%0.2f\n",
                        info->ram->mbps);
-        monitor_printf(mon, "  Sizes (KiB): pagesize=%" PRIu64
-                       ", total=%" PRIu64 ",\n",
-                       info->ram->page_size >> 10,
-                       info->ram->total >> 10);
-        monitor_printf(mon, "    transferred=%" PRIu64
-                       ", remain=%" PRIu64 ",\n",
-                       info->ram->transferred >> 10,
-                       info->ram->remaining >> 10);
-        monitor_printf(mon, "    precopy=%" PRIu64
-                       ", multifd=%" PRIu64
-                       ", postcopy=%" PRIu64,
-                       info->ram->precopy_bytes >> 10,
-                       info->ram->multifd_bytes >> 10,
-                       info->ram->postcopy_bytes >> 10);
+        monitor_printf(mon, "  Sizes: \t\tpagesize=%s, total=%s\n",
+                       str_psize, str_total);
+        monitor_printf(mon, "  Transfers: \t\ttransferred=%s, remain=%s\n",
+                       str_transferred, str_remaining);
+        monitor_printf(mon, "    Channels: \t\tprecopy=%s, "
+                       "multifd=%s, postcopy=%s",
+                       str_precopy, str_multifd, str_postcopy);
 
         if (info->vfio) {
-            monitor_printf(mon, ", vfio=%" PRIu64,
-                           info->vfio->transferred >> 10);
+            g_autofree char *str_vfio = size_to_str(info->vfio->transferred);
+
+            monitor_printf(mon, ", vfio=%s", str_vfio);
         }
         monitor_printf(mon, "\n");
 
-        monitor_printf(mon, "  Pages: normal=%" PRIu64 ", zero=%" PRIu64
-                       ", rate_per_sec=%" PRIu64 "\n",
-                       info->ram->normal,
-                       info->ram->duplicate,
+        monitor_printf(mon, "    Page Types: \tnormal=%" PRIu64
+                       ", zero=%" PRIu64 "\n",
+                       info->ram->normal, info->ram->duplicate);
+        monitor_printf(mon, "  Page Rates (pps): \ttransfer=%" PRIu64,
                        info->ram->pages_per_second);
-        monitor_printf(mon, "  Others: dirty_syncs=%" PRIu64,
-                       info->ram->dirty_sync_count);
-
         if (info->ram->dirty_pages_rate) {
-            monitor_printf(mon, ", dirty_pages_rate=%" PRIu64,
+            monitor_printf(mon, ", dirty=%" PRIu64,
                            info->ram->dirty_pages_rate);
         }
+        monitor_printf(mon, "\n");
+
+        monitor_printf(mon, "  Others: \t\tdirty_syncs=%" PRIu64,
+                       info->ram->dirty_sync_count);
         if (info->ram->postcopy_requests) {
             monitor_printf(mon, ", postcopy_req=%" PRIu64,
                            info->ram->postcopy_requests);
         }
         if (info->ram->downtime_bytes) {
-            monitor_printf(mon, ", downtime_ram=%" PRIu64,
+            monitor_printf(mon, ", downtime_bytes=%" PRIu64,
                            info->ram->downtime_bytes);
         }
         if (info->ram->dirty_sync_missed_zero_copy) {

From 2862d6d4fb09f57cabc4389fed34ae767ab2da94 Mon Sep 17 00:00:00 2001
From: Peter Xu <peterx@redhat.com>
Date: Fri, 13 Jun 2025 10:07:52 -0400
Subject: [PATCH 2125/2760] migration/hmp: Fix postcopy-blocktime per-vCPU
 results

Unfortunately, it was never correctly shown..

This is only found when I started to look into making the blocktime feature
more useful (so as to avoid using bpftrace, even though I'm not sure which
one will be harder to use..).

So the old dump would look like this:

  Postcopy vCPU Blocktime: 0-1,4,10,21,33,46,48,59

Even though there're actually 40 vcpus, and the string will merge same
elements and also sort them.

To fix it, simply loop over the uint32List manually.  Now it looks like:

  Postcopy vCPU Blocktime (ms):
   [15, 0, 0, 43, 29, 34, 36, 29, 37, 41,
    33, 37, 45, 52, 50, 38, 40, 37, 40, 49,
    40, 35, 35, 35, 81, 19, 18, 19, 18, 30,
    22, 3, 0, 0, 0, 0, 0, 0, 0, 0]

Cc: Dr. David Alan Gilbert <dave@treblig.org>
Cc: Alexey Perevalov <a.perevalov@samsung.com>
Cc: Markus Armbruster <armbru@redhat.com>
Tested-by: Mario Casquero <mcasquer@redhat.com>
Reviewed-by: Juraj Marcin <jmarcin@redhat.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20250613140801.474264-3-peterx@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Fabiano Rosas <farosas@suse.de>
---
 migration/migration-hmp-cmds.c | 22 +++++++++++++---------
 1 file changed, 13 insertions(+), 9 deletions(-)

diff --git a/migration/migration-hmp-cmds.c b/migration/migration-hmp-cmds.c
index 367ff6037f..867e017b32 100644
--- a/migration/migration-hmp-cmds.c
+++ b/migration/migration-hmp-cmds.c
@@ -208,15 +208,19 @@ void hmp_info_migrate(Monitor *mon, const QDict *qdict)
     }
 
     if (info->has_postcopy_vcpu_blocktime) {
-        Visitor *v;
-        char *str;
-        v = string_output_visitor_new(false, &str);
-        visit_type_uint32List(v, NULL, &info->postcopy_vcpu_blocktime,
-                              &error_abort);
-        visit_complete(v, &str);
-        monitor_printf(mon, "Postcopy vCPU Blocktime: %s\n", str);
-        g_free(str);
-        visit_free(v);
+        uint32List *item = info->postcopy_vcpu_blocktime;
+        const char *sep = "";
+        int count = 0;
+
+        monitor_printf(mon, "Postcopy vCPU Blocktime (ms):\n [");
+
+        while (item) {
+            monitor_printf(mon, "%s%"PRIu32, sep, item->value);
+            item = item->next;
+            /* Each line 10 vcpu results, newline if there's more */
+            sep = ((++count % 10 == 0) && item) ? ",\n  " : ", ";
+        }
+        monitor_printf(mon, "]\n");
     }
 
 out:

From 35290df01b064134a57339b2dbfee8713f9e6d85 Mon Sep 17 00:00:00 2001
From: Peter Xu <peterx@redhat.com>
Date: Fri, 13 Jun 2025 10:07:53 -0400
Subject: [PATCH 2126/2760] migration/docs: Move docs for postcopy blocktime
 feature

Move it out of vanilla postcopy session, but instead a standalone feature.
When at it, removing the NOTE because it's incorrect now after introduction
of max-postcopy-bandwidth, which can control the throughput even for
postcopy phase.

Reviewed-by: Juraj Marcin <jmarcin@redhat.com>
Link: https://lore.kernel.org/r/20250613140801.474264-4-peterx@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Fabiano Rosas <farosas@suse.de>
---
 docs/devel/migration/postcopy.rst | 36 +++++++++++++++----------------
 1 file changed, 17 insertions(+), 19 deletions(-)

diff --git a/docs/devel/migration/postcopy.rst b/docs/devel/migration/postcopy.rst
index 82e7a848c6..e319388d8f 100644
--- a/docs/devel/migration/postcopy.rst
+++ b/docs/devel/migration/postcopy.rst
@@ -33,25 +33,6 @@ will now cause the transition from precopy to postcopy.
 It can be issued immediately after migration is started or any
 time later on.  Issuing it after the end of a migration is harmless.
 
-Blocktime is a postcopy live migration metric, intended to show how
-long the vCPU was in state of interruptible sleep due to pagefault.
-That metric is calculated both for all vCPUs as overlapped value, and
-separately for each vCPU. These values are calculated on destination
-side.  To enable postcopy blocktime calculation, enter following
-command on destination monitor:
-
-``migrate_set_capability postcopy-blocktime on``
-
-Postcopy blocktime can be retrieved by query-migrate qmp command.
-postcopy-blocktime value of qmp command will show overlapped blocking
-time for all vCPU, postcopy-vcpu-blocktime will show list of blocking
-time per vCPU.
-
-.. note::
-  During the postcopy phase, the bandwidth limits set using
-  ``migrate_set_parameter`` is ignored (to avoid delaying requested pages that
-  the destination is waiting for).
-
 Postcopy internals
 ==================
 
@@ -312,3 +293,20 @@ explicitly) to be sent in a separate preempt channel, rather than queued in
 the background migration channel.  Anyone who cares about latencies of page
 faults during a postcopy migration should enable this feature.  By default,
 it's not enabled.
+
+Postcopy blocktime statistics
+-----------------------------
+
+Blocktime is a postcopy live migration metric, intended to show how
+long the vCPU was in state of interruptible sleep due to pagefault.
+That metric is calculated both for all vCPUs as overlapped value, and
+separately for each vCPU. These values are calculated on destination
+side.  To enable postcopy blocktime calculation, enter following
+command on destination monitor:
+
+``migrate_set_capability postcopy-blocktime on``
+
+Postcopy blocktime can be retrieved by query-migrate qmp command.
+postcopy-blocktime value of qmp command will show overlapped blocking
+time for all vCPU, postcopy-vcpu-blocktime will show list of blocking
+time per vCPU.

From 2145f38c31e940abca19bb8a9dc0d2549a40df14 Mon Sep 17 00:00:00 2001
From: Peter Xu <peterx@redhat.com>
Date: Fri, 13 Jun 2025 10:07:54 -0400
Subject: [PATCH 2127/2760] migration/bg-snapshot: Do not check for SKIP in
 iterator

It's not possible to happen in bg-snapshot case.

Reviewed-by: Juraj Marcin <jmarcin@redhat.com>
Link: https://lore.kernel.org/r/20250613140801.474264-5-peterx@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Fabiano Rosas <farosas@suse.de>
---
 migration/migration.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/migration/migration.c b/migration/migration.c
index 4098870bce..e33e39ac74 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -3887,9 +3887,8 @@ static void *bg_migration_thread(void *opaque)
 
     while (migration_is_active()) {
         MigIterateState iter_state = bg_migration_iteration_run(s);
-        if (iter_state == MIG_ITERATE_SKIP) {
-            continue;
-        } else if (iter_state == MIG_ITERATE_BREAK) {
+
+        if (iter_state == MIG_ITERATE_BREAK) {
             break;
         }
 

From d7530a9682b7cdac1859dcf1e28573415d2afd56 Mon Sep 17 00:00:00 2001
From: Peter Xu <peterx@redhat.com>
Date: Fri, 13 Jun 2025 10:07:55 -0400
Subject: [PATCH 2128/2760] migration: Drop save_live_complete_postcopy hook

The hook is only defined in two vmstate users ("ram" and "block dirty
bitmap"), meanwhile both of them define the hook exactly the same as the
precopy version.  Hence, this postcopy version isn't needed.

No functional change intended.

Reviewed-by: Juraj Marcin <jmarcin@redhat.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20250613140801.474264-6-peterx@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Fabiano Rosas <farosas@suse.de>
---
 include/migration/register.h   | 24 ++++++++----------------
 migration/block-dirty-bitmap.c |  1 -
 migration/ram.c                |  1 -
 migration/savevm.c             |  9 ++++-----
 4 files changed, 12 insertions(+), 23 deletions(-)

diff --git a/include/migration/register.h b/include/migration/register.h
index b79dc81b8d..e022195785 100644
--- a/include/migration/register.h
+++ b/include/migration/register.h
@@ -77,26 +77,18 @@ typedef struct SaveVMHandlers {
      */
     void (*save_cleanup)(void *opaque);
 
-    /**
-     * @save_live_complete_postcopy
-     *
-     * Called at the end of postcopy for all postcopyable devices.
-     *
-     * @f: QEMUFile where to send the data
-     * @opaque: data pointer passed to register_savevm_live()
-     *
-     * Returns zero to indicate success and negative for error
-     */
-    int (*save_live_complete_postcopy)(QEMUFile *f, void *opaque);
-
     /**
      * @save_live_complete_precopy
      *
      * Transmits the last section for the device containing any
-     * remaining data at the end of a precopy phase. When postcopy is
-     * enabled, devices that support postcopy will skip this step,
-     * where the final data will be flushed at the end of postcopy via
-     * @save_live_complete_postcopy instead.
+     * remaining data at the end phase of migration.
+     *
+     * For precopy, this will be invoked _during_ the switchover phase
+     * after source VM is stopped.
+     *
+     * For postcopy, this will be invoked _after_ the switchover phase
+     * (except some very unusual cases, like PMEM ramblocks), while
+     * destination VM can be running.
      *
      * @f: QEMUFile where to send the data
      * @opaque: data pointer passed to register_savevm_live()
diff --git a/migration/block-dirty-bitmap.c b/migration/block-dirty-bitmap.c
index f2c352d4a7..6ee3c32a76 100644
--- a/migration/block-dirty-bitmap.c
+++ b/migration/block-dirty-bitmap.c
@@ -1248,7 +1248,6 @@ static bool dirty_bitmap_has_postcopy(void *opaque)
 
 static SaveVMHandlers savevm_dirty_bitmap_handlers = {
     .save_setup = dirty_bitmap_save_setup,
-    .save_live_complete_postcopy = dirty_bitmap_save_complete,
     .save_live_complete_precopy = dirty_bitmap_save_complete,
     .has_postcopy = dirty_bitmap_has_postcopy,
     .state_pending_exact = dirty_bitmap_state_pending,
diff --git a/migration/ram.c b/migration/ram.c
index 2140785a05..6bb4f13031 100644
--- a/migration/ram.c
+++ b/migration/ram.c
@@ -4548,7 +4548,6 @@ void postcopy_preempt_shutdown_file(MigrationState *s)
 static SaveVMHandlers savevm_ram_handlers = {
     .save_setup = ram_save_setup,
     .save_live_iterate = ram_save_iterate,
-    .save_live_complete_postcopy = ram_save_complete,
     .save_live_complete_precopy = ram_save_complete,
     .has_postcopy = ram_has_postcopy,
     .state_pending_exact = ram_state_pending_exact,
diff --git a/migration/savevm.c b/migration/savevm.c
index bb04a4520d..3e20f8608a 100644
--- a/migration/savevm.c
+++ b/migration/savevm.c
@@ -1485,9 +1485,8 @@ bool should_send_vmdesc(void)
 }
 
 /*
- * Calls the save_live_complete_postcopy methods
- * causing the last few pages to be sent immediately and doing any associated
- * cleanup.
+ * Complete saving any postcopy-able devices.
+ *
  * Note postcopy also calls qemu_savevm_state_complete_precopy to complete
  * all the other devices, but that happens at the point we switch to postcopy.
  */
@@ -1497,7 +1496,7 @@ void qemu_savevm_state_complete_postcopy(QEMUFile *f)
     int ret;
 
     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
-        if (!se->ops || !se->ops->save_live_complete_postcopy) {
+        if (!se->ops || !se->ops->save_live_complete_precopy) {
             continue;
         }
         if (se->ops->is_active) {
@@ -1510,7 +1509,7 @@ void qemu_savevm_state_complete_postcopy(QEMUFile *f)
         qemu_put_byte(f, QEMU_VM_SECTION_END);
         qemu_put_be32(f, se->section_id);
 
-        ret = se->ops->save_live_complete_postcopy(f, se->opaque);
+        ret = se->ops->save_live_complete_precopy(f, se->opaque);
         trace_savevm_section_end(se->idstr, se->section_id, ret);
         save_section_footer(f, se);
         if (ret < 0) {

From 57c43e52bdf7f97c7555f408bddbc0b95e081844 Mon Sep 17 00:00:00 2001
From: Peter Xu <peterx@redhat.com>
Date: Fri, 13 Jun 2025 10:07:56 -0400
Subject: [PATCH 2129/2760] migration: Rename save_live_complete_precopy to
 save_complete

Now after merging the precopy and postcopy version of complete() hook,
rename the precopy version from save_live_complete_precopy() to
save_complete().

Dropping the "live" when at it, because it's in most cases not live when
happening (in precopy).

No functional change intended.

Reviewed-by: Juraj Marcin <jmarcin@redhat.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20250613140801.474264-7-peterx@redhat.com
[peterx: squash the fixup that covers a few more doc spots, per Juraj]
Signed-off-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Fabiano Rosas <farosas@suse.de>
---
 docs/devel/migration/main.rst  |  4 ++--
 docs/devel/migration/vfio.rst  | 12 ++++++------
 hw/ppc/spapr.c                 |  2 +-
 hw/s390x/s390-stattrib.c       |  2 +-
 hw/vfio/migration.c            |  2 +-
 include/migration/register.h   |  6 +++---
 migration/block-dirty-bitmap.c |  2 +-
 migration/ram.c                |  2 +-
 migration/savevm.c             |  8 ++++----
 9 files changed, 20 insertions(+), 20 deletions(-)

diff --git a/docs/devel/migration/main.rst b/docs/devel/migration/main.rst
index cdd4f4a6d7..6493c1d2bc 100644
--- a/docs/devel/migration/main.rst
+++ b/docs/devel/migration/main.rst
@@ -508,8 +508,8 @@ An iterative device must provide:
     the point that stream bandwidth limits tell it to stop.  Each call
     generates one section.
 
-  - A ``save_live_complete_precopy`` function that must transmit the
-    last section for the device containing any remaining data.
+  - A ``save_complete`` function that must transmit the last section for
+    the device containing any remaining data.
 
   - A ``load_state`` function used to load sections generated by
     any of the save functions that generate sections.
diff --git a/docs/devel/migration/vfio.rst b/docs/devel/migration/vfio.rst
index 673e354754..8ff5ab0c74 100644
--- a/docs/devel/migration/vfio.rst
+++ b/docs/devel/migration/vfio.rst
@@ -75,10 +75,10 @@ VFIO implements the device hooks for the iterative approach as follows:
   in the non-multifd mode.
   In the multifd mode it just emits either a dummy EOS marker.
 
-* A ``save_live_complete_precopy`` function that sets the VFIO device in
-  _STOP_COPY state and iteratively copies the data for the VFIO device until
-  the vendor driver indicates that no data remains.
-  In the multifd mode it just emits a dummy EOS marker.
+* A ``save_complete`` function that sets the VFIO device in _STOP_COPY
+  state and iteratively copies the data for the VFIO device until the
+  vendor driver indicates that no data remains.  In the multifd mode it
+  just emits a dummy EOS marker.
 
 * A ``save_live_complete_precopy_thread`` function that in the multifd mode
   provides thread handler performing multifd device state transfer.
@@ -195,9 +195,9 @@ Live migration save path
                                       |
                 Then the VFIO device is put in _STOP_COPY state
                      (FINISH_MIGRATE, _ACTIVE, _STOP_COPY)
-         .save_live_complete_precopy() is called for each active device
+               .save_complete() is called for each active device
               For the VFIO device: in the non-multifd mode iterate in
-                        .save_live_complete_precopy() until
+                             .save_complete() until
                                pending data is 0
 	          In the multifd mode this iteration is done in
 	          .save_live_complete_precopy_thread() instead.
diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index 08615f6c90..40f53ad7b3 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -2518,7 +2518,7 @@ static void htab_save_cleanup(void *opaque)
 static SaveVMHandlers savevm_htab_handlers = {
     .save_setup = htab_save_setup,
     .save_live_iterate = htab_save_iterate,
-    .save_live_complete_precopy = htab_save_complete,
+    .save_complete = htab_save_complete,
     .save_cleanup = htab_save_cleanup,
     .load_state = htab_load,
 };
diff --git a/hw/s390x/s390-stattrib.c b/hw/s390x/s390-stattrib.c
index f74cf32636..13a678a803 100644
--- a/hw/s390x/s390-stattrib.c
+++ b/hw/s390x/s390-stattrib.c
@@ -338,7 +338,7 @@ static const TypeInfo qemu_s390_stattrib_info = {
 static SaveVMHandlers savevm_s390_stattrib_handlers = {
     .save_setup = cmma_save_setup,
     .save_live_iterate = cmma_save_iterate,
-    .save_live_complete_precopy = cmma_save_complete,
+    .save_complete = cmma_save_complete,
     .state_pending_exact = cmma_state_pending,
     .state_pending_estimate = cmma_state_pending,
     .save_cleanup = cmma_save_cleanup,
diff --git a/hw/vfio/migration.c b/hw/vfio/migration.c
index b76697bd1a..33a71f8999 100644
--- a/hw/vfio/migration.c
+++ b/hw/vfio/migration.c
@@ -824,7 +824,7 @@ static const SaveVMHandlers savevm_vfio_handlers = {
     .state_pending_exact = vfio_state_pending_exact,
     .is_active_iterate = vfio_is_active_iterate,
     .save_live_iterate = vfio_save_iterate,
-    .save_live_complete_precopy = vfio_save_complete_precopy,
+    .save_complete = vfio_save_complete_precopy,
     .save_state = vfio_save_state,
     .load_setup = vfio_load_setup,
     .load_cleanup = vfio_load_cleanup,
diff --git a/include/migration/register.h b/include/migration/register.h
index e022195785..2a26e76a68 100644
--- a/include/migration/register.h
+++ b/include/migration/register.h
@@ -78,7 +78,7 @@ typedef struct SaveVMHandlers {
     void (*save_cleanup)(void *opaque);
 
     /**
-     * @save_live_complete_precopy
+     * @save_complete
      *
      * Transmits the last section for the device containing any
      * remaining data at the end phase of migration.
@@ -95,7 +95,7 @@ typedef struct SaveVMHandlers {
      *
      * Returns zero to indicate success and negative for error
      */
-    int (*save_live_complete_precopy)(QEMUFile *f, void *opaque);
+    int (*save_complete)(QEMUFile *f, void *opaque);
 
     /**
      * @save_live_complete_precopy_thread (invoked in a separate thread)
@@ -103,7 +103,7 @@ typedef struct SaveVMHandlers {
      * Called at the end of a precopy phase from a separate worker thread
      * in configurations where multifd device state transfer is supported
      * in order to perform asynchronous transmission of the remaining data in
-     * parallel with @save_live_complete_precopy handlers.
+     * parallel with @save_complete handlers.
      * When postcopy is enabled, devices that support postcopy will skip this
      * step.
      *
diff --git a/migration/block-dirty-bitmap.c b/migration/block-dirty-bitmap.c
index 6ee3c32a76..a061aad817 100644
--- a/migration/block-dirty-bitmap.c
+++ b/migration/block-dirty-bitmap.c
@@ -1248,7 +1248,7 @@ static bool dirty_bitmap_has_postcopy(void *opaque)
 
 static SaveVMHandlers savevm_dirty_bitmap_handlers = {
     .save_setup = dirty_bitmap_save_setup,
-    .save_live_complete_precopy = dirty_bitmap_save_complete,
+    .save_complete = dirty_bitmap_save_complete,
     .has_postcopy = dirty_bitmap_has_postcopy,
     .state_pending_exact = dirty_bitmap_state_pending,
     .state_pending_estimate = dirty_bitmap_state_pending,
diff --git a/migration/ram.c b/migration/ram.c
index 6bb4f13031..ffd839f57c 100644
--- a/migration/ram.c
+++ b/migration/ram.c
@@ -4548,7 +4548,7 @@ void postcopy_preempt_shutdown_file(MigrationState *s)
 static SaveVMHandlers savevm_ram_handlers = {
     .save_setup = ram_save_setup,
     .save_live_iterate = ram_save_iterate,
-    .save_live_complete_precopy = ram_save_complete,
+    .save_complete = ram_save_complete,
     .has_postcopy = ram_has_postcopy,
     .state_pending_exact = ram_state_pending_exact,
     .state_pending_estimate = ram_state_pending_estimate,
diff --git a/migration/savevm.c b/migration/savevm.c
index 3e20f8608a..454e914b56 100644
--- a/migration/savevm.c
+++ b/migration/savevm.c
@@ -1496,7 +1496,7 @@ void qemu_savevm_state_complete_postcopy(QEMUFile *f)
     int ret;
 
     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
-        if (!se->ops || !se->ops->save_live_complete_precopy) {
+        if (!se->ops || !se->ops->save_complete) {
             continue;
         }
         if (se->ops->is_active) {
@@ -1509,7 +1509,7 @@ void qemu_savevm_state_complete_postcopy(QEMUFile *f)
         qemu_put_byte(f, QEMU_VM_SECTION_END);
         qemu_put_be32(f, se->section_id);
 
-        ret = se->ops->save_live_complete_precopy(f, se->opaque);
+        ret = se->ops->save_complete(f, se->opaque);
         trace_savevm_section_end(se->idstr, se->section_id, ret);
         save_section_footer(f, se);
         if (ret < 0) {
@@ -1583,7 +1583,7 @@ int qemu_savevm_state_complete_precopy_iterable(QEMUFile *f, bool in_postcopy)
         if (!se->ops ||
             (in_postcopy && se->ops->has_postcopy &&
              se->ops->has_postcopy(se->opaque)) ||
-            !se->ops->save_live_complete_precopy) {
+            !se->ops->save_complete) {
             continue;
         }
 
@@ -1598,7 +1598,7 @@ int qemu_savevm_state_complete_precopy_iterable(QEMUFile *f, bool in_postcopy)
 
         save_section_header(f, se, QEMU_VM_SECTION_END);
 
-        ret = se->ops->save_live_complete_precopy(f, se->opaque);
+        ret = se->ops->save_complete(f, se->opaque);
         trace_savevm_section_end(se->idstr, se->section_id, ret);
         save_section_footer(f, se);
         if (ret < 0) {

From 7dd95a963072e0e33addbf2c87b548a624ce66b6 Mon Sep 17 00:00:00 2001
From: Peter Xu <peterx@redhat.com>
Date: Fri, 13 Jun 2025 10:07:57 -0400
Subject: [PATCH 2130/2760] migration: qemu_savevm_complete*() helpers

Since we use the same save_complete() hook for both precopy and postcopy,
add a set of helpers to invoke the hook() to dedup the code.

Reviewed-by: Juraj Marcin <jmarcin@redhat.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20250613140801.474264-8-peterx@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Fabiano Rosas <farosas@suse.de>
---
 migration/savevm.c | 78 ++++++++++++++++++++++++++--------------------
 1 file changed, 44 insertions(+), 34 deletions(-)

diff --git a/migration/savevm.c b/migration/savevm.c
index 454e914b56..c4fd5f5a5b 100644
--- a/migration/savevm.c
+++ b/migration/savevm.c
@@ -1484,6 +1484,38 @@ bool should_send_vmdesc(void)
     return !machine->suppress_vmdesc;
 }
 
+static bool qemu_savevm_complete_exists(SaveStateEntry *se)
+{
+    return se->ops && se->ops->save_complete;
+}
+
+/*
+ * Invoke the ->save_complete() if necessary.
+ * Returns: 0 if skip the current SE or succeeded, <0 if error happened.
+ */
+static int qemu_savevm_complete(SaveStateEntry *se, QEMUFile *f)
+{
+    int ret;
+
+    if (se->ops->is_active) {
+        if (!se->ops->is_active(se->opaque)) {
+            return 0;
+        }
+    }
+
+    trace_savevm_section_start(se->idstr, se->section_id);
+    save_section_header(f, se, QEMU_VM_SECTION_END);
+    ret = se->ops->save_complete(f, se->opaque);
+    trace_savevm_section_end(se->idstr, se->section_id, ret);
+    save_section_footer(f, se);
+
+    if (ret < 0) {
+        qemu_file_set_error(f, ret);
+    }
+
+    return ret;
+}
+
 /*
  * Complete saving any postcopy-able devices.
  *
@@ -1493,27 +1525,13 @@ bool should_send_vmdesc(void)
 void qemu_savevm_state_complete_postcopy(QEMUFile *f)
 {
     SaveStateEntry *se;
-    int ret;
 
     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
-        if (!se->ops || !se->ops->save_complete) {
+        if (!qemu_savevm_complete_exists(se)) {
             continue;
         }
-        if (se->ops->is_active) {
-            if (!se->ops->is_active(se->opaque)) {
-                continue;
-            }
-        }
-        trace_savevm_section_start(se->idstr, se->section_id);
-        /* Section type */
-        qemu_put_byte(f, QEMU_VM_SECTION_END);
-        qemu_put_be32(f, se->section_id);
 
-        ret = se->ops->save_complete(f, se->opaque);
-        trace_savevm_section_end(se->idstr, se->section_id, ret);
-        save_section_footer(f, se);
-        if (ret < 0) {
-            qemu_file_set_error(f, ret);
+        if (qemu_savevm_complete(se, f) < 0) {
             return;
         }
     }
@@ -1559,7 +1577,6 @@ int qemu_savevm_state_complete_precopy_iterable(QEMUFile *f, bool in_postcopy)
 {
     int64_t start_ts_each, end_ts_each;
     SaveStateEntry *se;
-    int ret;
     bool multifd_device_state = multifd_device_state_supported();
 
     if (multifd_device_state) {
@@ -1580,32 +1597,25 @@ int qemu_savevm_state_complete_precopy_iterable(QEMUFile *f, bool in_postcopy)
     }
 
     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
-        if (!se->ops ||
-            (in_postcopy && se->ops->has_postcopy &&
-             se->ops->has_postcopy(se->opaque)) ||
-            !se->ops->save_complete) {
+        if (!qemu_savevm_complete_exists(se)) {
             continue;
         }
 
-        if (se->ops->is_active) {
-            if (!se->ops->is_active(se->opaque)) {
-                continue;
-            }
+        if (in_postcopy && se->ops->has_postcopy &&
+            se->ops->has_postcopy(se->opaque)) {
+            /*
+             * If postcopy will start soon, and if the SE supports
+             * postcopy, then we can skip the SE for the postcopy phase.
+             */
+            continue;
         }
 
         start_ts_each = qemu_clock_get_us(QEMU_CLOCK_REALTIME);
-        trace_savevm_section_start(se->idstr, se->section_id);
-
-        save_section_header(f, se, QEMU_VM_SECTION_END);
-
-        ret = se->ops->save_complete(f, se->opaque);
-        trace_savevm_section_end(se->idstr, se->section_id, ret);
-        save_section_footer(f, se);
-        if (ret < 0) {
-            qemu_file_set_error(f, ret);
+        if (qemu_savevm_complete(se, f) < 0) {
             goto ret_fail_abort_threads;
         }
         end_ts_each = qemu_clock_get_us(QEMU_CLOCK_REALTIME);
+
         trace_vmstate_downtime_save("iterable", se->idstr, se->instance_id,
                                     end_ts_each - start_ts_each);
     }

From ff9dfc41d9e74651d565a3cad80dbaac3cde1eb9 Mon Sep 17 00:00:00 2001
From: Peter Xu <peterx@redhat.com>
Date: Fri, 13 Jun 2025 10:07:58 -0400
Subject: [PATCH 2131/2760] migration/ram: One less indent for
 ram_find_and_save_block()

The check over PAGE_DIRTY_FOUND isn't necessary. We could indent one less
and assert that instead.

Reviewed-by: Juraj Marcin <jmarcin@redhat.com>
Link: https://lore.kernel.org/r/20250613140801.474264-9-peterx@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Fabiano Rosas <farosas@suse.de>
---
 migration/ram.c | 20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/migration/ram.c b/migration/ram.c
index ffd839f57c..aa76f0a53f 100644
--- a/migration/ram.c
+++ b/migration/ram.c
@@ -2286,16 +2286,18 @@ static int ram_find_and_save_block(RAMState *rs)
         if (!get_queued_page(rs, pss)) {
             /* priority queue empty, so just search for something dirty */
             int res = find_dirty_block(rs, pss);
-            if (res != PAGE_DIRTY_FOUND) {
-                if (res == PAGE_ALL_CLEAN) {
-                    break;
-                } else if (res == PAGE_TRY_AGAIN) {
-                    continue;
-                } else if (res < 0) {
-                    pages = res;
-                    break;
-                }
+
+            if (res == PAGE_ALL_CLEAN) {
+                break;
+            } else if (res == PAGE_TRY_AGAIN) {
+                continue;
+            } else if (res < 0) {
+                pages = res;
+                break;
             }
+
+            /* Otherwise we must have a dirty page to move */
+            assert(res == PAGE_DIRTY_FOUND);
         }
         pages = ram_save_host_page(rs, pss);
         if (pages) {

From f1549da610dc3d37da4de0e3ba7374c5316af716 Mon Sep 17 00:00:00 2001
From: Peter Xu <peterx@redhat.com>
Date: Fri, 13 Jun 2025 10:07:59 -0400
Subject: [PATCH 2132/2760] migration/ram: Add tracepoints for
 ram_save_complete()

Take notes on start/end state of dirty pages for the whole system.

Reviewed-by: Juraj Marcin <jmarcin@redhat.com>
Link: https://lore.kernel.org/r/20250613140801.474264-10-peterx@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Fabiano Rosas <farosas@suse.de>
---
 migration/ram.c        | 5 +++++
 migration/trace-events | 1 +
 2 files changed, 6 insertions(+)

diff --git a/migration/ram.c b/migration/ram.c
index aa76f0a53f..e4871b4c17 100644
--- a/migration/ram.c
+++ b/migration/ram.c
@@ -3290,6 +3290,8 @@ static int ram_save_complete(QEMUFile *f, void *opaque)
     RAMState *rs = *temp;
     int ret = 0;
 
+    trace_ram_save_complete(rs->migration_dirty_pages, 0);
+
     rs->last_stage = !migration_in_colo_state();
 
     WITH_RCU_READ_LOCK_GUARD() {
@@ -3353,6 +3355,9 @@ static int ram_save_complete(QEMUFile *f, void *opaque)
     }
 
     qemu_put_be64(f, RAM_SAVE_FLAG_EOS);
+
+    trace_ram_save_complete(rs->migration_dirty_pages, 1);
+
     return qemu_fflush(f);
 }
 
diff --git a/migration/trace-events b/migration/trace-events
index c506e11a2e..dcd8fe9a0c 100644
--- a/migration/trace-events
+++ b/migration/trace-events
@@ -105,6 +105,7 @@ ram_load_postcopy_loop(int channel, uint64_t addr, int flags) "chan=%d addr=0x%"
 ram_postcopy_send_discard_bitmap(void) ""
 ram_save_page(const char *rbname, uint64_t offset, void *host) "%s: offset: 0x%" PRIx64 " host: %p"
 ram_save_queue_pages(const char *rbname, size_t start, size_t len) "%s: start: 0x%zx len: 0x%zx"
+ram_save_complete(uint64_t dirty_pages, int done) "dirty=%" PRIu64 ", done=%d"
 ram_dirty_bitmap_request(char *str) "%s"
 ram_dirty_bitmap_reload_begin(char *str) "%s"
 ram_dirty_bitmap_reload_complete(char *str) "%s"

From 7aaa1fc072ca7b9abf08c62504faa96126b583ce Mon Sep 17 00:00:00 2001
From: Peter Xu <peterx@redhat.com>
Date: Fri, 13 Jun 2025 10:08:00 -0400
Subject: [PATCH 2133/2760] migration: Rewrite the migration complete detect
 logic

There're a few things off here in that logic, rewrite it.  When at it, add
rich comment to explain each of the decisions.

Since this is very sensitive path for migration, below are the list of
things changed with their reasonings.

  (1) Exact pending size is only needed for precopy not postcopy

      Fundamentally it's because "exact" version only does one more deep
      sync to fetch the pending results, while in postcopy's case it's
      never going to sync anything more than estimate as the VM on source
      is stopped.

  (2) Do _not_ rely on threshold_size anymore to decide whether postcopy
      should complete

      threshold_size was calculated from the expected downtime and
      bandwidth only during precopy as an efficient way to decide when to
      switchover.  It's not sensible to rely on threshold_size in postcopy.

      For precopy, if switchover is decided, the migration will complete
      soon.  It's not true for postcopy.  Logically speaking, postcopy
      should only complete the migration if all pending data is flushed.

      Here it used to work because save_complete() used to implicitly
      contain save_live_iterate() when there's pending size.

      Even if that looks benign, having RAMs to be migrated in postcopy's
      save_complete() has other bad side effects:

      (a) Since save_complete() needs to be run once at a time, it means
      when moving RAM there's no way moving other things (rather than
      round-robin iterating the vmstate handlers like what we do with
      ITERABLE phase).  Not an immediate concern, but it may stop working
      in the future when there're more than one iterables (e.g. vfio
      postcopy).

      (b) postcopy recovery, unfortunately, only works during ITERABLE
      phase. IOW, if src QEMU moves RAM during postcopy's save_complete()
      and network failed, then it'll crash both QEMUs... OTOH if it failed
      during iteration it'll still be recoverable.  IOW, this change should
      further reduce the window QEMU split brain and crash in extreme cases.

      If we enable the ram_save_complete() tracepoints, we'll see this
      before this patch:

      1267959@1748381938.294066:ram_save_complete dirty=9627, done=0
      1267959@1748381938.308884:ram_save_complete dirty=0, done=1

      It means in this migration there're 9627 pages migrated at complete()
      of postcopy phase.

      After this change, all the postcopy RAM should be migrated in iterable
      phase, rather than save_complete():

      1267959@1748381938.294066:ram_save_complete dirty=0, done=0
      1267959@1748381938.308884:ram_save_complete dirty=0, done=1

  (3) Adjust when to decide to switch to postcopy

      This shouldn't be super important, the movement makes sure there's
      only one in_postcopy check, then we are clear on what we do with the
      two completely differnt use cases (precopy v.s. postcopy).

  (4) Trivial touch up on threshold_size comparision

      Which changes:

      "(!pending_size || pending_size < s->threshold_size)"

      into:

      "(pending_size <= s->threshold_size)"

Reviewed-by: Juraj Marcin <jmarcin@redhat.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20250613140801.474264-11-peterx@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Fabiano Rosas <farosas@suse.de>
---
 migration/migration.c | 57 +++++++++++++++++++++++++++++++------------
 1 file changed, 42 insertions(+), 15 deletions(-)

diff --git a/migration/migration.c b/migration/migration.c
index e33e39ac74..923400f801 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -3436,33 +3436,60 @@ static MigIterateState migration_iteration_run(MigrationState *s)
     Error *local_err = NULL;
     bool in_postcopy = s->state == MIGRATION_STATUS_POSTCOPY_ACTIVE;
     bool can_switchover = migration_can_switchover(s);
+    bool complete_ready;
 
+    /* Fast path - get the estimated amount of pending data */
     qemu_savevm_state_pending_estimate(&must_precopy, &can_postcopy);
     pending_size = must_precopy + can_postcopy;
     trace_migrate_pending_estimate(pending_size, must_precopy, can_postcopy);
 
-    if (pending_size < s->threshold_size) {
-        qemu_savevm_state_pending_exact(&must_precopy, &can_postcopy);
-        pending_size = must_precopy + can_postcopy;
-        trace_migrate_pending_exact(pending_size, must_precopy, can_postcopy);
+    if (in_postcopy) {
+        /*
+         * Iterate in postcopy until all pending data flushed.  Note that
+         * postcopy completion doesn't rely on can_switchover, because when
+         * POSTCOPY_ACTIVE it means switchover already happened.
+         */
+        complete_ready = !pending_size;
+    } else {
+        /*
+         * Exact pending reporting is only needed for precopy.  Taking RAM
+         * as example, there'll be no extra dirty information after
+         * postcopy started, so ESTIMATE should always match with EXACT
+         * during postcopy phase.
+         */
+        if (pending_size < s->threshold_size) {
+            qemu_savevm_state_pending_exact(&must_precopy, &can_postcopy);
+            pending_size = must_precopy + can_postcopy;
+            trace_migrate_pending_exact(pending_size, must_precopy,
+                                        can_postcopy);
+        }
+
+        /* Should we switch to postcopy now? */
+        if (must_precopy <= s->threshold_size &&
+            can_switchover && qatomic_read(&s->start_postcopy)) {
+            if (postcopy_start(s, &local_err)) {
+                migrate_set_error(s, local_err);
+                error_report_err(local_err);
+            }
+            return MIG_ITERATE_SKIP;
+        }
+
+        /*
+         * For precopy, migration can complete only if:
+         *
+         * (1) Switchover is acknowledged by destination
+         * (2) Pending size is no more than the threshold specified
+         *     (which was calculated from expected downtime)
+         */
+        complete_ready = can_switchover && (pending_size <= s->threshold_size);
     }
 
-    if ((!pending_size || pending_size < s->threshold_size) && can_switchover) {
+    if (complete_ready) {
         trace_migration_thread_low_pending(pending_size);
         migration_completion(s);
         return MIG_ITERATE_BREAK;
     }
 
-    /* Still a significant amount to transfer */
-    if (!in_postcopy && must_precopy <= s->threshold_size && can_switchover &&
-        qatomic_read(&s->start_postcopy)) {
-        if (postcopy_start(s, &local_err)) {
-            migrate_set_error(s, local_err);
-            error_report_err(local_err);
-        }
-        return MIG_ITERATE_SKIP;
-    }
-
     /* Just another iteration step */
     qemu_savevm_state_iterate(s->to_dst_file, in_postcopy);
     return MIG_ITERATE_RESUME;

From adb13d6e42d6e0084e19a41303138d5d022e5904 Mon Sep 17 00:00:00 2001
From: Peter Xu <peterx@redhat.com>
Date: Fri, 13 Jun 2025 10:08:01 -0400
Subject: [PATCH 2134/2760] migration/postcopy: Avoid clearing dirty bitmap for
 postcopy too

This is a follow up on the other commit "migration/ram: avoid to do log
clear in the last round" but for postcopy.

https://lore.kernel.org/r/20250514115827.3216082-1-yanfei.xu@bytedance.com

I can observe more than 10% reduction of average page fault latency during
postcopy phase with this optimization:

  Before: 268.00us (+-1.87%)
  After:  232.67us (+-2.01%)

The test was done with a 16GB VM with 80 vCPUs, running a workload that
busy random writes to 13GB memory.

Cc: Yanfei Xu <yanfei.xu@bytedance.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20250613140801.474264-12-peterx@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Fabiano Rosas <farosas@suse.de>
---
 migration/ram.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/migration/ram.c b/migration/ram.c
index e4871b4c17..7208bc114f 100644
--- a/migration/ram.c
+++ b/migration/ram.c
@@ -835,8 +835,10 @@ static inline bool migration_bitmap_clear_dirty(RAMState *rs,
      * protections isn't needed as we know there will be either (1) no
      * further writes if migration will complete, or (2) migration fails
      * at last then tracking isn't needed either.
+     *
+     * Do the same for postcopy due to the same reason.
      */
-    if (!rs->last_stage) {
+    if (!rs->last_stage && !migration_in_postcopy()) {
         /*
          * Clear dirty bitmap if needed.  This _must_ be called before we
          * send any of the page in the chunk because we need to make sure

From f62b7a0a29192891f0139f2ad8009f55a41c8641 Mon Sep 17 00:00:00 2001
From: Peter Xu <peterx@redhat.com>
Date: Fri, 13 Jun 2025 10:12:04 -0400
Subject: [PATCH 2135/2760] migration: Add option to set postcopy-blocktime

Add a global property to allow enabling postcopy-blocktime feature.

Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20250613141217.474825-2-peterx@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Fabiano Rosas <farosas@suse.de>
---
 migration/options.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/migration/options.c b/migration/options.c
index 162c72cda4..4e923a2e07 100644
--- a/migration/options.c
+++ b/migration/options.c
@@ -187,6 +187,8 @@ const Property migration_properties[] = {
     DEFINE_PROP_MIG_CAP("x-postcopy-ram", MIGRATION_CAPABILITY_POSTCOPY_RAM),
     DEFINE_PROP_MIG_CAP("x-postcopy-preempt",
                         MIGRATION_CAPABILITY_POSTCOPY_PREEMPT),
+    DEFINE_PROP_MIG_CAP("postcopy-blocktime",
+                        MIGRATION_CAPABILITY_POSTCOPY_BLOCKTIME),
     DEFINE_PROP_MIG_CAP("x-colo", MIGRATION_CAPABILITY_X_COLO),
     DEFINE_PROP_MIG_CAP("x-release-ram", MIGRATION_CAPABILITY_RELEASE_RAM),
     DEFINE_PROP_MIG_CAP("x-return-path", MIGRATION_CAPABILITY_RETURN_PATH),

From d2a81ca8c6fbe6ed691889d953d0b5fe2c7e4671 Mon Sep 17 00:00:00 2001
From: Peter Xu <peterx@redhat.com>
Date: Fri, 13 Jun 2025 10:12:05 -0400
Subject: [PATCH 2136/2760] migration/postcopy: Push blocktime start/end into
 page req mutex

The postcopy blocktime feature was tricky that it used quite some atomic
operations over quite a few arrays and vars, without explaining how that
would be thread safe.  The thread safety here is about concurrency between
the fault thread and the fault resolution threads, possible to access the
same chunk of data.  All these atomic ops can be expensive too before
knowing clearly how it works.

OTOH, postcopy has one page_request_mutex used to serialize the received
bitmap updates.  So far it's ok - we don't yet have a lot of threads
contending the lock.  It might change after multifd will be supported, but
that's a separate story.  What is important is, with that mutex, it's
pretty lightweight to move all the blocktime maintenance into the mutex
critical section.  It's because the blocktime layer is lightweighted:
almost "remember which vcpu faulted on which address", and "ok we get some
fault resolved, calculate how long it takes".  It's also an optional
feature for now (but I have thought of changing that, maybe in the future).

Let's push the blocktime layer into the mutex, so that it's always
thread-safe even without any atomic ops.

To achieve that, I'll need to add a tid parameter on fault path so that
it'll start to pass the faulted thread ID into deeper the stack, but not
too deep.  When at it, add a comment for the shared fault handler (for
example, vhost-user devices running with postcopy), to mention a TODO.  One
reason it might not be trivial is that vhost-user's userfaultfds should be
opened by vhost-user process, so it's pretty hard to control making sure
the TID feature will be around.  It wasn't supported before, so keep it
like that for now.

Now we should be as ease when everything is protected by a mutex that we
always take anyway.

One side effect: we can finally remove one ramblock_recv_bitmap_test() in
mark_postcopy_blocktime_begin(), which was pretty weird and which also
includes a weird (but maybe necessary.. but maybe not?) operation to inject
a blocktime entry then quickly erase it..  When we're with the mutex, and
when we make sure it's invoked after checking the receive bitmap, it's not
needed anymore.  Instead, we assert.

As another side effect, this paves way for removing all atomic ops in all
the mem accesses in blocktime layer.

Note that we need a stub for mark_postcopy_blocktime_begin() for Windows
builds.

Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20250613141217.474825-3-peterx@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Fabiano Rosas <farosas@suse.de>
---
 migration/migration.c    | 25 +++++++++++-------
 migration/migration.h    |  2 +-
 migration/postcopy-ram.c | 56 +++++++++++++++++++++-------------------
 migration/postcopy-ram.h |  2 ++
 migration/trace-events   |  2 +-
 5 files changed, 48 insertions(+), 39 deletions(-)

diff --git a/migration/migration.c b/migration/migration.c
index 923400f801..10c216d25d 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -576,22 +576,27 @@ int migrate_send_rp_message_req_pages(MigrationIncomingState *mis,
 }
 
 int migrate_send_rp_req_pages(MigrationIncomingState *mis,
-                              RAMBlock *rb, ram_addr_t start, uint64_t haddr)
+                              RAMBlock *rb, ram_addr_t start, uint64_t haddr,
+                              uint32_t tid)
 {
     void *aligned = (void *)(uintptr_t)ROUND_DOWN(haddr, qemu_ram_pagesize(rb));
     bool received = false;
 
     WITH_QEMU_LOCK_GUARD(&mis->page_request_mutex) {
         received = ramblock_recv_bitmap_test_byte_offset(rb, start);
-        if (!received && !g_tree_lookup(mis->page_requested, aligned)) {
-            /*
-             * The page has not been received, and it's not yet in the page
-             * request list.  Queue it.  Set the value of element to 1, so that
-             * things like g_tree_lookup() will return TRUE (1) when found.
-             */
-            g_tree_insert(mis->page_requested, aligned, (gpointer)1);
-            qatomic_inc(&mis->page_requested_count);
-            trace_postcopy_page_req_add(aligned, mis->page_requested_count);
+        if (!received) {
+            if (!g_tree_lookup(mis->page_requested, aligned)) {
+                /*
+                 * The page has not been received, and it's not yet in the
+                 * page request list.  Queue it.  Set the value of element
+                 * to 1, so that things like g_tree_lookup() will return
+                 * TRUE (1) when found.
+                 */
+                g_tree_insert(mis->page_requested, aligned, (gpointer)1);
+                qatomic_inc(&mis->page_requested_count);
+                trace_postcopy_page_req_add(aligned, mis->page_requested_count);
+            }
+            mark_postcopy_blocktime_begin(haddr, tid, rb);
         }
     }
 
diff --git a/migration/migration.h b/migration/migration.h
index 739289de93..01329bf824 100644
--- a/migration/migration.h
+++ b/migration/migration.h
@@ -546,7 +546,7 @@ void migrate_send_rp_shut(MigrationIncomingState *mis,
 void migrate_send_rp_pong(MigrationIncomingState *mis,
                           uint32_t value);
 int migrate_send_rp_req_pages(MigrationIncomingState *mis, RAMBlock *rb,
-                              ram_addr_t start, uint64_t haddr);
+                              ram_addr_t start, uint64_t haddr, uint32_t tid);
 int migrate_send_rp_message_req_pages(MigrationIncomingState *mis,
                                       RAMBlock *rb, ram_addr_t start);
 void migrate_send_rp_recv_bitmap(MigrationIncomingState *mis,
diff --git a/migration/postcopy-ram.c b/migration/postcopy-ram.c
index 75fd310fb2..32fa06dabd 100644
--- a/migration/postcopy-ram.c
+++ b/migration/postcopy-ram.c
@@ -752,8 +752,12 @@ int postcopy_wake_shared(struct PostCopyFD *pcfd,
                        pagesize);
 }
 
+/*
+ * NOTE: @tid is only used when postcopy-blocktime feature is enabled, and
+ * also optional: when zero is provided, the fault accounting will be ignored.
+ */
 static int postcopy_request_page(MigrationIncomingState *mis, RAMBlock *rb,
-                                 ram_addr_t start, uint64_t haddr)
+                                 ram_addr_t start, uint64_t haddr, uint32_t tid)
 {
     void *aligned = (void *)(uintptr_t)ROUND_DOWN(haddr, qemu_ram_pagesize(rb));
 
@@ -772,7 +776,7 @@ static int postcopy_request_page(MigrationIncomingState *mis, RAMBlock *rb,
         return received ? 0 : postcopy_place_page_zero(mis, aligned, rb);
     }
 
-    return migrate_send_rp_req_pages(mis, rb, start, haddr);
+    return migrate_send_rp_req_pages(mis, rb, start, haddr, tid);
 }
 
 /*
@@ -793,7 +797,8 @@ int postcopy_request_shared_page(struct PostCopyFD *pcfd, RAMBlock *rb,
                                         qemu_ram_get_idstr(rb), rb_offset);
         return postcopy_wake_shared(pcfd, client_addr, rb);
     }
-    postcopy_request_page(mis, rb, aligned_rbo, client_addr);
+    /* TODO: support blocktime tracking */
+    postcopy_request_page(mis, rb, aligned_rbo, client_addr, 0);
     return 0;
 }
 
@@ -819,17 +824,17 @@ static uint32_t get_low_time_offset(PostcopyBlocktimeContext *dc)
 }
 
 /*
- * This function is being called when pagefault occurs. It
- * tracks down vCPU blocking time.
+ * This function is being called when pagefault occurs. It tracks down vCPU
+ * blocking time.  It's protected by @page_request_mutex.
  *
  * @addr: faulted host virtual address
  * @ptid: faulted process thread id
  * @rb: ramblock appropriate to addr
  */
-static void mark_postcopy_blocktime_begin(uintptr_t addr, uint32_t ptid,
-                                          RAMBlock *rb)
+void mark_postcopy_blocktime_begin(uintptr_t addr, uint32_t ptid,
+                                   RAMBlock *rb)
 {
-    int cpu, already_received;
+    int cpu;
     MigrationIncomingState *mis = migration_incoming_get_current();
     PostcopyBlocktimeContext *dc = mis->blocktime_ctx;
     uint32_t low_time_offset;
@@ -852,24 +857,19 @@ static void mark_postcopy_blocktime_begin(uintptr_t addr, uint32_t ptid,
     qatomic_xchg(&dc->vcpu_addr[cpu], addr);
 
     /*
-     * check it here, not at the beginning of the function,
-     * due to, check could occur early than bitmap_set in
-     * qemu_ufd_copy_ioctl
+     * The caller should only inject a blocktime entry when the page is
+     * yet missing.
      */
-    already_received = ramblock_recv_bitmap_test(rb, (void *)addr);
-    if (already_received) {
-        qatomic_xchg(&dc->vcpu_addr[cpu], 0);
-        qatomic_xchg(&dc->page_fault_vcpu_time[cpu], 0);
-        qatomic_dec(&dc->smp_cpus_down);
-    }
+    assert(!ramblock_recv_bitmap_test(rb, (void *)addr));
+
     trace_mark_postcopy_blocktime_begin(addr, dc, dc->page_fault_vcpu_time[cpu],
-                                        cpu, already_received);
+                                        cpu);
 }
 
 /*
- *  This function just provide calculated blocktime per cpu and trace it.
- *  Total blocktime is calculated in mark_postcopy_blocktime_end.
- *
+ * This function just provide calculated blocktime per cpu and trace it.
+ * Total blocktime is calculated in mark_postcopy_blocktime_end.  It's
+ * protected by @page_request_mutex.
  *
  * Assume we have 3 CPU
  *
@@ -1068,17 +1068,14 @@ static void *postcopy_ram_fault_thread(void *opaque)
                                                 qemu_ram_get_idstr(rb),
                                                 rb_offset,
                                                 msg.arg.pagefault.feat.ptid);
-            mark_postcopy_blocktime_begin(
-                    (uintptr_t)(msg.arg.pagefault.address),
-                                msg.arg.pagefault.feat.ptid, rb);
-
 retry:
             /*
              * Send the request to the source - we want to request one
              * of our host page sizes (which is >= TPS)
              */
             ret = postcopy_request_page(mis, rb, rb_offset,
-                                        msg.arg.pagefault.address);
+                                        msg.arg.pagefault.address,
+                                        msg.arg.pagefault.feat.ptid);
             if (ret) {
                 /* May be network failure, try to wait for recovery */
                 postcopy_pause_fault_thread(mis);
@@ -1299,8 +1296,8 @@ static int qemu_ufd_copy_ioctl(MigrationIncomingState *mis, void *host_addr,
                 qemu_cond_signal(&mis->page_request_cond);
             }
         }
-        qemu_mutex_unlock(&mis->page_request_mutex);
         mark_postcopy_blocktime_end((uintptr_t)host_addr);
+        qemu_mutex_unlock(&mis->page_request_mutex);
     }
     return ret;
 }
@@ -1430,6 +1427,11 @@ int postcopy_wake_shared(struct PostCopyFD *pcfd,
 {
     g_assert_not_reached();
 }
+
+void mark_postcopy_blocktime_begin(uintptr_t addr, uint32_t ptid,
+                                   RAMBlock *rb)
+{
+}
 #endif
 
 /* ------------------------------------------------------------------------- */
diff --git a/migration/postcopy-ram.h b/migration/postcopy-ram.h
index a6df1b2811..3852141d7e 100644
--- a/migration/postcopy-ram.h
+++ b/migration/postcopy-ram.h
@@ -196,5 +196,7 @@ void postcopy_preempt_new_channel(MigrationIncomingState *mis, QEMUFile *file);
 void postcopy_preempt_setup(MigrationState *s);
 int postcopy_preempt_establish_channel(MigrationState *s);
 bool postcopy_is_paused(MigrationStatus status);
+void mark_postcopy_blocktime_begin(uintptr_t addr, uint32_t ptid,
+                                   RAMBlock *rb);
 
 #endif
diff --git a/migration/trace-events b/migration/trace-events
index dcd8fe9a0c..917f521e88 100644
--- a/migration/trace-events
+++ b/migration/trace-events
@@ -285,7 +285,7 @@ postcopy_nhp_range(const char *ramblock, void *host_addr, size_t offset, size_t
 postcopy_place_page(void *host_addr) "host=%p"
 postcopy_place_page_zero(void *host_addr) "host=%p"
 postcopy_ram_enable_notify(void) ""
-mark_postcopy_blocktime_begin(uint64_t addr, void *dd, uint32_t time, int cpu, int received) "addr: 0x%" PRIx64 ", dd: %p, time: %u, cpu: %d, already_received: %d"
+mark_postcopy_blocktime_begin(uint64_t addr, void *dd, uint32_t time, int cpu) "addr: 0x%" PRIx64 ", dd: %p, time: %u, cpu: %d"
 mark_postcopy_blocktime_end(uint64_t addr, void *dd, uint32_t time, int affected_cpu) "addr: 0x%" PRIx64 ", dd: %p, time: %u, affected_cpu: %d"
 postcopy_pause_fault_thread(void) ""
 postcopy_pause_fault_thread_continued(void) ""

From c0f47dfb5b06c40ef41641a5f03ebafa8125c557 Mon Sep 17 00:00:00 2001
From: Peter Xu <peterx@redhat.com>
Date: Fri, 13 Jun 2025 10:12:06 -0400
Subject: [PATCH 2137/2760] migration/postcopy: Drop all atomic ops in
 blocktime feature

Now with the mutex protection it's not needed anymore.

Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20250613141217.474825-4-peterx@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Fabiano Rosas <farosas@suse.de>
---
 migration/postcopy-ram.c | 23 ++++++++++-------------
 1 file changed, 10 insertions(+), 13 deletions(-)

diff --git a/migration/postcopy-ram.c b/migration/postcopy-ram.c
index 32fa06dabd..81925532de 100644
--- a/migration/postcopy-ram.c
+++ b/migration/postcopy-ram.c
@@ -849,12 +849,12 @@ void mark_postcopy_blocktime_begin(uintptr_t addr, uint32_t ptid,
 
     low_time_offset = get_low_time_offset(dc);
     if (dc->vcpu_addr[cpu] == 0) {
-        qatomic_inc(&dc->smp_cpus_down);
+        dc->smp_cpus_down++;
     }
 
-    qatomic_xchg(&dc->last_begin, low_time_offset);
-    qatomic_xchg(&dc->page_fault_vcpu_time[cpu], low_time_offset);
-    qatomic_xchg(&dc->vcpu_addr[cpu], addr);
+    dc->last_begin = low_time_offset;
+    dc->page_fault_vcpu_time[cpu] = low_time_offset;
+    dc->vcpu_addr[cpu] = addr;
 
     /*
      * The caller should only inject a blocktime entry when the page is
@@ -915,29 +915,26 @@ static void mark_postcopy_blocktime_end(uintptr_t addr)
     for (i = 0; i < smp_cpus; i++) {
         uint32_t vcpu_blocktime = 0;
 
-        read_vcpu_time = qatomic_fetch_add(&dc->page_fault_vcpu_time[i], 0);
-        if (qatomic_fetch_add(&dc->vcpu_addr[i], 0) != addr ||
-            read_vcpu_time == 0) {
+        read_vcpu_time = dc->page_fault_vcpu_time[i];
+        if (dc->vcpu_addr[i] != addr || read_vcpu_time == 0) {
             continue;
         }
-        qatomic_xchg(&dc->vcpu_addr[i], 0);
+        dc->vcpu_addr[i] = 0;
         vcpu_blocktime = low_time_offset - read_vcpu_time;
         affected_cpu += 1;
         /* we need to know is that mark_postcopy_end was due to
          * faulted page, another possible case it's prefetched
          * page and in that case we shouldn't be here */
-        if (!vcpu_total_blocktime &&
-            qatomic_fetch_add(&dc->smp_cpus_down, 0) == smp_cpus) {
+        if (!vcpu_total_blocktime && dc->smp_cpus_down == smp_cpus) {
             vcpu_total_blocktime = true;
         }
         /* continue cycle, due to one page could affect several vCPUs */
         dc->vcpu_blocktime[i] += vcpu_blocktime;
     }
 
-    qatomic_sub(&dc->smp_cpus_down, affected_cpu);
+    dc->smp_cpus_down -= affected_cpu;
     if (vcpu_total_blocktime) {
-        dc->total_blocktime += low_time_offset - qatomic_fetch_add(
-                &dc->last_begin, 0);
+        dc->total_blocktime += low_time_offset - dc->last_begin;
     }
     trace_mark_postcopy_blocktime_end(addr, dc, dc->total_blocktime,
                                       affected_cpu);

From b2819530e3134fb47c92c1bf0f3def8ea5b1c8ee Mon Sep 17 00:00:00 2001
From: Peter Xu <peterx@redhat.com>
Date: Fri, 13 Jun 2025 10:12:07 -0400
Subject: [PATCH 2138/2760] migration/postcopy: Make all blocktime vars 64bits

I am guessing it was used to be 32bits because of the atomic ops.  Now all
the atomic ops are gone and we're protected by a mutex instead, it's ok we
can switch to 64 bits.

Reasons to move over:

  - Allow further patches to change the unit from ms to us: with postcopy
  preempt mode, we're really into hundreds of microseconds level on
  blocktime.  We'd better be able to trap those.

  - This also paves way for some other tricks that the original version
  used to avoid overflows, e.g., start_time was almost only useful before
  to make sure the sampled timestamp won't overflow a 32-bit field.

  - This prepares further reports on top of existing data collected,
  e.g. average page fault latencies.  When average operation is taken into
  account, milliseconds are simply too coarse grained.

When at it:

  - Rename page_fault_vcpu_time to vcpu_blocktime_start.

  - Rename vcpu_blocktime to vcpu_blocktime_total.

  - Touch up the trace-events to not dump blocktime ctx pointer

Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20250613141217.474825-5-peterx@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Fabiano Rosas <farosas@suse.de>
---
 migration/postcopy-ram.c | 50 ++++++++++++++++++++--------------------
 migration/trace-events   |  4 ++--
 2 files changed, 27 insertions(+), 27 deletions(-)

diff --git a/migration/postcopy-ram.c b/migration/postcopy-ram.c
index 81925532de..ec91821b85 100644
--- a/migration/postcopy-ram.c
+++ b/migration/postcopy-ram.c
@@ -112,14 +112,15 @@ void postcopy_thread_create(MigrationIncomingState *mis,
 
 typedef struct PostcopyBlocktimeContext {
     /* time when page fault initiated per vCPU */
-    uint32_t *page_fault_vcpu_time;
+    uint64_t *vcpu_blocktime_start;
+    /* blocktime per vCPU */
+    uint64_t *vcpu_blocktime_total;
     /* page address per vCPU */
     uintptr_t *vcpu_addr;
-    uint32_t total_blocktime;
-    /* blocktime per vCPU */
-    uint32_t *vcpu_blocktime;
+    /* total blocktime when all vCPUs are stopped */
+    uint64_t total_blocktime;
     /* point in time when last page fault was initiated */
-    uint32_t last_begin;
+    uint64_t last_begin;
     /* number of vCPU are suspended */
     int smp_cpus_down;
     uint64_t start_time;
@@ -133,9 +134,9 @@ typedef struct PostcopyBlocktimeContext {
 
 static void destroy_blocktime_context(struct PostcopyBlocktimeContext *ctx)
 {
-    g_free(ctx->page_fault_vcpu_time);
+    g_free(ctx->vcpu_blocktime_start);
+    g_free(ctx->vcpu_blocktime_total);
     g_free(ctx->vcpu_addr);
-    g_free(ctx->vcpu_blocktime);
     g_free(ctx);
 }
 
@@ -151,13 +152,14 @@ static struct PostcopyBlocktimeContext *blocktime_context_new(void)
     MachineState *ms = MACHINE(qdev_get_machine());
     unsigned int smp_cpus = ms->smp.cpus;
     PostcopyBlocktimeContext *ctx = g_new0(PostcopyBlocktimeContext, 1);
-    ctx->page_fault_vcpu_time = g_new0(uint32_t, smp_cpus);
-    ctx->vcpu_addr = g_new0(uintptr_t, smp_cpus);
-    ctx->vcpu_blocktime = g_new0(uint32_t, smp_cpus);
 
+    ctx->vcpu_blocktime_start = g_new0(uint64_t, smp_cpus);
+    ctx->vcpu_blocktime_total = g_new0(uint64_t, smp_cpus);
+    ctx->vcpu_addr = g_new0(uintptr_t, smp_cpus);
     ctx->exit_notifier.notify = migration_exit_cb;
     ctx->start_time = qemu_clock_get_ms(QEMU_CLOCK_REALTIME);
     qemu_add_exit_notifier(&ctx->exit_notifier);
+
     return ctx;
 }
 
@@ -168,7 +170,7 @@ static uint32List *get_vcpu_blocktime_list(PostcopyBlocktimeContext *ctx)
     int i;
 
     for (i = ms->smp.cpus - 1; i >= 0; i--) {
-        QAPI_LIST_PREPEND(list, ctx->vcpu_blocktime[i]);
+        QAPI_LIST_PREPEND(list, (uint32_t)ctx->vcpu_blocktime_total[i]);
     }
 
     return list;
@@ -191,12 +193,12 @@ void fill_destination_postcopy_migration_info(MigrationInfo *info)
     }
 
     info->has_postcopy_blocktime = true;
-    info->postcopy_blocktime = bc->total_blocktime;
+    info->postcopy_blocktime = (uint32_t)bc->total_blocktime;
     info->has_postcopy_vcpu_blocktime = true;
     info->postcopy_vcpu_blocktime = get_vcpu_blocktime_list(bc);
 }
 
-static uint32_t get_postcopy_total_blocktime(void)
+static uint64_t get_postcopy_total_blocktime(void)
 {
     MigrationIncomingState *mis = migration_incoming_get_current();
     PostcopyBlocktimeContext *bc = mis->blocktime_ctx;
@@ -816,11 +818,9 @@ static int get_mem_fault_cpu_index(uint32_t pid)
     return -1;
 }
 
-static uint32_t get_low_time_offset(PostcopyBlocktimeContext *dc)
+static uint64_t get_low_time_offset(PostcopyBlocktimeContext *dc)
 {
-    int64_t start_time_offset = qemu_clock_get_ms(QEMU_CLOCK_REALTIME) -
-                                    dc->start_time;
-    return start_time_offset < 1 ? 1 : start_time_offset & UINT32_MAX;
+    return (uint64_t)qemu_clock_get_ms(QEMU_CLOCK_REALTIME) - dc->start_time;
 }
 
 /*
@@ -837,7 +837,7 @@ void mark_postcopy_blocktime_begin(uintptr_t addr, uint32_t ptid,
     int cpu;
     MigrationIncomingState *mis = migration_incoming_get_current();
     PostcopyBlocktimeContext *dc = mis->blocktime_ctx;
-    uint32_t low_time_offset;
+    uint64_t low_time_offset;
 
     if (!dc || ptid == 0) {
         return;
@@ -853,7 +853,7 @@ void mark_postcopy_blocktime_begin(uintptr_t addr, uint32_t ptid,
     }
 
     dc->last_begin = low_time_offset;
-    dc->page_fault_vcpu_time[cpu] = low_time_offset;
+    dc->vcpu_blocktime_start[cpu] = low_time_offset;
     dc->vcpu_addr[cpu] = addr;
 
     /*
@@ -862,7 +862,7 @@ void mark_postcopy_blocktime_begin(uintptr_t addr, uint32_t ptid,
      */
     assert(!ramblock_recv_bitmap_test(rb, (void *)addr));
 
-    trace_mark_postcopy_blocktime_begin(addr, dc, dc->page_fault_vcpu_time[cpu],
+    trace_mark_postcopy_blocktime_begin(addr, dc->vcpu_blocktime_start[cpu],
                                         cpu);
 }
 
@@ -901,7 +901,7 @@ static void mark_postcopy_blocktime_end(uintptr_t addr)
     unsigned int smp_cpus = ms->smp.cpus;
     int i, affected_cpu = 0;
     bool vcpu_total_blocktime = false;
-    uint32_t read_vcpu_time, low_time_offset;
+    uint64_t read_vcpu_time, low_time_offset;
 
     if (!dc) {
         return;
@@ -913,9 +913,9 @@ static void mark_postcopy_blocktime_end(uintptr_t addr)
      * optimal, more optimal algorithm is keeping tree or hash
      * where key is address value is a list of  */
     for (i = 0; i < smp_cpus; i++) {
-        uint32_t vcpu_blocktime = 0;
+        uint64_t vcpu_blocktime = 0;
 
-        read_vcpu_time = dc->page_fault_vcpu_time[i];
+        read_vcpu_time = dc->vcpu_blocktime_start[i];
         if (dc->vcpu_addr[i] != addr || read_vcpu_time == 0) {
             continue;
         }
@@ -929,14 +929,14 @@ static void mark_postcopy_blocktime_end(uintptr_t addr)
             vcpu_total_blocktime = true;
         }
         /* continue cycle, due to one page could affect several vCPUs */
-        dc->vcpu_blocktime[i] += vcpu_blocktime;
+        dc->vcpu_blocktime_total[i] += vcpu_blocktime;
     }
 
     dc->smp_cpus_down -= affected_cpu;
     if (vcpu_total_blocktime) {
         dc->total_blocktime += low_time_offset - dc->last_begin;
     }
-    trace_mark_postcopy_blocktime_end(addr, dc, dc->total_blocktime,
+    trace_mark_postcopy_blocktime_end(addr, dc->total_blocktime,
                                       affected_cpu);
 }
 
diff --git a/migration/trace-events b/migration/trace-events
index 917f521e88..02cdb6e7cc 100644
--- a/migration/trace-events
+++ b/migration/trace-events
@@ -285,8 +285,8 @@ postcopy_nhp_range(const char *ramblock, void *host_addr, size_t offset, size_t
 postcopy_place_page(void *host_addr) "host=%p"
 postcopy_place_page_zero(void *host_addr) "host=%p"
 postcopy_ram_enable_notify(void) ""
-mark_postcopy_blocktime_begin(uint64_t addr, void *dd, uint32_t time, int cpu) "addr: 0x%" PRIx64 ", dd: %p, time: %u, cpu: %d"
-mark_postcopy_blocktime_end(uint64_t addr, void *dd, uint32_t time, int affected_cpu) "addr: 0x%" PRIx64 ", dd: %p, time: %u, affected_cpu: %d"
+mark_postcopy_blocktime_begin(uint64_t addr, uint64_t time, int cpu) "addr: 0x%" PRIx64 ", time: %" PRIu64 ", cpu: %d"
+mark_postcopy_blocktime_end(uint64_t addr, uint64_t time, int affected_cpu) "addr: 0x%" PRIx64 ", time: %" PRIu64 ", affected_cpus: %d"
 postcopy_pause_fault_thread(void) ""
 postcopy_pause_fault_thread_continued(void) ""
 postcopy_pause_fast_load(void) ""

From 08fb2a933586183be788aac43c62b2993e0a99ce Mon Sep 17 00:00:00 2001
From: Peter Xu <peterx@redhat.com>
Date: Fri, 13 Jun 2025 10:12:08 -0400
Subject: [PATCH 2139/2760] migration/postcopy: Drop
 PostcopyBlocktimeContext.start_time

Now with 64bits, the offseting using start_time is not needed anymore,
because the array can always remember the whole timestamp.

Then drop the unused parameter in get_low_time_offset() altogether.

Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20250613141217.474825-6-peterx@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Fabiano Rosas <farosas@suse.de>
---
 migration/postcopy-ram.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/migration/postcopy-ram.c b/migration/postcopy-ram.c
index ec91821b85..e9acb4ef6e 100644
--- a/migration/postcopy-ram.c
+++ b/migration/postcopy-ram.c
@@ -123,7 +123,6 @@ typedef struct PostcopyBlocktimeContext {
     uint64_t last_begin;
     /* number of vCPU are suspended */
     int smp_cpus_down;
-    uint64_t start_time;
 
     /*
      * Handler for exit event, necessary for
@@ -157,7 +156,6 @@ static struct PostcopyBlocktimeContext *blocktime_context_new(void)
     ctx->vcpu_blocktime_total = g_new0(uint64_t, smp_cpus);
     ctx->vcpu_addr = g_new0(uintptr_t, smp_cpus);
     ctx->exit_notifier.notify = migration_exit_cb;
-    ctx->start_time = qemu_clock_get_ms(QEMU_CLOCK_REALTIME);
     qemu_add_exit_notifier(&ctx->exit_notifier);
 
     return ctx;
@@ -818,9 +816,9 @@ static int get_mem_fault_cpu_index(uint32_t pid)
     return -1;
 }
 
-static uint64_t get_low_time_offset(PostcopyBlocktimeContext *dc)
+static uint64_t get_low_time_offset(void)
 {
-    return (uint64_t)qemu_clock_get_ms(QEMU_CLOCK_REALTIME) - dc->start_time;
+    return (uint64_t)qemu_clock_get_ms(QEMU_CLOCK_REALTIME);
 }
 
 /*
@@ -847,7 +845,7 @@ void mark_postcopy_blocktime_begin(uintptr_t addr, uint32_t ptid,
         return;
     }
 
-    low_time_offset = get_low_time_offset(dc);
+    low_time_offset = get_low_time_offset();
     if (dc->vcpu_addr[cpu] == 0) {
         dc->smp_cpus_down++;
     }
@@ -907,7 +905,7 @@ static void mark_postcopy_blocktime_end(uintptr_t addr)
         return;
     }
 
-    low_time_offset = get_low_time_offset(dc);
+    low_time_offset = get_low_time_offset();
     /* lookup cpu, to clear it,
      * that algorithm looks straightforward, but it's not
      * optimal, more optimal algorithm is keeping tree or hash

From a098761f63e019b75a23575bb8d5a520c0dbce64 Mon Sep 17 00:00:00 2001
From: Peter Xu <peterx@redhat.com>
Date: Fri, 13 Jun 2025 10:12:09 -0400
Subject: [PATCH 2140/2760] migration/postcopy: Bring blocktime layer to ns
 level

With 64-bit fields, it is trivial.  The caution is when exposing any values
in QMP, it was still declared with milliseconds (ms).  Hence it's needed to
do the convertion when exporting the values to existing QMP queries.

Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20250613141217.474825-7-peterx@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Fabiano Rosas <farosas@suse.de>
---
 migration/postcopy-ram.c | 28 ++++++++++++++++------------
 1 file changed, 16 insertions(+), 12 deletions(-)

diff --git a/migration/postcopy-ram.c b/migration/postcopy-ram.c
index e9acb4ef6e..9dfa92a62d 100644
--- a/migration/postcopy-ram.c
+++ b/migration/postcopy-ram.c
@@ -110,6 +110,7 @@ void postcopy_thread_create(MigrationIncomingState *mis,
 #include <sys/eventfd.h>
 #include <linux/userfaultfd.h>
 
+/* All the time records are in unit of nanoseconds */
 typedef struct PostcopyBlocktimeContext {
     /* time when page fault initiated per vCPU */
     uint64_t *vcpu_blocktime_start;
@@ -168,7 +169,9 @@ static uint32List *get_vcpu_blocktime_list(PostcopyBlocktimeContext *ctx)
     int i;
 
     for (i = ms->smp.cpus - 1; i >= 0; i--) {
-        QAPI_LIST_PREPEND(list, (uint32_t)ctx->vcpu_blocktime_total[i]);
+        /* Convert ns -> ms */
+        QAPI_LIST_PREPEND(
+            list, (uint32_t)(ctx->vcpu_blocktime_total[i] / SCALE_MS));
     }
 
     return list;
@@ -191,7 +194,8 @@ void fill_destination_postcopy_migration_info(MigrationInfo *info)
     }
 
     info->has_postcopy_blocktime = true;
-    info->postcopy_blocktime = (uint32_t)bc->total_blocktime;
+    /* Convert ns -> ms */
+    info->postcopy_blocktime = (uint32_t)(bc->total_blocktime / SCALE_MS);
     info->has_postcopy_vcpu_blocktime = true;
     info->postcopy_vcpu_blocktime = get_vcpu_blocktime_list(bc);
 }
@@ -816,9 +820,9 @@ static int get_mem_fault_cpu_index(uint32_t pid)
     return -1;
 }
 
-static uint64_t get_low_time_offset(void)
+static uint64_t get_current_ns(void)
 {
-    return (uint64_t)qemu_clock_get_ms(QEMU_CLOCK_REALTIME);
+    return (uint64_t)qemu_clock_get_ns(QEMU_CLOCK_REALTIME);
 }
 
 /*
@@ -835,7 +839,7 @@ void mark_postcopy_blocktime_begin(uintptr_t addr, uint32_t ptid,
     int cpu;
     MigrationIncomingState *mis = migration_incoming_get_current();
     PostcopyBlocktimeContext *dc = mis->blocktime_ctx;
-    uint64_t low_time_offset;
+    uint64_t current;
 
     if (!dc || ptid == 0) {
         return;
@@ -845,13 +849,13 @@ void mark_postcopy_blocktime_begin(uintptr_t addr, uint32_t ptid,
         return;
     }
 
-    low_time_offset = get_low_time_offset();
+    current = get_current_ns();
     if (dc->vcpu_addr[cpu] == 0) {
         dc->smp_cpus_down++;
     }
 
-    dc->last_begin = low_time_offset;
-    dc->vcpu_blocktime_start[cpu] = low_time_offset;
+    dc->last_begin = current;
+    dc->vcpu_blocktime_start[cpu] = current;
     dc->vcpu_addr[cpu] = addr;
 
     /*
@@ -899,13 +903,13 @@ static void mark_postcopy_blocktime_end(uintptr_t addr)
     unsigned int smp_cpus = ms->smp.cpus;
     int i, affected_cpu = 0;
     bool vcpu_total_blocktime = false;
-    uint64_t read_vcpu_time, low_time_offset;
+    uint64_t read_vcpu_time, current;
 
     if (!dc) {
         return;
     }
 
-    low_time_offset = get_low_time_offset();
+    current = get_current_ns();
     /* lookup cpu, to clear it,
      * that algorithm looks straightforward, but it's not
      * optimal, more optimal algorithm is keeping tree or hash
@@ -918,7 +922,7 @@ static void mark_postcopy_blocktime_end(uintptr_t addr)
             continue;
         }
         dc->vcpu_addr[i] = 0;
-        vcpu_blocktime = low_time_offset - read_vcpu_time;
+        vcpu_blocktime = current - read_vcpu_time;
         affected_cpu += 1;
         /* we need to know is that mark_postcopy_end was due to
          * faulted page, another possible case it's prefetched
@@ -932,7 +936,7 @@ static void mark_postcopy_blocktime_end(uintptr_t addr)
 
     dc->smp_cpus_down -= affected_cpu;
     if (vcpu_total_blocktime) {
-        dc->total_blocktime += low_time_offset - dc->last_begin;
+        dc->total_blocktime += current - dc->last_begin;
     }
     trace_mark_postcopy_blocktime_end(addr, dc->total_blocktime,
                                       affected_cpu);

From 271a1940e91a32fab6165841279f250204f53ae4 Mon Sep 17 00:00:00 2001
From: Peter Xu <peterx@redhat.com>
Date: Fri, 13 Jun 2025 10:12:10 -0400
Subject: [PATCH 2141/2760] migration/postcopy: Add blocktime fault counts
 per-vcpu

Add a field to count how many remote faults one vCPU has taken.  So far
it's still not used, but will be soon.

Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20250613141217.474825-8-peterx@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Fabiano Rosas <farosas@suse.de>
---
 migration/postcopy-ram.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/migration/postcopy-ram.c b/migration/postcopy-ram.c
index 9dfa92a62d..15ea106910 100644
--- a/migration/postcopy-ram.c
+++ b/migration/postcopy-ram.c
@@ -116,6 +116,8 @@ typedef struct PostcopyBlocktimeContext {
     uint64_t *vcpu_blocktime_start;
     /* blocktime per vCPU */
     uint64_t *vcpu_blocktime_total;
+    /* count of faults per vCPU */
+    uint64_t *vcpu_faults_count;
     /* page address per vCPU */
     uintptr_t *vcpu_addr;
     /* total blocktime when all vCPUs are stopped */
@@ -136,6 +138,7 @@ static void destroy_blocktime_context(struct PostcopyBlocktimeContext *ctx)
 {
     g_free(ctx->vcpu_blocktime_start);
     g_free(ctx->vcpu_blocktime_total);
+    g_free(ctx->vcpu_faults_count);
     g_free(ctx->vcpu_addr);
     g_free(ctx);
 }
@@ -155,6 +158,7 @@ static struct PostcopyBlocktimeContext *blocktime_context_new(void)
 
     ctx->vcpu_blocktime_start = g_new0(uint64_t, smp_cpus);
     ctx->vcpu_blocktime_total = g_new0(uint64_t, smp_cpus);
+    ctx->vcpu_faults_count = g_new0(uint64_t, smp_cpus);
     ctx->vcpu_addr = g_new0(uintptr_t, smp_cpus);
     ctx->exit_notifier.notify = migration_exit_cb;
     qemu_add_exit_notifier(&ctx->exit_notifier);
@@ -857,6 +861,7 @@ void mark_postcopy_blocktime_begin(uintptr_t addr, uint32_t ptid,
     dc->last_begin = current;
     dc->vcpu_blocktime_start[cpu] = current;
     dc->vcpu_addr[cpu] = addr;
+    dc->vcpu_faults_count[cpu]++;
 
     /*
      * The caller should only inject a blocktime entry when the page is

From b4c82b428828c0ffff273a49f24a22cb4e18d485 Mon Sep 17 00:00:00 2001
From: Peter Xu <peterx@redhat.com>
Date: Fri, 13 Jun 2025 10:12:11 -0400
Subject: [PATCH 2142/2760] migration/postcopy: Report fault latencies in
 blocktime

Blocktime so far only cares about the time one vcpu (or the whole system)
got blocked.  It would be also be helpful if it can also report the latency
of page requests, which could be very sensitive during postcopy.

Blocktime itself is sometimes not very important, especially when one
thinks about KVM async PF support, which means vCPUs are literally almost
not blocked at all because the guest OS is smart enough to switch to
another task when a remote fault is needed.

However, latency is still sensitive and important because even if the guest
vCPU is running on threads that do not need a remote fault, the workload
that accesses some missing page is still affected.

Add two entries to the report, showing how long it takes to resolve a
remote fault.  Mention in the QAPI doc that this is not the real average
fault latency, but only the ones that was requested for a remote fault.

Unwrap get_vcpu_blocktime_list() so we don't need to walk the list twice,
meanwhile add the entry checks in qtests for all postcopy tests.

Cc: Markus Armbruster <armbru@redhat.com>
Cc: Dr. David Alan Gilbert <dave@treblig.org>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Tested-by: Mario Casquero <mcasquer@redhat.com>
Link: https://lore.kernel.org/r/20250613141217.474825-9-peterx@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Fabiano Rosas <farosas@suse.de>
---
 migration/migration-hmp-cmds.c        | 67 ++++++++++++++++++---------
 migration/postcopy-ram.c              | 49 +++++++++++++-------
 qapi/migration.json                   | 20 ++++++++
 tests/qtest/migration/migration-qmp.c |  3 ++
 4 files changed, 102 insertions(+), 37 deletions(-)

diff --git a/migration/migration-hmp-cmds.c b/migration/migration-hmp-cmds.c
index 867e017b32..8b3846dab5 100644
--- a/migration/migration-hmp-cmds.c
+++ b/migration/migration-hmp-cmds.c
@@ -52,6 +52,51 @@ static void migration_global_dump(Monitor *mon)
                    ms->clear_bitmap_shift);
 }
 
+static void migration_dump_blocktime(Monitor *mon, MigrationInfo *info)
+{
+    if (info->has_postcopy_blocktime) {
+        monitor_printf(mon, "Postcopy Blocktime (ms): %" PRIu32 "\n",
+                       info->postcopy_blocktime);
+    }
+
+    if (info->has_postcopy_vcpu_blocktime) {
+        uint32List *item = info->postcopy_vcpu_blocktime;
+        const char *sep = "";
+        int count = 0;
+
+        monitor_printf(mon, "Postcopy vCPU Blocktime (ms):\n [");
+
+        while (item) {
+            monitor_printf(mon, "%s%"PRIu32, sep, item->value);
+            item = item->next;
+            /* Each line 10 vcpu results, newline if there's more */
+            sep = ((++count % 10 == 0) && item) ? ",\n  " : ", ";
+        }
+        monitor_printf(mon, "]\n");
+    }
+
+    if (info->has_postcopy_latency) {
+        monitor_printf(mon, "Postcopy Latency (ns): %" PRIu64 "\n",
+                       info->postcopy_latency);
+    }
+
+    if (info->has_postcopy_vcpu_latency) {
+        uint64List *item = info->postcopy_vcpu_latency;
+        const char *sep = "";
+        int count = 0;
+
+        monitor_printf(mon, "Postcopy vCPU Latencies (ns):\n [");
+
+        while (item) {
+            monitor_printf(mon, "%s%"PRIu64, sep, item->value);
+            item = item->next;
+            /* Each line 10 vcpu results, newline if there's more */
+            sep = ((++count % 10 == 0) && item) ? ",\n  " : ", ";
+        }
+        monitor_printf(mon, "]\n");
+    }
+}
+
 void hmp_info_migrate(Monitor *mon, const QDict *qdict)
 {
     bool show_all = qdict_get_try_bool(qdict, "all", false);
@@ -202,27 +247,7 @@ void hmp_info_migrate(Monitor *mon, const QDict *qdict)
                        info->dirty_limit_ring_full_time);
     }
 
-    if (info->has_postcopy_blocktime) {
-        monitor_printf(mon, "Postcopy Blocktime (ms): %" PRIu32 "\n",
-                       info->postcopy_blocktime);
-    }
-
-    if (info->has_postcopy_vcpu_blocktime) {
-        uint32List *item = info->postcopy_vcpu_blocktime;
-        const char *sep = "";
-        int count = 0;
-
-        monitor_printf(mon, "Postcopy vCPU Blocktime (ms):\n [");
-
-        while (item) {
-            monitor_printf(mon, "%s%"PRIu32, sep, item->value);
-            item = item->next;
-            /* Each line 10 vcpu results, newline if there's more */
-            sep = ((++count % 10 == 0) && item) ? ",\n  " : ", ";
-        }
-        monitor_printf(mon, "]\n");
-    }
-
+    migration_dump_blocktime(mon, info);
 out:
     qapi_free_MigrationInfo(info);
 }
diff --git a/migration/postcopy-ram.c b/migration/postcopy-ram.c
index 15ea106910..fe940f89b9 100644
--- a/migration/postcopy-ram.c
+++ b/migration/postcopy-ram.c
@@ -166,21 +166,6 @@ static struct PostcopyBlocktimeContext *blocktime_context_new(void)
     return ctx;
 }
 
-static uint32List *get_vcpu_blocktime_list(PostcopyBlocktimeContext *ctx)
-{
-    MachineState *ms = MACHINE(qdev_get_machine());
-    uint32List *list = NULL;
-    int i;
-
-    for (i = ms->smp.cpus - 1; i >= 0; i--) {
-        /* Convert ns -> ms */
-        QAPI_LIST_PREPEND(
-            list, (uint32_t)(ctx->vcpu_blocktime_total[i] / SCALE_MS));
-    }
-
-    return list;
-}
-
 /*
  * This function just populates MigrationInfo from postcopy's
  * blocktime context. It will not populate MigrationInfo,
@@ -192,16 +177,48 @@ void fill_destination_postcopy_migration_info(MigrationInfo *info)
 {
     MigrationIncomingState *mis = migration_incoming_get_current();
     PostcopyBlocktimeContext *bc = mis->blocktime_ctx;
+    MachineState *ms = MACHINE(qdev_get_machine());
+    uint64_t latency_total = 0, faults = 0;
+    uint32List *list_blocktime = NULL;
+    uint64List *list_latency = NULL;
+    int i;
 
     if (!bc) {
         return;
     }
 
+    for (i = ms->smp.cpus - 1; i >= 0; i--) {
+        uint64_t latency, total, count;
+
+        /* Convert ns -> ms */
+        QAPI_LIST_PREPEND(list_blocktime,
+                          (uint32_t)(bc->vcpu_blocktime_total[i] / SCALE_MS));
+
+        /* The rest in nanoseconds */
+        total = bc->vcpu_blocktime_total[i];
+        latency_total += total;
+        count = bc->vcpu_faults_count[i];
+        faults += count;
+
+        if (count) {
+            latency = total / count;
+        } else {
+            /* No fault detected */
+            latency = 0;
+        }
+
+        QAPI_LIST_PREPEND(list_latency, latency);
+    }
+
     info->has_postcopy_blocktime = true;
     /* Convert ns -> ms */
     info->postcopy_blocktime = (uint32_t)(bc->total_blocktime / SCALE_MS);
     info->has_postcopy_vcpu_blocktime = true;
-    info->postcopy_vcpu_blocktime = get_vcpu_blocktime_list(bc);
+    info->postcopy_vcpu_blocktime = list_blocktime;
+    info->has_postcopy_latency = true;
+    info->postcopy_latency = faults ? (latency_total / faults) : 0;
+    info->has_postcopy_vcpu_latency = true;
+    info->postcopy_vcpu_latency = list_latency;
 }
 
 static uint64_t get_postcopy_total_blocktime(void)
diff --git a/qapi/migration.json b/qapi/migration.json
index e8a7d3b2a9..bb41dc0795 100644
--- a/qapi/migration.json
+++ b/qapi/migration.json
@@ -236,6 +236,17 @@
 #     This is only present when the postcopy-blocktime migration
 #     capability is enabled.  (Since 3.0)
 #
+# @postcopy-latency: average remote page fault latency (in ns).  Note that
+#     this doesn't include all faults, but only the ones that require a
+#     remote page request.  So it should be always bigger than the real
+#     average page fault latency. This is only present when the
+#     postcopy-blocktime migration capability is enabled.  (Since 10.1)
+#
+# @postcopy-vcpu-latency: average remote page fault latency per vCPU (in
+#     ns).  It has the same definition of @postcopy-latency, but instead
+#     this is the per-vCPU statistics.  This is only present when the
+#     postcopy-blocktime migration capability is enabled.  (Since 10.1)
+#
 # @socket-address: Only used for tcp, to know what the real port is
 #     (Since 4.0)
 #
@@ -260,6 +271,11 @@
 #     average memory load of the virtual CPU indirectly.  Note that
 #     zero means guest doesn't dirty memory.  (Since 8.1)
 #
+# Features:
+#
+# @unstable: Members @postcopy-latency, @postcopy-vcpu-latency are
+#     experimental.
+#
 # Since: 0.14
 ##
 { 'struct': 'MigrationInfo',
@@ -275,6 +291,10 @@
            '*blocked-reasons': ['str'],
            '*postcopy-blocktime': 'uint32',
            '*postcopy-vcpu-blocktime': ['uint32'],
+           '*postcopy-latency': {
+               'type': 'uint64', 'features': [ 'unstable' ] },
+           '*postcopy-vcpu-latency': {
+               'type': ['uint64'], 'features': [ 'unstable' ] },
            '*socket-address': ['SocketAddress'],
            '*dirty-limit-throttle-time-per-round': 'uint64',
            '*dirty-limit-ring-full-time': 'uint64'} }
diff --git a/tests/qtest/migration/migration-qmp.c b/tests/qtest/migration/migration-qmp.c
index fb59741b2c..1a5ab2d229 100644
--- a/tests/qtest/migration/migration-qmp.c
+++ b/tests/qtest/migration/migration-qmp.c
@@ -358,6 +358,9 @@ void read_blocktime(QTestState *who)
 
     rsp_return = migrate_query_not_failed(who);
     g_assert(qdict_haskey(rsp_return, "postcopy-blocktime"));
+    g_assert(qdict_haskey(rsp_return, "postcopy-vcpu-blocktime"));
+    g_assert(qdict_haskey(rsp_return, "postcopy-latency"));
+    g_assert(qdict_haskey(rsp_return, "postcopy-vcpu-latency"));
     qobject_unref(rsp_return);
 }
 

From f07f2a3092b70d407a009dae28b44ecc8fbcffb7 Mon Sep 17 00:00:00 2001
From: Peter Xu <peterx@redhat.com>
Date: Fri, 13 Jun 2025 10:12:12 -0400
Subject: [PATCH 2143/2760] migration/postcopy: Initialize blocktime context
 only until listen

Before this patch, the blocktime context can be created very early, because
postcopy_ram_supported_by_host() <- migrate_caps_check() can happen during
migration object init.

The trick here is the blocktime context needs system vCPU information,
which seems to be possible to change after that point.  I didn't verify it,
but it doesn't sound right.

Now move it out and initialize the context only when postcopy listen
starts.  That is already during a migration so it should be guaranteed the
vCPU topology can never change on both sides.

While at it, assert that the ctx isn't created instead this time; the old
"if" trick isn't needed when we're sure it will only happen once now.

Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20250613141217.474825-10-peterx@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Fabiano Rosas <farosas@suse.de>
---
 migration/postcopy-ram.c | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/migration/postcopy-ram.c b/migration/postcopy-ram.c
index fe940f89b9..dd3615663f 100644
--- a/migration/postcopy-ram.c
+++ b/migration/postcopy-ram.c
@@ -325,13 +325,13 @@ static bool ufd_check_and_apply(int ufd, MigrationIncomingState *mis,
     }
 
 #ifdef UFFD_FEATURE_THREAD_ID
+    /*
+     * Postcopy blocktime conditionally needs THREAD_ID feature (introduced
+     * to Linux in 2017). Always try to enable it when QEMU is compiled
+     * with such environment.
+     */
     if (UFFD_FEATURE_THREAD_ID & supported_features) {
         asked_features |= UFFD_FEATURE_THREAD_ID;
-        if (migrate_postcopy_blocktime()) {
-            if (!mis->blocktime_ctx) {
-                mis->blocktime_ctx = blocktime_context_new();
-            }
-        }
     }
 #endif
 
@@ -1239,6 +1239,11 @@ int postcopy_ram_incoming_setup(MigrationIncomingState *mis)
         return -1;
     }
 
+    if (migrate_postcopy_blocktime()) {
+        assert(mis->blocktime_ctx == NULL);
+        mis->blocktime_ctx = blocktime_context_new();
+    }
+
     /* Now an eventfd we use to tell the fault-thread to quit */
     mis->userfault_event_fd = eventfd(0, EFD_CLOEXEC);
     if (mis->userfault_event_fd == -1) {

From 28a185204ee9a4dd1b0da38c92f2d9326ca590d5 Mon Sep 17 00:00:00 2001
From: Peter Xu <peterx@redhat.com>
Date: Fri, 13 Jun 2025 10:12:13 -0400
Subject: [PATCH 2144/2760] migration/postcopy: Cache the tid->vcpu mapping for
 blocktime

Looking up the vCPU index for each fault can be expensive when there're
hundreds of vCPUs.  Provide a cache for tid->vcpu instead with a hash
table, then lookup from there.

When at it, add another counter to record how many non-vCPU faults it gets.
For example, the main thread can also access a guest page that was missing.
These kind of faults are not accounted by blocktime so far.

Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20250613141217.474825-11-peterx@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Fabiano Rosas <farosas@suse.de>
---
 migration/postcopy-ram.c | 68 ++++++++++++++++++++++++++++++++++------
 migration/trace-events   |  3 +-
 2 files changed, 59 insertions(+), 12 deletions(-)

diff --git a/migration/postcopy-ram.c b/migration/postcopy-ram.c
index dd3615663f..bf65d6035c 100644
--- a/migration/postcopy-ram.c
+++ b/migration/postcopy-ram.c
@@ -127,6 +127,17 @@ typedef struct PostcopyBlocktimeContext {
     /* number of vCPU are suspended */
     int smp_cpus_down;
 
+    /*
+     * Fast path for looking up vcpu_index from tid.  NOTE: this result
+     * only reflects the vcpu setup when postcopy is running.  It may not
+     * always match with the current vcpu setup because vcpus can be hot
+     * attached/detached after migration completes.  However this should be
+     * stable when blocktime is using the structure.
+     */
+    GHashTable *tid_to_vcpu_hash;
+    /* Count of non-vCPU faults.  This is only for debugging purpose. */
+    uint64_t non_vcpu_faults;
+
     /*
      * Handler for exit event, necessary for
      * releasing whole blocktime_ctx
@@ -136,6 +147,7 @@ typedef struct PostcopyBlocktimeContext {
 
 static void destroy_blocktime_context(struct PostcopyBlocktimeContext *ctx)
 {
+    g_hash_table_destroy(ctx->tid_to_vcpu_hash);
     g_free(ctx->vcpu_blocktime_start);
     g_free(ctx->vcpu_blocktime_total);
     g_free(ctx->vcpu_faults_count);
@@ -150,6 +162,36 @@ static void migration_exit_cb(Notifier *n, void *data)
     destroy_blocktime_context(ctx);
 }
 
+static GHashTable *blocktime_init_tid_to_vcpu_hash(void)
+{
+    /*
+     * TID as an unsigned int can be directly used as the key.  However,
+     * CPU index can NOT be directly used as value, because CPU index can
+     * be 0, which means NULL.  Then when lookup we can never know whether
+     * it's 0 or "not found".  Hence use an indirection for CPU index.
+     */
+    GHashTable *table = g_hash_table_new_full(g_direct_hash, g_direct_equal,
+                                              NULL, g_free);
+    CPUState *cpu;
+
+    /*
+     * Initialize the tid->cpu_id mapping for lookups.  The caller needs to
+     * make sure when reaching here the CPU topology is frozen and will be
+     * stable for the whole blocktime trapping period.
+     */
+    CPU_FOREACH(cpu) {
+        int *value = g_new(int, 1);
+
+        *value = cpu->cpu_index;
+        g_hash_table_insert(table,
+                            GUINT_TO_POINTER((uint32_t)cpu->thread_id),
+                            value);
+        trace_postcopy_blocktime_tid_cpu_map(cpu->cpu_index, cpu->thread_id);
+    }
+
+    return table;
+}
+
 static struct PostcopyBlocktimeContext *blocktime_context_new(void)
 {
     MachineState *ms = MACHINE(qdev_get_machine());
@@ -160,6 +202,8 @@ static struct PostcopyBlocktimeContext *blocktime_context_new(void)
     ctx->vcpu_blocktime_total = g_new0(uint64_t, smp_cpus);
     ctx->vcpu_faults_count = g_new0(uint64_t, smp_cpus);
     ctx->vcpu_addr = g_new0(uintptr_t, smp_cpus);
+    ctx->tid_to_vcpu_hash = blocktime_init_tid_to_vcpu_hash();
+
     ctx->exit_notifier.notify = migration_exit_cb;
     qemu_add_exit_notifier(&ctx->exit_notifier);
 
@@ -827,18 +871,21 @@ int postcopy_request_shared_page(struct PostCopyFD *pcfd, RAMBlock *rb,
     return 0;
 }
 
-static int get_mem_fault_cpu_index(uint32_t pid)
+static int blocktime_get_vcpu(PostcopyBlocktimeContext *ctx, uint32_t tid)
 {
-    CPUState *cpu_iter;
+    int *found;
 
-    CPU_FOREACH(cpu_iter) {
-        if (cpu_iter->thread_id == pid) {
-            trace_get_mem_fault_cpu_index(cpu_iter->cpu_index, pid);
-            return cpu_iter->cpu_index;
-        }
+    found = g_hash_table_lookup(ctx->tid_to_vcpu_hash, GUINT_TO_POINTER(tid));
+    if (!found) {
+        /*
+         * NOTE: this is possible, because QEMU's non-vCPU threads can
+         * also access a missing page.  Or, when KVM async pf is enabled, a
+         * fault can even happen from a kworker..
+         */
+        return -1;
     }
-    trace_get_mem_fault_cpu_index(-1, pid);
-    return -1;
+
+    return *found;
 }
 
 static uint64_t get_current_ns(void)
@@ -865,8 +912,9 @@ void mark_postcopy_blocktime_begin(uintptr_t addr, uint32_t ptid,
     if (!dc || ptid == 0) {
         return;
     }
-    cpu = get_mem_fault_cpu_index(ptid);
+    cpu = blocktime_get_vcpu(dc, ptid);
     if (cpu < 0) {
+        dc->non_vcpu_faults++;
         return;
     }
 
diff --git a/migration/trace-events b/migration/trace-events
index 02cdb6e7cc..9c1f3b7044 100644
--- a/migration/trace-events
+++ b/migration/trace-events
@@ -310,8 +310,7 @@ postcopy_preempt_tls_handshake(void) ""
 postcopy_preempt_new_channel(void) ""
 postcopy_preempt_thread_entry(void) ""
 postcopy_preempt_thread_exit(void) ""
-
-get_mem_fault_cpu_index(int cpu, uint32_t pid) "cpu: %d, pid: %u"
+postcopy_blocktime_tid_cpu_map(int cpu, uint32_t tid) "cpu: %d, tid: %u"
 
 # exec.c
 migration_exec_outgoing(const char *cmd) "cmd=%s"

From 4c8a1194852844a1fc07af804579c7cf997e5c4a Mon Sep 17 00:00:00 2001
From: Peter Xu <peterx@redhat.com>
Date: Fri, 13 Jun 2025 10:12:14 -0400
Subject: [PATCH 2145/2760] migration/postcopy: Cleanup the total blocktime
 accounting

The variable vcpu_total_blocktime isn't easy to follow.  In reality, it
wants to capture the case where all vCPUs are stopped, and now there will
be some vCPUs starts running.

The name now starts to conflict with vcpu_blocktime_total[], meanwhile it's
actually not necessary to have the variable at all: since nobody is
touching smp_cpus_down except ourselves, we can safely do the calculation
at the end before decrementing smp_cpus_down.

Hopefully this makes the logic easier to read, side benefit is we drop one
temp var.

Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20250613141217.474825-12-peterx@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Fabiano Rosas <farosas@suse.de>
---
 migration/postcopy-ram.c | 16 +++++++---------
 1 file changed, 7 insertions(+), 9 deletions(-)

diff --git a/migration/postcopy-ram.c b/migration/postcopy-ram.c
index bf65d6035c..fd6c0bdb1e 100644
--- a/migration/postcopy-ram.c
+++ b/migration/postcopy-ram.c
@@ -972,7 +972,6 @@ static void mark_postcopy_blocktime_end(uintptr_t addr)
     MachineState *ms = MACHINE(qdev_get_machine());
     unsigned int smp_cpus = ms->smp.cpus;
     int i, affected_cpu = 0;
-    bool vcpu_total_blocktime = false;
     uint64_t read_vcpu_time, current;
 
     if (!dc) {
@@ -994,20 +993,19 @@ static void mark_postcopy_blocktime_end(uintptr_t addr)
         dc->vcpu_addr[i] = 0;
         vcpu_blocktime = current - read_vcpu_time;
         affected_cpu += 1;
-        /* we need to know is that mark_postcopy_end was due to
-         * faulted page, another possible case it's prefetched
-         * page and in that case we shouldn't be here */
-        if (!vcpu_total_blocktime && dc->smp_cpus_down == smp_cpus) {
-            vcpu_total_blocktime = true;
-        }
         /* continue cycle, due to one page could affect several vCPUs */
         dc->vcpu_blocktime_total[i] += vcpu_blocktime;
     }
 
-    dc->smp_cpus_down -= affected_cpu;
-    if (vcpu_total_blocktime) {
+    /*
+     * If all vCPUs used to be down, and copying this page would free some
+     * vCPUs, then the system-level blocktime ends here.
+     */
+    if (dc->smp_cpus_down == smp_cpus && affected_cpu) {
         dc->total_blocktime += current - dc->last_begin;
     }
+    dc->smp_cpus_down -= affected_cpu;
+
     trace_mark_postcopy_blocktime_end(addr, dc->total_blocktime,
                                       affected_cpu);
 }

From b63a2e9e4b6dd779f7a699162ffdafc95e905c80 Mon Sep 17 00:00:00 2001
From: Peter Xu <peterx@redhat.com>
Date: Fri, 13 Jun 2025 10:12:15 -0400
Subject: [PATCH 2146/2760] migration/postcopy: Optimize blocktime fault
 tracking with hashtable

Currently, the postcopy blocktime feature maintains vCPU fault information
using an array (vcpu_addr[]).  It has two issues.

Issue 1: Performance Concern
============================

The old algorithm was almost OK and fast on inserts, except that the lookup
is slow and won't scale if there are a lot of vCPUs: when a page is copied
during postcopy, mark_postcopy_blocktime_end() will walk the whole array
trying to find which vCPUs are blocked by the address.  So it needs
constant O(N) walk for each page resolution.

Alexey (the author of postcopy blocktime) mentioned the perf issue and how
to optimize it in a piece of comment in the page resolution path.  The
comment was (interestingly..) not complete, but it's relatively clear what
he wanted to say about this perf issue.

Issue 2: Wrong Accounting on re-entrancies
==========================================

People might think that each vCPU should only and always get one fault at a
time, so that when the blocktime layer captured one fault on one vCPU, we
should never see another fault message on this vCPU.

It's almost correct, except in some extreme rare cases.

Case 1: it's possible the fault thread processes the userfaultfd messages
too fast so it can see >1 messages on one vCPU before the previous one was
resolved.

Case 2: it's theoretically also possible one vCPU can get even more than
one message on the same fault address if a fault is retried by the
kernel (e.g., handle_userfault() got interrupted before page resolution).

As this info might be important, instead of using commit message, I put
more details into the code as comment, when introducing an array
maintaining concurrent faults on one vCPU.  Please refer to the comments
for details on both cases, especially case 1 which can be tricky.

Case 1 sounds rare, but it can be easily reproduced locally for me when we
run blocktime together with the migration-test on the vanilla postcopy.

New Design
==========

This patch should do almost what Alexey mentioned, but slightly
differently: instead of having an array to maintain vCPU fault addresses,
for each of the fault message we push a message into a hash, indexed by the
fault address.

With the hash, it can replace the old two structs: both the vcpu_addr[]
array, and also the array to store the start time of the fault.  However
due to above we need one more counter array to account concurrent faults on
the same vCPU - that should even be needed in the old code, it's just that
the old code was buggy and it will blindly overwrite an existing
entry.. now we'll start to really track everything.

The hash structure might be more efficient than tree to maintain such
addr->(cpu, fault_time) information, so that the insert() and lookup()
paths should ideally both be ~O(1).  After all, we do not need to sort.

Here we need to do one remove() though after the lookup().  It could be
slow but only if many vCPUs faulted exactly on the same address (so when
the list of cpu entries is long), which should be unlikely. Even with that,
it's still a worst case O(N) (consider 400 vCPUs faulted on the same
address and how likely is it..) rather than a constant O(N) complexity.

When at it, touch up the tracepoints to make them slightly more useful.
One tracepoint is added when walking all the fault entries.

Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20250613141217.474825-13-peterx@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Fabiano Rosas <farosas@suse.de>
---
 migration/postcopy-ram.c | 265 +++++++++++++++++++++++++++++++--------
 migration/trace-events   |   5 +-
 2 files changed, 219 insertions(+), 51 deletions(-)

diff --git a/migration/postcopy-ram.c b/migration/postcopy-ram.c
index fd6c0bdb1e..91c23b446e 100644
--- a/migration/postcopy-ram.c
+++ b/migration/postcopy-ram.c
@@ -112,14 +112,69 @@ void postcopy_thread_create(MigrationIncomingState *mis,
 
 /* All the time records are in unit of nanoseconds */
 typedef struct PostcopyBlocktimeContext {
-    /* time when page fault initiated per vCPU */
-    uint64_t *vcpu_blocktime_start;
     /* blocktime per vCPU */
     uint64_t *vcpu_blocktime_total;
     /* count of faults per vCPU */
     uint64_t *vcpu_faults_count;
-    /* page address per vCPU */
-    uintptr_t *vcpu_addr;
+    /*
+     * count of currently blocked faults per vCPU.
+     *
+     * NOTE: Normally there should only be one fault in-progress per vCPU
+     * thread, so logically it _seems_ vcpu_faults_count[] for any vCPU
+     * should be either zero or one.  However, there can be reasons we see
+     * >1 faults on the same vCPU thread.
+     *
+     * CASE (1): since the process to resolve faults (ioctl(UFFDIO_COPY),
+     * for example) is done before taking the mutex that protects the
+     * blocktime context, it can happen that we read more than one faulted
+     * addresses per vCPU.
+     *
+     * One example when we can see >1 faulted addresses for one vCPU:
+     *
+     *  vcpu1 thread       fault thread         resolve thread
+     *  ============       ============         ==============
+     *
+     *  faulted on addr1
+     *                     read uffd msg (addr1)
+     *                     MUTEX_LOCK
+     *                     add entry (cpu1, addr1)
+     *                     MUTEX_UNLOCK
+     *                     request remote fault (addr1)
+     *                                          resolve fault (addr1)
+     *  addr1 resolved, continue..
+     *  faulted on addr2
+     *                     read uffd msg (addr2)
+     *                     MUTEX_LOCK
+     *                     add entry (cpu1, addr2) <--------------- [A]
+     *                     MUTEX_UNLOCK
+     *                                          MUTEX_LOCK
+     *                                          remove entry (cpu1, addr1)
+     *                                          MUTEX_UNLOCK
+     *
+     * In above case, we may see (cpu1, addr1) and (cpu1, addr2) entries to
+     * appear together at [A], when it gets the lock before the resolve
+     * thread.  Use this counter to maintain such case, and only when it
+     * reaches zero we know the vCPU is not blocked anymore.
+     *
+     * CASE (2): theoretically (the author admit to not have verified
+     * this..), one vCPU thread can also generate more than one userfaultfd
+     * message on the same address. It can happen e.g. for whatever reason
+     * the fault got retried before a resolution arrives. In that extremely
+     * rare case, we could also see two (cpu1, addr1) entries.
+     *
+     * In all cases, be prepared with such re-entrancies with this array.
+     *
+     * Using uint8_t should be far enough for now.  For example, when
+     * there're only one resolve thread (postcopy ram listening thread),
+     * the max (concurrent fault entries) should be two.
+     */
+    uint8_t *vcpu_faults_current;
+    /*
+     * The hash that contains addr1->[(cpu1,ts1),(cpu2,ts2) ...] mappings.
+     * Each of the entry is a tuple of (CPU index, fault timestamp) showing
+     * that a fault was requested.
+     */
+    GHashTable *vcpu_addr_hash;
     /* total blocktime when all vCPUs are stopped */
     uint64_t total_blocktime;
     /* point in time when last page fault was initiated */
@@ -145,13 +200,38 @@ typedef struct PostcopyBlocktimeContext {
     Notifier exit_notifier;
 } PostcopyBlocktimeContext;
 
+typedef struct {
+    /* The time the fault was triggered */
+    uint64_t fault_time;
+    /* The vCPU index that was blocked */
+    int cpu;
+} BlocktimeVCPUEntry;
+
+/* Alloc an entry to record a vCPU fault */
+static BlocktimeVCPUEntry *
+blocktime_vcpu_entry_alloc(int cpu, uint64_t fault_time)
+{
+    BlocktimeVCPUEntry *entry = g_new(BlocktimeVCPUEntry, 1);
+
+    entry->fault_time = fault_time;
+    entry->cpu = cpu;
+
+    return entry;
+}
+
+/* Free a @GList of @BlocktimeVCPUEntry */
+static void blocktime_vcpu_list_free(gpointer data)
+{
+    g_list_free_full(data, g_free);
+}
+
 static void destroy_blocktime_context(struct PostcopyBlocktimeContext *ctx)
 {
     g_hash_table_destroy(ctx->tid_to_vcpu_hash);
-    g_free(ctx->vcpu_blocktime_start);
+    g_hash_table_destroy(ctx->vcpu_addr_hash);
     g_free(ctx->vcpu_blocktime_total);
     g_free(ctx->vcpu_faults_count);
-    g_free(ctx->vcpu_addr);
+    g_free(ctx->vcpu_faults_current);
     g_free(ctx);
 }
 
@@ -198,12 +278,22 @@ static struct PostcopyBlocktimeContext *blocktime_context_new(void)
     unsigned int smp_cpus = ms->smp.cpus;
     PostcopyBlocktimeContext *ctx = g_new0(PostcopyBlocktimeContext, 1);
 
-    ctx->vcpu_blocktime_start = g_new0(uint64_t, smp_cpus);
     ctx->vcpu_blocktime_total = g_new0(uint64_t, smp_cpus);
     ctx->vcpu_faults_count = g_new0(uint64_t, smp_cpus);
-    ctx->vcpu_addr = g_new0(uintptr_t, smp_cpus);
+    ctx->vcpu_faults_current = g_new0(uint8_t, smp_cpus);
     ctx->tid_to_vcpu_hash = blocktime_init_tid_to_vcpu_hash();
 
+    /*
+     * The key (host virtual addresses) will always be gpointer-sized on
+     * either 32bits or 64bits systems, so it'll fit as a direct key.
+     *
+     * The value will be a list of BlocktimeVCPUEntry entries.
+     */
+    ctx->vcpu_addr_hash = g_hash_table_new_full(g_direct_hash,
+                                                g_direct_equal,
+                                                NULL,
+                                                blocktime_vcpu_list_free);
+
     ctx->exit_notifier.notify = migration_exit_cb;
     qemu_add_exit_notifier(&ctx->exit_notifier);
 
@@ -893,6 +983,39 @@ static uint64_t get_current_ns(void)
     return (uint64_t)qemu_clock_get_ns(QEMU_CLOCK_REALTIME);
 }
 
+/* Inject an (cpu, fault_time) entry into the database, using addr as key */
+static void blocktime_fault_inject(PostcopyBlocktimeContext *ctx,
+                                   uintptr_t addr, int cpu, uint64_t time)
+{
+    BlocktimeVCPUEntry *entry = blocktime_vcpu_entry_alloc(cpu, time);
+    GHashTable *table = ctx->vcpu_addr_hash;
+    gpointer key = (gpointer)addr;
+    GList *head, *list;
+    gboolean result;
+
+    head = g_hash_table_lookup(table, key);
+    if (head) {
+        /*
+         * If existed, steal the @head for list operation rather than
+         * freeing it, making sure steal succeeded.
+         */
+        result = g_hash_table_steal(table, key);
+        assert(result == TRUE);
+    }
+
+    /*
+     * Now the key is guaranteed to be absent.  Two cases:
+     *
+     * (1) There's no existing entry, list contains the only one. Insert.
+     * (2) There're existing entries, after stealing we own it, prepend the
+     *     result and re-insert.
+     */
+    list = g_list_prepend(head, entry);
+    g_hash_table_insert(table, key, list);
+
+    trace_postcopy_blocktime_begin(addr, time, cpu, !!head);
+}
+
 /*
  * This function is being called when pagefault occurs. It tracks down vCPU
  * blocking time.  It's protected by @page_request_mutex.
@@ -912,21 +1035,6 @@ void mark_postcopy_blocktime_begin(uintptr_t addr, uint32_t ptid,
     if (!dc || ptid == 0) {
         return;
     }
-    cpu = blocktime_get_vcpu(dc, ptid);
-    if (cpu < 0) {
-        dc->non_vcpu_faults++;
-        return;
-    }
-
-    current = get_current_ns();
-    if (dc->vcpu_addr[cpu] == 0) {
-        dc->smp_cpus_down++;
-    }
-
-    dc->last_begin = current;
-    dc->vcpu_blocktime_start[cpu] = current;
-    dc->vcpu_addr[cpu] = addr;
-    dc->vcpu_faults_count[cpu]++;
 
     /*
      * The caller should only inject a blocktime entry when the page is
@@ -934,8 +1042,67 @@ void mark_postcopy_blocktime_begin(uintptr_t addr, uint32_t ptid,
      */
     assert(!ramblock_recv_bitmap_test(rb, (void *)addr));
 
-    trace_mark_postcopy_blocktime_begin(addr, dc->vcpu_blocktime_start[cpu],
-                                        cpu);
+    current = get_current_ns();
+    cpu = blocktime_get_vcpu(dc, ptid);
+
+    if (cpu >= 0) {
+        /* How many faults on this vCPU in total? */
+        dc->vcpu_faults_count[cpu]++;
+
+        /*
+         * Account how many concurrent faults on this vCPU we trapped.  See
+         * comments above vcpu_faults_current[] on why it can be more than one.
+         */
+        if (dc->vcpu_faults_current[cpu]++ == 0) {
+            dc->smp_cpus_down++;
+            /*
+             * We use last_begin to cover (1) the 1st fault on this specific
+             * vCPU, but meanwhile (2) the last vCPU that got blocked.  It's
+             * only used to calculate system-wide blocktime.
+             */
+            dc->last_begin = current;
+        }
+
+        /* Making sure it won't overflow - it really should never! */
+        assert(dc->vcpu_faults_current[cpu] <= 255);
+    } else {
+        /* We do not support non-vCPU thread tracking yet */
+        dc->non_vcpu_faults++;
+        return;
+    }
+
+    blocktime_fault_inject(dc, addr, cpu, current);
+}
+
+typedef struct {
+    PostcopyBlocktimeContext *ctx;
+    uint64_t current;
+    int affected_cpus;
+} BlockTimeVCPUIter;
+
+static void blocktime_cpu_list_iter_fn(gpointer data, gpointer user_data)
+{
+    BlockTimeVCPUIter *iter = user_data;
+    PostcopyBlocktimeContext *ctx = iter->ctx;
+    BlocktimeVCPUEntry *entry = data;
+    int cpu = entry->cpu;
+
+    /*
+     * Time should never go back.. so when the fault is resolved it must be
+     * later than when it was faulted.
+     */
+    assert(iter->current >= entry->fault_time);
+
+    /*
+     * If we resolved all pending faults on one vCPU due to this page
+     * resolution, take a note.
+     */
+    if (--ctx->vcpu_faults_current[cpu] == 0) {
+        ctx->vcpu_blocktime_total[cpu] += iter->current - entry->fault_time;
+        iter->affected_cpus += 1;
+    }
+
+    trace_postcopy_blocktime_end_one(cpu, ctx->vcpu_faults_current[cpu]);
 }
 
 /*
@@ -971,43 +1138,43 @@ static void mark_postcopy_blocktime_end(uintptr_t addr)
     PostcopyBlocktimeContext *dc = mis->blocktime_ctx;
     MachineState *ms = MACHINE(qdev_get_machine());
     unsigned int smp_cpus = ms->smp.cpus;
-    int i, affected_cpu = 0;
-    uint64_t read_vcpu_time, current;
+    BlockTimeVCPUIter iter = {
+        .current = get_current_ns(),
+        .affected_cpus = 0,
+        .ctx = dc,
+    };
+    gpointer key = (gpointer)addr;
+    GHashTable *table;
+    GList *list;
 
     if (!dc) {
         return;
     }
 
-    current = get_current_ns();
-    /* lookup cpu, to clear it,
-     * that algorithm looks straightforward, but it's not
-     * optimal, more optimal algorithm is keeping tree or hash
-     * where key is address value is a list of  */
-    for (i = 0; i < smp_cpus; i++) {
-        uint64_t vcpu_blocktime = 0;
-
-        read_vcpu_time = dc->vcpu_blocktime_start[i];
-        if (dc->vcpu_addr[i] != addr || read_vcpu_time == 0) {
-            continue;
-        }
-        dc->vcpu_addr[i] = 0;
-        vcpu_blocktime = current - read_vcpu_time;
-        affected_cpu += 1;
-        /* continue cycle, due to one page could affect several vCPUs */
-        dc->vcpu_blocktime_total[i] += vcpu_blocktime;
+    table = dc->vcpu_addr_hash;
+    /* the address wasn't tracked at all? */
+    list = g_hash_table_lookup(table, key);
+    if (!list) {
+        return;
     }
 
+    /*
+     * Loop over the set of vCPUs that got blocked on this addr, do the
+     * blocktime accounting.  After that, remove the whole list.
+     */
+    g_list_foreach(list, blocktime_cpu_list_iter_fn, &iter);
+    g_hash_table_remove(table, key);
+
     /*
      * If all vCPUs used to be down, and copying this page would free some
      * vCPUs, then the system-level blocktime ends here.
      */
-    if (dc->smp_cpus_down == smp_cpus && affected_cpu) {
-        dc->total_blocktime += current - dc->last_begin;
+    if (dc->smp_cpus_down == smp_cpus && iter.affected_cpus) {
+        dc->total_blocktime += iter.current - dc->last_begin;
     }
-    dc->smp_cpus_down -= affected_cpu;
+    dc->smp_cpus_down -= iter.affected_cpus;
 
-    trace_mark_postcopy_blocktime_end(addr, dc->total_blocktime,
-                                      affected_cpu);
+    trace_postcopy_blocktime_end(addr, iter.current, iter.affected_cpus);
 }
 
 static void postcopy_pause_fault_thread(MigrationIncomingState *mis)
diff --git a/migration/trace-events b/migration/trace-events
index 9c1f3b7044..a36a78f01a 100644
--- a/migration/trace-events
+++ b/migration/trace-events
@@ -285,8 +285,6 @@ postcopy_nhp_range(const char *ramblock, void *host_addr, size_t offset, size_t
 postcopy_place_page(void *host_addr) "host=%p"
 postcopy_place_page_zero(void *host_addr) "host=%p"
 postcopy_ram_enable_notify(void) ""
-mark_postcopy_blocktime_begin(uint64_t addr, uint64_t time, int cpu) "addr: 0x%" PRIx64 ", time: %" PRIu64 ", cpu: %d"
-mark_postcopy_blocktime_end(uint64_t addr, uint64_t time, int affected_cpu) "addr: 0x%" PRIx64 ", time: %" PRIu64 ", affected_cpus: %d"
 postcopy_pause_fault_thread(void) ""
 postcopy_pause_fault_thread_continued(void) ""
 postcopy_pause_fast_load(void) ""
@@ -311,6 +309,9 @@ postcopy_preempt_new_channel(void) ""
 postcopy_preempt_thread_entry(void) ""
 postcopy_preempt_thread_exit(void) ""
 postcopy_blocktime_tid_cpu_map(int cpu, uint32_t tid) "cpu: %d, tid: %u"
+postcopy_blocktime_begin(uint64_t addr, uint64_t time, int cpu, bool exists) "addr: 0x%" PRIx64 ", time: %" PRIu64 ", cpu: %d, exist: %d"
+postcopy_blocktime_end(uint64_t addr, uint64_t time, int affected_cpu) "addr: 0x%" PRIx64 ", time: %" PRIu64 ", affected_cpus: %d"
+postcopy_blocktime_end_one(int cpu, uint8_t left_faults) "cpu: %d, left_faults: %" PRIu8
 
 # exec.c
 migration_exec_outgoing(const char *cmd) "cmd=%s"

From ed23a159763293e84d3562dedd731192b093b808 Mon Sep 17 00:00:00 2001
From: Peter Xu <peterx@redhat.com>
Date: Fri, 13 Jun 2025 10:12:16 -0400
Subject: [PATCH 2147/2760] migration/postcopy: blocktime allows track / report
 non-vCPU faults

When used to report page fault latencies, the blocktime feature can be
almost useless when KVM async page fault is enabled, because in most cases
such remote fault will kickoff async page faults, then it's not trackable
from blocktime layer.

After all these recent rewrites to blocktime layer, it's finally so easy to
also support tracking non-vCPU faults.  It'll be even faster if we could
always index fault records with TIDs, unfortunately we need to maintain the
blocktime API which report things in vCPU indexes.

Of course this can work not only for kworkers, but also any guest accesses
that may reach a missing page, for example, very likely when in the QEMU
main thread too (and all other threads whenever applicable).

In this case, we don't care about "how long the threads are blocked", but
we only care about "how long the fault will be resolved".

Cc: Markus Armbruster <armbru@redhat.com>
Cc: Dr. David Alan Gilbert <dave@treblig.org>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Tested-by: Mario Casquero <mcasquer@redhat.com>
Link: https://lore.kernel.org/r/20250613141217.474825-14-peterx@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Fabiano Rosas <farosas@suse.de>
---
 migration/migration-hmp-cmds.c        |  5 +++
 migration/postcopy-ram.c              | 64 +++++++++++++++++++++------
 migration/trace-events                |  2 +-
 qapi/migration.json                   | 12 ++++-
 tests/qtest/migration/migration-qmp.c |  1 +
 5 files changed, 67 insertions(+), 17 deletions(-)

diff --git a/migration/migration-hmp-cmds.c b/migration/migration-hmp-cmds.c
index 8b3846dab5..e1f9530520 100644
--- a/migration/migration-hmp-cmds.c
+++ b/migration/migration-hmp-cmds.c
@@ -80,6 +80,11 @@ static void migration_dump_blocktime(Monitor *mon, MigrationInfo *info)
                        info->postcopy_latency);
     }
 
+    if (info->has_postcopy_non_vcpu_latency) {
+        monitor_printf(mon, "Postcopy non-vCPU Latencies (ns): %" PRIu64 "\n",
+                       info->postcopy_non_vcpu_latency);
+    }
+
     if (info->has_postcopy_vcpu_latency) {
         uint64List *item = info->postcopy_vcpu_latency;
         const char *sep = "";
diff --git a/migration/postcopy-ram.c b/migration/postcopy-ram.c
index 91c23b446e..f4cb23b3e0 100644
--- a/migration/postcopy-ram.c
+++ b/migration/postcopy-ram.c
@@ -192,6 +192,8 @@ typedef struct PostcopyBlocktimeContext {
     GHashTable *tid_to_vcpu_hash;
     /* Count of non-vCPU faults.  This is only for debugging purpose. */
     uint64_t non_vcpu_faults;
+    /* total blocktime when a non-vCPU thread is stopped */
+    uint64_t non_vcpu_blocktime_total;
 
     /*
      * Handler for exit event, necessary for
@@ -203,7 +205,10 @@ typedef struct PostcopyBlocktimeContext {
 typedef struct {
     /* The time the fault was triggered */
     uint64_t fault_time;
-    /* The vCPU index that was blocked */
+    /*
+     * The vCPU index that was blocked, when cpu==-1, it means it's a
+     * fault from non-vCPU threads.
+     */
     int cpu;
 } BlocktimeVCPUEntry;
 
@@ -344,6 +349,12 @@ void fill_destination_postcopy_migration_info(MigrationInfo *info)
         QAPI_LIST_PREPEND(list_latency, latency);
     }
 
+    latency_total += bc->non_vcpu_blocktime_total;
+    faults += bc->non_vcpu_faults;
+
+    info->has_postcopy_non_vcpu_latency = true;
+    info->postcopy_non_vcpu_latency = bc->non_vcpu_faults ?
+        (bc->non_vcpu_blocktime_total / bc->non_vcpu_faults) : 0;
     info->has_postcopy_blocktime = true;
     /* Convert ns -> ms */
     info->postcopy_blocktime = (uint32_t)(bc->total_blocktime / SCALE_MS);
@@ -983,7 +994,10 @@ static uint64_t get_current_ns(void)
     return (uint64_t)qemu_clock_get_ns(QEMU_CLOCK_REALTIME);
 }
 
-/* Inject an (cpu, fault_time) entry into the database, using addr as key */
+/*
+ * Inject an (cpu, fault_time) entry into the database, using addr as key.
+ * When cpu==-1, it means it's a non-vCPU fault.
+ */
 static void blocktime_fault_inject(PostcopyBlocktimeContext *ctx,
                                    uintptr_t addr, int cpu, uint64_t time)
 {
@@ -1066,9 +1080,17 @@ void mark_postcopy_blocktime_begin(uintptr_t addr, uint32_t ptid,
         /* Making sure it won't overflow - it really should never! */
         assert(dc->vcpu_faults_current[cpu] <= 255);
     } else {
-        /* We do not support non-vCPU thread tracking yet */
+        /*
+         * For non-vCPU thread faults, we don't care about tid or cpu index
+         * or time the thread is blocked (e.g., a kworker trying to help
+         * KVM when async_pf=on is OK to be blocked and not affect guest
+         * responsiveness), but we care about latency.  Track it with
+         * cpu=-1.
+         *
+         * Note that this will NOT affect blocktime reports on vCPU being
+         * blocked, but only about system-wide latency reports.
+         */
         dc->non_vcpu_faults++;
-        return;
     }
 
     blocktime_fault_inject(dc, addr, cpu, current);
@@ -1078,6 +1100,7 @@ typedef struct {
     PostcopyBlocktimeContext *ctx;
     uint64_t current;
     int affected_cpus;
+    int affected_non_cpus;
 } BlockTimeVCPUIter;
 
 static void blocktime_cpu_list_iter_fn(gpointer data, gpointer user_data)
@@ -1085,6 +1108,7 @@ static void blocktime_cpu_list_iter_fn(gpointer data, gpointer user_data)
     BlockTimeVCPUIter *iter = user_data;
     PostcopyBlocktimeContext *ctx = iter->ctx;
     BlocktimeVCPUEntry *entry = data;
+    uint64_t time_passed;
     int cpu = entry->cpu;
 
     /*
@@ -1092,17 +1116,27 @@ static void blocktime_cpu_list_iter_fn(gpointer data, gpointer user_data)
      * later than when it was faulted.
      */
     assert(iter->current >= entry->fault_time);
+    time_passed = iter->current - entry->fault_time;
 
-    /*
-     * If we resolved all pending faults on one vCPU due to this page
-     * resolution, take a note.
-     */
-    if (--ctx->vcpu_faults_current[cpu] == 0) {
-        ctx->vcpu_blocktime_total[cpu] += iter->current - entry->fault_time;
-        iter->affected_cpus += 1;
+    if (cpu >= 0) {
+        /*
+         * If we resolved all pending faults on one vCPU due to this page
+         * resolution, take a note.
+         */
+        if (--ctx->vcpu_faults_current[cpu] == 0) {
+            ctx->vcpu_blocktime_total[cpu] += time_passed;
+            iter->affected_cpus += 1;
+        }
+        trace_postcopy_blocktime_end_one(cpu, ctx->vcpu_faults_current[cpu]);
+    } else {
+        iter->affected_non_cpus++;
+        ctx->non_vcpu_blocktime_total += time_passed;
+        /*
+         * We do not maintain how many pending non-vCPU faults because we
+         * do not care about blocktime, only latency.
+         */
+        trace_postcopy_blocktime_end_one(-1, 0);
     }
-
-    trace_postcopy_blocktime_end_one(cpu, ctx->vcpu_faults_current[cpu]);
 }
 
 /*
@@ -1141,6 +1175,7 @@ static void mark_postcopy_blocktime_end(uintptr_t addr)
     BlockTimeVCPUIter iter = {
         .current = get_current_ns(),
         .affected_cpus = 0,
+        .affected_non_cpus = 0,
         .ctx = dc,
     };
     gpointer key = (gpointer)addr;
@@ -1174,7 +1209,8 @@ static void mark_postcopy_blocktime_end(uintptr_t addr)
     }
     dc->smp_cpus_down -= iter.affected_cpus;
 
-    trace_postcopy_blocktime_end(addr, iter.current, iter.affected_cpus);
+    trace_postcopy_blocktime_end(addr, iter.current, iter.affected_cpus,
+                                 iter.affected_non_cpus);
 }
 
 static void postcopy_pause_fault_thread(MigrationIncomingState *mis)
diff --git a/migration/trace-events b/migration/trace-events
index a36a78f01a..706db97def 100644
--- a/migration/trace-events
+++ b/migration/trace-events
@@ -310,7 +310,7 @@ postcopy_preempt_thread_entry(void) ""
 postcopy_preempt_thread_exit(void) ""
 postcopy_blocktime_tid_cpu_map(int cpu, uint32_t tid) "cpu: %d, tid: %u"
 postcopy_blocktime_begin(uint64_t addr, uint64_t time, int cpu, bool exists) "addr: 0x%" PRIx64 ", time: %" PRIu64 ", cpu: %d, exist: %d"
-postcopy_blocktime_end(uint64_t addr, uint64_t time, int affected_cpu) "addr: 0x%" PRIx64 ", time: %" PRIu64 ", affected_cpus: %d"
+postcopy_blocktime_end(uint64_t addr, uint64_t time, int affected_cpu, int affected_non_cpus) "addr: 0x%" PRIx64 ", time: %" PRIu64 ", affected_cpus: %d, affected_non_cpus: %d"
 postcopy_blocktime_end_one(int cpu, uint8_t left_faults) "cpu: %d, left_faults: %" PRIu8
 
 # exec.c
diff --git a/qapi/migration.json b/qapi/migration.json
index bb41dc0795..66fb8ac74d 100644
--- a/qapi/migration.json
+++ b/qapi/migration.json
@@ -247,6 +247,12 @@
 #     this is the per-vCPU statistics.  This is only present when the
 #     postcopy-blocktime migration capability is enabled.  (Since 10.1)
 #
+# @postcopy-non-vcpu-latency: average remote page fault latency for all
+#     faults happend in non-vCPU threads (in ns).  It has the same
+#     definition of @postcopy-latency but this only provides statistics to
+#     non-vCPU faults.  This is only present when the postcopy-blocktime
+#     migration capability is enabled.  (Since 10.1)
+#
 # @socket-address: Only used for tcp, to know what the real port is
 #     (Since 4.0)
 #
@@ -273,8 +279,8 @@
 #
 # Features:
 #
-# @unstable: Members @postcopy-latency, @postcopy-vcpu-latency are
-#     experimental.
+# @unstable: Members @postcopy-latency, @postcopy-vcpu-latency,
+#     @postcopy-non-vcpu-latency are experimental.
 #
 # Since: 0.14
 ##
@@ -295,6 +301,8 @@
                'type': 'uint64', 'features': [ 'unstable' ] },
            '*postcopy-vcpu-latency': {
                'type': ['uint64'], 'features': [ 'unstable' ] },
+           '*postcopy-non-vcpu-latency': {
+               'type': 'uint64', 'features': [ 'unstable' ] },
            '*socket-address': ['SocketAddress'],
            '*dirty-limit-throttle-time-per-round': 'uint64',
            '*dirty-limit-ring-full-time': 'uint64'} }
diff --git a/tests/qtest/migration/migration-qmp.c b/tests/qtest/migration/migration-qmp.c
index 1a5ab2d229..67a67d4bd6 100644
--- a/tests/qtest/migration/migration-qmp.c
+++ b/tests/qtest/migration/migration-qmp.c
@@ -361,6 +361,7 @@ void read_blocktime(QTestState *who)
     g_assert(qdict_haskey(rsp_return, "postcopy-vcpu-blocktime"));
     g_assert(qdict_haskey(rsp_return, "postcopy-latency"));
     g_assert(qdict_haskey(rsp_return, "postcopy-vcpu-latency"));
+    g_assert(qdict_haskey(rsp_return, "postcopy-non-vcpu-latency"));
     qobject_unref(rsp_return);
 }
 

From 3345fb3b6d7f511c948bfb153b85b3cabb996231 Mon Sep 17 00:00:00 2001
From: Peter Xu <peterx@redhat.com>
Date: Fri, 13 Jun 2025 10:12:17 -0400
Subject: [PATCH 2148/2760] migration/postcopy: Add latency distribution report
 for blocktime

Add the latency distribution too for blocktime, using order-of-two buckets.
It accounts for all the faults, from either vCPU or non-vCPU threads.  With
prior rework, it's very easy to achieve by adding an array to account for
faults in each buckets.

Sample output for HMP (while for QMP it's simply an array):

Postcopy Latency Distribution:
  [     1 us -     2 us ]:          0
  [     2 us -     4 us ]:          0
  [     4 us -     8 us ]:          1
  [     8 us -    16 us ]:          2
  [    16 us -    32 us ]:          2
  [    32 us -    64 us ]:          3
  [    64 us -   128 us ]:      10169
  [   128 us -   256 us ]:      50151
  [   256 us -   512 us ]:      12876
  [   512 us -     1 ms ]:         97
  [     1 ms -     2 ms ]:         42
  [     2 ms -     4 ms ]:         44
  [     4 ms -     8 ms ]:         93
  [     8 ms -    16 ms ]:        138
  [    16 ms -    32 ms ]:          0
  [    32 ms -    65 ms ]:          0
  [    65 ms -   131 ms ]:          0
  [   131 ms -   262 ms ]:          0
  [   262 ms -   524 ms ]:          0
  [   524 ms -    1 sec ]:          0
  [    1 sec -    2 sec ]:          0
  [    2 sec -    4 sec ]:          0
  [    4 sec -    8 sec ]:          0
  [    8 sec -   16 sec ]:          0

Cc: Markus Armbruster <armbru@redhat.com>
Acked-by: Dr. David Alan Gilbert <dave@treblig.org>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20250613141217.474825-15-peterx@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Fabiano Rosas <farosas@suse.de>
---
 migration/migration-hmp-cmds.c        | 32 +++++++++++++++++++
 migration/postcopy-ram.c              | 46 +++++++++++++++++++++++++++
 qapi/migration.json                   | 12 ++++++-
 tests/qtest/migration/migration-qmp.c |  1 +
 4 files changed, 90 insertions(+), 1 deletion(-)

diff --git a/migration/migration-hmp-cmds.c b/migration/migration-hmp-cmds.c
index e1f9530520..cef5608210 100644
--- a/migration/migration-hmp-cmds.c
+++ b/migration/migration-hmp-cmds.c
@@ -52,6 +52,21 @@ static void migration_global_dump(Monitor *mon)
                    ms->clear_bitmap_shift);
 }
 
+static const gchar *format_time_str(uint64_t us)
+{
+    const char *units[] = {"us", "ms", "sec"};
+    int index = 0;
+
+    while (us > 1000) {
+        us /= 1000;
+        if (++index >= (sizeof(units) - 1)) {
+            break;
+        }
+    }
+
+    return g_strdup_printf("%"PRIu64" %s", us, units[index]);
+}
+
 static void migration_dump_blocktime(Monitor *mon, MigrationInfo *info)
 {
     if (info->has_postcopy_blocktime) {
@@ -100,6 +115,23 @@ static void migration_dump_blocktime(Monitor *mon, MigrationInfo *info)
         }
         monitor_printf(mon, "]\n");
     }
+
+    if (info->has_postcopy_latency_dist) {
+        uint64List *item = info->postcopy_latency_dist;
+        int count = 0;
+
+        monitor_printf(mon, "Postcopy Latency Distribution:\n");
+
+        while (item) {
+            g_autofree const gchar *from = format_time_str(1UL << count);
+            g_autofree const gchar *to = format_time_str(1UL << (count + 1));
+
+            monitor_printf(mon, "  [ %8s - %8s ]: %10"PRIu64"\n",
+                           from, to, item->value);
+            item = item->next;
+            count++;
+        }
+    }
 }
 
 void hmp_info_migrate(Monitor *mon, const QDict *qdict)
diff --git a/migration/postcopy-ram.c b/migration/postcopy-ram.c
index f4cb23b3e0..45af9a361e 100644
--- a/migration/postcopy-ram.c
+++ b/migration/postcopy-ram.c
@@ -110,6 +110,15 @@ void postcopy_thread_create(MigrationIncomingState *mis,
 #include <sys/eventfd.h>
 #include <linux/userfaultfd.h>
 
+/*
+ * Here we use 24 buckets, which means the last bucket will cover [2^24 us,
+ * 2^25 us) ~= [16, 32) seconds.  It should be far enough to record even
+ * extreme (perf-wise broken) 1G pages moving over, which can sometimes
+ * take a few seconds due to various reasons.  Anything more than that
+ * might be unsensible to account anymore.
+ */
+#define  BLOCKTIME_LATENCY_BUCKET_N  (24)
+
 /* All the time records are in unit of nanoseconds */
 typedef struct PostcopyBlocktimeContext {
     /* blocktime per vCPU */
@@ -175,6 +184,11 @@ typedef struct PostcopyBlocktimeContext {
      * that a fault was requested.
      */
     GHashTable *vcpu_addr_hash;
+    /*
+     * Each bucket stores the count of faults that were resolved within the
+     * bucket window [2^N us, 2^(N+1) us).
+     */
+    uint64_t latency_buckets[BLOCKTIME_LATENCY_BUCKET_N];
     /* total blocktime when all vCPUs are stopped */
     uint64_t total_blocktime;
     /* point in time when last page fault was initiated */
@@ -283,6 +297,9 @@ static struct PostcopyBlocktimeContext *blocktime_context_new(void)
     unsigned int smp_cpus = ms->smp.cpus;
     PostcopyBlocktimeContext *ctx = g_new0(PostcopyBlocktimeContext, 1);
 
+    /* Initialize all counters to be zeros */
+    memset(ctx->latency_buckets, 0, sizeof(ctx->latency_buckets));
+
     ctx->vcpu_blocktime_total = g_new0(uint64_t, smp_cpus);
     ctx->vcpu_faults_count = g_new0(uint64_t, smp_cpus);
     ctx->vcpu_faults_current = g_new0(uint8_t, smp_cpus);
@@ -320,6 +337,7 @@ void fill_destination_postcopy_migration_info(MigrationInfo *info)
     uint64_t latency_total = 0, faults = 0;
     uint32List *list_blocktime = NULL;
     uint64List *list_latency = NULL;
+    uint64List *latency_buckets = NULL;
     int i;
 
     if (!bc) {
@@ -349,6 +367,10 @@ void fill_destination_postcopy_migration_info(MigrationInfo *info)
         QAPI_LIST_PREPEND(list_latency, latency);
     }
 
+    for (i = BLOCKTIME_LATENCY_BUCKET_N - 1; i >= 0; i--) {
+        QAPI_LIST_PREPEND(latency_buckets, bc->latency_buckets[i]);
+    }
+
     latency_total += bc->non_vcpu_blocktime_total;
     faults += bc->non_vcpu_faults;
 
@@ -364,6 +386,8 @@ void fill_destination_postcopy_migration_info(MigrationInfo *info)
     info->postcopy_latency = faults ? (latency_total / faults) : 0;
     info->has_postcopy_vcpu_latency = true;
     info->postcopy_vcpu_latency = list_latency;
+    info->has_postcopy_latency_dist = true;
+    info->postcopy_latency_dist = latency_buckets;
 }
 
 static uint64_t get_postcopy_total_blocktime(void)
@@ -1096,6 +1120,25 @@ void mark_postcopy_blocktime_begin(uintptr_t addr, uint32_t ptid,
     blocktime_fault_inject(dc, addr, cpu, current);
 }
 
+static void blocktime_latency_account(PostcopyBlocktimeContext *ctx,
+                                      uint64_t time_us)
+{
+    /*
+     * Convert time (in us) to bucket index it belongs.  Take extra caution
+     * of time_us==0 even if normally rare - when happens put into bucket 0.
+     */
+    int index = time_us ? (63 - clz64(time_us)) : 0;
+
+    assert(index >= 0);
+
+    /* If it's too large, put into top bucket */
+    if (index >= BLOCKTIME_LATENCY_BUCKET_N) {
+        index = BLOCKTIME_LATENCY_BUCKET_N - 1;
+    }
+
+    ctx->latency_buckets[index]++;
+}
+
 typedef struct {
     PostcopyBlocktimeContext *ctx;
     uint64_t current;
@@ -1118,6 +1161,9 @@ static void blocktime_cpu_list_iter_fn(gpointer data, gpointer user_data)
     assert(iter->current >= entry->fault_time);
     time_passed = iter->current - entry->fault_time;
 
+    /* Latency buckets are in microseconds */
+    blocktime_latency_account(ctx, time_passed / SCALE_US);
+
     if (cpu >= 0) {
         /*
          * If we resolved all pending faults on one vCPU due to this page
diff --git a/qapi/migration.json b/qapi/migration.json
index 66fb8ac74d..2d39a8f748 100644
--- a/qapi/migration.json
+++ b/qapi/migration.json
@@ -242,6 +242,14 @@
 #     average page fault latency. This is only present when the
 #     postcopy-blocktime migration capability is enabled.  (Since 10.1)
 #
+# @postcopy-latency-dist: remote page fault latency distributions.  Each
+#     element of the array is the number of faults that fall into the
+#     bucket period.  For the N-th bucket (N>=0), the latency window is
+#     [2^Nus, 2^(N+1)us).  For example, the 8th element stores how many
+#     remote faults got resolved within [256us, 512us) window. This is only
+#     present when the postcopy-blocktime migration capability is enabled.
+#     (Since 10.1)
+#
 # @postcopy-vcpu-latency: average remote page fault latency per vCPU (in
 #     ns).  It has the same definition of @postcopy-latency, but instead
 #     this is the per-vCPU statistics.  This is only present when the
@@ -280,7 +288,7 @@
 # Features:
 #
 # @unstable: Members @postcopy-latency, @postcopy-vcpu-latency,
-#     @postcopy-non-vcpu-latency are experimental.
+#     @postcopy-latency-dist, @postcopy-non-vcpu-latency are experimental.
 #
 # Since: 0.14
 ##
@@ -299,6 +307,8 @@
            '*postcopy-vcpu-blocktime': ['uint32'],
            '*postcopy-latency': {
                'type': 'uint64', 'features': [ 'unstable' ] },
+           '*postcopy-latency-dist': {
+               'type': ['uint64'], 'features': [ 'unstable' ] },
            '*postcopy-vcpu-latency': {
                'type': ['uint64'], 'features': [ 'unstable' ] },
            '*postcopy-non-vcpu-latency': {
diff --git a/tests/qtest/migration/migration-qmp.c b/tests/qtest/migration/migration-qmp.c
index 67a67d4bd6..66dd369ba7 100644
--- a/tests/qtest/migration/migration-qmp.c
+++ b/tests/qtest/migration/migration-qmp.c
@@ -360,6 +360,7 @@ void read_blocktime(QTestState *who)
     g_assert(qdict_haskey(rsp_return, "postcopy-blocktime"));
     g_assert(qdict_haskey(rsp_return, "postcopy-vcpu-blocktime"));
     g_assert(qdict_haskey(rsp_return, "postcopy-latency"));
+    g_assert(qdict_haskey(rsp_return, "postcopy-latency-dist"));
     g_assert(qdict_haskey(rsp_return, "postcopy-vcpu-latency"));
     g_assert(qdict_haskey(rsp_return, "postcopy-non-vcpu-latency"));
     qobject_unref(rsp_return);

From beeac2df5ff0850299e58f4ad27f83dae64c54df Mon Sep 17 00:00:00 2001
From: Juraj Marcin <jmarcin@redhat.com>
Date: Thu, 26 Jun 2025 10:52:32 +0200
Subject: [PATCH 2149/2760] migration: Rename save_live_complete_precopy_thread
 to save_complete_precopy_thread
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Recent patch [1] renames the save_live_complete_precopy handler to
save_complete, as the machine is not live in most cases when this
handler is executed. The same is true also for
save_live_complete_precopy_thread, therefore this patch removes the
"live" keyword from the handler itself and related types to keep the
naming unified.

In contrast to save_complete, this handler is only executed at the end
of precopy, therefore the "precopy" keyword is retained.

[1]: https://lore.kernel.org/all/20250613140801.474264-7-peterx@redhat.com/

Cc: Alex Williamson <alex.williamson@redhat.com>
Cc: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Juraj Marcin <jmarcin@redhat.com>
Link: https://lore.kernel.org/r/20250626085235.294690-1-jmarcin@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Fabiano Rosas <farosas@suse.de>
---
 docs/devel/migration/vfio.rst    |  4 ++--
 hw/vfio/migration-multifd.c      |  4 ++--
 hw/vfio/migration-multifd.h      |  2 +-
 hw/vfio/migration.c              |  2 +-
 include/migration/misc.h         |  8 ++++----
 include/migration/register.h     |  6 +++---
 include/qemu/typedefs.h          |  6 +++---
 migration/multifd-device-state.c | 10 +++++-----
 migration/savevm.c               |  6 +++---
 9 files changed, 24 insertions(+), 24 deletions(-)

diff --git a/docs/devel/migration/vfio.rst b/docs/devel/migration/vfio.rst
index 8ff5ab0c74..2d8e5ca9dd 100644
--- a/docs/devel/migration/vfio.rst
+++ b/docs/devel/migration/vfio.rst
@@ -80,7 +80,7 @@ VFIO implements the device hooks for the iterative approach as follows:
   vendor driver indicates that no data remains.  In the multifd mode it
   just emits a dummy EOS marker.
 
-* A ``save_live_complete_precopy_thread`` function that in the multifd mode
+* A ``save_complete_precopy_thread`` function that in the multifd mode
   provides thread handler performing multifd device state transfer.
   It sets the VFIO device to _STOP_COPY state, iteratively reads the data
   from the VFIO device and queues it for multifd transmission until the vendor
@@ -200,7 +200,7 @@ Live migration save path
                              .save_complete() until
                                pending data is 0
 	          In the multifd mode this iteration is done in
-	          .save_live_complete_precopy_thread() instead.
+	          .save_complete_precopy_thread() instead.
                                       |
                      (POSTMIGRATE, _COMPLETED, _STOP_COPY)
             Migraton thread schedules cleanup bottom half and exits
diff --git a/hw/vfio/migration-multifd.c b/hw/vfio/migration-multifd.c
index 850a319488..55635486c8 100644
--- a/hw/vfio/migration-multifd.c
+++ b/hw/vfio/migration-multifd.c
@@ -583,7 +583,7 @@ vfio_save_complete_precopy_thread_config_state(VFIODevice *vbasedev,
 
 /*
  * This thread is spawned by the migration core directly via
- * .save_live_complete_precopy_thread SaveVMHandler.
+ * .save_complete_precopy_thread SaveVMHandler.
  *
  * It exits after either:
  * * completing saving the remaining device state and device config, OR:
@@ -592,7 +592,7 @@ vfio_save_complete_precopy_thread_config_state(VFIODevice *vbasedev,
  *   multifd_device_state_save_thread_should_exit() returning true.
  */
 bool
-vfio_multifd_save_complete_precopy_thread(SaveLiveCompletePrecopyThreadData *d,
+vfio_multifd_save_complete_precopy_thread(SaveCompletePrecopyThreadData *d,
                                           Error **errp)
 {
     VFIODevice *vbasedev = d->handler_opaque;
diff --git a/hw/vfio/migration-multifd.h b/hw/vfio/migration-multifd.h
index 0bab63211d..ebf22a7997 100644
--- a/hw/vfio/migration-multifd.h
+++ b/hw/vfio/migration-multifd.h
@@ -26,7 +26,7 @@ bool vfio_multifd_load_state_buffer(void *opaque, char *data, size_t data_size,
 void vfio_multifd_emit_dummy_eos(VFIODevice *vbasedev, QEMUFile *f);
 
 bool
-vfio_multifd_save_complete_precopy_thread(SaveLiveCompletePrecopyThreadData *d,
+vfio_multifd_save_complete_precopy_thread(SaveCompletePrecopyThreadData *d,
                                           Error **errp);
 
 int vfio_multifd_switchover_start(VFIODevice *vbasedev);
diff --git a/hw/vfio/migration.c b/hw/vfio/migration.c
index 33a71f8999..c329578eec 100644
--- a/hw/vfio/migration.c
+++ b/hw/vfio/migration.c
@@ -835,7 +835,7 @@ static const SaveVMHandlers savevm_vfio_handlers = {
      */
     .load_state_buffer = vfio_multifd_load_state_buffer,
     .switchover_start = vfio_switchover_start,
-    .save_live_complete_precopy_thread = vfio_multifd_save_complete_precopy_thread,
+    .save_complete_precopy_thread = vfio_multifd_save_complete_precopy_thread,
 };
 
 /* ---------------------------------------------------------------------- */
diff --git a/include/migration/misc.h b/include/migration/misc.h
index 8fd36eba1d..a261f99d89 100644
--- a/include/migration/misc.h
+++ b/include/migration/misc.h
@@ -119,19 +119,19 @@ bool migrate_uri_parse(const char *uri, MigrationChannel **channel,
                        Error **errp);
 
 /* migration/multifd-device-state.c */
-typedef struct SaveLiveCompletePrecopyThreadData {
-    SaveLiveCompletePrecopyThreadHandler hdlr;
+typedef struct SaveCompletePrecopyThreadData {
+    SaveCompletePrecopyThreadHandler hdlr;
     char *idstr;
     uint32_t instance_id;
     void *handler_opaque;
-} SaveLiveCompletePrecopyThreadData;
+} SaveCompletePrecopyThreadData;
 
 bool multifd_queue_device_state(char *idstr, uint32_t instance_id,
                                 char *data, size_t len);
 bool multifd_device_state_supported(void);
 
 void
-multifd_spawn_device_state_save_thread(SaveLiveCompletePrecopyThreadHandler hdlr,
+multifd_spawn_device_state_save_thread(SaveCompletePrecopyThreadHandler hdlr,
                                        char *idstr, uint32_t instance_id,
                                        void *opaque);
 
diff --git a/include/migration/register.h b/include/migration/register.h
index 2a26e76a68..ae79794cdd 100644
--- a/include/migration/register.h
+++ b/include/migration/register.h
@@ -98,7 +98,7 @@ typedef struct SaveVMHandlers {
     int (*save_complete)(QEMUFile *f, void *opaque);
 
     /**
-     * @save_live_complete_precopy_thread (invoked in a separate thread)
+     * @save_complete_precopy_thread (invoked in a separate thread)
      *
      * Called at the end of a precopy phase from a separate worker thread
      * in configurations where multifd device state transfer is supported
@@ -107,14 +107,14 @@ typedef struct SaveVMHandlers {
      * When postcopy is enabled, devices that support postcopy will skip this
      * step.
      *
-     * @d: a #SaveLiveCompletePrecopyThreadData containing parameters that the
+     * @d: a #SaveCompletePrecopyThreadData containing parameters that the
      * handler may need, including this device section idstr and instance_id,
      * and opaque data pointer passed to register_savevm_live().
      * @errp: pointer to Error*, to store an error if it happens.
      *
      * Returns true to indicate success and false for errors.
      */
-    SaveLiveCompletePrecopyThreadHandler save_live_complete_precopy_thread;
+    SaveCompletePrecopyThreadHandler save_complete_precopy_thread;
 
     /* This runs both outside and inside the BQL.  */
 
diff --git a/include/qemu/typedefs.h b/include/qemu/typedefs.h
index 507f0814d5..4a94af9665 100644
--- a/include/qemu/typedefs.h
+++ b/include/qemu/typedefs.h
@@ -109,7 +109,7 @@ typedef struct QString QString;
 typedef struct RAMBlock RAMBlock;
 typedef struct Range Range;
 typedef struct ReservedRegion ReservedRegion;
-typedef struct SaveLiveCompletePrecopyThreadData SaveLiveCompletePrecopyThreadData;
+typedef struct SaveCompletePrecopyThreadData SaveCompletePrecopyThreadData;
 typedef struct SHPCDevice SHPCDevice;
 typedef struct SSIBus SSIBus;
 typedef struct TCGCPUOps TCGCPUOps;
@@ -135,7 +135,7 @@ typedef struct IRQState *qemu_irq;
 typedef void (*qemu_irq_handler)(void *opaque, int n, int level);
 typedef bool (*MigrationLoadThread)(void *opaque, bool *should_quit,
                                     Error **errp);
-typedef bool (*SaveLiveCompletePrecopyThreadHandler)(SaveLiveCompletePrecopyThreadData *d,
-                                                     Error **errp);
+typedef bool (*SaveCompletePrecopyThreadHandler)(SaveCompletePrecopyThreadData *d,
+                                                 Error **errp);
 
 #endif /* QEMU_TYPEDEFS_H */
diff --git a/migration/multifd-device-state.c b/migration/multifd-device-state.c
index 94222d0eb0..fce64f00b0 100644
--- a/migration/multifd-device-state.c
+++ b/migration/multifd-device-state.c
@@ -131,7 +131,7 @@ bool multifd_device_state_supported(void)
 
 static void multifd_device_state_save_thread_data_free(void *opaque)
 {
-    SaveLiveCompletePrecopyThreadData *data = opaque;
+    SaveCompletePrecopyThreadData *data = opaque;
 
     g_clear_pointer(&data->idstr, g_free);
     g_free(data);
@@ -139,7 +139,7 @@ static void multifd_device_state_save_thread_data_free(void *opaque)
 
 static int multifd_device_state_save_thread(void *opaque)
 {
-    SaveLiveCompletePrecopyThreadData *data = opaque;
+    SaveCompletePrecopyThreadData *data = opaque;
     g_autoptr(Error) local_err = NULL;
 
     if (!data->hdlr(data, &local_err)) {
@@ -170,18 +170,18 @@ bool multifd_device_state_save_thread_should_exit(void)
 }
 
 void
-multifd_spawn_device_state_save_thread(SaveLiveCompletePrecopyThreadHandler hdlr,
+multifd_spawn_device_state_save_thread(SaveCompletePrecopyThreadHandler hdlr,
                                        char *idstr, uint32_t instance_id,
                                        void *opaque)
 {
-    SaveLiveCompletePrecopyThreadData *data;
+    SaveCompletePrecopyThreadData *data;
 
     assert(multifd_device_state_supported());
     assert(multifd_send_device_state);
 
     assert(!qatomic_read(&multifd_send_device_state->threads_abort));
 
-    data = g_new(SaveLiveCompletePrecopyThreadData, 1);
+    data = g_new(SaveCompletePrecopyThreadData, 1);
     data->hdlr = hdlr;
     data->idstr = g_strdup(idstr);
     data->instance_id = instance_id;
diff --git a/migration/savevm.c b/migration/savevm.c
index c4fd5f5a5b..fabbeb296a 100644
--- a/migration/savevm.c
+++ b/migration/savevm.c
@@ -1581,15 +1581,15 @@ int qemu_savevm_state_complete_precopy_iterable(QEMUFile *f, bool in_postcopy)
 
     if (multifd_device_state) {
         QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
-            SaveLiveCompletePrecopyThreadHandler hdlr;
+            SaveCompletePrecopyThreadHandler hdlr;
 
             if (!se->ops || (in_postcopy && se->ops->has_postcopy &&
                              se->ops->has_postcopy(se->opaque)) ||
-                !se->ops->save_live_complete_precopy_thread) {
+                !se->ops->save_complete_precopy_thread) {
                 continue;
             }
 
-            hdlr = se->ops->save_live_complete_precopy_thread;
+            hdlr = se->ops->save_complete_precopy_thread;
             multifd_spawn_device_state_save_thread(hdlr,
                                                    se->idstr, se->instance_id,
                                                    se->opaque);

From c86da2b1dd7589d414b5a2d1e5361d6c3b4ca885 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 10 Jul 2025 16:42:47 -0600
Subject: [PATCH 2150/2760] tcg: Use uintptr_t in tcg_malloc implementation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Avoid ubsan failure with clang-20,
  tcg.h:715:19: runtime error: applying non-zero offset 64 to null pointer
by not using pointers.

Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/tcg/tcg.h | 6 +++---
 tcg/tcg.c         | 9 +++++----
 2 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
index 125323f153..0c2a319c11 100644
--- a/include/tcg/tcg.h
+++ b/include/tcg/tcg.h
@@ -357,7 +357,7 @@ static inline TCGRegSet output_pref(const TCGOp *op, unsigned i)
 }
 
 struct TCGContext {
-    uint8_t *pool_cur, *pool_end;
+    uintptr_t pool_cur, pool_end;
     TCGPool *pool_first, *pool_current, *pool_first_large;
     int nb_labels;
     int nb_globals;
@@ -706,7 +706,7 @@ size_t tcg_nb_tbs(void);
 static inline void *tcg_malloc(int size)
 {
     TCGContext *s = tcg_ctx;
-    uint8_t *ptr, *ptr_end;
+    uintptr_t ptr, ptr_end;
 
     /* ??? This is a weak placeholder for minimum malloc alignment.  */
     size = QEMU_ALIGN_UP(size, 8);
@@ -717,7 +717,7 @@ static inline void *tcg_malloc(int size)
         return tcg_malloc_internal(tcg_ctx, size);
     } else {
         s->pool_cur = ptr_end;
-        return ptr;
+        return (void *)ptr;
     }
 }
 
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 50d40b9cbe..afac55a203 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1331,8 +1331,9 @@ void *tcg_malloc_internal(TCGContext *s, int size)
         p = s->pool_current;
         if (!p) {
             p = s->pool_first;
-            if (!p)
+            if (!p) {
                 goto new_pool;
+            }
         } else {
             if (!p->next) {
             new_pool:
@@ -1351,8 +1352,8 @@ void *tcg_malloc_internal(TCGContext *s, int size)
         }
     }
     s->pool_current = p;
-    s->pool_cur = p->data + size;
-    s->pool_end = p->data + p->size;
+    s->pool_cur = (uintptr_t)p->data + size;
+    s->pool_end = (uintptr_t)p->data + p->size;
     return p->data;
 }
 
@@ -1364,7 +1365,7 @@ void tcg_pool_reset(TCGContext *s)
         g_free(p);
     }
     s->pool_first_large = NULL;
-    s->pool_cur = s->pool_end = NULL;
+    s->pool_cur = s->pool_end = 0;
     s->pool_current = NULL;
 }
 

From d6390204c61e148488f034d1f79be35cd3318d93 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Fri, 11 Jul 2025 15:12:17 +0100
Subject: [PATCH 2151/2760] linux-user: Use qemu_set_cloexec() to mark pidfd as
 FD_CLOEXEC
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In the linux-user do_fork() function we try to set the FD_CLOEXEC
flag on a pidfd like this:

    fcntl(pid_fd, F_SETFD, fcntl(pid_fd, F_GETFL) | FD_CLOEXEC);

This has two problems:
 (1) it doesn't check errors, which Coverity complains about
 (2) we use F_GETFL when we mean F_GETFD

Deal with both of these problems by using qemu_set_cloexec() instead.
That function will assert() if the fcntls fail, which is fine (we are
inside fork_start()/fork_end() so we know nothing can mess around
with our file descriptors here, and we just got this one from
pidfd_open()).

(As we are touching the if() statement here, we correct the
indentation.)

Coverity: CID 1508111
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250711141217.1429412-1-peter.maydell@linaro.org>
---
 linux-user/syscall.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 38dd563166..91360a072c 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -6747,10 +6747,9 @@ static int do_fork(CPUArchState *env, unsigned int flags, abi_ulong newsp,
                 int pid_child = ret;
                 pid_fd = pidfd_open(pid_child, 0);
                 if (pid_fd >= 0) {
-                        fcntl(pid_fd, F_SETFD, fcntl(pid_fd, F_GETFL)
-                                               | FD_CLOEXEC);
+                    qemu_set_cloexec(pid_fd);
                 } else {
-                        pid_fd = 0;
+                    pid_fd = 0;
                 }
 #endif
                 put_user_u32(pid_fd, parent_tidptr);

From d93972d88b0984ed0a2090493f8d62cc188976d2 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Sat, 5 Jul 2025 14:17:30 +0200
Subject: [PATCH 2152/2760] target/i386: nvmm, whpx: add accel/CPU class that
 sets host vendor

NVMM and WHPX are virtualizers, and therefore they need to use
(at least by default) the host vendor for the guest CPUID.
Add a cpu_instance_init implementation to these accelerators.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c           |  3 ++-
 target/i386/meson.build     |  2 ++
 target/i386/nvmm/nvmm-all.c | 25 +++++++++++++++++++++++++
 target/i386/whpx/whpx-all.c | 25 +++++++++++++++++++++++++
 4 files changed, 54 insertions(+), 1 deletion(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 4d4e523424..8fb74b56dd 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -44,6 +44,7 @@
 #include "hw/boards.h"
 #include "hw/i386/sgx-epc.h"
 #endif
+#include "system/qtest.h"
 #include "tcg/tcg-cpu.h"
 
 #include "disas/capstone.h"
@@ -1943,7 +1944,7 @@ uint32_t xsave_area_size(uint64_t mask, bool compacted)
 
 static inline bool accel_uses_host_cpuid(void)
 {
-    return kvm_enabled() || hvf_enabled();
+    return !tcg_enabled() && !qtest_enabled();
 }
 
 static inline uint64_t x86_cpu_xsave_xcr0_components(X86CPU *cpu)
diff --git a/target/i386/meson.build b/target/i386/meson.build
index c1aacea613..092af34e2d 100644
--- a/target/i386/meson.build
+++ b/target/i386/meson.build
@@ -11,6 +11,8 @@ i386_ss.add(when: 'CONFIG_SEV', if_true: files('host-cpu.c', 'confidential-guest
 # x86 cpu type
 i386_ss.add(when: 'CONFIG_KVM', if_true: files('host-cpu.c'))
 i386_ss.add(when: 'CONFIG_HVF', if_true: files('host-cpu.c'))
+i386_ss.add(when: 'CONFIG_WHPX', if_true: files('host-cpu.c'))
+i386_ss.add(when: 'CONFIG_NVMM', if_true: files('host-cpu.c'))
 
 i386_system_ss = ss.source_set()
 i386_system_ss.add(files(
diff --git a/target/i386/nvmm/nvmm-all.c b/target/i386/nvmm/nvmm-all.c
index b4a4d50e86..11c263004d 100644
--- a/target/i386/nvmm/nvmm-all.c
+++ b/target/i386/nvmm/nvmm-all.c
@@ -19,6 +19,8 @@
 #include "qemu/error-report.h"
 #include "qapi/error.h"
 #include "qemu/queue.h"
+#include "accel/accel-cpu-target.h"
+#include "host-cpu.h"
 #include "migration/blocker.h"
 #include "strings.h"
 
@@ -1207,10 +1209,33 @@ static const TypeInfo nvmm_accel_type = {
     .class_init = nvmm_accel_class_init,
 };
 
+static void nvmm_cpu_instance_init(CPUState *cs)
+{
+    X86CPU *cpu = X86_CPU(cs);
+
+    host_cpu_instance_init(cpu);
+}
+
+static void nvmm_cpu_accel_class_init(ObjectClass *oc, const void *data)
+{
+    AccelCPUClass *acc = ACCEL_CPU_CLASS(oc);
+
+    acc->cpu_instance_init = nvmm_cpu_instance_init;
+}
+
+static const TypeInfo nvmm_cpu_accel_type = {
+    .name = ACCEL_CPU_NAME("nvmm"),
+
+    .parent = TYPE_ACCEL_CPU,
+    .class_init = nvmm_cpu_accel_class_init,
+    .abstract = true,
+};
+
 static void
 nvmm_type_init(void)
 {
     type_register_static(&nvmm_accel_type);
+    type_register_static(&nvmm_cpu_accel_type);
 }
 
 type_init(nvmm_type_init);
diff --git a/target/i386/whpx/whpx-all.c b/target/i386/whpx/whpx-all.c
index faf56e1972..22ac609070 100644
--- a/target/i386/whpx/whpx-all.c
+++ b/target/i386/whpx/whpx-all.c
@@ -26,6 +26,8 @@
 #include "qapi/qapi-types-common.h"
 #include "qapi/qapi-visit-common.h"
 #include "migration/blocker.h"
+#include "host-cpu.h"
+#include "accel/accel-cpu-target.h"
 #include <winerror.h>
 
 #include "whpx-internal.h"
@@ -2500,6 +2502,28 @@ static void whpx_set_kernel_irqchip(Object *obj, Visitor *v,
     }
 }
 
+static void whpx_cpu_instance_init(CPUState *cs)
+{
+    X86CPU *cpu = X86_CPU(cs);
+
+    host_cpu_instance_init(cpu);
+}
+
+static void whpx_cpu_accel_class_init(ObjectClass *oc, const void *data)
+{
+    AccelCPUClass *acc = ACCEL_CPU_CLASS(oc);
+
+    acc->cpu_instance_init = whpx_cpu_instance_init;
+}
+
+static const TypeInfo whpx_cpu_accel_type = {
+    .name = ACCEL_CPU_NAME("whpx"),
+
+    .parent = TYPE_ACCEL_CPU,
+    .class_init = whpx_cpu_accel_class_init,
+    .abstract = true,
+};
+
 /*
  * Partition support
  */
@@ -2726,6 +2750,7 @@ static const TypeInfo whpx_accel_type = {
 static void whpx_type_init(void)
 {
     type_register_static(&whpx_accel_type);
+    type_register_static(&whpx_cpu_accel_type);
 }
 
 bool init_whp_dispatch(void)

From 810fcc41fc572d90b3c05af3f06f451626ee6b10 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Thu, 10 Jul 2025 18:49:17 +0200
Subject: [PATCH 2153/2760] target/i386: allow reordering max_x86_cpu_initfn vs
 accel CPU init

The PMU feature is only supported by KVM, so move it there.  And since
all accelerators other than TCG overwrite the vendor, set it in
max_x86_cpu_initfn only if it has not been initialized by the
superclass.  This makes it possible to run max_x86_cpu_initfn
after accelerator init.

Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c         | 24 ++++++++++++------------
 target/i386/kvm/kvm-cpu.c |  2 ++
 2 files changed, 14 insertions(+), 12 deletions(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 8fb74b56dd..9c5cef2c7c 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -6199,21 +6199,21 @@ static void max_x86_cpu_class_init(ObjectClass *oc, const void *data)
 static void max_x86_cpu_initfn(Object *obj)
 {
     X86CPU *cpu = X86_CPU(obj);
-
-    /* We can't fill the features array here because we don't know yet if
-     * "migratable" is true or false.
-     */
-    object_property_set_bool(OBJECT(cpu), "pmu", true, &error_abort);
+    CPUX86State *env = &cpu->env;
 
     /*
-     * these defaults are used for TCG and all other accelerators
-     * besides KVM and HVF, which overwrite these values
+     * these defaults are used for TCG, other accelerators overwrite these
+     * values
      */
-    object_property_set_str(OBJECT(cpu), "vendor", CPUID_VENDOR_AMD,
-                            &error_abort);
-    object_property_set_str(OBJECT(cpu), "model-id",
-                            "QEMU TCG CPU version " QEMU_HW_VERSION,
-                            &error_abort);
+    if (!env->cpuid_vendor1) {
+        object_property_set_str(OBJECT(cpu), "vendor", CPUID_VENDOR_AMD,
+                                &error_abort);
+    }
+    if (!env->cpuid_model[0]) {
+        object_property_set_str(OBJECT(cpu), "model-id",
+                                "QEMU TCG CPU version " QEMU_HW_VERSION,
+                                &error_abort);
+    }
 }
 
 static const TypeInfo max_x86_cpu_type_info = {
diff --git a/target/i386/kvm/kvm-cpu.c b/target/i386/kvm/kvm-cpu.c
index 0fb88a239d..6fed353548 100644
--- a/target/i386/kvm/kvm-cpu.c
+++ b/target/i386/kvm/kvm-cpu.c
@@ -111,6 +111,8 @@ static void kvm_cpu_max_instance_init(X86CPU *cpu)
 
     host_cpu_max_instance_init(cpu);
 
+    object_property_set_bool(OBJECT(cpu), "pmu", true, &error_abort);
+
     if (lmce_supported()) {
         object_property_set_bool(OBJECT(cpu), "lmce", true, &error_abort);
     }

From 5f158abef44c7e0945fc5f76715ef135a9bf9bd2 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Sat, 5 Jul 2025 14:30:52 +0200
Subject: [PATCH 2154/2760] target/i386: move accel_cpu_instance_init to
 .instance_init

With the reordering of instance_post_init callbacks that is new in 10.1
accel_cpu_instance_init must execute in .instance_init as is already
the case for RISC-V.  Otherwise, for example, setting the vendor
property is broken when using KVM or Hypervisor.framework, because
KVM sets it *after* the user's value is set by DeviceState's
intance_post_init callback.

Reported-by: Like Xu <like.xu.linux@gmail.com>
Reported-by: Dongli Zhang <dongli.zhang@oracle.com>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 9c5cef2c7c..44178bc523 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -6202,8 +6202,8 @@ static void max_x86_cpu_initfn(Object *obj)
     CPUX86State *env = &cpu->env;
 
     /*
-     * these defaults are used for TCG, other accelerators overwrite these
-     * values
+     * these defaults are used for TCG, other accelerators have overwritten
+     * these values
      */
     if (!env->cpuid_vendor1) {
         object_property_set_str(OBJECT(cpu), "vendor", CPUID_VENDOR_AMD,
@@ -9038,8 +9038,6 @@ static void x86_cpu_post_initfn(Object *obj)
         }
     }
 
-    accel_cpu_instance_init(CPU(obj));
-
 #ifndef CONFIG_USER_ONLY
     if (current_machine && current_machine->cgs) {
         x86_confidential_guest_cpu_instance_init(
@@ -9114,6 +9112,8 @@ static void x86_cpu_initfn(Object *obj)
     if (xcc->model) {
         x86_cpu_load_model(cpu, xcc->model);
     }
+
+    accel_cpu_instance_init(CPU(obj));
 }
 
 static int64_t x86_cpu_get_arch_id(CPUState *cs)

From 29f1ba338baf60a9e455b6fdc37489ca1efe25aa Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 11 Jul 2025 09:43:52 +0200
Subject: [PATCH 2155/2760] target/i386: merge host_cpu_instance_init() and
 host_cpu_max_instance_init()

Simplify the accelerators' cpu_instance_init callbacks by doing all
host-cpu setup in a single function.

Based-on: <20250711000603.438312-1-pbonzini@redhat.com>
Cc: Xiaoyao Li <xiaoyao.li@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/host-cpu.c    | 28 ++++++++++++++--------------
 target/i386/hvf/hvf-cpu.c |  2 --
 target/i386/kvm/kvm-cpu.c |  2 --
 3 files changed, 14 insertions(+), 18 deletions(-)

diff --git a/target/i386/host-cpu.c b/target/i386/host-cpu.c
index 7512567298..3399edc1ad 100644
--- a/target/i386/host-cpu.c
+++ b/target/i386/host-cpu.c
@@ -132,27 +132,27 @@ void host_cpu_instance_init(X86CPU *cpu)
 {
     X86CPUClass *xcc = X86_CPU_GET_CLASS(cpu);
 
-    if (xcc->model) {
-        char vendor[CPUID_VENDOR_SZ + 1];
-
-        host_cpu_vendor_fms(vendor, NULL, NULL, NULL);
-        object_property_set_str(OBJECT(cpu), "vendor", vendor, &error_abort);
-    }
-}
-
-void host_cpu_max_instance_init(X86CPU *cpu)
-{
     char vendor[CPUID_VENDOR_SZ + 1] = { 0 };
     char model_id[CPUID_MODEL_ID_SZ + 1] = { 0 };
     int family, model, stepping;
 
+    /*
+     * setting vendor applies to both max/host and builtin_x86_defs CPU.
+     * FIXME: this probably should warn or should be skipped if vendors do
+     * not match, because family numbers are incompatible between Intel and AMD.
+     */
+    host_cpu_vendor_fms(vendor, &family, &model, &stepping);
+    object_property_set_str(OBJECT(cpu), "vendor", vendor, &error_abort);
+
+    if (!xcc->max_features) {
+        return;
+    }
+
+    host_cpu_fill_model_id(model_id);
+
     /* Use max host physical address bits if -cpu max option is applied */
     object_property_set_bool(OBJECT(cpu), "host-phys-bits", true, &error_abort);
 
-    host_cpu_vendor_fms(vendor, &family, &model, &stepping);
-    host_cpu_fill_model_id(model_id);
-
-    object_property_set_str(OBJECT(cpu), "vendor", vendor, &error_abort);
     object_property_set_int(OBJECT(cpu), "family", family, &error_abort);
     object_property_set_int(OBJECT(cpu), "model", model, &error_abort);
     object_property_set_int(OBJECT(cpu), "stepping", stepping,
diff --git a/target/i386/hvf/hvf-cpu.c b/target/i386/hvf/hvf-cpu.c
index 2b991f2fc8..94ee096ecf 100644
--- a/target/i386/hvf/hvf-cpu.c
+++ b/target/i386/hvf/hvf-cpu.c
@@ -21,8 +21,6 @@ static void hvf_cpu_max_instance_init(X86CPU *cpu)
 {
     CPUX86State *env = &cpu->env;
 
-    host_cpu_max_instance_init(cpu);
-
     env->cpuid_min_level =
         hvf_get_supported_cpuid(0x0, 0, R_EAX);
     env->cpuid_min_xlevel =
diff --git a/target/i386/kvm/kvm-cpu.c b/target/i386/kvm/kvm-cpu.c
index 6fed353548..a99b876464 100644
--- a/target/i386/kvm/kvm-cpu.c
+++ b/target/i386/kvm/kvm-cpu.c
@@ -109,8 +109,6 @@ static void kvm_cpu_max_instance_init(X86CPU *cpu)
     CPUX86State *env = &cpu->env;
     KVMState *s = kvm_state;
 
-    host_cpu_max_instance_init(cpu);
-
     object_property_set_bool(OBJECT(cpu), "pmu", true, &error_abort);
 
     if (lmce_supported()) {

From b57999bb258349fabe497c8ff70277b5e5b281e2 Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Thu, 3 Jul 2025 10:40:17 +0800
Subject: [PATCH 2156/2760] i386/tdx: Remove enumeration of GetQuote in
 tdx_handle_get_tdvmcall_info()

GHCI is finalized with the <GetQuote> being one of the base VMCALLs, and
not enuemrated via <GetTdVmCallInfo>.

Adjust tdx_handle_get_tdvmcall_info() to match with GHCI.

Opportunistically fix the wrong indentation and explicitly set the
ret to TDG_VP_VMCALL_SUCCESS (in case KVM leaves unexpected value).

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Link: https://lore.kernel.org/r/20250703024021.3559286-2-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/kvm/tdx.c | 6 ++++--
 target/i386/kvm/tdx.h | 2 --
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
index e809e4b2df..8c661c3ecf 100644
--- a/target/i386/kvm/tdx.c
+++ b/target/i386/kvm/tdx.c
@@ -1259,13 +1259,15 @@ out_free:
 void tdx_handle_get_tdvmcall_info(X86CPU *cpu, struct kvm_run *run)
 {
     if (run->tdx.get_tdvmcall_info.leaf != 1) {
-	return;
+        return;
     }
 
-    run->tdx.get_tdvmcall_info.r11 = TDG_VP_VMCALL_SUBFUNC_GET_QUOTE;
+    run->tdx.get_tdvmcall_info.r11 = 0;
     run->tdx.get_tdvmcall_info.r12 = 0;
     run->tdx.get_tdvmcall_info.r13 = 0;
     run->tdx.get_tdvmcall_info.r14 = 0;
+
+    run->tdx.get_tdvmcall_info.ret = TDG_VP_VMCALL_SUCCESS;
 }
 
 static void tdx_panicked_on_fatal_error(X86CPU *cpu, uint64_t error_code,
diff --git a/target/i386/kvm/tdx.h b/target/i386/kvm/tdx.h
index 35a09c19c5..d439078a87 100644
--- a/target/i386/kvm/tdx.h
+++ b/target/i386/kvm/tdx.h
@@ -32,8 +32,6 @@ typedef struct TdxGuestClass {
 #define TDG_VP_VMCALL_GPA_INUSE         0x8000000000000001ULL
 #define TDG_VP_VMCALL_ALIGN_ERROR       0x8000000000000002ULL
 
-#define TDG_VP_VMCALL_SUBFUNC_GET_QUOTE 0x0000000000000001ULL
-
 enum TdxRamType {
     TDX_RAM_UNACCEPTED,
     TDX_RAM_ADDED,

From 25c98a135001559be905a0399669e5cdb3b0a613 Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Thu, 3 Jul 2025 10:40:18 +0800
Subject: [PATCH 2157/2760] update Linux headers to KVM tree master

To fetch the update of TDX

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Link: https://lore.kernel.org/r/20250703024021.3559286-3-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 linux-headers/asm-x86/kvm.h | 8 +++++++-
 linux-headers/linux/kvm.h   | 4 ++++
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/linux-headers/asm-x86/kvm.h b/linux-headers/asm-x86/kvm.h
index cd275ae76d..f0c1a730d9 100644
--- a/linux-headers/asm-x86/kvm.h
+++ b/linux-headers/asm-x86/kvm.h
@@ -963,7 +963,13 @@ struct kvm_tdx_cmd {
 struct kvm_tdx_capabilities {
 	__u64 supported_attrs;
 	__u64 supported_xfam;
-	__u64 reserved[254];
+
+	__u64 kernel_tdvmcallinfo_1_r11;
+	__u64 user_tdvmcallinfo_1_r11;
+	__u64 kernel_tdvmcallinfo_1_r12;
+	__u64 user_tdvmcallinfo_1_r12;
+
+	__u64 reserved[250];
 
 	/* Configurable CPUID bits for userspace */
 	struct kvm_cpuid2 cpuid;
diff --git a/linux-headers/linux/kvm.h b/linux-headers/linux/kvm.h
index 0690743944..32c5885a3c 100644
--- a/linux-headers/linux/kvm.h
+++ b/linux-headers/linux/kvm.h
@@ -459,6 +459,10 @@ struct kvm_run {
 					__u64 leaf;
 					__u64 r11, r12, r13, r14;
 				} get_tdvmcall_info;
+				struct {
+					__u64 ret;
+					__u64 vector;
+				} setup_event_notify;
 			};
 		} tdx;
 		/* Fix the size of the union. */

From 55be385b10658a2372f944fa41aaba016e1e8433 Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Thu, 3 Jul 2025 10:40:19 +0800
Subject: [PATCH 2158/2760] i386/tdx: Set value of <GetTdVmCallInfo> based on
 capabilities of both KVM and QEMU

KVM reports the supported TDVMCALL sub leafs in TDX capabilities.

one for kernel-supported
    TDVMCALLs (userspace can set those blindly) and one for user-supported
    TDVMCALLs (userspace can set those if it knows how to handle them)

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Link: https://lore.kernel.org/r/20250703024021.3559286-4-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/kvm/tdx.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
index 8c661c3ecf..10dfb80d22 100644
--- a/target/i386/kvm/tdx.c
+++ b/target/i386/kvm/tdx.c
@@ -1256,14 +1256,21 @@ out_free:
     g_free(task);
 }
 
+#define SUPPORTED_TDVMCALLINFO_1_R11    (0)
+#define SUPPORTED_TDVMCALLINFO_1_R12    (0)
+
 void tdx_handle_get_tdvmcall_info(X86CPU *cpu, struct kvm_run *run)
 {
     if (run->tdx.get_tdvmcall_info.leaf != 1) {
         return;
     }
 
-    run->tdx.get_tdvmcall_info.r11 = 0;
-    run->tdx.get_tdvmcall_info.r12 = 0;
+    run->tdx.get_tdvmcall_info.r11 = (tdx_caps->user_tdvmcallinfo_1_r11 &
+                                      SUPPORTED_TDVMCALLINFO_1_R11) |
+                                      tdx_caps->kernel_tdvmcallinfo_1_r11;
+    run->tdx.get_tdvmcall_info.r12 = (tdx_caps->user_tdvmcallinfo_1_r12 &
+                                      SUPPORTED_TDVMCALLINFO_1_R12) |
+                                      tdx_caps->kernel_tdvmcallinfo_1_r12;
     run->tdx.get_tdvmcall_info.r13 = 0;
     run->tdx.get_tdvmcall_info.r14 = 0;
 

From efa742b23eff2a799c196d756bd506fe74e96fdc Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Thu, 3 Jul 2025 10:40:20 +0800
Subject: [PATCH 2159/2760] i386/tdx: handle
 TDVMCALL_SETUP_EVENT_NOTIFY_INTERRUPT

Record the interrupt vector and the apic id of the vcpu that calls
TDVMCALL_SETUP_EVENT_NOTIFY_INTERRUPT.

Inject the interrupt to TD guest to notify the completion of <GetQuote>
when notify interrupt vector is valid.

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Link: https://lore.kernel.org/r/20250703024021.3559286-5-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/kvm/kvm.c      |  3 +++
 target/i386/kvm/tdx-stub.c |  4 ++++
 target/i386/kvm/tdx.c      | 48 +++++++++++++++++++++++++++++++++++++-
 target/i386/kvm/tdx.h      |  7 ++++++
 4 files changed, 61 insertions(+), 1 deletion(-)

diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
index 234878c613..fc58a23b30 100644
--- a/target/i386/kvm/kvm.c
+++ b/target/i386/kvm/kvm.c
@@ -6182,6 +6182,9 @@ int kvm_arch_handle_exit(CPUState *cs, struct kvm_run *run)
         case TDVMCALL_GET_TD_VM_CALL_INFO:
             tdx_handle_get_tdvmcall_info(cpu, run);
             break;
+        case TDVMCALL_SETUP_EVENT_NOTIFY_INTERRUPT:
+            tdx_handle_setup_event_notify_interrupt(cpu, run);
+            break;
         }
         ret = 0;
         break;
diff --git a/target/i386/kvm/tdx-stub.c b/target/i386/kvm/tdx-stub.c
index 76fee49eff..1f0e108a69 100644
--- a/target/i386/kvm/tdx-stub.c
+++ b/target/i386/kvm/tdx-stub.c
@@ -26,3 +26,7 @@ void tdx_handle_get_quote(X86CPU *cpu, struct kvm_run *run)
 void tdx_handle_get_tdvmcall_info(X86CPU *cpu, struct kvm_run *run)
 {
 }
+
+void tdx_handle_setup_event_notify_interrupt(X86CPU *cpu, struct kvm_run *run)
+{
+}
diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
index 10dfb80d22..fb31071dd8 100644
--- a/target/i386/kvm/tdx.c
+++ b/target/i386/kvm/tdx.c
@@ -28,10 +28,13 @@
 #include "cpu.h"
 #include "cpu-internal.h"
 #include "host-cpu.h"
+#include "hw/i386/apic_internal.h"
+#include "hw/i386/apic-msidef.h"
 #include "hw/i386/e820_memory_layout.h"
 #include "hw/i386/tdvf.h"
 #include "hw/i386/x86.h"
 #include "hw/i386/tdvf-hob.h"
+#include "hw/pci/msi.h"
 #include "kvm_i386.h"
 #include "tdx.h"
 #include "tdx-quote-generator.h"
@@ -1123,6 +1126,28 @@ int tdx_parse_tdvf(void *flash_ptr, int size)
     return tdvf_parse_metadata(&tdx_guest->tdvf, flash_ptr, size);
 }
 
+static void tdx_inject_interrupt(uint32_t apicid, uint32_t vector)
+{
+    int ret;
+
+    if (vector < 32 || vector > 255) {
+        return;
+    }
+
+    MSIMessage msg = {
+        .address = ((apicid & 0xff) << MSI_ADDR_DEST_ID_SHIFT) |
+                   (((uint64_t)apicid & 0xffffff00) << 32),
+        .data = vector | (APIC_DM_FIXED << MSI_DATA_DELIVERY_MODE_SHIFT),
+    };
+
+    ret = kvm_irqchip_send_msi(kvm_state, msg);
+    if (ret < 0) {
+        /* In this case, no better way to tell it to guest. Log it. */
+        error_report("TDX: injection interrupt %d failed, interrupt lost (%s).",
+                     vector, strerror(-ret));
+    }
+}
+
 static void tdx_get_quote_completion(TdxGenerateQuoteTask *task)
 {
     TdxGuest *tdx = task->opaque;
@@ -1154,6 +1179,9 @@ static void tdx_get_quote_completion(TdxGenerateQuoteTask *task)
         error_report("TDX: get-quote: failed to update GetQuote header.");
     }
 
+    tdx_inject_interrupt(tdx_guest->event_notify_apicid,
+                         tdx_guest->event_notify_vector);
+
     g_free(task->send_data);
     g_free(task->receive_buf);
     g_free(task);
@@ -1256,7 +1284,7 @@ out_free:
     g_free(task);
 }
 
-#define SUPPORTED_TDVMCALLINFO_1_R11    (0)
+#define SUPPORTED_TDVMCALLINFO_1_R11    (TDG_VP_VMCALL_SUBFUNC_SET_EVENT_NOTIFY_INTERRUPT)
 #define SUPPORTED_TDVMCALLINFO_1_R12    (0)
 
 void tdx_handle_get_tdvmcall_info(X86CPU *cpu, struct kvm_run *run)
@@ -1277,6 +1305,21 @@ void tdx_handle_get_tdvmcall_info(X86CPU *cpu, struct kvm_run *run)
     run->tdx.get_tdvmcall_info.ret = TDG_VP_VMCALL_SUCCESS;
 }
 
+void tdx_handle_setup_event_notify_interrupt(X86CPU *cpu, struct kvm_run *run)
+{
+    uint64_t vector = run->tdx.setup_event_notify.vector;
+
+    if (vector >= 32 && vector < 256) {
+        qemu_mutex_lock(&tdx_guest->lock);
+        tdx_guest->event_notify_vector = vector;
+        tdx_guest->event_notify_apicid = cpu->apic_id;
+        qemu_mutex_unlock(&tdx_guest->lock);
+        run->tdx.setup_event_notify.ret = TDG_VP_VMCALL_SUCCESS;
+    } else {
+        run->tdx.setup_event_notify.ret = TDG_VP_VMCALL_INVALID_OPERAND;
+    }
+}
+
 static void tdx_panicked_on_fatal_error(X86CPU *cpu, uint64_t error_code,
                                         char *message, uint64_t gpa)
 {
@@ -1477,6 +1520,9 @@ static void tdx_guest_init(Object *obj)
                             NULL, NULL);
 
     qemu_mutex_init(&tdx->lock);
+
+    tdx->event_notify_vector = -1;
+    tdx->event_notify_apicid = -1;
 }
 
 static void tdx_guest_finalize(Object *obj)
diff --git a/target/i386/kvm/tdx.h b/target/i386/kvm/tdx.h
index d439078a87..1c38faf983 100644
--- a/target/i386/kvm/tdx.h
+++ b/target/i386/kvm/tdx.h
@@ -25,6 +25,7 @@ typedef struct TdxGuestClass {
 
 #define TDVMCALL_GET_TD_VM_CALL_INFO    0x10000
 #define TDVMCALL_GET_QUOTE		 0x10002
+#define TDVMCALL_SETUP_EVENT_NOTIFY_INTERRUPT   0x10004
 
 #define TDG_VP_VMCALL_SUCCESS           0x0000000000000000ULL
 #define TDG_VP_VMCALL_RETRY             0x0000000000000001ULL
@@ -32,6 +33,8 @@ typedef struct TdxGuestClass {
 #define TDG_VP_VMCALL_GPA_INUSE         0x8000000000000001ULL
 #define TDG_VP_VMCALL_ALIGN_ERROR       0x8000000000000002ULL
 
+#define TDG_VP_VMCALL_SUBFUNC_SET_EVENT_NOTIFY_INTERRUPT BIT_ULL(1)
+
 enum TdxRamType {
     TDX_RAM_UNACCEPTED,
     TDX_RAM_ADDED,
@@ -64,6 +67,9 @@ typedef struct TdxGuest {
     /* GetQuote */
     SocketAddress *qg_sock_addr;
     int num;
+
+    uint32_t event_notify_vector;
+    uint32_t event_notify_apicid;
 } TdxGuest;
 
 #ifdef CONFIG_TDX
@@ -78,5 +84,6 @@ int tdx_parse_tdvf(void *flash_ptr, int size);
 int tdx_handle_report_fatal_error(X86CPU *cpu, struct kvm_run *run);
 void tdx_handle_get_quote(X86CPU *cpu, struct kvm_run *run);
 void tdx_handle_get_tdvmcall_info(X86CPU *cpu, struct kvm_run *run);
+void tdx_handle_setup_event_notify_interrupt(X86CPU *cpu, struct kvm_run *run);
 
 #endif /* QEMU_I386_TDX_H */

From b28f6d5c16f19f8c56926c10929db29f913895ad Mon Sep 17 00:00:00 2001
From: Zhenzhong Duan <zhenzhong.duan@intel.com>
Date: Wed, 9 Jul 2025 23:55:38 -0400
Subject: [PATCH 2160/2760] i386/tdx: Fix the report of gpa in QAPI
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Gpa is defined in QAPI but never reported to monitor because has_gpa is
never set to ture.

Fix it by setting has_gpa to ture when TDX_REPORT_FATAL_ERROR_GPA_VALID
is set in error_code.

Fixes: 6e250463b08b ("i386/tdx: Wire TDX_REPORT_FATAL_ERROR with GuestPanic facility")
Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Link: https://lore.kernel.org/r/20250710035538.303136-1-zhenzhong.duan@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/kvm/tdx.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
index fb31071dd8..7d69d6d7b0 100644
--- a/target/i386/kvm/tdx.c
+++ b/target/i386/kvm/tdx.c
@@ -1321,7 +1321,8 @@ void tdx_handle_setup_event_notify_interrupt(X86CPU *cpu, struct kvm_run *run)
 }
 
 static void tdx_panicked_on_fatal_error(X86CPU *cpu, uint64_t error_code,
-                                        char *message, uint64_t gpa)
+                                        char *message, bool has_gpa,
+                                        uint64_t gpa)
 {
     GuestPanicInformation *panic_info;
 
@@ -1330,6 +1331,7 @@ static void tdx_panicked_on_fatal_error(X86CPU *cpu, uint64_t error_code,
     panic_info->u.tdx.error_code = (uint32_t) error_code;
     panic_info->u.tdx.message = message;
     panic_info->u.tdx.gpa = gpa;
+    panic_info->u.tdx.has_gpa = has_gpa;
 
     qemu_system_guest_panicked(panic_info);
 }
@@ -1349,6 +1351,7 @@ int tdx_handle_report_fatal_error(X86CPU *cpu, struct kvm_run *run)
     char *message = NULL;
     uint64_t *tmp;
     uint64_t gpa = -1ull;
+    bool has_gpa = false;
 
     if (error_code & 0xffff) {
         error_report("TDX: REPORT_FATAL_ERROR: invalid error code: 0x%"PRIx64,
@@ -1381,9 +1384,10 @@ int tdx_handle_report_fatal_error(X86CPU *cpu, struct kvm_run *run)
 
     if (error_code & TDX_REPORT_FATAL_ERROR_GPA_VALID) {
         gpa = run->system_event.data[R_R13];
+        has_gpa = true;
     }
 
-    tdx_panicked_on_fatal_error(cpu, error_code, message, gpa);
+    tdx_panicked_on_fatal_error(cpu, error_code, message, has_gpa, gpa);
 
     return -1;
 }

From 84fe49d94ac72d7fd226a65d2250c6294885561d Mon Sep 17 00:00:00 2001
From: Roy Hopkins <roy.hopkins@randomman.co.uk>
Date: Thu, 3 Jul 2025 16:00:36 +0100
Subject: [PATCH 2161/2760] meson: Add optional dependency on IGVM library
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The IGVM library allows Independent Guest Virtual Machine files to be
parsed and processed. IGVM files are used to configure guest memory
layout, initial processor state and other configuration pertaining to
secure virtual machines.

This adds the --enable-igvm configure option, enabled by default, which
attempts to locate and link against the IGVM library via pkgconfig and
sets CONFIG_IGVM if found.

The library is added to the system_ss target in backends/meson.build
where the IGVM parsing will be performed by the ConfidentialGuestSupport
object.

Signed-off-by: Roy Hopkins <roy.hopkins@randomman.co.uk>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Gerd Hoffman <kraxel@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Ani Sinha <anisinha@redhat.com>
Link: https://lore.kernel.org/r/45945a83a638c3f08e68c025f378e7b7f4f6d593.1751554099.git.roy.hopkins@randomman.co.uk
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 backends/meson.build          | 3 +++
 meson.build                   | 8 ++++++++
 meson_options.txt             | 2 ++
 scripts/meson-buildoptions.sh | 3 +++
 4 files changed, 16 insertions(+)

diff --git a/backends/meson.build b/backends/meson.build
index 9b88d22685..ac0fac7845 100644
--- a/backends/meson.build
+++ b/backends/meson.build
@@ -34,6 +34,9 @@ if have_vhost_user_crypto
 endif
 system_ss.add(when: gio, if_true: files('dbus-vmstate.c'))
 system_ss.add(when: 'CONFIG_SGX', if_true: files('hostmem-epc.c'))
+if igvm.found()
+  system_ss.add(igvm)
+endif
 
 system_ss.add(when: 'CONFIG_SPDM_SOCKET', if_true: files('spdm-socket.c'))
 
diff --git a/meson.build b/meson.build
index b5f74aa37a..200352c244 100644
--- a/meson.build
+++ b/meson.build
@@ -1424,6 +1424,12 @@ if host_os == 'linux' and (have_system or have_tools)
                        method: 'pkg-config',
                        required: get_option('libudev'))
 endif
+igvm = not_found
+if not get_option('igvm').auto() or have_system
+  igvm = dependency('igvm', version: '>= 0.3.0',
+                    method: 'pkg-config',
+                    required: get_option('igvm'))
+endif
 
 mpathlibs = [libudev]
 mpathpersist = not_found
@@ -2601,6 +2607,7 @@ config_host_data.set('CONFIG_CFI', get_option('cfi'))
 config_host_data.set('CONFIG_SELINUX', selinux.found())
 config_host_data.set('CONFIG_XEN_BACKEND', xen.found())
 config_host_data.set('CONFIG_LIBDW', libdw.found())
+config_host_data.set('CONFIG_IGVM', igvm.found())
 if xen.found()
   # protect from xen.version() having less than three components
   xen_version = xen.version().split('.') + ['0', '0']
@@ -4965,6 +4972,7 @@ summary_info += {'seccomp support':   seccomp}
 summary_info += {'GlusterFS support': glusterfs}
 summary_info += {'hv-balloon support': hv_balloon}
 summary_info += {'TPM support':       have_tpm}
+summary_info += {'IGVM support':      igvm}
 summary_info += {'libssh support':    libssh}
 summary_info += {'lzo support':       lzo}
 summary_info += {'snappy support':    snappy}
diff --git a/meson_options.txt b/meson_options.txt
index a442be2995..1e429311a2 100644
--- a/meson_options.txt
+++ b/meson_options.txt
@@ -117,6 +117,8 @@ option('tpm', type : 'feature', value : 'auto',
        description: 'TPM support')
 option('valgrind', type : 'feature', value: 'auto',
        description: 'valgrind debug support for coroutine stacks')
+option('igvm', type: 'feature', value: 'auto',
+       description: 'Independent Guest Virtual Machine (IGVM) file support')
 
 # Do not enable it by default even for Mingw32, because it doesn't
 # work on Wine.
diff --git a/scripts/meson-buildoptions.sh b/scripts/meson-buildoptions.sh
index 73e0770f42..7851540445 100644
--- a/scripts/meson-buildoptions.sh
+++ b/scripts/meson-buildoptions.sh
@@ -130,6 +130,7 @@ meson_options_help() {
   printf "%s\n" '  hv-balloon      hv-balloon driver (requires Glib 2.68+ GTree API)'
   printf "%s\n" '  hvf             HVF acceleration support'
   printf "%s\n" '  iconv           Font glyph conversion support'
+  printf "%s\n" '  igvm            IGVM file support'
   printf "%s\n" '  jack            JACK sound support'
   printf "%s\n" '  keyring         Linux keyring support'
   printf "%s\n" '  kvm             KVM acceleration support'
@@ -346,6 +347,8 @@ _meson_option_parse() {
     --iasl=*) quote_sh "-Diasl=$2" ;;
     --enable-iconv) printf "%s" -Diconv=enabled ;;
     --disable-iconv) printf "%s" -Diconv=disabled ;;
+    --enable-igvm) printf "%s" -Digvm=enabled ;;
+    --disable-igvm) printf "%s" -Digvm=disabled ;;
     --includedir=*) quote_sh "-Dincludedir=$2" ;;
     --enable-install-blobs) printf "%s" -Dinstall_blobs=true ;;
     --disable-install-blobs) printf "%s" -Dinstall_blobs=false ;;

From e7ed19507bc4f63162c578037db7d98178fbf54d Mon Sep 17 00:00:00 2001
From: Roy Hopkins <roy.hopkins@randomman.co.uk>
Date: Thu, 3 Jul 2025 16:03:10 +0100
Subject: [PATCH 2162/2760] backends/confidential-guest-support: Add functions
 to support IGVM

In preparation for supporting the processing of IGVM files to configure
guests, this adds a set of functions to ConfidentialGuestSupport
allowing configuration of secure virtual machines that can be
implemented for each supported isolation platform type such as Intel TDX
or AMD SEV-SNP. These functions will be called by IGVM processing code
in subsequent patches.

This commit provides a default implementation of the functions that
either perform no action or generate an error when they are called.
Targets that support ConfidentalGuestSupport should override these
implementations.

Signed-off-by: Roy Hopkins <roy.hopkins@randomman.co.uk>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Gerd Hoffman <kraxel@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Ani Sinha <anisinha@redhat.com>
Link: https://lore.kernel.org/r/23e34a106da87427899f93178102e4a6ef50c966.1751554099.git.roy.hopkins@randomman.co.uk
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 backends/confidential-guest-support.c       | 31 ++++++++++
 include/system/confidential-guest-support.h | 67 +++++++++++++++++++++
 2 files changed, 98 insertions(+)

diff --git a/backends/confidential-guest-support.c b/backends/confidential-guest-support.c
index 8ff7bfa857..c5bef1fbfa 100644
--- a/backends/confidential-guest-support.c
+++ b/backends/confidential-guest-support.c
@@ -14,15 +14,46 @@
 #include "qemu/osdep.h"
 
 #include "system/confidential-guest-support.h"
+#include "qapi/error.h"
 
 OBJECT_DEFINE_ABSTRACT_TYPE(ConfidentialGuestSupport,
                             confidential_guest_support,
                             CONFIDENTIAL_GUEST_SUPPORT,
                             OBJECT)
 
+static bool check_support(ConfidentialGuestPlatformType platform,
+                         uint16_t platform_version, uint8_t highest_vtl,
+                         uint64_t shared_gpa_boundary)
+{
+    /* Default: no support. */
+    return false;
+}
+
+static int set_guest_state(hwaddr gpa, uint8_t *ptr, uint64_t len,
+                           ConfidentialGuestPageType memory_type,
+                           uint16_t cpu_index, Error **errp)
+{
+    error_setg(errp,
+               "Setting confidential guest state is not supported for this platform");
+    return -1;
+}
+
+static int get_mem_map_entry(int index, ConfidentialGuestMemoryMapEntry *entry,
+                             Error **errp)
+{
+    error_setg(
+        errp,
+        "Obtaining the confidential guest memory map is not supported for this platform");
+    return -1;
+}
+
 static void confidential_guest_support_class_init(ObjectClass *oc,
                                                   const void *data)
 {
+    ConfidentialGuestSupportClass *cgsc = CONFIDENTIAL_GUEST_SUPPORT_CLASS(oc);
+    cgsc->check_support = check_support;
+    cgsc->set_guest_state = set_guest_state;
+    cgsc->get_mem_map_entry = get_mem_map_entry;
 }
 
 static void confidential_guest_support_init(Object *obj)
diff --git a/include/system/confidential-guest-support.h b/include/system/confidential-guest-support.h
index ea46b50c56..79ecd21f42 100644
--- a/include/system/confidential-guest-support.h
+++ b/include/system/confidential-guest-support.h
@@ -19,6 +19,7 @@
 #define QEMU_CONFIDENTIAL_GUEST_SUPPORT_H
 
 #include "qom/object.h"
+#include "exec/hwaddr.h"
 
 #define TYPE_CONFIDENTIAL_GUEST_SUPPORT "confidential-guest-support"
 OBJECT_DECLARE_TYPE(ConfidentialGuestSupport,
@@ -26,6 +27,36 @@ OBJECT_DECLARE_TYPE(ConfidentialGuestSupport,
                     CONFIDENTIAL_GUEST_SUPPORT)
 
 
+typedef enum ConfidentialGuestPlatformType {
+    CGS_PLATFORM_SEV,
+    CGS_PLATFORM_SEV_ES,
+    CGS_PLATFORM_SEV_SNP,
+} ConfidentialGuestPlatformType;
+
+typedef enum ConfidentialGuestMemoryType {
+    CGS_MEM_RAM,
+    CGS_MEM_RESERVED,
+    CGS_MEM_ACPI,
+    CGS_MEM_NVS,
+    CGS_MEM_UNUSABLE,
+} ConfidentialGuestMemoryType;
+
+typedef struct ConfidentialGuestMemoryMapEntry {
+    uint64_t gpa;
+    uint64_t size;
+    ConfidentialGuestMemoryType type;
+} ConfidentialGuestMemoryMapEntry;
+
+typedef enum ConfidentialGuestPageType {
+    CGS_PAGE_TYPE_NORMAL,
+    CGS_PAGE_TYPE_VMSA,
+    CGS_PAGE_TYPE_ZERO,
+    CGS_PAGE_TYPE_UNMEASURED,
+    CGS_PAGE_TYPE_SECRETS,
+    CGS_PAGE_TYPE_CPUID,
+    CGS_PAGE_TYPE_REQUIRED_MEMORY,
+} ConfidentialGuestPageType;
+
 struct ConfidentialGuestSupport {
     Object parent;
 
@@ -64,6 +95,42 @@ typedef struct ConfidentialGuestSupportClass {
 
     int (*kvm_init)(ConfidentialGuestSupport *cgs, Error **errp);
     int (*kvm_reset)(ConfidentialGuestSupport *cgs, Error **errp);
+
+    /*
+     * Check to see if this confidential guest supports a particular
+     * platform or configuration.
+     *
+     * Return true if supported or false if not supported.
+     */
+    bool (*check_support)(ConfidentialGuestPlatformType platform,
+                         uint16_t platform_version, uint8_t highest_vtl,
+                         uint64_t shared_gpa_boundary);
+
+    /*
+     * Configure part of the state of a guest for a particular set of data, page
+     * type and gpa. This can be used for example to pre-populate and measure
+     * guest memory contents, define private ranges or set the initial CPU state
+     * for one or more CPUs.
+     *
+     * If memory_type is CGS_PAGE_TYPE_VMSA then ptr points to the initial CPU
+     * context for a virtual CPU. The format of the data depends on the type of
+     * confidential virtual machine. For example, for SEV-ES ptr will point to a
+     * vmcb_save_area structure that should be copied into guest memory at the
+     * address specified in gpa. The cpu_index parameter contains the index of
+     * the CPU the VMSA applies to.
+     */
+    int (*set_guest_state)(hwaddr gpa, uint8_t *ptr, uint64_t len,
+                           ConfidentialGuestPageType memory_type,
+                           uint16_t cpu_index, Error **errp);
+
+    /*
+     * Iterate the system memory map, getting the entry with the given index
+     * that can be populated into guest memory.
+     *
+     * Returns 0 for ok, 1 if the index is out of range and -1 on error.
+     */
+    int (*get_mem_map_entry)(int index, ConfidentialGuestMemoryMapEntry *entry,
+                             Error **errp);
 } ConfidentialGuestSupportClass;
 
 static inline int confidential_guest_kvm_init(ConfidentialGuestSupport *cgs,

From c1d466d267cf40093c9489075906b385459a195f Mon Sep 17 00:00:00 2001
From: Roy Hopkins <roy.hopkins@randomman.co.uk>
Date: Thu, 3 Jul 2025 16:10:22 +0100
Subject: [PATCH 2163/2760] backends/igvm: Add IGVM loader and configuration

Adds an IGVM loader to QEMU which processes a given IGVM file and
applies the directives within the file to the current guest
configuration.

The IGVM loader can be used to configure both confidential and
non-confidential guests. For confidential guests, the
ConfidentialGuestSupport object for the system is used to encrypt
memory, apply the initial CPU state and perform other confidential guest
operations.

The loader is configured via a new IgvmCfg QOM object which allows the
user to provide a path to the IGVM file to process.

Signed-off-by: Roy Hopkins <roy.hopkins@randomman.co.uk>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Gerd Hoffman <kraxel@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Link: https://lore.kernel.org/r/ae3a07d8f514d93845a9c16bb155c847cb567b0d.1751554099.git.roy.hopkins@randomman.co.uk
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 backends/igvm-cfg.c       |  51 +++
 backends/igvm.c           | 807 ++++++++++++++++++++++++++++++++++++++
 backends/igvm.h           |  22 ++
 backends/meson.build      |   2 +
 include/system/igvm-cfg.h |  46 +++
 qapi/qom.json             |  17 +
 6 files changed, 945 insertions(+)
 create mode 100644 backends/igvm-cfg.c
 create mode 100644 backends/igvm.c
 create mode 100644 backends/igvm.h
 create mode 100644 include/system/igvm-cfg.h

diff --git a/backends/igvm-cfg.c b/backends/igvm-cfg.c
new file mode 100644
index 0000000000..45df63e06c
--- /dev/null
+++ b/backends/igvm-cfg.c
@@ -0,0 +1,51 @@
+/*
+ * QEMU IGVM interface
+ *
+ * Copyright (C) 2023-2024 SUSE
+ *
+ * Authors:
+ *  Roy Hopkins <roy.hopkins@randomman.co.uk>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+
+#include "system/igvm-cfg.h"
+#include "igvm.h"
+#include "qom/object_interfaces.h"
+
+static char *get_igvm(Object *obj, Error **errp)
+{
+    IgvmCfg *igvm = IGVM_CFG(obj);
+    return g_strdup(igvm->filename);
+}
+
+static void set_igvm(Object *obj, const char *value, Error **errp)
+{
+    IgvmCfg *igvm = IGVM_CFG(obj);
+    g_free(igvm->filename);
+    igvm->filename = g_strdup(value);
+}
+
+OBJECT_DEFINE_TYPE_WITH_INTERFACES(IgvmCfg, igvm_cfg, IGVM_CFG, OBJECT,
+                                   { TYPE_USER_CREATABLE }, { NULL })
+
+static void igvm_cfg_class_init(ObjectClass *oc, const void *data)
+{
+    IgvmCfgClass *igvmc = IGVM_CFG_CLASS(oc);
+
+    object_class_property_add_str(oc, "file", get_igvm, set_igvm);
+    object_class_property_set_description(oc, "file",
+                                          "Set the IGVM filename to use");
+
+    igvmc->process = qigvm_process_file;
+}
+
+static void igvm_cfg_init(Object *obj)
+{
+}
+
+static void igvm_cfg_finalize(Object *obj)
+{
+}
diff --git a/backends/igvm.c b/backends/igvm.c
new file mode 100644
index 0000000000..2a31021d44
--- /dev/null
+++ b/backends/igvm.c
@@ -0,0 +1,807 @@
+/*
+ * QEMU IGVM configuration backend for guests
+ *
+ * Copyright (C) 2023-2024 SUSE
+ *
+ * Authors:
+ *  Roy Hopkins <roy.hopkins@randomman.co.uk>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+
+#include "igvm.h"
+#include "qapi/error.h"
+#include "system/memory.h"
+#include "system/address-spaces.h"
+#include "hw/core/cpu.h"
+
+#include <igvm/igvm.h>
+#include <igvm/igvm_defs.h>
+
+typedef struct QIgvmParameterData {
+    QTAILQ_ENTRY(QIgvmParameterData) next;
+    uint8_t *data;
+    uint32_t size;
+    uint32_t index;
+} QIgvmParameterData;
+
+/*
+ * QIgvm contains the information required during processing
+ * of a single IGVM file.
+ */
+typedef struct QIgvm {
+    IgvmHandle file;
+    ConfidentialGuestSupport *cgs;
+    ConfidentialGuestSupportClass *cgsc;
+    uint32_t compatibility_mask;
+    unsigned current_header_index;
+    QTAILQ_HEAD(, QIgvmParameterData) parameter_data;
+
+    /* These variables keep track of contiguous page regions */
+    IGVM_VHS_PAGE_DATA region_prev_page_data;
+    uint64_t region_start;
+    unsigned region_start_index;
+    unsigned region_last_index;
+    unsigned region_page_count;
+} QIgvm;
+
+static int qigvm_directive_page_data(QIgvm *ctx, const uint8_t *header_data,
+                                     Error **errp);
+static int qigvm_directive_vp_context(QIgvm *ctx, const uint8_t *header_data,
+                                      Error **errp);
+static int qigvm_directive_parameter_area(QIgvm *ctx,
+                                          const uint8_t *header_data,
+                                          Error **errp);
+static int qigvm_directive_parameter_insert(QIgvm *ctx,
+                                            const uint8_t *header_data,
+                                            Error **errp);
+static int qigvm_directive_memory_map(QIgvm *ctx, const uint8_t *header_data,
+                                      Error **errp);
+static int qigvm_directive_vp_count(QIgvm *ctx, const uint8_t *header_data,
+                                    Error **errp);
+static int qigvm_directive_environment_info(QIgvm *ctx,
+                                            const uint8_t *header_data,
+                                            Error **errp);
+static int qigvm_directive_required_memory(QIgvm *ctx,
+                                           const uint8_t *header_data,
+                                           Error **errp);
+
+struct QIGVMHandler {
+    uint32_t type;
+    uint32_t section;
+    int (*handler)(QIgvm *ctx, const uint8_t *header_data, Error **errp);
+};
+
+static struct QIGVMHandler handlers[] = {
+    { IGVM_VHT_PAGE_DATA, IGVM_HEADER_SECTION_DIRECTIVE,
+      qigvm_directive_page_data },
+    { IGVM_VHT_VP_CONTEXT, IGVM_HEADER_SECTION_DIRECTIVE,
+      qigvm_directive_vp_context },
+    { IGVM_VHT_PARAMETER_AREA, IGVM_HEADER_SECTION_DIRECTIVE,
+      qigvm_directive_parameter_area },
+    { IGVM_VHT_PARAMETER_INSERT, IGVM_HEADER_SECTION_DIRECTIVE,
+      qigvm_directive_parameter_insert },
+    { IGVM_VHT_MEMORY_MAP, IGVM_HEADER_SECTION_DIRECTIVE,
+      qigvm_directive_memory_map },
+    { IGVM_VHT_VP_COUNT_PARAMETER, IGVM_HEADER_SECTION_DIRECTIVE,
+      qigvm_directive_vp_count },
+    { IGVM_VHT_ENVIRONMENT_INFO_PARAMETER, IGVM_HEADER_SECTION_DIRECTIVE,
+      qigvm_directive_environment_info },
+    { IGVM_VHT_REQUIRED_MEMORY, IGVM_HEADER_SECTION_DIRECTIVE,
+      qigvm_directive_required_memory },
+};
+
+static int qigvm_handler(QIgvm *ctx, uint32_t type, Error **errp)
+{
+    size_t handler;
+    IgvmHandle header_handle;
+    const uint8_t *header_data;
+    int result;
+
+    for (handler = 0; handler < G_N_ELEMENTS(handlers); handler++) {
+        if (handlers[handler].type != type) {
+            continue;
+        }
+        header_handle = igvm_get_header(ctx->file, handlers[handler].section,
+                                        ctx->current_header_index);
+        if (header_handle < 0) {
+            error_setg(
+                errp,
+                "IGVM file is invalid: Failed to read directive header (code: %d)",
+                (int)header_handle);
+            return -1;
+        }
+        header_data = igvm_get_buffer(ctx->file, header_handle) +
+                      sizeof(IGVM_VHS_VARIABLE_HEADER);
+        result = handlers[handler].handler(ctx, header_data, errp);
+        igvm_free_buffer(ctx->file, header_handle);
+        return result;
+    }
+    error_setg(errp,
+               "IGVM: Unknown header type encountered when processing file: "
+               "(type 0x%X)",
+               type);
+    return -1;
+}
+
+static void *qigvm_prepare_memory(QIgvm *ctx, uint64_t addr, uint64_t size,
+                                  int region_identifier, Error **errp)
+{
+    ERRP_GUARD();
+    MemoryRegion *igvm_pages = NULL;
+    Int128 gpa_region_size;
+    MemoryRegionSection mrs =
+        memory_region_find(get_system_memory(), addr, size);
+    if (mrs.mr) {
+        if (!memory_region_is_ram(mrs.mr)) {
+            memory_region_unref(mrs.mr);
+            error_setg(
+                errp,
+                "Processing of IGVM file failed: Could not prepare memory "
+                "at address 0x%lX due to existing non-RAM region",
+                addr);
+            return NULL;
+        }
+
+        gpa_region_size = int128_make64(size);
+        if (int128_lt(mrs.size, gpa_region_size)) {
+            memory_region_unref(mrs.mr);
+            error_setg(
+                errp,
+                "Processing of IGVM file failed: Could not prepare memory "
+                "at address 0x%lX: region size exceeded",
+                addr);
+            return NULL;
+        }
+        return qemu_map_ram_ptr(mrs.mr->ram_block, mrs.offset_within_region);
+    } else {
+        /*
+         * The region_identifier is the is the index of the IGVM directive that
+         * contains the page with the lowest GPA in the region. This will
+         * generate a unique region name.
+         */
+        g_autofree char *region_name =
+            g_strdup_printf("igvm.%X", region_identifier);
+        igvm_pages = g_new0(MemoryRegion, 1);
+        if (ctx->cgs && ctx->cgs->require_guest_memfd) {
+            if (!memory_region_init_ram_guest_memfd(igvm_pages, NULL,
+                                                    region_name, size, errp)) {
+                return NULL;
+            }
+        } else {
+            if (!memory_region_init_ram(igvm_pages, NULL, region_name, size,
+                                        errp)) {
+                return NULL;
+            }
+        }
+        memory_region_add_subregion(get_system_memory(), addr, igvm_pages);
+        return memory_region_get_ram_ptr(igvm_pages);
+    }
+}
+
+static int qigvm_type_to_cgs_type(IgvmPageDataType memory_type, bool unmeasured,
+                                  bool zero)
+{
+    switch (memory_type) {
+    case IGVM_PAGE_DATA_TYPE_NORMAL: {
+        if (unmeasured) {
+            return CGS_PAGE_TYPE_UNMEASURED;
+        } else {
+            return zero ? CGS_PAGE_TYPE_ZERO : CGS_PAGE_TYPE_NORMAL;
+        }
+    }
+    case IGVM_PAGE_DATA_TYPE_SECRETS:
+        return CGS_PAGE_TYPE_SECRETS;
+    case IGVM_PAGE_DATA_TYPE_CPUID_DATA:
+        return CGS_PAGE_TYPE_CPUID;
+    case IGVM_PAGE_DATA_TYPE_CPUID_XF:
+        return CGS_PAGE_TYPE_CPUID;
+    default:
+        return -1;
+    }
+}
+
+static bool qigvm_page_attrs_equal(IgvmHandle igvm, unsigned header_index,
+                                   const IGVM_VHS_PAGE_DATA *page_1,
+                                   const IGVM_VHS_PAGE_DATA *page_2)
+{
+    IgvmHandle data_handle1, data_handle2;
+
+    /*
+     * If one page has data and the other doesn't then this results in different
+     * page types: NORMAL vs ZERO.
+     */
+    data_handle1 = igvm_get_header_data(igvm, IGVM_HEADER_SECTION_DIRECTIVE,
+                                        header_index - 1);
+    data_handle2 =
+        igvm_get_header_data(igvm, IGVM_HEADER_SECTION_DIRECTIVE, header_index);
+    if ((data_handle1 == IGVMAPI_NO_DATA ||
+         data_handle2 == IGVMAPI_NO_DATA) &&
+         data_handle1 != data_handle2) {
+        return false;
+    }
+    return ((*(const uint32_t *)&page_1->flags ==
+             *(const uint32_t *)&page_2->flags) &&
+            (page_1->data_type == page_2->data_type) &&
+            (page_1->compatibility_mask == page_2->compatibility_mask));
+}
+
+static int qigvm_process_mem_region(QIgvm *ctx, unsigned start_index,
+                                    uint64_t gpa_start, unsigned page_count,
+                                    const IgvmPageDataFlags *flags,
+                                    const IgvmPageDataType page_type,
+                                    Error **errp)
+{
+    uint8_t *region;
+    IgvmHandle data_handle;
+    const void *data;
+    uint32_t data_size;
+    unsigned page_index;
+    bool zero = true;
+    const uint64_t page_size = flags->is_2mb_page ? 0x200000 : 0x1000;
+    int result;
+    int cgs_page_type;
+
+    region = qigvm_prepare_memory(ctx, gpa_start, page_count * page_size,
+                                  start_index, errp);
+    if (!region) {
+        return -1;
+    }
+
+    for (page_index = 0; page_index < page_count; page_index++) {
+        data_handle = igvm_get_header_data(
+            ctx->file, IGVM_HEADER_SECTION_DIRECTIVE, page_index + start_index);
+        if (data_handle == IGVMAPI_NO_DATA) {
+            /* No data indicates a zero page */
+            memset(&region[page_index * page_size], 0, page_size);
+        } else if (data_handle < 0) {
+            error_setg(
+                errp,
+                "IGVM file contains invalid page data for directive with "
+                "index %d",
+                page_index + start_index);
+            return -1;
+        } else {
+            zero = false;
+            data_size = igvm_get_buffer_size(ctx->file, data_handle);
+            if (data_size < page_size) {
+                memset(&region[page_index * page_size], 0, page_size);
+            } else if (data_size > page_size) {
+                error_setg(errp,
+                           "IGVM file contains page data with invalid size for "
+                           "directive with index %d",
+                           page_index + start_index);
+                return -1;
+            }
+            data = igvm_get_buffer(ctx->file, data_handle);
+            memcpy(&region[page_index * page_size], data, data_size);
+            igvm_free_buffer(ctx->file, data_handle);
+        }
+    }
+
+    /*
+     * If a confidential guest support object is provided then use it to set the
+     * guest state.
+     */
+    if (ctx->cgs) {
+        cgs_page_type =
+            qigvm_type_to_cgs_type(page_type, flags->unmeasured, zero);
+        if (cgs_page_type < 0) {
+            error_setg(errp,
+                       "Invalid page type in IGVM file. Directives: %d to %d, "
+                       "page type: %d",
+                       start_index, start_index + page_count, page_type);
+            return -1;
+        }
+
+        result = ctx->cgsc->set_guest_state(
+            gpa_start, region, page_size * page_count, cgs_page_type, 0, errp);
+        if (result < 0) {
+            return result;
+        }
+    }
+    return 0;
+}
+
+static int qigvm_process_mem_page(QIgvm *ctx,
+                                  const IGVM_VHS_PAGE_DATA *page_data,
+                                  Error **errp)
+{
+    if (page_data) {
+        if (ctx->region_page_count == 0) {
+            ctx->region_start = page_data->gpa;
+            ctx->region_start_index = ctx->current_header_index;
+        } else {
+            if (!qigvm_page_attrs_equal(ctx->file, ctx->current_header_index,
+                                        page_data,
+                                        &ctx->region_prev_page_data) ||
+                ((ctx->region_prev_page_data.gpa +
+                  (ctx->region_prev_page_data.flags.is_2mb_page ? 0x200000 :
+                                                                  0x1000)) !=
+                 page_data->gpa) ||
+                (ctx->region_last_index != (ctx->current_header_index - 1))) {
+                /* End of current region */
+                if (qigvm_process_mem_region(
+                        ctx, ctx->region_start_index, ctx->region_start,
+                        ctx->region_page_count,
+                        &ctx->region_prev_page_data.flags,
+                        ctx->region_prev_page_data.data_type, errp) < 0) {
+                    return -1;
+                }
+                ctx->region_page_count = 0;
+                ctx->region_start = page_data->gpa;
+                ctx->region_start_index = ctx->current_header_index;
+            }
+        }
+        memcpy(&ctx->region_prev_page_data, page_data,
+               sizeof(ctx->region_prev_page_data));
+        ctx->region_last_index = ctx->current_header_index;
+        ctx->region_page_count++;
+    } else {
+        if (ctx->region_page_count > 0) {
+            if (qigvm_process_mem_region(
+                    ctx, ctx->region_start_index, ctx->region_start,
+                    ctx->region_page_count, &ctx->region_prev_page_data.flags,
+                    ctx->region_prev_page_data.data_type, errp) < 0) {
+                return -1;
+            }
+            ctx->region_page_count = 0;
+        }
+    }
+    return 0;
+}
+
+static int qigvm_directive_page_data(QIgvm *ctx, const uint8_t *header_data,
+                                     Error **errp)
+{
+    const IGVM_VHS_PAGE_DATA *page_data =
+        (const IGVM_VHS_PAGE_DATA *)header_data;
+    if (page_data->compatibility_mask & ctx->compatibility_mask) {
+        return qigvm_process_mem_page(ctx, page_data, errp);
+    }
+    return 0;
+}
+
+static int qigvm_directive_vp_context(QIgvm *ctx, const uint8_t *header_data,
+                                      Error **errp)
+{
+    const IGVM_VHS_VP_CONTEXT *vp_context =
+        (const IGVM_VHS_VP_CONTEXT *)header_data;
+    IgvmHandle data_handle;
+    uint8_t *data;
+    int result;
+
+    if (!(vp_context->compatibility_mask & ctx->compatibility_mask)) {
+        return 0;
+    }
+
+    /*
+     * A confidential guest support object must be provided for setting
+     * a VP context.
+     */
+    if (!ctx->cgs) {
+        error_setg(
+            errp,
+            "A VP context is present in the IGVM file but is not supported "
+            "by the current system.");
+        return -1;
+    }
+
+    data_handle = igvm_get_header_data(ctx->file, IGVM_HEADER_SECTION_DIRECTIVE,
+                                       ctx->current_header_index);
+    if (data_handle < 0) {
+        error_setg(errp, "Invalid VP context in IGVM file. Error code: %X",
+                   data_handle);
+        return -1;
+    }
+
+    data = (uint8_t *)igvm_get_buffer(ctx->file, data_handle);
+    result = ctx->cgsc->set_guest_state(
+        vp_context->gpa, data, igvm_get_buffer_size(ctx->file, data_handle),
+        CGS_PAGE_TYPE_VMSA, vp_context->vp_index, errp);
+    igvm_free_buffer(ctx->file, data_handle);
+    if (result < 0) {
+        return result;
+    }
+    return 0;
+}
+
+static int qigvm_directive_parameter_area(QIgvm *ctx,
+                                          const uint8_t *header_data,
+                                          Error **errp)
+{
+    const IGVM_VHS_PARAMETER_AREA *param_area =
+        (const IGVM_VHS_PARAMETER_AREA *)header_data;
+    QIgvmParameterData *param_entry;
+
+    param_entry = g_new0(QIgvmParameterData, 1);
+    param_entry->size = param_area->number_of_bytes;
+    param_entry->index = param_area->parameter_area_index;
+    param_entry->data = g_malloc0(param_entry->size);
+
+    QTAILQ_INSERT_TAIL(&ctx->parameter_data, param_entry, next);
+    return 0;
+}
+
+static int qigvm_directive_parameter_insert(QIgvm *ctx,
+                                            const uint8_t *header_data,
+                                            Error **errp)
+{
+    const IGVM_VHS_PARAMETER_INSERT *param =
+        (const IGVM_VHS_PARAMETER_INSERT *)header_data;
+    QIgvmParameterData *param_entry;
+    int result;
+    void *region;
+
+    if (!(param->compatibility_mask & ctx->compatibility_mask)) {
+        return 0;
+    }
+
+    QTAILQ_FOREACH(param_entry, &ctx->parameter_data, next)
+    {
+        if (param_entry->index == param->parameter_area_index) {
+            region = qigvm_prepare_memory(ctx, param->gpa, param_entry->size,
+                                          ctx->current_header_index, errp);
+            if (!region) {
+                return -1;
+            }
+            memcpy(region, param_entry->data, param_entry->size);
+            g_free(param_entry->data);
+            param_entry->data = NULL;
+
+            /*
+             * If a confidential guest support object is provided then use it to
+             * set the guest state.
+             */
+            if (ctx->cgs) {
+                result = ctx->cgsc->set_guest_state(param->gpa, region,
+                                                    param_entry->size,
+                                                    CGS_PAGE_TYPE_UNMEASURED, 0,
+                                                    errp);
+                if (result < 0) {
+                    return -1;
+                }
+            }
+        }
+    }
+    return 0;
+}
+
+static int qigvm_cmp_mm_entry(const void *a, const void *b)
+{
+    const IGVM_VHS_MEMORY_MAP_ENTRY *entry_a =
+        (const IGVM_VHS_MEMORY_MAP_ENTRY *)a;
+    const IGVM_VHS_MEMORY_MAP_ENTRY *entry_b =
+        (const IGVM_VHS_MEMORY_MAP_ENTRY *)b;
+    if (entry_a->starting_gpa_page_number < entry_b->starting_gpa_page_number) {
+        return -1;
+    } else if (entry_a->starting_gpa_page_number >
+               entry_b->starting_gpa_page_number) {
+        return 1;
+    } else {
+        return 0;
+    }
+}
+
+static int qigvm_directive_memory_map(QIgvm *ctx, const uint8_t *header_data,
+                                      Error **errp)
+{
+    const IGVM_VHS_PARAMETER *param = (const IGVM_VHS_PARAMETER *)header_data;
+    QIgvmParameterData *param_entry;
+    int max_entry_count;
+    int entry = 0;
+    IGVM_VHS_MEMORY_MAP_ENTRY *mm_entry;
+    ConfidentialGuestMemoryMapEntry cgmm_entry;
+    int retval = 0;
+
+    if (!ctx->cgs) {
+        error_setg(errp,
+                   "IGVM file contains a memory map but this is not supported "
+                   "by the current system.");
+        return -1;
+    }
+
+    /* Find the parameter area that should hold the memory map */
+    QTAILQ_FOREACH(param_entry, &ctx->parameter_data, next)
+    {
+        if (param_entry->index == param->parameter_area_index) {
+            max_entry_count =
+                param_entry->size / sizeof(IGVM_VHS_MEMORY_MAP_ENTRY);
+            mm_entry = (IGVM_VHS_MEMORY_MAP_ENTRY *)param_entry->data;
+
+            retval = ctx->cgsc->get_mem_map_entry(entry, &cgmm_entry, errp);
+            while (retval == 0) {
+                if (entry > max_entry_count) {
+                    error_setg(
+                        errp,
+                        "IGVM: guest memory map size exceeds parameter area defined in IGVM file");
+                    return -1;
+                }
+                mm_entry[entry].starting_gpa_page_number = cgmm_entry.gpa >> 12;
+                mm_entry[entry].number_of_pages = cgmm_entry.size >> 12;
+
+                switch (cgmm_entry.type) {
+                case CGS_MEM_RAM:
+                    mm_entry[entry].entry_type =
+                        IGVM_MEMORY_MAP_ENTRY_TYPE_MEMORY;
+                    break;
+                case CGS_MEM_RESERVED:
+                    mm_entry[entry].entry_type =
+                        IGVM_MEMORY_MAP_ENTRY_TYPE_PLATFORM_RESERVED;
+                    break;
+                case CGS_MEM_ACPI:
+                    mm_entry[entry].entry_type =
+                        IGVM_MEMORY_MAP_ENTRY_TYPE_PLATFORM_RESERVED;
+                    break;
+                case CGS_MEM_NVS:
+                    mm_entry[entry].entry_type =
+                        IGVM_MEMORY_MAP_ENTRY_TYPE_PERSISTENT;
+                    break;
+                case CGS_MEM_UNUSABLE:
+                    mm_entry[entry].entry_type =
+                        IGVM_MEMORY_MAP_ENTRY_TYPE_PLATFORM_RESERVED;
+                    break;
+                }
+                retval =
+                    ctx->cgsc->get_mem_map_entry(++entry, &cgmm_entry, errp);
+            }
+            if (retval < 0) {
+                return retval;
+            }
+            /* The entries need to be sorted */
+            qsort(mm_entry, entry, sizeof(IGVM_VHS_MEMORY_MAP_ENTRY),
+                  qigvm_cmp_mm_entry);
+
+            break;
+        }
+    }
+    return 0;
+}
+
+static int qigvm_directive_vp_count(QIgvm *ctx, const uint8_t *header_data,
+                                    Error **errp)
+{
+    const IGVM_VHS_PARAMETER *param = (const IGVM_VHS_PARAMETER *)header_data;
+    QIgvmParameterData *param_entry;
+    uint32_t *vp_count;
+    CPUState *cpu;
+
+    QTAILQ_FOREACH(param_entry, &ctx->parameter_data, next)
+    {
+        if (param_entry->index == param->parameter_area_index) {
+            vp_count = (uint32_t *)(param_entry->data + param->byte_offset);
+            *vp_count = 0;
+            CPU_FOREACH(cpu)
+            {
+                (*vp_count)++;
+            }
+            break;
+        }
+    }
+    return 0;
+}
+
+static int qigvm_directive_environment_info(QIgvm *ctx,
+                                            const uint8_t *header_data,
+                                            Error **errp)
+{
+    const IGVM_VHS_PARAMETER *param = (const IGVM_VHS_PARAMETER *)header_data;
+    QIgvmParameterData *param_entry;
+    IgvmEnvironmentInfo *environmental_state;
+
+    QTAILQ_FOREACH(param_entry, &ctx->parameter_data, next)
+    {
+        if (param_entry->index == param->parameter_area_index) {
+            environmental_state =
+                (IgvmEnvironmentInfo *)(param_entry->data + param->byte_offset);
+            environmental_state->memory_is_shared = 1;
+            break;
+        }
+    }
+    return 0;
+}
+
+static int qigvm_directive_required_memory(QIgvm *ctx,
+                                           const uint8_t *header_data,
+                                           Error **errp)
+{
+    const IGVM_VHS_REQUIRED_MEMORY *mem =
+        (const IGVM_VHS_REQUIRED_MEMORY *)header_data;
+    uint8_t *region;
+    int result;
+
+    if (!(mem->compatibility_mask & ctx->compatibility_mask)) {
+        return 0;
+    }
+
+    region = qigvm_prepare_memory(ctx, mem->gpa, mem->number_of_bytes,
+                                  ctx->current_header_index, errp);
+    if (!region) {
+        return -1;
+    }
+    if (ctx->cgs) {
+        result =
+            ctx->cgsc->set_guest_state(mem->gpa, region, mem->number_of_bytes,
+                                       CGS_PAGE_TYPE_REQUIRED_MEMORY, 0, errp);
+        if (result < 0) {
+            return result;
+        }
+    }
+    return 0;
+}
+
+static int qigvm_supported_platform_compat_mask(QIgvm *ctx, Error **errp)
+{
+    int32_t header_count;
+    unsigned header_index;
+    IgvmHandle header_handle;
+    IGVM_VHS_SUPPORTED_PLATFORM *platform;
+    uint32_t compatibility_mask_sev = 0;
+    uint32_t compatibility_mask_sev_es = 0;
+    uint32_t compatibility_mask_sev_snp = 0;
+    uint32_t compatibility_mask = 0;
+
+    header_count = igvm_header_count(ctx->file, IGVM_HEADER_SECTION_PLATFORM);
+    if (header_count < 0) {
+        error_setg(errp,
+                   "Invalid platform header count in IGVM file. Error code: %X",
+                   header_count);
+        return -1;
+    }
+
+    for (header_index = 0; header_index < (unsigned)header_count;
+         header_index++) {
+        IgvmVariableHeaderType typ = igvm_get_header_type(
+            ctx->file, IGVM_HEADER_SECTION_PLATFORM, header_index);
+        if (typ == IGVM_VHT_SUPPORTED_PLATFORM) {
+            header_handle = igvm_get_header(
+                ctx->file, IGVM_HEADER_SECTION_PLATFORM, header_index);
+            if (header_handle < 0) {
+                error_setg(errp,
+                           "Invalid platform header in IGVM file. "
+                           "Index: %d, Error code: %X",
+                           header_index, header_handle);
+                return -1;
+            }
+            platform =
+                (IGVM_VHS_SUPPORTED_PLATFORM *)(igvm_get_buffer(ctx->file,
+                                                                header_handle) +
+                                                sizeof(
+                                                    IGVM_VHS_VARIABLE_HEADER));
+            if ((platform->platform_type == IGVM_PLATFORM_TYPE_SEV_ES) &&
+                ctx->cgs) {
+                if (ctx->cgsc->check_support(
+                        CGS_PLATFORM_SEV_ES, platform->platform_version,
+                        platform->highest_vtl, platform->shared_gpa_boundary)) {
+                    compatibility_mask_sev_es = platform->compatibility_mask;
+                }
+            } else if ((platform->platform_type == IGVM_PLATFORM_TYPE_SEV) &&
+                       ctx->cgs) {
+                if (ctx->cgsc->check_support(
+                        CGS_PLATFORM_SEV, platform->platform_version,
+                        platform->highest_vtl, platform->shared_gpa_boundary)) {
+                    compatibility_mask_sev = platform->compatibility_mask;
+                }
+            } else if ((platform->platform_type ==
+                        IGVM_PLATFORM_TYPE_SEV_SNP) &&
+                       ctx->cgs) {
+                if (ctx->cgsc->check_support(
+                        CGS_PLATFORM_SEV_SNP, platform->platform_version,
+                        platform->highest_vtl, platform->shared_gpa_boundary)) {
+                    compatibility_mask_sev_snp = platform->compatibility_mask;
+                }
+            } else if (platform->platform_type == IGVM_PLATFORM_TYPE_NATIVE) {
+                compatibility_mask = platform->compatibility_mask;
+            }
+            igvm_free_buffer(ctx->file, header_handle);
+        }
+    }
+    /* Choose the strongest supported isolation technology */
+    if (compatibility_mask_sev_snp != 0) {
+        ctx->compatibility_mask = compatibility_mask_sev_snp;
+    } else if (compatibility_mask_sev_es != 0) {
+        ctx->compatibility_mask = compatibility_mask_sev_es;
+    } else if (compatibility_mask_sev != 0) {
+        ctx->compatibility_mask = compatibility_mask_sev;
+    } else if (compatibility_mask != 0) {
+        ctx->compatibility_mask = compatibility_mask;
+    } else {
+        error_setg(
+            errp,
+            "IGVM file does not describe a compatible supported platform");
+        return -1;
+    }
+    return 0;
+}
+
+static IgvmHandle qigvm_file_init(char *filename, Error **errp)
+{
+    IgvmHandle igvm;
+    g_autofree uint8_t *buf = NULL;
+    unsigned long len;
+    g_autoptr(GError) gerr = NULL;
+
+    if (!g_file_get_contents(filename, (gchar **)&buf, &len, &gerr)) {
+        error_setg(errp, "Unable to load %s: %s", filename, gerr->message);
+        return -1;
+    }
+
+    igvm = igvm_new_from_binary(buf, len);
+    if (igvm < 0) {
+        error_setg(errp, "Unable to parse IGVM file %s: %d", filename, igvm);
+        return -1;
+    }
+    return igvm;
+}
+
+int qigvm_process_file(IgvmCfg *cfg, ConfidentialGuestSupport *cgs,
+                       Error **errp)
+{
+    int32_t header_count;
+    QIgvmParameterData *parameter;
+    int retval = -1;
+    QIgvm ctx;
+
+    memset(&ctx, 0, sizeof(ctx));
+    ctx.file = qigvm_file_init(cfg->filename, errp);
+    if (ctx.file < 0) {
+        return -1;
+    }
+
+    /*
+     * The ConfidentialGuestSupport object is optional and allows a confidential
+     * guest platform to perform extra processing, such as page measurement, on
+     * IGVM directives.
+     */
+    ctx.cgs = cgs;
+    ctx.cgsc = cgs ? CONFIDENTIAL_GUEST_SUPPORT_GET_CLASS(cgs) : NULL;
+
+    /*
+     * Check that the IGVM file provides configuration for the current
+     * platform
+     */
+    if (qigvm_supported_platform_compat_mask(&ctx, errp) < 0) {
+        goto cleanup;
+    }
+
+    header_count = igvm_header_count(ctx.file, IGVM_HEADER_SECTION_DIRECTIVE);
+    if (header_count <= 0) {
+        error_setg(
+            errp, "Invalid directive header count in IGVM file. Error code: %X",
+            header_count);
+        goto cleanup;
+    }
+
+    QTAILQ_INIT(&ctx.parameter_data);
+
+    for (ctx.current_header_index = 0;
+         ctx.current_header_index < (unsigned)header_count;
+         ctx.current_header_index++) {
+        IgvmVariableHeaderType type = igvm_get_header_type(
+            ctx.file, IGVM_HEADER_SECTION_DIRECTIVE, ctx.current_header_index);
+        if (qigvm_handler(&ctx, type, errp) < 0) {
+            goto cleanup_parameters;
+        }
+    }
+
+    /*
+     * Contiguous pages of data with compatible flags are grouped together in
+     * order to reduce the number of memory regions we create. Make sure the
+     * last group is processed with this call.
+     */
+    retval = qigvm_process_mem_page(&ctx, NULL, errp);
+
+cleanup_parameters:
+    QTAILQ_FOREACH(parameter, &ctx.parameter_data, next)
+    {
+        g_free(parameter->data);
+        parameter->data = NULL;
+    }
+
+cleanup:
+    igvm_free(ctx.file);
+
+    return retval;
+}
diff --git a/backends/igvm.h b/backends/igvm.h
new file mode 100644
index 0000000000..db02ea9165
--- /dev/null
+++ b/backends/igvm.h
@@ -0,0 +1,22 @@
+/*
+ * QEMU IGVM configuration backend for Confidential Guests
+ *
+ * Copyright (C) 2023-2024 SUSE
+ *
+ * Authors:
+ *  Roy Hopkins <roy.hopkins@randomman.co.uk>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef BACKENDS_IGVM_H
+#define BACKENDS_IGVM_H
+
+#include "system/confidential-guest-support.h"
+#include "system/igvm-cfg.h"
+#include "qapi/error.h"
+
+int qigvm_process_file(IgvmCfg *igvm, ConfidentialGuestSupport *cgs,
+                      Error **errp);
+
+#endif
diff --git a/backends/meson.build b/backends/meson.build
index ac0fac7845..60021f45d1 100644
--- a/backends/meson.build
+++ b/backends/meson.build
@@ -36,6 +36,8 @@ system_ss.add(when: gio, if_true: files('dbus-vmstate.c'))
 system_ss.add(when: 'CONFIG_SGX', if_true: files('hostmem-epc.c'))
 if igvm.found()
   system_ss.add(igvm)
+  system_ss.add(files('igvm-cfg.c'), igvm)
+  system_ss.add(files('igvm.c'), igvm)
 endif
 
 system_ss.add(when: 'CONFIG_SPDM_SOCKET', if_true: files('spdm-socket.c'))
diff --git a/include/system/igvm-cfg.h b/include/system/igvm-cfg.h
new file mode 100644
index 0000000000..321b3196f0
--- /dev/null
+++ b/include/system/igvm-cfg.h
@@ -0,0 +1,46 @@
+/*
+ * QEMU IGVM interface
+ *
+ * Copyright (C) 2024 SUSE
+ *
+ * Authors:
+ *  Roy Hopkins <roy.hopkins@randomman.co.uk>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef QEMU_IGVM_CFG_H
+#define QEMU_IGVM_CFG_H
+
+#include "qom/object.h"
+
+typedef struct IgvmCfg {
+    ObjectClass parent_class;
+
+    /*
+     * filename: Filename that specifies a file that contains the configuration
+     *           of the guest in Independent Guest Virtual Machine (IGVM)
+     *           format.
+     */
+    char *filename;
+} IgvmCfg;
+
+typedef struct IgvmCfgClass {
+    ObjectClass parent_class;
+
+    /*
+     * If an IGVM filename has been specified then process the IGVM file.
+     * Performs a no-op if no filename has been specified.
+     *
+     * Returns 0 for ok and -1 on error.
+     */
+    int (*process)(IgvmCfg *cfg, ConfidentialGuestSupport *cgs,
+                   Error **errp);
+
+} IgvmCfgClass;
+
+#define TYPE_IGVM_CFG "igvm-cfg"
+
+OBJECT_DECLARE_TYPE(IgvmCfg, IgvmCfgClass, IGVM_CFG)
+
+#endif
diff --git a/qapi/qom.json b/qapi/qom.json
index b133b06447..bbdb56dced 100644
--- a/qapi/qom.json
+++ b/qapi/qom.json
@@ -932,6 +932,19 @@
   'data': { '*filename': 'str' },
   'if': 'CONFIG_POSIX' }
 
+##
+# @IgvmCfgProperties:
+#
+# Properties common to objects that handle IGVM files.
+#
+# @file: IGVM file to use to configure guest
+#
+# Since: 10.1
+##
+{ 'struct': 'IgvmCfgProperties',
+  'if': 'CONFIG_IGVM',
+  'data': { 'file': 'str' } }
+
 ##
 # @SevCommonProperties:
 #
@@ -1142,6 +1155,8 @@
     'filter-redirector',
     'filter-replay',
     'filter-rewriter',
+    { 'name': 'igvm-cfg',
+      'if': 'CONFIG_IGVM' },
     'input-barrier',
     { 'name': 'input-linux',
       'if': 'CONFIG_LINUX' },
@@ -1218,6 +1233,8 @@
       'filter-redirector':          'FilterRedirectorProperties',
       'filter-replay':              'NetfilterProperties',
       'filter-rewriter':            'FilterRewriterProperties',
+      'igvm-cfg':                   { 'type': 'IgvmCfgProperties',
+                                      'if': 'CONFIG_IGVM' },
       'input-barrier':              'InputBarrierProperties',
       'input-linux':                { 'type': 'InputLinuxProperties',
                                       'if': 'CONFIG_LINUX' },

From 28e5ef4a6574cbaf6a5706d582b5b463b7f8d162 Mon Sep 17 00:00:00 2001
From: Roy Hopkins <roy.hopkins@randomman.co.uk>
Date: Thu, 3 Jul 2025 16:11:02 +0100
Subject: [PATCH 2164/2760] hw/i386: Add igvm-cfg object and processing for
 IGVM files

An IGVM file contains configuration of guest state that should be
applied during configuration of the guest, before the guest is started.

This patch allows the user to add an igvm-cfg object to an X86 machine
configuration that allows an IGVM file to be configured that will be
applied to the guest before it is started.

If an IGVM configuration is provided then the IGVM file is processed at
the end of the board initialization, before the state transition to
PHASE_MACHINE_INITIALIZED.

Signed-off-by: Roy Hopkins <roy.hopkins@randomman.co.uk>
Acked-by: Gerd Hoffman <kraxel@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Ani Sinha <anisinha@redhat.com>
Link: https://lore.kernel.org/r/23bc66ae4504ba5cf2134826e055b25df3fc9cd9.1751554099.git.roy.hopkins@randomman.co.uk
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/i386/pc.c          | 12 ++++++++++++
 hw/i386/pc_piix.c     | 10 ++++++++++
 hw/i386/pc_q35.c      | 10 ++++++++++
 include/hw/i386/x86.h |  3 +++
 qemu-options.hx       | 28 ++++++++++++++++++++++++++++
 5 files changed, 63 insertions(+)

diff --git a/hw/i386/pc.c b/hw/i386/pc.c
index b211633575..432ab288a8 100644
--- a/hw/i386/pc.c
+++ b/hw/i386/pc.c
@@ -1833,6 +1833,18 @@ static void pc_machine_class_init(ObjectClass *oc, const void *data)
     object_class_property_add_bool(oc, "fd-bootchk",
         pc_machine_get_fd_bootchk,
         pc_machine_set_fd_bootchk);
+
+#if defined(CONFIG_IGVM)
+    object_class_property_add_link(oc, "igvm-cfg",
+                                   TYPE_IGVM_CFG,
+                                   offsetof(X86MachineState, igvm),
+                                   object_property_allow_set_link,
+                                   OBJ_PROP_LINK_STRONG);
+    object_class_property_set_description(oc, "igvm-cfg",
+                                          "Set IGVM configuration");
+#endif
+
+
 }
 
 static const TypeInfo pc_machine_info = {
diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
index ea7572e783..3184ea1b37 100644
--- a/hw/i386/pc_piix.c
+++ b/hw/i386/pc_piix.c
@@ -366,6 +366,16 @@ static void pc_init1(MachineState *machine, const char *pci_type)
                                x86_nvdimm_acpi_dsmio,
                                x86ms->fw_cfg, OBJECT(pcms));
     }
+
+#if defined(CONFIG_IGVM)
+    /* Apply guest state from IGVM if supplied */
+    if (x86ms->igvm) {
+        if (IGVM_CFG_GET_CLASS(x86ms->igvm)
+                ->process(x86ms->igvm, machine->cgs, &error_fatal) < 0) {
+            g_assert_not_reached();
+        }
+    }
+#endif
 }
 
 typedef enum PCSouthBridgeOption {
diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
index 33211b1876..6990e1c669 100644
--- a/hw/i386/pc_q35.c
+++ b/hw/i386/pc_q35.c
@@ -325,6 +325,16 @@ static void pc_q35_init(MachineState *machine)
                                x86_nvdimm_acpi_dsmio,
                                x86ms->fw_cfg, OBJECT(pcms));
     }
+
+#if defined(CONFIG_IGVM)
+    /* Apply guest state from IGVM if supplied */
+    if (x86ms->igvm) {
+        if (IGVM_CFG_GET_CLASS(x86ms->igvm)
+                ->process(x86ms->igvm, machine->cgs, &error_fatal) < 0) {
+            g_assert_not_reached();
+        }
+    }
+#endif
 }
 
 #define DEFINE_Q35_MACHINE(major, minor) \
diff --git a/include/hw/i386/x86.h b/include/hw/i386/x86.h
index fc460b82f8..8755cad50a 100644
--- a/include/hw/i386/x86.h
+++ b/include/hw/i386/x86.h
@@ -25,6 +25,7 @@
 #include "hw/intc/ioapic.h"
 #include "hw/isa/isa.h"
 #include "qom/object.h"
+#include "system/igvm-cfg.h"
 
 struct X86MachineClass {
     MachineClass parent;
@@ -92,6 +93,8 @@ struct X86MachineState {
      * which means no limitation on the guest's bus locks.
      */
     uint64_t bus_lock_ratelimit;
+
+    IgvmCfg *igvm;
 };
 
 #define X86_MACHINE_SMM              "smm"
diff --git a/qemu-options.hx b/qemu-options.hx
index 1f862b19a6..f4c05b388b 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -5992,6 +5992,34 @@ SRST
                  -machine ...,memory-encryption=sev0 \\
                  .....
 
+    ``-object igvm-cfg,file=file``
+        Create an IGVM configuration object that defines the initial state
+        of the guest using a file in that conforms to the Independent Guest
+        Virtual Machine (IGVM) file format.
+
+        This is currently only supported by ``-machine q35`` and
+        ``-machine pc``.
+
+        The ``file`` parameter is used to specify the IGVM file to load.
+        When provided, the IGVM file is used to populate the initial
+        memory of the virtual machine and, depending on the platform, can
+        define the initial processor state, memory map and parameters.
+
+        The IGVM file is expected to contain the firmware for the virtual
+        machine, therefore an ``igvm-cfg`` object cannot be provided along
+        with other ways of specifying firmware, such as the ``-bios``
+        parameter on x86 machines.
+
+        e.g to launch a machine providing the firmware in an IGVM file
+
+        .. parsed-literal::
+
+             # |qemu_system_x86| \\
+                 ...... \\
+                 -object igvm-cfg,id=igvm0,file=bios.igvm \\
+                 -machine ...,igvm-cfg=igvm0 \\
+                 .....
+
     ``-object authz-simple,id=id,identity=string``
         Create an authorization object that will control access to
         network services.

From 170beda3cf4381e0b824ac96e06367391a669dca Mon Sep 17 00:00:00 2001
From: Roy Hopkins <roy.hopkins@randomman.co.uk>
Date: Thu, 3 Jul 2025 16:15:34 +0100
Subject: [PATCH 2165/2760] i386/pc_sysfw: Ensure sysfw flash configuration
 does not conflict with IGVM
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When using an IGVM file the configuration of the system firmware is
defined by IGVM directives contained in the file. In this case the user
should not configure any pflash devices.

This commit skips initialization of the ROM mode when pflash0 is not set
then checks to ensure no pflash devices have been configured when using
IGVM, exiting with an error message if this is not the case.

Signed-off-by: Roy Hopkins <roy.hopkins@randomman.co.uk>
Acked-by: Gerd Hoffman <kraxel@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Pankaj Gupta <pankaj.gupta@amd.com>
Reviewed-by: Ani Sinha <anisinha@redhat.com>
Link: https://lore.kernel.org/r/c6166cfe128933b04003a9288566b7affe170dfe.1751554099.git.roy.hopkins@randomman.co.uk
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/i386/pc_sysfw.c | 31 ++++++++++++++++++++++++++++---
 1 file changed, 28 insertions(+), 3 deletions(-)

diff --git a/hw/i386/pc_sysfw.c b/hw/i386/pc_sysfw.c
index 821396c16e..1a12b635ad 100644
--- a/hw/i386/pc_sysfw.c
+++ b/hw/i386/pc_sysfw.c
@@ -220,7 +220,13 @@ void pc_system_firmware_init(PCMachineState *pcms,
     BlockBackend *pflash_blk[ARRAY_SIZE(pcms->flash)];
 
     if (!pcmc->pci_enabled) {
-        x86_bios_rom_init(X86_MACHINE(pcms), "bios.bin", rom_memory, true);
+        /*
+         * If an IGVM file is specified then the firmware must be provided
+         * in the IGVM file.
+         */
+        if (!X86_MACHINE(pcms)->igvm) {
+            x86_bios_rom_init(X86_MACHINE(pcms), "bios.bin", rom_memory, true);
+        }
         return;
     }
 
@@ -240,8 +246,13 @@ void pc_system_firmware_init(PCMachineState *pcms,
     }
 
     if (!pflash_blk[0]) {
-        /* Machine property pflash0 not set, use ROM mode */
-        x86_bios_rom_init(X86_MACHINE(pcms), "bios.bin", rom_memory, false);
+        /*
+         * Machine property pflash0 not set, use ROM mode unless using IGVM,
+         * in which case the firmware must be provided by the IGVM file.
+         */
+        if (!X86_MACHINE(pcms)->igvm) {
+            x86_bios_rom_init(X86_MACHINE(pcms), "bios.bin", rom_memory, false);
+        }
     } else {
         if (kvm_enabled() && !kvm_readonly_mem_enabled()) {
             /*
@@ -257,6 +268,20 @@ void pc_system_firmware_init(PCMachineState *pcms,
     }
 
     pc_system_flash_cleanup_unused(pcms);
+
+    /*
+     * The user should not have specified any pflash devices when using IGVM
+     * to configure the guest.
+     */
+    if (X86_MACHINE(pcms)->igvm) {
+        for (i = 0; i < ARRAY_SIZE(pcms->flash); i++) {
+            if (pcms->flash[i]) {
+                error_report("pflash devices cannot be configured when "
+                             "using IGVM");
+                exit(1);
+            }
+        }
+    }
 }
 
 void x86_firmware_configure(hwaddr gpa, void *ptr, int size)

From 224e807f90a008dac1e4ba52e1bebc93b00472dd Mon Sep 17 00:00:00 2001
From: Roy Hopkins <roy.hopkins@randomman.co.uk>
Date: Thu, 3 Jul 2025 16:21:32 +0100
Subject: [PATCH 2166/2760] sev: Update launch_update_data functions to use
 Error handling

The class function and implementations for updating launch data return
a code in case of error. In some cases an error message is generated and
in other cases, just the error return value is used.

This small refactor adds an 'Error **errp' parameter to all functions
which consistently set an error condition if a non-zero value is
returned.

Signed-off-by: Roy Hopkins <roy.hopkins@randomman.co.uk>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Gerd Hoffman <kraxel@redhat.com>
Reviewed-by: Pankaj Gupta <pankaj.gupta@amd.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Ani Sinha <anisinha@redhat.com>
Link: https://lore.kernel.org/r/d59721f7b99cfc87aab71f8f551937e98e983615.1751554099.git.roy.hopkins@randomman.co.uk
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/sev.c | 68 +++++++++++++++++++++++------------------------
 1 file changed, 33 insertions(+), 35 deletions(-)

diff --git a/target/i386/sev.c b/target/i386/sev.c
index 1a12f0671c..a84f5f5d28 100644
--- a/target/i386/sev.c
+++ b/target/i386/sev.c
@@ -122,7 +122,8 @@ struct SevCommonStateClass {
                                        Error **errp);
     int (*launch_start)(SevCommonState *sev_common);
     void (*launch_finish)(SevCommonState *sev_common);
-    int (*launch_update_data)(SevCommonState *sev_common, hwaddr gpa, uint8_t *ptr, size_t len);
+    int (*launch_update_data)(SevCommonState *sev_common, hwaddr gpa,
+                              uint8_t *ptr, size_t len, Error **errp);
     int (*kvm_init)(ConfidentialGuestSupport *cgs, Error **errp);
 };
 
@@ -970,9 +971,8 @@ sev_snp_adjust_cpuid_features(X86ConfidentialGuest *cg, uint32_t feature, uint32
     return value;
 }
 
-static int
-sev_launch_update_data(SevCommonState *sev_common, hwaddr gpa,
-                       uint8_t *addr, size_t len)
+static int sev_launch_update_data(SevCommonState *sev_common, hwaddr gpa,
+                                  uint8_t *addr, size_t len, Error **errp)
 {
     int ret, fw_error;
     struct kvm_sev_launch_update_data update;
@@ -987,8 +987,8 @@ sev_launch_update_data(SevCommonState *sev_common, hwaddr gpa,
     ret = sev_ioctl(sev_common->sev_fd, KVM_SEV_LAUNCH_UPDATE_DATA,
                     &update, &fw_error);
     if (ret) {
-        error_report("%s: LAUNCH_UPDATE ret=%d fw_error=%d '%s'",
-                __func__, ret, fw_error, fw_error_to_str(fw_error));
+        error_setg(errp, "%s: LAUNCH_UPDATE ret=%d fw_error=%d '%s'", __func__,
+                   ret, fw_error, fw_error_to_str(fw_error));
     }
 
     return ret;
@@ -1116,8 +1116,8 @@ sev_launch_finish(SevCommonState *sev_common)
     migrate_add_blocker(&sev_mig_blocker, &error_fatal);
 }
 
-static int
-snp_launch_update_data(uint64_t gpa, void *hva, size_t len, int type)
+static int snp_launch_update_data(uint64_t gpa, void *hva, size_t len,
+                                  int type, Error **errp)
 {
     SevLaunchUpdateData *data;
 
@@ -1132,23 +1132,21 @@ snp_launch_update_data(uint64_t gpa, void *hva, size_t len, int type)
     return 0;
 }
 
-static int
-sev_snp_launch_update_data(SevCommonState *sev_common, hwaddr gpa,
-                           uint8_t *ptr, size_t len)
+static int sev_snp_launch_update_data(SevCommonState *sev_common, hwaddr gpa,
+                                      uint8_t *ptr, size_t len, Error **errp)
 {
-       int ret = snp_launch_update_data(gpa, ptr, len,
-                                         KVM_SEV_SNP_PAGE_TYPE_NORMAL);
-       return ret;
+    return snp_launch_update_data(gpa, ptr, len,
+                                     KVM_SEV_SNP_PAGE_TYPE_NORMAL, errp);
 }
 
 static int
 sev_snp_cpuid_info_fill(SnpCpuidInfo *snp_cpuid_info,
-                        const KvmCpuidInfo *kvm_cpuid_info)
+                        const KvmCpuidInfo *kvm_cpuid_info, Error **errp)
 {
     size_t i;
 
     if (kvm_cpuid_info->cpuid.nent > SNP_CPUID_FUNCTION_MAXCOUNT) {
-        error_report("SEV-SNP: CPUID entry count (%d) exceeds max (%d)",
+        error_setg(errp, "SEV-SNP: CPUID entry count (%d) exceeds max (%d)",
                      kvm_cpuid_info->cpuid.nent, SNP_CPUID_FUNCTION_MAXCOUNT);
         return -1;
     }
@@ -1190,8 +1188,8 @@ sev_snp_cpuid_info_fill(SnpCpuidInfo *snp_cpuid_info,
     return 0;
 }
 
-static int
-snp_launch_update_cpuid(uint32_t cpuid_addr, void *hva, size_t cpuid_len)
+static int snp_launch_update_cpuid(uint32_t cpuid_addr, void *hva,
+                                   size_t cpuid_len, Error **errp)
 {
     KvmCpuidInfo kvm_cpuid_info = {0};
     SnpCpuidInfo snp_cpuid_info;
@@ -1208,26 +1206,25 @@ snp_launch_update_cpuid(uint32_t cpuid_addr, void *hva, size_t cpuid_len)
     } while (ret == -E2BIG);
 
     if (ret) {
-        error_report("SEV-SNP: unable to query CPUID values for CPU: '%s'",
-                     strerror(-ret));
-        return 1;
+        error_setg(errp, "SEV-SNP: unable to query CPUID values for CPU: '%s'",
+                   strerror(-ret));
+        return -1;
     }
 
-    ret = sev_snp_cpuid_info_fill(&snp_cpuid_info, &kvm_cpuid_info);
-    if (ret) {
-        error_report("SEV-SNP: failed to generate CPUID table information");
-        return 1;
+    ret = sev_snp_cpuid_info_fill(&snp_cpuid_info, &kvm_cpuid_info, errp);
+    if (ret < 0) {
+        return -1;
     }
 
     memcpy(hva, &snp_cpuid_info, sizeof(snp_cpuid_info));
 
     return snp_launch_update_data(cpuid_addr, hva, cpuid_len,
-                                  KVM_SEV_SNP_PAGE_TYPE_CPUID);
+                                  KVM_SEV_SNP_PAGE_TYPE_CPUID, errp);
 }
 
-static int
-snp_launch_update_kernel_hashes(SevSnpGuestState *sev_snp, uint32_t addr,
-                                void *hva, uint32_t len)
+static int snp_launch_update_kernel_hashes(SevSnpGuestState *sev_snp,
+                                           uint32_t addr, void *hva,
+                                           uint32_t len, Error **errp)
 {
     int type = KVM_SEV_SNP_PAGE_TYPE_ZERO;
     if (sev_snp->parent_obj.kernel_hashes) {
@@ -1239,7 +1236,7 @@ snp_launch_update_kernel_hashes(SevSnpGuestState *sev_snp, uint32_t addr,
                sizeof(*sev_snp->kernel_hashes_data));
         type = KVM_SEV_SNP_PAGE_TYPE_NORMAL;
     }
-    return snp_launch_update_data(addr, hva, len, type);
+    return snp_launch_update_data(addr, hva, len, type, errp);
 }
 
 static int
@@ -1277,12 +1274,14 @@ snp_populate_metadata_pages(SevSnpGuestState *sev_snp,
         }
 
         if (type == KVM_SEV_SNP_PAGE_TYPE_CPUID) {
-            ret = snp_launch_update_cpuid(desc->base, hva, desc->len);
+            ret = snp_launch_update_cpuid(desc->base, hva, desc->len,
+                                          &error_fatal);
         } else if (desc->type == SEV_DESC_TYPE_SNP_KERNEL_HASHES) {
             ret = snp_launch_update_kernel_hashes(sev_snp, desc->base, hva,
-                                                  desc->len);
+                                                  desc->len, &error_fatal);
         } else {
-            ret = snp_launch_update_data(desc->base, hva, desc->len, type);
+            ret = snp_launch_update_data(desc->base, hva, desc->len, type,
+                                         &error_fatal);
         }
 
         if (ret) {
@@ -1615,9 +1614,8 @@ sev_encrypt_flash(hwaddr gpa, uint8_t *ptr, uint64_t len, Error **errp)
     if (sev_check_state(sev_common, SEV_STATE_LAUNCH_UPDATE)) {
         int ret;
 
-        ret = klass->launch_update_data(sev_common, gpa, ptr, len);
+        ret = klass->launch_update_data(sev_common, gpa, ptr, len, errp);
         if (ret < 0) {
-            error_setg(errp, "SEV: Failed to encrypt pflash rom");
             return ret;
         }
     }

From b0e8986668426dbd2bb3eee4c6e14fe6262ca34e Mon Sep 17 00:00:00 2001
From: Roy Hopkins <roy.hopkins@randomman.co.uk>
Date: Thu, 3 Jul 2025 16:31:58 +0100
Subject: [PATCH 2167/2760] target/i386: Allow setting of R_LDTR and R_TR with
 cpu_x86_load_seg_cache()

The x86 segment registers are identified by the X86Seg enumeration which
includes LDTR and TR as well as the normal segment registers. The
function 'cpu_x86_load_seg_cache()' uses the enum to determine which
segment to set. However, specifying R_LDTR or R_TR results in an
out-of-bounds access of the segment array.

Possibly by coincidence, the function does correctly set LDTR or TR in
this case as the structures for these registers immediately follow the
array which is accessed out of bounds.

This patch adds correct handling for R_LDTR and R_TR in the function.

Signed-off-by: Roy Hopkins <roy.hopkins@randomman.co.uk>
Acked-by: Gerd Hoffman <kraxel@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Ani Sinha <anisinha@redhat.com>
Link: https://lore.kernel.org/r/95c69253ea4f91107625872d5e3f0c586376771d.1751554099.git.roy.hopkins@randomman.co.uk
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.h | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index be3ae6d546..9829824ac8 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -2417,7 +2417,14 @@ static inline void cpu_x86_load_seg_cache(CPUX86State *env,
     SegmentCache *sc;
     unsigned int new_hflags;
 
-    sc = &env->segs[seg_reg];
+    if (seg_reg == R_LDTR) {
+        sc = &env->ldt;
+    } else if (seg_reg == R_TR) {
+        sc = &env->tr;
+    } else {
+        sc = &env->segs[seg_reg];
+    }
+
     sc->selector = selector;
     sc->base = base;
     sc->limit = limit;

From 4c7f0976b0d2afc892c10f6cc503e8b4607115e2 Mon Sep 17 00:00:00 2001
From: Roy Hopkins <roy.hopkins@randomman.co.uk>
Date: Thu, 3 Jul 2025 16:31:59 +0100
Subject: [PATCH 2168/2760] i386/sev: Refactor setting of reset vector and
 initial CPU state

When an SEV guest is started, the reset vector and state are
extracted from metadata that is contained in the firmware volume.

In preparation for using IGVM to setup the initial CPU state,
the code has been refactored to populate vmcb_save_area for each
CPU which is then applied during guest startup and CPU reset.

Signed-off-by: Roy Hopkins <roy.hopkins@randomman.co.uk>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Stefano Garzarella <sgarzare@redhat.com>
Acked-by: Gerd Hoffman <kraxel@redhat.com>
Reviewed-by: Pankaj Gupta <pankaj.gupta@amd.com>
Link: https://lore.kernel.org/r/d3c2debca496c4366a278b135f951908f3b9c341.1751554099.git.roy.hopkins@randomman.co.uk
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/sev.c | 326 +++++++++++++++++++++++++++++++++++++++++-----
 target/i386/sev.h | 110 ++++++++++++++++
 2 files changed, 401 insertions(+), 35 deletions(-)

diff --git a/target/i386/sev.c b/target/i386/sev.c
index a84f5f5d28..a13f91e615 100644
--- a/target/i386/sev.c
+++ b/target/i386/sev.c
@@ -50,6 +50,12 @@ OBJECT_DECLARE_TYPE(SevSnpGuestState, SevCommonStateClass, SEV_SNP_GUEST)
 /* hard code sha256 digest size */
 #define HASH_SIZE 32
 
+/* Convert between SEV-ES VMSA and SegmentCache flags/attributes */
+#define FLAGS_VMSA_TO_SEGCACHE(flags) \
+    ((((flags) & 0xff00) << 12) | (((flags) & 0xff) << 8))
+#define FLAGS_SEGCACHE_TO_VMSA(flags) \
+    ((((flags) & 0xff00) >> 8) | (((flags) & 0xf00000) >> 12))
+
 typedef struct QEMU_PACKED SevHashTableEntry {
     QemuUUID guid;
     uint16_t len;
@@ -89,6 +95,14 @@ typedef struct QEMU_PACKED SevHashTableDescriptor {
     uint32_t size;
 } SevHashTableDescriptor;
 
+typedef struct SevLaunchVmsa {
+    QTAILQ_ENTRY(SevLaunchVmsa) next;
+
+    uint16_t cpu_index;
+    uint64_t gpa;
+    struct sev_es_save_area vmsa;
+} SevLaunchVmsa;
+
 struct SevCommonState {
     X86ConfidentialGuest parent_obj;
 
@@ -107,9 +121,7 @@ struct SevCommonState {
     int sev_fd;
     SevState state;
 
-    uint32_t reset_cs;
-    uint32_t reset_ip;
-    bool reset_data_valid;
+    QTAILQ_HEAD(, SevLaunchVmsa) launch_vmsa;
 };
 
 struct SevCommonStateClass {
@@ -364,6 +376,172 @@ static struct RAMBlockNotifier sev_ram_notifier = {
     .ram_block_removed = sev_ram_block_removed,
 };
 
+static void sev_apply_cpu_context(CPUState *cpu)
+{
+    SevCommonState *sev_common = SEV_COMMON(MACHINE(qdev_get_machine())->cgs);
+    X86CPU *x86;
+    CPUX86State *env;
+    struct SevLaunchVmsa *launch_vmsa;
+
+    /* See if an initial VMSA has been provided for this CPU */
+    QTAILQ_FOREACH(launch_vmsa, &sev_common->launch_vmsa, next)
+    {
+        if (cpu->cpu_index == launch_vmsa->cpu_index) {
+            x86 = X86_CPU(cpu);
+            env = &x86->env;
+
+            /*
+             * Ideally we would provide the VMSA directly to kvm which would
+             * ensure that the resulting initial VMSA measurement which is
+             * calculated during KVM_SEV_LAUNCH_UPDATE_VMSA is calculated from
+             * exactly what we provide here. Currently this is not possible so
+             * we need to copy the parts of the VMSA structure that we currently
+             * support into the CPU state.
+             */
+            cpu_load_efer(env, launch_vmsa->vmsa.efer);
+            cpu_x86_update_cr4(env, launch_vmsa->vmsa.cr4);
+            cpu_x86_update_cr0(env, launch_vmsa->vmsa.cr0);
+            cpu_x86_update_cr3(env, launch_vmsa->vmsa.cr3);
+            env->xcr0 = launch_vmsa->vmsa.xcr0;
+            env->pat = launch_vmsa->vmsa.g_pat;
+
+            cpu_x86_load_seg_cache(
+                env, R_CS, launch_vmsa->vmsa.cs.selector,
+                launch_vmsa->vmsa.cs.base, launch_vmsa->vmsa.cs.limit,
+                FLAGS_VMSA_TO_SEGCACHE(launch_vmsa->vmsa.cs.attrib));
+            cpu_x86_load_seg_cache(
+                env, R_DS, launch_vmsa->vmsa.ds.selector,
+                launch_vmsa->vmsa.ds.base, launch_vmsa->vmsa.ds.limit,
+                FLAGS_VMSA_TO_SEGCACHE(launch_vmsa->vmsa.ds.attrib));
+            cpu_x86_load_seg_cache(
+                env, R_ES, launch_vmsa->vmsa.es.selector,
+                launch_vmsa->vmsa.es.base, launch_vmsa->vmsa.es.limit,
+                FLAGS_VMSA_TO_SEGCACHE(launch_vmsa->vmsa.es.attrib));
+            cpu_x86_load_seg_cache(
+                env, R_FS, launch_vmsa->vmsa.fs.selector,
+                launch_vmsa->vmsa.fs.base, launch_vmsa->vmsa.fs.limit,
+                FLAGS_VMSA_TO_SEGCACHE(launch_vmsa->vmsa.fs.attrib));
+            cpu_x86_load_seg_cache(
+                env, R_GS, launch_vmsa->vmsa.gs.selector,
+                launch_vmsa->vmsa.gs.base, launch_vmsa->vmsa.gs.limit,
+                FLAGS_VMSA_TO_SEGCACHE(launch_vmsa->vmsa.gs.attrib));
+            cpu_x86_load_seg_cache(
+                env, R_SS, launch_vmsa->vmsa.ss.selector,
+                launch_vmsa->vmsa.ss.base, launch_vmsa->vmsa.ss.limit,
+                FLAGS_VMSA_TO_SEGCACHE(launch_vmsa->vmsa.ss.attrib));
+
+            env->gdt.base = launch_vmsa->vmsa.gdtr.base;
+            env->gdt.limit = launch_vmsa->vmsa.gdtr.limit;
+            env->gdt.flags =
+                FLAGS_VMSA_TO_SEGCACHE(launch_vmsa->vmsa.gdtr.attrib);
+            env->idt.base = launch_vmsa->vmsa.idtr.base;
+            env->idt.limit = launch_vmsa->vmsa.idtr.limit;
+            env->idt.flags =
+                FLAGS_VMSA_TO_SEGCACHE(launch_vmsa->vmsa.idtr.attrib);
+
+            cpu_x86_load_seg_cache(
+                env, R_LDTR, launch_vmsa->vmsa.ldtr.selector,
+                launch_vmsa->vmsa.ldtr.base, launch_vmsa->vmsa.ldtr.limit,
+                FLAGS_VMSA_TO_SEGCACHE(launch_vmsa->vmsa.ldtr.attrib));
+            cpu_x86_load_seg_cache(
+                env, R_TR, launch_vmsa->vmsa.tr.selector,
+                launch_vmsa->vmsa.ldtr.base, launch_vmsa->vmsa.tr.limit,
+                FLAGS_VMSA_TO_SEGCACHE(launch_vmsa->vmsa.tr.attrib));
+
+            env->dr[6] = launch_vmsa->vmsa.dr6;
+            env->dr[7] = launch_vmsa->vmsa.dr7;
+
+            env->regs[R_EAX] = launch_vmsa->vmsa.rax;
+            env->regs[R_ECX] = launch_vmsa->vmsa.rcx;
+            env->regs[R_EDX] = launch_vmsa->vmsa.rdx;
+            env->regs[R_EBX] = launch_vmsa->vmsa.rbx;
+            env->regs[R_ESP] = launch_vmsa->vmsa.rsp;
+            env->regs[R_EBP] = launch_vmsa->vmsa.rbp;
+            env->regs[R_ESI] = launch_vmsa->vmsa.rsi;
+            env->regs[R_EDI] = launch_vmsa->vmsa.rdi;
+#ifdef TARGET_X86_64
+            env->regs[R_R8] = launch_vmsa->vmsa.r8;
+            env->regs[R_R9] = launch_vmsa->vmsa.r9;
+            env->regs[R_R10] = launch_vmsa->vmsa.r10;
+            env->regs[R_R11] = launch_vmsa->vmsa.r11;
+            env->regs[R_R12] = launch_vmsa->vmsa.r12;
+            env->regs[R_R13] = launch_vmsa->vmsa.r13;
+            env->regs[R_R14] = launch_vmsa->vmsa.r14;
+            env->regs[R_R15] = launch_vmsa->vmsa.r15;
+#endif
+            env->eip = launch_vmsa->vmsa.rip;
+            env->eflags = launch_vmsa->vmsa.rflags;
+
+            cpu_set_fpuc(env, launch_vmsa->vmsa.x87_fcw);
+            env->mxcsr = launch_vmsa->vmsa.mxcsr;
+
+            break;
+        }
+    }
+}
+
+static int sev_set_cpu_context(uint16_t cpu_index, const void *ctx,
+                               uint32_t ctx_len, hwaddr gpa, Error **errp)
+{
+    SevCommonState *sev_common = SEV_COMMON(MACHINE(qdev_get_machine())->cgs);
+    SevLaunchVmsa *launch_vmsa;
+    CPUState *cpu;
+    bool exists = false;
+
+    /*
+     * Setting the CPU context is only supported for SEV-ES and SEV-SNP. The
+     * context buffer will contain a sev_es_save_area from the Linux kernel
+     * which is defined by "Table B-4. VMSA Layout, State Save Area for SEV-ES"
+     * in the AMD64 APM, Volume 2.
+     */
+
+    if (!sev_es_enabled()) {
+        error_setg(errp, "SEV: unable to set CPU context: Not supported");
+        return -1;
+    }
+
+    if (ctx_len < sizeof(struct sev_es_save_area)) {
+        error_setg(errp, "SEV: unable to set CPU context: "
+                     "Invalid context provided");
+        return -1;
+    }
+
+    cpu = qemu_get_cpu(cpu_index);
+    if (!cpu) {
+        error_setg(errp, "SEV: unable to set CPU context for out of bounds "
+                     "CPU index %d", cpu_index);
+        return -1;
+    }
+
+    /*
+     * If the context of this VP has already been set then replace it with the
+     * new context.
+     */
+    QTAILQ_FOREACH(launch_vmsa, &sev_common->launch_vmsa, next)
+    {
+        if (cpu_index == launch_vmsa->cpu_index) {
+            launch_vmsa->gpa = gpa;
+            memcpy(&launch_vmsa->vmsa, ctx, sizeof(launch_vmsa->vmsa));
+            exists = true;
+            break;
+        }
+    }
+
+    if (!exists) {
+        /* New VP context */
+        launch_vmsa = g_new0(SevLaunchVmsa, 1);
+        memcpy(&launch_vmsa->vmsa, ctx, sizeof(launch_vmsa->vmsa));
+        launch_vmsa->cpu_index = cpu_index;
+        launch_vmsa->gpa = gpa;
+        QTAILQ_INSERT_TAIL(&sev_common->launch_vmsa, launch_vmsa, next);
+    }
+
+    /* Synchronise the VMSA with the current CPU state */
+    sev_apply_cpu_context(cpu);
+
+    return 0;
+}
+
 bool
 sev_enabled(void)
 {
@@ -998,6 +1176,16 @@ static int
 sev_launch_update_vmsa(SevGuestState *sev_guest)
 {
     int ret, fw_error;
+    CPUState *cpu;
+
+    /*
+     * The initial CPU state is measured as part of KVM_SEV_LAUNCH_UPDATE_VMSA.
+     * Synchronise the CPU state to any provided launch VMSA structures.
+     */
+    CPU_FOREACH(cpu) {
+        sev_apply_cpu_context(cpu);
+    }
+
 
     ret = sev_ioctl(SEV_COMMON(sev_guest)->sev_fd, KVM_SEV_LAUNCH_UPDATE_VMSA,
                     NULL, &fw_error);
@@ -1780,40 +1968,109 @@ sev_es_find_reset_vector(void *flash_ptr, uint64_t flash_size,
     return sev_es_parse_reset_block(info, addr);
 }
 
+
+static void seg_to_vmsa(const SegmentCache *cpu_seg, struct vmcb_seg *vmsa_seg)
+{
+    vmsa_seg->selector = cpu_seg->selector;
+    vmsa_seg->base = cpu_seg->base;
+    vmsa_seg->limit = cpu_seg->limit;
+    vmsa_seg->attrib = FLAGS_SEGCACHE_TO_VMSA(cpu_seg->flags);
+}
+
+static void initialize_vmsa(const CPUState *cpu, struct sev_es_save_area *vmsa)
+{
+    const X86CPU *x86 = X86_CPU(cpu);
+    const CPUX86State *env = &x86->env;
+
+    /*
+     * Initialize the SEV-ES save area from the current state of
+     * the CPU. The entire state does not need to be copied, only the state
+     * that is copied back to the CPUState in sev_apply_cpu_context.
+     */
+    memset(vmsa, 0, sizeof(struct sev_es_save_area));
+    vmsa->efer = env->efer;
+    vmsa->cr0 = env->cr[0];
+    vmsa->cr3 = env->cr[3];
+    vmsa->cr4 = env->cr[4];
+    vmsa->xcr0 = env->xcr0;
+    vmsa->g_pat = env->pat;
+
+    seg_to_vmsa(&env->segs[R_CS], &vmsa->cs);
+    seg_to_vmsa(&env->segs[R_DS], &vmsa->ds);
+    seg_to_vmsa(&env->segs[R_ES], &vmsa->es);
+    seg_to_vmsa(&env->segs[R_FS], &vmsa->fs);
+    seg_to_vmsa(&env->segs[R_GS], &vmsa->gs);
+    seg_to_vmsa(&env->segs[R_SS], &vmsa->ss);
+
+    seg_to_vmsa(&env->gdt, &vmsa->gdtr);
+    seg_to_vmsa(&env->idt, &vmsa->idtr);
+    seg_to_vmsa(&env->ldt, &vmsa->ldtr);
+    seg_to_vmsa(&env->tr, &vmsa->tr);
+
+    vmsa->dr6 = env->dr[6];
+    vmsa->dr7 = env->dr[7];
+
+    vmsa->rax = env->regs[R_EAX];
+    vmsa->rcx = env->regs[R_ECX];
+    vmsa->rdx = env->regs[R_EDX];
+    vmsa->rbx = env->regs[R_EBX];
+    vmsa->rsp = env->regs[R_ESP];
+    vmsa->rbp = env->regs[R_EBP];
+    vmsa->rsi = env->regs[R_ESI];
+    vmsa->rdi = env->regs[R_EDI];
+
+#ifdef TARGET_X86_64
+    vmsa->r8 = env->regs[R_R8];
+    vmsa->r9 = env->regs[R_R9];
+    vmsa->r10 = env->regs[R_R10];
+    vmsa->r11 = env->regs[R_R11];
+    vmsa->r12 = env->regs[R_R12];
+    vmsa->r13 = env->regs[R_R13];
+    vmsa->r14 = env->regs[R_R14];
+    vmsa->r15 = env->regs[R_R15];
+#endif
+
+    vmsa->rip = env->eip;
+    vmsa->rflags = env->eflags;
+}
+
+static void sev_es_set_ap_context(uint32_t reset_addr)
+{
+    CPUState *cpu;
+    struct sev_es_save_area vmsa;
+    SegmentCache cs;
+
+    cs.selector = 0xf000;
+    cs.base = reset_addr & 0xffff0000;
+    cs.limit = 0xffff;
+    cs.flags = DESC_P_MASK | DESC_S_MASK | DESC_CS_MASK | DESC_R_MASK |
+               DESC_A_MASK;
+
+    CPU_FOREACH(cpu) {
+        if (cpu->cpu_index == 0) {
+            /* Do not update the BSP reset state */
+            continue;
+        }
+        initialize_vmsa(cpu, &vmsa);
+        seg_to_vmsa(&cs, &vmsa.cs);
+        vmsa.rip = reset_addr & 0x0000ffff;
+        sev_set_cpu_context(cpu->cpu_index, &vmsa,
+                            sizeof(struct sev_es_save_area),
+                            0, &error_fatal);
+    }
+}
+
 void sev_es_set_reset_vector(CPUState *cpu)
 {
-    X86CPU *x86;
-    CPUX86State *env;
-    ConfidentialGuestSupport *cgs = MACHINE(qdev_get_machine())->cgs;
-    SevCommonState *sev_common = SEV_COMMON(
-        object_dynamic_cast(OBJECT(cgs), TYPE_SEV_COMMON));
-
-    /* Only update if we have valid reset information */
-    if (!sev_common || !sev_common->reset_data_valid) {
-        return;
+    if (sev_enabled()) {
+        sev_apply_cpu_context(cpu);
     }
-
-    /* Do not update the BSP reset state */
-    if (cpu->cpu_index == 0) {
-        return;
-    }
-
-    x86 = X86_CPU(cpu);
-    env = &x86->env;
-
-    cpu_x86_load_seg_cache(env, R_CS, 0xf000, sev_common->reset_cs, 0xffff,
-                           DESC_P_MASK | DESC_S_MASK | DESC_CS_MASK |
-                           DESC_R_MASK | DESC_A_MASK);
-
-    env->eip = sev_common->reset_ip;
 }
 
 int sev_es_save_reset_vector(void *flash_ptr, uint64_t flash_size)
 {
-    CPUState *cpu;
     uint32_t addr;
     int ret;
-    SevCommonState *sev_common = SEV_COMMON(MACHINE(qdev_get_machine())->cgs);
 
     if (!sev_es_enabled()) {
         return 0;
@@ -1826,14 +2083,12 @@ int sev_es_save_reset_vector(void *flash_ptr, uint64_t flash_size)
         return ret;
     }
 
+    /*
+     * The reset vector is saved into a CPU context for each AP but not for
+     * the BSP. This is applied during guest startup or when the CPU is reset.
+     */
     if (addr) {
-        sev_common->reset_cs = addr & 0xffff0000;
-        sev_common->reset_ip = addr & 0x0000ffff;
-        sev_common->reset_data_valid = true;
-
-        CPU_FOREACH(cpu) {
-            sev_es_set_reset_vector(cpu);
-        }
+        sev_es_set_ap_context(addr);
     }
 
     return 0;
@@ -2068,6 +2323,7 @@ sev_common_instance_init(Object *obj)
     object_property_add_uint32_ptr(obj, "reduced-phys-bits",
                                    &sev_common->reduced_phys_bits,
                                    OBJ_PROP_FLAG_READWRITE);
+    QTAILQ_INIT(&sev_common->launch_vmsa);
 }
 
 /* sev guest info common to sev/sev-es/sev-snp */
diff --git a/target/i386/sev.h b/target/i386/sev.h
index 373669eaac..38caa849f5 100644
--- a/target/i386/sev.h
+++ b/target/i386/sev.h
@@ -55,6 +55,116 @@ typedef struct SevKernelLoaderContext {
     size_t cmdline_size;
 } SevKernelLoaderContext;
 
+/* Save area definition for SEV-ES and SEV-SNP guests */
+struct QEMU_PACKED sev_es_save_area {
+    struct vmcb_seg es;
+    struct vmcb_seg cs;
+    struct vmcb_seg ss;
+    struct vmcb_seg ds;
+    struct vmcb_seg fs;
+    struct vmcb_seg gs;
+    struct vmcb_seg gdtr;
+    struct vmcb_seg ldtr;
+    struct vmcb_seg idtr;
+    struct vmcb_seg tr;
+    uint64_t vmpl0_ssp;
+    uint64_t vmpl1_ssp;
+    uint64_t vmpl2_ssp;
+    uint64_t vmpl3_ssp;
+    uint64_t u_cet;
+    uint8_t reserved_0xc8[2];
+    uint8_t vmpl;
+    uint8_t cpl;
+    uint8_t reserved_0xcc[4];
+    uint64_t efer;
+    uint8_t reserved_0xd8[104];
+    uint64_t xss;
+    uint64_t cr4;
+    uint64_t cr3;
+    uint64_t cr0;
+    uint64_t dr7;
+    uint64_t dr6;
+    uint64_t rflags;
+    uint64_t rip;
+    uint64_t dr0;
+    uint64_t dr1;
+    uint64_t dr2;
+    uint64_t dr3;
+    uint64_t dr0_addr_mask;
+    uint64_t dr1_addr_mask;
+    uint64_t dr2_addr_mask;
+    uint64_t dr3_addr_mask;
+    uint8_t reserved_0x1c0[24];
+    uint64_t rsp;
+    uint64_t s_cet;
+    uint64_t ssp;
+    uint64_t isst_addr;
+    uint64_t rax;
+    uint64_t star;
+    uint64_t lstar;
+    uint64_t cstar;
+    uint64_t sfmask;
+    uint64_t kernel_gs_base;
+    uint64_t sysenter_cs;
+    uint64_t sysenter_esp;
+    uint64_t sysenter_eip;
+    uint64_t cr2;
+    uint8_t reserved_0x248[32];
+    uint64_t g_pat;
+    uint64_t dbgctl;
+    uint64_t br_from;
+    uint64_t br_to;
+    uint64_t last_excp_from;
+    uint64_t last_excp_to;
+    uint8_t reserved_0x298[80];
+    uint32_t pkru;
+    uint32_t tsc_aux;
+    uint8_t reserved_0x2f0[24];
+    uint64_t rcx;
+    uint64_t rdx;
+    uint64_t rbx;
+    uint64_t reserved_0x320; /* rsp already available at 0x01d8 */
+    uint64_t rbp;
+    uint64_t rsi;
+    uint64_t rdi;
+    uint64_t r8;
+    uint64_t r9;
+    uint64_t r10;
+    uint64_t r11;
+    uint64_t r12;
+    uint64_t r13;
+    uint64_t r14;
+    uint64_t r15;
+    uint8_t reserved_0x380[16];
+    uint64_t guest_exit_info_1;
+    uint64_t guest_exit_info_2;
+    uint64_t guest_exit_int_info;
+    uint64_t guest_nrip;
+    uint64_t sev_features;
+    uint64_t vintr_ctrl;
+    uint64_t guest_exit_code;
+    uint64_t virtual_tom;
+    uint64_t tlb_id;
+    uint64_t pcpu_id;
+    uint64_t event_inj;
+    uint64_t xcr0;
+    uint8_t reserved_0x3f0[16];
+
+    /* Floating point area */
+    uint64_t x87_dp;
+    uint32_t mxcsr;
+    uint16_t x87_ftw;
+    uint16_t x87_fsw;
+    uint16_t x87_fcw;
+    uint16_t x87_fop;
+    uint16_t x87_ds;
+    uint16_t x87_cs;
+    uint64_t x87_rip;
+    uint8_t fpreg_x87[80];
+    uint8_t fpreg_xmm[256];
+    uint8_t fpreg_ymm[256];
+};
+
 bool sev_add_kernel_loader_hashes(SevKernelLoaderContext *ctx, Error **errp);
 
 int sev_encrypt_flash(hwaddr gpa, uint8_t *ptr, uint64_t len, Error **errp);

From 86e85eb1d41d1f2b328be812d3390d47055b620f Mon Sep 17 00:00:00 2001
From: Roy Hopkins <roy.hopkins@randomman.co.uk>
Date: Thu, 3 Jul 2025 16:34:41 +0100
Subject: [PATCH 2169/2760] i386/sev: Implement ConfidentialGuestSupport
 functions for SEV

The ConfidentialGuestSupport object defines a number of virtual
functions that are called during processing of IGVM directives to query
or configure initial guest state. In order to support processing of IGVM
files, these functions need to be implemented by relevant isolation
hardware support code such as SEV.

This commit implements the required functions for SEV-ES and adds
support for processing IGVM files for configuring the guest.

Signed-off-by: Roy Hopkins <roy.hopkins@randomman.co.uk>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Stefano Garzarella <sgarzare@redhat.com>
Acked-by: Gerd Hoffman <kraxel@redhat.com>
Reviewed-by: Ani Sinha <anisinha@redhat.com>
Link: https://lore.kernel.org/r/7145835f729e6195f2fbda308aa90e089a96ae6e.1751554099.git.roy.hopkins@randomman.co.uk
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/sev.c | 254 ++++++++++++++++++++++++++++++++++++++++++++--
 target/i386/sev.h |   2 +
 2 files changed, 246 insertions(+), 10 deletions(-)

diff --git a/target/i386/sev.c b/target/i386/sev.c
index a13f91e615..1296f4feb6 100644
--- a/target/i386/sev.c
+++ b/target/i386/sev.c
@@ -41,7 +41,9 @@
 #include "confidential-guest.h"
 #include "hw/i386/pc.h"
 #include "system/address-spaces.h"
+#include "hw/i386/e820_memory_layout.h"
 #include "qemu/queue.h"
+#include "qemu/cutils.h"
 
 OBJECT_DECLARE_TYPE(SevCommonState, SevCommonStateClass, SEV_COMMON)
 OBJECT_DECLARE_TYPE(SevGuestState, SevCommonStateClass, SEV_GUEST)
@@ -50,6 +52,9 @@ OBJECT_DECLARE_TYPE(SevSnpGuestState, SevCommonStateClass, SEV_SNP_GUEST)
 /* hard code sha256 digest size */
 #define HASH_SIZE 32
 
+/* Hard coded GPA that KVM uses for the VMSA */
+#define KVM_VMSA_GPA 0xFFFFFFFFF000
+
 /* Convert between SEV-ES VMSA and SegmentCache flags/attributes */
 #define FLAGS_VMSA_TO_SEGCACHE(flags) \
     ((((flags) & 0xff00) << 12) | (((flags) & 0xff) << 8))
@@ -480,6 +485,103 @@ static void sev_apply_cpu_context(CPUState *cpu)
     }
 }
 
+static int check_vmsa_supported(hwaddr gpa, const struct sev_es_save_area *vmsa,
+                                Error **errp)
+{
+    struct sev_es_save_area vmsa_check;
+
+    /*
+     * KVM always populates the VMSA at a fixed GPA which cannot be modified
+     * from userspace. Specifying a different GPA will not prevent the guest
+     * from starting but will cause the launch measurement to be different
+     * from expected. Therefore check that the provided GPA matches the KVM
+     * hardcoded value.
+     */
+    if (gpa != KVM_VMSA_GPA) {
+        error_setg(errp,
+                "%s: The VMSA GPA must be %lX but is specified as %lX",
+                __func__, KVM_VMSA_GPA, gpa);
+        return -1;
+    }
+
+    /*
+     * Clear all supported fields so we can then check the entire structure
+     * is zero.
+     */
+    memcpy(&vmsa_check, vmsa, sizeof(struct sev_es_save_area));
+    memset(&vmsa_check.es, 0, sizeof(vmsa_check.es));
+    memset(&vmsa_check.cs, 0, sizeof(vmsa_check.cs));
+    memset(&vmsa_check.ss, 0, sizeof(vmsa_check.ss));
+    memset(&vmsa_check.ds, 0, sizeof(vmsa_check.ds));
+    memset(&vmsa_check.fs, 0, sizeof(vmsa_check.fs));
+    memset(&vmsa_check.gs, 0, sizeof(vmsa_check.gs));
+    memset(&vmsa_check.gdtr, 0, sizeof(vmsa_check.gdtr));
+    memset(&vmsa_check.idtr, 0, sizeof(vmsa_check.idtr));
+    memset(&vmsa_check.ldtr, 0, sizeof(vmsa_check.ldtr));
+    memset(&vmsa_check.tr, 0, sizeof(vmsa_check.tr));
+    vmsa_check.efer = 0;
+    vmsa_check.cr0 = 0;
+    vmsa_check.cr3 = 0;
+    vmsa_check.cr4 = 0;
+    vmsa_check.xcr0 = 0;
+    vmsa_check.dr6 = 0;
+    vmsa_check.dr7 = 0;
+    vmsa_check.rax = 0;
+    vmsa_check.rcx = 0;
+    vmsa_check.rdx = 0;
+    vmsa_check.rbx = 0;
+    vmsa_check.rsp = 0;
+    vmsa_check.rbp = 0;
+    vmsa_check.rsi = 0;
+    vmsa_check.rdi = 0;
+    vmsa_check.r8 = 0;
+    vmsa_check.r9 = 0;
+    vmsa_check.r10 = 0;
+    vmsa_check.r11 = 0;
+    vmsa_check.r12 = 0;
+    vmsa_check.r13 = 0;
+    vmsa_check.r14 = 0;
+    vmsa_check.r15 = 0;
+    vmsa_check.rip = 0;
+    vmsa_check.rflags = 0;
+
+    vmsa_check.g_pat = 0;
+    vmsa_check.xcr0 = 0;
+
+    vmsa_check.x87_fcw = 0;
+    vmsa_check.mxcsr = 0;
+
+    if (sev_snp_enabled()) {
+        if (vmsa_check.sev_features != SVM_SEV_FEAT_SNP_ACTIVE) {
+            error_setg(errp,
+                       "%s: sev_features in the VMSA contains an unsupported "
+                       "value. For SEV-SNP, sev_features must be set to %x.",
+                       __func__, SVM_SEV_FEAT_SNP_ACTIVE);
+            return -1;
+        }
+        vmsa_check.sev_features = 0;
+    } else {
+        if (vmsa_check.sev_features != 0) {
+            error_setg(errp,
+                       "%s: sev_features in the VMSA contains an unsupported "
+                       "value. For SEV-ES and SEV, sev_features must be "
+                       "set to 0.", __func__);
+            return -1;
+        }
+    }
+
+    if (!buffer_is_zero(&vmsa_check, sizeof(vmsa_check))) {
+        error_setg(errp,
+                "%s: The VMSA contains fields that are not "
+                "synchronized with KVM. Continuing would result in "
+                "either unpredictable guest behavior, or a "
+                "mismatched launch measurement.",
+                __func__);
+        return -1;
+    }
+    return 0;
+}
+
 static int sev_set_cpu_context(uint16_t cpu_index, const void *ctx,
                                uint32_t ctx_len, hwaddr gpa, Error **errp)
 {
@@ -1491,18 +1593,26 @@ sev_snp_launch_finish(SevCommonState *sev_common)
     struct kvm_sev_snp_launch_finish *finish = &sev_snp->kvm_finish_conf;
 
     /*
-     * To boot the SNP guest, the hypervisor is required to populate the CPUID
-     * and Secrets page before finalizing the launch flow. The location of
-     * the secrets and CPUID page is available through the OVMF metadata GUID.
+     * Populate all the metadata pages if not using an IGVM file. In the case
+     * where an IGVM file is provided it will be used to configure the metadata
+     * pages directly.
      */
-    metadata = pc_system_get_ovmf_sev_metadata_ptr();
-    if (metadata == NULL) {
-        error_report("%s: Failed to locate SEV metadata header", __func__);
-        exit(1);
-    }
+    if (!X86_MACHINE(qdev_get_machine())->igvm) {
+        /*
+         * To boot the SNP guest, the hypervisor is required to populate the
+         * CPUID and Secrets page before finalizing the launch flow. The
+         * location of the secrets and CPUID page is available through the
+         * OVMF metadata GUID.
+         */
+        metadata = pc_system_get_ovmf_sev_metadata_ptr();
+        if (metadata == NULL) {
+            error_report("%s: Failed to locate SEV metadata header", __func__);
+            exit(1);
+        }
 
-    /* Populate all the metadata pages */
-    snp_populate_metadata_pages(sev_snp, metadata);
+        /* Populate all the metadata pages */
+        snp_populate_metadata_pages(sev_snp, metadata);
+    }
 
     QTAILQ_FOREACH(data, &launch_update, next) {
         ret = sev_snp_launch_update(sev_snp, data);
@@ -2290,6 +2400,124 @@ static void sev_common_set_kernel_hashes(Object *obj, bool value, Error **errp)
     SEV_COMMON(obj)->kernel_hashes = value;
 }
 
+static bool cgs_check_support(ConfidentialGuestPlatformType platform,
+                             uint16_t platform_version, uint8_t highest_vtl,
+                             uint64_t shared_gpa_boundary)
+{
+    return (((platform == CGS_PLATFORM_SEV_SNP) && sev_snp_enabled()) ||
+            ((platform == CGS_PLATFORM_SEV_ES) && sev_es_enabled()) ||
+            ((platform == CGS_PLATFORM_SEV) && sev_enabled()));
+}
+
+static int cgs_set_guest_state(hwaddr gpa, uint8_t *ptr, uint64_t len,
+                               ConfidentialGuestPageType memory_type,
+                               uint16_t cpu_index, Error **errp)
+{
+    SevCommonState *sev_common = SEV_COMMON(MACHINE(qdev_get_machine())->cgs);
+    SevCommonStateClass *klass = SEV_COMMON_GET_CLASS(sev_common);
+
+    if (!sev_enabled()) {
+        error_setg(errp, "%s: attempt to configure guest memory, but SEV "
+                     "is not enabled", __func__);
+        return -1;
+    }
+
+    switch (memory_type) {
+    case CGS_PAGE_TYPE_NORMAL:
+    case CGS_PAGE_TYPE_ZERO:
+        return klass->launch_update_data(sev_common, gpa, ptr, len, errp);
+
+    case CGS_PAGE_TYPE_VMSA:
+        if (!sev_es_enabled()) {
+            error_setg(errp,
+                       "%s: attempt to configure initial VMSA, but SEV-ES "
+                       "is not supported",
+                       __func__);
+            return -1;
+        }
+        if (check_vmsa_supported(gpa, (const struct sev_es_save_area *)ptr,
+                                 errp) < 0) {
+            return -1;
+        }
+        return sev_set_cpu_context(cpu_index, ptr, len, gpa, errp);
+
+    case CGS_PAGE_TYPE_UNMEASURED:
+        if (sev_snp_enabled()) {
+            return snp_launch_update_data(
+                gpa, ptr, len, KVM_SEV_SNP_PAGE_TYPE_UNMEASURED, errp);
+        }
+        /* No action required if not SEV-SNP */
+        return 0;
+
+    case CGS_PAGE_TYPE_SECRETS:
+        if (!sev_snp_enabled()) {
+            error_setg(errp,
+                       "%s: attempt to configure secrets page, but SEV-SNP "
+                       "is not supported",
+                       __func__);
+            return -1;
+        }
+        return snp_launch_update_data(gpa, ptr, len,
+                                      KVM_SEV_SNP_PAGE_TYPE_SECRETS, errp);
+
+    case CGS_PAGE_TYPE_REQUIRED_MEMORY:
+        if (kvm_convert_memory(gpa, len, true) < 0) {
+            error_setg(
+                errp,
+                "%s: failed to configure required memory. gpa: %lX, type: %d",
+                __func__, gpa, memory_type);
+            return -1;
+        }
+        return 0;
+
+    case CGS_PAGE_TYPE_CPUID:
+        if (!sev_snp_enabled()) {
+            error_setg(errp,
+                       "%s: attempt to configure CPUID page, but SEV-SNP "
+                       "is not supported",
+                       __func__);
+            return -1;
+        }
+        return snp_launch_update_cpuid(gpa, ptr, len, errp);
+    }
+    error_setg(errp, "%s: failed to update guest. gpa: %lX, type: %d", __func__,
+               gpa, memory_type);
+    return -1;
+}
+
+static int cgs_get_mem_map_entry(int index,
+                                 ConfidentialGuestMemoryMapEntry *entry,
+                                 Error **errp)
+{
+    struct e820_entry *table;
+    int num_entries;
+
+    num_entries = e820_get_table(&table);
+    if ((index < 0) || (index >= num_entries)) {
+        return 1;
+    }
+    entry->gpa = table[index].address;
+    entry->size = table[index].length;
+    switch (table[index].type) {
+    case E820_RAM:
+        entry->type = CGS_MEM_RAM;
+        break;
+    case E820_RESERVED:
+        entry->type = CGS_MEM_RESERVED;
+        break;
+    case E820_ACPI:
+        entry->type = CGS_MEM_ACPI;
+        break;
+    case E820_NVS:
+        entry->type = CGS_MEM_NVS;
+        break;
+    case E820_UNUSABLE:
+        entry->type = CGS_MEM_UNUSABLE;
+        break;
+    }
+    return 0;
+}
+
 static void
 sev_common_class_init(ObjectClass *oc, const void *data)
 {
@@ -2313,6 +2541,8 @@ static void
 sev_common_instance_init(Object *obj)
 {
     SevCommonState *sev_common = SEV_COMMON(obj);
+    ConfidentialGuestSupportClass *cgs =
+        CONFIDENTIAL_GUEST_SUPPORT_GET_CLASS(obj);
 
     sev_common->kvm_type = -1;
 
@@ -2323,6 +2553,10 @@ sev_common_instance_init(Object *obj)
     object_property_add_uint32_ptr(obj, "reduced-phys-bits",
                                    &sev_common->reduced_phys_bits,
                                    OBJ_PROP_FLAG_READWRITE);
+    cgs->check_support = cgs_check_support;
+    cgs->set_guest_state = cgs_set_guest_state;
+    cgs->get_mem_map_entry = cgs_get_mem_map_entry;
+
     QTAILQ_INIT(&sev_common->launch_vmsa);
 }
 
diff --git a/target/i386/sev.h b/target/i386/sev.h
index 38caa849f5..d2eb06db32 100644
--- a/target/i386/sev.h
+++ b/target/i386/sev.h
@@ -44,6 +44,8 @@ bool sev_snp_enabled(void);
 #define SEV_SNP_POLICY_SMT      0x10000
 #define SEV_SNP_POLICY_DBG      0x80000
 
+#define SVM_SEV_FEAT_SNP_ACTIVE 1
+
 typedef struct SevKernelLoaderContext {
     char *setup_data;
     size_t setup_size;

From 565d591f719d05763544a5d929de3a40c903b3ea Mon Sep 17 00:00:00 2001
From: Roy Hopkins <roy.hopkins@randomman.co.uk>
Date: Thu, 3 Jul 2025 16:41:51 +0100
Subject: [PATCH 2170/2760] docs/system: Add documentation on support for IGVM
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

IGVM support has been implemented for Confidential Guests that support
AMD SEV and AMD SEV-ES. Add some documentation that gives some
background on the IGVM format and how to use it to configure a
confidential guest.

Signed-off-by: Roy Hopkins <roy.hopkins@randomman.co.uk>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Pankaj Gupta <pankaj.gupta@amd.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Gerd Hoffman <kraxel@redhat.com>
Reviewed-by: Ani Sinha <anisinha@redhat.com>
Link: https://lore.kernel.org/r/b4dc920a30717e19cd79bbbe2cc769f3b9ff3d37.1751554099.git.roy.hopkins@randomman.co.uk
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 docs/system/i386/amd-memory-encryption.rst |   2 +
 docs/system/igvm.rst                       | 173 +++++++++++++++++++++
 docs/system/index.rst                      |   1 +
 3 files changed, 176 insertions(+)
 create mode 100644 docs/system/igvm.rst

diff --git a/docs/system/i386/amd-memory-encryption.rst b/docs/system/i386/amd-memory-encryption.rst
index 748f5094ba..6c23f3535f 100644
--- a/docs/system/i386/amd-memory-encryption.rst
+++ b/docs/system/i386/amd-memory-encryption.rst
@@ -1,3 +1,5 @@
+.. _amd-sev:
+
 AMD Secure Encrypted Virtualization (SEV)
 =========================================
 
diff --git a/docs/system/igvm.rst b/docs/system/igvm.rst
new file mode 100644
index 0000000000..79508d9588
--- /dev/null
+++ b/docs/system/igvm.rst
@@ -0,0 +1,173 @@
+Independent Guest Virtual Machine (IGVM) support
+================================================
+
+IGVM files are designed to encapsulate all the information required to launch a
+virtual machine on any given virtualization stack in a deterministic way. This
+allows the cryptographic measurement of initial guest state for Confidential
+Guests to be calculated when the IGVM file is built, allowing a relying party to
+verify the initial state of a guest via a remote attestation.
+
+Although IGVM files are designed with Confidential Computing in mind, they can
+also be used to configure non-confidential guests. Multiple platforms can be
+defined by a single IGVM file, allowing a single IGVM file to configure a
+virtual machine that can run on, for example, TDX, SEV and non-confidential
+hosts.
+
+QEMU supports IGVM files through the user-creatable ``igvm-cfg`` object. This
+object is used to define the filename of the IGVM file to process. A reference
+to the object is added to the ``-machine`` to configure the virtual machine
+to use the IGVM file for configuration.
+
+Confidential platform support is provided through the use of
+the ``ConfidentialGuestSupport`` object. If the virtual machine provides an
+instance of this object then this is used by the IGVM loader to configure the
+isolation properties of the directives within the file.
+
+Further Information on IGVM
+---------------------------
+
+Information about the IGVM format, including links to the format specification
+and documentation for the Rust and C libraries can be found at the project
+repository:
+
+https://github.com/microsoft/igvm
+
+
+Supported Platforms
+-------------------
+
+Currently, IGVM files can be provided for Confidential Guests on host systems
+that support AMD SEV, SEV-ES and SEV-SNP with KVM. IGVM files can also be
+provided for non-confidential guests.
+
+
+Limitations when using IGVM with AMD SEV, SEV-ES and SEV-SNP
+------------------------------------------------------------
+
+IGVM files configure the initial state of the guest using a set of directives.
+Not every directive is supported by every Confidential Guest type. For example,
+AMD SEV does not support encrypted save state regions, therefore setting the
+initial CPU state using IGVM for SEV is not possible. When an IGVM file contains
+directives that are not supported for the active platform, an error is generated
+and the guest launch is aborted.
+
+The table below describes the list of directives that are supported for SEV,
+SEV-ES, SEV-SNP and non-confidential platforms.
+
+.. list-table:: SEV, SEV-ES, SEV-SNP & non-confidential Supported Directives
+   :widths: 35 65
+   :header-rows: 1
+
+   * - IGVM directive
+     - Notes
+   * - IGVM_VHT_PAGE_DATA
+     - ``NORMAL`` zero, measured and unmeasured page types are supported. Other
+       page types result in an error.
+   * - IGVM_VHT_PARAMETER_AREA
+     -
+   * - IGVM_VHT_PARAMETER_INSERT
+     -
+   * - IGVM_VHT_VP_COUNT_PARAMETER
+     - The guest parameter page is populated with the CPU count.
+   * - IGVM_VHT_ENVIRONMENT_INFO_PARAMETER
+     - The ``memory_is_shared`` parameter is set to 1 in the guest parameter
+       page.
+
+.. list-table:: Additional SEV, SEV-ES & SEV_SNP Supported Directives
+   :widths: 25 75
+   :header-rows: 1
+
+   * - IGVM directive
+     - Notes
+   * - IGVM_VHT_MEMORY_MAP
+     - The memory map page is populated using entries from the E820 table.
+   * - IGVM_VHT_REQUIRED_MEMORY
+     - Ensures memory is available in the guest at the specified range.
+
+.. list-table:: Additional SEV-ES & SEV-SNP Supported Directives
+   :widths: 25 75
+   :header-rows: 1
+
+   * - IGVM directive
+     - Notes
+   * - IGVM_VHT_VP_CONTEXT
+     - Setting of the initial CPU state for the boot CPU and additional CPUs is
+       supported with limitations on the fields that can be provided in the
+       VMSA. See below for details on which fields are supported.
+
+Initial CPU state with VMSA
+---------------------------
+
+The initial state of guest CPUs can be defined in the IGVM file for AMD SEV-ES
+and SEV-SNP. The state data is provided as a VMSA structure as defined in Table
+B-4 in the AMD64 Architecture Programmer's Manual, Volume 2 [1].
+
+The IGVM VMSA is translated to CPU state in QEMU which is then synchronized
+by KVM to the guest VMSA during the launch process where it contributes to the
+launch measurement. See :ref:`amd-sev` for details on the launch process and
+guest launch measurement.
+
+It is important that no information is lost or changed when translating the
+VMSA provided by the IGVM file into the VSMA that is used to launch the guest.
+Therefore, QEMU restricts the VMSA fields that can be provided in the IGVM
+VMSA structure to the following registers:
+
+RAX, RCX, RDX, RBX, RBP, RSI, RDI, R8-R15, RSP, RIP, CS, DS, ES, FS, GS, SS,
+CR0, CR3, CR4, XCR0, EFER, PAT, GDT, IDT, LDTR, TR, DR6, DR7, RFLAGS, X87_FCW,
+MXCSR.
+
+When processing the IGVM file, QEMU will check if any fields other than the
+above are non-zero and generate an error if this is the case.
+
+KVM uses a hardcoded GPA of 0xFFFFFFFFF000 for the VMSA. When an IGVM file
+defines initial CPU state, the GPA for each VMSA must match this hardcoded
+value.
+
+Firmware Images with IGVM
+-------------------------
+
+When an IGVM filename is specified for a Confidential Guest Support object it
+overrides the default handling of system firmware: the firmware image, such as
+an OVMF binary should be contained as a payload of the IGVM file and not
+provided as a flash drive or via the ``-bios`` parameter. The default QEMU
+firmware is not automatically populated into the guest memory space.
+
+If an IGVM file is provided along with either the ``-bios`` parameter or pflash
+devices then an error is displayed and the guest startup is aborted.
+
+Running a guest configured using IGVM
+-------------------------------------
+
+To run a guest configured with IGVM you firstly need to generate an IGVM file
+that contains a guest configuration compatible with the platform you are
+targeting.
+
+The ``buildigvm`` tool [2] is an example of a tool that can be used to generate
+IGVM files for non-confidential X86 platforms as well as for SEV, SEV-ES and
+SEV-SNP confidential platforms.
+
+Example using this tool to generate an IGVM file for AMD SEV-SNP::
+
+    buildigvm --firmware /path/to/OVMF.fd --output sev-snp.igvm \
+              --cpucount 4 sev-snp
+
+To run a guest configured with the generated IGVM you need to add an
+``igvm-cfg`` object and refer to it from the ``-machine`` parameter:
+
+Example (for AMD SEV)::
+
+    qemu-system-x86_64 \
+        <other parameters> \
+        -machine ...,confidential-guest-support=sev0,igvm-cfg=igvm0 \
+        -object sev-guest,id=sev0,cbitpos=47,reduced-phys-bits=1 \
+        -object igvm-cfg,id=igvm0,file=/path/to/sev-snp.igvm
+
+References
+----------
+
+[1] AMD64 Architecture Programmer's Manual, Volume 2: System Programming
+  Rev 3.41
+  https://www.amd.com/content/dam/amd/en/documents/processor-tech-docs/programmer-references/24593.pdf
+
+[2] ``buildigvm`` - A tool to build example IGVM files containing OVMF firmware
+  https://github.com/roy-hopkins/buildigvm
\ No newline at end of file
diff --git a/docs/system/index.rst b/docs/system/index.rst
index 718e9d3c56..427b020483 100644
--- a/docs/system/index.rst
+++ b/docs/system/index.rst
@@ -38,5 +38,6 @@ or Hypervisor.Framework.
    security
    multi-process
    confidential-guest-support
+   igvm
    vm-templating
    sriov

From 596c330b19cf00384ec14d0bff25758ed204b49d Mon Sep 17 00:00:00 2001
From: Roy Hopkins <roy.hopkins@randomman.co.uk>
Date: Thu, 3 Jul 2025 17:02:19 +0100
Subject: [PATCH 2171/2760] docs/interop/firmware.json: Add igvm to
 FirmwareDevice

Create an enum entry within FirmwareDevice for 'igvm' to describe that
an IGVM file can be used to map firmware into memory as an alternative
to pre-existing firmware devices.

Signed-off-by: Roy Hopkins <roy.hopkins@randomman.co.uk>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Gerd Hoffman <kraxel@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Ani Sinha <anisinha@redhat.com>
Link: https://lore.kernel.org/r/2eca2611d372facbffa65ee8244cf2d321eb9d17.1751554099.git.roy.hopkins@randomman.co.uk
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 docs/interop/firmware.json | 30 ++++++++++++++++++++++++++++--
 1 file changed, 28 insertions(+), 2 deletions(-)

diff --git a/docs/interop/firmware.json b/docs/interop/firmware.json
index 745d21d822..0711b6f323 100644
--- a/docs/interop/firmware.json
+++ b/docs/interop/firmware.json
@@ -57,10 +57,17 @@
 #
 # @memory: The firmware is to be mapped into memory.
 #
+# @igvm: The firmware is defined by a file conforming to the IGVM
+#        specification and mapped into memory according to directives
+#        defined in the file. This is similar to @memory but may
+#        include additional processing defined by the IGVM file
+#        including initial CPU state or population of metadata into
+#        the guest address space. Since: 10.1
+#
 # Since: 3.0
 ##
 { 'enum' : 'FirmwareDevice',
-  'data' : [ 'flash', 'kernel', 'memory' ] }
+  'data' : [ 'flash', 'kernel', 'memory', 'igvm' ] }
 
 ##
 # @FirmwareArchitecture:
@@ -377,6 +384,24 @@
 { 'struct' : 'FirmwareMappingMemory',
   'data'   : { 'filename' : 'str' } }
 
+##
+# @FirmwareMappingIgvm:
+#
+# Describes loading and mapping properties for the firmware executable,
+# when @FirmwareDevice is @igvm.
+#
+# @filename: Identifies the IGVM file containing the firmware executable
+#            along with other information used to configure the initial
+#            state of the guest. The IGVM file may be shared by multiple
+#            virtual machine definitions. This corresponds to creating
+#            an object on the command line with "-object igvm-cfg,
+#            file=@filename".
+#
+# Since: 10.1
+##
+{ 'struct' : 'FirmwareMappingIgvm',
+  'data'   : { 'filename' : 'str' } }
+
 ##
 # @FirmwareMapping:
 #
@@ -393,7 +418,8 @@
   'discriminator' : 'device',
   'data'          : { 'flash'  : 'FirmwareMappingFlash',
                       'kernel' : 'FirmwareMappingKernel',
-                      'memory' : 'FirmwareMappingMemory' } }
+                      'memory' : 'FirmwareMappingMemory',
+                      'igvm'   : 'FirmwareMappingIgvm' } }
 
 ##
 # @Firmware:

From 96a3088f5ebe6854dc8fb5a547c6b1d1db60f0fa Mon Sep 17 00:00:00 2001
From: Roy Hopkins <roy.hopkins@randomman.co.uk>
Date: Thu, 3 Jul 2025 17:02:20 +0100
Subject: [PATCH 2172/2760] backends/confidential-guest-support: Add
 set_guest_policy() function
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

For confidential guests a policy can be provided that defines the
security level, debug status, expected launch measurement and other
parameters that define the configuration of the confidential platform.

This commit adds a new function named set_guest_policy() that can be
implemented by each confidential platform, such as AMD SEV to set the
policy. This will allow configuration of the policy from a
multi-platform resource such as an IGVM file without the IGVM processor
requiring specific implementation details for each platform.

Signed-off-by: Roy Hopkins <roy.hopkins@randomman.co.uk>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Ani Sinha <anisinha@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Gerd Hoffman <kraxel@redhat.com>
Link: https://lore.kernel.org/r/d3888a2eb170c8d8c85a1c4b7e99accf3a15589c.1751554099.git.roy.hopkins@randomman.co.uk
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 backends/confidential-guest-support.c       | 12 ++++++++++++
 include/system/confidential-guest-support.h | 21 +++++++++++++++++++++
 2 files changed, 33 insertions(+)

diff --git a/backends/confidential-guest-support.c b/backends/confidential-guest-support.c
index c5bef1fbfa..156dd15e66 100644
--- a/backends/confidential-guest-support.c
+++ b/backends/confidential-guest-support.c
@@ -38,6 +38,17 @@ static int set_guest_state(hwaddr gpa, uint8_t *ptr, uint64_t len,
     return -1;
 }
 
+static int set_guest_policy(ConfidentialGuestPolicyType policy_type,
+                            uint64_t policy,
+                            void *policy_data1, uint32_t policy_data1_size,
+                            void *policy_data2, uint32_t policy_data2_size,
+                            Error **errp)
+{
+    error_setg(errp,
+               "Setting confidential guest policy is not supported for this platform");
+    return -1;
+}
+
 static int get_mem_map_entry(int index, ConfidentialGuestMemoryMapEntry *entry,
                              Error **errp)
 {
@@ -53,6 +64,7 @@ static void confidential_guest_support_class_init(ObjectClass *oc,
     ConfidentialGuestSupportClass *cgsc = CONFIDENTIAL_GUEST_SUPPORT_CLASS(oc);
     cgsc->check_support = check_support;
     cgsc->set_guest_state = set_guest_state;
+    cgsc->set_guest_policy = set_guest_policy;
     cgsc->get_mem_map_entry = get_mem_map_entry;
 }
 
diff --git a/include/system/confidential-guest-support.h b/include/system/confidential-guest-support.h
index 79ecd21f42..0cc8b26e64 100644
--- a/include/system/confidential-guest-support.h
+++ b/include/system/confidential-guest-support.h
@@ -57,6 +57,10 @@ typedef enum ConfidentialGuestPageType {
     CGS_PAGE_TYPE_REQUIRED_MEMORY,
 } ConfidentialGuestPageType;
 
+typedef enum ConfidentialGuestPolicyType {
+    GUEST_POLICY_SEV,
+} ConfidentialGuestPolicyType;
+
 struct ConfidentialGuestSupport {
     Object parent;
 
@@ -123,6 +127,23 @@ typedef struct ConfidentialGuestSupportClass {
                            ConfidentialGuestPageType memory_type,
                            uint16_t cpu_index, Error **errp);
 
+    /*
+     * Set the guest policy. The policy can be used to configure the
+     * confidential platform, such as if debug is enabled or not and can contain
+     * information about expected launch measurements, signed verification of
+     * guest configuration and other platform data.
+     *
+     * The format of the policy data is specific to each platform. For example,
+     * SEV-SNP uses a policy bitfield in the 'policy' argument and provides an
+     * ID block and ID authentication in the 'policy_data' parameters. The type
+     * of policy data is identified by the 'policy_type' argument.
+     */
+    int (*set_guest_policy)(ConfidentialGuestPolicyType policy_type,
+                            uint64_t policy,
+                            void *policy_data1, uint32_t policy_data1_size,
+                            void *policy_data2, uint32_t policy_data2_size,
+                            Error **errp);
+
     /*
      * Iterate the system memory map, getting the entry with the given index
      * that can be populated into guest memory.

From 9de40d7df3266625bf6e6c2712604ab306d12e65 Mon Sep 17 00:00:00 2001
From: Roy Hopkins <roy.hopkins@randomman.co.uk>
Date: Thu, 3 Jul 2025 17:18:59 +0100
Subject: [PATCH 2173/2760] backends/igvm: Process initialization sections in
 IGVM file

The initialization sections in IGVM files contain configuration that
should be applied to the guest platform before it is started. This
includes guest policy and other information that can affect the security
level and the startup measurement of a guest.

This commit introduces handling of the initialization sections during
processing of the IGVM file.

Signed-off-by: Roy Hopkins <roy.hopkins@randomman.co.uk>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Gerd Hoffman <kraxel@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Link: https://lore.kernel.org/r/9de24fb5df402024b40cbe02de0b13faa7cb4d84.1751554099.git.roy.hopkins@randomman.co.uk
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 backends/igvm.c | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/backends/igvm.c b/backends/igvm.c
index 2a31021d44..ebdb4594d1 100644
--- a/backends/igvm.c
+++ b/backends/igvm.c
@@ -786,6 +786,27 @@ int qigvm_process_file(IgvmCfg *cfg, ConfidentialGuestSupport *cgs,
         }
     }
 
+    header_count =
+        igvm_header_count(ctx.file, IGVM_HEADER_SECTION_INITIALIZATION);
+    if (header_count < 0) {
+        error_setg(
+            errp,
+            "Invalid initialization header count in IGVM file. Error code: %X",
+            header_count);
+        goto cleanup_parameters;
+    }
+
+    for (ctx.current_header_index = 0;
+         ctx.current_header_index < (unsigned)header_count;
+         ctx.current_header_index++) {
+        IgvmVariableHeaderType type =
+            igvm_get_header_type(ctx.file, IGVM_HEADER_SECTION_INITIALIZATION,
+                                 ctx.current_header_index);
+        if (qigvm_handler(&ctx, type, errp) < 0) {
+            goto cleanup_parameters;
+        }
+    }
+
     /*
      * Contiguous pages of data with compatible flags are grouped together in
      * order to reduce the number of memory regions we create. Make sure the

From 915b47078d6b4cffde209aab81ab56f73e4a2632 Mon Sep 17 00:00:00 2001
From: Roy Hopkins <roy.hopkins@randomman.co.uk>
Date: Thu, 3 Jul 2025 17:21:57 +0100
Subject: [PATCH 2174/2760] backends/igvm: Handle policy for SEV guests

Adds a handler for the guest policy initialization IGVM section and
builds an SEV policy based on this information and the ID block
directive if present. The policy is applied using by calling
'set_guest_policy()' on the ConfidentialGuestSupport object.

Signed-off-by: Roy Hopkins <roy.hopkins@randomman.co.uk>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Stefano Garzarella <sgarzare@redhat.com>
Acked-by: Gerd Hoffman <kraxel@redhat.com>
Reviewed-by: Ani Sinha <anisinha@redhat.com>
Link: https://lore.kernel.org/r/57707230bef331b53e9366ce6a23ed25cd6f1293.1751554099.git.roy.hopkins@randomman.co.uk
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 backends/igvm.c | 149 ++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 149 insertions(+)

diff --git a/backends/igvm.c b/backends/igvm.c
index ebdb4594d1..b568f06c76 100644
--- a/backends/igvm.c
+++ b/backends/igvm.c
@@ -27,6 +27,40 @@ typedef struct QIgvmParameterData {
     uint32_t index;
 } QIgvmParameterData;
 
+/*
+ * Some directives are specific to particular confidential computing platforms.
+ * Define required types for each of those platforms here.
+ */
+
+/* SEV/SEV-ES/SEV-SNP */
+
+/*
+ * These structures are defined in "SEV Secure Nested Paging Firmware ABI
+ * Specification" Rev 1.58, section 8.18.
+ */
+struct QEMU_PACKED sev_id_block {
+    uint8_t ld[48];
+    uint8_t family_id[16];
+    uint8_t image_id[16];
+    uint32_t version;
+    uint32_t guest_svn;
+    uint64_t policy;
+};
+
+struct QEMU_PACKED sev_id_authentication {
+    uint32_t id_key_alg;
+    uint32_t auth_key_algo;
+    uint8_t reserved[56];
+    uint8_t id_block_sig[512];
+    uint8_t id_key[1028];
+    uint8_t reserved2[60];
+    uint8_t id_key_sig[512];
+    uint8_t author_key[1028];
+    uint8_t reserved3[892];
+};
+
+#define IGVM_SEV_ID_BLOCK_VERSION 1
+
 /*
  * QIgvm contains the information required during processing
  * of a single IGVM file.
@@ -38,6 +72,17 @@ typedef struct QIgvm {
     uint32_t compatibility_mask;
     unsigned current_header_index;
     QTAILQ_HEAD(, QIgvmParameterData) parameter_data;
+    IgvmPlatformType platform_type;
+
+    /*
+     * SEV-SNP platforms can contain an ID block and authentication
+     * that should be verified by the guest.
+     */
+    struct sev_id_block *id_block;
+    struct sev_id_authentication *id_auth;
+
+    /* Define the guest policy for SEV guests */
+    uint64_t sev_policy;
 
     /* These variables keep track of contiguous page regions */
     IGVM_VHS_PAGE_DATA region_prev_page_data;
@@ -67,6 +112,11 @@ static int qigvm_directive_environment_info(QIgvm *ctx,
 static int qigvm_directive_required_memory(QIgvm *ctx,
                                            const uint8_t *header_data,
                                            Error **errp);
+static int qigvm_directive_snp_id_block(QIgvm *ctx, const uint8_t *header_data,
+                                  Error **errp);
+static int qigvm_initialization_guest_policy(QIgvm *ctx,
+                                       const uint8_t *header_data,
+                                       Error **errp);
 
 struct QIGVMHandler {
     uint32_t type;
@@ -91,6 +141,10 @@ static struct QIGVMHandler handlers[] = {
       qigvm_directive_environment_info },
     { IGVM_VHT_REQUIRED_MEMORY, IGVM_HEADER_SECTION_DIRECTIVE,
       qigvm_directive_required_memory },
+    { IGVM_VHT_SNP_ID_BLOCK, IGVM_HEADER_SECTION_DIRECTIVE,
+      qigvm_directive_snp_id_block },
+    { IGVM_VHT_GUEST_POLICY, IGVM_HEADER_SECTION_INITIALIZATION,
+      qigvm_initialization_guest_policy },
 };
 
 static int qigvm_handler(QIgvm *ctx, uint32_t type, Error **errp)
@@ -632,6 +686,74 @@ static int qigvm_directive_required_memory(QIgvm *ctx,
     return 0;
 }
 
+static int qigvm_directive_snp_id_block(QIgvm *ctx, const uint8_t *header_data,
+                                  Error **errp)
+{
+    const IGVM_VHS_SNP_ID_BLOCK *igvm_id =
+        (const IGVM_VHS_SNP_ID_BLOCK *)header_data;
+
+    if (!(igvm_id->compatibility_mask & ctx->compatibility_mask)) {
+        return 0;
+    }
+
+    if (ctx->id_block) {
+        error_setg(errp, "IGVM: Multiple ID blocks encountered "
+                            "in IGVM file.");
+        return -1;
+    }
+    ctx->id_block = g_new0(struct sev_id_block, 1);
+    ctx->id_auth = g_new0(struct sev_id_authentication, 1);
+
+    memcpy(ctx->id_block->family_id, igvm_id->family_id,
+            sizeof(ctx->id_block->family_id));
+    memcpy(ctx->id_block->image_id, igvm_id->image_id,
+            sizeof(ctx->id_block->image_id));
+    ctx->id_block->guest_svn = igvm_id->guest_svn;
+    ctx->id_block->version = IGVM_SEV_ID_BLOCK_VERSION;
+    memcpy(ctx->id_block->ld, igvm_id->ld, sizeof(ctx->id_block->ld));
+
+    ctx->id_auth->id_key_alg = igvm_id->id_key_algorithm;
+    assert(sizeof(igvm_id->id_key_signature) <=
+           sizeof(ctx->id_auth->id_block_sig));
+    memcpy(ctx->id_auth->id_block_sig, &igvm_id->id_key_signature,
+           sizeof(igvm_id->id_key_signature));
+
+    ctx->id_auth->auth_key_algo = igvm_id->author_key_algorithm;
+    assert(sizeof(igvm_id->author_key_signature) <=
+           sizeof(ctx->id_auth->id_key_sig));
+    memcpy(ctx->id_auth->id_key_sig, &igvm_id->author_key_signature,
+           sizeof(igvm_id->author_key_signature));
+
+    /*
+     * SEV and IGVM public key structure population are slightly different.
+     * See SEV Secure Nested Paging Firmware ABI Specification, Chapter 10.
+     */
+    *((uint32_t *)ctx->id_auth->id_key) = igvm_id->id_public_key.curve;
+    memcpy(&ctx->id_auth->id_key[4], &igvm_id->id_public_key.qx, 72);
+    memcpy(&ctx->id_auth->id_key[76], &igvm_id->id_public_key.qy, 72);
+
+    *((uint32_t *)ctx->id_auth->author_key) =
+        igvm_id->author_public_key.curve;
+    memcpy(&ctx->id_auth->author_key[4], &igvm_id->author_public_key.qx,
+            72);
+    memcpy(&ctx->id_auth->author_key[76], &igvm_id->author_public_key.qy,
+            72);
+
+    return 0;
+}
+
+static int qigvm_initialization_guest_policy(QIgvm *ctx,
+                                       const uint8_t *header_data, Error **errp)
+{
+    const IGVM_VHS_GUEST_POLICY *guest =
+        (const IGVM_VHS_GUEST_POLICY *)header_data;
+
+    if (guest->compatibility_mask & ctx->compatibility_mask) {
+        ctx->sev_policy = guest->policy;
+    }
+    return 0;
+}
+
 static int qigvm_supported_platform_compat_mask(QIgvm *ctx, Error **errp)
 {
     int32_t header_count;
@@ -701,12 +823,16 @@ static int qigvm_supported_platform_compat_mask(QIgvm *ctx, Error **errp)
     /* Choose the strongest supported isolation technology */
     if (compatibility_mask_sev_snp != 0) {
         ctx->compatibility_mask = compatibility_mask_sev_snp;
+        ctx->platform_type = IGVM_PLATFORM_TYPE_SEV_SNP;
     } else if (compatibility_mask_sev_es != 0) {
         ctx->compatibility_mask = compatibility_mask_sev_es;
+        ctx->platform_type = IGVM_PLATFORM_TYPE_SEV_ES;
     } else if (compatibility_mask_sev != 0) {
         ctx->compatibility_mask = compatibility_mask_sev;
+        ctx->platform_type = IGVM_PLATFORM_TYPE_SEV;
     } else if (compatibility_mask != 0) {
         ctx->compatibility_mask = compatibility_mask;
+        ctx->platform_type = IGVM_PLATFORM_TYPE_NATIVE;
     } else {
         error_setg(
             errp,
@@ -716,6 +842,23 @@ static int qigvm_supported_platform_compat_mask(QIgvm *ctx, Error **errp)
     return 0;
 }
 
+static int qigvm_handle_policy(QIgvm *ctx, Error **errp)
+{
+    if (ctx->platform_type == IGVM_PLATFORM_TYPE_SEV_SNP) {
+        int id_block_len = 0;
+        int id_auth_len = 0;
+        if (ctx->id_block) {
+            ctx->id_block->policy = ctx->sev_policy;
+            id_block_len = sizeof(struct sev_id_block);
+            id_auth_len = sizeof(struct sev_id_authentication);
+        }
+        return ctx->cgsc->set_guest_policy(GUEST_POLICY_SEV, ctx->sev_policy,
+                                          ctx->id_block, id_block_len,
+                                          ctx->id_auth, id_auth_len, errp);
+    }
+    return 0;
+}
+
 static IgvmHandle qigvm_file_init(char *filename, Error **errp)
 {
     IgvmHandle igvm;
@@ -814,12 +957,18 @@ int qigvm_process_file(IgvmCfg *cfg, ConfidentialGuestSupport *cgs,
      */
     retval = qigvm_process_mem_page(&ctx, NULL, errp);
 
+    if (retval == 0) {
+        retval = qigvm_handle_policy(&ctx, errp);
+    }
+
 cleanup_parameters:
     QTAILQ_FOREACH(parameter, &ctx.parameter_data, next)
     {
         g_free(parameter->data);
         parameter->data = NULL;
     }
+    g_free(ctx.id_block);
+    g_free(ctx.id_auth);
 
 cleanup:
     igvm_free(ctx.file);

From 2ff75825cc5a5d56ea90d79cd15578f6b1893561 Mon Sep 17 00:00:00 2001
From: Roy Hopkins <roy.hopkins@randomman.co.uk>
Date: Thu, 3 Jul 2025 17:21:58 +0100
Subject: [PATCH 2175/2760] i386/sev: Add implementation of CGS
 set_guest_policy()

The new cgs_set_guest_policy() function is provided to receive the guest
policy flags, SNP ID block and SNP ID authentication from guest
configuration such as an IGVM file and apply it to the platform prior to
launching the guest.

The policy is used to populate values for the existing 'policy',
'id_block' and 'id_auth' parameters. When provided, the guest policy is
applied and the ID block configuration is used to verify the launch
measurement and signatures. The guest is only successfully started if
the expected launch measurements match the actual measurements and the
signatures are valid.

Signed-off-by: Roy Hopkins <roy.hopkins@randomman.co.uk>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Stefano Garzarella <sgarzare@redhat.com>
Acked-by: Gerd Hoffman <kraxel@redhat.com>
Reviewed-by: Ani Sinha <anisinha@redhat.com>
Link: https://lore.kernel.org/r/99e82ddec4ad2970c790db8bea16ea3f57eb0e53.1751554099.git.roy.hopkins@randomman.co.uk
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/sev.c | 83 +++++++++++++++++++++++++++++++++++++++++++++++
 target/i386/sev.h | 12 +++++++
 2 files changed, 95 insertions(+)

diff --git a/target/i386/sev.c b/target/i386/sev.c
index 1296f4feb6..3e5722ba65 100644
--- a/target/i386/sev.c
+++ b/target/i386/sev.c
@@ -2518,6 +2518,88 @@ static int cgs_get_mem_map_entry(int index,
     return 0;
 }
 
+static int cgs_set_guest_policy(ConfidentialGuestPolicyType policy_type,
+                                uint64_t policy, void *policy_data1,
+                                uint32_t policy_data1_size, void *policy_data2,
+                                uint32_t policy_data2_size, Error **errp)
+{
+    if (policy_type != GUEST_POLICY_SEV) {
+        error_setg(errp, "%s: Invalid guest policy type provided for SEV: %d",
+        __func__, policy_type);
+        return -1;
+    }
+    /*
+     * SEV-SNP handles policy differently. The policy flags are defined in
+     * kvm_start_conf.policy and an ID block and ID auth can be provided.
+     */
+    if (sev_snp_enabled()) {
+        SevSnpGuestState *sev_snp_guest =
+            SEV_SNP_GUEST(MACHINE(qdev_get_machine())->cgs);
+        struct kvm_sev_snp_launch_finish *finish =
+            &sev_snp_guest->kvm_finish_conf;
+
+        /*
+         * The policy consists of flags in 'policy' and optionally an ID block
+         * and ID auth in policy_data1 and policy_data2 respectively. The ID
+         * block and auth are optional so clear any previous ID block and auth
+         * and set them if provided, but always set the policy flags.
+         */
+        g_free(sev_snp_guest->id_block);
+        g_free((guchar *)finish->id_block_uaddr);
+        g_free(sev_snp_guest->id_auth);
+        g_free((guchar *)finish->id_auth_uaddr);
+        sev_snp_guest->id_block = NULL;
+        finish->id_block_uaddr = 0;
+        sev_snp_guest->id_auth = NULL;
+        finish->id_auth_uaddr = 0;
+
+        if (policy_data1_size > 0) {
+            struct sev_snp_id_authentication *id_auth =
+                (struct sev_snp_id_authentication *)policy_data2;
+
+            if (policy_data1_size != KVM_SEV_SNP_ID_BLOCK_SIZE) {
+                error_setg(errp, "%s: Invalid SEV-SNP ID block: incorrect size",
+                           __func__);
+                return -1;
+            }
+            if (policy_data2_size != KVM_SEV_SNP_ID_AUTH_SIZE) {
+                error_setg(errp,
+                           "%s: Invalid SEV-SNP ID auth block: incorrect size",
+                           __func__);
+                return -1;
+            }
+            assert(policy_data1 != NULL);
+            assert(policy_data2 != NULL);
+
+            finish->id_block_uaddr =
+                (__u64)g_memdup2(policy_data1, KVM_SEV_SNP_ID_BLOCK_SIZE);
+            finish->id_auth_uaddr =
+                (__u64)g_memdup2(policy_data2, KVM_SEV_SNP_ID_AUTH_SIZE);
+
+            /*
+             * Check if an author key has been provided and use that to flag
+             * whether the author key is enabled. The first of the author key
+             * must be non-zero to indicate the key type, which will currently
+             * always be 2.
+             */
+            sev_snp_guest->kvm_finish_conf.auth_key_en =
+                id_auth->author_key[0] ? 1 : 0;
+            finish->id_block_en = 1;
+        }
+        sev_snp_guest->kvm_start_conf.policy = policy;
+    } else {
+        SevGuestState *sev_guest = SEV_GUEST(MACHINE(qdev_get_machine())->cgs);
+        /* Only the policy flags are supported for SEV and SEV-ES */
+        if ((policy_data1_size > 0) || (policy_data2_size > 0) || !sev_guest) {
+            error_setg(errp, "%s: An ID block/ID auth block has been provided "
+                             "but SEV-SNP is not enabled", __func__);
+            return -1;
+        }
+        sev_guest->policy = policy;
+    }
+    return 0;
+}
+
 static void
 sev_common_class_init(ObjectClass *oc, const void *data)
 {
@@ -2556,6 +2638,7 @@ sev_common_instance_init(Object *obj)
     cgs->check_support = cgs_check_support;
     cgs->set_guest_state = cgs_set_guest_state;
     cgs->get_mem_map_entry = cgs_get_mem_map_entry;
+    cgs->set_guest_policy = cgs_set_guest_policy;
 
     QTAILQ_INIT(&sev_common->launch_vmsa);
 }
diff --git a/target/i386/sev.h b/target/i386/sev.h
index d2eb06db32..9db1a802f6 100644
--- a/target/i386/sev.h
+++ b/target/i386/sev.h
@@ -167,6 +167,18 @@ struct QEMU_PACKED sev_es_save_area {
     uint8_t fpreg_ymm[256];
 };
 
+struct QEMU_PACKED sev_snp_id_authentication {
+    uint32_t id_key_alg;
+    uint32_t auth_key_algo;
+    uint8_t reserved[56];
+    uint8_t id_block_sig[512];
+    uint8_t id_key[1028];
+    uint8_t reserved2[60];
+    uint8_t id_key_sig[512];
+    uint8_t author_key[1028];
+    uint8_t reserved3[892];
+};
+
 bool sev_add_kernel_loader_hashes(SevKernelLoaderContext *ctx, Error **errp);
 
 int sev_encrypt_flash(hwaddr gpa, uint8_t *ptr, uint64_t len, Error **errp);

From d60238b4c1e81235d5efb4a978a6f6b1adabccab Mon Sep 17 00:00:00 2001
From: Roy Hopkins <roy.hopkins@randomman.co.uk>
Date: Thu, 3 Jul 2025 17:21:59 +0100
Subject: [PATCH 2176/2760] sev: Provide sev_features flags from IGVM VMSA to
 KVM_SEV_INIT2

IGVM files can contain an initial VMSA that should be applied to each
vcpu as part of the initial guest state. The sev_features flags are
provided as part of the VMSA structure. However, KVM only allows
sev_features to be set during initialization and not as the guest is
being prepared for launch.

This patch queries KVM for the supported set of sev_features flags and
processes the VP context entries in the IGVM file during kvm_init to
determine any sev_features flags set in the IGVM file. These are then
provided in the call to KVM_SEV_INIT2 to ensure the guest state
matches that specified in the IGVM file.

The igvm process() function is modified to allow a partial processing
of the file during initialization, with only the IGVM_VHT_VP_CONTEXT
fields being processed. This means the function is called twice,
firstly to extract the sev_features then secondly to actually
configure the guest.

Signed-off-by: Roy Hopkins <roy.hopkins@randomman.co.uk>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Stefano Garzarella <sgarzare@redhat.com>
Acked-by: Gerd Hoffman <kraxel@redhat.com>
Tested-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Liam Merwick <liam.merwick@oracle.com>
Reviewed-by: Ani Sinha <anisinha@redhat.com>
Link: https://lore.kernel.org/r/b2f986aae04e1da2aee530c9be22a54c0c59a560.1751554099.git.roy.hopkins@randomman.co.uk
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 backends/igvm.c           |  17 +++-
 backends/igvm.h           |   2 +-
 hw/i386/pc_piix.c         |   2 +-
 hw/i386/pc_q35.c          |   2 +-
 include/system/igvm-cfg.h |   5 +-
 target/i386/sev.c         | 161 +++++++++++++++++++++++++++++++++-----
 6 files changed, 163 insertions(+), 26 deletions(-)

diff --git a/backends/igvm.c b/backends/igvm.c
index b568f06c76..9ad41582ee 100644
--- a/backends/igvm.c
+++ b/backends/igvm.c
@@ -880,7 +880,7 @@ static IgvmHandle qigvm_file_init(char *filename, Error **errp)
 }
 
 int qigvm_process_file(IgvmCfg *cfg, ConfidentialGuestSupport *cgs,
-                       Error **errp)
+                       bool onlyVpContext, Error **errp)
 {
     int32_t header_count;
     QIgvmParameterData *parameter;
@@ -924,11 +924,22 @@ int qigvm_process_file(IgvmCfg *cfg, ConfidentialGuestSupport *cgs,
          ctx.current_header_index++) {
         IgvmVariableHeaderType type = igvm_get_header_type(
             ctx.file, IGVM_HEADER_SECTION_DIRECTIVE, ctx.current_header_index);
-        if (qigvm_handler(&ctx, type, errp) < 0) {
-            goto cleanup_parameters;
+        if (!onlyVpContext || (type == IGVM_VHT_VP_CONTEXT)) {
+            if (qigvm_handler(&ctx, type, errp) < 0) {
+                goto cleanup_parameters;
+            }
         }
     }
 
+    /*
+     * If only processing the VP context then we don't need to process
+     * any more of the file.
+     */
+    if (onlyVpContext) {
+        retval = 0;
+        goto cleanup_parameters;
+    }
+
     header_count =
         igvm_header_count(ctx.file, IGVM_HEADER_SECTION_INITIALIZATION);
     if (header_count < 0) {
diff --git a/backends/igvm.h b/backends/igvm.h
index db02ea9165..a4abab043a 100644
--- a/backends/igvm.h
+++ b/backends/igvm.h
@@ -17,6 +17,6 @@
 #include "qapi/error.h"
 
 int qigvm_process_file(IgvmCfg *igvm, ConfidentialGuestSupport *cgs,
-                      Error **errp);
+                      bool onlyVpContext, Error **errp);
 
 #endif
diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
index 3184ea1b37..a3285fbc64 100644
--- a/hw/i386/pc_piix.c
+++ b/hw/i386/pc_piix.c
@@ -371,7 +371,7 @@ static void pc_init1(MachineState *machine, const char *pci_type)
     /* Apply guest state from IGVM if supplied */
     if (x86ms->igvm) {
         if (IGVM_CFG_GET_CLASS(x86ms->igvm)
-                ->process(x86ms->igvm, machine->cgs, &error_fatal) < 0) {
+                ->process(x86ms->igvm, machine->cgs, false, &error_fatal) < 0) {
             g_assert_not_reached();
         }
     }
diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
index 6990e1c669..cf871cfdad 100644
--- a/hw/i386/pc_q35.c
+++ b/hw/i386/pc_q35.c
@@ -330,7 +330,7 @@ static void pc_q35_init(MachineState *machine)
     /* Apply guest state from IGVM if supplied */
     if (x86ms->igvm) {
         if (IGVM_CFG_GET_CLASS(x86ms->igvm)
-                ->process(x86ms->igvm, machine->cgs, &error_fatal) < 0) {
+                ->process(x86ms->igvm, machine->cgs, false, &error_fatal) < 0) {
             g_assert_not_reached();
         }
     }
diff --git a/include/system/igvm-cfg.h b/include/system/igvm-cfg.h
index 321b3196f0..944f23a814 100644
--- a/include/system/igvm-cfg.h
+++ b/include/system/igvm-cfg.h
@@ -31,11 +31,14 @@ typedef struct IgvmCfgClass {
     /*
      * If an IGVM filename has been specified then process the IGVM file.
      * Performs a no-op if no filename has been specified.
+     * If onlyVpContext is true then only the IGVM_VHT_VP_CONTEXT entries
+     * in the IGVM file will be processed, allowing information about the
+     * CPU state to be determined before processing the entire file.
      *
      * Returns 0 for ok and -1 on error.
      */
     int (*process)(IgvmCfg *cfg, ConfidentialGuestSupport *cgs,
-                   Error **errp);
+                   bool onlyVpContext, Error **errp);
 
 } IgvmCfgClass;
 
diff --git a/target/i386/sev.c b/target/i386/sev.c
index 3e5722ba65..1057b8ab2c 100644
--- a/target/i386/sev.c
+++ b/target/i386/sev.c
@@ -118,6 +118,8 @@ struct SevCommonState {
     uint32_t cbitpos;
     uint32_t reduced_phys_bits;
     bool kernel_hashes;
+    uint64_t sev_features;
+    uint64_t supported_sev_features;
 
     /* runtime state */
     uint8_t api_major;
@@ -485,7 +487,40 @@ static void sev_apply_cpu_context(CPUState *cpu)
     }
 }
 
-static int check_vmsa_supported(hwaddr gpa, const struct sev_es_save_area *vmsa,
+static int check_sev_features(SevCommonState *sev_common, uint64_t sev_features,
+                              Error **errp)
+{
+    /*
+     * Ensure SEV_FEATURES is configured for correct SEV hardware and that
+     * the requested features are supported. If SEV-SNP is enabled then
+     * that feature must be enabled, otherwise it must be cleared.
+     */
+    if (sev_snp_enabled() && !(sev_features & SVM_SEV_FEAT_SNP_ACTIVE)) {
+        error_setg(
+            errp,
+            "%s: SEV_SNP is enabled but is not enabled in VMSA sev_features",
+            __func__);
+        return -1;
+    } else if (!sev_snp_enabled() &&
+               (sev_features & SVM_SEV_FEAT_SNP_ACTIVE)) {
+        error_setg(
+            errp,
+            "%s: SEV_SNP is not enabled but is enabled in VMSA sev_features",
+            __func__);
+        return -1;
+    }
+    if (sev_features & ~sev_common->supported_sev_features) {
+        error_setg(errp,
+                   "%s: VMSA contains unsupported sev_features: %lX, "
+                   "supported features: %lX",
+                   __func__, sev_features, sev_common->supported_sev_features);
+        return -1;
+    }
+    return 0;
+}
+
+static int check_vmsa_supported(SevCommonState *sev_common, hwaddr gpa,
+                                const struct sev_es_save_area *vmsa,
                                 Error **errp)
 {
     struct sev_es_save_area vmsa_check;
@@ -551,24 +586,10 @@ static int check_vmsa_supported(hwaddr gpa, const struct sev_es_save_area *vmsa,
     vmsa_check.x87_fcw = 0;
     vmsa_check.mxcsr = 0;
 
-    if (sev_snp_enabled()) {
-        if (vmsa_check.sev_features != SVM_SEV_FEAT_SNP_ACTIVE) {
-            error_setg(errp,
-                       "%s: sev_features in the VMSA contains an unsupported "
-                       "value. For SEV-SNP, sev_features must be set to %x.",
-                       __func__, SVM_SEV_FEAT_SNP_ACTIVE);
-            return -1;
-        }
-        vmsa_check.sev_features = 0;
-    } else {
-        if (vmsa_check.sev_features != 0) {
-            error_setg(errp,
-                       "%s: sev_features in the VMSA contains an unsupported "
-                       "value. For SEV-ES and SEV, sev_features must be "
-                       "set to 0.", __func__);
-            return -1;
-        }
+    if (check_sev_features(sev_common, vmsa_check.sev_features, errp) < 0) {
+        return -1;
     }
+    vmsa_check.sev_features = 0;
 
     if (!buffer_is_zero(&vmsa_check, sizeof(vmsa_check))) {
         error_setg(errp,
@@ -1722,6 +1743,39 @@ static int sev_snp_kvm_type(X86ConfidentialGuest *cg)
     return KVM_X86_SNP_VM;
 }
 
+static int sev_init_supported_features(ConfidentialGuestSupport *cgs,
+                                       SevCommonState *sev_common, Error **errp)
+{
+    X86ConfidentialGuestClass *x86_klass =
+                               X86_CONFIDENTIAL_GUEST_GET_CLASS(cgs);
+    /*
+     * Older kernels do not support query or setting of sev_features. In this
+     * case the set of supported features must be zero to match the settings
+     * in the kernel.
+     */
+    if (x86_klass->kvm_type(X86_CONFIDENTIAL_GUEST(sev_common)) ==
+        KVM_X86_DEFAULT_VM) {
+        sev_common->supported_sev_features = 0;
+        return 0;
+    }
+
+    /* Query KVM for the supported set of sev_features */
+    struct kvm_device_attr attr = {
+        .group = KVM_X86_GRP_SEV,
+        .attr = KVM_X86_SEV_VMSA_FEATURES,
+        .addr = (unsigned long)&sev_common->supported_sev_features,
+    };
+    if (kvm_ioctl(kvm_state, KVM_GET_DEVICE_ATTR, &attr) < 0) {
+        error_setg(errp, "%s: failed to query supported sev_features",
+                   __func__);
+        return -1;
+    }
+    if (sev_snp_enabled()) {
+        sev_common->supported_sev_features |= SVM_SEV_FEAT_SNP_ACTIVE;
+    }
+    return 0;
+}
+
 static int sev_common_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
 {
     char *devname;
@@ -1802,6 +1856,10 @@ static int sev_common_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
         }
     }
 
+    if (sev_init_supported_features(cgs, sev_common, errp) < 0) {
+        return -1;
+    }
+
     trace_kvm_sev_init();
     switch (x86_klass->kvm_type(X86_CONFIDENTIAL_GUEST(sev_common))) {
     case KVM_X86_DEFAULT_VM:
@@ -1813,6 +1871,40 @@ static int sev_common_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
     case KVM_X86_SEV_ES_VM:
     case KVM_X86_SNP_VM: {
         struct kvm_sev_init args = { 0 };
+        MachineState *machine = MACHINE(qdev_get_machine());
+        X86MachineState *x86machine = X86_MACHINE(qdev_get_machine());
+
+        /*
+         * If configuration is provided via an IGVM file then the IGVM file
+         * might contain configuration of the initial vcpu context. For SEV
+         * the vcpu context includes the sev_features which should be applied
+         * to the vcpu.
+         *
+         * KVM does not synchronize sev_features from CPU state. Instead it
+         * requires sev_features to be provided as part of this initialization
+         * call which is subsequently automatically applied to the VMSA of
+         * each vcpu.
+         *
+         * The IGVM file is normally processed after initialization. Therefore
+         * we need to pre-process it here to extract sev_features in order to
+         * provide it to KVM_SEV_INIT2. Each cgs_* function that is called by
+         * the IGVM processor detects this pre-process by observing the state
+         * as SEV_STATE_UNINIT.
+         */
+        if (x86machine->igvm) {
+            if (IGVM_CFG_GET_CLASS(x86machine->igvm)
+                    ->process(x86machine->igvm, machine->cgs, true, errp) ==
+                -1) {
+                return -1;
+            }
+            /*
+             * KVM maintains a bitmask of allowed sev_features. This does not
+             * include SVM_SEV_FEAT_SNP_ACTIVE which is set accordingly by KVM
+             * itself. Therefore we need to clear this flag.
+             */
+            args.vmsa_features = sev_common->sev_features &
+                                 ~SVM_SEV_FEAT_SNP_ACTIVE;
+        }
 
         ret = sev_ioctl(sev_common->sev_fd, KVM_SEV_INIT2, &args, &fw_error);
         break;
@@ -2416,6 +2508,24 @@ static int cgs_set_guest_state(hwaddr gpa, uint8_t *ptr, uint64_t len,
     SevCommonState *sev_common = SEV_COMMON(MACHINE(qdev_get_machine())->cgs);
     SevCommonStateClass *klass = SEV_COMMON_GET_CLASS(sev_common);
 
+    if (sev_common->state == SEV_STATE_UNINIT) {
+        /* Pre-processing of IGVM file called from sev_common_kvm_init() */
+        if ((cpu_index == 0) && (memory_type == CGS_PAGE_TYPE_VMSA)) {
+            const struct sev_es_save_area *sa =
+                (const struct sev_es_save_area *)ptr;
+            if (len < sizeof(*sa)) {
+                error_setg(errp, "%s: invalid VMSA length encountered",
+                           __func__);
+                return -1;
+            }
+            if (check_sev_features(sev_common, sa->sev_features, errp) < 0) {
+                return -1;
+            }
+            sev_common->sev_features = sa->sev_features;
+        }
+        return 0;
+    }
+
     if (!sev_enabled()) {
         error_setg(errp, "%s: attempt to configure guest memory, but SEV "
                      "is not enabled", __func__);
@@ -2435,7 +2545,8 @@ static int cgs_set_guest_state(hwaddr gpa, uint8_t *ptr, uint64_t len,
                        __func__);
             return -1;
         }
-        if (check_vmsa_supported(gpa, (const struct sev_es_save_area *)ptr,
+        if (check_vmsa_supported(sev_common, gpa,
+                                 (const struct sev_es_save_area *)ptr,
                                  errp) < 0) {
             return -1;
         }
@@ -2492,6 +2603,12 @@ static int cgs_get_mem_map_entry(int index,
     struct e820_entry *table;
     int num_entries;
 
+    SevCommonState *sev_common = SEV_COMMON(MACHINE(qdev_get_machine())->cgs);
+    if (sev_common->state == SEV_STATE_UNINIT) {
+        /* Pre-processing of IGVM file called from sev_common_kvm_init() */
+        return 1;
+    }
+
     num_entries = e820_get_table(&table);
     if ((index < 0) || (index >= num_entries)) {
         return 1;
@@ -2523,6 +2640,12 @@ static int cgs_set_guest_policy(ConfidentialGuestPolicyType policy_type,
                                 uint32_t policy_data1_size, void *policy_data2,
                                 uint32_t policy_data2_size, Error **errp)
 {
+    SevCommonState *sev_common = SEV_COMMON(MACHINE(qdev_get_machine())->cgs);
+    if (sev_common->state == SEV_STATE_UNINIT) {
+        /* Pre-processing of IGVM file called from sev_common_kvm_init() */
+        return 0;
+    }
+
     if (policy_type != GUEST_POLICY_SEV) {
         error_setg(errp, "%s: Invalid guest policy type provided for SEV: %d",
         __func__, policy_type);

From 2393fb93ed45109ecd2a07cf6e6444b1b4c8d7cb Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Tue, 1 Jul 2025 15:57:38 +0800
Subject: [PATCH 2177/2760] i386/cpu: Move the implementation of
 is_host_cpu_intel() host-cpu.c

It's more proper to put is_host_cpu_intel() in host-cpu.c instead of
vmsr_energy.c.

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Link: https://lore.kernel.org/r/20250701075738.3451873-3-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/host-cpu.c        | 9 +++++++++
 target/i386/host-cpu.h        | 1 +
 target/i386/kvm/vmsr_energy.c | 9 ---------
 target/i386/kvm/vmsr_energy.h | 1 -
 4 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/target/i386/host-cpu.c b/target/i386/host-cpu.c
index 3399edc1ad..e9a49e628f 100644
--- a/target/i386/host-cpu.c
+++ b/target/i386/host-cpu.c
@@ -161,6 +161,15 @@ void host_cpu_instance_init(X86CPU *cpu)
                             &error_abort);
 }
 
+bool is_host_cpu_intel(void)
+{
+    char vendor[CPUID_VENDOR_SZ + 1];
+
+    host_cpu_vendor_fms(vendor, NULL, NULL, NULL);
+
+    return g_str_equal(vendor, CPUID_VENDOR_INTEL);
+}
+
 static void host_cpu_class_init(ObjectClass *oc, const void *data)
 {
     X86CPUClass *xcc = X86_CPU_CLASS(oc);
diff --git a/target/i386/host-cpu.h b/target/i386/host-cpu.h
index b97ec01c9b..10df4b3a3a 100644
--- a/target/i386/host-cpu.h
+++ b/target/i386/host-cpu.h
@@ -17,4 +17,5 @@ bool host_cpu_realizefn(CPUState *cs, Error **errp);
 
 void host_cpu_vendor_fms(char *vendor, int *family, int *model, int *stepping);
 
+bool is_host_cpu_intel(void);
 #endif /* HOST_CPU_H */
diff --git a/target/i386/kvm/vmsr_energy.c b/target/i386/kvm/vmsr_energy.c
index d6aad5246b..58ce3df53a 100644
--- a/target/i386/kvm/vmsr_energy.c
+++ b/target/i386/kvm/vmsr_energy.c
@@ -27,15 +27,6 @@ char *vmsr_compute_default_paths(void)
     return g_build_filename(state, "run", "qemu-vmsr-helper.sock", NULL);
 }
 
-bool is_host_cpu_intel(void)
-{
-    char vendor[CPUID_VENDOR_SZ + 1];
-
-    host_cpu_vendor_fms(vendor, NULL, NULL, NULL);
-
-    return g_str_equal(vendor, CPUID_VENDOR_INTEL);
-}
-
 int is_rapl_enabled(void)
 {
     const char *path = "/sys/class/powercap/intel-rapl/enabled";
diff --git a/target/i386/kvm/vmsr_energy.h b/target/i386/kvm/vmsr_energy.h
index 16cc1f4814..151bcbd642 100644
--- a/target/i386/kvm/vmsr_energy.h
+++ b/target/i386/kvm/vmsr_energy.h
@@ -94,6 +94,5 @@ double vmsr_get_ratio(uint64_t e_delta,
                       unsigned long long delta_ticks,
                       unsigned int maxticks);
 void vmsr_init_topo_info(X86CPUTopoInfo *topo_info, const MachineState *ms);
-bool is_host_cpu_intel(void);
 int is_rapl_enabled(void);
 #endif /* VMSR_ENERGY_H */

From 7e862c3526450fe7cb14e25b5200036c237baa03 Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Mon, 30 Jun 2025 16:06:07 +0800
Subject: [PATCH 2178/2760] i386/cpu: Use CPUID_MODEL_ID_SZ instead of
 hardcoded 48
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

There is already the MACRO CPUID_MODEL_ID_SZ defined in QEMU. Use it to
replace all the hardcoded 48.

Opportunistically fix the indentation of CPUID_VENDOR_SZ.

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/r/20250630080610.3151956-2-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c      | 8 ++++----
 target/i386/cpu.h      | 3 ++-
 target/i386/host-cpu.c | 1 -
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 44178bc523..70b742fcde 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -6469,11 +6469,11 @@ static char *x86_cpuid_get_model_id(Object *obj, Error **errp)
     char *value;
     int i;
 
-    value = g_malloc(48 + 1);
-    for (i = 0; i < 48; i++) {
+    value = g_malloc(CPUID_MODEL_ID_SZ + 1);
+    for (i = 0; i < CPUID_MODEL_ID_SZ; i++) {
         value[i] = env->cpuid_model[i >> 2] >> (8 * (i & 3));
     }
-    value[48] = '\0';
+    value[CPUID_MODEL_ID_SZ] = '\0';
     return value;
 }
 
@@ -6488,7 +6488,7 @@ static void x86_cpuid_set_model_id(Object *obj, const char *model_id,
         model_id = "";
     }
     len = strlen(model_id);
-    memset(env->cpuid_model, 0, 48);
+    memset(env->cpuid_model, 0, CPUID_MODEL_ID_SZ);
     for (i = 0; i < 48; i++) {
         if (i >= len) {
             c = '\0';
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index 9829824ac8..b3bb988857 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -1159,7 +1159,8 @@ uint64_t x86_cpu_get_supported_feature_word(X86CPU *cpu, FeatureWord w);
 /* PMM enabled */
 #define CPUID_C000_0001_EDX_PMM_EN             (1U << 13)
 
-#define CPUID_VENDOR_SZ      12
+#define CPUID_VENDOR_SZ     12
+#define CPUID_MODEL_ID_SZ   48
 
 #define CPUID_VENDOR_INTEL_1 0x756e6547 /* "Genu" */
 #define CPUID_VENDOR_INTEL_2 0x49656e69 /* "ineI" */
diff --git a/target/i386/host-cpu.c b/target/i386/host-cpu.c
index e9a49e628f..b1fb6d6816 100644
--- a/target/i386/host-cpu.c
+++ b/target/i386/host-cpu.c
@@ -80,7 +80,6 @@ bool host_cpu_realizefn(CPUState *cs, Error **errp)
     return true;
 }
 
-#define CPUID_MODEL_ID_SZ 48
 /**
  * cpu_x86_fill_model_id:
  * Get CPUID model ID string from host CPU.

From 58f17c4a4fe9fc78bcadcdceada4c094c4b1d2c8 Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Mon, 30 Jun 2025 16:06:08 +0800
Subject: [PATCH 2179/2760] i386: Cleanup the usage of CPUID_VENDOR_INTEL_1

There are code using "env->cpuid_vendor1 == CPUID_VENDOR_INTEL_1" to
check if it is Intel vcpu. Cleanup them to just use IS_INTEL_CPU()

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Link: https://lore.kernel.org/r/20250630080610.3151956-3-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c                | 2 +-
 target/i386/tcg/decode-new.c.inc | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 70b742fcde..d3d13b1472 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -7761,7 +7761,7 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
         *ecx = env->features[FEAT_8000_0001_ECX];
         *edx = env->features[FEAT_8000_0001_EDX];
 
-        if (tcg_enabled() && env->cpuid_vendor1 == CPUID_VENDOR_INTEL_1 &&
+        if (tcg_enabled() && IS_INTEL_CPU(env) &&
             !(env->hflags & HF_LMA_MASK)) {
             *edx &= ~CPUID_EXT2_SYSCALL;
         }
diff --git a/target/i386/tcg/decode-new.c.inc b/target/i386/tcg/decode-new.c.inc
index 55216e0d24..853b1c8bf9 100644
--- a/target/i386/tcg/decode-new.c.inc
+++ b/target/i386/tcg/decode-new.c.inc
@@ -2722,14 +2722,14 @@ static void disas_insn(DisasContext *s, CPUState *cpu)
             if (decode.e.check & X86_CHECK_i64) {
                 goto illegal_op;
             }
-            if ((decode.e.check & X86_CHECK_i64_amd) && env->cpuid_vendor1 != CPUID_VENDOR_INTEL_1) {
+            if ((decode.e.check & X86_CHECK_i64_amd) && !IS_INTEL_CPU(env)) {
                 goto illegal_op;
             }
         } else {
             if (decode.e.check & X86_CHECK_o64) {
                 goto illegal_op;
             }
-            if ((decode.e.check & X86_CHECK_o64_intel) && env->cpuid_vendor1 == CPUID_VENDOR_INTEL_1) {
+            if ((decode.e.check & X86_CHECK_o64_intel) && IS_INTEL_CPU(env)) {
                 goto illegal_op;
             }
         }

From 3359b588f1f51c1ceaa72eb95cdc7e842d00a5b0 Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Mon, 30 Jun 2025 16:06:09 +0800
Subject: [PATCH 2180/2760] i386/kvm-cpu: Fix the indentation inside
 kvm_cpu_realizefn()

The indentation of one of the } inside kvm_cpu_realizefn() isn'f
correct. fix it.

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Link: https://lore.kernel.org/r/20250630080610.3151956-4-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/kvm/kvm-cpu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/i386/kvm/kvm-cpu.c b/target/i386/kvm/kvm-cpu.c
index a99b876464..89a7953659 100644
--- a/target/i386/kvm/kvm-cpu.c
+++ b/target/i386/kvm/kvm-cpu.c
@@ -73,7 +73,7 @@ static bool kvm_cpu_realizefn(CPUState *cs, Error **errp)
             if (env->features[FEAT_1_ECX] & CPUID_EXT_MONITOR) {
                 host_cpuid(5, 0, &cpu->mwait.eax, &cpu->mwait.ebx,
                            &cpu->mwait.ecx, &cpu->mwait.edx);
-	    }
+            }
         }
         if (cpu->ucode_rev == 0) {
             cpu->ucode_rev =

From b6c5b41ba28198030ce2f2b19cf333a9129d07dc Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Mon, 30 Jun 2025 16:06:10 +0800
Subject: [PATCH 2181/2760] i386/cpu: Unify family, model and stepping
 calculation for x86 CPU

There are multiple places where CPUID family/model/stepping info
are retrieved from env->cpuid_version.

Besides, the calculation of family and model inside host_cpu_vendor_fms()
doesn't comply to what Intel and AMD define. For family, both Intel
and AMD define that Extended Family ID needs to be counted only when
(base) Family is 0xF. For model, Intel counts Extended Model when
(base) Family is 0x6 or 0xF, while AMD counts EXtended MOdel when
(base) Family is 0xF.

Introduce generic helper functions to get family, model and stepping
from the EAX value of CPUID leaf 1, with the correct calculation
formula.

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Link: https://lore.kernel.org/r/20250630080610.3151956-5-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c      | 12 ++++--------
 target/i386/cpu.h      | 30 ++++++++++++++++++++++++++++++
 target/i386/host-cpu.c |  6 +++---
 target/i386/kvm/kvm.c  |  2 +-
 4 files changed, 38 insertions(+), 12 deletions(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index d3d13b1472..b768838b10 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -6325,10 +6325,7 @@ static void x86_cpuid_version_get_family(Object *obj, Visitor *v,
     CPUX86State *env = &cpu->env;
     uint64_t value;
 
-    value = (env->cpuid_version >> 8) & 0xf;
-    if (value == 0xf) {
-        value += (env->cpuid_version >> 20) & 0xff;
-    }
+    value = x86_cpu_family(env->cpuid_version);
     visit_type_uint64(v, name, &value, errp);
 }
 
@@ -6366,8 +6363,7 @@ static void x86_cpuid_version_get_model(Object *obj, Visitor *v,
     CPUX86State *env = &cpu->env;
     uint64_t value;
 
-    value = (env->cpuid_version >> 4) & 0xf;
-    value |= ((env->cpuid_version >> 16) & 0xf) << 4;
+    value = x86_cpu_model(env->cpuid_version);
     visit_type_uint64(v, name, &value, errp);
 }
 
@@ -6401,7 +6397,7 @@ static void x86_cpuid_version_get_stepping(Object *obj, Visitor *v,
     CPUX86State *env = &cpu->env;
     uint64_t value;
 
-    value = env->cpuid_version & 0xf;
+    value = x86_cpu_stepping(env->cpuid_version);
     visit_type_uint64(v, name, &value, errp);
 }
 
@@ -8155,7 +8151,7 @@ static void mce_init(X86CPU *cpu)
     CPUX86State *cenv = &cpu->env;
     unsigned int bank;
 
-    if (((cenv->cpuid_version >> 8) & 0xf) >= 6
+    if (x86_cpu_family(cenv->cpuid_version) >= 6
         && (cenv->features[FEAT_1_EDX] & (CPUID_MCE | CPUID_MCA)) ==
             (CPUID_MCE | CPUID_MCA)) {
         cenv->mcg_cap = MCE_CAP_DEF | MCE_BANKS_DEF |
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index b3bb988857..a580562b3d 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -2678,6 +2678,36 @@ static inline int32_t x86_get_a20_mask(CPUX86State *env)
     }
 }
 
+static inline uint32_t x86_cpu_family(uint32_t eax)
+{
+    uint32_t family = (eax >> 8) & 0xf;
+
+    if (family == 0xf) {
+        family += (eax >> 20) & 0xff;
+    }
+
+    return family;
+}
+
+static inline uint32_t x86_cpu_model(uint32_t eax)
+{
+    uint32_t family, model;
+
+    family = x86_cpu_family(eax);
+    model = (eax >> 4) & 0xf;
+
+    if (family >= 0x6) {
+        model += ((eax >> 16) & 0xf) << 4;
+    }
+
+    return model;
+}
+
+static inline uint32_t x86_cpu_stepping(uint32_t eax)
+{
+    return eax & 0xf;
+}
+
 static inline bool cpu_has_vmx(CPUX86State *env)
 {
     return env->features[FEAT_1_ECX] & CPUID_EXT_VMX;
diff --git a/target/i386/host-cpu.c b/target/i386/host-cpu.c
index b1fb6d6816..d5e2bb5e18 100644
--- a/target/i386/host-cpu.c
+++ b/target/i386/host-cpu.c
@@ -117,13 +117,13 @@ void host_cpu_vendor_fms(char *vendor, int *family, int *model, int *stepping)
 
     host_cpuid(0x1, 0, &eax, &ebx, &ecx, &edx);
     if (family) {
-        *family = ((eax >> 8) & 0x0F) + ((eax >> 20) & 0xFF);
+        *family = x86_cpu_family(eax);
     }
     if (model) {
-        *model = ((eax >> 4) & 0x0F) | ((eax & 0xF0000) >> 12);
+        *model = x86_cpu_model(eax);
     }
     if (stepping) {
-        *stepping = eax & 0x0F;
+        *stepping = x86_cpu_stepping(eax);
     }
 }
 
diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
index fc58a23b30..e8c8be09ba 100644
--- a/target/i386/kvm/kvm.c
+++ b/target/i386/kvm/kvm.c
@@ -2259,7 +2259,7 @@ int kvm_arch_init_vcpu(CPUState *cs)
     cpuid_i = kvm_x86_build_cpuid(env, cpuid_data.entries, cpuid_i);
     cpuid_data.cpuid.nent = cpuid_i;
 
-    if (((env->cpuid_version >> 8)&0xF) >= 6
+    if (x86_cpu_family(env->cpuid_version) >= 6
         && (env->features[FEAT_1_EDX] & (CPUID_MCE | CPUID_MCA)) ==
            (CPUID_MCE | CPUID_MCA)) {
         uint64_t mcg_cap, unsupported_caps;

From 50fd57418c3f08f13eb964dcb49f065246f2ecbf Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Wed, 25 Jun 2025 11:55:05 +0800
Subject: [PATCH 2182/2760] i386/tdx: Remove task->watch only when it's valid

In some case (e.g., failed to connect to QGS socket),
tdx_generate_quote_cleanup() is called with task->watch invalid. It
triggers assertion of

  qemu-system-x86_64: GLib: g_source_remove: assertion 'tag > 0' failed

Fix it by checking task->watch.

Fixes: 40da501d8989 ("i386/tdx: handle TDG.VP.VMCALL<GetQuote>")
Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250625035505.2770580-1-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/kvm/tdx-quote-generator.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/target/i386/kvm/tdx-quote-generator.c b/target/i386/kvm/tdx-quote-generator.c
index f59715f617..dee8334b27 100644
--- a/target/i386/kvm/tdx-quote-generator.c
+++ b/target/i386/kvm/tdx-quote-generator.c
@@ -75,7 +75,9 @@ static void tdx_generate_quote_cleanup(TdxGenerateQuoteTask *task)
 {
     timer_del(&task->timer);
 
-    g_source_remove(task->watch);
+    if (task->watch) {
+        g_source_remove(task->watch);
+    }
     qio_channel_close(QIO_CHANNEL(task->sioc), NULL);
     object_unref(OBJECT(task->sioc));
 

From 7ff24fb657d35c014f735f69aef03810fde607ab Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Wed, 25 Jun 2025 11:57:10 +0800
Subject: [PATCH 2183/2760] i386/tdx: Don't mask off CPUID_EXT_PDCM

It gets below warning when booting TDX VMs:

  warning: TDX forcibly sets the feature: CPUID[eax=01h].ECX.pdcm [bit 15]

Because CPUID_EXT_PDCM is fixed1 for TDX, and MSR_IA32_PERF_CAPABILITIES is
supported for TDX guest unconditioanlly.

Don't mask off CPUID_EXT_PDCM for TDX.

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250625035710.2770679-1-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index b768838b10..f9e6bc8d0e 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -28,6 +28,7 @@
 #include "system/hvf.h"
 #include "hvf/hvf-i386.h"
 #include "kvm/kvm_i386.h"
+#include "kvm/tdx.h"
 #include "sev.h"
 #include "qapi/error.h"
 #include "qemu/error-report.h"
@@ -8336,7 +8337,8 @@ void x86_cpu_expand_features(X86CPU *cpu, Error **errp)
         }
     }
 
-    if (!cpu->enable_pmu) {
+    /* PDCM is fixed1 bit for TDX */
+    if (!cpu->enable_pmu && !is_tdx_vm()) {
         mark_unavailable_features(cpu, FEAT_1_ECX,
                                   env->user_features[FEAT_1_ECX] & CPUID_EXT_PDCM,
                                   "This feature is not available due to PMU being disabled");

From 1034b94fe98da35857f261d4db89ce2ebed8c5c3 Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Fri, 11 Jul 2025 18:21:26 +0800
Subject: [PATCH 2184/2760] i386/cpu: Refine comment of
 CPUID2CacheDescriptorInfo

Refer to SDM vol.3 table 1-21, add the notes about the missing
descriptor, and fix the typo and comment format.

Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Tested-by: Yi Lai <yi1.lai@intel.com>
Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250711102143.1622339-2-zhao1.liu@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 31 ++++++++++++++++++++++---------
 1 file changed, 22 insertions(+), 9 deletions(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index f9e6bc8d0e..f107e58673 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -68,6 +68,7 @@ struct CPUID2CacheDescriptorInfo {
 
 /*
  * Known CPUID 2 cache descriptors.
+ * TLB, prefetch and sectored cache related descriptors are not included.
  * From Intel SDM Volume 2A, CPUID instruction
  */
 struct CPUID2CacheDescriptorInfo cpuid2_cache_descriptors[] = {
@@ -89,18 +90,29 @@ struct CPUID2CacheDescriptorInfo cpuid2_cache_descriptors[] = {
                .associativity = 2,  .line_size = 64, },
     [0x21] = { .level = 2, .type = UNIFIED_CACHE,     .size = 256 * KiB,
                .associativity = 8,  .line_size = 64, },
-    /* lines per sector is not supported cpuid2_cache_descriptor(),
-    * so descriptors 0x22, 0x23 are not included
-    */
+    /*
+     * lines per sector is not supported cpuid2_cache_descriptor(),
+     * so descriptors 0x22, 0x23 are not included
+     */
     [0x24] = { .level = 2, .type = UNIFIED_CACHE,     .size =   1 * MiB,
                .associativity = 16, .line_size = 64, },
-    /* lines per sector is not supported cpuid2_cache_descriptor(),
-    * so descriptors 0x25, 0x20 are not included
-    */
+    /*
+     * lines per sector is not supported cpuid2_cache_descriptor(),
+     * so descriptors 0x25, 0x29 are not included
+     */
     [0x2C] = { .level = 1, .type = DATA_CACHE,        .size =  32 * KiB,
                .associativity = 8,  .line_size = 64, },
     [0x30] = { .level = 1, .type = INSTRUCTION_CACHE, .size =  32 * KiB,
                .associativity = 8,  .line_size = 64, },
+    /*
+     * Newer Intel CPUs (having the cores without L3, e.g., Intel MTL, ARL)
+     * use CPUID 0x4 leaf to describe cache topology, by encoding CPUID 0x2
+     * leaf with 0xFF. For older CPUs (without 0x4 leaf), it's also valid
+     * to just ignore L3's code if there's no L3.
+     *
+     * This already covers all the cases in QEMU, so code 0x40 is not
+     * included.
+     */
     [0x41] = { .level = 2, .type = UNIFIED_CACHE,     .size = 128 * KiB,
                .associativity = 4,  .line_size = 32, },
     [0x42] = { .level = 2, .type = UNIFIED_CACHE,     .size = 256 * KiB,
@@ -138,9 +150,10 @@ struct CPUID2CacheDescriptorInfo cpuid2_cache_descriptors[] = {
                .associativity = 4,  .line_size = 64, },
     [0x78] = { .level = 2, .type = UNIFIED_CACHE,     .size =   1 * MiB,
                .associativity = 4,  .line_size = 64, },
-    /* lines per sector is not supported cpuid2_cache_descriptor(),
-    * so descriptors 0x79, 0x7A, 0x7B, 0x7C are not included.
-    */
+    /*
+     * lines per sector is not supported cpuid2_cache_descriptor(),
+     * so descriptors 0x79, 0x7A, 0x7B, 0x7C are not included.
+     */
     [0x7D] = { .level = 2, .type = UNIFIED_CACHE,     .size =   2 * MiB,
                .associativity = 8,  .line_size = 64, },
     [0x7F] = { .level = 2, .type = UNIFIED_CACHE,     .size = 512 * KiB,

From 67d54014afcfdd316a0e9c979a0ff8145d4cf963 Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Fri, 11 Jul 2025 18:21:27 +0800
Subject: [PATCH 2185/2760] i386/cpu: Add descriptor 0x49 for CPUID 0x2
 encoding

The legacy_l2_cache (2nd-level cache: 4 MByte, 16-way set associative,
64 byte line size) corresponds to descriptor 0x49, but at present
cpuid2_cache_descriptors doesn't support descriptor 0x49 because it has
multiple meanings.

The 0x49 is necessary when CPUID 0x2 and 0x4 leaves have the consistent
cache model, and use legacy_l2_cache as the default L2 cache.

Therefore, add descriptor 0x49 to represent general L2 cache.

Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Tested-by: Yi Lai <yi1.lai@intel.com>
Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250711102143.1622339-3-zhao1.liu@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index f107e58673..4386b60ff6 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -129,7 +129,18 @@ struct CPUID2CacheDescriptorInfo cpuid2_cache_descriptors[] = {
                .associativity = 8,  .line_size = 64, },
     [0x48] = { .level = 2, .type = UNIFIED_CACHE,     .size =   3 * MiB,
                .associativity = 12, .line_size = 64, },
-    /* Descriptor 0x49 depends on CPU family/model, so it is not included */
+    /*
+     * Descriptor 0x49 has 2 cases:
+     *  - 2nd-level cache: 4 MByte, 16-way set associative, 64 byte line size.
+     *  - 3rd-level cache: 4MB, 16-way set associative, 64-byte line size
+     *    (Intel Xeon processor MP, Family 0FH, Model 06H).
+     *
+     * When it represents L3, then it depends on CPU family/model. Fortunately,
+     * the legacy cache/CPU models don't have such special L3. So, just add it
+     * to represent the general L2 case.
+     */
+    [0x49] = { .level = 2, .type = UNIFIED_CACHE,     .size =   4 * MiB,
+               .associativity = 16, .line_size = 64, },
     [0x4A] = { .level = 3, .type = UNIFIED_CACHE,     .size =   6 * MiB,
                .associativity = 12, .line_size = 64, },
     [0x4B] = { .level = 3, .type = UNIFIED_CACHE,     .size =   8 * MiB,

From 2c70a50c8c3d8620f34884b340778358b6faf5d4 Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Fri, 11 Jul 2025 18:21:28 +0800
Subject: [PATCH 2186/2760] i386/cpu: Add default cache model for Intel CPUs
 with level < 4

Old Intel CPUs with CPUID level < 4, use CPUID 0x2 leaf (if available)
to encode cache information.

Introduce a cache model "legacy_intel_cpuid2_cache_info" for the CPUs
with CPUID level < 4, based on legacy_l1d_cache, legacy_l1i_cache,
legacy_l2_cache_cpuid2 and legacy_l3_cache. But for L2 cache, this
cache model completes self_init, sets, partitions, no_invd_sharing and
share_level fields, referring legacy_l2_cache, to avoid someone
increases CPUID level manually and meets assert() error. But the cache
information present in CPUID 0x2 leaf doesn't change.

This new cache model makes it possible to remove legacy_l2_cache_cpuid2
in X86CPUState and help to clarify historical cache inconsistency issue.

Furthermore, apply this legacy cache model to all Intel CPUs with CPUID
level < 4. This includes not only "pentium2" and "pentium3" (which have
0x2 leaf), but also "486" and "pentium" (which only have 0x1 leaf, and
cache model won't be presented, just for simplicity).

A legacy_intel_cpuid2_cache_info cache model doesn't change the cache
information of the above CPUs, because they just depend on 0x2 leaf.

Only when someone adjusts the min-level to >=4 will the cache
information in CPUID leaf 4 differ from before: previously, the L2
cache information in CPUID leaf 0x2 and 0x4 was different, but now with
legacy_intel_cpuid2_cache_info, the information they present will be
consistent. This case almost never happens, emulating a CPUID that is
not supported by the "ancient" hardware is itself meaningless behavior.

Therefore, even though there's the above difference (for really rare
case) and considering these old CPUs ("486", "pentium", "pentium2" and
"pentium3") won't be used for migration, there's no need to add new
versioned CPU models

Tested-by: Yi Lai <yi1.lai@intel.com>
Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250711102143.1622339-4-zhao1.liu@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 65 +++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 65 insertions(+)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 4386b60ff6..3278d5de5a 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -712,6 +712,67 @@ static CPUCacheInfo legacy_l3_cache = {
     .share_level = CPU_TOPOLOGY_LEVEL_DIE,
 };
 
+/*
+ * Only used for the CPU models with CPUID level < 4.
+ * These CPUs (CPUID level < 4) only use CPUID leaf 2 to present
+ * cache information.
+ *
+ * Note: This cache model is just a default one, and is not
+ *       guaranteed to match real hardwares.
+ */
+static const CPUCaches legacy_intel_cpuid2_cache_info = {
+    .l1d_cache = &(CPUCacheInfo) {
+        .type = DATA_CACHE,
+        .level = 1,
+        .size = 32 * KiB,
+        .self_init = 1,
+        .line_size = 64,
+        .associativity = 8,
+        .sets = 64,
+        .partitions = 1,
+        .no_invd_sharing = true,
+        .share_level = CPU_TOPOLOGY_LEVEL_CORE,
+    },
+    .l1i_cache = &(CPUCacheInfo) {
+        .type = INSTRUCTION_CACHE,
+        .level = 1,
+        .size = 32 * KiB,
+        .self_init = 1,
+        .line_size = 64,
+        .associativity = 8,
+        .sets = 64,
+        .partitions = 1,
+        .no_invd_sharing = true,
+        .share_level = CPU_TOPOLOGY_LEVEL_CORE,
+    },
+    .l2_cache = &(CPUCacheInfo) {
+        .type = UNIFIED_CACHE,
+        .level = 2,
+        .size = 2 * MiB,
+        .self_init = 1,
+        .line_size = 64,
+        .associativity = 8,
+        .sets = 4096,
+        .partitions = 1,
+        .no_invd_sharing = true,
+        .share_level = CPU_TOPOLOGY_LEVEL_CORE,
+    },
+    .l3_cache = &(CPUCacheInfo) {
+        .type = UNIFIED_CACHE,
+        .level = 3,
+        .size = 16 * MiB,
+        .line_size = 64,
+        .associativity = 16,
+        .sets = 16384,
+        .partitions = 1,
+        .lines_per_tag = 1,
+        .self_init = true,
+        .inclusive = true,
+        .complex_indexing = true,
+        .share_level = CPU_TOPOLOGY_LEVEL_DIE,
+    },
+};
+
 /* TLB definitions: */
 
 #define L1_DTLB_2M_ASSOC       1
@@ -3045,6 +3106,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
             I486_FEATURES,
         .xlevel = 0,
         .model_id = "",
+        .cache_info = &legacy_intel_cpuid2_cache_info,
     },
     {
         .name = "pentium",
@@ -3057,6 +3119,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
             PENTIUM_FEATURES,
         .xlevel = 0,
         .model_id = "",
+        .cache_info = &legacy_intel_cpuid2_cache_info,
     },
     {
         .name = "pentium2",
@@ -3069,6 +3132,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
             PENTIUM2_FEATURES,
         .xlevel = 0,
         .model_id = "",
+        .cache_info = &legacy_intel_cpuid2_cache_info,
     },
     {
         .name = "pentium3",
@@ -3081,6 +3145,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
             PENTIUM3_FEATURES,
         .xlevel = 0,
         .model_id = "",
+        .cache_info = &legacy_intel_cpuid2_cache_info,
     },
     {
         .name = "athlon",

From 6699e5dc864b0793e4fd90ef8038f6c71fcd0d47 Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Fri, 11 Jul 2025 18:21:29 +0800
Subject: [PATCH 2187/2760] i386/cpu: Present same cache model in CPUID 0x2 &
 0x4

For a long time, the default cache models used in CPUID 0x2 and
0x4 were inconsistent and had a FIXME note from Eduardo at commit
5e891bf8fd50 ("target-i386: Use #defines instead of magic numbers for
CPUID cache info"):

"/*FIXME: CPUID leaf 2 descriptor is inconsistent with CPUID leaf 4 */".

This difference is wrong, in principle, both 0x2 and 0x4 are used for
Intel's cache description. 0x2 leaf is used for ancient machines while
0x4 leaf is a subsequent addition, and both should be based on the same
cache model. Furthermore, on real hardware, 0x4 leaf should be used in
preference to 0x2 when it is available.

Revisiting the git history, that difference occurred much earlier.

Current legacy_l2_cache_cpuid2 (hardcode: "0x2c307d"), which is used for
CPUID 0x2 leaf, is introduced in commit d8134d91d9b7 ("Intel cache info,
by Filip Navara."). Its commit message didn't said anything, but its
patch [1] mentioned the cache model chosen is "closest to the ones
reported in the AMD registers". Now it is not possible to check which
AMD generation this cache model is based on (unfortunately, AMD does not
use 0x2 leaf), but at least it is close to the Pentium 4.

In fact, the patch description of commit d8134d91d9b7 is also a bit
wrong, the original cache model in leaf 2 is from Pentium Pro, and its
cache descriptor had specified the cache line size ad 32 byte by default,
while the updated cache model in commit d8134d91d9b7 has 64 byte line
size. But after so many years, such judgments are no longer meaningful.

On the other hand, for legacy_l2_cache, which is used in CPUID 0x4 leaf,
is based on Intel Core Duo (patch [2]) and Core2 Duo (commit e737b32a3688
("Core 2 Duo specification (Alexander Graf).")

The patches of Core Duo and Core 2 Duo add the cache model for CPUID
0x4, but did not update CPUID 0x2 encoding. This is the reason that
Intel Guests use two cache models in 0x2 and 0x4 all the time.

Of course, while no Core Duo or Core 2 Duo machines have been found for
double checking, this still makes no sense to encode different cache
models on a single machine.

Referring to the SDM and the real hardware available, 0x2 leaf can be
directly encoded 0xFF to instruct software to go to 0x4 leaf to get the
cache information, when 0x4 is available.

Therefore, it's time to clean up Intel's default cache models. As the
first step, add "x-consistent-cache" compat option to allow newer
machines (v10.1 and newer) to have the consistent cache model in CPUID
0x2 and 0x4 leaves.

This doesn't affect the CPU models with CPUID level < 4 ("486",
"pentium", "pentium2" and "pentium3"), because they have already had the
special default cache model - legacy_intel_cpuid2_cache_info.

[1]: https://lore.kernel.org/qemu-devel/5b31733c0709081227w3e5f1036odbc649edfdc8c79b@mail.gmail.com/
[2]: https://lore.kernel.org/qemu-devel/478B65C8.2080602@csgraf.de/

Cc: Alexander Graf <agraf@csgraf.de>
Tested-by: Yi Lai <yi1.lai@intel.com>
Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250711102143.1622339-5-zhao1.liu@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/i386/pc.c      | 4 +++-
 target/i386/cpu.c | 7 ++++++-
 target/i386/cpu.h | 7 +++++++
 3 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/hw/i386/pc.c b/hw/i386/pc.c
index 432ab288a8..a6fa792368 100644
--- a/hw/i386/pc.c
+++ b/hw/i386/pc.c
@@ -81,7 +81,9 @@
     { "qemu64-" TYPE_X86_CPU, "model-id", "QEMU Virtual CPU version " v, },\
     { "athlon-" TYPE_X86_CPU, "model-id", "QEMU Virtual CPU version " v, },
 
-GlobalProperty pc_compat_10_0[] = {};
+GlobalProperty pc_compat_10_0[] = {
+    { TYPE_X86_CPU, "x-consistent-cache", "false" },
+};
 const size_t pc_compat_10_0_len = G_N_ELEMENTS(pc_compat_10_0);
 
 GlobalProperty pc_compat_9_2[] = {};
diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 3278d5de5a..1f27fcf3ee 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -8935,7 +8935,11 @@ static void x86_cpu_realizefn(DeviceState *dev, Error **errp)
         /* Build legacy cache information */
         env->cache_info_cpuid2.l1d_cache = &legacy_l1d_cache;
         env->cache_info_cpuid2.l1i_cache = &legacy_l1i_cache;
-        env->cache_info_cpuid2.l2_cache = &legacy_l2_cache_cpuid2;
+        if (!cpu->consistent_cache) {
+            env->cache_info_cpuid2.l2_cache = &legacy_l2_cache_cpuid2;
+        } else {
+            env->cache_info_cpuid2.l2_cache = &legacy_l2_cache;
+        }
         env->cache_info_cpuid2.l3_cache = &legacy_l3_cache;
 
         env->cache_info_cpuid4.l1d_cache = &legacy_l1d_cache;
@@ -9461,6 +9465,7 @@ static const Property x86_cpu_properties[] = {
      * own cache information (see x86_cpu_load_def()).
      */
     DEFINE_PROP_BOOL("legacy-cache", X86CPU, legacy_cache, true),
+    DEFINE_PROP_BOOL("x-consistent-cache", X86CPU, consistent_cache, true),
     DEFINE_PROP_BOOL("legacy-multi-node", X86CPU, legacy_multi_node, false),
     DEFINE_PROP_BOOL("xen-vapic", X86CPU, xen_vapic, false),
 
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index a580562b3d..a3ebd3e08c 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -2259,6 +2259,13 @@ struct ArchCPU {
      */
     bool legacy_cache;
 
+    /*
+     * Compatibility bits for old machine types.
+     * If true, use the same cache model in CPUID leaf 0x2
+     * and 0x4.
+     */
+    bool consistent_cache;
+
     /* Compatibility bits for old machine types.
      * If true decode the CPUID Function 0x8000001E_ECX to support multiple
      * nodes per processor

From fe77a78149359485459db26814af436cfc873afe Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Fri, 11 Jul 2025 18:21:30 +0800
Subject: [PATCH 2188/2760] i386/cpu: Consolidate CPUID 0x4 leaf

Modern Intel CPUs use CPUID 0x4 leaf to describe cache information
and leave space in 0x2 for prefetch and TLBs (even TLB has its own leaf
CPUID 0x18).

And 0x2 leaf provides a descriptor 0xFF to instruct software to check
cache information in 0x4 leaf instead.

Therefore, follow this behavior to encode 0xFF when Intel CPU has 0x4
leaf with "x-consistent-cache=true" for compatibility.

In addition, for older CPUs without 0x4 leaf, still enumerate the cache
descriptor in 0x2 leaf, except the case that there's no descriptor
matching the cache model, then directly encode 0xFF in 0x2 leaf. This
makes sense, as in the 0x2 leaf era, all supported caches should have
the corresponding descriptor.

Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Tested-by: Yi Lai <yi1.lai@intel.com>
Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250711102143.1622339-6-zhao1.liu@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 48 ++++++++++++++++++++++++++++++++++++-----------
 1 file changed, 37 insertions(+), 11 deletions(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 1f27fcf3ee..812e85b952 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -225,7 +225,7 @@ struct CPUID2CacheDescriptorInfo cpuid2_cache_descriptors[] = {
  * Return a CPUID 2 cache descriptor for a given cache.
  * If no known descriptor is found, return CACHE_DESCRIPTOR_UNAVAILABLE
  */
-static uint8_t cpuid2_cache_descriptor(CPUCacheInfo *cache)
+static uint8_t cpuid2_cache_descriptor(CPUCacheInfo *cache, bool *unmacthed)
 {
     int i;
 
@@ -242,9 +242,44 @@ static uint8_t cpuid2_cache_descriptor(CPUCacheInfo *cache)
             }
     }
 
+    *unmacthed |= true;
     return CACHE_DESCRIPTOR_UNAVAILABLE;
 }
 
+/* Encode cache info for CPUID[2] */
+static void encode_cache_cpuid2(X86CPU *cpu,
+                                uint32_t *eax, uint32_t *ebx,
+                                uint32_t *ecx, uint32_t *edx)
+{
+    CPUX86State *env = &cpu->env;
+    CPUCaches *caches = &env->cache_info_cpuid2;
+    int l1d, l1i, l2, l3;
+    bool unmatched = false;
+
+    *eax = 1; /* Number of CPUID[EAX=2] calls required */
+    *ebx = *ecx = *edx = 0;
+
+    l1d = cpuid2_cache_descriptor(caches->l1d_cache, &unmatched);
+    l1i = cpuid2_cache_descriptor(caches->l1i_cache, &unmatched);
+    l2 = cpuid2_cache_descriptor(caches->l2_cache, &unmatched);
+    l3 = cpuid2_cache_descriptor(caches->l3_cache, &unmatched);
+
+    if (!cpu->consistent_cache ||
+        (env->cpuid_min_level < 0x4 && !unmatched)) {
+        /*
+         * Though SDM defines code 0x40 for cases with no L2 or L3. It's
+         * also valid to just ignore l3's code if there's no l2.
+         */
+        if (cpu->enable_l3_cache) {
+            *ecx = l3;
+        }
+        *edx = (l1d << 16) | (l1i <<  8) | l2;
+    } else {
+        *ecx = 0;
+        *edx = CACHE_DESCRIPTOR_UNAVAILABLE;
+    }
+}
+
 /* CPUID Leaf 4 constants: */
 
 /* EAX: */
@@ -7446,16 +7481,7 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
             *eax = *ebx = *ecx = *edx = 0;
             break;
         }
-        *eax = 1; /* Number of CPUID[EAX=2] calls required */
-        *ebx = 0;
-        if (!cpu->enable_l3_cache) {
-            *ecx = 0;
-        } else {
-            *ecx = cpuid2_cache_descriptor(env->cache_info_cpuid2.l3_cache);
-        }
-        *edx = (cpuid2_cache_descriptor(env->cache_info_cpuid2.l1d_cache) << 16) |
-               (cpuid2_cache_descriptor(env->cache_info_cpuid2.l1i_cache) <<  8) |
-               (cpuid2_cache_descriptor(env->cache_info_cpuid2.l2_cache));
+        encode_cache_cpuid2(cpu, eax, ebx, ecx, edx);
         break;
     case 4:
         /* cache info: needed for Core compatibility */

From c416411c28a2b21e590943f300ce0336f109abb5 Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Fri, 11 Jul 2025 18:21:31 +0800
Subject: [PATCH 2189/2760] i386/cpu: Drop CPUID 0x2 specific cache info in
 X86CPUState

With the pre-defined cache model legacy_intel_cpuid2_cache_info,
for X86CPUState there's no need to cache special cache information
for CPUID 0x2 leaf.

Drop the cache_info_cpuid2 field of X86CPUState and use the
legacy_intel_cpuid2_cache_info directly.

Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Tested-by: Yi Lai <yi1.lai@intel.com>
Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250711102143.1622339-7-zhao1.liu@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 31 +++++++++++--------------------
 target/i386/cpu.h |  3 ++-
 2 files changed, 13 insertions(+), 21 deletions(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 812e85b952..ac22548f47 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -246,19 +246,27 @@ static uint8_t cpuid2_cache_descriptor(CPUCacheInfo *cache, bool *unmacthed)
     return CACHE_DESCRIPTOR_UNAVAILABLE;
 }
 
+static const CPUCaches legacy_intel_cpuid2_cache_info;
+
 /* Encode cache info for CPUID[2] */
 static void encode_cache_cpuid2(X86CPU *cpu,
                                 uint32_t *eax, uint32_t *ebx,
                                 uint32_t *ecx, uint32_t *edx)
 {
     CPUX86State *env = &cpu->env;
-    CPUCaches *caches = &env->cache_info_cpuid2;
+    const CPUCaches *caches;
     int l1d, l1i, l2, l3;
     bool unmatched = false;
 
     *eax = 1; /* Number of CPUID[EAX=2] calls required */
     *ebx = *ecx = *edx = 0;
 
+    if (env->enable_legacy_cpuid2_cache) {
+        caches = &legacy_intel_cpuid2_cache_info;
+    } else {
+        caches = &env->cache_info_cpuid4;
+    }
+
     l1d = cpuid2_cache_descriptor(caches->l1d_cache, &unmatched);
     l1i = cpuid2_cache_descriptor(caches->l1i_cache, &unmatched);
     l2 = cpuid2_cache_descriptor(caches->l2_cache, &unmatched);
@@ -707,17 +715,6 @@ static CPUCacheInfo legacy_l2_cache = {
     .share_level = CPU_TOPOLOGY_LEVEL_CORE,
 };
 
-/*FIXME: CPUID leaf 2 descriptor is inconsistent with CPUID leaf 4 */
-static CPUCacheInfo legacy_l2_cache_cpuid2 = {
-    .type = UNIFIED_CACHE,
-    .level = 2,
-    .size = 2 * MiB,
-    .line_size = 64,
-    .associativity = 8,
-    .share_level = CPU_TOPOLOGY_LEVEL_INVALID,
-};
-
-
 /*FIXME: CPUID leaf 0x80000006 is inconsistent with leaves 2 & 4 */
 static CPUCacheInfo legacy_l2_cache_amd = {
     .type = UNIFIED_CACHE,
@@ -8955,18 +8952,12 @@ static void x86_cpu_realizefn(DeviceState *dev, Error **errp)
                        "CPU model '%s' doesn't support legacy-cache=off", name);
             return;
         }
-        env->cache_info_cpuid2 = env->cache_info_cpuid4 = env->cache_info_amd =
-            *cache_info;
+        env->cache_info_cpuid4 = env->cache_info_amd = *cache_info;
     } else {
         /* Build legacy cache information */
-        env->cache_info_cpuid2.l1d_cache = &legacy_l1d_cache;
-        env->cache_info_cpuid2.l1i_cache = &legacy_l1i_cache;
         if (!cpu->consistent_cache) {
-            env->cache_info_cpuid2.l2_cache = &legacy_l2_cache_cpuid2;
-        } else {
-            env->cache_info_cpuid2.l2_cache = &legacy_l2_cache;
+            env->enable_legacy_cpuid2_cache = true;
         }
-        env->cache_info_cpuid2.l3_cache = &legacy_l3_cache;
 
         env->cache_info_cpuid4.l1d_cache = &legacy_l1d_cache;
         env->cache_info_cpuid4.l1i_cache = &legacy_l1i_cache;
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index a3ebd3e08c..d3f7c53e30 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -2077,7 +2077,8 @@ typedef struct CPUArchState {
      * on each CPUID leaf will be different, because we keep compatibility
      * with old QEMU versions.
      */
-    CPUCaches cache_info_cpuid2, cache_info_cpuid4, cache_info_amd;
+    CPUCaches cache_info_cpuid4, cache_info_amd;
+    bool enable_legacy_cpuid2_cache;
 
     /* MTRRs */
     uint64_t mtrr_fixed[11];

From 216d9bb6d77162a93a0f09d72fdabfd252d941ce Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Fri, 11 Jul 2025 18:21:32 +0800
Subject: [PATCH 2190/2760] i386/cpu: Add x-vendor-cpuid-only-v2 option for
 compatibility

Add a compat property "x-vendor-cpuid-only-v2" (for PC machine v10.0
and older) to keep the original behavior. This property will be used
to adjust vendor specific CPUID fields.

Make x-vendor-cpuid-only-v2 depend on x-vendor-cpuid-only. Although
x-vendor-cpuid-only and v2 should be initernal only, QEMU doesn't
support "internal" property. To avoid any other unexpected issues, check
the dependency.

Tested-by: Yi Lai <yi1.lai@intel.com>
Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250711102143.1622339-8-zhao1.liu@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/i386/pc.c      |  1 +
 target/i386/cpu.c | 10 ++++++++++
 target/i386/cpu.h | 11 ++++++++++-
 3 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/hw/i386/pc.c b/hw/i386/pc.c
index a6fa792368..7cfa61c9ee 100644
--- a/hw/i386/pc.c
+++ b/hw/i386/pc.c
@@ -83,6 +83,7 @@
 
 GlobalProperty pc_compat_10_0[] = {
     { TYPE_X86_CPU, "x-consistent-cache", "false" },
+    { TYPE_X86_CPU, "x-vendor-cpuid-only-v2", "false" },
 };
 const size_t pc_compat_10_0_len = G_N_ELEMENTS(pc_compat_10_0);
 
diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index ac22548f47..630a40d72b 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -8749,6 +8749,16 @@ static void x86_cpu_realizefn(DeviceState *dev, Error **errp)
     tcg_cflags_set(cs, CF_PCREL);
 #endif
 
+    /*
+     * x-vendor-cpuid-only and v2 should be initernal only. But
+     * QEMU doesn't support "internal" property.
+     */
+    if (!cpu->vendor_cpuid_only && cpu->vendor_cpuid_only_v2) {
+        error_setg(errp, "x-vendor-cpuid-only-v2 property "
+                   "depends on x-vendor-cpuid-only");
+        return;
+    }
+
     if (cpu->apic_id == UNASSIGNED_APIC_ID) {
         error_setg(errp, "apic-id property was not initialized properly");
         return;
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index d3f7c53e30..d88481ba8e 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -2282,9 +2282,18 @@ struct ArchCPU {
     /* Enable auto level-increase for all CPUID leaves */
     bool full_cpuid_auto_level;
 
-    /* Only advertise CPUID leaves defined by the vendor */
+    /*
+     * Compatibility bits for old machine types (PC machine v6.0 and older).
+     * Only advertise CPUID leaves defined by the vendor.
+     */
     bool vendor_cpuid_only;
 
+    /*
+     * Compatibility bits for old machine types (PC machine v10.0 and older).
+     * Only advertise CPUID leaves defined by the vendor.
+     */
+    bool vendor_cpuid_only_v2;
+
     /* Only advertise TOPOEXT features that AMD defines */
     bool amd_topoext_features_only;
 

From 225aad5a7b78b3dc017996ab5b5e1b9249c036a0 Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Fri, 11 Jul 2025 18:21:33 +0800
Subject: [PATCH 2191/2760] i386/cpu: Mark CPUID[0x80000005] as reserved for
 Intel

Per SDM, 0x80000005 leaf is reserved for Intel CPU, and its current
"assert" check blocks adding new cache model for non-AMD CPUs.

And please note, although Zhaoxin mostly follows Intel behavior,
this leaf is an exception [1].

So, with the compat property "x-vendor-cpuid-only-v2", for the machine
since v10.1, check the vendor and encode this leaf as all-0 only for
Intel CPU. In addition, drop lines_per_tag assertion in
encode_cache_cpuid80000005(), since Zhaoxin will use legacy Intel cache
model in this leaf - which doesn't have this field.

This fix also resolves 2 FIXMEs of legacy_l1d_cache_amd and
legacy_l1i_cache_amd:

/*FIXME: CPUID leaf 0x80000005 is inconsistent with leaves 2 & 4 */

In addition, per AMD's APM, update the comment of CPUID[0x80000005].

[1]: https://lore.kernel.org/qemu-devel/fa16f7a8-4917-4731-9d9f-7d4c10977168@zhaoxin.com/

Tested-by: Yi Lai <yi1.lai@intel.com>
Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250711102143.1622339-9-zhao1.liu@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 630a40d72b..2abcb5acff 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -499,7 +499,6 @@ static void encode_topo_cpuid1f(CPUX86State *env, uint32_t count,
 static uint32_t encode_cache_cpuid80000005(CPUCacheInfo *cache)
 {
     assert(cache->size % 1024 == 0);
-    assert(cache->lines_per_tag > 0);
     assert(cache->associativity > 0);
     assert(cache->line_size > 0);
     return ((cache->size / 1024) << 24) | (cache->associativity << 16) |
@@ -657,7 +656,6 @@ static CPUCacheInfo legacy_l1d_cache = {
     .share_level = CPU_TOPOLOGY_LEVEL_CORE,
 };
 
-/*FIXME: CPUID leaf 0x80000005 is inconsistent with leaves 2 & 4 */
 static CPUCacheInfo legacy_l1d_cache_amd = {
     .type = DATA_CACHE,
     .level = 1,
@@ -686,7 +684,6 @@ static CPUCacheInfo legacy_l1i_cache = {
     .share_level = CPU_TOPOLOGY_LEVEL_CORE,
 };
 
-/*FIXME: CPUID leaf 0x80000005 is inconsistent with leaves 2 & 4 */
 static CPUCacheInfo legacy_l1i_cache_amd = {
     .type = INSTRUCTION_CACHE,
     .level = 1,
@@ -7884,11 +7881,17 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
         *edx = env->cpuid_model[(index - 0x80000002) * 4 + 3];
         break;
     case 0x80000005:
-        /* cache info (L1 cache) */
+        /* cache info (L1 cache/TLB Associativity Field) */
         if (cpu->cache_info_passthrough) {
             x86_cpu_get_cache_cpuid(index, 0, eax, ebx, ecx, edx);
             break;
         }
+
+        if (cpu->vendor_cpuid_only_v2 && IS_INTEL_CPU(env)) {
+            *eax = *ebx = *ecx = *edx = 0;
+            break;
+        }
+
         *eax = (L1_DTLB_2M_ASSOC << 24) | (L1_DTLB_2M_ENTRIES << 16) |
                (L1_ITLB_2M_ASSOC <<  8) | (L1_ITLB_2M_ENTRIES);
         *ebx = (L1_DTLB_4K_ASSOC << 24) | (L1_DTLB_4K_ENTRIES << 16) |
@@ -9478,6 +9481,7 @@ static const Property x86_cpu_properties[] = {
     DEFINE_PROP_STRING("hv-vendor-id", X86CPU, hyperv_vendor),
     DEFINE_PROP_BOOL("cpuid-0xb", X86CPU, enable_cpuid_0xb, true),
     DEFINE_PROP_BOOL("x-vendor-cpuid-only", X86CPU, vendor_cpuid_only, true),
+    DEFINE_PROP_BOOL("x-vendor-cpuid-only-v2", X86CPU, vendor_cpuid_only_v2, true),
     DEFINE_PROP_BOOL("x-amd-topoext-features-only", X86CPU, amd_topoext_features_only, true),
     DEFINE_PROP_BOOL("lmce", X86CPU, enable_lmce, false),
     DEFINE_PROP_BOOL("l3-cache", X86CPU, enable_l3_cache, true),

From 3275a379c8ff0862550910a97e8c0c9b056643cd Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Fri, 11 Jul 2025 18:21:34 +0800
Subject: [PATCH 2192/2760] i386/cpu: Rename AMD_ENC_ASSOC to X86_ENC_ASSOC

Rename AMD_ENC_ASSOC to X86_ENC_ASSOC since Intel also uses the same
rules.

While there are some slight differences between the rules in AMD APM
v4.07 no.40332 and Intel. But considerring the needs of current QEMU,
generally they are consistent and current AMD_ENC_ASSOC can be applied
for Intel CPUs..

Tested-by: Yi Lai <yi1.lai@intel.com>
Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250711102143.1622339-10-zhao1.liu@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 2abcb5acff..8a97272b4a 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -507,8 +507,8 @@ static uint32_t encode_cache_cpuid80000005(CPUCacheInfo *cache)
 
 #define ASSOC_FULL 0xFF
 
-/* AMD associativity encoding used on CPUID Leaf 0x80000006: */
-#define AMD_ENC_ASSOC(a) (a <=   1 ? a   : \
+/* x86 associativity encoding used on CPUID Leaf 0x80000006: */
+#define X86_ENC_ASSOC(a) (a <=   1 ? a   : \
                           a ==   2 ? 0x2 : \
                           a ==   4 ? 0x4 : \
                           a ==   8 ? 0x6 : \
@@ -534,7 +534,7 @@ static void encode_cache_cpuid80000006(CPUCacheInfo *l2,
     assert(l2->lines_per_tag > 0);
     assert(l2->line_size > 0);
     *ecx = ((l2->size / 1024) << 16) |
-           (AMD_ENC_ASSOC(l2->associativity) << 12) |
+           (X86_ENC_ASSOC(l2->associativity) << 12) |
            (l2->lines_per_tag << 8) | (l2->line_size);
 
     if (l3) {
@@ -543,7 +543,7 @@ static void encode_cache_cpuid80000006(CPUCacheInfo *l2,
         assert(l3->lines_per_tag > 0);
         assert(l3->line_size > 0);
         *edx = ((l3->size / (512 * 1024)) << 18) |
-               (AMD_ENC_ASSOC(l3->associativity) << 12) |
+               (X86_ENC_ASSOC(l3->associativity) << 12) |
                (l3->lines_per_tag << 8) | (l3->line_size);
     } else {
         *edx = 0;
@@ -7905,13 +7905,13 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
             x86_cpu_get_cache_cpuid(index, 0, eax, ebx, ecx, edx);
             break;
         }
-        *eax = (AMD_ENC_ASSOC(L2_DTLB_2M_ASSOC) << 28) |
+        *eax = (X86_ENC_ASSOC(L2_DTLB_2M_ASSOC) << 28) |
                (L2_DTLB_2M_ENTRIES << 16) |
-               (AMD_ENC_ASSOC(L2_ITLB_2M_ASSOC) << 12) |
+               (X86_ENC_ASSOC(L2_ITLB_2M_ASSOC) << 12) |
                (L2_ITLB_2M_ENTRIES);
-        *ebx = (AMD_ENC_ASSOC(L2_DTLB_4K_ASSOC) << 28) |
+        *ebx = (X86_ENC_ASSOC(L2_DTLB_4K_ASSOC) << 28) |
                (L2_DTLB_4K_ENTRIES << 16) |
-               (AMD_ENC_ASSOC(L2_ITLB_4K_ASSOC) << 12) |
+               (X86_ENC_ASSOC(L2_ITLB_4K_ASSOC) << 12) |
                (L2_ITLB_4K_ENTRIES);
         encode_cache_cpuid80000006(env->cache_info_amd.l2_cache,
                                    cpu->enable_l3_cache ?

From 63dc9f52f63475f61404a7f5a010aa352ead8763 Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Fri, 11 Jul 2025 18:21:35 +0800
Subject: [PATCH 2193/2760] i386/cpu: Fix CPUID[0x80000006] for Intel CPU

Per SDM, Intel supports CPUID[0x80000006]. But only L2 information is
encoded in ECX (note that L2 associativity field encodings rules
consistent with AMD are used), all other fields are reserved.

Therefore, make the following changes to CPUID[0x80000006]:
 * Check the vendor in CPUID[0x80000006] and just encode L2 to ECX for
   Intel.
 * Drop the lines_per_tag assertion, since AMD supports this field but
   Intel doesn't. And this field can be easily checked via cpuid tool
   in Guest.
 * Apply the encoding change of Intel for Zhaoxin as well [1].

This fix also resolves the FIXME of legacy_l2_cache_amd:

/*FIXME: CPUID leaf 0x80000006 is inconsistent with leaves 2 & 4 */

In addition, per AMD's APM, update the comment of CPUID[0x80000006].

[1]: https://lore.kernel.org/qemu-devel/c522ebb5-04d5-49c6-9ad8-d755b8998988@zhaoxin.com/

Tested-by: Yi Lai <yi1.lai@intel.com>
Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250711102143.1622339-11-zhao1.liu@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 8a97272b4a..6a0e8592bb 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -531,16 +531,15 @@ static void encode_cache_cpuid80000006(CPUCacheInfo *l2,
 {
     assert(l2->size % 1024 == 0);
     assert(l2->associativity > 0);
-    assert(l2->lines_per_tag > 0);
     assert(l2->line_size > 0);
     *ecx = ((l2->size / 1024) << 16) |
            (X86_ENC_ASSOC(l2->associativity) << 12) |
            (l2->lines_per_tag << 8) | (l2->line_size);
 
+    /* For Intel, EDX is reserved. */
     if (l3) {
         assert(l3->size % (512 * 1024) == 0);
         assert(l3->associativity > 0);
-        assert(l3->lines_per_tag > 0);
         assert(l3->line_size > 0);
         *edx = ((l3->size / (512 * 1024)) << 18) |
                (X86_ENC_ASSOC(l3->associativity) << 12) |
@@ -712,7 +711,6 @@ static CPUCacheInfo legacy_l2_cache = {
     .share_level = CPU_TOPOLOGY_LEVEL_CORE,
 };
 
-/*FIXME: CPUID leaf 0x80000006 is inconsistent with leaves 2 & 4 */
 static CPUCacheInfo legacy_l2_cache_amd = {
     .type = UNIFIED_CACHE,
     .level = 2,
@@ -7900,11 +7898,20 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
         *edx = encode_cache_cpuid80000005(env->cache_info_amd.l1i_cache);
         break;
     case 0x80000006:
-        /* cache info (L2 cache) */
+        /* cache info (L2 cache/TLB/L3 cache) */
         if (cpu->cache_info_passthrough) {
             x86_cpu_get_cache_cpuid(index, 0, eax, ebx, ecx, edx);
             break;
         }
+
+        if (cpu->vendor_cpuid_only_v2 &&
+            (IS_INTEL_CPU(env) || IS_ZHAOXIN_CPU(env))) {
+            *eax = *ebx = 0;
+            encode_cache_cpuid80000006(env->cache_info_cpuid4.l2_cache,
+                                       NULL, ecx, edx);
+            break;
+        }
+
         *eax = (X86_ENC_ASSOC(L2_DTLB_2M_ASSOC) << 28) |
                (L2_DTLB_2M_ENTRIES << 16) |
                (X86_ENC_ASSOC(L2_ITLB_2M_ASSOC) << 12) |
@@ -7913,6 +7920,7 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
                (L2_DTLB_4K_ENTRIES << 16) |
                (X86_ENC_ASSOC(L2_ITLB_4K_ASSOC) << 12) |
                (L2_ITLB_4K_ENTRIES);
+
         encode_cache_cpuid80000006(env->cache_info_amd.l2_cache,
                                    cpu->enable_l3_cache ?
                                    env->cache_info_amd.l3_cache : NULL,

From a9b6cca2df62ab3b0ba03edb3229a0eda385f65b Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Fri, 11 Jul 2025 18:21:36 +0800
Subject: [PATCH 2194/2760] i386/cpu: Add legacy_intel_cache_info cache model

Based on legacy_l1d_cache, legacy_l1i_cache, legacy_l2_cache and
legacy_l3_cache, build a complete legacy intel cache model, which can
clarify the purpose of these trivial legacy cache models, simplify the
initialization of cache info in X86CPUState, and make it easier to
handle compatibility later.

Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Tested-by: Yi Lai <yi1.lai@intel.com>
Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250711102143.1622339-12-zhao1.liu@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 101 +++++++++++++++++++++++++---------------------
 1 file changed, 54 insertions(+), 47 deletions(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 6a0e8592bb..d265dc8156 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -640,21 +640,6 @@ static void encode_topo_cpuid8000001e(X86CPU *cpu, X86CPUTopoInfo *topo_info,
  * These are legacy cache values. If there is a need to change any
  * of these values please use builtin_x86_defs
  */
-
-/* L1 data cache: */
-static CPUCacheInfo legacy_l1d_cache = {
-    .type = DATA_CACHE,
-    .level = 1,
-    .size = 32 * KiB,
-    .self_init = 1,
-    .line_size = 64,
-    .associativity = 8,
-    .sets = 64,
-    .partitions = 1,
-    .no_invd_sharing = true,
-    .share_level = CPU_TOPOLOGY_LEVEL_CORE,
-};
-
 static CPUCacheInfo legacy_l1d_cache_amd = {
     .type = DATA_CACHE,
     .level = 1,
@@ -669,20 +654,6 @@ static CPUCacheInfo legacy_l1d_cache_amd = {
     .share_level = CPU_TOPOLOGY_LEVEL_CORE,
 };
 
-/* L1 instruction cache: */
-static CPUCacheInfo legacy_l1i_cache = {
-    .type = INSTRUCTION_CACHE,
-    .level = 1,
-    .size = 32 * KiB,
-    .self_init = 1,
-    .line_size = 64,
-    .associativity = 8,
-    .sets = 64,
-    .partitions = 1,
-    .no_invd_sharing = true,
-    .share_level = CPU_TOPOLOGY_LEVEL_CORE,
-};
-
 static CPUCacheInfo legacy_l1i_cache_amd = {
     .type = INSTRUCTION_CACHE,
     .level = 1,
@@ -697,20 +668,6 @@ static CPUCacheInfo legacy_l1i_cache_amd = {
     .share_level = CPU_TOPOLOGY_LEVEL_CORE,
 };
 
-/* Level 2 unified cache: */
-static CPUCacheInfo legacy_l2_cache = {
-    .type = UNIFIED_CACHE,
-    .level = 2,
-    .size = 4 * MiB,
-    .self_init = 1,
-    .line_size = 64,
-    .associativity = 16,
-    .sets = 4096,
-    .partitions = 1,
-    .no_invd_sharing = true,
-    .share_level = CPU_TOPOLOGY_LEVEL_CORE,
-};
-
 static CPUCacheInfo legacy_l2_cache_amd = {
     .type = UNIFIED_CACHE,
     .level = 2,
@@ -800,6 +757,59 @@ static const CPUCaches legacy_intel_cpuid2_cache_info = {
     },
 };
 
+static const CPUCaches legacy_intel_cache_info = {
+    .l1d_cache = &(CPUCacheInfo) {
+        .type = DATA_CACHE,
+        .level = 1,
+        .size = 32 * KiB,
+        .self_init = 1,
+        .line_size = 64,
+        .associativity = 8,
+        .sets = 64,
+        .partitions = 1,
+        .no_invd_sharing = true,
+        .share_level = CPU_TOPOLOGY_LEVEL_CORE,
+    },
+    .l1i_cache = &(CPUCacheInfo) {
+        .type = INSTRUCTION_CACHE,
+        .level = 1,
+        .size = 32 * KiB,
+        .self_init = 1,
+        .line_size = 64,
+        .associativity = 8,
+        .sets = 64,
+        .partitions = 1,
+        .no_invd_sharing = true,
+        .share_level = CPU_TOPOLOGY_LEVEL_CORE,
+    },
+    .l2_cache = &(CPUCacheInfo) {
+        .type = UNIFIED_CACHE,
+        .level = 2,
+        .size = 4 * MiB,
+        .self_init = 1,
+        .line_size = 64,
+        .associativity = 16,
+        .sets = 4096,
+        .partitions = 1,
+        .no_invd_sharing = true,
+        .share_level = CPU_TOPOLOGY_LEVEL_CORE,
+    },
+    .l3_cache = &(CPUCacheInfo) {
+        .type = UNIFIED_CACHE,
+        .level = 3,
+        .size = 16 * MiB,
+        .line_size = 64,
+        .associativity = 16,
+        .sets = 16384,
+        .partitions = 1,
+        .lines_per_tag = 1,
+        .self_init = true,
+        .inclusive = true,
+        .complex_indexing = true,
+        .share_level = CPU_TOPOLOGY_LEVEL_DIE,
+    },
+};
+
 /* TLB definitions: */
 
 #define L1_DTLB_2M_ASSOC       1
@@ -8980,10 +8990,7 @@ static void x86_cpu_realizefn(DeviceState *dev, Error **errp)
             env->enable_legacy_cpuid2_cache = true;
         }
 
-        env->cache_info_cpuid4.l1d_cache = &legacy_l1d_cache;
-        env->cache_info_cpuid4.l1i_cache = &legacy_l1i_cache;
-        env->cache_info_cpuid4.l2_cache = &legacy_l2_cache;
-        env->cache_info_cpuid4.l3_cache = &legacy_l3_cache;
+        env->cache_info_cpuid4 = legacy_intel_cache_info;
 
         env->cache_info_amd.l1d_cache = &legacy_l1d_cache_amd;
         env->cache_info_amd.l1i_cache = &legacy_l1i_cache_amd;

From dcec3c18f9daed23bfb38786edfbd2c0c6ee71c6 Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Fri, 11 Jul 2025 18:21:37 +0800
Subject: [PATCH 2195/2760] i386/cpu: Add legacy_amd_cache_info cache model

Based on legacy_l1d_cachei_amd, legacy_l1i_cache_amd, legacy_l2_cache_amd
and legacy_l3_cache, build a complete legacy AMD cache model, which can
clarify the purpose of these trivial legacy cache models, simplify the
initialization of cache info in X86CPUState, and make it easier to
handle compatibility later.

Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Tested-by: Yi Lai <yi1.lai@intel.com>
Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250711102143.1622339-13-zhao1.liu@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 112 ++++++++++++++++++++++------------------------
 1 file changed, 53 insertions(+), 59 deletions(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index d265dc8156..92d21ce64c 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -640,60 +640,58 @@ static void encode_topo_cpuid8000001e(X86CPU *cpu, X86CPUTopoInfo *topo_info,
  * These are legacy cache values. If there is a need to change any
  * of these values please use builtin_x86_defs
  */
-static CPUCacheInfo legacy_l1d_cache_amd = {
-    .type = DATA_CACHE,
-    .level = 1,
-    .size = 64 * KiB,
-    .self_init = 1,
-    .line_size = 64,
-    .associativity = 2,
-    .sets = 512,
-    .partitions = 1,
-    .lines_per_tag = 1,
-    .no_invd_sharing = true,
-    .share_level = CPU_TOPOLOGY_LEVEL_CORE,
-};
-
-static CPUCacheInfo legacy_l1i_cache_amd = {
-    .type = INSTRUCTION_CACHE,
-    .level = 1,
-    .size = 64 * KiB,
-    .self_init = 1,
-    .line_size = 64,
-    .associativity = 2,
-    .sets = 512,
-    .partitions = 1,
-    .lines_per_tag = 1,
-    .no_invd_sharing = true,
-    .share_level = CPU_TOPOLOGY_LEVEL_CORE,
-};
-
-static CPUCacheInfo legacy_l2_cache_amd = {
-    .type = UNIFIED_CACHE,
-    .level = 2,
-    .size = 512 * KiB,
-    .line_size = 64,
-    .lines_per_tag = 1,
-    .associativity = 16,
-    .sets = 512,
-    .partitions = 1,
-    .share_level = CPU_TOPOLOGY_LEVEL_CORE,
-};
-
-/* Level 3 unified cache: */
-static CPUCacheInfo legacy_l3_cache = {
-    .type = UNIFIED_CACHE,
-    .level = 3,
-    .size = 16 * MiB,
-    .line_size = 64,
-    .associativity = 16,
-    .sets = 16384,
-    .partitions = 1,
-    .lines_per_tag = 1,
-    .self_init = true,
-    .inclusive = true,
-    .complex_indexing = true,
-    .share_level = CPU_TOPOLOGY_LEVEL_DIE,
+static const CPUCaches legacy_amd_cache_info = {
+    .l1d_cache = &(CPUCacheInfo) {
+        .type = DATA_CACHE,
+        .level = 1,
+        .size = 64 * KiB,
+        .self_init = 1,
+        .line_size = 64,
+        .associativity = 2,
+        .sets = 512,
+        .partitions = 1,
+        .lines_per_tag = 1,
+        .no_invd_sharing = true,
+        .share_level = CPU_TOPOLOGY_LEVEL_CORE,
+    },
+    .l1i_cache = &(CPUCacheInfo) {
+        .type = INSTRUCTION_CACHE,
+        .level = 1,
+        .size = 64 * KiB,
+        .self_init = 1,
+        .line_size = 64,
+        .associativity = 2,
+        .sets = 512,
+        .partitions = 1,
+        .lines_per_tag = 1,
+        .no_invd_sharing = true,
+        .share_level = CPU_TOPOLOGY_LEVEL_CORE,
+    },
+    .l2_cache = &(CPUCacheInfo) {
+        .type = UNIFIED_CACHE,
+        .level = 2,
+        .size = 512 * KiB,
+        .line_size = 64,
+        .lines_per_tag = 1,
+        .associativity = 16,
+        .sets = 512,
+        .partitions = 1,
+        .share_level = CPU_TOPOLOGY_LEVEL_CORE,
+    },
+    .l3_cache = &(CPUCacheInfo) {
+        .type = UNIFIED_CACHE,
+        .level = 3,
+        .size = 16 * MiB,
+        .line_size = 64,
+        .associativity = 16,
+        .sets = 16384,
+        .partitions = 1,
+        .lines_per_tag = 1,
+        .self_init = true,
+        .inclusive = true,
+        .complex_indexing = true,
+        .share_level = CPU_TOPOLOGY_LEVEL_DIE,
+    },
 };
 
 /*
@@ -8991,11 +8989,7 @@ static void x86_cpu_realizefn(DeviceState *dev, Error **errp)
         }
 
         env->cache_info_cpuid4 = legacy_intel_cache_info;
-
-        env->cache_info_amd.l1d_cache = &legacy_l1d_cache_amd;
-        env->cache_info_amd.l1i_cache = &legacy_l1i_cache_amd;
-        env->cache_info_amd.l2_cache = &legacy_l2_cache_amd;
-        env->cache_info_amd.l3_cache = &legacy_l3_cache;
+        env->cache_info_amd = legacy_amd_cache_info;
     }
 
 #ifndef CONFIG_USER_ONLY

From 2f5b76bce5c9aa71b35bbe5fb666343eed7478f1 Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Fri, 11 Jul 2025 18:21:38 +0800
Subject: [PATCH 2196/2760] i386/cpu: Select legacy cache model based on vendor
 in CPUID 0x2

As preparation for merging cache_info_cpuid4 and cache_info_amd in
X86CPUState, set legacy cache model based on vendor in the CPUID 0x2
leaf. For AMD CPU, select legacy AMD cache model (in cache_info_amd) as
the default cache model, otherwise, select legacy Intel cache model (in
cache_info_cpuid4) as before.

To ensure compatibility is not broken, add an enable_legacy_vendor_cache
flag based on x-vendor-only-v2 to indicate cases where the legacy cache
model should be used regardless of the vendor. For CPUID 0x2 leaf,
enable_legacy_vendor_cache flag indicates to pick legacy Intel cache
model, which is for compatibility with the behavior of PC machine v10.0
and older.

The following explains how current vendor-based default legacy cache
model ensures correctness without breaking compatibility.

* For the PC machine v6.0 and older, vendor_cpuid_only=false, and
  vendor_cpuid_only_v2=false.

  - If the named CPU model has its own cache model, and doesn't use
    legacy cache model (legacy_cache=false), then cache_info_cpuid4 and
    cache_info_amd are same, so 0x2 leaf uses its own cache model
    regardless of the vendor.

  - For max/host/named CPU (without its own cache model), then the flag
    enable_legacy_vendor_cache is true, they will use legacy Intel cache
    model just like their previous behavior.

* For the PC machine v10.0 and older (to v6.1), vendor_cpuid_only=true,
  and vendor_cpuid_only_v2=false.

  - If the named CPU model has its own cache model (legacy_cache=false),
    then cache_info_cpuid4 & cache_info_amd both equal to its own cache
    model, so it uses its own cache model in 0x2 leaf regardless of the
    vendor. Only AMD CPUs have all-0 leaf due to vendor_cpuid_only=true,
    and this is exactly the behavior of these old machines.

  - For max/host/named CPU (without its own cache model), then the flag
    enable_legacy_vendor_cache is true, they will use legacy Intel cache
    model. Similarly, only AMD CPUs have all-0 leaf, and this is exactly
    the behavior of these old machines.

* For the PC machine v10.1 and newer, vendor_cpuid_only=true, and
  vendor_cpuid_only_v2=true.

  - If the named CPU model has its own cache model (legacy_cache=false),
    then cache_info_cpuid4 & cache_info_amd both equal to its own cache
    model, so it uses its own cache model in 0x2 leaf regardless of the
    vendor. And AMD CPUs have all-0 leaf. Nothing will change.

  - For max/host/named CPU (without its own cache model), then the flag
    enable_legacy_vendor_cache is false, the legacy cache model is
    selected based on vendor.

    For AMD CPU, it will use legacy AMD cache but still get all-0 leaf
    due to vendor_cpuid_only=true.

    For non-AMD (Intel/Zhaoxin) CPU, it will use legacy Intel cache as
    expected.

    Here, selecting the legacy cache model based on the vendor does not
    change the previous (before the change)  behavior.

Therefore, the above analysis proves that, with the help of the flag
enable_legacy_vendor_cache, it is acceptable to select the default
legacy cache model based on the vendor.

For the CPUID 0x2 leaf, in X86CPUState, a unified cache_info is enough.
It only needs to be initialized and configured with the corresponding
legacy cache model based on the vendor.

Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Tested-by: Yi Lai <yi1.lai@intel.com>
Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250711102143.1622339-14-zhao1.liu@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 47 +++++++++++++++++++++++++++++++++++++----------
 target/i386/cpu.h |  1 +
 2 files changed, 38 insertions(+), 10 deletions(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 92d21ce64c..ca85603077 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -250,23 +250,17 @@ static const CPUCaches legacy_intel_cpuid2_cache_info;
 
 /* Encode cache info for CPUID[2] */
 static void encode_cache_cpuid2(X86CPU *cpu,
+                                const CPUCaches *caches,
                                 uint32_t *eax, uint32_t *ebx,
                                 uint32_t *ecx, uint32_t *edx)
 {
     CPUX86State *env = &cpu->env;
-    const CPUCaches *caches;
     int l1d, l1i, l2, l3;
     bool unmatched = false;
 
     *eax = 1; /* Number of CPUID[EAX=2] calls required */
     *ebx = *ecx = *edx = 0;
 
-    if (env->enable_legacy_cpuid2_cache) {
-        caches = &legacy_intel_cpuid2_cache_info;
-    } else {
-        caches = &env->cache_info_cpuid4;
-    }
-
     l1d = cpuid2_cache_descriptor(caches->l1d_cache, &unmatched);
     l1i = cpuid2_cache_descriptor(caches->l1i_cache, &unmatched);
     l2 = cpuid2_cache_descriptor(caches->l2_cache, &unmatched);
@@ -7472,8 +7466,37 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
             *ebx |= threads_per_pkg << 16;
         }
         break;
-    case 2:
-        /* cache info: needed for Pentium Pro compatibility */
+    case 2: { /* cache info: needed for Pentium Pro compatibility */
+        const CPUCaches *caches;
+
+        if (env->enable_legacy_cpuid2_cache) {
+            caches = &legacy_intel_cpuid2_cache_info;
+        } else if (env->enable_legacy_vendor_cache) {
+            caches = &legacy_intel_cache_info;
+        } else {
+            /*
+             * FIXME: Temporarily select cache info model here based on
+             * vendor, and merge these 2 cache info models later.
+             *
+             * This condition covers the following cases (with
+             * enable_legacy_vendor_cache=false):
+             *  - When CPU model has its own cache model and doesn't use legacy
+             *    cache model (legacy_model=off). Then cache_info_amd and
+             *    cache_info_cpuid4 are the same.
+             *
+             *  - For v10.1 and newer machines, when CPU model uses legacy cache
+             *    model. Non-AMD CPUs use cache_info_cpuid4 like before and AMD
+             *    CPU will use cache_info_amd. But this doesn't matter for AMD
+             *    CPU, because this leaf encodes all-0 for AMD whatever its cache
+             *    model is.
+             */
+            if (IS_AMD_CPU(env)) {
+                caches = &env->cache_info_amd;
+            } else {
+                caches = &env->cache_info_cpuid4;
+            }
+        }
+
         if (cpu->cache_info_passthrough) {
             x86_cpu_get_cache_cpuid(index, 0, eax, ebx, ecx, edx);
             break;
@@ -7481,8 +7504,9 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
             *eax = *ebx = *ecx = *edx = 0;
             break;
         }
-        encode_cache_cpuid2(cpu, eax, ebx, ecx, edx);
+        encode_cache_cpuid2(cpu, caches, eax, ebx, ecx, edx);
         break;
+    }
     case 4:
         /* cache info: needed for Core compatibility */
         if (cpu->cache_info_passthrough) {
@@ -8988,6 +9012,9 @@ static void x86_cpu_realizefn(DeviceState *dev, Error **errp)
             env->enable_legacy_cpuid2_cache = true;
         }
 
+        if (!cpu->vendor_cpuid_only_v2) {
+            env->enable_legacy_vendor_cache = true;
+        }
         env->cache_info_cpuid4 = legacy_intel_cache_info;
         env->cache_info_amd = legacy_amd_cache_info;
     }
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index d88481ba8e..20499a82a5 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -2079,6 +2079,7 @@ typedef struct CPUArchState {
      */
     CPUCaches cache_info_cpuid4, cache_info_amd;
     bool enable_legacy_cpuid2_cache;
+    bool enable_legacy_vendor_cache;
 
     /* MTRRs */
     uint64_t mtrr_fixed[11];

From 69fe18ff9ced6e9cac3e4f3f3b94452603f2006e Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Fri, 11 Jul 2025 18:21:39 +0800
Subject: [PATCH 2197/2760] i386/cpu: Select legacy cache model based on vendor
 in CPUID 0x4

As preparation for merging cache_info_cpuid4 and cache_info_amd in
X86CPUState, set legacy cache model based on vendor in the CPUID 0x4
leaf. For AMD CPU, select legacy AMD cache model (in cache_info_amd) as
the default cache model, otherwise, select legacy Intel cache model (in
cache_info_cpuid4) as before.

To ensure compatibility is not broken, add an enable_legacy_vendor_cache
flag based on x-vendor-only-v2 to indicate cases where the legacy cache
model should be used regardless of the vendor. For CPUID 0x4 leaf,
enable_legacy_vendor_cache flag indicates to pick legacy Intel cache
model, which is for compatibility with the behavior of PC machine v10.0
and older.

The following explains how current vendor-based default legacy cache
model ensures correctness without breaking compatibility.

* For the PC machine v6.0 and older, vendor_cpuid_only=false, and
  vendor_cpuid_only_v2=false.

  - If the named CPU model has its own cache model, and doesn't use
    legacy cache model (legacy_cache=false), then cache_info_cpuid4 and
    cache_info_amd are same, so 0x4 leaf uses its own cache model
    regardless of the vendor.

  - For max/host/named CPU (without its own cache model), then the flag
    enable_legacy_vendor_cache is true, they will use legacy Intel cache
    model just like their previous behavior.

* For the PC machine v10.0 and older (to v6.1), vendor_cpuid_only=true,
  and vendor_cpuid_only_v2=false.

  - If the named CPU model has its own cache model (legacy_cache=false),
    then cache_info_cpuid4 & cache_info_amd both equal to its own cache
    model, so it uses its own cache model in 0x4 leaf regardless of the
    vendor. Only AMD CPUs have all-0 leaf due to vendor_cpuid_only=true,
    and this is exactly the behavior of these old machines.

  - For max/host/named CPU (without its own cache model), then the flag
    enable_legacy_vendor_cache is true, they will use legacy Intel cache
    model. Similarly, only AMD CPUs have all-0 leaf, and this is exactly
    the behavior of these old machines.

* For the PC machine v10.1 and newer, vendor_cpuid_only=true, and
  vendor_cpuid_only_v2=true.

  - If the named CPU model has its own cache model (legacy_cache=false),
    then cache_info_cpuid4 & cache_info_amd both equal to its own cache
    model, so it uses its own cache model in 0x4 leaf regardless of the
    vendor. And AMD CPUs have all-0 leaf. Nothing will change.

  - For max/host/named CPU (without its own cache model), then the flag
    enable_legacy_vendor_cache is false, the legacy cache model is
    selected based on vendor.

    For AMD CPU, it will use legacy AMD cache but still get all-0 leaf
    due to vendor_cpuid_only=true.

    For non-AMD (Intel/Zhaoxin) CPU, it will use legacy Intel cache as
    expected.

    Here, selecting the legacy cache model based on the vendor does not
    change the previous (before the change) behavior.

Therefore, the above analysis proves that, with the help of the flag
enable_legacy_vendor_cache, it is acceptable to select the default
legacy cache model based on the vendor.

For the CPUID 0x4 leaf, in X86CPUState, a unified cache_info is enough.
It only needs to be initialized and configured with the corresponding
legacy cache model based on the vendor.

Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Tested-by: Yi Lai <yi1.lai@intel.com>
Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250711102143.1622339-15-zhao1.liu@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 43 ++++++++++++++++++++++++++++++++++---------
 1 file changed, 34 insertions(+), 9 deletions(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index ca85603077..565eaf0071 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -7507,7 +7507,35 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
         encode_cache_cpuid2(cpu, caches, eax, ebx, ecx, edx);
         break;
     }
-    case 4:
+    case 4: {
+        const CPUCaches *caches;
+
+        if (env->enable_legacy_vendor_cache) {
+            caches = &legacy_intel_cache_info;
+        } else {
+            /*
+             * FIXME: Temporarily select cache info model here based on
+             * vendor, and merge these 2 cache info models later.
+             *
+             * This condition covers the following cases (with
+             * enable_legacy_vendor_cache=false):
+             *  - When CPU model has its own cache model and doesn't use legacy
+             *    cache model (legacy_model=off). Then cache_info_amd and
+             *    cache_info_cpuid4 are the same.
+             *
+             *  - For v10.1 and newer machines, when CPU model uses legacy cache
+             *    model. Non-AMD CPUs use cache_info_cpuid4 like before and AMD
+             *    CPU will use cache_info_amd. But this doesn't matter for AMD
+             *    CPU, because this leaf encodes all-0 for AMD whatever its cache
+             *    model is.
+             */
+            if (IS_AMD_CPU(env)) {
+                caches = &env->cache_info_amd;
+            } else {
+                caches = &env->cache_info_cpuid4;
+            }
+        }
+
         /* cache info: needed for Core compatibility */
         if (cpu->cache_info_passthrough) {
             x86_cpu_get_cache_cpuid(index, count, eax, ebx, ecx, edx);
@@ -7535,30 +7563,26 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
 
             switch (count) {
             case 0: /* L1 dcache info */
-                encode_cache_cpuid4(env->cache_info_cpuid4.l1d_cache,
-                                    topo_info,
+                encode_cache_cpuid4(caches->l1d_cache, topo_info,
                                     eax, ebx, ecx, edx);
                 if (!cpu->l1_cache_per_core) {
                     *eax &= ~MAKE_64BIT_MASK(14, 12);
                 }
                 break;
             case 1: /* L1 icache info */
-                encode_cache_cpuid4(env->cache_info_cpuid4.l1i_cache,
-                                    topo_info,
+                encode_cache_cpuid4(caches->l1i_cache, topo_info,
                                     eax, ebx, ecx, edx);
                 if (!cpu->l1_cache_per_core) {
                     *eax &= ~MAKE_64BIT_MASK(14, 12);
                 }
                 break;
             case 2: /* L2 cache info */
-                encode_cache_cpuid4(env->cache_info_cpuid4.l2_cache,
-                                    topo_info,
+                encode_cache_cpuid4(caches->l2_cache, topo_info,
                                     eax, ebx, ecx, edx);
                 break;
             case 3: /* L3 cache info */
                 if (cpu->enable_l3_cache) {
-                    encode_cache_cpuid4(env->cache_info_cpuid4.l3_cache,
-                                        topo_info,
+                    encode_cache_cpuid4(caches->l3_cache, topo_info,
                                         eax, ebx, ecx, edx);
                     break;
                 }
@@ -7569,6 +7593,7 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
             }
         }
         break;
+    }
     case 5:
         /* MONITOR/MWAIT Leaf */
         *eax = cpu->mwait.eax; /* Smallest monitor-line size in bytes */

From d4a8c66de8cb1f90ef9c23db8fb0ccf668c3518b Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Fri, 11 Jul 2025 18:21:40 +0800
Subject: [PATCH 2198/2760] i386/cpu: Select legacy cache model based on vendor
 in CPUID 0x80000005

As preparation for merging cache_info_cpuid4 and cache_info_amd in
X86CPUState, set legacy cache model based on vendor in the CPUID
0x80000005 leaf. For AMD CPU, select legacy AMD cache model (in
cache_info_amd) as the default cache model like before, otherwise,
select legacy Intel cache model (in cache_info_cpuid4).

To ensure compatibility is not broken, add an enable_legacy_vendor_cache
flag based on x-vendor-only-v2 to indicate cases where the legacy cache
model should be used regardless of the vendor. For CPUID 0x80000005
leaf, enable_legacy_vendor_cache flag indicates to pick legacy AMD cache
model, which is for compatibility with the behavior of PC machine v10.0
and older.

The following explains how current vendor-based default legacy cache
model ensures correctness without breaking compatibility.

* For the PC machine v6.0 and older, vendor_cpuid_only=false, and
  vendor_cpuid_only_v2=false.

  - If the named CPU model has its own cache model, and doesn't use
    legacy cache model (legacy_cache=false), then cache_info_cpuid4 and
    cache_info_amd are same, so 0x80000005 leaf uses its own cache model
    regardless of the vendor.

  - For max/host/named CPU (without its own cache model), then the flag
    enable_legacy_vendor_cache is true, they will use legacy AMD cache
    model just like their previous behavior.

* For the PC machine v10.0 and older (to v6.1), vendor_cpuid_only=true,
  and vendor_cpuid_only_v2=false.

  - No change, since this leaf doesn't aware vendor_cpuid_only.

* For the PC machine v10.1 and newer, vendor_cpuid_only=true, and
  vendor_cpuid_only_v2=true.

  - If the named CPU model has its own cache model (legacy_cache=false),
    then cache_info_cpuid4 & cache_info_amd both equal to its own cache
    model, so it uses its own cache model in 0x80000005 leaf regardless
    of the vendor. Only Intel CPUs have all-0 leaf due to
    vendor_cpuid_only_2=true, and this is exactly the expected behavior.

  - For max/host/named CPU (without its own cache model), then the flag
    enable_legacy_vendor_cache is false, the legacy cache model is
    selected based on vendor.

    For AMD CPU, it will use legacy AMD cache as expected.

    For Intel CPU, it will use legacy Intel cache but still get all-0
    leaf due to vendor_cpuid_only_2=true as expected.

    (Note) And for Zhaoxin CPU, it will use legacy Intel cache model
    instead of AMD's. This is the difference brought by this change! But
    it's correct since then Zhaoxin could have the consistent cache info
    in CPUID 0x2, 0x4 and 0x80000005 leaves.

    Here, except Zhaoxin, selecting the legacy cache model based on the
    vendor does not change the previous (before the change) behavior.
    And the change for Zhaoxin is also a good improvement.

Therefore, the above analysis proves that, with the help of the flag
enable_legacy_vendor_cache, it is acceptable to select the default
legacy cache model based on the vendor.

For the CPUID 0x80000005 leaf, in X86CPUState, a unified cache_info is
enough. It only needs to be initialized and configured with the
corresponding legacy cache model based on the vendor.

Cc: EwanHai <ewanhai-oc@zhaoxin.com>
Tested-by: Yi Lai <yi1.lai@intel.com>
Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250711102143.1622339-16-zhao1.liu@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 35 ++++++++++++++++++++++++++++++++---
 1 file changed, 32 insertions(+), 3 deletions(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 565eaf0071..e98ffb11c3 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -7935,8 +7935,36 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
         *ecx = env->cpuid_model[(index - 0x80000002) * 4 + 2];
         *edx = env->cpuid_model[(index - 0x80000002) * 4 + 3];
         break;
-    case 0x80000005:
+    case 0x80000005: {
         /* cache info (L1 cache/TLB Associativity Field) */
+        const CPUCaches *caches;
+
+        if (env->enable_legacy_vendor_cache) {
+            caches = &legacy_amd_cache_info;
+        } else {
+            /*
+             * FIXME: Temporarily select cache info model here based on
+             * vendor, and merge these 2 cache info models later.
+             *
+             * This condition covers the following cases (with
+             * enable_legacy_vendor_cache=false):
+             *  - When CPU model has its own cache model and doesn't uses legacy
+             *    cache model (legacy_model=off). Then cache_info_amd and
+             *    cache_info_cpuid4 are the same.
+             *
+             *  - For v10.1 and newer machines, when CPU model uses legacy cache
+             *    model. AMD CPUs use cache_info_amd like before and non-AMD
+             *    CPU will use cache_info_cpuid4. But this doesn't matter,
+             *    because for Intel CPU, it will get all-0 leaf, and Zhaoxin CPU
+             *    will get correct cache info. Both are expected.
+             */
+            if (IS_AMD_CPU(env)) {
+                caches = &env->cache_info_amd;
+            } else {
+                caches = &env->cache_info_cpuid4;
+            }
+        }
+
         if (cpu->cache_info_passthrough) {
             x86_cpu_get_cache_cpuid(index, 0, eax, ebx, ecx, edx);
             break;
@@ -7951,9 +7979,10 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
                (L1_ITLB_2M_ASSOC <<  8) | (L1_ITLB_2M_ENTRIES);
         *ebx = (L1_DTLB_4K_ASSOC << 24) | (L1_DTLB_4K_ENTRIES << 16) |
                (L1_ITLB_4K_ASSOC <<  8) | (L1_ITLB_4K_ENTRIES);
-        *ecx = encode_cache_cpuid80000005(env->cache_info_amd.l1d_cache);
-        *edx = encode_cache_cpuid80000005(env->cache_info_amd.l1i_cache);
+        *ecx = encode_cache_cpuid80000005(caches->l1d_cache);
+        *edx = encode_cache_cpuid80000005(caches->l1i_cache);
         break;
+    }
     case 0x80000006:
         /* cache info (L2 cache/TLB/L3 cache) */
         if (cpu->cache_info_passthrough) {

From 00fa96c96a864e133c22a5f3793b468bb8a121a5 Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Fri, 11 Jul 2025 18:21:41 +0800
Subject: [PATCH 2199/2760] i386/cpu: Select legacy cache model based on vendor
 in CPUID 0x80000006

As preparation for merging cache_info_cpuid4 and cache_info_amd in
X86CPUState, set legacy cache model based on vendor in the CPUID
0x80000006 leaf. For AMD CPU, select legacy AMD cache model (in
cache_info_amd) as the default cache model like before, otherwise,
select legacy Intel cache model (in cache_info_cpuid4).

To ensure compatibility is not broken, add an enable_legacy_vendor_cache
flag based on x-vendor-only-v2 to indicate cases where the legacy cache
model should be used regardless of the vendor. For CPUID 0x80000006 leaf,
enable_legacy_vendor_cache flag indicates to pick legacy Intel cache
model, which is for compatibility with the behavior of PC machine v10.0
and older.

The following explains how current vendor-based default legacy cache
model ensures correctness without breaking compatibility.

* For the PC machine v6.0 and older, vendor_cpuid_only=false, and
  vendor_cpuid_only_v2=false.

  - If the named CPU model has its own cache model, and doesn't use
    legacy cache model (legacy_cache=false), then cache_info_cpuid4 and
    cache_info_amd are same, so 0x80000006 leaf uses its own cache model
    regardless of the vendor.

  - For max/host/named CPU (without its own cache model), then the flag
    enable_legacy_vendor_cache is true, they will use legacy AMD cache
    model just like their previous behavior.

* For the PC machine v10.0 and older (to v6.1), vendor_cpuid_only=true,
  and vendor_cpuid_only_v2=false.

  - No change, since this leaf doesn't aware vendor_cpuid_only.

* For the PC machine v10.1 and newer, vendor_cpuid_only=true, and
  vendor_cpuid_only_v2=true.

  - If the named CPU model has its own cache model (legacy_cache=false),
    then cache_info_cpuid4 & cache_info_amd both equal to its own cache
    model, so it uses its own cache model in 0x80000006 leaf regardless
    of the vendor. Intel and Zhaoxin CPUs have their special encoding
    based on SDM, which is the expected behavior and no different from
    before.

  - For max/host/named CPU (without its own cache model), then the flag
    enable_legacy_vendor_cache is false, the legacy cache model is
    selected based on vendor.

    For AMD CPU, it will use legacy AMD cache as before.

    For non-AMD (Intel/Zhaoxin) CPU, it will use legacy Intel cache and
    be encoded based on SDM as expected.

    Here, selecting the legacy cache model based on the vendor does not
    change the previous (before the change) behavior.

Therefore, the above analysis proves that, with the help of the flag
enable_legacy_vendor_cache, it is acceptable to select the default
legacy cache model based on the vendor.

For the CPUID 0x80000006 leaf, in X86CPUState, a unified cache_info is
enough. It only needs to be initialized and configured with the
corresponding legacy cache model based on the vendor.

Tested-by: Yi Lai <yi1.lai@intel.com>
Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250711102143.1622339-17-zhao1.liu@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 36 +++++++++++++++++++++++++++++++-----
 1 file changed, 31 insertions(+), 5 deletions(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index e98ffb11c3..b557fd01c0 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -7983,8 +7983,33 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
         *edx = encode_cache_cpuid80000005(caches->l1i_cache);
         break;
     }
-    case 0x80000006:
-        /* cache info (L2 cache/TLB/L3 cache) */
+    case 0x80000006: { /* cache info (L2 cache/TLB/L3 cache) */
+        const CPUCaches *caches;
+
+        if (env->enable_legacy_vendor_cache) {
+            caches = &legacy_amd_cache_info;
+        } else {
+            /*
+             * FIXME: Temporarily select cache info model here based on
+             * vendor, and merge these 2 cache info models later.
+             *
+             * This condition covers the following cases (with
+             * enable_legacy_vendor_cache=false):
+             *  - When CPU model has its own cache model and doesn't uses legacy
+             *    cache model (legacy_model=off). Then cache_info_amd and
+             *    cache_info_cpuid4 are the same.
+             *
+             *  - For v10.1 and newer machines, when CPU model uses legacy cache
+             *    model. AMD CPUs use cache_info_amd like before and non-AMD
+             *    CPU (Intel & Zhaoxin) will use cache_info_cpuid4 as expected.
+             */
+            if (IS_AMD_CPU(env)) {
+                caches = &env->cache_info_amd;
+            } else {
+                caches = &env->cache_info_cpuid4;
+            }
+        }
+
         if (cpu->cache_info_passthrough) {
             x86_cpu_get_cache_cpuid(index, 0, eax, ebx, ecx, edx);
             break;
@@ -7993,7 +8018,7 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
         if (cpu->vendor_cpuid_only_v2 &&
             (IS_INTEL_CPU(env) || IS_ZHAOXIN_CPU(env))) {
             *eax = *ebx = 0;
-            encode_cache_cpuid80000006(env->cache_info_cpuid4.l2_cache,
+            encode_cache_cpuid80000006(caches->l2_cache,
                                        NULL, ecx, edx);
             break;
         }
@@ -8007,11 +8032,12 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
                (X86_ENC_ASSOC(L2_ITLB_4K_ASSOC) << 12) |
                (L2_ITLB_4K_ENTRIES);
 
-        encode_cache_cpuid80000006(env->cache_info_amd.l2_cache,
+        encode_cache_cpuid80000006(caches->l2_cache,
                                    cpu->enable_l3_cache ?
-                                   env->cache_info_amd.l3_cache : NULL,
+                                   caches->l3_cache : NULL,
                                    ecx, edx);
         break;
+    }
     case 0x80000007:
         *eax = 0;
         *ebx = env->features[FEAT_8000_0007_EBX];

From 25acae4c6e7635ff0f0d36945548de4c0dc70608 Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Fri, 11 Jul 2025 18:21:42 +0800
Subject: [PATCH 2200/2760] i386/cpu: Select legacy cache model based on vendor
 in CPUID 0x8000001D

As preparation for merging cache_info_cpuid4 and cache_info_amd in
X86CPUState, set legacy cache model based on vendor in the CPUID
0x8000001D leaf. For AMD CPU, select legacy AMD cache model (in
cache_info_amd) as the default cache model like before, otherwise,
select legacy Intel cache model (in cache_info_cpuid4).

In fact, for Intel (and Zhaoxin) CPU, this change is safe because the
extended CPUID level supported by Intel is up to 0x80000008. So Intel
Guest doesn't have this 0x8000001D leaf.

Although someone could bump "xlevel" up to 0x8000001D for Intel Guest,
it's meaningless and this is undefined behavior. This leaf should be
considered reserved, but the SDM does not explicitly state this. So,
there's no need to specifically use vendor_cpuid_only_v2 to fix
anything, as it doesn't even qualify as a fix since nothing is
currently broken.

Therefore, it is acceptable to select the default legacy cache model
based on the vendor.

For the CPUID 0x8000001D leaf, in X86CPUState, a unified cache_info is
enough. It only needs to be initialized and configured with the
corresponding legacy cache model based on the vendor.

Tested-by: Yi Lai <yi1.lai@intel.com>
Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250711102143.1622339-18-zhao1.liu@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 26 +++++++++++++++++++++-----
 1 file changed, 21 insertions(+), 5 deletions(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index b557fd01c0..5b969743bc 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -8080,7 +8080,22 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
             *edx = 0;
         }
         break;
-    case 0x8000001D:
+    case 0x8000001D: {
+        const CPUCaches *caches;
+
+        /*
+         * FIXME: Temporarily select cache info model here based on
+         * vendor, and merge these 2 cache info models later.
+         *
+         * Intel doesn't support this leaf so that Intel Guests don't
+         * have this leaf. This change is harmless to Intel CPUs.
+         */
+        if (IS_AMD_CPU(env)) {
+            caches = &env->cache_info_amd;
+        } else {
+            caches = &env->cache_info_cpuid4;
+        }
+
         *eax = 0;
         if (cpu->cache_info_passthrough) {
             x86_cpu_get_cache_cpuid(index, count, eax, ebx, ecx, edx);
@@ -8088,19 +8103,19 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
         }
         switch (count) {
         case 0: /* L1 dcache info */
-            encode_cache_cpuid8000001d(env->cache_info_amd.l1d_cache,
+            encode_cache_cpuid8000001d(caches->l1d_cache,
                                        topo_info, eax, ebx, ecx, edx);
             break;
         case 1: /* L1 icache info */
-            encode_cache_cpuid8000001d(env->cache_info_amd.l1i_cache,
+            encode_cache_cpuid8000001d(caches->l1i_cache,
                                        topo_info, eax, ebx, ecx, edx);
             break;
         case 2: /* L2 cache info */
-            encode_cache_cpuid8000001d(env->cache_info_amd.l2_cache,
+            encode_cache_cpuid8000001d(caches->l2_cache,
                                        topo_info, eax, ebx, ecx, edx);
             break;
         case 3: /* L3 cache info */
-            encode_cache_cpuid8000001d(env->cache_info_amd.l3_cache,
+            encode_cache_cpuid8000001d(caches->l3_cache,
                                        topo_info, eax, ebx, ecx, edx);
             break;
         default: /* end of info */
@@ -8111,6 +8126,7 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
             *edx &= CACHE_NO_INVD_SHARING | CACHE_INCLUSIVE;
         }
         break;
+    }
     case 0x8000001E:
         if (cpu->core_id <= 255) {
             encode_topo_cpuid8000001e(cpu, topo_info, eax, ebx, ecx, edx);

From 2141898bb9b7f3d426871eaa6e98b4c77a1f81e8 Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Fri, 11 Jul 2025 18:21:43 +0800
Subject: [PATCH 2201/2760] i386/cpu: Use a unified cache_info in X86CPUState

At present, all cases using the cache model (CPUID 0x2, 0x4, 0x80000005,
0x80000006 and 0x8000001D leaves) have been verified to be able to
select either cache_info_intel or cache_info_amd based on the vendor.

Therefore, further merge cache_info_intel and cache_info_amd into a
unified cache_info in X86CPUState, and during its initialization, set
different legacy cache models based on the vendor.

Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Tested-by: Yi Lai <yi1.lai@intel.com>
Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250711102143.1622339-19-zhao1.liu@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 150 ++++++++--------------------------------------
 target/i386/cpu.h |   5 +-
 2 files changed, 27 insertions(+), 128 deletions(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 5b969743bc..ca6e412024 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -7474,27 +7474,7 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
         } else if (env->enable_legacy_vendor_cache) {
             caches = &legacy_intel_cache_info;
         } else {
-            /*
-             * FIXME: Temporarily select cache info model here based on
-             * vendor, and merge these 2 cache info models later.
-             *
-             * This condition covers the following cases (with
-             * enable_legacy_vendor_cache=false):
-             *  - When CPU model has its own cache model and doesn't use legacy
-             *    cache model (legacy_model=off). Then cache_info_amd and
-             *    cache_info_cpuid4 are the same.
-             *
-             *  - For v10.1 and newer machines, when CPU model uses legacy cache
-             *    model. Non-AMD CPUs use cache_info_cpuid4 like before and AMD
-             *    CPU will use cache_info_amd. But this doesn't matter for AMD
-             *    CPU, because this leaf encodes all-0 for AMD whatever its cache
-             *    model is.
-             */
-            if (IS_AMD_CPU(env)) {
-                caches = &env->cache_info_amd;
-            } else {
-                caches = &env->cache_info_cpuid4;
-            }
+            caches = &env->cache_info;
         }
 
         if (cpu->cache_info_passthrough) {
@@ -7513,27 +7493,7 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
         if (env->enable_legacy_vendor_cache) {
             caches = &legacy_intel_cache_info;
         } else {
-            /*
-             * FIXME: Temporarily select cache info model here based on
-             * vendor, and merge these 2 cache info models later.
-             *
-             * This condition covers the following cases (with
-             * enable_legacy_vendor_cache=false):
-             *  - When CPU model has its own cache model and doesn't use legacy
-             *    cache model (legacy_model=off). Then cache_info_amd and
-             *    cache_info_cpuid4 are the same.
-             *
-             *  - For v10.1 and newer machines, when CPU model uses legacy cache
-             *    model. Non-AMD CPUs use cache_info_cpuid4 like before and AMD
-             *    CPU will use cache_info_amd. But this doesn't matter for AMD
-             *    CPU, because this leaf encodes all-0 for AMD whatever its cache
-             *    model is.
-             */
-            if (IS_AMD_CPU(env)) {
-                caches = &env->cache_info_amd;
-            } else {
-                caches = &env->cache_info_cpuid4;
-            }
+            caches = &env->cache_info;
         }
 
         /* cache info: needed for Core compatibility */
@@ -7942,27 +7902,7 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
         if (env->enable_legacy_vendor_cache) {
             caches = &legacy_amd_cache_info;
         } else {
-            /*
-             * FIXME: Temporarily select cache info model here based on
-             * vendor, and merge these 2 cache info models later.
-             *
-             * This condition covers the following cases (with
-             * enable_legacy_vendor_cache=false):
-             *  - When CPU model has its own cache model and doesn't uses legacy
-             *    cache model (legacy_model=off). Then cache_info_amd and
-             *    cache_info_cpuid4 are the same.
-             *
-             *  - For v10.1 and newer machines, when CPU model uses legacy cache
-             *    model. AMD CPUs use cache_info_amd like before and non-AMD
-             *    CPU will use cache_info_cpuid4. But this doesn't matter,
-             *    because for Intel CPU, it will get all-0 leaf, and Zhaoxin CPU
-             *    will get correct cache info. Both are expected.
-             */
-            if (IS_AMD_CPU(env)) {
-                caches = &env->cache_info_amd;
-            } else {
-                caches = &env->cache_info_cpuid4;
-            }
+            caches = &env->cache_info;
         }
 
         if (cpu->cache_info_passthrough) {
@@ -7989,25 +7929,7 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
         if (env->enable_legacy_vendor_cache) {
             caches = &legacy_amd_cache_info;
         } else {
-            /*
-             * FIXME: Temporarily select cache info model here based on
-             * vendor, and merge these 2 cache info models later.
-             *
-             * This condition covers the following cases (with
-             * enable_legacy_vendor_cache=false):
-             *  - When CPU model has its own cache model and doesn't uses legacy
-             *    cache model (legacy_model=off). Then cache_info_amd and
-             *    cache_info_cpuid4 are the same.
-             *
-             *  - For v10.1 and newer machines, when CPU model uses legacy cache
-             *    model. AMD CPUs use cache_info_amd like before and non-AMD
-             *    CPU (Intel & Zhaoxin) will use cache_info_cpuid4 as expected.
-             */
-            if (IS_AMD_CPU(env)) {
-                caches = &env->cache_info_amd;
-            } else {
-                caches = &env->cache_info_cpuid4;
-            }
+            caches = &env->cache_info;
         }
 
         if (cpu->cache_info_passthrough) {
@@ -8080,22 +8002,7 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
             *edx = 0;
         }
         break;
-    case 0x8000001D: {
-        const CPUCaches *caches;
-
-        /*
-         * FIXME: Temporarily select cache info model here based on
-         * vendor, and merge these 2 cache info models later.
-         *
-         * Intel doesn't support this leaf so that Intel Guests don't
-         * have this leaf. This change is harmless to Intel CPUs.
-         */
-        if (IS_AMD_CPU(env)) {
-            caches = &env->cache_info_amd;
-        } else {
-            caches = &env->cache_info_cpuid4;
-        }
-
+    case 0x8000001D:
         *eax = 0;
         if (cpu->cache_info_passthrough) {
             x86_cpu_get_cache_cpuid(index, count, eax, ebx, ecx, edx);
@@ -8103,19 +8010,19 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
         }
         switch (count) {
         case 0: /* L1 dcache info */
-            encode_cache_cpuid8000001d(caches->l1d_cache,
+            encode_cache_cpuid8000001d(env->cache_info.l1d_cache,
                                        topo_info, eax, ebx, ecx, edx);
             break;
         case 1: /* L1 icache info */
-            encode_cache_cpuid8000001d(caches->l1i_cache,
+            encode_cache_cpuid8000001d(env->cache_info.l1i_cache,
                                        topo_info, eax, ebx, ecx, edx);
             break;
         case 2: /* L2 cache info */
-            encode_cache_cpuid8000001d(caches->l2_cache,
+            encode_cache_cpuid8000001d(env->cache_info.l2_cache,
                                        topo_info, eax, ebx, ecx, edx);
             break;
         case 3: /* L3 cache info */
-            encode_cache_cpuid8000001d(caches->l3_cache,
+            encode_cache_cpuid8000001d(env->cache_info.l3_cache,
                                        topo_info, eax, ebx, ecx, edx);
             break;
         default: /* end of info */
@@ -8126,7 +8033,6 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
             *edx &= CACHE_NO_INVD_SHARING | CACHE_INCLUSIVE;
         }
         break;
-    }
     case 0x8000001E:
         if (cpu->core_id <= 255) {
             encode_topo_cpuid8000001e(cpu, topo_info, eax, ebx, ecx, edx);
@@ -8825,46 +8731,34 @@ static bool x86_cpu_update_smp_cache_topo(MachineState *ms, X86CPU *cpu,
 
     level = machine_get_cache_topo_level(ms, CACHE_LEVEL_AND_TYPE_L1D);
     if (level != CPU_TOPOLOGY_LEVEL_DEFAULT) {
-        env->cache_info_cpuid4.l1d_cache->share_level = level;
-        env->cache_info_amd.l1d_cache->share_level = level;
+        env->cache_info.l1d_cache->share_level = level;
     } else {
         machine_set_cache_topo_level(ms, CACHE_LEVEL_AND_TYPE_L1D,
-            env->cache_info_cpuid4.l1d_cache->share_level);
-        machine_set_cache_topo_level(ms, CACHE_LEVEL_AND_TYPE_L1D,
-            env->cache_info_amd.l1d_cache->share_level);
+            env->cache_info.l1d_cache->share_level);
     }
 
     level = machine_get_cache_topo_level(ms, CACHE_LEVEL_AND_TYPE_L1I);
     if (level != CPU_TOPOLOGY_LEVEL_DEFAULT) {
-        env->cache_info_cpuid4.l1i_cache->share_level = level;
-        env->cache_info_amd.l1i_cache->share_level = level;
+        env->cache_info.l1i_cache->share_level = level;
     } else {
         machine_set_cache_topo_level(ms, CACHE_LEVEL_AND_TYPE_L1I,
-            env->cache_info_cpuid4.l1i_cache->share_level);
-        machine_set_cache_topo_level(ms, CACHE_LEVEL_AND_TYPE_L1I,
-            env->cache_info_amd.l1i_cache->share_level);
+            env->cache_info.l1i_cache->share_level);
     }
 
     level = machine_get_cache_topo_level(ms, CACHE_LEVEL_AND_TYPE_L2);
     if (level != CPU_TOPOLOGY_LEVEL_DEFAULT) {
-        env->cache_info_cpuid4.l2_cache->share_level = level;
-        env->cache_info_amd.l2_cache->share_level = level;
+        env->cache_info.l2_cache->share_level = level;
     } else {
         machine_set_cache_topo_level(ms, CACHE_LEVEL_AND_TYPE_L2,
-            env->cache_info_cpuid4.l2_cache->share_level);
-        machine_set_cache_topo_level(ms, CACHE_LEVEL_AND_TYPE_L2,
-            env->cache_info_amd.l2_cache->share_level);
+            env->cache_info.l2_cache->share_level);
     }
 
     level = machine_get_cache_topo_level(ms, CACHE_LEVEL_AND_TYPE_L3);
     if (level != CPU_TOPOLOGY_LEVEL_DEFAULT) {
-        env->cache_info_cpuid4.l3_cache->share_level = level;
-        env->cache_info_amd.l3_cache->share_level = level;
+        env->cache_info.l3_cache->share_level = level;
     } else {
         machine_set_cache_topo_level(ms, CACHE_LEVEL_AND_TYPE_L3,
-            env->cache_info_cpuid4.l3_cache->share_level);
-        machine_set_cache_topo_level(ms, CACHE_LEVEL_AND_TYPE_L3,
-            env->cache_info_amd.l3_cache->share_level);
+            env->cache_info.l3_cache->share_level);
     }
 
     if (!machine_check_smp_cache(ms, errp)) {
@@ -9101,7 +8995,7 @@ static void x86_cpu_realizefn(DeviceState *dev, Error **errp)
                        "CPU model '%s' doesn't support legacy-cache=off", name);
             return;
         }
-        env->cache_info_cpuid4 = env->cache_info_amd = *cache_info;
+        env->cache_info = *cache_info;
     } else {
         /* Build legacy cache information */
         if (!cpu->consistent_cache) {
@@ -9111,8 +9005,12 @@ static void x86_cpu_realizefn(DeviceState *dev, Error **errp)
         if (!cpu->vendor_cpuid_only_v2) {
             env->enable_legacy_vendor_cache = true;
         }
-        env->cache_info_cpuid4 = legacy_intel_cache_info;
-        env->cache_info_amd = legacy_amd_cache_info;
+
+        if (IS_AMD_CPU(env)) {
+            env->cache_info = legacy_amd_cache_info;
+        } else {
+            env->cache_info = legacy_intel_cache_info;
+        }
     }
 
 #ifndef CONFIG_USER_ONLY
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index 20499a82a5..f977fc49a7 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -2073,11 +2073,12 @@ typedef struct CPUArchState {
     /* Features that were explicitly enabled/disabled */
     FeatureWordArray user_features;
     uint32_t cpuid_model[12];
-    /* Cache information for CPUID.  When legacy-cache=on, the cache data
+    /*
+     * Cache information for CPUID.  When legacy-cache=on, the cache data
      * on each CPUID leaf will be different, because we keep compatibility
      * with old QEMU versions.
      */
-    CPUCaches cache_info_cpuid4, cache_info_amd;
+    CPUCaches cache_info;
     bool enable_legacy_cpuid2_cache;
     bool enable_legacy_vendor_cache;
 

From 1f0a9ce6c0c934507eed076b1b9a2774b7c81de4 Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Fri, 11 Jul 2025 18:45:55 +0800
Subject: [PATCH 2202/2760] i386/cpu: Introduce cache model for SierraForest
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add the cache model to SierraForest (v3) to better emulate its
environment.

The cache model is based on SierraForest-SP (Scalable Performance):

      --- cache 0 ---
      cache type                         = data cache (1)
      cache level                        = 0x1 (1)
      self-initializing cache level      = true
      fully associative cache            = false
      maximum IDs for CPUs sharing cache = 0x0 (0)
      maximum IDs for cores in pkg       = 0x3f (63)
      system coherency line size         = 0x40 (64)
      physical line partitions           = 0x1 (1)
      ways of associativity              = 0x8 (8)
      number of sets                     = 0x40 (64)
      WBINVD/INVD acts on lower caches   = false
      inclusive to lower caches          = false
      complex cache indexing             = false
      number of sets (s)                 = 64
      (size synth)                       = 32768 (32 KB)
      --- cache 1 ---
      cache type                         = instruction cache (2)
      cache level                        = 0x1 (1)
      self-initializing cache level      = true
      fully associative cache            = false
      maximum IDs for CPUs sharing cache = 0x0 (0)
      maximum IDs for cores in pkg       = 0x3f (63)
      system coherency line size         = 0x40 (64)
      physical line partitions           = 0x1 (1)
      ways of associativity              = 0x8 (8)
      number of sets                     = 0x80 (128)
      WBINVD/INVD acts on lower caches   = false
      inclusive to lower caches          = false
      complex cache indexing             = false
      number of sets (s)                 = 128
      (size synth)                       = 65536 (64 KB)
      --- cache 2 ---
      cache type                         = unified cache (3)
      cache level                        = 0x2 (2)
      self-initializing cache level      = true
      fully associative cache            = false
      maximum IDs for CPUs sharing cache = 0x7 (7)
      maximum IDs for cores in pkg       = 0x3f (63)
      system coherency line size         = 0x40 (64)
      physical line partitions           = 0x1 (1)
      ways of associativity              = 0x10 (16)
      number of sets                     = 0x1000 (4096)
      WBINVD/INVD acts on lower caches   = false
      inclusive to lower caches          = false
      complex cache indexing             = false
      number of sets (s)                 = 4096
      (size synth)                       = 4194304 (4 MB)
      --- cache 3 ---
      cache type                         = unified cache (3)
      cache level                        = 0x3 (3)
      self-initializing cache level      = true
      fully associative cache            = false
      maximum IDs for CPUs sharing cache = 0x1ff (511)
      maximum IDs for cores in pkg       = 0x3f (63)
      system coherency line size         = 0x40 (64)
      physical line partitions           = 0x1 (1)
      ways of associativity              = 0xc (12)
      number of sets                     = 0x24000 (147456)
      WBINVD/INVD acts on lower caches   = false
      inclusive to lower caches          = false
      complex cache indexing             = true
      number of sets (s)                 = 147456
      (size synth)                       = 113246208 (108 MB)
      --- cache 4 ---
      cache type                         = no more caches (0)

Suggested-by: Tejus GK <tejus.gk@nutanix.com>
Suggested-by: Jason Zeng <jason.zeng@intel.com>
Suggested-by: "Daniel P . Berrangé" <berrange@redhat.com>
Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Reviewed-by: Tao Su <tao1.su@linux.intel.com>
Tested-by: Yi Lai <yi1.lai@intel.com>
Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250711104603.1634832-2-zhao1.liu@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 96 +++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 96 insertions(+)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index ca6e412024..3c28e9588a 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -2880,6 +2880,97 @@ static const CPUCaches epyc_turin_cache_info = {
         .no_invd_sharing = true,
         .complex_indexing = false,
         .share_level = CPU_TOPOLOGY_LEVEL_DIE,
+    }
+};
+
+static const CPUCaches xeon_srf_cache_info = {
+    .l1d_cache = &(CPUCacheInfo) {
+        /* CPUID 0x4.0x0.EAX */
+        .type = DATA_CACHE,
+        .level = 1,
+        .self_init = true,
+
+        /* CPUID 0x4.0x0.EBX */
+        .line_size = 64,
+        .partitions = 1,
+        .associativity = 8,
+
+        /* CPUID 0x4.0x0.ECX */
+        .sets = 64,
+
+        /* CPUID 0x4.0x0.EDX */
+        .no_invd_sharing = false,
+        .inclusive = false,
+        .complex_indexing = false,
+
+        .size = 32 * KiB,
+        .share_level = CPU_TOPOLOGY_LEVEL_CORE,
+    },
+    .l1i_cache = &(CPUCacheInfo) {
+        /* CPUID 0x4.0x1.EAX */
+        .type = INSTRUCTION_CACHE,
+        .level = 1,
+        .self_init = true,
+
+        /* CPUID 0x4.0x1.EBX */
+        .line_size = 64,
+        .partitions = 1,
+        .associativity = 8,
+
+        /* CPUID 0x4.0x1.ECX */
+        .sets = 128,
+
+        /* CPUID 0x4.0x1.EDX */
+        .no_invd_sharing = false,
+        .inclusive = false,
+        .complex_indexing = false,
+
+        .size = 64 * KiB,
+        .share_level = CPU_TOPOLOGY_LEVEL_CORE,
+    },
+    .l2_cache = &(CPUCacheInfo) {
+        /* CPUID 0x4.0x2.EAX */
+        .type = UNIFIED_CACHE,
+        .level = 2,
+        .self_init = true,
+
+        /* CPUID 0x4.0x2.EBX */
+        .line_size = 64,
+        .partitions = 1,
+        .associativity = 16,
+
+        /* CPUID 0x4.0x2.ECX */
+        .sets = 4096,
+
+        /* CPUID 0x4.0x2.EDX */
+        .no_invd_sharing = false,
+        .inclusive = false,
+        .complex_indexing = false,
+
+        .size = 4 * MiB,
+        .share_level = CPU_TOPOLOGY_LEVEL_MODULE,
+    },
+    .l3_cache = &(CPUCacheInfo) {
+        /* CPUID 0x4.0x3.EAX */
+        .type = UNIFIED_CACHE,
+        .level = 3,
+        .self_init = true,
+
+        /* CPUID 0x4.0x3.EBX */
+        .line_size = 64,
+        .partitions = 1,
+        .associativity = 12,
+
+        /* CPUID 0x4.0x3.ECX */
+        .sets = 147456,
+
+        /* CPUID 0x4.0x3.EDX */
+        .no_invd_sharing = false,
+        .inclusive = false,
+        .complex_indexing = true,
+
+        .size = 108 * MiB,
+        .share_level = CPU_TOPOLOGY_LEVEL_SOCKET,
     },
 };
 
@@ -5005,6 +5096,11 @@ static const X86CPUDefinition builtin_x86_defs[] = {
                     { /* end of list */ }
                 }
             },
+            {
+                .version = 3,
+                .note = "with srf-sp cache model",
+                .cache_info = &xeon_srf_cache_info,
+            },
             { /* end of list */ },
         },
     },

From 23fb57838ddfa9271f8ebf8b7a74ed7ba3359cd3 Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Fri, 11 Jul 2025 18:45:56 +0800
Subject: [PATCH 2203/2760] i386/cpu: Introduce cache model for GraniteRapids
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add the cache model to GraniteRapids (v3) to better emulate its
environment.

The cache model is based on GraniteRapids-SP (Scalable Performance):

      --- cache 0 ---
      cache type                         = data cache (1)
      cache level                        = 0x1 (1)
      self-initializing cache level      = true
      fully associative cache            = false
      maximum IDs for CPUs sharing cache = 0x1 (1)
      maximum IDs for cores in pkg       = 0x3f (63)
      system coherency line size         = 0x40 (64)
      physical line partitions           = 0x1 (1)
      ways of associativity              = 0xc (12)
      number of sets                     = 0x40 (64)
      WBINVD/INVD acts on lower caches   = false
      inclusive to lower caches          = false
      complex cache indexing             = false
      number of sets (s)                 = 64
      (size synth)                       = 49152 (48 KB)
      --- cache 1 ---
      cache type                         = instruction cache (2)
      cache level                        = 0x1 (1)
      self-initializing cache level      = true
      fully associative cache            = false
      maximum IDs for CPUs sharing cache = 0x1 (1)
      maximum IDs for cores in pkg       = 0x3f (63)
      system coherency line size         = 0x40 (64)
      physical line partitions           = 0x1 (1)
      ways of associativity              = 0x10 (16)
      number of sets                     = 0x40 (64)
      WBINVD/INVD acts on lower caches   = false
      inclusive to lower caches          = false
      complex cache indexing             = false
      number of sets (s)                 = 64
      (size synth)                       = 65536 (64 KB)
      --- cache 2 ---
      cache type                         = unified cache (3)
      cache level                        = 0x2 (2)
      self-initializing cache level      = true
      fully associative cache            = false
      maximum IDs for CPUs sharing cache = 0x1 (1)
      maximum IDs for cores in pkg       = 0x3f (63)
      system coherency line size         = 0x40 (64)
      physical line partitions           = 0x1 (1)
      ways of associativity              = 0x10 (16)
      number of sets                     = 0x800 (2048)
      WBINVD/INVD acts on lower caches   = false
      inclusive to lower caches          = false
      complex cache indexing             = false
      number of sets (s)                 = 2048
      (size synth)                       = 2097152 (2 MB)
      --- cache 3 ---
      cache type                         = unified cache (3)
      cache level                        = 0x3 (3)
      self-initializing cache level      = true
      fully associative cache            = false
      maximum IDs for CPUs sharing cache = 0xff (255)
      maximum IDs for cores in pkg       = 0x3f (63)
      system coherency line size         = 0x40 (64)
      physical line partitions           = 0x1 (1)
      ways of associativity              = 0x10 (16)
      number of sets                     = 0x48000 (294912)
      WBINVD/INVD acts on lower caches   = false
      inclusive to lower caches          = false
      complex cache indexing             = true
      number of sets (s)                 = 294912
      (size synth)                       = 301989888 (288 MB)
      --- cache 4 ---
      cache type                         = no more caches (0)

Suggested-by: Tejus GK <tejus.gk@nutanix.com>
Suggested-by: Jason Zeng <jason.zeng@intel.com>
Suggested-by: "Daniel P . Berrangé" <berrange@redhat.com>
Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Reviewed-by: Tao Su <tao1.su@linux.intel.com>
Tested-by: Yi Lai <yi1.lai@intel.com>
Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250711104603.1634832-3-zhao1.liu@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 96 +++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 96 insertions(+)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 3c28e9588a..d1fc74eb0e 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -2883,6 +2883,97 @@ static const CPUCaches epyc_turin_cache_info = {
     }
 };
 
+static const CPUCaches xeon_gnr_cache_info = {
+    .l1d_cache = &(CPUCacheInfo) {
+        /* CPUID 0x4.0x0.EAX */
+        .type = DATA_CACHE,
+        .level = 1,
+        .self_init = true,
+
+        /* CPUID 0x4.0x0.EBX */
+        .line_size = 64,
+        .partitions = 1,
+        .associativity = 12,
+
+        /* CPUID 0x4.0x0.ECX */
+        .sets = 64,
+
+        /* CPUID 0x4.0x0.EDX */
+        .no_invd_sharing = false,
+        .inclusive = false,
+        .complex_indexing = false,
+
+        .size = 48 * KiB,
+        .share_level = CPU_TOPOLOGY_LEVEL_CORE,
+    },
+    .l1i_cache = &(CPUCacheInfo) {
+        /* CPUID 0x4.0x1.EAX */
+        .type = INSTRUCTION_CACHE,
+        .level = 1,
+        .self_init = true,
+
+        /* CPUID 0x4.0x1.EBX */
+        .line_size = 64,
+        .partitions = 1,
+        .associativity = 16,
+
+        /* CPUID 0x4.0x1.ECX */
+        .sets = 64,
+
+        /* CPUID 0x4.0x1.EDX */
+        .no_invd_sharing = false,
+        .inclusive = false,
+        .complex_indexing = false,
+
+        .size = 64 * KiB,
+        .share_level = CPU_TOPOLOGY_LEVEL_CORE,
+    },
+    .l2_cache = &(CPUCacheInfo) {
+        /* CPUID 0x4.0x2.EAX */
+        .type = UNIFIED_CACHE,
+        .level = 2,
+        .self_init = true,
+
+        /* CPUID 0x4.0x2.EBX */
+        .line_size = 64,
+        .partitions = 1,
+        .associativity = 16,
+
+        /* CPUID 0x4.0x2.ECX */
+        .sets = 2048,
+
+        /* CPUID 0x4.0x2.EDX */
+        .no_invd_sharing = false,
+        .inclusive = false,
+        .complex_indexing = false,
+
+        .size = 2 * MiB,
+        .share_level = CPU_TOPOLOGY_LEVEL_CORE,
+    },
+    .l3_cache = &(CPUCacheInfo) {
+        /* CPUID 0x4.0x3.EAX */
+        .type = UNIFIED_CACHE,
+        .level = 3,
+        .self_init = true,
+
+        /* CPUID 0x4.0x3.EBX */
+        .line_size = 64,
+        .partitions = 1,
+        .associativity = 16,
+
+        /* CPUID 0x4.0x3.ECX */
+        .sets = 294912,
+
+        /* CPUID 0x4.0x3.EDX */
+        .no_invd_sharing = false,
+        .inclusive = false,
+        .complex_indexing = true,
+
+        .size = 288 * MiB,
+        .share_level = CPU_TOPOLOGY_LEVEL_SOCKET,
+    },
+};
+
 static const CPUCaches xeon_srf_cache_info = {
     .l1d_cache = &(CPUCacheInfo) {
         /* CPUID 0x4.0x0.EAX */
@@ -4951,6 +5042,11 @@ static const X86CPUDefinition builtin_x86_defs[] = {
                     { /* end of list */ }
                 }
             },
+            {
+                .version = 3,
+                .note = "with gnr-sp cache model",
+                .cache_info = &xeon_gnr_cache_info,
+            },
             { /* end of list */ },
         },
     },

From 8d69fc2158edc83517622bd862beb29ffc6bbf02 Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Fri, 11 Jul 2025 18:45:57 +0800
Subject: [PATCH 2204/2760] i386/cpu: Introduce cache model for SapphireRapids
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add the cache model to SapphireRapids (v4) to better emulate its
environment.

The cache model is based on SapphireRapids-SP (Scalable Performance):

      --- cache 0 ---
      cache type                         = data cache (1)
      cache level                        = 0x1 (1)
      self-initializing cache level      = true
      fully associative cache            = false
      maximum IDs for CPUs sharing cache = 0x1 (1)
      maximum IDs for cores in pkg       = 0x3f (63)
      system coherency line size         = 0x40 (64)
      physical line partitions           = 0x1 (1)
      ways of associativity              = 0xc (12)
      number of sets                     = 0x40 (64)
      WBINVD/INVD acts on lower caches   = false
      inclusive to lower caches          = false
      complex cache indexing             = false
      number of sets (s)                 = 64
      (size synth)                       = 49152 (48 KB)
      --- cache 1 ---
      cache type                         = instruction cache (2)
      cache level                        = 0x1 (1)
      self-initializing cache level      = true
      fully associative cache            = false
      maximum IDs for CPUs sharing cache = 0x1 (1)
      maximum IDs for cores in pkg       = 0x3f (63)
      system coherency line size         = 0x40 (64)
      physical line partitions           = 0x1 (1)
      ways of associativity              = 0x8 (8)
      number of sets                     = 0x40 (64)
      WBINVD/INVD acts on lower caches   = false
      inclusive to lower caches          = false
      complex cache indexing             = false
      number of sets (s)                 = 64
      (size synth)                       = 32768 (32 KB)
      --- cache 2 ---
      cache type                         = unified cache (3)
      cache level                        = 0x2 (2)
      self-initializing cache level      = true
      fully associative cache            = false
      maximum IDs for CPUs sharing cache = 0x1 (1)
      maximum IDs for cores in pkg       = 0x3f (63)
      system coherency line size         = 0x40 (64)
      physical line partitions           = 0x1 (1)
      ways of associativity              = 0x10 (16)
      number of sets                     = 0x800 (2048)
      WBINVD/INVD acts on lower caches   = false
      inclusive to lower caches          = false
      complex cache indexing             = false
      number of sets (s)                 = 2048
      (size synth)                       = 2097152 (2 MB)
      --- cache 3 ---
      cache type                         = unified cache (3)
      cache level                        = 0x3 (3)
      self-initializing cache level      = true
      fully associative cache            = false
      maximum IDs for CPUs sharing cache = 0x7f (127)
      maximum IDs for cores in pkg       = 0x3f (63)
      system coherency line size         = 0x40 (64)
      physical line partitions           = 0x1 (1)
      ways of associativity              = 0xf (15)
      number of sets                     = 0x10000 (65536)
      WBINVD/INVD acts on lower caches   = false
      inclusive to lower caches          = false
      complex cache indexing             = true
      number of sets (s)                 = 65536
      (size synth)                       = 62914560 (60 MB)
      --- cache 4 ---
      cache type                         = no more caches (0)

Suggested-by: Tejus GK <tejus.gk@nutanix.com>
Suggested-by: Jason Zeng <jason.zeng@intel.com>
Suggested-by: "Daniel P . Berrangé" <berrange@redhat.com>
Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Reviewed-by: Tao Su <tao1.su@linux.intel.com>
Tested-by: Yi Lai <yi1.lai@intel.com>
Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250711104603.1634832-4-zhao1.liu@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 96 +++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 96 insertions(+)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index d1fc74eb0e..b3b29f6966 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -2883,6 +2883,97 @@ static const CPUCaches epyc_turin_cache_info = {
     }
 };
 
+static const CPUCaches xeon_spr_cache_info = {
+    .l1d_cache = &(CPUCacheInfo) {
+        /* CPUID 0x4.0x0.EAX */
+        .type = DATA_CACHE,
+        .level = 1,
+        .self_init = true,
+
+        /* CPUID 0x4.0x0.EBX */
+        .line_size = 64,
+        .partitions = 1,
+        .associativity = 12,
+
+        /* CPUID 0x4.0x0.ECX */
+        .sets = 64,
+
+        /* CPUID 0x4.0x0.EDX */
+        .no_invd_sharing = false,
+        .inclusive = false,
+        .complex_indexing = false,
+
+        .size = 48 * KiB,
+        .share_level = CPU_TOPOLOGY_LEVEL_CORE,
+    },
+    .l1i_cache = &(CPUCacheInfo) {
+        /* CPUID 0x4.0x1.EAX */
+        .type = INSTRUCTION_CACHE,
+        .level = 1,
+        .self_init = true,
+
+        /* CPUID 0x4.0x1.EBX */
+        .line_size = 64,
+        .partitions = 1,
+        .associativity = 8,
+
+        /* CPUID 0x4.0x1.ECX */
+        .sets = 64,
+
+        /* CPUID 0x4.0x1.EDX */
+        .no_invd_sharing = false,
+        .inclusive = false,
+        .complex_indexing = false,
+
+        .size = 32 * KiB,
+        .share_level = CPU_TOPOLOGY_LEVEL_CORE,
+    },
+    .l2_cache = &(CPUCacheInfo) {
+        /* CPUID 0x4.0x2.EAX */
+        .type = UNIFIED_CACHE,
+        .level = 2,
+        .self_init = true,
+
+        /* CPUID 0x4.0x2.EBX */
+        .line_size = 64,
+        .partitions = 1,
+        .associativity = 16,
+
+        /* CPUID 0x4.0x2.ECX */
+        .sets = 2048,
+
+        /* CPUID 0x4.0x2.EDX */
+        .no_invd_sharing = false,
+        .inclusive = false,
+        .complex_indexing = false,
+
+        .size = 2 * MiB,
+        .share_level = CPU_TOPOLOGY_LEVEL_CORE,
+    },
+    .l3_cache = &(CPUCacheInfo) {
+        /* CPUID 0x4.0x3.EAX */
+        .type = UNIFIED_CACHE,
+        .level = 3,
+        .self_init = true,
+
+        /* CPUID 0x4.0x3.EBX */
+        .line_size = 64,
+        .partitions = 1,
+        .associativity = 15,
+
+        /* CPUID 0x4.0x3.ECX */
+        .sets = 65536,
+
+        /* CPUID 0x4.0x3.EDX */
+        .no_invd_sharing = false,
+        .inclusive = false,
+        .complex_indexing = true,
+
+        .size = 60 * MiB,
+        .share_level = CPU_TOPOLOGY_LEVEL_SOCKET,
+    },
+};
+
 static const CPUCaches xeon_gnr_cache_info = {
     .l1d_cache = &(CPUCacheInfo) {
         /* CPUID 0x4.0x0.EAX */
@@ -4889,6 +4980,11 @@ static const X86CPUDefinition builtin_x86_defs[] = {
                     { /* end of list */ }
                 }
             },
+            {
+                .version = 4,
+                .note = "with spr-sp cache model",
+                .cache_info = &xeon_spr_cache_info,
+            },
             { /* end of list */ }
         }
     },

From b1a3a090b21a505d7a9da097c2046824f9e38f84 Mon Sep 17 00:00:00 2001
From: Ewan Hai <ewanhai-oc@zhaoxin.com>
Date: Fri, 11 Jul 2025 18:45:58 +0800
Subject: [PATCH 2205/2760] i386/cpu: Introduce cache model for YongFeng

Add the cache model to YongFeng (v3) to better emulate its
environment.

Note, although YongFeng v2 was added after v10.0, it was also back
ported to v10.0.2. Therefore, the new version (v3) is needed to avoid
conflict.

The cache model is as follows:

      --- cache 0 ---
      cache type                         = data cache (1)
      cache level                        = 0x1 (1)
      self-initializing cache level      = true
      fully associative cache            = false
      maximum IDs for CPUs sharing cache = 0x0 (0)
      maximum IDs for cores in pkg       = 0x0 (0)
      system coherency line size         = 0x40 (64)
      physical line partitions           = 0x1 (1)
      ways of associativity              = 0x8 (8)
      number of sets                     = 0x40 (64)
      WBINVD/INVD acts on lower caches   = false
      inclusive to lower caches          = false
      complex cache indexing             = false
      number of sets (s)                 = 64
      (size synth)                       = 32768 (32 KB)
      --- cache 1 ---
      cache type                         = instruction cache (2)
      cache level                        = 0x1 (1)
      self-initializing cache level      = true
      fully associative cache            = false
      maximum IDs for CPUs sharing cache = 0x0 (0)
      maximum IDs for cores in pkg       = 0x0 (0)
      system coherency line size         = 0x40 (64)
      physical line partitions           = 0x1 (1)
      ways of associativity              = 0x10 (16)
      number of sets                     = 0x40 (64)
      WBINVD/INVD acts on lower caches   = false
      inclusive to lower caches          = false
      complex cache indexing             = false
      number of sets (s)                 = 64
      (size synth)                       = 65536 (64 KB)
      --- cache 2 ---
      cache type                         = unified cache (3)
      cache level                        = 0x2 (2)
      self-initializing cache level      = true
      fully associative cache            = false
      maximum IDs for CPUs sharing cache = 0x0 (0)
      maximum IDs for cores in pkg       = 0x0 (0)
      system coherency line size         = 0x40 (64)
      physical line partitions           = 0x1 (1)
      ways of associativity              = 0x8 (8)
      number of sets                     = 0x200 (512)
      WBINVD/INVD acts on lower caches   = false
      inclusive to lower caches          = true
      complex cache indexing             = false
      number of sets (s)                 = 512
      (size synth)                       = 262144 (256 KB)
      --- cache 3 ---
      cache type                         = unified cache (3)
      cache level                        = 0x3 (3)
      self-initializing cache level      = true
      fully associative cache            = false
      maximum IDs for CPUs sharing cache = 0x0 (0)
      maximum IDs for cores in pkg       = 0x0 (0)
      system coherency line size         = 0x40 (64)
      physical line partitions           = 0x1 (1)
      ways of associativity              = 0x10 (16)
      number of sets                     = 0x2000 (8192)
      WBINVD/INVD acts on lower caches   = true
      inclusive to lower caches          = true
      complex cache indexing             = false
      number of sets (s)                 = 8192
      (size synth)                       = 8388608 (8 MB)
      --- cache 4 ---
      cache type                         = no more caches (0)

Tested-by: Yi Lai <yi1.lai@intel.com>
Signed-off-by: Ewan Hai <ewanhai-oc@zhaoxin.com>
Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250711104603.1634832-5-zhao1.liu@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 104 ++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 104 insertions(+)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index b3b29f6966..40f3b5eac8 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -3156,6 +3156,105 @@ static const CPUCaches xeon_srf_cache_info = {
     },
 };
 
+static const CPUCaches yongfeng_cache_info = {
+    .l1d_cache = &(CPUCacheInfo) {
+        /* CPUID 0x4.0x0.EAX */
+        .type = DATA_CACHE,
+        .level = 1,
+        .self_init = true,
+
+        /* CPUID 0x4.0x0.EBX */
+        .line_size = 64,
+        .partitions = 1,
+        .associativity = 8,
+
+        /* CPUID 0x4.0x0.ECX */
+        .sets = 64,
+
+        /* CPUID 0x4.0x0.EDX */
+        .no_invd_sharing = false,
+        .inclusive = false,
+        .complex_indexing = false,
+
+        /* CPUID 0x80000005.ECX */
+        .lines_per_tag = 1,
+        .size = 32 * KiB,
+
+        .share_level = CPU_TOPOLOGY_LEVEL_CORE,
+    },
+    .l1i_cache = &(CPUCacheInfo) {
+        /* CPUID 0x4.0x1.EAX */
+        .type = INSTRUCTION_CACHE,
+        .level = 1,
+        .self_init = true,
+
+        /* CPUID 0x4.0x1.EBX */
+        .line_size = 64,
+        .partitions = 1,
+        .associativity = 16,
+
+        /* CPUID 0x4.0x1.ECX */
+        .sets = 64,
+
+        /* CPUID 0x4.0x1.EDX */
+        .no_invd_sharing = false,
+        .inclusive = false,
+        .complex_indexing = false,
+
+        /* CPUID 0x80000005.EDX */
+        .lines_per_tag = 1,
+        .size = 64 * KiB,
+
+        .share_level = CPU_TOPOLOGY_LEVEL_CORE,
+    },
+    .l2_cache = &(CPUCacheInfo) {
+        /* CPUID 0x4.0x2.EAX */
+        .type = UNIFIED_CACHE,
+        .level = 2,
+        .self_init = true,
+
+        /* CPUID 0x4.0x2.EBX */
+        .line_size = 64,
+        .partitions = 1,
+        .associativity = 8,
+
+        /* CPUID 0x4.0x2.ECX */
+        .sets = 512,
+
+        /* CPUID 0x4.0x2.EDX */
+        .no_invd_sharing = false,
+        .inclusive = true,
+        .complex_indexing = false,
+
+        /* CPUID 0x80000006.ECX */
+        .size = 256 * KiB,
+
+        .share_level = CPU_TOPOLOGY_LEVEL_CORE,
+    },
+    .l3_cache = &(CPUCacheInfo) {
+        /* CPUID 0x4.0x3.EAX */
+        .type = UNIFIED_CACHE,
+        .level = 3,
+        .self_init = true,
+
+        /* CPUID 0x4.0x3.EBX */
+        .line_size = 64,
+        .partitions = 1,
+        .associativity = 16,
+
+        /* CPUID 0x4.0x3.ECX */
+        .sets = 8192,
+
+        /* CPUID 0x4.0x3.EDX */
+        .no_invd_sharing = true,
+        .inclusive = true,
+        .complex_indexing = false,
+
+        .size = 8 * MiB,
+        .share_level = CPU_TOPOLOGY_LEVEL_DIE,
+    },
+};
+
 /* The following VMX features are not supported by KVM and are left out in the
  * CPU definitions:
  *
@@ -6435,6 +6534,11 @@ static const X86CPUDefinition builtin_x86_defs[] = {
                     { /* end of list */ }
                 }
             },
+            {
+                .version = 3,
+                .note = "with the cache model",
+                .cache_info = &yongfeng_cache_info,
+            },
             { /* end of list */ }
         }
     },

From bf4032561447a518e9cc4af308ef1a15023bc4c6 Mon Sep 17 00:00:00 2001
From: Manish Mishra <manish.mishra@nutanix.com>
Date: Fri, 11 Jul 2025 18:45:59 +0800
Subject: [PATCH 2206/2760] i386/cpu: Add a "x-force-cpuid-0x1f" property

Add a "x-force-cpuid-0x1f" property so that CPU models can enable it and
have 0x1f CPUID leaf natually as the Host CPU.

The advantage is that when the CPU model's cache model is already
consistent with the Host CPU, for example, SRF defaults to l2 per
module & l3 per package, 0x1f can better help users identify the
topology in the VM.

Adding 0x1f for specific CPU models should not cause any trouble in
principle. This property is only enabled for CPU models that already
have 0x1f leaf on the Host, so software that originally runs normally on
the Host won't encounter issues in the Guest with corresponding CPU
model. Conversely, some software that relies on checking 0x1f might
have problems in the Guest due to the lack of 0x1f [*]. In
summary, adding 0x1f is also intended to further emulate the Host CPU
environment.

[*]: https://lore.kernel.org/qemu-devel/PH0PR02MB738410511BF51B12DB09BE6CF6AC2@PH0PR02MB7384.namprd02.prod.outlook.com/

Signed-off-by: Manish Mishra <manish.mishra@nutanix.com>
Co-authored-by: Xiaoyao Li <xiaoyao.li@intel.com>
Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
[Integrated and rebased 2 previous patches (ordered by post time)]
Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Tested-by: Yi Lai <yi1.lai@intel.com>
Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250711104603.1634832-6-zhao1.liu@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 40f3b5eac8..482979a443 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -9940,6 +9940,7 @@ static const Property x86_cpu_properties[] = {
     DEFINE_PROP_BOOL("x-intel-pt-auto-level", X86CPU, intel_pt_auto_level,
                      true),
     DEFINE_PROP_BOOL("x-l1-cache-per-thread", X86CPU, l1_cache_per_core, true),
+    DEFINE_PROP_BOOL("x-force-cpuid-0x1f", X86CPU, force_cpuid_0x1f, false),
 };
 
 #ifndef CONFIG_USER_ONLY

From e468c5e44435f5cbe1dd61099e6991a66c25988f Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Fri, 11 Jul 2025 18:46:00 +0800
Subject: [PATCH 2207/2760] i386/cpu: Enable 0x1f leaf for SierraForest by
 default

Host SierraForest CPU has 0x1f leaf by default, so that enable it for
Guest CPU by default as well.

Suggested-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Tested-by: Yi Lai <yi1.lai@intel.com>
Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250711104603.1634832-7-zhao1.liu@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 482979a443..668f3e63b7 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -5389,8 +5389,11 @@ static const X86CPUDefinition builtin_x86_defs[] = {
             },
             {
                 .version = 3,
-                .note = "with srf-sp cache model",
+                .note = "with srf-sp cache model and 0x1f leaf",
                 .cache_info = &xeon_srf_cache_info,
+                .props = (PropValue[]) {
+                    { "x-force-cpuid-0x1f", "on" },
+                }
             },
             { /* end of list */ },
         },

From af62bd3db0fde8aa132dd2a0d7dc620827ba1361 Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Fri, 11 Jul 2025 18:46:00 +0800
Subject: [PATCH 2208/2760] i386/cpu: Enable 0x1f leaf for SierraForest by
 default

Host SierraForest CPU has 0x1f leaf by default, so that enable it for
Guest CPU by default as well.

Suggested-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Tested-by: Yi Lai <yi1.lai@intel.com>
Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250711104603.1634832-7-zhao1.liu@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 668f3e63b7..c15082e8af 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -5393,6 +5393,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
                 .cache_info = &xeon_srf_cache_info,
                 .props = (PropValue[]) {
                     { "x-force-cpuid-0x1f", "on" },
+                    { /* end of list */ },
                 }
             },
             { /* end of list */ },

From 5dbdcdce06d9421598e84fa77692810ccc5c3a81 Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Fri, 11 Jul 2025 18:46:01 +0800
Subject: [PATCH 2209/2760] i386/cpu: Enable 0x1f leaf for GraniteRapids by
 default

Host GraniteRapids CPU has 0x1f leaf by default, so that enable it for
Guest CPU by default as well.

Suggested-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Tested-by: Yi Lai <yi1.lai@intel.com>
Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250711104603.1634832-8-zhao1.liu@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index c15082e8af..a11e9bb111 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -5239,8 +5239,12 @@ static const X86CPUDefinition builtin_x86_defs[] = {
             },
             {
                 .version = 3,
-                .note = "with gnr-sp cache model",
+                .note = "with gnr-sp cache model and 0x1f leaf",
                 .cache_info = &xeon_gnr_cache_info,
+                .props = (PropValue[]) {
+                    { "x-force-cpuid-0x1f", "on" },
+                    { /* end of list */ },
+                }
             },
             { /* end of list */ },
         },

From 1bf465f3e0a786bf3267931461c0c15fe6232bc8 Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Fri, 11 Jul 2025 18:46:02 +0800
Subject: [PATCH 2210/2760] i386/cpu: Enable 0x1f leaf for SapphireRapids by
 default

Host SapphireRapids CPU has 0x1f leaf by default, so that enable it for
Guest CPU by default as well.

Suggested-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Tested-by: Yi Lai <yi1.lai@intel.com>
Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250711104603.1634832-9-zhao1.liu@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index a11e9bb111..216e0232df 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -5081,8 +5081,12 @@ static const X86CPUDefinition builtin_x86_defs[] = {
             },
             {
                 .version = 4,
-                .note = "with spr-sp cache model",
+                .note = "with spr-sp cache model and 0x1f leaf",
                 .cache_info = &xeon_spr_cache_info,
+                .props = (PropValue[]) {
+                    { "x-force-cpuid-0x1f", "on" },
+                    { /* end of list */ },
+                }
             },
             { /* end of list */ }
         }

From 8113b7f0e662c138a4d0a739807cc3ad33bca8b3 Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Fri, 11 Jul 2025 18:46:03 +0800
Subject: [PATCH 2211/2760] i386/cpu: Enable 0x1f leaf for YongFeng by default

Host YongFeng CPU has 0x1f leaf by default, so that enable it for
Guest CPU by default as well.

Suggested-by: Ewan Hai <ewanhai-oc@zhaoxin.com>
Tested-by: Yi Lai <yi1.lai@intel.com>
Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250711104603.1634832-10-zhao1.liu@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 216e0232df..4f0c973446 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -6548,8 +6548,12 @@ static const X86CPUDefinition builtin_x86_defs[] = {
             },
             {
                 .version = 3,
-                .note = "with the cache model",
+                .note = "with the cache model and 0x1f leaf",
                 .cache_info = &yongfeng_cache_info,
+                .props = (PropValue[]) {
+                    { "x-force-cpuid-0x1f", "on" },
+                    { /* end of list */ },
+                }
             },
             { /* end of list */ }
         }

From ae1a6c6163bf2ad5889067a7ef121644249fade3 Mon Sep 17 00:00:00 2001
From: Thomas Lambertz <patch@thomaslambertz.de>
Date: Mon, 12 May 2025 23:50:10 +0200
Subject: [PATCH 2212/2760] hw/usb/dev-hid: Support side and extra mouse
 buttons for usb-tablet

The necessary plumbing for side- and extra mouse buttons to reach
usb-tablet is already done. But the descriptor advertises three buttons
max. Increase this to 5. Buttons are now identical to usb-mouse.

Signed-off-by: Thomas Lambertz <patch@thomaslambertz.de>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/usb/dev-hid.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/hw/usb/dev-hid.c b/hw/usb/dev-hid.c
index 54d064e54e..96623aa322 100644
--- a/hw/usb/dev-hid.c
+++ b/hw/usb/dev-hid.c
@@ -491,14 +491,14 @@ static const uint8_t qemu_tablet_hid_report_descriptor[] = {
     0xa1, 0x00,		/*   Collection (Physical) */
     0x05, 0x09,		/*     Usage Page (Button) */
     0x19, 0x01,		/*     Usage Minimum (1) */
-    0x29, 0x03,		/*     Usage Maximum (3) */
+    0x29, 0x05,		/*     Usage Maximum (5) */
     0x15, 0x00,		/*     Logical Minimum (0) */
     0x25, 0x01,		/*     Logical Maximum (1) */
-    0x95, 0x03,		/*     Report Count (3) */
+    0x95, 0x05,		/*     Report Count (5) */
     0x75, 0x01,		/*     Report Size (1) */
     0x81, 0x02,		/*     Input (Data, Variable, Absolute) */
     0x95, 0x01,		/*     Report Count (1) */
-    0x75, 0x05,		/*     Report Size (5) */
+    0x75, 0x03,		/*     Report Size (3) */
     0x81, 0x01,		/*     Input (Constant) */
     0x05, 0x01,		/*     Usage Page (Generic Desktop) */
     0x09, 0x30,		/*     Usage (X) */

From 7d6a775f17f1756f22a55cda847e9d7df93746ba Mon Sep 17 00:00:00 2001
From: Andrew Kreimer <algonell@gmail.com>
Date: Sun, 15 Jun 2025 17:33:03 +0300
Subject: [PATCH 2213/2760] docs: remove repeated word

The word 'find' appears twice, remove the extra one.

Signed-off-by: Andrew Kreimer <algonell@gmail.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 docs/system/introduction.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/system/introduction.rst b/docs/system/introduction.rst
index 338d3745c3..4cd46b5b8f 100644
--- a/docs/system/introduction.rst
+++ b/docs/system/introduction.rst
@@ -81,7 +81,7 @@ may not be optimal for modern systems.
 
 For a non-x86 system where we emulate a broad range of machine types,
 the command lines are generally more explicit in defining the machine
-and boot behaviour. You will find often find example command lines in
+and boot behaviour. You will often find example command lines in
 the :ref:`system-targets-ref` section of the manual.
 
 While the project doesn't want to discourage users from using the

From f180e367fce44b336105a11a62edf9610b6b2a06 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Wed, 2 Jul 2025 08:03:19 +0200
Subject: [PATCH 2214/2760] accel/kvm: Adjust the note about the minimum
 required kernel version
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since commit 126e7f78036 ("kvm: require KVM_CAP_IOEVENTFD and
KVM_CAP_IOEVENTFD_ANY_LENGTH") we require at least kernel 4.5 to
be able to use KVM. Adjust the upgrade_note accordingly.
While we're at it, remove the text about kvm-kmod and the
SourceForge URL since this is not actively maintained anymore.

Fixes: 126e7f78036 ("kvm: require KVM_CAP_IOEVENTFD and KVM_CAP_IOEVENTFD_ANY_LENGTH")
Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 accel/kvm/kvm-all.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index a106d1ba0f..78fc2d26fc 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -2606,8 +2606,7 @@ static int kvm_init(AccelState *as, MachineState *ms)
 {
     MachineClass *mc = MACHINE_GET_CLASS(ms);
     static const char upgrade_note[] =
-        "Please upgrade to at least kernel 2.6.29 or recent kvm-kmod\n"
-        "(see http://sourceforge.net/projects/kvm).\n";
+        "Please upgrade to at least kernel 4.5.\n";
     const struct {
         const char *name;
         int num;

From 3773ba281a3b8c3c75b9d9b614148b2356c328ac Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Wed, 2 Jul 2025 10:21:38 +0200
Subject: [PATCH 2215/2760] docs/system/target-i386: Remove the sentence about
 RHEL 7 being supported
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

According to our "Supported build platforms" policy, RHEL 7 is not
supported anymore, so let's remove the related sentence from the x86
documentation.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 docs/system/target-i386.rst | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/docs/system/target-i386.rst b/docs/system/target-i386.rst
index 43b09c79d6..2374391397 100644
--- a/docs/system/target-i386.rst
+++ b/docs/system/target-i386.rst
@@ -37,6 +37,4 @@ OS requirements
 ~~~~~~~~~~~~~~~
 
 On x86_64 hosts, the default set of CPU features enabled by the KVM
-accelerator require the host to be running Linux v4.5 or newer. Red Hat
-Enterprise Linux 7 is also supported, since the required
-functionality was backported.
+accelerator require the host to be running Linux v4.5 or newer.

From 21f4c5a700394878a6028708be480e73d8bea890 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Mon, 7 Jul 2025 15:24:12 +0100
Subject: [PATCH 2216/2760] hw/uefi: Create and use trace.h wrapper header
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The documentation of the trace subsystem (docs/devel/tracing.rst)
says that each subdirectory which uses trace events should create a
wrapper trace.h file which includes the trace/trace-foo.h generated
header, and that .c files then #include "trace.h".

We didn't follow this pattern in hw/uefi/.  Correct this by creating
and using the trace.h wrapper header.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/uefi/trace.h              | 2 ++
 hw/uefi/var-service-core.c   | 2 +-
 hw/uefi/var-service-policy.c | 2 +-
 hw/uefi/var-service-utils.c  | 2 +-
 hw/uefi/var-service-vars.c   | 2 +-
 5 files changed, 6 insertions(+), 4 deletions(-)
 create mode 100644 hw/uefi/trace.h

diff --git a/hw/uefi/trace.h b/hw/uefi/trace.h
new file mode 100644
index 0000000000..6aa1c93896
--- /dev/null
+++ b/hw/uefi/trace.h
@@ -0,0 +1,2 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+#include "trace/trace-hw_uefi.h"
diff --git a/hw/uefi/var-service-core.c b/hw/uefi/var-service-core.c
index 4836a0cb81..feec5a5958 100644
--- a/hw/uefi/var-service-core.c
+++ b/hw/uefi/var-service-core.c
@@ -12,7 +12,7 @@
 #include "hw/uefi/var-service-api.h"
 #include "hw/uefi/var-service-edk2.h"
 
-#include "trace/trace-hw_uefi.h"
+#include "trace.h"
 
 static int uefi_vars_pre_load(void *opaque)
 {
diff --git a/hw/uefi/var-service-policy.c b/hw/uefi/var-service-policy.c
index 3b1155fe4e..58da4adbeb 100644
--- a/hw/uefi/var-service-policy.c
+++ b/hw/uefi/var-service-policy.c
@@ -14,7 +14,7 @@
 #include "hw/uefi/var-service-api.h"
 #include "hw/uefi/var-service-edk2.h"
 
-#include "trace/trace-hw_uefi.h"
+#include "trace.h"
 
 static void calc_policy(uefi_var_policy *pol);
 
diff --git a/hw/uefi/var-service-utils.c b/hw/uefi/var-service-utils.c
index c9ef46570f..258013f436 100644
--- a/hw/uefi/var-service-utils.c
+++ b/hw/uefi/var-service-utils.c
@@ -8,7 +8,7 @@
 
 #include "hw/uefi/var-service.h"
 
-#include "trace/trace-hw_uefi.h"
+#include "trace.h"
 
 /* ------------------------------------------------------------------ */
 
diff --git a/hw/uefi/var-service-vars.c b/hw/uefi/var-service-vars.c
index 7f98d77a38..37d05b71cf 100644
--- a/hw/uefi/var-service-vars.c
+++ b/hw/uefi/var-service-vars.c
@@ -12,7 +12,7 @@
 #include "hw/uefi/var-service-api.h"
 #include "hw/uefi/var-service-edk2.h"
 
-#include "trace/trace-hw_uefi.h"
+#include "trace.h"
 
 #define EFI_VARIABLE_ATTRIBUTE_SUPPORTED                                \
     (EFI_VARIABLE_NON_VOLATILE |                                        \

From 0f55ca43cd90eb89193bae45d0907c1b17a1dadd Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Mon, 7 Jul 2025 15:49:17 +0100
Subject: [PATCH 2217/2760] docs/devel/tracing: Update trace.h creation rune to
 include SPDX

checkpatch now checks that new files have an SPDX line. If you use the
shell rune in tracing.rst to create a trace.h wrapper header, this
triggers checkpatch to complain.

Although these files are tiny, it's worth having the SPDX line to
avoid having to add extra exception cases to checkpatch.

Update the rune to include creating an SPDX line.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 docs/devel/tracing.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/devel/tracing.rst b/docs/devel/tracing.rst
index 043bed7fd0..f4557ee20e 100644
--- a/docs/devel/tracing.rst
+++ b/docs/devel/tracing.rst
@@ -76,7 +76,7 @@ The "io/trace.h" file must be created manually with an #include of the
 corresponding "trace/trace-<subdir>.h" file that will be generated in the
 builddir::
 
-  $ echo '#include "trace/trace-io.h"' >io/trace.h
+  $ (echo '/* SPDX-License-Identifier: GPL-2.0-or-later */' ; echo '#include "trace/trace-io.h"')  >io/trace.h
 
 While it is possible to include a trace.h file from outside a source file's own
 sub-directory, this is discouraged in general. It is strongly preferred that

From 110d0fa2d4d1f754242f6775baec43776a9adb35 Mon Sep 17 00:00:00 2001
From: Anastasia Belova <nabelova31@gmail.com>
Date: Mon, 2 Jun 2025 11:57:17 +0300
Subject: [PATCH 2218/2760] net: fix buffer overflow in af_xdp_umem_create()

s->pool has n_descs elements so maximum i should be
n_descs - 1. Fix the upper bound.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: cb039ef3d9 ("net: add initial support for AF_XDP network backend")
Cc: qemu-stable@nongnu.org
Reviewed-by: Ilya Maximets <i.maximets@ovn.org>
Signed-off-by: Anastasia Belova <nabelova31@gmail.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/af-xdp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/af-xdp.c b/net/af-xdp.c
index 01c5fb914e..d022534d76 100644
--- a/net/af-xdp.c
+++ b/net/af-xdp.c
@@ -323,7 +323,7 @@ static int af_xdp_umem_create(AFXDPState *s, int sock_fd, Error **errp)
 
     s->pool = g_new(uint64_t, n_descs);
     /* Fill the pool in the opposite order, because it's a LIFO queue. */
-    for (i = n_descs; i >= 0; i--) {
+    for (i = n_descs - 1; i >= 0; i--) {
         s->pool[i] = i * XSK_UMEM__DEFAULT_FRAME_SIZE;
     }
     s->n_pool = n_descs;

From adda0ad56bd28d5a809051cbd190fda5798ec4e4 Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <akihiko.odaki@daynix.com>
Date: Fri, 30 May 2025 14:18:53 +0900
Subject: [PATCH 2219/2760] virtio-net: Add queues for RSS during migration

virtio_net_pre_load_queues() inspects vdev->guest_features to tell if
VIRTIO_NET_F_RSS or VIRTIO_NET_F_MQ is enabled to infer the required
number of queues. This works for VIRTIO_NET_F_MQ but it doesn't for
VIRTIO_NET_F_RSS because only the lowest 32 bits of vdev->guest_features
is set at the point and VIRTIO_NET_F_RSS uses bit 60 while
VIRTIO_NET_F_MQ uses bit 22.

Instead of inferring the required number of queues from
vdev->guest_features, use the number loaded from the vm state. This
change also has a nice side effect to remove a duplicate peer queue
pair change by circumventing virtio_net_set_multiqueue().

Also update the comment in include/hw/virtio/virtio.h to prevent an
implementation of pre_load_queues() from refering to any fields being
loaded during migration by accident in the future.

Fixes: 8c49756825da ("virtio-net: Add only one queue pair when realizing")

Tested-by: Lei Yang <leiyang@redhat.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/virtio-net.c        | 11 ++++-------
 hw/virtio/virtio.c         | 14 +++++++-------
 include/hw/virtio/virtio.h | 10 ++++++++--
 3 files changed, 19 insertions(+), 16 deletions(-)

diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index eb93607b8c..351377c025 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -3022,11 +3022,10 @@ static void virtio_net_del_queue(VirtIONet *n, int index)
     virtio_del_queue(vdev, index * 2 + 1);
 }
 
-static void virtio_net_change_num_queue_pairs(VirtIONet *n, int new_max_queue_pairs)
+static void virtio_net_change_num_queues(VirtIONet *n, int new_num_queues)
 {
     VirtIODevice *vdev = VIRTIO_DEVICE(n);
     int old_num_queues = virtio_get_num_queues(vdev);
-    int new_num_queues = new_max_queue_pairs * 2 + 1;
     int i;
 
     assert(old_num_queues >= 3);
@@ -3062,16 +3061,14 @@ static void virtio_net_set_multiqueue(VirtIONet *n, int multiqueue)
     int max = multiqueue ? n->max_queue_pairs : 1;
 
     n->multiqueue = multiqueue;
-    virtio_net_change_num_queue_pairs(n, max);
+    virtio_net_change_num_queues(n, max * 2 + 1);
 
     virtio_net_set_queue_pairs(n);
 }
 
-static int virtio_net_pre_load_queues(VirtIODevice *vdev)
+static int virtio_net_pre_load_queues(VirtIODevice *vdev, uint32_t n)
 {
-    virtio_net_set_multiqueue(VIRTIO_NET(vdev),
-                              virtio_has_feature(vdev->guest_features, VIRTIO_NET_F_RSS) ||
-                              virtio_has_feature(vdev->guest_features, VIRTIO_NET_F_MQ));
+    virtio_net_change_num_queues(VIRTIO_NET(vdev), n);
 
     return 0;
 }
diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
index 82a285a31d..7e38b1ca97 100644
--- a/hw/virtio/virtio.c
+++ b/hw/virtio/virtio.c
@@ -3270,13 +3270,6 @@ virtio_load(VirtIODevice *vdev, QEMUFile *f, int version_id)
         config_len--;
     }
 
-    if (vdc->pre_load_queues) {
-        ret = vdc->pre_load_queues(vdev);
-        if (ret) {
-            return ret;
-        }
-    }
-
     num = qemu_get_be32(f);
 
     if (num > VIRTIO_QUEUE_MAX) {
@@ -3284,6 +3277,13 @@ virtio_load(VirtIODevice *vdev, QEMUFile *f, int version_id)
         return -1;
     }
 
+    if (vdc->pre_load_queues) {
+        ret = vdc->pre_load_queues(vdev, num);
+        if (ret) {
+            return ret;
+        }
+    }
+
     for (i = 0; i < num; i++) {
         vdev->vq[i].vring.num = qemu_get_be32(f);
         if (k->has_variable_vring_alignment) {
diff --git a/include/hw/virtio/virtio.h b/include/hw/virtio/virtio.h
index 214d4a77e9..c594764f23 100644
--- a/include/hw/virtio/virtio.h
+++ b/include/hw/virtio/virtio.h
@@ -210,8 +210,14 @@ struct VirtioDeviceClass {
     void (*guest_notifier_mask)(VirtIODevice *vdev, int n, bool mask);
     int (*start_ioeventfd)(VirtIODevice *vdev);
     void (*stop_ioeventfd)(VirtIODevice *vdev);
-    /* Called before loading queues. Useful to add queues before loading. */
-    int (*pre_load_queues)(VirtIODevice *vdev);
+    /*
+     * Called before loading queues.
+     * If the number of queues change at runtime, use @n to know the
+     * number and add or remove queues accordingly.
+     * Note that this function is called in the middle of loading vmsd;
+     * no assumption should be made on states being loaded from vmsd.
+     */
+    int (*pre_load_queues)(VirtIODevice *vdev, uint32_t n);
     /* Saving and loading of a device; trying to deprecate save/load
      * use vmsd for new devices.
      */

From adf684ce6908e2d2883946ffe1790c4ddfcf3ce0 Mon Sep 17 00:00:00 2001
From: Laurent Vivier <lvivier@redhat.com>
Date: Wed, 9 Jul 2025 10:24:15 +0200
Subject: [PATCH 2220/2760] net: Refactor stream logic for reuse in '-net
 passt'

To prepare for the implementation of '-net passt', this patch moves
the generic stream handling functions from net/stream.c into new
net/stream_data.c and net/stream_data.h files.

This refactoring introduces a NetStreamData struct that encapsulates
the generic fields and logic previously in NetStreamState. The
NetStreamState now embeds NetStreamData and delegates the core
stream operations to the new generic functions.

To maintain flexibility for different users of this generic code,
callbacks for send and listen operations are now passed via
function pointers within the NetStreamData struct. This allows
callers to provide their own specific implementations while reusing
the common connection and data transfer logic.

Signed-off-by: Laurent Vivier <lvivier@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/meson.build   |   3 +-
 net/stream.c      | 282 +++++++++++-----------------------------------
 net/stream_data.c | 193 +++++++++++++++++++++++++++++++
 net/stream_data.h |  31 +++++
 4 files changed, 290 insertions(+), 219 deletions(-)
 create mode 100644 net/stream_data.c
 create mode 100644 net/stream_data.h

diff --git a/net/meson.build b/net/meson.build
index bb97b4dcbe..bb3c011e5a 100644
--- a/net/meson.build
+++ b/net/meson.build
@@ -1,6 +1,7 @@
 system_ss.add(files(
   'announce.c',
   'checksum.c',
+  'dgram.c',
   'dump.c',
   'eth.c',
   'filter-buffer.c',
@@ -12,7 +13,7 @@ system_ss.add(files(
   'queue.c',
   'socket.c',
   'stream.c',
-  'dgram.c',
+  'stream_data.c',
   'util.c',
 ))
 
diff --git a/net/stream.c b/net/stream.c
index 6152d2a05e..d893f02cab 100644
--- a/net/stream.c
+++ b/net/stream.c
@@ -27,173 +27,50 @@
 
 #include "net/net.h"
 #include "clients.h"
-#include "monitor/monitor.h"
 #include "qapi/error.h"
-#include "qemu/error-report.h"
-#include "qemu/option.h"
-#include "qemu/sockets.h"
-#include "qemu/iov.h"
-#include "qemu/main-loop.h"
-#include "qemu/cutils.h"
-#include "io/channel.h"
-#include "io/channel-socket.h"
 #include "io/net-listener.h"
 #include "qapi/qapi-events-net.h"
 #include "qapi/qapi-visit-sockets.h"
 #include "qapi/clone-visitor.h"
 
+#include "stream_data.h"
+
 typedef struct NetStreamState {
-    NetClientState nc;
-    QIOChannel *listen_ioc;
-    QIONetListener *listener;
-    QIOChannel *ioc;
-    guint ioc_read_tag;
-    guint ioc_write_tag;
-    SocketReadState rs;
-    unsigned int send_index;      /* number of bytes sent*/
+    NetStreamData data;
     uint32_t reconnect_ms;
     guint timer_tag;
     SocketAddress *addr;
 } NetStreamState;
 
-static void net_stream_listen(QIONetListener *listener,
-                              QIOChannelSocket *cioc,
-                              void *opaque);
 static void net_stream_arm_reconnect(NetStreamState *s);
 
-static gboolean net_stream_writable(QIOChannel *ioc,
-                                    GIOCondition condition,
-                                    gpointer data)
-{
-    NetStreamState *s = data;
-
-    s->ioc_write_tag = 0;
-
-    qemu_flush_queued_packets(&s->nc);
-
-    return G_SOURCE_REMOVE;
-}
-
 static ssize_t net_stream_receive(NetClientState *nc, const uint8_t *buf,
                                   size_t size)
 {
-    NetStreamState *s = DO_UPCAST(NetStreamState, nc, nc);
-    uint32_t len = htonl(size);
-    struct iovec iov[] = {
-        {
-            .iov_base = &len,
-            .iov_len  = sizeof(len),
-        }, {
-            .iov_base = (void *)buf,
-            .iov_len  = size,
-        },
-    };
-    struct iovec local_iov[2];
-    unsigned int nlocal_iov;
-    size_t remaining;
-    ssize_t ret;
+    NetStreamData *d = DO_UPCAST(NetStreamData, nc, nc);
 
-    remaining = iov_size(iov, 2) - s->send_index;
-    nlocal_iov = iov_copy(local_iov, 2, iov, 2, s->send_index, remaining);
-    ret = qio_channel_writev(s->ioc, local_iov, nlocal_iov, NULL);
-    if (ret == QIO_CHANNEL_ERR_BLOCK) {
-        ret = 0; /* handled further down */
-    }
-    if (ret == -1) {
-        s->send_index = 0;
-        return -errno;
-    }
-    if (ret < (ssize_t)remaining) {
-        s->send_index += ret;
-        s->ioc_write_tag = qio_channel_add_watch(s->ioc, G_IO_OUT,
-                                                 net_stream_writable, s, NULL);
-        return 0;
-    }
-    s->send_index = 0;
-    return size;
-}
-
-static gboolean net_stream_send(QIOChannel *ioc,
-                                GIOCondition condition,
-                                gpointer data);
-
-static void net_stream_send_completed(NetClientState *nc, ssize_t len)
-{
-    NetStreamState *s = DO_UPCAST(NetStreamState, nc, nc);
-
-    if (!s->ioc_read_tag) {
-        s->ioc_read_tag = qio_channel_add_watch(s->ioc, G_IO_IN,
-                                                net_stream_send, s, NULL);
-    }
-}
-
-static void net_stream_rs_finalize(SocketReadState *rs)
-{
-    NetStreamState *s = container_of(rs, NetStreamState, rs);
-
-    if (qemu_send_packet_async(&s->nc, rs->buf,
-                               rs->packet_len,
-                               net_stream_send_completed) == 0) {
-        if (s->ioc_read_tag) {
-            g_source_remove(s->ioc_read_tag);
-            s->ioc_read_tag = 0;
-        }
-    }
+    return net_stream_data_receive(d, buf, size);
 }
 
 static gboolean net_stream_send(QIOChannel *ioc,
                                 GIOCondition condition,
                                 gpointer data)
 {
-    NetStreamState *s = data;
-    int size;
-    int ret;
-    QEMU_UNINITIALIZED char buf1[NET_BUFSIZE];
-    const char *buf;
+    if (net_stream_data_send(ioc, condition, data) == G_SOURCE_REMOVE) {
+        NetStreamState *s = DO_UPCAST(NetStreamState, data, data);
 
-    size = qio_channel_read(s->ioc, buf1, sizeof(buf1), NULL);
-    if (size < 0) {
-        if (errno != EWOULDBLOCK) {
-            goto eoc;
-        }
-    } else if (size == 0) {
-        /* end of connection */
-    eoc:
-        s->ioc_read_tag = 0;
-        if (s->ioc_write_tag) {
-            g_source_remove(s->ioc_write_tag);
-            s->ioc_write_tag = 0;
-        }
-        if (s->listener) {
-            qemu_set_info_str(&s->nc, "listening");
-            qio_net_listener_set_client_func(s->listener, net_stream_listen,
-                                             s, NULL);
-        }
-        object_unref(OBJECT(s->ioc));
-        s->ioc = NULL;
-
-        net_socket_rs_init(&s->rs, net_stream_rs_finalize, false);
-        s->nc.link_down = true;
-
-        qapi_event_send_netdev_stream_disconnected(s->nc.name);
+        qapi_event_send_netdev_stream_disconnected(s->data.nc.name);
         net_stream_arm_reconnect(s);
 
         return G_SOURCE_REMOVE;
     }
-    buf = buf1;
-
-    ret = net_fill_rstate(&s->rs, (const uint8_t *)buf, size);
-
-    if (ret == -1) {
-        goto eoc;
-    }
 
     return G_SOURCE_CONTINUE;
 }
 
 static void net_stream_cleanup(NetClientState *nc)
 {
-    NetStreamState *s = DO_UPCAST(NetStreamState, nc, nc);
+    NetStreamState *s = DO_UPCAST(NetStreamState, data.nc, nc);
     if (s->timer_tag) {
         g_source_remove(s->timer_tag);
         s->timer_tag = 0;
@@ -202,28 +79,28 @@ static void net_stream_cleanup(NetClientState *nc)
         qapi_free_SocketAddress(s->addr);
         s->addr = NULL;
     }
-    if (s->ioc) {
-        if (QIO_CHANNEL_SOCKET(s->ioc)->fd != -1) {
-            if (s->ioc_read_tag) {
-                g_source_remove(s->ioc_read_tag);
-                s->ioc_read_tag = 0;
+    if (s->data.ioc) {
+        if (QIO_CHANNEL_SOCKET(s->data.ioc)->fd != -1) {
+            if (s->data.ioc_read_tag) {
+                g_source_remove(s->data.ioc_read_tag);
+                s->data.ioc_read_tag = 0;
             }
-            if (s->ioc_write_tag) {
-                g_source_remove(s->ioc_write_tag);
-                s->ioc_write_tag = 0;
+            if (s->data.ioc_write_tag) {
+                g_source_remove(s->data.ioc_write_tag);
+                s->data.ioc_write_tag = 0;
             }
         }
-        object_unref(OBJECT(s->ioc));
-        s->ioc = NULL;
+        object_unref(OBJECT(s->data.ioc));
+        s->data.ioc = NULL;
     }
-    if (s->listen_ioc) {
-        if (s->listener) {
-            qio_net_listener_disconnect(s->listener);
-            object_unref(OBJECT(s->listener));
-            s->listener = NULL;
+    if (s->data.listen_ioc) {
+        if (s->data.listener) {
+            qio_net_listener_disconnect(s->data.listener);
+            object_unref(OBJECT(s->data.listener));
+            s->data.listener = NULL;
         }
-        object_unref(OBJECT(s->listen_ioc));
-        s->listen_ioc = NULL;
+        object_unref(OBJECT(s->data.listen_ioc));
+        s->data.listen_ioc = NULL;
     }
 }
 
@@ -235,23 +112,13 @@ static NetClientInfo net_stream_info = {
 };
 
 static void net_stream_listen(QIONetListener *listener,
-                              QIOChannelSocket *cioc,
-                              void *opaque)
+                                  QIOChannelSocket *cioc, gpointer data)
 {
-    NetStreamState *s = opaque;
+    NetStreamData *d = data;
     SocketAddress *addr;
     char *uri;
 
-    object_ref(OBJECT(cioc));
-
-    qio_net_listener_set_client_func(s->listener, NULL, s, NULL);
-
-    s->ioc = QIO_CHANNEL(cioc);
-    qio_channel_set_name(s->ioc, "stream-server");
-    s->nc.link_down = false;
-
-    s->ioc_read_tag = qio_channel_add_watch(s->ioc, G_IO_IN, net_stream_send,
-                                            s, NULL);
+    net_stream_data_listen(listener, cioc, data);
 
     if (cioc->localAddr.ss_family == AF_UNIX) {
         addr = qio_channel_socket_get_local_address(cioc, NULL);
@@ -260,22 +127,22 @@ static void net_stream_listen(QIONetListener *listener,
     }
     g_assert(addr != NULL);
     uri = socket_uri(addr);
-    qemu_set_info_str(&s->nc, "%s", uri);
+    qemu_set_info_str(&d->nc, "%s", uri);
     g_free(uri);
-    qapi_event_send_netdev_stream_connected(s->nc.name, addr);
+    qapi_event_send_netdev_stream_connected(d->nc.name, addr);
     qapi_free_SocketAddress(addr);
 }
 
 static void net_stream_server_listening(QIOTask *task, gpointer opaque)
 {
-    NetStreamState *s = opaque;
-    QIOChannelSocket *listen_sioc = QIO_CHANNEL_SOCKET(s->listen_ioc);
+    NetStreamData *d = opaque;
+    QIOChannelSocket *listen_sioc = QIO_CHANNEL_SOCKET(d->listen_ioc);
     SocketAddress *addr;
     int ret;
     Error *err = NULL;
 
     if (qio_task_propagate_error(task, &err)) {
-        qemu_set_info_str(&s->nc, "error: %s", error_get_pretty(err));
+        qemu_set_info_str(&d->nc, "error: %s", error_get_pretty(err));
         error_free(err);
         return;
     }
@@ -284,20 +151,21 @@ static void net_stream_server_listening(QIOTask *task, gpointer opaque)
     g_assert(addr != NULL);
     ret = qemu_socket_try_set_nonblock(listen_sioc->fd);
     if (addr->type == SOCKET_ADDRESS_TYPE_FD && ret < 0) {
-        qemu_set_info_str(&s->nc, "can't use file descriptor %s (errno %d)",
+        qemu_set_info_str(&d->nc, "can't use file descriptor %s (errno %d)",
                           addr->u.fd.str, -ret);
         return;
     }
     g_assert(ret == 0);
     qapi_free_SocketAddress(addr);
 
-    s->nc.link_down = true;
-    s->listener = qio_net_listener_new();
+    d->nc.link_down = true;
+    d->listener = qio_net_listener_new();
 
-    qemu_set_info_str(&s->nc, "listening");
-    net_socket_rs_init(&s->rs, net_stream_rs_finalize, false);
-    qio_net_listener_set_client_func(s->listener, net_stream_listen, s, NULL);
-    qio_net_listener_add(s->listener, listen_sioc);
+    qemu_set_info_str(&d->nc, "listening");
+    net_socket_rs_init(&d->rs, net_stream_data_rs_finalize, false);
+    qio_net_listener_set_client_func(d->listener, d->listen, d,
+                                     NULL);
+    qio_net_listener_add(d->listener, listen_sioc);
 }
 
 static int net_stream_server_init(NetClientState *peer,
@@ -307,16 +175,18 @@ static int net_stream_server_init(NetClientState *peer,
                                   Error **errp)
 {
     NetClientState *nc;
-    NetStreamState *s;
+    NetStreamData *d;
     QIOChannelSocket *listen_sioc = qio_channel_socket_new();
 
     nc = qemu_new_net_client(&net_stream_info, peer, model, name);
-    s = DO_UPCAST(NetStreamState, nc, nc);
-    qemu_set_info_str(&s->nc, "initializing");
+    d = DO_UPCAST(NetStreamData, nc, nc);
+    d->send = net_stream_send;
+    d->listen = net_stream_listen;
+    qemu_set_info_str(&d->nc, "initializing");
 
-    s->listen_ioc = QIO_CHANNEL(listen_sioc);
+    d->listen_ioc = QIO_CHANNEL(listen_sioc);
     qio_channel_socket_listen_async(listen_sioc, addr, 0,
-                                    net_stream_server_listening, s,
+                                    net_stream_server_listening, d,
                                     NULL, NULL);
 
     return 0;
@@ -325,49 +195,23 @@ static int net_stream_server_init(NetClientState *peer,
 static void net_stream_client_connected(QIOTask *task, gpointer opaque)
 {
     NetStreamState *s = opaque;
-    QIOChannelSocket *sioc = QIO_CHANNEL_SOCKET(s->ioc);
+    NetStreamData *d = &s->data;
+    QIOChannelSocket *sioc = QIO_CHANNEL_SOCKET(d->ioc);
     SocketAddress *addr;
     gchar *uri;
-    int ret;
-    Error *err = NULL;
 
-    if (qio_task_propagate_error(task, &err)) {
-        qemu_set_info_str(&s->nc, "error: %s", error_get_pretty(err));
-        error_free(err);
-        goto error;
+    if (net_stream_data_client_connected(task, d) == -1) {
+        net_stream_arm_reconnect(s);
+        return;
     }
 
     addr = qio_channel_socket_get_remote_address(sioc, NULL);
     g_assert(addr != NULL);
     uri = socket_uri(addr);
-    qemu_set_info_str(&s->nc, "%s", uri);
+    qemu_set_info_str(&d->nc, "%s", uri);
     g_free(uri);
-
-    ret = qemu_socket_try_set_nonblock(sioc->fd);
-    if (addr->type == SOCKET_ADDRESS_TYPE_FD && ret < 0) {
-        qemu_set_info_str(&s->nc, "can't use file descriptor %s (errno %d)",
-                          addr->u.fd.str, -ret);
-        qapi_free_SocketAddress(addr);
-        goto error;
-    }
-    g_assert(ret == 0);
-
-    net_socket_rs_init(&s->rs, net_stream_rs_finalize, false);
-
-    /* Disable Nagle algorithm on TCP sockets to reduce latency */
-    qio_channel_set_delay(s->ioc, false);
-
-    s->ioc_read_tag = qio_channel_add_watch(s->ioc, G_IO_IN, net_stream_send,
-                                            s, NULL);
-    s->nc.link_down = false;
-    qapi_event_send_netdev_stream_connected(s->nc.name, addr);
+    qapi_event_send_netdev_stream_connected(d->nc.name, addr);
     qapi_free_SocketAddress(addr);
-
-    return;
-error:
-    object_unref(OBJECT(s->ioc));
-    s->ioc = NULL;
-    net_stream_arm_reconnect(s);
 }
 
 static gboolean net_stream_reconnect(gpointer data)
@@ -378,7 +222,7 @@ static gboolean net_stream_reconnect(gpointer data)
     s->timer_tag = 0;
 
     sioc = qio_channel_socket_new();
-    s->ioc = QIO_CHANNEL(sioc);
+    s->data.ioc = QIO_CHANNEL(sioc);
     qio_channel_socket_connect_async(sioc, s->addr,
                                      net_stream_client_connected, s,
                                      NULL, NULL);
@@ -388,7 +232,7 @@ static gboolean net_stream_reconnect(gpointer data)
 static void net_stream_arm_reconnect(NetStreamState *s)
 {
     if (s->reconnect_ms && s->timer_tag == 0) {
-        qemu_set_info_str(&s->nc, "connecting");
+        qemu_set_info_str(&s->data.nc, "connecting");
         s->timer_tag = g_timeout_add(s->reconnect_ms, net_stream_reconnect, s);
     }
 }
@@ -405,11 +249,13 @@ static int net_stream_client_init(NetClientState *peer,
     QIOChannelSocket *sioc = qio_channel_socket_new();
 
     nc = qemu_new_net_client(&net_stream_info, peer, model, name);
-    s = DO_UPCAST(NetStreamState, nc, nc);
-    qemu_set_info_str(&s->nc, "connecting");
+    s = DO_UPCAST(NetStreamState, data.nc, nc);
+    qemu_set_info_str(&s->data.nc, "connecting");
 
-    s->ioc = QIO_CHANNEL(sioc);
-    s->nc.link_down = true;
+    s->data.ioc = QIO_CHANNEL(sioc);
+    s->data.nc.link_down = true;
+    s->data.send = net_stream_send;
+    s->data.listen = net_stream_listen;
 
     s->reconnect_ms = reconnect_ms;
     if (reconnect_ms) {
diff --git a/net/stream_data.c b/net/stream_data.c
new file mode 100644
index 0000000000..5af27e0d1d
--- /dev/null
+++ b/net/stream_data.c
@@ -0,0 +1,193 @@
+/*
+ * net stream generic functions
+ *
+ * Copyright Red Hat
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/iov.h"
+#include "qapi/error.h"
+#include "net/net.h"
+#include "io/channel.h"
+#include "io/net-listener.h"
+
+#include "stream_data.h"
+
+static gboolean net_stream_data_writable(QIOChannel *ioc,
+                                         GIOCondition condition, gpointer data)
+{
+    NetStreamData *d = data;
+
+    d->ioc_write_tag = 0;
+
+    qemu_flush_queued_packets(&d->nc);
+
+    return G_SOURCE_REMOVE;
+}
+
+ssize_t net_stream_data_receive(NetStreamData *d, const uint8_t *buf,
+                                size_t size)
+{
+    uint32_t len = htonl(size);
+    struct iovec iov[] = {
+        {
+            .iov_base = &len,
+            .iov_len  = sizeof(len),
+        }, {
+            .iov_base = (void *)buf,
+            .iov_len  = size,
+        },
+    };
+    struct iovec local_iov[2];
+    unsigned int nlocal_iov;
+    size_t remaining;
+    ssize_t ret;
+
+    remaining = iov_size(iov, 2) - d->send_index;
+    nlocal_iov = iov_copy(local_iov, 2, iov, 2, d->send_index, remaining);
+    ret = qio_channel_writev(d->ioc, local_iov, nlocal_iov, NULL);
+    if (ret == QIO_CHANNEL_ERR_BLOCK) {
+        ret = 0; /* handled further down */
+    }
+    if (ret == -1) {
+        d->send_index = 0;
+        return -errno;
+    }
+    if (ret < (ssize_t)remaining) {
+        d->send_index += ret;
+        d->ioc_write_tag = qio_channel_add_watch(d->ioc, G_IO_OUT,
+                                                 net_stream_data_writable, d,
+                                                 NULL);
+        return 0;
+    }
+    d->send_index = 0;
+    return size;
+}
+
+static void net_stream_data_send_completed(NetClientState *nc, ssize_t len)
+{
+    NetStreamData *d = DO_UPCAST(NetStreamData, nc, nc);
+
+    if (!d->ioc_read_tag) {
+        d->ioc_read_tag = qio_channel_add_watch(d->ioc, G_IO_IN, d->send, d,
+                                                NULL);
+    }
+}
+
+void net_stream_data_rs_finalize(SocketReadState *rs)
+{
+    NetStreamData *d = container_of(rs, NetStreamData, rs);
+
+    if (qemu_send_packet_async(&d->nc, rs->buf,
+                               rs->packet_len,
+                               net_stream_data_send_completed) == 0) {
+        if (d->ioc_read_tag) {
+            g_source_remove(d->ioc_read_tag);
+            d->ioc_read_tag = 0;
+        }
+    }
+}
+
+gboolean net_stream_data_send(QIOChannel *ioc, GIOCondition condition,
+                              NetStreamData *d)
+{
+    int size;
+    int ret;
+    QEMU_UNINITIALIZED char buf1[NET_BUFSIZE];
+    const char *buf;
+
+    size = qio_channel_read(d->ioc, buf1, sizeof(buf1), NULL);
+    if (size < 0) {
+        if (errno != EWOULDBLOCK) {
+            goto eoc;
+        }
+    } else if (size == 0) {
+        /* end of connection */
+    eoc:
+        d->ioc_read_tag = 0;
+        if (d->ioc_write_tag) {
+            g_source_remove(d->ioc_write_tag);
+            d->ioc_write_tag = 0;
+        }
+        if (d->listener) {
+            qemu_set_info_str(&d->nc, "listening");
+            qio_net_listener_set_client_func(d->listener,
+                                             d->listen, d, NULL);
+        }
+        object_unref(OBJECT(d->ioc));
+        d->ioc = NULL;
+
+        net_socket_rs_init(&d->rs, net_stream_data_rs_finalize, false);
+        d->nc.link_down = true;
+
+        return G_SOURCE_REMOVE;
+    }
+    buf = buf1;
+
+    ret = net_fill_rstate(&d->rs, (const uint8_t *)buf, size);
+
+    if (ret == -1) {
+        goto eoc;
+    }
+
+    return G_SOURCE_CONTINUE;
+}
+
+void net_stream_data_listen(QIONetListener *listener,
+                            QIOChannelSocket *cioc,
+                            NetStreamData *d)
+{
+    object_ref(OBJECT(cioc));
+
+    qio_net_listener_set_client_func(d->listener, NULL, d, NULL);
+
+    d->ioc = QIO_CHANNEL(cioc);
+    qio_channel_set_name(d->ioc, "stream-server");
+    d->nc.link_down = false;
+
+    d->ioc_read_tag = qio_channel_add_watch(d->ioc, G_IO_IN, d->send, d, NULL);
+}
+
+int net_stream_data_client_connected(QIOTask *task, NetStreamData *d)
+{
+    QIOChannelSocket *sioc = QIO_CHANNEL_SOCKET(d->ioc);
+    SocketAddress *addr;
+    int ret;
+    Error *err = NULL;
+
+    if (qio_task_propagate_error(task, &err)) {
+        qemu_set_info_str(&d->nc, "error: %s", error_get_pretty(err));
+        error_free(err);
+        goto error;
+    }
+
+    addr = qio_channel_socket_get_remote_address(sioc, NULL);
+    g_assert(addr != NULL);
+
+    ret = qemu_socket_try_set_nonblock(sioc->fd);
+    if (addr->type == SOCKET_ADDRESS_TYPE_FD && ret < 0) {
+        qemu_set_info_str(&d->nc, "can't use file descriptor %s (errno %d)",
+                          addr->u.fd.str, -ret);
+        qapi_free_SocketAddress(addr);
+        goto error;
+    }
+    g_assert(ret == 0);
+    qapi_free_SocketAddress(addr);
+
+    net_socket_rs_init(&d->rs, net_stream_data_rs_finalize, false);
+
+    /* Disable Nagle algorithm on TCP sockets to reduce latency */
+    qio_channel_set_delay(d->ioc, false);
+
+    d->ioc_read_tag = qio_channel_add_watch(d->ioc, G_IO_IN, d->send, d, NULL);
+    d->nc.link_down = false;
+
+    return 0;
+error:
+    object_unref(OBJECT(d->ioc));
+    d->ioc = NULL;
+
+    return -1;
+}
diff --git a/net/stream_data.h b/net/stream_data.h
new file mode 100644
index 0000000000..b868625665
--- /dev/null
+++ b/net/stream_data.h
@@ -0,0 +1,31 @@
+/*
+ * net stream generic functions
+ *
+ * Copyright Red Hat
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+typedef struct NetStreamData {
+    NetClientState nc;
+    QIOChannel *ioc;
+    guint ioc_read_tag;
+    guint ioc_write_tag;
+    SocketReadState rs;
+    unsigned int send_index;      /* number of bytes sent*/
+    QIOChannelFunc send;
+    /* server data */
+    QIOChannel *listen_ioc;
+    QIONetListener *listener;
+    QIONetListenerClientFunc listen;
+} NetStreamData;
+
+ssize_t net_stream_data_receive(NetStreamData *d, const uint8_t *buf,
+                                size_t size);
+void net_stream_data_rs_finalize(SocketReadState *rs);
+gboolean net_stream_data_send(QIOChannel *ioc, GIOCondition condition,
+                              NetStreamData *d);
+int net_stream_data_client_connected(QIOTask *task, NetStreamData *d);
+void net_stream_data_listen(QIONetListener *listener,
+                            QIOChannelSocket *cioc,
+                            NetStreamData *d);

From 9b5b45c7173b0447ec19aed4b901fd22db83d7eb Mon Sep 17 00:00:00 2001
From: Laurent Vivier <lvivier@redhat.com>
Date: Wed, 9 Jul 2025 10:24:16 +0200
Subject: [PATCH 2221/2760] net: Define net_client_set_link()

The code to set the link status is currently located in
qmp_set_link(). This function identifies the device by name,
searches for the corresponding NetClientState, and then updates
the link status.

In some parts of the code, such as vhost-user.c, the
NetClientState are already available. Calling qmp_set_link()
from these locations leads to a redundant search for the clients.

This patch refactors the logic by introducing a new function,
net_client_set_link(), which accepts a NetClientState array
directly. qmp_set_link() is simplified to be a wrapper that
performs the client search and then calls the new function.
The vhost-user implementation is updated to use net_client_set_link()
directly, thereby eliminating the unnecessary client lookup.

Signed-off-by: Laurent Vivier <lvivier@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 include/net/net.h |  1 +
 net/net.c         | 32 ++++++++++++++++++++------------
 net/vhost-user.c  |  4 ++--
 3 files changed, 23 insertions(+), 14 deletions(-)

diff --git a/include/net/net.h b/include/net/net.h
index cdd5b109b0..ac59b593ba 100644
--- a/include/net/net.h
+++ b/include/net/net.h
@@ -298,6 +298,7 @@ void net_client_parse(QemuOptsList *opts_list, const char *optstr);
 void show_netdevs(void);
 void net_init_clients(void);
 void net_check_clients(void);
+void net_client_set_link(NetClientState **ncs, int queues, bool up);
 void net_cleanup(void);
 void hmp_host_net_add(Monitor *mon, const QDict *qdict);
 void hmp_host_net_remove(Monitor *mon, const QDict *qdict);
diff --git a/net/net.c b/net/net.c
index 39d6f28158..cfa2d8e958 100644
--- a/net/net.c
+++ b/net/net.c
@@ -1601,21 +1601,11 @@ void colo_notify_filters_event(int event, Error **errp)
     }
 }
 
-void qmp_set_link(const char *name, bool up, Error **errp)
+void net_client_set_link(NetClientState **ncs, int queues, bool up)
 {
-    NetClientState *ncs[MAX_QUEUE_NUM];
     NetClientState *nc;
-    int queues, i;
+    int i;
 
-    queues = qemu_find_net_clients_except(name, ncs,
-                                          NET_CLIENT_DRIVER__MAX,
-                                          MAX_QUEUE_NUM);
-
-    if (queues == 0) {
-        error_set(errp, ERROR_CLASS_DEVICE_NOT_FOUND,
-                  "Device '%s' not found", name);
-        return;
-    }
     nc = ncs[0];
 
     for (i = 0; i < queues; i++) {
@@ -1646,6 +1636,24 @@ void qmp_set_link(const char *name, bool up, Error **errp)
     }
 }
 
+void qmp_set_link(const char *name, bool up, Error **errp)
+{
+    NetClientState *ncs[MAX_QUEUE_NUM];
+    int queues;
+
+    queues = qemu_find_net_clients_except(name, ncs,
+                                          NET_CLIENT_DRIVER__MAX,
+                                          MAX_QUEUE_NUM);
+
+    if (queues == 0) {
+        error_set(errp, ERROR_CLASS_DEVICE_NOT_FOUND,
+                  "Device '%s' not found", name);
+        return;
+    }
+
+    net_client_set_link(ncs, queues, up);
+}
+
 static void net_vm_change_state_handler(void *opaque, bool running,
                                         RunState state)
 {
diff --git a/net/vhost-user.c b/net/vhost-user.c
index 0b235e50c6..10ac8dc0b3 100644
--- a/net/vhost-user.c
+++ b/net/vhost-user.c
@@ -264,7 +264,7 @@ static void chr_closed_bh(void *opaque)
         vhost_user_save_acked_features(ncs[i]);
     }
 
-    qmp_set_link(name, false, &err);
+    net_client_set_link(ncs, queues, false);
 
     qemu_chr_fe_set_handlers(&s->chr, NULL, NULL, net_vhost_user_event,
                              NULL, opaque, NULL, true);
@@ -300,7 +300,7 @@ static void net_vhost_user_event(void *opaque, QEMUChrEvent event)
         }
         s->watch = qemu_chr_fe_add_watch(&s->chr, G_IO_HUP,
                                          net_vhost_user_watch, s);
-        qmp_set_link(name, true, &err);
+        net_client_set_link(ncs, queues, true);
         s->started = true;
         qapi_event_send_netdev_vhost_user_connected(name, chr->label);
         break;

From 7136352b40631b058dd0fe731a0d404e761e799f Mon Sep 17 00:00:00 2001
From: Laurent Vivier <lvivier@redhat.com>
Date: Wed, 9 Jul 2025 10:24:17 +0200
Subject: [PATCH 2222/2760] vhost_net: Rename vhost_set_vring_enable() for
 clarity

This is a cosmetic change with no functional impact.

The function vhost_set_vring_enable() is specific to vhost_net and
is used outside of vhost_net.c (specifically, in
hw/net/virtio-net.c). To prevent confusion with other similarly named
vhost functions, such as the one found in cryptodev-vhost.c, it has
been renamed to vhost_net_set_vring_enable(). This clarifies that the
function belongs to the vhost_net module.

Signed-off-by: Laurent Vivier <lvivier@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/vhost_net-stub.c | 2 +-
 hw/net/vhost_net.c      | 4 ++--
 hw/net/virtio-net.c     | 4 ++--
 include/net/vhost_net.h | 2 +-
 4 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/hw/net/vhost_net-stub.c b/hw/net/vhost_net-stub.c
index 72df6d757e..7bed0bf92b 100644
--- a/hw/net/vhost_net-stub.c
+++ b/hw/net/vhost_net-stub.c
@@ -101,7 +101,7 @@ VHostNetState *get_vhost_net(NetClientState *nc)
     return 0;
 }
 
-int vhost_set_vring_enable(NetClientState *nc, int enable)
+int vhost_net_set_vring_enable(NetClientState *nc, int enable)
 {
     return 0;
 }
diff --git a/hw/net/vhost_net.c b/hw/net/vhost_net.c
index 891f235a0a..cb87056397 100644
--- a/hw/net/vhost_net.c
+++ b/hw/net/vhost_net.c
@@ -551,7 +551,7 @@ int vhost_net_start(VirtIODevice *dev, NetClientState *ncs,
 
         if (peer->vring_enable) {
             /* restore vring enable state */
-            r = vhost_set_vring_enable(peer, peer->vring_enable);
+            r = vhost_net_set_vring_enable(peer, peer->vring_enable);
 
             if (r < 0) {
                 goto err_guest_notifiers;
@@ -686,7 +686,7 @@ VHostNetState *get_vhost_net(NetClientState *nc)
     return vhost_net;
 }
 
-int vhost_set_vring_enable(NetClientState *nc, int enable)
+int vhost_net_set_vring_enable(NetClientState *nc, int enable)
 {
     VHostNetState *net = get_vhost_net(nc);
     const VhostOps *vhost_ops = net->dev.vhost_ops;
diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index 351377c025..e3400f18c8 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -697,7 +697,7 @@ static int peer_attach(VirtIONet *n, int index)
     }
 
     if (nc->peer->info->type == NET_CLIENT_DRIVER_VHOST_USER) {
-        vhost_set_vring_enable(nc->peer, 1);
+        vhost_net_set_vring_enable(nc->peer, 1);
     }
 
     if (nc->peer->info->type != NET_CLIENT_DRIVER_TAP) {
@@ -720,7 +720,7 @@ static int peer_detach(VirtIONet *n, int index)
     }
 
     if (nc->peer->info->type == NET_CLIENT_DRIVER_VHOST_USER) {
-        vhost_set_vring_enable(nc->peer, 0);
+        vhost_net_set_vring_enable(nc->peer, 0);
     }
 
     if (nc->peer->info->type !=  NET_CLIENT_DRIVER_TAP) {
diff --git a/include/net/vhost_net.h b/include/net/vhost_net.h
index c6a5361a2a..0f40049f34 100644
--- a/include/net/vhost_net.h
+++ b/include/net/vhost_net.h
@@ -41,7 +41,7 @@ void vhost_net_config_mask(VHostNetState *net, VirtIODevice *dev, bool mask);
 int vhost_net_notify_migration_done(VHostNetState *net, char* mac_addr);
 VHostNetState *get_vhost_net(NetClientState *nc);
 
-int vhost_set_vring_enable(NetClientState * nc, int enable);
+int vhost_net_set_vring_enable(NetClientState *nc, int enable);
 
 uint64_t vhost_net_get_acked_features(VHostNetState *net);
 

From 8f6e5c620a5b21c070eed93721236cad48b6f9d7 Mon Sep 17 00:00:00 2001
From: Laurent Vivier <lvivier@redhat.com>
Date: Wed, 9 Jul 2025 10:24:18 +0200
Subject: [PATCH 2223/2760] net: Add get_vhost_net callback to NetClientInfo

The get_vhost_net() function previously contained a large switch
statement to find the VHostNetState pointer based on the net
client's type. This created a tight coupling, requiring the generic
vhost layer to be aware of every specific backend that supported
vhost, such as tap, vhost-user, and vhost-vdpa.

This approach is not scalable and requires modifying a central function
for any new backend. It also forced each backend to expose its internal
getter function in a public header file.

This patch refactors the logic by introducing a new get_vhost_net
function pointer to the NetClientInfo struct. The central
get_vhost_net() function is now a simple, generic dispatcher that
invokes the callback provided by the net client.

Each backend now implements its own private getter and registers it in
its NetClientInfo.

Signed-off-by: Laurent Vivier <lvivier@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/vhost_net.c       | 31 ++++---------------------------
 include/net/net.h        |  2 ++
 include/net/tap.h        |  3 ---
 include/net/vhost-user.h |  1 -
 include/net/vhost-vdpa.h |  2 --
 net/tap-win32.c          |  5 -----
 net/tap.c                | 20 +++++++++++++-------
 net/vhost-user.c         |  3 ++-
 net/vhost-vdpa.c         |  4 +++-
 9 files changed, 24 insertions(+), 47 deletions(-)

diff --git a/hw/net/vhost_net.c b/hw/net/vhost_net.c
index cb87056397..db8b97b753 100644
--- a/hw/net/vhost_net.c
+++ b/hw/net/vhost_net.c
@@ -649,41 +649,18 @@ void vhost_net_config_mask(VHostNetState *net, VirtIODevice *dev, bool mask)
 {
     vhost_config_mask(&net->dev, dev, mask);
 }
+
 VHostNetState *get_vhost_net(NetClientState *nc)
 {
-    VHostNetState *vhost_net = 0;
-
     if (!nc) {
         return 0;
     }
 
-    switch (nc->info->type) {
-    case NET_CLIENT_DRIVER_TAP:
-        vhost_net = tap_get_vhost_net(nc);
-        /*
-         * tap_get_vhost_net() can return NULL if a tap net-device backend is
-         * created with 'vhost=off' option, 'vhostforce=off' or no vhost or
-         * vhostforce or vhostfd options at all. Please see net_init_tap_one().
-         * Hence, we omit the assertion here.
-         */
-        break;
-#ifdef CONFIG_VHOST_NET_USER
-    case NET_CLIENT_DRIVER_VHOST_USER:
-        vhost_net = vhost_user_get_vhost_net(nc);
-        assert(vhost_net);
-        break;
-#endif
-#ifdef CONFIG_VHOST_NET_VDPA
-    case NET_CLIENT_DRIVER_VHOST_VDPA:
-        vhost_net = vhost_vdpa_get_vhost_net(nc);
-        assert(vhost_net);
-        break;
-#endif
-    default:
-        break;
+    if (nc->info->get_vhost_net) {
+        return nc->info->get_vhost_net(nc);
     }
 
-    return vhost_net;
+    return NULL;
 }
 
 int vhost_net_set_vring_enable(NetClientState *nc, int enable)
diff --git a/include/net/net.h b/include/net/net.h
index ac59b593ba..e67b375626 100644
--- a/include/net/net.h
+++ b/include/net/net.h
@@ -67,6 +67,7 @@ typedef void (SocketReadStateFinalize)(SocketReadState *rs);
 typedef void (NetAnnounce)(NetClientState *);
 typedef bool (SetSteeringEBPF)(NetClientState *, int);
 typedef bool (NetCheckPeerType)(NetClientState *, ObjectClass *, Error **);
+typedef struct vhost_net *(GetVHostNet)(NetClientState *nc);
 
 typedef struct NetClientInfo {
     NetClientDriver type;
@@ -92,6 +93,7 @@ typedef struct NetClientInfo {
     NetAnnounce *announce;
     SetSteeringEBPF *set_steering_ebpf;
     NetCheckPeerType *check_peer_type;
+    GetVHostNet *get_vhost_net;
 } NetClientInfo;
 
 struct NetClientState {
diff --git a/include/net/tap.h b/include/net/tap.h
index 5d585515f9..6f34f13eae 100644
--- a/include/net/tap.h
+++ b/include/net/tap.h
@@ -33,7 +33,4 @@ int tap_disable(NetClientState *nc);
 
 int tap_get_fd(NetClientState *nc);
 
-struct vhost_net;
-struct vhost_net *tap_get_vhost_net(NetClientState *nc);
-
 #endif /* QEMU_NET_TAP_H */
diff --git a/include/net/vhost-user.h b/include/net/vhost-user.h
index 35bf619709..0b233a2673 100644
--- a/include/net/vhost-user.h
+++ b/include/net/vhost-user.h
@@ -12,7 +12,6 @@
 #define VHOST_USER_H
 
 struct vhost_net;
-struct vhost_net *vhost_user_get_vhost_net(NetClientState *nc);
 uint64_t vhost_user_get_acked_features(NetClientState *nc);
 void vhost_user_save_acked_features(NetClientState *nc);
 
diff --git a/include/net/vhost-vdpa.h b/include/net/vhost-vdpa.h
index b81f9a6f2a..916ead3793 100644
--- a/include/net/vhost-vdpa.h
+++ b/include/net/vhost-vdpa.h
@@ -14,8 +14,6 @@
 
 #define TYPE_VHOST_VDPA "vhost-vdpa"
 
-struct vhost_net *vhost_vdpa_get_vhost_net(NetClientState *nc);
-
 extern const int vdpa_feature_bits[];
 
 #endif /* VHOST_VDPA_H */
diff --git a/net/tap-win32.c b/net/tap-win32.c
index 671dee970f..38baf90e0b 100644
--- a/net/tap-win32.c
+++ b/net/tap-win32.c
@@ -704,11 +704,6 @@ static void tap_win32_send(void *opaque)
     }
 }
 
-struct vhost_net *tap_get_vhost_net(NetClientState *nc)
-{
-    return NULL;
-}
-
 static NetClientInfo net_tap_win32_info = {
     .type = NET_CLIENT_DRIVER_TAP,
     .size = sizeof(TAPState),
diff --git a/net/tap.c b/net/tap.c
index ae1c7e3983..4beba6d7a7 100644
--- a/net/tap.c
+++ b/net/tap.c
@@ -329,6 +329,18 @@ int tap_get_fd(NetClientState *nc)
     return s->fd;
 }
 
+/*
+ * tap_get_vhost_net() can return NULL if a tap net-device backend is
+ * created with 'vhost=off' option, 'vhostforce=off' or no vhost or
+ * vhostforce or vhostfd options at all. Please see net_init_tap_one().
+ */
+static VHostNetState *tap_get_vhost_net(NetClientState *nc)
+{
+    TAPState *s = DO_UPCAST(TAPState, nc, nc);
+    assert(nc->info->type == NET_CLIENT_DRIVER_TAP);
+    return s->vhost_net;
+}
+
 /* fd support */
 
 static NetClientInfo net_tap_info = {
@@ -347,6 +359,7 @@ static NetClientInfo net_tap_info = {
     .set_vnet_le = tap_set_vnet_le,
     .set_vnet_be = tap_set_vnet_be,
     .set_steering_ebpf = tap_set_steering_ebpf,
+    .get_vhost_net = tap_get_vhost_net,
 };
 
 static TAPState *net_tap_fd_init(NetClientState *peer,
@@ -980,13 +993,6 @@ free_fail:
     return 0;
 }
 
-VHostNetState *tap_get_vhost_net(NetClientState *nc)
-{
-    TAPState *s = DO_UPCAST(TAPState, nc, nc);
-    assert(nc->info->type == NET_CLIENT_DRIVER_TAP);
-    return s->vhost_net;
-}
-
 int tap_enable(NetClientState *nc)
 {
     TAPState *s = DO_UPCAST(TAPState, nc, nc);
diff --git a/net/vhost-user.c b/net/vhost-user.c
index 10ac8dc0b3..b7bf0d2042 100644
--- a/net/vhost-user.c
+++ b/net/vhost-user.c
@@ -32,7 +32,7 @@ typedef struct NetVhostUserState {
     bool started;
 } NetVhostUserState;
 
-VHostNetState *vhost_user_get_vhost_net(NetClientState *nc)
+static struct vhost_net *vhost_user_get_vhost_net(NetClientState *nc)
 {
     NetVhostUserState *s = DO_UPCAST(NetVhostUserState, nc, nc);
     assert(nc->info->type == NET_CLIENT_DRIVER_VHOST_USER);
@@ -231,6 +231,7 @@ static NetClientInfo net_vhost_user_info = {
         .set_vnet_be = vhost_user_set_vnet_endianness,
         .set_vnet_le = vhost_user_set_vnet_endianness,
         .check_peer_type = vhost_user_check_peer_type,
+        .get_vhost_net = vhost_user_get_vhost_net,
 };
 
 static gboolean net_vhost_user_watch(void *do_not_use, GIOCondition cond,
diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c
index 58d738945d..0b86c917ed 100644
--- a/net/vhost-vdpa.c
+++ b/net/vhost-vdpa.c
@@ -132,7 +132,7 @@ static const uint64_t vdpa_svq_device_features =
 
 #define VHOST_VDPA_NET_CVQ_ASID 1
 
-VHostNetState *vhost_vdpa_get_vhost_net(NetClientState *nc)
+static struct vhost_net *vhost_vdpa_get_vhost_net(NetClientState *nc)
 {
     VhostVDPAState *s = DO_UPCAST(VhostVDPAState, nc, nc);
     assert(nc->info->type == NET_CLIENT_DRIVER_VHOST_VDPA);
@@ -432,6 +432,7 @@ static NetClientInfo net_vhost_vdpa_info = {
         .set_vnet_le = vhost_vdpa_set_vnet_le,
         .check_peer_type = vhost_vdpa_check_peer_type,
         .set_steering_ebpf = vhost_vdpa_set_steering_ebpf,
+        .get_vhost_net = vhost_vdpa_get_vhost_net,
 };
 
 static int64_t vhost_vdpa_get_vring_group(int device_fd, unsigned vq_index,
@@ -1287,6 +1288,7 @@ static NetClientInfo net_vhost_vdpa_cvq_info = {
     .has_ufo = vhost_vdpa_has_ufo,
     .check_peer_type = vhost_vdpa_check_peer_type,
     .set_steering_ebpf = vhost_vdpa_set_steering_ebpf,
+    .get_vhost_net = vhost_vdpa_get_vhost_net,
 };
 
 /*

From effdacbf28d76ca0eec9086539649e547e510bbc Mon Sep 17 00:00:00 2001
From: Laurent Vivier <lvivier@redhat.com>
Date: Wed, 9 Jul 2025 10:24:19 +0200
Subject: [PATCH 2224/2760] net: Consolidate vhost feature bits into vhost_net
 structure

Previously, the vhost_net_get_feature_bits() function in
hw/net/vhost_net.c used a large switch statement to determine
the appropriate feature bits based on the NetClientDriver type.

This created unnecessary coupling between the generic vhost layer
and specific network backends (like TAP, vhost-user, and
vhost-vdpa).

This patch moves the definition of vhost feature bits directly into the
vhost_net structure for each relevant network client.

Signed-off-by: Laurent Vivier <lvivier@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/vhost_net.c        | 90 ++-------------------------------------
 include/hw/virtio/vhost.h |  1 +
 include/net/vhost-vdpa.h  |  2 -
 include/net/vhost_net.h   |  1 +
 net/tap.c                 | 19 +++++++++
 net/vhost-user.c          | 43 +++++++++++++++++++
 net/vhost-vdpa.c          |  3 +-
 7 files changed, 69 insertions(+), 90 deletions(-)

diff --git a/hw/net/vhost_net.c b/hw/net/vhost_net.c
index db8b97b753..787c769ccc 100644
--- a/hw/net/vhost_net.c
+++ b/hw/net/vhost_net.c
@@ -36,94 +36,9 @@
 #include "hw/virtio/virtio-bus.h"
 #include "linux-headers/linux/vhost.h"
 
-
-/* Features supported by host kernel. */
-static const int kernel_feature_bits[] = {
-    VIRTIO_F_NOTIFY_ON_EMPTY,
-    VIRTIO_RING_F_INDIRECT_DESC,
-    VIRTIO_RING_F_EVENT_IDX,
-    VIRTIO_NET_F_MRG_RXBUF,
-    VIRTIO_F_VERSION_1,
-    VIRTIO_NET_F_MTU,
-    VIRTIO_F_IOMMU_PLATFORM,
-    VIRTIO_F_RING_PACKED,
-    VIRTIO_F_RING_RESET,
-    VIRTIO_F_IN_ORDER,
-    VIRTIO_F_NOTIFICATION_DATA,
-    VIRTIO_NET_F_RSC_EXT,
-    VIRTIO_NET_F_HASH_REPORT,
-    VHOST_INVALID_FEATURE_BIT
-};
-
-/* Features supported by others. */
-static const int user_feature_bits[] = {
-    VIRTIO_F_NOTIFY_ON_EMPTY,
-    VIRTIO_F_NOTIFICATION_DATA,
-    VIRTIO_RING_F_INDIRECT_DESC,
-    VIRTIO_RING_F_EVENT_IDX,
-
-    VIRTIO_F_ANY_LAYOUT,
-    VIRTIO_F_VERSION_1,
-    VIRTIO_NET_F_CSUM,
-    VIRTIO_NET_F_GUEST_CSUM,
-    VIRTIO_NET_F_GSO,
-    VIRTIO_NET_F_GUEST_TSO4,
-    VIRTIO_NET_F_GUEST_TSO6,
-    VIRTIO_NET_F_GUEST_ECN,
-    VIRTIO_NET_F_GUEST_UFO,
-    VIRTIO_NET_F_HOST_TSO4,
-    VIRTIO_NET_F_HOST_TSO6,
-    VIRTIO_NET_F_HOST_ECN,
-    VIRTIO_NET_F_HOST_UFO,
-    VIRTIO_NET_F_MRG_RXBUF,
-    VIRTIO_NET_F_MTU,
-    VIRTIO_F_IOMMU_PLATFORM,
-    VIRTIO_F_RING_PACKED,
-    VIRTIO_F_RING_RESET,
-    VIRTIO_F_IN_ORDER,
-    VIRTIO_NET_F_RSS,
-    VIRTIO_NET_F_RSC_EXT,
-    VIRTIO_NET_F_HASH_REPORT,
-    VIRTIO_NET_F_GUEST_USO4,
-    VIRTIO_NET_F_GUEST_USO6,
-    VIRTIO_NET_F_HOST_USO,
-
-    /* This bit implies RARP isn't sent by QEMU out of band */
-    VIRTIO_NET_F_GUEST_ANNOUNCE,
-
-    VIRTIO_NET_F_MQ,
-
-    VHOST_INVALID_FEATURE_BIT
-};
-
-static const int *vhost_net_get_feature_bits(struct vhost_net *net)
-{
-    const int *feature_bits = 0;
-
-    switch (net->nc->info->type) {
-    case NET_CLIENT_DRIVER_TAP:
-        feature_bits = kernel_feature_bits;
-        break;
-    case NET_CLIENT_DRIVER_VHOST_USER:
-        feature_bits = user_feature_bits;
-        break;
-#ifdef CONFIG_VHOST_NET_VDPA
-    case NET_CLIENT_DRIVER_VHOST_VDPA:
-        feature_bits = vdpa_feature_bits;
-        break;
-#endif
-    default:
-        error_report("Feature bits not defined for this type: %d",
-                net->nc->info->type);
-        break;
-    }
-
-    return feature_bits;
-}
-
 uint64_t vhost_net_get_features(struct vhost_net *net, uint64_t features)
 {
-    return vhost_get_features(&net->dev, vhost_net_get_feature_bits(net),
+    return vhost_get_features(&net->dev, net->feature_bits,
             features);
 }
 int vhost_net_get_config(struct vhost_net *net,  uint8_t *config,
@@ -140,7 +55,7 @@ int vhost_net_set_config(struct vhost_net *net, const uint8_t *data,
 void vhost_net_ack_features(struct vhost_net *net, uint64_t features)
 {
     net->dev.acked_features = net->dev.backend_features;
-    vhost_ack_features(&net->dev, vhost_net_get_feature_bits(net), features);
+    vhost_ack_features(&net->dev, net->feature_bits, features);
 }
 
 uint64_t vhost_net_get_max_queues(VHostNetState *net)
@@ -329,6 +244,7 @@ struct vhost_net *vhost_net_init(VhostNetOptions *options)
     }
     net->nc = options->net_backend;
     net->dev.nvqs = options->nvqs;
+    net->feature_bits = options->feature_bits;
 
     net->dev.max_queues = 1;
     net->dev.vqs = net->vqs;
diff --git a/include/hw/virtio/vhost.h b/include/hw/virtio/vhost.h
index 38800a7156..6a75fdc021 100644
--- a/include/hw/virtio/vhost.h
+++ b/include/hw/virtio/vhost.h
@@ -143,6 +143,7 @@ struct vhost_net {
     struct vhost_dev dev;
     struct vhost_virtqueue vqs[2];
     int backend;
+    const int *feature_bits;
     NetClientState *nc;
 };
 
diff --git a/include/net/vhost-vdpa.h b/include/net/vhost-vdpa.h
index 916ead3793..f8d7d6c904 100644
--- a/include/net/vhost-vdpa.h
+++ b/include/net/vhost-vdpa.h
@@ -14,6 +14,4 @@
 
 #define TYPE_VHOST_VDPA "vhost-vdpa"
 
-extern const int vdpa_feature_bits[];
-
 #endif /* VHOST_VDPA_H */
diff --git a/include/net/vhost_net.h b/include/net/vhost_net.h
index 0f40049f34..fbed37385a 100644
--- a/include/net/vhost_net.h
+++ b/include/net/vhost_net.h
@@ -12,6 +12,7 @@ typedef struct VhostNetOptions {
     NetClientState *net_backend;
     uint32_t busyloop_timeout;
     unsigned int nvqs;
+    const int *feature_bits;
     void *opaque;
 } VhostNetOptions;
 
diff --git a/net/tap.c b/net/tap.c
index 4beba6d7a7..a33eb23212 100644
--- a/net/tap.c
+++ b/net/tap.c
@@ -42,11 +42,29 @@
 #include "qemu/error-report.h"
 #include "qemu/main-loop.h"
 #include "qemu/sockets.h"
+#include "hw/virtio/vhost.h"
 
 #include "net/tap.h"
 
 #include "net/vhost_net.h"
 
+static const int kernel_feature_bits[] = {
+    VIRTIO_F_NOTIFY_ON_EMPTY,
+    VIRTIO_RING_F_INDIRECT_DESC,
+    VIRTIO_RING_F_EVENT_IDX,
+    VIRTIO_NET_F_MRG_RXBUF,
+    VIRTIO_F_VERSION_1,
+    VIRTIO_NET_F_MTU,
+    VIRTIO_F_IOMMU_PLATFORM,
+    VIRTIO_F_RING_PACKED,
+    VIRTIO_F_RING_RESET,
+    VIRTIO_F_IN_ORDER,
+    VIRTIO_F_NOTIFICATION_DATA,
+    VIRTIO_NET_F_RSC_EXT,
+    VIRTIO_NET_F_HASH_REPORT,
+    VHOST_INVALID_FEATURE_BIT
+};
+
 typedef struct TAPState {
     NetClientState nc;
     int fd;
@@ -725,6 +743,7 @@ static void net_init_tap_one(const NetdevTapOptions *tap, NetClientState *peer,
         }
         options.opaque = (void *)(uintptr_t)vhostfd;
         options.nvqs = 2;
+        options.feature_bits = kernel_feature_bits;
 
         s->vhost_net = vhost_net_init(&options);
         if (!s->vhost_net) {
diff --git a/net/vhost-user.c b/net/vhost-user.c
index b7bf0d2042..bc8e82a092 100644
--- a/net/vhost-user.c
+++ b/net/vhost-user.c
@@ -12,7 +12,9 @@
 #include "clients.h"
 #include "net/vhost_net.h"
 #include "net/vhost-user.h"
+#include "hw/virtio/vhost.h"
 #include "hw/virtio/vhost-user.h"
+#include "standard-headers/linux/virtio_net.h"
 #include "chardev/char-fe.h"
 #include "qapi/error.h"
 #include "qapi/qapi-commands-net.h"
@@ -22,6 +24,46 @@
 #include "qemu/option.h"
 #include "trace.h"
 
+static const int user_feature_bits[] = {
+    VIRTIO_F_NOTIFY_ON_EMPTY,
+    VIRTIO_F_NOTIFICATION_DATA,
+    VIRTIO_RING_F_INDIRECT_DESC,
+    VIRTIO_RING_F_EVENT_IDX,
+
+    VIRTIO_F_ANY_LAYOUT,
+    VIRTIO_F_VERSION_1,
+    VIRTIO_NET_F_CSUM,
+    VIRTIO_NET_F_GUEST_CSUM,
+    VIRTIO_NET_F_GSO,
+    VIRTIO_NET_F_GUEST_TSO4,
+    VIRTIO_NET_F_GUEST_TSO6,
+    VIRTIO_NET_F_GUEST_ECN,
+    VIRTIO_NET_F_GUEST_UFO,
+    VIRTIO_NET_F_HOST_TSO4,
+    VIRTIO_NET_F_HOST_TSO6,
+    VIRTIO_NET_F_HOST_ECN,
+    VIRTIO_NET_F_HOST_UFO,
+    VIRTIO_NET_F_MRG_RXBUF,
+    VIRTIO_NET_F_MTU,
+    VIRTIO_F_IOMMU_PLATFORM,
+    VIRTIO_F_RING_PACKED,
+    VIRTIO_F_RING_RESET,
+    VIRTIO_F_IN_ORDER,
+    VIRTIO_NET_F_RSS,
+    VIRTIO_NET_F_RSC_EXT,
+    VIRTIO_NET_F_HASH_REPORT,
+    VIRTIO_NET_F_GUEST_USO4,
+    VIRTIO_NET_F_GUEST_USO6,
+    VIRTIO_NET_F_HOST_USO,
+
+    /* This bit implies RARP isn't sent by QEMU out of band */
+    VIRTIO_NET_F_GUEST_ANNOUNCE,
+
+    VIRTIO_NET_F_MQ,
+
+    VHOST_INVALID_FEATURE_BIT
+};
+
 typedef struct NetVhostUserState {
     NetClientState nc;
     CharBackend chr; /* only queue index 0 */
@@ -96,6 +138,7 @@ static int vhost_user_start(int queues, NetClientState *ncs[],
         options.opaque      = be;
         options.busyloop_timeout = 0;
         options.nvqs = 2;
+        options.feature_bits = user_feature_bits;
         net = vhost_net_init(&options);
         if (!net) {
             error_report("failed to init vhost_net for queue %d", i);
diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c
index 0b86c917ed..cbbea0eb71 100644
--- a/net/vhost-vdpa.c
+++ b/net/vhost-vdpa.c
@@ -55,7 +55,7 @@ typedef struct VhostVDPAState {
  * with the exception of VHOST_INVALID_FEATURE_BIT,
  * which should always be the last entry.
  */
-const int vdpa_feature_bits[] = {
+static const int vdpa_feature_bits[] = {
     VIRTIO_F_ANY_LAYOUT,
     VIRTIO_F_IOMMU_PLATFORM,
     VIRTIO_F_NOTIFY_ON_EMPTY,
@@ -201,6 +201,7 @@ static int vhost_vdpa_add(NetClientState *ncs, void *be,
     options.opaque      = be;
     options.busyloop_timeout = 0;
     options.nvqs = nvqs;
+    options.feature_bits = vdpa_feature_bits;
 
     net = vhost_net_init(&options);
     if (!net) {

From bd38794a1119ec8e3f0a7473458ce4cdd229bc42 Mon Sep 17 00:00:00 2001
From: Laurent Vivier <lvivier@redhat.com>
Date: Wed, 9 Jul 2025 10:24:20 +0200
Subject: [PATCH 2225/2760] net: Add get_acked_features callback to
 VhostNetOptions

This patch continues the effort to decouple the generic vhost layer
from specific network backend implementations.

Previously, the vhost_net initialization code contained a hardcoded
check for the vhost-user client type to retrieve its acked features
by calling vhost_user_get_acked_features(). This exposed an
internal vhost-user function in a public header and coupled the two
modules.

The vhost-user backend is updated to provide a callback, and its
getter function is now static. The call site in vhost_net.c is
simplified to use the new generic helper, removing the type check and
the direct dependency.

Signed-off-by: Laurent Vivier <lvivier@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/vhost_net.c       | 6 ++----
 include/net/vhost-user.h | 2 --
 include/net/vhost_net.h  | 3 +++
 net/tap.c                | 1 +
 net/vhost-user.c         | 4 +++-
 net/vhost-vdpa.c         | 1 +
 6 files changed, 10 insertions(+), 7 deletions(-)

diff --git a/hw/net/vhost_net.c b/hw/net/vhost_net.c
index 787c769ccc..fb169af0e8 100644
--- a/hw/net/vhost_net.c
+++ b/hw/net/vhost_net.c
@@ -288,9 +288,8 @@ struct vhost_net *vhost_net_init(VhostNetOptions *options)
     }
 
     /* Set sane init value. Override when guest acks. */
-#ifdef CONFIG_VHOST_NET_USER
-    if (net->nc->info->type == NET_CLIENT_DRIVER_VHOST_USER) {
-        features = vhost_user_get_acked_features(net->nc);
+    if (options->get_acked_features) {
+        features = options->get_acked_features(net->nc);
         if (~net->dev.features & features) {
             fprintf(stderr, "vhost lacks feature mask 0x%" PRIx64
                     " for backend\n",
@@ -298,7 +297,6 @@ struct vhost_net *vhost_net_init(VhostNetOptions *options)
             goto fail;
         }
     }
-#endif
 
     vhost_net_ack_features(net, features);
 
diff --git a/include/net/vhost-user.h b/include/net/vhost-user.h
index 0b233a2673..a4d0ce4b8d 100644
--- a/include/net/vhost-user.h
+++ b/include/net/vhost-user.h
@@ -11,8 +11,6 @@
 #ifndef VHOST_USER_H
 #define VHOST_USER_H
 
-struct vhost_net;
-uint64_t vhost_user_get_acked_features(NetClientState *nc);
 void vhost_user_save_acked_features(NetClientState *nc);
 
 #endif /* VHOST_USER_H */
diff --git a/include/net/vhost_net.h b/include/net/vhost_net.h
index fbed37385a..a8d281c8f7 100644
--- a/include/net/vhost_net.h
+++ b/include/net/vhost_net.h
@@ -7,12 +7,15 @@
 struct vhost_net;
 typedef struct vhost_net VHostNetState;
 
+typedef uint64_t (GetAckedFeatures)(NetClientState *nc);
+
 typedef struct VhostNetOptions {
     VhostBackendType backend_type;
     NetClientState *net_backend;
     uint32_t busyloop_timeout;
     unsigned int nvqs;
     const int *feature_bits;
+    GetAckedFeatures *get_acked_features;
     void *opaque;
 } VhostNetOptions;
 
diff --git a/net/tap.c b/net/tap.c
index a33eb23212..acd77f816f 100644
--- a/net/tap.c
+++ b/net/tap.c
@@ -744,6 +744,7 @@ static void net_init_tap_one(const NetdevTapOptions *tap, NetClientState *peer,
         options.opaque = (void *)(uintptr_t)vhostfd;
         options.nvqs = 2;
         options.feature_bits = kernel_feature_bits;
+        options.get_acked_features = NULL;
 
         s->vhost_net = vhost_net_init(&options);
         if (!s->vhost_net) {
diff --git a/net/vhost-user.c b/net/vhost-user.c
index bc8e82a092..93b413b49f 100644
--- a/net/vhost-user.c
+++ b/net/vhost-user.c
@@ -81,7 +81,7 @@ static struct vhost_net *vhost_user_get_vhost_net(NetClientState *nc)
     return s->vhost_net;
 }
 
-uint64_t vhost_user_get_acked_features(NetClientState *nc)
+static uint64_t vhost_user_get_acked_features(NetClientState *nc)
 {
     NetVhostUserState *s = DO_UPCAST(NetVhostUserState, nc, nc);
     assert(nc->info->type == NET_CLIENT_DRIVER_VHOST_USER);
@@ -139,6 +139,8 @@ static int vhost_user_start(int queues, NetClientState *ncs[],
         options.busyloop_timeout = 0;
         options.nvqs = 2;
         options.feature_bits = user_feature_bits;
+        options.get_acked_features = vhost_user_get_acked_features;
+
         net = vhost_net_init(&options);
         if (!net) {
             error_report("failed to init vhost_net for queue %d", i);
diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c
index cbbea0eb71..a3980d1fb5 100644
--- a/net/vhost-vdpa.c
+++ b/net/vhost-vdpa.c
@@ -202,6 +202,7 @@ static int vhost_vdpa_add(NetClientState *ncs, void *be,
     options.busyloop_timeout = 0;
     options.nvqs = nvqs;
     options.feature_bits = vdpa_feature_bits;
+    options.get_acked_features = NULL;
 
     net = vhost_net_init(&options);
     if (!net) {

From 1652f1b335fb5bec921c64ff7f378e6732510ca4 Mon Sep 17 00:00:00 2001
From: Laurent Vivier <lvivier@redhat.com>
Date: Wed, 9 Jul 2025 10:24:21 +0200
Subject: [PATCH 2226/2760] net: Add save_acked_features callback to vhost_net

This commit introduces a save_acked_features function pointer to
vhost_net and converts the vhost_net function into a generic dispatcher.

The vhost-user backend provides the callback, making its function static.
With this change, no other module has a direct dependency on the
vhost-user implementation.

This cleanup allows for the complete removal of the net/vhost-user.h
header file.

Signed-off-by: Laurent Vivier <lvivier@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/vhost_net-stub.c   |  1 -
 hw/net/vhost_net.c        | 10 +++++-----
 include/hw/virtio/vhost.h |  2 ++
 include/net/vhost-user.h  | 16 ----------------
 include/net/vhost_net.h   |  2 ++
 net/tap.c                 |  1 +
 net/vhost-user-stub.c     |  1 -
 net/vhost-user.c          |  4 ++--
 net/vhost-vdpa.c          |  1 +
 9 files changed, 13 insertions(+), 25 deletions(-)
 delete mode 100644 include/net/vhost-user.h

diff --git a/hw/net/vhost_net-stub.c b/hw/net/vhost_net-stub.c
index 7bed0bf92b..7d49f82906 100644
--- a/hw/net/vhost_net-stub.c
+++ b/hw/net/vhost_net-stub.c
@@ -13,7 +13,6 @@
 #include "qemu/osdep.h"
 #include "net/net.h"
 #include "net/tap.h"
-#include "net/vhost-user.h"
 
 #include "hw/virtio/virtio-net.h"
 #include "net/vhost_net.h"
diff --git a/hw/net/vhost_net.c b/hw/net/vhost_net.c
index fb169af0e8..976d2b315a 100644
--- a/hw/net/vhost_net.c
+++ b/hw/net/vhost_net.c
@@ -16,7 +16,6 @@
 #include "qemu/osdep.h"
 #include "net/net.h"
 #include "net/tap.h"
-#include "net/vhost-user.h"
 #include "net/vhost-vdpa.h"
 
 #include "standard-headers/linux/vhost_types.h"
@@ -70,11 +69,11 @@ uint64_t vhost_net_get_acked_features(VHostNetState *net)
 
 void vhost_net_save_acked_features(NetClientState *nc)
 {
-#ifdef CONFIG_VHOST_NET_USER
-    if (nc->info->type == NET_CLIENT_DRIVER_VHOST_USER) {
-        vhost_user_save_acked_features(nc);
+    struct vhost_net *net = get_vhost_net(nc);
+
+    if (net && net->save_acked_features) {
+        net->save_acked_features(nc);
     }
-#endif
 }
 
 static void vhost_net_disable_notifiers_nvhosts(VirtIODevice *dev,
@@ -245,6 +244,7 @@ struct vhost_net *vhost_net_init(VhostNetOptions *options)
     net->nc = options->net_backend;
     net->dev.nvqs = options->nvqs;
     net->feature_bits = options->feature_bits;
+    net->save_acked_features = options->save_acked_features;
 
     net->dev.max_queues = 1;
     net->dev.vqs = net->vqs;
diff --git a/include/hw/virtio/vhost.h b/include/hw/virtio/vhost.h
index 6a75fdc021..b0830bac79 100644
--- a/include/hw/virtio/vhost.h
+++ b/include/hw/virtio/vhost.h
@@ -1,6 +1,7 @@
 #ifndef VHOST_H
 #define VHOST_H
 
+#include "net/vhost_net.h"
 #include "hw/virtio/vhost-backend.h"
 #include "hw/virtio/virtio.h"
 #include "system/memory.h"
@@ -144,6 +145,7 @@ struct vhost_net {
     struct vhost_virtqueue vqs[2];
     int backend;
     const int *feature_bits;
+    SaveAcketFeatures *save_acked_features;
     NetClientState *nc;
 };
 
diff --git a/include/net/vhost-user.h b/include/net/vhost-user.h
deleted file mode 100644
index a4d0ce4b8d..0000000000
--- a/include/net/vhost-user.h
+++ /dev/null
@@ -1,16 +0,0 @@
-/*
- * vhost-user.h
- *
- * Copyright (c) 2013 Virtual Open Systems Sarl.
- *
- * This work is licensed under the terms of the GNU GPL, version 2 or later.
- * See the COPYING file in the top-level directory.
- *
- */
-
-#ifndef VHOST_USER_H
-#define VHOST_USER_H
-
-void vhost_user_save_acked_features(NetClientState *nc);
-
-#endif /* VHOST_USER_H */
diff --git a/include/net/vhost_net.h b/include/net/vhost_net.h
index a8d281c8f7..eb26ed9bdc 100644
--- a/include/net/vhost_net.h
+++ b/include/net/vhost_net.h
@@ -8,6 +8,7 @@ struct vhost_net;
 typedef struct vhost_net VHostNetState;
 
 typedef uint64_t (GetAckedFeatures)(NetClientState *nc);
+typedef void (SaveAcketFeatures)(NetClientState *nc);
 
 typedef struct VhostNetOptions {
     VhostBackendType backend_type;
@@ -16,6 +17,7 @@ typedef struct VhostNetOptions {
     unsigned int nvqs;
     const int *feature_bits;
     GetAckedFeatures *get_acked_features;
+    SaveAcketFeatures *save_acked_features;
     void *opaque;
 } VhostNetOptions;
 
diff --git a/net/tap.c b/net/tap.c
index acd77f816f..79fa02a65c 100644
--- a/net/tap.c
+++ b/net/tap.c
@@ -745,6 +745,7 @@ static void net_init_tap_one(const NetdevTapOptions *tap, NetClientState *peer,
         options.nvqs = 2;
         options.feature_bits = kernel_feature_bits;
         options.get_acked_features = NULL;
+        options.save_acked_features = NULL;
 
         s->vhost_net = vhost_net_init(&options);
         if (!s->vhost_net) {
diff --git a/net/vhost-user-stub.c b/net/vhost-user-stub.c
index 52ab4e13f1..283dee87db 100644
--- a/net/vhost-user-stub.c
+++ b/net/vhost-user-stub.c
@@ -11,7 +11,6 @@
 #include "qemu/osdep.h"
 #include "clients.h"
 #include "net/vhost_net.h"
-#include "net/vhost-user.h"
 #include "qemu/error-report.h"
 #include "qapi/error.h"
 
diff --git a/net/vhost-user.c b/net/vhost-user.c
index 93b413b49f..8a3df27b02 100644
--- a/net/vhost-user.c
+++ b/net/vhost-user.c
@@ -11,7 +11,6 @@
 #include "qemu/osdep.h"
 #include "clients.h"
 #include "net/vhost_net.h"
-#include "net/vhost-user.h"
 #include "hw/virtio/vhost.h"
 #include "hw/virtio/vhost-user.h"
 #include "standard-headers/linux/virtio_net.h"
@@ -88,7 +87,7 @@ static uint64_t vhost_user_get_acked_features(NetClientState *nc)
     return s->acked_features;
 }
 
-void vhost_user_save_acked_features(NetClientState *nc)
+static void vhost_user_save_acked_features(NetClientState *nc)
 {
     NetVhostUserState *s;
 
@@ -140,6 +139,7 @@ static int vhost_user_start(int queues, NetClientState *ncs[],
         options.nvqs = 2;
         options.feature_bits = user_feature_bits;
         options.get_acked_features = vhost_user_get_acked_features;
+        options.save_acked_features = vhost_user_save_acked_features;
 
         net = vhost_net_init(&options);
         if (!net) {
diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c
index a3980d1fb5..c63225d3d2 100644
--- a/net/vhost-vdpa.c
+++ b/net/vhost-vdpa.c
@@ -203,6 +203,7 @@ static int vhost_vdpa_add(NetClientState *ncs, void *be,
     options.nvqs = nvqs;
     options.feature_bits = vdpa_feature_bits;
     options.get_acked_features = NULL;
+    options.save_acked_features = NULL;
 
     net = vhost_net_init(&options);
     if (!net) {

From 33b78a30a3e8e1cf16ef423bf2e78caf3d560985 Mon Sep 17 00:00:00 2001
From: Laurent Vivier <lvivier@redhat.com>
Date: Wed, 9 Jul 2025 10:24:22 +0200
Subject: [PATCH 2227/2760] net: Allow network backends to advertise max TX
 queue size

This commit refactors how the maximum transmit queue size for
virtio-net devices is determined, making the mechanism more generic
and extensible.

Previously, virtio_net_max_tx_queue_size() contained hardcoded
checks for specific network backend types (vhost-user and
vhost-vdpa) to determine their supported maximum queue size. This
created direct dependencies and would require modifications for
every new backend that supports variable queue sizes.

To improve flexibility, a new max_tx_queue_size field is added
to the vhost_net structure. This allows each network backend
to advertise its supported maximum transmit queue size directly.

The virtio_net_max_tx_queue_size() function now retrieves the max
TX queue size from the vhost_net struct, if available and set.
Otherwise, it defaults to VIRTIO_NET_TX_QUEUE_DEFAULT_SIZE.

Signed-off-by: Laurent Vivier <lvivier@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/vhost_net.c        |  1 +
 hw/net/virtio-net.c       | 24 ++++++++++++------------
 include/hw/virtio/vhost.h |  1 +
 include/net/vhost_net.h   |  1 +
 net/tap.c                 |  1 +
 net/vhost-user.c          |  1 +
 net/vhost-vdpa.c          |  1 +
 7 files changed, 18 insertions(+), 12 deletions(-)

diff --git a/hw/net/vhost_net.c b/hw/net/vhost_net.c
index 976d2b315a..74d2e3ed90 100644
--- a/hw/net/vhost_net.c
+++ b/hw/net/vhost_net.c
@@ -245,6 +245,7 @@ struct vhost_net *vhost_net_init(VhostNetOptions *options)
     net->dev.nvqs = options->nvqs;
     net->feature_bits = options->feature_bits;
     net->save_acked_features = options->save_acked_features;
+    net->max_tx_queue_size = options->max_tx_queue_size;
 
     net->dev.max_queues = 1;
     net->dev.vqs = net->vqs;
diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index e3400f18c8..39fc280839 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -670,22 +670,22 @@ static void virtio_net_set_mrg_rx_bufs(VirtIONet *n, int mergeable_rx_bufs,
 static int virtio_net_max_tx_queue_size(VirtIONet *n)
 {
     NetClientState *peer = n->nic_conf.peers.ncs[0];
+    struct vhost_net *net;
 
-    /*
-     * Backends other than vhost-user or vhost-vdpa don't support max queue
-     * size.
-     */
     if (!peer) {
-        return VIRTIO_NET_TX_QUEUE_DEFAULT_SIZE;
+        goto default_value;
     }
 
-    switch(peer->info->type) {
-    case NET_CLIENT_DRIVER_VHOST_USER:
-    case NET_CLIENT_DRIVER_VHOST_VDPA:
-        return VIRTQUEUE_MAX_SIZE;
-    default:
-        return VIRTIO_NET_TX_QUEUE_DEFAULT_SIZE;
-    };
+    net = get_vhost_net(peer);
+
+    if (!net || !net->max_tx_queue_size) {
+        goto default_value;
+    }
+
+    return net->max_tx_queue_size;
+
+default_value:
+    return VIRTIO_NET_TX_QUEUE_DEFAULT_SIZE;
 }
 
 static int peer_attach(VirtIONet *n, int index)
diff --git a/include/hw/virtio/vhost.h b/include/hw/virtio/vhost.h
index b0830bac79..a62992c819 100644
--- a/include/hw/virtio/vhost.h
+++ b/include/hw/virtio/vhost.h
@@ -145,6 +145,7 @@ struct vhost_net {
     struct vhost_virtqueue vqs[2];
     int backend;
     const int *feature_bits;
+    int max_tx_queue_size;
     SaveAcketFeatures *save_acked_features;
     NetClientState *nc;
 };
diff --git a/include/net/vhost_net.h b/include/net/vhost_net.h
index eb26ed9bdc..8f4fddfb69 100644
--- a/include/net/vhost_net.h
+++ b/include/net/vhost_net.h
@@ -16,6 +16,7 @@ typedef struct VhostNetOptions {
     uint32_t busyloop_timeout;
     unsigned int nvqs;
     const int *feature_bits;
+    int max_tx_queue_size;
     GetAckedFeatures *get_acked_features;
     SaveAcketFeatures *save_acked_features;
     void *opaque;
diff --git a/net/tap.c b/net/tap.c
index 79fa02a65c..2f0cb55c9a 100644
--- a/net/tap.c
+++ b/net/tap.c
@@ -746,6 +746,7 @@ static void net_init_tap_one(const NetdevTapOptions *tap, NetClientState *peer,
         options.feature_bits = kernel_feature_bits;
         options.get_acked_features = NULL;
         options.save_acked_features = NULL;
+        options.max_tx_queue_size = 0;
 
         s->vhost_net = vhost_net_init(&options);
         if (!s->vhost_net) {
diff --git a/net/vhost-user.c b/net/vhost-user.c
index 8a3df27b02..bf892915de 100644
--- a/net/vhost-user.c
+++ b/net/vhost-user.c
@@ -138,6 +138,7 @@ static int vhost_user_start(int queues, NetClientState *ncs[],
         options.busyloop_timeout = 0;
         options.nvqs = 2;
         options.feature_bits = user_feature_bits;
+        options.max_tx_queue_size = VIRTQUEUE_MAX_SIZE;
         options.get_acked_features = vhost_user_get_acked_features;
         options.save_acked_features = vhost_user_save_acked_features;
 
diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c
index c63225d3d2..353392b3d7 100644
--- a/net/vhost-vdpa.c
+++ b/net/vhost-vdpa.c
@@ -204,6 +204,7 @@ static int vhost_vdpa_add(NetClientState *ncs, void *be,
     options.feature_bits = vdpa_feature_bits;
     options.get_acked_features = NULL;
     options.save_acked_features = NULL;
+    options.max_tx_queue_size = VIRTQUEUE_MAX_SIZE;
 
     net = vhost_net_init(&options);
     if (!net) {

From ba5acc5d6e0bc9ab86619c92cb76493aa197d7a2 Mon Sep 17 00:00:00 2001
From: Laurent Vivier <lvivier@redhat.com>
Date: Wed, 9 Jul 2025 10:24:23 +0200
Subject: [PATCH 2228/2760] net: Add is_vhost_user flag to vhost_net struct

Introduce a boolean is_vhost_user field to the vhost_net
structure. This flag is initialized during vhost_net_init based
on whether the backend is vhost-user.

This refactoring simplifies checks for vhost-user specific behavior,
replacing direct comparisons of 'net->nc->info->type' with the new
flag. It improves readability and encapsulates the backend type
information directly within the vhost_net instance.

Signed-off-by: Laurent Vivier <lvivier@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/vhost_net.c        | 3 ++-
 hw/net/virtio-net.c       | 8 ++++++--
 include/hw/virtio/vhost.h | 1 +
 include/net/vhost_net.h   | 1 +
 net/tap.c                 | 1 +
 net/vhost-user.c          | 1 +
 net/vhost-vdpa.c          | 1 +
 7 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/hw/net/vhost_net.c b/hw/net/vhost_net.c
index 74d2e3ed90..540492b37d 100644
--- a/hw/net/vhost_net.c
+++ b/hw/net/vhost_net.c
@@ -246,6 +246,7 @@ struct vhost_net *vhost_net_init(VhostNetOptions *options)
     net->feature_bits = options->feature_bits;
     net->save_acked_features = options->save_acked_features;
     net->max_tx_queue_size = options->max_tx_queue_size;
+    net->is_vhost_user = options->is_vhost_user;
 
     net->dev.max_queues = 1;
     net->dev.vqs = net->vqs;
@@ -440,7 +441,7 @@ int vhost_net_start(VirtIODevice *dev, NetClientState *ncs,
          * because vhost user doesn't interrupt masking/unmasking
          * properly.
          */
-        if (net->nc->info->type == NET_CLIENT_DRIVER_VHOST_USER) {
+        if (net->is_vhost_user) {
             dev->use_guest_notifier_mask = false;
         }
      }
diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index 39fc280839..00df5fd6cd 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -691,12 +691,14 @@ default_value:
 static int peer_attach(VirtIONet *n, int index)
 {
     NetClientState *nc = qemu_get_subqueue(n->nic, index);
+    struct vhost_net *net;
 
     if (!nc->peer) {
         return 0;
     }
 
-    if (nc->peer->info->type == NET_CLIENT_DRIVER_VHOST_USER) {
+    net = get_vhost_net(nc->peer);
+    if (net && net->is_vhost_user) {
         vhost_net_set_vring_enable(nc->peer, 1);
     }
 
@@ -714,12 +716,14 @@ static int peer_attach(VirtIONet *n, int index)
 static int peer_detach(VirtIONet *n, int index)
 {
     NetClientState *nc = qemu_get_subqueue(n->nic, index);
+    struct vhost_net *net;
 
     if (!nc->peer) {
         return 0;
     }
 
-    if (nc->peer->info->type == NET_CLIENT_DRIVER_VHOST_USER) {
+    net = get_vhost_net(nc->peer);
+    if (net && net->is_vhost_user) {
         vhost_net_set_vring_enable(nc->peer, 0);
     }
 
diff --git a/include/hw/virtio/vhost.h b/include/hw/virtio/vhost.h
index a62992c819..f178cf9e1d 100644
--- a/include/hw/virtio/vhost.h
+++ b/include/hw/virtio/vhost.h
@@ -147,6 +147,7 @@ struct vhost_net {
     const int *feature_bits;
     int max_tx_queue_size;
     SaveAcketFeatures *save_acked_features;
+    bool is_vhost_user;
     NetClientState *nc;
 };
 
diff --git a/include/net/vhost_net.h b/include/net/vhost_net.h
index 8f4fddfb69..879781dad7 100644
--- a/include/net/vhost_net.h
+++ b/include/net/vhost_net.h
@@ -17,6 +17,7 @@ typedef struct VhostNetOptions {
     unsigned int nvqs;
     const int *feature_bits;
     int max_tx_queue_size;
+    bool is_vhost_user;
     GetAckedFeatures *get_acked_features;
     SaveAcketFeatures *save_acked_features;
     void *opaque;
diff --git a/net/tap.c b/net/tap.c
index 2f0cb55c9a..23536c09b4 100644
--- a/net/tap.c
+++ b/net/tap.c
@@ -747,6 +747,7 @@ static void net_init_tap_one(const NetdevTapOptions *tap, NetClientState *peer,
         options.get_acked_features = NULL;
         options.save_acked_features = NULL;
         options.max_tx_queue_size = 0;
+        options.is_vhost_user = false;
 
         s->vhost_net = vhost_net_init(&options);
         if (!s->vhost_net) {
diff --git a/net/vhost-user.c b/net/vhost-user.c
index bf892915de..1c3b8b36f3 100644
--- a/net/vhost-user.c
+++ b/net/vhost-user.c
@@ -141,6 +141,7 @@ static int vhost_user_start(int queues, NetClientState *ncs[],
         options.max_tx_queue_size = VIRTQUEUE_MAX_SIZE;
         options.get_acked_features = vhost_user_get_acked_features;
         options.save_acked_features = vhost_user_save_acked_features;
+        options.is_vhost_user = true;
 
         net = vhost_net_init(&options);
         if (!net) {
diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c
index 353392b3d7..943e9c585c 100644
--- a/net/vhost-vdpa.c
+++ b/net/vhost-vdpa.c
@@ -205,6 +205,7 @@ static int vhost_vdpa_add(NetClientState *ncs, void *be,
     options.get_acked_features = NULL;
     options.save_acked_features = NULL;
     options.max_tx_queue_size = VIRTQUEUE_MAX_SIZE;
+    options.is_vhost_user = false;
 
     net = vhost_net_init(&options);
     if (!net) {

From 854ee02b22220377f3fa3806adf7e0718c3a5c5a Mon Sep 17 00:00:00 2001
From: Laurent Vivier <lvivier@redhat.com>
Date: Wed, 9 Jul 2025 10:24:24 +0200
Subject: [PATCH 2229/2760] net: Add passt network backend

This commit introduces support for passt as a new network backend.
passt is an unprivileged, user-mode networking solution that provides
connectivity for virtual machines by launching an external helper process.

The implementation reuses the generic stream data handling logic. It
launches the passt binary using GSubprocess, passing it a file
descriptor from a socketpair() for communication. QEMU connects to
the other end of the socket pair to establish the network data stream.

The PID of the passt daemon is tracked via a temporary file to
ensure it is terminated when QEMU exits.

Signed-off-by: Laurent Vivier <lvivier@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 docs/system/devices/net.rst   |  40 +++-
 hmp-commands.hx               |   3 +
 meson.build                   |   6 +
 meson_options.txt             |   2 +
 net/clients.h                 |   4 +
 net/hub.c                     |   3 +
 net/meson.build               |   3 +
 net/net.c                     |   4 +
 net/passt.c                   | 407 ++++++++++++++++++++++++++++++++++
 qapi/net.json                 | 115 ++++++++++
 qemu-options.hx               | 145 +++++++++++-
 scripts/meson-buildoptions.sh |   3 +
 12 files changed, 731 insertions(+), 4 deletions(-)
 create mode 100644 net/passt.c

diff --git a/docs/system/devices/net.rst b/docs/system/devices/net.rst
index a3efbdcabd..c586ee0f40 100644
--- a/docs/system/devices/net.rst
+++ b/docs/system/devices/net.rst
@@ -85,13 +85,49 @@ passt doesn't require any capability or privilege. passt has
 better performance than ``-net user``, full IPv6 support and better security
 as it's a daemon that is not executed in QEMU context.
 
-passt can be connected to QEMU either by using a socket
-(``-netdev stream``) or using the vhost-user interface (``-netdev vhost-user``).
+passt_ can be used in the same way as the user backend (using ``-net passt``,
+``-netdev passt`` or ``-nic passt``) or it can be launched manually and
+connected to QEMU either by using a socket (``-netdev stream``) or by using
+the vhost-user interface (``-netdev vhost-user``).
+
+Using ``-netdev stream`` or ``-netdev vhost-user`` will allow the user to
+enable functionalities not available through the passt backend interface
+(like migration).
+
 See `passt(1)`_ for more details on passt.
 
 .. _passt: https://passt.top/
 .. _passt(1): https://passt.top/builds/latest/web/passt.1.html
 
+To use the passt backend interface
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+There is no need to start the daemon as QEMU will do it for you.
+
+passt is started in the socket-based mode.
+
+.. parsed-literal::
+   |qemu_system| [...OPTIONS...] -nic passt
+
+   (qemu) info network
+   e1000e.0: index=0,type=nic,model=e1000e,macaddr=52:54:00:12:34:56
+    \ #net071: index=0,type=passt,stream,connected to pid 24846
+
+.. parsed-literal::
+   |qemu_system| [...OPTIONS...] -net nic -net passt,tcp-ports=10001,udp-ports=10001
+
+   (qemu) info network
+   hub 0
+    \ hub0port1: #net136: index=0,type=passt,stream,connected to pid 25204
+    \ hub0port0: e1000e.0: index=0,type=nic,model=e1000e,macaddr=52:54:00:12:34:56
+
+.. parsed-literal::
+   |qemu_system| [...OPTIONS...] -netdev passt,id=netdev0 -device virtio-net,mac=9a:2b:2c:2d:2e:2f,id=virtio0,netdev=netdev0
+
+   (qemu) info network
+   virtio0: index=0,type=nic,model=virtio-net-pci,macaddr=9a:2b:2c:2d:2e:2f
+    \ netdev0: index=0,type=passt,stream,connected to pid 25428
+
 To use socket based passt interface:
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
diff --git a/hmp-commands.hx b/hmp-commands.hx
index 06746f0afc..d0e4f35a30 100644
--- a/hmp-commands.hx
+++ b/hmp-commands.hx
@@ -1287,6 +1287,9 @@ ERST
         .name       = "netdev_add",
         .args_type  = "netdev:O",
         .params     = "[user|tap|socket|stream|dgram|vde|bridge|hubport|netmap|vhost-user"
+#ifdef CONFIG_PASST
+                      "|passt"
+#endif
 #ifdef CONFIG_AF_XDP
                       "|af-xdp"
 #endif
diff --git a/meson.build b/meson.build
index b5f74aa37a..2adb22f198 100644
--- a/meson.build
+++ b/meson.build
@@ -1285,6 +1285,10 @@ if not get_option('slirp').auto() or have_system
   endif
 endif
 
+enable_passt = get_option('passt') \
+  .require(host_os == 'linux', error_message: 'passt is supported only on Linux') \
+  .allowed()
+
 vde = not_found
 if not get_option('vde').auto() or have_system or have_tools
   vde = cc.find_library('vdeplug', has_headers: ['libvdeplug.h'],
@@ -2538,6 +2542,7 @@ if seccomp.found()
   config_host_data.set('CONFIG_SECCOMP_SYSRAWRC', seccomp_has_sysrawrc)
 endif
 config_host_data.set('CONFIG_PIXMAN', pixman.found())
+config_host_data.set('CONFIG_PASST', enable_passt)
 config_host_data.set('CONFIG_SLIRP', slirp.found())
 config_host_data.set('CONFIG_SNAPPY', snappy.found())
 config_host_data.set('CONFIG_SOLARIS', host_os == 'sunos')
@@ -4926,6 +4931,7 @@ if host_os == 'darwin'
   summary_info += {'vmnet.framework support': vmnet}
 endif
 summary_info += {'AF_XDP support':    libxdp}
+summary_info += {'passt support':     enable_passt}
 summary_info += {'slirp support':     slirp}
 summary_info += {'vde support':       vde}
 summary_info += {'netmap support':    have_netmap}
diff --git a/meson_options.txt b/meson_options.txt
index a442be2995..3146eec194 100644
--- a/meson_options.txt
+++ b/meson_options.txt
@@ -234,6 +234,8 @@ option('pixman', type : 'feature', value : 'auto',
        description: 'pixman support')
 option('slirp', type: 'feature', value: 'auto',
        description: 'libslirp user mode network backend support')
+option('passt', type: 'feature', value: 'auto',
+       description: 'passt network backend support')
 option('vde', type : 'feature', value : 'auto',
        description: 'vde network backend support')
 option('vmnet', type : 'feature', value : 'auto',
diff --git a/net/clients.h b/net/clients.h
index be53794582..e786ab4203 100644
--- a/net/clients.h
+++ b/net/clients.h
@@ -29,6 +29,10 @@
 int net_init_dump(const Netdev *netdev, const char *name,
                   NetClientState *peer, Error **errp);
 
+#ifdef CONFIG_PASST
+int net_init_passt(const Netdev *netdev, const char *name,
+                   NetClientState *peer, Error **errp);
+#endif
 #ifdef CONFIG_SLIRP
 int net_init_slirp(const Netdev *netdev, const char *name,
                    NetClientState *peer, Error **errp);
diff --git a/net/hub.c b/net/hub.c
index cba20ebd87..e3b58b1c4f 100644
--- a/net/hub.c
+++ b/net/hub.c
@@ -285,6 +285,9 @@ void net_hub_check_clients(void)
             case NET_CLIENT_DRIVER_NIC:
                 has_nic = 1;
                 break;
+#ifdef CONFIG_PASST
+            case NET_CLIENT_DRIVER_PASST:
+#endif
             case NET_CLIENT_DRIVER_USER:
             case NET_CLIENT_DRIVER_TAP:
             case NET_CLIENT_DRIVER_SOCKET:
diff --git a/net/meson.build b/net/meson.build
index bb3c011e5a..da6ea635e9 100644
--- a/net/meson.build
+++ b/net/meson.build
@@ -34,6 +34,9 @@ system_ss.add(when: 'CONFIG_TCG', if_true: files('filter-replay.c'))
 if have_l2tpv3
   system_ss.add(files('l2tpv3.c'))
 endif
+if enable_passt
+  system_ss.add(files('passt.c'))
+endif
 system_ss.add(when: slirp, if_true: files('slirp.c'))
 system_ss.add(when: vde, if_true: files('vde.c'))
 if have_netmap
diff --git a/net/net.c b/net/net.c
index cfa2d8e958..90f69fdf39 100644
--- a/net/net.c
+++ b/net/net.c
@@ -1248,6 +1248,9 @@ static int (* const net_client_init_fun[NET_CLIENT_DRIVER__MAX])(
     const char *name,
     NetClientState *peer, Error **errp) = {
         [NET_CLIENT_DRIVER_NIC]       = net_init_nic,
+#ifdef CONFIG_PASST
+        [NET_CLIENT_DRIVER_PASST]     = net_init_passt,
+#endif
 #ifdef CONFIG_SLIRP
         [NET_CLIENT_DRIVER_USER]      = net_init_slirp,
 #endif
@@ -1353,6 +1356,7 @@ void show_netdevs(void)
         "dgram",
         "hubport",
         "tap",
+        "passt",
 #ifdef CONFIG_SLIRP
         "user",
 #endif
diff --git a/net/passt.c b/net/passt.c
new file mode 100644
index 0000000000..0a4a1ba6aa
--- /dev/null
+++ b/net/passt.c
@@ -0,0 +1,407 @@
+/*
+ * passt network backend
+ *
+ * Copyright Red Hat
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+#include "qemu/osdep.h"
+#include <glib/gstdio.h>
+#include <gio/gio.h>
+#include "net/net.h"
+#include "clients.h"
+#include "qapi/error.h"
+#include "io/net-listener.h"
+#include "stream_data.h"
+
+typedef struct NetPasstState {
+    NetStreamData data;
+    GPtrArray *args;
+    gchar *pidfile;
+    pid_t pid;
+} NetPasstState;
+
+static int net_passt_stream_start(NetPasstState *s, Error **errp);
+
+static void net_passt_cleanup(NetClientState *nc)
+{
+    NetPasstState *s = DO_UPCAST(NetPasstState, data.nc, nc);
+
+    kill(s->pid, SIGTERM);
+    g_remove(s->pidfile);
+    g_free(s->pidfile);
+    g_ptr_array_free(s->args, TRUE);
+}
+
+static ssize_t net_passt_receive(NetClientState *nc, const uint8_t *buf,
+                                  size_t size)
+{
+    NetStreamData *d = DO_UPCAST(NetStreamData, nc, nc);
+
+    return net_stream_data_receive(d, buf, size);
+}
+
+static gboolean net_passt_send(QIOChannel *ioc, GIOCondition condition,
+                                gpointer data)
+{
+    if (net_stream_data_send(ioc, condition, data) == G_SOURCE_REMOVE) {
+        NetPasstState *s = DO_UPCAST(NetPasstState, data, data);
+        Error *error;
+
+        /* we need to restart passt */
+        kill(s->pid, SIGTERM);
+        if (net_passt_stream_start(s, &error) == -1) {
+            error_report_err(error);
+        }
+
+        return G_SOURCE_REMOVE;
+    }
+
+    return G_SOURCE_CONTINUE;
+}
+
+static NetClientInfo net_passt_info = {
+    .type = NET_CLIENT_DRIVER_PASST,
+    .size = sizeof(NetPasstState),
+    .receive = net_passt_receive,
+    .cleanup = net_passt_cleanup,
+};
+
+static void net_passt_client_connected(QIOTask *task, gpointer opaque)
+{
+    NetPasstState *s = opaque;
+
+    if (net_stream_data_client_connected(task, &s->data) == 0) {
+        qemu_set_info_str(&s->data.nc, "stream,connected to pid %d", s->pid);
+    }
+}
+
+static int net_passt_start_daemon(NetPasstState *s, int sock, Error **errp)
+{
+    g_autoptr(GSubprocess) daemon = NULL;
+    g_autofree gchar *contents = NULL;
+    g_autoptr(GError) error = NULL;
+    GSubprocessLauncher *launcher;
+
+    qemu_set_info_str(&s->data.nc, "launching passt");
+
+    launcher = g_subprocess_launcher_new(G_SUBPROCESS_FLAGS_NONE);
+    g_subprocess_launcher_take_fd(launcher, sock, 3);
+
+    daemon =  g_subprocess_launcher_spawnv(launcher,
+                                           (const gchar *const *)s->args->pdata,
+                                           &error);
+    g_object_unref(launcher);
+
+    if (!daemon) {
+        error_setg(errp, "Error creating daemon: %s", error->message);
+        return -1;
+    }
+
+    if (!g_subprocess_wait(daemon, NULL, &error)) {
+        error_setg(errp, "Error waiting for daemon: %s", error->message);
+        return -1;
+    }
+
+    if (g_subprocess_get_if_exited(daemon) &&
+        g_subprocess_get_exit_status(daemon)) {
+        return -1;
+    }
+
+    if (!g_file_get_contents(s->pidfile, &contents, NULL, &error)) {
+        error_setg(errp, "Cannot read passt pid: %s", error->message);
+        return -1;
+    }
+
+    s->pid = (pid_t)g_ascii_strtoll(contents, NULL, 10);
+    if (s->pid <= 0) {
+        error_setg(errp, "File '%s' did not contain a valid PID.", s->pidfile);
+        return -1;
+    }
+
+    return 0;
+}
+
+static int net_passt_stream_start(NetPasstState *s, Error **errp)
+{
+    QIOChannelSocket *sioc;
+    SocketAddress *addr;
+    int sv[2];
+
+    if (socketpair(PF_UNIX, SOCK_STREAM, 0, sv) == -1) {
+        error_setg_errno(errp, errno, "socketpair() failed");
+        return -1;
+    }
+
+    /* connect to passt */
+    qemu_set_info_str(&s->data.nc, "connecting to passt");
+
+    /* create socket channel */
+    sioc = qio_channel_socket_new();
+    s->data.ioc = QIO_CHANNEL(sioc);
+    s->data.nc.link_down = true;
+    s->data.send = net_passt_send;
+
+    addr = g_new0(SocketAddress, 1);
+    addr->type = SOCKET_ADDRESS_TYPE_FD;
+    addr->u.fd.str = g_strdup_printf("%d", sv[0]);
+
+    qio_channel_socket_connect_async(sioc, addr,
+                                     net_passt_client_connected, s,
+                                     NULL, NULL);
+
+    qapi_free_SocketAddress(addr);
+
+    /* start passt */
+    if (net_passt_start_daemon(s, sv[1], errp) == -1) {
+        close(sv[0]);
+        close(sv[1]);
+        return -1;
+    }
+    close(sv[1]);
+
+    return 0;
+}
+
+static GPtrArray *net_passt_decode_args(const NetDevPasstOptions *passt,
+                                        gchar *pidfile, Error **errp)
+{
+    GPtrArray *args = g_ptr_array_new_with_free_func(g_free);
+
+    if (passt->path) {
+        g_ptr_array_add(args, g_strdup(passt->path));
+    } else {
+        g_ptr_array_add(args, g_strdup("passt"));
+    }
+
+    /* by default, be quiet */
+    if (!passt->has_quiet || passt->quiet) {
+        g_ptr_array_add(args, g_strdup("--quiet"));
+    }
+
+    if (passt->has_mtu) {
+        g_ptr_array_add(args, g_strdup("--mtu"));
+        g_ptr_array_add(args, g_strdup_printf("%"PRId64, passt->mtu));
+    }
+
+    if (passt->address) {
+        g_ptr_array_add(args, g_strdup("--address"));
+        g_ptr_array_add(args, g_strdup(passt->address));
+    }
+
+    if (passt->netmask) {
+        g_ptr_array_add(args, g_strdup("--netmask"));
+        g_ptr_array_add(args, g_strdup(passt->netmask));
+    }
+
+    if (passt->mac) {
+        g_ptr_array_add(args, g_strdup("--mac-addr"));
+        g_ptr_array_add(args, g_strdup(passt->mac));
+    }
+
+    if (passt->gateway) {
+        g_ptr_array_add(args, g_strdup("--gateway"));
+        g_ptr_array_add(args, g_strdup(passt->gateway));
+    }
+
+    if (passt->interface) {
+        g_ptr_array_add(args, g_strdup("--interface"));
+        g_ptr_array_add(args, g_strdup(passt->interface));
+    }
+
+    if (passt->outbound) {
+        g_ptr_array_add(args, g_strdup("--outbound"));
+        g_ptr_array_add(args, g_strdup(passt->outbound));
+    }
+
+    if (passt->outbound_if4) {
+        g_ptr_array_add(args, g_strdup("--outbound-if4"));
+        g_ptr_array_add(args, g_strdup(passt->outbound_if4));
+    }
+
+    if (passt->outbound_if6) {
+        g_ptr_array_add(args, g_strdup("--outbound-if6"));
+        g_ptr_array_add(args, g_strdup(passt->outbound_if6));
+    }
+
+    if (passt->dns) {
+        g_ptr_array_add(args, g_strdup("--dns"));
+        g_ptr_array_add(args, g_strdup(passt->dns));
+    }
+    if (passt->fqdn) {
+        g_ptr_array_add(args, g_strdup("--fqdn"));
+        g_ptr_array_add(args, g_strdup(passt->fqdn));
+    }
+
+    if (passt->has_dhcp_dns && !passt->dhcp_dns) {
+        g_ptr_array_add(args, g_strdup("--no-dhcp-dns"));
+    }
+
+    if (passt->has_dhcp_search && !passt->dhcp_search) {
+        g_ptr_array_add(args, g_strdup("--no-dhcp-search"));
+    }
+
+    if (passt->map_host_loopback) {
+        g_ptr_array_add(args, g_strdup("--map-host-loopback"));
+        g_ptr_array_add(args, g_strdup(passt->map_host_loopback));
+    }
+
+    if (passt->map_guest_addr) {
+        g_ptr_array_add(args, g_strdup("--map-guest-addr"));
+        g_ptr_array_add(args, g_strdup(passt->map_guest_addr));
+    }
+
+    if (passt->dns_forward) {
+        g_ptr_array_add(args, g_strdup("--dns-forward"));
+        g_ptr_array_add(args, g_strdup(passt->dns_forward));
+    }
+
+    if (passt->dns_host) {
+        g_ptr_array_add(args, g_strdup("--dns-host"));
+        g_ptr_array_add(args, g_strdup(passt->dns_host));
+    }
+
+    if (passt->has_tcp && !passt->tcp) {
+        g_ptr_array_add(args, g_strdup("--no-tcp"));
+    }
+
+    if (passt->has_udp && !passt->udp) {
+        g_ptr_array_add(args, g_strdup("--no-udp"));
+    }
+
+    if (passt->has_icmp && !passt->icmp) {
+        g_ptr_array_add(args, g_strdup("--no-icmp"));
+    }
+
+    if (passt->has_dhcp && !passt->dhcp) {
+        g_ptr_array_add(args, g_strdup("--no-dhcp"));
+    }
+
+    if (passt->has_ndp && !passt->ndp) {
+        g_ptr_array_add(args, g_strdup("--no-ndp"));
+    }
+    if (passt->has_dhcpv6 && !passt->dhcpv6) {
+        g_ptr_array_add(args, g_strdup("--no-dhcpv6"));
+    }
+
+    if (passt->has_ra && !passt->ra) {
+        g_ptr_array_add(args, g_strdup("--no-ra"));
+    }
+
+    if (passt->has_freebind && passt->freebind) {
+        g_ptr_array_add(args, g_strdup("--freebind"));
+    }
+
+    if (passt->has_ipv4 && !passt->ipv4) {
+        g_ptr_array_add(args, g_strdup("--ipv6-only"));
+    }
+
+    if (passt->has_ipv6 && !passt->ipv6) {
+        g_ptr_array_add(args, g_strdup("--ipv4-only"));
+    }
+
+    if (passt->has_search && passt->search) {
+        const StringList *list = passt->search;
+        GString *domains = g_string_new(list->value->str);
+
+        list = list->next;
+        while (list) {
+            g_string_append(domains, " ");
+            g_string_append(domains, list->value->str);
+            list = list->next;
+        }
+
+        g_ptr_array_add(args, g_strdup("--search"));
+        g_ptr_array_add(args, g_string_free(domains, FALSE));
+    }
+
+    if (passt->has_tcp_ports && passt->tcp_ports) {
+        const StringList *list = passt->tcp_ports;
+        GString *tcp_ports = g_string_new(list->value->str);
+
+        list = list->next;
+        while (list) {
+            g_string_append(tcp_ports, ",");
+            g_string_append(tcp_ports, list->value->str);
+            list = list->next;
+        }
+
+        g_ptr_array_add(args, g_strdup("--tcp-ports"));
+        g_ptr_array_add(args, g_string_free(tcp_ports, FALSE));
+    }
+
+    if (passt->has_udp_ports && passt->udp_ports) {
+        const StringList *list = passt->udp_ports;
+        GString *udp_ports = g_string_new(list->value->str);
+
+        list = list->next;
+        while (list) {
+            g_string_append(udp_ports, ",");
+            g_string_append(udp_ports, list->value->str);
+            list = list->next;
+        }
+
+        g_ptr_array_add(args, g_strdup("--udp-ports"));
+        g_ptr_array_add(args, g_string_free(udp_ports, FALSE));
+    }
+
+    if (passt->has_param && passt->param) {
+        const StringList *list = passt->param;
+
+        while (list) {
+            g_ptr_array_add(args, g_strdup(list->value->str));
+            list = list->next;
+        }
+    }
+
+    /* provide a pid file to be able to kil passt on exit */
+    g_ptr_array_add(args, g_strdup("--pid"));
+    g_ptr_array_add(args, g_strdup(pidfile));
+
+    /* g_subprocess_launcher_take_fd() will set the socket on fd 3 */
+    g_ptr_array_add(args, g_strdup("--fd"));
+    g_ptr_array_add(args, g_strdup("3"));
+
+    g_ptr_array_add(args, NULL);
+
+    return args;
+}
+
+int net_init_passt(const Netdev *netdev, const char *name,
+                   NetClientState *peer, Error **errp)
+{
+    g_autoptr(GError) error = NULL;
+    NetClientState *nc;
+    NetPasstState *s;
+    GPtrArray *args;
+    gchar *pidfile;
+    int pidfd;
+
+    assert(netdev->type == NET_CLIENT_DRIVER_PASST);
+
+    pidfd = g_file_open_tmp("passt-XXXXXX.pid", &pidfile, &error);
+    if (pidfd == -1) {
+        error_setg(errp, "Failed to create temporary file: %s", error->message);
+        return -1;
+    }
+    close(pidfd);
+
+    args = net_passt_decode_args(&netdev->u.passt, pidfile, errp);
+    if (args == NULL) {
+        g_free(pidfile);
+        return -1;
+    }
+
+    nc = qemu_new_net_client(&net_passt_info, peer, "passt", name);
+    s = DO_UPCAST(NetPasstState, data.nc, nc);
+
+    s->args = args;
+    s->pidfile = pidfile;
+
+    if (net_passt_stream_start(s, errp) == -1) {
+        qemu_del_net_client(nc);
+        return -1;
+    }
+
+    return 0;
+}
diff --git a/qapi/net.json b/qapi/net.json
index 97ea183981..24999f6752 100644
--- a/qapi/net.json
+++ b/qapi/net.json
@@ -112,6 +112,116 @@
   'data': {
     'str': 'str' } }
 
+##
+# @NetDevPasstOptions:
+#
+# Unprivileged user-mode network connectivity using passt
+#
+# @path: Filename of the passt program to run (by default 'passt', and use PATH)
+#
+# @quiet: don't print informational messages (default, passed as '--quiet')
+#
+# @mtu: assign MTU via DHCP/NDP
+#
+# @address: IPv4 or IPv6 address
+#
+# @netmask: IPv4 mask
+#
+# @mac: source MAC address
+#
+# @gateway: IPv4 or IPv6 address as gateway
+#
+# @interface: interface for addresses and routes
+#
+# @outbound: bind to address as outbound source
+#
+# @outbound-if4: bind to outbound interface for IPv4
+#
+# @outbound-if6: bind to outbound interface for IPv6
+#
+# @dns: IPv4 or IPv6 address as DNS
+#
+# @search: search domains
+#
+# @fqdn: FQDN to configure client with
+#
+# @dhcp-dns: enable/disable DNS list in DHCP/DHCPv6/NDP
+#
+# @dhcp-search: enable/disable list in DHCP/DHCPv6/NDP
+#
+# @map-host-loopback: addresse to refer to host
+#
+# @map-guest-addr: addr to translate to guest's address
+#
+# @dns-forward: forward DNS queries sent to
+#
+# @dns-host: host nameserver to direct queries to
+#
+# @tcp: enable/disable TCP
+#
+# @udp: enable/disable UDP
+#
+# @icmp: enable/disable ICMP
+#
+# @dhcp: enable/disable DHCP
+#
+# @ndp: enable/disable NDP
+#
+# @dhcpv6: enable/disable DHCPv6
+#
+# @ra: enable/disable route advertisements
+#
+# @freebind: bind to any address for forwarding
+#
+# @ipv4: enable/disable IPv4
+#
+# @ipv6: enable/disable IPv6
+#
+# @tcp-ports: TCP ports to forward
+#
+# @udp-ports: UDP ports to forward
+#
+# @param: parameter to pass to passt command
+#
+# Since: 10.1
+##
+{ 'struct': 'NetDevPasstOptions',
+  'data': {
+    '*path':               'str',
+    '*quiet':              'bool',
+    '*mtu':                'int',
+    '*address':            'str',
+    '*netmask':            'str',
+    '*mac':                'str',
+    '*gateway':            'str',
+    '*interface':          'str',
+    '*outbound':           'str',
+    '*outbound-if4':       'str',
+    '*outbound-if6':       'str',
+    '*dns':                'str',
+    '*search':             ['String'],
+    '*fqdn':               'str',
+    '*dhcp-dns':           'bool',
+    '*dhcp-search':        'bool',
+    '*map-host-loopback':  'str',
+    '*map-guest-addr':     'str',
+    '*dns-forward':        'str',
+    '*dns-host':           'str',
+    '*tcp':                'bool',
+    '*udp':                'bool',
+    '*icmp':               'bool',
+    '*dhcp':               'bool',
+    '*ndp':                'bool',
+    '*dhcpv6':             'bool',
+    '*ra':                 'bool',
+    '*freebind':           'bool',
+    '*ipv4':               'bool',
+    '*ipv6':               'bool',
+    '*tcp-ports':          ['String'],
+    '*udp-ports':          ['String'],
+    '*param':             ['String'] },
+    'if': 'CONFIG_PASST' }
+
 ##
 # @NetdevUserOptions:
 #
@@ -729,12 +839,15 @@
 #
 # @af-xdp: since 8.2
 #
+# @passt: since 10.1
+#
 # Since: 2.7
 ##
 { 'enum': 'NetClientDriver',
   'data': [ 'none', 'nic', 'user', 'tap', 'l2tpv3', 'socket', 'stream',
             'dgram', 'vde', 'bridge', 'hubport', 'netmap', 'vhost-user',
             'vhost-vdpa',
+            { 'name': 'passt', 'if': 'CONFIG_PASST' },
             { 'name': 'af-xdp', 'if': 'CONFIG_AF_XDP' },
             { 'name': 'vmnet-host', 'if': 'CONFIG_VMNET' },
             { 'name': 'vmnet-shared', 'if': 'CONFIG_VMNET' },
@@ -756,6 +869,8 @@
   'discriminator': 'type',
   'data': {
     'nic':      'NetLegacyNicOptions',
+    'passt':    { 'type': 'NetDevPasstOptions',
+                  'if': 'CONFIG_PASST' },
     'user':     'NetdevUserOptions',
     'tap':      'NetdevTapOptions',
     'l2tpv3':   'NetdevL2TPv3Options',
diff --git a/qemu-options.hx b/qemu-options.hx
index 1f862b19a6..e8252cd5e8 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -2796,6 +2796,24 @@ DEFHEADING()
 DEFHEADING(Network options:)
 
 DEF("netdev", HAS_ARG, QEMU_OPTION_netdev,
+#ifdef CONFIG_PASST
+    "-netdev passt,id=str[,path=file][,quiet=on|off]\n"
+    "[,mtu=mtu][,address=addr][,netmask=mask][,mac=addr][,gateway=addr]\n"
+    "          [,interface=name][,outbound=address][,outbound-if4=name]\n"
+    "          [,outbound-if6=name][,dns=addr][,search=list][,fqdn=name]\n"
+    "          [,dhcp-dns=on|off][,dhcp-search=on|off][,map-host-loopback=addr]\n"
+    "          [,map-guest-addr=addr][,dns-forward=addr][,dns-host=addr]\n"
+    "          [,tcp=on|off][,udp=on|off][,icmp=on|off][,dhcp=on|off]\n"
+    "          [,ndp=on|off][,dhcpv6=on|off][,ra=on|off][,freebind=on|off]\n"
+    "          [,ipv4=on|off][,ipv6=on|off][,tcp-ports=spec][,udp-ports=spec]\n"
+    "          [,param=list]\n"
+    "                configure a passt network backend with ID 'str'\n"
+    "                if 'path' is not provided 'passt' will be started according to PATH\n"
+    "                by default, informational message of passt are not displayed (quiet=on)\n"
+    "                to display this message, use 'quiet=off'\n"
+    "                for details on other options, refer to passt(1)\n"
+    "                'param' allows to pass any option defined by passt(1)\n"
+#endif
 #ifdef CONFIG_SLIRP
     "-netdev user,id=str[,ipv4=on|off][,net=addr[/mask]][,host=addr]\n"
     "         [,ipv6=on|off][,ipv6-net=addr[/int]][,ipv6-host=addr]\n"
@@ -2952,6 +2970,9 @@ DEF("netdev", HAS_ARG, QEMU_OPTION_netdev,
     "                configure a hub port on the hub with ID 'n'\n", QEMU_ARCH_ALL)
 DEF("nic", HAS_ARG, QEMU_OPTION_nic,
     "-nic [tap|bridge|"
+#ifdef CONFIG_PASST
+    "passt|"
+#endif
 #ifdef CONFIG_SLIRP
     "user|"
 #endif
@@ -2984,6 +3005,9 @@ DEF("net", HAS_ARG, QEMU_OPTION_net,
     "                configure or create an on-board (or machine default) NIC and\n"
     "                connect it to hub 0 (please use -nic unless you need a hub)\n"
     "-net ["
+#ifdef CONFIG_PASST
+    "passt|"
+#endif
 #ifdef CONFIG_SLIRP
     "user|"
 #endif
@@ -3005,7 +3029,7 @@ DEF("net", HAS_ARG, QEMU_OPTION_net,
     "                old way to initialize a host network interface\n"
     "                (use the -netdev option if possible instead)\n", QEMU_ARCH_ALL)
 SRST
-``-nic [tap|bridge|user|l2tpv3|vde|netmap|af-xdp|vhost-user|socket][,...][,mac=macaddr][,model=mn]``
+``-nic [tap|passt|bridge|user|l2tpv3|vde|netmap|af-xdp|vhost-user|socket][,...][,mac=macaddr][,model=mn]``
     This option is a shortcut for configuring both the on-board
     (default) guest NIC hardware and the host network backend in one go.
     The host backend options are the same as with the corresponding
@@ -3027,6 +3051,123 @@ SRST
     network backend) which is activated if no other networking options
     are provided.
 
+``-netdev passt,id=str[,option][,...]``
+    Configure a passt network backend which requires no administrator
+    privilege to run. Valid options are:
+
+    ``id=id``
+        Assign symbolic name for use in monitor commands.
+
+    ``path=file``
+        Filename of the passt program to run. If it is not provided,
+        passt command will be started with the help of the PATH environment
+        variable.
+
+    ``quiet=on|off``
+        By default, ``quiet=on`` to disable informational message from
+        passt. ``quiet=on`` is passed as ``--quiet`` to passt.
+
+    ``@mtu``
+        Assign MTU via DHCP/NDP
+
+    ``address``
+        IPv4 or IPv6 address
+
+    ``netmask``
+        IPv4 mask
+
+    ``mac``
+        source MAC address
+
+    ``gateway``
+        IPv4 or IPv6 address as gateway
+
+    ``interface``
+        Interface for addresses and routes
+
+    ``outbound``
+        Bind to address as outbound source
+
+    ``outbound-if4``
+        Bind to outbound interface for IPv4
+
+    ``outbound-if6``
+        Bind to outbound interface for IPv6
+
+    ``dns``
+        IPv4 or IPv6 address as DNS
+
+    ``search``
+        Search domains
+
+    ``fqdn``
+        FQDN to configure client with
+
+    ``dhcp-dns``
+        Enable/disable DNS list in DHCP/DHCPv6/NDP
+
+    ``dhcp-search``
+        Enable/disable list in DHCP/DHCPv6/NDP
+
+    ``map-host-loopback``
+        Addresse to refer to host
+
+    ``map-guest-addr``
+        Addr to translate to guest's address
+
+    ``dns-forward``
+        Forward DNS queries sent to
+
+    ``dns-host``
+        Host nameserver to direct queries to
+
+    ``tcp``
+        Enable/disable TCP
+
+    ``udp``
+        Enable/disable UDP
+
+    ``icmp``
+        Enable/disable ICMP
+
+    ``dhcp``
+        Enable/disable DHCP
+
+    ``ndp``
+        Enable/disable NDP
+
+    ``dhcpv6``
+        Enable/disable DHCPv6
+
+    ``ra``
+        Enable/disable route advertisements
+
+    ``freebind``
+        Bind to any address for forwarding
+
+    ``ipv4``
+        Enable/disable IPv4
+
+    ``ipv6``
+        Enable/disable IPv6
+
+    ``tcp-ports``
+        TCP ports to forward
+
+    ``udp-ports``
+        UDP ports to forward
+
+    ``param=string``
+         ``string`` will be passed to passt has a command line parameter,
+         we can have multiple occurences of the ``param`` parameter to
+         pass multiple parameters to passt.
+
+         For instance, to pass ``--trace --log=trace.log``:
+
+    .. parsed-literal::
+
+        |qemu_system| -nic passt,param=--trace,param=--log=trace.log
+
 ``-netdev user,id=id[,option][,option][,...]``
     Configure user mode host network backend which requires no
     administrator privilege to run. Valid options are:
@@ -3711,7 +3852,7 @@ SRST
     Use ``-net nic,model=help`` for a list of available devices for your
     target.
 
-``-net user|tap|bridge|socket|l2tpv3|vde[,...][,name=name]``
+``-net user|passt|tap|bridge|socket|l2tpv3|vde[,...][,name=name]``
     Configure a host network backend (with the options corresponding to
     the same ``-netdev`` option) and connect it to the emulated hub 0
     (the default hub). Use name to specify the name of the hub port.
diff --git a/scripts/meson-buildoptions.sh b/scripts/meson-buildoptions.sh
index 73e0770f42..bb3e34d852 100644
--- a/scripts/meson-buildoptions.sh
+++ b/scripts/meson-buildoptions.sh
@@ -162,6 +162,7 @@ meson_options_help() {
   printf "%s\n" '  oss             OSS sound support'
   printf "%s\n" '  pa              PulseAudio sound support'
   printf "%s\n" '  parallels       parallels image format support'
+  printf "%s\n" '  passt           passt network backend support'
   printf "%s\n" '  pipewire        PipeWire sound support'
   printf "%s\n" '  pixman          pixman support'
   printf "%s\n" '  plugins         TCG plugins via shared library loading'
@@ -422,6 +423,8 @@ _meson_option_parse() {
     --disable-pa) printf "%s" -Dpa=disabled ;;
     --enable-parallels) printf "%s" -Dparallels=enabled ;;
     --disable-parallels) printf "%s" -Dparallels=disabled ;;
+    --enable-passt) printf "%s" -Dpasst=enabled ;;
+    --disable-passt) printf "%s" -Dpasst=disabled ;;
     --enable-pipewire) printf "%s" -Dpipewire=enabled ;;
     --disable-pipewire) printf "%s" -Dpipewire=disabled ;;
     --enable-pixman) printf "%s" -Dpixman=enabled ;;

From da703b06a52bfb5fe1a77b0eddbb8d68d3f70762 Mon Sep 17 00:00:00 2001
From: Laurent Vivier <lvivier@redhat.com>
Date: Wed, 9 Jul 2025 10:24:25 +0200
Subject: [PATCH 2230/2760] net/passt: Implement vhost-user backend support

This commit adds support for the vhost-user interface to the passt
network backend, enabling high-performance, accelerated networking for
guests using passt.

The passt backend can now operate in a vhost-user mode, where it
communicates with the guest's virtio-net device over a socket pair
using the vhost-user protocol. This offloads the datapath from the
main QEMU loop, significantly improving network performance.

When the vhost-user=on option is used with -netdev passt, the new
vhost initialization path is taken instead of the standard
stream-based connection.

Signed-off-by: Laurent Vivier <lvivier@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 docs/system/devices/net.rst |  12 +-
 net/passt.c                 | 346 ++++++++++++++++++++++++++++++++++++
 qapi/net.json               |   3 +
 qemu-options.hx             |  10 +-
 4 files changed, 369 insertions(+), 2 deletions(-)

diff --git a/docs/system/devices/net.rst b/docs/system/devices/net.rst
index c586ee0f40..4d787c3aeb 100644
--- a/docs/system/devices/net.rst
+++ b/docs/system/devices/net.rst
@@ -104,7 +104,7 @@ To use the passt backend interface
 
 There is no need to start the daemon as QEMU will do it for you.
 
-passt is started in the socket-based mode.
+By default, passt will be started in the socket-based mode.
 
 .. parsed-literal::
    |qemu_system| [...OPTIONS...] -nic passt
@@ -128,6 +128,16 @@ passt is started in the socket-based mode.
    virtio0: index=0,type=nic,model=virtio-net-pci,macaddr=9a:2b:2c:2d:2e:2f
     \ netdev0: index=0,type=passt,stream,connected to pid 25428
 
+To use the vhost-based interface, add the ``vhost-user=on`` parameter and
+select the virtio-net device:
+
+.. parsed-literal::
+   |qemu_system| [...OPTIONS...] -nic passt,model=virtio,vhost-user=on
+
+   (qemu) info network
+   virtio-net-pci.0: index=0,type=nic,model=virtio-net-pci,macaddr=52:54:00:12:34:56
+    \ #net006: index=0,type=passt,vhost-user,connected to pid 25731
+
 To use socket based passt interface:
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
diff --git a/net/passt.c b/net/passt.c
index 0a4a1ba6aa..6f616ba3c2 100644
--- a/net/passt.c
+++ b/net/passt.c
@@ -7,18 +7,75 @@
  */
 #include "qemu/osdep.h"
 #include <glib/gstdio.h>
+#include "qemu/error-report.h"
 #include <gio/gio.h>
 #include "net/net.h"
 #include "clients.h"
 #include "qapi/error.h"
 #include "io/net-listener.h"
+#include "chardev/char-fe.h"
+#include "net/vhost_net.h"
+#include "hw/virtio/vhost.h"
+#include "hw/virtio/vhost-user.h"
+#include "standard-headers/linux/virtio_net.h"
 #include "stream_data.h"
 
+#ifdef CONFIG_VHOST_USER
+static const int user_feature_bits[] = {
+    VIRTIO_F_NOTIFY_ON_EMPTY,
+    VIRTIO_F_NOTIFICATION_DATA,
+    VIRTIO_RING_F_INDIRECT_DESC,
+    VIRTIO_RING_F_EVENT_IDX,
+
+    VIRTIO_F_ANY_LAYOUT,
+    VIRTIO_F_VERSION_1,
+    VIRTIO_NET_F_CSUM,
+    VIRTIO_NET_F_GUEST_CSUM,
+    VIRTIO_NET_F_GSO,
+    VIRTIO_NET_F_GUEST_TSO4,
+    VIRTIO_NET_F_GUEST_TSO6,
+    VIRTIO_NET_F_GUEST_ECN,
+    VIRTIO_NET_F_GUEST_UFO,
+    VIRTIO_NET_F_HOST_TSO4,
+    VIRTIO_NET_F_HOST_TSO6,
+    VIRTIO_NET_F_HOST_ECN,
+    VIRTIO_NET_F_HOST_UFO,
+    VIRTIO_NET_F_MRG_RXBUF,
+    VIRTIO_NET_F_MTU,
+    VIRTIO_F_IOMMU_PLATFORM,
+    VIRTIO_F_RING_PACKED,
+    VIRTIO_F_RING_RESET,
+    VIRTIO_F_IN_ORDER,
+    VIRTIO_NET_F_RSS,
+    VIRTIO_NET_F_RSC_EXT,
+    VIRTIO_NET_F_HASH_REPORT,
+    VIRTIO_NET_F_GUEST_USO4,
+    VIRTIO_NET_F_GUEST_USO6,
+    VIRTIO_NET_F_HOST_USO,
+
+    /* This bit implies RARP isn't sent by QEMU out of band */
+    VIRTIO_NET_F_GUEST_ANNOUNCE,
+
+    VIRTIO_NET_F_MQ,
+
+    VHOST_INVALID_FEATURE_BIT
+};
+#endif
+
 typedef struct NetPasstState {
     NetStreamData data;
     GPtrArray *args;
     gchar *pidfile;
     pid_t pid;
+#ifdef CONFIG_VHOST_USER
+    /* vhost user */
+    VhostUserState *vhost_user;
+    VHostNetState *vhost_net;
+    CharBackend vhost_chr;
+    guint vhost_watch;
+    uint64_t acked_features;
+    bool started;
+#endif
 } NetPasstState;
 
 static int net_passt_stream_start(NetPasstState *s, Error **errp);
@@ -27,6 +84,24 @@ static void net_passt_cleanup(NetClientState *nc)
 {
     NetPasstState *s = DO_UPCAST(NetPasstState, data.nc, nc);
 
+#ifdef CONFIG_VHOST_USER
+    if (s->vhost_net) {
+        vhost_net_cleanup(s->vhost_net);
+        g_free(s->vhost_net);
+        s->vhost_net = NULL;
+    }
+    if (s->vhost_watch) {
+        g_source_remove(s->vhost_watch);
+        s->vhost_watch = 0;
+    }
+    qemu_chr_fe_deinit(&s->vhost_chr, true);
+    if (s->vhost_user) {
+        vhost_user_cleanup(s->vhost_user);
+        g_free(s->vhost_user);
+        s->vhost_user = NULL;
+    }
+#endif
+
     kill(s->pid, SIGTERM);
     g_remove(s->pidfile);
     g_free(s->pidfile);
@@ -60,11 +135,98 @@ static gboolean net_passt_send(QIOChannel *ioc, GIOCondition condition,
     return G_SOURCE_CONTINUE;
 }
 
+#ifdef CONFIG_VHOST_USER
+static int passt_set_vnet_endianness(NetClientState *nc, bool enable)
+{
+    assert(nc->info->type == NET_CLIENT_DRIVER_PASST);
+
+    return 0;
+}
+
+static bool passt_has_vnet_hdr(NetClientState *nc)
+{
+    NetPasstState *s = DO_UPCAST(NetPasstState, data.nc, nc);
+
+    assert(nc->info->type == NET_CLIENT_DRIVER_PASST);
+
+    return s->vhost_user != NULL;
+}
+
+static bool passt_has_ufo(NetClientState *nc)
+{
+    NetPasstState *s = DO_UPCAST(NetPasstState, data.nc, nc);
+
+    assert(nc->info->type == NET_CLIENT_DRIVER_PASST);
+
+    return s->vhost_user != NULL;
+}
+
+static bool passt_check_peer_type(NetClientState *nc, ObjectClass *oc,
+                                             Error **errp)
+{
+    NetPasstState *s = DO_UPCAST(NetPasstState, data.nc, nc);
+    const char *driver = object_class_get_name(oc);
+
+    assert(nc->info->type == NET_CLIENT_DRIVER_PASST);
+
+    if (s->vhost_user == NULL) {
+        return true;
+    }
+
+    if (!g_str_has_prefix(driver, "virtio-net-")) {
+        error_setg(errp, "vhost-user requires frontend driver virtio-net-*");
+        return false;
+    }
+
+    return true;
+}
+
+static struct vhost_net *passt_get_vhost_net(NetClientState *nc)
+{
+    NetPasstState *s = DO_UPCAST(NetPasstState, data.nc, nc);
+
+    assert(nc->info->type == NET_CLIENT_DRIVER_PASST);
+
+    return s->vhost_net;
+}
+
+static uint64_t passt_get_acked_features(NetClientState *nc)
+{
+    NetPasstState *s = DO_UPCAST(NetPasstState, data.nc, nc);
+
+    assert(nc->info->type == NET_CLIENT_DRIVER_PASST);
+
+    return s->acked_features;
+}
+
+static void passt_save_acked_features(NetClientState *nc)
+{
+    NetPasstState *s = DO_UPCAST(NetPasstState, data.nc, nc);
+
+    assert(nc->info->type == NET_CLIENT_DRIVER_PASST);
+
+    if (s->vhost_net) {
+        uint64_t features = vhost_net_get_acked_features(s->vhost_net);
+        if (features) {
+            s->acked_features = features;
+        }
+    }
+}
+#endif
+
 static NetClientInfo net_passt_info = {
     .type = NET_CLIENT_DRIVER_PASST,
     .size = sizeof(NetPasstState),
     .receive = net_passt_receive,
     .cleanup = net_passt_cleanup,
+#ifdef CONFIG_VHOST_USER
+    .has_vnet_hdr = passt_has_vnet_hdr,
+    .has_ufo = passt_has_ufo,
+    .set_vnet_be = passt_set_vnet_endianness,
+    .set_vnet_le = passt_set_vnet_endianness,
+    .check_peer_type = passt_check_peer_type,
+    .get_vhost_net = passt_get_vhost_net,
+#endif
 };
 
 static void net_passt_client_connected(QIOTask *task, gpointer opaque)
@@ -163,6 +325,177 @@ static int net_passt_stream_start(NetPasstState *s, Error **errp)
     return 0;
 }
 
+#ifdef CONFIG_VHOST_USER
+static gboolean passt_vhost_user_watch(void *do_not_use, GIOCondition cond,
+                                       void *opaque)
+{
+    NetPasstState *s = opaque;
+
+    qemu_chr_fe_disconnect(&s->vhost_chr);
+
+    return G_SOURCE_CONTINUE;
+}
+
+static void passt_vhost_user_event(void *opaque, QEMUChrEvent event);
+
+static void chr_closed_bh(void *opaque)
+{
+    NetPasstState *s = opaque;
+
+    passt_save_acked_features(&s->data.nc);
+
+    net_client_set_link(&(NetClientState *){ &s->data.nc }, 1, false);
+
+    qemu_chr_fe_set_handlers(&s->vhost_chr, NULL, NULL, passt_vhost_user_event,
+                             NULL, s, NULL, true);
+}
+
+static void passt_vhost_user_stop(NetPasstState *s)
+{
+    passt_save_acked_features(&s->data.nc);
+    vhost_net_cleanup(s->vhost_net);
+}
+
+static int passt_vhost_user_start(NetPasstState *s, VhostUserState *be)
+{
+    struct vhost_net *net = NULL;
+    VhostNetOptions options;
+
+    options.backend_type = VHOST_BACKEND_TYPE_USER;
+    options.net_backend = &s->data.nc;
+    options.opaque = be;
+    options.busyloop_timeout = 0;
+    options.nvqs = 2;
+    options.feature_bits = user_feature_bits;
+    options.max_tx_queue_size = VIRTQUEUE_MAX_SIZE;
+    options.get_acked_features = passt_get_acked_features;
+    options.save_acked_features = passt_save_acked_features;
+    options.is_vhost_user = true;
+
+    net = vhost_net_init(&options);
+    if (!net) {
+        error_report("failed to init passt vhost_net");
+        goto err;
+    }
+
+    if (s->vhost_net) {
+        vhost_net_cleanup(s->vhost_net);
+        g_free(s->vhost_net);
+    }
+    s->vhost_net = net;
+
+    return 0;
+err:
+    if (net) {
+        vhost_net_cleanup(net);
+        g_free(net);
+    }
+    passt_vhost_user_stop(s);
+    return -1;
+}
+
+static void passt_vhost_user_event(void *opaque, QEMUChrEvent event)
+{
+    NetPasstState *s = opaque;
+    Error *err = NULL;
+
+    switch (event) {
+    case CHR_EVENT_OPENED:
+        if (passt_vhost_user_start(s, s->vhost_user) < 0) {
+            qemu_chr_fe_disconnect(&s->vhost_chr);
+            return;
+        }
+        s->vhost_watch = qemu_chr_fe_add_watch(&s->vhost_chr, G_IO_HUP,
+                                               passt_vhost_user_watch, s);
+        net_client_set_link(&(NetClientState *){ &s->data.nc }, 1, true);
+        s->started = true;
+        break;
+    case CHR_EVENT_CLOSED:
+        if (s->vhost_watch) {
+            AioContext *ctx = qemu_get_current_aio_context();
+
+            g_source_remove(s->vhost_watch);
+            s->vhost_watch = 0;
+            qemu_chr_fe_set_handlers(&s->vhost_chr, NULL, NULL,  NULL, NULL,
+                                     NULL, NULL, false);
+
+            aio_bh_schedule_oneshot(ctx, chr_closed_bh, s);
+        }
+        break;
+    case CHR_EVENT_BREAK:
+    case CHR_EVENT_MUX_IN:
+    case CHR_EVENT_MUX_OUT:
+        /* Ignore */
+        break;
+    }
+
+    if (err) {
+        error_report_err(err);
+    }
+}
+
+static int net_passt_vhost_user_init(NetPasstState *s, Error **errp)
+{
+    Chardev *chr;
+    int sv[2];
+
+    if (socketpair(PF_UNIX, SOCK_STREAM, 0, sv) == -1) {
+        error_setg_errno(errp, errno, "socketpair() failed");
+        return -1;
+    }
+
+    /* connect to passt */
+    qemu_set_info_str(&s->data.nc, "connecting to passt");
+
+    /* create chardev */
+
+    chr = CHARDEV(object_new(TYPE_CHARDEV_SOCKET));
+    if (!chr || qemu_chr_add_client(chr, sv[0]) == -1) {
+        object_unref(OBJECT(chr));
+        error_setg(errp, "Failed to make socket chardev");
+        goto err;
+    }
+
+    s->vhost_user = g_new0(struct VhostUserState, 1);
+    if (!qemu_chr_fe_init(&s->vhost_chr, chr, errp) ||
+        !vhost_user_init(s->vhost_user, &s->vhost_chr, errp)) {
+        goto err;
+    }
+
+    /* start passt */
+    if (net_passt_start_daemon(s, sv[1], errp) == -1) {
+        goto err;
+    }
+
+    do {
+        if (qemu_chr_fe_wait_connected(&s->vhost_chr, errp) < 0) {
+            goto err;
+        }
+
+        qemu_chr_fe_set_handlers(&s->vhost_chr, NULL, NULL,
+                                 passt_vhost_user_event, NULL, s, NULL,
+                                 true);
+    } while (!s->started);
+
+    qemu_set_info_str(&s->data.nc, "vhost-user,connected to pid %d", s->pid);
+
+    close(sv[1]);
+    return 0;
+err:
+    close(sv[0]);
+    close(sv[1]);
+
+    return -1;
+}
+#else
+static int net_passt_vhost_user_init(NetPasstState *s, Error **errp)
+{
+    error_setg(errp, "vhost-user support has not been built");
+
+    return -1;
+}
+#endif
+
 static GPtrArray *net_passt_decode_args(const NetDevPasstOptions *passt,
                                         gchar *pidfile, Error **errp)
 {
@@ -174,6 +507,10 @@ static GPtrArray *net_passt_decode_args(const NetDevPasstOptions *passt,
         g_ptr_array_add(args, g_strdup("passt"));
     }
 
+    if (passt->has_vhost_user && passt->vhost_user) {
+        g_ptr_array_add(args, g_strdup("--vhost-user"));
+    }
+
     /* by default, be quiet */
     if (!passt->has_quiet || passt->quiet) {
         g_ptr_array_add(args, g_strdup("--quiet"));
@@ -398,6 +735,15 @@ int net_init_passt(const Netdev *netdev, const char *name,
     s->args = args;
     s->pidfile = pidfile;
 
+    if (netdev->u.passt.has_vhost_user && netdev->u.passt.vhost_user) {
+        if (net_passt_vhost_user_init(s, errp) == -1) {
+            qemu_del_net_client(nc);
+            return -1;
+        }
+
+        return 0;
+    }
+
     if (net_passt_stream_start(s, errp) == -1) {
         qemu_del_net_client(nc);
         return -1;
diff --git a/qapi/net.json b/qapi/net.json
index 24999f6752..0f766041a3 100644
--- a/qapi/net.json
+++ b/qapi/net.json
@@ -121,6 +121,8 @@
 #
 # @quiet: don't print informational messages (default, passed as '--quiet')
 #
+# @vhost-user: enable vhost-user
+#
 # @mtu: assign MTU via DHCP/NDP
 #
 # @address: IPv4 or IPv6 address
@@ -189,6 +191,7 @@
   'data': {
     '*path':               'str',
     '*quiet':              'bool',
+    '*vhost-user':         'bool',
     '*mtu':                'int',
     '*address':            'str',
     '*netmask':            'str',
diff --git a/qemu-options.hx b/qemu-options.hx
index e8252cd5e8..a3c066c678 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -2797,7 +2797,7 @@ DEFHEADING(Network options:)
 
 DEF("netdev", HAS_ARG, QEMU_OPTION_netdev,
 #ifdef CONFIG_PASST
-    "-netdev passt,id=str[,path=file][,quiet=on|off]\n"
+    "-netdev passt,id=str[,path=file][,quiet=on|off][,vhost-user=on|off]\n"
     "[,mtu=mtu][,address=addr][,netmask=mask][,mac=addr][,gateway=addr]\n"
     "          [,interface=name][,outbound=address][,outbound-if4=name]\n"
     "          [,outbound-if6=name][,dns=addr][,search=list][,fqdn=name]\n"
@@ -2811,6 +2811,8 @@ DEF("netdev", HAS_ARG, QEMU_OPTION_netdev,
     "                if 'path' is not provided 'passt' will be started according to PATH\n"
     "                by default, informational message of passt are not displayed (quiet=on)\n"
     "                to display this message, use 'quiet=off'\n"
+    "                by default, passt will be started in socket-based mode, to enable vhost-mode,\n"
+    "                use 'vhost-user=on'\n"
     "                for details on other options, refer to passt(1)\n"
     "                'param' allows to pass any option defined by passt(1)\n"
 #endif
@@ -3067,6 +3069,12 @@ SRST
         By default, ``quiet=on`` to disable informational message from
         passt. ``quiet=on`` is passed as ``--quiet`` to passt.
 
+    ``vhost-user=on|off``
+        By default, ``vhost-user=off`` and QEMU uses the stream network
+        backend to communicate with passt. If ``vhost-user=on``, passt is
+        started with ``--vhost-user`` and QEMU uses the vhost-user network
+        backend to communicate with passt.
+
     ``@mtu``
         Assign MTU via DHCP/NDP
 

From 66c83cdd91c07575ebf30bb45da8cc5df8041c29 Mon Sep 17 00:00:00 2001
From: John Snow <jsnow@redhat.com>
Date: Wed, 18 Jun 2025 12:53:49 -0400
Subject: [PATCH 2231/2760] docs/sphinx: adjust qapidoc to cope with same-line
 error sections

Without this, the line the new QAPI doc generator chokes on

    # Errors: some

in doc-good.json.  We still use the old doc generator for the tests,
but we're about to correct that.

Signed-off-by: John Snow <jsnow@redhat.com>
Message-ID: <20250618165353.1980365-2-jsnow@redhat.com>
Acked-by: Markus Armbruster <armbru@redhat.com>
Fixes: e9fbf1a0c6c2 (docs/qapidoc: add visit_errors() method)
[Amend commit message to point to reproducer, and add Fixes:]
Signed-off-by: Markus Armbruster <armbru@redhat.com>
---
 docs/sphinx/qapidoc.py | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/docs/sphinx/qapidoc.py b/docs/sphinx/qapidoc.py
index 8011ac9efa..5374dee8fa 100644
--- a/docs/sphinx/qapidoc.py
+++ b/docs/sphinx/qapidoc.py
@@ -267,10 +267,14 @@ class Transmogrifier:
         self.add_field("return", typ, section.text, section.info)
 
     def visit_errors(self, section: QAPIDoc.Section) -> None:
-        # FIXME: the formatting for errors may be inconsistent and may
-        # or may not require different newline placement to ensure
-        # proper rendering as a nested list.
-        self.add_lines(f":error:\n{section.text}", section.info)
+        # If the section text does not start with a space, it means text
+        # began on the same line as the "Error:" string and we should
+        # not insert a newline in this case.
+        if section.text[0].isspace():
+            text = f":error:\n{section.text}"
+        else:
+            text = f":error: {section.text}"
+        self.add_lines(text, section.info)
 
     def preamble(self, ent: QAPISchemaDefinition) -> None:
         """

From e56c683bae9d1dc1b637029a0595225499ef7248 Mon Sep 17 00:00:00 2001
From: John Snow <jsnow@redhat.com>
Date: Wed, 18 Jun 2025 12:53:50 -0400
Subject: [PATCH 2232/2760] docs/sphinx: parse @references in freeform text

Oversight in the new qapidoc transmogrifier: @references in freeform
documentation blocks were not being transformed to literals. This fixes
that, and the next patch ensures that we're testing for this O:-)

Signed-off-by: John Snow <jsnow@redhat.com>
Message-ID: <20250618165353.1980365-3-jsnow@redhat.com>
Acked-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
---
 docs/sphinx/qapidoc.py | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/docs/sphinx/qapidoc.py b/docs/sphinx/qapidoc.py
index 5374dee8fa..adc14ade45 100644
--- a/docs/sphinx/qapidoc.py
+++ b/docs/sphinx/qapidoc.py
@@ -218,6 +218,11 @@ class Transmogrifier:
         typ = self.format_type(member)
         self.add_field(kind, member.name, body, info, typ)
 
+    @staticmethod
+    def reformat_arobase(text: str) -> str:
+        """ reformats @var to ``var`` """
+        return re.sub(r"@([\w-]+)", r"``\1``", text)
+
     # Transmogrification helpers
 
     def visit_paragraph(self, section: QAPIDoc.Section) -> None:
@@ -361,8 +366,7 @@ class Transmogrifier:
 
         # Add sections in source order:
         for i, section in enumerate(sections):
-            # @var is translated to ``var``:
-            section.text = re.sub(r"@([\w-]+)", r"``\1``", section.text)
+            section.text = self.reformat_arobase(section.text)
 
             if section.kind == QAPIDoc.Kind.PLAIN:
                 self.visit_paragraph(section)
@@ -405,7 +409,7 @@ class Transmogrifier:
 
         assert len(doc.all_sections) == 1, doc.all_sections
         body = doc.all_sections[0]
-        text = body.text
+        text = self.reformat_arobase(body.text)
         info = doc.info
 
         if re.match(r"=+ ", text):

From 8d789c8cdb8de2cae39f217b6c9607ac9c036c8c Mon Sep 17 00:00:00 2001
From: John Snow <jsnow@redhat.com>
Date: Wed, 18 Jun 2025 12:53:51 -0400
Subject: [PATCH 2233/2760] docs/sphinx: remove legacy QAPI manual generator

Thanks for your service!

Remove the old qapidoc and the option to enable the transmogrifier,
leaving the "transmogrifier" as the ONLY qapi doc generator. This in
effect also converts the QAPI test to use the new documentation
generator, too.

Update doc-good.txt output to match the new doc generator, which I
should've done exactly when we switched over to the transmogrifier, but,
uhh, oops!

Notes on the new format:
 1. per-member IFCOND documentation is missing. Known issue.
 2. Freeform documentation without a header is now copied through into
    the output. This is a bug fix.

Signed-off-by: John Snow <jsnow@redhat.com>
Message-ID: <20250618165353.1980365-4-jsnow@redhat.com>
Acked-by: Markus Armbruster <armbru@redhat.com>
Fixes: b61a4eb3f32 (docs/qapidoc: support header-less freeform sections)
[Tweak commit message to say it's a bug fix, add Fixes:]
Signed-off-by: Markus Armbruster <armbru@redhat.com>
---
 docs/interop/qemu-ga-ref.rst                 |   1 -
 docs/interop/qemu-qmp-ref.rst                |   1 -
 docs/interop/qemu-storage-daemon-qmp-ref.rst |   1 -
 docs/sphinx/qapidoc.py                       |  25 +-
 docs/sphinx/qapidoc_legacy.py                | 440 -------------------
 python/tests/qapi-isort.sh                   |   2 +-
 tests/qapi-schema/doc-good.txt               | 274 ++++--------
 7 files changed, 88 insertions(+), 656 deletions(-)
 delete mode 100644 docs/sphinx/qapidoc_legacy.py

diff --git a/docs/interop/qemu-ga-ref.rst b/docs/interop/qemu-ga-ref.rst
index 25f6e24b03..ea6652ae43 100644
--- a/docs/interop/qemu-ga-ref.rst
+++ b/docs/interop/qemu-ga-ref.rst
@@ -2,5 +2,4 @@ QEMU Guest Agent Protocol Reference
 ===================================
 
 .. qapi-doc:: qga/qapi-schema.json
-   :transmogrify:
    :namespace: QGA
diff --git a/docs/interop/qemu-qmp-ref.rst b/docs/interop/qemu-qmp-ref.rst
index 3bc1ca12b1..f0ce39ad67 100644
--- a/docs/interop/qemu-qmp-ref.rst
+++ b/docs/interop/qemu-qmp-ref.rst
@@ -7,5 +7,4 @@ QEMU QMP Reference Manual
    :local:
 
 .. qapi-doc:: qapi/qapi-schema.json
-   :transmogrify:
    :namespace: QMP
diff --git a/docs/interop/qemu-storage-daemon-qmp-ref.rst b/docs/interop/qemu-storage-daemon-qmp-ref.rst
index dc7bde262a..4dbb6a2cc8 100644
--- a/docs/interop/qemu-storage-daemon-qmp-ref.rst
+++ b/docs/interop/qemu-storage-daemon-qmp-ref.rst
@@ -5,5 +5,4 @@ QEMU Storage Daemon QMP Reference Manual
    :local:
 
 .. qapi-doc:: storage-daemon/qapi/qapi-schema.json
-   :transmogrify:
    :namespace: QSD
diff --git a/docs/sphinx/qapidoc.py b/docs/sphinx/qapidoc.py
index adc14ade45..d5d2b5eeb5 100644
--- a/docs/sphinx/qapidoc.py
+++ b/docs/sphinx/qapidoc.py
@@ -64,8 +64,6 @@ from sphinx.util import logging
 from sphinx.util.docutils import SphinxDirective, switch_source_input
 from sphinx.util.nodes import nested_parse_with_titles
 
-from qapidoc_legacy import QAPISchemaGenRSTVisitor  # type: ignore
-
 
 if TYPE_CHECKING:
     from typing import (
@@ -512,15 +510,9 @@ class QAPIDocDirective(NestedDirective):
     option_spec = {
         "qapifile": directives.unchanged_required,
         "namespace": directives.unchanged,
-        "transmogrify": directives.flag,
     }
     has_content = False
 
-    def new_serialno(self) -> str:
-        """Return a unique new ID string suitable for use as a node's ID"""
-        env = self.state.document.settings.env
-        return "qapidoc-%d" % env.new_serialno("qapidoc")
-
     def transmogrify(self, schema: QAPISchema) -> nodes.Element:
         logger.info("Transmogrifying QAPI to rST ...")
         vis = Transmogrifier()
@@ -598,21 +590,10 @@ class QAPIDocDirective(NestedDirective):
                     outfile.write(f" {rcol}")
                 outfile.write("\n")
 
-    def legacy(self, schema: QAPISchema) -> nodes.Element:
-        vis = QAPISchemaGenRSTVisitor(self)
-        vis.visit_begin(schema)
-        for doc in schema.docs:
-            if doc.symbol:
-                vis.symbol(doc, schema.lookup_entity(doc.symbol))
-            else:
-                vis.freeform(doc)
-        return vis.get_document_node()  # type: ignore
-
     def run(self) -> Sequence[nodes.Node]:
         env = self.state.document.settings.env
         qapifile = env.config.qapidoc_srctree + "/" + self.arguments[0]
         qapidir = os.path.dirname(qapifile)
-        transmogrify = "transmogrify" in self.options
 
         try:
             schema = QAPISchema(qapifile)
@@ -625,11 +606,7 @@ class QAPIDocDirective(NestedDirective):
             # so they are displayed nicely to the user
             raise ExtensionError(str(err)) from err
 
-        if transmogrify:
-            contentnode = self.transmogrify(schema)
-        else:
-            contentnode = self.legacy(schema)
-
+        contentnode = self.transmogrify(schema)
         return contentnode.children
 
 
diff --git a/docs/sphinx/qapidoc_legacy.py b/docs/sphinx/qapidoc_legacy.py
deleted file mode 100644
index 13520f4c26..0000000000
--- a/docs/sphinx/qapidoc_legacy.py
+++ /dev/null
@@ -1,440 +0,0 @@
-# coding=utf-8
-# type: ignore
-#
-# QEMU qapidoc QAPI file parsing extension
-#
-# Copyright (c) 2020 Linaro
-#
-# This work is licensed under the terms of the GNU GPLv2 or later.
-# See the COPYING file in the top-level directory.
-
-"""
-qapidoc is a Sphinx extension that implements the qapi-doc directive
-
-The purpose of this extension is to read the documentation comments
-in QAPI schema files, and insert them all into the current document.
-
-It implements one new rST directive, "qapi-doc::".
-Each qapi-doc:: directive takes one argument, which is the
-pathname of the schema file to process, relative to the source tree.
-
-The docs/conf.py file must set the qapidoc_srctree config value to
-the root of the QEMU source tree.
-
-The Sphinx documentation on writing extensions is at:
-https://www.sphinx-doc.org/en/master/development/index.html
-"""
-
-import re
-import textwrap
-
-from docutils import nodes
-from docutils.statemachine import ViewList
-from qapi.error import QAPISemError
-from qapi.gen import QAPISchemaVisitor
-from qapi.parser import QAPIDoc
-
-
-def dedent(text: str) -> str:
-    # Adjust indentation to make description text parse as paragraph.
-
-    lines = text.splitlines(True)
-    if re.match(r"\s+", lines[0]):
-        # First line is indented; description started on the line after
-        # the name. dedent the whole block.
-        return textwrap.dedent(text)
-
-    # Descr started on same line. Dedent line 2+.
-    return lines[0] + textwrap.dedent("".join(lines[1:]))
-
-
-class QAPISchemaGenRSTVisitor(QAPISchemaVisitor):
-    """A QAPI schema visitor which generates docutils/Sphinx nodes
-
-    This class builds up a tree of docutils/Sphinx nodes corresponding
-    to documentation for the various QAPI objects. To use it, first
-    create a QAPISchemaGenRSTVisitor object, and call its
-    visit_begin() method.  Then you can call one of the two methods
-    'freeform' (to add documentation for a freeform documentation
-    chunk) or 'symbol' (to add documentation for a QAPI symbol). These
-    will cause the visitor to build up the tree of document
-    nodes. Once you've added all the documentation via 'freeform' and
-    'symbol' method calls, you can call 'get_document_nodes' to get
-    the final list of document nodes (in a form suitable for returning
-    from a Sphinx directive's 'run' method).
-    """
-    def __init__(self, sphinx_directive):
-        self._cur_doc = None
-        self._sphinx_directive = sphinx_directive
-        self._top_node = nodes.section()
-        self._active_headings = [self._top_node]
-
-    def _make_dlitem(self, term, defn):
-        """Return a dlitem node with the specified term and definition.
-
-        term should be a list of Text and literal nodes.
-        defn should be one of:
-        - a string, which will be handed to _parse_text_into_node
-        - a list of Text and literal nodes, which will be put into
-          a paragraph node
-        """
-        dlitem = nodes.definition_list_item()
-        dlterm = nodes.term('', '', *term)
-        dlitem += dlterm
-        if defn:
-            dldef = nodes.definition()
-            if isinstance(defn, list):
-                dldef += nodes.paragraph('', '', *defn)
-            else:
-                self._parse_text_into_node(defn, dldef)
-            dlitem += dldef
-        return dlitem
-
-    def _make_section(self, title):
-        """Return a section node with optional title"""
-        section = nodes.section(ids=[self._sphinx_directive.new_serialno()])
-        if title:
-            section += nodes.title(title, title)
-        return section
-
-    def _nodes_for_ifcond(self, ifcond, with_if=True):
-        """Return list of Text, literal nodes for the ifcond
-
-        Return a list which gives text like ' (If: condition)'.
-        If with_if is False, we don't return the "(If: " and ")".
-        """
-
-        doc = ifcond.docgen()
-        if not doc:
-            return []
-        doc = nodes.literal('', doc)
-        if not with_if:
-            return [doc]
-
-        nodelist = [nodes.Text(' ('), nodes.strong('', 'If: ')]
-        nodelist.append(doc)
-        nodelist.append(nodes.Text(')'))
-        return nodelist
-
-    def _nodes_for_one_member(self, member):
-        """Return list of Text, literal nodes for this member
-
-        Return a list of doctree nodes which give text like
-        'name: type (optional) (If: ...)' suitable for use as the
-        'term' part of a definition list item.
-        """
-        term = [nodes.literal('', member.name)]
-        if member.type.doc_type():
-            term.append(nodes.Text(': '))
-            term.append(nodes.literal('', member.type.doc_type()))
-        if member.optional:
-            term.append(nodes.Text(' (optional)'))
-        if member.ifcond.is_present():
-            term.extend(self._nodes_for_ifcond(member.ifcond))
-        return term
-
-    def _nodes_for_variant_when(self, branches, variant):
-        """Return list of Text, literal nodes for variant 'when' clause
-
-        Return a list of doctree nodes which give text like
-        'when tagname is variant (If: ...)' suitable for use in
-        the 'branches' part of a definition list.
-        """
-        term = [nodes.Text(' when '),
-                nodes.literal('', branches.tag_member.name),
-                nodes.Text(' is '),
-                nodes.literal('', '"%s"' % variant.name)]
-        if variant.ifcond.is_present():
-            term.extend(self._nodes_for_ifcond(variant.ifcond))
-        return term
-
-    def _nodes_for_members(self, doc, what, base=None, branches=None):
-        """Return list of doctree nodes for the table of members"""
-        dlnode = nodes.definition_list()
-        for section in doc.args.values():
-            term = self._nodes_for_one_member(section.member)
-            # TODO drop fallbacks when undocumented members are outlawed
-            if section.text:
-                defn = dedent(section.text)
-            else:
-                defn = [nodes.Text('Not documented')]
-
-            dlnode += self._make_dlitem(term, defn)
-
-        if base:
-            dlnode += self._make_dlitem([nodes.Text('The members of '),
-                                         nodes.literal('', base.doc_type())],
-                                        None)
-
-        if branches:
-            for v in branches.variants:
-                if v.type.name == 'q_empty':
-                    continue
-                assert not v.type.is_implicit()
-                term = [nodes.Text('The members of '),
-                        nodes.literal('', v.type.doc_type())]
-                term.extend(self._nodes_for_variant_when(branches, v))
-                dlnode += self._make_dlitem(term, None)
-
-        if not dlnode.children:
-            return []
-
-        section = self._make_section(what)
-        section += dlnode
-        return [section]
-
-    def _nodes_for_enum_values(self, doc):
-        """Return list of doctree nodes for the table of enum values"""
-        seen_item = False
-        dlnode = nodes.definition_list()
-        for section in doc.args.values():
-            termtext = [nodes.literal('', section.member.name)]
-            if section.member.ifcond.is_present():
-                termtext.extend(self._nodes_for_ifcond(section.member.ifcond))
-            # TODO drop fallbacks when undocumented members are outlawed
-            if section.text:
-                defn = dedent(section.text)
-            else:
-                defn = [nodes.Text('Not documented')]
-
-            dlnode += self._make_dlitem(termtext, defn)
-            seen_item = True
-
-        if not seen_item:
-            return []
-
-        section = self._make_section('Values')
-        section += dlnode
-        return [section]
-
-    def _nodes_for_arguments(self, doc, arg_type):
-        """Return list of doctree nodes for the arguments section"""
-        if arg_type and not arg_type.is_implicit():
-            assert not doc.args
-            section = self._make_section('Arguments')
-            dlnode = nodes.definition_list()
-            dlnode += self._make_dlitem(
-                [nodes.Text('The members of '),
-                 nodes.literal('', arg_type.name)],
-                None)
-            section += dlnode
-            return [section]
-
-        return self._nodes_for_members(doc, 'Arguments')
-
-    def _nodes_for_features(self, doc):
-        """Return list of doctree nodes for the table of features"""
-        seen_item = False
-        dlnode = nodes.definition_list()
-        for section in doc.features.values():
-            dlnode += self._make_dlitem(
-                [nodes.literal('', section.member.name)], dedent(section.text))
-            seen_item = True
-
-        if not seen_item:
-            return []
-
-        section = self._make_section('Features')
-        section += dlnode
-        return [section]
-
-    def _nodes_for_sections(self, doc):
-        """Return list of doctree nodes for additional sections"""
-        nodelist = []
-        for section in doc.sections:
-            if section.kind == QAPIDoc.Kind.TODO:
-                # Hide TODO: sections
-                continue
-
-            if section.kind == QAPIDoc.Kind.PLAIN:
-                # Sphinx cannot handle sectionless titles;
-                # Instead, just append the results to the prior section.
-                container = nodes.container()
-                self._parse_text_into_node(section.text, container)
-                nodelist += container.children
-                continue
-
-            snode = self._make_section(section.kind.name.title())
-            self._parse_text_into_node(dedent(section.text), snode)
-            nodelist.append(snode)
-        return nodelist
-
-    def _nodes_for_if_section(self, ifcond):
-        """Return list of doctree nodes for the "If" section"""
-        nodelist = []
-        if ifcond.is_present():
-            snode = self._make_section('If')
-            snode += nodes.paragraph(
-                '', '', *self._nodes_for_ifcond(ifcond, with_if=False)
-            )
-            nodelist.append(snode)
-        return nodelist
-
-    def _add_doc(self, typ, sections):
-        """Add documentation for a command/object/enum...
-
-        We assume we're documenting the thing defined in self._cur_doc.
-        typ is the type of thing being added ("Command", "Object", etc)
-
-        sections is a list of nodes for sections to add to the definition.
-        """
-
-        doc = self._cur_doc
-        snode = nodes.section(ids=[self._sphinx_directive.new_serialno()])
-        snode += nodes.title('', '', *[nodes.literal(doc.symbol, doc.symbol),
-                                       nodes.Text(' (' + typ + ')')])
-        self._parse_text_into_node(doc.body.text, snode)
-        for s in sections:
-            if s is not None:
-                snode += s
-        self._add_node_to_current_heading(snode)
-
-    def visit_enum_type(self, name, info, ifcond, features, members, prefix):
-        doc = self._cur_doc
-        self._add_doc('Enum',
-                      self._nodes_for_enum_values(doc)
-                      + self._nodes_for_features(doc)
-                      + self._nodes_for_sections(doc)
-                      + self._nodes_for_if_section(ifcond))
-
-    def visit_object_type(self, name, info, ifcond, features,
-                          base, members, branches):
-        doc = self._cur_doc
-        if base and base.is_implicit():
-            base = None
-        self._add_doc('Object',
-                      self._nodes_for_members(doc, 'Members', base, branches)
-                      + self._nodes_for_features(doc)
-                      + self._nodes_for_sections(doc)
-                      + self._nodes_for_if_section(ifcond))
-
-    def visit_alternate_type(self, name, info, ifcond, features,
-                             alternatives):
-        doc = self._cur_doc
-        self._add_doc('Alternate',
-                      self._nodes_for_members(doc, 'Members')
-                      + self._nodes_for_features(doc)
-                      + self._nodes_for_sections(doc)
-                      + self._nodes_for_if_section(ifcond))
-
-    def visit_command(self, name, info, ifcond, features, arg_type,
-                      ret_type, gen, success_response, boxed, allow_oob,
-                      allow_preconfig, coroutine):
-        doc = self._cur_doc
-        self._add_doc('Command',
-                      self._nodes_for_arguments(doc, arg_type)
-                      + self._nodes_for_features(doc)
-                      + self._nodes_for_sections(doc)
-                      + self._nodes_for_if_section(ifcond))
-
-    def visit_event(self, name, info, ifcond, features, arg_type, boxed):
-        doc = self._cur_doc
-        self._add_doc('Event',
-                      self._nodes_for_arguments(doc, arg_type)
-                      + self._nodes_for_features(doc)
-                      + self._nodes_for_sections(doc)
-                      + self._nodes_for_if_section(ifcond))
-
-    def symbol(self, doc, entity):
-        """Add documentation for one symbol to the document tree
-
-        This is the main entry point which causes us to add documentation
-        nodes for a symbol (which could be a 'command', 'object', 'event',
-        etc). We do this by calling 'visit' on the schema entity, which
-        will then call back into one of our visit_* methods, depending
-        on what kind of thing this symbol is.
-        """
-        self._cur_doc = doc
-        entity.visit(self)
-        self._cur_doc = None
-
-    def _start_new_heading(self, heading, level):
-        """Start a new heading at the specified heading level
-
-        Create a new section whose title is 'heading' and which is placed
-        in the docutils node tree as a child of the most recent level-1
-        heading. Subsequent document sections (commands, freeform doc chunks,
-        etc) will be placed as children of this new heading section.
-        """
-        if len(self._active_headings) < level:
-            raise QAPISemError(self._cur_doc.info,
-                               'Level %d subheading found outside a '
-                               'level %d heading'
-                               % (level, level - 1))
-        snode = self._make_section(heading)
-        self._active_headings[level - 1] += snode
-        self._active_headings = self._active_headings[:level]
-        self._active_headings.append(snode)
-        return snode
-
-    def _add_node_to_current_heading(self, node):
-        """Add the node to whatever the current active heading is"""
-        self._active_headings[-1] += node
-
-    def freeform(self, doc):
-        """Add a piece of 'freeform' documentation to the document tree
-
-        A 'freeform' document chunk doesn't relate to any particular
-        symbol (for instance, it could be an introduction).
-
-        If the freeform document starts with a line of the form
-        '= Heading text', this is a section or subsection heading, with
-        the heading level indicated by the number of '=' signs.
-        """
-
-        # QAPIDoc documentation says free-form documentation blocks
-        # must have only a body section, nothing else.
-        assert not doc.sections
-        assert not doc.args
-        assert not doc.features
-        self._cur_doc = doc
-
-        text = doc.body.text
-        if re.match(r'=+ ', text):
-            # Section/subsection heading (if present, will always be
-            # the first line of the block)
-            (heading, _, text) = text.partition('\n')
-            (leader, _, heading) = heading.partition(' ')
-            node = self._start_new_heading(heading, len(leader))
-            if text == '':
-                return
-        else:
-            node = nodes.container()
-
-        self._parse_text_into_node(text, node)
-        self._cur_doc = None
-
-    def _parse_text_into_node(self, doctext, node):
-        """Parse a chunk of QAPI-doc-format text into the node
-
-        The doc comment can contain most inline rST markup, including
-        bulleted and enumerated lists.
-        As an extra permitted piece of markup, @var will be turned
-        into ``var``.
-        """
-
-        # Handle the "@var means ``var`` case
-        doctext = re.sub(r'@([\w-]+)', r'``\1``', doctext)
-
-        rstlist = ViewList()
-        for line in doctext.splitlines():
-            # The reported line number will always be that of the start line
-            # of the doc comment, rather than the actual location of the error.
-            # Being more precise would require overhaul of the QAPIDoc class
-            # to track lines more exactly within all the sub-parts of the doc
-            # comment, as well as counting lines here.
-            rstlist.append(line, self._cur_doc.info.fname,
-                           self._cur_doc.info.line)
-        # Append a blank line -- in some cases rST syntax errors get
-        # attributed to the line after one with actual text, and if there
-        # isn't anything in the ViewList corresponding to that then Sphinx
-        # 1.6's AutodocReporter will then misidentify the source/line location
-        # in the error message (usually attributing it to the top-level
-        # .rst file rather than the offending .json file). The extra blank
-        # line won't affect the rendered output.
-        rstlist.append("", self._cur_doc.info.fname, self._cur_doc.info.line)
-        self._sphinx_directive.do_parse(rstlist, node)
-
-    def get_document_node(self):
-        """Return the root docutils node which makes up the document"""
-        return self._top_node
diff --git a/python/tests/qapi-isort.sh b/python/tests/qapi-isort.sh
index 78dd947f68..067c16d5d9 100755
--- a/python/tests/qapi-isort.sh
+++ b/python/tests/qapi-isort.sh
@@ -3,6 +3,6 @@
 
 python3 -m isort --sp . -c ../scripts/qapi/
 # Force isort to recognize "compat" as a local module and not third-party
-python3 -m isort --sp . -c -p compat -p qapidoc_legacy \
+python3 -m isort --sp . -c -p compat \
         ../docs/sphinx/qapi_domain.py \
         ../docs/sphinx/qapidoc.py
diff --git a/tests/qapi-schema/doc-good.txt b/tests/qapi-schema/doc-good.txt
index 17a1d56ef1..74b73681d3 100644
--- a/tests/qapi-schema/doc-good.txt
+++ b/tests/qapi-schema/doc-good.txt
@@ -1,6 +1,8 @@
 Section
 *******
 
+Just text, no heading.
+
 
 Subsection
 ==========
@@ -35,249 +37,145 @@ Example:
 
 -> in <- out Examples: - *verbatim* - {braces}
 
+Enum Enum
+    *Availability*: "IFCOND"
 
-"Enum" (Enum)
--------------
+   Values:
+      * **one** -- The _one_ {and only}, description on the same line
 
+      * **two** -- Not documented
 
-Values
-~~~~~~
+   Features:
+      * **enum-feat** -- Also _one_ {and only}
 
-"one" (**If: **"IFONE")
-   The _one_ {and only}, description on the same line
+      * **enum-member-feat** -- a member feature
 
-"two"
-   Not documented
+   "two" is undocumented
 
+Object Base
+    *Availability*: "IFALL1 and IFALL2"
 
-Features
-~~~~~~~~
+   Members:
+      * **base1** ("Enum") -- description starts on a new line,
+        minimally indented
 
-"enum-feat"
-   Also _one_ {and only}
+Object Variant1
 
-"enum-member-feat"
-   a member feature
+   A paragraph
 
-"two" is undocumented
+   Another paragraph
 
+   "var1" is undocumented
 
-If
-~~
+   Members:
+      * **var1** ("string") -- Not documented
 
-"IFCOND"
+   Features:
+      * **variant1-feat** -- a feature
 
+      * **member-feat** -- a member feature
 
-"Base" (Object)
----------------
+Object Variant2
 
+Object Object
 
-Members
-~~~~~~~
+   Members:
+      * The members of "Base".
 
-"base1": "Enum"
-   description starts on a new line, minimally indented
+      * When "base1" is "one": The members of "Variant1".
 
+      * When "base1" is "two": The members of "Variant2".
 
-If
-~~
+   Features:
+      * **union-feat1** -- a feature
 
-"IFALL1 and IFALL2"
+Alternate Alternate
+    *Availability*: "not (IFONE or IFTWO)"
 
+   Alternatives:
+      * **i** ("int") -- description starts on the same line remainder
+        indented the same "b" is undocumented
 
-"Variant1" (Object)
--------------------
+      * **b** ("boolean") -- Not documented
 
-A paragraph
-
-Another paragraph
-
-"var1" is undocumented
-
-
-Members
-~~~~~~~
-
-"var1": "string" (**If: **"IFSTR")
-   Not documented
-
-
-Features
-~~~~~~~~
-
-"variant1-feat"
-   a feature
-
-"member-feat"
-   a member feature
-
-
-"Variant2" (Object)
--------------------
-
-
-"Object" (Object)
------------------
-
-
-Members
-~~~~~~~
-
-The members of "Base"
-The members of "Variant1" when "base1" is ""one""
-The members of "Variant2" when "base1" is ""two"" (**If: **"IFONE or
-IFTWO")
-
-Features
-~~~~~~~~
-
-"union-feat1"
-   a feature
-
-
-"Alternate" (Alternate)
------------------------
-
-
-Members
-~~~~~~~
-
-"i": "int"
-   description starts on the same line remainder indented the same "b"
-   is undocumented
-
-"b": "boolean"
-   Not documented
-
-
-Features
-~~~~~~~~
-
-"alt-feat"
-   a feature
-
-
-If
-~~
-
-"not (IFONE or IFTWO)"
+   Features:
+      * **alt-feat** -- a feature
 
 
 Another subsection
 ==================
 
+Command cmd (Since: 2.10)
 
-"cmd" (Command)
----------------
+   Arguments:
+      * **arg1** ("int") -- description starts on a new line, indented
 
+      * **arg2** ("string", *optional*) -- description starts on the
+        same line remainder indented differently
 
-Arguments
-~~~~~~~~~
+      * **arg3** ("boolean") -- Not documented
 
-"arg1": "int"
-   description starts on a new line, indented
+   Features:
+      * **cmd-feat1** -- a feature
 
-"arg2": "string" (optional)
-   description starts on the same line remainder indented differently
+      * **cmd-feat2** -- another feature
 
-"arg3": "boolean"
-   Not documented
+   Note:
 
+     "arg3" is undocumented
 
-Features
-~~~~~~~~
+   Return:
+      "Object" -- "Object"
 
-"cmd-feat1"
-   a feature
+   Errors:
+      some
 
-"cmd-feat2"
-   another feature
+   Notes:
 
-Note:
+   * Lorem ipsum dolor sit amet
 
-  "arg3" is undocumented
+   * Ut enim ad minim veniam
 
+   Duis aute irure dolor
 
-Returns
-~~~~~~~
+   Example: Ideal fast-food burger situation:
 
-"Object"
+      -> "in"
+      <- "out"
 
+   Examples:
 
-Errors
-~~~~~~
+      - Not a QMP code block
+      - Merely a preformatted code block literal
+      It isn't even an rST list.
+      - *verbatim*
+      - {braces}
 
-some
+   Note::
+      Ceci n'est pas une note
 
-Notes:
+Command cmd-boxed
 
-* Lorem ipsum dolor sit amet
+   If you're bored enough to read this, go see a video of boxed cats
 
-* Ut enim ad minim veniam
+   Arguments:
+      * The members of "Object".
 
-Duis aute irure dolor
+   Features:
+      * **cmd-feat1** -- a feature
 
-Example: Ideal fast-food burger situation:
+      * **cmd-feat2** -- another feature
 
-   -> "in"
-   <- "out"
+   Example::
 
-Examples:
+      -> "this example"
 
-   - Not a QMP code block
-   - Merely a preformatted code block literal
-   It isn't even an rST list.
-   - *verbatim*
-   - {braces}
+      <- ... has no title ...
 
-Note::
-   Ceci n'est pas une note
+Event EVT_BOXED
 
+   Members:
+      * The members of "Object".
 
-Since
-~~~~~
-
-2.10
-
-
-"cmd-boxed" (Command)
----------------------
-
-If you're bored enough to read this, go see a video of boxed cats
-
-
-Arguments
-~~~~~~~~~
-
-The members of "Object"
-
-Features
-~~~~~~~~
-
-"cmd-feat1"
-   a feature
-
-"cmd-feat2"
-   another feature
-
-Example::
-
-   -> "this example"
-
-   <- ... has no title ...
-
-
-"EVT_BOXED" (Event)
--------------------
-
-
-Arguments
-~~~~~~~~~
-
-The members of "Object"
-
-Features
-~~~~~~~~
-
-"feat3"
-   a feature
+   Features:
+      * **feat3** -- a feature

From 6c10778826a873b9012d95e63298a6f879debcaa Mon Sep 17 00:00:00 2001
From: John Snow <jsnow@redhat.com>
Date: Wed, 18 Jun 2025 12:53:52 -0400
Subject: [PATCH 2234/2760] docs/sphinx: remove special parsing for freeform
 sections

Remove the QAPI doc section heading syntax, use plain rST section
headings instead.

Tests and documentation are updated to match.

Interestingly, Plain rST headings work fine before this patch, except
for over- and underlining with '=', which the doc parser rejected as
invalid QAPI doc section heading in free-form comments.

Signed-off-by: John Snow <jsnow@redhat.com>
Message-ID: <20250618165353.1980365-5-jsnow@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
[Add more detail to commit message]
Signed-off-by: Markus Armbruster <armbru@redhat.com>
---
 docs/devel/qapi-code-gen.rst         | 28 ++++++++++++++-------
 docs/interop/firmware.json           |  4 ++-
 docs/interop/vhost-user.json         |  4 ++-
 docs/sphinx/qapidoc.py               | 37 +---------------------------
 qapi/acpi.json                       |  4 ++-
 qapi/audio.json                      |  4 ++-
 qapi/authz.json                      |  4 ++-
 qapi/block-core.json                 |  3 ++-
 qapi/block-export.json               |  3 ++-
 qapi/block.json                      |  7 ++++--
 qapi/char.json                       |  4 ++-
 qapi/common.json                     |  4 ++-
 qapi/compat.json                     |  4 ++-
 qapi/control.json                    |  4 ++-
 qapi/crypto.json                     |  4 ++-
 qapi/cryptodev.json                  |  4 ++-
 qapi/cxl.json                        |  4 ++-
 qapi/dump.json                       |  4 ++-
 qapi/ebpf.json                       |  4 ++-
 qapi/error.json                      |  4 ++-
 qapi/introspect.json                 |  4 ++-
 qapi/job.json                        |  4 ++-
 qapi/machine-common.json             |  4 ++-
 qapi/machine.json                    |  4 ++-
 qapi/migration.json                  |  4 ++-
 qapi/misc.json                       |  4 ++-
 qapi/net.json                        |  4 ++-
 qapi/pci.json                        |  4 ++-
 qapi/qapi-schema.json                |  4 ++-
 qapi/qdev.json                       |  4 ++-
 qapi/qom.json                        |  4 ++-
 qapi/replay.json                     |  4 ++-
 qapi/rocker.json                     |  4 ++-
 qapi/run-state.json                  |  4 ++-
 qapi/sockets.json                    |  4 ++-
 qapi/stats.json                      |  4 ++-
 qapi/tpm.json                        |  4 ++-
 qapi/trace.json                      |  4 ++-
 qapi/transaction.json                |  4 ++-
 qapi/uefi.json                       |  4 ++-
 qapi/ui.json                         | 14 ++++++++---
 qapi/vfio.json                       |  4 ++-
 qapi/virtio.json                     |  4 ++-
 qapi/yank.json                       |  4 ++-
 scripts/qapi/parser.py               |  7 ------
 storage-daemon/qapi/qapi-schema.json |  8 ++++--
 tests/qapi-schema/doc-good.json      | 10 +++++---
 tests/qapi-schema/doc-good.out       | 10 +++++---
 48 files changed, 173 insertions(+), 106 deletions(-)

diff --git a/docs/devel/qapi-code-gen.rst b/docs/devel/qapi-code-gen.rst
index 231cc0fecf..dfdbeac5a5 100644
--- a/docs/devel/qapi-code-gen.rst
+++ b/docs/devel/qapi-code-gen.rst
@@ -876,25 +876,35 @@ structuring content.
 Headings and subheadings
 ~~~~~~~~~~~~~~~~~~~~~~~~
 
-A free-form documentation comment containing a line which starts with
-some ``=`` symbols and then a space defines a section heading::
+Free-form documentation does not start with ``@SYMBOL`` and can contain
+arbitrary rST markup. Headings can be marked up using the standard rST
+syntax::
 
     ##
-    # = This is a top level heading
+    # *************************
+    # This is a level 2 heading
+    # *************************
     #
     # This is a free-form comment which will go under the
     # top level heading.
     ##
 
     ##
-    # == This is a second level heading
+    # This is a third level heading
+    # ==============================
+    #
+    # Level 4
+    # _______
+    #
+    # Level 5
+    # ^^^^^^^
+    #
+    # Level 6
+    # """""""
     ##
 
-A heading line must be the first line of the documentation
-comment block.
-
-Section headings must always be correctly nested, so you can only
-define a third-level heading inside a second-level heading, and so on.
+Level 1 headings are reserved for use by the generated documentation
+page itself, leaving level 2 as the highest level that should be used.
 
 
 Documentation markup
diff --git a/docs/interop/firmware.json b/docs/interop/firmware.json
index 745d21d822..f46fdedfa8 100644
--- a/docs/interop/firmware.json
+++ b/docs/interop/firmware.json
@@ -11,7 +11,9 @@
 # later. See the COPYING file in the top-level directory.
 
 ##
-# = Firmware
+# ********
+# Firmware
+# ********
 ##
 
 { 'pragma': {
diff --git a/docs/interop/vhost-user.json b/docs/interop/vhost-user.json
index b6ade9e493..095eb99cf7 100644
--- a/docs/interop/vhost-user.json
+++ b/docs/interop/vhost-user.json
@@ -10,7 +10,9 @@
 # later. See the COPYING file in the top-level directory.
 
 ##
-# = vhost user backend discovery & capabilities
+# *******************************************
+# vhost user backend discovery & capabilities
+# *******************************************
 ##
 
 ##
diff --git a/docs/sphinx/qapidoc.py b/docs/sphinx/qapidoc.py
index d5d2b5eeb5..b794cde697 100644
--- a/docs/sphinx/qapidoc.py
+++ b/docs/sphinx/qapidoc.py
@@ -399,44 +399,9 @@ class Transmogrifier:
         self.ensure_blank_line()
 
     def visit_freeform(self, doc: QAPIDoc) -> None:
-        # TODO: Once the old qapidoc transformer is deprecated, freeform
-        # sections can be updated to pure rST, and this transformed removed.
-        #
-        # For now, translate our micro-format into rST. Code adapted
-        # from Peter Maydell's freeform().
-
         assert len(doc.all_sections) == 1, doc.all_sections
         body = doc.all_sections[0]
-        text = self.reformat_arobase(body.text)
-        info = doc.info
-
-        if re.match(r"=+ ", text):
-            # Section/subsection heading (if present, will always be the
-            # first line of the block)
-            (heading, _, text) = text.partition("\n")
-            (leader, _, heading) = heading.partition(" ")
-            # Implicit +1 for heading in the containing .rst doc
-            level = len(leader) + 1
-
-            # https://www.sphinx-doc.org/en/master/usage/restructuredtext/basics.html#sections
-            markers = ' #*=_^"'
-            overline = level <= 2
-            marker = markers[level]
-
-            self.ensure_blank_line()
-            # This credits all 2 or 3 lines to the single source line.
-            if overline:
-                self.add_line(marker * len(heading), info)
-            self.add_line(heading, info)
-            self.add_line(marker * len(heading), info)
-            self.ensure_blank_line()
-
-            # Eat blank line(s) and advance info
-            trimmed = text.lstrip("\n")
-            text = trimmed
-            info = info.next_line(len(text) - len(trimmed) + 1)
-
-        self.add_lines(text, info)
+        self.add_lines(self.reformat_arobase(body.text), doc.info)
         self.ensure_blank_line()
 
     def visit_entity(self, ent: QAPISchemaDefinition) -> None:
diff --git a/qapi/acpi.json b/qapi/acpi.json
index 2d53b82365..90f8f564fd 100644
--- a/qapi/acpi.json
+++ b/qapi/acpi.json
@@ -6,7 +6,9 @@
 # SPDX-License-Identifier: GPL-2.0-or-later
 
 ##
-# = ACPI
+# ****
+# ACPI
+# ****
 ##
 
 ##
diff --git a/qapi/audio.json b/qapi/audio.json
index 16de231f6d..6a22ca384a 100644
--- a/qapi/audio.json
+++ b/qapi/audio.json
@@ -7,7 +7,9 @@
 # See the COPYING file in the top-level directory.
 
 ##
-# = Audio
+# *****
+# Audio
+# *****
 ##
 
 ##
diff --git a/qapi/authz.json b/qapi/authz.json
index 7fc6e3032e..ad1b4b3af0 100644
--- a/qapi/authz.json
+++ b/qapi/authz.json
@@ -2,7 +2,9 @@
 # vim: filetype=python
 
 ##
-# = User authorization
+# ******************
+# User authorization
+# ******************
 ##
 
 ##
diff --git a/qapi/block-core.json b/qapi/block-core.json
index 1df6644f0d..8b413946ff 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
@@ -2,7 +2,8 @@
 # vim: filetype=python
 
 ##
-# == Block core (VM unrelated)
+# Block core (VM unrelated)
+# =========================
 ##
 
 { 'include': 'common.json' }
diff --git a/qapi/block-export.json b/qapi/block-export.json
index ed4deb54db..2241bfecf2 100644
--- a/qapi/block-export.json
+++ b/qapi/block-export.json
@@ -2,7 +2,8 @@
 # vim: filetype=python
 
 ##
-# == Block device exports
+# Block device exports
+# ====================
 ##
 
 { 'include': 'sockets.json' }
diff --git a/qapi/block.json b/qapi/block.json
index 1490a1a17f..2d54a81c36 100644
--- a/qapi/block.json
+++ b/qapi/block.json
@@ -2,13 +2,16 @@
 # vim: filetype=python
 
 ##
-# = Block devices
+# *************
+# Block devices
+# *************
 ##
 
 { 'include': 'block-core.json' }
 
 ##
-# == Additional block stuff (VM related)
+# Additional block stuff (VM related)
+# ===================================
 ##
 
 ##
diff --git a/qapi/char.json b/qapi/char.json
index df6e325e2e..f38d04986d 100644
--- a/qapi/char.json
+++ b/qapi/char.json
@@ -3,7 +3,9 @@
 #
 
 ##
-# = Character devices
+# *****************
+# Character devices
+# *****************
 ##
 
 { 'include': 'sockets.json' }
diff --git a/qapi/common.json b/qapi/common.json
index 0e3a0bbbfb..af7e3d618a 100644
--- a/qapi/common.json
+++ b/qapi/common.json
@@ -2,7 +2,9 @@
 # vim: filetype=python
 
 ##
-# = Common data types
+# *****************
+# Common data types
+# *****************
 ##
 
 ##
diff --git a/qapi/compat.json b/qapi/compat.json
index 42034d9368..90b8d51cf2 100644
--- a/qapi/compat.json
+++ b/qapi/compat.json
@@ -2,7 +2,9 @@
 # vim: filetype=python
 
 ##
-# = Compatibility policy
+# ********************
+# Compatibility policy
+# ********************
 ##
 
 ##
diff --git a/qapi/control.json b/qapi/control.json
index 34b733f63b..ab0b3a3bbe 100644
--- a/qapi/control.json
+++ b/qapi/control.json
@@ -3,7 +3,9 @@
 #
 
 ##
-# = QMP monitor control
+# *******************
+# QMP monitor control
+# *******************
 ##
 
 ##
diff --git a/qapi/crypto.json b/qapi/crypto.json
index 9ec6301e18..21006de36c 100644
--- a/qapi/crypto.json
+++ b/qapi/crypto.json
@@ -3,7 +3,9 @@
 #
 
 ##
-# = Cryptography
+# ************
+# Cryptography
+# ************
 ##
 
 ##
diff --git a/qapi/cryptodev.json b/qapi/cryptodev.json
index b13db26403..1f49e1822c 100644
--- a/qapi/cryptodev.json
+++ b/qapi/cryptodev.json
@@ -5,7 +5,9 @@
 # See the COPYING file in the top-level directory.
 
 ##
-# = Cryptography devices
+# ********************
+# Cryptography devices
+# ********************
 ##
 
 ##
diff --git a/qapi/cxl.json b/qapi/cxl.json
index 8f2e9237b1..52cc5d4f33 100644
--- a/qapi/cxl.json
+++ b/qapi/cxl.json
@@ -2,7 +2,9 @@
 # vim: filetype=python
 
 ##
-# = CXL devices
+# ***********
+# CXL devices
+# ***********
 ##
 
 ##
diff --git a/qapi/dump.json b/qapi/dump.json
index d0ba1f0596..0642ca157b 100644
--- a/qapi/dump.json
+++ b/qapi/dump.json
@@ -5,7 +5,9 @@
 # See the COPYING file in the top-level directory.
 
 ##
-# = Dump guest memory
+# *****************
+# Dump guest memory
+# *****************
 ##
 
 ##
diff --git a/qapi/ebpf.json b/qapi/ebpf.json
index db19ae850f..d45054e666 100644
--- a/qapi/ebpf.json
+++ b/qapi/ebpf.json
@@ -5,7 +5,9 @@
 # See the COPYING file in the top-level directory.
 
 ##
-# = eBPF Objects
+# ************
+# eBPF Objects
+# ************
 #
 # eBPF object is an ELF binary that contains the eBPF program and eBPF
 # map description(BTF).  Overall, eBPF object should contain the
diff --git a/qapi/error.json b/qapi/error.json
index 135c1e8231..54cb02fb88 100644
--- a/qapi/error.json
+++ b/qapi/error.json
@@ -2,7 +2,9 @@
 # vim: filetype=python
 
 ##
-# = QMP errors
+# **********
+# QMP errors
+# **********
 ##
 
 ##
diff --git a/qapi/introspect.json b/qapi/introspect.json
index e9e0297282..26d8839f19 100644
--- a/qapi/introspect.json
+++ b/qapi/introspect.json
@@ -10,7 +10,9 @@
 # See the COPYING file in the top-level directory.
 
 ##
-# = QMP introspection
+# *****************
+# QMP introspection
+# *****************
 ##
 
 ##
diff --git a/qapi/job.json b/qapi/job.json
index 126fa5ce60..16b280f52f 100644
--- a/qapi/job.json
+++ b/qapi/job.json
@@ -2,7 +2,9 @@
 # vim: filetype=python
 
 ##
-# = Background jobs
+# ***************
+# Background jobs
+# ***************
 ##
 
 ##
diff --git a/qapi/machine-common.json b/qapi/machine-common.json
index 298e51f373..0f01599130 100644
--- a/qapi/machine-common.json
+++ b/qapi/machine-common.json
@@ -5,7 +5,9 @@
 # See the COPYING file in the top-level directory.
 
 ##
-# = Common machine types
+# ********************
+# Common machine types
+# ********************
 ##
 
 ##
diff --git a/qapi/machine.json b/qapi/machine.json
index f712e7da6d..af00a20b1f 100644
--- a/qapi/machine.json
+++ b/qapi/machine.json
@@ -5,7 +5,9 @@
 # See the COPYING file in the top-level directory.
 
 ##
-# = Machines
+# ********
+# Machines
+# ********
 ##
 
 { 'include': 'common.json' }
diff --git a/qapi/migration.json b/qapi/migration.json
index 2d39a8f748..3bf97df5d8 100644
--- a/qapi/migration.json
+++ b/qapi/migration.json
@@ -3,7 +3,9 @@
 #
 
 ##
-# = Migration
+# *********
+# Migration
+# *********
 ##
 
 { 'include': 'common.json' }
diff --git a/qapi/misc.json b/qapi/misc.json
index 4b9e601cfa..a180c16db2 100644
--- a/qapi/misc.json
+++ b/qapi/misc.json
@@ -3,7 +3,9 @@
 #
 
 ##
-# = Miscellanea
+# ***********
+# Miscellanea
+# ***********
 ##
 
 { 'include': 'common.json' }
diff --git a/qapi/net.json b/qapi/net.json
index 97ea183981..3b03843c16 100644
--- a/qapi/net.json
+++ b/qapi/net.json
@@ -3,7 +3,9 @@
 #
 
 ##
-# = Net devices
+# ***********
+# Net devices
+# ***********
 ##
 
 { 'include': 'sockets.json' }
diff --git a/qapi/pci.json b/qapi/pci.json
index dc85a41d28..a8671cd9ac 100644
--- a/qapi/pci.json
+++ b/qapi/pci.json
@@ -6,7 +6,9 @@
 # SPDX-License-Identifier: GPL-2.0-or-later
 
 ##
-# = PCI
+# ***
+# PCI
+# ***
 ##
 
 ##
diff --git a/qapi/qapi-schema.json b/qapi/qapi-schema.json
index a8f66163cb..49b9a0267d 100644
--- a/qapi/qapi-schema.json
+++ b/qapi/qapi-schema.json
@@ -1,7 +1,9 @@
 # -*- Mode: Python -*-
 # vim: filetype=python
 ##
-# = Introduction
+# ************
+# Introduction
+# ************
 #
 # This manual describes the commands and events supported by the QEMU
 # Monitor Protocol (QMP).
diff --git a/qapi/qdev.json b/qapi/qdev.json
index 32c7d10046..441ed518b8 100644
--- a/qapi/qdev.json
+++ b/qapi/qdev.json
@@ -5,7 +5,9 @@
 # See the COPYING file in the top-level directory.
 
 ##
-# = Device infrastructure (qdev)
+# ****************************
+# Device infrastructure (qdev)
+# ****************************
 ##
 
 { 'include': 'qom.json' }
diff --git a/qapi/qom.json b/qapi/qom.json
index b133b06447..f68f72fbbc 100644
--- a/qapi/qom.json
+++ b/qapi/qom.json
@@ -10,7 +10,9 @@
 { 'include': 'crypto.json' }
 
 ##
-# = QEMU Object Model (QOM)
+# ***********************
+# QEMU Object Model (QOM)
+# ***********************
 ##
 
 ##
diff --git a/qapi/replay.json b/qapi/replay.json
index 35e0c4a692..e46c5c1d3f 100644
--- a/qapi/replay.json
+++ b/qapi/replay.json
@@ -3,7 +3,9 @@
 #
 
 ##
-# = Record/replay
+# *************
+# Record/replay
+# *************
 ##
 
 { 'include': 'common.json' }
diff --git a/qapi/rocker.json b/qapi/rocker.json
index 0c7ef1f77c..e494964952 100644
--- a/qapi/rocker.json
+++ b/qapi/rocker.json
@@ -2,7 +2,9 @@
 # vim: filetype=python
 
 ##
-# = Rocker switch device
+# ********************
+# Rocker switch device
+# ********************
 ##
 
 ##
diff --git a/qapi/run-state.json b/qapi/run-state.json
index fd09beb35c..083a3c5eb3 100644
--- a/qapi/run-state.json
+++ b/qapi/run-state.json
@@ -3,7 +3,9 @@
 #
 
 ##
-# = VM run state
+# ************
+# VM run state
+# ************
 ##
 
 ##
diff --git a/qapi/sockets.json b/qapi/sockets.json
index f9f559daba..b5f4a8fecd 100644
--- a/qapi/sockets.json
+++ b/qapi/sockets.json
@@ -2,7 +2,9 @@
 # vim: filetype=python
 
 ##
-# = Socket data types
+# *****************
+# Socket data types
+# *****************
 ##
 
 ##
diff --git a/qapi/stats.json b/qapi/stats.json
index 8902ef94e0..78b88881ea 100644
--- a/qapi/stats.json
+++ b/qapi/stats.json
@@ -9,7 +9,9 @@
 # SPDX-License-Identifier: GPL-2.0-or-later
 
 ##
-# = Statistics
+# **********
+# Statistics
+# **********
 ##
 
 ##
diff --git a/qapi/tpm.json b/qapi/tpm.json
index a16a72edb9..e66b107f1d 100644
--- a/qapi/tpm.json
+++ b/qapi/tpm.json
@@ -3,7 +3,9 @@
 #
 
 ##
-# = TPM (trusted platform module) devices
+# *************************************
+# TPM (trusted platform module) devices
+# *************************************
 ##
 
 ##
diff --git a/qapi/trace.json b/qapi/trace.json
index eb5f63f513..d08c9c6a88 100644
--- a/qapi/trace.json
+++ b/qapi/trace.json
@@ -7,7 +7,9 @@
 # See the COPYING file in the top-level directory.
 
 ##
-# = Tracing
+# *******
+# Tracing
+# *******
 ##
 
 ##
diff --git a/qapi/transaction.json b/qapi/transaction.json
index 9d9e7af26c..927035f5a7 100644
--- a/qapi/transaction.json
+++ b/qapi/transaction.json
@@ -3,7 +3,9 @@
 #
 
 ##
-# = Transactions
+# ************
+# Transactions
+# ************
 ##
 
 { 'include': 'block-core.json' }
diff --git a/qapi/uefi.json b/qapi/uefi.json
index 6592183d6c..a206c2e953 100644
--- a/qapi/uefi.json
+++ b/qapi/uefi.json
@@ -3,7 +3,9 @@
 #
 
 ##
-# = UEFI Variable Store
+# *******************
+# UEFI Variable Store
+# *******************
 #
 # The QEMU efi variable store implementation (hw/uefi/) uses this to
 # store non-volatile variables in json format on disk.
diff --git a/qapi/ui.json b/qapi/ui.json
index 514fa159b1..f5e77ae19d 100644
--- a/qapi/ui.json
+++ b/qapi/ui.json
@@ -3,7 +3,9 @@
 #
 
 ##
-# = Remote desktop
+# **************
+# Remote desktop
+# **************
 ##
 
 { 'include': 'common.json' }
@@ -200,7 +202,8 @@
   'if': 'CONFIG_PIXMAN' }
 
 ##
-# == Spice
+# Spice
+# =====
 ##
 
 ##
@@ -461,7 +464,8 @@
   'if': 'CONFIG_SPICE' }
 
 ##
-# == VNC
+# VNC
+# ===
 ##
 
 ##
@@ -794,7 +798,9 @@
   'if': 'CONFIG_VNC' }
 
 ##
-# = Input
+# *****
+# Input
+# *****
 ##
 
 ##
diff --git a/qapi/vfio.json b/qapi/vfio.json
index b53b7caecd..a1a9c5b673 100644
--- a/qapi/vfio.json
+++ b/qapi/vfio.json
@@ -3,7 +3,9 @@
 #
 
 ##
-# = VFIO devices
+# ************
+# VFIO devices
+# ************
 ##
 
 ##
diff --git a/qapi/virtio.json b/qapi/virtio.json
index 73df718a26..3cac0774f7 100644
--- a/qapi/virtio.json
+++ b/qapi/virtio.json
@@ -3,7 +3,9 @@
 #
 
 ##
-# = Virtio devices
+# **************
+# Virtio devices
+# **************
 ##
 
 ##
diff --git a/qapi/yank.json b/qapi/yank.json
index 30f46c97c9..d13a8e9117 100644
--- a/qapi/yank.json
+++ b/qapi/yank.json
@@ -3,7 +3,9 @@
 #
 
 ##
-# = Yank feature
+# ************
+# Yank feature
+# ************
 ##
 
 ##
diff --git a/scripts/qapi/parser.py b/scripts/qapi/parser.py
index 949d9e8bff..aad7e249f8 100644
--- a/scripts/qapi/parser.py
+++ b/scripts/qapi/parser.py
@@ -597,22 +597,15 @@ class QAPISchemaParser:
             # Free-form documentation
             doc = QAPIDoc(info)
             doc.ensure_untagged_section(self.info)
-            first = True
             while line is not None:
                 if match := self._match_at_name_colon(line):
                     raise QAPIParseError(
                         self,
                         "'@%s:' not allowed in free-form documentation"
                         % match.group(1))
-                if line.startswith('='):
-                    if not first:
-                        raise QAPIParseError(
-                            self,
-                            "'=' heading must come first in a comment block")
                 doc.append_line(line)
                 self.accept(False)
                 line = self.get_doc_line()
-                first = False
 
         self.accept()
         doc.end()
diff --git a/storage-daemon/qapi/qapi-schema.json b/storage-daemon/qapi/qapi-schema.json
index 0427594c98..478e7a92b2 100644
--- a/storage-daemon/qapi/qapi-schema.json
+++ b/storage-daemon/qapi/qapi-schema.json
@@ -14,7 +14,9 @@
 # storage daemon.
 
 ##
-# = Introduction
+# ************
+# Introduction
+# ************
 #
 # This manual describes the commands and events supported by the QEMU
 # storage daemon QMP.
@@ -51,7 +53,9 @@
 { 'include': '../../qapi/job.json' }
 
 ##
-# = Block devices
+# *************
+# Block devices
+# *************
 ##
 { 'include': '../../qapi/block-core.json' }
 { 'include': '../../qapi/block-export.json' }
diff --git a/tests/qapi-schema/doc-good.json b/tests/qapi-schema/doc-good.json
index 14b808f909..fac13425b7 100644
--- a/tests/qapi-schema/doc-good.json
+++ b/tests/qapi-schema/doc-good.json
@@ -8,7 +8,9 @@
     'documentation-exceptions': [ 'Enum', 'Variant1', 'Alternate', 'cmd' ] } }
 
 ##
-# = Section
+# *******
+# Section
+# *******
 ##
 
 ##
@@ -16,7 +18,8 @@
 ##
 
 ##
-# == Subsection
+# Subsection
+# ==========
 #
 # *with emphasis*
 # @var {in braces}
@@ -144,7 +147,8 @@
   'if': { 'not': { 'any': [ 'IFONE', 'IFTWO' ] } } }
 
 ##
-# == Another subsection
+# Another subsection
+# ==================
 ##
 
 ##
diff --git a/tests/qapi-schema/doc-good.out b/tests/qapi-schema/doc-good.out
index dc8352eed4..04a5507264 100644
--- a/tests/qapi-schema/doc-good.out
+++ b/tests/qapi-schema/doc-good.out
@@ -55,13 +55,16 @@ event EVT_BOXED Object
     feature feat3
 doc freeform
     body=
-= Section
+*******
+Section
+*******
 doc freeform
     body=
 Just text, no heading.
 doc freeform
     body=
-== Subsection
+Subsection
+==========
 
 *with emphasis*
 @var {in braces}
@@ -155,7 +158,8 @@ description starts on the same line
 a feature
 doc freeform
     body=
-== Another subsection
+Another subsection
+==================
 doc symbol=cmd
     body=
 

From 62c4dc4b69ef7dcfcc476913a9c5fc15329e0290 Mon Sep 17 00:00:00 2001
From: John Snow <jsnow@redhat.com>
Date: Wed, 18 Jun 2025 12:53:53 -0400
Subject: [PATCH 2235/2760] qapi: lift restriction on using '=' in doc blocks

We reject lines starting with '=' in definition documentation.  This
made sense when such lines were headings in free-form documentation,
but not in definition documentation.

Before the previous commit, lines starting with '=' were headings in
free-form documentation, and rejected in definition documentation,
where such headings could not work.

The previous commit dropped the headings feature from free-form
documentation, because we can simply use plain rST headings.
Rejecting them in definition documentation no longer makes sense, so
drop that, too.

Signed-off-by: John Snow <jsnow@redhat.com>
Message-ID: <20250618165353.1980365-6-jsnow@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
[Amend commit message to explain why]
Signed-off-by: Markus Armbruster <armbru@redhat.com>
---
 scripts/qapi/parser.py                 |  4 ----
 tests/qapi-schema/doc-bad-section.err  |  1 -
 tests/qapi-schema/doc-bad-section.json | 10 ----------
 tests/qapi-schema/doc-bad-section.out  |  0
 tests/qapi-schema/meson.build          |  1 -
 5 files changed, 16 deletions(-)
 delete mode 100644 tests/qapi-schema/doc-bad-section.err
 delete mode 100644 tests/qapi-schema/doc-bad-section.json
 delete mode 100644 tests/qapi-schema/doc-bad-section.out

diff --git a/scripts/qapi/parser.py b/scripts/qapi/parser.py
index aad7e249f8..d43a123cd7 100644
--- a/scripts/qapi/parser.py
+++ b/scripts/qapi/parser.py
@@ -584,10 +584,6 @@ class QAPISchemaParser:
                         doc.append_line(text)
                     line = self.get_doc_indented(doc)
                     no_more_args = True
-                elif line.startswith('='):
-                    raise QAPIParseError(
-                        self,
-                        "unexpected '=' markup in definition documentation")
                 else:
                     # plain paragraph
                     doc.ensure_untagged_section(self.info)
diff --git a/tests/qapi-schema/doc-bad-section.err b/tests/qapi-schema/doc-bad-section.err
deleted file mode 100644
index 785cacc08c..0000000000
--- a/tests/qapi-schema/doc-bad-section.err
+++ /dev/null
@@ -1 +0,0 @@
-doc-bad-section.json:5:1: unexpected '=' markup in definition documentation
diff --git a/tests/qapi-schema/doc-bad-section.json b/tests/qapi-schema/doc-bad-section.json
deleted file mode 100644
index 8175d95867..0000000000
--- a/tests/qapi-schema/doc-bad-section.json
+++ /dev/null
@@ -1,10 +0,0 @@
-# = section within an expression comment
-
-##
-# @Enum:
-# == No good here
-# @one: The _one_ {and only}
-#
-# @two is undocumented
-##
-{ 'enum': 'Enum', 'data': [ 'one', 'two' ] }
diff --git a/tests/qapi-schema/doc-bad-section.out b/tests/qapi-schema/doc-bad-section.out
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/qapi-schema/meson.build b/tests/qapi-schema/meson.build
index 9577178b6f..c47025d16d 100644
--- a/tests/qapi-schema/meson.build
+++ b/tests/qapi-schema/meson.build
@@ -61,7 +61,6 @@ schemas = [
   'doc-bad-event-arg.json',
   'doc-bad-feature.json',
   'doc-bad-indent.json',
-  'doc-bad-section.json',
   'doc-bad-symbol.json',
   'doc-bad-union-member.json',
   'doc-before-include.json',

From c13ceeb42df5452690fc530269696f59da921b31 Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Tue, 8 Jul 2025 09:28:27 +0200
Subject: [PATCH 2236/2760] qapi: Clean up "This command will do ..." command
 descriptions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Use imperative mood "Do ..." instead.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20250708072828.105185-2-armbru@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
---
 qapi/control.json   |  9 +++++----
 qapi/misc-i386.json | 11 +++++------
 qapi/qom.json       | 10 ++++------
 3 files changed, 14 insertions(+), 16 deletions(-)

diff --git a/qapi/control.json b/qapi/control.json
index ab0b3a3bbe..5fed0701f8 100644
--- a/qapi/control.json
+++ b/qapi/control.json
@@ -160,10 +160,11 @@
 ##
 # @quit:
 #
-# This command will cause the QEMU process to exit gracefully.  While
-# every attempt is made to send the QMP response before terminating,
-# this is not guaranteed.  When using this interface, a premature EOF
-# would not be unexpected.
+# Request graceful QEMU process termination.
+#
+# While every attempt is made to send the QMP response before
+# terminating, this is not guaranteed.  When using this interface, a
+# premature EOF would not be unexpected.
 #
 # Since: 0.14
 #
diff --git a/qapi/misc-i386.json b/qapi/misc-i386.json
index 5fefa0a484..b53ed39288 100644
--- a/qapi/misc-i386.json
+++ b/qapi/misc-i386.json
@@ -6,9 +6,9 @@
 ##
 # @rtc-reset-reinjection:
 #
-# This command will reset the RTC interrupt reinjection backlog.  Can
-# be used if another mechanism to synchronize guest time is in effect,
-# for example QEMU guest agent's guest-set-time command.
+# Reset the RTC interrupt reinjection backlog.  Can be used if another
+# mechanism to synchronize guest time is in effect, for example QEMU
+# guest agent's guest-set-time command.
 #
 # Use of this command is only applicable for x86 machines with an RTC,
 # and on other machines will silently return without performing any
@@ -233,8 +233,7 @@
 ##
 # @sev-inject-launch-secret:
 #
-# This command injects a secret blob into memory of a SEV/SEV-ES
-# guest.
+# Inject a secret blob into a SEV/SEV-ES guest's memory.
 #
 # This is only valid on x86 machines configured with KVM and the
 # 'sev-guest' confidential virtualization object.  SEV-SNP guests do
@@ -272,7 +271,7 @@
 ##
 # @query-sev-attestation-report:
 #
-# This command is used to get the SEV attestation report.
+# Get the SEV attestation report.
 #
 # This is only valid on x86 machines configured with KVM and the
 # 'sev-guest' confidential virtualization object.  The attestation
diff --git a/qapi/qom.json b/qapi/qom.json
index f68f72fbbc..6c38e865a6 100644
--- a/qapi/qom.json
+++ b/qapi/qom.json
@@ -50,8 +50,7 @@
 ##
 # @qom-list:
 #
-# This command will list any properties of a object given a path in
-# the object model.
+# List properties of a object given a path in the object model.
 #
 # @path: the path within the object model.  See @qom-get for a
 #     description of this parameter.
@@ -78,8 +77,7 @@
 ##
 # @qom-get:
 #
-# This command will get a property from a object model path and return
-# the value.
+# Get a property value.
 #
 # @path: The path within the object model.  There are two forms of
 #     supported paths--absolute and partial paths.
@@ -130,7 +128,7 @@
 ##
 # @qom-set:
 #
-# This command will set a property from a object model path.
+# Set a property value.
 #
 # @path: see @qom-get for a description of this parameter
 #
@@ -173,7 +171,7 @@
 ##
 # @qom-list-types:
 #
-# This command will return a list of types given search parameters
+# Return a list of types given search parameters.
 #
 # @implements: if specified, only return types that implement this
 #     type name

From 92227370eb3d844528e6d7bc2fb42525d8245eaf Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Tue, 8 Jul 2025 09:28:28 +0200
Subject: [PATCH 2237/2760] qapi: Clean up a few Errors: sections
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Use the conventional "- If <error-condition>" phrasing, optionally
with ", <error-class>".

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20250708072828.105185-3-armbru@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
---
 qapi/misc-i386.json | 7 +++----
 qapi/qom.json       | 4 ++--
 2 files changed, 5 insertions(+), 6 deletions(-)

diff --git a/qapi/misc-i386.json b/qapi/misc-i386.json
index b53ed39288..24a2e143f6 100644
--- a/qapi/misc-i386.json
+++ b/qapi/misc-i386.json
@@ -283,10 +283,9 @@
 # Returns: SevAttestationReport objects.
 #
 # Errors:
-#     - This will return an error if the attestation report is
-#       unavailable, either due to an invalid guest configuration
-#       or if the guest has not reached the required SEV state,
-#       GenericError
+#     - If the attestation report is unavailable, either due to an
+#       invalid guest configuration or because the guest has not
+#       reached the required SEV state, GenericError
 #
 # Since: 6.1
 #
diff --git a/qapi/qom.json b/qapi/qom.json
index 6c38e865a6..fbf94b9e09 100644
--- a/qapi/qom.json
+++ b/qapi/qom.json
@@ -1261,7 +1261,7 @@
 # Create a QOM object.
 #
 # Errors:
-#     - Error if @qom-type is not a valid class name
+#     - If @qom-type is not a valid class name
 #
 # Since: 2.0
 #
@@ -1283,7 +1283,7 @@
 # @id: the name of the QOM object to remove
 #
 # Errors:
-#     - Error if @id is not a valid id for a QOM object
+#     - If @id is not a valid id for a QOM object
 #
 # Since: 2.0
 #

From a539cd26145c726fddd19eb0e2c20332960b0245 Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Fri, 27 Jun 2025 11:51:26 +0800
Subject: [PATCH 2238/2760] i386/cpu: Mark EBX/ECX/EDX in CPUID 0x80000000 leaf
 as reserved for Intel

Per SDM,

80000000H EAX Maximum Input Value for Extended Function CPUID Information.
          EBX Reserved.
          ECX Reserved.
          EDX Reserved.

EBX/ECX/EDX in CPUID 0x80000000 leaf are reserved. Intel is using 0x0
leaf to encode vendor.

Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Reviewed-by: Tao Su <tao1.su@linux.intel.com>
Link: https://lore.kernel.org/r/20250627035129.2755537-2-zhao1.liu@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 4f0c973446..ae508fa962 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -8280,9 +8280,15 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
         break;
     case 0x80000000:
         *eax = env->cpuid_xlevel;
-        *ebx = env->cpuid_vendor1;
-        *edx = env->cpuid_vendor2;
-        *ecx = env->cpuid_vendor3;
+
+        if (cpu->vendor_cpuid_only_v2 &&
+            (IS_INTEL_CPU(env) || IS_ZHAOXIN_CPU(env))) {
+            *ebx = *ecx = *edx = 0;
+        } else {
+            *ebx = env->cpuid_vendor1;
+            *edx = env->cpuid_vendor2;
+            *ecx = env->cpuid_vendor3;
+        }
         break;
     case 0x80000001:
         *eax = env->cpuid_version;

From 1c52c470baba1a2cc2d96e14c9f845ec3d2ea8c4 Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Fri, 27 Jun 2025 11:51:27 +0800
Subject: [PATCH 2239/2760] i386/cpu: Mark CPUID 0x80000007[EBX] as reserved
 for Intel

Per SDM,

80000007H EAX Reserved = 0.
          EBX Reserved = 0.
          ECX Reserved = 0.
          EDX Bits 07-00: Reserved = 0.
              Bit 08: Invariant TSC available if 1.
              Bits 31-09: Reserved = 0.

EAX/EBX/ECX in CPUID 0x80000007 leaf are reserved for Intel.

At present, EAX is reserved for AMD, too. And AMD hasn't used ECX in
QEMU. So these 2 registers are both left as 0.

Therefore, only fix the EBX and excode it as 0 for Intel.

Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Reviewed-by: Tao Su <tao1.su@linux.intel.com>
Link: https://lore.kernel.org/r/20250627035129.2755537-3-zhao1.liu@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index ae508fa962..533c9d9abc 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -8376,7 +8376,11 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
     }
     case 0x80000007:
         *eax = 0;
-        *ebx = env->features[FEAT_8000_0007_EBX];
+        if (cpu->vendor_cpuid_only_v2 && IS_INTEL_CPU(env)) {
+            *ebx = 0;
+        } else {
+            *ebx = env->features[FEAT_8000_0007_EBX];
+        }
         *ecx = 0;
         *edx = env->features[FEAT_8000_0007_EDX];
         break;

From da84c011544b808b9ea3dface2292437dd29d053 Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Fri, 27 Jun 2025 11:51:28 +0800
Subject: [PATCH 2240/2760] i386/cpu: Mark CPUID 0x80000008 ECX bits[0:7] &
 [12:15] as reserved for Intel/Zhaoxin

Per SDM,

80000008H EAX Linear/Physical Address size.
              Bits 07-00: #Physical Address Bits*.
              Bits 15-08: #Linear Address Bits.
              Bits 31-16: Reserved = 0.
          EBX Bits 08-00: Reserved = 0.
              Bit 09: WBNOINVD is available if 1.
              Bits 31-10: Reserved = 0.
          ECX Reserved = 0.
          EDX Reserved = 0.

ECX/EDX in CPUID 0x80000008 leaf are reserved.

Currently, in QEMU, only ECX bits[0:7] and ECX bits[12:15] are encoded,
and both are emulated in QEMU.

Considering that Intel and Zhaoxin are already using the 0x1f leaf to
describe CPU topology, which includes similar information, Intel and
Zhaoxin will not implement ECX bits[0:7] and bits[12:15] of 0x80000008.

Therefore, mark these two fields as reserved and clear them for Intel
and Zhaoxin guests.

Reviewed-by: Tao Su <tao1.su@linux.intel.com>
Tested-by: Yi Lai <yi1.lai@intel.com>
Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250714080859.1960104-3-zhao1.liu@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 533c9d9abc..1a2cae6ea1 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -8393,6 +8393,17 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
              *eax |= (cpu->guest_phys_bits << 16);
         }
         *ebx = env->features[FEAT_8000_0008_EBX];
+
+        /*
+         * Don't emulate Bits [7:0] & Bits [15:12] for Intel/Zhaoxin, since
+         * they're using 0x1f leaf.
+         */
+        if (cpu->vendor_cpuid_only_v2 &&
+            (IS_INTEL_CPU(env) || IS_ZHAOXIN_CPU(env))) {
+            *ecx = *edx = 0;
+            break;
+        }
+
         if (threads_per_pkg > 1) {
             /*
              * Bits 15:12 is "The number of bits in the initial

From 1b74aa47c33f2aa37ab7339826e30abb22ca0a5f Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Sat, 12 Jul 2025 09:21:14 +0200
Subject: [PATCH 2241/2760] tests/functional: test_x86_cpu_model_versions:
 remove dead tests

Tests that require machines older than 4.2 are now unconditionally skipped.
Remove them if they test legacy behavior, or use the latest machine if
they test current behavior.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 .../functional/test_x86_cpu_model_versions.py | 110 ++----------------
 1 file changed, 12 insertions(+), 98 deletions(-)

diff --git a/tests/functional/test_x86_cpu_model_versions.py b/tests/functional/test_x86_cpu_model_versions.py
index bd18acd44f..36c968f1c0 100755
--- a/tests/functional/test_x86_cpu_model_versions.py
+++ b/tests/functional/test_x86_cpu_model_versions.py
@@ -72,44 +72,11 @@ class X86CPUModelAliases(QemuSystemTest):
         self.assertNotIn("EPYC-IBPB-v1", cpus,
                          "EPYC-IBPB shouldn't be versioned")
 
-    def test_4_0_alias_compatibility(self):
-        """
-        Check if pc-*-4.0 unversioned CPU model won't be reported as aliases
-        """
-        self.set_machine('pc-i440fx-4.0')
-        # pc-*-4.0 won't expose non-versioned CPU models as aliases
-        # We do this to help management software to keep compatibility
-        # with older QEMU versions that didn't have the versioned CPU model
-        self.vm.add_args('-S')
-        self.vm.launch()
-        cpus = dict((m['name'], m) for m in
-                    self.vm.cmd('query-cpu-definitions'))
-
-        self.assertFalse(cpus['Cascadelake-Server']['static'],
-                         'unversioned Cascadelake-Server CPU model must not be static')
-        self.assertNotIn('alias-of', cpus['Cascadelake-Server'],
-                         'Cascadelake-Server must not be an alias')
-        self.assertNotIn('alias-of', cpus['Cascadelake-Server-v1'],
-                         'Cascadelake-Server-v1 must not be an alias')
-
-        self.assertFalse(cpus['qemu64']['static'],
-                         'unversioned qemu64 CPU model must not be static')
-        self.assertNotIn('alias-of', cpus['qemu64'],
-                         'qemu64 must not be an alias')
-        self.assertNotIn('alias-of', cpus['qemu64-v1'],
-                         'qemu64-v1 must not be an alias')
-
-        self.validate_variant_aliases(cpus)
-
-        # On pc-*-4.0, no CPU model should be reported as an alias:
-        for name,c in cpus.items():
-            self.assertNotIn('alias-of', c, "%s shouldn't be an alias" % (name))
-
-    def test_4_1_alias(self):
+    def test_unversioned_alias(self):
         """
         Check if unversioned CPU model is an alias pointing to right version
         """
-        self.set_machine('pc-i440fx-4.1')
+        self.set_machine('pc')
         self.vm.add_args('-S')
         self.vm.launch()
 
@@ -133,7 +100,7 @@ class X86CPUModelAliases(QemuSystemTest):
 
         self.validate_variant_aliases(cpus)
 
-        # On pc-*-4.1, -noTSX and -IBRS models should be aliases:
+        # On recent PC machines, -noTSX and -IBRS models should be aliases:
         self.assertEqual(cpus["Haswell"].get('alias-of'),
                          "Haswell-v1",
                          "Haswell must be an alias")
@@ -247,8 +214,8 @@ class CascadelakeArchCapabilities(QemuSystemTest):
         cpu_path = self.vm.cmd('query-cpus-fast')[0].get('qom-path')
         return self.vm.cmd('qom-get', path=cpu_path, property=prop)
 
-    def test_4_1(self):
-        self.set_machine('pc-i440fx-4.1')
+    def test(self):
+        self.set_machine('pc')
         # machine-type only:
         self.vm.add_args('-S')
         self.set_vm_arg('-cpu',
@@ -256,80 +223,27 @@ class CascadelakeArchCapabilities(QemuSystemTest):
                         'enforce=off')
         self.vm.launch()
         self.assertFalse(self.get_cpu_prop('arch-capabilities'),
-                         'pc-i440fx-4.1 + Cascadelake-Server should not have arch-capabilities')
+                         'pc + Cascadelake-Server should not have arch-capabilities')
 
-    def test_4_0(self):
-        self.set_machine('pc-i440fx-4.0')
-        self.vm.add_args('-S')
-        self.set_vm_arg('-cpu',
-                        'Cascadelake-Server,x-force-features=on,check=off,'
-                        'enforce=off')
-        self.vm.launch()
-        self.assertFalse(self.get_cpu_prop('arch-capabilities'),
-                         'pc-i440fx-4.0 + Cascadelake-Server should not have arch-capabilities')
-
-    def test_set_4_0(self):
-        self.set_machine('pc-i440fx-4.0')
-        # command line must override machine-type if CPU model is not versioned:
-        self.vm.add_args('-S')
-        self.set_vm_arg('-cpu',
-                        'Cascadelake-Server,x-force-features=on,check=off,'
-                        'enforce=off,+arch-capabilities')
-        self.vm.launch()
-        self.assertTrue(self.get_cpu_prop('arch-capabilities'),
-                        'pc-i440fx-4.0 + Cascadelake-Server,+arch-capabilities should have arch-capabilities')
-
-    def test_unset_4_1(self):
-        self.set_machine('pc-i440fx-4.1')
+    def test_unset(self):
+        self.set_machine('pc')
         self.vm.add_args('-S')
         self.set_vm_arg('-cpu',
                         'Cascadelake-Server,x-force-features=on,check=off,'
                         'enforce=off,-arch-capabilities')
         self.vm.launch()
         self.assertFalse(self.get_cpu_prop('arch-capabilities'),
-                         'pc-i440fx-4.1 + Cascadelake-Server,-arch-capabilities should not have arch-capabilities')
+                         'pc + Cascadelake-Server,-arch-capabilities should not have arch-capabilities')
 
-    def test_v1_4_0(self):
-        self.set_machine('pc-i440fx-4.0')
-        # versioned CPU model overrides machine-type:
-        self.vm.add_args('-S')
-        self.set_vm_arg('-cpu',
-                        'Cascadelake-Server-v1,x-force-features=on,check=off,'
-                        'enforce=off')
-        self.vm.launch()
-        self.assertFalse(self.get_cpu_prop('arch-capabilities'),
-                         'pc-i440fx-4.0 + Cascadelake-Server-v1 should not have arch-capabilities')
-
-    def test_v2_4_0(self):
-        self.set_machine('pc-i440fx-4.0')
-        self.vm.add_args('-S')
-        self.set_vm_arg('-cpu',
-                        'Cascadelake-Server-v2,x-force-features=on,check=off,'
-                        'enforce=off')
-        self.vm.launch()
-        self.assertTrue(self.get_cpu_prop('arch-capabilities'),
-                        'pc-i440fx-4.0 + Cascadelake-Server-v2 should have arch-capabilities')
-
-    def test_v1_set_4_0(self):
-        self.set_machine('pc-i440fx-4.0')
-        # command line must override machine-type and versioned CPU model:
-        self.vm.add_args('-S')
-        self.set_vm_arg('-cpu',
-                        'Cascadelake-Server-v1,x-force-features=on,check=off,'
-                        'enforce=off,+arch-capabilities')
-        self.vm.launch()
-        self.assertTrue(self.get_cpu_prop('arch-capabilities'),
-                        'pc-i440fx-4.0 + Cascadelake-Server-v1,+arch-capabilities should have arch-capabilities')
-
-    def test_v2_unset_4_1(self):
-        self.set_machine('pc-i440fx-4.1')
+    def test_v2_unset(self):
+        self.set_machine('pc')
         self.vm.add_args('-S')
         self.set_vm_arg('-cpu',
                         'Cascadelake-Server-v2,x-force-features=on,check=off,'
                         'enforce=off,-arch-capabilities')
         self.vm.launch()
         self.assertFalse(self.get_cpu_prop('arch-capabilities'),
-                         'pc-i440fx-4.1 + Cascadelake-Server-v2,-arch-capabilities should not have arch-capabilities')
+                         'pc + Cascadelake-Server-v2,-arch-capabilities should not have arch-capabilities')
 
 if __name__ == '__main__':
     QemuSystemTest.main()

From c8958b7eb494d06a209b1befb6c34edfbce68867 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Sat, 12 Jul 2025 10:02:01 +0200
Subject: [PATCH 2242/2760] tests/vm: bump FreeBSD image to 14.3

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 tests/vm/freebsd | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/vm/freebsd b/tests/vm/freebsd
index 74b3b1e520..2e96c9eba5 100755
--- a/tests/vm/freebsd
+++ b/tests/vm/freebsd
@@ -28,8 +28,8 @@ class FreeBSDVM(basevm.BaseVM):
     name = "freebsd"
     arch = "x86_64"
 
-    link = "https://download.freebsd.org/releases/CI-IMAGES/14.1-RELEASE/amd64/Latest/FreeBSD-14.1-RELEASE-amd64-BASIC-CI.raw.xz"
-    csum = "202fe27a05427f0a86d3ebb97712745186f2776ccc4f70d95466dd99a0238ba5"
+    link = "https://download.freebsd.org/releases/CI-IMAGES/14.3-RELEASE/amd64/Latest/FreeBSD-14.3-RELEASE-amd64-BASIC-CI.raw.xz"
+    csum = "ec0f5a4bbe63aa50a725d9fee0f1931f850e9a21cbebdadb991df00f168d6805"
     size = "20G"
 
     BUILD_SCRIPT = """

From 075e91a4a42dad834d6488cd8141fa29c7b218bd Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Fri, 27 Jun 2025 11:51:29 +0800
Subject: [PATCH 2243/2760] i386/cpu: Reorder CPUID leaves in cpu_x86_cpuid()

Sort the CPUID leaves strictly by index to facilitate checking and
changing.

Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Reviewed-by: Tao Su <tao1.su@linux.intel.com>
Link: https://lore.kernel.org/r/20250627035129.2755537-5-zhao1.liu@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 60 +++++++++++++++++++++++------------------------
 1 file changed, 30 insertions(+), 30 deletions(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 1a2cae6ea1..3b7c22e5d3 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -8052,21 +8052,6 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
         assert(!(*eax & ~0x1f));
         *ebx &= 0xffff; /* The count doesn't need to be reliable. */
         break;
-    case 0x1C:
-        if (cpu->enable_pmu && (env->features[FEAT_7_0_EDX] & CPUID_7_0_EDX_ARCH_LBR)) {
-            x86_cpu_get_supported_cpuid(0x1C, 0, eax, ebx, ecx, edx);
-            *edx = 0;
-        }
-        break;
-    case 0x1F:
-        /* V2 Extended Topology Enumeration Leaf */
-        if (!x86_has_cpuid_0x1f(cpu)) {
-            *eax = *ebx = *ecx = *edx = 0;
-            break;
-        }
-
-        encode_topo_cpuid1f(env, count, topo_info, eax, ebx, ecx, edx);
-        break;
     case 0xD: {
         /* Processor Extended State */
         *eax = 0;
@@ -8207,6 +8192,12 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
         }
         break;
     }
+    case 0x1C:
+        if (cpu->enable_pmu && (env->features[FEAT_7_0_EDX] & CPUID_7_0_EDX_ARCH_LBR)) {
+            x86_cpu_get_supported_cpuid(0x1C, 0, eax, ebx, ecx, edx);
+            *edx = 0;
+        }
+        break;
     case 0x1D: {
         /* AMX TILE, for now hardcoded for Sapphire Rapids*/
         *eax = 0;
@@ -8244,6 +8235,15 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
         }
         break;
     }
+    case 0x1F:
+        /* V2 Extended Topology Enumeration Leaf */
+        if (!x86_has_cpuid_0x1f(cpu)) {
+            *eax = *ebx = *ecx = *edx = 0;
+            break;
+        }
+
+        encode_topo_cpuid1f(env, count, topo_info, eax, ebx, ecx, edx);
+        break;
     case 0x24: {
         *eax = 0;
         *ebx = 0;
@@ -8472,6 +8472,21 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
             *edx = 0;
         }
         break;
+    case 0x8000001F:
+        *eax = *ebx = *ecx = *edx = 0;
+        if (sev_enabled()) {
+            *eax = 0x2;
+            *eax |= sev_es_enabled() ? 0x8 : 0;
+            *eax |= sev_snp_enabled() ? 0x10 : 0;
+            *ebx = sev_get_cbit_position() & 0x3f; /* EBX[5:0] */
+            *ebx |= (sev_get_reduced_phys_bits() & 0x3f) << 6; /* EBX[11:6] */
+        }
+        break;
+    case 0x80000021:
+        *eax = *ebx = *ecx = *edx = 0;
+        *eax = env->features[FEAT_8000_0021_EAX];
+        *ebx = env->features[FEAT_8000_0021_EBX];
+        break;
     case 0x80000022:
         *eax = *ebx = *ecx = *edx = 0;
         /* AMD Extended Performance Monitoring and Debug */
@@ -8504,21 +8519,6 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
         *ecx = 0;
         *edx = 0;
         break;
-    case 0x8000001F:
-        *eax = *ebx = *ecx = *edx = 0;
-        if (sev_enabled()) {
-            *eax = 0x2;
-            *eax |= sev_es_enabled() ? 0x8 : 0;
-            *eax |= sev_snp_enabled() ? 0x10 : 0;
-            *ebx = sev_get_cbit_position() & 0x3f; /* EBX[5:0] */
-            *ebx |= (sev_get_reduced_phys_bits() & 0x3f) << 6; /* EBX[11:6] */
-        }
-        break;
-    case 0x80000021:
-        *eax = *ebx = *ecx = *edx = 0;
-        *eax = env->features[FEAT_8000_0021_EAX];
-        *ebx = env->features[FEAT_8000_0021_EBX];
-        break;
     default:
         /* reserved values: zero */
         *eax = 0;

From f985a1195ba2d9c6f6f33e83fe2e419a7e8acb60 Mon Sep 17 00:00:00 2001
From: Chuang Xu <xuchuangxclwt@bytedance.com>
Date: Mon, 14 Jul 2025 16:08:56 +0800
Subject: [PATCH 2244/2760] i386/cpu: Fix number of addressable IDs field for
 CPUID.01H.EBX[23:16]

When QEMU is started with:
-cpu host,migratable=on,host-cache-info=on,l3-cache=off
-smp 180,sockets=2,dies=1,cores=45,threads=2

On Intel platform:
CPUID.01H.EBX[23:16] is defined as "max number of addressable IDs for
logical processors in the physical package".

When executing "cpuid -1 -l 1 -r" in the guest, we obtain a value of 90 for
CPUID.01H.EBX[23:16], whereas the expected value is 128. Additionally,
executing "cpuid -1 -l 4 -r" in the guest yields a value of 63 for
CPUID.04H.EAX[31:26], which matches the expected result.

As (1+CPUID.04H.EAX[31:26]) rounds up to the nearest power-of-2 integer,
it's necessary to round up CPUID.01H.EBX[23:16] to the nearest power-of-2
integer too. Otherwise there would be unexpected results in guest with
older kernel.

For example, when QEMU is started with CLI above and xtopology is disabled,
guest kernel 5.15.120 uses CPUID.01H.EBX[23:16]/(1+CPUID.04H.EAX[31:26]) to
calculate threads-per-core in detect_ht(). Then guest will get "90/(1+63)=1"
as the result, even though threads-per-core should actually be 2.

And on AMD platform:
CPUID.01H.EBX[23:16] is defined as "Logical processor count". Current
result meets our expectation.

So round up CPUID.01H.EBX[23:16] to the nearest power-of-2 integer only
for Intel platform to solve the unexpected result.

Use the "x-vendor-cpuid-only-v2" compat option to fix this issue.

Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Guixiong Wei <weiguixiong@bytedance.com>
Signed-off-by: Yipeng Yin <yinyipeng@bytedance.com>
Signed-off-by: Chuang Xu <xuchuangxclwt@bytedance.com>
Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250714080859.1960104-5-zhao1.liu@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 3b7c22e5d3..12e719e995 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -7871,7 +7871,17 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
         }
         *edx = env->features[FEAT_1_EDX];
         if (threads_per_pkg > 1) {
-            *ebx |= threads_per_pkg << 16;
+            /*
+             * For CPUID.01H.EBX[Bits 23-16], AMD requires logical processor
+             * count, but Intel needs maximum number of addressable IDs for
+             * logical processors per package.
+             */
+            if (cpu->vendor_cpuid_only_v2 &&
+                (IS_INTEL_CPU(env) || IS_ZHAOXIN_CPU(env))) {
+                *ebx |= 1 << apicid_pkg_offset(topo_info) << 16;
+            } else {
+                *ebx |= threads_per_pkg << 16;
+            }
         }
         break;
     case 2: { /* cache info: needed for Pentium Pro compatibility */

From a62fef58299562aae6667b8d8552247423e886b3 Mon Sep 17 00:00:00 2001
From: Qian Wen <qian.wen@intel.com>
Date: Mon, 14 Jul 2025 16:08:57 +0800
Subject: [PATCH 2245/2760] i386/cpu: Fix cpu number overflow in
 CPUID.01H.EBX[23:16]

The legacy topology enumerated by CPUID.1.EBX[23:16] is defined in SDM
Vol2:

Bits 23-16: Maximum number of addressable IDs for logical processors in
this physical package.

When threads_per_socket > 255, it will 1) overwrite bits[31:24] which is
apic_id, 2) bits [23:16] get truncated.

Specifically, if launching the VM with -smp 256, the value written to
EBX[23:16] is 0 because of data overflow. If the guest only supports
legacy topology, without V2 Extended Topology enumerated by CPUID.0x1f
or Extended Topology enumerated by CPUID.0x0b to support over 255 CPUs,
the return of the kernel invoking cpu_smt_allowed() is false and APs
(application processors) will fail to bring up. Then only CPU 0 is online,
and others are offline.

For example, launch VM via:
qemu-system-x86_64 -M q35,accel=kvm,kernel-irqchip=split \
    -cpu qemu64,cpuid-0xb=off -smp 256 -m 32G \
    -drive file=guest.img,if=none,id=virtio-disk0,format=raw \
    -device virtio-blk-pci,drive=virtio-disk0,bootindex=1 --nographic

The guest shows:
    CPU(s):               256
    On-line CPU(s) list:  0
    Off-line CPU(s) list: 1-255

To avoid this issue caused by overflow, limit the max value written to
EBX[23:16] to 255 as the HW does.

Cc: qemu-stable@nongnu.org
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Signed-off-by: Qian Wen <qian.wen@intel.com>
Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250714080859.1960104-6-zhao1.liu@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 12e719e995..608fdcf757 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -7871,6 +7871,8 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
         }
         *edx = env->features[FEAT_1_EDX];
         if (threads_per_pkg > 1) {
+            uint32_t num;
+
             /*
              * For CPUID.01H.EBX[Bits 23-16], AMD requires logical processor
              * count, but Intel needs maximum number of addressable IDs for
@@ -7878,10 +7880,13 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
              */
             if (cpu->vendor_cpuid_only_v2 &&
                 (IS_INTEL_CPU(env) || IS_ZHAOXIN_CPU(env))) {
-                *ebx |= 1 << apicid_pkg_offset(topo_info) << 16;
+                num = 1 << apicid_pkg_offset(topo_info);
             } else {
-                *ebx |= threads_per_pkg << 16;
+                num = threads_per_pkg;
             }
+
+            /* Fixup overflow: max value for bits 23-16 is 255. */
+            *ebx |= MIN(num, 255) << 16;
         }
         break;
     case 2: { /* cache info: needed for Pentium Pro compatibility */

From 3e86124e7cb9b66e07fb992667865a308f16fcf2 Mon Sep 17 00:00:00 2001
From: Qian Wen <qian.wen@intel.com>
Date: Mon, 14 Jul 2025 16:08:58 +0800
Subject: [PATCH 2246/2760] i386/cpu: Fix overflow of cache topology fields in
 CPUID.04H

According to SDM, CPUID.0x4:EAX[31:26] indicates the Maximum number of
addressable IDs for processor cores in the physical package. If we
launch over 64 cores VM, the 6-bit field will overflow, and the wrong
core_id number will be reported.

Since the HW reports 0x3f when the intel processor has over 64 cores,
limit the max value written to EAX[31:26] to 63, so max num_cores should
be 64.

For EAX[14:25], though at present Q35 supports up to 4096 CPUs, by
constructing a specific topology, the width of the APIC ID can be
extended beyond 12 bits. For example, using `-smp threads=33,cores=9,
modules=9` results in a die level offset of 6 + 4 + 4 = 14 bits, which
can also cause overflow.  check and honor the maximum value for
EAX[14:25] as well.

In addition, for host-cache-info case, also apply the same checks and
fixes.

Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Signed-off-by: Qian Wen <qian.wen@intel.com>
Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250714080859.1960104-7-zhao1.liu@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 608fdcf757..fdc677614d 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -349,11 +349,17 @@ static void encode_cache_cpuid4(CPUCacheInfo *cache,
     assert(cache->size == cache->line_size * cache->associativity *
                           cache->partitions * cache->sets);
 
+    /*
+     * The following fields have bit-width limitations, so consider the
+     * maximum values to avoid overflow:
+     * Bits 25-14: maximum 4095.
+     * Bits 31-26: maximum 63.
+     */
     *eax = CACHE_TYPE(cache->type) |
            CACHE_LEVEL(cache->level) |
            (cache->self_init ? CACHE_SELF_INIT_LEVEL : 0) |
-           (max_core_ids_in_package(topo_info) << 26) |
-           (max_thread_ids_for_cache(topo_info, cache->share_level) << 14);
+           (MIN(max_core_ids_in_package(topo_info), 63) << 26) |
+           (MIN(max_thread_ids_for_cache(topo_info, cache->share_level), 4095) << 14);
 
     assert(cache->line_size > 0);
     assert(cache->partitions > 0);
@@ -7930,13 +7936,13 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
                 int host_vcpus_per_cache = 1 + ((*eax & 0x3FFC000) >> 14);
 
                 *eax &= ~0xFC000000;
-                *eax |= max_core_ids_in_package(topo_info) << 26;
+                *eax |= MIN(max_core_ids_in_package(topo_info), 63) << 26;
                 if (host_vcpus_per_cache > threads_per_pkg) {
                     *eax &= ~0x3FFC000;
 
                     /* Share the cache at package level. */
-                    *eax |= max_thread_ids_for_cache(topo_info,
-                                CPU_TOPOLOGY_LEVEL_SOCKET) << 14;
+                    *eax |= MIN(max_thread_ids_for_cache(topo_info,
+                                CPU_TOPOLOGY_LEVEL_SOCKET), 4095) << 14;
                 }
             }
         } else if (cpu->vendor_cpuid_only && IS_AMD_CPU(env)) {

From 5d21ee453ad8e3f95f75e542cb3b35c5bb7cf23a Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Mon, 14 Jul 2025 16:08:59 +0800
Subject: [PATCH 2247/2760] i386/cpu: Honor maximum value for
 CPUID.8000001DH.EAX[25:14]

CPUID.8000001DH:EAX[25:14] is "NumSharingCache", and the number of
logical processors sharing this cache is the value of this field
incremented by 1. Because of its width limitation, the maximum value
currently supported is 4095.

Though at present Q35 supports up to 4096 CPUs, by constructing a
specific topology, the width of the APIC ID can be extended beyond 12
bits. For example, using `-smp threads=33,cores=9,modules=9` results in
a die level offset of 6 + 4 + 4 = 14 bits, which can also cause
overflow. Check and honor the maximum value as CPUID.04H did.

Cc: Babu Moger <babu.moger@amd.com>
Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250714080859.1960104-8-zhao1.liu@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index fdc677614d..da7d8dca63 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -560,7 +560,8 @@ static void encode_cache_cpuid8000001d(CPUCacheInfo *cache,
 
     *eax = CACHE_TYPE(cache->type) | CACHE_LEVEL(cache->level) |
                (cache->self_init ? CACHE_SELF_INIT_LEVEL : 0);
-    *eax |= max_thread_ids_for_cache(topo_info, cache->share_level) << 14;
+    /* Bits 25:14 - NumSharingCache: maximum 4095. */
+    *eax |= MIN(max_thread_ids_for_cache(topo_info, cache->share_level), 4095) << 14;
 
     assert(cache->line_size > 0);
     assert(cache->partitions > 0);

From 52f45faa4f843617ae09e7965aec963fab3fb564 Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <akihiko.odaki@daynix.com>
Date: Fri, 30 May 2025 13:33:16 +0900
Subject: [PATCH 2248/2760] qdev-properties: Add
 DEFINE_PROP_ON_OFF_AUTO_BIT64()

DEFINE_PROP_ON_OFF_AUTO_BIT64() corresponds to DEFINE_PROP_ON_OFF_AUTO()
as DEFINE_PROP_BIT64() corresponds to DEFINE_PROP_BOOL(). The difference
is that DEFINE_PROP_ON_OFF_AUTO_BIT64() exposes OnOffAuto instead of
bool.

Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Message-Id: <20250530-vdpa-v1-1-5af4109b1c19@daynix.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/core/qdev-properties.c    | 67 +++++++++++++++++++++++++++++++++++-
 include/hw/qdev-properties.h | 18 ++++++++++
 2 files changed, 84 insertions(+), 1 deletion(-)

diff --git a/hw/core/qdev-properties.c b/hw/core/qdev-properties.c
index 147b3ffd16..b7e8a89ba5 100644
--- a/hw/core/qdev-properties.c
+++ b/hw/core/qdev-properties.c
@@ -2,6 +2,7 @@
 #include "hw/qdev-properties.h"
 #include "qapi/error.h"
 #include "qapi/qapi-types-misc.h"
+#include "qapi/qapi-visit-common.h"
 #include "qobject/qlist.h"
 #include "qemu/ctype.h"
 #include "qemu/error-report.h"
@@ -180,7 +181,8 @@ const PropertyInfo qdev_prop_bit = {
 
 static uint64_t qdev_get_prop_mask64(const Property *prop)
 {
-    assert(prop->info == &qdev_prop_bit64);
+    assert(prop->info == &qdev_prop_bit64 ||
+           prop->info == &qdev_prop_on_off_auto_bit64);
     return 0x1ull << prop->bitnr;
 }
 
@@ -225,6 +227,69 @@ const PropertyInfo qdev_prop_bit64 = {
     .set_default_value = set_default_value_bool,
 };
 
+static void prop_get_on_off_auto_bit64(Object *obj, Visitor *v,
+                                       const char *name, void *opaque,
+                                       Error **errp)
+{
+    Property *prop = opaque;
+    OnOffAutoBit64 *p = object_field_prop_ptr(obj, prop);
+    OnOffAuto value;
+    uint64_t mask = qdev_get_prop_mask64(prop);
+
+    if (p->auto_bits & mask) {
+        value = ON_OFF_AUTO_AUTO;
+    } else if (p->on_bits & mask) {
+        value = ON_OFF_AUTO_ON;
+    } else {
+        value = ON_OFF_AUTO_OFF;
+    }
+
+    visit_type_OnOffAuto(v, name, &value, errp);
+}
+
+static void prop_set_on_off_auto_bit64(Object *obj, Visitor *v,
+                                       const char *name, void *opaque,
+                                       Error **errp)
+{
+    Property *prop = opaque;
+    OnOffAutoBit64 *p = object_field_prop_ptr(obj, prop);
+    OnOffAuto value;
+    uint64_t mask = qdev_get_prop_mask64(prop);
+
+    if (!visit_type_OnOffAuto(v, name, &value, errp)) {
+        return;
+    }
+
+    switch (value) {
+    case ON_OFF_AUTO_AUTO:
+        p->on_bits &= ~mask;
+        p->auto_bits |= mask;
+        break;
+
+    case ON_OFF_AUTO_ON:
+        p->on_bits |= mask;
+        p->auto_bits &= ~mask;
+        break;
+
+    case ON_OFF_AUTO_OFF:
+        p->on_bits &= ~mask;
+        p->auto_bits &= ~mask;
+        break;
+
+    case ON_OFF_AUTO__MAX:
+        g_assert_not_reached();
+    }
+}
+
+const PropertyInfo qdev_prop_on_off_auto_bit64 = {
+    .type = "OnOffAuto",
+    .description = "on/off/auto",
+    .enum_table = &OnOffAuto_lookup,
+    .get = prop_get_on_off_auto_bit64,
+    .set = prop_set_on_off_auto_bit64,
+    .set_default_value = qdev_propinfo_set_default_value_enum,
+};
+
 /* --- bool --- */
 
 static void get_bool(Object *obj, Visitor *v, const char *name, void *opaque,
diff --git a/include/hw/qdev-properties.h b/include/hw/qdev-properties.h
index 2c99856caa..0197aa4995 100644
--- a/include/hw/qdev-properties.h
+++ b/include/hw/qdev-properties.h
@@ -43,11 +43,22 @@ struct PropertyInfo {
     ObjectPropertyRelease *release;
 };
 
+/**
+ * struct OnOffAutoBit64 - OnOffAuto storage with 64 elements.
+ * @on_bits: Bitmap of elements with "on".
+ * @auto_bits: Bitmap of elements with "auto".
+ */
+typedef struct OnOffAutoBit64 {
+    uint64_t on_bits;
+    uint64_t auto_bits;
+} OnOffAutoBit64;
+
 
 /*** qdev-properties.c ***/
 
 extern const PropertyInfo qdev_prop_bit;
 extern const PropertyInfo qdev_prop_bit64;
+extern const PropertyInfo qdev_prop_on_off_auto_bit64;
 extern const PropertyInfo qdev_prop_bool;
 extern const PropertyInfo qdev_prop_uint8;
 extern const PropertyInfo qdev_prop_uint16;
@@ -100,6 +111,13 @@ extern const PropertyInfo qdev_prop_link;
                 .set_default = true,                              \
                 .defval.u  = (bool)_defval)
 
+#define DEFINE_PROP_ON_OFF_AUTO_BIT64(_name, _state, _field, _bit, _defval) \
+    DEFINE_PROP(_name, _state, _field, qdev_prop_on_off_auto_bit64,         \
+                OnOffAutoBit64,                                             \
+                .bitnr    = (_bit),                                         \
+                .set_default = true,                                        \
+                .defval.i = (OnOffAuto)_defval)
+
 #define DEFINE_PROP_BOOL(_name, _state, _field, _defval)     \
     DEFINE_PROP(_name, _state, _field, qdev_prop_bool, bool, \
                 .set_default = true,                         \

From 14f521f491063136bb4aa282c9d29735c78ee433 Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <akihiko.odaki@daynix.com>
Date: Fri, 30 May 2025 13:33:17 +0900
Subject: [PATCH 2249/2760] net/vhost-vdpa: Report hashing capability

Report hashing capability so that virtio-net can deliver the correct
capability information to the guest.

Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Message-Id: <20250530-vdpa-v1-2-5af4109b1c19@daynix.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 include/net/net.h |  3 +++
 net/net.c         |  9 +++++++++
 net/vhost-vdpa.c  | 28 ++++++++++++++++++++++++++++
 3 files changed, 40 insertions(+)

diff --git a/include/net/net.h b/include/net/net.h
index cdd5b109b0..545f4339ce 100644
--- a/include/net/net.h
+++ b/include/net/net.h
@@ -60,6 +60,7 @@ typedef bool (HasVnetHdrLen)(NetClientState *, int);
 typedef void (SetOffload)(NetClientState *, int, int, int, int, int, int, int);
 typedef int (GetVnetHdrLen)(NetClientState *);
 typedef void (SetVnetHdrLen)(NetClientState *, int);
+typedef bool (GetVnetHashSupportedTypes)(NetClientState *, uint32_t *);
 typedef int (SetVnetLE)(NetClientState *, bool);
 typedef int (SetVnetBE)(NetClientState *, bool);
 typedef struct SocketReadState SocketReadState;
@@ -89,6 +90,7 @@ typedef struct NetClientInfo {
     SetVnetHdrLen *set_vnet_hdr_len;
     SetVnetLE *set_vnet_le;
     SetVnetBE *set_vnet_be;
+    GetVnetHashSupportedTypes *get_vnet_hash_supported_types;
     NetAnnounce *announce;
     SetSteeringEBPF *set_steering_ebpf;
     NetCheckPeerType *check_peer_type;
@@ -189,6 +191,7 @@ void qemu_set_offload(NetClientState *nc, int csum, int tso4, int tso6,
                       int ecn, int ufo, int uso4, int uso6);
 int qemu_get_vnet_hdr_len(NetClientState *nc);
 void qemu_set_vnet_hdr_len(NetClientState *nc, int len);
+bool qemu_get_vnet_hash_supported_types(NetClientState *nc, uint32_t *types);
 int qemu_set_vnet_le(NetClientState *nc, bool is_le);
 int qemu_set_vnet_be(NetClientState *nc, bool is_be);
 void qemu_macaddr_default_if_unset(MACAddr *macaddr);
diff --git a/net/net.c b/net/net.c
index 39d6f28158..d0ae3db0d8 100644
--- a/net/net.c
+++ b/net/net.c
@@ -573,6 +573,15 @@ void qemu_set_vnet_hdr_len(NetClientState *nc, int len)
     nc->info->set_vnet_hdr_len(nc, len);
 }
 
+bool qemu_get_vnet_hash_supported_types(NetClientState *nc, uint32_t *types)
+{
+    if (!nc || !nc->info->get_vnet_hash_supported_types) {
+        return false;
+    }
+
+    return nc->info->get_vnet_hash_supported_types(nc, types);
+}
+
 int qemu_set_vnet_le(NetClientState *nc, bool is_le)
 {
 #if HOST_BIG_ENDIAN
diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c
index 58d738945d..cb63e09453 100644
--- a/net/vhost-vdpa.c
+++ b/net/vhost-vdpa.c
@@ -252,6 +252,32 @@ static bool vhost_vdpa_has_vnet_hdr(NetClientState *nc)
     return true;
 }
 
+static bool vhost_vdpa_get_vnet_hash_supported_types(NetClientState *nc,
+                                                     uint32_t *types)
+{
+    assert(nc->info->type == NET_CLIENT_DRIVER_VHOST_VDPA);
+    VhostVDPAState *s = DO_UPCAST(VhostVDPAState, nc, nc);
+    uint64_t features = s->vhost_vdpa.dev->features;
+    int fd = s->vhost_vdpa.shared->device_fd;
+    struct {
+        struct vhost_vdpa_config hdr;
+        uint32_t supported_hash_types;
+    } config;
+
+    if (!virtio_has_feature(features, VIRTIO_NET_F_HASH_REPORT) &&
+        !virtio_has_feature(features, VIRTIO_NET_F_RSS)) {
+        return false;
+    }
+
+    config.hdr.off = offsetof(struct virtio_net_config, supported_hash_types);
+    config.hdr.len = sizeof(config.supported_hash_types);
+
+    assert(!ioctl(fd, VHOST_VDPA_GET_CONFIG, &config));
+    *types = le32_to_cpu(config.supported_hash_types);
+
+    return true;
+}
+
 static bool vhost_vdpa_has_ufo(NetClientState *nc)
 {
     assert(nc->info->type == NET_CLIENT_DRIVER_VHOST_VDPA);
@@ -428,6 +454,7 @@ static NetClientInfo net_vhost_vdpa_info = {
         .stop = vhost_vdpa_net_client_stop,
         .cleanup = vhost_vdpa_cleanup,
         .has_vnet_hdr = vhost_vdpa_has_vnet_hdr,
+        .get_vnet_hash_supported_types = vhost_vdpa_get_vnet_hash_supported_types,
         .has_ufo = vhost_vdpa_has_ufo,
         .set_vnet_le = vhost_vdpa_set_vnet_le,
         .check_peer_type = vhost_vdpa_check_peer_type,
@@ -1284,6 +1311,7 @@ static NetClientInfo net_vhost_vdpa_cvq_info = {
     .stop = vhost_vdpa_net_cvq_stop,
     .cleanup = vhost_vdpa_cleanup,
     .has_vnet_hdr = vhost_vdpa_has_vnet_hdr,
+    .get_vnet_hash_supported_types = vhost_vdpa_get_vnet_hash_supported_types,
     .has_ufo = vhost_vdpa_has_ufo,
     .check_peer_type = vhost_vdpa_check_peer_type,
     .set_steering_ebpf = vhost_vdpa_set_steering_ebpf,

From 2deec9ab7d25d7cd8f57033bd0421c1f9f28d905 Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <akihiko.odaki@daynix.com>
Date: Fri, 30 May 2025 13:33:18 +0900
Subject: [PATCH 2250/2760] virtio-net: Move virtio_net_get_features() down

Move virtio_net_get_features() to the later part of the file so that
it can call other functions.

Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Message-Id: <20250530-vdpa-v1-3-5af4109b1c19@daynix.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/net/virtio-net.c | 146 ++++++++++++++++++++++----------------------
 1 file changed, 73 insertions(+), 73 deletions(-)

diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index eb93607b8c..34fe5909c5 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -752,79 +752,6 @@ static void virtio_net_set_queue_pairs(VirtIONet *n)
 
 static void virtio_net_set_multiqueue(VirtIONet *n, int multiqueue);
 
-static uint64_t virtio_net_get_features(VirtIODevice *vdev, uint64_t features,
-                                        Error **errp)
-{
-    VirtIONet *n = VIRTIO_NET(vdev);
-    NetClientState *nc = qemu_get_queue(n->nic);
-
-    /* Firstly sync all virtio-net possible supported features */
-    features |= n->host_features;
-
-    virtio_add_feature(&features, VIRTIO_NET_F_MAC);
-
-    if (!peer_has_vnet_hdr(n)) {
-        virtio_clear_feature(&features, VIRTIO_NET_F_CSUM);
-        virtio_clear_feature(&features, VIRTIO_NET_F_HOST_TSO4);
-        virtio_clear_feature(&features, VIRTIO_NET_F_HOST_TSO6);
-        virtio_clear_feature(&features, VIRTIO_NET_F_HOST_ECN);
-
-        virtio_clear_feature(&features, VIRTIO_NET_F_GUEST_CSUM);
-        virtio_clear_feature(&features, VIRTIO_NET_F_GUEST_TSO4);
-        virtio_clear_feature(&features, VIRTIO_NET_F_GUEST_TSO6);
-        virtio_clear_feature(&features, VIRTIO_NET_F_GUEST_ECN);
-
-        virtio_clear_feature(&features, VIRTIO_NET_F_HOST_USO);
-        virtio_clear_feature(&features, VIRTIO_NET_F_GUEST_USO4);
-        virtio_clear_feature(&features, VIRTIO_NET_F_GUEST_USO6);
-
-        virtio_clear_feature(&features, VIRTIO_NET_F_HASH_REPORT);
-    }
-
-    if (!peer_has_vnet_hdr(n) || !peer_has_ufo(n)) {
-        virtio_clear_feature(&features, VIRTIO_NET_F_GUEST_UFO);
-        virtio_clear_feature(&features, VIRTIO_NET_F_HOST_UFO);
-    }
-
-    if (!peer_has_uso(n)) {
-        virtio_clear_feature(&features, VIRTIO_NET_F_HOST_USO);
-        virtio_clear_feature(&features, VIRTIO_NET_F_GUEST_USO4);
-        virtio_clear_feature(&features, VIRTIO_NET_F_GUEST_USO6);
-    }
-
-    if (!get_vhost_net(nc->peer)) {
-        return features;
-    }
-
-    if (!ebpf_rss_is_loaded(&n->ebpf_rss)) {
-        virtio_clear_feature(&features, VIRTIO_NET_F_RSS);
-    }
-    features = vhost_net_get_features(get_vhost_net(nc->peer), features);
-    vdev->backend_features = features;
-
-    if (n->mtu_bypass_backend &&
-            (n->host_features & 1ULL << VIRTIO_NET_F_MTU)) {
-        features |= (1ULL << VIRTIO_NET_F_MTU);
-    }
-
-    /*
-     * Since GUEST_ANNOUNCE is emulated the feature bit could be set without
-     * enabled. This happens in the vDPA case.
-     *
-     * Make sure the feature set is not incoherent, as the driver could refuse
-     * to start.
-     *
-     * TODO: QEMU is able to emulate a CVQ just for guest_announce purposes,
-     * helping guest to notify the new location with vDPA devices that does not
-     * support it.
-     */
-    if (!virtio_has_feature(vdev->backend_features, VIRTIO_NET_F_CTRL_VQ)) {
-        virtio_clear_feature(&features, VIRTIO_NET_F_GUEST_ANNOUNCE);
-    }
-
-    return features;
-}
-
 static uint64_t virtio_net_bad_features(VirtIODevice *vdev)
 {
     uint64_t features = 0;
@@ -3076,6 +3003,79 @@ static int virtio_net_pre_load_queues(VirtIODevice *vdev)
     return 0;
 }
 
+static uint64_t virtio_net_get_features(VirtIODevice *vdev, uint64_t features,
+                                        Error **errp)
+{
+    VirtIONet *n = VIRTIO_NET(vdev);
+    NetClientState *nc = qemu_get_queue(n->nic);
+
+    /* Firstly sync all virtio-net possible supported features */
+    features |= n->host_features;
+
+    virtio_add_feature(&features, VIRTIO_NET_F_MAC);
+
+    if (!peer_has_vnet_hdr(n)) {
+        virtio_clear_feature(&features, VIRTIO_NET_F_CSUM);
+        virtio_clear_feature(&features, VIRTIO_NET_F_HOST_TSO4);
+        virtio_clear_feature(&features, VIRTIO_NET_F_HOST_TSO6);
+        virtio_clear_feature(&features, VIRTIO_NET_F_HOST_ECN);
+
+        virtio_clear_feature(&features, VIRTIO_NET_F_GUEST_CSUM);
+        virtio_clear_feature(&features, VIRTIO_NET_F_GUEST_TSO4);
+        virtio_clear_feature(&features, VIRTIO_NET_F_GUEST_TSO6);
+        virtio_clear_feature(&features, VIRTIO_NET_F_GUEST_ECN);
+
+        virtio_clear_feature(&features, VIRTIO_NET_F_HOST_USO);
+        virtio_clear_feature(&features, VIRTIO_NET_F_GUEST_USO4);
+        virtio_clear_feature(&features, VIRTIO_NET_F_GUEST_USO6);
+
+        virtio_clear_feature(&features, VIRTIO_NET_F_HASH_REPORT);
+    }
+
+    if (!peer_has_vnet_hdr(n) || !peer_has_ufo(n)) {
+        virtio_clear_feature(&features, VIRTIO_NET_F_GUEST_UFO);
+        virtio_clear_feature(&features, VIRTIO_NET_F_HOST_UFO);
+    }
+
+    if (!peer_has_uso(n)) {
+        virtio_clear_feature(&features, VIRTIO_NET_F_HOST_USO);
+        virtio_clear_feature(&features, VIRTIO_NET_F_GUEST_USO4);
+        virtio_clear_feature(&features, VIRTIO_NET_F_GUEST_USO6);
+    }
+
+    if (!get_vhost_net(nc->peer)) {
+        return features;
+    }
+
+    if (!ebpf_rss_is_loaded(&n->ebpf_rss)) {
+        virtio_clear_feature(&features, VIRTIO_NET_F_RSS);
+    }
+    features = vhost_net_get_features(get_vhost_net(nc->peer), features);
+    vdev->backend_features = features;
+
+    if (n->mtu_bypass_backend &&
+            (n->host_features & 1ULL << VIRTIO_NET_F_MTU)) {
+        features |= (1ULL << VIRTIO_NET_F_MTU);
+    }
+
+    /*
+     * Since GUEST_ANNOUNCE is emulated the feature bit could be set without
+     * enabled. This happens in the vDPA case.
+     *
+     * Make sure the feature set is not incoherent, as the driver could refuse
+     * to start.
+     *
+     * TODO: QEMU is able to emulate a CVQ just for guest_announce purposes,
+     * helping guest to notify the new location with vDPA devices that does not
+     * support it.
+     */
+    if (!virtio_has_feature(vdev->backend_features, VIRTIO_NET_F_CTRL_VQ)) {
+        virtio_clear_feature(&features, VIRTIO_NET_F_GUEST_ANNOUNCE);
+    }
+
+    return features;
+}
+
 static int virtio_net_post_load_device(void *opaque, int version_id)
 {
     VirtIONet *n = opaque;

From 7b6e7e49905d0682f67ae4d02fc9edc4a2ec7df5 Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <akihiko.odaki@daynix.com>
Date: Fri, 30 May 2025 13:33:19 +0900
Subject: [PATCH 2251/2760] virtio-net: Retrieve peer hashing capability

Retrieve peer hashing capability instead of hardcoding.

Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Message-Id: <20250530-vdpa-v1-4-5af4109b1c19@daynix.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/net/virtio-net.c            | 71 +++++++++++++++++++++++++++-------
 include/hw/virtio/virtio-net.h |  5 ++-
 net/vhost-vdpa.c               |  4 +-
 3 files changed, 64 insertions(+), 16 deletions(-)

diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index 34fe5909c5..9888ff22bd 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -158,7 +158,7 @@ static void virtio_net_get_config(VirtIODevice *vdev, uint8_t *config)
                  virtio_host_has_feature(vdev, VIRTIO_NET_F_RSS) ?
                  VIRTIO_NET_RSS_MAX_TABLE_LEN : 1);
     virtio_stl_p(vdev, &netcfg.supported_hash_types,
-                 VIRTIO_NET_RSS_SUPPORTED_HASHES);
+                 n->rss_data.supported_hash_types);
     memcpy(config, &netcfg, n->config_size);
 
     /*
@@ -1178,7 +1178,7 @@ static void rss_data_to_rss_config(struct VirtioNetRssData *data,
 {
     config->redirect = data->redirect;
     config->populate_hash = data->populate_hash;
-    config->hash_types = data->hash_types;
+    config->hash_types = data->runtime_hash_types;
     config->indirections_len = data->indirections_len;
     config->default_queue = data->default_queue;
 }
@@ -1213,6 +1213,10 @@ static void virtio_net_detach_ebpf_rss(VirtIONet *n)
 
 static void virtio_net_commit_rss_config(VirtIONet *n)
 {
+    if (n->rss_data.peer_hash_available) {
+        return;
+    }
+
     if (n->rss_data.enabled) {
         n->rss_data.enabled_software_rss = n->rss_data.populate_hash;
         if (n->rss_data.populate_hash) {
@@ -1227,7 +1231,7 @@ static void virtio_net_commit_rss_config(VirtIONet *n)
         }
 
         trace_virtio_net_rss_enable(n,
-                                    n->rss_data.hash_types,
+                                    n->rss_data.runtime_hash_types,
                                     n->rss_data.indirections_len,
                                     sizeof(n->rss_data.key));
     } else {
@@ -1338,7 +1342,7 @@ static uint16_t virtio_net_handle_rss(VirtIONet *n,
         err_value = (uint32_t)s;
         goto error;
     }
-    n->rss_data.hash_types = virtio_ldl_p(vdev, &cfg.hash_types);
+    n->rss_data.runtime_hash_types = virtio_ldl_p(vdev, &cfg.hash_types);
     n->rss_data.indirections_len =
         virtio_lduw_p(vdev, &cfg.indirection_table_mask);
     if (!do_rss) {
@@ -1401,12 +1405,12 @@ static uint16_t virtio_net_handle_rss(VirtIONet *n,
         err_value = temp.b;
         goto error;
     }
-    if (!temp.b && n->rss_data.hash_types) {
+    if (!temp.b && n->rss_data.runtime_hash_types) {
         err_msg = "No key provided";
         err_value = 0;
         goto error;
     }
-    if (!temp.b && !n->rss_data.hash_types) {
+    if (!temp.b && !n->rss_data.runtime_hash_types) {
         virtio_net_disable_rss(n);
         return queue_pairs;
     }
@@ -1808,7 +1812,7 @@ static int virtio_net_process_rss(NetClientState *nc, const uint8_t *buf,
     net_rx_pkt_set_protocols(pkt, &iov, 1, n->host_hdr_len);
     net_rx_pkt_get_protocols(pkt, &hasip4, &hasip6, &l4hdr_proto);
     net_hash_type = virtio_net_get_hash_type(hasip4, hasip6, l4hdr_proto,
-                                             n->rss_data.hash_types);
+                                             n->rss_data.runtime_hash_types);
     if (net_hash_type > NetPktRssIpV6UdpEx) {
         if (n->rss_data.populate_hash) {
             hdr->hash_value = VIRTIO_NET_HASH_REPORT_NONE;
@@ -3008,6 +3012,14 @@ static uint64_t virtio_net_get_features(VirtIODevice *vdev, uint64_t features,
 {
     VirtIONet *n = VIRTIO_NET(vdev);
     NetClientState *nc = qemu_get_queue(n->nic);
+    uint32_t supported_hash_types = n->rss_data.supported_hash_types;
+    uint32_t peer_hash_types = n->rss_data.peer_hash_types;
+    bool use_own_hash =
+        (supported_hash_types & VIRTIO_NET_RSS_SUPPORTED_HASHES) ==
+        supported_hash_types;
+    bool use_peer_hash =
+        n->rss_data.peer_hash_available &&
+        (supported_hash_types & peer_hash_types) == supported_hash_types;
 
     /* Firstly sync all virtio-net possible supported features */
     features |= n->host_features;
@@ -3044,12 +3056,28 @@ static uint64_t virtio_net_get_features(VirtIODevice *vdev, uint64_t features,
     }
 
     if (!get_vhost_net(nc->peer)) {
+        if (!use_own_hash) {
+            virtio_clear_feature(&features, VIRTIO_NET_F_HASH_REPORT);
+            virtio_clear_feature(&features, VIRTIO_NET_F_RSS);
+        } else if (virtio_has_feature(features, VIRTIO_NET_F_RSS)) {
+            virtio_net_load_ebpf(n, errp);
+        }
+
         return features;
     }
 
-    if (!ebpf_rss_is_loaded(&n->ebpf_rss)) {
-        virtio_clear_feature(&features, VIRTIO_NET_F_RSS);
+    if (!use_peer_hash) {
+        virtio_clear_feature(&features, VIRTIO_NET_F_HASH_REPORT);
+
+        if (!use_own_hash || !virtio_net_attach_ebpf_to_backend(n->nic, -1)) {
+            if (!virtio_net_load_ebpf(n, errp)) {
+                return features;
+            }
+
+            virtio_clear_feature(&features, VIRTIO_NET_F_RSS);
+        }
     }
+
     features = vhost_net_get_features(get_vhost_net(nc->peer), features);
     vdev->backend_features = features;
 
@@ -3314,6 +3342,17 @@ static const VMStateDescription vmstate_virtio_net_has_vnet = {
     },
 };
 
+static int virtio_net_rss_post_load(void *opaque, int version_id)
+{
+    VirtIONet *n = VIRTIO_NET(opaque);
+
+    if (version_id == 1) {
+        n->rss_data.supported_hash_types = VIRTIO_NET_RSS_SUPPORTED_HASHES;
+    }
+
+    return 0;
+}
+
 static bool virtio_net_rss_needed(void *opaque)
 {
     return VIRTIO_NET(opaque)->rss_data.enabled;
@@ -3321,14 +3360,16 @@ static bool virtio_net_rss_needed(void *opaque)
 
 static const VMStateDescription vmstate_virtio_net_rss = {
     .name      = "virtio-net-device/rss",
-    .version_id = 1,
+    .version_id = 2,
     .minimum_version_id = 1,
+    .post_load = virtio_net_rss_post_load,
     .needed = virtio_net_rss_needed,
     .fields = (const VMStateField[]) {
         VMSTATE_BOOL(rss_data.enabled, VirtIONet),
         VMSTATE_BOOL(rss_data.redirect, VirtIONet),
         VMSTATE_BOOL(rss_data.populate_hash, VirtIONet),
-        VMSTATE_UINT32(rss_data.hash_types, VirtIONet),
+        VMSTATE_UINT32(rss_data.runtime_hash_types, VirtIONet),
+        VMSTATE_UINT32_V(rss_data.supported_hash_types, VirtIONet, 2),
         VMSTATE_UINT16(rss_data.indirections_len, VirtIONet),
         VMSTATE_UINT16(rss_data.default_queue, VirtIONet),
         VMSTATE_UINT8_ARRAY(rss_data.key, VirtIONet,
@@ -3915,8 +3956,12 @@ static void virtio_net_device_realize(DeviceState *dev, Error **errp)
 
     net_rx_pkt_init(&n->rx_pkt);
 
-    if (virtio_has_feature(n->host_features, VIRTIO_NET_F_RSS)) {
-        virtio_net_load_ebpf(n, errp);
+    if (qemu_get_vnet_hash_supported_types(qemu_get_queue(n->nic)->peer,
+                                           &n->rss_data.peer_hash_types)) {
+        n->rss_data.peer_hash_available = true;
+        n->rss_data.supported_hash_types = n->rss_data.peer_hash_types;
+    } else {
+        n->rss_data.supported_hash_types = VIRTIO_NET_RSS_SUPPORTED_HASHES;
     }
 }
 
diff --git a/include/hw/virtio/virtio-net.h b/include/hw/virtio/virtio-net.h
index b9ea9e824e..c4957c44c0 100644
--- a/include/hw/virtio/virtio-net.h
+++ b/include/hw/virtio/virtio-net.h
@@ -144,7 +144,10 @@ typedef struct VirtioNetRssData {
     bool    enabled_software_rss;
     bool    redirect;
     bool    populate_hash;
-    uint32_t hash_types;
+    bool    peer_hash_available;
+    uint32_t runtime_hash_types;
+    uint32_t supported_hash_types;
+    uint32_t peer_hash_types;
     uint8_t key[VIRTIO_NET_RSS_MAX_KEY_SIZE];
     uint16_t indirections_len;
     uint16_t *indirections_table;
diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c
index cb63e09453..3452835ca9 100644
--- a/net/vhost-vdpa.c
+++ b/net/vhost-vdpa.c
@@ -865,13 +865,13 @@ static int vhost_vdpa_net_load_rss(VhostVDPAState *s, const VirtIONet *n,
      * configuration only at live migration.
      */
     if (!n->rss_data.enabled ||
-        n->rss_data.hash_types == VIRTIO_NET_HASH_REPORT_NONE) {
+        n->rss_data.runtime_hash_types == VIRTIO_NET_HASH_REPORT_NONE) {
         return 0;
     }
 
     table = g_malloc_n(n->rss_data.indirections_len,
                        sizeof(n->rss_data.indirections_table[0]));
-    cfg.hash_types = cpu_to_le32(n->rss_data.hash_types);
+    cfg.hash_types = cpu_to_le32(n->rss_data.runtime_hash_types);
 
     if (do_rss) {
         /*

From abef963a12e2bc266884b27677ff3cf94c09e512 Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <akihiko.odaki@daynix.com>
Date: Fri, 30 May 2025 13:33:20 +0900
Subject: [PATCH 2252/2760] net/vhost-vdpa: Remove dummy SetSteeringEBPF

It is no longer used.

Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Message-Id: <20250530-vdpa-v1-5-5af4109b1c19@daynix.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 net/vhost-vdpa.c | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c
index 3452835ca9..0f782ed444 100644
--- a/net/vhost-vdpa.c
+++ b/net/vhost-vdpa.c
@@ -239,12 +239,6 @@ static void vhost_vdpa_cleanup(NetClientState *nc)
     g_free(s->vhost_vdpa.shared);
 }
 
-/** Dummy SetSteeringEBPF to support RSS for vhost-vdpa backend  */
-static bool vhost_vdpa_set_steering_ebpf(NetClientState *nc, int prog_fd)
-{
-    return true;
-}
-
 static bool vhost_vdpa_has_vnet_hdr(NetClientState *nc)
 {
     assert(nc->info->type == NET_CLIENT_DRIVER_VHOST_VDPA);
@@ -458,7 +452,6 @@ static NetClientInfo net_vhost_vdpa_info = {
         .has_ufo = vhost_vdpa_has_ufo,
         .set_vnet_le = vhost_vdpa_set_vnet_le,
         .check_peer_type = vhost_vdpa_check_peer_type,
-        .set_steering_ebpf = vhost_vdpa_set_steering_ebpf,
 };
 
 static int64_t vhost_vdpa_get_vring_group(int device_fd, unsigned vq_index,
@@ -1314,7 +1307,6 @@ static NetClientInfo net_vhost_vdpa_cvq_info = {
     .get_vnet_hash_supported_types = vhost_vdpa_get_vnet_hash_supported_types,
     .has_ufo = vhost_vdpa_has_ufo,
     .check_peer_type = vhost_vdpa_check_peer_type,
-    .set_steering_ebpf = vhost_vdpa_set_steering_ebpf,
 };
 
 /*

From 729b5734197d1afad364bb025a827438bb85e050 Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <akihiko.odaki@daynix.com>
Date: Fri, 30 May 2025 13:33:21 +0900
Subject: [PATCH 2253/2760] virtio-net: Add hash type options

By default, virtio-net limits the hash types that will be advertised to
the guest so that all hash types are covered by the offloading
capability the client provides. This change allows to override this
behavior and to advertise hash types that require user-space hash
calculation by specifying "on" for the corresponding properties.

Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Message-Id: <20250530-vdpa-v1-6-5af4109b1c19@daynix.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/net/virtio-net.c            | 45 ++++++++++++++++++++++++++++++++--
 include/hw/virtio/virtio-net.h |  1 +
 2 files changed, 44 insertions(+), 2 deletions(-)

diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index 9888ff22bd..6af230bca9 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -3959,9 +3959,14 @@ static void virtio_net_device_realize(DeviceState *dev, Error **errp)
     if (qemu_get_vnet_hash_supported_types(qemu_get_queue(n->nic)->peer,
                                            &n->rss_data.peer_hash_types)) {
         n->rss_data.peer_hash_available = true;
-        n->rss_data.supported_hash_types = n->rss_data.peer_hash_types;
+        n->rss_data.supported_hash_types =
+            n->rss_data.specified_hash_types.on_bits |
+            (n->rss_data.specified_hash_types.auto_bits &
+             n->rss_data.peer_hash_types);
     } else {
-        n->rss_data.supported_hash_types = VIRTIO_NET_RSS_SUPPORTED_HASHES;
+        n->rss_data.supported_hash_types =
+            n->rss_data.specified_hash_types.on_bits |
+            n->rss_data.specified_hash_types.auto_bits;
     }
 }
 
@@ -4178,6 +4183,42 @@ static const Property virtio_net_properties[] = {
                       VIRTIO_NET_F_GUEST_USO6, true),
     DEFINE_PROP_BIT64("host_uso", VirtIONet, host_features,
                       VIRTIO_NET_F_HOST_USO, true),
+    DEFINE_PROP_ON_OFF_AUTO_BIT64("hash-ipv4", VirtIONet,
+                                  rss_data.specified_hash_types,
+                                  VIRTIO_NET_HASH_REPORT_IPv4 - 1,
+                                  ON_OFF_AUTO_AUTO),
+    DEFINE_PROP_ON_OFF_AUTO_BIT64("hash-tcp4", VirtIONet,
+                                  rss_data.specified_hash_types,
+                                  VIRTIO_NET_HASH_REPORT_TCPv4 - 1,
+                                  ON_OFF_AUTO_AUTO),
+    DEFINE_PROP_ON_OFF_AUTO_BIT64("hash-udp4", VirtIONet,
+                                  rss_data.specified_hash_types,
+                                  VIRTIO_NET_HASH_REPORT_UDPv4 - 1,
+                                  ON_OFF_AUTO_AUTO),
+    DEFINE_PROP_ON_OFF_AUTO_BIT64("hash-ipv6", VirtIONet,
+                                  rss_data.specified_hash_types,
+                                  VIRTIO_NET_HASH_REPORT_IPv6 - 1,
+                                  ON_OFF_AUTO_AUTO),
+    DEFINE_PROP_ON_OFF_AUTO_BIT64("hash-tcp6", VirtIONet,
+                                  rss_data.specified_hash_types,
+                                  VIRTIO_NET_HASH_REPORT_TCPv6 - 1,
+                                  ON_OFF_AUTO_AUTO),
+    DEFINE_PROP_ON_OFF_AUTO_BIT64("hash-udp6", VirtIONet,
+                                  rss_data.specified_hash_types,
+                                  VIRTIO_NET_HASH_REPORT_UDPv6 - 1,
+                                  ON_OFF_AUTO_AUTO),
+    DEFINE_PROP_ON_OFF_AUTO_BIT64("hash-ipv6ex", VirtIONet,
+                                  rss_data.specified_hash_types,
+                                  VIRTIO_NET_HASH_REPORT_IPv6_EX - 1,
+                                  ON_OFF_AUTO_AUTO),
+    DEFINE_PROP_ON_OFF_AUTO_BIT64("hash-tcp6ex", VirtIONet,
+                                  rss_data.specified_hash_types,
+                                  VIRTIO_NET_HASH_REPORT_TCPv6_EX - 1,
+                                  ON_OFF_AUTO_AUTO),
+    DEFINE_PROP_ON_OFF_AUTO_BIT64("hash-udp6ex", VirtIONet,
+                                  rss_data.specified_hash_types,
+                                  VIRTIO_NET_HASH_REPORT_UDPv6_EX - 1,
+                                  ON_OFF_AUTO_AUTO),
 };
 
 static void virtio_net_class_init(ObjectClass *klass, const void *data)
diff --git a/include/hw/virtio/virtio-net.h b/include/hw/virtio/virtio-net.h
index c4957c44c0..73fdefc0dc 100644
--- a/include/hw/virtio/virtio-net.h
+++ b/include/hw/virtio/virtio-net.h
@@ -148,6 +148,7 @@ typedef struct VirtioNetRssData {
     uint32_t runtime_hash_types;
     uint32_t supported_hash_types;
     uint32_t peer_hash_types;
+    OnOffAutoBit64 specified_hash_types;
     uint8_t key[VIRTIO_NET_RSS_MAX_KEY_SIZE];
     uint16_t indirections_len;
     uint16_t *indirections_table;

From 9f749129e2629b19f424df106c92c5a5647e396c Mon Sep 17 00:00:00 2001
From: David Hildenbrand <david@redhat.com>
Date: Tue, 3 Jun 2025 13:13:36 +0200
Subject: [PATCH 2254/2760] vhost: Fix used memslot tracking when destroying a
 vhost device

When we unplug a vhost device, we end up calling vhost_dev_cleanup()
where we do a memory_listener_unregister().

This memory_listener_unregister() call will end up disconnecting the
listener from the address space through listener_del_address_space().

In that process, we effectively communicate the removal of all memory
regions from that listener, resulting in region_del() + commit()
callbacks getting triggered.

So in case of vhost, we end up calling vhost_commit() with no remaining
memory slots (0).

In vhost_commit() we end up overwriting the global variables
used_memslots / used_shared_memslots, used for detecting the number
of free memslots. With used_memslots / used_shared_memslots set to 0
by vhost_commit() during device removal, we'll later assume that the
other vhost devices still have plenty of memslots left when calling
vhost_get_free_memslots().

Let's fix it by simply removing the global variables and depending
only on the actual per-device count.

Easy to reproduce by adding two vhost-user devices to a VM and then
hot-unplugging one of them.

While at it, detect unexpected underflows in vhost_get_free_memslots()
and issue a warning.

Reported-by: yuanminghao <yuanmh12@chinatelecom.cn>
Link: https://lore.kernel.org/qemu-devel/20241121060755.164310-1-yuanmh12@chinatelecom.cn/
Fixes: 2ce68e4cf5be ("vhost: add vhost_has_free_slot() interface")
Cc: Igor Mammedov <imammedo@redhat.com>
Cc: Michael S. Tsirkin <mst@redhat.com>
Cc: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: David Hildenbrand <david@redhat.com>
Message-Id: <20250603111336.1858888-1-david@redhat.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/virtio/vhost.c | 37 ++++++++++---------------------------
 1 file changed, 10 insertions(+), 27 deletions(-)

diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c
index fc43853704..c87861b31f 100644
--- a/hw/virtio/vhost.c
+++ b/hw/virtio/vhost.c
@@ -47,12 +47,6 @@ static struct vhost_log *vhost_log[VHOST_BACKEND_TYPE_MAX];
 static struct vhost_log *vhost_log_shm[VHOST_BACKEND_TYPE_MAX];
 static QLIST_HEAD(, vhost_dev) vhost_log_devs[VHOST_BACKEND_TYPE_MAX];
 
-/* Memslots used by backends that support private memslots (without an fd). */
-static unsigned int used_memslots;
-
-/* Memslots used by backends that only support shared memslots (with an fd). */
-static unsigned int used_shared_memslots;
-
 static QLIST_HEAD(, vhost_dev) vhost_devices =
     QLIST_HEAD_INITIALIZER(vhost_devices);
 
@@ -74,15 +68,15 @@ unsigned int vhost_get_free_memslots(void)
 
     QLIST_FOREACH(hdev, &vhost_devices, entry) {
         unsigned int r = hdev->vhost_ops->vhost_backend_memslots_limit(hdev);
-        unsigned int cur_free;
+        unsigned int cur_free = r - hdev->mem->nregions;
 
-        if (hdev->vhost_ops->vhost_backend_no_private_memslots &&
-            hdev->vhost_ops->vhost_backend_no_private_memslots(hdev)) {
-            cur_free = r - used_shared_memslots;
+        if (unlikely(r < hdev->mem->nregions)) {
+            warn_report_once("used (%u) vhost backend memory slots exceed"
+                             " the device limit (%u).", hdev->mem->nregions, r);
+            free = 0;
         } else {
-            cur_free = r - used_memslots;
+            free = MIN(free, cur_free);
         }
-        free = MIN(free, cur_free);
     }
     return free;
 }
@@ -666,13 +660,6 @@ static void vhost_commit(MemoryListener *listener)
     dev->mem = g_realloc(dev->mem, regions_size);
     dev->mem->nregions = dev->n_mem_sections;
 
-    if (dev->vhost_ops->vhost_backend_no_private_memslots &&
-        dev->vhost_ops->vhost_backend_no_private_memslots(dev)) {
-        used_shared_memslots = dev->mem->nregions;
-    } else {
-        used_memslots = dev->mem->nregions;
-    }
-
     for (i = 0; i < dev->n_mem_sections; i++) {
         struct vhost_memory_region *cur_vmr = dev->mem->regions + i;
         struct MemoryRegionSection *mrs = dev->mem_sections + i;
@@ -1619,15 +1606,11 @@ int vhost_dev_init(struct vhost_dev *hdev, void *opaque,
     QLIST_INSERT_HEAD(&vhost_devices, hdev, entry);
 
     /*
-     * The listener we registered properly updated the corresponding counter.
-     * So we can trust that these values are accurate.
+     * The listener we registered properly setup the number of required
+     * memslots in vhost_commit().
      */
-    if (hdev->vhost_ops->vhost_backend_no_private_memslots &&
-        hdev->vhost_ops->vhost_backend_no_private_memslots(hdev)) {
-        used = used_shared_memslots;
-    } else {
-        used = used_memslots;
-    }
+    used = hdev->mem->nregions;
+
     /*
      * We assume that all reserved memslots actually require a real memslot
      * in our vhost backend. This might not be true, for example, if the

From 5ad6432880959ca373d62d715de8f0e2ca507a38 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Thu, 10 Jul 2025 11:45:24 +0100
Subject: [PATCH 2255/2760] gitlab: use argparse in check-units script
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Modernise the argument parsing so we can easily add to the script.

Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250710104531.3099313-2-alex.bennee@linaro.org>
---
 .gitlab-ci.d/check-units.py | 21 ++++++++++++---------
 1 file changed, 12 insertions(+), 9 deletions(-)

diff --git a/.gitlab-ci.d/check-units.py b/.gitlab-ci.d/check-units.py
index 268a4118d5..cdc62ae5ee 100755
--- a/.gitlab-ci.d/check-units.py
+++ b/.gitlab-ci.d/check-units.py
@@ -8,8 +8,10 @@
 # SPDX-License-Identifier: GPL-2.0-or-later
 
 from os import access, R_OK, path
-from sys import argv, exit
+from sys import exit
 import json
+import argparse
+from pathlib import Path
 from collections import Counter
 
 
@@ -51,16 +53,17 @@ def analyse_units(build_units):
 
 
 if __name__ == "__main__":
-    if len(argv) != 2:
-        script_name = path.basename(argv[0])
-        print(f"Usage: {script_name} <path_to_compile_commands.json>")
-        exit(1)
+    parser = argparse.ArgumentParser(
+        description="analyse number of build units in compile_commands.json")
+    parser.add_argument("cc_path", type=Path, default=None,
+                        help="Path to compile_commands.json")
 
-    cc_path = argv[1]
-    if path.isfile(cc_path) and access(cc_path, R_OK):
-        units = extract_build_units(cc_path)
+    args = parser.parse_args()
+
+    if path.isfile(args.cc_path) and access(args.cc_path, R_OK):
+        units = extract_build_units(args.cc_path)
         analyse_units(units)
         exit(0)
     else:
-        print(f"{cc_path} doesn't exist or isn't readable")
+        print(f"{args.cc_path} doesn't exist or isn't readable")
         exit(1)

From 2e51072ae5c0275733be748fbee3ce59df6d6261 Mon Sep 17 00:00:00 2001
From: John Snow <jsnow@redhat.com>
Date: Fri, 11 Jul 2025 01:10:42 -0400
Subject: [PATCH 2256/2760] docs/qapi-domain: add return-nodesc

This form is used to annotate a return type without an accompanying
description, for when there is no "Returns:" information in the source
doc, but we have a return type we want to generate a cross-reference to.

The syntax is:

:return-nodesc: TypeName

It's primarily necessary because Sphinx always expects both a type and a
description for the prior form and will format it accordingly. To have a
reasonable rendering when the body is missing, we need to use a
different info field list entirely.

Signed-off-by: John Snow <jsnow@redhat.com>
Message-ID: <20250711051045.51110-2-jsnow@redhat.com>
Acked-by: Markus Armbruster <armbru@redhat.com>
[Long line wrapped]
Signed-off-by: Markus Armbruster <armbru@redhat.com>
---
 docs/devel/qapi-domain.rst | 31 +++++++++++++++++++++++++++++++
 docs/sphinx/qapi_domain.py |  8 ++++++++
 2 files changed, 39 insertions(+)

diff --git a/docs/devel/qapi-domain.rst b/docs/devel/qapi-domain.rst
index 11238723c2..b71890f660 100644
--- a/docs/devel/qapi-domain.rst
+++ b/docs/devel/qapi-domain.rst
@@ -242,6 +242,37 @@ Example::
              }
 
 
+``:return-nodesc:``
+-------------------
+
+Document the return type of a QAPI command, without an accompanying
+description.
+
+:availability: This field list is only available in the body of the
+               Command directive.
+:syntax: ``:return-nodesc: type``
+:type: `sphinx.util.docfields.Field
+       <https://pydoc.dev/sphinx/latest/sphinx.util.docfields.Field.html?private=1>`_
+
+
+Example::
+
+   .. qapi:command:: query-replay
+      :since: 5.2
+
+      Retrieve the record/replay information.  It includes current
+      instruction count which may be used for ``replay-break`` and
+      ``replay-seek`` commands.
+
+      :return-nodesc: ReplayInfo
+
+      .. qmp-example::
+
+          -> { "execute": "query-replay" }
+          <- { "return": {
+                 "mode": "play", "filename": "log.rr", "icount": 220414 }
+             }
+
 ``:value:``
 -----------
 
diff --git a/docs/sphinx/qapi_domain.py b/docs/sphinx/qapi_domain.py
index ebc46a72c6..f561dc465f 100644
--- a/docs/sphinx/qapi_domain.py
+++ b/docs/sphinx/qapi_domain.py
@@ -532,6 +532,14 @@ class QAPICommand(QAPIObject):
                 names=("return",),
                 can_collapse=True,
             ),
+            # :return-nodesc: TypeName
+            CompatField(
+                "returnvalue",
+                label=_("Return"),
+                names=("return-nodesc",),
+                bodyrolename="type",
+                has_arg=False,
+            ),
         ]
     )
 

From 636c96cd77d39aaec3e1c09b9990b76b015566e1 Mon Sep 17 00:00:00 2001
From: John Snow <jsnow@redhat.com>
Date: Fri, 11 Jul 2025 01:10:43 -0400
Subject: [PATCH 2257/2760] qapi: Fix undocumented return values by generating
 something
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Generated command documentation lacks information on return value in
several cases, e.g. query-tpm.

The obvious fix would be to require a Returns: section when a command
returns something.

However, note that many existing Returns: sections are pretty useless:
the description is basically the return type, which then gets rendered
like "Return: <Type> – <basically the return type>".  This suggests
that a description is often not really necessary, and requiring one
isn't useful.

Instead, generate the obvious minimal thing when Returns: is absent:
"Return: <Type>".

This auto-generated Return documentation is placed is as follows:

1. If we have arguments, return goes right after them.
2. Else if we have errors, return goes right before them.
3. Else if we have features, return goes right before them.
4. Else return goes right after the intro

To facilitate this algorithm, a "TODO:" hack line is used to separate
the intro from the remainder of the documentation block in cases where
there are no other sections to separate the intro from e.g. examples and
additional detail meant to appear below the key sections of interest.

Signed-off-by: John Snow <jsnow@redhat.com>
Message-ID: <20250711051045.51110-3-jsnow@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
[_insert_near_kind() code replaced by something simpler, commit
message amended to explain why we're doing this]
Signed-off-by: Markus Armbruster <armbru@redhat.com>
---
 docs/sphinx/qapidoc.py | 14 ++++++++------
 qapi/machine.json      |  2 ++
 scripts/qapi/parser.py | 37 +++++++++++++++++++++++++++++++++++++
 scripts/qapi/schema.py |  3 +++
 4 files changed, 50 insertions(+), 6 deletions(-)

diff --git a/docs/sphinx/qapidoc.py b/docs/sphinx/qapidoc.py
index b794cde697..c2f09bac16 100644
--- a/docs/sphinx/qapidoc.py
+++ b/docs/sphinx/qapidoc.py
@@ -258,16 +258,18 @@ class Transmogrifier:
     def visit_returns(self, section: QAPIDoc.Section) -> None:
         assert isinstance(self.entity, QAPISchemaCommand)
         rtype = self.entity.ret_type
-        # q_empty can produce None, but we won't be documenting anything
-        # without an explicit return statement in the doc block, and we
-        # should not have any such explicit statements when there is no
-        # return value.
+        # return statements will not be present (and won't be
+        # autogenerated) for any command that doesn't return
+        # *something*, so rtype will always be defined here.
         assert rtype
 
         typ = self.format_type(rtype)
         assert typ
-        assert section.text
-        self.add_field("return", typ, section.text, section.info)
+
+        if section.text:
+            self.add_field("return", typ, section.text, section.info)
+        else:
+            self.add_lines(f":return-nodesc: {typ}", section.info)
 
     def visit_errors(self, section: QAPIDoc.Section) -> None:
         # If the section text does not start with a space, it means text
diff --git a/qapi/machine.json b/qapi/machine.json
index af00a20b1f..2d6a137f21 100644
--- a/qapi/machine.json
+++ b/qapi/machine.json
@@ -1303,6 +1303,8 @@
 # Return the amount of initially allocated and present hotpluggable
 # (if enabled) memory in bytes.
 #
+# TODO: This line is a hack to separate the example from the body
+#
 # .. qmp-example::
 #
 #     -> { "execute": "query-memory-size-summary" }
diff --git a/scripts/qapi/parser.py b/scripts/qapi/parser.py
index d43a123cd7..2529edf81a 100644
--- a/scripts/qapi/parser.py
+++ b/scripts/qapi/parser.py
@@ -804,6 +804,43 @@ class QAPIDoc:
                                % feature.name)
         self.features[feature.name].connect(feature)
 
+    def ensure_returns(self, info: QAPISourceInfo) -> None:
+
+        def _insert_near_kind(
+            kind: QAPIDoc.Kind,
+            new_sect: QAPIDoc.Section,
+            after: bool = False,
+        ) -> bool:
+            for idx, sect in enumerate(reversed(self.all_sections)):
+                if sect.kind == kind:
+                    pos = len(self.all_sections) - idx - 1
+                    if after:
+                        pos += 1
+                    self.all_sections.insert(pos, new_sect)
+                    return True
+            return False
+
+        if any(s.kind == QAPIDoc.Kind.RETURNS for s in self.all_sections):
+            return
+
+        # Stub "Returns" section for undocumented returns value
+        stub = QAPIDoc.Section(info, QAPIDoc.Kind.RETURNS)
+
+        if any(_insert_near_kind(kind, stub, after) for kind, after in (
+                # 1. If arguments, right after those.
+                (QAPIDoc.Kind.MEMBER, True),
+                # 2. Elif errors, right *before* those.
+                (QAPIDoc.Kind.ERRORS, False),
+                # 3. Elif features, right *before* those.
+                (QAPIDoc.Kind.FEATURE, False),
+        )):
+            return
+
+        # Otherwise, it should go right after the intro. The intro
+        # is always the first section and is always present (even
+        # when empty), so we can insert directly at index=1 blindly.
+        self.all_sections.insert(1, stub)
+
     def check_expr(self, expr: QAPIExpression) -> None:
         if 'command' in expr:
             if self.returns and 'returns' not in expr:
diff --git a/scripts/qapi/schema.py b/scripts/qapi/schema.py
index cbe3b5aa91..3abddea352 100644
--- a/scripts/qapi/schema.py
+++ b/scripts/qapi/schema.py
@@ -1062,6 +1062,9 @@ class QAPISchemaCommand(QAPISchemaDefinition):
             if self.arg_type and self.arg_type.is_implicit():
                 self.arg_type.connect_doc(doc)
 
+            if self.ret_type and self.info:
+                doc.ensure_returns(self.info)
+
     def visit(self, visitor: QAPISchemaVisitor) -> None:
         super().visit(visitor)
         visitor.visit_command(

From 0462da9d6b1918c741c632f57d743d5851ec5983 Mon Sep 17 00:00:00 2001
From: John Snow <jsnow@redhat.com>
Date: Fri, 11 Jul 2025 01:10:44 -0400
Subject: [PATCH 2258/2760] qapi: remove trivial "Returns:" sections

The new qapidoc.py can generate "Returns" statements with type
information just fine, so we can remove it from the source where it
doesn't add anything particularly novel or helpful and just repeats the
type info.

This patch is fairly "gentle" and doesn't aggressively touch other
"Returns" lines that could be rephrased to omit repeating type
information; it only removes lines that appear appropriate to wholly
remove.

To help facilitate auto-generated placement, a few doc blocks have a
"TODO:" line inserted to help the placement algorithm differentiate the
introductory paragraph(s) from the rest of the documentation.

The auto-generated returns are in the exact same spot, except for
query-migrationthreads, query-machines, and
x-query-virtio-queue-element.  These auto-generation moves to a better
spot.

Signed-off-by: John Snow <jsnow@redhat.com>
Message-ID: <20250711051045.51110-4-jsnow@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
[Two more Returns: removed, commit message amended to explain
auto-generated returns generated into a different spot]
Signed-off-by: Markus Armbruster <armbru@redhat.com>
---
 qapi/audio.json      |  2 --
 qapi/block-core.json |  8 --------
 qapi/char.json       |  8 --------
 qapi/cryptodev.json  |  2 --
 qapi/machine.json    | 24 ------------------------
 qapi/migration.json  | 12 ++----------
 qapi/misc-arm.json   |  2 --
 qapi/misc-i386.json  | 10 ----------
 qapi/misc.json       |  7 -------
 qapi/rocker.json     |  4 ----
 qapi/run-state.json  |  2 --
 qapi/tpm.json        |  4 ----
 qapi/ui.json         |  8 --------
 qapi/virtio.json     |  2 --
 qapi/yank.json       |  2 +-
 15 files changed, 3 insertions(+), 94 deletions(-)

diff --git a/qapi/audio.json b/qapi/audio.json
index 6a22ca384a..53142080f7 100644
--- a/qapi/audio.json
+++ b/qapi/audio.json
@@ -537,8 +537,6 @@
 #
 # Return information about audiodev configuration
 #
-# Returns: array of @Audiodev
-#
 # Since: 8.0
 ##
 { 'command': 'query-audiodevs',
diff --git a/qapi/block-core.json b/qapi/block-core.json
index 8b413946ff..01bf41b8b0 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
@@ -1951,8 +1951,6 @@
 # @flat: Omit the nested data about backing image ("backing-image"
 #     key) if true.  Default is false (Since 5.0)
 #
-# Returns: the list of BlockDeviceInfo
-#
 # Since: 2.0
 #
 # .. qmp-example::
@@ -2465,9 +2463,6 @@
 #
 # @unstable: This command is meant for debugging.
 #
-# Returns:
-#     BlockDirtyBitmapSha256
-#
 # Errors:
 #     - If @node is not a valid block device, DeviceNotFound
 #     - If @name is not found or if hashing has failed, GenericError
@@ -6203,9 +6198,6 @@
 #
 # @name: optional the snapshot's name to be deleted
 #
-# Returns:
-#     SnapshotInfo
-#
 # Errors:
 #     - If @device is not a valid block device, GenericError
 #     - If snapshot not found, GenericError
diff --git a/qapi/char.json b/qapi/char.json
index f38d04986d..f0a53f742c 100644
--- a/qapi/char.json
+++ b/qapi/char.json
@@ -38,8 +38,6 @@
 #
 # Return information about current character devices.
 #
-# Returns: a list of @ChardevInfo
-#
 # Since: 0.14
 #
 # .. qmp-example::
@@ -84,8 +82,6 @@
 #
 # Return information about character device backends.
 #
-# Returns: a list of @ChardevBackendInfo
-#
 # Since: 2.0
 #
 # .. qmp-example::
@@ -774,8 +770,6 @@
 #
 # @backend: backend type and parameters
 #
-# Returns: ChardevReturn.
-#
 # Since: 1.4
 #
 # .. qmp-example::
@@ -814,8 +808,6 @@
 #
 # @backend: new backend type and parameters
 #
-# Returns: ChardevReturn.
-#
 # Since: 2.10
 #
 # .. qmp-example::
diff --git a/qapi/cryptodev.json b/qapi/cryptodev.json
index 1f49e1822c..eb309c22f8 100644
--- a/qapi/cryptodev.json
+++ b/qapi/cryptodev.json
@@ -98,8 +98,6 @@
 #
 # Return information about current crypto devices.
 #
-# Returns: a list of @QCryptodevInfo
-#
 # Since: 8.0
 ##
 { 'command': 'query-cryptodev', 'returns': ['QCryptodevInfo']}
diff --git a/qapi/machine.json b/qapi/machine.json
index 2d6a137f21..2364893cba 100644
--- a/qapi/machine.json
+++ b/qapi/machine.json
@@ -103,8 +103,6 @@
 #
 # Return information about all virtual CPUs.
 #
-# Returns: list of @CpuInfoFast
-#
 # Since: 2.12
 #
 # .. qmp-example::
@@ -220,8 +218,6 @@
 #
 # @unstable: Argument @compat-props is experimental.
 #
-# Returns: a list of MachineInfo
-#
 # Since: 1.2
 #
 # .. qmp-example::
@@ -270,8 +266,6 @@
 #
 # Return information on the current virtual machine.
 #
-# Returns: CurrentMachineParams
-#
 # Since: 4.0
 ##
 { 'command': 'query-current-machine', 'returns': 'CurrentMachineParams' }
@@ -293,8 +287,6 @@
 #
 # Return information about the target for this QEMU
 #
-# Returns: QemuTargetInfo
-#
 # Since: 1.2
 ##
 { 'command': 'query-target', 'returns': 'QemuTargetInfo' }
@@ -318,8 +310,6 @@
 #
 # Query the guest UUID information.
 #
-# Returns: The @UuidInfo for the guest
-#
 # Since: 0.14
 #
 # .. qmp-example::
@@ -471,8 +461,6 @@
 #
 # Return information about KVM acceleration
 #
-# Returns: @KvmInfo
-#
 # Since: 0.14
 #
 # .. qmp-example::
@@ -934,8 +922,6 @@
 #
 # Return information for all memory backends.
 #
-# Returns: a list of @Memdev.
-#
 # Since: 2.1
 #
 # .. qmp-example::
@@ -1051,8 +1037,6 @@
 #
 # TODO: Better documentation; currently there is none.
 #
-# Returns: a list of HotpluggableCPU objects.
-#
 # Since: 2.7
 #
 # .. qmp-example::
@@ -1174,9 +1158,6 @@
 #
 # Return information about the balloon device.
 #
-# Returns:
-#     @BalloonInfo
-#
 # Errors:
 #     - If the balloon driver is enabled but not functional because
 #       the KVM kernel module cannot support it, KVMMissingCap
@@ -1240,9 +1221,6 @@
 # Return the hv-balloon driver data contained in the last received
 # "STATUS" message from the guest.
 #
-# Returns:
-#     @HvBalloonInfo
-#
 # Errors:
 #     - If no hv-balloon device is present, guest memory status
 #       reporting is not enabled or no guest memory status report
@@ -2260,8 +2238,6 @@
 #
 # Return a list of supported virtual CPU definitions
 #
-# Returns: a list of CpuDefinitionInfo
-#
 # Since: 1.2
 ##
 { 'command': 'query-cpu-definitions', 'returns': ['CpuDefinitionInfo'] }
diff --git a/qapi/migration.json b/qapi/migration.json
index 3bf97df5d8..57653160eb 100644
--- a/qapi/migration.json
+++ b/qapi/migration.json
@@ -326,8 +326,6 @@
 # is active there will be another json-object with RAM migration
 # status.
 #
-# Returns: @MigrationInfo
-#
 # Since: 0.14
 #
 # .. qmp-example::
@@ -577,8 +575,6 @@
 #
 # Return information about the current migration capabilities status
 #
-# Returns: @MigrationCapabilityStatus
-#
 # Since: 1.2
 #
 # .. qmp-example::
@@ -1364,8 +1360,6 @@
 #
 # Return information about the current migration parameters
 #
-# Returns: @MigrationParameters
-#
 # Since: 2.4
 #
 # .. qmp-example::
@@ -1946,7 +1940,7 @@
 #
 # Query replication status while the vm is running.
 #
-# Returns: A @ReplicationStatus object showing the status.
+# TODO: This line is a hack to separate the example from the body
 #
 # .. qmp-example::
 #
@@ -2000,7 +1994,7 @@
 #
 # Query COLO status while the vm is running.
 #
-# Returns: A @COLOStatus object showing the status.
+# TODO: This line is a hack to separate the example from the body
 #
 # .. qmp-example::
 #
@@ -2375,8 +2369,6 @@
 #
 # @deprecated: This command is deprecated with no replacement yet.
 #
-# Returns: @MigrationThreadInfo
-#
 # Since: 7.2
 ##
 { 'command': 'query-migrationthreads',
diff --git a/qapi/misc-arm.json b/qapi/misc-arm.json
index f5341372f5..f9dd743b52 100644
--- a/qapi/misc-arm.json
+++ b/qapi/misc-arm.json
@@ -36,8 +36,6 @@
 # On non-ARM targets this command will report an error as the GIC
 # technology is not applicable.
 #
-# Returns: a list of GICCapability objects.
-#
 # Since: 2.6
 #
 # .. qmp-example::
diff --git a/qapi/misc-i386.json b/qapi/misc-i386.json
index 24a2e143f6..5c3c9a14e0 100644
--- a/qapi/misc-i386.json
+++ b/qapi/misc-i386.json
@@ -132,8 +132,6 @@
 # @enabled field is set to 'false' and the state of all other fields
 # is unspecified.
 #
-# Returns: @SevInfo
-#
 # Since: 2.12
 #
 # .. qmp-example::
@@ -214,8 +212,6 @@
 #
 # This is only supported on AMD X86 platforms with KVM enabled.
 #
-# Returns: SevCapability objects.
-#
 # Errors:
 #     - If SEV is not available on the platform, GenericError
 #
@@ -280,8 +276,6 @@
 # @mnonce: a random 16 bytes value encoded in base64 (it will be
 #     included in report)
 #
-# Returns: SevAttestationReport objects.
-#
 # Errors:
 #     - If the attestation report is unavailable, either due to an
 #       invalid guest configuration or because the guest has not
@@ -343,8 +337,6 @@
 #
 # Return information about configured SGX capabilities of guest
 #
-# Returns: @SgxInfo
-#
 # Since: 6.2
 #
 # .. qmp-example::
@@ -362,8 +354,6 @@
 #
 # Return information about SGX capabilities of host
 #
-# Returns: @SgxInfo
-#
 # Since: 6.2
 #
 # .. qmp-example::
diff --git a/qapi/misc.json b/qapi/misc.json
index a180c16db2..b19eb08606 100644
--- a/qapi/misc.json
+++ b/qapi/misc.json
@@ -58,8 +58,6 @@
 #
 # Return the name information of a guest.
 #
-# Returns: @NameInfo of the guest
-#
 # Since: 0.14
 #
 # .. qmp-example::
@@ -334,9 +332,6 @@
 #
 # @opaque: A free-form string that can be used to describe the fd.
 #
-# Returns:
-#     @AddfdInfo
-#
 # Errors:
 #     - If file descriptor was not received, GenericError
 #     - If @fdset-id is a negative value, GenericError
@@ -417,8 +412,6 @@
 #
 # Return information describing all fd sets.
 #
-# Returns: A list of @FdsetInfo
-#
 # Since: 1.2
 #
 # .. note:: The list of fd sets is shared by all monitor connections.
diff --git a/qapi/rocker.json b/qapi/rocker.json
index e494964952..5d2dbd2603 100644
--- a/qapi/rocker.json
+++ b/qapi/rocker.json
@@ -30,8 +30,6 @@
 #
 # @name: switch name
 #
-# Returns: @Rocker information
-#
 # Since: 2.4
 #
 # .. qmp-example::
@@ -100,8 +98,6 @@
 #
 # @name: port name
 #
-# Returns: a list of @RockerPort information
-#
 # Since: 2.4
 #
 # .. qmp-example::
diff --git a/qapi/run-state.json b/qapi/run-state.json
index 083a3c5eb3..76f14569ff 100644
--- a/qapi/run-state.json
+++ b/qapi/run-state.json
@@ -121,8 +121,6 @@
 #
 # Query the run status of the VM
 #
-# Returns: @StatusInfo reflecting the VM
-#
 # Since: 0.14
 #
 # .. qmp-example::
diff --git a/qapi/tpm.json b/qapi/tpm.json
index e66b107f1d..3f2850a573 100644
--- a/qapi/tpm.json
+++ b/qapi/tpm.json
@@ -29,8 +29,6 @@
 #
 # Return a list of supported TPM models
 #
-# Returns: a list of TpmModel
-#
 # Since: 1.5
 #
 # .. qmp-example::
@@ -60,8 +58,6 @@
 #
 # Return a list of supported TPM types
 #
-# Returns: a list of TpmType
-#
 # Since: 1.5
 #
 # .. qmp-example::
diff --git a/qapi/ui.json b/qapi/ui.json
index f5e77ae19d..53489ab65f 100644
--- a/qapi/ui.json
+++ b/qapi/ui.json
@@ -328,8 +328,6 @@
 #
 # Return information about the current SPICE server
 #
-# Returns: @SpiceInfo
-#
 # Since: 0.14
 #
 # .. qmp-example::
@@ -660,8 +658,6 @@
 #
 # Return information about the current VNC server
 #
-# Returns: @VncInfo
-#
 # Since: 0.14
 #
 # .. qmp-example::
@@ -691,8 +687,6 @@
 #
 # Return a list of vnc servers.  The list can be empty.
 #
-# Returns: a list of @VncInfo2
-#
 # Since: 2.3
 ##
 { 'command': 'query-vnc-servers', 'returns': ['VncInfo2'],
@@ -1570,8 +1564,6 @@
 #
 # Return information about display configuration
 #
-# Returns: @DisplayOptions
-#
 # Since: 3.1
 ##
 { 'command': 'query-display-options',
diff --git a/qapi/virtio.json b/qapi/virtio.json
index 3cac0774f7..f0753cde71 100644
--- a/qapi/virtio.json
+++ b/qapi/virtio.json
@@ -849,8 +849,6 @@
 #
 # @unstable: This command is meant for debugging.
 #
-# Returns: VirtioQueueElement information
-#
 # Since: 7.2
 #
 # .. qmp-example::
diff --git a/qapi/yank.json b/qapi/yank.json
index d13a8e9117..c14de5229e 100644
--- a/qapi/yank.json
+++ b/qapi/yank.json
@@ -104,7 +104,7 @@
 #
 # Query yank instances.  See @YankInstance for more information.
 #
-# Returns: list of @YankInstance
+# TODO: This line is a hack to separate the example from the body
 #
 # .. qmp-example::
 #

From f7296f8de5c96c09452a0774435c1e5b512fab19 Mon Sep 17 00:00:00 2001
From: John Snow <jsnow@redhat.com>
Date: Fri, 11 Jul 2025 01:10:45 -0400
Subject: [PATCH 2259/2760] qapi: rephrase return docs to avoid type name
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

"Returns: <description>" is rendered like "Return: <Type> –
<description>".  Mentioning the type in the description again is
commonly redundant.  Rephrase such descriptions not to.

Well, I tried. Maybe not very hard. Sorry!

Signed-off-by: John Snow <jsnow@redhat.com>
Message-ID: <20250711051045.51110-5-jsnow@redhat.com>
Acked-by: Markus Armbruster <armbru@redhat.com>
[Commit message amended to explain why]
Signed-off-by: Markus Armbruster <armbru@redhat.com>
---
 qapi/block-core.json   | 6 +++---
 qapi/block-export.json | 2 +-
 qapi/block.json        | 2 +-
 qapi/control.json      | 5 ++---
 qapi/dump.json         | 5 ++---
 qapi/introspect.json   | 6 +++---
 qapi/job.json          | 2 +-
 qapi/misc-i386.json    | 2 +-
 qapi/misc.json         | 5 ++---
 qapi/net.json          | 2 +-
 qapi/pci.json          | 2 +-
 qapi/qdev.json         | 3 +--
 qapi/qom.json          | 8 +++-----
 qapi/stats.json        | 2 +-
 qapi/trace.json        | 2 +-
 qapi/ui.json           | 2 +-
 qapi/virtio.json       | 6 +++---
 17 files changed, 28 insertions(+), 34 deletions(-)

diff --git a/qapi/block-core.json b/qapi/block-core.json
index 01bf41b8b0..848ebaff5a 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
@@ -764,7 +764,7 @@
 #
 # Get a list of BlockInfo for all virtual block devices.
 #
-# Returns: a list of @BlockInfo describing each virtual block device.
+# Returns: a list describing each virtual block device.
 #     Filter nodes that were created implicitly are skipped over.
 #
 # Since: 0.14
@@ -1169,7 +1169,7 @@
 #     nodes that were created implicitly are skipped over in this
 #     mode.  (Since 2.3)
 #
-# Returns: A list of @BlockStats for each virtual block devices.
+# Returns: A list of statistics for each virtual block device.
 #
 # Since: 0.14
 #
@@ -1441,7 +1441,7 @@
 #
 # Return information about long-running block device operations.
 #
-# Returns: a list of @BlockJobInfo for each active block job
+# Returns: a list of job info for each active block job
 #
 # Since: 1.1
 ##
diff --git a/qapi/block-export.json b/qapi/block-export.json
index 2241bfecf2..fb004e35fd 100644
--- a/qapi/block-export.json
+++ b/qapi/block-export.json
@@ -473,7 +473,7 @@
 ##
 # @query-block-exports:
 #
-# Returns: A list of BlockExportInfo describing all block exports
+# Returns: A list describing all block exports
 #
 # Since: 5.2
 ##
diff --git a/qapi/block.json b/qapi/block.json
index 2d54a81c36..f0436ce871 100644
--- a/qapi/block.json
+++ b/qapi/block.json
@@ -89,7 +89,7 @@
 # Return a list of information about each persistent reservation
 # manager.
 #
-# Returns: a list of @PRManagerInfo for each persistent reservation
+# Returns: a list of manager info for each persistent reservation
 #     manager
 #
 # Since: 3.0
diff --git a/qapi/control.json b/qapi/control.json
index 5fed0701f8..931a860b30 100644
--- a/qapi/control.json
+++ b/qapi/control.json
@@ -95,8 +95,7 @@
 #
 # Return the current version of QEMU.
 #
-# Returns: A @VersionInfo object describing the current version of
-#     QEMU.
+# Returns: An object describing the current version of QEMU.
 #
 # Since: 0.14
 #
@@ -133,7 +132,7 @@
 #
 # Return a list of supported QMP commands by this server
 #
-# Returns: A list of @CommandInfo for all supported commands
+# Returns: A list of all supported commands
 #
 # Since: 0.14
 #
diff --git a/qapi/dump.json b/qapi/dump.json
index 0642ca157b..dc92b53247 100644
--- a/qapi/dump.json
+++ b/qapi/dump.json
@@ -148,7 +148,7 @@
 #
 # Query latest dump status.
 #
-# Returns: A @DumpStatus object showing the dump status.
+# Returns: An object showing the dump status.
 #
 # Since: 2.6
 #
@@ -199,8 +199,7 @@
 #
 # Return the available formats for dump-guest-memory
 #
-# Returns: A @DumpGuestMemoryCapability object listing available
-#     formats for dump-guest-memory
+# Returns: An object listing available formats for dump-guest-memory
 #
 # Since: 2.0
 #
diff --git a/qapi/introspect.json b/qapi/introspect.json
index 26d8839f19..be8511b067 100644
--- a/qapi/introspect.json
+++ b/qapi/introspect.json
@@ -36,10 +36,10 @@
 # string into a specific enum or from one specific type into an
 # alternate that includes the original type alongside something else.
 #
-# Returns: array of @SchemaInfo, where each element describes an
-#     entity in the ABI: command, event, type, ...
+# Returns: an array where each element describes an entity in the ABI:
+#     command, event, type, ...
 #
-#     The order of the various SchemaInfo is unspecified; however, all
+#     The order of the various elements is unspecified; however, all
 #     names are guaranteed to be unique (no name will be duplicated
 #     with different meta-types).
 #
diff --git a/qapi/job.json b/qapi/job.json
index 16b280f52f..51a57c523e 100644
--- a/qapi/job.json
+++ b/qapi/job.json
@@ -297,7 +297,7 @@
 #
 # Return information about jobs.
 #
-# Returns: a list with a @JobInfo for each active job
+# Returns: a list with info for each active job
 #
 # Since: 3.0
 ##
diff --git a/qapi/misc-i386.json b/qapi/misc-i386.json
index 5c3c9a14e0..282bd3627b 100644
--- a/qapi/misc-i386.json
+++ b/qapi/misc-i386.json
@@ -163,7 +163,7 @@
 # 'sev-guest' confidential virtualization object.  The launch
 # measurement for SEV-SNP guests is only available within the guest.
 #
-# Returns: The @SevLaunchMeasureInfo for the guest
+# Returns: The guest's SEV guest launch measurement info
 #
 # Errors:
 #     - If the launch measurement is unavailable, either due to an
diff --git a/qapi/misc.json b/qapi/misc.json
index b19eb08606..7dbc29dbd6 100644
--- a/qapi/misc.json
+++ b/qapi/misc.json
@@ -107,7 +107,7 @@
 #    declared using the ``-object iothread`` command-line option.  It
 #    is always the main thread of the process.
 #
-# Returns: a list of @IOThreadInfo for each iothread
+# Returns: a list of info for each iothread
 #
 # Since: 2.0
 #
@@ -511,8 +511,7 @@
 #
 # @option: option name
 #
-# Returns: list of @CommandLineOptionInfo for all options (or for the
-#     given @option).
+# Returns: list of objects for all options (or for the given @option).
 #
 # Errors:
 #     - if the given @option doesn't exist
diff --git a/qapi/net.json b/qapi/net.json
index 3b03843c16..a266c6786e 100644
--- a/qapi/net.json
+++ b/qapi/net.json
@@ -847,7 +847,7 @@
 #
 # @name: net client name
 #
-# Returns: list of @RxFilterInfo for all NICs (or for the given NIC).
+# Returns: list of info for all NICs (or for the given NIC).
 #
 # Errors:
 #     - if the given @name doesn't exist
diff --git a/qapi/pci.json b/qapi/pci.json
index a8671cd9ac..418ea4fc93 100644
--- a/qapi/pci.json
+++ b/qapi/pci.json
@@ -177,7 +177,7 @@
 #
 # Return information about the PCI bus topology of the guest.
 #
-# Returns: a list of @PciInfo for each PCI bus.  Each bus is
+# Returns: a list of info for each PCI bus.  Each bus is
 #     represented by a json-object, which has a key with a json-array
 #     of all PCI devices attached to it.  Each device is represented
 #     by a json-object.
diff --git a/qapi/qdev.json b/qapi/qdev.json
index 441ed518b8..6441357e00 100644
--- a/qapi/qdev.json
+++ b/qapi/qdev.json
@@ -19,8 +19,7 @@
 #
 # @typename: the type name of a device
 #
-# Returns: a list of ObjectPropertyInfo describing a devices
-#     properties
+# Returns: a list describing a devices properties
 #
 # .. note:: Objects can create properties at runtime, for example to
 #    describe links between different devices and/or objects.  These
diff --git a/qapi/qom.json b/qapi/qom.json
index fbf94b9e09..aa09eddbf9 100644
--- a/qapi/qom.json
+++ b/qapi/qom.json
@@ -55,8 +55,7 @@
 # @path: the path within the object model.  See @qom-get for a
 #     description of this parameter.
 #
-# Returns: a list of @ObjectPropertyInfo that describe the properties
-#     of the object.
+# Returns: a list that describe the properties of the object.
 #
 # Since: 1.2
 #
@@ -178,8 +177,7 @@
 #
 # @abstract: if true, include abstract types in the results
 #
-# Returns: a list of @ObjectTypeInfo or an empty list if no results
-#     are found
+# Returns: a list of types, or an empty list if no results are found
 #
 # Since: 1.1
 ##
@@ -199,7 +197,7 @@
 #    describe links between different devices and/or objects.  These
 #    properties are not included in the output of this command.
 #
-# Returns: a list of ObjectPropertyInfo describing object properties
+# Returns: a list describing object properties
 #
 # Since: 2.12
 ##
diff --git a/qapi/stats.json b/qapi/stats.json
index 78b88881ea..b63a7369dd 100644
--- a/qapi/stats.json
+++ b/qapi/stats.json
@@ -188,7 +188,7 @@
 # The arguments are a StatsFilter and specify the provider and objects
 # to return statistics about.
 #
-# Returns: a list of StatsResult, one for each provider and object
+# Returns: a list of statistics, one for each provider and object
 #     (e.g., for each vCPU).
 #
 # Since: 7.1
diff --git a/qapi/trace.json b/qapi/trace.json
index d08c9c6a88..de369dae6b 100644
--- a/qapi/trace.json
+++ b/qapi/trace.json
@@ -49,7 +49,7 @@
 #
 # @name: Event name pattern (case-sensitive glob).
 #
-# Returns: a list of @TraceEventInfo for the matching events
+# Returns: a list of info for the matching events
 #
 # Since: 2.2
 #
diff --git a/qapi/ui.json b/qapi/ui.json
index 53489ab65f..b48266c458 100644
--- a/qapi/ui.json
+++ b/qapi/ui.json
@@ -822,7 +822,7 @@
 #
 # Return information about each active mouse device
 #
-# Returns: a list of @MouseInfo for each device
+# Returns: a list of info for each device
 #
 # Since: 0.14
 #
diff --git a/qapi/virtio.json b/qapi/virtio.json
index f0753cde71..2e23512085 100644
--- a/qapi/virtio.json
+++ b/qapi/virtio.json
@@ -201,7 +201,7 @@
 #
 # @unstable: This command is meant for debugging.
 #
-# Returns: VirtioStatus of the virtio device
+# Returns: Status of the virtio device
 #
 # Since: 7.2
 #
@@ -565,7 +565,7 @@
 #
 # @unstable: This command is meant for debugging.
 #
-# Returns: VirtQueueStatus of the VirtQueue
+# Returns: Status of the queue
 #
 # .. note:: last_avail_idx will not be displayed in the case where the
 #    selected VirtIODevice has a running vhost device and the
@@ -700,7 +700,7 @@
 #
 # @unstable: This command is meant for debugging.
 #
-# Returns: VirtVhostQueueStatus of the vhost_virtqueue
+# Returns: Status of the vhost_virtqueue
 #
 # Since: 7.2
 #

From 17c2c399bdf75c314bfce97fb9fb21badc9e4465 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Thu, 10 Jul 2025 11:45:25 +0100
Subject: [PATCH 2260/2760] gitlab: add -n option to check-units script
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Mostly a developer aid for those who want to look at the full backlog
of multiple build units.

Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250710104531.3099313-3-alex.bennee@linaro.org>
---
 .gitlab-ci.d/check-units.py | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/.gitlab-ci.d/check-units.py b/.gitlab-ci.d/check-units.py
index cdc62ae5ee..cebef0e8be 100755
--- a/.gitlab-ci.d/check-units.py
+++ b/.gitlab-ci.d/check-units.py
@@ -30,7 +30,7 @@ def extract_build_units(cc_path):
     return build_units
 
 
-def analyse_units(build_units):
+def analyse_units(build_units, top_n):
     """
     Analyse the build units and report stats and the top 10 rebuilds
     """
@@ -44,7 +44,7 @@ def analyse_units(build_units):
                                 reverse=True)
 
     print("Most rebuilt units:")
-    for unit, count in sorted_build_units[:20]:
+    for unit, count in sorted_build_units[:top_n]:
         print(f"  {unit} built {count} times")
 
     print("Least rebuilt units:")
@@ -57,12 +57,14 @@ if __name__ == "__main__":
         description="analyse number of build units in compile_commands.json")
     parser.add_argument("cc_path", type=Path, default=None,
                         help="Path to compile_commands.json")
+    parser.add_argument("-n", type=int, default=20,
+                        help="Dump the top <n> entries")
 
     args = parser.parse_args()
 
     if path.isfile(args.cc_path) and access(args.cc_path, R_OK):
         units = extract_build_units(args.cc_path)
-        analyse_units(units)
+        analyse_units(units, args.n)
         exit(0)
     else:
         print(f"{args.cc_path} doesn't exist or isn't readable")

From 81143b7f9d9f6645dcd6e9ea3fca0942ab25c337 Mon Sep 17 00:00:00 2001
From: Yodel Eldar <yodel.eldar@gmail.com>
Date: Thu, 10 Jul 2025 11:45:26 +0100
Subject: [PATCH 2261/2760] contrib/plugins/execlog: Add tab to the separator
 search of insn_disas
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Currently, execlog searches for a space separator between the
instruction mnemonic and operands, but some disassemblers, e.g. Alpha's,
use a tab separator instead; this results in a null pointer being passed
as the haystack in g_strstr during a subsequent register search, i.e.
undefined behavior, because of a missing null check.

This patch adds tab to the separator search and a null check on the
result.

Also, an affected pointer is changed to const.

Lastly, a break statement was added to immediately terminate the
register search when a user-requested register is found in the current
instruction as a trivial optimization, because searching for the
remaining requested registers is unnecessary once one is found.

Suggested-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Yodel Eldar <yodel.eldar@gmail.com>
Message-ID: <20250630164124.26315-2-yodel.eldar@gmail.com>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250710104531.3099313-4-alex.bennee@linaro.org>
---
 contrib/plugins/execlog.c | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/contrib/plugins/execlog.c b/contrib/plugins/execlog.c
index d67d010761..06ec76d6e9 100644
--- a/contrib/plugins/execlog.c
+++ b/contrib/plugins/execlog.c
@@ -232,12 +232,15 @@ static void vcpu_tb_trans(qemu_plugin_id_t id, struct qemu_plugin_tb *tb)
          */
         if (disas_assist && rmatches) {
             check_regs_next = false;
-            gchar *args = g_strstr_len(insn_disas, -1, " ");
-            for (int n = 0; n < all_reg_names->len; n++) {
-                gchar *reg = g_ptr_array_index(all_reg_names, n);
-                if (g_strrstr(args, reg)) {
-                    check_regs_next = true;
-                    skip = false;
+            g_auto(GStrv) args = g_strsplit_set(insn_disas, " \t", 2);
+            if (args && args[1]) {
+                for (int n = 0; n < all_reg_names->len; n++) {
+                    const gchar *reg = g_ptr_array_index(all_reg_names, n);
+                    if (g_strrstr(args[1], reg)) {
+                        check_regs_next = true;
+                        skip = false;
+                        break;
+                    }
                 }
             }
         }

From 5a28fa5ba17254d0398a854657b47af3096bd86a Mon Sep 17 00:00:00 2001
From: Yodel Eldar <yodel.eldar@gmail.com>
Date: Thu, 10 Jul 2025 11:45:27 +0100
Subject: [PATCH 2262/2760] target/alpha: Add GDB XML feature file
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This patch adds the GDB XML feature file that describes Alpha's core
registers.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2569

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Yodel Eldar <yodel.eldar@gmail.com>
Message-ID: <20250630164124.26315-3-yodel.eldar@gmail.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250710104531.3099313-5-alex.bennee@linaro.org>
---
 configs/targets/alpha-linux-user.mak |   1 +
 configs/targets/alpha-softmmu.mak    |   1 +
 gdb-xml/alpha-core.xml               | 136 +++++++++++++++++++++++++++
 target/alpha/cpu.c                   |   1 +
 4 files changed, 139 insertions(+)
 create mode 100644 gdb-xml/alpha-core.xml

diff --git a/configs/targets/alpha-linux-user.mak b/configs/targets/alpha-linux-user.mak
index ef8e365b09..aa25766236 100644
--- a/configs/targets/alpha-linux-user.mak
+++ b/configs/targets/alpha-linux-user.mak
@@ -2,3 +2,4 @@ TARGET_ARCH=alpha
 TARGET_SYSTBL_ABI=common
 TARGET_SYSTBL=syscall.tbl
 TARGET_LONG_BITS=64
+TARGET_XML_FILES= gdb-xml/alpha-core.xml
diff --git a/configs/targets/alpha-softmmu.mak b/configs/targets/alpha-softmmu.mak
index 5275076e50..e31f059a52 100644
--- a/configs/targets/alpha-softmmu.mak
+++ b/configs/targets/alpha-softmmu.mak
@@ -1,2 +1,3 @@
 TARGET_ARCH=alpha
 TARGET_LONG_BITS=64
+TARGET_XML_FILES= gdb-xml/alpha-core.xml
diff --git a/gdb-xml/alpha-core.xml b/gdb-xml/alpha-core.xml
new file mode 100644
index 0000000000..c9e12f4ffd
--- /dev/null
+++ b/gdb-xml/alpha-core.xml
@@ -0,0 +1,136 @@
+<?xml version="1.0"?>
+<!-- Copyright (C) 2025 Free Software Foundation, Inc.
+
+     Copying and distribution of this file, with or without modification,
+     are permitted in any medium without royalty provided the copyright
+     notice and this notice are preserved.  -->
+
+<!DOCTYPE feature SYSTEM "gdb-target.dtd">
+<feature name="org.gnu.gdb.alpha.core">
+  <!-- IEEE rounding mode values -->
+  <enum id="dyn_rm_enum" size="8">
+    <!-- Chopped rounding mode -->
+    <evalue name="chop" value="0"/>
+    <!-- Minus infinity -->
+    <evalue name="-inf" value="1"/>
+    <!-- Normal rounding -->
+    <evalue name="norm" value="2"/>
+    <!-- Plus infinity -->
+    <evalue name="+inf" value="3"/>
+  </enum>
+
+  <!-- Floating-Point Control Register Flags -->
+  <flags id="fpcr_flags" size="8">
+    <!-- Denormal Operand Exception Disable -->
+    <field name="DNOD"   start="47" end="47"/>
+    <!-- Denormal Operands to Zero -->
+    <field name="DNZ"    start="48" end="48"/>
+    <!-- Invalid Operation Disable -->
+    <field name="INVD"   start="49" end="49"/>
+    <!-- Division by Zero Disable -->
+    <field name="DZED"   start="50" end="50"/>
+    <!-- Overflow Disable -->
+    <field name="OVFD"   start="51" end="51"/>
+    <!-- Invalid Operation -->
+    <field name="INV"    start="52" end="52"/>
+    <!-- Division by Zero -->
+    <field name="DZE"    start="53" end="53"/>
+    <!-- Overflow -->
+    <field name="OVF"    start="54" end="54"/>
+    <!-- Underflow -->
+    <field name="UNF"    start="55" end="55"/>
+    <!-- Inexact Result -->
+    <field name="INE"    start="56" end="56"/>
+    <!-- Integer Overflow -->
+    <field name="IOV"    start="57" end="57"/>
+    <!-- Dynamic Rounding Mode -->
+    <field name="DYN_RM" start="58" end="59" type="dyn_rm_enum"/>
+    <!-- Underflow to Zero -->
+    <field name="UNDZ"   start="60" end="60"/>
+    <!-- Underflow Disable -->
+    <field name="UNFD"   start="61" end="61"/>
+    <!-- Inexact Disable -->
+    <field name="INED"   start="62" end="62"/>
+    <!-- Summary Bit -->
+    <field name="SUM"    start="63" end="63"/>
+  </flags>
+
+  <!-- Integer Registers -->
+  <reg name="v0"   bitsize="64" type="int64"/>
+  <reg name="t0"   bitsize="64" type="int64"/>
+  <reg name="t1"   bitsize="64" type="int64"/>
+  <reg name="t2"   bitsize="64" type="int64"/>
+  <reg name="t3"   bitsize="64" type="int64"/>
+  <reg name="t4"   bitsize="64" type="int64"/>
+  <reg name="t5"   bitsize="64" type="int64"/>
+  <reg name="t6"   bitsize="64" type="int64"/>
+  <reg name="t7"   bitsize="64" type="int64"/>
+  <reg name="s0"   bitsize="64" type="int64"/>
+  <reg name="s1"   bitsize="64" type="int64"/>
+  <reg name="s2"   bitsize="64" type="int64"/>
+  <reg name="s3"   bitsize="64" type="int64"/>
+  <reg name="s4"   bitsize="64" type="int64"/>
+  <reg name="s5"   bitsize="64" type="int64"/>
+  <reg name="fp"   bitsize="64" type="int64"/>
+  <reg name="a0"   bitsize="64" type="int64"/>
+  <reg name="a1"   bitsize="64" type="int64"/>
+  <reg name="a2"   bitsize="64" type="int64"/>
+  <reg name="a3"   bitsize="64" type="int64"/>
+  <reg name="a4"   bitsize="64" type="int64"/>
+  <reg name="a5"   bitsize="64" type="int64"/>
+  <reg name="t8"   bitsize="64" type="int64"/>
+  <reg name="t9"   bitsize="64" type="int64"/>
+  <reg name="t10"  bitsize="64" type="int64"/>
+  <reg name="t11"  bitsize="64" type="int64"/>
+  <reg name="ra"   bitsize="64" type="int64"/>
+  <reg name="t12"  bitsize="64" type="int64"/>
+  <reg name="at"   bitsize="64" type="int64"/>
+  <reg name="gp"   bitsize="64" type="data_ptr"/>
+  <reg name="sp"   bitsize="64" type="data_ptr"/>
+  <reg name="zero" bitsize="64" type="int64" save-restore="no"/>
+
+  <!-- Floating-Point Registers -->
+  <reg name="f0"  bitsize="64" type="float" group="float"/>
+  <reg name="f1"  bitsize="64" type="float" group="float"/>
+  <reg name="f2"  bitsize="64" type="float" group="float"/>
+  <reg name="f3"  bitsize="64" type="float" group="float"/>
+  <reg name="f4"  bitsize="64" type="float" group="float"/>
+  <reg name="f5"  bitsize="64" type="float" group="float"/>
+  <reg name="f6"  bitsize="64" type="float" group="float"/>
+  <reg name="f7"  bitsize="64" type="float" group="float"/>
+  <reg name="f8"  bitsize="64" type="float" group="float"/>
+  <reg name="f9"  bitsize="64" type="float" group="float"/>
+  <reg name="f10" bitsize="64" type="float" group="float"/>
+  <reg name="f11" bitsize="64" type="float" group="float"/>
+  <reg name="f12" bitsize="64" type="float" group="float"/>
+  <reg name="f13" bitsize="64" type="float" group="float"/>
+  <reg name="f14" bitsize="64" type="float" group="float"/>
+  <reg name="f15" bitsize="64" type="float" group="float"/>
+  <reg name="f16" bitsize="64" type="float" group="float"/>
+  <reg name="f17" bitsize="64" type="float" group="float"/>
+  <reg name="f18" bitsize="64" type="float" group="float"/>
+  <reg name="f19" bitsize="64" type="float" group="float"/>
+  <reg name="f20" bitsize="64" type="float" group="float"/>
+  <reg name="f21" bitsize="64" type="float" group="float"/>
+  <reg name="f22" bitsize="64" type="float" group="float"/>
+  <reg name="f23" bitsize="64" type="float" group="float"/>
+  <reg name="f24" bitsize="64" type="float" group="float"/>
+  <reg name="f25" bitsize="64" type="float" group="float"/>
+  <reg name="f26" bitsize="64" type="float" group="float"/>
+  <reg name="f27" bitsize="64" type="float" group="float"/>
+  <reg name="f28" bitsize="64" type="float" group="float"/>
+  <reg name="f29" bitsize="64" type="float" group="float"/>
+  <reg name="f30" bitsize="64" type="float" group="float"/>
+
+  <!-- Floating-Point Control Register -->
+  <reg name="fpcr" bitsize="64" type="fpcr_flags" group="float"/>
+
+  <!-- Program Counter -->
+  <reg name="pc" bitsize="64" type="code_ptr"/>
+
+  <!-- Reserved Index for Former Virtual Register -->
+  <reg name="" bitsize="64" type="int64" save-restore="no"/>
+
+  <!-- PALcode Memory Slot -->
+  <reg name="unique" bitsize="64" type="int64" group="system"/>
+</feature>
diff --git a/target/alpha/cpu.c b/target/alpha/cpu.c
index 2082db45ea..bf1787a69d 100644
--- a/target/alpha/cpu.c
+++ b/target/alpha/cpu.c
@@ -286,6 +286,7 @@ static void alpha_cpu_class_init(ObjectClass *oc, const void *data)
     cc->get_pc = alpha_cpu_get_pc;
     cc->gdb_read_register = alpha_cpu_gdb_read_register;
     cc->gdb_write_register = alpha_cpu_gdb_write_register;
+    cc->gdb_core_xml_file = "alpha-core.xml";
 #ifndef CONFIG_USER_ONLY
     dc->vmsd = &vmstate_alpha_cpu;
     cc->sysemu_ops = &alpha_sysemu_ops;

From dcc83c3e41a89a1426fb56106c882479185f6383 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Thu, 10 Jul 2025 11:45:28 +0100
Subject: [PATCH 2263/2760] plugins: fix inclusion of user-mode APIs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In 903e870f24 (plugins/api: split out binary path/start/end/entry
code) we didn't actually enable the building of the new plugin helper.
However this was missed because only contrib plugins like drcov
actually used the helpers.

With that fixed we discover we also need some more includes to be able
to extract the relevant data from TaskState.

Fixes: 903e870f24 (plugins/api: split out binary path/start/end/entry code)
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3014
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250710104531.3099313-6-alex.bennee@linaro.org>
---
 common-user/plugin-api.c.inc | 1 +
 linux-user/meson.build       | 5 ++++-
 linux-user/plugin-api.c      | 1 +
 3 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/common-user/plugin-api.c.inc b/common-user/plugin-api.c.inc
index 5b8a1396b6..63f3983271 100644
--- a/common-user/plugin-api.c.inc
+++ b/common-user/plugin-api.c.inc
@@ -13,6 +13,7 @@
 #include "qemu/osdep.h"
 #include "qemu/main-loop.h"
 #include "qemu/plugin.h"
+#include "accel/tcg/vcpu-state.h"
 #include "qemu.h"
 
 /*
diff --git a/linux-user/meson.build b/linux-user/meson.build
index f47a213ca3..efca843369 100644
--- a/linux-user/meson.build
+++ b/linux-user/meson.build
@@ -27,7 +27,10 @@ linux_user_ss.add(libdw)
 linux_user_ss.add(when: 'TARGET_HAS_BFLT', if_true: files('flatload.c'))
 linux_user_ss.add(when: 'TARGET_I386', if_true: files('vm86.c'))
 linux_user_ss.add(when: 'CONFIG_ARM_COMPATIBLE_SEMIHOSTING', if_true: files('semihost.c'))
-linux_user_ss.add(when: 'CONFIG_TCG_PLUGINS', if_true: files('plugin-api.c'))
+
+if get_option('plugins')
+  linux_user_ss.add(files('plugin-api.c'))
+endif
 
 syscall_nr_generators = {}
 
diff --git a/linux-user/plugin-api.c b/linux-user/plugin-api.c
index 66755df526..8d6fbb60e0 100644
--- a/linux-user/plugin-api.c
+++ b/linux-user/plugin-api.c
@@ -12,4 +12,5 @@
 
 #include "qemu/osdep.h"
 #include "qemu.h"
+#include "loader.h"
 #include "common-user/plugin-api.c.inc"

From e962d3c921e00395a7d151adba617249b7579f7a Mon Sep 17 00:00:00 2001
From: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Date: Thu, 10 Jul 2025 11:45:29 +0100
Subject: [PATCH 2264/2760] docs: use :kbd: role in sphinx docs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Sphinx supports the :kbd: role for notating keyboard input. They get
formatted as <kbd> HTML elements in the readthedocs theme we currently
use for Sphinx.

Besides the better visual formatting, it also helps with accessibility
as screen readers can announce the semantics of the <kbd> element to the
user.

Signed-off-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Message-ID: <20250709-docs_rst_improvements-v2-1-cb5096ad0022@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250710104531.3099313-7-alex.bennee@linaro.org>
---
 docs/devel/testing/main.rst     |  4 +--
 docs/system/images.rst          |  2 +-
 docs/system/keys.rst.inc        | 49 +++++++++++++++++----------------
 docs/system/linuxboot.rst       |  2 +-
 docs/system/mux-chardev.rst.inc | 38 ++++++++++++++-----------
 5 files changed, 51 insertions(+), 44 deletions(-)

diff --git a/docs/devel/testing/main.rst b/docs/devel/testing/main.rst
index 6b18ed875c..2b5cb0c148 100644
--- a/docs/devel/testing/main.rst
+++ b/docs/devel/testing/main.rst
@@ -604,9 +604,9 @@ below steps to debug it:
 2. Add "V=1" to the command line, try again, to see the verbose output.
 3. Further add "DEBUG=1" to the command line. This will pause in a shell prompt
    in the container right before testing starts. You could either manually
-   build QEMU and run tests from there, or press Ctrl-D to let the Docker
+   build QEMU and run tests from there, or press :kbd:`Ctrl+d` to let the Docker
    testing continue.
-4. If you press Ctrl-D, the same building and testing procedure will begin, and
+4. If you press :kbd:`Ctrl+d`, the same building and testing procedure will begin, and
    will hopefully run into the error again. After that, you will be dropped to
    the prompt for debug.
 
diff --git a/docs/system/images.rst b/docs/system/images.rst
index a5551173c9..43706969fd 100644
--- a/docs/system/images.rst
+++ b/docs/system/images.rst
@@ -30,7 +30,7 @@ Snapshot mode
 If you use the option ``-snapshot``, all disk images are considered as
 read only. When sectors in written, they are written in a temporary file
 created in ``/tmp``. You can however force the write back to the raw
-disk images by using the ``commit`` monitor command (or C-a s in the
+disk images by using the ``commit`` monitor command (or :kbd:`Ctrl+a s` in the
 serial console).
 
 .. _vm_005fsnapshots:
diff --git a/docs/system/keys.rst.inc b/docs/system/keys.rst.inc
index 59966a3fe7..c28ae1a227 100644
--- a/docs/system/keys.rst.inc
+++ b/docs/system/keys.rst.inc
@@ -1,36 +1,37 @@
 During the graphical emulation, you can use special key combinations from
-the following table to change modes. By default the modifier is Ctrl-Alt
+the following table to change modes. By default the modifier is :kbd:`Ctrl+Alt`
 (used in the table below) which can be changed with ``-display`` suboption
 ``mod=`` where appropriate. For example, ``-display sdl,
-grab-mod=lshift-lctrl-lalt`` changes the modifier key to Ctrl-Alt-Shift,
-while ``-display sdl,grab-mod=rctrl`` changes it to the right Ctrl key.
+grab-mod=lshift-lctrl-lalt`` changes the modifier key to :kbd:`Ctrl+Alt+Shift`,
+while ``-display sdl,grab-mod=rctrl`` changes it to the right :kbd:`Ctrl` key.
 
-Ctrl-Alt-f
-   Toggle full screen
+.. list-table:: Multiplexer Keys
+  :widths: 10 90
+  :header-rows: 1
 
-Ctrl-Alt-+
-   Enlarge the screen
+  * - Key Sequence
+    - Action
 
-Ctrl-Alt\--
-   Shrink the screen
+  * - :kbd:`Ctrl+Alt+f`
+    - Toggle full screen
 
-Ctrl-Alt-u
-   Restore the screen's un-scaled dimensions
+  * - :kbd:`Ctrl+Alt++`
+    - Enlarge the screen
 
-Ctrl-Alt-n
-   Switch to virtual console 'n'. Standard console mappings are:
+  * - :kbd:`Ctrl+Alt+-`
+    - Shrink the screen
 
-   *1*
-      Target system display
+  * - :kbd:`Ctrl+Alt+u`
+    - Restore the screen's un-scaled dimensions
 
-   *2*
-      Monitor
+  * - :kbd:`Ctrl+Alt+n`
+    - Switch to virtual console 'n'. Standard console mappings are:
 
-   *3*
-      Serial port
+      - *1*: Target system display
+      - *2*: Monitor
+      - *3*: Serial port
+  * - :kbd:`Ctrl+Alt+g`
+    - Toggle mouse and keyboard grab.
 
-Ctrl-Alt-g
-   Toggle mouse and keyboard grab.
-
-In the virtual consoles, you can use Ctrl-Up, Ctrl-Down, Ctrl-PageUp and
-Ctrl-PageDown to move in the back log.
+In the virtual consoles, you can use :kbd:`Ctrl+Up`, :kbd:`Ctrl+Down`, :kbd:`Ctrl+PageUp` and
+:kbd:`Ctrl+PageDown` to move in the back log.
diff --git a/docs/system/linuxboot.rst b/docs/system/linuxboot.rst
index 2328b4a73d..f7573ab80a 100644
--- a/docs/system/linuxboot.rst
+++ b/docs/system/linuxboot.rst
@@ -26,5 +26,5 @@ virtual serial port and the QEMU monitor to the console with the
    |qemu_system| -kernel bzImage -drive file=rootdisk.img,format=raw \
                     -append "root=/dev/sda console=ttyS0" -nographic
 
-Use Ctrl-a c to switch between the serial console and the monitor (see
+Use :kbd:`Ctrl+a c` to switch between the serial console and the monitor (see
 :ref:`GUI_keys`).
diff --git a/docs/system/mux-chardev.rst.inc b/docs/system/mux-chardev.rst.inc
index 84ea12cbf5..c87ba31362 100644
--- a/docs/system/mux-chardev.rst.inc
+++ b/docs/system/mux-chardev.rst.inc
@@ -1,27 +1,33 @@
 During emulation, if you are using a character backend multiplexer
 (which is the default if you are using ``-nographic``) then several
 commands are available via an escape sequence. These key sequences all
-start with an escape character, which is Ctrl-a by default, but can be
+start with an escape character, which is :kbd:`Ctrl+a` by default, but can be
 changed with ``-echr``. The list below assumes you're using the default.
 
-Ctrl-a h
-   Print this help
+.. list-table:: Multiplexer Keys
+  :widths: 20 80
+  :header-rows: 1
 
-Ctrl-a x
-   Exit emulator
+  * - Key Sequence
+    - Action
 
-Ctrl-a s
-   Save disk data back to file (if -snapshot)
+  * - :kbd:`Ctrl+a h`
+    - Print this help
 
-Ctrl-a t
-   Toggle console timestamps
+  * - :kbd:`Ctrl+a x`
+    - Exit emulator
 
-Ctrl-a b
-   Send break (magic sysrq in Linux)
+  * - :kbd:`Ctrl+a s`
+    - Save disk data back to file (if -snapshot)
 
-Ctrl-a c
-   Rotate between the frontends connected to the multiplexer (usually
-   this switches between the monitor and the console)
+  * - :kbd:`Ctrl+a t`
+    - Toggle console timestamps
 
-Ctrl-a Ctrl-a
-   Send the escape character to the frontend
+  * - :kbd:`Ctrl+a b`
+    - Send break (magic sysrq in Linux)
+
+  * - :kbd:`Ctrl+a c`
+    - Rotate between the frontends connected to the multiplexer (usually this switches between the monitor and the console)
+
+  * - :kbd:`Ctrl+a Ctrl+a`
+    - Send the escape character to the frontend

From 15f5acb8102c94d7a6aa79370fad776cf42b63d6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Thu, 10 Jul 2025 11:45:30 +0100
Subject: [PATCH 2265/2760] docs/system: clean-up formatting of
 virtio-net-failover
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We didn't clean-up the rst formatting when we moved this into the
docs so lets do that now:

 - un-indent the usage/hotplug/migration paragraphs
 - properly wrap the command line fragments in code-block
 - highlight parameters in text with ``double quotes``

No changes to the actual text.

Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250710104531.3099313-8-alex.bennee@linaro.org>
---
 docs/system/virtio-net-failover.rst | 51 ++++++++++++++++-------------
 1 file changed, 28 insertions(+), 23 deletions(-)

diff --git a/docs/system/virtio-net-failover.rst b/docs/system/virtio-net-failover.rst
index 6002dc5d96..0cc465454c 100644
--- a/docs/system/virtio-net-failover.rst
+++ b/docs/system/virtio-net-failover.rst
@@ -26,43 +26,48 @@ and standby devices are not plugged into the same PCIe slot.
 Usecase
 -------
 
-  Virtio-net standby allows easy migration while using a passed-through fast
-  networking device by falling back to a virtio-net device for the duration of
-  the migration. It is like a simple version of a bond, the difference is that it
-  requires no configuration in the guest. When a guest is live-migrated to
-  another host QEMU will unplug the primary device via the PCIe based hotplug
-  handler and traffic will go through the virtio-net device.  On the target
-  system the primary device will be automatically plugged back and the
-  net_failover module registers it again as the primary device.
+Virtio-net standby allows easy migration while using a passed-through
+fast networking device by falling back to a virtio-net device for the
+duration of the migration. It is like a simple version of a bond, the
+difference is that it requires no configuration in the guest. When a
+guest is live-migrated to another host QEMU will unplug the primary
+device via the PCIe based hotplug handler and traffic will go through
+the virtio-net device. On the target system the primary device will be
+automatically plugged back and the net_failover module registers it
+again as the primary device.
 
 Usage
 -----
 
-  The primary device can be hotplugged or be part of the startup configuration
+The primary device can be hotplugged or be part of the startup configuration
 
-  -device virtio-net-pci,netdev=hostnet1,id=net1,mac=52:54:00:6f:55:cc, \
-    bus=root2,failover=on
+.. code-block:: shell
 
-  With the parameter failover=on the VIRTIO_NET_F_STANDBY feature will be enabled.
+  -device virtio-net-pci,netdev=hostnet1,id=net1,mac=52:54:00:6f:55:cc,bus=root2,failover=on
+
+With the parameter ``failover=on`` the VIRTIO_NET_F_STANDBY feature will be enabled.
+
+.. code-block:: shell
 
   -device vfio-pci,host=5e:00.2,id=hostdev0,bus=root1,failover_pair_id=net1
 
-  failover_pair_id references the id of the virtio-net standby device. This
-  is only for pairing the devices within QEMU. The guest kernel module
-  net_failover will match devices with identical MAC addresses.
+``failover_pair_id`` references the id of the virtio-net standby device.
+This is only for pairing the devices within QEMU. The guest kernel
+module net_failover will match devices with identical MAC addresses.
 
 Hotplug
 -------
 
-  Both primary and standby device can be hotplugged via the QEMU monitor.  Note
-  that if the virtio-net device is plugged first a warning will be issued that it
-  couldn't find the primary device.
+Both primary and standby device can be hotplugged via the QEMU
+monitor. Note that if the virtio-net device is plugged first a warning
+will be issued that it couldn't find the primary device.
 
 Migration
 ---------
 
-  A new migration state wait-unplug was added for this feature. If failover primary
-  devices are present in the configuration, migration will go into this state.
-  It will wait until the device unplug is completed in the guest and then move into
-  active state. On the target system the primary devices will be automatically hotplugged
-  when the feature bit was negotiated for the virtio-net standby device.
+A new migration state wait-unplug was added for this feature. If
+failover primary devices are present in the configuration, migration
+will go into this state. It will wait until the device unplug is
+completed in the guest and then move into active state. On the target
+system the primary devices will be automatically hotplugged when the
+feature bit was negotiated for the virtio-net standby device.

From 9152540f4ef3528ff003493cbe6a27b6c0f322e8 Mon Sep 17 00:00:00 2001
From: Rot127 <unisono@quyllur.org>
Date: Fri, 11 Jul 2025 10:51:39 -0500
Subject: [PATCH 2266/2760] gdbstub: add the GDB register XML files for
 sparc64.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Rot127 <unisono@quyllur.org>
Message-ID: <20250711155141.62916-2-unisono@quyllur.org>
[AJB: clean up commit msg]
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 configs/targets/sparc64-linux-user.mak |  1 +
 configs/targets/sparc64-softmmu.mak    |  1 +
 gdb-xml/sparc64-core.xml               | 99 ++++++++++++++++++++++++++
 target/sparc/cpu.c                     |  1 +
 4 files changed, 102 insertions(+)
 create mode 100644 gdb-xml/sparc64-core.xml

diff --git a/configs/targets/sparc64-linux-user.mak b/configs/targets/sparc64-linux-user.mak
index 64ea04e3e2..7c2ecb7be0 100644
--- a/configs/targets/sparc64-linux-user.mak
+++ b/configs/targets/sparc64-linux-user.mak
@@ -4,4 +4,5 @@ TARGET_ABI_DIR=sparc
 TARGET_SYSTBL_ABI=common,64
 TARGET_SYSTBL=syscall.tbl
 TARGET_BIG_ENDIAN=y
+TARGET_XML_FILES=gdb-xml/sparc64-core.xml
 TARGET_LONG_BITS=64
diff --git a/configs/targets/sparc64-softmmu.mak b/configs/targets/sparc64-softmmu.mak
index 2504e31ae3..d9d51d21e5 100644
--- a/configs/targets/sparc64-softmmu.mak
+++ b/configs/targets/sparc64-softmmu.mak
@@ -1,4 +1,5 @@
 TARGET_ARCH=sparc64
 TARGET_BASE_ARCH=sparc
 TARGET_BIG_ENDIAN=y
+TARGET_XML_FILES=gdb-xml/sparc64-core.xml
 TARGET_LONG_BITS=64
diff --git a/gdb-xml/sparc64-core.xml b/gdb-xml/sparc64-core.xml
new file mode 100644
index 0000000000..375b9bb0cc
--- /dev/null
+++ b/gdb-xml/sparc64-core.xml
@@ -0,0 +1,99 @@
+<?xml version="1.0"?>
+<!-- Copyright (C) 2013-2025 Free Software Foundation, Inc.
+
+     Copying and distribution of this file, with or without modification,
+     are permitted in any medium without royalty provided the copyright
+     notice and this notice are preserved.  -->
+
+<!DOCTYPE feature SYSTEM "gdb-target.dtd">
+<feature name="org.gnu.gdb.sparc.core">
+  <reg name="g0" bitsize="64" type="uint64" regnum="0"/>
+  <reg name="g1" bitsize="64" type="uint64" regnum="1"/>
+  <reg name="g2" bitsize="64" type="uint64" regnum="2"/>
+  <reg name="g3" bitsize="64" type="uint64" regnum="3"/>
+  <reg name="g4" bitsize="64" type="uint64" regnum="4"/>
+  <reg name="g5" bitsize="64" type="uint64" regnum="5"/>
+  <reg name="g6" bitsize="64" type="uint64" regnum="6"/>
+  <reg name="g7" bitsize="64" type="uint64" regnum="7"/>
+  <reg name="o0" bitsize="64" type="uint64" regnum="8"/>
+  <reg name="o1" bitsize="64" type="uint64" regnum="9"/>
+  <reg name="o2" bitsize="64" type="uint64" regnum="10"/>
+  <reg name="o3" bitsize="64" type="uint64" regnum="11"/>
+  <reg name="o4" bitsize="64" type="uint64" regnum="12"/>
+  <reg name="o5" bitsize="64" type="uint64" regnum="13"/>
+  <reg name="sp" bitsize="64" type="uint64" regnum="14"/>
+  <reg name="o7" bitsize="64" type="uint64" regnum="15"/>
+  <reg name="l0" bitsize="64" type="uint64" regnum="16"/>
+  <reg name="l1" bitsize="64" type="uint64" regnum="17"/>
+  <reg name="l2" bitsize="64" type="uint64" regnum="18"/>
+  <reg name="l3" bitsize="64" type="uint64" regnum="19"/>
+  <reg name="l4" bitsize="64" type="uint64" regnum="20"/>
+  <reg name="l5" bitsize="64" type="uint64" regnum="21"/>
+  <reg name="l6" bitsize="64" type="uint64" regnum="22"/>
+  <reg name="l7" bitsize="64" type="uint64" regnum="23"/>
+  <reg name="i0" bitsize="64" type="uint64" regnum="24"/>
+  <reg name="i1" bitsize="64" type="uint64" regnum="25"/>
+  <reg name="i2" bitsize="64" type="uint64" regnum="26"/>
+  <reg name="i3" bitsize="64" type="uint64" regnum="27"/>
+  <reg name="i4" bitsize="64" type="uint64" regnum="28"/>
+  <reg name="i5" bitsize="64" type="uint64" regnum="29"/>
+  <reg name="fp" bitsize="64" type="uint64" regnum="30"/>
+  <reg name="i7" bitsize="64" type="uint64" regnum="31"/>
+
+  <reg name="f0" bitsize="32" type="ieee_single" regnum="32"/>
+  <reg name="f1" bitsize="32" type="ieee_single" regnum="33"/>
+  <reg name="f2" bitsize="32" type="ieee_single" regnum="34"/>
+  <reg name="f3" bitsize="32" type="ieee_single" regnum="35"/>
+  <reg name="f4" bitsize="32" type="ieee_single" regnum="36"/>
+  <reg name="f5" bitsize="32" type="ieee_single" regnum="37"/>
+  <reg name="f6" bitsize="32" type="ieee_single" regnum="38"/>
+  <reg name="f7" bitsize="32" type="ieee_single" regnum="39"/>
+  <reg name="f8" bitsize="32" type="ieee_single" regnum="40"/>
+  <reg name="f9" bitsize="32" type="ieee_single" regnum="41"/>
+  <reg name="f10" bitsize="32" type="ieee_single" regnum="42"/>
+  <reg name="f11" bitsize="32" type="ieee_single" regnum="43"/>
+  <reg name="f12" bitsize="32" type="ieee_single" regnum="44"/>
+  <reg name="f13" bitsize="32" type="ieee_single" regnum="45"/>
+  <reg name="f14" bitsize="32" type="ieee_single" regnum="46"/>
+  <reg name="f15" bitsize="32" type="ieee_single" regnum="47"/>
+  <reg name="f16" bitsize="32" type="ieee_single" regnum="48"/>
+  <reg name="f17" bitsize="32" type="ieee_single" regnum="49"/>
+  <reg name="f18" bitsize="32" type="ieee_single" regnum="50"/>
+  <reg name="f19" bitsize="32" type="ieee_single" regnum="51"/>
+  <reg name="f20" bitsize="32" type="ieee_single" regnum="52"/>
+  <reg name="f21" bitsize="32" type="ieee_single" regnum="53"/>
+  <reg name="f22" bitsize="32" type="ieee_single" regnum="54"/>
+  <reg name="f23" bitsize="32" type="ieee_single" regnum="55"/>
+  <reg name="f24" bitsize="32" type="ieee_single" regnum="56"/>
+  <reg name="f25" bitsize="32" type="ieee_single" regnum="57"/>
+  <reg name="f26" bitsize="32" type="ieee_single" regnum="58"/>
+  <reg name="f27" bitsize="32" type="ieee_single" regnum="59"/>
+  <reg name="f28" bitsize="32" type="ieee_single" regnum="60"/>
+  <reg name="f29" bitsize="32" type="ieee_single" regnum="61"/>
+  <reg name="f30" bitsize="32" type="ieee_single" regnum="62"/>
+  <reg name="f31" bitsize="32" type="ieee_single" regnum="63"/>
+
+  <reg name="f32" bitsize="64" type="ieee_double" regnum="64"/>
+  <reg name="f34" bitsize="64" type="ieee_double" regnum="65"/>
+  <reg name="f36" bitsize="64" type="ieee_double" regnum="66"/>
+  <reg name="f38" bitsize="64" type="ieee_double" regnum="67"/>
+  <reg name="f40" bitsize="64" type="ieee_double" regnum="68"/>
+  <reg name="f42" bitsize="64" type="ieee_double" regnum="69"/>
+  <reg name="f44" bitsize="64" type="ieee_double" regnum="70"/>
+  <reg name="f46" bitsize="64" type="ieee_double" regnum="71"/>
+  <reg name="f48" bitsize="64" type="ieee_double" regnum="72"/>
+  <reg name="f50" bitsize="64" type="ieee_double" regnum="73"/>
+  <reg name="f52" bitsize="64" type="ieee_double" regnum="74"/>
+  <reg name="f54" bitsize="64" type="ieee_double" regnum="75"/>
+  <reg name="f56" bitsize="64" type="ieee_double" regnum="76"/>
+  <reg name="f58" bitsize="64" type="ieee_double" regnum="77"/>
+  <reg name="f60" bitsize="64" type="ieee_double" regnum="78"/>
+  <reg name="f62" bitsize="64" type="ieee_double" regnum="79"/>
+
+  <reg name="pc" bitsize="64" type="code_ptr" regnum="80"/>
+  <reg name="npc" bitsize="64" type="code_ptr" regnum="81"/>
+  <reg name="state" bitsize="64" type="uint64" regnum="82"/>
+  <reg name="fsr" bitsize="64" type="uint64" regnum="83"/>
+  <reg name="fprs" bitsize="64" type="uint64" regnum="84"/>
+  <reg name="y" bitsize="64" type="uint64" regnum="85"/>
+</feature>
diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
index ed7701b02f..245caf2de0 100644
--- a/target/sparc/cpu.c
+++ b/target/sparc/cpu.c
@@ -1090,6 +1090,7 @@ static void sparc_cpu_class_init(ObjectClass *oc, const void *data)
     cc->disas_set_info = cpu_sparc_disas_set_info;
 
 #if defined(TARGET_SPARC64) && !defined(TARGET_ABI32)
+    cc->gdb_core_xml_file = "sparc64-core.xml";
     cc->gdb_num_core_regs = 86;
 #else
     cc->gdb_num_core_regs = 72;

From aef22331b5a4670f42638a5f63a26e93bf779aae Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Date: Tue, 3 Jun 2025 18:18:28 +0900
Subject: [PATCH 2267/2760] ui/vnc: Do not copy z_stream
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

vnc_worker_thread_loop() copies z_stream stored in its local VncState to
the persistent VncState, and the copied one is freed with deflateEnd()
later. However, deflateEnd() refuses to operate with a copied z_stream
and returns Z_STREAM_ERROR, leaking the allocated memory.

Avoid copying the zlib state to fix the memory leak.

Fixes: bd023f953e5e ("vnc: threaded VNC server")
Signed-off-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20250603-zlib-v3-1-20b857bd8d05@rsg.ci.i.u-tokyo.ac.jp>
---
 ui/vnc-enc-zlib.c | 30 +++++++++++++++---------------
 ui/vnc.c          | 13 ++++++++++---
 ui/vnc.h          |  2 +-
 3 files changed, 26 insertions(+), 19 deletions(-)

diff --git a/ui/vnc-enc-zlib.c b/ui/vnc-enc-zlib.c
index 900ae5b30f..52e9193eab 100644
--- a/ui/vnc-enc-zlib.c
+++ b/ui/vnc-enc-zlib.c
@@ -48,21 +48,21 @@ void vnc_zlib_zfree(void *x, void *addr)
 
 static void vnc_zlib_start(VncState *vs)
 {
-    buffer_reset(&vs->zlib.zlib);
+    buffer_reset(&vs->zlib->zlib);
 
     // make the output buffer be the zlib buffer, so we can compress it later
-    vs->zlib.tmp = vs->output;
-    vs->output = vs->zlib.zlib;
+    vs->zlib->tmp = vs->output;
+    vs->output = vs->zlib->zlib;
 }
 
 static int vnc_zlib_stop(VncState *vs)
 {
-    z_streamp zstream = &vs->zlib.stream;
+    z_streamp zstream = &vs->zlib->stream;
     int previous_out;
 
     // switch back to normal output/zlib buffers
-    vs->zlib.zlib = vs->output;
-    vs->output = vs->zlib.tmp;
+    vs->zlib->zlib = vs->output;
+    vs->output = vs->zlib->tmp;
 
     // compress the zlib buffer
 
@@ -85,24 +85,24 @@ static int vnc_zlib_stop(VncState *vs)
             return -1;
         }
 
-        vs->zlib.level = vs->tight->compression;
+        vs->zlib->level = vs->tight->compression;
         zstream->opaque = vs;
     }
 
-    if (vs->tight->compression != vs->zlib.level) {
+    if (vs->tight->compression != vs->zlib->level) {
         if (deflateParams(zstream, vs->tight->compression,
                           Z_DEFAULT_STRATEGY) != Z_OK) {
             return -1;
         }
-        vs->zlib.level = vs->tight->compression;
+        vs->zlib->level = vs->tight->compression;
     }
 
     // reserve memory in output buffer
-    buffer_reserve(&vs->output, vs->zlib.zlib.offset + 64);
+    buffer_reserve(&vs->output, vs->zlib->zlib.offset + 64);
 
     // set pointers
-    zstream->next_in = vs->zlib.zlib.buffer;
-    zstream->avail_in = vs->zlib.zlib.offset;
+    zstream->next_in = vs->zlib->zlib.buffer;
+    zstream->avail_in = vs->zlib->zlib.offset;
     zstream->next_out = vs->output.buffer + vs->output.offset;
     zstream->avail_out = vs->output.capacity - vs->output.offset;
     previous_out = zstream->avail_out;
@@ -147,8 +147,8 @@ int vnc_zlib_send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
 
 void vnc_zlib_clear(VncState *vs)
 {
-    if (vs->zlib.stream.opaque) {
-        deflateEnd(&vs->zlib.stream);
+    if (vs->zlib->stream.opaque) {
+        deflateEnd(&vs->zlib->stream);
     }
-    buffer_free(&vs->zlib.zlib);
+    buffer_free(&vs->zlib->zlib);
 }
diff --git a/ui/vnc.c b/ui/vnc.c
index e9c30aad62..ab74154e4c 100644
--- a/ui/vnc.c
+++ b/ui/vnc.c
@@ -56,6 +56,11 @@
 #include "io/dns-resolver.h"
 #include "monitor/monitor.h"
 
+typedef struct VncConnection {
+    VncState vs;
+    VncZlib zlib;
+} VncConnection;
+
 #define VNC_REFRESH_INTERVAL_BASE GUI_REFRESH_INTERVAL_DEFAULT
 #define VNC_REFRESH_INTERVAL_INC  50
 #define VNC_REFRESH_INTERVAL_MAX  GUI_REFRESH_INTERVAL_IDLE
@@ -1362,7 +1367,7 @@ void vnc_disconnect_finish(VncState *vs)
     vs->magic = 0;
     g_free(vs->zrle);
     g_free(vs->tight);
-    g_free(vs);
+    g_free(container_of(vs, VncConnection, vs));
 }
 
 size_t vnc_client_io_error(VncState *vs, ssize_t ret, Error *err)
@@ -3241,11 +3246,13 @@ static void vnc_refresh(DisplayChangeListener *dcl)
 static void vnc_connect(VncDisplay *vd, QIOChannelSocket *sioc,
                         bool skipauth, bool websocket)
 {
-    VncState *vs = g_new0(VncState, 1);
+    VncConnection *vc = g_new0(VncConnection, 1);
+    VncState *vs = &vc->vs;
     bool first_client = QTAILQ_EMPTY(&vd->clients);
     int i;
 
     trace_vnc_client_connect(vs, sioc);
+    vs->zlib = &vc->zlib;
     vs->zrle = g_new0(VncZrle, 1);
     vs->tight = g_new0(VncTight, 1);
     vs->magic = VNC_MAGIC;
@@ -3268,7 +3275,7 @@ static void vnc_connect(VncDisplay *vd, QIOChannelSocket *sioc,
 #ifdef CONFIG_PNG
     buffer_init(&vs->tight->png,      "vnc-tight-png/%p", sioc);
 #endif
-    buffer_init(&vs->zlib.zlib,      "vnc-zlib/%p", sioc);
+    buffer_init(&vc->zlib.zlib,      "vnc-zlib/%p", sioc);
     buffer_init(&vs->zrle->zrle,      "vnc-zrle/%p", sioc);
     buffer_init(&vs->zrle->fb,        "vnc-zrle-fb/%p", sioc);
     buffer_init(&vs->zrle->zlib,      "vnc-zrle-zlib/%p", sioc);
diff --git a/ui/vnc.h b/ui/vnc.h
index b3e07269bb..8df0cbab25 100644
--- a/ui/vnc.h
+++ b/ui/vnc.h
@@ -342,7 +342,7 @@ struct VncState
      *  update vnc_async_encoding_start()
      */
     VncTight *tight;
-    VncZlib zlib;
+    VncZlib *zlib;
     VncHextile hextile;
     VncZrle *zrle;
     VncZywrle zywrle;

From 37ff925d5d4a70a951ade42094896246c989742f Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Date: Tue, 3 Jun 2025 18:18:29 +0900
Subject: [PATCH 2268/2760] ui/vnc: Introduce the VncWorker type
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The worker thread copies data in VncState to avoid race, but some
data are too big to copy. Such data are held with pointers to avoid
the overhead to copy, but it requires tedious memory management and
makes them vulnerable to race.

Introduce the VncWorker type to contain all data shared without copying.
It allows allocating and freeing all shared data at once and shows that
the race with the worker thread needs to be taken care of when
accessing them.

Signed-off-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20250603-zlib-v3-2-20b857bd8d05@rsg.ci.i.u-tokyo.ac.jp>
---
 ui/vnc-enc-tight.c    | 456 ++++++++++++++++++++++--------------------
 ui/vnc-enc-zlib.c     |  47 ++---
 ui/vnc-enc-zrle.c     | 122 +++++------
 ui/vnc-enc-zrle.c.inc |  20 +-
 ui/vnc-jobs.c         |  13 +-
 ui/vnc.c              |  86 ++++----
 ui/vnc.h              |  45 +++--
 7 files changed, 403 insertions(+), 386 deletions(-)

diff --git a/ui/vnc-enc-tight.c b/ui/vnc-enc-tight.c
index 25c7b2c788..9dfe6ae5a2 100644
--- a/ui/vnc-enc-tight.c
+++ b/ui/vnc-enc-tight.c
@@ -72,8 +72,8 @@ static const struct {
 };
 
 
-static int tight_send_framebuffer_update(VncState *vs, int x, int y,
-                                         int w, int h);
+static int tight_send_framebuffer_update(VncState *vs, VncWorker *worker,
+                                         int x, int y, int w, int h);
 
 #ifdef CONFIG_VNC_JPEG
 static const struct {
@@ -111,12 +111,12 @@ static const struct {
     { 9, PNG_ALL_FILTERS },
 };
 
-static int send_png_rect(VncState *vs, int x, int y, int w, int h,
-                         VncPalette *palette);
+static int send_png_rect(VncState *vs, VncWorker *worker,
+                         int x, int y, int w, int h, VncPalette *palette);
 
-static bool tight_can_send_png_rect(VncState *vs, int w, int h)
+static bool tight_can_send_png_rect(VncState *vs, VncTight *tight, int w, int h)
 {
-    if (vs->tight->type != VNC_ENCODING_TIGHT_PNG) {
+    if (tight->type != VNC_ENCODING_TIGHT_PNG) {
         return false;
     }
 
@@ -135,7 +135,7 @@ static bool tight_can_send_png_rect(VncState *vs, int w, int h)
  */
 
 static unsigned int
-tight_detect_smooth_image24(VncState *vs, int w, int h)
+tight_detect_smooth_image24(VncState *vs, VncTight *tight, int w, int h)
 {
     int off;
     int x, y, d, dx;
@@ -144,7 +144,7 @@ tight_detect_smooth_image24(VncState *vs, int w, int h)
     int pixels = 0;
     int pix, left[3];
     unsigned int errors;
-    unsigned char *buf = vs->tight->tight.buffer;
+    unsigned char *buf = tight->tight.buffer;
 
     /*
      * If client is big-endian, color samples begin from the second
@@ -205,7 +205,8 @@ tight_detect_smooth_image24(VncState *vs, int w, int h)
 #define DEFINE_DETECT_FUNCTION(bpp)                                     \
                                                                         \
     static unsigned int                                                 \
-    tight_detect_smooth_image##bpp(VncState *vs, int w, int h) {        \
+    tight_detect_smooth_image##bpp(VncState *vs, VncTight *tight,       \
+                                   int w, int h) {                      \
         bool endian;                                                    \
         uint##bpp##_t pix;                                              \
         int max[3], shift[3];                                           \
@@ -215,7 +216,7 @@ tight_detect_smooth_image24(VncState *vs, int w, int h)
         int pixels = 0;                                                 \
         int sample, sum, left[3];                                       \
         unsigned int errors;                                            \
-        unsigned char *buf = vs->tight->tight.buffer;                    \
+        unsigned char *buf = tight->tight.buffer;                       \
                                                                         \
         endian = 0; /* FIXME */                                         \
                                                                         \
@@ -293,11 +294,11 @@ DEFINE_DETECT_FUNCTION(16)
 DEFINE_DETECT_FUNCTION(32)
 
 static int
-tight_detect_smooth_image(VncState *vs, int w, int h)
+tight_detect_smooth_image(VncState *vs, VncTight *tight, int w, int h)
 {
     unsigned int errors;
-    int compression = vs->tight->compression;
-    int quality = vs->tight->quality;
+    int compression = tight->compression;
+    int quality = tight->quality;
 
     if (!vs->vd->lossy) {
         return 0;
@@ -309,7 +310,7 @@ tight_detect_smooth_image(VncState *vs, int w, int h)
         return 0;
     }
 
-    if (vs->tight->quality != (uint8_t)-1) {
+    if (tight->quality != (uint8_t)-1) {
         if (w * h < VNC_TIGHT_JPEG_MIN_RECT_SIZE) {
             return 0;
         }
@@ -320,17 +321,17 @@ tight_detect_smooth_image(VncState *vs, int w, int h)
     }
 
     if (vs->client_pf.bytes_per_pixel == 4) {
-        if (vs->tight->pixel24) {
-            errors = tight_detect_smooth_image24(vs, w, h);
-            if (vs->tight->quality != (uint8_t)-1) {
+        if (tight->pixel24) {
+            errors = tight_detect_smooth_image24(vs, tight, w, h);
+            if (tight->quality != (uint8_t)-1) {
                 return (errors < tight_conf[quality].jpeg_threshold24);
             }
             return (errors < tight_conf[compression].gradient_threshold24);
         } else {
-            errors = tight_detect_smooth_image32(vs, w, h);
+            errors = tight_detect_smooth_image32(vs, tight, w, h);
         }
     } else {
-        errors = tight_detect_smooth_image16(vs, w, h);
+        errors = tight_detect_smooth_image16(vs, tight, w, h);
     }
     if (quality != (uint8_t)-1) {
         return (errors < tight_conf[quality].jpeg_threshold);
@@ -344,15 +345,15 @@ tight_detect_smooth_image(VncState *vs, int w, int h)
 #define DEFINE_FILL_PALETTE_FUNCTION(bpp)                               \
                                                                         \
     static int                                                          \
-    tight_fill_palette##bpp(VncState *vs, int x, int y,                 \
-                            int max, size_t count,                      \
+    tight_fill_palette##bpp(VncState *vs, VncTight *tight,              \
+                            int x, int y, int max, size_t count,        \
                             uint32_t *bg, uint32_t *fg,                 \
                             VncPalette *palette) {                      \
         uint##bpp##_t *data;                                            \
         uint##bpp##_t c0, c1, ci;                                       \
         int i, n0, n1;                                                  \
                                                                         \
-        data = (uint##bpp##_t *)vs->tight->tight.buffer;                \
+        data = (uint##bpp##_t *)tight->tight.buffer;                    \
                                                                         \
         c0 = data[0];                                                   \
         i = 1;                                                          \
@@ -417,15 +418,15 @@ DEFINE_FILL_PALETTE_FUNCTION(8)
 DEFINE_FILL_PALETTE_FUNCTION(16)
 DEFINE_FILL_PALETTE_FUNCTION(32)
 
-static int tight_fill_palette(VncState *vs, int x, int y,
+static int tight_fill_palette(VncState *vs, VncTight *tight, int x, int y,
                               size_t count, uint32_t *bg, uint32_t *fg,
                               VncPalette *palette)
 {
     int max;
 
-    max = count / tight_conf[vs->tight->compression].idx_max_colors_divisor;
+    max = count / tight_conf[tight->compression].idx_max_colors_divisor;
     if (max < 2 &&
-        count >= tight_conf[vs->tight->compression].mono_min_rect_size) {
+        count >= tight_conf[tight->compression].mono_min_rect_size) {
         max = 2;
     }
     if (max >= 256) {
@@ -434,12 +435,15 @@ static int tight_fill_palette(VncState *vs, int x, int y,
 
     switch (vs->client_pf.bytes_per_pixel) {
     case 4:
-        return tight_fill_palette32(vs, x, y, max, count, bg, fg, palette);
+        return tight_fill_palette32(vs, tight, x, y, max, count, bg, fg,
+                                    palette);
     case 2:
-        return tight_fill_palette16(vs, x, y, max, count, bg, fg, palette);
+        return tight_fill_palette16(vs, tight, x, y, max, count, bg, fg,
+                                    palette);
     default:
         max = 2;
-        return tight_fill_palette8(vs, x, y, max, count, bg, fg, palette);
+        return tight_fill_palette8(vs, tight, x, y, max, count, bg, fg,
+                                   palette);
     }
     return 0;
 }
@@ -547,7 +551,8 @@ DEFINE_MONO_ENCODE_FUNCTION(32)
  */
 
 static void
-tight_filter_gradient24(VncState *vs, uint8_t *buf, int w, int h)
+tight_filter_gradient24(VncState *vs, VncTight *tight, uint8_t *buf,
+                        int w, int h)
 {
     uint32_t *buf32;
     uint32_t pix32;
@@ -558,7 +563,7 @@ tight_filter_gradient24(VncState *vs, uint8_t *buf, int w, int h)
     int x, y, c;
 
     buf32 = (uint32_t *)buf;
-    memset(vs->tight->gradient.buffer, 0, w * 3 * sizeof(int));
+    memset(tight->gradient.buffer, 0, w * 3 * sizeof(int));
 
     if (1 /* FIXME */) {
         shift[0] = vs->client_pf.rshift;
@@ -575,7 +580,7 @@ tight_filter_gradient24(VncState *vs, uint8_t *buf, int w, int h)
             upper[c] = 0;
             here[c] = 0;
         }
-        prev = (int *)vs->tight->gradient.buffer;
+        prev = (int *)tight->gradient.buffer;
         for (x = 0; x < w; x++) {
             pix32 = *buf32++;
             for (c = 0; c < 3; c++) {
@@ -605,8 +610,8 @@ tight_filter_gradient24(VncState *vs, uint8_t *buf, int w, int h)
 #define DEFINE_GRADIENT_FILTER_FUNCTION(bpp)                            \
                                                                         \
     static void                                                         \
-    tight_filter_gradient##bpp(VncState *vs, uint##bpp##_t *buf,        \
-                               int w, int h) {                          \
+    tight_filter_gradient##bpp(VncState *vs, VncTight *tight,           \
+                               uint##bpp##_t *buf, int w, int h) {      \
         uint##bpp##_t pix, diff;                                        \
         bool endian;                                                    \
         int *prev;                                                      \
@@ -615,7 +620,7 @@ tight_filter_gradient24(VncState *vs, uint8_t *buf, int w, int h)
         int prediction;                                                 \
         int x, y, c;                                                    \
                                                                         \
-        memset(vs->tight->gradient.buffer, 0, w * 3 * sizeof(int));     \
+        memset(tight->gradient.buffer, 0, w * 3 * sizeof(int));         \
                                                                         \
         endian = 0; /* FIXME */                                         \
                                                                         \
@@ -631,7 +636,7 @@ tight_filter_gradient24(VncState *vs, uint8_t *buf, int w, int h)
                 upper[c] = 0;                                           \
                 here[c] = 0;                                            \
             }                                                           \
-            prev = (int *)vs->tight->gradient.buffer;                    \
+            prev = (int *)tight->gradient.buffer;                       \
             for (x = 0; x < w; x++) {                                   \
                 pix = *buf;                                             \
                 if (endian) {                                           \
@@ -782,10 +787,10 @@ static void extend_solid_area(VncState *vs, int x, int y, int w, int h,
     *w_ptr += cx - (*x_ptr + *w_ptr);
 }
 
-static int tight_init_stream(VncState *vs, int stream_id,
+static int tight_init_stream(VncState *vs, VncTight *tight, int stream_id,
                              int level, int strategy)
 {
-    z_streamp zstream = &vs->tight->stream[stream_id];
+    z_streamp zstream = &tight->stream[stream_id];
 
     if (zstream->opaque == NULL) {
         int err;
@@ -803,15 +808,15 @@ static int tight_init_stream(VncState *vs, int stream_id,
             return -1;
         }
 
-        vs->tight->levels[stream_id] = level;
+        tight->levels[stream_id] = level;
         zstream->opaque = vs;
     }
 
-    if (vs->tight->levels[stream_id] != level) {
+    if (tight->levels[stream_id] != level) {
         if (deflateParams(zstream, level, strategy) != Z_OK) {
             return -1;
         }
-        vs->tight->levels[stream_id] = level;
+        tight->levels[stream_id] = level;
     }
     return 0;
 }
@@ -836,29 +841,29 @@ static void tight_send_compact_size(VncState *vs, size_t len)
     }
 }
 
-static int tight_compress_data(VncState *vs, int stream_id, size_t bytes,
-                               int level, int strategy)
+static int tight_compress_data(VncState *vs, VncTight *tight, int stream_id,
+                               size_t bytes, int level, int strategy)
 {
-    z_streamp zstream = &vs->tight->stream[stream_id];
+    z_streamp zstream = &tight->stream[stream_id];
     int previous_out;
 
     if (bytes < VNC_TIGHT_MIN_TO_COMPRESS) {
-        vnc_write(vs, vs->tight->tight.buffer, vs->tight->tight.offset);
+        vnc_write(vs, tight->tight.buffer, tight->tight.offset);
         return bytes;
     }
 
-    if (tight_init_stream(vs, stream_id, level, strategy)) {
+    if (tight_init_stream(vs, tight, stream_id, level, strategy)) {
         return -1;
     }
 
     /* reserve memory in output buffer */
-    buffer_reserve(&vs->tight->zlib, bytes + 64);
+    buffer_reserve(&tight->zlib, bytes + 64);
 
     /* set pointers */
-    zstream->next_in = vs->tight->tight.buffer;
-    zstream->avail_in = vs->tight->tight.offset;
-    zstream->next_out = vs->tight->zlib.buffer + vs->tight->zlib.offset;
-    zstream->avail_out = vs->tight->zlib.capacity - vs->tight->zlib.offset;
+    zstream->next_in = tight->tight.buffer;
+    zstream->avail_in = tight->tight.offset;
+    zstream->next_out = tight->zlib.buffer + tight->zlib.offset;
+    zstream->avail_out = tight->zlib.capacity - tight->zlib.offset;
     previous_out = zstream->avail_out;
     zstream->data_type = Z_BINARY;
 
@@ -868,14 +873,14 @@ static int tight_compress_data(VncState *vs, int stream_id, size_t bytes,
         return -1;
     }
 
-    vs->tight->zlib.offset = vs->tight->zlib.capacity - zstream->avail_out;
+    tight->zlib.offset = tight->zlib.capacity - zstream->avail_out;
     /* ...how much data has actually been produced by deflate() */
     bytes = previous_out - zstream->avail_out;
 
     tight_send_compact_size(vs, bytes);
-    vnc_write(vs, vs->tight->zlib.buffer, bytes);
+    vnc_write(vs, tight->zlib.buffer, bytes);
 
-    buffer_reset(&vs->tight->zlib);
+    buffer_reset(&tight->zlib);
 
     return bytes;
 }
@@ -914,67 +919,69 @@ static void tight_pack24(VncState *vs, uint8_t *buf, size_t count, size_t *ret)
     }
 }
 
-static int send_full_color_rect(VncState *vs, int x, int y, int w, int h)
+static int send_full_color_rect(VncState *vs, VncWorker *worker,
+                                int x, int y, int w, int h)
 {
+    VncTight *tight = &worker->tight;
+    int level = tight_conf[tight->compression].raw_zlib_level;
     int stream = 0;
     ssize_t bytes;
 
 #ifdef CONFIG_PNG
-    if (tight_can_send_png_rect(vs, w, h)) {
-        return send_png_rect(vs, x, y, w, h, NULL);
+    if (tight_can_send_png_rect(vs, tight, w, h)) {
+        return send_png_rect(vs, worker, x, y, w, h, NULL);
     }
 #endif
 
     vnc_write_u8(vs, stream << 4); /* no flushing, no filter */
 
-    if (vs->tight->pixel24) {
-        tight_pack24(vs, vs->tight->tight.buffer, w * h,
-                     &vs->tight->tight.offset);
+    if (tight->pixel24) {
+        tight_pack24(vs, tight->tight.buffer, w * h, &tight->tight.offset);
         bytes = 3;
     } else {
         bytes = vs->client_pf.bytes_per_pixel;
     }
 
-    bytes = tight_compress_data(vs, stream, w * h * bytes,
-                            tight_conf[vs->tight->compression].raw_zlib_level,
+    bytes = tight_compress_data(vs, tight, stream, w * h * bytes, level,
                             Z_DEFAULT_STRATEGY);
 
     return (bytes >= 0);
 }
 
-static int send_solid_rect(VncState *vs)
+static int send_solid_rect(VncState *vs, VncWorker *worker)
 {
+    VncTight *tight = &worker->tight;
     size_t bytes;
 
     vnc_write_u8(vs, VNC_TIGHT_FILL << 4); /* no flushing, no filter */
 
-    if (vs->tight->pixel24) {
-        tight_pack24(vs, vs->tight->tight.buffer, 1, &vs->tight->tight.offset);
+    if (tight->pixel24) {
+        tight_pack24(vs, tight->tight.buffer, 1, &tight->tight.offset);
         bytes = 3;
     } else {
         bytes = vs->client_pf.bytes_per_pixel;
     }
 
-    vnc_write(vs, vs->tight->tight.buffer, bytes);
+    vnc_write(vs, tight->tight.buffer, bytes);
     return 1;
 }
 
-static int send_mono_rect(VncState *vs, int x, int y,
+static int send_mono_rect(VncState *vs, VncWorker *worker, int x, int y,
                           int w, int h, uint32_t bg, uint32_t fg)
 {
     ssize_t bytes;
     int stream = 1;
-    int level = tight_conf[vs->tight->compression].mono_zlib_level;
+    int level = tight_conf[worker->tight.compression].mono_zlib_level;
 
 #ifdef CONFIG_PNG
-    if (tight_can_send_png_rect(vs, w, h)) {
+    if (tight_can_send_png_rect(vs, &worker->tight, w, h)) {
         int ret;
         int bpp = vs->client_pf.bytes_per_pixel * 8;
         VncPalette *palette = palette_new(2, bpp);
 
         palette_put(palette, bg);
         palette_put(palette, fg);
-        ret = send_png_rect(vs, x, y, w, h, palette);
+        ret = send_png_rect(vs, worker, x, y, w, h, palette);
         palette_destroy(palette);
         return ret;
     }
@@ -992,12 +999,12 @@ static int send_mono_rect(VncState *vs, int x, int y,
         uint32_t buf[2] = {bg, fg};
         size_t ret = sizeof (buf);
 
-        if (vs->tight->pixel24) {
+        if (worker->tight.pixel24) {
             tight_pack24(vs, (unsigned char*)buf, 2, &ret);
         }
         vnc_write(vs, buf, ret);
 
-        tight_encode_mono_rect32(vs->tight->tight.buffer, w, h, bg, fg);
+        tight_encode_mono_rect32(worker->tight.tight.buffer, w, h, bg, fg);
         break;
     }
     case 2:
@@ -1006,7 +1013,7 @@ static int send_mono_rect(VncState *vs, int x, int y,
         uint16_t fg16 = fg;
         vnc_write(vs, &bg16, 2);
         vnc_write(vs, &fg16, 2);
-        tight_encode_mono_rect16(vs->tight->tight.buffer, w, h, bg, fg);
+        tight_encode_mono_rect16(worker->tight.tight.buffer, w, h, bg, fg);
         break;
     }
     default:
@@ -1015,18 +1022,20 @@ static int send_mono_rect(VncState *vs, int x, int y,
         uint8_t fg8 = fg;
         vnc_write_u8(vs, bg8);
         vnc_write_u8(vs, fg8);
-        tight_encode_mono_rect8(vs->tight->tight.buffer, w, h, bg, fg);
+        tight_encode_mono_rect8(worker->tight.tight.buffer, w, h, bg, fg);
         break;
     }
     }
-    vs->tight->tight.offset = bytes;
+    worker->tight.tight.offset = bytes;
 
-    bytes = tight_compress_data(vs, stream, bytes, level, Z_DEFAULT_STRATEGY);
+    bytes = tight_compress_data(vs, &worker->tight, stream, bytes, level,
+                                Z_DEFAULT_STRATEGY);
     return (bytes >= 0);
 }
 
 struct palette_cb_priv {
     VncState *vs;
+    VncTight *tight;
     uint8_t *header;
 #ifdef CONFIG_PNG
     png_colorp png_palette;
@@ -1046,53 +1055,58 @@ static void write_palette(int idx, uint32_t color, void *opaque)
     }
 }
 
-static bool send_gradient_rect(VncState *vs, int x, int y, int w, int h)
+static bool send_gradient_rect(VncState *vs, VncWorker *worker,
+                               int x, int y, int w, int h)
 {
+    VncTight *tight = &worker->tight;
     int stream = 3;
-    int level = tight_conf[vs->tight->compression].gradient_zlib_level;
+    int level = tight_conf[tight->compression].gradient_zlib_level;
     ssize_t bytes;
 
     if (vs->client_pf.bytes_per_pixel == 1) {
-        return send_full_color_rect(vs, x, y, w, h);
+        return send_full_color_rect(vs, worker, x, y, w, h);
     }
 
     vnc_write_u8(vs, (stream | VNC_TIGHT_EXPLICIT_FILTER) << 4);
     vnc_write_u8(vs, VNC_TIGHT_FILTER_GRADIENT);
 
-    buffer_reserve(&vs->tight->gradient, w * 3 * sizeof(int));
+    buffer_reserve(&tight->gradient, w * 3 * sizeof(int));
 
-    if (vs->tight->pixel24) {
-        tight_filter_gradient24(vs, vs->tight->tight.buffer, w, h);
+    if (tight->pixel24) {
+        tight_filter_gradient24(vs, tight, tight->tight.buffer, w, h);
         bytes = 3;
     } else if (vs->client_pf.bytes_per_pixel == 4) {
-        tight_filter_gradient32(vs, (uint32_t *)vs->tight->tight.buffer, w, h);
+        tight_filter_gradient32(vs, tight, (uint32_t *)tight->tight.buffer,
+                                w, h);
         bytes = 4;
     } else {
-        tight_filter_gradient16(vs, (uint16_t *)vs->tight->tight.buffer, w, h);
+        tight_filter_gradient16(vs, tight, (uint16_t *)tight->tight.buffer,
+                                w, h);
         bytes = 2;
     }
 
-    buffer_reset(&vs->tight->gradient);
+    buffer_reset(&tight->gradient);
 
     bytes = w * h * bytes;
-    vs->tight->tight.offset = bytes;
+    tight->tight.offset = bytes;
 
-    bytes = tight_compress_data(vs, stream, bytes,
+    bytes = tight_compress_data(vs, tight, stream, bytes,
                                 level, Z_FILTERED);
     return (bytes >= 0);
 }
 
-static int send_palette_rect(VncState *vs, int x, int y,
+static int send_palette_rect(VncState *vs, VncWorker *worker, int x, int y,
                              int w, int h, VncPalette *palette)
 {
+    VncTight *tight = &worker->tight;
     int stream = 2;
-    int level = tight_conf[vs->tight->compression].idx_zlib_level;
+    int level = tight_conf[tight->compression].idx_zlib_level;
     int colors;
     ssize_t bytes;
 
 #ifdef CONFIG_PNG
-    if (tight_can_send_png_rect(vs, w, h)) {
-        return send_png_rect(vs, x, y, w, h, palette);
+    if (tight_can_send_png_rect(vs, tight, w, h)) {
+        return send_png_rect(vs, worker, x, y, w, h, palette);
     }
 #endif
 
@@ -1107,38 +1121,38 @@ static int send_palette_rect(VncState *vs, int x, int y,
     {
         size_t old_offset, offset, palette_sz = palette_size(palette);
         g_autofree uint32_t *header = g_new(uint32_t, palette_sz);
-        struct palette_cb_priv priv = { vs, (uint8_t *)header };
+        struct palette_cb_priv priv = { vs, tight, (uint8_t *)header };
 
         old_offset = vs->output.offset;
         palette_iter(palette, write_palette, &priv);
         vnc_write(vs, header, palette_sz * sizeof(uint32_t));
 
-        if (vs->tight->pixel24) {
+        if (tight->pixel24) {
             tight_pack24(vs, vs->output.buffer + old_offset, colors, &offset);
             vs->output.offset = old_offset + offset;
         }
 
-        tight_encode_indexed_rect32(vs->tight->tight.buffer, w * h, palette);
+        tight_encode_indexed_rect32(tight->tight.buffer, w * h, palette);
         break;
     }
     case 2:
     {
         size_t palette_sz = palette_size(palette);
         g_autofree uint16_t *header = g_new(uint16_t, palette_sz);
-        struct palette_cb_priv priv = { vs, (uint8_t *)header };
+        struct palette_cb_priv priv = { vs, tight, (uint8_t *)header };
 
         palette_iter(palette, write_palette, &priv);
         vnc_write(vs, header, palette_sz * sizeof(uint16_t));
-        tight_encode_indexed_rect16(vs->tight->tight.buffer, w * h, palette);
+        tight_encode_indexed_rect16(tight->tight.buffer, w * h, palette);
         break;
     }
     default:
         return -1; /* No palette for 8bits colors */
     }
     bytes = w * h;
-    vs->tight->tight.offset = bytes;
+    tight->tight.offset = bytes;
 
-    bytes = tight_compress_data(vs, stream, bytes,
+    bytes = tight_compress_data(vs, tight, stream, bytes,
                                 level, Z_DEFAULT_STRATEGY);
     return (bytes >= 0);
 }
@@ -1154,8 +1168,8 @@ static int send_palette_rect(VncState *vs, int x, int y,
 /* This is called once per encoding */
 static void jpeg_init_destination(j_compress_ptr cinfo)
 {
-    VncState *vs = cinfo->client_data;
-    Buffer *buffer = &vs->tight->jpeg;
+    VncTight *tight = cinfo->client_data;
+    Buffer *buffer = &tight->jpeg;
 
     cinfo->dest->next_output_byte = (JOCTET *)buffer->buffer + buffer->offset;
     cinfo->dest->free_in_buffer = (size_t)(buffer->capacity - buffer->offset);
@@ -1164,8 +1178,8 @@ static void jpeg_init_destination(j_compress_ptr cinfo)
 /* This is called when we ran out of buffer (shouldn't happen!) */
 static boolean jpeg_empty_output_buffer(j_compress_ptr cinfo)
 {
-    VncState *vs = cinfo->client_data;
-    Buffer *buffer = &vs->tight->jpeg;
+    VncTight *tight = cinfo->client_data;
+    Buffer *buffer = &tight->jpeg;
 
     buffer->offset = buffer->capacity;
     buffer_reserve(buffer, 2048);
@@ -1176,13 +1190,14 @@ static boolean jpeg_empty_output_buffer(j_compress_ptr cinfo)
 /* This is called when we are done processing data */
 static void jpeg_term_destination(j_compress_ptr cinfo)
 {
-    VncState *vs = cinfo->client_data;
-    Buffer *buffer = &vs->tight->jpeg;
+    VncTight *tight = cinfo->client_data;
+    Buffer *buffer = &tight->jpeg;
 
     buffer->offset = buffer->capacity - cinfo->dest->free_in_buffer;
 }
 
-static int send_jpeg_rect(VncState *vs, int x, int y, int w, int h, int quality)
+static int send_jpeg_rect(VncState *vs, VncWorker *worker,
+                          int x, int y, int w, int h, int quality)
 {
     struct jpeg_compress_struct cinfo;
     struct jpeg_error_mgr jerr;
@@ -1193,15 +1208,15 @@ static int send_jpeg_rect(VncState *vs, int x, int y, int w, int h, int quality)
     int dy;
 
     if (surface_bytes_per_pixel(vs->vd->ds) == 1) {
-        return send_full_color_rect(vs, x, y, w, h);
+        return send_full_color_rect(vs, worker, x, y, w, h);
     }
 
-    buffer_reserve(&vs->tight->jpeg, 2048);
+    buffer_reserve(&worker->tight.jpeg, 2048);
 
     cinfo.err = jpeg_std_error(&jerr);
     jpeg_create_compress(&cinfo);
 
-    cinfo.client_data = vs;
+    cinfo.client_data = &worker->tight;
     cinfo.image_width = w;
     cinfo.image_height = h;
     cinfo.input_components = 3;
@@ -1231,9 +1246,9 @@ static int send_jpeg_rect(VncState *vs, int x, int y, int w, int h, int quality)
 
     vnc_write_u8(vs, VNC_TIGHT_JPEG << 4);
 
-    tight_send_compact_size(vs, vs->tight->jpeg.offset);
-    vnc_write(vs, vs->tight->jpeg.buffer, vs->tight->jpeg.offset);
-    buffer_reset(&vs->tight->jpeg);
+    tight_send_compact_size(vs, worker->tight.jpeg.offset);
+    vnc_write(vs, worker->tight.jpeg.buffer, worker->tight.jpeg.offset);
+    buffer_reset(&worker->tight.jpeg);
 
     return 1;
 }
@@ -1249,7 +1264,7 @@ static void write_png_palette(int idx, uint32_t pix, void *opaque)
     VncState *vs = priv->vs;
     png_colorp color = &priv->png_palette[idx];
 
-    if (vs->tight->pixel24)
+    if (priv->tight->pixel24)
     {
         color->red = (pix >> vs->client_pf.rshift) & vs->client_pf.rmax;
         color->green = (pix >> vs->client_pf.gshift) & vs->client_pf.gmax;
@@ -1274,12 +1289,12 @@ static void write_png_palette(int idx, uint32_t pix, void *opaque)
 static void png_write_data(png_structp png_ptr, png_bytep data,
                            png_size_t length)
 {
-    VncState *vs = png_get_io_ptr(png_ptr);
+    VncWorker *worker = png_get_io_ptr(png_ptr);
 
-    buffer_reserve(&vs->tight->png, vs->tight->png.offset + length);
-    memcpy(vs->tight->png.buffer + vs->tight->png.offset, data, length);
+    buffer_reserve(&worker->tight.png, worker->tight.png.offset + length);
+    memcpy(worker->tight.png.buffer + worker->tight.png.offset, data, length);
 
-    vs->tight->png.offset += length;
+    worker->tight.png.offset += length;
 }
 
 static void png_flush_data(png_structp png_ptr)
@@ -1296,16 +1311,16 @@ static void vnc_png_free(png_structp png_ptr, png_voidp ptr)
     g_free(ptr);
 }
 
-static int send_png_rect(VncState *vs, int x, int y, int w, int h,
-                         VncPalette *palette)
+static int send_png_rect(VncState *vs, VncWorker *worker,
+                         int x, int y, int w, int h, VncPalette *palette)
 {
     png_byte color_type;
     png_structp png_ptr;
     png_infop info_ptr;
     png_colorp png_palette = NULL;
     pixman_image_t *linebuf;
-    int level = tight_png_conf[vs->tight->compression].png_zlib_level;
-    int filters = tight_png_conf[vs->tight->compression].png_filters;
+    int level = tight_png_conf[worker->tight.compression].png_zlib_level;
+    int filters = tight_png_conf[worker->tight.compression].png_filters;
     uint8_t *buf;
     int dy;
 
@@ -1322,7 +1337,7 @@ static int send_png_rect(VncState *vs, int x, int y, int w, int h,
         return -1;
     }
 
-    png_set_write_fn(png_ptr, (void *) vs, png_write_data, png_flush_data);
+    png_set_write_fn(png_ptr, worker, png_write_data, png_flush_data);
     png_set_compression_level(png_ptr, level);
     png_set_filter(png_ptr, PNG_FILTER_TYPE_DEFAULT, filters);
 
@@ -1343,29 +1358,30 @@ static int send_png_rect(VncState *vs, int x, int y, int w, int h,
                                  palette_size(palette));
 
         priv.vs = vs;
+        priv.tight = &worker->tight;
         priv.png_palette = png_palette;
         palette_iter(palette, write_png_palette, &priv);
 
         png_set_PLTE(png_ptr, info_ptr, png_palette, palette_size(palette));
 
         if (vs->client_pf.bytes_per_pixel == 4) {
-            tight_encode_indexed_rect32(vs->tight->tight.buffer, w * h,
+            tight_encode_indexed_rect32(worker->tight.tight.buffer, w * h,
                                         palette);
         } else {
-            tight_encode_indexed_rect16(vs->tight->tight.buffer, w * h,
+            tight_encode_indexed_rect16(worker->tight.tight.buffer, w * h,
                                         palette);
         }
     }
 
     png_write_info(png_ptr, info_ptr);
 
-    buffer_reserve(&vs->tight->png, 2048);
+    buffer_reserve(&worker->tight.png, 2048);
     linebuf = qemu_pixman_linebuf_create(PIXMAN_BE_r8g8b8, w);
     buf = (uint8_t *)pixman_image_get_data(linebuf);
     for (dy = 0; dy < h; dy++)
     {
         if (color_type == PNG_COLOR_TYPE_PALETTE) {
-            memcpy(buf, vs->tight->tight.buffer + (dy * w), w);
+            memcpy(buf, worker->tight.tight.buffer + (dy * w), w);
         } else {
             qemu_pixman_linebuf_fill(linebuf, vs->vd->server, w, x, y + dy);
         }
@@ -1383,46 +1399,47 @@ static int send_png_rect(VncState *vs, int x, int y, int w, int h,
 
     vnc_write_u8(vs, VNC_TIGHT_PNG << 4);
 
-    tight_send_compact_size(vs, vs->tight->png.offset);
-    vnc_write(vs, vs->tight->png.buffer, vs->tight->png.offset);
-    buffer_reset(&vs->tight->png);
+    tight_send_compact_size(vs, worker->tight.png.offset);
+    vnc_write(vs, worker->tight.png.buffer, worker->tight.png.offset);
+    buffer_reset(&worker->tight.png);
     return 1;
 }
 #endif /* CONFIG_PNG */
 
-static void vnc_tight_start(VncState *vs)
+static void vnc_tight_start(VncState *vs, VncTight *tight)
 {
-    buffer_reset(&vs->tight->tight);
+    buffer_reset(&tight->tight);
 
     // make the output buffer be the zlib buffer, so we can compress it later
-    vs->tight->tmp = vs->output;
-    vs->output = vs->tight->tight;
+    tight->tmp = vs->output;
+    vs->output = tight->tight;
 }
 
-static void vnc_tight_stop(VncState *vs)
+static void vnc_tight_stop(VncState *vs, VncTight *tight)
 {
     // switch back to normal output/zlib buffers
-    vs->tight->tight = vs->output;
-    vs->output = vs->tight->tmp;
+    tight->tight = vs->output;
+    vs->output = tight->tmp;
 }
 
-static int send_sub_rect_nojpeg(VncState *vs, int x, int y, int w, int h,
+static int send_sub_rect_nojpeg(VncState *vs, VncWorker *worker,
+                                int x, int y, int w, int h,
                                 int bg, int fg, int colors, VncPalette *palette)
 {
     int ret;
 
     if (colors == 0) {
-        if (tight_detect_smooth_image(vs, w, h)) {
-            ret = send_gradient_rect(vs, x, y, w, h);
+        if (tight_detect_smooth_image(vs, &worker->tight, w, h)) {
+            ret = send_gradient_rect(vs, worker, x, y, w, h);
         } else {
-            ret = send_full_color_rect(vs, x, y, w, h);
+            ret = send_full_color_rect(vs, worker, x, y, w, h);
         }
     } else if (colors == 1) {
-        ret = send_solid_rect(vs);
+        ret = send_solid_rect(vs, worker);
     } else if (colors == 2) {
-        ret = send_mono_rect(vs, x, y, w, h, bg, fg);
+        ret = send_mono_rect(vs, worker, x, y, w, h, bg, fg);
     } else if (colors <= 256) {
-        ret = send_palette_rect(vs, x, y, w, h, palette);
+        ret = send_palette_rect(vs, worker, x, y, w, h, palette);
     } else {
         ret = 0;
     }
@@ -1430,34 +1447,35 @@ static int send_sub_rect_nojpeg(VncState *vs, int x, int y, int w, int h,
 }
 
 #ifdef CONFIG_VNC_JPEG
-static int send_sub_rect_jpeg(VncState *vs, int x, int y, int w, int h,
+static int send_sub_rect_jpeg(VncState *vs, VncWorker *worker,
+                              int x, int y, int w, int h,
                               int bg, int fg, int colors,
                               VncPalette *palette, bool force)
 {
     int ret;
 
     if (colors == 0) {
-        if (force || (tight_jpeg_conf[vs->tight->quality].jpeg_full &&
-                      tight_detect_smooth_image(vs, w, h))) {
-            int quality = tight_conf[vs->tight->quality].jpeg_quality;
+        if (force || (tight_jpeg_conf[worker->tight.quality].jpeg_full &&
+                      tight_detect_smooth_image(vs, &worker->tight, w, h))) {
+            int quality = tight_conf[worker->tight.quality].jpeg_quality;
 
-            ret = send_jpeg_rect(vs, x, y, w, h, quality);
+            ret = send_jpeg_rect(vs, worker, x, y, w, h, quality);
         } else {
-            ret = send_full_color_rect(vs, x, y, w, h);
+            ret = send_full_color_rect(vs, worker, x, y, w, h);
         }
     } else if (colors == 1) {
-        ret = send_solid_rect(vs);
+        ret = send_solid_rect(vs, worker);
     } else if (colors == 2) {
-        ret = send_mono_rect(vs, x, y, w, h, bg, fg);
+        ret = send_mono_rect(vs, worker, x, y, w, h, bg, fg);
     } else if (colors <= 256) {
         if (force || (colors > 96 &&
-                      tight_jpeg_conf[vs->tight->quality].jpeg_idx &&
-                      tight_detect_smooth_image(vs, w, h))) {
-            int quality = tight_conf[vs->tight->quality].jpeg_quality;
+                      tight_jpeg_conf[worker->tight.quality].jpeg_idx &&
+                      tight_detect_smooth_image(vs, &worker->tight, w, h))) {
+            int quality = tight_conf[worker->tight.quality].jpeg_quality;
 
-            ret = send_jpeg_rect(vs, x, y, w, h, quality);
+            ret = send_jpeg_rect(vs, worker, x, y, w, h, quality);
         } else {
-            ret = send_palette_rect(vs, x, y, w, h, palette);
+            ret = send_palette_rect(vs, worker, x, y, w, h, palette);
         }
     } else {
         ret = 0;
@@ -1475,8 +1493,10 @@ static void vnc_tight_cleanup(Notifier *n, void *value)
     color_count_palette = NULL;
 }
 
-static int send_sub_rect(VncState *vs, int x, int y, int w, int h)
+static int send_sub_rect(VncState *vs, VncWorker *worker,
+                         int x, int y, int w, int h)
 {
+    VncTight *tight = &worker->tight;
     uint32_t bg = 0, fg = 0;
     int colors;
     int ret = 0;
@@ -1491,57 +1511,59 @@ static int send_sub_rect(VncState *vs, int x, int y, int w, int h)
         qemu_thread_atexit_add(&vnc_tight_cleanup_notifier);
     }
 
-    vnc_framebuffer_update(vs, x, y, w, h, vs->tight->type);
+    vnc_framebuffer_update(vs, x, y, w, h, tight->type);
 
-    vnc_tight_start(vs);
+    vnc_tight_start(vs, tight);
     vnc_raw_send_framebuffer_update(vs, x, y, w, h);
-    vnc_tight_stop(vs);
+    vnc_tight_stop(vs, tight);
 
 #ifdef CONFIG_VNC_JPEG
-    if (!vs->vd->non_adaptive && vs->tight->quality != (uint8_t)-1) {
+    if (!vs->vd->non_adaptive && tight->quality != (uint8_t)-1) {
         double freq = vnc_update_freq(vs, x, y, w, h);
 
-        if (freq < tight_jpeg_conf[vs->tight->quality].jpeg_freq_min) {
+        if (freq < tight_jpeg_conf[tight->quality].jpeg_freq_min) {
             allow_jpeg = false;
         }
-        if (freq >= tight_jpeg_conf[vs->tight->quality].jpeg_freq_threshold) {
+        if (freq >= tight_jpeg_conf[tight->quality].jpeg_freq_threshold) {
             force_jpeg = true;
-            vnc_sent_lossy_rect(vs, x, y, w, h);
+            vnc_sent_lossy_rect(worker, x, y, w, h);
         }
     }
 #endif
 
-    colors = tight_fill_palette(vs, x, y, w * h, &bg, &fg, color_count_palette);
+    colors = tight_fill_palette(vs, tight, x, y, w * h, &bg, &fg,
+                                color_count_palette);
 
 #ifdef CONFIG_VNC_JPEG
-    if (allow_jpeg && vs->tight->quality != (uint8_t)-1) {
-        ret = send_sub_rect_jpeg(vs, x, y, w, h, bg, fg, colors,
+    if (allow_jpeg && tight->quality != (uint8_t)-1) {
+        ret = send_sub_rect_jpeg(vs, worker, x, y, w, h, bg, fg, colors,
                                  color_count_palette, force_jpeg);
     } else {
-        ret = send_sub_rect_nojpeg(vs, x, y, w, h, bg, fg, colors,
-                                   color_count_palette);
+        ret = send_sub_rect_nojpeg(vs, worker, x, y, w, h, bg, fg,
+                                   colors, color_count_palette);
     }
 #else
-    ret = send_sub_rect_nojpeg(vs, x, y, w, h, bg, fg, colors,
+    ret = send_sub_rect_nojpeg(vs, worker, x, y, w, h, bg, fg, colors,
                                color_count_palette);
 #endif
 
     return ret;
 }
 
-static int send_sub_rect_solid(VncState *vs, int x, int y, int w, int h)
+static int send_sub_rect_solid(VncState *vs, VncWorker *worker,
+                               int x, int y, int w, int h)
 {
-    vnc_framebuffer_update(vs, x, y, w, h, vs->tight->type);
+    vnc_framebuffer_update(vs, x, y, w, h, worker->tight.type);
 
-    vnc_tight_start(vs);
+    vnc_tight_start(vs, &worker->tight);
     vnc_raw_send_framebuffer_update(vs, x, y, w, h);
-    vnc_tight_stop(vs);
+    vnc_tight_stop(vs, &worker->tight);
 
-    return send_solid_rect(vs);
+    return send_solid_rect(vs, worker);
 }
 
-static int send_rect_simple(VncState *vs, int x, int y, int w, int h,
-                            bool split)
+static int send_rect_simple(VncState *vs, VncWorker *worker,
+                            int x, int y, int w, int h, bool split)
 {
     int max_size, max_width;
     int max_sub_width, max_sub_height;
@@ -1549,8 +1571,8 @@ static int send_rect_simple(VncState *vs, int x, int y, int w, int h,
     int rw, rh;
     int n = 0;
 
-    max_size = tight_conf[vs->tight->compression].max_rect_size;
-    max_width = tight_conf[vs->tight->compression].max_rect_width;
+    max_size = tight_conf[worker->tight.compression].max_rect_size;
+    max_width = tight_conf[worker->tight.compression].max_rect_width;
 
     if (split && (w > max_width || w * h > max_size)) {
         max_sub_width = (w > max_width) ? max_width : w;
@@ -1560,18 +1582,18 @@ static int send_rect_simple(VncState *vs, int x, int y, int w, int h,
             for (dx = 0; dx < w; dx += max_width) {
                 rw = MIN(max_sub_width, w - dx);
                 rh = MIN(max_sub_height, h - dy);
-                n += send_sub_rect(vs, x+dx, y+dy, rw, rh);
+                n += send_sub_rect(vs, worker, x + dx, y + dy, rw, rh);
             }
         }
     } else {
-        n += send_sub_rect(vs, x, y, w, h);
+        n += send_sub_rect(vs, worker, x, y, w, h);
     }
 
     return n;
 }
 
-static int find_large_solid_color_rect(VncState *vs, int x, int y,
-                                       int w, int h, int max_rows)
+static int find_large_solid_color_rect(VncState *vs, VncWorker *worker,
+                                       int x, int y, int w, int h, int max_rows)
 {
     int dx, dy, dw, dh;
     int n = 0;
@@ -1583,7 +1605,7 @@ static int find_large_solid_color_rect(VncState *vs, int x, int y,
         /* If a rectangle becomes too large, send its upper part now. */
 
         if (dy - y >= max_rows) {
-            n += send_rect_simple(vs, x, y, w, max_rows, true);
+            n += send_rect_simple(vs, worker, x, y, w, max_rows, true);
             y += max_rows;
             h -= max_rows;
         }
@@ -1622,26 +1644,28 @@ static int find_large_solid_color_rect(VncState *vs, int x, int y,
             /* Send rectangles at top and left to solid-color area. */
 
             if (y_best != y) {
-                n += send_rect_simple(vs, x, y, w, y_best-y, true);
+                n += send_rect_simple(vs, worker, x, y, w, y_best - y, true);
             }
             if (x_best != x) {
-                n += tight_send_framebuffer_update(vs, x, y_best,
+                n += tight_send_framebuffer_update(vs, worker, x, y_best,
                                                    x_best-x, h_best);
             }
 
             /* Send solid-color rectangle. */
-            n += send_sub_rect_solid(vs, x_best, y_best, w_best, h_best);
+            n += send_sub_rect_solid(vs, worker,
+                                     x_best, y_best, w_best, h_best);
 
             /* Send remaining rectangles (at right and bottom). */
 
             if (x_best + w_best != x + w) {
-                n += tight_send_framebuffer_update(vs, x_best+w_best,
+                n += tight_send_framebuffer_update(vs, worker, x_best + w_best,
                                                    y_best,
                                                    w-(x_best-x)-w_best,
                                                    h_best);
             }
             if (y_best + h_best != y + h) {
-                n += tight_send_framebuffer_update(vs, x, y_best+h_best,
+                n += tight_send_framebuffer_update(vs, worker,
+                                                   x, y_best + h_best,
                                                    w, h-(y_best-y)-h_best);
             }
 
@@ -1649,73 +1673,73 @@ static int find_large_solid_color_rect(VncState *vs, int x, int y,
             return n;
         }
     }
-    return n + send_rect_simple(vs, x, y, w, h, true);
+    return n + send_rect_simple(vs, worker, x, y, w, h, true);
 }
 
-static int tight_send_framebuffer_update(VncState *vs, int x, int y,
-                                         int w, int h)
+static int tight_send_framebuffer_update(VncState *vs, VncWorker *worker,
+                                         int x, int y, int w, int h)
 {
     int max_rows;
 
     if (vs->client_pf.bytes_per_pixel == 4 && vs->client_pf.rmax == 0xFF &&
         vs->client_pf.bmax == 0xFF && vs->client_pf.gmax == 0xFF) {
-        vs->tight->pixel24 = true;
+        worker->tight.pixel24 = true;
     } else {
-        vs->tight->pixel24 = false;
+        worker->tight.pixel24 = false;
     }
 
 #ifdef CONFIG_VNC_JPEG
-    if (vs->tight->quality != (uint8_t)-1) {
+    if (worker->tight.quality != (uint8_t)-1) {
         double freq = vnc_update_freq(vs, x, y, w, h);
 
-        if (freq > tight_jpeg_conf[vs->tight->quality].jpeg_freq_threshold) {
-            return send_rect_simple(vs, x, y, w, h, false);
+        if (freq > tight_jpeg_conf[worker->tight.quality].jpeg_freq_threshold) {
+            return send_rect_simple(vs, worker, x, y, w, h, false);
         }
     }
 #endif
 
     if (w * h < VNC_TIGHT_MIN_SPLIT_RECT_SIZE) {
-        return send_rect_simple(vs, x, y, w, h, true);
+        return send_rect_simple(vs, worker, x, y, w, h, true);
     }
 
     /* Calculate maximum number of rows in one non-solid rectangle. */
 
-    max_rows = tight_conf[vs->tight->compression].max_rect_size;
-    max_rows /= MIN(tight_conf[vs->tight->compression].max_rect_width, w);
+    max_rows = tight_conf[worker->tight.compression].max_rect_size;
+    max_rows /= MIN(tight_conf[worker->tight.compression].max_rect_width, w);
 
-    return find_large_solid_color_rect(vs, x, y, w, h, max_rows);
+    return find_large_solid_color_rect(vs, worker, x, y, w, h, max_rows);
 }
 
-int vnc_tight_send_framebuffer_update(VncState *vs, int x, int y,
-                                      int w, int h)
+int vnc_tight_send_framebuffer_update(VncState *vs, VncWorker *worker,
+                                      int x, int y, int w, int h)
 {
-    vs->tight->type = VNC_ENCODING_TIGHT;
-    return tight_send_framebuffer_update(vs, x, y, w, h);
+    worker->tight.type = VNC_ENCODING_TIGHT;
+    return tight_send_framebuffer_update(vs, worker, x, y, w, h);
 }
 
-int vnc_tight_png_send_framebuffer_update(VncState *vs, int x, int y,
-                                          int w, int h)
+int vnc_tight_png_send_framebuffer_update(VncState *vs, VncWorker *worker,
+                                          int x, int y, int w, int h)
 {
-    vs->tight->type = VNC_ENCODING_TIGHT_PNG;
-    return tight_send_framebuffer_update(vs, x, y, w, h);
+    worker->tight.type = VNC_ENCODING_TIGHT_PNG;
+    return tight_send_framebuffer_update(vs, worker, x, y, w, h);
 }
 
-void vnc_tight_clear(VncState *vs)
+void vnc_tight_clear(VncWorker *worker)
 {
     int i;
-    for (i = 0; i < ARRAY_SIZE(vs->tight->stream); i++) {
-        if (vs->tight->stream[i].opaque) {
-            deflateEnd(&vs->tight->stream[i]);
+    for (i = 0; i < ARRAY_SIZE(worker->tight.stream); i++) {
+        if (worker->tight.stream[i].opaque) {
+            deflateEnd(&worker->tight.stream[i]);
         }
     }
 
-    buffer_free(&vs->tight->tight);
-    buffer_free(&vs->tight->zlib);
-    buffer_free(&vs->tight->gradient);
+    buffer_free(&worker->tight.tight);
+    buffer_free(&worker->tight.zlib);
+    buffer_free(&worker->tight.gradient);
 #ifdef CONFIG_VNC_JPEG
-    buffer_free(&vs->tight->jpeg);
+    buffer_free(&worker->tight.jpeg);
 #endif
 #ifdef CONFIG_PNG
-    buffer_free(&vs->tight->png);
+    buffer_free(&worker->tight.png);
 #endif
 }
diff --git a/ui/vnc-enc-zlib.c b/ui/vnc-enc-zlib.c
index 52e9193eab..a6d287118a 100644
--- a/ui/vnc-enc-zlib.c
+++ b/ui/vnc-enc-zlib.c
@@ -46,23 +46,23 @@ void vnc_zlib_zfree(void *x, void *addr)
     g_free(addr);
 }
 
-static void vnc_zlib_start(VncState *vs)
+static void vnc_zlib_start(VncState *vs, VncWorker *worker)
 {
-    buffer_reset(&vs->zlib->zlib);
+    buffer_reset(&worker->zlib.zlib);
 
     // make the output buffer be the zlib buffer, so we can compress it later
-    vs->zlib->tmp = vs->output;
-    vs->output = vs->zlib->zlib;
+    worker->zlib.tmp = vs->output;
+    vs->output = worker->zlib.zlib;
 }
 
-static int vnc_zlib_stop(VncState *vs)
+static int vnc_zlib_stop(VncState *vs, VncWorker *worker)
 {
-    z_streamp zstream = &vs->zlib->stream;
+    z_streamp zstream = &worker->zlib.stream;
     int previous_out;
 
     // switch back to normal output/zlib buffers
-    vs->zlib->zlib = vs->output;
-    vs->output = vs->zlib->tmp;
+    worker->zlib.zlib = vs->output;
+    vs->output = worker->zlib.tmp;
 
     // compress the zlib buffer
 
@@ -76,7 +76,7 @@ static int vnc_zlib_stop(VncState *vs)
         zstream->zalloc = vnc_zlib_zalloc;
         zstream->zfree = vnc_zlib_zfree;
 
-        err = deflateInit2(zstream, vs->tight->compression, Z_DEFLATED,
+        err = deflateInit2(zstream, worker->tight.compression, Z_DEFLATED,
                            MAX_WBITS,
                            MAX_MEM_LEVEL, Z_DEFAULT_STRATEGY);
 
@@ -85,24 +85,24 @@ static int vnc_zlib_stop(VncState *vs)
             return -1;
         }
 
-        vs->zlib->level = vs->tight->compression;
+        worker->zlib.level = worker->tight.compression;
         zstream->opaque = vs;
     }
 
-    if (vs->tight->compression != vs->zlib->level) {
-        if (deflateParams(zstream, vs->tight->compression,
+    if (worker->tight.compression != worker->zlib.level) {
+        if (deflateParams(zstream, worker->tight.compression,
                           Z_DEFAULT_STRATEGY) != Z_OK) {
             return -1;
         }
-        vs->zlib->level = vs->tight->compression;
+        worker->zlib.level = worker->tight.compression;
     }
 
     // reserve memory in output buffer
-    buffer_reserve(&vs->output, vs->zlib->zlib.offset + 64);
+    buffer_reserve(&vs->output, worker->zlib.zlib.offset + 64);
 
     // set pointers
-    zstream->next_in = vs->zlib->zlib.buffer;
-    zstream->avail_in = vs->zlib->zlib.offset;
+    zstream->next_in = worker->zlib.zlib.buffer;
+    zstream->avail_in = worker->zlib.zlib.offset;
     zstream->next_out = vs->output.buffer + vs->output.offset;
     zstream->avail_out = vs->output.capacity - vs->output.offset;
     previous_out = zstream->avail_out;
@@ -118,7 +118,8 @@ static int vnc_zlib_stop(VncState *vs)
     return previous_out - zstream->avail_out;
 }
 
-int vnc_zlib_send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
+int vnc_zlib_send_framebuffer_update(VncState *vs, VncWorker *worker,
+                                     int x, int y, int w, int h)
 {
     int old_offset, new_offset, bytes_written;
 
@@ -129,9 +130,9 @@ int vnc_zlib_send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
     vnc_write_s32(vs, 0);
 
     // compress the stream
-    vnc_zlib_start(vs);
+    vnc_zlib_start(vs, worker);
     vnc_raw_send_framebuffer_update(vs, x, y, w, h);
-    bytes_written = vnc_zlib_stop(vs);
+    bytes_written = vnc_zlib_stop(vs, worker);
 
     if (bytes_written == -1)
         return 0;
@@ -145,10 +146,10 @@ int vnc_zlib_send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
     return 1;
 }
 
-void vnc_zlib_clear(VncState *vs)
+void vnc_zlib_clear(VncWorker *worker)
 {
-    if (vs->zlib->stream.opaque) {
-        deflateEnd(&vs->zlib->stream);
+    if (worker->zlib.stream.opaque) {
+        deflateEnd(&worker->zlib.stream);
     }
-    buffer_free(&vs->zlib->zlib);
+    buffer_free(&worker->zlib.zlib);
 }
diff --git a/ui/vnc-enc-zrle.c b/ui/vnc-enc-zrle.c
index 97ec6c7119..7679014c9e 100644
--- a/ui/vnc-enc-zrle.c
+++ b/ui/vnc-enc-zrle.c
@@ -35,45 +35,45 @@ static const int bits_per_packed_pixel[] = {
 };
 
 
-static void vnc_zrle_start(VncState *vs)
+static void vnc_zrle_start(VncState *vs, VncZrle *zrle)
 {
-    buffer_reset(&vs->zrle->zrle);
+    buffer_reset(&zrle->zrle);
 
     /* make the output buffer be the zlib buffer, so we can compress it later */
-    vs->zrle->tmp = vs->output;
-    vs->output = vs->zrle->zrle;
+    zrle->tmp = vs->output;
+    vs->output = zrle->zrle;
 }
 
-static void vnc_zrle_stop(VncState *vs)
+static void vnc_zrle_stop(VncState *vs, VncZrle *zrle)
 {
     /* switch back to normal output/zlib buffers */
-    vs->zrle->zrle = vs->output;
-    vs->output = vs->zrle->tmp;
+    zrle->zrle = vs->output;
+    vs->output = zrle->tmp;
 }
 
-static void *zrle_convert_fb(VncState *vs, int x, int y, int w, int h,
-                             int bpp)
+static void *zrle_convert_fb(VncState *vs, VncZrle *zrle,
+                             int x, int y, int w, int h, int bpp)
 {
     Buffer tmp;
 
-    buffer_reset(&vs->zrle->fb);
-    buffer_reserve(&vs->zrle->fb, w * h * bpp + bpp);
+    buffer_reset(&zrle->fb);
+    buffer_reserve(&zrle->fb, w * h * bpp + bpp);
 
     tmp = vs->output;
-    vs->output = vs->zrle->fb;
+    vs->output = zrle->fb;
 
     vnc_raw_send_framebuffer_update(vs, x, y, w, h);
 
-    vs->zrle->fb = vs->output;
+    zrle->fb = vs->output;
     vs->output = tmp;
-    return vs->zrle->fb.buffer;
+    return zrle->fb.buffer;
 }
 
-static int zrle_compress_data(VncState *vs, int level)
+static int zrle_compress_data(VncState *vs, VncZrle *zrle, int level)
 {
-    z_streamp zstream = &vs->zrle->stream;
+    z_streamp zstream = &zrle->stream;
 
-    buffer_reset(&vs->zrle->zlib);
+    buffer_reset(&zrle->zlib);
 
     if (zstream->opaque != vs) {
         int err;
@@ -93,13 +93,13 @@ static int zrle_compress_data(VncState *vs, int level)
     }
 
     /* reserve memory in output buffer */
-    buffer_reserve(&vs->zrle->zlib, vs->zrle->zrle.offset + 64);
+    buffer_reserve(&zrle->zlib, zrle->zrle.offset + 64);
 
     /* set pointers */
-    zstream->next_in = vs->zrle->zrle.buffer;
-    zstream->avail_in = vs->zrle->zrle.offset;
-    zstream->next_out = vs->zrle->zlib.buffer;
-    zstream->avail_out = vs->zrle->zlib.capacity;
+    zstream->next_in = zrle->zrle.buffer;
+    zstream->avail_in = zrle->zrle.offset;
+    zstream->next_out = zrle->zlib.buffer;
+    zstream->avail_out = zrle->zlib.capacity;
     zstream->data_type = Z_BINARY;
 
     /* start encoding */
@@ -108,8 +108,8 @@ static int zrle_compress_data(VncState *vs, int level)
         return -1;
     }
 
-    vs->zrle->zlib.offset = vs->zrle->zlib.capacity - zstream->avail_out;
-    return vs->zrle->zlib.offset;
+    zrle->zlib.offset = zrle->zlib.capacity - zstream->avail_out;
+    return zrle->zlib.offset;
 }
 
 /* Try to work out whether to use RLE and/or a palette.  We do this by
@@ -252,21 +252,21 @@ static void zrle_write_u8(VncState *vs, uint8_t value)
 #undef ZRLE_COMPACT_PIXEL
 #undef ZRLE_BPP
 
-static int zrle_send_framebuffer_update(VncState *vs, int x, int y,
-                                        int w, int h)
+static int zrle_send_framebuffer_update(VncState *vs, VncWorker *worker,
+                                        int x, int y, int w, int h)
 {
     bool be = vs->client_endian == G_BIG_ENDIAN;
     size_t bytes;
     int zywrle_level;
 
-    if (vs->zrle->type == VNC_ENCODING_ZYWRLE) {
-        if (!vs->vd->lossy || vs->tight->quality == (uint8_t)-1
-            || vs->tight->quality == 9) {
+    if (worker->zrle.type == VNC_ENCODING_ZYWRLE) {
+        if (!vs->vd->lossy || worker->tight.quality == (uint8_t)-1
+            || worker->tight.quality == 9) {
             zywrle_level = 0;
-            vs->zrle->type = VNC_ENCODING_ZRLE;
-        } else if (vs->tight->quality < 3) {
+            worker->zrle.type = VNC_ENCODING_ZRLE;
+        } else if (worker->tight.quality < 3) {
             zywrle_level = 3;
-        } else if (vs->tight->quality < 6) {
+        } else if (worker->tight.quality < 6) {
             zywrle_level = 2;
         } else {
             zywrle_level = 1;
@@ -275,25 +275,25 @@ static int zrle_send_framebuffer_update(VncState *vs, int x, int y,
         zywrle_level = 0;
     }
 
-    vnc_zrle_start(vs);
+    vnc_zrle_start(vs, &worker->zrle);
 
     switch (vs->client_pf.bytes_per_pixel) {
     case 1:
-        zrle_encode_8ne(vs, x, y, w, h, zywrle_level);
+        zrle_encode_8ne(vs, &worker->zrle, x, y, w, h, zywrle_level);
         break;
 
     case 2:
         if (vs->client_pf.gmax > 0x1F) {
             if (be) {
-                zrle_encode_16be(vs, x, y, w, h, zywrle_level);
+                zrle_encode_16be(vs, &worker->zrle, x, y, w, h, zywrle_level);
             } else {
-                zrle_encode_16le(vs, x, y, w, h, zywrle_level);
+                zrle_encode_16le(vs, &worker->zrle, x, y, w, h, zywrle_level);
             }
         } else {
             if (be) {
-                zrle_encode_15be(vs, x, y, w, h, zywrle_level);
+                zrle_encode_15be(vs, &worker->zrle, x, y, w, h, zywrle_level);
             } else {
-                zrle_encode_15le(vs, x, y, w, h, zywrle_level);
+                zrle_encode_15le(vs, &worker->zrle, x, y, w, h, zywrle_level);
             }
         }
         break;
@@ -314,53 +314,55 @@ static int zrle_send_framebuffer_update(VncState *vs, int x, int y,
 
         if ((fits_in_ls3bytes && !be) || (fits_in_ms3bytes && be)) {
             if (be) {
-                zrle_encode_24abe(vs, x, y, w, h, zywrle_level);
+                zrle_encode_24abe(vs, &worker->zrle, x, y, w, h, zywrle_level);
             } else {
-                zrle_encode_24ale(vs, x, y, w, h, zywrle_level);
+                zrle_encode_24ale(vs, &worker->zrle, x, y, w, h, zywrle_level);
           }
         } else if ((fits_in_ls3bytes && be) || (fits_in_ms3bytes && !be)) {
             if (be) {
-                zrle_encode_24bbe(vs, x, y, w, h, zywrle_level);
+                zrle_encode_24bbe(vs, &worker->zrle, x, y, w, h, zywrle_level);
             } else {
-                zrle_encode_24ble(vs, x, y, w, h, zywrle_level);
+                zrle_encode_24ble(vs, &worker->zrle, x, y, w, h, zywrle_level);
             }
         } else {
             if (be) {
-                zrle_encode_32be(vs, x, y, w, h, zywrle_level);
+                zrle_encode_32be(vs, &worker->zrle, x, y, w, h, zywrle_level);
             } else {
-                zrle_encode_32le(vs, x, y, w, h, zywrle_level);
+                zrle_encode_32le(vs, &worker->zrle, x, y, w, h, zywrle_level);
             }
         }
     }
     break;
     }
 
-    vnc_zrle_stop(vs);
-    bytes = zrle_compress_data(vs, Z_DEFAULT_COMPRESSION);
-    vnc_framebuffer_update(vs, x, y, w, h, vs->zrle->type);
+    vnc_zrle_stop(vs, &worker->zrle);
+    bytes = zrle_compress_data(vs, &worker->zrle, Z_DEFAULT_COMPRESSION);
+    vnc_framebuffer_update(vs, x, y, w, h, worker->zrle.type);
     vnc_write_u32(vs, bytes);
-    vnc_write(vs, vs->zrle->zlib.buffer, vs->zrle->zlib.offset);
+    vnc_write(vs, worker->zrle.zlib.buffer, worker->zrle.zlib.offset);
     return 1;
 }
 
-int vnc_zrle_send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
+int vnc_zrle_send_framebuffer_update(VncState *vs, VncWorker *worker,
+                                     int x, int y, int w, int h)
 {
-    vs->zrle->type = VNC_ENCODING_ZRLE;
-    return zrle_send_framebuffer_update(vs, x, y, w, h);
+    worker->zrle.type = VNC_ENCODING_ZRLE;
+    return zrle_send_framebuffer_update(vs, worker, x, y, w, h);
 }
 
-int vnc_zywrle_send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
+int vnc_zywrle_send_framebuffer_update(VncState *vs, VncWorker *worker,
+                                       int x, int y, int w, int h)
 {
-    vs->zrle->type = VNC_ENCODING_ZYWRLE;
-    return zrle_send_framebuffer_update(vs, x, y, w, h);
+    worker->zrle.type = VNC_ENCODING_ZYWRLE;
+    return zrle_send_framebuffer_update(vs, worker, x, y, w, h);
 }
 
-void vnc_zrle_clear(VncState *vs)
+void vnc_zrle_clear(VncWorker *worker)
 {
-    if (vs->zrle->stream.opaque) {
-        deflateEnd(&vs->zrle->stream);
+    if (worker->zrle.stream.opaque) {
+        deflateEnd(&worker->zrle.stream);
     }
-    buffer_free(&vs->zrle->zrle);
-    buffer_free(&vs->zrle->fb);
-    buffer_free(&vs->zrle->zlib);
+    buffer_free(&worker->zrle.zrle);
+    buffer_free(&worker->zrle.fb);
+    buffer_free(&worker->zrle.zlib);
 }
diff --git a/ui/vnc-enc-zrle.c.inc b/ui/vnc-enc-zrle.c.inc
index 2ef7501d52..68d28f58b7 100644
--- a/ui/vnc-enc-zrle.c.inc
+++ b/ui/vnc-enc-zrle.c.inc
@@ -62,16 +62,16 @@
 #define ZRLE_ENCODE_TILE     ZRLE_CONCAT2(zrle_encode_tile,  ZRLE_ENCODE_SUFFIX)
 #define ZRLE_WRITE_PALETTE   ZRLE_CONCAT2(zrle_write_palette,ZRLE_ENCODE_SUFFIX)
 
-static void ZRLE_ENCODE_TILE(VncState *vs, ZRLE_PIXEL *data, int w, int h,
-                             int zywrle_level);
+static void ZRLE_ENCODE_TILE(VncState *vs, VncZrle *zrle, ZRLE_PIXEL *data,
+                             int w, int h, int zywrle_level);
 
 #if ZRLE_BPP != 8
 #include "vnc-enc-zywrle-template.c"
 #endif
 
 
-static void ZRLE_ENCODE(VncState *vs, int x, int y, int w, int h,
-                        int zywrle_level)
+static void ZRLE_ENCODE(VncState *vs, VncZrle *zrle,
+                        int x, int y, int w, int h, int zywrle_level)
 {
     int ty;
 
@@ -87,16 +87,16 @@ static void ZRLE_ENCODE(VncState *vs, int x, int y, int w, int h,
 
             tw = MIN(VNC_ZRLE_TILE_WIDTH, x + w - tx);
 
-            buf = zrle_convert_fb(vs, tx, ty, tw, th, ZRLE_BPP);
-            ZRLE_ENCODE_TILE(vs, buf, tw, th, zywrle_level);
+            buf = zrle_convert_fb(vs, zrle, tx, ty, tw, th, ZRLE_BPP);
+            ZRLE_ENCODE_TILE(vs, zrle, buf, tw, th, zywrle_level);
         }
     }
 }
 
-static void ZRLE_ENCODE_TILE(VncState *vs, ZRLE_PIXEL *data, int w, int h,
-                             int zywrle_level)
+static void ZRLE_ENCODE_TILE(VncState *vs, VncZrle *zrle, ZRLE_PIXEL *data,
+                             int w, int h, int zywrle_level)
 {
-    VncPalette *palette = &vs->zrle->palette;
+    VncPalette *palette = &zrle->palette;
 
     int runs = 0;
     int single_pixels = 0;
@@ -236,7 +236,7 @@ static void ZRLE_ENCODE_TILE(VncState *vs, ZRLE_PIXEL *data, int w, int h,
 #if ZRLE_BPP != 8
         if (zywrle_level > 0 && !(zywrle_level & 0x80)) {
             ZYWRLE_ANALYZE(data, data, w, h, w, zywrle_level, vs->zywrle.buf);
-            ZRLE_ENCODE_TILE(vs, data, w, h, zywrle_level | 0x80);
+            ZRLE_ENCODE_TILE(vs, zrle, data, w, h, zywrle_level | 0x80);
         }
         else
 #endif
diff --git a/ui/vnc-jobs.c b/ui/vnc-jobs.c
index d3486af9e2..bed33950a8 100644
--- a/ui/vnc-jobs.c
+++ b/ui/vnc-jobs.c
@@ -185,14 +185,10 @@ static void vnc_async_encoding_start(VncState *orig, VncState *local)
     local->vnc_encoding = orig->vnc_encoding;
     local->features = orig->features;
     local->vd = orig->vd;
-    local->lossy_rect = orig->lossy_rect;
     local->write_pixels = orig->write_pixels;
     local->client_pf = orig->client_pf;
     local->client_endian = orig->client_endian;
-    local->tight = orig->tight;
-    local->zlib = orig->zlib;
     local->hextile = orig->hextile;
-    local->zrle = orig->zrle;
     local->client_width = orig->client_width;
     local->client_height = orig->client_height;
 }
@@ -200,11 +196,7 @@ static void vnc_async_encoding_start(VncState *orig, VncState *local)
 static void vnc_async_encoding_end(VncState *orig, VncState *local)
 {
     buffer_free(&local->output);
-    orig->tight = local->tight;
-    orig->zlib = local->zlib;
     orig->hextile = local->hextile;
-    orig->zrle = local->zrle;
-    orig->lossy_rect = local->lossy_rect;
 }
 
 static bool vnc_worker_clamp_rect(VncState *vs, VncJob *job, VncRect *rect)
@@ -237,6 +229,7 @@ static bool vnc_worker_clamp_rect(VncState *vs, VncJob *job, VncRect *rect)
 
 static int vnc_worker_thread_loop(VncJobQueue *queue)
 {
+    VncConnection *vc;
     VncJob *job;
     VncRectEntry *entry, *tmp;
     VncState vs = {};
@@ -256,6 +249,7 @@ static int vnc_worker_thread_loop(VncJobQueue *queue)
     }
 
     assert(job->vs->magic == VNC_MAGIC);
+    vc = container_of(job->vs, VncConnection, vs);
 
     vnc_lock_output(job->vs);
     if (job->vs->ioc == NULL || job->vs->abort == true) {
@@ -295,7 +289,8 @@ static int vnc_worker_thread_loop(VncJobQueue *queue)
         }
 
         if (vnc_worker_clamp_rect(&vs, job, &entry->rect)) {
-            n = vnc_send_framebuffer_update(&vs, entry->rect.x, entry->rect.y,
+            n = vnc_send_framebuffer_update(&vs, &vc->worker,
+                                            entry->rect.x, entry->rect.y,
                                             entry->rect.w, entry->rect.h);
 
             if (n >= 0) {
diff --git a/ui/vnc.c b/ui/vnc.c
index ab74154e4c..1df35832d5 100644
--- a/ui/vnc.c
+++ b/ui/vnc.c
@@ -56,11 +56,6 @@
 #include "io/dns-resolver.h"
 #include "monitor/monitor.h"
 
-typedef struct VncConnection {
-    VncState vs;
-    VncZlib zlib;
-} VncConnection;
-
 #define VNC_REFRESH_INTERVAL_BASE GUI_REFRESH_INTERVAL_DEFAULT
 #define VNC_REFRESH_INTERVAL_INC  50
 #define VNC_REFRESH_INTERVAL_MAX  GUI_REFRESH_INTERVAL_IDLE
@@ -951,29 +946,30 @@ int vnc_raw_send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
     return 1;
 }
 
-int vnc_send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
+int vnc_send_framebuffer_update(VncState *vs, VncWorker *worker,
+                                int x, int y, int w, int h)
 {
     int n = 0;
 
     switch(vs->vnc_encoding) {
         case VNC_ENCODING_ZLIB:
-            n = vnc_zlib_send_framebuffer_update(vs, x, y, w, h);
+            n = vnc_zlib_send_framebuffer_update(vs, worker, x, y, w, h);
             break;
         case VNC_ENCODING_HEXTILE:
             vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_HEXTILE);
             n = vnc_hextile_send_framebuffer_update(vs, x, y, w, h);
             break;
         case VNC_ENCODING_TIGHT:
-            n = vnc_tight_send_framebuffer_update(vs, x, y, w, h);
+            n = vnc_tight_send_framebuffer_update(vs, worker, x, y, w, h);
             break;
         case VNC_ENCODING_TIGHT_PNG:
-            n = vnc_tight_png_send_framebuffer_update(vs, x, y, w, h);
+            n = vnc_tight_png_send_framebuffer_update(vs, worker, x, y, w, h);
             break;
         case VNC_ENCODING_ZRLE:
-            n = vnc_zrle_send_framebuffer_update(vs, x, y, w, h);
+            n = vnc_zrle_send_framebuffer_update(vs, worker, x, y, w, h);
             break;
         case VNC_ENCODING_ZYWRLE:
-            n = vnc_zywrle_send_framebuffer_update(vs, x, y, w, h);
+            n = vnc_zywrle_send_framebuffer_update(vs, worker, x, y, w, h);
             break;
         default:
             vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_RAW);
@@ -1311,7 +1307,7 @@ static void vnc_disconnect_start(VncState *vs)
 
 void vnc_disconnect_finish(VncState *vs)
 {
-    int i;
+    VncConnection *vc = container_of(vs, VncConnection, vs);
 
     trace_vnc_client_disconnect_finish(vs, vs->ioc);
 
@@ -1325,9 +1321,9 @@ void vnc_disconnect_finish(VncState *vs)
 
     qapi_free_VncClientInfo(vs->info);
 
-    vnc_zlib_clear(vs);
-    vnc_tight_clear(vs);
-    vnc_zrle_clear(vs);
+    vnc_zlib_clear(&vc->worker);
+    vnc_tight_clear(&vc->worker);
+    vnc_zrle_clear(&vc->worker);
 
 #ifdef CONFIG_VNC_SASL
     vnc_sasl_client_cleanup(vs);
@@ -1355,19 +1351,12 @@ void vnc_disconnect_finish(VncState *vs)
     }
     buffer_free(&vs->jobs_buffer);
 
-    for (i = 0; i < VNC_STAT_ROWS; ++i) {
-        g_free(vs->lossy_rect[i]);
-    }
-    g_free(vs->lossy_rect);
-
     object_unref(OBJECT(vs->ioc));
     vs->ioc = NULL;
     object_unref(OBJECT(vs->sioc));
     vs->sioc = NULL;
     vs->magic = 0;
-    g_free(vs->zrle);
-    g_free(vs->tight);
-    g_free(container_of(vs, VncConnection, vs));
+    g_free(vc);
 }
 
 size_t vnc_client_io_error(VncState *vs, ssize_t ret, Error *err)
@@ -2131,13 +2120,14 @@ static void send_xvp_message(VncState *vs, int code)
 
 static void set_encodings(VncState *vs, int32_t *encodings, size_t n_encodings)
 {
+    VncConnection *vc = container_of(vs, VncConnection, vs);
     int i;
     unsigned int enc = 0;
 
     vs->features = 0;
     vs->vnc_encoding = 0;
-    vs->tight->compression = 9;
-    vs->tight->quality = -1; /* Lossless by default */
+    vc->worker.tight.compression = 9;
+    vc->worker.tight.quality = -1; /* Lossless by default */
     vs->absolute = -1;
 
     /*
@@ -2225,11 +2215,11 @@ static void set_encodings(VncState *vs, int32_t *encodings, size_t n_encodings)
             vnc_server_cut_text_caps(vs);
             break;
         case VNC_ENCODING_COMPRESSLEVEL0 ... VNC_ENCODING_COMPRESSLEVEL0 + 9:
-            vs->tight->compression = (enc & 0x0F);
+            vc->worker.tight.compression = (enc & 0x0F);
             break;
         case VNC_ENCODING_QUALITYLEVEL0 ... VNC_ENCODING_QUALITYLEVEL0 + 9:
             if (vs->vd->lossy) {
-                vs->tight->quality = (enc & 0x0F);
+                vc->worker.tight.quality = (enc & 0x0F);
             }
             break;
         default:
@@ -2958,7 +2948,7 @@ static VncRectStat *vnc_stat_rect(VncDisplay *vd, int x, int y)
     return &vs->stats[y / VNC_STAT_RECT][x / VNC_STAT_RECT];
 }
 
-void vnc_sent_lossy_rect(VncState *vs, int x, int y, int w, int h)
+void vnc_sent_lossy_rect(VncWorker *worker, int x, int y, int w, int h)
 {
     int i, j;
 
@@ -2969,7 +2959,7 @@ void vnc_sent_lossy_rect(VncState *vs, int x, int y, int w, int h)
 
     for (j = y; j <= h; j++) {
         for (i = x; i <= w; i++) {
-            vs->lossy_rect[j][i] = 1;
+            worker->lossy_rect[j][i] = 1;
         }
     }
 }
@@ -2985,6 +2975,7 @@ static int vnc_refresh_lossy_rect(VncDisplay *vd, int x, int y)
     x = QEMU_ALIGN_DOWN(x, VNC_STAT_RECT);
 
     QTAILQ_FOREACH(vs, &vd->clients, next) {
+        VncConnection *vc = container_of(vs, VncConnection, vs);
         int j;
 
         /* kernel send buffers are full -> refresh later */
@@ -2992,11 +2983,11 @@ static int vnc_refresh_lossy_rect(VncDisplay *vd, int x, int y)
             continue;
         }
 
-        if (!vs->lossy_rect[sty][stx]) {
+        if (!vc->worker.lossy_rect[sty][stx]) {
             continue;
         }
 
-        vs->lossy_rect[sty][stx] = 0;
+        vc->worker.lossy_rect[sty][stx] = 0;
         for (j = 0; j < VNC_STAT_RECT; ++j) {
             bitmap_set(vs->dirty[y + j],
                        x / VNC_DIRTY_PIXELS_PER_BIT,
@@ -3249,12 +3240,8 @@ static void vnc_connect(VncDisplay *vd, QIOChannelSocket *sioc,
     VncConnection *vc = g_new0(VncConnection, 1);
     VncState *vs = &vc->vs;
     bool first_client = QTAILQ_EMPTY(&vd->clients);
-    int i;
 
     trace_vnc_client_connect(vs, sioc);
-    vs->zlib = &vc->zlib;
-    vs->zrle = g_new0(VncZrle, 1);
-    vs->tight = g_new0(VncTight, 1);
     vs->magic = VNC_MAGIC;
     vs->sioc = sioc;
     object_ref(OBJECT(vs->sioc));
@@ -3262,23 +3249,23 @@ static void vnc_connect(VncDisplay *vd, QIOChannelSocket *sioc,
     object_ref(OBJECT(vs->ioc));
     vs->vd = vd;
 
-    buffer_init(&vs->input,          "vnc-input/%p", sioc);
-    buffer_init(&vs->output,         "vnc-output/%p", sioc);
-    buffer_init(&vs->jobs_buffer,    "vnc-jobs_buffer/%p", sioc);
+    buffer_init(&vs->input,                 "vnc-input/%p", sioc);
+    buffer_init(&vs->output,                "vnc-output/%p", sioc);
+    buffer_init(&vs->jobs_buffer,           "vnc-jobs_buffer/%p", sioc);
 
-    buffer_init(&vs->tight->tight,    "vnc-tight/%p", sioc);
-    buffer_init(&vs->tight->zlib,     "vnc-tight-zlib/%p", sioc);
-    buffer_init(&vs->tight->gradient, "vnc-tight-gradient/%p", sioc);
+    buffer_init(&vc->worker.tight.tight,    "vnc-tight/%p", sioc);
+    buffer_init(&vc->worker.tight.zlib,     "vnc-tight-zlib/%p", sioc);
+    buffer_init(&vc->worker.tight.gradient, "vnc-tight-gradient/%p", sioc);
 #ifdef CONFIG_VNC_JPEG
-    buffer_init(&vs->tight->jpeg,     "vnc-tight-jpeg/%p", sioc);
+    buffer_init(&vc->worker.tight.jpeg,     "vnc-tight-jpeg/%p", sioc);
 #endif
 #ifdef CONFIG_PNG
-    buffer_init(&vs->tight->png,      "vnc-tight-png/%p", sioc);
+    buffer_init(&vc->worker.tight.png,      "vnc-tight-png/%p", sioc);
 #endif
-    buffer_init(&vc->zlib.zlib,      "vnc-zlib/%p", sioc);
-    buffer_init(&vs->zrle->zrle,      "vnc-zrle/%p", sioc);
-    buffer_init(&vs->zrle->fb,        "vnc-zrle-fb/%p", sioc);
-    buffer_init(&vs->zrle->zlib,      "vnc-zrle-zlib/%p", sioc);
+    buffer_init(&vc->worker.zlib.zlib,      "vnc-zlib/%p", sioc);
+    buffer_init(&vc->worker.zrle.zrle,      "vnc-zrle/%p", sioc);
+    buffer_init(&vc->worker.zrle.fb,        "vnc-zrle-fb/%p", sioc);
+    buffer_init(&vc->worker.zrle.zlib,      "vnc-zrle-zlib/%p", sioc);
 
     if (skipauth) {
         vs->auth = VNC_AUTH_NONE;
@@ -3295,11 +3282,6 @@ static void vnc_connect(VncDisplay *vd, QIOChannelSocket *sioc,
     VNC_DEBUG("Client sioc=%p ws=%d auth=%d subauth=%d\n",
               sioc, websocket, vs->auth, vs->subauth);
 
-    vs->lossy_rect = g_malloc0(VNC_STAT_ROWS * sizeof (*vs->lossy_rect));
-    for (i = 0; i < VNC_STAT_ROWS; ++i) {
-        vs->lossy_rect[i] = g_new0(uint8_t, VNC_STAT_COLS);
-    }
-
     VNC_DEBUG("New client on socket %p\n", vs->sioc);
     update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_BASE);
     qio_channel_set_blocking(vs->ioc, false, NULL);
diff --git a/ui/vnc.h b/ui/vnc.h
index 8df0cbab25..f2dab2f4d9 100644
--- a/ui/vnc.h
+++ b/ui/vnc.h
@@ -272,8 +272,6 @@ struct VncState
     gboolean disconnecting;
 
     DECLARE_BITMAP(dirty[VNC_MAX_HEIGHT], VNC_DIRTY_BITS);
-    uint8_t **lossy_rect; /* Not an Array to avoid costly memcpy in
-                           * vnc-jobs-async.c */
 
     VncDisplay *vd;
     VncStateUpdate update; /* Most recent pending request from client */
@@ -341,10 +339,7 @@ struct VncState
     /* Encoding specific, if you add something here, don't forget to
      *  update vnc_async_encoding_start()
      */
-    VncTight *tight;
-    VncZlib *zlib;
     VncHextile hextile;
-    VncZrle *zrle;
     VncZywrle zywrle;
 
     Notifier mouse_mode_notifier;
@@ -356,6 +351,19 @@ struct VncState
     QTAILQ_ENTRY(VncState) next;
 };
 
+typedef struct VncWorker {
+    uint8_t lossy_rect[VNC_STAT_ROWS][VNC_STAT_COLS];
+
+    VncTight tight;
+    VncZlib zlib;
+    VncZrle zrle;
+} VncWorker;
+
+typedef struct VncConnection {
+    VncState vs;
+    VncWorker worker;
+} VncConnection;
+
 
 /*****************************************************************************
  *
@@ -602,10 +610,11 @@ int vnc_server_fb_stride(VncDisplay *vd);
 
 void vnc_convert_pixel(VncState *vs, uint8_t *buf, uint32_t v);
 double vnc_update_freq(VncState *vs, int x, int y, int w, int h);
-void vnc_sent_lossy_rect(VncState *vs, int x, int y, int w, int h);
+void vnc_sent_lossy_rect(VncWorker *worker, int x, int y, int w, int h);
 
 /* Encodings */
-int vnc_send_framebuffer_update(VncState *vs, int x, int y, int w, int h);
+int vnc_send_framebuffer_update(VncState *vs, VncWorker *worker,
+                                int x, int y, int w, int h);
 
 int vnc_raw_send_framebuffer_update(VncState *vs, int x, int y, int w, int h);
 
@@ -615,17 +624,21 @@ void vnc_hextile_set_pixel_conversion(VncState *vs, int generic);
 
 void *vnc_zlib_zalloc(void *x, unsigned items, unsigned size);
 void vnc_zlib_zfree(void *x, void *addr);
-int vnc_zlib_send_framebuffer_update(VncState *vs, int x, int y, int w, int h);
-void vnc_zlib_clear(VncState *vs);
+int vnc_zlib_send_framebuffer_update(VncState *vs, VncWorker *worker,
+                                     int x, int y, int w, int h);
+void vnc_zlib_clear(VncWorker *worker);
 
-int vnc_tight_send_framebuffer_update(VncState *vs, int x, int y, int w, int h);
-int vnc_tight_png_send_framebuffer_update(VncState *vs, int x, int y,
-                                          int w, int h);
-void vnc_tight_clear(VncState *vs);
+int vnc_tight_send_framebuffer_update(VncState *vs, VncWorker *worker,
+                                      int x, int y, int w, int h);
+int vnc_tight_png_send_framebuffer_update(VncState *vs, VncWorker *worker,
+                                          int x, int y, int w, int h);
+void vnc_tight_clear(VncWorker *worker);
 
-int vnc_zrle_send_framebuffer_update(VncState *vs, int x, int y, int w, int h);
-int vnc_zywrle_send_framebuffer_update(VncState *vs, int x, int y, int w, int h);
-void vnc_zrle_clear(VncState *vs);
+int vnc_zrle_send_framebuffer_update(VncState *vs, VncWorker *worker,
+                                     int x, int y, int w, int h);
+int vnc_zywrle_send_framebuffer_update(VncState *vs, VncWorker *worker,
+                                       int x, int y, int w, int h);
+void vnc_zrle_clear(VncWorker *worker);
 
 /* vnc-clipboard.c */
 void vnc_server_cut_text_caps(VncState *vs);

From 46c798f0471ca341ce607b5ca15f76b001712f3f Mon Sep 17 00:00:00 2001
From: Vivek Kasireddy <vivek.kasireddy@intel.com>
Date: Mon, 16 Jun 2025 21:32:25 -0700
Subject: [PATCH 2269/2760] ui/egl-helpers: Error check the fds in
 egl_dmabuf_export_texture()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

While trying to export and obtain fds associated with a texture, it
is possible that the fds returned after eglExportDMABUFImageMESA()
call have error values. Therefore, we need to evaluate the value of
all fds and return false if any of them are negative.

Cc: Gerd Hoffmann <kraxel@redhat.com>
Cc: Marc-André Lureau <marcandre.lureau@redhat.com>
Cc: Dmitry Osipenko <dmitry.osipenko@collabora.com>
Cc: Frediano Ziglio <freddy77@gmail.com>
Cc: Dongwon Kim <dongwon.kim@intel.com>
Cc: Michael Scherle <michael.scherle@rz.uni-freiburg.de>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Vivek Kasireddy <vivek.kasireddy@intel.com>
Message-Id: <20250617043546.1022779-2-vivek.kasireddy@intel.com>
---
 ui/egl-helpers.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/ui/egl-helpers.c b/ui/egl-helpers.c
index 5503a795e4..e3f2872cc1 100644
--- a/ui/egl-helpers.c
+++ b/ui/egl-helpers.c
@@ -295,6 +295,7 @@ bool egl_dmabuf_export_texture(uint32_t tex_id, int *fd, EGLint *offset,
 {
     EGLImageKHR image;
     EGLuint64KHR modifiers[DMABUF_MAX_PLANES];
+    int i;
 
     image = eglCreateImageKHR(qemu_egl_display, eglGetCurrentContext(),
                               EGL_GL_TEXTURE_2D_KHR,
@@ -314,6 +315,11 @@ bool egl_dmabuf_export_texture(uint32_t tex_id, int *fd, EGLint *offset,
         *modifier = modifiers[0];
     }
 
+    for (i = 0; i < *num_planes; i++) {
+        if (fd[i] < 0) {
+            return false;
+        }
+    }
     return true;
 }
 

From 376d4b22e4d7dd81cb0c1ea1dfe1db0a0dc4b0e2 Mon Sep 17 00:00:00 2001
From: Vivek Kasireddy <vivek.kasireddy@intel.com>
Date: Mon, 16 Jun 2025 21:32:26 -0700
Subject: [PATCH 2270/2760] ui/spice: Enable gl=on option for non-local or
 remote clients
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Newer versions of Spice server should be able to accept dmabuf
fds from Qemu for clients that are connected via the network.
In other words, when this option is enabled, Qemu would share
a dmabuf fd with Spice which would encode and send the data
associated with the fd to a client that could be located on
a different machine.

Cc: Gerd Hoffmann <kraxel@redhat.com>
Cc: Marc-André Lureau <marcandre.lureau@redhat.com>
Cc: Dmitry Osipenko <dmitry.osipenko@collabora.com>
Cc: Frediano Ziglio <freddy77@gmail.com>
Cc: Dongwon Kim <dongwon.kim@intel.com>
Cc: Michael Scherle <michael.scherle@rz.uni-freiburg.de>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Vivek Kasireddy <vivek.kasireddy@intel.com>
Message-Id: <20250617043546.1022779-3-vivek.kasireddy@intel.com>
---
 include/ui/spice-display.h | 1 +
 ui/spice-core.c            | 4 ++++
 ui/spice-display.c         | 1 +
 3 files changed, 6 insertions(+)

diff --git a/include/ui/spice-display.h b/include/ui/spice-display.h
index e1a9b36185..6c55f38c8b 100644
--- a/include/ui/spice-display.h
+++ b/include/ui/spice-display.h
@@ -151,6 +151,7 @@ struct SimpleSpiceCursor {
 };
 
 extern bool spice_opengl;
+extern bool spice_remote_client;
 
 int qemu_spice_rect_is_empty(const QXLRect* r);
 void qemu_spice_rect_union(QXLRect *dest, const QXLRect *r);
diff --git a/ui/spice-core.c b/ui/spice-core.c
index 0326c63bec..5acbdd3955 100644
--- a/ui/spice-core.c
+++ b/ui/spice-core.c
@@ -836,9 +836,13 @@ static void qemu_spice_init(void)
 #ifdef HAVE_SPICE_GL
     if (qemu_opt_get_bool(opts, "gl", 0)) {
         if ((port != 0) || (tls_port != 0)) {
+#if SPICE_SERVER_VERSION >= 0x000f03 /* release 0.15.3 */
+            spice_remote_client = 1;
+#else
             error_report("SPICE GL support is local-only for now and "
                          "incompatible with -spice port/tls-port");
             exit(1);
+#endif
         }
         egl_init(qemu_opt_get(opts, "rendernode"), DISPLAY_GL_MODE_ON, &error_fatal);
         spice_opengl = 1;
diff --git a/ui/spice-display.c b/ui/spice-display.c
index 9c39d2c5c8..0fb72f6d6f 100644
--- a/ui/spice-display.c
+++ b/ui/spice-display.c
@@ -31,6 +31,7 @@
 #include "standard-headers/drm/drm_fourcc.h"
 
 bool spice_opengl;
+bool spice_remote_client;
 
 int qemu_spice_rect_is_empty(const QXLRect* r)
 {

From 95b3be1965779e77a12a95d531914fa0fecc24ec Mon Sep 17 00:00:00 2001
From: John Snow <jsnow@redhat.com>
Date: Fri, 11 Jul 2025 01:39:48 -0400
Subject: [PATCH 2271/2760] qapi: add cross-references to acpi.json

Signed-off-by: John Snow <jsnow@redhat.com>
Message-ID: <20250711054005.60969-2-jsnow@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
---
 qapi/acpi.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/qapi/acpi.json b/qapi/acpi.json
index 90f8f564fd..906b3687a5 100644
--- a/qapi/acpi.json
+++ b/qapi/acpi.json
@@ -108,7 +108,7 @@
 ##
 # @query-acpi-ospm-status:
 #
-# Return a list of ACPIOSTInfo for devices that support status
+# Return a list of `ACPIOSTInfo` for devices that support status
 # reporting via ACPI _OST method.
 #
 # Since: 2.1

From a724defe3213999db735496daee94abb52e93f43 Mon Sep 17 00:00:00 2001
From: John Snow <jsnow@redhat.com>
Date: Fri, 11 Jul 2025 01:39:49 -0400
Subject: [PATCH 2272/2760] qapi: add cross-references to authz.json

Signed-off-by: John Snow <jsnow@redhat.com>
Message-ID: <20250711054005.60969-3-jsnow@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
---
 qapi/authz.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/qapi/authz.json b/qapi/authz.json
index ad1b4b3af0..bc1123cc05 100644
--- a/qapi/authz.json
+++ b/qapi/authz.json
@@ -77,7 +77,7 @@
 # Properties for authz-listfile objects.
 #
 # @filename: File name to load the configuration from.  The file must
-#     contain valid JSON for AuthZListProperties.
+#     contain valid JSON for `AuthZListProperties`.
 #
 # @refresh: If true, inotify is used to monitor the file,
 #     automatically reloading changes.  If an error occurs during

From a3763337ad0f4e6252abc894a8bbced11ddf3998 Mon Sep 17 00:00:00 2001
From: John Snow <jsnow@redhat.com>
Date: Fri, 11 Jul 2025 01:39:50 -0400
Subject: [PATCH 2273/2760] qapi: add cross-references to block layer

Signed-off-by: John Snow <jsnow@redhat.com>
Message-ID: <20250711054005.60969-4-jsnow@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
[Two unwanted cross-references dropped]
Signed-off-by: Markus Armbruster <armbru@redhat.com>
---
 qapi/block-core.json   | 184 ++++++++++++++++++++---------------------
 qapi/block-export.json |  36 ++++----
 qapi/block.json        |  14 ++--
 qapi/transaction.json  |  12 +--
 4 files changed, 123 insertions(+), 123 deletions(-)

diff --git a/qapi/block-core.json b/qapi/block-core.json
index 848ebaff5a..25b57919a7 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
@@ -32,7 +32,7 @@
 # @icount: Current instruction count.  Appears when execution
 #     record/replay is enabled.  Used for "time-traveling" to match
 #     the moment in the recorded execution with the snapshots.  This
-#     counter may be obtained through @query-replay command
+#     counter may be obtained through `query-replay` command
 #     (since 5.2)
 #
 # Since: 1.3
@@ -224,7 +224,7 @@
 { 'struct': 'ImageInfoSpecificLUKSWrapper',
   'data': { 'data': 'QCryptoBlockInfoLUKS' } }
 # If we need to add block driver specific parameters for
-# LUKS in future, then we'll subclass QCryptoBlockInfoLUKS
+# LUKS in future, then we'll subclass `QCryptoBlockInfoLUKS`
 # to define a ImageInfoSpecificLUKS
 
 ##
@@ -333,7 +333,7 @@
 # node, annotated with information about that node in relation to its
 # parent.
 #
-# @name: Child name of the root node in the BlockGraphInfo struct, in
+# @name: Child name of the root node in the `BlockGraphInfo` struct, in
 #     its role as the child of some undescribed parent node
 #
 # @info: Block graph information starting at this node
@@ -350,7 +350,7 @@
 # @BlockGraphInfo:
 #
 # Information about all nodes in a block (sub)graph in the form of
-# BlockNodeInfo data.  The base BlockNodeInfo struct contains the
+# `BlockNodeInfo` data.  The base `BlockNodeInfo` struct contains the
 # information for the (sub)graph's root node.
 #
 # @children: Array of links to this node's child nodes' information
@@ -615,7 +615,7 @@
 # @inconsistent: true if this is a persistent bitmap that was
 #     improperly stored.  Implies @persistent to be true; @recording
 #     and @busy to be false.  This bitmap cannot be used.  To remove
-#     it, use @block-dirty-bitmap-remove.  (Since 4.0)
+#     it, use `block-dirty-bitmap-remove`.  (Since 4.0)
 #
 # Since: 1.3
 ##
@@ -710,12 +710,12 @@
 # @tray_open: True if the device's tray is open (only present if it
 #     has a tray)
 #
-# @io-status: @BlockDeviceIoStatus.  Only present if the device
+# @io-status: `BlockDeviceIoStatus`.  Only present if the device
 #     supports it and the VM is configured to stop on errors
 #     (supported device models: virtio-blk, IDE, SCSI except
 #     scsi-generic)
 #
-# @inserted: @BlockDeviceInfo describing the device if media is
+# @inserted: `BlockDeviceInfo` describing the device if media is
 #     present
 #
 # Since: 0.14
@@ -762,7 +762,7 @@
 ##
 # @query-block:
 #
-# Get a list of BlockInfo for all virtual block devices.
+# Get a list of `BlockInfo` for all virtual block devices.
 #
 # Returns: a list describing each virtual block device.
 #     Filter nodes that were created implicitly are skipped over.
@@ -1027,14 +1027,14 @@
 # @timed_stats: Statistics specific to the set of previously defined
 #     intervals of time (Since 2.5)
 #
-# @rd_latency_histogram: @BlockLatencyHistogramInfo.  (Since 4.0)
+# @rd_latency_histogram: `BlockLatencyHistogramInfo`.  (Since 4.0)
 #
-# @wr_latency_histogram: @BlockLatencyHistogramInfo.  (Since 4.0)
+# @wr_latency_histogram: `BlockLatencyHistogramInfo`.  (Since 4.0)
 #
-# @zone_append_latency_histogram: @BlockLatencyHistogramInfo.
+# @zone_append_latency_histogram: `BlockLatencyHistogramInfo`.
 #     (since 8.1)
 #
-# @flush_latency_histogram: @BlockLatencyHistogramInfo.  (Since 4.0)
+# @flush_latency_histogram: `BlockLatencyHistogramInfo`.  (Since 4.0)
 #
 # Since: 0.14
 ##
@@ -1135,7 +1135,7 @@
 # @qdev: The qdev ID, or if no ID is assigned, the QOM path of the
 #     block device.  (since 3.0)
 #
-# @stats: A @BlockDeviceStats for the device.
+# @stats: A `BlockDeviceStats` for the device.
 #
 # @driver-specific: Optional driver-specific stats.  (Since 4.2)
 #
@@ -1159,7 +1159,7 @@
 ##
 # @query-blockstats:
 #
-# Query the @BlockStats for all virtual block devices.
+# Query the `BlockStats` for all virtual block devices.
 #
 # @query-nodes: If true, the command will query all the block nodes
 #     that have a node name, in a list which will include "parent"
@@ -1290,8 +1290,8 @@
 # @report: for guest operations, report the error to the guest; for
 #     jobs, cancel the job
 #
-# @ignore: ignore the error, only report a QMP event (BLOCK_IO_ERROR
-#     or BLOCK_JOB_ERROR).  The backup, mirror and commit block jobs
+# @ignore: ignore the error, only report a QMP event (`BLOCK_IO_ERROR`
+#     or `BLOCK_JOB_ERROR`).  The backup, mirror and commit block jobs
 #     retry the failing request later and may still complete
 #     successfully.  The stream block job continues to stream and will
 #     complete with an error.
@@ -1324,7 +1324,7 @@
 #     (since: 2.4)
 #
 # @bitmap: only copy data described by the dirty bitmap.  Behavior on
-#     completion is determined by the BitmapSyncMode.  (since: 4.2)
+#     completion is determined by the `BitmapSyncMode`.  (since: 4.2)
 #
 # Since: 1.3
 ##
@@ -1531,7 +1531,7 @@
 # @overlay: reference to the existing block device that will become
 #     the overlay of @node, as part of taking the snapshot.  It must
 #     not have a current backing file (this can be achieved by passing
-#     "backing": null to blockdev-add).
+#     "backing": null to `blockdev-add`).
 #
 # Since: 2.5
 ##
@@ -1586,7 +1586,7 @@
 # @bitmap: The name of a dirty bitmap to use.  Must be present if sync
 #     is "bitmap" or "incremental".  Can be present if sync is "full"
 #     or "top".  Must not be present otherwise.
-#     (Since 2.4 (drive-backup), 3.1 (blockdev-backup))
+#     (Since 2.4 (`drive-backup`), 3.1 (`blockdev-backup`))
 #
 # @bitmap-mode: Specifies the type of data the bitmap should contain
 #     after the operation concludes.  Must be present if a bitmap was
@@ -1597,7 +1597,7 @@
 #
 # @on-source-error: the action to take on an error on the source,
 #     default 'report'.  'stop' and 'enospc' can only be used if the
-#     block device supports io-status (see BlockInfo).
+#     block device supports io-status (see `BlockInfo`).
 #
 # @on-target-error: the action to take on an error on the target,
 #     default 'report' (no limitations, since this applies to a
@@ -1607,14 +1607,14 @@
 #     copy-before-write jobs; defaults to break-guest-write.  (Since 10.1)
 #
 # @auto-finalize: When false, this job will wait in a PENDING state
-#     after it has finished its work, waiting for @job-finalize before
+#     after it has finished its work, waiting for `job-finalize` before
 #     making any block graph changes.  When true, this job will
 #     automatically perform its abort or commit actions.  Defaults to
 #     true.  (Since 2.12)
 #
 # @auto-dismiss: When false, this job will wait in a CONCLUDED state
 #     after it has completely ceased all work, and awaits
-#     @job-dismiss.  When true, this job will automatically disappear
+#     `job-dismiss`.  When true, this job will automatically disappear
 #     without user intervention.  Defaults to true.  (Since 2.12)
 #
 # @filter-node-name: the node name that should be assigned to the
@@ -1720,7 +1720,7 @@
 #
 # @allow-write-only-overlay: If present, the check whether this
 #     operation is safe was relaxed so that it can be used to change
-#     backing file of a destination of a blockdev-mirror.  (since 5.0)
+#     backing file of a destination of a `blockdev-mirror`.  (since 5.0)
 #
 # Since: 2.5
 #
@@ -1785,7 +1785,7 @@
 # If top == base, that is an error.  If top has no overlays on top of
 # it, or if it is in use by a writer, the job will not be completed by
 # itself.  The user needs to complete the job with the
-# job-complete command after getting the ready event.  (Since 2.0)
+# `job-complete` command after getting the ready event.  (Since 2.0)
 #
 # If the base image is smaller than top, then the base image will be
 # resized to be the same size as top.  If top is smaller than the base
@@ -1847,14 +1847,14 @@
 #     autogenerated.  (Since: 2.9)
 #
 # @auto-finalize: When false, this job will wait in a PENDING state
-#     after it has finished its work, waiting for @job-finalize before
+#     after it has finished its work, waiting for `job-finalize` before
 #     making any block graph changes.  When true, this job will
 #     automatically perform its abort or commit actions.  Defaults to
 #     true.  (Since 3.1)
 #
 # @auto-dismiss: When false, this job will wait in a CONCLUDED state
 #     after it has completely ceased all work, and awaits
-#     @job-dismiss.  When true, this job will automatically disappear
+#     `job-dismiss`.  When true, this job will automatically disappear
 #     without user intervention.  Defaults to true.  (Since 3.1)
 #
 # Features:
@@ -1890,14 +1890,14 @@
 # @drive-backup:
 #
 # Start a point-in-time copy of a block device to a new destination.
-# The status of ongoing drive-backup operations can be checked with
-# query-block-jobs where the BlockJobInfo.type field has the value
+# The status of ongoing `drive-backup` operations can be checked with
+# `query-block-jobs` where the `BlockJobInfo`.type field has the value
 # 'backup'.  The operation can be stopped before it has completed
-# using the job-cancel or block-job-cancel command.
+# using the `job-cancel` or `block-job-cancel` command.
 #
 # Features:
 #
-# @deprecated: This command is deprecated.  Use @blockdev-backup
+# @deprecated: This command is deprecated.  Use `blockdev-backup`
 #     instead.
 #
 # Errors:
@@ -1921,10 +1921,10 @@
 # @blockdev-backup:
 #
 # Start a point-in-time copy of a block device to a new destination.
-# The status of ongoing blockdev-backup operations can be checked with
-# query-block-jobs where the BlockJobInfo.type field has the value
+# The status of ongoing `blockdev-backup` operations can be checked with
+# `query-block-jobs` where the `BlockJobInfo`.type field has the value
 # 'backup'.  The operation can be stopped before it has completed
-# using the job-cancel or block-job-cancel command.
+# using the `job-cancel` or `block-job-cancel` command.
 #
 # Errors:
 #     - If @device is not a valid block device, DeviceNotFound
@@ -2025,7 +2025,7 @@
 # @XDbgBlockGraphNode:
 #
 # @id: Block graph node identifier.  This @id is generated only for
-#     x-debug-query-block-graph and does not relate to any other
+#     `x-debug-query-block-graph` and does not relate to any other
 #     identifiers in QEMU.
 #
 # @type: Type of graph node.  Can be one of block-backend, block-job
@@ -2074,7 +2074,7 @@
 ##
 # @XDbgBlockGraphEdge:
 #
-# Block Graph edge description for x-debug-query-block-graph.
+# Block Graph edge description for `x-debug-query-block-graph`.
 #
 # @parent: parent id
 #
@@ -2192,7 +2192,7 @@
 #
 # @on-source-error: the action to take on an error on the source,
 #     default 'report'.  'stop' and 'enospc' can only be used if the
-#     block device supports io-status (see BlockInfo).
+#     block device supports io-status (see `BlockInfo`).
 #
 # @on-target-error: the action to take on an error on the target,
 #     default 'report' (no limitations, since this applies to a
@@ -2208,14 +2208,14 @@
 #     'background' (Since: 3.0)
 #
 # @auto-finalize: When false, this job will wait in a PENDING state
-#     after it has finished its work, waiting for @job-finalize before
+#     after it has finished its work, waiting for `job-finalize` before
 #     making any block graph changes.  When true, this job will
 #     automatically perform its abort or commit actions.  Defaults to
 #     true.  (Since 3.1)
 #
 # @auto-dismiss: When false, this job will wait in a CONCLUDED state
 #     after it has completely ceased all work, and awaits
-#     @job-dismiss.  When true, this job will automatically disappear
+#     `job-dismiss`.  When true, this job will automatically disappear
 #     without user intervention.  Defaults to true.  (Since 3.1)
 #
 # Since: 1.3
@@ -2250,16 +2250,16 @@
 # @name: name of the dirty bitmap (must be less than 1024 bytes)
 #
 # @granularity: the bitmap granularity, default is 64k for
-#     block-dirty-bitmap-add
+#     `block-dirty-bitmap-add`
 #
 # @persistent: the bitmap is persistent, i.e. it will be saved to the
 #     corresponding block device image file on its close.  For now
 #     only Qcow2 disks support persistent bitmaps.  Default is false
-#     for block-dirty-bitmap-add.  (Since: 2.10)
+#     for `block-dirty-bitmap-add`.  (Since: 2.10)
 #
 # @disabled: the bitmap is created in the disabled state, which means
 #     that it will not track drive changes.  The bitmap may be enabled
-#     with block-dirty-bitmap-enable.  Default is false.  (Since: 4.0)
+#     with `block-dirty-bitmap-enable`.  Default is false.  (Since: 4.0)
 #
 # Since: 2.4
 ##
@@ -2289,7 +2289,7 @@
 # @target: name of the destination dirty bitmap
 #
 # @bitmaps: name(s) of the source dirty bitmap(s) at @node and/or
-#     fully specified BlockDirtyBitmap elements.  The latter are
+#     fully specified `BlockDirtyBitmap` elements.  The latter are
 #     supported since 4.1.
 #
 # Since: 4.0
@@ -2324,7 +2324,7 @@
 # @block-dirty-bitmap-remove:
 #
 # Stop write tracking and remove the dirty bitmap that was created
-# with block-dirty-bitmap-add.  If the bitmap is persistent, remove it
+# with `block-dirty-bitmap-add`.  If the bitmap is persistent, remove it
 # from its storage too.
 #
 # Errors:
@@ -2508,7 +2508,7 @@
 #
 # @on-source-error: the action to take on an error on the source,
 #     default 'report'.  'stop' and 'enospc' can only be used if the
-#     block device supports io-status (see BlockInfo).
+#     block device supports io-status (see `BlockInfo`).
 #
 # @on-target-error: the action to take on an error on the target,
 #     default 'report' (no limitations, since this applies to a
@@ -2523,14 +2523,14 @@
 #     'background' (Since: 3.0)
 #
 # @auto-finalize: When false, this job will wait in a PENDING state
-#     after it has finished its work, waiting for @job-finalize before
+#     after it has finished its work, waiting for `job-finalize` before
 #     making any block graph changes.  When true, this job will
 #     automatically perform its abort or commit actions.  Defaults to
 #     true.  (Since 3.1)
 #
 # @auto-dismiss: When false, this job will wait in a CONCLUDED state
 #     after it has completely ceased all work, and awaits
-#     @job-dismiss.  When true, this job will automatically disappear
+#     `job-dismiss`.  When true, this job will automatically disappear
 #     without user intervention.  Defaults to true.  (Since 3.1)
 #
 # @target-is-zero: Assume the destination reads as all zeroes before
@@ -2778,9 +2778,9 @@
 # The block streaming operation is performed in the background until
 # the entire backing file has been copied.  This command returns
 # immediately once streaming has started.  The status of ongoing block
-# streaming operations can be checked with query-block-jobs.  The
+# streaming operations can be checked with `query-block-jobs`.  The
 # operation can be stopped before it has completed using the
-# job-cancel or block-job-cancel command.
+# `job-cancel` or `block-job-cancel` command.
 #
 # The node that receives the data is called the top image, can be
 # located in any part of the chain (but always above the base image;
@@ -2799,9 +2799,9 @@
 # will be the new backing file.
 #
 # On successful completion the image file is updated to drop the
-# backing file and the BLOCK_JOB_COMPLETED event is emitted.
+# backing file and the `BLOCK_JOB_COMPLETED` event is emitted.
 #
-# In case @device is a filter node, block-stream modifies the first
+# In case @device is a filter node, `block-stream` modifies the first
 # non-filter overlay node below it to point to the new backing node
 # instead of modifying @device itself.
 #
@@ -2842,7 +2842,7 @@
 #
 # @on-error: the action to take on an error (default report).  'stop'
 #     and 'enospc' can only be used if the block device supports
-#     io-status (see BlockInfo).  (Since 1.3)
+#     io-status (see `BlockInfo`).  (Since 1.3)
 #
 # @filter-node-name: the node name that should be assigned to the
 #     filter driver that the stream job inserts into the graph above
@@ -2850,14 +2850,14 @@
 #     autogenerated.  (Since: 6.0)
 #
 # @auto-finalize: When false, this job will wait in a PENDING state
-#     after it has finished its work, waiting for @job-finalize before
+#     after it has finished its work, waiting for `job-finalize` before
 #     making any block graph changes.  When true, this job will
 #     automatically perform its abort or commit actions.  Defaults to
 #     true.  (Since 3.1)
 #
 # @auto-dismiss: When false, this job will wait in a CONCLUDED state
 #     after it has completely ceased all work, and awaits
-#     @job-dismiss.  When true, this job will automatically disappear
+#     `job-dismiss`.  When true, this job will automatically disappear
 #     without user intervention.  Defaults to true.  (Since 3.1)
 #
 # Errors:
@@ -2918,13 +2918,13 @@
 # command if no operation is in progress.
 #
 # The operation will cancel as soon as possible and then emit the
-# BLOCK_JOB_CANCELLED event.  Before that happens the job is still
-# visible when enumerated using query-block-jobs.
+# `BLOCK_JOB_CANCELLED` event.  Before that happens the job is still
+# visible when enumerated using `query-block-jobs`.
 #
-# Note that if you issue 'block-job-cancel' after 'drive-mirror' has
-# indicated (via the event BLOCK_JOB_READY) that the source and
+# Note that if you issue `block-job-cancel` after `drive-mirror` has
+# indicated (via the event `BLOCK_JOB_READY`) that the source and
 # destination are synchronized, then the event triggered by this
-# command changes to BLOCK_JOB_COMPLETED, to indicate that the
+# command changes to `BLOCK_JOB_COMPLETED`, to indicate that the
 # mirroring has ended and the destination now has a point-in-time copy
 # tied to the time of the cancellation.
 #
@@ -2938,7 +2938,7 @@
 #     values.
 #
 # @force: If true, and the job has already emitted the event
-#     BLOCK_JOB_READY, abandon the job immediately (even if it is
+#     `BLOCK_JOB_READY`, abandon the job immediately (even if it is
 #     paused) instead of waiting for the destination to complete its
 #     final synchronization (since 1.3)
 #
@@ -2961,7 +2961,7 @@
 #
 # The job will pause as soon as possible, which means transitioning
 # into the PAUSED state if it was RUNNING, or into STANDBY if it was
-# READY.  The corresponding JOB_STATUS_CHANGE event will be emitted.
+# READY.  The corresponding `JOB_STATUS_CHANGE` event will be emitted.
 #
 # Cancelling a paused job automatically resumes it.
 #
@@ -2971,7 +2971,7 @@
 #
 # Features:
 #
-# @deprecated: This command is deprecated.  Use @job-pause
+# @deprecated: This command is deprecated.  Use `job-pause`
 #     instead.
 #
 # Errors:
@@ -3000,7 +3000,7 @@
 #
 # Features:
 #
-# @deprecated: This command is deprecated.  Use @job-resume
+# @deprecated: This command is deprecated.  Use `job-resume`
 #     instead.
 #
 # Errors:
@@ -3021,14 +3021,14 @@
 #
 # This is supported only for drive mirroring, where it also switches
 # the device to write to the target path only.  Note that drive
-# mirroring includes drive-mirror, blockdev-mirror and block-commit
+# mirroring includes `drive-mirror`, `blockdev-mirror` and `block-commit`
 # job (only in case of "active commit", when the node being commited
 # is used by the guest).  The ability to complete is signaled with a
-# BLOCK_JOB_READY event.
+# `BLOCK_JOB_READY` event.
 #
 # This command completes an active background block operation
 # synchronously.  The ordering of this command's return with the
-# BLOCK_JOB_COMPLETED event is not defined.  Note that if an I/O error
+# `BLOCK_JOB_COMPLETED` event is not defined.  Note that if an I/O error
 # occurs during the processing of this command: 1) the command itself
 # will fail; 2) the error will be processed according to the
 # rerror/werror arguments that were specified when starting the
@@ -3040,7 +3040,7 @@
 #
 # Features:
 #
-# @deprecated: This command is deprecated.  Use @job-complete
+# @deprecated: This command is deprecated.  Use `job-complete`
 #     instead.
 #
 # Errors:
@@ -3059,21 +3059,21 @@
 # Deletes a job that is in the CONCLUDED state.  This command only
 # needs to be run explicitly for jobs that don't have automatic
 # dismiss enabled.  In turn, automatic dismiss may be enabled only
-# for jobs that have @auto-dismiss option, which are drive-backup,
-# blockdev-backup, drive-mirror, blockdev-mirror, block-commit and
-# block-stream.  @auto-dismiss is enabled by default for these
+# for jobs that have @auto-dismiss option, which are `drive-backup`,
+# `blockdev-backup`, `drive-mirror`, `blockdev-mirror`, `block-commit` and
+# `block-stream`.  @auto-dismiss is enabled by default for these
 # jobs.
 #
 # This command will refuse to operate on any job that has not yet
 # reached its terminal state, CONCLUDED.  For jobs that make use of
-# the BLOCK_JOB_READY event, job-cancel, block-job-cancel or
-# job-complete will still need to be used as appropriate.
+# the `BLOCK_JOB_READY` event, `job-cancel`, `block-job-cancel` or
+# `job-complete` will still need to be used as appropriate.
 #
 # @id: The job identifier.
 #
 # Features:
 #
-# @deprecated: This command is deprecated.  Use @job-dismiss
+# @deprecated: This command is deprecated.  Use `job-dismiss`
 #     instead.
 #
 # Since: 2.12
@@ -3101,7 +3101,7 @@
 #
 # Features:
 #
-# @deprecated: This command is deprecated.  Use @job-finalize
+# @deprecated: This command is deprecated.  Use `job-finalize`
 #     instead.
 #
 # Since: 2.12
@@ -3173,7 +3173,7 @@
 # @on: Enabled
 #
 # @unmap: Enabled and even try to unmap blocks if possible.  This
-#     requires also that @BlockdevDiscardOptions is set to unmap for
+#     requires also that `BlockdevDiscardOptions` is set to unmap for
 #     this device.
 #
 # Since: 2.1
@@ -4715,7 +4715,7 @@
 # @driver: block driver name
 #
 # @node-name: the node name of the new node.  This option is required
-#     on the top level of blockdev-add.  Valid node names start with
+#     on the top level of `blockdev-add`.  Valid node names start with
 #     an alphabetic character and may contain only alphanumeric
 #     characters, '-', '.' and '_'.  Their maximum length is 31
 #     characters.  (Since 2.0)
@@ -4919,7 +4919,7 @@
 # cancelled.
 #
 # The command receives a list of block devices to reopen.  For each
-# one of them, the top-level @node-name option (from BlockdevOptions)
+# one of them, the top-level @node-name option (from `BlockdevOptions`)
 # must be specified and is used to select the block device to be
 # reopened.  Other @node-name options must be either omitted or set to
 # the current name of the appropriate node.  This command won't change
@@ -4928,7 +4928,7 @@
 # In the case of options that refer to child nodes, the behavior of
 # this command depends on the value:
 #
-#  1) A set of options (BlockdevOptions): the child is reopened with
+#  1) A set of options (`BlockdevOptions`): the child is reopened with
 #     the specified set of options.
 #
 #  2) A reference to the current child: the child is reopened using
@@ -4942,7 +4942,7 @@
 # Options (1) and (2) are supported in all cases.  Option (3) is
 # supported for @file and @backing, and option (4) for @backing only.
 #
-# Unlike with blockdev-add, the @backing option must always be present
+# Unlike with `blockdev-add`, the @backing option must always be present
 # unless the node being reopened does not have a backing file and its
 # image does not have a default backing file name as part of its
 # metadata.
@@ -4956,7 +4956,7 @@
 ##
 # @blockdev-del:
 #
-# Deletes a block device that has been added using blockdev-add.  The
+# Deletes a block device that has been added using `blockdev-add`.  The
 # command will fail if the node is attached to a device or is
 # otherwise being used.
 #
@@ -5511,7 +5511,7 @@
 # @blockdev-create:
 #
 # Starts a job to create an image format on a given node.  The job is
-# automatically finalized, but a manual job-dismiss is required.
+# automatically finalized, but a manual `job-dismiss` is required.
 #
 # @job-id: Identifier for the newly created job.
 #
@@ -5571,7 +5571,7 @@
 #
 # Starts a job to amend format specific options of an existing open
 # block device.  The job is automatically finalized, but a manual
-# job-dismiss is required.
+# `job-dismiss` is required.
 #
 # @job-id: Identifier for the newly created job.
 #
@@ -5640,10 +5640,10 @@
 #
 # @fatal: if set, the image is marked corrupt and therefore unusable
 #     after this event and must be repaired (Since 2.2; before, every
-#     BLOCK_IMAGE_CORRUPTED event was fatal)
+#     `BLOCK_IMAGE_CORRUPTED` event was fatal)
 #
-# .. note:: If action is "stop", a STOP event will eventually follow
-#    the BLOCK_IO_ERROR event.
+# .. note:: If action is "stop", a `STOP` event will eventually follow
+#    the `BLOCK_IO_ERROR` event.
 #
 # .. qmp-example::
 #
@@ -5684,15 +5684,15 @@
 #
 # @nospace: true if I/O error was caused due to a no-space condition.
 #     This key is only present if query-block's io-status is present,
-#     please see query-block documentation for more information
+#     please see `query-block` documentation for more information
 #     (since: 2.2)
 #
 # @reason: human readable string describing the error cause.  (This
 #     field is a debugging aid for humans, it should not be parsed by
 #     applications) (since: 2.2)
 #
-# .. note:: If action is "stop", a STOP event will eventually follow
-#    the BLOCK_IO_ERROR event.
+# .. note:: If action is "stop", a `STOP` event will eventually follow
+#    the `BLOCK_IO_ERROR` event.
 #
 # .. note:: This event is rate-limited.
 #
@@ -5834,7 +5834,7 @@
 # @speed: rate limit, bytes per second
 #
 # .. note:: The "ready to complete" status is always reset by a
-#    @BLOCK_JOB_ERROR event.
+#    `BLOCK_JOB_ERROR` event.
 #
 # Since: 1.3
 #
@@ -5856,7 +5856,7 @@
 # @BLOCK_JOB_PENDING:
 #
 # Emitted when a block job is awaiting explicit authorization to
-# finalize graph changes via @job-finalize.  If this job is part
+# finalize graph changes via `job-finalize`.  If this job is part
 # of a transaction, it will not emit this event until the transaction
 # has converged first.
 #
@@ -5905,7 +5905,7 @@
 # configured write threshold.  For thin-provisioned devices, this
 # means the device should be extended to avoid pausing for disk
 # exhaustion.  The event is one shot.  Once triggered, it needs to be
-# re-registered with another block-set-write-threshold command.
+# re-registered with another `block-set-write-threshold` command.
 #
 # @node-name: graph node name on which the threshold was exceeded.
 #
@@ -5976,7 +5976,7 @@
 #
 # TODO: Removing children from a quorum node means introducing
 #     gaps in the child indices.  This cannot be represented in the
-#     'children' list of BlockdevOptionsQuorum, as returned by
+#     'children' list of `BlockdevOptionsQuorum`, as returned by
 #     .bdrv_refresh_filename().
 #
 # Since: 2.7
@@ -6189,7 +6189,7 @@
 # Synchronously delete an internal snapshot of a block device, when
 # the format of the image used support it.  The snapshot is identified
 # by name or id or both.  One of the name or id is required.  Return
-# SnapshotInfo for the successfully deleted snapshot.
+# `SnapshotInfo` for the successfully deleted snapshot.
 #
 # @device: the device name or node-name of a root node to delete the
 #     snapshot from
diff --git a/qapi/block-export.json b/qapi/block-export.json
index fb004e35fd..6878b89dcf 100644
--- a/qapi/block-export.json
+++ b/qapi/block-export.json
@@ -38,9 +38,9 @@
 ##
 # @NbdServerOptions:
 #
-# Keep this type consistent with the NbdServerOptionsLegacy type.  The
-# only intended difference is using SocketAddress instead of
-# SocketAddressLegacy.
+# Keep this type consistent with the `NbdServerOptionsLegacy` type.  The
+# only intended difference is using `SocketAddress` instead of
+# `SocketAddressLegacy`.
 #
 # @addr: Address on which to listen (since 4.2).
 ##
@@ -51,9 +51,9 @@
 ##
 # @NbdServerOptionsLegacy:
 #
-# Keep this type consistent with the NbdServerOptions type.  The only
-# intended difference is using SocketAddressLegacy instead of
-# SocketAddress.
+# Keep this type consistent with the `NbdServerOptions` type.  The only
+# intended difference is using `SocketAddressLegacy` instead of
+# `SocketAddress`.
 #
 # @addr: Address on which to listen (since 1.3).
 ##
@@ -65,7 +65,7 @@
 # @nbd-server-start:
 #
 # Start an NBD server listening on the given host and port.  Block
-# devices can then be exported using @nbd-server-add.  The NBD server
+# devices can then be exported using `nbd-server-add`.  The NBD server
 # will present them as named exports; for example, another QEMU
 # instance could refer to them as "nbd:HOST:PORT:exportname=NAME".
 #
@@ -81,8 +81,8 @@
 ##
 # @BlockExportOptionsNbdBase:
 #
-# An NBD block export (common options shared between nbd-server-add
-# and the NBD branch of block-export-add).
+# An NBD block export (common options shared between `nbd-server-add`
+# and the NBD branch of `block-export-add`).
 #
 # @name: Export name.  If unspecified, the @device parameter is used
 #     as the export name.  (Since 2.12)
@@ -99,7 +99,7 @@
 # @BlockExportOptionsNbd:
 #
 # An NBD block export (distinct options used in the NBD branch of
-# block-export-add).
+# `block-export-add`).
 #
 # @bitmaps: Also export each of the named dirty bitmaps reachable from
 #     @device, so the NBD client can use NBD_OPT_SET_META_CONTEXT with
@@ -125,7 +125,7 @@
 # A vhost-user-blk block export.
 #
 # @addr: The vhost-user socket on which to listen.  Both 'unix' and
-#     'fd' SocketAddress types are supported.  Passed fds must be UNIX
+#     'fd' `SocketAddress` types are supported.  Passed fds must be UNIX
 #     domain sockets.
 #
 # @logical-block-size: Logical block size in bytes.  Defaults to 512
@@ -217,7 +217,7 @@
 ##
 # @NbdServerAddOptions:
 #
-# An NBD block export, per legacy nbd-server-add command.
+# An NBD block export, per legacy `nbd-server-add` command.
 #
 # @device: The device name or node name of the node to be exported
 #
@@ -246,7 +246,7 @@
 #
 # Features:
 #
-# @deprecated: This command is deprecated.  Use @block-export-add
+# @deprecated: This command is deprecated.  Use `block-export-add`
 #     instead.
 #
 # Errors:
@@ -289,12 +289,12 @@
 #
 # @name: Block export id.
 #
-# @mode: Mode of command operation.  See @BlockExportRemoveMode
+# @mode: Mode of command operation.  See `BlockExportRemoveMode`
 #     description.  Default is 'safe'.
 #
 # Features:
 #
-# @deprecated: This command is deprecated.  Use @block-export-del
+# @deprecated: This command is deprecated.  Use `block-export-del`
 #     instead.
 #
 # Errors:
@@ -313,7 +313,7 @@
 # @nbd-server-stop:
 #
 # Stop QEMU's embedded NBD server, and unregister all devices
-# previously added via @nbd-server-add.
+# previously added via `nbd-server-add`.
 #
 # Since: 1.3
 ##
@@ -422,7 +422,7 @@
 #
 # @id: Block export id.
 #
-# @mode: Mode of command operation.  See @BlockExportRemoveMode
+# @mode: Mode of command operation.  See `BlockExportRemoveMode`
 #     description.  Default is 'safe'.
 #
 # Errors:
@@ -460,7 +460,7 @@
 # @node-name: The node name of the block node that is exported
 #
 # @shutting-down: True if the export is shutting down (e.g. after a
-#     block-export-del command, but before the shutdown has completed)
+#     `block-export-del` command, but before the shutdown has completed)
 #
 # Since: 5.2
 ##
diff --git a/qapi/block.json b/qapi/block.json
index f0436ce871..46955bbb3e 100644
--- a/qapi/block.json
+++ b/qapi/block.json
@@ -140,7 +140,7 @@
 #
 # If the tray was already open before, this will be a no-op.
 #
-# Once the tray opens, a DEVICE_TRAY_MOVED event is emitted.  There
+# Once the tray opens, a `DEVICE_TRAY_MOVED` event is emitted.  There
 # are cases in which no such event will be generated, these include:
 #
 # - if the guest has locked the tray, @force is false and the guest
@@ -299,7 +299,7 @@
 # @BlockdevChangeReadOnlyMode:
 #
 # Specifies the new read-only mode of a block device subject to the
-# @blockdev-change-medium command.
+# `blockdev-change-medium` command.
 #
 # @retain: Retains the current read-only mode
 #
@@ -317,9 +317,9 @@
 #
 # Changes the medium inserted into a block device by ejecting the
 # current medium and loading a new image file which is inserted as the
-# new medium (this command combines blockdev-open-tray,
-# blockdev-remove-medium, blockdev-insert-medium and
-# blockdev-close-tray).
+# new medium (this command combines `blockdev-open-tray`,
+# `blockdev-remove-medium`, `blockdev-insert-medium` and
+# `blockdev-close-tray`).
 #
 # @device: Block device name
 #
@@ -334,7 +334,7 @@
 #     to 'retain'
 #
 # @force: if false (the default), an eject request through
-#     blockdev-open-tray will be sent to the guest if it has locked
+#     `blockdev-open-tray` will be sent to the guest if it has locked
 #     the tray (and the tray will not be opened immediately); if true,
 #     the tray will be opened regardless of whether it is locked.
 #     (since 7.1)
@@ -522,7 +522,7 @@
 # @id: The name or QOM path of the guest device.
 #
 # @boundaries: list of interval boundary values (see description in
-#     BlockLatencyHistogramInfo definition).  If specified, all
+#     `BlockLatencyHistogramInfo` definition).  If specified, all
 #     latency histograms are removed, and empty ones created for all
 #     io types with intervals corresponding to @boundaries (except for
 #     io types, for which specific boundaries are set through the
diff --git a/qapi/transaction.json b/qapi/transaction.json
index 927035f5a7..4b4eb09bf3 100644
--- a/qapi/transaction.json
+++ b/qapi/transaction.json
@@ -69,8 +69,8 @@
 #
 # Features:
 #
-# @deprecated: Member @drive-backup is deprecated.  Use member
-#     @blockdev-backup instead.
+# @deprecated: Member `drive-backup` is deprecated.  Use member
+#     `blockdev-backup` instead.
 #
 # Since: 1.1
 ##
@@ -158,7 +158,7 @@
 # @TransactionAction:
 #
 # A discriminated record of operations that can be performed with
-# @transaction.
+# `transaction`.
 #
 # @type: the operation to be performed
 #
@@ -189,7 +189,7 @@
 #
 # @completion-mode: Controls how jobs launched asynchronously by
 #     Actions will complete or fail as a group.  See
-#     @ActionCompletionMode for details.
+#     `ActionCompletionMode` for details.
 #
 # Since: 2.5
 ##
@@ -229,11 +229,11 @@
 # in the transaction.  When an I/O error occurs during deletion, the
 # user needs to fix it later with qemu-img or other command.
 #
-# @actions: List of @TransactionAction; information needed for the
+# @actions: List of `TransactionAction`; information needed for the
 #     respective operations.
 #
 # @properties: structure of additional options to control the
-#     execution of the transaction.  See @TransactionProperties for
+#     execution of the transaction.  See `TransactionProperties` for
 #     additional detail.
 #
 # Errors:

From ed17e68732d2efa4dc813a02de0bbf68ed40775c Mon Sep 17 00:00:00 2001
From: John Snow <jsnow@redhat.com>
Date: Fri, 11 Jul 2025 01:39:51 -0400
Subject: [PATCH 2274/2760] qapi: add cross-references to crypto.json

Signed-off-by: John Snow <jsnow@redhat.com>
Message-ID: <20250711054005.60969-5-jsnow@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
---
 qapi/crypto.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/qapi/crypto.json b/qapi/crypto.json
index 21006de36c..ab6eda4c2f 100644
--- a/qapi/crypto.json
+++ b/qapi/crypto.json
@@ -591,9 +591,9 @@
 #
 # Specific parameters for RSA algorithm.
 #
-# @hash-alg: QCryptoHashAlgo
+# @hash-alg: `QCryptoHashAlgo`
 #
-# @padding-alg: QCryptoRSAPaddingAlgo
+# @padding-alg: `QCryptoRSAPaddingAlgo`
 #
 # Since: 7.1
 ##

From dc79c02898dd5b2fdc9851f6c226421c701f6478 Mon Sep 17 00:00:00 2001
From: John Snow <jsnow@redhat.com>
Date: Fri, 11 Jul 2025 01:39:52 -0400
Subject: [PATCH 2275/2760] qapi: add cross-references to dump.json

Signed-off-by: John Snow <jsnow@redhat.com>
Message-ID: <20250711054005.60969-6-jsnow@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
---
 qapi/dump.json | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/qapi/dump.json b/qapi/dump.json
index dc92b53247..32c8c1f06e 100644
--- a/qapi/dump.json
+++ b/qapi/dump.json
@@ -112,7 +112,7 @@
 #
 # Describe the status of a long-running background guest memory dump.
 #
-# @none: no dump-guest-memory has started yet.
+# @none: no `dump-guest-memory` has started yet.
 #
 # @active: there is one dump running in background.
 #
@@ -128,9 +128,9 @@
 ##
 # @DumpQueryResult:
 #
-# The result format for 'query-dump'.
+# The result format for `query-dump`.
 #
-# @status: enum of @DumpStatus, which shows current dump status
+# @status: enum of `DumpStatus`, which shows current dump status
 #
 # @completed: bytes written in latest dump (uncompressed)
 #
@@ -186,7 +186,7 @@
 ##
 # @DumpGuestMemoryCapability:
 #
-# @formats: the available formats for dump-guest-memory
+# @formats: the available formats for `dump-guest-memory`
 #
 # Since: 2.0
 ##
@@ -197,9 +197,9 @@
 ##
 # @query-dump-guest-memory-capability:
 #
-# Return the available formats for dump-guest-memory
+# Return the available formats for `dump-guest-memory`
 #
-# Returns: An object listing available formats for dump-guest-memory
+# Returns: An object listing available formats for `dump-guest-memory`
 #
 # Since: 2.0
 #

From d1813fb4c4b052ec24814b7781431ee60bd57fdd Mon Sep 17 00:00:00 2001
From: John Snow <jsnow@redhat.com>
Date: Fri, 11 Jul 2025 01:39:53 -0400
Subject: [PATCH 2276/2760] qapi: add cross-references to job.json

Signed-off-by: John Snow <jsnow@redhat.com>
Message-ID: <20250711054005.60969-7-jsnow@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
[Accidental line rewrap and an unwanted cross-refence dropped]
Signed-off-by: Markus Armbruster <armbru@redhat.com>
---
 qapi/job.json | 56 +++++++++++++++++++++++++--------------------------
 1 file changed, 28 insertions(+), 28 deletions(-)

diff --git a/qapi/job.json b/qapi/job.json
index 51a57c523e..8b08350af2 100644
--- a/qapi/job.json
+++ b/qapi/job.json
@@ -12,26 +12,26 @@
 #
 # Type of a background job.
 #
-# @commit: block commit job type, see "block-commit"
+# @commit: block commit job type, see `block-commit`
 #
-# @stream: block stream job type, see "block-stream"
+# @stream: block stream job type, see `block-stream`
 #
-# @mirror: drive mirror job type, see "drive-mirror"
+# @mirror: drive mirror job type, see `drive-mirror`
 #
-# @backup: drive backup job type, see "drive-backup"
+# @backup: drive backup job type, see `drive-backup`
 #
-# @create: image creation job type, see "blockdev-create" (since 3.0)
+# @create: image creation job type, see `blockdev-create` (since 3.0)
 #
-# @amend: image options amend job type, see "x-blockdev-amend"
+# @amend: image options amend job type, see `x-blockdev-amend`
 #     (since 5.1)
 #
-# @snapshot-load: snapshot load job type, see "snapshot-load"
+# @snapshot-load: snapshot load job type, see `snapshot-load`
 #     (since 6.0)
 #
-# @snapshot-save: snapshot save job type, see "snapshot-save"
+# @snapshot-save: snapshot save job type, see `snapshot-save`
 #     (since 6.0)
 #
-# @snapshot-delete: snapshot delete job type, see "snapshot-delete"
+# @snapshot-delete: snapshot delete job type, see `snapshot-delete`
 #     (since 6.0)
 #
 # Since: 1.7
@@ -67,7 +67,7 @@
 #
 # @pending: The job has finished its work, but has finalization steps
 #     that it needs to make prior to completing.  These changes will
-#     require manual intervention via @job-finalize if auto-finalize
+#     require manual intervention via `job-finalize` if auto-finalize
 #     was set to false.  These pending changes may still fail.
 #
 # @aborting: The job is in the process of being aborted, and will
@@ -77,7 +77,7 @@
 #
 # @concluded: The job has finished all work.  If auto-dismiss was set
 #     to false, the job will remain in this state until it is
-#     dismissed via @job-dismiss.
+#     dismissed via `job-dismiss`.
 #
 # @null: The job is in the process of being dismantled.  This state
 #     should not ever be visible externally.
@@ -93,21 +93,21 @@
 #
 # Represents command verbs that can be applied to a job.
 #
-# @cancel: see @job-cancel
+# @cancel: see `job-cancel`
 #
-# @pause: see @job-pause
+# @pause: see `job-pause`
 #
-# @resume: see @job-resume
+# @resume: see `job-resume`
 #
-# @set-speed: see @block-job-set-speed
+# @set-speed: see `block-job-set-speed`
 #
-# @complete: see @job-complete
+# @complete: see `job-complete`
 #
-# @dismiss: see @job-dismiss
+# @dismiss: see `job-dismiss`
 #
-# @finalize: see @job-finalize
+# @finalize: see `job-finalize`
 #
-# @change: see @block-job-change (since 8.2)
+# @change: see `block-job-change` (since 8.2)
 #
 # Since: 2.12
 ##
@@ -140,7 +140,7 @@
 #
 # The job will pause as soon as possible, which means transitioning
 # into the PAUSED state if it was RUNNING, or into STANDBY if it was
-# READY.  The corresponding JOB_STATUS_CHANGE event will be emitted.
+# READY.  The corresponding `JOB_STATUS_CHANGE` event will be emitted.
 #
 # Cancelling a paused job automatically resumes it.
 #
@@ -175,7 +175,7 @@
 # cancellation.
 #
 # The job will cancel as soon as possible and then emit a
-# JOB_STATUS_CHANGE event.  Usually, the status will change to
+# `JOB_STATUS_CHANGE` event.  Usually, the status will change to
 # ABORTING, but it is possible that a job successfully completes (e.g.
 # because it was almost done and there was no opportunity to cancel
 # earlier than completing the job) and transitions to PENDING instead.
@@ -194,14 +194,14 @@
 #
 # This is supported only for drive mirroring, where it also switches
 # the device to write to the target path only.  Note that drive
-# mirroring includes drive-mirror, blockdev-mirror and block-commit
+# mirroring includes `drive-mirror`, `blockdev-mirror` and `block-commit`
 # job (only in case of "active commit", when the node being commited
 # is used by the guest).  The ability to complete is signaled with a
-# BLOCK_JOB_READY event.
+# `BLOCK_JOB_READY` event.
 #
 # This command completes an active background block operation
 # synchronously.  The ordering of this command's return with the
-# BLOCK_JOB_COMPLETED event is not defined.  Note that if an I/O error
+# `BLOCK_JOB_COMPLETED` event is not defined.  Note that if an I/O error
 # occurs during the processing of this command: 1) the command itself
 # will fail; 2) the error will be processed according to the
 # rerror/werror arguments that were specified when starting the
@@ -219,14 +219,14 @@
 # Deletes a job that is in the CONCLUDED state.  This command only
 # needs to be run explicitly for jobs that don't have automatic
 # dismiss enabled.  In turn, automatic dismiss may be enabled only
-# for jobs that have @auto-dismiss option, which are drive-backup,
-# blockdev-backup, drive-mirror, blockdev-mirror, block-commit and
-# block-stream.  @auto-dismiss is enabled by default for these
+# for jobs that have @auto-dismiss option, which are `drive-backup`,
+# `blockdev-backup`, `drive-mirror`, `blockdev-mirror`, `block-commit` and
+# `block-stream`.  @auto-dismiss is enabled by default for these
 # jobs.
 #
 # This command will refuse to operate on any job that has not yet
 # reached its terminal state, CONCLUDED.  For jobs that make use of
-# the JOB_READY event, job-cancel or job-complete will still need to
+# the JOB_READY event, `job-cancel` or `job-complete` will still need to
 # be used as appropriate.
 #
 # @id: The job identifier.

From 6082825e95cd1d3e638c1df68c05c8847cac5c08 Mon Sep 17 00:00:00 2001
From: John Snow <jsnow@redhat.com>
Date: Fri, 11 Jul 2025 01:39:54 -0400
Subject: [PATCH 2277/2760] qapi: add cross-references to Machine core

Signed-off-by: John Snow <jsnow@redhat.com>
Message-ID: <20250711054005.60969-8-jsnow@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
---
 qapi/machine-common.json | 20 +++++-----
 qapi/machine.json        | 80 ++++++++++++++++++++--------------------
 2 files changed, 50 insertions(+), 50 deletions(-)

diff --git a/qapi/machine-common.json b/qapi/machine-common.json
index 0f01599130..ed3d20a2fb 100644
--- a/qapi/machine-common.json
+++ b/qapi/machine-common.json
@@ -28,29 +28,29 @@
 #
 # @thread: thread level, which would also be called SMT level or
 #     logical processor level.  The @threads option in
-#     SMPConfiguration is used to configure the topology of this
+#     `SMPConfiguration` is used to configure the topology of this
 #     level.
 #
-# @core: core level.  The @cores option in SMPConfiguration is used
+# @core: core level.  The @cores option in `SMPConfiguration` is used
 #     to configure the topology of this level.
 #
-# @module: module level.  The @modules option in SMPConfiguration is
+# @module: module level.  The @modules option in `SMPConfiguration` is
 #     used to configure the topology of this level.
 #
-# @cluster: cluster level.  The @clusters option in SMPConfiguration
+# @cluster: cluster level.  The @clusters option in `SMPConfiguration`
 #     is used to configure the topology of this level.
 #
-# @die: die level.  The @dies option in SMPConfiguration is used to
+# @die: die level.  The @dies option in `SMPConfiguration` is used to
 #     configure the topology of this level.
 #
 # @socket: socket level, which would also be called package level.
-#     The @sockets option in SMPConfiguration is used to configure
+#     The @sockets option in `SMPConfiguration` is used to configure
 #     the topology of this level.
 #
-# @book: book level.  The @books option in SMPConfiguration is used
+# @book: book level.  The @books option in `SMPConfiguration` is used
 #     to configure the topology of this level.
 #
-# @drawer: drawer level.  The @drawers option in SMPConfiguration is
+# @drawer: drawer level.  The @drawers option in `SMPConfiguration` is
 #     used to configure the topology of this level.
 #
 # @default: default level.  Some architectures will have default
@@ -104,9 +104,9 @@
 ##
 # @SmpCachePropertiesWrapper:
 #
-# List wrapper of SmpCacheProperties.
+# List wrapper of `SmpCacheProperties`.
 #
-# @caches: the list of SmpCacheProperties.
+# @caches: the list of `SmpCacheProperties`.
 #
 # Since 9.2
 ##
diff --git a/qapi/machine.json b/qapi/machine.json
index 2364893cba..f9bfda2151 100644
--- a/qapi/machine.json
+++ b/qapi/machine.json
@@ -188,7 +188,7 @@
 # @acpi: machine type supports ACPI (since 8.0)
 #
 # @compat-props: The machine type's compatibility properties.  Only
-#     present when query-machines argument @compat-props is true.
+#     present when `query-machines` argument @compat-props is true.
 #     (since 9.1)
 #
 # Features:
@@ -377,7 +377,7 @@
 #
 # Wake up guest from suspend.  If the guest has wake-up from suspend
 # support enabled (wakeup-suspend-support flag from
-# query-current-machine), wake-up guest from suspend if the guest is
+# `query-current-machine`), wake-up guest from suspend if the guest is
 # in SUSPENDED state.  Return an error otherwise.
 #
 # Since: 1.1
@@ -589,7 +589,7 @@
 #
 # List of CXL Fixed Memory Windows.
 #
-# @cxl-fmw: List of CXLFixedMemoryWindowOptions
+# @cxl-fmw: List of `CXLFixedMemoryWindowOptions`
 #
 # Since: 7.1
 ##
@@ -644,10 +644,10 @@
 ##
 # @NumaCpuOptions:
 #
-# Option "-numa cpu" overrides default cpu to node mapping.  It
-# accepts the same set of cpu properties as returned by
-# query-hotpluggable-cpus[].props, where node-id could be used to
-# override default node mapping.
+# Option "-numa cpu" overrides default cpu to node mapping.  It accepts
+# the same set of cpu properties as returned by
+# `query-hotpluggable-cpus[].props <query-hotpluggable-cpus>`, where
+# node-id could be used to override default node mapping.
 #
 # Since: 2.10
 ##
@@ -661,7 +661,7 @@
 # The memory hierarchy in the System Locality Latency and Bandwidth
 # Information Structure of HMAT (Heterogeneous Memory Attribute Table)
 #
-# For more information about @HmatLBMemoryHierarchy, see chapter
+# For more information about `HmatLBMemoryHierarchy`, see chapter
 # 5.2.27.4: Table 5-146: Field "Flags" of ACPI 6.3 spec.
 #
 # @memory: the structure represents the memory performance
@@ -683,7 +683,7 @@
 # Data type in the System Locality Latency and Bandwidth Information
 # Structure of HMAT (Heterogeneous Memory Attribute Table)
 #
-# For more information about @HmatLBDataType, see chapter 5.2.27.4:
+# For more information about `HmatLBDataType`, see chapter 5.2.27.4:
 # Table 5-146: Field "Data Type" of ACPI 6.3 spec.
 #
 # @access-latency: access latency (nanoseconds)
@@ -710,7 +710,7 @@
 # Set the system locality latency and bandwidth information between
 # Initiator and Target proximity Domains.
 #
-# For more information about @NumaHmatLBOptions, see chapter 5.2.27.4:
+# For more information about `NumaHmatLBOptions`, see chapter 5.2.27.4:
 # Table 5-146 of ACPI 6.3 spec.
 #
 # @initiator: the Initiator Proximity Domain.
@@ -746,7 +746,7 @@
 # Cache associativity in the Memory Side Cache Information Structure
 # of HMAT
 #
-# For more information of @HmatCacheAssociativity, see chapter
+# For more information of `HmatCacheAssociativity`, see chapter
 # 5.2.27.5: Table 5-147 of ACPI 6.3 spec.
 #
 # @none: None (no memory side cache in this proximity domain, or cache
@@ -767,7 +767,7 @@
 # Cache write policy in the Memory Side Cache Information Structure of
 # HMAT
 #
-# For more information of @HmatCacheWritePolicy, see chapter 5.2.27.5:
+# For more information of `HmatCacheWritePolicy`, see chapter 5.2.27.5:
 # Table 5-147: Field "Cache Attributes" of ACPI 6.3 spec.
 #
 # @none: None (no memory side cache in this proximity domain, or cache
@@ -787,7 +787,7 @@
 #
 # Set the memory side cache information for a given memory domain.
 #
-# For more information of @NumaHmatCacheOptions, see chapter 5.2.27.5:
+# For more information of `NumaHmatCacheOptions`, see chapter 5.2.27.5:
 # Table 5-147: Field "Cache Attributes" of ACPI 6.3 spec.
 #
 # @node-id: the memory proximity domain to which the memory belongs.
@@ -964,7 +964,7 @@
 #
 # The ids other than the node-id specify the position of the CPU
 # within the CPU topology (as defined by the machine property "smp",
-# thus see also type @SMPConfiguration)
+# thus see also type `SMPConfiguration`)
 #
 # @node-id: NUMA node ID the CPU belongs to
 #
@@ -992,7 +992,7 @@
 # Since: 2.7
 ##
 { 'struct': 'CpuInstanceProperties',
-  # Keep these in sync with the properties device_add accepts
+  # Keep these in sync with the properties `device_add` accepts
   'data': { '*node-id': 'int',
             '*drawer-id': 'int',
             '*book-id': 'int',
@@ -1008,19 +1008,19 @@
 ##
 # @HotpluggableCPU:
 #
-# @type: CPU object type for usage with device_add command
+# @type: CPU object type for usage with `device_add` command
 #
 # @props: list of properties to pass for hotplugging a CPU with
-#     device_add
+#     `device_add`
 #
-# @vcpus-count: number of logical VCPU threads @HotpluggableCPU
+# @vcpus-count: number of logical VCPU threads `HotpluggableCPU`
 #     provides
 #
 # @qom-path: link to existing CPU object if CPU is present or omitted
 #     if CPU is not present.
 #
 # .. note:: Management should be prepared to pass through additional
-#    properties with device_add.
+#    properties with `device_add`.
 #
 # Since: 2.7
 ##
@@ -1179,7 +1179,7 @@
 # @BALLOON_CHANGE:
 #
 # Emitted when the guest changes the actual BALLOON level.  This value
-# is equivalent to the @actual field return by the 'query-balloon'
+# is equivalent to the @actual field return by the `query-balloon`
 # command
 #
 # @actual: the logical size of the VM in bytes.  Formula used:
@@ -1965,7 +1965,7 @@
 #
 # The result of a CPU model baseline.
 #
-# @model: the baselined CpuModelInfo.
+# @model: the baselined `CpuModelInfo`.
 #
 # Since: 2.8
 ##
@@ -2014,28 +2014,28 @@
 #
 # * QEMU version: CPU models may look different depending on the QEMU
 #   version.  (Except for CPU models reported as "static" in
-#   query-cpu-definitions.)
+#   `query-cpu-definitions`.)
 # * machine-type: CPU model may look different depending on the
 #   machine-type.  (Except for CPU models reported as "static" in
-#   query-cpu-definitions.)
+#   `query-cpu-definitions`.)
 # * machine options (including accelerator): in some architectures,
 #   CPU models may look different depending on machine and accelerator
 #   options.  (Except for CPU models reported as "static" in
-#   query-cpu-definitions.)
+#   `query-cpu-definitions`.)
 # * "-cpu" arguments and global properties: arguments to the -cpu
 #   option and global properties may affect expansion of CPU models.
-#   Using query-cpu-model-expansion while using these is not advised.
+#   Using `query-cpu-model-expansion` while using these is not advised.
 #
 # Some architectures may not support comparing CPU models.  s390x
 # supports comparing CPU models.
 #
 # @modela: description of the first CPU model to compare, referred to
-#     as "model A" in CpuModelCompareResult
+#     as "model A" in `CpuModelCompareResult`
 #
 # @modelb: description of the second CPU model to compare, referred to
-#     as "model B" in CpuModelCompareResult
+#     as "model B" in `CpuModelCompareResult`
 #
-# Returns: a CpuModelCompareInfo describing how both CPU models
+# Returns: a `CpuModelCompareInfo` describing how both CPU models
 #     compare
 #
 # Errors:
@@ -2068,17 +2068,17 @@
 #
 # * QEMU version: CPU models may look different depending on the QEMU
 #   version.  (Except for CPU models reported as "static" in
-#   query-cpu-definitions.)
+#   `query-cpu-definitions`.)
 # * machine-type: CPU model may look different depending on the
 #   machine-type.  (Except for CPU models reported as "static" in
-#   query-cpu-definitions.)
+#   `query-cpu-definitions`.)
 # * machine options (including accelerator): in some architectures,
 #   CPU models may look different depending on machine and accelerator
 #   options.  (Except for CPU models reported as "static" in
-#   query-cpu-definitions.)
+#   `query-cpu-definitions`.)
 # * "-cpu" arguments and global properties: arguments to the -cpu
 #   option and global properties may affect expansion of CPU models.
-#   Using query-cpu-model-expansion while using these is not advised.
+#   Using `query-cpu-model-expansion` while using these is not advised.
 #
 # Some architectures may not support baselining CPU models.  s390x
 # supports baselining CPU models.
@@ -2087,7 +2087,7 @@
 #
 # @modelb: description of the second CPU model to baseline
 #
-# Returns: a CpuModelBaselineInfo describing the baselined CPU model
+# Returns: a `CpuModelBaselineInfo` describing the baselined CPU model
 #
 # Errors:
 #     - if baselining CPU models is not supported by the target
@@ -2107,7 +2107,7 @@
 #
 # The result of a cpu model expansion.
 #
-# @model: the expanded CpuModelInfo.
+# @model: the expanded `CpuModelInfo`.
 #
 # @deprecated-props: an optional list of properties that are flagged as
 #     deprecated by the CPU vendor.  The list depends on the
@@ -2136,17 +2136,17 @@
 #
 # * QEMU version: CPU models may look different depending on the QEMU
 #   version.  (Except for CPU models reported as "static" in
-#   query-cpu-definitions.)
+#   `query-cpu-definitions`.)
 # * machine-type: CPU model may look different depending on the
 #   machine-type.  (Except for CPU models reported as "static" in
-#   query-cpu-definitions.)
+#   `query-cpu-definitions`.)
 # * machine options (including accelerator): in some architectures,
 #   CPU models may look different depending on machine and accelerator
 #   options.  (Except for CPU models reported as "static" in
-#   query-cpu-definitions.)
+#   `query-cpu-definitions`.)
 # * "-cpu" arguments and global properties: arguments to the -cpu
 #   option and global properties may affect expansion of CPU models.
-#   Using query-cpu-model-expansion while using these is not advised.
+#   Using `query-cpu-model-expansion` while using these is not advised.
 #
 # Some architectures may not support all expansion types.  s390x
 # supports "full" and "static".  Arm only supports "full".
@@ -2155,7 +2155,7 @@
 #
 # @type: expansion type, specifying how to expand the CPU model
 #
-# Returns: a CpuModelExpansionInfo describing the expanded CPU model
+# Returns: a `CpuModelExpansionInfo` describing the expanded CPU model
 #
 # Errors:
 #     - if expanding CPU models is not supported
@@ -2194,7 +2194,7 @@
 #     from running in the current host.  (since 2.8)
 #
 # @typename: Type name that can be used as argument to
-#     @device-list-properties, to introspect properties configurable
+#     `device-list-properties`, to introspect properties configurable
 #     using -cpu or -global.  (since 2.9)
 #
 # @alias-of: Name of CPU model this model is an alias for.  The target

From b51ea1c42111464961a4b2bb3f1d3f4f0ddfc006 Mon Sep 17 00:00:00 2001
From: John Snow <jsnow@redhat.com>
Date: Fri, 11 Jul 2025 01:39:55 -0400
Subject: [PATCH 2278/2760] qapi: add cross-references to migration.json

Note that a reference to MIGRATION needs to be disambiguated with a
:qapi:event: prefix.  Without this, Sphinx complains

    more than one target found for 'any' cross-reference 'MIGRATION': could be :std:ref:`Migration framework` or :qapi:event:`QMP:migration.MIGRATION`

Signed-off-by: John Snow <jsnow@redhat.com>
Message-ID: <20250711054005.60969-9-jsnow@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
[Commit message amended to explain need for :qapi:event:]
Signed-off-by: Markus Armbruster <armbru@redhat.com>
---
 qapi/migration.json | 68 ++++++++++++++++++++++-----------------------
 1 file changed, 34 insertions(+), 34 deletions(-)

diff --git a/qapi/migration.json b/qapi/migration.json
index 57653160eb..e08a99bb82 100644
--- a/qapi/migration.json
+++ b/qapi/migration.json
@@ -195,14 +195,14 @@
 #
 # Information about current migration process.
 #
-# @status: @MigrationStatus describing the current migration status.
+# @status: `MigrationStatus` describing the current migration status.
 #     If this field is not returned, no migration process has been
 #     initiated
 #
-# @ram: @MigrationStats containing detailed migration status, only
+# @ram: `MigrationStats` containing detailed migration status, only
 #     returned if status is 'active' or 'completed'(since 1.2)
 #
-# @xbzrle-cache: @XBZRLECacheStats containing detailed XBZRLE
+# @xbzrle-cache: `XBZRLECacheStats` containing detailed XBZRLE
 #     migration statistics, only returned if XBZRLE feature is on and
 #     status is 'active' or 'completed' (since 1.2)
 #
@@ -266,7 +266,7 @@
 # @socket-address: Only used for tcp, to know what the real port is
 #     (Since 4.0)
 #
-# @vfio: @VfioStats containing detailed VFIO devices migration
+# @vfio: `VfioStats` containing detailed VFIO devices migration
 #     statistics, only returned if VFIO device is present, migration
 #     is supported by all VFIO devices and status is 'active' or
 #     'completed' (since 5.2)
@@ -277,7 +277,7 @@
 #
 # @dirty-limit-throttle-time-per-round: Maximum throttle time (in
 #     microseconds) of virtual CPUs each dirty ring full round, which
-#     shows how MigrationCapability dirty-limit affects the guest
+#     shows how `MigrationCapability` dirty-limit affects the guest
 #     during live migration.  (Since 8.1)
 #
 # @dirty-limit-ring-full-time: Estimated average dirty ring full time
@@ -627,7 +627,7 @@
 #
 # @normal: the original form of migration.  (since 8.2)
 #
-# @cpr-reboot: The migrate command stops the VM and saves state to the
+# @cpr-reboot: The `migrate` command stops the VM and saves state to the
 #     URI.  After quitting QEMU, the user resumes by running QEMU
 #     -incoming.
 #
@@ -677,7 +677,7 @@
 #
 #     New QEMU reads the CPR channel before opening a monitor, hence
 #     the CPR channel cannot be specified in the list of channels for
-#     a migrate-incoming command.  It may only be specified on the
+#     a `migrate-incoming` command.  It may only be specified on the
 #     command line.
 #
 #     The main channel address cannot be a file type, and for an
@@ -688,10 +688,10 @@
 #     memory-backend-epc is not supported.  The VM must be started
 #     with the '-machine aux-ram-share=on' option.
 #
-#     When using -incoming defer, you must issue the migrate command
+#     When using -incoming defer, you must issue the `migrate` command
 #     to old QEMU before issuing any monitor commands to new QEMU.
 #     However, new QEMU does not open and read the migration stream
-#     until you issue the migrate incoming command.
+#     until you issue the `migrate-incoming` command.
 #
 #     (since 10.0)
 ##
@@ -913,11 +913,11 @@
 # @vcpu-dirty-limit: Dirtyrate limit (MB/s) during live migration.
 #     Defaults to 1.  (Since 8.1)
 #
-# @mode: Migration mode.  See description in @MigMode.  Default is
+# @mode: Migration mode.  See description in `MigMode`.  Default is
 #     'normal'.  (Since 8.2)
 #
 # @zero-page-detection: Whether and how to detect zero pages.
-#     See description in @ZeroPageDetection.  Default is 'multifd'.
+#     See description in `ZeroPageDetection`.  Default is 'multifd'.
 #     (since 9.0)
 #
 # @direct-io: Open migration files with O_DIRECT when possible.  This
@@ -1094,11 +1094,11 @@
 # @vcpu-dirty-limit: Dirtyrate limit (MB/s) during live migration.
 #     Defaults to 1.  (Since 8.1)
 #
-# @mode: Migration mode.  See description in @MigMode.  Default is
+# @mode: Migration mode.  See description in `MigMode`.  Default is
 #     'normal'.  (Since 8.2)
 #
 # @zero-page-detection: Whether and how to detect zero pages.
-#     See description in @ZeroPageDetection.  Default is 'multifd'.
+#     See description in `ZeroPageDetection`.  Default is 'multifd'.
 #     (since 9.0)
 #
 # @direct-io: Open migration files with O_DIRECT when possible.  This
@@ -1110,8 +1110,8 @@
 # @unstable: Members @x-checkpoint-delay and
 #     @x-vcpu-dirty-limit-period are experimental.
 #
-# TODO: either fuse back into MigrationParameters, or make
-#     MigrationParameters members mandatory
+# TODO: either fuse back into `MigrationParameters`, or make
+#     `MigrationParameters` members mandatory
 #
 # Since: 2.4
 ##
@@ -1304,11 +1304,11 @@
 # @vcpu-dirty-limit: Dirtyrate limit (MB/s) during live migration.
 #     Defaults to 1.  (Since 8.1)
 #
-# @mode: Migration mode.  See description in @MigMode.  Default is
+# @mode: Migration mode.  See description in `MigMode`.  Default is
 #     'normal'.  (Since 8.2)
 #
 # @zero-page-detection: Whether and how to detect zero pages.
-#     See description in @ZeroPageDetection.  Default is 'multifd'.
+#     See description in `ZeroPageDetection`.  Default is 'multifd'.
 #     (since 9.0)
 #
 # @direct-io: Open migration files with O_DIRECT when possible.  This
@@ -1398,7 +1398,7 @@
 #
 # Emitted when a migration event happens
 #
-# @status: @MigrationStatus describing the current migration status.
+# @status: `MigrationStatus` describing the current migration status.
 #
 # Since: 2.4
 #
@@ -1519,8 +1519,8 @@
 # The reason for a COLO exit.
 #
 # @none: failover has never happened.  This state does not occur in
-#     the COLO_EXIT event, and is only visible in the result of
-#     query-colo-status.
+#     the `COLO_EXIT` event, and is only visible in the result of
+#     `query-colo-status`.
 #
 # @request: COLO exit is due to an external request.
 #
@@ -1775,8 +1775,8 @@
 #     list connected to a destination interface endpoint.
 #
 # @exit-on-error: Exit on incoming migration failure.  Default true.
-#     When set to false, the failure triggers a MIGRATION event, and
-#     error details could be retrieved with query-migrate.
+#     When set to false, the failure triggers a :qapi:event:`MIGRATION`
+#     event, and error details could be retrieved with `query-migrate`.
 #     (since 9.1)
 #
 # Since: 2.3
@@ -1788,7 +1788,7 @@
 #        already exposed above libvirt.
 #
 #     2. QEMU must be started with -incoming defer to allow
-#        migrate-incoming to be used.
+#        `migrate-incoming` to be used.
 #
 #     3. The uri format is the same as for -incoming
 #
@@ -1841,7 +1841,7 @@
 # devices of the VM are not saved by this command.
 #
 # @filename: the file to save the state of the devices to as binary
-#     data.  See xen-save-devices-state.txt for a description of the
+#     data.  See `xen-save-devices-state`.txt for a description of the
 #     binary format.
 #
 # @live: Optional argument to ask QEMU to treat this command as part
@@ -1882,7 +1882,7 @@
 # devices of the VM are not loaded by this command.
 #
 # @filename: the file to load the state of the devices from as binary
-#     data.  See xen-save-devices-state.txt for a description of the
+#     data.  See `xen-save-devices-state`.txt for a description of the
 #     binary format.
 #
 # Since: 2.7
@@ -1922,7 +1922,7 @@
 ##
 # @ReplicationStatus:
 #
-# The result format for 'query-xen-replication-status'.
+# The result format for `query-xen-replication-status`.
 #
 # @error: true if an error happened, false if replication is normal.
 #
@@ -1971,7 +1971,7 @@
 ##
 # @COLOStatus:
 #
-# The result format for 'query-colo-status'.
+# The result format for `query-colo-status`.
 #
 # @mode: COLO running mode.  If COLO is running, this field will
 #     return 'primary' or 'secondary'.
@@ -2095,7 +2095,7 @@
 # @DirtyRateMeasureMode:
 #
 # Method used to measure dirty page rate.  Differences between
-# available methods are explained in @calc-dirty-rate.
+# available methods are explained in `calc-dirty-rate`.
 #
 # @page-sampling: use page sampling
 #
@@ -2163,7 +2163,7 @@
 # @calc-dirty-rate:
 #
 # Start measuring dirty page rate of the VM.  Results can be retrieved
-# with @query-dirty-rate after measurements are completed.
+# with `query-dirty-rate` after measurements are completed.
 #
 # Dirty page rate is the number of pages changed in a given time
 # period expressed in MiB/s.  The following methods of calculation are
@@ -2236,7 +2236,7 @@
 ##
 # @query-dirty-rate:
 #
-# Query results of the most recent invocation of @calc-dirty-rate.
+# Query results of the most recent invocation of `calc-dirty-rate`.
 #
 # @calc-time-unit: time unit in which to report calculation time.
 #     By default it is reported in seconds.  (Since 8.2)
@@ -2286,7 +2286,7 @@
 #
 # Requires KVM with accelerator property "dirty-ring-size" set.  A
 # virtual CPU's dirty page rate is a measure of its memory load.  To
-# observe dirty page rates, use @calc-dirty-rate.
+# observe dirty page rates, use `calc-dirty-rate`.
 #
 # @cpu-index: index of a virtual CPU, default is all.
 #
@@ -2311,8 +2311,8 @@
 # Cancel the upper limit of dirty page rate for virtual CPUs.
 #
 # Cancel the dirty page limit for the vCPU which has been set with
-# set-vcpu-dirty-limit command.  Note that this command requires
-# support from dirty ring, same as the "set-vcpu-dirty-limit".
+# `set-vcpu-dirty-limit` command.  Note that this command requires
+# support from dirty ring, same as the `set-vcpu-dirty-limit`.
 #
 # @cpu-index: index of a virtual CPU, default is all.
 #
@@ -2469,7 +2469,7 @@
 # time it takes to load the snapshot.
 #
 # It is strongly recommended that @devices contain all writable block
-# device nodes that can have changed since the original @snapshot-save
+# device nodes that can have changed since the original `snapshot-save`
 # command execution.
 #
 # .. qmp-example::

From 4411a50e31157a1ee81147c2a6d6f1372a7bf6e8 Mon Sep 17 00:00:00 2001
From: John Snow <jsnow@redhat.com>
Date: Fri, 11 Jul 2025 01:39:56 -0400
Subject: [PATCH 2279/2760] qapi: add cross-references to net.json

Signed-off-by: John Snow <jsnow@redhat.com>
Message-ID: <20250711054005.60969-10-jsnow@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
---
 qapi/net.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/qapi/net.json b/qapi/net.json
index a266c6786e..1dda21fe61 100644
--- a/qapi/net.json
+++ b/qapi/net.json
@@ -657,7 +657,7 @@
 #     this to zero disables this function.  This member is mutually
 #     exclusive with @reconnect.  (default: 0) (Since: 9.2)
 #
-# Only SocketAddress types 'unix', 'inet' and 'fd' are supported.
+# Only `SocketAddress` types 'unix', 'inet' and 'fd' are supported.
 #
 # Features:
 #
@@ -682,7 +682,7 @@
 #
 # @local: local address
 #
-# Only SocketAddress types 'unix', 'inet' and 'fd' are supported.
+# Only `SocketAddress` types 'unix', 'inet' and 'fd' are supported.
 #
 # If remote address is present and it's a multicast address, local
 # address is optional.  Otherwise local address is required and remote
@@ -892,7 +892,7 @@
 ##
 # @NIC_RX_FILTER_CHANGED:
 #
-# Emitted once until the 'query-rx-filter' command is executed, the
+# Emitted once until the `query-rx-filter` command is executed, the
 # first event will always be emitted
 #
 # @name: net client name

From b9abf7dd3f926e50029bd450e2d9c7cd2f1dde51 Mon Sep 17 00:00:00 2001
From: John Snow <jsnow@redhat.com>
Date: Fri, 11 Jul 2025 01:39:57 -0400
Subject: [PATCH 2280/2760] qapi: add cross-references to pci.json

Signed-off-by: John Snow <jsnow@redhat.com>
Message-ID: <20250711054005.60969-11-jsnow@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
---
 qapi/pci.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/qapi/pci.json b/qapi/pci.json
index 418ea4fc93..694c741e42 100644
--- a/qapi/pci.json
+++ b/qapi/pci.json
@@ -85,7 +85,7 @@
 #
 # @bus: information about the bus the device resides on
 #
-# @devices: a list of @PciDeviceInfo for each device on this bridge
+# @devices: a list of `PciDeviceInfo` for each device on this bridge
 #
 # Since: 0.14
 ##

From 91581b49e1d1910c1e5af641e7b8afa95c1b0a53 Mon Sep 17 00:00:00 2001
From: John Snow <jsnow@redhat.com>
Date: Fri, 11 Jul 2025 01:39:58 -0400
Subject: [PATCH 2281/2760] qapi: add cross-references to QOM

Signed-off-by: John Snow <jsnow@redhat.com>
Message-ID: <20250711054005.60969-12-jsnow@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
---
 qapi/qdev.json |  4 ++--
 qapi/qom.json  | 13 +++++++------
 2 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/qapi/qdev.json b/qapi/qdev.json
index 6441357e00..e14a0c9259 100644
--- a/qapi/qdev.json
+++ b/qapi/qdev.json
@@ -97,10 +97,10 @@
 #    from the guest.  Hot removal is an operation that requires guest
 #    cooperation.  This command merely requests that the guest begin
 #    the hot removal process.  Completion of the device removal
-#    process is signaled with a DEVICE_DELETED event.  Guest reset
+#    process is signaled with a `DEVICE_DELETED` event.  Guest reset
 #    will automatically complete removal for all devices.  If a
 #    guest-side error in the hot removal process is detected, the
-#    device will not be removed and a DEVICE_UNPLUG_GUEST_ERROR event
+#    device will not be removed and a `DEVICE_UNPLUG_GUEST_ERROR` event
 #    is sent.  Some errors cannot be detected.
 #
 # Since: 0.14
diff --git a/qapi/qom.json b/qapi/qom.json
index aa09eddbf9..4e85baae47 100644
--- a/qapi/qom.json
+++ b/qapi/qom.json
@@ -52,7 +52,7 @@
 #
 # List properties of a object given a path in the object model.
 #
-# @path: the path within the object model.  See @qom-get for a
+# @path: the path within the object model.  See `qom-get` for a
 #     description of this parameter.
 #
 # Returns: a list that describe the properties of the object.
@@ -129,12 +129,12 @@
 #
 # Set a property value.
 #
-# @path: see @qom-get for a description of this parameter
+# @path: see `qom-get` for a description of this parameter
 #
 # @property: the property name to set
 #
 # @value: a value who's type is appropriate for the property type.
-#     See @qom-get for a description of type mapping.
+#     See `qom-get` for a description of type mapping.
 #
 # Since: 1.2
 #
@@ -153,7 +153,7 @@
 ##
 # @ObjectTypeInfo:
 #
-# This structure describes a search result from @qom-list-types
+# This structure describes a search result from `qom-list-types`
 #
 # @name: the type name found in the search
 #
@@ -193,6 +193,7 @@
 #
 # @typename: the type name of an object
 #
+#
 # .. note:: Objects can create properties at runtime, for example to
 #    describe links between different devices and/or objects.  These
 #    properties are not included in the output of this command.
@@ -787,7 +788,7 @@
 #
 # Properties for x-remote-object objects.
 #
-# @fd: file descriptor name previously passed via 'getfd' command
+# @fd: file descriptor name previously passed via `getfd` command
 #
 # @devid: the id of the device to be associated with the file
 #     descriptor
@@ -816,7 +817,7 @@
 #
 # Properties for iommufd objects.
 #
-# @fd: file descriptor name previously passed via 'getfd' command,
+# @fd: file descriptor name previously passed via `getfd` command,
 #     which represents a pre-opened /dev/iommu.  This allows the
 #     iommufd object to be shared across several subsystems (VFIO,
 #     VDPA, ...), and the file descriptor to be shared with other

From 551c00b8fac1f0532ba10bac05a5da7b7b508f71 Mon Sep 17 00:00:00 2001
From: John Snow <jsnow@redhat.com>
Date: Fri, 11 Jul 2025 01:39:59 -0400
Subject: [PATCH 2282/2760] qapi: add cross-references to replay.json

Signed-off-by: John Snow <jsnow@redhat.com>
Message-ID: <20250711054005.60969-13-jsnow@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
---
 qapi/replay.json | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/qapi/replay.json b/qapi/replay.json
index e46c5c1d3f..ccf84da68e 100644
--- a/qapi/replay.json
+++ b/qapi/replay.json
@@ -49,8 +49,8 @@
 # @query-replay:
 #
 # Retrieve the record/replay information.  It includes current
-# instruction count which may be used for @replay-break and
-# @replay-seek commands.
+# instruction count which may be used for `replay-break` and
+# `replay-seek` commands.
 #
 # Returns: record/replay information.
 #
@@ -72,7 +72,7 @@
 # breakpoint.  When breakpoint is set, any prior one is removed.  The
 # breakpoint may be set only in replay mode and only "in the future",
 # i.e. at instruction counts greater than the current one.  The
-# current instruction count can be observed with @query-replay.
+# current instruction count can be observed with `query-replay`.
 #
 # @icount: instruction count to stop at
 #
@@ -88,7 +88,7 @@
 ##
 # @replay-delete-break:
 #
-# Remove replay breakpoint which was set with @replay-break.  The
+# Remove replay breakpoint which was set with `replay-break`.  The
 # command is ignored when there are no replay breakpoints.
 #
 # Since: 5.2
@@ -108,7 +108,7 @@
 # snapshot and replays the execution to find the desired instruction.
 # When there is no preceding snapshot or the execution is not
 # replayed, then the command fails.  Instruction count can be obtained
-# with the @query-replay command.
+# with the `query-replay` command.
 #
 # @icount: target instruction count
 #

From 57d2ad7d2f534d510c7afb44d574d6313a0ab91e Mon Sep 17 00:00:00 2001
From: John Snow <jsnow@redhat.com>
Date: Fri, 11 Jul 2025 01:40:00 -0400
Subject: [PATCH 2283/2760] qapi: add cross-references to run-state.json

Signed-off-by: John Snow <jsnow@redhat.com>
Message-ID: <20250711054005.60969-14-jsnow@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
---
 qapi/run-state.json | 46 ++++++++++++++++++++++-----------------------
 1 file changed, 23 insertions(+), 23 deletions(-)

diff --git a/qapi/run-state.json b/qapi/run-state.json
index 76f14569ff..54ba5c9a3f 100644
--- a/qapi/run-state.json
+++ b/qapi/run-state.json
@@ -70,9 +70,9 @@
 #
 # @host-error: An error prevents further use of guest
 #
-# @host-qmp-quit: Reaction to the QMP command 'quit'
+# @host-qmp-quit: Reaction to the QMP command `quit`
 #
-# @host-qmp-system-reset: Reaction to the QMP command 'system_reset'
+# @host-qmp-system-reset: Reaction to the QMP command `system_reset`
 #
 # @host-signal: Reaction to a signal, such as SIGINT
 #
@@ -108,7 +108,7 @@
 #
 # @running: true if all VCPUs are runnable, false if not runnable
 #
-# @status: the virtual machine @RunState
+# @status: the virtual machine `RunState`
 #
 # Since: 0.14
 ##
@@ -143,12 +143,12 @@
 #     hardware-specific action) rather than a host request (such as
 #     sending QEMU a SIGINT).  (since 2.10)
 #
-# @reason: The @ShutdownCause which resulted in the SHUTDOWN.
+# @reason: The `ShutdownCause` which resulted in the `SHUTDOWN`.
 #     (since 4.0)
 #
 # .. note:: If the command-line option ``-no-shutdown`` has been
-#    specified, QEMU will not exit, and a STOP event will eventually
-#    follow the SHUTDOWN event.
+#    specified, QEMU will not exit, and a `STOP` event will eventually
+#    follow the `SHUTDOWN` event.
 #
 # Since: 0.12
 #
@@ -183,9 +183,9 @@
 # @guest: If true, the reset was triggered by a guest request (such as
 #     a guest-initiated ACPI reboot request or other hardware-specific
 #     action) rather than a host request (such as the QMP command
-#     system_reset).  (since 2.10)
+#     `system_reset`).  (since 2.10)
 #
-# @reason: The @ShutdownCause of the RESET.  (since 4.0)
+# @reason: The `ShutdownCause` of the `RESET`.  (since 4.0)
 #
 # Since: 0.12
 #
@@ -247,7 +247,7 @@
 # saved on disk, for example, S4 state, which is sometimes called
 # hibernate state
 #
-# .. note:: QEMU shuts down (similar to event @SHUTDOWN) when entering
+# .. note:: QEMU shuts down (similar to event `SHUTDOWN`) when entering
 #    this state.
 #
 # Since: 1.2
@@ -281,8 +281,8 @@
 #
 # @action: action that has been taken
 #
-# .. note:: If action is "reset", "shutdown", or "pause" the WATCHDOG
-#    event is followed respectively by the RESET, SHUTDOWN, or STOP
+# .. note:: If action is "reset", "shutdown", or "pause" the `WATCHDOG`
+#    event is followed respectively by the `RESET`, `SHUTDOWN`, or `STOP`
 #    events.
 #
 # .. note:: This event is rate-limited.
@@ -378,7 +378,7 @@
 #
 # Set watchdog action.
 #
-# @action: @WatchdogAction action taken when watchdog timer expires.
+# @action: `WatchdogAction` action taken when watchdog timer expires.
 #
 # Since: 2.11
 #
@@ -396,13 +396,13 @@
 # Set the actions that will be taken by the emulator in response to
 # guest events.
 #
-# @reboot: @RebootAction action taken on guest reboot.
+# @reboot: `RebootAction` action taken on guest reboot.
 #
-# @shutdown: @ShutdownAction action taken on guest shutdown.
+# @shutdown: `ShutdownAction` action taken on guest shutdown.
 #
-# @panic: @PanicAction action taken on guest panic.
+# @panic: `PanicAction` action taken on guest panic.
 #
-# @watchdog: @WatchdogAction action taken when watchdog timer expires.
+# @watchdog: `WatchdogAction` action taken when watchdog timer expires.
 #
 # Since: 6.0
 #
@@ -529,20 +529,20 @@
 #
 # Hyper-V specific guest panic information (HV crash MSRs)
 #
-# @arg1: for Windows, STOP code for the guest crash.  For Linux,
+# @arg1: for Windows, `STOP` code for the guest crash.  For Linux,
 #     an error code.
 #
-# @arg2: for Windows, first argument of the STOP.  For Linux, the
+# @arg2: for Windows, first argument of the `STOP`.  For Linux, the
 #     guest OS ID, which has the kernel version in bits 16-47 and
 #     0x8100 in bits 48-63.
 #
-# @arg3: for Windows, second argument of the STOP.  For Linux, the
+# @arg3: for Windows, second argument of the `STOP`.  For Linux, the
 #     program counter of the guest.
 #
-# @arg4: for Windows, third argument of the STOP.  For Linux, the
+# @arg4: for Windows, third argument of the `STOP`.  For Linux, the
 #     RAX register (x86) or the stack pointer (aarch64) of the guest.
 #
-# @arg5: for Windows, fourth argument of the STOP.  For x86 Linux, the
+# @arg5: for Windows, fourth argument of the `STOP`.  For x86 Linux, the
 #     stack pointer of the guest.
 #
 # Since: 2.9
@@ -630,11 +630,11 @@
 #
 # Emitted when a memory failure occurs on host side.
 #
-# @recipient: recipient is defined as @MemoryFailureRecipient.
+# @recipient: recipient is defined as `MemoryFailureRecipient`.
 #
 # @action: action that has been taken.
 #
-# @flags: flags for MemoryFailureAction.
+# @flags: flags for `MemoryFailureAction`.
 #
 # Since: 5.2
 #

From bfdfd96388fed2c23b2a42c32c5dd1a96d437c20 Mon Sep 17 00:00:00 2001
From: John Snow <jsnow@redhat.com>
Date: Fri, 11 Jul 2025 01:40:01 -0400
Subject: [PATCH 2284/2760] qapi: add cross-references to sockets.json

Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-ID: <20250711054005.60969-15-jsnow@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
---
 qapi/sockets.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/qapi/sockets.json b/qapi/sockets.json
index b5f4a8fecd..82046b0b3a 100644
--- a/qapi/sockets.json
+++ b/qapi/sockets.json
@@ -211,14 +211,14 @@
     'unix': 'UnixSocketAddressWrapper',
     'vsock': 'VsockSocketAddressWrapper',
     'fd': 'FdSocketAddressWrapper' } }
-# Note: This type is deprecated in favor of SocketAddress.  The
-# difference between SocketAddressLegacy and SocketAddress is that the
+# Note: This type is deprecated in favor of `SocketAddress`.  The
+# difference between `SocketAddressLegacy` and `SocketAddress` is that the
 # latter has fewer ``{}`` on the wire.
 
 ##
 # @SocketAddressType:
 #
-# Available SocketAddress types
+# Available `SocketAddress` types
 #
 # @inet: Internet address
 #

From 64ebc732e1a1bc3a76b7412eca9f0fc6b0c235d1 Mon Sep 17 00:00:00 2001
From: John Snow <jsnow@redhat.com>
Date: Fri, 11 Jul 2025 01:40:02 -0400
Subject: [PATCH 2285/2760] qapi: add cross-references to ui.json

Signed-off-by: John Snow <jsnow@redhat.com>
Message-ID: <20250711054005.60969-16-jsnow@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
---
 qapi/ui.json | 34 +++++++++++++++++-----------------
 1 file changed, 17 insertions(+), 17 deletions(-)

diff --git a/qapi/ui.json b/qapi/ui.json
index b48266c458..c672cf10f9 100644
--- a/qapi/ui.json
+++ b/qapi/ui.json
@@ -41,7 +41,7 @@
 ##
 # @SetPasswordOptions:
 #
-# Options for set_password.
+# Options for `set_password`.
 #
 # @protocol:
 #     - 'vnc' to modify the VNC server password
@@ -65,7 +65,7 @@
 ##
 # @SetPasswordOptionsVnc:
 #
-# Options for set_password specific to the VNC protocol.
+# Options for `set_password` specific to the VNC protocol.
 #
 # @display: The id of the display where the password should be
 #     changed.  Defaults to the first.
@@ -96,7 +96,7 @@
 ##
 # @ExpirePasswordOptions:
 #
-# General options for expire_password.
+# General options for `expire_password`.
 #
 # @protocol:
 #     - 'vnc' to modify the VNC server expiration
@@ -126,7 +126,7 @@
 ##
 # @ExpirePasswordOptionsVnc:
 #
-# Options for expire_password specific to the VNC protocol.
+# Options for `expire_password` specific to the VNC protocol.
 #
 # @display: The id of the display where the expiration should be
 #     changed.  Defaults to the first.
@@ -185,7 +185,7 @@
 #     the head can only be specified in conjunction with the device
 #     ID.  (Since 2.12)
 #
-# @format: image format for screendump.  (default: ppm) (Since 7.1)
+# @format: image format for `screendump`.  (default: ppm) (Since 7.1)
 #
 # Since: 0.14
 #
@@ -313,7 +313,7 @@
 #     unknown if spice server doesn't provide this information.
 #     (since: 1.1)
 #
-# @channels: a list of @SpiceChannel for each active spice channel
+# @channels: a list of `SpiceChannel` for each active spice channel
 #
 # Since: 0.14
 ##
@@ -563,7 +563,7 @@
 #     - 'vencrypt+x509+sasl' if VEncrypt is used with x509 and SASL
 #       auth
 #
-# @clients: a list of @VncClientInfo of all currently connected
+# @clients: a list of `VncClientInfo` of all currently connected
 #     clients
 #
 # Since: 0.14
@@ -626,12 +626,12 @@
 #
 # @id: vnc server name.
 #
-# @server: A list of @VncBasincInfo describing all listening sockets.
+# @server: A list of `VncBasicInfo` describing all listening sockets.
 #     The list can be empty (in case the vnc server is disabled).  It
 #     also may have multiple entries: normal + websocket, possibly
 #     also ipv4 + ipv6 in the future.
 #
-# @clients: A list of @VncClientInfo of all currently connected
+# @clients: A list of `VncClientInfo` of all currently connected
 #     clients.  The list can be empty, for obvious reasons.
 #
 # @auth: The current authentication type used by the non-websockets
@@ -852,7 +852,7 @@
 #
 # An enumeration of key name.
 #
-# This is used by the @send-key command.
+# This is used by the `send-key` command.
 #
 # @unmapped: since 2.0
 #
@@ -1023,10 +1023,10 @@
 #
 # Send keys to guest.
 #
-# @keys: An array of @KeyValue elements.  All @KeyValues in this array
-#     are simultaneously sent to the guest.  A @KeyValue.number value
-#     is sent directly to the guest, while @KeyValue.qcode must be a
-#     valid @QKeyCode value
+# @keys: An array of `KeyValue` elements.  All @KeyValues in this array
+#     are simultaneously sent to the guest.  A `KeyValue`.number value
+#     is sent directly to the guest, while `KeyValue`.qcode must be a
+#     valid `QKeyCode` value
 #
 # @hold-time: time to delay key up events, milliseconds.  Defaults to
 #     100
@@ -1263,7 +1263,7 @@
 # @head: head to send event(s) to, in case the display device supports
 #     multiple scanouts.
 #
-# @events: List of InputEvent union.
+# @events: List of `InputEvent` union.
 #
 # Since: 2.6
 #
@@ -1367,7 +1367,7 @@
 #     first available node on the host.
 #
 # @p2p: Whether to use peer-to-peer connections (accepted through
-#     @add_client).
+#     `add_client`).
 #
 # @audiodev: Use the specified DBus audiodev to export audio.
 #
@@ -1526,7 +1526,7 @@
 #
 # Display (user interface) options.
 #
-# @type: Which DisplayType QEMU should use.
+# @type: Which `DisplayType` QEMU should use.
 #
 # @full-screen: Start user interface in fullscreen mode
 #     (default: off).

From 6e202378d1533d87f77c73ffb22fbb784d08f545 Mon Sep 17 00:00:00 2001
From: John Snow <jsnow@redhat.com>
Date: Fri, 11 Jul 2025 01:40:03 -0400
Subject: [PATCH 2286/2760] qapi: add cross-references to virtio.json

Signed-off-by: John Snow <jsnow@redhat.com>
Message-ID: <20250711054005.60969-17-jsnow@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
---
 qapi/virtio.json | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/qapi/virtio.json b/qapi/virtio.json
index 2e23512085..b29c850eaf 100644
--- a/qapi/virtio.json
+++ b/qapi/virtio.json
@@ -137,7 +137,7 @@
 # @num-vqs: VirtIODevice virtqueue count.  This is the number of
 #     active virtqueues being used by the VirtIODevice.
 #
-# @status: VirtIODevice configuration status (VirtioDeviceStatus)
+# @status: VirtIODevice configuration status (`VirtioDeviceStatus`)
 #
 # @isr: VirtIODevice ISR
 #
@@ -579,7 +579,7 @@
 # .. qmp-example::
 #    :annotated:
 #
-#    Get VirtQueueStatus for virtio-vsock (vhost-vsock running)
+#    Get `VirtQueueStatus` for virtio-vsock (vhost-vsock running)
 #    ::
 #
 #     -> { "execute": "x-query-virtio-queue-status",
@@ -606,7 +606,7 @@
 # .. qmp-example::
 #    :annotated:
 #
-#    Get VirtQueueStatus for virtio-serial (no vhost)
+#    Get `VirtQueueStatus` for virtio-serial (no vhost)
 #    ::
 #
 #     -> { "execute": "x-query-virtio-queue-status",
@@ -818,7 +818,7 @@
 #
 # @index: Index of the element in the queue
 #
-# @descs: List of descriptors (VirtioRingDesc)
+# @descs: List of descriptors (`VirtioRingDesc`)
 #
 # @avail: VRingAvail info
 #

From 13f53cc902b7fa6d1864f7c13c3b3c755d1001a5 Mon Sep 17 00:00:00 2001
From: John Snow <jsnow@redhat.com>
Date: Fri, 11 Jul 2025 01:40:04 -0400
Subject: [PATCH 2287/2760] qapi: add cross-references to yank.json

Signed-off-by: John Snow <jsnow@redhat.com>
Acked-by: Lukas Straub <lukasstraub2@web.de>
Message-ID: <20250711054005.60969-18-jsnow@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
---
 qapi/yank.json | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/qapi/yank.json b/qapi/yank.json
index c14de5229e..f3cd5c15d6 100644
--- a/qapi/yank.json
+++ b/qapi/yank.json
@@ -11,7 +11,7 @@
 ##
 # @YankInstanceType:
 #
-# An enumeration of yank instance types.  See @YankInstance for more
+# An enumeration of yank instance types.  See `YankInstance` for more
 # information.
 #
 # Since: 6.0
@@ -22,7 +22,7 @@
 ##
 # @YankInstanceBlockNode:
 #
-# Specifies which block graph node to yank.  See @YankInstance for
+# Specifies which block graph node to yank.  See `YankInstance` for
 # more information.
 #
 # @node-name: the name of the block graph node
@@ -35,7 +35,7 @@
 ##
 # @YankInstanceChardev:
 #
-# Specifies which character device to yank.  See @YankInstance for
+# Specifies which character device to yank.  See `YankInstance` for
 # more information.
 #
 # @id: the chardev's ID
@@ -48,7 +48,7 @@
 ##
 # @YankInstance:
 #
-# A yank instance can be yanked with the @yank qmp command to recover
+# A yank instance can be yanked with the `yank` qmp command to recover
 # from a hanging QEMU.
 #
 # @type: yank instance type
@@ -59,9 +59,9 @@
 #   nbd server without attempting to reconnect.
 # - socket chardev: Yanking it will shut down the connected socket.
 # - migration: Yanking it will shut down all migration connections.
-#   Unlike @migrate_cancel, it will not notify the migration process,
+#   Unlike `migrate_cancel`, it will not notify the migration process,
 #   so migration will go into @failed state, instead of @cancelled
-#   state.  @yank should be used to recover from hangs.
+#   state.  `yank` should be used to recover from hangs.
 #
 # Since: 6.0
 ##
@@ -76,7 +76,7 @@
 # @yank:
 #
 # Try to recover from hanging QEMU by yanking the specified instances.
-# See @YankInstance for more information.
+# See `YankInstance` for more information.
 #
 # @instances: the instances to be yanked
 #
@@ -102,7 +102,7 @@
 ##
 # @query-yank:
 #
-# Query yank instances.  See @YankInstance for more information.
+# Query yank instances.  See `YankInstance` for more information.
 #
 # TODO: This line is a hack to separate the example from the body
 #

From 68c0156de2581b69e62b2f04b58a89bdc762e603 Mon Sep 17 00:00:00 2001
From: John Snow <jsnow@redhat.com>
Date: Fri, 11 Jul 2025 01:40:05 -0400
Subject: [PATCH 2288/2760] qapi: add cross-references to misc modules

These modules don't have specific maintainers, so they're lumped in
together here as miscellaneous.

Signed-off-by: John Snow <jsnow@redhat.com>
Message-ID: <20250711054005.60969-19-jsnow@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
---
 qapi/control.json    |  2 +-
 qapi/ebpf.json       |  2 +-
 qapi/introspect.json | 24 ++++++++++++------------
 qapi/misc-arm.json   |  2 +-
 qapi/misc-i386.json  |  2 +-
 qapi/misc.json       | 12 ++++++------
 qapi/stats.json      |  8 ++++----
 7 files changed, 26 insertions(+), 26 deletions(-)

diff --git a/qapi/control.json b/qapi/control.json
index 931a860b30..9a5302193d 100644
--- a/qapi/control.json
+++ b/qapi/control.json
@@ -13,7 +13,7 @@
 #
 # Enable QMP capabilities.
 #
-# @enable: An optional list of QMPCapability values to enable.  The
+# @enable: An optional list of `QMPCapability` values to enable.  The
 #     client must not enable any capability that is not mentioned in
 #     the QMP greeting message.  If the field is not provided, it
 #     means no QMP capabilities will be enabled.  (since 2.12)
diff --git a/qapi/ebpf.json b/qapi/ebpf.json
index d45054e666..f0257955fa 100644
--- a/qapi/ebpf.json
+++ b/qapi/ebpf.json
@@ -34,7 +34,7 @@
 ##
 # @EbpfProgramID:
 #
-# The eBPF programs that can be gotten with request-ebpf.
+# The eBPF programs that can be gotten with `request-ebpf`.
 #
 # @rss: Receive side scaling, technology that allows steering traffic
 #     between queues by calculation hash.  Users may set up
diff --git a/qapi/introspect.json b/qapi/introspect.json
index be8511b067..53100714a8 100644
--- a/qapi/introspect.json
+++ b/qapi/introspect.json
@@ -18,11 +18,11 @@
 ##
 # @query-qmp-schema:
 #
-# Command query-qmp-schema exposes the QMP wire ABI as an array of
-# SchemaInfo.  This lets QMP clients figure out what commands and
+# Command `query-qmp-schema` exposes the QMP wire ABI as an array of
+# `SchemaInfo`.  This lets QMP clients figure out what commands and
 # events are available in this QEMU, and their parameters and results.
 #
-# However, the SchemaInfo can't reflect all the rules and restrictions
+# However, the `SchemaInfo` can't reflect all the rules and restrictions
 # that apply to QMP.  It's interface introspection (figuring out
 # what's there), not interface specification.  The specification is in
 # the QAPI schema.
@@ -56,7 +56,7 @@
 ##
 # @SchemaMetaType:
 #
-# This is a @SchemaInfo's meta type, i.e. the kind of entity it
+# This is a `SchemaInfo`'s meta type, i.e. the kind of entity it
 # describes.
 #
 # @builtin: a predefined type such as 'int' or 'bool'.
@@ -82,7 +82,7 @@
 ##
 # @SchemaInfo:
 #
-# @name: the entity's name, inherited from @base.  The SchemaInfo is
+# @name: the entity's name, inherited from @base.  The `SchemaInfo` is
 #     always referenced by this name.  Commands and events have the
 #     name defined in the QAPI schema.  Unlike command and event
 #     names, type names are not part of the wire ABI.  Consequently,
@@ -113,7 +113,7 @@
 ##
 # @SchemaInfoBuiltin:
 #
-# Additional SchemaInfo members for meta-type 'builtin'.
+# Additional `SchemaInfo` members for meta-type 'builtin'.
 #
 # @json-type: the JSON type used for this type on the wire.
 #
@@ -154,7 +154,7 @@
 ##
 # @SchemaInfoEnum:
 #
-# Additional SchemaInfo members for meta-type 'enum'.
+# Additional `SchemaInfo` members for meta-type 'enum'.
 #
 # @members: the enum type's members, in no particular order.
 #     (since 6.2)
@@ -194,7 +194,7 @@
 ##
 # @SchemaInfoArray:
 #
-# Additional SchemaInfo members for meta-type 'array'.
+# Additional `SchemaInfo` members for meta-type 'array'.
 #
 # @element-type: the array type's element type.
 #
@@ -208,7 +208,7 @@
 ##
 # @SchemaInfoObject:
 #
-# Additional SchemaInfo members for meta-type 'object'.
+# Additional `SchemaInfo` members for meta-type 'object'.
 #
 # @members: the object type's (non-variant) members, in no particular
 #     order.
@@ -273,7 +273,7 @@
 ##
 # @SchemaInfoAlternate:
 #
-# Additional SchemaInfo members for meta-type 'alternate'.
+# Additional `SchemaInfo` members for meta-type 'alternate'.
 #
 # @members: the alternate type's members, in no particular order.  The
 #     members' wire encoding is distinct, see
@@ -301,7 +301,7 @@
 ##
 # @SchemaInfoCommand:
 #
-# Additional SchemaInfo members for meta-type 'command'.
+# Additional `SchemaInfo` members for meta-type 'command'.
 #
 # @arg-type: the name of the object type that provides the command's
 #     parameters.
@@ -323,7 +323,7 @@
 ##
 # @SchemaInfoEvent:
 #
-# Additional SchemaInfo members for meta-type 'event'.
+# Additional `SchemaInfo` members for meta-type 'event'.
 #
 # @arg-type: the name of the object type that provides the event's
 #     parameters.
diff --git a/qapi/misc-arm.json b/qapi/misc-arm.json
index f9dd743b52..f921d740f1 100644
--- a/qapi/misc-arm.json
+++ b/qapi/misc-arm.json
@@ -30,7 +30,7 @@
 ##
 # @query-gic-capabilities:
 #
-# It will return a list of GICCapability objects that describe its
+# It will return a list of `GICCapability` objects that describe its
 # capability bits.
 #
 # On non-ARM targets this command will report an error as the GIC
diff --git a/qapi/misc-i386.json b/qapi/misc-i386.json
index 282bd3627b..c8c91a241c 100644
--- a/qapi/misc-i386.json
+++ b/qapi/misc-i386.json
@@ -26,7 +26,7 @@
 ##
 # @SevState:
 #
-# An enumeration of SEV state information used during @query-sev.
+# An enumeration of SEV state information used during `query-sev`.
 #
 # @uninit: The guest is uninitialized.
 #
diff --git a/qapi/misc.json b/qapi/misc.json
index 7dbc29dbd6..28c641fe2f 100644
--- a/qapi/misc.json
+++ b/qapi/misc.json
@@ -23,7 +23,7 @@
 #     "@dbus-display" or the name of a character device (e.g. from
 #     -chardev id=XXXX)
 #
-# @fdname: file descriptor name previously passed via 'getfd' command
+# @fdname: file descriptor name previously passed via `getfd` command
 #
 # @skipauth: whether to skip authentication.  Only applies to "vnc"
 #     and "spice" protocols
@@ -228,7 +228,7 @@
 #    Known limitations:
 #
 #    * This command is stateless, this means that commands that depend
-#      on state information (such as getfd) might not work.
+#      on state information (such as `getfd`) might not work.
 #
 #    * Commands that prompt the user for data don't currently work.
 #
@@ -255,7 +255,7 @@
 # .. note:: If @fdname already exists, the file descriptor assigned to
 #    it will be closed and replaced by the received file descriptor.
 #
-#    The 'closefd' command can be used to explicitly close the file
+#    The `closefd` command can be used to explicitly close the file
 #    descriptor when it is no longer needed.
 #
 # .. qmp-example::
@@ -282,7 +282,7 @@
 # .. note:: If @fdname already exists, the file descriptor assigned to
 #    it will be closed and replaced by the received file descriptor.
 #
-#    The 'closefd' command can be used to explicitly close the file
+#    The `closefd` command can be used to explicitly close the file
 #    descriptor when it is no longer needed.
 #
 # .. qmp-example::
@@ -475,7 +475,7 @@
 #
 # @name: parameter name
 #
-# @type: parameter @CommandLineParameterType
+# @type: parameter `CommandLineParameterType`
 #
 # @help: human readable text string, not suitable for parsing.
 #
@@ -497,7 +497,7 @@
 #
 # @option: option name
 #
-# @parameters: an array of @CommandLineParameterInfo
+# @parameters: an array of `CommandLineParameterInfo`
 #
 # Since: 1.5
 ##
diff --git a/qapi/stats.json b/qapi/stats.json
index b63a7369dd..151ac43c48 100644
--- a/qapi/stats.json
+++ b/qapi/stats.json
@@ -89,7 +89,7 @@
 # @StatsRequest:
 #
 # Indicates a set of statistics that should be returned by
-# query-stats.
+# `query-stats`.
 #
 # @provider: provider for which to return statistics.
 #
@@ -114,7 +114,7 @@
 ##
 # @StatsFilter:
 #
-# The arguments to the query-stats command; specifies a target for
+# The arguments to the `query-stats` command; specifies a target for
 # which to request statistics and optionally the required subset of
 # information for that target.
 #
@@ -185,7 +185,7 @@
 # Return runtime-collected statistics for objects such as the VM or
 # its vCPUs.
 #
-# The arguments are a StatsFilter and specify the provider and objects
+# The arguments are a `StatsFilter` and specify the provider and objects
 # to return statistics about.
 #
 # Returns: a list of statistics, one for each provider and object
@@ -205,7 +205,7 @@
 #
 # @name: name of the statistic; each element of the schema is uniquely
 #     identified by a target, a provider (both available in
-#     @StatsSchema) and the name.
+#     `StatsSchema`) and the name.
 #
 # @type: kind of statistic.
 #

From 260f826cf8f2fe54f3cf4de541d761cf616e15ea Mon Sep 17 00:00:00 2001
From: Daniil Tatianin <d-tatianin@yandex-team.ru>
Date: Tue, 10 Jun 2025 00:25:45 +0300
Subject: [PATCH 2289/2760] softmmu/runstate: add a way to detect force
 shutdowns

This can be useful for devices that might take too long to shut down
gracefully, but may have a way to shutdown quickly otherwise if needed
or explicitly requested by a force shutdown.

For now we only consider SIGTERM or the QMP quit() command a force
shutdown, since those bypass the guest entirely and are equivalent to
pulling the power plug.

Signed-off-by: Daniil Tatianin <d-tatianin@yandex-team.ru>
Message-Id: <20250609212547.2859224-2-d-tatianin@yandex-team.ru>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 include/system/runstate.h |  1 +
 system/runstate.c         | 10 ++++++++++
 2 files changed, 11 insertions(+)

diff --git a/include/system/runstate.h b/include/system/runstate.h
index fdd5c4a517..b406a3960e 100644
--- a/include/system/runstate.h
+++ b/include/system/runstate.h
@@ -107,6 +107,7 @@ void qemu_system_vmstop_request(RunState reason);
 void qemu_system_vmstop_request_prepare(void);
 bool qemu_vmstop_requested(RunState *r);
 ShutdownCause qemu_shutdown_requested_get(void);
+bool qemu_force_shutdown_requested(void);
 ShutdownCause qemu_reset_requested_get(void);
 void qemu_system_killed(int signal, pid_t pid);
 void qemu_system_reset(ShutdownCause reason);
diff --git a/system/runstate.c b/system/runstate.c
index 38900c935a..e18eb8cb0c 100644
--- a/system/runstate.c
+++ b/system/runstate.c
@@ -437,6 +437,7 @@ static ShutdownCause reset_requested;
 static ShutdownCause shutdown_requested;
 static int shutdown_exit_code = EXIT_SUCCESS;
 static int shutdown_signal;
+static bool force_shutdown;
 static pid_t shutdown_pid;
 static int powerdown_requested;
 static int debug_requested;
@@ -457,6 +458,11 @@ ShutdownCause qemu_shutdown_requested_get(void)
     return shutdown_requested;
 }
 
+bool qemu_force_shutdown_requested(void)
+{
+    return force_shutdown;
+}
+
 ShutdownCause qemu_reset_requested_get(void)
 {
     return reset_requested;
@@ -805,6 +811,7 @@ void qemu_system_killed(int signal, pid_t pid)
      * we are in a signal handler.
      */
     shutdown_requested = SHUTDOWN_CAUSE_HOST_SIGNAL;
+    force_shutdown = true;
     qemu_notify_event();
 }
 
@@ -820,6 +827,9 @@ void qemu_system_shutdown_request(ShutdownCause reason)
     trace_qemu_system_shutdown_request(reason);
     replay_shutdown_request(reason);
     shutdown_requested = reason;
+    if (reason == SHUTDOWN_CAUSE_HOST_QMP_QUIT) {
+        force_shutdown = true;
+    }
     qemu_notify_event();
 }
 

From 2f527fff460a2c67fd37298dbd7fe42fffdb738b Mon Sep 17 00:00:00 2001
From: Daniil Tatianin <d-tatianin@yandex-team.ru>
Date: Tue, 10 Jun 2025 00:25:46 +0300
Subject: [PATCH 2290/2760] vhost: add a helper for force stopping a device

This adds an ability to skip GET_VRING_BASE during device stop entirely,
and thus the expensive drain operation that this call entails as well,
which may be useful during a non-graceful shutdown in case the guest
operating system hangs or refuses to react to a previously requested
ACPI shutdown for whatever reason.

Signed-off-by: Daniil Tatianin <d-tatianin@yandex-team.ru>
Message-Id: <20250609212547.2859224-3-d-tatianin@yandex-team.ru>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/virtio/vhost.c         | 52 +++++++++++++++++++++++++++++----------
 include/hw/virtio/vhost.h | 15 +++++++++++
 2 files changed, 54 insertions(+), 13 deletions(-)

diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c
index c87861b31f..c30ea1156e 100644
--- a/hw/virtio/vhost.c
+++ b/hw/virtio/vhost.c
@@ -1354,25 +1354,30 @@ fail_alloc_desc:
     return r;
 }
 
-int vhost_virtqueue_stop(struct vhost_dev *dev,
-                         struct VirtIODevice *vdev,
-                         struct vhost_virtqueue *vq,
-                         unsigned idx)
+static int do_vhost_virtqueue_stop(struct vhost_dev *dev,
+                                   struct VirtIODevice *vdev,
+                                   struct vhost_virtqueue *vq,
+                                   unsigned idx, bool force)
 {
     int vhost_vq_index = dev->vhost_ops->vhost_get_vq_index(dev, idx);
     struct vhost_vring_state state = {
         .index = vhost_vq_index,
     };
-    int r;
+    int r = 0;
 
     if (virtio_queue_get_desc_addr(vdev, idx) == 0) {
         /* Don't stop the virtqueue which might have not been started */
         return 0;
     }
 
-    r = dev->vhost_ops->vhost_get_vring_base(dev, &state);
-    if (r < 0) {
-        VHOST_OPS_DEBUG(r, "vhost VQ %u ring restore failed: %d", idx, r);
+    if (!force) {
+        r = dev->vhost_ops->vhost_get_vring_base(dev, &state);
+        if (r < 0) {
+            VHOST_OPS_DEBUG(r, "vhost VQ %u ring restore failed: %d", idx, r);
+        }
+    }
+
+    if (r < 0 || force) {
         /* Connection to the backend is broken, so let's sync internal
          * last avail idx to the device used idx.
          */
@@ -1401,6 +1406,14 @@ int vhost_virtqueue_stop(struct vhost_dev *dev,
     return r;
 }
 
+int vhost_virtqueue_stop(struct vhost_dev *dev,
+                         struct VirtIODevice *vdev,
+                         struct vhost_virtqueue *vq,
+                         unsigned idx)
+{
+    return do_vhost_virtqueue_stop(dev, vdev, vq, idx, false);
+}
+
 static int vhost_virtqueue_set_busyloop_timeout(struct vhost_dev *dev,
                                                 int n, uint32_t timeout)
 {
@@ -2119,7 +2132,8 @@ fail_features:
 }
 
 /* Host notifiers must be enabled at this point. */
-int vhost_dev_stop(struct vhost_dev *hdev, VirtIODevice *vdev, bool vrings)
+static int do_vhost_dev_stop(struct vhost_dev *hdev, VirtIODevice *vdev,
+                             bool vrings, bool force)
 {
     int i;
     int rc = 0;
@@ -2141,10 +2155,11 @@ int vhost_dev_stop(struct vhost_dev *hdev, VirtIODevice *vdev, bool vrings)
         vhost_dev_set_vring_enable(hdev, false);
     }
     for (i = 0; i < hdev->nvqs; ++i) {
-        rc |= vhost_virtqueue_stop(hdev,
-                                   vdev,
-                                   hdev->vqs + i,
-                                   hdev->vq_index + i);
+        rc |= do_vhost_virtqueue_stop(hdev,
+                                      vdev,
+                                      hdev->vqs + i,
+                                      hdev->vq_index + i,
+                                      force);
     }
     if (hdev->vhost_ops->vhost_reset_status) {
         hdev->vhost_ops->vhost_reset_status(hdev);
@@ -2164,6 +2179,17 @@ int vhost_dev_stop(struct vhost_dev *hdev, VirtIODevice *vdev, bool vrings)
     return rc;
 }
 
+int vhost_dev_stop(struct vhost_dev *hdev, VirtIODevice *vdev, bool vrings)
+{
+    return do_vhost_dev_stop(hdev, vdev, vrings, false);
+}
+
+int vhost_dev_force_stop(struct vhost_dev *hdev, VirtIODevice *vdev,
+                         bool vrings)
+{
+    return do_vhost_dev_stop(hdev, vdev, vrings, true);
+}
+
 int vhost_net_set_backend(struct vhost_dev *hdev,
                           struct vhost_vring_file *file)
 {
diff --git a/include/hw/virtio/vhost.h b/include/hw/virtio/vhost.h
index 38800a7156..eb3dd7616b 100644
--- a/include/hw/virtio/vhost.h
+++ b/include/hw/virtio/vhost.h
@@ -237,6 +237,21 @@ int vhost_dev_start(struct vhost_dev *hdev, VirtIODevice *vdev, bool vrings);
  */
 int vhost_dev_stop(struct vhost_dev *hdev, VirtIODevice *vdev, bool vrings);
 
+/**
+ * vhost_dev_force_stop() - force stop the vhost device
+ * @hdev: common vhost_dev structure
+ * @vdev: the VirtIODevice structure
+ * @vrings: true to have vrings disabled in this call
+ *
+ * Force stop the vhost device. After the device is stopped the notifiers
+ * can be disabled (@vhost_dev_disable_notifiers) and the device can
+ * be torn down (@vhost_dev_cleanup). Unlike @vhost_dev_stop, this doesn't
+ * attempt to flush in-flight backend requests by skipping GET_VRING_BASE
+ * entirely.
+ */
+int vhost_dev_force_stop(struct vhost_dev *hdev, VirtIODevice *vdev,
+                         bool vrings);
+
 /**
  * DOC: vhost device configuration handling
  *

From 07fde5901b5254d3b9706df22dbb16cfacf966d5 Mon Sep 17 00:00:00 2001
From: Daniil Tatianin <d-tatianin@yandex-team.ru>
Date: Tue, 10 Jun 2025 00:25:47 +0300
Subject: [PATCH 2291/2760] vhost-user-blk: add an option to skip
 GET_VRING_BASE for force shutdown

If we have a server running disk requests that is for whatever reason
hanging or not able to process any more IO requests but still has some
in-flight requests previously issued by the guest OS, QEMU will still
try to drain the vring before shutting down even if it was explicitly
asked to do a "force shutdown" via SIGTERM or QMP quit. This is not
useful since the guest is no longer running at this point since it was
killed by QEMU earlier in the process. At this point, we don't care
about whatever in-flight IO it might have pending, we just want QEMU
to shut down.

Add an option called "skip-get-vring-base-on-force-shutdown" to allow
SIGTERM/QMP quit() to actually act like a "force shutdown" at least
for vhost-user-blk devices since those require the drain operation
to shut down gracefully unlike, for example, network devices.

Signed-off-by: Daniil Tatianin <d-tatianin@yandex-team.ru>
Message-Id: <20250609212547.2859224-4-d-tatianin@yandex-team.ru>
Acked-by: Raphael Norwitz <raphael@enfabrica.net>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/block/vhost-user-blk.c          | 9 ++++++++-
 include/hw/virtio/vhost-user-blk.h | 2 ++
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/hw/block/vhost-user-blk.c b/hw/block/vhost-user-blk.c
index 0eebbcd80d..c0cc5f6942 100644
--- a/hw/block/vhost-user-blk.c
+++ b/hw/block/vhost-user-blk.c
@@ -210,6 +210,7 @@ static int vhost_user_blk_stop(VirtIODevice *vdev)
     BusState *qbus = BUS(qdev_get_parent_bus(DEVICE(vdev)));
     VirtioBusClass *k = VIRTIO_BUS_GET_CLASS(qbus);
     int ret;
+    bool force_stop = false;
 
     if (!s->started_vu) {
         return 0;
@@ -220,7 +221,11 @@ static int vhost_user_blk_stop(VirtIODevice *vdev)
         return 0;
     }
 
-    ret = vhost_dev_stop(&s->dev, vdev, true);
+    force_stop = s->skip_get_vring_base_on_force_shutdown &&
+                 qemu_force_shutdown_requested();
+
+    ret = force_stop ? vhost_dev_force_stop(&s->dev, vdev, true) :
+                       vhost_dev_stop(&s->dev, vdev, true);
 
     if (k->set_guest_notifiers(qbus->parent, s->dev.nvqs, false) < 0) {
         error_report("vhost guest notifier cleanup failed: %d", ret);
@@ -584,6 +589,8 @@ static const Property vhost_user_blk_properties[] = {
                       VIRTIO_BLK_F_DISCARD, true),
     DEFINE_PROP_BIT64("write-zeroes", VHostUserBlk, parent_obj.host_features,
                       VIRTIO_BLK_F_WRITE_ZEROES, true),
+    DEFINE_PROP_BOOL("skip-get-vring-base-on-force-shutdown", VHostUserBlk,
+                     skip_get_vring_base_on_force_shutdown, false),
 };
 
 static void vhost_user_blk_class_init(ObjectClass *klass, const void *data)
diff --git a/include/hw/virtio/vhost-user-blk.h b/include/hw/virtio/vhost-user-blk.h
index ea085ee1ed..a10f785672 100644
--- a/include/hw/virtio/vhost-user-blk.h
+++ b/include/hw/virtio/vhost-user-blk.h
@@ -50,6 +50,8 @@ struct VHostUserBlk {
     bool connected;
     /* vhost_user_blk_start/vhost_user_blk_stop */
     bool started_vu;
+
+    bool skip_get_vring_base_on_force_shutdown;
 };
 
 #endif

From f3bc2c3f33cc875a3b7e5349aa4141ea6789a01d Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Thu, 12 Jun 2025 17:03:17 +0800
Subject: [PATCH 2292/2760] tests/acpi: Add empty ACPI data files for LoongArch

Add empty acpi table for LoongArch virt machine, it is only empty
file and there is no data in these files.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Message-Id: <20250612090321.3416594-2-maobibo@loongson.cn>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 tests/data/acpi/loongarch64/virt/APIC       | 0
 tests/data/acpi/loongarch64/virt/DSDT       | 0
 tests/data/acpi/loongarch64/virt/FACP       | 0
 tests/data/acpi/loongarch64/virt/MCFG       | 0
 tests/data/acpi/loongarch64/virt/PPTT       | 0
 tests/data/acpi/loongarch64/virt/SLIT       | 0
 tests/data/acpi/loongarch64/virt/SPCR       | 0
 tests/data/acpi/loongarch64/virt/SRAT       | 0
 tests/qtest/bios-tables-test-allowed-diff.h | 8 ++++++++
 9 files changed, 8 insertions(+)
 create mode 100644 tests/data/acpi/loongarch64/virt/APIC
 create mode 100644 tests/data/acpi/loongarch64/virt/DSDT
 create mode 100644 tests/data/acpi/loongarch64/virt/FACP
 create mode 100644 tests/data/acpi/loongarch64/virt/MCFG
 create mode 100644 tests/data/acpi/loongarch64/virt/PPTT
 create mode 100644 tests/data/acpi/loongarch64/virt/SLIT
 create mode 100644 tests/data/acpi/loongarch64/virt/SPCR
 create mode 100644 tests/data/acpi/loongarch64/virt/SRAT

diff --git a/tests/data/acpi/loongarch64/virt/APIC b/tests/data/acpi/loongarch64/virt/APIC
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/tests/data/acpi/loongarch64/virt/DSDT b/tests/data/acpi/loongarch64/virt/DSDT
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/tests/data/acpi/loongarch64/virt/FACP b/tests/data/acpi/loongarch64/virt/FACP
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/tests/data/acpi/loongarch64/virt/MCFG b/tests/data/acpi/loongarch64/virt/MCFG
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/tests/data/acpi/loongarch64/virt/PPTT b/tests/data/acpi/loongarch64/virt/PPTT
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/tests/data/acpi/loongarch64/virt/SLIT b/tests/data/acpi/loongarch64/virt/SLIT
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/tests/data/acpi/loongarch64/virt/SPCR b/tests/data/acpi/loongarch64/virt/SPCR
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/tests/data/acpi/loongarch64/virt/SRAT b/tests/data/acpi/loongarch64/virt/SRAT
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/tests/qtest/bios-tables-test-allowed-diff.h b/tests/qtest/bios-tables-test-allowed-diff.h
index dfb8523c8b..bad1380eec 100644
--- a/tests/qtest/bios-tables-test-allowed-diff.h
+++ b/tests/qtest/bios-tables-test-allowed-diff.h
@@ -1 +1,9 @@
 /* List of comma-separated changed AML files to ignore */
+"tests/data/acpi/loongarch64/virt/APIC",
+"tests/data/acpi/loongarch64/virt/DSDT",
+"tests/data/acpi/loongarch64/virt/FACP",
+"tests/data/acpi/loongarch64/virt/MCFG",
+"tests/data/acpi/loongarch64/virt/PPTT",
+"tests/data/acpi/loongarch64/virt/SLIT",
+"tests/data/acpi/loongarch64/virt/SPCR",
+"tests/data/acpi/loongarch64/virt/SRAT",

From 73e2cba058c74c9a0d5b640711a1ff2428551952 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Thu, 12 Jun 2025 17:03:18 +0800
Subject: [PATCH 2293/2760] tests/qtest/bios-tables-test: Add basic testing for
 LoongArch

Add basic ACPI table test case for LoongArch, including cpu topology,
numa memory, memory hotplug and oem-id test cases.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Message-Id: <20250612090321.3416594-3-maobibo@loongson.cn>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 tests/qtest/bios-tables-test.c | 79 ++++++++++++++++++++++++++++++++++
 tests/qtest/meson.build        |  1 +
 2 files changed, 80 insertions(+)

diff --git a/tests/qtest/bios-tables-test.c b/tests/qtest/bios-tables-test.c
index 4dbc07ec5e..f41e638014 100644
--- a/tests/qtest/bios-tables-test.c
+++ b/tests/qtest/bios-tables-test.c
@@ -2439,6 +2439,74 @@ static void test_acpi_aarch64_virt_oem_fields(void)
     g_free(args);
 }
 
+#define LOONGARCH64_INIT_TEST_DATA(data)                          \
+    test_data data = {                                            \
+        .machine = "virt",                                        \
+        .arch    = "loongarch64",                                 \
+        .tcg_only = true,                                         \
+        .uefi_fl1 = "pc-bios/edk2-loongarch64-code.fd",           \
+        .uefi_fl2 = "pc-bios/edk2-loongarch64-vars.fd",           \
+        .cd = "tests/data/uefi-boot-images/"                      \
+              "bios-tables-test.loongarch64.iso.qcow2",           \
+        .ram_start = 0,                                           \
+        .scan_len = 128ULL * MiB,                                 \
+    }
+
+static void test_acpi_loongarch64_virt(void)
+{
+    LOONGARCH64_INIT_TEST_DATA(data);
+
+    test_acpi_one("-cpu la464 ", &data);
+    free_test_data(&data);
+}
+
+static void test_acpi_loongarch64_virt_topology(void)
+{
+    LOONGARCH64_INIT_TEST_DATA(data);
+
+    data.variant = ".topology";
+    test_acpi_one("-cpu la464 -smp sockets=1,cores=2,threads=2", &data);
+    free_test_data(&data);
+}
+
+static void test_acpi_loongarch64_virt_numamem(void)
+{
+    LOONGARCH64_INIT_TEST_DATA(data);
+
+    data.variant = ".numamem";
+    test_acpi_one(" -cpu la464 -m 128"
+                  " -object memory-backend-ram,id=ram0,size=64M"
+                  " -object memory-backend-ram,id=ram1,size=64M"
+                  " -numa node,memdev=ram0 -numa node,memdev=ram1"
+                  " -numa dist,src=0,dst=1,val=21",
+                  &data);
+    free_test_data(&data);
+}
+
+static void test_acpi_loongarch64_virt_memhp(void)
+{
+    LOONGARCH64_INIT_TEST_DATA(data);
+
+    data.variant = ".memhp";
+    test_acpi_one(" -cpu la464 -m 128,slots=2,maxmem=256M"
+                  " -object memory-backend-ram,id=ram0,size=128M",
+                  &data);
+    free_test_data(&data);
+}
+
+static void test_acpi_loongarch64_virt_oem_fields(void)
+{
+    LOONGARCH64_INIT_TEST_DATA(data);
+    char *args;
+
+    args = test_acpi_create_args(&data, "-cpu la464 "OEM_TEST_ARGS);
+    data.qts = qtest_init(args);
+    test_acpi_load_tables(&data);
+    test_oem_fields(&data);
+    qtest_quit(data.qts);
+    free_test_data(&data);
+    g_free(args);
+}
 
 int main(int argc, char *argv[])
 {
@@ -2614,6 +2682,17 @@ int main(int argc, char *argv[])
             qtest_add_func("acpi/virt/numamem",
                            test_acpi_riscv64_virt_tcg_numamem);
         }
+    } else if (strcmp(arch, "loongarch64") == 0) {
+        if (has_tcg) {
+            qtest_add_func("acpi/virt", test_acpi_loongarch64_virt);
+            qtest_add_func("acpi/virt/topology",
+                           test_acpi_loongarch64_virt_topology);
+            qtest_add_func("acpi/virt/numamem",
+                           test_acpi_loongarch64_virt_numamem);
+            qtest_add_func("acpi/virt/memhp", test_acpi_loongarch64_virt_memhp);
+            qtest_add_func("acpi/virt/oem-fields",
+                           test_acpi_loongarch64_virt_oem_fields);
+        }
     }
     ret = g_test_run();
     boot_sector_cleanup(disk);
diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
index 5ad969f616..669d07c06b 100644
--- a/tests/qtest/meson.build
+++ b/tests/qtest/meson.build
@@ -148,6 +148,7 @@ qtests_hppa = \
 
 qtests_loongarch64 = qtests_filter + \
   (config_all_devices.has_key('CONFIG_LOONGARCH_VIRT') ? ['numa-test'] : []) + \
+  (unpack_edk2_blobs ? ['bios-tables-test'] : []) + \
   ['boot-serial-test',
    'cpu-plug-test']
 

From c43ca0de62749286ee099baaf628b7f7b6e9844f Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Thu, 12 Jun 2025 17:03:19 +0800
Subject: [PATCH 2294/2760] rebuild-expected-aml.sh: Add support for LoongArch

Update the list of supported architectures to include LoongArch.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Message-Id: <20250612090321.3416594-4-maobibo@loongson.cn>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 tests/data/acpi/rebuild-expected-aml.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/data/acpi/rebuild-expected-aml.sh b/tests/data/acpi/rebuild-expected-aml.sh
index c1092fb8ba..cbf9ffe0dd 100755
--- a/tests/data/acpi/rebuild-expected-aml.sh
+++ b/tests/data/acpi/rebuild-expected-aml.sh
@@ -12,7 +12,7 @@
 # This work is licensed under the terms of the GNU GPLv2.
 # See the COPYING.LIB file in the top-level directory.
 
-qemu_arches="x86_64 aarch64 riscv64"
+qemu_arches="x86_64 aarch64 riscv64 loongarch64"
 
 if [ ! -e "tests/qtest/bios-tables-test" ]; then
     echo "Test: bios-tables-test is required! Run make check before this script."
@@ -37,7 +37,7 @@ if [ -z "$qemu_bins" ]; then
     echo "Only the following architectures are currently supported: $qemu_arches"
     echo "None of these configured!"
     echo "To fix, run configure \
-         --target-list=x86_64-softmmu,aarch64-softmmu,riscv64-softmmu"
+         --target-list=x86_64-softmmu,aarch64-softmmu,riscv64-softmmu,loongarch64-softmmu"
     exit 1;
 fi
 

From 67fbf12288df10eb1ea76d4f48d6a8efa46ae65c Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Thu, 12 Jun 2025 17:03:20 +0800
Subject: [PATCH 2295/2760] tests/acpi: Fill acpi table data for LoongArch

The acpi table data is filled for LoongArch virt machine with the
following command:
  tests/data/acpi/rebuild-expected-aml.sh

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Message-Id: <20250612090321.3416594-5-maobibo@loongson.cn>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 tests/data/acpi/loongarch64/virt/APIC          | Bin 0 -> 108 bytes
 tests/data/acpi/loongarch64/virt/APIC.topology | Bin 0 -> 153 bytes
 tests/data/acpi/loongarch64/virt/DSDT          | Bin 0 -> 4641 bytes
 tests/data/acpi/loongarch64/virt/DSDT.memhp    | Bin 0 -> 5862 bytes
 tests/data/acpi/loongarch64/virt/DSDT.numamem  | Bin 0 -> 4647 bytes
 tests/data/acpi/loongarch64/virt/DSDT.topology | Bin 0 -> 4943 bytes
 tests/data/acpi/loongarch64/virt/FACP          | Bin 0 -> 268 bytes
 tests/data/acpi/loongarch64/virt/MCFG          | Bin 0 -> 60 bytes
 tests/data/acpi/loongarch64/virt/PPTT          | Bin 0 -> 76 bytes
 tests/data/acpi/loongarch64/virt/PPTT.topology | Bin 0 -> 176 bytes
 tests/data/acpi/loongarch64/virt/SLIT.numamem  | Bin 0 -> 48 bytes
 tests/data/acpi/loongarch64/virt/SPCR          | Bin 0 -> 80 bytes
 tests/data/acpi/loongarch64/virt/SRAT          | Bin 0 -> 104 bytes
 tests/data/acpi/loongarch64/virt/SRAT.memhp    | Bin 0 -> 144 bytes
 tests/data/acpi/loongarch64/virt/SRAT.numamem  | Bin 0 -> 144 bytes
 tests/data/acpi/loongarch64/virt/SRAT.topology | Bin 0 -> 152 bytes
 16 files changed, 0 insertions(+), 0 deletions(-)
 create mode 100644 tests/data/acpi/loongarch64/virt/APIC.topology
 create mode 100644 tests/data/acpi/loongarch64/virt/DSDT.memhp
 create mode 100644 tests/data/acpi/loongarch64/virt/DSDT.numamem
 create mode 100644 tests/data/acpi/loongarch64/virt/DSDT.topology
 create mode 100644 tests/data/acpi/loongarch64/virt/PPTT.topology
 create mode 100644 tests/data/acpi/loongarch64/virt/SLIT.numamem
 create mode 100644 tests/data/acpi/loongarch64/virt/SRAT.memhp
 create mode 100644 tests/data/acpi/loongarch64/virt/SRAT.numamem
 create mode 100644 tests/data/acpi/loongarch64/virt/SRAT.topology

diff --git a/tests/data/acpi/loongarch64/virt/APIC b/tests/data/acpi/loongarch64/virt/APIC
index e69de29bb2d1d6434b8b29ae775ad8c2e48c5391..3477789f422cad54f16734b3ec9ad1ff5135165d 100644
GIT binary patch
literal 108
zcmZ<^@N~{$U|?YU>g4b25v<@85#X$#prF9Wz`y`vgJ=ejJOcxRAU}-90Ah&nGBPv#
o{|}O7U=S5%WMKH958^m5FfbfoU|<jv1gR1L2{8yTFgP#(05Xsa0RR91

literal 0
HcmV?d00001

diff --git a/tests/data/acpi/loongarch64/virt/APIC.topology b/tests/data/acpi/loongarch64/virt/APIC.topology
new file mode 100644
index 0000000000000000000000000000000000000000..da0089d57f608aca230a76b67e72f9f0ad8e71f2
GIT binary patch
literal 153
zcmZ<^@N}NZz`(#5=H&0}5v<@85#X$#prF9Wz`y`vgJ=ejJOcxRAU}-90AdL8GlD1>
z7UXASVqjnZVUUm@KO-{(0|N+yxFWoa%nbkkgN$Ne5EW)*VECX9;y5rcFdSfDU=R}o
PsS*GQF$gd)I4}SJQ#cF(

literal 0
HcmV?d00001

diff --git a/tests/data/acpi/loongarch64/virt/DSDT b/tests/data/acpi/loongarch64/virt/DSDT
index e69de29bb2d1d6434b8b29ae775ad8c2e48c5391..f32e732b11a557ae01c7f383625d3b6f459ac9f7 100644
GIT binary patch
literal 4641
zcmZ<>b_r1wVqjq0<mB({5v<@85#X$#prF9Wz`y`vgJ=O~uJ~Z5_~<5YPG^5#1CDqP
zPZ!<*zW@VM149Om_)t$5299`VXGcbkc;}#CK^rd1E^P(|9*|ZB5O~1&KpsTjXM)fm
zHW))ybh0sUGCDCZFjO*d#JdE$2pKa83UdjF-1vWMS6+{A*Tg-u_j@g76p~>Sl4Rmx
zc=(l-H#sLiIa@caC^fIJG&L`|k^$9?hFIJPavdHwLfv+s8IK#CDRiR?G#q_E;b?@#
zja*Fl0}|@E`z&}I=|W9M8e?-LGk!-x9e1A<k0V_vb7XXrCyS4P0a8+QHgJO{#ekq-
zK|U_-PBsQc#sH{ApoEDkCc+jU92Cq5H3})kz>Q+$h(|Um5Q|X|F}P7)AXgzpEZiti
z#3Gv&gvBg~7^+!F;g2wj8P#3ESj>Wm!Oe1-9N_GU6k3i37N9H(&Bl%f#ta<s!LIHM
z9Pv(0e(-P%4ha&J=aLCvaAxpiNM%r9Fknz%aA8PgC}YTENM=Z7U;r5c&Qk$FA;Lbz
zTn$3pEZqP9Gl1fT0m5eVF)%P>5aI!eb20fC7#P7g%svJN#tcHdEIj}JGcthm7{YlV
zT}BK-d=NRXK4SzIq|*SZmI<uW2+jlPgehfW0P8e>>SSWz0_lX=!VK04a{)60NGD7w
zGeoB$R3|e;C(ITWuuhl@Sim}AN?9N}VUA~k=!DtA3f2j80V`N1OerfwC(QAz5S=hv
z*uXkrE?@)egehf%=!7|*4Wbif3p-dR%mwUVoiL^B5S=i`vqN;kY~cXwgt>qNtP`e`
z1ELe=cn*k8m@S-OoiG=0f_1`_azb>%9M1{S3A2R@tP|z}F0f9RQZ9&2nB%!1I$^eO
zgLT4Ozzx<3Q_2m|33EI*L?_G^9<WZB3wXdfVM=)*I$@6If#`(U!VA_3a{(_{Crl|X
zL?_Jgybzr*Tll~_VJ_eU>x3!ggXn}go)4lEW(z-9C(H%>V4X0f{1BZm$MZvU!fX)$
z>x8*L0IU<HQ~;tA=6C^!PM9r%V4W}*2!eIOlnO$0!W=IM(FwCf2&@z40wJ(Ym{K8#
zPMG6`AUa{T2!nOPTp$eA2~#Qz(Ft?BFhnQJ77?&cm<vR}I$=shAUa`=7lG)6*&+(o
z33GucSSL)WC`2dB@uCo&Fk8gHI$<sl1M7q-6@%!6IbIB+6K0DzSSQQ{;$WRHrQ#5s
zFvp8Sbi!<r0PBRgKmx22rc?r=6Xtjch)$R-l3<-M7f6D2!jwuvbiy1j3DF6&MGCAF
z<^n0OPMA_Dh)$T}r64+Cwn&3@!dxH?)(KN84bcg6yfj27%oZ82PM8a1z&c?{Wgt3X
zj+cSxgxMks)(LZgELbN@sVqb%%<-}ioiJPEz&c?rkOS+4DV2lhggIUgq7!C|JXj~p
z1@d5>Fs1SkoiNACLv$K3i15TaJ2^5e;bCB4P=GX}{aCr8I(QkFKtc=*^$ZLQ4Git#
z42(R?;I=aZ1H=FQ3=9ko3=#|n7#L7n++cB#ivRyX8etkhv;&B!WZ(!64G3W1a1IIb
zVGwcSjQ0<AX6ediaCQkdT;RbzIRn%HkM_N7{9RtgVOn^J;{n_2X<gY|EY2?BMqSxl
z9L_G`#swe_$Q%&E7-Up6h~Sb3kqZPSP0nPj1sModZMZ;e(qxb>kR(J{03=xe;)BGO
zWH01{h=VLKT#_xK8}AbA%d$Wb;+hNQC!YqJR{2g8f8{HA*x7dh=j1GgC4$V1j39y`
zy2+O%$Tb+Lk>hM&1ZtlI1q&K;8DNBu0w^5*|NpNJqLDBMh+WAL-Q>*?qX+8txVyT<
zLt4R(&H<hV28N)<QmCg3ue&R_-ve)KGBdh^TVl}-u0gKu3_J`Bd;(l7(T&_7uCr^f
ztB-<+S-fjl2xkF^ldwQwa&-b1sEyJV5FX^j)v!PUB*4MI#Sx>=471uf*x66O!v@5S
zZt~%TxG5mWH5lwB9>)t@Y~U^!uX8}Cf=7NyK~8D9LQ!gQerZv1YB57JqjP|dH#8gs
zx%k>R85rdm_yj<ys*)kPAs{F?gn<Vn!o?Har~%?SGAK9)xcV_Vd-?@4ItTfNF*>_?
z8Gr~kMh0eQXI~eN=tiM{px_W@XOO2D6r5cgLlmN$oQxo@a}EfFxQ-VZVg?}lJzYSK
zWfc*04snZQTEI0qgQ3mYz`!6=#Dmp2IK+`NS{dqXkncdQ{{O!q16e58)u(_VVS(6W
zWI>Qi3%K|bqSaAEeY}?>i1@OATuz+9jL6zuy$mqS6LA*@#RUfzXL30ExrPfd{pWCY
z_3{y7`d`41T)>#J$W?f93S$97N&#a+0YhQ|L+T<ot_hP97^fyP7BD0fBqQ4h_8YQ*
zv#-kn;i<?XE{-9|OBe7>oSew@e{w3<{{qI8r3L5;7AT;E4k!u>k~=`|OJpcbEMQDP
zQvixykOEgPpHzm@)B?tY(&Pe$q(wGUlM)M>!5Whol0i|H%vg{dZHVb=lz{W}3ocCp
z>9?GklnT=C>g5B|&&5nYbC7RXX%c3*J90St2Z!)r33trof#MivUzdVRv;ZpLVnP-H
zDak?>aB&R5a6xpF2MZ{rf^!@+O&gd)yGbHE@xdXE97{k+n1LhS*D*wpn~Q^igMk4w
zx*@_B?;jk(4e|g(MrM|X0@N;0p#n-x3{XBO%YgXNO_HFp0Adqph{f5!8ER2<lcAdr
ztbFtF3-UKGFf@hAL23+W_GVyUkYQk8U<4InAT7|YEvgpKXh=}7AVP~QM2mnx45%+?
O8ZX4o!o|wKzyJUR4J17P

literal 0
HcmV?d00001

diff --git a/tests/data/acpi/loongarch64/virt/DSDT.memhp b/tests/data/acpi/loongarch64/virt/DSDT.memhp
new file mode 100644
index 0000000000000000000000000000000000000000..f19eae7d00f9c0eefc9e92de2c8a24863bf309d6
GIT binary patch
literal 5862
zcmZ<>b_sbV#=yY1!^z*-BUr&HBEVTeK|z6$fq?<U2GIh}T=Bt9@zG7*oX-Bf1|0Do
zo-VuregOui28IkA@u8kB3>@*!&W?;6@y<cPf;L>1UD^x`JRq$MAn<_kfjo%5&jg`C
zY%qqZ=wxHyWOQO+V5nr^h<6Eg5i({H6y_2Tx$*zjuDl-Ku8DhQ@Aq2FC?vxuB+10X
z@bD`uZ*oq4a<*<-QEFacX=+|_B?GD(4Y9Zp<T^ZVgu3lMGaffOQ|Lw)XgK<S!qEte
z8@ZV92PD*S_gU~b(uJCiG{)vgX8ewXI_^Fz9!I)T=E&$KPZl2o1Ei$rY~Th@iUC2v
zf_z-uoooz@i~&%KKnW97OoS~yI4GDAY7|n6fg8oh5sz$CAQqz_VsN9pK(0cHSh!K3
zh($Il2#Z+|F;ugV!XIH4Gpf6Sv6uxBgPY|vIl$QyDYP67EI?TnnvER|j2SrMgI(Pj
zIO3h0{NUjj91<ib&m|MU;LPC3kjkLIV8Ecj;KGo~P{xqSkj#+EzyLA?oTmbULWF&a
zxf+DHS-AiIX8^?w1BA`!V_;y&AjAU_=VJ0PFff8~n0*Wkj2VP@S$O{cXJi2BF@*C#
zx{Mfv_#kp%eZ~kbNT&f*EfZL$5u69o2~*0%0M=;$)yc%b1=0z#g&C|9<^pC0kWQFV
zW{6Hhs7_{xPM9q$V4W}*uz+>Kl(Il{!W_>6(FwDK6|58H0#>k2m{L}VPMG6aAv$5U
zuz_{LT)+m_2~)}j(Ft=r8$>6}7Iv^sm<!m!I$=uLAv$4>XNTy7*}?(V33CAlSSL&=
z2Sg{#@f;AHFk3jmI$<v01nYz;<%H;jIi3@u6J`q+SSQQ{Twt9rrCbo5FvoL2bi!=m
z2J3{mfE%n6rj#3^6Xtksh)$R-JYbzL7w~{}!j$qrbiy3Z1JMbyg%_+7<^o=@PMA_&
zh)$T}c_BJsw(x;<!d$=y)(KO}2hj<0JRd|S%ocvIPM8b$!8&0|`5`)Cj^~HygxMkh
z)(LZg09YqXsQ^SL%<%#coiJMj!8&0s5CrRlDHVk1ggIUiq7!C|5LhS71wvq*Fr`8e
zoiN7>L3F}w5eDmoxj-1K6Q)!cq7&wLVTewcEh1o@Fc*k`b;6X2Ky<<!F9OjCvqcoF
z6XpU@uuhm#QHV~M<3%AlVYY~Yb;4XA2G$8vDhAOBbG#TtC(IUcuuhl@#KAgYO2r{M
zVU8Dv=!DrK0oDm~fdp75OsND!C(Q8@5S=hvB*8jiE|3K4gejGT=!7|55~34kixgNV
z%mq?loiL?R5S=i`OF?wPY>@`*gt<T(tP`eG8ln^Ccxi}Em@P73oiG>3fOW!@%0P6&
z94`aW3A05OtP|z}S+Gu+Qdx*jnB!$3I$^fRfpx-MAP3e7Qz{4133I$0L?_G^d9Y5H
z3*^B%VM^s8I$@5Nhv+n75aEe;c5-A`!o$G8pa5w``>}FGb?`DUfrJ<s>KPaq8W`He
z85nt(!EI*-28RFp85kHG7$g`DFfgFDxWVEe761Q(G{Q81Xa^8c$-ogD8W6z1;T#g=
z!yw|u8SfwL%+i(3;Or7^xWI#bat5dY9_@SE_`AG}!?f@c#{;(4)4H;`Se#wLjk>bA
zIGkO=jSD~=kU1cRG03QD5Wyu6A{Piunw-g43o;O_+Hir`q{$#%AW4X@07$X`#0QBl
z$zI3@5eHdfxFlOdH{K=Kmt}z>#5EVpPd*Jct@52H{>oSKu(R(1&dFH}O9Yu289@X?
zbdxVjkZUkfBgfgm2-H3a3KlfxGQbEQ1yDHr|NmbdL?dAi5WA8gy2+U<Mi12Oad&lz
zhqQtnodY}#3=BbyrBF{7UUye;zX#sfWM*^+x5T0wT!UQQ8F&~N_yo9Eq8qtETxZu{
zS04otKbCmcun^7y5HDeY*yQR2Mh3<heP)nFz8(S2zQN9Z3j`)tCvbt<E^PtfK~7u^
z3nV}S91L6>P?aDjIR`uYMK}4eLLBMq5#R!GB&c8JXkZ3u#PRy3=H?ewDrDrB6y%hq
zD-@*`=a&{Grxrs4Mv#lIjgx_qg@I2%0_t{;0N)@69*_u^M0As@3*3BXZ05Uo`uZxQ
zq?ToZ&GdEg3*usmZq$Oh6XYt8dCa~+PCg30K~5eDzCk`9mXC*mZ$L!6LUf}Bnp#H&
z2QFXN;CMz~PrqPB-yq*GMqgL2c*f{P1vHh+zMvrW^>+<Z@bwRNRuB=64-Ro;Sim_M
z<PL@<3`@AUqZxgDoV^)D9N9o2izHXTkPxj5lKcOEk<HWukdA@`kbw(?Cqrxwaf?h~
zEC4%Wq1XbE$q=W2M7fv?zz!=)U`&Ws2N|-2QAF1_C^&=>$=HIK84O?pxhI4DQ^3U!
zQ=K5<DB<fI6wC>80!%H3Z;+V@Jh{R%Iw(nk@W1~M0AhnMg!lh{B|{fTBNv~qr=Jgm
zDdg+v=K*1=`MAPFwR~J*qGG;|5m2>KzK#(d1)%5wX#z2PKn4}~2Kjh^G=LaBAVZ2k
z!XO4nFNgz{2I*cPG8H5Sk}m@B89~GXL9ifW35Ww00kM2QET07~?2|#l3>>~e#zvrS
zM!Prz1EOpLc@^eGu=k9OxVU^h{o=bo>bdxQ9V4JjF&|gI_yUm4An5|IGaMu03qbA!
zNkL->qz%qAGZ9ho4T$h%M2~<1P^v^klZLN<a0m;AqD)YtE64(+I*5@XO1`dM222<V
z!ATdQB)Z9$%{KtlWd)TT1{DSd4B!mK<9LCmL4+SPa>B3#lqf*sDI)yfq`U-_rl9<Q
z2w#RJAUA{gg7N;rA<Q7xfw&o&St9)Lu3iQp`wYM$Q0olA!!x`F72uH?4^I~wStlan
z8{!tpw18`J216Ujo0%XcBZz63Dd1-VD&L};d^jPcNkEWmFwFB@Y!D|p2ZSnkU=&l)
zjLrc*-l(OOJOiHqs8XzCh;9f73Jzi50f}(&L^o=HxQ+}8&H=7|jLx9)!x>b5ID<mQ
z+11O9k%8IS+1G_5x=|<~C^&@K8B~BUC^)+~hA2cgc^E-l=Nu3UaUCzTzz4;YGdSqD
zSVaV#5gv6mFfhmz@nCfh4sqm+R)&^OAm4#p{r`VK2C`7Ft4{#~sL)3i1i2JaGN6e1
zcrQs1@nr$IoH&DFl?d2!S1*HTbu{xt+{Hmv1_u^raya|Bh6^$M=WurQ@)2VCU%-%D
zz?ibgRd{j=V*x`-0b@b|Lt+6#>LNF;36m2TrzV4nxq@V53&4Iu7I5};Ss*+WS;WOL
zBzfrqzKN3)x&BX1<@#U1n6k70UBLo{$;d*WC@e_s0J$%bp)|38F#$~hD0)E(T)li!
z8A?+N7!yj93mB3X*-TAJENBL6Okzj|MOiXqL2|SqrmIl`&eJcrGzp~Na%xg4NWZI>
z4@^H7GXc#(zG0<FnBnfo;p`tA!h<E;F_Q<1W1M|m3Nn#H!^JVAfQt!P1f(PjS-{0H
z1j7Z<O@1t(lnTyq&@^pe4rw5O8lJ%+jvPxsNtl5n-q$fikeiExfrEhoG&n252P$W{
zK^|bp$jsu12bDr1u!<Pg3}Jw}0F-e+X)L-)64Y>k*avElI2$-at&46lbn}5V(tP}a
z{0$5YO`&p-W-qi!!oa{F!@$762x^Iev_Qw_P_=-Dbc2Eg5n5y+S_A}QKm%H)@j~n@
JT&xTX3;<Z!gG>Mb

literal 0
HcmV?d00001

diff --git a/tests/data/acpi/loongarch64/virt/DSDT.numamem b/tests/data/acpi/loongarch64/virt/DSDT.numamem
new file mode 100644
index 0000000000000000000000000000000000000000..9b462869cd4911714e7c2a22025c465afa2a7d52
GIT binary patch
literal 4647
zcmZ<>b_r1zVqjpjbMklg2v%^42yj+VP*7lGU|;~TL9~D~SA4Kjd~}mHr?bDW0Y|)t
zrwea@Ux0zBfguA&e5j`j14q2Gvm+x%ymL^npbeL0mo@_f4@fHm2s~hXAP=JNGeKw&
z8;qeUI@uUF8J!py7%CY!;$4DWgp8R4g}DSoZv4NsE3e15YvP{S`@I%33dt}ENiy*;
zJp9Vao1BxMoUNNyl$uvqnwpnf$$;ucLo99txekvTp>Dg+jK_`66uQv`8je1oa5Tc=
zMlL4&0SR^7eHJ{9bfKmrjj=hB8NVZ;j=Rr_$C0j-IWoG*lf}ot04XUt8@R!fVn9%^
zARiZZCmRDJV*u15P{KqN6Jd)F4hm+38ikZ%;6^cW#3LIOh{Y&~7~Ci?kgJd)7H$+M
zVv)@X!eSOg4Am^8@JE=%jOwmnEM`H(;AS~Z4siBF3N1$i3s9DYW@ASKV+M}+U{`kr
zj(8_0KX^C>hXe`AbIAlSI5T)Mq%tTl7%(U>xG<zLlrdy7Br~KkFn|mJ=c$085MiHU
zt_C4)7ViK589;Hv0AVxw7#J8b2=Rc#xtM$m42)nLW*-9sV+J8!7M}nA85ux&4B<SG
zE+YmZK8PGxpD}_9(rExy%LLYG1m}Tt!jv*GfOQ%`buuw<fpo%bVFv4jxqz7gq!Xr;
z8KTn=s*@R_6J`qwSSQQ{EMT25r7RGgFvqh%bi!<51?z;lfEBD0rj!+;6XtkUh)$R-
zY+#)*7qEeK!j!T>biy3Z2GI$#g&nLD<^p!GPMA`5h)$T}*&#Y%ws3%T!d$=s)(KO}
z0nrI_JO@N4%oa|tPM8Zg!8&0|IUzb>j^~8vgxSIc)(LX~7g#4uDHlX1%<)_hoiJOt
z!8&0s;0Ei2DdmRfggKrYq7!Bd4_GJ61w3G#Fr_>YoiNAqKy<=v;RWl2xqug}6Q-0G
zq7&wLUWiVZEqq{|Fc<KFb;6YLL3F|#&j-;7vxOh56XpVbuuhm#euz$(<M|;vVYUc>
zb;4XA0M-dpDge<5bG!gVC(IT>uuhl@1i?CCN(CW0VU8Ds=!DrK1l9?2fe=_HOsNn=
zC(Q9e5S=hvguyytE)WLmgeet<=!7|57@`wqiwIaJ%mpG~oiL>$5S=i`i$HY3Y!L<P
zgt<TztP`eG6rvO6cu|N>m@Q&poiG=Ofpx-^ia~V394`jZ3A05UtP|z}aj;I9QgMh*
znB&DEI$^d*fOW!LAOY41Qz`+`33I#zL?_G^Nw7|s3nalhVM-+-I$@5Ngy@9XA_dk7
zbAc3CCrqgnL?_JgQV^XmTcp7{VJ?sc>x3zlhUkPjUK*kkW{V71C(H#hV4X0fG7z0G
z$IC!;!fcTR>x8*L7OWGdR2HHW=6G3%PM9rnV4W}*$bogjl*&PL!W=IL(FwCf9;_4Q
z0(r1bm{NI&PMG86Av%p1M0nzzog5jK@GvkiC_tLgeym(k9lQ)oARz{ZdIkoD28MQV
z21XucaNC)If#Lst1_lNP1__1(3=F6(Zm>8=#sB{xjW7)$+5tpVGH?Wk1_Us0IEMuJ
zFo?Ku#`_05vvg%MIJ<-!F7RNVoB?WpNBiD3{w^=$FfF{q@qq31w61I}7H5}mqpoZ&
z4riBe;{p%|WDba73^J-3L~zN2$OQtECTB9%f(!(!He4V!X);I`ND?9}0Fo>K@j>EC
zvKR6}#6gxAF3A?rjduz5Wm%vIam@wulTU+9t9&Plzw(tl?CiUMb8;5L5<zB0Mi9Xe
z-Q>#><Qk0B$Z<9>0<}+qf(4Da3^2k+0Td4Z|NmD9(MXsB#I9tBZt~`c(F1jR++AJb
zA+2CX=KxOw14B?_Db&-2*WDG|?}0ZqnHk-|EwShZ*C1DS1|9|mJ^?P4=tgc3*V#4L
z)ki_ZEZ#LNgtGv|Nmw8-xjKOh)JACw2oG}NYFHov65wFq;)u~_hFR?#?CdAtX9MC!
zH~DZv+!PSx8Vq(5kK+X{HgFe=*Et|m!6Uz<Ag454p(wRDzqBYhwU{BA(K*1!8yXIR
zTzqYu42<#&d;*|URml+D5D*j`!oUL(;o^yI)BtfE85EoYT>TiGJ^g|ior8SC7@b|c
z3_ye%BLlOuv#$$BbfZu}P;dydGssg63eGN$Aqvq=9!3z?IR}J7T*nIyF$0kOo-QEA
zvWf^ghqy&DE#R7*!O-SxU|^6b;=$@19OB3stqk=x$af%D|Nmc*fh-j4>Qlgwut01w
zvLMK%1zh|I(dsCoKHf_bM0{C5E+@`lMr7@-UIrNEiMWe{;(`N<GdZ07T*HN!{&P6H
zdie-3{V!lhE?`Vq<SINlg|UDkrGPP^fFZGfA$5@(*M!Llj8l^t3m6g#l96o$`wdyZ
z+1F)(@Kj_G7srs~r3?5bPEO?dKRK1_e*t64(gJh^3lva72NZ<`$sHi~B{GyI7BD8D
zDF8(;NP(-DPbx!cY5`+HX>tKW(juFwNr?r`V2w!($)G4pW-LgKHpFx_O2B#g1(zm)
z^jl6%N(Je6_40w~=VB(HImkDxGzl}@9XXu+gF|?*gga*PKyi$-uS-EDS^yPrF(He9
zlw=_bxHyJjxFEX8j|G%c!8s0^rVY%Y-6Rp7_}~ynjwPTZ%)k-v>lh-)&BejM!N33-
z-4Nl6_YV%?26=!XBQuL5J|M!EK|}#+BdBNrr6~p|ACz%G{OBf0P>BGs4>Zu?Y~T#F
zF1pFk%?DP>`S=C-8yFaxLggU!1~ij1Ffhn4FfcHJiZYNEXa^Tn3usIvC|D4oMHZq(
UKp+OxBQ%W{VrSuEWnf?c0BwsUJpcdz

literal 0
HcmV?d00001

diff --git a/tests/data/acpi/loongarch64/virt/DSDT.topology b/tests/data/acpi/loongarch64/virt/DSDT.topology
new file mode 100644
index 0000000000000000000000000000000000000000..65111aa822663a907b83487cb496be38a4bdff05
GIT binary patch
literal 4943
zcmZ<>b_wwpW?*1cbMklg2v%^42yj+VP*7lGU|;~TL9~D~SA4Kjd~}mHr?bDW0Y|)t
zrwea@Ux0zBfguA&e5j`j14q2Gvm+x%ymL^npbeL0mo@_f4@fHm2s~hXAP=JNGeKw&
z8;qeUI@uUF8J!py7%CY!;$4DWgp8R4g}DSoZv4NsE3e15YvP{S`@I%33dt}ENiy*;
zJp9Vao1BxMoUNNyl$uvqnwpnf$$;ucLo99txekvTp>Dg+jK_`66uQv`8je1oa5Tc=
zMlL4&0SR^7eHJ{9bfKmrjj=hB8NVZ;j=Rr_$C0j-IWoG*lf}ot04XUt8@R!fVn9%^
zARiZZCmRDJV*u15P{KqN6Jd)F4hm+38ikZ%;6^cW#3LIOh{Y&~7~Ci?kgJd)7H$+M
zVv)@X!eSOg4Am^8@JE=%jOwmnEM`H(;AS~Z4siBF3N1$i3s9DYW@ASKV+M}+U{`kr
zj(8_0KX^C>hXe`AbIAlSI5T)Mq%tTl7%(U>xG<zLlrdy7Br~KkFn|mJ=c$085MiHU
zt_C4)7ViK589;Hv0AVxw7#J8b2=Rc#xtM$m42)nLW*-9sV+J8!7M}nA85ux&4B<SG
zE+YmZK8PGxpD}_9(rExy%LLYG1m}Tt!jv*GfOQ%`buuw<fpo%bVFv4jxqz7gq!Xr;
z8KTn=s*@R_6J`qwSSQQ{EMT25r7RGgFvqh%bi!<51?z;lfEBD0rj!+;6XtkUh)$R-
zY+#)*7qEeK!j!T>biy3Z2GI$#g&nLD<^p!GPMA`5h)$T}*&#Y%ws3%T!d$=s)(KO}
z0nrI_JO@N4%oa|tPM8Zg!8&0|IUzb>j^~8vgxSIc)(LX~7g#4uDHlX1%<)_hoiJOt
z!8&0s;0Ei2DdmRfggKrYq7!Bd4_GJ61w3G#Fr_>YoiNAqKy<=v;RWl2xqug}6Q-0G
zq7&wLUWiVZEqq{|Fc<KFb;6YLL3F|#&j-;7vxOh56XpVbuuhm#euz$(<M|;vVYUc>
zb;4XA0M-dpDge<5bG!gVC(IT>uuhl@1i?CCN(CW0VU8Ds=!DrK1l9?2fe=_HOsNn=
zC(Q9e5S=hvguyytE)WLmgeet<=!7|57@`wqiwIaJ%mpG~oiL>$5S=i`i$HY3Y!L<P
zgt<TztP`eG6rvO6cu|N>m@Q&poiG=Ofpx-^ia~V394`jZ3A05UtP|z}aj;I9QgMh*
znB&DEI$^d*fOW!LAOY41Qz`+`33I#zL?_G^Nw7|s3nalhVM-+-I$@5Ngy@9XA_dk7
zbAc3CCrqgnL?_JgQV^XmTcp7{VJ?sc>x3zlhUkPjUK*kkW{V71C(H#hV4X0fG7z0G
z$IC!;!fcTR>x8*L7OWGdR2HHW=6G3%PM9rnV4W}*$bogjl*&PL!W=IL(FwCf9;_4Q
z0(r1bm{NI&PMG86Av%p1M0nzzog5jK@GvkiC_tLgeym(k9lQ)oARz{ZdIkoD28MQV
z21XucaNC)If#Lst1_lNP1__1(3=F6(Zm>8=#sB{xjW7)$+5tpVGH?Wk1_Us0IEMuJ
zFo?Ku#`_05vvg%MIJ<-!F7RNVoB?WpNBiD3{w^=$FfF{q@qq31w61I}7H5}mqpoZ&
z4riBe;{p%|WDba73^J-3L~zN2$OQtECTB9%f(!(!He4V!X);I`ND?9}0Fo>K@j>EC
zvKR6}#6gxAF3A?rjduz5Wm%vIam@wulTU+9t9&Plzw(tl?CiUMb8;5L5<zB0Mi9Xe
z-Q>#><Qk0B$Z<9>0<}+qf(4Da3^2k+0Td4Z|NmD9(MXsB#I9tBZt~`c(F1jR++AJb
zA+2CX=KxOw14B?_Db&-2*WDG|?}0ZqnHk-|EwShZ*C1DS1|9|mJ^?P4=tgc3*V#4L
z)ki_ZEZ#LNgtGv|Nmw8-xjKOh)JACw2oG}NYFHov65wFq;)u~_hFR?#?CdAt<`3dV
zH~DZv+!PSx8Vq(5kK+X{HgFe=*Et|m!6Uz<Ag454p(wRDzqBYhwU{BA(K*1!8yXIR
zTzqYu42<#&d;*|URml+D5D*j`!oUL(;o^yI)BtfE85EoYT>TiGJ^g|ior8SC7@b|c
z3_ye%BLlOuv#$$BbfZu}P;dydGssg63eGN$Aqvq=4z3W_IR}J7T*nIyF$0kOo-QEA
zvWl2Ehqy&DE#R7*!O-SxU|^65Vlsl5hM5bvCueXmf!Ib6HZzEAoGIeL>Kq*6$Qi8+
z4H-}XfIRm9e?bPaP_U~{0Ykz9vB}7SAkP$V@h3#9qlo%=FG&#bWdV7PID;9HwYz#5
zV3;T3Ar6Wz4lK^(aQ1Tz7h?L);q2<=BgFK-fFZenF=dgP@Z=Q60)~_V#)JZf!~%xY
zMebY^CMPgXP3B@LU`QxPMz#{{Ib;E6UzY{KQ;|hn97B?qF5sIuIg#uC<W#Qz1&k?6
z3(yrTP(TSDP&5}LcYqw2$WWSCz?guh0F(qk3S7N>QW;893m6khlM5J<7THWqN-Ssw
zYfNHD21RQ!V?lDXA*QQQLeA4KxHJi*-*ReFDoDSpmk&%o7c&9PLB3(7Ntgle$l>fC
z9KwSo;4#w&iesF8T?#VM0;qtC30VZBBnw%<#W4iK1<_3&ETGg3&Xv$~Z(t7XN{R5q
z2ZuOvECHoq299`N#}GkoE)E6`1_sawhzMW2e{cvl$O8-+nOV_IF09T52G9;EBnQDv
zVnjBH5y>P*MzBfT@z9)Vz=&ijBiK|Akg3qVDXOVlOd`Ap2ZFk)a2GN$fz9QCo6E%{
z!Vh;Y7Zbu{XipW*WM&kTnUP$~%#3a_GqTCd8JSrk3eZpo6~Um4#Q^1l3K$SSx=9jL
zazer!G$7?{;0z7&=q5uqA6RYR;}_&_U|?tpm4no;(87>`fkB3Wfq@ZJ<b$+8!yQ!%
fXzVB`SP-E_7NSK!AO_TPHjNizXW?RHU|;|M9qnU1

literal 0
HcmV?d00001

diff --git a/tests/data/acpi/loongarch64/virt/FACP b/tests/data/acpi/loongarch64/virt/FACP
index e69de29bb2d1d6434b8b29ae775ad8c2e48c5391..04d8d4c26fa2be24af40cd7a72959ec6b12790e5 100644
GIT binary patch
literal 268
zcmZ>BbPnKQWME+Ra`Jcf2v%^42yj+VP*7lGU|;~TK{Nw30gC_w0|x_x90Q*K$XF*3
SL2t~#z#s#)ALJHUC>sDQ_Xhz0

literal 0
HcmV?d00001

diff --git a/tests/data/acpi/loongarch64/virt/MCFG b/tests/data/acpi/loongarch64/virt/MCFG
index e69de29bb2d1d6434b8b29ae775ad8c2e48c5391..5f93b05abe1669fe4239edbba8aaf4fe666f5b95 100644
GIT binary patch
literal 60
ucmeZuc5}C3U|?XJ<K*w`5v<@85#X$#prF9Wz`y`vgJ=c>P=GS)K{Nm*r3V23

literal 0
HcmV?d00001

diff --git a/tests/data/acpi/loongarch64/virt/PPTT b/tests/data/acpi/loongarch64/virt/PPTT
index e69de29bb2d1d6434b8b29ae775ad8c2e48c5391..7a1258ecf123555b24462c98ccbb76b4ac1d0c2b 100644
GIT binary patch
literal 76
zcmWFt2nq3FU|?Wc;pFe^5v<@85#X$#prF9Wz`y`vgJ=d31_m(AfCNMs7`PZ17*vpi
E0HXp20RR91

literal 0
HcmV?d00001

diff --git a/tests/data/acpi/loongarch64/virt/PPTT.topology b/tests/data/acpi/loongarch64/virt/PPTT.topology
new file mode 100644
index 0000000000000000000000000000000000000000..d91e55b2399d9949dbb8e4c8cf634af1a0e56df4
GIT binary patch
literal 176
zcmWFt2npH1z`($y@8s|75v<@85#X$#prF9Wz`y`vgJ=d31_m(AfCNM!Y!wIvAw?J%
k_!t-%EFe4xi6jO$14%Ek7)Wmk$Sn|^3?O@9V$4u60J3}u0RR91

literal 0
HcmV?d00001

diff --git a/tests/data/acpi/loongarch64/virt/SLIT.numamem b/tests/data/acpi/loongarch64/virt/SLIT.numamem
new file mode 100644
index 0000000000000000000000000000000000000000..67f00813af7b2356fe74eed943ab8dcf2291578b
GIT binary patch
literal 48
ucmWIc@eDCwU|?W;;pFe^5v<@85#X$#prF9Wz`y`vgJ>oO2;dSG<pKcYv<CqI

literal 0
HcmV?d00001

diff --git a/tests/data/acpi/loongarch64/virt/SPCR b/tests/data/acpi/loongarch64/virt/SPCR
index e69de29bb2d1d6434b8b29ae775ad8c2e48c5391..3cc9bbcfb8051e632592d9db0fe3dba0af53ed8d 100644
GIT binary patch
literal 80
zcmWFza1IJ!U|?W6=;ZJ05v<@85#X$#prF9Wz`y`vgJ=d2P+(wu!1zEO#AIM_Vqjok
SXJBMtVE+IA|9^-WgaiOV#ti`g

literal 0
HcmV?d00001

diff --git a/tests/data/acpi/loongarch64/virt/SRAT b/tests/data/acpi/loongarch64/virt/SRAT
index e69de29bb2d1d6434b8b29ae775ad8c2e48c5391..ff234ce45cbdd32f57fc0668aba135992e5ca887 100644
GIT binary patch
literal 104
zcmWFzatz5}U|?We=j89~5v<@85#X$#prF9Wz`y`vgJ=+DfB^vp24p^?2227@bHG^0
F>HuiR2LS*8

literal 0
HcmV?d00001

diff --git a/tests/data/acpi/loongarch64/virt/SRAT.memhp b/tests/data/acpi/loongarch64/virt/SRAT.memhp
new file mode 100644
index 0000000000000000000000000000000000000000..525321890138de509ceaf9723f0a4565048e823f
GIT binary patch
literal 144
zcmWFzatxWkz`(%h<>c?|5v<@85#X$#prF9Wz`y`vgJ=+DfB^vp24p^?2227@bHG?Q
Q)WPIoGy^kC0|NsC0BRNo0RR91

literal 0
HcmV?d00001

diff --git a/tests/data/acpi/loongarch64/virt/SRAT.numamem b/tests/data/acpi/loongarch64/virt/SRAT.numamem
new file mode 100644
index 0000000000000000000000000000000000000000..2972a9abdcface5b943078d61b4946da80176ea2
GIT binary patch
literal 144
zcmWFzatxWkz`(#5?&R<65v<@85#X$#prF9Wz`y`vgJ=+DfB^vp24p^?2227@v%pxW
N>fk(>Jd8#$4*+jN2LS*8

literal 0
HcmV?d00001

diff --git a/tests/data/acpi/loongarch64/virt/SRAT.topology b/tests/data/acpi/loongarch64/virt/SRAT.topology
new file mode 100644
index 0000000000000000000000000000000000000000..4a44831f475b5fda1db9bed12c2e63a79d6d6e71
GIT binary patch
literal 152
zcmWFzatxWlz`(%h>g4b25v<@85#X$#prF9Wz`y`vgJ=+DfB^vp1~fh+8lMS`&y37x
O)PNZTr#WCOWOV?bSqA|C

literal 0
HcmV?d00001


From 85240876b2f6f9edd72a6f324cac0ee9ee28ab0a Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Thu, 12 Jun 2025 17:03:21 +0800
Subject: [PATCH 2296/2760] tests/acpi: Remove stale allowed tables

Remove stale allowed tables for LoongArch virt machine.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Message-Id: <20250612090321.3416594-6-maobibo@loongson.cn>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 tests/qtest/bios-tables-test-allowed-diff.h | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/tests/qtest/bios-tables-test-allowed-diff.h b/tests/qtest/bios-tables-test-allowed-diff.h
index bad1380eec..dfb8523c8b 100644
--- a/tests/qtest/bios-tables-test-allowed-diff.h
+++ b/tests/qtest/bios-tables-test-allowed-diff.h
@@ -1,9 +1 @@
 /* List of comma-separated changed AML files to ignore */
-"tests/data/acpi/loongarch64/virt/APIC",
-"tests/data/acpi/loongarch64/virt/DSDT",
-"tests/data/acpi/loongarch64/virt/FACP",
-"tests/data/acpi/loongarch64/virt/MCFG",
-"tests/data/acpi/loongarch64/virt/PPTT",
-"tests/data/acpi/loongarch64/virt/SLIT",
-"tests/data/acpi/loongarch64/virt/SPCR",
-"tests/data/acpi/loongarch64/virt/SRAT",

From d7fb5693d9ffbeb9b49c981e1f9774392f1d41e5 Mon Sep 17 00:00:00 2001
From: Li Zhijian <lizhijian@fujitsu.com>
Date: Fri, 13 Jun 2025 16:51:10 +0800
Subject: [PATCH 2297/2760] hw/acpi: Fix GPtrArray memory leak in
 crs_range_merge
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This leak was detected by the valgrind.

The crs_range_merge() function unconditionally allocated a GPtrArray
'even when range->len was zero, causing an early return without freeing
the allocated array. This resulted in a memory leak when an empty range
was processed.

Instead of moving the allocation after the check (as previously attempted),
use g_autoptr for automatic cleanup. This ensures the array is freed even
on early returns, and also removes the need for the explicit free at the
end of the function.

Signed-off-by: Li Zhijian <lizhijian@fujitsu.com>
Message-Id: <20250613085110.111204-1-lizhijian@fujitsu.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Ani Sinha <anisinha@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/acpi/aml-build.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/hw/acpi/aml-build.c b/hw/acpi/aml-build.c
index f8f93a9f66..cb817a0f31 100644
--- a/hw/acpi/aml-build.c
+++ b/hw/acpi/aml-build.c
@@ -160,7 +160,7 @@ void crs_replace_with_free_ranges(GPtrArray *ranges,
  */
 static void crs_range_merge(GPtrArray *range)
 {
-    GPtrArray *tmp = g_ptr_array_new_with_free_func(crs_range_free);
+    g_autoptr(GPtrArray) tmp = g_ptr_array_new_with_free_func(crs_range_free);
     CrsRangeEntry *entry;
     uint64_t range_base, range_limit;
     int i;
@@ -191,7 +191,6 @@ static void crs_range_merge(GPtrArray *range)
         entry = g_ptr_array_index(tmp, i);
         crs_range_insert(range, entry->base, entry->limit);
     }
-    g_ptr_array_free(tmp, true);
 }
 
 static void

From 091c7d7924f33781c2fb8e7297dc54971e0c3785 Mon Sep 17 00:00:00 2001
From: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Date: Tue, 17 Jun 2025 15:04:20 +0000
Subject: [PATCH 2298/2760] amd_iommu: Fix Miscellaneous Information Register 0
 encoding

The definitions encoding the maximum Virtual, Physical, and Guest Virtual
Address sizes supported by the IOMMU are using incorrect offsets i.e. the
VASize and GVASize offsets are switched. The value in the GVAsize field is
also modified, since it was incorrectly encoded.

Cc: qemu-stable@nongnu.org
Fixes: d29a09ca6842 ("hw/i386: Introduce AMD IOMMU")
Co-developed-by: Ethan MILON <ethan.milon@eviden.com>
Signed-off-by: Ethan MILON <ethan.milon@eviden.com>
Signed-off-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Message-Id: <20250617150427.20585-2-alejandro.j.jimenez@oracle.com>
Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/amd_iommu.h | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/hw/i386/amd_iommu.h b/hw/i386/amd_iommu.h
index 5672bdef89..3b1d2e9da5 100644
--- a/hw/i386/amd_iommu.h
+++ b/hw/i386/amd_iommu.h
@@ -196,9 +196,9 @@
 #define AMDVI_PAGE_SHIFT_4K 12
 #define AMDVI_PAGE_MASK_4K  (~((1ULL << AMDVI_PAGE_SHIFT_4K) - 1))
 
-#define AMDVI_MAX_VA_ADDR          (48UL << 5)
-#define AMDVI_MAX_PH_ADDR          (40UL << 8)
-#define AMDVI_MAX_GVA_ADDR         (48UL << 15)
+#define AMDVI_MAX_GVA_ADDR      (2UL << 5)
+#define AMDVI_MAX_PH_ADDR       (40UL << 8)
+#define AMDVI_MAX_VA_ADDR       (48UL << 15)
 
 /* Completion Wait data size */
 #define AMDVI_COMPLETION_DATA_SIZE    8

From c63b8d1425ba8b3b08ee4f7346457fd8a7f12a24 Mon Sep 17 00:00:00 2001
From: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Date: Tue, 17 Jun 2025 15:04:21 +0000
Subject: [PATCH 2299/2760] amd_iommu: Fix Device ID decoding for
 INVALIDATE_IOTLB_PAGES command

The DeviceID bits are extracted using an incorrect offset in the call to
amdvi_iotlb_remove_page(). This field is read (correctly) earlier, so use
the value already retrieved for devid.

Cc: qemu-stable@nongnu.org
Fixes: d29a09ca6842 ("hw/i386: Introduce AMD IOMMU")
Signed-off-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
Message-Id: <20250617150427.20585-3-alejandro.j.jimenez@oracle.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/amd_iommu.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/i386/amd_iommu.c b/hw/i386/amd_iommu.c
index 963aa2450c..c27efa504d 100644
--- a/hw/i386/amd_iommu.c
+++ b/hw/i386/amd_iommu.c
@@ -508,7 +508,7 @@ static void amdvi_inval_inttable(AMDVIState *s, uint64_t *cmd)
 static void iommu_inval_iotlb(AMDVIState *s, uint64_t *cmd)
 {
 
-    uint16_t devid = extract64(cmd[0], 0, 16);
+    uint16_t devid = cpu_to_le16(extract64(cmd[0], 0, 16));
     if (extract64(cmd[1], 1, 1) || extract64(cmd[1], 3, 1) ||
         extract64(cmd[1], 6, 6)) {
         amdvi_log_illegalcom_error(s, extract64(cmd[0], 60, 4),
@@ -521,7 +521,7 @@ static void iommu_inval_iotlb(AMDVIState *s, uint64_t *cmd)
                                     &devid);
     } else {
         amdvi_iotlb_remove_page(s, cpu_to_le64(extract64(cmd[1], 12, 52)) << 12,
-                                cpu_to_le16(extract64(cmd[1], 0, 16)));
+                                devid);
     }
     trace_amdvi_iotlb_inval();
 }

From ff3dcb3bf652912466dcc1cd10d3267f185c212e Mon Sep 17 00:00:00 2001
From: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Date: Tue, 17 Jun 2025 15:04:22 +0000
Subject: [PATCH 2300/2760] amd_iommu: Update bitmasks representing DTE
 reserved fields

The DTE validation method verifies that all bits in reserved DTE fields are
unset. Update them according to the latest definition available in AMD I/O
Virtualization Technology (IOMMU) Specification - Section 2.2.2.1 Device
Table Entry Format. Remove the magic numbers and use a macro helper to
generate bitmasks covering the specified ranges for better legibility.

Note that some reserved fields specify that events are generated when they
contain non-zero bits, or checks are skipped under certain configurations.
This change only updates the reserved masks, checks for special conditions
are not yet implemented.

Cc: qemu-stable@nongnu.org
Signed-off-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
Message-Id: <20250617150427.20585-4-alejandro.j.jimenez@oracle.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/amd_iommu.c | 7 ++++---
 hw/i386/amd_iommu.h | 9 ++++++---
 2 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/hw/i386/amd_iommu.c b/hw/i386/amd_iommu.c
index c27efa504d..6e78047919 100644
--- a/hw/i386/amd_iommu.c
+++ b/hw/i386/amd_iommu.c
@@ -848,9 +848,10 @@ static inline uint64_t amdvi_get_perms(uint64_t entry)
 static bool amdvi_validate_dte(AMDVIState *s, uint16_t devid,
                                uint64_t *dte)
 {
-    if ((dte[0] & AMDVI_DTE_LOWER_QUAD_RESERVED)
-        || (dte[1] & AMDVI_DTE_MIDDLE_QUAD_RESERVED)
-        || (dte[2] & AMDVI_DTE_UPPER_QUAD_RESERVED) || dte[3]) {
+    if ((dte[0] & AMDVI_DTE_QUAD0_RESERVED) ||
+        (dte[1] & AMDVI_DTE_QUAD1_RESERVED) ||
+        (dte[2] & AMDVI_DTE_QUAD2_RESERVED) ||
+        (dte[3] & AMDVI_DTE_QUAD3_RESERVED)) {
         amdvi_log_illegaldevtab_error(s, devid,
                                       s->devtab +
                                       devid * AMDVI_DEVTAB_ENTRY_SIZE, 0);
diff --git a/hw/i386/amd_iommu.h b/hw/i386/amd_iommu.h
index 3b1d2e9da5..aacb29b617 100644
--- a/hw/i386/amd_iommu.h
+++ b/hw/i386/amd_iommu.h
@@ -25,6 +25,8 @@
 #include "hw/i386/x86-iommu.h"
 #include "qom/object.h"
 
+#define GENMASK64(h, l)  (((~0ULL) >> (63 - (h) + (l))) << (l))
+
 /* Capability registers */
 #define AMDVI_CAPAB_BAR_LOW           0x04
 #define AMDVI_CAPAB_BAR_HIGH          0x08
@@ -162,9 +164,10 @@
 #define AMDVI_FEATURE_PC                  (1ULL << 9) /* Perf counters       */
 
 /* reserved DTE bits */
-#define AMDVI_DTE_LOWER_QUAD_RESERVED  0x80300000000000fc
-#define AMDVI_DTE_MIDDLE_QUAD_RESERVED 0x0000000000000100
-#define AMDVI_DTE_UPPER_QUAD_RESERVED  0x08f0000000000000
+#define AMDVI_DTE_QUAD0_RESERVED        (GENMASK64(6, 2) | GENMASK64(63, 63))
+#define AMDVI_DTE_QUAD1_RESERVED        0
+#define AMDVI_DTE_QUAD2_RESERVED        GENMASK64(53, 52)
+#define AMDVI_DTE_QUAD3_RESERVED        (GENMASK64(14, 0) | GENMASK64(53, 48))
 
 /* AMDVI paging mode */
 #define AMDVI_GATS_MODE                 (2ULL <<  12)

From 108e10ff69099c3ebe147f505246be7c2ad2a499 Mon Sep 17 00:00:00 2001
From: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Date: Tue, 17 Jun 2025 15:04:23 +0000
Subject: [PATCH 2301/2760] amd_iommu: Fix masks for various IOMMU MMIO
 Registers

Address various issues with definitions of the MMIO registers e.g. for the
Device Table Address Register, the size mask currently encompasses reserved
bits [11:9], so change it to only extract the bits [8:0] encoding size.

Convert masks to use GENMASK64 for consistency, and make unrelated
definitions independent.

Cc: qemu-stable@nongnu.org
Fixes: d29a09ca6842 ("hw/i386: Introduce AMD IOMMU")
Signed-off-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
Message-Id: <20250617150427.20585-5-alejandro.j.jimenez@oracle.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/amd_iommu.h | 38 +++++++++++++++++++-------------------
 1 file changed, 19 insertions(+), 19 deletions(-)

diff --git a/hw/i386/amd_iommu.h b/hw/i386/amd_iommu.h
index aacb29b617..988a485f80 100644
--- a/hw/i386/amd_iommu.h
+++ b/hw/i386/amd_iommu.h
@@ -68,34 +68,34 @@
 
 #define AMDVI_MMIO_SIZE               0x4000
 
-#define AMDVI_MMIO_DEVTAB_SIZE_MASK   ((1ULL << 12) - 1)
-#define AMDVI_MMIO_DEVTAB_BASE_MASK   (((1ULL << 52) - 1) & ~ \
-                                       AMDVI_MMIO_DEVTAB_SIZE_MASK)
+#define AMDVI_MMIO_DEVTAB_SIZE_MASK     GENMASK64(8, 0)
+#define AMDVI_MMIO_DEVTAB_BASE_MASK     GENMASK64(51, 12)
+
 #define AMDVI_MMIO_DEVTAB_ENTRY_SIZE  32
 #define AMDVI_MMIO_DEVTAB_SIZE_UNIT   4096
 
 /* some of this are similar but just for readability */
 #define AMDVI_MMIO_CMDBUF_SIZE_BYTE       (AMDVI_MMIO_COMMAND_BASE + 7)
 #define AMDVI_MMIO_CMDBUF_SIZE_MASK       0x0f
-#define AMDVI_MMIO_CMDBUF_BASE_MASK       AMDVI_MMIO_DEVTAB_BASE_MASK
-#define AMDVI_MMIO_CMDBUF_HEAD_MASK       (((1ULL << 19) - 1) & ~0x0f)
-#define AMDVI_MMIO_CMDBUF_TAIL_MASK       AMDVI_MMIO_EVTLOG_HEAD_MASK
+#define AMDVI_MMIO_CMDBUF_BASE_MASK       GENMASK64(51, 12)
+#define AMDVI_MMIO_CMDBUF_HEAD_MASK       GENMASK64(18, 4)
+#define AMDVI_MMIO_CMDBUF_TAIL_MASK       GENMASK64(18, 4)
 
 #define AMDVI_MMIO_EVTLOG_SIZE_BYTE       (AMDVI_MMIO_EVENT_BASE + 7)
-#define AMDVI_MMIO_EVTLOG_SIZE_MASK       AMDVI_MMIO_CMDBUF_SIZE_MASK
-#define AMDVI_MMIO_EVTLOG_BASE_MASK       AMDVI_MMIO_CMDBUF_BASE_MASK
-#define AMDVI_MMIO_EVTLOG_HEAD_MASK       (((1ULL << 19) - 1) & ~0x0f)
-#define AMDVI_MMIO_EVTLOG_TAIL_MASK       AMDVI_MMIO_EVTLOG_HEAD_MASK
+#define AMDVI_MMIO_EVTLOG_SIZE_MASK       0x0f
+#define AMDVI_MMIO_EVTLOG_BASE_MASK       GENMASK64(51, 12)
+#define AMDVI_MMIO_EVTLOG_HEAD_MASK       GENMASK64(18, 4)
+#define AMDVI_MMIO_EVTLOG_TAIL_MASK       GENMASK64(18, 4)
 
-#define AMDVI_MMIO_PPRLOG_SIZE_BYTE       (AMDVI_MMIO_EVENT_BASE + 7)
-#define AMDVI_MMIO_PPRLOG_HEAD_MASK       AMDVI_MMIO_EVTLOG_HEAD_MASK
-#define AMDVI_MMIO_PPRLOG_TAIL_MASK       AMDVI_MMIO_EVTLOG_HEAD_MASK
-#define AMDVI_MMIO_PPRLOG_BASE_MASK       AMDVI_MMIO_EVTLOG_BASE_MASK
-#define AMDVI_MMIO_PPRLOG_SIZE_MASK       AMDVI_MMIO_EVTLOG_SIZE_MASK
+#define AMDVI_MMIO_PPRLOG_SIZE_BYTE       (AMDVI_MMIO_PPR_BASE + 7)
+#define AMDVI_MMIO_PPRLOG_SIZE_MASK       0x0f
+#define AMDVI_MMIO_PPRLOG_BASE_MASK       GENMASK64(51, 12)
+#define AMDVI_MMIO_PPRLOG_HEAD_MASK       GENMASK64(18, 4)
+#define AMDVI_MMIO_PPRLOG_TAIL_MASK       GENMASK64(18, 4)
 
 #define AMDVI_MMIO_EXCL_ENABLED_MASK      (1ULL << 0)
 #define AMDVI_MMIO_EXCL_ALLOW_MASK        (1ULL << 1)
-#define AMDVI_MMIO_EXCL_LIMIT_MASK        AMDVI_MMIO_DEVTAB_BASE_MASK
+#define AMDVI_MMIO_EXCL_LIMIT_MASK        GENMASK64(51, 12)
 #define AMDVI_MMIO_EXCL_LIMIT_LOW         0xfff
 
 /* mmio control register flags */
@@ -132,14 +132,14 @@
 #define AMDVI_DEV_TRANSLATION_VALID       (1ULL << 1)
 #define AMDVI_DEV_MODE_MASK               0x7
 #define AMDVI_DEV_MODE_RSHIFT             9
-#define AMDVI_DEV_PT_ROOT_MASK            0xffffffffff000
+#define AMDVI_DEV_PT_ROOT_MASK            GENMASK64(51, 12)
 #define AMDVI_DEV_PT_ROOT_RSHIFT          12
 #define AMDVI_DEV_PERM_SHIFT              61
 #define AMDVI_DEV_PERM_READ               (1ULL << 61)
 #define AMDVI_DEV_PERM_WRITE              (1ULL << 62)
 
 /* Device table entry bits 64:127 */
-#define AMDVI_DEV_DOMID_ID_MASK          ((1ULL << 16) - 1)
+#define AMDVI_DEV_DOMID_ID_MASK             GENMASK64(15, 0)
 
 /* Event codes and flags, as stored in the info field */
 #define AMDVI_EVENT_ILLEGAL_DEVTAB_ENTRY  (0x1U << 12)
@@ -197,7 +197,7 @@
 #define AMDVI_PAGE_SIZE  (1ULL << AMDVI_PAGE_SHIFT)
 
 #define AMDVI_PAGE_SHIFT_4K 12
-#define AMDVI_PAGE_MASK_4K  (~((1ULL << AMDVI_PAGE_SHIFT_4K) - 1))
+#define AMDVI_PAGE_MASK_4K      GENMASK64(63, 12)
 
 #define AMDVI_MAX_GVA_ADDR      (2UL << 5)
 #define AMDVI_MAX_PH_ADDR       (40UL << 8)

From 123cf4bdd378f746dfa2f5415ba084148dded3e3 Mon Sep 17 00:00:00 2001
From: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Date: Tue, 17 Jun 2025 15:04:24 +0000
Subject: [PATCH 2302/2760] amd_iommu: Fix mask to retrieve Interrupt Table
 Root Pointer from DTE

Fix an off-by-one error in the definition of AMDVI_IR_PHYS_ADDR_MASK. The
current definition masks off the most significant bit of the Interrupt Table
Root ptr i.e. it only generates a mask with bits [50:6] set. See the AMD I/O
Virtualization Technology (IOMMU) Specification for the Interrupt Table
Root Pointer[51:6] field in the Device Table Entry format.

Cc: qemu-stable@nongnu.org
Fixes: b44159fe0078 ("x86_iommu/amd: Add interrupt remap support when VAPIC is not enabled")
Signed-off-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
Message-Id: <20250617150427.20585-6-alejandro.j.jimenez@oracle.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/amd_iommu.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/i386/amd_iommu.h b/hw/i386/amd_iommu.h
index 988a485f80..96fc5b621e 100644
--- a/hw/i386/amd_iommu.h
+++ b/hw/i386/amd_iommu.h
@@ -231,7 +231,7 @@
 #define AMDVI_IR_INTCTL_PASS            1
 #define AMDVI_IR_INTCTL_REMAP           2
 
-#define AMDVI_IR_PHYS_ADDR_MASK         (((1ULL << 45) - 1) << 6)
+#define AMDVI_IR_PHYS_ADDR_MASK         GENMASK64(51, 6)
 
 /* MSI data 10:0 bits (section 2.2.5.1 Fig 14) */
 #define AMDVI_IRTE_OFFSET               0x7ff

From 67d3077ee403472d45794399e97c9f329242fce9 Mon Sep 17 00:00:00 2001
From: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Date: Tue, 17 Jun 2025 15:04:25 +0000
Subject: [PATCH 2303/2760] amd_iommu: Fix the calculation for Device Table
 size

Correctly calculate the Device Table size using the format encoded in the
Device Table Base Address Register (MMIO Offset 0000h).

Cc: qemu-stable@nongnu.org
Fixes: d29a09ca6842 ("hw/i386: Introduce AMD IOMMU")
Signed-off-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
Message-Id: <20250617150427.20585-7-alejandro.j.jimenez@oracle.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/amd_iommu.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/i386/amd_iommu.c b/hw/i386/amd_iommu.c
index 6e78047919..92f94dc788 100644
--- a/hw/i386/amd_iommu.c
+++ b/hw/i386/amd_iommu.c
@@ -665,8 +665,8 @@ static inline void amdvi_handle_devtab_write(AMDVIState *s)
     uint64_t val = amdvi_readq(s, AMDVI_MMIO_DEVICE_TABLE);
     s->devtab = (val & AMDVI_MMIO_DEVTAB_BASE_MASK);
 
-    /* set device table length */
-    s->devtab_len = ((val & AMDVI_MMIO_DEVTAB_SIZE_MASK) + 1 *
+    /* set device table length (i.e. number of entries table can hold) */
+    s->devtab_len = (((val & AMDVI_MMIO_DEVTAB_SIZE_MASK) + 1) *
                     (AMDVI_MMIO_DEVTAB_SIZE_UNIT /
                      AMDVI_MMIO_DEVTAB_ENTRY_SIZE));
 }

From 5959b641c98b5ae9677e2c1d89902dac31b344d9 Mon Sep 17 00:00:00 2001
From: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Date: Tue, 17 Jun 2025 15:04:26 +0000
Subject: [PATCH 2304/2760] amd_iommu: Remove duplicated definitions

No functional change.

Signed-off-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
Message-Id: <20250617150427.20585-8-alejandro.j.jimenez@oracle.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/amd_iommu.h | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/hw/i386/amd_iommu.h b/hw/i386/amd_iommu.h
index 96fc5b621e..8b42913ed8 100644
--- a/hw/i386/amd_iommu.h
+++ b/hw/i386/amd_iommu.h
@@ -206,10 +206,6 @@
 /* Completion Wait data size */
 #define AMDVI_COMPLETION_DATA_SIZE    8
 
-#define AMDVI_COMMAND_SIZE   16
-/* Completion Wait data size */
-#define AMDVI_COMPLETION_DATA_SIZE    8
-
 #define AMDVI_COMMAND_SIZE   16
 
 #define AMDVI_INT_ADDR_FIRST    0xfee00000

From 5788929e05e18ed5f76dc8ade4210f022c9ba5a1 Mon Sep 17 00:00:00 2001
From: Ethan Milon <ethan.milon@eviden.com>
Date: Tue, 17 Jun 2025 15:04:27 +0000
Subject: [PATCH 2305/2760] amd_iommu: Fix truncation of oldval in amdvi_writeq

The variable `oldval` was incorrectly declared as a 32-bit `uint32_t`.
This could lead to truncation and incorrect behavior where the upper
read-only 32 bits are significant.

Fix the type of `oldval` to match the return type of `ldq_le_p()`.

Cc: qemu-stable@nongnu.org
Fixes: d29a09ca6842 ("hw/i386: Introduce AMD IOMMU")
Signed-off-by: Ethan Milon <ethan.milon@eviden.com>
Message-Id: <20250617150427.20585-9-alejandro.j.jimenez@oracle.com>
Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/amd_iommu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/i386/amd_iommu.c b/hw/i386/amd_iommu.c
index 92f94dc788..5a24c17548 100644
--- a/hw/i386/amd_iommu.c
+++ b/hw/i386/amd_iommu.c
@@ -140,7 +140,7 @@ static void amdvi_writeq(AMDVIState *s, hwaddr addr, uint64_t val)
 {
     uint64_t romask = ldq_le_p(&s->romask[addr]);
     uint64_t w1cmask = ldq_le_p(&s->w1cmask[addr]);
-    uint32_t oldval = ldq_le_p(&s->mmior[addr]);
+    uint64_t oldval = ldq_le_p(&s->mmior[addr]);
     stq_le_p(&s->mmior[addr],
             ((oldval & romask) | (val & ~romask)) & ~(val & w1cmask));
 }

From 54401d5abd13c7f2ff5d1cb65e73a067743230e3 Mon Sep 17 00:00:00 2001
From: Li Chen <chenl311@chinatelecom.cn>
Date: Wed, 28 May 2025 18:53:35 +0800
Subject: [PATCH 2306/2760] acpi: Add machine option to disable SPCR table

The ACPI SPCR (Serial Port Console Redirection) table allows firmware
to specify a preferred serial console device to the operating system.
On ARM64 systems, Linux by default respects this table: even if the
kernel command line does not include a hardware serial console (e.g.,
"console=ttyAMA0"), the kernel still register the serial device
referenced by SPCR as a printk console.

While this behavior is standard-compliant, it can lead to situations
where guest console behavior is influenced by platform firmware rather
than user-specified configuration. To make guest console behavior more
predictable and under user control, this patch introduces a machine
option to explicitly disable SPCR table exposure:

    -machine spcr=off

By default, the option is enabled (spcr=on), preserving existing
behavior. When disabled, QEMU will omit the SPCR table from the guest's
ACPI namespace, ensuring that only consoles explicitly declared in the
kernel command line are registered.

Signed-off-by: Li Chen <chenl311@chinatelecom.cn>
Reviewed-by: Bibo Mao <maobibo@loongson.cn>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Gavin Shan <gshan@redhat.com>
Reviewed-by: Sunil V L <sunilvl@ventanamicro.com>
Message-Id: <20250528105404.457729-2-me@linux.beauty>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/arm/virt-acpi-build.c       |  5 ++++-
 hw/core/machine.c              | 22 ++++++++++++++++++++++
 hw/loongarch/virt-acpi-build.c |  4 +++-
 hw/riscv/virt-acpi-build.c     |  5 ++++-
 include/hw/boards.h            |  1 +
 qemu-options.hx                |  5 +++++
 6 files changed, 39 insertions(+), 3 deletions(-)

diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
index 0dfb8ec2c3..782b17b966 100644
--- a/hw/arm/virt-acpi-build.c
+++ b/hw/arm/virt-acpi-build.c
@@ -1023,7 +1023,10 @@ void virt_acpi_build(VirtMachineState *vms, AcpiBuildTables *tables)
     }
 
     acpi_add_table(table_offsets, tables_blob);
-    spcr_setup(tables_blob, tables->linker, vms);
+
+    if (ms->acpi_spcr_enabled) {
+        spcr_setup(tables_blob, tables->linker, vms);
+    }
 
     acpi_add_table(table_offsets, tables_blob);
     build_dbg2(tables_blob, tables->linker, vms);
diff --git a/hw/core/machine.c b/hw/core/machine.c
index e869821b22..ceee058cad 100644
--- a/hw/core/machine.c
+++ b/hw/core/machine.c
@@ -577,6 +577,20 @@ static void machine_set_nvdimm(Object *obj, bool value, Error **errp)
     ms->nvdimms_state->is_enabled = value;
 }
 
+static bool machine_get_spcr(Object *obj, Error **errp)
+{
+    MachineState *ms = MACHINE(obj);
+
+    return ms->acpi_spcr_enabled;
+}
+
+static void machine_set_spcr(Object *obj, bool value, Error **errp)
+{
+    MachineState *ms = MACHINE(obj);
+
+    ms->acpi_spcr_enabled = value;
+}
+
 static bool machine_get_hmat(Object *obj, Error **errp)
 {
     MachineState *ms = MACHINE(obj);
@@ -1281,6 +1295,14 @@ static void machine_initfn(Object *obj)
                                         "Table (HMAT)");
     }
 
+    /* SPCR */
+    ms->acpi_spcr_enabled = true;
+    object_property_add_bool(obj, "spcr", machine_get_spcr, machine_set_spcr);
+    object_property_set_description(obj, "spcr",
+                                   "Set on/off to enable/disable "
+                                   "ACPI Serial Port Console Redirection "
+                                   "Table (spcr)");
+
     /* default to mc->default_cpus */
     ms->smp.cpus = mc->default_cpus;
     ms->smp.max_cpus = mc->default_cpus;
diff --git a/hw/loongarch/virt-acpi-build.c b/hw/loongarch/virt-acpi-build.c
index 2cd2d9d842..8c2228a772 100644
--- a/hw/loongarch/virt-acpi-build.c
+++ b/hw/loongarch/virt-acpi-build.c
@@ -557,7 +557,9 @@ static void acpi_build(AcpiBuildTables *tables, MachineState *machine)
     acpi_add_table(table_offsets, tables_blob);
     build_srat(tables_blob, tables->linker, machine);
     acpi_add_table(table_offsets, tables_blob);
-    spcr_setup(tables_blob, tables->linker, machine);
+
+    if (machine->acpi_spcr_enabled)
+        spcr_setup(tables_blob, tables->linker, machine);
 
     if (machine->numa_state->num_nodes) {
         if (machine->numa_state->have_numa_distance) {
diff --git a/hw/riscv/virt-acpi-build.c b/hw/riscv/virt-acpi-build.c
index 8b5683dbde..ee1416d264 100644
--- a/hw/riscv/virt-acpi-build.c
+++ b/hw/riscv/virt-acpi-build.c
@@ -894,7 +894,10 @@ static void virt_acpi_build(RISCVVirtState *s, AcpiBuildTables *tables)
     }
 
     acpi_add_table(table_offsets, tables_blob);
-    spcr_setup(tables_blob, tables->linker, s);
+
+    if (ms->acpi_spcr_enabled) {
+        spcr_setup(tables_blob, tables->linker, s);
+    }
 
     acpi_add_table(table_offsets, tables_blob);
     {
diff --git a/include/hw/boards.h b/include/hw/boards.h
index f424b2b505..f94713e6e2 100644
--- a/include/hw/boards.h
+++ b/include/hw/boards.h
@@ -443,6 +443,7 @@ struct MachineState {
     SmpCache smp_cache;
     struct NVDIMMState *nvdimms_state;
     struct NumaState *numa_state;
+    bool acpi_spcr_enabled;
 };
 
 /*
diff --git a/qemu-options.hx b/qemu-options.hx
index 1f862b19a6..9b2d5f4b7a 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -38,6 +38,7 @@ DEF("machine", HAS_ARG, QEMU_OPTION_machine, \
     "                nvdimm=on|off controls NVDIMM support (default=off)\n"
     "                memory-encryption=@var{} memory encryption object to use (default=none)\n"
     "                hmat=on|off controls ACPI HMAT support (default=off)\n"
+    "                spcr=on|off controls ACPI SPCR support (default=on)\n"
 #ifdef CONFIG_POSIX
     "                aux-ram-share=on|off allocate auxiliary guest RAM as shared (default: off)\n"
 #endif
@@ -105,6 +106,10 @@ SRST
         Enables or disables ACPI Heterogeneous Memory Attribute Table
         (HMAT) support. The default is off.
 
+    ``spcr=on|off``
+        Enables or disables ACPI Serial Port Console Redirection Table
+        (SPCR) support. The default is on.
+
     ``aux-ram-share=on|off``
         Allocate auxiliary guest RAM as an anonymous file that is
         shareable with an external process.  This option applies to

From 9ce87106c7bcb1c2ada17e578db87f13ac29ae92 Mon Sep 17 00:00:00 2001
From: Li Chen <chenl311@chinatelecom.cn>
Date: Wed, 28 May 2025 18:53:36 +0800
Subject: [PATCH 2307/2760] tests/qtest/bios-tables-test: Add test for
 disabling SPCR on AArch64

Add ACPI SPCR table test case for ARM when SPCR was off.

Signed-off-by: Li Chen <chenl311@chinatelecom.cn>
Message-Id: <20250528105404.457729-3-me@linux.beauty>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 tests/qtest/bios-tables-test.c | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/tests/qtest/bios-tables-test.c b/tests/qtest/bios-tables-test.c
index f41e638014..c84cf1070d 100644
--- a/tests/qtest/bios-tables-test.c
+++ b/tests/qtest/bios-tables-test.c
@@ -1789,6 +1789,24 @@ static void test_acpi_aarch64_virt_tcg_pxb(void)
     free_test_data(&data);
 }
 
+static void test_acpi_aarch64_virt_tcg_acpi_spcr(void)
+{
+    test_data data = {
+        .machine = "virt",
+        .arch = "aarch64",
+        .tcg_only = true,
+        .uefi_fl1 = "pc-bios/edk2-aarch64-code.fd",
+        .uefi_fl2 = "pc-bios/edk2-arm-vars.fd",
+        .cd = "tests/data/uefi-boot-images/bios-tables-test.aarch64.iso.qcow2",
+        .ram_start = 0x40000000ULL,
+        .scan_len = 128ULL * 1024 * 1024,
+        .variant = ".acpispcr",
+    };
+
+    test_acpi_one("-cpu cortex-a57 "
+                  " -machine spcr=off", &data);
+    free_test_data(&data);
+}
 static void test_acpi_tcg_acpi_hmat(const char *machine, const char *arch)
 {
     test_data data = {};
@@ -2672,6 +2690,8 @@ int main(int argc, char *argv[])
             qtest_add_func("acpi/virt/pxb", test_acpi_aarch64_virt_tcg_pxb);
             qtest_add_func("acpi/virt/oem-fields",
                            test_acpi_aarch64_virt_oem_fields);
+            qtest_add_func("acpi/virt/acpispcr",
+                           test_acpi_aarch64_virt_tcg_acpi_spcr);
             if (qtest_has_device("virtio-iommu-pci")) {
                 qtest_add_func("acpi/virt/viot", test_acpi_aarch64_virt_viot);
             }

From da77fc6c2e28a17249a6f459213247720e22e170 Mon Sep 17 00:00:00 2001
From: Li Chen <chenl311@chinatelecom.cn>
Date: Wed, 28 May 2025 18:53:37 +0800
Subject: [PATCH 2308/2760] tests/qtest/bios-tables-test: Add test for
 disabling SPCR on RISC-V

Add ACPI SPCR table test case for RISC-V when SPCR was off.

Signed-off-by: Li Chen <chenl311@chinatelecom.cn>
Reviewed-by: Sunil V L <sunilvl@ventanamicro.com>
Message-Id: <20250528105404.457729-4-me@linux.beauty>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 tests/qtest/bios-tables-test.c | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/tests/qtest/bios-tables-test.c b/tests/qtest/bios-tables-test.c
index c84cf1070d..e988deac02 100644
--- a/tests/qtest/bios-tables-test.c
+++ b/tests/qtest/bios-tables-test.c
@@ -1807,6 +1807,26 @@ static void test_acpi_aarch64_virt_tcg_acpi_spcr(void)
                   " -machine spcr=off", &data);
     free_test_data(&data);
 }
+
+static void test_acpi_riscv64_virt_tcg_acpi_spcr(void)
+{
+    test_data data = {
+        .machine = "virt",
+        .arch = "riscv64",
+        .tcg_only = true,
+        .uefi_fl1 = "pc-bios/edk2-riscv-code.fd",
+        .uefi_fl2 = "pc-bios/edk2-riscv-vars.fd",
+        .cd = "tests/data/uefi-boot-images/bios-tables-test.riscv64.iso.qcow2",
+        .ram_start = 0x80000000ULL,
+        .scan_len = 128ULL * 1024 * 1024,
+        .variant = ".acpispcr",
+    };
+
+    test_acpi_one("-cpu rva22s64 "
+                  "-machine spcr=off", &data);
+    free_test_data(&data);
+}
+
 static void test_acpi_tcg_acpi_hmat(const char *machine, const char *arch)
 {
     test_data data = {};
@@ -2701,6 +2721,8 @@ int main(int argc, char *argv[])
             qtest_add_func("acpi/virt", test_acpi_riscv64_virt_tcg);
             qtest_add_func("acpi/virt/numamem",
                            test_acpi_riscv64_virt_tcg_numamem);
+            qtest_add_func("acpi/virt/acpispcr",
+                           test_acpi_riscv64_virt_tcg_acpi_spcr);
         }
     } else if (strcmp(arch, "loongarch64") == 0) {
         if (has_tcg) {

From 502f00c51ad9a133c728b52e96c7e8e0cffef191 Mon Sep 17 00:00:00 2001
From: Fiona Ebner <f.ebner@proxmox.com>
Date: Fri, 30 May 2025 17:11:00 +0200
Subject: [PATCH 2309/2760] block: never use atomics to access
 bs->quiesce_counter

All accesses of bs->quiesce_counter are in the main thread, either
after a GLOBAL_STATE_CODE() macro or in a function with GRAPH_WRLOCK
annotation.

This is essentially a revert of 414c2ec358 ("block: access
quiesce_counter with atomic ops"). At that time, neither the
GLOBAL_STATE_CODE() macro nor the GRAPH_WRLOCK annotation existed.
Even if the field was only accessed in the main thread back then (did
not check if that is actually the case), it wouldn't have been easy to
verify.

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Message-ID: <20250530151125.955508-24-f.ebner@proxmox.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/io.c                       | 7 ++-----
 include/block/block_int-common.h | 2 +-
 2 files changed, 3 insertions(+), 6 deletions(-)

diff --git a/block/io.c b/block/io.c
index ac5c7174f6..9bd8ba8431 100644
--- a/block/io.c
+++ b/block/io.c
@@ -361,7 +361,7 @@ static void bdrv_do_drained_begin(BlockDriverState *bs, BdrvChild *parent,
     GLOBAL_STATE_CODE();
 
     /* Stop things in parent-to-child order */
-    if (qatomic_fetch_inc(&bs->quiesce_counter) == 0) {
+    if (bs->quiesce_counter++ == 0) {
         GRAPH_RDLOCK_GUARD_MAINLOOP();
         bdrv_parent_drained_begin(bs, parent);
         if (bs->drv && bs->drv->bdrv_drain_begin) {
@@ -401,8 +401,6 @@ bdrv_drained_begin(BlockDriverState *bs)
  */
 static void bdrv_do_drained_end(BlockDriverState *bs, BdrvChild *parent)
 {
-    int old_quiesce_counter;
-
     IO_OR_GS_CODE();
 
     if (qemu_in_coroutine()) {
@@ -415,8 +413,7 @@ static void bdrv_do_drained_end(BlockDriverState *bs, BdrvChild *parent)
     assert(bs->quiesce_counter > 0);
 
     /* Re-enable things in child-to-parent order */
-    old_quiesce_counter = qatomic_fetch_dec(&bs->quiesce_counter);
-    if (old_quiesce_counter == 1) {
+    if (--bs->quiesce_counter == 0) {
         GRAPH_RDLOCK_GUARD_MAINLOOP();
         if (bs->drv && bs->drv->bdrv_drain_end) {
             bs->drv->bdrv_drain_end(bs);
diff --git a/include/block/block_int-common.h b/include/block/block_int-common.h
index 925a3e7353..e96c6a6a03 100644
--- a/include/block/block_int-common.h
+++ b/include/block/block_int-common.h
@@ -1253,7 +1253,7 @@ struct BlockDriverState {
     /* do we need to tell the quest if we have a volatile write cache? */
     int enable_write_cache;
 
-    /* Accessed with atomic ops.  */
+    /* Accessed only in the main thread. */
     int quiesce_counter;
 
     unsigned int write_gen;               /* Current data generation */

From 6b89e851fabf78d7fb090bcdc71789ea1ef55c9b Mon Sep 17 00:00:00 2001
From: Fiona Ebner <f.ebner@proxmox.com>
Date: Fri, 30 May 2025 17:11:01 +0200
Subject: [PATCH 2310/2760] block: add bdrv_graph_wrlock_drained() convenience
 wrapper

Many write-locked sections are also drained sections. A new
bdrv_graph_wrunlock_drained() wrapper around bdrv_graph_wrunlock() is
introduced, which will begin a drained section first. A global
variable is used so bdrv_graph_wrunlock() knows if it also needs
to end such a drained section. Both the aio_poll call in
bdrv_graph_wrlock() and the aio_bh_poll() in bdrv_graph_wrunlock()
can re-enter a write-locked section. While for the latter, ending the
drain could be moved to before the call, the former requires that the
variable is a counter and not just a boolean.

Since the wrapper calls bdrv_drain_all_begin(), which must be called
with the graph unlocked, mark the wrapper as GRAPH_UNLOCKED too.

The switch to the new helpers was generated with the following
commands and then manually checked:
find . -name '*.c' -exec sed -i -z 's/bdrv_drain_all_begin();\n\s*bdrv_graph_wrlock();/bdrv_graph_wrlock_drained();/g' {} ';'
find . -name '*.c' -exec sed -i -z 's/bdrv_graph_wrunlock();\n\s*bdrv_drain_all_end();/bdrv_graph_wrunlock();/g' {} ';'

Suggested-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Message-ID: <20250530151125.955508-25-f.ebner@proxmox.com>
[kwolf: Removed redundant GRAPH_UNLOCKED]
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block.c                          | 20 ++++------------
 block/backup.c                   |  4 +---
 block/blklogwrites.c             |  8 ++-----
 block/blkverify.c                |  4 +---
 block/block-backend.c            |  8 ++-----
 block/commit.c                   |  6 +----
 block/graph-lock.c               | 40 +++++++++++++++++++++++++++++---
 block/mirror.c                   |  7 +-----
 block/qcow2.c                    |  4 +---
 block/quorum.c                   |  8 ++-----
 block/replication.c              | 11 ++-------
 block/snapshot.c                 |  4 +---
 block/stream.c                   |  6 +----
 block/vmdk.c                     | 20 ++++------------
 blockdev.c                       |  4 +---
 blockjob.c                       | 10 ++------
 include/block/graph-lock.h       | 11 +++++++++
 tests/unit/test-bdrv-drain.c     | 36 +++++++---------------------
 tests/unit/test-bdrv-graph-mod.c | 20 ++++------------
 19 files changed, 90 insertions(+), 141 deletions(-)

diff --git a/block.c b/block.c
index bfd4340b24..1da10d55f0 100644
--- a/block.c
+++ b/block.c
@@ -1721,14 +1721,12 @@ bdrv_open_driver(BlockDriverState *bs, BlockDriver *drv, const char *node_name,
 open_failed:
     bs->drv = NULL;
 
-    bdrv_drain_all_begin();
-    bdrv_graph_wrlock();
+    bdrv_graph_wrlock_drained();
     if (bs->file != NULL) {
         bdrv_unref_child(bs, bs->file);
         assert(!bs->file);
     }
     bdrv_graph_wrunlock();
-    bdrv_drain_all_end();
 
     g_free(bs->opaque);
     bs->opaque = NULL;
@@ -3602,11 +3600,9 @@ int bdrv_set_backing_hd(BlockDriverState *bs, BlockDriverState *backing_hd,
     int ret;
     GLOBAL_STATE_CODE();
 
-    bdrv_drain_all_begin();
-    bdrv_graph_wrlock();
+    bdrv_graph_wrlock_drained();
     ret = bdrv_set_backing_hd_drained(bs, backing_hd, errp);
     bdrv_graph_wrunlock();
-    bdrv_drain_all_end();
 
     return ret;
 }
@@ -3797,12 +3793,10 @@ static BdrvChild *bdrv_open_child_common(const char *filename,
         return NULL;
     }
 
-    bdrv_drain_all_begin();
-    bdrv_graph_wrlock();
+    bdrv_graph_wrlock_drained();
     child = bdrv_attach_child(parent, bs, bdref_key, child_class, child_role,
                               errp);
     bdrv_graph_wrunlock();
-    bdrv_drain_all_end();
 
     return child;
 }
@@ -5180,8 +5174,7 @@ static void bdrv_close(BlockDriverState *bs)
         bs->drv = NULL;
     }
 
-    bdrv_drain_all_begin();
-    bdrv_graph_wrlock();
+    bdrv_graph_wrlock_drained();
     QLIST_FOREACH_SAFE(child, &bs->children, next, next) {
         bdrv_unref_child(bs, child);
     }
@@ -5189,7 +5182,6 @@ static void bdrv_close(BlockDriverState *bs)
     assert(!bs->backing);
     assert(!bs->file);
     bdrv_graph_wrunlock();
-    bdrv_drain_all_end();
 
     g_free(bs->opaque);
     bs->opaque = NULL;
@@ -5515,8 +5507,7 @@ int bdrv_append(BlockDriverState *bs_new, BlockDriverState *bs_top,
     assert(!bs_new->backing);
     bdrv_graph_rdunlock_main_loop();
 
-    bdrv_drain_all_begin();
-    bdrv_graph_wrlock();
+    bdrv_graph_wrlock_drained();
 
     child = bdrv_attach_child_noperm(bs_new, bs_top, "backing",
                                      &child_of_bds, bdrv_backing_role(bs_new),
@@ -5537,7 +5528,6 @@ out:
 
     bdrv_refresh_limits(bs_top, NULL, NULL);
     bdrv_graph_wrunlock();
-    bdrv_drain_all_end();
 
     return ret;
 }
diff --git a/block/backup.c b/block/backup.c
index 909027c17a..d4713fa1cd 100644
--- a/block/backup.c
+++ b/block/backup.c
@@ -498,12 +498,10 @@ BlockJob *backup_job_create(const char *job_id, BlockDriverState *bs,
     block_copy_set_speed(bcs, speed);
 
     /* Required permissions are taken by copy-before-write filter target */
-    bdrv_drain_all_begin();
-    bdrv_graph_wrlock();
+    bdrv_graph_wrlock_drained();
     block_job_add_bdrv(&job->common, "target", target, 0, BLK_PERM_ALL,
                        &error_abort);
     bdrv_graph_wrunlock();
-    bdrv_drain_all_end();
 
     return &job->common;
 
diff --git a/block/blklogwrites.c b/block/blklogwrites.c
index 70ac76f401..aa1f888869 100644
--- a/block/blklogwrites.c
+++ b/block/blklogwrites.c
@@ -281,11 +281,9 @@ static int blk_log_writes_open(BlockDriverState *bs, QDict *options, int flags,
     ret = 0;
 fail_log:
     if (ret < 0) {
-        bdrv_drain_all_begin();
-        bdrv_graph_wrlock();
+        bdrv_graph_wrlock_drained();
         bdrv_unref_child(bs, s->log_file);
         bdrv_graph_wrunlock();
-        bdrv_drain_all_end();
         s->log_file = NULL;
         qemu_mutex_destroy(&s->mutex);
     }
@@ -298,12 +296,10 @@ static void blk_log_writes_close(BlockDriverState *bs)
 {
     BDRVBlkLogWritesState *s = bs->opaque;
 
-    bdrv_drain_all_begin();
-    bdrv_graph_wrlock();
+    bdrv_graph_wrlock_drained();
     bdrv_unref_child(bs, s->log_file);
     s->log_file = NULL;
     bdrv_graph_wrunlock();
-    bdrv_drain_all_end();
     qemu_mutex_destroy(&s->mutex);
 }
 
diff --git a/block/blkverify.c b/block/blkverify.c
index 3a71f7498c..72efcbe7ef 100644
--- a/block/blkverify.c
+++ b/block/blkverify.c
@@ -151,12 +151,10 @@ static void blkverify_close(BlockDriverState *bs)
 {
     BDRVBlkverifyState *s = bs->opaque;
 
-    bdrv_drain_all_begin();
-    bdrv_graph_wrlock();
+    bdrv_graph_wrlock_drained();
     bdrv_unref_child(bs, s->test_file);
     s->test_file = NULL;
     bdrv_graph_wrunlock();
-    bdrv_drain_all_end();
 }
 
 static int64_t coroutine_fn GRAPH_RDLOCK
diff --git a/block/block-backend.c b/block/block-backend.c
index 68209bb2f7..f8d6ba65c1 100644
--- a/block/block-backend.c
+++ b/block/block-backend.c
@@ -889,11 +889,9 @@ void blk_remove_bs(BlockBackend *blk)
     root = blk->root;
     blk->root = NULL;
 
-    bdrv_drain_all_begin();
-    bdrv_graph_wrlock();
+    bdrv_graph_wrlock_drained();
     bdrv_root_unref_child(root);
     bdrv_graph_wrunlock();
-    bdrv_drain_all_end();
 }
 
 /*
@@ -906,8 +904,7 @@ int blk_insert_bs(BlockBackend *blk, BlockDriverState *bs, Error **errp)
 
     GLOBAL_STATE_CODE();
     bdrv_ref(bs);
-    bdrv_drain_all_begin();
-    bdrv_graph_wrlock();
+    bdrv_graph_wrlock_drained();
 
     if ((bs->open_flags & BDRV_O_INACTIVE) && blk_can_inactivate(blk)) {
         blk->disable_perm = true;
@@ -922,7 +919,6 @@ int blk_insert_bs(BlockBackend *blk, BlockDriverState *bs, Error **errp)
                                        BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY,
                                        perm, shared_perm, blk, errp);
     bdrv_graph_wrunlock();
-    bdrv_drain_all_end();
     if (blk->root == NULL) {
         return -EPERM;
     }
diff --git a/block/commit.c b/block/commit.c
index 6c4b736ff8..dc1942483b 100644
--- a/block/commit.c
+++ b/block/commit.c
@@ -392,8 +392,7 @@ void commit_start(const char *job_id, BlockDriverState *bs,
      * this is the responsibility of the interface (i.e. whoever calls
      * commit_start()).
      */
-    bdrv_drain_all_begin();
-    bdrv_graph_wrlock();
+    bdrv_graph_wrlock_drained();
     s->base_overlay = bdrv_find_overlay(top, base);
     assert(s->base_overlay);
 
@@ -425,21 +424,18 @@ void commit_start(const char *job_id, BlockDriverState *bs,
                                  iter_shared_perms, errp);
         if (ret < 0) {
             bdrv_graph_wrunlock();
-            bdrv_drain_all_end();
             goto fail;
         }
     }
 
     if (bdrv_freeze_backing_chain(commit_top_bs, base, errp) < 0) {
         bdrv_graph_wrunlock();
-        bdrv_drain_all_end();
         goto fail;
     }
     s->chain_frozen = true;
 
     ret = block_job_add_bdrv(&s->common, "base", base, 0, BLK_PERM_ALL, errp);
     bdrv_graph_wrunlock();
-    bdrv_drain_all_end();
 
     if (ret < 0) {
         goto fail;
diff --git a/block/graph-lock.c b/block/graph-lock.c
index c81162b147..b7319473a1 100644
--- a/block/graph-lock.c
+++ b/block/graph-lock.c
@@ -33,6 +33,17 @@ static QemuMutex aio_context_list_lock;
 /* Written and read with atomic operations. */
 static int has_writer;
 
+/*
+ * Many write-locked sections are also drained sections. There is a convenience
+ * wrapper bdrv_graph_wrlock_drained() which begins a drained section before
+ * acquiring the lock. This variable here is used so bdrv_graph_wrunlock() knows
+ * if it also needs to end such a drained section. It needs to be a counter,
+ * because the aio_poll() call in bdrv_graph_wrlock() might re-enter
+ * bdrv_graph_wrlock_drained(). And note that aio_bh_poll() in
+ * bdrv_graph_wrunlock() might also re-enter a write-locked section.
+ */
+static int wrlock_quiesced_counter;
+
 /*
  * A reader coroutine could move from an AioContext to another.
  * If this happens, there is no problem from the point of view of
@@ -112,8 +123,14 @@ void no_coroutine_fn bdrv_graph_wrlock(void)
     assert(!qatomic_read(&has_writer));
     assert(!qemu_in_coroutine());
 
-    /* Make sure that constantly arriving new I/O doesn't cause starvation */
-    bdrv_drain_all_begin_nopoll();
+    bool need_drain = wrlock_quiesced_counter == 0;
+
+    if (need_drain) {
+        /*
+         * Make sure that constantly arriving new I/O doesn't cause starvation
+         */
+        bdrv_drain_all_begin_nopoll();
+    }
 
     /*
      * reader_count == 0: this means writer will read has_reader as 1
@@ -139,7 +156,18 @@ void no_coroutine_fn bdrv_graph_wrlock(void)
         smp_mb();
     } while (reader_count() >= 1);
 
-    bdrv_drain_all_end();
+    if (need_drain) {
+        bdrv_drain_all_end();
+    }
+}
+
+void no_coroutine_fn bdrv_graph_wrlock_drained(void)
+{
+    GLOBAL_STATE_CODE();
+
+    bdrv_drain_all_begin();
+    wrlock_quiesced_counter++;
+    bdrv_graph_wrlock();
 }
 
 void no_coroutine_fn bdrv_graph_wrunlock(void)
@@ -168,6 +196,12 @@ void no_coroutine_fn bdrv_graph_wrunlock(void)
      * progress.
      */
     aio_bh_poll(qemu_get_aio_context());
+
+    if (wrlock_quiesced_counter > 0) {
+        bdrv_drain_all_end();
+        wrlock_quiesced_counter--;
+    }
+
 }
 
 void coroutine_fn bdrv_graph_co_rdlock(void)
diff --git a/block/mirror.c b/block/mirror.c
index 6e8caf4b49..82a6e50cf8 100644
--- a/block/mirror.c
+++ b/block/mirror.c
@@ -2014,15 +2014,13 @@ static BlockJob *mirror_start_job(
      */
     bdrv_disable_dirty_bitmap(s->dirty_bitmap);
 
-    bdrv_drain_all_begin();
-    bdrv_graph_wrlock();
+    bdrv_graph_wrlock_drained();
     ret = block_job_add_bdrv(&s->common, "source", bs, 0,
                              BLK_PERM_WRITE_UNCHANGED | BLK_PERM_WRITE |
                              BLK_PERM_CONSISTENT_READ,
                              errp);
     if (ret < 0) {
         bdrv_graph_wrunlock();
-        bdrv_drain_all_end();
         goto fail;
     }
 
@@ -2068,19 +2066,16 @@ static BlockJob *mirror_start_job(
                                      iter_shared_perms, errp);
             if (ret < 0) {
                 bdrv_graph_wrunlock();
-                bdrv_drain_all_end();
                 goto fail;
             }
         }
 
         if (bdrv_freeze_backing_chain(mirror_top_bs, target, errp) < 0) {
             bdrv_graph_wrunlock();
-            bdrv_drain_all_end();
             goto fail;
         }
     }
     bdrv_graph_wrunlock();
-    bdrv_drain_all_end();
 
     QTAILQ_INIT(&s->ops_in_flight);
 
diff --git a/block/qcow2.c b/block/qcow2.c
index 45451a7ee8..4aa9f9e068 100644
--- a/block/qcow2.c
+++ b/block/qcow2.c
@@ -2823,11 +2823,9 @@ qcow2_do_close(BlockDriverState *bs, bool close_data_file)
     if (close_data_file && has_data_file(bs)) {
         GLOBAL_STATE_CODE();
         bdrv_graph_rdunlock_main_loop();
-        bdrv_drain_all_begin();
-        bdrv_graph_wrlock();
+        bdrv_graph_wrlock_drained();
         bdrv_unref_child(bs, s->data_file);
         bdrv_graph_wrunlock();
-        bdrv_drain_all_end();
         s->data_file = NULL;
         bdrv_graph_rdlock_main_loop();
     }
diff --git a/block/quorum.c b/block/quorum.c
index cc3bc5f4e7..76a4feb2d9 100644
--- a/block/quorum.c
+++ b/block/quorum.c
@@ -1037,8 +1037,7 @@ static int quorum_open(BlockDriverState *bs, QDict *options, int flags,
 
 close_exit:
     /* cleanup on error */
-    bdrv_drain_all_begin();
-    bdrv_graph_wrlock();
+    bdrv_graph_wrlock_drained();
     for (i = 0; i < s->num_children; i++) {
         if (!opened[i]) {
             continue;
@@ -1046,7 +1045,6 @@ close_exit:
         bdrv_unref_child(bs, s->children[i]);
     }
     bdrv_graph_wrunlock();
-    bdrv_drain_all_end();
     g_free(s->children);
     g_free(opened);
 exit:
@@ -1059,13 +1057,11 @@ static void quorum_close(BlockDriverState *bs)
     BDRVQuorumState *s = bs->opaque;
     int i;
 
-    bdrv_drain_all_begin();
-    bdrv_graph_wrlock();
+    bdrv_graph_wrlock_drained();
     for (i = 0; i < s->num_children; i++) {
         bdrv_unref_child(bs, s->children[i]);
     }
     bdrv_graph_wrunlock();
-    bdrv_drain_all_end();
 
     g_free(s->children);
 }
diff --git a/block/replication.c b/block/replication.c
index 0879718854..83978b61f5 100644
--- a/block/replication.c
+++ b/block/replication.c
@@ -540,8 +540,7 @@ static void replication_start(ReplicationState *rs, ReplicationMode mode,
             return;
         }
 
-        bdrv_drain_all_begin();
-        bdrv_graph_wrlock();
+        bdrv_graph_wrlock_drained();
 
         bdrv_ref(hidden_disk->bs);
         s->hidden_disk = bdrv_attach_child(bs, hidden_disk->bs, "hidden disk",
@@ -550,7 +549,6 @@ static void replication_start(ReplicationState *rs, ReplicationMode mode,
         if (local_err) {
             error_propagate(errp, local_err);
             bdrv_graph_wrunlock();
-            bdrv_drain_all_end();
             return;
         }
 
@@ -561,7 +559,6 @@ static void replication_start(ReplicationState *rs, ReplicationMode mode,
         if (local_err) {
             error_propagate(errp, local_err);
             bdrv_graph_wrunlock();
-            bdrv_drain_all_end();
             return;
         }
 
@@ -574,14 +571,12 @@ static void replication_start(ReplicationState *rs, ReplicationMode mode,
             !check_top_bs(top_bs, bs)) {
             error_setg(errp, "No top_bs or it is invalid");
             bdrv_graph_wrunlock();
-            bdrv_drain_all_end();
             reopen_backing_file(bs, false, NULL);
             return;
         }
         bdrv_op_block_all(top_bs, s->blocker);
 
         bdrv_graph_wrunlock();
-        bdrv_drain_all_end();
 
         s->backup_job = backup_job_create(
                                 NULL, s->secondary_disk->bs, s->hidden_disk->bs,
@@ -656,14 +651,12 @@ static void replication_done(void *opaque, int ret)
     if (ret == 0) {
         s->stage = BLOCK_REPLICATION_DONE;
 
-        bdrv_drain_all_begin();
-        bdrv_graph_wrlock();
+        bdrv_graph_wrlock_drained();
         bdrv_unref_child(bs, s->secondary_disk);
         s->secondary_disk = NULL;
         bdrv_unref_child(bs, s->hidden_disk);
         s->hidden_disk = NULL;
         bdrv_graph_wrunlock();
-        bdrv_drain_all_end();
 
         s->error = 0;
     } else {
diff --git a/block/snapshot.c b/block/snapshot.c
index 28c9c43621..bd9d759b32 100644
--- a/block/snapshot.c
+++ b/block/snapshot.c
@@ -291,11 +291,9 @@ int bdrv_snapshot_goto(BlockDriverState *bs,
         }
 
         /* .bdrv_open() will re-attach it */
-        bdrv_drain_all_begin();
-        bdrv_graph_wrlock();
+        bdrv_graph_wrlock_drained();
         bdrv_unref_child(bs, fallback);
         bdrv_graph_wrunlock();
-        bdrv_drain_all_end();
 
         ret = bdrv_snapshot_goto(fallback_bs, snapshot_id, errp);
         memset(bs->opaque, 0, drv->instance_size);
diff --git a/block/stream.c b/block/stream.c
index f5441f27f4..a6ef840e29 100644
--- a/block/stream.c
+++ b/block/stream.c
@@ -371,12 +371,10 @@ void stream_start(const char *job_id, BlockDriverState *bs,
      * already have our own plans. Also don't allow resize as the image size is
      * queried only at the job start and then cached.
      */
-    bdrv_drain_all_begin();
-    bdrv_graph_wrlock();
+    bdrv_graph_wrlock_drained();
     if (block_job_add_bdrv(&s->common, "active node", bs, 0,
                            basic_flags | BLK_PERM_WRITE, errp)) {
         bdrv_graph_wrunlock();
-        bdrv_drain_all_end();
         goto fail;
     }
 
@@ -397,12 +395,10 @@ void stream_start(const char *job_id, BlockDriverState *bs,
                                  basic_flags, errp);
         if (ret < 0) {
             bdrv_graph_wrunlock();
-            bdrv_drain_all_end();
             goto fail;
         }
     }
     bdrv_graph_wrunlock();
-    bdrv_drain_all_end();
 
     s->base_overlay = base_overlay;
     s->above_base = above_base;
diff --git a/block/vmdk.c b/block/vmdk.c
index 89a7250120..04986c8d55 100644
--- a/block/vmdk.c
+++ b/block/vmdk.c
@@ -271,8 +271,7 @@ static void vmdk_free_extents(BlockDriverState *bs)
     BDRVVmdkState *s = bs->opaque;
     VmdkExtent *e;
 
-    bdrv_drain_all_begin();
-    bdrv_graph_wrlock();
+    bdrv_graph_wrlock_drained();
     for (i = 0; i < s->num_extents; i++) {
         e = &s->extents[i];
         g_free(e->l1_table);
@@ -284,7 +283,6 @@ static void vmdk_free_extents(BlockDriverState *bs)
         }
     }
     bdrv_graph_wrunlock();
-    bdrv_drain_all_end();
 
     g_free(s->extents);
 }
@@ -1249,11 +1247,9 @@ vmdk_parse_extents(const char *desc, BlockDriverState *bs, QDict *options,
                             0, 0, 0, 0, 0, &extent, errp);
             if (ret < 0) {
                 bdrv_graph_rdunlock_main_loop();
-                bdrv_drain_all_begin();
-                bdrv_graph_wrlock();
+                bdrv_graph_wrlock_drained();
                 bdrv_unref_child(bs, extent_file);
                 bdrv_graph_wrunlock();
-                bdrv_drain_all_end();
                 bdrv_graph_rdlock_main_loop();
                 goto out;
             }
@@ -1270,11 +1266,9 @@ vmdk_parse_extents(const char *desc, BlockDriverState *bs, QDict *options,
             g_free(buf);
             if (ret) {
                 bdrv_graph_rdunlock_main_loop();
-                bdrv_drain_all_begin();
-                bdrv_graph_wrlock();
+                bdrv_graph_wrlock_drained();
                 bdrv_unref_child(bs, extent_file);
                 bdrv_graph_wrunlock();
-                bdrv_drain_all_end();
                 bdrv_graph_rdlock_main_loop();
                 goto out;
             }
@@ -1283,11 +1277,9 @@ vmdk_parse_extents(const char *desc, BlockDriverState *bs, QDict *options,
             ret = vmdk_open_se_sparse(bs, extent_file, bs->open_flags, errp);
             if (ret) {
                 bdrv_graph_rdunlock_main_loop();
-                bdrv_drain_all_begin();
-                bdrv_graph_wrlock();
+                bdrv_graph_wrlock_drained();
                 bdrv_unref_child(bs, extent_file);
                 bdrv_graph_wrunlock();
-                bdrv_drain_all_end();
                 bdrv_graph_rdlock_main_loop();
                 goto out;
             }
@@ -1295,11 +1287,9 @@ vmdk_parse_extents(const char *desc, BlockDriverState *bs, QDict *options,
         } else {
             error_setg(errp, "Unsupported extent type '%s'", type);
             bdrv_graph_rdunlock_main_loop();
-            bdrv_drain_all_begin();
-            bdrv_graph_wrlock();
+            bdrv_graph_wrlock_drained();
             bdrv_unref_child(bs, extent_file);
             bdrv_graph_wrunlock();
-            bdrv_drain_all_end();
             bdrv_graph_rdlock_main_loop();
             ret = -ENOTSUP;
             goto out;
diff --git a/blockdev.c b/blockdev.c
index 2e7fda6780..e625534925 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -3561,8 +3561,7 @@ void qmp_x_blockdev_change(const char *parent, const char *child,
     BlockDriverState *parent_bs, *new_bs = NULL;
     BdrvChild *p_child;
 
-    bdrv_drain_all_begin();
-    bdrv_graph_wrlock();
+    bdrv_graph_wrlock_drained();
 
     parent_bs = bdrv_lookup_bs(parent, parent, errp);
     if (!parent_bs) {
@@ -3599,7 +3598,6 @@ void qmp_x_blockdev_change(const char *parent, const char *child,
 
 out:
     bdrv_graph_wrunlock();
-    bdrv_drain_all_end();
 }
 
 BlockJobInfoList *qmp_query_block_jobs(Error **errp)
diff --git a/blockjob.c b/blockjob.c
index e68181a35b..db7c3a69a0 100644
--- a/blockjob.c
+++ b/blockjob.c
@@ -198,8 +198,7 @@ void block_job_remove_all_bdrv(BlockJob *job)
      * one to make sure that such a concurrent access does not attempt
      * to process an already freed BdrvChild.
      */
-    bdrv_drain_all_begin();
-    bdrv_graph_wrlock();
+    bdrv_graph_wrlock_drained();
     while (job->nodes) {
         GSList *l = job->nodes;
         BdrvChild *c = l->data;
@@ -212,7 +211,6 @@ void block_job_remove_all_bdrv(BlockJob *job)
         g_slist_free_1(l);
     }
     bdrv_graph_wrunlock();
-    bdrv_drain_all_end();
 }
 
 bool block_job_has_bdrv(BlockJob *job, BlockDriverState *bs)
@@ -498,8 +496,7 @@ void *block_job_create(const char *job_id, const BlockJobDriver *driver,
     int ret;
     GLOBAL_STATE_CODE();
 
-    bdrv_drain_all_begin();
-    bdrv_graph_wrlock();
+    bdrv_graph_wrlock_drained();
 
     if (job_id == NULL && !(flags & JOB_INTERNAL)) {
         job_id = bdrv_get_device_name(bs);
@@ -509,7 +506,6 @@ void *block_job_create(const char *job_id, const BlockJobDriver *driver,
                      flags, cb, opaque, errp);
     if (job == NULL) {
         bdrv_graph_wrunlock();
-        bdrv_drain_all_end();
         return NULL;
     }
 
@@ -548,12 +544,10 @@ void *block_job_create(const char *job_id, const BlockJobDriver *driver,
     }
 
     bdrv_graph_wrunlock();
-    bdrv_drain_all_end();
     return job;
 
 fail:
     bdrv_graph_wrunlock();
-    bdrv_drain_all_end();
     job_early_fail(&job->job);
     return NULL;
 }
diff --git a/include/block/graph-lock.h b/include/block/graph-lock.h
index 2c26c72108..95bf5ede40 100644
--- a/include/block/graph-lock.h
+++ b/include/block/graph-lock.h
@@ -112,10 +112,21 @@ void unregister_aiocontext(AioContext *ctx);
 void no_coroutine_fn TSA_ACQUIRE(graph_lock) TSA_NO_TSA
 bdrv_graph_wrlock(void);
 
+/*
+ * bdrv_graph_wrlock_drained:
+ * Similar to bdrv_graph_wrlock, but will begin a drained section before
+ * locking.
+ */
+void no_coroutine_fn TSA_ACQUIRE(graph_lock) TSA_NO_TSA
+bdrv_graph_wrlock_drained(void);
+
 /*
  * bdrv_graph_wrunlock:
  * Write finished, reset global has_writer to 0 and restart
  * all readers that are waiting.
+ *
+ * Also ends the drained section if bdrv_graph_wrlock_drained() was used to lock
+ * the graph.
  */
 void no_coroutine_fn TSA_RELEASE(graph_lock) TSA_NO_TSA
 bdrv_graph_wrunlock(void);
diff --git a/tests/unit/test-bdrv-drain.c b/tests/unit/test-bdrv-drain.c
index 59c2793725..3369c2c2aa 100644
--- a/tests/unit/test-bdrv-drain.c
+++ b/tests/unit/test-bdrv-drain.c
@@ -772,11 +772,9 @@ static void test_blockjob_common_drain_node(enum drain_type drain_type,
     tjob->bs = src;
     job = &tjob->common;
 
-    bdrv_drain_all_begin();
-    bdrv_graph_wrlock();
+    bdrv_graph_wrlock_drained();
     block_job_add_bdrv(job, "target", target, 0, BLK_PERM_ALL, &error_abort);
     bdrv_graph_wrunlock();
-    bdrv_drain_all_end();
 
     switch (result) {
     case TEST_JOB_SUCCESS:
@@ -955,13 +953,11 @@ static void bdrv_test_top_close(BlockDriverState *bs)
 {
     BdrvChild *c, *next_c;
 
-    bdrv_drain_all_begin();
-    bdrv_graph_wrlock();
+    bdrv_graph_wrlock_drained();
     QLIST_FOREACH_SAFE(c, &bs->children, next, next_c) {
         bdrv_unref_child(bs, c);
     }
     bdrv_graph_wrunlock();
-    bdrv_drain_all_end();
 }
 
 static int coroutine_fn GRAPH_RDLOCK
@@ -1053,12 +1049,10 @@ static void do_test_delete_by_drain(bool detach_instead_of_delete,
 
     null_bs = bdrv_open("null-co://", NULL, NULL, BDRV_O_RDWR | BDRV_O_PROTOCOL,
                         &error_abort);
-    bdrv_drain_all_begin();
-    bdrv_graph_wrlock();
+    bdrv_graph_wrlock_drained();
     bdrv_attach_child(bs, null_bs, "null-child", &child_of_bds,
                       BDRV_CHILD_DATA, &error_abort);
     bdrv_graph_wrunlock();
-    bdrv_drain_all_end();
 
     /* This child will be the one to pass to requests through to, and
      * it will stall until a drain occurs */
@@ -1066,25 +1060,21 @@ static void do_test_delete_by_drain(bool detach_instead_of_delete,
                                     &error_abort);
     child_bs->total_sectors = 65536 >> BDRV_SECTOR_BITS;
     /* Takes our reference to child_bs */
-    bdrv_drain_all_begin();
-    bdrv_graph_wrlock();
+    bdrv_graph_wrlock_drained();
     tts->wait_child = bdrv_attach_child(bs, child_bs, "wait-child",
                                         &child_of_bds,
                                         BDRV_CHILD_DATA | BDRV_CHILD_PRIMARY,
                                         &error_abort);
     bdrv_graph_wrunlock();
-    bdrv_drain_all_end();
 
     /* This child is just there to be deleted
      * (for detach_instead_of_delete == true) */
     null_bs = bdrv_open("null-co://", NULL, NULL, BDRV_O_RDWR | BDRV_O_PROTOCOL,
                         &error_abort);
-    bdrv_drain_all_begin();
-    bdrv_graph_wrlock();
+    bdrv_graph_wrlock_drained();
     bdrv_attach_child(bs, null_bs, "null-child", &child_of_bds, BDRV_CHILD_DATA,
                       &error_abort);
     bdrv_graph_wrunlock();
-    bdrv_drain_all_end();
 
     blk = blk_new(qemu_get_aio_context(), BLK_PERM_ALL, BLK_PERM_ALL);
     blk_insert_bs(blk, bs, &error_abort);
@@ -1167,8 +1157,7 @@ static void no_coroutine_fn detach_indirect_bh(void *opaque)
 
     bdrv_dec_in_flight(data->child_b->bs);
 
-    bdrv_drain_all_begin();
-    bdrv_graph_wrlock();
+    bdrv_graph_wrlock_drained();
     bdrv_unref_child(data->parent_b, data->child_b);
 
     bdrv_ref(data->c);
@@ -1176,7 +1165,6 @@ static void no_coroutine_fn detach_indirect_bh(void *opaque)
                                       &child_of_bds, BDRV_CHILD_DATA,
                                       &error_abort);
     bdrv_graph_wrunlock();
-    bdrv_drain_all_end();
 }
 
 static void coroutine_mixed_fn detach_by_parent_aio_cb(void *opaque, int ret)
@@ -1274,8 +1262,7 @@ static void TSA_NO_TSA test_detach_indirect(bool by_parent_cb)
     /* Set child relationships */
     bdrv_ref(b);
     bdrv_ref(a);
-    bdrv_drain_all_begin();
-    bdrv_graph_wrlock();
+    bdrv_graph_wrlock_drained();
     child_b = bdrv_attach_child(parent_b, b, "PB-B", &child_of_bds,
                                 BDRV_CHILD_DATA, &error_abort);
     child_a = bdrv_attach_child(parent_b, a, "PB-A", &child_of_bds,
@@ -1286,7 +1273,6 @@ static void TSA_NO_TSA test_detach_indirect(bool by_parent_cb)
                       by_parent_cb ? &child_of_bds : &detach_by_driver_cb_class,
                       BDRV_CHILD_DATA, &error_abort);
     bdrv_graph_wrunlock();
-    bdrv_drain_all_end();
 
     g_assert_cmpint(parent_a->refcnt, ==, 1);
     g_assert_cmpint(parent_b->refcnt, ==, 1);
@@ -1699,8 +1685,7 @@ static void test_drop_intermediate_poll(void)
      * Establish the chain last, so the chain links are the first
      * elements in the BDS.parents lists
      */
-    bdrv_drain_all_begin();
-    bdrv_graph_wrlock();
+    bdrv_graph_wrlock_drained();
     for (i = 0; i < 3; i++) {
         if (i) {
             /* Takes the reference to chain[i - 1] */
@@ -1709,7 +1694,6 @@ static void test_drop_intermediate_poll(void)
         }
     }
     bdrv_graph_wrunlock();
-    bdrv_drain_all_end();
 
     job = block_job_create("job", &test_simple_job_driver, NULL, job_node,
                            0, BLK_PERM_ALL, 0, 0, NULL, NULL, &error_abort);
@@ -1956,12 +1940,10 @@ static void do_test_replace_child_mid_drain(int old_drain_count,
     new_child_bs->total_sectors = 1;
 
     bdrv_ref(old_child_bs);
-    bdrv_drain_all_begin();
-    bdrv_graph_wrlock();
+    bdrv_graph_wrlock_drained();
     bdrv_attach_child(parent_bs, old_child_bs, "child", &child_of_bds,
                       BDRV_CHILD_COW, &error_abort);
     bdrv_graph_wrunlock();
-    bdrv_drain_all_end();
     parent_s->setup_completed = true;
 
     for (i = 0; i < old_drain_count; i++) {
diff --git a/tests/unit/test-bdrv-graph-mod.c b/tests/unit/test-bdrv-graph-mod.c
index 7b03ebe4b0..b077f0e3e3 100644
--- a/tests/unit/test-bdrv-graph-mod.c
+++ b/tests/unit/test-bdrv-graph-mod.c
@@ -137,12 +137,10 @@ static void test_update_perm_tree(void)
 
     blk_insert_bs(root, bs, &error_abort);
 
-    bdrv_drain_all_begin();
-    bdrv_graph_wrlock();
+    bdrv_graph_wrlock_drained();
     bdrv_attach_child(filter, bs, "child", &child_of_bds,
                       BDRV_CHILD_DATA, &error_abort);
     bdrv_graph_wrunlock();
-    bdrv_drain_all_end();
 
     ret = bdrv_append(filter, bs, NULL);
     g_assert_cmpint(ret, <, 0);
@@ -206,13 +204,11 @@ static void test_should_update_child(void)
 
     bdrv_set_backing_hd(target, bs, &error_abort);
 
-    bdrv_drain_all_begin();
-    bdrv_graph_wrlock();
+    bdrv_graph_wrlock_drained();
     g_assert(target->backing->bs == bs);
     bdrv_attach_child(filter, target, "target", &child_of_bds,
                       BDRV_CHILD_DATA, &error_abort);
     bdrv_graph_wrunlock();
-    bdrv_drain_all_end();
     bdrv_append(filter, bs, &error_abort);
 
     bdrv_graph_rdlock_main_loop();
@@ -248,8 +244,7 @@ static void test_parallel_exclusive_write(void)
     bdrv_ref(base);
     bdrv_ref(fl1);
 
-    bdrv_drain_all_begin();
-    bdrv_graph_wrlock();
+    bdrv_graph_wrlock_drained();
     bdrv_attach_child(top, fl1, "backing", &child_of_bds,
                       BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY,
                       &error_abort);
@@ -262,7 +257,6 @@ static void test_parallel_exclusive_write(void)
 
     bdrv_replace_node(fl1, fl2, &error_abort);
     bdrv_graph_wrunlock();
-    bdrv_drain_all_end();
 
     bdrv_drained_end(fl2);
     bdrv_drained_end(fl1);
@@ -369,8 +363,7 @@ static void test_parallel_perm_update(void)
      */
     bdrv_ref(base);
 
-    bdrv_drain_all_begin();
-    bdrv_graph_wrlock();
+    bdrv_graph_wrlock_drained();
     bdrv_attach_child(top, ws, "file", &child_of_bds, BDRV_CHILD_DATA,
                       &error_abort);
     c_fl1 = bdrv_attach_child(ws, fl1, "first", &child_of_bds,
@@ -384,7 +377,6 @@ static void test_parallel_perm_update(void)
                       BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY,
                       &error_abort);
     bdrv_graph_wrunlock();
-    bdrv_drain_all_end();
 
     /* Select fl1 as first child to be active */
     s->selected = c_fl1;
@@ -438,13 +430,11 @@ static void test_append_greedy_filter(void)
     BlockDriverState *base = no_perm_node("base");
     BlockDriverState *fl = exclusive_writer_node("fl1");
 
-    bdrv_drain_all_begin();
-    bdrv_graph_wrlock();
+    bdrv_graph_wrlock_drained();
     bdrv_attach_child(top, base, "backing", &child_of_bds,
                       BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY,
                       &error_abort);
     bdrv_graph_wrunlock();
-    bdrv_drain_all_end();
 
     bdrv_append(fl, base, &error_abort);
     bdrv_unref(fl);

From 9918b2e95ed55680e5b2016149dd51610c698611 Mon Sep 17 00:00:00 2001
From: Fiona Ebner <f.ebner@proxmox.com>
Date: Fri, 30 May 2025 17:11:02 +0200
Subject: [PATCH 2311/2760] block/mirror: switch to
 bdrv_set_backing_hd_drained() variant

This is in preparation to mark bdrv_set_backing_hd() as
GRAPH_UNLOCKED.

Switch to using the bdrv_set_backing_hd_drained() variant, so that the
drained and locked section can also cover the calls to
bdrv_skip_filters() and bdrv_cow_bs().

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Message-ID: <20250530151125.955508-26-f.ebner@proxmox.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/mirror.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/block/mirror.c b/block/mirror.c
index 82a6e50cf8..873e95d029 100644
--- a/block/mirror.c
+++ b/block/mirror.c
@@ -761,30 +761,36 @@ static int mirror_exit_common(Job *job)
     bdrv_graph_rdlock_main_loop();
     bdrv_child_refresh_perms(mirror_top_bs, mirror_top_bs->backing,
                              &error_abort);
+    bdrv_graph_rdunlock_main_loop();
 
     if (!abort && s->backing_mode == MIRROR_SOURCE_BACKING_CHAIN) {
         BlockDriverState *backing;
-        BlockDriverState *unfiltered_target = bdrv_skip_filters(target_bs);
+        BlockDriverState *unfiltered_target;
+
+        bdrv_graph_wrlock_drained();
+        unfiltered_target = bdrv_skip_filters(target_bs);
 
         backing = s->sync_mode == MIRROR_SYNC_MODE_NONE ? src : s->base;
         if (bdrv_cow_bs(unfiltered_target) != backing) {
-            bdrv_set_backing_hd(unfiltered_target, backing, &local_err);
+            bdrv_set_backing_hd_drained(unfiltered_target, backing, &local_err);
             if (local_err) {
                 error_report_err(local_err);
                 local_err = NULL;
                 ret = -EPERM;
             }
         }
+        bdrv_graph_wrunlock();
     } else if (!abort && s->backing_mode == MIRROR_OPEN_BACKING_CHAIN) {
+        bdrv_graph_rdlock_main_loop();
         assert(!bdrv_backing_chain_next(target_bs));
         ret = bdrv_open_backing_file(bdrv_skip_filters(target_bs), NULL,
                                      "backing", &local_err);
+        bdrv_graph_rdunlock_main_loop();
         if (ret < 0) {
             error_report_err(local_err);
             local_err = NULL;
         }
     }
-    bdrv_graph_rdunlock_main_loop();
 
     if (s->should_complete && !abort) {
         BlockDriverState *to_replace = s->to_replace ?: src;

From 47bc2ed6f6a8eb637ede90c0545bca082b68379f Mon Sep 17 00:00:00 2001
From: Fiona Ebner <f.ebner@proxmox.com>
Date: Fri, 30 May 2025 17:11:03 +0200
Subject: [PATCH 2312/2760] block/commit: switch to
 bdrv_set_backing_hd_drained() variant

This is in preparation to mark bdrv_set_backing_hd() as
GRAPH_UNLOCKED.

Switch to using the bdrv_set_backing_hd_drained() variant. For the
first pair of calls to avoid draining and locking twice in a row
within the individual calls. For the third call, so that the drained
and locked section can also cover bdrv_cow_bs().

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Message-ID: <20250530151125.955508-27-f.ebner@proxmox.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/commit.c | 32 +++++++++++++++++++++++++-------
 1 file changed, 25 insertions(+), 7 deletions(-)

diff --git a/block/commit.c b/block/commit.c
index dc1942483b..c9690a5da0 100644
--- a/block/commit.c
+++ b/block/commit.c
@@ -514,28 +514,32 @@ int bdrv_commit(BlockDriverState *bs)
     Error *local_err = NULL;
 
     GLOBAL_STATE_CODE();
-    GRAPH_RDLOCK_GUARD_MAINLOOP();
 
     if (!drv)
         return -ENOMEDIUM;
 
+    bdrv_graph_rdlock_main_loop();
+
     backing_file_bs = bdrv_cow_bs(bs);
 
     if (!backing_file_bs) {
-        return -ENOTSUP;
+        ret = -ENOTSUP;
+        goto out;
     }
 
     if (bdrv_op_is_blocked(bs, BLOCK_OP_TYPE_COMMIT_SOURCE, NULL) ||
         bdrv_op_is_blocked(backing_file_bs, BLOCK_OP_TYPE_COMMIT_TARGET, NULL))
     {
-        return -EBUSY;
+        ret = -EBUSY;
+        goto out;
     }
 
     ro = bdrv_is_read_only(backing_file_bs);
 
     if (ro) {
         if (bdrv_reopen_set_read_only(backing_file_bs, false, NULL)) {
-            return -EACCES;
+            ret = -EACCES;
+            goto out;
         }
     }
 
@@ -559,8 +563,14 @@ int bdrv_commit(BlockDriverState *bs)
         goto ro_cleanup;
     }
 
-    bdrv_set_backing_hd(commit_top_bs, backing_file_bs, &error_abort);
-    bdrv_set_backing_hd(bs, commit_top_bs, &error_abort);
+    bdrv_graph_rdunlock_main_loop();
+
+    bdrv_graph_wrlock_drained();
+    bdrv_set_backing_hd_drained(commit_top_bs, backing_file_bs, &error_abort);
+    bdrv_set_backing_hd_drained(bs, commit_top_bs, &error_abort);
+    bdrv_graph_wrunlock();
+
+    bdrv_graph_rdlock_main_loop();
 
     ret = blk_insert_bs(backing, backing_file_bs, &local_err);
     if (ret < 0) {
@@ -635,9 +645,14 @@ int bdrv_commit(BlockDriverState *bs)
     ret = 0;
 ro_cleanup:
     blk_unref(backing);
+
+    bdrv_graph_rdunlock_main_loop();
+    bdrv_graph_wrlock_drained();
     if (bdrv_cow_bs(bs) != backing_file_bs) {
-        bdrv_set_backing_hd(bs, backing_file_bs, &error_abort);
+        bdrv_set_backing_hd_drained(bs, backing_file_bs, &error_abort);
     }
+    bdrv_graph_wrunlock();
+    bdrv_graph_rdlock_main_loop();
     bdrv_unref(commit_top_bs);
     blk_unref(src);
 
@@ -646,5 +661,8 @@ ro_cleanup:
         bdrv_reopen_set_read_only(backing_file_bs, true, NULL);
     }
 
+out:
+    bdrv_graph_rdunlock_main_loop();
+
     return ret;
 }

From d7573eba14b214d20340eed6880fb8f5cf90d051 Mon Sep 17 00:00:00 2001
From: Fiona Ebner <f.ebner@proxmox.com>
Date: Fri, 30 May 2025 17:11:04 +0200
Subject: [PATCH 2313/2760] block: call bdrv_set_backing_hd() while unlocked in
 bdrv_open_backing_file()

This is in preparation to mark bdrv_set_backing_hd() as
GRAPH_UNLOCKED.

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Message-ID: <20250530151125.955508-28-f.ebner@proxmox.com>
[kwolf: Removed an extra blank line]
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/block.c b/block.c
index 1da10d55f0..9ef3b0262c 100644
--- a/block.c
+++ b/block.c
@@ -3632,7 +3632,8 @@ int bdrv_open_backing_file(BlockDriverState *bs, QDict *parent_options,
     Error *local_err = NULL;
 
     GLOBAL_STATE_CODE();
-    GRAPH_RDLOCK_GUARD_MAINLOOP();
+
+    bdrv_graph_rdlock_main_loop();
 
     if (bs->backing != NULL) {
         goto free_exit;
@@ -3713,7 +3714,9 @@ int bdrv_open_backing_file(BlockDriverState *bs, QDict *parent_options,
 
     /* Hook up the backing file link; drop our reference, bs owns the
      * backing_hd reference now */
+    bdrv_graph_rdunlock_main_loop();
     ret = bdrv_set_backing_hd(bs, backing_hd, errp);
+    bdrv_graph_rdlock_main_loop();
     bdrv_unref(backing_hd);
 
     if (ret < 0) {
@@ -3725,6 +3728,7 @@ int bdrv_open_backing_file(BlockDriverState *bs, QDict *parent_options,
 free_exit:
     g_free(backing_filename);
     qobject_unref(tmp_parent_options);
+    bdrv_graph_rdunlock_main_loop();
     return ret;
 }
 

From de0d24c711f6d4deaf51de2d5001c0516a10ef22 Mon Sep 17 00:00:00 2001
From: Fiona Ebner <f.ebner@proxmox.com>
Date: Fri, 30 May 2025 17:11:05 +0200
Subject: [PATCH 2314/2760] block: mark bdrv_set_backing_hd() as GRAPH_UNLOCKED

The function bdrv_set_backing_hd() calls bdrv_drain_all_begin(), which
must be called with the graph unlocked.

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Message-ID: <20250530151125.955508-29-f.ebner@proxmox.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 include/block/block-global-state.h | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/include/block/block-global-state.h b/include/block/block-global-state.h
index 84a2a4ecd5..009b9ac946 100644
--- a/include/block/block-global-state.h
+++ b/include/block/block-global-state.h
@@ -100,8 +100,9 @@ bdrv_open_blockdev_ref(BlockdevRef *ref, Error **errp);
 BlockDriverState * coroutine_fn no_co_wrapper
 bdrv_co_open_blockdev_ref(BlockdevRef *ref, Error **errp);
 
-int bdrv_set_backing_hd(BlockDriverState *bs, BlockDriverState *backing_hd,
-                        Error **errp);
+int GRAPH_UNLOCKED
+bdrv_set_backing_hd(BlockDriverState *bs, BlockDriverState *backing_hd,
+                    Error **errp);
 int GRAPH_WRLOCK
 bdrv_set_backing_hd_drained(BlockDriverState *bs, BlockDriverState *backing_hd,
                             Error **errp);

From c7af387c7b58f8ffcd412b175768f6ccd591b1fc Mon Sep 17 00:00:00 2001
From: Fiona Ebner <f.ebner@proxmox.com>
Date: Fri, 30 May 2025 17:11:06 +0200
Subject: [PATCH 2315/2760] blockdev: avoid locking and draining multiple times
 in external_snapshot_abort()

By using the appropriate variants bdrv_set_backing_hd_drained() and
bdrv_try_change_aio_context_locked(), there only needs to be a single
drained and write-locked section in external_snapshot_abort().

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Message-ID: <20250530151125.955508-30-f.ebner@proxmox.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 blockdev.c | 22 ++++++++++++++--------
 1 file changed, 14 insertions(+), 8 deletions(-)

diff --git a/blockdev.c b/blockdev.c
index e625534925..3c53472a23 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -1580,11 +1580,19 @@ static void external_snapshot_abort(void *opaque)
             AioContext *tmp_context;
             int ret;
 
+            bdrv_graph_wrlock_drained();
+
             aio_context = bdrv_get_aio_context(state->old_bs);
 
-            bdrv_ref(state->old_bs);   /* we can't let bdrv_set_backind_hd()
-                                          close state->old_bs; we need it */
-            bdrv_set_backing_hd(state->new_bs, NULL, &error_abort);
+            /*
+             * Note that state->old_bs would not disappear during the
+             * write-locked section, because the unref from
+             * bdrv_set_backing_hd_drained() only happens at the end of the
+             * write-locked section. However, just be explicit about keeping a
+             * reference and don't rely on that implicit detail.
+             */
+            bdrv_ref(state->old_bs);
+            bdrv_set_backing_hd_drained(state->new_bs, NULL, &error_abort);
 
             /*
              * The call to bdrv_set_backing_hd() above returns state->old_bs to
@@ -1593,16 +1601,14 @@ static void external_snapshot_abort(void *opaque)
              */
             tmp_context = bdrv_get_aio_context(state->old_bs);
             if (aio_context != tmp_context) {
-                ret = bdrv_try_change_aio_context(state->old_bs,
-                                                  aio_context, NULL, NULL);
+                ret = bdrv_try_change_aio_context_locked(state->old_bs,
+                                                         aio_context, NULL,
+                                                         NULL);
                 assert(ret == 0);
             }
 
-            bdrv_drained_begin(state->new_bs);
-            bdrv_graph_wrlock();
             bdrv_replace_node(state->new_bs, state->old_bs, &error_abort);
             bdrv_graph_wrunlock();
-            bdrv_drained_end(state->new_bs);
 
             bdrv_unref(state->old_bs); /* bdrv_replace_node() ref'ed old_bs */
         }

From 54eb59d668d6e4e7584188628ca44f3e9bd39d17 Mon Sep 17 00:00:00 2001
From: Fiona Ebner <f.ebner@proxmox.com>
Date: Fri, 30 May 2025 17:11:07 +0200
Subject: [PATCH 2316/2760] block: drop wrapper for
 bdrv_set_backing_hd_drained()

Nearly all callers (outside of the tests) are already using the
_drained() variant of the function. It doesn't seem worth keeping.
Simply adapt the remaining callers of bdrv_set_backing_hd() and rename
bdrv_set_backing_hd_drained() to bdrv_set_backing_hd().

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Message-ID: <20250530151125.955508-31-f.ebner@proxmox.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block.c                            | 20 ++++----------------
 block/commit.c                     |  6 +++---
 block/mirror.c                     |  2 +-
 block/stream.c                     | 13 ++++++-------
 blockdev.c                         | 13 ++++++++-----
 include/block/block-global-state.h |  5 +----
 tests/unit/test-bdrv-drain.c       | 12 +++++++++++-
 tests/unit/test-bdrv-graph-mod.c   |  2 +-
 8 files changed, 35 insertions(+), 38 deletions(-)

diff --git a/block.c b/block.c
index 9ef3b0262c..4754705bfd 100644
--- a/block.c
+++ b/block.c
@@ -3570,9 +3570,8 @@ out:
  *
  * All block nodes must be drained.
  */
-int bdrv_set_backing_hd_drained(BlockDriverState *bs,
-                                BlockDriverState *backing_hd,
-                                Error **errp)
+int bdrv_set_backing_hd(BlockDriverState *bs, BlockDriverState *backing_hd,
+                        Error **errp)
 {
     int ret;
     Transaction *tran = tran_new();
@@ -3594,19 +3593,6 @@ out:
     return ret;
 }
 
-int bdrv_set_backing_hd(BlockDriverState *bs, BlockDriverState *backing_hd,
-                        Error **errp)
-{
-    int ret;
-    GLOBAL_STATE_CODE();
-
-    bdrv_graph_wrlock_drained();
-    ret = bdrv_set_backing_hd_drained(bs, backing_hd, errp);
-    bdrv_graph_wrunlock();
-
-    return ret;
-}
-
 /*
  * Opens the backing file for a BlockDriverState if not yet open
  *
@@ -3715,7 +3701,9 @@ int bdrv_open_backing_file(BlockDriverState *bs, QDict *parent_options,
     /* Hook up the backing file link; drop our reference, bs owns the
      * backing_hd reference now */
     bdrv_graph_rdunlock_main_loop();
+    bdrv_graph_wrlock_drained();
     ret = bdrv_set_backing_hd(bs, backing_hd, errp);
+    bdrv_graph_wrunlock();
     bdrv_graph_rdlock_main_loop();
     bdrv_unref(backing_hd);
 
diff --git a/block/commit.c b/block/commit.c
index c9690a5da0..7496cf732e 100644
--- a/block/commit.c
+++ b/block/commit.c
@@ -566,8 +566,8 @@ int bdrv_commit(BlockDriverState *bs)
     bdrv_graph_rdunlock_main_loop();
 
     bdrv_graph_wrlock_drained();
-    bdrv_set_backing_hd_drained(commit_top_bs, backing_file_bs, &error_abort);
-    bdrv_set_backing_hd_drained(bs, commit_top_bs, &error_abort);
+    bdrv_set_backing_hd(commit_top_bs, backing_file_bs, &error_abort);
+    bdrv_set_backing_hd(bs, commit_top_bs, &error_abort);
     bdrv_graph_wrunlock();
 
     bdrv_graph_rdlock_main_loop();
@@ -649,7 +649,7 @@ ro_cleanup:
     bdrv_graph_rdunlock_main_loop();
     bdrv_graph_wrlock_drained();
     if (bdrv_cow_bs(bs) != backing_file_bs) {
-        bdrv_set_backing_hd_drained(bs, backing_file_bs, &error_abort);
+        bdrv_set_backing_hd(bs, backing_file_bs, &error_abort);
     }
     bdrv_graph_wrunlock();
     bdrv_graph_rdlock_main_loop();
diff --git a/block/mirror.c b/block/mirror.c
index 873e95d029..b344182c74 100644
--- a/block/mirror.c
+++ b/block/mirror.c
@@ -772,7 +772,7 @@ static int mirror_exit_common(Job *job)
 
         backing = s->sync_mode == MIRROR_SYNC_MODE_NONE ? src : s->base;
         if (bdrv_cow_bs(unfiltered_target) != backing) {
-            bdrv_set_backing_hd_drained(unfiltered_target, backing, &local_err);
+            bdrv_set_backing_hd(unfiltered_target, backing, &local_err);
             if (local_err) {
                 error_report_err(local_err);
                 local_err = NULL;
diff --git a/block/stream.c b/block/stream.c
index a6ef840e29..17e240460c 100644
--- a/block/stream.c
+++ b/block/stream.c
@@ -73,12 +73,11 @@ static int stream_prepare(Job *job)
     s->cor_filter_bs = NULL;
 
     /*
-     * bdrv_set_backing_hd() requires that the unfiltered_bs and the COW child
-     * of unfiltered_bs is drained. Drain already here and use
-     * bdrv_set_backing_hd_drained() instead because the polling during
-     * drained_begin() might change the graph, and if we do this only later, we
-     * may end up working with the wrong base node (or it might even have gone
-     * away by the time we want to use it).
+     * bdrv_set_backing_hd() requires that all block nodes are drained. Drain
+     * already here, because the polling during drained_begin() might change the
+     * graph, and if we do this only later, we may end up working with the wrong
+     * base node (or it might even have gone away by the time we want to use
+     * it).
      */
     if (unfiltered_bs_cow) {
         bdrv_ref(unfiltered_bs_cow);
@@ -105,7 +104,7 @@ static int stream_prepare(Job *job)
         }
 
         bdrv_graph_wrlock();
-        bdrv_set_backing_hd_drained(unfiltered_bs, base, &local_err);
+        bdrv_set_backing_hd(unfiltered_bs, base, &local_err);
         bdrv_graph_wrunlock();
 
         /*
diff --git a/blockdev.c b/blockdev.c
index 3c53472a23..9f3f42d896 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -1587,12 +1587,12 @@ static void external_snapshot_abort(void *opaque)
             /*
              * Note that state->old_bs would not disappear during the
              * write-locked section, because the unref from
-             * bdrv_set_backing_hd_drained() only happens at the end of the
-             * write-locked section. However, just be explicit about keeping a
-             * reference and don't rely on that implicit detail.
+             * bdrv_set_backing_hd() only happens at the end of the write-locked
+             * section. However, just be explicit about keeping a reference and
+             * don't rely on that implicit detail.
              */
             bdrv_ref(state->old_bs);
-            bdrv_set_backing_hd_drained(state->new_bs, NULL, &error_abort);
+            bdrv_set_backing_hd(state->new_bs, NULL, &error_abort);
 
             /*
              * The call to bdrv_set_backing_hd() above returns state->old_bs to
@@ -1776,7 +1776,10 @@ static void drive_backup_action(DriveBackup *backup,
     }
 
     if (set_backing_hd) {
-        if (bdrv_set_backing_hd(target_bs, source, errp) < 0) {
+        bdrv_graph_wrlock_drained();
+        ret = bdrv_set_backing_hd(target_bs, source, errp);
+        bdrv_graph_wrunlock();
+        if (ret < 0) {
             goto unref;
         }
     }
diff --git a/include/block/block-global-state.h b/include/block/block-global-state.h
index 009b9ac946..bcbb624a7b 100644
--- a/include/block/block-global-state.h
+++ b/include/block/block-global-state.h
@@ -100,12 +100,9 @@ bdrv_open_blockdev_ref(BlockdevRef *ref, Error **errp);
 BlockDriverState * coroutine_fn no_co_wrapper
 bdrv_co_open_blockdev_ref(BlockdevRef *ref, Error **errp);
 
-int GRAPH_UNLOCKED
+int GRAPH_WRLOCK
 bdrv_set_backing_hd(BlockDriverState *bs, BlockDriverState *backing_hd,
                     Error **errp);
-int GRAPH_WRLOCK
-bdrv_set_backing_hd_drained(BlockDriverState *bs, BlockDriverState *backing_hd,
-                            Error **errp);
 
 int bdrv_open_backing_file(BlockDriverState *bs, QDict *parent_options,
                            const char *bdref_key, Error **errp);
diff --git a/tests/unit/test-bdrv-drain.c b/tests/unit/test-bdrv-drain.c
index 3369c2c2aa..43b0ba8648 100644
--- a/tests/unit/test-bdrv-drain.c
+++ b/tests/unit/test-bdrv-drain.c
@@ -193,7 +193,9 @@ static BlockBackend * no_coroutine_fn test_setup(void)
     blk_insert_bs(blk, bs, &error_abort);
 
     backing = bdrv_new_open_driver(&bdrv_test, "backing", 0, &error_abort);
+    bdrv_graph_wrlock_drained();
     bdrv_set_backing_hd(bs, backing, &error_abort);
+    bdrv_graph_wrunlock();
 
     bdrv_unref(backing);
     bdrv_unref(bs);
@@ -386,7 +388,9 @@ static void test_nested(void)
 
     backing = bdrv_new_open_driver(&bdrv_test, "backing", 0, &error_abort);
     backing_s = backing->opaque;
+    bdrv_graph_wrlock_drained();
     bdrv_set_backing_hd(bs, backing, &error_abort);
+    bdrv_graph_wrunlock();
 
     for (outer = 0; outer < DRAIN_TYPE_MAX; outer++) {
         for (inner = 0; inner < DRAIN_TYPE_MAX; inner++) {
@@ -733,10 +737,12 @@ static void test_blockjob_common_drain_node(enum drain_type drain_type,
     src_overlay = bdrv_new_open_driver(&bdrv_test, "source-overlay",
                                        BDRV_O_RDWR, &error_abort);
 
+    bdrv_graph_wrlock_drained();
     bdrv_set_backing_hd(src_overlay, src, &error_abort);
     bdrv_unref(src);
     bdrv_set_backing_hd(src, src_backing, &error_abort);
     bdrv_unref(src_backing);
+    bdrv_graph_wrunlock();
 
     blk_src = blk_new(qemu_get_aio_context(), BLK_PERM_ALL, BLK_PERM_ALL);
     blk_insert_bs(blk_src, src_overlay, &error_abort);
@@ -1436,8 +1442,10 @@ static void test_drop_backing_job_commit(Job *job)
     TestDropBackingBlockJob *s =
         container_of(job, TestDropBackingBlockJob, common.job);
 
+    bdrv_graph_wrlock_drained();
     bdrv_set_backing_hd(s->bs, NULL, &error_abort);
     bdrv_set_backing_hd(s->detach_also, NULL, &error_abort);
+    bdrv_graph_wrunlock();
 
     *s->did_complete = true;
 }
@@ -1530,7 +1538,9 @@ static void test_blockjob_commit_by_drained_end(void)
         snprintf(name, sizeof(name), "parent-node-%i", i);
         bs_parents[i] = bdrv_new_open_driver(&bdrv_test, name, BDRV_O_RDWR,
                                              &error_abort);
+        bdrv_graph_wrlock_drained();
         bdrv_set_backing_hd(bs_parents[i], bs_child, &error_abort);
+        bdrv_graph_wrunlock();
     }
 
     job = block_job_create("job", &test_drop_backing_job_driver, NULL,
@@ -1679,13 +1689,13 @@ static void test_drop_intermediate_poll(void)
 
     job_node = bdrv_new_open_driver(&bdrv_test, "job-node", BDRV_O_RDWR,
                                     &error_abort);
+    bdrv_graph_wrlock_drained();
     bdrv_set_backing_hd(job_node, chain[1], &error_abort);
 
     /*
      * Establish the chain last, so the chain links are the first
      * elements in the BDS.parents lists
      */
-    bdrv_graph_wrlock_drained();
     for (i = 0; i < 3; i++) {
         if (i) {
             /* Takes the reference to chain[i - 1] */
diff --git a/tests/unit/test-bdrv-graph-mod.c b/tests/unit/test-bdrv-graph-mod.c
index b077f0e3e3..567db99e4f 100644
--- a/tests/unit/test-bdrv-graph-mod.c
+++ b/tests/unit/test-bdrv-graph-mod.c
@@ -202,9 +202,9 @@ static void test_should_update_child(void)
 
     blk_insert_bs(root, bs, &error_abort);
 
+    bdrv_graph_wrlock_drained();
     bdrv_set_backing_hd(target, bs, &error_abort);
 
-    bdrv_graph_wrlock_drained();
     g_assert(target->backing->bs == bs);
     bdrv_attach_child(filter, target, "target", &child_of_bds,
                       BDRV_CHILD_DATA, &error_abort);

From 9ec8c4793f0f5a6f1d342a5d5eebeec516e3c107 Mon Sep 17 00:00:00 2001
From: Fiona Ebner <f.ebner@proxmox.com>
Date: Fri, 30 May 2025 17:11:08 +0200
Subject: [PATCH 2317/2760] block-backend: mark blk_drain_all() as
 GRAPH_UNLOCKED

The function blk_drain_all() calls bdrv_drain_all_begin(), which must
be called with the graph unlocked.

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Message-ID: <20250530151125.955508-32-f.ebner@proxmox.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 include/system/block-backend-global-state.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/system/block-backend-global-state.h b/include/system/block-backend-global-state.h
index 35b5e8380b..a62dbdf0dc 100644
--- a/include/system/block-backend-global-state.h
+++ b/include/system/block-backend-global-state.h
@@ -79,7 +79,7 @@ void blk_aio_cancel(BlockAIOCB *acb);
 int blk_commit_all(void);
 bool blk_in_drain(BlockBackend *blk);
 void blk_drain(BlockBackend *blk);
-void blk_drain_all(void);
+void GRAPH_UNLOCKED blk_drain_all(void);
 void blk_set_on_error(BlockBackend *blk, BlockdevOnError on_read_error,
                       BlockdevOnError on_write_error);
 bool blk_supports_write_perm(BlockBackend *blk);

From c6b5328b5b81a358df766094a361b747eadc55a8 Mon Sep 17 00:00:00 2001
From: Fiona Ebner <f.ebner@proxmox.com>
Date: Fri, 30 May 2025 17:11:09 +0200
Subject: [PATCH 2318/2760] block/snapshot: mark bdrv_all_delete_snapshot() as
 GRAPH_UNLOCKED

The function bdrv_all_delete_snapshot() calls bdrv_drain_all_begin(),
which must be called with the graph unlocked.

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Message-ID: <20250530151125.955508-33-f.ebner@proxmox.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 include/block/snapshot.h | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/include/block/snapshot.h b/include/block/snapshot.h
index 304cc6ea61..2316a43e26 100644
--- a/include/block/snapshot.h
+++ b/include/block/snapshot.h
@@ -90,9 +90,9 @@ int bdrv_snapshot_load_tmp_by_id_or_name(BlockDriverState *bs,
 
 bool bdrv_all_can_snapshot(bool has_devices, strList *devices,
                            Error **errp);
-int bdrv_all_delete_snapshot(const char *name,
-                             bool has_devices, strList *devices,
-                             Error **errp);
+int GRAPH_UNLOCKED
+bdrv_all_delete_snapshot(const char *name, bool has_devices, strList *devices,
+                         Error **errp);
 int bdrv_all_goto_snapshot(const char *name,
                            bool has_devices, strList *devices,
                            Error **errp);

From 0a0474b065b97e9a25c2723bde87afbc77ba4bd9 Mon Sep 17 00:00:00 2001
From: Fiona Ebner <f.ebner@proxmox.com>
Date: Fri, 30 May 2025 17:11:10 +0200
Subject: [PATCH 2319/2760] block/stream: mark stream_prepare() as
 GRAPH_UNLOCKED

The function stream_prepare() calls bdrv_drain_all_begin(), which
must be called with the graph unlocked.

Also mark the JobDriver's prepare() callback as GRAPH_UNLOCKED_PTR,
because that is the callback via which stream_prepare() is reached.

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Message-ID: <20250530151125.955508-34-f.ebner@proxmox.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/stream.c     | 2 +-
 include/qemu/job.h | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/block/stream.c b/block/stream.c
index 17e240460c..c0616b69e2 100644
--- a/block/stream.c
+++ b/block/stream.c
@@ -51,7 +51,7 @@ static int coroutine_fn stream_populate(BlockBackend *blk,
     return blk_co_preadv(blk, offset, bytes, NULL, BDRV_REQ_PREFETCH);
 }
 
-static int stream_prepare(Job *job)
+static int GRAPH_UNLOCKED stream_prepare(Job *job)
 {
     StreamBlockJob *s = container_of(job, StreamBlockJob, common.job);
     BlockDriverState *unfiltered_bs;
diff --git a/include/qemu/job.h b/include/qemu/job.h
index a5a04155ea..bb8ee766ef 100644
--- a/include/qemu/job.h
+++ b/include/qemu/job.h
@@ -263,7 +263,7 @@ struct JobDriver {
      * This callback will not be invoked if the job has already failed.
      * If it fails, abort and then clean will be called.
      */
-    int (*prepare)(Job *job);
+    int GRAPH_UNLOCKED_PTR (*prepare)(Job *job);
 
     /**
      * If the callback is not NULL, it will be invoked when all the jobs

From 6717dc307523c9e57b0d6c7dd302eab764c19265 Mon Sep 17 00:00:00 2001
From: Fiona Ebner <f.ebner@proxmox.com>
Date: Fri, 30 May 2025 17:11:11 +0200
Subject: [PATCH 2320/2760] block: mark bdrv_reopen_queue() and
 bdrv_reopen_multiple() as GRAPH_UNLOCKED

The function bdrv_reopen_queue() can call bdrv_drain_all_begin(),
which must be called with the graph unlocked.

The function bdrv_reopen_multiple() calls bdrv_reopen_prepare() which
must be called with the graph unlocked.

To mark bdrv_reopen_queue() as GRAPH_UNLOCKED, it is necessary to make
the locked section in reopen_backing_file() shorter.

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Message-ID: <20250530151125.955508-35-f.ebner@proxmox.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/replication.c                | 3 ++-
 include/block/block-global-state.h | 9 +++++----
 2 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/block/replication.c b/block/replication.c
index 83978b61f5..3a431e908c 100644
--- a/block/replication.c
+++ b/block/replication.c
@@ -364,14 +364,15 @@ static void reopen_backing_file(BlockDriverState *bs, bool writable,
     BlockReopenQueue *reopen_queue = NULL;
 
     GLOBAL_STATE_CODE();
-    GRAPH_RDLOCK_GUARD_MAINLOOP();
 
+    bdrv_graph_rdlock_main_loop();
     /*
      * s->hidden_disk and s->secondary_disk may not be set yet, as they will
      * only be set after the children are writable.
      */
     hidden_disk = bs->file->bs->backing;
     secondary_disk = hidden_disk->bs->backing;
+    bdrv_graph_rdunlock_main_loop();
 
     if (writable) {
         s->orig_hidden_read_only = bdrv_is_read_only(hidden_disk->bs);
diff --git a/include/block/block-global-state.h b/include/block/block-global-state.h
index bcbb624a7b..f25c65c1b4 100644
--- a/include/block/block-global-state.h
+++ b/include/block/block-global-state.h
@@ -121,11 +121,12 @@ BlockDriverState *bdrv_new_open_driver_opts(BlockDriver *drv,
                                             Error **errp);
 BlockDriverState *bdrv_new_open_driver(BlockDriver *drv, const char *node_name,
                                        int flags, Error **errp);
-BlockReopenQueue *bdrv_reopen_queue(BlockReopenQueue *bs_queue,
-                                    BlockDriverState *bs, QDict *options,
-                                    bool keep_old_opts);
+BlockReopenQueue * GRAPH_UNLOCKED
+bdrv_reopen_queue(BlockReopenQueue *bs_queue, BlockDriverState *bs,
+                  QDict *options, bool keep_old_opts);
 void bdrv_reopen_queue_free(BlockReopenQueue *bs_queue);
-int bdrv_reopen_multiple(BlockReopenQueue *bs_queue, Error **errp);
+int GRAPH_UNLOCKED
+bdrv_reopen_multiple(BlockReopenQueue *bs_queue, Error **errp);
 int bdrv_reopen(BlockDriverState *bs, QDict *opts, bool keep_old_opts,
                 Error **errp);
 int bdrv_reopen_set_read_only(BlockDriverState *bs, bool read_only,

From e2d9cc57905eaabd2b212de2f77993935a7fc271 Mon Sep 17 00:00:00 2001
From: Fiona Ebner <f.ebner@proxmox.com>
Date: Fri, 30 May 2025 17:11:12 +0200
Subject: [PATCH 2321/2760] block: mark bdrv_inactivate() as GRAPH_RDLOCK and
 move drain to callers

The function bdrv_inactivate() calls bdrv_drain_all_begin(), which
needs to be called with the graph unlocked, so either
bdrv_inactivate() should be marked as GRAPH_UNLOCKED or the drain
needs to be moved to the callers. The caller in
qmp_blockdev_set_active() requires that the locked section covers
bdrv_find_node() too, so the latter alternative is chosen.

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Message-ID: <20250530151125.955508-36-f.ebner@proxmox.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block.c                            | 14 ++----
 blockdev.c                         | 75 ++++++++++++++++++------------
 include/block/block-global-state.h |  2 +-
 3 files changed, 51 insertions(+), 40 deletions(-)

diff --git a/block.c b/block.c
index 4754705bfd..932e599f45 100644
--- a/block.c
+++ b/block.c
@@ -7058,31 +7058,25 @@ bdrv_inactivate_recurse(BlockDriverState *bs, bool top_level)
     return 0;
 }
 
+/* All block nodes must be drained. */
 int bdrv_inactivate(BlockDriverState *bs, Error **errp)
 {
     int ret;
 
     GLOBAL_STATE_CODE();
 
-    bdrv_drain_all_begin();
-    bdrv_graph_rdlock_main_loop();
-
     if (bdrv_has_bds_parent(bs, true)) {
         error_setg(errp, "Node has active parent node");
-        ret = -EPERM;
-        goto out;
+        return -EPERM;
     }
 
     ret = bdrv_inactivate_recurse(bs, true);
     if (ret < 0) {
         error_setg_errno(errp, -ret, "Failed to inactivate node");
-        goto out;
+        return ret;
     }
 
-out:
-    bdrv_graph_rdunlock_main_loop();
-    bdrv_drain_all_end();
-    return ret;
+    return 0;
 }
 
 int bdrv_inactivate_all(void)
diff --git a/blockdev.c b/blockdev.c
index 9f3f42d896..b451fee6e1 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -1421,7 +1421,7 @@ static void external_snapshot_action(TransactionAction *action,
     bdrv_graph_rdunlock_main_loop();
     /* Paired with .clean() */
     bdrv_drained_begin(state->old_bs);
-    GRAPH_RDLOCK_GUARD_MAINLOOP();
+    bdrv_graph_rdlock_main_loop();
 
     /* Make sure the associated bs did not change with the drain. */
     check_bs = bdrv_lookup_bs(device, node_name, errp);
@@ -1430,18 +1430,18 @@ static void external_snapshot_action(TransactionAction *action,
             error_setg(errp, "Block node of device '%s' unexpectedly changed",
                        device);
         } /* else errp is already set */
-        return;
+        goto unlock;
     }
 
     if (!bdrv_is_inserted(state->old_bs)) {
         error_setg(errp, "Device '%s' has no medium",
                    bdrv_get_device_or_node_name(state->old_bs));
-        return;
+        goto unlock;
     }
 
     if (bdrv_op_is_blocked(state->old_bs,
                            BLOCK_OP_TYPE_EXTERNAL_SNAPSHOT, errp)) {
-        return;
+        goto unlock;
     }
 
     if (!bdrv_is_read_only(state->old_bs)) {
@@ -1449,7 +1449,7 @@ static void external_snapshot_action(TransactionAction *action,
         if (ret < 0) {
             error_setg_errno(errp, -ret, "Write to node '%s' failed",
                              bdrv_get_device_or_node_name(state->old_bs));
-            return;
+            goto unlock;
         }
     }
 
@@ -1461,13 +1461,13 @@ static void external_snapshot_action(TransactionAction *action,
 
         if (node_name && !snapshot_node_name) {
             error_setg(errp, "New overlay node-name missing");
-            return;
+            goto unlock;
         }
 
         if (snapshot_node_name &&
             bdrv_lookup_bs(snapshot_node_name, snapshot_node_name, NULL)) {
             error_setg(errp, "New overlay node-name already in use");
-            return;
+            goto unlock;
         }
 
         flags = state->old_bs->open_flags;
@@ -1480,7 +1480,7 @@ static void external_snapshot_action(TransactionAction *action,
             int64_t size = bdrv_getlength(state->old_bs);
             if (size < 0) {
                 error_setg_errno(errp, -size, "bdrv_getlength failed");
-                return;
+                goto unlock;
             }
             bdrv_refresh_filename(state->old_bs);
 
@@ -1491,7 +1491,7 @@ static void external_snapshot_action(TransactionAction *action,
 
             if (local_err) {
                 error_propagate(errp, local_err);
-                return;
+                goto unlock;
             }
         }
 
@@ -1507,7 +1507,7 @@ static void external_snapshot_action(TransactionAction *action,
 
     /* We will manually add the backing_hd field to the bs later */
     if (!state->new_bs) {
-        return;
+        goto unlock;
     }
 
     /*
@@ -1518,22 +1518,22 @@ static void external_snapshot_action(TransactionAction *action,
     bdrv_get_cumulative_perm(state->new_bs, &perm, &shared);
     if (perm & BLK_PERM_CONSISTENT_READ) {
         error_setg(errp, "The overlay is already in use");
-        return;
+        goto unlock;
     }
 
     if (state->new_bs->drv->is_filter) {
         error_setg(errp, "Filters cannot be used as overlays");
-        return;
+        goto unlock;
     }
 
     if (bdrv_cow_child(state->new_bs)) {
         error_setg(errp, "The overlay already has a backing image");
-        return;
+        goto unlock;
     }
 
     if (!state->new_bs->drv->supports_backing) {
         error_setg(errp, "The overlay does not support backing images");
-        return;
+        goto unlock;
     }
 
     /*
@@ -1546,17 +1546,23 @@ static void external_snapshot_action(TransactionAction *action,
      * to keep this working.
      */
     if (bdrv_is_inactive(state->old_bs) && !bdrv_is_inactive(state->new_bs)) {
+        bdrv_graph_rdunlock_main_loop();
+        bdrv_drain_all_begin();
+        bdrv_graph_rdlock_main_loop();
         ret = bdrv_inactivate(state->new_bs, errp);
+        bdrv_drain_all_end();
         if (ret < 0) {
-            return;
+            goto unlock;
         }
     }
 
     ret = bdrv_append(state->new_bs, state->old_bs, errp);
     if (ret < 0) {
-        return;
+        goto unlock;
     }
     state->overlay_appended = true;
+unlock:
+    bdrv_graph_rdunlock_main_loop();
 }
 
 static void external_snapshot_commit(void *opaque)
@@ -3520,10 +3526,10 @@ void qmp_blockdev_del(const char *node_name, Error **errp)
 
 void qmp_blockdev_set_active(const char *node_name, bool active, Error **errp)
 {
+    BlockDriverState *bs;
     int ret;
 
     GLOBAL_STATE_CODE();
-    GRAPH_RDLOCK_GUARD_MAINLOOP();
 
     if (!node_name) {
         if (active) {
@@ -3534,19 +3540,30 @@ void qmp_blockdev_set_active(const char *node_name, bool active, Error **errp)
                 error_setg_errno(errp, -ret, "Failed to inactivate all nodes");
             }
         }
-    } else {
-        BlockDriverState *bs = bdrv_find_node(node_name);
-        if (!bs) {
-            error_setg(errp, "Failed to find node with node-name='%s'",
-                       node_name);
-            return;
-        }
+        return;
+    }
 
-        if (active) {
-            bdrv_activate(bs, errp);
-        } else {
-            bdrv_inactivate(bs, errp);
-        }
+    if (!active) {
+        bdrv_drain_all_begin();
+    }
+    bdrv_graph_rdlock_main_loop();
+
+    bs = bdrv_find_node(node_name);
+    if (!bs) {
+        error_setg(errp, "Failed to find node with node-name='%s'",
+                   node_name);
+        goto unlock;
+    }
+    if (active) {
+        bdrv_activate(bs, errp);
+    } else {
+        bdrv_inactivate(bs, errp);
+    }
+
+unlock:
+    bdrv_graph_rdunlock_main_loop();
+    if (!active) {
+        bdrv_drain_all_end();
     }
 }
 
diff --git a/include/block/block-global-state.h b/include/block/block-global-state.h
index f25c65c1b4..a641beb270 100644
--- a/include/block/block-global-state.h
+++ b/include/block/block-global-state.h
@@ -183,7 +183,7 @@ bdrv_activate(BlockDriverState *bs, Error **errp);
 int coroutine_fn no_co_wrapper_bdrv_rdlock
 bdrv_co_activate(BlockDriverState *bs, Error **errp);
 
-int no_coroutine_fn
+int no_coroutine_fn GRAPH_RDLOCK
 bdrv_inactivate(BlockDriverState *bs, Error **errp);
 
 void bdrv_activate_all(Error **errp);

From 7525aa25dbee5213c10a325a4633fd80f577c440 Mon Sep 17 00:00:00 2001
From: Fiona Ebner <f.ebner@proxmox.com>
Date: Fri, 30 May 2025 17:11:13 +0200
Subject: [PATCH 2322/2760] block: mark bdrv_inactivate_all() as GRAPH_UNLOCKED

The function bdrv_inactivate_all() calls bdrv_drain_all_begin(), which
must be called with the graph unlocked.

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Message-ID: <20250530151125.955508-37-f.ebner@proxmox.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 include/block/block-global-state.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/block/block-global-state.h b/include/block/block-global-state.h
index a641beb270..eec92a98da 100644
--- a/include/block/block-global-state.h
+++ b/include/block/block-global-state.h
@@ -187,7 +187,7 @@ int no_coroutine_fn GRAPH_RDLOCK
 bdrv_inactivate(BlockDriverState *bs, Error **errp);
 
 void bdrv_activate_all(Error **errp);
-int bdrv_inactivate_all(void);
+int GRAPH_UNLOCKED bdrv_inactivate_all(void);
 
 int bdrv_flush_all(void);
 void bdrv_close_all(void);

From b326b127df9eef8e41818ff88d33f99ea54af984 Mon Sep 17 00:00:00 2001
From: Fiona Ebner <f.ebner@proxmox.com>
Date: Fri, 30 May 2025 17:11:14 +0200
Subject: [PATCH 2323/2760] block: mark blk_remove_bs() as GRAPH_UNLOCKED

The function blk_remove_bs() calls bdrv_graph_wrlock_drained() and can
also call bdrv_drained_begin(), both of which which must be called with
the graph unlocked.

Marking blk_remove_bs() as GRAPH_UNLOCKED requires temporarily
unlocking in hmp_drive_del().

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Message-ID: <20250530151125.955508-38-f.ebner@proxmox.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/monitor/block-hmp-cmds.c              | 15 ++++++++++-----
 include/system/block-backend-global-state.h |  2 +-
 2 files changed, 11 insertions(+), 6 deletions(-)

diff --git a/block/monitor/block-hmp-cmds.c b/block/monitor/block-hmp-cmds.c
index 6919a49bf5..282d1c386e 100644
--- a/block/monitor/block-hmp-cmds.c
+++ b/block/monitor/block-hmp-cmds.c
@@ -144,7 +144,7 @@ void hmp_drive_del(Monitor *mon, const QDict *qdict)
     Error *local_err = NULL;
 
     GLOBAL_STATE_CODE();
-    GRAPH_RDLOCK_GUARD_MAINLOOP();
+    bdrv_graph_rdlock_main_loop();
 
     bs = bdrv_find_node(id);
     if (bs) {
@@ -152,29 +152,31 @@ void hmp_drive_del(Monitor *mon, const QDict *qdict)
         if (local_err) {
             error_report_err(local_err);
         }
-        return;
+        goto unlock;
     }
 
     blk = blk_by_name(id);
     if (!blk) {
         error_report("Device '%s' not found", id);
-        return;
+        goto unlock;
     }
 
     if (!blk_legacy_dinfo(blk)) {
         error_report("Deleting device added with blockdev-add"
                      " is not supported");
-        return;
+        goto unlock;
     }
 
     bs = blk_bs(blk);
     if (bs) {
         if (bdrv_op_is_blocked(bs, BLOCK_OP_TYPE_DRIVE_DEL, &local_err)) {
             error_report_err(local_err);
-            return;
+            goto unlock;
         }
 
+        bdrv_graph_rdunlock_main_loop();
         blk_remove_bs(blk);
+        bdrv_graph_rdlock_main_loop();
     }
 
     /* Make the BlockBackend and the attached BlockDriverState anonymous */
@@ -191,6 +193,9 @@ void hmp_drive_del(Monitor *mon, const QDict *qdict)
     } else {
         blk_unref(blk);
     }
+
+unlock:
+    bdrv_graph_rdunlock_main_loop();
 }
 
 void hmp_commit(Monitor *mon, const QDict *qdict)
diff --git a/include/system/block-backend-global-state.h b/include/system/block-backend-global-state.h
index a62dbdf0dc..1a134083b7 100644
--- a/include/system/block-backend-global-state.h
+++ b/include/system/block-backend-global-state.h
@@ -55,7 +55,7 @@ void monitor_remove_blk(BlockBackend *blk);
 
 BlockBackendPublic *blk_get_public(BlockBackend *blk);
 
-void blk_remove_bs(BlockBackend *blk);
+void GRAPH_UNLOCKED blk_remove_bs(BlockBackend *blk);
 int blk_insert_bs(BlockBackend *blk, BlockDriverState *bs, Error **errp);
 int blk_replace_bs(BlockBackend *blk, BlockDriverState *new_bs, Error **errp);
 bool GRAPH_RDLOCK bdrv_has_blk(BlockDriverState *bs);

From f3e84330f730b2f734d9fec6762d9f4ff570468d Mon Sep 17 00:00:00 2001
From: Fiona Ebner <f.ebner@proxmox.com>
Date: Fri, 30 May 2025 17:11:15 +0200
Subject: [PATCH 2324/2760] block: mark blk_drain() as GRAPH_UNLOCKED

The function blk_drain() calls bdrv_drained_begin(), which must be
called with the graph unlocked.

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Message-ID: <20250530151125.955508-39-f.ebner@proxmox.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 include/system/block-backend-global-state.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/system/block-backend-global-state.h b/include/system/block-backend-global-state.h
index 1a134083b7..f6ec1174e6 100644
--- a/include/system/block-backend-global-state.h
+++ b/include/system/block-backend-global-state.h
@@ -78,7 +78,7 @@ int blk_make_zero(BlockBackend *blk, BdrvRequestFlags flags);
 void blk_aio_cancel(BlockAIOCB *acb);
 int blk_commit_all(void);
 bool blk_in_drain(BlockBackend *blk);
-void blk_drain(BlockBackend *blk);
+void GRAPH_UNLOCKED blk_drain(BlockBackend *blk);
 void GRAPH_UNLOCKED blk_drain_all(void);
 void blk_set_on_error(BlockBackend *blk, BlockdevOnError on_read_error,
                       BlockdevOnError on_write_error);

From 7bb9bd52ec2b058acc1957a92ea505d8a4e12077 Mon Sep 17 00:00:00 2001
From: Fiona Ebner <f.ebner@proxmox.com>
Date: Fri, 30 May 2025 17:11:16 +0200
Subject: [PATCH 2325/2760] block-backend: mark blk_io_limits_disable() as
 GRAPH_UNLOCKED

The function blk_io_limits_disable() calls bdrv_drained_begin(), which
must be called with the graph unlocked.

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Message-ID: <20250530151125.955508-40-f.ebner@proxmox.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 include/system/block-backend-global-state.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/system/block-backend-global-state.h b/include/system/block-backend-global-state.h
index f6ec1174e6..c3849640df 100644
--- a/include/system/block-backend-global-state.h
+++ b/include/system/block-backend-global-state.h
@@ -109,7 +109,7 @@ int blk_probe_blocksizes(BlockBackend *blk, BlockSizes *bsz);
 int blk_probe_geometry(BlockBackend *blk, HDGeometry *geo);
 
 void blk_set_io_limits(BlockBackend *blk, ThrottleConfig *cfg);
-void blk_io_limits_disable(BlockBackend *blk);
+void GRAPH_UNLOCKED blk_io_limits_disable(BlockBackend *blk);
 void blk_io_limits_enable(BlockBackend *blk, const char *group);
 void blk_io_limits_update_group(BlockBackend *blk, const char *group);
 void blk_set_force_allow_inactivate(BlockBackend *blk);

From 60f609c1526102df35d8de8f513a80e6d3528bd8 Mon Sep 17 00:00:00 2001
From: Fiona Ebner <f.ebner@proxmox.com>
Date: Fri, 30 May 2025 17:11:17 +0200
Subject: [PATCH 2326/2760] block/commit: mark commit_abort() as GRAPH_UNLOCKED

The function commit_abort() calls bdrv_drained_begin(), which must be
called with the graph unlocked.

Also mark the JobDriver's abort() callback as GRAPH_UNLOCKED_PTR,
because that is the callback via which commit_abort() is reached.

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Message-ID: <20250530151125.955508-41-f.ebner@proxmox.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/commit.c     | 2 +-
 include/qemu/job.h | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/block/commit.c b/block/commit.c
index 7496cf732e..0d9e1a16d7 100644
--- a/block/commit.c
+++ b/block/commit.c
@@ -68,7 +68,7 @@ static int commit_prepare(Job *job)
                                   s->backing_mask_protocol);
 }
 
-static void commit_abort(Job *job)
+static void GRAPH_UNLOCKED commit_abort(Job *job)
 {
     CommitBlockJob *s = container_of(job, CommitBlockJob, common.job);
     BlockDriverState *top_bs = blk_bs(s->top);
diff --git a/include/qemu/job.h b/include/qemu/job.h
index bb8ee766ef..ead31578d3 100644
--- a/include/qemu/job.h
+++ b/include/qemu/job.h
@@ -283,7 +283,7 @@ struct JobDriver {
      * All jobs will complete with a call to either .commit() or .abort() but
      * never both.
      */
-    void (*abort)(Job *job);
+    void GRAPH_UNLOCKED_PTR (*abort)(Job *job);
 
     /**
      * If the callback is not NULL, it will be invoked after a call to either

From 975d9ff32e37f67e82d0da546cfb567bdee9c6fb Mon Sep 17 00:00:00 2001
From: Kevin Wolf <kwolf@redhat.com>
Date: Mon, 14 Jul 2025 15:01:53 +0200
Subject: [PATCH 2327/2760] block: Allow bdrv_new() with and without graph lock

bdrv_new() calls bdrv_drained_begin(), which can poll and therefore
can't be called while holding the graph lock. One option to make sure
that this call is allowed would be marking bdrv_new() GRAPH_UNLOCKED.

However, this is actually an unnecessary restriction because we know
that we only just created the BlockDriverState and it isn't even part of
the graph yet. We can use bdrv_do_drained_begin_quiesce() instead to
avoid the polling, which means that bdrv_new() can now safely be called
from callers that hold the graph lock as well as from callers that
don't.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/block.c b/block.c
index 932e599f45..fe5aa2e767 100644
--- a/block.c
+++ b/block.c
@@ -431,7 +431,7 @@ BlockDriverState *bdrv_new(void)
     bs->block_status_cache = g_new0(BdrvBlockStatusCache, 1);
 
     for (i = 0; i < bdrv_drain_all_count; i++) {
-        bdrv_drained_begin(bs);
+        bdrv_do_drained_begin_quiesce(bs, NULL);
     }
 
     QTAILQ_INSERT_TAIL(&all_bdrv_states, bs, bs_list);

From 5d048233474b57b8b4321f06a45df97461473589 Mon Sep 17 00:00:00 2001
From: Fiona Ebner <f.ebner@proxmox.com>
Date: Fri, 30 May 2025 17:11:19 +0200
Subject: [PATCH 2328/2760] block: mark bdrv_replace_child_bs() as
 GRAPH_UNLOCKED

The function bdrv_replace_child_bs() calls bdrv_drained_begin() which
must be called with the graph unlocked.

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Message-ID: <20250530151125.955508-43-f.ebner@proxmox.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 include/block/block-global-state.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/block/block-global-state.h b/include/block/block-global-state.h
index eec92a98da..706a2cde36 100644
--- a/include/block/block-global-state.h
+++ b/include/block/block-global-state.h
@@ -74,8 +74,8 @@ int bdrv_append(BlockDriverState *bs_new, BlockDriverState *bs_top,
 int GRAPH_WRLOCK
 bdrv_replace_node(BlockDriverState *from, BlockDriverState *to, Error **errp);
 
-int bdrv_replace_child_bs(BdrvChild *child, BlockDriverState *new_bs,
-                          Error **errp);
+int GRAPH_UNLOCKED
+bdrv_replace_child_bs(BdrvChild *child, BlockDriverState *new_bs, Error **errp);
 BlockDriverState *bdrv_insert_node(BlockDriverState *bs, QDict *node_options,
                                    int flags, Error **errp);
 int bdrv_drop_filter(BlockDriverState *bs, Error **errp);

From 04f4d9c555d194526126235d752c092017818d6b Mon Sep 17 00:00:00 2001
From: Fiona Ebner <f.ebner@proxmox.com>
Date: Fri, 30 May 2025 17:11:20 +0200
Subject: [PATCH 2329/2760] block: mark bdrv_insert_node() as GRAPH_UNLOCKED

The function bdrv_insert_node() calls bdrv_drained_begin() which must
be called with the graph unlocked.

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Message-ID: <20250530151125.955508-44-f.ebner@proxmox.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 include/block/block-global-state.h | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/include/block/block-global-state.h b/include/block/block-global-state.h
index 706a2cde36..cb4d8bca22 100644
--- a/include/block/block-global-state.h
+++ b/include/block/block-global-state.h
@@ -76,8 +76,9 @@ bdrv_replace_node(BlockDriverState *from, BlockDriverState *to, Error **errp);
 
 int GRAPH_UNLOCKED
 bdrv_replace_child_bs(BdrvChild *child, BlockDriverState *new_bs, Error **errp);
-BlockDriverState *bdrv_insert_node(BlockDriverState *bs, QDict *node_options,
-                                   int flags, Error **errp);
+BlockDriverState * GRAPH_UNLOCKED
+bdrv_insert_node(BlockDriverState *bs, QDict *node_options, int flags,
+                 Error **errp);
 int bdrv_drop_filter(BlockDriverState *bs, Error **errp);
 
 BdrvChild * no_coroutine_fn

From 94371745d763755efde8442c40a2cd02571f2b5e Mon Sep 17 00:00:00 2001
From: Fiona Ebner <f.ebner@proxmox.com>
Date: Fri, 30 May 2025 17:11:21 +0200
Subject: [PATCH 2330/2760] block: mark bdrv_drop_intermediate() as
 GRAPH_UNLOCKED

The function bdrv_drop_intermediate() calls bdrv_drained_begin(),
which must be called with the graph unlocked.

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Message-ID: <20250530151125.955508-45-f.ebner@proxmox.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 include/block/block-global-state.h | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/include/block/block-global-state.h b/include/block/block-global-state.h
index cb4d8bca22..d3dd951013 100644
--- a/include/block/block-global-state.h
+++ b/include/block/block-global-state.h
@@ -143,9 +143,10 @@ int bdrv_commit(BlockDriverState *bs);
 int GRAPH_RDLOCK bdrv_make_empty(BdrvChild *c, Error **errp);
 
 void bdrv_register(BlockDriver *bdrv);
-int bdrv_drop_intermediate(BlockDriverState *top, BlockDriverState *base,
-                           const char *backing_file_str,
-                           bool backing_mask_protocol);
+int GRAPH_UNLOCKED
+bdrv_drop_intermediate(BlockDriverState *top, BlockDriverState *base,
+                       const char *backing_file_str,
+                       bool backing_mask_protocol);
 
 BlockDriverState * GRAPH_RDLOCK
 bdrv_find_overlay(BlockDriverState *active, BlockDriverState *bs);

From 6d7e3f8de09d92f9ebea530be3696ed053ae8508 Mon Sep 17 00:00:00 2001
From: Fiona Ebner <f.ebner@proxmox.com>
Date: Fri, 30 May 2025 17:11:22 +0200
Subject: [PATCH 2331/2760] block: mark bdrv_close_all() as GRAPH_UNLOCKED

The function bdrv_close_all() calls bdrv_drain_all(), which must be
called with the graph unlocked.

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Message-ID: <20250530151125.955508-46-f.ebner@proxmox.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 include/block/block-global-state.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/block/block-global-state.h b/include/block/block-global-state.h
index d3dd951013..e7c9acd2ba 100644
--- a/include/block/block-global-state.h
+++ b/include/block/block-global-state.h
@@ -192,7 +192,7 @@ void bdrv_activate_all(Error **errp);
 int GRAPH_UNLOCKED bdrv_inactivate_all(void);
 
 int bdrv_flush_all(void);
-void bdrv_close_all(void);
+void GRAPH_UNLOCKED bdrv_close_all(void);
 void GRAPH_UNLOCKED bdrv_drain_all_begin(void);
 void bdrv_drain_all_begin_nopoll(void);
 void bdrv_drain_all_end(void);

From ede0859311e46ca8654eaf11456e19868ac06c66 Mon Sep 17 00:00:00 2001
From: Fiona Ebner <f.ebner@proxmox.com>
Date: Fri, 30 May 2025 17:11:23 +0200
Subject: [PATCH 2332/2760] block: mark bdrv_close() as GRAPH_UNLOCKED

The functions blk_log_writes_close(), blkverify_close(),
quorum_close(), vmdk_close() via vmdk_free_extents(), and other
bdrv_close() implementations call bdrv_graph_wrlock_drained(), which
must be called with the graph unlocked. They are reached via the
BlockDriver's bdrv_close() callback and the bdrv_close() wrapper,
which are also marked as GRAPH_UNLOCKED_PTR and GRAPH_UNLOCKED.

Furthermore, the function bdrv_close() also calls bdrv_drained_begin()
and bdrv_graph_wrlock_drained(), so there are additional reasons for
marking it GRAPH_UNLOCKED.

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Message-ID: <20250530151125.955508-47-f.ebner@proxmox.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block.c                          | 2 +-
 include/block/block_int-common.h | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/block.c b/block.c
index fe5aa2e767..8d3dd5a8e3 100644
--- a/block.c
+++ b/block.c
@@ -5146,7 +5146,7 @@ static void GRAPH_UNLOCKED bdrv_reopen_abort(BDRVReopenState *reopen_state)
 }
 
 
-static void bdrv_close(BlockDriverState *bs)
+static void GRAPH_UNLOCKED bdrv_close(BlockDriverState *bs)
 {
     BdrvAioNotifier *ban, *ban_next;
     BdrvChild *child, *next;
diff --git a/include/block/block_int-common.h b/include/block/block_int-common.h
index e96c6a6a03..034c0634c8 100644
--- a/include/block/block_int-common.h
+++ b/include/block/block_int-common.h
@@ -248,7 +248,7 @@ struct BlockDriver {
     int GRAPH_UNLOCKED_PTR (*bdrv_open)(
         BlockDriverState *bs, QDict *options, int flags, Error **errp);
 
-    void (*bdrv_close)(BlockDriverState *bs);
+    void GRAPH_UNLOCKED_PTR (*bdrv_close)(BlockDriverState *bs);
 
     int coroutine_fn GRAPH_UNLOCKED_PTR (*bdrv_co_create)(
         BlockdevCreateOptions *opts, Error **errp);

From 2cf92b15cda38a34cd2508e5f51323e601a588d3 Mon Sep 17 00:00:00 2001
From: Fiona Ebner <f.ebner@proxmox.com>
Date: Fri, 30 May 2025 17:11:24 +0200
Subject: [PATCH 2333/2760] block: mark bdrv_open_child_common() and its
 callers GRAPH_UNLOCKED

The function bdrv_open_child_common() calls
bdrv_graph_wrlock_drained(), which must be called with the graph
unlocked. Mark it and its two callers bdrv_open_file_child() and
bdrv_open_child() as GRAPH_UNLOCKED. This requires temporarily
unlocking in vmdk_parse_extents() and making the locked section
shorter in vmdk_open().

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Message-ID: <20250530151125.955508-48-f.ebner@proxmox.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block.c                            | 13 ++++++-------
 block/vmdk.c                       |  6 ++++--
 include/block/block-global-state.h |  9 +++++----
 3 files changed, 15 insertions(+), 13 deletions(-)

diff --git a/block.c b/block.c
index 8d3dd5a8e3..8848e9a7ed 100644
--- a/block.c
+++ b/block.c
@@ -3766,13 +3766,12 @@ done:
     return bs;
 }
 
-static BdrvChild *bdrv_open_child_common(const char *filename,
-                                         QDict *options, const char *bdref_key,
-                                         BlockDriverState *parent,
-                                         const BdrvChildClass *child_class,
-                                         BdrvChildRole child_role,
-                                         bool allow_none, bool parse_filename,
-                                         Error **errp)
+static BdrvChild * GRAPH_UNLOCKED
+bdrv_open_child_common(const char *filename, QDict *options,
+                       const char *bdref_key, BlockDriverState *parent,
+                       const BdrvChildClass *child_class,
+                       BdrvChildRole child_role, bool allow_none,
+                       bool parse_filename, Error **errp)
 {
     BlockDriverState *bs;
     BdrvChild *child;
diff --git a/block/vmdk.c b/block/vmdk.c
index 04986c8d55..7b98debc2b 100644
--- a/block/vmdk.c
+++ b/block/vmdk.c
@@ -1229,9 +1229,11 @@ vmdk_parse_extents(const char *desc, BlockDriverState *bs, QDict *options,
             extent_role |= BDRV_CHILD_METADATA;
         }
 
+        bdrv_graph_rdunlock_main_loop();
         extent_file = bdrv_open_child(extent_path, options, extent_opt_prefix,
                                       bs, &child_of_bds, extent_role, false,
                                       &local_err);
+        bdrv_graph_rdlock_main_loop();
         g_free(extent_path);
         if (!extent_file) {
             error_propagate(errp, local_err);
@@ -1352,13 +1354,13 @@ static int vmdk_open(BlockDriverState *bs, QDict *options, int flags,
     BDRVVmdkState *s = bs->opaque;
     uint32_t magic;
 
-    GRAPH_RDLOCK_GUARD_MAINLOOP();
-
     ret = bdrv_open_file_child(NULL, options, "file", bs, errp);
     if (ret < 0) {
         return ret;
     }
 
+    GRAPH_RDLOCK_GUARD_MAINLOOP();
+
     buf = vmdk_read_desc(bs->file, 0, errp);
     if (!buf) {
         return -EINVAL;
diff --git a/include/block/block-global-state.h b/include/block/block-global-state.h
index e7c9acd2ba..62da83c616 100644
--- a/include/block/block-global-state.h
+++ b/include/block/block-global-state.h
@@ -81,7 +81,7 @@ bdrv_insert_node(BlockDriverState *bs, QDict *node_options, int flags,
                  Error **errp);
 int bdrv_drop_filter(BlockDriverState *bs, Error **errp);
 
-BdrvChild * no_coroutine_fn
+BdrvChild * no_coroutine_fn GRAPH_UNLOCKED
 bdrv_open_child(const char *filename, QDict *options, const char *bdref_key,
                 BlockDriverState *parent, const BdrvChildClass *child_class,
                 BdrvChildRole child_role, bool allow_none, Error **errp);
@@ -91,9 +91,10 @@ bdrv_co_open_child(const char *filename, QDict *options, const char *bdref_key,
                 BlockDriverState *parent, const BdrvChildClass *child_class,
                 BdrvChildRole child_role, bool allow_none, Error **errp);
 
-int bdrv_open_file_child(const char *filename,
-                         QDict *options, const char *bdref_key,
-                         BlockDriverState *parent, Error **errp);
+int GRAPH_UNLOCKED
+bdrv_open_file_child(const char *filename, QDict *options,
+                     const char *bdref_key, BlockDriverState *parent,
+                     Error **errp);
 
 BlockDriverState * no_coroutine_fn
 bdrv_open_blockdev_ref(BlockdevRef *ref, Error **errp);

From a256a427b026f26be33ce2ace7158f5ab0931fa8 Mon Sep 17 00:00:00 2001
From: Fiona Ebner <f.ebner@proxmox.com>
Date: Fri, 30 May 2025 17:11:25 +0200
Subject: [PATCH 2334/2760] blockjob: mark block_job_remove_all_bdrv() as
 GRAPH_UNLOCKED

The function block_job_remove_all_bdrv() calls
bdrv_graph_wrlock_drained(), which must be called with the graph
unlocked.

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Message-ID: <20250530151125.955508-49-f.ebner@proxmox.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 include/block/blockjob.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/block/blockjob.h b/include/block/blockjob.h
index 990f3e179a..85284cb25e 100644
--- a/include/block/blockjob.h
+++ b/include/block/blockjob.h
@@ -151,7 +151,7 @@ block_job_add_bdrv(BlockJob *job, const char *name, BlockDriverState *bs,
  * Remove all BlockDriverStates from the list of nodes that are involved in the
  * job. This removes the blockers added with block_job_add_bdrv().
  */
-void block_job_remove_all_bdrv(BlockJob *job);
+void GRAPH_UNLOCKED block_job_remove_all_bdrv(BlockJob *job);
 
 /**
  * block_job_has_bdrv:

From cfac5a963e4bf287a194b5df80b7984bc8e41221 Mon Sep 17 00:00:00 2001
From: Fiona Ebner <f.ebner@proxmox.com>
Date: Wed, 2 Jul 2025 14:31:27 +0200
Subject: [PATCH 2335/2760] block/qapi: include child references in block
 device info

In combination with using a throttle filter to enforce IO limits for
a guest device, knowing the 'file' child of a block device can be
useful. If the throttle filter is only intended for guest IO, block
jobs should not also be limited by the throttle filter, so the
block operations need to be done with the 'file' child of the top
throttle node as the target. In combination with mirroring, the name
of that child is not fixed.

Another scenario is when unplugging a guest device after mirroring
below a top throttle node, where the mirror target is added explicitly
via blockdev-add. After mirroring, the target becomes the new 'file'
child of the throttle node. For unplugging, both the top throttle node
and the mirror target need to be deleted, because only implicitly
added child nodes are deleted automatically, and the current 'file'
child of the throttle node was explicitly added (as the mirror
target).

In other scenarios, it could be useful to follow the backing chain.

Note that iotests 191 and 273 use _filter_img_info, so the 'children'
information is filtered out there.

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Message-ID: <20250702123204.325470-2-f.ebner@proxmox.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/qapi.c               | 10 ++++++++++
 qapi/block-core.json       | 16 ++++++++++++++++
 tests/qemu-iotests/184.out |  8 ++++++++
 3 files changed, 34 insertions(+)

diff --git a/block/qapi.c b/block/qapi.c
index 2c50a6bf3b..e08a1e970f 100644
--- a/block/qapi.c
+++ b/block/qapi.c
@@ -51,6 +51,8 @@ BlockDeviceInfo *bdrv_block_device_info(BlockBackend *blk,
     ImageInfo *backing_info;
     BlockDriverState *backing;
     BlockDeviceInfo *info;
+    BlockdevChildList **children_list_tail;
+    BdrvChild *child;
 
     if (!bs->drv) {
         error_setg(errp, "Block device %s is ejected", bs->node_name);
@@ -77,6 +79,14 @@ BlockDeviceInfo *bdrv_block_device_info(BlockBackend *blk,
         info->node_name = g_strdup(bs->node_name);
     }
 
+    children_list_tail = &info->children;
+    QLIST_FOREACH(child, &bs->children, next) {
+        BlockdevChild *child_ref = g_new0(BlockdevChild, 1);
+        child_ref->child = g_strdup(child->name);
+        child_ref->node_name = g_strdup(child->bs->node_name);
+        QAPI_LIST_APPEND(children_list_tail, child_ref);
+    }
+
     backing = bdrv_cow_bs(bs);
     if (backing) {
         info->backing_file = g_strdup(backing->filename);
diff --git a/qapi/block-core.json b/qapi/block-core.json
index 1df6644f0d..3e720af5ad 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
@@ -461,6 +461,19 @@
             'direct': 'bool',
             'no-flush': 'bool' } }
 
+##
+# @BlockdevChild:
+#
+# @child: The name of the child, for example 'file' or 'backing'.
+#
+# @node-name: The name of the child's block driver node.
+#
+# Since: 10.1
+##
+{ 'struct': 'BlockdevChild',
+  'data': { 'child': 'str',
+            'node-name': 'str' } }
+
 ##
 # @BlockDeviceInfo:
 #
@@ -486,6 +499,8 @@
 # @backing_file_depth: number of files in the backing file chain
 #     (since: 1.2)
 #
+# @children: Information about child block nodes. (since: 10.1)
+#
 # @active: true if the backend is active; typical cases for inactive backends
 #     are on the migration source instance after migration completes and on the
 #     destination before it completes.  (since: 10.0)
@@ -560,6 +575,7 @@
 { 'struct': 'BlockDeviceInfo',
   'data': { 'file': 'str', '*node-name': 'str', 'ro': 'bool', 'drv': 'str',
             '*backing_file': 'str', 'backing_file_depth': 'int',
+            'children': ['BlockdevChild'],
             'active': 'bool', 'encrypted': 'bool',
             'detect_zeroes': 'BlockdevDetectZeroesOptions',
             'bps': 'int', 'bps_rd': 'int', 'bps_wr': 'int',
diff --git a/tests/qemu-iotests/184.out b/tests/qemu-iotests/184.out
index 52692b6b3b..ef99bb2e9a 100644
--- a/tests/qemu-iotests/184.out
+++ b/tests/qemu-iotests/184.out
@@ -41,6 +41,12 @@ Testing:
             },
             "iops_wr": 0,
             "ro": false,
+            "children": [
+                {
+                    "node-name": "disk0",
+                    "child": "file"
+                }
+            ],
             "node-name": "throttle0",
             "backing_file_depth": 1,
             "drv": "throttle",
@@ -69,6 +75,8 @@ Testing:
             },
             "iops_wr": 0,
             "ro": false,
+            "children": [
+            ],
             "node-name": "disk0",
             "backing_file_depth": 0,
             "drv": "null-co",

From 430e2be81e0970ee06c1c956f7698262b2ec514f Mon Sep 17 00:00:00 2001
From: Fiona Ebner <f.ebner@proxmox.com>
Date: Wed, 2 Jul 2025 14:31:28 +0200
Subject: [PATCH 2336/2760] block/qapi: make @node-name in @BlockDeviceInfo
 non-optional

Since commit 15489c769b ("block: auto-generated node-names"), if the
node name of a block driver state is not explicitly specified, it
will be auto-generated.

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Message-ID: <20250702123204.325470-3-f.ebner@proxmox.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/qapi.c         | 4 +---
 qapi/block-core.json | 2 +-
 2 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/block/qapi.c b/block/qapi.c
index e08a1e970f..12fbf8d1b7 100644
--- a/block/qapi.c
+++ b/block/qapi.c
@@ -75,9 +75,7 @@ BlockDeviceInfo *bdrv_block_device_info(BlockBackend *blk,
         .no_flush       = !!(bs->open_flags & BDRV_O_NO_FLUSH),
     };
 
-    if (bs->node_name[0]) {
-        info->node_name = g_strdup(bs->node_name);
-    }
+    info->node_name = g_strdup(bs->node_name);
 
     children_list_tail = &info->children;
     QLIST_FOREACH(child, &bs->children, next) {
diff --git a/qapi/block-core.json b/qapi/block-core.json
index 3e720af5ad..9d36927fc1 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
@@ -573,7 +573,7 @@
 # Since: 0.14
 ##
 { 'struct': 'BlockDeviceInfo',
-  'data': { 'file': 'str', '*node-name': 'str', 'ro': 'bool', 'drv': 'str',
+  'data': { 'file': 'str', 'node-name': 'str', 'ro': 'bool', 'drv': 'str',
             '*backing_file': 'str', 'backing_file_depth': 'int',
             'children': ['BlockdevChild'],
             'active': 'bool', 'encrypted': 'bool',

From d402da1360c2240e81f0e5fc80ddbfc6238e0da8 Mon Sep 17 00:00:00 2001
From: Kevin Wolf <kwolf@redhat.com>
Date: Wed, 25 Jun 2025 10:50:19 +0200
Subject: [PATCH 2337/2760] file-posix: Fix aio=threads performance regression
 after enablign FUA

For aio=threads, we're currently not implementing REQ_FUA in any useful
way, but just do a separate raw_co_flush_to_disk() call. This changes
behaviour compared to the old state, which used bdrv_co_flush() with its
optimisations. As a quick fix, call bdrv_co_flush() again like before.
Eventually, we can use pwritev2() to make use of RWF_DSYNC if available,
but we'll still have to keep this code path as a fallback, so this fix
is required either way.

While the fix itself is a one-liner, some new graph locking annotations
are needed to convince TSA that the locking is correct.

Cc: qemu-stable@nongnu.org
Fixes: 984a32f17e8d ("file-posix: Support FUA writes")
Buglink: https://issues.redhat.com/browse/RHEL-96854
Reported-by: Tingting Mao <timao@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20250625085019.27735-1-kwolf@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/file-posix.c | 29 +++++++++++++++--------------
 1 file changed, 15 insertions(+), 14 deletions(-)

diff --git a/block/file-posix.c b/block/file-posix.c
index 9b5f08ccb2..8c738674ce 100644
--- a/block/file-posix.c
+++ b/block/file-posix.c
@@ -2564,9 +2564,9 @@ static inline bool raw_check_linux_aio(BDRVRawState *s)
 }
 #endif
 
-static int coroutine_fn raw_co_prw(BlockDriverState *bs, int64_t *offset_ptr,
-                                   uint64_t bytes, QEMUIOVector *qiov, int type,
-                                   int flags)
+static int coroutine_fn GRAPH_RDLOCK
+raw_co_prw(BlockDriverState *bs, int64_t *offset_ptr, uint64_t bytes,
+           QEMUIOVector *qiov, int type, int flags)
 {
     BDRVRawState *s = bs->opaque;
     RawPosixAIOData acb;
@@ -2625,7 +2625,7 @@ static int coroutine_fn raw_co_prw(BlockDriverState *bs, int64_t *offset_ptr,
     ret = raw_thread_pool_submit(handle_aiocb_rw, &acb);
     if (ret == 0 && (flags & BDRV_REQ_FUA)) {
         /* TODO Use pwritev2() instead if it's available */
-        ret = raw_co_flush_to_disk(bs);
+        ret = bdrv_co_flush(bs);
     }
     goto out; /* Avoid the compiler err of unused label */
 
@@ -2660,16 +2660,16 @@ out:
     return ret;
 }
 
-static int coroutine_fn raw_co_preadv(BlockDriverState *bs, int64_t offset,
-                                      int64_t bytes, QEMUIOVector *qiov,
-                                      BdrvRequestFlags flags)
+static int coroutine_fn GRAPH_RDLOCK
+raw_co_preadv(BlockDriverState *bs, int64_t offset, int64_t bytes,
+              QEMUIOVector *qiov, BdrvRequestFlags flags)
 {
     return raw_co_prw(bs, &offset, bytes, qiov, QEMU_AIO_READ, flags);
 }
 
-static int coroutine_fn raw_co_pwritev(BlockDriverState *bs, int64_t offset,
-                                       int64_t bytes, QEMUIOVector *qiov,
-                                       BdrvRequestFlags flags)
+static int coroutine_fn GRAPH_RDLOCK
+raw_co_pwritev(BlockDriverState *bs, int64_t offset, int64_t bytes,
+               QEMUIOVector *qiov, BdrvRequestFlags flags)
 {
     return raw_co_prw(bs, &offset, bytes, qiov, QEMU_AIO_WRITE, flags);
 }
@@ -3606,10 +3606,11 @@ static int coroutine_fn raw_co_zone_mgmt(BlockDriverState *bs, BlockZoneOp op,
 #endif
 
 #if defined(CONFIG_BLKZONED)
-static int coroutine_fn raw_co_zone_append(BlockDriverState *bs,
-                                           int64_t *offset,
-                                           QEMUIOVector *qiov,
-                                           BdrvRequestFlags flags) {
+static int coroutine_fn GRAPH_RDLOCK
+raw_co_zone_append(BlockDriverState *bs,
+                   int64_t *offset,
+                   QEMUIOVector *qiov,
+                   BdrvRequestFlags flags) {
     assert(flags == 0);
     int64_t zone_size_mask = bs->bl.zone_size - 1;
     int64_t iov_len = 0;

From 9253773cb7ff10d85ccaf4d5f418ea5c7fa31834 Mon Sep 17 00:00:00 2001
From: Yongbok Kim <yongbok.kim@mips.com>
Date: Mon, 29 Jul 2019 19:23:33 +0200
Subject: [PATCH 2338/2760] target/mips: Add support for emulation of CRC32
 instructions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add emulation of MIPS' CRC32 (Cyclic Redundancy Check) instructions.
Reuse zlib crc32() and Linux crc32c().

Corresponding disassembly has been added in commit 99029be1c28
("target/mips: Add implementation of GINVT instruction").

Signed-off-by: Yongbok Kim <yongbok.kim@mips.com>
Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
Signed-off-by: Aleksandar Rakic <aleksandar.rakic@htecgroup.com>
Reviewed-by: Aleksandar Rikalo <arikalo@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <PA4PR09MB486489692D843DDFC25F3CF1846B2@PA4PR09MB4864.eurprd09.prod.outlook.com>
---
 target/mips/cpu-defs.c.inc       | 10 ++++++----
 target/mips/helper.h             |  2 ++
 target/mips/meson.build          |  1 +
 target/mips/tcg/op_helper.c      | 26 ++++++++++++++++++++++++++
 target/mips/tcg/rel6.decode      |  5 +++++
 target/mips/tcg/rel6_translate.c | 12 ++++++++++++
 target/mips/tcg/translate.c      | 24 ++++++++++++++++++++++++
 target/mips/tcg/translate.h      |  2 ++
 8 files changed, 78 insertions(+), 4 deletions(-)

diff --git a/target/mips/cpu-defs.c.inc b/target/mips/cpu-defs.c.inc
index 922fc39138..d93b9d341a 100644
--- a/target/mips/cpu-defs.c.inc
+++ b/target/mips/cpu-defs.c.inc
@@ -756,8 +756,9 @@ const mips_def_t mips_defs[] =
                        (1 << CP0C3_RXI) | (1 << CP0C3_LPA) | (1 << CP0C3_VInt),
         .CP0_Config4 = MIPS_CONFIG4 | (1U << CP0C4_M) | (3 << CP0C4_IE) |
                        (1 << CP0C4_AE) | (0xfc << CP0C4_KScrExist),
-        .CP0_Config5 = MIPS_CONFIG5 | (1 << CP0C5_XNP) | (1 << CP0C5_VP) |
-                       (1 << CP0C5_LLB) | (1 << CP0C5_MRP) | (3 << CP0C5_GI),
+        .CP0_Config5 = MIPS_CONFIG5 | (1 << CP0C5_CRCP) | (1 << CP0C5_XNP) |
+                       (1 << CP0C5_VP) | (1 << CP0C5_LLB) | (1 << CP0C5_MRP) |
+                       (3 << CP0C5_GI),
         .CP0_Config5_rw_bitmask = (1 << CP0C5_MSAEn) | (1 << CP0C5_SBRI) |
                                   (1 << CP0C5_FRE) | (1 << CP0C5_UFE),
         .CP0_LLAddr_rw_bitmask = 0,
@@ -796,8 +797,9 @@ const mips_def_t mips_defs[] =
                        (1 << CP0C3_RXI) | (1 << CP0C3_LPA) | (1 << CP0C3_VInt),
         .CP0_Config4 = MIPS_CONFIG4 | (1U << CP0C4_M) | (3 << CP0C4_IE) |
                        (1 << CP0C4_AE) | (0xfc << CP0C4_KScrExist),
-        .CP0_Config5 = MIPS_CONFIG5 | (1 << CP0C5_XNP) | (1 << CP0C5_VP) |
-                       (1 << CP0C5_LLB) | (1 << CP0C5_MRP) | (3 << CP0C5_GI),
+        .CP0_Config5 = MIPS_CONFIG5 | (1 << CP0C5_CRCP) | (1 << CP0C5_XNP) |
+                       (1 << CP0C5_VP) | (1 << CP0C5_LLB) | (1 << CP0C5_MRP) |
+                       (3 << CP0C5_GI),
         .CP0_Config5_rw_bitmask = (1 << CP0C5_MSAEn) | (1 << CP0C5_SBRI) |
                                   (1 << CP0C5_FRE) | (1 << CP0C5_UFE),
         .CP0_LLAddr_rw_bitmask = 0,
diff --git a/target/mips/helper.h b/target/mips/helper.h
index 7e40041828..b6cd53c853 100644
--- a/target/mips/helper.h
+++ b/target/mips/helper.h
@@ -21,6 +21,8 @@ DEF_HELPER_FLAGS_1(bitswap, TCG_CALL_NO_RWG_SE, tl, tl)
 DEF_HELPER_FLAGS_1(dbitswap, TCG_CALL_NO_RWG_SE, tl, tl)
 #endif
 
+DEF_HELPER_3(crc32, tl, tl, tl, i32)
+DEF_HELPER_3(crc32c, tl, tl, tl, i32)
 DEF_HELPER_FLAGS_4(rotx, TCG_CALL_NO_RWG_SE, tl, tl, i32, i32, i32)
 
 /* microMIPS functions */
diff --git a/target/mips/meson.build b/target/mips/meson.build
index 247979a2cf..abf0ce3e8b 100644
--- a/target/mips/meson.build
+++ b/target/mips/meson.build
@@ -7,6 +7,7 @@ mips_ss.add(files(
   'gdbstub.c',
   'msa.c',
 ))
+mips_ss.add(zlib)
 
 if have_system
   subdir('system')
diff --git a/target/mips/tcg/op_helper.c b/target/mips/tcg/op_helper.c
index b906d10204..4502ae2b5b 100644
--- a/target/mips/tcg/op_helper.c
+++ b/target/mips/tcg/op_helper.c
@@ -24,6 +24,8 @@
 #include "exec/helper-proto.h"
 #include "exec/memop.h"
 #include "fpu_helper.h"
+#include "qemu/crc32c.h"
+#include <zlib.h>
 
 static inline target_ulong bitswap(target_ulong v)
 {
@@ -142,6 +144,30 @@ target_ulong helper_rotx(target_ulong rs, uint32_t shift, uint32_t shiftx,
     return (int64_t)(int32_t)(uint32_t)tmp5;
 }
 
+/* these crc32 functions are based on target/loongarch/tcg/op_helper.c */
+target_ulong helper_crc32(target_ulong val, target_ulong m, uint32_t sz)
+{
+    uint8_t buf[8];
+    target_ulong mask = ((sz * 8) == 64) ?
+                        (target_ulong) -1ULL :
+                        ((1ULL << (sz * 8)) - 1);
+
+    m &= mask;
+    stq_le_p(buf, m);
+    return (int32_t) (crc32(val ^ 0xffffffff, buf, sz) ^ 0xffffffff);
+}
+
+target_ulong helper_crc32c(target_ulong val, target_ulong m, uint32_t sz)
+{
+    uint8_t buf[8];
+    target_ulong mask = ((sz * 8) == 64) ?
+                        (target_ulong) -1ULL :
+                        ((1ULL << (sz * 8)) - 1);
+    m &= mask;
+    stq_le_p(buf, m);
+    return (int32_t) (crc32c(val, buf, sz) ^ 0xffffffff);
+}
+
 void helper_fork(target_ulong arg1, target_ulong arg2)
 {
     /*
diff --git a/target/mips/tcg/rel6.decode b/target/mips/tcg/rel6.decode
index d6989cf56e..7fbcb109b4 100644
--- a/target/mips/tcg/rel6.decode
+++ b/target/mips/tcg/rel6.decode
@@ -16,11 +16,16 @@
 
 &r                  rs rt rd sa
 
+&special3_crc       rs rt c sz
+
 @lsa                ...... rs:5 rt:5 rd:5 ... sa:2 ......   &r
+@crc32              ...... rs:5 rt:5 ..... c:3 sz:2 ......  &special3_crc
 
 LSA                 000000 ..... ..... ..... 000 .. 000101  @lsa
 DLSA                000000 ..... ..... ..... 000 .. 010101  @lsa
 
+CRC32               011111 ..... ..... 00000 ... .. 001111  @crc32
+
 REMOVED             010011 ----- ----- ----- ----- ------   # COP1X (COP3)
 
 REMOVED             011100 ----- ----- ----- ----- ------   # SPECIAL2
diff --git a/target/mips/tcg/rel6_translate.c b/target/mips/tcg/rel6_translate.c
index 59f237ba3b..8933506397 100644
--- a/target/mips/tcg/rel6_translate.c
+++ b/target/mips/tcg/rel6_translate.c
@@ -33,3 +33,15 @@ static bool trans_DLSA(DisasContext *ctx, arg_r *a)
     }
     return gen_dlsa(ctx, a->rd, a->rt, a->rs, a->sa);
 }
+
+static bool trans_CRC32(DisasContext *ctx, arg_special3_crc *a)
+{
+    if (unlikely(!ctx->crcp)
+        || unlikely((a->sz == 3) && (!(ctx->hflags & MIPS_HFLAG_64)))
+        || unlikely((a->c >= 2))) {
+        gen_reserved_instruction(ctx);
+        return true;
+    }
+    gen_crc32(ctx, a->rt, a->rs, a->rt, a->sz, a->c);
+    return true;
+}
diff --git a/target/mips/tcg/translate.c b/target/mips/tcg/translate.c
index 8658315f93..5c80b03032 100644
--- a/target/mips/tcg/translate.c
+++ b/target/mips/tcg/translate.c
@@ -13449,6 +13449,29 @@ static void decode_opc_special2_legacy(CPUMIPSState *env, DisasContext *ctx)
     }
 }
 
+void gen_crc32(DisasContext *ctx, int rd, int rs, int rt, int sz,
+               int crc32c)
+{
+    TCGv t0;
+    TCGv t1;
+    TCGv_i32 tsz = tcg_constant_i32(1 << sz);
+    if (rd == 0) {
+        /* Treat as NOP. */
+        return;
+    }
+    t0 = tcg_temp_new();
+    t1 = tcg_temp_new();
+
+    gen_load_gpr(t0, rt);
+    gen_load_gpr(t1, rs);
+
+    if (crc32c) {
+        gen_helper_crc32c(cpu_gpr[rd], t0, t1, tsz);
+    } else {
+        gen_helper_crc32(cpu_gpr[rd], t0, t1, tsz);
+    }
+}
+
 static void decode_opc_special3_r6(CPUMIPSState *env, DisasContext *ctx)
 {
     int rs, rt, rd, sa;
@@ -15095,6 +15118,7 @@ static void mips_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
     ctx->abs2008 = (env->active_fpu.fcr31 >> FCR31_ABS2008) & 1;
     ctx->mi = (env->CP0_Config5 >> CP0C5_MI) & 1;
     ctx->gi = (env->CP0_Config5 >> CP0C5_GI) & 3;
+    ctx->crcp = (env->CP0_Config5 >> CP0C5_CRCP) & 1;
     restore_cpu_state(env, ctx);
 #ifdef CONFIG_USER_ONLY
         ctx->mem_idx = MIPS_HFLAG_UM;
diff --git a/target/mips/tcg/translate.h b/target/mips/tcg/translate.h
index 1bf153d183..428b53a0da 100644
--- a/target/mips/tcg/translate.h
+++ b/target/mips/tcg/translate.h
@@ -51,6 +51,7 @@ typedef struct DisasContext {
     bool abs2008;
     bool mi;
     int gi;
+    bool crcp;
 } DisasContext;
 
 #define DISAS_STOP       DISAS_TARGET_0
@@ -181,6 +182,7 @@ bool gen_lsa(DisasContext *ctx, int rd, int rt, int rs, int sa);
 bool gen_dlsa(DisasContext *ctx, int rd, int rt, int rs, int sa);
 
 void gen_rdhwr(DisasContext *ctx, int rt, int rd, int sel);
+void gen_crc32(DisasContext *ctx, int rd, int rs, int rt, int sz, int crc32c);
 
 extern TCGv cpu_gpr[32], cpu_PC;
 #if defined(TARGET_MIPS64)

From 263ce6008ffd15e152b8ff5ecd16a000d88276ed Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Sun, 3 Nov 2024 05:30:07 -0300
Subject: [PATCH 2339/2760] target/mips: Extract gen_base_index_addr() helper
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Factor out gen_base_index_addr() which is used twice
but we'll use it more.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20241111222936.59869-2-philmd@linaro.org>
---
 target/mips/tcg/translate.c | 27 +++++++++++++--------------
 target/mips/tcg/translate.h |  1 +
 2 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/target/mips/tcg/translate.c b/target/mips/tcg/translate.c
index 5c80b03032..8816237e92 100644
--- a/target/mips/tcg/translate.c
+++ b/target/mips/tcg/translate.c
@@ -1957,6 +1957,17 @@ void gen_base_offset_addr(DisasContext *ctx, TCGv addr, int base, int offset)
     }
 }
 
+void gen_base_index_addr(DisasContext *ctx, TCGv addr, int base, int index)
+{
+    if (base == 0) {
+        gen_load_gpr(addr, index);
+    } else if (index == 0) {
+        gen_load_gpr(addr, base);
+    } else {
+        gen_op_addr_add(ctx, addr, cpu_gpr[base], cpu_gpr[index]);
+    }
+}
+
 static target_ulong pc_relative_pc(DisasContext *ctx)
 {
     target_ulong pc = ctx->base.pc_next;
@@ -10546,13 +10557,7 @@ static void gen_flt3_ldst(DisasContext *ctx, uint32_t opc,
 {
     TCGv t0 = tcg_temp_new();
 
-    if (base == 0) {
-        gen_load_gpr(t0, index);
-    } else if (index == 0) {
-        gen_load_gpr(t0, base);
-    } else {
-        gen_op_addr_add(ctx, t0, cpu_gpr[base], cpu_gpr[index]);
-    }
+    gen_base_index_addr(ctx, t0, base, index);
     /*
      * Don't do NOP if destination is zero: we must perform the actual
      * memory access.
@@ -11334,13 +11339,7 @@ static void gen_mips_lx(DisasContext *ctx, uint32_t opc,
     }
     t0 = tcg_temp_new();
 
-    if (base == 0) {
-        gen_load_gpr(t0, offset);
-    } else if (offset == 0) {
-        gen_load_gpr(t0, base);
-    } else {
-        gen_op_addr_add(ctx, t0, cpu_gpr[base], cpu_gpr[offset]);
-    }
+    gen_base_index_addr(ctx, t0, base, offset);
 
     switch (opc) {
     case OPC_LBUX:
diff --git a/target/mips/tcg/translate.h b/target/mips/tcg/translate.h
index 428b53a0da..e65593815e 100644
--- a/target/mips/tcg/translate.h
+++ b/target/mips/tcg/translate.h
@@ -154,6 +154,7 @@ void check_cp1_registers(DisasContext *ctx, int regs);
 void check_cop1x(DisasContext *ctx);
 
 void gen_base_offset_addr(DisasContext *ctx, TCGv addr, int base, int offset);
+void gen_base_index_addr(DisasContext *ctx, TCGv addr, int base, int index);
 void gen_move_low32(TCGv ret, TCGv_i64 arg);
 void gen_move_high32(TCGv ret, TCGv_i64 arg);
 void gen_load_gpr(TCGv t, int reg);

From f0be3f9769d72f231269d3d746ea1a391301ff36 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Sun, 3 Nov 2024 05:35:19 -0300
Subject: [PATCH 2340/2760] target/mips: Extract generic gen_lx() helper
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Extract gen_lx() from gen_mips_lx(); inline the Octeon
check in decode_opc_special3_legacy().

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20241111222936.59869-3-philmd@linaro.org>
---
 target/mips/tcg/translate.c | 55 +++++++++++++------------------------
 target/mips/tcg/translate.h |  1 +
 2 files changed, 20 insertions(+), 36 deletions(-)

diff --git a/target/mips/tcg/translate.c b/target/mips/tcg/translate.c
index 8816237e92..b9b2d8bb7e 100644
--- a/target/mips/tcg/translate.c
+++ b/target/mips/tcg/translate.c
@@ -2036,6 +2036,15 @@ static void gen_lxr(DisasContext *ctx, TCGv reg, TCGv addr,
     tcg_gen_or_tl(reg, t0, t1);
 }
 
+void gen_lx(DisasContext *ctx, int rd, int base, int index, MemOp mop)
+{
+    TCGv t0 = tcg_temp_new();
+
+    gen_base_index_addr(ctx, t0, base, index);
+    tcg_gen_qemu_ld_tl(t0, t0, ctx->mem_idx, mo_endian(ctx) | mop);
+    gen_store_gpr(t0, rd);
+}
+
 /* Load */
 static void gen_ld(DisasContext *ctx, uint32_t opc,
                    int rt, int base, int offset)
@@ -11328,41 +11337,6 @@ enum {
 
 /* MIPSDSP functions. */
 
-/* Indexed load is not for DSP only */
-static void gen_mips_lx(DisasContext *ctx, uint32_t opc,
-                        int rd, int base, int offset)
-{
-    TCGv t0;
-
-    if (!(ctx->insn_flags & INSN_OCTEON)) {
-        check_dsp(ctx);
-    }
-    t0 = tcg_temp_new();
-
-    gen_base_index_addr(ctx, t0, base, offset);
-
-    switch (opc) {
-    case OPC_LBUX:
-        tcg_gen_qemu_ld_tl(t0, t0, ctx->mem_idx, MO_UB);
-        gen_store_gpr(t0, rd);
-        break;
-    case OPC_LHX:
-        tcg_gen_qemu_ld_tl(t0, t0, ctx->mem_idx, mo_endian(ctx) | MO_SW);
-        gen_store_gpr(t0, rd);
-        break;
-    case OPC_LWX:
-        tcg_gen_qemu_ld_tl(t0, t0, ctx->mem_idx, mo_endian(ctx) | MO_SL);
-        gen_store_gpr(t0, rd);
-        break;
-#if defined(TARGET_MIPS64)
-    case OPC_LDX:
-        tcg_gen_qemu_ld_tl(t0, t0, ctx->mem_idx, mo_endian(ctx) | MO_UQ);
-        gen_store_gpr(t0, rd);
-        break;
-#endif
-    }
-}
-
 static void gen_mipsdsp_arith(DisasContext *ctx, uint32_t op1, uint32_t op2,
                               int ret, int v1, int v2)
 {
@@ -13633,15 +13607,24 @@ static void decode_opc_special3_legacy(CPUMIPSState *env, DisasContext *ctx)
         }
         break;
     case OPC_LX_DSP:
+        if (!(ctx->insn_flags & INSN_OCTEON)) {
+            check_dsp(ctx);
+        }
         op2 = MASK_LX(ctx->opcode);
         switch (op2) {
 #if defined(TARGET_MIPS64)
         case OPC_LDX:
+            gen_lx(ctx, rd, rs, rt, MO_UQ);
+            break;
 #endif
         case OPC_LBUX:
+            gen_lx(ctx, rd, rs, rt, MO_UB);
+            break;
         case OPC_LHX:
+            gen_lx(ctx, rd, rs, rt, MO_SW);
+            break;
         case OPC_LWX:
-            gen_mips_lx(ctx, op2, rd, rs, rt);
+            gen_lx(ctx, rd, rs, rt, MO_SL);
             break;
         default:            /* Invalid */
             MIPS_INVAL("MASK LX");
diff --git a/target/mips/tcg/translate.h b/target/mips/tcg/translate.h
index e65593815e..89dde1e712 100644
--- a/target/mips/tcg/translate.h
+++ b/target/mips/tcg/translate.h
@@ -169,6 +169,7 @@ void gen_store_fpr32(DisasContext *ctx, TCGv_i32 t, int reg);
 void gen_store_fpr64(DisasContext *ctx, TCGv_i64 t, int reg);
 int get_fp_bit(int cc);
 
+void gen_lx(DisasContext *ctx, int rd, int base, int index, MemOp mop);
 void gen_ldxs(DisasContext *ctx, int base, int index, int rd);
 void gen_align(DisasContext *ctx, int wordsz, int rd, int rs, int rt, int bp);
 void gen_addiupc(DisasContext *ctx, int rx, int imm,

From 23ecff81ac881e18dd06ee87d0c6319244353ade Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Sun, 3 Nov 2024 05:37:10 -0300
Subject: [PATCH 2341/2760] target/mips: Convert Octeon LX instructions to
 decodetree
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Use Octeon decodetree to call gen_lx() for the LX instructions.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pavel Dovgalyuk <Pavel.Dovgalyuk@ispras.ru>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20241111222936.59869-4-philmd@linaro.org>
---
 target/mips/tcg/octeon.decode      |  8 ++++++++
 target/mips/tcg/octeon_translate.c | 12 ++++++++++++
 target/mips/tcg/translate.c        |  4 +---
 3 files changed, 21 insertions(+), 3 deletions(-)

diff --git a/target/mips/tcg/octeon.decode b/target/mips/tcg/octeon.decode
index 0c787cb498..102a05860d 100644
--- a/target/mips/tcg/octeon.decode
+++ b/target/mips/tcg/octeon.decode
@@ -1,6 +1,7 @@
 # Octeon Architecture Module instruction set
 #
 # Copyright (C) 2022 Pavel Dovgalyuk
+# Copyright (C) 2024 Philippe Mathieu-Daudé
 #
 # SPDX-License-Identifier: LGPL-2.1-or-later
 #
@@ -39,3 +40,10 @@ CINS         011100 ..... ..... ..... ..... 11001 . @bitfield
 POP          011100 rs:5 00000 rd:5 00000 10110 dw:1
 SEQNE        011100 rs:5 rt:5 rd:5 00000 10101 ne:1
 SEQNEI       011100 rs:5 rt:5 imm:s10 10111 ne:1
+
+&lx          base index rd
+@lx          ...... base:5 index:5 rd:5 ...... ..... &lx
+LWX          011111 ..... ..... ..... 00000 001010 @lx
+LHX          011111 ..... ..... ..... 00100 001010 @lx
+LBUX         011111 ..... ..... ..... 00110 001010 @lx
+LDX          011111 ..... ..... ..... 01000 001010 @lx
diff --git a/target/mips/tcg/octeon_translate.c b/target/mips/tcg/octeon_translate.c
index d9eb43716e..b2eca29e06 100644
--- a/target/mips/tcg/octeon_translate.c
+++ b/target/mips/tcg/octeon_translate.c
@@ -174,3 +174,15 @@ static bool trans_SEQNEI(DisasContext *ctx, arg_SEQNEI *a)
     }
     return true;
 }
+
+static bool trans_lx(DisasContext *ctx, arg_lx *a, MemOp mop)
+{
+    gen_lx(ctx, a->rd, a->base, a->index, mop);
+
+    return true;
+}
+
+TRANS(LBUX, trans_lx, MO_UB);
+TRANS(LHX,  trans_lx, MO_SW);
+TRANS(LWX,  trans_lx, MO_SL);
+TRANS(LDX,  trans_lx, MO_UQ);
diff --git a/target/mips/tcg/translate.c b/target/mips/tcg/translate.c
index b9b2d8bb7e..d91d6efe02 100644
--- a/target/mips/tcg/translate.c
+++ b/target/mips/tcg/translate.c
@@ -13607,9 +13607,7 @@ static void decode_opc_special3_legacy(CPUMIPSState *env, DisasContext *ctx)
         }
         break;
     case OPC_LX_DSP:
-        if (!(ctx->insn_flags & INSN_OCTEON)) {
-            check_dsp(ctx);
-        }
+        check_dsp(ctx);
         op2 = MASK_LX(ctx->opcode);
         switch (op2) {
 #if defined(TARGET_MIPS64)

From 65a67f0fe5adcff442d80efba5094333f7ed7a21 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 12 Nov 2024 16:19:18 +0100
Subject: [PATCH 2342/2760] target/mips: Have gen_[d]lsa() callers add 1 to
 shift amount argument
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Having the callee add 1 to shift amount is misleading (see the
NM_LSA case in decode_nanomips_32_48_opc() where we have to
manually substract 1). Rather have the callers pass a modified
$sa.

Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20241112172022.88348-4-philmd@linaro.org>
---
 target/mips/tcg/micromips_translate.c.inc | 2 +-
 target/mips/tcg/msa_translate.c           | 4 ++--
 target/mips/tcg/nanomips_translate.c.inc  | 7 +------
 target/mips/tcg/rel6_translate.c          | 4 ++--
 target/mips/tcg/translate_addr_const.c    | 4 ++--
 5 files changed, 8 insertions(+), 13 deletions(-)

diff --git a/target/mips/tcg/micromips_translate.c.inc b/target/mips/tcg/micromips_translate.c.inc
index c479bec108..8fda7c8a21 100644
--- a/target/mips/tcg/micromips_translate.c.inc
+++ b/target/mips/tcg/micromips_translate.c.inc
@@ -1795,7 +1795,7 @@ static void decode_micromips32_opc(CPUMIPSState *env, DisasContext *ctx)
             return;
         case LSA:
             check_insn(ctx, ISA_MIPS_R6);
-            gen_lsa(ctx, rd, rt, rs, extract32(ctx->opcode, 9, 2));
+            gen_lsa(ctx, rd, rt, rs, extract32(ctx->opcode, 9, 2) + 1);
             break;
         case ALIGN:
             check_insn(ctx, ISA_MIPS_R6);
diff --git a/target/mips/tcg/msa_translate.c b/target/mips/tcg/msa_translate.c
index 75cf80a20e..82b149922f 100644
--- a/target/mips/tcg/msa_translate.c
+++ b/target/mips/tcg/msa_translate.c
@@ -780,7 +780,7 @@ TRANS_DF_iv(ST, trans_msa_ldst, gen_helper_msa_st);
 
 static bool trans_LSA(DisasContext *ctx, arg_r *a)
 {
-    return gen_lsa(ctx, a->rd, a->rt, a->rs, a->sa);
+    return gen_lsa(ctx, a->rd, a->rt, a->rs, a->sa + 1);
 }
 
 static bool trans_DLSA(DisasContext *ctx, arg_r *a)
@@ -788,5 +788,5 @@ static bool trans_DLSA(DisasContext *ctx, arg_r *a)
     if (TARGET_LONG_BITS != 64) {
         return false;
     }
-    return gen_dlsa(ctx, a->rd, a->rt, a->rs, a->sa);
+    return gen_dlsa(ctx, a->rd, a->rt, a->rs, a->sa + 1);
 }
diff --git a/target/mips/tcg/nanomips_translate.c.inc b/target/mips/tcg/nanomips_translate.c.inc
index 1e274143bb..9d4e0bee81 100644
--- a/target/mips/tcg/nanomips_translate.c.inc
+++ b/target/mips/tcg/nanomips_translate.c.inc
@@ -3626,12 +3626,7 @@ static int decode_nanomips_32_48_opc(CPUMIPSState *env, DisasContext *ctx)
                 gen_p_lsx(ctx, rd, rs, rt);
                 break;
             case NM_LSA:
-                /*
-                 * In nanoMIPS, the shift field directly encodes the shift
-                 * amount, meaning that the supported shift values are in
-                 * the range 0 to 3 (instead of 1 to 4 in MIPSR6).
-                 */
-                gen_lsa(ctx, rd, rt, rs, extract32(ctx->opcode, 9, 2) - 1);
+                gen_lsa(ctx, rd, rt, rs, extract32(ctx->opcode, 9, 2));
                 break;
             case NM_EXTW:
                 gen_ext(ctx, 32, rd, rs, rt, extract32(ctx->opcode, 6, 5));
diff --git a/target/mips/tcg/rel6_translate.c b/target/mips/tcg/rel6_translate.c
index 8933506397..4c056621c9 100644
--- a/target/mips/tcg/rel6_translate.c
+++ b/target/mips/tcg/rel6_translate.c
@@ -23,7 +23,7 @@ bool trans_REMOVED(DisasContext *ctx, arg_REMOVED *a)
 
 static bool trans_LSA(DisasContext *ctx, arg_r *a)
 {
-    return gen_lsa(ctx, a->rd, a->rt, a->rs, a->sa);
+    return gen_lsa(ctx, a->rd, a->rt, a->rs, a->sa + 1);
 }
 
 static bool trans_DLSA(DisasContext *ctx, arg_r *a)
@@ -31,7 +31,7 @@ static bool trans_DLSA(DisasContext *ctx, arg_r *a)
     if (TARGET_LONG_BITS != 64) {
         return false;
     }
-    return gen_dlsa(ctx, a->rd, a->rt, a->rs, a->sa);
+    return gen_dlsa(ctx, a->rd, a->rt, a->rs, a->sa + 1);
 }
 
 static bool trans_CRC32(DisasContext *ctx, arg_special3_crc *a)
diff --git a/target/mips/tcg/translate_addr_const.c b/target/mips/tcg/translate_addr_const.c
index 6f4b39f715..1d140e918d 100644
--- a/target/mips/tcg/translate_addr_const.c
+++ b/target/mips/tcg/translate_addr_const.c
@@ -26,7 +26,7 @@ bool gen_lsa(DisasContext *ctx, int rd, int rt, int rs, int sa)
     t1 = tcg_temp_new();
     gen_load_gpr(t0, rs);
     gen_load_gpr(t1, rt);
-    tcg_gen_shli_tl(t0, t0, sa + 1);
+    tcg_gen_shli_tl(t0, t0, sa);
     tcg_gen_add_tl(cpu_gpr[rd], t0, t1);
     tcg_gen_ext32s_tl(cpu_gpr[rd], cpu_gpr[rd]);
     return true;
@@ -47,7 +47,7 @@ bool gen_dlsa(DisasContext *ctx, int rd, int rt, int rs, int sa)
     t1 = tcg_temp_new();
     gen_load_gpr(t0, rs);
     gen_load_gpr(t1, rt);
-    tcg_gen_shli_tl(t0, t0, sa + 1);
+    tcg_gen_shli_tl(t0, t0, sa);
     tcg_gen_add_tl(cpu_gpr[rd], t0, t1);
     return true;
 }

From c083f1f3de93c80df757444aa22837f0a2db3172 Mon Sep 17 00:00:00 2001
From: Aleksandar Rakic <aleksandar.rakic@htecgroup.com>
Date: Fri, 14 Feb 2025 17:37:42 +0000
Subject: [PATCH 2343/2760] tests/tcg/mips: Add tests for MIPS CRC32[c]
 instructions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Yongbok Kim <yongbok.kim@mips.com>
Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
Signed-off-by: Aleksandar Rakic <aleksandar.rakic@htecgroup.com>
Reviewed-by: Aleksandar Rikalo <arikalo@gmail.com>
Message-ID: <20250214173702.2308488-3-aleksandar.rakic@htecgroup.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 tests/tcg/mips/include/wrappers_mips64r6.h    |  32 ++++
 tests/tcg/mips/user/isa/mips64r6/crc/Makefile |  40 +++++
 .../isa/mips64r6/crc/test_mips64r6_crc32b.c   | 142 ++++++++++++++++++
 .../isa/mips64r6/crc/test_mips64r6_crc32cb.c  | 142 ++++++++++++++++++
 .../isa/mips64r6/crc/test_mips64r6_crc32cd.c  | 142 ++++++++++++++++++
 .../isa/mips64r6/crc/test_mips64r6_crc32ch.c  | 142 ++++++++++++++++++
 .../isa/mips64r6/crc/test_mips64r6_crc32cw.c  | 142 ++++++++++++++++++
 .../isa/mips64r6/crc/test_mips64r6_crc32d.c   | 142 ++++++++++++++++++
 .../isa/mips64r6/crc/test_mips64r6_crc32h.c   | 142 ++++++++++++++++++
 .../isa/mips64r6/crc/test_mips64r6_crc32w.c   | 142 ++++++++++++++++++
 10 files changed, 1208 insertions(+)
 create mode 100644 tests/tcg/mips/user/isa/mips64r6/crc/Makefile
 create mode 100644 tests/tcg/mips/user/isa/mips64r6/crc/test_mips64r6_crc32b.c
 create mode 100644 tests/tcg/mips/user/isa/mips64r6/crc/test_mips64r6_crc32cb.c
 create mode 100644 tests/tcg/mips/user/isa/mips64r6/crc/test_mips64r6_crc32cd.c
 create mode 100644 tests/tcg/mips/user/isa/mips64r6/crc/test_mips64r6_crc32ch.c
 create mode 100644 tests/tcg/mips/user/isa/mips64r6/crc/test_mips64r6_crc32cw.c
 create mode 100644 tests/tcg/mips/user/isa/mips64r6/crc/test_mips64r6_crc32d.c
 create mode 100644 tests/tcg/mips/user/isa/mips64r6/crc/test_mips64r6_crc32h.c
 create mode 100644 tests/tcg/mips/user/isa/mips64r6/crc/test_mips64r6_crc32w.c

diff --git a/tests/tcg/mips/include/wrappers_mips64r6.h b/tests/tcg/mips/include/wrappers_mips64r6.h
index d1e5edb632..33d03de50b 100644
--- a/tests/tcg/mips/include/wrappers_mips64r6.h
+++ b/tests/tcg/mips/include/wrappers_mips64r6.h
@@ -23,6 +23,7 @@
 #ifndef WRAPPERS_MIPS64R6_H
 #define WRAPPERS_MIPS64R6_H
 
+#include <string.h>
 
 #define DO_MIPS64R6__RD__RS(suffix, mnemonic)                          \
 static inline void do_mips64r6_##suffix(const void *input,             \
@@ -80,4 +81,35 @@ DO_MIPS64R6__RD__RS_RT(DMULU, dmulu)
 DO_MIPS64R6__RD__RS_RT(DMUHU, dmuhu)
 
 
+#define DO_MIPS64R6__RT__RS_RT(suffix, mnemonic)                       \
+static inline void do_mips64r6_##suffix(const void *input1,            \
+                                        const void *input2,            \
+                                        void *output)                  \
+{                                                                      \
+    if (strncmp(#mnemonic, "crc32", 5) == 0)                           \
+        __asm__ volatile (                                             \
+           ".set crc\n\t"                                              \
+        );                                                             \
+                                                                       \
+   __asm__ volatile (                                                  \
+      "ld $t1, 0(%0)\n\t"                                              \
+      "ld $t2, 0(%1)\n\t"                                              \
+      #mnemonic " $t2, $t1, $t2\n\t"                                   \
+      "sd $t2, 0(%2)\n\t"                                              \
+      :                                                                \
+      : "r" (input1), "r" (input2), "r" (output)                       \
+      : "t0", "t1", "t2", "memory"                                     \
+   );                                                                  \
+}
+
+DO_MIPS64R6__RT__RS_RT(CRC32B, crc32b)
+DO_MIPS64R6__RT__RS_RT(CRC32H, crc32h)
+DO_MIPS64R6__RT__RS_RT(CRC32W, crc32w)
+DO_MIPS64R6__RT__RS_RT(CRC32D, crc32d)
+
+DO_MIPS64R6__RT__RS_RT(CRC32CB, crc32cb)
+DO_MIPS64R6__RT__RS_RT(CRC32CH, crc32ch)
+DO_MIPS64R6__RT__RS_RT(CRC32CW, crc32cw)
+DO_MIPS64R6__RT__RS_RT(CRC32CD, crc32cd)
+
 #endif
diff --git a/tests/tcg/mips/user/isa/mips64r6/crc/Makefile b/tests/tcg/mips/user/isa/mips64r6/crc/Makefile
new file mode 100644
index 0000000000..b7f5811a5e
--- /dev/null
+++ b/tests/tcg/mips/user/isa/mips64r6/crc/Makefile
@@ -0,0 +1,40 @@
+#
+#  Test program for MIPS64R6 CRC32 instructions
+#
+#  Copyright (C) 2025  Aleksandar Rakic <aleksandar.rakic@htecgroup.com>
+#
+#  SPDX-License-Identifier: GPL-2.0-or-later
+#
+
+ifndef PREFIX
+  $(error "PREFIX not set, please export GNU Toolchain install directory.")
+endif
+
+ifndef SYSROOT
+  $(error "SYSROOT not set, please export GNU Toolchain system root directory.")
+endif
+
+SIM = ../../../../../../../build/qemu-mips64
+SIM_FLAGS = -L $(SYSROOT)
+
+CC      =  $(PREFIX)/bin/mips64-r6-linux-gnu-gcc
+
+TESTCASES  = test_mips64r6_crc32b.tst
+TESTCASES += test_mips64r6_crc32h.tst
+TESTCASES += test_mips64r6_crc32w.tst
+TESTCASES += test_mips64r6_crc32d.tst
+TESTCASES += test_mips64r6_crc32cb.tst
+TESTCASES += test_mips64r6_crc32ch.tst
+TESTCASES += test_mips64r6_crc32cw.tst
+TESTCASES += test_mips64r6_crc32cd.tst
+
+all: $(TESTCASES)
+	@for case in $(TESTCASES); do \
+            echo $(SIM) $(SIM_FLAGS) ./$$case; \
+            $(SIM) $(SIM_FLAGS) ./$$case; \
+            echo $(RM) -rf ./$$case; \
+            $(RM) -rf ./$$case; \
+	done
+
+%.tst: %.c
+	$(CC) $< -o $@
diff --git a/tests/tcg/mips/user/isa/mips64r6/crc/test_mips64r6_crc32b.c b/tests/tcg/mips/user/isa/mips64r6/crc/test_mips64r6_crc32b.c
new file mode 100644
index 0000000000..bb1f3f6924
--- /dev/null
+++ b/tests/tcg/mips/user/isa/mips64r6/crc/test_mips64r6_crc32b.c
@@ -0,0 +1,142 @@
+/*
+ *  Test program for MIPS64R6 instruction CRC32B
+ *
+ *  Copyright (C) 2019  Wave Computing, Inc.
+ *  Copyright (C) 2019  Aleksandar Markovic <amarkovic@wavecomp.com>
+ *  Copyright (C) 2025  Aleksandar Rakic <aleksandar.rakic@htecgroup.com>
+ *
+ *  SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include <sys/time.h>
+#include <stdint.h>
+
+#include "../../../../include/wrappers_mips64r6.h"
+#include "../../../../include/test_inputs_64.h"
+#include "../../../../include/test_utils_64.h"
+
+#define TEST_COUNT_TOTAL (PATTERN_INPUTS_64_COUNT + RANDOM_INPUTS_64_COUNT)
+
+int32_t main(void)
+{
+    char *isa_ase_name = "mips64r6";
+    char *group_name = "CRC with reversed polynomial 0xEDB88320";
+    char *instruction_name =   "CRC32B";
+    int32_t ret;
+    uint32_t i, j;
+    struct timeval start, end;
+    double elapsed_time;
+
+    uint64_t b64_result[TEST_COUNT_TOTAL];
+    uint64_t b64_expect[TEST_COUNT_TOTAL] = {
+        0x0000000000ffffffULL,                    /*   0  */
+        0x000000002d02ef8dULL,
+        0x000000001bab0fd1ULL,
+        0x0000000036561fa3ULL,
+        0xffffffffbf1caddaULL,
+        0xffffffff92e1bda8ULL,
+        0x00000000278c7949ULL,
+        0x000000000a71693bULL,
+        0x000000002dfd1072ULL,                    /*   8  */
+        0x0000000000000000ULL,
+        0x0000000036a9e05cULL,
+        0x000000001b54f02eULL,
+        0xffffffff921e4257ULL,
+        0xffffffffbfe35225ULL,
+        0x000000000a8e96c4ULL,
+        0x00000000277386b6ULL,
+        0x000000001bfe5a84ULL,                    /*  16  */
+        0x0000000036034af6ULL,
+        0x0000000000aaaaaaULL,
+        0x000000002d57bad8ULL,
+        0xffffffffa41d08a1ULL,
+        0xffffffff89e018d3ULL,
+        0x000000003c8ddc32ULL,
+        0x000000001170cc40ULL,
+        0x0000000036fcb509ULL,                    /*  24  */
+        0x000000001b01a57bULL,
+        0x000000002da84527ULL,
+        0x0000000000555555ULL,
+        0xffffffff891fe72cULL,
+        0xffffffffa4e2f75eULL,
+        0x00000000118f33bfULL,
+        0x000000003c7223cdULL,
+        0xffffffffbf2f9ee9ULL,                    /*  32  */
+        0xffffffff92d28e9bULL,
+        0xffffffffa47b6ec7ULL,
+        0xffffffff89867eb5ULL,
+        0x0000000000ccccccULL,
+        0x000000002d31dcbeULL,
+        0xffffffff985c185fULL,
+        0xffffffffb5a1082dULL,
+        0xffffffff922d7164ULL,                    /*  40  */
+        0xffffffffbfd06116ULL,
+        0xffffffff8979814aULL,
+        0xffffffffa4849138ULL,
+        0x000000002dce2341ULL,
+        0x0000000000333333ULL,
+        0xffffffffb55ef7d2ULL,
+        0xffffffff98a3e7a0ULL,
+        0x0000000027fdbe55ULL,                    /*  48  */
+        0x000000000a00ae27ULL,
+        0x000000003ca94e7bULL,
+        0x0000000011545e09ULL,
+        0xffffffff981eec70ULL,
+        0xffffffffb5e3fc02ULL,
+        0x00000000008e38e3ULL,
+        0x000000002d732891ULL,
+        0x000000000aff51d8ULL,                    /*  56  */
+        0x00000000270241aaULL,
+        0x0000000011aba1f6ULL,
+        0x000000003c56b184ULL,
+        0xffffffffb51c03fdULL,
+        0xffffffff98e1138fULL,
+        0x000000002d8cd76eULL,
+        0x000000000071c71cULL,
+        0x0000000000286255ULL,                    /*  64  */
+        0x00000000784a5a65ULL,
+        0xffffffff9bdd0d3bULL,
+        0xffffffffe7e61ce5ULL,
+        0x00000000782fabf7ULL,
+        0x00000000004d93c7ULL,
+        0xffffffffe3dac499ULL,
+        0xffffffff9fe1d547ULL,
+        0xffffffff9b4ca0e5ULL,                    /*  72  */
+        0xffffffffe32e98d5ULL,
+        0x0000000000b9cf8bULL,
+        0x000000007c82de55ULL,
+        0xffffffffe7904f52ULL,
+        0xffffffff9ff27762ULL,
+        0x000000007c65203cULL,
+        0x00000000005e31e2ULL,
+    };
+
+    gettimeofday(&start, NULL);
+
+    for (i = 0; i < PATTERN_INPUTS_64_SHORT_COUNT; i++) {
+        for (j = 0; j < PATTERN_INPUTS_64_SHORT_COUNT; j++) {
+            do_mips64r6_CRC32B(b64_pattern + i, b64_pattern + j,
+                b64_result + (PATTERN_INPUTS_64_SHORT_COUNT * i + j));
+        }
+    }
+
+    for (i = 0; i < RANDOM_INPUTS_64_SHORT_COUNT; i++) {
+        for (j = 0; j < RANDOM_INPUTS_64_SHORT_COUNT; j++) {
+            do_mips64r6_CRC32B(b64_random + i, b64_random + j,
+                b64_result + (((PATTERN_INPUTS_64_SHORT_COUNT) *
+                               (PATTERN_INPUTS_64_SHORT_COUNT)) +
+                              RANDOM_INPUTS_64_SHORT_COUNT * i + j));
+        }
+    }
+
+    gettimeofday(&end, NULL);
+
+    elapsed_time = (end.tv_sec - start.tv_sec) * 1000.0;
+    elapsed_time += (end.tv_usec - start.tv_usec) / 1000.0;
+
+    ret = check_results_64(isa_ase_name, group_name, instruction_name,
+                           TEST_COUNT_TOTAL, elapsed_time, b64_result,
+                           b64_expect);
+
+    return ret;
+}
diff --git a/tests/tcg/mips/user/isa/mips64r6/crc/test_mips64r6_crc32cb.c b/tests/tcg/mips/user/isa/mips64r6/crc/test_mips64r6_crc32cb.c
new file mode 100644
index 0000000000..1439d44bf2
--- /dev/null
+++ b/tests/tcg/mips/user/isa/mips64r6/crc/test_mips64r6_crc32cb.c
@@ -0,0 +1,142 @@
+/*
+ *  Test program for MIPS64R6 instruction CRC32CB
+ *
+ *  Copyright (C) 2019  Wave Computing, Inc.
+ *  Copyright (C) 2019  Aleksandar Markovic <amarkovic@wavecomp.com>
+ *  Copyright (C) 2025  Aleksandar Rakic <aleksandar.rakic@htecgroup.com>
+ *
+ *  SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include <sys/time.h>
+#include <stdint.h>
+
+#include "../../../../include/wrappers_mips64r6.h"
+#include "../../../../include/test_inputs_64.h"
+#include "../../../../include/test_utils_64.h"
+
+#define TEST_COUNT_TOTAL (PATTERN_INPUTS_64_COUNT + RANDOM_INPUTS_64_COUNT)
+
+int32_t main(void)
+{
+    char *isa_ase_name = "mips64r6";
+    char *group_name = "CRC with reversed polynomial 0x82F63B78";
+    char *instruction_name =   "CRC32CB";
+    int32_t ret;
+    uint32_t i, j;
+    struct timeval start, end;
+    double elapsed_time;
+
+    uint64_t b64_result[TEST_COUNT_TOTAL];
+    uint64_t b64_expect[TEST_COUNT_TOTAL] = {
+        0x0000000000ffffffULL,                    /*   0  */
+        0xffffffffad7d5351ULL,
+        0x00000000647e6465ULL,
+        0xffffffffc9fcc8cbULL,
+        0x00000000237f7689ULL,
+        0xffffffff8efdda27ULL,
+        0xffffffff837defedULL,
+        0x000000002eff4343ULL,
+        0xffffffffad82acaeULL,                    /*   8  */
+        0x0000000000000000ULL,
+        0xffffffffc9033734ULL,
+        0x0000000064819b9aULL,
+        0xffffffff8e0225d8ULL,
+        0x0000000023808976ULL,
+        0x000000002e00bcbcULL,
+        0xffffffff83821012ULL,
+        0x00000000642b3130ULL,                    /*  16  */
+        0xffffffffc9a99d9eULL,
+        0x0000000000aaaaaaULL,
+        0xffffffffad280604ULL,
+        0x0000000047abb846ULL,
+        0xffffffffea2914e8ULL,
+        0xffffffffe7a92122ULL,
+        0x000000004a2b8d8cULL,
+        0xffffffffc9566261ULL,                    /*  24  */
+        0x0000000064d4cecfULL,
+        0xffffffffadd7f9fbULL,
+        0x0000000000555555ULL,
+        0xffffffffead6eb17ULL,
+        0x00000000475447b9ULL,
+        0x000000004ad47273ULL,
+        0xffffffffe756deddULL,
+        0x00000000234c45baULL,                    /*  32  */
+        0xffffffff8ecee914ULL,
+        0x0000000047cdde20ULL,
+        0xffffffffea4f728eULL,
+        0x0000000000ccccccULL,
+        0xffffffffad4e6062ULL,
+        0xffffffffa0ce55a8ULL,
+        0x000000000d4cf906ULL,
+        0xffffffff8e3116ebULL,                    /*  40  */
+        0x0000000023b3ba45ULL,
+        0xffffffffeab08d71ULL,
+        0x00000000473221dfULL,
+        0xffffffffadb19f9dULL,
+        0x0000000000333333ULL,
+        0x000000000db306f9ULL,
+        0xffffffffa031aa57ULL,
+        0xffffffff830c28f1ULL,                    /*  48  */
+        0x000000002e8e845fULL,
+        0xffffffffe78db36bULL,
+        0x000000004a0f1fc5ULL,
+        0xffffffffa08ca187ULL,
+        0x000000000d0e0d29ULL,
+        0x00000000008e38e3ULL,
+        0xffffffffad0c944dULL,
+        0x000000002e717ba0ULL,                    /*  56  */
+        0xffffffff83f3d70eULL,
+        0x000000004af0e03aULL,
+        0xffffffffe7724c94ULL,
+        0x000000000df1f2d6ULL,
+        0xffffffffa0735e78ULL,
+        0xffffffffadf36bb2ULL,
+        0x000000000071c71cULL,
+        0x0000000000286255ULL,                    /*  64  */
+        0xffffffffcbefd6b4ULL,
+        0xffffffffc334e94fULL,
+        0xffffffffac268ec5ULL,
+        0xffffffffcb8a2726ULL,
+        0x00000000004d93c7ULL,
+        0x000000000896ac3cULL,
+        0x000000006784cbb6ULL,
+        0xffffffffc3a54491ULL,                    /*  72  */
+        0x000000000862f070ULL,
+        0x0000000000b9cf8bULL,
+        0x000000006faba801ULL,
+        0xffffffffac50dd72ULL,
+        0x0000000067976993ULL,
+        0x000000006f4c5668ULL,
+        0x00000000005e31e2ULL,
+    };
+
+    gettimeofday(&start, NULL);
+
+    for (i = 0; i < PATTERN_INPUTS_64_SHORT_COUNT; i++) {
+        for (j = 0; j < PATTERN_INPUTS_64_SHORT_COUNT; j++) {
+            do_mips64r6_CRC32CB(b64_pattern + i, b64_pattern + j,
+                b64_result + (PATTERN_INPUTS_64_SHORT_COUNT * i + j));
+        }
+    }
+
+    for (i = 0; i < RANDOM_INPUTS_64_SHORT_COUNT; i++) {
+        for (j = 0; j < RANDOM_INPUTS_64_SHORT_COUNT; j++) {
+            do_mips64r6_CRC32CB(b64_random + i, b64_random + j,
+                b64_result + (((PATTERN_INPUTS_64_SHORT_COUNT) *
+                               (PATTERN_INPUTS_64_SHORT_COUNT)) +
+                              RANDOM_INPUTS_64_SHORT_COUNT * i + j));
+        }
+    }
+
+    gettimeofday(&end, NULL);
+
+    elapsed_time = (end.tv_sec - start.tv_sec) * 1000.0;
+    elapsed_time += (end.tv_usec - start.tv_usec) / 1000.0;
+
+    ret = check_results_64(isa_ase_name, group_name, instruction_name,
+                           TEST_COUNT_TOTAL, elapsed_time, b64_result,
+                           b64_expect);
+
+    return ret;
+}
diff --git a/tests/tcg/mips/user/isa/mips64r6/crc/test_mips64r6_crc32cd.c b/tests/tcg/mips/user/isa/mips64r6/crc/test_mips64r6_crc32cd.c
new file mode 100644
index 0000000000..bf258e0696
--- /dev/null
+++ b/tests/tcg/mips/user/isa/mips64r6/crc/test_mips64r6_crc32cd.c
@@ -0,0 +1,142 @@
+/*
+ *  Test program for MIPS64R6 instruction CRC32CD
+ *
+ *  Copyright (C) 2019  Wave Computing, Inc.
+ *  Copyright (C) 2019  Aleksandar Markovic <amarkovic@wavecomp.com>
+ *  Copyright (C) 2025  Aleksandar Rakic <aleksandar.rakic@htecgroup.com>
+ *
+ *  SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include <sys/time.h>
+#include <stdint.h>
+
+#include "../../../../include/wrappers_mips64r6.h"
+#include "../../../../include/test_inputs_64.h"
+#include "../../../../include/test_utils_64.h"
+
+#define TEST_COUNT_TOTAL (PATTERN_INPUTS_64_COUNT + RANDOM_INPUTS_64_COUNT)
+
+int32_t main(void)
+{
+    char *isa_ase_name = "mips64r6";
+    char *group_name = "CRC with reversed polynomial 0x82F63B78";
+    char *instruction_name =   "CRC32CD";
+    int32_t ret;
+    uint32_t i, j;
+    struct timeval start, end;
+    double elapsed_time;
+
+    uint64_t b64_result[TEST_COUNT_TOTAL];
+    uint64_t b64_expect[TEST_COUNT_TOTAL] = {
+        0xffffffffb798b438ULL,                    /*   0  */
+        0xffffffffc44ff94dULL,
+        0xffffffff992a70ebULL,
+        0xffffffffeafd3d9eULL,
+        0x000000005152da26ULL,
+        0x0000000022859753ULL,
+        0x0000000015cb6d32ULL,
+        0x00000000661c2047ULL,
+        0x0000000073d74d75ULL,                    /*   8  */
+        0x0000000000000000ULL,
+        0x000000005d6589a6ULL,
+        0x000000002eb2c4d3ULL,
+        0xffffffff951d236bULL,
+        0xffffffffe6ca6e1eULL,
+        0xffffffffd184947fULL,
+        0xffffffffa253d90aULL,
+        0x0000000008f9ceacULL,                    /*  16  */
+        0x000000007b2e83d9ULL,
+        0x00000000264b0a7fULL,
+        0x00000000559c470aULL,
+        0xffffffffee33a0b2ULL,
+        0xffffffff9de4edc7ULL,
+        0xffffffffaaaa17a6ULL,
+        0xffffffffd97d5ad3ULL,
+        0xffffffffccb637e1ULL,                    /*  24  */
+        0xffffffffbf617a94ULL,
+        0xffffffffe204f332ULL,
+        0xffffffff91d3be47ULL,
+        0x000000002a7c59ffULL,
+        0x0000000059ab148aULL,
+        0x000000006ee5eeebULL,
+        0x000000001d32a39eULL,
+        0x0000000021e3b01bULL,                    /*  32  */
+        0x000000005234fd6eULL,
+        0x000000000f5174c8ULL,
+        0x000000007c8639bdULL,
+        0xffffffffc729de05ULL,
+        0xffffffffb4fe9370ULL,
+        0xffffffff83b06911ULL,
+        0xfffffffff0672464ULL,
+        0xffffffffe5ac4956ULL,                    /*  40  */
+        0xffffffff967b0423ULL,
+        0xffffffffcb1e8d85ULL,
+        0xffffffffb8c9c0f0ULL,
+        0x0000000003662748ULL,
+        0x0000000070b16a3dULL,
+        0x0000000047ff905cULL,
+        0x000000003428dd29ULL,
+        0xffffffffb89d59a6ULL,                    /*  48  */
+        0xffffffffcb4a14d3ULL,
+        0xffffffff962f9d75ULL,
+        0xffffffffe5f8d000ULL,
+        0x000000005e5737b8ULL,
+        0x000000002d807acdULL,
+        0x000000001ace80acULL,
+        0x000000006919cdd9ULL,
+        0x000000007cd2a0ebULL,                    /*  56  */
+        0x000000000f05ed9eULL,
+        0x0000000052606438ULL,
+        0x0000000021b7294dULL,
+        0xffffffff9a18cef5ULL,
+        0xffffffffe9cf8380ULL,
+        0xffffffffde8179e1ULL,
+        0xffffffffad563494ULL,
+        0x000000003a358bb3ULL,                    /*  64  */
+        0xffffffff975446ebULL,
+        0x0000000041d37ad6ULL,
+        0x000000004be84fe1ULL,
+        0xffffffff9671b1b3ULL,
+        0x000000003b107cebULL,
+        0xffffffffed9740d6ULL,
+        0xffffffffe7ac75e1ULL,
+        0xffffffffa1489696ULL,                    /*  72  */
+        0x000000000c295bceULL,
+        0xffffffffdaae67f3ULL,
+        0xffffffffd09552c4ULL,
+        0x0000000042bd7071ULL,
+        0xffffffffefdcbd29ULL,
+        0x00000000395b8114ULL,
+        0x000000003360b423ULL,
+    };
+
+    gettimeofday(&start, NULL);
+
+    for (i = 0; i < PATTERN_INPUTS_64_SHORT_COUNT; i++) {
+        for (j = 0; j < PATTERN_INPUTS_64_SHORT_COUNT; j++) {
+            do_mips64r6_CRC32CD(b64_pattern + i, b64_pattern + j,
+                b64_result + (PATTERN_INPUTS_64_SHORT_COUNT * i + j));
+        }
+    }
+
+    for (i = 0; i < RANDOM_INPUTS_64_SHORT_COUNT; i++) {
+        for (j = 0; j < RANDOM_INPUTS_64_SHORT_COUNT; j++) {
+            do_mips64r6_CRC32CD(b64_random + i, b64_random + j,
+                b64_result + (((PATTERN_INPUTS_64_SHORT_COUNT) *
+                               (PATTERN_INPUTS_64_SHORT_COUNT)) +
+                              RANDOM_INPUTS_64_SHORT_COUNT * i + j));
+        }
+    }
+
+    gettimeofday(&end, NULL);
+
+    elapsed_time = (end.tv_sec - start.tv_sec) * 1000.0;
+    elapsed_time += (end.tv_usec - start.tv_usec) / 1000.0;
+
+    ret = check_results_64(isa_ase_name, group_name, instruction_name,
+                           TEST_COUNT_TOTAL, elapsed_time, b64_result,
+                           b64_expect);
+
+    return ret;
+}
diff --git a/tests/tcg/mips/user/isa/mips64r6/crc/test_mips64r6_crc32ch.c b/tests/tcg/mips/user/isa/mips64r6/crc/test_mips64r6_crc32ch.c
new file mode 100644
index 0000000000..0e7b67732e
--- /dev/null
+++ b/tests/tcg/mips/user/isa/mips64r6/crc/test_mips64r6_crc32ch.c
@@ -0,0 +1,142 @@
+/*
+ *  Test program for MIPS64R6 instruction CRC32CH
+ *
+ *  Copyright (C) 2019  Wave Computing, Inc.
+ *  Copyright (C) 2019  Aleksandar Markovic <amarkovic@wavecomp.com>
+ *  Copyright (C) 2025  Aleksandar Rakic <aleksandar.rakic@htecgroup.com>
+ *
+ *  SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include <sys/time.h>
+#include <stdint.h>
+
+#include "../../../../include/wrappers_mips64r6.h"
+#include "../../../../include/test_inputs_64.h"
+#include "../../../../include/test_utils_64.h"
+
+#define TEST_COUNT_TOTAL (PATTERN_INPUTS_64_COUNT + RANDOM_INPUTS_64_COUNT)
+
+int32_t main(void)
+{
+    char *isa_ase_name = "mips64r6";
+    char *group_name = "CRC with reversed polynomial 0x82F63B78";
+    char *instruction_name =   "CRC32CH";
+    int32_t ret;
+    uint32_t i, j;
+    struct timeval start, end;
+    double elapsed_time;
+
+    uint64_t b64_result[TEST_COUNT_TOTAL];
+    uint64_t b64_expect[TEST_COUNT_TOTAL] = {
+        0x000000000000ffffULL,                    /*   0  */
+        0x000000000e9e77d2ULL,
+        0xfffffffff92eaa4bULL,
+        0xfffffffff7b02266ULL,
+        0x00000000571acc93ULL,
+        0x00000000598444beULL,
+        0xfffffffff1e6ca77ULL,
+        0xffffffffff78425aULL,
+        0x000000000e9e882dULL,                    /*   8  */
+        0x0000000000000000ULL,
+        0xfffffffff7b0dd99ULL,
+        0xfffffffff92e55b4ULL,
+        0x000000005984bb41ULL,
+        0x00000000571a336cULL,
+        0xffffffffff78bda5ULL,
+        0xfffffffff1e63588ULL,
+        0xfffffffff92eff1eULL,                    /*  16  */
+        0xfffffffff7b07733ULL,
+        0x000000000000aaaaULL,
+        0x000000000e9e2287ULL,
+        0xffffffffae34cc72ULL,
+        0xffffffffa0aa445fULL,
+        0x0000000008c8ca96ULL,
+        0x00000000065642bbULL,
+        0xfffffffff7b088ccULL,                    /*  24  */
+        0xfffffffff92e00e1ULL,
+        0x000000000e9edd78ULL,
+        0x0000000000005555ULL,
+        0xffffffffa0aabba0ULL,
+        0xffffffffae34338dULL,
+        0x000000000656bd44ULL,
+        0x0000000008c83569ULL,
+        0x00000000571affa0ULL,                    /*  32  */
+        0x000000005984778dULL,
+        0xffffffffae34aa14ULL,
+        0xffffffffa0aa2239ULL,
+        0x000000000000ccccULL,
+        0x000000000e9e44e1ULL,
+        0xffffffffa6fcca28ULL,
+        0xffffffffa8624205ULL,
+        0x0000000059848872ULL,                    /*  40  */
+        0x00000000571a005fULL,
+        0xffffffffa0aaddc6ULL,
+        0xffffffffae3455ebULL,
+        0x000000000e9ebb1eULL,
+        0x0000000000003333ULL,
+        0xffffffffa862bdfaULL,
+        0xffffffffa6fc35d7ULL,
+        0xfffffffff1e6bbb0ULL,                    /*  48  */
+        0xffffffffff78339dULL,
+        0x0000000008c8ee04ULL,
+        0x0000000006566629ULL,
+        0xffffffffa6fc88dcULL,
+        0xffffffffa86200f1ULL,
+        0x0000000000008e38ULL,
+        0x000000000e9e0615ULL,
+        0xffffffffff78cc62ULL,                    /*  56  */
+        0xfffffffff1e6444fULL,
+        0x00000000065699d6ULL,
+        0x0000000008c811fbULL,
+        0xffffffffa862ff0eULL,
+        0xffffffffa6fc7723ULL,
+        0x000000000e9ef9eaULL,
+        0x00000000000071c7ULL,
+        0x0000000000002862ULL,                    /*  64  */
+        0x000000001190c4cfULL,
+        0x000000007b7fdbbeULL,
+        0xffffffff9204da99ULL,
+        0x000000001190a13eULL,
+        0x0000000000004d93ULL,
+        0x000000006aef52e2ULL,
+        0xffffffff839453c5ULL,
+        0x000000007b7f4a13ULL,                    /*  72  */
+        0x000000006aefa6beULL,
+        0x000000000000b9cfULL,
+        0xffffffffe97bb8e8ULL,
+        0xffffffff9204accaULL,
+        0xffffffff83944067ULL,
+        0xffffffffe97b5f16ULL,
+        0x0000000000005e31ULL,
+    };
+
+    gettimeofday(&start, NULL);
+
+    for (i = 0; i < PATTERN_INPUTS_64_SHORT_COUNT; i++) {
+        for (j = 0; j < PATTERN_INPUTS_64_SHORT_COUNT; j++) {
+            do_mips64r6_CRC32CH(b64_pattern + i, b64_pattern + j,
+                b64_result + (PATTERN_INPUTS_64_SHORT_COUNT * i + j));
+        }
+    }
+
+    for (i = 0; i < RANDOM_INPUTS_64_SHORT_COUNT; i++) {
+        for (j = 0; j < RANDOM_INPUTS_64_SHORT_COUNT; j++) {
+            do_mips64r6_CRC32CH(b64_random + i, b64_random + j,
+                b64_result + (((PATTERN_INPUTS_64_SHORT_COUNT) *
+                               (PATTERN_INPUTS_64_SHORT_COUNT)) +
+                              RANDOM_INPUTS_64_SHORT_COUNT * i + j));
+        }
+    }
+
+    gettimeofday(&end, NULL);
+
+    elapsed_time = (end.tv_sec - start.tv_sec) * 1000.0;
+    elapsed_time += (end.tv_usec - start.tv_usec) / 1000.0;
+
+    ret = check_results_64(isa_ase_name, group_name, instruction_name,
+                           TEST_COUNT_TOTAL, elapsed_time, b64_result,
+                           b64_expect);
+
+    return ret;
+}
diff --git a/tests/tcg/mips/user/isa/mips64r6/crc/test_mips64r6_crc32cw.c b/tests/tcg/mips/user/isa/mips64r6/crc/test_mips64r6_crc32cw.c
new file mode 100644
index 0000000000..f7110b3a0a
--- /dev/null
+++ b/tests/tcg/mips/user/isa/mips64r6/crc/test_mips64r6_crc32cw.c
@@ -0,0 +1,142 @@
+/*
+ *  Test program for MIPS64R6 instruction CRC32CW
+ *
+ *  Copyright (C) 2019  Wave Computing, Inc.
+ *  Copyright (C) 2019  Aleksandar Markovic <amarkovic@wavecomp.com>
+ *  Copyright (C) 2025  Aleksandar Rakic <aleksandar.rakic@htecgroup.com>
+ *
+ *  SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include <sys/time.h>
+#include <stdint.h>
+
+#include "../../../../include/wrappers_mips64r6.h"
+#include "../../../../include/test_inputs_64.h"
+#include "../../../../include/test_utils_64.h"
+
+#define TEST_COUNT_TOTAL (PATTERN_INPUTS_64_COUNT + RANDOM_INPUTS_64_COUNT)
+
+int32_t main(void)
+{
+    char *isa_ase_name = "mips64r6";
+    char *group_name = "CRC with reversed polynomial 0x82F63B78";
+    char *instruction_name =   "CRC32CW";
+    int32_t ret;
+    uint32_t i, j;
+    struct timeval start, end;
+    double elapsed_time;
+
+    uint64_t b64_result[TEST_COUNT_TOTAL];
+    uint64_t b64_expect[TEST_COUNT_TOTAL] = {
+        0x0000000000000000ULL,                    /*   0  */
+        0xffffffffb798b438ULL,
+        0xffffffff91d3be47ULL,
+        0x00000000264b0a7fULL,
+        0x0000000070b16a3dULL,
+        0xffffffffc729de05ULL,
+        0x0000000063c5950aULL,
+        0xffffffffd45d2132ULL,
+        0xffffffffb798b438ULL,                    /*   8  */
+        0x0000000000000000ULL,
+        0x00000000264b0a7fULL,
+        0xffffffff91d3be47ULL,
+        0xffffffffc729de05ULL,
+        0x0000000070b16a3dULL,
+        0xffffffffd45d2132ULL,
+        0x0000000063c5950aULL,
+        0xffffffff91d3be47ULL,                    /*  16  */
+        0x00000000264b0a7fULL,
+        0x0000000000000000ULL,
+        0xffffffffb798b438ULL,
+        0xffffffffe162d47aULL,
+        0x0000000056fa6042ULL,
+        0xfffffffff2162b4dULL,
+        0x00000000458e9f75ULL,
+        0x00000000264b0a7fULL,                    /*  24  */
+        0xffffffff91d3be47ULL,
+        0xffffffffb798b438ULL,
+        0x0000000000000000ULL,
+        0x0000000056fa6042ULL,
+        0xffffffffe162d47aULL,
+        0x00000000458e9f75ULL,
+        0xfffffffff2162b4dULL,
+        0x0000000070b16a3dULL,                    /*  32  */
+        0xffffffffc729de05ULL,
+        0xffffffffe162d47aULL,
+        0x0000000056fa6042ULL,
+        0x0000000000000000ULL,
+        0xffffffffb798b438ULL,
+        0x000000001374ff37ULL,
+        0xffffffffa4ec4b0fULL,
+        0xffffffffc729de05ULL,                    /*  40  */
+        0x0000000070b16a3dULL,
+        0x0000000056fa6042ULL,
+        0xffffffffe162d47aULL,
+        0xffffffffb798b438ULL,
+        0x0000000000000000ULL,
+        0xffffffffa4ec4b0fULL,
+        0x000000001374ff37ULL,
+        0x0000000063c5950aULL,                    /*  48  */
+        0xffffffffd45d2132ULL,
+        0xfffffffff2162b4dULL,
+        0x00000000458e9f75ULL,
+        0x000000001374ff37ULL,
+        0xffffffffa4ec4b0fULL,
+        0x0000000000000000ULL,
+        0xffffffffb798b438ULL,
+        0xffffffffd45d2132ULL,                    /*  56  */
+        0x0000000063c5950aULL,
+        0x00000000458e9f75ULL,
+        0xfffffffff2162b4dULL,
+        0xffffffffa4ec4b0fULL,
+        0x000000001374ff37ULL,
+        0xffffffffb798b438ULL,
+        0x0000000000000000ULL,
+        0x0000000000000000ULL,                    /*  64  */
+        0xffffffffea0755b2ULL,
+        0x0000000008b188e6ULL,
+        0xffffffffff3cc8d9ULL,
+        0xffffffffea0755b2ULL,
+        0x0000000000000000ULL,
+        0xffffffffe2b6dd54ULL,
+        0x00000000153b9d6bULL,
+        0x0000000008b188e6ULL,                    /*  72  */
+        0xffffffffe2b6dd54ULL,
+        0x0000000000000000ULL,
+        0xfffffffff78d403fULL,
+        0xffffffffff3cc8d9ULL,
+        0x00000000153b9d6bULL,
+        0xfffffffff78d403fULL,
+        0x0000000000000000ULL,
+    };
+
+    gettimeofday(&start, NULL);
+
+    for (i = 0; i < PATTERN_INPUTS_64_SHORT_COUNT; i++) {
+        for (j = 0; j < PATTERN_INPUTS_64_SHORT_COUNT; j++) {
+            do_mips64r6_CRC32CW(b64_pattern + i, b64_pattern + j,
+                b64_result + (PATTERN_INPUTS_64_SHORT_COUNT * i + j));
+        }
+    }
+
+    for (i = 0; i < RANDOM_INPUTS_64_SHORT_COUNT; i++) {
+        for (j = 0; j < RANDOM_INPUTS_64_SHORT_COUNT; j++) {
+            do_mips64r6_CRC32CW(b64_random + i, b64_random + j,
+                b64_result + (((PATTERN_INPUTS_64_SHORT_COUNT) *
+                               (PATTERN_INPUTS_64_SHORT_COUNT)) +
+                              RANDOM_INPUTS_64_SHORT_COUNT * i + j));
+        }
+    }
+
+    gettimeofday(&end, NULL);
+
+    elapsed_time = (end.tv_sec - start.tv_sec) * 1000.0;
+    elapsed_time += (end.tv_usec - start.tv_usec) / 1000.0;
+
+    ret = check_results_64(isa_ase_name, group_name, instruction_name,
+                           TEST_COUNT_TOTAL, elapsed_time, b64_result,
+                           b64_expect);
+
+    return ret;
+}
diff --git a/tests/tcg/mips/user/isa/mips64r6/crc/test_mips64r6_crc32d.c b/tests/tcg/mips/user/isa/mips64r6/crc/test_mips64r6_crc32d.c
new file mode 100644
index 0000000000..e391be803f
--- /dev/null
+++ b/tests/tcg/mips/user/isa/mips64r6/crc/test_mips64r6_crc32d.c
@@ -0,0 +1,142 @@
+/*
+ *  Test program for MIPS64R6 instruction CRC32D
+ *
+ *  Copyright (C) 2019  Wave Computing, Inc.
+ *  Copyright (C) 2019  Aleksandar Markovic <amarkovic@wavecomp.com>
+ *  Copyright (C) 2025  Aleksandar Rakic <aleksandar.rakic@htecgroup.com>
+ *
+ *  SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include <sys/time.h>
+#include <stdint.h>
+
+#include "../../../../include/wrappers_mips64r6.h"
+#include "../../../../include/test_inputs_64.h"
+#include "../../../../include/test_utils_64.h"
+
+#define TEST_COUNT_TOTAL (PATTERN_INPUTS_64_COUNT + RANDOM_INPUTS_64_COUNT)
+
+int32_t main(void)
+{
+    char *isa_ase_name = "mips64r6";
+    char *group_name = "CRC with reversed polynomial 0xEDB88320";
+    char *instruction_name =   "CRC32D";
+    int32_t ret;
+    uint32_t i, j;
+    struct timeval start, end;
+    double elapsed_time;
+
+    uint64_t b64_result[TEST_COUNT_TOTAL];
+    uint64_t b64_expect[TEST_COUNT_TOTAL] = {
+        0xffffffffdebb20e3ULL,                    /*   0  */
+        0x0000000044660075ULL,
+        0x000000001e20c2aeULL,
+        0xffffffff84fde238ULL,
+        0x00000000281d7ce7ULL,
+        0xffffffffb2c05c71ULL,
+        0xffffffffd660a024ULL,
+        0x000000004cbd80b2ULL,
+        0xffffffff9add2096ULL,                    /*   8  */
+        0x0000000000000000ULL,
+        0x000000005a46c2dbULL,
+        0xffffffffc09be24dULL,
+        0x000000006c7b7c92ULL,
+        0xfffffffff6a65c04ULL,
+        0xffffffff9206a051ULL,
+        0x0000000008db80c7ULL,
+        0x000000005449dd0fULL,                    /*  16  */
+        0xffffffffce94fd99ULL,
+        0xffffffff94d23f42ULL,
+        0x000000000e0f1fd4ULL,
+        0xffffffffa2ef810bULL,
+        0x000000003832a19dULL,
+        0x000000005c925dc8ULL,
+        0xffffffffc64f7d5eULL,
+        0x00000000102fdd7aULL,                    /*  24  */
+        0xffffffff8af2fdecULL,
+        0xffffffffd0b43f37ULL,
+        0x000000004a691fa1ULL,
+        0xffffffffe689817eULL,
+        0x000000007c54a1e8ULL,
+        0x0000000018f45dbdULL,
+        0xffffffff82297d2bULL,
+        0xffffffffa7157447ULL,                    /*  32  */
+        0x000000003dc854d1ULL,
+        0x00000000678e960aULL,
+        0xfffffffffd53b69cULL,
+        0x0000000051b32843ULL,
+        0xffffffffcb6e08d5ULL,
+        0xffffffffafcef480ULL,
+        0x000000003513d416ULL,
+        0xffffffffe3737432ULL,                    /*  40  */
+        0x0000000079ae54a4ULL,
+        0x0000000023e8967fULL,
+        0xffffffffb935b6e9ULL,
+        0x0000000015d52836ULL,
+        0xffffffff8f0808a0ULL,
+        0xffffffffeba8f4f5ULL,
+        0x000000007175d463ULL,
+        0x000000007a6adc3eULL,                    /*  48  */
+        0xffffffffe0b7fca8ULL,
+        0xffffffffbaf13e73ULL,
+        0x00000000202c1ee5ULL,
+        0xffffffff8ccc803aULL,
+        0x000000001611a0acULL,
+        0x0000000072b15cf9ULL,
+        0xffffffffe86c7c6fULL,
+        0x000000003e0cdc4bULL,                    /*  56  */
+        0xffffffffa4d1fcddULL,
+        0xfffffffffe973e06ULL,
+        0x00000000644a1e90ULL,
+        0xffffffffc8aa804fULL,
+        0x000000005277a0d9ULL,
+        0x0000000036d75c8cULL,
+        0xffffffffac0a7c1aULL,
+        0xffffffffed857593ULL,                    /*  64  */
+        0xffffffffe0b6f95fULL,
+        0x00000000253b462cULL,
+        0xffffffffe15579b9ULL,
+        0x0000000074897c83ULL,
+        0x0000000079baf04fULL,
+        0xffffffffbc374f3cULL,
+        0x00000000785970a9ULL,
+        0xffffffffa6bae0a9ULL,                    /*  72  */
+        0xffffffffab896c65ULL,
+        0x000000006e04d316ULL,
+        0xffffffffaa6aec83ULL,
+        0x000000005ae171feULL,
+        0x0000000057d2fd32ULL,
+        0xffffffff925f4241ULL,
+        0x0000000056317dd4ULL,
+    };
+
+    gettimeofday(&start, NULL);
+
+    for (i = 0; i < PATTERN_INPUTS_64_SHORT_COUNT; i++) {
+        for (j = 0; j < PATTERN_INPUTS_64_SHORT_COUNT; j++) {
+            do_mips64r6_CRC32D(b64_pattern + i, b64_pattern + j,
+                b64_result + (PATTERN_INPUTS_64_SHORT_COUNT * i + j));
+        }
+    }
+
+    for (i = 0; i < RANDOM_INPUTS_64_SHORT_COUNT; i++) {
+        for (j = 0; j < RANDOM_INPUTS_64_SHORT_COUNT; j++) {
+            do_mips64r6_CRC32D(b64_random + i, b64_random + j,
+                b64_result + (((PATTERN_INPUTS_64_SHORT_COUNT) *
+                               (PATTERN_INPUTS_64_SHORT_COUNT)) +
+                              RANDOM_INPUTS_64_SHORT_COUNT * i + j));
+        }
+    }
+
+    gettimeofday(&end, NULL);
+
+    elapsed_time = (end.tv_sec - start.tv_sec) * 1000.0;
+    elapsed_time += (end.tv_usec - start.tv_usec) / 1000.0;
+
+    ret = check_results_64(isa_ase_name, group_name, instruction_name,
+                           TEST_COUNT_TOTAL, elapsed_time, b64_result,
+                           b64_expect);
+
+    return ret;
+}
diff --git a/tests/tcg/mips/user/isa/mips64r6/crc/test_mips64r6_crc32h.c b/tests/tcg/mips/user/isa/mips64r6/crc/test_mips64r6_crc32h.c
new file mode 100644
index 0000000000..100f02c7dd
--- /dev/null
+++ b/tests/tcg/mips/user/isa/mips64r6/crc/test_mips64r6_crc32h.c
@@ -0,0 +1,142 @@
+/*
+ *  Test program for MIPS64R6 instruction CRC32H
+ *
+ *  Copyright (C) 2019  Wave Computing, Inc.
+ *  Copyright (C) 2019  Aleksandar Markovic <amarkovic@wavecomp.com>
+ *  Copyright (C) 2025  Aleksandar Rakic <aleksandar.rakic@htecgroup.com>
+ *
+ *  SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include <sys/time.h>
+#include <stdint.h>
+
+#include "../../../../include/wrappers_mips64r6.h"
+#include "../../../../include/test_inputs_64.h"
+#include "../../../../include/test_utils_64.h"
+
+#define TEST_COUNT_TOTAL (PATTERN_INPUTS_64_COUNT + RANDOM_INPUTS_64_COUNT)
+
+int32_t main(void)
+{
+    char *isa_ase_name = "mips64r6";
+    char *group_name = "CRC with reversed polynomial 0xEDB88320";
+    char *instruction_name =   "CRC32H";
+    int32_t ret;
+    uint32_t i, j;
+    struct timeval start, end;
+    double elapsed_time;
+
+    uint64_t b64_result[TEST_COUNT_TOTAL];
+    uint64_t b64_expect[TEST_COUNT_TOTAL] = {
+        0x000000000000ffffULL,                    /*   0  */
+        0xffffffffbe2612ffULL,
+        0xffffffffdccda6c0ULL,
+        0x0000000062eb4bc0ULL,
+        0x000000004bbbc8eaULL,
+        0xfffffffff59d25eaULL,
+        0x0000000022259ac0ULL,
+        0xffffffff9c0377c0ULL,
+        0xffffffffbe26ed00ULL,                    /*   8  */
+        0x0000000000000000ULL,
+        0x0000000062ebb43fULL,
+        0xffffffffdccd593fULL,
+        0xfffffffff59dda15ULL,
+        0x000000004bbb3715ULL,
+        0xffffffff9c03883fULL,
+        0x000000002225653fULL,
+        0xffffffffdccdf395ULL,                    /*  16  */
+        0x0000000062eb1e95ULL,
+        0x000000000000aaaaULL,
+        0xffffffffbe2647aaULL,
+        0xffffffff9776c480ULL,
+        0x0000000029502980ULL,
+        0xfffffffffee896aaULL,
+        0x0000000040ce7baaULL,
+        0x0000000062ebe16aULL,                    /*  24  */
+        0xffffffffdccd0c6aULL,
+        0xffffffffbe26b855ULL,
+        0x0000000000005555ULL,
+        0x000000002950d67fULL,
+        0xffffffff97763b7fULL,
+        0x0000000040ce8455ULL,
+        0xfffffffffee86955ULL,
+        0x000000004bbbfbd9ULL,                    /*  32  */
+        0xfffffffff59d16d9ULL,
+        0xffffffff9776a2e6ULL,
+        0x0000000029504fe6ULL,
+        0x000000000000ccccULL,
+        0xffffffffbe2621ccULL,
+        0x00000000699e9ee6ULL,
+        0xffffffffd7b873e6ULL,
+        0xfffffffff59de926ULL,                    /*  40  */
+        0x000000004bbb0426ULL,
+        0x000000002950b019ULL,
+        0xffffffff97765d19ULL,
+        0xffffffffbe26de33ULL,
+        0x0000000000003333ULL,
+        0xffffffffd7b88c19ULL,
+        0x00000000699e6119ULL,
+        0x000000002225eb07ULL,                    /*  48  */
+        0xffffffff9c030607ULL,
+        0xfffffffffee8b238ULL,
+        0x0000000040ce5f38ULL,
+        0x00000000699edc12ULL,
+        0xffffffffd7b83112ULL,
+        0x0000000000008e38ULL,
+        0xffffffffbe266338ULL,
+        0xffffffff9c03f9f8ULL,                    /*  56  */
+        0x00000000222514f8ULL,
+        0x0000000040cea0c7ULL,
+        0xfffffffffee84dc7ULL,
+        0xffffffffd7b8ceedULL,
+        0x00000000699e23edULL,
+        0xffffffffbe269cc7ULL,
+        0x00000000000071c7ULL,
+        0x0000000000002862ULL,                    /*  64  */
+        0x0000000026a17af6ULL,
+        0xffffffffaa919152ULL,
+        0xffffffffcb865590ULL,
+        0x0000000026a11f07ULL,
+        0x0000000000004d93ULL,
+        0xffffffff8c30a637ULL,
+        0xffffffffed2762f5ULL,
+        0xffffffffaa9100ffULL,                    /*  72  */
+        0xffffffff8c30526bULL,
+        0x000000000000b9cfULL,
+        0x0000000061177d0dULL,
+        0xffffffffcb8623c3ULL,
+        0xffffffffed277157ULL,
+        0x0000000061179af3ULL,
+        0x0000000000005e31ULL
+    };
+
+    gettimeofday(&start, NULL);
+
+    for (i = 0; i < PATTERN_INPUTS_64_SHORT_COUNT; i++) {
+        for (j = 0; j < PATTERN_INPUTS_64_SHORT_COUNT; j++) {
+            do_mips64r6_CRC32H(b64_pattern + i, b64_pattern + j,
+                b64_result + (PATTERN_INPUTS_64_SHORT_COUNT * i + j));
+        }
+    }
+
+    for (i = 0; i < RANDOM_INPUTS_64_SHORT_COUNT; i++) {
+        for (j = 0; j < RANDOM_INPUTS_64_SHORT_COUNT; j++) {
+            do_mips64r6_CRC32H(b64_random + i, b64_random + j,
+                b64_result + (((PATTERN_INPUTS_64_SHORT_COUNT) *
+                               (PATTERN_INPUTS_64_SHORT_COUNT)) +
+                              RANDOM_INPUTS_64_SHORT_COUNT * i + j));
+        }
+    }
+
+    gettimeofday(&end, NULL);
+
+    elapsed_time = (end.tv_sec - start.tv_sec) * 1000.0;
+    elapsed_time += (end.tv_usec - start.tv_usec) / 1000.0;
+
+    ret = check_results_64(isa_ase_name, group_name, instruction_name,
+                           TEST_COUNT_TOTAL, elapsed_time, b64_result,
+                           b64_expect);
+
+    return ret;
+}
diff --git a/tests/tcg/mips/user/isa/mips64r6/crc/test_mips64r6_crc32w.c b/tests/tcg/mips/user/isa/mips64r6/crc/test_mips64r6_crc32w.c
new file mode 100644
index 0000000000..b4f5f4bbee
--- /dev/null
+++ b/tests/tcg/mips/user/isa/mips64r6/crc/test_mips64r6_crc32w.c
@@ -0,0 +1,142 @@
+/*
+ *  Test program for MIPS64R6 instruction CRC32W
+ *
+ *  Copyright (C) 2019  Wave Computing, Inc.
+ *  Copyright (C) 2019  Aleksandar Markovic <amarkovic@wavecomp.com>
+ *  Copyright (C) 2025  Aleksandar Rakic <aleksandar.rakic@htecgroup.com>
+ *
+ *  SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include <sys/time.h>
+#include <stdint.h>
+
+#include "../../../../include/wrappers_mips64r6.h"
+#include "../../../../include/test_inputs_64.h"
+#include "../../../../include/test_utils_64.h"
+
+#define TEST_COUNT_TOTAL (PATTERN_INPUTS_64_COUNT + RANDOM_INPUTS_64_COUNT)
+
+int32_t main(void)
+{
+    char *isa_ase_name = "mips64r6";
+    char *group_name = "CRC with reversed polynomial 0xEDB88320";
+    char *instruction_name =   "CRC32W";
+    int32_t ret;
+    uint32_t i, j;
+    struct timeval start, end;
+    double elapsed_time;
+
+    uint64_t b64_result[TEST_COUNT_TOTAL];
+    uint64_t b64_expect[TEST_COUNT_TOTAL] = {
+        0x0000000000000000ULL,                    /*   0  */
+        0xffffffffdebb20e3ULL,
+        0x000000004a691fa1ULL,
+        0xffffffff94d23f42ULL,
+        0xffffffff8f0808a0ULL,
+        0x0000000051b32843ULL,
+        0x0000000065069dceULL,
+        0xffffffffbbbdbd2dULL,
+        0xffffffffdebb20e3ULL,                    /*   8  */
+        0x0000000000000000ULL,
+        0xffffffff94d23f42ULL,
+        0x000000004a691fa1ULL,
+        0x0000000051b32843ULL,
+        0xffffffff8f0808a0ULL,
+        0xffffffffbbbdbd2dULL,
+        0x0000000065069dceULL,
+        0x000000004a691fa1ULL,                    /*  16  */
+        0xffffffff94d23f42ULL,
+        0x0000000000000000ULL,
+        0xffffffffdebb20e3ULL,
+        0xffffffffc5611701ULL,
+        0x000000001bda37e2ULL,
+        0x000000002f6f826fULL,
+        0xfffffffff1d4a28cULL,
+        0xffffffff94d23f42ULL,                    /*  24  */
+        0x000000004a691fa1ULL,
+        0xffffffffdebb20e3ULL,
+        0x0000000000000000ULL,
+        0x000000001bda37e2ULL,
+        0xffffffffc5611701ULL,
+        0xfffffffff1d4a28cULL,
+        0x000000002f6f826fULL,
+        0xffffffff8f0808a0ULL,                    /*  32  */
+        0x0000000051b32843ULL,
+        0xffffffffc5611701ULL,
+        0x000000001bda37e2ULL,
+        0x0000000000000000ULL,
+        0xffffffffdebb20e3ULL,
+        0xffffffffea0e956eULL,
+        0x0000000034b5b58dULL,
+        0x0000000051b32843ULL,                    /*  40  */
+        0xffffffff8f0808a0ULL,
+        0x000000001bda37e2ULL,
+        0xffffffffc5611701ULL,
+        0xffffffffdebb20e3ULL,
+        0x0000000000000000ULL,
+        0x0000000034b5b58dULL,
+        0xffffffffea0e956eULL,
+        0x0000000065069dceULL,                    /*  48  */
+        0xffffffffbbbdbd2dULL,
+        0x000000002f6f826fULL,
+        0xfffffffff1d4a28cULL,
+        0xffffffffea0e956eULL,
+        0x0000000034b5b58dULL,
+        0x0000000000000000ULL,
+        0xffffffffdebb20e3ULL,
+        0xffffffffbbbdbd2dULL,                    /*  56  */
+        0x0000000065069dceULL,
+        0xfffffffff1d4a28cULL,
+        0x000000002f6f826fULL,
+        0x0000000034b5b58dULL,
+        0xffffffffea0e956eULL,
+        0xffffffffdebb20e3ULL,
+        0x0000000000000000ULL,
+        0x0000000000000000ULL,                    /*  64  */
+        0xffffffff90485967ULL,
+        0x000000006dfb974aULL,
+        0x00000000083e4538ULL,
+        0xffffffff90485967ULL,
+        0x0000000000000000ULL,
+        0xfffffffffdb3ce2dULL,
+        0xffffffff98761c5fULL,
+        0x000000006dfb974aULL,                    /*  72  */
+        0xfffffffffdb3ce2dULL,
+        0x0000000000000000ULL,
+        0x0000000065c5d272ULL,
+        0x00000000083e4538ULL,
+        0xffffffff98761c5fULL,
+        0x0000000065c5d272ULL,
+        0x0000000000000000ULL,
+    };
+
+    gettimeofday(&start, NULL);
+
+    for (i = 0; i < PATTERN_INPUTS_64_SHORT_COUNT; i++) {
+        for (j = 0; j < PATTERN_INPUTS_64_SHORT_COUNT; j++) {
+            do_mips64r6_CRC32W(b64_pattern + i, b64_pattern + j,
+                b64_result + (PATTERN_INPUTS_64_SHORT_COUNT * i + j));
+        }
+    }
+
+    for (i = 0; i < RANDOM_INPUTS_64_SHORT_COUNT; i++) {
+        for (j = 0; j < RANDOM_INPUTS_64_SHORT_COUNT; j++) {
+            do_mips64r6_CRC32W(b64_random + i, b64_random + j,
+                b64_result + (((PATTERN_INPUTS_64_SHORT_COUNT) *
+                               (PATTERN_INPUTS_64_SHORT_COUNT)) +
+                              RANDOM_INPUTS_64_SHORT_COUNT * i + j));
+        }
+    }
+
+    gettimeofday(&end, NULL);
+
+    elapsed_time = (end.tv_sec - start.tv_sec) * 1000.0;
+    elapsed_time += (end.tv_usec - start.tv_usec) / 1000.0;
+
+    ret = check_results_64(isa_ase_name, group_name, instruction_name,
+                           TEST_COUNT_TOTAL, elapsed_time, b64_result,
+                           b64_expect);
+
+    return ret;
+}

From a598090ebaeb930ce33c2df0d80d87da13be8848 Mon Sep 17 00:00:00 2001
From: Cole Robinson <crobinso@redhat.com>
Date: Sun, 18 May 2025 13:54:20 -0400
Subject: [PATCH 2344/2760] roms: re-remove execute bit from hppa-firmware*
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This was fixed in c9d77526bddba0803a1fa982fb59ec98057150f9 for
9.2.0 but regressed in db34be329162cf6b06192703065e6c1010dbe3c5 in
10.0.0

When the bit is present, rpmbuild complains about missing ELF build-id

Signed-off-by: Cole Robinson <crobinso@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Acked-by: Helge Deller <deller@gmx.de>
Message-ID: <52d0edfbb9b2f63a866f0065a721f3a95da6f8ba.1747590860.git.crobinso@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 pc-bios/hppa-firmware.img   | Bin
 pc-bios/hppa-firmware64.img | Bin
 2 files changed, 0 insertions(+), 0 deletions(-)
 mode change 100755 => 100644 pc-bios/hppa-firmware.img
 mode change 100755 => 100644 pc-bios/hppa-firmware64.img

diff --git a/pc-bios/hppa-firmware.img b/pc-bios/hppa-firmware.img
old mode 100755
new mode 100644
diff --git a/pc-bios/hppa-firmware64.img b/pc-bios/hppa-firmware64.img
old mode 100755
new mode 100644

From 63e7af2035242dda6e2460f4eadbbe6f58c67614 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 25 Jun 2025 23:59:49 +0200
Subject: [PATCH 2345/2760] hw/mips: Restrict ITU to TCG
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

MIPS Inter-Thread Communication Unit is implemented using
TCG. Check for TCG both in Kconfig and CPS source.

Fixes: 2321d971b6f ("hw/mips: Add dependency MIPS_CPS -> MIPS_ITU")
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250702164953.18579-1-philmd@linaro.org>
---
 hw/mips/Kconfig | 2 +-
 hw/mips/cps.c   | 4 ++--
 hw/misc/Kconfig | 1 +
 3 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/hw/mips/Kconfig b/hw/mips/Kconfig
index b09c89a017..f84fffcd32 100644
--- a/hw/mips/Kconfig
+++ b/hw/mips/Kconfig
@@ -76,7 +76,7 @@ config LOONGSON3V
 
 config MIPS_CPS
     bool
-    select MIPS_ITU
+    select MIPS_ITU if TCG
 
 config MIPS_BOSTON
     bool
diff --git a/hw/mips/cps.c b/hw/mips/cps.c
index 2a3ba3f58d..e47695e2b0 100644
--- a/hw/mips/cps.c
+++ b/hw/mips/cps.c
@@ -24,7 +24,7 @@
 #include "hw/mips/mips.h"
 #include "hw/qdev-clock.h"
 #include "hw/qdev-properties.h"
-#include "system/kvm.h"
+#include "system/tcg.h"
 #include "system/reset.h"
 
 qemu_irq get_cps_irq(MIPSCPSState *s, int pin_number)
@@ -59,7 +59,7 @@ static bool cpu_mips_itu_supported(CPUMIPSState *env)
 {
     bool is_mt = (env->CP0_Config5 & (1 << CP0C5_VP)) || ase_mt_available(env);
 
-    return is_mt && !kvm_enabled();
+    return is_mt && tcg_enabled();
 }
 
 static void mips_cps_realize(DeviceState *dev, Error **errp)
diff --git a/hw/misc/Kconfig b/hw/misc/Kconfig
index c27285b47a..4e35657468 100644
--- a/hw/misc/Kconfig
+++ b/hw/misc/Kconfig
@@ -119,6 +119,7 @@ config STM32L4X5_RCC
 
 config MIPS_ITU
     bool
+    depends on TCG
 
 config MPS2_FPGAIO
     bool

From 83110a6c662f392360b2d235de6c96cd09370823 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 8 Jul 2025 10:55:20 +0200
Subject: [PATCH 2346/2760] hw/intc/loongarch_extioi: Remove unnecessary
 'qemu/typedefs.h' include
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

"qemu/typedefs.h" is already included by "qemu/osdep.h".

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Song Gao <gaosong@loongson.cn>
Message-Id: <20250708085859.7885-2-philmd@linaro.org>
---
 hw/intc/loongarch_extioi_kvm.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/hw/intc/loongarch_extioi_kvm.c b/hw/intc/loongarch_extioi_kvm.c
index 0133540c45..aa2e8c753f 100644
--- a/hw/intc/loongarch_extioi_kvm.c
+++ b/hw/intc/loongarch_extioi_kvm.c
@@ -6,7 +6,6 @@
  */
 
 #include "qemu/osdep.h"
-#include "qemu/typedefs.h"
 #include "hw/intc/loongarch_extioi.h"
 #include "linux/kvm.h"
 #include "qapi/error.h"

From 07e8cd2b8c757d646178879169df79fbf0a09eda Mon Sep 17 00:00:00 2001
From: Bernhard Beschow <shentey@gmail.com>
Date: Tue, 8 Jul 2025 22:48:04 +0200
Subject: [PATCH 2347/2760] hw/microblaze: Add missing FDT dependency
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

These boards ship with a bundled DTB, and dtc will be required for generating
these from device tree sources. Prepare for that by adding an FDT dependency.

Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250708204806.1898-2-shentey@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/microblaze/Kconfig | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/microblaze/Kconfig b/hw/microblaze/Kconfig
index b0214b2c8b..72d8072f76 100644
--- a/hw/microblaze/Kconfig
+++ b/hw/microblaze/Kconfig
@@ -1,7 +1,7 @@
 config PETALOGIX_S3ADSP1800
     bool
     default y
-    depends on MICROBLAZE
+    depends on MICROBLAZE && FDT
     select PFLASH_CFI01
     select XILINX
     select XILINX_AXI
@@ -11,7 +11,7 @@ config PETALOGIX_S3ADSP1800
 config PETALOGIX_ML605
     bool
     default y
-    depends on MICROBLAZE
+    depends on MICROBLAZE && FDT
     select PFLASH_CFI01
     select SERIAL_MM
     select SSI_M25P80

From 1fa3812ee884dba8dbbd9d2f121b10c67469cae3 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Date: Fri, 11 Jul 2025 21:46:30 +0100
Subject: [PATCH 2348/2760] esp.c: only raise IRQ in esp_transfer_data() for
 CMD_SEL, CMD_SELATN and CMD_TI commands
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Clarify the logic in esp_transfer_data() to ensure that the deferred interrupt code
can only be triggered for CMD_SEL, CMD_SELATN and CMD_TI commands. This should already
be the case, but make it explicit to ensure the logic isn't triggered unexpectedly.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250711204636.542964-2-mark.cave-ayland@ilande.co.uk>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/scsi/esp.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/hw/scsi/esp.c b/hw/scsi/esp.c
index f24991fd16..9181c8810f 100644
--- a/hw/scsi/esp.c
+++ b/hw/scsi/esp.c
@@ -1012,6 +1012,7 @@ void esp_transfer_data(SCSIRequest *req, uint32_t len)
              */
              s->rregs[ESP_RINTR] |= INTR_BS | INTR_FC;
              s->rregs[ESP_RSEQ] = SEQ_CD;
+             esp_raise_irq(s);
              break;
 
         case CMD_SELATNS | CMD_DMA:
@@ -1022,6 +1023,7 @@ void esp_transfer_data(SCSIRequest *req, uint32_t len)
              */
              s->rregs[ESP_RINTR] |= INTR_BS;
              s->rregs[ESP_RSEQ] = SEQ_MO;
+             esp_raise_irq(s);
              break;
 
         case CMD_TI | CMD_DMA:
@@ -1032,10 +1034,9 @@ void esp_transfer_data(SCSIRequest *req, uint32_t len)
              */
             s->rregs[ESP_CMD] = 0;
             s->rregs[ESP_RINTR] |= INTR_BS;
+            esp_raise_irq(s);
             break;
         }
-
-        esp_raise_irq(s);
     }
 
     /*

From daaaec4f54ae0ad3e4304dc55c3c0f159988d773 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Date: Fri, 11 Jul 2025 21:46:31 +0100
Subject: [PATCH 2349/2760] esp.c: improve comment in esp_transfer_data()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Whilst working on the previous patch, the existing comment was not enough to
document when the TI command codepath was being used. Update and improve the
comment accordingly.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250711204636.542964-3-mark.cave-ayland@ilande.co.uk>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/scsi/esp.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/hw/scsi/esp.c b/hw/scsi/esp.c
index 9181c8810f..62ba406149 100644
--- a/hw/scsi/esp.c
+++ b/hw/scsi/esp.c
@@ -1029,8 +1029,9 @@ void esp_transfer_data(SCSIRequest *req, uint32_t len)
         case CMD_TI | CMD_DMA:
         case CMD_TI:
             /*
-             * Bus service interrupt raised because of initial change to
-             * DATA phase
+             * If the final COMMAND phase data was transferred using a TI
+             * command, clear ESP_CMD to terminate the TI command and raise
+             * the completion interrupt
              */
             s->rregs[ESP_CMD] = 0;
             s->rregs[ESP_RINTR] |= INTR_BS;

From e70aa5dc299c49c59bd91c80e771db56996c2188 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Date: Fri, 11 Jul 2025 21:46:32 +0100
Subject: [PATCH 2350/2760] esp.h: remove separate ESPState typedef
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This is not needed as it is now handled by the OBJECT_DECLARE_SIMPLE_TYPE() macro.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250711204636.542964-4-mark.cave-ayland@ilande.co.uk>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 include/hw/scsi/esp.h | 2 --
 1 file changed, 2 deletions(-)

diff --git a/include/hw/scsi/esp.h b/include/hw/scsi/esp.h
index 533d856aa3..c9afcb7cac 100644
--- a/include/hw/scsi/esp.h
+++ b/include/hw/scsi/esp.h
@@ -14,8 +14,6 @@ typedef void (*ESPDMAMemoryReadWriteFunc)(void *opaque, uint8_t *buf, int len);
 #define ESP_FIFO_SZ 16
 #define ESP_CMDFIFO_SZ 32
 
-typedef struct ESPState ESPState;
-
 #define TYPE_ESP "esp"
 OBJECT_DECLARE_SIMPLE_TYPE(ESPState, ESP)
 

From 9d6df740ec5e43bd8e4521901aca95f9780e524a Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Date: Fri, 11 Jul 2025 21:46:33 +0100
Subject: [PATCH 2351/2760] esp.c: only call dma_memory_read function if
 transfer length is non-zero
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In the cases where mixed DMA/non-DMA transfers are used or no data is
available, it is possible for the calculated transfer length to be zero.
Only call the dma_memory_read function where the transfer length is
non-zero to avoid invoking the DMA engine for a zero length transfer
which can have side-effects (along with generating additional tracing
noise).

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250711204636.542964-5-mark.cave-ayland@ilande.co.uk>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/scsi/esp.c | 20 +++++++++++++-------
 1 file changed, 13 insertions(+), 7 deletions(-)

diff --git a/hw/scsi/esp.c b/hw/scsi/esp.c
index 62ba406149..ec9fcbeddf 100644
--- a/hw/scsi/esp.c
+++ b/hw/scsi/esp.c
@@ -487,8 +487,10 @@ static void esp_do_dma(ESPState *s)
     case STAT_MO:
         if (s->dma_memory_read) {
             len = MIN(len, fifo8_num_free(&s->cmdfifo));
-            s->dma_memory_read(s->dma_opaque, buf, len);
-            esp_set_tc(s, esp_get_tc(s) - len);
+            if (len) {
+                s->dma_memory_read(s->dma_opaque, buf, len);
+                esp_set_tc(s, esp_get_tc(s) - len);
+            }
         } else {
             len = esp_fifo_pop_buf(s, buf, fifo8_num_used(&s->fifo));
             len = MIN(fifo8_num_free(&s->cmdfifo), len);
@@ -541,9 +543,11 @@ static void esp_do_dma(ESPState *s)
         trace_esp_do_dma(cmdlen, len);
         if (s->dma_memory_read) {
             len = MIN(len, fifo8_num_free(&s->cmdfifo));
-            s->dma_memory_read(s->dma_opaque, buf, len);
-            fifo8_push_all(&s->cmdfifo, buf, len);
-            esp_set_tc(s, esp_get_tc(s) - len);
+            if (len) {
+                s->dma_memory_read(s->dma_opaque, buf, len);
+                fifo8_push_all(&s->cmdfifo, buf, len);
+                esp_set_tc(s, esp_get_tc(s) - len);
+            }
         } else {
             len = esp_fifo_pop_buf(s, buf, fifo8_num_used(&s->fifo));
             len = MIN(fifo8_num_free(&s->cmdfifo), len);
@@ -572,8 +576,10 @@ static void esp_do_dma(ESPState *s)
         switch (s->rregs[ESP_CMD]) {
         case CMD_TI | CMD_DMA:
             if (s->dma_memory_read) {
-                s->dma_memory_read(s->dma_opaque, s->async_buf, len);
-                esp_set_tc(s, esp_get_tc(s) - len);
+                if (len) {
+                    s->dma_memory_read(s->dma_opaque, s->async_buf, len);
+                    esp_set_tc(s, esp_get_tc(s) - len);
+                }
             } else {
                 /* Copy FIFO data to device */
                 len = MIN(s->async_len, ESP_FIFO_SZ);

From 28a579a349015a7ed5a57cb4bdcdc5c60ba6b6fc Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Date: Fri, 11 Jul 2025 21:46:34 +0100
Subject: [PATCH 2352/2760] esp.c: only call dma_memory_write function if
 transfer length is non-zero
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In the cases where mixed DMA/non-DMA transfers are used or no data is
available, it is possible for the calculated transfer length to be zero.
Only call the dma_memory_write function where the transfer length is
non-zero to avoid invoking the DMA engine for a zero length transfer
which can have side-effects (along with generating additional tracing
noise).

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250711204636.542964-6-mark.cave-ayland@ilande.co.uk>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/scsi/esp.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/hw/scsi/esp.c b/hw/scsi/esp.c
index ec9fcbeddf..1c7bad8fc0 100644
--- a/hw/scsi/esp.c
+++ b/hw/scsi/esp.c
@@ -631,7 +631,9 @@ static void esp_do_dma(ESPState *s)
         switch (s->rregs[ESP_CMD]) {
         case CMD_TI | CMD_DMA:
             if (s->dma_memory_write) {
-                s->dma_memory_write(s->dma_opaque, s->async_buf, len);
+                if (len) {
+                    s->dma_memory_write(s->dma_opaque, s->async_buf, len);
+                }
             } else {
                 /* Copy device data to FIFO */
                 len = MIN(len, fifo8_num_free(&s->fifo));
@@ -681,6 +683,7 @@ static void esp_do_dma(ESPState *s)
                 buf[0] = s->status;
 
                 if (s->dma_memory_write) {
+                    /* Length already non-zero */
                     s->dma_memory_write(s->dma_opaque, buf, len);
                 } else {
                     esp_fifo_push_buf(s, buf, len);
@@ -715,6 +718,7 @@ static void esp_do_dma(ESPState *s)
                 buf[0] = 0;
 
                 if (s->dma_memory_write) {
+                    /* Length already non-zero */
                     s->dma_memory_write(s->dma_opaque, buf, len);
                 } else {
                     esp_fifo_push_buf(s, buf, len);

From ab1207401edc19d17fad6cb473cd6beae31b1dd1 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Date: Fri, 11 Jul 2025 21:46:35 +0100
Subject: [PATCH 2353/2760] esp.c: add asc_mode property to indicate the
 current ESP mode
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add a new asc_mode property to ESPState which indicates the current mode of
the ESP and update the ESP state machine accordingly.

Bump the vmstate version and include migration logic to ensure that asc_mode
is set to initiator mode such that any commands in progress will always
continue.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250711204636.542964-7-mark.cave-ayland@ilande.co.uk>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/scsi/esp.c         | 21 ++++++++++++++++++++-
 include/hw/scsi/esp.h |  7 +++++++
 2 files changed, 27 insertions(+), 1 deletion(-)

diff --git a/hw/scsi/esp.c b/hw/scsi/esp.c
index 1c7bad8fc0..4aa58f9e48 100644
--- a/hw/scsi/esp.c
+++ b/hw/scsi/esp.c
@@ -275,6 +275,7 @@ static int esp_select(ESPState *s)
     if (!s->current_dev) {
         /* No such drive */
         s->rregs[ESP_RSTAT] = 0;
+        s->asc_mode = ESP_ASC_MODE_DIS;
         s->rregs[ESP_RINTR] = INTR_DC;
         esp_raise_irq(s);
         return -1;
@@ -284,6 +285,7 @@ static int esp_select(ESPState *s)
      * Note that we deliberately don't raise the IRQ here: this will be done
      * either in esp_transfer_data() or esp_command_complete()
      */
+    s->asc_mode = ESP_ASC_MODE_INI;
     return 0;
 }
 
@@ -308,6 +310,7 @@ static void do_command_phase(ESPState *s)
     if (!current_lun) {
         /* No such drive */
         s->rregs[ESP_RSTAT] = 0;
+        s->asc_mode = ESP_ASC_MODE_DIS;
         s->rregs[ESP_RINTR] = INTR_DC;
         s->rregs[ESP_RSEQ] = SEQ_0;
         esp_raise_irq(s);
@@ -1102,6 +1105,7 @@ void esp_hard_reset(ESPState *s)
     fifo8_reset(&s->cmdfifo);
     s->dma = 0;
     s->dma_cb = NULL;
+    s->asc_mode = ESP_ASC_MODE_DIS;
 
     s->rregs[ESP_CFG1] = 7;
 }
@@ -1170,6 +1174,7 @@ static void esp_run_cmd(ESPState *s)
         break;
     case CMD_MSGACC:
         trace_esp_mem_writeb_cmd_msgacc(cmd);
+        s->asc_mode = ESP_ASC_MODE_DIS;
         s->rregs[ESP_RINTR] |= INTR_DC;
         s->rregs[ESP_RSEQ] = 0;
         s->rregs[ESP_RFLAGS] = 0;
@@ -1337,6 +1342,14 @@ static bool esp_is_between_version_5_and_6(void *opaque, int version_id)
     return version_id >= 5 && version_id <= 6;
 }
 
+static bool esp_is_version_8(void *opaque, int version_id)
+{
+    ESPState *s = ESP(opaque);
+
+    version_id = MIN(version_id, s->mig_version_id);
+    return version_id >= 8;
+}
+
 int esp_pre_save(void *opaque)
 {
     ESPState *s = ESP(object_resolve_path_component(
@@ -1368,13 +1381,18 @@ static int esp_post_load(void *opaque, int version_id)
         }
     }
 
+    if (version_id < 8) {
+        /* Assume initiator mode to allow all commands to continue */
+        s->asc_mode = ESP_ASC_MODE_INI;
+    }
+
     s->mig_version_id = vmstate_esp.version_id;
     return 0;
 }
 
 const VMStateDescription vmstate_esp = {
     .name = "esp",
-    .version_id = 7,
+    .version_id = 8,
     .minimum_version_id = 3,
     .post_load = esp_post_load,
     .fields = (const VMStateField[]) {
@@ -1406,6 +1424,7 @@ const VMStateDescription vmstate_esp = {
                            esp_is_between_version_5_and_6),
         VMSTATE_UINT8_TEST(lun, ESPState, esp_is_version_6),
         VMSTATE_BOOL(drq_state, ESPState),
+        VMSTATE_UINT8_TEST(asc_mode, ESPState, esp_is_version_8),
         VMSTATE_END_OF_LIST()
     },
 };
diff --git a/include/hw/scsi/esp.h b/include/hw/scsi/esp.h
index c9afcb7cac..6327060c7c 100644
--- a/include/hw/scsi/esp.h
+++ b/include/hw/scsi/esp.h
@@ -14,6 +14,12 @@ typedef void (*ESPDMAMemoryReadWriteFunc)(void *opaque, uint8_t *buf, int len);
 #define ESP_FIFO_SZ 16
 #define ESP_CMDFIFO_SZ 32
 
+enum ESPASCMode {
+    ESP_ASC_MODE_DIS = 0,    /* Disconnected */
+    ESP_ASC_MODE_INI = 1,    /* Initiator */
+    ESP_ASC_MODE_TGT = 2     /* Target */
+};
+
 #define TYPE_ESP "esp"
 OBJECT_DECLARE_SIMPLE_TYPE(ESPState, ESP)
 
@@ -38,6 +44,7 @@ struct ESPState {
     uint8_t cmdfifo_cdb_offset;
     uint8_t lun;
     uint32_t do_cmd;
+    uint8_t asc_mode;
 
     bool data_ready;
     int dma_enabled;

From 6f8ce26bb00db66e6cec632f16df3cd13e4df934 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Date: Fri, 11 Jul 2025 21:46:36 +0100
Subject: [PATCH 2354/2760] esp.c: only allow ESP commands permitted in the
 current asc_mode
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

If an ESP command is issued in an incorrect mode then an illegal command
interrupt should be generated. Add a new esp_cmd_is_valid() function to
indicate whether the ESP command is valid for the current mode, and if not
then raise the illegal command interrupt.

This fixes WinNT MIPS which issues ICCS after a Chip Reset which is not
permitted, but will fail with an INACCESSIBLE_BOOT_DEVICE error unless an
interrupt is generated.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Fixes: 83428f7a97 ("esp.c: move write_response() non-DMA logic to esp_do_nodma()")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2464
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250711204636.542964-8-mark.cave-ayland@ilande.co.uk>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/scsi/esp.c         | 37 +++++++++++++++++++++++++++++++++++++
 hw/scsi/trace-events  |  1 +
 include/hw/scsi/esp.h |  8 ++++++++
 3 files changed, 46 insertions(+)

diff --git a/hw/scsi/esp.c b/hw/scsi/esp.c
index 4aa58f9e48..1d264c40e5 100644
--- a/hw/scsi/esp.c
+++ b/hw/scsi/esp.c
@@ -1129,6 +1129,38 @@ static void parent_esp_reset(ESPState *s, int irq, int level)
     }
 }
 
+static bool esp_cmd_is_valid(ESPState *s, uint8_t cmd)
+{
+    uint8_t cmd_group = (cmd & CMD_GRP_MASK) >> 4;
+
+    /* Always allow misc commands */
+    if (cmd_group == CMD_GRP_MISC) {
+        return true;
+    }
+
+    switch (s->asc_mode) {
+    case ESP_ASC_MODE_DIS:
+        /* Disconnected mode: only allow disconnected commands */
+        if (cmd_group == CMD_GRP_DISC) {
+            return true;
+        }
+        break;
+
+    case ESP_ASC_MODE_INI:
+        /* Initiator mode: allow initiator commands */
+        if (cmd_group == CMD_GRP_INIT) {
+            return true;
+        }
+        break;
+
+    default:
+        g_assert_not_reached();
+    }
+
+    trace_esp_invalid_cmd(cmd, s->asc_mode);
+    return false;
+}
+
 static void esp_run_cmd(ESPState *s)
 {
     uint8_t cmd = s->rregs[ESP_CMD];
@@ -1285,6 +1317,11 @@ void esp_reg_write(ESPState *s, uint32_t saddr, uint64_t val)
         break;
     case ESP_CMD:
         s->rregs[saddr] = val;
+        if (!esp_cmd_is_valid(s, s->rregs[saddr])) {
+            s->rregs[ESP_RSTAT] |= INTR_IL;
+            esp_raise_irq(s);
+            break;
+        }
         esp_run_cmd(s);
         break;
     case ESP_WBUSID ... ESP_WSYNO:
diff --git a/hw/scsi/trace-events b/hw/scsi/trace-events
index f0f2a98c2e..6c2788e202 100644
--- a/hw/scsi/trace-events
+++ b/hw/scsi/trace-events
@@ -198,6 +198,7 @@ esp_mem_writeb_cmd_ensel(uint32_t val) "Enable selection (0x%2.2x)"
 esp_mem_writeb_cmd_dissel(uint32_t val) "Disable selection (0x%2.2x)"
 esp_mem_writeb_cmd_ti(uint32_t val) "Transfer Information (0x%2.2x)"
 esp_set_phase(const char *phase) "setting bus phase to %s"
+esp_invalid_cmd(uint8_t cmd, uint8_t asc_mode) "command 0x%x asc_mode 0x%x"
 
 # esp-pci.c
 esp_pci_error_invalid_dma_direction(void) "invalid DMA transfer direction"
diff --git a/include/hw/scsi/esp.h b/include/hw/scsi/esp.h
index 6327060c7c..3526bad746 100644
--- a/include/hw/scsi/esp.h
+++ b/include/hw/scsi/esp.h
@@ -111,6 +111,13 @@ struct SysBusESPState {
 #define CMD_DMA 0x80
 #define CMD_CMD 0x7f
 
+#define CMD_GRP_MASK 0x70
+
+#define CMD_GRP_MISC 0x00
+#define CMD_GRP_INIT 0x01
+#define CMD_GRP_TRGT 0x02
+#define CMD_GRP_DISC 0x04
+
 #define CMD_NOP      0x00
 #define CMD_FLUSH    0x01
 #define CMD_RESET    0x02
@@ -145,6 +152,7 @@ struct SysBusESPState {
 #define INTR_FC 0x08
 #define INTR_BS 0x10
 #define INTR_DC 0x20
+#define INTR_IL 0x40
 #define INTR_RST 0x80
 
 #define SEQ_0 0x0

From d38c5e0d0c206dc52421b8bb777cefdf47c13b7e Mon Sep 17 00:00:00 2001
From: Daniel Borkmann <daniel@iogearbox.net>
Date: Fri, 11 Jul 2025 11:44:14 +0200
Subject: [PATCH 2355/2760] net/af-xdp: Remove XDP program cleanup logic

There are two issues with the XDP program removal in af_xdp_cleanup():

1) Starting from libxdp 1.3.0 [0] the XDP program gets automatically
   detached when we call xsk_socket__delete() for the last successfully
   configured queue. libxdp internally keeps track of that. For QEMU
   we require libxdp >= 1.4.0. Given QEMU is not loading the program,
   lets also not attempt to remove it and delegate this instead.

2) The removal logic is incorrect anyway because we are setting n_queues
   into the last queue that never has xdp_flags on failure, so the logic
   is always skipped since the non-zero test for s->xdp_flags in
   af_xdp_cleanup() fails.

Fixes: cb039ef3d9e3 ("net: add initial support for AF_XDP network backend")
Suggested-by: Ilya Maximets <i.maximets@ovn.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Ilya Maximets <i.maximets@ovn.org>
Cc: Ilya Maximets <i.maximets@ovn.org>
Cc: Jason Wang <jasowang@redhat.com>
Cc: Anton Protopopov <aspsk@isovalent.com>
Link: https://github.com/xdp-project/xdp-tools/commit/38c2914988fd5c1ef65f2381fc8af9f3e8404e2b [0]
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/af-xdp.c | 12 ------------
 1 file changed, 12 deletions(-)

diff --git a/net/af-xdp.c b/net/af-xdp.c
index d022534d76..3d3268e18b 100644
--- a/net/af-xdp.c
+++ b/net/af-xdp.c
@@ -49,7 +49,6 @@ typedef struct AFXDPState {
     char                 *buffer;
     struct xsk_umem      *umem;
 
-    uint32_t             n_queues;
     uint32_t             xdp_flags;
     bool                 inhibit;
 } AFXDPState;
@@ -274,14 +273,6 @@ static void af_xdp_cleanup(NetClientState *nc)
     s->umem = NULL;
     qemu_vfree(s->buffer);
     s->buffer = NULL;
-
-    /* Remove the program if it's the last open queue. */
-    if (!s->inhibit && nc->queue_index == s->n_queues - 1 && s->xdp_flags
-        && bpf_xdp_detach(s->ifindex, s->xdp_flags, NULL) != 0) {
-        fprintf(stderr,
-                "af-xdp: unable to remove XDP program from '%s', ifindex: %d\n",
-                s->ifname, s->ifindex);
-    }
 }
 
 static int af_xdp_umem_create(AFXDPState *s, int sock_fd, Error **errp)
@@ -490,12 +481,9 @@ int net_init_af_xdp(const Netdev *netdev,
 
         pstrcpy(s->ifname, sizeof(s->ifname), opts->ifname);
         s->ifindex = ifindex;
-        s->n_queues = queues;
 
         if (af_xdp_umem_create(s, sock_fds ? sock_fds[i] : -1, errp)
             || af_xdp_socket_create(s, opts, errp)) {
-            /* Make sure the XDP program will be removed. */
-            s->n_queues = i;
             error_propagate(errp, err);
             goto err;
         }

From bdebcb49f459237c094a5b9cb084515cfe05e1bc Mon Sep 17 00:00:00 2001
From: Daniel Borkmann <daniel@iogearbox.net>
Date: Fri, 11 Jul 2025 11:44:15 +0200
Subject: [PATCH 2356/2760] net/af-xdp: Fix up cleanup path upon failure in
 queue creation

While testing, it turned out that upon error in the queue creation loop,
we never trigger the af_xdp_cleanup() handler. This is because we pass
errp instead of a local err pointer into the various AF_XDP setup functions
instead of a scheme like:

    bool fn(..., Error **errp)
    {
        Error *err = NULL;

        foo(arg, &err);
        if (err) {
            handle the error...
            error_propagate(errp, err);
            return false;
        }
        ...
    }

The same is true for the attachment probing with bpf_xdp_query_id(). With a
conversion into the above format, the af_xdp_cleanup() handler is called as
expected. Note the error_propagate() handles a NULL err internally.

Fixes: cb039ef3d9e3 ("net: add initial support for AF_XDP network backend")
Reviewed-by: Ilya Maximets <i.maximets@ovn.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Cc: Ilya Maximets <i.maximets@ovn.org>
Cc: Jason Wang <jasowang@redhat.com>
Cc: Anton Protopopov <aspsk@isovalent.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/af-xdp.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/net/af-xdp.c b/net/af-xdp.c
index 3d3268e18b..cbe1cae700 100644
--- a/net/af-xdp.c
+++ b/net/af-xdp.c
@@ -482,9 +482,8 @@ int net_init_af_xdp(const Netdev *netdev,
         pstrcpy(s->ifname, sizeof(s->ifname), opts->ifname);
         s->ifindex = ifindex;
 
-        if (af_xdp_umem_create(s, sock_fds ? sock_fds[i] : -1, errp)
-            || af_xdp_socket_create(s, opts, errp)) {
-            error_propagate(errp, err);
+        if (af_xdp_umem_create(s, sock_fds ? sock_fds[i] : -1, &err) ||
+            af_xdp_socket_create(s, opts, &err)) {
             goto err;
         }
     }
@@ -492,7 +491,7 @@ int net_init_af_xdp(const Netdev *netdev,
     if (nc0) {
         s = DO_UPCAST(AFXDPState, nc, nc0);
         if (bpf_xdp_query_id(s->ifindex, s->xdp_flags, &prog_id) || !prog_id) {
-            error_setg_errno(errp, errno,
+            error_setg_errno(&err, errno,
                              "no XDP program loaded on '%s', ifindex: %d",
                              s->ifname, s->ifindex);
             goto err;
@@ -506,6 +505,7 @@ int net_init_af_xdp(const Netdev *netdev,
 err:
     if (nc0) {
         qemu_del_net_client(nc0);
+        error_propagate(errp, err);
     }
 
     return -1;

From e53d9ec7ccc2dbb9378353fe2a89ebdca5cd7015 Mon Sep 17 00:00:00 2001
From: Daniel Borkmann <daniel@iogearbox.net>
Date: Fri, 11 Jul 2025 11:44:16 +0200
Subject: [PATCH 2357/2760] net/af-xdp: Support pinned map path for AF_XDP
 sockets

Extend 'inhibit=on' setting with the option to specify a pinned XSK map
path along with a starting index (default 0) to push the created XSK
sockets into. Example usage:

  # ./build/qemu-system-x86_64 [...] \
   -netdev af-xdp,ifname=enp2s0f0np0,id=net0,mode=native,queues=2,start-queue=14,inhibit=on,map-path=/sys/fs/bpf/xsks_map,map-start-index=14 \
   -device virtio-net-pci,netdev=net0 [...]

This is useful for the case where an existing XDP program with XSK map
is present on the AF_XDP supported phys device and the XSK map is not
yet populated. For example, the former could have been pre-loaded onto
the netdevice by a control plane, which later launches QEMU to populate
it with XSK sockets.

Normally, the main idea behind 'inhibit=on' is that the QEMU instance
doesn't need to have a lot of privileges to use the pre-loaded program
and the pre-created sockets, but this mentioned use-case here is different
where QEMU still needs privileges to create the sockets.

The 'map-start-index' parameter is optional and defaults to 0. It allows
flexible placement of the XSK sockets, and is up to the user to specify
when the XDP program with XSK map was already preloaded. In the simplest
case the queue-to-map-slot mapping is just 1:1 based on ctx->rx_queue_index
but the user might as well have a different scheme (or smaller map size,
e.g. ctx->rx_queue_index % max_size) to push the inbound traffic to one
of the XSK sockets.

Note that the bpf_xdp_query_id() is now only tested for 'inhibit=off'
since only in the latter case the libxdp takes care of installing the
XDP program which was installed based on the s->xdp_flags pointing to
either driver or skb mode. For 'inhibit=on' we don't make any assumptions
and neither go down the path of probing all possible options in which
way the user installed the XDP program.

Reviewed-by: Ilya Maximets <i.maximets@ovn.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Cc: Ilya Maximets <i.maximets@ovn.org>
Cc: Jason Wang <jasowang@redhat.com>
Cc: Anton Protopopov <aspsk@isovalent.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/af-xdp.c    | 83 ++++++++++++++++++++++++++++++++++++++++++++++---
 qapi/net.json   | 29 +++++++++++------
 qemu-options.hx | 23 ++++++++++++--
 3 files changed, 118 insertions(+), 17 deletions(-)

diff --git a/net/af-xdp.c b/net/af-xdp.c
index cbe1cae700..14f302ea21 100644
--- a/net/af-xdp.c
+++ b/net/af-xdp.c
@@ -51,6 +51,10 @@ typedef struct AFXDPState {
 
     uint32_t             xdp_flags;
     bool                 inhibit;
+
+    char                 *map_path;
+    int                  map_fd;
+    uint32_t             map_start_index;
 } AFXDPState;
 
 #define AF_XDP_BATCH_SIZE 64
@@ -260,6 +264,7 @@ static void af_xdp_send(void *opaque)
 static void af_xdp_cleanup(NetClientState *nc)
 {
     AFXDPState *s = DO_UPCAST(AFXDPState, nc, nc);
+    int idx;
 
     qemu_purge_queued_packets(nc);
 
@@ -273,6 +278,18 @@ static void af_xdp_cleanup(NetClientState *nc)
     s->umem = NULL;
     qemu_vfree(s->buffer);
     s->buffer = NULL;
+
+    if (s->map_fd >= 0) {
+        idx = nc->queue_index + s->map_start_index;
+        if (bpf_map_delete_elem(s->map_fd, &idx)) {
+            fprintf(stderr, "af-xdp: unable to remove AF_XDP socket from map"
+                    " %s\n", s->map_path);
+        }
+        close(s->map_fd);
+        s->map_fd = -1;
+    }
+    g_free(s->map_path);
+    s->map_path = NULL;
 }
 
 static int af_xdp_umem_create(AFXDPState *s, int sock_fd, Error **errp)
@@ -336,7 +353,6 @@ static int af_xdp_socket_create(AFXDPState *s,
     };
     int queue_id, error = 0;
 
-    s->inhibit = opts->has_inhibit && opts->inhibit;
     if (s->inhibit) {
         cfg.libxdp_flags |= XSK_LIBXDP_FLAGS__INHIBIT_PROG_LOAD;
     }
@@ -387,6 +403,35 @@ static int af_xdp_socket_create(AFXDPState *s,
     return 0;
 }
 
+static int af_xdp_update_xsk_map(AFXDPState *s, Error **errp)
+{
+    int xsk_fd, idx, error = 0;
+
+    if (!s->map_path) {
+        return 0;
+    }
+
+    s->map_fd = bpf_obj_get(s->map_path);
+    if (s->map_fd < 0) {
+        error = errno;
+    } else {
+        xsk_fd = xsk_socket__fd(s->xsk);
+        idx = s->nc.queue_index + s->map_start_index;
+        if (bpf_map_update_elem(s->map_fd, &idx, &xsk_fd, 0)) {
+            error = errno;
+        }
+    }
+
+    if (error) {
+        error_setg_errno(errp, error,
+                         "failed to insert AF_XDP socket into map %s",
+                         s->map_path);
+        return -1;
+    }
+
+    return 0;
+}
+
 /* NetClientInfo methods. */
 static NetClientInfo net_af_xdp_info = {
     .type = NET_CLIENT_DRIVER_AF_XDP,
@@ -435,12 +480,14 @@ int net_init_af_xdp(const Netdev *netdev,
 {
     const NetdevAFXDPOptions *opts = &netdev->u.af_xdp;
     NetClientState *nc, *nc0 = NULL;
+    int32_t map_start_index;
     unsigned int ifindex;
     uint32_t prog_id = 0;
     g_autofree int *sock_fds = NULL;
     int64_t i, queues;
     Error *err = NULL;
     AFXDPState *s;
+    bool inhibit;
 
     ifindex = if_nametoindex(opts->ifname);
     if (!ifindex) {
@@ -456,8 +503,28 @@ int net_init_af_xdp(const Netdev *netdev,
         return -1;
     }
 
-    if ((opts->has_inhibit && opts->inhibit) != !!opts->sock_fds) {
-        error_setg(errp, "'inhibit=on' requires 'sock-fds' and vice versa");
+    inhibit = opts->has_inhibit && opts->inhibit;
+    if (inhibit && !opts->sock_fds && !opts->map_path) {
+        error_setg(errp, "'inhibit=on' requires 'sock-fds' or 'map-path'");
+        return -1;
+    }
+    if (!inhibit && (opts->sock_fds || opts->map_path)) {
+        error_setg(errp, "'sock-fds' and 'map-path' require 'inhibit=on'");
+        return -1;
+    }
+    if (opts->sock_fds && opts->map_path) {
+        error_setg(errp, "'sock-fds' and 'map-path' are mutually exclusive");
+        return -1;
+    }
+    if (!opts->map_path && opts->has_map_start_index) {
+        error_setg(errp, "'map-start-index' requires 'map-path'");
+        return -1;
+    }
+
+    map_start_index = opts->has_map_start_index ? opts->map_start_index : 0;
+    if (map_start_index < 0) {
+        error_setg(errp, "'map-start-index' cannot be negative (%d)",
+                   map_start_index);
         return -1;
     }
 
@@ -481,14 +548,20 @@ int net_init_af_xdp(const Netdev *netdev,
 
         pstrcpy(s->ifname, sizeof(s->ifname), opts->ifname);
         s->ifindex = ifindex;
+        s->inhibit = inhibit;
+
+        s->map_path = g_strdup(opts->map_path);
+        s->map_start_index = map_start_index;
+        s->map_fd = -1;
 
         if (af_xdp_umem_create(s, sock_fds ? sock_fds[i] : -1, &err) ||
-            af_xdp_socket_create(s, opts, &err)) {
+            af_xdp_socket_create(s, opts, &err) ||
+            af_xdp_update_xsk_map(s, &err)) {
             goto err;
         }
     }
 
-    if (nc0) {
+    if (nc0 && !inhibit) {
         s = DO_UPCAST(AFXDPState, nc, nc0);
         if (bpf_xdp_query_id(s->ifindex, s->xdp_flags, &prog_id) || !prog_id) {
             error_setg_errno(&err, errno,
diff --git a/qapi/net.json b/qapi/net.json
index 0f766041a3..1f40bf46bb 100644
--- a/qapi/net.json
+++ b/qapi/net.json
@@ -567,25 +567,34 @@
 #     (default: 0).
 #
 # @inhibit: Don't load a default XDP program, use one already loaded
-#     to the interface (default: false).  Requires @sock-fds.
+#     to the interface (default: false).  Requires @sock-fds or @map-path.
 #
 # @sock-fds: A colon (:) separated list of file descriptors for
 #     already open but not bound AF_XDP sockets in the queue order.
 #     One fd per queue.  These descriptors should already be added
-#     into XDP socket map for corresponding queues.  Requires
-#     @inhibit.
+#     into XDP socket map for corresponding queues.  @sock-fds and
+#     @map-path are mutually exclusive.  Requires @inhibit.
+#
+# @map-path: The path to a pinned xsk map to push file descriptors
+#     for bound AF_XDP sockets into.  @map-path and @sock-fds are
+#     mutually exclusive.  Requires @inhibit.  (Since 10.1)
+#
+# @map-start-index: Use @map-path to insert xsk sockets starting from
+#     this index number (default: 0).  Requires @map-path.  (Since 10.1)
 #
 # Since: 8.2
 ##
 { 'struct': 'NetdevAFXDPOptions',
   'data': {
-    'ifname':       'str',
-    '*mode':        'AFXDPMode',
-    '*force-copy':  'bool',
-    '*queues':      'int',
-    '*start-queue': 'int',
-    '*inhibit':     'bool',
-    '*sock-fds':    'str' },
+    'ifname':           'str',
+    '*mode':            'AFXDPMode',
+    '*force-copy':      'bool',
+    '*queues':          'int',
+    '*start-queue':     'int',
+    '*inhibit':         'bool',
+    '*sock-fds':        'str',
+    '*map-path':        'str',
+    '*map-start-index': 'int32' },
   'if': 'CONFIG_AF_XDP' }
 
 ##
diff --git a/qemu-options.hx b/qemu-options.hx
index a3c066c678..bf19987cb0 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -2929,6 +2929,7 @@ DEF("netdev", HAS_ARG, QEMU_OPTION_netdev,
 #ifdef CONFIG_AF_XDP
     "-netdev af-xdp,id=str,ifname=name[,mode=native|skb][,force-copy=on|off]\n"
     "         [,queues=n][,start-queue=m][,inhibit=on|off][,sock-fds=x:y:...:z]\n"
+    "         [,map-path=/path/to/socket/map][,map-start-index=i]\n"
     "                attach to the existing network interface 'name' with AF_XDP socket\n"
     "                use 'mode=MODE' to specify an XDP program attach mode\n"
     "                use 'force-copy=on|off' to force XDP copy mode even if device supports zero-copy (default: off)\n"
@@ -2936,6 +2937,8 @@ DEF("netdev", HAS_ARG, QEMU_OPTION_netdev,
     "                with inhibit=on,\n"
     "                  use 'sock-fds' to provide file descriptors for already open AF_XDP sockets\n"
     "                  added to a socket map in XDP program.  One socket per queue.\n"
+    "                  use 'map-path' to provide the socket map location to populate AF_XDP sockets with,\n"
+    "                  and use 'map-start-index' to specify the starting index for the map (default: 0) (Since 10.1)\n"
     "                use 'queues=n' to specify how many queues of a multiqueue interface should be used\n"
     "                use 'start-queue=m' to specify the first queue that should be used\n"
 #endif
@@ -3759,7 +3762,7 @@ SRST
         # launch QEMU instance
         |qemu_system| linux.img -nic vde,sock=/tmp/myswitch
 
-``-netdev af-xdp,id=str,ifname=name[,mode=native|skb][,force-copy=on|off][,queues=n][,start-queue=m][,inhibit=on|off][,sock-fds=x:y:...:z]``
+``-netdev af-xdp,id=str,ifname=name[,mode=native|skb][,force-copy=on|off][,queues=n][,start-queue=m][,inhibit=on|off][,sock-fds=x:y:...:z][,map-path=/path/to/socket/map][,map-start-index=i]``
     Configure AF_XDP backend to connect to a network interface 'name'
     using AF_XDP socket.  A specific program attach mode for a default
     XDP program can be forced with 'mode', defaults to best-effort,
@@ -3799,7 +3802,8 @@ SRST
             -netdev af-xdp,id=n1,ifname=eth0,queues=1,start-queue=1
 
     XDP program can also be loaded externally.  In this case 'inhibit' option
-    should be set to 'on' and 'sock-fds' provided with file descriptors for
+    should be set to 'on'.  Either 'sock-fds' or 'map-path' can be used with
+    'inhibit' enabled.  'sock-fds' can be provided with file descriptors for
     already open but not bound XDP sockets already added to a socket map for
     corresponding queues.  One socket per queue.
 
@@ -3808,6 +3812,21 @@ SRST
         |qemu_system| linux.img -device virtio-net-pci,netdev=n1 \\
             -netdev af-xdp,id=n1,ifname=eth0,queues=3,inhibit=on,sock-fds=15:16:17
 
+    For the 'inhibit' option set to 'on' used together with 'map-path' it is
+    expected that the XDP program with the socket map is already loaded on
+    the networking device and the map pinned into BPF file system.  The path
+    to the pinned map is then passed to QEMU which then creates the file
+    descriptors and inserts them into the existing socket map.
+
+    .. parsed-literal::
+
+        |qemu_system| linux.img -device virtio-net-pci,netdev=n1 \\
+            -netdev af-xdp,id=n1,ifname=eth0,queues=2,inhibit=on,map-path=/sys/fs/bpf/xsks_map
+
+    Additionally, 'map-start-index' can be used to specify the start offset
+    for insertion into the socket map.  The combination of 'map-path' and
+    'sock-fds' together is not supported.
+
 ``-netdev vhost-user,chardev=id[,vhostforce=on|off][,queues=n]``
     Establish a vhost-user netdev, backed by a chardev id. The chardev
     should be a unix domain socket backed one. The vhost-user uses a

From bd46161dd1bef1da9402fa10aa6e8f38b4dfe1d3 Mon Sep 17 00:00:00 2001
From: Vivek Kasireddy <vivek.kasireddy@intel.com>
Date: Mon, 16 Jun 2025 21:32:27 -0700
Subject: [PATCH 2358/2760] ui/spice: Add an option for users to provide a
 preferred video codec
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Giving users an option to choose a particular codec will enable
them to make an appropriate decision based on their hardware and
use-case. Note that, the Spice server would use this codec with
Gstreamer encoder and only when gl=on is specified.

If no codec is provided, then the codec gstreamer:h264 would be used
as default. And, for the case where gl=off, the default codec to be
used is determined by the Spice server.

Cc: Gerd Hoffmann <kraxel@redhat.com>
Cc: Marc-André Lureau <marcandre.lureau@redhat.com>
Cc: Dmitry Osipenko <dmitry.osipenko@collabora.com>
Cc: Frediano Ziglio <freddy77@gmail.com>
Cc: Dongwon Kim <dongwon.kim@intel.com>
Cc: Michael Scherle <michael.scherle@rz.uni-freiburg.de>
Cc: Daniel P. Berrangé <berrange@redhat.com>
[ Marc-Andre - fix unused variables warnings ]
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Vivek Kasireddy <vivek.kasireddy@intel.com>
Message-Id: <20250617043546.1022779-4-vivek.kasireddy@intel.com>
---
 qemu-options.hx |  8 ++++++++
 ui/spice-core.c | 16 ++++++++++++++++
 2 files changed, 24 insertions(+)

diff --git a/qemu-options.hx b/qemu-options.hx
index 1f862b19a6..8f6a228a89 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -2281,6 +2281,7 @@ DEF("spice", HAS_ARG, QEMU_OPTION_spice,
     "       [,streaming-video=[off|all|filter]][,disable-copy-paste=on|off]\n"
     "       [,disable-agent-file-xfer=on|off][,agent-mouse=[on|off]]\n"
     "       [,playback-compression=[on|off]][,seamless-migration=[on|off]]\n"
+    "       [,video-codec=<codec>\n"
     "       [,gl=[on|off]][,rendernode=<file>]\n"
     "                enable spice\n"
     "                at least one of {port, tls-port} is mandatory\n",
@@ -2369,6 +2370,13 @@ SRST
     ``seamless-migration=[on|off]``
         Enable/disable spice seamless migration. Default is off.
 
+    ``video-codec=<codec>``
+        Provide the preferred codec the Spice server should use with the
+        Gstreamer encoder. This option is only relevant when gl=on is
+        specified. If no codec is provided, then the codec gstreamer:h264
+        would be used as default. And, for the case where gl=off, the
+        default codec to be used is determined by the Spice server.
+
     ``gl=[on|off]``
         Enable/disable OpenGL context. Default is off.
 
diff --git a/ui/spice-core.c b/ui/spice-core.c
index 5acbdd3955..51bdcef1af 100644
--- a/ui/spice-core.c
+++ b/ui/spice-core.c
@@ -488,6 +488,9 @@ static QemuOptsList qemu_spice_opts = {
         },{
             .name = "streaming-video",
             .type = QEMU_OPT_STRING,
+        },{
+            .name = "video-codec",
+            .type = QEMU_OPT_STRING,
         },{
             .name = "agent-mouse",
             .type = QEMU_OPT_BOOL,
@@ -837,7 +840,20 @@ static void qemu_spice_init(void)
     if (qemu_opt_get_bool(opts, "gl", 0)) {
         if ((port != 0) || (tls_port != 0)) {
 #if SPICE_SERVER_VERSION >= 0x000f03 /* release 0.15.3 */
+            const char *video_codec = NULL;
+            g_autofree char *enc_codec = NULL;
+
             spice_remote_client = 1;
+
+            video_codec = qemu_opt_get(opts, "video-codec");
+            if (video_codec) {
+                enc_codec = g_strconcat("gstreamer:", video_codec, NULL);
+            }
+            if (spice_server_set_video_codecs(spice_server,
+                                              enc_codec ?: "gstreamer:h264")) {
+                error_report("invalid video codec");
+                exit(1);
+            }
 #else
             error_report("SPICE GL support is local-only for now and "
                          "incompatible with -spice port/tls-port");

From 50d135e3779f276eba93c63dff49a940b85e23a5 Mon Sep 17 00:00:00 2001
From: Vivek Kasireddy <vivek.kasireddy@intel.com>
Date: Mon, 16 Jun 2025 21:32:28 -0700
Subject: [PATCH 2359/2760] ui/spice: Add an option to submit gl_draw requests
 at fixed rate
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In the specific case where the display layer (virtio-gpu) is using
dmabuf, and if remote clients are enabled (-spice gl=on,port=xxxx),
it makes sense to limit the maximum (streaming) rate (refresh rate)
to a fixed value using the GUI refresh timer. Otherwise, the updates
or gl_draw requests would be sent as soon as the Guest submits a new
frame which is not optimal as it would lead to increased network
traffic and wastage of GPU cycles if the frames get dropped.

Cc: Gerd Hoffmann <kraxel@redhat.com>
Cc: Marc-André Lureau <marcandre.lureau@redhat.com>
Cc: Dmitry Osipenko <dmitry.osipenko@collabora.com>
Cc: Frediano Ziglio <freddy77@gmail.com>
Cc: Dongwon Kim <dongwon.kim@intel.com>
Cc: Michael Scherle <michael.scherle@rz.uni-freiburg.de>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Vivek Kasireddy <vivek.kasireddy@intel.com>
Message-Id: <20250617043546.1022779-5-vivek.kasireddy@intel.com>
---
 include/ui/spice-display.h |  1 +
 qemu-options.hx            |  5 +++
 ui/spice-core.c            | 12 ++++++++
 ui/spice-display.c         | 62 ++++++++++++++++++++++++++++++++------
 4 files changed, 70 insertions(+), 10 deletions(-)

diff --git a/include/ui/spice-display.h b/include/ui/spice-display.h
index 6c55f38c8b..9bdde78266 100644
--- a/include/ui/spice-display.h
+++ b/include/ui/spice-display.h
@@ -152,6 +152,7 @@ struct SimpleSpiceCursor {
 
 extern bool spice_opengl;
 extern bool spice_remote_client;
+extern int spice_max_refresh_rate;
 
 int qemu_spice_rect_is_empty(const QXLRect* r);
 void qemu_spice_rect_union(QXLRect *dest, const QXLRect *r);
diff --git a/qemu-options.hx b/qemu-options.hx
index 8f6a228a89..ac09abfd71 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -2282,6 +2282,7 @@ DEF("spice", HAS_ARG, QEMU_OPTION_spice,
     "       [,disable-agent-file-xfer=on|off][,agent-mouse=[on|off]]\n"
     "       [,playback-compression=[on|off]][,seamless-migration=[on|off]]\n"
     "       [,video-codec=<codec>\n"
+    "       [,max-refresh-rate=rate\n"
     "       [,gl=[on|off]][,rendernode=<file>]\n"
     "                enable spice\n"
     "                at least one of {port, tls-port} is mandatory\n",
@@ -2377,6 +2378,10 @@ SRST
         would be used as default. And, for the case where gl=off, the
         default codec to be used is determined by the Spice server.
 
+    ``max-refresh-rate=rate``
+        Provide the maximum refresh rate (or FPS) at which the encoding
+        requests should be sent to the Spice server. Default would be 30.
+
     ``gl=[on|off]``
         Enable/disable OpenGL context. Default is off.
 
diff --git a/ui/spice-core.c b/ui/spice-core.c
index 51bdcef1af..5992f9daec 100644
--- a/ui/spice-core.c
+++ b/ui/spice-core.c
@@ -56,6 +56,8 @@ struct SpiceTimer {
     QEMUTimer *timer;
 };
 
+#define DEFAULT_MAX_REFRESH_RATE 30
+
 static SpiceTimer *timer_add(SpiceTimerFunc func, void *opaque)
 {
     SpiceTimer *timer;
@@ -491,6 +493,9 @@ static QemuOptsList qemu_spice_opts = {
         },{
             .name = "video-codec",
             .type = QEMU_OPT_STRING,
+        },{
+            .name = "max-refresh-rate",
+            .type = QEMU_OPT_NUMBER,
         },{
             .name = "agent-mouse",
             .type = QEMU_OPT_BOOL,
@@ -804,6 +809,13 @@ static void qemu_spice_init(void)
         spice_server_set_streaming_video(spice_server, SPICE_STREAM_VIDEO_OFF);
     }
 
+    spice_max_refresh_rate = qemu_opt_get_number(opts, "max-refresh-rate",
+                                                 DEFAULT_MAX_REFRESH_RATE);
+    if (spice_max_refresh_rate <= 0) {
+        error_report("max refresh rate/fps is invalid");
+        exit(1);
+    }
+
     spice_server_set_agent_mouse
         (spice_server, qemu_opt_get_bool(opts, "agent-mouse", 1));
     spice_server_set_playback_compression
diff --git a/ui/spice-display.c b/ui/spice-display.c
index 0fb72f6d6f..e409b6bdb2 100644
--- a/ui/spice-display.c
+++ b/ui/spice-display.c
@@ -32,6 +32,7 @@
 
 bool spice_opengl;
 bool spice_remote_client;
+int spice_max_refresh_rate;
 
 int qemu_spice_rect_is_empty(const QXLRect* r)
 {
@@ -844,12 +845,32 @@ static void qemu_spice_gl_block_timer(void *opaque)
     warn_report("spice: no gl-draw-done within one second");
 }
 
+static void spice_gl_draw(SimpleSpiceDisplay *ssd,
+                           uint32_t x, uint32_t y, uint32_t w, uint32_t h)
+{
+    uint64_t cookie;
+
+    cookie = (uintptr_t)qxl_cookie_new(QXL_COOKIE_TYPE_GL_DRAW_DONE, 0);
+    spice_qxl_gl_draw_async(&ssd->qxl, x, y, w, h, cookie);
+}
+
 static void spice_gl_refresh(DisplayChangeListener *dcl)
 {
     SimpleSpiceDisplay *ssd = container_of(dcl, SimpleSpiceDisplay, dcl);
-    uint64_t cookie;
 
-    if (!ssd->ds || qemu_console_is_gl_blocked(ssd->dcl.con)) {
+    if (!ssd->ds) {
+        return;
+    }
+
+    if (qemu_console_is_gl_blocked(ssd->dcl.con)) {
+        if (spice_remote_client && ssd->gl_updates && ssd->have_scanout) {
+            glFlush();
+            spice_gl_draw(ssd, 0, 0,
+                          surface_width(ssd->ds), surface_height(ssd->ds));
+            ssd->gl_updates = 0;
+            /* E.g, to achieve 60 FPS, update_interval needs to be ~16.66 ms */
+            dcl->update_interval = 1000 / spice_max_refresh_rate;
+        }
         return;
     }
 
@@ -857,11 +878,8 @@ static void spice_gl_refresh(DisplayChangeListener *dcl)
     if (ssd->gl_updates && ssd->have_surface) {
         qemu_spice_gl_block(ssd, true);
         glFlush();
-        cookie = (uintptr_t)qxl_cookie_new(QXL_COOKIE_TYPE_GL_DRAW_DONE, 0);
-        spice_qxl_gl_draw_async(&ssd->qxl, 0, 0,
-                                surface_width(ssd->ds),
-                                surface_height(ssd->ds),
-                                cookie);
+        spice_gl_draw(ssd, 0, 0,
+                      surface_width(ssd->ds), surface_height(ssd->ds));
         ssd->gl_updates = 0;
     }
 }
@@ -954,6 +972,20 @@ static void qemu_spice_gl_scanout_disable(DisplayChangeListener *dcl)
     SimpleSpiceDisplay *ssd = container_of(dcl, SimpleSpiceDisplay, dcl);
 
     trace_qemu_spice_gl_scanout_disable(ssd->qxl.id);
+
+    /*
+     * We need to check for the case of "lost" updates, where a gl_draw
+     * was not submitted because the timer did not get a chance to run.
+     * One case where this happens is when the Guest VM is getting
+     * rebooted. If the console is blocked in this situation, we need
+     * to unblock it. Otherwise, newer updates would not take effect.
+     */
+    if (qemu_console_is_gl_blocked(ssd->dcl.con)) {
+        if (spice_remote_client && ssd->gl_updates && ssd->have_scanout) {
+            ssd->gl_updates = 0;
+            qemu_spice_gl_block(ssd, false);
+        }
+    }
     spice_server_gl_scanout(&ssd->qxl, NULL, 0, 0, NULL, NULL, 0, DRM_FORMAT_INVALID,
                             DRM_FORMAT_MOD_INVALID, false);
     qemu_spice_gl_monitor_config(ssd, 0, 0, 0, 0);
@@ -1061,7 +1093,6 @@ static void qemu_spice_gl_update(DisplayChangeListener *dcl,
     EGLint fourcc = 0;
     bool render_cursor = false;
     bool y_0_top = false; /* FIXME */
-    uint64_t cookie;
     uint32_t width, height, texture;
 
     if (!ssd->have_scanout) {
@@ -1159,8 +1190,19 @@ static void qemu_spice_gl_update(DisplayChangeListener *dcl,
     trace_qemu_spice_gl_update(ssd->qxl.id, w, h, x, y);
     qemu_spice_gl_block(ssd, true);
     glFlush();
-    cookie = (uintptr_t)qxl_cookie_new(QXL_COOKIE_TYPE_GL_DRAW_DONE, 0);
-    spice_qxl_gl_draw_async(&ssd->qxl, x, y, w, h, cookie);
+
+    /*
+     * In the case of remote clients, the submission of gl_draw request is
+     * deferred here, so that it can be submitted later (to spice server)
+     * from spice_gl_refresh() timer callback. This is done to ensure that
+     * Guest updates are submitted at a steady rate (e.g. 60 FPS) instead
+     * of submitting them arbitrarily.
+     */
+    if (spice_remote_client) {
+        ssd->gl_updates++;
+    } else {
+        spice_gl_draw(ssd, x, y, w, h);
+    }
 }
 
 static const DisplayChangeListenerOps display_listener_gl_ops = {

From e6f0fe8f7c058af6e95e8f845c25e90453b2aec6 Mon Sep 17 00:00:00 2001
From: Vivek Kasireddy <vivek.kasireddy@intel.com>
Date: Mon, 16 Jun 2025 21:32:29 -0700
Subject: [PATCH 2360/2760] ui/console-gl: Add a helper to create a texture
 with linear memory layout
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

There are cases where we do not want the memory layout of a texture to
be tiled as the component processing the texture would not know how to
de-tile either via software or hardware. Therefore, ensuring that the
memory backing the texture has a linear layout is absolutely necessary
in these situations.

Cc: Gerd Hoffmann <kraxel@redhat.com>
Cc: Marc-André Lureau <marcandre.lureau@redhat.com>
Cc: Dmitry Osipenko <dmitry.osipenko@collabora.com>
Cc: Frediano Ziglio <freddy77@gmail.com>
Cc: Dongwon Kim <dongwon.kim@intel.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Co-developed-by: Michael Scherle <michael.scherle@rz.uni-freiburg.de>
Signed-off-by: Vivek Kasireddy <vivek.kasireddy@intel.com>
Reviewed-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
Message-Id: <20250617043546.1022779-6-vivek.kasireddy@intel.com>
---
 include/ui/console.h |  3 +++
 ui/console-gl.c      | 48 ++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 51 insertions(+)

diff --git a/include/ui/console.h b/include/ui/console.h
index 46b3128185..98feaa58bd 100644
--- a/include/ui/console.h
+++ b/include/ui/console.h
@@ -422,6 +422,9 @@ bool console_gl_check_format(DisplayChangeListener *dcl,
                              pixman_format_code_t format);
 void surface_gl_create_texture(QemuGLShader *gls,
                                DisplaySurface *surface);
+bool surface_gl_create_texture_from_fd(DisplaySurface *surface,
+                                       int fd, GLuint *texture,
+                                       GLuint *mem_obj);
 void surface_gl_update_texture(QemuGLShader *gls,
                                DisplaySurface *surface,
                                int x, int y, int w, int h);
diff --git a/ui/console-gl.c b/ui/console-gl.c
index 103b954017..afb36dba64 100644
--- a/ui/console-gl.c
+++ b/ui/console-gl.c
@@ -25,6 +25,7 @@
  * THE SOFTWARE.
  */
 #include "qemu/osdep.h"
+#include "qemu/error-report.h"
 #include "ui/console.h"
 #include "ui/shader.h"
 
@@ -96,6 +97,53 @@ void surface_gl_create_texture(QemuGLShader *gls,
     glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER, GL_LINEAR);
 }
 
+bool surface_gl_create_texture_from_fd(DisplaySurface *surface,
+                                       int fd, GLuint *texture,
+                                       GLuint *mem_obj)
+{
+    unsigned long size = surface_stride(surface) * surface_height(surface);
+    GLenum err = glGetError();
+    *texture = 0;
+    *mem_obj = 0;
+
+    if (!epoxy_has_gl_extension("GL_EXT_memory_object") ||
+        !epoxy_has_gl_extension("GL_EXT_memory_object_fd")) {
+        error_report("spice: required OpenGL extensions not supported: "
+                     "GL_EXT_memory_object and GL_EXT_memory_object_fd");
+        return false;
+    }
+
+#ifdef GL_EXT_memory_object_fd
+    glCreateMemoryObjectsEXT(1, mem_obj);
+    glImportMemoryFdEXT(*mem_obj, size, GL_HANDLE_TYPE_OPAQUE_FD_EXT, fd);
+
+    err = glGetError();
+    if (err != GL_NO_ERROR) {
+        error_report("spice: cannot import memory object from fd");
+        goto cleanup_mem;
+    }
+
+    glGenTextures(1, texture);
+    glBindTexture(GL_TEXTURE_2D, *texture);
+    glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_TILING_EXT, GL_LINEAR_TILING_EXT);
+    glTexStorageMem2DEXT(GL_TEXTURE_2D, 1, GL_RGBA8, surface_width(surface),
+                         surface_height(surface), *mem_obj, 0);
+    err = glGetError();
+    if (err != GL_NO_ERROR) {
+        error_report("spice: cannot create texture from memory object");
+        goto cleanup_tex_and_mem;
+    }
+    return true;
+
+cleanup_tex_and_mem:
+    glDeleteTextures(1, texture);
+cleanup_mem:
+    glDeleteMemoryObjectsEXT(1, mem_obj);
+
+#endif
+    return false;
+}
+
 void surface_gl_update_texture(QemuGLShader *gls,
                                DisplaySurface *surface,
                                int x, int y, int w, int h)

From 2103690b1a7d98f88f7c150f48fcd951d3ee8b36 Mon Sep 17 00:00:00 2001
From: Vivek Kasireddy <vivek.kasireddy@intel.com>
Date: Mon, 16 Jun 2025 21:32:30 -0700
Subject: [PATCH 2361/2760] ui/spice: Create a new texture with linear layout
 when gl=on is specified
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since most encoders/decoders (invoked by Spice) may not work properly
with tiled memory associated with a texture, we need to create another
texture that has linear memory layout and use that instead.

Note that, there does not seem to be a direct way to indicate to the
GL implementation that a texture's backing memory needs to be linear.
Instead, we have to do it in a roundabout way where we need to first
create a tiled texture and import that as a memory object to create
a new texture that has a linear memory layout.

Cc: Gerd Hoffmann <kraxel@redhat.com>
Cc: Marc-André Lureau <marcandre.lureau@redhat.com>
Cc: Dmitry Osipenko <dmitry.osipenko@collabora.com>
Cc: Frediano Ziglio <freddy77@gmail.com>
Cc: Dongwon Kim <dongwon.kim@intel.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Co-developed-by: Michael Scherle <michael.scherle@rz.uni-freiburg.de>
Signed-off-by: Vivek Kasireddy <vivek.kasireddy@intel.com>
Reviewed-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
Message-Id: <20250617043546.1022779-7-vivek.kasireddy@intel.com>
---
 include/ui/surface.h |  1 +
 ui/console-gl.c      |  6 ++++
 ui/spice-display.c   | 82 ++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 89 insertions(+)

diff --git a/include/ui/surface.h b/include/ui/surface.h
index f16f7be8be..006b1986bb 100644
--- a/include/ui/surface.h
+++ b/include/ui/surface.h
@@ -22,6 +22,7 @@ typedef struct DisplaySurface {
     GLenum glformat;
     GLenum gltype;
     GLuint texture;
+    GLuint mem_obj;
 #endif
     qemu_pixman_shareable share_handle;
     uint32_t share_handle_offset;
diff --git a/ui/console-gl.c b/ui/console-gl.c
index afb36dba64..403fc36fbd 100644
--- a/ui/console-gl.c
+++ b/ui/console-gl.c
@@ -184,6 +184,12 @@ void surface_gl_destroy_texture(QemuGLShader *gls,
     }
     glDeleteTextures(1, &surface->texture);
     surface->texture = 0;
+#ifdef GL_EXT_memory_object_fd
+    if (surface->mem_obj) {
+        glDeleteMemoryObjectsEXT(1, &surface->mem_obj);
+        surface->mem_obj = 0;
+    }
+#endif
 }
 
 void surface_gl_setup_viewport(QemuGLShader *gls,
diff --git a/ui/spice-display.c b/ui/spice-display.c
index e409b6bdb2..854a97c198 100644
--- a/ui/spice-display.c
+++ b/ui/spice-display.c
@@ -893,6 +893,81 @@ static void spice_gl_update(DisplayChangeListener *dcl,
     ssd->gl_updates++;
 }
 
+static bool spice_gl_replace_fd_texture(SimpleSpiceDisplay *ssd,
+                                        int *fds, uint64_t *modifier,
+                                        int *num_planes)
+{
+    uint32_t offsets[DMABUF_MAX_PLANES], strides[DMABUF_MAX_PLANES];
+    GLuint texture;
+    GLuint mem_obj;
+    int fourcc;
+    bool ret;
+
+    if (!spice_remote_client) {
+        return true;
+    }
+
+    if (*modifier == DRM_FORMAT_MOD_LINEAR) {
+        return true;
+    }
+
+    if (*num_planes > 1) {
+        error_report("spice: cannot replace texture with multiple planes");
+        return false;
+    }
+
+    /*
+     * We really want to ensure that the memory layout of the texture
+     * is linear; otherwise, the encoder's output may show corruption.
+     */
+    if (!surface_gl_create_texture_from_fd(ssd->ds, fds[0], &texture,
+                                           &mem_obj)) {
+        error_report("spice: cannot create new texture from fd");
+        return false;
+    }
+
+    /*
+     * A successful return after glImportMemoryFdEXT() means that
+     * the ownership of fd has been passed to GL. In other words,
+     * the fd we got above should not be used anymore.
+     */
+    ret = egl_dmabuf_export_texture(texture,
+                                    fds,
+                                    (EGLint *)offsets,
+                                    (EGLint *)strides,
+                                    &fourcc,
+                                    num_planes,
+                                    modifier);
+    if (!ret) {
+        glDeleteTextures(1, &texture);
+#ifdef GL_EXT_memory_object_fd
+        glDeleteMemoryObjectsEXT(1, &mem_obj);
+#endif
+
+        /*
+         * Since we couldn't export our newly create texture (or create,
+         * an fd associated with it) we need to backtrack and try to
+         * recreate the fd associated with the original texture.
+         */
+        ret = egl_dmabuf_export_texture(ssd->ds->texture,
+                                        fds,
+                                        (EGLint *)offsets,
+                                        (EGLint *)strides,
+                                        &fourcc,
+                                        num_planes,
+                                        modifier);
+        if (!ret) {
+            surface_gl_destroy_texture(ssd->gls, ssd->ds);
+            warn_report("spice: no texture available to display");
+        }
+    } else {
+        surface_gl_destroy_texture(ssd->gls, ssd->ds);
+        ssd->ds->texture = texture;
+        ssd->ds->mem_obj = mem_obj;
+    }
+    return ret;
+}
+
 static void spice_server_gl_scanout(QXLInstance *qxl,
                                     const int *fd,
                                     uint32_t width, uint32_t height,
@@ -917,6 +992,7 @@ static void spice_gl_switch(DisplayChangeListener *dcl,
                             struct DisplaySurface *new_surface)
 {
     SimpleSpiceDisplay *ssd = container_of(dcl, SimpleSpiceDisplay, dcl);
+    bool ret;
 
     if (ssd->ds) {
         surface_gl_destroy_texture(ssd->gls, ssd->ds);
@@ -939,6 +1015,12 @@ static void spice_gl_switch(DisplayChangeListener *dcl,
             return;
         }
 
+        ret = spice_gl_replace_fd_texture(ssd, fd, &modifier, &num_planes);
+        if (!ret) {
+            surface_gl_destroy_texture(ssd->gls, ssd->ds);
+            return;
+        }
+
         trace_qemu_spice_gl_surface(ssd->qxl.id,
                                     surface_width(ssd->ds),
                                     surface_height(ssd->ds),

From f851cd65ebe24cc716a70a2fa68c149e5440f2f4 Mon Sep 17 00:00:00 2001
From: Vivek Kasireddy <vivek.kasireddy@intel.com>
Date: Mon, 16 Jun 2025 21:32:31 -0700
Subject: [PATCH 2362/2760] ui/spice: Blit the scanout texture if its memory
 layout is not linear
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In cases where the scanout buffer is provided as a texture (e.g. Virgl)
we need to check to see if it has a linear memory layout or not. If
it doesn't have a linear layout, then blitting it onto the texture
associated with the display surface (which already has a linear layout)
seems to ensure that there is no corruption seen regardless of which
encoder or decoder is used.

Cc: Gerd Hoffmann <kraxel@redhat.com>
Cc: Marc-André Lureau <marcandre.lureau@redhat.com>
Cc: Dmitry Osipenko <dmitry.osipenko@collabora.com>
Cc: Frediano Ziglio <freddy77@gmail.com>
Cc: Dongwon Kim <dongwon.kim@intel.com>
Cc: Michael Scherle <michael.scherle@rz.uni-freiburg.de>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Vivek Kasireddy <vivek.kasireddy@intel.com>
Message-Id: <20250617043546.1022779-8-vivek.kasireddy@intel.com>
---
 include/ui/spice-display.h |  3 ++
 ui/spice-display.c         | 81 +++++++++++++++++++++++++++++++++++---
 2 files changed, 78 insertions(+), 6 deletions(-)

diff --git a/include/ui/spice-display.h b/include/ui/spice-display.h
index 9bdde78266..690ece7380 100644
--- a/include/ui/spice-display.h
+++ b/include/ui/spice-display.h
@@ -132,6 +132,9 @@ struct SimpleSpiceDisplay {
     egl_fb guest_fb;
     egl_fb blit_fb;
     egl_fb cursor_fb;
+    bool backing_y_0_top;
+    bool blit_scanout_texture;
+    bool new_scanout_texture;
     bool have_hot;
 #endif
 };
diff --git a/ui/spice-display.c b/ui/spice-display.c
index 854a97c198..9ce622cefc 100644
--- a/ui/spice-display.c
+++ b/ui/spice-display.c
@@ -1086,7 +1086,7 @@ static void qemu_spice_gl_scanout_texture(DisplayChangeListener *dcl,
 {
     SimpleSpiceDisplay *ssd = container_of(dcl, SimpleSpiceDisplay, dcl);
     EGLint offset[DMABUF_MAX_PLANES], stride[DMABUF_MAX_PLANES], fourcc = 0;
-    int fd[DMABUF_MAX_PLANES], num_planes;
+    int fd[DMABUF_MAX_PLANES], num_planes, i;
     uint64_t modifier;
 
     assert(tex_id);
@@ -1098,11 +1098,26 @@ static void qemu_spice_gl_scanout_texture(DisplayChangeListener *dcl,
 
     trace_qemu_spice_gl_scanout_texture(ssd->qxl.id, w, h, fourcc);
 
-    /* note: spice server will close the fd */
-    spice_server_gl_scanout(&ssd->qxl, fd, backing_width, backing_height,
-                            (uint32_t *)offset, (uint32_t *)stride, num_planes,
-                            fourcc, modifier, y_0_top);
-    qemu_spice_gl_monitor_config(ssd, x, y, w, h);
+    if (spice_remote_client && modifier != DRM_FORMAT_MOD_LINEAR) {
+        egl_fb_destroy(&ssd->guest_fb);
+        egl_fb_setup_for_tex(&ssd->guest_fb,
+                             backing_width, backing_height,
+                             tex_id, false);
+        ssd->backing_y_0_top = y_0_top;
+        ssd->blit_scanout_texture = true;
+        ssd->new_scanout_texture = true;
+
+        for (i = 0; i < num_planes; i++) {
+            close(fd[i]);
+        }
+    } else {
+        /* note: spice server will close the fd */
+        spice_server_gl_scanout(&ssd->qxl, fd, backing_width, backing_height,
+                                (uint32_t *)offset, (uint32_t *)stride,
+                                num_planes, fourcc, modifier, y_0_top);
+        qemu_spice_gl_monitor_config(ssd, x, y, w, h);
+    }
+
     ssd->have_surface = false;
     ssd->have_scanout = true;
 }
@@ -1168,6 +1183,50 @@ static void qemu_spice_gl_release_dmabuf(DisplayChangeListener *dcl,
     egl_dmabuf_release_texture(dmabuf);
 }
 
+static bool spice_gl_blit_scanout_texture(SimpleSpiceDisplay *ssd,
+                                          egl_fb *scanout_tex_fb)
+{
+    uint32_t offsets[DMABUF_MAX_PLANES], strides[DMABUF_MAX_PLANES];
+    int fds[DMABUF_MAX_PLANES], num_planes, fourcc;
+    uint64_t modifier;
+    bool ret;
+
+    egl_fb_destroy(scanout_tex_fb);
+    egl_fb_setup_for_tex(scanout_tex_fb,
+                         surface_width(ssd->ds), surface_height(ssd->ds),
+                         ssd->ds->texture, false);
+    egl_fb_blit(scanout_tex_fb, &ssd->guest_fb, false);
+    glFlush();
+
+    if (!ssd->new_scanout_texture) {
+        return true;
+    }
+
+    ret = egl_dmabuf_export_texture(ssd->ds->texture,
+                                    fds,
+                                    (EGLint *)offsets,
+                                    (EGLint *)strides,
+                                    &fourcc,
+                                    &num_planes,
+                                    &modifier);
+    if (!ret) {
+        error_report("spice: failed to get fd for texture");
+        return false;
+    }
+
+    spice_server_gl_scanout(&ssd->qxl, fds,
+                            surface_width(ssd->ds),
+                            surface_height(ssd->ds),
+                            (uint32_t *)offsets, (uint32_t *)strides,
+                            num_planes, fourcc, modifier,
+                            ssd->backing_y_0_top);
+    qemu_spice_gl_monitor_config(ssd, 0, 0,
+                                 surface_width(ssd->ds),
+                                 surface_height(ssd->ds));
+    ssd->new_scanout_texture = false;
+    return true;
+}
+
 static void qemu_spice_gl_update(DisplayChangeListener *dcl,
                                  uint32_t x, uint32_t y, uint32_t w, uint32_t h)
 {
@@ -1175,6 +1234,7 @@ static void qemu_spice_gl_update(DisplayChangeListener *dcl,
     EGLint fourcc = 0;
     bool render_cursor = false;
     bool y_0_top = false; /* FIXME */
+    bool ret;
     uint32_t width, height, texture;
 
     if (!ssd->have_scanout) {
@@ -1269,6 +1329,15 @@ static void qemu_spice_gl_update(DisplayChangeListener *dcl,
         glFlush();
     }
 
+    if (spice_remote_client && ssd->blit_scanout_texture) {
+        egl_fb scanout_tex_fb;
+
+        ret = spice_gl_blit_scanout_texture(ssd, &scanout_tex_fb);
+        if (!ret) {
+            return;
+        }
+    }
+
     trace_qemu_spice_gl_update(ssd->qxl.id, w, h, x, y);
     qemu_spice_gl_block(ssd, true);
     glFlush();

From 454f4b0f593b149c7a6d8192e1ed3de00de9ae24 Mon Sep 17 00:00:00 2001
From: Andrew Keesler <ankeesler@google.com>
Date: Wed, 9 Jul 2025 12:11:26 +0000
Subject: [PATCH 2363/2760] hw/display: Allow injection of virtio-gpu EDID name
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Thanks to 72d277a7, 1ed2cb32, and others, EDID (Extended Display
Identification Data) is propagated by QEMU such that a virtual display
presents legitimate metadata (e.g., name, serial number, preferred
resolutions, etc.) to its connected guest.

This change adds the ability to specify the EDID name for a particular
virtio-vga display. Previously, every virtual display would have the same
name: "QEMU Monitor". Now, we can inject names of displays in order to test
guest behavior that is specific to display names. We provide the ability to
inject the display name from the frontend since this is guest visible
data. Furthermore, this makes it clear where N potential display outputs
would get their name from (which will be added in a future change).

Note that we have elected to use a struct here for output data for
extensibility - we intend to add per-output fields like resolution in a
future change.

It should be noted that EDID names longer than 12 bytes will be truncated
per spec (I think?).

Testing: verified that when I specified 2 outputs for a virtio-gpu with
edid_name set, the names matched those that I configured with my vnc
display.

  -display vnc=localhost:0,id=aaa,display=vga,head=0 \
  -display vnc=localhost:1,id=bbb,display=vga,head=1 \
  -device '{"driver":"virtio-vga",
            "max_outputs":2,
            "id":"vga",
            "outputs":[
              {
                 "name":"AAA"
              },
              {
                 "name":"BBB"
              }
            ]}'

Signed-off-by: Andrew Keesler <ankeesler@google.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20250709121126.2946088-2-ankeesler@google.com>
---
 hw/core/qdev-properties-system.c    | 44 +++++++++++++++++++++++++++++
 hw/display/virtio-gpu-base.c        | 27 ++++++++++++++++++
 include/hw/display/edid.h           |  2 ++
 include/hw/qdev-properties-system.h |  5 ++++
 include/hw/virtio/virtio-gpu.h      |  3 ++
 qapi/virtio.json                    | 18 ++++++++++--
 6 files changed, 97 insertions(+), 2 deletions(-)

diff --git a/hw/core/qdev-properties-system.c b/hw/core/qdev-properties-system.c
index 24e145d870..1f810b7ddf 100644
--- a/hw/core/qdev-properties-system.c
+++ b/hw/core/qdev-properties-system.c
@@ -1299,3 +1299,47 @@ const PropertyInfo qdev_prop_vmapple_virtio_blk_variant = {
     .set   = qdev_propinfo_set_enum,
     .set_default_value = qdev_propinfo_set_default_value_enum,
 };
+
+/* --- VirtIOGPUOutputList --- */
+
+static void get_virtio_gpu_output_list(Object *obj, Visitor *v,
+    const char *name, void *opaque, Error **errp)
+{
+    VirtIOGPUOutputList **prop_ptr =
+        object_field_prop_ptr(obj, opaque);
+
+    visit_type_VirtIOGPUOutputList(v, name, prop_ptr, errp);
+}
+
+static void set_virtio_gpu_output_list(Object *obj, Visitor *v,
+    const char *name, void *opaque, Error **errp)
+{
+    VirtIOGPUOutputList **prop_ptr =
+        object_field_prop_ptr(obj, opaque);
+    VirtIOGPUOutputList *list;
+
+    if (!visit_type_VirtIOGPUOutputList(v, name, &list, errp)) {
+        return;
+    }
+
+    qapi_free_VirtIOGPUOutputList(*prop_ptr);
+    *prop_ptr = list;
+}
+
+static void release_virtio_gpu_output_list(Object *obj,
+    const char *name, void *opaque)
+{
+    VirtIOGPUOutputList **prop_ptr =
+        object_field_prop_ptr(obj, opaque);
+
+    qapi_free_VirtIOGPUOutputList(*prop_ptr);
+    *prop_ptr = NULL;
+}
+
+const PropertyInfo qdev_prop_virtio_gpu_output_list = {
+    .type = "VirtIOGPUOutputList",
+    .description = "VirtIO GPU output list [{\"name\":\"<name>\"},...]",
+    .get = get_virtio_gpu_output_list,
+    .set = set_virtio_gpu_output_list,
+    .release = release_virtio_gpu_output_list,
+};
diff --git a/hw/display/virtio-gpu-base.c b/hw/display/virtio-gpu-base.c
index 9eb806b71f..7269477a1c 100644
--- a/hw/display/virtio-gpu-base.c
+++ b/hw/display/virtio-gpu-base.c
@@ -19,6 +19,7 @@
 #include "qemu/error-report.h"
 #include "hw/display/edid.h"
 #include "trace.h"
+#include "qapi/qapi-types-virtio.h"
 
 void
 virtio_gpu_base_reset(VirtIOGPUBase *g)
@@ -56,6 +57,8 @@ void
 virtio_gpu_base_generate_edid(VirtIOGPUBase *g, int scanout,
                               struct virtio_gpu_resp_edid *edid)
 {
+    size_t output_idx;
+    VirtIOGPUOutputList *node;
     qemu_edid_info info = {
         .width_mm = g->req_state[scanout].width_mm,
         .height_mm = g->req_state[scanout].height_mm,
@@ -64,6 +67,14 @@ virtio_gpu_base_generate_edid(VirtIOGPUBase *g, int scanout,
         .refresh_rate = g->req_state[scanout].refresh_rate,
     };
 
+    for (output_idx = 0, node = g->conf.outputs;
+         output_idx <= scanout && node; output_idx++, node = node->next) {
+        if (output_idx == scanout && node->value && node->value->name) {
+            info.name = node->value->name;
+            break;
+        }
+    }
+
     edid->size = cpu_to_le32(sizeof(edid->edid));
     qemu_edid_generate(edid->edid, sizeof(edid->edid), &info);
 }
@@ -172,6 +183,8 @@ virtio_gpu_base_device_realize(DeviceState *qdev,
                                VirtIOHandleOutput cursor_cb,
                                Error **errp)
 {
+    size_t output_idx;
+    VirtIOGPUOutputList *node;
     VirtIODevice *vdev = VIRTIO_DEVICE(qdev);
     VirtIOGPUBase *g = VIRTIO_GPU_BASE(qdev);
     int i;
@@ -181,6 +194,20 @@ virtio_gpu_base_device_realize(DeviceState *qdev,
         return false;
     }
 
+    for (output_idx = 0, node = g->conf.outputs;
+         node; output_idx++, node = node->next) {
+        if (output_idx == g->conf.max_outputs) {
+            error_setg(errp, "invalid outputs > %d", g->conf.max_outputs);
+            return false;
+        }
+        if (node->value && node->value->name &&
+            strlen(node->value->name) > EDID_NAME_MAX_LENGTH) {
+            error_setg(errp, "invalid output name '%s' > %d",
+                       node->value->name, EDID_NAME_MAX_LENGTH);
+            return false;
+        }
+    }
+
     if (virtio_gpu_virgl_enabled(g->conf)) {
         error_setg(&g->migration_blocker, "virgl is not yet migratable");
         if (migrate_add_blocker(&g->migration_blocker, errp) < 0) {
diff --git a/include/hw/display/edid.h b/include/hw/display/edid.h
index 520f8ec202..91c0a428af 100644
--- a/include/hw/display/edid.h
+++ b/include/hw/display/edid.h
@@ -1,6 +1,8 @@
 #ifndef EDID_H
 #define EDID_H
 
+#define EDID_NAME_MAX_LENGTH 12
+
 typedef struct qemu_edid_info {
     const char *vendor; /* http://www.uefi.org/pnp_id_list */
     const char *name;
diff --git a/include/hw/qdev-properties-system.h b/include/hw/qdev-properties-system.h
index b921392c52..9601a11a09 100644
--- a/include/hw/qdev-properties-system.h
+++ b/include/hw/qdev-properties-system.h
@@ -32,6 +32,7 @@ extern const PropertyInfo qdev_prop_cpus390entitlement;
 extern const PropertyInfo qdev_prop_iothread_vq_mapping_list;
 extern const PropertyInfo qdev_prop_endian_mode;
 extern const PropertyInfo qdev_prop_vmapple_virtio_blk_variant;
+extern const PropertyInfo qdev_prop_virtio_gpu_output_list;
 
 #define DEFINE_PROP_PCI_DEVFN(_n, _s, _f, _d)                   \
     DEFINE_PROP_SIGNED(_n, _s, _f, _d, qdev_prop_pci_devfn, int32_t)
@@ -110,4 +111,8 @@ extern const PropertyInfo qdev_prop_vmapple_virtio_blk_variant;
                          qdev_prop_vmapple_virtio_blk_variant, \
                          VMAppleVirtioBlkVariant)
 
+#define DEFINE_PROP_VIRTIO_GPU_OUTPUT_LIST(_name, _state, _field) \
+    DEFINE_PROP(_name, _state, _field, qdev_prop_virtio_gpu_output_list, \
+                VirtIOGPUOutputList *)
+
 #endif
diff --git a/include/hw/virtio/virtio-gpu.h b/include/hw/virtio/virtio-gpu.h
index a42957c4e2..9f16f89a36 100644
--- a/include/hw/virtio/virtio-gpu.h
+++ b/include/hw/virtio/virtio-gpu.h
@@ -20,6 +20,7 @@
 #include "hw/virtio/virtio.h"
 #include "qemu/log.h"
 #include "system/vhost-user-backend.h"
+#include "qapi/qapi-types-virtio.h"
 
 #include "standard-headers/linux/virtio_gpu.h"
 #include "standard-headers/linux/virtio_ids.h"
@@ -128,6 +129,7 @@ struct virtio_gpu_base_conf {
     uint32_t xres;
     uint32_t yres;
     uint64_t hostmem;
+    VirtIOGPUOutputList *outputs;
 };
 
 struct virtio_gpu_ctrl_command {
@@ -167,6 +169,7 @@ struct VirtIOGPUBaseClass {
 
 #define VIRTIO_GPU_BASE_PROPERTIES(_state, _conf)                       \
     DEFINE_PROP_UINT32("max_outputs", _state, _conf.max_outputs, 1),    \
+    DEFINE_PROP_VIRTIO_GPU_OUTPUT_LIST("outputs", _state, _conf.outputs), \
     DEFINE_PROP_BIT("edid", _state, _conf.flags, \
                     VIRTIO_GPU_FLAG_EDID_ENABLED, true), \
     DEFINE_PROP_UINT32("xres", _state, _conf.xres, 1280), \
diff --git a/qapi/virtio.json b/qapi/virtio.json
index 73df718a26..5e658a7033 100644
--- a/qapi/virtio.json
+++ b/qapi/virtio.json
@@ -963,17 +963,31 @@
 { 'struct': 'IOThreadVirtQueueMapping',
   'data': { 'iothread': 'str', '*vqs': ['uint16'] } }
 
+##
+# @VirtIOGPUOutput:
+#
+# Describes configuration of a VirtIO GPU output.
+#
+# @name: the name of the output
+#
+# Since: 10.1
+##
+
+{ 'struct': 'VirtIOGPUOutput',
+  'data': { 'name': 'str' } }
+
 ##
 # @DummyVirtioForceArrays:
 #
 # Not used by QMP; hack to let us use IOThreadVirtQueueMappingList
-# internally
+# and VirtIOGPUOutputList internally
 #
 # Since: 9.0
 ##
 
 { 'struct': 'DummyVirtioForceArrays',
-  'data': { 'unused-iothread-vq-mapping': ['IOThreadVirtQueueMapping'] } }
+  'data': { 'unused-iothread-vq-mapping': ['IOThreadVirtQueueMapping'],
+            'unused-virtio-gpu-output': ['VirtIOGPUOutput'] } }
 
 ##
 # @GranuleMode:

From c65680a76c190d187be1bfd18207b22227541d77 Mon Sep 17 00:00:00 2001
From: Weifeng Liu <weifeng.liu.z@gmail.com>
Date: Sun, 1 Jun 2025 12:52:32 +0800
Subject: [PATCH 2364/2760] ui/gtk: Add keep-aspect-ratio option
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When aspect ratio of host window and that of guest display are not
aligned, we can either zoom the guest content to fill the whole host
window or add padding to respect aspect ratio of the guest. Add an
option keep-aspect-ratio to allow users to select their preferred
behavior in this case.

Suggested-by: BALATON Zoltan <balaton@eik.bme.hu>
Suggested-by: Kim, Dongwon <dongwon.kim@intel.com>
Signed-off-by: Weifeng Liu <weifeng.liu.z@gmail.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Tested-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20250601045245.36778-2-weifeng.liu.z@gmail.com>
---
 include/ui/gtk.h |  1 +
 qapi/ui.json     | 12 ++++++++----
 ui/gtk.c         | 12 ++++++++++--
 3 files changed, 19 insertions(+), 6 deletions(-)

diff --git a/include/ui/gtk.h b/include/ui/gtk.h
index d3944046db..b7cfbf218e 100644
--- a/include/ui/gtk.h
+++ b/include/ui/gtk.h
@@ -140,6 +140,7 @@ struct GtkDisplayState {
     GdkCursor *null_cursor;
     Notifier mouse_mode_notifier;
     gboolean free_scale;
+    gboolean keep_aspect_ratio;
 
     bool external_pause_update;
 
diff --git a/qapi/ui.json b/qapi/ui.json
index 514fa159b1..9e496b4835 100644
--- a/qapi/ui.json
+++ b/qapi/ui.json
@@ -1335,13 +1335,17 @@
 # @show-menubar: Display the main window menubar.  Defaults to "on".
 #     (Since 8.0)
 #
+# @keep-aspect-ratio: Keep width/height aspect ratio of guest content when
+#     resizing host window.  Defaults to "on". (Since 10.1)
+#
 # Since: 2.12
 ##
 { 'struct'  : 'DisplayGTK',
-  'data'    : { '*grab-on-hover' : 'bool',
-                '*zoom-to-fit'   : 'bool',
-                '*show-tabs'     : 'bool',
-                '*show-menubar'  : 'bool'  } }
+  'data'    : { '*grab-on-hover'     : 'bool',
+                '*zoom-to-fit'       : 'bool',
+                '*show-tabs'         : 'bool',
+                '*show-menubar'      : 'bool',
+                '*keep-aspect-ratio' : 'bool'  } }
 
 ##
 # @DisplayEGLHeadless:
diff --git a/ui/gtk.c b/ui/gtk.c
index 8c4a94c8f6..9104509ee1 100644
--- a/ui/gtk.c
+++ b/ui/gtk.c
@@ -828,8 +828,12 @@ void gd_update_scale(VirtualConsole *vc, int ww, int wh, int fbw, int fbh)
 
         sx = (double)ww / fbw;
         sy = (double)wh / fbh;
-
-        vc->gfx.scale_x = vc->gfx.scale_y = MIN(sx, sy);
+        if (vc->s->keep_aspect_ratio) {
+            vc->gfx.scale_x = vc->gfx.scale_y = MIN(sx, sy);
+        } else {
+            vc->gfx.scale_x = sx;
+            vc->gfx.scale_y = sy;
+        }
     }
 }
 /**
@@ -2328,6 +2332,10 @@ static GSList *gd_vc_gfx_init(GtkDisplayState *s, VirtualConsole *vc,
         s->free_scale = true;
     }
 
+    s->keep_aspect_ratio = true;
+    if (s->opts->u.gtk.has_keep_aspect_ratio)
+        s->keep_aspect_ratio = s->opts->u.gtk.keep_aspect_ratio;
+
     for (i = 0; i < INPUT_EVENT_SLOTS_MAX; i++) {
         struct touch_slot *slot = &touch_slots[i];
         slot->tracking_id = -1;

From 0ba45b79452b7f1fb7d45a1a555cbd88ccedb228 Mon Sep 17 00:00:00 2001
From: Weifeng Liu <weifeng.liu.z@gmail.com>
Date: Sun, 1 Jun 2025 12:52:33 +0800
Subject: [PATCH 2365/2760] ui/gtk: Add scale option
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Allow user to set a preferred scale (defaulting to 1) of the virtual
display. Along with zoom-to-fix=false, this would be helpful for users
running QEMU on hi-dpi host desktop to achieve pixel to pixel display --
e.g., if the scale factor of a user's host desktop is set to 200%, then
they can set a 0.5 scale for the virtual display to avoid magnification
that might cause blurriness.

Signed-off-by: Weifeng Liu <weifeng.liu.z@gmail.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Tested-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20250601045245.36778-3-weifeng.liu.z@gmail.com>
---
 include/ui/gtk.h |  1 +
 qapi/ui.json     |  5 ++++-
 ui/gtk.c         | 46 +++++++++++++++++++++++++++++-----------------
 3 files changed, 34 insertions(+), 18 deletions(-)

diff --git a/include/ui/gtk.h b/include/ui/gtk.h
index b7cfbf218e..3e6ce3cb48 100644
--- a/include/ui/gtk.h
+++ b/include/ui/gtk.h
@@ -41,6 +41,7 @@ typedef struct VirtualGfxConsole {
     DisplaySurface *ds;
     pixman_image_t *convert;
     cairo_surface_t *surface;
+    double preferred_scale;
     double scale_x;
     double scale_y;
 #if defined(CONFIG_OPENGL)
diff --git a/qapi/ui.json b/qapi/ui.json
index 9e496b4835..a465d671c7 100644
--- a/qapi/ui.json
+++ b/qapi/ui.json
@@ -1338,6 +1338,8 @@
 # @keep-aspect-ratio: Keep width/height aspect ratio of guest content when
 #     resizing host window.  Defaults to "on". (Since 10.1)
 #
+# @scale: Set preferred scale of the display.  Defaults to 1.0.  (Since 10.1)
+#
 # Since: 2.12
 ##
 { 'struct'  : 'DisplayGTK',
@@ -1345,7 +1347,8 @@
                 '*zoom-to-fit'       : 'bool',
                 '*show-tabs'         : 'bool',
                 '*show-menubar'      : 'bool',
-                '*keep-aspect-ratio' : 'bool'  } }
+                '*keep-aspect-ratio' : 'bool',
+                '*scale'             : 'number'  } }
 
 ##
 # @DisplayEGLHeadless:
diff --git a/ui/gtk.c b/ui/gtk.c
index 9104509ee1..e91d093a49 100644
--- a/ui/gtk.c
+++ b/ui/gtk.c
@@ -67,6 +67,7 @@
 #define VC_TERM_X_MIN     80
 #define VC_TERM_Y_MIN     25
 #define VC_SCALE_MIN    0.25
+#define VC_SCALE_MAX       4
 #define VC_SCALE_STEP   0.25
 
 #ifdef GDK_WINDOWING_X11
@@ -272,15 +273,11 @@ static void gd_update_geometry_hints(VirtualConsole *vc)
         if (!vc->gfx.ds) {
             return;
         }
-        if (s->free_scale) {
-            geo.min_width  = surface_width(vc->gfx.ds) * VC_SCALE_MIN;
-            geo.min_height = surface_height(vc->gfx.ds) * VC_SCALE_MIN;
-            mask |= GDK_HINT_MIN_SIZE;
-        } else {
-            geo.min_width  = surface_width(vc->gfx.ds) * vc->gfx.scale_x;
-            geo.min_height = surface_height(vc->gfx.ds) * vc->gfx.scale_y;
-            mask |= GDK_HINT_MIN_SIZE;
-        }
+        double scale_x = s->free_scale ? VC_SCALE_MIN : vc->gfx.scale_x;
+        double scale_y = s->free_scale ? VC_SCALE_MIN : vc->gfx.scale_y;
+        geo.min_width  = surface_width(vc->gfx.ds) * scale_x;
+        geo.min_height = surface_height(vc->gfx.ds) * scale_y;
+        mask |= GDK_HINT_MIN_SIZE;
         geo_widget = vc->gfx.drawing_area;
         gtk_widget_set_size_request(geo_widget, geo.min_width, geo.min_height);
 
@@ -1579,8 +1576,8 @@ static void gd_menu_full_screen(GtkMenuItem *item, void *opaque)
         }
         s->full_screen = FALSE;
         if (vc->type == GD_VC_GFX) {
-            vc->gfx.scale_x = 1.0;
-            vc->gfx.scale_y = 1.0;
+            vc->gfx.scale_x = vc->gfx.preferred_scale;
+            vc->gfx.scale_y = vc->gfx.preferred_scale;
             gd_update_windowsize(vc);
         }
     }
@@ -1636,8 +1633,8 @@ static void gd_menu_zoom_fixed(GtkMenuItem *item, void *opaque)
     GtkDisplayState *s = opaque;
     VirtualConsole *vc = gd_vc_find_current(s);
 
-    vc->gfx.scale_x = 1.0;
-    vc->gfx.scale_y = 1.0;
+    vc->gfx.scale_x = vc->gfx.preferred_scale;
+    vc->gfx.scale_y = vc->gfx.preferred_scale;
 
     gd_update_windowsize(vc);
 }
@@ -1651,8 +1648,8 @@ static void gd_menu_zoom_fit(GtkMenuItem *item, void *opaque)
         s->free_scale = TRUE;
     } else {
         s->free_scale = FALSE;
-        vc->gfx.scale_x = 1.0;
-        vc->gfx.scale_y = 1.0;
+        vc->gfx.scale_x = vc->gfx.preferred_scale;
+        vc->gfx.scale_y = vc->gfx.preferred_scale;
     }
 
     gd_update_windowsize(vc);
@@ -2243,6 +2240,11 @@ static void gl_area_realize(GtkGLArea *area, VirtualConsole *vc)
 }
 #endif
 
+static bool gd_scale_valid(double scale)
+{
+    return scale >= VC_SCALE_MIN && scale <= VC_SCALE_MAX;
+}
+
 static GSList *gd_vc_gfx_init(GtkDisplayState *s, VirtualConsole *vc,
                               QemuConsole *con, int idx,
                               GSList *group, GtkWidget *view_menu)
@@ -2252,8 +2254,18 @@ static GSList *gd_vc_gfx_init(GtkDisplayState *s, VirtualConsole *vc,
 
     vc->label = qemu_console_get_label(con);
     vc->s = s;
-    vc->gfx.scale_x = 1.0;
-    vc->gfx.scale_y = 1.0;
+    vc->gfx.preferred_scale = 1.0;
+    if (s->opts->u.gtk.has_scale) {
+        if (gd_scale_valid(s->opts->u.gtk.scale)) {
+            vc->gfx.preferred_scale = s->opts->u.gtk.scale;
+        } else {
+            error_report("Invalid scale value %lf given, being ignored",
+                         s->opts->u.gtk.scale);
+            s->opts->u.gtk.has_scale = false;
+        }
+    }
+    vc->gfx.scale_x = vc->gfx.preferred_scale;
+    vc->gfx.scale_y = vc->gfx.preferred_scale;
 
 #if defined(CONFIG_OPENGL)
     if (display_opengl) {

From df892b3954e5b2782165e6c59e5ffd55c2f7ec5a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Mon, 7 Jul 2025 14:14:12 +0400
Subject: [PATCH 2366/2760] tpm: "qemu -tpmdev help" should return success
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Like other "-foo help" CLI, the qemu process should return 0 for
"-tpmdev help".

While touching this, switch to is_help_option() utility function as
suggested by Peter Maydell.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20250707101412.2055581-1-marcandre.lureau@redhat.com>
---
 system/tpm.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/system/tpm.c b/system/tpm.c
index 8df0f6e72b..903b29c043 100644
--- a/system/tpm.c
+++ b/system/tpm.c
@@ -21,6 +21,7 @@
 #include "system/tpm.h"
 #include "qemu/config-file.h"
 #include "qemu/error-report.h"
+#include "qemu/help_option.h"
 
 static QLIST_HEAD(, TPMBackend) tpm_backends =
     QLIST_HEAD_INITIALIZER(tpm_backends);
@@ -179,9 +180,9 @@ int tpm_config_parse(QemuOptsList *opts_list, const char *optstr)
 {
     QemuOpts *opts;
 
-    if (!strcmp(optstr, "help")) {
+    if (is_help_option(optstr)) {
         tpm_display_backend_drivers();
-        return -1;
+        exit(EXIT_SUCCESS);
     }
     opts = qemu_opts_parse_noisily(opts_list, optstr, true);
     if (!opts) {

From 4bf06bcf072968c702712ed7fcb2a53f5a252216 Mon Sep 17 00:00:00 2001
From: "Michael S. Tsirkin" <mst@redhat.com>
Date: Mon, 14 Jul 2025 16:42:12 -0400
Subject: [PATCH 2367/2760] rust: bindings: allow any number of params
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We are going to be adding more parameters, and this makes
rust unhappy:
    Functions with lots of parameters are considered bad style and reduce
    readability (“what does the 5th parameter mean?”). Consider grouping
    some parameters into a new type.

Specifically:

error: this function has too many arguments (8/7)
    --> /builds/mstredhat/qemu/build/rust/qemu-api/rust-qemu-api-tests.p/structured/bindings.inc.rs:3840:5
     |
3840 | /     pub fn new_bitfield_1(
3841 | |         secure: std::os::raw::c_uint,
3842 | |         space: std::os::raw::c_uint,
3843 | |         user: std::os::raw::c_uint,
...    |
3848 | |         address_type: std::os::raw::c_uint,
3849 | |     ) -> __BindgenBitfieldUnit<[u8; 4usize]> {
     | |____________________________________________^
     |
     = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#too_many_arguments
     = note: `-D clippy::too-many-arguments` implied by `-D warnings`
     = help: to override `-D warnings` add `#[allow(clippy::too_many_arguments)]`

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Acked-by: Paolo Bonzini <pbonzini@redhat.com>
Message-Id: <e41344bd22248b0883752ef7a7c459090a3d9cfc.1752560127.git.mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 rust/qemu-api/src/bindings.rs | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/rust/qemu-api/src/bindings.rs b/rust/qemu-api/src/bindings.rs
index 057de4b646..c4f1f755ce 100644
--- a/rust/qemu-api/src/bindings.rs
+++ b/rust/qemu-api/src/bindings.rs
@@ -13,7 +13,8 @@
     clippy::missing_const_for_fn,
     clippy::ptr_offset_with_cast,
     clippy::useless_transmute,
-    clippy::missing_safety_doc
+    clippy::missing_safety_doc,
+    clippy::too_many_arguments
 )]
 
 //! `bindgen`-generated declarations.

From 06895f7948a32e833a8686d8394064ca2a4d66cc Mon Sep 17 00:00:00 2001
From: CLEMENT MATHIEU--DRIF <clement.mathieu--drif@eviden.com>
Date: Sat, 28 Jun 2025 18:03:58 +0000
Subject: [PATCH 2368/2760] pci: Add a memory attribute for pre-translated DMA
 operations

The address_type bit will be set to PCI_AT_TRANSLATED by devices that
use cached addresses obtained via ATS.

Signed-off-by: Clement Mathieu--Drif <clement.mathieu--drif@eviden.com>
Message-Id: <20250628180226.133285-2-clement.mathieu--drif@eviden.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 include/exec/memattrs.h | 3 +++
 include/hw/pci/pci.h    | 9 +++++++++
 2 files changed, 12 insertions(+)

diff --git a/include/exec/memattrs.h b/include/exec/memattrs.h
index 8db1d30464..52ee955249 100644
--- a/include/exec/memattrs.h
+++ b/include/exec/memattrs.h
@@ -54,6 +54,9 @@ typedef struct MemTxAttrs {
      */
     unsigned int pid:8;
 
+    /* PCI - IOMMU operations, see PCIAddressType */
+    unsigned int address_type:1;
+
     /*
      * Bus masters which don't specify any attributes will get this
      * (via the MEMTXATTRS_UNSPECIFIED constant), so that we can
diff --git a/include/hw/pci/pci.h b/include/hw/pci/pci.h
index df3cc7b875..6b7d3ac8a3 100644
--- a/include/hw/pci/pci.h
+++ b/include/hw/pci/pci.h
@@ -134,6 +134,15 @@ struct PCIHostDeviceAddress {
     unsigned int function;
 };
 
+/*
+ * Represents the Address Type (AT) field in a PCI request,
+ * see MemTxAttrs.address_type
+ */
+typedef enum PCIAddressType {
+    PCI_AT_UNTRANSLATED = 0, /* Default when no attribute is set */
+    PCI_AT_TRANSLATED = 1,
+} PCIAddressType;
+
 typedef void PCIConfigWriteFunc(PCIDevice *pci_dev,
                                 uint32_t address, uint32_t data, int len);
 typedef uint32_t PCIConfigReadFunc(PCIDevice *pci_dev,

From 4b05c720aaf32c404003a3235300466b7b3342c3 Mon Sep 17 00:00:00 2001
From: CLEMENT MATHIEU--DRIF <clement.mathieu--drif@eviden.com>
Date: Sat, 28 Jun 2025 18:03:59 +0000
Subject: [PATCH 2369/2760] memory: Add permissions in IOMMUAccessFlags

This will be necessary for devices implementing ATS.
We also define a new macro IOMMU_ACCESS_FLAG_FULL in addition to
IOMMU_ACCESS_FLAG to support more access flags.
IOMMU_ACCESS_FLAG is kept for convenience and backward compatibility.

Here are the flags added (defined by the PCIe 5 specification) :
    - Execute Requested
    - Privileged Mode Requested
    - Global
    - Untranslated Only

IOMMU_ACCESS_FLAG sets the additional flags to 0

Signed-off-by: Clement Mathieu--Drif <clement.mathieu--drif@eviden.com>
Message-Id: <20250628180226.133285-3-clement.mathieu--drif@eviden.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 include/system/memory.h | 23 +++++++++++++++++++++--
 1 file changed, 21 insertions(+), 2 deletions(-)

diff --git a/include/system/memory.h b/include/system/memory.h
index 46248d4a52..1672622d70 100644
--- a/include/system/memory.h
+++ b/include/system/memory.h
@@ -109,15 +109,34 @@ struct MemoryRegionSection {
 
 typedef struct IOMMUTLBEntry IOMMUTLBEntry;
 
-/* See address_space_translate: bit 0 is read, bit 1 is write.  */
+/*
+ * See address_space_translate:
+ *      - bit 0 : read
+ *      - bit 1 : write
+ *      - bit 2 : exec
+ *      - bit 3 : priv
+ *      - bit 4 : global
+ *      - bit 5 : untranslated only
+ */
 typedef enum {
     IOMMU_NONE = 0,
     IOMMU_RO   = 1,
     IOMMU_WO   = 2,
     IOMMU_RW   = 3,
+    IOMMU_EXEC = 4,
+    IOMMU_PRIV = 8,
+    IOMMU_GLOBAL = 16,
+    IOMMU_UNTRANSLATED_ONLY = 32,
 } IOMMUAccessFlags;
 
-#define IOMMU_ACCESS_FLAG(r, w) (((r) ? IOMMU_RO : 0) | ((w) ? IOMMU_WO : 0))
+#define IOMMU_ACCESS_FLAG(r, w)     (((r) ? IOMMU_RO : 0) | \
+                                    ((w) ? IOMMU_WO : 0))
+#define IOMMU_ACCESS_FLAG_FULL(r, w, x, p, g, uo) \
+                                    (IOMMU_ACCESS_FLAG(r, w) | \
+                                    ((x) ? IOMMU_EXEC : 0) | \
+                                    ((p) ? IOMMU_PRIV : 0) | \
+                                    ((g) ? IOMMU_GLOBAL : 0) | \
+                                    ((uo) ? IOMMU_UNTRANSLATED_ONLY : 0))
 
 struct IOMMUTLBEntry {
     AddressSpace    *target_as;

From 1f81edd7007f00be44966148daaf415158f49009 Mon Sep 17 00:00:00 2001
From: CLEMENT MATHIEU--DRIF <clement.mathieu--drif@eviden.com>
Date: Sat, 28 Jun 2025 18:04:00 +0000
Subject: [PATCH 2370/2760] memory: Allow to store the PASID in IOMMUTLBEntry

This will be useful for devices that support ATS
and need to store entries in an ATC (device IOTLB).

Signed-off-by: Clement Mathieu--Drif <clement.mathieu--drif@eviden.com>
Message-Id: <20250628180226.133285-4-clement.mathieu--drif@eviden.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 include/system/memory.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/include/system/memory.h b/include/system/memory.h
index 1672622d70..d6d069fd50 100644
--- a/include/system/memory.h
+++ b/include/system/memory.h
@@ -144,6 +144,7 @@ struct IOMMUTLBEntry {
     hwaddr           translated_addr;
     hwaddr           addr_mask;  /* 0xfff = 4k translation */
     IOMMUAccessFlags perm;
+    uint32_t         pasid;
 };
 
 /*

From f8eee3452ffb6257bbb3537b987e1e95c2bd5d95 Mon Sep 17 00:00:00 2001
From: CLEMENT MATHIEU--DRIF <clement.mathieu--drif@eviden.com>
Date: Sat, 28 Jun 2025 18:04:02 +0000
Subject: [PATCH 2371/2760] intel_iommu: Fill the PASID field when creating an
 IOMMUTLBEntry

PASID value must be used by devices as a key (or part of a key)
when populating their ATC with the IOTLB entries returned by the IOMMU.

Signed-off-by: Clement Mathieu--Drif <clement.mathieu--drif@eviden.com>
Message-Id: <20250628180226.133285-5-clement.mathieu--drif@eviden.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/intel_iommu.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/hw/i386/intel_iommu.c b/hw/i386/intel_iommu.c
index 69d72ad35c..0fb4350d48 100644
--- a/hw/i386/intel_iommu.c
+++ b/hw/i386/intel_iommu.c
@@ -2503,6 +2503,7 @@ static void vtd_iotlb_page_invalidate_notify(IntelIOMMUState *s,
                         .translated_addr = 0,
                         .addr_mask = size - 1,
                         .perm = IOMMU_NONE,
+                        .pasid = vtd_as->pasid,
                     },
                 };
                 memory_region_notify_iommu(&vtd_as->iommu, 0, event);
@@ -3090,6 +3091,7 @@ static void do_invalidate_device_tlb(VTDAddressSpace *vtd_dev_as,
     event.entry.iova = addr;
     event.entry.perm = IOMMU_NONE;
     event.entry.translated_addr = 0;
+    event.entry.pasid = vtd_dev_as->pasid;
     memory_region_notify_iommu(&vtd_dev_as->iommu, 0, event);
 }
 
@@ -3672,6 +3674,7 @@ static IOMMUTLBEntry vtd_iommu_translate(IOMMUMemoryRegion *iommu, hwaddr addr,
     IOMMUTLBEntry iotlb = {
         /* We'll fill in the rest later. */
         .target_as = &address_space_memory,
+        .pasid = vtd_as->pasid,
     };
     bool success;
 

From 9b3725eec592140ec3d6557ec0f4c86991af7bd9 Mon Sep 17 00:00:00 2001
From: CLEMENT MATHIEU--DRIF <clement.mathieu--drif@eviden.com>
Date: Sat, 28 Jun 2025 18:04:03 +0000
Subject: [PATCH 2372/2760] intel_iommu: Declare supported PASID size

the PSS field of the extended capabilities stores the supported PASID
size minus 1. This commit adds support for 8bits PASIDs (limited by
MemTxAttrs::pid).

Signed-off-by: Clement Mathieu--Drif <clement.mathieu--drif@eviden.com>
Message-Id: <20250628180226.133285-6-clement.mathieu--drif@eviden.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/intel_iommu.c          | 2 +-
 hw/i386/intel_iommu_internal.h | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/i386/intel_iommu.c b/hw/i386/intel_iommu.c
index 0fb4350d48..71497f1936 100644
--- a/hw/i386/intel_iommu.c
+++ b/hw/i386/intel_iommu.c
@@ -4590,7 +4590,7 @@ static void vtd_cap_init(IntelIOMMUState *s)
     }
 
     if (s->pasid) {
-        s->ecap |= VTD_ECAP_PASID;
+        s->ecap |= VTD_ECAP_PASID | VTD_ECAP_PSS;
     }
 }
 
diff --git a/hw/i386/intel_iommu_internal.h b/hw/i386/intel_iommu_internal.h
index e8b211e8b0..360e937989 100644
--- a/hw/i386/intel_iommu_internal.h
+++ b/hw/i386/intel_iommu_internal.h
@@ -192,6 +192,7 @@
 #define VTD_ECAP_SC                 (1ULL << 7)
 #define VTD_ECAP_MHMV               (15ULL << 20)
 #define VTD_ECAP_SRS                (1ULL << 31)
+#define VTD_ECAP_PSS                (7ULL << 35) /* limit: MemTxAttrs::pid */
 #define VTD_ECAP_PASID              (1ULL << 40)
 #define VTD_ECAP_SMTS               (1ULL << 43)
 #define VTD_ECAP_SLTS               (1ULL << 46)

From d6f6467b7cad6615bba78a40f1a1ed703a667f44 Mon Sep 17 00:00:00 2001
From: CLEMENT MATHIEU--DRIF <clement.mathieu--drif@eviden.com>
Date: Sat, 28 Jun 2025 18:04:05 +0000
Subject: [PATCH 2373/2760] intel_iommu: Implement vtd_get_iotlb_info from
 PCIIOMMUOps

Signed-off-by: Clement Mathieu--Drif <clement.mathieu--drif@eviden.com>
Message-Id: <20250628180226.133285-7-clement.mathieu--drif@eviden.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/intel_iommu.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/hw/i386/intel_iommu.c b/hw/i386/intel_iommu.c
index 71497f1936..affa7768e6 100644
--- a/hw/i386/intel_iommu.c
+++ b/hw/i386/intel_iommu.c
@@ -4733,10 +4733,20 @@ static AddressSpace *vtd_host_dma_iommu(PCIBus *bus, void *opaque, int devfn)
     return &vtd_as->as;
 }
 
+static void vtd_get_iotlb_info(void *opaque, uint8_t *addr_width,
+                               uint32_t *min_page_size)
+{
+    IntelIOMMUState *s = opaque;
+
+    *addr_width = s->aw_bits;
+    *min_page_size = VTD_PAGE_SIZE;
+}
+
 static PCIIOMMUOps vtd_iommu_ops = {
     .get_address_space = vtd_host_dma_iommu,
     .set_iommu_device = vtd_dev_set_iommu_device,
     .unset_iommu_device = vtd_dev_unset_iommu_device,
+    .get_iotlb_info = vtd_get_iotlb_info,
 };
 
 static bool vtd_decide_config(IntelIOMMUState *s, Error **errp)

From 838efe99fde22f7ee120cddae3cce732653db869 Mon Sep 17 00:00:00 2001
From: CLEMENT MATHIEU--DRIF <clement.mathieu--drif@eviden.com>
Date: Sat, 28 Jun 2025 18:04:07 +0000
Subject: [PATCH 2374/2760] intel_iommu: Implement the PCIIOMMUOps callbacks
 related to invalidations of device-IOTLB

Signed-off-by: Clement Mathieu--Drif <clement.mathieu--drif@eviden.com>
Message-Id: <20250628180226.133285-8-clement.mathieu--drif@eviden.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/intel_iommu.c | 35 +++++++++++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)

diff --git a/hw/i386/intel_iommu.c b/hw/i386/intel_iommu.c
index affa7768e6..234c452849 100644
--- a/hw/i386/intel_iommu.c
+++ b/hw/i386/intel_iommu.c
@@ -4733,6 +4733,15 @@ static AddressSpace *vtd_host_dma_iommu(PCIBus *bus, void *opaque, int devfn)
     return &vtd_as->as;
 }
 
+static void vtd_init_iotlb_notifier(PCIBus *bus, void *opaque, int devfn,
+                                    IOMMUNotifier *n, IOMMUNotify fn,
+                                    void *user_opaque)
+{
+    n->opaque = user_opaque;
+    iommu_notifier_init(n, fn, IOMMU_NOTIFIER_DEVIOTLB_EVENTS, 0,
+                        HWADDR_MAX, 0);
+}
+
 static void vtd_get_iotlb_info(void *opaque, uint8_t *addr_width,
                                uint32_t *min_page_size)
 {
@@ -4742,11 +4751,37 @@ static void vtd_get_iotlb_info(void *opaque, uint8_t *addr_width,
     *min_page_size = VTD_PAGE_SIZE;
 }
 
+static void vtd_register_iotlb_notifier(PCIBus *bus, void *opaque,
+                                        int devfn, uint32_t pasid,
+                                        IOMMUNotifier *n)
+{
+    IntelIOMMUState *s = opaque;
+    VTDAddressSpace *vtd_as;
+
+    vtd_as = vtd_find_add_as(s, bus, devfn, pasid);
+    memory_region_register_iommu_notifier(MEMORY_REGION(&vtd_as->iommu), n,
+                                          &error_fatal);
+}
+
+static void vtd_unregister_iotlb_notifier(PCIBus *bus, void *opaque,
+                                          int devfn, uint32_t pasid,
+                                          IOMMUNotifier *n)
+{
+    IntelIOMMUState *s = opaque;
+    VTDAddressSpace *vtd_as;
+
+    vtd_as = vtd_find_add_as(s, bus, devfn, pasid);
+    memory_region_unregister_iommu_notifier(MEMORY_REGION(&vtd_as->iommu), n);
+}
+
 static PCIIOMMUOps vtd_iommu_ops = {
     .get_address_space = vtd_host_dma_iommu,
     .set_iommu_device = vtd_dev_set_iommu_device,
     .unset_iommu_device = vtd_dev_unset_iommu_device,
     .get_iotlb_info = vtd_get_iotlb_info,
+    .init_iotlb_notifier = vtd_init_iotlb_notifier,
+    .register_iotlb_notifier = vtd_register_iotlb_notifier,
+    .unregister_iotlb_notifier = vtd_unregister_iotlb_notifier,
 };
 
 static bool vtd_decide_config(IntelIOMMUState *s, Error **errp)

From 35b47759c720cc6a3b5ce51c76f981b45df64a7d Mon Sep 17 00:00:00 2001
From: CLEMENT MATHIEU--DRIF <clement.mathieu--drif@eviden.com>
Date: Sat, 28 Jun 2025 18:04:08 +0000
Subject: [PATCH 2375/2760] intel_iommu: Return page walk level even when the
 translation fails

We will use this information in vtd_do_iommu_translate to populate the
IOMMUTLBEntry and indicate the correct page mask. This prevents ATS
devices from sending many useless translation requests when a megapage
or gigapage is not present.

Signed-off-by: Clement Mathieu--Drif <clement.mathieu--drif@eviden.com>
Message-Id: <20250628180226.133285-9-clement.mathieu--drif@eviden.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/intel_iommu.c | 17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/hw/i386/intel_iommu.c b/hw/i386/intel_iommu.c
index 234c452849..bff307b9bc 100644
--- a/hw/i386/intel_iommu.c
+++ b/hw/i386/intel_iommu.c
@@ -1987,9 +1987,9 @@ static int vtd_iova_to_flpte(IntelIOMMUState *s, VTDContextEntry *ce,
                              uint32_t pasid)
 {
     dma_addr_t addr = vtd_get_iova_pgtbl_base(s, ce, pasid);
-    uint32_t level = vtd_get_iova_level(s, ce, pasid);
     uint32_t offset;
     uint64_t flpte, flag_ad = VTD_FL_A;
+    *flpte_level = vtd_get_iova_level(s, ce, pasid);
 
     if (!vtd_iova_fl_check_canonical(s, iova, ce, pasid)) {
         error_report_once("%s: detected non canonical IOVA (iova=0x%" PRIx64 ","
@@ -1998,11 +1998,11 @@ static int vtd_iova_to_flpte(IntelIOMMUState *s, VTDContextEntry *ce,
     }
 
     while (true) {
-        offset = vtd_iova_level_offset(iova, level);
+        offset = vtd_iova_level_offset(iova, *flpte_level);
         flpte = vtd_get_pte(addr, offset);
 
         if (flpte == (uint64_t)-1) {
-            if (level == vtd_get_iova_level(s, ce, pasid)) {
+            if (*flpte_level == vtd_get_iova_level(s, ce, pasid)) {
                 /* Invalid programming of pasid-entry */
                 return -VTD_FR_PASID_ENTRY_FSPTPTR_INV;
             } else {
@@ -2028,15 +2028,15 @@ static int vtd_iova_to_flpte(IntelIOMMUState *s, VTDContextEntry *ce,
         if (is_write && !(flpte & VTD_FL_RW)) {
             return -VTD_FR_SM_WRITE;
         }
-        if (vtd_flpte_nonzero_rsvd(flpte, level)) {
+        if (vtd_flpte_nonzero_rsvd(flpte, *flpte_level)) {
             error_report_once("%s: detected flpte reserved non-zero "
                               "iova=0x%" PRIx64 ", level=0x%" PRIx32
                               "flpte=0x%" PRIx64 ", pasid=0x%" PRIX32 ")",
-                              __func__, iova, level, flpte, pasid);
+                              __func__, iova, *flpte_level, flpte, pasid);
             return -VTD_FR_FS_PAGING_ENTRY_RSVD;
         }
 
-        if (vtd_is_last_pte(flpte, level) && is_write) {
+        if (vtd_is_last_pte(flpte, *flpte_level) && is_write) {
             flag_ad |= VTD_FL_D;
         }
 
@@ -2044,14 +2044,13 @@ static int vtd_iova_to_flpte(IntelIOMMUState *s, VTDContextEntry *ce,
             return -VTD_FR_FS_BIT_UPDATE_FAILED;
         }
 
-        if (vtd_is_last_pte(flpte, level)) {
+        if (vtd_is_last_pte(flpte, *flpte_level)) {
             *flptep = flpte;
-            *flpte_level = level;
             return 0;
         }
 
         addr = vtd_get_pte_addr(flpte, aw_bits);
-        level--;
+        (*flpte_level)--;
     }
 }
 

From 580b926344a88997264b0a72576bba35f76c59e1 Mon Sep 17 00:00:00 2001
From: CLEMENT MATHIEU--DRIF <clement.mathieu--drif@eviden.com>
Date: Sat, 28 Jun 2025 18:04:09 +0000
Subject: [PATCH 2376/2760] intel_iommu: Set address mask when a translation
 fails and adjust W permission

Implements the behavior defined in section 10.2.3.5 of PCIe spec rev 5.
This is needed by devices that support ATS.

Signed-off-by: Clement Mathieu--Drif <clement.mathieu--drif@eviden.com>
Message-Id: <20250628180226.133285-10-clement.mathieu--drif@eviden.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/intel_iommu.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/hw/i386/intel_iommu.c b/hw/i386/intel_iommu.c
index bff307b9bc..1b1b0b5632 100644
--- a/hw/i386/intel_iommu.c
+++ b/hw/i386/intel_iommu.c
@@ -2091,7 +2091,8 @@ static bool vtd_do_iommu_translate(VTDAddressSpace *vtd_as, PCIBus *bus,
     uint8_t bus_num = pci_bus_num(bus);
     VTDContextCacheEntry *cc_entry;
     uint64_t pte, page_mask;
-    uint32_t level, pasid = vtd_as->pasid;
+    uint32_t level = UINT32_MAX;
+    uint32_t pasid = vtd_as->pasid;
     uint16_t source_id = PCI_BUILD_BDF(bus_num, devfn);
     int ret_fr;
     bool is_fpd_set = false;
@@ -2250,14 +2251,19 @@ out:
     entry->iova = addr & page_mask;
     entry->translated_addr = vtd_get_pte_addr(pte, s->aw_bits) & page_mask;
     entry->addr_mask = ~page_mask;
-    entry->perm = access_flags;
+    entry->perm = (is_write ? access_flags : (access_flags & (~IOMMU_WO)));
     return true;
 
 error:
     vtd_iommu_unlock(s);
     entry->iova = 0;
     entry->translated_addr = 0;
-    entry->addr_mask = 0;
+    /*
+     * Set the mask for ATS (the range must be present even when the
+     * translation fails : PCIe rev 5 10.2.3.5)
+     */
+    entry->addr_mask = (level != UINT32_MAX) ?
+                       (~vtd_pt_level_page_mask(level)) : (~VTD_PAGE_MASK_4K);
     entry->perm = IOMMU_NONE;
     return false;
 }

From c049bf5bb9dd2cd12d6089cb102aeee268d06423 Mon Sep 17 00:00:00 2001
From: CLEMENT MATHIEU--DRIF <clement.mathieu--drif@eviden.com>
Date: Sat, 28 Jun 2025 18:04:10 +0000
Subject: [PATCH 2377/2760] intel_iommu: Add support for ATS

Signed-off-by: Clement Mathieu--Drif <clement.mathieu--drif@eviden.com>
Message-Id: <20250628180226.133285-11-clement.mathieu--drif@eviden.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/intel_iommu.c | 63 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 63 insertions(+)

diff --git a/hw/i386/intel_iommu.c b/hw/i386/intel_iommu.c
index 1b1b0b5632..fe9a5f2872 100644
--- a/hw/i386/intel_iommu.c
+++ b/hw/i386/intel_iommu.c
@@ -4738,6 +4738,68 @@ static AddressSpace *vtd_host_dma_iommu(PCIBus *bus, void *opaque, int devfn)
     return &vtd_as->as;
 }
 
+static IOMMUTLBEntry vtd_iommu_ats_do_translate(IOMMUMemoryRegion *iommu,
+                                                hwaddr addr,
+                                                IOMMUAccessFlags flags)
+{
+    IOMMUTLBEntry entry;
+    VTDAddressSpace *vtd_as = container_of(iommu, VTDAddressSpace, iommu);
+
+    if (vtd_is_interrupt_addr(addr)) {
+        vtd_report_ir_illegal_access(vtd_as, addr, flags & IOMMU_WO);
+        entry.target_as = &address_space_memory;
+        entry.iova = 0;
+        entry.translated_addr = 0;
+        entry.addr_mask = ~VTD_PAGE_MASK_4K;
+        entry.perm = IOMMU_NONE;
+        entry.pasid = PCI_NO_PASID;
+    } else {
+        entry = vtd_iommu_translate(iommu, addr, flags, 0);
+    }
+
+    return entry;
+}
+
+static ssize_t vtd_ats_request_translation(PCIBus *bus, void *opaque,
+                                           int devfn, uint32_t pasid,
+                                           bool priv_req, bool exec_req,
+                                           hwaddr addr, size_t length,
+                                           bool no_write, IOMMUTLBEntry *result,
+                                           size_t result_length,
+                                           uint32_t *err_count)
+{
+    IntelIOMMUState *s = opaque;
+    VTDAddressSpace *vtd_as;
+    IOMMUAccessFlags flags = IOMMU_ACCESS_FLAG_FULL(true, !no_write, exec_req,
+                                                    priv_req, false, false);
+    ssize_t res_index = 0;
+    hwaddr target_address = addr + length;
+    IOMMUTLBEntry entry;
+
+    vtd_as = vtd_find_add_as(s, bus, devfn, pasid);
+    *err_count = 0;
+
+    while ((addr < target_address) && (res_index < result_length)) {
+        entry = vtd_iommu_ats_do_translate(&vtd_as->iommu, addr, flags);
+        entry.perm &= ~IOMMU_GLOBAL; /* Spec 4.1.2: Global Mapping never set */
+
+        if ((entry.perm & flags) != flags) {
+            *err_count += 1; /* Less than expected */
+        }
+
+        result[res_index] = entry;
+        res_index += 1;
+        addr = (addr & (~entry.addr_mask)) + (entry.addr_mask + 1);
+    }
+
+    /* Buffer too small */
+    if (addr < target_address) {
+        return -ENOMEM;
+    }
+
+    return res_index;
+}
+
 static void vtd_init_iotlb_notifier(PCIBus *bus, void *opaque, int devfn,
                                     IOMMUNotifier *n, IOMMUNotify fn,
                                     void *user_opaque)
@@ -4787,6 +4849,7 @@ static PCIIOMMUOps vtd_iommu_ops = {
     .init_iotlb_notifier = vtd_init_iotlb_notifier,
     .register_iotlb_notifier = vtd_register_iotlb_notifier,
     .unregister_iotlb_notifier = vtd_unregister_iotlb_notifier,
+    .ats_request_translation = vtd_ats_request_translation,
 };
 
 static bool vtd_decide_config(IntelIOMMUState *s, Error **errp)

From fafcff5f306ee91b20b7838ad1817ff6738642ce Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 8 Jul 2025 23:53:12 +0200
Subject: [PATCH 2378/2760] target/qmp: Use target_cpu_type()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20250708215320.70426-2-philmd@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 target/arm/arm-qmp-cmds.c             | 3 ++-
 target/loongarch/loongarch-qmp-cmds.c | 3 ++-
 target/mips/system/mips-qmp-cmds.c    | 3 ++-
 3 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/target/arm/arm-qmp-cmds.c b/target/arm/arm-qmp-cmds.c
index cefd235263..d292c974c4 100644
--- a/target/arm/arm-qmp-cmds.c
+++ b/target/arm/arm-qmp-cmds.c
@@ -21,6 +21,7 @@
  */
 
 #include "qemu/osdep.h"
+#include "qemu/target-info.h"
 #include "hw/boards.h"
 #include "kvm_arm.h"
 #include "qapi/error.h"
@@ -241,7 +242,7 @@ CpuDefinitionInfoList *qmp_query_cpu_definitions(Error **errp)
     CpuDefinitionInfoList *cpu_list = NULL;
     GSList *list;
 
-    list = object_class_get_list(TYPE_ARM_CPU, false);
+    list = object_class_get_list(target_cpu_type(), false);
     g_slist_foreach(list, arm_cpu_add_definition, &cpu_list);
     g_slist_free(list);
 
diff --git a/target/loongarch/loongarch-qmp-cmds.c b/target/loongarch/loongarch-qmp-cmds.c
index f5f1cd0009..1d8cd32f5f 100644
--- a/target/loongarch/loongarch-qmp-cmds.c
+++ b/target/loongarch/loongarch-qmp-cmds.c
@@ -7,6 +7,7 @@
  */
 
 #include "qemu/osdep.h"
+#include "qemu/target-info.h"
 #include "qapi/error.h"
 #include "qapi/qapi-commands-machine.h"
 #include "cpu.h"
@@ -32,7 +33,7 @@ CpuDefinitionInfoList *qmp_query_cpu_definitions(Error **errp)
     CpuDefinitionInfoList *cpu_list = NULL;
     GSList *list;
 
-    list = object_class_get_list(TYPE_LOONGARCH_CPU, false);
+    list = object_class_get_list(target_cpu_type(), false);
     g_slist_foreach(list, loongarch_cpu_add_definition, &cpu_list);
     g_slist_free(list);
 
diff --git a/target/mips/system/mips-qmp-cmds.c b/target/mips/system/mips-qmp-cmds.c
index d98d6623f2..b6a2874f2d 100644
--- a/target/mips/system/mips-qmp-cmds.c
+++ b/target/mips/system/mips-qmp-cmds.c
@@ -7,6 +7,7 @@
  */
 
 #include "qemu/osdep.h"
+#include "qemu/target-info.h"
 #include "qapi/error.h"
 #include "qapi/qapi-commands-machine.h"
 #include "cpu.h"
@@ -40,7 +41,7 @@ CpuDefinitionInfoList *qmp_query_cpu_definitions(Error **errp)
     CpuDefinitionInfoList *cpu_list = NULL;
     GSList *list;
 
-    list = object_class_get_list(TYPE_MIPS_CPU, false);
+    list = object_class_get_list(target_cpu_type(), false);
     g_slist_foreach(list, mips_cpu_add_definition, &cpu_list);
     g_slist_free(list);
 

From 0af00042a9290626e3c9f05cdc35b6e3d62ecd49 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 8 Jul 2025 23:53:13 +0200
Subject: [PATCH 2379/2760] qemu/target-info: Factor target_arch() out
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

To keep "qemu/target-info.h" self-contained to native
types, declare target_arch() -- which returns a QAPI
type -- in "qemu/target-info-qapi.h".

No logical change.

Keeping native types in "qemu/target-info.h" is necessary
to keep building tests such tests/tcg/plugins/mem.c, as
per the comment added in commit ecbcc9ead2f ("tests/tcg:
add a system test to check memory instrumentation"):

/*
 * plugins should not include anything from QEMU aside from the
 * API header. However as this is a test plugin to exercise the
 * internals of QEMU and we want to avoid needless code duplication we
 * do so here. bswap.h is pretty self-contained although it needs a
 * few things provided by compiler.h.
 */

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20250708215320.70426-3-philmd@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/core/machine-qmp-cmds.c      |  8 +++-----
 include/qemu/target-info-qapi.h | 21 +++++++++++++++++++++
 include/qemu/target-info.h      |  2 +-
 target-info.c                   |  8 ++++++++
 4 files changed, 33 insertions(+), 6 deletions(-)
 create mode 100644 include/qemu/target-info-qapi.h

diff --git a/hw/core/machine-qmp-cmds.c b/hw/core/machine-qmp-cmds.c
index d82043e1c6..cd98daedd1 100644
--- a/hw/core/machine-qmp-cmds.c
+++ b/hw/core/machine-qmp-cmds.c
@@ -19,7 +19,7 @@
 #include "qapi/qobject-input-visitor.h"
 #include "qapi/type-helpers.h"
 #include "qemu/uuid.h"
-#include "qemu/target-info.h"
+#include "qemu/target-info-qapi.h"
 #include "qom/qom-qobject.h"
 #include "system/hostmem.h"
 #include "system/hw_accel.h"
@@ -37,8 +37,7 @@ CpuInfoFastList *qmp_query_cpus_fast(Error **errp)
     MachineState *ms = MACHINE(qdev_get_machine());
     MachineClass *mc = MACHINE_GET_CLASS(ms);
     CpuInfoFastList *head = NULL, **tail = &head;
-    SysEmuTarget target = qapi_enum_parse(&SysEmuTarget_lookup, target_name(),
-                                          -1, &error_abort);
+    SysEmuTarget target = target_arch();
     CPUState *cpu;
 
     CPU_FOREACH(cpu) {
@@ -139,8 +138,7 @@ QemuTargetInfo *qmp_query_target(Error **errp)
 {
     QemuTargetInfo *info = g_malloc0(sizeof(*info));
 
-    info->arch = qapi_enum_parse(&SysEmuTarget_lookup, target_name(), -1,
-                                 &error_abort);
+    info->arch = target_arch();
 
     return info;
 }
diff --git a/include/qemu/target-info-qapi.h b/include/qemu/target-info-qapi.h
new file mode 100644
index 0000000000..a337c867bf
--- /dev/null
+++ b/include/qemu/target-info-qapi.h
@@ -0,0 +1,21 @@
+/*
+ * QEMU target info API (returning QAPI types)
+ *
+ *  Copyright (c) Linaro
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef QEMU_TARGET_INFO_EXTRA_H
+#define QEMU_TARGET_INFO_EXTRA_H
+
+#include "qapi/qapi-types-machine.h"
+
+/**
+ * target_arch:
+ *
+ * Returns: QAPI SysEmuTarget enum (e.g. SYS_EMU_TARGET_X86_64).
+ */
+SysEmuTarget target_arch(void);
+
+#endif
diff --git a/include/qemu/target-info.h b/include/qemu/target-info.h
index 850a2958b9..dde0e7d968 100644
--- a/include/qemu/target-info.h
+++ b/include/qemu/target-info.h
@@ -1,5 +1,5 @@
 /*
- * QEMU target info API
+ * QEMU target info API (returning native types)
  *
  *  Copyright (c) Linaro
  *
diff --git a/target-info.c b/target-info.c
index 16fdca7aaa..9ebabec988 100644
--- a/target-info.c
+++ b/target-info.c
@@ -8,7 +8,9 @@
 
 #include "qemu/osdep.h"
 #include "qemu/target-info.h"
+#include "qemu/target-info-qapi.h"
 #include "qemu/target-info-impl.h"
+#include "qapi/error.h"
 
 const char *target_name(void)
 {
@@ -20,6 +22,12 @@ unsigned target_long_bits(void)
     return target_info()->long_bits;
 }
 
+SysEmuTarget target_arch(void)
+{
+    return qapi_enum_parse(&SysEmuTarget_lookup, target_name(), -1,
+                           &error_abort);
+}
+
 const char *target_cpu_type(void)
 {
     return target_info()->cpu_type;

From 536613be40c7005a956a52487c1fed4530d6613f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 8 Jul 2025 23:53:14 +0200
Subject: [PATCH 2380/2760] qemu/target-info: Add %target_arch field to
 TargetInfo
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20250708215320.70426-4-philmd@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 include/qemu/target-info-impl.h | 4 +++-
 target-info-stub.c              | 1 +
 target-info.c                   | 9 +++++++--
 3 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/include/qemu/target-info-impl.h b/include/qemu/target-info-impl.h
index 1b51cbcfe1..a8b34d150a 100644
--- a/include/qemu/target-info-impl.h
+++ b/include/qemu/target-info-impl.h
@@ -9,11 +9,13 @@
 #ifndef QEMU_TARGET_INFO_IMPL_H
 #define QEMU_TARGET_INFO_IMPL_H
 
-#include "qemu/target-info.h"
+#include "qapi/qapi-types-machine.h"
 
 typedef struct TargetInfo {
     /* runtime equivalent of TARGET_NAME definition */
     const char *target_name;
+    /* related to TARGET_ARCH definition */
+    SysEmuTarget target_arch;
     /* runtime equivalent of TARGET_LONG_BITS definition */
     unsigned long_bits;
     /* runtime equivalent of CPU_RESOLVING_TYPE definition */
diff --git a/target-info-stub.c b/target-info-stub.c
index fecc0e7128..2e4407ff04 100644
--- a/target-info-stub.c
+++ b/target-info-stub.c
@@ -14,6 +14,7 @@
 
 static const TargetInfo target_info_stub = {
     .target_name = TARGET_NAME,
+    .target_arch = SYS_EMU_TARGET__MAX,
     .long_bits = TARGET_LONG_BITS,
     .cpu_type = CPU_RESOLVING_TYPE,
     .machine_typename = TYPE_MACHINE,
diff --git a/target-info.c b/target-info.c
index 9ebabec988..8e29553b4e 100644
--- a/target-info.c
+++ b/target-info.c
@@ -24,8 +24,13 @@ unsigned target_long_bits(void)
 
 SysEmuTarget target_arch(void)
 {
-    return qapi_enum_parse(&SysEmuTarget_lookup, target_name(), -1,
-                           &error_abort);
+    SysEmuTarget arch = target_info()->target_arch;
+
+    if (arch == SYS_EMU_TARGET__MAX) {
+        arch = qapi_enum_parse(&SysEmuTarget_lookup, target_name(), -1,
+                               &error_abort);
+    }
+    return arch;
 }
 
 const char *target_cpu_type(void)

From a37aec2e7d8f7191d29c700629850da5057e446b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 8 Jul 2025 23:53:15 +0200
Subject: [PATCH 2381/2760] qemu/target-info: Add target_endian_mode()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

target_endian_mode() returns the default endianness (QAPI type)
of a target.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250708215320.70426-5-philmd@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 include/qemu/target-info-impl.h | 2 ++
 include/qemu/target-info-qapi.h | 8 ++++++++
 target-info-stub.c              | 1 +
 target-info.c                   | 5 +++++
 4 files changed, 16 insertions(+)

diff --git a/include/qemu/target-info-impl.h b/include/qemu/target-info-impl.h
index a8b34d150a..17887f64e2 100644
--- a/include/qemu/target-info-impl.h
+++ b/include/qemu/target-info-impl.h
@@ -22,6 +22,8 @@ typedef struct TargetInfo {
     const char *cpu_type;
     /* QOM typename machines for this binary must implement */
     const char *machine_typename;
+    /* related to TARGET_BIG_ENDIAN definition */
+    EndianMode endianness;
 } TargetInfo;
 
 /**
diff --git a/include/qemu/target-info-qapi.h b/include/qemu/target-info-qapi.h
index a337c867bf..d5ce052323 100644
--- a/include/qemu/target-info-qapi.h
+++ b/include/qemu/target-info-qapi.h
@@ -9,6 +9,7 @@
 #ifndef QEMU_TARGET_INFO_EXTRA_H
 #define QEMU_TARGET_INFO_EXTRA_H
 
+#include "qapi/qapi-types-common.h"
 #include "qapi/qapi-types-machine.h"
 
 /**
@@ -18,4 +19,11 @@
  */
 SysEmuTarget target_arch(void);
 
+/**
+ * target_endian_mode:
+ *
+ * Returns: QAPI EndianMode enum (e.g. ENDIAN_MODE_LITTLE).
+ */
+EndianMode target_endian_mode(void);
+
 #endif
diff --git a/target-info-stub.c b/target-info-stub.c
index 2e4407ff04..ca0caa3686 100644
--- a/target-info-stub.c
+++ b/target-info-stub.c
@@ -18,6 +18,7 @@ static const TargetInfo target_info_stub = {
     .long_bits = TARGET_LONG_BITS,
     .cpu_type = CPU_RESOLVING_TYPE,
     .machine_typename = TYPE_MACHINE,
+    .endianness = TARGET_BIG_ENDIAN ? ENDIAN_MODE_BIG : ENDIAN_MODE_LITTLE,
 };
 
 const TargetInfo *target_info(void)
diff --git a/target-info.c b/target-info.c
index 8e29553b4e..a756c0714c 100644
--- a/target-info.c
+++ b/target-info.c
@@ -42,3 +42,8 @@ const char *target_machine_typename(void)
 {
     return target_info()->machine_typename;
 }
+
+EndianMode target_endian_mode(void)
+{
+    return target_info()->endianness;
+}

From 749c21cf6d8ff8eff094137c4ca1298c8f714066 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 8 Jul 2025 23:53:16 +0200
Subject: [PATCH 2382/2760] qemu: Convert target_words_bigendian() to
 TargetInfo API
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250708215320.70426-6-philmd@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 cpu-target.c               |  7 -------
 hw/core/cpu-system.c       |  2 +-
 hw/display/vga.c           |  2 +-
 hw/virtio/virtio.c         |  2 +-
 include/exec/tswap.h       | 13 +------------
 include/qemu/target-info.h | 12 ++++++++++++
 system/memory.c            |  1 +
 system/qtest.c             |  1 +
 target-info.c              |  5 +++++
 9 files changed, 23 insertions(+), 22 deletions(-)

diff --git a/cpu-target.c b/cpu-target.c
index 1c90a30759..20db5ff310 100644
--- a/cpu-target.c
+++ b/cpu-target.c
@@ -22,7 +22,6 @@
 #include "system/accel-ops.h"
 #include "system/cpus.h"
 #include "exec/cpu-common.h"
-#include "exec/tswap.h"
 #include "exec/replay-core.h"
 #include "exec/log.h"
 #include "hw/core/cpu.h"
@@ -85,9 +84,3 @@ void cpu_abort(CPUState *cpu, const char *fmt, ...)
 #endif
     abort();
 }
-
-#undef target_big_endian
-bool target_big_endian(void)
-{
-    return TARGET_BIG_ENDIAN;
-}
diff --git a/hw/core/cpu-system.c b/hw/core/cpu-system.c
index 3c84176a0c..a975405d3a 100644
--- a/hw/core/cpu-system.c
+++ b/hw/core/cpu-system.c
@@ -24,7 +24,7 @@
 #include "exec/cputlb.h"
 #include "system/memory.h"
 #include "exec/tb-flush.h"
-#include "exec/tswap.h"
+#include "qemu/target-info.h"
 #include "hw/qdev-core.h"
 #include "hw/qdev-properties.h"
 #include "hw/core/sysemu-cpu-ops.h"
diff --git a/hw/display/vga.c b/hw/display/vga.c
index 20475ebbd3..90b89cf404 100644
--- a/hw/display/vga.c
+++ b/hw/display/vga.c
@@ -26,7 +26,7 @@
 #include "qemu/units.h"
 #include "system/reset.h"
 #include "qapi/error.h"
-#include "exec/tswap.h"
+#include "qemu/target-info.h"
 #include "hw/display/vga.h"
 #include "hw/i386/x86.h"
 #include "hw/pci/pci.h"
diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
index 82a285a31d..0f4d28033d 100644
--- a/hw/virtio/virtio.c
+++ b/hw/virtio/virtio.c
@@ -20,7 +20,7 @@
 #include "qemu/log.h"
 #include "qemu/main-loop.h"
 #include "qemu/module.h"
-#include "exec/tswap.h"
+#include "qemu/target-info.h"
 #include "qom/object_interfaces.h"
 #include "hw/core/cpu.h"
 #include "hw/virtio/virtio.h"
diff --git a/include/exec/tswap.h b/include/exec/tswap.h
index 49511f2611..55ffa63359 100644
--- a/include/exec/tswap.h
+++ b/include/exec/tswap.h
@@ -9,18 +9,7 @@
 #define TSWAP_H
 
 #include "qemu/bswap.h"
-
-/**
- * target_big_endian:
- * Returns true if the (default) endianness of the target is big endian,
- * false otherwise. Common code should normally never need to know about the
- * endianness of the target, so please do *not* use this function unless you
- * know very well what you are doing!
- */
-bool target_big_endian(void);
-#ifdef COMPILING_PER_TARGET
-#define target_big_endian()   TARGET_BIG_ENDIAN
-#endif
+#include "qemu/target-info.h"
 
 /*
  * If we're in target-specific code, we can hard-code the swapping
diff --git a/include/qemu/target-info.h b/include/qemu/target-info.h
index dde0e7d968..abcf25db6f 100644
--- a/include/qemu/target-info.h
+++ b/include/qemu/target-info.h
@@ -38,4 +38,16 @@ const char *target_machine_typename(void);
  */
 const char *target_cpu_type(void);
 
+/**
+ * target_big_endian:
+ *
+ * Returns: %true if the (default) endianness of the target is big endian,
+ *          %false otherwise.
+ *
+ * Common code should normally never need to know about the endianness of
+ * the target, so please do *not* use this function unless you  know very
+ * well what you are doing!
+ */
+bool target_big_endian(void);
+
 #endif
diff --git a/system/memory.c b/system/memory.c
index e8d9b15b28..38da62f505 100644
--- a/system/memory.c
+++ b/system/memory.c
@@ -22,6 +22,7 @@
 #include "qemu/error-report.h"
 #include "qemu/main-loop.h"
 #include "qemu/qemu-print.h"
+#include "qemu/target-info.h"
 #include "qom/object.h"
 #include "trace.h"
 #include "system/ram_addr.h"
diff --git a/system/qtest.c b/system/qtest.c
index 301b03be2d..fa42c9f921 100644
--- a/system/qtest.c
+++ b/system/qtest.c
@@ -29,6 +29,7 @@
 #include "qemu/error-report.h"
 #include "qemu/module.h"
 #include "qemu/cutils.h"
+#include "qemu/target-info.h"
 #include "qom/object_interfaces.h"
 
 #define MAX_IRQ 256
diff --git a/target-info.c b/target-info.c
index a756c0714c..3110ab32f7 100644
--- a/target-info.c
+++ b/target-info.c
@@ -47,3 +47,8 @@ EndianMode target_endian_mode(void)
 {
     return target_info()->endianness;
 }
+
+bool target_big_endian(void)
+{
+    return target_endian_mode() == ENDIAN_MODE_BIG;
+}

From 16c9cb7187ef2414e3ad509048d59a8a4e7d1cd1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 8 Jul 2025 23:53:17 +0200
Subject: [PATCH 2383/2760] gdbstub/helpers: Replace TARGET_BIG_ENDIAN ->
 target_big_endian()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Check endianness at runtime to remove the target-specific
TARGET_BIG_ENDIAN definition. Use cpu_to_[be,le]XX() from
"qemu/bswap.h" instead of tswapXX() from "exec/tswap.h".

Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20250708215320.70426-7-philmd@linaro.org>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 include/gdbstub/helpers.h | 48 +++++++++++++++++++++++----------------
 1 file changed, 29 insertions(+), 19 deletions(-)

diff --git a/include/gdbstub/helpers.h b/include/gdbstub/helpers.h
index 6f7cc48adc..b685afac43 100644
--- a/include/gdbstub/helpers.h
+++ b/include/gdbstub/helpers.h
@@ -16,7 +16,8 @@
 #error "gdbstub helpers should only be included by target specific code"
 #endif
 
-#include "exec/tswap.h"
+#include "qemu/bswap.h"
+#include "qemu/target-info.h"
 #include "cpu-param.h"
 
 /*
@@ -33,40 +34,49 @@ static inline int gdb_get_reg8(GByteArray *buf, uint8_t val)
 
 static inline int gdb_get_reg16(GByteArray *buf, uint16_t val)
 {
-    uint16_t to_word = tswap16(val);
-    g_byte_array_append(buf, (uint8_t *) &to_word, 2);
+    if (target_big_endian()) {
+        cpu_to_be16s(&val);
+    } else {
+        cpu_to_le16s(&val);
+    }
+    g_byte_array_append(buf, (uint8_t *) &val, 2);
     return 2;
 }
 
 static inline int gdb_get_reg32(GByteArray *buf, uint32_t val)
 {
-    uint32_t to_long = tswap32(val);
-    g_byte_array_append(buf, (uint8_t *) &to_long, 4);
+    if (target_big_endian()) {
+        cpu_to_be32s(&val);
+    } else {
+        cpu_to_le32s(&val);
+    }
+    g_byte_array_append(buf, (uint8_t *) &val, 4);
     return 4;
 }
 
 static inline int gdb_get_reg64(GByteArray *buf, uint64_t val)
 {
-    uint64_t to_quad = tswap64(val);
-    g_byte_array_append(buf, (uint8_t *) &to_quad, 8);
+    if (target_big_endian()) {
+        cpu_to_be64s(&val);
+    } else {
+        cpu_to_le64s(&val);
+    }
+    g_byte_array_append(buf, (uint8_t *) &val, 8);
     return 8;
 }
 
 static inline int gdb_get_reg128(GByteArray *buf, uint64_t val_hi,
                                  uint64_t val_lo)
 {
-    uint64_t to_quad;
-#if TARGET_BIG_ENDIAN
-    to_quad = tswap64(val_hi);
-    g_byte_array_append(buf, (uint8_t *) &to_quad, 8);
-    to_quad = tswap64(val_lo);
-    g_byte_array_append(buf, (uint8_t *) &to_quad, 8);
-#else
-    to_quad = tswap64(val_lo);
-    g_byte_array_append(buf, (uint8_t *) &to_quad, 8);
-    to_quad = tswap64(val_hi);
-    g_byte_array_append(buf, (uint8_t *) &to_quad, 8);
-#endif
+    uint64_t tmp[2];
+    if (target_big_endian()) {
+        tmp[0] = cpu_to_be64(val_hi);
+        tmp[1] = cpu_to_be64(val_lo);
+    } else {
+        tmp[0] = cpu_to_le64(val_lo);
+        tmp[1] = cpu_to_le64(val_hi);
+    }
+    g_byte_array_append(buf, (uint8_t *)&tmp, 16);
     return 16;
 }
 

From 0f64fb674360393ae09605d8d53bf81c02c78a3e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 8 Jul 2025 23:53:18 +0200
Subject: [PATCH 2384/2760] qemu: Declare all load/store helper in
 'qemu/bswap.h'
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Restrict "exec/tswap.h" to the tswap*() methods,
move the load/store helpers with the other ones
declared in "qemu/bswap.h".

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20250708215320.70426-8-philmd@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/acpi/bios-linker-loader.c         |  2 -
 hw/arm/allwinner-r40.c               |  1 -
 hw/arm/boot.c                        |  2 +
 hw/arm/npcm7xx.c                     |  2 +-
 hw/block/hd-geometry.c               |  1 -
 hw/char/riscv_htif.c                 |  1 -
 hw/cxl/cxl-events.c                  |  2 -
 hw/display/artist.c                  |  1 +
 hw/display/ati.c                     |  1 +
 hw/net/can/ctucan_core.c             |  1 -
 hw/net/lan9118.c                     |  1 +
 hw/net/rtl8139.c                     |  1 +
 hw/net/vmxnet3.c                     |  1 -
 hw/pci-host/gt64120.c                |  1 +
 hw/pci-host/pnv_phb3.c               |  1 +
 hw/pci-host/pnv_phb4.c               |  1 +
 hw/pci-host/ppce500.c                |  1 -
 hw/pci-host/sh_pci.c                 |  1 -
 hw/s390x/s390-pci-inst.c             |  1 +
 hw/sensor/lsm303dlhc_mag.c           |  1 -
 hw/smbios/smbios.c                   |  1 +
 hw/vfio/migration-multifd.c          |  1 -
 hw/virtio/virtio-pci.c               |  1 +
 hw/vmapple/virtio-blk.c              |  1 -
 include/exec/tswap.h                 | 70 --------------------------
 include/qemu/bswap.h                 | 73 ++++++++++++++++++++++++++++
 include/system/memory.h              |  1 -
 include/user/abitypes.h              |  1 -
 target/arm/cpu.c                     |  1 -
 target/i386/tcg/system/excp_helper.c |  1 -
 target/i386/xsave_helper.c           |  1 -
 target/ppc/mmu-hash64.h              |  2 -
 target/riscv/vector_helper.c         |  1 -
 tests/tcg/plugins/mem.c              |  1 +
 34 files changed, 87 insertions(+), 93 deletions(-)

diff --git a/hw/acpi/bios-linker-loader.c b/hw/acpi/bios-linker-loader.c
index 108061828b..c9ffe449aa 100644
--- a/hw/acpi/bios-linker-loader.c
+++ b/hw/acpi/bios-linker-loader.c
@@ -22,8 +22,6 @@
 #include "hw/acpi/bios-linker-loader.h"
 #include "hw/nvram/fw_cfg.h"
 
-#include "qemu/bswap.h"
-
 /*
  * Linker/loader is a paravirtualized interface that passes commands to guest.
  * The commands can be used to request guest to
diff --git a/hw/arm/allwinner-r40.c b/hw/arm/allwinner-r40.c
index 0bf700865c..c8eda39957 100644
--- a/hw/arm/allwinner-r40.c
+++ b/hw/arm/allwinner-r40.c
@@ -20,7 +20,6 @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "qemu/error-report.h"
-#include "qemu/bswap.h"
 #include "qemu/module.h"
 #include "qemu/units.h"
 #include "hw/boards.h"
diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index becd827af1..d391cd01bb 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -15,6 +15,7 @@
 #include "hw/arm/boot.h"
 #include "hw/arm/linux-boot-if.h"
 #include "cpu.h"
+#include "exec/tswap.h"
 #include "exec/target_page.h"
 #include "system/kvm.h"
 #include "system/tcg.h"
@@ -29,6 +30,7 @@
 #include "qemu/config-file.h"
 #include "qemu/option.h"
 #include "qemu/units.h"
+#include "qemu/bswap.h"
 
 /* Kernel boot protocol is specified in the kernel docs
  * Documentation/arm/Booting and Documentation/arm64/booting.txt
diff --git a/hw/arm/npcm7xx.c b/hw/arm/npcm7xx.c
index 2f30c49df5..ecfae328a9 100644
--- a/hw/arm/npcm7xx.c
+++ b/hw/arm/npcm7xx.c
@@ -24,7 +24,7 @@
 #include "hw/qdev-clock.h"
 #include "hw/qdev-properties.h"
 #include "qapi/error.h"
-#include "qemu/bswap.h"
+#include "exec/tswap.h"
 #include "qemu/units.h"
 #include "system/system.h"
 #include "target/arm/cpu-qom.h"
diff --git a/hw/block/hd-geometry.c b/hw/block/hd-geometry.c
index f3939e73f4..db221901cf 100644
--- a/hw/block/hd-geometry.c
+++ b/hw/block/hd-geometry.c
@@ -33,7 +33,6 @@
 #include "qemu/osdep.h"
 #include "system/block-backend.h"
 #include "qapi/qapi-types-block.h"
-#include "qemu/bswap.h"
 #include "hw/block/block.h"
 #include "trace.h"
 
diff --git a/hw/char/riscv_htif.c b/hw/char/riscv_htif.c
index c884be5d75..a78ea9b01c 100644
--- a/hw/char/riscv_htif.c
+++ b/hw/char/riscv_htif.c
@@ -29,7 +29,6 @@
 #include "qemu/timer.h"
 #include "qemu/error-report.h"
 #include "system/address-spaces.h"
-#include "exec/tswap.h"
 #include "system/dma.h"
 #include "system/runstate.h"
 #include "trace.h"
diff --git a/hw/cxl/cxl-events.c b/hw/cxl/cxl-events.c
index 12dee2e467..f90470930d 100644
--- a/hw/cxl/cxl-events.c
+++ b/hw/cxl/cxl-events.c
@@ -8,8 +8,6 @@
  */
 
 #include "qemu/osdep.h"
-
-#include "qemu/bswap.h"
 #include "qemu/error-report.h"
 #include "hw/pci/msi.h"
 #include "hw/pci/msix.h"
diff --git a/hw/display/artist.c b/hw/display/artist.c
index 3fafc8a222..3c884c9243 100644
--- a/hw/display/artist.c
+++ b/hw/display/artist.c
@@ -12,6 +12,7 @@
 #include "qemu/log.h"
 #include "qemu/module.h"
 #include "qemu/units.h"
+#include "qemu/bswap.h"
 #include "qapi/error.h"
 #include "hw/sysbus.h"
 #include "hw/loader.h"
diff --git a/hw/display/ati.c b/hw/display/ati.c
index 7de27732cd..f7c0006a87 100644
--- a/hw/display/ati.c
+++ b/hw/display/ati.c
@@ -22,6 +22,7 @@
 #include "vga-access.h"
 #include "hw/qdev-properties.h"
 #include "vga_regs.h"
+#include "qemu/bswap.h"
 #include "qemu/log.h"
 #include "qemu/module.h"
 #include "qemu/error-report.h"
diff --git a/hw/net/can/ctucan_core.c b/hw/net/can/ctucan_core.c
index 17131a4e18..6bd99c477b 100644
--- a/hw/net/can/ctucan_core.c
+++ b/hw/net/can/ctucan_core.c
@@ -28,7 +28,6 @@
 
 #include "qemu/osdep.h"
 #include "qemu/log.h"
-#include "qemu/bswap.h"
 #include "qemu/bitops.h"
 #include "hw/irq.h"
 #include "migration/vmstate.h"
diff --git a/hw/net/lan9118.c b/hw/net/lan9118.c
index 6dda1e5c94..3017e12971 100644
--- a/hw/net/lan9118.c
+++ b/hw/net/lan9118.c
@@ -21,6 +21,7 @@
 #include "hw/ptimer.h"
 #include "hw/qdev-properties.h"
 #include "qapi/error.h"
+#include "qemu/bswap.h"
 #include "qemu/log.h"
 #include "qemu/module.h"
 #include <zlib.h> /* for crc32 */
diff --git a/hw/net/rtl8139.c b/hw/net/rtl8139.c
index 654a087d80..324fb932aa 100644
--- a/hw/net/rtl8139.c
+++ b/hw/net/rtl8139.c
@@ -57,6 +57,7 @@
 #include "system/dma.h"
 #include "qemu/module.h"
 #include "qemu/timer.h"
+#include "qemu/bswap.h"
 #include "net/net.h"
 #include "net/eth.h"
 #include "system/system.h"
diff --git a/hw/net/vmxnet3.c b/hw/net/vmxnet3.c
index 7c0ca56b7c..af73aa8ef2 100644
--- a/hw/net/vmxnet3.c
+++ b/hw/net/vmxnet3.c
@@ -22,7 +22,6 @@
 #include "net/tap.h"
 #include "net/checksum.h"
 #include "system/system.h"
-#include "qemu/bswap.h"
 #include "qemu/log.h"
 #include "qemu/module.h"
 #include "hw/pci/msix.h"
diff --git a/hw/pci-host/gt64120.c b/hw/pci-host/gt64120.c
index b12a25696c..b1d96f62fe 100644
--- a/hw/pci-host/gt64120.c
+++ b/hw/pci-host/gt64120.c
@@ -28,6 +28,7 @@
 #include "qapi/error.h"
 #include "qemu/units.h"
 #include "qemu/log.h"
+#include "qemu/bswap.h"
 #include "hw/qdev-properties.h"
 #include "hw/registerfields.h"
 #include "hw/pci/pci_device.h"
diff --git a/hw/pci-host/pnv_phb3.c b/hw/pci-host/pnv_phb3.c
index a4335f44f2..5d8383fac3 100644
--- a/hw/pci-host/pnv_phb3.c
+++ b/hw/pci-host/pnv_phb3.c
@@ -8,6 +8,7 @@
  */
 #include "qemu/osdep.h"
 #include "qemu/log.h"
+#include "qemu/bswap.h"
 #include "qapi/visitor.h"
 #include "qapi/error.h"
 #include "hw/pci-host/pnv_phb3_regs.h"
diff --git a/hw/pci-host/pnv_phb4.c b/hw/pci-host/pnv_phb4.c
index 77ea35299d..18992054e8 100644
--- a/hw/pci-host/pnv_phb4.c
+++ b/hw/pci-host/pnv_phb4.c
@@ -8,6 +8,7 @@
  */
 #include "qemu/osdep.h"
 #include "qemu/log.h"
+#include "qemu/bswap.h"
 #include "qapi/visitor.h"
 #include "qapi/error.h"
 #include "target/ppc/cpu.h"
diff --git a/hw/pci-host/ppce500.c b/hw/pci-host/ppce500.c
index 52269b05bb..975d191ccb 100644
--- a/hw/pci-host/ppce500.c
+++ b/hw/pci-host/ppce500.c
@@ -20,7 +20,6 @@
 #include "migration/vmstate.h"
 #include "hw/pci/pci_device.h"
 #include "hw/pci/pci_host.h"
-#include "qemu/bswap.h"
 #include "hw/pci-host/ppce500.h"
 #include "qom/object.h"
 
diff --git a/hw/pci-host/sh_pci.c b/hw/pci-host/sh_pci.c
index de8f6a84aa..62fb945075 100644
--- a/hw/pci-host/sh_pci.c
+++ b/hw/pci-host/sh_pci.c
@@ -28,7 +28,6 @@
 #include "hw/irq.h"
 #include "hw/pci/pci_device.h"
 #include "hw/pci/pci_host.h"
-#include "qemu/bswap.h"
 #include "qemu/module.h"
 #include "qom/object.h"
 
diff --git a/hw/s390x/s390-pci-inst.c b/hw/s390x/s390-pci-inst.c
index b5dddb22b8..a3bb5aa221 100644
--- a/hw/s390x/s390-pci-inst.c
+++ b/hw/s390x/s390-pci-inst.c
@@ -16,6 +16,7 @@
 #include "exec/target_page.h"
 #include "system/memory.h"
 #include "qemu/error-report.h"
+#include "qemu/bswap.h"
 #include "system/hw_accel.h"
 #include "hw/boards.h"
 #include "hw/pci/pci_device.h"
diff --git a/hw/sensor/lsm303dlhc_mag.c b/hw/sensor/lsm303dlhc_mag.c
index f9e501da84..cd5773ae64 100644
--- a/hw/sensor/lsm303dlhc_mag.c
+++ b/hw/sensor/lsm303dlhc_mag.c
@@ -28,7 +28,6 @@
 #include "qapi/visitor.h"
 #include "qemu/module.h"
 #include "qemu/log.h"
-#include "qemu/bswap.h"
 
 enum LSM303DLHCMagReg {
     LSM303DLHC_MAG_REG_CRA          = 0x00,
diff --git a/hw/smbios/smbios.c b/hw/smbios/smbios.c
index ad4cd6721e..1ac063cfb4 100644
--- a/hw/smbios/smbios.c
+++ b/hw/smbios/smbios.c
@@ -17,6 +17,7 @@
 
 #include "qemu/osdep.h"
 #include "qemu/units.h"
+#include "qemu/bswap.h"
 #include "qapi/error.h"
 #include "qemu/config-file.h"
 #include "qemu/module.h"
diff --git a/hw/vfio/migration-multifd.c b/hw/vfio/migration-multifd.c
index 55635486c8..9dc70fdf16 100644
--- a/hw/vfio/migration-multifd.c
+++ b/hw/vfio/migration-multifd.c
@@ -13,7 +13,6 @@
 #include "hw/vfio/vfio-device.h"
 #include "migration/misc.h"
 #include "qapi/error.h"
-#include "qemu/bswap.h"
 #include "qemu/error-report.h"
 #include "qemu/lockable.h"
 #include "qemu/main-loop.h"
diff --git a/hw/virtio/virtio-pci.c b/hw/virtio/virtio-pci.c
index fba2372c93..767216d795 100644
--- a/hw/virtio/virtio-pci.c
+++ b/hw/virtio/virtio-pci.c
@@ -30,6 +30,7 @@
 #include "qemu/error-report.h"
 #include "qemu/log.h"
 #include "qemu/module.h"
+#include "qemu/bswap.h"
 #include "hw/pci/msi.h"
 #include "hw/pci/msix.h"
 #include "hw/loader.h"
diff --git a/hw/vmapple/virtio-blk.c b/hw/vmapple/virtio-blk.c
index 532b5649ab..9de9aaae0b 100644
--- a/hw/vmapple/virtio-blk.c
+++ b/hw/vmapple/virtio-blk.c
@@ -19,7 +19,6 @@
 #include "hw/vmapple/vmapple.h"
 #include "hw/virtio/virtio-blk.h"
 #include "hw/virtio/virtio-pci.h"
-#include "qemu/bswap.h"
 #include "qemu/log.h"
 #include "qemu/module.h"
 #include "qapi/error.h"
diff --git a/include/exec/tswap.h b/include/exec/tswap.h
index 55ffa63359..72219e2c43 100644
--- a/include/exec/tswap.h
+++ b/include/exec/tswap.h
@@ -69,74 +69,4 @@ static inline void tswap64s(uint64_t *s)
     }
 }
 
-/* Return ld{word}_{le,be}_p following target endianness. */
-#define LOAD_IMPL(word, args...)                    \
-do {                                                \
-    if (target_big_endian()) {                      \
-        return glue(glue(ld, word), _be_p)(args);   \
-    } else {                                        \
-        return glue(glue(ld, word), _le_p)(args);   \
-    }                                               \
-} while (0)
-
-static inline int lduw_p(const void *ptr)
-{
-    LOAD_IMPL(uw, ptr);
-}
-
-static inline int ldsw_p(const void *ptr)
-{
-    LOAD_IMPL(sw, ptr);
-}
-
-static inline int ldl_p(const void *ptr)
-{
-    LOAD_IMPL(l, ptr);
-}
-
-static inline uint64_t ldq_p(const void *ptr)
-{
-    LOAD_IMPL(q, ptr);
-}
-
-static inline uint64_t ldn_p(const void *ptr, int sz)
-{
-    LOAD_IMPL(n, ptr, sz);
-}
-
-#undef LOAD_IMPL
-
-/* Call st{word}_{le,be}_p following target endianness. */
-#define STORE_IMPL(word, args...)           \
-do {                                        \
-    if (target_big_endian()) {              \
-        glue(glue(st, word), _be_p)(args);  \
-    } else {                                \
-        glue(glue(st, word), _le_p)(args);  \
-    }                                       \
-} while (0)
-
-
-static inline void stw_p(void *ptr, uint16_t v)
-{
-    STORE_IMPL(w, ptr, v);
-}
-
-static inline void stl_p(void *ptr, uint32_t v)
-{
-    STORE_IMPL(l, ptr, v);
-}
-
-static inline void stq_p(void *ptr, uint64_t v)
-{
-    STORE_IMPL(q, ptr, v);
-}
-
-static inline void stn_p(void *ptr, int sz, uint64_t v)
-{
-    STORE_IMPL(n, ptr, sz, v);
-}
-
-#undef STORE_IMPL
-
 #endif  /* TSWAP_H */
diff --git a/include/qemu/bswap.h b/include/qemu/bswap.h
index 9a11764536..39ba64046a 100644
--- a/include/qemu/bswap.h
+++ b/include/qemu/bswap.h
@@ -1,6 +1,8 @@
 #ifndef BSWAP_H
 #define BSWAP_H
 
+#include "qemu/target-info.h"
+
 #undef  bswap16
 #define bswap16(_x) __builtin_bswap16(_x)
 #undef  bswap32
@@ -432,4 +434,75 @@ DO_STN_LDN_P(be)
 #undef le_bswaps
 #undef be_bswaps
 
+
+/* Return ld{word}_{le,be}_p following target endianness. */
+#define LOAD_IMPL(word, args...)                    \
+do {                                                \
+    if (target_big_endian()) {                      \
+        return glue(glue(ld, word), _be_p)(args);   \
+    } else {                                        \
+        return glue(glue(ld, word), _le_p)(args);   \
+    }                                               \
+} while (0)
+
+static inline int lduw_p(const void *ptr)
+{
+    LOAD_IMPL(uw, ptr);
+}
+
+static inline int ldsw_p(const void *ptr)
+{
+    LOAD_IMPL(sw, ptr);
+}
+
+static inline int ldl_p(const void *ptr)
+{
+    LOAD_IMPL(l, ptr);
+}
+
+static inline uint64_t ldq_p(const void *ptr)
+{
+    LOAD_IMPL(q, ptr);
+}
+
+static inline uint64_t ldn_p(const void *ptr, int sz)
+{
+    LOAD_IMPL(n, ptr, sz);
+}
+
+#undef LOAD_IMPL
+
+/* Call st{word}_{le,be}_p following target endianness. */
+#define STORE_IMPL(word, args...)           \
+do {                                        \
+    if (target_big_endian()) {              \
+        glue(glue(st, word), _be_p)(args);  \
+    } else {                                \
+        glue(glue(st, word), _le_p)(args);  \
+    }                                       \
+} while (0)
+
+
+static inline void stw_p(void *ptr, uint16_t v)
+{
+    STORE_IMPL(w, ptr, v);
+}
+
+static inline void stl_p(void *ptr, uint32_t v)
+{
+    STORE_IMPL(l, ptr, v);
+}
+
+static inline void stq_p(void *ptr, uint64_t v)
+{
+    STORE_IMPL(q, ptr, v);
+}
+
+static inline void stn_p(void *ptr, int sz, uint64_t v)
+{
+    STORE_IMPL(n, ptr, sz, v);
+}
+
+#undef STORE_IMPL
+
 #endif /* BSWAP_H */
diff --git a/include/system/memory.h b/include/system/memory.h
index d6d069fd50..e2cd6ed126 100644
--- a/include/system/memory.h
+++ b/include/system/memory.h
@@ -19,7 +19,6 @@
 #include "exec/memattrs.h"
 #include "exec/memop.h"
 #include "exec/ramlist.h"
-#include "exec/tswap.h"
 #include "qemu/bswap.h"
 #include "qemu/queue.h"
 #include "qemu/int128.h"
diff --git a/include/user/abitypes.h b/include/user/abitypes.h
index 7528124b62..be7a876523 100644
--- a/include/user/abitypes.h
+++ b/include/user/abitypes.h
@@ -6,7 +6,6 @@
 #endif
 
 #include "exec/cpu-defs.h"
-#include "exec/tswap.h"
 #include "user/tswap-target.h"
 
 #ifdef TARGET_ABI32
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index 08c43f674a..e2b2337399 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -23,7 +23,6 @@
 #include "qemu/timer.h"
 #include "qemu/log.h"
 #include "exec/page-vary.h"
-#include "exec/tswap.h"
 #include "target/arm/idau.h"
 #include "qemu/module.h"
 #include "qapi/error.h"
diff --git a/target/i386/tcg/system/excp_helper.c b/target/i386/tcg/system/excp_helper.c
index c162621587..50040f6fca 100644
--- a/target/i386/tcg/system/excp_helper.c
+++ b/target/i386/tcg/system/excp_helper.c
@@ -25,7 +25,6 @@
 #include "exec/page-protection.h"
 #include "exec/target_page.h"
 #include "exec/tlb-flags.h"
-#include "exec/tswap.h"
 #include "tcg/helper-tcg.h"
 
 typedef struct TranslateParams {
diff --git a/target/i386/xsave_helper.c b/target/i386/xsave_helper.c
index 24ab7be8e9..996e9f3bfe 100644
--- a/target/i386/xsave_helper.c
+++ b/target/i386/xsave_helper.c
@@ -5,7 +5,6 @@
 #include "qemu/osdep.h"
 
 #include "cpu.h"
-#include "exec/tswap.h"
 
 void x86_cpu_xsave_all_areas(X86CPU *cpu, void *buf, uint32_t buflen)
 {
diff --git a/target/ppc/mmu-hash64.h b/target/ppc/mmu-hash64.h
index b8fb12a970..ae8d4b37ae 100644
--- a/target/ppc/mmu-hash64.h
+++ b/target/ppc/mmu-hash64.h
@@ -1,8 +1,6 @@
 #ifndef MMU_HASH64_H
 #define MMU_HASH64_H
 
-#include "exec/tswap.h"
-
 #ifndef CONFIG_USER_ONLY
 
 #ifdef TARGET_PPC64
diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
index b41c29da0b..7c67d67a13 100644
--- a/target/riscv/vector_helper.c
+++ b/target/riscv/vector_helper.c
@@ -27,7 +27,6 @@
 #include "exec/helper-proto.h"
 #include "exec/tlb-flags.h"
 #include "exec/target_page.h"
-#include "exec/tswap.h"
 #include "fpu/softfloat.h"
 #include "tcg/tcg-gvec-desc.h"
 #include "internals.h"
diff --git a/tests/tcg/plugins/mem.c b/tests/tcg/plugins/mem.c
index ca4e8883dd..9649bce99c 100644
--- a/tests/tcg/plugins/mem.c
+++ b/tests/tcg/plugins/mem.c
@@ -20,6 +20,7 @@
  * few things provided by compiler.h.
  */
 #include <compiler.h>
+#include <stdbool.h>
 #include <bswap.h>
 #include <qemu-plugin.h>
 

From 7f2e88837cb0b03a8ace4a01628d9c26a1196452 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 8 Jul 2025 23:53:19 +0200
Subject: [PATCH 2385/2760] hw/virtio: Build various files once
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Now that various VirtIO files don't use target specific
API anymore, we can move them to the system_ss[] source
set to build them once.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20250708215320.70426-9-philmd@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/block/meson.build         |  6 ++++--
 hw/virtio/meson.build        | 20 +++++++++++---------
 hw/virtio/virtio-config-io.c |  1 -
 3 files changed, 15 insertions(+), 12 deletions(-)

diff --git a/hw/block/meson.build b/hw/block/meson.build
index 655704471a..43ed296cf4 100644
--- a/hw/block/meson.build
+++ b/hw/block/meson.build
@@ -13,7 +13,9 @@ system_ss.add(when: 'CONFIG_SSI_M25P80', if_true: files('m25p80_sfdp.c'))
 system_ss.add(when: 'CONFIG_SWIM', if_true: files('swim.c'))
 system_ss.add(when: 'CONFIG_XEN_BUS', if_true: files('xen-block.c'))
 
-specific_ss.add(when: 'CONFIG_VIRTIO_BLK', if_true: files('virtio-blk.c', 'virtio-blk-common.c'))
-specific_ss.add(when: 'CONFIG_VHOST_USER_BLK', if_true: files('vhost-user-blk.c', 'virtio-blk-common.c'))
+specific_ss.add(when: 'CONFIG_VIRTIO_BLK', if_true: files('virtio-blk.c'))
+system_ss.add(when: 'CONFIG_VIRTIO_BLK', if_true: files('virtio-blk-common.c'))
+specific_ss.add(when: 'CONFIG_VHOST_USER_BLK', if_true: files('vhost-user-blk.c'))
+system_ss.add(when: 'CONFIG_VHOST_USER_BLK', if_true: files('virtio-blk-common.c'))
 
 subdir('dataplane')
diff --git a/hw/virtio/meson.build b/hw/virtio/meson.build
index 164f6fd995..3ea7b3cec8 100644
--- a/hw/virtio/meson.build
+++ b/hw/virtio/meson.build
@@ -1,6 +1,7 @@
 system_virtio_ss = ss.source_set()
 system_virtio_ss.add(files('virtio-bus.c'))
 system_virtio_ss.add(files('iothread-vq-mapping.c'))
+system_virtio_ss.add(files('virtio-config-io.c'))
 system_virtio_ss.add(when: 'CONFIG_VIRTIO_PCI', if_true: files('virtio-pci.c'))
 system_virtio_ss.add(when: 'CONFIG_VIRTIO_MMIO', if_true: files('virtio-mmio.c'))
 system_virtio_ss.add(when: 'CONFIG_VIRTIO_CRYPTO', if_true: files('virtio-crypto.c'))
@@ -10,11 +11,11 @@ system_virtio_ss.add(when: 'CONFIG_VHOST_VDPA_DEV', if_true: files('vdpa-dev.c')
 
 specific_virtio_ss = ss.source_set()
 specific_virtio_ss.add(files('virtio.c'))
-specific_virtio_ss.add(files('virtio-config-io.c', 'virtio-qmp.c'))
+specific_virtio_ss.add(files('virtio-qmp.c'))
 
 if have_vhost
   system_virtio_ss.add(files('vhost.c'))
-  specific_virtio_ss.add(files('vhost-backend.c', 'vhost-iova-tree.c'))
+  system_virtio_ss.add(files('vhost-backend.c', 'vhost-iova-tree.c'))
   if have_vhost_user
     # fixme - this really should be generic
     specific_virtio_ss.add(files('vhost-user.c'))
@@ -43,22 +44,22 @@ if have_vhost
   endif
   if have_vhost_vdpa
     system_virtio_ss.add(files('vhost-vdpa.c'))
-    specific_virtio_ss.add(files('vhost-shadow-virtqueue.c'))
+    system_virtio_ss.add(files('vhost-shadow-virtqueue.c'))
   endif
 else
   system_virtio_ss.add(files('vhost-stub.c'))
 endif
+system_virtio_ss.add(when: 'CONFIG_VHOST_USER_VSOCK', if_true: files('vhost-user-vsock.c'))
+system_virtio_ss.add(when: 'CONFIG_VIRTIO_RNG', if_true: files('virtio-rng.c'))
 
 specific_virtio_ss.add(when: 'CONFIG_VIRTIO_BALLOON', if_true: files('virtio-balloon.c'))
 specific_virtio_ss.add(when: 'CONFIG_VHOST_USER_FS', if_true: files('vhost-user-fs.c'))
 specific_virtio_ss.add(when: 'CONFIG_VIRTIO_PMEM', if_true: files('virtio-pmem.c'))
 specific_virtio_ss.add(when: 'CONFIG_VHOST_VSOCK', if_true: files('vhost-vsock.c'))
-specific_virtio_ss.add(when: 'CONFIG_VHOST_USER_VSOCK', if_true: files('vhost-user-vsock.c'))
-specific_virtio_ss.add(when: 'CONFIG_VIRTIO_RNG', if_true: files('virtio-rng.c'))
-specific_virtio_ss.add(when: 'CONFIG_VIRTIO_NSM', if_true: [files('virtio-nsm.c', 'cbor-helpers.c'), libcbor])
 specific_virtio_ss.add(when: 'CONFIG_VIRTIO_MEM', if_true: files('virtio-mem.c'))
-specific_virtio_ss.add(when: 'CONFIG_VHOST_USER_SCMI', if_true: files('vhost-user-scmi.c'))
-specific_virtio_ss.add(when: ['CONFIG_VIRTIO_PCI', 'CONFIG_VHOST_USER_SCMI'], if_true: files('vhost-user-scmi-pci.c'))
+system_virtio_ss.add(when: 'CONFIG_VIRTIO_NSM', if_true: files('virtio-nsm.c'))
+system_virtio_ss.add(when: 'CONFIG_VIRTIO_NSM', if_true: [files('cbor-helpers.c'), libcbor])
+system_virtio_ss.add(when: 'CONFIG_VHOST_USER_SCMI', if_true: files('vhost-user-scmi.c'))
 
 virtio_pci_ss = ss.source_set()
 virtio_pci_ss.add(when: 'CONFIG_VHOST_VSOCK', if_true: files('vhost-vsock-pci.c'))
@@ -67,6 +68,7 @@ virtio_pci_ss.add(when: 'CONFIG_VHOST_USER_BLK', if_true: files('vhost-user-blk-
 virtio_pci_ss.add(when: 'CONFIG_VHOST_USER_SCSI', if_true: files('vhost-user-scsi-pci.c'))
 virtio_pci_ss.add(when: 'CONFIG_VHOST_SCSI', if_true: files('vhost-scsi-pci.c'))
 virtio_pci_ss.add(when: 'CONFIG_VHOST_USER_FS', if_true: files('vhost-user-fs-pci.c'))
+virtio_pci_ss.add(when: 'CONFIG_VHOST_USER_SCMI', if_true: files('vhost-user-scmi-pci.c'))
 
 virtio_pci_ss.add(when: 'CONFIG_VIRTIO_CRYPTO', if_true: files('virtio-crypto-pci.c'))
 virtio_pci_ss.add(when: 'CONFIG_VIRTIO_INPUT_HOST', if_true: files('virtio-input-host-pci.c'))
@@ -85,7 +87,7 @@ virtio_pci_ss.add(when: 'CONFIG_VIRTIO_MEM', if_true: files('virtio-mem-pci.c'))
 virtio_pci_ss.add(when: 'CONFIG_VHOST_VDPA_DEV', if_true: files('vdpa-dev-pci.c'))
 virtio_pci_ss.add(when: 'CONFIG_VIRTIO_MD', if_true: files('virtio-md-pci.c'))
 
-specific_virtio_ss.add_all(when: 'CONFIG_VIRTIO_PCI', if_true: virtio_pci_ss)
+system_virtio_ss.add_all(when: 'CONFIG_VIRTIO_PCI', if_true: virtio_pci_ss)
 
 system_ss.add_all(when: 'CONFIG_VIRTIO', if_true: system_virtio_ss)
 system_ss.add(when: 'CONFIG_VIRTIO', if_false: files('vhost-stub.c'))
diff --git a/hw/virtio/virtio-config-io.c b/hw/virtio/virtio-config-io.c
index ad78e0b9bc..f58d90b6e3 100644
--- a/hw/virtio/virtio-config-io.c
+++ b/hw/virtio/virtio-config-io.c
@@ -11,7 +11,6 @@
 
 #include "qemu/osdep.h"
 #include "hw/virtio/virtio.h"
-#include "cpu.h"
 
 uint32_t virtio_config_readb(VirtIODevice *vdev, uint32_t addr)
 {

From 25e84c02e7aafbcb7a677569e9a4198e97cc38b8 Mon Sep 17 00:00:00 2001
From: Eric Auger <eric.auger@redhat.com>
Date: Mon, 14 Jul 2025 10:04:45 +0200
Subject: [PATCH 2386/2760] hw/i386/acpi-build: Make aml_pci_device_dsm()
 static
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

No need to export aml_pci_device_dsm() as it is only used
in hw/i386/acpi-build.c.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Gustavo Romero <gustavo.romero@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Message-Id: <20250714080639.2525563-2-eric.auger@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/acpi-build.c  | 2 +-
 include/hw/acpi/pci.h | 1 -
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
index 61851cc840..f59026524f 100644
--- a/hw/i386/acpi-build.c
+++ b/hw/i386/acpi-build.c
@@ -338,7 +338,7 @@ build_facs(GArray *table_data)
     g_array_append_vals(table_data, reserved, 40); /* Reserved */
 }
 
-Aml *aml_pci_device_dsm(void)
+static Aml *aml_pci_device_dsm(void)
 {
     Aml *method;
 
diff --git a/include/hw/acpi/pci.h b/include/hw/acpi/pci.h
index 6359d574fd..ab0187a894 100644
--- a/include/hw/acpi/pci.h
+++ b/include/hw/acpi/pci.h
@@ -36,7 +36,6 @@ typedef struct AcpiMcfgInfo {
 
 void build_mcfg(GArray *table_data, BIOSLinker *linker, AcpiMcfgInfo *info,
                 const char *oem_id, const char *oem_table_id);
-Aml *aml_pci_device_dsm(void);
 
 void build_append_pci_bus_devices(Aml *parent_scope, PCIBus *bus);
 void build_pci_bridge_aml(AcpiDevAmlIf *adev, Aml *scope);

From c242101c3c92410b7f5196f9d04a2844867be682 Mon Sep 17 00:00:00 2001
From: Eric Auger <eric.auger@redhat.com>
Date: Mon, 14 Jul 2025 10:04:46 +0200
Subject: [PATCH 2387/2760] hw/acpi: Rename and move build_x86_acpi_pci_hotplug
 to pcihp

We plan to reuse build_x86_acpi_pci_hotplug() implementation
for ARM so let's move the code to generic pcihp.

Associated static aml_pci_pdsm() helper is also moved along.
build_x86_acpi_pci_hotplug is renamed into build_acpi_pci_hotplug().

No code change intended.

Also fix the reference to acpi_pci_hotplug.rst documentation

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Gustavo Romero <gustavo.romero@linaro.org>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Message-Id: <20250714080639.2525563-3-eric.auger@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/acpi/pcihp.c         | 174 ++++++++++++++++++++++++++++++++++++++-
 hw/i386/acpi-build.c    | 176 +---------------------------------------
 hw/i386/acpi-build.h    |   4 -
 include/hw/acpi/pcihp.h |   7 ++
 4 files changed, 182 insertions(+), 179 deletions(-)

diff --git a/hw/acpi/pcihp.c b/hw/acpi/pcihp.c
index 497281ae20..cbe7e01385 100644
--- a/hw/acpi/pcihp.c
+++ b/hw/acpi/pcihp.c
@@ -26,7 +26,7 @@
 
 #include "qemu/osdep.h"
 #include "hw/acpi/pcihp.h"
-
+#include "hw/acpi/aml-build.h"
 #include "hw/pci-host/i440fx.h"
 #include "hw/pci/pci.h"
 #include "hw/pci/pci_bridge.h"
@@ -513,6 +513,178 @@ void acpi_pcihp_init(Object *owner, AcpiPciHpState *s, PCIBus *root_bus,
                                    OBJ_PROP_FLAG_READ);
 }
 
+void build_append_pci_dsm_func0_common(Aml *ctx, Aml *retvar)
+{
+    Aml *UUID, *ifctx1;
+    uint8_t byte_list[1] = { 0 }; /* nothing supported yet */
+
+    aml_append(ctx, aml_store(aml_buffer(1, byte_list), retvar));
+    /*
+     * PCI Firmware Specification 3.1
+     * 4.6.  _DSM Definitions for PCI
+     */
+    UUID = aml_touuid("E5C937D0-3553-4D7A-9117-EA4D19C3434D");
+    ifctx1 = aml_if(aml_lnot(aml_equal(aml_arg(0), UUID)));
+    {
+        /* call is for unsupported UUID, bail out */
+        aml_append(ifctx1, aml_return(retvar));
+    }
+    aml_append(ctx, ifctx1);
+
+    ifctx1 = aml_if(aml_lless(aml_arg(1), aml_int(2)));
+    {
+        /* call is for unsupported REV, bail out */
+        aml_append(ifctx1, aml_return(retvar));
+    }
+    aml_append(ctx, ifctx1);
+}
+
+static Aml *aml_pci_pdsm(void)
+{
+    Aml *method, *ifctx, *ifctx1;
+    Aml *ret = aml_local(0);
+    Aml *caps = aml_local(1);
+    Aml *acpi_index = aml_local(2);
+    Aml *zero = aml_int(0);
+    Aml *one = aml_int(1);
+    Aml *not_supp = aml_int(0xFFFFFFFF);
+    Aml *func = aml_arg(2);
+    Aml *params = aml_arg(4);
+    Aml *bnum = aml_derefof(aml_index(params, aml_int(0)));
+    Aml *sunum = aml_derefof(aml_index(params, aml_int(1)));
+
+    method = aml_method("PDSM", 5, AML_SERIALIZED);
+
+    /* get supported functions */
+    ifctx = aml_if(aml_equal(func, zero));
+    {
+        build_append_pci_dsm_func0_common(ifctx, ret);
+
+        aml_append(ifctx, aml_store(zero, caps));
+        aml_append(ifctx,
+            aml_store(aml_call2("AIDX", bnum, sunum), acpi_index));
+        /*
+         * advertise function 7 if device has acpi-index
+         * acpi_index values:
+         *            0: not present (default value)
+         *     FFFFFFFF: not supported (old QEMU without PIDX reg)
+         *        other: device's acpi-index
+         */
+        ifctx1 = aml_if(aml_lnot(
+                     aml_or(aml_equal(acpi_index, zero),
+                            aml_equal(acpi_index, not_supp), NULL)
+                 ));
+        {
+            /* have supported functions */
+            aml_append(ifctx1, aml_or(caps, one, caps));
+            /* support for function 7 */
+            aml_append(ifctx1,
+                aml_or(caps, aml_shiftleft(one, aml_int(7)), caps));
+        }
+        aml_append(ifctx, ifctx1);
+
+        aml_append(ifctx, aml_store(caps, aml_index(ret, zero)));
+        aml_append(ifctx, aml_return(ret));
+    }
+    aml_append(method, ifctx);
+
+    /* handle specific functions requests */
+    /*
+     * PCI Firmware Specification 3.1
+     * 4.6.7. _DSM for Naming a PCI or PCI Express Device Under
+     *        Operating Systems
+     */
+    ifctx = aml_if(aml_equal(func, aml_int(7)));
+    {
+       Aml *pkg = aml_package(2);
+
+       aml_append(ifctx, aml_store(aml_call2("AIDX", bnum, sunum), acpi_index));
+       aml_append(ifctx, aml_store(pkg, ret));
+       /*
+        * Windows calls func=7 without checking if it's available,
+        * as workaround Microsoft has suggested to return invalid for func7
+        * Package, so return 2 elements package but only initialize elements
+        * when acpi_index is supported and leave them uninitialized, which
+        * leads elements to being Uninitialized ObjectType and should trip
+        * Windows into discarding result as an unexpected and prevent setting
+        * bogus 'PCI Label' on the device.
+        */
+       ifctx1 = aml_if(aml_lnot(aml_lor(
+                    aml_equal(acpi_index, zero), aml_equal(acpi_index, not_supp)
+                )));
+       {
+           aml_append(ifctx1, aml_store(acpi_index, aml_index(ret, zero)));
+           /*
+            * optional, if not impl. should return null string
+            */
+           aml_append(ifctx1, aml_store(aml_string("%s", ""),
+                                        aml_index(ret, one)));
+       }
+       aml_append(ifctx, ifctx1);
+
+       aml_append(ifctx, aml_return(ret));
+    }
+
+    aml_append(method, ifctx);
+    return method;
+}
+
+void build_acpi_pci_hotplug(Aml *table, uint64_t pcihp_addr)
+{
+    Aml *scope;
+    Aml *field;
+    Aml *method;
+
+    scope =  aml_scope("_SB.PCI0");
+
+    aml_append(scope,
+        aml_operation_region("PCST", AML_SYSTEM_IO, aml_int(pcihp_addr), 0x08));
+    field = aml_field("PCST", AML_DWORD_ACC, AML_NOLOCK, AML_WRITE_AS_ZEROS);
+    aml_append(field, aml_named_field("PCIU", 32));
+    aml_append(field, aml_named_field("PCID", 32));
+    aml_append(scope, field);
+
+    aml_append(scope,
+        aml_operation_region("SEJ", AML_SYSTEM_IO,
+                             aml_int(pcihp_addr + ACPI_PCIHP_SEJ_BASE), 0x04));
+    field = aml_field("SEJ", AML_DWORD_ACC, AML_NOLOCK, AML_WRITE_AS_ZEROS);
+    aml_append(field, aml_named_field("B0EJ", 32));
+    aml_append(scope, field);
+
+    aml_append(scope,
+        aml_operation_region("BNMR", AML_SYSTEM_IO,
+                             aml_int(pcihp_addr + ACPI_PCIHP_BNMR_BASE), 0x08));
+    field = aml_field("BNMR", AML_DWORD_ACC, AML_NOLOCK, AML_WRITE_AS_ZEROS);
+    aml_append(field, aml_named_field("BNUM", 32));
+    aml_append(field, aml_named_field("PIDX", 32));
+    aml_append(scope, field);
+
+    aml_append(scope, aml_mutex("BLCK", 0));
+
+        method = aml_method("PCEJ", 2, AML_NOTSERIALIZED);
+    aml_append(method, aml_acquire(aml_name("BLCK"), 0xFFFF));
+    aml_append(method, aml_store(aml_arg(0), aml_name("BNUM")));
+    aml_append(method,
+        aml_store(aml_shiftleft(aml_int(1), aml_arg(1)), aml_name("B0EJ")));
+    aml_append(method, aml_release(aml_name("BLCK")));
+    aml_append(method, aml_return(aml_int(0)));
+    aml_append(scope, method);
+
+    method = aml_method("AIDX", 2, AML_NOTSERIALIZED);
+    aml_append(method, aml_acquire(aml_name("BLCK"), 0xFFFF));
+    aml_append(method, aml_store(aml_arg(0), aml_name("BNUM")));
+    aml_append(method,
+        aml_store(aml_shiftleft(aml_int(1), aml_arg(1)), aml_name("PIDX")));
+    aml_append(method, aml_store(aml_name("PIDX"), aml_local(0)));
+    aml_append(method, aml_release(aml_name("BLCK")));
+    aml_append(method, aml_return(aml_local(0)));
+    aml_append(scope, method);
+
+    aml_append(scope, aml_pci_pdsm());
+
+    aml_append(table, scope);
+}
+
 const VMStateDescription vmstate_acpi_pcihp_pci_status = {
     .name = "acpi_pcihp_pci_status",
     .version_id = 1,
diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
index f59026524f..4f8572eebe 100644
--- a/hw/i386/acpi-build.c
+++ b/hw/i386/acpi-build.c
@@ -361,32 +361,6 @@ static Aml *aml_pci_device_dsm(void)
     return method;
 }
 
-static void build_append_pci_dsm_func0_common(Aml *ctx, Aml *retvar)
-{
-    Aml *UUID, *ifctx1;
-    uint8_t byte_list[1] = { 0 }; /* nothing supported yet */
-
-    aml_append(ctx, aml_store(aml_buffer(1, byte_list), retvar));
-    /*
-     * PCI Firmware Specification 3.1
-     * 4.6.  _DSM Definitions for PCI
-     */
-    UUID = aml_touuid("E5C937D0-3553-4D7A-9117-EA4D19C3434D");
-    ifctx1 = aml_if(aml_lnot(aml_equal(aml_arg(0), UUID)));
-    {
-        /* call is for unsupported UUID, bail out */
-        aml_append(ifctx1, aml_return(retvar));
-    }
-    aml_append(ctx, ifctx1);
-
-    ifctx1 = aml_if(aml_lless(aml_arg(1), aml_int(2)));
-    {
-        /* call is for unsupported REV, bail out */
-        aml_append(ifctx1, aml_return(retvar));
-    }
-    aml_append(ctx, ifctx1);
-}
-
 static Aml *aml_pci_edsm(void)
 {
     Aml *method, *ifctx;
@@ -647,96 +621,6 @@ static bool build_append_notification_callback(Aml *parent_scope,
     return !!nr_notifiers;
 }
 
-static Aml *aml_pci_pdsm(void)
-{
-    Aml *method, *ifctx, *ifctx1;
-    Aml *ret = aml_local(0);
-    Aml *caps = aml_local(1);
-    Aml *acpi_index = aml_local(2);
-    Aml *zero = aml_int(0);
-    Aml *one = aml_int(1);
-    Aml *not_supp = aml_int(0xFFFFFFFF);
-    Aml *func = aml_arg(2);
-    Aml *params = aml_arg(4);
-    Aml *bnum = aml_derefof(aml_index(params, aml_int(0)));
-    Aml *sunum = aml_derefof(aml_index(params, aml_int(1)));
-
-    method = aml_method("PDSM", 5, AML_SERIALIZED);
-
-    /* get supported functions */
-    ifctx = aml_if(aml_equal(func, zero));
-    {
-        build_append_pci_dsm_func0_common(ifctx, ret);
-
-        aml_append(ifctx, aml_store(zero, caps));
-        aml_append(ifctx,
-            aml_store(aml_call2("AIDX", bnum, sunum), acpi_index));
-        /*
-         * advertise function 7 if device has acpi-index
-         * acpi_index values:
-         *            0: not present (default value)
-         *     FFFFFFFF: not supported (old QEMU without PIDX reg)
-         *        other: device's acpi-index
-         */
-        ifctx1 = aml_if(aml_lnot(
-                     aml_or(aml_equal(acpi_index, zero),
-                            aml_equal(acpi_index, not_supp), NULL)
-                 ));
-        {
-            /* have supported functions */
-            aml_append(ifctx1, aml_or(caps, one, caps));
-            /* support for function 7 */
-            aml_append(ifctx1,
-                aml_or(caps, aml_shiftleft(one, aml_int(7)), caps));
-        }
-        aml_append(ifctx, ifctx1);
-
-        aml_append(ifctx, aml_store(caps, aml_index(ret, zero)));
-        aml_append(ifctx, aml_return(ret));
-    }
-    aml_append(method, ifctx);
-
-    /* handle specific functions requests */
-    /*
-     * PCI Firmware Specification 3.1
-     * 4.6.7. _DSM for Naming a PCI or PCI Express Device Under
-     *        Operating Systems
-     */
-    ifctx = aml_if(aml_equal(func, aml_int(7)));
-    {
-       Aml *pkg = aml_package(2);
-
-       aml_append(ifctx, aml_store(aml_call2("AIDX", bnum, sunum), acpi_index));
-       aml_append(ifctx, aml_store(pkg, ret));
-       /*
-        * Windows calls func=7 without checking if it's available,
-        * as workaround Microsoft has suggested to return invalid for func7
-        * Package, so return 2 elements package but only initialize elements
-        * when acpi_index is supported and leave them uninitialized, which
-        * leads elements to being Uninitialized ObjectType and should trip
-        * Windows into discarding result as an unexpected and prevent setting
-        * bogus 'PCI Label' on the device.
-        */
-       ifctx1 = aml_if(aml_lnot(aml_lor(
-                    aml_equal(acpi_index, zero), aml_equal(acpi_index, not_supp)
-                )));
-       {
-           aml_append(ifctx1, aml_store(acpi_index, aml_index(ret, zero)));
-           /*
-            * optional, if not impl. should return null string
-            */
-           aml_append(ifctx1, aml_store(aml_string("%s", ""),
-                                        aml_index(ret, one)));
-       }
-       aml_append(ifctx, ifctx1);
-
-       aml_append(ifctx, aml_return(ret));
-    }
-
-    aml_append(method, ifctx);
-    return method;
-}
-
 /*
  * build_prt - Define interrupt routing rules
  *
@@ -1227,62 +1111,6 @@ static Aml *build_q35_dram_controller(const AcpiMcfgInfo *mcfg)
     return dev;
 }
 
-static void build_x86_acpi_pci_hotplug(Aml *table, uint64_t pcihp_addr)
-{
-    Aml *scope;
-    Aml *field;
-    Aml *method;
-
-    scope =  aml_scope("_SB.PCI0");
-
-    aml_append(scope,
-        aml_operation_region("PCST", AML_SYSTEM_IO, aml_int(pcihp_addr), 0x08));
-    field = aml_field("PCST", AML_DWORD_ACC, AML_NOLOCK, AML_WRITE_AS_ZEROS);
-    aml_append(field, aml_named_field("PCIU", 32));
-    aml_append(field, aml_named_field("PCID", 32));
-    aml_append(scope, field);
-
-    aml_append(scope,
-        aml_operation_region("SEJ", AML_SYSTEM_IO,
-                             aml_int(pcihp_addr + ACPI_PCIHP_SEJ_BASE), 0x04));
-    field = aml_field("SEJ", AML_DWORD_ACC, AML_NOLOCK, AML_WRITE_AS_ZEROS);
-    aml_append(field, aml_named_field("B0EJ", 32));
-    aml_append(scope, field);
-
-    aml_append(scope,
-        aml_operation_region("BNMR", AML_SYSTEM_IO,
-                             aml_int(pcihp_addr + ACPI_PCIHP_BNMR_BASE), 0x08));
-    field = aml_field("BNMR", AML_DWORD_ACC, AML_NOLOCK, AML_WRITE_AS_ZEROS);
-    aml_append(field, aml_named_field("BNUM", 32));
-    aml_append(field, aml_named_field("PIDX", 32));
-    aml_append(scope, field);
-
-    aml_append(scope, aml_mutex("BLCK", 0));
-
-    method = aml_method("PCEJ", 2, AML_NOTSERIALIZED);
-    aml_append(method, aml_acquire(aml_name("BLCK"), 0xFFFF));
-    aml_append(method, aml_store(aml_arg(0), aml_name("BNUM")));
-    aml_append(method,
-        aml_store(aml_shiftleft(aml_int(1), aml_arg(1)), aml_name("B0EJ")));
-    aml_append(method, aml_release(aml_name("BLCK")));
-    aml_append(method, aml_return(aml_int(0)));
-    aml_append(scope, method);
-
-    method = aml_method("AIDX", 2, AML_NOTSERIALIZED);
-    aml_append(method, aml_acquire(aml_name("BLCK"), 0xFFFF));
-    aml_append(method, aml_store(aml_arg(0), aml_name("BNUM")));
-    aml_append(method,
-        aml_store(aml_shiftleft(aml_int(1), aml_arg(1)), aml_name("PIDX")));
-    aml_append(method, aml_store(aml_name("PIDX"), aml_local(0)));
-    aml_append(method, aml_release(aml_name("BLCK")));
-    aml_append(method, aml_return(aml_local(0)));
-    aml_append(scope, method);
-
-    aml_append(scope, aml_pci_pdsm());
-
-    aml_append(table, scope);
-}
-
 static Aml *build_q35_osc_method(bool enable_native_pcie_hotplug)
 {
     Aml *if_ctx;
@@ -1394,7 +1222,7 @@ build_dsdt(GArray *table_data, BIOSLinker *linker,
         aml_append(dsdt, sb_scope);
 
         if (pm->pcihp_bridge_en || pm->pcihp_root_en) {
-            build_x86_acpi_pci_hotplug(dsdt, pm->pcihp_io_base);
+            build_acpi_pci_hotplug(dsdt, pm->pcihp_io_base);
         }
         build_piix4_pci0_int(dsdt);
     } else if (q35) {
@@ -1438,7 +1266,7 @@ build_dsdt(GArray *table_data, BIOSLinker *linker,
         aml_append(dsdt, sb_scope);
 
         if (pm->pcihp_bridge_en) {
-            build_x86_acpi_pci_hotplug(dsdt, pm->pcihp_io_base);
+            build_acpi_pci_hotplug(dsdt, pm->pcihp_io_base);
         }
         build_q35_pci0_int(dsdt);
     }
diff --git a/hw/i386/acpi-build.h b/hw/i386/acpi-build.h
index 275ec058a1..8ba3c33e48 100644
--- a/hw/i386/acpi-build.h
+++ b/hw/i386/acpi-build.h
@@ -5,10 +5,6 @@
 
 extern const struct AcpiGenericAddress x86_nvdimm_acpi_dsmio;
 
-/* PCI Hot-plug registers' base. See docs/specs/acpi_pci_hotplug.rst */
-#define ACPI_PCIHP_SEJ_BASE 0x8
-#define ACPI_PCIHP_BNMR_BASE 0x10
-
 void acpi_setup(void);
 Object *acpi_get_i386_pci_host(void);
 
diff --git a/include/hw/acpi/pcihp.h b/include/hw/acpi/pcihp.h
index cdc0cb8e43..971451e8ea 100644
--- a/include/hw/acpi/pcihp.h
+++ b/include/hw/acpi/pcihp.h
@@ -33,6 +33,10 @@
 #define ACPI_PCIHP_IO_BASE_PROP "acpi-pcihp-io-base"
 #define ACPI_PCIHP_IO_LEN_PROP "acpi-pcihp-io-len"
 
+/* PCI Hot-plug registers bases. See docs/specs/acpi_pci_hotplug.rst */
+#define ACPI_PCIHP_SEJ_BASE 0x8
+#define ACPI_PCIHP_BNMR_BASE 0x10
+
 typedef struct AcpiPciHpPciStatus {
     uint32_t up;
     uint32_t down;
@@ -69,6 +73,9 @@ void acpi_pcihp_device_unplug_request_cb(HotplugHandler *hotplug_dev,
                                          AcpiPciHpState *s, DeviceState *dev,
                                          Error **errp);
 
+void build_acpi_pci_hotplug(Aml *table, uint64_t pcihp_addr);
+void build_append_pci_dsm_func0_common(Aml *ctx, Aml *retvar);
+
 /* Called on reset */
 void acpi_pcihp_reset(AcpiPciHpState *s);
 

From eb3feb8747754d2e41654368133c2d61cc8dd72c Mon Sep 17 00:00:00 2001
From: Eric Auger <eric.auger@redhat.com>
Date: Mon, 14 Jul 2025 10:04:47 +0200
Subject: [PATCH 2388/2760] hw/pci-host/gpex-acpi: Add native_pci_hotplug arg
 to acpi_dsdt_add_pci_osc

Add a new argument to acpi_dsdt_add_pci_osc to be able to disable
native pci hotplug.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Gustavo Romero <gustavo.romero@linaro.org>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Message-Id: <20250714080639.2525563-4-eric.auger@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/pci-host/gpex-acpi.c | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/hw/pci-host/gpex-acpi.c b/hw/pci-host/gpex-acpi.c
index 0aba47c71c..f34b7cf25e 100644
--- a/hw/pci-host/gpex-acpi.c
+++ b/hw/pci-host/gpex-acpi.c
@@ -50,7 +50,7 @@ static void acpi_dsdt_add_pci_route_table(Aml *dev, uint32_t irq,
     }
 }
 
-static void acpi_dsdt_add_pci_osc(Aml *dev)
+static void acpi_dsdt_add_pci_osc(Aml *dev, bool enable_native_pcie_hotplug)
 {
     Aml *method, *UUID, *ifctx, *ifctx1, *elsectx, *buf;
 
@@ -77,11 +77,12 @@ static void acpi_dsdt_add_pci_osc(Aml *dev)
     aml_append(ifctx, aml_store(aml_name("CDW3"), aml_name("CTRL")));
 
     /*
-     * Allow OS control for all 5 features:
-     * PCIeHotplug SHPCHotplug PME AER PCIeCapability.
+     * Allow OS control for SHPCHotplug, PME, AER, PCIeCapability,
+     * and PCIeHotplug depending on enable_native_pcie_hotplug
      */
-    aml_append(ifctx, aml_and(aml_name("CTRL"), aml_int(0x1F),
-                              aml_name("CTRL")));
+    aml_append(ifctx, aml_and(aml_name("CTRL"),
+               aml_int(0x1E | (enable_native_pcie_hotplug ? 0x1 : 0x0)),
+               aml_name("CTRL")));
 
     ifctx1 = aml_if(aml_lnot(aml_equal(aml_arg(1), aml_int(0x1))));
     aml_append(ifctx1, aml_or(aml_name("CDW1"), aml_int(0x08),
@@ -192,7 +193,7 @@ void acpi_dsdt_add_gpex(Aml *scope, struct GPEXConfig *cfg)
             if (is_cxl) {
                 build_cxl_osc_method(dev);
             } else {
-                acpi_dsdt_add_pci_osc(dev);
+                acpi_dsdt_add_pci_osc(dev, true);
             }
 
             aml_append(scope, dev);
@@ -267,7 +268,7 @@ void acpi_dsdt_add_gpex(Aml *scope, struct GPEXConfig *cfg)
     }
     aml_append(dev, aml_name_decl("_CRS", rbuf));
 
-    acpi_dsdt_add_pci_osc(dev);
+    acpi_dsdt_add_pci_osc(dev, true);
 
     Aml *dev_res0 = aml_device("%s", "RES0");
     aml_append(dev_res0, aml_name_decl("_HID", aml_string("PNP0C02")));

From 9748673735d93da3b1da12041f2525e0fbca5dc6 Mon Sep 17 00:00:00 2001
From: Gustavo Romero <gustavo.romero@linaro.org>
Date: Mon, 14 Jul 2025 10:04:48 +0200
Subject: [PATCH 2389/2760] tests/qtest/bios-tables-test: Prepare for changes
 in the DSDT table

This commit adds DSDT blobs to the whilelist in the prospect to
allow changes in the GPEX _OSC method.

Signed-off-by: Gustavo Romero <gustavo.romero@linaro.org>
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Acked-by: Igor Mammedov <imammedo@redhat.com>
Message-Id: <20250714080639.2525563-5-eric.auger@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 tests/qtest/bios-tables-test-allowed-diff.h | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/tests/qtest/bios-tables-test-allowed-diff.h b/tests/qtest/bios-tables-test-allowed-diff.h
index dfb8523c8b..8d9673cb5d 100644
--- a/tests/qtest/bios-tables-test-allowed-diff.h
+++ b/tests/qtest/bios-tables-test-allowed-diff.h
@@ -1 +1,12 @@
 /* List of comma-separated changed AML files to ignore */
+"tests/data/acpi/aarch64/virt/DSDT",
+"tests/data/acpi/aarch64/virt/DSDT.acpihmatvirt",
+"tests/data/acpi/aarch64/virt/DSDT.memhp",
+"tests/data/acpi/aarch64/virt/DSDT.pxb",
+"tests/data/acpi/aarch64/virt/DSDT.topology",
+"tests/data/acpi/loongarch64/virt/DSDT.memhp",
+"tests/data/acpi/loongarch64/virt/DSDT.topology",
+"tests/data/acpi/loongarch64/virt/DSDT.numamem",
+"tests/data/acpi/loongarch64/virt/DSDT",
+"tests/data/acpi/x86/microvm/DSDT.pcie",
+"tests/data/acpi/riscv64/virt/DSDT",

From ec9af8919826d57126d9b83fa1715d1333b74a18 Mon Sep 17 00:00:00 2001
From: Eric Auger <eric.auger@redhat.com>
Date: Mon, 14 Jul 2025 10:04:49 +0200
Subject: [PATCH 2390/2760] hw/pci-host/gpex-acpi: Split host bridge OSC and
 DSM generation

acpi_dsdt_add_pci_osc() name is confusing as it gives the impression
it appends the _OSC method but in fact it also appends the _DSM method
for the host bridge. Let's split the function into two separate ones
and let them return the method Aml pointer instead. This matches the
way it is done on x86 (build_q35_osc_method). In a subsequent patch
we will replace the gpex method by the q35 implementation that will
become shared between ARM and x86.

acpi_dsdt_add_host_bridge_methods is a new top helper that generates
both the _OSC and _DSM methods.

We take the opportunity to move SUPP and CTRL in the _osc method
that use them.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Message-Id: <20250714080639.2525563-6-eric.auger@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/pci-host/gpex-acpi.c | 32 +++++++++++++++++++++-----------
 1 file changed, 21 insertions(+), 11 deletions(-)

diff --git a/hw/pci-host/gpex-acpi.c b/hw/pci-host/gpex-acpi.c
index f34b7cf25e..80fc2bf032 100644
--- a/hw/pci-host/gpex-acpi.c
+++ b/hw/pci-host/gpex-acpi.c
@@ -50,14 +50,12 @@ static void acpi_dsdt_add_pci_route_table(Aml *dev, uint32_t irq,
     }
 }
 
-static void acpi_dsdt_add_pci_osc(Aml *dev, bool enable_native_pcie_hotplug)
+static Aml *build_host_bridge_osc(bool enable_native_pcie_hotplug)
 {
-    Aml *method, *UUID, *ifctx, *ifctx1, *elsectx, *buf;
-
-    /* Declare an _OSC (OS Control Handoff) method */
-    aml_append(dev, aml_name_decl("SUPP", aml_int(0)));
-    aml_append(dev, aml_name_decl("CTRL", aml_int(0)));
+    Aml *method, *UUID, *ifctx, *ifctx1, *elsectx;
     method = aml_method("_OSC", 4, AML_NOTSERIALIZED);
+    aml_append(method, aml_name_decl("SUPP", aml_int(0)));
+    aml_append(method, aml_name_decl("CTRL", aml_int(0)));
     aml_append(method,
         aml_create_dword_field(aml_arg(3), aml_int(0), "CDW1"));
 
@@ -103,9 +101,13 @@ static void acpi_dsdt_add_pci_osc(Aml *dev, bool enable_native_pcie_hotplug)
                                aml_name("CDW1")));
     aml_append(elsectx, aml_return(aml_arg(3)));
     aml_append(method, elsectx);
-    aml_append(dev, method);
+    return method;
+}
 
-    method = aml_method("_DSM", 4, AML_NOTSERIALIZED);
+static Aml *build_host_bridge_dsm(void)
+{
+    Aml *method = aml_method("_DSM", 4, AML_NOTSERIALIZED);
+    Aml *UUID, *ifctx, *ifctx1, *buf;
 
     /* PCI Firmware Specification 3.0
      * 4.6.1. _DSM for PCI Express Slot Information
@@ -124,7 +126,15 @@ static void acpi_dsdt_add_pci_osc(Aml *dev, bool enable_native_pcie_hotplug)
     byte_list[0] = 0;
     buf = aml_buffer(1, byte_list);
     aml_append(method, aml_return(buf));
-    aml_append(dev, method);
+    return method;
+}
+
+static void acpi_dsdt_add_host_bridge_methods(Aml *dev,
+                                              bool enable_native_pcie_hotplug)
+{
+    /* Declare an _OSC (OS Control Handoff) method */
+    aml_append(dev, build_host_bridge_osc(enable_native_pcie_hotplug));
+    aml_append(dev, build_host_bridge_dsm());
 }
 
 void acpi_dsdt_add_gpex(Aml *scope, struct GPEXConfig *cfg)
@@ -193,7 +203,7 @@ void acpi_dsdt_add_gpex(Aml *scope, struct GPEXConfig *cfg)
             if (is_cxl) {
                 build_cxl_osc_method(dev);
             } else {
-                acpi_dsdt_add_pci_osc(dev, true);
+                acpi_dsdt_add_host_bridge_methods(dev, true);
             }
 
             aml_append(scope, dev);
@@ -268,7 +278,7 @@ void acpi_dsdt_add_gpex(Aml *scope, struct GPEXConfig *cfg)
     }
     aml_append(dev, aml_name_decl("_CRS", rbuf));
 
-    acpi_dsdt_add_pci_osc(dev, true);
+    acpi_dsdt_add_host_bridge_methods(dev, true);
 
     Aml *dev_res0 = aml_device("%s", "RES0");
     aml_append(dev_res0, aml_name_decl("_HID", aml_string("PNP0C02")));

From c4ad7513565979ae4c3910bd37c453f5737343a1 Mon Sep 17 00:00:00 2001
From: Eric Auger <eric.auger@redhat.com>
Date: Mon, 14 Jul 2025 10:04:50 +0200
Subject: [PATCH 2391/2760] hw/acpi/ged: Add a
 acpi-pci-hotplug-with-bridge-support property

A new boolean property is introduced. This will be used to turn
ACPI PCI hotplug support. By default it is unset.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Message-Id: <20250714080639.2525563-7-eric.auger@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/acpi/generic_event_device.c         | 2 ++
 include/hw/acpi/generic_event_device.h | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/hw/acpi/generic_event_device.c b/hw/acpi/generic_event_device.c
index 7a62f8d5bc..7831db412b 100644
--- a/hw/acpi/generic_event_device.c
+++ b/hw/acpi/generic_event_device.c
@@ -318,6 +318,8 @@ static void acpi_ged_send_event(AcpiDeviceIf *adev, AcpiEventStatusBits ev)
 
 static const Property acpi_ged_properties[] = {
     DEFINE_PROP_UINT32("ged-event", AcpiGedState, ged_event_bitmap, 0),
+    DEFINE_PROP_BOOL(ACPI_PM_PROP_ACPI_PCIHP_BRIDGE, AcpiGedState,
+                     pcihp_state.use_acpi_hotplug_bridge, 0),
 };
 
 static const VMStateDescription vmstate_memhp_state = {
diff --git a/include/hw/acpi/generic_event_device.h b/include/hw/acpi/generic_event_device.h
index d2dac87b4a..f5ffa67a39 100644
--- a/include/hw/acpi/generic_event_device.h
+++ b/include/hw/acpi/generic_event_device.h
@@ -63,6 +63,7 @@
 #include "hw/acpi/memory_hotplug.h"
 #include "hw/acpi/ghes.h"
 #include "hw/acpi/cpu.h"
+#include "hw/acpi/pcihp.h"
 #include "qom/object.h"
 
 #define ACPI_POWER_BUTTON_DEVICE "PWRB"
@@ -114,6 +115,7 @@ struct AcpiGedState {
     MemoryRegion container_memhp;
     CPUHotplugState cpuhp_state;
     MemoryRegion container_cpuhp;
+    AcpiPciHpState pcihp_state;
     GEDState ged_state;
     uint32_t ged_event_bitmap;
     qemu_irq irq;

From 1136309df5e3de7d031a137221318f48784cca5d Mon Sep 17 00:00:00 2001
From: Eric Auger <eric.auger@redhat.com>
Date: Mon, 14 Jul 2025 10:04:51 +0200
Subject: [PATCH 2392/2760] hw/pci-host/gpex-acpi: Use GED acpi pcihp property

Retrieve the acpi pcihp property value from the ged. In case this latter
is not set, PCI native hotplug is used on pci0. For expander bridges we
keep pci native hotplug, as done on x86 q35.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Message-Id: <20250714080639.2525563-8-eric.auger@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/arm/virt-acpi-build.c   | 9 +++++++++
 hw/pci-host/gpex-acpi.c    | 3 ++-
 include/hw/pci-host/gpex.h | 1 +
 3 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
index 782b17b966..f3bad69aa7 100644
--- a/hw/arm/virt-acpi-build.c
+++ b/hw/arm/virt-acpi-build.c
@@ -144,12 +144,21 @@ static void acpi_dsdt_add_pci(Aml *scope, const MemMapEntry *memmap,
     int ecam_id = VIRT_ECAM_ID(vms->highmem_ecam);
     bool cxl_present = false;
     PCIBus *bus = vms->bus;
+    bool acpi_pcihp = false;
+
+    if (vms->acpi_dev) {
+        acpi_pcihp = object_property_get_bool(OBJECT(vms->acpi_dev),
+                                              ACPI_PM_PROP_ACPI_PCIHP_BRIDGE,
+                                              NULL);
+    }
+
     struct GPEXConfig cfg = {
         .mmio32 = memmap[VIRT_PCIE_MMIO],
         .pio    = memmap[VIRT_PCIE_PIO],
         .ecam   = memmap[ecam_id],
         .irq    = irq,
         .bus    = vms->bus,
+        .pci_native_hotplug = !acpi_pcihp,
     };
 
     if (vms->highmem_mmio) {
diff --git a/hw/pci-host/gpex-acpi.c b/hw/pci-host/gpex-acpi.c
index 80fc2bf032..44737a8d81 100644
--- a/hw/pci-host/gpex-acpi.c
+++ b/hw/pci-host/gpex-acpi.c
@@ -203,6 +203,7 @@ void acpi_dsdt_add_gpex(Aml *scope, struct GPEXConfig *cfg)
             if (is_cxl) {
                 build_cxl_osc_method(dev);
             } else {
+                /* pxb bridges do not have ACPI PCI Hot-plug enabled */
                 acpi_dsdt_add_host_bridge_methods(dev, true);
             }
 
@@ -278,7 +279,7 @@ void acpi_dsdt_add_gpex(Aml *scope, struct GPEXConfig *cfg)
     }
     aml_append(dev, aml_name_decl("_CRS", rbuf));
 
-    acpi_dsdt_add_host_bridge_methods(dev, true);
+    acpi_dsdt_add_host_bridge_methods(dev, cfg->pci_native_hotplug);
 
     Aml *dev_res0 = aml_device("%s", "RES0");
     aml_append(dev_res0, aml_name_decl("_HID", aml_string("PNP0C02")));
diff --git a/include/hw/pci-host/gpex.h b/include/hw/pci-host/gpex.h
index 84471533af..feaf827474 100644
--- a/include/hw/pci-host/gpex.h
+++ b/include/hw/pci-host/gpex.h
@@ -45,6 +45,7 @@ struct GPEXConfig {
     MemMapEntry pio;
     int         irq;
     PCIBus      *bus;
+    bool        pci_native_hotplug;
 };
 
 typedef struct GPEXIrq GPEXIrq;

From dc925e4b1d19dcce93107d1d20f7232244f48924 Mon Sep 17 00:00:00 2001
From: Eric Auger <eric.auger@redhat.com>
Date: Mon, 14 Jul 2025 10:04:52 +0200
Subject: [PATCH 2393/2760] hw/i386/acpi-build: Turn build_q35_osc_method into
 a generic method

GPEX acpi_dsdt_add_pci_osc() does basically the same as
build_q35_osc_method().

Rename build_q35_osc_method() into build_pci_host_bridge_osc_method()
and move it into hw/acpi/pci.c. In a subsequent patch we will
use this later in place of acpi_dsdt_add_pci_osc().

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Message-Id: <20250714080639.2525563-9-eric.auger@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/acpi/pci.c         | 50 +++++++++++++++++++++++++++++++++++++++
 hw/i386/acpi-build.c  | 54 ++-----------------------------------------
 include/hw/acpi/pci.h |  2 ++
 3 files changed, 54 insertions(+), 52 deletions(-)

diff --git a/hw/acpi/pci.c b/hw/acpi/pci.c
index d511a85029..2228f1245e 100644
--- a/hw/acpi/pci.c
+++ b/hw/acpi/pci.c
@@ -301,3 +301,53 @@ void build_srat_generic_affinity_structures(GArray *table_data)
     object_child_foreach_recursive(object_get_root(), build_acpi_generic_port,
                                    table_data);
 }
+
+Aml *build_pci_host_bridge_osc_method(bool enable_native_pcie_hotplug)
+{
+    Aml *if_ctx;
+    Aml *if_ctx2;
+    Aml *else_ctx;
+    Aml *method;
+    Aml *a_cwd1 = aml_name("CDW1");
+    Aml *a_ctrl = aml_local(0);
+
+    method = aml_method("_OSC", 4, AML_NOTSERIALIZED);
+    aml_append(method, aml_create_dword_field(aml_arg(3), aml_int(0), "CDW1"));
+
+    if_ctx = aml_if(aml_equal(
+        aml_arg(0), aml_touuid("33DB4D5B-1FF7-401C-9657-7441C03DD766")));
+    aml_append(if_ctx, aml_create_dword_field(aml_arg(3), aml_int(4), "CDW2"));
+    aml_append(if_ctx, aml_create_dword_field(aml_arg(3), aml_int(8), "CDW3"));
+
+    aml_append(if_ctx, aml_store(aml_name("CDW3"), a_ctrl));
+
+    /*
+     * Always allow native PME, AER (no dependencies)
+     * Allow SHPC (PCI bridges can have SHPC controller)
+     * Disable PCIe Native Hot-plug if ACPI PCI Hot-plug is enabled.
+     */
+    aml_append(if_ctx, aml_and(a_ctrl,
+        aml_int(0x1E | (enable_native_pcie_hotplug ? 0x1 : 0x0)), a_ctrl));
+
+    if_ctx2 = aml_if(aml_lnot(aml_equal(aml_arg(1), aml_int(1))));
+    /* Unknown revision */
+    aml_append(if_ctx2, aml_or(a_cwd1, aml_int(0x08), a_cwd1));
+    aml_append(if_ctx, if_ctx2);
+
+    if_ctx2 = aml_if(aml_lnot(aml_equal(aml_name("CDW3"), a_ctrl)));
+    /* Capabilities bits were masked */
+    aml_append(if_ctx2, aml_or(a_cwd1, aml_int(0x10), a_cwd1));
+    aml_append(if_ctx, if_ctx2);
+
+    /* Update DWORD3 in the buffer */
+    aml_append(if_ctx, aml_store(a_ctrl, aml_name("CDW3")));
+    aml_append(method, if_ctx);
+
+    else_ctx = aml_else();
+    /* Unrecognized UUID */
+    aml_append(else_ctx, aml_or(a_cwd1, aml_int(4), a_cwd1));
+    aml_append(method, else_ctx);
+
+    aml_append(method, aml_return(aml_arg(3)));
+    return method;
+}
diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
index 4f8572eebe..91945f716c 100644
--- a/hw/i386/acpi-build.c
+++ b/hw/i386/acpi-build.c
@@ -1111,56 +1111,6 @@ static Aml *build_q35_dram_controller(const AcpiMcfgInfo *mcfg)
     return dev;
 }
 
-static Aml *build_q35_osc_method(bool enable_native_pcie_hotplug)
-{
-    Aml *if_ctx;
-    Aml *if_ctx2;
-    Aml *else_ctx;
-    Aml *method;
-    Aml *a_cwd1 = aml_name("CDW1");
-    Aml *a_ctrl = aml_local(0);
-
-    method = aml_method("_OSC", 4, AML_NOTSERIALIZED);
-    aml_append(method, aml_create_dword_field(aml_arg(3), aml_int(0), "CDW1"));
-
-    if_ctx = aml_if(aml_equal(
-        aml_arg(0), aml_touuid("33DB4D5B-1FF7-401C-9657-7441C03DD766")));
-    aml_append(if_ctx, aml_create_dword_field(aml_arg(3), aml_int(4), "CDW2"));
-    aml_append(if_ctx, aml_create_dword_field(aml_arg(3), aml_int(8), "CDW3"));
-
-    aml_append(if_ctx, aml_store(aml_name("CDW3"), a_ctrl));
-
-    /*
-     * Always allow native PME, AER (no dependencies)
-     * Allow SHPC (PCI bridges can have SHPC controller)
-     * Disable PCIe Native Hot-plug if ACPI PCI Hot-plug is enabled.
-     */
-    aml_append(if_ctx, aml_and(a_ctrl,
-        aml_int(0x1E | (enable_native_pcie_hotplug ? 0x1 : 0x0)), a_ctrl));
-
-    if_ctx2 = aml_if(aml_lnot(aml_equal(aml_arg(1), aml_int(1))));
-    /* Unknown revision */
-    aml_append(if_ctx2, aml_or(a_cwd1, aml_int(0x08), a_cwd1));
-    aml_append(if_ctx, if_ctx2);
-
-    if_ctx2 = aml_if(aml_lnot(aml_equal(aml_name("CDW3"), a_ctrl)));
-    /* Capabilities bits were masked */
-    aml_append(if_ctx2, aml_or(a_cwd1, aml_int(0x10), a_cwd1));
-    aml_append(if_ctx, if_ctx2);
-
-    /* Update DWORD3 in the buffer */
-    aml_append(if_ctx, aml_store(a_ctrl, aml_name("CDW3")));
-    aml_append(method, if_ctx);
-
-    else_ctx = aml_else();
-    /* Unrecognized UUID */
-    aml_append(else_ctx, aml_or(a_cwd1, aml_int(4), a_cwd1));
-    aml_append(method, else_ctx);
-
-    aml_append(method, aml_return(aml_arg(3)));
-    return method;
-}
-
 static void build_acpi0017(Aml *table)
 {
     Aml *dev, *scope, *method;
@@ -1231,7 +1181,7 @@ build_dsdt(GArray *table_data, BIOSLinker *linker,
         aml_append(dev, aml_name_decl("_HID", aml_eisaid("PNP0A08")));
         aml_append(dev, aml_name_decl("_CID", aml_eisaid("PNP0A03")));
         aml_append(dev, aml_name_decl("_UID", aml_int(pcmc->pci_root_uid)));
-        aml_append(dev, build_q35_osc_method(!pm->pcihp_bridge_en));
+        aml_append(dev, build_pci_host_bridge_osc_method(!pm->pcihp_bridge_en));
         aml_append(dev, aml_pci_edsm());
         aml_append(sb_scope, dev);
         if (mcfg_valid) {
@@ -1353,7 +1303,7 @@ build_dsdt(GArray *table_data, BIOSLinker *linker,
                 aml_append(dev, aml_name_decl("_CID", aml_eisaid("PNP0A03")));
 
                 /* Expander bridges do not have ACPI PCI Hot-plug enabled */
-                aml_append(dev, build_q35_osc_method(true));
+                aml_append(dev, build_pci_host_bridge_osc_method(true));
             } else {
                 aml_append(dev, aml_name_decl("_HID", aml_eisaid("PNP0A03")));
             }
diff --git a/include/hw/acpi/pci.h b/include/hw/acpi/pci.h
index ab0187a894..8a328b580c 100644
--- a/include/hw/acpi/pci.h
+++ b/include/hw/acpi/pci.h
@@ -42,4 +42,6 @@ void build_pci_bridge_aml(AcpiDevAmlIf *adev, Aml *scope);
 
 void build_srat_generic_affinity_structures(GArray *table_data);
 
+Aml *build_pci_host_bridge_osc_method(bool enable_native_pcie_hotplug);
+
 #endif

From af151d50eac24604be19d0fc3bd6492979b0f399 Mon Sep 17 00:00:00 2001
From: Eric Auger <eric.auger@redhat.com>
Date: Mon, 14 Jul 2025 10:04:53 +0200
Subject: [PATCH 2394/2760] hw/pci-host/gpex-acpi: Use
 build_pci_host_bridge_osc_method

gpex build_host_bridge_osc() and x86 originated
build_pci_host_bridge_osc_method() are mostly identical.

In GPEX, SUPP is set to CDW2 but is not further used. CTRL
is same as Local0.

So let gpex code reuse build_pci_host_bridge_osc_method()
and remove build_host_bridge_osc().

Also add an imply ACPI_PCI clause along with
PCI_EXPRESS_GENERIC_BRIDGE to compile hw/acpi/pci.c
when its dependency is resolved (ie. CONFIG_ACPI_PCI).
This is requested to link qemu-system-mips64el.

The disassembled DSDT difference is given below:

  * Original Table Header:
  *     Signature        "DSDT"
- *     Length           0x00001A4F (6735)
+ *     Length           0x00001A35 (6709)
  *     Revision         0x02
- *     Checksum         0xBF
+ *     Checksum         0xDD
  *     OEM ID           "BOCHS "
  *     OEM Table ID     "BXPC    "
  *     OEM Revision     0x00000001 (1)
@@ -1849,27 +1849,26 @@ DefinitionBlock ("", "DSDT", 2, "BOCHS ", "BXPC    ", 0x00000001)
                 {
                     CreateDWordField (Arg3, 0x04, CDW2)
                     CreateDWordField (Arg3, 0x08, CDW3)
-                    SUPP = CDW2 /* \_SB_.PCI0._OSC.CDW2 */
-                    CTRL = CDW3 /* \_SB_.PCI0._OSC.CDW3 */
-                    CTRL &= 0x1F
+                    Local0 = CDW3 /* \_SB_.PCI0._OSC.CDW3 */
+                    Local0 &= 0x1F
                     If ((Arg1 != One))
                     {
                         CDW1 |= 0x08
                     }

-                    If ((CDW3 != CTRL))
+                    If ((CDW3 != Local0))
                     {
                         CDW1 |= 0x10
                     }

-                    CDW3 = CTRL /* \_SB_.PCI0.CTRL */
-                    Return (Arg3)
+                    CDW3 = Local0
                 }
                 Else
                 {
                     CDW1 |= 0x04
-                    Return (Arg3)
                 }
+
+                Return (Arg3)
             }

             Method (_DSM, 4, NotSerialized)  // _DSM: Device-Specific Method

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Message-Id: <20250714080639.2525563-10-eric.auger@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/pci-host/Kconfig     |  1 +
 hw/pci-host/gpex-acpi.c | 62 ++++-------------------------------------
 2 files changed, 6 insertions(+), 57 deletions(-)

diff --git a/hw/pci-host/Kconfig b/hw/pci-host/Kconfig
index 35c0415242..9824fa188d 100644
--- a/hw/pci-host/Kconfig
+++ b/hw/pci-host/Kconfig
@@ -54,6 +54,7 @@ config PCI_EXPRESS_Q35
 config PCI_EXPRESS_GENERIC_BRIDGE
     bool
     select PCI_EXPRESS
+    imply ACPI_PCI
 
 config PCI_EXPRESS_XILINX
     bool
diff --git a/hw/pci-host/gpex-acpi.c b/hw/pci-host/gpex-acpi.c
index 44737a8d81..952a0ace19 100644
--- a/hw/pci-host/gpex-acpi.c
+++ b/hw/pci-host/gpex-acpi.c
@@ -1,5 +1,6 @@
 #include "qemu/osdep.h"
 #include "hw/acpi/aml-build.h"
+#include "hw/acpi/pci.h"
 #include "hw/pci-host/gpex.h"
 #include "hw/arm/virt.h"
 #include "hw/pci/pci_bus.h"
@@ -50,61 +51,7 @@ static void acpi_dsdt_add_pci_route_table(Aml *dev, uint32_t irq,
     }
 }
 
-static Aml *build_host_bridge_osc(bool enable_native_pcie_hotplug)
-{
-    Aml *method, *UUID, *ifctx, *ifctx1, *elsectx;
-    method = aml_method("_OSC", 4, AML_NOTSERIALIZED);
-    aml_append(method, aml_name_decl("SUPP", aml_int(0)));
-    aml_append(method, aml_name_decl("CTRL", aml_int(0)));
-    aml_append(method,
-        aml_create_dword_field(aml_arg(3), aml_int(0), "CDW1"));
-
-    /* PCI Firmware Specification 3.0
-     * 4.5.1. _OSC Interface for PCI Host Bridge Devices
-     * The _OSC interface for a PCI/PCI-X/PCI Express hierarchy is
-     * identified by the Universal Unique IDentifier (UUID)
-     * 33DB4D5B-1FF7-401C-9657-7441C03DD766
-     */
-    UUID = aml_touuid("33DB4D5B-1FF7-401C-9657-7441C03DD766");
-    ifctx = aml_if(aml_equal(aml_arg(0), UUID));
-    aml_append(ifctx,
-        aml_create_dword_field(aml_arg(3), aml_int(4), "CDW2"));
-    aml_append(ifctx,
-        aml_create_dword_field(aml_arg(3), aml_int(8), "CDW3"));
-    aml_append(ifctx, aml_store(aml_name("CDW2"), aml_name("SUPP")));
-    aml_append(ifctx, aml_store(aml_name("CDW3"), aml_name("CTRL")));
-
-    /*
-     * Allow OS control for SHPCHotplug, PME, AER, PCIeCapability,
-     * and PCIeHotplug depending on enable_native_pcie_hotplug
-     */
-    aml_append(ifctx, aml_and(aml_name("CTRL"),
-               aml_int(0x1E | (enable_native_pcie_hotplug ? 0x1 : 0x0)),
-               aml_name("CTRL")));
-
-    ifctx1 = aml_if(aml_lnot(aml_equal(aml_arg(1), aml_int(0x1))));
-    aml_append(ifctx1, aml_or(aml_name("CDW1"), aml_int(0x08),
-                              aml_name("CDW1")));
-    aml_append(ifctx, ifctx1);
-
-    ifctx1 = aml_if(aml_lnot(aml_equal(aml_name("CDW3"), aml_name("CTRL"))));
-    aml_append(ifctx1, aml_or(aml_name("CDW1"), aml_int(0x10),
-                              aml_name("CDW1")));
-    aml_append(ifctx, ifctx1);
-
-    aml_append(ifctx, aml_store(aml_name("CTRL"), aml_name("CDW3")));
-    aml_append(ifctx, aml_return(aml_arg(3)));
-    aml_append(method, ifctx);
-
-    elsectx = aml_else();
-    aml_append(elsectx, aml_or(aml_name("CDW1"), aml_int(4),
-                               aml_name("CDW1")));
-    aml_append(elsectx, aml_return(aml_arg(3)));
-    aml_append(method, elsectx);
-    return method;
-}
-
-static Aml *build_host_bridge_dsm(void)
+static Aml *build_pci_host_bridge_dsm_method(void)
 {
     Aml *method = aml_method("_DSM", 4, AML_NOTSERIALIZED);
     Aml *UUID, *ifctx, *ifctx1, *buf;
@@ -133,8 +80,9 @@ static void acpi_dsdt_add_host_bridge_methods(Aml *dev,
                                               bool enable_native_pcie_hotplug)
 {
     /* Declare an _OSC (OS Control Handoff) method */
-    aml_append(dev, build_host_bridge_osc(enable_native_pcie_hotplug));
-    aml_append(dev, build_host_bridge_dsm());
+    aml_append(dev,
+               build_pci_host_bridge_osc_method(enable_native_pcie_hotplug));
+    aml_append(dev, build_pci_host_bridge_dsm_method());
 }
 
 void acpi_dsdt_add_gpex(Aml *scope, struct GPEXConfig *cfg)

From f47d6e6a8f69c8890207d3f771e079700418f7a6 Mon Sep 17 00:00:00 2001
From: "Michael S. Tsirkin" <mst@redhat.com>
Date: Mon, 14 Jul 2025 17:49:03 -0400
Subject: [PATCH 2395/2760] tests/qtest/bios-tables-test: Update DSDT blobs
 after GPEX _OSC change

Update the reference DSDT blobs after GPEX _OSC change. The _OSC change
affects the aarch64 'virt' and the x86 'microvm' machines.

DSDT diff is the same for all the machines/tests:

  * Original Table Header:
  *     Signature        "DSDT"
- *     Length           0x00001A4F (6735)
+ *     Length           0x00001A35 (6709)
  *     Revision         0x02
- *     Checksum         0xBF
+ *     Checksum         0xDD
  *     OEM ID           "BOCHS "
  *     OEM Table ID     "BXPC    "
  *     OEM Revision     0x00000001 (1)
@@ -1849,27 +1849,26 @@ DefinitionBlock ("", "DSDT", 2, "BOCHS ", "BXPC    ", 0x00000001)
                 {
                     CreateDWordField (Arg3, 0x04, CDW2)
                     CreateDWordField (Arg3, 0x08, CDW3)
-                    SUPP = CDW2 /* \_SB_.PCI0._OSC.CDW2 */
-                    CTRL = CDW3 /* \_SB_.PCI0._OSC.CDW3 */
-                    CTRL &= 0x1F
+                    Local0 = CDW3 /* \_SB_.PCI0._OSC.CDW3 */
+                    Local0 &= 0x1F
                     If ((Arg1 != One))
                     {
                         CDW1 |= 0x08
                     }

-                    If ((CDW3 != CTRL))
+                    If ((CDW3 != Local0))
                     {
                         CDW1 |= 0x10
                     }

-                    CDW3 = CTRL /* \_SB_.PCI0.CTRL */
-                    Return (Arg3)
+                    CDW3 = Local0
                 }
                 Else
                 {
                     CDW1 |= 0x04
-                    Return (Arg3)
                 }
+
+                Return (Arg3)
             }

             Method (_DSM, 4, NotSerialized)  // _DSM: Device-Specific Method

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Gustavo Romero <gustavo.romero@linaro.org>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Message-Id: <20250714080639.2525563-11-eric.auger@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 tests/data/acpi/aarch64/virt/DSDT             | Bin 5196 -> 5158 bytes
 .../data/acpi/aarch64/virt/DSDT.acpihmatvirt  | Bin 5282 -> 5244 bytes
 tests/data/acpi/aarch64/virt/DSDT.memhp       | Bin 6557 -> 6519 bytes
 tests/data/acpi/aarch64/virt/DSDT.pxb         | Bin 7679 -> 7603 bytes
 tests/data/acpi/aarch64/virt/DSDT.topology    | Bin 5398 -> 5360 bytes
 tests/data/acpi/loongarch64/virt/DSDT         | Bin 4641 -> 4603 bytes
 tests/data/acpi/loongarch64/virt/DSDT.memhp   | Bin 5862 -> 5824 bytes
 tests/data/acpi/loongarch64/virt/DSDT.numamem | Bin 4647 -> 4609 bytes
 .../data/acpi/loongarch64/virt/DSDT.topology  | Bin 4943 -> 4905 bytes
 tests/data/acpi/riscv64/virt/DSDT             | Bin 3576 -> 3538 bytes
 tests/data/acpi/x86/microvm/DSDT.pcie         | Bin 3023 -> 2985 bytes
 tests/qtest/bios-tables-test-allowed-diff.h   |  11 -----------
 12 files changed, 11 deletions(-)

diff --git a/tests/data/acpi/aarch64/virt/DSDT b/tests/data/acpi/aarch64/virt/DSDT
index 36d3e5d5a5e47359b6dcb3706f98b4f225677591..acab6e65febbc210158d4c39be0680bbb90250f5 100644
GIT binary patch
delta 114
zcmX@3u}p)@CD<iIO@x7g>C8kfX{JVpjp}Y(OkR^V=X2?C2#NTx$NL96vvg%MIJ<-!
zF7RWWyjw`i#5kckflEGNfxx86nT)j{87>YGxj=Z*WM`Lf;{=G907$GL0VJ}JXS1=e
GBqIPCb06IR

delta 152
zcmZ3caYlp7CD<jzM}&caNqQoeG*i3NMs+tXCWon;^SSgm<T!#u0|FR0oI`?q7)0DS
z<Nbr3S-P?roL#~V7kIEwUN5BOX9QAG;Or7^3{q7MBDmy1<N|?7lQS7>L29`;K;#0k
bNt0pfAi@G5;R29ikoc19g?yWNg(VpQ5Tq&5

diff --git a/tests/data/acpi/aarch64/virt/DSDT.acpihmatvirt b/tests/data/acpi/aarch64/virt/DSDT.acpihmatvirt
index e6154d0355f84fdcc51387b4db8f9ee63acae4e9..54c27e7d95b4956ed1b5dee0d299ccb08dc2a73e 100644
GIT binary patch
delta 114
zcmZ3a`A37xCD<jTMudTZsdFNiG*i3lM)f&dOkR^VALY{H5EAiWkM|FDX6ediaCQkd
zT;Rt#Sx{KZ#5kckflEGNfxx86nT)j{87>YGxj=Z*WM`Lf;{=G907$GL0VJ}JXLF~p
GBqIP%EFggZ

delta 152
zcmeyPu}G84CD<iokq83=(~XH-(oDVX8`bA<F*!`#e3VO%LyjXjG$4S1!#O0#he5=R
zGu}VgnWZb6!PzC;aDfN=WL9A<KO>Nm0%w<SW00z95Wyu6A{Piunw-g43sTF)0U{TO
cO_~f-2N4zk2^WAAgT$9)FXY>tEG)?g0OQ*$bpQYW

diff --git a/tests/data/acpi/aarch64/virt/DSDT.memhp b/tests/data/acpi/aarch64/virt/DSDT.memhp
index 33f011d6b635035a04c0b39ce9b4e219f7ae74b7..4330bc97cba0950191c45ac833533db7a190db81 100644
GIT binary patch
delta 114
zcmbPh{N0GlCD<jTT#|u->Fq==X{M&B8`a&on7k%!&gatO5EAiWkM|FDX6ediaCQkd
zT;Rt#dAE?3iE%=80+)Qk0)a`BGZ||^GF%)Wa)I!q$<8j}#t9HH0gzZh0!U;b&t_xc
GEH(gwhaoor

delta 152
zcmexvG}oBRCD<iot|S8klg&gfX{L_p8`a&om>i~V&gatOkmCpr4G3W1a1IIbVGwcS
zjQ0<AX6ediaCQkdT;RbzdA*R9pAkq&fwN1vF-TQ4h~Sb3kqZPSP0nPj1*zrY0FevC
cCQXK^g9r<NgbP55LE=lY7xHc970zM<0H97QD*ylh

diff --git a/tests/data/acpi/aarch64/virt/DSDT.pxb b/tests/data/acpi/aarch64/virt/DSDT.pxb
index c0fdc6e9c1396cc2259dc4bc665ba023adcf4c9b..7fdbc03e2bf9fb7d35704779253de36e362f0bf9 100644
GIT binary patch
delta 207
zcmexwz1f<}CD<iovn&Gx)9r~|(oB6fHmbXEG5NM`&ga^|E+pc^9`7IQ%+i(3;Or7^
zxWJEfa-NKqiE%=80+)Qk0)a`BGZ||^GF%)Wa)I!q$<8j}#t9HH0gzZh0!U;b&*Wz^
bwwpf*=`k{SP1>v^qQ^l^!#6*Zkz@n_W$r!H

delta 282
zcmdmN{ok6)CD<k8zbpd-Q^!OuX{N5b8`a&on4CK{=W}gfm*WTy4G3W1a1IIbVGwcS
zjQ0<AX6ediaCQkdT;Rbz*-%K!&j_TXz}Y3-7^JEiL~zN2$OQtECTB9%g4A+xfXD@6
vlP1H|L4*ZB!UZ73An_&H3;8zp3uQAhIZWOBM_7-8{?<?K7qXpvUFHq|QWjHp

diff --git a/tests/data/acpi/aarch64/virt/DSDT.topology b/tests/data/acpi/aarch64/virt/DSDT.topology
index 029d03eecc4efddc001e5377e85ac8e831294362..969b4f6560d3ae39f5b7e0064b7122905476fce8 100644
GIT binary patch
delta 114
zcmbQH^+A)%CD<k8g9rly)24}B(oEex8`TB4nY<=#w&d315EAiWkM|FDX6ediaCQkd
zT;Rt#xm8%p#5kckflEGNfxx86nT)j{87>YGxj=Z*WM`Lf;{=G907$GL0VJ}JXY*fS
GNk#xh{2=83

delta 152
zcmeyMIZcbpCD<iIOq79viGL!OG*hGhMs)#hCWon;ExGkL<T!#u0|FR0oI`?q7)0DS
z<Nbr3S-P?roL#~V7kIEwt`yetGXg0oaCQkd2C1qB5nS>ha)H34$(f9`Ahlc^Aaa4&
bq{%RK5Mcq3Z~;g$NPJ25LcYz{g(VpQyBaCk

diff --git a/tests/data/acpi/loongarch64/virt/DSDT b/tests/data/acpi/loongarch64/virt/DSDT
index f32e732b11a557ae01c7f383625d3b6f459ac9f7..b31841aec6ed296f10ea1695a67ead38f45424d5 100644
GIT binary patch
delta 108
zcmZ3e@>`k9CD<k8w;%%pW9&w*JIqWz6E?qK7T^#P@nMhm4|Znh%4TqO2{&Be$2wVz
zN6W-Gp*n#}E@6Sdq{*3#wICTT4iLFOc+zBNmvG|*h?oFKtRMj-vXEzUAJ1e~0LOD5
A(*OVf

delta 146
zcmeyZyikS9CD<iIQHX(oannYwJIqW@lQ+L$7T}QM2o4PhVBl~L3G!hOapR2l4|Znh
z%4TqO2{&Be!9JObN6XI$q@=*vCEOUKsv1Oa$%DuR0+S|ZGS-6Ba&dsj1!9vX!_+~9
W1wg_DAjKf@CD{x4HfQimW(5GG6e-65

diff --git a/tests/data/acpi/loongarch64/virt/DSDT.memhp b/tests/data/acpi/loongarch64/virt/DSDT.memhp
index f19eae7d00f9c0eefc9e92de2c8a24863bf309d6..e291200fc91caa3d93dcd6ec4736f7340f5e3f65 100644
GIT binary patch
delta 108
zcmaE+dq9`VCD<k8fEWV<W70;hJIqWz6E?qK7T^#P@nMhm4|Znh%4TqO2{&Be$2wVz
zN6W-Gp*n#}E@6Sdq{*3#wICTT4iLFOc+zBNmvG|*h?oFKtRMj-vXEzUA5R1q0Kj}7
Ai2wiq

delta 146
zcmX@0`%IV1CD<k8nHU2D<BpA7cbJ)+CU1VhEWjbh5gZy2z`)@g66C`m;>H>8AMDK1
zmCfMn5^lJ_gMBg=kCvYiNJ)XSOSmyeRW*p<k_V9s1SU<+WUK|L<>CO53&bW(hN*)H
W3xI?RK#D=)OR^X8ZO-6{-~s?5GAexl

diff --git a/tests/data/acpi/loongarch64/virt/DSDT.numamem b/tests/data/acpi/loongarch64/virt/DSDT.numamem
index 9b462869cd4911714e7c2a22025c465afa2a7d52..07923ac39584c5a5e73c9556d251814ce10de6cc 100644
GIT binary patch
delta 108
zcmZ3k(x}4a66_MfD8#_P_+lg19cCt<37cOq3vdXD_^`+O2RpNLWivRtgc~mKW1TF<
zqh(^8P@TXfm#{!!(&S9WT96DE2Z&rCJZZACOSo|YL`(oAR*(P^S;(`wk7p(;0BWip
A_y7O^

delta 146
zcmZovS+2t666_M9F2umVXt$B;4l|R}<jpUb1vun5f<prW7&x3mf_xZ6+&JU?gPmEr
zvKgFR!VMRAuutaV(eg6_DJgJv2{#6*ss<5U@*r}7z@*8UjI|)OTpS>Bf!L(UFm(`N
V0g!M3NHIu!N%lg%%^5s1Spg~IDC__L

diff --git a/tests/data/acpi/loongarch64/virt/DSDT.topology b/tests/data/acpi/loongarch64/virt/DSDT.topology
index 65111aa822663a907b83487cb496be38a4bdff05..6dfbb495f88b74b87849b58473e46717bc588a56 100644
GIT binary patch
delta 108
zcmX@Fwo;ADCD<iIQ<#B)@xn%~JIqWz6E?qK7T^#P@nMhm4|Znh%4TqO2{&Be$2wVz
zN6W-Gp*n#}E@6Sdq{*3#wICTT4iLFOc+zBNmvG|*h?oFKtRMj-vXEzUAJ0KH0F@md
Ah5!Hn

delta 146
zcmZ3fc3zFkCD<jzUzmY`QEemF9cCt{$(vs=3vkGB1cwF$FmO1B1o<$CxN*k&2RpNL
zWivRtgc~mKV4uvzqvdA=Qc~dT5^fAqRShDz<U!;Dfk~4y8EZjmxi~=N0<lSxVd@~l
W0wCc6kYbSdlI(?in=^P0vH<{NR4IA@

diff --git a/tests/data/acpi/riscv64/virt/DSDT b/tests/data/acpi/riscv64/virt/DSDT
index 6a33f5647ddd6de3a0f000f718b58f6fff44f0fd..527f239dab13a00ad42e5a70b8dc2b89f12aa84a 100644
GIT binary patch
delta 113
zcmew%eMy?jCD<k85-$S-lgdOcX(r!W8`WD`nA|39UdN)vAtd6%9`7IQ%+i(3;Or7^
zxWJEf@;4qW6XS&H1TMLR1p<>MXEN4;WVkp$<O1PIlbv0{jT0bZ0wA%11dzx=p2>N<
FT>x#oA)x>O

delta 151
zcmca4{X?3|CD<k82QLEyQ_(~&X(s2p8`WD`n0%&eUdN)vA;%FM8W6z1;T#g=!yw|u
z8SfwL%+i(3;Or7^xWI#b@+%%KKO>Nm0%w<SW00z95Wyu6A{Piunw-g43sTF)0U{TO
bO_~f-2N4zk2^WAAgT$9)FXWr-!P^A@4^1qU

diff --git a/tests/data/acpi/x86/microvm/DSDT.pcie b/tests/data/acpi/x86/microvm/DSDT.pcie
index 8eacd21d6ecdf9a3cd3e4f03cf1b40748dcbf53e..ba258f454dc0e59ef2fd67e0ce37e270e7c122e8 100644
GIT binary patch
delta 113
zcmX>vzEYgaCD<ioB{u^D)Axy7(oD|VH>#&HG5Ji`+{YxqAtd6%9`7IQ%+i(3;Or7^
zxWJEf@*XZN6XS&H1TMLR1p<>MXEN4;WVkp$<O1PIlbv0{jT0bZ0wA%11dzx=p2;TM
FvjItGAprmY

delta 151
zcmZ1}eqNl*CD<k8JU0Ualj}q-X(rE|8`V>pn4BhW?qd?*kmCpr4G3W1a1IIbVGwcS
zjQ0<AX6ediaCQkdT;Rbzc>|Z0pAkq&fwN1vF-TQ4h~Sb3kqZPSP0nPj1*zrY0FevC
bCQXK^g9r<NgbP55LE=lY7xGQ!<DLxwQ^YFu

diff --git a/tests/qtest/bios-tables-test-allowed-diff.h b/tests/qtest/bios-tables-test-allowed-diff.h
index 8d9673cb5d..dfb8523c8b 100644
--- a/tests/qtest/bios-tables-test-allowed-diff.h
+++ b/tests/qtest/bios-tables-test-allowed-diff.h
@@ -1,12 +1 @@
 /* List of comma-separated changed AML files to ignore */
-"tests/data/acpi/aarch64/virt/DSDT",
-"tests/data/acpi/aarch64/virt/DSDT.acpihmatvirt",
-"tests/data/acpi/aarch64/virt/DSDT.memhp",
-"tests/data/acpi/aarch64/virt/DSDT.pxb",
-"tests/data/acpi/aarch64/virt/DSDT.topology",
-"tests/data/acpi/loongarch64/virt/DSDT.memhp",
-"tests/data/acpi/loongarch64/virt/DSDT.topology",
-"tests/data/acpi/loongarch64/virt/DSDT.numamem",
-"tests/data/acpi/loongarch64/virt/DSDT",
-"tests/data/acpi/x86/microvm/DSDT.pcie",
-"tests/data/acpi/riscv64/virt/DSDT",

From c5dee204b0ae45c92b1a9640055ec068c6748b3c Mon Sep 17 00:00:00 2001
From: Eric Auger <eric.auger@redhat.com>
Date: Mon, 14 Jul 2025 10:04:55 +0200
Subject: [PATCH 2396/2760] hw/i386/acpi-build: Introduce
 build_append_pcihp_resources() helper

Extract the code that reserves resources for ACPI PCI hotplug
into a new helper named build_append_pcihp_resources() and
move it to pcihp.c. We will reuse it on ARM.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Gustavo Romero <gustavo.romero@linaro.org>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Message-Id: <20250714080639.2525563-12-eric.auger@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/acpi/pcihp.c         | 18 ++++++++++++++++++
 hw/i386/acpi-build.c    | 15 ++-------------
 include/hw/acpi/pcihp.h |  2 ++
 3 files changed, 22 insertions(+), 13 deletions(-)

diff --git a/hw/acpi/pcihp.c b/hw/acpi/pcihp.c
index cbe7e01385..5ca36c8619 100644
--- a/hw/acpi/pcihp.c
+++ b/hw/acpi/pcihp.c
@@ -685,6 +685,24 @@ void build_acpi_pci_hotplug(Aml *table, uint64_t pcihp_addr)
     aml_append(table, scope);
 }
 
+/* Reserve PCIHP resources */
+void build_append_pcihp_resources(Aml *scope /* \\_SB.PCI0 */,
+                                  uint64_t io_addr, uint64_t io_len)
+{
+    Aml *dev, *crs;
+
+    dev = aml_device("PHPR");
+    aml_append(dev, aml_name_decl("_HID", aml_string("PNP0A06")));
+    aml_append(dev,
+               aml_name_decl("_UID", aml_string("PCI Hotplug resources")));
+    /* device present, functioning, decoding, not shown in UI */
+    aml_append(dev, aml_name_decl("_STA", aml_int(0xB)));
+    crs = aml_resource_template();
+    aml_append(crs, aml_io(AML_DECODE16, io_addr, io_addr, 1, io_len));
+    aml_append(dev, aml_name_decl("_CRS", crs));
+    aml_append(scope, dev);
+}
+
 const VMStateDescription vmstate_acpi_pcihp_pci_status = {
     .name = "acpi_pcihp_pci_status",
     .version_id = 1,
diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
index 91945f716c..52cef834ed 100644
--- a/hw/i386/acpi-build.c
+++ b/hw/i386/acpi-build.c
@@ -1432,19 +1432,8 @@ build_dsdt(GArray *table_data, BIOSLinker *linker,
 
     /* reserve PCIHP resources */
     if (pm->pcihp_io_len && (pm->pcihp_bridge_en || pm->pcihp_root_en)) {
-        dev = aml_device("PHPR");
-        aml_append(dev, aml_name_decl("_HID", aml_string("PNP0A06")));
-        aml_append(dev,
-            aml_name_decl("_UID", aml_string("PCI Hotplug resources")));
-        /* device present, functioning, decoding, not shown in UI */
-        aml_append(dev, aml_name_decl("_STA", aml_int(0xB)));
-        crs = aml_resource_template();
-        aml_append(crs,
-            aml_io(AML_DECODE16, pm->pcihp_io_base, pm->pcihp_io_base, 1,
-                   pm->pcihp_io_len)
-        );
-        aml_append(dev, aml_name_decl("_CRS", crs));
-        aml_append(scope, dev);
+        build_append_pcihp_resources(scope,
+                                      pm->pcihp_io_base, pm->pcihp_io_len);
     }
     aml_append(dsdt, scope);
 
diff --git a/include/hw/acpi/pcihp.h b/include/hw/acpi/pcihp.h
index 971451e8ea..8a46a414cc 100644
--- a/include/hw/acpi/pcihp.h
+++ b/include/hw/acpi/pcihp.h
@@ -75,6 +75,8 @@ void acpi_pcihp_device_unplug_request_cb(HotplugHandler *hotplug_dev,
 
 void build_acpi_pci_hotplug(Aml *table, uint64_t pcihp_addr);
 void build_append_pci_dsm_func0_common(Aml *ctx, Aml *retvar);
+void build_append_pcihp_resources(Aml *table,
+                                  uint64_t io_addr, uint64_t io_len);
 
 /* Called on reset */
 void acpi_pcihp_reset(AcpiPciHpState *s);

From b412e0557c03b9aac946133a443a76aa86c3f8b4 Mon Sep 17 00:00:00 2001
From: Eric Auger <eric.auger@redhat.com>
Date: Mon, 14 Jul 2025 10:04:56 +0200
Subject: [PATCH 2397/2760] hw/acpi/pcihp: Add an AmlRegionSpace arg to
 build_acpi_pci_hotplug

On ARM we will put the operation regions in AML_SYSTEM_MEMORY.
So let's allow this configuration.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Gustavo Romero <gustavo.romero@linaro.org>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Message-Id: <20250714080639.2525563-13-eric.auger@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/acpi/pcihp.c         | 8 ++++----
 hw/i386/acpi-build.c    | 4 ++--
 include/hw/acpi/pcihp.h | 3 ++-
 3 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/hw/acpi/pcihp.c b/hw/acpi/pcihp.c
index 5ca36c8619..afa3ec5f4d 100644
--- a/hw/acpi/pcihp.c
+++ b/hw/acpi/pcihp.c
@@ -629,7 +629,7 @@ static Aml *aml_pci_pdsm(void)
     return method;
 }
 
-void build_acpi_pci_hotplug(Aml *table, uint64_t pcihp_addr)
+void build_acpi_pci_hotplug(Aml *table, AmlRegionSpace rs, uint64_t pcihp_addr)
 {
     Aml *scope;
     Aml *field;
@@ -638,21 +638,21 @@ void build_acpi_pci_hotplug(Aml *table, uint64_t pcihp_addr)
     scope =  aml_scope("_SB.PCI0");
 
     aml_append(scope,
-        aml_operation_region("PCST", AML_SYSTEM_IO, aml_int(pcihp_addr), 0x08));
+        aml_operation_region("PCST", rs, aml_int(pcihp_addr), 0x08));
     field = aml_field("PCST", AML_DWORD_ACC, AML_NOLOCK, AML_WRITE_AS_ZEROS);
     aml_append(field, aml_named_field("PCIU", 32));
     aml_append(field, aml_named_field("PCID", 32));
     aml_append(scope, field);
 
     aml_append(scope,
-        aml_operation_region("SEJ", AML_SYSTEM_IO,
+        aml_operation_region("SEJ", rs,
                              aml_int(pcihp_addr + ACPI_PCIHP_SEJ_BASE), 0x04));
     field = aml_field("SEJ", AML_DWORD_ACC, AML_NOLOCK, AML_WRITE_AS_ZEROS);
     aml_append(field, aml_named_field("B0EJ", 32));
     aml_append(scope, field);
 
     aml_append(scope,
-        aml_operation_region("BNMR", AML_SYSTEM_IO,
+        aml_operation_region("BNMR", rs,
                              aml_int(pcihp_addr + ACPI_PCIHP_BNMR_BASE), 0x08));
     field = aml_field("BNMR", AML_DWORD_ACC, AML_NOLOCK, AML_WRITE_AS_ZEROS);
     aml_append(field, aml_named_field("BNUM", 32));
diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
index 52cef834ed..6ca2b34ef8 100644
--- a/hw/i386/acpi-build.c
+++ b/hw/i386/acpi-build.c
@@ -1172,7 +1172,7 @@ build_dsdt(GArray *table_data, BIOSLinker *linker,
         aml_append(dsdt, sb_scope);
 
         if (pm->pcihp_bridge_en || pm->pcihp_root_en) {
-            build_acpi_pci_hotplug(dsdt, pm->pcihp_io_base);
+            build_acpi_pci_hotplug(dsdt, AML_SYSTEM_IO, pm->pcihp_io_base);
         }
         build_piix4_pci0_int(dsdt);
     } else if (q35) {
@@ -1216,7 +1216,7 @@ build_dsdt(GArray *table_data, BIOSLinker *linker,
         aml_append(dsdt, sb_scope);
 
         if (pm->pcihp_bridge_en) {
-            build_acpi_pci_hotplug(dsdt, pm->pcihp_io_base);
+            build_acpi_pci_hotplug(dsdt, AML_SYSTEM_IO, pm->pcihp_io_base);
         }
         build_q35_pci0_int(dsdt);
     }
diff --git a/include/hw/acpi/pcihp.h b/include/hw/acpi/pcihp.h
index 8a46a414cc..253ac6e483 100644
--- a/include/hw/acpi/pcihp.h
+++ b/include/hw/acpi/pcihp.h
@@ -28,6 +28,7 @@
 #define HW_ACPI_PCIHP_H
 
 #include "hw/acpi/acpi.h"
+#include "hw/acpi/aml-build.h"
 #include "hw/hotplug.h"
 
 #define ACPI_PCIHP_IO_BASE_PROP "acpi-pcihp-io-base"
@@ -73,7 +74,7 @@ void acpi_pcihp_device_unplug_request_cb(HotplugHandler *hotplug_dev,
                                          AcpiPciHpState *s, DeviceState *dev,
                                          Error **errp);
 
-void build_acpi_pci_hotplug(Aml *table, uint64_t pcihp_addr);
+void build_acpi_pci_hotplug(Aml *table, AmlRegionSpace rs, uint64_t pcihp_addr);
 void build_append_pci_dsm_func0_common(Aml *ctx, Aml *retvar);
 void build_append_pcihp_resources(Aml *table,
                                   uint64_t io_addr, uint64_t io_len);

From d962f199c7e8625c91e8d1cc54a0323180e6f3e1 Mon Sep 17 00:00:00 2001
From: Eric Auger <eric.auger@redhat.com>
Date: Mon, 14 Jul 2025 10:04:57 +0200
Subject: [PATCH 2398/2760] hw/i386/acpi-build: Move
 build_append_notification_callback to pcihp

We plan to reuse build_append_notification_callback() on ARM
so let's move it to pcihp.c.

No functional change intended.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Gustavo Romero <gustavo.romero@linaro.org>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Message-Id: <20250714080639.2525563-14-eric.auger@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/acpi/pcihp.c         | 58 +++++++++++++++++++++++++++++++++++++++++
 hw/i386/acpi-build.c    | 58 -----------------------------------------
 include/hw/acpi/pcihp.h |  1 +
 3 files changed, 59 insertions(+), 58 deletions(-)

diff --git a/hw/acpi/pcihp.c b/hw/acpi/pcihp.c
index afa3ec5f4d..b64d06afc9 100644
--- a/hw/acpi/pcihp.c
+++ b/hw/acpi/pcihp.c
@@ -39,6 +39,7 @@
 #include "migration/vmstate.h"
 #include "qapi/error.h"
 #include "qom/qom-qobject.h"
+#include "qobject/qnum.h"
 #include "trace.h"
 
 #define ACPI_PCIHP_SIZE 0x0018
@@ -703,6 +704,63 @@ void build_append_pcihp_resources(Aml *scope /* \\_SB.PCI0 */,
     aml_append(scope, dev);
 }
 
+bool build_append_notification_callback(Aml *parent_scope, const PCIBus *bus)
+{
+    Aml *method;
+    PCIBus *sec;
+    QObject *bsel;
+    int nr_notifiers = 0;
+    GQueue *pcnt_bus_list = g_queue_new();
+
+    QLIST_FOREACH(sec, &bus->child, sibling) {
+        Aml *br_scope = aml_scope("S%.02X", sec->parent_dev->devfn);
+        if (pci_bus_is_root(sec)) {
+            continue;
+        }
+        nr_notifiers = nr_notifiers +
+                       build_append_notification_callback(br_scope, sec);
+        /*
+         * add new child scope to parent
+         * and keep track of bus that have PCNT,
+         * bus list is used later to call children PCNTs from this level PCNT
+         */
+        if (nr_notifiers) {
+            g_queue_push_tail(pcnt_bus_list, sec);
+            aml_append(parent_scope, br_scope);
+        }
+    }
+
+    /*
+     * Append PCNT method to notify about events on local and child buses.
+     * ps: hostbridge might not have hotplug (bsel) enabled but might have
+     * child bridges that do have bsel.
+     */
+    method = aml_method("PCNT", 0, AML_NOTSERIALIZED);
+
+    /* If bus supports hotplug select it and notify about local events */
+    bsel = object_property_get_qobject(OBJECT(bus), ACPI_PCIHP_PROP_BSEL, NULL);
+    if (bsel) {
+        uint64_t bsel_val = qnum_get_uint(qobject_to(QNum, bsel));
+
+        aml_append(method, aml_store(aml_int(bsel_val), aml_name("BNUM")));
+        aml_append(method, aml_call2("DVNT", aml_name("PCIU"),
+                                     aml_int(1))); /* Device Check */
+        aml_append(method, aml_call2("DVNT", aml_name("PCID"),
+                                     aml_int(3))); /* Eject Request */
+        nr_notifiers++;
+    }
+
+    /* Notify about child bus events in any case */
+    while ((sec = g_queue_pop_head(pcnt_bus_list))) {
+        aml_append(method, aml_name("^S%.02X.PCNT", sec->parent_dev->devfn));
+    }
+
+    aml_append(parent_scope, method);
+    qobject_unref(bsel);
+    g_queue_free(pcnt_bus_list);
+    return !!nr_notifiers;
+}
+
 const VMStateDescription vmstate_acpi_pcihp_pci_status = {
     .name = "acpi_pcihp_pci_status",
     .version_id = 1,
diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
index 6ca2b34ef8..3275675e60 100644
--- a/hw/i386/acpi-build.c
+++ b/hw/i386/acpi-build.c
@@ -563,64 +563,6 @@ void build_append_pci_bus_devices(Aml *parent_scope, PCIBus *bus)
     }
 }
 
-static bool build_append_notification_callback(Aml *parent_scope,
-                                               const PCIBus *bus)
-{
-    Aml *method;
-    PCIBus *sec;
-    QObject *bsel;
-    int nr_notifiers = 0;
-    GQueue *pcnt_bus_list = g_queue_new();
-
-    QLIST_FOREACH(sec, &bus->child, sibling) {
-        Aml *br_scope = aml_scope("S%.02X", sec->parent_dev->devfn);
-        if (pci_bus_is_root(sec)) {
-            continue;
-        }
-        nr_notifiers = nr_notifiers +
-                       build_append_notification_callback(br_scope, sec);
-        /*
-         * add new child scope to parent
-         * and keep track of bus that have PCNT,
-         * bus list is used later to call children PCNTs from this level PCNT
-         */
-        if (nr_notifiers) {
-            g_queue_push_tail(pcnt_bus_list, sec);
-            aml_append(parent_scope, br_scope);
-        }
-    }
-
-    /*
-     * Append PCNT method to notify about events on local and child buses.
-     * ps: hostbridge might not have hotplug (bsel) enabled but might have
-     * child bridges that do have bsel.
-     */
-    method = aml_method("PCNT", 0, AML_NOTSERIALIZED);
-
-    /* If bus supports hotplug select it and notify about local events */
-    bsel = object_property_get_qobject(OBJECT(bus), ACPI_PCIHP_PROP_BSEL, NULL);
-    if (bsel) {
-        uint64_t bsel_val = qnum_get_uint(qobject_to(QNum, bsel));
-
-        aml_append(method, aml_store(aml_int(bsel_val), aml_name("BNUM")));
-        aml_append(method, aml_call2("DVNT", aml_name("PCIU"),
-                                     aml_int(1))); /* Device Check */
-        aml_append(method, aml_call2("DVNT", aml_name("PCID"),
-                                     aml_int(3))); /* Eject Request */
-        nr_notifiers++;
-    }
-
-    /* Notify about child bus events in any case */
-    while ((sec = g_queue_pop_head(pcnt_bus_list))) {
-        aml_append(method, aml_name("^S%.02X.PCNT", sec->parent_dev->devfn));
-    }
-
-    aml_append(parent_scope, method);
-    qobject_unref(bsel);
-    g_queue_free(pcnt_bus_list);
-    return !!nr_notifiers;
-}
-
 /*
  * build_prt - Define interrupt routing rules
  *
diff --git a/include/hw/acpi/pcihp.h b/include/hw/acpi/pcihp.h
index 253ac6e483..f4fd44cb32 100644
--- a/include/hw/acpi/pcihp.h
+++ b/include/hw/acpi/pcihp.h
@@ -78,6 +78,7 @@ void build_acpi_pci_hotplug(Aml *table, AmlRegionSpace rs, uint64_t pcihp_addr);
 void build_append_pci_dsm_func0_common(Aml *ctx, Aml *retvar);
 void build_append_pcihp_resources(Aml *table,
                                   uint64_t io_addr, uint64_t io_len);
+bool build_append_notification_callback(Aml *parent_scope, const PCIBus *bus);
 
 /* Called on reset */
 void acpi_pcihp_reset(AcpiPciHpState *s);

From e87ab64e8f614ae8702209dd801ac08ca5897ff1 Mon Sep 17 00:00:00 2001
From: Eric Auger <eric.auger@redhat.com>
Date: Mon, 14 Jul 2025 10:04:58 +0200
Subject: [PATCH 2399/2760] hw/i386/acpi-build: Move
 build_append_pci_bus_devices/pcihp_slots to pcihp

We intend to reuse build_append_pci_bus_devices and build_append_pcihp_slots
on ARM. So let's move them to hw/acpi/pcihp.c as well as all static
helpers they use.

No functional change intended.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Gustavo Romero <gustavo.romero@linaro.org>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Message-Id: <20250714080639.2525563-15-eric.auger@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/acpi/pcihp.c         | 173 ++++++++++++++++++++++++++++++++++++++++
 hw/i386/acpi-build.c    | 172 ---------------------------------------
 include/hw/acpi/pci.h   |   1 -
 include/hw/acpi/pcihp.h |   2 +
 4 files changed, 175 insertions(+), 173 deletions(-)

diff --git a/hw/acpi/pcihp.c b/hw/acpi/pcihp.c
index b64d06afc9..2c76edeb15 100644
--- a/hw/acpi/pcihp.c
+++ b/hw/acpi/pcihp.c
@@ -27,6 +27,7 @@
 #include "qemu/osdep.h"
 #include "hw/acpi/pcihp.h"
 #include "hw/acpi/aml-build.h"
+#include "hw/acpi/acpi_aml_interface.h"
 #include "hw/pci-host/i440fx.h"
 #include "hw/pci/pci.h"
 #include "hw/pci/pci_bridge.h"
@@ -761,6 +762,178 @@ bool build_append_notification_callback(Aml *parent_scope, const PCIBus *bus)
     return !!nr_notifiers;
 }
 
+static Aml *aml_pci_device_dsm(void)
+{
+    Aml *method;
+
+    method = aml_method("_DSM", 4, AML_SERIALIZED);
+    {
+        Aml *params = aml_local(0);
+        Aml *pkg = aml_package(2);
+        aml_append(pkg, aml_int(0));
+        aml_append(pkg, aml_int(0));
+        aml_append(method, aml_store(pkg, params));
+        aml_append(method,
+            aml_store(aml_name("BSEL"), aml_index(params, aml_int(0))));
+        aml_append(method,
+            aml_store(aml_name("ASUN"), aml_index(params, aml_int(1))));
+        aml_append(method,
+            aml_return(aml_call5("PDSM", aml_arg(0), aml_arg(1),
+                                 aml_arg(2), aml_arg(3), params))
+        );
+    }
+    return method;
+}
+
+static Aml *aml_pci_static_endpoint_dsm(PCIDevice *pdev)
+{
+    Aml *method;
+
+    g_assert(pdev->acpi_index != 0);
+    method = aml_method("_DSM", 4, AML_SERIALIZED);
+    {
+        Aml *params = aml_local(0);
+        Aml *pkg = aml_package(1);
+        aml_append(pkg, aml_int(pdev->acpi_index));
+        aml_append(method, aml_store(pkg, params));
+        aml_append(method,
+            aml_return(aml_call5("EDSM", aml_arg(0), aml_arg(1),
+                                 aml_arg(2), aml_arg(3), params))
+        );
+    }
+    return method;
+}
+
+static void build_append_pcihp_notify_entry(Aml *method, int slot)
+{
+    Aml *if_ctx;
+    int32_t devfn = PCI_DEVFN(slot, 0);
+
+    if_ctx = aml_if(aml_and(aml_arg(0), aml_int(0x1U << slot), NULL));
+    aml_append(if_ctx, aml_notify(aml_name("S%.02X", devfn), aml_arg(1)));
+    aml_append(method, if_ctx);
+}
+
+static bool is_devfn_ignored_generic(const int devfn, const PCIBus *bus)
+{
+    const PCIDevice *pdev = bus->devices[devfn];
+
+    if (PCI_FUNC(devfn)) {
+        if (IS_PCI_BRIDGE(pdev)) {
+            /*
+             * Ignore only hotplugged PCI bridges on !0 functions, but
+             * allow describing cold plugged bridges on all functions
+             */
+            if (DEVICE(pdev)->hotplugged) {
+                return true;
+            }
+        }
+    }
+    return false;
+}
+
+static bool is_devfn_ignored_hotplug(const int devfn, const PCIBus *bus)
+{
+    PCIDevice *pdev = bus->devices[devfn];
+    if (pdev) {
+        return is_devfn_ignored_generic(devfn, bus) ||
+               !DEVICE_GET_CLASS(pdev)->hotpluggable ||
+               /* Cold plugged bridges aren't themselves hot-pluggable */
+               (IS_PCI_BRIDGE(pdev) && !DEVICE(pdev)->hotplugged);
+    } else { /* non populated slots */
+         /*
+          * hotplug is supported only for non-multifunction device
+          * so generate device description only for function 0
+          */
+        if (PCI_FUNC(devfn) ||
+            (pci_bus_is_express(bus) && PCI_SLOT(devfn) > 0)) {
+            return true;
+        }
+    }
+    return false;
+}
+
+void build_append_pcihp_slots(Aml *parent_scope, PCIBus *bus)
+{
+    int devfn;
+    Aml *dev, *notify_method = NULL, *method;
+    QObject *bsel = object_property_get_qobject(OBJECT(bus),
+                        ACPI_PCIHP_PROP_BSEL, NULL);
+    uint64_t bsel_val = qnum_get_uint(qobject_to(QNum, bsel));
+    qobject_unref(bsel);
+
+    aml_append(parent_scope, aml_name_decl("BSEL", aml_int(bsel_val)));
+    notify_method = aml_method("DVNT", 2, AML_NOTSERIALIZED);
+
+    for (devfn = 0; devfn < ARRAY_SIZE(bus->devices); devfn++) {
+        int slot = PCI_SLOT(devfn);
+        int adr = slot << 16 | PCI_FUNC(devfn);
+
+        if (is_devfn_ignored_hotplug(devfn, bus)) {
+            continue;
+        }
+
+        if (bus->devices[devfn]) {
+            dev = aml_scope("S%.02X", devfn);
+        } else {
+            dev = aml_device("S%.02X", devfn);
+            aml_append(dev, aml_name_decl("_ADR", aml_int(adr)));
+        }
+
+        /*
+         * Can't declare _SUN here for every device as it changes 'slot'
+         * enumeration order in linux kernel, so use another variable for it
+         */
+        aml_append(dev, aml_name_decl("ASUN", aml_int(slot)));
+        aml_append(dev, aml_pci_device_dsm());
+
+        aml_append(dev, aml_name_decl("_SUN", aml_int(slot)));
+        /* add _EJ0 to make slot hotpluggable  */
+        method = aml_method("_EJ0", 1, AML_NOTSERIALIZED);
+        aml_append(method,
+            aml_call2("PCEJ", aml_name("BSEL"), aml_name("_SUN"))
+        );
+        aml_append(dev, method);
+
+        build_append_pcihp_notify_entry(notify_method, slot);
+
+        /* device descriptor has been composed, add it into parent context */
+        aml_append(parent_scope, dev);
+    }
+    aml_append(parent_scope, notify_method);
+}
+
+void build_append_pci_bus_devices(Aml *parent_scope, PCIBus *bus)
+{
+    int devfn;
+    Aml *dev;
+
+    for (devfn = 0; devfn < ARRAY_SIZE(bus->devices); devfn++) {
+        /* ACPI spec: 1.0b: Table 6-2 _ADR Object Bus Types, PCI type */
+        int adr = PCI_SLOT(devfn) << 16 | PCI_FUNC(devfn);
+        PCIDevice *pdev = bus->devices[devfn];
+
+        if (!pdev || is_devfn_ignored_generic(devfn, bus)) {
+            continue;
+        }
+
+        /* start to compose PCI device descriptor */
+        dev = aml_device("S%.02X", devfn);
+        aml_append(dev, aml_name_decl("_ADR", aml_int(adr)));
+
+        call_dev_aml_func(DEVICE(bus->devices[devfn]), dev);
+        /* add _DSM if device has acpi-index set */
+        if (pdev->acpi_index &&
+            !object_property_get_bool(OBJECT(pdev), "hotpluggable",
+                                      &error_abort)) {
+            aml_append(dev, aml_pci_static_endpoint_dsm(pdev));
+        }
+
+        /* device descriptor has been composed, add it into parent context */
+        aml_append(parent_scope, dev);
+    }
+}
+
 const VMStateDescription vmstate_acpi_pcihp_pci_status = {
     .name = "acpi_pcihp_pci_status",
     .version_id = 1,
diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
index 3275675e60..fe8bc62c03 100644
--- a/hw/i386/acpi-build.c
+++ b/hw/i386/acpi-build.c
@@ -338,29 +338,6 @@ build_facs(GArray *table_data)
     g_array_append_vals(table_data, reserved, 40); /* Reserved */
 }
 
-static Aml *aml_pci_device_dsm(void)
-{
-    Aml *method;
-
-    method = aml_method("_DSM", 4, AML_SERIALIZED);
-    {
-        Aml *params = aml_local(0);
-        Aml *pkg = aml_package(2);
-        aml_append(pkg, aml_int(0));
-        aml_append(pkg, aml_int(0));
-        aml_append(method, aml_store(pkg, params));
-        aml_append(method,
-            aml_store(aml_name("BSEL"), aml_index(params, aml_int(0))));
-        aml_append(method,
-            aml_store(aml_name("ASUN"), aml_index(params, aml_int(1))));
-        aml_append(method,
-            aml_return(aml_call5("PDSM", aml_arg(0), aml_arg(1),
-                                 aml_arg(2), aml_arg(3), params))
-        );
-    }
-    return method;
-}
-
 static Aml *aml_pci_edsm(void)
 {
     Aml *method, *ifctx;
@@ -414,155 +391,6 @@ static Aml *aml_pci_edsm(void)
     return method;
 }
 
-static Aml *aml_pci_static_endpoint_dsm(PCIDevice *pdev)
-{
-    Aml *method;
-
-    g_assert(pdev->acpi_index != 0);
-    method = aml_method("_DSM", 4, AML_SERIALIZED);
-    {
-        Aml *params = aml_local(0);
-        Aml *pkg = aml_package(1);
-        aml_append(pkg, aml_int(pdev->acpi_index));
-        aml_append(method, aml_store(pkg, params));
-        aml_append(method,
-            aml_return(aml_call5("EDSM", aml_arg(0), aml_arg(1),
-                                 aml_arg(2), aml_arg(3), params))
-        );
-    }
-    return method;
-}
-
-static void build_append_pcihp_notify_entry(Aml *method, int slot)
-{
-    Aml *if_ctx;
-    int32_t devfn = PCI_DEVFN(slot, 0);
-
-    if_ctx = aml_if(aml_and(aml_arg(0), aml_int(0x1U << slot), NULL));
-    aml_append(if_ctx, aml_notify(aml_name("S%.02X", devfn), aml_arg(1)));
-    aml_append(method, if_ctx);
-}
-
-static bool is_devfn_ignored_generic(const int devfn, const PCIBus *bus)
-{
-    const PCIDevice *pdev = bus->devices[devfn];
-
-    if (PCI_FUNC(devfn)) {
-        if (IS_PCI_BRIDGE(pdev)) {
-            /*
-             * Ignore only hotplugged PCI bridges on !0 functions, but
-             * allow describing cold plugged bridges on all functions
-             */
-            if (DEVICE(pdev)->hotplugged) {
-                return true;
-            }
-        }
-    }
-    return false;
-}
-
-static bool is_devfn_ignored_hotplug(const int devfn, const PCIBus *bus)
-{
-    PCIDevice *pdev = bus->devices[devfn];
-    if (pdev) {
-        return is_devfn_ignored_generic(devfn, bus) ||
-               !DEVICE_GET_CLASS(pdev)->hotpluggable ||
-               /* Cold plugged bridges aren't themselves hot-pluggable */
-               (IS_PCI_BRIDGE(pdev) && !DEVICE(pdev)->hotplugged);
-    } else { /* non populated slots */
-         /*
-         * hotplug is supported only for non-multifunction device
-         * so generate device description only for function 0
-         */
-        if (PCI_FUNC(devfn) ||
-            (pci_bus_is_express(bus) && PCI_SLOT(devfn) > 0)) {
-            return true;
-        }
-    }
-    return false;
-}
-
-void build_append_pcihp_slots(Aml *parent_scope, PCIBus *bus)
-{
-    int devfn;
-    Aml *dev, *notify_method = NULL, *method;
-    QObject *bsel = object_property_get_qobject(OBJECT(bus),
-                        ACPI_PCIHP_PROP_BSEL, NULL);
-    uint64_t bsel_val = qnum_get_uint(qobject_to(QNum, bsel));
-    qobject_unref(bsel);
-
-    aml_append(parent_scope, aml_name_decl("BSEL", aml_int(bsel_val)));
-    notify_method = aml_method("DVNT", 2, AML_NOTSERIALIZED);
-
-    for (devfn = 0; devfn < ARRAY_SIZE(bus->devices); devfn++) {
-        int slot = PCI_SLOT(devfn);
-        int adr = slot << 16 | PCI_FUNC(devfn);
-
-        if (is_devfn_ignored_hotplug(devfn, bus)) {
-            continue;
-        }
-
-        if (bus->devices[devfn]) {
-            dev = aml_scope("S%.02X", devfn);
-        } else {
-            dev = aml_device("S%.02X", devfn);
-            aml_append(dev, aml_name_decl("_ADR", aml_int(adr)));
-        }
-
-        /*
-         * Can't declare _SUN here for every device as it changes 'slot'
-         * enumeration order in linux kernel, so use another variable for it
-         */
-        aml_append(dev, aml_name_decl("ASUN", aml_int(slot)));
-        aml_append(dev, aml_pci_device_dsm());
-
-        aml_append(dev, aml_name_decl("_SUN", aml_int(slot)));
-        /* add _EJ0 to make slot hotpluggable  */
-        method = aml_method("_EJ0", 1, AML_NOTSERIALIZED);
-        aml_append(method,
-            aml_call2("PCEJ", aml_name("BSEL"), aml_name("_SUN"))
-        );
-        aml_append(dev, method);
-
-        build_append_pcihp_notify_entry(notify_method, slot);
-
-        /* device descriptor has been composed, add it into parent context */
-        aml_append(parent_scope, dev);
-    }
-    aml_append(parent_scope, notify_method);
-}
-
-void build_append_pci_bus_devices(Aml *parent_scope, PCIBus *bus)
-{
-    int devfn;
-    Aml *dev;
-
-    for (devfn = 0; devfn < ARRAY_SIZE(bus->devices); devfn++) {
-        /* ACPI spec: 1.0b: Table 6-2 _ADR Object Bus Types, PCI type */
-        int adr = PCI_SLOT(devfn) << 16 | PCI_FUNC(devfn);
-        PCIDevice *pdev = bus->devices[devfn];
-
-        if (!pdev || is_devfn_ignored_generic(devfn, bus)) {
-            continue;
-        }
-
-        /* start to compose PCI device descriptor */
-        dev = aml_device("S%.02X", devfn);
-        aml_append(dev, aml_name_decl("_ADR", aml_int(adr)));
-
-        call_dev_aml_func(DEVICE(bus->devices[devfn]), dev);
-        /* add _DSM if device has acpi-index set */
-        if (pdev->acpi_index &&
-            !object_property_get_bool(OBJECT(pdev), "hotpluggable",
-                                      &error_abort)) {
-            aml_append(dev, aml_pci_static_endpoint_dsm(pdev));
-        }
-
-        /* device descriptor has been composed, add it into parent context */
-        aml_append(parent_scope, dev);
-    }
-}
-
 /*
  * build_prt - Define interrupt routing rules
  *
diff --git a/include/hw/acpi/pci.h b/include/hw/acpi/pci.h
index 8a328b580c..69bae95eac 100644
--- a/include/hw/acpi/pci.h
+++ b/include/hw/acpi/pci.h
@@ -37,7 +37,6 @@ typedef struct AcpiMcfgInfo {
 void build_mcfg(GArray *table_data, BIOSLinker *linker, AcpiMcfgInfo *info,
                 const char *oem_id, const char *oem_table_id);
 
-void build_append_pci_bus_devices(Aml *parent_scope, PCIBus *bus);
 void build_pci_bridge_aml(AcpiDevAmlIf *adev, Aml *scope);
 
 void build_srat_generic_affinity_structures(GArray *table_data);
diff --git a/include/hw/acpi/pcihp.h b/include/hw/acpi/pcihp.h
index f4fd44cb32..5506a58862 100644
--- a/include/hw/acpi/pcihp.h
+++ b/include/hw/acpi/pcihp.h
@@ -80,6 +80,8 @@ void build_append_pcihp_resources(Aml *table,
                                   uint64_t io_addr, uint64_t io_len);
 bool build_append_notification_callback(Aml *parent_scope, const PCIBus *bus);
 
+void build_append_pci_bus_devices(Aml *parent_scope, PCIBus *bus);
+
 /* Called on reset */
 void acpi_pcihp_reset(AcpiPciHpState *s);
 

From b9dc4e04c807ad3860a9ba8773b3b0e7057c31aa Mon Sep 17 00:00:00 2001
From: Eric Auger <eric.auger@redhat.com>
Date: Mon, 14 Jul 2025 10:04:59 +0200
Subject: [PATCH 2400/2760] hw/i386/acpi-build: Use AcpiPciHpState::root in
 acpi_set_pci_info

pcihp acpi_set_pci_info() generic code currently uses
acpi_get_i386_pci_host() to retrieve the pci host bridge.

To make it work also on ARM we get rid of that call and
directly use AcpiPciHpState::root.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Suggested-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Message-Id: <20250714080639.2525563-16-eric.auger@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/acpi/pcihp.c | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/hw/acpi/pcihp.c b/hw/acpi/pcihp.c
index 2c76edeb15..2db2f16940 100644
--- a/hw/acpi/pcihp.c
+++ b/hw/acpi/pcihp.c
@@ -99,10 +99,10 @@ static void *acpi_set_bsel(PCIBus *bus, void *opaque)
     return info;
 }
 
-static void acpi_set_pci_info(bool has_bridge_hotplug)
+static void acpi_set_pci_info(AcpiPciHpState *s)
 {
     static bool bsel_is_set;
-    Object *host = acpi_get_i386_pci_host();
+    bool has_bridge_hotplug = s->use_acpi_hotplug_bridge;
     PCIBus *bus;
     BSELInfo info = { .bsel_alloc = ACPI_PCIHP_BSEL_DEFAULT,
                       .has_bridge_hotplug = has_bridge_hotplug };
@@ -112,11 +112,8 @@ static void acpi_set_pci_info(bool has_bridge_hotplug)
     }
     bsel_is_set = true;
 
-    if (!host) {
-        return;
-    }
 
-    bus = PCI_HOST_BRIDGE(host)->bus;
+    bus = s->root;
     if (bus) {
         /* Scan all PCI buses. Set property to enable acpi based hotplug. */
         pci_for_each_bus_depth_first(bus, acpi_set_bsel, NULL, &info);
@@ -266,7 +263,7 @@ static void acpi_pcihp_update(AcpiPciHpState *s)
 
 void acpi_pcihp_reset(AcpiPciHpState *s)
 {
-    acpi_set_pci_info(s->use_acpi_hotplug_bridge);
+    acpi_set_pci_info(s);
     acpi_pcihp_update(s);
 }
 

From bc8f29df27e68b0476360526634097608171e783 Mon Sep 17 00:00:00 2001
From: Eric Auger <eric.auger@redhat.com>
Date: Mon, 14 Jul 2025 10:05:00 +0200
Subject: [PATCH 2401/2760] hw/i386/acpi-build: Move aml_pci_edsm to a generic
 place

Move aml_pci_edsm to pci-bridge.c since we want to reuse that for
ARM and acpi-index support. Also rename it into build_pci_bridge_edsm.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Message-Id: <20250714080639.2525563-17-eric.auger@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/acpi/pci-bridge.c  | 54 ++++++++++++++++++++++++++++++++++++++++
 hw/i386/acpi-build.c  | 57 ++-----------------------------------------
 include/hw/acpi/pci.h |  1 +
 3 files changed, 57 insertions(+), 55 deletions(-)

diff --git a/hw/acpi/pci-bridge.c b/hw/acpi/pci-bridge.c
index 7baa7034a1..394a919479 100644
--- a/hw/acpi/pci-bridge.c
+++ b/hw/acpi/pci-bridge.c
@@ -35,3 +35,57 @@ void build_pci_bridge_aml(AcpiDevAmlIf *adev, Aml *scope)
         }
     }
 }
+
+Aml *build_pci_bridge_edsm(void)
+{
+    Aml *method, *ifctx;
+    Aml *zero = aml_int(0);
+    Aml *func = aml_arg(2);
+    Aml *ret = aml_local(0);
+    Aml *aidx = aml_local(1);
+    Aml *params = aml_arg(4);
+
+    method = aml_method("EDSM", 5, AML_SERIALIZED);
+
+    /* get supported functions */
+    ifctx = aml_if(aml_equal(func, zero));
+    {
+        /* 1: have supported functions */
+        /* 7: support for function 7 */
+        const uint8_t caps = 1 | BIT(7);
+        build_append_pci_dsm_func0_common(ifctx, ret);
+        aml_append(ifctx, aml_store(aml_int(caps), aml_index(ret, zero)));
+        aml_append(ifctx, aml_return(ret));
+    }
+    aml_append(method, ifctx);
+
+    /* handle specific functions requests */
+    /*
+     * PCI Firmware Specification 3.1
+     * 4.6.7. _DSM for Naming a PCI or PCI Express Device Under
+     *        Operating Systems
+     */
+    ifctx = aml_if(aml_equal(func, aml_int(7)));
+    {
+       Aml *pkg = aml_package(2);
+       aml_append(pkg, zero);
+       /* optional, if not impl. should return null string */
+       aml_append(pkg, aml_string("%s", ""));
+       aml_append(ifctx, aml_store(pkg, ret));
+
+       /*
+        * IASL is fine when initializing Package with computational data,
+        * however it makes guest unhappy /it fails to process such AML/.
+        * So use runtime assignment to set acpi-index after initializer
+        * to make OSPM happy.
+        */
+       aml_append(ifctx,
+           aml_store(aml_derefof(aml_index(params, aml_int(0))), aidx));
+       aml_append(ifctx, aml_store(aidx, aml_index(ret, zero)));
+       aml_append(ifctx, aml_return(ret));
+    }
+    aml_append(method, ifctx);
+
+    return method;
+}
+
diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
index fe8bc62c03..423c4959fe 100644
--- a/hw/i386/acpi-build.c
+++ b/hw/i386/acpi-build.c
@@ -338,59 +338,6 @@ build_facs(GArray *table_data)
     g_array_append_vals(table_data, reserved, 40); /* Reserved */
 }
 
-static Aml *aml_pci_edsm(void)
-{
-    Aml *method, *ifctx;
-    Aml *zero = aml_int(0);
-    Aml *func = aml_arg(2);
-    Aml *ret = aml_local(0);
-    Aml *aidx = aml_local(1);
-    Aml *params = aml_arg(4);
-
-    method = aml_method("EDSM", 5, AML_SERIALIZED);
-
-    /* get supported functions */
-    ifctx = aml_if(aml_equal(func, zero));
-    {
-        /* 1: have supported functions */
-        /* 7: support for function 7 */
-        const uint8_t caps = 1 | BIT(7);
-        build_append_pci_dsm_func0_common(ifctx, ret);
-        aml_append(ifctx, aml_store(aml_int(caps), aml_index(ret, zero)));
-        aml_append(ifctx, aml_return(ret));
-    }
-    aml_append(method, ifctx);
-
-    /* handle specific functions requests */
-    /*
-     * PCI Firmware Specification 3.1
-     * 4.6.7. _DSM for Naming a PCI or PCI Express Device Under
-     *        Operating Systems
-     */
-    ifctx = aml_if(aml_equal(func, aml_int(7)));
-    {
-       Aml *pkg = aml_package(2);
-       aml_append(pkg, zero);
-       /* optional, if not impl. should return null string */
-       aml_append(pkg, aml_string("%s", ""));
-       aml_append(ifctx, aml_store(pkg, ret));
-
-       /*
-        * IASL is fine when initializing Package with computational data,
-        * however it makes guest unhappy /it fails to process such AML/.
-        * So use runtime assignment to set acpi-index after initializer
-        * to make OSPM happy.
-        */
-       aml_append(ifctx,
-           aml_store(aml_derefof(aml_index(params, aml_int(0))), aidx));
-       aml_append(ifctx, aml_store(aidx, aml_index(ret, zero)));
-       aml_append(ifctx, aml_return(ret));
-    }
-    aml_append(method, ifctx);
-
-    return method;
-}
-
 /*
  * build_prt - Define interrupt routing rules
  *
@@ -937,7 +884,7 @@ build_dsdt(GArray *table_data, BIOSLinker *linker,
         dev = aml_device("PCI0");
         aml_append(dev, aml_name_decl("_HID", aml_eisaid("PNP0A03")));
         aml_append(dev, aml_name_decl("_UID", aml_int(pcmc->pci_root_uid)));
-        aml_append(dev, aml_pci_edsm());
+        aml_append(dev, build_pci_bridge_edsm());
         aml_append(sb_scope, dev);
         aml_append(dsdt, sb_scope);
 
@@ -952,7 +899,7 @@ build_dsdt(GArray *table_data, BIOSLinker *linker,
         aml_append(dev, aml_name_decl("_CID", aml_eisaid("PNP0A03")));
         aml_append(dev, aml_name_decl("_UID", aml_int(pcmc->pci_root_uid)));
         aml_append(dev, build_pci_host_bridge_osc_method(!pm->pcihp_bridge_en));
-        aml_append(dev, aml_pci_edsm());
+        aml_append(dev, build_pci_bridge_edsm());
         aml_append(sb_scope, dev);
         if (mcfg_valid) {
             aml_append(sb_scope, build_q35_dram_controller(&mcfg));
diff --git a/include/hw/acpi/pci.h b/include/hw/acpi/pci.h
index 69bae95eac..20b672575f 100644
--- a/include/hw/acpi/pci.h
+++ b/include/hw/acpi/pci.h
@@ -42,5 +42,6 @@ void build_pci_bridge_aml(AcpiDevAmlIf *adev, Aml *scope);
 void build_srat_generic_affinity_structures(GArray *table_data);
 
 Aml *build_pci_host_bridge_osc_method(bool enable_native_pcie_hotplug);
+Aml *build_pci_bridge_edsm(void);
 
 #endif

From c82a9d740758644493bbb32711237c41070babb8 Mon Sep 17 00:00:00 2001
From: Eric Auger <eric.auger@redhat.com>
Date: Mon, 14 Jul 2025 10:05:01 +0200
Subject: [PATCH 2402/2760] qtest/bios-tables-test: Prepare for fixing the
 aarch64 viot test

The test misses a variant and this puts the mess on subsequent
rebuild-expected-aml.sh where a first DSDT reference blob is
overriden by another one.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Message-Id: <20250714080639.2525563-18-eric.auger@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 tests/data/acpi/aarch64/virt/DSDT.viot      | 0
 tests/qtest/bios-tables-test-allowed-diff.h | 1 +
 2 files changed, 1 insertion(+)
 create mode 100644 tests/data/acpi/aarch64/virt/DSDT.viot

diff --git a/tests/data/acpi/aarch64/virt/DSDT.viot b/tests/data/acpi/aarch64/virt/DSDT.viot
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/tests/qtest/bios-tables-test-allowed-diff.h b/tests/qtest/bios-tables-test-allowed-diff.h
index dfb8523c8b..7a74beab3d 100644
--- a/tests/qtest/bios-tables-test-allowed-diff.h
+++ b/tests/qtest/bios-tables-test-allowed-diff.h
@@ -1 +1,2 @@
 /* List of comma-separated changed AML files to ignore */
+"tests/data/acpi/aarch64/virt/DSDT.viot",

From 070c0892d528d66651cb2f3cc6a63eaa13c01ddf Mon Sep 17 00:00:00 2001
From: Eric Auger <eric.auger@redhat.com>
Date: Mon, 14 Jul 2025 10:05:02 +0200
Subject: [PATCH 2403/2760] qtest/bios-tables-test: Add a variant to the
 aarch64 viot test

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Message-Id: <20250714080639.2525563-19-eric.auger@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 tests/qtest/bios-tables-test.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tests/qtest/bios-tables-test.c b/tests/qtest/bios-tables-test.c
index e988deac02..4701975c05 100644
--- a/tests/qtest/bios-tables-test.c
+++ b/tests/qtest/bios-tables-test.c
@@ -2275,6 +2275,7 @@ static void test_acpi_aarch64_virt_viot(void)
     test_data data = {
         .machine = "virt",
         .arch = "aarch64",
+        .variant = ".viot",
         .tcg_only = true,
         .uefi_fl1 = "pc-bios/edk2-aarch64-code.fd",
         .uefi_fl2 = "pc-bios/edk2-arm-vars.fd",

From c34115091fab11342370c7af51589ba24d5cece9 Mon Sep 17 00:00:00 2001
From: Eric Auger <eric.auger@redhat.com>
Date: Mon, 14 Jul 2025 10:05:03 +0200
Subject: [PATCH 2404/2760] qtest/bios-tables-test: Generate DSDT.viot

Use a specific DSDT.viot reference blob instead of relying on
the default DSDT blob. The content is unchanged.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Message-Id: <20250714080639.2525563-20-eric.auger@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 tests/data/acpi/aarch64/virt/DSDT.viot      | Bin 0 -> 5158 bytes
 tests/qtest/bios-tables-test-allowed-diff.h |   1 -
 2 files changed, 1 deletion(-)

diff --git a/tests/data/acpi/aarch64/virt/DSDT.viot b/tests/data/acpi/aarch64/virt/DSDT.viot
index e69de29bb2d1d6434b8b29ae775ad8c2e48c5391..acab6e65febbc210158d4c39be0680bbb90250f5 100644
GIT binary patch
literal 5158
zcmZ<>b_r1vVPIf7<K*w`5v<@85#X$#prF9Wz`y`vgJ^+92gaEAV5j)#CMjnF0|SnD
z4^J0fN9O=f0|Ntd29EepPZx&hCM#!uUzl8wuZMwwp&?X`Bi=bESWt>fyp59qWFRMl
z00ToO8v`SwA_D_MB|~(Rg<H6@8^qi|SKm+r0|O%lj`-jZM=oxTcxPuvMu-uDTzn8C
zm^dY%IvrWUf?!Va@eA@dFfcGhSPR#Qu$+s532M0kvJr+5+fj`GS&Lx=69d8sL#Po>
zAXgY+GlGi=*#j_VuppUXglvW}Rx_BfnZbr+hB2}kCRoj2!Da>rk{Kq*W|(3%gB6<@
zTu5e^BAa1`)eJUlX7C`HVTNpmIaV{+v6;b#WQIAi85UU0;J{{v0FoIN$Yxk#HG>nI
z8A3>ASR$EW2+bU*NsNmNn;9ZVW>_Jcfi;<;W)fH$6GJk?8rcl&>68bXJ0y_Iut7Eh
zdphOCW`-1!8Meq~U{9xf*vybYGQ$qp4D9KYADbC+NM_h0n}I!@3Scus0m%#pWHYd*
zQ$cKIC?T2Qh-?P-bSi|+3>73ZoRH1Ho=%0anW2VchBJ~GM%dG-2sSe`kj!vFHUoP)
z6~$(T7LpmR$Yx+qr()R5&_Oc84cQFr=~Nt>8G1-&xFef^J)KHmGs6JM3=d>8u%}Z=
zY-SiCnc<0S2KIC+h0P2TBs08_&A^^crLmb|hGd2}vKiRZsSGwVERf9bK{f+>I+ev{
zh82<-zDQ;mV^61Y*vzm&GQ$tq4D9Jt9-A3<NM`s$&G2OLfj5W(`~nP|4cy?3kAR?H
zK|U^Sa63mCtRB*cK@}5Wiw_P8W{hqE8wGU^icyRl@yJH0U@;0J1~<wJ<SJ<HK`{!{
z7(q5m6^mIAF;uglxd_!PW>j~nVKECLhA?YVfU_qw)<9-C8dxxJ#5;Ss@IrXTpf;bY
zI|E0&lan7j9D_rG1m(G80vMbbJQ-3M6c`K`6c}6>QW?q^G8vK?QW+RPhJc%C0YM?c
zKE+%OLfkCe|Nk?9;)VgjX7n*IFk}$o0f}=l`GDG&P!6+?fq^lD5HAbQ|No2(AU%d~
z9!QrFgAgA?4y?}@!3F6wfU0Ez>okJ%KssScnHa!24WK%i7`Q+>VYV=Xb;4Z0%mC5}
zQ_2j{X$aNH4ABX*g$1k=<^mS5PMA^_h)$T}Ss*%Lwy=VA!d$=#)(KO}3egF3JS#*e
z%oaAVPM8bWz&c?{*&sS$j%S1DgxSIl)(LX~J6I=7DLX_b%<=3HoiJNCz&c?r-~j7{
zDdm9ZggKrAq7!BdCs-%U1)N}=Fr}OjoiN99LUh7x;R5S~xqu6-6Q-04q7&wLE{IN;
zE!<$8Fc)xxb;6W#Lv+F%&kfNDvxNt&6XpUQuuhm#9*9nu<9Q%DVYcvsb;4Z03)Tr!
z$_vp6b389ZC(IT;uuhl@_`o`0O8Fo<VUFj6=!DtA57r5D0Y6wLOesG^C(QBu5S=hv
z1i(6BE)W3ggeet(=!7|50HPCSiy&Ah%mspAoiL?>5S=i`3qo|lY!L$Mgt<TntP`eG
z2%;0_cp->Rm@UF!oiG;&gLT4`3PW_l94`#f3A056tP|z}5wK2}QW1zwnBzqtI$^em
zf_1`NAPUwAQz{D433I$CL?_G^F|baU3&g-WVM@gyI$@3%gXo0WA`aFGbAdQmCrqh0
zL?_Jg;t-uMTO`0bVJ?sW>x3zlfarudUIL;MW{V_PC(H$sV4X0fk`SFR$4f$V!fcTO
z>x8*L3ak^RR0^UK=6ETHPM9syV4W}*NP~64luAQ%!W=IR(FwCf2CNh20vWJQm{J*t
zPMG6mAUa{T$bxmkTp$b92~#Qy(Ft?BEJP>F7CEp^m<!~<I$=uXAUa`=mxJhp*&+|t
z33GuwSSL)WJVYnV@$wLzMhqeX@y<?;3`_VJ7#IXV{ToP&#e<!zq=T1%iH89M{(}g{
zc5wy<9?)P8h$ry>|36T-jDdmSzh1jI10xSJNEn3wgO&fcV_;xp=+Z{g1CnHD0O|Pu
zAEF2>0wF-+l?)<2?D77=&MaNo49+g$h70^yCuax>a|uNI-ZuU&FXJ#Ryu|T<?e(;-
zY%UgOmvE!5Y%UIGmvG|(5Rp)wz$KrsKw#43OvYM}cCeh`0^v!M!O{>h0gy~V0!U;b
z4@3xLl;M(W5#4x~U|*I6iV!<5n4f$aY+B_zQT&y!<Y8yu1)P(!7?ub!Gctk*hUg|=
zmLS()q{fXicnAwL@MX+pfZ=m+=>GrzUmg_75I=)S0T2lq5p!aX(F2XSxx2c=L&hE;
z18#<(MpCG!3$MGY3#i=#Z)7qvYJyu}(G9LauI>yx3=ABcTrAOz+#s&AYp|=2f{1Lq
rYgh<p0f>{ZKwxrp0vD)l(iRXN<iynw-6RQOKr90_$eazFp^Y#A)ragZ

literal 0
HcmV?d00001

diff --git a/tests/qtest/bios-tables-test-allowed-diff.h b/tests/qtest/bios-tables-test-allowed-diff.h
index 7a74beab3d..dfb8523c8b 100644
--- a/tests/qtest/bios-tables-test-allowed-diff.h
+++ b/tests/qtest/bios-tables-test-allowed-diff.h
@@ -1,2 +1 @@
 /* List of comma-separated changed AML files to ignore */
-"tests/data/acpi/aarch64/virt/DSDT.viot",

From 1983d552999a68dec60246e3e2fd122ecf25fa97 Mon Sep 17 00:00:00 2001
From: Gustavo Romero <gustavo.romero@linaro.org>
Date: Mon, 14 Jul 2025 10:05:04 +0200
Subject: [PATCH 2405/2760] tests/qtest/bios-tables-test: Prepare for changes
 in the arm virt DSDT table

This commit adds DSDT blobs to the whilelist in the prospect to
allow changes in the arm virt DSDT method.

Signed-off-by: Gustavo Romero <gustavo.romero@linaro.org>
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Message-Id: <20250714080639.2525563-21-eric.auger@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 tests/qtest/bios-tables-test-allowed-diff.h | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/tests/qtest/bios-tables-test-allowed-diff.h b/tests/qtest/bios-tables-test-allowed-diff.h
index dfb8523c8b..023fbc6059 100644
--- a/tests/qtest/bios-tables-test-allowed-diff.h
+++ b/tests/qtest/bios-tables-test-allowed-diff.h
@@ -1 +1,7 @@
 /* List of comma-separated changed AML files to ignore */
+"tests/data/acpi/aarch64/virt/DSDT",
+"tests/data/acpi/aarch64/virt/DSDT.acpihmatvirt",
+"tests/data/acpi/aarch64/virt/DSDT.memhp",
+"tests/data/acpi/aarch64/virt/DSDT.pxb",
+"tests/data/acpi/aarch64/virt/DSDT.topology",
+"tests/data/acpi/aarch64/virt/DSDT.viot",

From ff692ee7bcb506d318c7a279abf570b1f220a3da Mon Sep 17 00:00:00 2001
From: Eric Auger <eric.auger@redhat.com>
Date: Mon, 14 Jul 2025 10:05:05 +0200
Subject: [PATCH 2406/2760] hw/arm/virt-acpi-build: Let non hotplug ports
 support static acpi-index

hw/arm/virt-acpi-build: Let non hotplug ports support static acpi-index

Add the requested ACPI bits requested to support static acpi-index
for non hotplug ports.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Message-Id: <20250714080639.2525563-22-eric.auger@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/arm/Kconfig           |  2 ++
 hw/arm/virt-acpi-build.c | 12 ++++++++++++
 2 files changed, 14 insertions(+)

diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
index 1634e26fcc..2aa4b5d778 100644
--- a/hw/arm/Kconfig
+++ b/hw/arm/Kconfig
@@ -34,6 +34,8 @@ config ARM_VIRT
     select ACPI_HW_REDUCED
     select ACPI_APEI
     select ACPI_VIOT
+    select ACPI_PCIHP
+    select ACPI_PCI_BRIDGE
     select VIRTIO_MEM_SUPPORTED
     select ACPI_CXL
     select ACPI_HMAT
diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
index f3bad69aa7..3dc1cfcd67 100644
--- a/hw/arm/virt-acpi-build.c
+++ b/hw/arm/virt-acpi-build.c
@@ -34,6 +34,7 @@
 #include "hw/core/cpu.h"
 #include "hw/acpi/acpi-defs.h"
 #include "hw/acpi/acpi.h"
+#include "hw/acpi/pcihp.h"
 #include "hw/nvram/fw_cfg_acpi.h"
 #include "hw/acpi/bios-linker-loader.h"
 #include "hw/acpi/aml-build.h"
@@ -906,6 +907,7 @@ build_dsdt(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
     const int *irqmap = vms->irqmap;
     AcpiTable table = { .sig = "DSDT", .rev = 2, .oem_id = vms->oem_id,
                         .oem_table_id = vms->oem_table_id };
+    Aml *pci0_scope;
 
     acpi_table_begin(&table, table_data);
     dsdt = init_aml_allocator();
@@ -959,6 +961,16 @@ build_dsdt(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
 
     aml_append(dsdt, scope);
 
+    pci0_scope = aml_scope("\\_SB.PCI0");
+
+    aml_append(pci0_scope, build_pci_bridge_edsm());
+    build_append_pci_bus_devices(pci0_scope, vms->bus);
+    if (object_property_find(OBJECT(vms->bus), ACPI_PCIHP_PROP_BSEL)) {
+        build_append_pcihp_slots(pci0_scope, vms->bus);
+    }
+
+    aml_append(dsdt, pci0_scope);
+
     /* copy AML table into ACPI tables blob */
     g_array_append_vals(table_data, dsdt->buf->data, dsdt->buf->len);
 

From 4dfb1418278a43f3acbf177dfcafe955da8ffaf6 Mon Sep 17 00:00:00 2001
From: Eric Auger <eric.auger@redhat.com>
Date: Mon, 14 Jul 2025 10:05:06 +0200
Subject: [PATCH 2407/2760] tests/qtest/bios-tables-test: Update ARM DSDT
 reference blobs

    Changes relate to the introduction of pieces related to
    acpi-index static support along with root ports with no hotplug.

+
+    Scope (\_SB.PCI0)
+    {
+        Method (EDSM, 5, Serialized)
+        {
+            If ((Arg2 == Zero))
+            {
+                Local0 = Buffer (One)
+                    {
+                         0x00                                             // .
+                    }
+                If ((Arg0 != ToUUID ("e5c937d0-3553-4d7a-9117-ea4d19c3434d") /* Device Labeling Interface */))
+                {
+                    Return (Local0)
+                }
+
+                If ((Arg1 < 0x02))
+                {
+                    Return (Local0)
+                }
+
+                Local0 [Zero] = 0x81
+                Return (Local0)
+            }
+
+            If ((Arg2 == 0x07))
+            {
+                Local0 = Package (0x02)
+                    {
+                        Zero,
+                        ""
+                    }
+                Local1 = DerefOf (Arg4 [Zero])
+                Local0 [Zero] = Local1
+                Return (Local0)
+            }
+        }
+
+        Device (S00)
+        {
+            Name (_ADR, Zero)  // _ADR: Address
+        }
+
+        Device (S08)
+        {
+            Name (_ADR, 0x00010000)  // _ADR: Address
+        }
+
+        Device (S10)
+        {
+            Name (_ADR, 0x00020000)  // _ADR: Address
+        }
+    }
 }

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Message-Id: <20250714080639.2525563-23-eric.auger@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 tests/data/acpi/aarch64/virt/DSDT             | Bin 5158 -> 5293 bytes
 .../data/acpi/aarch64/virt/DSDT.acpihmatvirt  | Bin 5244 -> 5379 bytes
 tests/data/acpi/aarch64/virt/DSDT.memhp       | Bin 6519 -> 6654 bytes
 tests/data/acpi/aarch64/virt/DSDT.pxb         | Bin 7603 -> 7768 bytes
 tests/data/acpi/aarch64/virt/DSDT.topology    | Bin 5360 -> 5495 bytes
 tests/data/acpi/aarch64/virt/DSDT.viot        | Bin 5158 -> 5310 bytes
 tests/qtest/bios-tables-test-allowed-diff.h   |   6 ------
 7 files changed, 6 deletions(-)

diff --git a/tests/data/acpi/aarch64/virt/DSDT b/tests/data/acpi/aarch64/virt/DSDT
index acab6e65febbc210158d4c39be0680bbb90250f5..18d97e8f22979411a528705c0e314acb424bbfa5 100644
GIT binary patch
delta 156
zcmZ3cu~w7ICD<iotq21H)2oeKG9vW?ZX7Xs@xe~<0nVNVBHpa7F2TOM3(O{GF%$?g
zGcqJBkeW0(Lr|DY;DY(dr@^LGz7xe?`AQyk_Fa;&fPHEv7t@l20<Ol61O|pB2@7N<
zXK}F?2(dCT@G>M6G<W1MFeDZvLL{S`xPuK0;yL0SU4j^*oA`qbEaExhIUHSrco-NM
F82~q;ELZ>l

delta 19
acmZ3hxlDu0CD<iIO@x7g>C8qh84&<B2?Wsq

diff --git a/tests/data/acpi/aarch64/virt/DSDT.acpihmatvirt b/tests/data/acpi/aarch64/virt/DSDT.acpihmatvirt
index 54c27e7d95b4956ed1b5dee0d299ccb08dc2a73e..2cef095bcc1bb404f8cd9ec77a879ed81c191875 100644
GIT binary patch
delta 156
zcmeyP(X7Sg66_MfEXu&Zv}_|+kx0FO8%K;@e6Uk|fU~E8h&QXNORz8R0<+0k3<ZMB
zj0_12q$W+y5ESMTxL|(rX|QRP??mxezLJNXeU~IGV4s@F#k3@$fUB`1fq`L3!UCDe
zSzPP|Laa;-ybK8i%^f)m42cDa5XtB!?qCChc#e2Smmr4dCjMXpi+GNB4o8<D9tH+R
F1_1j$EA9XQ

delta 19
acmZqH`lG?+66_LEBf`MI)VYzXNCW^oYz1ck

diff --git a/tests/data/acpi/aarch64/virt/DSDT.memhp b/tests/data/acpi/aarch64/virt/DSDT.memhp
index 4330bc97cba0950191c45ac833533db7a190db81..372ca3d7fb1e2927c7c12f97eec406d597f294ab 100644
GIT binary patch
delta 156
zcmexv^v{^fCD<k8pCkhV6Zb~0T*-O?H;x#+_+Y2_0B27F5pPykmtbGs1!j}87zzZL
z85t55NKKlYAt=lxaKZfK(_qso--+U{d?gP%`z}dXz&<sTi)l$h0as&30t3U6gatB_
zv$)s`gjksvco`B3nmckB7!nH-A(GKe+`$G0@f`7vE<p^@P5i+I7V#YM9F8tQJPZts
F3;>E4EZYD8

delta 19
acmexo{N0GlCD<jTT#|u->Fq|YTuA^&WCm0K

diff --git a/tests/data/acpi/aarch64/virt/DSDT.pxb b/tests/data/acpi/aarch64/virt/DSDT.pxb
index 7fdbc03e2bf9fb7d35704779253de36e362f0bf9..c2779882494e16920787b8ab7b4cb3c3b70f224b 100644
GIT binary patch
delta 168
zcmdmNeZz*!CD<h-LXLrf$!jCmN?BzA7p@q+_+Y2_0B27F5pPykmtbGs1!j}87zzZL
z85t55NKKl&K}IZRNx}m5shM0%OA-pW8aomg7?va~keQst#a<x9%EZ9SkWkRvk;A}{
uSda*jjBer%HZX|ih<9`eVu)^%2{y2RaCjIP7#YxH`GXCiN_iL<m>2+L6)WZd

delta 19
acmca%v)P)<CD<iovn&Gx)9sC1D`f#g-Uey_

diff --git a/tests/data/acpi/aarch64/virt/DSDT.topology b/tests/data/acpi/aarch64/virt/DSDT.topology
index 969b4f6560d3ae39f5b7e0064b7122905476fce8..ebbeedc1ed30d811315c350f4cb42f8aa265af73 100644
GIT binary patch
delta 156
zcmeyM`CW_4CD<jTT$F)<>HJ2nXCn0iZX7Xs@xe~<0nVNVBHpa7F2TOM3(O{GF%$?g
zGcqJBkeW0(Lr|DY;DY(dr@^LGz7xe?`AQyk_Fa;&fPHEv7t@l20<Ol61O|pB2@7N<
zXK}F?2(dCT@G>M6G<W1MFeDZvLL{S`xPuK0;yL0SU4j^*oA`qbEaExhIUHSrco-NM
F8359@EocA$

delta 19
acmeya^+A)%CD<k8g9rly)25AF&qM%8i3Z^S

diff --git a/tests/data/acpi/aarch64/virt/DSDT.viot b/tests/data/acpi/aarch64/virt/DSDT.viot
index acab6e65febbc210158d4c39be0680bbb90250f5..b897d667971500da4732000091a6f0828d05d89e 100644
GIT binary patch
delta 173
zcmZ3cu}_oBCD<iop9lj3Q_n^&8IgJccg`5S_+Y2_0B27F5pPykmtbGs1!j}87zzZL
z85t55NKKlYAt=lxaKZfK(_qso--+U{d?gP%`z}dXz&<sTi)l$h0as&30t3U6gatB_
zv$)s`gjksvco`B3nmckB7!nH-A(GKe+`$G0@f`7vE<p^@P5i+I7V#YMl8!DxJPZts
OU=c&8G!Fv<69WJ)j4yfs

delta 19
acmdm|xlDu0CD<iIO@x7g>C8qh84&<COa$Tp

diff --git a/tests/qtest/bios-tables-test-allowed-diff.h b/tests/qtest/bios-tables-test-allowed-diff.h
index 023fbc6059..dfb8523c8b 100644
--- a/tests/qtest/bios-tables-test-allowed-diff.h
+++ b/tests/qtest/bios-tables-test-allowed-diff.h
@@ -1,7 +1 @@
 /* List of comma-separated changed AML files to ignore */
-"tests/data/acpi/aarch64/virt/DSDT",
-"tests/data/acpi/aarch64/virt/DSDT.acpihmatvirt",
-"tests/data/acpi/aarch64/virt/DSDT.memhp",
-"tests/data/acpi/aarch64/virt/DSDT.pxb",
-"tests/data/acpi/aarch64/virt/DSDT.topology",
-"tests/data/acpi/aarch64/virt/DSDT.viot",

From 1c2efc8ae03111f60d58806ba794109f5eb0c4ac Mon Sep 17 00:00:00 2001
From: Eric Auger <eric.auger@redhat.com>
Date: Mon, 14 Jul 2025 10:05:07 +0200
Subject: [PATCH 2408/2760] hw/arm/virt-acpi-build: Modify the DSDT ACPI table
 to enable ACPI PCI hotplug

Modify the DSDT ACPI table to enable ACPI PCI hotplug.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Message-Id: <20250714080639.2525563-24-eric.auger@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/acpi/pcihp.c          |  1 -
 hw/arm/virt-acpi-build.c | 17 +++++++++++++++++
 hw/arm/virt.c            |  2 ++
 include/hw/acpi/pcihp.h  |  2 ++
 include/hw/arm/virt.h    |  1 +
 5 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/hw/acpi/pcihp.c b/hw/acpi/pcihp.c
index 2db2f16940..f1594e664a 100644
--- a/hw/acpi/pcihp.c
+++ b/hw/acpi/pcihp.c
@@ -43,7 +43,6 @@
 #include "qobject/qnum.h"
 #include "trace.h"
 
-#define ACPI_PCIHP_SIZE 0x0018
 #define PCI_UP_BASE 0x0000
 #define PCI_DOWN_BASE 0x0004
 #define PCI_EJ_BASE 0x0008
diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
index 3dc1cfcd67..b01fc4f8ef 100644
--- a/hw/arm/virt-acpi-build.c
+++ b/hw/arm/virt-acpi-build.c
@@ -969,6 +969,23 @@ build_dsdt(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
         build_append_pcihp_slots(pci0_scope, vms->bus);
     }
 
+    if (vms->acpi_dev) {
+        bool acpi_pcihp;
+
+        acpi_pcihp = object_property_get_bool(OBJECT(vms->acpi_dev),
+                                              ACPI_PM_PROP_ACPI_PCIHP_BRIDGE,
+                                              NULL);
+
+        if (acpi_pcihp) {
+            build_acpi_pci_hotplug(dsdt, AML_SYSTEM_MEMORY,
+                                   memmap[VIRT_ACPI_PCIHP].base);
+            build_append_pcihp_resources(pci0_scope,
+                                         memmap[VIRT_ACPI_PCIHP].base,
+                                         memmap[VIRT_ACPI_PCIHP].size);
+
+            build_append_notification_callback(pci0_scope, vms->bus);
+        }
+    }
     aml_append(dsdt, pci0_scope);
 
     /* copy AML table into ACPI tables blob */
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index 8070ff7b11..817adedb31 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -76,6 +76,7 @@
 #include "standard-headers/linux/input.h"
 #include "hw/arm/smmuv3.h"
 #include "hw/acpi/acpi.h"
+#include "hw/acpi/pcihp.h"
 #include "target/arm/cpu-qom.h"
 #include "target/arm/internals.h"
 #include "target/arm/multiprocessing.h"
@@ -186,6 +187,7 @@ static const MemMapEntry base_memmap[] = {
     [VIRT_NVDIMM_ACPI] =        { 0x09090000, NVDIMM_ACPI_IO_LEN},
     [VIRT_PVTIME] =             { 0x090a0000, 0x00010000 },
     [VIRT_SECURE_GPIO] =        { 0x090b0000, 0x00001000 },
+    [VIRT_ACPI_PCIHP] =         { 0x090c0000, ACPI_PCIHP_SIZE },
     [VIRT_MMIO] =               { 0x0a000000, 0x00000200 },
     /* ...repeating for a total of NUM_VIRTIO_TRANSPORTS, each of that size */
     [VIRT_PLATFORM_BUS] =       { 0x0c000000, 0x02000000 },
diff --git a/include/hw/acpi/pcihp.h b/include/hw/acpi/pcihp.h
index 5506a58862..9ff548650b 100644
--- a/include/hw/acpi/pcihp.h
+++ b/include/hw/acpi/pcihp.h
@@ -38,6 +38,8 @@
 #define ACPI_PCIHP_SEJ_BASE 0x8
 #define ACPI_PCIHP_BNMR_BASE 0x10
 
+#define ACPI_PCIHP_SIZE 0x0018
+
 typedef struct AcpiPciHpPciStatus {
     uint32_t up;
     uint32_t down;
diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
index 4375819ea0..365a28b082 100644
--- a/include/hw/arm/virt.h
+++ b/include/hw/arm/virt.h
@@ -80,6 +80,7 @@ enum {
     VIRT_ACPI_GED,
     VIRT_NVDIMM_ACPI,
     VIRT_PVTIME,
+    VIRT_ACPI_PCIHP,
     VIRT_LOWMEMMAP_LAST,
 };
 

From 7b3e231f0902c6aec5fd0ed38b84eb33fb7271e0 Mon Sep 17 00:00:00 2001
From: Eric Auger <eric.auger@redhat.com>
Date: Mon, 14 Jul 2025 10:05:08 +0200
Subject: [PATCH 2409/2760] hw/acpi/ged: Add a bus link property

This property will be set by the machine code on the object
creation. It will be used by acpi pcihp hotplug code.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Message-Id: <20250714080639.2525563-25-eric.auger@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/acpi/generic_event_device.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/hw/acpi/generic_event_device.c b/hw/acpi/generic_event_device.c
index 7831db412b..ef1c1ec51f 100644
--- a/hw/acpi/generic_event_device.c
+++ b/hw/acpi/generic_event_device.c
@@ -13,6 +13,7 @@
 #include "qapi/error.h"
 #include "hw/acpi/acpi.h"
 #include "hw/acpi/generic_event_device.h"
+#include "hw/pci/pci.h"
 #include "hw/irq.h"
 #include "hw/mem/pc-dimm.h"
 #include "hw/mem/nvdimm.h"
@@ -320,6 +321,8 @@ static const Property acpi_ged_properties[] = {
     DEFINE_PROP_UINT32("ged-event", AcpiGedState, ged_event_bitmap, 0),
     DEFINE_PROP_BOOL(ACPI_PM_PROP_ACPI_PCIHP_BRIDGE, AcpiGedState,
                      pcihp_state.use_acpi_hotplug_bridge, 0),
+    DEFINE_PROP_LINK("bus", AcpiGedState, pcihp_state.root,
+                     TYPE_PCI_BUS, PCIBus *),
 };
 
 static const VMStateDescription vmstate_memhp_state = {

From 1913b8e68670223cfe8101c332a3b903031fc4d2 Mon Sep 17 00:00:00 2001
From: Eric Auger <eric.auger@redhat.com>
Date: Mon, 14 Jul 2025 10:05:09 +0200
Subject: [PATCH 2410/2760] hw/arm/virt: Pass the bus on the ged creation

The bus will be needed on ged realize for acpi pci hp setup.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Message-Id: <20250714080639.2525563-26-eric.auger@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/arm/virt.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index 817adedb31..41b5086b55 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -701,6 +701,7 @@ static inline DeviceState *create_acpi_ged(VirtMachineState *vms)
 
     dev = qdev_new(TYPE_ACPI_GED);
     qdev_prop_set_uint32(dev, "ged-event", event);
+    object_property_set_link(OBJECT(dev), "bus", OBJECT(vms->bus), &error_abort);
     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
 
     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, vms->memmap[VIRT_ACPI_GED].base);

From 8c58dc0531d868ea706a68114c22601cdf4c4e67 Mon Sep 17 00:00:00 2001
From: Eric Auger <eric.auger@redhat.com>
Date: Mon, 14 Jul 2025 10:05:10 +0200
Subject: [PATCH 2411/2760] hw/acpi/ged: Call pcihp plug callbacks in hotplug
 handler implementation

Add PCI device related code in the TYPE_HOTPLUG_HANDLER
implementation.

For a PCI device hotplug/hotunplug event, the code routes to
acpi_pcihp_device callbacks (pre_plug_cb, plug_cb, unplug_request_cb,
unplug_cb).

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Message-Id: <20250714080639.2525563-27-eric.auger@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/acpi/generic_event_device.c | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/hw/acpi/generic_event_device.c b/hw/acpi/generic_event_device.c
index ef1c1ec51f..92b931758f 100644
--- a/hw/acpi/generic_event_device.c
+++ b/hw/acpi/generic_event_device.c
@@ -17,6 +17,7 @@
 #include "hw/irq.h"
 #include "hw/mem/pc-dimm.h"
 #include "hw/mem/nvdimm.h"
+#include "hw/pci/pci_device.h"
 #include "hw/qdev-properties.h"
 #include "migration/vmstate.h"
 #include "qemu/error-report.h"
@@ -228,6 +229,14 @@ static const MemoryRegionOps ged_regs_ops = {
     },
 };
 
+static void acpi_ged_device_pre_plug_cb(HotplugHandler *hotplug_dev,
+                                        DeviceState *dev, Error **errp)
+{
+    if (object_dynamic_cast(OBJECT(dev), TYPE_PCI_DEVICE)) {
+        acpi_pcihp_device_pre_plug_cb(hotplug_dev, dev, errp);
+    }
+}
+
 static void acpi_ged_device_plug_cb(HotplugHandler *hotplug_dev,
                                     DeviceState *dev, Error **errp)
 {
@@ -241,6 +250,8 @@ static void acpi_ged_device_plug_cb(HotplugHandler *hotplug_dev,
         }
     } else if (object_dynamic_cast(OBJECT(dev), TYPE_CPU)) {
         acpi_cpu_plug_cb(hotplug_dev, &s->cpuhp_state, dev, errp);
+    } else if (object_dynamic_cast(OBJECT(dev), TYPE_PCI_DEVICE)) {
+        acpi_pcihp_device_plug_cb(hotplug_dev, &s->pcihp_state, dev, errp);
     } else {
         error_setg(errp, "virt: device plug request for unsupported device"
                    " type: %s", object_get_typename(OBJECT(dev)));
@@ -257,6 +268,9 @@ static void acpi_ged_unplug_request_cb(HotplugHandler *hotplug_dev,
         acpi_memory_unplug_request_cb(hotplug_dev, &s->memhp_state, dev, errp);
     } else if (object_dynamic_cast(OBJECT(dev), TYPE_CPU)) {
         acpi_cpu_unplug_request_cb(hotplug_dev, &s->cpuhp_state, dev, errp);
+    } else if (object_dynamic_cast(OBJECT(dev), TYPE_PCI_DEVICE)) {
+        acpi_pcihp_device_unplug_request_cb(hotplug_dev, &s->pcihp_state,
+                                            dev, errp);
     } else {
         error_setg(errp, "acpi: device unplug request for unsupported device"
                    " type: %s", object_get_typename(OBJECT(dev)));
@@ -272,6 +286,8 @@ static void acpi_ged_unplug_cb(HotplugHandler *hotplug_dev,
         acpi_memory_unplug_cb(&s->memhp_state, dev, errp);
     } else if (object_dynamic_cast(OBJECT(dev), TYPE_CPU)) {
         acpi_cpu_unplug_cb(&s->cpuhp_state, dev, errp);
+    } else if (object_dynamic_cast(OBJECT(dev), TYPE_PCI_DEVICE)) {
+        acpi_pcihp_device_unplug_cb(hotplug_dev, &s->pcihp_state, dev, errp);
     } else {
         error_setg(errp, "acpi: device unplug for unsupported device"
                    " type: %s", object_get_typename(OBJECT(dev)));
@@ -485,6 +501,7 @@ static void acpi_ged_class_init(ObjectClass *class, const void *data)
     dc->vmsd = &vmstate_acpi_ged;
     dc->realize = acpi_ged_realize;
 
+    hc->pre_plug = acpi_ged_device_pre_plug_cb;
     hc->plug = acpi_ged_device_plug_cb;
     hc->unplug_request = acpi_ged_unplug_request_cb;
     hc->unplug = acpi_ged_unplug_cb;

From b8c7ebbb70a316c8ea4a2a31eb071456bcc350b5 Mon Sep 17 00:00:00 2001
From: Eric Auger <eric.auger@redhat.com>
Date: Mon, 14 Jul 2025 10:05:11 +0200
Subject: [PATCH 2412/2760] hw/acpi/pcihp: Remove root arg in acpi_pcihp_init

Let pass the root bus to ich9 and piix4 through a property link
instead of through an argument passed to acpi_pcihp_init().

Also make sure the root bus is set at the entry of acpi_pcihp_init().

The rationale of that change is to be consistent with the forecoming ARM
implementation where the machine passes the root bus (steming from GPEX)
to the GED device through a link property.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Suggested-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Message-Id: <20250714080639.2525563-28-eric.auger@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/acpi/acpi-pci-hotplug-stub.c | 2 +-
 hw/acpi/ich9.c                  | 7 ++++++-
 hw/acpi/pcihp.c                 | 4 ++--
 hw/acpi/piix4.c                 | 5 ++++-
 include/hw/acpi/pcihp.h         | 2 +-
 5 files changed, 14 insertions(+), 6 deletions(-)

diff --git a/hw/acpi/acpi-pci-hotplug-stub.c b/hw/acpi/acpi-pci-hotplug-stub.c
index b7bc6e40a1..d58ea726a8 100644
--- a/hw/acpi/acpi-pci-hotplug-stub.c
+++ b/hw/acpi/acpi-pci-hotplug-stub.c
@@ -4,7 +4,7 @@
 
 const VMStateDescription vmstate_acpi_pcihp_pci_status;
 
-void acpi_pcihp_init(Object *owner, AcpiPciHpState *s, PCIBus *root_bus,
+void acpi_pcihp_init(Object *owner, AcpiPciHpState *s,
                      MemoryRegion *address_space_io, uint16_t io_base)
 {
 }
diff --git a/hw/acpi/ich9.c b/hw/acpi/ich9.c
index 967b67485e..2b3b493c01 100644
--- a/hw/acpi/ich9.c
+++ b/hw/acpi/ich9.c
@@ -322,9 +322,10 @@ void ich9_pm_init(PCIDevice *lpc_pci, ICH9LPCPMRegs *pm, qemu_irq sci_irq)
     }
 
     if (pm->acpi_pci_hotplug.use_acpi_hotplug_bridge) {
+        object_property_set_link(OBJECT(lpc_pci), "bus",
+                                 OBJECT(pci_get_bus(lpc_pci)), &error_abort);
         acpi_pcihp_init(OBJECT(lpc_pci),
                         &pm->acpi_pci_hotplug,
-                        pci_get_bus(lpc_pci),
                         pci_address_space_io(lpc_pci),
                         ACPI_PCIHP_ADDR_ICH9);
 
@@ -428,6 +429,10 @@ void ich9_pm_add_properties(Object *obj, ICH9LPCPMRegs *pm)
 
     object_property_add_uint32_ptr(obj, ACPI_PM_PROP_PM_IO_BASE,
                                    &pm->pm_io_base, OBJ_PROP_FLAG_READ);
+    object_property_add_link(obj, "bus", TYPE_PCI_BUS,
+                             (Object **)&pm->acpi_pci_hotplug.root,
+                             object_property_allow_set_link,
+                             OBJ_PROP_LINK_STRONG);
     object_property_add(obj, ACPI_PM_PROP_GPE0_BLK, "uint32",
                         ich9_pm_get_gpe0_blk,
                         NULL, NULL, pm);
diff --git a/hw/acpi/pcihp.c b/hw/acpi/pcihp.c
index f1594e664a..4922bbc778 100644
--- a/hw/acpi/pcihp.c
+++ b/hw/acpi/pcihp.c
@@ -493,13 +493,13 @@ static const MemoryRegionOps acpi_pcihp_io_ops = {
     },
 };
 
-void acpi_pcihp_init(Object *owner, AcpiPciHpState *s, PCIBus *root_bus,
+void acpi_pcihp_init(Object *owner, AcpiPciHpState *s,
                      MemoryRegion *io, uint16_t io_base)
 {
     s->io_len = ACPI_PCIHP_SIZE;
     s->io_base = io_base;
 
-    s->root = root_bus;
+    assert(s->root);
 
     memory_region_init_io(&s->io, owner, &acpi_pcihp_io_ops, s,
                           "acpi-pci-hotplug", s->io_len);
diff --git a/hw/acpi/piix4.c b/hw/acpi/piix4.c
index d98b80df6d..7a18f18dda 100644
--- a/hw/acpi/piix4.c
+++ b/hw/acpi/piix4.c
@@ -567,7 +567,8 @@ static void piix4_acpi_system_hot_add_init(MemoryRegion *parent,
 
     if (s->acpi_pci_hotplug.use_acpi_hotplug_bridge ||
         s->acpi_pci_hotplug.use_acpi_root_pci_hotplug) {
-        acpi_pcihp_init(OBJECT(s), &s->acpi_pci_hotplug, bus, parent,
+        object_property_set_link(OBJECT(s), "bus", OBJECT(bus), &error_abort);
+        acpi_pcihp_init(OBJECT(s), &s->acpi_pci_hotplug, parent,
                         ACPI_PCIHP_ADDR_PIIX4);
         qbus_set_hotplug_handler(BUS(pci_get_bus(PCI_DEVICE(s))), OBJECT(s));
     }
@@ -611,6 +612,8 @@ static const Property piix4_pm_properties[] = {
                      acpi_pci_hotplug.use_acpi_hotplug_bridge, true),
     DEFINE_PROP_BOOL(ACPI_PM_PROP_ACPI_PCI_ROOTHP, PIIX4PMState,
                      acpi_pci_hotplug.use_acpi_root_pci_hotplug, true),
+    DEFINE_PROP_LINK("bus", PIIX4PMState, acpi_pci_hotplug.root,
+                     TYPE_PCI_BUS, PCIBus *),
     DEFINE_PROP_BOOL("memory-hotplug-support", PIIX4PMState,
                      acpi_memory_hotplug.is_enabled, true),
     DEFINE_PROP_BOOL("smm-compat", PIIX4PMState, smm_compat, false),
diff --git a/include/hw/acpi/pcihp.h b/include/hw/acpi/pcihp.h
index 9ff548650b..ca6a258825 100644
--- a/include/hw/acpi/pcihp.h
+++ b/include/hw/acpi/pcihp.h
@@ -62,7 +62,7 @@ typedef struct AcpiPciHpState {
     bool use_acpi_root_pci_hotplug;
 } AcpiPciHpState;
 
-void acpi_pcihp_init(Object *owner, AcpiPciHpState *, PCIBus *root,
+void acpi_pcihp_init(Object *owner, AcpiPciHpState *,
                      MemoryRegion *io, uint16_t io_base);
 
 bool acpi_pcihp_is_hotpluggable_bus(AcpiPciHpState *s, BusState *bus);

From 1816a337a126281de43aabb4b55689f69ee876bc Mon Sep 17 00:00:00 2001
From: Eric Auger <eric.auger@redhat.com>
Date: Mon, 14 Jul 2025 10:05:12 +0200
Subject: [PATCH 2413/2760] hw/acpi/ged: Prepare the device to react to PCI
 hotplug events

QEMU will notify the OS about PCI hotplug/hotunplug events through
GED interrupts. Let the GED device handle a new PCI hotplug event.
On its occurrence it calls the \\_SB.PCI0.PCNT method with the BLCK
mutex held.

The GED device uses a dedicated MMIO region that will be mapped
by the machine code.

At this point the GED still does not support PCI device hotplug in
its TYPE_HOTPLUG_HANDLER implementation. This will come in a
subsequent patch.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Message-Id: <20250714080639.2525563-29-eric.auger@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/acpi/generic_event_device.c         | 35 ++++++++++++++++++++++++++
 include/hw/acpi/generic_event_device.h | 14 ++++++++++-
 2 files changed, 48 insertions(+), 1 deletion(-)

diff --git a/hw/acpi/generic_event_device.c b/hw/acpi/generic_event_device.c
index 92b931758f..7535d07737 100644
--- a/hw/acpi/generic_event_device.c
+++ b/hw/acpi/generic_event_device.c
@@ -12,6 +12,7 @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "hw/acpi/acpi.h"
+#include "hw/acpi/pcihp.h"
 #include "hw/acpi/generic_event_device.h"
 #include "hw/pci/pci.h"
 #include "hw/irq.h"
@@ -28,6 +29,7 @@ static const uint32_t ged_supported_events[] = {
     ACPI_GED_PWR_DOWN_EVT,
     ACPI_GED_NVDIMM_HOTPLUG_EVT,
     ACPI_GED_CPU_HOTPLUG_EVT,
+    ACPI_GED_PCI_HOTPLUG_EVT,
 };
 
 /*
@@ -123,6 +125,12 @@ void build_ged_aml(Aml *table, const char *name, HotplugHandler *hotplug_dev,
                            aml_notify(aml_name("\\_SB.NVDR"),
                                       aml_int(0x80)));
                 break;
+            case ACPI_GED_PCI_HOTPLUG_EVT:
+                aml_append(if_ctx,
+                           aml_acquire(aml_name("\\_SB.PCI0.BLCK"), 0xFFFF));
+                aml_append(if_ctx, aml_call0("\\_SB.PCI0.PCNT"));
+                aml_append(if_ctx, aml_release(aml_name("\\_SB.PCI0.BLCK")));
+                break;
             default:
                 /*
                  * Please make sure all the events in ged_supported_events[]
@@ -316,6 +324,8 @@ static void acpi_ged_send_event(AcpiDeviceIf *adev, AcpiEventStatusBits ev)
         sel = ACPI_GED_NVDIMM_HOTPLUG_EVT;
     } else if (ev & ACPI_CPU_HOTPLUG_STATUS) {
         sel = ACPI_GED_CPU_HOTPLUG_EVT;
+    } else if (ev & ACPI_PCI_HOTPLUG_STATUS) {
+        sel = ACPI_GED_PCI_HOTPLUG_EVT;
     } else {
         /* Unknown event. Return without generating interrupt. */
         warn_report("GED: Unsupported event %d. No irq injected", ev);
@@ -427,9 +437,13 @@ static void acpi_ged_realize(DeviceState *dev, Error **errp)
 {
     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
     AcpiGedState *s = ACPI_GED(dev);
+    AcpiPciHpState *pcihp_state = &s->pcihp_state;
     uint32_t ged_events;
     int i;
 
+    if (pcihp_state->use_acpi_hotplug_bridge) {
+        s->ged_event_bitmap |= ACPI_GED_PCI_HOTPLUG_EVT;
+    }
     ged_events = ctpop32(s->ged_event_bitmap);
 
     for (i = 0; i < ARRAY_SIZE(ged_supported_events) && ged_events; i++) {
@@ -449,6 +463,13 @@ static void acpi_ged_realize(DeviceState *dev, Error **errp)
             cpu_hotplug_hw_init(&s->container_cpuhp, OBJECT(dev),
                                 &s->cpuhp_state, 0);
             break;
+        case ACPI_GED_PCI_HOTPLUG_EVT:
+            memory_region_init(&s->container_pcihp, OBJECT(dev),
+                               ACPI_PCIHP_REGION_NAME, ACPI_PCIHP_SIZE);
+            sysbus_init_mmio(sbd, &s->container_pcihp);
+            acpi_pcihp_init(OBJECT(s), &s->pcihp_state,
+                            &s->container_pcihp, 0);
+            qbus_set_hotplug_handler(BUS(s->pcihp_state.root), OBJECT(dev));
         }
         ged_events--;
     }
@@ -490,11 +511,22 @@ static void acpi_ged_initfn(Object *obj)
     sysbus_init_mmio(sbd, &ged_st->regs);
 }
 
+static void ged_reset_hold(Object *obj, ResetType type)
+{
+    AcpiGedState *s = ACPI_GED(obj);
+
+    if (s->pcihp_state.use_acpi_hotplug_bridge) {
+        acpi_pcihp_reset(&s->pcihp_state);
+    }
+}
+
 static void acpi_ged_class_init(ObjectClass *class, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(class);
     HotplugHandlerClass *hc = HOTPLUG_HANDLER_CLASS(class);
     AcpiDeviceIfClass *adevc = ACPI_DEVICE_IF_CLASS(class);
+    ResettableClass *rc = RESETTABLE_CLASS(class);
+    AcpiGedClass *gedc = ACPI_GED_CLASS(class);
 
     dc->desc = "ACPI Generic Event Device";
     device_class_set_props(dc, acpi_ged_properties);
@@ -505,6 +537,8 @@ static void acpi_ged_class_init(ObjectClass *class, const void *data)
     hc->plug = acpi_ged_device_plug_cb;
     hc->unplug_request = acpi_ged_unplug_request_cb;
     hc->unplug = acpi_ged_unplug_cb;
+    resettable_class_set_parent_phases(rc, NULL, ged_reset_hold, NULL,
+                                       &gedc->parent_phases);
 
     adevc->ospm_status = acpi_ged_ospm_status;
     adevc->send_event = acpi_ged_send_event;
@@ -516,6 +550,7 @@ static const TypeInfo acpi_ged_info = {
     .instance_size = sizeof(AcpiGedState),
     .instance_init  = acpi_ged_initfn,
     .class_init    = acpi_ged_class_init,
+    .class_size    = sizeof(AcpiGedClass),
     .interfaces = (const InterfaceInfo[]) {
         { TYPE_HOTPLUG_HANDLER },
         { TYPE_ACPI_DEVICE_IF },
diff --git a/include/hw/acpi/generic_event_device.h b/include/hw/acpi/generic_event_device.h
index f5ffa67a39..d56adaa626 100644
--- a/include/hw/acpi/generic_event_device.h
+++ b/include/hw/acpi/generic_event_device.h
@@ -69,7 +69,7 @@
 #define ACPI_POWER_BUTTON_DEVICE "PWRB"
 
 #define TYPE_ACPI_GED "acpi-ged"
-OBJECT_DECLARE_SIMPLE_TYPE(AcpiGedState, ACPI_GED)
+OBJECT_DECLARE_TYPE(AcpiGedState, AcpiGedClass, ACPI_GED)
 
 #define ACPI_GED_EVT_SEL_OFFSET    0x0
 #define ACPI_GED_EVT_SEL_LEN       0x4
@@ -102,6 +102,7 @@ OBJECT_DECLARE_SIMPLE_TYPE(AcpiGedState, ACPI_GED)
 #define ACPI_GED_PWR_DOWN_EVT      0x2
 #define ACPI_GED_NVDIMM_HOTPLUG_EVT 0x4
 #define ACPI_GED_CPU_HOTPLUG_EVT    0x8
+#define ACPI_GED_PCI_HOTPLUG_EVT    0x10
 
 typedef struct GEDState {
     MemoryRegion evt;
@@ -109,6 +110,8 @@ typedef struct GEDState {
     uint32_t     sel;
 } GEDState;
 
+#define ACPI_PCIHP_REGION_NAME "pcihp container"
+
 struct AcpiGedState {
     SysBusDevice parent_obj;
     MemHotplugState memhp_state;
@@ -116,12 +119,21 @@ struct AcpiGedState {
     CPUHotplugState cpuhp_state;
     MemoryRegion container_cpuhp;
     AcpiPciHpState pcihp_state;
+    MemoryRegion container_pcihp;
     GEDState ged_state;
     uint32_t ged_event_bitmap;
     qemu_irq irq;
     AcpiGhesState ghes_state;
 };
 
+typedef struct AcpiGedClass {
+    /* <private> */
+    SysBusDeviceClass parent_class;
+
+    /*< public >*/
+    ResettablePhases parent_phases;
+} AcpiGedClass;
+
 void build_ged_aml(Aml *table, const char* name, HotplugHandler *hotplug_dev,
                    uint32_t ged_irq, AmlRegionSpace rs, hwaddr ged_base);
 void acpi_dsdt_add_power_button(Aml *scope);

From 745315784db4315644421f5def482ff1324503bd Mon Sep 17 00:00:00 2001
From: Eric Auger <eric.auger@redhat.com>
Date: Mon, 14 Jul 2025 10:05:13 +0200
Subject: [PATCH 2414/2760] hw/acpi/ged: Support migration of AcpiPciHpState

Add a subsection to migrate the AcpiPciHpState state.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Reviewed-by: Prasad Pandit <pjp@fedoraproject.org>
Message-Id: <20250714080639.2525563-30-eric.auger@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/acpi/generic_event_device.c | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/hw/acpi/generic_event_device.c b/hw/acpi/generic_event_device.c
index 7535d07737..95682b79a2 100644
--- a/hw/acpi/generic_event_device.c
+++ b/hw/acpi/generic_event_device.c
@@ -417,6 +417,25 @@ static const VMStateDescription vmstate_ghes_state = {
     }
 };
 
+static bool pcihp_needed(void *opaque)
+{
+    AcpiGedState *s = opaque;
+    return s->pcihp_state.use_acpi_hotplug_bridge;
+}
+
+static const VMStateDescription vmstate_pcihp_state = {
+    .name = "acpi-ged/pcihp",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .needed = pcihp_needed,
+    .fields = (const VMStateField[]) {
+        VMSTATE_PCI_HOTPLUG(pcihp_state,
+                            AcpiGedState,
+                            NULL, NULL),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
 static const VMStateDescription vmstate_acpi_ged = {
     .name = "acpi-ged",
     .version_id = 1,
@@ -429,6 +448,7 @@ static const VMStateDescription vmstate_acpi_ged = {
         &vmstate_memhp_state,
         &vmstate_cpuhp_state,
         &vmstate_ghes_state,
+        &vmstate_pcihp_state,
         NULL
     }
 };

From 1a102856652268cf2ec4cbd2cb9b229ef920c31d Mon Sep 17 00:00:00 2001
From: Eric Auger <eric.auger@redhat.com>
Date: Mon, 14 Jul 2025 10:05:14 +0200
Subject: [PATCH 2415/2760] hw/core/sysbus: Introduce sysbus_mmio_map_name()
 helper

Some sysbus devices have conditional mmio regions. This
happens for instance with the hw/acpi/ged device. In that case
it becomes difficult to predict which index a specific MMIO
region corresponds to when one needs to mmio map the region.
Introduce a new helper that takes the name of the region instead
of its index. If the region is not found this returns -1.
Otherwise it maps the corresponding index and returns this latter.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Message-Id: <20250714080639.2525563-31-eric.auger@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/core/sysbus.c    | 11 +++++++++++
 include/hw/sysbus.h |  1 +
 2 files changed, 12 insertions(+)

diff --git a/hw/core/sysbus.c b/hw/core/sysbus.c
index e71367adfb..ec69e877a2 100644
--- a/hw/core/sysbus.c
+++ b/hw/core/sysbus.c
@@ -151,6 +151,17 @@ void sysbus_mmio_map(SysBusDevice *dev, int n, hwaddr addr)
     sysbus_mmio_map_common(dev, n, addr, false, 0);
 }
 
+int sysbus_mmio_map_name(SysBusDevice *dev, const char *name, hwaddr addr)
+{
+    for (int i = 0; i < dev->num_mmio; i++) {
+        if (!strcmp(dev->mmio[i].memory->name, name)) {
+            sysbus_mmio_map(dev, i, addr);
+            return i;
+        }
+    }
+    return -1;
+}
+
 void sysbus_mmio_map_overlap(SysBusDevice *dev, int n, hwaddr addr,
                              int priority)
 {
diff --git a/include/hw/sysbus.h b/include/hw/sysbus.h
index 7dc88aaa27..18fde8a7b4 100644
--- a/include/hw/sysbus.h
+++ b/include/hw/sysbus.h
@@ -82,6 +82,7 @@ void sysbus_connect_irq(SysBusDevice *dev, int n, qemu_irq irq);
 bool sysbus_is_irq_connected(SysBusDevice *dev, int n);
 qemu_irq sysbus_get_connected_irq(SysBusDevice *dev, int n);
 void sysbus_mmio_map(SysBusDevice *dev, int n, hwaddr addr);
+int sysbus_mmio_map_name(SysBusDevice *dev, const char*name, hwaddr addr);
 void sysbus_mmio_map_overlap(SysBusDevice *dev, int n, hwaddr addr,
                              int priority);
 

From cfd4ace6e5faf3064defa559e1b5fd674109186f Mon Sep 17 00:00:00 2001
From: Eric Auger <eric.auger@redhat.com>
Date: Mon, 14 Jul 2025 10:05:15 +0200
Subject: [PATCH 2416/2760] hw/arm/virt: Minor code reshuffling in
 create_acpi_ged

Use a local SysBusDevice handle. Also use the newly introduced
sysbus_mmio_map_name which brings better readability about the region
being mapped. GED device has regions which exist depending on some
external properties and it becomes difficult to guess the index of
a region. Better refer to a region by its name.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Message-Id: <20250714080639.2525563-32-eric.auger@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/arm/virt.c                          | 11 +++++++----
 include/hw/acpi/generic_event_device.h |  1 +
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index 41b5086b55..f127a668ef 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -688,6 +688,7 @@ static inline DeviceState *create_acpi_ged(VirtMachineState *vms)
 {
     DeviceState *dev;
     MachineState *ms = MACHINE(vms);
+    SysBusDevice *sbdev;
     int irq = vms->irqmap[VIRT_ACPI_GED];
     uint32_t event = ACPI_GED_PWR_DOWN_EVT;
 
@@ -702,11 +703,13 @@ static inline DeviceState *create_acpi_ged(VirtMachineState *vms)
     dev = qdev_new(TYPE_ACPI_GED);
     qdev_prop_set_uint32(dev, "ged-event", event);
     object_property_set_link(OBJECT(dev), "bus", OBJECT(vms->bus), &error_abort);
-    sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
+    sbdev = SYS_BUS_DEVICE(dev);
+    sysbus_realize_and_unref(sbdev, &error_fatal);
 
-    sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, vms->memmap[VIRT_ACPI_GED].base);
-    sysbus_mmio_map(SYS_BUS_DEVICE(dev), 1, vms->memmap[VIRT_PCDIMM_ACPI].base);
-    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, qdev_get_gpio_in(vms->gic, irq));
+    sysbus_mmio_map_name(sbdev, TYPE_ACPI_GED, vms->memmap[VIRT_ACPI_GED].base);
+    sysbus_mmio_map_name(sbdev, ACPI_MEMHP_REGION_NAME,
+                         vms->memmap[VIRT_PCDIMM_ACPI].base);
+    sysbus_connect_irq(sbdev, 0, qdev_get_gpio_in(vms->gic, irq));
 
     return dev;
 }
diff --git a/include/hw/acpi/generic_event_device.h b/include/hw/acpi/generic_event_device.h
index d56adaa626..2c5b055327 100644
--- a/include/hw/acpi/generic_event_device.h
+++ b/include/hw/acpi/generic_event_device.h
@@ -111,6 +111,7 @@ typedef struct GEDState {
 } GEDState;
 
 #define ACPI_PCIHP_REGION_NAME "pcihp container"
+#define ACPI_MEMHP_REGION_NAME "memhp container"
 
 struct AcpiGedState {
     SysBusDevice parent_obj;

From 6af97d127eb40bd8a3b25db86d3644b25287be51 Mon Sep 17 00:00:00 2001
From: Eric Auger <eric.auger@redhat.com>
Date: Mon, 14 Jul 2025 10:05:16 +0200
Subject: [PATCH 2417/2760] hw/arm/virt: Let virt support pci hotplug/unplug
 GED event

Set up the IO registers used to communicate between QEMU
and ACPI.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Message-Id: <20250714080639.2525563-33-eric.auger@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/arm/virt.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index f127a668ef..ef6be3660f 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -691,6 +691,7 @@ static inline DeviceState *create_acpi_ged(VirtMachineState *vms)
     SysBusDevice *sbdev;
     int irq = vms->irqmap[VIRT_ACPI_GED];
     uint32_t event = ACPI_GED_PWR_DOWN_EVT;
+    bool acpi_pcihp;
 
     if (ms->ram_slots) {
         event |= ACPI_GED_MEM_HOTPLUG_EVT;
@@ -709,6 +710,18 @@ static inline DeviceState *create_acpi_ged(VirtMachineState *vms)
     sysbus_mmio_map_name(sbdev, TYPE_ACPI_GED, vms->memmap[VIRT_ACPI_GED].base);
     sysbus_mmio_map_name(sbdev, ACPI_MEMHP_REGION_NAME,
                          vms->memmap[VIRT_PCDIMM_ACPI].base);
+
+    acpi_pcihp = object_property_get_bool(OBJECT(dev),
+                                          ACPI_PM_PROP_ACPI_PCIHP_BRIDGE, NULL);
+
+    if (acpi_pcihp) {
+        int pcihp_region_index;
+
+        pcihp_region_index = sysbus_mmio_map_name(sbdev, ACPI_PCIHP_REGION_NAME,
+                                                  vms->memmap[VIRT_ACPI_PCIHP].base);
+        assert(pcihp_region_index >= 0);
+    }
+
     sysbus_connect_irq(sbdev, 0, qdev_get_gpio_in(vms->gic, irq));
 
     return dev;

From 099ea5daeae0b1acb386b9e3c99838798cb0f690 Mon Sep 17 00:00:00 2001
From: Gustavo Romero <gustavo.romero@linaro.org>
Date: Mon, 14 Jul 2025 10:05:17 +0200
Subject: [PATCH 2418/2760] tests/qtest/bios-tables-test: Prepare for addition
 of acpi pci hp tests

Soon we will introduce new tests related to ACPI PCI hotplug and
acpi-index that will use a new reference blob:

tests/data/acpi/aarch64/virt/DSDT.acpipcihp
tests/data/acpi/aarch64/virt/DSDT.hpoffacpiindex

Signed-off-by: Gustavo Romero <gustavo.romero@linaro.org>
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Message-Id: <20250714080639.2525563-34-eric.auger@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 tests/data/acpi/aarch64/virt/DSDT.acpipcihp      | 0
 tests/data/acpi/aarch64/virt/DSDT.hpoffacpiindex | 0
 tests/qtest/bios-tables-test-allowed-diff.h      | 2 ++
 3 files changed, 2 insertions(+)
 create mode 100644 tests/data/acpi/aarch64/virt/DSDT.acpipcihp
 create mode 100644 tests/data/acpi/aarch64/virt/DSDT.hpoffacpiindex

diff --git a/tests/data/acpi/aarch64/virt/DSDT.acpipcihp b/tests/data/acpi/aarch64/virt/DSDT.acpipcihp
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/tests/data/acpi/aarch64/virt/DSDT.hpoffacpiindex b/tests/data/acpi/aarch64/virt/DSDT.hpoffacpiindex
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/tests/qtest/bios-tables-test-allowed-diff.h b/tests/qtest/bios-tables-test-allowed-diff.h
index dfb8523c8b..02f4f0b29f 100644
--- a/tests/qtest/bios-tables-test-allowed-diff.h
+++ b/tests/qtest/bios-tables-test-allowed-diff.h
@@ -1 +1,3 @@
 /* List of comma-separated changed AML files to ignore */
+"tests/data/acpi/aarch64/virt/DSDT.acpipcihp",
+"tests/data/acpi/aarch64/virt/DSDT.hpoffacpiindex",

From 72140ff2a14545f3c7835c8531cb51255b652d2e Mon Sep 17 00:00:00 2001
From: Gustavo Romero <gustavo.romero@linaro.org>
Date: Mon, 14 Jul 2025 10:05:18 +0200
Subject: [PATCH 2419/2760] tests/qtest/bios-tables-test: Add aarch64 ACPI PCI
 hotplug test

Add 2 new tests:
- test_acpi_aarch64_virt_acpi_pci_hotplug tests the acpi pci hotplug
  using -global acpi-ged.acpi-pci-hotplug-with-bridge-support=on
- test_acpi_aarch64_virt_pcie_root_port_hpoff tests static-acpi index
  on a root port with disabled hotplug

Signed-off-by: Gustavo Romero <gustavo.romero@linaro.org>
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Message-Id: <20250714080639.2525563-35-eric.auger@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 tests/qtest/bios-tables-test.c | 52 ++++++++++++++++++++++++++++++++++
 1 file changed, 52 insertions(+)

diff --git a/tests/qtest/bios-tables-test.c b/tests/qtest/bios-tables-test.c
index 4701975c05..6aec68decc 100644
--- a/tests/qtest/bios-tables-test.c
+++ b/tests/qtest/bios-tables-test.c
@@ -1643,6 +1643,54 @@ static void test_acpi_aarch64_virt_tcg_memhp(void)
 
 }
 
+static void test_acpi_aarch64_virt_acpi_pci_hotplug(void)
+{
+    test_data data = {
+        .machine = "virt",
+        .arch = "aarch64",
+        .tcg_only = true,
+        .uefi_fl1 = "pc-bios/edk2-aarch64-code.fd",
+        .uefi_fl2 = "pc-bios/edk2-arm-vars.fd",
+        .cd = "tests/data/uefi-boot-images/bios-tables-test.aarch64.iso.qcow2",
+        .ram_start = 0x40000000ULL,
+        .scan_len = 256ULL * MiB,
+        .variant = ".acpipcihp",
+    };
+
+   /* Use ACPI PCI Hotplug */
+   test_acpi_one(" -global acpi-ged.acpi-pci-hotplug-with-bridge-support=on"
+                 " -cpu cortex-a57"
+                 " -device pcie-root-port,id=pcie.1,bus=pcie.0,chassis=0,slot=1,addr=7.0"
+                 " -device pci-testdev,bus=pcie.1",
+                 &data);
+
+    free_test_data(&data);
+}
+
+static void test_acpi_aarch64_virt_pcie_root_port_hpoff(void)
+{
+    test_data data = {
+        .machine = "virt",
+        .arch = "aarch64",
+        .tcg_only = true,
+        .uefi_fl1 = "pc-bios/edk2-aarch64-code.fd",
+        .uefi_fl2 = "pc-bios/edk2-arm-vars.fd",
+        .cd = "tests/data/uefi-boot-images/bios-tables-test.aarch64.iso.qcow2",
+        .ram_start = 0x40000000ULL,
+        .scan_len = 256ULL * MiB,
+        .variant = ".hpoffacpiindex",
+    };
+
+   /* turn hotplug off on the pcie-root-port and use static acpi-index*/
+   test_acpi_one(" -device pcie-root-port,id=pcie.1,chassis=0,"
+                                          "slot=1,hotplug=off,addr=7.0"
+                 " -device pci-testdev,bus=pcie.1,acpi-index=12"
+                 " -cpu cortex-a57",
+                 &data);
+
+    free_test_data(&data);
+}
+
 static void test_acpi_microvm_prepare(test_data *data)
 {
     data->machine = "microvm";
@@ -2708,6 +2756,10 @@ int main(int argc, char *argv[])
             qtest_add_func("acpi/virt/numamem",
                            test_acpi_aarch64_virt_tcg_numamem);
             qtest_add_func("acpi/virt/memhp", test_acpi_aarch64_virt_tcg_memhp);
+            qtest_add_func("acpi/virt/acpipcihp",
+                           test_acpi_aarch64_virt_acpi_pci_hotplug);
+            qtest_add_func("acpi/virt/hpoffacpiindex",
+                          test_acpi_aarch64_virt_pcie_root_port_hpoff);
             qtest_add_func("acpi/virt/pxb", test_acpi_aarch64_virt_tcg_pxb);
             qtest_add_func("acpi/virt/oem-fields",
                            test_acpi_aarch64_virt_oem_fields);

From 84dfc6c07495052c16886f3bf279342fc30e99b0 Mon Sep 17 00:00:00 2001
From: Eric Auger <eric.auger@redhat.com>
Date: Mon, 14 Jul 2025 10:05:19 +0200
Subject: [PATCH 2420/2760] qtest/bios-tables-test: Generate reference blob for
 DSDT.hpoffacpiindex

The disassembled DSDT table is given below

 * Original Table Header:
 *     Signature        "DSDT"
 *     Length           0x000014E3 (5347)
 *     Revision         0x02
 *     Checksum         0x92
 *     OEM ID           "BOCHS "
 *     OEM Table ID     "BXPC    "
 *     OEM Revision     0x00000001 (1)
 *     Compiler ID      "BXPC"
 *     Compiler Version 0x00000001 (1)
 */
DefinitionBlock ("", "DSDT", 2, "BOCHS ", "BXPC    ", 0x00000001)
{
    Scope (\_SB)
    {
        Device (C000)
        {
            Name (_HID, "ACPI0007" /* Processor Device */)  // _HID: Hardware ID
            Name (_UID, Zero)  // _UID: Unique ID
        }

        Device (COM0)
        {
            Name (_HID, "ARMH0011")  // _HID: Hardware ID
            Name (_UID, Zero)  // _UID: Unique ID
            Name (_CRS, ResourceTemplate ()  // _CRS: Current Resource Settings
            {
                Memory32Fixed (ReadWrite,
                    0x09000000,         // Address Base
                    0x00001000,         // Address Length
                    )
                Interrupt (ResourceConsumer, Level, ActiveHigh, Exclusive, ,, )
                {
                    0x00000021,
                }
            })
        }

        Device (FWCF)
        {
            Name (_HID, "QEMU0002")  // _HID: Hardware ID
            Name (_STA, 0x0B)  // _STA: Status
            Name (_CCA, One)  // _CCA: Cache Coherency Attribute
            Name (_CRS, ResourceTemplate ()  // _CRS: Current Resource Settings
            {
                Memory32Fixed (ReadWrite,
                    0x09020000,         // Address Base
                    0x00000018,         // Address Length
                    )
            })
        }

        Device (VR00)
        {
            Name (_HID, "LNRO0005")  // _HID: Hardware ID
            Name (_UID, Zero)  // _UID: Unique ID
            Name (_CCA, One)  // _CCA: Cache Coherency Attribute
            Name (_CRS, ResourceTemplate ()  // _CRS: Current Resource Settings
            {
                Memory32Fixed (ReadWrite,
                    0x0A000000,         // Address Base
                    0x00000200,         // Address Length
                    )
                Interrupt (ResourceConsumer, Level, ActiveHigh, Exclusive, ,, )
                {
                    0x00000030,
                }
            })
        }

../..

        Device (L000)
        {
            Name (_HID, "PNP0C0F" /* PCI Interrupt Link Device */)  // _HID: Hardware ID
            Name (_UID, Zero)  // _UID: Unique ID
            Name (_PRS, ResourceTemplate ()  // _PRS: Possible Resource Settings
            {
                Interrupt (ResourceConsumer, Level, ActiveHigh, Exclusive, ,, )
                {
                    0x00000023,
                }
            })
            Name (_CRS, ResourceTemplate ()  // _CRS: Current Resource Settings
            {
                Interrupt (ResourceConsumer, Level, ActiveHigh, Exclusive, ,, )
                {
                    0x00000023,
                }
            })
            Method (_SRS, 1, NotSerialized)  // _SRS: Set Resource Settings
            {
            }
        }

../..

        Device (PCI0)
        {
            Name (_HID, "PNP0A08" /* PCI Express Bus */)  // _HID: Hardware ID
            Name (_CID, "PNP0A03" /* PCI Bus */)  // _CID: Compatible ID
            Name (_SEG, Zero)  // _SEG: PCI Segment
            Name (_BBN, Zero)  // _BBN: BIOS Bus Number
            Name (_UID, Zero)  // _UID: Unique ID
            Name (_STR, Unicode ("PCIe 0 Device"))  // _STR: Description String
            Name (_CCA, One)  // _CCA: Cache Coherency Attribute
            Name (_PRT, Package (0x80)  // _PRT: PCI Routing Table
            {
                Package (0x04)
                {
                    0xFFFF,
                    Zero,
                    L000,
                    Zero
                },

../..

            })
            Method (_CBA, 0, NotSerialized)  // _CBA: Configuration Base Address
            {
                Return (0x0000004010000000)
            }

            Name (_CRS, ResourceTemplate ()  // _CRS: Current Resource Settings
            {
                WordBusNumber (ResourceProducer, MinFixed, MaxFixed, PosDecode,
                    0x0000,             // Granularity
                    0x0000,             // Range Minimum
                    0x00FF,             // Range Maximum
                    0x0000,             // Translation Offset
                    0x0100,             // Length
                    ,, )
                DWordMemory (ResourceProducer, PosDecode, MinFixed, MaxFixed, NonCacheable, ReadWrite,
                    0x00000000,         // Granularity
                    0x10000000,         // Range Minimum
                    0x3EFEFFFF,         // Range Maximum
                    0x00000000,         // Translation Offset
                    0x2EFF0000,         // Length
                    ,, , AddressRangeMemory, TypeStatic)
                DWordIO (ResourceProducer, MinFixed, MaxFixed, PosDecode, EntireRange,
                    0x00000000,         // Granularity
                    0x00000000,         // Range Minimum
                    0x0000FFFF,         // Range Maximum
                    0x3EFF0000,         // Translation Offset
                    0x00010000,         // Length
                    ,, , TypeStatic, DenseTranslation)
                QWordMemory (ResourceProducer, PosDecode, MinFixed, MaxFixed, NonCacheable, ReadWrite,
                    0x0000000000000000, // Granularity
                    0x0000008000000000, // Range Minimum
                    0x000000FFFFFFFFFF, // Range Maximum
                    0x0000000000000000, // Translation Offset
                    0x0000008000000000, // Length
                    ,, , AddressRangeMemory, TypeStatic)
            })
            Method (_OSC, 4, NotSerialized)  // _OSC: Operating System Capabilities
            {
                CreateDWordField (Arg3, Zero, CDW1)
                If ((Arg0 == ToUUID ("33db4d5b-1ff7-401c-9657-7441c03dd766") /* PCI Host Bridge Device */))
                {
                    CreateDWordField (Arg3, 0x04, CDW2)
                    CreateDWordField (Arg3, 0x08, CDW3)
                    Local0 = CDW3 /* \_SB_.PCI0._OSC.CDW3 */
                    Local0 &= 0x1F
                    If ((Arg1 != One))
                    {
                        CDW1 |= 0x08
                    }

                    If ((CDW3 != Local0))
                    {
                        CDW1 |= 0x10
                    }

                    CDW3 = Local0
                }
                Else
                {
                    CDW1 |= 0x04
                }

                Return (Arg3)
            }

            Method (_DSM, 4, NotSerialized)  // _DSM: Device-Specific Method
            {
                If ((Arg0 == ToUUID ("e5c937d0-3553-4d7a-9117-ea4d19c3434d") /* Device Labeling Interface */))
                {
                    If ((Arg2 == Zero))
                    {
                        Return (Buffer (One)
                        {
                             0x01                                             // .
                        })
                    }
                }

                Return (Buffer (One)
                {
                     0x00                                             // .
                })
            }

            Device (RES0)
            {
                Name (_HID, "PNP0C02" /* PNP Motherboard Resources */)  // _HID: Hardware ID
                Name (_CRS, ResourceTemplate ()  // _CRS: Current Resource Settings
                {
                    QWordMemory (ResourceProducer, PosDecode, MinFixed, MaxFixed, NonCacheable, ReadWrite,
                        0x0000000000000000, // Granularity
                        0x0000004010000000, // Range Minimum
                        0x000000401FFFFFFF, // Range Maximum
                        0x0000000000000000, // Translation Offset
                        0x0000000010000000, // Length
                        ,, , AddressRangeMemory, TypeStatic)
                })
            }
        }

        Device (\_SB.GED)
        {
            Name (_HID, "ACPI0013" /* Generic Event Device */)  // _HID: Hardware ID
            Name (_UID, "GED")  // _UID: Unique ID
            Name (_CRS, ResourceTemplate ()  // _CRS: Current Resource Settings
            {
                Interrupt (ResourceConsumer, Edge, ActiveHigh, Exclusive, ,, )
                {
                    0x00000029,
                }
            })
            OperationRegion (EREG, SystemMemory, 0x09080000, 0x04)
            Field (EREG, DWordAcc, NoLock, WriteAsZeros)
            {
                ESEL,   32
            }

            Method (_EVT, 1, Serialized)  // _EVT: Event
            {
                Local0 = ESEL /* \_SB_.GED_.ESEL */
                If (((Local0 & 0x02) == 0x02))
                {
                    Notify (PWRB, 0x80) // Status Change
                }
            }
        }

        Device (PWRB)
        {
            Name (_HID, "PNP0C0C" /* Power Button Device */)  // _HID: Hardware ID
            Name (_UID, Zero)  // _UID: Unique ID
        }
    }

    Scope (\_SB.PCI0)
    {
        Method (EDSM, 5, Serialized)
        {
            If ((Arg2 == Zero))
            {
                Local0 = Buffer (One)
                    {
                         0x00                                             // .
                    }
                If ((Arg0 != ToUUID ("e5c937d0-3553-4d7a-9117-ea4d19c3434d") /* Device Labeling Interface */))
                {
                    Return (Local0)
                }

                If ((Arg1 < 0x02))
                {
                    Return (Local0)
                }

                Local0 [Zero] = 0x81
                Return (Local0)
            }

            If ((Arg2 == 0x07))
            {
                Local0 = Package (0x02)
                    {
                        Zero,
                        ""
                    }
                Local1 = DerefOf (Arg4 [Zero])
                Local0 [Zero] = Local1
                Return (Local0)
            }
        }

        Device (S00)
        {
            Name (_ADR, Zero)  // _ADR: Address
        }

        Device (S08)
        {
            Name (_ADR, 0x00010000)  // _ADR: Address
        }

        Device (S38)
        {
            Name (_ADR, 0x00070000)  // _ADR: Address
            Device (S00)
            {
                Name (_ADR, Zero)  // _ADR: Address
                Method (_DSM, 4, Serialized)  // _DSM: Device-Specific Method
                {
                    Local0 = Package (0x01)
                        {
                            0x0C
                        }
                    Return (EDSM (Arg0, Arg1, Arg2, Arg3, Local0))
                }
            }
        }
    }
}

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Message-Id: <20250714080639.2525563-36-eric.auger@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 tests/data/acpi/aarch64/virt/DSDT.hpoffacpiindex | Bin 0 -> 5347 bytes
 tests/qtest/bios-tables-test-allowed-diff.h      |   1 -
 2 files changed, 1 deletion(-)

diff --git a/tests/data/acpi/aarch64/virt/DSDT.hpoffacpiindex b/tests/data/acpi/aarch64/virt/DSDT.hpoffacpiindex
index e69de29bb2d1d6434b8b29ae775ad8c2e48c5391..970d43f68bca060361105f70dbb00b3a25646db4 100644
GIT binary patch
literal 5347
zcmZ<>b_sbb!oa{Z$;sc@BUr&HBEVTeK|z6$fq?<U2GIhI4vaDJ!A|kfO;XMV1_m7Q
z9-c0|j?Mv|1_lP^3>@*Ho-Pd0O;*nSzA(8UUk?KVLqn(>N4#@Tu%Hx|cpE1J$Usg8
z0S1OnHU>sUMFs|jN`~kr3%77*H;B1`uD+oL1_nk99Pz;+j$GUv@y^bUj1VIPx%ePP
zFmXyibvm+y1;L!;;}_&_U|?X1uokWpVL2BA6V!48WFrhAwxb#WvKGS#CI*BNhEOA%
zK&~*tW&{@#vIk(!U_mm&2-yr{tY$D{GlLDu3}a+7Ot6~4g3SyLBr{Bq%`nAk1}io*
zxRA^+MK;3>s~K$A%-}&X!wlIBbF5~tV>5#f$qaL3Gc2&0!GX;T0VFdlkj=2fY6d4Z
zGlY=LutYM$5SlqqlNc8lHZw$!%&<Z>18Xux%_OiiCWd5&HL@Al(<u)&cSs<aVS{W2
z_H@dN%?v3dGi;H~z@AR|u$du)WQHBG8Q9Y)KQ=Sukj$`0HUoP)6~JbO0+JaH$Yx+q
zr-InbP(m`p5!npv=~M`t87fF-I3b&XJ)H_;GeZr@3}+-WjIgIu5o~5?AerHUYzFpp
zDvHevEhIBsk<GxKPQ|d9p@U?G8?qVL)2TQ%GxU(ma7Q)+dpecCW`+Th86L=HU{9x#
z*vv3OGQ$(u4D9Jt3Y!@wNM?8;n}I!@N@Fv_49N^{WHYd*QyFY#SRk3<gKP%&bSjI@
z3@aove38sB#-2{)u$f_lWQHHI8Q9aQJT^1zkj(Ihn&HXf18)!o_yrg^8@Rz69|1wZ
zf_z-u;C7BOSUsc>gDNJ%79SiG%oyDSHVWz-6r&h9;*pI~!D19d3~rPc$W_qXgJKk@
zF@kKCDi*UKVyI?8a}lap%&6{C!(tXh3}M!!0B28VtbxpOG_YXch<EmM;f3&wL2W))
zcLt7lCnrC6I0lCV3CeTH1TZ)=crv6iC@>f>C@{D%q%xE-WHKZ(q%tso3;{RO0)j$>
zeTumngt%F_|NmzI#SH_5&FEubV8|fE0}|(A@&UCkp&Vu(0|R3QAzl`q|Nj{oKza<}
zJdiFU1|dF(99W+*f(z1V09DHb)@cOifpo%@GBJR48bEb2F>rx&!fas%>x8+0nE|8|
zrj!|?(-5kY8KM(r3kz5$%mpl9oiL>=5S=i`vp{shY+(iKgt>qftP`e`6`~X7cvgr`
zm@RBzoiG=$fpx-^vO#ph9M1;P3A2SAtP|z}cCb#EQg(<=nB&<YI$^eOfOW!Lzya0?
zQ_2C+33EILL?_G^POwgx3pl|#VM;k6I$@6Igy@9X!Ufg|a{(7vCrl|9L?_JgTo9cw
zTe!hGVJ_eX>x3!ghUkPjo*SYQW(yBkC(H#rV4X0fJP@5Q$MZmR!ffFM>x8+07pxPe
zloz5C=6GI+PM9rxV4W}*@PT#0l=4Az!W_>B(FwDKAFLDR0)DVgm{NX-PMG8QAv$5U
z2!M6MTp$3}2~#Qn(Ft?B07NIu7D2F1m<t5KI$=r$Av$4>7li19*&+ni33GuESSL)W
z5JV@;@j?)tFk6JdI$<sl2J3_=6^7`9IbIl|6K0DDSSQQ{B4C{`r6LfWFvp8Pbi!;A
z1?z;lKoqPKrc@N76XtkPh)$R-Vql#x7l?s%!jy_Zbiy1j2GI$#MI5XX<^plBPMA`0
zh)$T}#UVOjwn%_=!dxH$)(KN80nrI_yaYri%oa(oPM8ZM!8&0|B_TRtj+cb!gxMkm
z)(LZg6j&!rsT4#f%<)nXoiJOZ!8&0skOu37DV2ukggIUsq7!C|3|J@31u|frFr_jO
zoiNACKy<=vkp=67xj+`I6Q)!aq7&wLS%^-UEplL;Fc-*yb;6X&L3F|#F9*>Hvqc`P
z6XpVWuuhm#d5BJ!<K-bbjTl4(;+>rw8J6%dFfa&!`Ztgkiw8SbNe3?j6AuFj{09+?
z?cxj!JfOiG5KrL$|9_xv83O~uf4z2b21XuckT3}U2P^+?$H2hI(4~!}2PDbR0MhaQ
zKSU8&1VVtsD;Y$5*yH_!omslF8Ju0h4Hx*aPR<Y%<`RhZy>0wmUdCZsc!}cy+v{mv
z*<38nF5yO9*<2jXF5$)nAR?hUflEGNfxx86nT)j{?O-{>1;UdigQX#20w9@!1dzx=
z9*7XgD8nV$BD(P|!M-dD6d`tAFhBV;*tE)bqWCLc$-~aR3pgidF)R^eW@H2r4AD)#
zEJ3cpNR1n3@DLVg;LDiH0K@0t(Eb1azdR_EA$|sv0w5AJBId*%qX!yub9Z%#hm1Wy
z2HXrmjigXd7hZQ)7f`zg-pFKT)C9M{q8nU;T-_OX7#KJ>xmcnbxj|fK*I-v41rgbJ
z*RT-I0uU!*fxzVI1TIk9q%9yk$cd{Vx=9kmfLI1<kU1MTLmOcNKHL!3fZA^&-mI=J
z!M?l;%qC|s6bLdiG9)aJnuI-+mLx1-pPI?Vv?QT`tFa@2fniC)0-4EKT<irxtV|5N
z3<(9z9XSjPi3N!e$>=8TU;~4Aj(A6xAcp8B{$K+O2!{uhexjR9f{hUZ><rOO$_V8m
Y;-CoQDG*{|<l;$K0&-(UW>$6r00#{qJpcdz

literal 0
HcmV?d00001

diff --git a/tests/qtest/bios-tables-test-allowed-diff.h b/tests/qtest/bios-tables-test-allowed-diff.h
index 02f4f0b29f..dc3ab24d05 100644
--- a/tests/qtest/bios-tables-test-allowed-diff.h
+++ b/tests/qtest/bios-tables-test-allowed-diff.h
@@ -1,3 +1,2 @@
 /* List of comma-separated changed AML files to ignore */
 "tests/data/acpi/aarch64/virt/DSDT.acpipcihp",
-"tests/data/acpi/aarch64/virt/DSDT.hpoffacpiindex",

From 14e37f46b1762224f215df884d2f1547ff7198ae Mon Sep 17 00:00:00 2001
From: Eric Auger <eric.auger@redhat.com>
Date: Mon, 14 Jul 2025 10:05:20 +0200
Subject: [PATCH 2421/2760] qtest/bios-tables-test: Generate reference blob for
 DSDT.acpipcihp

The disassembled DSDT table is given below.

/*
 * Intel ACPI Component Architecture
 * AML/ASL+ Disassembler version 20210604 (64-bit version)
 * Copyright (c) 2000 - 2021 Intel Corporation
 *
 * Disassembling to symbolic ASL+ operators
 *
 * Disassembly of ../tests/data/acpi/aarch64/virt/DSDT.acpipcihp, Thu Jul  3 05:16:27 2025
 *
 * Original Table Header:
 *     Signature        "DSDT"
 *     Length           0x0000183A (6202)
 *     Revision         0x02
 *     Checksum         0x98
 *     OEM ID           "BOCHS "
 *     OEM Table ID     "BXPC    "
 *     OEM Revision     0x00000001 (1)
 *     Compiler ID      "BXPC"
 *     Compiler Version 0x00000001 (1)
 */
DefinitionBlock ("", "DSDT", 2, "BOCHS ", "BXPC    ", 0x00000001)
{
    Scope (\_SB)
    {
        Device (C000)
        {
            Name (_HID, "ACPI0007" /* Processor Device */)  // _HID: Hardware ID
            Name (_UID, Zero)  // _UID: Unique ID
        }

        Device (COM0)
        {
            Name (_HID, "ARMH0011")  // _HID: Hardware ID
            Name (_UID, Zero)  // _UID: Unique ID
            Name (_CRS, ResourceTemplate ()  // _CRS: Current Resource Settings
            {
                Memory32Fixed (ReadWrite,
                    0x09000000,         // Address Base
                    0x00001000,         // Address Length
                    )
                Interrupt (ResourceConsumer, Level, ActiveHigh, Exclusive, ,, )
                {
                    0x00000021,
                }
            })
        }

        Device (FWCF)
        {
            Name (_HID, "QEMU0002")  // _HID: Hardware ID
            Name (_STA, 0x0B)  // _STA: Status
            Name (_CCA, One)  // _CCA: Cache Coherency Attribute
            Name (_CRS, ResourceTemplate ()  // _CRS: Current Resource Settings
            {
                Memory32Fixed (ReadWrite,
                    0x09020000,         // Address Base
                    0x00000018,         // Address Length
                    )
            })
        }

        Device (VR00)
        {
            Name (_HID, "LNRO0005")  // _HID: Hardware ID
            Name (_UID, Zero)  // _UID: Unique ID
            Name (_CCA, One)  // _CCA: Cache Coherency Attribute
            Name (_CRS, ResourceTemplate ()  // _CRS: Current Resource Settings
            {
                Memory32Fixed (ReadWrite,
                    0x0A000000,         // Address Base
                    0x00000200,         // Address Length
                    )
                Interrupt (ResourceConsumer, Level, ActiveHigh, Exclusive, ,, )
                {
                    0x00000030,
                }
            })
        }

../..

        Device (L000)
        {
            Name (_HID, "PNP0C0F" /* PCI Interrupt Link Device */)  // _HID: Hardware ID
            Name (_UID, Zero)  // _UID: Unique ID
            Name (_PRS, ResourceTemplate ()  // _PRS: Possible Resource Settings
            {
                Interrupt (ResourceConsumer, Level, ActiveHigh, Exclusive, ,, )
                {
                    0x00000023,
                }
            })
            Name (_CRS, ResourceTemplate ()  // _CRS: Current Resource Settings
            {
                Interrupt (ResourceConsumer, Level, ActiveHigh, Exclusive, ,, )
                {
                    0x00000023,
                }
            })
            Method (_SRS, 1, NotSerialized)  // _SRS: Set Resource Settings
            {
            }
        }

../..

        Device (PCI0)
        {
            Name (_HID, "PNP0A08" /* PCI Express Bus */)  // _HID: Hardware ID
            Name (_CID, "PNP0A03" /* PCI Bus */)  // _CID: Compatible ID
            Name (_SEG, Zero)  // _SEG: PCI Segment
            Name (_BBN, Zero)  // _BBN: BIOS Bus Number
            Name (_UID, Zero)  // _UID: Unique ID
            Name (_STR, Unicode ("PCIe 0 Device"))  // _STR: Description String
            Name (_CCA, One)  // _CCA: Cache Coherency Attribute
            Name (_PRT, Package (0x80)  // _PRT: PCI Routing Table
            {
                Package (0x04)
                {
                    0xFFFF,
                    Zero,
                    L000,
                    Zero
                },

../..

            })
            Method (_CBA, 0, NotSerialized)  // _CBA: Configuration Base Address
            {
                Return (0x0000004010000000)
            }

            Name (_CRS, ResourceTemplate ()  // _CRS: Current Resource Settings
            {
                WordBusNumber (ResourceProducer, MinFixed, MaxFixed, PosDecode,
                    0x0000,             // Granularity
                    0x0000,             // Range Minimum
                    0x00FF,             // Range Maximum
                    0x0000,             // Translation Offset
                    0x0100,             // Length
                    ,, )
                DWordMemory (ResourceProducer, PosDecode, MinFixed, MaxFixed, NonCacheable, ReadWrite,
                    0x00000000,         // Granularity
                    0x10000000,         // Range Minimum
                    0x3EFEFFFF,         // Range Maximum
                    0x00000000,         // Translation Offset
                    0x2EFF0000,         // Length
                    ,, , AddressRangeMemory, TypeStatic)
                DWordIO (ResourceProducer, MinFixed, MaxFixed, PosDecode, EntireRange,
                    0x00000000,         // Granularity
                    0x00000000,         // Range Minimum
                    0x0000FFFF,         // Range Maximum
                    0x3EFF0000,         // Translation Offset
                    0x00010000,         // Length
                    ,, , TypeStatic, DenseTranslation)
                QWordMemory (ResourceProducer, PosDecode, MinFixed, MaxFixed, NonCacheable, ReadWrite,
                    0x0000000000000000, // Granularity
                    0x0000008000000000, // Range Minimum
                    0x000000FFFFFFFFFF, // Range Maximum
                    0x0000000000000000, // Translation Offset
                    0x0000008000000000, // Length
                    ,, , AddressRangeMemory, TypeStatic)
            })
            Method (_OSC, 4, NotSerialized)  // _OSC: Operating System Capabilities
            {
                CreateDWordField (Arg3, Zero, CDW1)
                If ((Arg0 == ToUUID ("33db4d5b-1ff7-401c-9657-7441c03dd766") /* PCI Host Bridge Device */))
                {
                    CreateDWordField (Arg3, 0x04, CDW2)
                    CreateDWordField (Arg3, 0x08, CDW3)
                    Local0 = CDW3 /* \_SB_.PCI0._OSC.CDW3 */
                    Local0 &= 0x1E
                    If ((Arg1 != One))
                    {
                        CDW1 |= 0x08
                    }

                    If ((CDW3 != Local0))
                    {
                        CDW1 |= 0x10
                    }

                    CDW3 = Local0
                }
                Else
                {
                    CDW1 |= 0x04
                }

                Return (Arg3)
            }

            Method (_DSM, 4, NotSerialized)  // _DSM: Device-Specific Method
            {
                If ((Arg0 == ToUUID ("e5c937d0-3553-4d7a-9117-ea4d19c3434d") /* Device Labeling Interface */))
                {
                    If ((Arg2 == Zero))
                    {
                        Return (Buffer (One)
                        {
                             0x01                                             // .
                        })
                    }
                }

                Return (Buffer (One)
                {
                     0x00                                             // .
                })
            }

            Device (RES0)
            {
                Name (_HID, "PNP0C02" /* PNP Motherboard Resources */)  // _HID: Hardware ID
                Name (_CRS, ResourceTemplate ()  // _CRS: Current Resource Settings
                {
                    QWordMemory (ResourceProducer, PosDecode, MinFixed, MaxFixed, NonCacheable, ReadWrite,
                        0x0000000000000000, // Granularity
                        0x0000004010000000, // Range Minimum
                        0x000000401FFFFFFF, // Range Maximum
                        0x0000000000000000, // Translation Offset
                        0x0000000010000000, // Length
                        ,, , AddressRangeMemory, TypeStatic)
                })
            }
        }

        Device (\_SB.GED)
        {
            Name (_HID, "ACPI0013" /* Generic Event Device */)  // _HID: Hardware ID
            Name (_UID, "GED")  // _UID: Unique ID
            Name (_CRS, ResourceTemplate ()  // _CRS: Current Resource Settings
            {
                Interrupt (ResourceConsumer, Edge, ActiveHigh, Exclusive, ,, )
                {
                    0x00000029,
                }
            })
            OperationRegion (EREG, SystemMemory, 0x09080000, 0x04)
            Field (EREG, DWordAcc, NoLock, WriteAsZeros)
            {
                ESEL,   32
            }

            Method (_EVT, 1, Serialized)  // _EVT: Event
            {
                Local0 = ESEL /* \_SB_.GED_.ESEL */
                If (((Local0 & 0x02) == 0x02))
                {
                    Notify (PWRB, 0x80) // Status Change
                }

                If (((Local0 & 0x10) == 0x10))
                {
                    Acquire (\_SB.PCI0.BLCK, 0xFFFF)
                    \_SB.PCI0.PCNT ()
                    Release (\_SB.PCI0.BLCK)
                }
            }
        }

        Device (PWRB)
        {
            Name (_HID, "PNP0C0C" /* Power Button Device */)  // _HID: Hardware ID
            Name (_UID, Zero)  // _UID: Unique ID
        }
    }

    Scope (_SB.PCI0)
    {
        OperationRegion (PCST, SystemMemory, 0x090C0000, 0x08)
        Field (PCST, DWordAcc, NoLock, WriteAsZeros)
        {
            PCIU,   32,
            PCID,   32
        }

        OperationRegion (SEJ, SystemMemory, 0x090C0008, 0x04)
        Field (SEJ, DWordAcc, NoLock, WriteAsZeros)
        {
            B0EJ,   32
        }

        OperationRegion (BNMR, SystemMemory, 0x090C0010, 0x08)
        Field (BNMR, DWordAcc, NoLock, WriteAsZeros)
        {
            BNUM,   32,
            PIDX,   32
        }

        Mutex (BLCK, 0x00)
        Method (PCEJ, 2, NotSerialized)
        {
            Acquire (BLCK, 0xFFFF)
            BNUM = Arg0
            B0EJ = (One << Arg1)
            Release (BLCK)
            Return (Zero)
        }

        Method (AIDX, 2, NotSerialized)
        {
            Acquire (BLCK, 0xFFFF)
            BNUM = Arg0
            PIDX = (One << Arg1)
            Local0 = PIDX /* \_SB_.PCI0.PIDX */
            Release (BLCK)
            Return (Local0)
        }

        Method (PDSM, 5, Serialized)
        {
            If ((Arg2 == Zero))
            {
                Local0 = Buffer (One)
                    {
                         0x00                                             // .
                    }
                If ((Arg0 != ToUUID ("e5c937d0-3553-4d7a-9117-ea4d19c3434d") /* Device Labeling Interface */))
                {
                    Return (Local0)
                }

                If ((Arg1 < 0x02))
                {
                    Return (Local0)
                }

                Local1 = Zero
                Local2 = AIDX (DerefOf (Arg4 [Zero]), DerefOf (Arg4 [One]
                    ))
                If (!((Local2 == Zero) | (Local2 == 0xFFFFFFFF)))
                {
                    Local1 |= One
                    Local1 |= (One << 0x07)
                }

                Local0 [Zero] = Local1
                Return (Local0)
            }

            If ((Arg2 == 0x07))
            {
                Local2 = AIDX (DerefOf (Arg4 [Zero]), DerefOf (Arg4 [One]
                    ))
                Local0 = Package (0x02) {}
                If (!((Local2 == Zero) || (Local2 == 0xFFFFFFFF)))
                {
                    Local0 [Zero] = Local2
                    Local0 [One] = ""
                }

                Return (Local0)
            }
        }
    }

    Scope (\_SB.PCI0)
    {
        Method (EDSM, 5, Serialized)
        {
            If ((Arg2 == Zero))
            {
                Local0 = Buffer (One)
                    {
                         0x00                                             // .
                    }
                If ((Arg0 != ToUUID ("e5c937d0-3553-4d7a-9117-ea4d19c3434d") /* Device Labeling Interface */))
                {
                    Return (Local0)
                }

                If ((Arg1 < 0x02))
                {
                    Return (Local0)
                }

                Local0 [Zero] = 0x81
                Return (Local0)
            }

            If ((Arg2 == 0x07))
            {
                Local0 = Package (0x02)
                    {
                        Zero,
                        ""
                    }
                Local1 = DerefOf (Arg4 [Zero])
                Local0 [Zero] = Local1
                Return (Local0)
            }
        }

        Device (S00)
        {
            Name (_ADR, Zero)  // _ADR: Address
        }

        Device (S08)
        {
            Name (_ADR, 0x00010000)  // _ADR: Address
        }

        Device (S38)
        {
            Name (_ADR, 0x00070000)  // _ADR: Address
            Device (S00)
            {
                Name (_ADR, Zero)  // _ADR: Address
            }

            Name (BSEL, One)
            Scope (S00)
            {
                Name (ASUN, Zero)
                Method (_DSM, 4, Serialized)  // _DSM: Device-Specific Method
                {
                    Local0 = Package (0x02)
                        {
                            Zero,
                            Zero
                        }
                    Local0 [Zero] = BSEL /* \_SB_.PCI0.S38_.BSEL */
                    Local0 [One] = ASUN /* \_SB_.PCI0.S38_.S00_.ASUN */
                    Return (PDSM (Arg0, Arg1, Arg2, Arg3, Local0))
                }

                Name (_SUN, Zero)  // _SUN: Slot User Number
                Method (_EJ0, 1, NotSerialized)  // _EJx: Eject Device, x=0-9
                {
                    PCEJ (BSEL, _SUN)
                }
            }

            Method (DVNT, 2, NotSerialized)
            {
                If ((Arg0 & One))
                {
                    Notify (S00, Arg1)
                }
            }
        }

        Name (BSEL, Zero)
        Scope (S00)
        {
            Name (ASUN, Zero)
            Method (_DSM, 4, Serialized)  // _DSM: Device-Specific Method
            {
                Local0 = Package (0x02)
                    {
                        Zero,
                        Zero
                    }
                Local0 [Zero] = BSEL /* \_SB_.PCI0.BSEL */
                Local0 [One] = ASUN /* \_SB_.PCI0.S00_.ASUN */
                Return (PDSM (Arg0, Arg1, Arg2, Arg3, Local0))
            }

            Name (_SUN, Zero)  // _SUN: Slot User Number
            Method (_EJ0, 1, NotSerialized)  // _EJx: Eject Device, x=0-9
            {
                PCEJ (BSEL, _SUN)
            }
        }

        Scope (S08)
        {
            Name (ASUN, One)
            Method (_DSM, 4, Serialized)  // _DSM: Device-Specific Method
            {
                Local0 = Package (0x02)
                    {
                        Zero,
                        Zero
                    }
                Local0 [Zero] = BSEL /* \_SB_.PCI0.BSEL */
                Local0 [One] = ASUN /* \_SB_.PCI0.S08_.ASUN */
                Return (PDSM (Arg0, Arg1, Arg2, Arg3, Local0))
            }

            Name (_SUN, One)  // _SUN: Slot User Number
            Method (_EJ0, 1, NotSerialized)  // _EJx: Eject Device, x=0-9
            {
                PCEJ (BSEL, _SUN)
            }
        }

        Method (DVNT, 2, NotSerialized)
        {
            If ((Arg0 & One))
            {
                Notify (S00, Arg1)
            }

            If ((Arg0 & 0x02))
            {
                Notify (S08, Arg1)
            }
        }

        Device (PHPR)
        {
            Name (_HID, "PNP0A06" /* Generic Container Device */)  // _HID: Hardware ID
            Name (_UID, "PCI Hotplug resources")  // _UID: Unique ID
            Name (_STA, 0x0B)  // _STA: Status
            Name (_CRS, ResourceTemplate ()  // _CRS: Current Resource Settings
            {
                IO (Decode16,
                    0x0000,             // Range Minimum
                    0x0000,             // Range Maximum
                    0x01,               // Alignment
                    0x18,               // Length
                    )
            })
        }

        Scope (S38)
        {
            Method (PCNT, 0, NotSerialized)
            {
                BNUM = One
                DVNT (PCIU, One)
                DVNT (PCID, 0x03)
            }
        }

        Method (PCNT, 0, NotSerialized)
        {
            BNUM = Zero
            DVNT (PCIU, One)
            DVNT (PCID, 0x03)
            ^S38.PCNT ()
        }
    }
}

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Message-Id: <20250714080639.2525563-37-eric.auger@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 tests/data/acpi/aarch64/virt/DSDT.acpipcihp | Bin 0 -> 6202 bytes
 tests/qtest/bios-tables-test-allowed-diff.h |   1 -
 2 files changed, 1 deletion(-)

diff --git a/tests/data/acpi/aarch64/virt/DSDT.acpipcihp b/tests/data/acpi/aarch64/virt/DSDT.acpipcihp
index e69de29bb2d1d6434b8b29ae775ad8c2e48c5391..8d55a877a40cb4c4dffdc70378204e12d2261a75 100644
GIT binary patch
literal 6202
zcmZ<>b_ubPU|?XH;pFe^5v<@85#X$#prF9Wz`y`vgJ^+%XU3TLV5j)#CMjnF0|SnD
z4^J0fN9O=f0|Ntd29EepPZx&hCM#!uUzl8wuZMwwp&?X`Bi=bESWt>fyp59qWFRMl
z00ToO8v`SwA_D_MB|~(Rg<H6@8^qi|SKm+r0|O%lj`-jZM=oxTcxPuvMu-uDTzn8C
zm^dY%IvrWUf?!Va@eA@dFfcGhSPR#Qu$+s532M0kvJr+5+fj`GS&Lx=69d8sL#Po>
zAXgY+GlGi=*#j_VuppUXglvW}Rx_BfnZbr+hB2}kCRoj2!Da>rk{Kq*W|(3%gB6<@
zTu5e^BAa1`)eJUlX7C`HVTNpmIaV{+v6;b#WQIAi85UU0;J{{v0FoIN$Yxk#HG>nI
z8A3>ASR$EW2+bU*NsNmNn;9ZVW>_Jcfi;<;W)fH$6GJk?8rcl&>68bXJ0y_Iut7Eh
zdphOCW`-1!8Meq~U{9xf*vybYGQ$qp4D9KYADbC+NM_h0n}I!@3Scus0m%#pWHYd*
zQ$cKIC?T2Qh-?P-bSi|+3>73ZoRH1Ho=%0anW2VchBJ~GM%dG-2sSe`kj!vFHUoP)
z6~$(T7LpmR$Yx+qr()R5&_Oc84cQFr=~Nt>8G1-&xFef^J)KHmGs6JM3=d>8u%}Z=
zY-SiCnc<0S2KIC+h0P2TBs08_&A^^crLmb|hGd2}vKiRZsSGwVERf9bK{f+>I+ev{
zh82<-zDQ;mV^61Y*vzm&GQ$tq4D9Jt9-A3<NM`s$&G2OLfj5W(`~nP|4cy?3kAR?H
zK|U^Sa63mCtRB*cK@}5Wiw_P8W{hqE8wGU^icyRl@yJH0U@;0J1~<wJ<SJ<HK`{!{
z7(q5m6^mIAF;uglxd_!PW>j~nVKECLhA?YVfU_qw)<9-C8dxxJ#5;Ss@IrXTpf;bY
zI|E0&lan7j9D_rG1m(G80vMbbJQ-3M6c`K`6c}6>QW?q^G8vK?QW+RPhJc%C0YM?c
zKE+%OLfkCe|Nk?9;)VgjX7n*IFk}$o0f}=l`GDG&P!6+?fq^lD5HAbQ|No2(AU%d~
z9!QrFgAgA?4y?}@!3F6wfU0Ez>okJ%KssScnHa!24WK%i7`Q+>VYV=Xb;4Z0%mC5}
zQ_2j{X$aNH4ABX*g$1k=<^mS5PMA^_h)$T}Ss*%Lwy=VA!d$=#)(KO}3egF3JS#*e
z%oaAVPM8bWz&c?{*&sS$j%S1DgxSIl)(LX~J6I=7DLX_b%<=3HoiJNCz&c?r-~j7{
zDdm9ZggKrAq7!BdCs-%U1)N}=Fr}OjoiN99LUh7x;R5S~xqu6-6Q-04q7&wLE{IN;
zE!<$8Fc)xxb;6W#Lv+F%&kfNDvxNt&6XpUQuuhm#9*9nu<9Q%DVYcvsb;4Z03)Tr!
z$_vp6b389ZC(IT;uuhl@_`o`0O8Fo<VUFj6=!DtA57r5D0Y6wLOesG^C(QBu5S=hv
z1i(6BE)W3ggeet(=!7|50HPCSiy&Ah%mspAoiL?>5S=i`3qo|lY!L$Mgt<TntP`eG
z2%;0_cp->Rm@UF!oiG;&gLT4`3PW_l94`#f3A056tP|z}5wK2}QW1zwnBzqtI$^em
zf_1`NAPUwAQz{D433I$CL?_G^F|baU3&g-WVM@gyI$@3%gXo0WA`aFGbAdQmCrqh0
zL?_Jg;t-uMTO`0bVJ?sW>x3zlfarudUIL;MW{V_PC(H$sV4X0fk`SFR$4f$V!fcTO
z>x8*L3ak^RR0^UK=6ETHPM9syV4W}*NP~64luAQ%!W=IR(FwCf2CNh20vWJQm{J*t
zPMG6mAUa{T$bxmkTp$b92~#Qy(Ft?BEJP>F7CEp^m<!~<I$=uXAUa`=mxJhp*&+|t
z33GuwSSL)WJVYnV@$wLzMhqeX@y<?;3`_VJ7#IXV{ToP&#e<!zq=T1%iH89M{(}g{
zc5wy<9?)P8h$ry>|36T-jDdmSzh1jI10xSJNEn3wgO&fcV_;xp=+Z{g1CnHD0O|Pu
zAEF2>0wF-+l?)<2?D77=&MaNo49+g$h70^yCuax>a|uNI-ZuU&FXJ#Ryu|T<?e(;-
zY%UgOmvE!5Y%UIGmvG|(5Rp)wz$KTkKw#43OvYM}cCeh`0^v!M!O{>h0gy~V0!U;b
z4@3xLl;M(W5#4x~U|*I6iV!<5n4f$aY+B_zQT&y!<Y8yu1)P(!7?ub!Gctk*hUg|=
zmLS()q{fXicnAwL@MX+pfZ=m+=>GrzUmg_75I=)S0T2lq5p&><(F2XSxx2c=L&hE;
z18#<(MpCG!3$MGY3#i=#Z)7qvYJyu}(G9LauI>yx3=ABcTrAOz+#s&AYp|=2f`~V3
zylYqpX90+pus~pPbpjWtancqL9^}N;u)qc+Ai%&S5Um`e&kV91)LwJ)arXZIA4wp<
z*)Jqo9Z3MBBDzTuWD3Nopyr&jfituTC*UFm_6o?b=!O92;1H1OcsRK@q8kN3T;~91
z&rpQ`XHOS}=!RfduXqL?4h9~G>p@&+Cj(b6h3Ez+Ki?n*9s!UPNGpiz?Bo~fs}SJn
z5}^>y2yzF5h-!eds~1zWGKly8e?bOFML{KFCIiTnXmybA5(W`%M^BdsY^p$J6@Z8Y
zsM-V(7p?%8U|-$^E^L#t7zzZL85t55NKL|?E|w%LV4s@F#k3@$fFZE}WJz;J4g*7T
zM-C%H(gLYTwUd(=CMWTL(|m0rV`6P$B_kI*Lt;T<M*;)Gl7t23le4(k(KQwbF)@Mc
zoQTj}kOb0Dz{}8)z{s#9LBK&Bl3+lgEaJ`T3U;v>Ne<>}1R1#`VSx<T4MMC;47>~p
z1z-=r9T?rj9c*9_&k^tF62uVQ#2;*60paj~vUqfp8%MA)LWG?GMLma8u&WQFfIkb^
z2*==1KL!y^P(I@+5Mp6sU`QwcDFC^m03-?a8Yt{DGPAN1IO4(Th2mYk3>ZO?3{ndc
z6A^L=^9x~Gz+Iie$j}BdIumRW1GOyzn`aTv0dgB7i4JEJ!Qyav42Lh^sm|bH0{Oxs
zJ~O(>izUD#APAAG91YAMxr#Ty*;BzIzoa0iG+m)6wK%`DC^@wl)PaHyng<07@^W#x
xgNtZJiAn|mRZzT$$b)h(LjfZwSAZ-BWj#hH!-b1kL=z&<fI~h`4`d2R4FFRE3QPb1

literal 0
HcmV?d00001

diff --git a/tests/qtest/bios-tables-test-allowed-diff.h b/tests/qtest/bios-tables-test-allowed-diff.h
index dc3ab24d05..dfb8523c8b 100644
--- a/tests/qtest/bios-tables-test-allowed-diff.h
+++ b/tests/qtest/bios-tables-test-allowed-diff.h
@@ -1,2 +1 @@
 /* List of comma-separated changed AML files to ignore */
-"tests/data/acpi/aarch64/virt/DSDT.acpipcihp",

From ce1b67acd6fa6b3cc959340b2b45a96b1b809c76 Mon Sep 17 00:00:00 2001
From: Yicong Yang <yangyicong@hisilicon.com>
Date: Mon, 14 Jul 2025 18:31:43 +0100
Subject: [PATCH 2422/2760] tests: virt: Allow changes to PPTT test table

Allow changes to PPTT test table, preparing for adding identical
implementation flags support and for adding a root node for all
the system.

This is related to both loongarch64 and aarch64.

Signed-off-by: Yicong Yang <yangyicong@hisilicon.com>
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Alireza Sanaee <alireza.sanaee@huawei.com>
Message-Id: <20250714173146.511-2-alireza.sanaee@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 tests/qtest/bios-tables-test-allowed-diff.h | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/tests/qtest/bios-tables-test-allowed-diff.h b/tests/qtest/bios-tables-test-allowed-diff.h
index dfb8523c8b..5c3ff47748 100644
--- a/tests/qtest/bios-tables-test-allowed-diff.h
+++ b/tests/qtest/bios-tables-test-allowed-diff.h
@@ -1 +1,6 @@
 /* List of comma-separated changed AML files to ignore */
+"tests/data/acpi/aarch64/virt/PPTT",
+"tests/data/acpi/aarch64/virt/PPTT.acpihmatvirt",
+"tests/data/acpi/aarch64/virt/PPTT.topology",
+"tests/data/acpi/loongarch64/virt/PPTT",
+"tests/data/acpi/loongarch64/virt/PPTT.topology",

From ec57e4778e3c64d17d57e629a0c37209ff36900b Mon Sep 17 00:00:00 2001
From: Yicong Yang <yangyicong@hisilicon.com>
Date: Mon, 14 Jul 2025 18:31:44 +0100
Subject: [PATCH 2423/2760] hw/acpi/aml-build: Set identical implementation
 flag for PPTT processor nodes

Per ACPI 6.5 Table 5.158: Processor Structure Flags, the identical
implementation flag indicates whether all the children processors
of this node share the same identical implementation revision.
Currently Linux support parsing this field [1] and maybe used to
identify the heterogeneous platform. Since qemu only support
homogeneous emulation, set this flag for all the processor node
to indicates the facts when building the PPTT table. Node leaf
is an exception since spec says this flag should be ignored
on leaf nodes by OSPM.

[1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/drivers/acpi/pptt.c?h=v6.11-rc1#n810

Signed-off-by: Yicong Yang <yangyicong@hisilicon.com>
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Alireza Sanaee <alireza.sanaee@huawei.com>
Message-Id: <20250714173146.511-3-alireza.sanaee@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/acpi/aml-build.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/hw/acpi/aml-build.c b/hw/acpi/aml-build.c
index cb817a0f31..9b9be4ea0f 100644
--- a/hw/acpi/aml-build.c
+++ b/hw/acpi/aml-build.c
@@ -2172,7 +2172,8 @@ void build_pptt(GArray *table_data, BIOSLinker *linker, MachineState *ms,
             core_id = -1;
             socket_offset = table_data->len - pptt_start;
             build_processor_hierarchy_node(table_data,
-                (1 << 0), /* Physical package */
+                (1 << 0) | /* Physical package */
+                (1 << 4), /* Identical Implementation */
                 0, socket_id, NULL, 0);
         }
 
@@ -2183,7 +2184,8 @@ void build_pptt(GArray *table_data, BIOSLinker *linker, MachineState *ms,
                 core_id = -1;
                 cluster_offset = table_data->len - pptt_start;
                 build_processor_hierarchy_node(table_data,
-                    (0 << 0), /* Not a physical package */
+                    (0 << 0) | /* Not a physical package */
+                    (1 << 4), /* Identical Implementation */
                     socket_offset, cluster_id, NULL, 0);
             }
         } else {
@@ -2201,7 +2203,8 @@ void build_pptt(GArray *table_data, BIOSLinker *linker, MachineState *ms,
                 core_id = cpus->cpus[n].props.core_id;
                 core_offset = table_data->len - pptt_start;
                 build_processor_hierarchy_node(table_data,
-                    (0 << 0), /* Not a physical package */
+                    (0 << 0) | /* Not a physical package */
+                    (1 << 4), /* Identical Implementation */
                     cluster_offset, core_id, NULL, 0);
             }
 

From 9bf96fc2df494053bcd8697b5c5ad8954bf3510f Mon Sep 17 00:00:00 2001
From: Yicong Yang <yangyicong@hisilicon.com>
Date: Mon, 14 Jul 2025 18:31:45 +0100
Subject: [PATCH 2424/2760] hw/acpi/aml-build: Build a root node in the PPTT
 table

Currently we build the PPTT starting from the socket node and each
socket will be a separate tree. For a multi-socket system it'll
be hard for the OS to know the whole system is homogeneous or not
(actually we're in the current implementation) since no parent node
to telling the identical implementation informentation. Add a
root node for indicating this.

Signed-off-by: Yicong Yang <yangyicong@hisilicon.com>
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Alireza Sanaee <alireza.sanaee@huawei.com>
Message-Id: <20250714173146.511-4-alireza.sanaee@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/acpi/aml-build.c | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/hw/acpi/aml-build.c b/hw/acpi/aml-build.c
index 9b9be4ea0f..1e685f982f 100644
--- a/hw/acpi/aml-build.c
+++ b/hw/acpi/aml-build.c
@@ -2152,12 +2152,25 @@ void build_pptt(GArray *table_data, BIOSLinker *linker, MachineState *ms,
     int64_t socket_id = -1, cluster_id = -1, core_id = -1;
     uint32_t socket_offset = 0, cluster_offset = 0, core_offset = 0;
     uint32_t pptt_start = table_data->len;
+    uint32_t root_offset;
     int n;
     AcpiTable table = { .sig = "PPTT", .rev = 2,
                         .oem_id = oem_id, .oem_table_id = oem_table_id };
 
     acpi_table_begin(&table, table_data);
 
+    /*
+     * Build a root node for all the processor nodes. Otherwise when
+     * building a multi-socket system each socket tree is separated
+     * and will be hard for the OS like Linux to know whether the
+     * system is homogeneous.
+     */
+    root_offset = table_data->len - pptt_start;
+    build_processor_hierarchy_node(table_data,
+        (1 << 0) | /* Physical package */
+        (1 << 4), /* Identical Implementation */
+        0, 0, NULL, 0);
+
     /*
      * This works with the assumption that cpus[n].props.*_id has been
      * sorted from top to down levels in mc->possible_cpu_arch_ids().
@@ -2174,7 +2187,7 @@ void build_pptt(GArray *table_data, BIOSLinker *linker, MachineState *ms,
             build_processor_hierarchy_node(table_data,
                 (1 << 0) | /* Physical package */
                 (1 << 4), /* Identical Implementation */
-                0, socket_id, NULL, 0);
+                root_offset, socket_id, NULL, 0);
         }
 
         if (mc->smp_props.clusters_supported && mc->smp_props.has_clusters) {

From 98f030e7c9b4ac42e886b140899f7ae12ab4f028 Mon Sep 17 00:00:00 2001
From: Alireza Sanaee <alireza.sanaee@huawei.com>
Date: Mon, 14 Jul 2025 18:31:46 +0100
Subject: [PATCH 2425/2760] tests: virt: Update expected ACPI tables for virt
 test

Update the ACPI tables according to the acpi aml_build change, also
empty bios-tables-test-allowed-diff.h.

The disassembled differences between actual and expected PPTT shows
below. Only about the root node adding and identification flag set
as expected.

Diff regarding Loongarch64:

 /*
  * Intel ACPI Component Architecture
  * AML/ASL+ Disassembler version 20230628 (64-bit version)
  * Copyright (c) 2000 - 2023 Intel Corporation
  *
- * Disassembly of tests/data/acpi/loongarch64/virt/PPTT, Mon Jul 14 16:15:12 2025
+ * Disassembly of /tmp/aml-4A0092, Mon Jul 14 16:15:12 2025
  *
  * ACPI Data Table [PPTT]
  *
  * Format: [HexOffset DecimalOffset ByteLength]  FieldName : FieldValue (in hex)
  */

 [000h 0000 004h]                   Signature : "PPTT"    [Processor Properties Topology Table]
-[004h 0004 004h]                Table Length : 0000004C
+[004h 0004 004h]                Table Length : 00000060
 [008h 0008 001h]                    Revision : 02
-[009h 0009 001h]                    Checksum : A8
+[009h 0009 001h]                    Checksum : 27
 [00Ah 0010 006h]                      Oem ID : "BOCHS "
 [010h 0016 008h]                Oem Table ID : "BXPC    "
 [018h 0024 004h]                Oem Revision : 00000001
 [01Ch 0028 004h]             Asl Compiler ID : "BXPC"
 [020h 0032 004h]       Asl Compiler Revision : 00000001

 [024h 0036 001h]               Subtable Type : 00 [Processor Hierarchy Node]
 [025h 0037 001h]                      Length : 14
 [026h 0038 002h]                    Reserved : 0000
-[028h 0040 004h]       Flags (decoded below) : 00000001
+[028h 0040 004h]       Flags (decoded below) : 00000011
                             Physical package : 1
                      ACPI Processor ID valid : 0
                        Processor is a thread : 0
                               Node is a leaf : 0
-                    Identical Implementation : 0
+                    Identical Implementation : 1
 [02Ch 0044 004h]                      Parent : 00000000
 [030h 0048 004h]           ACPI Processor ID : 00000000
 [034h 0052 004h]     Private Resource Number : 00000000

 [038h 0056 001h]               Subtable Type : 00 [Processor Hierarchy Node]
 [039h 0057 001h]                      Length : 14
 [03Ah 0058 002h]                    Reserved : 0000
-[03Ch 0060 004h]       Flags (decoded below) : 0000000A
+[03Ch 0060 004h]       Flags (decoded below) : 00000011
+                            Physical package : 1
+                     ACPI Processor ID valid : 0
+                       Processor is a thread : 0
+                              Node is a leaf : 0
+                    Identical Implementation : 1
+[040h 0064 004h]                      Parent : 00000024
+[044h 0068 004h]           ACPI Processor ID : 00000000
+[048h 0072 004h]     Private Resource Number : 00000000
+
+[04Ch 0076 001h]               Subtable Type : 00 [Processor Hierarchy Node]
+[04Dh 0077 001h]                      Length : 14
+[04Eh 0078 002h]                    Reserved : 0000
+[050h 0080 004h]       Flags (decoded below) : 0000000A
                             Physical package : 0
                      ACPI Processor ID valid : 1
                        Processor is a thread : 0
                               Node is a leaf : 1
                     Identical Implementation : 0
-[040h 0064 004h]                      Parent : 00000024
-[044h 0068 004h]           ACPI Processor ID : 00000000
-[048h 0072 004h]     Private Resource Number : 00000000
+[054h 0084 004h]                      Parent : 00000038
+[058h 0088 004h]           ACPI Processor ID : 00000000
+[05Ch 0092 004h]     Private Resource Number : 00000000

-Raw Table Data: Length 76 (0x4C)
+Raw Table Data: Length 96 (0x60)

-    0000: 50 50 54 54 4C 00 00 00 02 A8 42 4F 43 48 53 20  // PPTTL.....BOCHS
+    0000: 50 50 54 54 60 00 00 00 02 27 42 4F 43 48 53 20  // PPTT`....'BOCHS
     0010: 42 58 50 43 20 20 20 20 01 00 00 00 42 58 50 43  // BXPC    ....BXPC
-    0020: 01 00 00 00 00 14 00 00 01 00 00 00 00 00 00 00  // ................
-    0030: 00 00 00 00 00 00 00 00 00 14 00 00 0A 00 00 00  // ................
-    0040: 24 00 00 00 00 00 00 00 00 00 00 00              // $...........
+    0020: 01 00 00 00 00 14 00 00 11 00 00 00 00 00 00 00  // ................
+    0030: 00 00 00 00 00 00 00 00 00 14 00 00 11 00 00 00  // ................
+    0040: 24 00 00 00 00 00 00 00 00 00 00 00 00 14 00 00  // $...............
+    0050: 0A 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00  // ....8...........

Diff regarding ARM64:
/*
  * Intel ACPI Component Architecture
  * AML/ASL+ Disassembler version 20200925 (64-bit version)
  * Copyright (c) 2000 - 2020 Intel Corporation
  *
- * Disassembly of tests/data/acpi/aarch64/virt/PPTT, Thu Apr 24 11:02:39 2025
+ * Disassembly of /tmp/aml-E0RF52, Thu Apr 24 11:02:39 2025
  *
  * ACPI Data Table [PPTT]
  *
  * Format: [HexOffset DecimalOffset ByteLength]  FieldName : FieldValue
  */

 [000h 0000   4]                    Signature : "PPTT"    [Processor Properties Topology Table]
-[004h 0004   4]                 Table Length : 0000004C
+[004h 0004   4]                 Table Length : 00000060
 [008h 0008   1]                     Revision : 02
-[009h 0009   1]                     Checksum : A8
+[009h 0009   1]                     Checksum : 27
 [00Ah 0010   6]                       Oem ID : "BOCHS "
 [010h 0016   8]                 Oem Table ID : "BXPC    "
 [018h 0024   4]                 Oem Revision : 00000001
 [01Ch 0028   4]              Asl Compiler ID : "BXPC"
 [020h 0032   4]        Asl Compiler Revision : 00000001

 [024h 0036   1]                Subtable Type : 00 [Processor Hierarchy Node]
 [025h 0037   1]                       Length : 14
 [026h 0038   2]                     Reserved : 0000
-[028h 0040   4]        Flags (decoded below) : 00000001
+[028h 0040   4]        Flags (decoded below) : 00000011
                             Physical package : 1
                      ACPI Processor ID valid : 0
                        Processor is a thread : 0
                               Node is a leaf : 0
-                    Identical Implementation : 0
+                    Identical Implementation : 1
 [02Ch 0044   4]                       Parent : 00000000
 [030h 0048   4]            ACPI Processor ID : 00000000
 [034h 0052   4]      Private Resource Number : 00000000

 [038h 0056   1]                Subtable Type : 00 [Processor Hierarchy Node]
 [039h 0057   1]                       Length : 14
 [03Ah 0058   2]                     Reserved : 0000
-[03Ch 0060   4]        Flags (decoded below) : 0000000A
+[03Ch 0060   4]        Flags (decoded below) : 00000011
+                            Physical package : 1
+                     ACPI Processor ID valid : 0
+                       Processor is a thread : 0
+                              Node is a leaf : 0
+                    Identical Implementation : 1
+[040h 0064   4]                       Parent : 00000024
+[044h 0068   4]            ACPI Processor ID : 00000000
+[048h 0072   4]      Private Resource Number : 00000000
+
+[04Ch 0076   1]                Subtable Type : 00 [Processor Hierarchy Node]
+[04Dh 0077   1]                       Length : 14
+[04Eh 0078   2]                     Reserved : 0000
+[050h 0080   4]        Flags (decoded below) : 0000000A
                             Physical package : 0
                      ACPI Processor ID valid : 1
                        Processor is a thread : 0
                               Node is a leaf : 1
                     Identical Implementation : 0
-[040h 0064   4]                       Parent : 00000024
-[044h 0068   4]            ACPI Processor ID : 00000000
-[048h 0072   4]      Private Resource Number : 00000000
+[054h 0084   4]                       Parent : 00000038
+[058h 0088   4]            ACPI Processor ID : 00000000
+[05Ch 0092   4]      Private Resource Number : 00000000

-Raw Table Data: Length 76 (0x4C)
+Raw Table Data: Length 96 (0x60)

-    0000: 50 50 54 54 4C 00 00 00 02 A8 42 4F 43 48 53 20  // PPTTL.....BOCHS
+    0000: 50 50 54 54 60 00 00 00 02 27 42 4F 43 48 53 20  // PPTT`....'BOCHS
     0010: 42 58 50 43 20 20 20 20 01 00 00 00 42 58 50 43  // BXPC    ....BXPC
-    0020: 01 00 00 00 00 14 00 00 01 00 00 00 00 00 00 00  // ................
-    0030: 00 00 00 00 00 00 00 00 00 14 00 00 0A 00 00 00  // ................
-    0040: 24 00 00 00 00 00 00 00 00 00 00 00              // $...........
+    0020: 01 00 00 00 00 14 00 00 11 00 00 00 00 00 00 00  // ................
+    0030: 00 00 00 00 00 00 00 00 00 14 00 00 11 00 00 00  // ................
+    0040: 24 00 00 00 00 00 00 00 00 00 00 00 00 14 00 00  // $...............
+    0050: 0A 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00  // ....8...........

Signed-off-by: Alireza Sanaee <alireza.sanaee@huawei.com>
Message-Id: <20250714173146.511-5-alireza.sanaee@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 tests/data/acpi/aarch64/virt/PPTT              | Bin 76 -> 96 bytes
 tests/data/acpi/aarch64/virt/PPTT.acpihmatvirt | Bin 156 -> 176 bytes
 tests/data/acpi/aarch64/virt/PPTT.topology     | Bin 336 -> 356 bytes
 tests/data/acpi/loongarch64/virt/PPTT          | Bin 76 -> 96 bytes
 tests/data/acpi/loongarch64/virt/PPTT.topology | Bin 176 -> 196 bytes
 tests/qtest/bios-tables-test-allowed-diff.h    |   5 -----
 6 files changed, 5 deletions(-)

diff --git a/tests/data/acpi/aarch64/virt/PPTT b/tests/data/acpi/aarch64/virt/PPTT
index 7a1258ecf123555b24462c98ccbb76b4ac1d0c2b..15598a9b8a3cc0cdd50bc1f77c73ae0ba728a272 100644
GIT binary patch
literal 96
zcmWFt2nk7GU|?WUck*}k2v%^42yj+VP*7lGU|;~TK{SI11A`y~8i0zaAPb8yFmN$2
JFjydo0RR)W2LS*8

delta 38
lcmYfB;R*-{3GrcIU|?D?kxP!1k%57MVWOijj|zwZ#Q=h<1jzsZ

diff --git a/tests/data/acpi/aarch64/virt/PPTT.acpihmatvirt b/tests/data/acpi/aarch64/virt/PPTT.acpihmatvirt
index 4eef303a5b6168c6bc3795c2e2c53f65b4c4cfd4..7b613ddaf4b8cfa13821aa2e835d290077221897 100644
GIT binary patch
literal 176
zcmWFt2npH1z`(%7>*Vk35v<@85#X$#prF9Wz`y`vgJ=d31_nU}GyoM-K^7KaVBlh4
jV6ea;1~v;Mhol!-45YUN<Q9+`5Qdru5@QDO85kG<thxyS

literal 156
zcmWFt2nm_Pz`(%t&&l7}BUr&HBEVTeK|z6$fq?<U2GI;63=CkJ0SSmOFmN$2FsL92
dfz-jo;Odd|B8!34C4lUO>4%yJ5@Uvn0RUu82>}2A

diff --git a/tests/data/acpi/aarch64/virt/PPTT.topology b/tests/data/acpi/aarch64/virt/PPTT.topology
index 3fbcae5ff08aaf16fedf4da45e941661d79c1174..6b864f035c9f48845e9a3beb482c5171074864a5 100644
GIT binary patch
literal 356
zcmWFt2nk7HWME*L?&R<65v<@85#X$#prF9Wz`y`vgJ=d31_nU}GyoM-K^7KaU=Uzn
zV6ea<=7T22$H2glfI|#yCrA!z9!M{;7)b9N1_lNukQxvcVPJrXF@yLZ4Al#A3$k92
o`)+{bVHm3S4FdxM3l=d}Br%v?Wb;7wYA`Y|upy~~iLpb)00?&w0RR91

literal 336
zcmWFt2nh*bWME*baq@Te2v%^42yj+VP*7lGU|;~TK{SI10|S_5KmsBVwhDxTkWeuT
z2oFMvFfi~jFfjN)cn}gv3~nxxUSu(l-VO!^1}2D329R4|V$4WlASTEy$a+CyM?eG&
rL+!o6z`($QMT`|m48#QKMK%v)uLvUp0~<&ZgrVkv#MnW61_lNI0DKMs

diff --git a/tests/data/acpi/loongarch64/virt/PPTT b/tests/data/acpi/loongarch64/virt/PPTT
index 7a1258ecf123555b24462c98ccbb76b4ac1d0c2b..15598a9b8a3cc0cdd50bc1f77c73ae0ba728a272 100644
GIT binary patch
literal 96
zcmWFt2nk7GU|?WUck*}k2v%^42yj+VP*7lGU|;~TK{SI11A`y~8i0zaAPb8yFmN$2
JFjydo0RR)W2LS*8

delta 38
lcmYfB;R*-{3GrcIU|?D?kxP!1k%57MVWOijj|zwZ#Q=h<1jzsZ

diff --git a/tests/data/acpi/loongarch64/virt/PPTT.topology b/tests/data/acpi/loongarch64/virt/PPTT.topology
index d91e55b2399d9949dbb8e4c8cf634af1a0e56df4..7fc92984694d2cac7bf867c7fea696e135f8c758 100644
GIT binary patch
literal 196
zcmWFt2njjDz`($y<>c?|5v<@85#X$#prF9Wz`y`vgJ=d31_nU}GyoM-K^7KaU=Uzn
rV6Z?F<6~f8@WCMlHXkI1q!(EXq_+d)K9Cv^7GYq3i7|ut3=9kan=lFi

literal 176
zcmWFt2npH1z`($y@8s|75v<@85#X$#prF9Wz`y`vgJ=d31_m(AfCNM!Y!wIvAw?J%
k_!t-%EFe4xi6jO$14%Ek7)Wmk$Sn|^3?O@9V$4u60J3}u0RR91

diff --git a/tests/qtest/bios-tables-test-allowed-diff.h b/tests/qtest/bios-tables-test-allowed-diff.h
index 5c3ff47748..dfb8523c8b 100644
--- a/tests/qtest/bios-tables-test-allowed-diff.h
+++ b/tests/qtest/bios-tables-test-allowed-diff.h
@@ -1,6 +1 @@
 /* List of comma-separated changed AML files to ignore */
-"tests/data/acpi/aarch64/virt/PPTT",
-"tests/data/acpi/aarch64/virt/PPTT.acpihmatvirt",
-"tests/data/acpi/aarch64/virt/PPTT.topology",
-"tests/data/acpi/loongarch64/virt/PPTT",
-"tests/data/acpi/loongarch64/virt/PPTT.topology",

From fe63feb7e8f2d62621008fdf7c884f3573de249b Mon Sep 17 00:00:00 2001
From: Fan Ni <fan.ni@samsung.com>
Date: Mon, 14 Jul 2025 18:44:57 +0100
Subject: [PATCH 2426/2760] hw/cxl: fix DC extent capacity tracking

Per cxl r3.2 Section 9.13.3.3, extent capacity tracking should include
extents in different states including added, pending, etc.

Before the change, for the in-device extent number tracking purpose, we only
have "total_extent_count" defined, which only tracks the number of
extents accepted. However, we need to track number of extents in other
states also, for now it is extents pending-to-add.

To fix that, we introduce a new counter for dynamic capacity
"nr_extents_accepted" which explicitly tracks number of the extents
accepted by the hosts, and fix "total_extent_count" to include
both accepted and pending extents counting.

Signed-off-by: Fan Ni <fan.ni@samsung.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Message-Id: <20250714174509.1984430-2-Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/cxl/cxl-mailbox-utils.c  | 26 ++++++++++++++++++--------
 hw/mem/cxl_type3.c          |  1 +
 include/hw/cxl/cxl_device.h |  3 ++-
 3 files changed, 21 insertions(+), 9 deletions(-)

diff --git a/hw/cxl/cxl-mailbox-utils.c b/hw/cxl/cxl-mailbox-utils.c
index 299f232f26..0b615ea37a 100644
--- a/hw/cxl/cxl-mailbox-utils.c
+++ b/hw/cxl/cxl-mailbox-utils.c
@@ -2750,7 +2750,7 @@ static CXLRetCode cmd_dcd_get_dyn_cap_ext_list(const struct cxl_cmd *cmd,
     uint16_t out_pl_len, size;
     CXLDCExtent *ent;
 
-    if (start_extent_id > ct3d->dc.total_extent_count) {
+    if (start_extent_id > ct3d->dc.nr_extents_accepted) {
         return CXL_MBOX_INVALID_INPUT;
     }
 
@@ -2761,7 +2761,7 @@ static CXLRetCode cmd_dcd_get_dyn_cap_ext_list(const struct cxl_cmd *cmd,
     out_pl_len = sizeof(*out) + record_count * sizeof(out->records[0]);
 
     stl_le_p(&out->count, record_count);
-    stl_le_p(&out->total_extents, ct3d->dc.total_extent_count);
+    stl_le_p(&out->total_extents, ct3d->dc.nr_extents_accepted);
     stl_le_p(&out->generation_num, ct3d->dc.ext_list_gen_seq);
 
     if (record_count > 0) {
@@ -2883,16 +2883,20 @@ void cxl_extent_group_list_insert_tail(CXLDCExtentGroupList *list,
     QTAILQ_INSERT_TAIL(list, group, node);
 }
 
-void cxl_extent_group_list_delete_front(CXLDCExtentGroupList *list)
+uint32_t cxl_extent_group_list_delete_front(CXLDCExtentGroupList *list)
 {
     CXLDCExtent *ent, *ent_next;
     CXLDCExtentGroup *group = QTAILQ_FIRST(list);
+    uint32_t extents_deleted = 0;
 
     QTAILQ_REMOVE(list, group, node);
     QTAILQ_FOREACH_SAFE(ent, &group->list, node, ent_next) {
         cxl_remove_extent_from_extent_list(&group->list, ent);
+        extents_deleted++;
     }
     g_free(group);
+
+    return extents_deleted;
 }
 
 /*
@@ -3011,7 +3015,7 @@ static CXLRetCode cmd_dcd_add_dyn_cap_rsp(const struct cxl_cmd *cmd,
     CXLUpdateDCExtentListInPl *in = (void *)payload_in;
     CXLType3Dev *ct3d = CXL_TYPE3(cci->d);
     CXLDCExtentList *extent_list = &ct3d->dc.extents;
-    uint32_t i;
+    uint32_t i, num;
     uint64_t dpa, len;
     CXLRetCode ret;
 
@@ -3020,7 +3024,8 @@ static CXLRetCode cmd_dcd_add_dyn_cap_rsp(const struct cxl_cmd *cmd,
     }
 
     if (in->num_entries_updated == 0) {
-        cxl_extent_group_list_delete_front(&ct3d->dc.extents_pending);
+        num = cxl_extent_group_list_delete_front(&ct3d->dc.extents_pending);
+        ct3d->dc.total_extent_count -= num;
         return CXL_MBOX_SUCCESS;
     }
 
@@ -3051,10 +3056,12 @@ static CXLRetCode cmd_dcd_add_dyn_cap_rsp(const struct cxl_cmd *cmd,
 
         cxl_insert_extent_to_extent_list(extent_list, dpa, len, NULL, 0);
         ct3d->dc.total_extent_count += 1;
+        ct3d->dc.nr_extents_accepted += 1;
         ct3_set_region_block_backed(ct3d, dpa, len);
     }
     /* Remove the first extent group in the pending list */
-    cxl_extent_group_list_delete_front(&ct3d->dc.extents_pending);
+    num = cxl_extent_group_list_delete_front(&ct3d->dc.extents_pending);
+    ct3d->dc.total_extent_count -= num;
 
     return CXL_MBOX_SUCCESS;
 }
@@ -3160,7 +3167,7 @@ free_and_exit:
         }
         *updated_list_size = 0;
     } else {
-        *updated_list_size = ct3d->dc.total_extent_count + cnt_delta;
+        *updated_list_size = ct3d->dc.nr_extents_accepted + cnt_delta;
     }
 
     return ret;
@@ -3222,7 +3229,10 @@ static CXLRetCode cmd_dcd_release_dyn_cap(const struct cxl_cmd *cmd,
         ct3_set_region_block_backed(ct3d, ent->start_dpa, ent->len);
         cxl_remove_extent_from_extent_list(&updated_list, ent);
     }
-    ct3d->dc.total_extent_count = updated_list_size;
+    ct3d->dc.total_extent_count += (updated_list_size -
+                                    ct3d->dc.nr_extents_accepted);
+
+    ct3d->dc.nr_extents_accepted = updated_list_size;
 
     return CXL_MBOX_SUCCESS;
 }
diff --git a/hw/mem/cxl_type3.c b/hw/mem/cxl_type3.c
index 94e7274912..f283178d88 100644
--- a/hw/mem/cxl_type3.c
+++ b/hw/mem/cxl_type3.c
@@ -2076,6 +2076,7 @@ static void qmp_cxl_process_dynamic_capacity_prescriptive(const char *path,
     }
     if (group) {
         cxl_extent_group_list_insert_tail(&dcd->dc.extents_pending, group);
+        dcd->dc.total_extent_count += num_extents;
     }
 
     /*
diff --git a/include/hw/cxl/cxl_device.h b/include/hw/cxl/cxl_device.h
index ed6cd50c67..a151e19da8 100644
--- a/include/hw/cxl/cxl_device.h
+++ b/include/hw/cxl/cxl_device.h
@@ -618,6 +618,7 @@ struct CXLType3Dev {
         CXLDCExtentList extents;
         CXLDCExtentGroupList extents_pending;
         uint32_t total_extent_count;
+        uint32_t nr_extents_accepted;
         uint32_t ext_list_gen_seq;
 
         uint8_t num_regions; /* 0-8 regions */
@@ -696,7 +697,7 @@ CXLDCExtentGroup *cxl_insert_extent_to_extent_group(CXLDCExtentGroup *group,
                                                     uint16_t shared_seq);
 void cxl_extent_group_list_insert_tail(CXLDCExtentGroupList *list,
                                        CXLDCExtentGroup *group);
-void cxl_extent_group_list_delete_front(CXLDCExtentGroupList *list);
+uint32_t cxl_extent_group_list_delete_front(CXLDCExtentGroupList *list);
 void ct3_set_region_block_backed(CXLType3Dev *ct3d, uint64_t dpa,
                                  uint64_t len);
 void ct3_clear_region_block_backed(CXLType3Dev *ct3d, uint64_t dpa,

From 9fde6eb39d8f2354c8f8da91ee6854c60929270f Mon Sep 17 00:00:00 2001
From: Anisa Su <anisa.su@samsung.com>
Date: Mon, 14 Jul 2025 18:44:58 +0100
Subject: [PATCH 2427/2760] hw/cxl: mailbox-utils: 0x5600 - FMAPI Get DCD Info

FM DCD Management command 0x5600 implemented per CXL 3.2 Spec Section 7.6.7.6.1.

Reviewed-by: Fan Ni <fan.ni@samsung.com>
Signed-off-by: Anisa Su <anisa.su@samsung.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Message-Id: <20250714174509.1984430-3-Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/cxl/cxl-mailbox-utils.c  | 59 +++++++++++++++++++++++++++++++++++++
 hw/mem/cxl_type3.c          |  4 +++
 include/hw/cxl/cxl_device.h |  1 +
 3 files changed, 64 insertions(+)

diff --git a/hw/cxl/cxl-mailbox-utils.c b/hw/cxl/cxl-mailbox-utils.c
index 0b615ea37a..3304048922 100644
--- a/hw/cxl/cxl-mailbox-utils.c
+++ b/hw/cxl/cxl-mailbox-utils.c
@@ -23,6 +23,7 @@
 #include "qemu/uuid.h"
 #include "system/hostmem.h"
 #include "qemu/range.h"
+#include "qapi/qapi-types-cxl.h"
 
 #define CXL_CAPACITY_MULTIPLIER   (256 * MiB)
 #define CXL_DC_EVENT_LOG_SIZE 8
@@ -117,6 +118,8 @@ enum {
         #define GET_PHYSICAL_PORT_STATE     0x1
     TUNNEL = 0x53,
         #define MANAGEMENT_COMMAND     0x0
+    FMAPI_DCD_MGMT = 0x56,
+        #define GET_DCD_INFO    0x0
 };
 
 /* CCI Message Format CXL r3.1 Figure 7-19 */
@@ -3237,6 +3240,52 @@ static CXLRetCode cmd_dcd_release_dyn_cap(const struct cxl_cmd *cmd,
     return CXL_MBOX_SUCCESS;
 }
 
+/* CXL r3.2 section 7.6.7.6.1: Get DCD Info (Opcode 5600h) */
+static CXLRetCode cmd_fm_get_dcd_info(const struct cxl_cmd *cmd,
+                                      uint8_t *payload_in,
+                                      size_t len_in,
+                                      uint8_t *payload_out,
+                                      size_t *len_out,
+                                      CXLCCI *cci)
+{
+    struct {
+        uint8_t num_hosts;
+        uint8_t num_regions_supported;
+        uint8_t rsvd1[2];
+        uint16_t supported_add_sel_policy_bitmask;
+        uint8_t rsvd2[2];
+        uint16_t supported_removal_policy_bitmask;
+        uint8_t sanitize_on_release_bitmask;
+        uint8_t rsvd3;
+        uint64_t total_dynamic_capacity;
+        uint64_t region_blk_size_bitmasks[8];
+    } QEMU_PACKED *out = (void *)payload_out;
+    CXLType3Dev *ct3d = CXL_TYPE3(cci->d);
+    CXLDCRegion *region;
+    int i;
+
+    out->num_hosts = 1;
+    out->num_regions_supported = ct3d->dc.num_regions;
+    stw_le_p(&out->supported_add_sel_policy_bitmask,
+             BIT(CXL_EXTENT_SELECTION_POLICY_PRESCRIPTIVE));
+    stw_le_p(&out->supported_removal_policy_bitmask,
+             BIT(CXL_EXTENT_REMOVAL_POLICY_PRESCRIPTIVE));
+    out->sanitize_on_release_bitmask = 0;
+
+    stq_le_p(&out->total_dynamic_capacity,
+             ct3d->dc.total_capacity / CXL_CAPACITY_MULTIPLIER);
+
+    for (i = 0; i < ct3d->dc.num_regions; i++) {
+        region = &ct3d->dc.regions[i];
+        memcpy(&out->region_blk_size_bitmasks[i],
+               &region->supported_blk_size_bitmask,
+               sizeof(out->region_blk_size_bitmasks[i]));
+    }
+
+    *len_out = sizeof(*out);
+    return CXL_MBOX_SUCCESS;
+}
+
 static const struct cxl_cmd cxl_cmd_set[256][256] = {
     [INFOSTAT][BACKGROUND_OPERATION_ABORT] = { "BACKGROUND_OPERATION_ABORT",
         cmd_infostat_bg_op_abort, 0, 0 },
@@ -3350,6 +3399,11 @@ static const struct cxl_cmd cxl_cmd_set_sw[256][256] = {
                                      cmd_tunnel_management_cmd, ~0, 0 },
 };
 
+static const struct cxl_cmd cxl_cmd_set_fm_dcd[256][256] = {
+    [FMAPI_DCD_MGMT][GET_DCD_INFO] = { "GET_DCD_INFO",
+        cmd_fm_get_dcd_info, 0, 0 },
+};
+
 /*
  * While the command is executing in the background, the device should
  * update the percentage complete in the Background Command Status Register
@@ -3624,7 +3678,12 @@ void cxl_initialize_t3_fm_owned_ld_mctpcci(CXLCCI *cci, DeviceState *d,
                                            DeviceState *intf,
                                            size_t payload_max)
 {
+    CXLType3Dev *ct3d = CXL_TYPE3(d);
+
     cxl_copy_cci_commands(cci, cxl_cmd_set_t3_fm_owned_ld_mctp);
+    if (ct3d->dc.num_regions) {
+        cxl_copy_cci_commands(cci, cxl_cmd_set_fm_dcd);
+    }
     cci->d = d;
     cci->intf = intf;
     cxl_init_cci(cci, payload_max);
diff --git a/hw/mem/cxl_type3.c b/hw/mem/cxl_type3.c
index f283178d88..d898cfd617 100644
--- a/hw/mem/cxl_type3.c
+++ b/hw/mem/cxl_type3.c
@@ -8,6 +8,7 @@
  *
  * SPDX-License-Identifier: GPL-v2-only
  */
+#include <math.h>
 
 #include "qemu/osdep.h"
 #include "qemu/units.h"
@@ -634,6 +635,8 @@ static bool cxl_create_dc_regions(CXLType3Dev *ct3d, Error **errp)
     uint64_t region_len;
     uint64_t decode_len;
     uint64_t blk_size = 2 * MiB;
+    /* Only 1 block size is supported for now. */
+    uint64_t supported_blk_size_bitmask = blk_size;
     CXLDCRegion *region;
     MemoryRegion *mr;
     uint64_t dc_size;
@@ -679,6 +682,7 @@ static bool cxl_create_dc_regions(CXLType3Dev *ct3d, Error **errp)
             .block_size = blk_size,
             /* dsmad_handle set when creating CDAT table entries */
             .flags = 0,
+            .supported_blk_size_bitmask = supported_blk_size_bitmask,
         };
         ct3d->dc.total_capacity += region->len;
         region->blk_bitmap = bitmap_new(region->len / region->block_size);
diff --git a/include/hw/cxl/cxl_device.h b/include/hw/cxl/cxl_device.h
index a151e19da8..7eade9cf8a 100644
--- a/include/hw/cxl/cxl_device.h
+++ b/include/hw/cxl/cxl_device.h
@@ -530,6 +530,7 @@ typedef struct CXLDCRegion {
     uint32_t dsmadhandle;
     uint8_t flags;
     unsigned long *blk_bitmap;
+    uint64_t supported_blk_size_bitmask;
 } CXLDCRegion;
 
 typedef struct CXLSetFeatureInfo {

From 3d1607cc299f40d0f0749ce808e9776196f7ef85 Mon Sep 17 00:00:00 2001
From: Anisa Su <anisa.su@samsung.com>
Date: Mon, 14 Jul 2025 18:44:59 +0100
Subject: [PATCH 2428/2760] hw/mem: cxl_type3: Add dsmas_flags to CXLDCRegion
 struct

Add booleans to DC Region struct to represent dsmas flags (defined in CDAT) in
preparation for the next command, which returns the flags in the next mailbox
command 0x5601.

Reviewed-by: Fan Ni <fan.ni@samsung.com>
Signed-off-by: Anisa Su <anisa.su@samsung.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Message-Id: <20250714174509.1984430-4-Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/mem/cxl_type3.c          |  8 +++++++-
 include/hw/cxl/cxl_device.h | 15 +++++++++++++++
 2 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/hw/mem/cxl_type3.c b/hw/mem/cxl_type3.c
index d898cfd617..6b0889c9ae 100644
--- a/hw/mem/cxl_type3.c
+++ b/hw/mem/cxl_type3.c
@@ -226,10 +226,16 @@ static int ct3_build_cdat_table(CDATSubHeader ***cdat_table, void *priv)
          * future.
          */
         for (i = 0; i < ct3d->dc.num_regions; i++) {
+            ct3d->dc.regions[i].nonvolatile = false;
+            ct3d->dc.regions[i].sharable = false;
+            ct3d->dc.regions[i].hw_managed_coherency = false;
+            ct3d->dc.regions[i].ic_specific_dc_management = false;
+            ct3d->dc.regions[i].rdonly = false;
             ct3_build_cdat_entries_for_mr(&(table[cur_ent]),
                                           dsmad_handle++,
                                           ct3d->dc.regions[i].len,
-                                          false, true, region_base);
+                                          ct3d->dc.regions[i].nonvolatile,
+                                          true, region_base);
             ct3d->dc.regions[i].dsmadhandle = dsmad_handle - 1;
 
             cur_ent += CT3_CDAT_NUM_ENTRIES;
diff --git a/include/hw/cxl/cxl_device.h b/include/hw/cxl/cxl_device.h
index 7eade9cf8a..7e0a66906f 100644
--- a/include/hw/cxl/cxl_device.h
+++ b/include/hw/cxl/cxl_device.h
@@ -133,6 +133,15 @@ typedef enum {
     CXL_MBOX_MAX = 0x20
 } CXLRetCode;
 
+/* r3.2 Section 7.6.7.6.2: Table 7-66: DSMAS Flags Bits */
+typedef enum {
+    CXL_DSMAS_FLAGS_NONVOLATILE = 2,
+    CXL_DSMAS_FLAGS_SHARABLE = 3,
+    CXL_DSMAS_FLAGS_HW_MANAGED_COHERENCY = 4,
+    CXL_DSMAS_FLAGS_IC_SPECIFIC_DC_MANAGEMENT = 5,
+    CXL_DSMAS_FLAGS_RDONLY = 6,
+} CXLDSMASFlags;
+
 typedef struct CXLCCI CXLCCI;
 typedef struct cxl_device_state CXLDeviceState;
 struct cxl_cmd;
@@ -531,6 +540,12 @@ typedef struct CXLDCRegion {
     uint8_t flags;
     unsigned long *blk_bitmap;
     uint64_t supported_blk_size_bitmask;
+    /* Following bools make up dsmas flags, as defined in the CDAT */
+    bool nonvolatile;
+    bool sharable;
+    bool hw_managed_coherency;
+    bool ic_specific_dc_management;
+    bool rdonly;
 } CXLDCRegion;
 
 typedef struct CXLSetFeatureInfo {

From a8f1cbbbcad6e1b2211a201ad95d68c451a990e3 Mon Sep 17 00:00:00 2001
From: Anisa Su <anisa.su@samsung.com>
Date: Mon, 14 Jul 2025 18:45:00 +0100
Subject: [PATCH 2429/2760] hw/cxl: mailbox-utils: 0x5601 - FMAPI Get Host
 Region Config

FM DCD Management command 0x5601 implemented per CXL r3.2 Spec Section 7.6.7.6.2

Reviewed-by: Fan Ni <fan.ni@samsung.com>
Signed-off-by: Anisa Su <anisa.su@samsung.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Message-Id: <20250714174509.1984430-5-Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/cxl/cxl-mailbox-utils.c | 106 +++++++++++++++++++++++++++++++++++++
 1 file changed, 106 insertions(+)

diff --git a/hw/cxl/cxl-mailbox-utils.c b/hw/cxl/cxl-mailbox-utils.c
index 3304048922..bf1710b251 100644
--- a/hw/cxl/cxl-mailbox-utils.c
+++ b/hw/cxl/cxl-mailbox-utils.c
@@ -120,6 +120,7 @@ enum {
         #define MANAGEMENT_COMMAND     0x0
     FMAPI_DCD_MGMT = 0x56,
         #define GET_DCD_INFO    0x0
+        #define GET_HOST_DC_REGION_CONFIG   0x1
 };
 
 /* CCI Message Format CXL r3.1 Figure 7-19 */
@@ -3286,6 +3287,109 @@ static CXLRetCode cmd_fm_get_dcd_info(const struct cxl_cmd *cmd,
     return CXL_MBOX_SUCCESS;
 }
 
+static void build_dsmas_flags(uint8_t *flags, CXLDCRegion *region)
+{
+    *flags = 0;
+
+    if (region->nonvolatile) {
+        *flags |= BIT(CXL_DSMAS_FLAGS_NONVOLATILE);
+    }
+    if (region->sharable) {
+        *flags |= BIT(CXL_DSMAS_FLAGS_SHARABLE);
+    }
+    if (region->hw_managed_coherency) {
+        *flags |= BIT(CXL_DSMAS_FLAGS_HW_MANAGED_COHERENCY);
+    }
+    if (region->ic_specific_dc_management) {
+        *flags |= BIT(CXL_DSMAS_FLAGS_IC_SPECIFIC_DC_MANAGEMENT);
+    }
+    if (region->rdonly) {
+        *flags |= BIT(CXL_DSMAS_FLAGS_RDONLY);
+    }
+}
+
+/*
+ * CXL r3.2 section 7.6.7.6.2:
+ * Get Host DC Region Configuration (Opcode 5601h)
+ */
+static CXLRetCode cmd_fm_get_host_dc_region_config(const struct cxl_cmd *cmd,
+                                                   uint8_t *payload_in,
+                                                   size_t len_in,
+                                                   uint8_t *payload_out,
+                                                   size_t *len_out,
+                                                   CXLCCI *cci)
+{
+    struct {
+        uint16_t host_id;
+        uint8_t region_cnt;
+        uint8_t start_rid;
+    } QEMU_PACKED *in = (void *)payload_in;
+    struct {
+        uint16_t host_id;
+        uint8_t num_regions;
+        uint8_t regions_returned;
+        struct {
+            uint64_t base;
+            uint64_t decode_len;
+            uint64_t region_len;
+            uint64_t block_size;
+            uint8_t flags;
+            uint8_t rsvd1[3];
+            uint8_t sanitize;
+            uint8_t rsvd2[3];
+        } QEMU_PACKED records[];
+    } QEMU_PACKED *out = (void *)payload_out;
+    struct {
+        uint32_t num_extents_supported;
+        uint32_t num_extents_available;
+        uint32_t num_tags_supported;
+        uint32_t num_tags_available;
+    } QEMU_PACKED *extra_out;
+    CXLType3Dev *ct3d = CXL_TYPE3(cci->d);
+    uint16_t record_count, out_pl_len, i;
+
+    if (in->start_rid >= ct3d->dc.num_regions) {
+        return CXL_MBOX_INVALID_INPUT;
+    }
+    record_count = MIN(ct3d->dc.num_regions - in->start_rid, in->region_cnt);
+
+    out_pl_len = sizeof(*out) + record_count * sizeof(out->records[0]);
+    extra_out = (void *)out + out_pl_len;
+    out_pl_len += sizeof(*extra_out);
+
+    assert(out_pl_len <= CXL_MAILBOX_MAX_PAYLOAD_SIZE);
+
+    stw_le_p(&out->host_id, 0);
+    out->num_regions = ct3d->dc.num_regions;
+    out->regions_returned = record_count;
+
+    for (i = 0; i < record_count; i++) {
+        stq_le_p(&out->records[i].base,
+                 ct3d->dc.regions[in->start_rid + i].base);
+        stq_le_p(&out->records[i].decode_len,
+                 ct3d->dc.regions[in->start_rid + i].decode_len /
+                 CXL_CAPACITY_MULTIPLIER);
+        stq_le_p(&out->records[i].region_len,
+                 ct3d->dc.regions[in->start_rid + i].len);
+        stq_le_p(&out->records[i].block_size,
+                 ct3d->dc.regions[in->start_rid + i].block_size);
+        build_dsmas_flags(&out->records[i].flags,
+                          &ct3d->dc.regions[in->start_rid + i]);
+        /* Sanitize is bit 0 of flags. */
+        out->records[i].sanitize =
+            ct3d->dc.regions[in->start_rid + i].flags & BIT(0);
+    }
+
+    stl_le_p(&extra_out->num_extents_supported, CXL_NUM_EXTENTS_SUPPORTED);
+    stl_le_p(&extra_out->num_extents_available, CXL_NUM_EXTENTS_SUPPORTED -
+             ct3d->dc.total_extent_count);
+    stl_le_p(&extra_out->num_tags_supported, CXL_NUM_TAGS_SUPPORTED);
+    stl_le_p(&extra_out->num_tags_available, CXL_NUM_TAGS_SUPPORTED);
+
+    *len_out = out_pl_len;
+    return CXL_MBOX_SUCCESS;
+}
+
 static const struct cxl_cmd cxl_cmd_set[256][256] = {
     [INFOSTAT][BACKGROUND_OPERATION_ABORT] = { "BACKGROUND_OPERATION_ABORT",
         cmd_infostat_bg_op_abort, 0, 0 },
@@ -3402,6 +3506,8 @@ static const struct cxl_cmd cxl_cmd_set_sw[256][256] = {
 static const struct cxl_cmd cxl_cmd_set_fm_dcd[256][256] = {
     [FMAPI_DCD_MGMT][GET_DCD_INFO] = { "GET_DCD_INFO",
         cmd_fm_get_dcd_info, 0, 0 },
+    [FMAPI_DCD_MGMT][GET_HOST_DC_REGION_CONFIG] = { "GET_HOST_DC_REGION_CONFIG",
+        cmd_fm_get_host_dc_region_config, 4, 0 },
 };
 
 /*

From 0686f160b767615279ca39cfebf77c0b2e67816d Mon Sep 17 00:00:00 2001
From: Anisa Su <anisa.su@samsung.com>
Date: Mon, 14 Jul 2025 18:45:01 +0100
Subject: [PATCH 2430/2760] hw/cxl: Move definition for dynamic_capacity_uuid
 and enum for DC event types to header

Move definition/enum to cxl_events.h for shared use in next patch

Reviewed-by: Fan Ni <fan.ni@samsung.com>
Signed-off-by: Anisa Su <anisa.su@samsung.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Message-Id: <20250714174509.1984430-6-Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/mem/cxl_type3.c          | 15 ---------------
 include/hw/cxl/cxl_events.h | 15 +++++++++++++++
 2 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/hw/mem/cxl_type3.c b/hw/mem/cxl_type3.c
index 6b0889c9ae..52d3910ed9 100644
--- a/hw/mem/cxl_type3.c
+++ b/hw/mem/cxl_type3.c
@@ -1876,21 +1876,6 @@ void qmp_cxl_inject_memory_module_event(const char *path, CxlEventLog log,
     }
 }
 
-/* CXL r3.1 Table 8-50: Dynamic Capacity Event Record */
-static const QemuUUID dynamic_capacity_uuid = {
-    .data = UUID(0xca95afa7, 0xf183, 0x4018, 0x8c, 0x2f,
-                 0x95, 0x26, 0x8e, 0x10, 0x1a, 0x2a),
-};
-
-typedef enum CXLDCEventType {
-    DC_EVENT_ADD_CAPACITY = 0x0,
-    DC_EVENT_RELEASE_CAPACITY = 0x1,
-    DC_EVENT_FORCED_RELEASE_CAPACITY = 0x2,
-    DC_EVENT_REGION_CONFIG_UPDATED = 0x3,
-    DC_EVENT_ADD_CAPACITY_RSP = 0x4,
-    DC_EVENT_CAPACITY_RELEASED = 0x5,
-} CXLDCEventType;
-
 /*
  * Check whether the range [dpa, dpa + len - 1] has overlaps with extents in
  * the list.
diff --git a/include/hw/cxl/cxl_events.h b/include/hw/cxl/cxl_events.h
index 38cadaa0f3..758b075a64 100644
--- a/include/hw/cxl/cxl_events.h
+++ b/include/hw/cxl/cxl_events.h
@@ -184,4 +184,19 @@ typedef struct CXLEventDynamicCapacity {
     uint32_t tags_avail;
 } QEMU_PACKED CXLEventDynamicCapacity;
 
+/* CXL r3.1 Table 8-50: Dynamic Capacity Event Record */
+static const QemuUUID dynamic_capacity_uuid = {
+    .data = UUID(0xca95afa7, 0xf183, 0x4018, 0x8c, 0x2f,
+                 0x95, 0x26, 0x8e, 0x10, 0x1a, 0x2a),
+};
+
+typedef enum CXLDCEventType {
+    DC_EVENT_ADD_CAPACITY = 0x0,
+    DC_EVENT_RELEASE_CAPACITY = 0x1,
+    DC_EVENT_FORCED_RELEASE_CAPACITY = 0x2,
+    DC_EVENT_REGION_CONFIG_UPDATED = 0x3,
+    DC_EVENT_ADD_CAPACITY_RSP = 0x4,
+    DC_EVENT_CAPACITY_RELEASED = 0x5,
+} CXLDCEventType;
+
 #endif /* CXL_EVENTS_H */

From 69798d000b95a147f73dfce8c80cff92aa929dcb Mon Sep 17 00:00:00 2001
From: Anisa Su <anisa.su@samsung.com>
Date: Mon, 14 Jul 2025 18:45:02 +0100
Subject: [PATCH 2431/2760] hw/mem: cxl_type3: Add DC Region bitmap lock

Add a lock on the bitmap of each CXLDCRegion in preparation for the next
patch which implements FMAPI Set DC Region Configuration. This command
can modify the block size, which means the region's bitmap must be updated
accordingly.

The lock becomes necessary when commands that add/release extents
(meaning they update the bitmap too) are enabled on a different CCI than
the CCI on which the FMAPI commands are enabled.

Reviewed-by: Fan Ni <fan.ni@samsung.com>
Signed-off-by: Anisa Su <anisa.su@samsung.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Message-Id: <20250714174509.1984430-7-Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/mem/cxl_type3.c          | 4 ++++
 include/hw/cxl/cxl_device.h | 1 +
 2 files changed, 5 insertions(+)

diff --git a/hw/mem/cxl_type3.c b/hw/mem/cxl_type3.c
index 52d3910ed9..a7a1857a0c 100644
--- a/hw/mem/cxl_type3.c
+++ b/hw/mem/cxl_type3.c
@@ -692,6 +692,7 @@ static bool cxl_create_dc_regions(CXLType3Dev *ct3d, Error **errp)
         };
         ct3d->dc.total_capacity += region->len;
         region->blk_bitmap = bitmap_new(region->len / region->block_size);
+        qemu_mutex_init(&region->bitmap_lock);
     }
     QTAILQ_INIT(&ct3d->dc.extents);
     QTAILQ_INIT(&ct3d->dc.extents_pending);
@@ -1020,6 +1021,7 @@ void ct3_set_region_block_backed(CXLType3Dev *ct3d, uint64_t dpa,
         return;
     }
 
+    QEMU_LOCK_GUARD(&region->bitmap_lock);
     bitmap_set(region->blk_bitmap, (dpa - region->base) / region->block_size,
                len / region->block_size);
 }
@@ -1046,6 +1048,7 @@ bool ct3_test_region_block_backed(CXLType3Dev *ct3d, uint64_t dpa,
      * if bits between [dpa, dpa + len) are all 1s, meaning the DPA range is
      * backed with DC extents, return true; else return false.
      */
+    QEMU_LOCK_GUARD(&region->bitmap_lock);
     return find_next_zero_bit(region->blk_bitmap, nr + nbits, nr) == nr + nbits;
 }
 
@@ -1067,6 +1070,7 @@ void ct3_clear_region_block_backed(CXLType3Dev *ct3d, uint64_t dpa,
 
     nr = (dpa - region->base) / region->block_size;
     nbits = len / region->block_size;
+    QEMU_LOCK_GUARD(&region->bitmap_lock);
     bitmap_clear(region->blk_bitmap, nr, nbits);
 }
 
diff --git a/include/hw/cxl/cxl_device.h b/include/hw/cxl/cxl_device.h
index 7e0a66906f..42ae5b7479 100644
--- a/include/hw/cxl/cxl_device.h
+++ b/include/hw/cxl/cxl_device.h
@@ -540,6 +540,7 @@ typedef struct CXLDCRegion {
     uint8_t flags;
     unsigned long *blk_bitmap;
     uint64_t supported_blk_size_bitmask;
+    QemuMutex bitmap_lock;
     /* Following bools make up dsmas flags, as defined in the CDAT */
     bool nonvolatile;
     bool sharable;

From 1befc7bde30d2e09f20a44584aaefdfa31f60074 Mon Sep 17 00:00:00 2001
From: Anisa Su <anisa.su@samsung.com>
Date: Mon, 14 Jul 2025 18:45:03 +0100
Subject: [PATCH 2432/2760] hw/cxl: mailbox-utils: 0x5602 - FMAPI Set DC Region
 Config

FM DCD Management command 0x5602 implemented per CXL r3.2 Spec Section 7.6.7.6.3

Reviewed-by: Fan Ni <fan.ni@samsung.com>
Signed-off-by: Anisa Su <anisa.su@samsung.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Message-Id: <20250714174509.1984430-8-Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/cxl/cxl-mailbox-utils.c   | 87 ++++++++++++++++++++++++++++++++++++
 hw/mem/cxl_type3.c           |  6 +--
 include/hw/cxl/cxl_device.h  |  3 ++
 include/hw/cxl/cxl_mailbox.h |  6 +++
 4 files changed, 99 insertions(+), 3 deletions(-)

diff --git a/hw/cxl/cxl-mailbox-utils.c b/hw/cxl/cxl-mailbox-utils.c
index bf1710b251..b4a0f7d664 100644
--- a/hw/cxl/cxl-mailbox-utils.c
+++ b/hw/cxl/cxl-mailbox-utils.c
@@ -18,6 +18,7 @@
 #include "hw/pci/pci.h"
 #include "hw/pci-bridge/cxl_upstream_port.h"
 #include "qemu/cutils.h"
+#include "qemu/host-utils.h"
 #include "qemu/log.h"
 #include "qemu/units.h"
 #include "qemu/uuid.h"
@@ -121,6 +122,7 @@ enum {
     FMAPI_DCD_MGMT = 0x56,
         #define GET_DCD_INFO    0x0
         #define GET_HOST_DC_REGION_CONFIG   0x1
+        #define SET_DC_REGION_CONFIG        0x2
 };
 
 /* CCI Message Format CXL r3.1 Figure 7-19 */
@@ -3390,6 +3392,84 @@ static CXLRetCode cmd_fm_get_host_dc_region_config(const struct cxl_cmd *cmd,
     return CXL_MBOX_SUCCESS;
 }
 
+/* CXL r3.2 section 7.6.7.6.3: Set Host DC Region Configuration (Opcode 5602) */
+static CXLRetCode cmd_fm_set_dc_region_config(const struct cxl_cmd *cmd,
+                                              uint8_t *payload_in,
+                                              size_t len_in,
+                                              uint8_t *payload_out,
+                                              size_t *len_out,
+                                              CXLCCI *cci)
+{
+    struct {
+        uint8_t reg_id;
+        uint8_t rsvd[3];
+        uint64_t block_sz;
+        uint8_t flags;
+        uint8_t rsvd2[3];
+    } QEMU_PACKED *in = (void *)payload_in;
+    CXLType3Dev *ct3d = CXL_TYPE3(cci->d);
+    CXLEventDynamicCapacity dcEvent = {};
+    CXLDCRegion *region = &ct3d->dc.regions[in->reg_id];
+
+    /*
+     * CXL r3.2 7.6.7.6.3: Set DC Region Configuration
+     * This command shall fail with Unsupported when the Sanitize on Release
+     * field does not match the region’s configuration... and the device
+     * does not support reconfiguration of the Sanitize on Release setting.
+     *
+     * Currently not reconfigurable, so always fail if sanitize bit (bit 0)
+     * doesn't match.
+     */
+    if ((in->flags & 0x1) != (region->flags & 0x1)) {
+        return CXL_MBOX_UNSUPPORTED;
+    }
+
+    if (in->reg_id >= DCD_MAX_NUM_REGION) {
+        return CXL_MBOX_UNSUPPORTED;
+    }
+
+    /* Check that no extents are in the region being reconfigured */
+    if (!bitmap_empty(region->blk_bitmap, region->len / region->block_size)) {
+        return CXL_MBOX_UNSUPPORTED;
+    }
+
+    /* Check that new block size is supported */
+    if (!is_power_of_2(in->block_sz) ||
+        !(in->block_sz & region->supported_blk_size_bitmask)) {
+        return CXL_MBOX_INVALID_INPUT;
+    }
+
+    /* Return success if new block size == current block size */
+    if (in->block_sz == region->block_size) {
+        return CXL_MBOX_SUCCESS;
+    }
+
+    /* Free bitmap and create new one for new block size. */
+    qemu_mutex_lock(&region->bitmap_lock);
+    g_free(region->blk_bitmap);
+    region->blk_bitmap = bitmap_new(region->len / in->block_sz);
+    qemu_mutex_unlock(&region->bitmap_lock);
+    region->block_size = in->block_sz;
+
+    /* Create event record and insert into event log */
+    cxl_assign_event_header(&dcEvent.hdr,
+                            &dynamic_capacity_uuid,
+                            (1 << CXL_EVENT_TYPE_INFO),
+                            sizeof(dcEvent),
+                            cxl_device_get_timestamp(&ct3d->cxl_dstate));
+    dcEvent.type = DC_EVENT_REGION_CONFIG_UPDATED;
+    dcEvent.validity_flags = 1;
+    dcEvent.host_id = 0;
+    dcEvent.updated_region_id = in->reg_id;
+
+    if (cxl_event_insert(&ct3d->cxl_dstate,
+                         CXL_EVENT_TYPE_DYNAMIC_CAP,
+                         (CXLEventRecordRaw *)&dcEvent)) {
+        cxl_event_irq_assert(ct3d);
+    }
+    return CXL_MBOX_SUCCESS;
+}
+
 static const struct cxl_cmd cxl_cmd_set[256][256] = {
     [INFOSTAT][BACKGROUND_OPERATION_ABORT] = { "BACKGROUND_OPERATION_ABORT",
         cmd_infostat_bg_op_abort, 0, 0 },
@@ -3508,6 +3588,13 @@ static const struct cxl_cmd cxl_cmd_set_fm_dcd[256][256] = {
         cmd_fm_get_dcd_info, 0, 0 },
     [FMAPI_DCD_MGMT][GET_HOST_DC_REGION_CONFIG] = { "GET_HOST_DC_REGION_CONFIG",
         cmd_fm_get_host_dc_region_config, 4, 0 },
+    [FMAPI_DCD_MGMT][SET_DC_REGION_CONFIG] = { "SET_DC_REGION_CONFIG",
+        cmd_fm_set_dc_region_config, 16,
+        (CXL_MBOX_CONFIG_CHANGE_COLD_RESET |
+         CXL_MBOX_CONFIG_CHANGE_CONV_RESET |
+         CXL_MBOX_CONFIG_CHANGE_CXL_RESET |
+         CXL_MBOX_IMMEDIATE_CONFIG_CHANGE |
+         CXL_MBOX_IMMEDIATE_DATA_CHANGE) },
 };
 
 /*
diff --git a/hw/mem/cxl_type3.c b/hw/mem/cxl_type3.c
index a7a1857a0c..4a45b4510e 100644
--- a/hw/mem/cxl_type3.c
+++ b/hw/mem/cxl_type3.c
@@ -1590,9 +1590,9 @@ void qmp_cxl_inject_correctable_error(const char *path, CxlCorErrorType type,
     pcie_aer_inject_error(PCI_DEVICE(obj), &err);
 }
 
-static void cxl_assign_event_header(CXLEventRecordHdr *hdr,
-                                    const QemuUUID *uuid, uint32_t flags,
-                                    uint8_t length, uint64_t timestamp)
+void cxl_assign_event_header(CXLEventRecordHdr *hdr,
+                             const QemuUUID *uuid, uint32_t flags,
+                             uint8_t length, uint64_t timestamp)
 {
     st24_le_p(&hdr->flags, flags);
     hdr->length = length;
diff --git a/include/hw/cxl/cxl_device.h b/include/hw/cxl/cxl_device.h
index 42ae5b7479..c836fc17f0 100644
--- a/include/hw/cxl/cxl_device.h
+++ b/include/hw/cxl/cxl_device.h
@@ -721,4 +721,7 @@ void ct3_clear_region_block_backed(CXLType3Dev *ct3d, uint64_t dpa,
                                    uint64_t len);
 bool ct3_test_region_block_backed(CXLType3Dev *ct3d, uint64_t dpa,
                                   uint64_t len);
+void cxl_assign_event_header(CXLEventRecordHdr *hdr,
+                             const QemuUUID *uuid, uint32_t flags,
+                             uint8_t length, uint64_t timestamp);
 #endif
diff --git a/include/hw/cxl/cxl_mailbox.h b/include/hw/cxl/cxl_mailbox.h
index 9008402d1c..a05d7cb5b7 100644
--- a/include/hw/cxl/cxl_mailbox.h
+++ b/include/hw/cxl/cxl_mailbox.h
@@ -8,6 +8,7 @@
 #ifndef CXL_MAILBOX_H
 #define CXL_MAILBOX_H
 
+#define CXL_MBOX_CONFIG_CHANGE_COLD_RESET (1)
 #define CXL_MBOX_IMMEDIATE_CONFIG_CHANGE (1 << 1)
 #define CXL_MBOX_IMMEDIATE_DATA_CHANGE (1 << 2)
 #define CXL_MBOX_IMMEDIATE_POLICY_CHANGE (1 << 3)
@@ -15,5 +16,10 @@
 #define CXL_MBOX_SECURITY_STATE_CHANGE (1 << 5)
 #define CXL_MBOX_BACKGROUND_OPERATION (1 << 6)
 #define CXL_MBOX_BACKGROUND_OPERATION_ABORT (1 << 7)
+#define CXL_MBOX_SECONDARY_MBOX_SUPPORTED (1 << 8)
+#define CXL_MBOX_REQUEST_ABORT_BACKGROUND_OP_SUPPORTED (1 << 9)
+#define CXL_MBOX_CEL_10_TO_11_VALID (1 << 10)
+#define CXL_MBOX_CONFIG_CHANGE_CONV_RESET (1 << 11)
+#define CXL_MBOX_CONFIG_CHANGE_CXL_RESET (1 << 12)
 
 #endif

From 21af9a917eca69996891dcbb93edcb6c5c53e52c Mon Sep 17 00:00:00 2001
From: Anisa Su <anisa.su@samsung.com>
Date: Mon, 14 Jul 2025 18:45:04 +0100
Subject: [PATCH 2433/2760] hw/cxl: mailbox-utils: 0x5603 - FMAPI Get DC Region
 Extent Lists

FM DCD Management command 0x5603 implemented per CXL r3.2 Spec Section 7.6.7.6.4
Very similar to previously implemented command 0x4801.

Reviewed-by: Fan Ni <fan.ni@samsung.com>
Signed-off-by: Anisa Su <anisa.su@samsung.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Message-Id: <20250714174509.1984430-9-Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/cxl/cxl-mailbox-utils.c | 76 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 76 insertions(+)

diff --git a/hw/cxl/cxl-mailbox-utils.c b/hw/cxl/cxl-mailbox-utils.c
index b4a0f7d664..4b0fdbbdd8 100644
--- a/hw/cxl/cxl-mailbox-utils.c
+++ b/hw/cxl/cxl-mailbox-utils.c
@@ -123,6 +123,7 @@ enum {
         #define GET_DCD_INFO    0x0
         #define GET_HOST_DC_REGION_CONFIG   0x1
         #define SET_DC_REGION_CONFIG        0x2
+        #define GET_DC_REGION_EXTENT_LIST   0x3
 };
 
 /* CCI Message Format CXL r3.1 Figure 7-19 */
@@ -3470,6 +3471,79 @@ static CXLRetCode cmd_fm_set_dc_region_config(const struct cxl_cmd *cmd,
     return CXL_MBOX_SUCCESS;
 }
 
+/* CXL r3.2 section 7.6.7.6.4: Get DC Region Extent Lists (Opcode 5603h) */
+static CXLRetCode cmd_fm_get_dc_region_extent_list(const struct cxl_cmd *cmd,
+                                                   uint8_t *payload_in,
+                                                   size_t len_in,
+                                                   uint8_t *payload_out,
+                                                   size_t *len_out,
+                                                   CXLCCI *cci)
+{
+    struct {
+        uint16_t host_id;
+        uint8_t rsvd[2];
+        uint32_t extent_cnt;
+        uint32_t start_extent_id;
+    } QEMU_PACKED *in = (void *)payload_in;
+    struct {
+        uint16_t host_id;
+        uint8_t rsvd[2];
+        uint32_t start_extent_id;
+        uint32_t extents_returned;
+        uint32_t total_extents;
+        uint32_t list_generation_num;
+        uint8_t rsvd2[4];
+        CXLDCExtentRaw records[];
+    } QEMU_PACKED *out = (void *)payload_out;
+    QEMU_BUILD_BUG_ON(sizeof(*in) != 0xc);
+    CXLType3Dev *ct3d = CXL_TYPE3(cci->d);
+    CXLDCExtent *ent;
+    CXLDCExtentRaw *out_rec;
+    uint16_t record_count = 0, record_done = 0, i = 0;
+    uint16_t out_pl_len, max_size;
+
+    if (in->host_id != 0) {
+        return CXL_MBOX_INVALID_INPUT;
+    }
+
+    if (in->start_extent_id > ct3d->dc.nr_extents_accepted) {
+        return CXL_MBOX_INVALID_INPUT;
+    }
+
+    record_count = MIN(in->extent_cnt,
+                       ct3d->dc.nr_extents_accepted - in->start_extent_id);
+    max_size = CXL_MAILBOX_MAX_PAYLOAD_SIZE - sizeof(*out);
+    record_count = MIN(record_count, max_size / sizeof(out->records[0]));
+    out_pl_len = sizeof(*out) + record_count * sizeof(out->records[0]);
+
+    stw_le_p(&out->host_id, in->host_id);
+    stl_le_p(&out->start_extent_id, in->start_extent_id);
+    stl_le_p(&out->extents_returned, record_count);
+    stl_le_p(&out->total_extents, ct3d->dc.nr_extents_accepted);
+    stl_le_p(&out->list_generation_num, ct3d->dc.ext_list_gen_seq);
+
+    if (record_count > 0) {
+        QTAILQ_FOREACH(ent, &ct3d->dc.extents, node) {
+            if (i++ < in->start_extent_id) {
+                continue;
+            }
+            out_rec = &out->records[record_done];
+            stq_le_p(&out_rec->start_dpa, ent->start_dpa);
+            stq_le_p(&out_rec->len, ent->len);
+            memcpy(&out_rec->tag, ent->tag, 0x10);
+            stw_le_p(&out_rec->shared_seq, ent->shared_seq);
+
+            record_done++;
+            if (record_done == record_count) {
+                break;
+            }
+        }
+    }
+
+    *len_out = out_pl_len;
+    return CXL_MBOX_SUCCESS;
+}
+
 static const struct cxl_cmd cxl_cmd_set[256][256] = {
     [INFOSTAT][BACKGROUND_OPERATION_ABORT] = { "BACKGROUND_OPERATION_ABORT",
         cmd_infostat_bg_op_abort, 0, 0 },
@@ -3595,6 +3669,8 @@ static const struct cxl_cmd cxl_cmd_set_fm_dcd[256][256] = {
          CXL_MBOX_CONFIG_CHANGE_CXL_RESET |
          CXL_MBOX_IMMEDIATE_CONFIG_CHANGE |
          CXL_MBOX_IMMEDIATE_DATA_CHANGE) },
+    [FMAPI_DCD_MGMT][GET_DC_REGION_EXTENT_LIST] = { "GET_DC_REGION_EXTENT_LIST",
+        cmd_fm_get_dc_region_extent_list, 12, 0 },
 };
 
 /*

From 0a362772e0cff8745d0bda73757ba4c7cfbbc841 Mon Sep 17 00:00:00 2001
From: Anisa Su <anisa.su@samsung.com>
Date: Mon, 14 Jul 2025 18:45:05 +0100
Subject: [PATCH 2434/2760] hw/cxl: Create helper function to create DC Event
 Records from extents

Prepatory patch for following FMAPI Add/Release Patches. Refactors part
of qmp_cxl_process_dynamic_capacity_prescriptive() into a helper
function to create DC Event Records and insert in the event log.

Moves definition for CXL_NUM_EXTENTS_SUPPORTED to cxl.h so it can be
accessed by cxl-mailbox-utils.c and cxl-events.c, where the helper
function is defined.

Reviewed-by: Fan Ni <fan.ni@samsung.com>
Signed-off-by: Anisa Su <anisa.su@samsung.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Message-Id: <20250714174509.1984430-10-Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/cxl/cxl-events.c         | 38 +++++++++++++++++++++++++++++++++++++
 hw/cxl/cxl-mailbox-utils.c  |  1 -
 hw/mem/cxl_type3.c          | 37 +-----------------------------------
 include/hw/cxl/cxl.h        |  1 +
 include/hw/cxl/cxl_device.h |  4 ++++
 5 files changed, 44 insertions(+), 37 deletions(-)

diff --git a/hw/cxl/cxl-events.c b/hw/cxl/cxl-events.c
index f90470930d..7583dd9162 100644
--- a/hw/cxl/cxl-events.c
+++ b/hw/cxl/cxl-events.c
@@ -258,3 +258,41 @@ void cxl_event_irq_assert(CXLType3Dev *ct3d)
         }
     }
 }
+
+void cxl_create_dc_event_records_for_extents(CXLType3Dev *ct3d,
+                                             CXLDCEventType type,
+                                             CXLDCExtentRaw extents[],
+                                             uint32_t ext_count)
+{
+    CXLEventDynamicCapacity event_rec = {};
+    int i;
+
+    cxl_assign_event_header(&event_rec.hdr,
+                            &dynamic_capacity_uuid,
+                            (1 << CXL_EVENT_TYPE_INFO),
+                            sizeof(event_rec),
+                            cxl_device_get_timestamp(&ct3d->cxl_dstate));
+    event_rec.type = type;
+    event_rec.validity_flags = 1;
+    event_rec.host_id = 0;
+    event_rec.updated_region_id = 0;
+    event_rec.extents_avail = CXL_NUM_EXTENTS_SUPPORTED -
+                              ct3d->dc.total_extent_count;
+
+    for (i = 0; i < ext_count; i++) {
+        memcpy(&event_rec.dynamic_capacity_extent,
+               &extents[i],
+               sizeof(CXLDCExtentRaw));
+        event_rec.flags = 0;
+        if (i < ext_count - 1) {
+            /* Set "More" flag */
+            event_rec.flags |= BIT(0);
+        }
+
+        if (cxl_event_insert(&ct3d->cxl_dstate,
+                             CXL_EVENT_TYPE_DYNAMIC_CAP,
+                             (CXLEventRecordRaw *)&event_rec)) {
+            cxl_event_irq_assert(ct3d);
+        }
+    }
+}
diff --git a/hw/cxl/cxl-mailbox-utils.c b/hw/cxl/cxl-mailbox-utils.c
index 4b0fdbbdd8..b6f30e8689 100644
--- a/hw/cxl/cxl-mailbox-utils.c
+++ b/hw/cxl/cxl-mailbox-utils.c
@@ -28,7 +28,6 @@
 
 #define CXL_CAPACITY_MULTIPLIER   (256 * MiB)
 #define CXL_DC_EVENT_LOG_SIZE 8
-#define CXL_NUM_EXTENTS_SUPPORTED 512
 #define CXL_NUM_TAGS_SUPPORTED 0
 #define CXL_ALERTS_LIFE_USED_WARN_THRESH (1 << 0)
 #define CXL_ALERTS_OVER_TEMP_WARN_THRESH (1 << 1)
diff --git a/hw/mem/cxl_type3.c b/hw/mem/cxl_type3.c
index 4a45b4510e..4e975b1a42 100644
--- a/hw/mem/cxl_type3.c
+++ b/hw/mem/cxl_type3.c
@@ -1957,15 +1957,11 @@ static void qmp_cxl_process_dynamic_capacity_prescriptive(const char *path,
         CxlDynamicCapacityExtentList *records, Error **errp)
 {
     Object *obj;
-    CXLEventDynamicCapacity dCap = {};
-    CXLEventRecordHdr *hdr = &dCap.hdr;
     CXLType3Dev *dcd;
-    uint8_t flags = 1 << CXL_EVENT_TYPE_INFO;
     uint32_t num_extents = 0;
     CxlDynamicCapacityExtentList *list;
     CXLDCExtentGroup *group = NULL;
     g_autofree CXLDCExtentRaw *extents = NULL;
-    uint8_t enc_log = CXL_EVENT_TYPE_DYNAMIC_CAP;
     uint64_t dpa, offset, len, block_size;
     g_autofree unsigned long *blk_bitmap = NULL;
     int i;
@@ -2078,38 +2074,7 @@ static void qmp_cxl_process_dynamic_capacity_prescriptive(const char *path,
         dcd->dc.total_extent_count += num_extents;
     }
 
-    /*
-     * CXL r3.1 section 8.2.9.2.1.6: Dynamic Capacity Event Record
-     *
-     * All Dynamic Capacity event records shall set the Event Record Severity
-     * field in the Common Event Record Format to Informational Event. All
-     * Dynamic Capacity related events shall be logged in the Dynamic Capacity
-     * Event Log.
-     */
-    cxl_assign_event_header(hdr, &dynamic_capacity_uuid, flags, sizeof(dCap),
-                            cxl_device_get_timestamp(&dcd->cxl_dstate));
-
-    dCap.type = type;
-    /* FIXME: for now, validity flag is cleared */
-    dCap.validity_flags = 0;
-    stw_le_p(&dCap.host_id, hid);
-    /* only valid for DC_REGION_CONFIG_UPDATED event */
-    dCap.updated_region_id = 0;
-    for (i = 0; i < num_extents; i++) {
-        memcpy(&dCap.dynamic_capacity_extent, &extents[i],
-               sizeof(CXLDCExtentRaw));
-
-        dCap.flags = 0;
-        if (i < num_extents - 1) {
-            /* Set "More" flag */
-            dCap.flags |= BIT(0);
-        }
-
-        if (cxl_event_insert(&dcd->cxl_dstate, enc_log,
-                             (CXLEventRecordRaw *)&dCap)) {
-            cxl_event_irq_assert(dcd);
-        }
-    }
+    cxl_create_dc_event_records_for_extents(dcd, type, extents, num_extents);
 }
 
 void qmp_cxl_add_dynamic_capacity(const char *path, uint16_t host_id,
diff --git a/include/hw/cxl/cxl.h b/include/hw/cxl/cxl.h
index de66ab8c35..998f495a98 100644
--- a/include/hw/cxl/cxl.h
+++ b/include/hw/cxl/cxl.h
@@ -23,6 +23,7 @@
 #define CXL_DEVICE_REG_BAR_IDX 2
 
 #define CXL_WINDOW_MAX 10
+#define CXL_NUM_EXTENTS_SUPPORTED 512
 
 typedef struct PXBCXLDev PXBCXLDev;
 
diff --git a/include/hw/cxl/cxl_device.h b/include/hw/cxl/cxl_device.h
index c836fc17f0..71a5834c3d 100644
--- a/include/hw/cxl/cxl_device.h
+++ b/include/hw/cxl/cxl_device.h
@@ -724,4 +724,8 @@ bool ct3_test_region_block_backed(CXLType3Dev *ct3d, uint64_t dpa,
 void cxl_assign_event_header(CXLEventRecordHdr *hdr,
                              const QemuUUID *uuid, uint32_t flags,
                              uint8_t length, uint64_t timestamp);
+void cxl_create_dc_event_records_for_extents(CXLType3Dev *ct3d,
+                                             CXLDCEventType type,
+                                             CXLDCExtentRaw extents[],
+                                             uint32_t ext_count);
 #endif

From 42cbc937d4f6502b398674e38e393f354db52c4c Mon Sep 17 00:00:00 2001
From: Anisa Su <anisa.su@samsung.com>
Date: Mon, 14 Jul 2025 18:45:06 +0100
Subject: [PATCH 2435/2760] hw/cxl: mailbox-utils: 0x5604 - FMAPI Initiate DC
 Add

FM DCD Management command 0x5604 implemented per CXL r3.2 Spec Section 7.6.7.6.5

Reviewed-by: Fan Ni <fan.ni@samsung.com>
Signed-off-by: Anisa Su <anisa.su@samsung.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Message-Id: <20250714174509.1984430-11-Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/cxl/cxl-mailbox-utils.c  | 109 ++++++++++++++++++++++++++++++++++++
 hw/mem/cxl_type3.c          |   8 +--
 include/hw/cxl/cxl_device.h |   4 ++
 3 files changed, 117 insertions(+), 4 deletions(-)

diff --git a/hw/cxl/cxl-mailbox-utils.c b/hw/cxl/cxl-mailbox-utils.c
index b6f30e8689..5d08525529 100644
--- a/hw/cxl/cxl-mailbox-utils.c
+++ b/hw/cxl/cxl-mailbox-utils.c
@@ -123,6 +123,7 @@ enum {
         #define GET_HOST_DC_REGION_CONFIG   0x1
         #define SET_DC_REGION_CONFIG        0x2
         #define GET_DC_REGION_EXTENT_LIST   0x3
+        #define INITIATE_DC_ADD             0x4
 };
 
 /* CCI Message Format CXL r3.1 Figure 7-19 */
@@ -3543,6 +3544,107 @@ static CXLRetCode cmd_fm_get_dc_region_extent_list(const struct cxl_cmd *cmd,
     return CXL_MBOX_SUCCESS;
 }
 
+/*
+ * Helper function to convert CXLDCExtentRaw to CXLUpdateDCExtentListInPl
+ * in order to reuse cxl_detect_malformed_extent_list() function which accepts
+ * CXLUpdateDCExtentListInPl as a parameter.
+ */
+static void convert_raw_extents(CXLDCExtentRaw raw_extents[],
+                                CXLUpdateDCExtentListInPl *extent_list,
+                                int count)
+{
+    int i;
+
+    extent_list->num_entries_updated = count;
+
+    for (i = 0; i < count; i++) {
+        extent_list->updated_entries[i].start_dpa = raw_extents[i].start_dpa;
+        extent_list->updated_entries[i].len = raw_extents[i].len;
+    }
+}
+
+/* CXL r3.2 Section 7.6.7.6.5: Initiate Dynamic Capacity Add (Opcode 5604h) */
+static CXLRetCode cmd_fm_initiate_dc_add(const struct cxl_cmd *cmd,
+                                         uint8_t *payload_in,
+                                         size_t len_in,
+                                         uint8_t *payload_out,
+                                         size_t *len_out,
+                                         CXLCCI *cci)
+{
+    struct {
+        uint16_t host_id;
+        uint8_t selection_policy;
+        uint8_t reg_num;
+        uint64_t length;
+        uint8_t tag[0x10];
+        uint32_t ext_count;
+        CXLDCExtentRaw extents[];
+    } QEMU_PACKED *in = (void *)payload_in;
+    CXLType3Dev *ct3d = CXL_TYPE3(cci->d);
+    int i, rc;
+
+    switch (in->selection_policy) {
+        case CXL_EXTENT_SELECTION_POLICY_PRESCRIPTIVE: {
+            /* Adding extents exceeds device's extent tracking ability. */
+            if (in->ext_count + ct3d->dc.total_extent_count >
+                CXL_NUM_EXTENTS_SUPPORTED) {
+                return CXL_MBOX_RESOURCES_EXHAUSTED;
+            }
+
+            g_autofree CXLUpdateDCExtentListInPl *list =
+                g_malloc0(sizeof(*list) +
+                    in->ext_count * sizeof(*list->updated_entries));
+
+            convert_raw_extents(in->extents, list, in->ext_count);
+            rc = cxl_detect_malformed_extent_list(ct3d, list);
+
+            for (i = 0; i < in->ext_count; i++) {
+                CXLDCExtentRaw *ext = &in->extents[i];
+
+                /* Check requested extents do not overlap with pending ones. */
+                if (cxl_extent_groups_overlaps_dpa_range(&ct3d->dc.extents_pending,
+                                                         ext->start_dpa,
+                                                         ext->len)) {
+                    return CXL_MBOX_INVALID_EXTENT_LIST;
+                }
+                /* Check requested extents do not overlap with existing ones. */
+                if (cxl_extents_overlaps_dpa_range(&ct3d->dc.extents,
+                                                   ext->start_dpa,
+                                                   ext->len)) {
+                    return CXL_MBOX_INVALID_EXTENT_LIST;
+                }
+            }
+
+            if (rc) {
+                return rc;
+            }
+
+            CXLDCExtentGroup *group = NULL;
+            for (i = 0; i < in->ext_count; i++) {
+                CXLDCExtentRaw *ext = &in->extents[i];
+
+                group = cxl_insert_extent_to_extent_group(group, ext->start_dpa,
+                                                          ext->len, ext->tag,
+                                                          ext->shared_seq);
+            }
+
+            cxl_extent_group_list_insert_tail(&ct3d->dc.extents_pending, group);
+            ct3d->dc.total_extent_count += in->ext_count;
+            cxl_create_dc_event_records_for_extents(ct3d,
+                                                    DC_EVENT_ADD_CAPACITY,
+                                                    in->extents,
+                                                    in->ext_count);
+
+            return CXL_MBOX_SUCCESS;
+        }
+        default: {
+            qemu_log_mask(LOG_UNIMP,
+                          "CXL extent selection policy not supported.\n");
+            return CXL_MBOX_INVALID_INPUT;
+        }
+    }
+}
+
 static const struct cxl_cmd cxl_cmd_set[256][256] = {
     [INFOSTAT][BACKGROUND_OPERATION_ABORT] = { "BACKGROUND_OPERATION_ABORT",
         cmd_infostat_bg_op_abort, 0, 0 },
@@ -3670,6 +3772,13 @@ static const struct cxl_cmd cxl_cmd_set_fm_dcd[256][256] = {
          CXL_MBOX_IMMEDIATE_DATA_CHANGE) },
     [FMAPI_DCD_MGMT][GET_DC_REGION_EXTENT_LIST] = { "GET_DC_REGION_EXTENT_LIST",
         cmd_fm_get_dc_region_extent_list, 12, 0 },
+    [FMAPI_DCD_MGMT][INITIATE_DC_ADD] = { "INIT_DC_ADD",
+        cmd_fm_initiate_dc_add, ~0,
+        (CXL_MBOX_CONFIG_CHANGE_COLD_RESET |
+        CXL_MBOX_CONFIG_CHANGE_CONV_RESET |
+        CXL_MBOX_CONFIG_CHANGE_CXL_RESET |
+        CXL_MBOX_IMMEDIATE_CONFIG_CHANGE |
+        CXL_MBOX_IMMEDIATE_DATA_CHANGE) },
 };
 
 /*
diff --git a/hw/mem/cxl_type3.c b/hw/mem/cxl_type3.c
index 4e975b1a42..be609ff9d0 100644
--- a/hw/mem/cxl_type3.c
+++ b/hw/mem/cxl_type3.c
@@ -1885,8 +1885,8 @@ void qmp_cxl_inject_memory_module_event(const char *path, CxlEventLog log,
  * the list.
  * Return value: return true if has overlaps; otherwise, return false
  */
-static bool cxl_extents_overlaps_dpa_range(CXLDCExtentList *list,
-                                           uint64_t dpa, uint64_t len)
+bool cxl_extents_overlaps_dpa_range(CXLDCExtentList *list,
+                                    uint64_t dpa, uint64_t len)
 {
     CXLDCExtent *ent;
     Range range1, range2;
@@ -1931,8 +1931,8 @@ bool cxl_extents_contains_dpa_range(CXLDCExtentList *list,
     return false;
 }
 
-static bool cxl_extent_groups_overlaps_dpa_range(CXLDCExtentGroupList *list,
-                                                 uint64_t dpa, uint64_t len)
+bool cxl_extent_groups_overlaps_dpa_range(CXLDCExtentGroupList *list,
+                                          uint64_t dpa, uint64_t len)
 {
     CXLDCExtentGroup *group;
 
diff --git a/include/hw/cxl/cxl_device.h b/include/hw/cxl/cxl_device.h
index 71a5834c3d..89411c8093 100644
--- a/include/hw/cxl/cxl_device.h
+++ b/include/hw/cxl/cxl_device.h
@@ -728,4 +728,8 @@ void cxl_create_dc_event_records_for_extents(CXLType3Dev *ct3d,
                                              CXLDCEventType type,
                                              CXLDCExtentRaw extents[],
                                              uint32_t ext_count);
+bool cxl_extents_overlaps_dpa_range(CXLDCExtentList *list,
+                                    uint64_t dpa, uint64_t len);
+bool cxl_extent_groups_overlaps_dpa_range(CXLDCExtentGroupList *list,
+                                          uint64_t dpa, uint64_t len);
 #endif

From fdd48ce20ce125cc992dfaace925f1bfae3dfdc1 Mon Sep 17 00:00:00 2001
From: Anisa Su <anisa.su@samsung.com>
Date: Mon, 14 Jul 2025 18:45:07 +0100
Subject: [PATCH 2436/2760] hw/cxl: mailbox-utils: 0x5605 - FMAPI Initiate DC
 Release

FM DCD Management command 0x5605 implemented per CXL r3.2 Spec Section 7.6.7.6.6

Reviewed-by: Fan Ni <fan.ni@samsung.com>
Signed-off-by: Anisa Su <anisa.su@samsung.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Message-Id: <20250714174509.1984430-12-Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/cxl/cxl-mailbox-utils.c | 88 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 88 insertions(+)

diff --git a/hw/cxl/cxl-mailbox-utils.c b/hw/cxl/cxl-mailbox-utils.c
index 5d08525529..68c7cc9891 100644
--- a/hw/cxl/cxl-mailbox-utils.c
+++ b/hw/cxl/cxl-mailbox-utils.c
@@ -124,6 +124,7 @@ enum {
         #define SET_DC_REGION_CONFIG        0x2
         #define GET_DC_REGION_EXTENT_LIST   0x3
         #define INITIATE_DC_ADD             0x4
+        #define INITIATE_DC_RELEASE         0x5
 };
 
 /* CCI Message Format CXL r3.1 Figure 7-19 */
@@ -3645,6 +3646,86 @@ static CXLRetCode cmd_fm_initiate_dc_add(const struct cxl_cmd *cmd,
     }
 }
 
+#define CXL_EXTENT_REMOVAL_POLICY_MASK 0x0F
+#define CXL_FORCED_REMOVAL_MASK (1 << 4)
+/*
+ * CXL r3.2 Section 7.6.7.6.6:
+ * Initiate Dynamic Capacity Release (Opcode 5605h)
+ */
+static CXLRetCode cmd_fm_initiate_dc_release(const struct cxl_cmd *cmd,
+                                             uint8_t *payload_in,
+                                             size_t len_in,
+                                             uint8_t *payload_out,
+                                             size_t *len_out,
+                                             CXLCCI *cci)
+{
+    struct {
+        uint16_t host_id;
+        uint8_t flags;
+        uint8_t reg_num;
+        uint64_t length;
+        uint8_t tag[0x10];
+        uint32_t ext_count;
+        CXLDCExtentRaw extents[];
+    } QEMU_PACKED *in = (void *)payload_in;
+    CXLType3Dev *ct3d = CXL_TYPE3(cci->d);
+    int i, rc;
+
+    switch (in->flags & CXL_EXTENT_REMOVAL_POLICY_MASK) {
+        case CXL_EXTENT_REMOVAL_POLICY_PRESCRIPTIVE: {
+            CXLDCExtentList updated_list;
+            uint32_t updated_list_size;
+            g_autofree CXLUpdateDCExtentListInPl *list =
+                g_malloc0(sizeof(*list) +
+                    in->ext_count * sizeof(*list->updated_entries));
+
+            convert_raw_extents(in->extents, list, in->ext_count);
+            rc = cxl_detect_malformed_extent_list(ct3d, list);
+            if (rc) {
+                return rc;
+            }
+
+            /*
+             * Fail with Invalid PA if an extent is pending and Forced Removal
+             * flag not set.
+             */
+            if (!(in->flags & CXL_FORCED_REMOVAL_MASK)) {
+                for (i = 0; i < in->ext_count; i++) {
+                    CXLDCExtentRaw ext = in->extents[i];
+                    /*
+                     * Check requested extents don't overlap with pending
+                     * extents.
+                     */
+                    if (cxl_extent_groups_overlaps_dpa_range(
+                            &ct3d->dc.extents_pending,
+                            ext.start_dpa,
+                            ext.len)) {
+                        return CXL_MBOX_INVALID_PA;
+                    }
+                }
+            }
+
+            rc = cxl_dc_extent_release_dry_run(ct3d,
+                                               list,
+                                               &updated_list,
+                                               &updated_list_size);
+            if (rc) {
+                return rc;
+            }
+            cxl_create_dc_event_records_for_extents(ct3d,
+                                                    DC_EVENT_RELEASE_CAPACITY,
+                                                    in->extents,
+                                                    in->ext_count);
+            return CXL_MBOX_SUCCESS;
+        }
+        default: {
+            qemu_log_mask(LOG_UNIMP,
+                "CXL extent removal policy not supported.\n");
+            return CXL_MBOX_INVALID_INPUT;
+        }
+    }
+}
+
 static const struct cxl_cmd cxl_cmd_set[256][256] = {
     [INFOSTAT][BACKGROUND_OPERATION_ABORT] = { "BACKGROUND_OPERATION_ABORT",
         cmd_infostat_bg_op_abort, 0, 0 },
@@ -3779,6 +3860,13 @@ static const struct cxl_cmd cxl_cmd_set_fm_dcd[256][256] = {
         CXL_MBOX_CONFIG_CHANGE_CXL_RESET |
         CXL_MBOX_IMMEDIATE_CONFIG_CHANGE |
         CXL_MBOX_IMMEDIATE_DATA_CHANGE) },
+    [FMAPI_DCD_MGMT][INITIATE_DC_RELEASE] = { "INIT_DC_RELEASE",
+        cmd_fm_initiate_dc_release, ~0,
+        (CXL_MBOX_CONFIG_CHANGE_COLD_RESET |
+         CXL_MBOX_CONFIG_CHANGE_CONV_RESET |
+         CXL_MBOX_CONFIG_CHANGE_CXL_RESET |
+         CXL_MBOX_IMMEDIATE_CONFIG_CHANGE |
+         CXL_MBOX_IMMEDIATE_DATA_CHANGE) },
 };
 
 /*

From 0c1a109fe6d1bcad98f217dd9ce8767b07039df0 Mon Sep 17 00:00:00 2001
From: John Levon <john.levon@nutanix.com>
Date: Tue, 15 Jul 2025 13:59:51 +0200
Subject: [PATCH 2437/2760] =?UTF-8?q?hw/vfio-user:=20add=20C=C3=A9dric=20L?=
 =?UTF-8?q?e=20Goater=20as=20a=20maintainer?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: John Levon <john.levon@nutanix.com>
Acked-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Link: https://lore.kernel.org/qemu-devel/20250715115954.515819-2-john.levon@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 MAINTAINERS | 1 +
 1 file changed, 1 insertion(+)

diff --git a/MAINTAINERS b/MAINTAINERS
index e88ed2c0a9..30e9b71e6e 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -4287,6 +4287,7 @@ F: tests/functional/test_multiprocess.py
 VFIO-USER:
 M: John Levon <john.levon@nutanix.com>
 M: Thanos Makatos <thanos.makatos@nutanix.com>
+M: Cédric Le Goater <clg@redhat.com>
 S: Supported
 F: docs/interop/vfio-user.rst
 F: docs/system/devices/vfio-user.rst

From 09353802f0021af9f13ebe9336e1994da4505626 Mon Sep 17 00:00:00 2001
From: John Levon <john.levon@nutanix.com>
Date: Tue, 15 Jul 2025 13:59:52 +0200
Subject: [PATCH 2438/2760] hw/vfio: fix region fd initialization
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We were not initializing the region fd array to -1, so we would
accidentally try to close(0) on cleanup for any region that is not
referenced.

Fixes: 95cdb024 ("vfio: add region info cache")
Signed-off-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250715115954.515819-3-john.levon@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/device.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/hw/vfio/device.c b/hw/vfio/device.c
index 96cf21462c..52a1996dc4 100644
--- a/hw/vfio/device.c
+++ b/hw/vfio/device.c
@@ -463,6 +463,8 @@ void vfio_device_detach(VFIODevice *vbasedev)
 void vfio_device_prepare(VFIODevice *vbasedev, VFIOContainerBase *bcontainer,
                          struct vfio_device_info *info)
 {
+    int i;
+
     vbasedev->num_irqs = info->num_irqs;
     vbasedev->num_regions = info->num_regions;
     vbasedev->flags = info->flags;
@@ -477,6 +479,9 @@ void vfio_device_prepare(VFIODevice *vbasedev, VFIOContainerBase *bcontainer,
                                vbasedev->num_regions);
     if (vbasedev->use_region_fds) {
         vbasedev->region_fds = g_new0(int, vbasedev->num_regions);
+        for (i = 0; i < vbasedev->num_regions; i++) {
+            vbasedev->region_fds[i] = -1;
+        }
     }
 }
 
@@ -489,7 +494,6 @@ void vfio_device_unprepare(VFIODevice *vbasedev)
         if (vbasedev->region_fds != NULL && vbasedev->region_fds[i] != -1) {
             close(vbasedev->region_fds[i]);
         }
-
     }
 
     g_clear_pointer(&vbasedev->reginfo, g_free);

From ea6788440df37495de6e257ca204cdd669d32b83 Mon Sep 17 00:00:00 2001
From: John Levon <john.levon@nutanix.com>
Date: Tue, 15 Jul 2025 13:59:53 +0200
Subject: [PATCH 2439/2760] hw/vfio-user: wait for proxy close correctly
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Coverity reported:

CID 1611806: Concurrent data access violations (BAD_CHECK_OF_WAIT_COND)

A wait is performed without a loop. If there is a spurious wakeup, the
condition may not be satisfied.

Fix this by checking ->state for VFIO_PROXY_CLOSED in a loop.

Also rename the callback for clarity.

Signed-off-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Mark Cave-Ayland <markcaveayland@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250715115954.515819-4-john.levon@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio-user/proxy.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/hw/vfio-user/proxy.c b/hw/vfio-user/proxy.c
index c418954440..2275d3fe39 100644
--- a/hw/vfio-user/proxy.c
+++ b/hw/vfio-user/proxy.c
@@ -32,7 +32,6 @@ static void vfio_user_recycle(VFIOUserProxy *proxy, VFIOUserMsg *msg);
 
 static void vfio_user_recv(void *opaque);
 static void vfio_user_send(void *opaque);
-static void vfio_user_cb(void *opaque);
 
 static void vfio_user_request(void *opaque);
 
@@ -492,7 +491,7 @@ static void vfio_user_send(void *opaque)
     }
 }
 
-static void vfio_user_cb(void *opaque)
+static void vfio_user_close_cb(void *opaque)
 {
     VFIOUserProxy *proxy = opaque;
 
@@ -984,8 +983,11 @@ void vfio_user_disconnect(VFIOUserProxy *proxy)
      * handler to run after the proxy fd handlers were
      * deleted above.
      */
-    aio_bh_schedule_oneshot(proxy->ctx, vfio_user_cb, proxy);
-    qemu_cond_wait(&proxy->close_cv, &proxy->lock);
+    aio_bh_schedule_oneshot(proxy->ctx, vfio_user_close_cb, proxy);
+
+    while (proxy->state != VFIO_PROXY_CLOSED) {
+        qemu_cond_wait(&proxy->close_cv, &proxy->lock);
+    }
 
     /* we now hold the only ref to proxy */
     qemu_mutex_unlock(&proxy->lock);

From 622740aad9f39c4266ce00d7478b32c7506e6642 Mon Sep 17 00:00:00 2001
From: John Levon <john.levon@nutanix.com>
Date: Tue, 15 Jul 2025 13:59:54 +0200
Subject: [PATCH 2440/2760] hw/vfio-user: fix use of uninitialized variable
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Coverity reported:

CID 1611805:         Uninitialized variables

in vfio_user_dma_map(). This can occur in the happy path when
->async_ops was not set; as this doesn't typically happen, it wasn't
caught during testing.

Align both map and unmap implementations to initialize ret the same way
to resolve this.

Resolves: Coverity CID 1611805
Fixes: 18e899e6 ("vfio-user: implement VFIO_USER_DMA_MAP/UNMAP")
Reported-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Link: https://lore.kernel.org/qemu-devel/20250715115954.515819-5-john.levon@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio-user/container.c | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/hw/vfio-user/container.c b/hw/vfio-user/container.c
index d318e6a339..d589dd90f5 100644
--- a/hw/vfio-user/container.c
+++ b/hw/vfio-user/container.c
@@ -64,8 +64,6 @@ static int vfio_user_dma_unmap(const VFIOContainerBase *bcontainer,
                               0, &local_err)) {
             error_report_err(local_err);
             ret = -EFAULT;
-        } else {
-            ret = 0;
         }
     } else {
         if (!vfio_user_send_wait(container->proxy, &msgp->hdr, NULL,
@@ -92,7 +90,7 @@ static int vfio_user_dma_map(const VFIOContainerBase *bcontainer, hwaddr iova,
                                                 bcontainer);
     int fd = memory_region_get_fd(mrp);
     Error *local_err = NULL;
-    int ret;
+    int ret = 0;
 
     VFIOUserFDs *fds = NULL;
     VFIOUserDMAMap *msgp = g_malloc0(sizeof(*msgp));
@@ -135,8 +133,6 @@ static int vfio_user_dma_map(const VFIOContainerBase *bcontainer, hwaddr iova,
                               0, &local_err)) {
             error_report_err(local_err);
             ret = -EFAULT;
-        } else {
-            ret = 0;
         }
     } else {
         VFIOUserFDs local_fds = { 1, 0, &fd };

From a59d06305fff9d10ddeeaebc66590af422362701 Mon Sep 17 00:00:00 2001
From: Tomita Moeko <tomitamoeko@gmail.com>
Date: Tue, 8 Jul 2025 22:52:11 +0800
Subject: [PATCH 2441/2760] vfio/pci: Introduce x-pci-class-code option
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Introduce x-pci-class-code option to allow users to override PCI class
code of a device, similar to the existing x-pci-vendor-id option. Only
the lower 24 bits of this option are used, though a uint32 is used here
for determining whether the value is valid and set by user.

Additionally, to ensure VGA ranges are only exposed on VGA devices,
pci_register_vga() is now called in vfio_pci_config_setup(), after
the class code override is completed.

This is mainly intended for IGD devices that expose themselves either
as VGA controller (primary display) or Display controller (non-primary
display). The UEFI GOP driver depends on the device reporting a VGA
controller class code (0x030000).

Signed-off-by: Tomita Moeko <tomitamoeko@gmail.com>
Reviewed-by: Alex Williamson <alex.williamson@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250708145211.6179-1-tomitamoeko@gmail.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/pci.c        | 29 +++++++++++++++++++++++++----
 hw/vfio/pci.h        |  6 ++----
 hw/vfio/trace-events |  1 +
 3 files changed, 28 insertions(+), 8 deletions(-)

diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index 1093b28df7..910042c6c2 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -2893,10 +2893,6 @@ bool vfio_populate_vga(VFIOPCIDevice *vdev, Error **errp)
                           "vfio-vga-io@0x3c0",
                           QEMU_PCI_VGA_IO_HI_SIZE);
 
-    pci_register_vga(&vdev->pdev, &vdev->vga->region[QEMU_PCI_VGA_MEM].mem,
-                     &vdev->vga->region[QEMU_PCI_VGA_IO_LO].mem,
-                     &vdev->vga->region[QEMU_PCI_VGA_IO_HI].mem);
-
     return true;
 }
 
@@ -3228,6 +3224,23 @@ bool vfio_pci_config_setup(VFIOPCIDevice *vdev, Error **errp)
                                               vdev->sub_device_id);
     }
 
+    /*
+     * Class code is a 24-bit value at config space 0x09. Allow overriding it
+     * with any 24-bit value.
+     */
+    if (vdev->class_code != PCI_ANY_ID) {
+        if (vdev->class_code > 0xffffff) {
+            error_setg(errp, "invalid PCI class code provided");
+            return false;
+        }
+        /* Higher 24 bits of PCI_CLASS_REVISION are class code */
+        vfio_add_emulated_long(vdev, PCI_CLASS_REVISION,
+                               vdev->class_code << 8, ~0xff);
+        trace_vfio_pci_emulated_class_code(vbasedev->name, vdev->class_code);
+    } else {
+        vdev->class_code = pci_get_long(pdev->config + PCI_CLASS_REVISION) >> 8;
+    }
+
     /* QEMU can change multi-function devices to single function, or reverse */
     vdev->emulated_config_bits[PCI_HEADER_TYPE] =
                                               PCI_HEADER_TYPE_MULTI_FUNCTION;
@@ -3257,6 +3270,12 @@ bool vfio_pci_config_setup(VFIOPCIDevice *vdev, Error **errp)
 
     vfio_bars_register(vdev);
 
+    if (vdev->vga && vfio_is_vga(vdev)) {
+        pci_register_vga(&vdev->pdev, &vdev->vga->region[QEMU_PCI_VGA_MEM].mem,
+                         &vdev->vga->region[QEMU_PCI_VGA_IO_LO].mem,
+                         &vdev->vga->region[QEMU_PCI_VGA_IO_HI].mem);
+    }
+
     return true;
 }
 
@@ -3643,6 +3662,8 @@ static const Property vfio_pci_dev_properties[] = {
                        sub_vendor_id, PCI_ANY_ID),
     DEFINE_PROP_UINT32("x-pci-sub-device-id", VFIOPCIDevice,
                        sub_device_id, PCI_ANY_ID),
+    DEFINE_PROP_UINT32("x-pci-class-code", VFIOPCIDevice,
+                       class_code, PCI_ANY_ID),
     DEFINE_PROP_UINT32("x-igd-gms", VFIOPCIDevice, igd_gms, 0),
     DEFINE_PROP_UNSIGNED_NODEFAULT("x-nv-gpudirect-clique", VFIOPCIDevice,
                                    nv_gpudirect_clique,
diff --git a/hw/vfio/pci.h b/hw/vfio/pci.h
index 495fae737d..4aa6461117 100644
--- a/hw/vfio/pci.h
+++ b/hw/vfio/pci.h
@@ -157,6 +157,7 @@ struct VFIOPCIDevice {
     uint32_t device_id;
     uint32_t sub_vendor_id;
     uint32_t sub_device_id;
+    uint32_t class_code;
     uint32_t features;
 #define VFIO_FEATURE_ENABLE_VGA_BIT 0
 #define VFIO_FEATURE_ENABLE_VGA (1 << VFIO_FEATURE_ENABLE_VGA_BIT)
@@ -205,10 +206,7 @@ static inline bool vfio_pci_is(VFIOPCIDevice *vdev, uint32_t vendor, uint32_t de
 
 static inline bool vfio_is_vga(VFIOPCIDevice *vdev)
 {
-    PCIDevice *pdev = &vdev->pdev;
-    uint16_t class = pci_get_word(pdev->config + PCI_CLASS_DEVICE);
-
-    return class == PCI_CLASS_DISPLAY_VGA;
+    return (vdev->class_code >> 8) == PCI_CLASS_DISPLAY_VGA;
 }
 
 /* MSI/MSI-X/INTx */
diff --git a/hw/vfio/trace-events b/hw/vfio/trace-events
index 8ec0ad0cde..fc6ed230d0 100644
--- a/hw/vfio/trace-events
+++ b/hw/vfio/trace-events
@@ -48,6 +48,7 @@ vfio_pci_emulated_vendor_id(const char *name, uint16_t val) "%s 0x%04x"
 vfio_pci_emulated_device_id(const char *name, uint16_t val) "%s 0x%04x"
 vfio_pci_emulated_sub_vendor_id(const char *name, uint16_t val) "%s 0x%04x"
 vfio_pci_emulated_sub_device_id(const char *name, uint16_t val) "%s 0x%04x"
+vfio_pci_emulated_class_code(const char *name, uint32_t val) "%s 0x%06x"
 
 # pci-quirks.c
 vfio_quirk_rom_in_denylist(const char *name, uint16_t vid, uint16_t did) "%s %04x:%04x"

From 6380b0a02fbdac253b8a98b300398319ab655237 Mon Sep 17 00:00:00 2001
From: "Maciej S. Szmigiero" <maciej.szmigiero@oracle.com>
Date: Tue, 15 Jul 2025 16:37:36 +0200
Subject: [PATCH 2442/2760] vfio/migration: Add
 x-migration-load-config-after-iter VFIO property
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This property allows configuring whether to start the config load only
after all iterables were loaded, during non-iterables loading phase.
Such interlocking is required for ARM64 due to this platform VFIO
dependency on interrupt controller being loaded first.

The property defaults to AUTO, which means ON for ARM, OFF for other
platforms.

Reviewed-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Avihai Horon <avihaih@nvidia.com>
Signed-off-by: Maciej S. Szmigiero <maciej.szmigiero@oracle.com>
Link: https://lore.kernel.org/qemu-devel/0e03c60dbc91f9a9ba2516929574df605b7dfcb4.1752589295.git.maciej.szmigiero@oracle.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 docs/devel/migration/vfio.rst     |  6 +++
 hw/core/machine.c                 |  1 +
 hw/vfio/helpers.c                 | 17 +++++++
 hw/vfio/migration-multifd.c       | 79 +++++++++++++++++++++++++++++++
 hw/vfio/migration-multifd.h       |  3 ++
 hw/vfio/migration.c               | 10 +++-
 hw/vfio/pci.c                     | 10 ++++
 hw/vfio/vfio-helpers.h            |  2 +
 hw/vfio/vfio-migration-internal.h |  1 +
 include/hw/vfio/vfio-device.h     |  1 +
 10 files changed, 129 insertions(+), 1 deletion(-)

diff --git a/docs/devel/migration/vfio.rst b/docs/devel/migration/vfio.rst
index 2d8e5ca9dd..dae3a98830 100644
--- a/docs/devel/migration/vfio.rst
+++ b/docs/devel/migration/vfio.rst
@@ -247,3 +247,9 @@ The multifd VFIO device state transfer is controlled by
 "x-migration-multifd-transfer" VFIO device property. This property defaults to
 AUTO, which means that VFIO device state transfer via multifd channels is
 attempted in configurations that otherwise support it.
+
+Some host platforms (like ARM64) require that VFIO device config is loaded only
+after all iterables were loaded, during non-iterables loading phase.
+Such interlocking is controlled by "x-migration-load-config-after-iter" VFIO
+device property, which in its default setting (AUTO) does so only on platforms
+that actually require it.
diff --git a/hw/core/machine.c b/hw/core/machine.c
index e869821b22..16640b700f 100644
--- a/hw/core/machine.c
+++ b/hw/core/machine.c
@@ -39,6 +39,7 @@
 
 GlobalProperty hw_compat_10_0[] = {
     { "scsi-hd", "dpofua", "off" },
+    { "vfio-pci", "x-migration-load-config-after-iter", "off" },
 };
 const size_t hw_compat_10_0_len = G_N_ELEMENTS(hw_compat_10_0);
 
diff --git a/hw/vfio/helpers.c b/hw/vfio/helpers.c
index 9a5f621545..23d13e5db5 100644
--- a/hw/vfio/helpers.c
+++ b/hw/vfio/helpers.c
@@ -209,3 +209,20 @@ retry:
 
     return info;
 }
+
+bool vfio_arch_wants_loading_config_after_iter(void)
+{
+    /*
+     * Starting the config load only after all iterables were loaded (during
+     * non-iterables loading phase) is required for ARM64 due to this platform
+     * VFIO dependency on interrupt controller being loaded first.
+     *
+     * See commit d329f5032e17 ("vfio: Move the saving of the config space to
+     * the right place in VFIO migration").
+     */
+#if defined(TARGET_ARM)
+    return true;
+#else
+    return false;
+#endif
+}
diff --git a/hw/vfio/migration-multifd.c b/hw/vfio/migration-multifd.c
index 55635486c8..e539befaa9 100644
--- a/hw/vfio/migration-multifd.c
+++ b/hw/vfio/migration-multifd.c
@@ -23,6 +23,7 @@
 #include "migration-multifd.h"
 #include "vfio-migration-internal.h"
 #include "trace.h"
+#include "vfio-helpers.h"
 
 #define VFIO_DEVICE_STATE_CONFIG_STATE (1)
 
@@ -35,6 +36,18 @@ typedef struct VFIODeviceStatePacket {
     uint8_t data[0];
 } QEMU_PACKED VFIODeviceStatePacket;
 
+bool vfio_load_config_after_iter(VFIODevice *vbasedev)
+{
+    if (vbasedev->migration_load_config_after_iter == ON_OFF_AUTO_ON) {
+        return true;
+    } else if (vbasedev->migration_load_config_after_iter == ON_OFF_AUTO_OFF) {
+        return false;
+    }
+
+    assert(vbasedev->migration_load_config_after_iter == ON_OFF_AUTO_AUTO);
+    return vfio_arch_wants_loading_config_after_iter();
+}
+
 /* type safety */
 typedef struct VFIOStateBuffers {
     GArray *array;
@@ -50,6 +63,9 @@ typedef struct VFIOMultifd {
     bool load_bufs_thread_running;
     bool load_bufs_thread_want_exit;
 
+    bool load_bufs_iter_done;
+    QemuCond load_bufs_iter_done_cond;
+
     VFIOStateBuffers load_bufs;
     QemuCond load_bufs_buffer_ready_cond;
     QemuCond load_bufs_thread_finished_cond;
@@ -394,6 +410,22 @@ static bool vfio_load_bufs_thread(void *opaque, bool *should_quit, Error **errp)
         multifd->load_buf_idx++;
     }
 
+    if (vfio_load_config_after_iter(vbasedev)) {
+        while (!multifd->load_bufs_iter_done) {
+            qemu_cond_wait(&multifd->load_bufs_iter_done_cond,
+                           &multifd->load_bufs_mutex);
+
+            /*
+             * Need to re-check cancellation immediately after wait in case
+             * cond was signalled by vfio_load_cleanup_load_bufs_thread().
+             */
+            if (vfio_load_bufs_thread_want_exit(multifd, should_quit)) {
+                error_setg(errp, "operation cancelled");
+                goto thread_exit;
+            }
+        }
+    }
+
     if (!vfio_load_bufs_thread_load_config(vbasedev, errp)) {
         goto thread_exit;
     }
@@ -413,6 +445,48 @@ thread_exit:
     return ret;
 }
 
+int vfio_load_state_config_load_ready(VFIODevice *vbasedev)
+{
+    VFIOMigration *migration = vbasedev->migration;
+    VFIOMultifd *multifd = migration->multifd;
+    int ret = 0;
+
+    if (!vfio_multifd_transfer_enabled(vbasedev)) {
+        error_report("%s: got DEV_CONFIG_LOAD_READY outside multifd transfer",
+                     vbasedev->name);
+        return -EINVAL;
+    }
+
+    if (!vfio_load_config_after_iter(vbasedev)) {
+        error_report("%s: got DEV_CONFIG_LOAD_READY but was disabled",
+                     vbasedev->name);
+        return -EINVAL;
+    }
+
+    assert(multifd);
+
+    /* The lock order is load_bufs_mutex -> BQL so unlock BQL here first */
+    bql_unlock();
+    WITH_QEMU_LOCK_GUARD(&multifd->load_bufs_mutex) {
+        if (multifd->load_bufs_iter_done) {
+            /* Can't print error here as we're outside BQL */
+            ret = -EINVAL;
+            break;
+        }
+
+        multifd->load_bufs_iter_done = true;
+        qemu_cond_signal(&multifd->load_bufs_iter_done_cond);
+    }
+    bql_lock();
+
+    if (ret) {
+        error_report("%s: duplicate DEV_CONFIG_LOAD_READY",
+                     vbasedev->name);
+    }
+
+    return ret;
+}
+
 static VFIOMultifd *vfio_multifd_new(void)
 {
     VFIOMultifd *multifd = g_new(VFIOMultifd, 1);
@@ -425,6 +499,9 @@ static VFIOMultifd *vfio_multifd_new(void)
     multifd->load_buf_idx_last = UINT32_MAX;
     qemu_cond_init(&multifd->load_bufs_buffer_ready_cond);
 
+    multifd->load_bufs_iter_done = false;
+    qemu_cond_init(&multifd->load_bufs_iter_done_cond);
+
     multifd->load_bufs_thread_running = false;
     multifd->load_bufs_thread_want_exit = false;
     qemu_cond_init(&multifd->load_bufs_thread_finished_cond);
@@ -448,6 +525,7 @@ static void vfio_load_cleanup_load_bufs_thread(VFIOMultifd *multifd)
             multifd->load_bufs_thread_want_exit = true;
 
             qemu_cond_signal(&multifd->load_bufs_buffer_ready_cond);
+            qemu_cond_signal(&multifd->load_bufs_iter_done_cond);
             qemu_cond_wait(&multifd->load_bufs_thread_finished_cond,
                            &multifd->load_bufs_mutex);
         }
@@ -460,6 +538,7 @@ static void vfio_multifd_free(VFIOMultifd *multifd)
     vfio_load_cleanup_load_bufs_thread(multifd);
 
     qemu_cond_destroy(&multifd->load_bufs_thread_finished_cond);
+    qemu_cond_destroy(&multifd->load_bufs_iter_done_cond);
     vfio_state_buffers_destroy(&multifd->load_bufs);
     qemu_cond_destroy(&multifd->load_bufs_buffer_ready_cond);
     qemu_mutex_destroy(&multifd->load_bufs_mutex);
diff --git a/hw/vfio/migration-multifd.h b/hw/vfio/migration-multifd.h
index ebf22a7997..82d2d3a1fd 100644
--- a/hw/vfio/migration-multifd.h
+++ b/hw/vfio/migration-multifd.h
@@ -20,9 +20,12 @@ void vfio_multifd_cleanup(VFIODevice *vbasedev);
 bool vfio_multifd_transfer_supported(void);
 bool vfio_multifd_transfer_enabled(VFIODevice *vbasedev);
 
+bool vfio_load_config_after_iter(VFIODevice *vbasedev);
 bool vfio_multifd_load_state_buffer(void *opaque, char *data, size_t data_size,
                                     Error **errp);
 
+int vfio_load_state_config_load_ready(VFIODevice *vbasedev);
+
 void vfio_multifd_emit_dummy_eos(VFIODevice *vbasedev, QEMUFile *f);
 
 bool
diff --git a/hw/vfio/migration.c b/hw/vfio/migration.c
index c329578eec..4c06e3db93 100644
--- a/hw/vfio/migration.c
+++ b/hw/vfio/migration.c
@@ -675,7 +675,11 @@ static void vfio_save_state(QEMUFile *f, void *opaque)
     int ret;
 
     if (vfio_multifd_transfer_enabled(vbasedev)) {
-        vfio_multifd_emit_dummy_eos(vbasedev, f);
+        if (vfio_load_config_after_iter(vbasedev)) {
+            qemu_put_be64(f, VFIO_MIG_FLAG_DEV_CONFIG_LOAD_READY);
+        } else {
+            vfio_multifd_emit_dummy_eos(vbasedev, f);
+        }
         return;
     }
 
@@ -784,6 +788,10 @@ static int vfio_load_state(QEMUFile *f, void *opaque, int version_id)
 
             return ret;
         }
+        case VFIO_MIG_FLAG_DEV_CONFIG_LOAD_READY:
+        {
+            return vfio_load_state_config_load_ready(vbasedev);
+        }
         default:
             error_report("%s: Unknown tag 0x%"PRIx64, vbasedev->name, data);
             return -EINVAL;
diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index 910042c6c2..09acad002a 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -3642,6 +3642,9 @@ static const Property vfio_pci_dev_properties[] = {
                 vbasedev.migration_multifd_transfer,
                 vfio_pci_migration_multifd_transfer_prop, OnOffAuto,
                 .set_default = true, .defval.i = ON_OFF_AUTO_AUTO),
+    DEFINE_PROP_ON_OFF_AUTO("x-migration-load-config-after-iter", VFIOPCIDevice,
+                            vbasedev.migration_load_config_after_iter,
+                            ON_OFF_AUTO_AUTO),
     DEFINE_PROP_BOOL("migration-events", VFIOPCIDevice,
                      vbasedev.migration_events, false),
     DEFINE_PROP_BOOL("x-no-mmap", VFIOPCIDevice, vbasedev.no_mmap, false),
@@ -3818,6 +3821,13 @@ static void vfio_pci_dev_class_init(ObjectClass *klass, const void *data)
                                           "x-migration-multifd-transfer",
                                           "Transfer this device state via "
                                           "multifd channels when live migrating it");
+    object_class_property_set_description(klass, /* 10.1 */
+                                          "x-migration-load-config-after-iter",
+                                          "Start the config load only after "
+                                          "all iterables were loaded (during "
+                                          "non-iterables loading phase) when "
+                                          "doing live migration of device state "
+                                          "via multifd channels");
 }
 
 static const TypeInfo vfio_pci_dev_info = {
diff --git a/hw/vfio/vfio-helpers.h b/hw/vfio/vfio-helpers.h
index 54a327ffbc..ce31758080 100644
--- a/hw/vfio/vfio-helpers.h
+++ b/hw/vfio/vfio-helpers.h
@@ -32,4 +32,6 @@ struct vfio_device_info *vfio_get_device_info(int fd);
 int vfio_kvm_device_add_fd(int fd, Error **errp);
 int vfio_kvm_device_del_fd(int fd, Error **errp);
 
+bool vfio_arch_wants_loading_config_after_iter(void);
+
 #endif /* HW_VFIO_VFIO_HELPERS_H */
diff --git a/hw/vfio/vfio-migration-internal.h b/hw/vfio/vfio-migration-internal.h
index a8b456b239..54141e27e6 100644
--- a/hw/vfio/vfio-migration-internal.h
+++ b/hw/vfio/vfio-migration-internal.h
@@ -32,6 +32,7 @@
 #define VFIO_MIG_FLAG_DEV_SETUP_STATE   (0xffffffffef100003ULL)
 #define VFIO_MIG_FLAG_DEV_DATA_STATE    (0xffffffffef100004ULL)
 #define VFIO_MIG_FLAG_DEV_INIT_DATA_SENT (0xffffffffef100005ULL)
+#define VFIO_MIG_FLAG_DEV_CONFIG_LOAD_READY (0xffffffffef100006ULL)
 
 typedef struct VFIODevice VFIODevice;
 typedef struct VFIOMultifd VFIOMultifd;
diff --git a/include/hw/vfio/vfio-device.h b/include/hw/vfio/vfio-device.h
index 1901a35aa9..dac3fdce15 100644
--- a/include/hw/vfio/vfio-device.h
+++ b/include/hw/vfio/vfio-device.h
@@ -67,6 +67,7 @@ typedef struct VFIODevice {
     bool ram_block_discard_allowed;
     OnOffAuto enable_migration;
     OnOffAuto migration_multifd_transfer;
+    OnOffAuto migration_load_config_after_iter;
     bool migration_events;
     bool use_region_fds;
     VFIODeviceOps *ops;

From 300dcf58b72fa1635190b19f102231b0775e93cb Mon Sep 17 00:00:00 2001
From: "Maciej S. Szmigiero" <maciej.szmigiero@oracle.com>
Date: Tue, 15 Jul 2025 16:37:37 +0200
Subject: [PATCH 2443/2760] vfio/migration: Max in-flight VFIO device state
 buffers size limit
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Allow capping the maximum total size of in-flight VFIO device state buffers
queued at the destination, otherwise a malicious QEMU source could
theoretically cause the target QEMU to allocate unlimited amounts of memory
for buffers-in-flight.

Since this is not expected to be a realistic threat in most of VFIO live
migration use cases and the right value depends on the particular setup
disable this limit by default by setting it to UINT64_MAX.

Reviewed-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Avihai Horon <avihaih@nvidia.com>
Signed-off-by: Maciej S. Szmigiero <maciej.szmigiero@oracle.com>
Link: https://lore.kernel.org/qemu-devel/4f7cad490988288f58e36b162d7a888ed7e7fd17.1752589295.git.maciej.szmigiero@oracle.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 docs/devel/migration/vfio.rst | 13 +++++++++++++
 hw/vfio/migration-multifd.c   | 21 +++++++++++++++++++--
 hw/vfio/pci.c                 |  9 +++++++++
 include/hw/vfio/vfio-device.h |  1 +
 4 files changed, 42 insertions(+), 2 deletions(-)

diff --git a/docs/devel/migration/vfio.rst b/docs/devel/migration/vfio.rst
index dae3a98830..0790e5031d 100644
--- a/docs/devel/migration/vfio.rst
+++ b/docs/devel/migration/vfio.rst
@@ -248,6 +248,19 @@ The multifd VFIO device state transfer is controlled by
 AUTO, which means that VFIO device state transfer via multifd channels is
 attempted in configurations that otherwise support it.
 
+Since the target QEMU needs to load device state buffers in-order it needs to
+queue incoming buffers until they can be loaded into the device.
+This means that a malicious QEMU source could theoretically cause the target
+QEMU to allocate unlimited amounts of memory for such buffers-in-flight.
+
+The "x-migration-max-queued-buffers-size" property allows capping the total size
+of these VFIO device state buffers queued at the destination.
+
+Because a malicious QEMU source causing OOM on the target is not expected to be
+a realistic threat in most of VFIO live migration use cases and the right value
+depends on the particular setup by default this queued buffers size limit is
+disabled by setting it to UINT64_MAX.
+
 Some host platforms (like ARM64) require that VFIO device config is loaded only
 after all iterables were loaded, during non-iterables loading phase.
 Such interlocking is controlled by "x-migration-load-config-after-iter" VFIO
diff --git a/hw/vfio/migration-multifd.c b/hw/vfio/migration-multifd.c
index e539befaa9..d522671b8d 100644
--- a/hw/vfio/migration-multifd.c
+++ b/hw/vfio/migration-multifd.c
@@ -72,6 +72,7 @@ typedef struct VFIOMultifd {
     QemuMutex load_bufs_mutex; /* Lock order: this lock -> BQL */
     uint32_t load_buf_idx;
     uint32_t load_buf_idx_last;
+    size_t load_buf_queued_pending_buffers_size;
 } VFIOMultifd;
 
 static void vfio_state_buffer_clear(gpointer data)
@@ -128,6 +129,7 @@ static bool vfio_load_state_buffer_insert(VFIODevice *vbasedev,
     VFIOMigration *migration = vbasedev->migration;
     VFIOMultifd *multifd = migration->multifd;
     VFIOStateBuffer *lb;
+    size_t data_size = packet_total_size - sizeof(*packet);
 
     vfio_state_buffers_assert_init(&multifd->load_bufs);
     if (packet->idx >= vfio_state_buffers_size_get(&multifd->load_bufs)) {
@@ -143,8 +145,19 @@ static bool vfio_load_state_buffer_insert(VFIODevice *vbasedev,
 
     assert(packet->idx >= multifd->load_buf_idx);
 
-    lb->data = g_memdup2(&packet->data, packet_total_size - sizeof(*packet));
-    lb->len = packet_total_size - sizeof(*packet);
+    multifd->load_buf_queued_pending_buffers_size += data_size;
+    if (multifd->load_buf_queued_pending_buffers_size >
+        vbasedev->migration_max_queued_buffers_size) {
+        error_setg(errp,
+                   "%s: queuing state buffer %" PRIu32
+                   " would exceed the size max of %" PRIu64,
+                   vbasedev->name, packet->idx,
+                   vbasedev->migration_max_queued_buffers_size);
+        return false;
+    }
+
+    lb->data = g_memdup2(&packet->data, data_size);
+    lb->len = data_size;
     lb->is_present = true;
 
     return true;
@@ -328,6 +341,9 @@ static bool vfio_load_state_buffer_write(VFIODevice *vbasedev,
         assert(wr_ret <= buf_len);
         buf_len -= wr_ret;
         buf_cur += wr_ret;
+
+        assert(multifd->load_buf_queued_pending_buffers_size >= wr_ret);
+        multifd->load_buf_queued_pending_buffers_size -= wr_ret;
     }
 
     trace_vfio_load_state_device_buffer_load_end(vbasedev->name,
@@ -497,6 +513,7 @@ static VFIOMultifd *vfio_multifd_new(void)
 
     multifd->load_buf_idx = 0;
     multifd->load_buf_idx_last = UINT32_MAX;
+    multifd->load_buf_queued_pending_buffers_size = 0;
     qemu_cond_init(&multifd->load_bufs_buffer_ready_cond);
 
     multifd->load_bufs_iter_done = false;
diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index 09acad002a..be05002b98 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -3645,6 +3645,8 @@ static const Property vfio_pci_dev_properties[] = {
     DEFINE_PROP_ON_OFF_AUTO("x-migration-load-config-after-iter", VFIOPCIDevice,
                             vbasedev.migration_load_config_after_iter,
                             ON_OFF_AUTO_AUTO),
+    DEFINE_PROP_SIZE("x-migration-max-queued-buffers-size", VFIOPCIDevice,
+                     vbasedev.migration_max_queued_buffers_size, UINT64_MAX),
     DEFINE_PROP_BOOL("migration-events", VFIOPCIDevice,
                      vbasedev.migration_events, false),
     DEFINE_PROP_BOOL("x-no-mmap", VFIOPCIDevice, vbasedev.no_mmap, false),
@@ -3828,6 +3830,13 @@ static void vfio_pci_dev_class_init(ObjectClass *klass, const void *data)
                                           "non-iterables loading phase) when "
                                           "doing live migration of device state "
                                           "via multifd channels");
+    object_class_property_set_description(klass, /* 10.1 */
+                                          "x-migration-max-queued-buffers-size",
+                                          "Maximum size of in-flight VFIO "
+                                          "device state buffers queued at the "
+                                          "destination when doing live "
+                                          "migration of device state via "
+                                          "multifd channels");
 }
 
 static const TypeInfo vfio_pci_dev_info = {
diff --git a/include/hw/vfio/vfio-device.h b/include/hw/vfio/vfio-device.h
index dac3fdce15..6e4d5ccdac 100644
--- a/include/hw/vfio/vfio-device.h
+++ b/include/hw/vfio/vfio-device.h
@@ -68,6 +68,7 @@ typedef struct VFIODevice {
     OnOffAuto enable_migration;
     OnOffAuto migration_multifd_transfer;
     OnOffAuto migration_load_config_after_iter;
+    uint64_t migration_max_queued_buffers_size;
     bool migration_events;
     bool use_region_fds;
     VFIODeviceOps *ops;

From 62b8cc1ecb376f39df67590f8c82914b923a6f15 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 4 Apr 2025 16:40:31 +0200
Subject: [PATCH 2444/2760] hw/xen/arch_hvm: Unify x86 and ARM variants
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

As each target declares the same prototypes, we can
use a single header, removing the TARGET_XXX uses.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
Message-Id: <20250513171737.74386-1-philmd@linaro.org>
---
 include/hw/arm/xen_arch_hvm.h  |  9 ---------
 include/hw/i386/xen_arch_hvm.h | 11 -----------
 include/hw/xen/arch_hvm.h      | 14 ++++++++++----
 3 files changed, 10 insertions(+), 24 deletions(-)
 delete mode 100644 include/hw/arm/xen_arch_hvm.h
 delete mode 100644 include/hw/i386/xen_arch_hvm.h

diff --git a/include/hw/arm/xen_arch_hvm.h b/include/hw/arm/xen_arch_hvm.h
deleted file mode 100644
index 8fd645e723..0000000000
--- a/include/hw/arm/xen_arch_hvm.h
+++ /dev/null
@@ -1,9 +0,0 @@
-#ifndef HW_XEN_ARCH_ARM_HVM_H
-#define HW_XEN_ARCH_ARM_HVM_H
-
-#include <xen/hvm/ioreq.h>
-void arch_handle_ioreq(XenIOState *state, ioreq_t *req);
-void arch_xen_set_memory(XenIOState *state,
-                         MemoryRegionSection *section,
-                         bool add);
-#endif
diff --git a/include/hw/i386/xen_arch_hvm.h b/include/hw/i386/xen_arch_hvm.h
deleted file mode 100644
index 1000f8f543..0000000000
--- a/include/hw/i386/xen_arch_hvm.h
+++ /dev/null
@@ -1,11 +0,0 @@
-#ifndef HW_XEN_ARCH_I386_HVM_H
-#define HW_XEN_ARCH_I386_HVM_H
-
-#include <xen/hvm/ioreq.h>
-#include "hw/xen/xen-hvm-common.h"
-
-void arch_handle_ioreq(XenIOState *state, ioreq_t *req);
-void arch_xen_set_memory(XenIOState *state,
-                         MemoryRegionSection *section,
-                         bool add);
-#endif
diff --git a/include/hw/xen/arch_hvm.h b/include/hw/xen/arch_hvm.h
index df39c819c8..8bacaa4ec4 100644
--- a/include/hw/xen/arch_hvm.h
+++ b/include/hw/xen/arch_hvm.h
@@ -1,5 +1,11 @@
-#if defined(TARGET_I386) || defined(TARGET_X86_64)
-#include "hw/i386/xen_arch_hvm.h"
-#elif defined(TARGET_ARM) || defined(TARGET_AARCH64)
-#include "hw/arm/xen_arch_hvm.h"
+#ifndef HW_XEN_ARCH_HVM_H
+#define HW_XEN_ARCH_HVM_H
+
+#include <xen/hvm/ioreq.h>
+#include "hw/xen/xen-hvm-common.h"
+
+void arch_handle_ioreq(XenIOState *state, ioreq_t *req);
+void arch_xen_set_memory(XenIOState *state,
+                         MemoryRegionSection *section,
+                         bool add);
 #endif

From 187aad2896a3775941a9a02ce8d8a4a15970c1e6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 4 Apr 2025 16:40:31 +0200
Subject: [PATCH 2445/2760] hw/arm/xen-pvh: Remove unnecessary
 'hw/xen/arch_hvm.h' header
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

"hw/xen/arch_hvm.h" only declares the arch_handle_ioreq() and
arch_xen_set_memory() prototypes, which are not used by xen-pvh.c.
Remove the unnecessary header inclusion.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Message-Id: <20250715071528.46196-1-philmd@linaro.org>
---
 hw/arm/xen-pvh.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/hw/arm/xen-pvh.c b/hw/arm/xen-pvh.c
index 4b26bcff7a..1a9eeb01c8 100644
--- a/hw/arm/xen-pvh.c
+++ b/hw/arm/xen-pvh.c
@@ -10,7 +10,6 @@
 #include "hw/boards.h"
 #include "system/system.h"
 #include "hw/xen/xen-pvh-common.h"
-#include "hw/xen/arch_hvm.h"
 
 #define TYPE_XEN_ARM  MACHINE_TYPE_NAME("xenpvh")
 

From 18da42ee4273a66f240bcca7aa4d8ce3b97b1a77 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 2 Jul 2025 14:44:11 +0200
Subject: [PATCH 2446/2760] qapi/accel: Move definitions related to
 accelerators in their own file
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Extract KVM definitions from machine.json to accelerator.json.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Message-Id: <20250703105540.67664-29-philmd@linaro.org>
---
 MAINTAINERS                |  1 +
 hw/core/machine-hmp-cmds.c |  1 +
 hw/core/machine-qmp-cmds.c |  1 +
 qapi/accelerator.json      | 39 ++++++++++++++++++++++++++++++++++++++
 qapi/machine.json          | 29 ----------------------------
 qapi/meson.build           |  1 +
 qapi/qapi-schema.json      |  1 +
 7 files changed, 44 insertions(+), 29 deletions(-)
 create mode 100644 qapi/accelerator.json

diff --git a/MAINTAINERS b/MAINTAINERS
index e88ed2c0a9..0e945f3bd2 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -509,6 +509,7 @@ F: accel/Makefile.objs
 F: accel/stubs/Makefile.objs
 F: cpu-common.c
 F: cpu-target.c
+F: qapi/accelerator.json
 F: system/cpus.c
 
 Apple Silicon HVF CPUs
diff --git a/hw/core/machine-hmp-cmds.c b/hw/core/machine-hmp-cmds.c
index c6325cdcaa..5ca0da77b1 100644
--- a/hw/core/machine-hmp-cmds.c
+++ b/hw/core/machine-hmp-cmds.c
@@ -18,6 +18,7 @@
 #include "monitor/monitor.h"
 #include "qapi/error.h"
 #include "qapi/qapi-builtin-visit.h"
+#include "qapi/qapi-commands-accelerator.h"
 #include "qapi/qapi-commands-machine.h"
 #include "qobject/qdict.h"
 #include "qapi/string-output-visitor.h"
diff --git a/hw/core/machine-qmp-cmds.c b/hw/core/machine-qmp-cmds.c
index d82043e1c6..1af0f29f7d 100644
--- a/hw/core/machine-qmp-cmds.c
+++ b/hw/core/machine-qmp-cmds.c
@@ -14,6 +14,7 @@
 #include "hw/mem/memory-device.h"
 #include "qapi/error.h"
 #include "qapi/qapi-builtin-visit.h"
+#include "qapi/qapi-commands-accelerator.h"
 #include "qapi/qapi-commands-machine.h"
 #include "qobject/qobject.h"
 #include "qapi/qobject-input-visitor.h"
diff --git a/qapi/accelerator.json b/qapi/accelerator.json
new file mode 100644
index 0000000000..d55fe1aa0a
--- /dev/null
+++ b/qapi/accelerator.json
@@ -0,0 +1,39 @@
+# -*- Mode: Python -*-
+# vim: filetype=python
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+##
+# = Accelerators
+##
+
+{ 'include': 'common.json' }
+
+##
+# @KvmInfo:
+#
+# Information about support for KVM acceleration
+#
+# @enabled: true if KVM acceleration is active
+#
+# @present: true if KVM acceleration is built into this executable
+#
+# Since: 0.14
+##
+{ 'struct': 'KvmInfo', 'data': {'enabled': 'bool', 'present': 'bool'} }
+
+##
+# @query-kvm:
+#
+# Return information about KVM acceleration
+#
+# Returns: @KvmInfo
+#
+# Since: 0.14
+#
+# .. qmp-example::
+#
+#     -> { "execute": "query-kvm" }
+#     <- { "return": { "enabled": true, "present": true } }
+##
+{ 'command': 'query-kvm', 'returns': 'KvmInfo' }
diff --git a/qapi/machine.json b/qapi/machine.json
index f712e7da6d..f80ba264b5 100644
--- a/qapi/machine.json
+++ b/qapi/machine.json
@@ -451,35 +451,6 @@
 ##
 { 'command': 'inject-nmi' }
 
-##
-# @KvmInfo:
-#
-# Information about support for KVM acceleration
-#
-# @enabled: true if KVM acceleration is active
-#
-# @present: true if KVM acceleration is built into this executable
-#
-# Since: 0.14
-##
-{ 'struct': 'KvmInfo', 'data': {'enabled': 'bool', 'present': 'bool'} }
-
-##
-# @query-kvm:
-#
-# Return information about KVM acceleration
-#
-# Returns: @KvmInfo
-#
-# Since: 0.14
-#
-# .. qmp-example::
-#
-#     -> { "execute": "query-kvm" }
-#     <- { "return": { "enabled": true, "present": true } }
-##
-{ 'command': 'query-kvm', 'returns': 'KvmInfo' }
-
 ##
 # @NumaOptionsType:
 #
diff --git a/qapi/meson.build b/qapi/meson.build
index 3b035aea33..ca6b61a608 100644
--- a/qapi/meson.build
+++ b/qapi/meson.build
@@ -57,6 +57,7 @@ qapi_all_modules = [
 ]
 if have_system
   qapi_all_modules += [
+    'accelerator',
     'acpi',
     'audio',
     'cryptodev',
diff --git a/qapi/qapi-schema.json b/qapi/qapi-schema.json
index a8f66163cb..0477696ff0 100644
--- a/qapi/qapi-schema.json
+++ b/qapi/qapi-schema.json
@@ -37,6 +37,7 @@
 { 'include': 'run-state.json' }
 { 'include': 'crypto.json' }
 { 'include': 'job.json' }
+{ 'include': 'accelerator.json' }
 { 'include': 'block.json' }
 { 'include': 'block-export.json' }
 { 'include': 'char.json' }

From 6ca2eba6d3decff61a725c379876e18869521a5d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 15 Jul 2025 10:53:49 +0200
Subject: [PATCH 2447/2760] qapi/machine: Add @qom-type field to CpuInfoFast
 structure
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Knowing the QOM type name of a CPU can be useful,
in particular to infer its model name.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Message-Id: <20250715090624.52377-2-philmd@linaro.org>
---
 hw/core/machine-qmp-cmds.c | 1 +
 qapi/machine.json          | 3 +++
 2 files changed, 4 insertions(+)

diff --git a/hw/core/machine-qmp-cmds.c b/hw/core/machine-qmp-cmds.c
index 1af0f29f7d..b9e7eb64e0 100644
--- a/hw/core/machine-qmp-cmds.c
+++ b/hw/core/machine-qmp-cmds.c
@@ -48,6 +48,7 @@ CpuInfoFastList *qmp_query_cpus_fast(Error **errp)
         value->cpu_index = cpu->cpu_index;
         value->qom_path = object_get_canonical_path(OBJECT(cpu));
         value->thread_id = cpu->thread_id;
+        value->qom_type = g_strdup(object_get_typename(OBJECT(cpu)));
 
         if (mc->cpu_index_to_instance_props) {
             CpuInstanceProperties *props;
diff --git a/qapi/machine.json b/qapi/machine.json
index f80ba264b5..6d3a480bea 100644
--- a/qapi/machine.json
+++ b/qapi/machine.json
@@ -76,6 +76,8 @@
 #
 # @cpu-index: index of the virtual CPU
 #
+# @qom-type: QOM type name of the CPU (since 10.1)
+#
 # @qom-path: path to the CPU object in the QOM tree
 #
 # @thread-id: ID of the underlying host thread
@@ -89,6 +91,7 @@
 ##
 { 'union'         : 'CpuInfoFast',
   'base'          : { 'cpu-index'    : 'int',
+                      'qom-type'     : 'str',
                       'qom-path'     : 'str',
                       'thread-id'    : 'int',
                       '*props'       : 'CpuInstanceProperties',

From d6c73ac306a8fca6d98f91e447904c5149d56ed8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 19 Jun 2025 18:05:43 +0200
Subject: [PATCH 2448/2760] hw/core/machine: Display CPU model name in 'info
 cpus' command
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Display the CPU model in 'info cpus'. Example before:

 $ qemu-system-aarch64 -M xlnx-versal-virt -S -monitor stdio
 QEMU 10.0.0 monitor - type 'help' for more information
 (qemu) info cpus
 * CPU #0: thread_id=42924
   CPU #1: thread_id=42924
   CPU #2: thread_id=42924
   CPU #3: thread_id=42924
 (qemu) q

and after:

 $ qemu-system-aarch64 -M xlnx-versal-virt -S -monitor stdio
 QEMU 10.0.50 monitor - type 'help' for more information
 (qemu) info cpus
 * CPU #0: thread_id=42916 model=cortex-a72
   CPU #1: thread_id=42916 model=cortex-a72
   CPU #2: thread_id=42916 model=cortex-r5f
   CPU #3: thread_id=42916 model=cortex-r5f
 (qemu)

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Tested-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Message-Id: <20250715090624.52377-3-philmd@linaro.org>
---
 hw/core/machine-hmp-cmds.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/hw/core/machine-hmp-cmds.c b/hw/core/machine-hmp-cmds.c
index 5ca0da77b1..3a612e2232 100644
--- a/hw/core/machine-hmp-cmds.c
+++ b/hw/core/machine-hmp-cmds.c
@@ -33,6 +33,7 @@ void hmp_info_cpus(Monitor *mon, const QDict *qdict)
     cpu_list = qmp_query_cpus_fast(NULL);
 
     for (cpu = cpu_list; cpu; cpu = cpu->next) {
+        g_autofree char *cpu_model = cpu_model_from_type(cpu->value->qom_type);
         int active = ' ';
 
         if (cpu->value->cpu_index == monitor_get_cpu_index(mon)) {
@@ -41,7 +42,8 @@ void hmp_info_cpus(Monitor *mon, const QDict *qdict)
 
         monitor_printf(mon, "%c CPU #%" PRId64 ":", active,
                        cpu->value->cpu_index);
-        monitor_printf(mon, " thread_id=%" PRId64 "\n", cpu->value->thread_id);
+        monitor_printf(mon, " thread_id=%" PRId64 " model=%s\n",
+                       cpu->value->thread_id, cpu_model);
     }
 
     qapi_free_CpuInfoFastList(cpu_list);

From b2ed4df79e82a6c95feadbe6efefced7bbeb4db2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 9 Jul 2025 16:14:59 +0200
Subject: [PATCH 2449/2760] accel/tcg: Do not dump NaN statistics
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Message-Id: <20250710111303.8917-1-philmd@linaro.org>
---
 accel/tcg/monitor.c | 22 +++++++++++++++-------
 1 file changed, 15 insertions(+), 7 deletions(-)

diff --git a/accel/tcg/monitor.c b/accel/tcg/monitor.c
index e7ed7281a4..778b12613f 100644
--- a/accel/tcg/monitor.c
+++ b/accel/tcg/monitor.c
@@ -19,7 +19,7 @@
 #include "tcg/tcg.h"
 #include "internal-common.h"
 #include "tb-context.h"
-
+#include <math.h>
 
 static void dump_drift_info(GString *buf)
 {
@@ -57,6 +57,7 @@ static void print_qht_statistics(struct qht_stats hst, GString *buf)
     uint32_t hgram_opts;
     size_t hgram_bins;
     char *hgram;
+    double avg;
 
     if (!hst.head_buckets) {
         return;
@@ -73,9 +74,13 @@ static void print_qht_statistics(struct qht_stats hst, GString *buf)
         hgram_opts |= QDIST_PR_NODECIMAL;
     }
     hgram = qdist_pr(&hst.occupancy, 10, hgram_opts);
-    g_string_append_printf(buf, "TB hash occupancy   %0.2f%% avg chain occ. "
-                           "Histogram: %s\n",
-                           qdist_avg(&hst.occupancy) * 100, hgram);
+    avg = qdist_avg(&hst.occupancy);
+    if (!isnan(avg)) {
+        g_string_append_printf(buf, "TB hash occupancy   "
+                                    "%0.2f%% avg chain occ. "
+                                    "Histogram: %s\n",
+                               avg * 100, hgram);
+    }
     g_free(hgram);
 
     hgram_opts = QDIST_PR_BORDER | QDIST_PR_LABELS;
@@ -87,9 +92,12 @@ static void print_qht_statistics(struct qht_stats hst, GString *buf)
         hgram_opts |= QDIST_PR_NODECIMAL | QDIST_PR_NOBINRANGE;
     }
     hgram = qdist_pr(&hst.chain, hgram_bins, hgram_opts);
-    g_string_append_printf(buf, "TB hash avg chain   %0.3f buckets. "
-                           "Histogram: %s\n",
-                           qdist_avg(&hst.chain), hgram);
+    avg = qdist_avg(&hst.chain);
+    if (!isnan(avg)) {
+        g_string_append_printf(buf, "TB hash avg chain   %0.3f buckets. "
+                                    "Histogram: %s\n",
+                               avg, hgram);
+    }
     g_free(hgram);
 }
 

From 05927e9dc9371766d20c97ac609ec8698e95bb45 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 3 Jul 2025 16:18:32 +0200
Subject: [PATCH 2450/2760] accel: Rename 'system/accel-ops.h' ->
 'accel/accel-cpu-ops.h'
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Unfortunately "system/accel-ops.h" handlers are not only
system-specific. For example, the cpu_reset_hold() hook
is part of the vCPU creation, after it is realized.

Mechanical rename to drop 'system' using:

  $ sed -i -e s_system/accel-ops.h_accel/accel-cpu-ops.h_g \
              $(git grep -l system/accel-ops.h)

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250703173248.44995-38-philmd@linaro.org>
---
 accel/accel-system.c                                  | 2 +-
 accel/hvf/hvf-accel-ops.c                             | 2 +-
 accel/kvm/kvm-accel-ops.c                             | 2 +-
 accel/qtest/qtest.c                                   | 2 +-
 accel/tcg/tcg-accel-ops.c                             | 2 +-
 accel/xen/xen-all.c                                   | 2 +-
 cpu-target.c                                          | 2 +-
 gdbstub/system.c                                      | 2 +-
 include/{system/accel-ops.h => accel/accel-cpu-ops.h} | 8 ++++----
 system/cpus.c                                         | 2 +-
 target/i386/nvmm/nvmm-accel-ops.c                     | 2 +-
 target/i386/whpx/whpx-accel-ops.c                     | 2 +-
 12 files changed, 15 insertions(+), 15 deletions(-)
 rename include/{system/accel-ops.h => accel/accel-cpu-ops.h} (95%)

diff --git a/accel/accel-system.c b/accel/accel-system.c
index c54c30f18b..c2a955a6da 100644
--- a/accel/accel-system.c
+++ b/accel/accel-system.c
@@ -26,7 +26,7 @@
 #include "qemu/osdep.h"
 #include "qemu/accel.h"
 #include "hw/boards.h"
-#include "system/accel-ops.h"
+#include "accel/accel-cpu-ops.h"
 #include "system/cpus.h"
 #include "qemu/error-report.h"
 #include "accel-internal.h"
diff --git a/accel/hvf/hvf-accel-ops.c b/accel/hvf/hvf-accel-ops.c
index be8724ac89..214454bd0b 100644
--- a/accel/hvf/hvf-accel-ops.c
+++ b/accel/hvf/hvf-accel-ops.c
@@ -54,7 +54,7 @@
 #include "gdbstub/enums.h"
 #include "exec/cpu-common.h"
 #include "hw/core/cpu.h"
-#include "system/accel-ops.h"
+#include "accel/accel-cpu-ops.h"
 #include "system/cpus.h"
 #include "system/hvf.h"
 #include "system/hvf_int.h"
diff --git a/accel/kvm/kvm-accel-ops.c b/accel/kvm/kvm-accel-ops.c
index 0eafc902c3..b709187c7d 100644
--- a/accel/kvm/kvm-accel-ops.c
+++ b/accel/kvm/kvm-accel-ops.c
@@ -16,7 +16,7 @@
 #include "qemu/osdep.h"
 #include "qemu/error-report.h"
 #include "qemu/main-loop.h"
-#include "system/accel-ops.h"
+#include "accel/accel-cpu-ops.h"
 #include "system/kvm.h"
 #include "system/kvm_int.h"
 #include "system/runstate.h"
diff --git a/accel/qtest/qtest.c b/accel/qtest/qtest.c
index 2b83126020..a7fc8bee6d 100644
--- a/accel/qtest/qtest.c
+++ b/accel/qtest/qtest.c
@@ -18,7 +18,7 @@
 #include "qemu/option.h"
 #include "qemu/config-file.h"
 #include "qemu/accel.h"
-#include "system/accel-ops.h"
+#include "accel/accel-cpu-ops.h"
 #include "system/qtest.h"
 #include "system/cpus.h"
 #include "qemu/guest-random.h"
diff --git a/accel/tcg/tcg-accel-ops.c b/accel/tcg/tcg-accel-ops.c
index 279dbfa1cf..58ded9d6f0 100644
--- a/accel/tcg/tcg-accel-ops.c
+++ b/accel/tcg/tcg-accel-ops.c
@@ -26,7 +26,7 @@
  */
 
 #include "qemu/osdep.h"
-#include "system/accel-ops.h"
+#include "accel/accel-cpu-ops.h"
 #include "system/tcg.h"
 #include "system/replay.h"
 #include "exec/icount.h"
diff --git a/accel/xen/xen-all.c b/accel/xen/xen-all.c
index bd0ff64bef..55a60bb42c 100644
--- a/accel/xen/xen-all.c
+++ b/accel/xen/xen-all.c
@@ -19,7 +19,7 @@
 #include "chardev/char.h"
 #include "qemu/accel.h"
 #include "accel/dummy-cpus.h"
-#include "system/accel-ops.h"
+#include "accel/accel-cpu-ops.h"
 #include "system/cpus.h"
 #include "system/xen.h"
 #include "system/runstate.h"
diff --git a/cpu-target.c b/cpu-target.c
index 1c90a30759..2049eb1d0f 100644
--- a/cpu-target.c
+++ b/cpu-target.c
@@ -19,7 +19,7 @@
 
 #include "qemu/osdep.h"
 #include "cpu.h"
-#include "system/accel-ops.h"
+#include "accel/accel-cpu-ops.h"
 #include "system/cpus.h"
 #include "exec/cpu-common.h"
 #include "exec/tswap.h"
diff --git a/gdbstub/system.c b/gdbstub/system.c
index 8a32d8e1a1..5b6f8d0733 100644
--- a/gdbstub/system.c
+++ b/gdbstub/system.c
@@ -19,7 +19,7 @@
 #include "gdbstub/commands.h"
 #include "exec/hwaddr.h"
 #include "exec/tb-flush.h"
-#include "system/accel-ops.h"
+#include "accel/accel-cpu-ops.h"
 #include "system/cpus.h"
 #include "system/runstate.h"
 #include "system/replay.h"
diff --git a/include/system/accel-ops.h b/include/accel/accel-cpu-ops.h
similarity index 95%
rename from include/system/accel-ops.h
rename to include/accel/accel-cpu-ops.h
index bf7383511d..a9191dded7 100644
--- a/include/system/accel-ops.h
+++ b/include/accel/accel-cpu-ops.h
@@ -1,5 +1,5 @@
 /*
- * Accelerator OPS, used for cpus.c module
+ * Accelerator per-vCPU handlers
  *
  * Copyright 2021 SUSE LLC
  *
@@ -7,8 +7,8 @@
  * See the COPYING file in the top-level directory.
  */
 
-#ifndef ACCEL_OPS_H
-#define ACCEL_OPS_H
+#ifndef QEMU_ACCEL_CPU_OPS_H
+#define QEMU_ACCEL_CPU_OPS_H
 
 #include "qemu/accel.h"
 #include "exec/vaddr.h"
@@ -89,4 +89,4 @@ struct AccelOpsClass {
 
 void generic_handle_interrupt(CPUState *cpu, int mask);
 
-#endif /* ACCEL_OPS_H */
+#endif /* QEMU_ACCEL_CPU_OPS_H */
diff --git a/system/cpus.c b/system/cpus.c
index 8e6da2e060..256723558d 100644
--- a/system/cpus.c
+++ b/system/cpus.c
@@ -31,7 +31,7 @@
 #include "qapi/qapi-events-run-state.h"
 #include "qapi/qmp/qerror.h"
 #include "exec/gdbstub.h"
-#include "system/accel-ops.h"
+#include "accel/accel-cpu-ops.h"
 #include "system/hw_accel.h"
 #include "exec/cpu-common.h"
 #include "qemu/thread.h"
diff --git a/target/i386/nvmm/nvmm-accel-ops.c b/target/i386/nvmm/nvmm-accel-ops.c
index a5517b0abf..3799260bbd 100644
--- a/target/i386/nvmm/nvmm-accel-ops.c
+++ b/target/i386/nvmm/nvmm-accel-ops.c
@@ -10,7 +10,7 @@
 #include "qemu/osdep.h"
 #include "system/kvm_int.h"
 #include "qemu/main-loop.h"
-#include "system/accel-ops.h"
+#include "accel/accel-cpu-ops.h"
 #include "system/cpus.h"
 #include "qemu/guest-random.h"
 
diff --git a/target/i386/whpx/whpx-accel-ops.c b/target/i386/whpx/whpx-accel-ops.c
index 5f4841c9fa..da58805b1a 100644
--- a/target/i386/whpx/whpx-accel-ops.c
+++ b/target/i386/whpx/whpx-accel-ops.c
@@ -11,7 +11,7 @@
 #include "qemu/osdep.h"
 #include "system/kvm_int.h"
 #include "qemu/main-loop.h"
-#include "system/accel-ops.h"
+#include "accel/accel-cpu-ops.h"
 #include "system/cpus.h"
 #include "qemu/guest-random.h"
 

From f7a7e7dd2179e7189064e0b7b637e6906617221f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 3 Jul 2025 16:44:39 +0200
Subject: [PATCH 2451/2760] accel: Extract AccelClass definition to
 'accel/accel-ops.h'
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Only accelerator implementations (and the common accelator
code) need to know about AccelClass internals. Move the
definition out but forward declare AccelState and AccelClass.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250703173248.44995-39-philmd@linaro.org>
---
 MAINTAINERS                 |  2 +-
 accel/accel-common.c        |  2 ++
 accel/accel-system.c        |  1 +
 accel/hvf/hvf-all.c         |  1 +
 accel/kvm/kvm-all.c         |  1 +
 accel/qtest/qtest.c         |  1 +
 accel/tcg/tcg-accel-ops.c   |  1 +
 accel/tcg/tcg-all.c         |  2 ++
 accel/xen/xen-all.c         |  1 +
 bsd-user/main.c             |  1 +
 gdbstub/system.c            |  1 +
 include/accel/accel-ops.h   | 49 +++++++++++++++++++++++++++++++++++++
 include/qemu/accel.h        | 39 ++---------------------------
 include/system/hvf_int.h    |  3 ++-
 include/system/kvm_int.h    |  1 +
 linux-user/main.c           |  1 +
 system/memory.c             |  1 +
 target/i386/nvmm/nvmm-all.c |  1 +
 target/i386/whpx/whpx-all.c |  1 +
 19 files changed, 71 insertions(+), 39 deletions(-)
 create mode 100644 include/accel/accel-ops.h

diff --git a/MAINTAINERS b/MAINTAINERS
index 0e945f3bd2..9d88c17433 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -502,7 +502,7 @@ F: include/exec/target_long.h
 F: include/qemu/accel.h
 F: include/system/accel-*.h
 F: include/system/cpus.h
-F: include/accel/accel-cpu*.h
+F: include/accel/accel-*.h
 F: accel/accel-*.?
 F: accel/dummy-cpus.?
 F: accel/Makefile.objs
diff --git a/accel/accel-common.c b/accel/accel-common.c
index 591ff4cbb6..850c5ab4b8 100644
--- a/accel/accel-common.c
+++ b/accel/accel-common.c
@@ -10,7 +10,9 @@
 #include "qemu/osdep.h"
 #include "qemu/accel.h"
 #include "qemu/target-info.h"
+#include "accel/accel-ops.h"
 #include "accel/accel-cpu.h"
+#include "accel/accel-cpu-ops.h"
 #include "accel-internal.h"
 
 /* Lookup AccelClass from opt_name. Returns NULL if not found */
diff --git a/accel/accel-system.c b/accel/accel-system.c
index c2a955a6da..8df561b953 100644
--- a/accel/accel-system.c
+++ b/accel/accel-system.c
@@ -26,6 +26,7 @@
 #include "qemu/osdep.h"
 #include "qemu/accel.h"
 #include "hw/boards.h"
+#include "accel/accel-ops.h"
 #include "accel/accel-cpu-ops.h"
 #include "system/cpus.h"
 #include "qemu/error-report.h"
diff --git a/accel/hvf/hvf-all.c b/accel/hvf/hvf-all.c
index 1fa07c8b69..e67a8105a6 100644
--- a/accel/hvf/hvf-all.c
+++ b/accel/hvf/hvf-all.c
@@ -10,6 +10,7 @@
 
 #include "qemu/osdep.h"
 #include "qemu/error-report.h"
+#include "accel/accel-ops.h"
 #include "system/address-spaces.h"
 #include "system/memory.h"
 #include "system/hvf.h"
diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index a106d1ba0f..659ff88156 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -32,6 +32,7 @@
 #include "system/runstate.h"
 #include "system/cpus.h"
 #include "system/accel-blocker.h"
+#include "accel/accel-ops.h"
 #include "qemu/bswap.h"
 #include "exec/tswap.h"
 #include "system/memory.h"
diff --git a/accel/qtest/qtest.c b/accel/qtest/qtest.c
index a7fc8bee6d..1d4337d698 100644
--- a/accel/qtest/qtest.c
+++ b/accel/qtest/qtest.c
@@ -18,6 +18,7 @@
 #include "qemu/option.h"
 #include "qemu/config-file.h"
 #include "qemu/accel.h"
+#include "accel/accel-ops.h"
 #include "accel/accel-cpu-ops.h"
 #include "system/qtest.h"
 #include "system/cpus.h"
diff --git a/accel/tcg/tcg-accel-ops.c b/accel/tcg/tcg-accel-ops.c
index 58ded9d6f0..3b0d7d298e 100644
--- a/accel/tcg/tcg-accel-ops.c
+++ b/accel/tcg/tcg-accel-ops.c
@@ -26,6 +26,7 @@
  */
 
 #include "qemu/osdep.h"
+#include "accel/accel-ops.h"
 #include "accel/accel-cpu-ops.h"
 #include "system/tcg.h"
 #include "system/replay.h"
diff --git a/accel/tcg/tcg-all.c b/accel/tcg/tcg-all.c
index 5904582a68..eaeb465dfd 100644
--- a/accel/tcg/tcg-all.c
+++ b/accel/tcg/tcg-all.c
@@ -39,6 +39,8 @@
 #ifndef CONFIG_USER_ONLY
 #include "hw/boards.h"
 #endif
+#include "accel/accel-ops.h"
+#include "accel/accel-cpu-ops.h"
 #include "accel/tcg/cpu-ops.h"
 #include "internal-common.h"
 
diff --git a/accel/xen/xen-all.c b/accel/xen/xen-all.c
index 55a60bb42c..97377d67d1 100644
--- a/accel/xen/xen-all.c
+++ b/accel/xen/xen-all.c
@@ -19,6 +19,7 @@
 #include "chardev/char.h"
 #include "qemu/accel.h"
 #include "accel/dummy-cpus.h"
+#include "accel/accel-ops.h"
 #include "accel/accel-cpu-ops.h"
 #include "system/cpus.h"
 #include "system/xen.h"
diff --git a/bsd-user/main.c b/bsd-user/main.c
index d0cc8e0088..7e5d4bbce0 100644
--- a/bsd-user/main.c
+++ b/bsd-user/main.c
@@ -38,6 +38,7 @@
 #include "qemu/plugin.h"
 #include "user/guest-base.h"
 #include "user/page-protection.h"
+#include "accel/accel-ops.h"
 #include "tcg/startup.h"
 #include "qemu/timer.h"
 #include "qemu/envlist.h"
diff --git a/gdbstub/system.c b/gdbstub/system.c
index 5b6f8d0733..5be0d3c58c 100644
--- a/gdbstub/system.c
+++ b/gdbstub/system.c
@@ -19,6 +19,7 @@
 #include "gdbstub/commands.h"
 #include "exec/hwaddr.h"
 #include "exec/tb-flush.h"
+#include "accel/accel-ops.h"
 #include "accel/accel-cpu-ops.h"
 #include "system/cpus.h"
 #include "system/runstate.h"
diff --git a/include/accel/accel-ops.h b/include/accel/accel-ops.h
new file mode 100644
index 0000000000..86a27c30fa
--- /dev/null
+++ b/include/accel/accel-ops.h
@@ -0,0 +1,49 @@
+/*
+ * Accelerator handlers
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef ACCEL_OPS_H
+#define ACCEL_OPS_H
+
+#include "exec/hwaddr.h"
+#include "qemu/accel.h"
+#include "qom/object.h"
+
+struct AccelState {
+    Object parent_obj;
+};
+
+struct AccelClass {
+    ObjectClass parent_class;
+
+    const char *name;
+    /* Cached by accel_init_ops_interfaces() when created */
+    AccelOpsClass *ops;
+
+    int (*init_machine)(AccelState *as, MachineState *ms);
+    bool (*cpu_common_realize)(CPUState *cpu, Error **errp);
+    void (*cpu_common_unrealize)(CPUState *cpu);
+
+    /* system related hooks */
+    void (*setup_post)(AccelState *as);
+    void (*pre_resume_vm)(AccelState *as, bool step_pending);
+    bool (*has_memory)(AccelState *accel, AddressSpace *as,
+                       hwaddr start_addr, hwaddr size);
+
+    /* gdbstub related hooks */
+    int (*gdbstub_supported_sstep_flags)(AccelState *as);
+
+    bool *allowed;
+    /*
+     * Array of global properties that would be applied when specific
+     * accelerator is chosen. It works like MachineClass.compat_props
+     * but it's for accelerators not machines. Accelerator-provided
+     * global properties may be overridden by machine-type
+     * compat_props or user-provided global properties.
+     */
+    GPtrArray *compat_props;
+};
+
+#endif /* ACCEL_OPS_H */
diff --git a/include/qemu/accel.h b/include/qemu/accel.h
index 9e821d0fae..d3638c7bfd 100644
--- a/include/qemu/accel.h
+++ b/include/qemu/accel.h
@@ -26,43 +26,8 @@
 #include "qom/object.h"
 #include "exec/hwaddr.h"
 
-struct AccelState {
-    /*< private >*/
-    Object parent_obj;
-};
-
-typedef struct AccelClass {
-    /*< private >*/
-    ObjectClass parent_class;
-    /*< public >*/
-
-    const char *name;
-    /* Cached by accel_init_ops_interfaces() when created */
-    AccelOpsClass *ops;
-
-    int (*init_machine)(AccelState *as, MachineState *ms);
-    bool (*cpu_common_realize)(CPUState *cpu, Error **errp);
-    void (*cpu_common_unrealize)(CPUState *cpu);
-
-    /* system related hooks */
-    void (*setup_post)(AccelState *as);
-    void (*pre_resume_vm)(AccelState *as, bool step_pending);
-    bool (*has_memory)(AccelState *accel, AddressSpace *as,
-                       hwaddr start_addr, hwaddr size);
-
-    /* gdbstub related hooks */
-    int (*gdbstub_supported_sstep_flags)(AccelState *as);
-
-    bool *allowed;
-    /*
-     * Array of global properties that would be applied when specific
-     * accelerator is chosen. It works like MachineClass.compat_props
-     * but it's for accelerators not machines. Accelerator-provided
-     * global properties may be overridden by machine-type
-     * compat_props or user-provided global properties.
-     */
-    GPtrArray *compat_props;
-} AccelClass;
+typedef struct AccelState AccelState;
+typedef struct AccelClass AccelClass;
 
 #define TYPE_ACCEL "accel"
 
diff --git a/include/system/hvf_int.h b/include/system/hvf_int.h
index 5150c7dd9c..a3b06a3e75 100644
--- a/include/system/hvf_int.h
+++ b/include/system/hvf_int.h
@@ -14,6 +14,7 @@
 #include "qemu/queue.h"
 #include "exec/vaddr.h"
 #include "qom/object.h"
+#include "accel/accel-ops.h"
 
 #ifdef __aarch64__
 #include <Hypervisor/Hypervisor.h>
@@ -45,7 +46,7 @@ typedef struct hvf_vcpu_caps {
 } hvf_vcpu_caps;
 
 struct HVFState {
-    AccelState parent;
+    AccelState parent_obj;
 
     hvf_slot slots[32];
     int num_slots;
diff --git a/include/system/kvm_int.h b/include/system/kvm_int.h
index 756a3c0a25..9247493b02 100644
--- a/include/system/kvm_int.h
+++ b/include/system/kvm_int.h
@@ -14,6 +14,7 @@
 #include "qemu/accel.h"
 #include "qemu/queue.h"
 #include "system/kvm.h"
+#include "accel/accel-ops.h"
 #include "hw/boards.h"
 #include "hw/i386/topology.h"
 #include "io/channel-socket.h"
diff --git a/linux-user/main.c b/linux-user/main.c
index f4f2007439..68972f00a1 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -42,6 +42,7 @@
 #include "user/page-protection.h"
 #include "exec/gdbstub.h"
 #include "gdbstub/user.h"
+#include "accel/accel-ops.h"
 #include "tcg/startup.h"
 #include "qemu/timer.h"
 #include "qemu/envlist.h"
diff --git a/system/memory.c b/system/memory.c
index e8d9b15b28..0983ff8962 100644
--- a/system/memory.c
+++ b/system/memory.c
@@ -29,6 +29,7 @@
 #include "system/runstate.h"
 #include "system/tcg.h"
 #include "qemu/accel.h"
+#include "accel/accel-ops.h"
 #include "hw/boards.h"
 #include "migration/vmstate.h"
 #include "system/address-spaces.h"
diff --git a/target/i386/nvmm/nvmm-all.c b/target/i386/nvmm/nvmm-all.c
index b4a4d50e86..aab12d7732 100644
--- a/target/i386/nvmm/nvmm-all.c
+++ b/target/i386/nvmm/nvmm-all.c
@@ -12,6 +12,7 @@
 #include "system/address-spaces.h"
 #include "system/ioport.h"
 #include "qemu/accel.h"
+#include "accel/accel-ops.h"
 #include "system/nvmm.h"
 #include "system/cpus.h"
 #include "system/runstate.h"
diff --git a/target/i386/whpx/whpx-all.c b/target/i386/whpx/whpx-all.c
index faf56e1972..10df2d398f 100644
--- a/target/i386/whpx/whpx-all.c
+++ b/target/i386/whpx/whpx-all.c
@@ -14,6 +14,7 @@
 #include "system/ioport.h"
 #include "gdbstub/helpers.h"
 #include "qemu/accel.h"
+#include "accel/accel-ops.h"
 #include "system/whpx.h"
 #include "system/cpus.h"
 #include "system/runstate.h"

From 2d7dc398ab48d09386c718708b43bd431758f1a4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 15 Jul 2025 11:28:10 +0200
Subject: [PATCH 2452/2760] Revert "accel/tcg: Unregister the RCU before
 exiting RR thread"
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This reverts commit bc93332fe460211c2d2f4ff50e1a0e030c7b5159,
which was merged prematurely, re-introducing Coverity CID 1547782
(unreachable code).

Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250715104015.72663-2-philmd@linaro.org>
---
 accel/tcg/tcg-accel-ops-rr.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/accel/tcg/tcg-accel-ops-rr.c b/accel/tcg/tcg-accel-ops-rr.c
index a578698d07..6eec5c9eee 100644
--- a/accel/tcg/tcg-accel-ops-rr.c
+++ b/accel/tcg/tcg-accel-ops-rr.c
@@ -302,8 +302,6 @@ static void *rr_cpu_thread_fn(void *arg)
         rr_deal_with_unplugged_cpus();
     }
 
-    rcu_unregister_thread();
-
     g_assert_not_reached();
 }
 

From 8cc04fd9df3b9775eaf0fb1b17d82a1a075aa3ec Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 3 Jul 2025 11:33:46 +0200
Subject: [PATCH 2453/2760] accel/tcg: Extract statistic related code to
 tcg-stats.c
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Statistic code is not specific to system emulation (except
cross-page checks) and can be used to analyze user-mode binaries.
Extract statistic related code to its own file: tcg-stats.c,
keeping the original LGPL-2.1-or-later license tag.
Note, this code is not yet reachable by user-mode.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250715140048.84942-3-philmd@linaro.org>
---
 accel/tcg/meson.build |   1 +
 accel/tcg/monitor.c   | 201 ---------------------------------------
 accel/tcg/tcg-stats.c | 215 ++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 216 insertions(+), 201 deletions(-)
 create mode 100644 accel/tcg/tcg-stats.c

diff --git a/accel/tcg/meson.build b/accel/tcg/meson.build
index 575e92bb9e..002aa8f458 100644
--- a/accel/tcg/meson.build
+++ b/accel/tcg/meson.build
@@ -11,6 +11,7 @@ tcg_ss.add(files(
   'tcg-runtime-gvec.c',
   'tb-maint.c',
   'tcg-all.c',
+  'tcg-stats.c',
   'translate-all.c',
   'translator.c',
 ))
diff --git a/accel/tcg/monitor.c b/accel/tcg/monitor.c
index 778b12613f..adb9de5a1c 100644
--- a/accel/tcg/monitor.c
+++ b/accel/tcg/monitor.c
@@ -7,213 +7,12 @@
  */
 
 #include "qemu/osdep.h"
-#include "qemu/accel.h"
-#include "qemu/qht.h"
 #include "qapi/error.h"
 #include "qapi/type-helpers.h"
 #include "qapi/qapi-commands-machine.h"
 #include "monitor/monitor.h"
-#include "system/cpu-timers.h"
-#include "exec/icount.h"
 #include "system/tcg.h"
-#include "tcg/tcg.h"
 #include "internal-common.h"
-#include "tb-context.h"
-#include <math.h>
-
-static void dump_drift_info(GString *buf)
-{
-    if (!icount_enabled()) {
-        return;
-    }
-
-    g_string_append_printf(buf, "Host - Guest clock  %"PRIi64" ms\n",
-                           (cpu_get_clock() - icount_get()) / SCALE_MS);
-    if (icount_align_option) {
-        g_string_append_printf(buf, "Max guest delay     %"PRIi64" ms\n",
-                               -max_delay / SCALE_MS);
-        g_string_append_printf(buf, "Max guest advance   %"PRIi64" ms\n",
-                               max_advance / SCALE_MS);
-    } else {
-        g_string_append_printf(buf, "Max guest delay     NA\n");
-        g_string_append_printf(buf, "Max guest advance   NA\n");
-    }
-}
-
-static void dump_accel_info(GString *buf)
-{
-    AccelState *accel = current_accel();
-    bool one_insn_per_tb = object_property_get_bool(OBJECT(accel),
-                                                    "one-insn-per-tb",
-                                                    &error_fatal);
-
-    g_string_append_printf(buf, "Accelerator settings:\n");
-    g_string_append_printf(buf, "one-insn-per-tb: %s\n\n",
-                           one_insn_per_tb ? "on" : "off");
-}
-
-static void print_qht_statistics(struct qht_stats hst, GString *buf)
-{
-    uint32_t hgram_opts;
-    size_t hgram_bins;
-    char *hgram;
-    double avg;
-
-    if (!hst.head_buckets) {
-        return;
-    }
-    g_string_append_printf(buf, "TB hash buckets     %zu/%zu "
-                           "(%0.2f%% head buckets used)\n",
-                           hst.used_head_buckets, hst.head_buckets,
-                           (double)hst.used_head_buckets /
-                           hst.head_buckets * 100);
-
-    hgram_opts =  QDIST_PR_BORDER | QDIST_PR_LABELS;
-    hgram_opts |= QDIST_PR_100X   | QDIST_PR_PERCENT;
-    if (qdist_xmax(&hst.occupancy) - qdist_xmin(&hst.occupancy) == 1) {
-        hgram_opts |= QDIST_PR_NODECIMAL;
-    }
-    hgram = qdist_pr(&hst.occupancy, 10, hgram_opts);
-    avg = qdist_avg(&hst.occupancy);
-    if (!isnan(avg)) {
-        g_string_append_printf(buf, "TB hash occupancy   "
-                                    "%0.2f%% avg chain occ. "
-                                    "Histogram: %s\n",
-                               avg * 100, hgram);
-    }
-    g_free(hgram);
-
-    hgram_opts = QDIST_PR_BORDER | QDIST_PR_LABELS;
-    hgram_bins = qdist_xmax(&hst.chain) - qdist_xmin(&hst.chain);
-    if (hgram_bins > 10) {
-        hgram_bins = 10;
-    } else {
-        hgram_bins = 0;
-        hgram_opts |= QDIST_PR_NODECIMAL | QDIST_PR_NOBINRANGE;
-    }
-    hgram = qdist_pr(&hst.chain, hgram_bins, hgram_opts);
-    avg = qdist_avg(&hst.chain);
-    if (!isnan(avg)) {
-        g_string_append_printf(buf, "TB hash avg chain   %0.3f buckets. "
-                                    "Histogram: %s\n",
-                               avg, hgram);
-    }
-    g_free(hgram);
-}
-
-struct tb_tree_stats {
-    size_t nb_tbs;
-    size_t host_size;
-    size_t target_size;
-    size_t max_target_size;
-    size_t direct_jmp_count;
-    size_t direct_jmp2_count;
-    size_t cross_page;
-};
-
-static gboolean tb_tree_stats_iter(gpointer key, gpointer value, gpointer data)
-{
-    const TranslationBlock *tb = value;
-    struct tb_tree_stats *tst = data;
-
-    tst->nb_tbs++;
-    tst->host_size += tb->tc.size;
-    tst->target_size += tb->size;
-    if (tb->size > tst->max_target_size) {
-        tst->max_target_size = tb->size;
-    }
-    if (tb->page_addr[1] != -1) {
-        tst->cross_page++;
-    }
-    if (tb->jmp_reset_offset[0] != TB_JMP_OFFSET_INVALID) {
-        tst->direct_jmp_count++;
-        if (tb->jmp_reset_offset[1] != TB_JMP_OFFSET_INVALID) {
-            tst->direct_jmp2_count++;
-        }
-    }
-    return false;
-}
-
-static void tlb_flush_counts(size_t *pfull, size_t *ppart, size_t *pelide)
-{
-    CPUState *cpu;
-    size_t full = 0, part = 0, elide = 0;
-
-    CPU_FOREACH(cpu) {
-        full += qatomic_read(&cpu->neg.tlb.c.full_flush_count);
-        part += qatomic_read(&cpu->neg.tlb.c.part_flush_count);
-        elide += qatomic_read(&cpu->neg.tlb.c.elide_flush_count);
-    }
-    *pfull = full;
-    *ppart = part;
-    *pelide = elide;
-}
-
-static void tcg_dump_flush_info(GString *buf)
-{
-    size_t flush_full, flush_part, flush_elide;
-
-    g_string_append_printf(buf, "TB flush count      %u\n",
-                           qatomic_read(&tb_ctx.tb_flush_count));
-    g_string_append_printf(buf, "TB invalidate count %u\n",
-                           qatomic_read(&tb_ctx.tb_phys_invalidate_count));
-
-    tlb_flush_counts(&flush_full, &flush_part, &flush_elide);
-    g_string_append_printf(buf, "TLB full flushes    %zu\n", flush_full);
-    g_string_append_printf(buf, "TLB partial flushes %zu\n", flush_part);
-    g_string_append_printf(buf, "TLB elided flushes  %zu\n", flush_elide);
-}
-
-static void dump_exec_info(GString *buf)
-{
-    struct tb_tree_stats tst = {};
-    struct qht_stats hst;
-    size_t nb_tbs;
-
-    tcg_tb_foreach(tb_tree_stats_iter, &tst);
-    nb_tbs = tst.nb_tbs;
-    /* XXX: avoid using doubles ? */
-    g_string_append_printf(buf, "Translation buffer state:\n");
-    /*
-     * Report total code size including the padding and TB structs;
-     * otherwise users might think "-accel tcg,tb-size" is not honoured.
-     * For avg host size we use the precise numbers from tb_tree_stats though.
-     */
-    g_string_append_printf(buf, "gen code size       %zu/%zu\n",
-                           tcg_code_size(), tcg_code_capacity());
-    g_string_append_printf(buf, "TB count            %zu\n", nb_tbs);
-    g_string_append_printf(buf, "TB avg target size  %zu max=%zu bytes\n",
-                           nb_tbs ? tst.target_size / nb_tbs : 0,
-                           tst.max_target_size);
-    g_string_append_printf(buf, "TB avg host size    %zu bytes "
-                           "(expansion ratio: %0.1f)\n",
-                           nb_tbs ? tst.host_size / nb_tbs : 0,
-                           tst.target_size ?
-                           (double)tst.host_size / tst.target_size : 0);
-    g_string_append_printf(buf, "cross page TB count %zu (%zu%%)\n",
-                           tst.cross_page,
-                           nb_tbs ? (tst.cross_page * 100) / nb_tbs : 0);
-    g_string_append_printf(buf, "direct jump count   %zu (%zu%%) "
-                           "(2 jumps=%zu %zu%%)\n",
-                           tst.direct_jmp_count,
-                           nb_tbs ? (tst.direct_jmp_count * 100) / nb_tbs : 0,
-                           tst.direct_jmp2_count,
-                           nb_tbs ? (tst.direct_jmp2_count * 100) / nb_tbs : 0);
-
-    qht_statistics_init(&tb_ctx.htable, &hst);
-    print_qht_statistics(hst, buf);
-    qht_statistics_destroy(&hst);
-
-    g_string_append_printf(buf, "\nStatistics:\n");
-    tcg_dump_flush_info(buf);
-}
-
-void tcg_dump_stats(GString *buf)
-{
-    dump_accel_info(buf);
-    dump_exec_info(buf);
-    dump_drift_info(buf);
-}
 
 HumanReadableText *qmp_x_query_jit(Error **errp)
 {
diff --git a/accel/tcg/tcg-stats.c b/accel/tcg/tcg-stats.c
new file mode 100644
index 0000000000..eb6e20ae98
--- /dev/null
+++ b/accel/tcg/tcg-stats.c
@@ -0,0 +1,215 @@
+/*
+ * SPDX-License-Identifier: LGPL-2.1-or-later
+ *
+ *  QEMU TCG statistics
+ *
+ *  Copyright (c) 2003-2005 Fabrice Bellard
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/accel.h"
+#include "qemu/qht.h"
+#include "qapi/error.h"
+#include "system/cpu-timers.h"
+#include "exec/icount.h"
+#include "hw/core/cpu.h"
+#include "tcg/tcg.h"
+#include "internal-common.h"
+#include "tb-context.h"
+#include <math.h>
+
+static void dump_drift_info(GString *buf)
+{
+    if (!icount_enabled()) {
+        return;
+    }
+
+    g_string_append_printf(buf, "Host - Guest clock  %"PRIi64" ms\n",
+                           (cpu_get_clock() - icount_get()) / SCALE_MS);
+    if (icount_align_option) {
+        g_string_append_printf(buf, "Max guest delay     %"PRIi64" ms\n",
+                               -max_delay / SCALE_MS);
+        g_string_append_printf(buf, "Max guest advance   %"PRIi64" ms\n",
+                               max_advance / SCALE_MS);
+    } else {
+        g_string_append_printf(buf, "Max guest delay     NA\n");
+        g_string_append_printf(buf, "Max guest advance   NA\n");
+    }
+}
+
+static void dump_accel_info(GString *buf)
+{
+    AccelState *accel = current_accel();
+    bool one_insn_per_tb = object_property_get_bool(OBJECT(accel),
+                                                    "one-insn-per-tb",
+                                                    &error_fatal);
+
+    g_string_append_printf(buf, "Accelerator settings:\n");
+    g_string_append_printf(buf, "one-insn-per-tb: %s\n\n",
+                           one_insn_per_tb ? "on" : "off");
+}
+
+static void print_qht_statistics(struct qht_stats hst, GString *buf)
+{
+    uint32_t hgram_opts;
+    size_t hgram_bins;
+    char *hgram;
+    double avg;
+
+    if (!hst.head_buckets) {
+        return;
+    }
+    g_string_append_printf(buf, "TB hash buckets     %zu/%zu "
+                           "(%0.2f%% head buckets used)\n",
+                           hst.used_head_buckets, hst.head_buckets,
+                           (double)hst.used_head_buckets /
+                           hst.head_buckets * 100);
+
+    hgram_opts =  QDIST_PR_BORDER | QDIST_PR_LABELS;
+    hgram_opts |= QDIST_PR_100X   | QDIST_PR_PERCENT;
+    if (qdist_xmax(&hst.occupancy) - qdist_xmin(&hst.occupancy) == 1) {
+        hgram_opts |= QDIST_PR_NODECIMAL;
+    }
+    hgram = qdist_pr(&hst.occupancy, 10, hgram_opts);
+    avg = qdist_avg(&hst.occupancy);
+    if (!isnan(avg)) {
+        g_string_append_printf(buf, "TB hash occupancy   "
+                                    "%0.2f%% avg chain occ. "
+                                    "Histogram: %s\n",
+                               avg * 100, hgram);
+    }
+    g_free(hgram);
+
+    hgram_opts = QDIST_PR_BORDER | QDIST_PR_LABELS;
+    hgram_bins = qdist_xmax(&hst.chain) - qdist_xmin(&hst.chain);
+    if (hgram_bins > 10) {
+        hgram_bins = 10;
+    } else {
+        hgram_bins = 0;
+        hgram_opts |= QDIST_PR_NODECIMAL | QDIST_PR_NOBINRANGE;
+    }
+    hgram = qdist_pr(&hst.chain, hgram_bins, hgram_opts);
+    avg = qdist_avg(&hst.chain);
+    if (!isnan(avg)) {
+        g_string_append_printf(buf, "TB hash avg chain   %0.3f buckets. "
+                               "Histogram: %s\n",
+                               avg, hgram);
+    }
+    g_free(hgram);
+}
+
+struct tb_tree_stats {
+    size_t nb_tbs;
+    size_t host_size;
+    size_t target_size;
+    size_t max_target_size;
+    size_t direct_jmp_count;
+    size_t direct_jmp2_count;
+    size_t cross_page;
+};
+
+static gboolean tb_tree_stats_iter(gpointer key, gpointer value, gpointer data)
+{
+    const TranslationBlock *tb = value;
+    struct tb_tree_stats *tst = data;
+
+    tst->nb_tbs++;
+    tst->host_size += tb->tc.size;
+    tst->target_size += tb->size;
+    if (tb->size > tst->max_target_size) {
+        tst->max_target_size = tb->size;
+    }
+#ifndef CONFIG_USER_ONLY
+    if (tb->page_addr[1] != -1) {
+        tst->cross_page++;
+    }
+#endif
+    if (tb->jmp_reset_offset[0] != TB_JMP_OFFSET_INVALID) {
+        tst->direct_jmp_count++;
+        if (tb->jmp_reset_offset[1] != TB_JMP_OFFSET_INVALID) {
+            tst->direct_jmp2_count++;
+        }
+    }
+    return false;
+}
+
+static void tlb_flush_counts(size_t *pfull, size_t *ppart, size_t *pelide)
+{
+    CPUState *cpu;
+    size_t full = 0, part = 0, elide = 0;
+
+    CPU_FOREACH(cpu) {
+        full += qatomic_read(&cpu->neg.tlb.c.full_flush_count);
+        part += qatomic_read(&cpu->neg.tlb.c.part_flush_count);
+        elide += qatomic_read(&cpu->neg.tlb.c.elide_flush_count);
+    }
+    *pfull = full;
+    *ppart = part;
+    *pelide = elide;
+}
+
+static void tcg_dump_flush_info(GString *buf)
+{
+    size_t flush_full, flush_part, flush_elide;
+
+    g_string_append_printf(buf, "TB flush count      %u\n",
+                           qatomic_read(&tb_ctx.tb_flush_count));
+    g_string_append_printf(buf, "TB invalidate count %u\n",
+                           qatomic_read(&tb_ctx.tb_phys_invalidate_count));
+
+    tlb_flush_counts(&flush_full, &flush_part, &flush_elide);
+    g_string_append_printf(buf, "TLB full flushes    %zu\n", flush_full);
+    g_string_append_printf(buf, "TLB partial flushes %zu\n", flush_part);
+    g_string_append_printf(buf, "TLB elided flushes  %zu\n", flush_elide);
+}
+
+static void dump_exec_info(GString *buf)
+{
+    struct tb_tree_stats tst = {};
+    struct qht_stats hst;
+    size_t nb_tbs;
+
+    tcg_tb_foreach(tb_tree_stats_iter, &tst);
+    nb_tbs = tst.nb_tbs;
+    /* XXX: avoid using doubles ? */
+    g_string_append_printf(buf, "Translation buffer state:\n");
+    /*
+     * Report total code size including the padding and TB structs;
+     * otherwise users might think "-accel tcg,tb-size" is not honoured.
+     * For avg host size we use the precise numbers from tb_tree_stats though.
+     */
+    g_string_append_printf(buf, "gen code size       %zu/%zu\n",
+                           tcg_code_size(), tcg_code_capacity());
+    g_string_append_printf(buf, "TB count            %zu\n", nb_tbs);
+    g_string_append_printf(buf, "TB avg target size  %zu max=%zu bytes\n",
+                           nb_tbs ? tst.target_size / nb_tbs : 0,
+                           tst.max_target_size);
+    g_string_append_printf(buf, "TB avg host size    %zu bytes "
+                           "(expansion ratio: %0.1f)\n",
+                           nb_tbs ? tst.host_size / nb_tbs : 0,
+                           tst.target_size ?
+                           (double)tst.host_size / tst.target_size : 0);
+    g_string_append_printf(buf, "cross page TB count %zu (%zu%%)\n",
+                           tst.cross_page,
+                           nb_tbs ? (tst.cross_page * 100) / nb_tbs : 0);
+    g_string_append_printf(buf, "direct jump count   %zu (%zu%%) "
+                           "(2 jumps=%zu %zu%%)\n",
+                           tst.direct_jmp_count,
+                           nb_tbs ? (tst.direct_jmp_count * 100) / nb_tbs : 0,
+                           tst.direct_jmp2_count,
+                           nb_tbs ? (tst.direct_jmp2_count * 100) / nb_tbs : 0);
+
+    qht_statistics_init(&tb_ctx.htable, &hst);
+    print_qht_statistics(hst, buf);
+    qht_statistics_destroy(&hst);
+
+    g_string_append_printf(buf, "\nStatistics:\n");
+    tcg_dump_flush_info(buf);
+}
+
+void tcg_dump_stats(GString *buf)
+{
+    dump_accel_info(buf);
+    dump_exec_info(buf);
+    dump_drift_info(buf);
+}

From 1861993f1fc13e42afed6a618c45a5a95a1457ea Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 2 Jul 2025 15:03:12 +0200
Subject: [PATCH 2454/2760] accel/system: Introduce @x-accel-stats QMP command
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Unstable QMP 'x-accel-stats' dispatches to the
AccelOpsClass::get_stats() and get_vcpu_stats() handlers.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Message-Id: <20250715140048.84942-4-philmd@linaro.org>
---
 accel/accel-qmp.c             | 35 +++++++++++++++++++++++++++++++++++
 accel/accel-system.c          |  1 +
 accel/meson.build             |  2 +-
 include/accel/accel-cpu-ops.h |  3 +++
 include/accel/accel-ops.h     |  2 ++
 qapi/accelerator.json         | 17 +++++++++++++++++
 6 files changed, 59 insertions(+), 1 deletion(-)
 create mode 100644 accel/accel-qmp.c

diff --git a/accel/accel-qmp.c b/accel/accel-qmp.c
new file mode 100644
index 0000000000..5fb70c6631
--- /dev/null
+++ b/accel/accel-qmp.c
@@ -0,0 +1,35 @@
+/*
+ * QMP commands related to accelerators
+ *
+ * Copyright (c) Linaro
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/accel.h"
+#include "qapi/type-helpers.h"
+#include "qapi/qapi-commands-accelerator.h"
+#include "accel/accel-ops.h"
+#include "accel/accel-cpu-ops.h"
+#include "hw/core/cpu.h"
+
+HumanReadableText *qmp_x_accel_stats(Error **errp)
+{
+    AccelState *accel = current_accel();
+    AccelClass *acc = ACCEL_GET_CLASS(accel);
+    g_autoptr(GString) buf = g_string_new("");
+
+    if (acc->get_stats) {
+        acc->get_stats(accel, buf);
+    }
+    if (acc->ops->get_vcpu_stats) {
+        CPUState *cpu;
+
+        CPU_FOREACH(cpu) {
+            acc->ops->get_vcpu_stats(cpu, buf);
+        }
+    }
+
+    return human_readable_text_from_str(buf);
+}
diff --git a/accel/accel-system.c b/accel/accel-system.c
index 8df561b953..76cf4e7ef7 100644
--- a/accel/accel-system.c
+++ b/accel/accel-system.c
@@ -26,6 +26,7 @@
 #include "qemu/osdep.h"
 #include "qemu/accel.h"
 #include "hw/boards.h"
+#include "hw/core/cpu.h"
 #include "accel/accel-ops.h"
 #include "accel/accel-cpu-ops.h"
 #include "system/cpus.h"
diff --git a/accel/meson.build b/accel/meson.build
index 52909314bf..25b0f100b5 100644
--- a/accel/meson.build
+++ b/accel/meson.build
@@ -1,6 +1,6 @@
 common_ss.add(files('accel-common.c'))
 specific_ss.add(files('accel-target.c'))
-system_ss.add(files('accel-system.c', 'accel-blocker.c'))
+system_ss.add(files('accel-system.c', 'accel-blocker.c', 'accel-qmp.c'))
 user_ss.add(files('accel-user.c'))
 
 subdir('tcg')
diff --git a/include/accel/accel-cpu-ops.h b/include/accel/accel-cpu-ops.h
index a9191dded7..0674764914 100644
--- a/include/accel/accel-cpu-ops.h
+++ b/include/accel/accel-cpu-ops.h
@@ -65,6 +65,9 @@ struct AccelOpsClass {
     /* handle_interrupt is mandatory. */
     void (*handle_interrupt)(CPUState *cpu, int mask);
 
+    /* get_vcpu_stats: Append statistics of this @cpu to @buf */
+    void (*get_vcpu_stats)(CPUState *cpu, GString *buf);
+
     /**
      * @get_virtual_clock: fetch virtual clock
      * @set_virtual_clock: set virtual clock
diff --git a/include/accel/accel-ops.h b/include/accel/accel-ops.h
index 86a27c30fa..23a8c246e1 100644
--- a/include/accel/accel-ops.h
+++ b/include/accel/accel-ops.h
@@ -25,6 +25,8 @@ struct AccelClass {
     int (*init_machine)(AccelState *as, MachineState *ms);
     bool (*cpu_common_realize)(CPUState *cpu, Error **errp);
     void (*cpu_common_unrealize)(CPUState *cpu);
+    /* get_stats: Append statistics to @buf */
+    void (*get_stats)(AccelState *as, GString *buf);
 
     /* system related hooks */
     void (*setup_post)(AccelState *as);
diff --git a/qapi/accelerator.json b/qapi/accelerator.json
index d55fe1aa0a..6029e7307a 100644
--- a/qapi/accelerator.json
+++ b/qapi/accelerator.json
@@ -37,3 +37,20 @@
 #     <- { "return": { "enabled": true, "present": true } }
 ##
 { 'command': 'query-kvm', 'returns': 'KvmInfo' }
+
+##
+# @x-accel-stats:
+#
+# Query accelerator statistics
+#
+# Features:
+#
+# @unstable: This command is meant for debugging.
+#
+# Returns: accelerator statistics
+#
+# Since: 10.1
+##
+{ 'command': 'x-accel-stats',
+  'returns': 'HumanReadableText',
+  'features': [ 'unstable' ] }

From c10eb740108c24c65f049e5ae85ed10b2779e75d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 17 Jun 2025 14:44:14 +0200
Subject: [PATCH 2455/2760] accel/system: Add 'info accel' on human monitor
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

'info accel' dispatches to the AccelOpsClass::get_stats()
and get_vcpu_stats() handlers.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Acked-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20250715140048.84942-5-philmd@linaro.org>
---
 accel/accel-system.c |  8 ++++++++
 hmp-commands-info.hx | 12 ++++++++++++
 2 files changed, 20 insertions(+)

diff --git a/accel/accel-system.c b/accel/accel-system.c
index 76cf4e7ef7..1e97c64fdc 100644
--- a/accel/accel-system.c
+++ b/accel/accel-system.c
@@ -25,6 +25,8 @@
 
 #include "qemu/osdep.h"
 #include "qemu/accel.h"
+#include "qapi/qapi-commands-accelerator.h"
+#include "monitor/monitor.h"
 #include "hw/boards.h"
 #include "hw/core/cpu.h"
 #include "accel/accel-ops.h"
@@ -103,11 +105,17 @@ void accel_init_ops_interfaces(AccelClass *ac)
     cpus_register_accel(ops);
 }
 
+static void accel_ops_class_init(ObjectClass *oc, const void *data)
+{
+    monitor_register_hmp_info_hrt("accel", qmp_x_accel_stats);
+}
+
 static const TypeInfo accel_ops_type_info = {
     .name = TYPE_ACCEL_OPS,
     .parent = TYPE_OBJECT,
     .abstract = true,
     .class_size = sizeof(AccelOpsClass),
+    .class_init = accel_ops_class_init,
 };
 
 static void accel_system_register_types(void)
diff --git a/hmp-commands-info.hx b/hmp-commands-info.hx
index d797922275..6142f60e7b 100644
--- a/hmp-commands-info.hx
+++ b/hmp-commands-info.hx
@@ -267,6 +267,18 @@ ERST
         .cmd        = hmp_info_sync_profile,
     },
 
+    {
+        .name       = "accel",
+        .args_type  = "",
+        .params     = "",
+        .help       = "show accelerator info",
+    },
+
+SRST
+  ``info accel``
+    Show accelerator info.
+ERST
+
 SRST
   ``info sync-profile [-m|-n]`` [*max*]
     Show synchronization profiling info, up to *max* entries (default: 10),

From 2320453031f87e4245a5625f3714d444e987ea0c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 8 Jul 2025 14:09:29 +0200
Subject: [PATCH 2456/2760] accel/tcg: Propagate AccelState to
 dump_accel_info()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Declare tcg_dump_stats() in "tcg/tcg.h" so it can be used out of
accel/tcg/, like by {bsd,linux}-user.

Next commit will register the TCG AccelClass::get_stats handler,
which expects a AccelState, so propagate it to dump_accel_info().

Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20250715140048.84942-6-philmd@linaro.org>
---
 accel/tcg/internal-common.h | 2 --
 accel/tcg/monitor.c         | 1 +
 accel/tcg/tcg-stats.c       | 5 ++---
 include/tcg/tcg.h           | 2 ++
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/accel/tcg/internal-common.h b/accel/tcg/internal-common.h
index 77a3a0684a..1dbc45dd95 100644
--- a/accel/tcg/internal-common.h
+++ b/accel/tcg/internal-common.h
@@ -139,6 +139,4 @@ G_NORETURN void cpu_io_recompile(CPUState *cpu, uintptr_t retaddr);
 void tb_phys_invalidate(TranslationBlock *tb, tb_page_addr_t page_addr);
 void tb_set_jmp_target(TranslationBlock *tb, int n, uintptr_t addr);
 
-void tcg_dump_stats(GString *buf);
-
 #endif
diff --git a/accel/tcg/monitor.c b/accel/tcg/monitor.c
index adb9de5a1c..be5c195017 100644
--- a/accel/tcg/monitor.c
+++ b/accel/tcg/monitor.c
@@ -12,6 +12,7 @@
 #include "qapi/qapi-commands-machine.h"
 #include "monitor/monitor.h"
 #include "system/tcg.h"
+#include "tcg/tcg.h"
 #include "internal-common.h"
 
 HumanReadableText *qmp_x_query_jit(Error **errp)
diff --git a/accel/tcg/tcg-stats.c b/accel/tcg/tcg-stats.c
index eb6e20ae98..e1a1c4cf4a 100644
--- a/accel/tcg/tcg-stats.c
+++ b/accel/tcg/tcg-stats.c
@@ -37,9 +37,8 @@ static void dump_drift_info(GString *buf)
     }
 }
 
-static void dump_accel_info(GString *buf)
+static void dump_accel_info(AccelState *accel, GString *buf)
 {
-    AccelState *accel = current_accel();
     bool one_insn_per_tb = object_property_get_bool(OBJECT(accel),
                                                     "one-insn-per-tb",
                                                     &error_fatal);
@@ -209,7 +208,7 @@ static void dump_exec_info(GString *buf)
 
 void tcg_dump_stats(GString *buf)
 {
-    dump_accel_info(buf);
+    dump_accel_info(current_accel(), buf);
     dump_exec_info(buf);
     dump_drift_info(buf);
 }
diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
index 0c2a319c11..a6d9aa50d4 100644
--- a/include/tcg/tcg.h
+++ b/include/tcg/tcg.h
@@ -1005,5 +1005,7 @@ static inline const TCGOpcode *tcg_swap_vecop_list(const TCGOpcode *n)
 
 bool tcg_can_emit_vecop_list(const TCGOpcode *, TCGType, unsigned);
 void tcg_dump_ops(TCGContext *s, FILE *f, bool have_prefs);
+/* tcg_dump_stats: Append TCG statistics to @buf */
+void tcg_dump_stats(GString *buf);
 
 #endif /* TCG_H */

From cf4305ed7a24f25cef0bd35609d03ea688fa24fa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 17 Jun 2025 14:45:29 +0200
Subject: [PATCH 2457/2760] accel/tcg: Implement AccelClass::get_stats()
 handler
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Factor tcg_get_stats() out of tcg_dump_stats(),
passing the current accelerator argument to match
the AccelClass::get_stats() prototype.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250715140048.84942-7-philmd@linaro.org>
---
 accel/tcg/internal-common.h | 2 ++
 accel/tcg/tcg-all.c         | 1 +
 accel/tcg/tcg-stats.c       | 9 +++++++--
 3 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/accel/tcg/internal-common.h b/accel/tcg/internal-common.h
index 1dbc45dd95..6adfeefe13 100644
--- a/accel/tcg/internal-common.h
+++ b/accel/tcg/internal-common.h
@@ -139,4 +139,6 @@ G_NORETURN void cpu_io_recompile(CPUState *cpu, uintptr_t retaddr);
 void tb_phys_invalidate(TranslationBlock *tb, tb_page_addr_t page_addr);
 void tb_set_jmp_target(TranslationBlock *tb, int n, uintptr_t addr);
 
+void tcg_get_stats(AccelState *accel, GString *buf);
+
 #endif
diff --git a/accel/tcg/tcg-all.c b/accel/tcg/tcg-all.c
index eaeb465dfd..5125e1a4e2 100644
--- a/accel/tcg/tcg-all.c
+++ b/accel/tcg/tcg-all.c
@@ -243,6 +243,7 @@ static void tcg_accel_class_init(ObjectClass *oc, const void *data)
     ac->init_machine = tcg_init_machine;
     ac->cpu_common_realize = tcg_exec_realizefn;
     ac->cpu_common_unrealize = tcg_exec_unrealizefn;
+    ac->get_stats = tcg_get_stats;
     ac->allowed = &tcg_allowed;
     ac->gdbstub_supported_sstep_flags = tcg_gdbstub_supported_sstep_flags;
 
diff --git a/accel/tcg/tcg-stats.c b/accel/tcg/tcg-stats.c
index e1a1c4cf4a..ced5dec0c4 100644
--- a/accel/tcg/tcg-stats.c
+++ b/accel/tcg/tcg-stats.c
@@ -206,9 +206,14 @@ static void dump_exec_info(GString *buf)
     tcg_dump_flush_info(buf);
 }
 
-void tcg_dump_stats(GString *buf)
+void tcg_get_stats(AccelState *accel, GString *buf)
 {
-    dump_accel_info(current_accel(), buf);
+    dump_accel_info(accel, buf);
     dump_exec_info(buf);
     dump_drift_info(buf);
 }
+
+void tcg_dump_stats(GString *buf)
+{
+    tcg_get_stats(current_accel(), buf);
+}

From 96acc034ffffc8d7dc0cf3dfbf2996cbdbe3dde2 Mon Sep 17 00:00:00 2001
From: Fiona Ebner <f.ebner@proxmox.com>
Date: Thu, 5 Jun 2025 12:09:38 +0200
Subject: [PATCH 2458/2760] iotests: add test for changing the 'drive' property
 via 'qom-set'

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Message-ID: <20250605100938.43133-1-f.ebner@proxmox.com>
[kwolf: Fixed up pylint warnings flagged by 297]
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 tests/qemu-iotests/tests/qom-set-drive     | 75 ++++++++++++++++++++++
 tests/qemu-iotests/tests/qom-set-drive.out | 11 ++++
 2 files changed, 86 insertions(+)
 create mode 100755 tests/qemu-iotests/tests/qom-set-drive
 create mode 100644 tests/qemu-iotests/tests/qom-set-drive.out

diff --git a/tests/qemu-iotests/tests/qom-set-drive b/tests/qemu-iotests/tests/qom-set-drive
new file mode 100755
index 0000000000..ec8ddac4fd
--- /dev/null
+++ b/tests/qemu-iotests/tests/qom-set-drive
@@ -0,0 +1,75 @@
+#!/usr/bin/env python3
+# group: quick
+#
+# Test how changing the 'drive' property via 'qom-set' behaves.
+#
+# Copyright (C) Proxmox Server Solutions GmbH
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+import os
+import iotests
+from iotests import imgfmt, log, qemu_img_create, QMPTestCase
+
+image_size = 1 * 1024 * 1024
+images = [os.path.join(iotests.test_dir, f'{i}.img') for i in range(0, 4)]
+
+class TestQOMSetDrive(QMPTestCase):
+    def setUp(self) -> None:
+        for image in images:
+            qemu_img_create('-f', imgfmt, image, str(image_size))
+
+        self.vm = iotests.VM()
+        for i, image in enumerate(images):
+            self.vm.add_blockdev(self.vm.qmp_to_opts({
+                'driver': imgfmt,
+                'node-name': f'node{i}',
+                'file': {
+                    'driver': 'file',
+                    'filename': image,
+                }
+            }))
+        self.vm.add_object('iothread,id=iothread0')
+        self.vm.add_device('virtio-scsi,iothread=iothread0')
+        self.vm.add_device('scsi-hd,id=iot,drive=node0')
+        self.vm.add_device('virtio-scsi')
+        self.vm.add_device('scsi-hd,id=no-iot,drive=node1')
+        self.vm.launch()
+
+    def tearDown(self) -> None:
+        self.vm.shutdown()
+        for image in images:
+            os.remove(image)
+
+    def test_qom_set_drive(self) -> None:
+        log(self.vm.qmp('qom-get', path='/machine/peripheral/iot',
+                        property='drive'))
+        log(self.vm.qmp('qom-set', path='/machine/peripheral/iot',
+                        property='drive', value='node2'))
+        log(self.vm.qmp('qom-get', path='/machine/peripheral/iot',
+                        property='drive'))
+
+        log(self.vm.qmp('qom-get', path='/machine/peripheral/no-iot',
+                        property='drive'))
+        log(self.vm.qmp('qom-set', path='/machine/peripheral/no-iot',
+                        property='drive', value='node3'))
+        log(self.vm.qmp('qom-get', path='/machine/peripheral/no-iot',
+                        property='drive'))
+
+if __name__ == '__main__':
+    iotests.activate_logging()
+    # LUKS would require special key-secret handling in add_blockdevs()
+    iotests.main(supported_fmts=['generic'],
+                 unsupported_fmts=['luks'])
diff --git a/tests/qemu-iotests/tests/qom-set-drive.out b/tests/qemu-iotests/tests/qom-set-drive.out
new file mode 100644
index 0000000000..7fc243dca6
--- /dev/null
+++ b/tests/qemu-iotests/tests/qom-set-drive.out
@@ -0,0 +1,11 @@
+{"return": "node0"}
+{"error": {"class": "GenericError", "desc": "Different aio context is not supported for new node"}}
+{"return": "node0"}
+{"return": "node1"}
+{"return": {}}
+{"return": "node3"}
+.
+----------------------------------------------------------------------
+Ran 1 tests
+
+OK

From 1c47abc5779dfaaee303f0bff144e88dc8fb74d5 Mon Sep 17 00:00:00 2001
From: Michael Tokarev <mjt@tls.msk.ru>
Date: Sat, 31 May 2025 20:15:43 +0300
Subject: [PATCH 2459/2760] qemu-img: measure: convert img_size to signed,
 simplify handling
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

qemu_opt_set_number() expects signed int64_t.

Use int64_t instead of uint64_t for img_size, use -1 as "unset"
value instead of UINT64_MAX, and do not require temporary sval
for conversion from string.

Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20250531171609.197078-2-mjt@tls.msk.ru>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 qemu-img.c | 19 +++++++------------
 1 file changed, 7 insertions(+), 12 deletions(-)

diff --git a/qemu-img.c b/qemu-img.c
index e75707180d..e676602fc7 100644
--- a/qemu-img.c
+++ b/qemu-img.c
@@ -5370,7 +5370,7 @@ static int img_measure(int argc, char **argv)
     QemuOpts *sn_opts = NULL;
     QemuOptsList *create_opts = NULL;
     bool image_opts = false;
-    uint64_t img_size = UINT64_MAX;
+    int64_t img_size = -1;
     BlockMeasureInfo *info = NULL;
     Error *local_err = NULL;
     int ret = 1;
@@ -5428,16 +5428,11 @@ static int img_measure(int argc, char **argv)
             }
             break;
         case OPTION_SIZE:
-        {
-            int64_t sval;
-
-            sval = cvtnum("image size", optarg);
-            if (sval < 0) {
+            img_size = cvtnum("image size", optarg);
+            if (img_size < 0) {
                 goto out;
             }
-            img_size = (uint64_t)sval;
-        }
-        break;
+            break;
         }
     }
 
@@ -5452,11 +5447,11 @@ static int img_measure(int argc, char **argv)
         error_report("--image-opts, -f, and -l require a filename argument.");
         goto out;
     }
-    if (filename && img_size != UINT64_MAX) {
+    if (filename && img_size != -1) {
         error_report("--size N cannot be used together with a filename.");
         goto out;
     }
-    if (!filename && img_size == UINT64_MAX) {
+    if (!filename && img_size == -1) {
         error_report("Either --size N or one filename must be specified.");
         goto out;
     }
@@ -5504,7 +5499,7 @@ static int img_measure(int argc, char **argv)
             goto out;
         }
     }
-    if (img_size != UINT64_MAX) {
+    if (img_size != -1) {
         qemu_opt_set_number(opts, BLOCK_OPT_SIZE, img_size, &error_abort);
     }
 

From 443761ab3874d0ffc2df0a0cd73dd1ca833b277e Mon Sep 17 00:00:00 2001
From: Michael Tokarev <mjt@tls.msk.ru>
Date: Sat, 31 May 2025 20:15:44 +0300
Subject: [PATCH 2460/2760] qemu-img: create: convert img_size to signed,
 simplify handling
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Initializing an unsigned as -1, or using temporary
sval for conversion is awkward.  Since we don't allow
other "negative" values anyway, use signed value and
pass it to bdrv_img_create() (where it is properly
converted to unsigned), simplifying code.

Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20250531171609.197078-3-mjt@tls.msk.ru>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 qemu-img.c | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/qemu-img.c b/qemu-img.c
index e676602fc7..6750d0657c 100644
--- a/qemu-img.c
+++ b/qemu-img.c
@@ -511,7 +511,7 @@ static int64_t cvtnum(const char *name, const char *value)
 static int img_create(int argc, char **argv)
 {
     int c;
-    uint64_t img_size = -1;
+    int64_t img_size = -1;
     const char *fmt = "raw";
     const char *base_fmt = NULL;
     const char *filename;
@@ -582,13 +582,10 @@ static int img_create(int argc, char **argv)
 
     /* Get image size, if specified */
     if (optind < argc) {
-        int64_t sval;
-
-        sval = cvtnum("image size", argv[optind++]);
-        if (sval < 0) {
+        img_size = cvtnum("image size", argv[optind++]);
+        if (img_size < 0) {
             goto fail;
         }
-        img_size = (uint64_t)sval;
     }
     if (optind != argc) {
         error_exit("Unexpected argument: %s", argv[optind]);

From fef5f1d4aa60360226bc15288611998b3699618f Mon Sep 17 00:00:00 2001
From: Michael Tokarev <mjt@tls.msk.ru>
Date: Sat, 31 May 2025 20:15:45 +0300
Subject: [PATCH 2461/2760] qemu-img: global option processing and error
 printing

In order to correctly print executable name in various
error messages, pass argv[0] to error_exit() function.
This way, error messages will refer to actual executable
name, which may be different from 'qemu-img'.

For subcommands, pass original command name from the
qemu-img argv[0], plus the subcommand name, as its own
argv[0] element, so error messages can be more useful.
Also don't require at least 3 options on the command
line: it makes no sense with options before subcommand.

Introduce tryhelp() function which just prints

 try 'command-name --help' for more info

and exits.  When tryhelp() is called from within a subcommand
handler, the message will look like:

 try 'command-name subcommand --help' for more information

qemu-img uses getopt_long() with ':' as the first char in
optstring parameter, which means it doesn't print error
messages but return ':' or '?' instead, and qemu-img uses
unrecognized_option() or missing_argument() function to
print error messages.  But it doesn't quite work:

 $ ./qemu-img -xx
 qemu-img: unrecognized option './qemu-img'

so the aim is to let getopt_long() to print regular error
messages instead (removing ':' prefix from optstring) and
remove handling of '?' and ':' "options" entirely.  With
concatenated argv[0] and the subcommand, it all finally
does the right thing in all cases.  This will be done in
subsequent changes command by command, with main() done
last.

unrecognized_option() and missing_argument() functions
prototypes aren't changed by this patch, since they're
called from many places and will be removed a few patches
later.  Only artifical "qemu-img" argv0 is provided in
there for now.

Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20250531171609.197078-4-mjt@tls.msk.ru>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 qemu-img.c | 80 +++++++++++++++++++++++++++++-------------------------
 1 file changed, 43 insertions(+), 37 deletions(-)

diff --git a/qemu-img.c b/qemu-img.c
index 6750d0657c..2b46c952bd 100644
--- a/qemu-img.c
+++ b/qemu-img.c
@@ -101,8 +101,15 @@ static void format_print(void *opaque, const char *name)
     printf(" %s", name);
 }
 
-static G_NORETURN G_GNUC_PRINTF(1, 2)
-void error_exit(const char *fmt, ...)
+static G_NORETURN
+void tryhelp(const char *argv0)
+{
+    error_printf("Try '%s --help' for more information\n", argv0);
+    exit(EXIT_FAILURE);
+}
+
+static G_NORETURN G_GNUC_PRINTF(2, 3)
+void error_exit(const char *argv0, const char *fmt, ...)
 {
     va_list ap;
 
@@ -110,20 +117,19 @@ void error_exit(const char *fmt, ...)
     error_vreport(fmt, ap);
     va_end(ap);
 
-    error_printf("Try 'qemu-img --help' for more information\n");
-    exit(EXIT_FAILURE);
+    tryhelp(argv0);
 }
 
 static G_NORETURN
 void missing_argument(const char *option)
 {
-    error_exit("missing argument for option '%s'", option);
+    error_exit("qemu-img", "missing argument for option '%s'", option);
 }
 
 static G_NORETURN
 void unrecognized_option(const char *option)
 {
-    error_exit("unrecognized option '%s'", option);
+    error_exit("qemu-img", "unrecognized option '%s'", option);
 }
 
 /* Please keep in synch with docs/tools/qemu-img.rst */
@@ -576,7 +582,7 @@ static int img_create(int argc, char **argv)
     }
 
     if (optind >= argc) {
-        error_exit("Expecting image file name");
+        error_exit(argv[0], "Expecting image file name");
     }
     optind++;
 
@@ -588,7 +594,7 @@ static int img_create(int argc, char **argv)
         }
     }
     if (optind != argc) {
-        error_exit("Unexpected argument: %s", argv[optind]);
+        error_exit(argv[0], "Unexpected argument: %s", argv[optind]);
     }
 
     bdrv_img_create(filename, fmt, base_filename, base_fmt,
@@ -770,7 +776,7 @@ static int img_check(int argc, char **argv)
             } else if (!strcmp(optarg, "all")) {
                 fix = BDRV_FIX_LEAKS | BDRV_FIX_ERRORS;
             } else {
-                error_exit("Unknown option value for -r "
+                error_exit(argv[0], "Unknown option value for -r "
                            "(expecting 'leaks' or 'all'): %s", optarg);
             }
             break;
@@ -795,7 +801,7 @@ static int img_check(int argc, char **argv)
         }
     }
     if (optind != argc - 1) {
-        error_exit("Expecting one image file name");
+        error_exit(argv[0], "Expecting one image file name");
     }
     filename = argv[optind++];
 
@@ -1025,7 +1031,7 @@ static int img_commit(int argc, char **argv)
     }
 
     if (optind != argc - 1) {
-        error_exit("Expecting one image file name");
+        error_exit(argv[0], "Expecting one image file name");
     }
     filename = argv[optind++];
 
@@ -1446,7 +1452,7 @@ static int img_compare(int argc, char **argv)
 
 
     if (optind != argc - 2) {
-        error_exit("Expecting two image file names");
+        error_exit(argv[0], "Expecting two image file names");
     }
     filename1 = argv[optind++];
     filename2 = argv[optind++];
@@ -3056,7 +3062,7 @@ static int img_info(int argc, char **argv)
         }
     }
     if (optind != argc - 1) {
-        error_exit("Expecting one image file name");
+        error_exit(argv[0], "Expecting one image file name");
     }
     filename = argv[optind++];
 
@@ -3296,7 +3302,7 @@ static int img_map(int argc, char **argv)
         }
     }
     if (optind != argc - 1) {
-        error_exit("Expecting one image file name");
+        error_exit(argv[0], "Expecting one image file name");
     }
     filename = argv[optind];
 
@@ -3411,7 +3417,7 @@ static int img_snapshot(int argc, char **argv)
             return 0;
         case 'l':
             if (action) {
-                error_exit("Cannot mix '-l', '-a', '-c', '-d'");
+                error_exit(argv[0], "Cannot mix '-l', '-a', '-c', '-d'");
                 return 0;
             }
             action = SNAPSHOT_LIST;
@@ -3419,7 +3425,7 @@ static int img_snapshot(int argc, char **argv)
             break;
         case 'a':
             if (action) {
-                error_exit("Cannot mix '-l', '-a', '-c', '-d'");
+                error_exit(argv[0], "Cannot mix '-l', '-a', '-c', '-d'");
                 return 0;
             }
             action = SNAPSHOT_APPLY;
@@ -3427,7 +3433,7 @@ static int img_snapshot(int argc, char **argv)
             break;
         case 'c':
             if (action) {
-                error_exit("Cannot mix '-l', '-a', '-c', '-d'");
+                error_exit(argv[0], "Cannot mix '-l', '-a', '-c', '-d'");
                 return 0;
             }
             action = SNAPSHOT_CREATE;
@@ -3435,7 +3441,7 @@ static int img_snapshot(int argc, char **argv)
             break;
         case 'd':
             if (action) {
-                error_exit("Cannot mix '-l', '-a', '-c', '-d'");
+                error_exit(argv[0], "Cannot mix '-l', '-a', '-c', '-d'");
                 return 0;
             }
             action = SNAPSHOT_DELETE;
@@ -3457,7 +3463,7 @@ static int img_snapshot(int argc, char **argv)
     }
 
     if (optind != argc - 1) {
-        error_exit("Expecting one image file name");
+        error_exit(argv[0], "Expecting one image file name");
     }
     filename = argv[optind++];
 
@@ -3626,10 +3632,11 @@ static int img_rebase(int argc, char **argv)
     }
 
     if (optind != argc - 1) {
-        error_exit("Expecting one image file name");
+        error_exit(argv[0], "Expecting one image file name");
     }
     if (!unsafe && !out_baseimg) {
-        error_exit("Must specify backing file (-b) or use unsafe mode (-u)");
+        error_exit(argv[0],
+                   "Must specify backing file (-b) or use unsafe mode (-u)");
     }
     filename = argv[optind++];
 
@@ -4053,7 +4060,7 @@ static int img_resize(int argc, char **argv)
     /* Remove size from argv manually so that negative numbers are not treated
      * as options by getopt. */
     if (argc < 3) {
-        error_exit("Not enough arguments");
+        error_exit(argv[0], "Not enough arguments");
         return 1;
     }
 
@@ -4111,7 +4118,7 @@ static int img_resize(int argc, char **argv)
         }
     }
     if (optind != argc - 1) {
-        error_exit("Expecting image file name and size");
+        error_exit(argv[0], "Expecting image file name and size");
     }
     filename = argv[optind++];
 
@@ -4308,7 +4315,7 @@ static int img_amend(int argc, char **argv)
     }
 
     if (!options) {
-        error_exit("Must specify options (-o)");
+        error_exit(argv[0], "Must specify options (-o)");
     }
 
     if (quiet) {
@@ -4674,7 +4681,7 @@ static int img_bench(int argc, char **argv)
     }
 
     if (optind != argc - 1) {
-        error_exit("Expecting one image file name");
+        error_exit(argv[0], "Expecting one image file name");
     }
     filename = argv[argc - 1];
 
@@ -5564,9 +5571,6 @@ int main(int argc, char **argv)
 
     module_call_init(MODULE_INIT_QOM);
     bdrv_init();
-    if (argc < 2) {
-        error_exit("Not enough arguments");
-    }
 
     qemu_add_opts(&qemu_source_opts);
     qemu_add_opts(&qemu_trace_opts);
@@ -5591,15 +5595,11 @@ int main(int argc, char **argv)
         }
     }
 
-    cmdname = argv[optind];
-
-    /* reset getopt_long scanning */
-    argc -= optind;
-    if (argc < 1) {
-        return 0;
+    if (optind >= argc) {
+        error_exit(argv[0], "Not enough arguments");
     }
-    argv += optind;
-    qemu_reset_optind();
+
+    cmdname = argv[optind];
 
     if (!trace_init_backends()) {
         exit(1);
@@ -5610,10 +5610,16 @@ int main(int argc, char **argv)
     /* find the command */
     for (cmd = img_cmds; cmd->name != NULL; cmd++) {
         if (!strcmp(cmdname, cmd->name)) {
+            g_autofree char *argv0 = g_strdup_printf("%s %s", argv[0], cmdname);
+            /* reset options and getopt processing (incl return order) */
+            argv += optind;
+            argc -= optind;
+            qemu_reset_optind();
+            argv[0] = argv0;
             return cmd->handler(argc, argv);
         }
     }
 
     /* not found */
-    error_exit("Command not found: %s", cmdname);
+    error_exit(argv[0], "Command not found: %s", cmdname);
 }

From 80415af893644e440f73e8c87dc104f4ebd36434 Mon Sep 17 00:00:00 2001
From: Michael Tokarev <mjt@tls.msk.ru>
Date: Sat, 31 May 2025 20:15:46 +0300
Subject: [PATCH 2462/2760] qemu-img: pass current cmd info into command
 handlers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This info will be used to generate --help output.

Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20250531171609.197078-5-mjt@tls.msk.ru>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 qemu-img.c | 34 +++++++++++++++++-----------------
 1 file changed, 17 insertions(+), 17 deletions(-)

diff --git a/qemu-img.c b/qemu-img.c
index 2b46c952bd..a414837355 100644
--- a/qemu-img.c
+++ b/qemu-img.c
@@ -60,7 +60,7 @@
 
 typedef struct img_cmd_t {
     const char *name;
-    int (*handler)(int argc, char **argv);
+    int (*handler)(const struct img_cmd_t *ccmd, int argc, char **argv);
 } img_cmd_t;
 
 enum {
@@ -514,7 +514,7 @@ static int64_t cvtnum(const char *name, const char *value)
     return cvtnum_full(name, value, 0, INT64_MAX);
 }
 
-static int img_create(int argc, char **argv)
+static int img_create(const img_cmd_t *ccmd, int argc, char **argv)
 {
     int c;
     int64_t img_size = -1;
@@ -719,7 +719,7 @@ static int collect_image_check(BlockDriverState *bs,
  *  3 - Check completed, image has leaked clusters, but is good otherwise
  * 63 - Checks are not supported by the image format
  */
-static int img_check(int argc, char **argv)
+static int img_check(const img_cmd_t *ccmd, int argc, char **argv)
 {
     int c, ret;
     OutputFormat output_format = OFORMAT_HUMAN;
@@ -951,7 +951,7 @@ static void run_block_job(BlockJob *job, Error **errp)
     }
 }
 
-static int img_commit(int argc, char **argv)
+static int img_commit(const img_cmd_t *ccmd, int argc, char **argv)
 {
     int c, ret, flags;
     const char *filename, *fmt, *cache, *base;
@@ -1358,7 +1358,7 @@ static int check_empty_sectors(BlockBackend *blk, int64_t offset,
  * 1 - Images differ
  * >1 - Error occurred
  */
-static int img_compare(int argc, char **argv)
+static int img_compare(const img_cmd_t *ccmd, int argc, char **argv)
 {
     const char *fmt1 = NULL, *fmt2 = NULL, *cache, *filename1, *filename2;
     BlockBackend *blk1, *blk2;
@@ -2234,7 +2234,7 @@ static void set_rate_limit(BlockBackend *blk, int64_t rate_limit)
     blk_set_io_limits(blk, &cfg);
 }
 
-static int img_convert(int argc, char **argv)
+static int img_convert(const img_cmd_t *ccmd, int argc, char **argv)
 {
     int c, bs_i, flags, src_flags = BDRV_O_NO_SHARE;
     const char *fmt = NULL, *out_fmt = NULL, *cache = "unsafe",
@@ -3002,7 +3002,7 @@ err:
     return NULL;
 }
 
-static int img_info(int argc, char **argv)
+static int img_info(const img_cmd_t *ccmd, int argc, char **argv)
 {
     int c;
     OutputFormat output_format = OFORMAT_HUMAN;
@@ -3227,7 +3227,7 @@ static inline bool entry_mergeable(const MapEntry *curr, const MapEntry *next)
     return true;
 }
 
-static int img_map(int argc, char **argv)
+static int img_map(const img_cmd_t *ccmd, int argc, char **argv)
 {
     int c;
     OutputFormat output_format = OFORMAT_HUMAN;
@@ -3376,7 +3376,7 @@ out:
 #define SNAPSHOT_APPLY  3
 #define SNAPSHOT_DELETE 4
 
-static int img_snapshot(int argc, char **argv)
+static int img_snapshot(const img_cmd_t *ccmd, int argc, char **argv)
 {
     BlockBackend *blk;
     BlockDriverState *bs;
@@ -3536,7 +3536,7 @@ static int img_snapshot(int argc, char **argv)
     return 0;
 }
 
-static int img_rebase(int argc, char **argv)
+static int img_rebase(const img_cmd_t *ccmd, int argc, char **argv)
 {
     BlockBackend *blk = NULL, *blk_old_backing = NULL, *blk_new_backing = NULL;
     uint8_t *buf_old = NULL;
@@ -4030,7 +4030,7 @@ out:
     return 0;
 }
 
-static int img_resize(int argc, char **argv)
+static int img_resize(const img_cmd_t *ccmd, int argc, char **argv)
 {
     Error *err = NULL;
     int c, ret, relative;
@@ -4243,7 +4243,7 @@ static int print_amend_option_help(const char *format)
     return 0;
 }
 
-static int img_amend(int argc, char **argv)
+static int img_amend(const img_cmd_t *ccmd, int argc, char **argv)
 {
     Error *err = NULL;
     int c, ret = 0;
@@ -4511,7 +4511,7 @@ static void bench_cb(void *opaque, int ret)
     }
 }
 
-static int img_bench(int argc, char **argv)
+static int img_bench(const img_cmd_t *ccmd, int argc, char **argv)
 {
     int c, ret = 0;
     const char *fmt = NULL, *filename;
@@ -4781,7 +4781,7 @@ typedef struct ImgBitmapAction {
     QSIMPLEQ_ENTRY(ImgBitmapAction) next;
 } ImgBitmapAction;
 
-static int img_bitmap(int argc, char **argv)
+static int img_bitmap(const img_cmd_t *ccmd, int argc, char **argv)
 {
     Error *err = NULL;
     int c, ret = 1;
@@ -5081,7 +5081,7 @@ static int img_dd_skip(const char *arg,
     return 0;
 }
 
-static int img_dd(int argc, char **argv)
+static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
 {
     int ret = 0;
     char *arg = NULL;
@@ -5349,7 +5349,7 @@ static void dump_json_block_measure_info(BlockMeasureInfo *info)
     g_string_free(str, true);
 }
 
-static int img_measure(int argc, char **argv)
+static int img_measure(const img_cmd_t *ccmd, int argc, char **argv)
 {
     static const struct option long_options[] = {
         {"help", no_argument, 0, 'h'},
@@ -5616,7 +5616,7 @@ int main(int argc, char **argv)
             argc -= optind;
             qemu_reset_optind();
             argv[0] = argv0;
-            return cmd->handler(argc, argv);
+            return cmd->handler(cmd, argc, argv);
         }
     }
 

From 52292ba8b65723546478bc2c146542a601382e82 Mon Sep 17 00:00:00 2001
From: Michael Tokarev <mjt@tls.msk.ru>
Date: Sat, 31 May 2025 20:15:47 +0300
Subject: [PATCH 2463/2760] qemu-img: create: refresh options/--help (short
 option change)

Create helper function cmd_help() to display command-specific
help text, and use it to print --help for 'create' subcommand.

Add missing long options (eg --format) in img_create().

Recognize -B option for --backing-format, keep -F for
backward compatibility,

Reorder options for consistency.

Remove usage of missing_argument()/unrecognized_option() in
img_create().

Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Message-ID: <20250531171609.197078-6-mjt@tls.msk.ru>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 docs/tools/qemu-img.rst | 10 ++---
 qemu-img.c              | 84 +++++++++++++++++++++++++++++++++--------
 2 files changed, 73 insertions(+), 21 deletions(-)

diff --git a/docs/tools/qemu-img.rst b/docs/tools/qemu-img.rst
index 3653adb963..a21e439082 100644
--- a/docs/tools/qemu-img.rst
+++ b/docs/tools/qemu-img.rst
@@ -467,11 +467,11 @@ Command description:
   ``--skip-broken-bitmaps`` is also specified to copy only the
   consistent bitmaps.
 
-.. option:: create [--object OBJECTDEF] [-q] [-f FMT] [-b BACKING_FILE [-F BACKING_FMT]] [-u] [-o OPTIONS] FILENAME [SIZE]
+.. option:: create [-f FMT] [-o FMT_OPTS] [-b BACKING_FILE [-B BACKING_FMT]] [-u] [-q] [--object OBJDEF] FILE [SIZE]
 
-  Create the new disk image *FILENAME* of size *SIZE* and format
-  *FMT*. Depending on the file format, you can add one or more *OPTIONS*
-  that enable additional features of this format.
+  Create the new disk image *FILE* of size *SIZE* and format
+  *FMT*. Depending on the file format, you can add one or more *FMT_OPTS*
+  options that enable additional features of this format.
 
   If the option *BACKING_FILE* is specified, then the image will record
   only the differences from *BACKING_FILE*. No size needs to be specified in
@@ -479,7 +479,7 @@ Command description:
   ``commit`` monitor command (or ``qemu-img commit``).
 
   If a relative path name is given, the backing file is looked up relative to
-  the directory containing *FILENAME*.
+  the directory containing *FILE*.
 
   Note that a given backing file will be opened to check that it is valid. Use
   the ``-u`` option to enable unsafe backing file mode, which means that the
diff --git a/qemu-img.c b/qemu-img.c
index a414837355..6569efd310 100644
--- a/qemu-img.c
+++ b/qemu-img.c
@@ -132,6 +132,32 @@ void unrecognized_option(const char *option)
     error_exit("qemu-img", "unrecognized option '%s'", option);
 }
 
+/*
+ * Print --help output for a command and exit.
+ * @syntax and @description are multi-line with trailing EOL
+ * (to allow easy extending of the text)
+ * @syntax has each subsequent line indented by 8 chars.
+ * @description is indented by 2 chars for argument on each own line,
+ * and with 5 chars for argument description (like -h arg below).
+ */
+static G_NORETURN
+void cmd_help(const img_cmd_t *ccmd,
+              const char *syntax, const char *arguments)
+{
+    printf(
+"Usage:\n"
+"\n"
+"  %s %s %s"
+"\n"
+"Arguments:\n"
+"  -h, --help\n"
+"     print this help and exit\n"
+"%s\n",
+           "qemu-img", ccmd->name,
+           syntax, arguments);
+    exit(EXIT_SUCCESS);
+}
+
 /* Please keep in synch with docs/tools/qemu-img.rst */
 static G_NORETURN
 void help(void)
@@ -530,29 +556,46 @@ static int img_create(const img_cmd_t *ccmd, int argc, char **argv)
     for(;;) {
         static const struct option long_options[] = {
             {"help", no_argument, 0, 'h'},
+            {"format", required_argument, 0, 'f'},
+            {"options", required_argument, 0, 'o'},
+            {"backing", required_argument, 0, 'b'},
+            {"backing-format", required_argument, 0, 'B'}, /* was -F in 10.0 */
+            {"backing-unsafe", no_argument, 0, 'u'},
+            {"quiet", no_argument, 0, 'q'},
             {"object", required_argument, 0, OPTION_OBJECT},
             {0, 0, 0, 0}
         };
-        c = getopt_long(argc, argv, ":F:b:f:ho:qu",
+        c = getopt_long(argc, argv, "hf:o:b:F:B:uq",
                         long_options, NULL);
         if (c == -1) {
             break;
         }
         switch(c) {
-        case ':':
-            missing_argument(argv[optind - 1]);
-            break;
-        case '?':
-            unrecognized_option(argv[optind - 1]);
-            break;
         case 'h':
-            help();
-            break;
-        case 'F':
-            base_fmt = optarg;
-            break;
-        case 'b':
-            base_filename = optarg;
+            cmd_help(ccmd, "[-f FMT] [-o FMT_OPTS]\n"
+"        [-b BACKING_FILE [-B BACKING_FMT]] [-u]\n"
+"        [-q] [--object OBJDEF] FILE [SIZE]\n"
+,
+"  -f, --format FMT\n"
+"     specifies the format of the new image (default: raw)\n"
+"  -o, --options FMT_OPTS\n"
+"     format-specific options (specify '-o help' for help)\n"
+"  -b, --backing BACKING_FILE\n"
+"     create target image to be a CoW on top of BACKING_FILE\n"
+"  -B, --backing-format BACKING_FMT (was -F in <= 10.0)\n"
+"     specifies the format of BACKING_FILE (default: probing is used)\n"
+"  -u, --backing-unsafe\n"
+"     do not fail if BACKING_FILE can not be read\n"
+"  -q, --quiet\n"
+"     quiet mode (produce only error messages if any)\n"
+"  --object OBJDEF\n"
+"     defines QEMU user-creatable object\n"
+"  FILE\n"
+"     name of the image file to create (will be overritten if already exists)\n"
+"  SIZE[bKMGTPE]\n"
+"     image size with optional multiplier suffix (powers of 1024)\n"
+"     (required unless BACKING_FILE is specified)\n"
+);
             break;
         case 'f':
             fmt = optarg;
@@ -562,15 +605,24 @@ static int img_create(const img_cmd_t *ccmd, int argc, char **argv)
                 goto fail;
             }
             break;
-        case 'q':
-            quiet = true;
+        case 'b':
+            base_filename = optarg;
+            break;
+        case 'F': /* <=10.0 */
+        case 'B':
+            base_fmt = optarg;
             break;
         case 'u':
             flags |= BDRV_O_NO_BACKING;
             break;
+        case 'q':
+            quiet = true;
+            break;
         case OPTION_OBJECT:
             user_creatable_process_cmdline(optarg);
             break;
+        default:
+            tryhelp(argv[0]);
         }
     }
 

From a03cd2982d84c6901f3583e31ef12ac7fd170052 Mon Sep 17 00:00:00 2001
From: Michael Tokarev <mjt@tls.msk.ru>
Date: Sat, 31 May 2025 20:15:48 +0300
Subject: [PATCH 2464/2760] qemu-img: factor out parse_output_format() and use
 it in the code
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Use common code and simplify error message

Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20250531171609.197078-7-mjt@tls.msk.ru>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 qemu-img.c                       | 63 +++++++++-----------------------
 tests/qemu-iotests/178           |  2 +-
 tests/qemu-iotests/178.out.qcow2 |  3 +-
 tests/qemu-iotests/178.out.raw   |  3 +-
 tests/qemu-iotests/common.filter |  6 +++
 5 files changed, 29 insertions(+), 48 deletions(-)

diff --git a/qemu-img.c b/qemu-img.c
index 6569efd310..b60b4d38df 100644
--- a/qemu-img.c
+++ b/qemu-img.c
@@ -158,6 +158,17 @@ void cmd_help(const img_cmd_t *ccmd,
     exit(EXIT_SUCCESS);
 }
 
+static OutputFormat parse_output_format(const char *argv0, const char *arg)
+{
+    if (!strcmp(arg, "json")) {
+        return OFORMAT_JSON;
+    } else if (!strcmp(arg, "human")) {
+        return OFORMAT_HUMAN;
+    } else {
+        error_exit(argv0, "--output expects 'human' or 'json', not '%s'", arg);
+    }
+}
+
 /* Please keep in synch with docs/tools/qemu-img.rst */
 static G_NORETURN
 void help(void)
@@ -775,7 +786,7 @@ static int img_check(const img_cmd_t *ccmd, int argc, char **argv)
 {
     int c, ret;
     OutputFormat output_format = OFORMAT_HUMAN;
-    const char *filename, *fmt, *output, *cache;
+    const char *filename, *fmt, *cache;
     BlockBackend *blk;
     BlockDriverState *bs;
     int fix = 0;
@@ -787,7 +798,6 @@ static int img_check(const img_cmd_t *ccmd, int argc, char **argv)
     bool force_share = false;
 
     fmt = NULL;
-    output = NULL;
     cache = BDRV_DEFAULT_CACHE;
 
     for(;;) {
@@ -833,7 +843,7 @@ static int img_check(const img_cmd_t *ccmd, int argc, char **argv)
             }
             break;
         case OPTION_OUTPUT:
-            output = optarg;
+            output_format = parse_output_format(argv[0], optarg);
             break;
         case 'T':
             cache = optarg;
@@ -857,15 +867,6 @@ static int img_check(const img_cmd_t *ccmd, int argc, char **argv)
     }
     filename = argv[optind++];
 
-    if (output && !strcmp(output, "json")) {
-        output_format = OFORMAT_JSON;
-    } else if (output && !strcmp(output, "human")) {
-        output_format = OFORMAT_HUMAN;
-    } else if (output) {
-        error_report("--output must be used with human or json as argument.");
-        return 1;
-    }
-
     ret = bdrv_parse_cache_mode(cache, &flags, &writethrough);
     if (ret < 0) {
         error_report("Invalid source cache option: %s", cache);
@@ -3059,13 +3060,12 @@ static int img_info(const img_cmd_t *ccmd, int argc, char **argv)
     int c;
     OutputFormat output_format = OFORMAT_HUMAN;
     bool chain = false;
-    const char *filename, *fmt, *output;
+    const char *filename, *fmt;
     BlockGraphInfoList *list;
     bool image_opts = false;
     bool force_share = false;
 
     fmt = NULL;
-    output = NULL;
     for(;;) {
         int option_index = 0;
         static const struct option long_options[] = {
@@ -3100,7 +3100,7 @@ static int img_info(const img_cmd_t *ccmd, int argc, char **argv)
             force_share = true;
             break;
         case OPTION_OUTPUT:
-            output = optarg;
+            output_format = parse_output_format(argv[0], optarg);
             break;
         case OPTION_BACKING_CHAIN:
             chain = true;
@@ -3118,15 +3118,6 @@ static int img_info(const img_cmd_t *ccmd, int argc, char **argv)
     }
     filename = argv[optind++];
 
-    if (output && !strcmp(output, "json")) {
-        output_format = OFORMAT_JSON;
-    } else if (output && !strcmp(output, "human")) {
-        output_format = OFORMAT_HUMAN;
-    } else if (output) {
-        error_report("--output must be used with human or json as argument.");
-        return 1;
-    }
-
     list = collect_image_info_list(image_opts, filename, fmt, chain,
                                    force_share);
     if (!list) {
@@ -3285,7 +3276,7 @@ static int img_map(const img_cmd_t *ccmd, int argc, char **argv)
     OutputFormat output_format = OFORMAT_HUMAN;
     BlockBackend *blk;
     BlockDriverState *bs;
-    const char *filename, *fmt, *output;
+    const char *filename, *fmt;
     int64_t length;
     MapEntry curr = { .length = 0 }, next;
     int ret = 0;
@@ -3295,7 +3286,6 @@ static int img_map(const img_cmd_t *ccmd, int argc, char **argv)
     int64_t max_length = -1;
 
     fmt = NULL;
-    output = NULL;
     for (;;) {
         int option_index = 0;
         static const struct option long_options[] = {
@@ -3331,7 +3321,7 @@ static int img_map(const img_cmd_t *ccmd, int argc, char **argv)
             force_share = true;
             break;
         case OPTION_OUTPUT:
-            output = optarg;
+            output_format = parse_output_format(argv[0], optarg);
             break;
         case 's':
             start_offset = cvtnum("start offset", optarg);
@@ -3358,15 +3348,6 @@ static int img_map(const img_cmd_t *ccmd, int argc, char **argv)
     }
     filename = argv[optind];
 
-    if (output && !strcmp(output, "json")) {
-        output_format = OFORMAT_JSON;
-    } else if (output && !strcmp(output, "human")) {
-        output_format = OFORMAT_HUMAN;
-    } else if (output) {
-        error_report("--output must be used with human or json as argument.");
-        return 1;
-    }
-
     blk = img_open(image_opts, filename, fmt, 0, false, false, force_share);
     if (!blk) {
         return 1;
@@ -5473,15 +5454,7 @@ static int img_measure(const img_cmd_t *ccmd, int argc, char **argv)
             image_opts = true;
             break;
         case OPTION_OUTPUT:
-            if (!strcmp(optarg, "json")) {
-                output_format = OFORMAT_JSON;
-            } else if (!strcmp(optarg, "human")) {
-                output_format = OFORMAT_HUMAN;
-            } else {
-                error_report("--output must be used with human or json "
-                             "as argument.");
-                goto out;
-            }
+            output_format = parse_output_format(argv[0], optarg);
             break;
         case OPTION_SIZE:
             img_size = cvtnum("image size", optarg);
diff --git a/tests/qemu-iotests/178 b/tests/qemu-iotests/178
index 8df241ead8..463c59a77f 100755
--- a/tests/qemu-iotests/178
+++ b/tests/qemu-iotests/178
@@ -58,7 +58,7 @@ $QEMU_IMG measure -f qcow2 # missing filename
 $QEMU_IMG measure -l snap1 # missing filename
 $QEMU_IMG measure -o , # invalid option list
 $QEMU_IMG measure -l snapshot.foo=bar # invalid snapshot option
-$QEMU_IMG measure --output foo # invalid output format
+$QEMU_IMG measure --output foo 2>&1 | _filter_qemu_img # invalid output format
 $QEMU_IMG measure --size -1 # invalid image size
 $QEMU_IMG measure -O foo "$TEST_IMG" # unknown image file format
 
diff --git a/tests/qemu-iotests/178.out.qcow2 b/tests/qemu-iotests/178.out.qcow2
index fe193fd5f4..61506b519f 100644
--- a/tests/qemu-iotests/178.out.qcow2
+++ b/tests/qemu-iotests/178.out.qcow2
@@ -12,7 +12,8 @@ qemu-img: --image-opts, -f, and -l require a filename argument.
 qemu-img: Invalid option list: ,
 qemu-img: Invalid parameter 'snapshot.foo'
 qemu-img: Failed in parsing snapshot param 'snapshot.foo=bar'
-qemu-img: --output must be used with human or json as argument.
+qemu-img: --output expects 'human' or 'json', not 'foo'
+Try 'qemu-img measure --help' for more information
 qemu-img: Invalid image size specified. Must be between 0 and 9223372036854775807.
 qemu-img: Unknown file format 'foo'
 
diff --git a/tests/qemu-iotests/178.out.raw b/tests/qemu-iotests/178.out.raw
index 445e460fad..6d994a433a 100644
--- a/tests/qemu-iotests/178.out.raw
+++ b/tests/qemu-iotests/178.out.raw
@@ -12,7 +12,8 @@ qemu-img: --image-opts, -f, and -l require a filename argument.
 qemu-img: Invalid option list: ,
 qemu-img: Invalid parameter 'snapshot.foo'
 qemu-img: Failed in parsing snapshot param 'snapshot.foo=bar'
-qemu-img: --output must be used with human or json as argument.
+qemu-img: --output expects 'human' or 'json', not 'foo'
+Try 'qemu-img measure --help' for more information
 qemu-img: Invalid image size specified. Must be between 0 and 9223372036854775807.
 qemu-img: Unknown file format 'foo'
 
diff --git a/tests/qemu-iotests/common.filter b/tests/qemu-iotests/common.filter
index fc3c64bcb8..67f819d866 100644
--- a/tests/qemu-iotests/common.filter
+++ b/tests/qemu-iotests/common.filter
@@ -86,6 +86,12 @@ _filter_qemu()
         -e $'s#\r##' # QEMU monitor uses \r\n line endings
 }
 
+# replace occurrences of QEMU_IMG_PROG with "qemu-img"
+_filter_qemu_img()
+{
+    sed -e "s#$QEMU_IMG_PROG#qemu-img#g"
+}
+
 # replace problematic QMP output like timestamps
 _filter_qmp()
 {

From d1dcf1422440d9aa207d34e62e7a6b067b87f242 Mon Sep 17 00:00:00 2001
From: Michael Tokarev <mjt@tls.msk.ru>
Date: Sat, 31 May 2025 20:15:49 +0300
Subject: [PATCH 2465/2760] qemu-img: check: refresh options/--help

Add missing long options and --help output,
reorder options for consistency.

Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Message-ID: <20250531171609.197078-8-mjt@tls.msk.ru>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 qemu-img.c | 62 ++++++++++++++++++++++++++++++++++++------------------
 1 file changed, 42 insertions(+), 20 deletions(-)

diff --git a/qemu-img.c b/qemu-img.c
index b60b4d38df..d310f0de0d 100644
--- a/qemu-img.c
+++ b/qemu-img.c
@@ -805,31 +805,57 @@ static int img_check(const img_cmd_t *ccmd, int argc, char **argv)
         static const struct option long_options[] = {
             {"help", no_argument, 0, 'h'},
             {"format", required_argument, 0, 'f'},
-            {"repair", required_argument, 0, 'r'},
-            {"output", required_argument, 0, OPTION_OUTPUT},
-            {"object", required_argument, 0, OPTION_OBJECT},
             {"image-opts", no_argument, 0, OPTION_IMAGE_OPTS},
+            {"cache", required_argument, 0, 'T'},
+            {"repair", required_argument, 0, 'r'},
             {"force-share", no_argument, 0, 'U'},
+            {"output", required_argument, 0, OPTION_OUTPUT},
+            {"quiet", no_argument, 0, 'q'},
+            {"object", required_argument, 0, OPTION_OBJECT},
             {0, 0, 0, 0}
         };
-        c = getopt_long(argc, argv, ":hf:r:T:qU",
+        c = getopt_long(argc, argv, "hf:T:r:Uq",
                         long_options, &option_index);
         if (c == -1) {
             break;
         }
         switch(c) {
-        case ':':
-            missing_argument(argv[optind - 1]);
-            break;
-        case '?':
-            unrecognized_option(argv[optind - 1]);
-            break;
         case 'h':
-            help();
+            cmd_help(ccmd, "[-f FMT | --image-opts] [-T CACHE_MODE] [-r leaks|all]\n"
+"        [-U] [--output human|json] [-q] [--object OBJDEF] FILE\n"
+,
+"  -f, --format FMT\n"
+"     specifies the format of the image explicitly (default: probing is used)\n"
+"  --image-opts\n"
+"     treat FILE as an option string (key=value,..), not a file name\n"
+"     (incompatible with -f|--format)\n"
+"  -T, --cache CACHE_MODE\n" /* why not -t ? */
+"     cache mode (default: " BDRV_DEFAULT_CACHE ")\n"
+"  -r, --repair leaks|all\n"
+"     repair errors of the given category in the image (image will be\n"
+"     opened in read-write mode, incompatible with -U|--force-share)\n"
+"  -U, --force-share\n"
+"     open image in shared mode for concurrent access\n"
+"  --output human|json\n"
+"     output format (default: human)\n"
+"  -q, --quiet\n"
+"     quiet mode (produce only error messages if any)\n"
+"  --object OBJDEF\n"
+"     defines QEMU user-creatable object\n"
+"  FILE\n"
+"     name of the image file, or an option string (key=value,..)\n"
+"     with --image-opts, to operate on\n"
+);
             break;
         case 'f':
             fmt = optarg;
             break;
+        case OPTION_IMAGE_OPTS:
+            image_opts = true;
+            break;
+        case 'T':
+            cache = optarg;
+            break;
         case 'r':
             flags |= BDRV_O_RDWR;
 
@@ -842,24 +868,20 @@ static int img_check(const img_cmd_t *ccmd, int argc, char **argv)
                            "(expecting 'leaks' or 'all'): %s", optarg);
             }
             break;
+        case 'U':
+            force_share = true;
+            break;
         case OPTION_OUTPUT:
             output_format = parse_output_format(argv[0], optarg);
             break;
-        case 'T':
-            cache = optarg;
-            break;
         case 'q':
             quiet = true;
             break;
-        case 'U':
-            force_share = true;
-            break;
         case OPTION_OBJECT:
             user_creatable_process_cmdline(optarg);
             break;
-        case OPTION_IMAGE_OPTS:
-            image_opts = true;
-            break;
+        default:
+            tryhelp(argv[0]);
         }
     }
     if (optind != argc - 1) {

From bf1e1cd357b0dd395f880ac9a9cb436c0c304139 Mon Sep 17 00:00:00 2001
From: Michael Tokarev <mjt@tls.msk.ru>
Date: Sat, 31 May 2025 20:15:50 +0300
Subject: [PATCH 2466/2760] qemu-img: simplify --repair error message
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20250531171609.197078-9-mjt@tls.msk.ru>
[kwolf: Added missing comma in help text]
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 qemu-img.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/qemu-img.c b/qemu-img.c
index d310f0de0d..ec6802b03b 100644
--- a/qemu-img.c
+++ b/qemu-img.c
@@ -864,8 +864,9 @@ static int img_check(const img_cmd_t *ccmd, int argc, char **argv)
             } else if (!strcmp(optarg, "all")) {
                 fix = BDRV_FIX_LEAKS | BDRV_FIX_ERRORS;
             } else {
-                error_exit(argv[0], "Unknown option value for -r "
-                           "(expecting 'leaks' or 'all'): %s", optarg);
+                error_exit(argv[0],
+                           "--repair (-r) expects 'leaks' or 'all', not '%s'",
+                           optarg);
             }
             break;
         case 'U':

From a79d282fc9e1dfa887b13e079279277ea257162a Mon Sep 17 00:00:00 2001
From: Michael Tokarev <mjt@tls.msk.ru>
Date: Sat, 31 May 2025 20:15:51 +0300
Subject: [PATCH 2467/2760] qemu-img: commit: refresh options/--help

Add missing long options and --help output,
reorder options for consistency.

Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Message-ID: <20250531171609.197078-10-mjt@tls.msk.ru>
[kwolf: Fixed up qemu-iotests]
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 qemu-img.c                 | 70 ++++++++++++++++++++++++++------------
 tests/qemu-iotests/153     |  2 +-
 tests/qemu-iotests/153.out | 12 +++----
 3 files changed, 56 insertions(+), 28 deletions(-)

diff --git a/qemu-img.c b/qemu-img.c
index ec6802b03b..9d2eba3b36 100644
--- a/qemu-img.c
+++ b/qemu-img.c
@@ -1047,57 +1047,85 @@ static int img_commit(const img_cmd_t *ccmd, int argc, char **argv)
     for(;;) {
         static const struct option long_options[] = {
             {"help", no_argument, 0, 'h'},
-            {"object", required_argument, 0, OPTION_OBJECT},
+            {"format", required_argument, 0, 'f'},
             {"image-opts", no_argument, 0, OPTION_IMAGE_OPTS},
+            {"cache", required_argument, 0, 't'},
+            {"drop", no_argument, 0, 'd'},
+            {"base", required_argument, 0, 'b'},
+            {"rate-limit", required_argument, 0, 'r'},
+            {"progress", no_argument, 0, 'p'},
+            {"quiet", no_argument, 0, 'q'},
+            {"object", required_argument, 0, OPTION_OBJECT},
             {0, 0, 0, 0}
         };
-        c = getopt_long(argc, argv, ":f:ht:b:dpqr:",
+        c = getopt_long(argc, argv, "hf:t:db:r:pq",
                         long_options, NULL);
         if (c == -1) {
             break;
         }
         switch(c) {
-        case ':':
-            missing_argument(argv[optind - 1]);
-            break;
-        case '?':
-            unrecognized_option(argv[optind - 1]);
-            break;
         case 'h':
-            help();
+            cmd_help(ccmd, "[-f FMT | --image-opts] [-t CACHE_MODE] [-b BASE_IMG]\n"
+"        [-d] [-r RATE] [-q] [--object OBJDEF] FILE\n"
+,
+"  -f, --format FMT\n"
+"     specify FILE image format explicitly (default: probing is used)\n"
+"  --image-opts\n"
+"     treat FILE as an option string (key=value,..), not a file name\n"
+"     (incompatible with -f|--format)\n"
+"  -t, --cache CACHE_MODE image cache mode (default: " BDRV_DEFAULT_CACHE ")\n"
+"  -d, --drop\n"
+"     skip emptying FILE on completion\n"
+"  -b, --base BASE_IMG\n"
+"     image in the backing chain to commit change to\n"
+"     (default: immediate backing file; implies --drop)\n"
+"  -r, --rate-limit RATE\n"
+"     I/O rate limit, in bytes per second\n"
+"  -p, --progress\n"
+"     display progress information\n"
+"  -q, --quiet\n"
+"     quiet mode (produce only error messages if any)\n"
+"  --object OBJDEF\n"
+"     defines QEMU user-creatable object\n"
+"  FILE\n"
+"     name of the image file, or an option string (key=value,..)\n"
+"     with --image-opts, to operate on\n"
+);
             break;
         case 'f':
             fmt = optarg;
             break;
+        case OPTION_IMAGE_OPTS:
+            image_opts = true;
+            break;
         case 't':
             cache = optarg;
             break;
+        case 'd':
+            drop = true;
+            break;
         case 'b':
             base = optarg;
             /* -b implies -d */
             drop = true;
             break;
-        case 'd':
-            drop = true;
-            break;
-        case 'p':
-            progress = true;
-            break;
-        case 'q':
-            quiet = true;
-            break;
         case 'r':
             rate_limit = cvtnum("rate limit", optarg);
             if (rate_limit < 0) {
                 return 1;
             }
             break;
+        case 'p':
+            progress = true;
+            break;
+        case 'q':
+            quiet = true;
+            break;
         case OPTION_OBJECT:
             user_creatable_process_cmdline(optarg);
             break;
-        case OPTION_IMAGE_OPTS:
-            image_opts = true;
-            break;
+        default:
+            tryhelp(argv[0]);
         }
     }
 
diff --git a/tests/qemu-iotests/153 b/tests/qemu-iotests/153
index 9bc3be8f75..1e02f6a6e3 100755
--- a/tests/qemu-iotests/153
+++ b/tests/qemu-iotests/153
@@ -63,7 +63,7 @@ _supported_proto file
 _run_cmd()
 {
     echo
-    (echo "$@"; "$@" 2>&1 1>/dev/null) | _filter_testdir
+    (echo "$@"; "$@" 2>&1 1>/dev/null) | _filter_testdir | _filter_qemu_img
 }
 
 _do_run_qemu()
diff --git a/tests/qemu-iotests/153.out b/tests/qemu-iotests/153.out
index ff8e55864a..a8ffd01266 100644
--- a/tests/qemu-iotests/153.out
+++ b/tests/qemu-iotests/153.out
@@ -124,8 +124,8 @@ qemu-img: unrecognized option '-U'
 Try 'qemu-img --help' for more information
 
 _qemu_img_wrapper commit -U TEST_DIR/t.qcow2
-qemu-img: unrecognized option '-U'
-Try 'qemu-img --help' for more information
+qemu-img commit: invalid option -- 'U'
+Try 'qemu-img commit --help' for more information
 
 _qemu_img_wrapper resize -U TEST_DIR/t.qcow2 32M
 qemu-img: unrecognized option '-U'
@@ -248,8 +248,8 @@ qemu-img: unrecognized option '-U'
 Try 'qemu-img --help' for more information
 
 _qemu_img_wrapper commit -U TEST_DIR/t.qcow2
-qemu-img: unrecognized option '-U'
-Try 'qemu-img --help' for more information
+qemu-img commit: invalid option -- 'U'
+Try 'qemu-img commit --help' for more information
 
 _qemu_img_wrapper resize -U TEST_DIR/t.qcow2 32M
 qemu-img: unrecognized option '-U'
@@ -353,8 +353,8 @@ qemu-img: unrecognized option '-U'
 Try 'qemu-img --help' for more information
 
 _qemu_img_wrapper commit -U TEST_DIR/t.qcow2
-qemu-img: unrecognized option '-U'
-Try 'qemu-img --help' for more information
+qemu-img commit: invalid option -- 'U'
+Try 'qemu-img commit --help' for more information
 
 _qemu_img_wrapper resize -U TEST_DIR/t.qcow2 32M
 qemu-img: unrecognized option '-U'

From eedfb5c07e270eca9bfe1f8f16303b23447f8176 Mon Sep 17 00:00:00 2001
From: Michael Tokarev <mjt@tls.msk.ru>
Date: Sat, 31 May 2025 20:15:52 +0300
Subject: [PATCH 2468/2760] qemu-img: compare: use helper function for --object

Use the same function to parse --object as used by all
other qemu-img subcommands.

Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Message-ID: <20250531171609.197078-11-mjt@tls.msk.ru>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 qemu-img.c | 16 ++--------------
 1 file changed, 2 insertions(+), 14 deletions(-)

diff --git a/qemu-img.c b/qemu-img.c
index 9d2eba3b36..a7a07ed4bc 100644
--- a/qemu-img.c
+++ b/qemu-img.c
@@ -1529,20 +1529,8 @@ static int img_compare(const img_cmd_t *ccmd, int argc, char **argv)
             force_share = true;
             break;
         case OPTION_OBJECT:
-            {
-                Error *local_err = NULL;
-
-                if (!user_creatable_add_from_str(optarg, &local_err)) {
-                    if (local_err) {
-                        error_report_err(local_err);
-                        exit(2);
-                    } else {
-                        /* Help was printed */
-                        exit(EXIT_SUCCESS);
-                    }
-                }
-                break;
-            }
+            user_creatable_process_cmdline(optarg);
+            break;
         case OPTION_IMAGE_OPTS:
             image_opts = true;
             break;

From 3c8296dfcfe0f43cd5b2d07703f795748200962b Mon Sep 17 00:00:00 2001
From: Michael Tokarev <mjt@tls.msk.ru>
Date: Sat, 31 May 2025 20:15:53 +0300
Subject: [PATCH 2469/2760] qemu-img: compare: refresh options/--help

Add long options, add help, reorder options for consistency.

Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Message-ID: <20250531171609.197078-12-mjt@tls.msk.ru>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 qemu-img.c | 64 +++++++++++++++++++++++++++++++++++++++---------------
 1 file changed, 46 insertions(+), 18 deletions(-)

diff --git a/qemu-img.c b/qemu-img.c
index a7a07ed4bc..5697e45ae6 100644
--- a/qemu-img.c
+++ b/qemu-img.c
@@ -1487,25 +1487,51 @@ static int img_compare(const img_cmd_t *ccmd, int argc, char **argv)
     for (;;) {
         static const struct option long_options[] = {
             {"help", no_argument, 0, 'h'},
-            {"object", required_argument, 0, OPTION_OBJECT},
+            {"a-format", required_argument, 0, 'f'},
+            {"b-format", required_argument, 0, 'F'},
             {"image-opts", no_argument, 0, OPTION_IMAGE_OPTS},
+            {"strict", no_argument, 0, 's'},
+            {"cache", required_argument, 0, 'T'},
             {"force-share", no_argument, 0, 'U'},
+            {"progress", no_argument, 0, 'p'},
+            {"quiet", no_argument, 0, 'q'},
+            {"object", required_argument, 0, OPTION_OBJECT},
             {0, 0, 0, 0}
         };
-        c = getopt_long(argc, argv, ":hf:F:T:pqsU",
+        c = getopt_long(argc, argv, "hf:F:sT:Upq",
                         long_options, NULL);
         if (c == -1) {
             break;
         }
         switch (c) {
-        case ':':
-            missing_argument(argv[optind - 1]);
-            break;
-        case '?':
-            unrecognized_option(argv[optind - 1]);
-            break;
         case 'h':
-            help();
+            cmd_help(ccmd,
+"[[-f FMT] [-F FMT] | --image-opts] [-s] [-T CACHE]\n"
+"        [-U] [-p] [-q] [--object OBJDEF] FILE1 FILE2\n"
+,
+"  -f, --a-format FMT\n"
+"     specify FILE1 image format explicitly (default: probing is used)\n"
+"  -F, --b-format FMT\n"
+"     specify FILE2 image format explicitly (default: probing is used)\n"
+"  --image-opts\n"
+"     treat FILE1 and FILE2 as option strings (key=value,..), not file names\n"
+"     (incompatible with -f|--a-format and -F|--b-format)\n"
+"  -s, --strict\n"
+"     strict mode, also check if sizes are equal\n"
+"  -T, --cache CACHE_MODE\n"
+"     images caching mode (default: " BDRV_DEFAULT_CACHE ")\n"
+"  -U, --force-share\n"
+"     open images in shared mode for concurrent access\n"
+"  -p, --progress\n"
+"     display progress information\n"
+"  -q, --quiet\n"
+"     quiet mode (produce only error messages if any)\n"
+"  --object OBJDEF\n"
+"     defines QEMU user-creatable object\n"
+"  FILE1, FILE2\n"
+"     names of the image files, or option strings (key=value,..)\n"
+"     with --image-opts, to compare\n"
+);
             break;
         case 'f':
             fmt1 = optarg;
@@ -1513,27 +1539,29 @@ static int img_compare(const img_cmd_t *ccmd, int argc, char **argv)
         case 'F':
             fmt2 = optarg;
             break;
+        case OPTION_IMAGE_OPTS:
+            image_opts = true;
+            break;
+        case 's':
+            strict = true;
+            break;
         case 'T':
             cache = optarg;
             break;
+        case 'U':
+            force_share = true;
+            break;
         case 'p':
             progress = true;
             break;
         case 'q':
             quiet = true;
             break;
-        case 's':
-            strict = true;
-            break;
-        case 'U':
-            force_share = true;
-            break;
         case OPTION_OBJECT:
             user_creatable_process_cmdline(optarg);
             break;
-        case OPTION_IMAGE_OPTS:
-            image_opts = true;
-            break;
+        default:
+            tryhelp(argv[0]);
         }
     }
 

From c02276223ff312dd20d6535e243a94192342b170 Mon Sep 17 00:00:00 2001
From: Michael Tokarev <mjt@tls.msk.ru>
Date: Tue, 15 Jul 2025 17:07:02 +0300
Subject: [PATCH 2470/2760] qemu-img: convert: refresh options/--help (short
 option change)

Add missing long options and --help output.

Reorder options for consistency.

Use -b for --backing, and recognize -B for backwards
compatibility.  Unfortunately we can't use -B to
specify backing format.

Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Message-ID: <20250715140702.131321-1-mjt@tls.msk.ru>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 docs/tools/qemu-img.rst |   2 +-
 qemu-img.c              | 234 +++++++++++++++++++++++++++-------------
 2 files changed, 161 insertions(+), 75 deletions(-)

diff --git a/docs/tools/qemu-img.rst b/docs/tools/qemu-img.rst
index a21e439082..23715811e2 100644
--- a/docs/tools/qemu-img.rst
+++ b/docs/tools/qemu-img.rst
@@ -419,7 +419,7 @@ Command description:
   4
     Error on reading data
 
-.. option:: convert [--object OBJECTDEF] [--image-opts] [--target-image-opts] [--target-is-zero] [--bitmaps [--skip-broken-bitmaps]] [-U] [-C] [-c] [-p] [-q] [-n] [-f FMT] [-t CACHE] [-T SRC_CACHE] [-O OUTPUT_FMT] [-B BACKING_FILE [-F BACKING_FMT]] [-o OPTIONS] [-l SNAPSHOT_PARAM] [-S SPARSE_SIZE] [-r RATE_LIMIT] [-m NUM_COROUTINES] [-W] FILENAME [FILENAME2 [...]] OUTPUT_FILENAME
+.. option:: convert [--object OBJECTDEF] [--image-opts] [--target-image-opts] [--target-is-zero] [--bitmaps [--skip-broken-bitmaps]] [-U] [-C] [-c] [-p] [-q] [-n] [-f FMT] [-t CACHE] [-T SRC_CACHE] [-O OUTPUT_FMT] [-b BACKING_FILE [-F BACKING_FMT]] [-o OPTIONS] [-l SNAPSHOT_PARAM] [-S SPARSE_SIZE] [-r RATE_LIMIT] [-m NUM_COROUTINES] [-W] FILENAME [FILENAME2 [...]] OUTPUT_FILENAME
 
   Convert the disk image *FILENAME* or a snapshot *SNAPSHOT_PARAM*
   to disk image *OUTPUT_FILENAME* using format *OUTPUT_FMT*. It can
diff --git a/qemu-img.c b/qemu-img.c
index 5697e45ae6..950f319a97 100644
--- a/qemu-img.c
+++ b/qemu-img.c
@@ -2390,53 +2390,122 @@ static int img_convert(const img_cmd_t *ccmd, int argc, char **argv)
     for(;;) {
         static const struct option long_options[] = {
             {"help", no_argument, 0, 'h'},
-            {"object", required_argument, 0, OPTION_OBJECT},
+            {"source-format", required_argument, 0, 'f'},
+            /*
+             * XXX: historic --image-opts acts on source file only,
+             * it seems better to have it affect both source and target,
+             * and have separate --source-image-opts for source,
+             * but this might break existing setups.
+             */
             {"image-opts", no_argument, 0, OPTION_IMAGE_OPTS},
-            {"force-share", no_argument, 0, 'U'},
-            {"target-image-opts", no_argument, 0, OPTION_TARGET_IMAGE_OPTS},
-            {"salvage", no_argument, 0, OPTION_SALVAGE},
-            {"target-is-zero", no_argument, 0, OPTION_TARGET_IS_ZERO},
+            {"source-cache", required_argument, 0, 'T'},
+            {"snapshot", required_argument, 0, 'l'},
             {"bitmaps", no_argument, 0, OPTION_BITMAPS},
             {"skip-broken-bitmaps", no_argument, 0, OPTION_SKIP_BROKEN},
+            {"salvage", no_argument, 0, OPTION_SALVAGE},
+            {"target-format", required_argument, 0, 'O'},
+            {"target-image-opts", no_argument, 0, OPTION_TARGET_IMAGE_OPTS},
+            {"target-format-options", required_argument, 0, 'o'},
+            {"target-cache", required_argument, 0, 't'},
+            {"backing", required_argument, 0, 'b'},
+            {"backing-format", required_argument, 0, 'F'},
+            {"sparse-size", required_argument, 0, 'S'},
+            {"no-create", no_argument, 0, 'n'},
+            {"target-is-zero", no_argument, 0, OPTION_TARGET_IS_ZERO},
+            {"force-share", no_argument, 0, 'U'},
+            {"rate-limit", required_argument, 0, 'r'},
+            {"parallel", required_argument, 0, 'm'},
+            {"oob-writes", no_argument, 0, 'W'},
+            {"copy-range-offloading", no_argument, 0, 'C'},
+            {"progress", no_argument, 0, 'p'},
+            {"quiet", no_argument, 0, 'q'},
+            {"object", required_argument, 0, OPTION_OBJECT},
             {0, 0, 0, 0}
         };
-        c = getopt_long(argc, argv, ":hf:O:B:CcF:o:l:S:pt:T:qnm:WUr:",
+        c = getopt_long(argc, argv, "hf:O:b:B:CcF:o:l:S:pt:T:nm:WUr:q",
                         long_options, NULL);
         if (c == -1) {
             break;
         }
-        switch(c) {
-        case ':':
-            missing_argument(argv[optind - 1]);
-            break;
-        case '?':
-            unrecognized_option(argv[optind - 1]);
-            break;
+        switch (c) {
         case 'h':
-            help();
+            cmd_help(ccmd, "[-f SRC_FMT | --image-opts] [-T SRC_CACHE]\n"
+"        [-l SNAPSHOT] [--bitmaps [--skip-broken-bitmaps]] [--salvage]\n"
+"        [-O TGT_FMT | --target-image-opts] [-o TGT_FMT_OPTS] [-t TGT_CACHE]\n"
+"        [-b BACKING_FILE [-F BACKING_FMT]] [-S SPARSE_SIZE]\n"
+"        [-n] [--target-is-zero] [-c]\n"
+"        [-U] [-r RATE] [-m NUM_PARALLEL] [-W] [-C] [-p] [-q] [--object OBJDEF]\n"
+"        SRC_FILE [SRC_FILE2...] TGT_FILE\n"
+,
+"  -f, --source-format SRC_FMT\n"
+"     specify format of all SRC_FILEs explicitly (default: probing is used)\n"
+"  --image-opts\n"
+"     treat each SRC_FILE as an option string (key=value,...), not a file name\n"
+"     (incompatible with -f|--source-format)\n"
+"  -T, --source-cache SRC_CACHE\n"
+"     source image(s) cache mode (" BDRV_DEFAULT_CACHE ")\n"
+"  -l, --snapshot SNAPSHOT\n"
+"     specify source snapshot\n"
+"  --bitmaps\n"
+"     also copy any persistent bitmaps present in source\n"
+"  --skip-broken-bitmaps\n"
+"     skip (do not error out) any broken bitmaps\n"
+"  --salvage\n"
+"     ignore errors on input (convert unreadable areas to zeros)\n"
+"  -O, --target-format TGT_FMT\n"
+"     specify TGT_FILE image format (default: raw)\n"
+"  --target-image-opts\n"
+"     treat TGT_FILE as an option string (key=value,...), not a file name\n"
+"     (incompatible with -O|--target-format)\n"
+"  -o, --target-format-options TGT_FMT_OPTS\n"
+"     TGT_FMT-specific options\n"
+"  -t, --target-cache TGT_CACHE\n"
+"     cache mode when opening output image (default: unsafe)\n"
+"  -b, --backing BACKING_FILE (was -B in <= 10.0)\n"
+"     create target image to be a CoW on top of BACKING_FILE\n"
+"  -F, --backing-format BACKING_FMT\n" /* -B used for -b in <=10.0 */
+"     specify BACKING_FILE image format explicitly (default: probing is used)\n"
+"  -S, --sparse-size SPARSE_SIZE[bkKMGTPE]\n"
+"     specify number of consecutive zero bytes to treat as a gap on output\n"
+"     (rounded down to nearest 512 bytes), with optional multiplier suffix\n"
+"  -n, --no-create\n"
+"     omit target volume creation (e.g. on rbd)\n"
+"  --target-is-zero\n"
+"     indicates that the target volume is pre-zeroed\n"
+"  -c, --compress\n"
+"     create compressed output image (qcow and qcow2 formats only)\n"
+"  -U, --force-share\n"
+"     open images in shared mode for concurrent access\n"
+"  -r, --rate-limit RATE\n"
+"     I/O rate limit, in bytes per second\n"
+"  -m, --parallel NUM_PARALLEL\n"
+"     specify parallelism (default: 8)\n"
+"  -C, --copy-range-offloading\n"
+"     try to use copy offloading\n"
+"  -W, --oob-writes\n"
+"     enable out-of-order writes to improve performance\n"
+"  -p, --progress\n"
+"     display progress information\n"
+"  -q, --quiet\n"
+"     quiet mode (produce only error messages if any)\n"
+"  --object OBJDEF\n"
+"     defines QEMU user-creatable object\n"
+"  SRC_FILE...\n"
+"     one or more source image file names,\n"
+"     or option strings (key=value,..) with --source-image-opts\n"
+"  TGT_FILE\n"
+"     target (output) image file name,\n"
+"     or option string (key=value,..) with --target-image-opts\n"
+);
             break;
         case 'f':
             fmt = optarg;
             break;
-        case 'O':
-            out_fmt = optarg;
+        case OPTION_IMAGE_OPTS:
+            image_opts = true;
             break;
-        case 'B':
-            out_baseimg = optarg;
-            break;
-        case 'C':
-            s.copy_range = true;
-            break;
-        case 'c':
-            s.compressed = true;
-            break;
-        case 'F':
-            backing_fmt = optarg;
-            break;
-        case 'o':
-            if (accumulate_options(&options, optarg) < 0) {
-                goto fail_getopt;
-            }
+        case 'T':
+            src_cache = optarg;
             break;
         case 'l':
             if (strstart(optarg, SNAPSHOT_OPT_BASE, NULL)) {
@@ -2451,6 +2520,36 @@ static int img_convert(const img_cmd_t *ccmd, int argc, char **argv)
                 snapshot_name = optarg;
             }
             break;
+        case OPTION_BITMAPS:
+            bitmaps = true;
+            break;
+        case OPTION_SKIP_BROKEN:
+            skip_broken = true;
+            break;
+        case OPTION_SALVAGE:
+            s.salvage = true;
+            break;
+         case 'O':
+            out_fmt = optarg;
+            break;
+        case OPTION_TARGET_IMAGE_OPTS:
+            tgt_image_opts = true;
+            break;
+        case 'o':
+            if (accumulate_options(&options, optarg) < 0) {
+                goto fail_getopt;
+            }
+            break;
+        case 't':
+            cache = optarg;
+            break;
+        case 'B': /* <=10.0 */
+        case 'b':
+            out_baseimg = optarg;
+            break;
+        case 'F': /* can't use -B as it used as -b in <=10.0 */
+            backing_fmt = optarg;
+            break;
         case 'S':
         {
             int64_t sval;
@@ -2471,21 +2570,29 @@ static int img_convert(const img_cmd_t *ccmd, int argc, char **argv)
             explict_min_sparse = true;
             break;
         }
-        case 'p':
-            progress = true;
-            break;
-        case 't':
-            cache = optarg;
-            break;
-        case 'T':
-            src_cache = optarg;
-            break;
-        case 'q':
-            s.quiet = true;
-            break;
         case 'n':
             skip_create = true;
             break;
+        case OPTION_TARGET_IS_ZERO:
+            /*
+             * The user asserting that the target is blank has the
+             * same effect as the target driver supporting zero
+             * initialisation.
+             */
+            s.has_zero_init = true;
+            break;
+        case 'c':
+            s.compressed = true;
+            break;
+        case 'U':
+            force_share = true;
+            break;
+        case 'r':
+            rate_limit = cvtnum("rate limit", optarg);
+            if (rate_limit < 0) {
+                goto fail_getopt;
+            }
+            break;
         case 'm':
             if (qemu_strtol(optarg, NULL, 0, &s.num_coroutines) ||
                 s.num_coroutines < 1 || s.num_coroutines > MAX_COROUTINES) {
@@ -2497,41 +2604,20 @@ static int img_convert(const img_cmd_t *ccmd, int argc, char **argv)
         case 'W':
             s.wr_in_order = false;
             break;
-        case 'U':
-            force_share = true;
+        case 'C':
+            s.copy_range = true;
             break;
-        case 'r':
-            rate_limit = cvtnum("rate limit", optarg);
-            if (rate_limit < 0) {
-                goto fail_getopt;
-            }
+        case 'p':
+            progress = true;
+            break;
+        case 'q':
+            s.quiet = true;
             break;
         case OPTION_OBJECT:
             user_creatable_process_cmdline(optarg);
             break;
-        case OPTION_IMAGE_OPTS:
-            image_opts = true;
-            break;
-        case OPTION_SALVAGE:
-            s.salvage = true;
-            break;
-        case OPTION_TARGET_IMAGE_OPTS:
-            tgt_image_opts = true;
-            break;
-        case OPTION_TARGET_IS_ZERO:
-            /*
-             * The user asserting that the target is blank has the
-             * same effect as the target driver supporting zero
-             * initialisation.
-             */
-            s.has_zero_init = true;
-            break;
-        case OPTION_BITMAPS:
-            bitmaps = true;
-            break;
-        case OPTION_SKIP_BROKEN:
-            skip_broken = true;
-            break;
+        default:
+            tryhelp(argv[0]);
         }
     }
 

From 403197d2f0edb28c8dff03ee7e7d478c99992a1c Mon Sep 17 00:00:00 2001
From: Michael Tokarev <mjt@tls.msk.ru>
Date: Sat, 31 May 2025 20:15:55 +0300
Subject: [PATCH 2471/2760] qemu-img: info: refresh options/--help

Add missing long options and --help output.
Also add -b short option for --backing-chain, and remove
now-unused OPTION_BACKING_CHAIN.

Reorder options for consistency.

While at it, remove unused option_index variable.

Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Message-ID: <20250531171609.197078-14-mjt@tls.msk.ru>
[kwolf: Fixed up help text formatting]
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 qemu-img.c | 51 ++++++++++++++++++++++++++++++++-------------------
 1 file changed, 32 insertions(+), 19 deletions(-)

diff --git a/qemu-img.c b/qemu-img.c
index 950f319a97..530123bfdf 100644
--- a/qemu-img.c
+++ b/qemu-img.c
@@ -3220,50 +3220,63 @@ static int img_info(const img_cmd_t *ccmd, int argc, char **argv)
 
     fmt = NULL;
     for(;;) {
-        int option_index = 0;
         static const struct option long_options[] = {
             {"help", no_argument, 0, 'h'},
             {"format", required_argument, 0, 'f'},
-            {"output", required_argument, 0, OPTION_OUTPUT},
-            {"backing-chain", no_argument, 0, OPTION_BACKING_CHAIN},
-            {"object", required_argument, 0, OPTION_OBJECT},
             {"image-opts", no_argument, 0, OPTION_IMAGE_OPTS},
+            {"backing-chain", no_argument, 0, OPTION_BACKING_CHAIN},
             {"force-share", no_argument, 0, 'U'},
+            {"output", required_argument, 0, OPTION_OUTPUT},
+            {"object", required_argument, 0, OPTION_OBJECT},
             {0, 0, 0, 0}
         };
-        c = getopt_long(argc, argv, ":f:hU",
-                        long_options, &option_index);
+        c = getopt_long(argc, argv, "hf:U", long_options, NULL);
         if (c == -1) {
             break;
         }
         switch(c) {
-        case ':':
-            missing_argument(argv[optind - 1]);
-            break;
-        case '?':
-            unrecognized_option(argv[optind - 1]);
-            break;
         case 'h':
-            help();
+            cmd_help(ccmd, "[-f FMT | --image-opts] [--backing-chain] [-U]\n"
+"        [--output human|json] [--object OBJDEF] FILE\n"
+,
+"  -f, --format FMT\n"
+"     specify FILE image format explicitly (default: probing is used)\n"
+"  --image-opts\n"
+"     treat FILE as an option string (key=value,..), not a file name\n"
+"     (incompatible with -f|--format)\n"
+"  --backing-chain\n"
+"     display information about the backing chain for copy-on-write overlays\n"
+"  -U, --force-share\n"
+"     open image in shared mode for concurrent access\n"
+"  --output human|json\n"
+"     specify output format (default: human)\n"
+"  --object OBJDEF\n"
+"     defines QEMU user-creatable object\n"
+"  FILE\n"
+"     name of the image file, or option string (key=value,..)\n"
+"     with --image-opts, to operate on\n"
+);
             break;
         case 'f':
             fmt = optarg;
             break;
+        case OPTION_IMAGE_OPTS:
+            image_opts = true;
+            break;
+        case OPTION_BACKING_CHAIN:
+            chain = true;
+            break;
         case 'U':
             force_share = true;
             break;
         case OPTION_OUTPUT:
             output_format = parse_output_format(argv[0], optarg);
             break;
-        case OPTION_BACKING_CHAIN:
-            chain = true;
-            break;
         case OPTION_OBJECT:
             user_creatable_process_cmdline(optarg);
             break;
-        case OPTION_IMAGE_OPTS:
-            image_opts = true;
-            break;
+        default:
+            tryhelp(argv[0]);
         }
     }
     if (optind != argc - 1) {

From fed0efefc24144ffacbd3452819909e83e14f595 Mon Sep 17 00:00:00 2001
From: Michael Tokarev <mjt@tls.msk.ru>
Date: Tue, 15 Jul 2025 17:09:03 +0300
Subject: [PATCH 2472/2760] qemu-img: map: refresh options/--help

Add missing long options and --help output,
reorder options for consistency.

While at it, remove unused option_index variable.

Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Message-ID: <20250715140903.131529-1-mjt@tls.msk.ru>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 qemu-img.c | 59 +++++++++++++++++++++++++++++++++++-------------------
 1 file changed, 38 insertions(+), 21 deletions(-)

diff --git a/qemu-img.c b/qemu-img.c
index 530123bfdf..a02ccad943 100644
--- a/qemu-img.c
+++ b/qemu-img.c
@@ -3453,41 +3453,53 @@ static int img_map(const img_cmd_t *ccmd, int argc, char **argv)
 
     fmt = NULL;
     for (;;) {
-        int option_index = 0;
         static const struct option long_options[] = {
             {"help", no_argument, 0, 'h'},
             {"format", required_argument, 0, 'f'},
-            {"output", required_argument, 0, OPTION_OUTPUT},
-            {"object", required_argument, 0, OPTION_OBJECT},
             {"image-opts", no_argument, 0, OPTION_IMAGE_OPTS},
-            {"force-share", no_argument, 0, 'U'},
             {"start-offset", required_argument, 0, 's'},
             {"max-length", required_argument, 0, 'l'},
+            {"force-share", no_argument, 0, 'U'},
+            {"output", required_argument, 0, OPTION_OUTPUT},
+            {"object", required_argument, 0, OPTION_OBJECT},
             {0, 0, 0, 0}
         };
-        c = getopt_long(argc, argv, ":f:s:l:hU",
-                        long_options, &option_index);
+        c = getopt_long(argc, argv, "hf:s:l:U",
+                        long_options, NULL);
         if (c == -1) {
             break;
         }
         switch (c) {
-        case ':':
-            missing_argument(argv[optind - 1]);
-            break;
-        case '?':
-            unrecognized_option(argv[optind - 1]);
-            break;
         case 'h':
-            help();
+            cmd_help(ccmd, "[-f FMT | --image-opts]\n"
+"        [--start-offset OFFSET] [--max-length LENGTH]\n"
+"        [--output human|json] [-U] [--object OBJDEF] FILE\n"
+,
+"  -f, --format FMT\n"
+"     specify FILE image format explicitly (default: probing is used)\n"
+"  --image-opts\n"
+"     treat FILE as an option string (key=value,..), not a file name\n"
+"     (incompatible with -f|--format)\n"
+"  -s, --start-offset OFFSET\n"
+"     start at the given OFFSET in the image, not at the beginning\n"
+"  -l, --max-length LENGTH\n"
+"     process at most LENGTH bytes instead of up to the end of the image\n"
+"  --output human|json\n"
+"     specify output format name (default: human)\n"
+"  -U, --force-share\n"
+"     open image in shared mode for concurrent access\n"
+"  --object OBJDEF\n"
+"     defines QEMU user-creatable object\n"
+"  FILE\n"
+"     the image file name, or option string (key=value,..)\n"
+"     with --image-opts, to operate on\n"
+);
             break;
         case 'f':
             fmt = optarg;
             break;
-        case 'U':
-            force_share = true;
-            break;
-        case OPTION_OUTPUT:
-            output_format = parse_output_format(argv[0], optarg);
+        case OPTION_IMAGE_OPTS:
+            image_opts = true;
             break;
         case 's':
             start_offset = cvtnum("start offset", optarg);
@@ -3501,12 +3513,17 @@ static int img_map(const img_cmd_t *ccmd, int argc, char **argv)
                 return 1;
             }
             break;
+        case OPTION_OUTPUT:
+            output_format = parse_output_format(argv[0], optarg);
+            break;
+        case 'U':
+            force_share = true;
+            break;
         case OPTION_OBJECT:
             user_creatable_process_cmdline(optarg);
             break;
-        case OPTION_IMAGE_OPTS:
-            image_opts = true;
-            break;
+        default:
+            tryhelp(argv[0]);
         }
     }
     if (optind != argc - 1) {

From e19597bc552f2db08b5595682cc4de6ec259ade6 Mon Sep 17 00:00:00 2001
From: Michael Tokarev <mjt@tls.msk.ru>
Date: Sat, 31 May 2025 20:15:57 +0300
Subject: [PATCH 2473/2760] qemu-img: snapshot: allow specifying -f fmt
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

For consistency with other commands, and since it already
accepts --image-opts, allow specifying -f fmt too.

Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20250531171609.197078-16-mjt@tls.msk.ru>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 docs/tools/qemu-img.rst | 2 +-
 qemu-img-cmds.hx        | 4 ++--
 qemu-img.c              | 9 ++++++---
 3 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/docs/tools/qemu-img.rst b/docs/tools/qemu-img.rst
index 23715811e2..935f28bbc5 100644
--- a/docs/tools/qemu-img.rst
+++ b/docs/tools/qemu-img.rst
@@ -663,7 +663,7 @@ Command description:
   bitmap support, or 0 if bitmaps are supported but there is nothing
   to copy.
 
-.. option:: snapshot [--object OBJECTDEF] [--image-opts] [-U] [-q] [-l | -a SNAPSHOT | -c SNAPSHOT | -d SNAPSHOT] FILENAME
+.. option:: snapshot [--object OBJECTDEF] [-f FMT | --image-opts] [-U] [-q] [-l | -a SNAPSHOT | -c SNAPSHOT | -d SNAPSHOT] FILENAME
 
   List, apply, create or delete snapshots in image *FILENAME*.
 
diff --git a/qemu-img-cmds.hx b/qemu-img-cmds.hx
index c9dd70a892..2c5a8a28f9 100644
--- a/qemu-img-cmds.hx
+++ b/qemu-img-cmds.hx
@@ -84,9 +84,9 @@ SRST
 ERST
 
 DEF("snapshot", img_snapshot,
-    "snapshot [--object objectdef] [--image-opts] [-U] [-q] [-l | -a snapshot | -c snapshot | -d snapshot] filename")
+    "snapshot [--object objectdef] [-f fmt | --image-opts] [-U] [-q] [-l | -a snapshot | -c snapshot | -d snapshot] filename")
 SRST
-.. option:: snapshot [--object OBJECTDEF] [--image-opts] [-U] [-q] [-l | -a SNAPSHOT | -c SNAPSHOT | -d SNAPSHOT] FILENAME
+.. option:: snapshot [--object OBJECTDEF] [-f FMT | --image-opts] [-U] [-q] [-l | -a SNAPSHOT | -c SNAPSHOT | -d SNAPSHOT] FILENAME
 ERST
 
 DEF("rebase", img_rebase,
diff --git a/qemu-img.c b/qemu-img.c
index a02ccad943..49c61c8b54 100644
--- a/qemu-img.c
+++ b/qemu-img.c
@@ -3597,7 +3597,7 @@ static int img_snapshot(const img_cmd_t *ccmd, int argc, char **argv)
     BlockBackend *blk;
     BlockDriverState *bs;
     QEMUSnapshotInfo sn;
-    char *filename, *snapshot_name = NULL;
+    char *filename, *fmt = NULL, *snapshot_name = NULL;
     int c, ret = 0, bdrv_oflags;
     int action = 0;
     bool quiet = false;
@@ -3616,7 +3616,7 @@ static int img_snapshot(const img_cmd_t *ccmd, int argc, char **argv)
             {"force-share", no_argument, 0, 'U'},
             {0, 0, 0, 0}
         };
-        c = getopt_long(argc, argv, ":la:c:d:hqU",
+        c = getopt_long(argc, argv, ":la:c:d:f:hqU",
                         long_options, NULL);
         if (c == -1) {
             break;
@@ -3631,6 +3631,9 @@ static int img_snapshot(const img_cmd_t *ccmd, int argc, char **argv)
         case 'h':
             help();
             return 0;
+        case 'f':
+            fmt = optarg;
+            break;
         case 'l':
             if (action) {
                 error_exit(argv[0], "Cannot mix '-l', '-a', '-c', '-d'");
@@ -3684,7 +3687,7 @@ static int img_snapshot(const img_cmd_t *ccmd, int argc, char **argv)
     filename = argv[optind++];
 
     /* Open the image */
-    blk = img_open(image_opts, filename, NULL, bdrv_oflags, false, quiet,
+    blk = img_open(image_opts, filename, fmt, bdrv_oflags, false, quiet,
                    force_share);
     if (!blk) {
         return 1;

From 0473674b6f4797985ac1023ed469c6766b77a21d Mon Sep 17 00:00:00 2001
From: Michael Tokarev <mjt@tls.msk.ru>
Date: Sat, 31 May 2025 20:15:58 +0300
Subject: [PATCH 2474/2760] qemu-img: snapshot: make -l (list) the default,
 simplify option handling
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When no -l/-a/-c/-d specified, assume -l (list).

Use the same values for SNAPSHOT_LIST/etc constants as the
option chars (lacd), this makes it possible to simplify
option handling a lot, combining cases for 4 options into
one.

Also remove bdrv_oflags handling (only list can use RO mode).

Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20250531171609.197078-17-mjt@tls.msk.ru>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 docs/tools/qemu-img.rst |  2 +-
 qemu-img.c              | 52 ++++++++++++++---------------------------
 2 files changed, 19 insertions(+), 35 deletions(-)

diff --git a/docs/tools/qemu-img.rst b/docs/tools/qemu-img.rst
index 935f28bbc5..a346988292 100644
--- a/docs/tools/qemu-img.rst
+++ b/docs/tools/qemu-img.rst
@@ -256,7 +256,7 @@ Parameters to snapshot subcommand:
 
 .. option:: -l
 
-  Lists all snapshots in the given image
+  Lists all snapshots in the given image (default action)
 
 Command description:
 
diff --git a/qemu-img.c b/qemu-img.c
index 49c61c8b54..f117efe687 100644
--- a/qemu-img.c
+++ b/qemu-img.c
@@ -3587,10 +3587,11 @@ out:
     return ret < 0;
 }
 
-#define SNAPSHOT_LIST   1
-#define SNAPSHOT_CREATE 2
-#define SNAPSHOT_APPLY  3
-#define SNAPSHOT_DELETE 4
+/* the same as options */
+#define SNAPSHOT_LIST   'l'
+#define SNAPSHOT_CREATE 'c'
+#define SNAPSHOT_APPLY  'a'
+#define SNAPSHOT_DELETE 'd'
 
 static int img_snapshot(const img_cmd_t *ccmd, int argc, char **argv)
 {
@@ -3598,7 +3599,7 @@ static int img_snapshot(const img_cmd_t *ccmd, int argc, char **argv)
     BlockDriverState *bs;
     QEMUSnapshotInfo sn;
     char *filename, *fmt = NULL, *snapshot_name = NULL;
-    int c, ret = 0, bdrv_oflags;
+    int c, ret = 0;
     int action = 0;
     bool quiet = false;
     Error *err = NULL;
@@ -3606,7 +3607,6 @@ static int img_snapshot(const img_cmd_t *ccmd, int argc, char **argv)
     bool force_share = false;
     int64_t rt;
 
-    bdrv_oflags = BDRV_O_RDWR;
     /* Parse commandline parameters */
     for(;;) {
         static const struct option long_options[] = {
@@ -3634,36 +3634,15 @@ static int img_snapshot(const img_cmd_t *ccmd, int argc, char **argv)
         case 'f':
             fmt = optarg;
             break;
-        case 'l':
+        case SNAPSHOT_LIST:
+        case SNAPSHOT_APPLY:
+        case SNAPSHOT_CREATE:
+        case SNAPSHOT_DELETE:
             if (action) {
                 error_exit(argv[0], "Cannot mix '-l', '-a', '-c', '-d'");
                 return 0;
             }
-            action = SNAPSHOT_LIST;
-            bdrv_oflags &= ~BDRV_O_RDWR; /* no need for RW */
-            break;
-        case 'a':
-            if (action) {
-                error_exit(argv[0], "Cannot mix '-l', '-a', '-c', '-d'");
-                return 0;
-            }
-            action = SNAPSHOT_APPLY;
-            snapshot_name = optarg;
-            break;
-        case 'c':
-            if (action) {
-                error_exit(argv[0], "Cannot mix '-l', '-a', '-c', '-d'");
-                return 0;
-            }
-            action = SNAPSHOT_CREATE;
-            snapshot_name = optarg;
-            break;
-        case 'd':
-            if (action) {
-                error_exit(argv[0], "Cannot mix '-l', '-a', '-c', '-d'");
-                return 0;
-            }
-            action = SNAPSHOT_DELETE;
+            action = c;
             snapshot_name = optarg;
             break;
         case 'q':
@@ -3686,9 +3665,14 @@ static int img_snapshot(const img_cmd_t *ccmd, int argc, char **argv)
     }
     filename = argv[optind++];
 
+    if (!action) {
+        action = SNAPSHOT_LIST;
+    }
+
     /* Open the image */
-    blk = img_open(image_opts, filename, fmt, bdrv_oflags, false, quiet,
-                   force_share);
+    blk = img_open(image_opts, filename, fmt,
+                   action == SNAPSHOT_LIST ? 0 : BDRV_O_RDWR,
+                   false, quiet, force_share);
     if (!blk) {
         return 1;
     }

From 9fd7e6658cd42cc09905f0b950cd6e9acfc81354 Mon Sep 17 00:00:00 2001
From: Michael Tokarev <mjt@tls.msk.ru>
Date: Sat, 31 May 2025 20:15:59 +0300
Subject: [PATCH 2475/2760] qemu-img: snapshot: refresh options/--help

Add missing long options and --help output,
reorder options for consistency.

Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Message-ID: <20250531171609.197078-18-mjt@tls.msk.ru>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 qemu-img.c | 60 +++++++++++++++++++++++++++++++++++++++---------------
 1 file changed, 44 insertions(+), 16 deletions(-)

diff --git a/qemu-img.c b/qemu-img.c
index f117efe687..cc26ae9100 100644
--- a/qemu-img.c
+++ b/qemu-img.c
@@ -3611,29 +3611,58 @@ static int img_snapshot(const img_cmd_t *ccmd, int argc, char **argv)
     for(;;) {
         static const struct option long_options[] = {
             {"help", no_argument, 0, 'h'},
-            {"object", required_argument, 0, OPTION_OBJECT},
+            {"format", required_argument, 0, 'f'},
             {"image-opts", no_argument, 0, OPTION_IMAGE_OPTS},
+            {"list", no_argument, 0, SNAPSHOT_LIST},
+            {"apply", required_argument, 0, SNAPSHOT_APPLY},
+            {"create", required_argument, 0, SNAPSHOT_CREATE},
+            {"delete", required_argument, 0, SNAPSHOT_DELETE},
             {"force-share", no_argument, 0, 'U'},
+            {"quiet", no_argument, 0, 'q'},
+            {"object", required_argument, 0, OPTION_OBJECT},
             {0, 0, 0, 0}
         };
-        c = getopt_long(argc, argv, ":la:c:d:f:hqU",
+        c = getopt_long(argc, argv, "hf:la:c:d:Uq",
                         long_options, NULL);
         if (c == -1) {
             break;
         }
         switch(c) {
-        case ':':
-            missing_argument(argv[optind - 1]);
-            break;
-        case '?':
-            unrecognized_option(argv[optind - 1]);
-            break;
         case 'h':
-            help();
-            return 0;
+            cmd_help(ccmd, "[-f FMT | --image-opts] [-l | -a|-c|-d SNAPSHOT]\n"
+"        [-U] [-q] [--object OBJDEF] FILE\n"
+,
+"  -f, --format FMT\n"
+"     specify FILE format explicitly (default: probing is used)\n"
+"  --image-opts\n"
+"     treat FILE as an option string (key=value,..), not a file name\n"
+"     (incompatible with -f|--format)\n"
+"  -l, --list\n"
+"     list snapshots in FILE (default action if no -l|-c|-a|-d is given)\n"
+"  -c, --create SNAPSHOT\n"
+"     create named snapshot\n"
+"  -a, --apply SNAPSHOT\n"
+"     apply named snapshot to the base\n"
+"  -d, --delete SNAPSHOT\n"
+"     delete named snapshot\n"
+"  (only one of -l|-c|-a|-d can be specified)\n"
+"  -U, --force-share\n"
+"     open image in shared mode for concurrent access\n"
+"  -q, --quiet\n"
+"     quiet mode (produce only error messages if any)\n"
+"  --object OBJDEF\n"
+"     defines QEMU user-creatable object\n"
+"  FILE\n"
+"     name of the image file, or option string (key=value,..)\n"
+"     with --image-opts) to operate on\n"
+);
+            break;
         case 'f':
             fmt = optarg;
             break;
+        case OPTION_IMAGE_OPTS:
+            image_opts = true;
+            break;
         case SNAPSHOT_LIST:
         case SNAPSHOT_APPLY:
         case SNAPSHOT_CREATE:
@@ -3645,18 +3674,17 @@ static int img_snapshot(const img_cmd_t *ccmd, int argc, char **argv)
             action = c;
             snapshot_name = optarg;
             break;
-        case 'q':
-            quiet = true;
-            break;
         case 'U':
             force_share = true;
             break;
+        case 'q':
+            quiet = true;
+            break;
         case OPTION_OBJECT:
             user_creatable_process_cmdline(optarg);
             break;
-        case OPTION_IMAGE_OPTS:
-            image_opts = true;
-            break;
+        default:
+            tryhelp(argv[0]);
         }
     }
 

From c1563952521d4d5947b4279efe8dcc432791287e Mon Sep 17 00:00:00 2001
From: Michael Tokarev <mjt@tls.msk.ru>
Date: Sat, 31 May 2025 20:16:00 +0300
Subject: [PATCH 2476/2760] qemu-img: rebase: refresh options/--help (short
 option change)

Add missing long options and --help output,
reorder options for consistency.

Use -B for --backing-format, keep -F for
backwards compatibility.

Options added:
 --format, --cache - for the image in question
 --backing, --backing-format, --backing-cache, --backing-unsafe -
   for the new backing file
(was eg CACHE vs SRC_CACHE, which is unclear).

Probably should rename local variables.

Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Message-ID: <20250531171609.197078-19-mjt@tls.msk.ru>
[kwolf: Removed command description from the argument list]
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 docs/tools/qemu-img.rst |  2 +-
 qemu-img.c              | 87 +++++++++++++++++++++++++++++------------
 2 files changed, 63 insertions(+), 26 deletions(-)

diff --git a/docs/tools/qemu-img.rst b/docs/tools/qemu-img.rst
index a346988292..5e7b85079d 100644
--- a/docs/tools/qemu-img.rst
+++ b/docs/tools/qemu-img.rst
@@ -667,7 +667,7 @@ Command description:
 
   List, apply, create or delete snapshots in image *FILENAME*.
 
-.. option:: rebase [--object OBJECTDEF] [--image-opts] [-U] [-q] [-f FMT] [-t CACHE] [-T SRC_CACHE] [-p] [-u] [-c] -b BACKING_FILE [-F BACKING_FMT] FILENAME
+.. option:: rebase [--object OBJECTDEF] [--image-opts] [-U] [-q] [-f FMT] [-t CACHE] [-T SRC_CACHE] [-p] [-u] [-c] -b BACKING_FILE [-B BACKING_FMT] FILENAME
 
   Changes the backing file of an image. Only the formats ``qcow2`` and
   ``qed`` support changing the backing file.
diff --git a/qemu-img.c b/qemu-img.c
index cc26ae9100..a02d271af1 100644
--- a/qemu-img.c
+++ b/qemu-img.c
@@ -3798,45 +3798,89 @@ static int img_rebase(const img_cmd_t *ccmd, int argc, char **argv)
     for(;;) {
         static const struct option long_options[] = {
             {"help", no_argument, 0, 'h'},
-            {"object", required_argument, 0, OPTION_OBJECT},
+            {"format", required_argument, 0, 'f'},
             {"image-opts", no_argument, 0, OPTION_IMAGE_OPTS},
-            {"force-share", no_argument, 0, 'U'},
+            {"cache", required_argument, 0, 't'},
             {"compress", no_argument, 0, 'c'},
+            {"backing", required_argument, 0, 'b'},
+            {"backing-format", required_argument, 0, 'B'},
+            {"backing-cache", required_argument, 0, 'T'},
+            {"backing-unsafe", no_argument, 0, 'u'},
+            {"force-share", no_argument, 0, 'U'},
+            {"progress", no_argument, 0, 'p'},
+            {"quiet", no_argument, 0, 'q'},
+            {"object", required_argument, 0, OPTION_OBJECT},
             {0, 0, 0, 0}
         };
-        c = getopt_long(argc, argv, ":hf:F:b:upt:T:qUc",
+        c = getopt_long(argc, argv, "hf:t:cb:F:B:T:uUpq",
                         long_options, NULL);
         if (c == -1) {
             break;
         }
-        switch(c) {
-        case ':':
-            missing_argument(argv[optind - 1]);
-            break;
-        case '?':
-            unrecognized_option(argv[optind - 1]);
-            break;
+        switch (c) {
         case 'h':
-            help();
+            cmd_help(ccmd, "[-f FMT | --image-opts] [-t CACHE]\n"
+"        [-b BACKING_FILE [-B BACKING_FMT] [-T BACKING_CACHE]] [-u]\n"
+"        [-c] [-U] [-p] [-q] [--object OBJDEF] FILE\n"
+,
+"  -f, --format FMT\n"
+"     specify FILE format explicitly (default: probing is used)\n"
+"  --image-opts\n"
+"     treat FILE as an option string (key=value,..), not a file name\n"
+"     (incompatible with -f|--format)\n"
+"  -t, --cache CACHE\n"
+"     cache mode for FILE (default: " BDRV_DEFAULT_CACHE ")\n"
+"  -b, --backing BACKING_FILE|\"\"\n"
+"     rebase onto this file (specify empty name for no backing file)\n"
+"  -B, --backing-format BACKING_FMT (was -F in <=10.0)\n"
+"     specify format for BACKING_FILE explicitly (default: probing is used)\n"
+"  -T, --backing-cache CACHE\n"
+"     BACKING_FILE cache mode (default: " BDRV_DEFAULT_CACHE ")\n"
+"  -u, --backing-unsafe\n"
+"     do not fail if BACKING_FILE can not be read\n"
+"  -c, --compress\n"
+"     compress image (when image supports this)\n"
+"  -U, --force-share\n"
+"     open image in shared mode for concurrent access\n"
+"  -p, --progress\n"
+"     display progress information\n"
+"  -q, --quiet\n"
+"     quiet mode (produce only error messages if any)\n"
+"  --object OBJDEF\n"
+"     defines QEMU user-creatable object\n"
+"  FILE\n"
+"     name of the image file, or option string (key=value,..)\n"
+"     with --image-opts, to operate on\n"
+);
             return 0;
         case 'f':
             fmt = optarg;
             break;
-        case 'F':
-            out_basefmt = optarg;
+        case OPTION_IMAGE_OPTS:
+            image_opts = true;
+            break;
+        case 't':
+            cache = optarg;
             break;
         case 'b':
             out_baseimg = optarg;
             break;
+        case 'F': /* <=10.0 */
+        case 'B':
+            out_basefmt = optarg;
+            break;
         case 'u':
             unsafe = 1;
             break;
+        case 'c':
+            compress = true;
+            break;
+        case 'U':
+            force_share = true;
+            break;
         case 'p':
             progress = 1;
             break;
-        case 't':
-            cache = optarg;
-            break;
         case 'T':
             src_cache = optarg;
             break;
@@ -3846,15 +3890,8 @@ static int img_rebase(const img_cmd_t *ccmd, int argc, char **argv)
         case OPTION_OBJECT:
             user_creatable_process_cmdline(optarg);
             break;
-        case OPTION_IMAGE_OPTS:
-            image_opts = true;
-            break;
-        case 'U':
-            force_share = true;
-            break;
-        case 'c':
-            compress = true;
-            break;
+        default:
+            tryhelp(argv[0]);
         }
     }
 

From 8737b342e236c8cf5e4ae1f5cc0f519a23a6dd2b Mon Sep 17 00:00:00 2001
From: Michael Tokarev <mjt@tls.msk.ru>
Date: Sat, 31 May 2025 20:16:01 +0300
Subject: [PATCH 2477/2760] qemu-img: resize: do not always eat last argument

'qemu-img resize --help' does not work, since it wants more
arguments.  Also -size is only recognized as a very last
argument, but it is common for tools to handle other options
after positional arguments too.

Tell getopt_long() to return non-options together with options,
and process filename and size in the loop, and check if there's
an argument right after filename which looks like -N (number),
and treat it as size (decrement).  This way we can handle --help,
and we can also have options after filename and size, and `--'
will be handled fine too.

The only case which is not handled right is when there's an option
between filename and size, and size is given as decrement, - in
this case -size will be treated as option, not as size.

Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Message-ID: <20250531171609.197078-20-mjt@tls.msk.ru>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 qemu-img.c | 41 +++++++++++++++++++++++++++--------------
 1 file changed, 27 insertions(+), 14 deletions(-)

diff --git a/qemu-img.c b/qemu-img.c
index a02d271af1..36ef998a34 100644
--- a/qemu-img.c
+++ b/qemu-img.c
@@ -4302,7 +4302,7 @@ static int img_resize(const img_cmd_t *ccmd, int argc, char **argv)
 {
     Error *err = NULL;
     int c, ret, relative;
-    const char *filename, *fmt, *size;
+    const char *filename = NULL, *fmt = NULL, *size = NULL;
     int64_t n, total_size, current_size;
     bool quiet = false;
     BlockBackend *blk = NULL;
@@ -4325,17 +4325,7 @@ static int img_resize(const img_cmd_t *ccmd, int argc, char **argv)
     bool image_opts = false;
     bool shrink = false;
 
-    /* Remove size from argv manually so that negative numbers are not treated
-     * as options by getopt. */
-    if (argc < 3) {
-        error_exit(argv[0], "Not enough arguments");
-        return 1;
-    }
-
-    size = argv[--argc];
-
     /* Parse getopt arguments */
-    fmt = NULL;
     for(;;) {
         static const struct option long_options[] = {
             {"help", no_argument, 0, 'h'},
@@ -4345,7 +4335,7 @@ static int img_resize(const img_cmd_t *ccmd, int argc, char **argv)
             {"shrink", no_argument, 0, OPTION_SHRINK},
             {0, 0, 0, 0}
         };
-        c = getopt_long(argc, argv, ":f:hq",
+        c = getopt_long(argc, argv, "-:f:hq",
                         long_options, NULL);
         if (c == -1) {
             break;
@@ -4383,12 +4373,35 @@ static int img_resize(const img_cmd_t *ccmd, int argc, char **argv)
         case OPTION_SHRINK:
             shrink = true;
             break;
+        case 1: /* a non-optional argument */
+            if (!filename) {
+                filename = optarg;
+                /* see if we have -size (number) next to filename */
+                if (optind < argc) {
+                    size = argv[optind];
+                    if (size[0] == '-' && size[1] >= '0' && size[1] <= '9') {
+                        ++optind;
+                    } else {
+                        size = NULL;
+                    }
+                }
+            } else if (!size) {
+                size = optarg;
+            } else {
+                error_exit(argv[0], "Extra argument(s) in command line");
+            }
+            break;
         }
     }
-    if (optind != argc - 1) {
+    if (!filename && optind < argc) {
+        filename = argv[optind++];
+    }
+    if (!size && optind < argc) {
+        size = argv[optind++];
+    }
+    if (!filename || !size || optind < argc) {
         error_exit(argv[0], "Expecting image file name and size");
     }
-    filename = argv[optind++];
 
     /* Choose grow, shrink, or absolute resize mode */
     switch (size[0]) {

From a8ce9adfe1b30999b2f51cec61d44e525365077d Mon Sep 17 00:00:00 2001
From: Michael Tokarev <mjt@tls.msk.ru>
Date: Sat, 31 May 2025 20:16:02 +0300
Subject: [PATCH 2478/2760] qemu-img: resize: refresh options/--help

Add missing long options and --help output,
reorder options for consistency.

Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Message-ID: <20250531171609.197078-21-mjt@tls.msk.ru>
[kwolf: Fixed up qemu-iotests]
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 qemu-img.c                 | 52 ++++++++++++++++++++++++++------------
 tests/qemu-iotests/153.out | 12 ++++-----
 2 files changed, 42 insertions(+), 22 deletions(-)

diff --git a/qemu-img.c b/qemu-img.c
index 36ef998a34..c16de265e0 100644
--- a/qemu-img.c
+++ b/qemu-img.c
@@ -4329,36 +4329,48 @@ static int img_resize(const img_cmd_t *ccmd, int argc, char **argv)
     for(;;) {
         static const struct option long_options[] = {
             {"help", no_argument, 0, 'h'},
-            {"object", required_argument, 0, OPTION_OBJECT},
+            {"format", required_argument, 0, 'f'},
             {"image-opts", no_argument, 0, OPTION_IMAGE_OPTS},
             {"preallocation", required_argument, 0, OPTION_PREALLOCATION},
             {"shrink", no_argument, 0, OPTION_SHRINK},
+            {"quiet", no_argument, 0, 'q'},
+            {"object", required_argument, 0, OPTION_OBJECT},
             {0, 0, 0, 0}
         };
-        c = getopt_long(argc, argv, "-:f:hq",
+        c = getopt_long(argc, argv, "-hf:q",
                         long_options, NULL);
         if (c == -1) {
             break;
         }
         switch(c) {
-        case ':':
-            missing_argument(argv[optind - 1]);
-            break;
-        case '?':
-            unrecognized_option(argv[optind - 1]);
-            break;
         case 'h':
-            help();
-            break;
+            cmd_help(ccmd, "[-f FMT | --image-opts] [--preallocation PREALLOC] [--shrink]\n"
+"        [-q] [--object OBJDEF] FILE [+-]SIZE[bkKMGTPE]\n"
+,
+"  -f, --format FMT\n"
+"     specify FILE format explicitly (default: probing is used)\n"
+"  --image-opts\n"
+"     treat FILE as an option string (key=value,...), not a file name\n"
+"     (incompatible with -f|--format)\n"
+"  --shrink\n"
+"     allow operation when the new size is smaller than the original\n"
+"  --preallocation PREALLOC\n"
+"     specify FMT-specific preallocation type for the new areas\n"
+"  -q, --quiet\n"
+"     quiet mode (produce only error messages if any)\n"
+"  --object OBJDEF\n"
+"     defines QEMU user-creatable object\n"
+"  FILE\n"
+"     name of the image file, or option string (key=value,..)\n"
+"     with --image-opts, to operate on\n"
+"  [+-]SIZE[bkKMGTPE]\n"
+"     new image size or amount by which to shrink (-)/grow (+),\n"
+"     with optional multiplier suffix (powers of 1024, default is bytes)\n"
+);
+            return 0;
         case 'f':
             fmt = optarg;
             break;
-        case 'q':
-            quiet = true;
-            break;
-        case OPTION_OBJECT:
-            user_creatable_process_cmdline(optarg);
-            break;
         case OPTION_IMAGE_OPTS:
             image_opts = true;
             break;
@@ -4373,6 +4385,12 @@ static int img_resize(const img_cmd_t *ccmd, int argc, char **argv)
         case OPTION_SHRINK:
             shrink = true;
             break;
+        case 'q':
+            quiet = true;
+            break;
+        case OPTION_OBJECT:
+            user_creatable_process_cmdline(optarg);
+            break;
         case 1: /* a non-optional argument */
             if (!filename) {
                 filename = optarg;
@@ -4391,6 +4409,8 @@ static int img_resize(const img_cmd_t *ccmd, int argc, char **argv)
                 error_exit(argv[0], "Extra argument(s) in command line");
             }
             break;
+        default:
+            tryhelp(argv[0]);
         }
     }
     if (!filename && optind < argc) {
diff --git a/tests/qemu-iotests/153.out b/tests/qemu-iotests/153.out
index a8ffd01266..ac3e340e15 100644
--- a/tests/qemu-iotests/153.out
+++ b/tests/qemu-iotests/153.out
@@ -128,8 +128,8 @@ qemu-img commit: invalid option -- 'U'
 Try 'qemu-img commit --help' for more information
 
 _qemu_img_wrapper resize -U TEST_DIR/t.qcow2 32M
-qemu-img: unrecognized option '-U'
-Try 'qemu-img --help' for more information
+qemu-img resize: invalid option -- 'U'
+Try 'qemu-img resize --help' for more information
 
 _qemu_img_wrapper rebase -U TEST_DIR/t.qcow2 -b TEST_DIR/t.qcow2.base -F qcow2
 qemu-img: Could not open 'TEST_DIR/t.qcow2': Failed to get "write" lock
@@ -252,8 +252,8 @@ qemu-img commit: invalid option -- 'U'
 Try 'qemu-img commit --help' for more information
 
 _qemu_img_wrapper resize -U TEST_DIR/t.qcow2 32M
-qemu-img: unrecognized option '-U'
-Try 'qemu-img --help' for more information
+qemu-img resize: invalid option -- 'U'
+Try 'qemu-img resize --help' for more information
 
 _qemu_img_wrapper rebase -U TEST_DIR/t.qcow2 -b TEST_DIR/t.qcow2.base -F qcow2
 qemu-img: Could not open 'TEST_DIR/t.qcow2': Failed to get "write" lock
@@ -357,8 +357,8 @@ qemu-img commit: invalid option -- 'U'
 Try 'qemu-img commit --help' for more information
 
 _qemu_img_wrapper resize -U TEST_DIR/t.qcow2 32M
-qemu-img: unrecognized option '-U'
-Try 'qemu-img --help' for more information
+qemu-img resize: invalid option -- 'U'
+Try 'qemu-img resize --help' for more information
 
 _qemu_img_wrapper rebase -U TEST_DIR/t.qcow2 -b TEST_DIR/t.qcow2.base -F qcow2
 

From 03b5de62d2af64c8349c62909bc7d11641491b24 Mon Sep 17 00:00:00 2001
From: Michael Tokarev <mjt@tls.msk.ru>
Date: Sat, 31 May 2025 20:16:03 +0300
Subject: [PATCH 2479/2760] qemu-img: amend: refresh options/--help

Add missing long options and --help output,
reorder options for consistency.

Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Message-ID: <20250531171609.197078-22-mjt@tls.msk.ru>
[kwolf: Fixed up qemu-iotests]
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 qemu-img.c                 | 54 +++++++++++++++++++++++++++-----------
 tests/qemu-iotests/153.out | 12 ++++-----
 2 files changed, 45 insertions(+), 21 deletions(-)

diff --git a/qemu-img.c b/qemu-img.c
index c16de265e0..bb10569372 100644
--- a/qemu-img.c
+++ b/qemu-img.c
@@ -4564,26 +4564,48 @@ static int img_amend(const img_cmd_t *ccmd, int argc, char **argv)
     for (;;) {
         static const struct option long_options[] = {
             {"help", no_argument, 0, 'h'},
-            {"object", required_argument, 0, OPTION_OBJECT},
+            {"options", required_argument, 0, 'o'},
+            {"format", required_argument, 0, 'f'},
             {"image-opts", no_argument, 0, OPTION_IMAGE_OPTS},
+            {"cache", required_argument, 0, 't'},
             {"force", no_argument, 0, OPTION_FORCE},
+            {"progress", no_argument, 0, 'p'},
+            {"quiet", no_argument, 0, 'q'},
+            {"object", required_argument, 0, OPTION_OBJECT},
             {0, 0, 0, 0}
         };
-        c = getopt_long(argc, argv, ":ho:f:t:pq",
+        c = getopt_long(argc, argv, "ho:f:t:pq",
                         long_options, NULL);
         if (c == -1) {
             break;
         }
 
         switch (c) {
-        case ':':
-            missing_argument(argv[optind - 1]);
-            break;
-        case '?':
-            unrecognized_option(argv[optind - 1]);
-            break;
         case 'h':
-            help();
+            cmd_help(ccmd, "-o FMT_OPTS [-f FMT | --image-opts]\n"
+"        [-t CACHE] [--force] [-p] [-q] [--object OBJDEF] FILE\n"
+,
+"  -o, --options FMT_OPTS\n"
+"     FMT-specfic format options (required)\n"
+"  -f, --format FMT\n"
+"     specify FILE format explicitly (default: probing is used)\n"
+"  --image-opts\n"
+"     treat FILE as an option string (key=value,..), not a file name\n"
+"     (incompatible with -f|--format)\n"
+"  -t, --cache CACHE\n"
+"     cache mode for FILE (default: " BDRV_DEFAULT_CACHE ")\n"
+"  --force\n"
+"     allow certain unsafe operations\n"
+"  -p, --progres\n"
+"     show operation progress\n"
+"  -q, --quiet\n"
+"     quiet mode (produce only error messages if any)\n"
+"  --object OBJDEF\n"
+"     defines QEMU user-creatable object\n"
+"  FILE\n"
+"     name of the image file, or option string (key=value,..)\n"
+"     with --image-opts, to operate on\n"
+);
             break;
         case 'o':
             if (accumulate_options(&options, optarg) < 0) {
@@ -4594,9 +4616,15 @@ static int img_amend(const img_cmd_t *ccmd, int argc, char **argv)
         case 'f':
             fmt = optarg;
             break;
+        case OPTION_IMAGE_OPTS:
+            image_opts = true;
+            break;
         case 't':
             cache = optarg;
             break;
+        case OPTION_FORCE:
+            force = true;
+            break;
         case 'p':
             progress = true;
             break;
@@ -4606,12 +4634,8 @@ static int img_amend(const img_cmd_t *ccmd, int argc, char **argv)
         case OPTION_OBJECT:
             user_creatable_process_cmdline(optarg);
             break;
-        case OPTION_IMAGE_OPTS:
-            image_opts = true;
-            break;
-        case OPTION_FORCE:
-            force = true;
-            break;
+        default:
+            tryhelp(argv[0]);
         }
     }
 
diff --git a/tests/qemu-iotests/153.out b/tests/qemu-iotests/153.out
index ac3e340e15..28e1a22952 100644
--- a/tests/qemu-iotests/153.out
+++ b/tests/qemu-iotests/153.out
@@ -120,8 +120,8 @@ _qemu_img_wrapper compare -U TEST_DIR/t.qcow2 TEST_DIR/t.qcow2
 _qemu_img_wrapper map -U TEST_DIR/t.qcow2
 
 _qemu_img_wrapper amend -o size=32M -U TEST_DIR/t.qcow2
-qemu-img: unrecognized option '-U'
-Try 'qemu-img --help' for more information
+qemu-img amend: invalid option -- 'U'
+Try 'qemu-img amend --help' for more information
 
 _qemu_img_wrapper commit -U TEST_DIR/t.qcow2
 qemu-img commit: invalid option -- 'U'
@@ -244,8 +244,8 @@ _qemu_img_wrapper compare -U TEST_DIR/t.qcow2 TEST_DIR/t.qcow2
 _qemu_img_wrapper map -U TEST_DIR/t.qcow2
 
 _qemu_img_wrapper amend -o size=32M -U TEST_DIR/t.qcow2
-qemu-img: unrecognized option '-U'
-Try 'qemu-img --help' for more information
+qemu-img amend: invalid option -- 'U'
+Try 'qemu-img amend --help' for more information
 
 _qemu_img_wrapper commit -U TEST_DIR/t.qcow2
 qemu-img commit: invalid option -- 'U'
@@ -349,8 +349,8 @@ _qemu_img_wrapper compare -U TEST_DIR/t.qcow2 TEST_DIR/t.qcow2
 _qemu_img_wrapper map -U TEST_DIR/t.qcow2
 
 _qemu_img_wrapper amend -o size=32M -U TEST_DIR/t.qcow2
-qemu-img: unrecognized option '-U'
-Try 'qemu-img --help' for more information
+qemu-img amend: invalid option -- 'U'
+Try 'qemu-img amend --help' for more information
 
 _qemu_img_wrapper commit -U TEST_DIR/t.qcow2
 qemu-img commit: invalid option -- 'U'

From 609cbaf893f6bb4143dacde0be2b82a5134a7f5f Mon Sep 17 00:00:00 2001
From: Michael Tokarev <mjt@tls.msk.ru>
Date: Sat, 31 May 2025 20:16:04 +0300
Subject: [PATCH 2480/2760] qemu-img: bench: refresh options/--help

Add missing long options and --help output,
reorder options for consistency.

Add missing --object option.

Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Message-ID: <20250531171609.197078-23-mjt@tls.msk.ru>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 qemu-img.c | 114 +++++++++++++++++++++++++++++++++++++++--------------
 1 file changed, 85 insertions(+), 29 deletions(-)

diff --git a/qemu-img.c b/qemu-img.c
index bb10569372..17f7516a68 100644
--- a/qemu-img.c
+++ b/qemu-img.c
@@ -4864,28 +4864,93 @@ static int img_bench(const img_cmd_t *ccmd, int argc, char **argv)
     for (;;) {
         static const struct option long_options[] = {
             {"help", no_argument, 0, 'h'},
-            {"flush-interval", required_argument, 0, OPTION_FLUSH_INTERVAL},
+            {"format", required_argument, 0, 'f'},
             {"image-opts", no_argument, 0, OPTION_IMAGE_OPTS},
+            {"cache", required_argument, 0, 't'},
+            {"count", required_argument, 0, 'c'},
+            {"depth", required_argument, 0, 'd'},
+            {"offset", required_argument, 0, 'o'},
+            {"buffer-size", required_argument, 0, 's'},
+            {"step-size", required_argument, 0, 'S'},
+            {"write", no_argument, 0, 'w'},
             {"pattern", required_argument, 0, OPTION_PATTERN},
+            {"flush-interval", required_argument, 0, OPTION_FLUSH_INTERVAL},
             {"no-drain", no_argument, 0, OPTION_NO_DRAIN},
+            {"aio", required_argument, 0, 'i'},
+            {"native", no_argument, 0, 'n'},
             {"force-share", no_argument, 0, 'U'},
+            {"quiet", no_argument, 0, 'q'},
+            {"object", required_argument, 0, OPTION_OBJECT},
             {0, 0, 0, 0}
         };
-        c = getopt_long(argc, argv, ":hc:d:f:ni:o:qs:S:t:wU", long_options,
-                        NULL);
+        c = getopt_long(argc, argv, "hf:t:c:d:o:s:S:wi:nUq",
+                        long_options, NULL);
         if (c == -1) {
             break;
         }
 
         switch (c) {
-        case ':':
-            missing_argument(argv[optind - 1]);
-            break;
-        case '?':
-            unrecognized_option(argv[optind - 1]);
-            break;
         case 'h':
-            help();
+            cmd_help(ccmd, "[-f FMT | --image-opts] [-t CACHE]\n"
+"        [-c COUNT] [-d DEPTH] [-o OFFSET] [-s BUFFER_SIZE] [-S STEP_SIZE]\n"
+"        [-w [--pattern PATTERN] [--flush-interval INTERVAL [--no-drain]]]\n"
+"        [-i AIO] [-n] [-U] [-q] FILE\n"
+,
+"  -f, --format FMT\n"
+"     specify FILE format explicitly\n"
+"  --image-opts\n"
+"     indicates that FILE is a complete image specification\n"
+"     instead of a file name (incompatible with --format)\n"
+"  -t, --cache CACHE\n"
+"     cache mode for FILE (default: " BDRV_DEFAULT_CACHE ")\n"
+"  -c, --count COUNT\n"
+"     number of I/O requests to perform\n"
+"  -d, --depth DEPTH\n"
+"     number of requests to perform in parallel\n"
+"  -o, --offset OFFSET\n"
+"     start first request at this OFFSET\n"
+"  -s, --buffer-size BUFFER_SIZE[bkKMGTPE]\n"
+"     size of each I/O request, with optional multiplier suffix\n"
+"     (powers of 1024, default is 4K)\n"
+"  -S, --step-size STEP_SIZE[bkKMGTPE]\n"
+"     each next request offset increment, with optional multiplier suffix\n"
+"     (powers of 1024, default is the same as BUFFER_SIZE)\n"
+"  -w, --write\n"
+"     perform write test (default is read)\n"
+"  --pattern PATTERN\n"
+"     write this pattern byte instead of zero\n"
+"  --flush-interval FLUSH_INTERVAL\n"
+"     issue flush after this number of requests\n"
+"  --no-drain\n"
+"     do not wait when flushing pending requests\n"
+"  -i, --aio AIO\n"
+"     async-io backend (threads, native, io_uring)\n"
+"  -n, --native\n"
+"     use native AIO backend if possible\n"
+"  -U, --force-share\n"
+"     open images in shared mode for concurrent access\n"
+"  -q, --quiet\n"
+"     quiet mode (produce only error messages if any)\n"
+"  --object OBJDEF\n"
+"     defines QEMU user-creatable object\n"
+"  FILE\n"
+"     name of the image file, or option string (key=value,..)\n"
+"     with --image-opts, to operate on\n"
+);
+            break;
+        case 'f':
+            fmt = optarg;
+            break;
+        case OPTION_IMAGE_OPTS:
+            image_opts = true;
+            break;
+        case 't':
+            ret = bdrv_parse_cache_mode(optarg, &flags, &writethrough);
+            if (ret < 0) {
+                error_report("Invalid cache mode");
+                ret = -1;
+                goto out;
+            }
             break;
         case 'c':
         {
@@ -4909,9 +4974,6 @@ static int img_bench(const img_cmd_t *ccmd, int argc, char **argv)
             depth = res;
             break;
         }
-        case 'f':
-            fmt = optarg;
-            break;
         case 'n':
             flags |= BDRV_O_NATIVE_AIO;
             break;
@@ -4932,9 +4994,6 @@ static int img_bench(const img_cmd_t *ccmd, int argc, char **argv)
             break;
         }
             break;
-        case 'q':
-            quiet = true;
-            break;
         case 's':
         {
             int64_t sval;
@@ -4959,21 +5018,10 @@ static int img_bench(const img_cmd_t *ccmd, int argc, char **argv)
             step = sval;
             break;
         }
-        case 't':
-            ret = bdrv_parse_cache_mode(optarg, &flags, &writethrough);
-            if (ret < 0) {
-                error_report("Invalid cache mode");
-                ret = -1;
-                goto out;
-            }
-            break;
         case 'w':
             flags |= BDRV_O_RDWR;
             is_write = true;
             break;
-        case 'U':
-            force_share = true;
-            break;
         case OPTION_PATTERN:
         {
             unsigned long res;
@@ -4999,9 +5047,17 @@ static int img_bench(const img_cmd_t *ccmd, int argc, char **argv)
         case OPTION_NO_DRAIN:
             drain_on_flush = false;
             break;
-        case OPTION_IMAGE_OPTS:
-            image_opts = true;
+        case 'U':
+            force_share = true;
             break;
+        case 'q':
+            quiet = true;
+            break;
+        case OPTION_OBJECT:
+            user_creatable_process_cmdline(optarg);
+            break;
+        default:
+            tryhelp(argv[0]);
         }
     }
 

From 0668a468d2c1ee6783f53fb4ef6abc6d8f9f26b8 Mon Sep 17 00:00:00 2001
From: Michael Tokarev <mjt@tls.msk.ru>
Date: Sat, 31 May 2025 20:16:05 +0300
Subject: [PATCH 2481/2760] qemu-img: bitmap: refresh options/--help

Add missing long options and --help output,
reorder options for consistency.

Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Message-ID: <20250531171609.197078-24-mjt@tls.msk.ru>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 qemu-img.c | 80 ++++++++++++++++++++++++++++++++++++++----------------
 1 file changed, 56 insertions(+), 24 deletions(-)

diff --git a/qemu-img.c b/qemu-img.c
index 17f7516a68..d7f69c4bfb 100644
--- a/qemu-img.c
+++ b/qemu-img.c
@@ -5184,48 +5184,69 @@ static int img_bitmap(const img_cmd_t *ccmd, int argc, char **argv)
     for (;;) {
         static const struct option long_options[] = {
             {"help", no_argument, 0, 'h'},
-            {"object", required_argument, 0, OPTION_OBJECT},
+            {"format", required_argument, 0, 'f'},
             {"image-opts", no_argument, 0, OPTION_IMAGE_OPTS},
             {"add", no_argument, 0, OPTION_ADD},
+            {"granularity", required_argument, 0, 'g'},
             {"remove", no_argument, 0, OPTION_REMOVE},
             {"clear", no_argument, 0, OPTION_CLEAR},
             {"enable", no_argument, 0, OPTION_ENABLE},
             {"disable", no_argument, 0, OPTION_DISABLE},
             {"merge", required_argument, 0, OPTION_MERGE},
-            {"granularity", required_argument, 0, 'g'},
             {"source-file", required_argument, 0, 'b'},
             {"source-format", required_argument, 0, 'F'},
+            {"object", required_argument, 0, OPTION_OBJECT},
             {0, 0, 0, 0}
         };
-        c = getopt_long(argc, argv, ":b:f:F:g:h", long_options, NULL);
+        c = getopt_long(argc, argv, "hf:g:b:F:",
+                        long_options, NULL);
         if (c == -1) {
             break;
         }
 
         switch (c) {
-        case ':':
-            missing_argument(argv[optind - 1]);
-            break;
-        case '?':
-            unrecognized_option(argv[optind - 1]);
-            break;
         case 'h':
-            help();
-            break;
-        case 'b':
-            src_filename = optarg;
+            cmd_help(ccmd, "[-f FMT | --image-opts]\n"
+"        ( --add [-g SIZE] | --remove | --clear | --enable | --disable |\n"
+"          --merge SOURCE [-b SRC_FILE [-F SRC_FMT]] )..\n"
+"        [--object OBJDEF] FILE BITMAP\n"
+,
+"  -f, --format FMT\n"
+"     specify FILE format explicitly (default: probing is used)\n"
+"  --image-opts\n"
+"     treat FILE as an option string (key=value,..), not a file name\n"
+"     (incompatible with -f|--format)\n"
+"  --add\n"
+"     creates BITMAP in FILE, enables to record future edits\n"
+"  -g, --granularity SIZE[bKMGTPE]\n"
+"     sets non-default granularity for the bitmap being added,\n"
+"     with optional multiplier suffix (in powers of 1024)\n"
+"  --remove\n"
+"     removes BITMAP from FILE\n"
+"  --clear\n"
+"     clears BITMAP in FILE\n"
+"  --enable, --disable\n"
+"     starts and stops recording future edits to BITMAP in FILE\n"
+"  --merge SOURCE\n"
+"     merges contents of the SOURCE bitmap into BITMAP in FILE\n"
+"  -b, --source-file SRC_FILE\n"
+"     select alternative source file for --merge\n"
+"  -F, --source-format SRC_FMT\n"
+"     specify format for SRC_FILE explicitly\n"
+"  --object OBJDEF\n"
+"     defines QEMU user-creatable object\n"
+"  FILE\n"
+"     name of the image file, or option string (key=value,..)\n"
+"     with --image-opts, to operate on\n"
+"  BITMAP\n"
+"     name of the bitmap to add, remove, clear, enable, disable or merge to\n"
+);
             break;
         case 'f':
             fmt = optarg;
             break;
-        case 'F':
-            src_fmt = optarg;
-            break;
-        case 'g':
-            granularity = cvtnum("granularity", optarg);
-            if (granularity < 0) {
-                return 1;
-            }
+        case OPTION_IMAGE_OPTS:
+            image_opts = true;
             break;
         case OPTION_ADD:
             act = g_new0(ImgBitmapAction, 1);
@@ -5233,6 +5254,12 @@ static int img_bitmap(const img_cmd_t *ccmd, int argc, char **argv)
             QSIMPLEQ_INSERT_TAIL(&actions, act, next);
             add = true;
             break;
+        case 'g':
+            granularity = cvtnum("granularity", optarg);
+            if (granularity < 0) {
+                return 1;
+            }
+            break;
         case OPTION_REMOVE:
             act = g_new0(ImgBitmapAction, 1);
             act->act = BITMAP_REMOVE;
@@ -5260,12 +5287,17 @@ static int img_bitmap(const img_cmd_t *ccmd, int argc, char **argv)
             QSIMPLEQ_INSERT_TAIL(&actions, act, next);
             merge = true;
             break;
+        case 'b':
+            src_filename = optarg;
+            break;
+        case 'F':
+            src_fmt = optarg;
+            break;
         case OPTION_OBJECT:
             user_creatable_process_cmdline(optarg);
             break;
-        case OPTION_IMAGE_OPTS:
-            image_opts = true;
-            break;
+        default:
+            tryhelp(argv[0]);
         }
     }
 

From 892b0abf971f1b7ce8b363616ec42cc6248096cf Mon Sep 17 00:00:00 2001
From: Michael Tokarev <mjt@tls.msk.ru>
Date: Sat, 31 May 2025 20:16:06 +0300
Subject: [PATCH 2482/2760] qemu-img: dd: refresh options/--help

Add missing long options and --help output,
reorder options for consistency.

Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Message-ID: <20250531171609.197078-25-mjt@tls.msk.ru>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 qemu-img.c | 50 ++++++++++++++++++++++++++++++++++++--------------
 1 file changed, 36 insertions(+), 14 deletions(-)

diff --git a/qemu-img.c b/qemu-img.c
index d7f69c4bfb..35c3d9ad48 100644
--- a/qemu-img.c
+++ b/qemu-img.c
@@ -5538,31 +5538,54 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
     };
     const struct option long_options[] = {
         { "help", no_argument, 0, 'h'},
-        { "object", required_argument, 0, OPTION_OBJECT},
+        { "format", required_argument, 0, 'f'},
         { "image-opts", no_argument, 0, OPTION_IMAGE_OPTS},
+        { "output-format", required_argument, 0, 'O'},
         { "force-share", no_argument, 0, 'U'},
+        { "object", required_argument, 0, OPTION_OBJECT},
         { 0, 0, 0, 0 }
     };
 
-    while ((c = getopt_long(argc, argv, ":hf:O:U", long_options, NULL))) {
+    while ((c = getopt_long(argc, argv, "hf:O:U", long_options, NULL))) {
         if (c == EOF) {
             break;
         }
         switch (c) {
-        case 'O':
-            out_fmt = optarg;
+        case 'h':
+            cmd_help(ccmd, "[-f FMT|--image-opts] [-O OUTPUT_FMT] [-U]\n"
+"        [--object OBJDEF] [bs=BLOCK_SIZE] [count=BLOCKS] if=INPUT of=OUTPUT\n"
+,
+"  -f, --format FMT\n"
+"     specify format for INPUT explicitly (default: probing is used)\n"
+"  --image-opts\n"
+"     treat INPUT as an option string (key=value,..), not a file name\n"
+"     (incompatible with -f|--format)\n"
+"  -O, --output-format OUTPUT_FMT\n"
+"     format of the OUTPUT (default: raw)\n"
+"  -U, --force-share\n"
+"     open images in shared mode for concurrent access\n"
+"  --object OBJDEF\n"
+"     defines QEMU user-creatable object\n"
+"  bs=BLOCK_SIZE[bKMGTP]\n"
+"     size of the I/O block, with optional multiplier suffix (powers of 1024)\n"
+"     (default: 512)\n"
+"  count=COUNT\n"
+"     number of blocks to convert (default whole INPUT)\n"
+"  if=INPUT\n"
+"     name of the file, or option string (key=value,..)\n"
+"     with --image-opts, to use for input\n"
+"  of=OUTPUT\n"
+"     output file name to create (will be overridden if alrady exists)\n"
+);
             break;
         case 'f':
             fmt = optarg;
             break;
-        case ':':
-            missing_argument(argv[optind - 1]);
+        case OPTION_IMAGE_OPTS:
+            image_opts = true;
             break;
-        case '?':
-            unrecognized_option(argv[optind - 1]);
-            break;
-        case 'h':
-            help();
+        case 'O':
+            out_fmt = optarg;
             break;
         case 'U':
             force_share = true;
@@ -5570,9 +5593,8 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
         case OPTION_OBJECT:
             user_creatable_process_cmdline(optarg);
             break;
-        case OPTION_IMAGE_OPTS:
-            image_opts = true;
-            break;
+        default:
+            tryhelp(argv[0]);
         }
     }
 

From d7d0e936f9d665622badf3913de8925581d8fa8c Mon Sep 17 00:00:00 2001
From: Michael Tokarev <mjt@tls.msk.ru>
Date: Sat, 31 May 2025 20:16:07 +0300
Subject: [PATCH 2483/2760] qemu-img: measure: refresh options/--help

Add missing long options and --help output,
reorder options for consistency.

Also add -s short option for --size (and remove OPTION_SIZE).

Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Message-ID: <20250531171609.197078-26-mjt@tls.msk.ru>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 qemu-img.c | 89 +++++++++++++++++++++++++++++++++++++-----------------
 1 file changed, 62 insertions(+), 27 deletions(-)

diff --git a/qemu-img.c b/qemu-img.c
index 35c3d9ad48..a7d9d50250 100644
--- a/qemu-img.c
+++ b/qemu-img.c
@@ -72,7 +72,6 @@ enum {
     OPTION_FLUSH_INTERVAL = 261,
     OPTION_NO_DRAIN = 262,
     OPTION_TARGET_IMAGE_OPTS = 263,
-    OPTION_SIZE = 264,
     OPTION_PREALLOCATION = 265,
     OPTION_SHRINK = 266,
     OPTION_SALVAGE = 267,
@@ -5786,15 +5785,6 @@ static void dump_json_block_measure_info(BlockMeasureInfo *info)
 
 static int img_measure(const img_cmd_t *ccmd, int argc, char **argv)
 {
-    static const struct option long_options[] = {
-        {"help", no_argument, 0, 'h'},
-        {"image-opts", no_argument, 0, OPTION_IMAGE_OPTS},
-        {"object", required_argument, 0, OPTION_OBJECT},
-        {"output", required_argument, 0, OPTION_OUTPUT},
-        {"size", required_argument, 0, OPTION_SIZE},
-        {"force-share", no_argument, 0, 'U'},
-        {0, 0, 0, 0}
-    };
     OutputFormat output_format = OFORMAT_HUMAN;
     BlockBackend *in_blk = NULL;
     BlockDriver *drv;
@@ -5815,23 +5805,61 @@ static int img_measure(const img_cmd_t *ccmd, int argc, char **argv)
     int ret = 1;
     int c;
 
-    while ((c = getopt_long(argc, argv, "hf:O:o:l:U",
+    static const struct option long_options[] = {
+        {"help", no_argument, 0, 'h'},
+        {"source-format", required_argument, 0, 'f'}, /* img_convert */
+        {"format", required_argument, 0, 'f'},
+        {"image-opts", no_argument, 0, OPTION_IMAGE_OPTS},
+        {"source-image-opts", no_argument, 0, OPTION_IMAGE_OPTS}, /* img_convert */
+        {"snapshot", required_argument, 0, 'l'},
+        {"target-format", required_argument, 0, 'O'},
+        {"target-format-options", required_argument, 0, 'o'}, /* img_convert */
+        {"options", required_argument, 0, 'o'},
+        {"force-share", no_argument, 0, 'U'},
+        {"output", required_argument, 0, OPTION_OUTPUT},
+        {"object", required_argument, 0, OPTION_OBJECT},
+        {"size", required_argument, 0, 's'},
+        {0, 0, 0, 0}
+    };
+
+    while ((c = getopt_long(argc, argv, "hf:l:O:o:Us:",
                             long_options, NULL)) != -1) {
         switch (c) {
-        case '?':
         case 'h':
-            help();
+            cmd_help(ccmd, "[-f FMT|--image-opts] [-l SNAPSHOT]\n"
+"       [-O TARGET_FMT] [-o TARGET_FMT_OPTS] [--output human|json]\n"
+"       [--object OBJDEF] (--size SIZE | FILE)\n"
+,
+"  -f, --format\n"
+"     specify format of FILE explicitly (default: probing is used)\n"
+"  --image-opts\n"
+"     indicates that FILE is a complete image specification\n"
+"     instead of a file name (incompatible with --format)\n"
+"  -l, --snapshot SNAPSHOT\n"
+"     use this snapshot in FILE as source\n"
+"  -O, --target-format TARGET_FMT\n"
+"     desired target/output image format (default: raw)\n"
+"  -o TARGET_FMT_OPTS\n"
+"     options specific to TARGET_FMT\n"
+"  --output human|json\n"
+"     output format (default: human)\n"
+"  -U, --force-share\n"
+"     open images in shared mode for concurrent access\n"
+"  --object OBJDEF\n"
+"     defines QEMU user-creatable object\n"
+"  -s, --size SIZE[bKMGTPE]\n"
+"     measure file size for given image size,\n"
+"     with optional multiplier suffix (powers of 1024)\n"
+"  FILE\n"
+"     measure file size required to convert from FILE (either a file name\n"
+"     or an option string (key=value,..) with --image-options)\n"
+);
             break;
         case 'f':
             fmt = optarg;
             break;
-        case 'O':
-            out_fmt = optarg;
-            break;
-        case 'o':
-            if (accumulate_options(&options, optarg) < 0) {
-                goto out;
-            }
+        case OPTION_IMAGE_OPTS:
+            image_opts = true;
             break;
         case 'l':
             if (strstart(optarg, SNAPSHOT_OPT_BASE, NULL)) {
@@ -5846,24 +5874,31 @@ static int img_measure(const img_cmd_t *ccmd, int argc, char **argv)
                 snapshot_name = optarg;
             }
             break;
+        case 'O':
+            out_fmt = optarg;
+            break;
+        case 'o':
+            if (accumulate_options(&options, optarg) < 0) {
+                goto out;
+            }
+            break;
         case 'U':
             force_share = true;
             break;
-        case OPTION_OBJECT:
-            user_creatable_process_cmdline(optarg);
-            break;
-        case OPTION_IMAGE_OPTS:
-            image_opts = true;
-            break;
         case OPTION_OUTPUT:
             output_format = parse_output_format(argv[0], optarg);
             break;
-        case OPTION_SIZE:
+        case OPTION_OBJECT:
+            user_creatable_process_cmdline(optarg);
+            break;
+        case 's':
             img_size = cvtnum("image size", optarg);
             if (img_size < 0) {
                 goto out;
             }
             break;
+        default:
+            tryhelp(argv[0]);
         }
     }
 

From bf5647ae24f3a539eb40003f3d3db95b9484b978 Mon Sep 17 00:00:00 2001
From: Michael Tokarev <mjt@tls.msk.ru>
Date: Sat, 31 May 2025 20:16:08 +0300
Subject: [PATCH 2484/2760] qemu-img: implement short --help, remove global
 help() function
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

now once all individual subcommands has --help support, remove
the large unreadable help() thing and replace it with small
global --help, which refers to individual command --help for
more info.

While at it, also line-wrap list of formats after 75 chars.

Since missing_argument() and unrecognized_option() are now unused,
remove them.

Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20250531171609.197078-27-mjt@tls.msk.ru>
[kwolf: Fixed up style and formatting]
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 qemu-img.c | 214 ++++++++++++++++++-----------------------------------
 1 file changed, 73 insertions(+), 141 deletions(-)

diff --git a/qemu-img.c b/qemu-img.c
index a7d9d50250..b34b1390bb 100644
--- a/qemu-img.c
+++ b/qemu-img.c
@@ -61,6 +61,7 @@
 typedef struct img_cmd_t {
     const char *name;
     int (*handler)(const struct img_cmd_t *ccmd, int argc, char **argv);
+    const char *description;
 } img_cmd_t;
 
 enum {
@@ -95,11 +96,6 @@ typedef enum OutputFormat {
 /* Default to cache=writeback as data integrity is not important for qemu-img */
 #define BDRV_DEFAULT_CACHE "writeback"
 
-static void format_print(void *opaque, const char *name)
-{
-    printf(" %s", name);
-}
-
 static G_NORETURN
 void tryhelp(const char *argv0)
 {
@@ -119,18 +115,6 @@ void error_exit(const char *argv0, const char *fmt, ...)
     tryhelp(argv0);
 }
 
-static G_NORETURN
-void missing_argument(const char *option)
-{
-    error_exit("qemu-img", "missing argument for option '%s'", option);
-}
-
-static G_NORETURN
-void unrecognized_option(const char *option)
-{
-    error_exit("qemu-img", "unrecognized option '%s'", option);
-}
-
 /*
  * Print --help output for a command and exit.
  * @syntax and @description are multi-line with trailing EOL
@@ -145,15 +129,14 @@ void cmd_help(const img_cmd_t *ccmd,
 {
     printf(
 "Usage:\n"
-"\n"
-"  %s %s %s"
+"  %s %s %s\n"
+"%s.\n"
 "\n"
 "Arguments:\n"
 "  -h, --help\n"
 "     print this help and exit\n"
 "%s\n",
-           "qemu-img", ccmd->name,
-           syntax, arguments);
+           "qemu-img", ccmd->name, syntax, ccmd->description, arguments);
     exit(EXIT_SUCCESS);
 }
 
@@ -168,114 +151,6 @@ static OutputFormat parse_output_format(const char *argv0, const char *arg)
     }
 }
 
-/* Please keep in synch with docs/tools/qemu-img.rst */
-static G_NORETURN
-void help(void)
-{
-    const char *help_msg =
-           QEMU_IMG_VERSION
-           "usage: qemu-img [standard options] command [command options]\n"
-           "QEMU disk image utility\n"
-           "\n"
-           "    '-h', '--help'       display this help and exit\n"
-           "    '-V', '--version'    output version information and exit\n"
-           "    '-T', '--trace'      [[enable=]<pattern>][,events=<file>][,file=<file>]\n"
-           "                         specify tracing options\n"
-           "\n"
-           "Command syntax:\n"
-#define DEF(option, callback, arg_string)        \
-           "  " arg_string "\n"
-#include "qemu-img-cmds.h"
-#undef DEF
-           "\n"
-           "Command parameters:\n"
-           "  'filename' is a disk image filename\n"
-           "  'objectdef' is a QEMU user creatable object definition. See the qemu(1)\n"
-           "    manual page for a description of the object properties. The most common\n"
-           "    object type is a 'secret', which is used to supply passwords and/or\n"
-           "    encryption keys.\n"
-           "  'fmt' is the disk image format. It is guessed automatically in most cases\n"
-           "  'cache' is the cache mode used to write the output disk image, the valid\n"
-           "    options are: 'none', 'writeback' (default, except for convert), 'writethrough',\n"
-           "    'directsync' and 'unsafe' (default for convert)\n"
-           "  'src_cache' is the cache mode used to read input disk images, the valid\n"
-           "    options are the same as for the 'cache' option\n"
-           "  'size' is the disk image size in bytes. Optional suffixes\n"
-           "    'k' or 'K' (kilobyte, 1024), 'M' (megabyte, 1024k), 'G' (gigabyte, 1024M),\n"
-           "    'T' (terabyte, 1024G), 'P' (petabyte, 1024T) and 'E' (exabyte, 1024P)  are\n"
-           "    supported. 'b' is ignored.\n"
-           "  'output_filename' is the destination disk image filename\n"
-           "  'output_fmt' is the destination format\n"
-           "  'options' is a comma separated list of format specific options in a\n"
-           "    name=value format. Use -o help for an overview of the options supported by\n"
-           "    the used format\n"
-           "  'snapshot_param' is param used for internal snapshot, format\n"
-           "    is 'snapshot.id=[ID],snapshot.name=[NAME]', or\n"
-           "    '[ID_OR_NAME]'\n"
-           "  '-c' indicates that target image must be compressed (qcow format only)\n"
-           "  '-u' allows unsafe backing chains. For rebasing, it is assumed that old and\n"
-           "       new backing file match exactly. The image doesn't need a working\n"
-           "       backing file before rebasing in this case (useful for renaming the\n"
-           "       backing file). For image creation, allow creating without attempting\n"
-           "       to open the backing file.\n"
-           "  '-h' with or without a command shows this help and lists the supported formats\n"
-           "  '-p' show progress of command (only certain commands)\n"
-           "  '-q' use Quiet mode - do not print any output (except errors)\n"
-           "  '-S' indicates the consecutive number of bytes (defaults to 4k) that must\n"
-           "       contain only zeros for qemu-img to create a sparse image during\n"
-           "       conversion. If the number of bytes is 0, the source will not be scanned for\n"
-           "       unallocated or zero sectors, and the destination image will always be\n"
-           "       fully allocated\n"
-           "  '--output' takes the format in which the output must be done (human or json)\n"
-           "  '-n' skips the target volume creation (useful if the volume is created\n"
-           "       prior to running qemu-img)\n"
-           "\n"
-           "Parameters to bitmap subcommand:\n"
-           "  'bitmap' is the name of the bitmap to manipulate, through one or more\n"
-           "       actions from '--add', '--remove', '--clear', '--enable', '--disable',\n"
-           "       or '--merge source'\n"
-           "  '-g granularity' sets the granularity for '--add' actions\n"
-           "  '-b source' and '-F src_fmt' tell '--merge' actions to find the source\n"
-           "       bitmaps from an alternative file\n"
-           "\n"
-           "Parameters to check subcommand:\n"
-           "  '-r' tries to repair any inconsistencies that are found during the check.\n"
-           "       '-r leaks' repairs only cluster leaks, whereas '-r all' fixes all\n"
-           "       kinds of errors, with a higher risk of choosing the wrong fix or\n"
-           "       hiding corruption that has already occurred.\n"
-           "\n"
-           "Parameters to convert subcommand:\n"
-           "  '--bitmaps' copies all top-level persistent bitmaps to destination\n"
-           "  '-m' specifies how many coroutines work in parallel during the convert\n"
-           "       process (defaults to 8)\n"
-           "  '-W' allow to write to the target out of order rather than sequential\n"
-           "\n"
-           "Parameters to snapshot subcommand:\n"
-           "  'snapshot' is the name of the snapshot to create, apply or delete\n"
-           "  '-a' applies a snapshot (revert disk to saved state)\n"
-           "  '-c' creates a snapshot\n"
-           "  '-d' deletes a snapshot\n"
-           "  '-l' lists all snapshots in the given image\n"
-           "\n"
-           "Parameters to compare subcommand:\n"
-           "  '-f' first image format\n"
-           "  '-F' second image format\n"
-           "  '-s' run in Strict mode - fail on different image size or sector allocation\n"
-           "\n"
-           "Parameters to dd subcommand:\n"
-           "  'bs=BYTES' read and write up to BYTES bytes at a time "
-           "(default: 512)\n"
-           "  'count=N' copy only N input blocks\n"
-           "  'if=FILE' read from FILE\n"
-           "  'of=FILE' write to FILE\n"
-           "  'skip=N' skip N bs-sized blocks at the start of input\n";
-
-    printf("%s\nSupported formats:", help_msg);
-    bdrv_iterate_format(format_print, NULL, false);
-    printf("\n\n" QEMU_HELP_BOTTOM "\n");
-    exit(EXIT_SUCCESS);
-}
-
 /*
  * Is @list safe for accumulate_options()?
  * It is when multiple of them can be joined together separated by ','.
@@ -5999,13 +5874,49 @@ out:
 }
 
 static const img_cmd_t img_cmds[] = {
-#define DEF(option, callback, arg_string)        \
-    { option, callback },
-#include "qemu-img-cmds.h"
-#undef DEF
+    { "amend", img_amend,
+      "Update format-specific options of the image" },
+    { "bench", img_bench,
+      "Run a simple image benchmark" },
+    { "bitmap", img_bitmap,
+      "Perform modifications of the persistent bitmap in the image" },
+    { "check", img_check,
+      "Check basic image integrity" },
+    { "commit", img_commit,
+      "Commit image to its backing file" },
+    { "compare", img_compare,
+      "Check if two images have the same contents" },
+    { "convert", img_convert,
+      "Copy one or more images to another with optional format conversion" },
+    { "create", img_create,
+      "Create and format a new image file" },
+    { "dd", img_dd,
+      "Copy input to output with optional format conversion" },
+    { "info", img_info,
+      "Display information about the image" },
+    { "map", img_map,
+      "Dump image metadata" },
+    { "measure", img_measure,
+      "Calculate the file size required for a new image" },
+    { "rebase", img_rebase,
+      "Change the backing file of the image" },
+    { "resize", img_resize,
+      "Resize the image" },
+    { "snapshot", img_snapshot,
+      "List or manipulate snapshots in the image" },
     { NULL, NULL, },
 };
 
+static void format_print(void *opaque, const char *name)
+{
+    int *np = opaque;
+    if (*np + strlen(name) > 75) {
+        printf("\n ");
+        *np = 1;
+    }
+    *np += printf(" %s", name);
+}
+
 int main(int argc, char **argv)
 {
     const img_cmd_t *cmd;
@@ -6037,16 +5948,35 @@ int main(int argc, char **argv)
     qemu_add_opts(&qemu_source_opts);
     qemu_add_opts(&qemu_trace_opts);
 
-    while ((c = getopt_long(argc, argv, "+:hVT:", long_options, NULL)) != -1) {
+    while ((c = getopt_long(argc, argv, "+hVT:", long_options, NULL)) != -1) {
         switch (c) {
-        case ':':
-            missing_argument(argv[optind - 1]);
-            return 0;
-        case '?':
-            unrecognized_option(argv[optind - 1]);
-            return 0;
         case 'h':
-            help();
+            printf(
+QEMU_IMG_VERSION
+"QEMU disk image utility.  Usage:\n"
+"\n"
+"  qemu-img [standard options] COMMAND [--help | command options]\n"
+"\n"
+"Standard options:\n"
+"  -h, --help\n"
+"     display this help and exit\n"
+"  -V, --version\n"
+"     display version info and exit\n"
+"  -T,--trace TRACE\n"
+"     specify tracing options:\n"
+"        [[enable=]<pattern>][,events=<file>][,file=<file>]\n"
+"\n"
+"Recognized commands (run qemu-img COMMAND --help for command-specific help):\n\n");
+            for (cmd = img_cmds; cmd->name != NULL; cmd++) {
+                printf("  %s - %s\n", cmd->name, cmd->description);
+            }
+            printf("\nSupported image formats:\n");
+            c = 99; /* force a newline */
+            bdrv_iterate_format(format_print, &c, false);
+            if (c) {
+                printf("\n");
+            }
+            printf("\n" QEMU_HELP_BOTTOM "\n");
             return 0;
         case 'V':
             printf(QEMU_IMG_VERSION);
@@ -6054,6 +5984,8 @@ int main(int argc, char **argv)
         case 'T':
             trace_opt_parse(optarg);
             break;
+        default:
+            tryhelp(argv[0]);
         }
     }
 

From d7bd47bf84707d21324ad079c5aa8cca16fd138f Mon Sep 17 00:00:00 2001
From: Michael Tokarev <mjt@tls.msk.ru>
Date: Sat, 31 May 2025 20:16:09 +0300
Subject: [PATCH 2485/2760] qemu-img: extend cvtnum() and use it in more places
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

cvtnum() expects input string to specify some sort of size
(optionally with KMG... suffix).  However, there are a lot
of other number conversions in there (using qemu_strtol &Co),
also, not all conversions which use cvtnum, actually expects
size, - like dd count=nn.

Add bool is_size argument to cvtnum() to specify if it should
treat the argument as a size or something else, - this changes
conversion routine in use and error text.

Use the new cvtnum() in more places (like where strtol were used),
since it never return negative number in successful conversion.
When it makes sense, also specify upper or lower bounds at the
same time.  This simplifies option processing in multiple places,
removing the need of local temporary variables and longer error
reporting code.

While at it, fix errors, like depth in measure must be >= 1,
while the previous code allowed it to be 0.

In a few places, change unsigned variables (like of type size_t)
to be signed instead, - to avoid the need of temporary conversion
variable.  All these variables are okay to be signed, we never
assign <0 value to them except of the cases of conversion error,
where we return immediately.

While at it, remove allowed size suffixes from the error message
as it makes no sense most of the time (should be in help instead).

Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20250531171609.197078-28-mjt@tls.msk.ru>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 qemu-img.c                 | 111 +++++++++++++------------------------
 tests/qemu-iotests/049.out |   9 +--
 2 files changed, 40 insertions(+), 80 deletions(-)

diff --git a/qemu-img.c b/qemu-img.c
index b34b1390bb..7a162fdc08 100644
--- a/qemu-img.c
+++ b/qemu-img.c
@@ -398,18 +398,16 @@ static int add_old_style_options(const char *fmt, QemuOpts *opts,
     return 0;
 }
 
-static int64_t cvtnum_full(const char *name, const char *value, int64_t min,
-                           int64_t max)
+static int64_t cvtnum_full(const char *name, const char *value,
+                           bool is_size, int64_t min, int64_t max)
 {
     int err;
     uint64_t res;
 
-    err = qemu_strtosz(value, NULL, &res);
+    err = is_size ? qemu_strtosz(value, NULL, &res) :
+                    qemu_strtou64(value, NULL, 0, &res);
     if (err < 0 && err != -ERANGE) {
-        error_report("Invalid %s specified. You may use "
-                     "k, M, G, T, P or E suffixes for", name);
-        error_report("kilobytes, megabytes, gigabytes, terabytes, "
-                     "petabytes and exabytes.");
+        error_report("Invalid %s specified: '%s'", name, value);
         return err;
     }
     if (err == -ERANGE || res > max || res < min) {
@@ -420,9 +418,9 @@ static int64_t cvtnum_full(const char *name, const char *value, int64_t min,
     return res;
 }
 
-static int64_t cvtnum(const char *name, const char *value)
+static int64_t cvtnum(const char *name, const char *value, bool is_size)
 {
-    return cvtnum_full(name, value, 0, INT64_MAX);
+    return cvtnum_full(name, value, is_size, 0, INT64_MAX);
 }
 
 static int img_create(const img_cmd_t *ccmd, int argc, char **argv)
@@ -525,7 +523,7 @@ static int img_create(const img_cmd_t *ccmd, int argc, char **argv)
 
     /* Get image size, if specified */
     if (optind < argc) {
-        img_size = cvtnum("image size", argv[optind++]);
+        img_size = cvtnum("image size", argv[optind++], true);
         if (img_size < 0) {
             goto fail;
         }
@@ -984,7 +982,7 @@ static int img_commit(const img_cmd_t *ccmd, int argc, char **argv)
             drop = true;
             break;
         case 'r':
-            rate_limit = cvtnum("rate limit", optarg);
+            rate_limit = cvtnum("rate limit", optarg, true);
             if (rate_limit < 0) {
                 return 1;
             }
@@ -2428,7 +2426,7 @@ static int img_convert(const img_cmd_t *ccmd, int argc, char **argv)
         {
             int64_t sval;
 
-            sval = cvtnum("buffer size for sparse output", optarg);
+            sval = cvtnum("buffer size for sparse output", optarg, true);
             if (sval < 0) {
                 goto fail_getopt;
             } else if (!QEMU_IS_ALIGNED(sval, BDRV_SECTOR_SIZE) ||
@@ -2462,16 +2460,15 @@ static int img_convert(const img_cmd_t *ccmd, int argc, char **argv)
             force_share = true;
             break;
         case 'r':
-            rate_limit = cvtnum("rate limit", optarg);
+            rate_limit = cvtnum("rate limit", optarg, true);
             if (rate_limit < 0) {
                 goto fail_getopt;
             }
             break;
         case 'm':
-            if (qemu_strtol(optarg, NULL, 0, &s.num_coroutines) ||
-                s.num_coroutines < 1 || s.num_coroutines > MAX_COROUTINES) {
-                error_report("Invalid number of coroutines. Allowed number of"
-                             " coroutines is between 1 and %d", MAX_COROUTINES);
+            s.num_coroutines = cvtnum_full("number of coroutines", optarg,
+                                           false, 1, MAX_COROUTINES);
+            if (s.num_coroutines < 0) {
                 goto fail_getopt;
             }
             break;
@@ -3376,13 +3373,13 @@ static int img_map(const img_cmd_t *ccmd, int argc, char **argv)
             image_opts = true;
             break;
         case 's':
-            start_offset = cvtnum("start offset", optarg);
+            start_offset = cvtnum("start offset", optarg, true);
             if (start_offset < 0) {
                 return 1;
             }
             break;
         case 'l':
-            max_length = cvtnum("max length", optarg);
+            max_length = cvtnum("max length", optarg, true);
             if (max_length < 0) {
                 return 1;
             }
@@ -4720,9 +4717,9 @@ static int img_bench(const img_cmd_t *ccmd, int argc, char **argv)
     int count = 75000;
     int depth = 64;
     int64_t offset = 0;
-    size_t bufsize = 4096;
+    ssize_t bufsize = 4096;
     int pattern = 0;
-    size_t step = 0;
+    ssize_t step = 0;
     int flush_interval = 0;
     bool drain_on_flush = true;
     int64_t image_size;
@@ -4827,27 +4824,17 @@ static int img_bench(const img_cmd_t *ccmd, int argc, char **argv)
             }
             break;
         case 'c':
-        {
-            unsigned long res;
-
-            if (qemu_strtoul(optarg, NULL, 0, &res) < 0 || res > INT_MAX) {
-                error_report("Invalid request count specified");
+            count = cvtnum_full("request count", optarg, false, 1, INT_MAX);
+            if (count < 0) {
                 return 1;
             }
-            count = res;
             break;
-        }
         case 'd':
-        {
-            unsigned long res;
-
-            if (qemu_strtoul(optarg, NULL, 0, &res) <= 0 || res > INT_MAX) {
-                error_report("Invalid queue depth specified");
+            depth = cvtnum_full("queue depth", optarg, false, 1, INT_MAX);
+            if (depth < 0) {
                 return 1;
             }
-            depth = res;
             break;
-        }
         case 'n':
             flags |= BDRV_O_NATIVE_AIO;
             break;
@@ -4860,64 +4847,40 @@ static int img_bench(const img_cmd_t *ccmd, int argc, char **argv)
             }
             break;
         case 'o':
-        {
-            offset = cvtnum("offset", optarg);
+            offset = cvtnum("offset", optarg, true);
             if (offset < 0) {
                 return 1;
             }
             break;
-        }
-            break;
         case 's':
-        {
-            int64_t sval;
-
-            sval = cvtnum_full("buffer size", optarg, 0, INT_MAX);
-            if (sval < 0) {
+            bufsize = cvtnum_full("buffer size", optarg, true, 1, INT_MAX);
+            if (bufsize < 0) {
                 return 1;
             }
-
-            bufsize = sval;
             break;
-        }
         case 'S':
-        {
-            int64_t sval;
-
-            sval = cvtnum_full("step_size", optarg, 0, INT_MAX);
-            if (sval < 0) {
+            step = cvtnum_full("step size", optarg, true, 0, INT_MAX);
+            if (step < 0) {
                 return 1;
             }
-
-            step = sval;
             break;
-        }
         case 'w':
             flags |= BDRV_O_RDWR;
             is_write = true;
             break;
         case OPTION_PATTERN:
-        {
-            unsigned long res;
-
-            if (qemu_strtoul(optarg, NULL, 0, &res) < 0 || res > 0xff) {
-                error_report("Invalid pattern byte specified");
+            pattern = cvtnum_full("pattern byte", optarg, false, 0, 0xff);
+            if (pattern < 0) {
                 return 1;
             }
-            pattern = res;
             break;
-        }
         case OPTION_FLUSH_INTERVAL:
-        {
-            unsigned long res;
-
-            if (qemu_strtoul(optarg, NULL, 0, &res) < 0 || res > INT_MAX) {
-                error_report("Invalid flush interval specified");
+            flush_interval = cvtnum_full("flush interval", optarg,
+                                         false, 0, INT_MAX);
+            if (flush_interval < 0) {
                 return 1;
             }
-            flush_interval = res;
             break;
-        }
         case OPTION_NO_DRAIN:
             drain_on_flush = false;
             break;
@@ -5129,7 +5092,7 @@ static int img_bitmap(const img_cmd_t *ccmd, int argc, char **argv)
             add = true;
             break;
         case 'g':
-            granularity = cvtnum("granularity", optarg);
+            granularity = cvtnum("granularity", optarg, true);
             if (granularity < 0) {
                 return 1;
             }
@@ -5314,7 +5277,7 @@ static int img_dd_bs(const char *arg,
 {
     int64_t res;
 
-    res = cvtnum_full("bs", arg, 1, INT_MAX);
+    res = cvtnum_full("bs", arg, true, 1, INT_MAX);
 
     if (res < 0) {
         return 1;
@@ -5328,7 +5291,7 @@ static int img_dd_count(const char *arg,
                         struct DdIo *in, struct DdIo *out,
                         struct DdInfo *dd)
 {
-    dd->count = cvtnum("count", arg);
+    dd->count = cvtnum("count", arg, true);
 
     if (dd->count < 0) {
         return 1;
@@ -5359,7 +5322,7 @@ static int img_dd_skip(const char *arg,
                        struct DdIo *in, struct DdIo *out,
                        struct DdInfo *dd)
 {
-    in->offset = cvtnum("skip", arg);
+    in->offset = cvtnum("skip", arg, true);
 
     if (in->offset < 0) {
         return 1;
@@ -5767,7 +5730,7 @@ static int img_measure(const img_cmd_t *ccmd, int argc, char **argv)
             user_creatable_process_cmdline(optarg);
             break;
         case 's':
-            img_size = cvtnum("image size", optarg);
+            img_size = cvtnum("image size", optarg, true);
             if (img_size < 0) {
                 goto out;
             }
diff --git a/tests/qemu-iotests/049.out b/tests/qemu-iotests/049.out
index 34e1b452e6..70c627538b 100644
--- a/tests/qemu-iotests/049.out
+++ b/tests/qemu-iotests/049.out
@@ -98,8 +98,7 @@ qemu-img create -f qcow2 -o size=-1024 TEST_DIR/t.qcow2
 qemu-img: TEST_DIR/t.qcow2: Value '-1024' is out of range for parameter 'size'
 
 qemu-img create -f qcow2 TEST_DIR/t.qcow2 -- -1k
-qemu-img: Invalid image size specified. You may use k, M, G, T, P or E suffixes for
-qemu-img: kilobytes, megabytes, gigabytes, terabytes, petabytes and exabytes.
+qemu-img: Invalid image size specified: '-1k'
 
 qemu-img create -f qcow2 -o size=-1k TEST_DIR/t.qcow2
 qemu-img: TEST_DIR/t.qcow2: Parameter 'size' expects a non-negative number below 2^64
@@ -107,8 +106,7 @@ Optional suffix k, M, G, T, P or E means kilo-, mega-, giga-, tera-, peta-
 and exabytes, respectively.
 
 qemu-img create -f qcow2 TEST_DIR/t.qcow2 -- 1kilobyte
-qemu-img: Invalid image size specified. You may use k, M, G, T, P or E suffixes for
-qemu-img: kilobytes, megabytes, gigabytes, terabytes, petabytes and exabytes.
+qemu-img: Invalid image size specified: '1kilobyte'
 
 qemu-img create -f qcow2 -o size=1kilobyte TEST_DIR/t.qcow2
 qemu-img: TEST_DIR/t.qcow2: Parameter 'size' expects a non-negative number below 2^64
@@ -116,8 +114,7 @@ Optional suffix k, M, G, T, P or E means kilo-, mega-, giga-, tera-, peta-
 and exabytes, respectively.
 
 qemu-img create -f qcow2 TEST_DIR/t.qcow2 -- foobar
-qemu-img: Invalid image size specified. You may use k, M, G, T, P or E suffixes for
-qemu-img: kilobytes, megabytes, gigabytes, terabytes, petabytes and exabytes.
+qemu-img: Invalid image size specified: 'foobar'
 
 qemu-img create -f qcow2 -o size=foobar TEST_DIR/t.qcow2
 qemu-img: TEST_DIR/t.qcow2: Parameter 'size' expects a non-negative number below 2^64

From ec5c2e7f38ee05c3edc81f2d0873141e4d8d074e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 4 Jul 2025 00:25:04 +0200
Subject: [PATCH 2486/2760] accel/hvf: Implement AccelClass::get_vcpu_stats()
 handler
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-developed-by: Mads Ynddal <mads@ynddal.dk>
Signed-off-by: Mads Ynddal <mads@ynddal.dk>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250715104015.72663-8-philmd@linaro.org>
---
 accel/hvf/hvf-accel-ops.c | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/accel/hvf/hvf-accel-ops.c b/accel/hvf/hvf-accel-ops.c
index 214454bd0b..d488d6afba 100644
--- a/accel/hvf/hvf-accel-ops.c
+++ b/accel/hvf/hvf-accel-ops.c
@@ -58,6 +58,7 @@
 #include "system/cpus.h"
 #include "system/hvf.h"
 #include "system/hvf_int.h"
+#include <mach/mach_time.h>
 
 HVFState *hvf_state;
 
@@ -118,6 +119,12 @@ static void dummy_signal(int sig)
 {
 }
 
+static void do_hvf_get_vcpu_exec_time(CPUState *cpu, run_on_cpu_data arg)
+{
+    int r = hv_vcpu_get_exec_time(cpu->accel->fd, arg.host_ptr);
+    assert_hvf_ok(r);
+}
+
 static void hvf_vcpu_destroy(CPUState *cpu)
 {
     hv_return_t ret = hv_vcpu_destroy(cpu->accel->fd);
@@ -347,6 +354,21 @@ static void hvf_remove_all_breakpoints(CPUState *cpu)
     }
 }
 
+static void hvf_get_vcpu_stats(CPUState *cpu, GString *buf)
+{
+    uint64_t time_mach; /* units of mach_absolute_time() */
+
+    run_on_cpu(cpu, do_hvf_get_vcpu_exec_time, RUN_ON_CPU_HOST_PTR(&time_mach));
+
+    mach_timebase_info_data_t timebase;
+    mach_timebase_info(&timebase);
+    uint64_t time_ns = time_mach * timebase.numer / timebase.denom;
+
+    g_string_append_printf(buf, "HVF cumulative execution time: %llu.%.3llus\n",
+                                 time_ns / 1000000000,
+                                (time_ns % 1000000000) / 1000000);
+}
+
 static void hvf_accel_ops_class_init(ObjectClass *oc, const void *data)
 {
     AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
@@ -365,7 +387,10 @@ static void hvf_accel_ops_class_init(ObjectClass *oc, const void *data)
     ops->remove_all_breakpoints = hvf_remove_all_breakpoints;
     ops->update_guest_debug = hvf_update_guest_debug;
     ops->supports_guest_debug = hvf_arch_supports_guest_debug;
+
+    ops->get_vcpu_stats = hvf_get_vcpu_stats;
 };
+
 static const TypeInfo hvf_accel_ops_type = {
     .name = ACCEL_OPS_NAME("hvf"),
 

From 5a67e43096484ba11470b5b9aea5d78e32fded63 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 17 Jun 2025 06:44:18 +0200
Subject: [PATCH 2487/2760] system/runstate: Document
 qemu_add_vm_change_state_handler()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Message-Id: <20250703173248.44995-4-philmd@linaro.org>
---
 include/system/runstate.h | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/include/system/runstate.h b/include/system/runstate.h
index fdd5c4a517..b6e8d6beab 100644
--- a/include/system/runstate.h
+++ b/include/system/runstate.h
@@ -14,6 +14,16 @@ void runstate_replay_enable(void);
 typedef void VMChangeStateHandler(void *opaque, bool running, RunState state);
 typedef int VMChangeStateHandlerWithRet(void *opaque, bool running, RunState state);
 
+/**
+ * qemu_add_vm_change_state_handler:
+ * @cb: the callback to invoke
+ * @opaque: user data passed to the callback
+ *
+ * Register a callback function that is invoked when the vm starts or stops
+ * running.
+ *
+ * Returns: an entry to be freed using qemu_del_vm_change_state_handler()
+ */
 VMChangeStateEntry *qemu_add_vm_change_state_handler(VMChangeStateHandler *cb,
                                                      void *opaque);
 VMChangeStateEntry *qemu_add_vm_change_state_handler_prio(

From 0a94a7b8802b7f6dc2521e48d837d1b5173f9db4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 15 Jul 2025 19:14:34 +0200
Subject: [PATCH 2488/2760] system/runstate: Document
 qemu_add_vm_change_state_handler_prio* in hdr
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Generally APIs to the rest of QEMU should be documented in the headers.
Comments on individual functions or internal details are fine to live
in the C files. Make qemu_add_vm_change_state_handler_prio[_full]()
docstrings consistent by moving them from source to header.

Suggested-by: Xiaoyao Li <xiaoyao.li@intel.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20250715171920.89670-1-philmd@linaro.org>
---
 include/system/runstate.h | 30 ++++++++++++++++++++++++++++++
 system/runstate.c         | 30 ------------------------------
 2 files changed, 30 insertions(+), 30 deletions(-)

diff --git a/include/system/runstate.h b/include/system/runstate.h
index b6e8d6beab..b8d1bc3d27 100644
--- a/include/system/runstate.h
+++ b/include/system/runstate.h
@@ -26,9 +26,39 @@ typedef int VMChangeStateHandlerWithRet(void *opaque, bool running, RunState sta
  */
 VMChangeStateEntry *qemu_add_vm_change_state_handler(VMChangeStateHandler *cb,
                                                      void *opaque);
+/**
+ * qemu_add_vm_change_state_handler_prio:
+ * @cb: the callback to invoke
+ * @opaque: user data passed to the callback
+ * @priority: low priorities execute first when the vm runs and the reverse is
+ *            true when the vm stops
+ *
+ * Register a callback function that is invoked when the vm starts or stops
+ * running.
+ *
+ * Returns: an entry to be freed using qemu_del_vm_change_state_handler()
+ */
 VMChangeStateEntry *qemu_add_vm_change_state_handler_prio(
         VMChangeStateHandler *cb, void *opaque, int priority);
 VMChangeStateEntry *
+/**
+ * qemu_add_vm_change_state_handler_prio_full:
+ * @cb: the main callback to invoke
+ * @prepare_cb: a callback to invoke before the main callback
+ * @cb_ret: the main callback to invoke with return value
+ * @opaque: user data passed to the callbacks
+ * @priority: low priorities execute first when the vm runs and the reverse is
+ *            true when the vm stops
+ *
+ * Register a main callback function and an optional prepare callback function
+ * that are invoked when the vm starts or stops running. The main callback and
+ * the prepare callback are called in two separate phases: First all prepare
+ * callbacks are called and only then all main callbacks are called. As its
+ * name suggests, the prepare callback can be used to do some preparatory work
+ * before invoking the main callback.
+ *
+ * Returns: an entry to be freed using qemu_del_vm_change_state_handler()
+ */
 qemu_add_vm_change_state_handler_prio_full(VMChangeStateHandler *cb,
                                            VMChangeStateHandler *prepare_cb,
                                            VMChangeStateHandlerWithRet *cb_ret,
diff --git a/system/runstate.c b/system/runstate.c
index 38900c935a..fa32aa4795 100644
--- a/system/runstate.c
+++ b/system/runstate.c
@@ -306,18 +306,6 @@ struct VMChangeStateEntry {
 static QTAILQ_HEAD(, VMChangeStateEntry) vm_change_state_head =
     QTAILQ_HEAD_INITIALIZER(vm_change_state_head);
 
-/**
- * qemu_add_vm_change_state_handler_prio:
- * @cb: the callback to invoke
- * @opaque: user data passed to the callback
- * @priority: low priorities execute first when the vm runs and the reverse is
- *            true when the vm stops
- *
- * Register a callback function that is invoked when the vm starts or stops
- * running.
- *
- * Returns: an entry to be freed using qemu_del_vm_change_state_handler()
- */
 VMChangeStateEntry *qemu_add_vm_change_state_handler_prio(
         VMChangeStateHandler *cb, void *opaque, int priority)
 {
@@ -325,24 +313,6 @@ VMChangeStateEntry *qemu_add_vm_change_state_handler_prio(
                                                       opaque, priority);
 }
 
-/**
- * qemu_add_vm_change_state_handler_prio_full:
- * @cb: the main callback to invoke
- * @prepare_cb: a callback to invoke before the main callback
- * @cb_ret: the main callback to invoke with return value
- * @opaque: user data passed to the callbacks
- * @priority: low priorities execute first when the vm runs and the reverse is
- *            true when the vm stops
- *
- * Register a main callback function and an optional prepare callback function
- * that are invoked when the vm starts or stops running. The main callback and
- * the prepare callback are called in two separate phases: First all prepare
- * callbacks are called and only then all main callbacks are called. As its
- * name suggests, the prepare callback can be used to do some preparatory work
- * before invoking the main callback.
- *
- * Returns: an entry to be freed using qemu_del_vm_change_state_handler()
- */
 VMChangeStateEntry *
 qemu_add_vm_change_state_handler_prio_full(VMChangeStateHandler *cb,
                                            VMChangeStateHandler *prepare_cb,

From 3ac6daa9e1c5d7dae2a3cd1c6a388174b462f3e8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Wed, 4 Jun 2025 16:47:31 +0100
Subject: [PATCH 2489/2760] ui: fix setting client_endian field defaults
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When a VNC client sends a "set pixel format" message, the
'client_endian' field will get initialized, however, it is
valid to omit this message if the client wants to use the
server's native pixel format. In the latter scenario nothing
is initializing the 'client_endian' field, so it remains set
to 0, matching neither G_LITTLE_ENDIAN nor G_BIG_ENDIAN. This
then results in pixel format conversion routines taking the
wrong code paths.

This problem existed before the 'client_be' flag was changed
into the 'client_endian' value, but the lack of initialization
meant it semantically defaulted to little endian, so only big
endian systems would potentially be exposed to incorrect pixel
translation.

The 'virt-viewer' / 'remote-viewer' apps always send a "set
pixel format" message so aren't exposed to any problems, but
the classical 'vncviewer' app will show the problem easily.

Fixes: 7ed96710e82c385c6cfc3d064eec7dde20f0f3fd
Reported-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 ui/vnc.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/ui/vnc.c b/ui/vnc.c
index e9c30aad62..a16be468b9 100644
--- a/ui/vnc.c
+++ b/ui/vnc.c
@@ -2329,6 +2329,7 @@ static void pixel_format_message (VncState *vs) {
     char pad[3] = { 0, 0, 0 };
 
     vs->client_pf = qemu_default_pixelformat(32);
+    vs->client_endian = G_BYTE_ORDER;
 
     vnc_write_u8(vs, vs->client_pf.bits_per_pixel); /* bits-per-pixel */
     vnc_write_u8(vs, vs->client_pf.depth); /* depth */

From 8fc3d63d685751734fb9c8c0284dc44a36a8e053 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Wed, 4 Jun 2025 17:14:38 +0100
Subject: [PATCH 2490/2760] ui: add trace events for all client messages
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This lets us see the full flow of RFB messages received from the
client.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 ui/trace-events | 14 +++++++++++++
 ui/vnc.c        | 52 +++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 66 insertions(+)

diff --git a/ui/trace-events b/ui/trace-events
index 3da0d5e280..3eba9ca3a8 100644
--- a/ui/trace-events
+++ b/ui/trace-events
@@ -48,13 +48,27 @@ vnc_msg_server_ext_desktop_resize(void *state, void *ioc, int width, int height,
 vnc_msg_client_audio_enable(void *state, void *ioc) "VNC client msg audio enable state=%p ioc=%p"
 vnc_msg_client_audio_disable(void *state, void *ioc) "VNC client msg audio disable state=%p ioc=%p"
 vnc_msg_client_audio_format(void *state, void *ioc, int fmt, int channels, int freq) "VNC client msg audio format state=%p ioc=%p fmt=%d channels=%d freq=%d"
+vnc_msg_client_cut_text(void *state, void *ioc, int len) "VNC client msg cut text state=%p ioc=%p len=%u"
+vnc_msg_client_cut_text_ext(void *state, void *ioc, int len, int flags) "VNC client msg cut text state=%p ioc=%p len=%u flags=%u"
+vnc_msg_client_ext_key_event(void *state, void *ioc, int down, int sym, int keycode) "VNC client msg ext key event state=%p ioc=%p down=%u sym=%u keycode=%u"
+vnc_msg_client_framebuffer_update_request(void *state, void *ioc, int incremental, int x, int y, int w, int h) "VNC client msg framebuffer update request state=%p ioc=%p incremental=%u x=%u y=%u w=%u h=%u"
+vnc_msg_client_key_event(void *state, void *ioc, int down, int sym) "VNC client msg key event state=%p ioc=%p down=%u sym=%u"
+vnc_msg_client_pointer_event(void *state, void *ioc, int button_mask, int x, int y) "VNC client msg pointer event state=%p ioc=%p button_mask=%u x=%u y=%u"
 vnc_msg_client_set_desktop_size(void *state, void *ioc, int width, int height, int screens) "VNC client msg set desktop size  state=%p ioc=%p size=%dx%d screens=%d"
+vnc_msg_client_set_encodings(void *state, void *ioc, int limit) "VNC client msg set encodings state=%p ioc=%p limit=%u"
+vnc_msg_client_set_pixel_format(void *state, void *ioc, int bpp, int big_endian, int true_color) "VNC client msg set pixel format state=%p ioc=%p bpp=%u big_endian=%u true_color=%u"
+vnc_msg_client_set_pixel_format_rgb(void *state, void *ioc, int red_max, int green_max, int blue_max, int red_shift, int green_shift, int blue_shift) "VNC client msg set pixel format RGB state=%p ioc=%p red_max=%u green_max=%u blue_max=%u red_shift=%u green_shift=%u blue_shift=%u"
+vnc_msg_client_xvp(void *state, void *ioc, int version, int action) "VNC client msg XVP state=%p ioc=%p version=%u action=%u"
 vnc_client_eof(void *state, void *ioc) "VNC client EOF state=%p ioc=%p"
 vnc_client_io_error(void *state, void *ioc, const char *msg) "VNC client I/O error state=%p ioc=%p errmsg=%s"
 vnc_client_connect(void *state, void *ioc) "VNC client connect state=%p ioc=%p"
 vnc_client_disconnect_start(void *state, void *ioc) "VNC client disconnect start state=%p ioc=%p"
 vnc_client_disconnect_finish(void *state, void *ioc) "VNC client disconnect finish state=%p ioc=%p"
 vnc_client_io_wrap(void *state, void *ioc, const char *type) "VNC client I/O wrap state=%p ioc=%p type=%s"
+vnc_client_pixel_format(void *state, void *ioc, int bpp, int depth, int endian) "VNC client pixel format state=%p ioc=%p bpp=%u depth=%u endian=%u"
+vnc_client_pixel_format_red(void *state, void *ioc, int max, int bits, int shift, int mask) "VNC client pixel format red state=%p ioc=%p max=%u bits=%u shift=%u mask=%u"
+vnc_client_pixel_format_green(void *state, void *ioc, int max, int bits, int shift, int mask) "VNC client pixel format green state=%p ioc=%p max=%u bits=%u shift=%u mask=%u"
+vnc_client_pixel_format_blue(void *state, void *ioc, int max, int bits, int shift, int mask) "VNC client pixel format blue state=%p ioc=%p max=%u bits=%u shift=%u mask=%u"
 vnc_client_throttle_threshold(void *state, void *ioc, size_t oldoffset, size_t offset, int client_width, int client_height, int bytes_per_pixel, void *audio_cap) "VNC client throttle threshold state=%p ioc=%p oldoffset=%zu newoffset=%zu width=%d height=%d bpp=%d audio=%p"
 vnc_client_throttle_incremental(void *state, void *ioc, int job_update, size_t offset) "VNC client throttle incremental state=%p ioc=%p job-update=%d offset=%zu"
 vnc_client_throttle_forced(void *state, void *ioc, int job_update, size_t offset) "VNC client throttle forced state=%p ioc=%p job-update=%d offset=%zu"
diff --git a/ui/vnc.c b/ui/vnc.c
index a16be468b9..c309882ddb 100644
--- a/ui/vnc.c
+++ b/ui/vnc.c
@@ -2314,6 +2314,25 @@ static void set_pixel_format(VncState *vs, int bits_per_pixel,
     vs->client_pf.bytes_per_pixel = bits_per_pixel / 8;
     vs->client_pf.depth = bits_per_pixel == 32 ? 24 : bits_per_pixel;
     vs->client_endian = big_endian_flag ? G_BIG_ENDIAN : G_LITTLE_ENDIAN;
+    trace_vnc_client_pixel_format(vs, vs->ioc,
+                                  vs->client_pf.bits_per_pixel,
+                                  vs->client_pf.depth,
+                                  vs->client_endian);
+    trace_vnc_client_pixel_format_red(vs, vs->ioc,
+                                      vs->client_pf.rmax,
+                                      vs->client_pf.rbits,
+                                      vs->client_pf.rshift,
+                                      vs->client_pf.rmask);
+    trace_vnc_client_pixel_format_green(vs, vs->ioc,
+                                        vs->client_pf.gmax,
+                                        vs->client_pf.gbits,
+                                        vs->client_pf.gshift,
+                                        vs->client_pf.gmask);
+    trace_vnc_client_pixel_format_blue(vs, vs->ioc,
+                                       vs->client_pf.bmax,
+                                       vs->client_pf.bbits,
+                                       vs->client_pf.bshift,
+                                       vs->client_pf.bmask);
 
     if (!true_color_flag) {
         send_color_map(vs);
@@ -2388,6 +2407,17 @@ static int protocol_client_msg(VncState *vs, uint8_t *data, size_t len)
         if (len == 1)
             return 20;
 
+        trace_vnc_msg_client_set_pixel_format(vs, vs->ioc,
+                                              read_u8(data, 4),
+                                              read_u8(data, 6),
+                                              read_u8(data, 7));
+        trace_vnc_msg_client_set_pixel_format_rgb(vs, vs->ioc,
+                                                  read_u16(data, 8),
+                                                  read_u16(data, 10),
+                                                  read_u16(data, 12),
+                                                  read_u8(data, 14),
+                                                  read_u8(data, 15),
+                                                  read_u8(data, 16));
         set_pixel_format(vs, read_u8(data, 4),
                          read_u8(data, 6), read_u8(data, 7),
                          read_u16(data, 8), read_u16(data, 10),
@@ -2410,12 +2440,19 @@ static int protocol_client_msg(VncState *vs, uint8_t *data, size_t len)
             memcpy(data + 4 + (i * 4), &val, sizeof(val));
         }
 
+        trace_vnc_msg_client_set_encodings(vs, vs->ioc, limit);
         set_encodings(vs, (int32_t *)(data + 4), limit);
         break;
     case VNC_MSG_CLIENT_FRAMEBUFFER_UPDATE_REQUEST:
         if (len == 1)
             return 10;
 
+        trace_vnc_msg_client_framebuffer_update_request(vs, vs->ioc,
+                                                        read_u8(data, 1),
+                                                        read_u16(data, 2),
+                                                        read_u16(data, 4),
+                                                        read_u16(data, 6),
+                                                        read_u16(data, 8));
         framebuffer_update_request(vs,
                                    read_u8(data, 1), read_u16(data, 2), read_u16(data, 4),
                                    read_u16(data, 6), read_u16(data, 8));
@@ -2424,12 +2461,19 @@ static int protocol_client_msg(VncState *vs, uint8_t *data, size_t len)
         if (len == 1)
             return 8;
 
+        trace_vnc_msg_client_key_event(vs, vs->ioc,
+                                       read_u8(data, 1),
+                                       read_u32(data, 4));
         key_event(vs, read_u8(data, 1), read_u32(data, 4));
         break;
     case VNC_MSG_CLIENT_POINTER_EVENT:
         if (len == 1)
             return 6;
 
+        trace_vnc_msg_client_pointer_event(vs, vs->ioc,
+                                           read_u8(data, 1),
+                                           read_u16(data, 2),
+                                           read_u16(data, 4));
         pointer_event(vs, read_u8(data, 1), read_u16(data, 2), read_u16(data, 4));
         break;
     case VNC_MSG_CLIENT_CUT_TEXT:
@@ -2461,9 +2505,12 @@ static int protocol_client_msg(VncState *vs, uint8_t *data, size_t len)
                 vnc_client_error(vs);
                 break;
             }
+            trace_vnc_msg_client_cut_text_ext(vs, vs->ioc,
+                                              dlen, read_u32(data, 8));
             vnc_client_cut_text_ext(vs, dlen, read_u32(data, 8), data + 12);
             break;
         }
+        trace_vnc_msg_client_cut_text(vs, vs->ioc, read_u32(data, 4));
         vnc_client_cut_text(vs, read_u32(data, 4), data + 8);
         break;
     case VNC_MSG_CLIENT_XVP:
@@ -2478,6 +2525,7 @@ static int protocol_client_msg(VncState *vs, uint8_t *data, size_t len)
         if (len == 4) {
             uint8_t version = read_u8(data, 2);
             uint8_t action = read_u8(data, 3);
+            trace_vnc_msg_client_xvp(vs, vs->ioc, version, action);
 
             if (version != 1) {
                 error_report("vnc: xvp client message version %d != 1",
@@ -2511,6 +2559,10 @@ static int protocol_client_msg(VncState *vs, uint8_t *data, size_t len)
             if (len == 2)
                 return 12;
 
+            trace_vnc_msg_client_ext_key_event(vs, vs->ioc,
+                                               read_u16(data, 2),
+                                               read_u32(data, 4),
+                                               read_u32(data, 8));
             ext_key_event(vs, read_u16(data, 2),
                           read_u32(data, 4), read_u32(data, 8));
             break;

From 2183ab62512c6253293e83cce3970b0b42e65630 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Thu, 10 Jul 2025 15:44:17 +0100
Subject: [PATCH 2491/2760] crypto/x509-utils: Check for error from
 gnutls_x509_crt_init()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Coverity notes that in qcrypto_get_x509_cert_fingerprint() we
call gnutls_x509_crt_init() but don't check for an error return.
Add the missing check.

Coverity: CID 1593155
Fixes: 10a1d34fc0d ("crypto: Introduce x509 utils")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 crypto/x509-utils.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/crypto/x509-utils.c b/crypto/x509-utils.c
index 8bad00a51b..39bb6d4d8c 100644
--- a/crypto/x509-utils.c
+++ b/crypto/x509-utils.c
@@ -46,7 +46,11 @@ int qcrypto_get_x509_cert_fingerprint(uint8_t *cert, size_t size,
         return -1;
     }
 
-    gnutls_x509_crt_init(&crt);
+    if (gnutls_x509_crt_init(&crt) < 0) {
+        error_setg(errp, "Unable to initialize certificate: %s",
+                   gnutls_strerror(ret));
+        return -1;
+    }
 
     if (gnutls_x509_crt_import(crt, &datum, GNUTLS_X509_FMT_PEM) != 0) {
         error_setg(errp, "Failed to import certificate");

From 44b540338a3e271866a3d636359bfe6b2edecbb6 Mon Sep 17 00:00:00 2001
From: Sean Wei <me@sean.taipei>
Date: Fri, 13 Jun 2025 22:08:40 -0400
Subject: [PATCH 2492/2760] fsdev/9p-marshal: move G_GNUC_PRINTF to header
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

v9fs_string_sprintf() is annotated with G_GNUC_PRINTF(2, 3) in
9p-marshal.c, but the prototype in fsdev/9p-marshal.h is missing the
attribute, so callers that include only the header do not get format
checking.

Move the annotation to the header and delete the duplicate in the
source file. No behavior change.

Signed-off-by: Sean Wei <me@sean.taipei>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20250613.qemu.9p.01@sean.taipei>
[CS: fix code style (max. 80 chars per line)]
Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
---
 fsdev/9p-marshal.c | 3 +--
 fsdev/9p-marshal.h | 3 ++-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/fsdev/9p-marshal.c b/fsdev/9p-marshal.c
index f9b0336cd5..3455580703 100644
--- a/fsdev/9p-marshal.c
+++ b/fsdev/9p-marshal.c
@@ -27,8 +27,7 @@ void v9fs_string_free(V9fsString *str)
     str->size = 0;
 }
 
-void G_GNUC_PRINTF(2, 3)
-v9fs_string_sprintf(V9fsString *str, const char *fmt, ...)
+void v9fs_string_sprintf(V9fsString *str, const char *fmt, ...)
 {
     va_list ap;
 
diff --git a/fsdev/9p-marshal.h b/fsdev/9p-marshal.h
index f1abbe151c..8995e42067 100644
--- a/fsdev/9p-marshal.h
+++ b/fsdev/9p-marshal.h
@@ -76,7 +76,8 @@ static inline void v9fs_string_init(V9fsString *str)
     str->size = 0;
 }
 void v9fs_string_free(V9fsString *str);
-void v9fs_string_sprintf(V9fsString *str, const char *fmt, ...);
+void G_GNUC_PRINTF(2, 3) v9fs_string_sprintf(V9fsString *str, const char *fmt,
+                                             ...);
 void v9fs_string_copy(V9fsString *lhs, V9fsString *rhs);
 
 #endif

From 44f51c1a3cf435daa82eb757740b59b1fd4fe71c Mon Sep 17 00:00:00 2001
From: Sean Wei <me@sean.taipei>
Date: Fri, 13 Jun 2025 22:09:20 -0400
Subject: [PATCH 2493/2760] hw/9pfs: move G_GNUC_PRINTF to header
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

v9fs_path_sprintf() is annotated with G_GNUC_PRINTF(2, 3) in
hw/9pfs/9p.c, but the prototype in hw/9pfs/9p.h is missing the
attribute, so callers that include only the header do not get format
checking.

Move the annotation to the header and delete the duplicate in the
source file. No behavior change.

Signed-off-by: Sean Wei <me@sean.taipei>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250613.qemu.9p.02@sean.taipei>
[CS: fix code style (max. 80 chars per line)]
Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
---
 hw/9pfs/9p.c | 3 +--
 hw/9pfs/9p.h | 3 ++-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c
index 8b001b9112..acfa7db4e1 100644
--- a/hw/9pfs/9p.c
+++ b/hw/9pfs/9p.c
@@ -201,8 +201,7 @@ void v9fs_path_free(V9fsPath *path)
 }
 
 
-void G_GNUC_PRINTF(2, 3)
-v9fs_path_sprintf(V9fsPath *path, const char *fmt, ...)
+void v9fs_path_sprintf(V9fsPath *path, const char *fmt, ...)
 {
     va_list ap;
 
diff --git a/hw/9pfs/9p.h b/hw/9pfs/9p.h
index 259ad32ed1..65cc45e344 100644
--- a/hw/9pfs/9p.h
+++ b/hw/9pfs/9p.h
@@ -456,7 +456,8 @@ static inline uint8_t v9fs_request_cancelled(V9fsPDU *pdu)
 void coroutine_fn v9fs_reclaim_fd(V9fsPDU *pdu);
 void v9fs_path_init(V9fsPath *path);
 void v9fs_path_free(V9fsPath *path);
-void v9fs_path_sprintf(V9fsPath *path, const char *fmt, ...);
+void G_GNUC_PRINTF(2, 3) v9fs_path_sprintf(V9fsPath *path, const char *fmt,
+                                           ...);
 void v9fs_path_copy(V9fsPath *dst, const V9fsPath *src);
 size_t v9fs_readdir_response_size(V9fsString *name);
 int v9fs_name_to_path(V9fsState *s, V9fsPath *dirpath,

From 8eb6d39e22a2f9ea1a415d95d3c3ac5d5752b6d7 Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Fri, 11 Jul 2025 08:45:01 -0700
Subject: [PATCH 2494/2760] qom: qom-list-get
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Using qom-list and qom-get to get all the nodes and property values in
a QOM tree can take multiple seconds because it requires 1000's of
individual QOM requests.  Some managers fetch the entire tree or a
large subset of it when starting a new VM, and this cost is a
substantial fraction of start up time.

Define the qom-list-get command, which fetches all the properties and
values for a list of paths.  This can be much faster than qom-list
plus qom-get.  When getting an entire QOM tree, I measured a 10x
speedup in elapsed time.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <1752248703-217318-2-git-send-email-steven.sistare@oracle.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
---
 qapi/qom.json      | 50 +++++++++++++++++++++++++++++++++++++++++++
 qom/qom-qmp-cmds.c | 53 ++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 103 insertions(+)

diff --git a/qapi/qom.json b/qapi/qom.json
index 96d56df6cd..830cb2ffe7 100644
--- a/qapi/qom.json
+++ b/qapi/qom.json
@@ -47,6 +47,34 @@
             '*description': 'str',
             '*default-value': 'any' } }
 
+##
+# @ObjectPropertyValue:
+#
+# @name: the name of the property.
+#
+# @type: the type of the property, as described in `ObjectPropertyInfo`.
+#
+# @value: the value of the property.  Absent when the property cannot
+#     be read.
+#
+# Since 10.1
+##
+{ 'struct': 'ObjectPropertyValue',
+  'data': { 'name': 'str',
+            'type': 'str',
+            '*value': 'any' } }
+
+##
+# @ObjectPropertiesValues:
+#
+# @properties: a list of properties.
+#
+# Since 10.1
+##
+{ 'struct': 'ObjectPropertiesValues',
+  'data': { 'properties': [ 'ObjectPropertyValue' ] }}
+
+
 ##
 # @qom-list:
 #
@@ -124,6 +152,28 @@
   'returns': 'any',
   'allow-preconfig': true }
 
+##
+# @qom-list-get:
+#
+# List properties and their values for each object path in the input
+# list.
+#
+# @paths: The absolute or partial path for each object, as described
+#     in `qom-get`.
+#
+# Errors:
+#     - If any path is not valid or is ambiguous
+#
+# Returns: A list where each element is the result for the
+#     corresponding element of @paths.
+#
+# Since 10.1
+##
+{ 'command': 'qom-list-get',
+  'data': { 'paths': [ 'str' ] },
+  'returns': [ 'ObjectPropertiesValues' ],
+  'allow-preconfig': true }
+
 ##
 # @qom-set:
 #
diff --git a/qom/qom-qmp-cmds.c b/qom/qom-qmp-cmds.c
index 293755f409..57f1898cf6 100644
--- a/qom/qom-qmp-cmds.c
+++ b/qom/qom-qmp-cmds.c
@@ -69,6 +69,59 @@ ObjectPropertyInfoList *qmp_qom_list(const char *path, Error **errp)
     return props;
 }
 
+static void qom_list_add_property_value(Object *obj, ObjectProperty *prop,
+                                        ObjectPropertyValueList **props)
+{
+    ObjectPropertyValue *item = g_new0(ObjectPropertyValue, 1);
+
+    QAPI_LIST_PREPEND(*props, item);
+
+    item->name = g_strdup(prop->name);
+    item->type = g_strdup(prop->type);
+    item->value = object_property_get_qobject(obj, prop->name, NULL);
+}
+
+static ObjectPropertyValueList *qom_get_property_value_list(const char *path,
+                                                            Error **errp)
+{
+    Object *obj;
+    ObjectProperty *prop;
+    ObjectPropertyIterator iter;
+    ObjectPropertyValueList *props = NULL;
+
+    obj = qom_resolve_path(path, errp);
+    if (obj == NULL) {
+        return NULL;
+    }
+
+    object_property_iter_init(&iter, obj);
+    while ((prop = object_property_iter_next(&iter))) {
+        qom_list_add_property_value(obj, prop, &props);
+    }
+
+    return props;
+}
+
+ObjectPropertiesValuesList *qmp_qom_list_get(strList *paths, Error **errp)
+{
+    ObjectPropertiesValuesList *head = NULL, **tail = &head;
+    strList *path;
+
+    for (path = paths; path; path = path->next) {
+        ObjectPropertiesValues *item = g_new0(ObjectPropertiesValues, 1);
+
+        QAPI_LIST_APPEND(tail, item);
+
+        item->properties = qom_get_property_value_list(path->value, errp);
+        if (!item->properties) {
+            qapi_free_ObjectPropertiesValuesList(head);
+            return NULL;
+        }
+    }
+
+    return head;
+}
+
 void qmp_qom_set(const char *path, const char *property, QObject *value,
                  Error **errp)
 {

From 4ece9b61c90ce8cd5edb28ce1ba9e14992382fb0 Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Fri, 11 Jul 2025 08:45:02 -0700
Subject: [PATCH 2495/2760] python: use qom-list-get

Use qom-list-get to speed up the qom-tree command.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Acked-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <1752248703-217318-3-git-send-email-steven.sistare@oracle.com>
Tested-by: Markus Armbruster <armbru@redhat.com>
[Lint picked off to mollify make check-minreqs]
Signed-off-by: Markus Armbruster <armbru@redhat.com>
---
 python/qemu/utils/qom.py        | 45 +++++++++++++++------------
 python/qemu/utils/qom_common.py | 55 +++++++++++++++++++++++++++++++++
 2 files changed, 80 insertions(+), 20 deletions(-)

diff --git a/python/qemu/utils/qom.py b/python/qemu/utils/qom.py
index 426a0f245f..05e5f14179 100644
--- a/python/qemu/utils/qom.py
+++ b/python/qemu/utils/qom.py
@@ -31,8 +31,7 @@ QOM commands:
 ##
 
 import argparse
-
-from qemu.qmp import ExecuteError
+from typing import List
 
 from .qom_common import QOMCommand
 
@@ -224,28 +223,34 @@ class QOMTree(QOMCommand):
         super().__init__(args)
         self.path = args.path
 
-    def _list_node(self, path: str) -> None:
-        print(path)
-        items = self.qom_list(path)
-        for item in items:
-            if item.child:
-                continue
-            try:
-                rsp = self.qmp.cmd('qom-get', path=path,
-                                   property=item.name)
-                print(f"  {item.name}: {rsp} ({item.type})")
-            except ExecuteError as err:
-                print(f"  {item.name}: <EXCEPTION: {err!s}> ({item.type})")
-        print('')
-        for item in items:
-            if not item.child:
-                continue
+    def _list_nodes(self, paths: List[str]) -> None:
+        all_paths_props = self.qom_list_get(paths)
+        i = 0
+
+        for props in all_paths_props:
+            path = paths[i]
+            i = i + 1
+            print(path)
             if path == '/':
                 path = ''
-            self._list_node(f"{path}/{item.name}")
+            newpaths = []
+
+            for item in props.properties:
+                if item.child:
+                    newpaths += [f"{path}/{item.name}"]
+                else:
+                    value = item.value
+                    if value is None:
+                        value = "<EXCEPTION: property could not be read>"
+                    print(f"  {item.name}: {value} ({item.type})")
+
+            print('')
+
+            if newpaths:
+                self._list_nodes(newpaths)
 
     def run(self) -> int:
-        self._list_node(self.path)
+        self._list_nodes([self.path])
         return 0
 
 
diff --git a/python/qemu/utils/qom_common.py b/python/qemu/utils/qom_common.py
index dd2c8b1908..ab21a4d364 100644
--- a/python/qemu/utils/qom_common.py
+++ b/python/qemu/utils/qom_common.py
@@ -65,6 +65,52 @@ class ObjectPropertyInfo:
         return self.type.startswith('link<')
 
 
+class ObjectPropertyValue:
+    """
+    Represents a property return from e.g. qom-tree-get
+    """
+    def __init__(self, name: str, type_: str, value: object):
+        self.name = name
+        self.type = type_
+        self.value = value
+
+    @classmethod
+    def make(cls, value: Dict[str, Any]) -> 'ObjectPropertyValue':
+        """
+        Build an ObjectPropertyValue from a Dict with an unknown shape.
+        """
+        assert value.keys() >= {'name', 'type'}
+        assert value.keys() <= {'name', 'type', 'value'}
+        return cls(value['name'], value['type'], value.get('value'))
+
+    @property
+    def child(self) -> bool:
+        """Is this property a child property?"""
+        return self.type.startswith('child<')
+
+
+class ObjectPropertiesValues:
+    """
+    Represents the return type from e.g. qom-list-get
+    """
+    # pylint: disable=too-few-public-methods
+
+    def __init__(self, properties: List[ObjectPropertyValue]) -> None:
+        self.properties = properties
+
+    @classmethod
+    def make(cls, value: Dict[str, Any]) -> 'ObjectPropertiesValues':
+        """
+        Build an ObjectPropertiesValues from a Dict with an unknown shape.
+        """
+        assert value.keys() == {'properties'}
+        props = [ObjectPropertyValue(item['name'],
+                                     item['type'],
+                                     item.get('value'))
+                 for item in value['properties']]
+        return cls(props)
+
+
 CommandT = TypeVar('CommandT', bound='QOMCommand')
 
 
@@ -145,6 +191,15 @@ class QOMCommand:
         assert isinstance(rsp, list)
         return [ObjectPropertyInfo.make(x) for x in rsp]
 
+    def qom_list_get(self, paths: List[str]) -> List[ObjectPropertiesValues]:
+        """
+        :return: a strongly typed list from the 'qom-list-get' command.
+        """
+        rsp = self.qmp.cmd('qom-list-get', paths=paths)
+        # qom-list-get returns List[ObjectPropertiesValues]
+        assert isinstance(rsp, list)
+        return [ObjectPropertiesValues.make(x) for x in rsp]
+
     @classmethod
     def command_runner(
             cls: Type[CommandT],

From 3dd93992ffbd86a520e5f887d17179fd00ff0928 Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Fri, 11 Jul 2025 08:45:03 -0700
Subject: [PATCH 2496/2760] tests/qtest/qom-test: unit test for qom-list-get
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add a unit test for qom-list-get.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <1752248703-217318-4-git-send-email-steven.sistare@oracle.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
---
 tests/qtest/qom-test.c | 116 ++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 115 insertions(+), 1 deletion(-)

diff --git a/tests/qtest/qom-test.c b/tests/qtest/qom-test.c
index 27d70bc11c..4ade1c728c 100644
--- a/tests/qtest/qom-test.c
+++ b/tests/qtest/qom-test.c
@@ -11,11 +11,119 @@
 
 #include "qobject/qdict.h"
 #include "qobject/qlist.h"
+#include "qobject/qstring.h"
 #include "qemu/cutils.h"
 #include "libqtest.h"
 
+#define RAM_NAME "node0"
+#define RAM_SIZE 65536
+
 static int verbosity_level;
 
+/*
+ * Verify that the /object/RAM_NAME 'size' property is RAM_SIZE.
+ */
+static void test_list_get_value(QTestState *qts)
+{
+    QDict *args = qdict_new();
+    g_autoptr(QDict) response = NULL;
+    g_autoptr(QList) paths = qlist_new();
+    QListEntry *entry, *prop_entry;
+    const char *prop_name;
+    QList *properties, *return_list;
+    QDict *obj;
+
+    qlist_append_str(paths, "/objects/" RAM_NAME);
+    qdict_put_obj(args, "paths", QOBJECT(qlist_copy(paths)));
+    response = qtest_qmp(qts, "{ 'execute': 'qom-list-get',"
+                              "  'arguments': %p }", args);
+    g_assert(response);
+    g_assert(qdict_haskey(response, "return"));
+    return_list = qobject_to(QList, qdict_get(response, "return"));
+
+    entry = QTAILQ_FIRST(&return_list->head);
+    obj = qobject_to(QDict, qlist_entry_obj(entry));
+    g_assert(qdict_haskey(obj, "properties"));
+    properties = qobject_to(QList, qdict_get(obj, "properties"));
+
+    QLIST_FOREACH_ENTRY(properties, prop_entry) {
+        QDict *prop = qobject_to(QDict, qlist_entry_obj(prop_entry));
+
+        g_assert(qdict_haskey(prop, "name"));
+        g_assert(qdict_haskey(prop, "value"));
+
+        prop_name = qdict_get_str(prop, "name");
+        if (!strcmp(prop_name, "type")) {
+            g_assert_cmpstr(qdict_get_str(prop, "value"), ==,
+                            "memory-backend-ram");
+
+        } else if (!strcmp(prop_name, "size")) {
+            g_assert_cmpint(qdict_get_int(prop, "value"), ==, RAM_SIZE);
+        }
+    }
+}
+
+static void test_list_get(QTestState *qts, QList *paths)
+{
+    QListEntry *entry, *prop_entry, *path_entry;
+    g_autoptr(QDict) response = NULL;
+    QDict *args = qdict_new();
+    QDict *prop;
+    QList *return_list;
+
+    if (verbosity_level >= 2) {
+        g_test_message("Obtaining properties for paths:");
+        QLIST_FOREACH_ENTRY(paths, path_entry) {
+            QString *qstr = qobject_to(QString, qlist_entry_obj(path_entry));
+            g_test_message("  %s", qstring_get_str(qstr));
+        }
+    }
+
+    qdict_put_obj(args, "paths", QOBJECT(qlist_copy(paths)));
+    response = qtest_qmp(qts, "{ 'execute': 'qom-list-get',"
+                              "  'arguments': %p }", args);
+    g_assert(response);
+    g_assert(qdict_haskey(response, "return"));
+    return_list = qobject_to(QList, qdict_get(response, "return"));
+    g_assert(!qlist_empty(return_list));
+
+    path_entry = QTAILQ_FIRST(&paths->head);
+    QLIST_FOREACH_ENTRY(return_list, entry) {
+        QDict *obj = qobject_to(QDict, qlist_entry_obj(entry));
+        g_assert(qdict_haskey(obj, "properties"));
+        QList *properties = qobject_to(QList, qdict_get(obj, "properties"));
+        bool has_child = false;
+
+        QLIST_FOREACH_ENTRY(properties, prop_entry) {
+            prop = qobject_to(QDict, qlist_entry_obj(prop_entry));
+            g_assert(qdict_haskey(prop, "name"));
+            g_assert(qdict_haskey(prop, "type"));
+            has_child |= strstart(qdict_get_str(prop, "type"), "child<", NULL);
+        }
+
+        if (has_child) {
+            /* build a list of child paths */
+            QString *qstr = qobject_to(QString, qlist_entry_obj(path_entry));
+            const char *path = qstring_get_str(qstr);
+            g_autoptr(QList) child_paths = qlist_new();
+
+            QLIST_FOREACH_ENTRY(properties, prop_entry) {
+                prop = qobject_to(QDict, qlist_entry_obj(prop_entry));
+                if (strstart(qdict_get_str(prop, "type"), "child<", NULL)) {
+                    g_autofree char *child_path = g_strdup_printf(
+                        "%s/%s", path, qdict_get_str(prop, "name"));
+                    qlist_append_str(child_paths, child_path);
+                }
+            }
+
+            /* fetch props for all children with one qom-list-get call */
+            test_list_get(qts, child_paths);
+        }
+
+        path_entry = QTAILQ_NEXT(path_entry, next);
+    }
+}
+
 static void test_properties(QTestState *qts, const char *path, bool recurse)
 {
     char *child_path;
@@ -85,8 +193,10 @@ static void test_machine(gconstpointer data)
     const char *machine = data;
     QDict *response;
     QTestState *qts;
+    g_autoptr(QList) paths = qlist_new();
 
-    qts = qtest_initf("-machine %s", machine);
+    qts = qtest_initf("-machine %s -object memory-backend-ram,id=%s,size=%d",
+                      machine, RAM_NAME, RAM_SIZE);
 
     if (g_test_slow()) {
         /* Make sure we can get the machine class properties: */
@@ -101,6 +211,10 @@ static void test_machine(gconstpointer data)
 
     test_properties(qts, "/machine", true);
 
+    qlist_append_str(paths, "/machine");
+    test_list_get(qts, paths);
+    test_list_get_value(qts);
+
     response = qtest_qmp(qts, "{ 'execute': 'quit' }");
     g_assert(qdict_haskey(response, "return"));
     qobject_unref(response);

From 5dd68db9cd005aeb2870d8754fd90e1b6af793a7 Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <akihiko.odaki@daynix.com>
Date: Tue, 15 Jul 2025 17:28:47 -0400
Subject: [PATCH 2497/2760] docs: Bump sphinx to 6.2.1

sphinx 5.3.0 fails with Python 3.13.1:

../docs/meson.build:37: WARNING: /home/me/qemu/build/pyvenv/bin/sphinx-build:
Extension error:
Could not import extension sphinx.builders.epub3 (exception: No module named 'imghdr')

../docs/meson.build:39:6: ERROR: Problem encountered: Install a Python 3 version of python-sphinx and the readthedoc theme

Bump sphinx to 6.2.1 and also sphinx_rtd_theme as required for the new
sphinx version.

(jsnow note: this patch bumps the recommended version for Sphinx to
install when it is missing, but allows old versions to be used if they
are present and functional. The version used for building docs on
readthedocs is pinned to the recommended version, 6.2.1.)

Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Tested-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: John Snow <jsnow@redhat.com>
Signed-off-by: John Snow <jsnow@redhat.com>
Message-ID: <20250715212848.171879-2-jsnow@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
---
 docs/requirements.txt | 4 ++--
 pythondeps.toml       | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/docs/requirements.txt b/docs/requirements.txt
index 02583f209a..87f7afcb2e 100644
--- a/docs/requirements.txt
+++ b/docs/requirements.txt
@@ -1,5 +1,5 @@
 # Used by readthedocs.io
 # Should be in sync with the "installed" key of pythondeps.toml
 
-sphinx==5.3.0
-sphinx_rtd_theme==1.1.1
+sphinx==6.2.1
+sphinx_rtd_theme==1.2.2
diff --git a/pythondeps.toml b/pythondeps.toml
index 7884ab521d..b2eec940ce 100644
--- a/pythondeps.toml
+++ b/pythondeps.toml
@@ -24,8 +24,8 @@ pycotap = { accepted = ">=1.1.0", installed = "1.3.1" }
 
 [docs]
 # Please keep the installed versions in sync with docs/requirements.txt
-sphinx = { accepted = ">=3.4.3", installed = "5.3.0", canary = "sphinx-build" }
-sphinx_rtd_theme = { accepted = ">=0.5", installed = "1.1.1" }
+sphinx = { accepted = ">=3.4.3", installed = "6.2.1", canary = "sphinx-build" }
+sphinx_rtd_theme = { accepted = ">=0.5", installed = "1.2.2" }
 
 [testdeps]
 qemu.qmp = { accepted = ">=0.0.3", installed = "0.0.3" }

From b417dd98f442a11f8a7fa79ae7e78279a42483cb Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <akihiko.odaki@daynix.com>
Date: Tue, 15 Jul 2025 17:28:48 -0400
Subject: [PATCH 2498/2760] MAINTAINERS: Add docs/requirements.txt

Add docs/requirements.txt to
"Sphinx documentation configuration and build machinery".

Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Signed-off-by: John Snow <jsnow@redhat.com>
Message-ID: <20250715212848.171879-3-jsnow@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
---
 MAINTAINERS | 1 +
 1 file changed, 1 insertion(+)

diff --git a/MAINTAINERS b/MAINTAINERS
index bc0af3e8dd..a462345618 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -4428,6 +4428,7 @@ M: Peter Maydell <peter.maydell@linaro.org>
 S: Maintained
 F: docs/conf.py
 F: docs/*/conf.py
+F: docs/requirements.txt
 F: docs/sphinx/
 F: docs/_templates/
 F: docs/devel/docs.rst

From 64e4375b2b1efb634876a119a7378c50be5d195b Mon Sep 17 00:00:00 2001
From: John Snow <jsnow@redhat.com>
Date: Tue, 15 Jul 2025 18:25:48 -0400
Subject: [PATCH 2499/2760] python: fix editable installs for modern
 pip/setuptools

The way editable installs work has changed at some point since Fedora 40
was released. Generally, we should be opting to use pyproject.toml
installs (PEP517/518) - but those are not fully supported until v61 of
setuptools, and CentOS Stream 9 ships v53.

Until that time, we can make use of a transitional feature in
pip/setuptools to use "legacy" editable installs, which is enough to fix
"make check-dev" on modern local workstations for now.

By using the environment variable approach to configure pip, we avoid
any problems for older versions of pip that don't recognize this option,
so it's harmless. The config-settings option first appeared in v23 of
pip. editable_mode was first supported by setuptools in v64.

(I'm not currently precisely aware of when the default behavior of '-e'
switched away from 'compat', but it appears to be a joint effect between
setuptools and pip versions.)

Version information for supported build platforms:

distro              python3  pip     setuptools  sphinx
--------------------------------------------------------
centos_stream_9     3.9.23   21.3.1  53.0.0      3.4.3
ubuntu_22_04        3.10.12  22.0.2  59.6.0      4.3.2

** pyproject.toml installs supported as of here **

freebsd             3.11.13  23.3.2  63.1.0      5.3.0
debian_12           3.11.2   23.0.1  66.1.1      5.3.0
ubuntu_24_04        3.12.3   24.0    68.1.2      7.2.6
centos_stream_10    3.12.11  23.3.2  69.0.3      7.2.6
fedora_41           3.13.5   24.2    69.2.0      7.3.7
alpine_3_19         3.11.13  23.3.1  70.3.0      6.2.1
alpine_3_20         3.12.11  24.0    70.3.0      7.2.6
alpine_3_21         3.12.11  24.3.1  70.3.0      8.1.3
ubuntu_24_10        3.12.7   24.2    74.1.2      7.4.7
fedora_42           3.13.5   24.3.1  74.1.3      8.1.3
ubuntu_25_04        3.13.3   25.0    75.8.0      8.1.3
macports            3.13.5   25.1.1  78.1.1      8.2.3
openbsd             3.12.11  25.1.1  79.0.1      8.2.3
alpine_3_22         3.12.11  25.1.1  80.9.0      8.2.3
homebrew            3.13.5   ---     80.9.0      8.2.3
pkgsrc_current      3.12.11  25.1.1  80.9.0      8.2.3

Signed-off-by: John Snow <jsnow@redhat.com>
Message-ID: <20250715222548.198888-1-jsnow@redhat.com>
Tested-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
---
 python/Makefile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/python/Makefile b/python/Makefile
index 764b79ccb2..32aedce413 100644
--- a/python/Makefile
+++ b/python/Makefile
@@ -68,7 +68,7 @@ $(QEMU_MINVENV_DIR) $(QEMU_MINVENV_DIR)/bin/activate: setup.cfg tests/minreqs.tx
 		echo "INSTALL -r tests/minreqs.txt $(QEMU_MINVENV_DIR)";\
 		$(PIP_INSTALL) -r tests/minreqs.txt 1>/dev/null;	\
 		echo "INSTALL -e qemu $(QEMU_MINVENV_DIR)";		\
-		$(PIP_INSTALL) -e . 1>/dev/null;			\
+		PIP_CONFIG_SETTINGS="editable_mode=compat" $(PIP_INSTALL) -e . 1>/dev/null;	\
 	)
 	@touch $(QEMU_MINVENV_DIR)
 
@@ -103,7 +103,7 @@ check-dev: dev-venv
 
 .PHONY: develop
 develop:
-	$(PIP_INSTALL) -e .[devel]
+	PIP_CONFIG_SETTINGS="editable_mode=compat" $(PIP_INSTALL) -e .[devel]
 
 .PHONY: check
 check:

From 350785d41d8bb0b799dd16ea04a7232dc8d6093a Mon Sep 17 00:00:00 2001
From: Shaoqin Huang <shahuang@redhat.com>
Date: Thu, 17 Jul 2025 06:09:39 -0400
Subject: [PATCH 2500/2760] ramfb: Add property to control if load the romfile

Currently the ramfb device loads the vgabios-ramfb.bin unconditionally,
but only the x86 need the vgabios-ramfb.bin, this can cause that when
use the release package on arm64 it can't find the vgabios-ramfb.bin.

Because only seabios will use the vgabios-ramfb.bin, load the rom logic
is x86-specific. For other !x86 platforms, the edk2 ships an EFI driver
for ramfb, so they don't need to load the romfile.

So add a new property use-legacy-x86-rom in both ramfb and vfio_pci
device, because the vfio display also use the ramfb_setup() to load
the vgabios-ramfb.bin file.

After have this property, the machine type can set the compatibility to
not load the vgabios-ramfb.bin if the arch doesn't need it.

For now the default value is true but it will be turned off by default
in subsequent patch when compats get properly handled.

Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Shaoqin Huang <shahuang@redhat.com>
Message-ID: <20250717100941.2230408-2-shahuang@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
 hw/display/ramfb-standalone.c | 5 ++++-
 hw/display/ramfb-stubs.c      | 2 +-
 hw/display/ramfb.c            | 6 ++++--
 hw/vfio/display.c             | 4 ++--
 hw/vfio/pci.c                 | 2 ++
 hw/vfio/pci.h                 | 1 +
 include/hw/display/ramfb.h    | 2 +-
 7 files changed, 15 insertions(+), 7 deletions(-)

diff --git a/hw/display/ramfb-standalone.c b/hw/display/ramfb-standalone.c
index 08f2d5db4e..82d8c69f89 100644
--- a/hw/display/ramfb-standalone.c
+++ b/hw/display/ramfb-standalone.c
@@ -17,6 +17,7 @@ struct RAMFBStandaloneState {
     QemuConsole *con;
     RAMFBState *state;
     bool migrate;
+    bool use_legacy_x86_rom;
 };
 
 static void display_update_wrapper(void *dev)
@@ -39,7 +40,7 @@ static void ramfb_realizefn(DeviceState *dev, Error **errp)
     RAMFBStandaloneState *ramfb = RAMFB(dev);
 
     ramfb->con = graphic_console_init(dev, 0, &wrapper_ops, dev);
-    ramfb->state = ramfb_setup(errp);
+    ramfb->state = ramfb_setup(ramfb->use_legacy_x86_rom, errp);
 }
 
 static bool migrate_needed(void *opaque)
@@ -62,6 +63,8 @@ static const VMStateDescription ramfb_dev_vmstate = {
 
 static const Property ramfb_properties[] = {
     DEFINE_PROP_BOOL("x-migrate", RAMFBStandaloneState, migrate,  true),
+    DEFINE_PROP_BOOL("use-legacy-x86-rom", RAMFBStandaloneState,
+                     use_legacy_x86_rom, true),
 };
 
 static void ramfb_class_initfn(ObjectClass *klass, const void *data)
diff --git a/hw/display/ramfb-stubs.c b/hw/display/ramfb-stubs.c
index cf64733b10..b83551357b 100644
--- a/hw/display/ramfb-stubs.c
+++ b/hw/display/ramfb-stubs.c
@@ -8,7 +8,7 @@ void ramfb_display_update(QemuConsole *con, RAMFBState *s)
 {
 }
 
-RAMFBState *ramfb_setup(Error **errp)
+RAMFBState *ramfb_setup(bool romfile, Error **errp)
 {
     error_setg(errp, "ramfb support not available");
     return NULL;
diff --git a/hw/display/ramfb.c b/hw/display/ramfb.c
index 8c0f907673..9a17d97d07 100644
--- a/hw/display/ramfb.c
+++ b/hw/display/ramfb.c
@@ -135,7 +135,7 @@ const VMStateDescription ramfb_vmstate = {
     }
 };
 
-RAMFBState *ramfb_setup(Error **errp)
+RAMFBState *ramfb_setup(bool romfile, Error **errp)
 {
     FWCfgState *fw_cfg = fw_cfg_find();
     RAMFBState *s;
@@ -147,7 +147,9 @@ RAMFBState *ramfb_setup(Error **errp)
 
     s = g_new0(RAMFBState, 1);
 
-    rom_add_vga("vgabios-ramfb.bin");
+    if (romfile) {
+        rom_add_vga("vgabios-ramfb.bin");
+    }
     fw_cfg_add_file_callback(fw_cfg, "etc/ramfb",
                              NULL, ramfb_fw_cfg_write, s,
                              &s->cfg, sizeof(s->cfg), false);
diff --git a/hw/vfio/display.c b/hw/vfio/display.c
index 9c6f5aa265..faacd9019a 100644
--- a/hw/vfio/display.c
+++ b/hw/vfio/display.c
@@ -365,7 +365,7 @@ static bool vfio_display_dmabuf_init(VFIOPCIDevice *vdev, Error **errp)
                                           &vfio_display_dmabuf_ops,
                                           vdev);
     if (vdev->enable_ramfb) {
-        vdev->dpy->ramfb = ramfb_setup(errp);
+        vdev->dpy->ramfb = ramfb_setup(vdev->use_legacy_x86_rom, errp);
         if (!vdev->dpy->ramfb) {
             return false;
         }
@@ -494,7 +494,7 @@ static bool vfio_display_region_init(VFIOPCIDevice *vdev, Error **errp)
                                           &vfio_display_region_ops,
                                           vdev);
     if (vdev->enable_ramfb) {
-        vdev->dpy->ramfb = ramfb_setup(errp);
+        vdev->dpy->ramfb = ramfb_setup(vdev->use_legacy_x86_rom, errp);
         if (!vdev->dpy->ramfb) {
             return false;
         }
diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index 1093b28df7..0b969b3359 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -3809,6 +3809,8 @@ static const TypeInfo vfio_pci_dev_info = {
 
 static const Property vfio_pci_dev_nohotplug_properties[] = {
     DEFINE_PROP_BOOL("ramfb", VFIOPCIDevice, enable_ramfb, false),
+    DEFINE_PROP_BOOL("use-legacy-x86-rom", VFIOPCIDevice,
+                     use_legacy_x86_rom, true),
     DEFINE_PROP_ON_OFF_AUTO("x-ramfb-migrate", VFIOPCIDevice, ramfb_migrate,
                             ON_OFF_AUTO_AUTO),
 };
diff --git a/hw/vfio/pci.h b/hw/vfio/pci.h
index 495fae737d..826db8c131 100644
--- a/hw/vfio/pci.h
+++ b/hw/vfio/pci.h
@@ -188,6 +188,7 @@ struct VFIOPCIDevice {
     bool no_kvm_ioeventfd;
     bool no_vfio_ioeventfd;
     bool enable_ramfb;
+    bool use_legacy_x86_rom;
     OnOffAuto ramfb_migrate;
     bool defer_kvm_irq_routing;
     bool clear_parent_atomics_on_exit;
diff --git a/include/hw/display/ramfb.h b/include/hw/display/ramfb.h
index a7e0019144..172aa6dc89 100644
--- a/include/hw/display/ramfb.h
+++ b/include/hw/display/ramfb.h
@@ -6,7 +6,7 @@
 /* ramfb.c */
 typedef struct RAMFBState RAMFBState;
 void ramfb_display_update(QemuConsole *con, RAMFBState *s);
-RAMFBState *ramfb_setup(Error **errp);
+RAMFBState *ramfb_setup(bool romfile, Error **errp);
 
 extern const VMStateDescription ramfb_vmstate;
 

From d3a24134e37d57abd3e7445842cda2717f49e96d Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Mon, 14 Jul 2025 10:19:36 +0200
Subject: [PATCH 2501/2760] target/i386: do not expose ARCH_CAPABILITIES on AMD
 CPU
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

KVM emulates the ARCH_CAPABILITIES on x86 for both Intel and AMD
cpus, although the IA32_ARCH_CAPABILITIES MSR is an Intel-specific
MSR and it makes no sense to emulate it on AMD.

As a consequence, VMs created on AMD with qemu -cpu host and using
KVM will advertise the ARCH_CAPABILITIES feature and provide the
IA32_ARCH_CAPABILITIES MSR. This can cause issues (like Windows BSOD)
as the guest OS might not expect this MSR to exist on such cpus (the
AMD documentation specifies that ARCH_CAPABILITIES feature and MSR
are not defined on the AMD architecture).

A fix was proposed in KVM code, however KVM maintainers don't want to
change this behavior that exists for 6+ years and suggest changes to be
done in QEMU instead.  Therefore, hide the bit from "-cpu host":
migration of -cpu host guests is only possible between identical host
kernel and QEMU versions, therefore this is not a problematic breakage.

If a future AMD machine does include the MSR, that would re-expose the
Windows guest bug; but it would not be KVM/QEMU's problem at that
point, as we'd be following a genuine physical CPU impl.

Reported-by: Alexandre Chartre <alexandre.chartre@oracle.com>
Suggested-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/kvm/kvm.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
index e8c8be09ba..369626f8c8 100644
--- a/target/i386/kvm/kvm.c
+++ b/target/i386/kvm/kvm.c
@@ -503,8 +503,12 @@ uint32_t kvm_arch_get_supported_cpuid(KVMState *s, uint32_t function,
          * Linux v4.17-v4.20 incorrectly return ARCH_CAPABILITIES on SVM hosts.
          * We can detect the bug by checking if MSR_IA32_ARCH_CAPABILITIES is
          * returned by KVM_GET_MSR_INDEX_LIST.
+         *
+         * But also, because Windows does not like ARCH_CAPABILITIES on AMD
+         * mcahines at all, do not show the fake ARCH_CAPABILITIES MSR that
+         * KVM sets up.
          */
-        if (!has_msr_arch_capabs) {
+        if (!has_msr_arch_capabs || !(edx & CPUID_7_0_EDX_ARCH_CAPABILITIES)) {
             ret &= ~CPUID_7_0_EDX_ARCH_CAPABILITIES;
         }
     } else if (function == 7 && index == 1 && reg == R_EAX) {

From e52af92e9e6f8fc00f2ae6b63214b3d6213b3cec Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Thu, 17 Jul 2025 10:39:33 +0800
Subject: [PATCH 2502/2760] i386/cpu: Move x86_ext_save_areas[] initialization
 to .instance_init

In x86_cpu_post_initfn(), the initialization of x86_ext_save_areas[]
marks the unsupported xsave areas based on Host support.

This step must be done before accel_cpu_instance_init(), otherwise,
KVM's assertion on host xsave support would fail:

qemu-system-x86_64: ../target/i386/kvm/kvm-cpu.c:149:
kvm_cpu_xsave_init: Assertion `esa->size == eax' failed.

(on AMD EPYC 7302 16-Core Processor)

Move x86_ext_save_areas[] initialization to .instance_init and place it
before accel_cpu_instance_init().

Fixes: commit 5f158abef44c ("target/i386: move accel_cpu_instance_init to .instance_init")
Reported-by: Paolo Abeni <pabeni@redhat.com>
Tested-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250717023933.2502109-1-zhao1.liu@intel.com
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 22 +++++++++++++++-------
 1 file changed, 15 insertions(+), 7 deletions(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index da7d8dca63..251d5760a0 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -9619,6 +9619,16 @@ static void x86_cpu_register_feature_bit_props(X86CPUClass *xcc,
 }
 
 static void x86_cpu_post_initfn(Object *obj)
+{
+#ifndef CONFIG_USER_ONLY
+    if (current_machine && current_machine->cgs) {
+        x86_confidential_guest_cpu_instance_init(
+            X86_CONFIDENTIAL_GUEST(current_machine->cgs), (CPU(obj)));
+    }
+#endif
+}
+
+static void x86_cpu_init_xsave(void)
 {
     static bool first = true;
     uint64_t supported_xcr0;
@@ -9639,13 +9649,6 @@ static void x86_cpu_post_initfn(Object *obj)
             }
         }
     }
-
-#ifndef CONFIG_USER_ONLY
-    if (current_machine && current_machine->cgs) {
-        x86_confidential_guest_cpu_instance_init(
-            X86_CONFIDENTIAL_GUEST(current_machine->cgs), (CPU(obj)));
-    }
-#endif
 }
 
 static void x86_cpu_init_default_topo(X86CPU *cpu)
@@ -9715,6 +9718,11 @@ static void x86_cpu_initfn(Object *obj)
         x86_cpu_load_model(cpu, xcc->model);
     }
 
+    /*
+     * accel's cpu_instance_init may have the xsave check,
+     * so x86_ext_save_areas[] must be initialized before this.
+     */
+    x86_cpu_init_xsave();
     accel_cpu_instance_init(CPU(obj));
 }
 

From e00cb2189a920bcfb428622c5d112469c4a094d1 Mon Sep 17 00:00:00 2001
From: Stefano Garzarella <sgarzare@redhat.com>
Date: Thu, 17 Jul 2025 15:12:56 +0200
Subject: [PATCH 2503/2760] meson: re-generate scripts/meson-buildoptions.sh to
 fix IGVM entry
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Commit 84fe49d94a ("meson: Add optional dependency on IGVM library")
was inconsistent with the contents of meson_options.txt and the one
generated in scripts/meson-buildoptions.sh

Let's regenerate the file in this way to keep them consistent and prevent
future changes from including the spurious diff:

    touch meson_options.txt
    make update-buildoptions

Fixes: 84fe49d94a ("meson: Add optional dependency on IGVM library")
Cc: roy.hopkins@randomman.co.uk
Reported-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Link: https://lore.kernel.org/r/20250717131256.157383-1-sgarzare@redhat.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 scripts/meson-buildoptions.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/meson-buildoptions.sh b/scripts/meson-buildoptions.sh
index e8504689e8..0ebe6bc52a 100644
--- a/scripts/meson-buildoptions.sh
+++ b/scripts/meson-buildoptions.sh
@@ -130,7 +130,7 @@ meson_options_help() {
   printf "%s\n" '  hv-balloon      hv-balloon driver (requires Glib 2.68+ GTree API)'
   printf "%s\n" '  hvf             HVF acceleration support'
   printf "%s\n" '  iconv           Font glyph conversion support'
-  printf "%s\n" '  igvm            IGVM file support'
+  printf "%s\n" '  igvm            Independent Guest Virtual Machine (IGVM) file support'
   printf "%s\n" '  jack            JACK sound support'
   printf "%s\n" '  keyring         Linux keyring support'
   printf "%s\n" '  kvm             KVM acceleration support'

From f2b787976342a9e1d47810f3146ad74b86a5088a Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Thu, 17 Jul 2025 12:32:23 +0200
Subject: [PATCH 2504/2760] target/i386: tdx: fix locking for interrupt
 injection

Take tdx_guest->lock when injecting the event notification interrupt into
the guest.

Fixes CID 1612364.

Reported-by: Peter Maydell <peter.maydell@linaro.org>
Cc: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/kvm/tdx.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
index 7d69d6d7b0..1574e7d76f 100644
--- a/target/i386/kvm/tdx.c
+++ b/target/i386/kvm/tdx.c
@@ -1126,10 +1126,15 @@ int tdx_parse_tdvf(void *flash_ptr, int size)
     return tdvf_parse_metadata(&tdx_guest->tdvf, flash_ptr, size);
 }
 
-static void tdx_inject_interrupt(uint32_t apicid, uint32_t vector)
+static void tdx_inject_interrupt(TdxGuest *tdx)
 {
     int ret;
+    uint32_t apicid, vector;
 
+    qemu_mutex_lock(&tdx->lock);
+    vector = tdx->event_notify_vector;
+    apicid = tdx->event_notify_apicid;
+    qemu_mutex_unlock(&tdx->lock);
     if (vector < 32 || vector > 255) {
         return;
     }
@@ -1179,8 +1184,7 @@ static void tdx_get_quote_completion(TdxGenerateQuoteTask *task)
         error_report("TDX: get-quote: failed to update GetQuote header.");
     }
 
-    tdx_inject_interrupt(tdx_guest->event_notify_apicid,
-                         tdx_guest->event_notify_vector);
+    tdx_inject_interrupt(tdx);
 
     g_free(task->send_data);
     g_free(task->receive_buf);

From 5fe6b9a854a91df86fdb794cbeb67d0656756137 Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Wed, 16 Jul 2025 14:31:16 +0800
Subject: [PATCH 2505/2760] i386/cpu: Cleanup host_cpu_max_instance_init()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The implementation of host_cpu_max_instance_init() was merged into
host_cpu_instance_init() by commit 29f1ba338baf ("target/i386: merge
host_cpu_instance_init() and host_cpu_max_instance_init()"), while the
declaration of it remains in host-cpu.h.

Clean it up.

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250716063117.602050-1-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/host-cpu.h | 1 -
 1 file changed, 1 deletion(-)

diff --git a/target/i386/host-cpu.h b/target/i386/host-cpu.h
index 10df4b3a3a..ee65324225 100644
--- a/target/i386/host-cpu.h
+++ b/target/i386/host-cpu.h
@@ -12,7 +12,6 @@
 
 uint32_t host_cpu_phys_bits(void);
 void host_cpu_instance_init(X86CPU *cpu);
-void host_cpu_max_instance_init(X86CPU *cpu);
 bool host_cpu_realizefn(CPUState *cs, Error **errp);
 
 void host_cpu_vendor_fms(char *vendor, int *family, int *model, int *stepping);

From f64832033d1262983bfe759669b4f65080f760dc Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Thu, 17 Jul 2025 18:37:07 +0800
Subject: [PATCH 2506/2760] i386/tdx: Remove the redundant
 qemu_mutex_init(&tdx->lock)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Commit 40da501d8989 ("i386/tdx: handle TDG.VP.VMCALL<GetQuote>") added
redundant qemu_mutex_init(&tdx->lock) in tdx_guest_init by mistake.

Fix it by removing the redundant one.

Fixes: 40da501d8989 ("i386/tdx: handle TDG.VP.VMCALL<GetQuote>")
Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Link: https://lore.kernel.org/r/20250717103707.688929-1-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/kvm/tdx.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
index 1574e7d76f..dbf0fa2c91 100644
--- a/target/i386/kvm/tdx.c
+++ b/target/i386/kvm/tdx.c
@@ -1527,8 +1527,6 @@ static void tdx_guest_init(Object *obj)
                             tdx_guest_set_qgs,
                             NULL, NULL);
 
-    qemu_mutex_init(&tdx->lock);
-
     tdx->event_notify_vector = -1;
     tdx->event_notify_apicid = -1;
 }

From b53a3bba5e02df7cbdb26f8bf8bcb11b8290e863 Mon Sep 17 00:00:00 2001
From: Shaoqin Huang <shahuang@redhat.com>
Date: Thu, 17 Jul 2025 06:09:40 -0400
Subject: [PATCH 2507/2760] vfio: Move the TYPE_* to hw/vfio/types.h

Move the TYPE_* to a new file hw/vfio/types.h because the
TYPE_VFIO_PCI will be used in later patch, but directly include the
hw/vfio/pci.h can cause some compilation error when cross build the
windows version.

The hw/vfio/types.h can be included to mitigate that problem.

Signed-off-by: Shaoqin Huang <shahuang@redhat.com>
Message-ID: <20250717100941.2230408-3-shahuang@redhat.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
 hw/vfio/pci.h   | 10 +---------
 hw/vfio/types.h | 21 +++++++++++++++++++++
 2 files changed, 22 insertions(+), 9 deletions(-)
 create mode 100644 hw/vfio/types.h

diff --git a/hw/vfio/pci.h b/hw/vfio/pci.h
index 826db8c131..0fd151c5dc 100644
--- a/hw/vfio/pci.h
+++ b/hw/vfio/pci.h
@@ -14,6 +14,7 @@
 
 #include "system/memory.h"
 #include "hw/pci/pci_device.h"
+#include "hw/vfio/types.h"
 #include "hw/vfio/vfio-device.h"
 #include "hw/vfio/vfio-region.h"
 #include "qemu/event_notifier.h"
@@ -119,17 +120,8 @@ typedef struct VFIOMSIXInfo {
     MemoryRegion *pba_region;
 } VFIOMSIXInfo;
 
-/*
- * TYPE_VFIO_PCI_BASE is an abstract type used to share code
- * between VFIO implementations that use a kernel driver
- * with those that use user sockets.
- */
-#define TYPE_VFIO_PCI_BASE "vfio-pci-base"
 OBJECT_DECLARE_SIMPLE_TYPE(VFIOPCIDevice, VFIO_PCI_BASE)
 
-#define TYPE_VFIO_PCI "vfio-pci"
-/* TYPE_VFIO_PCI shares struct VFIOPCIDevice. */
-
 struct VFIOPCIDevice {
     PCIDevice pdev;
     VFIODevice vbasedev;
diff --git a/hw/vfio/types.h b/hw/vfio/types.h
new file mode 100644
index 0000000000..fa20c29b9f
--- /dev/null
+++ b/hw/vfio/types.h
@@ -0,0 +1,21 @@
+/*
+ * VFIO types definition
+ *
+ * Copyright Red Hat, Inc. 2025
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+#ifndef HW_VFIO_VFIO_TYPES_H
+#define HW_VFIO_VFIO_TYPES_H
+
+/*
+ * TYPE_VFIO_PCI_BASE is an abstract type used to share code
+ * between VFIO implementations that use a kernel driver
+ * with those that use user sockets.
+ */
+#define TYPE_VFIO_PCI_BASE "vfio-pci-base"
+
+#define TYPE_VFIO_PCI "vfio-pci"
+/* TYPE_VFIO_PCI shares struct VFIOPCIDevice. */
+
+#endif /* HW_VFIO_VFIO_TYPES_H */

From d5fcf0d960d893b1765e6388cefca9c690839267 Mon Sep 17 00:00:00 2001
From: Shaoqin Huang <shahuang@redhat.com>
Date: Thu, 17 Jul 2025 06:09:41 -0400
Subject: [PATCH 2508/2760] hw/i386: Add the ramfb romfile compatibility

ramfb is a sysbus device so it can only used for machine types where it
is explicitly enabled:

  # git grep machine_class_allow_dynamic_sysbus_dev.*TYPE_RAMFB_DEVICE
  hw/arm/virt.c:    machine_class_allow_dynamic_sysbus_dev(mc,
		  TYPE_RAMFB_DEVICE);
  hw/i386/microvm.c:    machine_class_allow_dynamic_sysbus_dev(mc,
		  TYPE_RAMFB_DEVICE);
  hw/i386/pc_piix.c:    machine_class_allow_dynamic_sysbus_dev(m,
		  TYPE_RAMFB_DEVICE);
  hw/i386/pc_q35.c:    machine_class_allow_dynamic_sysbus_dev(m,
		  TYPE_RAMFB_DEVICE);
  hw/loongarch/virt.c:    machine_class_allow_dynamic_sysbus_dev(mc,
		  TYPE_RAMFB_DEVICE);
  hw/riscv/virt.c:    machine_class_allow_dynamic_sysbus_dev(mc,
		  TYPE_RAMFB_DEVICE);

So these six are the only machine types we have to worry about.

The three x86 machine types (pc, q35, microvm) will actually use the rom
(when booting with seabios).

For arm/riscv/loongarch virt we want to disable the rom.

This patch sets ramfb romfile option to false by default, except for x86
machines types (pc, q35, microvm) which need the rom file when booting
with seabios and machine types <= 10.0 (handling the case of arm virt,
for compat reasons).

At the same time, set the "use-legacy-x86-rom" property to true on those
historical versioned machine types in order to avoid the memory layout
being changed.

Acked-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Shaoqin Huang <shahuang@redhat.com>
Message-ID: <20250717100941.2230408-4-shahuang@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
 hw/core/machine.c             |  2 ++
 hw/display/ramfb-standalone.c |  2 +-
 hw/i386/microvm.c             |  3 +++
 hw/i386/pc_piix.c             | 10 ++++++++++
 hw/i386/pc_q35.c              |  3 +++
 hw/vfio/pci.c                 |  2 +-
 6 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/hw/core/machine.c b/hw/core/machine.c
index e869821b22..a7043e2a34 100644
--- a/hw/core/machine.c
+++ b/hw/core/machine.c
@@ -39,6 +39,8 @@
 
 GlobalProperty hw_compat_10_0[] = {
     { "scsi-hd", "dpofua", "off" },
+    { "ramfb", "use-legacy-x86-rom", "true"},
+    { "vfio-pci", "use-legacy-x86-rom", "true" },
 };
 const size_t hw_compat_10_0_len = G_N_ELEMENTS(hw_compat_10_0);
 
diff --git a/hw/display/ramfb-standalone.c b/hw/display/ramfb-standalone.c
index 82d8c69f89..72b2071aed 100644
--- a/hw/display/ramfb-standalone.c
+++ b/hw/display/ramfb-standalone.c
@@ -64,7 +64,7 @@ static const VMStateDescription ramfb_dev_vmstate = {
 static const Property ramfb_properties[] = {
     DEFINE_PROP_BOOL("x-migrate", RAMFBStandaloneState, migrate,  true),
     DEFINE_PROP_BOOL("use-legacy-x86-rom", RAMFBStandaloneState,
-                     use_legacy_x86_rom, true),
+                     use_legacy_x86_rom, false),
 };
 
 static void ramfb_class_initfn(ObjectClass *klass, const void *data)
diff --git a/hw/i386/microvm.c b/hw/i386/microvm.c
index e0daf0d4fc..d90b69a162 100644
--- a/hw/i386/microvm.c
+++ b/hw/i386/microvm.c
@@ -49,6 +49,7 @@
 #include "hw/acpi/generic_event_device.h"
 #include "hw/pci-host/gpex.h"
 #include "hw/usb/xhci.h"
+#include "hw/vfio/types.h"
 
 #include "elf.h"
 #include "kvm/kvm_i386.h"
@@ -633,6 +634,8 @@ GlobalProperty microvm_properties[] = {
      * so reserving io space is not going to work.  Turn it off.
      */
     { "pcie-root-port", "io-reserve", "0" },
+    { TYPE_RAMFB_DEVICE, "use-legacy-x86-rom", "true" },
+    { TYPE_VFIO_PCI, "use-legacy-x86-rom", "true" },
 };
 
 static void microvm_class_init(ObjectClass *oc, const void *data)
diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
index a3285fbc64..ad5caff3a5 100644
--- a/hw/i386/pc_piix.c
+++ b/hw/i386/pc_piix.c
@@ -49,6 +49,7 @@
 #include "hw/i2c/smbus_eeprom.h"
 #include "system/memory.h"
 #include "hw/acpi/acpi.h"
+#include "hw/vfio/types.h"
 #include "qapi/error.h"
 #include "qemu/error-report.h"
 #include "system/xen.h"
@@ -77,6 +78,13 @@ static const int ide_iobase2[MAX_IDE_BUS] = { 0x3f6, 0x376 };
 static const int ide_irq[MAX_IDE_BUS] = { 14, 15 };
 #endif
 
+static GlobalProperty pc_piix_compat_defaults[] = {
+    { TYPE_RAMFB_DEVICE, "use-legacy-x86-rom", "true" },
+    { TYPE_VFIO_PCI, "use-legacy-x86-rom", "true" },
+};
+static const size_t pc_piix_compat_defaults_len =
+    G_N_ELEMENTS(pc_piix_compat_defaults);
+
 /*
  * Return the global irq number corresponding to a given device irq
  * pin. We could also use the bus number to have a more precise mapping.
@@ -492,6 +500,8 @@ static void pc_i440fx_machine_options(MachineClass *m)
                                    pc_set_south_bridge);
     object_class_property_set_description(oc, "x-south-bridge",
                                      "Use a different south bridge than PIIX3");
+    compat_props_add(m->compat_props,
+                     pc_piix_compat_defaults, pc_piix_compat_defaults_len);
 }
 
 static void pc_i440fx_machine_10_1_options(MachineClass *m)
diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
index cf871cfdad..9b9519fa02 100644
--- a/hw/i386/pc_q35.c
+++ b/hw/i386/pc_q35.c
@@ -45,6 +45,7 @@
 #include "hw/i386/pc.h"
 #include "hw/i386/amd_iommu.h"
 #include "hw/i386/intel_iommu.h"
+#include "hw/vfio/types.h"
 #include "hw/virtio/virtio-iommu.h"
 #include "hw/display/ramfb.h"
 #include "hw/ide/pci.h"
@@ -67,6 +68,8 @@
 
 static GlobalProperty pc_q35_compat_defaults[] = {
     { TYPE_VIRTIO_IOMMU_PCI, "aw-bits", "39" },
+    { TYPE_RAMFB_DEVICE, "use-legacy-x86-rom", "true" },
+    { TYPE_VFIO_PCI, "use-legacy-x86-rom", "true" },
 };
 static const size_t pc_q35_compat_defaults_len =
     G_N_ELEMENTS(pc_q35_compat_defaults);
diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index 0b969b3359..174499ecec 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -3810,7 +3810,7 @@ static const TypeInfo vfio_pci_dev_info = {
 static const Property vfio_pci_dev_nohotplug_properties[] = {
     DEFINE_PROP_BOOL("ramfb", VFIOPCIDevice, enable_ramfb, false),
     DEFINE_PROP_BOOL("use-legacy-x86-rom", VFIOPCIDevice,
-                     use_legacy_x86_rom, true),
+                     use_legacy_x86_rom, false),
     DEFINE_PROP_ON_OFF_AUTO("x-ramfb-migrate", VFIOPCIDevice, ramfb_migrate,
                             ON_OFF_AUTO_AUTO),
 };

From 3f9f6299a1bc46ff462142c7398a5953e3640cc2 Mon Sep 17 00:00:00 2001
From: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Date: Wed, 16 Jul 2025 10:28:53 +0300
Subject: [PATCH 2509/2760] net/tap: drop too small packets

Theoretically tap_read_packet() may return size less than
s->host_vnet_hdr_len, and next, we'll work with negative size
(in case of !s->using_vnet_hdr). Let's avoid it.

Don't proceed with size == s->host_vnet_hdr_len as well in case
of !s->using_vnet_hdr, it doesn't make sense.

Tested-by: Lei Yang <leiyang@redhat.com>
Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/tap.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/net/tap.c b/net/tap.c
index 23536c09b4..2a85936019 100644
--- a/net/tap.c
+++ b/net/tap.c
@@ -190,6 +190,11 @@ static void tap_send(void *opaque)
             break;
         }
 
+        if (s->host_vnet_hdr_len && size <= s->host_vnet_hdr_len) {
+            /* Invalid packet */
+            break;
+        }
+
         if (s->host_vnet_hdr_len && !s->using_vnet_hdr) {
             buf  += s->host_vnet_hdr_len;
             size -= s->host_vnet_hdr_len;

From ea263e8fd9a8f9cff615631a9bda775f5ddd3f98 Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Mon, 14 Jul 2025 13:36:54 -0700
Subject: [PATCH 2510/2760] tap: fix net_init_tap() return code

net_init_tap intends to return 0 for success and -1 on error.  However,
when net_init_tap() succeeds for a multi-queue device, it returns 1,
because of this code where ret becomes 1 when g_unix_set_fd_nonblocking
succeeds:

        ret = g_unix_set_fd_nonblocking(fd, true, NULL);
        if (!ret) {
            ... error ...
    free_fail:
        ...
        return ret;

Luckily, the only current call site checks for negative, rather than non-zero:

  net_client_init1()
      if (net_client_init_fun[](...) < 0)

Also, in the unlikely case that g_unix_set_fd_nonblocking fails and returns
false, ret=0 is returned, and net_client_init1 will use a broken interface.

Fix it to be future proof.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/tap.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/tap.c b/net/tap.c
index 2a85936019..f7df702f97 100644
--- a/net/tap.c
+++ b/net/tap.c
@@ -895,8 +895,8 @@ int net_init_tap(const Netdev *netdev, const char *name,
                 goto free_fail;
             }
 
-            ret = g_unix_set_fd_nonblocking(fd, true, NULL);
-            if (!ret) {
+            if (!g_unix_set_fd_nonblocking(fd, true, NULL)) {
+                ret = -1;
                 error_setg_errno(errp, errno, "%s: Can't use file descriptor %d",
                                  name, fd);
                 goto free_fail;

From 871a6e5b339f0b5e71925ec7d3f452944a1c82d3 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Mon, 14 Jul 2025 17:55:20 +0100
Subject: [PATCH 2511/2760] hw/net/npcm_gmac.c: Send the right data for second
 packet in a row

The transmit loop in gmac_try_send_next_packet() is constructed in a
way that means it will send incorrect data if it it sends more than
one packet.

The function assembles the outbound data in a dynamically allocated
block of memory which is pointed to by tx_send_buffer.  We track the
first point in this block of memory which is not yet used with the
prev_buf_size offset, initially zero.  We track the size of the
packet we're sending with the length variable, also initially zero.

As we read chunks of data out of guest memory, we write them to
tx_send_buffer[prev_buf_size], and then increment both prev_buf_size
and length.  (We might dynamically reallocate the buffer if needed.)

When we send a packet, we checksum and send length bytes, starting at
tx_send_buffer, and then we reset length to 0.  This gives the right
data for the first packet.  But we don't reset prev_buf_size.  This
means that if we process more descriptors with further data for the
next packet, that data will continue to accumulate at offset
prev_buf_size, i.e.  after the data for the first packet.  But when
we transmit that second packet, we send length bytes from
tx_send_buffer, so we will send a packet which has the length of the
second packet but the data of the first one.

The fix for this is to also clear prev_buf_size after the packet has
been sent -- we never need the data from packet one after we've sent
it, so we can write packet two's data starting at the beginning of
the buffer.

Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/npcm_gmac.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/net/npcm_gmac.c b/hw/net/npcm_gmac.c
index a434112580..921327dd8c 100644
--- a/hw/net/npcm_gmac.c
+++ b/hw/net/npcm_gmac.c
@@ -615,6 +615,7 @@ static void gmac_try_send_next_packet(NPCMGMACState *gmac)
             trace_npcm_gmac_packet_sent(DEVICE(gmac)->canonical_path, length);
             buf = tx_send_buffer;
             length = 0;
+            prev_buf_size = 0;
         }
 
         /* step 6 */

From 01b327c9a609cb613da1e04c5af5f4fcc7d9c0a3 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Mon, 14 Jul 2025 17:55:21 +0100
Subject: [PATCH 2512/2760] hw/net/npcm_gmac.c: Unify length and prev_buf_size
 variables

After the bug fix in the previous commit, the length and prev_buf_size
variables are identical, except that prev_buf_size is uint32_t and
length is uint16_t. We can therefore unify them. The only place where
the type makes a difference is that we will truncate the packet
at 64K when sending it; this commit preserves that behaviour
by using a local variable when doing the packet send.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/npcm_gmac.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/hw/net/npcm_gmac.c b/hw/net/npcm_gmac.c
index 921327dd8c..a0050a7725 100644
--- a/hw/net/npcm_gmac.c
+++ b/hw/net/npcm_gmac.c
@@ -516,7 +516,6 @@ static void gmac_try_send_next_packet(NPCMGMACState *gmac)
     uint32_t desc_addr;
     struct NPCMGMACTxDesc tx_desc;
     uint32_t tx_buf_addr, tx_buf_len;
-    uint16_t length = 0;
     uint8_t *buf = tx_send_buffer;
     uint32_t prev_buf_size = 0;
     int csum = 0;
@@ -583,7 +582,6 @@ static void gmac_try_send_next_packet(NPCMGMACState *gmac)
                         __func__, tx_buf_addr);
             return;
         }
-        length += tx_buf_len;
         prev_buf_size += tx_buf_len;
 
         /* If not chained we'll have a second buffer. */
@@ -606,15 +604,18 @@ static void gmac_try_send_next_packet(NPCMGMACState *gmac)
                               __func__, tx_buf_addr);
                 return;
             }
-            length += tx_buf_len;
             prev_buf_size += tx_buf_len;
         }
         if (tx_desc.tdes1 & TX_DESC_TDES1_LAST_SEG_MASK) {
+            /*
+             * This will truncate the packet at 64K.
+             * TODO: find out if this is the correct behaviour.
+             */
+            uint16_t length = prev_buf_size;
             net_checksum_calculate(tx_send_buffer, length, csum);
             qemu_send_packet(qemu_get_queue(gmac->nic), tx_send_buffer, length);
             trace_npcm_gmac_packet_sent(DEVICE(gmac)->canonical_path, length);
             buf = tx_send_buffer;
-            length = 0;
             prev_buf_size = 0;
         }
 

From e96a1aa6766f1b188dada3ad8d172c0fbe2f3a5f Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Mon, 14 Jul 2025 17:55:22 +0100
Subject: [PATCH 2513/2760] hw/net/npcm_gmac.c: Correct test for when to
 reallocate packet buffer

In gmac_try_send_next_packet() we have code that does "if this block
of data won't fit in the buffer, reallocate it".  However, the
condition it uses is
  if ((prev_buf_size + tx_buf_len) > sizeof(buf))
where buf is a uint8_t *.

This means that sizeof(buf) is always 8 bytes, and the condition will
almost always be true, so we will reallocate the buffer more often
than we need to.

Correct the condition to test against tx_buffer_size, which is
where we track how big the allocated buffer is.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/npcm_gmac.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/net/npcm_gmac.c b/hw/net/npcm_gmac.c
index a0050a7725..0c17ae9b2a 100644
--- a/hw/net/npcm_gmac.c
+++ b/hw/net/npcm_gmac.c
@@ -569,7 +569,7 @@ static void gmac_try_send_next_packet(NPCMGMACState *gmac)
         tx_buf_len = TX_DESC_TDES1_BFFR1_SZ_MASK(tx_desc.tdes1);
         buf = &tx_send_buffer[prev_buf_size];
 
-        if ((prev_buf_size + tx_buf_len) > sizeof(buf)) {
+        if ((prev_buf_size + tx_buf_len) > tx_buffer_size) {
             tx_buffer_size = prev_buf_size + tx_buf_len;
             tx_send_buffer = g_realloc(tx_send_buffer, tx_buffer_size);
             buf = &tx_send_buffer[prev_buf_size];
@@ -591,7 +591,7 @@ static void gmac_try_send_next_packet(NPCMGMACState *gmac)
             tx_buf_len = TX_DESC_TDES1_BFFR2_SZ_MASK(tx_desc.tdes1);
             buf = &tx_send_buffer[prev_buf_size];
 
-            if ((prev_buf_size + tx_buf_len) > sizeof(buf)) {
+            if ((prev_buf_size + tx_buf_len) > tx_buffer_size) {
                 tx_buffer_size = prev_buf_size + tx_buf_len;
                 tx_send_buffer = g_realloc(tx_send_buffer, tx_buffer_size);
                 buf = &tx_send_buffer[prev_buf_size];

From a6d6e37901551cbd61b0a61c6bab5745fb1833ff Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Mon, 14 Jul 2025 17:55:23 +0100
Subject: [PATCH 2514/2760] hw/net/npcm_gmac.c: Drop 'buf' local variable

We use the local variable 'buf' only when we call dma_memory_read(),
and it is always set to &tx_send_buffer[prev_buf_size] immediately
before both of those calls.  So remove the variable and pass
tx_send_buffer + prev_buf_size to dma_memory_read().

This fixes in passing a place where we set buf = tx_send_buffer
but never used that value because we always updated buf to
something else later before using it.

Coverity: CID 1534027
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/npcm_gmac.c | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/hw/net/npcm_gmac.c b/hw/net/npcm_gmac.c
index 0c17ae9b2a..5e32cd3edf 100644
--- a/hw/net/npcm_gmac.c
+++ b/hw/net/npcm_gmac.c
@@ -516,7 +516,6 @@ static void gmac_try_send_next_packet(NPCMGMACState *gmac)
     uint32_t desc_addr;
     struct NPCMGMACTxDesc tx_desc;
     uint32_t tx_buf_addr, tx_buf_len;
-    uint8_t *buf = tx_send_buffer;
     uint32_t prev_buf_size = 0;
     int csum = 0;
 
@@ -567,16 +566,15 @@ static void gmac_try_send_next_packet(NPCMGMACState *gmac)
         tx_buf_addr = tx_desc.tdes2;
         gmac->regs[R_NPCM_DMA_CUR_TX_BUF_ADDR] = tx_buf_addr;
         tx_buf_len = TX_DESC_TDES1_BFFR1_SZ_MASK(tx_desc.tdes1);
-        buf = &tx_send_buffer[prev_buf_size];
 
         if ((prev_buf_size + tx_buf_len) > tx_buffer_size) {
             tx_buffer_size = prev_buf_size + tx_buf_len;
             tx_send_buffer = g_realloc(tx_send_buffer, tx_buffer_size);
-            buf = &tx_send_buffer[prev_buf_size];
         }
 
         /* step 5 */
-        if (dma_memory_read(&address_space_memory, tx_buf_addr, buf,
+        if (dma_memory_read(&address_space_memory, tx_buf_addr,
+                            tx_send_buffer + prev_buf_size,
                             tx_buf_len, MEMTXATTRS_UNSPECIFIED)) {
             qemu_log_mask(LOG_GUEST_ERROR, "%s: Failed to read packet @ 0x%x\n",
                         __func__, tx_buf_addr);
@@ -589,15 +587,14 @@ static void gmac_try_send_next_packet(NPCMGMACState *gmac)
             tx_buf_addr = tx_desc.tdes3;
             gmac->regs[R_NPCM_DMA_CUR_TX_BUF_ADDR] = tx_buf_addr;
             tx_buf_len = TX_DESC_TDES1_BFFR2_SZ_MASK(tx_desc.tdes1);
-            buf = &tx_send_buffer[prev_buf_size];
 
             if ((prev_buf_size + tx_buf_len) > tx_buffer_size) {
                 tx_buffer_size = prev_buf_size + tx_buf_len;
                 tx_send_buffer = g_realloc(tx_send_buffer, tx_buffer_size);
-                buf = &tx_send_buffer[prev_buf_size];
             }
 
-            if (dma_memory_read(&address_space_memory, tx_buf_addr, buf,
+            if (dma_memory_read(&address_space_memory, tx_buf_addr,
+                                tx_send_buffer + prev_buf_size,
                                 tx_buf_len, MEMTXATTRS_UNSPECIFIED)) {
                 qemu_log_mask(LOG_GUEST_ERROR,
                               "%s: Failed to read packet @ 0x%x\n",
@@ -615,7 +612,6 @@ static void gmac_try_send_next_packet(NPCMGMACState *gmac)
             net_checksum_calculate(tx_send_buffer, length, csum);
             qemu_send_packet(qemu_get_queue(gmac->nic), tx_send_buffer, length);
             trace_npcm_gmac_packet_sent(DEVICE(gmac)->canonical_path, length);
-            buf = tx_send_buffer;
             prev_buf_size = 0;
         }
 

From 2ed74e3c005f236acbf7d85d396a653bfb004a17 Mon Sep 17 00:00:00 2001
From: Laurent Vivier <lvivier@redhat.com>
Date: Thu, 17 Jul 2025 17:08:00 +0200
Subject: [PATCH 2515/2760] net/passt: Remove unused "err" from
 passt_vhost_user_event() (CID 1612375)

The "err" variable was declared but never used within the
passt_vhost_user_event() function. This resulted in a dead code
warning (CID 1612375) from Coverity.

Remove the unused variable and the associated error block
to resolve the issue.

Signed-off-by: Laurent Vivier <lvivier@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/passt.c | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/net/passt.c b/net/passt.c
index 6f616ba3c2..9cd5b3e6f2 100644
--- a/net/passt.c
+++ b/net/passt.c
@@ -397,7 +397,6 @@ err:
 static void passt_vhost_user_event(void *opaque, QEMUChrEvent event)
 {
     NetPasstState *s = opaque;
-    Error *err = NULL;
 
     switch (event) {
     case CHR_EVENT_OPENED:
@@ -428,10 +427,6 @@ static void passt_vhost_user_event(void *opaque, QEMUChrEvent event)
         /* Ignore */
         break;
     }
-
-    if (err) {
-        error_report_err(err);
-    }
 }
 
 static int net_passt_vhost_user_init(NetPasstState *s, Error **errp)

From 37c8b208cc3161c2bcd4e2ff1e1077a64872ced3 Mon Sep 17 00:00:00 2001
From: Laurent Vivier <lvivier@redhat.com>
Date: Thu, 17 Jul 2025 17:08:01 +0200
Subject: [PATCH 2516/2760] net/vhost-user: Remove unused "err" from
 net_vhost_user_event() (CID 1612372)

The "err" variable was declared but never used within the
net_vhost_user_event() function. This resulted in a dead code
warning (CID 1612372) from Coverity.

Remove the unused variable and the associated error block
to resolve the issue.

Signed-off-by: Laurent Vivier <lvivier@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/vhost-user.c | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/net/vhost-user.c b/net/vhost-user.c
index 1c3b8b36f3..cec83e925f 100644
--- a/net/vhost-user.c
+++ b/net/vhost-user.c
@@ -329,7 +329,6 @@ static void net_vhost_user_event(void *opaque, QEMUChrEvent event)
     NetClientState *ncs[MAX_QUEUE_NUM];
     NetVhostUserState *s;
     Chardev *chr;
-    Error *err = NULL;
     int queues;
 
     queues = qemu_find_net_clients_except(name, ncs,
@@ -375,10 +374,6 @@ static void net_vhost_user_event(void *opaque, QEMUChrEvent event)
         /* Ignore */
         break;
     }
-
-    if (err) {
-        error_report_err(err);
-    }
 }
 
 static int net_vhost_user_init(NetClientState *peer, const char *device,

From c40ef7243fdbec816242cb0ded569a61270ea7c3 Mon Sep 17 00:00:00 2001
From: Laurent Vivier <lvivier@redhat.com>
Date: Thu, 17 Jul 2025 17:08:02 +0200
Subject: [PATCH 2517/2760] net/passt: Remove dead code in
 passt_vhost_user_start error path (CID 1612371)

In passt_vhost_user_start(), if vhost_net_init() fails, the "net"
variable is NULL and execution jumps to the "err:" label.

The cleanup code within this label is conditioned on "if (net)",
which can never be true in this error case. This makes the cleanup
block dead code, as reported by Coverity (CID 1612371).

Refactor the error handling to occur inline, removing the goto and
the unreachable cleanup block.

Signed-off-by: Laurent Vivier <lvivier@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/passt.c | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/net/passt.c b/net/passt.c
index 9cd5b3e6f2..ef59d0682b 100644
--- a/net/passt.c
+++ b/net/passt.c
@@ -375,7 +375,8 @@ static int passt_vhost_user_start(NetPasstState *s, VhostUserState *be)
     net = vhost_net_init(&options);
     if (!net) {
         error_report("failed to init passt vhost_net");
-        goto err;
+        passt_vhost_user_stop(s);
+        return -1;
     }
 
     if (s->vhost_net) {
@@ -385,13 +386,6 @@ static int passt_vhost_user_start(NetPasstState *s, VhostUserState *be)
     s->vhost_net = net;
 
     return 0;
-err:
-    if (net) {
-        vhost_net_cleanup(net);
-        g_free(net);
-    }
-    passt_vhost_user_stop(s);
-    return -1;
 }
 
 static void passt_vhost_user_event(void *opaque, QEMUChrEvent event)

From f74e4f2e60c3b2c6e2f13eb115478df116148fe6 Mon Sep 17 00:00:00 2001
From: Laurent Vivier <lvivier@redhat.com>
Date: Thu, 17 Jul 2025 17:08:03 +0200
Subject: [PATCH 2518/2760] net/passt: Check return value of g_remove() in
 net_passt_cleanup() (CID 1612369)

If g_remove() fails, use warn_report() to log an error.

Signed-off-by: Laurent Vivier <lvivier@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/passt.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/net/passt.c b/net/passt.c
index ef59d0682b..43c336e596 100644
--- a/net/passt.c
+++ b/net/passt.c
@@ -103,7 +103,10 @@ static void net_passt_cleanup(NetClientState *nc)
 #endif
 
     kill(s->pid, SIGTERM);
-    g_remove(s->pidfile);
+    if (g_remove(s->pidfile) != 0) {
+        warn_report("Failed to remove passt pidfile %s: %s",
+                    s->pidfile, strerror(errno));
+    }
     g_free(s->pidfile);
     g_ptr_array_free(s->args, TRUE);
 }

From 667ad57b7636881eb79b0b319951f3cba9bbf27e Mon Sep 17 00:00:00 2001
From: Laurent Vivier <lvivier@redhat.com>
Date: Thu, 17 Jul 2025 17:08:04 +0200
Subject: [PATCH 2519/2760] net/passt: Initialize "error" variable in
 net_passt_send() (CID 1612368)

This was flagged by Coverity as a memory illegal access.

Initialize the pointer to NULL at declaration.

Signed-off-by: Laurent Vivier <lvivier@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/passt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/passt.c b/net/passt.c
index 43c336e596..32ecffb763 100644
--- a/net/passt.c
+++ b/net/passt.c
@@ -124,7 +124,7 @@ static gboolean net_passt_send(QIOChannel *ioc, GIOCondition condition,
 {
     if (net_stream_data_send(ioc, condition, data) == G_SOURCE_REMOVE) {
         NetPasstState *s = DO_UPCAST(NetPasstState, data, data);
-        Error *error;
+        Error *error = NULL;
 
         /* we need to restart passt */
         kill(s->pid, SIGTERM);

From ae9b09972bbf8ff49ae0edf3241fb413391b15ce Mon Sep 17 00:00:00 2001
From: Laurent Vivier <lvivier@redhat.com>
Date: Thu, 17 Jul 2025 17:08:05 +0200
Subject: [PATCH 2520/2760] net/vhost-user: Remove unused "err" from
 chr_closed_bh() (CID 1612365)

The "err" variable was declared but never used within the
chr_closed_bh() function. This resulted in a dead code
warning (CID 1612365) from Coverity.

Remove the unused variable and the associated error block
to resolve the issue.

Signed-off-by: Laurent Vivier <lvivier@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/vhost-user.c | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/net/vhost-user.c b/net/vhost-user.c
index cec83e925f..8b96157145 100644
--- a/net/vhost-user.c
+++ b/net/vhost-user.c
@@ -298,7 +298,6 @@ static void chr_closed_bh(void *opaque)
     const char *name = opaque;
     NetClientState *ncs[MAX_QUEUE_NUM];
     NetVhostUserState *s;
-    Error *err = NULL;
     int queues, i;
 
     queues = qemu_find_net_clients_except(name, ncs,
@@ -317,9 +316,6 @@ static void chr_closed_bh(void *opaque)
     qemu_chr_fe_set_handlers(&s->chr, NULL, NULL, net_vhost_user_event,
                              NULL, opaque, NULL, true);
 
-    if (err) {
-        error_report_err(err);
-    }
     qapi_event_send_netdev_vhost_user_disconnected(name);
 }
 

From 99c6e970a4a6cfd862c6bb0a363c28538436de13 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Thu, 10 Jul 2025 14:00:35 +0200
Subject: [PATCH 2521/2760] linux-headers: Remove the 32-bit arm headers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

KVM support for 32-bit arm has been dropped a while ago, so we don't
need these headers in QEMU anymore.

Fixes: 82bf7ae84ce ("target/arm: Remove KVM support for 32-bit Arm hosts")
Acked-by: Cornelia Huck <cohuck@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250710120035.169376-1-thuth@redhat.com>
---
 configure                             |   1 -
 linux-headers/asm-arm/bitsperlong.h   |   1 -
 linux-headers/asm-arm/kvm.h           | 312 --------------------
 linux-headers/asm-arm/mman.h          |   4 -
 linux-headers/asm-arm/unistd-common.h | 397 --------------------------
 linux-headers/asm-arm/unistd-eabi.h   |   5 -
 linux-headers/asm-arm/unistd-oabi.h   |  17 --
 linux-headers/asm-arm/unistd.h        |  41 ---
 scripts/update-linux-headers.sh       |   5 -
 9 files changed, 783 deletions(-)
 delete mode 100644 linux-headers/asm-arm/bitsperlong.h
 delete mode 100644 linux-headers/asm-arm/kvm.h
 delete mode 100644 linux-headers/asm-arm/mman.h
 delete mode 100644 linux-headers/asm-arm/unistd-common.h
 delete mode 100644 linux-headers/asm-arm/unistd-eabi.h
 delete mode 100644 linux-headers/asm-arm/unistd-oabi.h
 delete mode 100644 linux-headers/asm-arm/unistd.h

diff --git a/configure b/configure
index 2b2b3d6597..95f67c1a82 100755
--- a/configure
+++ b/configure
@@ -453,7 +453,6 @@ case "$cpu" in
   armv*b|armv*l|arm)
     cpu=arm
     host_arch=arm
-    linux_arch=arm
     ;;
 
   i386|i486|i586|i686)
diff --git a/linux-headers/asm-arm/bitsperlong.h b/linux-headers/asm-arm/bitsperlong.h
deleted file mode 100644
index 6dc0bb0c13..0000000000
--- a/linux-headers/asm-arm/bitsperlong.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/bitsperlong.h>
diff --git a/linux-headers/asm-arm/kvm.h b/linux-headers/asm-arm/kvm.h
deleted file mode 100644
index 0db5644e27..0000000000
--- a/linux-headers/asm-arm/kvm.h
+++ /dev/null
@@ -1,312 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
-/*
- * Copyright (C) 2012 - Virtual Open Systems and Columbia University
- * Author: Christoffer Dall <c.dall@virtualopensystems.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License, version 2, as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
- */
-
-#ifndef __ARM_KVM_H__
-#define __ARM_KVM_H__
-
-#include <linux/types.h>
-#include <linux/psci.h>
-#include <asm/ptrace.h>
-
-#define __KVM_HAVE_GUEST_DEBUG
-#define __KVM_HAVE_IRQ_LINE
-#define __KVM_HAVE_READONLY_MEM
-#define __KVM_HAVE_VCPU_EVENTS
-
-#define KVM_COALESCED_MMIO_PAGE_OFFSET 1
-
-#define KVM_REG_SIZE(id)						\
-	(1U << (((id) & KVM_REG_SIZE_MASK) >> KVM_REG_SIZE_SHIFT))
-
-/* Valid for svc_regs, abt_regs, und_regs, irq_regs in struct kvm_regs */
-#define KVM_ARM_SVC_sp		svc_regs[0]
-#define KVM_ARM_SVC_lr		svc_regs[1]
-#define KVM_ARM_SVC_spsr	svc_regs[2]
-#define KVM_ARM_ABT_sp		abt_regs[0]
-#define KVM_ARM_ABT_lr		abt_regs[1]
-#define KVM_ARM_ABT_spsr	abt_regs[2]
-#define KVM_ARM_UND_sp		und_regs[0]
-#define KVM_ARM_UND_lr		und_regs[1]
-#define KVM_ARM_UND_spsr	und_regs[2]
-#define KVM_ARM_IRQ_sp		irq_regs[0]
-#define KVM_ARM_IRQ_lr		irq_regs[1]
-#define KVM_ARM_IRQ_spsr	irq_regs[2]
-
-/* Valid only for fiq_regs in struct kvm_regs */
-#define KVM_ARM_FIQ_r8		fiq_regs[0]
-#define KVM_ARM_FIQ_r9		fiq_regs[1]
-#define KVM_ARM_FIQ_r10		fiq_regs[2]
-#define KVM_ARM_FIQ_fp		fiq_regs[3]
-#define KVM_ARM_FIQ_ip		fiq_regs[4]
-#define KVM_ARM_FIQ_sp		fiq_regs[5]
-#define KVM_ARM_FIQ_lr		fiq_regs[6]
-#define KVM_ARM_FIQ_spsr	fiq_regs[7]
-
-struct kvm_regs {
-	struct pt_regs usr_regs;	/* R0_usr - R14_usr, PC, CPSR */
-	unsigned long svc_regs[3];	/* SP_svc, LR_svc, SPSR_svc */
-	unsigned long abt_regs[3];	/* SP_abt, LR_abt, SPSR_abt */
-	unsigned long und_regs[3];	/* SP_und, LR_und, SPSR_und */
-	unsigned long irq_regs[3];	/* SP_irq, LR_irq, SPSR_irq */
-	unsigned long fiq_regs[8];	/* R8_fiq - R14_fiq, SPSR_fiq */
-};
-
-/* Supported Processor Types */
-#define KVM_ARM_TARGET_CORTEX_A15	0
-#define KVM_ARM_TARGET_CORTEX_A7	1
-#define KVM_ARM_NUM_TARGETS		2
-
-/* KVM_ARM_SET_DEVICE_ADDR ioctl id encoding */
-#define KVM_ARM_DEVICE_TYPE_SHIFT	0
-#define KVM_ARM_DEVICE_TYPE_MASK	(0xffff << KVM_ARM_DEVICE_TYPE_SHIFT)
-#define KVM_ARM_DEVICE_ID_SHIFT		16
-#define KVM_ARM_DEVICE_ID_MASK		(0xffff << KVM_ARM_DEVICE_ID_SHIFT)
-
-/* Supported device IDs */
-#define KVM_ARM_DEVICE_VGIC_V2		0
-
-/* Supported VGIC address types  */
-#define KVM_VGIC_V2_ADDR_TYPE_DIST	0
-#define KVM_VGIC_V2_ADDR_TYPE_CPU	1
-
-#define KVM_VGIC_V2_DIST_SIZE		0x1000
-#define KVM_VGIC_V2_CPU_SIZE		0x2000
-
-/* Supported VGICv3 address types  */
-#define KVM_VGIC_V3_ADDR_TYPE_DIST	2
-#define KVM_VGIC_V3_ADDR_TYPE_REDIST	3
-#define KVM_VGIC_ITS_ADDR_TYPE		4
-#define KVM_VGIC_V3_ADDR_TYPE_REDIST_REGION	5
-
-#define KVM_VGIC_V3_DIST_SIZE		SZ_64K
-#define KVM_VGIC_V3_REDIST_SIZE		(2 * SZ_64K)
-#define KVM_VGIC_V3_ITS_SIZE		(2 * SZ_64K)
-
-#define KVM_ARM_VCPU_POWER_OFF		0 /* CPU is started in OFF state */
-#define KVM_ARM_VCPU_PSCI_0_2		1 /* CPU uses PSCI v0.2 */
-
-struct kvm_vcpu_init {
-	__u32 target;
-	__u32 features[7];
-};
-
-struct kvm_sregs {
-};
-
-struct kvm_fpu {
-};
-
-struct kvm_guest_debug_arch {
-};
-
-struct kvm_debug_exit_arch {
-};
-
-struct kvm_sync_regs {
-	/* Used with KVM_CAP_ARM_USER_IRQ */
-	__u64 device_irq_level;
-};
-
-struct kvm_arch_memory_slot {
-};
-
-/* for KVM_GET/SET_VCPU_EVENTS */
-struct kvm_vcpu_events {
-	struct {
-		__u8 serror_pending;
-		__u8 serror_has_esr;
-		__u8 ext_dabt_pending;
-		/* Align it to 8 bytes */
-		__u8 pad[5];
-		__u64 serror_esr;
-	} exception;
-	__u32 reserved[12];
-};
-
-/* If you need to interpret the index values, here is the key: */
-#define KVM_REG_ARM_COPROC_MASK		0x000000000FFF0000
-#define KVM_REG_ARM_COPROC_SHIFT	16
-#define KVM_REG_ARM_32_OPC2_MASK	0x0000000000000007
-#define KVM_REG_ARM_32_OPC2_SHIFT	0
-#define KVM_REG_ARM_OPC1_MASK		0x0000000000000078
-#define KVM_REG_ARM_OPC1_SHIFT		3
-#define KVM_REG_ARM_CRM_MASK		0x0000000000000780
-#define KVM_REG_ARM_CRM_SHIFT		7
-#define KVM_REG_ARM_32_CRN_MASK		0x0000000000007800
-#define KVM_REG_ARM_32_CRN_SHIFT	11
-/*
- * For KVM currently all guest registers are nonsecure, but we reserve a bit
- * in the encoding to distinguish secure from nonsecure for AArch32 system
- * registers that are banked by security. This is 1 for the secure banked
- * register, and 0 for the nonsecure banked register or if the register is
- * not banked by security.
- */
-#define KVM_REG_ARM_SECURE_MASK	0x0000000010000000
-#define KVM_REG_ARM_SECURE_SHIFT	28
-
-#define ARM_CP15_REG_SHIFT_MASK(x,n) \
-	(((x) << KVM_REG_ARM_ ## n ## _SHIFT) & KVM_REG_ARM_ ## n ## _MASK)
-
-#define __ARM_CP15_REG(op1,crn,crm,op2) \
-	(KVM_REG_ARM | (15 << KVM_REG_ARM_COPROC_SHIFT) | \
-	ARM_CP15_REG_SHIFT_MASK(op1, OPC1) | \
-	ARM_CP15_REG_SHIFT_MASK(crn, 32_CRN) | \
-	ARM_CP15_REG_SHIFT_MASK(crm, CRM) | \
-	ARM_CP15_REG_SHIFT_MASK(op2, 32_OPC2))
-
-#define ARM_CP15_REG32(...) (__ARM_CP15_REG(__VA_ARGS__) | KVM_REG_SIZE_U32)
-
-#define __ARM_CP15_REG64(op1,crm) \
-	(__ARM_CP15_REG(op1, 0, crm, 0) | KVM_REG_SIZE_U64)
-#define ARM_CP15_REG64(...) __ARM_CP15_REG64(__VA_ARGS__)
-
-/* PL1 Physical Timer Registers */
-#define KVM_REG_ARM_PTIMER_CTL		ARM_CP15_REG32(0, 14, 2, 1)
-#define KVM_REG_ARM_PTIMER_CNT		ARM_CP15_REG64(0, 14)
-#define KVM_REG_ARM_PTIMER_CVAL		ARM_CP15_REG64(2, 14)
-
-/* Virtual Timer Registers */
-#define KVM_REG_ARM_TIMER_CTL		ARM_CP15_REG32(0, 14, 3, 1)
-#define KVM_REG_ARM_TIMER_CNT		ARM_CP15_REG64(1, 14)
-#define KVM_REG_ARM_TIMER_CVAL		ARM_CP15_REG64(3, 14)
-
-/* Normal registers are mapped as coprocessor 16. */
-#define KVM_REG_ARM_CORE		(0x0010 << KVM_REG_ARM_COPROC_SHIFT)
-#define KVM_REG_ARM_CORE_REG(name)	(offsetof(struct kvm_regs, name) / 4)
-
-/* Some registers need more space to represent values. */
-#define KVM_REG_ARM_DEMUX		(0x0011 << KVM_REG_ARM_COPROC_SHIFT)
-#define KVM_REG_ARM_DEMUX_ID_MASK	0x000000000000FF00
-#define KVM_REG_ARM_DEMUX_ID_SHIFT	8
-#define KVM_REG_ARM_DEMUX_ID_CCSIDR	(0x00 << KVM_REG_ARM_DEMUX_ID_SHIFT)
-#define KVM_REG_ARM_DEMUX_VAL_MASK	0x00000000000000FF
-#define KVM_REG_ARM_DEMUX_VAL_SHIFT	0
-
-/* VFP registers: we could overload CP10 like ARM does, but that's ugly. */
-#define KVM_REG_ARM_VFP			(0x0012 << KVM_REG_ARM_COPROC_SHIFT)
-#define KVM_REG_ARM_VFP_MASK		0x000000000000FFFF
-#define KVM_REG_ARM_VFP_BASE_REG	0x0
-#define KVM_REG_ARM_VFP_FPSID		0x1000
-#define KVM_REG_ARM_VFP_FPSCR		0x1001
-#define KVM_REG_ARM_VFP_MVFR1		0x1006
-#define KVM_REG_ARM_VFP_MVFR0		0x1007
-#define KVM_REG_ARM_VFP_FPEXC		0x1008
-#define KVM_REG_ARM_VFP_FPINST		0x1009
-#define KVM_REG_ARM_VFP_FPINST2		0x100A
-
-/* KVM-as-firmware specific pseudo-registers */
-#define KVM_REG_ARM_FW			(0x0014 << KVM_REG_ARM_COPROC_SHIFT)
-#define KVM_REG_ARM_FW_REG(r)		(KVM_REG_ARM | KVM_REG_SIZE_U64 | \
-					 KVM_REG_ARM_FW | ((r) & 0xffff))
-#define KVM_REG_ARM_PSCI_VERSION	KVM_REG_ARM_FW_REG(0)
-#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1	KVM_REG_ARM_FW_REG(1)
-	/* Higher values mean better protection. */
-#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1_NOT_AVAIL		0
-#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1_AVAIL		1
-#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1_NOT_REQUIRED	2
-#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2	KVM_REG_ARM_FW_REG(2)
-	/* Higher values mean better protection. */
-#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_NOT_AVAIL		0
-#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_UNKNOWN		1
-#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_AVAIL		2
-#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_NOT_REQUIRED	3
-#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_ENABLED	(1U << 4)
-
-/* Device Control API: ARM VGIC */
-#define KVM_DEV_ARM_VGIC_GRP_ADDR	0
-#define KVM_DEV_ARM_VGIC_GRP_DIST_REGS	1
-#define KVM_DEV_ARM_VGIC_GRP_CPU_REGS	2
-#define   KVM_DEV_ARM_VGIC_CPUID_SHIFT	32
-#define   KVM_DEV_ARM_VGIC_CPUID_MASK	(0xffULL << KVM_DEV_ARM_VGIC_CPUID_SHIFT)
-#define   KVM_DEV_ARM_VGIC_V3_MPIDR_SHIFT 32
-#define   KVM_DEV_ARM_VGIC_V3_MPIDR_MASK \
-			(0xffffffffULL << KVM_DEV_ARM_VGIC_V3_MPIDR_SHIFT)
-#define   KVM_DEV_ARM_VGIC_OFFSET_SHIFT	0
-#define   KVM_DEV_ARM_VGIC_OFFSET_MASK	(0xffffffffULL << KVM_DEV_ARM_VGIC_OFFSET_SHIFT)
-#define   KVM_DEV_ARM_VGIC_SYSREG_INSTR_MASK (0xffff)
-#define KVM_DEV_ARM_VGIC_GRP_NR_IRQS	3
-#define KVM_DEV_ARM_VGIC_GRP_CTRL       4
-#define KVM_DEV_ARM_VGIC_GRP_REDIST_REGS 5
-#define KVM_DEV_ARM_VGIC_GRP_CPU_SYSREGS 6
-#define KVM_DEV_ARM_VGIC_GRP_LEVEL_INFO  7
-#define KVM_DEV_ARM_VGIC_GRP_ITS_REGS	8
-#define KVM_DEV_ARM_VGIC_LINE_LEVEL_INFO_SHIFT	10
-#define KVM_DEV_ARM_VGIC_LINE_LEVEL_INFO_MASK \
-			(0x3fffffULL << KVM_DEV_ARM_VGIC_LINE_LEVEL_INFO_SHIFT)
-#define KVM_DEV_ARM_VGIC_LINE_LEVEL_INTID_MASK 0x3ff
-#define VGIC_LEVEL_INFO_LINE_LEVEL	0
-
-/* Device Control API on vcpu fd */
-#define KVM_ARM_VCPU_PMU_V3_CTRL	0
-#define   KVM_ARM_VCPU_PMU_V3_IRQ	0
-#define   KVM_ARM_VCPU_PMU_V3_INIT	1
-#define KVM_ARM_VCPU_TIMER_CTRL		1
-#define   KVM_ARM_VCPU_TIMER_IRQ_VTIMER		0
-#define   KVM_ARM_VCPU_TIMER_IRQ_PTIMER		1
-
-#define   KVM_DEV_ARM_VGIC_CTRL_INIT		0
-#define   KVM_DEV_ARM_ITS_SAVE_TABLES		1
-#define   KVM_DEV_ARM_ITS_RESTORE_TABLES	2
-#define   KVM_DEV_ARM_VGIC_SAVE_PENDING_TABLES	3
-#define   KVM_DEV_ARM_ITS_CTRL_RESET		4
-
-/* KVM_IRQ_LINE irq field index values */
-#define KVM_ARM_IRQ_VCPU2_SHIFT		28
-#define KVM_ARM_IRQ_VCPU2_MASK		0xf
-#define KVM_ARM_IRQ_TYPE_SHIFT		24
-#define KVM_ARM_IRQ_TYPE_MASK		0xf
-#define KVM_ARM_IRQ_VCPU_SHIFT		16
-#define KVM_ARM_IRQ_VCPU_MASK		0xff
-#define KVM_ARM_IRQ_NUM_SHIFT		0
-#define KVM_ARM_IRQ_NUM_MASK		0xffff
-
-/* irq_type field */
-#define KVM_ARM_IRQ_TYPE_CPU		0
-#define KVM_ARM_IRQ_TYPE_SPI		1
-#define KVM_ARM_IRQ_TYPE_PPI		2
-
-/* out-of-kernel GIC cpu interrupt injection irq_number field */
-#define KVM_ARM_IRQ_CPU_IRQ		0
-#define KVM_ARM_IRQ_CPU_FIQ		1
-
-/*
- * This used to hold the highest supported SPI, but it is now obsolete
- * and only here to provide source code level compatibility with older
- * userland. The highest SPI number can be set via KVM_DEV_ARM_VGIC_GRP_NR_IRQS.
- */
-#define KVM_ARM_IRQ_GIC_MAX		127
-
-/* One single KVM irqchip, ie. the VGIC */
-#define KVM_NR_IRQCHIPS          1
-
-/* PSCI interface */
-#define KVM_PSCI_FN_BASE		0x95c1ba5e
-#define KVM_PSCI_FN(n)			(KVM_PSCI_FN_BASE + (n))
-
-#define KVM_PSCI_FN_CPU_SUSPEND		KVM_PSCI_FN(0)
-#define KVM_PSCI_FN_CPU_OFF		KVM_PSCI_FN(1)
-#define KVM_PSCI_FN_CPU_ON		KVM_PSCI_FN(2)
-#define KVM_PSCI_FN_MIGRATE		KVM_PSCI_FN(3)
-
-#define KVM_PSCI_RET_SUCCESS		PSCI_RET_SUCCESS
-#define KVM_PSCI_RET_NI			PSCI_RET_NOT_SUPPORTED
-#define KVM_PSCI_RET_INVAL		PSCI_RET_INVALID_PARAMS
-#define KVM_PSCI_RET_DENIED		PSCI_RET_DENIED
-
-#endif /* __ARM_KVM_H__ */
diff --git a/linux-headers/asm-arm/mman.h b/linux-headers/asm-arm/mman.h
deleted file mode 100644
index 41f99c573b..0000000000
--- a/linux-headers/asm-arm/mman.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#include <asm-generic/mman.h>
-
-#define arch_mmap_check(addr, len, flags) \
-	(((flags) & MAP_FIXED && (addr) < FIRST_USER_ADDRESS) ? -EINVAL : 0)
diff --git a/linux-headers/asm-arm/unistd-common.h b/linux-headers/asm-arm/unistd-common.h
deleted file mode 100644
index 57cd1f21db..0000000000
--- a/linux-headers/asm-arm/unistd-common.h
+++ /dev/null
@@ -1,397 +0,0 @@
-#ifndef _ASM_ARM_UNISTD_COMMON_H
-#define _ASM_ARM_UNISTD_COMMON_H 1
-
-#define __NR_restart_syscall (__NR_SYSCALL_BASE + 0)
-#define __NR_exit (__NR_SYSCALL_BASE + 1)
-#define __NR_fork (__NR_SYSCALL_BASE + 2)
-#define __NR_read (__NR_SYSCALL_BASE + 3)
-#define __NR_write (__NR_SYSCALL_BASE + 4)
-#define __NR_open (__NR_SYSCALL_BASE + 5)
-#define __NR_close (__NR_SYSCALL_BASE + 6)
-#define __NR_creat (__NR_SYSCALL_BASE + 8)
-#define __NR_link (__NR_SYSCALL_BASE + 9)
-#define __NR_unlink (__NR_SYSCALL_BASE + 10)
-#define __NR_execve (__NR_SYSCALL_BASE + 11)
-#define __NR_chdir (__NR_SYSCALL_BASE + 12)
-#define __NR_mknod (__NR_SYSCALL_BASE + 14)
-#define __NR_chmod (__NR_SYSCALL_BASE + 15)
-#define __NR_lchown (__NR_SYSCALL_BASE + 16)
-#define __NR_lseek (__NR_SYSCALL_BASE + 19)
-#define __NR_getpid (__NR_SYSCALL_BASE + 20)
-#define __NR_mount (__NR_SYSCALL_BASE + 21)
-#define __NR_setuid (__NR_SYSCALL_BASE + 23)
-#define __NR_getuid (__NR_SYSCALL_BASE + 24)
-#define __NR_ptrace (__NR_SYSCALL_BASE + 26)
-#define __NR_pause (__NR_SYSCALL_BASE + 29)
-#define __NR_access (__NR_SYSCALL_BASE + 33)
-#define __NR_nice (__NR_SYSCALL_BASE + 34)
-#define __NR_sync (__NR_SYSCALL_BASE + 36)
-#define __NR_kill (__NR_SYSCALL_BASE + 37)
-#define __NR_rename (__NR_SYSCALL_BASE + 38)
-#define __NR_mkdir (__NR_SYSCALL_BASE + 39)
-#define __NR_rmdir (__NR_SYSCALL_BASE + 40)
-#define __NR_dup (__NR_SYSCALL_BASE + 41)
-#define __NR_pipe (__NR_SYSCALL_BASE + 42)
-#define __NR_times (__NR_SYSCALL_BASE + 43)
-#define __NR_brk (__NR_SYSCALL_BASE + 45)
-#define __NR_setgid (__NR_SYSCALL_BASE + 46)
-#define __NR_getgid (__NR_SYSCALL_BASE + 47)
-#define __NR_geteuid (__NR_SYSCALL_BASE + 49)
-#define __NR_getegid (__NR_SYSCALL_BASE + 50)
-#define __NR_acct (__NR_SYSCALL_BASE + 51)
-#define __NR_umount2 (__NR_SYSCALL_BASE + 52)
-#define __NR_ioctl (__NR_SYSCALL_BASE + 54)
-#define __NR_fcntl (__NR_SYSCALL_BASE + 55)
-#define __NR_setpgid (__NR_SYSCALL_BASE + 57)
-#define __NR_umask (__NR_SYSCALL_BASE + 60)
-#define __NR_chroot (__NR_SYSCALL_BASE + 61)
-#define __NR_ustat (__NR_SYSCALL_BASE + 62)
-#define __NR_dup2 (__NR_SYSCALL_BASE + 63)
-#define __NR_getppid (__NR_SYSCALL_BASE + 64)
-#define __NR_getpgrp (__NR_SYSCALL_BASE + 65)
-#define __NR_setsid (__NR_SYSCALL_BASE + 66)
-#define __NR_sigaction (__NR_SYSCALL_BASE + 67)
-#define __NR_setreuid (__NR_SYSCALL_BASE + 70)
-#define __NR_setregid (__NR_SYSCALL_BASE + 71)
-#define __NR_sigsuspend (__NR_SYSCALL_BASE + 72)
-#define __NR_sigpending (__NR_SYSCALL_BASE + 73)
-#define __NR_sethostname (__NR_SYSCALL_BASE + 74)
-#define __NR_setrlimit (__NR_SYSCALL_BASE + 75)
-#define __NR_getrusage (__NR_SYSCALL_BASE + 77)
-#define __NR_gettimeofday (__NR_SYSCALL_BASE + 78)
-#define __NR_settimeofday (__NR_SYSCALL_BASE + 79)
-#define __NR_getgroups (__NR_SYSCALL_BASE + 80)
-#define __NR_setgroups (__NR_SYSCALL_BASE + 81)
-#define __NR_symlink (__NR_SYSCALL_BASE + 83)
-#define __NR_readlink (__NR_SYSCALL_BASE + 85)
-#define __NR_uselib (__NR_SYSCALL_BASE + 86)
-#define __NR_swapon (__NR_SYSCALL_BASE + 87)
-#define __NR_reboot (__NR_SYSCALL_BASE + 88)
-#define __NR_munmap (__NR_SYSCALL_BASE + 91)
-#define __NR_truncate (__NR_SYSCALL_BASE + 92)
-#define __NR_ftruncate (__NR_SYSCALL_BASE + 93)
-#define __NR_fchmod (__NR_SYSCALL_BASE + 94)
-#define __NR_fchown (__NR_SYSCALL_BASE + 95)
-#define __NR_getpriority (__NR_SYSCALL_BASE + 96)
-#define __NR_setpriority (__NR_SYSCALL_BASE + 97)
-#define __NR_statfs (__NR_SYSCALL_BASE + 99)
-#define __NR_fstatfs (__NR_SYSCALL_BASE + 100)
-#define __NR_syslog (__NR_SYSCALL_BASE + 103)
-#define __NR_setitimer (__NR_SYSCALL_BASE + 104)
-#define __NR_getitimer (__NR_SYSCALL_BASE + 105)
-#define __NR_stat (__NR_SYSCALL_BASE + 106)
-#define __NR_lstat (__NR_SYSCALL_BASE + 107)
-#define __NR_fstat (__NR_SYSCALL_BASE + 108)
-#define __NR_vhangup (__NR_SYSCALL_BASE + 111)
-#define __NR_wait4 (__NR_SYSCALL_BASE + 114)
-#define __NR_swapoff (__NR_SYSCALL_BASE + 115)
-#define __NR_sysinfo (__NR_SYSCALL_BASE + 116)
-#define __NR_fsync (__NR_SYSCALL_BASE + 118)
-#define __NR_sigreturn (__NR_SYSCALL_BASE + 119)
-#define __NR_clone (__NR_SYSCALL_BASE + 120)
-#define __NR_setdomainname (__NR_SYSCALL_BASE + 121)
-#define __NR_uname (__NR_SYSCALL_BASE + 122)
-#define __NR_adjtimex (__NR_SYSCALL_BASE + 124)
-#define __NR_mprotect (__NR_SYSCALL_BASE + 125)
-#define __NR_sigprocmask (__NR_SYSCALL_BASE + 126)
-#define __NR_init_module (__NR_SYSCALL_BASE + 128)
-#define __NR_delete_module (__NR_SYSCALL_BASE + 129)
-#define __NR_quotactl (__NR_SYSCALL_BASE + 131)
-#define __NR_getpgid (__NR_SYSCALL_BASE + 132)
-#define __NR_fchdir (__NR_SYSCALL_BASE + 133)
-#define __NR_bdflush (__NR_SYSCALL_BASE + 134)
-#define __NR_sysfs (__NR_SYSCALL_BASE + 135)
-#define __NR_personality (__NR_SYSCALL_BASE + 136)
-#define __NR_setfsuid (__NR_SYSCALL_BASE + 138)
-#define __NR_setfsgid (__NR_SYSCALL_BASE + 139)
-#define __NR__llseek (__NR_SYSCALL_BASE + 140)
-#define __NR_getdents (__NR_SYSCALL_BASE + 141)
-#define __NR__newselect (__NR_SYSCALL_BASE + 142)
-#define __NR_flock (__NR_SYSCALL_BASE + 143)
-#define __NR_msync (__NR_SYSCALL_BASE + 144)
-#define __NR_readv (__NR_SYSCALL_BASE + 145)
-#define __NR_writev (__NR_SYSCALL_BASE + 146)
-#define __NR_getsid (__NR_SYSCALL_BASE + 147)
-#define __NR_fdatasync (__NR_SYSCALL_BASE + 148)
-#define __NR__sysctl (__NR_SYSCALL_BASE + 149)
-#define __NR_mlock (__NR_SYSCALL_BASE + 150)
-#define __NR_munlock (__NR_SYSCALL_BASE + 151)
-#define __NR_mlockall (__NR_SYSCALL_BASE + 152)
-#define __NR_munlockall (__NR_SYSCALL_BASE + 153)
-#define __NR_sched_setparam (__NR_SYSCALL_BASE + 154)
-#define __NR_sched_getparam (__NR_SYSCALL_BASE + 155)
-#define __NR_sched_setscheduler (__NR_SYSCALL_BASE + 156)
-#define __NR_sched_getscheduler (__NR_SYSCALL_BASE + 157)
-#define __NR_sched_yield (__NR_SYSCALL_BASE + 158)
-#define __NR_sched_get_priority_max (__NR_SYSCALL_BASE + 159)
-#define __NR_sched_get_priority_min (__NR_SYSCALL_BASE + 160)
-#define __NR_sched_rr_get_interval (__NR_SYSCALL_BASE + 161)
-#define __NR_nanosleep (__NR_SYSCALL_BASE + 162)
-#define __NR_mremap (__NR_SYSCALL_BASE + 163)
-#define __NR_setresuid (__NR_SYSCALL_BASE + 164)
-#define __NR_getresuid (__NR_SYSCALL_BASE + 165)
-#define __NR_poll (__NR_SYSCALL_BASE + 168)
-#define __NR_nfsservctl (__NR_SYSCALL_BASE + 169)
-#define __NR_setresgid (__NR_SYSCALL_BASE + 170)
-#define __NR_getresgid (__NR_SYSCALL_BASE + 171)
-#define __NR_prctl (__NR_SYSCALL_BASE + 172)
-#define __NR_rt_sigreturn (__NR_SYSCALL_BASE + 173)
-#define __NR_rt_sigaction (__NR_SYSCALL_BASE + 174)
-#define __NR_rt_sigprocmask (__NR_SYSCALL_BASE + 175)
-#define __NR_rt_sigpending (__NR_SYSCALL_BASE + 176)
-#define __NR_rt_sigtimedwait (__NR_SYSCALL_BASE + 177)
-#define __NR_rt_sigqueueinfo (__NR_SYSCALL_BASE + 178)
-#define __NR_rt_sigsuspend (__NR_SYSCALL_BASE + 179)
-#define __NR_pread64 (__NR_SYSCALL_BASE + 180)
-#define __NR_pwrite64 (__NR_SYSCALL_BASE + 181)
-#define __NR_chown (__NR_SYSCALL_BASE + 182)
-#define __NR_getcwd (__NR_SYSCALL_BASE + 183)
-#define __NR_capget (__NR_SYSCALL_BASE + 184)
-#define __NR_capset (__NR_SYSCALL_BASE + 185)
-#define __NR_sigaltstack (__NR_SYSCALL_BASE + 186)
-#define __NR_sendfile (__NR_SYSCALL_BASE + 187)
-#define __NR_vfork (__NR_SYSCALL_BASE + 190)
-#define __NR_ugetrlimit (__NR_SYSCALL_BASE + 191)
-#define __NR_mmap2 (__NR_SYSCALL_BASE + 192)
-#define __NR_truncate64 (__NR_SYSCALL_BASE + 193)
-#define __NR_ftruncate64 (__NR_SYSCALL_BASE + 194)
-#define __NR_stat64 (__NR_SYSCALL_BASE + 195)
-#define __NR_lstat64 (__NR_SYSCALL_BASE + 196)
-#define __NR_fstat64 (__NR_SYSCALL_BASE + 197)
-#define __NR_lchown32 (__NR_SYSCALL_BASE + 198)
-#define __NR_getuid32 (__NR_SYSCALL_BASE + 199)
-#define __NR_getgid32 (__NR_SYSCALL_BASE + 200)
-#define __NR_geteuid32 (__NR_SYSCALL_BASE + 201)
-#define __NR_getegid32 (__NR_SYSCALL_BASE + 202)
-#define __NR_setreuid32 (__NR_SYSCALL_BASE + 203)
-#define __NR_setregid32 (__NR_SYSCALL_BASE + 204)
-#define __NR_getgroups32 (__NR_SYSCALL_BASE + 205)
-#define __NR_setgroups32 (__NR_SYSCALL_BASE + 206)
-#define __NR_fchown32 (__NR_SYSCALL_BASE + 207)
-#define __NR_setresuid32 (__NR_SYSCALL_BASE + 208)
-#define __NR_getresuid32 (__NR_SYSCALL_BASE + 209)
-#define __NR_setresgid32 (__NR_SYSCALL_BASE + 210)
-#define __NR_getresgid32 (__NR_SYSCALL_BASE + 211)
-#define __NR_chown32 (__NR_SYSCALL_BASE + 212)
-#define __NR_setuid32 (__NR_SYSCALL_BASE + 213)
-#define __NR_setgid32 (__NR_SYSCALL_BASE + 214)
-#define __NR_setfsuid32 (__NR_SYSCALL_BASE + 215)
-#define __NR_setfsgid32 (__NR_SYSCALL_BASE + 216)
-#define __NR_getdents64 (__NR_SYSCALL_BASE + 217)
-#define __NR_pivot_root (__NR_SYSCALL_BASE + 218)
-#define __NR_mincore (__NR_SYSCALL_BASE + 219)
-#define __NR_madvise (__NR_SYSCALL_BASE + 220)
-#define __NR_fcntl64 (__NR_SYSCALL_BASE + 221)
-#define __NR_gettid (__NR_SYSCALL_BASE + 224)
-#define __NR_readahead (__NR_SYSCALL_BASE + 225)
-#define __NR_setxattr (__NR_SYSCALL_BASE + 226)
-#define __NR_lsetxattr (__NR_SYSCALL_BASE + 227)
-#define __NR_fsetxattr (__NR_SYSCALL_BASE + 228)
-#define __NR_getxattr (__NR_SYSCALL_BASE + 229)
-#define __NR_lgetxattr (__NR_SYSCALL_BASE + 230)
-#define __NR_fgetxattr (__NR_SYSCALL_BASE + 231)
-#define __NR_listxattr (__NR_SYSCALL_BASE + 232)
-#define __NR_llistxattr (__NR_SYSCALL_BASE + 233)
-#define __NR_flistxattr (__NR_SYSCALL_BASE + 234)
-#define __NR_removexattr (__NR_SYSCALL_BASE + 235)
-#define __NR_lremovexattr (__NR_SYSCALL_BASE + 236)
-#define __NR_fremovexattr (__NR_SYSCALL_BASE + 237)
-#define __NR_tkill (__NR_SYSCALL_BASE + 238)
-#define __NR_sendfile64 (__NR_SYSCALL_BASE + 239)
-#define __NR_futex (__NR_SYSCALL_BASE + 240)
-#define __NR_sched_setaffinity (__NR_SYSCALL_BASE + 241)
-#define __NR_sched_getaffinity (__NR_SYSCALL_BASE + 242)
-#define __NR_io_setup (__NR_SYSCALL_BASE + 243)
-#define __NR_io_destroy (__NR_SYSCALL_BASE + 244)
-#define __NR_io_getevents (__NR_SYSCALL_BASE + 245)
-#define __NR_io_submit (__NR_SYSCALL_BASE + 246)
-#define __NR_io_cancel (__NR_SYSCALL_BASE + 247)
-#define __NR_exit_group (__NR_SYSCALL_BASE + 248)
-#define __NR_lookup_dcookie (__NR_SYSCALL_BASE + 249)
-#define __NR_epoll_create (__NR_SYSCALL_BASE + 250)
-#define __NR_epoll_ctl (__NR_SYSCALL_BASE + 251)
-#define __NR_epoll_wait (__NR_SYSCALL_BASE + 252)
-#define __NR_remap_file_pages (__NR_SYSCALL_BASE + 253)
-#define __NR_set_tid_address (__NR_SYSCALL_BASE + 256)
-#define __NR_timer_create (__NR_SYSCALL_BASE + 257)
-#define __NR_timer_settime (__NR_SYSCALL_BASE + 258)
-#define __NR_timer_gettime (__NR_SYSCALL_BASE + 259)
-#define __NR_timer_getoverrun (__NR_SYSCALL_BASE + 260)
-#define __NR_timer_delete (__NR_SYSCALL_BASE + 261)
-#define __NR_clock_settime (__NR_SYSCALL_BASE + 262)
-#define __NR_clock_gettime (__NR_SYSCALL_BASE + 263)
-#define __NR_clock_getres (__NR_SYSCALL_BASE + 264)
-#define __NR_clock_nanosleep (__NR_SYSCALL_BASE + 265)
-#define __NR_statfs64 (__NR_SYSCALL_BASE + 266)
-#define __NR_fstatfs64 (__NR_SYSCALL_BASE + 267)
-#define __NR_tgkill (__NR_SYSCALL_BASE + 268)
-#define __NR_utimes (__NR_SYSCALL_BASE + 269)
-#define __NR_arm_fadvise64_64 (__NR_SYSCALL_BASE + 270)
-#define __NR_pciconfig_iobase (__NR_SYSCALL_BASE + 271)
-#define __NR_pciconfig_read (__NR_SYSCALL_BASE + 272)
-#define __NR_pciconfig_write (__NR_SYSCALL_BASE + 273)
-#define __NR_mq_open (__NR_SYSCALL_BASE + 274)
-#define __NR_mq_unlink (__NR_SYSCALL_BASE + 275)
-#define __NR_mq_timedsend (__NR_SYSCALL_BASE + 276)
-#define __NR_mq_timedreceive (__NR_SYSCALL_BASE + 277)
-#define __NR_mq_notify (__NR_SYSCALL_BASE + 278)
-#define __NR_mq_getsetattr (__NR_SYSCALL_BASE + 279)
-#define __NR_waitid (__NR_SYSCALL_BASE + 280)
-#define __NR_socket (__NR_SYSCALL_BASE + 281)
-#define __NR_bind (__NR_SYSCALL_BASE + 282)
-#define __NR_connect (__NR_SYSCALL_BASE + 283)
-#define __NR_listen (__NR_SYSCALL_BASE + 284)
-#define __NR_accept (__NR_SYSCALL_BASE + 285)
-#define __NR_getsockname (__NR_SYSCALL_BASE + 286)
-#define __NR_getpeername (__NR_SYSCALL_BASE + 287)
-#define __NR_socketpair (__NR_SYSCALL_BASE + 288)
-#define __NR_send (__NR_SYSCALL_BASE + 289)
-#define __NR_sendto (__NR_SYSCALL_BASE + 290)
-#define __NR_recv (__NR_SYSCALL_BASE + 291)
-#define __NR_recvfrom (__NR_SYSCALL_BASE + 292)
-#define __NR_shutdown (__NR_SYSCALL_BASE + 293)
-#define __NR_setsockopt (__NR_SYSCALL_BASE + 294)
-#define __NR_getsockopt (__NR_SYSCALL_BASE + 295)
-#define __NR_sendmsg (__NR_SYSCALL_BASE + 296)
-#define __NR_recvmsg (__NR_SYSCALL_BASE + 297)
-#define __NR_semop (__NR_SYSCALL_BASE + 298)
-#define __NR_semget (__NR_SYSCALL_BASE + 299)
-#define __NR_semctl (__NR_SYSCALL_BASE + 300)
-#define __NR_msgsnd (__NR_SYSCALL_BASE + 301)
-#define __NR_msgrcv (__NR_SYSCALL_BASE + 302)
-#define __NR_msgget (__NR_SYSCALL_BASE + 303)
-#define __NR_msgctl (__NR_SYSCALL_BASE + 304)
-#define __NR_shmat (__NR_SYSCALL_BASE + 305)
-#define __NR_shmdt (__NR_SYSCALL_BASE + 306)
-#define __NR_shmget (__NR_SYSCALL_BASE + 307)
-#define __NR_shmctl (__NR_SYSCALL_BASE + 308)
-#define __NR_add_key (__NR_SYSCALL_BASE + 309)
-#define __NR_request_key (__NR_SYSCALL_BASE + 310)
-#define __NR_keyctl (__NR_SYSCALL_BASE + 311)
-#define __NR_semtimedop (__NR_SYSCALL_BASE + 312)
-#define __NR_vserver (__NR_SYSCALL_BASE + 313)
-#define __NR_ioprio_set (__NR_SYSCALL_BASE + 314)
-#define __NR_ioprio_get (__NR_SYSCALL_BASE + 315)
-#define __NR_inotify_init (__NR_SYSCALL_BASE + 316)
-#define __NR_inotify_add_watch (__NR_SYSCALL_BASE + 317)
-#define __NR_inotify_rm_watch (__NR_SYSCALL_BASE + 318)
-#define __NR_mbind (__NR_SYSCALL_BASE + 319)
-#define __NR_get_mempolicy (__NR_SYSCALL_BASE + 320)
-#define __NR_set_mempolicy (__NR_SYSCALL_BASE + 321)
-#define __NR_openat (__NR_SYSCALL_BASE + 322)
-#define __NR_mkdirat (__NR_SYSCALL_BASE + 323)
-#define __NR_mknodat (__NR_SYSCALL_BASE + 324)
-#define __NR_fchownat (__NR_SYSCALL_BASE + 325)
-#define __NR_futimesat (__NR_SYSCALL_BASE + 326)
-#define __NR_fstatat64 (__NR_SYSCALL_BASE + 327)
-#define __NR_unlinkat (__NR_SYSCALL_BASE + 328)
-#define __NR_renameat (__NR_SYSCALL_BASE + 329)
-#define __NR_linkat (__NR_SYSCALL_BASE + 330)
-#define __NR_symlinkat (__NR_SYSCALL_BASE + 331)
-#define __NR_readlinkat (__NR_SYSCALL_BASE + 332)
-#define __NR_fchmodat (__NR_SYSCALL_BASE + 333)
-#define __NR_faccessat (__NR_SYSCALL_BASE + 334)
-#define __NR_pselect6 (__NR_SYSCALL_BASE + 335)
-#define __NR_ppoll (__NR_SYSCALL_BASE + 336)
-#define __NR_unshare (__NR_SYSCALL_BASE + 337)
-#define __NR_set_robust_list (__NR_SYSCALL_BASE + 338)
-#define __NR_get_robust_list (__NR_SYSCALL_BASE + 339)
-#define __NR_splice (__NR_SYSCALL_BASE + 340)
-#define __NR_arm_sync_file_range (__NR_SYSCALL_BASE + 341)
-#define __NR_tee (__NR_SYSCALL_BASE + 342)
-#define __NR_vmsplice (__NR_SYSCALL_BASE + 343)
-#define __NR_move_pages (__NR_SYSCALL_BASE + 344)
-#define __NR_getcpu (__NR_SYSCALL_BASE + 345)
-#define __NR_epoll_pwait (__NR_SYSCALL_BASE + 346)
-#define __NR_kexec_load (__NR_SYSCALL_BASE + 347)
-#define __NR_utimensat (__NR_SYSCALL_BASE + 348)
-#define __NR_signalfd (__NR_SYSCALL_BASE + 349)
-#define __NR_timerfd_create (__NR_SYSCALL_BASE + 350)
-#define __NR_eventfd (__NR_SYSCALL_BASE + 351)
-#define __NR_fallocate (__NR_SYSCALL_BASE + 352)
-#define __NR_timerfd_settime (__NR_SYSCALL_BASE + 353)
-#define __NR_timerfd_gettime (__NR_SYSCALL_BASE + 354)
-#define __NR_signalfd4 (__NR_SYSCALL_BASE + 355)
-#define __NR_eventfd2 (__NR_SYSCALL_BASE + 356)
-#define __NR_epoll_create1 (__NR_SYSCALL_BASE + 357)
-#define __NR_dup3 (__NR_SYSCALL_BASE + 358)
-#define __NR_pipe2 (__NR_SYSCALL_BASE + 359)
-#define __NR_inotify_init1 (__NR_SYSCALL_BASE + 360)
-#define __NR_preadv (__NR_SYSCALL_BASE + 361)
-#define __NR_pwritev (__NR_SYSCALL_BASE + 362)
-#define __NR_rt_tgsigqueueinfo (__NR_SYSCALL_BASE + 363)
-#define __NR_perf_event_open (__NR_SYSCALL_BASE + 364)
-#define __NR_recvmmsg (__NR_SYSCALL_BASE + 365)
-#define __NR_accept4 (__NR_SYSCALL_BASE + 366)
-#define __NR_fanotify_init (__NR_SYSCALL_BASE + 367)
-#define __NR_fanotify_mark (__NR_SYSCALL_BASE + 368)
-#define __NR_prlimit64 (__NR_SYSCALL_BASE + 369)
-#define __NR_name_to_handle_at (__NR_SYSCALL_BASE + 370)
-#define __NR_open_by_handle_at (__NR_SYSCALL_BASE + 371)
-#define __NR_clock_adjtime (__NR_SYSCALL_BASE + 372)
-#define __NR_syncfs (__NR_SYSCALL_BASE + 373)
-#define __NR_sendmmsg (__NR_SYSCALL_BASE + 374)
-#define __NR_setns (__NR_SYSCALL_BASE + 375)
-#define __NR_process_vm_readv (__NR_SYSCALL_BASE + 376)
-#define __NR_process_vm_writev (__NR_SYSCALL_BASE + 377)
-#define __NR_kcmp (__NR_SYSCALL_BASE + 378)
-#define __NR_finit_module (__NR_SYSCALL_BASE + 379)
-#define __NR_sched_setattr (__NR_SYSCALL_BASE + 380)
-#define __NR_sched_getattr (__NR_SYSCALL_BASE + 381)
-#define __NR_renameat2 (__NR_SYSCALL_BASE + 382)
-#define __NR_seccomp (__NR_SYSCALL_BASE + 383)
-#define __NR_getrandom (__NR_SYSCALL_BASE + 384)
-#define __NR_memfd_create (__NR_SYSCALL_BASE + 385)
-#define __NR_bpf (__NR_SYSCALL_BASE + 386)
-#define __NR_execveat (__NR_SYSCALL_BASE + 387)
-#define __NR_userfaultfd (__NR_SYSCALL_BASE + 388)
-#define __NR_membarrier (__NR_SYSCALL_BASE + 389)
-#define __NR_mlock2 (__NR_SYSCALL_BASE + 390)
-#define __NR_copy_file_range (__NR_SYSCALL_BASE + 391)
-#define __NR_preadv2 (__NR_SYSCALL_BASE + 392)
-#define __NR_pwritev2 (__NR_SYSCALL_BASE + 393)
-#define __NR_pkey_mprotect (__NR_SYSCALL_BASE + 394)
-#define __NR_pkey_alloc (__NR_SYSCALL_BASE + 395)
-#define __NR_pkey_free (__NR_SYSCALL_BASE + 396)
-#define __NR_statx (__NR_SYSCALL_BASE + 397)
-#define __NR_rseq (__NR_SYSCALL_BASE + 398)
-#define __NR_io_pgetevents (__NR_SYSCALL_BASE + 399)
-#define __NR_migrate_pages (__NR_SYSCALL_BASE + 400)
-#define __NR_kexec_file_load (__NR_SYSCALL_BASE + 401)
-#define __NR_clock_gettime64 (__NR_SYSCALL_BASE + 403)
-#define __NR_clock_settime64 (__NR_SYSCALL_BASE + 404)
-#define __NR_clock_adjtime64 (__NR_SYSCALL_BASE + 405)
-#define __NR_clock_getres_time64 (__NR_SYSCALL_BASE + 406)
-#define __NR_clock_nanosleep_time64 (__NR_SYSCALL_BASE + 407)
-#define __NR_timer_gettime64 (__NR_SYSCALL_BASE + 408)
-#define __NR_timer_settime64 (__NR_SYSCALL_BASE + 409)
-#define __NR_timerfd_gettime64 (__NR_SYSCALL_BASE + 410)
-#define __NR_timerfd_settime64 (__NR_SYSCALL_BASE + 411)
-#define __NR_utimensat_time64 (__NR_SYSCALL_BASE + 412)
-#define __NR_pselect6_time64 (__NR_SYSCALL_BASE + 413)
-#define __NR_ppoll_time64 (__NR_SYSCALL_BASE + 414)
-#define __NR_io_pgetevents_time64 (__NR_SYSCALL_BASE + 416)
-#define __NR_recvmmsg_time64 (__NR_SYSCALL_BASE + 417)
-#define __NR_mq_timedsend_time64 (__NR_SYSCALL_BASE + 418)
-#define __NR_mq_timedreceive_time64 (__NR_SYSCALL_BASE + 419)
-#define __NR_semtimedop_time64 (__NR_SYSCALL_BASE + 420)
-#define __NR_rt_sigtimedwait_time64 (__NR_SYSCALL_BASE + 421)
-#define __NR_futex_time64 (__NR_SYSCALL_BASE + 422)
-#define __NR_sched_rr_get_interval_time64 (__NR_SYSCALL_BASE + 423)
-#define __NR_pidfd_send_signal (__NR_SYSCALL_BASE + 424)
-#define __NR_io_uring_setup (__NR_SYSCALL_BASE + 425)
-#define __NR_io_uring_enter (__NR_SYSCALL_BASE + 426)
-#define __NR_io_uring_register (__NR_SYSCALL_BASE + 427)
-#define __NR_open_tree (__NR_SYSCALL_BASE + 428)
-#define __NR_move_mount (__NR_SYSCALL_BASE + 429)
-#define __NR_fsopen (__NR_SYSCALL_BASE + 430)
-#define __NR_fsconfig (__NR_SYSCALL_BASE + 431)
-#define __NR_fsmount (__NR_SYSCALL_BASE + 432)
-#define __NR_fspick (__NR_SYSCALL_BASE + 433)
-#define __NR_pidfd_open (__NR_SYSCALL_BASE + 434)
-#define __NR_clone3 (__NR_SYSCALL_BASE + 435)
-#define __NR_openat2 (__NR_SYSCALL_BASE + 437)
-#define __NR_pidfd_getfd (__NR_SYSCALL_BASE + 438)
-#define __NR_faccessat2 (__NR_SYSCALL_BASE + 439)
-
-#endif /* _ASM_ARM_UNISTD_COMMON_H */
diff --git a/linux-headers/asm-arm/unistd-eabi.h b/linux-headers/asm-arm/unistd-eabi.h
deleted file mode 100644
index 266f1fcdfb..0000000000
--- a/linux-headers/asm-arm/unistd-eabi.h
+++ /dev/null
@@ -1,5 +0,0 @@
-#ifndef _ASM_ARM_UNISTD_EABI_H
-#define _ASM_ARM_UNISTD_EABI_H 1
-
-
-#endif /* _ASM_ARM_UNISTD_EABI_H */
diff --git a/linux-headers/asm-arm/unistd-oabi.h b/linux-headers/asm-arm/unistd-oabi.h
deleted file mode 100644
index 47d9afb96d..0000000000
--- a/linux-headers/asm-arm/unistd-oabi.h
+++ /dev/null
@@ -1,17 +0,0 @@
-#ifndef _ASM_ARM_UNISTD_OABI_H
-#define _ASM_ARM_UNISTD_OABI_H 1
-
-#define __NR_time (__NR_SYSCALL_BASE + 13)
-#define __NR_umount (__NR_SYSCALL_BASE + 22)
-#define __NR_stime (__NR_SYSCALL_BASE + 25)
-#define __NR_alarm (__NR_SYSCALL_BASE + 27)
-#define __NR_utime (__NR_SYSCALL_BASE + 30)
-#define __NR_getrlimit (__NR_SYSCALL_BASE + 76)
-#define __NR_select (__NR_SYSCALL_BASE + 82)
-#define __NR_readdir (__NR_SYSCALL_BASE + 89)
-#define __NR_mmap (__NR_SYSCALL_BASE + 90)
-#define __NR_socketcall (__NR_SYSCALL_BASE + 102)
-#define __NR_syscall (__NR_SYSCALL_BASE + 113)
-#define __NR_ipc (__NR_SYSCALL_BASE + 117)
-
-#endif /* _ASM_ARM_UNISTD_OABI_H */
diff --git a/linux-headers/asm-arm/unistd.h b/linux-headers/asm-arm/unistd.h
deleted file mode 100644
index 18b0825885..0000000000
--- a/linux-headers/asm-arm/unistd.h
+++ /dev/null
@@ -1,41 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
-/*
- *  arch/arm/include/asm/unistd.h
- *
- *  Copyright (C) 2001-2005 Russell King
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- *
- * Please forward _all_ changes to this file to rmk@arm.linux.org.uk,
- * no matter what the change is.  Thanks!
- */
-#ifndef __ASM_ARM_UNISTD_H
-#define __ASM_ARM_UNISTD_H
-
-#define __NR_OABI_SYSCALL_BASE	0x900000
-
-#if defined(__thumb__) || defined(__ARM_EABI__)
-#define __NR_SYSCALL_BASE	0
-#include <asm/unistd-eabi.h>
-#else
-#define __NR_SYSCALL_BASE	__NR_OABI_SYSCALL_BASE
-#include <asm/unistd-oabi.h>
-#endif
-
-#include <asm/unistd-common.h>
-#define __NR_sync_file_range2		__NR_arm_sync_file_range
-
-/*
- * The following SWIs are ARM private.
- */
-#define __ARM_NR_BASE			(__NR_SYSCALL_BASE+0x0f0000)
-#define __ARM_NR_breakpoint		(__ARM_NR_BASE+1)
-#define __ARM_NR_cacheflush		(__ARM_NR_BASE+2)
-#define __ARM_NR_usr26			(__ARM_NR_BASE+3)
-#define __ARM_NR_usr32			(__ARM_NR_BASE+4)
-#define __ARM_NR_set_tls		(__ARM_NR_BASE+5)
-#define __ARM_NR_get_tls		(__ARM_NR_BASE+6)
-
-#endif /* __ASM_ARM_UNISTD_H */
diff --git a/scripts/update-linux-headers.sh b/scripts/update-linux-headers.sh
index b43b8ef75a..717c379f9e 100755
--- a/scripts/update-linux-headers.sh
+++ b/scripts/update-linux-headers.sh
@@ -156,11 +156,6 @@ EOF
         cp "$hdrdir/include/asm/unistd_32.h" "$output/linux-headers/asm-s390/"
         cp "$hdrdir/include/asm/unistd_64.h" "$output/linux-headers/asm-s390/"
     fi
-    if [ $arch = arm ]; then
-        cp "$hdrdir/include/asm/unistd-eabi.h" "$output/linux-headers/asm-arm/"
-        cp "$hdrdir/include/asm/unistd-oabi.h" "$output/linux-headers/asm-arm/"
-        cp "$hdrdir/include/asm/unistd-common.h" "$output/linux-headers/asm-arm/"
-    fi
     if [ $arch = arm64 ]; then
         cp "$hdrdir/include/asm/sve_context.h" "$output/linux-headers/asm-arm64/"
         cp "$hdrdir/include/asm/unistd_64.h" "$output/linux-headers/asm-arm64/"

From 069a2ce8a75c9b59a4d08d6d2da3b36bfc5af3f4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 15 Jul 2025 15:30:17 +0100
Subject: [PATCH 2522/2760] functional: ensure log handlers are closed
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This avoids a resource leak warning from python when the
log handler is garbage collected.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250715143023.1851000-9-berrange@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/functional/qemu_test/testcase.py | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/tests/functional/qemu_test/testcase.py b/tests/functional/qemu_test/testcase.py
index 2082c6fce4..71c7160adc 100644
--- a/tests/functional/qemu_test/testcase.py
+++ b/tests/functional/qemu_test/testcase.py
@@ -232,6 +232,7 @@ class QemuBaseTest(unittest.TestCase):
             self.socketdir = None
         self.machinelog.removeHandler(self._log_fh)
         self.log.removeHandler(self._log_fh)
+        self._log_fh.close()
 
     def main():
         path = os.path.basename(sys.argv[0])[:-3]
@@ -399,4 +400,5 @@ class QemuSystemTest(QemuBaseTest):
         for vm in self._vms.values():
             vm.shutdown()
         logging.getLogger('console').removeHandler(self._console_log_fh)
+        self._console_log_fh.close()
         super().tearDown()

From 72bc0134b500d599f0f1c253c78c68df642d1634 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 15 Jul 2025 15:30:18 +0100
Subject: [PATCH 2523/2760] functional: ensure sockets and files are closed
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The multiprocess and virtio_gpu tests open sockets but then forget
to close them, which triggers resource leak warnings

The virtio_gpu test also fails to close a log file it opens.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250715143023.1851000-10-berrange@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/functional/test_multiprocess.py | 3 +++
 tests/functional/test_virtio_gpu.py   | 2 ++
 2 files changed, 5 insertions(+)

diff --git a/tests/functional/test_multiprocess.py b/tests/functional/test_multiprocess.py
index 751cf10e63..92d5207b0e 100755
--- a/tests/functional/test_multiprocess.py
+++ b/tests/functional/test_multiprocess.py
@@ -83,6 +83,9 @@ class Multiprocess(QemuSystemTest):
                                           'cat /sys/bus/pci/devices/*/uevent',
                                           'PCI_ID=1000:0012')
 
+        proxy_sock.close()
+        remote_sock.close()
+
     def test_multiprocess(self):
         kernel_command_line = self.KERNEL_COMMON_COMMAND_LINE
         if self.arch == 'x86_64':
diff --git a/tests/functional/test_virtio_gpu.py b/tests/functional/test_virtio_gpu.py
index 81c9156d63..be96de24da 100755
--- a/tests/functional/test_virtio_gpu.py
+++ b/tests/functional/test_virtio_gpu.py
@@ -108,6 +108,7 @@ class VirtioGPUx86(QemuSystemTest):
             shell=False,
             close_fds=False,
         )
+        self._vug_log_file.close()
 
         self.vm.set_console()
         self.vm.add_args("-cpu", "host")
@@ -135,6 +136,7 @@ class VirtioGPUx86(QemuSystemTest):
                                           "features: +virgl +edid")
         self.vm.shutdown()
         qemu_sock.close()
+        vug_sock.close()
         vugp.terminate()
         vugp.wait()
 

From c3fd296cf7b1016671205e1525e4e9caf870f68e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 15 Jul 2025 15:30:19 +0100
Subject: [PATCH 2524/2760] functional: always enable all python warnings
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Of most importance is that this gives us a heads-up if anything
we rely on has been deprecated. The default python behaviour
only emits a warning if triggered from __main__ which is very
limited.

Setting the env variable further ensures that any python child
processes will also display warnings.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Acked-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250715143023.1851000-11-berrange@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/functional/qemu_test/testcase.py | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/tests/functional/qemu_test/testcase.py b/tests/functional/qemu_test/testcase.py
index 71c7160adc..2a78e735f1 100644
--- a/tests/functional/qemu_test/testcase.py
+++ b/tests/functional/qemu_test/testcase.py
@@ -19,6 +19,7 @@ import shutil
 from subprocess import run
 import sys
 import tempfile
+import warnings
 import unittest
 import uuid
 
@@ -235,6 +236,9 @@ class QemuBaseTest(unittest.TestCase):
         self._log_fh.close()
 
     def main():
+        warnings.simplefilter("default")
+        os.environ["PYTHONWARNINGS"] = "default"
+
         path = os.path.basename(sys.argv[0])[:-3]
 
         cache = os.environ.get("QEMU_TEST_PRECACHE", None)

From 2c182e1213a0fd334f13948cb80b886e6fd1ab88 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Thu, 17 Jul 2025 11:41:05 +0100
Subject: [PATCH 2525/2760] docs/devel: fix over-quoting of
 QEMU_TEST_KEEP_SCRATCH
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20250717104105.2656786-1-alex.bennee@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 docs/devel/testing/functional.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/devel/testing/functional.rst b/docs/devel/testing/functional.rst
index 9e56dd1b11..3728bab6c0 100644
--- a/docs/devel/testing/functional.rst
+++ b/docs/devel/testing/functional.rst
@@ -65,7 +65,7 @@ directory should be your build folder. For example::
 
 The test framework will automatically purge any scratch files created during
 the tests. If needing to debug a failed test, it is possible to keep these
-files around on disk by setting ```QEMU_TEST_KEEP_SCRATCH=1``` as an env
+files around on disk by setting ``QEMU_TEST_KEEP_SCRATCH=1`` as an env
 variable.  Any preserved files will be deleted the next time the test is run
 without this variable set.
 

From 301fbbaf03fb114a1e45833987ddfd7bbb403963 Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Mon, 12 May 2025 13:10:10 +1000
Subject: [PATCH 2526/2760] ppc/xive: Fix xive trace event output
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Typo, IBP should be IPB.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Glenn Miles <milesg@linux.ibm.com>
Reviewed-by: Michael Kowal <kowal@linux.ibm.com>
Reviewed-by: Caleb Schlossin <calebs@linux.ibm.com>
Tested-by: Gautam Menghani <gautam@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20250512031100.439842-2-npiggin@gmail.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/intc/trace-events | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/hw/intc/trace-events b/hw/intc/trace-events
index 334aa6a97b..9ed2616e58 100644
--- a/hw/intc/trace-events
+++ b/hw/intc/trace-events
@@ -274,9 +274,9 @@ kvm_xive_cpu_connect(uint32_t id) "connect CPU%d to KVM device"
 kvm_xive_source_reset(uint32_t srcno) "IRQ 0x%x"
 
 # xive.c
-xive_tctx_accept(uint32_t index, uint8_t ring, uint8_t ipb, uint8_t pipr, uint8_t cppr, uint8_t nsr) "target=%d ring=0x%x IBP=0x%02x PIPR=0x%02x CPPR=0x%02x NSR=0x%02x ACK"
-xive_tctx_notify(uint32_t index, uint8_t ring, uint8_t ipb, uint8_t pipr, uint8_t cppr, uint8_t nsr) "target=%d ring=0x%x IBP=0x%02x PIPR=0x%02x CPPR=0x%02x NSR=0x%02x raise !"
-xive_tctx_set_cppr(uint32_t index, uint8_t ring, uint8_t ipb, uint8_t pipr, uint8_t cppr, uint8_t nsr) "target=%d ring=0x%x IBP=0x%02x PIPR=0x%02x new CPPR=0x%02x NSR=0x%02x"
+xive_tctx_accept(uint32_t index, uint8_t ring, uint8_t ipb, uint8_t pipr, uint8_t cppr, uint8_t nsr) "target=%d ring=0x%x IPB=0x%02x PIPR=0x%02x CPPR=0x%02x NSR=0x%02x ACK"
+xive_tctx_notify(uint32_t index, uint8_t ring, uint8_t ipb, uint8_t pipr, uint8_t cppr, uint8_t nsr) "target=%d ring=0x%x IPB=0x%02x PIPR=0x%02x CPPR=0x%02x NSR=0x%02x raise !"
+xive_tctx_set_cppr(uint32_t index, uint8_t ring, uint8_t ipb, uint8_t pipr, uint8_t cppr, uint8_t nsr) "target=%d ring=0x%x IPB=0x%02x PIPR=0x%02x new CPPR=0x%02x NSR=0x%02x"
 xive_source_esb_read(uint64_t addr, uint32_t srcno, uint64_t value) "@0x%"PRIx64" IRQ 0x%x val=0x%"PRIx64
 xive_source_esb_write(uint64_t addr, uint32_t srcno, uint64_t value) "@0x%"PRIx64" IRQ 0x%x val=0x%"PRIx64
 xive_router_end_notify(uint8_t end_blk, uint32_t end_idx, uint32_t end_data) "END 0x%02x/0x%04x -> enqueue 0x%08x"

From f0aab779418ed883ea2b5ffcc3985ef26f6e3545 Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Mon, 12 May 2025 13:10:11 +1000
Subject: [PATCH 2527/2760] ppc/xive: Report access size in XIVE TM operation
 error logs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Report access size in XIVE TM operation error logs.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Glenn Miles <milesg@linux.ibm.com>
Reviewed-by: Michael Kowal <kowal@linux.ibm.com>
Reviewed-by: Caleb Schlossin <calebs@linux.ibm.com>
Tested-by: Gautam Menghani <gautam@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20250512031100.439842-3-npiggin@gmail.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/intc/xive.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/hw/intc/xive.c b/hw/intc/xive.c
index 27b473e4d7..120376fb6b 100644
--- a/hw/intc/xive.c
+++ b/hw/intc/xive.c
@@ -326,7 +326,7 @@ static void xive_tm_raw_write(XiveTCTX *tctx, hwaddr offset, uint64_t value,
      */
     if (size < 4 || !mask || ring_offset == TM_QW0_USER) {
         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid write access at TIMA @%"
-                      HWADDR_PRIx"\n", offset);
+                      HWADDR_PRIx" size %d\n", offset, size);
         return;
     }
 
@@ -357,7 +357,7 @@ static uint64_t xive_tm_raw_read(XiveTCTX *tctx, hwaddr offset, unsigned size)
      */
     if (size < 4 || !mask || ring_offset == TM_QW0_USER) {
         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid read access at TIMA @%"
-                      HWADDR_PRIx"\n", offset);
+                      HWADDR_PRIx" size %d\n", offset, size);
         return -1;
     }
 
@@ -688,7 +688,7 @@ void xive_tctx_tm_write(XivePresenter *xptr, XiveTCTX *tctx, hwaddr offset,
         xto = xive_tm_find_op(tctx->xptr, offset, size, true);
         if (!xto) {
             qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid write access at TIMA "
-                          "@%"HWADDR_PRIx"\n", offset);
+                          "@%"HWADDR_PRIx" size %d\n", offset, size);
         } else {
             xto->write_handler(xptr, tctx, offset, value, size);
         }
@@ -727,7 +727,7 @@ uint64_t xive_tctx_tm_read(XivePresenter *xptr, XiveTCTX *tctx, hwaddr offset,
         xto = xive_tm_find_op(tctx->xptr, offset, size, false);
         if (!xto) {
             qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid read access to TIMA"
-                          "@%"HWADDR_PRIx"\n", offset);
+                          "@%"HWADDR_PRIx" size %d\n", offset, size);
             return -1;
         }
         ret = xto->read_handler(xptr, tctx, offset, size);

From f16697292add6c3c15014a20fd5fce70b8c56734 Mon Sep 17 00:00:00 2001
From: Glenn Miles <milesg@linux.ibm.com>
Date: Mon, 12 May 2025 13:10:12 +1000
Subject: [PATCH 2528/2760] ppc/xive2: Fix calculation of END queue sizes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The queue size of an Event Notification Descriptor (END)
is determined by the 'cl' and QsZ fields of the END.
If the cl field is 1, then the queue size (in bytes) will
be the size of a cache line 128B * 2^QsZ and QsZ is limited
to 4.  Otherwise, it will be 4096B * 2^QsZ with QsZ limited
to 12.

Fixes: f8a233dedf2 ("ppc/xive2: Introduce a XIVE2 core framework")
Signed-off-by: Glenn Miles <milesg@linux.ibm.com>
Reviewed-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Michael Kowal <kowal@linux.ibm.com>
Reviewed-by: Caleb Schlossin <calebs@linux.ibm.com>
Tested-by: Gautam Menghani <gautam@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20250512031100.439842-4-npiggin@gmail.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/intc/xive2.c             | 25 +++++++++++++++++++------
 include/hw/ppc/xive2_regs.h |  1 +
 2 files changed, 20 insertions(+), 6 deletions(-)

diff --git a/hw/intc/xive2.c b/hw/intc/xive2.c
index a08cf906d0..cb75ca8798 100644
--- a/hw/intc/xive2.c
+++ b/hw/intc/xive2.c
@@ -188,12 +188,27 @@ void xive2_eas_pic_print_info(Xive2Eas *eas, uint32_t lisn, GString *buf)
                            (uint32_t) xive_get_field64(EAS2_END_DATA, eas->w));
 }
 
+#define XIVE2_QSIZE_CHUNK_CL    128
+#define XIVE2_QSIZE_CHUNK_4k   4096
+/* Calculate max number of queue entries for an END */
+static uint32_t xive2_end_get_qentries(Xive2End *end)
+{
+    uint32_t w3 = end->w3;
+    uint32_t qsize = xive_get_field32(END2_W3_QSIZE, w3);
+    if (xive_get_field32(END2_W3_CL, w3)) {
+        g_assert(qsize <= 4);
+        return (XIVE2_QSIZE_CHUNK_CL << qsize) / sizeof(uint32_t);
+    } else {
+        g_assert(qsize <= 12);
+        return (XIVE2_QSIZE_CHUNK_4k << qsize) / sizeof(uint32_t);
+    }
+}
+
 void xive2_end_queue_pic_print_info(Xive2End *end, uint32_t width, GString *buf)
 {
     uint64_t qaddr_base = xive2_end_qaddr(end);
-    uint32_t qsize = xive_get_field32(END2_W3_QSIZE, end->w3);
     uint32_t qindex = xive_get_field32(END2_W1_PAGE_OFF, end->w1);
-    uint32_t qentries = 1 << (qsize + 10);
+    uint32_t qentries = xive2_end_get_qentries(end);
     int i;
 
     /*
@@ -223,8 +238,7 @@ void xive2_end_pic_print_info(Xive2End *end, uint32_t end_idx, GString *buf)
     uint64_t qaddr_base = xive2_end_qaddr(end);
     uint32_t qindex = xive_get_field32(END2_W1_PAGE_OFF, end->w1);
     uint32_t qgen = xive_get_field32(END2_W1_GENERATION, end->w1);
-    uint32_t qsize = xive_get_field32(END2_W3_QSIZE, end->w3);
-    uint32_t qentries = 1 << (qsize + 10);
+    uint32_t qentries = xive2_end_get_qentries(end);
 
     uint32_t nvx_blk = xive_get_field32(END2_W6_VP_BLOCK, end->w6);
     uint32_t nvx_idx = xive_get_field32(END2_W6_VP_OFFSET, end->w6);
@@ -341,13 +355,12 @@ void xive2_nvgc_pic_print_info(Xive2Nvgc *nvgc, uint32_t nvgc_idx, GString *buf)
 static void xive2_end_enqueue(Xive2End *end, uint32_t data)
 {
     uint64_t qaddr_base = xive2_end_qaddr(end);
-    uint32_t qsize = xive_get_field32(END2_W3_QSIZE, end->w3);
     uint32_t qindex = xive_get_field32(END2_W1_PAGE_OFF, end->w1);
     uint32_t qgen = xive_get_field32(END2_W1_GENERATION, end->w1);
 
     uint64_t qaddr = qaddr_base + (qindex << 2);
     uint32_t qdata = cpu_to_be32((qgen << 31) | (data & 0x7fffffff));
-    uint32_t qentries = 1 << (qsize + 10);
+    uint32_t qentries = xive2_end_get_qentries(end);
 
     if (dma_memory_write(&address_space_memory, qaddr, &qdata, sizeof(qdata),
                          MEMTXATTRS_UNSPECIFIED)) {
diff --git a/include/hw/ppc/xive2_regs.h b/include/hw/ppc/xive2_regs.h
index b11395c563..3c28de8a30 100644
--- a/include/hw/ppc/xive2_regs.h
+++ b/include/hw/ppc/xive2_regs.h
@@ -87,6 +87,7 @@ typedef struct Xive2End {
 #define END2_W2_EQ_ADDR_HI         PPC_BITMASK32(8, 31)
         uint32_t       w3;
 #define END2_W3_EQ_ADDR_LO         PPC_BITMASK32(0, 24)
+#define END2_W3_CL                 PPC_BIT32(27)
 #define END2_W3_QSIZE              PPC_BITMASK32(28, 31)
         uint32_t       w4;
 #define END2_W4_END_BLOCK          PPC_BITMASK32(4, 7)

From e8cf73b849879cd93b1d1b5fd3bde79fb42064dc Mon Sep 17 00:00:00 2001
From: Michael Kowal <kowal@linux.ibm.com>
Date: Mon, 12 May 2025 13:10:13 +1000
Subject: [PATCH 2529/2760] ppc/xive2: Remote VSDs need to match on forwarding
 address
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In a multi chip environment there will be remote/forwarded VSDs.  The check
to find a matching INT controller (XIVE) of the remote block number was
checking the INTs chip number.  Block numbers are not tied to a chip number.
The matching remote INT is the one that matches the forwarded VSD address
with VSD types associated MMIO BAR.

Signed-off-by: Michael Kowal <kowal@linux.ibm.com>
Reviewed-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Glenn Miles <milesg@linux.ibm.com>
Reviewed-by: Michael Kowal <kowal@linux.ibm.com>
Reviewed-by: Caleb Schlossin <calebs@linux.ibm.com>
Tested-by: Gautam Menghani <gautam@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20250512031100.439842-5-npiggin@gmail.com
[ clg: Fixed log format in pnv_xive2_get_remote() ]
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/intc/pnv_xive2.c | 26 ++++++++++++++++++--------
 1 file changed, 18 insertions(+), 8 deletions(-)

diff --git a/hw/intc/pnv_xive2.c b/hw/intc/pnv_xive2.c
index ec8b0c68f1..6b724fe762 100644
--- a/hw/intc/pnv_xive2.c
+++ b/hw/intc/pnv_xive2.c
@@ -101,12 +101,10 @@ static uint32_t pnv_xive2_block_id(PnvXive2 *xive)
 }
 
 /*
- * Remote access to controllers. HW uses MMIOs. For now, a simple scan
- * of the chips is good enough.
- *
- * TODO: Block scope support
+ * Remote access to INT controllers. HW uses MMIOs(?). For now, a simple
+ * scan of all the chips INT controller is good enough.
  */
-static PnvXive2 *pnv_xive2_get_remote(uint8_t blk)
+static PnvXive2 *pnv_xive2_get_remote(uint32_t vsd_type, hwaddr fwd_addr)
 {
     PnvMachineState *pnv = PNV_MACHINE(qdev_get_machine());
     int i;
@@ -115,10 +113,23 @@ static PnvXive2 *pnv_xive2_get_remote(uint8_t blk)
         Pnv10Chip *chip10 = PNV10_CHIP(pnv->chips[i]);
         PnvXive2 *xive = &chip10->xive;
 
-        if (pnv_xive2_block_id(xive) == blk) {
+        /*
+         * Is this the XIVE matching the forwarded VSD address is for this
+         * VSD type
+         */
+        if ((vsd_type == VST_ESB   && fwd_addr == xive->esb_base) ||
+            (vsd_type == VST_END   && fwd_addr == xive->end_base)  ||
+            ((vsd_type == VST_NVP ||
+              vsd_type == VST_NVG) && fwd_addr == xive->nvpg_base) ||
+            (vsd_type == VST_NVC   && fwd_addr == xive->nvc_base)) {
             return xive;
         }
     }
+
+    qemu_log_mask(LOG_GUEST_ERROR,
+                 "XIVE: >>>>> %s vsd_type %u  fwd_addr 0x%"HWADDR_PRIx
+                  " NOT FOUND\n",
+                  __func__, vsd_type, fwd_addr);
     return NULL;
 }
 
@@ -251,8 +262,7 @@ static uint64_t pnv_xive2_vst_addr(PnvXive2 *xive, uint32_t type, uint8_t blk,
 
     /* Remote VST access */
     if (GETFIELD(VSD_MODE, vsd) == VSD_MODE_FORWARD) {
-        xive = pnv_xive2_get_remote(blk);
-
+        xive = pnv_xive2_get_remote(type, (vsd & VSD_ADDRESS_MASK));
         return xive ? pnv_xive2_vst_addr(xive, type, blk, idx) : 0;
     }
 

From d1023a296c8297454fc4b207d58707c0a5e62e0a Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Mon, 12 May 2025 13:10:14 +1000
Subject: [PATCH 2530/2760] ppc/xive2: fix context push calculation of IPB
 priority
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Pushing a context and loading IPB from NVP is defined to merge ('or')
that IPB into the TIMA IPB register. PIPR should therefore be calculated
based on the final IPB value, not just the NVP value.

Fixes: 9d2b6058c5b ("ppc/xive2: Add grouping level to notification")
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Glenn Miles <milesg@linux.ibm.com>
Reviewed-by: Caleb Schlossin <calebs@linux.ibm.com>
Tested-by: Gautam Menghani <gautam@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20250512031100.439842-6-npiggin@gmail.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/intc/xive2.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/intc/xive2.c b/hw/intc/xive2.c
index cb75ca8798..01cf96a2af 100644
--- a/hw/intc/xive2.c
+++ b/hw/intc/xive2.c
@@ -835,8 +835,9 @@ static void xive2_tctx_need_resend(Xive2Router *xrtr, XiveTCTX *tctx,
         nvp.w2 = xive_set_field32(NVP2_W2_IPB, nvp.w2, 0);
         xive2_router_write_nvp(xrtr, nvp_blk, nvp_idx, &nvp, 2);
     }
+    /* IPB bits in the backlog are merged with the TIMA IPB bits */
     regs[TM_IPB] |= ipb;
-    backlog_prio = xive_ipb_to_pipr(ipb);
+    backlog_prio = xive_ipb_to_pipr(regs[TM_IPB]);
     backlog_level = 0;
 
     first_group = xive_get_field32(NVP2_W0_PGOFIRST, nvp.w0);

From bde8c148bb22b99cb84cda800fa555851b8cb358 Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Mon, 12 May 2025 13:10:15 +1000
Subject: [PATCH 2531/2760] ppc/xive: Fix PHYS NSR ring matching
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Test that the NSR exception bit field is equal to the pool ring value,
rather than any common bits set, which is more correct (although there
is no practical bug because the LSI NSR type is not implemented and
POOL/PHYS NSR are encoded with exclusive bits).

Fixes: 4c3ccac636 ("pnv/xive: Add special handling for pool targets")
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Glenn Miles <milesg@linux.ibm.com>
Reviewed-by: Michael Kowal <kowal@linux.ibm.com>
Reviewed-by: Caleb Schlossin <calebs@linux.ibm.com>
Tested-by: Gautam Menghani <gautam@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20250512031100.439842-7-npiggin@gmail.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/intc/xive.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/intc/xive.c b/hw/intc/xive.c
index 120376fb6b..bc829bebe9 100644
--- a/hw/intc/xive.c
+++ b/hw/intc/xive.c
@@ -54,7 +54,8 @@ static uint64_t xive_tctx_accept(XiveTCTX *tctx, uint8_t ring)
         uint8_t *alt_regs;
 
         /* POOL interrupt uses IPB in QW2, POOL ring */
-        if ((ring == TM_QW3_HV_PHYS) && (nsr & (TM_QW3_NSR_HE_POOL << 6))) {
+        if ((ring == TM_QW3_HV_PHYS) &&
+            ((nsr & TM_QW3_NSR_HE) == (TM_QW3_NSR_HE_POOL << 6))) {
             alt_ring = TM_QW2_HV_POOL;
         } else {
             alt_ring = ring;

From 576830428eea6ebfc85792851a343214b834e401 Mon Sep 17 00:00:00 2001
From: Michael Kowal <kowal@linux.ibm.com>
Date: Mon, 12 May 2025 13:10:16 +1000
Subject: [PATCH 2532/2760] ppc/xive2: Reset Generation Flipped bit on END
 Cache Watch
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When the END Event Queue wraps the END EQ Generation bit is flipped and the
Generation Flipped bit is set to one.  On a END cache Watch read operation,
the Generation Flipped bit needs to be reset.

While debugging an error modified END not valid error messages to include
the method since all were the same.

Signed-off-by: Michael Kowal <kowal@linux.ibm.com>
Reviewed-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Glenn Miles <milesg@linux.ibm.com>
Reviewed-by: Michael Kowal <kowal@linux.ibm.com>
Reviewed-by: Caleb Schlossin <calebs@linux.ibm.com>
Tested-by: Gautam Menghani <gautam@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20250512031100.439842-8-npiggin@gmail.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/intc/pnv_xive2.c | 3 ++-
 hw/intc/xive2.c     | 4 ++--
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/hw/intc/pnv_xive2.c b/hw/intc/pnv_xive2.c
index 6b724fe762..ec247ce48f 100644
--- a/hw/intc/pnv_xive2.c
+++ b/hw/intc/pnv_xive2.c
@@ -1325,10 +1325,11 @@ static uint64_t pnv_xive2_ic_vc_read(void *opaque, hwaddr offset,
     case VC_ENDC_WATCH3_DATA0:
         /*
          * Load DATA registers from cache with data requested by the
-         * SPEC register
+         * SPEC register.  Clear gen_flipped bit in word 1.
          */
         watch_engine = (offset - VC_ENDC_WATCH0_DATA0) >> 6;
         pnv_xive2_end_cache_load(xive, watch_engine);
+        xive->vc_regs[reg] &= ~(uint64_t)END2_W1_GEN_FLIPPED;
         val = xive->vc_regs[reg];
         break;
 
diff --git a/hw/intc/xive2.c b/hw/intc/xive2.c
index 01cf96a2af..edf5d9eb94 100644
--- a/hw/intc/xive2.c
+++ b/hw/intc/xive2.c
@@ -374,8 +374,8 @@ static void xive2_end_enqueue(Xive2End *end, uint32_t data)
         qgen ^= 1;
         end->w1 = xive_set_field32(END2_W1_GENERATION, end->w1, qgen);
 
-        /* TODO(PowerNV): reset GF bit on a cache watch operation */
-        end->w1 = xive_set_field32(END2_W1_GEN_FLIPPED, end->w1, qgen);
+        /* Set gen flipped to 1, it gets reset on a cache watch operation */
+        end->w1 = xive_set_field32(END2_W1_GEN_FLIPPED, end->w1, 1);
     }
     end->w1 = xive_set_field32(END2_W1_PAGE_OFF, end->w1, qindex);
 }

From a1577527e212efd27a8ceefbd95321c306abf739 Mon Sep 17 00:00:00 2001
From: Glenn Miles <milesg@linux.ibm.com>
Date: Mon, 12 May 2025 13:10:17 +1000
Subject: [PATCH 2533/2760] ppc/xive2: Use fair irq target search algorithm
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The current xive algorithm for finding a matching group vCPU
target always uses the first vCPU found.  And, since it always
starts the search with thread 0 of a core, thread 0 is almost
always used to handle group interrupts.  This can lead to additional
interrupt latency and poor performance for interrupt intensive
work loads.

Changing this to use a simple round-robin algorithm for deciding which
thread number to use when starting a search, which leads to a more
distributed use of threads for handling group interrupts.

[npiggin: Also round-robin among threads, not just cores]

Signed-off-by: Glenn Miles <milesg@linux.ibm.com>
Reviewed-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Glenn Miles <milesg@linux.ibm.com>
Reviewed-by: Michael Kowal <kowal@linux.ibm.com>
Reviewed-by: Caleb Schlossin <calebs@linux.ibm.com>
Tested-by: Gautam Menghani <gautam@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20250512031100.439842-9-npiggin@gmail.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/intc/pnv_xive2.c | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/hw/intc/pnv_xive2.c b/hw/intc/pnv_xive2.c
index ec247ce48f..25dc8a372d 100644
--- a/hw/intc/pnv_xive2.c
+++ b/hw/intc/pnv_xive2.c
@@ -643,13 +643,18 @@ static int pnv_xive2_match_nvt(XivePresenter *xptr, uint8_t format,
     int i, j;
     bool gen1_tima_os =
         xive->cq_regs[CQ_XIVE_CFG >> 3] & CQ_XIVE_CFG_GEN1_TIMA_OS;
+    static int next_start_core;
+    static int next_start_thread;
+    int start_core = next_start_core;
+    int start_thread = next_start_thread;
 
     for (i = 0; i < chip->nr_cores; i++) {
-        PnvCore *pc = chip->cores[i];
+        PnvCore *pc = chip->cores[(i + start_core) % chip->nr_cores];
         CPUCore *cc = CPU_CORE(pc);
 
         for (j = 0; j < cc->nr_threads; j++) {
-            PowerPCCPU *cpu = pc->threads[j];
+            /* Start search for match with different thread each call */
+            PowerPCCPU *cpu = pc->threads[(j + start_thread) % cc->nr_threads];
             XiveTCTX *tctx;
             int ring;
 
@@ -694,6 +699,15 @@ static int pnv_xive2_match_nvt(XivePresenter *xptr, uint8_t format,
                     if (!match->tctx) {
                         match->ring = ring;
                         match->tctx = tctx;
+
+                        next_start_thread = j + start_thread + 1;
+                        if (next_start_thread >= cc->nr_threads) {
+                            next_start_thread = 0;
+                            next_start_core = i + start_core + 1;
+                            if (next_start_core >= chip->nr_cores) {
+                                next_start_core = 0;
+                            }
+                        }
                     }
                     count++;
                 }

From 8d373176181fbc11f8d8eae2b4532b867f083ea6 Mon Sep 17 00:00:00 2001
From: Glenn Miles <milesg@linux.ibm.com>
Date: Mon, 12 May 2025 13:10:18 +1000
Subject: [PATCH 2534/2760] ppc/xive2: Fix irq preempted by lower priority
 group irq
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A problem was seen where uart interrupts would be lost resulting in the
console hanging. Traces showed that a lower priority interrupt was
preempting a higher priority interrupt, which would result in the higher
priority interrupt never being handled.

The new interrupt's priority was being compared against the CPPR
(Current Processor Priority Register) instead of the PIPR (Post
Interrupt Priority Register), as was required by the XIVE spec.
This allowed for a window between raising an interrupt and ACK'ing
the interrupt where a lower priority interrupt could slip in.

Fixes: 26c55b99418 ("ppc/xive2: Process group backlog when updating the CPPR")
Signed-off-by: Glenn Miles <milesg@linux.ibm.com>
Reviewed-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Michael Kowal <kowal@linux.ibm.com>
Reviewed-by: Caleb Schlossin <calebs@linux.ibm.com>
Tested-by: Gautam Menghani <gautam@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20250512031100.439842-10-npiggin@gmail.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/intc/xive2.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/intc/xive2.c b/hw/intc/xive2.c
index edf5d9eb94..36e842f041 100644
--- a/hw/intc/xive2.c
+++ b/hw/intc/xive2.c
@@ -1283,7 +1283,7 @@ bool xive2_tm_irq_precluded(XiveTCTX *tctx, int ring, uint8_t priority)
      * priority to know if the thread can take the interrupt now or if
      * it is precluded.
      */
-    if (priority < alt_regs[TM_CPPR]) {
+    if (priority < alt_regs[TM_PIPR]) {
         return false;
     }
     return true;

From d4720a7faf4bb415f3fe7f10e5c888212b81316a Mon Sep 17 00:00:00 2001
From: Glenn Miles <milesg@linux.ibm.com>
Date: Mon, 12 May 2025 13:10:19 +1000
Subject: [PATCH 2535/2760] ppc/xive2: Fix treatment of PIPR in CPPR update
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

According to the XIVE spec, updating the CPPR should also update the
PIPR. The final value of the PIPR depends on other factors, but it
should never be set to a value that is above the CPPR.

Also added support for redistributing an active group interrupt when it
is precluded as a result of changing the CPPR value.

Signed-off-by: Glenn Miles <milesg@linux.ibm.com>
Reviewed-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Michael Kowal <kowal@linux.ibm.com>
Reviewed-by: Caleb Schlossin <calebs@linux.ibm.com>
Tested-by: Gautam Menghani <gautam@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20250512031100.439842-11-npiggin@gmail.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/intc/xive2.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/hw/intc/xive2.c b/hw/intc/xive2.c
index 36e842f041..c23933f8f5 100644
--- a/hw/intc/xive2.c
+++ b/hw/intc/xive2.c
@@ -995,7 +995,9 @@ static void xive2_tctx_set_cppr(XiveTCTX *tctx, uint8_t ring, uint8_t cppr)
             }
         }
     }
-    regs[TM_PIPR] = pipr_min;
+
+    /* PIPR should not be set to a value greater than CPPR */
+    regs[TM_PIPR] = (pipr_min > cppr) ? cppr : pipr_min;
 
     rc = xive2_tctx_get_nvp_indexes(tctx, ring_min, &nvp_blk, &nvp_idx);
     if (rc) {

From 3abbec04e627396c32f2b7b7461961fb68c5c122 Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Mon, 12 May 2025 13:10:20 +1000
Subject: [PATCH 2536/2760] ppc/xive2: Do not present group interrupt on
 OS-push if precluded by CPPR
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Group interrupts should not be taken from the backlog and presented
if they are precluded by CPPR.

Fixes: 855434b3b8 ("ppc/xive2: Process group backlog when pushing an OS context")
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Glenn Miles <milesg@linux.ibm.com>
Reviewed-by: Michael Kowal <kowal@linux.ibm.com>
Reviewed-by: Caleb Schlossin <calebs@linux.ibm.com>
Tested-by: Gautam Menghani <gautam@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20250512031100.439842-12-npiggin@gmail.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/intc/xive2.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/hw/intc/xive2.c b/hw/intc/xive2.c
index c23933f8f5..181d1ae5f9 100644
--- a/hw/intc/xive2.c
+++ b/hw/intc/xive2.c
@@ -845,7 +845,9 @@ static void xive2_tctx_need_resend(Xive2Router *xrtr, XiveTCTX *tctx,
         group_prio = xive2_presenter_backlog_scan(xptr, nvp_blk, nvp_idx,
                                                   first_group, &group_level);
         regs[TM_LSMFB] = group_prio;
-        if (regs[TM_LGS] && group_prio < backlog_prio) {
+        if (regs[TM_LGS] && group_prio < backlog_prio &&
+            group_prio < regs[TM_CPPR]) {
+
             /* VP can take a group interrupt */
             xive2_presenter_backlog_decr(xptr, nvp_blk, nvp_idx,
                                          group_prio, group_level);

From ad9175f8a2d7b4ef7d63e9663a42e7f7a44bc3f5 Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Mon, 12 May 2025 13:10:21 +1000
Subject: [PATCH 2537/2760] ppc/xive2: Set CPPR delivery should account for
 group priority
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The group interrupt delivery flow selects the group backlog scan if
LSMFB < IPB, but that scan may find an interrupt with a priority >=
IPB. In that case, the VP-direct interrupt should be chosen. This
extends to selecting the lowest prio between POOL and PHYS rings.

Implement this just by re-starting the selection logic if the
backlog irq was not found or priority did not match LSMFB (LSMFB
is updated so next time around it would see the right value and
not loop infinitely).

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Michael Kowal <kowal@linux.ibm.com>
Reviewed-by: Caleb Schlossin <calebs@linux.ibm.com>
Tested-by: Gautam Menghani <gautam@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20250512031100.439842-13-npiggin@gmail.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/intc/xive2.c | 32 ++++++++++++++++++++++----------
 1 file changed, 22 insertions(+), 10 deletions(-)

diff --git a/hw/intc/xive2.c b/hw/intc/xive2.c
index 181d1ae5f9..cca121b5f1 100644
--- a/hw/intc/xive2.c
+++ b/hw/intc/xive2.c
@@ -939,7 +939,7 @@ static void xive2_tctx_set_cppr(XiveTCTX *tctx, uint8_t ring, uint8_t cppr)
 {
     uint8_t *regs = &tctx->regs[ring];
     Xive2Router *xrtr = XIVE2_ROUTER(tctx->xptr);
-    uint8_t old_cppr, backlog_prio, first_group, group_level = 0;
+    uint8_t old_cppr, backlog_prio, first_group, group_level;
     uint8_t pipr_min, lsmfb_min, ring_min;
     bool group_enabled;
     uint32_t nvp_blk, nvp_idx;
@@ -961,10 +961,12 @@ static void xive2_tctx_set_cppr(XiveTCTX *tctx, uint8_t ring, uint8_t cppr)
      * Recompute the PIPR based on local pending interrupts. It will
      * be adjusted below if needed in case of pending group interrupts.
      */
+again:
     pipr_min = xive_ipb_to_pipr(regs[TM_IPB]);
     group_enabled = !!regs[TM_LGS];
-    lsmfb_min = (group_enabled) ? regs[TM_LSMFB] : 0xff;
+    lsmfb_min = group_enabled ? regs[TM_LSMFB] : 0xff;
     ring_min = ring;
+    group_level = 0;
 
     /* PHYS updates also depend on POOL values */
     if (ring == TM_QW3_HV_PHYS) {
@@ -998,9 +1000,6 @@ static void xive2_tctx_set_cppr(XiveTCTX *tctx, uint8_t ring, uint8_t cppr)
         }
     }
 
-    /* PIPR should not be set to a value greater than CPPR */
-    regs[TM_PIPR] = (pipr_min > cppr) ? cppr : pipr_min;
-
     rc = xive2_tctx_get_nvp_indexes(tctx, ring_min, &nvp_blk, &nvp_idx);
     if (rc) {
         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: set CPPR on invalid context\n");
@@ -1019,7 +1018,7 @@ static void xive2_tctx_set_cppr(XiveTCTX *tctx, uint8_t ring, uint8_t cppr)
 
     if (group_enabled &&
         lsmfb_min < cppr &&
-        lsmfb_min < regs[TM_PIPR]) {
+        lsmfb_min < pipr_min) {
         /*
          * Thread has seen a group interrupt with a higher priority
          * than the new cppr or pending local interrupt. Check the
@@ -1048,12 +1047,25 @@ static void xive2_tctx_set_cppr(XiveTCTX *tctx, uint8_t ring, uint8_t cppr)
                                                     nvp_blk, nvp_idx,
                                                     first_group, &group_level);
         tctx->regs[ring_min + TM_LSMFB] = backlog_prio;
-        if (backlog_prio != 0xFF) {
-            xive2_presenter_backlog_decr(tctx->xptr, nvp_blk, nvp_idx,
-                                         backlog_prio, group_level);
-            regs[TM_PIPR] = backlog_prio;
+        if (backlog_prio != lsmfb_min) {
+            /*
+             * If the group backlog scan finds a less favored or no interrupt,
+             * then re-do the processing which may turn up a more favored
+             * interrupt from IPB or the other pool. Backlog should not
+             * find a priority < LSMFB.
+             */
+            g_assert(backlog_prio >= lsmfb_min);
+            goto again;
         }
+
+        xive2_presenter_backlog_decr(tctx->xptr, nvp_blk, nvp_idx,
+                                     backlog_prio, group_level);
+        pipr_min = backlog_prio;
     }
+
+    /* PIPR should not be set to a value greater than CPPR */
+    regs[TM_PIPR] = (pipr_min > cppr) ? cppr : pipr_min;
+
     /* CPPR has changed, check if we need to raise a pending exception */
     xive_tctx_notify(tctx, ring_min, group_level);
 }

From 14bcc5239f4d4780ec52881779161c62c46e7243 Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Mon, 12 May 2025 13:10:22 +1000
Subject: [PATCH 2538/2760] ppc/xive: tctx_notify should clear the precluded
 interrupt
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

If CPPR is lowered to preclude the pending interrupt, NSR should be
cleared and the qemu_irq should be lowered. This avoids some cases
of supurious interrupts.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Glenn Miles <milesg@linux.ibm.com>
Reviewed-by: Michael Kowal <kowal@linux.ibm.com>
Reviewed-by: Caleb Schlossin <calebs@linux.ibm.com>
Tested-by: Gautam Menghani <gautam@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20250512031100.439842-14-npiggin@gmail.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/intc/xive.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/hw/intc/xive.c b/hw/intc/xive.c
index bc829bebe9..a0a60a24f5 100644
--- a/hw/intc/xive.c
+++ b/hw/intc/xive.c
@@ -110,6 +110,9 @@ void xive_tctx_notify(XiveTCTX *tctx, uint8_t ring, uint8_t group_level)
                                regs[TM_IPB], alt_regs[TM_PIPR],
                                alt_regs[TM_CPPR], alt_regs[TM_NSR]);
         qemu_irq_raise(xive_tctx_output(tctx, ring));
+    } else {
+        alt_regs[TM_NSR] = 0;
+        qemu_irq_lower(xive_tctx_output(tctx, ring));
     }
 }
 

From 9d466ab9b6f27a5d5b7a0ec5a7ad6f60e82fafda Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Mon, 12 May 2025 13:10:23 +1000
Subject: [PATCH 2539/2760] ppc/xive: Explicitly zero NSR after accepting
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Have xive_tctx_accept clear NSR in one shot rather than masking out bits
as they are tested, which makes it clear it's reset to 0, and does not
have a partial NSR value in the register.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Glenn Miles <milesg@linux.ibm.com>
Reviewed-by: Michael Kowal <kowal@linux.ibm.com>
Reviewed-by: Caleb Schlossin <calebs@linux.ibm.com>
Tested-by: Gautam Menghani <gautam@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20250512031100.439842-15-npiggin@gmail.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/intc/xive.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/hw/intc/xive.c b/hw/intc/xive.c
index a0a60a24f5..b35d2ec179 100644
--- a/hw/intc/xive.c
+++ b/hw/intc/xive.c
@@ -68,13 +68,11 @@ static uint64_t xive_tctx_accept(XiveTCTX *tctx, uint8_t ring)
          * If the interrupt was for a specific VP, reset the pending
          * buffer bit, otherwise clear the logical server indicator
          */
-        if (regs[TM_NSR] & TM_NSR_GRP_LVL) {
-            regs[TM_NSR] &= ~TM_NSR_GRP_LVL;
-        } else {
+        if (!(regs[TM_NSR] & TM_NSR_GRP_LVL)) {
             alt_regs[TM_IPB] &= ~xive_priority_to_ipb(cppr);
         }
 
-        /* Drop the exception bit and any group/crowd */
+        /* Clear the exception from NSR */
         regs[TM_NSR] = 0;
 
         trace_xive_tctx_accept(tctx->cs->cpu_index, alt_ring,

From 261626dce11311ba4e866272c9a2c0990c53d85c Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Mon, 12 May 2025 13:10:24 +1000
Subject: [PATCH 2540/2760] ppc/xive: Move NSR decoding into helper functions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Rather than functions to return masks to test NSR bits, have functions
to test those bits directly. This should be no functional change, it
just makes the code more readable.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Glenn Miles <milesg@linux.ibm.com>
Reviewed-by: Michael Kowal <kowal@linux.ibm.com>
Reviewed-by: Caleb Schlossin <calebs@linux.ibm.com>
Tested-by: Gautam Menghani <gautam@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20250512031100.439842-16-npiggin@gmail.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/intc/xive.c        | 51 +++++++++++++++++++++++++++++++++++--------
 include/hw/ppc/xive.h |  4 ++++
 2 files changed, 46 insertions(+), 9 deletions(-)

diff --git a/hw/intc/xive.c b/hw/intc/xive.c
index b35d2ec179..8537cad27b 100644
--- a/hw/intc/xive.c
+++ b/hw/intc/xive.c
@@ -25,6 +25,45 @@
 /*
  * XIVE Thread Interrupt Management context
  */
+bool xive_nsr_indicates_exception(uint8_t ring, uint8_t nsr)
+{
+    switch (ring) {
+    case TM_QW1_OS:
+        return !!(nsr & TM_QW1_NSR_EO);
+    case TM_QW2_HV_POOL:
+    case TM_QW3_HV_PHYS:
+        return !!(nsr & TM_QW3_NSR_HE);
+    default:
+        g_assert_not_reached();
+    }
+}
+
+bool xive_nsr_indicates_group_exception(uint8_t ring, uint8_t nsr)
+{
+    if ((nsr & TM_NSR_GRP_LVL) > 0) {
+        g_assert(xive_nsr_indicates_exception(ring, nsr));
+        return true;
+    }
+    return false;
+}
+
+uint8_t xive_nsr_exception_ring(uint8_t ring, uint8_t nsr)
+{
+    /* NSR determines if pool/phys ring is for phys or pool interrupt */
+    if ((ring == TM_QW3_HV_PHYS) || (ring == TM_QW2_HV_POOL)) {
+        uint8_t he = (nsr & TM_QW3_NSR_HE) >> 6;
+
+        if (he == TM_QW3_NSR_HE_PHYS) {
+            return TM_QW3_HV_PHYS;
+        } else if (he == TM_QW3_NSR_HE_POOL) {
+            return TM_QW2_HV_POOL;
+        } else {
+            /* Don't support LSI mode */
+            g_assert_not_reached();
+        }
+    }
+    return ring;
+}
 
 static qemu_irq xive_tctx_output(XiveTCTX *tctx, uint8_t ring)
 {
@@ -48,18 +87,12 @@ static uint64_t xive_tctx_accept(XiveTCTX *tctx, uint8_t ring)
 
     qemu_irq_lower(xive_tctx_output(tctx, ring));
 
-    if (regs[TM_NSR] != 0) {
+    if (xive_nsr_indicates_exception(ring, nsr)) {
         uint8_t cppr = regs[TM_PIPR];
         uint8_t alt_ring;
         uint8_t *alt_regs;
 
-        /* POOL interrupt uses IPB in QW2, POOL ring */
-        if ((ring == TM_QW3_HV_PHYS) &&
-            ((nsr & TM_QW3_NSR_HE) == (TM_QW3_NSR_HE_POOL << 6))) {
-            alt_ring = TM_QW2_HV_POOL;
-        } else {
-            alt_ring = ring;
-        }
+        alt_ring = xive_nsr_exception_ring(ring, nsr);
         alt_regs = &tctx->regs[alt_ring];
 
         regs[TM_CPPR] = cppr;
@@ -68,7 +101,7 @@ static uint64_t xive_tctx_accept(XiveTCTX *tctx, uint8_t ring)
          * If the interrupt was for a specific VP, reset the pending
          * buffer bit, otherwise clear the logical server indicator
          */
-        if (!(regs[TM_NSR] & TM_NSR_GRP_LVL)) {
+        if (!xive_nsr_indicates_group_exception(ring, nsr)) {
             alt_regs[TM_IPB] &= ~xive_priority_to_ipb(cppr);
         }
 
diff --git a/include/hw/ppc/xive.h b/include/hw/ppc/xive.h
index 538f438681..28f0f1b79a 100644
--- a/include/hw/ppc/xive.h
+++ b/include/hw/ppc/xive.h
@@ -365,6 +365,10 @@ static inline uint32_t xive_tctx_word2(uint8_t *ring)
     return *((uint32_t *) &ring[TM_WORD2]);
 }
 
+bool xive_nsr_indicates_exception(uint8_t ring, uint8_t nsr);
+bool xive_nsr_indicates_group_exception(uint8_t ring, uint8_t nsr);
+uint8_t xive_nsr_exception_ring(uint8_t ring, uint8_t nsr);
+
 /*
  * XIVE Router
  */

From 279031bc03e6f59d58f4de37b06bddaa03e4f209 Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Mon, 12 May 2025 13:10:25 +1000
Subject: [PATCH 2541/2760] ppc/xive: Fix pulling pool and phys contexts
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This improves the implementation of pulling pool and phys contexts in
XIVE1, by following closer the OS pulling code.

In particular, the old ring data is returned rather than the modified,
and irq signals are reset on pull.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Glenn Miles <milesg@linux.ibm.com>
Reviewed-by: Michael Kowal <kowal@linux.ibm.com>
Reviewed-by: Caleb Schlossin <calebs@linux.ibm.com>
Tested-by: Gautam Menghani <gautam@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20250512031100.439842-17-npiggin@gmail.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/intc/xive.c | 66 ++++++++++++++++++++++++++++++++++++++++++++------
 1 file changed, 58 insertions(+), 8 deletions(-)

diff --git a/hw/intc/xive.c b/hw/intc/xive.c
index 8537cad27b..5483a815ef 100644
--- a/hw/intc/xive.c
+++ b/hw/intc/xive.c
@@ -241,25 +241,75 @@ static uint64_t xive_tm_ack_hv_reg(XivePresenter *xptr, XiveTCTX *tctx,
     return xive_tctx_accept(tctx, TM_QW3_HV_PHYS);
 }
 
+static void xive_pool_cam_decode(uint32_t cam, uint8_t *nvt_blk,
+                                 uint32_t *nvt_idx, bool *vp)
+{
+    if (nvt_blk) {
+        *nvt_blk = xive_nvt_blk(cam);
+    }
+    if (nvt_idx) {
+        *nvt_idx = xive_nvt_idx(cam);
+    }
+    if (vp) {
+        *vp = !!(cam & TM_QW2W2_VP);
+    }
+}
+
+static uint32_t xive_tctx_get_pool_cam(XiveTCTX *tctx, uint8_t *nvt_blk,
+                                       uint32_t *nvt_idx, bool *vp)
+{
+    uint32_t qw2w2 = xive_tctx_word2(&tctx->regs[TM_QW2_HV_POOL]);
+    uint32_t cam = be32_to_cpu(qw2w2);
+
+    xive_pool_cam_decode(cam, nvt_blk, nvt_idx, vp);
+    return qw2w2;
+}
+
+static void xive_tctx_set_pool_cam(XiveTCTX *tctx, uint32_t qw2w2)
+{
+    memcpy(&tctx->regs[TM_QW2_HV_POOL + TM_WORD2], &qw2w2, 4);
+}
+
 static uint64_t xive_tm_pull_pool_ctx(XivePresenter *xptr, XiveTCTX *tctx,
                                       hwaddr offset, unsigned size)
 {
-    uint32_t qw2w2_prev = xive_tctx_word2(&tctx->regs[TM_QW2_HV_POOL]);
     uint32_t qw2w2;
+    uint32_t qw2w2_new;
+    uint8_t nvt_blk;
+    uint32_t nvt_idx;
+    bool vp;
 
-    qw2w2 = xive_set_field32(TM_QW2W2_VP, qw2w2_prev, 0);
-    memcpy(&tctx->regs[TM_QW2_HV_POOL + TM_WORD2], &qw2w2, 4);
+    qw2w2 = xive_tctx_get_pool_cam(tctx, &nvt_blk, &nvt_idx, &vp);
+
+    if (!vp) {
+        qemu_log_mask(LOG_GUEST_ERROR, "XIVE: pull invalid POOL NVT %x/%x !?\n",
+                      nvt_blk, nvt_idx);
+    }
+
+    /* Invalidate CAM line */
+    qw2w2_new = xive_set_field32(TM_QW2W2_VP, qw2w2, 0);
+    xive_tctx_set_pool_cam(tctx, qw2w2_new);
+
+    xive_tctx_reset_signal(tctx, TM_QW1_OS);
+    xive_tctx_reset_signal(tctx, TM_QW2_HV_POOL);
     return qw2w2;
 }
 
 static uint64_t xive_tm_pull_phys_ctx(XivePresenter *xptr, XiveTCTX *tctx,
                                       hwaddr offset, unsigned size)
 {
-    uint8_t qw3b8_prev = tctx->regs[TM_QW3_HV_PHYS + TM_WORD2];
-    uint8_t qw3b8;
+    uint8_t qw3b8 = tctx->regs[TM_QW3_HV_PHYS + TM_WORD2];
+    uint8_t qw3b8_new;
 
-    qw3b8 = qw3b8_prev & ~TM_QW3B8_VT;
-    tctx->regs[TM_QW3_HV_PHYS + TM_WORD2] = qw3b8;
+    qw3b8 = tctx->regs[TM_QW3_HV_PHYS + TM_WORD2];
+    if (!(qw3b8 & TM_QW3B8_VT)) {
+        qemu_log_mask(LOG_GUEST_ERROR, "XIVE: pulling invalid PHYS thread!?\n");
+    }
+    qw3b8_new = qw3b8 & ~TM_QW3B8_VT;
+    tctx->regs[TM_QW3_HV_PHYS + TM_WORD2] = qw3b8_new;
+
+    xive_tctx_reset_signal(tctx, TM_QW1_OS);
+    xive_tctx_reset_signal(tctx, TM_QW3_HV_PHYS);
     return qw3b8;
 }
 
@@ -489,7 +539,7 @@ static uint64_t xive_tm_pull_os_ctx(XivePresenter *xptr, XiveTCTX *tctx,
     qw1w2 = xive_tctx_get_os_cam(tctx, &nvt_blk, &nvt_idx, &vo);
 
     if (!vo) {
-        qemu_log_mask(LOG_GUEST_ERROR, "XIVE: pulling invalid NVT %x/%x !?\n",
+        qemu_log_mask(LOG_GUEST_ERROR, "XIVE: pull invalid OS NVT %x/%x !?\n",
                       nvt_blk, nvt_idx);
     }
 

From c2cee7477f4af8cdfc33c5bb5928a3a1862655ee Mon Sep 17 00:00:00 2001
From: Glenn Miles <milesg@linux.vnet.ibm.com>
Date: Mon, 12 May 2025 13:10:26 +1000
Subject: [PATCH 2542/2760] pnv/xive2: Support ESB Escalation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add support for XIVE ESB Interrupt Escalation.

Suggested-by: Michael Kowal <kowal@linux.ibm.com>
[This change was taken from a patch provided by Michael Kowal.]
Signed-off-by: Glenn Miles <milesg@linux.vnet.ibm.com>
Reviewed-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Michael Kowal <kowal@linux.ibm.com>
Reviewed-by: Caleb Schlossin <calebs@linux.ibm.com>
Tested-by: Gautam Menghani <gautam@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20250512031100.439842-18-npiggin@gmail.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/intc/xive2.c             | 62 ++++++++++++++++++++++++++++++-------
 include/hw/ppc/xive2.h      |  1 +
 include/hw/ppc/xive2_regs.h | 13 +++++---
 3 files changed, 59 insertions(+), 17 deletions(-)

diff --git a/hw/intc/xive2.c b/hw/intc/xive2.c
index cca121b5f1..541b05225c 100644
--- a/hw/intc/xive2.c
+++ b/hw/intc/xive2.c
@@ -1552,18 +1552,39 @@ do_escalation:
         }
     }
 
-    /*
-     * The END trigger becomes an Escalation trigger
-     */
-    xive2_router_end_notify(xrtr,
-                           xive_get_field32(END2_W4_END_BLOCK,     end.w4),
-                           xive_get_field32(END2_W4_ESC_END_INDEX, end.w4),
-                           xive_get_field32(END2_W5_ESC_END_DATA,  end.w5));
+    if (xive2_end_is_escalate_end(&end)) {
+        /*
+         * Perform END Adaptive escalation processing
+         * The END trigger becomes an Escalation trigger
+         */
+        xive2_router_end_notify(xrtr,
+                               xive_get_field32(END2_W4_END_BLOCK,     end.w4),
+                               xive_get_field32(END2_W4_ESC_END_INDEX, end.w4),
+                               xive_get_field32(END2_W5_ESC_END_DATA,  end.w5));
+    } /* end END adaptive escalation */
+
+    else {
+        uint32_t lisn;              /* Logical Interrupt Source Number */
+
+        /*
+         *  Perform ESB escalation processing
+         *      E[N] == 1 --> N
+         *      Req[Block] <- E[ESB_Block]
+         *      Req[Index] <- E[ESB_Index]
+         *      Req[Offset] <- 0x000
+         *      Execute <ESB Store> Req command
+         */
+        lisn = XIVE_EAS(xive_get_field32(END2_W4_END_BLOCK,     end.w4),
+                        xive_get_field32(END2_W4_ESC_END_INDEX, end.w4));
+
+        xive2_notify(xrtr, lisn, true /* pq_checked */);
+    }
+
+    return;
 }
 
-void xive2_router_notify(XiveNotifier *xn, uint32_t lisn, bool pq_checked)
+void xive2_notify(Xive2Router *xrtr , uint32_t lisn, bool pq_checked)
 {
-    Xive2Router *xrtr = XIVE2_ROUTER(xn);
     uint8_t eas_blk = XIVE_EAS_BLOCK(lisn);
     uint32_t eas_idx = XIVE_EAS_INDEX(lisn);
     Xive2Eas eas;
@@ -1606,13 +1627,30 @@ void xive2_router_notify(XiveNotifier *xn, uint32_t lisn, bool pq_checked)
         return;
     }
 
+    /* TODO: add support for EAS resume */
+    if (xive2_eas_is_resume(&eas)) {
+        qemu_log_mask(LOG_UNIMP,
+                      "XIVE: EAS resume processing unimplemented - LISN %x\n",
+                      lisn);
+        return;
+    }
+
     /*
      * The event trigger becomes an END trigger
      */
     xive2_router_end_notify(xrtr,
-                             xive_get_field64(EAS2_END_BLOCK, eas.w),
-                             xive_get_field64(EAS2_END_INDEX, eas.w),
-                             xive_get_field64(EAS2_END_DATA,  eas.w));
+                            xive_get_field64(EAS2_END_BLOCK, eas.w),
+                            xive_get_field64(EAS2_END_INDEX, eas.w),
+                            xive_get_field64(EAS2_END_DATA,  eas.w));
+    return;
+}
+
+void xive2_router_notify(XiveNotifier *xn, uint32_t lisn, bool pq_checked)
+{
+    Xive2Router *xrtr = XIVE2_ROUTER(xn);
+
+    xive2_notify(xrtr, lisn, pq_checked);
+    return;
 }
 
 static const Property xive2_router_properties[] = {
diff --git a/include/hw/ppc/xive2.h b/include/hw/ppc/xive2.h
index 8cdf819174..2436ddb5e5 100644
--- a/include/hw/ppc/xive2.h
+++ b/include/hw/ppc/xive2.h
@@ -80,6 +80,7 @@ int xive2_router_write_nvgc(Xive2Router *xrtr, bool crowd,
 uint32_t xive2_router_get_config(Xive2Router *xrtr);
 
 void xive2_router_notify(XiveNotifier *xn, uint32_t lisn, bool pq_checked);
+void xive2_notify(Xive2Router *xrtr, uint32_t lisn, bool pq_checked);
 
 /*
  * XIVE2 Presenter (POWER10)
diff --git a/include/hw/ppc/xive2_regs.h b/include/hw/ppc/xive2_regs.h
index 3c28de8a30..2c535ec0d0 100644
--- a/include/hw/ppc/xive2_regs.h
+++ b/include/hw/ppc/xive2_regs.h
@@ -39,15 +39,18 @@
 
 typedef struct Xive2Eas {
         uint64_t       w;
-#define EAS2_VALID                 PPC_BIT(0)
-#define EAS2_END_BLOCK             PPC_BITMASK(4, 7) /* Destination EQ block# */
-#define EAS2_END_INDEX             PPC_BITMASK(8, 31) /* Destination EQ index */
-#define EAS2_MASKED                PPC_BIT(32) /* Masked                 */
-#define EAS2_END_DATA              PPC_BITMASK(33, 63) /* written to the EQ */
+#define EAS2_VALID         PPC_BIT(0)
+#define EAS2_QOS           PPC_BIT(1, 2)       /* Quality of Service(unimp) */
+#define EAS2_RESUME        PPC_BIT(3)          /* END Resume(unimp) */
+#define EAS2_END_BLOCK     PPC_BITMASK(4, 7)   /* Destination EQ block# */
+#define EAS2_END_INDEX     PPC_BITMASK(8, 31)  /* Destination EQ index */
+#define EAS2_MASKED        PPC_BIT(32)         /* Masked */
+#define EAS2_END_DATA      PPC_BITMASK(33, 63) /* written to the EQ */
 } Xive2Eas;
 
 #define xive2_eas_is_valid(eas)   (be64_to_cpu((eas)->w) & EAS2_VALID)
 #define xive2_eas_is_masked(eas)  (be64_to_cpu((eas)->w) & EAS2_MASKED)
+#define xive2_eas_is_resume(eas)  (be64_to_cpu((eas)->w) & EAS2_RESUME)
 
 void xive2_eas_pic_print_info(Xive2Eas *eas, uint32_t lisn, GString *buf);
 

From 14cbb7bf1245c2d9166be0309c9407845783b281 Mon Sep 17 00:00:00 2001
From: Michael Kowal <kowal@linux.ibm.com>
Date: Mon, 12 May 2025 13:10:27 +1000
Subject: [PATCH 2543/2760] pnv/xive2: Print value in invalid register write
 logging
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This can make it easier to see what the target system is trying to
do.

[npiggin: split from larger patch]

Signed-off-by: Michael Kowal <kowal@linux.ibm.com>
Reviewed-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Glenn Miles <milesg@linux.ibm.com>
Reviewed-by: Michael Kowal <kowal@linux.ibm.com>
Reviewed-by: Caleb Schlossin <calebs@linux.ibm.com>
Tested-by: Gautam Menghani <gautam@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20250512031100.439842-19-npiggin@gmail.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/intc/pnv_xive2.c | 24 ++++++++++++++++--------
 1 file changed, 16 insertions(+), 8 deletions(-)

diff --git a/hw/intc/pnv_xive2.c b/hw/intc/pnv_xive2.c
index 25dc8a372d..9d53537e3e 100644
--- a/hw/intc/pnv_xive2.c
+++ b/hw/intc/pnv_xive2.c
@@ -1197,7 +1197,8 @@ static void pnv_xive2_ic_cq_write(void *opaque, hwaddr offset,
     case CQ_FIRMASK_OR: /* FIR error reporting */
         break;
     default:
-        xive2_error(xive, "CQ: invalid write 0x%"HWADDR_PRIx, offset);
+        xive2_error(xive, "CQ: invalid write 0x%"HWADDR_PRIx" value 0x%"PRIx64,
+                    offset, val);
         return;
     }
 
@@ -1495,7 +1496,8 @@ static void pnv_xive2_ic_vc_write(void *opaque, hwaddr offset,
         break;
 
     default:
-        xive2_error(xive, "VC: invalid write @%"HWADDR_PRIx, offset);
+        xive2_error(xive, "VC: invalid write @0x%"HWADDR_PRIx" value 0x%"PRIx64,
+                    offset, val);
         return;
     }
 
@@ -1703,7 +1705,8 @@ static void pnv_xive2_ic_pc_write(void *opaque, hwaddr offset,
         break;
 
     default:
-        xive2_error(xive, "PC: invalid write @%"HWADDR_PRIx, offset);
+        xive2_error(xive, "PC: invalid write @0x%"HWADDR_PRIx" value 0x%"PRIx64,
+                    offset, val);
         return;
     }
 
@@ -1790,7 +1793,8 @@ static void pnv_xive2_ic_tctxt_write(void *opaque, hwaddr offset,
         xive->tctxt_regs[reg] = val;
         break;
     default:
-        xive2_error(xive, "TCTXT: invalid write @%"HWADDR_PRIx, offset);
+        xive2_error(xive, "TCTXT: invalid write @0x%"HWADDR_PRIx
+                    " data 0x%"PRIx64, offset, val);
         return;
     }
 }
@@ -1861,7 +1865,8 @@ static void pnv_xive2_xscom_write(void *opaque, hwaddr offset,
         pnv_xive2_ic_tctxt_write(opaque, mmio_offset, val, size);
         break;
     default:
-        xive2_error(xive, "XSCOM: invalid write @%"HWADDR_PRIx, offset);
+        xive2_error(xive, "XSCOM: invalid write @%"HWADDR_PRIx
+                    " value 0x%"PRIx64, offset, val);
     }
 }
 
@@ -1929,7 +1934,8 @@ static void pnv_xive2_ic_notify_write(void *opaque, hwaddr offset,
         break;
 
     default:
-        xive2_error(xive, "NOTIFY: invalid write @%"HWADDR_PRIx, offset);
+        xive2_error(xive, "NOTIFY: invalid write @%"HWADDR_PRIx
+                    " value 0x%"PRIx64, offset, val);
     }
 }
 
@@ -1971,7 +1977,8 @@ static void pnv_xive2_ic_lsi_write(void *opaque, hwaddr offset,
 {
     PnvXive2 *xive = PNV_XIVE2(opaque);
 
-    xive2_error(xive, "LSI: invalid write @%"HWADDR_PRIx, offset);
+    xive2_error(xive, "LSI: invalid write @%"HWADDR_PRIx" value 0x%"PRIx64,
+                offset, val);
 }
 
 static const MemoryRegionOps pnv_xive2_ic_lsi_ops = {
@@ -2074,7 +2081,8 @@ static void pnv_xive2_ic_sync_write(void *opaque, hwaddr offset,
         inject_type = PNV_XIVE2_QUEUE_NXC_ST_RMT_CI;
         break;
     default:
-        xive2_error(xive, "SYNC: invalid write @%"HWADDR_PRIx, offset);
+        xive2_error(xive, "SYNC: invalid write @%"HWADDR_PRIx" value 0x%"PRIx64,
+                    offset, val);
         return;
     }
 

From d273abbfba47ef47e331dc22731c7d2a15e95c9a Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Mon, 12 May 2025 13:10:28 +1000
Subject: [PATCH 2544/2760] pnv/xive2: VC_ENDC_WATCH_SPEC regs should read back
 WATCH_FULL
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Firmware expects to read back the WATCH_FULL bit from the VC_ENDC_WATCH_SPEC
register, so don't clear it on read.

Don't bother clearing the reads-as-zero CONFLICT bit because it's masked
at write already.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Glenn Miles <milesg@linux.ibm.com>
Reviewed-by: Michael Kowal <kowal@linux.ibm.com>
Reviewed-by: Caleb Schlossin <calebs@linux.ibm.com>
Tested-by: Gautam Menghani <gautam@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20250512031100.439842-20-npiggin@gmail.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/intc/pnv_xive2.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/hw/intc/pnv_xive2.c b/hw/intc/pnv_xive2.c
index 9d53537e3e..e15f414d0b 100644
--- a/hw/intc/pnv_xive2.c
+++ b/hw/intc/pnv_xive2.c
@@ -1329,7 +1329,6 @@ static uint64_t pnv_xive2_ic_vc_read(void *opaque, hwaddr offset,
     case VC_ENDC_WATCH2_SPEC:
     case VC_ENDC_WATCH3_SPEC:
         watch_engine = (offset - VC_ENDC_WATCH0_SPEC) >> 6;
-        xive->vc_regs[reg] &= ~(VC_ENDC_WATCH_FULL | VC_ENDC_WATCH_CONFLICT);
         pnv_xive2_endc_cache_watch_release(xive, watch_engine);
         val = xive->vc_regs[reg];
         break;

From 9898cc80306588eb6a1c44b7ba38f207ca8bdcfa Mon Sep 17 00:00:00 2001
From: Michael Kowal <kowal@linux.ibm.com>
Date: Mon, 12 May 2025 13:10:29 +1000
Subject: [PATCH 2545/2760] pnv/xive2: Permit valid writes to VC/PC Flush
 Control registers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Writes to the Flush Control registers were logged as invalid
when they are allowed. Clearing the unsupported want_cache_disable
feature is supported, so don't log an error in that case.

Signed-off-by: Michael Kowal <kowal@linux.ibm.com>
Reviewed-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Glenn Miles <milesg@linux.ibm.com>
Reviewed-by: Michael Kowal <kowal@linux.ibm.com>
Reviewed-by: Caleb Schlossin <calebs@linux.ibm.com>
Tested-by: Gautam Menghani <gautam@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20250512031100.439842-21-npiggin@gmail.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/intc/pnv_xive2.c | 36 ++++++++++++++++++++++++++++++++----
 1 file changed, 32 insertions(+), 4 deletions(-)

diff --git a/hw/intc/pnv_xive2.c b/hw/intc/pnv_xive2.c
index e15f414d0b..386175a68b 100644
--- a/hw/intc/pnv_xive2.c
+++ b/hw/intc/pnv_xive2.c
@@ -1411,7 +1411,14 @@ static void pnv_xive2_ic_vc_write(void *opaque, hwaddr offset,
     /*
      * ESB cache updates (not modeled)
      */
-    /* case VC_ESBC_FLUSH_CTRL: */
+    case VC_ESBC_FLUSH_CTRL:
+        if (val & VC_ESBC_FLUSH_CTRL_WANT_CACHE_DISABLE) {
+            xive2_error(xive, "VC: unsupported write @0x%"HWADDR_PRIx
+                        " value 0x%"PRIx64" bit[2] poll_want_cache_disable",
+                        offset, val);
+            return;
+        }
+        break;
     case VC_ESBC_FLUSH_POLL:
         xive->vc_regs[VC_ESBC_FLUSH_CTRL >> 3] |= VC_ESBC_FLUSH_CTRL_POLL_VALID;
         /* ESB update */
@@ -1427,7 +1434,14 @@ static void pnv_xive2_ic_vc_write(void *opaque, hwaddr offset,
     /*
      * EAS cache updates (not modeled)
      */
-    /* case VC_EASC_FLUSH_CTRL: */
+    case VC_EASC_FLUSH_CTRL:
+        if (val & VC_EASC_FLUSH_CTRL_WANT_CACHE_DISABLE) {
+            xive2_error(xive, "VC: unsupported write @0x%"HWADDR_PRIx
+                        " value 0x%"PRIx64" bit[2] poll_want_cache_disable",
+                        offset, val);
+            return;
+        }
+        break;
     case VC_EASC_FLUSH_POLL:
         xive->vc_regs[VC_EASC_FLUSH_CTRL >> 3] |= VC_EASC_FLUSH_CTRL_POLL_VALID;
         /* EAS update */
@@ -1466,7 +1480,14 @@ static void pnv_xive2_ic_vc_write(void *opaque, hwaddr offset,
         break;
 
 
-    /* case VC_ENDC_FLUSH_CTRL: */
+    case VC_ENDC_FLUSH_CTRL:
+        if (val & VC_ENDC_FLUSH_CTRL_WANT_CACHE_DISABLE) {
+            xive2_error(xive, "VC: unsupported write @0x%"HWADDR_PRIx
+                        " value 0x%"PRIx64" bit[2] poll_want_cache_disable",
+                        offset, val);
+            return;
+        }
+        break;
     case VC_ENDC_FLUSH_POLL:
         xive->vc_regs[VC_ENDC_FLUSH_CTRL >> 3] |= VC_ENDC_FLUSH_CTRL_POLL_VALID;
         break;
@@ -1687,7 +1708,14 @@ static void pnv_xive2_ic_pc_write(void *opaque, hwaddr offset,
         pnv_xive2_nxc_update(xive, watch_engine);
         break;
 
-   /* case PC_NXC_FLUSH_CTRL: */
+    case PC_NXC_FLUSH_CTRL:
+        if (val & PC_NXC_FLUSH_CTRL_WANT_CACHE_DISABLE) {
+            xive2_error(xive, "VC: unsupported write @0x%"HWADDR_PRIx
+                        " value 0x%"PRIx64" bit[2] poll_want_cache_disable",
+                        offset, val);
+            return;
+        }
+        break;
     case PC_NXC_FLUSH_POLL:
         xive->pc_regs[PC_NXC_FLUSH_CTRL >> 3] |= PC_NXC_FLUSH_CTRL_POLL_VALID;
         break;

From b22ffb42999504614a1bef3a52c5b2e6549e8de6 Mon Sep 17 00:00:00 2001
From: Glenn Miles <milesg@linux.ibm.com>
Date: Mon, 12 May 2025 13:10:30 +1000
Subject: [PATCH 2546/2760] ppc/xive2: add interrupt priority configuration
 flags
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adds support for extracting additional configuration flags from
the XIVE configuration register that are needed for redistribution
of group interrupts.

Signed-off-by: Glenn Miles <milesg@linux.ibm.com>
Reviewed-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Michael Kowal <kowal@linux.ibm.com>
Tested-by: Gautam Menghani <gautam@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20250512031100.439842-22-npiggin@gmail.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/intc/pnv_xive2.c      | 16 ++++++++++++----
 hw/intc/pnv_xive2_regs.h |  1 +
 include/hw/ppc/xive2.h   |  8 +++++---
 3 files changed, 18 insertions(+), 7 deletions(-)

diff --git a/hw/intc/pnv_xive2.c b/hw/intc/pnv_xive2.c
index 386175a68b..7b4a33228e 100644
--- a/hw/intc/pnv_xive2.c
+++ b/hw/intc/pnv_xive2.c
@@ -605,20 +605,28 @@ static uint32_t pnv_xive2_get_config(Xive2Router *xrtr)
 {
     PnvXive2 *xive = PNV_XIVE2(xrtr);
     uint32_t cfg = 0;
+    uint64_t reg = xive->cq_regs[CQ_XIVE_CFG >> 3];
 
-    if (xive->cq_regs[CQ_XIVE_CFG >> 3] & CQ_XIVE_CFG_GEN1_TIMA_OS) {
+    if (reg & CQ_XIVE_CFG_GEN1_TIMA_OS) {
         cfg |= XIVE2_GEN1_TIMA_OS;
     }
 
-    if (xive->cq_regs[CQ_XIVE_CFG >> 3] & CQ_XIVE_CFG_EN_VP_SAVE_RESTORE) {
+    if (reg & CQ_XIVE_CFG_EN_VP_SAVE_RESTORE) {
         cfg |= XIVE2_VP_SAVE_RESTORE;
     }
 
-    if (GETFIELD(CQ_XIVE_CFG_HYP_HARD_RANGE,
-              xive->cq_regs[CQ_XIVE_CFG >> 3]) == CQ_XIVE_CFG_THREADID_8BITS) {
+    if (GETFIELD(CQ_XIVE_CFG_HYP_HARD_RANGE, reg) ==
+                      CQ_XIVE_CFG_THREADID_8BITS) {
         cfg |= XIVE2_THREADID_8BITS;
     }
 
+    if (reg & CQ_XIVE_CFG_EN_VP_GRP_PRIORITY) {
+        cfg |= XIVE2_EN_VP_GRP_PRIORITY;
+    }
+
+    cfg = SETFIELD(XIVE2_VP_INT_PRIO, cfg,
+                   GETFIELD(CQ_XIVE_CFG_VP_INT_PRIO, reg));
+
     return cfg;
 }
 
diff --git a/hw/intc/pnv_xive2_regs.h b/hw/intc/pnv_xive2_regs.h
index e8b87b3d2c..d53300f709 100644
--- a/hw/intc/pnv_xive2_regs.h
+++ b/hw/intc/pnv_xive2_regs.h
@@ -66,6 +66,7 @@
 #define    CQ_XIVE_CFG_GEN1_TIMA_HYP_BLK0       PPC_BIT(26) /* 0 if bit[25]=0 */
 #define    CQ_XIVE_CFG_GEN1_TIMA_CROWD_DIS      PPC_BIT(27) /* 0 if bit[25]=0 */
 #define    CQ_XIVE_CFG_GEN1_END_ESX             PPC_BIT(28)
+#define    CQ_XIVE_CFG_EN_VP_GRP_PRIORITY       PPC_BIT(32) /* 0 if bit[25]=1 */
 #define    CQ_XIVE_CFG_EN_VP_SAVE_RESTORE       PPC_BIT(38) /* 0 if bit[25]=1 */
 #define    CQ_XIVE_CFG_EN_VP_SAVE_REST_STRICT   PPC_BIT(39) /* 0 if bit[25]=1 */
 
diff --git a/include/hw/ppc/xive2.h b/include/hw/ppc/xive2.h
index 2436ddb5e5..760b94a962 100644
--- a/include/hw/ppc/xive2.h
+++ b/include/hw/ppc/xive2.h
@@ -29,9 +29,11 @@ OBJECT_DECLARE_TYPE(Xive2Router, Xive2RouterClass, XIVE2_ROUTER);
  * Configuration flags
  */
 
-#define XIVE2_GEN1_TIMA_OS      0x00000001
-#define XIVE2_VP_SAVE_RESTORE   0x00000002
-#define XIVE2_THREADID_8BITS    0x00000004
+#define XIVE2_GEN1_TIMA_OS          0x00000001
+#define XIVE2_VP_SAVE_RESTORE       0x00000002
+#define XIVE2_THREADID_8BITS        0x00000004
+#define XIVE2_EN_VP_GRP_PRIORITY    0x00000008
+#define XIVE2_VP_INT_PRIO           0x00000030
 
 typedef struct Xive2RouterClass {
     SysBusDeviceClass parent;

From 555e446019f58e488ccf9fc416667be450e3f32f Mon Sep 17 00:00:00 2001
From: Glenn Miles <milesg@linux.ibm.com>
Date: Mon, 12 May 2025 13:10:31 +1000
Subject: [PATCH 2547/2760] ppc/xive2: Support redistribution of group
 interrupts
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When an XIVE context is pulled while it has an active, unacknowledged
group interrupt, XIVE will check to see if a context on another thread
can handle the interrupt and, if so, notify that context.  If there
are no contexts that can handle the interrupt, then the interrupt is
added to a backlog and XIVE will attempt to escalate the interrupt,
if configured to do so, allowing the higher privileged handler to
activate a context that can handle the original interrupt.

Signed-off-by: Glenn Miles <milesg@linux.ibm.com>
Reviewed-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Michael Kowal <kowal@linux.ibm.com>
Tested-by: Gautam Menghani <gautam@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20250512031100.439842-23-npiggin@gmail.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/intc/xive2.c             | 84 +++++++++++++++++++++++++++++++++++--
 include/hw/ppc/xive2_regs.h |  3 ++
 2 files changed, 83 insertions(+), 4 deletions(-)

diff --git a/hw/intc/xive2.c b/hw/intc/xive2.c
index 541b05225c..9ef372b6d1 100644
--- a/hw/intc/xive2.c
+++ b/hw/intc/xive2.c
@@ -19,6 +19,10 @@
 #include "hw/ppc/xive2_regs.h"
 #include "trace.h"
 
+static void xive2_router_end_notify(Xive2Router *xrtr, uint8_t end_blk,
+                                    uint32_t end_idx, uint32_t end_data,
+                                    bool redistribute);
+
 uint32_t xive2_router_get_config(Xive2Router *xrtr)
 {
     Xive2RouterClass *xrc = XIVE2_ROUTER_GET_CLASS(xrtr);
@@ -597,6 +601,68 @@ static uint32_t xive2_tctx_hw_cam_line(XivePresenter *xptr, XiveTCTX *tctx)
     return xive2_nvp_cam_line(blk, 1 << tid_shift | (pir & tid_mask));
 }
 
+static void xive2_redistribute(Xive2Router *xrtr, XiveTCTX *tctx,
+                               uint8_t nvp_blk, uint32_t nvp_idx, uint8_t ring)
+{
+    uint8_t nsr = tctx->regs[ring + TM_NSR];
+    uint8_t crowd = NVx_CROWD_LVL(nsr);
+    uint8_t group = NVx_GROUP_LVL(nsr);
+    uint8_t nvgc_blk;
+    uint8_t nvgc_idx;
+    uint8_t end_blk;
+    uint32_t end_idx;
+    uint8_t pipr = tctx->regs[ring + TM_PIPR];
+    Xive2Nvgc nvgc;
+    uint8_t prio_limit;
+    uint32_t cfg;
+
+    /* convert crowd/group to blk/idx */
+    if (group > 0) {
+        nvgc_idx = (nvp_idx & (0xffffffff << group)) |
+                   ((1 << (group - 1)) - 1);
+    } else {
+        nvgc_idx = nvp_idx;
+    }
+
+    if (crowd > 0) {
+        crowd = (crowd == 3) ? 4 : crowd;
+        nvgc_blk = (nvp_blk & (0xffffffff << crowd)) |
+                   ((1 << (crowd - 1)) - 1);
+    } else {
+        nvgc_blk = nvp_blk;
+    }
+
+    /* Use blk/idx to retrieve the NVGC */
+    if (xive2_router_get_nvgc(xrtr, crowd, nvgc_blk, nvgc_idx, &nvgc)) {
+        qemu_log_mask(LOG_GUEST_ERROR, "XIVE: no %s %x/%x\n",
+                      crowd ? "NVC" : "NVG", nvgc_blk, nvgc_idx);
+        return;
+    }
+
+    /* retrieve the END blk/idx from the NVGC */
+    end_blk = xive_get_field32(NVGC2_W1_END_BLK, nvgc.w1);
+    end_idx = xive_get_field32(NVGC2_W1_END_IDX, nvgc.w1);
+
+    /* determine number of priorities being used */
+    cfg = xive2_router_get_config(xrtr);
+    if (cfg & XIVE2_EN_VP_GRP_PRIORITY) {
+        prio_limit = 1 << GETFIELD(NVGC2_W1_PSIZE, nvgc.w1);
+    } else {
+        prio_limit = 1 << GETFIELD(XIVE2_VP_INT_PRIO, cfg);
+    }
+
+    /* add priority offset to end index */
+    end_idx += pipr % prio_limit;
+
+    /* trigger the group END */
+    xive2_router_end_notify(xrtr, end_blk, end_idx, 0, true);
+
+    /* clear interrupt indication for the context */
+    tctx->regs[ring + TM_NSR] = 0;
+    tctx->regs[ring + TM_PIPR] = tctx->regs[ring + TM_CPPR];
+    xive_tctx_reset_signal(tctx, ring);
+}
+
 static uint64_t xive2_tm_pull_ctx(XivePresenter *xptr, XiveTCTX *tctx,
                                   hwaddr offset, unsigned size, uint8_t ring)
 {
@@ -608,6 +674,7 @@ static uint64_t xive2_tm_pull_ctx(XivePresenter *xptr, XiveTCTX *tctx,
     uint8_t cur_ring;
     bool valid;
     bool do_save;
+    uint8_t nsr;
 
     xive2_cam_decode(cam, &nvp_blk, &nvp_idx, &valid, &do_save);
 
@@ -624,6 +691,12 @@ static uint64_t xive2_tm_pull_ctx(XivePresenter *xptr, XiveTCTX *tctx,
         memcpy(&tctx->regs[cur_ring + TM_WORD2], &ringw2_new, 4);
     }
 
+    /* Active group/crowd interrupts need to be redistributed */
+    nsr = tctx->regs[ring + TM_NSR];
+    if (xive_nsr_indicates_group_exception(ring, nsr)) {
+        xive2_redistribute(xrtr, tctx, nvp_blk, nvp_idx, ring);
+    }
+
     if (xive2_router_get_config(xrtr) & XIVE2_VP_SAVE_RESTORE && do_save) {
         xive2_tctx_save_ctx(xrtr, tctx, nvp_blk, nvp_idx, ring);
     }
@@ -1352,7 +1425,8 @@ static bool xive2_router_end_es_notify(Xive2Router *xrtr, uint8_t end_blk,
  * message has the same parameters than in the function below.
  */
 static void xive2_router_end_notify(Xive2Router *xrtr, uint8_t end_blk,
-                                    uint32_t end_idx, uint32_t end_data)
+                                    uint32_t end_idx, uint32_t end_data,
+                                    bool redistribute)
 {
     Xive2End end;
     uint8_t priority;
@@ -1380,7 +1454,7 @@ static void xive2_router_end_notify(Xive2Router *xrtr, uint8_t end_blk,
         return;
     }
 
-    if (xive2_end_is_enqueue(&end)) {
+    if (!redistribute && xive2_end_is_enqueue(&end)) {
         xive2_end_enqueue(&end, end_data);
         /* Enqueuing event data modifies the EQ toggle and index */
         xive2_router_write_end(xrtr, end_blk, end_idx, &end, 1);
@@ -1560,7 +1634,8 @@ do_escalation:
         xive2_router_end_notify(xrtr,
                                xive_get_field32(END2_W4_END_BLOCK,     end.w4),
                                xive_get_field32(END2_W4_ESC_END_INDEX, end.w4),
-                               xive_get_field32(END2_W5_ESC_END_DATA,  end.w5));
+                               xive_get_field32(END2_W5_ESC_END_DATA,  end.w5),
+                               false);
     } /* end END adaptive escalation */
 
     else {
@@ -1641,7 +1716,8 @@ void xive2_notify(Xive2Router *xrtr , uint32_t lisn, bool pq_checked)
     xive2_router_end_notify(xrtr,
                             xive_get_field64(EAS2_END_BLOCK, eas.w),
                             xive_get_field64(EAS2_END_INDEX, eas.w),
-                            xive_get_field64(EAS2_END_DATA,  eas.w));
+                            xive_get_field64(EAS2_END_DATA,  eas.w),
+                            false);
     return;
 }
 
diff --git a/include/hw/ppc/xive2_regs.h b/include/hw/ppc/xive2_regs.h
index 2c535ec0d0..e222038143 100644
--- a/include/hw/ppc/xive2_regs.h
+++ b/include/hw/ppc/xive2_regs.h
@@ -224,6 +224,9 @@ typedef struct Xive2Nvgc {
 #define NVGC2_W0_VALID             PPC_BIT32(0)
 #define NVGC2_W0_PGONEXT           PPC_BITMASK32(26, 31)
         uint32_t        w1;
+#define NVGC2_W1_PSIZE             PPC_BITMASK32(0, 1)
+#define NVGC2_W1_END_BLK           PPC_BITMASK32(4, 7)
+#define NVGC2_W1_END_IDX           PPC_BITMASK32(8, 31)
         uint32_t        w2;
         uint32_t        w3;
         uint32_t        w4;

From 701ab1857a9175a86e3ad6f18958df631af86a62 Mon Sep 17 00:00:00 2001
From: Glenn Miles <milesg@linux.ibm.com>
Date: Mon, 12 May 2025 13:10:32 +1000
Subject: [PATCH 2548/2760] ppc/xive: Add more interrupt notification tracing
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add more tracing around notification, redistribution, and escalation.

Signed-off-by: Glenn Miles <milesg@linux.ibm.com>
Reviewed-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Michael Kowal <kowal@linux.ibm.com>
Tested-by: Gautam Menghani <gautam@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20250512031100.439842-24-npiggin@gmail.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/intc/trace-events |  6 ++++++
 hw/intc/xive.c       |  3 +++
 hw/intc/xive2.c      | 13 ++++++++-----
 3 files changed, 17 insertions(+), 5 deletions(-)

diff --git a/hw/intc/trace-events b/hw/intc/trace-events
index 9ed2616e58..018c609ca5 100644
--- a/hw/intc/trace-events
+++ b/hw/intc/trace-events
@@ -279,6 +279,8 @@ xive_tctx_notify(uint32_t index, uint8_t ring, uint8_t ipb, uint8_t pipr, uint8_
 xive_tctx_set_cppr(uint32_t index, uint8_t ring, uint8_t ipb, uint8_t pipr, uint8_t cppr, uint8_t nsr) "target=%d ring=0x%x IPB=0x%02x PIPR=0x%02x new CPPR=0x%02x NSR=0x%02x"
 xive_source_esb_read(uint64_t addr, uint32_t srcno, uint64_t value) "@0x%"PRIx64" IRQ 0x%x val=0x%"PRIx64
 xive_source_esb_write(uint64_t addr, uint32_t srcno, uint64_t value) "@0x%"PRIx64" IRQ 0x%x val=0x%"PRIx64
+xive_source_notify(uint32_t srcno) "Processing notification for queued IRQ 0x%x"
+xive_source_blocked(uint32_t srcno) "No action needed for IRQ 0x%x currently"
 xive_router_end_notify(uint8_t end_blk, uint32_t end_idx, uint32_t end_data) "END 0x%02x/0x%04x -> enqueue 0x%08x"
 xive_router_end_escalate(uint8_t end_blk, uint32_t end_idx, uint8_t esc_blk, uint32_t esc_idx, uint32_t end_data) "END 0x%02x/0x%04x -> escalate END 0x%02x/0x%04x data 0x%08x"
 xive_tctx_tm_write(uint32_t index, uint64_t offset, unsigned int size, uint64_t value) "target=%d @0x%"PRIx64" sz=%d val=0x%" PRIx64
@@ -289,6 +291,10 @@ xive_end_source_read(uint8_t end_blk, uint32_t end_idx, uint64_t addr) "END 0x%x
 # xive2.c
 xive_nvp_backlog_op(uint8_t blk, uint32_t idx, uint8_t op, uint8_t priority, uint8_t rc) "NVP 0x%x/0x%x operation=%d priority=%d rc=%d"
 xive_nvgc_backlog_op(bool c, uint8_t blk, uint32_t idx, uint8_t op, uint8_t priority, uint32_t rc) "NVGC crowd=%d 0x%x/0x%x operation=%d priority=%d rc=%d"
+xive_redistribute(uint32_t index, uint8_t ring, uint8_t end_blk, uint32_t end_idx) "Redistribute from target=%d ring=0x%x NVP 0x%x/0x%x"
+xive_end_enqueue(uint8_t end_blk, uint32_t end_idx, uint32_t end_data) "Queue event for END 0x%x/0x%x data=0x%x"
+xive_escalate_end(uint8_t end_blk, uint32_t end_idx, uint8_t esc_blk, uint32_t esc_idx, uint32_t esc_data) "Escalate from END 0x%x/0x%x to END 0x%x/0x%x data=0x%x"
+xive_escalate_esb(uint8_t end_blk, uint32_t end_idx, uint32_t lisn) "Escalate from END 0x%x/0x%x to LISN=0x%x"
 
 # pnv_xive.c
 pnv_xive_ic_hw_trigger(uint64_t addr, uint64_t val) "@0x%"PRIx64" val=0x%"PRIx64
diff --git a/hw/intc/xive.c b/hw/intc/xive.c
index 5483a815ef..d653946516 100644
--- a/hw/intc/xive.c
+++ b/hw/intc/xive.c
@@ -1276,6 +1276,7 @@ static uint64_t xive_source_esb_read(void *opaque, hwaddr addr, unsigned size)
 
         /* Forward the source event notification for routing */
         if (ret) {
+            trace_xive_source_notify(srcno);
             xive_source_notify(xsrc, srcno);
         }
         break;
@@ -1371,6 +1372,8 @@ out:
     /* Forward the source event notification for routing */
     if (notify) {
         xive_source_notify(xsrc, srcno);
+    } else {
+        trace_xive_source_blocked(srcno);
     }
 }
 
diff --git a/hw/intc/xive2.c b/hw/intc/xive2.c
index 9ef372b6d1..f810e716de 100644
--- a/hw/intc/xive2.c
+++ b/hw/intc/xive2.c
@@ -616,6 +616,7 @@ static void xive2_redistribute(Xive2Router *xrtr, XiveTCTX *tctx,
     uint8_t prio_limit;
     uint32_t cfg;
 
+    trace_xive_redistribute(tctx->cs->cpu_index, ring, nvp_blk, nvp_idx);
     /* convert crowd/group to blk/idx */
     if (group > 0) {
         nvgc_idx = (nvp_idx & (0xffffffff << group)) |
@@ -1455,6 +1456,7 @@ static void xive2_router_end_notify(Xive2Router *xrtr, uint8_t end_blk,
     }
 
     if (!redistribute && xive2_end_is_enqueue(&end)) {
+        trace_xive_end_enqueue(end_blk, end_idx, end_data);
         xive2_end_enqueue(&end, end_data);
         /* Enqueuing event data modifies the EQ toggle and index */
         xive2_router_write_end(xrtr, end_blk, end_idx, &end, 1);
@@ -1631,11 +1633,11 @@ do_escalation:
          * Perform END Adaptive escalation processing
          * The END trigger becomes an Escalation trigger
          */
-        xive2_router_end_notify(xrtr,
-                               xive_get_field32(END2_W4_END_BLOCK,     end.w4),
-                               xive_get_field32(END2_W4_ESC_END_INDEX, end.w4),
-                               xive_get_field32(END2_W5_ESC_END_DATA,  end.w5),
-                               false);
+        uint8_t esc_blk = xive_get_field32(END2_W4_END_BLOCK, end.w4);
+        uint32_t esc_idx = xive_get_field32(END2_W4_ESC_END_INDEX, end.w4);
+        uint32_t esc_data = xive_get_field32(END2_W5_ESC_END_DATA, end.w5);
+        trace_xive_escalate_end(end_blk, end_idx, esc_blk, esc_idx, esc_data);
+        xive2_router_end_notify(xrtr, esc_blk, esc_idx, esc_data, false);
     } /* end END adaptive escalation */
 
     else {
@@ -1652,6 +1654,7 @@ do_escalation:
         lisn = XIVE_EAS(xive_get_field32(END2_W4_END_BLOCK,     end.w4),
                         xive_get_field32(END2_W4_ESC_END_INDEX, end.w4));
 
+        trace_xive_escalate_esb(end_blk, end_idx, lisn);
         xive2_notify(xrtr, lisn, true /* pq_checked */);
     }
 

From 1a0cd94252bf111b0ace7b9cd88258e837d95ea4 Mon Sep 17 00:00:00 2001
From: Glenn Miles <milesg@linux.ibm.com>
Date: Mon, 12 May 2025 13:10:33 +1000
Subject: [PATCH 2549/2760] ppc/xive2: Improve pool regs variable name
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Change pregs to pool_regs, for clarity.

[npiggin: split from larger patch]

Signed-off-by: Glenn Miles <milesg@linux.ibm.com>
Reviewed-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Michael Kowal <kowal@linux.ibm.com>
Tested-by: Gautam Menghani <gautam@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20250512031100.439842-25-npiggin@gmail.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/intc/xive2.c | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/hw/intc/xive2.c b/hw/intc/xive2.c
index f810e716de..1f4713dabe 100644
--- a/hw/intc/xive2.c
+++ b/hw/intc/xive2.c
@@ -1044,13 +1044,12 @@ again:
 
     /* PHYS updates also depend on POOL values */
     if (ring == TM_QW3_HV_PHYS) {
-        uint8_t *pregs = &tctx->regs[TM_QW2_HV_POOL];
+        uint8_t *pool_regs = &tctx->regs[TM_QW2_HV_POOL];
 
         /* POOL values only matter if POOL ctx is valid */
-        if (pregs[TM_WORD2] & 0x80) {
-
-            uint8_t pool_pipr = xive_ipb_to_pipr(pregs[TM_IPB]);
-            uint8_t pool_lsmfb = pregs[TM_LSMFB];
+        if (pool_regs[TM_WORD2] & 0x80) {
+            uint8_t pool_pipr = xive_ipb_to_pipr(pool_regs[TM_IPB]);
+            uint8_t pool_lsmfb = pool_regs[TM_LSMFB];
 
             /*
              * Determine highest priority interrupt and
@@ -1064,7 +1063,7 @@ again:
             }
 
             /* Values needed for group priority calculation */
-            if (pregs[TM_LGS] && (pool_lsmfb < lsmfb_min)) {
+            if (pool_regs[TM_LGS] && (pool_lsmfb < lsmfb_min)) {
                 group_enabled = true;
                 lsmfb_min = pool_lsmfb;
                 if (lsmfb_min < pipr_min) {

From 97cd373e6ca0024132e78496b8a585c00531f7a4 Mon Sep 17 00:00:00 2001
From: Glenn Miles <milesg@linux.ibm.com>
Date: Mon, 12 May 2025 13:10:34 +1000
Subject: [PATCH 2550/2760] ppc/xive2: Implement "Ack OS IRQ to even report
 line" TIMA op
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Booting AIX in a PowerVM partition requires the use of the "Acknowledge
O/S Interrupt to even O/S reporting line" special operation provided by
the IBM XIVE interrupt controller. This operation is invoked by writing
a byte (data is irrelevant) to offset 0xC10 of the Thread Interrupt
Management Area (TIMA). It can be used by software to notify the XIVE
logic that the interrupt was received.

Signed-off-by: Glenn Miles <milesg@linux.ibm.com>
Reviewed-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Michael Kowal <kowal@linux.ibm.com>
Tested-by: Gautam Menghani <gautam@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20250512031100.439842-26-npiggin@gmail.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/intc/xive.c         |  8 ++++---
 hw/intc/xive2.c        | 50 ++++++++++++++++++++++++++++++++++++++++++
 include/hw/ppc/xive.h  |  1 +
 include/hw/ppc/xive2.h |  3 ++-
 4 files changed, 58 insertions(+), 4 deletions(-)

diff --git a/hw/intc/xive.c b/hw/intc/xive.c
index d653946516..8b705727ae 100644
--- a/hw/intc/xive.c
+++ b/hw/intc/xive.c
@@ -80,7 +80,7 @@ static qemu_irq xive_tctx_output(XiveTCTX *tctx, uint8_t ring)
         }
 }
 
-static uint64_t xive_tctx_accept(XiveTCTX *tctx, uint8_t ring)
+uint64_t xive_tctx_accept(XiveTCTX *tctx, uint8_t ring)
 {
     uint8_t *regs = &tctx->regs[ring];
     uint8_t nsr = regs[TM_NSR];
@@ -340,14 +340,14 @@ static uint64_t xive_tm_vt_poll(XivePresenter *xptr, XiveTCTX *tctx,
 
 static const uint8_t xive_tm_hw_view[] = {
     3, 0, 0, 0,   0, 0, 0, 0,   3, 3, 3, 3,   0, 0, 0, 0, /* QW-0 User */
-    3, 3, 3, 3,   3, 3, 0, 2,   3, 3, 3, 3,   0, 0, 0, 0, /* QW-1 OS   */
+    3, 3, 3, 3,   3, 3, 0, 2,   3, 3, 3, 3,   0, 0, 0, 3, /* QW-1 OS   */
     0, 0, 3, 3,   0, 3, 3, 0,   3, 3, 3, 3,   0, 0, 0, 0, /* QW-2 POOL */
     3, 3, 3, 3,   0, 3, 0, 2,   3, 0, 0, 3,   3, 3, 3, 0, /* QW-3 PHYS */
 };
 
 static const uint8_t xive_tm_hv_view[] = {
     3, 0, 0, 0,   0, 0, 0, 0,   3, 3, 3, 3,   0, 0, 0, 0, /* QW-0 User */
-    3, 3, 3, 3,   3, 3, 0, 2,   3, 3, 3, 3,   0, 0, 0, 0, /* QW-1 OS   */
+    3, 3, 3, 3,   3, 3, 0, 2,   3, 3, 3, 3,   0, 0, 0, 3, /* QW-1 OS   */
     0, 0, 3, 3,   0, 3, 3, 0,   0, 3, 3, 3,   0, 0, 0, 0, /* QW-2 POOL */
     3, 3, 3, 3,   0, 3, 0, 2,   3, 0, 0, 3,   0, 0, 0, 0, /* QW-3 PHYS */
 };
@@ -718,6 +718,8 @@ static const XiveTmOp xive2_tm_operations[] = {
                                                      xive_tm_pull_phys_ctx },
     { XIVE_TM_HV_PAGE, TM_SPC_PULL_PHYS_CTX_OL,   1, xive2_tm_pull_phys_ctx_ol,
                                                      NULL },
+    { XIVE_TM_OS_PAGE, TM_SPC_ACK_OS_EL,          1, xive2_tm_ack_os_el,
+                                                     NULL },
 };
 
 static const XiveTmOp *xive_tm_find_op(XivePresenter *xptr, hwaddr offset,
diff --git a/hw/intc/xive2.c b/hw/intc/xive2.c
index 1f4713dabe..e7e364c13e 100644
--- a/hw/intc/xive2.c
+++ b/hw/intc/xive2.c
@@ -1009,6 +1009,56 @@ static int xive2_tctx_get_nvp_indexes(XiveTCTX *tctx, uint8_t ring,
     return 0;
 }
 
+static void xive2_tctx_accept_el(XivePresenter *xptr, XiveTCTX *tctx,
+                                 uint8_t ring, uint8_t cl_ring)
+{
+    uint64_t rd;
+    Xive2Router *xrtr = XIVE2_ROUTER(xptr);
+    uint32_t nvp_blk, nvp_idx, xive2_cfg;
+    Xive2Nvp nvp;
+    uint64_t phys_addr;
+    uint8_t OGen = 0;
+
+    xive2_tctx_get_nvp_indexes(tctx, cl_ring, &nvp_blk, &nvp_idx);
+
+    if (xive2_router_get_nvp(xrtr, (uint8_t)nvp_blk, nvp_idx, &nvp)) {
+        qemu_log_mask(LOG_GUEST_ERROR, "XIVE: No NVP %x/%x\n",
+                      nvp_blk, nvp_idx);
+        return;
+    }
+
+    if (!xive2_nvp_is_valid(&nvp)) {
+        qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid NVP %x/%x\n",
+                      nvp_blk, nvp_idx);
+        return;
+    }
+
+
+    rd = xive_tctx_accept(tctx, ring);
+
+    if (ring == TM_QW1_OS) {
+        OGen = tctx->regs[ring + TM_OGEN];
+    }
+    xive2_cfg = xive2_router_get_config(xrtr);
+    phys_addr = xive2_nvp_reporting_addr(&nvp);
+    uint8_t report_data[REPORT_LINE_GEN1_SIZE];
+    memset(report_data, 0xff, sizeof(report_data));
+    if ((OGen == 1) || (xive2_cfg & XIVE2_GEN1_TIMA_OS)) {
+        report_data[8] = (rd >> 8) & 0xff;
+        report_data[9] = rd & 0xff;
+    } else {
+        report_data[0] = (rd >> 8) & 0xff;
+        report_data[1] = rd & 0xff;
+    }
+    cpu_physical_memory_write(phys_addr, report_data, REPORT_LINE_GEN1_SIZE);
+}
+
+void xive2_tm_ack_os_el(XivePresenter *xptr, XiveTCTX *tctx,
+                        hwaddr offset, uint64_t value, unsigned size)
+{
+    xive2_tctx_accept_el(xptr, tctx, TM_QW1_OS, TM_QW1_OS);
+}
+
 static void xive2_tctx_set_cppr(XiveTCTX *tctx, uint8_t ring, uint8_t cppr)
 {
     uint8_t *regs = &tctx->regs[ring];
diff --git a/include/hw/ppc/xive.h b/include/hw/ppc/xive.h
index 28f0f1b79a..46d05d74fb 100644
--- a/include/hw/ppc/xive.h
+++ b/include/hw/ppc/xive.h
@@ -561,6 +561,7 @@ void xive_tctx_pipr_update(XiveTCTX *tctx, uint8_t ring, uint8_t priority,
                            uint8_t group_level);
 void xive_tctx_reset_signal(XiveTCTX *tctx, uint8_t ring);
 void xive_tctx_notify(XiveTCTX *tctx, uint8_t ring, uint8_t group_level);
+uint64_t xive_tctx_accept(XiveTCTX *tctx, uint8_t ring);
 
 /*
  * KVM XIVE device helpers
diff --git a/include/hw/ppc/xive2.h b/include/hw/ppc/xive2.h
index 760b94a962..ff02ce2549 100644
--- a/include/hw/ppc/xive2.h
+++ b/include/hw/ppc/xive2.h
@@ -142,5 +142,6 @@ void xive2_tm_set_hv_target(XivePresenter *xptr, XiveTCTX *tctx,
                             hwaddr offset, uint64_t value, unsigned size);
 void xive2_tm_pull_phys_ctx_ol(XivePresenter *xptr, XiveTCTX *tctx,
                                hwaddr offset, uint64_t value, unsigned size);
-
+void xive2_tm_ack_os_el(XivePresenter *xptr, XiveTCTX *tctx,
+                        hwaddr offset, uint64_t value, unsigned size);
 #endif /* PPC_XIVE2_H */

From 9ad30401ce9aefa319364cb8efdc6893a5bc20ad Mon Sep 17 00:00:00 2001
From: Glenn Miles <milesg@linux.ibm.com>
Date: Mon, 12 May 2025 13:10:35 +1000
Subject: [PATCH 2551/2760] ppc/xive2: Redistribute group interrupt precluded
 by CPPR update
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add support for redistributing a presented group interrupt if it
is precluded as a result of changing the CPPR value. Without this,
group interrupts can be lost.

Signed-off-by: Glenn Miles <milesg@linux.ibm.com>
Reviewed-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Michael Kowal <kowal@linux.ibm.com>
Tested-by: Gautam Menghani <gautam@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20250512031100.439842-27-npiggin@gmail.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/intc/xive2.c | 82 ++++++++++++++++++++++++++++++++++++-------------
 1 file changed, 60 insertions(+), 22 deletions(-)

diff --git a/hw/intc/xive2.c b/hw/intc/xive2.c
index e7e364c13e..624620e5b4 100644
--- a/hw/intc/xive2.c
+++ b/hw/intc/xive2.c
@@ -601,20 +601,37 @@ static uint32_t xive2_tctx_hw_cam_line(XivePresenter *xptr, XiveTCTX *tctx)
     return xive2_nvp_cam_line(blk, 1 << tid_shift | (pir & tid_mask));
 }
 
-static void xive2_redistribute(Xive2Router *xrtr, XiveTCTX *tctx,
-                               uint8_t nvp_blk, uint32_t nvp_idx, uint8_t ring)
+static void xive2_redistribute(Xive2Router *xrtr, XiveTCTX *tctx, uint8_t ring)
 {
-    uint8_t nsr = tctx->regs[ring + TM_NSR];
+    uint8_t *regs = &tctx->regs[ring];
+    uint8_t nsr = regs[TM_NSR];
+    uint8_t pipr = regs[TM_PIPR];
     uint8_t crowd = NVx_CROWD_LVL(nsr);
     uint8_t group = NVx_GROUP_LVL(nsr);
-    uint8_t nvgc_blk;
-    uint8_t nvgc_idx;
-    uint8_t end_blk;
-    uint32_t end_idx;
-    uint8_t pipr = tctx->regs[ring + TM_PIPR];
+    uint8_t nvgc_blk, end_blk, nvp_blk;
+    uint32_t nvgc_idx, end_idx, nvp_idx;
     Xive2Nvgc nvgc;
     uint8_t prio_limit;
     uint32_t cfg;
+    uint8_t alt_ring;
+    uint32_t target_ringw2;
+    uint32_t cam;
+    bool valid;
+    bool hw;
+
+    /* redistribution is only for group/crowd interrupts */
+    if (!xive_nsr_indicates_group_exception(ring, nsr)) {
+        return;
+    }
+
+    alt_ring = xive_nsr_exception_ring(ring, nsr);
+    target_ringw2 = xive_tctx_word2(&tctx->regs[alt_ring]);
+    cam = be32_to_cpu(target_ringw2);
+
+    /* extract nvp block and index from targeted ring's cam */
+    xive2_cam_decode(cam, &nvp_blk, &nvp_idx, &valid, &hw);
+
+    trace_xive_redistribute(tctx->cs->cpu_index, alt_ring, nvp_blk, nvp_idx);
 
     trace_xive_redistribute(tctx->cs->cpu_index, ring, nvp_blk, nvp_idx);
     /* convert crowd/group to blk/idx */
@@ -659,8 +676,8 @@ static void xive2_redistribute(Xive2Router *xrtr, XiveTCTX *tctx,
     xive2_router_end_notify(xrtr, end_blk, end_idx, 0, true);
 
     /* clear interrupt indication for the context */
-    tctx->regs[ring + TM_NSR] = 0;
-    tctx->regs[ring + TM_PIPR] = tctx->regs[ring + TM_CPPR];
+    regs[TM_NSR] = 0;
+    regs[TM_PIPR] = regs[TM_CPPR];
     xive_tctx_reset_signal(tctx, ring);
 }
 
@@ -695,7 +712,7 @@ static uint64_t xive2_tm_pull_ctx(XivePresenter *xptr, XiveTCTX *tctx,
     /* Active group/crowd interrupts need to be redistributed */
     nsr = tctx->regs[ring + TM_NSR];
     if (xive_nsr_indicates_group_exception(ring, nsr)) {
-        xive2_redistribute(xrtr, tctx, nvp_blk, nvp_idx, ring);
+        xive2_redistribute(xrtr, tctx, ring);
     }
 
     if (xive2_router_get_config(xrtr) & XIVE2_VP_SAVE_RESTORE && do_save) {
@@ -1059,6 +1076,7 @@ void xive2_tm_ack_os_el(XivePresenter *xptr, XiveTCTX *tctx,
     xive2_tctx_accept_el(xptr, tctx, TM_QW1_OS, TM_QW1_OS);
 }
 
+/* NOTE: CPPR only exists for TM_QW1_OS and TM_QW3_HV_PHYS */
 static void xive2_tctx_set_cppr(XiveTCTX *tctx, uint8_t ring, uint8_t cppr)
 {
     uint8_t *regs = &tctx->regs[ring];
@@ -1069,10 +1087,11 @@ static void xive2_tctx_set_cppr(XiveTCTX *tctx, uint8_t ring, uint8_t cppr)
     uint32_t nvp_blk, nvp_idx;
     Xive2Nvp nvp;
     int rc;
+    uint8_t nsr = regs[TM_NSR];
 
     trace_xive_tctx_set_cppr(tctx->cs->cpu_index, ring,
                              regs[TM_IPB], regs[TM_PIPR],
-                             cppr, regs[TM_NSR]);
+                             cppr, nsr);
 
     if (cppr > XIVE_PRIORITY_MAX) {
         cppr = 0xff;
@@ -1081,6 +1100,35 @@ static void xive2_tctx_set_cppr(XiveTCTX *tctx, uint8_t ring, uint8_t cppr)
     old_cppr = regs[TM_CPPR];
     regs[TM_CPPR] = cppr;
 
+    /* Handle increased CPPR priority (lower value) */
+    if (cppr < old_cppr) {
+        if (cppr <= regs[TM_PIPR]) {
+            /* CPPR lowered below PIPR, must un-present interrupt */
+            if (xive_nsr_indicates_exception(ring, nsr)) {
+                if (xive_nsr_indicates_group_exception(ring, nsr)) {
+                    /* redistribute precluded active grp interrupt */
+                    xive2_redistribute(xrtr, tctx, ring);
+                    return;
+                }
+            }
+
+            /* interrupt is VP directed, pending in IPB */
+            regs[TM_PIPR] = cppr;
+            xive_tctx_notify(tctx, ring, 0); /* Ensure interrupt is cleared */
+            return;
+        } else {
+            /* CPPR was lowered, but still above PIPR. No action needed. */
+            return;
+        }
+    }
+
+    /* CPPR didn't change, nothing needs to be done */
+    if (cppr == old_cppr) {
+        return;
+    }
+
+    /* CPPR priority decreased (higher value) */
+
     /*
      * Recompute the PIPR based on local pending interrupts. It will
      * be adjusted below if needed in case of pending group interrupts.
@@ -1129,16 +1177,6 @@ again:
         return;
     }
 
-    if (cppr < old_cppr) {
-        /*
-         * FIXME: check if there's a group interrupt being presented
-         * and if the new cppr prevents it. If so, then the group
-         * interrupt needs to be re-added to the backlog and
-         * re-triggered (see re-trigger END info in the NVGC
-         * structure)
-         */
-    }
-
     if (group_enabled &&
         lsmfb_min < cppr &&
         lsmfb_min < pipr_min) {

From 64c772ca16fcb539380a777ff273278c42f5dfef Mon Sep 17 00:00:00 2001
From: Glenn Miles <milesg@linux.ibm.com>
Date: Mon, 12 May 2025 13:10:36 +1000
Subject: [PATCH 2552/2760] ppc/xive2: redistribute irqs for pool and phys ctx
 pull
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When disabling (pulling) an xive interrupt context, we need
to redistribute any active group interrupts to other threads
that can handle the interrupt if possible.  This support had
already been added for the OS context but had not yet been
added to the pool or physical context.

Signed-off-by: Glenn Miles <milesg@linux.ibm.com>
Reviewed-by: Michael Kowal <kowal@linux.ibm.com>
Tested-by: Gautam Menghani <gautam@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20250512031100.439842-28-npiggin@gmail.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/intc/xive.c              | 12 ++---
 hw/intc/xive2.c             | 94 ++++++++++++++++++++++++++-----------
 include/hw/ppc/xive2.h      |  4 ++
 include/hw/ppc/xive2_regs.h |  4 +-
 4 files changed, 79 insertions(+), 35 deletions(-)

diff --git a/hw/intc/xive.c b/hw/intc/xive.c
index 8b705727ae..2f72d6ecd5 100644
--- a/hw/intc/xive.c
+++ b/hw/intc/xive.c
@@ -693,7 +693,7 @@ static const XiveTmOp xive2_tm_operations[] = {
 
     /* MMIOs above 2K : special operations with side effects */
     { XIVE_TM_OS_PAGE, TM_SPC_ACK_OS_REG,         2, NULL,
-                                                     xive_tm_ack_os_reg },
+                                                   xive_tm_ack_os_reg },
     { XIVE_TM_OS_PAGE, TM_SPC_SET_OS_PENDING,     1, xive_tm_set_os_pending,
                                                      NULL },
     { XIVE_TM_HV_PAGE, TM_SPC_PULL_OS_CTX_G2,     4, NULL,
@@ -705,17 +705,17 @@ static const XiveTmOp xive2_tm_operations[] = {
     { XIVE_TM_HV_PAGE, TM_SPC_ACK_HV_REG,         2, NULL,
                                                      xive_tm_ack_hv_reg },
     { XIVE_TM_HV_PAGE, TM_SPC_PULL_POOL_CTX_G2,   4, NULL,
-                                                     xive_tm_pull_pool_ctx },
+                                                     xive2_tm_pull_pool_ctx },
     { XIVE_TM_HV_PAGE, TM_SPC_PULL_POOL_CTX,      4, NULL,
-                                                     xive_tm_pull_pool_ctx },
+                                                     xive2_tm_pull_pool_ctx },
     { XIVE_TM_HV_PAGE, TM_SPC_PULL_POOL_CTX,      8, NULL,
-                                                     xive_tm_pull_pool_ctx },
+                                                     xive2_tm_pull_pool_ctx },
     { XIVE_TM_HV_PAGE, TM_SPC_PULL_OS_CTX_OL,     1, xive2_tm_pull_os_ctx_ol,
                                                      NULL },
     { XIVE_TM_HV_PAGE, TM_SPC_PULL_PHYS_CTX_G2,   4, NULL,
-                                                     xive_tm_pull_phys_ctx },
+                                                     xive2_tm_pull_phys_ctx },
     { XIVE_TM_HV_PAGE, TM_SPC_PULL_PHYS_CTX,      1, NULL,
-                                                     xive_tm_pull_phys_ctx },
+                                                     xive2_tm_pull_phys_ctx },
     { XIVE_TM_HV_PAGE, TM_SPC_PULL_PHYS_CTX_OL,   1, xive2_tm_pull_phys_ctx_ol,
                                                      NULL },
     { XIVE_TM_OS_PAGE, TM_SPC_ACK_OS_EL,          1, xive2_tm_ack_os_el,
diff --git a/hw/intc/xive2.c b/hw/intc/xive2.c
index 624620e5b4..2791985cf2 100644
--- a/hw/intc/xive2.c
+++ b/hw/intc/xive2.c
@@ -23,6 +23,9 @@ static void xive2_router_end_notify(Xive2Router *xrtr, uint8_t end_blk,
                                     uint32_t end_idx, uint32_t end_data,
                                     bool redistribute);
 
+static int xive2_tctx_get_nvp_indexes(XiveTCTX *tctx, uint8_t ring,
+                                      uint8_t *nvp_blk, uint32_t *nvp_idx);
+
 uint32_t xive2_router_get_config(Xive2Router *xrtr)
 {
     Xive2RouterClass *xrc = XIVE2_ROUTER_GET_CLASS(xrtr);
@@ -604,8 +607,10 @@ static uint32_t xive2_tctx_hw_cam_line(XivePresenter *xptr, XiveTCTX *tctx)
 static void xive2_redistribute(Xive2Router *xrtr, XiveTCTX *tctx, uint8_t ring)
 {
     uint8_t *regs = &tctx->regs[ring];
-    uint8_t nsr = regs[TM_NSR];
-    uint8_t pipr = regs[TM_PIPR];
+    uint8_t *alt_regs = (ring == TM_QW2_HV_POOL) ? &tctx->regs[TM_QW3_HV_PHYS] :
+                                                   regs;
+    uint8_t nsr = alt_regs[TM_NSR];
+    uint8_t pipr = alt_regs[TM_PIPR];
     uint8_t crowd = NVx_CROWD_LVL(nsr);
     uint8_t group = NVx_GROUP_LVL(nsr);
     uint8_t nvgc_blk, end_blk, nvp_blk;
@@ -614,10 +619,6 @@ static void xive2_redistribute(Xive2Router *xrtr, XiveTCTX *tctx, uint8_t ring)
     uint8_t prio_limit;
     uint32_t cfg;
     uint8_t alt_ring;
-    uint32_t target_ringw2;
-    uint32_t cam;
-    bool valid;
-    bool hw;
 
     /* redistribution is only for group/crowd interrupts */
     if (!xive_nsr_indicates_group_exception(ring, nsr)) {
@@ -625,11 +626,9 @@ static void xive2_redistribute(Xive2Router *xrtr, XiveTCTX *tctx, uint8_t ring)
     }
 
     alt_ring = xive_nsr_exception_ring(ring, nsr);
-    target_ringw2 = xive_tctx_word2(&tctx->regs[alt_ring]);
-    cam = be32_to_cpu(target_ringw2);
 
-    /* extract nvp block and index from targeted ring's cam */
-    xive2_cam_decode(cam, &nvp_blk, &nvp_idx, &valid, &hw);
+    /* Don't check return code since ring is expected to be invalidated */
+    xive2_tctx_get_nvp_indexes(tctx, alt_ring, &nvp_blk, &nvp_idx);
 
     trace_xive_redistribute(tctx->cs->cpu_index, alt_ring, nvp_blk, nvp_idx);
 
@@ -676,11 +675,23 @@ static void xive2_redistribute(Xive2Router *xrtr, XiveTCTX *tctx, uint8_t ring)
     xive2_router_end_notify(xrtr, end_blk, end_idx, 0, true);
 
     /* clear interrupt indication for the context */
-    regs[TM_NSR] = 0;
-    regs[TM_PIPR] = regs[TM_CPPR];
+    alt_regs[TM_NSR] = 0;
+    alt_regs[TM_PIPR] = alt_regs[TM_CPPR];
     xive_tctx_reset_signal(tctx, ring);
 }
 
+static uint8_t xive2_hv_irq_ring(uint8_t nsr)
+{
+    switch (nsr >> 6) {
+    case TM_QW3_NSR_HE_POOL:
+        return TM_QW2_HV_POOL;
+    case TM_QW3_NSR_HE_PHYS:
+        return TM_QW3_HV_PHYS;
+    default:
+        return -1;
+    }
+}
+
 static uint64_t xive2_tm_pull_ctx(XivePresenter *xptr, XiveTCTX *tctx,
                                   hwaddr offset, unsigned size, uint8_t ring)
 {
@@ -696,7 +707,7 @@ static uint64_t xive2_tm_pull_ctx(XivePresenter *xptr, XiveTCTX *tctx,
 
     xive2_cam_decode(cam, &nvp_blk, &nvp_idx, &valid, &do_save);
 
-    if (!valid) {
+    if (xive2_tctx_get_nvp_indexes(tctx, ring, &nvp_blk, &nvp_idx)) {
         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: pulling invalid NVP %x/%x !?\n",
                       nvp_blk, nvp_idx);
     }
@@ -706,13 +717,25 @@ static uint64_t xive2_tm_pull_ctx(XivePresenter *xptr, XiveTCTX *tctx,
          cur_ring += XIVE_TM_RING_SIZE) {
         uint32_t ringw2 = xive_tctx_word2(&tctx->regs[cur_ring]);
         uint32_t ringw2_new = xive_set_field32(TM2_QW1W2_VO, ringw2, 0);
+        bool is_valid = !!(xive_get_field32(TM2_QW1W2_VO, ringw2));
+        uint8_t alt_ring;
         memcpy(&tctx->regs[cur_ring + TM_WORD2], &ringw2_new, 4);
-    }
 
-    /* Active group/crowd interrupts need to be redistributed */
-    nsr = tctx->regs[ring + TM_NSR];
-    if (xive_nsr_indicates_group_exception(ring, nsr)) {
-        xive2_redistribute(xrtr, tctx, ring);
+        /* Skip the rest for USER or invalid contexts */
+        if ((cur_ring == TM_QW0_USER) || !is_valid) {
+            continue;
+        }
+
+        /* Active group/crowd interrupts need to be redistributed */
+        alt_ring = (cur_ring == TM_QW2_HV_POOL) ? TM_QW3_HV_PHYS : cur_ring;
+        nsr = tctx->regs[alt_ring + TM_NSR];
+        if (xive_nsr_indicates_group_exception(alt_ring, nsr)) {
+            /* For HV rings, only redistribute if cur_ring matches NSR */
+            if ((cur_ring == TM_QW1_OS) ||
+                (cur_ring == xive2_hv_irq_ring(nsr))) {
+                xive2_redistribute(xrtr, tctx, cur_ring);
+            }
+        }
     }
 
     if (xive2_router_get_config(xrtr) & XIVE2_VP_SAVE_RESTORE && do_save) {
@@ -736,6 +759,18 @@ uint64_t xive2_tm_pull_os_ctx(XivePresenter *xptr, XiveTCTX *tctx,
     return xive2_tm_pull_ctx(xptr, tctx, offset, size, TM_QW1_OS);
 }
 
+uint64_t xive2_tm_pull_pool_ctx(XivePresenter *xptr, XiveTCTX *tctx,
+                                hwaddr offset, unsigned size)
+{
+    return xive2_tm_pull_ctx(xptr, tctx, offset, size, TM_QW2_HV_POOL);
+}
+
+uint64_t xive2_tm_pull_phys_ctx(XivePresenter *xptr, XiveTCTX *tctx,
+                                hwaddr offset, unsigned size)
+{
+    return xive2_tm_pull_ctx(xptr, tctx, offset, size, TM_QW3_HV_PHYS);
+}
+
 #define REPORT_LINE_GEN1_SIZE       16
 
 static void xive2_tm_report_line_gen1(XiveTCTX *tctx, uint8_t *data,
@@ -993,37 +1028,40 @@ void xive2_tm_push_os_ctx(XivePresenter *xptr, XiveTCTX *tctx,
     }
 }
 
+/* returns -1 if ring is invalid, but still populates block and index */
 static int xive2_tctx_get_nvp_indexes(XiveTCTX *tctx, uint8_t ring,
-                                      uint32_t *nvp_blk, uint32_t *nvp_idx)
+                                      uint8_t *nvp_blk, uint32_t *nvp_idx)
 {
-    uint32_t w2, cam;
+    uint32_t w2;
+    uint32_t cam = 0;
+    int rc = 0;
 
     w2 = xive_tctx_word2(&tctx->regs[ring]);
     switch (ring) {
     case TM_QW1_OS:
         if (!(be32_to_cpu(w2) & TM2_QW1W2_VO)) {
-            return -1;
+            rc = -1;
         }
         cam = xive_get_field32(TM2_QW1W2_OS_CAM, w2);
         break;
     case TM_QW2_HV_POOL:
         if (!(be32_to_cpu(w2) & TM2_QW2W2_VP)) {
-            return -1;
+            rc = -1;
         }
         cam = xive_get_field32(TM2_QW2W2_POOL_CAM, w2);
         break;
     case TM_QW3_HV_PHYS:
         if (!(be32_to_cpu(w2) & TM2_QW3W2_VT)) {
-            return -1;
+            rc = -1;
         }
         cam = xive2_tctx_hw_cam_line(tctx->xptr, tctx);
         break;
     default:
-        return -1;
+        rc = -1;
     }
     *nvp_blk = xive2_nvp_blk(cam);
     *nvp_idx = xive2_nvp_idx(cam);
-    return 0;
+    return rc;
 }
 
 static void xive2_tctx_accept_el(XivePresenter *xptr, XiveTCTX *tctx,
@@ -1031,7 +1069,8 @@ static void xive2_tctx_accept_el(XivePresenter *xptr, XiveTCTX *tctx,
 {
     uint64_t rd;
     Xive2Router *xrtr = XIVE2_ROUTER(xptr);
-    uint32_t nvp_blk, nvp_idx, xive2_cfg;
+    uint32_t nvp_idx, xive2_cfg;
+    uint8_t nvp_blk;
     Xive2Nvp nvp;
     uint64_t phys_addr;
     uint8_t OGen = 0;
@@ -1084,7 +1123,8 @@ static void xive2_tctx_set_cppr(XiveTCTX *tctx, uint8_t ring, uint8_t cppr)
     uint8_t old_cppr, backlog_prio, first_group, group_level;
     uint8_t pipr_min, lsmfb_min, ring_min;
     bool group_enabled;
-    uint32_t nvp_blk, nvp_idx;
+    uint8_t nvp_blk;
+    uint32_t nvp_idx;
     Xive2Nvp nvp;
     int rc;
     uint8_t nsr = regs[TM_NSR];
diff --git a/include/hw/ppc/xive2.h b/include/hw/ppc/xive2.h
index ff02ce2549..a91b99057c 100644
--- a/include/hw/ppc/xive2.h
+++ b/include/hw/ppc/xive2.h
@@ -140,6 +140,10 @@ bool xive2_tm_irq_precluded(XiveTCTX *tctx, int ring, uint8_t priority);
 void xive2_tm_set_lsmfb(XiveTCTX *tctx, int ring, uint8_t priority);
 void xive2_tm_set_hv_target(XivePresenter *xptr, XiveTCTX *tctx,
                             hwaddr offset, uint64_t value, unsigned size);
+uint64_t xive2_tm_pull_pool_ctx(XivePresenter *xptr, XiveTCTX *tctx,
+                                hwaddr offset, unsigned size);
+uint64_t xive2_tm_pull_phys_ctx(XivePresenter *xptr, XiveTCTX *tctx,
+                                hwaddr offset, unsigned size);
 void xive2_tm_pull_phys_ctx_ol(XivePresenter *xptr, XiveTCTX *tctx,
                                hwaddr offset, uint64_t value, unsigned size);
 void xive2_tm_ack_os_el(XivePresenter *xptr, XiveTCTX *tctx,
diff --git a/include/hw/ppc/xive2_regs.h b/include/hw/ppc/xive2_regs.h
index e222038143..f82054661b 100644
--- a/include/hw/ppc/xive2_regs.h
+++ b/include/hw/ppc/xive2_regs.h
@@ -209,9 +209,9 @@ static inline uint32_t xive2_nvp_idx(uint32_t cam_line)
     return cam_line & ((1 << XIVE2_NVP_SHIFT) - 1);
 }
 
-static inline uint32_t xive2_nvp_blk(uint32_t cam_line)
+static inline uint8_t xive2_nvp_blk(uint32_t cam_line)
 {
-    return (cam_line >> XIVE2_NVP_SHIFT) & 0xf;
+    return (uint8_t)((cam_line >> XIVE2_NVP_SHIFT) & 0xf);
 }
 
 void xive2_nvp_pic_print_info(Xive2Nvp *nvp, uint32_t nvp_idx, GString *buf);

From 1319cb8997b9d0fdaae04a79398a2ed06d4cb5e1 Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Mon, 12 May 2025 13:10:37 +1000
Subject: [PATCH 2553/2760] ppc/xive: Change presenter .match_nvt to match not
 present
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Have the match_nvt method only perform a TCTX match but don't present
the interrupt, the caller presents. This has no functional change, but
allows for more complicated presentation logic after matching.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Glenn Miles <milesg@linux.ibm.com>
Reviewed-by: Michael Kowal <kowal@linux.ibm.com>
Tested-by: Gautam Menghani <gautam@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20250512031100.439842-29-npiggin@gmail.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/intc/pnv_xive.c    | 16 +++++++-------
 hw/intc/pnv_xive2.c   | 16 +++++++-------
 hw/intc/spapr_xive.c  | 18 +++++++--------
 hw/intc/xive.c        | 51 +++++++++++++++----------------------------
 hw/intc/xive2.c       | 29 ++++++++++++------------
 hw/ppc/pnv.c          | 48 ++++++++++++++--------------------------
 hw/ppc/spapr.c        | 21 +++++++-----------
 include/hw/ppc/xive.h | 27 +++++++++++++----------
 8 files changed, 96 insertions(+), 130 deletions(-)

diff --git a/hw/intc/pnv_xive.c b/hw/intc/pnv_xive.c
index 935c0e4742..c2ca40b8be 100644
--- a/hw/intc/pnv_xive.c
+++ b/hw/intc/pnv_xive.c
@@ -470,14 +470,13 @@ static bool pnv_xive_is_cpu_enabled(PnvXive *xive, PowerPCCPU *cpu)
     return xive->regs[reg >> 3] & PPC_BIT(bit);
 }
 
-static int pnv_xive_match_nvt(XivePresenter *xptr, uint8_t format,
-                              uint8_t nvt_blk, uint32_t nvt_idx,
-                              bool crowd, bool cam_ignore, uint8_t priority,
-                              uint32_t logic_serv, XiveTCTXMatch *match)
+static bool pnv_xive_match_nvt(XivePresenter *xptr, uint8_t format,
+                               uint8_t nvt_blk, uint32_t nvt_idx,
+                               bool crowd, bool cam_ignore, uint8_t priority,
+                               uint32_t logic_serv, XiveTCTXMatch *match)
 {
     PnvXive *xive = PNV_XIVE(xptr);
     PnvChip *chip = xive->chip;
-    int count = 0;
     int i, j;
 
     for (i = 0; i < chip->nr_cores; i++) {
@@ -510,17 +509,18 @@ static int pnv_xive_match_nvt(XivePresenter *xptr, uint8_t format,
                     qemu_log_mask(LOG_GUEST_ERROR, "XIVE: already found a "
                                   "thread context NVT %x/%x\n",
                                   nvt_blk, nvt_idx);
-                    return -1;
+                    match->count++;
+                    continue;
                 }
 
                 match->ring = ring;
                 match->tctx = tctx;
-                count++;
+                match->count++;
             }
         }
     }
 
-    return count;
+    return !!match->count;
 }
 
 static uint32_t pnv_xive_presenter_get_config(XivePresenter *xptr)
diff --git a/hw/intc/pnv_xive2.c b/hw/intc/pnv_xive2.c
index 7b4a33228e..e019cad5c1 100644
--- a/hw/intc/pnv_xive2.c
+++ b/hw/intc/pnv_xive2.c
@@ -640,14 +640,13 @@ static bool pnv_xive2_is_cpu_enabled(PnvXive2 *xive, PowerPCCPU *cpu)
     return xive->tctxt_regs[reg >> 3] & PPC_BIT(bit);
 }
 
-static int pnv_xive2_match_nvt(XivePresenter *xptr, uint8_t format,
-                               uint8_t nvt_blk, uint32_t nvt_idx,
-                               bool crowd, bool cam_ignore, uint8_t priority,
-                               uint32_t logic_serv, XiveTCTXMatch *match)
+static bool pnv_xive2_match_nvt(XivePresenter *xptr, uint8_t format,
+                                uint8_t nvt_blk, uint32_t nvt_idx,
+                                bool crowd, bool cam_ignore, uint8_t priority,
+                                uint32_t logic_serv, XiveTCTXMatch *match)
 {
     PnvXive2 *xive = PNV_XIVE2(xptr);
     PnvChip *chip = xive->chip;
-    int count = 0;
     int i, j;
     bool gen1_tima_os =
         xive->cq_regs[CQ_XIVE_CFG >> 3] & CQ_XIVE_CFG_GEN1_TIMA_OS;
@@ -692,7 +691,8 @@ static int pnv_xive2_match_nvt(XivePresenter *xptr, uint8_t format,
                                   "thread context NVT %x/%x\n",
                                   nvt_blk, nvt_idx);
                     /* Should set a FIR if we ever model it */
-                    return -1;
+                    match->count++;
+                    continue;
                 }
                 /*
                  * For a group notification, we need to know if the
@@ -717,13 +717,13 @@ static int pnv_xive2_match_nvt(XivePresenter *xptr, uint8_t format,
                             }
                         }
                     }
-                    count++;
+                    match->count++;
                 }
             }
         }
     }
 
-    return count;
+    return !!match->count;
 }
 
 static uint32_t pnv_xive2_presenter_get_config(XivePresenter *xptr)
diff --git a/hw/intc/spapr_xive.c b/hw/intc/spapr_xive.c
index 440edb97d8..e393f5dcdc 100644
--- a/hw/intc/spapr_xive.c
+++ b/hw/intc/spapr_xive.c
@@ -428,14 +428,13 @@ static int spapr_xive_write_nvt(XiveRouter *xrtr, uint8_t nvt_blk,
     g_assert_not_reached();
 }
 
-static int spapr_xive_match_nvt(XivePresenter *xptr, uint8_t format,
-                                uint8_t nvt_blk, uint32_t nvt_idx,
-                                bool crowd, bool cam_ignore,
-                                uint8_t priority,
-                                uint32_t logic_serv, XiveTCTXMatch *match)
+static bool spapr_xive_match_nvt(XivePresenter *xptr, uint8_t format,
+                                 uint8_t nvt_blk, uint32_t nvt_idx,
+                                 bool crowd, bool cam_ignore,
+                                 uint8_t priority,
+                                 uint32_t logic_serv, XiveTCTXMatch *match)
 {
     CPUState *cs;
-    int count = 0;
 
     CPU_FOREACH(cs) {
         PowerPCCPU *cpu = POWERPC_CPU(cs);
@@ -463,16 +462,17 @@ static int spapr_xive_match_nvt(XivePresenter *xptr, uint8_t format,
             if (match->tctx) {
                 qemu_log_mask(LOG_GUEST_ERROR, "XIVE: already found a thread "
                               "context NVT %x/%x\n", nvt_blk, nvt_idx);
-                return -1;
+                match->count++;
+                continue;
             }
 
             match->ring = ring;
             match->tctx = tctx;
-            count++;
+            match->count++;
         }
     }
 
-    return count;
+    return !!match->count;
 }
 
 static uint32_t spapr_xive_presenter_get_config(XivePresenter *xptr)
diff --git a/hw/intc/xive.c b/hw/intc/xive.c
index 2f72d6ecd5..c92e819053 100644
--- a/hw/intc/xive.c
+++ b/hw/intc/xive.c
@@ -1762,8 +1762,8 @@ uint32_t xive_get_vpgroup_size(uint32_t nvp_index)
     return 1U << (first_zero + 1);
 }
 
-static uint8_t xive_get_group_level(bool crowd, bool ignore,
-                                    uint32_t nvp_blk, uint32_t nvp_index)
+uint8_t xive_get_group_level(bool crowd, bool ignore,
+                             uint32_t nvp_blk, uint32_t nvp_index)
 {
     int first_zero;
     uint8_t level;
@@ -1881,15 +1881,14 @@ int xive_presenter_tctx_match(XivePresenter *xptr, XiveTCTX *tctx,
  * This is our simple Xive Presenter Engine model. It is merged in the
  * Router as it does not require an extra object.
  */
-bool xive_presenter_notify(XiveFabric *xfb, uint8_t format,
+bool xive_presenter_match(XiveFabric *xfb, uint8_t format,
                            uint8_t nvt_blk, uint32_t nvt_idx,
                            bool crowd, bool cam_ignore, uint8_t priority,
-                           uint32_t logic_serv, bool *precluded)
+                           uint32_t logic_serv, XiveTCTXMatch *match)
 {
     XiveFabricClass *xfc = XIVE_FABRIC_GET_CLASS(xfb);
-    XiveTCTXMatch match = { .tctx = NULL, .ring = 0, .precluded = false };
-    uint8_t group_level;
-    int count;
+
+    memset(match, 0, sizeof(*match));
 
     /*
      * Ask the machine to scan the interrupt controllers for a match.
@@ -1914,22 +1913,8 @@ bool xive_presenter_notify(XiveFabric *xfb, uint8_t format,
      * a new command to the presenters (the equivalent of the "assign"
      * power bus command in the documented full notify sequence.
      */
-    count = xfc->match_nvt(xfb, format, nvt_blk, nvt_idx, crowd, cam_ignore,
-                           priority, logic_serv, &match);
-    if (count < 0) {
-        return false;
-    }
-
-    /* handle CPU exception delivery */
-    if (count) {
-        group_level = xive_get_group_level(crowd, cam_ignore, nvt_blk, nvt_idx);
-        trace_xive_presenter_notify(nvt_blk, nvt_idx, match.ring, group_level);
-        xive_tctx_pipr_update(match.tctx, match.ring, priority, group_level);
-    } else {
-        *precluded = match.precluded;
-    }
-
-    return !!count;
+    return xfc->match_nvt(xfb, format, nvt_blk, nvt_idx, crowd, cam_ignore,
+                          priority, logic_serv, match);
 }
 
 /*
@@ -1966,7 +1951,7 @@ void xive_router_end_notify(XiveRouter *xrtr, XiveEAS *eas)
     uint8_t nvt_blk;
     uint32_t nvt_idx;
     XiveNVT nvt;
-    bool found, precluded;
+    XiveTCTXMatch match;
 
     uint8_t end_blk = xive_get_field64(EAS_END_BLOCK, eas->w);
     uint32_t end_idx = xive_get_field64(EAS_END_INDEX, eas->w);
@@ -2046,16 +2031,16 @@ void xive_router_end_notify(XiveRouter *xrtr, XiveEAS *eas)
         return;
     }
 
-    found = xive_presenter_notify(xrtr->xfb, format, nvt_blk, nvt_idx,
-                          false /* crowd */,
-                          xive_get_field32(END_W7_F0_IGNORE, end.w7),
-                          priority,
-                          xive_get_field32(END_W7_F1_LOG_SERVER_ID, end.w7),
-                          &precluded);
-    /* we don't support VP-group notification on P9, so precluded is not used */
     /* TODO: Auto EOI. */
-
-    if (found) {
+    /* we don't support VP-group notification on P9, so precluded is not used */
+    if (xive_presenter_match(xrtr->xfb, format, nvt_blk, nvt_idx,
+                             false /* crowd */,
+                             xive_get_field32(END_W7_F0_IGNORE, end.w7),
+                             priority,
+                             xive_get_field32(END_W7_F1_LOG_SERVER_ID, end.w7),
+                             &match)) {
+        trace_xive_presenter_notify(nvt_blk, nvt_idx, match.ring, 0);
+        xive_tctx_pipr_update(match.tctx, match.ring, priority, 0);
         return;
     }
 
diff --git a/hw/intc/xive2.c b/hw/intc/xive2.c
index 2791985cf2..602b23d06d 100644
--- a/hw/intc/xive2.c
+++ b/hw/intc/xive2.c
@@ -1559,7 +1559,8 @@ static void xive2_router_end_notify(Xive2Router *xrtr, uint8_t end_blk,
     Xive2End end;
     uint8_t priority;
     uint8_t format;
-    bool found, precluded;
+    XiveTCTXMatch match;
+    bool crowd, cam_ignore;
     uint8_t nvx_blk;
     uint32_t nvx_idx;
 
@@ -1629,16 +1630,19 @@ static void xive2_router_end_notify(Xive2Router *xrtr, uint8_t end_blk,
      */
     nvx_blk = xive_get_field32(END2_W6_VP_BLOCK, end.w6);
     nvx_idx = xive_get_field32(END2_W6_VP_OFFSET, end.w6);
-
-    found = xive_presenter_notify(xrtr->xfb, format, nvx_blk, nvx_idx,
-                          xive2_end_is_crowd(&end), xive2_end_is_ignore(&end),
-                          priority,
-                          xive_get_field32(END2_W7_F1_LOG_SERVER_ID, end.w7),
-                          &precluded);
+    crowd = xive2_end_is_crowd(&end);
+    cam_ignore = xive2_end_is_ignore(&end);
 
     /* TODO: Auto EOI. */
+    if (xive_presenter_match(xrtr->xfb, format, nvx_blk, nvx_idx,
+                             crowd, cam_ignore, priority,
+                             xive_get_field32(END2_W7_F1_LOG_SERVER_ID, end.w7),
+                             &match)) {
+        uint8_t group_level;
 
-    if (found) {
+        group_level = xive_get_group_level(crowd, cam_ignore, nvx_blk, nvx_idx);
+        trace_xive_presenter_notify(nvx_blk, nvx_idx, match.ring, group_level);
+        xive_tctx_pipr_update(match.tctx, match.ring, priority, group_level);
         return;
     }
 
@@ -1656,7 +1660,7 @@ static void xive2_router_end_notify(Xive2Router *xrtr, uint8_t end_blk,
             return;
         }
 
-        if (!xive2_end_is_ignore(&end)) {
+        if (!cam_ignore) {
             uint8_t ipb;
             Xive2Nvp nvp;
 
@@ -1685,9 +1689,6 @@ static void xive2_router_end_notify(Xive2Router *xrtr, uint8_t end_blk,
         } else {
             Xive2Nvgc nvgc;
             uint32_t backlog;
-            bool crowd;
-
-            crowd = xive2_end_is_crowd(&end);
 
             /*
              * For groups and crowds, the per-priority backlog
@@ -1719,9 +1720,7 @@ static void xive2_router_end_notify(Xive2Router *xrtr, uint8_t end_blk,
             if (backlog == 1) {
                 XiveFabricClass *xfc = XIVE_FABRIC_GET_CLASS(xrtr->xfb);
                 xfc->broadcast(xrtr->xfb, nvx_blk, nvx_idx,
-                               xive2_end_is_crowd(&end),
-                               xive2_end_is_ignore(&end),
-                               priority);
+                               crowd, cam_ignore, priority);
 
                 if (!xive2_end_is_precluded_escalation(&end)) {
                     /*
diff --git a/hw/ppc/pnv.c b/hw/ppc/pnv.c
index 4a49e9d1a8..d84c9067ed 100644
--- a/hw/ppc/pnv.c
+++ b/hw/ppc/pnv.c
@@ -2608,62 +2608,46 @@ static void pnv_pic_print_info(InterruptStatsProvider *obj, GString *buf)
     }
 }
 
-static int pnv_match_nvt(XiveFabric *xfb, uint8_t format,
-                         uint8_t nvt_blk, uint32_t nvt_idx,
-                         bool crowd, bool cam_ignore, uint8_t priority,
-                         uint32_t logic_serv,
-                         XiveTCTXMatch *match)
+static bool pnv_match_nvt(XiveFabric *xfb, uint8_t format,
+                          uint8_t nvt_blk, uint32_t nvt_idx,
+                          bool crowd, bool cam_ignore, uint8_t priority,
+                          uint32_t logic_serv,
+                          XiveTCTXMatch *match)
 {
     PnvMachineState *pnv = PNV_MACHINE(xfb);
-    int total_count = 0;
     int i;
 
     for (i = 0; i < pnv->num_chips; i++) {
         Pnv9Chip *chip9 = PNV9_CHIP(pnv->chips[i]);
         XivePresenter *xptr = XIVE_PRESENTER(&chip9->xive);
         XivePresenterClass *xpc = XIVE_PRESENTER_GET_CLASS(xptr);
-        int count;
 
-        count = xpc->match_nvt(xptr, format, nvt_blk, nvt_idx, crowd,
-                               cam_ignore, priority, logic_serv, match);
-
-        if (count < 0) {
-            return count;
-        }
-
-        total_count += count;
+        xpc->match_nvt(xptr, format, nvt_blk, nvt_idx, crowd,
+                       cam_ignore, priority, logic_serv, match);
     }
 
-    return total_count;
+    return !!match->count;
 }
 
-static int pnv10_xive_match_nvt(XiveFabric *xfb, uint8_t format,
-                                uint8_t nvt_blk, uint32_t nvt_idx,
-                                bool crowd, bool cam_ignore, uint8_t priority,
-                                uint32_t logic_serv,
-                                XiveTCTXMatch *match)
+static bool pnv10_xive_match_nvt(XiveFabric *xfb, uint8_t format,
+                                 uint8_t nvt_blk, uint32_t nvt_idx,
+                                 bool crowd, bool cam_ignore, uint8_t priority,
+                                 uint32_t logic_serv,
+                                 XiveTCTXMatch *match)
 {
     PnvMachineState *pnv = PNV_MACHINE(xfb);
-    int total_count = 0;
     int i;
 
     for (i = 0; i < pnv->num_chips; i++) {
         Pnv10Chip *chip10 = PNV10_CHIP(pnv->chips[i]);
         XivePresenter *xptr = XIVE_PRESENTER(&chip10->xive);
         XivePresenterClass *xpc = XIVE_PRESENTER_GET_CLASS(xptr);
-        int count;
 
-        count = xpc->match_nvt(xptr, format, nvt_blk, nvt_idx, crowd,
-                               cam_ignore, priority, logic_serv, match);
-
-        if (count < 0) {
-            return count;
-        }
-
-        total_count += count;
+        xpc->match_nvt(xptr, format, nvt_blk, nvt_idx, crowd,
+                       cam_ignore, priority, logic_serv, match);
     }
 
-    return total_count;
+    return !!match->count;
 }
 
 static int pnv10_xive_broadcast(XiveFabric *xfb,
diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index 40f53ad7b3..1855a3cd8d 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -4468,21 +4468,14 @@ static void spapr_pic_print_info(InterruptStatsProvider *obj, GString *buf)
 /*
  * This is a XIVE only operation
  */
-static int spapr_match_nvt(XiveFabric *xfb, uint8_t format,
-                           uint8_t nvt_blk, uint32_t nvt_idx,
-                           bool crowd, bool cam_ignore, uint8_t priority,
-                           uint32_t logic_serv, XiveTCTXMatch *match)
+static bool spapr_match_nvt(XiveFabric *xfb, uint8_t format,
+                            uint8_t nvt_blk, uint32_t nvt_idx,
+                            bool crowd, bool cam_ignore, uint8_t priority,
+                            uint32_t logic_serv, XiveTCTXMatch *match)
 {
     SpaprMachineState *spapr = SPAPR_MACHINE(xfb);
     XivePresenter *xptr = XIVE_PRESENTER(spapr->active_intc);
     XivePresenterClass *xpc = XIVE_PRESENTER_GET_CLASS(xptr);
-    int count;
-
-    count = xpc->match_nvt(xptr, format, nvt_blk, nvt_idx, crowd, cam_ignore,
-                           priority, logic_serv, match);
-    if (count < 0) {
-        return count;
-    }
 
     /*
      * When we implement the save and restore of the thread interrupt
@@ -4493,12 +4486,14 @@ static int spapr_match_nvt(XiveFabric *xfb, uint8_t format,
      * Until this is done, the sPAPR machine should find at least one
      * matching context always.
      */
-    if (count == 0) {
+    if (!xpc->match_nvt(xptr, format, nvt_blk, nvt_idx, crowd, cam_ignore,
+                           priority, logic_serv, match)) {
         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: NVT %x/%x is not dispatched\n",
                       nvt_blk, nvt_idx);
+        return false;
     }
 
-    return count;
+    return true;
 }
 
 int spapr_get_vcpu_id(PowerPCCPU *cpu)
diff --git a/include/hw/ppc/xive.h b/include/hw/ppc/xive.h
index 46d05d74fb..8152a9df3d 100644
--- a/include/hw/ppc/xive.h
+++ b/include/hw/ppc/xive.h
@@ -425,6 +425,7 @@ void xive_router_end_notify(XiveRouter *xrtr, XiveEAS *eas);
 
 typedef struct XiveTCTXMatch {
     XiveTCTX *tctx;
+    int count;
     uint8_t ring;
     bool precluded;
 } XiveTCTXMatch;
@@ -440,10 +441,10 @@ DECLARE_CLASS_CHECKERS(XivePresenterClass, XIVE_PRESENTER,
 
 struct XivePresenterClass {
     InterfaceClass parent;
-    int (*match_nvt)(XivePresenter *xptr, uint8_t format,
-                     uint8_t nvt_blk, uint32_t nvt_idx,
-                     bool crowd, bool cam_ignore, uint8_t priority,
-                     uint32_t logic_serv, XiveTCTXMatch *match);
+    bool (*match_nvt)(XivePresenter *xptr, uint8_t format,
+                      uint8_t nvt_blk, uint32_t nvt_idx,
+                      bool crowd, bool cam_ignore, uint8_t priority,
+                      uint32_t logic_serv, XiveTCTXMatch *match);
     bool (*in_kernel)(const XivePresenter *xptr);
     uint32_t (*get_config)(XivePresenter *xptr);
     int (*broadcast)(XivePresenter *xptr,
@@ -455,12 +456,14 @@ int xive_presenter_tctx_match(XivePresenter *xptr, XiveTCTX *tctx,
                               uint8_t format,
                               uint8_t nvt_blk, uint32_t nvt_idx,
                               bool cam_ignore, uint32_t logic_serv);
-bool xive_presenter_notify(XiveFabric *xfb, uint8_t format,
-                           uint8_t nvt_blk, uint32_t nvt_idx,
-                           bool crowd, bool cam_ignore, uint8_t priority,
-                           uint32_t logic_serv, bool *precluded);
+bool xive_presenter_match(XiveFabric *xfb, uint8_t format,
+                          uint8_t nvt_blk, uint32_t nvt_idx,
+                          bool crowd, bool cam_ignore, uint8_t priority,
+                          uint32_t logic_serv, XiveTCTXMatch *match);
 
 uint32_t xive_get_vpgroup_size(uint32_t nvp_index);
+uint8_t xive_get_group_level(bool crowd, bool ignore,
+                             uint32_t nvp_blk, uint32_t nvp_index);
 
 /*
  * XIVE Fabric (Interface between Interrupt Controller and Machine)
@@ -475,10 +478,10 @@ DECLARE_CLASS_CHECKERS(XiveFabricClass, XIVE_FABRIC,
 
 struct XiveFabricClass {
     InterfaceClass parent;
-    int (*match_nvt)(XiveFabric *xfb, uint8_t format,
-                     uint8_t nvt_blk, uint32_t nvt_idx,
-                     bool crowd, bool cam_ignore, uint8_t priority,
-                     uint32_t logic_serv, XiveTCTXMatch *match);
+    bool (*match_nvt)(XiveFabric *xfb, uint8_t format,
+                      uint8_t nvt_blk, uint32_t nvt_idx,
+                      bool crowd, bool cam_ignore, uint8_t priority,
+                      uint32_t logic_serv, XiveTCTXMatch *match);
     int (*broadcast)(XiveFabric *xfb, uint8_t nvt_blk, uint32_t nvt_idx,
                      bool crowd, bool cam_ignore, uint8_t priority);
 };

From cc15d50b6e8a4090d667755259ea36144b79d22f Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Mon, 12 May 2025 13:10:38 +1000
Subject: [PATCH 2554/2760] ppc/xive2: Redistribute group interrupt preempted
 by higher priority interrupt
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A group interrupt that gets preempted by a higher priority interrupt
delivery must be redistributed otherwise it would get lost.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Glenn Miles <milesg@linux.ibm.com>
Reviewed-by: Michael Kowal <kowal@linux.ibm.com>
Tested-by: Gautam Menghani <gautam@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20250512031100.439842-30-npiggin@gmail.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/intc/xive2.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/hw/intc/xive2.c b/hw/intc/xive2.c
index 602b23d06d..f51fd38a13 100644
--- a/hw/intc/xive2.c
+++ b/hw/intc/xive2.c
@@ -1638,11 +1638,21 @@ static void xive2_router_end_notify(Xive2Router *xrtr, uint8_t end_blk,
                              crowd, cam_ignore, priority,
                              xive_get_field32(END2_W7_F1_LOG_SERVER_ID, end.w7),
                              &match)) {
+        XiveTCTX *tctx = match.tctx;
+        uint8_t ring = match.ring;
+        uint8_t alt_ring = (ring == TM_QW2_HV_POOL) ? TM_QW3_HV_PHYS : ring;
+        uint8_t *aregs = &tctx->regs[alt_ring];
+        uint8_t nsr = aregs[TM_NSR];
         uint8_t group_level;
 
+        if (priority < aregs[TM_PIPR] &&
+            xive_nsr_indicates_group_exception(alt_ring, nsr)) {
+            xive2_redistribute(xrtr, tctx, alt_ring);
+        }
+
         group_level = xive_get_group_level(crowd, cam_ignore, nvx_blk, nvx_idx);
-        trace_xive_presenter_notify(nvx_blk, nvx_idx, match.ring, group_level);
-        xive_tctx_pipr_update(match.tctx, match.ring, priority, group_level);
+        trace_xive_presenter_notify(nvx_blk, nvx_idx, ring, group_level);
+        xive_tctx_pipr_update(tctx, ring, priority, group_level);
         return;
     }
 

From d16214ed2c57a31b5de7e2c115c65b831170a60e Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Mon, 12 May 2025 13:10:39 +1000
Subject: [PATCH 2555/2760] ppc/xive: Add xive_tctx_pipr_present() to present
 new interrupt
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

xive_tctx_pipr_update() is used for multiple things. In an effort
to make things simpler and less overloaded, split out the function
that is used to present a new interrupt to the tctx.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Glenn Miles <milesg@linux.ibm.com>
Reviewed-by: Michael Kowal <kowal@linux.ibm.com>
Tested-by: Gautam Menghani <gautam@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20250512031100.439842-31-npiggin@gmail.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/intc/xive.c        | 8 +++++++-
 hw/intc/xive2.c       | 2 +-
 include/hw/ppc/xive.h | 2 ++
 3 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/hw/intc/xive.c b/hw/intc/xive.c
index c92e819053..038c35846d 100644
--- a/hw/intc/xive.c
+++ b/hw/intc/xive.c
@@ -225,6 +225,12 @@ void xive_tctx_pipr_update(XiveTCTX *tctx, uint8_t ring, uint8_t priority,
     xive_tctx_notify(tctx, ring, group_level);
  }
 
+void xive_tctx_pipr_present(XiveTCTX *tctx, uint8_t ring, uint8_t priority,
+                            uint8_t group_level)
+{
+    xive_tctx_pipr_update(tctx, ring, priority, group_level);
+}
+
 /*
  * XIVE Thread Interrupt Management Area (TIMA)
  */
@@ -2040,7 +2046,7 @@ void xive_router_end_notify(XiveRouter *xrtr, XiveEAS *eas)
                              xive_get_field32(END_W7_F1_LOG_SERVER_ID, end.w7),
                              &match)) {
         trace_xive_presenter_notify(nvt_blk, nvt_idx, match.ring, 0);
-        xive_tctx_pipr_update(match.tctx, match.ring, priority, 0);
+        xive_tctx_pipr_present(match.tctx, match.ring, priority, 0);
         return;
     }
 
diff --git a/hw/intc/xive2.c b/hw/intc/xive2.c
index f51fd38a13..fe40f7f07b 100644
--- a/hw/intc/xive2.c
+++ b/hw/intc/xive2.c
@@ -1652,7 +1652,7 @@ static void xive2_router_end_notify(Xive2Router *xrtr, uint8_t end_blk,
 
         group_level = xive_get_group_level(crowd, cam_ignore, nvx_blk, nvx_idx);
         trace_xive_presenter_notify(nvx_blk, nvx_idx, ring, group_level);
-        xive_tctx_pipr_update(tctx, ring, priority, group_level);
+        xive_tctx_pipr_present(tctx, ring, priority, group_level);
         return;
     }
 
diff --git a/include/hw/ppc/xive.h b/include/hw/ppc/xive.h
index 8152a9df3d..0d6b11e818 100644
--- a/include/hw/ppc/xive.h
+++ b/include/hw/ppc/xive.h
@@ -562,6 +562,8 @@ void xive_tctx_reset(XiveTCTX *tctx);
 void xive_tctx_destroy(XiveTCTX *tctx);
 void xive_tctx_pipr_update(XiveTCTX *tctx, uint8_t ring, uint8_t priority,
                            uint8_t group_level);
+void xive_tctx_pipr_present(XiveTCTX *tctx, uint8_t ring, uint8_t priority,
+                            uint8_t group_level);
 void xive_tctx_reset_signal(XiveTCTX *tctx, uint8_t ring);
 void xive_tctx_notify(XiveTCTX *tctx, uint8_t ring, uint8_t group_level);
 uint64_t xive_tctx_accept(XiveTCTX *tctx, uint8_t ring);

From 46f5ee8885a521c56e60820bf35aba4e94e16cf7 Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Mon, 12 May 2025 13:10:40 +1000
Subject: [PATCH 2556/2760] ppc/xive: Fix high prio group interrupt being
 preempted by low prio VP
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

xive_tctx_pipr_present() as implemented with xive_tctx_pipr_update()
causes VP-directed (group==0) interrupt to be presented in PIPR and NSR
despite being a lower priority than the currently presented group
interrupt.

This must not happen. The IPB bit should record the low priority VP
interrupt, but PIPR and NSR must not present the lower priority
interrupt.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Glenn Miles <milesg@linux.ibm.com>
Reviewed-by: Michael Kowal <kowal@linux.ibm.com>
Tested-by: Gautam Menghani <gautam@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20250512031100.439842-32-npiggin@gmail.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/intc/xive.c | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/hw/intc/xive.c b/hw/intc/xive.c
index 038c35846d..7110cf45d7 100644
--- a/hw/intc/xive.c
+++ b/hw/intc/xive.c
@@ -228,7 +228,23 @@ void xive_tctx_pipr_update(XiveTCTX *tctx, uint8_t ring, uint8_t priority,
 void xive_tctx_pipr_present(XiveTCTX *tctx, uint8_t ring, uint8_t priority,
                             uint8_t group_level)
 {
-    xive_tctx_pipr_update(tctx, ring, priority, group_level);
+    /* HV_POOL ring uses HV_PHYS NSR, CPPR and PIPR registers */
+    uint8_t alt_ring = (ring == TM_QW2_HV_POOL) ? TM_QW3_HV_PHYS : ring;
+    uint8_t *aregs = &tctx->regs[alt_ring];
+    uint8_t *regs = &tctx->regs[ring];
+    uint8_t pipr = xive_priority_to_pipr(priority);
+
+    if (group_level == 0) {
+        regs[TM_IPB] |= xive_priority_to_ipb(priority);
+        if (pipr >= aregs[TM_PIPR]) {
+            /* VP interrupts can come here with lower priority than PIPR */
+            return;
+        }
+    }
+    g_assert(pipr <= xive_ipb_to_pipr(regs[TM_IPB]));
+    g_assert(pipr < aregs[TM_PIPR]);
+    aregs[TM_PIPR] = pipr;
+    xive_tctx_notify(tctx, ring, group_level);
 }
 
 /*

From 3516b9b6739714068d83bb5ed9ce25cc1b20be8d Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Mon, 12 May 2025 13:10:41 +1000
Subject: [PATCH 2557/2760] ppc/xive: Split xive recompute from IPB function
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Further split xive_tctx_pipr_update() by splitting out a new function
that is used to re-compute the PIPR from IPB. This is generally only
used with XIVE1, because group interrputs require more logic.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Glenn Miles <milesg@linux.ibm.com>
Reviewed-by: Michael Kowal <kowal@linux.ibm.com>
Tested-by: Gautam Menghani <gautam@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20250512031100.439842-33-npiggin@gmail.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/intc/xive.c | 25 ++++++++++++++++++++++---
 1 file changed, 22 insertions(+), 3 deletions(-)

diff --git a/hw/intc/xive.c b/hw/intc/xive.c
index 7110cf45d7..5deb2f478f 100644
--- a/hw/intc/xive.c
+++ b/hw/intc/xive.c
@@ -225,6 +225,20 @@ void xive_tctx_pipr_update(XiveTCTX *tctx, uint8_t ring, uint8_t priority,
     xive_tctx_notify(tctx, ring, group_level);
  }
 
+static void xive_tctx_pipr_recompute_from_ipb(XiveTCTX *tctx, uint8_t ring)
+{
+    /* HV_POOL ring uses HV_PHYS NSR, CPPR and PIPR registers */
+    uint8_t alt_ring = (ring == TM_QW2_HV_POOL) ? TM_QW3_HV_PHYS : ring;
+    uint8_t *aregs = &tctx->regs[alt_ring];
+    uint8_t *regs = &tctx->regs[ring];
+
+    /* Does not support a presented group interrupt */
+    g_assert(!xive_nsr_indicates_group_exception(alt_ring, aregs[TM_NSR]));
+
+    aregs[TM_PIPR] = xive_ipb_to_pipr(regs[TM_IPB]);
+    xive_tctx_notify(tctx, ring, 0);
+}
+
 void xive_tctx_pipr_present(XiveTCTX *tctx, uint8_t ring, uint8_t priority,
                             uint8_t group_level)
 {
@@ -517,7 +531,12 @@ static void xive_tm_set_os_lgs(XivePresenter *xptr, XiveTCTX *tctx,
 static void xive_tm_set_os_pending(XivePresenter *xptr, XiveTCTX *tctx,
                                    hwaddr offset, uint64_t value, unsigned size)
 {
-    xive_tctx_pipr_update(tctx, TM_QW1_OS, value & 0xff, 0);
+    uint8_t ring = TM_QW1_OS;
+    uint8_t *regs = &tctx->regs[ring];
+
+    /* XXX: how should this work exactly? */
+    regs[TM_IPB] |= xive_priority_to_ipb(value & 0xff);
+    xive_tctx_pipr_recompute_from_ipb(tctx, ring);
 }
 
 static void xive_os_cam_decode(uint32_t cam, uint8_t *nvt_blk,
@@ -601,14 +620,14 @@ static void xive_tctx_need_resend(XiveRouter *xrtr, XiveTCTX *tctx,
     }
 
     /*
-     * Always call xive_tctx_pipr_update(). Even if there were no
+     * Always call xive_tctx_recompute_from_ipb(). Even if there were no
      * escalation triggered, there could be a pending interrupt which
      * was saved when the context was pulled and that we need to take
      * into account by recalculating the PIPR (which is not
      * saved/restored).
      * It will also raise the External interrupt signal if needed.
      */
-    xive_tctx_pipr_update(tctx, TM_QW1_OS, 0xFF, 0); /* fxb */
+    xive_tctx_pipr_recompute_from_ipb(tctx, TM_QW1_OS); /* fxb */
 }
 
 /*

From 581bec5a04c5c27a86cfae93ca531c101f2df2ec Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Mon, 12 May 2025 13:10:42 +1000
Subject: [PATCH 2558/2760] ppc/xive: tctx signaling registers rework
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The tctx "signaling" registers (PIPR, CPPR, NSR) raise an interrupt on
the target CPU thread. The POOL and PHYS rings both raise hypervisor
interrupts, so they both share one set of signaling registers in the
PHYS ring. The PHYS NSR register contains a field that indicates which
ring has presented the interrupt being signaled to the CPU.

This sharing results in all the "alt_regs" throughout the code. alt_regs
is not very descriptive, and worse is that the name is used for
conversions in both directions, i.e., to find the presenting ring from
the signaling ring, and the signaling ring from the presenting ring.

Instead of alt_regs, use the names sig_regs and sig_ring, and regs and
ring for the presenting ring being worked on. Add a helper function to
get the sign_regs, and add some asserts to ensure the POOL regs are
never used to signal interrupts.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Glenn Miles <milesg@linux.ibm.com>
Reviewed-by: Michael Kowal <kowal@linux.ibm.com>
Tested-by: Gautam Menghani <gautam@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20250512031100.439842-34-npiggin@gmail.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/intc/xive.c        | 112 ++++++++++++++++++++++--------------------
 hw/intc/xive2.c       |  94 ++++++++++++++++-------------------
 include/hw/ppc/xive.h |  26 +++++++++-
 3 files changed, 126 insertions(+), 106 deletions(-)

diff --git a/hw/intc/xive.c b/hw/intc/xive.c
index 5deb2f478f..119a178f2e 100644
--- a/hw/intc/xive.c
+++ b/hw/intc/xive.c
@@ -80,69 +80,77 @@ static qemu_irq xive_tctx_output(XiveTCTX *tctx, uint8_t ring)
         }
 }
 
-uint64_t xive_tctx_accept(XiveTCTX *tctx, uint8_t ring)
+/*
+ * interrupt is accepted on the presentation ring, for PHYS ring the NSR
+ * directs it to the PHYS or POOL rings.
+ */
+uint64_t xive_tctx_accept(XiveTCTX *tctx, uint8_t sig_ring)
 {
-    uint8_t *regs = &tctx->regs[ring];
-    uint8_t nsr = regs[TM_NSR];
+    uint8_t *sig_regs = &tctx->regs[sig_ring];
+    uint8_t nsr = sig_regs[TM_NSR];
 
-    qemu_irq_lower(xive_tctx_output(tctx, ring));
+    g_assert(sig_ring == TM_QW1_OS || sig_ring == TM_QW3_HV_PHYS);
 
-    if (xive_nsr_indicates_exception(ring, nsr)) {
-        uint8_t cppr = regs[TM_PIPR];
-        uint8_t alt_ring;
-        uint8_t *alt_regs;
+    g_assert(tctx->regs[TM_QW2_HV_POOL + TM_NSR] == 0);
+    g_assert(tctx->regs[TM_QW2_HV_POOL + TM_PIPR] == 0);
+    g_assert(tctx->regs[TM_QW2_HV_POOL + TM_CPPR] == 0);
 
-        alt_ring = xive_nsr_exception_ring(ring, nsr);
-        alt_regs = &tctx->regs[alt_ring];
+    qemu_irq_lower(xive_tctx_output(tctx, sig_ring));
 
-        regs[TM_CPPR] = cppr;
+    if (xive_nsr_indicates_exception(sig_ring, nsr)) {
+        uint8_t cppr = sig_regs[TM_PIPR];
+        uint8_t ring;
+        uint8_t *regs;
+
+        ring = xive_nsr_exception_ring(sig_ring, nsr);
+        regs = &tctx->regs[ring];
+
+        sig_regs[TM_CPPR] = cppr;
 
         /*
          * If the interrupt was for a specific VP, reset the pending
          * buffer bit, otherwise clear the logical server indicator
          */
-        if (!xive_nsr_indicates_group_exception(ring, nsr)) {
-            alt_regs[TM_IPB] &= ~xive_priority_to_ipb(cppr);
+        if (!xive_nsr_indicates_group_exception(sig_ring, nsr)) {
+            regs[TM_IPB] &= ~xive_priority_to_ipb(cppr);
         }
 
         /* Clear the exception from NSR */
-        regs[TM_NSR] = 0;
+        sig_regs[TM_NSR] = 0;
 
-        trace_xive_tctx_accept(tctx->cs->cpu_index, alt_ring,
-                               alt_regs[TM_IPB], regs[TM_PIPR],
-                               regs[TM_CPPR], regs[TM_NSR]);
+        trace_xive_tctx_accept(tctx->cs->cpu_index, ring,
+                               regs[TM_IPB], sig_regs[TM_PIPR],
+                               sig_regs[TM_CPPR], sig_regs[TM_NSR]);
     }
 
-    return ((uint64_t)nsr << 8) | regs[TM_CPPR];
+    return ((uint64_t)nsr << 8) | sig_regs[TM_CPPR];
 }
 
 void xive_tctx_notify(XiveTCTX *tctx, uint8_t ring, uint8_t group_level)
 {
-    /* HV_POOL ring uses HV_PHYS NSR, CPPR and PIPR registers */
-    uint8_t alt_ring = (ring == TM_QW2_HV_POOL) ? TM_QW3_HV_PHYS : ring;
-    uint8_t *alt_regs = &tctx->regs[alt_ring];
+    uint8_t *sig_regs = xive_tctx_signal_regs(tctx, ring);
     uint8_t *regs = &tctx->regs[ring];
 
-    if (alt_regs[TM_PIPR] < alt_regs[TM_CPPR]) {
+    if (sig_regs[TM_PIPR] < sig_regs[TM_CPPR]) {
         switch (ring) {
         case TM_QW1_OS:
-            regs[TM_NSR] = TM_QW1_NSR_EO | (group_level & 0x3F);
+            sig_regs[TM_NSR] = TM_QW1_NSR_EO | (group_level & 0x3F);
             break;
         case TM_QW2_HV_POOL:
-            alt_regs[TM_NSR] = (TM_QW3_NSR_HE_POOL << 6) | (group_level & 0x3F);
+            sig_regs[TM_NSR] = (TM_QW3_NSR_HE_POOL << 6) | (group_level & 0x3F);
             break;
         case TM_QW3_HV_PHYS:
-            regs[TM_NSR] = (TM_QW3_NSR_HE_PHYS << 6) | (group_level & 0x3F);
+            sig_regs[TM_NSR] = (TM_QW3_NSR_HE_PHYS << 6) | (group_level & 0x3F);
             break;
         default:
             g_assert_not_reached();
         }
         trace_xive_tctx_notify(tctx->cs->cpu_index, ring,
-                               regs[TM_IPB], alt_regs[TM_PIPR],
-                               alt_regs[TM_CPPR], alt_regs[TM_NSR]);
+                               regs[TM_IPB], sig_regs[TM_PIPR],
+                               sig_regs[TM_CPPR], sig_regs[TM_NSR]);
         qemu_irq_raise(xive_tctx_output(tctx, ring));
     } else {
-        alt_regs[TM_NSR] = 0;
+        sig_regs[TM_NSR] = 0;
         qemu_irq_lower(xive_tctx_output(tctx, ring));
     }
 }
@@ -159,25 +167,32 @@ void xive_tctx_reset_signal(XiveTCTX *tctx, uint8_t ring)
 
 static void xive_tctx_set_cppr(XiveTCTX *tctx, uint8_t ring, uint8_t cppr)
 {
-    uint8_t *regs = &tctx->regs[ring];
+    uint8_t *sig_regs = &tctx->regs[ring];
     uint8_t pipr_min;
     uint8_t ring_min;
 
+    g_assert(ring == TM_QW1_OS || ring == TM_QW3_HV_PHYS);
+
+    g_assert(tctx->regs[TM_QW2_HV_POOL + TM_NSR] == 0);
+    g_assert(tctx->regs[TM_QW2_HV_POOL + TM_PIPR] == 0);
+    g_assert(tctx->regs[TM_QW2_HV_POOL + TM_CPPR] == 0);
+
+    /* XXX: should show pool IPB for PHYS ring */
     trace_xive_tctx_set_cppr(tctx->cs->cpu_index, ring,
-                             regs[TM_IPB], regs[TM_PIPR],
-                             cppr, regs[TM_NSR]);
+                             sig_regs[TM_IPB], sig_regs[TM_PIPR],
+                             cppr, sig_regs[TM_NSR]);
 
     if (cppr > XIVE_PRIORITY_MAX) {
         cppr = 0xff;
     }
 
-    tctx->regs[ring + TM_CPPR] = cppr;
+    sig_regs[TM_CPPR] = cppr;
 
     /*
      * Recompute the PIPR based on local pending interrupts.  The PHYS
      * ring must take the minimum of both the PHYS and POOL PIPR values.
      */
-    pipr_min = xive_ipb_to_pipr(regs[TM_IPB]);
+    pipr_min = xive_ipb_to_pipr(sig_regs[TM_IPB]);
     ring_min = ring;
 
     /* PHYS updates also depend on POOL values */
@@ -186,7 +201,6 @@ static void xive_tctx_set_cppr(XiveTCTX *tctx, uint8_t ring, uint8_t cppr)
 
         /* POOL values only matter if POOL ctx is valid */
         if (pool_regs[TM_WORD2] & 0x80) {
-
             uint8_t pool_pipr = xive_ipb_to_pipr(pool_regs[TM_IPB]);
 
             /*
@@ -200,7 +214,7 @@ static void xive_tctx_set_cppr(XiveTCTX *tctx, uint8_t ring, uint8_t cppr)
         }
     }
 
-    regs[TM_PIPR] = pipr_min;
+    sig_regs[TM_PIPR] = pipr_min;
 
     /* CPPR has changed, check if we need to raise a pending exception */
     xive_tctx_notify(tctx, ring_min, 0);
@@ -208,56 +222,50 @@ static void xive_tctx_set_cppr(XiveTCTX *tctx, uint8_t ring, uint8_t cppr)
 
 void xive_tctx_pipr_update(XiveTCTX *tctx, uint8_t ring, uint8_t priority,
                            uint8_t group_level)
- {
-    /* HV_POOL ring uses HV_PHYS NSR, CPPR and PIPR registers */
-    uint8_t alt_ring = (ring == TM_QW2_HV_POOL) ? TM_QW3_HV_PHYS : ring;
-    uint8_t *alt_regs = &tctx->regs[alt_ring];
+{
+    uint8_t *sig_regs = xive_tctx_signal_regs(tctx, ring);
     uint8_t *regs = &tctx->regs[ring];
 
     if (group_level == 0) {
         /* VP-specific */
         regs[TM_IPB] |= xive_priority_to_ipb(priority);
-        alt_regs[TM_PIPR] = xive_ipb_to_pipr(regs[TM_IPB]);
+        sig_regs[TM_PIPR] = xive_ipb_to_pipr(regs[TM_IPB]);
     } else {
         /* VP-group */
-        alt_regs[TM_PIPR] = xive_priority_to_pipr(priority);
+        sig_regs[TM_PIPR] = xive_priority_to_pipr(priority);
     }
     xive_tctx_notify(tctx, ring, group_level);
  }
 
 static void xive_tctx_pipr_recompute_from_ipb(XiveTCTX *tctx, uint8_t ring)
 {
-    /* HV_POOL ring uses HV_PHYS NSR, CPPR and PIPR registers */
-    uint8_t alt_ring = (ring == TM_QW2_HV_POOL) ? TM_QW3_HV_PHYS : ring;
-    uint8_t *aregs = &tctx->regs[alt_ring];
+    uint8_t *sig_regs = xive_tctx_signal_regs(tctx, ring);
     uint8_t *regs = &tctx->regs[ring];
 
     /* Does not support a presented group interrupt */
-    g_assert(!xive_nsr_indicates_group_exception(alt_ring, aregs[TM_NSR]));
+    g_assert(!xive_nsr_indicates_group_exception(ring, sig_regs[TM_NSR]));
 
-    aregs[TM_PIPR] = xive_ipb_to_pipr(regs[TM_IPB]);
+    sig_regs[TM_PIPR] = xive_ipb_to_pipr(regs[TM_IPB]);
     xive_tctx_notify(tctx, ring, 0);
 }
 
 void xive_tctx_pipr_present(XiveTCTX *tctx, uint8_t ring, uint8_t priority,
                             uint8_t group_level)
 {
-    /* HV_POOL ring uses HV_PHYS NSR, CPPR and PIPR registers */
-    uint8_t alt_ring = (ring == TM_QW2_HV_POOL) ? TM_QW3_HV_PHYS : ring;
-    uint8_t *aregs = &tctx->regs[alt_ring];
+    uint8_t *sig_regs = xive_tctx_signal_regs(tctx, ring);
     uint8_t *regs = &tctx->regs[ring];
     uint8_t pipr = xive_priority_to_pipr(priority);
 
     if (group_level == 0) {
         regs[TM_IPB] |= xive_priority_to_ipb(priority);
-        if (pipr >= aregs[TM_PIPR]) {
+        if (pipr >= sig_regs[TM_PIPR]) {
             /* VP interrupts can come here with lower priority than PIPR */
             return;
         }
     }
     g_assert(pipr <= xive_ipb_to_pipr(regs[TM_IPB]));
-    g_assert(pipr < aregs[TM_PIPR]);
-    aregs[TM_PIPR] = pipr;
+    g_assert(pipr < sig_regs[TM_PIPR]);
+    sig_regs[TM_PIPR] = pipr;
     xive_tctx_notify(tctx, ring, group_level);
 }
 
diff --git a/hw/intc/xive2.c b/hw/intc/xive2.c
index fe40f7f07b..71b40f702a 100644
--- a/hw/intc/xive2.c
+++ b/hw/intc/xive2.c
@@ -606,11 +606,9 @@ static uint32_t xive2_tctx_hw_cam_line(XivePresenter *xptr, XiveTCTX *tctx)
 
 static void xive2_redistribute(Xive2Router *xrtr, XiveTCTX *tctx, uint8_t ring)
 {
-    uint8_t *regs = &tctx->regs[ring];
-    uint8_t *alt_regs = (ring == TM_QW2_HV_POOL) ? &tctx->regs[TM_QW3_HV_PHYS] :
-                                                   regs;
-    uint8_t nsr = alt_regs[TM_NSR];
-    uint8_t pipr = alt_regs[TM_PIPR];
+    uint8_t *sig_regs = xive_tctx_signal_regs(tctx, ring);
+    uint8_t nsr = sig_regs[TM_NSR];
+    uint8_t pipr = sig_regs[TM_PIPR];
     uint8_t crowd = NVx_CROWD_LVL(nsr);
     uint8_t group = NVx_GROUP_LVL(nsr);
     uint8_t nvgc_blk, end_blk, nvp_blk;
@@ -618,19 +616,16 @@ static void xive2_redistribute(Xive2Router *xrtr, XiveTCTX *tctx, uint8_t ring)
     Xive2Nvgc nvgc;
     uint8_t prio_limit;
     uint32_t cfg;
-    uint8_t alt_ring;
 
     /* redistribution is only for group/crowd interrupts */
     if (!xive_nsr_indicates_group_exception(ring, nsr)) {
         return;
     }
 
-    alt_ring = xive_nsr_exception_ring(ring, nsr);
-
     /* Don't check return code since ring is expected to be invalidated */
-    xive2_tctx_get_nvp_indexes(tctx, alt_ring, &nvp_blk, &nvp_idx);
+    xive2_tctx_get_nvp_indexes(tctx, ring, &nvp_blk, &nvp_idx);
 
-    trace_xive_redistribute(tctx->cs->cpu_index, alt_ring, nvp_blk, nvp_idx);
+    trace_xive_redistribute(tctx->cs->cpu_index, ring, nvp_blk, nvp_idx);
 
     trace_xive_redistribute(tctx->cs->cpu_index, ring, nvp_blk, nvp_idx);
     /* convert crowd/group to blk/idx */
@@ -675,23 +670,11 @@ static void xive2_redistribute(Xive2Router *xrtr, XiveTCTX *tctx, uint8_t ring)
     xive2_router_end_notify(xrtr, end_blk, end_idx, 0, true);
 
     /* clear interrupt indication for the context */
-    alt_regs[TM_NSR] = 0;
-    alt_regs[TM_PIPR] = alt_regs[TM_CPPR];
+    sig_regs[TM_NSR] = 0;
+    sig_regs[TM_PIPR] = sig_regs[TM_CPPR];
     xive_tctx_reset_signal(tctx, ring);
 }
 
-static uint8_t xive2_hv_irq_ring(uint8_t nsr)
-{
-    switch (nsr >> 6) {
-    case TM_QW3_NSR_HE_POOL:
-        return TM_QW2_HV_POOL;
-    case TM_QW3_NSR_HE_PHYS:
-        return TM_QW3_HV_PHYS;
-    default:
-        return -1;
-    }
-}
-
 static uint64_t xive2_tm_pull_ctx(XivePresenter *xptr, XiveTCTX *tctx,
                                   hwaddr offset, unsigned size, uint8_t ring)
 {
@@ -718,7 +701,8 @@ static uint64_t xive2_tm_pull_ctx(XivePresenter *xptr, XiveTCTX *tctx,
         uint32_t ringw2 = xive_tctx_word2(&tctx->regs[cur_ring]);
         uint32_t ringw2_new = xive_set_field32(TM2_QW1W2_VO, ringw2, 0);
         bool is_valid = !!(xive_get_field32(TM2_QW1W2_VO, ringw2));
-        uint8_t alt_ring;
+        uint8_t *sig_regs;
+
         memcpy(&tctx->regs[cur_ring + TM_WORD2], &ringw2_new, 4);
 
         /* Skip the rest for USER or invalid contexts */
@@ -727,12 +711,11 @@ static uint64_t xive2_tm_pull_ctx(XivePresenter *xptr, XiveTCTX *tctx,
         }
 
         /* Active group/crowd interrupts need to be redistributed */
-        alt_ring = (cur_ring == TM_QW2_HV_POOL) ? TM_QW3_HV_PHYS : cur_ring;
-        nsr = tctx->regs[alt_ring + TM_NSR];
-        if (xive_nsr_indicates_group_exception(alt_ring, nsr)) {
-            /* For HV rings, only redistribute if cur_ring matches NSR */
-            if ((cur_ring == TM_QW1_OS) ||
-                (cur_ring == xive2_hv_irq_ring(nsr))) {
+        sig_regs = xive_tctx_signal_regs(tctx, ring);
+        nsr = sig_regs[TM_NSR];
+        if (xive_nsr_indicates_group_exception(cur_ring, nsr)) {
+            /* Ensure ring matches NSR (for HV NSR POOL vs PHYS rings) */
+            if (cur_ring == xive_nsr_exception_ring(cur_ring, nsr)) {
                 xive2_redistribute(xrtr, tctx, cur_ring);
             }
         }
@@ -1118,7 +1101,7 @@ void xive2_tm_ack_os_el(XivePresenter *xptr, XiveTCTX *tctx,
 /* NOTE: CPPR only exists for TM_QW1_OS and TM_QW3_HV_PHYS */
 static void xive2_tctx_set_cppr(XiveTCTX *tctx, uint8_t ring, uint8_t cppr)
 {
-    uint8_t *regs = &tctx->regs[ring];
+    uint8_t *sig_regs = &tctx->regs[ring];
     Xive2Router *xrtr = XIVE2_ROUTER(tctx->xptr);
     uint8_t old_cppr, backlog_prio, first_group, group_level;
     uint8_t pipr_min, lsmfb_min, ring_min;
@@ -1127,33 +1110,41 @@ static void xive2_tctx_set_cppr(XiveTCTX *tctx, uint8_t ring, uint8_t cppr)
     uint32_t nvp_idx;
     Xive2Nvp nvp;
     int rc;
-    uint8_t nsr = regs[TM_NSR];
+    uint8_t nsr = sig_regs[TM_NSR];
 
+    g_assert(ring == TM_QW1_OS || ring == TM_QW3_HV_PHYS);
+
+    g_assert(tctx->regs[TM_QW2_HV_POOL + TM_NSR] == 0);
+    g_assert(tctx->regs[TM_QW2_HV_POOL + TM_PIPR] == 0);
+    g_assert(tctx->regs[TM_QW2_HV_POOL + TM_CPPR] == 0);
+
+    /* XXX: should show pool IPB for PHYS ring */
     trace_xive_tctx_set_cppr(tctx->cs->cpu_index, ring,
-                             regs[TM_IPB], regs[TM_PIPR],
+                             sig_regs[TM_IPB], sig_regs[TM_PIPR],
                              cppr, nsr);
 
     if (cppr > XIVE_PRIORITY_MAX) {
         cppr = 0xff;
     }
 
-    old_cppr = regs[TM_CPPR];
-    regs[TM_CPPR] = cppr;
+    old_cppr = sig_regs[TM_CPPR];
+    sig_regs[TM_CPPR] = cppr;
 
     /* Handle increased CPPR priority (lower value) */
     if (cppr < old_cppr) {
-        if (cppr <= regs[TM_PIPR]) {
+        if (cppr <= sig_regs[TM_PIPR]) {
             /* CPPR lowered below PIPR, must un-present interrupt */
             if (xive_nsr_indicates_exception(ring, nsr)) {
                 if (xive_nsr_indicates_group_exception(ring, nsr)) {
                     /* redistribute precluded active grp interrupt */
-                    xive2_redistribute(xrtr, tctx, ring);
+                    xive2_redistribute(xrtr, tctx,
+                                       xive_nsr_exception_ring(ring, nsr));
                     return;
                 }
             }
 
             /* interrupt is VP directed, pending in IPB */
-            regs[TM_PIPR] = cppr;
+            sig_regs[TM_PIPR] = cppr;
             xive_tctx_notify(tctx, ring, 0); /* Ensure interrupt is cleared */
             return;
         } else {
@@ -1174,9 +1165,9 @@ static void xive2_tctx_set_cppr(XiveTCTX *tctx, uint8_t ring, uint8_t cppr)
      * be adjusted below if needed in case of pending group interrupts.
      */
 again:
-    pipr_min = xive_ipb_to_pipr(regs[TM_IPB]);
-    group_enabled = !!regs[TM_LGS];
-    lsmfb_min = group_enabled ? regs[TM_LSMFB] : 0xff;
+    pipr_min = xive_ipb_to_pipr(sig_regs[TM_IPB]);
+    group_enabled = !!sig_regs[TM_LGS];
+    lsmfb_min = group_enabled ? sig_regs[TM_LSMFB] : 0xff;
     ring_min = ring;
     group_level = 0;
 
@@ -1265,7 +1256,7 @@ again:
     }
 
     /* PIPR should not be set to a value greater than CPPR */
-    regs[TM_PIPR] = (pipr_min > cppr) ? cppr : pipr_min;
+    sig_regs[TM_PIPR] = (pipr_min > cppr) ? cppr : pipr_min;
 
     /* CPPR has changed, check if we need to raise a pending exception */
     xive_tctx_notify(tctx, ring_min, group_level);
@@ -1490,9 +1481,7 @@ int xive2_presenter_tctx_match(XivePresenter *xptr, XiveTCTX *tctx,
 
 bool xive2_tm_irq_precluded(XiveTCTX *tctx, int ring, uint8_t priority)
 {
-    /* HV_POOL ring uses HV_PHYS NSR, CPPR and PIPR registers */
-    uint8_t alt_ring = (ring == TM_QW2_HV_POOL) ? TM_QW3_HV_PHYS : ring;
-    uint8_t *alt_regs = &tctx->regs[alt_ring];
+    uint8_t *sig_regs = xive_tctx_signal_regs(tctx, ring);
 
     /*
      * The xive2_presenter_tctx_match() above tells if there's a match
@@ -1500,7 +1489,7 @@ bool xive2_tm_irq_precluded(XiveTCTX *tctx, int ring, uint8_t priority)
      * priority to know if the thread can take the interrupt now or if
      * it is precluded.
      */
-    if (priority < alt_regs[TM_PIPR]) {
+    if (priority < sig_regs[TM_PIPR]) {
         return false;
     }
     return true;
@@ -1640,14 +1629,13 @@ static void xive2_router_end_notify(Xive2Router *xrtr, uint8_t end_blk,
                              &match)) {
         XiveTCTX *tctx = match.tctx;
         uint8_t ring = match.ring;
-        uint8_t alt_ring = (ring == TM_QW2_HV_POOL) ? TM_QW3_HV_PHYS : ring;
-        uint8_t *aregs = &tctx->regs[alt_ring];
-        uint8_t nsr = aregs[TM_NSR];
+        uint8_t *sig_regs = xive_tctx_signal_regs(tctx, ring);
+        uint8_t nsr = sig_regs[TM_NSR];
         uint8_t group_level;
 
-        if (priority < aregs[TM_PIPR] &&
-            xive_nsr_indicates_group_exception(alt_ring, nsr)) {
-            xive2_redistribute(xrtr, tctx, alt_ring);
+        if (priority < sig_regs[TM_PIPR] &&
+            xive_nsr_indicates_group_exception(ring, nsr)) {
+            xive2_redistribute(xrtr, tctx, xive_nsr_exception_ring(ring, nsr));
         }
 
         group_level = xive_get_group_level(crowd, cam_ignore, nvx_blk, nvx_idx);
diff --git a/include/hw/ppc/xive.h b/include/hw/ppc/xive.h
index 0d6b11e818..a3c2f50ece 100644
--- a/include/hw/ppc/xive.h
+++ b/include/hw/ppc/xive.h
@@ -539,7 +539,7 @@ static inline uint8_t xive_ipb_to_pipr(uint8_t ibp)
 }
 
 /*
- * XIVE Thread Interrupt Management Aera (TIMA)
+ * XIVE Thread Interrupt Management Area (TIMA)
  *
  * This region gives access to the registers of the thread interrupt
  * management context. It is four page wide, each page providing a
@@ -551,6 +551,30 @@ static inline uint8_t xive_ipb_to_pipr(uint8_t ibp)
 #define XIVE_TM_OS_PAGE         0x2
 #define XIVE_TM_USER_PAGE       0x3
 
+/*
+ * The TCTX (TIMA) has 4 rings (phys, pool, os, user), but only signals
+ * (raises an interrupt on) the CPU from 3 of them. Phys and pool both
+ * cause a hypervisor privileged interrupt so interrupts presented on
+ * those rings signal using the phys ring. This helper returns the signal
+ * regs from the given ring.
+ */
+static inline uint8_t *xive_tctx_signal_regs(XiveTCTX *tctx, uint8_t ring)
+{
+    /*
+     * This is a good point to add invariants to ensure nothing has tried to
+     * signal using the POOL ring.
+     */
+    g_assert(tctx->regs[TM_QW2_HV_POOL + TM_NSR] == 0);
+    g_assert(tctx->regs[TM_QW2_HV_POOL + TM_PIPR] == 0);
+    g_assert(tctx->regs[TM_QW2_HV_POOL + TM_CPPR] == 0);
+
+    if (ring == TM_QW2_HV_POOL) {
+        /* POOL and PHYS rings share the signal regs (PIPR, NSR, CPPR) */
+        ring = TM_QW3_HV_PHYS;
+    }
+    return &tctx->regs[ring];
+}
+
 void xive_tctx_tm_write(XivePresenter *xptr, XiveTCTX *tctx, hwaddr offset,
                         uint64_t value, unsigned size);
 uint64_t xive_tctx_tm_read(XivePresenter *xptr, XiveTCTX *tctx, hwaddr offset,

From cf454eaa96e8a0c3c1de63b0f7b85542d7c5ecbf Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Mon, 12 May 2025 13:10:43 +1000
Subject: [PATCH 2559/2760] ppc/xive: tctx_accept only lower irq line if an
 interrupt was presented
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The relationship between an interrupt signaled in the TIMA and the QEMU
irq line to the processor to be 1:1, so they should be raised and
lowered together and "just in case" lowering should be avoided (it could
mask

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Glenn Miles <milesg@linux.ibm.com>
Tested-by: Gautam Menghani <gautam@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20250512031100.439842-35-npiggin@gmail.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/intc/xive.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/hw/intc/xive.c b/hw/intc/xive.c
index 119a178f2e..db26dae7db 100644
--- a/hw/intc/xive.c
+++ b/hw/intc/xive.c
@@ -95,8 +95,6 @@ uint64_t xive_tctx_accept(XiveTCTX *tctx, uint8_t sig_ring)
     g_assert(tctx->regs[TM_QW2_HV_POOL + TM_PIPR] == 0);
     g_assert(tctx->regs[TM_QW2_HV_POOL + TM_CPPR] == 0);
 
-    qemu_irq_lower(xive_tctx_output(tctx, sig_ring));
-
     if (xive_nsr_indicates_exception(sig_ring, nsr)) {
         uint8_t cppr = sig_regs[TM_PIPR];
         uint8_t ring;
@@ -117,6 +115,7 @@ uint64_t xive_tctx_accept(XiveTCTX *tctx, uint8_t sig_ring)
 
         /* Clear the exception from NSR */
         sig_regs[TM_NSR] = 0;
+        qemu_irq_lower(xive_tctx_output(tctx, sig_ring));
 
         trace_xive_tctx_accept(tctx->cs->cpu_index, ring,
                                regs[TM_IPB], sig_regs[TM_PIPR],

From 64a18e0c37a6b5c3d94541ff0599ea84fec998c0 Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Mon, 12 May 2025 13:10:44 +1000
Subject: [PATCH 2560/2760] ppc/xive: Add xive_tctx_pipr_set() helper function
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Have xive_tctx_notify() also set the new PIPR value and rename it to
xive_tctx_pipr_set(). This can replace the last xive_tctx_pipr_update()
caller because it does not need to update IPB (it already sets it).

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Glenn Miles <milesg@linux.ibm.com>
Reviewed-by: Michael Kowal <kowal@linux.ibm.com>
Tested-by: Gautam Menghani <gautam@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20250512031100.439842-36-npiggin@gmail.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/intc/xive.c        | 39 +++++++++++----------------------------
 hw/intc/xive2.c       | 16 +++++++---------
 include/hw/ppc/xive.h |  5 ++---
 3 files changed, 20 insertions(+), 40 deletions(-)

diff --git a/hw/intc/xive.c b/hw/intc/xive.c
index db26dae7db..6ad84f93c7 100644
--- a/hw/intc/xive.c
+++ b/hw/intc/xive.c
@@ -125,12 +125,16 @@ uint64_t xive_tctx_accept(XiveTCTX *tctx, uint8_t sig_ring)
     return ((uint64_t)nsr << 8) | sig_regs[TM_CPPR];
 }
 
-void xive_tctx_notify(XiveTCTX *tctx, uint8_t ring, uint8_t group_level)
+/* Change PIPR and calculate NSR and irq based on PIPR, CPPR, group */
+void xive_tctx_pipr_set(XiveTCTX *tctx, uint8_t ring, uint8_t pipr,
+                        uint8_t group_level)
 {
     uint8_t *sig_regs = xive_tctx_signal_regs(tctx, ring);
     uint8_t *regs = &tctx->regs[ring];
 
-    if (sig_regs[TM_PIPR] < sig_regs[TM_CPPR]) {
+    sig_regs[TM_PIPR] = pipr;
+
+    if (pipr < sig_regs[TM_CPPR]) {
         switch (ring) {
         case TM_QW1_OS:
             sig_regs[TM_NSR] = TM_QW1_NSR_EO | (group_level & 0x3F);
@@ -145,7 +149,7 @@ void xive_tctx_notify(XiveTCTX *tctx, uint8_t ring, uint8_t group_level)
             g_assert_not_reached();
         }
         trace_xive_tctx_notify(tctx->cs->cpu_index, ring,
-                               regs[TM_IPB], sig_regs[TM_PIPR],
+                               regs[TM_IPB], pipr,
                                sig_regs[TM_CPPR], sig_regs[TM_NSR]);
         qemu_irq_raise(xive_tctx_output(tctx, ring));
     } else {
@@ -213,29 +217,10 @@ static void xive_tctx_set_cppr(XiveTCTX *tctx, uint8_t ring, uint8_t cppr)
         }
     }
 
-    sig_regs[TM_PIPR] = pipr_min;
-
-    /* CPPR has changed, check if we need to raise a pending exception */
-    xive_tctx_notify(tctx, ring_min, 0);
+    /* CPPR has changed, this may present or preclude a pending exception */
+    xive_tctx_pipr_set(tctx, ring_min, pipr_min, 0);
 }
 
-void xive_tctx_pipr_update(XiveTCTX *tctx, uint8_t ring, uint8_t priority,
-                           uint8_t group_level)
-{
-    uint8_t *sig_regs = xive_tctx_signal_regs(tctx, ring);
-    uint8_t *regs = &tctx->regs[ring];
-
-    if (group_level == 0) {
-        /* VP-specific */
-        regs[TM_IPB] |= xive_priority_to_ipb(priority);
-        sig_regs[TM_PIPR] = xive_ipb_to_pipr(regs[TM_IPB]);
-    } else {
-        /* VP-group */
-        sig_regs[TM_PIPR] = xive_priority_to_pipr(priority);
-    }
-    xive_tctx_notify(tctx, ring, group_level);
- }
-
 static void xive_tctx_pipr_recompute_from_ipb(XiveTCTX *tctx, uint8_t ring)
 {
     uint8_t *sig_regs = xive_tctx_signal_regs(tctx, ring);
@@ -244,8 +229,7 @@ static void xive_tctx_pipr_recompute_from_ipb(XiveTCTX *tctx, uint8_t ring)
     /* Does not support a presented group interrupt */
     g_assert(!xive_nsr_indicates_group_exception(ring, sig_regs[TM_NSR]));
 
-    sig_regs[TM_PIPR] = xive_ipb_to_pipr(regs[TM_IPB]);
-    xive_tctx_notify(tctx, ring, 0);
+    xive_tctx_pipr_set(tctx, ring, xive_ipb_to_pipr(regs[TM_IPB]), 0);
 }
 
 void xive_tctx_pipr_present(XiveTCTX *tctx, uint8_t ring, uint8_t priority,
@@ -264,8 +248,7 @@ void xive_tctx_pipr_present(XiveTCTX *tctx, uint8_t ring, uint8_t priority,
     }
     g_assert(pipr <= xive_ipb_to_pipr(regs[TM_IPB]));
     g_assert(pipr < sig_regs[TM_PIPR]);
-    sig_regs[TM_PIPR] = pipr;
-    xive_tctx_notify(tctx, ring, group_level);
+    xive_tctx_pipr_set(tctx, ring, pipr, group_level);
 }
 
 /*
diff --git a/hw/intc/xive2.c b/hw/intc/xive2.c
index 71b40f702a..0ee50a6bca 100644
--- a/hw/intc/xive2.c
+++ b/hw/intc/xive2.c
@@ -966,10 +966,10 @@ static void xive2_tctx_need_resend(Xive2Router *xrtr, XiveTCTX *tctx,
     }
 
     /*
-     * Compute the PIPR based on the restored state.
+     * Set the PIPR/NSR based on the restored state.
      * It will raise the External interrupt signal if needed.
      */
-    xive_tctx_pipr_update(tctx, TM_QW1_OS, backlog_prio, backlog_level);
+    xive_tctx_pipr_set(tctx, TM_QW1_OS, backlog_prio, backlog_level);
 }
 
 /*
@@ -1144,8 +1144,7 @@ static void xive2_tctx_set_cppr(XiveTCTX *tctx, uint8_t ring, uint8_t cppr)
             }
 
             /* interrupt is VP directed, pending in IPB */
-            sig_regs[TM_PIPR] = cppr;
-            xive_tctx_notify(tctx, ring, 0); /* Ensure interrupt is cleared */
+            xive_tctx_pipr_set(tctx, ring, cppr, 0);
             return;
         } else {
             /* CPPR was lowered, but still above PIPR. No action needed. */
@@ -1255,11 +1254,10 @@ again:
         pipr_min = backlog_prio;
     }
 
-    /* PIPR should not be set to a value greater than CPPR */
-    sig_regs[TM_PIPR] = (pipr_min > cppr) ? cppr : pipr_min;
-
-    /* CPPR has changed, check if we need to raise a pending exception */
-    xive_tctx_notify(tctx, ring_min, group_level);
+    if (pipr_min > cppr) {
+        pipr_min = cppr;
+    }
+    xive_tctx_pipr_set(tctx, ring_min, pipr_min, group_level);
 }
 
 void xive2_tm_set_hv_cppr(XivePresenter *xptr, XiveTCTX *tctx,
diff --git a/include/hw/ppc/xive.h b/include/hw/ppc/xive.h
index a3c2f50ece..2372d1014b 100644
--- a/include/hw/ppc/xive.h
+++ b/include/hw/ppc/xive.h
@@ -584,12 +584,11 @@ void xive_tctx_pic_print_info(XiveTCTX *tctx, GString *buf);
 Object *xive_tctx_create(Object *cpu, XivePresenter *xptr, Error **errp);
 void xive_tctx_reset(XiveTCTX *tctx);
 void xive_tctx_destroy(XiveTCTX *tctx);
-void xive_tctx_pipr_update(XiveTCTX *tctx, uint8_t ring, uint8_t priority,
-                           uint8_t group_level);
+void xive_tctx_pipr_set(XiveTCTX *tctx, uint8_t ring, uint8_t priority,
+                        uint8_t group_level);
 void xive_tctx_pipr_present(XiveTCTX *tctx, uint8_t ring, uint8_t priority,
                             uint8_t group_level);
 void xive_tctx_reset_signal(XiveTCTX *tctx, uint8_t ring);
-void xive_tctx_notify(XiveTCTX *tctx, uint8_t ring, uint8_t group_level);
 uint64_t xive_tctx_accept(XiveTCTX *tctx, uint8_t ring);
 
 /*

From 384f0365abae49b3d6a1cd46e8ae3cf4b9d4013e Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Mon, 12 May 2025 13:10:45 +1000
Subject: [PATCH 2561/2760] ppc/xive2: split tctx presentation processing from
 set CPPR
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The second part of the set CPPR operation is to process (or re-present)
any pending interrupts after CPPR is adjusted.

Split this presentation processing out into a standalone function that
can be used in other places.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Glenn Miles <milesg@linux.ibm.com>
Reviewed-by: Michael Kowal <kowal@linux.ibm.com>
Tested-by: Gautam Menghani <gautam@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20250512031100.439842-37-npiggin@gmail.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/intc/xive2.c | 137 +++++++++++++++++++++++++++---------------------
 1 file changed, 76 insertions(+), 61 deletions(-)

diff --git a/hw/intc/xive2.c b/hw/intc/xive2.c
index 0ee50a6bca..c7356c5b2f 100644
--- a/hw/intc/xive2.c
+++ b/hw/intc/xive2.c
@@ -1098,66 +1098,19 @@ void xive2_tm_ack_os_el(XivePresenter *xptr, XiveTCTX *tctx,
     xive2_tctx_accept_el(xptr, tctx, TM_QW1_OS, TM_QW1_OS);
 }
 
-/* NOTE: CPPR only exists for TM_QW1_OS and TM_QW3_HV_PHYS */
-static void xive2_tctx_set_cppr(XiveTCTX *tctx, uint8_t ring, uint8_t cppr)
+/* Re-calculate and present pending interrupts */
+static void xive2_tctx_process_pending(XiveTCTX *tctx, uint8_t sig_ring)
 {
-    uint8_t *sig_regs = &tctx->regs[ring];
+    uint8_t *sig_regs = &tctx->regs[sig_ring];
     Xive2Router *xrtr = XIVE2_ROUTER(tctx->xptr);
-    uint8_t old_cppr, backlog_prio, first_group, group_level;
+    uint8_t backlog_prio, first_group, group_level;
     uint8_t pipr_min, lsmfb_min, ring_min;
+    uint8_t cppr = sig_regs[TM_CPPR];
     bool group_enabled;
-    uint8_t nvp_blk;
-    uint32_t nvp_idx;
     Xive2Nvp nvp;
     int rc;
-    uint8_t nsr = sig_regs[TM_NSR];
 
-    g_assert(ring == TM_QW1_OS || ring == TM_QW3_HV_PHYS);
-
-    g_assert(tctx->regs[TM_QW2_HV_POOL + TM_NSR] == 0);
-    g_assert(tctx->regs[TM_QW2_HV_POOL + TM_PIPR] == 0);
-    g_assert(tctx->regs[TM_QW2_HV_POOL + TM_CPPR] == 0);
-
-    /* XXX: should show pool IPB for PHYS ring */
-    trace_xive_tctx_set_cppr(tctx->cs->cpu_index, ring,
-                             sig_regs[TM_IPB], sig_regs[TM_PIPR],
-                             cppr, nsr);
-
-    if (cppr > XIVE_PRIORITY_MAX) {
-        cppr = 0xff;
-    }
-
-    old_cppr = sig_regs[TM_CPPR];
-    sig_regs[TM_CPPR] = cppr;
-
-    /* Handle increased CPPR priority (lower value) */
-    if (cppr < old_cppr) {
-        if (cppr <= sig_regs[TM_PIPR]) {
-            /* CPPR lowered below PIPR, must un-present interrupt */
-            if (xive_nsr_indicates_exception(ring, nsr)) {
-                if (xive_nsr_indicates_group_exception(ring, nsr)) {
-                    /* redistribute precluded active grp interrupt */
-                    xive2_redistribute(xrtr, tctx,
-                                       xive_nsr_exception_ring(ring, nsr));
-                    return;
-                }
-            }
-
-            /* interrupt is VP directed, pending in IPB */
-            xive_tctx_pipr_set(tctx, ring, cppr, 0);
-            return;
-        } else {
-            /* CPPR was lowered, but still above PIPR. No action needed. */
-            return;
-        }
-    }
-
-    /* CPPR didn't change, nothing needs to be done */
-    if (cppr == old_cppr) {
-        return;
-    }
-
-    /* CPPR priority decreased (higher value) */
+    g_assert(sig_ring == TM_QW3_HV_PHYS || sig_ring == TM_QW1_OS);
 
     /*
      * Recompute the PIPR based on local pending interrupts. It will
@@ -1167,11 +1120,11 @@ again:
     pipr_min = xive_ipb_to_pipr(sig_regs[TM_IPB]);
     group_enabled = !!sig_regs[TM_LGS];
     lsmfb_min = group_enabled ? sig_regs[TM_LSMFB] : 0xff;
-    ring_min = ring;
+    ring_min = sig_ring;
     group_level = 0;
 
     /* PHYS updates also depend on POOL values */
-    if (ring == TM_QW3_HV_PHYS) {
+    if (sig_ring == TM_QW3_HV_PHYS) {
         uint8_t *pool_regs = &tctx->regs[TM_QW2_HV_POOL];
 
         /* POOL values only matter if POOL ctx is valid */
@@ -1201,20 +1154,25 @@ again:
         }
     }
 
-    rc = xive2_tctx_get_nvp_indexes(tctx, ring_min, &nvp_blk, &nvp_idx);
-    if (rc) {
-        qemu_log_mask(LOG_GUEST_ERROR, "XIVE: set CPPR on invalid context\n");
-        return;
-    }
-
     if (group_enabled &&
         lsmfb_min < cppr &&
         lsmfb_min < pipr_min) {
+
+        uint8_t nvp_blk;
+        uint32_t nvp_idx;
+
         /*
          * Thread has seen a group interrupt with a higher priority
          * than the new cppr or pending local interrupt. Check the
          * backlog
          */
+        rc = xive2_tctx_get_nvp_indexes(tctx, ring_min, &nvp_blk, &nvp_idx);
+        if (rc) {
+            qemu_log_mask(LOG_GUEST_ERROR, "XIVE: set CPPR on invalid "
+                                           "context\n");
+            return;
+        }
+
         if (xive2_router_get_nvp(xrtr, nvp_blk, nvp_idx, &nvp)) {
             qemu_log_mask(LOG_GUEST_ERROR, "XIVE: No NVP %x/%x\n",
                           nvp_blk, nvp_idx);
@@ -1260,6 +1218,63 @@ again:
     xive_tctx_pipr_set(tctx, ring_min, pipr_min, group_level);
 }
 
+/* NOTE: CPPR only exists for TM_QW1_OS and TM_QW3_HV_PHYS */
+static void xive2_tctx_set_cppr(XiveTCTX *tctx, uint8_t sig_ring, uint8_t cppr)
+{
+    uint8_t *sig_regs = &tctx->regs[sig_ring];
+    Xive2Router *xrtr = XIVE2_ROUTER(tctx->xptr);
+    uint8_t old_cppr;
+    uint8_t nsr = sig_regs[TM_NSR];
+
+    g_assert(sig_ring == TM_QW1_OS || sig_ring == TM_QW3_HV_PHYS);
+
+    g_assert(tctx->regs[TM_QW2_HV_POOL + TM_NSR] == 0);
+    g_assert(tctx->regs[TM_QW2_HV_POOL + TM_PIPR] == 0);
+    g_assert(tctx->regs[TM_QW2_HV_POOL + TM_CPPR] == 0);
+
+    /* XXX: should show pool IPB for PHYS ring */
+    trace_xive_tctx_set_cppr(tctx->cs->cpu_index, sig_ring,
+                             sig_regs[TM_IPB], sig_regs[TM_PIPR],
+                             cppr, nsr);
+
+    if (cppr > XIVE_PRIORITY_MAX) {
+        cppr = 0xff;
+    }
+
+    old_cppr = sig_regs[TM_CPPR];
+    sig_regs[TM_CPPR] = cppr;
+
+    /* Handle increased CPPR priority (lower value) */
+    if (cppr < old_cppr) {
+        if (cppr <= sig_regs[TM_PIPR]) {
+            /* CPPR lowered below PIPR, must un-present interrupt */
+            if (xive_nsr_indicates_exception(sig_ring, nsr)) {
+                if (xive_nsr_indicates_group_exception(sig_ring, nsr)) {
+                    /* redistribute precluded active grp interrupt */
+                    xive2_redistribute(xrtr, tctx,
+                                       xive_nsr_exception_ring(sig_ring, nsr));
+                    return;
+                }
+            }
+
+            /* interrupt is VP directed, pending in IPB */
+            xive_tctx_pipr_set(tctx, sig_ring, cppr, 0);
+            return;
+        } else {
+            /* CPPR was lowered, but still above PIPR. No action needed. */
+            return;
+        }
+    }
+
+    /* CPPR didn't change, nothing needs to be done */
+    if (cppr == old_cppr) {
+        return;
+    }
+
+    /* CPPR priority decreased (higher value) */
+    xive2_tctx_process_pending(tctx, sig_ring);
+}
+
 void xive2_tm_set_hv_cppr(XivePresenter *xptr, XiveTCTX *tctx,
                           hwaddr offset, uint64_t value, unsigned size)
 {

From 04627e2206dce95ecda486abf70d0ef7dd9f39f4 Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Mon, 12 May 2025 13:10:46 +1000
Subject: [PATCH 2562/2760] ppc/xive2: Consolidate presentation processing in
 context push
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

OS-push operation must re-present pending interrupts. Use the
newly created xive2_tctx_process_pending() function instead of
duplicating the logic.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Glenn Miles <milesg@linux.ibm.com>
Reviewed-by: Michael Kowal <kowal@linux.ibm.com>
Tested-by: Gautam Menghani <gautam@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20250512031100.439842-38-npiggin@gmail.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/intc/xive2.c | 42 ++++++++++--------------------------------
 1 file changed, 10 insertions(+), 32 deletions(-)

diff --git a/hw/intc/xive2.c b/hw/intc/xive2.c
index c7356c5b2f..be945bef1c 100644
--- a/hw/intc/xive2.c
+++ b/hw/intc/xive2.c
@@ -903,18 +903,14 @@ static uint8_t xive2_tctx_restore_os_ctx(Xive2Router *xrtr, XiveTCTX *tctx,
     return cppr;
 }
 
+static void xive2_tctx_process_pending(XiveTCTX *tctx, uint8_t sig_ring);
+
 static void xive2_tctx_need_resend(Xive2Router *xrtr, XiveTCTX *tctx,
                                    uint8_t nvp_blk, uint32_t nvp_idx,
                                    bool do_restore)
 {
-    XivePresenter *xptr = XIVE_PRESENTER(xrtr);
-    uint8_t ipb;
-    uint8_t backlog_level;
-    uint8_t group_level;
-    uint8_t first_group;
-    uint8_t backlog_prio;
-    uint8_t group_prio;
     uint8_t *regs = &tctx->regs[TM_QW1_OS];
+    uint8_t ipb;
     Xive2Nvp nvp;
 
     /*
@@ -946,30 +942,8 @@ static void xive2_tctx_need_resend(Xive2Router *xrtr, XiveTCTX *tctx,
     }
     /* IPB bits in the backlog are merged with the TIMA IPB bits */
     regs[TM_IPB] |= ipb;
-    backlog_prio = xive_ipb_to_pipr(regs[TM_IPB]);
-    backlog_level = 0;
 
-    first_group = xive_get_field32(NVP2_W0_PGOFIRST, nvp.w0);
-    if (first_group && regs[TM_LSMFB] < backlog_prio) {
-        group_prio = xive2_presenter_backlog_scan(xptr, nvp_blk, nvp_idx,
-                                                  first_group, &group_level);
-        regs[TM_LSMFB] = group_prio;
-        if (regs[TM_LGS] && group_prio < backlog_prio &&
-            group_prio < regs[TM_CPPR]) {
-
-            /* VP can take a group interrupt */
-            xive2_presenter_backlog_decr(xptr, nvp_blk, nvp_idx,
-                                         group_prio, group_level);
-            backlog_prio = group_prio;
-            backlog_level = group_level;
-        }
-    }
-
-    /*
-     * Set the PIPR/NSR based on the restored state.
-     * It will raise the External interrupt signal if needed.
-     */
-    xive_tctx_pipr_set(tctx, TM_QW1_OS, backlog_prio, backlog_level);
+    xive2_tctx_process_pending(tctx, TM_QW1_OS);
 }
 
 /*
@@ -1103,8 +1077,12 @@ static void xive2_tctx_process_pending(XiveTCTX *tctx, uint8_t sig_ring)
 {
     uint8_t *sig_regs = &tctx->regs[sig_ring];
     Xive2Router *xrtr = XIVE2_ROUTER(tctx->xptr);
-    uint8_t backlog_prio, first_group, group_level;
-    uint8_t pipr_min, lsmfb_min, ring_min;
+    uint8_t backlog_prio;
+    uint8_t first_group;
+    uint8_t group_level;
+    uint8_t pipr_min;
+    uint8_t lsmfb_min;
+    uint8_t ring_min;
     uint8_t cppr = sig_regs[TM_CPPR];
     bool group_enabled;
     Xive2Nvp nvp;

From 370ea4a4b6fffc30324fc8f8134483e5a749114d Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Mon, 12 May 2025 13:10:47 +1000
Subject: [PATCH 2563/2760] ppc/xive2: Avoid needless interrupt re-check on
 CPPR set
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When CPPR priority is decreased, pending interrupts do not need to be
re-checked if one is already presented because by definition that will
be the highest priority.

This prevents a presented group interrupt from being lost.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Glenn Miles <milesg@linux.ibm.com>
Reviewed-by: Michael Kowal <kowal@linux.ibm.com>
Tested-by: Gautam Menghani <gautam@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20250512031100.439842-39-npiggin@gmail.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/intc/xive2.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/hw/intc/xive2.c b/hw/intc/xive2.c
index be945bef1c..531e6517ba 100644
--- a/hw/intc/xive2.c
+++ b/hw/intc/xive2.c
@@ -1250,7 +1250,9 @@ static void xive2_tctx_set_cppr(XiveTCTX *tctx, uint8_t sig_ring, uint8_t cppr)
     }
 
     /* CPPR priority decreased (higher value) */
-    xive2_tctx_process_pending(tctx, sig_ring);
+    if (!xive_nsr_indicates_exception(sig_ring, nsr)) {
+        xive2_tctx_process_pending(tctx, sig_ring);
+    }
 }
 
 void xive2_tm_set_hv_cppr(XivePresenter *xptr, XiveTCTX *tctx,

From 203181cebdb96283520b496d6eaa49634eb51579 Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Mon, 12 May 2025 13:10:48 +1000
Subject: [PATCH 2564/2760] ppc/xive: Assert group interrupts were
 redistributed
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add some assertions to try to ensure presented group interrupts do
not get lost without being redistributed, if they become precluded
by CPPR or preempted by a higher priority interrupt.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Glenn Miles <milesg@linux.ibm.com>
Reviewed-by: Michael Kowal <kowal@linux.ibm.com>
Tested-by: Gautam Menghani <gautam@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20250512031100.439842-40-npiggin@gmail.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/intc/xive.c  | 2 ++
 hw/intc/xive2.c | 1 +
 2 files changed, 3 insertions(+)

diff --git a/hw/intc/xive.c b/hw/intc/xive.c
index 6ad84f93c7..d609d552e8 100644
--- a/hw/intc/xive.c
+++ b/hw/intc/xive.c
@@ -132,6 +132,8 @@ void xive_tctx_pipr_set(XiveTCTX *tctx, uint8_t ring, uint8_t pipr,
     uint8_t *sig_regs = xive_tctx_signal_regs(tctx, ring);
     uint8_t *regs = &tctx->regs[ring];
 
+    g_assert(!xive_nsr_indicates_group_exception(ring, sig_regs[TM_NSR]));
+
     sig_regs[TM_PIPR] = pipr;
 
     if (pipr < sig_regs[TM_CPPR]) {
diff --git a/hw/intc/xive2.c b/hw/intc/xive2.c
index 531e6517ba..a0a6b1a881 100644
--- a/hw/intc/xive2.c
+++ b/hw/intc/xive2.c
@@ -1089,6 +1089,7 @@ static void xive2_tctx_process_pending(XiveTCTX *tctx, uint8_t sig_ring)
     int rc;
 
     g_assert(sig_ring == TM_QW3_HV_PHYS || sig_ring == TM_QW1_OS);
+    g_assert(!xive_nsr_indicates_group_exception(sig_ring, sig_regs[TM_NSR]));
 
     /*
      * Recompute the PIPR based on local pending interrupts. It will

From 365e322cfb86b2e7131c3290c3a61f8d2bb224d3 Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Mon, 12 May 2025 13:10:49 +1000
Subject: [PATCH 2565/2760] ppc/xive2: implement NVP context save restore for
 POOL ring
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In preparation to implement POOL context push, add support for POOL
NVP context save/restore.

The NVP p bit is defined in the spec as follows:

    If TRUE, the CPPR of a Pool VP in the NVP is updated during store of
    the context with the CPPR of the Hard context it was running under.

It's not clear whether non-pool VPs always or never get CPPR updated.
Before this patch, OS contexts always save CPPR, so we will assume that
is the behaviour.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Glenn Miles <milesg@linux.ibm.com>
Reviewed-by: Michael Kowal <kowal@linux.ibm.com>
Tested-by: Gautam Menghani <gautam@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20250512031100.439842-41-npiggin@gmail.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/intc/xive2.c             | 51 +++++++++++++++++++++++++------------
 include/hw/ppc/xive2_regs.h |  1 +
 2 files changed, 36 insertions(+), 16 deletions(-)

diff --git a/hw/intc/xive2.c b/hw/intc/xive2.c
index a0a6b1a881..7631d48862 100644
--- a/hw/intc/xive2.c
+++ b/hw/intc/xive2.c
@@ -512,12 +512,13 @@ static void xive2_presenter_backlog_decr(XivePresenter *xptr,
  */
 
 static void xive2_tctx_save_ctx(Xive2Router *xrtr, XiveTCTX *tctx,
-                                uint8_t nvp_blk, uint32_t nvp_idx,
-                                uint8_t ring)
+                                uint8_t ring,
+                                uint8_t nvp_blk, uint32_t nvp_idx)
 {
     CPUPPCState *env = &POWERPC_CPU(tctx->cs)->env;
     uint32_t pir = env->spr_cb[SPR_PIR].default_value;
     Xive2Nvp nvp;
+    uint8_t *sig_regs = xive_tctx_signal_regs(tctx, ring);
     uint8_t *regs = &tctx->regs[ring];
 
     if (xive2_router_get_nvp(xrtr, nvp_blk, nvp_idx, &nvp)) {
@@ -553,7 +554,14 @@ static void xive2_tctx_save_ctx(Xive2Router *xrtr, XiveTCTX *tctx,
     }
 
     nvp.w2 = xive_set_field32(NVP2_W2_IPB, nvp.w2, regs[TM_IPB]);
-    nvp.w2 = xive_set_field32(NVP2_W2_CPPR, nvp.w2, regs[TM_CPPR]);
+
+    if ((nvp.w0 & NVP2_W0_P) || ring != TM_QW2_HV_POOL) {
+        /*
+         * Non-pool contexts always save CPPR (ignore p bit). XXX: Clarify
+         * whether that is the correct behaviour.
+         */
+        nvp.w2 = xive_set_field32(NVP2_W2_CPPR, nvp.w2, sig_regs[TM_CPPR]);
+    }
     if (nvp.w0 & NVP2_W0_L) {
         /*
          * Typically not used. If LSMFB is restored with 0, it will
@@ -722,7 +730,7 @@ static uint64_t xive2_tm_pull_ctx(XivePresenter *xptr, XiveTCTX *tctx,
     }
 
     if (xive2_router_get_config(xrtr) & XIVE2_VP_SAVE_RESTORE && do_save) {
-        xive2_tctx_save_ctx(xrtr, tctx, nvp_blk, nvp_idx, ring);
+        xive2_tctx_save_ctx(xrtr, tctx, ring, nvp_blk, nvp_idx);
     }
 
     /*
@@ -863,12 +871,15 @@ void xive2_tm_pull_phys_ctx_ol(XivePresenter *xptr, XiveTCTX *tctx,
     xive2_tm_pull_ctx_ol(xptr, tctx, offset, value, size, TM_QW3_HV_PHYS);
 }
 
-static uint8_t xive2_tctx_restore_os_ctx(Xive2Router *xrtr, XiveTCTX *tctx,
-                                        uint8_t nvp_blk, uint32_t nvp_idx,
-                                        Xive2Nvp *nvp)
+static uint8_t xive2_tctx_restore_ctx(Xive2Router *xrtr, XiveTCTX *tctx,
+                                      uint8_t ring,
+                                      uint8_t nvp_blk, uint32_t nvp_idx,
+                                      Xive2Nvp *nvp)
 {
     CPUPPCState *env = &POWERPC_CPU(tctx->cs)->env;
     uint32_t pir = env->spr_cb[SPR_PIR].default_value;
+    uint8_t *sig_regs = xive_tctx_signal_regs(tctx, ring);
+    uint8_t *regs = &tctx->regs[ring];
     uint8_t cppr;
 
     if (!xive2_nvp_is_hw(nvp)) {
@@ -881,10 +892,10 @@ static uint8_t xive2_tctx_restore_os_ctx(Xive2Router *xrtr, XiveTCTX *tctx,
     nvp->w2 = xive_set_field32(NVP2_W2_CPPR, nvp->w2, 0);
     xive2_router_write_nvp(xrtr, nvp_blk, nvp_idx, nvp, 2);
 
-    tctx->regs[TM_QW1_OS + TM_CPPR] = cppr;
-    tctx->regs[TM_QW1_OS + TM_LSMFB] = xive_get_field32(NVP2_W2_LSMFB, nvp->w2);
-    tctx->regs[TM_QW1_OS + TM_LGS] = xive_get_field32(NVP2_W2_LGS, nvp->w2);
-    tctx->regs[TM_QW1_OS + TM_T] = xive_get_field32(NVP2_W2_T, nvp->w2);
+    sig_regs[TM_CPPR] = cppr;
+    regs[TM_LSMFB] = xive_get_field32(NVP2_W2_LSMFB, nvp->w2);
+    regs[TM_LGS] = xive_get_field32(NVP2_W2_LGS, nvp->w2);
+    regs[TM_T] = xive_get_field32(NVP2_W2_T, nvp->w2);
 
     nvp->w1 = xive_set_field32(NVP2_W1_CO, nvp->w1, 1);
     nvp->w1 = xive_set_field32(NVP2_W1_CO_THRID_VALID, nvp->w1, 1);
@@ -893,9 +904,18 @@ static uint8_t xive2_tctx_restore_os_ctx(Xive2Router *xrtr, XiveTCTX *tctx,
     /*
      * Checkout privilege: 0:OS, 1:Pool, 2:Hard
      *
-     * TODO: we only support OS push/pull
+     * TODO: we don't support hard push/pull
      */
-    nvp->w1 = xive_set_field32(NVP2_W1_CO_PRIV, nvp->w1, 0);
+    switch (ring) {
+    case TM_QW1_OS:
+        nvp->w1 = xive_set_field32(NVP2_W1_CO_PRIV, nvp->w1, 0);
+        break;
+    case TM_QW2_HV_POOL:
+        nvp->w1 = xive_set_field32(NVP2_W1_CO_PRIV, nvp->w1, 1);
+        break;
+    default:
+        g_assert_not_reached();
+    }
 
     xive2_router_write_nvp(xrtr, nvp_blk, nvp_idx, nvp, 1);
 
@@ -930,9 +950,8 @@ static void xive2_tctx_need_resend(Xive2Router *xrtr, XiveTCTX *tctx,
     }
 
     /* Automatically restore thread context registers */
-    if (xive2_router_get_config(xrtr) & XIVE2_VP_SAVE_RESTORE &&
-        do_restore) {
-        xive2_tctx_restore_os_ctx(xrtr, tctx, nvp_blk, nvp_idx, &nvp);
+    if (xive2_router_get_config(xrtr) & XIVE2_VP_SAVE_RESTORE && do_restore) {
+        xive2_tctx_restore_ctx(xrtr, tctx, TM_QW1_OS, nvp_blk, nvp_idx, &nvp);
     }
 
     ipb = xive_get_field32(NVP2_W2_IPB, nvp.w2);
diff --git a/include/hw/ppc/xive2_regs.h b/include/hw/ppc/xive2_regs.h
index f82054661b..2a3e60abad 100644
--- a/include/hw/ppc/xive2_regs.h
+++ b/include/hw/ppc/xive2_regs.h
@@ -158,6 +158,7 @@ typedef struct Xive2Nvp {
 #define NVP2_W0_L                  PPC_BIT32(8)
 #define NVP2_W0_G                  PPC_BIT32(9)
 #define NVP2_W0_T                  PPC_BIT32(10)
+#define NVP2_W0_P                  PPC_BIT32(11)
 #define NVP2_W0_ESC_END            PPC_BIT32(25) /* 'N' bit 0:ESB  1:END */
 #define NVP2_W0_PGOFIRST           PPC_BITMASK32(26, 31)
         uint32_t       w1;

From 7a40b50757b55c2d4233c304f32df5afdd1bd63a Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Mon, 12 May 2025 13:10:50 +1000
Subject: [PATCH 2566/2760] ppc/xive2: Prevent pulling of pool context losing
 phys interrupt
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When the pool context is pulled, the shared pool/phys signal is
reset, which loses the qemu irq if a phys interrupt was presented.

Only reset the signal if a poll irq was presented.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Glenn Miles <milesg@linux.ibm.com>
Reviewed-by: Michael Kowal <kowal@linux.ibm.com>
Tested-by: Gautam Menghani <gautam@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20250512031100.439842-42-npiggin@gmail.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/intc/xive2.c | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/hw/intc/xive2.c b/hw/intc/xive2.c
index 7631d48862..112397459a 100644
--- a/hw/intc/xive2.c
+++ b/hw/intc/xive2.c
@@ -727,20 +727,22 @@ static uint64_t xive2_tm_pull_ctx(XivePresenter *xptr, XiveTCTX *tctx,
                 xive2_redistribute(xrtr, tctx, cur_ring);
             }
         }
+
+        /*
+         * Lower external interrupt line of requested ring and below except for
+         * USER, which doesn't exist.
+         */
+        if (xive_nsr_indicates_exception(cur_ring, nsr)) {
+            if (cur_ring == xive_nsr_exception_ring(cur_ring, nsr)) {
+                xive_tctx_reset_signal(tctx, cur_ring);
+            }
+        }
     }
 
     if (xive2_router_get_config(xrtr) & XIVE2_VP_SAVE_RESTORE && do_save) {
         xive2_tctx_save_ctx(xrtr, tctx, ring, nvp_blk, nvp_idx);
     }
 
-    /*
-     * Lower external interrupt line of requested ring and below except for
-     * USER, which doesn't exist.
-     */
-    for (cur_ring = TM_QW1_OS; cur_ring <= ring;
-         cur_ring += XIVE_TM_RING_SIZE) {
-        xive_tctx_reset_signal(tctx, cur_ring);
-    }
     return target_ringw2;
 }
 

From 565e6d4d2151e856026ee60d16c12a61e667cd15 Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Mon, 12 May 2025 13:10:51 +1000
Subject: [PATCH 2567/2760] ppc/xive: Redistribute phys after pulling of pool
 context
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

After pulling the pool context, if a pool irq had been presented and
was cleared in the process, there could be a pending irq in phys that
should be presented. Process the phys irq ring after pulling pool ring
to catch this case and avoid losing irqs.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Glenn Miles <milesg@linux.ibm.com>
Reviewed-by: Michael Kowal <kowal@linux.ibm.com>
Tested-by: Gautam Menghani <gautam@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20250512031100.439842-43-npiggin@gmail.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/intc/xive.c  |  3 +++
 hw/intc/xive2.c | 16 ++++++++++++++--
 2 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/hw/intc/xive.c b/hw/intc/xive.c
index d609d552e8..50a38bbf2e 100644
--- a/hw/intc/xive.c
+++ b/hw/intc/xive.c
@@ -320,6 +320,9 @@ static uint64_t xive_tm_pull_pool_ctx(XivePresenter *xptr, XiveTCTX *tctx,
 
     xive_tctx_reset_signal(tctx, TM_QW1_OS);
     xive_tctx_reset_signal(tctx, TM_QW2_HV_POOL);
+    /* Re-check phys for interrupts if pool was disabled */
+    xive_tctx_pipr_recompute_from_ipb(tctx, TM_QW3_HV_PHYS);
+
     return qw2w2;
 }
 
diff --git a/hw/intc/xive2.c b/hw/intc/xive2.c
index 112397459a..e3f9ff384a 100644
--- a/hw/intc/xive2.c
+++ b/hw/intc/xive2.c
@@ -683,6 +683,8 @@ static void xive2_redistribute(Xive2Router *xrtr, XiveTCTX *tctx, uint8_t ring)
     xive_tctx_reset_signal(tctx, ring);
 }
 
+static void xive2_tctx_process_pending(XiveTCTX *tctx, uint8_t sig_ring);
+
 static uint64_t xive2_tm_pull_ctx(XivePresenter *xptr, XiveTCTX *tctx,
                                   hwaddr offset, unsigned size, uint8_t ring)
 {
@@ -739,6 +741,18 @@ static uint64_t xive2_tm_pull_ctx(XivePresenter *xptr, XiveTCTX *tctx,
         }
     }
 
+    if (ring == TM_QW2_HV_POOL) {
+        /* Re-check phys for interrupts if pool was disabled */
+        nsr = tctx->regs[TM_QW3_HV_PHYS + TM_NSR];
+        if (xive_nsr_indicates_exception(TM_QW3_HV_PHYS, nsr)) {
+            /* Ring must be PHYS because POOL would have been redistributed */
+            g_assert(xive_nsr_exception_ring(TM_QW3_HV_PHYS, nsr) ==
+                                                           TM_QW3_HV_PHYS);
+        } else {
+            xive2_tctx_process_pending(tctx, TM_QW3_HV_PHYS);
+        }
+    }
+
     if (xive2_router_get_config(xrtr) & XIVE2_VP_SAVE_RESTORE && do_save) {
         xive2_tctx_save_ctx(xrtr, tctx, ring, nvp_blk, nvp_idx);
     }
@@ -925,8 +939,6 @@ static uint8_t xive2_tctx_restore_ctx(Xive2Router *xrtr, XiveTCTX *tctx,
     return cppr;
 }
 
-static void xive2_tctx_process_pending(XiveTCTX *tctx, uint8_t sig_ring);
-
 static void xive2_tctx_need_resend(Xive2Router *xrtr, XiveTCTX *tctx,
                                    uint8_t nvp_blk, uint32_t nvp_idx,
                                    bool do_restore)

From ca0081ef7ece566e877e9f4ceab9e9988d08fb78 Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Mon, 12 May 2025 13:10:52 +1000
Subject: [PATCH 2568/2760] ppc/xive: Check TIMA operations validity
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Certain TIMA operations should only be performed when a ring is valid,
others when the ring is invalid, and they are considered undefined if
used incorrectly. Add checks for this condition.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Glenn Miles <milesg@linux.ibm.com>
Reviewed-by: Michael Kowal <kowal@linux.ibm.com>
Tested-by: Gautam Menghani <gautam@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20250512031100.439842-44-npiggin@gmail.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/intc/xive.c        | 196 +++++++++++++++++++++++++-----------------
 include/hw/ppc/xive.h |   1 +
 2 files changed, 116 insertions(+), 81 deletions(-)

diff --git a/hw/intc/xive.c b/hw/intc/xive.c
index 50a38bbf2e..6589c0a523 100644
--- a/hw/intc/xive.c
+++ b/hw/intc/xive.c
@@ -25,6 +25,19 @@
 /*
  * XIVE Thread Interrupt Management context
  */
+bool xive_ring_valid(XiveTCTX *tctx, uint8_t ring)
+{
+    uint8_t cur_ring;
+
+    for (cur_ring = ring; cur_ring <= TM_QW3_HV_PHYS;
+         cur_ring += XIVE_TM_RING_SIZE) {
+        if (!(tctx->regs[cur_ring + TM_WORD2] & 0x80)) {
+            return false;
+        }
+    }
+    return true;
+}
+
 bool xive_nsr_indicates_exception(uint8_t ring, uint8_t nsr)
 {
     switch (ring) {
@@ -663,6 +676,8 @@ typedef struct XiveTmOp {
     uint8_t  page_offset;
     uint32_t op_offset;
     unsigned size;
+    bool     hw_ok;
+    bool     sw_ok;
     void     (*write_handler)(XivePresenter *xptr, XiveTCTX *tctx,
                               hwaddr offset,
                               uint64_t value, unsigned size);
@@ -675,34 +690,34 @@ static const XiveTmOp xive_tm_operations[] = {
      * MMIOs below 2K : raw values and special operations without side
      * effects
      */
-    { XIVE_TM_OS_PAGE, TM_QW1_OS + TM_CPPR,       1, xive_tm_set_os_cppr,
-                                                     NULL },
-    { XIVE_TM_HV_PAGE, TM_QW1_OS + TM_WORD2,      4, xive_tm_push_os_ctx,
-                                                     NULL },
-    { XIVE_TM_HV_PAGE, TM_QW3_HV_PHYS + TM_CPPR,  1, xive_tm_set_hv_cppr,
-                                                     NULL },
-    { XIVE_TM_HV_PAGE, TM_QW3_HV_PHYS + TM_WORD2, 1, xive_tm_vt_push,
-                                                     NULL },
-    { XIVE_TM_HV_PAGE, TM_QW3_HV_PHYS + TM_WORD2, 1, NULL,
-                                                     xive_tm_vt_poll },
+    { XIVE_TM_OS_PAGE, TM_QW1_OS + TM_CPPR,       1, true, true,
+      xive_tm_set_os_cppr, NULL },
+    { XIVE_TM_HV_PAGE, TM_QW1_OS + TM_WORD2,      4, true, true,
+      xive_tm_push_os_ctx, NULL },
+    { XIVE_TM_HV_PAGE, TM_QW3_HV_PHYS + TM_CPPR,  1, true, true,
+      xive_tm_set_hv_cppr, NULL },
+    { XIVE_TM_HV_PAGE, TM_QW3_HV_PHYS + TM_WORD2, 1, false, true,
+      xive_tm_vt_push, NULL },
+    { XIVE_TM_HV_PAGE, TM_QW3_HV_PHYS + TM_WORD2, 1, true, true,
+      NULL, xive_tm_vt_poll },
 
     /* MMIOs above 2K : special operations with side effects */
-    { XIVE_TM_OS_PAGE, TM_SPC_ACK_OS_REG,         2, NULL,
-                                                     xive_tm_ack_os_reg },
-    { XIVE_TM_OS_PAGE, TM_SPC_SET_OS_PENDING,     1, xive_tm_set_os_pending,
-                                                     NULL },
-    { XIVE_TM_HV_PAGE, TM_SPC_PULL_OS_CTX,        4, NULL,
-                                                     xive_tm_pull_os_ctx },
-    { XIVE_TM_HV_PAGE, TM_SPC_PULL_OS_CTX,        8, NULL,
-                                                     xive_tm_pull_os_ctx },
-    { XIVE_TM_HV_PAGE, TM_SPC_ACK_HV_REG,         2, NULL,
-                                                     xive_tm_ack_hv_reg },
-    { XIVE_TM_HV_PAGE, TM_SPC_PULL_POOL_CTX,      4, NULL,
-                                                     xive_tm_pull_pool_ctx },
-    { XIVE_TM_HV_PAGE, TM_SPC_PULL_POOL_CTX,      8, NULL,
-                                                     xive_tm_pull_pool_ctx },
-    { XIVE_TM_HV_PAGE, TM_SPC_PULL_PHYS_CTX,      1, NULL,
-                                                     xive_tm_pull_phys_ctx },
+    { XIVE_TM_OS_PAGE, TM_SPC_ACK_OS_REG,         2, true, false,
+      NULL, xive_tm_ack_os_reg },
+    { XIVE_TM_OS_PAGE, TM_SPC_SET_OS_PENDING,     1, true, false,
+      xive_tm_set_os_pending, NULL },
+    { XIVE_TM_HV_PAGE, TM_SPC_PULL_OS_CTX,        4, true, false,
+      NULL, xive_tm_pull_os_ctx },
+    { XIVE_TM_HV_PAGE, TM_SPC_PULL_OS_CTX,        8, true, false,
+      NULL, xive_tm_pull_os_ctx },
+    { XIVE_TM_HV_PAGE, TM_SPC_ACK_HV_REG,         2, true, false,
+      NULL, xive_tm_ack_hv_reg },
+    { XIVE_TM_HV_PAGE, TM_SPC_PULL_POOL_CTX,      4, true, false,
+      NULL, xive_tm_pull_pool_ctx },
+    { XIVE_TM_HV_PAGE, TM_SPC_PULL_POOL_CTX,      8, true, false,
+      NULL, xive_tm_pull_pool_ctx },
+    { XIVE_TM_HV_PAGE, TM_SPC_PULL_PHYS_CTX,      1, true, false,
+      NULL, xive_tm_pull_phys_ctx },
 };
 
 static const XiveTmOp xive2_tm_operations[] = {
@@ -710,52 +725,48 @@ static const XiveTmOp xive2_tm_operations[] = {
      * MMIOs below 2K : raw values and special operations without side
      * effects
      */
-    { XIVE_TM_OS_PAGE, TM_QW1_OS + TM_CPPR,       1, xive2_tm_set_os_cppr,
-                                                     NULL },
-    { XIVE_TM_HV_PAGE, TM_QW1_OS + TM_WORD2,      4, xive2_tm_push_os_ctx,
-                                                     NULL },
-    { XIVE_TM_HV_PAGE, TM_QW1_OS + TM_WORD2,      8, xive2_tm_push_os_ctx,
-                                                     NULL },
-    { XIVE_TM_OS_PAGE, TM_QW1_OS + TM_LGS,        1, xive_tm_set_os_lgs,
-                                                     NULL },
-    { XIVE_TM_HV_PAGE, TM_QW3_HV_PHYS + TM_CPPR,  1, xive2_tm_set_hv_cppr,
-                                                     NULL },
-    { XIVE_TM_HV_PAGE, TM_QW3_HV_PHYS + TM_WORD2, 1, xive_tm_vt_push,
-                                                     NULL },
-    { XIVE_TM_HV_PAGE, TM_QW3_HV_PHYS + TM_WORD2, 1, NULL,
-                                                     xive_tm_vt_poll },
-    { XIVE_TM_HV_PAGE, TM_QW3_HV_PHYS + TM_T,     1, xive2_tm_set_hv_target,
-                                                     NULL },
+    { XIVE_TM_OS_PAGE, TM_QW1_OS + TM_CPPR,       1, true, true,
+      xive2_tm_set_os_cppr, NULL },
+    { XIVE_TM_HV_PAGE, TM_QW1_OS + TM_WORD2,      4, true, true,
+      xive2_tm_push_os_ctx, NULL },
+    { XIVE_TM_HV_PAGE, TM_QW1_OS + TM_WORD2,      8, true, true,
+      xive2_tm_push_os_ctx, NULL },
+    { XIVE_TM_OS_PAGE, TM_QW1_OS + TM_LGS,        1, true, true,
+      xive_tm_set_os_lgs, NULL },
+    { XIVE_TM_HV_PAGE, TM_QW3_HV_PHYS + TM_CPPR,  1, true, true,
+      xive2_tm_set_hv_cppr, NULL },
+    { XIVE_TM_HV_PAGE, TM_QW3_HV_PHYS + TM_WORD2, 1, true, true,
+      NULL, xive_tm_vt_poll },
+    { XIVE_TM_HV_PAGE, TM_QW3_HV_PHYS + TM_T,     1, true, true,
+      xive2_tm_set_hv_target, NULL },
 
     /* MMIOs above 2K : special operations with side effects */
-    { XIVE_TM_OS_PAGE, TM_SPC_ACK_OS_REG,         2, NULL,
-                                                   xive_tm_ack_os_reg },
-    { XIVE_TM_OS_PAGE, TM_SPC_SET_OS_PENDING,     1, xive_tm_set_os_pending,
-                                                     NULL },
-    { XIVE_TM_HV_PAGE, TM_SPC_PULL_OS_CTX_G2,     4, NULL,
-                                                     xive2_tm_pull_os_ctx },
-    { XIVE_TM_HV_PAGE, TM_SPC_PULL_OS_CTX,        4, NULL,
-                                                     xive2_tm_pull_os_ctx },
-    { XIVE_TM_HV_PAGE, TM_SPC_PULL_OS_CTX,        8, NULL,
-                                                     xive2_tm_pull_os_ctx },
-    { XIVE_TM_HV_PAGE, TM_SPC_ACK_HV_REG,         2, NULL,
-                                                     xive_tm_ack_hv_reg },
-    { XIVE_TM_HV_PAGE, TM_SPC_PULL_POOL_CTX_G2,   4, NULL,
-                                                     xive2_tm_pull_pool_ctx },
-    { XIVE_TM_HV_PAGE, TM_SPC_PULL_POOL_CTX,      4, NULL,
-                                                     xive2_tm_pull_pool_ctx },
-    { XIVE_TM_HV_PAGE, TM_SPC_PULL_POOL_CTX,      8, NULL,
-                                                     xive2_tm_pull_pool_ctx },
-    { XIVE_TM_HV_PAGE, TM_SPC_PULL_OS_CTX_OL,     1, xive2_tm_pull_os_ctx_ol,
-                                                     NULL },
-    { XIVE_TM_HV_PAGE, TM_SPC_PULL_PHYS_CTX_G2,   4, NULL,
-                                                     xive2_tm_pull_phys_ctx },
-    { XIVE_TM_HV_PAGE, TM_SPC_PULL_PHYS_CTX,      1, NULL,
-                                                     xive2_tm_pull_phys_ctx },
-    { XIVE_TM_HV_PAGE, TM_SPC_PULL_PHYS_CTX_OL,   1, xive2_tm_pull_phys_ctx_ol,
-                                                     NULL },
-    { XIVE_TM_OS_PAGE, TM_SPC_ACK_OS_EL,          1, xive2_tm_ack_os_el,
-                                                     NULL },
+    { XIVE_TM_OS_PAGE, TM_SPC_ACK_OS_REG,         2, true, false,
+      NULL, xive_tm_ack_os_reg },
+    { XIVE_TM_HV_PAGE, TM_SPC_PULL_OS_CTX_G2,     4, true, false,
+      NULL, xive2_tm_pull_os_ctx },
+    { XIVE_TM_HV_PAGE, TM_SPC_PULL_OS_CTX,        4, true, false,
+      NULL, xive2_tm_pull_os_ctx },
+    { XIVE_TM_HV_PAGE, TM_SPC_PULL_OS_CTX,        8, true, false,
+      NULL, xive2_tm_pull_os_ctx },
+    { XIVE_TM_HV_PAGE, TM_SPC_ACK_HV_REG,         2, true, false,
+      NULL, xive_tm_ack_hv_reg },
+    { XIVE_TM_HV_PAGE, TM_SPC_PULL_POOL_CTX_G2,   4, true, false,
+      NULL, xive2_tm_pull_pool_ctx },
+    { XIVE_TM_HV_PAGE, TM_SPC_PULL_POOL_CTX,      4, true, false,
+      NULL, xive2_tm_pull_pool_ctx },
+    { XIVE_TM_HV_PAGE, TM_SPC_PULL_POOL_CTX,      8, true, false,
+      NULL, xive2_tm_pull_pool_ctx },
+    { XIVE_TM_HV_PAGE, TM_SPC_PULL_OS_CTX_OL,     1, true, false,
+      xive2_tm_pull_os_ctx_ol, NULL },
+    { XIVE_TM_HV_PAGE, TM_SPC_PULL_PHYS_CTX_G2,   4, true, false,
+      NULL, xive2_tm_pull_phys_ctx },
+    { XIVE_TM_HV_PAGE, TM_SPC_PULL_PHYS_CTX,      1, true, false,
+      NULL, xive2_tm_pull_phys_ctx },
+    { XIVE_TM_HV_PAGE, TM_SPC_PULL_PHYS_CTX_OL,   1, true, false,
+      xive2_tm_pull_phys_ctx_ol, NULL },
+    { XIVE_TM_OS_PAGE, TM_SPC_ACK_OS_EL,          1, true, false,
+      xive2_tm_ack_os_el, NULL },
 };
 
 static const XiveTmOp *xive_tm_find_op(XivePresenter *xptr, hwaddr offset,
@@ -797,18 +808,28 @@ void xive_tctx_tm_write(XivePresenter *xptr, XiveTCTX *tctx, hwaddr offset,
                         uint64_t value, unsigned size)
 {
     const XiveTmOp *xto;
+    uint8_t ring = offset & TM_RING_OFFSET;
+    bool is_valid = xive_ring_valid(tctx, ring);
+    bool hw_owned = is_valid;
 
     trace_xive_tctx_tm_write(tctx->cs->cpu_index, offset, size, value);
 
-    /*
-     * TODO: check V bit in Q[0-3]W2
-     */
-
     /*
      * First, check for special operations in the 2K region
      */
+    xto = xive_tm_find_op(tctx->xptr, offset, size, true);
+    if (xto) {
+        if (hw_owned && !xto->hw_ok) {
+            qemu_log_mask(LOG_GUEST_ERROR, "XIVE: undefined write to HW TIMA "
+                          "@%"HWADDR_PRIx" size %d\n", offset, size);
+        }
+        if (!hw_owned && !xto->sw_ok) {
+            qemu_log_mask(LOG_GUEST_ERROR, "XIVE: undefined write to SW TIMA "
+                          "@%"HWADDR_PRIx" size %d\n", offset, size);
+        }
+    }
+
     if (offset & TM_SPECIAL_OP) {
-        xto = xive_tm_find_op(tctx->xptr, offset, size, true);
         if (!xto) {
             qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid write access at TIMA "
                           "@%"HWADDR_PRIx" size %d\n", offset, size);
@@ -821,7 +842,6 @@ void xive_tctx_tm_write(XivePresenter *xptr, XiveTCTX *tctx, hwaddr offset,
     /*
      * Then, for special operations in the region below 2K.
      */
-    xto = xive_tm_find_op(tctx->xptr, offset, size, true);
     if (xto) {
         xto->write_handler(xptr, tctx, offset, value, size);
         return;
@@ -830,6 +850,11 @@ void xive_tctx_tm_write(XivePresenter *xptr, XiveTCTX *tctx, hwaddr offset,
     /*
      * Finish with raw access to the register values
      */
+    if (hw_owned) {
+        /* Store context operations are dangerous when context is valid */
+        qemu_log_mask(LOG_GUEST_ERROR, "XIVE: undefined write to HW TIMA "
+                      "@%"HWADDR_PRIx" size %d\n", offset, size);
+    }
     xive_tm_raw_write(tctx, offset, value, size);
 }
 
@@ -837,17 +862,27 @@ uint64_t xive_tctx_tm_read(XivePresenter *xptr, XiveTCTX *tctx, hwaddr offset,
                            unsigned size)
 {
     const XiveTmOp *xto;
+    uint8_t ring = offset & TM_RING_OFFSET;
+    bool is_valid = xive_ring_valid(tctx, ring);
+    bool hw_owned = is_valid;
     uint64_t ret;
 
-    /*
-     * TODO: check V bit in Q[0-3]W2
-     */
+    xto = xive_tm_find_op(tctx->xptr, offset, size, false);
+    if (xto) {
+        if (hw_owned && !xto->hw_ok) {
+            qemu_log_mask(LOG_GUEST_ERROR, "XIVE: undefined read to HW TIMA "
+                          "@%"HWADDR_PRIx" size %d\n", offset, size);
+        }
+        if (!hw_owned && !xto->sw_ok) {
+            qemu_log_mask(LOG_GUEST_ERROR, "XIVE: undefined read to SW TIMA "
+                          "@%"HWADDR_PRIx" size %d\n", offset, size);
+        }
+    }
 
     /*
      * First, check for special operations in the 2K region
      */
     if (offset & TM_SPECIAL_OP) {
-        xto = xive_tm_find_op(tctx->xptr, offset, size, false);
         if (!xto) {
             qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid read access to TIMA"
                           "@%"HWADDR_PRIx" size %d\n", offset, size);
@@ -860,7 +895,6 @@ uint64_t xive_tctx_tm_read(XivePresenter *xptr, XiveTCTX *tctx, hwaddr offset,
     /*
      * Then, for special operations in the region below 2K.
      */
-    xto = xive_tm_find_op(tctx->xptr, offset, size, false);
     if (xto) {
         ret = xto->read_handler(xptr, tctx, offset, size);
         goto out;
diff --git a/include/hw/ppc/xive.h b/include/hw/ppc/xive.h
index 2372d1014b..b7ca8544e4 100644
--- a/include/hw/ppc/xive.h
+++ b/include/hw/ppc/xive.h
@@ -365,6 +365,7 @@ static inline uint32_t xive_tctx_word2(uint8_t *ring)
     return *((uint32_t *) &ring[TM_WORD2]);
 }
 
+bool xive_ring_valid(XiveTCTX *tctx, uint8_t ring);
 bool xive_nsr_indicates_exception(uint8_t ring, uint8_t nsr);
 bool xive_nsr_indicates_group_exception(uint8_t ring, uint8_t nsr);
 uint8_t xive_nsr_exception_ring(uint8_t ring, uint8_t nsr);

From ba127a1e48d34f6c805000dc881e240fc4f2bd1d Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Mon, 12 May 2025 13:10:53 +1000
Subject: [PATCH 2569/2760] ppc/xive2: Implement pool context push TIMA op
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Implement pool context push TIMA op.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Glenn Miles <milesg@linux.ibm.com>
Reviewed-by: Michael Kowal <kowal@linux.ibm.com>
Tested-by: Gautam Menghani <gautam@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20250512031100.439842-45-npiggin@gmail.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/intc/xive.c         |  4 ++++
 hw/intc/xive2.c        | 50 ++++++++++++++++++++++++++++--------------
 include/hw/ppc/xive2.h |  2 ++
 3 files changed, 39 insertions(+), 17 deletions(-)

diff --git a/hw/intc/xive.c b/hw/intc/xive.c
index 6589c0a523..e7f77be2f7 100644
--- a/hw/intc/xive.c
+++ b/hw/intc/xive.c
@@ -733,6 +733,10 @@ static const XiveTmOp xive2_tm_operations[] = {
       xive2_tm_push_os_ctx, NULL },
     { XIVE_TM_OS_PAGE, TM_QW1_OS + TM_LGS,        1, true, true,
       xive_tm_set_os_lgs, NULL },
+    { XIVE_TM_HV_PAGE, TM_QW2_HV_POOL + TM_WORD2, 4, true, true,
+      xive2_tm_push_pool_ctx, NULL },
+    { XIVE_TM_HV_PAGE, TM_QW2_HV_POOL + TM_WORD2, 8, true, true,
+      xive2_tm_push_pool_ctx, NULL },
     { XIVE_TM_HV_PAGE, TM_QW3_HV_PHYS + TM_CPPR,  1, true, true,
       xive2_tm_set_hv_cppr, NULL },
     { XIVE_TM_HV_PAGE, TM_QW3_HV_PHYS + TM_WORD2, 1, true, true,
diff --git a/hw/intc/xive2.c b/hw/intc/xive2.c
index e3f9ff384a..4244e1d02b 100644
--- a/hw/intc/xive2.c
+++ b/hw/intc/xive2.c
@@ -583,6 +583,7 @@ static void xive2_tctx_save_ctx(Xive2Router *xrtr, XiveTCTX *tctx,
     xive2_router_write_nvp(xrtr, nvp_blk, nvp_idx, &nvp, 1);
 }
 
+/* POOL cam is the same as OS cam encoding */
 static void xive2_cam_decode(uint32_t cam, uint8_t *nvp_blk,
                              uint32_t *nvp_idx, bool *valid, bool *hw)
 {
@@ -940,10 +941,11 @@ static uint8_t xive2_tctx_restore_ctx(Xive2Router *xrtr, XiveTCTX *tctx,
 }
 
 static void xive2_tctx_need_resend(Xive2Router *xrtr, XiveTCTX *tctx,
+                                   uint8_t ring,
                                    uint8_t nvp_blk, uint32_t nvp_idx,
                                    bool do_restore)
 {
-    uint8_t *regs = &tctx->regs[TM_QW1_OS];
+    uint8_t *regs = &tctx->regs[ring];
     uint8_t ipb;
     Xive2Nvp nvp;
 
@@ -965,7 +967,7 @@ static void xive2_tctx_need_resend(Xive2Router *xrtr, XiveTCTX *tctx,
 
     /* Automatically restore thread context registers */
     if (xive2_router_get_config(xrtr) & XIVE2_VP_SAVE_RESTORE && do_restore) {
-        xive2_tctx_restore_ctx(xrtr, tctx, TM_QW1_OS, nvp_blk, nvp_idx, &nvp);
+        xive2_tctx_restore_ctx(xrtr, tctx, ring, nvp_blk, nvp_idx, &nvp);
     }
 
     ipb = xive_get_field32(NVP2_W2_IPB, nvp.w2);
@@ -976,48 +978,62 @@ static void xive2_tctx_need_resend(Xive2Router *xrtr, XiveTCTX *tctx,
     /* IPB bits in the backlog are merged with the TIMA IPB bits */
     regs[TM_IPB] |= ipb;
 
-    xive2_tctx_process_pending(tctx, TM_QW1_OS);
+    xive2_tctx_process_pending(tctx, ring == TM_QW2_HV_POOL ?
+                                         TM_QW3_HV_PHYS : ring);
 }
 
 /*
- * Updating the OS CAM line can trigger a resend of interrupt
+ * Updating the ring CAM line can trigger a resend of interrupt
  */
-void xive2_tm_push_os_ctx(XivePresenter *xptr, XiveTCTX *tctx,
-                          hwaddr offset, uint64_t value, unsigned size)
+static void xive2_tm_push_ctx(XivePresenter *xptr, XiveTCTX *tctx,
+                              hwaddr offset, uint64_t value, unsigned size,
+                              uint8_t ring)
 {
     uint32_t cam;
-    uint32_t qw1w2;
-    uint64_t qw1dw1;
+    uint32_t w2;
+    uint64_t dw1;
     uint8_t nvp_blk;
     uint32_t nvp_idx;
-    bool vo;
+    bool v;
     bool do_restore;
 
     /* First update the thead context */
     switch (size) {
     case 4:
         cam = value;
-        qw1w2 = cpu_to_be32(cam);
-        memcpy(&tctx->regs[TM_QW1_OS + TM_WORD2], &qw1w2, 4);
+        w2 = cpu_to_be32(cam);
+        memcpy(&tctx->regs[ring + TM_WORD2], &w2, 4);
         break;
     case 8:
         cam = value >> 32;
-        qw1dw1 = cpu_to_be64(value);
-        memcpy(&tctx->regs[TM_QW1_OS + TM_WORD2], &qw1dw1, 8);
+        dw1 = cpu_to_be64(value);
+        memcpy(&tctx->regs[ring + TM_WORD2], &dw1, 8);
         break;
     default:
         g_assert_not_reached();
     }
 
-    xive2_cam_decode(cam, &nvp_blk, &nvp_idx, &vo, &do_restore);
+    xive2_cam_decode(cam, &nvp_blk, &nvp_idx, &v, &do_restore);
 
     /* Check the interrupt pending bits */
-    if (vo) {
-        xive2_tctx_need_resend(XIVE2_ROUTER(xptr), tctx, nvp_blk, nvp_idx,
-                               do_restore);
+    if (v) {
+        xive2_tctx_need_resend(XIVE2_ROUTER(xptr), tctx, ring,
+                               nvp_blk, nvp_idx, do_restore);
     }
 }
 
+void xive2_tm_push_os_ctx(XivePresenter *xptr, XiveTCTX *tctx,
+                          hwaddr offset, uint64_t value, unsigned size)
+{
+    xive2_tm_push_ctx(xptr, tctx, offset, value, size, TM_QW1_OS);
+}
+
+void xive2_tm_push_pool_ctx(XivePresenter *xptr, XiveTCTX *tctx,
+                            hwaddr offset, uint64_t value, unsigned size)
+{
+    xive2_tm_push_ctx(xptr, tctx, offset, value, size, TM_QW2_HV_POOL);
+}
+
 /* returns -1 if ring is invalid, but still populates block and index */
 static int xive2_tctx_get_nvp_indexes(XiveTCTX *tctx, uint8_t ring,
                                       uint8_t *nvp_blk, uint32_t *nvp_idx)
diff --git a/include/hw/ppc/xive2.h b/include/hw/ppc/xive2.h
index a91b99057c..c1ab06a55a 100644
--- a/include/hw/ppc/xive2.h
+++ b/include/hw/ppc/xive2.h
@@ -140,6 +140,8 @@ bool xive2_tm_irq_precluded(XiveTCTX *tctx, int ring, uint8_t priority);
 void xive2_tm_set_lsmfb(XiveTCTX *tctx, int ring, uint8_t priority);
 void xive2_tm_set_hv_target(XivePresenter *xptr, XiveTCTX *tctx,
                             hwaddr offset, uint64_t value, unsigned size);
+void xive2_tm_push_pool_ctx(XivePresenter *xptr, XiveTCTX *tctx,
+                            hwaddr offset, uint64_t value, unsigned size);
 uint64_t xive2_tm_pull_pool_ctx(XivePresenter *xptr, XiveTCTX *tctx,
                                 hwaddr offset, unsigned size);
 uint64_t xive2_tm_pull_phys_ctx(XivePresenter *xptr, XiveTCTX *tctx,

From 6936d2f561759c00993217a424ddeb1554c5f1ff Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Mon, 12 May 2025 13:10:54 +1000
Subject: [PATCH 2570/2760] ppc/xive2: redistribute group interrupts on context
 push
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When pushing a context, any presented group interrupt should be
redistributed before processing pending interrupts to present
highest priority.

This can occur when pushing the POOL ring when the valid PHYS
ring has a group interrupt presented, because they share signal
registers.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Glenn Miles <milesg@linux.ibm.com>
Reviewed-by: Michael Kowal <kowal@linux.ibm.com>
Tested-by: Gautam Menghani <gautam@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20250512031100.439842-46-npiggin@gmail.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/intc/xive2.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/hw/intc/xive2.c b/hw/intc/xive2.c
index 4244e1d02b..23eb85bb86 100644
--- a/hw/intc/xive2.c
+++ b/hw/intc/xive2.c
@@ -945,8 +945,9 @@ static void xive2_tctx_need_resend(Xive2Router *xrtr, XiveTCTX *tctx,
                                    uint8_t nvp_blk, uint32_t nvp_idx,
                                    bool do_restore)
 {
+    uint8_t *sig_regs = xive_tctx_signal_regs(tctx, ring);
     uint8_t *regs = &tctx->regs[ring];
-    uint8_t ipb;
+    uint8_t ipb, nsr = sig_regs[TM_NSR];
     Xive2Nvp nvp;
 
     /*
@@ -978,6 +979,11 @@ static void xive2_tctx_need_resend(Xive2Router *xrtr, XiveTCTX *tctx,
     /* IPB bits in the backlog are merged with the TIMA IPB bits */
     regs[TM_IPB] |= ipb;
 
+    if (xive_nsr_indicates_group_exception(ring, nsr)) {
+        /* redistribute precluded active grp interrupt */
+        g_assert(ring == TM_QW2_HV_POOL); /* PHYS ring has the grp interrupt */
+        xive2_redistribute(xrtr, tctx, xive_nsr_exception_ring(ring, nsr));
+    }
     xive2_tctx_process_pending(tctx, ring == TM_QW2_HV_POOL ?
                                          TM_QW3_HV_PHYS : ring);
 }

From 6ef77843603b89b1e48a06ca0644e74e45297839 Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Mon, 12 May 2025 13:10:55 +1000
Subject: [PATCH 2571/2760] ppc/xive2: Implement set_os_pending TIMA op
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

xive2 must take into account redistribution of group interrupts if
the VP directed priority exceeds the group interrupt priority after
this operation. The xive1 code is not group aware so implement this
for xive2.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Glenn Miles <milesg@linux.ibm.com>
Reviewed-by: Michael Kowal <kowal@linux.ibm.com>
Tested-by: Gautam Menghani <gautam@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20250512031100.439842-47-npiggin@gmail.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/intc/xive.c         |  2 ++
 hw/intc/xive2.c        | 28 ++++++++++++++++++++++++++++
 include/hw/ppc/xive2.h |  2 ++
 3 files changed, 32 insertions(+)

diff --git a/hw/intc/xive.c b/hw/intc/xive.c
index e7f77be2f7..25cb3877cb 100644
--- a/hw/intc/xive.c
+++ b/hw/intc/xive.c
@@ -747,6 +747,8 @@ static const XiveTmOp xive2_tm_operations[] = {
     /* MMIOs above 2K : special operations with side effects */
     { XIVE_TM_OS_PAGE, TM_SPC_ACK_OS_REG,         2, true, false,
       NULL, xive_tm_ack_os_reg },
+    { XIVE_TM_OS_PAGE, TM_SPC_SET_OS_PENDING,     1, true, false,
+      xive2_tm_set_os_pending, NULL },
     { XIVE_TM_HV_PAGE, TM_SPC_PULL_OS_CTX_G2,     4, true, false,
       NULL, xive2_tm_pull_os_ctx },
     { XIVE_TM_HV_PAGE, TM_SPC_PULL_OS_CTX,        4, true, false,
diff --git a/hw/intc/xive2.c b/hw/intc/xive2.c
index 23eb85bb86..f9eaea1192 100644
--- a/hw/intc/xive2.c
+++ b/hw/intc/xive2.c
@@ -1323,6 +1323,34 @@ void xive2_tm_set_os_cppr(XivePresenter *xptr, XiveTCTX *tctx,
     xive2_tctx_set_cppr(tctx, TM_QW1_OS, value & 0xff);
 }
 
+/*
+ * Adjust the IPB to allow a CPU to process event queues of other
+ * priorities during one physical interrupt cycle.
+ */
+void xive2_tm_set_os_pending(XivePresenter *xptr, XiveTCTX *tctx,
+                             hwaddr offset, uint64_t value, unsigned size)
+{
+    Xive2Router *xrtr = XIVE2_ROUTER(xptr);
+    uint8_t ring = TM_QW1_OS;
+    uint8_t *regs = &tctx->regs[ring];
+    uint8_t priority = value & 0xff;
+
+    /*
+     * XXX: should this simply set a bit in IPB and wait for it to be picked
+     * up next cycle, or is it supposed to present it now? We implement the
+     * latter here.
+     */
+    regs[TM_IPB] |= xive_priority_to_ipb(priority);
+    if (xive_ipb_to_pipr(regs[TM_IPB]) >= regs[TM_PIPR]) {
+        return;
+    }
+    if (xive_nsr_indicates_group_exception(ring, regs[TM_NSR])) {
+        xive2_redistribute(xrtr, tctx, ring);
+    }
+
+    xive_tctx_pipr_present(tctx, ring, priority, 0);
+}
+
 static void xive2_tctx_set_target(XiveTCTX *tctx, uint8_t ring, uint8_t target)
 {
     uint8_t *regs = &tctx->regs[ring];
diff --git a/include/hw/ppc/xive2.h b/include/hw/ppc/xive2.h
index c1ab06a55a..45266c2a8b 100644
--- a/include/hw/ppc/xive2.h
+++ b/include/hw/ppc/xive2.h
@@ -130,6 +130,8 @@ void xive2_tm_set_hv_cppr(XivePresenter *xptr, XiveTCTX *tctx,
                           hwaddr offset, uint64_t value, unsigned size);
 void xive2_tm_set_os_cppr(XivePresenter *xptr, XiveTCTX *tctx,
                           hwaddr offset, uint64_t value, unsigned size);
+void xive2_tm_set_os_pending(XivePresenter *xptr, XiveTCTX *tctx,
+                             hwaddr offset, uint64_t value, unsigned size);
 void xive2_tm_push_os_ctx(XivePresenter *xptr, XiveTCTX *tctx, hwaddr offset,
                            uint64_t value, unsigned size);
 uint64_t xive2_tm_pull_os_ctx(XivePresenter *xptr, XiveTCTX *tctx,

From f030f35109062a3cf815e12939a66c9df8354714 Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Mon, 12 May 2025 13:10:56 +1000
Subject: [PATCH 2572/2760] ppc/xive2: Implement POOL LGS push TIMA op
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Implement set LGS for the POOL ring.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Glenn Miles <milesg@linux.ibm.com>
Reviewed-by: Michael Kowal <kowal@linux.ibm.com>
Tested-by: Gautam Menghani <gautam@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20250512031100.439842-48-npiggin@gmail.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/intc/xive.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/hw/intc/xive.c b/hw/intc/xive.c
index 25cb3877cb..725ba72b8f 100644
--- a/hw/intc/xive.c
+++ b/hw/intc/xive.c
@@ -532,6 +532,12 @@ static void xive_tm_set_os_lgs(XivePresenter *xptr, XiveTCTX *tctx,
     xive_tctx_set_lgs(tctx, TM_QW1_OS, value & 0xff);
 }
 
+static void xive_tm_set_pool_lgs(XivePresenter *xptr, XiveTCTX *tctx,
+                          hwaddr offset, uint64_t value, unsigned size)
+{
+    xive_tctx_set_lgs(tctx, TM_QW2_HV_POOL, value & 0xff);
+}
+
 /*
  * Adjust the PIPR to allow a CPU to process event queues of other
  * priorities during one physical interrupt cycle.
@@ -737,6 +743,8 @@ static const XiveTmOp xive2_tm_operations[] = {
       xive2_tm_push_pool_ctx, NULL },
     { XIVE_TM_HV_PAGE, TM_QW2_HV_POOL + TM_WORD2, 8, true, true,
       xive2_tm_push_pool_ctx, NULL },
+    { XIVE_TM_HV_PAGE, TM_QW2_HV_POOL + TM_LGS,   1, true, true,
+      xive_tm_set_pool_lgs, NULL },
     { XIVE_TM_HV_PAGE, TM_QW3_HV_PHYS + TM_CPPR,  1, true, true,
       xive2_tm_set_hv_cppr, NULL },
     { XIVE_TM_HV_PAGE, TM_QW3_HV_PHYS + TM_WORD2, 1, true, true,

From 714bae7351d9c85643d6b48109f59f20f05c8466 Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Mon, 12 May 2025 13:10:57 +1000
Subject: [PATCH 2573/2760] ppc/xive2: Implement PHYS ring VP push TIMA op
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Implement the phys (aka hard) VP push. PowerVM uses this operation.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Glenn Miles <milesg@linux.ibm.com>
Reviewed-by: Michael Kowal <kowal@linux.ibm.com>
Tested-by: Gautam Menghani <gautam@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20250512031100.439842-49-npiggin@gmail.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/intc/xive.c         |  2 ++
 hw/intc/xive2.c        | 11 +++++++++++
 include/hw/ppc/xive2.h |  2 ++
 3 files changed, 15 insertions(+)

diff --git a/hw/intc/xive.c b/hw/intc/xive.c
index 725ba72b8f..8b7182fbb8 100644
--- a/hw/intc/xive.c
+++ b/hw/intc/xive.c
@@ -747,6 +747,8 @@ static const XiveTmOp xive2_tm_operations[] = {
       xive_tm_set_pool_lgs, NULL },
     { XIVE_TM_HV_PAGE, TM_QW3_HV_PHYS + TM_CPPR,  1, true, true,
       xive2_tm_set_hv_cppr, NULL },
+    { XIVE_TM_HV_PAGE, TM_QW3_HV_PHYS + TM_WORD2, 1, false, true,
+      xive2_tm_push_phys_ctx, NULL },
     { XIVE_TM_HV_PAGE, TM_QW3_HV_PHYS + TM_WORD2, 1, true, true,
       NULL, xive_tm_vt_poll },
     { XIVE_TM_HV_PAGE, TM_QW3_HV_PHYS + TM_T,     1, true, true,
diff --git a/hw/intc/xive2.c b/hw/intc/xive2.c
index f9eaea1192..1b00568796 100644
--- a/hw/intc/xive2.c
+++ b/hw/intc/xive2.c
@@ -1005,6 +1005,11 @@ static void xive2_tm_push_ctx(XivePresenter *xptr, XiveTCTX *tctx,
 
     /* First update the thead context */
     switch (size) {
+    case 1:
+        tctx->regs[ring + TM_WORD2] = value & 0xff;
+        cam = xive2_tctx_hw_cam_line(xptr, tctx);
+        cam |= ((value & 0xc0) << 24); /* V and H bits */
+        break;
     case 4:
         cam = value;
         w2 = cpu_to_be32(cam);
@@ -1040,6 +1045,12 @@ void xive2_tm_push_pool_ctx(XivePresenter *xptr, XiveTCTX *tctx,
     xive2_tm_push_ctx(xptr, tctx, offset, value, size, TM_QW2_HV_POOL);
 }
 
+void xive2_tm_push_phys_ctx(XivePresenter *xptr, XiveTCTX *tctx,
+                            hwaddr offset, uint64_t value, unsigned size)
+{
+    xive2_tm_push_ctx(xptr, tctx, offset, value, size, TM_QW3_HV_PHYS);
+}
+
 /* returns -1 if ring is invalid, but still populates block and index */
 static int xive2_tctx_get_nvp_indexes(XiveTCTX *tctx, uint8_t ring,
                                       uint8_t *nvp_blk, uint32_t *nvp_idx)
diff --git a/include/hw/ppc/xive2.h b/include/hw/ppc/xive2.h
index 45266c2a8b..f4437e2c79 100644
--- a/include/hw/ppc/xive2.h
+++ b/include/hw/ppc/xive2.h
@@ -146,6 +146,8 @@ void xive2_tm_push_pool_ctx(XivePresenter *xptr, XiveTCTX *tctx,
                             hwaddr offset, uint64_t value, unsigned size);
 uint64_t xive2_tm_pull_pool_ctx(XivePresenter *xptr, XiveTCTX *tctx,
                                 hwaddr offset, unsigned size);
+void xive2_tm_push_phys_ctx(XivePresenter *xptr, XiveTCTX *tctx,
+                            hwaddr offset, uint64_t value, unsigned size);
 uint64_t xive2_tm_pull_phys_ctx(XivePresenter *xptr, XiveTCTX *tctx,
                                 hwaddr offset, unsigned size);
 void xive2_tm_pull_phys_ctx_ol(XivePresenter *xptr, XiveTCTX *tctx,

From 3a50f36469c318d3c66360a8e5ada6f2dc1a349d Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Mon, 12 May 2025 13:10:58 +1000
Subject: [PATCH 2574/2760] ppc/xive: Split need_resend into restore_nvp
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This is needed by the next patch which will re-send on all lower
rings when pushing a context.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Glenn Miles <milesg@linux.ibm.com>
Reviewed-by: Michael Kowal <kowal@linux.ibm.com>
Tested-by: Gautam Menghani <gautam@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20250512031100.439842-50-npiggin@gmail.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/intc/xive.c  | 24 ++++++++++++------------
 hw/intc/xive2.c | 28 ++++++++++++++++------------
 2 files changed, 28 insertions(+), 24 deletions(-)

diff --git a/hw/intc/xive.c b/hw/intc/xive.c
index 8b7182fbb8..e0ffcf89eb 100644
--- a/hw/intc/xive.c
+++ b/hw/intc/xive.c
@@ -606,7 +606,7 @@ static uint64_t xive_tm_pull_os_ctx(XivePresenter *xptr, XiveTCTX *tctx,
     return qw1w2;
 }
 
-static void xive_tctx_need_resend(XiveRouter *xrtr, XiveTCTX *tctx,
+static void xive_tctx_restore_nvp(XiveRouter *xrtr, XiveTCTX *tctx,
                                   uint8_t nvt_blk, uint32_t nvt_idx)
 {
     XiveNVT nvt;
@@ -632,16 +632,6 @@ static void xive_tctx_need_resend(XiveRouter *xrtr, XiveTCTX *tctx,
         uint8_t *regs = &tctx->regs[TM_QW1_OS];
         regs[TM_IPB] |= ipb;
     }
-
-    /*
-     * Always call xive_tctx_recompute_from_ipb(). Even if there were no
-     * escalation triggered, there could be a pending interrupt which
-     * was saved when the context was pulled and that we need to take
-     * into account by recalculating the PIPR (which is not
-     * saved/restored).
-     * It will also raise the External interrupt signal if needed.
-     */
-    xive_tctx_pipr_recompute_from_ipb(tctx, TM_QW1_OS); /* fxb */
 }
 
 /*
@@ -663,7 +653,17 @@ static void xive_tm_push_os_ctx(XivePresenter *xptr, XiveTCTX *tctx,
 
     /* Check the interrupt pending bits */
     if (vo) {
-        xive_tctx_need_resend(XIVE_ROUTER(xptr), tctx, nvt_blk, nvt_idx);
+        xive_tctx_restore_nvp(XIVE_ROUTER(xptr), tctx, nvt_blk, nvt_idx);
+
+        /*
+         * Always call xive_tctx_recompute_from_ipb(). Even if there were no
+         * escalation triggered, there could be a pending interrupt which
+         * was saved when the context was pulled and that we need to take
+         * into account by recalculating the PIPR (which is not
+         * saved/restored).
+         * It will also raise the External interrupt signal if needed.
+         */
+        xive_tctx_pipr_recompute_from_ipb(tctx, TM_QW1_OS); /* fxb */
     }
 }
 
diff --git a/hw/intc/xive2.c b/hw/intc/xive2.c
index 1b00568796..c3c6871e91 100644
--- a/hw/intc/xive2.c
+++ b/hw/intc/xive2.c
@@ -940,14 +940,14 @@ static uint8_t xive2_tctx_restore_ctx(Xive2Router *xrtr, XiveTCTX *tctx,
     return cppr;
 }
 
-static void xive2_tctx_need_resend(Xive2Router *xrtr, XiveTCTX *tctx,
+/* Restore TIMA VP context from NVP backlog */
+static void xive2_tctx_restore_nvp(Xive2Router *xrtr, XiveTCTX *tctx,
                                    uint8_t ring,
                                    uint8_t nvp_blk, uint32_t nvp_idx,
                                    bool do_restore)
 {
-    uint8_t *sig_regs = xive_tctx_signal_regs(tctx, ring);
     uint8_t *regs = &tctx->regs[ring];
-    uint8_t ipb, nsr = sig_regs[TM_NSR];
+    uint8_t ipb;
     Xive2Nvp nvp;
 
     /*
@@ -978,14 +978,6 @@ static void xive2_tctx_need_resend(Xive2Router *xrtr, XiveTCTX *tctx,
     }
     /* IPB bits in the backlog are merged with the TIMA IPB bits */
     regs[TM_IPB] |= ipb;
-
-    if (xive_nsr_indicates_group_exception(ring, nsr)) {
-        /* redistribute precluded active grp interrupt */
-        g_assert(ring == TM_QW2_HV_POOL); /* PHYS ring has the grp interrupt */
-        xive2_redistribute(xrtr, tctx, xive_nsr_exception_ring(ring, nsr));
-    }
-    xive2_tctx_process_pending(tctx, ring == TM_QW2_HV_POOL ?
-                                         TM_QW3_HV_PHYS : ring);
 }
 
 /*
@@ -1028,8 +1020,20 @@ static void xive2_tm_push_ctx(XivePresenter *xptr, XiveTCTX *tctx,
 
     /* Check the interrupt pending bits */
     if (v) {
-        xive2_tctx_need_resend(XIVE2_ROUTER(xptr), tctx, ring,
+        Xive2Router *xrtr = XIVE2_ROUTER(xptr);
+        uint8_t *sig_regs = xive_tctx_signal_regs(tctx, ring);
+        uint8_t nsr = sig_regs[TM_NSR];
+
+        xive2_tctx_restore_nvp(xrtr, tctx, ring,
                                nvp_blk, nvp_idx, do_restore);
+
+        if (xive_nsr_indicates_group_exception(ring, nsr)) {
+            /* redistribute precluded active grp interrupt */
+            g_assert(ring == TM_QW2_HV_POOL); /* PHYS ring has the interrupt */
+            xive2_redistribute(xrtr, tctx, xive_nsr_exception_ring(ring, nsr));
+        }
+        xive2_tctx_process_pending(tctx, ring == TM_QW2_HV_POOL ?
+                                                 TM_QW3_HV_PHYS : ring);
     }
 }
 

From df3614b7983e0629b0d422259968985ca0117bfa Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Mon, 12 May 2025 13:10:59 +1000
Subject: [PATCH 2575/2760] ppc/xive2: Enable lower level contexts on VP push
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When pushing a context, the lower-level context becomes valid if it
had V=1, and so on. Iterate lower level contexts and send them
pending interrupts if they become enabled.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Glenn Miles <milesg@linux.ibm.com>
Reviewed-by: Michael Kowal <kowal@linux.ibm.com>
Tested-by: Gautam Menghani <gautam@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20250512031100.439842-51-npiggin@gmail.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/intc/xive2.c | 36 ++++++++++++++++++++++++++++--------
 1 file changed, 28 insertions(+), 8 deletions(-)

diff --git a/hw/intc/xive2.c b/hw/intc/xive2.c
index c3c6871e91..ee5fa26178 100644
--- a/hw/intc/xive2.c
+++ b/hw/intc/xive2.c
@@ -995,6 +995,12 @@ static void xive2_tm_push_ctx(XivePresenter *xptr, XiveTCTX *tctx,
     bool v;
     bool do_restore;
 
+    if (xive_ring_valid(tctx, ring)) {
+        qemu_log_mask(LOG_GUEST_ERROR, "XIVE: Attempt to push VP to enabled"
+                                       " ring 0x%02x\n", ring);
+        return;
+    }
+
     /* First update the thead context */
     switch (size) {
     case 1:
@@ -1021,19 +1027,32 @@ static void xive2_tm_push_ctx(XivePresenter *xptr, XiveTCTX *tctx,
     /* Check the interrupt pending bits */
     if (v) {
         Xive2Router *xrtr = XIVE2_ROUTER(xptr);
-        uint8_t *sig_regs = xive_tctx_signal_regs(tctx, ring);
-        uint8_t nsr = sig_regs[TM_NSR];
+        uint8_t cur_ring;
 
         xive2_tctx_restore_nvp(xrtr, tctx, ring,
                                nvp_blk, nvp_idx, do_restore);
 
-        if (xive_nsr_indicates_group_exception(ring, nsr)) {
-            /* redistribute precluded active grp interrupt */
-            g_assert(ring == TM_QW2_HV_POOL); /* PHYS ring has the interrupt */
-            xive2_redistribute(xrtr, tctx, xive_nsr_exception_ring(ring, nsr));
+        for (cur_ring = TM_QW1_OS; cur_ring <= ring;
+             cur_ring += XIVE_TM_RING_SIZE) {
+            uint8_t *sig_regs = xive_tctx_signal_regs(tctx, cur_ring);
+            uint8_t nsr = sig_regs[TM_NSR];
+
+            if (!xive_ring_valid(tctx, cur_ring)) {
+                continue;
+            }
+
+            if (cur_ring == TM_QW2_HV_POOL) {
+                if (xive_nsr_indicates_exception(cur_ring, nsr)) {
+                    g_assert(xive_nsr_exception_ring(cur_ring, nsr) ==
+                                                               TM_QW3_HV_PHYS);
+                    xive2_redistribute(xrtr, tctx,
+                                       xive_nsr_exception_ring(ring, nsr));
+                }
+                xive2_tctx_process_pending(tctx, TM_QW3_HV_PHYS);
+                break;
+            }
+            xive2_tctx_process_pending(tctx, cur_ring);
         }
-        xive2_tctx_process_pending(tctx, ring == TM_QW2_HV_POOL ?
-                                                 TM_QW3_HV_PHYS : ring);
     }
 }
 
@@ -1159,6 +1178,7 @@ static void xive2_tctx_process_pending(XiveTCTX *tctx, uint8_t sig_ring)
     int rc;
 
     g_assert(sig_ring == TM_QW3_HV_PHYS || sig_ring == TM_QW1_OS);
+    g_assert(sig_regs[TM_WORD2] & 0x80);
     g_assert(!xive_nsr_indicates_group_exception(sig_ring, sig_regs[TM_NSR]));
 
     /*

From 8c8f62baa61b55b297453a8d416c6b0932398948 Mon Sep 17 00:00:00 2001
From: Zenghui Yu <zenghui.yu@linux.dev>
Date: Mon, 21 Jul 2025 10:07:52 +0100
Subject: [PATCH 2576/2760] hvf: arm: Remove $pc from trace_hvf_data_abort()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We don't synchronize vcpu registers from the hardware accelerator (e.g., by
cpu_synchronize_state()) in the Dabort handler, so env->pc points to the
instruction which has nothing to do with the Dabort at all.

And it doesn't seem to make much sense to log PC in every Dabort handler,
let's just remove it from this trace event.

Signed-off-by: Zenghui Yu <zenghui.yu@linux.dev>
Reviewed-by: Mads Ynddal <mads@ynddal.dk>
Message-id: 20250713154719.4248-1-zenghui.yu@linux.dev
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/hvf/hvf.c        | 2 +-
 target/arm/hvf/trace-events | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index c9cfcdc08b..8f93e42b34 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -2005,7 +2005,7 @@ int hvf_vcpu_exec(CPUState *cpu)
         uint32_t cm = (syndrome >> 8) & 0x1;
         uint64_t val = 0;
 
-        trace_hvf_data_abort(env->pc, hvf_exit->exception.virtual_address,
+        trace_hvf_data_abort(hvf_exit->exception.virtual_address,
                              hvf_exit->exception.physical_address, isv,
                              iswrite, s1ptw, len, srt);
 
diff --git a/target/arm/hvf/trace-events b/target/arm/hvf/trace-events
index b49746f28d..b29a995f3d 100644
--- a/target/arm/hvf/trace-events
+++ b/target/arm/hvf/trace-events
@@ -2,7 +2,7 @@ hvf_unhandled_sysreg_read(uint64_t pc, uint32_t reg, uint32_t op0, uint32_t op1,
 hvf_unhandled_sysreg_write(uint64_t pc, uint32_t reg, uint32_t op0, uint32_t op1, uint32_t crn, uint32_t crm, uint32_t op2) "unhandled sysreg write at pc=0x%"PRIx64": 0x%08x (op0=%d op1=%d crn=%d crm=%d op2=%d)"
 hvf_inject_fiq(void) "injecting FIQ"
 hvf_inject_irq(void) "injecting IRQ"
-hvf_data_abort(uint64_t pc, uint64_t va, uint64_t pa, bool isv, bool iswrite, bool s1ptw, uint32_t len, uint32_t srt) "data abort: [pc=0x%"PRIx64" va=0x%016"PRIx64" pa=0x%016"PRIx64" isv=%d iswrite=%d s1ptw=%d len=%d srt=%d]"
+hvf_data_abort(uint64_t va, uint64_t pa, bool isv, bool iswrite, bool s1ptw, uint32_t len, uint32_t srt) "data abort: [va=0x%016"PRIx64" pa=0x%016"PRIx64" isv=%d iswrite=%d s1ptw=%d len=%d srt=%d]"
 hvf_sysreg_read(uint32_t reg, uint32_t op0, uint32_t op1, uint32_t crn, uint32_t crm, uint32_t op2, uint64_t val) "sysreg read 0x%08x (op0=%d op1=%d crn=%d crm=%d op2=%d) = 0x%016"PRIx64
 hvf_sysreg_write(uint32_t reg, uint32_t op0, uint32_t op1, uint32_t crn, uint32_t crm, uint32_t op2, uint64_t val) "sysreg write 0x%08x (op0=%d op1=%d crn=%d crm=%d op2=%d, val=0x%016"PRIx64")"
 hvf_unknown_hvc(uint64_t pc, uint64_t x0) "pc=0x%"PRIx64" unknown HVC! 0x%016"PRIx64

From 655659a74a36b63e33d2dc969d3c44beb1b008b3 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Mon, 21 Jul 2025 10:07:52 +0100
Subject: [PATCH 2577/2760] target/arm: Correct encoding of Debug
 Communications Channel registers

We don't implement the Debug Communications Channel (DCC), but
we do attempt to provide dummy versions of its system registers
so that software that tries to access them doesn't fall over.

However, we got the tx/rx register definitions wrong. These
should be:

AArch32:
  DBGDTRTX   p14 0 c0 c5 0  (on writes)
  DBGDTRRX   p14 0 c0 c5 0  (on reads)

AArch64:
  DBGDTRTX_EL0  2 3 0 5 0 (on writes)
  DBGDTRRX_EL0  2 3 0 5 0 (on reads)
  DBGDTR_EL0    2 3 0 4 0 (reads and writes)

where DBGDTRTX and DBGDTRRX are effectively different names for the
same 32-bit register, which has tx behaviour on writes and rx
behaviour on reads.  The AArch64-only DBGDTR_EL0 is a 64-bit wide
register whose top and bottom halves map to the DBGDTRRX and DBGDTRTX
registers.

Currently we have just one cpreg struct, which:
 * calls itself DBGDTR_EL0
 * uses the DBGDTRTX_EL0/DBGDTRRX_EL0 encoding
 * is marked as ARM_CP_STATE_BOTH but has the wrong opc1
   value for AArch32
 * is implemented as RAZ/WI

Correct the encoding so:
 * we name the DBGDTRTX/DBGDTRRX register correctly
 * we split it into AA64 and AA32 versions so we can get the
   AA32 encoding right
 * we implement DBGDTR_EL0 at its correct encoding

Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2986
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250708141049.778361-1-peter.maydell@linaro.org
---
 target/arm/debug_helper.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/target/arm/debug_helper.c b/target/arm/debug_helper.c
index 69fb1d0d9f..aee06d4d42 100644
--- a/target/arm/debug_helper.c
+++ b/target/arm/debug_helper.c
@@ -988,11 +988,20 @@ static const ARMCPRegInfo debug_cp_reginfo[] = {
       .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 2,
       .access = PL1_RW, .accessfn = access_tdcc,
       .type = ARM_CP_CONST, .resetvalue = 0 },
-    /* DBGDTRTX_EL0/DBGDTRRX_EL0 depend on direction */
-    { .name = "DBGDTR_EL0", .state = ARM_CP_STATE_BOTH, .cp = 14,
+    /* Architecturally DBGDTRTX is named DBGDTRRX when used for reads */
+    { .name = "DBGDTRTX_EL0", .state = ARM_CP_STATE_AA64,
       .opc0 = 2, .opc1 = 3, .crn = 0, .crm = 5, .opc2 = 0,
       .access = PL0_RW, .accessfn = access_tdcc,
       .type = ARM_CP_CONST, .resetvalue = 0 },
+    { .name = "DBGDTRTX", .state = ARM_CP_STATE_AA32, .cp = 14,
+      .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 0,
+      .access = PL0_RW, .accessfn = access_tdcc,
+      .type = ARM_CP_CONST, .resetvalue = 0 },
+    /* This is AArch64-only and is a combination of DBGDTRTX and DBGDTRRX */
+    { .name = "DBGDTR_EL0", .state = ARM_CP_STATE_AA64,
+      .opc0 = 2, .opc1 = 3, .crn = 0, .crm = 4, .opc2 = 0,
+      .access = PL0_RW, .accessfn = access_tdcc,
+      .type = ARM_CP_CONST, .resetvalue = 0 },
     /*
      * OSECCR_EL1 provides a mechanism for an operating system
      * to access the contents of EDECCR. EDECCR is not implemented though,

From 8ccd35f25cdf2e03f44585a11b7daf93d1d46a3a Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Mon, 21 Jul 2025 10:07:53 +0100
Subject: [PATCH 2578/2760] hw/misc/ivshmem-pci: Improve error handling

Coverity points out that the ivshmem-pci code has some error handling
cases where it incorrectly tries to use an invalid filedescriptor.
These generally happen because ivshmem_recv_msg() calls
qemu_chr_fe_get_msgfd(), which might return -1, but the code in
process_msg() generally assumes that the file descriptor was provided
when it was supposed to be. In particular:
 * the error case in process_msg() only needs to close the fd
   if one was provided
 * process_msg_shmem() should fail if no fd was provided

Coverity: CID 1508726
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Message-id: 20250711145012.1521936-1-peter.maydell@linaro.org
---
 hw/misc/ivshmem-pci.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/hw/misc/ivshmem-pci.c b/hw/misc/ivshmem-pci.c
index 5a10bca633..d47ae739d6 100644
--- a/hw/misc/ivshmem-pci.c
+++ b/hw/misc/ivshmem-pci.c
@@ -479,6 +479,11 @@ static void process_msg_shmem(IVShmemState *s, int fd, Error **errp)
     struct stat buf;
     size_t size;
 
+    if (fd < 0) {
+        error_setg(errp, "server didn't provide fd with shared memory message");
+        return;
+    }
+
     if (s->ivshmem_bar2) {
         error_setg(errp, "server sent unexpected shared memory message");
         close(fd);
@@ -553,7 +558,9 @@ static void process_msg(IVShmemState *s, int64_t msg, int fd, Error **errp)
 
     if (msg < -1 || msg > IVSHMEM_MAX_PEERS) {
         error_setg(errp, "server sent invalid message %" PRId64, msg);
-        close(fd);
+        if (fd >= 0) {
+            close(fd);
+        }
         return;
     }
 

From 32d8fb61e5a1fb5feeecce85d461be019cc30a54 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Mon, 21 Jul 2025 10:07:53 +0100
Subject: [PATCH 2579/2760] target/arm: Provide always-false
 kvm_arm_*_supported() stubs for usermode

If you try to build aarch64-linux-user with clang and --enable-debug then it
fails to compile:

 ld: libqemu-aarch64-linux-user.a.p/target_arm_cpu64.c.o: in function `cpu_arm_set_sve':
 ../../target/arm/cpu64.c:321:(.text+0x1254): undefined reference to `kvm_arm_sve_supported'

This is a regression introduced in commit f86d4220, which switched
the kvm-stub.c file away from being built for all arm targets to only
being built for system emulation binaries.  It doesn't affect gcc,
presumably because even at -O0 gcc folds away the always-false
kvm_enabled() condition but clang does not.

We would prefer not to build kvm-stub.c once for usermode and once
for system-emulation binaries, and we can't build it just once for
both because it includes cpu.h.  So instead provide always-false
versions of the five functions that are valid to call without KVM
support in kvm_arm.h.

Fixes: f86d42205c2eba ("target/arm/meson: accelerator files are not needed in user mode")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3033
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-id: 20250714135152.1896214-1-peter.maydell@linaro.org
---
 target/arm/kvm_arm.h | 35 +++++++++++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)

diff --git a/target/arm/kvm_arm.h b/target/arm/kvm_arm.h
index b4cad05155..6a9b6374a6 100644
--- a/target/arm/kvm_arm.h
+++ b/target/arm/kvm_arm.h
@@ -161,6 +161,14 @@ void kvm_arm_add_vcpu_properties(ARMCPU *cpu);
  */
 void kvm_arm_steal_time_finalize(ARMCPU *cpu, Error **errp);
 
+/*
+ * These "is some KVM subfeature enabled?" functions may be called
+ * when KVM support is not present, including in the user-mode
+ * emulators. The kvm-stub.c file is only built into the system
+ * emulators, so for user-mode emulation we provide "always false"
+ * stubs here.
+ */
+#ifndef CONFIG_USER_ONLY
 /**
  * kvm_arm_aarch32_supported:
  *
@@ -197,6 +205,33 @@ bool kvm_arm_mte_supported(void);
  * Returns true if KVM can enable EL2 and false otherwise.
  */
 bool kvm_arm_el2_supported(void);
+#else
+
+static inline bool kvm_arm_aarch32_supported(void)
+{
+    return false;
+}
+
+static inline bool kvm_arm_pmu_supported(void)
+{
+    return false;
+}
+
+static inline bool kvm_arm_sve_supported(void)
+{
+    return false;
+}
+
+static inline bool kvm_arm_mte_supported(void)
+{
+    return false;
+}
+
+static inline bool kvm_arm_el2_supported(void)
+{
+    return false;
+}
+#endif
 
 /**
  * kvm_arm_get_max_vm_ipa_size:

From e74aad9f81cc2bfee2057086610e21bd98e9c5a5 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Mon, 21 Jul 2025 10:07:53 +0100
Subject: [PATCH 2580/2760] host-utils: Drop workaround for buggy Apple Clang
 __builtin_subcll()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In commit b0438861efe ("host-utils: Avoid using __builtin_subcll on
buggy versions of Apple Clang") we added a workaround for a bug in
Apple Clang 14 where its __builtin_subcll() implementation was wrong.
This bug was only present in Apple Clang 14, not in upstream clang,
and is not present in Apple Clang versions 15 and newer.

Since commit 4e035201 we have required at least Apple Clang 15, so we
no longer build with the buggy versions.  We can therefore drop the
workaround. This is effectively a revert of b0438861efe.

This should not be backported to stable branches, which may still
need to support Apple Clang 14.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3030
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250714145033.1908788-1-peter.maydell@linaro.org
---
 include/qemu/compiler.h   | 13 -------------
 include/qemu/host-utils.h |  2 +-
 2 files changed, 1 insertion(+), 14 deletions(-)

diff --git a/include/qemu/compiler.h b/include/qemu/compiler.h
index 65b89958d3..1c2b673c05 100644
--- a/include/qemu/compiler.h
+++ b/include/qemu/compiler.h
@@ -182,19 +182,6 @@
 #define QEMU_DISABLE_CFI
 #endif
 
-/*
- * Apple clang version 14 has a bug in its __builtin_subcll(); define
- * BUILTIN_SUBCLL_BROKEN for the offending versions so we can avoid it.
- * When a version of Apple clang which has this bug fixed is released
- * we can add an upper bound to this check.
- * See https://gitlab.com/qemu-project/qemu/-/issues/1631
- * and https://gitlab.com/qemu-project/qemu/-/issues/1659 for details.
- * The bug never made it into any upstream LLVM releases, only Apple ones.
- */
-#if defined(__apple_build_version__) && __clang_major__ >= 14
-#define BUILTIN_SUBCLL_BROKEN
-#endif
-
 #if __has_attribute(annotate)
 #define QEMU_ANNOTATE(x) __attribute__((annotate(x)))
 #else
diff --git a/include/qemu/host-utils.h b/include/qemu/host-utils.h
index 4d28fa22cf..dd558589cb 100644
--- a/include/qemu/host-utils.h
+++ b/include/qemu/host-utils.h
@@ -677,7 +677,7 @@ static inline uint64_t uadd64_carry(uint64_t x, uint64_t y, bool *pcarry)
  */
 static inline uint64_t usub64_borrow(uint64_t x, uint64_t y, bool *pborrow)
 {
-#if __has_builtin(__builtin_subcll) && !defined(BUILTIN_SUBCLL_BROKEN)
+#if __has_builtin(__builtin_subcll)
     unsigned long long b = *pborrow;
     x = __builtin_subcll(x, y, b, &b);
     *pborrow = b & 1;

From 30dbcd9283988ba352181cb42c6a69ae32075363 Mon Sep 17 00:00:00 2001
From: Jackson Donaldson <jackson88044@gmail.com>
Date: Mon, 21 Jul 2025 10:07:53 +0100
Subject: [PATCH 2581/2760] hw/misc/max78000_aes: Comment Internal Key Storage

Coverity Scan noted an unusual pattern in the
MAX78000 aes device, with duplicated calls to
set_decrypt. This commit adds a comment noting
why the implementation is correct.

Signed-off-by: Jackson Donaldson <jcksn@duck.com>
Message-id: 20250716002622.84685-1-jcksn@duck.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/misc/max78000_aes.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/hw/misc/max78000_aes.c b/hw/misc/max78000_aes.c
index 0bfb2f02b5..d883ddd2b6 100644
--- a/hw/misc/max78000_aes.c
+++ b/hw/misc/max78000_aes.c
@@ -79,6 +79,12 @@ static void max78000_aes_do_crypto(Max78000AesState *s)
         keydata += 8;
     }
 
+    /*
+     * The MAX78000 AES engine stores an internal key, which it uses only
+     * for decryption. This results in the slighly odd looking pairs of
+     * set_encrypt and set_decrypt calls below; s->internal_key is
+     * being stored for later use in both cases.
+     */
     AES_KEY key;
     if ((s->ctrl & TYPE) == 0) {
         AES_set_encrypt_key(keydata, keylen, &key);

From 012bf8ad134ecec5d7e68101c216204107fd9741 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Mon, 21 Jul 2025 10:07:54 +0100
Subject: [PATCH 2582/2760] docs: Fix Aspeed title
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit ad8e0e8a0088 removed the "======" underlining the file title
which broke documentation rendering. Add it back.

Fixes: ad8e0e8a0088 ("docs: add support for gb200-bmc")
Cc: Ed Tanous <etanous@nvidia.com>
Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Ed Tanous <etanous@nvidia.com>
Message-id: 20250715061904.97540-1-clg@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/aspeed.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docs/system/arm/aspeed.rst b/docs/system/arm/aspeed.rst
index bec0a1dfa8..bf18c56347 100644
--- a/docs/system/arm/aspeed.rst
+++ b/docs/system/arm/aspeed.rst
@@ -1,4 +1,5 @@
 Aspeed family boards (``ast2500-evb``, ``ast2600-evb``, ``ast2700-evb``, ``bletchley-bmc``, ``fuji-bmc``, ``gb200nvl-bmc``, ``fby35-bmc``, ``fp5280g2-bmc``, ``g220a-bmc``, ``palmetto-bmc``, ``qcom-dc-scm-v1-bmc``, ``qcom-firework-bmc``, ``quanta-q71l-bmc``, ``rainier-bmc``, ``romulus-bmc``, ``sonorapass-bmc``, ``supermicrox11-bmc``, ``supermicrox11spi-bmc``, ``tiogapass-bmc``, ``witherspoon-bmc``, ``yosemitev2-bmc``)
+====================================================================================================================================================================================================================================================================================================================================================================================================================================
 
 The QEMU Aspeed machines model BMCs of various OpenPOWER systems and
 Aspeed evaluation boards. They are based on different releases of the

From 2b5a9bbbadb39750584f36e6bee3a36ebe134418 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Fri, 18 Jul 2025 18:30:23 +0100
Subject: [PATCH 2583/2760] target/arm: Add BFADD, BFSUB, BFMUL (unpredicated)

FEAT_SVE_B16B16 adds bfloat16 versions of the SVE floating point
(unpredicated) instructions, which are encoded via sz==0b00.

Fixes: 7b1613a1020d2942 ("target/arm: Enable FEAT_SME2p1 on -cpu max")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250718173032.2498900-2-peter.maydell@linaro.org
---
 target/arm/tcg/helper.h        | 3 +++
 target/arm/tcg/translate-sve.c | 6 +++++-
 target/arm/tcg/vec_helper.c    | 3 +++
 3 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/target/arm/tcg/helper.h b/target/arm/tcg/helper.h
index 0a006d9514..d9ca5b7c56 100644
--- a/target/arm/tcg/helper.h
+++ b/target/arm/tcg/helper.h
@@ -728,16 +728,19 @@ DEF_HELPER_FLAGS_4(gvec_fclt0_h, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_4(gvec_fclt0_s, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_4(gvec_fclt0_d, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
 
+DEF_HELPER_FLAGS_5(gvec_fadd_b16, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_5(gvec_fadd_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_5(gvec_fadd_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_5(gvec_fadd_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_5(gvec_bfadd, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
 
+DEF_HELPER_FLAGS_5(gvec_fsub_b16, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_5(gvec_fsub_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_5(gvec_fsub_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_5(gvec_fsub_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_5(gvec_bfsub, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
 
+DEF_HELPER_FLAGS_5(gvec_fmul_b16, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_5(gvec_fmul_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_5(gvec_fmul_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_5(gvec_fmul_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
index 7b575734fd..f00cccf154 100644
--- a/target/arm/tcg/translate-sve.c
+++ b/target/arm/tcg/translate-sve.c
@@ -190,6 +190,10 @@ static bool gen_gvec_fpst_zzz(DisasContext *s, gen_helper_gvec_3_ptr *fn,
 static bool gen_gvec_fpst_arg_zzz(DisasContext *s, gen_helper_gvec_3_ptr *fn,
                                   arg_rrr_esz *a, int data)
 {
+    /* These insns use MO_8 to encode BFloat16 */
+    if (a->esz == MO_8 && !dc_isar_feature(aa64_sve_b16b16, s)) {
+        return false;
+    }
     return gen_gvec_fpst_zzz(s, fn, a->rd, a->rn, a->rm, data,
                              a->esz == MO_16 ? FPST_A64_F16 : FPST_A64);
 }
@@ -4146,7 +4150,7 @@ static bool trans_FADDA(DisasContext *s, arg_rprr_esz *a)
 
 #define DO_FP3(NAME, name) \
     static gen_helper_gvec_3_ptr * const name##_fns[4] = {          \
-        NULL, gen_helper_gvec_##name##_h,                           \
+        gen_helper_gvec_##name##_b16, gen_helper_gvec_##name##_h,   \
         gen_helper_gvec_##name##_s, gen_helper_gvec_##name##_d      \
     };                                                              \
     TRANS_FEAT(NAME, aa64_sve, gen_gvec_fpst_arg_zzz, name##_fns[a->esz], a, 0)
diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
index bae6165b50..76a9ab0da3 100644
--- a/target/arm/tcg/vec_helper.c
+++ b/target/arm/tcg/vec_helper.c
@@ -1467,16 +1467,19 @@ void HELPER(NAME)(void *vd, void *vn, void *vm,                            \
     clear_tail(d, oprsz, simd_maxsz(desc));                                \
 }
 
+DO_3OP(gvec_fadd_b16, bfloat16_add, float16)
 DO_3OP(gvec_fadd_h, float16_add, float16)
 DO_3OP(gvec_fadd_s, float32_add, float32)
 DO_3OP(gvec_fadd_d, float64_add, float64)
 DO_3OP(gvec_bfadd, bfloat16_add, bfloat16)
 
+DO_3OP(gvec_fsub_b16, bfloat16_sub, float16)
 DO_3OP(gvec_fsub_h, float16_sub, float16)
 DO_3OP(gvec_fsub_s, float32_sub, float32)
 DO_3OP(gvec_fsub_d, float64_sub, float64)
 DO_3OP(gvec_bfsub, bfloat16_sub, bfloat16)
 
+DO_3OP(gvec_fmul_b16, bfloat16_mul, float16)
 DO_3OP(gvec_fmul_h, float16_mul, float16)
 DO_3OP(gvec_fmul_s, float32_mul, float32)
 DO_3OP(gvec_fmul_d, float64_mul, float64)

From 86fa06f8d9f953252a7919fa56a402d789bf1b78 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Fri, 18 Jul 2025 18:30:24 +0100
Subject: [PATCH 2584/2760] target/arm: Add BFADD, BFSUB, BFMUL, BFMAXNM,
 BFMINNM (predicated)

FEAT_SVE_B16B16 adds bfloat16 versions of the SVE floating point
(predicated) instructions, which are encoded via sz=0b00.
Add BFADD, BFSUB, BFMUL, BFMAXNM, BFMINNM; these are all the insns
in this group which do not change behaviour for AH=1.

We will deal with BFMAX/BFMIN (which do have different AH=1
behaviour) in a following commit.

Fixes: 7b1613a1020d2942 ("target/arm: Enable FEAT_SME2p1 on -cpu max")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250718173032.2498900-3-peter.maydell@linaro.org
---
 target/arm/tcg/helper-sve.h    | 10 ++++++++++
 target/arm/tcg/sve_helper.c    |  5 +++++
 target/arm/tcg/translate-sve.c | 22 +++++++++++++++++-----
 3 files changed, 32 insertions(+), 5 deletions(-)

diff --git a/target/arm/tcg/helper-sve.h b/target/arm/tcg/helper-sve.h
index c36090d13d..d612bcaded 100644
--- a/target/arm/tcg/helper-sve.h
+++ b/target/arm/tcg/helper-sve.h
@@ -1196,6 +1196,8 @@ DEF_HELPER_FLAGS_5(sve_fcmne0_s, TCG_CALL_NO_RWG,
 DEF_HELPER_FLAGS_5(sve_fcmne0_d, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, fpst, i32)
 
+DEF_HELPER_FLAGS_6(sve_fadd_b16, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_6(sve_fadd_h, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_6(sve_fadd_s, TCG_CALL_NO_RWG,
@@ -1203,6 +1205,8 @@ DEF_HELPER_FLAGS_6(sve_fadd_s, TCG_CALL_NO_RWG,
 DEF_HELPER_FLAGS_6(sve_fadd_d, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, fpst, i32)
 
+DEF_HELPER_FLAGS_6(sve_fsub_b16, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_6(sve_fsub_h, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_6(sve_fsub_s, TCG_CALL_NO_RWG,
@@ -1210,6 +1214,8 @@ DEF_HELPER_FLAGS_6(sve_fsub_s, TCG_CALL_NO_RWG,
 DEF_HELPER_FLAGS_6(sve_fsub_d, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, fpst, i32)
 
+DEF_HELPER_FLAGS_6(sve_fmul_b16, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_6(sve_fmul_h, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_6(sve_fmul_s, TCG_CALL_NO_RWG,
@@ -1252,6 +1258,8 @@ DEF_HELPER_FLAGS_6(sve_ah_fmax_s, TCG_CALL_NO_RWG,
 DEF_HELPER_FLAGS_6(sve_ah_fmax_d, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, fpst, i32)
 
+DEF_HELPER_FLAGS_6(sve_fminnum_b16, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_6(sve_fminnum_h, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_6(sve_fminnum_s, TCG_CALL_NO_RWG,
@@ -1259,6 +1267,8 @@ DEF_HELPER_FLAGS_6(sve_fminnum_s, TCG_CALL_NO_RWG,
 DEF_HELPER_FLAGS_6(sve_fminnum_d, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, fpst, i32)
 
+DEF_HELPER_FLAGS_6(sve_fmaxnum_b16, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_6(sve_fmaxnum_h, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_6(sve_fmaxnum_s, TCG_CALL_NO_RWG,
diff --git a/target/arm/tcg/sve_helper.c b/target/arm/tcg/sve_helper.c
index 43b872c7fd..a229503bc2 100644
--- a/target/arm/tcg/sve_helper.c
+++ b/target/arm/tcg/sve_helper.c
@@ -4629,14 +4629,17 @@ void HELPER(NAME)(void *vd, void *vn, void *vm, void *vg,       \
     } while (i != 0);                                           \
 }
 
+DO_ZPZZ_FP(sve_fadd_b16, uint16_t, H1_2, bfloat16_add)
 DO_ZPZZ_FP(sve_fadd_h, uint16_t, H1_2, float16_add)
 DO_ZPZZ_FP(sve_fadd_s, uint32_t, H1_4, float32_add)
 DO_ZPZZ_FP(sve_fadd_d, uint64_t, H1_8, float64_add)
 
+DO_ZPZZ_FP(sve_fsub_b16, uint16_t, H1_2, bfloat16_sub)
 DO_ZPZZ_FP(sve_fsub_h, uint16_t, H1_2, float16_sub)
 DO_ZPZZ_FP(sve_fsub_s, uint32_t, H1_4, float32_sub)
 DO_ZPZZ_FP(sve_fsub_d, uint64_t, H1_8, float64_sub)
 
+DO_ZPZZ_FP(sve_fmul_b16, uint16_t, H1_2, bfloat16_mul)
 DO_ZPZZ_FP(sve_fmul_h, uint16_t, H1_2, float16_mul)
 DO_ZPZZ_FP(sve_fmul_s, uint32_t, H1_4, float32_mul)
 DO_ZPZZ_FP(sve_fmul_d, uint64_t, H1_8, float64_mul)
@@ -4661,10 +4664,12 @@ DO_ZPZZ_FP(sve_ah_fmax_h, uint16_t, H1_2, helper_vfp_ah_maxh)
 DO_ZPZZ_FP(sve_ah_fmax_s, uint32_t, H1_4, helper_vfp_ah_maxs)
 DO_ZPZZ_FP(sve_ah_fmax_d, uint64_t, H1_8, helper_vfp_ah_maxd)
 
+DO_ZPZZ_FP(sve_fminnum_b16, uint16_t, H1_2, bfloat16_minnum)
 DO_ZPZZ_FP(sve_fminnum_h, uint16_t, H1_2, float16_minnum)
 DO_ZPZZ_FP(sve_fminnum_s, uint32_t, H1_4, float32_minnum)
 DO_ZPZZ_FP(sve_fminnum_d, uint64_t, H1_8, float64_minnum)
 
+DO_ZPZZ_FP(sve_fmaxnum_b16, uint16_t, H1_2, bfloat16_maxnum)
 DO_ZPZZ_FP(sve_fmaxnum_h, uint16_t, H1_2, float16_maxnum)
 DO_ZPZZ_FP(sve_fmaxnum_s, uint32_t, H1_4, float32_maxnum)
 DO_ZPZZ_FP(sve_fmaxnum_d, uint64_t, H1_8, float64_maxnum)
diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
index f00cccf154..2739c226d7 100644
--- a/target/arm/tcg/translate-sve.c
+++ b/target/arm/tcg/translate-sve.c
@@ -407,6 +407,10 @@ static bool gen_gvec_fpst_zzzp(DisasContext *s, gen_helper_gvec_4_ptr *fn,
 static bool gen_gvec_fpst_arg_zpzz(DisasContext *s, gen_helper_gvec_4_ptr *fn,
                                    arg_rprr_esz *a)
 {
+    /* These insns use MO_8 to encode BFloat16. */
+    if (a->esz == MO_8 && !dc_isar_feature(aa64_sve_b16b16, s)) {
+        return false;
+    }
     return gen_gvec_fpst_zzzp(s, fn, a->rd, a->rn, a->rm, a->pg, 0,
                               a->esz == MO_16 ? FPST_A64_F16 : FPST_A64);
 }
@@ -4206,13 +4210,21 @@ TRANS_FEAT_NONSTREAMING(FTSMUL, aa64_sve, gen_gvec_fpst_arg_zzz,
                s->fpcr_ah ? name##_ah_zpzz_fns[a->esz] :                \
                name##_zpzz_fns[a->esz], a)
 
-DO_ZPZZ_FP(FADD_zpzz, aa64_sve, sve_fadd)
-DO_ZPZZ_FP(FSUB_zpzz, aa64_sve, sve_fsub)
-DO_ZPZZ_FP(FMUL_zpzz, aa64_sve, sve_fmul)
+/* Similar, but for insns where sz == 0 encodes bfloat16 */
+#define DO_ZPZZ_FP_B16(NAME, FEAT, name) \
+    static gen_helper_gvec_4_ptr * const name##_zpzz_fns[4] = { \
+        gen_helper_##name##_b16, gen_helper_##name##_h,         \
+        gen_helper_##name##_s, gen_helper_##name##_d            \
+    };                                                          \
+    TRANS_FEAT(NAME, FEAT, gen_gvec_fpst_arg_zpzz, name##_zpzz_fns[a->esz], a)
+
+DO_ZPZZ_FP_B16(FADD_zpzz, aa64_sve, sve_fadd)
+DO_ZPZZ_FP_B16(FSUB_zpzz, aa64_sve, sve_fsub)
+DO_ZPZZ_FP_B16(FMUL_zpzz, aa64_sve, sve_fmul)
 DO_ZPZZ_AH_FP(FMIN_zpzz, aa64_sve, sve_fmin, sve_ah_fmin)
 DO_ZPZZ_AH_FP(FMAX_zpzz, aa64_sve, sve_fmax, sve_ah_fmax)
-DO_ZPZZ_FP(FMINNM_zpzz, aa64_sve, sve_fminnum)
-DO_ZPZZ_FP(FMAXNM_zpzz, aa64_sve, sve_fmaxnum)
+DO_ZPZZ_FP_B16(FMINNM_zpzz, aa64_sve, sve_fminnum)
+DO_ZPZZ_FP_B16(FMAXNM_zpzz, aa64_sve, sve_fmaxnum)
 DO_ZPZZ_AH_FP(FABD, aa64_sve, sve_fabd, sve_ah_fabd)
 DO_ZPZZ_FP(FSCALE, aa64_sve, sve_fscalbn)
 DO_ZPZZ_FP(FDIV, aa64_sve, sve_fdiv)

From 279438560ba8575266e9105202c6e87044d24885 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Fri, 18 Jul 2025 18:30:25 +0100
Subject: [PATCH 2585/2760] target/arm: Add BFMIN, BFMAX (predicated)

FEAT_SVE_B16B16 adds bfloat16 versions of the SVE floating point
(predicated) instructions, which are encoded via sz=0b00.  Add the
BFMAX and BFMIN insns.  These have separate behaviour for AH=1 and
AH=0; we have already implemented the AH=1 helper for the SME2
versions of these insns.

Fixes: 7b1613a1020d2942 ("target/arm: Enable FEAT_SME2p1 on -cpu max")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250718173032.2498900-4-peter.maydell@linaro.org
---
 target/arm/tcg/helper-sve.h    |  8 ++++++++
 target/arm/tcg/sve_helper.c    |  4 ++++
 target/arm/tcg/translate-sve.c | 17 +++++++++++++++--
 3 files changed, 27 insertions(+), 2 deletions(-)

diff --git a/target/arm/tcg/helper-sve.h b/target/arm/tcg/helper-sve.h
index d612bcaded..cb6c2355e5 100644
--- a/target/arm/tcg/helper-sve.h
+++ b/target/arm/tcg/helper-sve.h
@@ -1230,6 +1230,8 @@ DEF_HELPER_FLAGS_6(sve_fdiv_s, TCG_CALL_NO_RWG,
 DEF_HELPER_FLAGS_6(sve_fdiv_d, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, fpst, i32)
 
+DEF_HELPER_FLAGS_6(sve_fmin_b16, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_6(sve_fmin_h, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_6(sve_fmin_s, TCG_CALL_NO_RWG,
@@ -1237,6 +1239,8 @@ DEF_HELPER_FLAGS_6(sve_fmin_s, TCG_CALL_NO_RWG,
 DEF_HELPER_FLAGS_6(sve_fmin_d, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, fpst, i32)
 
+DEF_HELPER_FLAGS_6(sve_fmax_b16, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_6(sve_fmax_h, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_6(sve_fmax_s, TCG_CALL_NO_RWG,
@@ -1244,6 +1248,8 @@ DEF_HELPER_FLAGS_6(sve_fmax_s, TCG_CALL_NO_RWG,
 DEF_HELPER_FLAGS_6(sve_fmax_d, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, fpst, i32)
 
+DEF_HELPER_FLAGS_6(sve_ah_fmin_b16, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_6(sve_ah_fmin_h, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_6(sve_ah_fmin_s, TCG_CALL_NO_RWG,
@@ -1251,6 +1257,8 @@ DEF_HELPER_FLAGS_6(sve_ah_fmin_s, TCG_CALL_NO_RWG,
 DEF_HELPER_FLAGS_6(sve_ah_fmin_d, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, fpst, i32)
 
+DEF_HELPER_FLAGS_6(sve_ah_fmax_b16, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_6(sve_ah_fmax_h, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_6(sve_ah_fmax_s, TCG_CALL_NO_RWG,
diff --git a/target/arm/tcg/sve_helper.c b/target/arm/tcg/sve_helper.c
index a229503bc2..1a56fa86d9 100644
--- a/target/arm/tcg/sve_helper.c
+++ b/target/arm/tcg/sve_helper.c
@@ -4648,18 +4648,22 @@ DO_ZPZZ_FP(sve_fdiv_h, uint16_t, H1_2, float16_div)
 DO_ZPZZ_FP(sve_fdiv_s, uint32_t, H1_4, float32_div)
 DO_ZPZZ_FP(sve_fdiv_d, uint64_t, H1_8, float64_div)
 
+DO_ZPZZ_FP(sve_fmin_b16, uint16_t, H1_2, bfloat16_min)
 DO_ZPZZ_FP(sve_fmin_h, uint16_t, H1_2, float16_min)
 DO_ZPZZ_FP(sve_fmin_s, uint32_t, H1_4, float32_min)
 DO_ZPZZ_FP(sve_fmin_d, uint64_t, H1_8, float64_min)
 
+DO_ZPZZ_FP(sve_fmax_b16, uint16_t, H1_2, bfloat16_max)
 DO_ZPZZ_FP(sve_fmax_h, uint16_t, H1_2, float16_max)
 DO_ZPZZ_FP(sve_fmax_s, uint32_t, H1_4, float32_max)
 DO_ZPZZ_FP(sve_fmax_d, uint64_t, H1_8, float64_max)
 
+DO_ZPZZ_FP(sve_ah_fmin_b16, uint16_t, H1_2, helper_sme2_ah_fmin_b16)
 DO_ZPZZ_FP(sve_ah_fmin_h, uint16_t, H1_2, helper_vfp_ah_minh)
 DO_ZPZZ_FP(sve_ah_fmin_s, uint32_t, H1_4, helper_vfp_ah_mins)
 DO_ZPZZ_FP(sve_ah_fmin_d, uint64_t, H1_8, helper_vfp_ah_mind)
 
+DO_ZPZZ_FP(sve_ah_fmax_b16, uint16_t, H1_2, helper_sme2_ah_fmax_b16)
 DO_ZPZZ_FP(sve_ah_fmax_h, uint16_t, H1_2, helper_vfp_ah_maxh)
 DO_ZPZZ_FP(sve_ah_fmax_s, uint32_t, H1_4, helper_vfp_ah_maxs)
 DO_ZPZZ_FP(sve_ah_fmax_d, uint64_t, H1_8, helper_vfp_ah_maxd)
diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
index 2739c226d7..27af3df9a4 100644
--- a/target/arm/tcg/translate-sve.c
+++ b/target/arm/tcg/translate-sve.c
@@ -4218,11 +4218,24 @@ TRANS_FEAT_NONSTREAMING(FTSMUL, aa64_sve, gen_gvec_fpst_arg_zzz,
     };                                                          \
     TRANS_FEAT(NAME, FEAT, gen_gvec_fpst_arg_zpzz, name##_zpzz_fns[a->esz], a)
 
+#define DO_ZPZZ_AH_FP_B16(NAME, FEAT, name, ah_name)                    \
+    static gen_helper_gvec_4_ptr * const name##_zpzz_fns[4] = {         \
+        gen_helper_##name##_b16, gen_helper_##name##_h,                 \
+        gen_helper_##name##_s, gen_helper_##name##_d                    \
+    };                                                                  \
+    static gen_helper_gvec_4_ptr * const name##_ah_zpzz_fns[4] = {      \
+        gen_helper_##ah_name##_b16, gen_helper_##ah_name##_h,           \
+        gen_helper_##ah_name##_s, gen_helper_##ah_name##_d              \
+    };                                                                  \
+    TRANS_FEAT(NAME, FEAT, gen_gvec_fpst_arg_zpzz,                      \
+               s->fpcr_ah ? name##_ah_zpzz_fns[a->esz] :                \
+               name##_zpzz_fns[a->esz], a)
+
 DO_ZPZZ_FP_B16(FADD_zpzz, aa64_sve, sve_fadd)
 DO_ZPZZ_FP_B16(FSUB_zpzz, aa64_sve, sve_fsub)
 DO_ZPZZ_FP_B16(FMUL_zpzz, aa64_sve, sve_fmul)
-DO_ZPZZ_AH_FP(FMIN_zpzz, aa64_sve, sve_fmin, sve_ah_fmin)
-DO_ZPZZ_AH_FP(FMAX_zpzz, aa64_sve, sve_fmax, sve_ah_fmax)
+DO_ZPZZ_AH_FP_B16(FMIN_zpzz, aa64_sve, sve_fmin, sve_ah_fmin)
+DO_ZPZZ_AH_FP_B16(FMAX_zpzz, aa64_sve, sve_fmax, sve_ah_fmax)
 DO_ZPZZ_FP_B16(FMINNM_zpzz, aa64_sve, sve_fminnum)
 DO_ZPZZ_FP_B16(FMAXNM_zpzz, aa64_sve, sve_fmaxnum)
 DO_ZPZZ_AH_FP(FABD, aa64_sve, sve_fabd, sve_ah_fabd)

From f71c3f470f48bece6d0601171bfda63a0b746879 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Fri, 18 Jul 2025 18:30:26 +0100
Subject: [PATCH 2586/2760] target/arm: Add BFMUL (indexed)

FEAT_SVE_B16B16 adds a bfloat16 version of the FMUL insn in the
floating-point multiply (indexed) instruction group. The encoding
is slightly bespoke; in our implementation we use MO_8 to indicate
bfloat16, as with the other B16B16 insns.

Fixes: 7b1613a1020d2942 ("target/arm: Enable FEAT_SME2p1 on -cpu max")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250718173032.2498900-5-peter.maydell@linaro.org
---
 target/arm/tcg/helper.h        | 2 ++
 target/arm/tcg/sve.decode      | 1 +
 target/arm/tcg/translate-sve.c | 2 +-
 target/arm/tcg/vec_helper.c    | 1 +
 4 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/target/arm/tcg/helper.h b/target/arm/tcg/helper.h
index d9ca5b7c56..4da32db902 100644
--- a/target/arm/tcg/helper.h
+++ b/target/arm/tcg/helper.h
@@ -823,6 +823,8 @@ DEF_HELPER_FLAGS_5(gvec_ftsmul_s, TCG_CALL_NO_RWG,
 DEF_HELPER_FLAGS_5(gvec_ftsmul_d, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, fpst, i32)
 
+DEF_HELPER_FLAGS_5(gvec_fmul_idx_b16, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_5(gvec_fmul_idx_h, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_5(gvec_fmul_idx_s, TCG_CALL_NO_RWG,
diff --git a/target/arm/tcg/sve.decode b/target/arm/tcg/sve.decode
index 2efd5f57e4..a76f2236f4 100644
--- a/target/arm/tcg/sve.decode
+++ b/target/arm/tcg/sve.decode
@@ -1062,6 +1062,7 @@ FMLS_zzxz       01100100 11 1 ..... 000001 ..... .....  @rrxr_1 esz=3
 ### SVE FP Multiply Indexed Group
 
 # SVE floating-point multiply (indexed)
+FMUL_zzx        01100100 0. 1 ..... 001010 ..... .....   @rrx_3 esz=0
 FMUL_zzx        01100100 0. 1 ..... 001000 ..... .....   @rrx_3 esz=1
 FMUL_zzx        01100100 10 1 ..... 001000 ..... .....   @rrx_2 esz=2
 FMUL_zzx        01100100 11 1 ..... 001000 ..... .....   @rrx_1 esz=3
diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
index 27af3df9a4..918cf6e1bd 100644
--- a/target/arm/tcg/translate-sve.c
+++ b/target/arm/tcg/translate-sve.c
@@ -3907,7 +3907,7 @@ TRANS_FEAT(FMLS_zzxz, aa64_sve, gen_gvec_fpst_zzzz,
  */
 
 static gen_helper_gvec_3_ptr * const fmul_idx_fns[4] = {
-    NULL,                       gen_helper_gvec_fmul_idx_h,
+    gen_helper_gvec_fmul_idx_b16, gen_helper_gvec_fmul_idx_h,
     gen_helper_gvec_fmul_idx_s, gen_helper_gvec_fmul_idx_d,
 };
 TRANS_FEAT(FMUL_zzx, aa64_sve, gen_gvec_fpst_zzz,
diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
index 76a9ab0da3..33a136b90a 100644
--- a/target/arm/tcg/vec_helper.c
+++ b/target/arm/tcg/vec_helper.c
@@ -1785,6 +1785,7 @@ void HELPER(NAME)(void *vd, void *vn, void *vm,                            \
 
 #define nop(N, M, S) (M)
 
+DO_FMUL_IDX(gvec_fmul_idx_b16, nop, bfloat16_mul, float16, H2)
 DO_FMUL_IDX(gvec_fmul_idx_h, nop, float16_mul, float16, H2)
 DO_FMUL_IDX(gvec_fmul_idx_s, nop, float32_mul, float32, H4)
 DO_FMUL_IDX(gvec_fmul_idx_d, nop, float64_mul, float64, H8)

From 929bec5581966c43d083588f9be38af48150c4fe Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Fri, 18 Jul 2025 18:30:27 +0100
Subject: [PATCH 2587/2760] target/arm: Add BFMLA, BFMLS (vectors)

FEAT_SVE_B16B16 adds bfloat16 versions of the FMLA and FMLS insns in
the "SVE floating-point multiply-accumulate writing addend" group,
encoded as sz=0b00.

Fixes: 7b1613a1020d2942 ("target/arm: Enable FEAT_SME2p1 on -cpu max")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250718173032.2498900-6-peter.maydell@linaro.org
---
 target/arm/tcg/helper-sve.h    | 14 +++++++
 target/arm/tcg/sve_helper.c    | 69 ++++++++++++++++++++++++++++++++++
 target/arm/tcg/translate-sve.c | 21 ++++++++---
 3 files changed, 98 insertions(+), 6 deletions(-)

diff --git a/target/arm/tcg/helper-sve.h b/target/arm/tcg/helper-sve.h
index cb6c2355e5..5e4b7fd8cf 100644
--- a/target/arm/tcg/helper-sve.h
+++ b/target/arm/tcg/helper-sve.h
@@ -1541,6 +1541,8 @@ DEF_HELPER_FLAGS_6(sve_fcadd_s, TCG_CALL_NO_RWG,
 DEF_HELPER_FLAGS_6(sve_fcadd_d, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, fpst, i32)
 
+DEF_HELPER_FLAGS_7(sve_fmla_zpzzz_b16, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_7(sve_fmla_zpzzz_h, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_7(sve_fmla_zpzzz_s, TCG_CALL_NO_RWG,
@@ -1548,6 +1550,8 @@ DEF_HELPER_FLAGS_7(sve_fmla_zpzzz_s, TCG_CALL_NO_RWG,
 DEF_HELPER_FLAGS_7(sve_fmla_zpzzz_d, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, ptr, fpst, i32)
 
+DEF_HELPER_FLAGS_7(sve_fmls_zpzzz_b16, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_7(sve_fmls_zpzzz_h, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_7(sve_fmls_zpzzz_s, TCG_CALL_NO_RWG,
@@ -1555,6 +1559,8 @@ DEF_HELPER_FLAGS_7(sve_fmls_zpzzz_s, TCG_CALL_NO_RWG,
 DEF_HELPER_FLAGS_7(sve_fmls_zpzzz_d, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, ptr, fpst, i32)
 
+DEF_HELPER_FLAGS_7(sve_fnmla_zpzzz_b16, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_7(sve_fnmla_zpzzz_h, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_7(sve_fnmla_zpzzz_s, TCG_CALL_NO_RWG,
@@ -1562,6 +1568,8 @@ DEF_HELPER_FLAGS_7(sve_fnmla_zpzzz_s, TCG_CALL_NO_RWG,
 DEF_HELPER_FLAGS_7(sve_fnmla_zpzzz_d, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, ptr, fpst, i32)
 
+DEF_HELPER_FLAGS_7(sve_fnmls_zpzzz_b16, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_7(sve_fnmls_zpzzz_h, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_7(sve_fnmls_zpzzz_s, TCG_CALL_NO_RWG,
@@ -1569,6 +1577,8 @@ DEF_HELPER_FLAGS_7(sve_fnmls_zpzzz_s, TCG_CALL_NO_RWG,
 DEF_HELPER_FLAGS_7(sve_fnmls_zpzzz_d, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, ptr, fpst, i32)
 
+DEF_HELPER_FLAGS_7(sve_ah_fmls_zpzzz_b16, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_7(sve_ah_fmls_zpzzz_h, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_7(sve_ah_fmls_zpzzz_s, TCG_CALL_NO_RWG,
@@ -1576,6 +1586,8 @@ DEF_HELPER_FLAGS_7(sve_ah_fmls_zpzzz_s, TCG_CALL_NO_RWG,
 DEF_HELPER_FLAGS_7(sve_ah_fmls_zpzzz_d, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, ptr, fpst, i32)
 
+DEF_HELPER_FLAGS_7(sve_ah_fnmla_zpzzz_b16, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_7(sve_ah_fnmla_zpzzz_h, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_7(sve_ah_fnmla_zpzzz_s, TCG_CALL_NO_RWG,
@@ -1583,6 +1595,8 @@ DEF_HELPER_FLAGS_7(sve_ah_fnmla_zpzzz_s, TCG_CALL_NO_RWG,
 DEF_HELPER_FLAGS_7(sve_ah_fnmla_zpzzz_d, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, ptr, fpst, i32)
 
+DEF_HELPER_FLAGS_7(sve_ah_fnmls_zpzzz_b16, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_7(sve_ah_fnmls_zpzzz_h, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_7(sve_ah_fnmls_zpzzz_s, TCG_CALL_NO_RWG,
diff --git a/target/arm/tcg/sve_helper.c b/target/arm/tcg/sve_helper.c
index 1a56fa86d9..105cc5dd12 100644
--- a/target/arm/tcg/sve_helper.c
+++ b/target/arm/tcg/sve_helper.c
@@ -5099,6 +5099,75 @@ DO_ZPZ_FP(flogb_d, float64, H1_8, do_float64_logb_as_int)
 
 #undef DO_ZPZ_FP
 
+static void do_fmla_zpzzz_b16(void *vd, void *vn, void *vm, void *va, void *vg,
+                              float_status *status, uint32_t desc,
+                              uint16_t neg1, uint16_t neg3, int flags)
+{
+    intptr_t i = simd_oprsz(desc);
+    uint64_t *g = vg;
+
+    do {
+        uint64_t pg = g[(i - 1) >> 6];
+        do {
+            i -= 2;
+            if (likely((pg >> (i & 63)) & 1)) {
+                float16 e1, e2, e3, r;
+
+                e1 = *(uint16_t *)(vn + H1_2(i)) ^ neg1;
+                e2 = *(uint16_t *)(vm + H1_2(i));
+                e3 = *(uint16_t *)(va + H1_2(i)) ^ neg3;
+                r = bfloat16_muladd(e1, e2, e3, flags, status);
+                *(uint16_t *)(vd + H1_2(i)) = r;
+            }
+        } while (i & 63);
+    } while (i != 0);
+}
+
+void HELPER(sve_fmla_zpzzz_b16)(void *vd, void *vn, void *vm, void *va,
+                              void *vg, float_status *status, uint32_t desc)
+{
+    do_fmla_zpzzz_b16(vd, vn, vm, va, vg, status, desc, 0, 0, 0);
+}
+
+void HELPER(sve_fmls_zpzzz_b16)(void *vd, void *vn, void *vm, void *va,
+                              void *vg, float_status *status, uint32_t desc)
+{
+    do_fmla_zpzzz_b16(vd, vn, vm, va, vg, status, desc, 0x8000, 0, 0);
+}
+
+void HELPER(sve_fnmla_zpzzz_b16)(void *vd, void *vn, void *vm, void *va,
+                               void *vg, float_status *status, uint32_t desc)
+{
+    do_fmla_zpzzz_b16(vd, vn, vm, va, vg, status, desc, 0x8000, 0x8000, 0);
+}
+
+void HELPER(sve_fnmls_zpzzz_b16)(void *vd, void *vn, void *vm, void *va,
+                               void *vg, float_status *status, uint32_t desc)
+{
+    do_fmla_zpzzz_b16(vd, vn, vm, va, vg, status, desc, 0, 0x8000, 0);
+}
+
+void HELPER(sve_ah_fmls_zpzzz_b16)(void *vd, void *vn, void *vm, void *va,
+                              void *vg, float_status *status, uint32_t desc)
+{
+    do_fmla_zpzzz_b16(vd, vn, vm, va, vg, status, desc, 0, 0,
+                      float_muladd_negate_product);
+}
+
+void HELPER(sve_ah_fnmla_zpzzz_b16)(void *vd, void *vn, void *vm, void *va,
+                               void *vg, float_status *status, uint32_t desc)
+{
+    do_fmla_zpzzz_b16(vd, vn, vm, va, vg, status, desc, 0, 0,
+                      float_muladd_negate_product | float_muladd_negate_c);
+}
+
+void HELPER(sve_ah_fnmls_zpzzz_b16)(void *vd, void *vn, void *vm, void *va,
+                               void *vg, float_status *status, uint32_t desc)
+{
+    do_fmla_zpzzz_b16(vd, vn, vm, va, vg, status, desc, 0, 0,
+                      float_muladd_negate_c);
+}
+
 static void do_fmla_zpzzz_h(void *vd, void *vn, void *vm, void *va, void *vg,
                             float_status *status, uint32_t desc,
                             uint16_t neg1, uint16_t neg3, int flags)
diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
index 918cf6e1bd..37ecbc2b7c 100644
--- a/target/arm/tcg/translate-sve.c
+++ b/target/arm/tcg/translate-sve.c
@@ -4368,19 +4368,28 @@ TRANS_FEAT(FCADD, aa64_sve, gen_gvec_fpst_zzzp, fcadd_fns[a->esz],
            a->rd, a->rn, a->rm, a->pg, a->rot | (s->fpcr_ah << 1),
            a->esz == MO_16 ? FPST_A64_F16 : FPST_A64)
 
+static bool do_fmla_zpzzz(DisasContext *s, arg_rprrr_esz *a,
+                          gen_helper_gvec_5_ptr *fn)
+{
+    /* These insns use MO_8 to encode BFloat16 */
+    if (a->esz == MO_8 && !dc_isar_feature(aa64_sve_b16b16, s)) {
+        return false;
+    }
+    return gen_gvec_fpst_zzzzp(s, fn, a->rd, a->rn, a->rm, a->ra, a->pg, 0,
+                               a->esz == MO_16 ? FPST_A64_F16 : FPST_A64);
+}
+
 #define DO_FMLA(NAME, name, ah_name)                                    \
     static gen_helper_gvec_5_ptr * const name##_fns[4] = {              \
-        NULL, gen_helper_sve_##name##_h,                                \
+        gen_helper_sve_##name##_b16, gen_helper_sve_##name##_h,         \
         gen_helper_sve_##name##_s, gen_helper_sve_##name##_d            \
     };                                                                  \
     static gen_helper_gvec_5_ptr * const name##_ah_fns[4] = {           \
-        NULL, gen_helper_sve_##ah_name##_h,                             \
+        gen_helper_sve_##ah_name##_b16, gen_helper_sve_##ah_name##_h,   \
         gen_helper_sve_##ah_name##_s, gen_helper_sve_##ah_name##_d      \
     };                                                                  \
-    TRANS_FEAT(NAME, aa64_sve, gen_gvec_fpst_zzzzp,                     \
-               s->fpcr_ah ? name##_ah_fns[a->esz] : name##_fns[a->esz], \
-               a->rd, a->rn, a->rm, a->ra, a->pg, 0,                    \
-               a->esz == MO_16 ? FPST_A64_F16 : FPST_A64)
+    TRANS_FEAT(NAME, aa64_sve, do_fmla_zpzzz, a,                        \
+               s->fpcr_ah ? name##_ah_fns[a->esz] : name##_fns[a->esz])
 
 /* We don't need an ah_fmla_zpzzz because fmla doesn't negate anything */
 DO_FMLA(FMLA_zpzzz, fmla_zpzzz, fmla_zpzzz)

From 67fbc4c8079226eb9e47369cc45eb3fe56c3c9c3 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Fri, 18 Jul 2025 18:30:28 +0100
Subject: [PATCH 2588/2760] target/arm: Add BFMLA, BFMLS (indexed)

FEAT_SVE_B16B16 adds bfloat16 versions of the FMLA and FMLS insns in
the SVE floating-point multiply-add (indexed) insn group.  Implement
these.

Fixes: 7b1613a1020d2942 ("target/arm: Enable FEAT_SME2p1 on -cpu max")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250718173032.2498900-7-peter.maydell@linaro.org
---
 target/arm/tcg/sve.decode      |  2 ++
 target/arm/tcg/translate-sve.c | 25 ++++++++++++++++---------
 2 files changed, 18 insertions(+), 9 deletions(-)

diff --git a/target/arm/tcg/sve.decode b/target/arm/tcg/sve.decode
index a76f2236f4..a77b725c87 100644
--- a/target/arm/tcg/sve.decode
+++ b/target/arm/tcg/sve.decode
@@ -1052,9 +1052,11 @@ FCMLA_zzxz      01100100 11 1 index:1 rm:4 0001 rot:2 rn:5 rd:5 \
 ### SVE FP Multiply-Add Indexed Group
 
 # SVE floating-point multiply-add (indexed)
+FMLA_zzxz       01100100 0. 1 ..... 000010 ..... .....  @rrxr_3 esz=0
 FMLA_zzxz       01100100 0. 1 ..... 000000 ..... .....  @rrxr_3 esz=1
 FMLA_zzxz       01100100 10 1 ..... 000000 ..... .....  @rrxr_2 esz=2
 FMLA_zzxz       01100100 11 1 ..... 000000 ..... .....  @rrxr_1 esz=3
+FMLS_zzxz       01100100 0. 1 ..... 000011 ..... .....  @rrxr_3 esz=0
 FMLS_zzxz       01100100 0. 1 ..... 000001 ..... .....  @rrxr_3 esz=1
 FMLS_zzxz       01100100 10 1 ..... 000001 ..... .....  @rrxr_2 esz=2
 FMLS_zzxz       01100100 11 1 ..... 000001 ..... .....  @rrxr_1 esz=3
diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
index 37ecbc2b7c..fc76624b5a 100644
--- a/target/arm/tcg/translate-sve.c
+++ b/target/arm/tcg/translate-sve.c
@@ -3883,24 +3883,31 @@ DO_SVE2_RRXR_ROT(CDOT_zzxw_d, gen_helper_sve2_cdot_idx_d)
  *** SVE Floating Point Multiply-Add Indexed Group
  */
 
+static bool do_fmla_zzxz(DisasContext *s, arg_rrxr_esz *a,
+                         gen_helper_gvec_4_ptr *fn)
+{
+    /* These insns use MO_8 to encode BFloat16 */
+    if (a->esz == MO_8 && !dc_isar_feature(aa64_sve_b16b16, s)) {
+        return false;
+    }
+    return gen_gvec_fpst_zzzz(s, fn, a->rd, a->rn, a->rm, a->ra, a->index,
+                              a->esz == MO_16 ? FPST_A64_F16 : FPST_A64);
+}
+
 static gen_helper_gvec_4_ptr * const fmla_idx_fns[4] = {
-    NULL,                       gen_helper_gvec_fmla_idx_h,
+    gen_helper_gvec_bfmla_idx, gen_helper_gvec_fmla_idx_h,
     gen_helper_gvec_fmla_idx_s, gen_helper_gvec_fmla_idx_d
 };
-TRANS_FEAT(FMLA_zzxz, aa64_sve, gen_gvec_fpst_zzzz,
-           fmla_idx_fns[a->esz], a->rd, a->rn, a->rm, a->ra, a->index,
-           a->esz == MO_16 ? FPST_A64_F16 : FPST_A64)
+TRANS_FEAT(FMLA_zzxz, aa64_sve, do_fmla_zzxz, a, fmla_idx_fns[a->esz])
 
 static gen_helper_gvec_4_ptr * const fmls_idx_fns[4][2] = {
-    { NULL, NULL },
+    { gen_helper_gvec_bfmls_idx, gen_helper_gvec_ah_bfmls_idx },
     { gen_helper_gvec_fmls_idx_h, gen_helper_gvec_ah_fmls_idx_h },
     { gen_helper_gvec_fmls_idx_s, gen_helper_gvec_ah_fmls_idx_s },
     { gen_helper_gvec_fmls_idx_d, gen_helper_gvec_ah_fmls_idx_d },
 };
-TRANS_FEAT(FMLS_zzxz, aa64_sve, gen_gvec_fpst_zzzz,
-           fmls_idx_fns[a->esz][s->fpcr_ah],
-           a->rd, a->rn, a->rm, a->ra, a->index,
-           a->esz == MO_16 ? FPST_A64_F16 : FPST_A64)
+TRANS_FEAT(FMLS_zzxz, aa64_sve, do_fmla_zzxz, a,
+           fmls_idx_fns[a->esz][s->fpcr_ah])
 
 /*
  *** SVE Floating Point Multiply Indexed Group

From 17f6436822ff600cae4590c4b06b3321c97f1f42 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Fri, 18 Jul 2025 18:30:29 +0100
Subject: [PATCH 2589/2760] target/arm: Correct sense of FPCR.AH test for
 FMAXQV and FMINQV
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When we implemented the FMAXQV and FMINQV insns we accidentally
inverted the sense of the FPCR.AH test, so we gave the AH=1 behaviour
when FPCR.AH was zero, and vice-versa.  (The difference is limited to
handling of negative zero and NaN inputs.)

Fixes: 1de7ecfc12d05 ("target/arm: Implement FADDQV, F{MIN, MAX}{NM}QV for SVE2p1")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250718173032.2498900-8-peter.maydell@linaro.org
---
 target/arm/tcg/translate-sve.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
index fc76624b5a..2ed440aff1 100644
--- a/target/arm/tcg/translate-sve.c
+++ b/target/arm/tcg/translate-sve.c
@@ -4020,7 +4020,7 @@ static gen_helper_gvec_3_ptr * const fmaxqv_ah_fns[4] = {
     gen_helper_sve2p1_ah_fmaxqv_s, gen_helper_sve2p1_ah_fmaxqv_d,
 };
 TRANS_FEAT(FMAXQV, aa64_sme2p1_or_sve2p1, gen_gvec_fpst_arg_zpz,
-           (s->fpcr_ah ? fmaxqv_fns : fmaxqv_ah_fns)[a->esz], a, 0,
+           (s->fpcr_ah ? fmaxqv_ah_fns : fmaxqv_fns)[a->esz], a, 0,
            a->esz == MO_16 ? FPST_A64_F16 : FPST_A64)
 
 static gen_helper_gvec_3_ptr * const fminqv_fns[4] = {
@@ -4032,7 +4032,7 @@ static gen_helper_gvec_3_ptr * const fminqv_ah_fns[4] = {
     gen_helper_sve2p1_ah_fminqv_s, gen_helper_sve2p1_ah_fminqv_d,
 };
 TRANS_FEAT(FMINQV, aa64_sme2p1_or_sve2p1, gen_gvec_fpst_arg_zpz,
-           (s->fpcr_ah ? fminqv_fns : fminqv_ah_fns)[a->esz], a, 0,
+           (s->fpcr_ah ? fminqv_ah_fns : fminqv_fns)[a->esz], a, 0,
            a->esz == MO_16 ? FPST_A64_F16 : FPST_A64)
 
 /*

From 07327d5f451162a841747836ff05cc6dd6e8c023 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Fri, 18 Jul 2025 18:30:30 +0100
Subject: [PATCH 2590/2760] target/arm: Don't nest H() macro calls in SVE
 DO_REDUCE

In the part of the SVE DO_REDUCE macro used by the SVE2p1 FMAXQV,
FMINQV, etc insns, we incorrectly applied the H() macro twice when
calculating an offset to add to the vn pointer.  This has no effect
on little-endian hosts but on big-endian hosts the two invocations
will cancel each other out and we will access the wrong part of the
array.

The "s * 16" part of the expression is already aligned, so we only
need to use the H macro on the "e". Correct the macro usage.

Fixes: 1de7ecfc12d05 ("target/arm: Implement FADDQV, F{MIN, MAX}{NM}QV for SVE2p1")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250718173032.2498900-9-peter.maydell@linaro.org
---
 target/arm/tcg/sve_helper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/tcg/sve_helper.c b/target/arm/tcg/sve_helper.c
index 105cc5dd12..bf894f0bf1 100644
--- a/target/arm/tcg/sve_helper.c
+++ b/target/arm/tcg/sve_helper.c
@@ -4509,7 +4509,7 @@ void helper_sve2p1_##NAME##qv_##SUF(void *vd, void *vn, void *vg,     \
         TYPE data[ARM_MAX_VQ];                                        \
         for (unsigned s = 0; s < segments; s++) {                     \
             uint16_t pg = *(uint16_t *)(vg + H1_2(s * 2));            \
-            TYPE nn = *(TYPE *)(vn + H(s * 16 + H(e)));               \
+            TYPE nn = *(TYPE *)(vn + (s * 16 + H(e)));                \
             data[s] = (pg >> e) & 1 ? nn : IDENT;                     \
         }                                                             \
         *(TYPE *)(vd + H(e)) = FUNC##_reduce(data, status, segments); \

From 82a1c5c661ef9ab567b7946b75240963c153a3b0 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Fri, 18 Jul 2025 18:30:31 +0100
Subject: [PATCH 2591/2760] target/arm: Honour FPCR.AH=1 default NaN value in
 FMAXNMQV, FMINNMQV

The FMAXNMQV and FMINNMQV insns use the default NaN as their identity
value for inactive source vector elements. We open-coded this in
sve_helper.c, hoping to avoid a function call. However, this fails
to account for FPCR.AH=1 changing the default NaN value to set the
sign bit. Use a call to floatN_default_nan() to obtain this value.

Fixes: 1de7ecfc12d05 ("target/arm: Implement FADDQV, F{MIN, MAX}{NM}QV for SVE2p1")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250718173032.2498900-10-peter.maydell@linaro.org
---
 target/arm/tcg/sve_helper.c | 29 +++++++++++++++++------------
 1 file changed, 17 insertions(+), 12 deletions(-)

diff --git a/target/arm/tcg/sve_helper.c b/target/arm/tcg/sve_helper.c
index bf894f0bf1..803f0a094d 100644
--- a/target/arm/tcg/sve_helper.c
+++ b/target/arm/tcg/sve_helper.c
@@ -4484,33 +4484,35 @@ static TYPE FUNC##_reduce(TYPE *data, float_status *status, uintptr_t n) \
     }                                                                 \
 }                                                                     \
 uint64_t helper_sve_##NAME##v_##SUF(void *vn, void *vg,               \
-                                    float_status *s, uint32_t desc)   \
+                                    float_status *status, uint32_t desc) \
 {                                                                     \
     uintptr_t i, oprsz = simd_oprsz(desc), maxsz = simd_data(desc);   \
     TYPE data[sizeof(ARMVectorReg) / sizeof(TYPE)];                   \
+    TYPE ident = IDENT;                                               \
     for (i = 0; i < oprsz; ) {                                        \
         uint16_t pg = *(uint16_t *)(vg + H1_2(i >> 3));               \
         do {                                                          \
             TYPE nn = *(TYPE *)(vn + H(i));                           \
-            *(TYPE *)((void *)data + i) = (pg & 1 ? nn : IDENT);      \
+            *(TYPE *)((void *)data + i) = (pg & 1 ? nn : ident);      \
             i += sizeof(TYPE), pg >>= sizeof(TYPE);                   \
         } while (i & 15);                                             \
     }                                                                 \
     for (; i < maxsz; i += sizeof(TYPE)) {                            \
-        *(TYPE *)((void *)data + i) = IDENT;                          \
+        *(TYPE *)((void *)data + i) = ident;                          \
     }                                                                 \
-    return FUNC##_reduce(data, s, maxsz / sizeof(TYPE));              \
+    return FUNC##_reduce(data, status, maxsz / sizeof(TYPE));         \
 }                                                                     \
 void helper_sve2p1_##NAME##qv_##SUF(void *vd, void *vn, void *vg,     \
                                     float_status *status, uint32_t desc) \
 {                                                                     \
     unsigned oprsz = simd_oprsz(desc), segments = oprsz / 16;         \
+    TYPE ident = IDENT;                                               \
     for (unsigned e = 0; e < 16; e += sizeof(TYPE)) {                 \
         TYPE data[ARM_MAX_VQ];                                        \
         for (unsigned s = 0; s < segments; s++) {                     \
             uint16_t pg = *(uint16_t *)(vg + H1_2(s * 2));            \
             TYPE nn = *(TYPE *)(vn + (s * 16 + H(e)));                \
-            data[s] = (pg >> e) & 1 ? nn : IDENT;                     \
+            data[s] = (pg >> e) & 1 ? nn : ident;                     \
         }                                                             \
         *(TYPE *)(vd + H(e)) = FUNC##_reduce(data, status, segments); \
     }                                                                 \
@@ -4521,14 +4523,17 @@ DO_REDUCE(fadd,h, float16, H1_2, float16_add, float16_zero)
 DO_REDUCE(fadd,s, float32, H1_4, float32_add, float32_zero)
 DO_REDUCE(fadd,d, float64, H1_8, float64_add, float64_zero)
 
-/* Identity is floatN_default_nan, without the function call.  */
-DO_REDUCE(fminnm,h, float16, H1_2, float16_minnum, 0x7E00)
-DO_REDUCE(fminnm,s, float32, H1_4, float32_minnum, 0x7FC00000)
-DO_REDUCE(fminnm,d, float64, H1_8, float64_minnum, 0x7FF8000000000000ULL)
+/*
+ * We can't avoid the function call for the default NaN value, because
+ * it changes when FPCR.AH is set.
+ */
+DO_REDUCE(fminnm,h, float16, H1_2, float16_minnum, float16_default_nan(status))
+DO_REDUCE(fminnm,s, float32, H1_4, float32_minnum, float32_default_nan(status))
+DO_REDUCE(fminnm,d, float64, H1_8, float64_minnum, float64_default_nan(status))
 
-DO_REDUCE(fmaxnm,h, float16, H1_2, float16_maxnum, 0x7E00)
-DO_REDUCE(fmaxnm,s, float32, H1_4, float32_maxnum, 0x7FC00000)
-DO_REDUCE(fmaxnm,d, float64, H1_8, float64_maxnum, 0x7FF8000000000000ULL)
+DO_REDUCE(fmaxnm,h, float16, H1_2, float16_maxnum, float16_default_nan(status))
+DO_REDUCE(fmaxnm,s, float32, H1_4, float32_maxnum, float32_default_nan(status))
+DO_REDUCE(fmaxnm,d, float64, H1_8, float64_maxnum, float64_default_nan(status))
 
 DO_REDUCE(fmin,h, float16, H1_2, float16_min, float16_infinity)
 DO_REDUCE(fmin,s, float32, H1_4, float32_min, float32_infinity)

From 082933a1f7d3c8e4a9e999c3d284928ef866c67d Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Fri, 18 Jul 2025 18:30:32 +0100
Subject: [PATCH 2592/2760] target/arm: Make LD1Q decode and trans fn agree
 about a->u

For the LD1Q instruction (gather load of quadwords) we use the
LD1_zprz pattern with MO_128 elements.  At this element size there is
no signed vs unsigned distinction, and we only set the 'u' bit in the
arg_LD1_zprz struct because we share the code and decode struct with
smaller element sizes.

However, we set u=0 in the decode pattern line but then accidentally
asserted that it was 1 in the trans function.  Since our usual convention
is that the "default" is unsigned and we only mark operations as signed
when they really do need to extend, change the decode pattern line to
set u=1 to match the assert.

Fixes: d2aa9a804ee6 ("target/arm: Implement LD1Q, ST1Q for SVE2p1")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250718173032.2498900-11-peter.maydell@linaro.org
---
 target/arm/tcg/sve.decode | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/tcg/sve.decode b/target/arm/tcg/sve.decode
index a77b725c87..aea7f51973 100644
--- a/target/arm/tcg/sve.decode
+++ b/target/arm/tcg/sve.decode
@@ -1345,7 +1345,7 @@ LD1_zprz        1100010 11 1. ..... 11. ... ..... ..... \
 
 # LD1Q
 LD1_zprz        1100 0100 000 rm:5 101 pg:3 rn:5 rd:5 \
-                &rprr_gather_load u=0 ff=0 xs=2 esz=4 msz=4 scale=0
+                &rprr_gather_load u=1 ff=0 xs=2 esz=4 msz=4 scale=0
 
 # SVE 64-bit gather load (vector plus immediate)
 LD1_zpiz        1100010 .. 01 ..... 1.. ... ..... ..... \

From f19310b23a00b5c19f930e4d57fc298744d11740 Mon Sep 17 00:00:00 2001
From: Zenghui Yu <zenghui.yu@linux.dev>
Date: Tue, 15 Jul 2025 00:01:38 +0800
Subject: [PATCH 2593/2760] hvf: arm: Add permission check in GIC sysreg
 handlers

Quoting Peter Maydell:

" hvf_sysreg_read_cp() and hvf_sysreg_write_cp() do not check the .access
  field of the ARMCPRegInfo to ensure that they forbid writes to registers
  that are marked with a .access field that says they're read-only (and
  ditto reads to write-only registers). "

Before we add more registers in GIC sysreg handlers, let's get it correct
by adding the .access checks to hvf_sysreg_read_cp() and
hvf_sysreg_write_cp(). With that, a sysreg access with invalid permission
will result in an UNDEFINED exception.

Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Zenghui Yu <zenghui.yu@linux.dev>
Message-id: 20250714160139.10404-2-zenghui.yu@linux.dev
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/hvf/hvf.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index 8f93e42b34..861657df96 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -1263,6 +1263,9 @@ static bool hvf_sysreg_read_cp(CPUState *cpu, uint32_t reg, uint64_t *val)
 
     ri = get_arm_cp_reginfo(arm_cpu->cp_regs, hvf_reg2cp_reg(reg));
     if (ri) {
+        if (!cp_access_ok(1, ri, true)) {
+            return false;
+        }
         if (ri->accessfn) {
             if (ri->accessfn(env, ri, true) != CP_ACCESS_OK) {
                 return false;
@@ -1543,6 +1546,9 @@ static bool hvf_sysreg_write_cp(CPUState *cpu, uint32_t reg, uint64_t val)
     ri = get_arm_cp_reginfo(arm_cpu->cp_regs, hvf_reg2cp_reg(reg));
 
     if (ri) {
+        if (!cp_access_ok(1, ri, false)) {
+            return false;
+        }
         if (ri->accessfn) {
             if (ri->accessfn(env, ri, false) != CP_ACCESS_OK) {
                 return false;

From e6da704b711d5d731e4d933ad56cbbc25ee0a825 Mon Sep 17 00:00:00 2001
From: Zenghui Yu <zenghui.yu@linux.dev>
Date: Tue, 15 Jul 2025 00:01:39 +0800
Subject: [PATCH 2594/2760] hvf: arm: Emulate ICC_RPR_EL1 accesses properly
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Commit a2260983c655 ("hvf: arm: Add support for GICv3") added GICv3 support
by implementing emulation for a few system registers. ICC_RPR_EL1 was
defined but not plugged in the sysreg handlers (for no good reason).

Fix it.

Fixes: a2260983c655 ("hvf: arm: Add support for GICv3")
Signed-off-by: Zenghui Yu <zenghui.yu@linux.dev>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250714160139.10404-3-zenghui.yu@linux.dev
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/hvf/hvf.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index 861657df96..bd6b5d11de 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -1361,6 +1361,7 @@ static int hvf_sysreg_read(CPUState *cpu, uint32_t reg, uint64_t *val)
     case SYSREG_ICC_IGRPEN0_EL1:
     case SYSREG_ICC_IGRPEN1_EL1:
     case SYSREG_ICC_PMR_EL1:
+    case SYSREG_ICC_RPR_EL1:
     case SYSREG_ICC_SGI0R_EL1:
     case SYSREG_ICC_SGI1R_EL1:
     case SYSREG_ICC_SRE_EL1:
@@ -1678,6 +1679,7 @@ static int hvf_sysreg_write(CPUState *cpu, uint32_t reg, uint64_t val)
     case SYSREG_ICC_IGRPEN0_EL1:
     case SYSREG_ICC_IGRPEN1_EL1:
     case SYSREG_ICC_PMR_EL1:
+    case SYSREG_ICC_RPR_EL1:
     case SYSREG_ICC_SGI0R_EL1:
     case SYSREG_ICC_SGI1R_EL1:
     case SYSREG_ICC_SRE_EL1:

From 6f7f3419cce86553dd239f10a5deb9ab872bd8c2 Mon Sep 17 00:00:00 2001
From: Henry Kleynhans <hkleynhans@fb.com>
Date: Wed, 22 Dec 2021 15:05:59 +0000
Subject: [PATCH 2595/2760] crypto: load all certificates in X509 CA file
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Some CA files may contain multiple intermediaries and roots of trust.
These may not fit into the hard-coded limit of 16.

Extend the validation code to allocate enough space to load all of the
certificates present in the CA file and ensure they are cleaned up.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Henry Kleynhans <hkleynhans@fb.com>
[DB: drop MAX_CERTS constant & whitespace tweaks]
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 crypto/tlscredsx509.c | 23 +++++++++++------------
 1 file changed, 11 insertions(+), 12 deletions(-)

diff --git a/crypto/tlscredsx509.c b/crypto/tlscredsx509.c
index 63a72fe47c..cd1f504471 100644
--- a/crypto/tlscredsx509.c
+++ b/crypto/tlscredsx509.c
@@ -426,9 +426,8 @@ qcrypto_tls_creds_load_cert(QCryptoTLSCredsX509 *creds,
 static int
 qcrypto_tls_creds_load_ca_cert_list(QCryptoTLSCredsX509 *creds,
                                     const char *certFile,
-                                    gnutls_x509_crt_t *certs,
-                                    unsigned int certMax,
-                                    size_t *ncerts,
+                                    gnutls_x509_crt_t **certs,
+                                    unsigned int *ncerts,
                                     Error **errp)
 {
     gnutls_datum_t data;
@@ -449,20 +448,18 @@ qcrypto_tls_creds_load_ca_cert_list(QCryptoTLSCredsX509 *creds,
     data.data = (unsigned char *)buf;
     data.size = strlen(buf);
 
-    if (gnutls_x509_crt_list_import(certs, &certMax, &data,
-                                    GNUTLS_X509_FMT_PEM, 0) < 0) {
+    if (gnutls_x509_crt_list_import2(certs, ncerts, &data,
+                                     GNUTLS_X509_FMT_PEM, 0) < 0) {
         error_setg(errp,
                    "Unable to import CA certificate list %s",
                    certFile);
         return -1;
     }
-    *ncerts = certMax;
 
     return 0;
 }
 
 
-#define MAX_CERTS 16
 static int
 qcrypto_tls_creds_x509_sanity_check(QCryptoTLSCredsX509 *creds,
                                     bool isServer,
@@ -471,12 +468,11 @@ qcrypto_tls_creds_x509_sanity_check(QCryptoTLSCredsX509 *creds,
                                     Error **errp)
 {
     gnutls_x509_crt_t cert = NULL;
-    gnutls_x509_crt_t cacerts[MAX_CERTS];
-    size_t ncacerts = 0;
+    gnutls_x509_crt_t *cacerts = NULL;
+    unsigned int ncacerts = 0;
     size_t i;
     int ret = -1;
 
-    memset(cacerts, 0, sizeof(cacerts));
     if (certFile &&
         access(certFile, R_OK) == 0) {
         cert = qcrypto_tls_creds_load_cert(creds,
@@ -488,8 +484,9 @@ qcrypto_tls_creds_x509_sanity_check(QCryptoTLSCredsX509 *creds,
     }
     if (access(cacertFile, R_OK) == 0) {
         if (qcrypto_tls_creds_load_ca_cert_list(creds,
-                                                cacertFile, cacerts,
-                                                MAX_CERTS, &ncacerts,
+                                                cacertFile,
+                                                &cacerts,
+                                                &ncacerts,
                                                 errp) < 0) {
             goto cleanup;
         }
@@ -526,6 +523,8 @@ qcrypto_tls_creds_x509_sanity_check(QCryptoTLSCredsX509 *creds,
     for (i = 0; i < ncacerts; i++) {
         gnutls_x509_crt_deinit(cacerts[i]);
     }
+    g_free(cacerts);
+
     return ret;
 }
 

From 7724ca9a772594b96939ff549c74f46e11d7870b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 16 Jul 2025 19:28:11 +0200
Subject: [PATCH 2596/2760] accel/hvf: Display executable bit as 'X'
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Developers are accustomed to read RWX, not RWE.
Replace E -> X.

Reported-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Mads Ynddal <mads@ynddal.dk>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 accel/hvf/hvf-all.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/accel/hvf/hvf-all.c b/accel/hvf/hvf-all.c
index e67a8105a6..0a4b498e83 100644
--- a/accel/hvf/hvf-all.c
+++ b/accel/hvf/hvf-all.c
@@ -84,7 +84,7 @@ static int do_hvf_set_memory(hvf_slot *slot, hv_memory_flags_t flags)
     trace_hvf_vm_map(slot->start, slot->size, slot->mem, flags,
                      flags & HV_MEMORY_READ ?  'R' : '-',
                      flags & HV_MEMORY_WRITE ? 'W' : '-',
-                     flags & HV_MEMORY_EXEC ?  'E' : '-');
+                     flags & HV_MEMORY_EXEC ?  'X' : '-');
     ret = hv_vm_map(slot->mem, slot->start, slot->size, flags);
     assert_hvf_ok(ret);
     return 0;

From 2c047bdb77e8f636936edd9ac5000521c9580477 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 18 Jul 2025 17:34:06 +0000
Subject: [PATCH 2597/2760] tcg/optimize: Don't fold INDEX_op_and_vec to
 extract

There is no such thing as vector extract.

Fixes: 932522a9ddc1 ("tcg/optimize: Fold and to extract during optimize")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3036
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Tested-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
---
 tcg/optimize.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index 62a128bc9b..3638ab9fea 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -1454,7 +1454,7 @@ static bool fold_and(OptContext *ctx, TCGOp *op)
     a_mask = t1->z_mask & ~t2->o_mask;
 
     if (!fold_masks_zosa_int(ctx, op, z_mask, o_mask, s_mask, a_mask)) {
-        if (ti_is_const(t2)) {
+        if (op->opc == INDEX_op_and && ti_is_const(t2)) {
             /*
              * Canonicalize on extract, if valid.  This aids x86 with its
              * 2 operand MOVZBL and 2 operand AND, selecting the TCGOpcode

From 0d70c5aa1bbfb0f5099d53d6e084337a8246cc0c Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Mon, 21 Jul 2025 12:51:31 +0200
Subject: [PATCH 2598/2760] rust: devices are not staticlibs

This is only cosmetic for now, but hopefully later on Meson will parse more
of Cargo.toml.  Devices are linked into a staticlib but are not staticlibs
themselves.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/hw/char/pl011/Cargo.toml | 3 ---
 rust/hw/timer/hpet/Cargo.toml | 3 ---
 2 files changed, 6 deletions(-)

diff --git a/rust/hw/char/pl011/Cargo.toml b/rust/hw/char/pl011/Cargo.toml
index 003ef9613d..88ef110507 100644
--- a/rust/hw/char/pl011/Cargo.toml
+++ b/rust/hw/char/pl011/Cargo.toml
@@ -12,9 +12,6 @@ license.workspace = true
 repository.workspace = true
 rust-version.workspace = true
 
-[lib]
-crate-type = ["staticlib"]
-
 [dependencies]
 bilge = { version = "0.2.0" }
 bilge-impl = { version = "0.2.0" }
diff --git a/rust/hw/timer/hpet/Cargo.toml b/rust/hw/timer/hpet/Cargo.toml
index 6f07502784..ac5df23c1d 100644
--- a/rust/hw/timer/hpet/Cargo.toml
+++ b/rust/hw/timer/hpet/Cargo.toml
@@ -10,9 +10,6 @@ license.workspace = true
 repository.workspace = true
 rust-version.workspace = true
 
-[lib]
-crate-type = ["staticlib"]
-
 [dependencies]
 qemu_api = { path = "../../../qemu-api" }
 qemu_api_macros = { path = "../../../qemu-api-macros" }

From f63000d943bd7db60b338f12546a96efaa6058aa Mon Sep 17 00:00:00 2001
From: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Date: Fri, 18 Jul 2025 10:00:52 +0300
Subject: [PATCH 2599/2760] rust/pl011: merge device_class.rs into device.rs

The split was a relic of early development and is not necessary.

Signed-off-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Link: https://lore.kernel.org/r/20250718-rust-pl011-cleanup-v1-1-c71b1d6a69a5@linaro.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/hw/char/pl011/src/device.rs       | 103 +++++++++++++++++++++++--
 rust/hw/char/pl011/src/device_class.rs | 103 -------------------------
 rust/hw/char/pl011/src/lib.rs          |   1 -
 3 files changed, 96 insertions(+), 111 deletions(-)
 delete mode 100644 rust/hw/char/pl011/src/device_class.rs

diff --git a/rust/hw/char/pl011/src/device.rs b/rust/hw/char/pl011/src/device.rs
index 5b53f2649f..ceb71dd99b 100644
--- a/rust/hw/char/pl011/src/device.rs
+++ b/rust/hw/char/pl011/src/device.rs
@@ -2,9 +2,14 @@
 // Author(s): Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
 // SPDX-License-Identifier: GPL-2.0-or-later
 
-use std::{ffi::CStr, mem::size_of};
+use std::{
+    ffi::{c_int, c_void, CStr},
+    mem::size_of,
+    ptr::NonNull,
+};
 
 use qemu_api::{
+    bindings::{qdev_prop_bool, qdev_prop_chr},
     chardev::{CharBackend, Chardev, Event},
     impl_vmstate_forward,
     irq::{IRQState, InterruptSource},
@@ -18,12 +23,11 @@ use qemu_api::{
     sysbus::{SysBusDevice, SysBusDeviceImpl},
     uninit_field_mut,
     vmstate::VMStateDescription,
+    vmstate_clock, vmstate_fields, vmstate_of, vmstate_struct, vmstate_subsections, vmstate_unused,
+    zeroable::Zeroable,
 };
 
-use crate::{
-    device_class,
-    registers::{self, Interrupt, RegisterOffset},
-};
+use crate::registers::{self, Interrupt, RegisterOffset};
 
 // TODO: You must disable the UART before any of the control registers are
 // reprogrammed. When the UART is disabled in the middle of transmission or
@@ -173,10 +177,10 @@ impl ObjectImpl for PL011State {
 
 impl DeviceImpl for PL011State {
     fn properties() -> &'static [Property] {
-        &device_class::PL011_PROPERTIES
+        &PL011_PROPERTIES
     }
     fn vmsd() -> Option<&'static VMStateDescription> {
-        Some(&device_class::VMSTATE_PL011)
+        Some(&VMSTATE_PL011)
     }
     const REALIZE: Option<fn(&Self) -> qemu_api::Result<()>> = Some(Self::realize);
 }
@@ -712,3 +716,88 @@ impl PL011Impl for PL011Luminary {
 impl DeviceImpl for PL011Luminary {}
 impl ResettablePhasesImpl for PL011Luminary {}
 impl SysBusDeviceImpl for PL011Luminary {}
+
+extern "C" fn pl011_clock_needed(opaque: *mut c_void) -> bool {
+    let state = NonNull::new(opaque).unwrap().cast::<PL011State>();
+    unsafe { state.as_ref().migrate_clock }
+}
+
+/// Migration subsection for [`PL011State`] clock.
+static VMSTATE_PL011_CLOCK: VMStateDescription = VMStateDescription {
+    name: c"pl011/clock".as_ptr(),
+    version_id: 1,
+    minimum_version_id: 1,
+    needed: Some(pl011_clock_needed),
+    fields: vmstate_fields! {
+        vmstate_clock!(PL011State, clock),
+    },
+    ..Zeroable::ZERO
+};
+
+extern "C" fn pl011_post_load(opaque: *mut c_void, version_id: c_int) -> c_int {
+    let state = NonNull::new(opaque).unwrap().cast::<PL011State>();
+    let result = unsafe { state.as_ref().post_load(version_id as u32) };
+    if result.is_err() {
+        -1
+    } else {
+        0
+    }
+}
+
+static VMSTATE_PL011_REGS: VMStateDescription = VMStateDescription {
+    name: c"pl011/regs".as_ptr(),
+    version_id: 2,
+    minimum_version_id: 2,
+    fields: vmstate_fields! {
+        vmstate_of!(PL011Registers, flags),
+        vmstate_of!(PL011Registers, line_control),
+        vmstate_of!(PL011Registers, receive_status_error_clear),
+        vmstate_of!(PL011Registers, control),
+        vmstate_of!(PL011Registers, dmacr),
+        vmstate_of!(PL011Registers, int_enabled),
+        vmstate_of!(PL011Registers, int_level),
+        vmstate_of!(PL011Registers, read_fifo),
+        vmstate_of!(PL011Registers, ilpr),
+        vmstate_of!(PL011Registers, ibrd),
+        vmstate_of!(PL011Registers, fbrd),
+        vmstate_of!(PL011Registers, ifl),
+        vmstate_of!(PL011Registers, read_pos),
+        vmstate_of!(PL011Registers, read_count),
+        vmstate_of!(PL011Registers, read_trigger),
+    },
+    ..Zeroable::ZERO
+};
+
+pub static VMSTATE_PL011: VMStateDescription = VMStateDescription {
+    name: c"pl011".as_ptr(),
+    version_id: 2,
+    minimum_version_id: 2,
+    post_load: Some(pl011_post_load),
+    fields: vmstate_fields! {
+        vmstate_unused!(core::mem::size_of::<u32>()),
+        vmstate_struct!(PL011State, regs, &VMSTATE_PL011_REGS, BqlRefCell<PL011Registers>),
+    },
+    subsections: vmstate_subsections! {
+        VMSTATE_PL011_CLOCK
+    },
+    ..Zeroable::ZERO
+};
+
+qemu_api::declare_properties! {
+    PL011_PROPERTIES,
+    qemu_api::define_property!(
+        c"chardev",
+        PL011State,
+        char_backend,
+        unsafe { &qdev_prop_chr },
+        CharBackend
+    ),
+    qemu_api::define_property!(
+        c"migrate-clk",
+        PL011State,
+        migrate_clock,
+        unsafe { &qdev_prop_bool },
+        bool,
+        default = true
+    ),
+}
diff --git a/rust/hw/char/pl011/src/device_class.rs b/rust/hw/char/pl011/src/device_class.rs
deleted file mode 100644
index d328d84632..0000000000
--- a/rust/hw/char/pl011/src/device_class.rs
+++ /dev/null
@@ -1,103 +0,0 @@
-// Copyright 2024, Linaro Limited
-// Author(s): Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
-// SPDX-License-Identifier: GPL-2.0-or-later
-
-use std::{
-    ffi::{c_int, c_void},
-    ptr::NonNull,
-};
-
-use qemu_api::{
-    bindings::{qdev_prop_bool, qdev_prop_chr},
-    prelude::*,
-    vmstate::VMStateDescription,
-    vmstate_clock, vmstate_fields, vmstate_of, vmstate_struct, vmstate_subsections, vmstate_unused,
-    zeroable::Zeroable,
-};
-
-use crate::device::{PL011Registers, PL011State};
-
-extern "C" fn pl011_clock_needed(opaque: *mut c_void) -> bool {
-    let state = NonNull::new(opaque).unwrap().cast::<PL011State>();
-    unsafe { state.as_ref().migrate_clock }
-}
-
-/// Migration subsection for [`PL011State`] clock.
-static VMSTATE_PL011_CLOCK: VMStateDescription = VMStateDescription {
-    name: c"pl011/clock".as_ptr(),
-    version_id: 1,
-    minimum_version_id: 1,
-    needed: Some(pl011_clock_needed),
-    fields: vmstate_fields! {
-        vmstate_clock!(PL011State, clock),
-    },
-    ..Zeroable::ZERO
-};
-
-extern "C" fn pl011_post_load(opaque: *mut c_void, version_id: c_int) -> c_int {
-    let state = NonNull::new(opaque).unwrap().cast::<PL011State>();
-    let result = unsafe { state.as_ref().post_load(version_id as u32) };
-    if result.is_err() {
-        -1
-    } else {
-        0
-    }
-}
-
-static VMSTATE_PL011_REGS: VMStateDescription = VMStateDescription {
-    name: c"pl011/regs".as_ptr(),
-    version_id: 2,
-    minimum_version_id: 2,
-    fields: vmstate_fields! {
-        vmstate_of!(PL011Registers, flags),
-        vmstate_of!(PL011Registers, line_control),
-        vmstate_of!(PL011Registers, receive_status_error_clear),
-        vmstate_of!(PL011Registers, control),
-        vmstate_of!(PL011Registers, dmacr),
-        vmstate_of!(PL011Registers, int_enabled),
-        vmstate_of!(PL011Registers, int_level),
-        vmstate_of!(PL011Registers, read_fifo),
-        vmstate_of!(PL011Registers, ilpr),
-        vmstate_of!(PL011Registers, ibrd),
-        vmstate_of!(PL011Registers, fbrd),
-        vmstate_of!(PL011Registers, ifl),
-        vmstate_of!(PL011Registers, read_pos),
-        vmstate_of!(PL011Registers, read_count),
-        vmstate_of!(PL011Registers, read_trigger),
-    },
-    ..Zeroable::ZERO
-};
-
-pub static VMSTATE_PL011: VMStateDescription = VMStateDescription {
-    name: c"pl011".as_ptr(),
-    version_id: 2,
-    minimum_version_id: 2,
-    post_load: Some(pl011_post_load),
-    fields: vmstate_fields! {
-        vmstate_unused!(core::mem::size_of::<u32>()),
-        vmstate_struct!(PL011State, regs, &VMSTATE_PL011_REGS, BqlRefCell<PL011Registers>),
-    },
-    subsections: vmstate_subsections! {
-        VMSTATE_PL011_CLOCK
-    },
-    ..Zeroable::ZERO
-};
-
-qemu_api::declare_properties! {
-    PL011_PROPERTIES,
-    qemu_api::define_property!(
-        c"chardev",
-        PL011State,
-        char_backend,
-        unsafe { &qdev_prop_chr },
-        CharBackend
-    ),
-    qemu_api::define_property!(
-        c"migrate-clk",
-        PL011State,
-        migrate_clock,
-        unsafe { &qdev_prop_bool },
-        bool,
-        default = true
-    ),
-}
diff --git a/rust/hw/char/pl011/src/lib.rs b/rust/hw/char/pl011/src/lib.rs
index 5c4fbc9d14..2b70d2ff56 100644
--- a/rust/hw/char/pl011/src/lib.rs
+++ b/rust/hw/char/pl011/src/lib.rs
@@ -13,7 +13,6 @@
 //! the [`registers`] module for register types.
 
 mod device;
-mod device_class;
 mod registers;
 
 pub use device::pl011_create;

From 2b1791323e7ce043cbc3857699e5d5b0ad021cbc Mon Sep 17 00:00:00 2001
From: Tanish Desai <tanishdesai37@gmail.com>
Date: Tue, 22 Jul 2025 11:43:52 +0000
Subject: [PATCH 2600/2760] tracetool: removed the unused vcpu property
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The vcpu property is no longer used in these backends. Removing it avoids
unnecessary checks and simplifies the code generation for these trace
backends.

Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Tanish Desai <tanishdesai37@gmail.com>
Message-id: 20250722114352.3624-1-tanishdesai37@gmail.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 scripts/tracetool/__init__.py       | 2 +-
 scripts/tracetool/backend/log.py    | 6 +-----
 scripts/tracetool/backend/simple.py | 6 +-----
 scripts/tracetool/backend/syslog.py | 6 +-----
 4 files changed, 4 insertions(+), 16 deletions(-)

diff --git a/scripts/tracetool/__init__.py b/scripts/tracetool/__init__.py
index 6dfcbf71e1..2ae2e562d6 100644
--- a/scripts/tracetool/__init__.py
+++ b/scripts/tracetool/__init__.py
@@ -219,7 +219,7 @@ class Event(object):
                       r"(?:(?:(?P<fmt_trans>\".+),)?\s*(?P<fmt>\".+))?"
                       r"\s*")
 
-    _VALID_PROPS = set(["disable", "vcpu"])
+    _VALID_PROPS = set(["disable"])
 
     def __init__(self, name, props, fmt, args, lineno, filename, orig=None,
                  event_trans=None, event_exec=None):
diff --git a/scripts/tracetool/backend/log.py b/scripts/tracetool/backend/log.py
index 17ba1cd90e..5c9d09dd11 100644
--- a/scripts/tracetool/backend/log.py
+++ b/scripts/tracetool/backend/log.py
@@ -29,11 +29,7 @@ def generate_h(event, group):
     if len(event.args) > 0:
         argnames = ", " + argnames
 
-    if "vcpu" in event.properties:
-        # already checked on the generic format code
-        cond = "true"
-    else:
-        cond = "trace_event_get_state(%s)" % ("TRACE_" + event.name.upper())
+    cond = "trace_event_get_state(%s)" % ("TRACE_" + event.name.upper())
 
     out('    if (%(cond)s && qemu_loglevel_mask(LOG_TRACE)) {',
         '        if (message_with_timestamp) {',
diff --git a/scripts/tracetool/backend/simple.py b/scripts/tracetool/backend/simple.py
index 2688d4b64b..7c84c06b20 100644
--- a/scripts/tracetool/backend/simple.py
+++ b/scripts/tracetool/backend/simple.py
@@ -37,11 +37,7 @@ def generate_h_begin(events, group):
 
 def generate_h(event, group):
     event_id = 'TRACE_' + event.name.upper()
-    if "vcpu" in event.properties:
-        # already checked on the generic format code
-        cond = "true"
-    else:
-        cond = "trace_event_get_state(%s)" % event_id
+    cond = "trace_event_get_state(%s)" % event_id
     out('    if (%(cond)s) {',
         '        _simple_%(api)s(%(args)s);',
         '    }',
diff --git a/scripts/tracetool/backend/syslog.py b/scripts/tracetool/backend/syslog.py
index 5a3a00fe31..3f82e54aab 100644
--- a/scripts/tracetool/backend/syslog.py
+++ b/scripts/tracetool/backend/syslog.py
@@ -28,11 +28,7 @@ def generate_h(event, group):
     if len(event.args) > 0:
         argnames = ", " + argnames
 
-    if "vcpu" in event.properties:
-        # already checked on the generic format code
-        cond = "true"
-    else:
-        cond = "trace_event_get_state(%s)" % ("TRACE_" + event.name.upper())
+    cond = "trace_event_get_state(%s)" % ("TRACE_" + event.name.upper())
 
     out('    if (%(cond)s) {',
         '#line %(event_lineno)d "%(event_filename)s"',

From 9e601684dc24a521bb1d23215a63e5c6e79ea0bb Mon Sep 17 00:00:00 2001
From: Stefan Hajnoczi <stefanha@redhat.com>
Date: Tue, 22 Jul 2025 15:48:48 -0400
Subject: [PATCH 2601/2760] Update version for the v10.1.0-rc0 release

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 VERSION | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/VERSION b/VERSION
index 54e6ccf854..c52f1cc9fe 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-10.0.50
+10.0.90

From 2251f9ac9261cda05b6b19e9ba329b15d9d89bae Mon Sep 17 00:00:00 2001
From: Fabiano Rosas <farosas@suse.de>
Date: Wed, 16 Jul 2025 15:26:46 -0300
Subject: [PATCH 2602/2760] migration: HMP: Fix possible out-of-bounds access
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Coverity has caught a bug in the formatting of time intervals for
postcopy latency distribution display in 'info migrate'.

While bounds checking the labels array, sizeof is incorrectly being
used. ARRAY_SIZE is the correct form of obtaining the size of an
array.

Fixes: 3345fb3b6d ("migration/postcopy: Add latency distribution report for blocktime")
Resolves: Coverity CID 1612248
Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/qemu-devel/20250716182648.30202-2-farosas@suse.de
Signed-off-by: Fabiano Rosas <farosas@suse.de>
---
 migration/migration-hmp-cmds.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/migration/migration-hmp-cmds.c b/migration/migration-hmp-cmds.c
index cef5608210..bb954881d7 100644
--- a/migration/migration-hmp-cmds.c
+++ b/migration/migration-hmp-cmds.c
@@ -57,11 +57,9 @@ static const gchar *format_time_str(uint64_t us)
     const char *units[] = {"us", "ms", "sec"};
     int index = 0;
 
-    while (us > 1000) {
+    while (us > 1000 && index + 1 < ARRAY_SIZE(units)) {
         us /= 1000;
-        if (++index >= (sizeof(units) - 1)) {
-            break;
-        }
+        index++;
     }
 
     return g_strdup_printf("%"PRIu64" %s", us, units[index]);

From fd1514cbd97bcad5b3dc5d002cab6fee4d7cd45e Mon Sep 17 00:00:00 2001
From: Fabiano Rosas <farosas@suse.de>
Date: Wed, 16 Jul 2025 15:26:47 -0300
Subject: [PATCH 2603/2760] migration: HMP: Fix postcopy latency distribution
 label
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fix the loop condition to avoid having a label with "1000 us" instead
of "1 ms".

Reported-by: Prasad Pandit <ppandit@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/qemu-devel/20250716182648.30202-3-farosas@suse.de
Signed-off-by: Fabiano Rosas <farosas@suse.de>
---
 migration/migration-hmp-cmds.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/migration/migration-hmp-cmds.c b/migration/migration-hmp-cmds.c
index bb954881d7..a8b879c9d6 100644
--- a/migration/migration-hmp-cmds.c
+++ b/migration/migration-hmp-cmds.c
@@ -57,7 +57,7 @@ static const gchar *format_time_str(uint64_t us)
     const char *units[] = {"us", "ms", "sec"};
     int index = 0;
 
-    while (us > 1000 && index + 1 < ARRAY_SIZE(units)) {
+    while (us >= 1000 && index + 1 < ARRAY_SIZE(units)) {
         us /= 1000;
         index++;
     }

From eaec556bc88cc1196f7bbf23d5de311aac1d812f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Mon, 21 Jul 2025 14:39:13 +0100
Subject: [PATCH 2604/2760] migration: show error message when postcopy fails
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The 'info migrate' command only shows the error message when the
migration state is 'failed'. When postcopy is used, however,
the 'postcopy-paused' state is used instead of 'failed', so we
must show the error message there too.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/qemu-devel/20250721133913.2914669-1-berrange@redhat.com
[line break to satisfy checkpatch]
Signed-off-by: Fabiano Rosas <farosas@suse.de>
---
 migration/migration-hmp-cmds.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/migration/migration-hmp-cmds.c b/migration/migration-hmp-cmds.c
index a8b879c9d6..0fc21f0647 100644
--- a/migration/migration-hmp-cmds.c
+++ b/migration/migration-hmp-cmds.c
@@ -151,7 +151,9 @@ void hmp_info_migrate(Monitor *mon, const QDict *qdict)
     if (info->has_status) {
         monitor_printf(mon, "Status: \t\t%s",
                        MigrationStatus_str(info->status));
-        if (info->status == MIGRATION_STATUS_FAILED && info->error_desc) {
+        if ((info->status == MIGRATION_STATUS_FAILED ||
+             info->status == MIGRATION_STATUS_POSTCOPY_PAUSED) &&
+            info->error_desc) {
             monitor_printf(mon, " (%s)\n", info->error_desc);
         } else {
             monitor_printf(mon, "\n");

From 24ad5e19952b326796c8a3a1595c57ff180dab84 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Fri, 18 Jul 2025 16:05:11 +0100
Subject: [PATCH 2605/2760] crypto: implement workaround for GNUTLS thread
 safety problems
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When TLS 1.3 is negotiated on a TLS session, GNUTLS will perform
automatic rekeying of the session after 16 million records. This
is done for all algorithms except CHACHA20_POLY1305 which does
not require rekeying.

Unfortunately the rekeying breaks GNUTLS' promise that it is safe
to use a gnutls_session_t object concurrently from multiple threads
if they are exclusively calling gnutls_record_send/recv.

This patch implements a workaround for QEMU that adds a mutex lock
around any gnutls_record_send/recv call to serialize execution
within GNUTLS code. When GNUTLS calls into the push/pull functions
we can release the lock so the OS level I/O calls can at least
have some parallelism.

The big downside of this is that the actual encryption/decryption
code is fully serialized, which will halve performance of that
cipher operations if two threads are contending.

The workaround is not enabled by default, since most use of GNUTLS
in QEMU does not tickle the problem, only non-multifd migration
with a return path open is affected. Fortunately the migration
code also won't trigger the halving of performance, since only
the outbound channel diretion needs to sustain high data rates,
the inbound direction is low volume.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/qemu-devel/20250718150514.2635338-2-berrange@redhat.com
[add stub for qcrypto_tls_session_require_thread_safety; fix unused var]
Signed-off-by: Fabiano Rosas <farosas@suse.de>
---
 crypto/tlssession.c           | 92 +++++++++++++++++++++++++++++++++--
 include/crypto/tlssession.h   | 14 ++++++
 meson.build                   |  9 ++++
 meson_options.txt             |  2 +
 scripts/meson-buildoptions.sh |  5 ++
 5 files changed, 119 insertions(+), 3 deletions(-)

diff --git a/crypto/tlssession.c b/crypto/tlssession.c
index 6d8f8df623..baef878fa0 100644
--- a/crypto/tlssession.c
+++ b/crypto/tlssession.c
@@ -19,6 +19,7 @@
  */
 
 #include "qemu/osdep.h"
+#include "qemu/thread.h"
 #include "crypto/tlssession.h"
 #include "crypto/tlscredsanon.h"
 #include "crypto/tlscredspsk.h"
@@ -51,6 +52,14 @@ struct QCryptoTLSSession {
      */
     Error *rerr;
     Error *werr;
+
+    /*
+     * Used to protect against broken GNUTLS thread safety
+     * https://gitlab.com/gnutls/gnutls/-/issues/1717
+     */
+    bool requireThreadSafety;
+    bool lockEnabled;
+    QemuMutex lock;
 };
 
 
@@ -69,6 +78,7 @@ qcrypto_tls_session_free(QCryptoTLSSession *session)
     g_free(session->peername);
     g_free(session->authzid);
     object_unref(OBJECT(session->creds));
+    qemu_mutex_destroy(&session->lock);
     g_free(session);
 }
 
@@ -84,10 +94,19 @@ qcrypto_tls_session_push(void *opaque, const void *buf, size_t len)
         return -1;
     };
 
+    if (session->lockEnabled) {
+        qemu_mutex_unlock(&session->lock);
+    }
+
     error_free(session->werr);
     session->werr = NULL;
 
     ret = session->writeFunc(buf, len, session->opaque, &session->werr);
+
+    if (session->lockEnabled) {
+        qemu_mutex_lock(&session->lock);
+    }
+
     if (ret == QCRYPTO_TLS_SESSION_ERR_BLOCK) {
         errno = EAGAIN;
         return -1;
@@ -114,7 +133,16 @@ qcrypto_tls_session_pull(void *opaque, void *buf, size_t len)
     error_free(session->rerr);
     session->rerr = NULL;
 
+    if (session->lockEnabled) {
+        qemu_mutex_unlock(&session->lock);
+    }
+
     ret = session->readFunc(buf, len, session->opaque, &session->rerr);
+
+    if (session->lockEnabled) {
+        qemu_mutex_lock(&session->lock);
+    }
+
     if (ret == QCRYPTO_TLS_SESSION_ERR_BLOCK) {
         errno = EAGAIN;
         return -1;
@@ -153,6 +181,8 @@ qcrypto_tls_session_new(QCryptoTLSCreds *creds,
     session->creds = creds;
     object_ref(OBJECT(creds));
 
+    qemu_mutex_init(&session->lock);
+
     if (creds->endpoint != endpoint) {
         error_setg(errp, "Credentials endpoint doesn't match session");
         goto error;
@@ -289,6 +319,11 @@ qcrypto_tls_session_new(QCryptoTLSCreds *creds,
     return NULL;
 }
 
+void qcrypto_tls_session_require_thread_safety(QCryptoTLSSession *sess)
+{
+    sess->requireThreadSafety = true;
+}
+
 static int
 qcrypto_tls_session_check_certificate(QCryptoTLSSession *session,
                                       Error **errp)
@@ -480,7 +515,17 @@ qcrypto_tls_session_write(QCryptoTLSSession *session,
                           size_t len,
                           Error **errp)
 {
-    ssize_t ret = gnutls_record_send(session->handle, buf, len);
+    ssize_t ret;
+
+    if (session->lockEnabled) {
+        qemu_mutex_lock(&session->lock);
+    }
+
+    ret = gnutls_record_send(session->handle, buf, len);
+
+    if (session->lockEnabled) {
+        qemu_mutex_unlock(&session->lock);
+    }
 
     if (ret < 0) {
         if (ret == GNUTLS_E_AGAIN) {
@@ -509,7 +554,17 @@ qcrypto_tls_session_read(QCryptoTLSSession *session,
                          bool gracefulTermination,
                          Error **errp)
 {
-    ssize_t ret = gnutls_record_recv(session->handle, buf, len);
+    ssize_t ret;
+
+    if (session->lockEnabled) {
+        qemu_mutex_lock(&session->lock);
+    }
+
+    ret = gnutls_record_recv(session->handle, buf, len);
+
+    if (session->lockEnabled) {
+        qemu_mutex_unlock(&session->lock);
+    }
 
     if (ret < 0) {
         if (ret == GNUTLS_E_AGAIN) {
@@ -545,8 +600,29 @@ int
 qcrypto_tls_session_handshake(QCryptoTLSSession *session,
                               Error **errp)
 {
-    int ret = gnutls_handshake(session->handle);
+    int ret;
+    ret = gnutls_handshake(session->handle);
+
     if (!ret) {
+#ifdef CONFIG_GNUTLS_BUG1717_WORKAROUND
+        gnutls_cipher_algorithm_t cipher =
+            gnutls_cipher_get(session->handle);
+
+        /*
+         * Any use of rekeying in TLS 1.3 is unsafe for
+         * a gnutls with bug 1717, however, we know that
+         * QEMU won't initiate manual rekeying. Thus we
+         * only have to protect against automatic rekeying
+         * which doesn't trigger with CHACHA20
+         */
+        if (session->requireThreadSafety &&
+            gnutls_protocol_get_version(session->handle) ==
+            GNUTLS_TLS1_3 &&
+            cipher != GNUTLS_CIPHER_CHACHA20_POLY1305) {
+            session->lockEnabled = true;
+        }
+#endif
+
         session->handshakeComplete = true;
         return QCRYPTO_TLS_HANDSHAKE_COMPLETE;
     }
@@ -584,8 +660,15 @@ qcrypto_tls_session_bye(QCryptoTLSSession *session, Error **errp)
         return 0;
     }
 
+    if (session->lockEnabled) {
+        qemu_mutex_lock(&session->lock);
+    }
     ret = gnutls_bye(session->handle, GNUTLS_SHUT_WR);
 
+    if (session->lockEnabled) {
+        qemu_mutex_unlock(&session->lock);
+    }
+
     if (!ret) {
         return QCRYPTO_TLS_BYE_COMPLETE;
     }
@@ -651,6 +734,9 @@ qcrypto_tls_session_new(QCryptoTLSCreds *creds G_GNUC_UNUSED,
     return NULL;
 }
 
+void qcrypto_tls_session_require_thread_safety(QCryptoTLSSession *sess)
+{
+}
 
 void
 qcrypto_tls_session_free(QCryptoTLSSession *sess G_GNUC_UNUSED)
diff --git a/include/crypto/tlssession.h b/include/crypto/tlssession.h
index d77ae0d423..2f62ce2d67 100644
--- a/include/crypto/tlssession.h
+++ b/include/crypto/tlssession.h
@@ -165,6 +165,20 @@ void qcrypto_tls_session_free(QCryptoTLSSession *sess);
 
 G_DEFINE_AUTOPTR_CLEANUP_FUNC(QCryptoTLSSession, qcrypto_tls_session_free)
 
+/**
+ * qcrypto_tls_session_require_thread_safety:
+ * @sess: the TLS session object
+ *
+ * Mark that this TLS session will require thread safety
+ * for concurrent I/O in both directions. This must be
+ * called before the handshake is performed.
+ *
+ * This will activate a workaround for GNUTLS thread
+ * safety issues, where appropriate for the negotiated
+ * TLS session parameters.
+ */
+void qcrypto_tls_session_require_thread_safety(QCryptoTLSSession *sess);
+
 /**
  * qcrypto_tls_session_check_credentials:
  * @sess: the TLS session object
diff --git a/meson.build b/meson.build
index c2bc3eeedc..e53cd5b413 100644
--- a/meson.build
+++ b/meson.build
@@ -1809,6 +1809,7 @@ endif
 
 gnutls = not_found
 gnutls_crypto = not_found
+gnutls_bug1717_workaround = false
 if get_option('gnutls').enabled() or (get_option('gnutls').auto() and have_system)
   # For general TLS support our min gnutls matches
   # that implied by our platform support matrix
@@ -1834,6 +1835,12 @@ if get_option('gnutls').enabled() or (get_option('gnutls').auto() and have_syste
                         method: 'pkg-config',
                         required: get_option('gnutls'))
   endif
+
+  if gnutls.found() and not get_option('gnutls-bug1717-workaround').disabled()
+    # XXX: when bug 1717 is resolved, add logic to probe for
+    # the GNUTLS fixed version number to handle the 'auto' case
+    gnutls_bug1717_workaround = true
+  endif
 endif
 
 # We prefer use of gnutls for crypto, unless the options
@@ -2585,6 +2592,7 @@ config_host_data.set('CONFIG_KEYUTILS', keyutils.found())
 config_host_data.set('CONFIG_GETTID', has_gettid)
 config_host_data.set('CONFIG_GNUTLS', gnutls.found())
 config_host_data.set('CONFIG_GNUTLS_CRYPTO', gnutls_crypto.found())
+config_host_data.set('CONFIG_GNUTLS_BUG1717_WORKAROUND', gnutls_bug1717_workaround)
 config_host_data.set('CONFIG_TASN1', tasn1.found())
 config_host_data.set('CONFIG_GCRYPT', gcrypt.found())
 config_host_data.set('CONFIG_NETTLE', nettle.found())
@@ -4869,6 +4877,7 @@ summary_info += {'TLS priority':      get_option('tls_priority')}
 summary_info += {'GNUTLS support':    gnutls}
 if gnutls.found()
   summary_info += {'  GNUTLS crypto':   gnutls_crypto.found()}
+  summary_info += {'  GNUTLS bug 1717 workaround': gnutls_bug1717_workaround }
 endif
 summary_info += {'libgcrypt':         gcrypt}
 summary_info += {'nettle':            nettle}
diff --git a/meson_options.txt b/meson_options.txt
index fff1521e58..dd33530750 100644
--- a/meson_options.txt
+++ b/meson_options.txt
@@ -174,6 +174,8 @@ option('libcbor', type : 'feature', value : 'auto',
        description: 'libcbor support')
 option('gnutls', type : 'feature', value : 'auto',
        description: 'GNUTLS cryptography support')
+option('gnutls-bug1717-workaround', type: 'feature', value : 'auto',
+       description: 'GNUTLS workaround for https://gitlab.com/gnutls/gnutls/-/issues/1717')
 option('nettle', type : 'feature', value : 'auto',
        description: 'nettle cryptography support')
 option('gcrypt', type : 'feature', value : 'auto',
diff --git a/scripts/meson-buildoptions.sh b/scripts/meson-buildoptions.sh
index 0ebe6bc52a..d559e260ed 100644
--- a/scripts/meson-buildoptions.sh
+++ b/scripts/meson-buildoptions.sh
@@ -123,6 +123,9 @@ meson_options_help() {
   printf "%s\n" '  gio             use libgio for D-Bus support'
   printf "%s\n" '  glusterfs       Glusterfs block device driver'
   printf "%s\n" '  gnutls          GNUTLS cryptography support'
+  printf "%s\n" '  gnutls-bug1717-workaround'
+  printf "%s\n" '                  GNUTLS workaround for'
+  printf "%s\n" '                  https://gitlab.com/gnutls/gnutls/-/issues/1717'
   printf "%s\n" '  gtk             GTK+ user interface'
   printf "%s\n" '  gtk-clipboard   clipboard support for the gtk UI (EXPERIMENTAL, MAY HANG)'
   printf "%s\n" '  guest-agent     Build QEMU Guest Agent'
@@ -331,6 +334,8 @@ _meson_option_parse() {
     --disable-glusterfs) printf "%s" -Dglusterfs=disabled ;;
     --enable-gnutls) printf "%s" -Dgnutls=enabled ;;
     --disable-gnutls) printf "%s" -Dgnutls=disabled ;;
+    --enable-gnutls-bug1717-workaround) printf "%s" -Dgnutls-bug1717-workaround=enabled ;;
+    --disable-gnutls-bug1717-workaround) printf "%s" -Dgnutls-bug1717-workaround=disabled ;;
     --enable-gtk) printf "%s" -Dgtk=enabled ;;
     --disable-gtk) printf "%s" -Dgtk=disabled ;;
     --enable-gtk-clipboard) printf "%s" -Dgtk_clipboard=enabled ;;

From edea818371bd7179b55f38d3b113d342251d8f9b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Fri, 18 Jul 2025 16:05:12 +0100
Subject: [PATCH 2606/2760] io: add support for activating TLS thread safety
 workaround
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add a QIO_CHANNEL_FEATURE_CONCURRENT_IO feature flag.

If this is set on a QIOChannelTLS session object, the TLS
session will be marked as requiring thread safety, which
will activate the workaround for GNUTLS bug 1717 if needed.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/qemu-devel/20250718150514.2635338-3-berrange@redhat.com
Signed-off-by: Fabiano Rosas <farosas@suse.de>
---
 include/io/channel.h | 1 +
 io/channel-tls.c     | 5 +++++
 2 files changed, 6 insertions(+)

diff --git a/include/io/channel.h b/include/io/channel.h
index 62b657109c..234e5db70d 100644
--- a/include/io/channel.h
+++ b/include/io/channel.h
@@ -46,6 +46,7 @@ enum QIOChannelFeature {
     QIO_CHANNEL_FEATURE_WRITE_ZERO_COPY,
     QIO_CHANNEL_FEATURE_READ_MSG_PEEK,
     QIO_CHANNEL_FEATURE_SEEKABLE,
+    QIO_CHANNEL_FEATURE_CONCURRENT_IO,
 };
 
 
diff --git a/io/channel-tls.c b/io/channel-tls.c
index db2ac1deae..a8248a9216 100644
--- a/io/channel-tls.c
+++ b/io/channel-tls.c
@@ -241,6 +241,11 @@ void qio_channel_tls_handshake(QIOChannelTLS *ioc,
 {
     QIOTask *task;
 
+    if (qio_channel_has_feature(QIO_CHANNEL(ioc),
+                                QIO_CHANNEL_FEATURE_CONCURRENT_IO)) {
+        qcrypto_tls_session_require_thread_safety(ioc->session);
+    }
+
     task = qio_task_new(OBJECT(ioc),
                         func, opaque, destroy);
 

From eb3618e9e259ef93f5a1a76867fbccae540fcd61 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Fri, 18 Jul 2025 16:05:13 +0100
Subject: [PATCH 2607/2760] migration: activate TLS thread safety workaround
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When either the postcopy or return path capabilities are
enabled, the migration code will use the primary channel
for bidirectional I/O.

If either of those capabilities are enabled, the migration
code needs to mark the channel as expecting concurrent I/O
in order to activate the thread safety workarounds for
GNUTLS bug 1717

Closes: https://gitlab.com/qemu-project/qemu/-/issues/1937
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/qemu-devel/20250718150514.2635338-4-berrange@redhat.com
Signed-off-by: Fabiano Rosas <farosas@suse.de>
---
 migration/tls.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/migration/tls.c b/migration/tls.c
index 5cbf952383..284a6194b2 100644
--- a/migration/tls.c
+++ b/migration/tls.c
@@ -90,6 +90,10 @@ void migration_tls_channel_process_incoming(MigrationState *s,
 
     trace_migration_tls_incoming_handshake_start();
     qio_channel_set_name(QIO_CHANNEL(tioc), "migration-tls-incoming");
+    if (migrate_postcopy_ram() || migrate_return_path()) {
+        qio_channel_set_feature(QIO_CHANNEL(tioc),
+                                QIO_CHANNEL_FEATURE_CONCURRENT_IO);
+    }
     qio_channel_tls_handshake(tioc,
                               migration_tls_incoming_handshake,
                               NULL,
@@ -149,6 +153,11 @@ void migration_tls_channel_connect(MigrationState *s,
     s->hostname = g_strdup(hostname);
     trace_migration_tls_outgoing_handshake_start(hostname);
     qio_channel_set_name(QIO_CHANNEL(tioc), "migration-tls-outgoing");
+
+    if (migrate_postcopy_ram() || migrate_return_path()) {
+        qio_channel_set_feature(QIO_CHANNEL(tioc),
+                                QIO_CHANNEL_FEATURE_CONCURRENT_IO);
+    }
     qio_channel_tls_handshake(tioc,
                               migration_tls_outgoing_handshake,
                               s,

From 0db6f798024ea6f57ecf2020209b761b50a01d71 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Fri, 18 Jul 2025 16:05:14 +0100
Subject: [PATCH 2608/2760] crypto: add tracing & warning about GNUTLS
 countermeasures
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We want some visibility on stderr when the GNUTLS thread
safety countermeasures are activated, to encourage people
to get the real fix deployed (once it exists). Some trace
points will also help if we see any further wierd crash
scenario we've not anticipated.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/qemu-devel/20250718150514.2635338-5-berrange@redhat.com
[add missing include]
Signed-off-by: Fabiano Rosas <farosas@suse.de>
---
 crypto/tlssession.c | 11 +++++++++++
 crypto/trace-events |  2 ++
 2 files changed, 13 insertions(+)

diff --git a/crypto/tlssession.c b/crypto/tlssession.c
index baef878fa0..86d407a142 100644
--- a/crypto/tlssession.c
+++ b/crypto/tlssession.c
@@ -19,6 +19,7 @@
  */
 
 #include "qemu/osdep.h"
+#include "qemu/error-report.h"
 #include "qemu/thread.h"
 #include "crypto/tlssession.h"
 #include "crypto/tlscredsanon.h"
@@ -615,10 +616,20 @@ qcrypto_tls_session_handshake(QCryptoTLSSession *session,
          * only have to protect against automatic rekeying
          * which doesn't trigger with CHACHA20
          */
+        trace_qcrypto_tls_session_parameters(
+            session,
+            session->requireThreadSafety,
+            gnutls_protocol_get_version(session->handle),
+            cipher);
+
         if (session->requireThreadSafety &&
             gnutls_protocol_get_version(session->handle) ==
             GNUTLS_TLS1_3 &&
             cipher != GNUTLS_CIPHER_CHACHA20_POLY1305) {
+            warn_report("WARNING: activating thread safety countermeasures "
+                        "for potentially broken GNUTLS with TLS1.3 cipher=%d",
+                        cipher);
+            trace_qcrypto_tls_session_bug1717_workaround(session);
             session->lockEnabled = true;
         }
 #endif
diff --git a/crypto/trace-events b/crypto/trace-events
index bccd0bbf29..d0e33427fa 100644
--- a/crypto/trace-events
+++ b/crypto/trace-events
@@ -21,6 +21,8 @@ qcrypto_tls_creds_x509_load_cert_list(void *creds, const char *file) "TLS creds
 # tlssession.c
 qcrypto_tls_session_new(void *session, void *creds, const char *hostname, const char *authzid, int endpoint) "TLS session new session=%p creds=%p hostname=%s authzid=%s endpoint=%d"
 qcrypto_tls_session_check_creds(void *session, const char *status) "TLS session check creds session=%p status=%s"
+qcrypto_tls_session_parameters(void *session, int threadSafety, int protocol, int cipher) "TLS session parameters session=%p threadSafety=%d protocol=%d cipher=%d"
+qcrypto_tls_session_bug1717_workaround(void *session) "TLS session bug1717 workaround session=%p"
 
 # tls-cipher-suites.c
 qcrypto_tls_cipher_suite_priority(const char *name) "priority: %s"

From c4103b27973653a7a9f64244de8fb5243e4397c5 Mon Sep 17 00:00:00 2001
From: Harsh Prateek Bora <harshpb@linux.ibm.com>
Date: Thu, 24 Jul 2025 15:36:15 +0530
Subject: [PATCH 2609/2760] MAINTAINERS: Adding myself as a co-maintainer for
 ppc/spapr
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Have been contributing in ppc/spapr and related areas for quite some
time as a contributor and reviewer. I think its time to step up as a
co-maintainer to help with maintainer activities.

Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250724100623.3071131-2-harshpb@linux.ibm.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 MAINTAINERS | 1 +
 1 file changed, 1 insertion(+)

diff --git a/MAINTAINERS b/MAINTAINERS
index a462345618..afc94e6e67 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1550,6 +1550,7 @@ F: tests/functional/test_ppc_40p.py
 
 sPAPR (pseries)
 M: Nicholas Piggin <npiggin@gmail.com>
+M: Harsh Prateek Bora <harshpb@linux.ibm.com>
 R: Daniel Henrique Barboza <danielhb413@gmail.com>
 R: Harsh Prateek Bora <harshpb@linux.ibm.com>
 L: qemu-ppc@nongnu.org

From 1da3e7f863d65bb850a7662c6b8dfba623ac7cb7 Mon Sep 17 00:00:00 2001
From: Harsh Prateek Bora <harshpb@linux.ibm.com>
Date: Thu, 24 Jul 2025 15:36:16 +0530
Subject: [PATCH 2610/2760] MAINTAINERS: Adding myself as reviewer for PPC KVM
 cpus.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Have been contributing in ppc/spapr from tcg/kvm perspective, stepping
up to help with patch reviews and get notified of incoming changes.

Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250724100623.3071131-3-harshpb@linux.ibm.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 MAINTAINERS | 1 +
 1 file changed, 1 insertion(+)

diff --git a/MAINTAINERS b/MAINTAINERS
index afc94e6e67..6e95ef00c1 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -453,6 +453,7 @@ F: target/mips/system/
 PPC KVM CPUs
 M: Nicholas Piggin <npiggin@gmail.com>
 R: Daniel Henrique Barboza <danielhb413@gmail.com>
+R: Harsh Prateek Bora <harshpb@linux.ibm.com>
 S: Odd Fixes
 F: target/ppc/kvm.c
 

From 884216cf419bb56664e3a8e7c0ce19d180fe2b24 Mon Sep 17 00:00:00 2001
From: Chinmay Rath <rathc@linux.ibm.com>
Date: Thu, 24 Jul 2025 15:36:17 +0530
Subject: [PATCH 2611/2760] MAINTAINERS: Add myself as reviewer for PowerPC TCG
 CPUs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

I have been working on Power ISA for a long time now and have mostly
contributed in TCG instruction translation area (moved 300+ instructions to
decodetree as of yet) and would like to continue contributing to PPC TCG in
best possible ways I can. I think it's time to step up and assist in reviewing
related patches to enable myself contribute more effectively in this direction.

Signed-off-by: Chinmay Rath <rathc@linux.ibm.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20250724100623.3071131-4-harshpb@linux.ibm.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 MAINTAINERS | 1 +
 1 file changed, 1 insertion(+)

diff --git a/MAINTAINERS b/MAINTAINERS
index 6e95ef00c1..31bcb82e93 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -296,6 +296,7 @@ F: tests/tcg/openrisc/
 PowerPC TCG CPUs
 M: Nicholas Piggin <npiggin@gmail.com>
 M: Daniel Henrique Barboza <danielhb413@gmail.com>
+R: Chinmay Rath <rathc@linux.ibm.com>
 L: qemu-ppc@nongnu.org
 S: Odd Fixes
 F: target/ppc/

From 01286ee41ea3fc030a171dc5813945370f18955b Mon Sep 17 00:00:00 2001
From: Aditya Gupta <adityag@linux.ibm.com>
Date: Thu, 24 Jul 2025 15:36:18 +0530
Subject: [PATCH 2612/2760] MAINTAINERS: Add myself as a reviewer of PowerNV
 emulation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Proposing myself as a reviewer in the PowerNV emulation in QEMU

Have been working on PowerNV QEMU for sometime, with contributions in
Power11, MPIPL and minor fixes and things such as dtb support

Cc: Cédric Le Goater <clg@kaod.org>
Cc: Frédéric Barrat <fbarrat@linux.ibm.com>
Cc: Mahesh J Salgaonkar <mahesh@linux.ibm.com>
Cc: Madhavan Srinivasan <maddy@linux.ibm.com>
Cc: Nicholas Piggin <npiggin@gmail.com>
Signed-off-by: Aditya Gupta <adityag@linux.ibm.com>
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250724100623.3071131-5-harshpb@linux.ibm.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 MAINTAINERS | 1 +
 1 file changed, 1 insertion(+)

diff --git a/MAINTAINERS b/MAINTAINERS
index 31bcb82e93..1ba161d75b 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1579,6 +1579,7 @@ F: tests/functional/test_ppc64_tuxrun.py
 PowerNV (Non-Virtualized)
 M: Nicholas Piggin <npiggin@gmail.com>
 R: Frédéric Barrat <fbarrat@linux.ibm.com>
+R: Aditya Gupta <adityag@linux.ibm.com>
 L: qemu-ppc@nongnu.org
 S: Odd Fixes
 F: docs/system/ppc/powernv.rst

From 076b4306f9b6743059592e9632b149ac7708fa40 Mon Sep 17 00:00:00 2001
From: Gautam Menghani <gautam@linux.ibm.com>
Date: Thu, 24 Jul 2025 15:36:19 +0530
Subject: [PATCH 2613/2760] MAINTAINERS: Add myself as a reviewer for XIVE
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Proposing myself as a reviewer for XIVE on PPC.

I have been looking at XIVE in context of KVM internally at IBM for some time
in addition to testing a few XIVE upstream patches; and I'll be closely looking
at XIVE going forward.

Signed-off-by: Gautam Menghani <gautam@linux.ibm.com>
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250724100623.3071131-6-harshpb@linux.ibm.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 MAINTAINERS | 1 +
 1 file changed, 1 insertion(+)

diff --git a/MAINTAINERS b/MAINTAINERS
index 1ba161d75b..f3f981f90d 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2781,6 +2781,7 @@ T: git https://github.com/philmd/qemu.git fw_cfg-next
 
 XIVE
 R: Frédéric Barrat <fbarrat@linux.ibm.com>
+R: Gautam Menghani <gautam@linux.ibm.com>
 L: qemu-ppc@nongnu.org
 S: Odd Fixes
 F: hw/*/*xive*

From cf8f0f006d380d50ef10ab77a4673e83eb19006c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Thu, 24 Jul 2025 09:59:16 +0200
Subject: [PATCH 2614/2760] =?UTF-8?q?MAINTAINERS:=20Remove=20Fr=C3=A9d?=
 =?UTF-8?q?=C3=A9ric=20as=20reviewer?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Frédéric has moved to other tasks within IBM and no longer does QEMU
development.

Cc: Frédéric Barrat <fbarrat@linux.ibm.com>
Acked-by: Frédéric Barrat <fbarrat@linux.ibm.com>
Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Link: https://lore.kernel.org/qemu-devel/20250724075916.1593420-1-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 MAINTAINERS | 2 --
 1 file changed, 2 deletions(-)

diff --git a/MAINTAINERS b/MAINTAINERS
index f3f981f90d..9481a21c80 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1578,7 +1578,6 @@ F: tests/functional/test_ppc64_tuxrun.py
 
 PowerNV (Non-Virtualized)
 M: Nicholas Piggin <npiggin@gmail.com>
-R: Frédéric Barrat <fbarrat@linux.ibm.com>
 R: Aditya Gupta <adityag@linux.ibm.com>
 L: qemu-ppc@nongnu.org
 S: Odd Fixes
@@ -2780,7 +2779,6 @@ F: tests/qtest/fw_cfg-test.c
 T: git https://github.com/philmd/qemu.git fw_cfg-next
 
 XIVE
-R: Frédéric Barrat <fbarrat@linux.ibm.com>
 R: Gautam Menghani <gautam@linux.ibm.com>
 L: qemu-ppc@nongnu.org
 S: Odd Fixes

From 0fb961e392e2055adc5429236989b01bb763f12c Mon Sep 17 00:00:00 2001
From: Daniel Henrique Barboza <danielhb413@gmail.com>
Date: Thu, 24 Jul 2025 09:34:16 -0300
Subject: [PATCH 2615/2760] MAINTAINERS: remove myself as ppc
 maintainer/reviewer
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

It has been awhile since I actively did anything for qemu-ppc aside from
reading the qemu-ppc inbox a couple of times each month. It's not enough
to justify a reviewer role, let alone being a maintainer.

Given that we're doing qemu-ppc maintainership changes across the board
I'll take the opportunity and remove myself from the premises too. Feel
free to reach out with questions about code I did in the past, but at
this moment I'm no longer able to keep up with qemu-ppc activities.

Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250724123416.3115941-1-danielhb413@gmail.com
[ clg: Adjusted context ]
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 MAINTAINERS | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/MAINTAINERS b/MAINTAINERS
index 9481a21c80..f1bd69c3db 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -295,7 +295,6 @@ F: tests/tcg/openrisc/
 
 PowerPC TCG CPUs
 M: Nicholas Piggin <npiggin@gmail.com>
-M: Daniel Henrique Barboza <danielhb413@gmail.com>
 R: Chinmay Rath <rathc@linux.ibm.com>
 L: qemu-ppc@nongnu.org
 S: Odd Fixes
@@ -453,7 +452,6 @@ F: target/mips/system/
 
 PPC KVM CPUs
 M: Nicholas Piggin <npiggin@gmail.com>
-R: Daniel Henrique Barboza <danielhb413@gmail.com>
 R: Harsh Prateek Bora <harshpb@linux.ibm.com>
 S: Odd Fixes
 F: target/ppc/kvm.c
@@ -1553,7 +1551,6 @@ F: tests/functional/test_ppc_40p.py
 sPAPR (pseries)
 M: Nicholas Piggin <npiggin@gmail.com>
 M: Harsh Prateek Bora <harshpb@linux.ibm.com>
-R: Daniel Henrique Barboza <danielhb413@gmail.com>
 R: Harsh Prateek Bora <harshpb@linux.ibm.com>
 L: qemu-ppc@nongnu.org
 S: Odd Fixes

From 012842c075520dbe1bd96a2fdcf4e218874ba443 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Mon, 21 Jul 2025 19:54:52 +0100
Subject: [PATCH 2616/2760] log: make '-msg timestamp=on' apply to all qemu_log
 usage
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Currently the tracing 'log' back emits special code to add timestamps
to trace points sent via qemu_log(). This current impl is a bad design
for a number of reasons.

 * It changes the QEMU headers, such that 'error-report.h' content
   is visible to all files using tracing, but only when the 'log'
   backend is enabled. This has led to build failure bugs as devs
   rarely test without the (default) 'log' backend enabled, and
   CI can't cover every scenario for every trace backend.

 * It bloats the trace points definitions which are inlined into
   every probe location due to repeated inlining of timestamp
   formatting code, adding MBs of overhead to QEMU.

 * The tracing subsystem should not be treated any differently
   from other users of qemu_log. They all would benefit from
   having timestamps present.

 * The timestamp emitted with the tracepoints is in a needlessly
   different format to that used by error_report() in response
   to '-msg timestamp=on'.

This fixes all these issues simply by moving timestamp formatting
into qemu_log, using the same approach as for error_report.

The code before:

  static inline void _nocheck__trace_qcrypto_tls_creds_get_path(void * creds, const char * filename, const char * path)
  {
      if (trace_event_get_state(TRACE_QCRYPTO_TLS_CREDS_GET_PATH) && qemu_loglevel_mask(LOG_TRACE)) {
          if (message_with_timestamp) {
              struct timeval _now;
              gettimeofday(&_now, NULL);
              qemu_log("%d@%zu.%06zu:qcrypto_tls_creds_get_path " "TLS creds path creds=%p filename=%s path=%s" "\n",
                       qemu_get_thread_id(),
                       (size_t)_now.tv_sec, (size_t)_now.tv_usec
                       , creds, filename, path);
          } else {
              qemu_log("qcrypto_tls_creds_get_path " "TLS creds path creds=%p filename=%s path=%s" "\n", creds, filename, path);
          }
      }
  }

and after:

  static inline void _nocheck__trace_qcrypto_tls_creds_get_path(void * creds, const char * filename, const char * path)
  {
      if (trace_event_get_state(TRACE_QCRYPTO_TLS_CREDS_GET_PATH) && qemu_loglevel_mask(LOG_TRACE)) {
          qemu_log("qcrypto_tls_creds_get_path " "TLS creds path creds=%p filename=%s path=%s" "\n", creds, filename, path);
      }
  }

The log and error messages before:

  $ qemu-system-x86_64 -trace qcrypto* -object tls-creds-x509,id=tls0,dir=$HOME/tls -msg timestamp=on
  2986097@1753122905.917608:qcrypto_tls_creds_x509_load TLS creds x509 load creds=0x55d925bd9490 dir=/var/home/berrange/tls
  2986097@1753122905.917621:qcrypto_tls_creds_get_path TLS creds path creds=0x55d925bd9490 filename=ca-cert.pem path=<none>
  2025-07-21T18:35:05.917626Z qemu-system-x86_64: Unable to access credentials /var/home/berrange/tls/ca-cert.pem: No such file or directory

and after:

  $ qemu-system-x86_64 -trace qcrypto* -object tls-creds-x509,id=tls0,dir=$HOME/tls -msg timestamp=on
  2025-07-21T18:43:28.089797Z qcrypto_tls_creds_x509_load TLS creds x509 load creds=0x55bf5bf12380 dir=/var/home/berrange/tls
  2025-07-21T18:43:28.089815Z qcrypto_tls_creds_get_path TLS creds path creds=0x55bf5bf12380 filename=ca-cert.pem path=<none>
  2025-07-21T18:43:28.089819Z qemu-system-x86_64: Unable to access credentials /var/home/berrange/tls/ca-cert.pem: No such file or directory

The binary size before:

  $ ls -alh qemu-system-x86_64
  -rwxr-xr-x. 1 berrange berrange 87M Jul 21 19:39 qemu-system-x86_64
  $ strip qemu-system-x86_64
  $ ls -alh qemu-system-x86_64
  -rwxr-xr-x. 1 berrange berrange 30M Jul 21 19:39 qemu-system-x86_64

and after:

  $ ls -alh qemu-system-x86_64
  -rwxr-xr-x. 1 berrange berrange 85M Jul 21 19:41 qemu-system-x86_64
  $ strip qemu-system-x86_64
  $ ls -alh qemu-system-x86_64
  -rwxr-xr-x. 1 berrange berrange 29M Jul 21 19:41 qemu-system-x86_64

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Message-id: 20250721185452.3016488-1-berrange@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 scripts/tracetool/backend/log.py | 14 +-------------
 util/log.c                       | 20 +++++++++++++++++++-
 2 files changed, 20 insertions(+), 14 deletions(-)

diff --git a/scripts/tracetool/backend/log.py b/scripts/tracetool/backend/log.py
index 5c9d09dd11..eb50ceea34 100644
--- a/scripts/tracetool/backend/log.py
+++ b/scripts/tracetool/backend/log.py
@@ -20,7 +20,6 @@ PUBLIC = True
 
 def generate_h_begin(events, group):
     out('#include "qemu/log-for-trace.h"',
-        '#include "qemu/error-report.h"',
         '')
 
 
@@ -32,20 +31,9 @@ def generate_h(event, group):
     cond = "trace_event_get_state(%s)" % ("TRACE_" + event.name.upper())
 
     out('    if (%(cond)s && qemu_loglevel_mask(LOG_TRACE)) {',
-        '        if (message_with_timestamp) {',
-        '            struct timeval _now;',
-        '            gettimeofday(&_now, NULL);',
         '#line %(event_lineno)d "%(event_filename)s"',
-        '            qemu_log("%%d@%%zu.%%06zu:%(name)s " %(fmt)s "\\n",',
-        '                     qemu_get_thread_id(),',
-        '                     (size_t)_now.tv_sec, (size_t)_now.tv_usec',
-        '                     %(argnames)s);',
+        '        qemu_log("%(name)s " %(fmt)s "\\n"%(argnames)s);',
         '#line %(out_next_lineno)d "%(out_filename)s"',
-        '        } else {',
-        '#line %(event_lineno)d "%(event_filename)s"',
-        '            qemu_log("%(name)s " %(fmt)s "\\n"%(argnames)s);',
-        '#line %(out_next_lineno)d "%(out_filename)s"',
-        '        }',
         '    }',
         cond=cond,
         event_lineno=event.lineno,
diff --git a/util/log.c b/util/log.c
index 58d24de48a..abdcb6b311 100644
--- a/util/log.c
+++ b/util/log.c
@@ -145,10 +145,28 @@ void qemu_log_unlock(FILE *logfile)
 
 void qemu_log(const char *fmt, ...)
 {
-    FILE *f = qemu_log_trylock();
+    FILE *f;
+    g_autofree const char *timestr = NULL;
+
+    /*
+     * Prepare the timestamp *outside* the logging
+     * lock so it better reflects when the message
+     * was emitted if we are delayed acquiring the
+     * mutex
+     */
+    if (message_with_timestamp) {
+        g_autoptr(GDateTime) dt = g_date_time_new_now_utc();
+        timestr = g_date_time_format_iso8601(dt);
+    }
+
+    f = qemu_log_trylock();
     if (f) {
         va_list ap;
 
+        if (timestr) {
+            fprintf(f, "%s ", timestr);
+        }
+
         va_start(ap, fmt);
         vfprintf(f, fmt, ap);
         va_end(ap);

From b8882becd572d3afb888c836a6ffc7f92c17d1c5 Mon Sep 17 00:00:00 2001
From: Michael Tokarev <mjt@tls.msk.ru>
Date: Fri, 21 Feb 2025 16:34:52 +0300
Subject: [PATCH 2617/2760] hw/display/qxl-render.c: fix qxl_unpack_chunks()
 chunk size calculation

In case of multiple chunks, code in qxl_unpack_chunks() takes size of the
wrong (next in the chain) chunk, instead of using current chunk size.
This leads to wrong number of bytes being copied, and to crashes if next
chunk size is larger than the current one.

Based on the code by Gao Yong.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1628
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Reviewed-by: Thomas Huth <thuth@redhat.com>
---
 hw/display/qxl-render.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/hw/display/qxl-render.c b/hw/display/qxl-render.c
index eda6d3de37..c6a9ac1da1 100644
--- a/hw/display/qxl-render.c
+++ b/hw/display/qxl-render.c
@@ -222,6 +222,7 @@ static void qxl_unpack_chunks(void *dest, size_t size, PCIQXLDevice *qxl,
     uint32_t max_chunks = 32;
     size_t offset = 0;
     size_t bytes;
+    QXLPHYSICAL next_chunk_phys = 0;
 
     for (;;) {
         bytes = MIN(size - offset, chunk->data_size);
@@ -230,7 +231,15 @@ static void qxl_unpack_chunks(void *dest, size_t size, PCIQXLDevice *qxl,
         if (offset == size) {
             return;
         }
-        chunk = qxl_phys2virt(qxl, chunk->next_chunk, group_id,
+        next_chunk_phys = chunk->next_chunk;
+        /* fist time, only get the next chunk's data size */
+        chunk = qxl_phys2virt(qxl, next_chunk_phys, group_id,
+                              sizeof(QXLDataChunk));
+        if (!chunk) {
+            return;
+        }
+        /* second time, check data size and get data */
+        chunk = qxl_phys2virt(qxl, next_chunk_phys, group_id,
                               sizeof(QXLDataChunk) + chunk->data_size);
         if (!chunk) {
             return;

From 0e171b427b1d2f68d76a2b7cae987432c10ca8aa Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 23 Jul 2025 17:54:53 +0100
Subject: [PATCH 2618/2760] target/arm: Expand the descriptor for SME/SVE
 memory ops to i64

We have run out of room attempting to pack both the gvec
descriptor and the mte descriptor into 32 bits.
Here, change nothing except the parameter type, which
affects all declarations, the function typedefs, and the
type used with tcg expansion.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20250723165458.3509150-2-peter.maydell@linaro.org
---
 target/arm/tcg/helper-sme.h    |  144 ++--
 target/arm/tcg/helper-sve.h    | 1196 ++++++++++++++++----------------
 target/arm/tcg/sme_helper.c    |   16 +-
 target/arm/tcg/sve_helper.c    |   96 +--
 target/arm/tcg/translate-a64.h |    2 +-
 target/arm/tcg/translate-sme.c |    6 +-
 target/arm/tcg/translate-sve.c |   33 +-
 7 files changed, 747 insertions(+), 746 deletions(-)

diff --git a/target/arm/tcg/helper-sme.h b/target/arm/tcg/helper-sme.h
index 1fc756bec6..c551797c6f 100644
--- a/target/arm/tcg/helper-sme.h
+++ b/target/arm/tcg/helper-sme.h
@@ -48,87 +48,87 @@ DEF_HELPER_FLAGS_3(sme2p1_movaz_zc_s, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 DEF_HELPER_FLAGS_3(sme2p1_movaz_zc_d, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 DEF_HELPER_FLAGS_3(sme2p1_movaz_zc_q, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 
-DEF_HELPER_FLAGS_5(sme_ld1b_h, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
-DEF_HELPER_FLAGS_5(sme_ld1b_v, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
-DEF_HELPER_FLAGS_5(sme_ld1b_h_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
-DEF_HELPER_FLAGS_5(sme_ld1b_v_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
+DEF_HELPER_FLAGS_5(sme_ld1b_h, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
+DEF_HELPER_FLAGS_5(sme_ld1b_v, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
+DEF_HELPER_FLAGS_5(sme_ld1b_h_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
+DEF_HELPER_FLAGS_5(sme_ld1b_v_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_5(sme_ld1h_be_h, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
-DEF_HELPER_FLAGS_5(sme_ld1h_le_h, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
-DEF_HELPER_FLAGS_5(sme_ld1h_be_v, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
-DEF_HELPER_FLAGS_5(sme_ld1h_le_v, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
-DEF_HELPER_FLAGS_5(sme_ld1h_be_h_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
-DEF_HELPER_FLAGS_5(sme_ld1h_le_h_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
-DEF_HELPER_FLAGS_5(sme_ld1h_be_v_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
-DEF_HELPER_FLAGS_5(sme_ld1h_le_v_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
+DEF_HELPER_FLAGS_5(sme_ld1h_be_h, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
+DEF_HELPER_FLAGS_5(sme_ld1h_le_h, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
+DEF_HELPER_FLAGS_5(sme_ld1h_be_v, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
+DEF_HELPER_FLAGS_5(sme_ld1h_le_v, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
+DEF_HELPER_FLAGS_5(sme_ld1h_be_h_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
+DEF_HELPER_FLAGS_5(sme_ld1h_le_h_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
+DEF_HELPER_FLAGS_5(sme_ld1h_be_v_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
+DEF_HELPER_FLAGS_5(sme_ld1h_le_v_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_5(sme_ld1s_be_h, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
-DEF_HELPER_FLAGS_5(sme_ld1s_le_h, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
-DEF_HELPER_FLAGS_5(sme_ld1s_be_v, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
-DEF_HELPER_FLAGS_5(sme_ld1s_le_v, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
-DEF_HELPER_FLAGS_5(sme_ld1s_be_h_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
-DEF_HELPER_FLAGS_5(sme_ld1s_le_h_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
-DEF_HELPER_FLAGS_5(sme_ld1s_be_v_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
-DEF_HELPER_FLAGS_5(sme_ld1s_le_v_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
+DEF_HELPER_FLAGS_5(sme_ld1s_be_h, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
+DEF_HELPER_FLAGS_5(sme_ld1s_le_h, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
+DEF_HELPER_FLAGS_5(sme_ld1s_be_v, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
+DEF_HELPER_FLAGS_5(sme_ld1s_le_v, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
+DEF_HELPER_FLAGS_5(sme_ld1s_be_h_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
+DEF_HELPER_FLAGS_5(sme_ld1s_le_h_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
+DEF_HELPER_FLAGS_5(sme_ld1s_be_v_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
+DEF_HELPER_FLAGS_5(sme_ld1s_le_v_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_5(sme_ld1d_be_h, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
-DEF_HELPER_FLAGS_5(sme_ld1d_le_h, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
-DEF_HELPER_FLAGS_5(sme_ld1d_be_v, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
-DEF_HELPER_FLAGS_5(sme_ld1d_le_v, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
-DEF_HELPER_FLAGS_5(sme_ld1d_be_h_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
-DEF_HELPER_FLAGS_5(sme_ld1d_le_h_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
-DEF_HELPER_FLAGS_5(sme_ld1d_be_v_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
-DEF_HELPER_FLAGS_5(sme_ld1d_le_v_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
+DEF_HELPER_FLAGS_5(sme_ld1d_be_h, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
+DEF_HELPER_FLAGS_5(sme_ld1d_le_h, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
+DEF_HELPER_FLAGS_5(sme_ld1d_be_v, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
+DEF_HELPER_FLAGS_5(sme_ld1d_le_v, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
+DEF_HELPER_FLAGS_5(sme_ld1d_be_h_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
+DEF_HELPER_FLAGS_5(sme_ld1d_le_h_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
+DEF_HELPER_FLAGS_5(sme_ld1d_be_v_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
+DEF_HELPER_FLAGS_5(sme_ld1d_le_v_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_5(sme_ld1q_be_h, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
-DEF_HELPER_FLAGS_5(sme_ld1q_le_h, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
-DEF_HELPER_FLAGS_5(sme_ld1q_be_v, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
-DEF_HELPER_FLAGS_5(sme_ld1q_le_v, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
-DEF_HELPER_FLAGS_5(sme_ld1q_be_h_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
-DEF_HELPER_FLAGS_5(sme_ld1q_le_h_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
-DEF_HELPER_FLAGS_5(sme_ld1q_be_v_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
-DEF_HELPER_FLAGS_5(sme_ld1q_le_v_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
+DEF_HELPER_FLAGS_5(sme_ld1q_be_h, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
+DEF_HELPER_FLAGS_5(sme_ld1q_le_h, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
+DEF_HELPER_FLAGS_5(sme_ld1q_be_v, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
+DEF_HELPER_FLAGS_5(sme_ld1q_le_v, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
+DEF_HELPER_FLAGS_5(sme_ld1q_be_h_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
+DEF_HELPER_FLAGS_5(sme_ld1q_le_h_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
+DEF_HELPER_FLAGS_5(sme_ld1q_be_v_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
+DEF_HELPER_FLAGS_5(sme_ld1q_le_v_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_5(sme_st1b_h, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
-DEF_HELPER_FLAGS_5(sme_st1b_v, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
-DEF_HELPER_FLAGS_5(sme_st1b_h_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
-DEF_HELPER_FLAGS_5(sme_st1b_v_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
+DEF_HELPER_FLAGS_5(sme_st1b_h, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
+DEF_HELPER_FLAGS_5(sme_st1b_v, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
+DEF_HELPER_FLAGS_5(sme_st1b_h_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
+DEF_HELPER_FLAGS_5(sme_st1b_v_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_5(sme_st1h_be_h, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
-DEF_HELPER_FLAGS_5(sme_st1h_le_h, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
-DEF_HELPER_FLAGS_5(sme_st1h_be_v, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
-DEF_HELPER_FLAGS_5(sme_st1h_le_v, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
-DEF_HELPER_FLAGS_5(sme_st1h_be_h_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
-DEF_HELPER_FLAGS_5(sme_st1h_le_h_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
-DEF_HELPER_FLAGS_5(sme_st1h_be_v_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
-DEF_HELPER_FLAGS_5(sme_st1h_le_v_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
+DEF_HELPER_FLAGS_5(sme_st1h_be_h, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
+DEF_HELPER_FLAGS_5(sme_st1h_le_h, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
+DEF_HELPER_FLAGS_5(sme_st1h_be_v, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
+DEF_HELPER_FLAGS_5(sme_st1h_le_v, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
+DEF_HELPER_FLAGS_5(sme_st1h_be_h_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
+DEF_HELPER_FLAGS_5(sme_st1h_le_h_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
+DEF_HELPER_FLAGS_5(sme_st1h_be_v_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
+DEF_HELPER_FLAGS_5(sme_st1h_le_v_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_5(sme_st1s_be_h, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
-DEF_HELPER_FLAGS_5(sme_st1s_le_h, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
-DEF_HELPER_FLAGS_5(sme_st1s_be_v, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
-DEF_HELPER_FLAGS_5(sme_st1s_le_v, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
-DEF_HELPER_FLAGS_5(sme_st1s_be_h_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
-DEF_HELPER_FLAGS_5(sme_st1s_le_h_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
-DEF_HELPER_FLAGS_5(sme_st1s_be_v_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
-DEF_HELPER_FLAGS_5(sme_st1s_le_v_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
+DEF_HELPER_FLAGS_5(sme_st1s_be_h, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
+DEF_HELPER_FLAGS_5(sme_st1s_le_h, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
+DEF_HELPER_FLAGS_5(sme_st1s_be_v, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
+DEF_HELPER_FLAGS_5(sme_st1s_le_v, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
+DEF_HELPER_FLAGS_5(sme_st1s_be_h_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
+DEF_HELPER_FLAGS_5(sme_st1s_le_h_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
+DEF_HELPER_FLAGS_5(sme_st1s_be_v_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
+DEF_HELPER_FLAGS_5(sme_st1s_le_v_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_5(sme_st1d_be_h, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
-DEF_HELPER_FLAGS_5(sme_st1d_le_h, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
-DEF_HELPER_FLAGS_5(sme_st1d_be_v, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
-DEF_HELPER_FLAGS_5(sme_st1d_le_v, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
-DEF_HELPER_FLAGS_5(sme_st1d_be_h_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
-DEF_HELPER_FLAGS_5(sme_st1d_le_h_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
-DEF_HELPER_FLAGS_5(sme_st1d_be_v_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
-DEF_HELPER_FLAGS_5(sme_st1d_le_v_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
+DEF_HELPER_FLAGS_5(sme_st1d_be_h, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
+DEF_HELPER_FLAGS_5(sme_st1d_le_h, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
+DEF_HELPER_FLAGS_5(sme_st1d_be_v, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
+DEF_HELPER_FLAGS_5(sme_st1d_le_v, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
+DEF_HELPER_FLAGS_5(sme_st1d_be_h_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
+DEF_HELPER_FLAGS_5(sme_st1d_le_h_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
+DEF_HELPER_FLAGS_5(sme_st1d_be_v_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
+DEF_HELPER_FLAGS_5(sme_st1d_le_v_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_5(sme_st1q_be_h, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
-DEF_HELPER_FLAGS_5(sme_st1q_le_h, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
-DEF_HELPER_FLAGS_5(sme_st1q_be_v, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
-DEF_HELPER_FLAGS_5(sme_st1q_le_v, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
-DEF_HELPER_FLAGS_5(sme_st1q_be_h_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
-DEF_HELPER_FLAGS_5(sme_st1q_le_h_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
-DEF_HELPER_FLAGS_5(sme_st1q_be_v_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
-DEF_HELPER_FLAGS_5(sme_st1q_le_v_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i32)
+DEF_HELPER_FLAGS_5(sme_st1q_be_h, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
+DEF_HELPER_FLAGS_5(sme_st1q_le_h, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
+DEF_HELPER_FLAGS_5(sme_st1q_be_v, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
+DEF_HELPER_FLAGS_5(sme_st1q_le_v, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
+DEF_HELPER_FLAGS_5(sme_st1q_be_h_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
+DEF_HELPER_FLAGS_5(sme_st1q_le_h_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
+DEF_HELPER_FLAGS_5(sme_st1q_be_v_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
+DEF_HELPER_FLAGS_5(sme_st1q_le_v_mte, TCG_CALL_NO_WG, void, env, ptr, ptr, tl, i64)
 
 DEF_HELPER_FLAGS_5(sme_addha_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_5(sme_addva_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
diff --git a/target/arm/tcg/helper-sve.h b/target/arm/tcg/helper-sve.h
index 5e4b7fd8cf..c3541a8ca8 100644
--- a/target/arm/tcg/helper-sve.h
+++ b/target/arm/tcg/helper-sve.h
@@ -1655,1015 +1655,1015 @@ DEF_HELPER_FLAGS_4(sve2_usubw_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(sve2_usubw_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(sve2_usubw_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 
-DEF_HELPER_FLAGS_4(sve_ld1bb_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld2bb_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld3bb_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld4bb_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_ld1bb_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld2bb_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld3bb_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld4bb_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_ld1hh_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld2hh_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld3hh_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld4hh_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_ld1hh_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld2hh_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld3hh_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld4hh_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_ld1hh_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld2hh_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld3hh_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld4hh_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_ld1hh_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld2hh_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld3hh_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld4hh_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_ld1ss_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld2ss_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld3ss_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld4ss_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_ld1ss_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld2ss_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld3ss_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld4ss_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_ld1ss_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld2ss_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld3ss_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld4ss_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_ld1ss_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld2ss_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld3ss_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld4ss_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_ld1dd_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld2dd_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld3dd_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld4dd_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_ld1dd_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld2dd_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld3dd_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld4dd_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_ld1dd_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld2dd_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld3dd_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld4dd_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_ld1dd_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld2dd_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld3dd_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld4dd_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_ld2qq_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld3qq_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld4qq_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_ld2qq_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld3qq_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld4qq_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_ld2qq_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld3qq_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld4qq_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_ld2qq_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld3qq_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld4qq_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_ld1bhu_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld1bsu_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld1bdu_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld1bhs_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld1bss_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld1bds_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_ld1bhu_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld1bsu_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld1bdu_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld1bhs_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld1bss_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld1bds_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_ld1hsu_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld1hdu_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld1hss_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld1hds_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_ld1hsu_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld1hdu_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld1hss_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld1hds_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_ld1hsu_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld1hdu_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld1hss_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld1hds_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_ld1hsu_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld1hdu_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld1hss_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld1hds_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_ld1sdu_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld1sds_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_ld1sdu_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld1sds_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_ld1squ_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld1dqu_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_ld1squ_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld1dqu_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_ld1sdu_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld1sds_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_ld1sdu_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld1sds_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_ld1squ_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld1dqu_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_ld1squ_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld1dqu_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_ld1bb_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld2bb_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld3bb_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld4bb_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_ld1bb_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld2bb_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld3bb_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld4bb_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_ld1hh_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld2hh_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld3hh_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld4hh_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_ld1hh_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld2hh_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld3hh_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld4hh_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_ld1hh_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld2hh_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld3hh_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld4hh_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_ld1hh_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld2hh_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld3hh_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld4hh_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_ld1ss_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld2ss_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld3ss_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld4ss_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_ld1ss_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld2ss_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld3ss_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld4ss_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_ld1ss_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld2ss_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld3ss_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld4ss_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_ld1ss_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld2ss_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld3ss_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld4ss_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_ld1dd_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld2dd_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld3dd_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld4dd_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_ld1dd_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld2dd_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld3dd_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld4dd_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_ld1dd_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld2dd_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld3dd_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld4dd_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_ld1dd_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld2dd_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld3dd_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld4dd_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_ld2qq_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld3qq_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld4qq_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_ld2qq_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld3qq_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld4qq_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_ld2qq_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld3qq_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld4qq_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_ld2qq_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld3qq_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld4qq_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_ld1bhu_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld1bsu_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld1bdu_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld1bhs_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld1bss_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld1bds_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_ld1bhu_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld1bsu_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld1bdu_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld1bhs_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld1bss_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld1bds_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_ld1hsu_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld1hdu_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld1hss_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld1hds_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_ld1hsu_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld1hdu_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld1hss_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld1hds_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_ld1hsu_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld1hdu_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld1hss_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld1hds_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_ld1hsu_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld1hdu_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld1hss_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld1hds_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_ld1sdu_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld1sds_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_ld1sdu_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld1sds_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_ld1squ_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld1dqu_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_ld1squ_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld1dqu_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_ld1sdu_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld1sds_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_ld1sdu_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld1sds_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_ld1squ_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ld1dqu_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_ld1squ_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ld1dqu_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_ldff1bb_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ldff1bhu_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ldff1bsu_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ldff1bdu_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ldff1bhs_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ldff1bss_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ldff1bds_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_ldff1bb_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ldff1bhu_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ldff1bsu_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ldff1bdu_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ldff1bhs_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ldff1bss_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ldff1bds_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_ldff1hh_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ldff1hsu_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ldff1hdu_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ldff1hss_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ldff1hds_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_ldff1hh_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ldff1hsu_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ldff1hdu_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ldff1hss_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ldff1hds_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_ldff1hh_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ldff1hsu_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ldff1hdu_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ldff1hss_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ldff1hds_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_ldff1hh_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ldff1hsu_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ldff1hdu_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ldff1hss_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ldff1hds_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_ldff1ss_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ldff1sdu_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ldff1sds_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_ldff1ss_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ldff1sdu_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ldff1sds_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_ldff1ss_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ldff1sdu_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ldff1sds_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_ldff1ss_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ldff1sdu_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ldff1sds_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_ldff1dd_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ldff1dd_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_ldff1dd_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ldff1dd_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_ldff1bb_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ldff1bhu_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ldff1bsu_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ldff1bdu_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ldff1bhs_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ldff1bss_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ldff1bds_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_ldff1bb_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ldff1bhu_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ldff1bsu_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ldff1bdu_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ldff1bhs_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ldff1bss_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ldff1bds_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
 DEF_HELPER_FLAGS_4(sve_ldff1hh_le_r_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, tl, i32)
+                   void, env, ptr, tl, i64)
 DEF_HELPER_FLAGS_4(sve_ldff1hsu_le_r_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, tl, i32)
+                   void, env, ptr, tl, i64)
 DEF_HELPER_FLAGS_4(sve_ldff1hdu_le_r_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, tl, i32)
+                   void, env, ptr, tl, i64)
 DEF_HELPER_FLAGS_4(sve_ldff1hss_le_r_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, tl, i32)
+                   void, env, ptr, tl, i64)
 DEF_HELPER_FLAGS_4(sve_ldff1hds_le_r_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, tl, i32)
+                   void, env, ptr, tl, i64)
 
 DEF_HELPER_FLAGS_4(sve_ldff1hh_be_r_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, tl, i32)
+                   void, env, ptr, tl, i64)
 DEF_HELPER_FLAGS_4(sve_ldff1hsu_be_r_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, tl, i32)
+                   void, env, ptr, tl, i64)
 DEF_HELPER_FLAGS_4(sve_ldff1hdu_be_r_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, tl, i32)
+                   void, env, ptr, tl, i64)
 DEF_HELPER_FLAGS_4(sve_ldff1hss_be_r_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, tl, i32)
+                   void, env, ptr, tl, i64)
 DEF_HELPER_FLAGS_4(sve_ldff1hds_be_r_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, tl, i32)
+                   void, env, ptr, tl, i64)
 
 DEF_HELPER_FLAGS_4(sve_ldff1ss_le_r_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, tl, i32)
+                   void, env, ptr, tl, i64)
 DEF_HELPER_FLAGS_4(sve_ldff1sdu_le_r_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, tl, i32)
+                   void, env, ptr, tl, i64)
 DEF_HELPER_FLAGS_4(sve_ldff1sds_le_r_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, tl, i32)
+                   void, env, ptr, tl, i64)
 
 DEF_HELPER_FLAGS_4(sve_ldff1ss_be_r_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, tl, i32)
+                   void, env, ptr, tl, i64)
 DEF_HELPER_FLAGS_4(sve_ldff1sdu_be_r_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, tl, i32)
+                   void, env, ptr, tl, i64)
 DEF_HELPER_FLAGS_4(sve_ldff1sds_be_r_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, tl, i32)
+                   void, env, ptr, tl, i64)
 
 DEF_HELPER_FLAGS_4(sve_ldff1dd_le_r_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, tl, i32)
+                   void, env, ptr, tl, i64)
 DEF_HELPER_FLAGS_4(sve_ldff1dd_be_r_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, tl, i32)
+                   void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_ldnf1bb_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ldnf1bhu_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ldnf1bsu_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ldnf1bdu_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ldnf1bhs_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ldnf1bss_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ldnf1bds_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_ldnf1bb_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ldnf1bhu_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ldnf1bsu_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ldnf1bdu_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ldnf1bhs_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ldnf1bss_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ldnf1bds_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_ldnf1hh_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ldnf1hsu_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ldnf1hdu_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ldnf1hss_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ldnf1hds_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_ldnf1hh_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ldnf1hsu_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ldnf1hdu_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ldnf1hss_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ldnf1hds_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_ldnf1hh_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ldnf1hsu_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ldnf1hdu_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ldnf1hss_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ldnf1hds_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_ldnf1hh_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ldnf1hsu_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ldnf1hdu_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ldnf1hss_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ldnf1hds_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_ldnf1ss_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ldnf1sdu_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ldnf1sds_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_ldnf1ss_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ldnf1sdu_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ldnf1sds_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_ldnf1ss_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ldnf1sdu_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ldnf1sds_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_ldnf1ss_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ldnf1sdu_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ldnf1sds_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_ldnf1dd_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ldnf1dd_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_ldnf1dd_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ldnf1dd_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_ldnf1bb_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ldnf1bhu_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ldnf1bsu_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ldnf1bdu_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ldnf1bhs_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ldnf1bss_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_ldnf1bds_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_ldnf1bb_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ldnf1bhu_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ldnf1bsu_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ldnf1bdu_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ldnf1bhs_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ldnf1bss_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_ldnf1bds_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
 DEF_HELPER_FLAGS_4(sve_ldnf1hh_le_r_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, tl, i32)
+                   void, env, ptr, tl, i64)
 DEF_HELPER_FLAGS_4(sve_ldnf1hsu_le_r_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, tl, i32)
+                   void, env, ptr, tl, i64)
 DEF_HELPER_FLAGS_4(sve_ldnf1hdu_le_r_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, tl, i32)
+                   void, env, ptr, tl, i64)
 DEF_HELPER_FLAGS_4(sve_ldnf1hss_le_r_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, tl, i32)
+                   void, env, ptr, tl, i64)
 DEF_HELPER_FLAGS_4(sve_ldnf1hds_le_r_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, tl, i32)
+                   void, env, ptr, tl, i64)
 
 DEF_HELPER_FLAGS_4(sve_ldnf1hh_be_r_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, tl, i32)
+                   void, env, ptr, tl, i64)
 DEF_HELPER_FLAGS_4(sve_ldnf1hsu_be_r_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, tl, i32)
+                   void, env, ptr, tl, i64)
 DEF_HELPER_FLAGS_4(sve_ldnf1hdu_be_r_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, tl, i32)
+                   void, env, ptr, tl, i64)
 DEF_HELPER_FLAGS_4(sve_ldnf1hss_be_r_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, tl, i32)
+                   void, env, ptr, tl, i64)
 DEF_HELPER_FLAGS_4(sve_ldnf1hds_be_r_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, tl, i32)
+                   void, env, ptr, tl, i64)
 
 DEF_HELPER_FLAGS_4(sve_ldnf1ss_le_r_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, tl, i32)
+                   void, env, ptr, tl, i64)
 DEF_HELPER_FLAGS_4(sve_ldnf1sdu_le_r_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, tl, i32)
+                   void, env, ptr, tl, i64)
 DEF_HELPER_FLAGS_4(sve_ldnf1sds_le_r_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, tl, i32)
+                   void, env, ptr, tl, i64)
 
 DEF_HELPER_FLAGS_4(sve_ldnf1ss_be_r_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, tl, i32)
+                   void, env, ptr, tl, i64)
 DEF_HELPER_FLAGS_4(sve_ldnf1sdu_be_r_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, tl, i32)
+                   void, env, ptr, tl, i64)
 DEF_HELPER_FLAGS_4(sve_ldnf1sds_be_r_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, tl, i32)
+                   void, env, ptr, tl, i64)
 
 DEF_HELPER_FLAGS_4(sve_ldnf1dd_le_r_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, tl, i32)
+                   void, env, ptr, tl, i64)
 DEF_HELPER_FLAGS_4(sve_ldnf1dd_be_r_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, tl, i32)
+                   void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_st1bb_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_st2bb_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_st3bb_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_st4bb_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_st1bb_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_st2bb_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_st3bb_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_st4bb_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_st1hh_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_st2hh_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_st3hh_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_st4hh_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_st1hh_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_st2hh_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_st3hh_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_st4hh_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_st1hh_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_st2hh_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_st3hh_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_st4hh_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_st1hh_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_st2hh_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_st3hh_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_st4hh_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_st1ss_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_st2ss_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_st3ss_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_st4ss_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_st1ss_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_st2ss_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_st3ss_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_st4ss_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_st1ss_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_st2ss_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_st3ss_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_st4ss_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_st1ss_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_st2ss_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_st3ss_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_st4ss_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_st1dd_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_st2dd_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_st3dd_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_st4dd_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_st1dd_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_st2dd_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_st3dd_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_st4dd_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_st1dd_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_st2dd_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_st3dd_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_st4dd_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_st1dd_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_st2dd_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_st3dd_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_st4dd_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_st2qq_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_st3qq_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_st4qq_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_st2qq_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_st3qq_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_st4qq_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_st2qq_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_st3qq_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_st4qq_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_st2qq_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_st3qq_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_st4qq_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_st1bh_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_st1bs_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_st1bd_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_st1bh_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_st1bs_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_st1bd_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_st1hs_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_st1hd_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_st1hs_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_st1hd_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_st1hs_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_st1hd_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_st1hs_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_st1hd_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_st1sd_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_st1sd_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_st1sd_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_st1sd_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_st1sq_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_st1sq_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_st1dq_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_st1dq_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_st1sq_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_st1sq_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_st1dq_le_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_st1dq_be_r, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_st1bb_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_st2bb_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_st3bb_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_st4bb_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_st1bb_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_st2bb_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_st3bb_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_st4bb_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_st1hh_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_st2hh_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_st3hh_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_st4hh_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_st1hh_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_st2hh_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_st3hh_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_st4hh_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_st1hh_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_st2hh_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_st3hh_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_st4hh_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_st1hh_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_st2hh_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_st3hh_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_st4hh_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_st1ss_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_st2ss_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_st3ss_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_st4ss_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_st1ss_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_st2ss_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_st3ss_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_st4ss_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_st1ss_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_st2ss_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_st3ss_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_st4ss_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_st1ss_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_st2ss_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_st3ss_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_st4ss_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_st1dd_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_st2dd_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_st3dd_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_st4dd_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_st1dd_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_st2dd_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_st3dd_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_st4dd_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_st1dd_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_st2dd_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_st3dd_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_st4dd_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_st1dd_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_st2dd_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_st3dd_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_st4dd_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_st2qq_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_st3qq_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_st4qq_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_st2qq_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_st3qq_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_st4qq_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_st2qq_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_st3qq_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_st4qq_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_st2qq_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_st3qq_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_st4qq_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_st1bh_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_st1bs_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_st1bd_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_st1bh_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_st1bs_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_st1bd_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_st1hs_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_st1hd_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_st1hs_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_st1hd_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_st1hs_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_st1hd_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_st1hs_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_st1hd_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_st1sd_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_st1sd_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_st1sd_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_st1sd_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
-DEF_HELPER_FLAGS_4(sve_st1sq_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_st1sq_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_st1dq_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
-DEF_HELPER_FLAGS_4(sve_st1dq_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i32)
+DEF_HELPER_FLAGS_4(sve_st1sq_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_st1sq_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_st1dq_le_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
+DEF_HELPER_FLAGS_4(sve_st1dq_be_r_mte, TCG_CALL_NO_WG, void, env, ptr, tl, i64)
 
 DEF_HELPER_FLAGS_6(sve_ldbsu_zsu, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldhsu_le_zsu, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldhsu_be_zsu, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldss_le_zsu, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldss_be_zsu, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldbss_zsu, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldhss_le_zsu, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldhss_be_zsu, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 
 DEF_HELPER_FLAGS_6(sve_ldbsu_zss, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldhsu_le_zss, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldhsu_be_zss, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldss_le_zss, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldss_be_zss, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldbss_zss, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldhss_le_zss, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldhss_be_zss, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 
 DEF_HELPER_FLAGS_6(sve_ldbdu_zsu, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldhdu_le_zsu, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldhdu_be_zsu, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldsdu_le_zsu, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldsdu_be_zsu, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_lddd_le_zsu, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_lddd_be_zsu, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldbds_zsu, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldhds_le_zsu, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldhds_be_zsu, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldsds_le_zsu, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldsds_be_zsu, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 
 DEF_HELPER_FLAGS_6(sve_ldbdu_zss, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldhdu_le_zss, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldhdu_be_zss, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldsdu_le_zss, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldsdu_be_zss, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_lddd_le_zss, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_lddd_be_zss, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldbds_zss, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldhds_le_zss, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldhds_be_zss, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldsds_le_zss, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldsds_be_zss, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 
 DEF_HELPER_FLAGS_6(sve_ldbdu_zd, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldhdu_le_zd, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldhdu_be_zd, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldsdu_le_zd, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldsdu_be_zd, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_lddd_le_zd, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_lddd_be_zd, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldbds_zd, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldhds_le_zd, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldhds_be_zd, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldsds_le_zd, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldsds_be_zd, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldqq_le_zd, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldqq_be_zd, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 
 DEF_HELPER_FLAGS_6(sve_ldbsu_zsu_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldhsu_le_zsu_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldhsu_be_zsu_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldss_le_zsu_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldss_be_zsu_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldbss_zsu_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldhss_le_zsu_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldhss_be_zsu_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 
 DEF_HELPER_FLAGS_6(sve_ldbsu_zss_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldhsu_le_zss_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldhsu_be_zss_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldss_le_zss_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldss_be_zss_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldbss_zss_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldhss_le_zss_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldhss_be_zss_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 
 DEF_HELPER_FLAGS_6(sve_ldbdu_zsu_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldhdu_le_zsu_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldhdu_be_zsu_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldsdu_le_zsu_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldsdu_be_zsu_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_lddd_le_zsu_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_lddd_be_zsu_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldbds_zsu_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldhds_le_zsu_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldhds_be_zsu_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldsds_le_zsu_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldsds_be_zsu_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 
 DEF_HELPER_FLAGS_6(sve_ldbdu_zss_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldhdu_le_zss_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldhdu_be_zss_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldsdu_le_zss_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldsdu_be_zss_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_lddd_le_zss_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_lddd_be_zss_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldbds_zss_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldhds_le_zss_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldhds_be_zss_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldsds_le_zss_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldsds_be_zss_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 
 DEF_HELPER_FLAGS_6(sve_ldbdu_zd_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldhdu_le_zd_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldhdu_be_zd_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldsdu_le_zd_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldsdu_be_zd_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_lddd_le_zd_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_lddd_be_zd_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldbds_zd_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldhds_le_zd_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldhds_be_zd_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldsds_le_zd_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldsds_be_zd_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldqq_le_zd_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldqq_be_zd_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 
 DEF_HELPER_FLAGS_6(sve_ldffbsu_zsu, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffhsu_le_zsu, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffhsu_be_zsu, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffss_le_zsu, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffss_be_zsu, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffbss_zsu, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffhss_le_zsu, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffhss_be_zsu, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 
 DEF_HELPER_FLAGS_6(sve_ldffbsu_zss, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffhsu_le_zss, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffhsu_be_zss, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffss_le_zss, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffss_be_zss, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffbss_zss, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffhss_le_zss, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffhss_be_zss, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 
 DEF_HELPER_FLAGS_6(sve_ldffbdu_zsu, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffhdu_le_zsu, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffhdu_be_zsu, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffsdu_le_zsu, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffsdu_be_zsu, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffdd_le_zsu, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffdd_be_zsu, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffbds_zsu, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffhds_le_zsu, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffhds_be_zsu, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffsds_le_zsu, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffsds_be_zsu, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 
 DEF_HELPER_FLAGS_6(sve_ldffbdu_zss, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffhdu_le_zss, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffhdu_be_zss, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffsdu_le_zss, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffsdu_be_zss, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffdd_le_zss, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffdd_be_zss, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffbds_zss, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffhds_le_zss, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffhds_be_zss, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffsds_le_zss, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffsds_be_zss, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 
 DEF_HELPER_FLAGS_6(sve_ldffbdu_zd, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffhdu_le_zd, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffhdu_be_zd, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffsdu_le_zd, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffsdu_be_zd, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffdd_le_zd, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffdd_be_zd, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffbds_zd, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffhds_le_zd, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffhds_be_zd, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffsds_le_zd, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffsds_be_zd, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 
 DEF_HELPER_FLAGS_6(sve_ldffbsu_zsu_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffhsu_le_zsu_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffhsu_be_zsu_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffss_le_zsu_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffss_be_zsu_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffbss_zsu_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffhss_le_zsu_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffhss_be_zsu_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 
 DEF_HELPER_FLAGS_6(sve_ldffbsu_zss_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffhsu_le_zss_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffhsu_be_zss_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffss_le_zss_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffss_be_zss_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffbss_zss_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffhss_le_zss_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffhss_be_zss_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 
 DEF_HELPER_FLAGS_6(sve_ldffbdu_zsu_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffhdu_le_zsu_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffhdu_be_zsu_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffsdu_le_zsu_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffsdu_be_zsu_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffdd_le_zsu_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffdd_be_zsu_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffbds_zsu_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffhds_le_zsu_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffhds_be_zsu_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffsds_le_zsu_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffsds_be_zsu_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 
 DEF_HELPER_FLAGS_6(sve_ldffbdu_zss_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffhdu_le_zss_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffhdu_be_zss_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffsdu_le_zss_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffsdu_be_zss_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffdd_le_zss_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffdd_be_zss_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffbds_zss_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffhds_le_zss_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffhds_be_zss_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffsds_le_zss_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffsds_be_zss_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 
 DEF_HELPER_FLAGS_6(sve_ldffbdu_zd_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffhdu_le_zd_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffhdu_be_zd_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffsdu_le_zd_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffsdu_be_zd_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffdd_le_zd_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffdd_be_zd_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffbds_zd_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffhds_le_zd_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffhds_be_zd_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffsds_le_zd_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_ldffsds_be_zd_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 
 DEF_HELPER_FLAGS_6(sve_stbs_zsu, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_sths_le_zsu, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_sths_be_zsu, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_stss_le_zsu, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_stss_be_zsu, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 
 DEF_HELPER_FLAGS_6(sve_stbs_zss, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_sths_le_zss, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_sths_be_zss, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_stss_le_zss, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_stss_be_zss, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 
 DEF_HELPER_FLAGS_6(sve_stbd_zsu, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_sthd_le_zsu, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_sthd_be_zsu, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_stsd_le_zsu, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_stsd_be_zsu, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_stdd_le_zsu, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_stdd_be_zsu, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 
 DEF_HELPER_FLAGS_6(sve_stbd_zss, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_sthd_le_zss, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_sthd_be_zss, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_stsd_le_zss, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_stsd_be_zss, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_stdd_le_zss, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_stdd_be_zss, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 
 DEF_HELPER_FLAGS_6(sve_stbd_zd, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_sthd_le_zd, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_sthd_be_zd, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_stsd_le_zd, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_stsd_be_zd, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_stdd_le_zd, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_stdd_be_zd, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_stqq_le_zd, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_stqq_be_zd, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 
 DEF_HELPER_FLAGS_6(sve_stbs_zsu_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_sths_le_zsu_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_sths_be_zsu_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_stss_le_zsu_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_stss_be_zsu_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 
 DEF_HELPER_FLAGS_6(sve_stbs_zss_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_sths_le_zss_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_sths_be_zss_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_stss_le_zss_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_stss_be_zss_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 
 DEF_HELPER_FLAGS_6(sve_stbd_zsu_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_sthd_le_zsu_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_sthd_be_zsu_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_stsd_le_zsu_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_stsd_be_zsu_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_stdd_le_zsu_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_stdd_be_zsu_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 
 DEF_HELPER_FLAGS_6(sve_stbd_zss_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_sthd_le_zss_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_sthd_be_zss_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_stsd_le_zss_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_stsd_be_zss_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_stdd_le_zss_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_stdd_be_zss_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 
 DEF_HELPER_FLAGS_6(sve_stbd_zd_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_sthd_le_zd_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_sthd_be_zd_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_stsd_le_zd_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_stsd_be_zd_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_stdd_le_zd_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_stdd_be_zd_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_stqq_le_zd_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 DEF_HELPER_FLAGS_6(sve_stqq_be_zd_mte, TCG_CALL_NO_WG,
-                   void, env, ptr, ptr, ptr, tl, i32)
+                   void, env, ptr, ptr, ptr, tl, i64)
 
 DEF_HELPER_FLAGS_4(sve2_sqdmull_zzz_h, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, i32)
@@ -3151,18 +3151,18 @@ DEF_HELPER_FLAGS_3(pmov_vp_h, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 DEF_HELPER_FLAGS_3(pmov_vp_s, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 DEF_HELPER_FLAGS_3(pmov_vp_d, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 
-DEF_HELPER_FLAGS_5(sve2p1_ld1bb_c, TCG_CALL_NO_WG, void, env, ptr, tl, i32, i32)
-DEF_HELPER_FLAGS_5(sve2p1_ld1hh_le_c, TCG_CALL_NO_WG, void, env, ptr, tl, i32, i32)
-DEF_HELPER_FLAGS_5(sve2p1_ld1hh_be_c, TCG_CALL_NO_WG, void, env, ptr, tl, i32, i32)
-DEF_HELPER_FLAGS_5(sve2p1_ld1ss_le_c, TCG_CALL_NO_WG, void, env, ptr, tl, i32, i32)
-DEF_HELPER_FLAGS_5(sve2p1_ld1ss_be_c, TCG_CALL_NO_WG, void, env, ptr, tl, i32, i32)
-DEF_HELPER_FLAGS_5(sve2p1_ld1dd_le_c, TCG_CALL_NO_WG, void, env, ptr, tl, i32, i32)
-DEF_HELPER_FLAGS_5(sve2p1_ld1dd_be_c, TCG_CALL_NO_WG, void, env, ptr, tl, i32, i32)
+DEF_HELPER_FLAGS_5(sve2p1_ld1bb_c, TCG_CALL_NO_WG, void, env, ptr, tl, i32, i64)
+DEF_HELPER_FLAGS_5(sve2p1_ld1hh_le_c, TCG_CALL_NO_WG, void, env, ptr, tl, i32, i64)
+DEF_HELPER_FLAGS_5(sve2p1_ld1hh_be_c, TCG_CALL_NO_WG, void, env, ptr, tl, i32, i64)
+DEF_HELPER_FLAGS_5(sve2p1_ld1ss_le_c, TCG_CALL_NO_WG, void, env, ptr, tl, i32, i64)
+DEF_HELPER_FLAGS_5(sve2p1_ld1ss_be_c, TCG_CALL_NO_WG, void, env, ptr, tl, i32, i64)
+DEF_HELPER_FLAGS_5(sve2p1_ld1dd_le_c, TCG_CALL_NO_WG, void, env, ptr, tl, i32, i64)
+DEF_HELPER_FLAGS_5(sve2p1_ld1dd_be_c, TCG_CALL_NO_WG, void, env, ptr, tl, i32, i64)
 
-DEF_HELPER_FLAGS_5(sve2p1_st1bb_c, TCG_CALL_NO_WG, void, env, ptr, tl, i32, i32)
-DEF_HELPER_FLAGS_5(sve2p1_st1hh_le_c, TCG_CALL_NO_WG, void, env, ptr, tl, i32, i32)
-DEF_HELPER_FLAGS_5(sve2p1_st1hh_be_c, TCG_CALL_NO_WG, void, env, ptr, tl, i32, i32)
-DEF_HELPER_FLAGS_5(sve2p1_st1ss_le_c, TCG_CALL_NO_WG, void, env, ptr, tl, i32, i32)
-DEF_HELPER_FLAGS_5(sve2p1_st1ss_be_c, TCG_CALL_NO_WG, void, env, ptr, tl, i32, i32)
-DEF_HELPER_FLAGS_5(sve2p1_st1dd_le_c, TCG_CALL_NO_WG, void, env, ptr, tl, i32, i32)
-DEF_HELPER_FLAGS_5(sve2p1_st1dd_be_c, TCG_CALL_NO_WG, void, env, ptr, tl, i32, i32)
+DEF_HELPER_FLAGS_5(sve2p1_st1bb_c, TCG_CALL_NO_WG, void, env, ptr, tl, i32, i64)
+DEF_HELPER_FLAGS_5(sve2p1_st1hh_le_c, TCG_CALL_NO_WG, void, env, ptr, tl, i32, i64)
+DEF_HELPER_FLAGS_5(sve2p1_st1hh_be_c, TCG_CALL_NO_WG, void, env, ptr, tl, i32, i64)
+DEF_HELPER_FLAGS_5(sve2p1_st1ss_le_c, TCG_CALL_NO_WG, void, env, ptr, tl, i32, i64)
+DEF_HELPER_FLAGS_5(sve2p1_st1ss_be_c, TCG_CALL_NO_WG, void, env, ptr, tl, i32, i64)
+DEF_HELPER_FLAGS_5(sve2p1_st1dd_le_c, TCG_CALL_NO_WG, void, env, ptr, tl, i32, i64)
+DEF_HELPER_FLAGS_5(sve2p1_st1dd_be_c, TCG_CALL_NO_WG, void, env, ptr, tl, i32, i64)
diff --git a/target/arm/tcg/sme_helper.c b/target/arm/tcg/sme_helper.c
index bb8ed1ed0e..0b55f13f8c 100644
--- a/target/arm/tcg/sme_helper.c
+++ b/target/arm/tcg/sme_helper.c
@@ -691,28 +691,28 @@ void sme_ld1_mte(CPUARMState *env, void *za, uint64_t *vg,
 
 #define DO_LD(L, END, ESZ)                                                 \
 void HELPER(sme_ld1##L##END##_h)(CPUARMState *env, void *za, void *vg,     \
-                                 target_ulong addr, uint32_t desc)         \
+                                 target_ulong addr, uint64_t desc)         \
 {                                                                          \
     sme_ld1(env, za, vg, addr, desc, GETPC(), ESZ, 0, false,               \
             sve_ld1##L##L##END##_host, sve_ld1##L##L##END##_tlb,           \
             clear_horizontal, copy_horizontal);                            \
 }                                                                          \
 void HELPER(sme_ld1##L##END##_v)(CPUARMState *env, void *za, void *vg,     \
-                                 target_ulong addr, uint32_t desc)         \
+                                 target_ulong addr, uint64_t desc)         \
 {                                                                          \
     sme_ld1(env, za, vg, addr, desc, GETPC(), ESZ, 0, true,                \
             sme_ld1##L##END##_v_host, sme_ld1##L##END##_v_tlb,             \
             clear_vertical_##L, copy_vertical_##L);                        \
 }                                                                          \
 void HELPER(sme_ld1##L##END##_h_mte)(CPUARMState *env, void *za, void *vg, \
-                                     target_ulong addr, uint32_t desc)     \
+                                     target_ulong addr, uint64_t desc)     \
 {                                                                          \
     sme_ld1_mte(env, za, vg, addr, desc, GETPC(), ESZ, false,              \
                 sve_ld1##L##L##END##_host, sve_ld1##L##L##END##_tlb,       \
                 clear_horizontal, copy_horizontal);                        \
 }                                                                          \
 void HELPER(sme_ld1##L##END##_v_mte)(CPUARMState *env, void *za, void *vg, \
-                                     target_ulong addr, uint32_t desc)     \
+                                     target_ulong addr, uint64_t desc)     \
 {                                                                          \
     sme_ld1_mte(env, za, vg, addr, desc, GETPC(), ESZ, true,               \
                 sme_ld1##L##END##_v_host, sme_ld1##L##END##_v_tlb,         \
@@ -876,25 +876,25 @@ void sme_st1_mte(CPUARMState *env, void *za, uint64_t *vg, target_ulong addr,
 
 #define DO_ST(L, END, ESZ)                                                 \
 void HELPER(sme_st1##L##END##_h)(CPUARMState *env, void *za, void *vg,     \
-                                 target_ulong addr, uint32_t desc)         \
+                                 target_ulong addr, uint64_t desc)         \
 {                                                                          \
     sme_st1(env, za, vg, addr, desc, GETPC(), ESZ, 0, false,               \
             sve_st1##L##L##END##_host, sve_st1##L##L##END##_tlb);          \
 }                                                                          \
 void HELPER(sme_st1##L##END##_v)(CPUARMState *env, void *za, void *vg,     \
-                                 target_ulong addr, uint32_t desc)         \
+                                 target_ulong addr, uint64_t desc)         \
 {                                                                          \
     sme_st1(env, za, vg, addr, desc, GETPC(), ESZ, 0, true,                \
             sme_st1##L##END##_v_host, sme_st1##L##END##_v_tlb);            \
 }                                                                          \
 void HELPER(sme_st1##L##END##_h_mte)(CPUARMState *env, void *za, void *vg, \
-                                     target_ulong addr, uint32_t desc)     \
+                                     target_ulong addr, uint64_t desc)     \
 {                                                                          \
     sme_st1_mte(env, za, vg, addr, desc, GETPC(), ESZ, false,              \
                 sve_st1##L##L##END##_host, sve_st1##L##L##END##_tlb);      \
 }                                                                          \
 void HELPER(sme_st1##L##END##_v_mte)(CPUARMState *env, void *za, void *vg, \
-                                     target_ulong addr, uint32_t desc)     \
+                                     target_ulong addr, uint64_t desc)     \
 {                                                                          \
     sme_st1_mte(env, za, vg, addr, desc, GETPC(), ESZ, true,               \
                 sme_st1##L##END##_v_host, sme_st1##L##END##_v_tlb);        \
diff --git a/target/arm/tcg/sve_helper.c b/target/arm/tcg/sve_helper.c
index 803f0a094d..9fc2c05879 100644
--- a/target/arm/tcg/sve_helper.c
+++ b/target/arm/tcg/sve_helper.c
@@ -6384,13 +6384,13 @@ void sve_ldN_r_mte(CPUARMState *env, uint64_t *vg, target_ulong addr,
 
 #define DO_LD1_1(NAME, ESZ)                                             \
 void HELPER(sve_##NAME##_r)(CPUARMState *env, void *vg,                 \
-                            target_ulong addr, uint32_t desc)           \
+                            target_ulong addr, uint64_t desc)           \
 {                                                                       \
     sve_ldN_r(env, vg, addr, desc, GETPC(), ESZ, MO_8, 1, 0,            \
               sve_##NAME##_host, sve_##NAME##_tlb);                     \
 }                                                                       \
 void HELPER(sve_##NAME##_r_mte)(CPUARMState *env, void *vg,             \
-                                target_ulong addr, uint32_t desc)       \
+                                target_ulong addr, uint64_t desc)       \
 {                                                                       \
     sve_ldN_r_mte(env, vg, addr, desc, GETPC(), ESZ, MO_8, 1,           \
                   sve_##NAME##_host, sve_##NAME##_tlb);                 \
@@ -6398,25 +6398,25 @@ void HELPER(sve_##NAME##_r_mte)(CPUARMState *env, void *vg,             \
 
 #define DO_LD1_2(NAME, ESZ, MSZ)                                        \
 void HELPER(sve_##NAME##_le_r)(CPUARMState *env, void *vg,              \
-                               target_ulong addr, uint32_t desc)        \
+                               target_ulong addr, uint64_t desc)        \
 {                                                                       \
     sve_ldN_r(env, vg, addr, desc, GETPC(), ESZ, MSZ, 1, 0,             \
               sve_##NAME##_le_host, sve_##NAME##_le_tlb);               \
 }                                                                       \
 void HELPER(sve_##NAME##_be_r)(CPUARMState *env, void *vg,              \
-                               target_ulong addr, uint32_t desc)        \
+                               target_ulong addr, uint64_t desc)        \
 {                                                                       \
     sve_ldN_r(env, vg, addr, desc, GETPC(), ESZ, MSZ, 1, 0,             \
               sve_##NAME##_be_host, sve_##NAME##_be_tlb);               \
 }                                                                       \
 void HELPER(sve_##NAME##_le_r_mte)(CPUARMState *env, void *vg,          \
-                                   target_ulong addr, uint32_t desc)    \
+                                   target_ulong addr, uint64_t desc)    \
 {                                                                       \
     sve_ldN_r_mte(env, vg, addr, desc, GETPC(), ESZ, MSZ, 1,            \
                   sve_##NAME##_le_host, sve_##NAME##_le_tlb);           \
 }                                                                       \
 void HELPER(sve_##NAME##_be_r_mte)(CPUARMState *env, void *vg,          \
-                                   target_ulong addr, uint32_t desc)    \
+                                   target_ulong addr, uint64_t desc)    \
 {                                                                       \
     sve_ldN_r_mte(env, vg, addr, desc, GETPC(), ESZ, MSZ, 1,            \
                   sve_##NAME##_be_host, sve_##NAME##_be_tlb);           \
@@ -6450,13 +6450,13 @@ DO_LD1_2(ld1dqu, MO_64, MO_128)
 
 #define DO_LDN_1(N)                                                     \
 void HELPER(sve_ld##N##bb_r)(CPUARMState *env, void *vg,                \
-                             target_ulong addr, uint32_t desc)          \
+                             target_ulong addr, uint64_t desc)          \
 {                                                                       \
     sve_ldN_r(env, vg, addr, desc, GETPC(), MO_8, MO_8, N, 0,           \
               sve_ld1bb_host, sve_ld1bb_tlb);                           \
 }                                                                       \
 void HELPER(sve_ld##N##bb_r_mte)(CPUARMState *env, void *vg,            \
-                                 target_ulong addr, uint32_t desc)      \
+                                 target_ulong addr, uint64_t desc)      \
 {                                                                       \
     sve_ldN_r_mte(env, vg, addr, desc, GETPC(), MO_8, MO_8, N,          \
                   sve_ld1bb_host, sve_ld1bb_tlb);                       \
@@ -6464,25 +6464,25 @@ void HELPER(sve_ld##N##bb_r_mte)(CPUARMState *env, void *vg,            \
 
 #define DO_LDN_2(N, SUFF, ESZ)                                          \
 void HELPER(sve_ld##N##SUFF##_le_r)(CPUARMState *env, void *vg,         \
-                                    target_ulong addr, uint32_t desc)   \
+                                    target_ulong addr, uint64_t desc)   \
 {                                                                       \
     sve_ldN_r(env, vg, addr, desc, GETPC(), ESZ, ESZ, N, 0,             \
               sve_ld1##SUFF##_le_host, sve_ld1##SUFF##_le_tlb);         \
 }                                                                       \
 void HELPER(sve_ld##N##SUFF##_be_r)(CPUARMState *env, void *vg,         \
-                                    target_ulong addr, uint32_t desc)   \
+                                    target_ulong addr, uint64_t desc)   \
 {                                                                       \
     sve_ldN_r(env, vg, addr, desc, GETPC(), ESZ, ESZ, N, 0,             \
               sve_ld1##SUFF##_be_host, sve_ld1##SUFF##_be_tlb);         \
 }                                                                       \
 void HELPER(sve_ld##N##SUFF##_le_r_mte)(CPUARMState *env, void *vg,     \
-                                        target_ulong addr, uint32_t desc) \
+                                        target_ulong addr, uint64_t desc) \
 {                                                                       \
     sve_ldN_r_mte(env, vg, addr, desc, GETPC(), ESZ, ESZ, N,            \
                   sve_ld1##SUFF##_le_host, sve_ld1##SUFF##_le_tlb);     \
 }                                                                       \
 void HELPER(sve_ld##N##SUFF##_be_r_mte)(CPUARMState *env, void *vg,     \
-                                        target_ulong addr, uint32_t desc) \
+                                        target_ulong addr, uint64_t desc) \
 {                                                                       \
     sve_ldN_r_mte(env, vg, addr, desc, GETPC(), ESZ, ESZ, N,            \
                   sve_ld1##SUFF##_be_host, sve_ld1##SUFF##_be_tlb);     \
@@ -6750,25 +6750,25 @@ void sve_ldnfff1_r_mte(CPUARMState *env, void *vg, target_ulong addr,
 
 #define DO_LDFF1_LDNF1_1(PART, ESZ)                                     \
 void HELPER(sve_ldff1##PART##_r)(CPUARMState *env, void *vg,            \
-                                 target_ulong addr, uint32_t desc)      \
+                                 target_ulong addr, uint64_t desc)      \
 {                                                                       \
     sve_ldnfff1_r(env, vg, addr, desc, GETPC(), 0, ESZ, MO_8, FAULT_FIRST, \
                   sve_ld1##PART##_host, sve_ld1##PART##_tlb);           \
 }                                                                       \
 void HELPER(sve_ldnf1##PART##_r)(CPUARMState *env, void *vg,            \
-                                 target_ulong addr, uint32_t desc)      \
+                                 target_ulong addr, uint64_t desc)      \
 {                                                                       \
     sve_ldnfff1_r(env, vg, addr, desc, GETPC(), 0, ESZ, MO_8, FAULT_NO, \
                   sve_ld1##PART##_host, sve_ld1##PART##_tlb);           \
 }                                                                       \
 void HELPER(sve_ldff1##PART##_r_mte)(CPUARMState *env, void *vg,        \
-                                     target_ulong addr, uint32_t desc)  \
+                                     target_ulong addr, uint64_t desc)  \
 {                                                                       \
     sve_ldnfff1_r_mte(env, vg, addr, desc, GETPC(), ESZ, MO_8, FAULT_FIRST, \
                       sve_ld1##PART##_host, sve_ld1##PART##_tlb);       \
 }                                                                       \
 void HELPER(sve_ldnf1##PART##_r_mte)(CPUARMState *env, void *vg,        \
-                                     target_ulong addr, uint32_t desc)  \
+                                     target_ulong addr, uint64_t desc)  \
 {                                                                       \
     sve_ldnfff1_r_mte(env, vg, addr, desc, GETPC(), ESZ, MO_8, FAULT_NO, \
                   sve_ld1##PART##_host, sve_ld1##PART##_tlb);           \
@@ -6776,49 +6776,49 @@ void HELPER(sve_ldnf1##PART##_r_mte)(CPUARMState *env, void *vg,        \
 
 #define DO_LDFF1_LDNF1_2(PART, ESZ, MSZ)                                \
 void HELPER(sve_ldff1##PART##_le_r)(CPUARMState *env, void *vg,         \
-                                    target_ulong addr, uint32_t desc)   \
+                                    target_ulong addr, uint64_t desc)   \
 {                                                                       \
     sve_ldnfff1_r(env, vg, addr, desc, GETPC(), 0, ESZ, MSZ, FAULT_FIRST, \
                   sve_ld1##PART##_le_host, sve_ld1##PART##_le_tlb);     \
 }                                                                       \
 void HELPER(sve_ldnf1##PART##_le_r)(CPUARMState *env, void *vg,         \
-                                    target_ulong addr, uint32_t desc)   \
+                                    target_ulong addr, uint64_t desc)   \
 {                                                                       \
     sve_ldnfff1_r(env, vg, addr, desc, GETPC(), 0, ESZ, MSZ, FAULT_NO,  \
                   sve_ld1##PART##_le_host, sve_ld1##PART##_le_tlb);     \
 }                                                                       \
 void HELPER(sve_ldff1##PART##_be_r)(CPUARMState *env, void *vg,         \
-                                    target_ulong addr, uint32_t desc)   \
+                                    target_ulong addr, uint64_t desc)   \
 {                                                                       \
     sve_ldnfff1_r(env, vg, addr, desc, GETPC(), 0, ESZ, MSZ, FAULT_FIRST, \
                   sve_ld1##PART##_be_host, sve_ld1##PART##_be_tlb);     \
 }                                                                       \
 void HELPER(sve_ldnf1##PART##_be_r)(CPUARMState *env, void *vg,         \
-                                    target_ulong addr, uint32_t desc)   \
+                                    target_ulong addr, uint64_t desc)   \
 {                                                                       \
     sve_ldnfff1_r(env, vg, addr, desc, GETPC(), 0, ESZ, MSZ, FAULT_NO,  \
                   sve_ld1##PART##_be_host, sve_ld1##PART##_be_tlb);     \
 }                                                                       \
 void HELPER(sve_ldff1##PART##_le_r_mte)(CPUARMState *env, void *vg,     \
-                                        target_ulong addr, uint32_t desc) \
+                                        target_ulong addr, uint64_t desc) \
 {                                                                       \
     sve_ldnfff1_r_mte(env, vg, addr, desc, GETPC(), ESZ, MSZ, FAULT_FIRST, \
                       sve_ld1##PART##_le_host, sve_ld1##PART##_le_tlb); \
 }                                                                       \
 void HELPER(sve_ldnf1##PART##_le_r_mte)(CPUARMState *env, void *vg,     \
-                                        target_ulong addr, uint32_t desc) \
+                                        target_ulong addr, uint64_t desc) \
 {                                                                       \
     sve_ldnfff1_r_mte(env, vg, addr, desc, GETPC(), ESZ, MSZ, FAULT_NO, \
                       sve_ld1##PART##_le_host, sve_ld1##PART##_le_tlb); \
 }                                                                       \
 void HELPER(sve_ldff1##PART##_be_r_mte)(CPUARMState *env, void *vg,     \
-                                        target_ulong addr, uint32_t desc) \
+                                        target_ulong addr, uint64_t desc) \
 {                                                                       \
     sve_ldnfff1_r_mte(env, vg, addr, desc, GETPC(), ESZ, MSZ, FAULT_FIRST, \
                       sve_ld1##PART##_be_host, sve_ld1##PART##_be_tlb); \
 }                                                                       \
 void HELPER(sve_ldnf1##PART##_be_r_mte)(CPUARMState *env, void *vg,     \
-                                        target_ulong addr, uint32_t desc) \
+                                        target_ulong addr, uint64_t desc) \
 {                                                                       \
     sve_ldnfff1_r_mte(env, vg, addr, desc, GETPC(), ESZ, MSZ, FAULT_NO, \
                       sve_ld1##PART##_be_host, sve_ld1##PART##_be_tlb); \
@@ -7007,13 +7007,13 @@ void sve_stN_r_mte(CPUARMState *env, uint64_t *vg, target_ulong addr,
 
 #define DO_STN_1(N, NAME, ESZ)                                          \
 void HELPER(sve_st##N##NAME##_r)(CPUARMState *env, void *vg,            \
-                                 target_ulong addr, uint32_t desc)      \
+                                 target_ulong addr, uint64_t desc)      \
 {                                                                       \
     sve_stN_r(env, vg, addr, desc, GETPC(), ESZ, MO_8, N, 0,            \
               sve_st1##NAME##_host, sve_st1##NAME##_tlb);               \
 }                                                                       \
 void HELPER(sve_st##N##NAME##_r_mte)(CPUARMState *env, void *vg,        \
-                                     target_ulong addr, uint32_t desc)  \
+                                     target_ulong addr, uint64_t desc)  \
 {                                                                       \
     sve_stN_r_mte(env, vg, addr, desc, GETPC(), ESZ, MO_8, N,           \
                   sve_st1##NAME##_host, sve_st1##NAME##_tlb);           \
@@ -7021,25 +7021,25 @@ void HELPER(sve_st##N##NAME##_r_mte)(CPUARMState *env, void *vg,        \
 
 #define DO_STN_2(N, NAME, ESZ, MSZ)                                     \
 void HELPER(sve_st##N##NAME##_le_r)(CPUARMState *env, void *vg,         \
-                                    target_ulong addr, uint32_t desc)   \
+                                    target_ulong addr, uint64_t desc)   \
 {                                                                       \
     sve_stN_r(env, vg, addr, desc, GETPC(), ESZ, MSZ, N, 0,             \
               sve_st1##NAME##_le_host, sve_st1##NAME##_le_tlb);         \
 }                                                                       \
 void HELPER(sve_st##N##NAME##_be_r)(CPUARMState *env, void *vg,         \
-                                    target_ulong addr, uint32_t desc)   \
+                                    target_ulong addr, uint64_t desc)   \
 {                                                                       \
     sve_stN_r(env, vg, addr, desc, GETPC(), ESZ, MSZ, N, 0,             \
               sve_st1##NAME##_be_host, sve_st1##NAME##_be_tlb);         \
 }                                                                       \
 void HELPER(sve_st##N##NAME##_le_r_mte)(CPUARMState *env, void *vg,     \
-                                        target_ulong addr, uint32_t desc) \
+                                        target_ulong addr, uint64_t desc) \
 {                                                                       \
     sve_stN_r_mte(env, vg, addr, desc, GETPC(), ESZ, MSZ, N,            \
                   sve_st1##NAME##_le_host, sve_st1##NAME##_le_tlb);     \
 }                                                                       \
 void HELPER(sve_st##N##NAME##_be_r_mte)(CPUARMState *env, void *vg,     \
-                                        target_ulong addr, uint32_t desc) \
+                                        target_ulong addr, uint64_t desc) \
 {                                                                       \
     sve_stN_r_mte(env, vg, addr, desc, GETPC(), ESZ, MSZ, N,            \
                   sve_st1##NAME##_be_host, sve_st1##NAME##_be_tlb);     \
@@ -7204,13 +7204,13 @@ void sve_ld1_z_mte(CPUARMState *env, void *vd, uint64_t *vg, void *vm,
 
 #define DO_LD1_ZPZ_S(MEM, OFS, MSZ) \
 void HELPER(sve_ld##MEM##_##OFS)(CPUARMState *env, void *vd, void *vg,       \
-                                 void *vm, target_ulong base, uint32_t desc) \
+                                 void *vm, target_ulong base, uint64_t desc) \
 {                                                                            \
     sve_ld1_z(env, vd, vg, vm, base, desc, GETPC(), 0, 4, 1 << MSZ,          \
               off_##OFS##_s, sve_ld1##MEM##_host, sve_ld1##MEM##_tlb);       \
 }                                                                            \
 void HELPER(sve_ld##MEM##_##OFS##_mte)(CPUARMState *env, void *vd, void *vg, \
-     void *vm, target_ulong base, uint32_t desc)                             \
+     void *vm, target_ulong base, uint64_t desc)                             \
 {                                                                            \
     sve_ld1_z_mte(env, vd, vg, vm, base, desc, GETPC(), 4, 1 << MSZ,         \
                   off_##OFS##_s, sve_ld1##MEM##_host, sve_ld1##MEM##_tlb);   \
@@ -7218,13 +7218,13 @@ void HELPER(sve_ld##MEM##_##OFS##_mte)(CPUARMState *env, void *vd, void *vg, \
 
 #define DO_LD1_ZPZ_D(MEM, OFS, MSZ) \
 void HELPER(sve_ld##MEM##_##OFS)(CPUARMState *env, void *vd, void *vg,       \
-                                 void *vm, target_ulong base, uint32_t desc) \
+                                 void *vm, target_ulong base, uint64_t desc) \
 {                                                                            \
     sve_ld1_z(env, vd, vg, vm, base, desc, GETPC(), 0, 8, 1 << MSZ,          \
               off_##OFS##_d, sve_ld1##MEM##_host, sve_ld1##MEM##_tlb);       \
 }                                                                            \
 void HELPER(sve_ld##MEM##_##OFS##_mte)(CPUARMState *env, void *vd, void *vg, \
-    void *vm, target_ulong base, uint32_t desc)                              \
+    void *vm, target_ulong base, uint64_t desc)                              \
 {                                                                            \
     sve_ld1_z_mte(env, vd, vg, vm, base, desc, GETPC(), 8, 1 << MSZ,         \
                   off_##OFS##_d, sve_ld1##MEM##_host, sve_ld1##MEM##_tlb);   \
@@ -7418,14 +7418,14 @@ void sve_ldff1_z_mte(CPUARMState *env, void *vd, uint64_t *vg, void *vm,
 #define DO_LDFF1_ZPZ_S(MEM, OFS, MSZ)                                   \
 void HELPER(sve_ldff##MEM##_##OFS)                                      \
     (CPUARMState *env, void *vd, void *vg,                              \
-     void *vm, target_ulong base, uint32_t desc)                        \
+     void *vm, target_ulong base, uint64_t desc)                        \
 {                                                                       \
     sve_ldff1_z(env, vd, vg, vm, base, desc, GETPC(), 0, MO_32, MSZ,    \
                 off_##OFS##_s, sve_ld1##MEM##_host, sve_ld1##MEM##_tlb); \
 }                                                                       \
 void HELPER(sve_ldff##MEM##_##OFS##_mte)                                \
     (CPUARMState *env, void *vd, void *vg,                              \
-     void *vm, target_ulong base, uint32_t desc)                        \
+     void *vm, target_ulong base, uint64_t desc)                        \
 {                                                                       \
     sve_ldff1_z_mte(env, vd, vg, vm, base, desc, GETPC(), MO_32, MSZ,   \
                     off_##OFS##_s, sve_ld1##MEM##_host, sve_ld1##MEM##_tlb); \
@@ -7434,14 +7434,14 @@ void HELPER(sve_ldff##MEM##_##OFS##_mte)                                \
 #define DO_LDFF1_ZPZ_D(MEM, OFS, MSZ)                                   \
 void HELPER(sve_ldff##MEM##_##OFS)                                      \
     (CPUARMState *env, void *vd, void *vg,                              \
-     void *vm, target_ulong base, uint32_t desc)                        \
+     void *vm, target_ulong base, uint64_t desc)                        \
 {                                                                       \
     sve_ldff1_z(env, vd, vg, vm, base, desc, GETPC(), 0, MO_64, MSZ,    \
                 off_##OFS##_d, sve_ld1##MEM##_host, sve_ld1##MEM##_tlb); \
 }                                                                       \
 void HELPER(sve_ldff##MEM##_##OFS##_mte)                                \
     (CPUARMState *env, void *vd, void *vg,                              \
-     void *vm, target_ulong base, uint32_t desc)                        \
+     void *vm, target_ulong base, uint64_t desc)                        \
 {                                                                       \
     sve_ldff1_z_mte(env, vd, vg, vm, base, desc, GETPC(), MO_64, MSZ,   \
                     off_##OFS##_d, sve_ld1##MEM##_host, sve_ld1##MEM##_tlb); \
@@ -7621,13 +7621,13 @@ void sve_st1_z_mte(CPUARMState *env, void *vd, uint64_t *vg, void *vm,
 
 #define DO_ST1_ZPZ_S(MEM, OFS, MSZ)                                     \
 void HELPER(sve_st##MEM##_##OFS)(CPUARMState *env, void *vd, void *vg,  \
-                                 void *vm, target_ulong base, uint32_t desc) \
+                                 void *vm, target_ulong base, uint64_t desc) \
 {                                                                       \
     sve_st1_z(env, vd, vg, vm, base, desc, GETPC(), 0, 4, 1 << MSZ,     \
               off_##OFS##_s, sve_st1##MEM##_host, sve_st1##MEM##_tlb);  \
 }                                                                       \
 void HELPER(sve_st##MEM##_##OFS##_mte)(CPUARMState *env, void *vd, void *vg, \
-    void *vm, target_ulong base, uint32_t desc)                         \
+    void *vm, target_ulong base, uint64_t desc)                         \
 {                                                                       \
     sve_st1_z_mte(env, vd, vg, vm, base, desc, GETPC(), 4, 1 << MSZ,    \
                   off_##OFS##_s, sve_st1##MEM##_host, sve_st1##MEM##_tlb); \
@@ -7635,13 +7635,13 @@ void HELPER(sve_st##MEM##_##OFS##_mte)(CPUARMState *env, void *vd, void *vg, \
 
 #define DO_ST1_ZPZ_D(MEM, OFS, MSZ)                                     \
 void HELPER(sve_st##MEM##_##OFS)(CPUARMState *env, void *vd, void *vg,  \
-                                 void *vm, target_ulong base, uint32_t desc) \
+                                 void *vm, target_ulong base, uint64_t desc) \
 {                                                                       \
     sve_st1_z(env, vd, vg, vm, base, desc, GETPC(), 0, 8, 1 << MSZ,     \
               off_##OFS##_d, sve_st1##MEM##_host, sve_st1##MEM##_tlb);  \
 }                                                                       \
 void HELPER(sve_st##MEM##_##OFS##_mte)(CPUARMState *env, void *vd, void *vg, \
-    void *vm, target_ulong base, uint32_t desc)                         \
+    void *vm, target_ulong base, uint64_t desc)                         \
 {                                                                       \
     sve_st1_z_mte(env, vd, vg, vm, base, desc, GETPC(), 8, 1 << MSZ,    \
                   off_##OFS##_d, sve_st1##MEM##_host, sve_st1##MEM##_tlb); \
@@ -7995,7 +7995,7 @@ void sve2p1_ld1_c(CPUARMState *env, ARMVectorReg *zd, const vaddr addr,
 }
 
 void HELPER(sve2p1_ld1bb_c)(CPUARMState *env, void *vd, target_ulong addr,
-                            uint32_t png, uint32_t desc)
+                            uint32_t png, uint64_t desc)
 {
     sve2p1_ld1_c(env, vd, addr, png, desc, GETPC(), MO_8,
                  sve_ld1bb_host, sve_ld1bb_tlb);
@@ -8004,14 +8004,14 @@ void HELPER(sve2p1_ld1bb_c)(CPUARMState *env, void *vd, target_ulong addr,
 #define DO_LD1_2(NAME, ESZ)                                             \
 void HELPER(sve2p1_##NAME##_le_c)(CPUARMState *env, void *vd,           \
                                   target_ulong addr, uint32_t png,      \
-                                  uint32_t desc)                        \
+                                  uint64_t desc)                        \
 {                                                                       \
     sve2p1_ld1_c(env, vd, addr, png, desc, GETPC(), ESZ,                \
                  sve_##NAME##_le_host, sve_##NAME##_le_tlb);            \
 }                                                                       \
 void HELPER(sve2p1_##NAME##_be_c)(CPUARMState *env, void *vd,           \
                                   target_ulong addr, uint32_t png,      \
-                                  uint32_t desc)                        \
+                                  uint64_t desc)                        \
 {                                                                       \
     sve2p1_ld1_c(env, vd, addr, png, desc, GETPC(), ESZ,                \
                  sve_##NAME##_be_host, sve_##NAME##_be_tlb);            \
@@ -8154,7 +8154,7 @@ void sve2p1_st1_c(CPUARMState *env, ARMVectorReg *zd, const vaddr addr,
 }
 
 void HELPER(sve2p1_st1bb_c)(CPUARMState *env, void *vd, target_ulong addr,
-                           uint32_t png, uint32_t desc)
+                           uint32_t png, uint64_t desc)
 {
     sve2p1_st1_c(env, vd, addr, png, desc, GETPC(), MO_8,
                  sve_st1bb_host, sve_st1bb_tlb);
@@ -8163,14 +8163,14 @@ void HELPER(sve2p1_st1bb_c)(CPUARMState *env, void *vd, target_ulong addr,
 #define DO_ST1_2(NAME, ESZ)                                             \
 void HELPER(sve2p1_##NAME##_le_c)(CPUARMState *env, void *vd,           \
                                   target_ulong addr, uint32_t png,      \
-                                  uint32_t desc)                        \
+                                  uint64_t desc)                        \
 {                                                                       \
     sve2p1_st1_c(env, vd, addr, png, desc, GETPC(), ESZ,                \
                  sve_##NAME##_le_host, sve_##NAME##_le_tlb);            \
 }                                                                       \
 void HELPER(sve2p1_##NAME##_be_c)(CPUARMState *env, void *vd,           \
                                   target_ulong addr, uint32_t png,      \
-                                  uint32_t desc)                        \
+                                  uint64_t desc)                        \
 {                                                                       \
     sve2p1_st1_c(env, vd, addr, png, desc, GETPC(), ESZ,                \
                  sve_##NAME##_be_host, sve_##NAME##_be_tlb);            \
diff --git a/target/arm/tcg/translate-a64.h b/target/arm/tcg/translate-a64.h
index 993dde61a4..9c45f89305 100644
--- a/target/arm/tcg/translate-a64.h
+++ b/target/arm/tcg/translate-a64.h
@@ -28,7 +28,7 @@ bool logic_imm_decode_wmask(uint64_t *result, unsigned int immn,
 bool sve_access_check(DisasContext *s);
 bool sme_enabled_check(DisasContext *s);
 bool sme_enabled_check_with_svcr(DisasContext *s, unsigned);
-uint32_t make_svemte_desc(DisasContext *s, unsigned vsz, uint32_t nregs,
+uint64_t make_svemte_desc(DisasContext *s, unsigned vsz, uint32_t nregs,
                           uint32_t msz, bool is_write, uint32_t data);
 
 /* This function corresponds to CheckStreamingSVEEnabled. */
diff --git a/target/arm/tcg/translate-sme.c b/target/arm/tcg/translate-sme.c
index 65fc8bc9b2..091c56da4f 100644
--- a/target/arm/tcg/translate-sme.c
+++ b/target/arm/tcg/translate-sme.c
@@ -387,7 +387,7 @@ TRANS_FEAT(MOVT_ztr, aa64_sme2, do_movt, a, tcg_gen_st_i64)
 
 static bool trans_LDST1(DisasContext *s, arg_LDST1 *a)
 {
-    typedef void GenLdSt1(TCGv_env, TCGv_ptr, TCGv_ptr, TCGv, TCGv_i32);
+    typedef void GenLdSt1(TCGv_env, TCGv_ptr, TCGv_ptr, TCGv, TCGv_i64);
 
     /*
      * Indexed by [esz][be][v][mte][st], which is (except for load/store)
@@ -415,7 +415,7 @@ static bool trans_LDST1(DisasContext *s, arg_LDST1 *a)
 
     TCGv_ptr t_za, t_pg;
     TCGv_i64 addr;
-    uint32_t desc;
+    uint64_t desc;
     bool be = s->be_data == MO_BE;
     bool mte = s->mte_active[0];
 
@@ -440,7 +440,7 @@ static bool trans_LDST1(DisasContext *s, arg_LDST1 *a)
     desc = make_svemte_desc(s, streaming_vec_reg_size(s), 1, a->esz, a->st, 0);
 
     fns[a->esz][be][a->v][mte][a->st](tcg_env, t_za, t_pg, addr,
-                                      tcg_constant_i32(desc));
+                                      tcg_constant_i64(desc));
     return true;
 }
 
diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
index 2ed440aff1..849151826e 100644
--- a/target/arm/tcg/translate-sve.c
+++ b/target/arm/tcg/translate-sve.c
@@ -31,9 +31,9 @@ typedef void gen_helper_gvec_flags_3(TCGv_i32, TCGv_ptr, TCGv_ptr,
 typedef void gen_helper_gvec_flags_4(TCGv_i32, TCGv_ptr, TCGv_ptr,
                                      TCGv_ptr, TCGv_ptr, TCGv_i32);
 
-typedef void gen_helper_gvec_mem(TCGv_env, TCGv_ptr, TCGv_i64, TCGv_i32);
+typedef void gen_helper_gvec_mem(TCGv_env, TCGv_ptr, TCGv_i64, TCGv_i64);
 typedef void gen_helper_gvec_mem_scatter(TCGv_env, TCGv_ptr, TCGv_ptr,
-                                         TCGv_ptr, TCGv_i64, TCGv_i32);
+                                         TCGv_ptr, TCGv_i64, TCGv_i64);
 
 /*
  * Helpers for extracting complex instruction fields.
@@ -4883,11 +4883,11 @@ static const uint8_t dtype_esz[19] = {
     4, 4, 4,
 };
 
-uint32_t make_svemte_desc(DisasContext *s, unsigned vsz, uint32_t nregs,
+uint64_t make_svemte_desc(DisasContext *s, unsigned vsz, uint32_t nregs,
                           uint32_t msz, bool is_write, uint32_t data)
 {
     uint32_t sizem1;
-    uint32_t desc = 0;
+    uint64_t desc = 0;
 
     /* Assert all of the data fits, with or without MTE enabled. */
     assert(nregs >= 1 && nregs <= 4);
@@ -4911,7 +4911,7 @@ static void do_mem_zpa(DisasContext *s, int zt, int pg, TCGv_i64 addr,
                        gen_helper_gvec_mem *fn)
 {
     TCGv_ptr t_pg;
-    uint32_t desc;
+    uint64_t desc;
 
     if (!s->mte_active[0]) {
         addr = clean_data_tbi(s, addr);
@@ -4927,7 +4927,7 @@ static void do_mem_zpa(DisasContext *s, int zt, int pg, TCGv_i64 addr,
     t_pg = tcg_temp_new_ptr();
 
     tcg_gen_addi_ptr(t_pg, tcg_env, pred_full_reg_offset(s, pg));
-    fn(tcg_env, t_pg, addr, tcg_constant_i32(desc));
+    fn(tcg_env, t_pg, addr, tcg_constant_i64(desc));
 }
 
 /* Indexed by [mte][be][dtype][nreg] */
@@ -5379,7 +5379,7 @@ static void do_ldrq(DisasContext *s, int zt, int pg, TCGv_i64 addr, int dtype)
     unsigned vsz = vec_full_reg_size(s);
     TCGv_ptr t_pg;
     int poff;
-    uint32_t desc;
+    uint64_t desc;
 
     /* Load the first quadword using the normal predicated load helpers.  */
     if (!s->mte_active[0]) {
@@ -5410,7 +5410,7 @@ static void do_ldrq(DisasContext *s, int zt, int pg, TCGv_i64 addr, int dtype)
     gen_helper_gvec_mem *fn
         = ldr_fns[s->mte_active[0]][s->be_data == MO_BE][dtype][0];
     desc = make_svemte_desc(s, 16, 1, dtype_msz(dtype), false, zt);
-    fn(tcg_env, t_pg, addr, tcg_constant_i32(desc));
+    fn(tcg_env, t_pg, addr, tcg_constant_i64(desc));
 
     /* Replicate that first quadword.  */
     if (vsz > 16) {
@@ -5453,7 +5453,7 @@ static void do_ldro(DisasContext *s, int zt, int pg, TCGv_i64 addr, int dtype)
     unsigned vsz_r32;
     TCGv_ptr t_pg;
     int poff, doff;
-    uint32_t desc;
+    uint64_t desc;
 
     if (vsz < 32) {
         /*
@@ -5494,7 +5494,7 @@ static void do_ldro(DisasContext *s, int zt, int pg, TCGv_i64 addr, int dtype)
     gen_helper_gvec_mem *fn
         = ldr_fns[s->mte_active[0]][s->be_data == MO_BE][dtype][0];
     desc = make_svemte_desc(s, 32, 1, dtype_msz(dtype), false, zt);
-    fn(tcg_env, t_pg, addr, tcg_constant_i32(desc));
+    fn(tcg_env, t_pg, addr, tcg_constant_i64(desc));
 
     /*
      * Replicate that first octaword.
@@ -5828,14 +5828,14 @@ static void do_mem_zpz(DisasContext *s, int zt, int pg, int zm,
     TCGv_ptr t_zm = tcg_temp_new_ptr();
     TCGv_ptr t_pg = tcg_temp_new_ptr();
     TCGv_ptr t_zt = tcg_temp_new_ptr();
-    uint32_t desc;
+    uint64_t desc;
 
     tcg_gen_addi_ptr(t_pg, tcg_env, pred_full_reg_offset(s, pg));
     tcg_gen_addi_ptr(t_zm, tcg_env, vec_full_reg_offset(s, zm));
     tcg_gen_addi_ptr(t_zt, tcg_env, vec_full_reg_offset(s, zt));
 
     desc = make_svemte_desc(s, vec_full_reg_size(s), 1, msz, is_write, scale);
-    fn(tcg_env, t_zt, t_pg, t_zm, scalar, tcg_constant_i32(desc));
+    fn(tcg_env, t_zt, t_pg, t_zm, scalar, tcg_constant_i64(desc));
 }
 
 /* Indexed by [mte][be][ff][xs][u][msz].  */
@@ -8079,7 +8079,7 @@ static bool gen_ldst_c(DisasContext *s, TCGv_i64 addr, int zd, int png,
                        MemOp esz, bool is_write, int n, bool strided)
 {
     typedef void ldst_c_fn(TCGv_env, TCGv_ptr, TCGv_i64,
-                           TCGv_i32, TCGv_i32);
+                           TCGv_i32, TCGv_i64);
     static ldst_c_fn * const f_ldst[2][2][4] = {
         { { gen_helper_sve2p1_ld1bb_c,
             gen_helper_sve2p1_ld1hh_le_c,
@@ -8100,9 +8100,10 @@ static bool gen_ldst_c(DisasContext *s, TCGv_i64 addr, int zd, int png,
             gen_helper_sve2p1_st1dd_be_c, } }
     };
 
-    TCGv_i32 t_png, t_desc;
+    TCGv_i32 t_png;
+    TCGv_i64 t_desc;
     TCGv_ptr t_zd;
-    uint32_t desc, lg2_rstride = 0;
+    uint64_t desc, lg2_rstride = 0;
     bool be = s->be_data == MO_BE;
 
     assert(n == 2 || n == 4);
@@ -8132,7 +8133,7 @@ static bool gen_ldst_c(DisasContext *s, TCGv_i64 addr, int zd, int png,
     desc = n == 2 ? 0 : 1;
     desc = desc | (lg2_rstride << 1);
     desc = make_svemte_desc(s, vec_full_reg_size(s), 1, esz, is_write, desc);
-    t_desc = tcg_constant_i32(desc);
+    t_desc = tcg_constant_i64(desc);
 
     t_png = tcg_temp_new_i32();
     tcg_gen_ld16u_i32(t_png, tcg_env,

From aba39946baaf5ca73aae0b79e2cd0790ddafe291 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 23 Jul 2025 17:54:54 +0100
Subject: [PATCH 2619/2760] target/arm: Pack mtedesc into upper 32 bits of
 descriptor

Instead of trying to pack mtedesc into the upper 17 bits of a 32-bit
gvec descriptor, pass the gvec descriptor in the lower 32 bits and
the mte descriptor in the upper 32 bits of a 64-bit operand.

This fixes two bugs:
 (1) in gen_sve_ldr() and gen_sve_str() call gen_mte_checkN() with a
 length value which is the SVE vector length and can be up to 256
 bytes. We don't assert there that it fits in the descriptor, so
 we would just fail to do the MTE checks on the right length of memory
 if the VL is more than 32 bytes

 (2) the new-in-SVE2p1 insns LD3Q, LD4Q, ST3Q, ST4Q also involve
 transfers of more than 32 bytes of memory. In this case we would
 assert at translate time.

(Note for potential backporting: this commit depends on the previous
"target/arm: Expand the descriptor for SME/SVE memory ops to i64".)

Fixes: 7b1613a1020d2942 ("target/arm: Enable FEAT_SME2p1 on -cpu max")
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20250723165458.3509150-3-peter.maydell@linaro.org
[PMM: expand commit message to clarify that we are fixing bugs here]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/internals.h         |  8 +-----
 target/arm/tcg/sme_helper.c    | 14 +++-------
 target/arm/tcg/sve_helper.c    | 49 +++++++++++++---------------------
 target/arm/tcg/translate-sve.c |  5 ++--
 4 files changed, 25 insertions(+), 51 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index c4765e4489..1b3d0244fd 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -1623,19 +1623,13 @@ FIELD(PREDDESC, OPRSZ, 0, 6)
 FIELD(PREDDESC, ESZ, 6, 2)
 FIELD(PREDDESC, DATA, 8, 24)
 
-/*
- * The SVE simd_data field, for memory ops, contains either
- * rd (5 bits) or a shift count (2 bits).
- */
-#define SVE_MTEDESC_SHIFT 5
-
 /* Bits within a descriptor passed to the helper_mte_check* functions. */
 FIELD(MTEDESC, MIDX,  0, 4)
 FIELD(MTEDESC, TBI,   4, 2)
 FIELD(MTEDESC, TCMA,  6, 2)
 FIELD(MTEDESC, WRITE, 8, 1)
 FIELD(MTEDESC, ALIGN, 9, 3)
-FIELD(MTEDESC, SIZEM1, 12, SIMD_DATA_BITS - SVE_MTEDESC_SHIFT - 12)  /* size - 1 */
+FIELD(MTEDESC, SIZEM1, 12, 32 - 12)  /* size - 1 */
 
 bool mte_probe(CPUARMState *env, uint32_t desc, uint64_t ptr);
 uint64_t mte_check(CPUARMState *env, uint32_t desc, uint64_t ptr, uintptr_t ra);
diff --git a/target/arm/tcg/sme_helper.c b/target/arm/tcg/sme_helper.c
index 0b55f13f8c..075360d8b8 100644
--- a/target/arm/tcg/sme_helper.c
+++ b/target/arm/tcg/sme_helper.c
@@ -666,19 +666,16 @@ void sme_ld1(CPUARMState *env, void *za, uint64_t *vg,
 
 static inline QEMU_ALWAYS_INLINE
 void sme_ld1_mte(CPUARMState *env, void *za, uint64_t *vg,
-                 target_ulong addr, uint32_t desc, uintptr_t ra,
+                 target_ulong addr, uint64_t desc, uintptr_t ra,
                  const int esz, bool vertical,
                  sve_ldst1_host_fn *host_fn,
                  sve_ldst1_tlb_fn *tlb_fn,
                  ClearFn *clr_fn,
                  CopyFn *cpy_fn)
 {
-    uint32_t mtedesc = desc >> (SIMD_DATA_SHIFT + SVE_MTEDESC_SHIFT);
+    uint32_t mtedesc = desc >> 32;
     int bit55 = extract64(addr, 55, 1);
 
-    /* Remove mtedesc from the normal sve descriptor. */
-    desc = extract32(desc, 0, SIMD_DATA_SHIFT + SVE_MTEDESC_SHIFT);
-
     /* Perform gross MTE suppression early. */
     if (!tbi_check(mtedesc, bit55) ||
         tcma_check(mtedesc, bit55, allocation_tag_from_addr(addr))) {
@@ -854,16 +851,13 @@ void sme_st1(CPUARMState *env, void *za, uint64_t *vg,
 
 static inline QEMU_ALWAYS_INLINE
 void sme_st1_mte(CPUARMState *env, void *za, uint64_t *vg, target_ulong addr,
-                 uint32_t desc, uintptr_t ra, int esz, bool vertical,
+                 uint64_t desc, uintptr_t ra, int esz, bool vertical,
                  sve_ldst1_host_fn *host_fn,
                  sve_ldst1_tlb_fn *tlb_fn)
 {
-    uint32_t mtedesc = desc >> (SIMD_DATA_SHIFT + SVE_MTEDESC_SHIFT);
+    uint32_t mtedesc = desc >> 32;
     int bit55 = extract64(addr, 55, 1);
 
-    /* Remove mtedesc from the normal sve descriptor. */
-    desc = extract32(desc, 0, SIMD_DATA_SHIFT + SVE_MTEDESC_SHIFT);
-
     /* Perform gross MTE suppression early. */
     if (!tbi_check(mtedesc, bit55) ||
         tcma_check(mtedesc, bit55, allocation_tag_from_addr(addr))) {
diff --git a/target/arm/tcg/sve_helper.c b/target/arm/tcg/sve_helper.c
index 9fc2c05879..d0fb4138d2 100644
--- a/target/arm/tcg/sve_helper.c
+++ b/target/arm/tcg/sve_helper.c
@@ -6362,17 +6362,14 @@ void sve_ldN_r(CPUARMState *env, uint64_t *vg, const target_ulong addr,
 
 static inline QEMU_ALWAYS_INLINE
 void sve_ldN_r_mte(CPUARMState *env, uint64_t *vg, target_ulong addr,
-                   uint32_t desc, const uintptr_t ra,
+                   uint64_t desc, const uintptr_t ra,
                    const int esz, const int msz, const int N,
                    sve_ldst1_host_fn *host_fn,
                    sve_ldst1_tlb_fn *tlb_fn)
 {
-    uint32_t mtedesc = desc >> (SIMD_DATA_SHIFT + SVE_MTEDESC_SHIFT);
+    uint32_t mtedesc = desc >> 32;
     int bit55 = extract64(addr, 55, 1);
 
-    /* Remove mtedesc from the normal sve descriptor. */
-    desc = extract32(desc, 0, SIMD_DATA_SHIFT + SVE_MTEDESC_SHIFT);
-
     /* Perform gross MTE suppression early. */
     if (!tbi_check(mtedesc, bit55) ||
         tcma_check(mtedesc, bit55, allocation_tag_from_addr(addr))) {
@@ -6727,17 +6724,14 @@ void sve_ldnfff1_r(CPUARMState *env, void *vg, const target_ulong addr,
 
 static inline QEMU_ALWAYS_INLINE
 void sve_ldnfff1_r_mte(CPUARMState *env, void *vg, target_ulong addr,
-                       uint32_t desc, const uintptr_t retaddr,
+                       uint64_t desc, const uintptr_t retaddr,
                        const int esz, const int msz, const SVEContFault fault,
                        sve_ldst1_host_fn *host_fn,
                        sve_ldst1_tlb_fn *tlb_fn)
 {
-    uint32_t mtedesc = desc >> (SIMD_DATA_SHIFT + SVE_MTEDESC_SHIFT);
+    uint32_t mtedesc = desc >> 32;
     int bit55 = extract64(addr, 55, 1);
 
-    /* Remove mtedesc from the normal sve descriptor. */
-    desc = extract32(desc, 0, SIMD_DATA_SHIFT + SVE_MTEDESC_SHIFT);
-
     /* Perform gross MTE suppression early. */
     if (!tbi_check(mtedesc, bit55) ||
         tcma_check(mtedesc, bit55, allocation_tag_from_addr(addr))) {
@@ -6985,17 +6979,14 @@ void sve_stN_r(CPUARMState *env, uint64_t *vg, target_ulong addr,
 
 static inline QEMU_ALWAYS_INLINE
 void sve_stN_r_mte(CPUARMState *env, uint64_t *vg, target_ulong addr,
-                   uint32_t desc, const uintptr_t ra,
+                   uint64_t desc, const uintptr_t ra,
                    const int esz, const int msz, const int N,
                    sve_ldst1_host_fn *host_fn,
                    sve_ldst1_tlb_fn *tlb_fn)
 {
-    uint32_t mtedesc = desc >> (SIMD_DATA_SHIFT + SVE_MTEDESC_SHIFT);
+    uint32_t mtedesc = desc >> 32;
     int bit55 = extract64(addr, 55, 1);
 
-    /* Remove mtedesc from the normal sve descriptor. */
-    desc = extract32(desc, 0, SIMD_DATA_SHIFT + SVE_MTEDESC_SHIFT);
-
     /* Perform gross MTE suppression early. */
     if (!tbi_check(mtedesc, bit55) ||
         tcma_check(mtedesc, bit55, allocation_tag_from_addr(addr))) {
@@ -7183,14 +7174,12 @@ void sve_ld1_z(CPUARMState *env, void *vd, uint64_t *vg, void *vm,
 
 static inline QEMU_ALWAYS_INLINE
 void sve_ld1_z_mte(CPUARMState *env, void *vd, uint64_t *vg, void *vm,
-                   target_ulong base, uint32_t desc, uintptr_t retaddr,
+                   target_ulong base, uint64_t desc, uintptr_t retaddr,
                    int esize, int msize, zreg_off_fn *off_fn,
                    sve_ldst1_host_fn *host_fn,
                    sve_ldst1_tlb_fn *tlb_fn)
 {
-    uint32_t mtedesc = desc >> (SIMD_DATA_SHIFT + SVE_MTEDESC_SHIFT);
-    /* Remove mtedesc from the normal sve descriptor. */
-    desc = extract32(desc, 0, SIMD_DATA_SHIFT + SVE_MTEDESC_SHIFT);
+    uint32_t mtedesc = desc >> 32;
 
     /*
      * ??? TODO: For the 32-bit offset extractions, base + ofs cannot
@@ -7395,15 +7384,13 @@ void sve_ldff1_z(CPUARMState *env, void *vd, uint64_t *vg, void *vm,
 
 static inline QEMU_ALWAYS_INLINE
 void sve_ldff1_z_mte(CPUARMState *env, void *vd, uint64_t *vg, void *vm,
-                     target_ulong base, uint32_t desc, uintptr_t retaddr,
+                     target_ulong base, uint64_t desc, uintptr_t retaddr,
                      const int esz, const int msz,
                      zreg_off_fn *off_fn,
                      sve_ldst1_host_fn *host_fn,
                      sve_ldst1_tlb_fn *tlb_fn)
 {
-    uint32_t mtedesc = desc >> (SIMD_DATA_SHIFT + SVE_MTEDESC_SHIFT);
-    /* Remove mtedesc from the normal sve descriptor. */
-    desc = extract32(desc, 0, SIMD_DATA_SHIFT + SVE_MTEDESC_SHIFT);
+    uint32_t mtedesc = desc >> 32;
 
     /*
      * ??? TODO: For the 32-bit offset extractions, base + ofs cannot
@@ -7600,14 +7587,12 @@ void sve_st1_z(CPUARMState *env, void *vd, uint64_t *vg, void *vm,
 
 static inline QEMU_ALWAYS_INLINE
 void sve_st1_z_mte(CPUARMState *env, void *vd, uint64_t *vg, void *vm,
-                   target_ulong base, uint32_t desc, uintptr_t retaddr,
+                   target_ulong base, uint64_t desc, uintptr_t retaddr,
                    int esize, int msize, zreg_off_fn *off_fn,
                    sve_ldst1_host_fn *host_fn,
                    sve_ldst1_tlb_fn *tlb_fn)
 {
-    uint32_t mtedesc = desc >> (SIMD_DATA_SHIFT + SVE_MTEDESC_SHIFT);
-    /* Remove mtedesc from the normal sve descriptor. */
-    desc = extract32(desc, 0, SIMD_DATA_SHIFT + SVE_MTEDESC_SHIFT);
+    uint32_t mtedesc = desc >> 32;
 
     /*
      * ??? TODO: For the 32-bit offset extractions, base + ofs cannot
@@ -7853,14 +7838,15 @@ static void sve2p1_cont_ldst_mte_check(SVEContLdSt *info, CPUARMState *env,
 
 static inline QEMU_ALWAYS_INLINE
 void sve2p1_ld1_c(CPUARMState *env, ARMVectorReg *zd, const vaddr addr,
-                  uint32_t png, uint32_t desc,
+                  uint32_t png, uint64_t desc64,
                   const uintptr_t ra, const MemOp esz,
                   sve_ldst1_host_fn *host_fn,
                   sve_ldst1_tlb_fn *tlb_fn)
 {
+    uint32_t mtedesc = desc64 >> 32;
+    uint32_t desc = desc64;
     const unsigned N = (desc >> SIMD_DATA_SHIFT) & 1 ? 4 : 2;
     const unsigned rstride = 1 << ((desc >> (SIMD_DATA_SHIFT + 1)) % 4);
-    uint32_t mtedesc = desc >> (SIMD_DATA_SHIFT + SVE_MTEDESC_SHIFT);
     const intptr_t reg_max = simd_oprsz(desc);
     const unsigned esize = 1 << esz;
     intptr_t count_off, count_last;
@@ -8025,14 +8011,15 @@ DO_LD1_2(ld1dd, MO_64)
 
 static inline QEMU_ALWAYS_INLINE
 void sve2p1_st1_c(CPUARMState *env, ARMVectorReg *zd, const vaddr addr,
-                  uint32_t png, uint32_t desc,
+                  uint32_t png, uint64_t desc64,
                   const uintptr_t ra, const int esz,
                   sve_ldst1_host_fn *host_fn,
                   sve_ldst1_tlb_fn *tlb_fn)
 {
+    uint32_t mtedesc = desc64 >> 32;
+    uint32_t desc = desc64;
     const unsigned N = (desc >> SIMD_DATA_SHIFT) & 1 ? 4 : 2;
     const unsigned rstride = 1 << ((desc >> (SIMD_DATA_SHIFT + 1)) % 4);
-    uint32_t mtedesc = desc >> (SIMD_DATA_SHIFT + SVE_MTEDESC_SHIFT);
     const intptr_t reg_max = simd_oprsz(desc);
     const unsigned esize = 1 << esz;
     intptr_t count_off, count_last;
diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
index 849151826e..5cba7b87bd 100644
--- a/target/arm/tcg/translate-sve.c
+++ b/target/arm/tcg/translate-sve.c
@@ -4893,7 +4893,6 @@ uint64_t make_svemte_desc(DisasContext *s, unsigned vsz, uint32_t nregs,
     assert(nregs >= 1 && nregs <= 4);
     sizem1 = (nregs << msz) - 1;
     assert(sizem1 <= R_MTEDESC_SIZEM1_MASK >> R_MTEDESC_SIZEM1_SHIFT);
-    assert(data < 1u << SVE_MTEDESC_SHIFT);
 
     if (s->mte_active[0]) {
         desc = FIELD_DP32(desc, MTEDESC, MIDX, get_mem_index(s));
@@ -4901,9 +4900,9 @@ uint64_t make_svemte_desc(DisasContext *s, unsigned vsz, uint32_t nregs,
         desc = FIELD_DP32(desc, MTEDESC, TCMA, s->tcma);
         desc = FIELD_DP32(desc, MTEDESC, WRITE, is_write);
         desc = FIELD_DP32(desc, MTEDESC, SIZEM1, sizem1);
-        desc <<= SVE_MTEDESC_SHIFT;
+        desc <<= 32;
     }
-    return simd_desc(vsz, vsz, desc | data);
+    return simd_desc(vsz, vsz, data) | desc;
 }
 
 static void do_mem_zpa(DisasContext *s, int zt, int pg, TCGv_i64 addr,

From b79f944e09657f63b6dd6e78ac7966fdc7a3e6d1 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 23 Jul 2025 17:54:55 +0100
Subject: [PATCH 2620/2760] decodetree: Infer argument set before inferring
 format
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Failure to confirm an argument set first may result in
the selection of a format which leaves extra arguments
to be filled in by the pattern.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Tested-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20250723165458.3509150-4-peter.maydell@linaro.org
Message-id: 20250722183343.273533-1-richard.henderson@linaro.org
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Tested-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 scripts/decodetree.py           | 7 ++++---
 tests/decode/meson.build        | 1 +
 tests/decode/succ_infer1.decode | 4 ++++
 3 files changed, 9 insertions(+), 3 deletions(-)
 create mode 100644 tests/decode/succ_infer1.decode

diff --git a/scripts/decodetree.py b/scripts/decodetree.py
index e8b72da3a9..f992472b73 100644
--- a/scripts/decodetree.py
+++ b/scripts/decodetree.py
@@ -1016,9 +1016,12 @@ def infer_format(arg, fieldmask, flds, width):
         else:
             var_flds[n] = c
 
+    if not arg:
+        arg = infer_argument_set(flds)
+
     # Look for an existing format with the same argument set and fields
     for fmt in formats.values():
-        if arg and fmt.base != arg:
+        if fmt.base != arg:
             continue
         if fieldmask != fmt.fieldmask:
             continue
@@ -1029,8 +1032,6 @@ def infer_format(arg, fieldmask, flds, width):
         return (fmt, const_flds)
 
     name = decode_function + '_Fmt_' + str(len(formats))
-    if not arg:
-        arg = infer_argument_set(flds)
 
     fmt = Format(name, 0, arg, 0, 0, 0, fieldmask, var_flds, width)
     formats[name] = fmt
diff --git a/tests/decode/meson.build b/tests/decode/meson.build
index b13fada980..63405ca08f 100644
--- a/tests/decode/meson.build
+++ b/tests/decode/meson.build
@@ -41,6 +41,7 @@ succ_tests = [
     'succ_argset_type1.decode',
     'succ_function.decode',
     'succ_ident1.decode',
+    'succ_infer1.decode',
     'succ_named_field.decode',
     'succ_pattern_group_nest1.decode',
     'succ_pattern_group_nest2.decode',
diff --git a/tests/decode/succ_infer1.decode b/tests/decode/succ_infer1.decode
new file mode 100644
index 0000000000..6fa40bada5
--- /dev/null
+++ b/tests/decode/succ_infer1.decode
@@ -0,0 +1,4 @@
+&rprr_load      rd pg rn rm dtype nreg
+@rprr_load      .... .... ... rm:5 ... pg:3 rn:5 rd:5            &rprr_load
+
+LD1Q            1100 0100 000 rm:5 101 pg:3 rn:5 rd:5

From 1c6aae5efbd28ac35003dea341364cd63a4515a1 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Wed, 23 Jul 2025 17:54:56 +0100
Subject: [PATCH 2621/2760] target/arm: LD1Q, ST1Q are vector + scalar, not
 scalar + vector

Unlike the "LD1D (scalar + vector)" etc instructions, LD1Q is
vector + scalar. This means that:
 * the vector and the scalar register are in opposite fields
   in the encoding
 * 31 in the scalar register field is XZR, not XSP

The same applies for ST1Q.

This means we can't reuse the trans_LD1_zprz() and trans_ST1_zprz()
functions for LD1Q and ST1Q. Split them out to use their own
trans functions.

Note that the change made here to sve.decode requires the decodetree
bugfix "decodetree: Infer argument set before inferring format" to
avoid a spurious compile-time error about "dtype".

Fixes: d2aa9a804ee678f ("target/arm: Implement LD1Q, ST1Q for SVE2p1")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250723165458.3509150-5-peter.maydell@linaro.org
---
 target/arm/tcg/sve.decode      | 12 +++----
 target/arm/tcg/translate-sve.c | 65 ++++++++++++++++++++++++++--------
 2 files changed, 57 insertions(+), 20 deletions(-)

diff --git a/target/arm/tcg/sve.decode b/target/arm/tcg/sve.decode
index aea7f51973..ab63cfaa0f 100644
--- a/target/arm/tcg/sve.decode
+++ b/target/arm/tcg/sve.decode
@@ -1343,9 +1343,9 @@ LD1_zprz        1100010 10 1. ..... 1.. ... ..... ..... \
 LD1_zprz        1100010 11 1. ..... 11. ... ..... ..... \
                 @rprr_g_load_sc esz=3 msz=3 u=1
 
-# LD1Q
-LD1_zprz        1100 0100 000 rm:5 101 pg:3 rn:5 rd:5 \
-                &rprr_gather_load u=1 ff=0 xs=2 esz=4 msz=4 scale=0
+# LD1Q. Note that this is subtly different from LD1_zprz because
+# it is vector + scalar, not scalar + vector.
+LD1Q            1100 0100 000 rm:5 101 pg:3 rn:5 rd:5
 
 # SVE 64-bit gather load (vector plus immediate)
 LD1_zpiz        1100010 .. 01 ..... 1.. ... ..... ..... \
@@ -1450,9 +1450,9 @@ ST1_zprz        1110010 .. 01 ..... 101 ... ..... ..... \
 ST1_zprz        1110010 .. 00 ..... 101 ... ..... ..... \
                 @rprr_scatter_store xs=2 esz=3 scale=0
 
-# ST1Q
-ST1_zprz        1110 0100 001 rm:5 001 pg:3 rn:5 rd:5 \
-                &rprr_scatter_store xs=2 msz=4 esz=4 scale=0
+# ST1Q. Note that this is subtly different from ST1_zprz because
+# it is vector + scalar, not scalar + vector.
+ST1Q            1110 0100 001 rm:5 001 pg:3 rn:5 rd:5
 
 # SVE 64-bit scatter store (vector plus immediate)
 ST1_zpiz        1110010 .. 10 ..... 101 ... ..... ..... \
diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
index 5cba7b87bd..07b827fa8e 100644
--- a/target/arm/tcg/translate-sve.c
+++ b/target/arm/tcg/translate-sve.c
@@ -6179,9 +6179,7 @@ static bool trans_LD1_zprz(DisasContext *s, arg_LD1_zprz *a)
     bool be = s->be_data == MO_BE;
     bool mte = s->mte_active[0];
 
-    if (a->esz < MO_128
-        ? !dc_isar_feature(aa64_sve, s)
-        : !dc_isar_feature(aa64_sve2p1, s)) {
+    if (!dc_isar_feature(aa64_sve, s)) {
         return false;
     }
     s->is_nonstreaming = true;
@@ -6196,10 +6194,6 @@ static bool trans_LD1_zprz(DisasContext *s, arg_LD1_zprz *a)
     case MO_64:
         fn = gather_load_fn64[mte][be][a->ff][a->xs][a->u][a->msz];
         break;
-    case MO_128:
-        assert(!a->ff && a->u && a->xs == 2 && a->msz == MO_128);
-        fn = gather_load_fn128[mte][be];
-        break;
     default:
         g_assert_not_reached();
     }
@@ -6210,6 +6204,32 @@ static bool trans_LD1_zprz(DisasContext *s, arg_LD1_zprz *a)
     return true;
 }
 
+static bool trans_LD1Q(DisasContext *s, arg_LD1Q *a)
+{
+    gen_helper_gvec_mem_scatter *fn = NULL;
+    bool be = s->be_data == MO_BE;
+    bool mte = s->mte_active[0];
+
+    if (!dc_isar_feature(aa64_sve2p1, s)) {
+        return false;
+    }
+    s->is_nonstreaming = true;
+    if (!sve_access_check(s)) {
+        return true;
+    }
+
+    fn = gather_load_fn128[mte][be];
+    assert(fn != NULL);
+
+    /*
+     * Unlike LD1_zprz, a->rm is the scalar register and it can be XZR, not XSP.
+     * a->rn is the vector register.
+     */
+    do_mem_zpz(s, a->rd, a->pg, a->rn, 0,
+               cpu_reg(s, a->rm), MO_128, false, fn);
+    return true;
+}
+
 static bool trans_LD1_zpiz(DisasContext *s, arg_LD1_zpiz *a)
 {
     gen_helper_gvec_mem_scatter *fn = NULL;
@@ -6386,9 +6406,7 @@ static bool trans_ST1_zprz(DisasContext *s, arg_ST1_zprz *a)
     if (a->esz < a->msz || (a->msz == 0 && a->scale)) {
         return false;
     }
-    if (a->esz < MO_128
-        ? !dc_isar_feature(aa64_sve, s)
-        : !dc_isar_feature(aa64_sve2p1, s)) {
+    if (!dc_isar_feature(aa64_sve, s)) {
         return false;
     }
     s->is_nonstreaming = true;
@@ -6402,10 +6420,6 @@ static bool trans_ST1_zprz(DisasContext *s, arg_ST1_zprz *a)
     case MO_64:
         fn = scatter_store_fn64[mte][be][a->xs][a->msz];
         break;
-    case MO_128:
-        assert(a->xs == 2 && a->msz == MO_128);
-        fn = scatter_store_fn128[mte][be];
-        break;
     default:
         g_assert_not_reached();
     }
@@ -6414,6 +6428,29 @@ static bool trans_ST1_zprz(DisasContext *s, arg_ST1_zprz *a)
     return true;
 }
 
+static bool trans_ST1Q(DisasContext *s, arg_ST1Q *a)
+{
+    gen_helper_gvec_mem_scatter *fn;
+    bool be = s->be_data == MO_BE;
+    bool mte = s->mte_active[0];
+
+    if (!dc_isar_feature(aa64_sve2p1, s)) {
+        return false;
+    }
+    s->is_nonstreaming = true;
+    if (!sve_access_check(s)) {
+        return true;
+    }
+    fn = scatter_store_fn128[mte][be];
+    /*
+     * Unlike ST1_zprz, a->rm is the scalar register, and it
+     * can be XZR, not XSP. a->rn is the vector register.
+     */
+    do_mem_zpz(s, a->rd, a->pg, a->rn, 0,
+               cpu_reg(s, a->rm), MO_128, true, fn);
+    return true;
+}
+
 static bool trans_ST1_zpiz(DisasContext *s, arg_ST1_zpiz *a)
 {
     gen_helper_gvec_mem_scatter *fn = NULL;

From 4726be1c69606e34c3cc4c26e39e252a9856b3d3 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Wed, 23 Jul 2025 17:54:57 +0100
Subject: [PATCH 2622/2760] target/arm: Pass correct esize to sve_st1_z() for
 LD1Q, ST1Q

Our implementation of the helper functions for the LD1Q and ST1Q
insns reused the existing DO_LD1_ZPZ_D and DO_ST1_ZPZ_D macros.  This
passes the wrong esize (8, not 16) to sve_ldl_z().

Create new macros DO_LD1_ZPZ_Q and DO_ST1_ZPZ_Q which pass the
correct esize, and use them for the LD1Q and ST1Q helpers.

Fixes: d2aa9a804ee ("target/arm: Implement LD1Q, ST1Q for SVE2p1")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250723165458.3509150-6-peter.maydell@linaro.org
---
 target/arm/tcg/sve_helper.c | 36 ++++++++++++++++++++++++++++++++----
 1 file changed, 32 insertions(+), 4 deletions(-)

diff --git a/target/arm/tcg/sve_helper.c b/target/arm/tcg/sve_helper.c
index d0fb4138d2..c4aaf0cc45 100644
--- a/target/arm/tcg/sve_helper.c
+++ b/target/arm/tcg/sve_helper.c
@@ -7219,6 +7219,20 @@ void HELPER(sve_ld##MEM##_##OFS##_mte)(CPUARMState *env, void *vd, void *vg, \
                   off_##OFS##_d, sve_ld1##MEM##_host, sve_ld1##MEM##_tlb);   \
 }
 
+#define DO_LD1_ZPZ_Q(MEM, OFS, MSZ)                                          \
+void HELPER(sve_ld##MEM##_##OFS)(CPUARMState *env, void *vd, void *vg,       \
+                                 void *vm, target_ulong base, uint64_t desc) \
+{                                                                            \
+    sve_ld1_z(env, vd, vg, vm, base, desc, GETPC(), 0, 16, 1 << MSZ,         \
+              off_##OFS##_d, sve_ld1##MEM##_host, sve_ld1##MEM##_tlb);       \
+}                                                                            \
+void HELPER(sve_ld##MEM##_##OFS##_mte)(CPUARMState *env, void *vd, void *vg, \
+    void *vm, target_ulong base, uint64_t desc)                              \
+{                                                                            \
+    sve_ld1_z_mte(env, vd, vg, vm, base, desc, GETPC(), 16, 1 << MSZ,        \
+                  off_##OFS##_d, sve_ld1##MEM##_host, sve_ld1##MEM##_tlb);   \
+}
+
 DO_LD1_ZPZ_S(bsu, zsu, MO_8)
 DO_LD1_ZPZ_S(bsu, zss, MO_8)
 DO_LD1_ZPZ_D(bdu, zsu, MO_8)
@@ -7283,8 +7297,8 @@ DO_LD1_ZPZ_D(dd_be, zsu, MO_64)
 DO_LD1_ZPZ_D(dd_be, zss, MO_64)
 DO_LD1_ZPZ_D(dd_be, zd, MO_64)
 
-DO_LD1_ZPZ_D(qq_le, zd, MO_128)
-DO_LD1_ZPZ_D(qq_be, zd, MO_128)
+DO_LD1_ZPZ_Q(qq_le, zd, MO_128)
+DO_LD1_ZPZ_Q(qq_be, zd, MO_128)
 
 #undef DO_LD1_ZPZ_S
 #undef DO_LD1_ZPZ_D
@@ -7632,6 +7646,20 @@ void HELPER(sve_st##MEM##_##OFS##_mte)(CPUARMState *env, void *vd, void *vg, \
                   off_##OFS##_d, sve_st1##MEM##_host, sve_st1##MEM##_tlb); \
 }
 
+#define DO_ST1_ZPZ_Q(MEM, OFS, MSZ)                                     \
+void HELPER(sve_st##MEM##_##OFS)(CPUARMState *env, void *vd, void *vg,  \
+                                 void *vm, target_ulong base, uint64_t desc) \
+{                                                                       \
+    sve_st1_z(env, vd, vg, vm, base, desc, GETPC(), 0, 16, 1 << MSZ,    \
+              off_##OFS##_d, sve_st1##MEM##_host, sve_st1##MEM##_tlb);  \
+}                                                                       \
+void HELPER(sve_st##MEM##_##OFS##_mte)(CPUARMState *env, void *vd, void *vg, \
+    void *vm, target_ulong base, uint64_t desc)                         \
+{                                                                       \
+    sve_st1_z_mte(env, vd, vg, vm, base, desc, GETPC(), 16, 1 << MSZ,   \
+                  off_##OFS##_d, sve_st1##MEM##_host, sve_st1##MEM##_tlb); \
+}
+
 DO_ST1_ZPZ_S(bs, zsu, MO_8)
 DO_ST1_ZPZ_S(hs_le, zsu, MO_16)
 DO_ST1_ZPZ_S(hs_be, zsu, MO_16)
@@ -7668,8 +7696,8 @@ DO_ST1_ZPZ_D(sd_be, zd, MO_32)
 DO_ST1_ZPZ_D(dd_le, zd, MO_64)
 DO_ST1_ZPZ_D(dd_be, zd, MO_64)
 
-DO_ST1_ZPZ_D(qq_le, zd, MO_128)
-DO_ST1_ZPZ_D(qq_be, zd, MO_128)
+DO_ST1_ZPZ_Q(qq_le, zd, MO_128)
+DO_ST1_ZPZ_Q(qq_be, zd, MO_128)
 
 #undef DO_ST1_ZPZ_S
 #undef DO_ST1_ZPZ_D

From 7428c46c06b4365ee5131dcdcc3da218c5e99ddd Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Wed, 23 Jul 2025 17:54:58 +0100
Subject: [PATCH 2623/2760] target/arm: Fix LD1W, LD1D to 128-bit elements

In our implementation of the SVE2p1 contiguous load to 128-bit
element insns such as LD1D (scalar plus scalar, single register), we
got the order of the arguments to the DO_LD1_2() macro wrong.  Here
the first argument is the element size and the second is the memory
size, and the element size is always the same size or larger than
the memory size.

For the 128-bit versions, we want to load either 32-bit or 64-bit
values from memory and extend them to the 128-bit vector element, but
were trying to load 128 bit values and then stuff them into 32-bit or
64-bit vector elements.  Correct the macro ordering.

Fixes: fc5f060bcb7b ("target/arm: Implement {LD1, ST1}{W, D} (128-bit element) for SVE2p1")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250723165458.3509150-7-peter.maydell@linaro.org
---
 target/arm/tcg/sve_helper.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/tcg/sve_helper.c b/target/arm/tcg/sve_helper.c
index c4aaf0cc45..c442fcb540 100644
--- a/target/arm/tcg/sve_helper.c
+++ b/target/arm/tcg/sve_helper.c
@@ -6439,8 +6439,8 @@ DO_LD1_2(ld1sds, MO_64, MO_32)
 
 DO_LD1_2(ld1dd,  MO_64, MO_64)
 
-DO_LD1_2(ld1squ, MO_32, MO_128)
-DO_LD1_2(ld1dqu, MO_64, MO_128)
+DO_LD1_2(ld1squ, MO_128, MO_32)
+DO_LD1_2(ld1dqu, MO_128, MO_64)
 
 #undef DO_LD1_1
 #undef DO_LD1_2

From bd52d8bc9e01dcf68731dcdd9d2b8ebcb9fc5692 Mon Sep 17 00:00:00 2001
From: JianChunfu <jansef.jian@hj-micro.com>
Date: Fri, 14 Feb 2025 15:20:29 +0800
Subject: [PATCH 2624/2760] hw/arm/smmu-common: Avoid using inlined functions
 with external linkage
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Similarly to commit 9de9fa5c ("hw/arm/smmu-common: Avoid using
inlined functions with external linkage"):

  None of our code base require / use inlined functions with external
  linkage. Some places use internal inlining in the hot path. These
  two functions are certainly not in any hot path and don't justify
  any inlining, so these are likely oversights rather than intentional.

Fixes: b8fa4c23 (hw/arm/smmu: Support nesting in the rest of commands)
Signed-off-by: JianChunfu <jansef.jian@hj-micro.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/smmu-common.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c
index f39b99e526..0dcaf2f589 100644
--- a/hw/arm/smmu-common.c
+++ b/hw/arm/smmu-common.c
@@ -319,7 +319,7 @@ void smmu_iotlb_inv_vmid(SMMUState *s, int vmid)
     g_hash_table_foreach_remove(s->iotlb, smmu_hash_remove_by_vmid, &vmid);
 }
 
-inline void smmu_iotlb_inv_vmid_s1(SMMUState *s, int vmid)
+void smmu_iotlb_inv_vmid_s1(SMMUState *s, int vmid)
 {
     trace_smmu_iotlb_inv_vmid_s1(vmid);
     g_hash_table_foreach_remove(s->iotlb, smmu_hash_remove_by_vmid_s1, &vmid);

From a7aa2af13e287e11cb2d73972353bfec161803a4 Mon Sep 17 00:00:00 2001
From: Mohamed Mediouni <mohamed@unpredictable.fr>
Date: Mon, 21 Jul 2025 17:29:02 +0200
Subject: [PATCH 2625/2760] target/arm: hvf: stubbing reads to LORC_EL1

Linux zeroes LORC_EL1 on boot at EL2, without further interaction with FEAT_LOR afterwards.

Stub out LORC_EL1 accesses as FEAT_LOR is a mandatory extension on Armv8.1+.

Signed-off-by: Mohamed Mediouni <mohamed@unpredictable.fr>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/hvf/hvf.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index bd6b5d11de..47b0cd3a35 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -186,6 +186,7 @@ void hvf_arm_init_debug(void)
 #define SYSREG_OSLAR_EL1      SYSREG(2, 0, 1, 0, 4)
 #define SYSREG_OSLSR_EL1      SYSREG(2, 0, 1, 1, 4)
 #define SYSREG_OSDLR_EL1      SYSREG(2, 0, 1, 3, 4)
+#define SYSREG_LORC_EL1       SYSREG(3, 0, 10, 4, 3)
 #define SYSREG_CNTPCT_EL0     SYSREG(3, 3, 14, 0, 1)
 #define SYSREG_CNTP_CTL_EL0   SYSREG(3, 3, 14, 2, 1)
 #define SYSREG_PMCR_EL0       SYSREG(3, 3, 9, 12, 0)
@@ -1657,6 +1658,9 @@ static int hvf_sysreg_write(CPUState *cpu, uint32_t reg, uint64_t val)
     case SYSREG_OSDLR_EL1:
         /* Dummy register */
         return 0;
+    case SYSREG_LORC_EL1:
+        /* Dummy register */
+        return 0;
     case SYSREG_ICC_AP0R0_EL1:
     case SYSREG_ICC_AP0R1_EL1:
     case SYSREG_ICC_AP0R2_EL1:

From fbc8fb36e3636854195705cba13278befb94158d Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Tue, 22 Jul 2025 09:50:01 +0200
Subject: [PATCH 2626/2760] scripts: add script to help distros use global Rust
 packages

Some distros prefer to avoid vendored crate sources, and instead use
local sources from e.g. ``/usr/share/cargo/registry``.  Add a
script, inspired by the Mesa spec file(*), that automatically
performs this task.  The script is meant to be invoked after unpacking
the QEMU tarball.

(*) This is the hack that Mesa uses:

    export MESON_PACKAGE_CACHE_DIR="%{cargo_registry}/"
    %define inst_crate_nameversion() %(basename %{cargo_registry}/%{1}-*)
    %define rewrite_wrap_file() sed -e "/source.*/d" -e "s/%{1}-.*/%{inst_crate_nameversion %{1}}/" -i subprojects/%{1}.wrap
    %rewrite_wrap_file proc-macro2
    ... more %rewrite_wrap_file invocations follow ...

Reviewed-by: Neal Gompa <ngompa@fedoraproject.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 MAINTAINERS                              |   1 +
 docs/about/build-platforms.rst           |   8 +
 scripts/get-wraps-from-cargo-registry.py | 190 +++++++++++++++++++++++
 3 files changed, 199 insertions(+)
 create mode 100755 scripts/get-wraps-from-cargo-registry.py

diff --git a/MAINTAINERS b/MAINTAINERS
index a462345618..1604f3dfc1 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3511,6 +3511,7 @@ S: Maintained
 F: rust/qemu-api
 F: rust/qemu-api-macros
 F: rust/rustfmt.toml
+F: scripts/get-wraps-from-cargo-registry.py
 
 Rust-related patches CC here
 L: qemu-rust@nongnu.org
diff --git a/docs/about/build-platforms.rst b/docs/about/build-platforms.rst
index 8ecbd6b26f..8671c3be9c 100644
--- a/docs/about/build-platforms.rst
+++ b/docs/about/build-platforms.rst
@@ -127,6 +127,14 @@ Rust build dependencies
   (or newer) package.  The path to ``rustc`` and ``rustdoc`` must be
   provided manually to the configure script.
 
+  Some distros prefer to avoid vendored crate sources, and instead use
+  local sources from e.g. ``/usr/share/cargo/registry``.  QEMU includes a
+  script, ``scripts/get-wraps-from-cargo-registry.py``, that automatically
+  performs this task.  The script is meant to be invoked after unpacking
+  the QEMU tarball.  QEMU also includes ``rust/Cargo.toml`` and
+  ``rust/Cargo.lock`` files that can be used to compute QEMU's build
+  dependencies, e.g. using ``cargo2rpm -p rust/Cargo.toml buildrequires``.
+
 Optional build dependencies
   Build components whose absence does not affect the ability to build QEMU
   may not be available in distros, or may be too old for our requirements.
diff --git a/scripts/get-wraps-from-cargo-registry.py b/scripts/get-wraps-from-cargo-registry.py
new file mode 100755
index 0000000000..31eed5c2dd
--- /dev/null
+++ b/scripts/get-wraps-from-cargo-registry.py
@@ -0,0 +1,190 @@
+#!/usr/bin/env python3
+
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+"""
+get-wraps-from-cargo-registry.py - Update Meson subprojects from a global registry
+"""
+
+# Copyright (C) 2025 Red Hat, Inc.
+#
+# Author: Paolo Bonzini <pbonzini@redhat.com>
+
+import argparse
+import configparser
+import filecmp
+import glob
+import os
+import subprocess
+import sys
+
+
+def get_name_and_semver(namever: str) -> tuple[str, str]:
+    """Split a subproject name into its name and semantic version parts"""
+    parts = namever.rsplit("-", 1)
+    if len(parts) != 2:
+        return namever, ""
+
+    return parts[0], parts[1]
+
+
+class UpdateSubprojects:
+    cargo_registry: str
+    top_srcdir: str
+    dry_run: bool
+    changes: int = 0
+
+    def find_installed_crate(self, namever: str) -> str | None:
+        """Find installed crate matching name and semver prefix"""
+        name, semver = get_name_and_semver(namever)
+
+        # exact version match
+        path = os.path.join(self.cargo_registry, f"{name}-{semver}")
+        if os.path.exists(path):
+            return f"{name}-{semver}"
+
+        # semver match
+        matches = sorted(glob.glob(f"{path}.*"))
+        return os.path.basename(matches[0]) if matches else None
+
+    def compare_build_rs(self, orig_dir: str, registry_namever: str) -> None:
+        """Warn if the build.rs in the original directory differs from the registry version."""
+        orig_build_rs = os.path.join(orig_dir, "build.rs")
+        new_build_rs = os.path.join(self.cargo_registry, registry_namever, "build.rs")
+
+        msg = None
+        if os.path.isfile(orig_build_rs) != os.path.isfile(new_build_rs):
+            if os.path.isfile(orig_build_rs):
+                msg = f"build.rs removed in {registry_namever}"
+            if os.path.isfile(new_build_rs):
+                msg = f"build.rs added in {registry_namever}"
+
+        elif os.path.isfile(orig_build_rs) and not filecmp.cmp(orig_build_rs, new_build_rs):
+            msg = f"build.rs changed from {orig_dir} to {registry_namever}"
+
+        if msg:
+            print(f"⚠️  Warning: {msg}")
+            print("   This may affect the build process - please review the differences.")
+
+    def update_subproject(self, wrap_file: str, registry_namever: str) -> None:
+        """Modify [wrap-file] section to point to self.cargo_registry."""
+        assert wrap_file.endswith("-rs.wrap")
+        wrap_name = wrap_file[:-5]
+
+        env = os.environ.copy()
+        env["MESON_PACKAGE_CACHE_DIR"] = self.cargo_registry
+
+        config = configparser.ConfigParser()
+        config.read(wrap_file)
+        if "wrap-file" not in config:
+            return
+
+        # do not download the wrap, always use the local copy
+        orig_dir = config["wrap-file"]["directory"]
+        if os.path.exists(orig_dir) and orig_dir != registry_namever:
+            self.compare_build_rs(orig_dir, registry_namever)
+
+        if self.dry_run:
+            if orig_dir == registry_namever:
+                print(f"Will install {orig_dir} from registry.")
+            else:
+                print(f"Will replace {orig_dir} with {registry_namever}.")
+            self.changes += 1
+            return
+
+        config["wrap-file"]["directory"] = registry_namever
+        for key in list(config["wrap-file"].keys()):
+            if key.startswith("source"):
+                del config["wrap-file"][key]
+
+        # replace existing directory with installed version
+        if os.path.exists(orig_dir):
+            subprocess.run(
+                ["meson", "subprojects", "purge", "--confirm", wrap_name],
+                cwd=self.top_srcdir,
+                env=env,
+                check=True,
+            )
+
+        with open(wrap_file, "w") as f:
+            config.write(f)
+
+        if orig_dir == registry_namever:
+            print(f"Installing {orig_dir} from registry.")
+        else:
+            print(f"Replacing {orig_dir} with {registry_namever}.")
+            patch_dir = config["wrap-file"]["patch_directory"]
+            patch_dir = os.path.join("packagefiles", patch_dir)
+            _, ver = registry_namever.rsplit("-", 1)
+            subprocess.run(
+                ["meson", "rewrite", "kwargs", "set", "project", "/", "version", ver],
+                cwd=patch_dir,
+                env=env,
+                check=True,
+            )
+
+        subprocess.run(
+            ["meson", "subprojects", "download", wrap_name],
+            cwd=self.top_srcdir,
+            env=env,
+            check=True,
+        )
+        self.changes += 1
+
+    @staticmethod
+    def parse_cmdline() -> argparse.Namespace:
+        parser = argparse.ArgumentParser(
+            description="Replace Meson subprojects with packages in a Cargo registry"
+        )
+        parser.add_argument(
+            "--cargo-registry",
+            default=os.environ.get("CARGO_REGISTRY"),
+            help="Path to Cargo registry (default: CARGO_REGISTRY env var)",
+        )
+        parser.add_argument(
+            "--dry-run",
+            action="store_true",
+            default=False,
+            help="Do not actually replace anything",
+        )
+
+        args = parser.parse_args()
+        if not args.cargo_registry:
+            print("error: CARGO_REGISTRY environment variable not set and --cargo-registry not provided")
+            sys.exit(1)
+
+        return args
+
+    def __init__(self, args: argparse.Namespace):
+        self.cargo_registry = args.cargo_registry
+        self.dry_run = args.dry_run
+        self.top_srcdir = os.getcwd()
+
+    def main(self) -> None:
+        if not os.path.exists("subprojects"):
+            print("'subprojects' directory not found, nothing to do.")
+            return
+
+        os.chdir("subprojects")
+        for wrap_file in sorted(glob.glob("*-rs.wrap")):
+            namever = wrap_file[:-8]  # Remove '-rs.wrap'
+
+            registry_namever = self.find_installed_crate(namever)
+            if not registry_namever:
+                print(f"No installed crate found for {wrap_file}")
+                continue
+
+            self.update_subproject(wrap_file, registry_namever)
+
+        if self.changes:
+            if self.dry_run:
+                print("Rerun without --dry-run to apply changes.")
+            else:
+                print(f"✨ {self.changes} subproject(s) updated!")
+        else:
+            print("No changes.")
+
+
+if __name__ == "__main__":
+    args = UpdateSubprojects.parse_cmdline()
+    UpdateSubprojects(args).main()

From feea87cd6b645d5166bdd304aac88f47f63dc2ef Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 25 Jul 2025 01:10:12 +0200
Subject: [PATCH 2627/2760] target/i386: fix width of third operand of
 VINSERTx128

Table A-5 of the Intel manual incorrectly lists the third operand of
VINSERTx128 as Wqq, but it is actually a 128-bit value.  This is
visible when W is a memory operand close to the end of the page.

Fixes the recently-added poly1305_kunit test in linux-next.

(No testcase yet, but I plan to modify test-avx2 to use memory
close to the end of the page.  This would work because the test
vectors correctly have the memory operand as xmm2/m128).

Reported-by: Eric Biggers <ebiggers@kernel.org>
Tested-by: Eric Biggers <ebiggers@kernel.org>
Cc: Ard Biesheuvel <ardb@kernel.org>
Cc: "Jason A. Donenfeld" <Jason@zx2c4.com>
Cc: Guenter Roeck <linux@roeck-us.net>
Cc: qemu-stable@nongnu.org
Fixes: 79068477686 ("target/i386: reimplement 0x0f 0x3a, add AVX", 2022-10-18)
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/tcg/decode-new.c.inc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/i386/tcg/decode-new.c.inc b/target/i386/tcg/decode-new.c.inc
index 853b1c8bf9..51038657f0 100644
--- a/target/i386/tcg/decode-new.c.inc
+++ b/target/i386/tcg/decode-new.c.inc
@@ -878,10 +878,10 @@ static const X86OpEntry opcodes_0F3A[256] = {
     [0x0e] = X86_OP_ENTRY4(VPBLENDW,   V,x,  H,x,  W,x,  vex4 cpuid(SSE41) avx2_256 p_66),
     [0x0f] = X86_OP_ENTRY4(PALIGNR,    V,x,  H,x,  W,x,  vex4 cpuid(SSSE3) mmx avx2_256 p_00_66),
 
-    [0x18] = X86_OP_ENTRY4(VINSERTx128,  V,qq, H,qq, W,qq, vex6 chk(W0) cpuid(AVX) p_66),
+    [0x18] = X86_OP_ENTRY4(VINSERTx128,  V,qq, H,qq, W,dq, vex6 chk(W0) cpuid(AVX) p_66),
     [0x19] = X86_OP_ENTRY3(VEXTRACTx128, W,dq, V,qq, I,b,  vex6 chk(W0) cpuid(AVX) p_66),
 
-    [0x38] = X86_OP_ENTRY4(VINSERTx128,  V,qq, H,qq, W,qq, vex6 chk(W0) cpuid(AVX2) p_66),
+    [0x38] = X86_OP_ENTRY4(VINSERTx128,  V,qq, H,qq, W,dq, vex6 chk(W0) cpuid(AVX2) p_66),
     [0x39] = X86_OP_ENTRY3(VEXTRACTx128, W,dq, V,qq, I,b,  vex6 chk(W0) cpuid(AVX2) p_66),
 
     /* Listed incorrectly as type 4 */

From 3cdd990aa920ec8f2994b634f758dab4a86ac167 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Fri, 25 Jul 2025 18:55:08 +0100
Subject: [PATCH 2628/2760] linux-user/aarch64: Clear TPIDR2_EL0 when
 delivering signals

A recent change to the kernel (Linux commit b376108e1f88
"arm64/fpsimd: signal: Clear TPIDR2 when delivering signals") updated
the signal-handler entry code to always clear TPIDR2_EL0.

This is necessary for the userspace ZA lazy saving scheme to work
correctly when unwinding exceptions across a signal boundary.
(For the essay-length description of the incorrect behaviour and
why this is the correct fix, see the commit message for the
kernel commit.)

Make QEMU also clear TPIDR2_EL0 on signal entry, applying the
equivalent bugfix to our implementation.

Note that getting this unwinding to work correctly also requires
changes to the userspace code, e.g.  as implemented in gcc in
https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=b5ffc8e75a8

This change is technically an ABI change; from the kernel's
point of view SME was never enabled (it was hidden behind
CONFIG_BROKEN) before the change. From QEMU's point of view
our SME-related signal handling was broken anyway as we weren't
saving and restoring TPIDR2_EL0.

Cc: qemu-stable@nongnu.org
Fixes: 78011586b90d1 ("target/arm: Enable SME for user-only")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250725175510.3864231-2-peter.maydell@linaro.org>
---
 linux-user/aarch64/signal.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/linux-user/aarch64/signal.c b/linux-user/aarch64/signal.c
index d50cab78d8..6514b73ad9 100644
--- a/linux-user/aarch64/signal.c
+++ b/linux-user/aarch64/signal.c
@@ -666,8 +666,12 @@ static void target_setup_frame(int usig, struct target_sigaction *ka,
         env->btype = 2;
     }
 
-    /* Invoke the signal handler with both SM and ZA disabled. */
+    /*
+     * Invoke the signal handler with a clean SME state: both SM and ZA
+     * disabled and TPIDR2_EL0 cleared.
+     */
     aarch64_set_svcr(env, 0, R_SVCR_SM_MASK | R_SVCR_ZA_MASK);
+    env->cp15.tpidr2_el0 = 0;
 
     if (info) {
         frame->info = *info;

From 99870aff907b1c863cd32558b543f0ab0d0e74ba Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Fri, 25 Jul 2025 18:55:09 +0100
Subject: [PATCH 2629/2760] linux-user/aarch64: Support TPIDR2_MAGIC signal
 frame record

FEAT_SME adds the TPIDR2 userspace-accessible system register, which
is used as part of the procedure calling standard's lazy saving
scheme for the ZA registers:
 https://github.com/ARM-software/abi-aa/blob/main/aapcs64/aapcs64.rst#66the-za-lazy-saving-scheme

The Linux kernel has a signal frame record for saving
and restoring this value when calling signal handlers, but
we forgot to implement this. The result is that code which
tries to unwind an exception out of a signal handler will
not work correctly.

Add support for the missing record.

Cc: qemu-stable@nongnu.org
Fixes: 78011586b90d1 ("target/arm: Enable SME for user-only")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250725175510.3864231-3-peter.maydell@linaro.org>
---
 linux-user/aarch64/signal.c | 42 +++++++++++++++++++++++++++++++++++--
 1 file changed, 40 insertions(+), 2 deletions(-)

diff --git a/linux-user/aarch64/signal.c b/linux-user/aarch64/signal.c
index 6514b73ad9..f28ba80754 100644
--- a/linux-user/aarch64/signal.c
+++ b/linux-user/aarch64/signal.c
@@ -121,6 +121,13 @@ struct target_za_context {
 #define TARGET_ZA_SIG_CONTEXT_SIZE(VQ) \
     TARGET_ZA_SIG_ZAV_OFFSET(VQ, VQ * TARGET_SVE_VQ_BYTES)
 
+#define TARGET_TPIDR2_MAGIC 0x54504902
+
+struct target_tpidr2_context {
+    struct target_aarch64_ctx head;
+    uint64_t tpidr2;
+};
+
 struct target_rt_sigframe {
     struct target_siginfo info;
     struct target_ucontext uc;
@@ -253,6 +260,14 @@ static void target_setup_za_record(struct target_za_context *za,
     }
 }
 
+static void target_setup_tpidr2_record(struct target_tpidr2_context *tpidr2,
+                                       CPUARMState *env)
+{
+    __put_user(TARGET_TPIDR2_MAGIC, &tpidr2->head.magic);
+    __put_user(sizeof(struct target_tpidr2_context), &tpidr2->head.size);
+    __put_user(env->cp15.tpidr2_el0, &tpidr2->tpidr2);
+}
+
 static void target_restore_general_frame(CPUARMState *env,
                                          struct target_rt_sigframe *sf)
 {
@@ -403,6 +418,12 @@ static bool target_restore_za_record(CPUARMState *env,
     return true;
 }
 
+static void target_restore_tpidr2_record(CPUARMState *env,
+                                         struct target_tpidr2_context *tpidr2)
+{
+    __get_user(env->cp15.tpidr2_el0, &tpidr2->tpidr2);
+}
+
 static int target_restore_sigframe(CPUARMState *env,
                                    struct target_rt_sigframe *sf)
 {
@@ -410,6 +431,7 @@ static int target_restore_sigframe(CPUARMState *env,
     struct target_fpsimd_context *fpsimd = NULL;
     struct target_sve_context *sve = NULL;
     struct target_za_context *za = NULL;
+    struct target_tpidr2_context *tpidr2 = NULL;
     uint64_t extra_datap = 0;
     bool used_extra = false;
     int sve_size = 0;
@@ -460,6 +482,14 @@ static int target_restore_sigframe(CPUARMState *env,
             za_size = size;
             break;
 
+        case TARGET_TPIDR2_MAGIC:
+            if (tpidr2 || size != sizeof(struct target_tpidr2_context) ||
+                !cpu_isar_feature(aa64_sme, env_archcpu(env))) {
+                goto err;
+            }
+            tpidr2 = (struct target_tpidr2_context *)ctx;
+            break;
+
         case TARGET_EXTRA_MAGIC:
             if (extra || size != sizeof(struct target_extra_context)) {
                 goto err;
@@ -497,6 +527,9 @@ static int target_restore_sigframe(CPUARMState *env,
     if (za && !target_restore_za_record(env, za, za_size, &svcr)) {
         goto err;
     }
+    if (tpidr2) {
+        target_restore_tpidr2_record(env, tpidr2);
+    }
     if (env->svcr != svcr) {
         env->svcr = svcr;
         arm_rebuild_hflags(env);
@@ -568,8 +601,8 @@ static void target_setup_frame(int usig, struct target_sigaction *ka,
         .total_size = offsetof(struct target_rt_sigframe,
                                uc.tuc_mcontext.__reserved),
     };
-    int fpsimd_ofs, fr_ofs, sve_ofs = 0, za_ofs = 0;
-    int sve_size = 0, za_size = 0;
+    int fpsimd_ofs, fr_ofs, sve_ofs = 0, za_ofs = 0, tpidr2_ofs = 0;
+    int sve_size = 0, za_size = 0, tpidr2_size = 0;
     struct target_rt_sigframe *frame;
     struct target_rt_frame_record *fr;
     abi_ulong frame_addr, return_addr;
@@ -585,6 +618,8 @@ static void target_setup_frame(int usig, struct target_sigaction *ka,
         sve_ofs = alloc_sigframe_space(sve_size, &layout);
     }
     if (cpu_isar_feature(aa64_sme, env_archcpu(env))) {
+        tpidr2_size = sizeof(struct target_tpidr2_context);
+        tpidr2_ofs = alloc_sigframe_space(tpidr2_size, &layout);
         /* ZA state needs saving only if it is enabled.  */
         if (FIELD_EX64(env->svcr, SVCR, ZA)) {
             za_size = TARGET_ZA_SIG_CONTEXT_SIZE(sme_vq(env));
@@ -644,6 +679,9 @@ static void target_setup_frame(int usig, struct target_sigaction *ka,
     if (za_ofs) {
         target_setup_za_record((void *)frame + za_ofs, env, za_size);
     }
+    if (tpidr2_ofs) {
+        target_setup_tpidr2_record((void *)frame + tpidr2_ofs, env);
+    }
 
     /* Set up the stack frame for unwinding.  */
     fr = (void *)frame + fr_ofs;

From e35215db401113867e20634622a370c0e8931797 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Fri, 25 Jul 2025 18:55:10 +0100
Subject: [PATCH 2630/2760] linux-user/aarch64: Support ZT_MAGIC signal frame
 record

FEAT_SME2 adds the ZT0 register, whose contents may need to be
preserved and restored on signal handler entry and exit.  This is
done with a new ZT_MAGIC record.  We forgot to implement support for
this in our linux-user code before enabling the SME2p1 emulation,
which meant that a signal handler using SME would corrupt the ZT0
register value, and code that attempted to unwind an exception from
inside a signal handler would not work.

Add the missing record handling.

Fixes: 7b1613a1020d2942 ("target/arm: Enable FEAT_SME2p1 on -cpu max")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250725175510.3864231-4-peter.maydell@linaro.org>
---
 linux-user/aarch64/signal.c | 93 ++++++++++++++++++++++++++++++++++++-
 1 file changed, 92 insertions(+), 1 deletion(-)

diff --git a/linux-user/aarch64/signal.c b/linux-user/aarch64/signal.c
index f28ba80754..668353bbda 100644
--- a/linux-user/aarch64/signal.c
+++ b/linux-user/aarch64/signal.c
@@ -128,6 +128,23 @@ struct target_tpidr2_context {
     uint64_t tpidr2;
 };
 
+#define TARGET_ZT_MAGIC 0x5a544e01
+
+struct target_zt_context {
+    struct target_aarch64_ctx head;
+    uint16_t nregs;
+    uint16_t reserved[3];
+    /* ZTn register data immediately follows */
+};
+
+#define TARGET_ZT_SIG_REG_BYTES (512 / 8)
+#define TARGET_ZT_SIG_REGS_SIZE(n) (TARGET_ZT_SIG_REG_BYTES * (n))
+#define TARGET_ZT_SIG_CONTEXT_SIZE(n) (sizeof(struct target_zt_context) + \
+                                       TARGET_ZT_SIG_REGS_SIZE(n))
+#define TARGET_ZT_SIG_REGS_OFFSET sizeof(struct target_zt_context)
+QEMU_BUILD_BUG_ON(TARGET_ZT_SIG_REG_BYTES != \
+                  sizeof_field(CPUARMState, za_state.zt0));
+
 struct target_rt_sigframe {
     struct target_siginfo info;
     struct target_ucontext uc;
@@ -268,6 +285,28 @@ static void target_setup_tpidr2_record(struct target_tpidr2_context *tpidr2,
     __put_user(env->cp15.tpidr2_el0, &tpidr2->tpidr2);
 }
 
+static void target_setup_zt_record(struct target_zt_context *zt,
+                                   CPUARMState *env, int size)
+{
+    uint64_t *z;
+
+    memset(zt, 0, sizeof(*zt));
+    __put_user(TARGET_ZT_MAGIC, &zt->head.magic);
+    __put_user(size, &zt->head.size);
+    /*
+     * The record format allows for multiple ZT regs, but
+     * currently there is only one, ZT0.
+     */
+    __put_user(1, &zt->nregs);
+    assert(size == TARGET_ZT_SIG_CONTEXT_SIZE(1));
+
+    /* ZT0 is the same byte-stream format as SVE regs and ZA */
+    z = (void *)zt + TARGET_ZT_SIG_REGS_OFFSET;
+    for (int i = 0; i < ARRAY_SIZE(env->za_state.zt0); i++) {
+        __put_user_e(env->za_state.zt0[i], z + i, le);
+    }
+}
+
 static void target_restore_general_frame(CPUARMState *env,
                                          struct target_rt_sigframe *sf)
 {
@@ -424,6 +463,30 @@ static void target_restore_tpidr2_record(CPUARMState *env,
     __get_user(env->cp15.tpidr2_el0, &tpidr2->tpidr2);
 }
 
+static bool target_restore_zt_record(CPUARMState *env,
+                                     struct target_zt_context *zt, int size,
+                                     int svcr)
+{
+    uint16_t nregs;
+    uint64_t *z;
+
+    if (!(FIELD_EX64(svcr, SVCR, ZA))) {
+        return false;
+    }
+
+    __get_user(nregs, &zt->nregs);
+
+    if (nregs != 1) {
+        return false;
+    }
+
+    z = (void *)zt + TARGET_ZT_SIG_REGS_OFFSET;
+    for (int i = 0; i < ARRAY_SIZE(env->za_state.zt0); i++) {
+        __get_user_e(env->za_state.zt0[i], z + i, le);
+    }
+    return true;
+}
+
 static int target_restore_sigframe(CPUARMState *env,
                                    struct target_rt_sigframe *sf)
 {
@@ -432,10 +495,12 @@ static int target_restore_sigframe(CPUARMState *env,
     struct target_sve_context *sve = NULL;
     struct target_za_context *za = NULL;
     struct target_tpidr2_context *tpidr2 = NULL;
+    struct target_zt_context *zt = NULL;
     uint64_t extra_datap = 0;
     bool used_extra = false;
     int sve_size = 0;
     int za_size = 0;
+    int zt_size = 0;
     int svcr = 0;
 
     target_restore_general_frame(env, sf);
@@ -490,6 +555,15 @@ static int target_restore_sigframe(CPUARMState *env,
             tpidr2 = (struct target_tpidr2_context *)ctx;
             break;
 
+        case TARGET_ZT_MAGIC:
+            if (zt || size != TARGET_ZT_SIG_CONTEXT_SIZE(1) ||
+                !cpu_isar_feature(aa64_sme2, env_archcpu(env))) {
+                goto err;
+            }
+            zt = (struct target_zt_context *)ctx;
+            zt_size = size;
+            break;
+
         case TARGET_EXTRA_MAGIC:
             if (extra || size != sizeof(struct target_extra_context)) {
                 goto err;
@@ -530,6 +604,13 @@ static int target_restore_sigframe(CPUARMState *env,
     if (tpidr2) {
         target_restore_tpidr2_record(env, tpidr2);
     }
+    /*
+     * NB that we must restore ZT after ZA so the check that there's
+     * no ZT record if SVCR.ZA is 0 gets the right value of SVCR.
+     */
+    if (zt && !target_restore_zt_record(env, zt, zt_size, svcr)) {
+        goto err;
+    }
     if (env->svcr != svcr) {
         env->svcr = svcr;
         arm_rebuild_hflags(env);
@@ -602,7 +683,8 @@ static void target_setup_frame(int usig, struct target_sigaction *ka,
                                uc.tuc_mcontext.__reserved),
     };
     int fpsimd_ofs, fr_ofs, sve_ofs = 0, za_ofs = 0, tpidr2_ofs = 0;
-    int sve_size = 0, za_size = 0, tpidr2_size = 0;
+    int zt_ofs = 0;
+    int sve_size = 0, za_size = 0, tpidr2_size = 0, zt_size = 0;
     struct target_rt_sigframe *frame;
     struct target_rt_frame_record *fr;
     abi_ulong frame_addr, return_addr;
@@ -628,6 +710,12 @@ static void target_setup_frame(int usig, struct target_sigaction *ka,
         }
         za_ofs = alloc_sigframe_space(za_size, &layout);
     }
+    if (cpu_isar_feature(aa64_sme2, env_archcpu(env)) &&
+        FIELD_EX64(env->svcr, SVCR, ZA)) {
+        /* If SME ZA storage is enabled, we must also save SME2 ZT0 */
+        zt_size = TARGET_ZT_SIG_CONTEXT_SIZE(1);
+        zt_ofs = alloc_sigframe_space(zt_size, &layout);
+    }
 
     if (layout.extra_ofs) {
         /* Reserve space for the extra end marker.  The standard end marker
@@ -682,6 +770,9 @@ static void target_setup_frame(int usig, struct target_sigaction *ka,
     if (tpidr2_ofs) {
         target_setup_tpidr2_record((void *)frame + tpidr2_ofs, env);
     }
+    if (zt_ofs) {
+        target_setup_zt_record((void *)frame + zt_ofs, env, zt_size);
+    }
 
     /* Set up the stack frame for unwinding.  */
     fr = (void *)frame + fr_ofs;

From 8d6c7de1cc71207ccc047583df0c84363a5da16b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Fri, 25 Jul 2025 16:45:04 +0100
Subject: [PATCH 2631/2760] docs/user: clarify user-mode expects the same OS
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

While we somewhat cover this later when we talk about supported
operating systems make it clear in the front matter.

Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250725154517.3523095-2-alex.bennee@linaro.org>
---
 docs/user/index.rst | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/docs/user/index.rst b/docs/user/index.rst
index 782d27cda2..2307580cb9 100644
--- a/docs/user/index.rst
+++ b/docs/user/index.rst
@@ -5,8 +5,9 @@ User Mode Emulation
 -------------------
 
 This section of the manual is the overall guide for users using QEMU
-for user-mode emulation.  In this mode, QEMU can launch
-processes compiled for one CPU on another CPU.
+for user-mode emulation. In this mode, QEMU can launch programs
+compiled for one CPU architecture on the same Operating System (OS)
+but running on a different CPU architecture.
 
 .. toctree::
    :maxdepth: 2

From 9b6656668f01144288e1190980e1689394cc236c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Fri, 25 Jul 2025 16:45:05 +0100
Subject: [PATCH 2632/2760] docs/system: reword the TAP notes to remove tarball
 ref
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We don't ship the tarball and users should generally look to the
distribution specific packaging.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/560
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250725154517.3523095-3-alex.bennee@linaro.org>
---
 docs/system/devices/net.rst | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/docs/system/devices/net.rst b/docs/system/devices/net.rst
index 4d787c3aeb..7d76fe88c4 100644
--- a/docs/system/devices/net.rst
+++ b/docs/system/devices/net.rst
@@ -21,11 +21,17 @@ configure it as if it was a real ethernet card.
 Linux host
 ^^^^^^^^^^
 
-As an example, you can download the ``linux-test-xxx.tar.gz`` archive
-and copy the script ``qemu-ifup`` in ``/etc`` and configure properly
-``sudo`` so that the command ``ifconfig`` contained in ``qemu-ifup`` can
-be executed as root. You must verify that your host kernel supports the
-TAP network interfaces: the device ``/dev/net/tun`` must be present.
+A distribution will generally provide specific helper scripts when it
+packages QEMU. By default these are found at ``/etc/qemu-ifup`` and
+``/etc/qemu-ifdown`` and are called appropriately when QEMU wants to
+change the network state.
+
+If QEMU is being run as a non-privileged user you may need properly
+configure ``sudo`` so that network commands in the scripts can be
+executed as root.
+
+You must verify that your host kernel supports the TAP network
+interfaces: the device ``/dev/net/tun`` must be present.
 
 See :ref:`sec_005finvocation` to have examples of command
 lines using the TAP network interfaces.

From 1ab41da6bb17b8c8abaabe5c9dbf65d0667cd9ec Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Fri, 25 Jul 2025 16:45:06 +0100
Subject: [PATCH 2633/2760] docs/user: clean up headings
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This was a slightly duff format for rst, make it use proper headings.

Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250725154517.3523095-4-alex.bennee@linaro.org>
---
 docs/user/main.rst | 44 +++++++++++++++++++++++++-------------------
 1 file changed, 25 insertions(+), 19 deletions(-)

diff --git a/docs/user/main.rst b/docs/user/main.rst
index 9a1c60448c..b8ff203c21 100644
--- a/docs/user/main.rst
+++ b/docs/user/main.rst
@@ -17,28 +17,34 @@ Features
 
 QEMU user space emulation has the following notable features:
 
-**System call translation:**
-   QEMU includes a generic system call translator. This means that the
-   parameters of the system calls can be converted to fix endianness and
-   32/64-bit mismatches between hosts and targets. IOCTLs can be
-   converted too.
+System call translation
+~~~~~~~~~~~~~~~~~~~~~~~
 
-**POSIX signal handling:**
-   QEMU can redirect to the running program all signals coming from the
-   host (such as ``SIGALRM``), as well as synthesize signals from
-   virtual CPU exceptions (for example ``SIGFPE`` when the program
-   executes a division by zero).
+QEMU includes a generic system call translator. This means that the
+parameters of the system calls can be converted to fix endianness
+and 32/64-bit mismatches between hosts and targets. IOCTLs can be
+converted too.
 
-   QEMU relies on the host kernel to emulate most signal system calls,
-   for example to emulate the signal mask. On Linux, QEMU supports both
-   normal and real-time signals.
+POSIX signal handling
+~~~~~~~~~~~~~~~~~~~~~
 
-**Threading:**
-   On Linux, QEMU can emulate the ``clone`` syscall and create a real
-   host thread (with a separate virtual CPU) for each emulated thread.
-   Note that not all targets currently emulate atomic operations
-   correctly. x86 and Arm use a global lock in order to preserve their
-   semantics.
+QEMU can redirect to the running program all signals coming from the
+host (such as ``SIGALRM``), as well as synthesize signals from
+virtual CPU exceptions (for example ``SIGFPE`` when the program
+executes a division by zero).
+
+QEMU relies on the host kernel to emulate most signal system calls,
+for example to emulate the signal mask. On Linux, QEMU supports both
+normal and real-time signals.
+
+Threading
+~~~~~~~~~
+
+On Linux, QEMU can emulate the ``clone`` syscall and create a real
+host thread (with a separate virtual CPU) for each emulated thread.
+Note that not all targets currently emulate atomic operations
+correctly. x86 and Arm use a global lock in order to preserve their
+semantics.
 
 QEMU was conceived so that ultimately it can emulate itself. Although it
 is not very useful, it is an important test to show the power of the

From bd0eb9b0cdb69ce8eafa85258a564596eeb165b7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Fri, 25 Jul 2025 16:45:07 +0100
Subject: [PATCH 2634/2760] docs/user: slightly reword section on system calls
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Expand the description slightly and quote ioctl(). I did ponder
mentioning something about why DRM ioctls are often missing but I see
we have the I915 ones so I guess its just no one has done them.

Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250725154517.3523095-5-alex.bennee@linaro.org>
---
 docs/user/main.rst | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/docs/user/main.rst b/docs/user/main.rst
index b8ff203c21..05de904225 100644
--- a/docs/user/main.rst
+++ b/docs/user/main.rst
@@ -20,10 +20,14 @@ QEMU user space emulation has the following notable features:
 System call translation
 ~~~~~~~~~~~~~~~~~~~~~~~
 
-QEMU includes a generic system call translator. This means that the
-parameters of the system calls can be converted to fix endianness
-and 32/64-bit mismatches between hosts and targets. IOCTLs can be
-converted too.
+System calls are the principle interface between user-space and the
+kernel. Generally the same system calls exist on all versions of the
+kernel so QEMU includes a generic system call translator. The
+translator takes care of adjusting endianess, 32/64 bit parameter size
+and then calling the equivalent host system call.
+
+QEMU can also adjust device specific ``ioctl()`` calls in a similar
+fashion.
 
 POSIX signal handling
 ~~~~~~~~~~~~~~~~~~~~~

From f1f25eed03308f9f85770e0b6b911b6caf83c268 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Fri, 25 Jul 2025 16:45:08 +0100
Subject: [PATCH 2635/2760] docs/user: expand section on threading
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Potentially too many weasel words when describing atomic and memory
order issues.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250725154517.3523095-6-alex.bennee@linaro.org>
---
 docs/user/main.rst | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/docs/user/main.rst b/docs/user/main.rst
index 05de904225..347bdfabf8 100644
--- a/docs/user/main.rst
+++ b/docs/user/main.rst
@@ -46,9 +46,15 @@ Threading
 
 On Linux, QEMU can emulate the ``clone`` syscall and create a real
 host thread (with a separate virtual CPU) for each emulated thread.
-Note that not all targets currently emulate atomic operations
-correctly. x86 and Arm use a global lock in order to preserve their
-semantics.
+However as QEMU relies on the system libc to call ``clone`` on its
+behalf we limit the flags accepted to those it uses. Specifically this
+means flags affecting namespaces (e.g. container runtimes) are not
+supported. QEMU user-mode processes can still be run inside containers
+though.
+
+While QEMU does its best to emulate atomic operations properly
+differences between the host and guest memory models can cause issues
+for software that makes assumptions about the memory model.
 
 QEMU was conceived so that ultimately it can emulate itself. Although it
 is not very useful, it is an important test to show the power of the

From ebbc04adbb079066f8d180b8744c1c01c6de23f9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Fri, 25 Jul 2025 16:45:09 +0100
Subject: [PATCH 2636/2760] tests/functional: add hypervisor test for aarch64
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This is a simple test case that runs an image with kvmtool and
kvm-unit-tests which can validate virtualisation works. This is useful
for exercising TCG but can also be applied to any nested virt setup
which is why it doesn't specify an accelerator.

Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250725154517.3523095-7-alex.bennee@linaro.org>
---
 tests/functional/meson.build         |  1 +
 tests/functional/test_aarch64_kvm.py | 71 ++++++++++++++++++++++++++++
 2 files changed, 72 insertions(+)
 create mode 100755 tests/functional/test_aarch64_kvm.py

diff --git a/tests/functional/meson.build b/tests/functional/meson.build
index 8bebcd4d94..ecf965adc6 100644
--- a/tests/functional/meson.build
+++ b/tests/functional/meson.build
@@ -89,6 +89,7 @@ tests_aarch64_system_thorough = [
   'aarch64_device_passthrough',
   'aarch64_hotplug_pci',
   'aarch64_imx8mp_evk',
+  'aarch64_kvm',
   'aarch64_raspi3',
   'aarch64_raspi4',
   'aarch64_replay',
diff --git a/tests/functional/test_aarch64_kvm.py b/tests/functional/test_aarch64_kvm.py
new file mode 100755
index 0000000000..9fb9286139
--- /dev/null
+++ b/tests/functional/test_aarch64_kvm.py
@@ -0,0 +1,71 @@
+#!/usr/bin/env python3
+#
+# Functional test that runs subsets of kvm-unit-tests on Aarch64.
+# These can run on TCG and any accelerator supporting nested
+# virtualisation.
+#
+# Copyright (c) 2025 Linaro
+#
+# Author:
+#  Alex Bennée <alex.bennee@linaro.org>
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+from qemu_test import Asset
+from qemu_test import exec_command_and_wait_for_pattern as ec_and_wait
+from qemu_test.linuxkernel import LinuxKernelTest
+
+
+class Aarch64VirtKVMTests(LinuxKernelTest):
+
+    ASSET_KVM_TEST_KERNEL = Asset(
+        'https://fileserver.linaro.org/s/HmjaxXXYHYSqbes/'
+        'download?path=%2F&files='
+        'image-with-kvm-tool-and-unit-tests.gz',
+        '34de4aaea90db5da42729e7d28b77f392c37a2f4da859f889a5234aaf0970696')
+
+    # make it easier to detect successful return to shell
+    PS1 = 'RES=[$?] # '
+    OK_CMD = 'RES=[0] # '
+
+    # base of tests
+    KUT_BASE = "/usr/share/kvm-unit-tests/"
+
+    def _launch_guest(self, kvm_mode="nvhe"):
+
+        self.set_machine('virt')
+        kernel_path = self.ASSET_KVM_TEST_KERNEL.fetch()
+
+        self.vm.set_console()
+        kernel_command_line = (self.KERNEL_COMMON_COMMAND_LINE +
+                               f"console=ttyAMA0 kvm-arm.mode={kvm_mode}")
+
+        self.vm.add_args("-cpu", "cortex-a72")
+        self.vm.add_args("-machine", "virt,gic-version=3,virtualization=on",
+                         '-kernel', kernel_path,
+                         '-append', kernel_command_line)
+        self.vm.add_args("-smp", "2", "-m", "320")
+
+        self.vm.launch()
+
+        self.wait_for_console_pattern('buildroot login:')
+        ec_and_wait(self, 'root', '#')
+        ec_and_wait(self, f"export PS1='{self.PS1}'", self.OK_CMD)
+
+    # this is just a smoketest, we don't run all the tests in the image
+    def _smoketest_kvm(self):
+        ec_and_wait(self, f"{self.KUT_BASE}/selftest-setup", self.OK_CMD)
+        ec_and_wait(self, f"{self.KUT_BASE}/selftest-smp", self.OK_CMD)
+        ec_and_wait(self, f"{self.KUT_BASE}/selftest-vectors-kernel", self.OK_CMD)
+        ec_and_wait(self, f"{self.KUT_BASE}/selftest-vectors-user", self.OK_CMD)
+
+    def test_aarch64_nvhe_selftest(self):
+        self._launch_guest("nvhe")
+        self._smoketest_kvm()
+
+    def test_aarch64_vhe_selftest(self):
+        self._launch_guest("vhe")
+        self._smoketest_kvm()
+
+if __name__ == '__main__':
+    LinuxKernelTest.main()

From 78029e9283f69140d377f589b76e369971dbe0e3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Fri, 25 Jul 2025 16:45:10 +0100
Subject: [PATCH 2637/2760] tests/tcg: skip libsyscall.so on softmmu tests
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

It isn't testing anything and just expanding the runtime of testing.

Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250725154517.3523095-8-alex.bennee@linaro.org>
---
 tests/tcg/Makefile.target | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/tests/tcg/Makefile.target b/tests/tcg/Makefile.target
index af68f11664..3d96182a7b 100644
--- a/tests/tcg/Makefile.target
+++ b/tests/tcg/Makefile.target
@@ -155,6 +155,12 @@ VPATH+=$(PLUGIN_LIB)
 # For example, libpatch.so only needs to run against the arch-specific patch
 # target test, so we explicitly run it in the arch-specific Makefile.
 DISABLE_PLUGINS=libpatch.so
+
+# Likewise don't bother with the syscall plugin for softmmu
+ifneq ($(filter %-softmmu, $(TARGET)),)
+DISABLE_PLUGINS += libsyscall.so
+endif
+
 PLUGINS=$(filter-out $(DISABLE_PLUGINS), \
 	$(patsubst %.c, lib%.so, $(notdir $(wildcard $(PLUGIN_SRC)/*.c))))
 

From a80e2c26f1cbac07d923415fecbf274ce4fa2d02 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Fri, 25 Jul 2025 16:45:11 +0100
Subject: [PATCH 2638/2760] tests/tcg: remove ADDITIONAL_PLUGINS_TESTS
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We never actually used this is the end. Remove it to enable
re-factoring.

Fixes: 7cefff22d54 (tests/tcg: add mechanism to run specific tests with plugins)
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250725154517.3523095-9-alex.bennee@linaro.org>
---
 tests/tcg/Makefile.target | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/tests/tcg/Makefile.target b/tests/tcg/Makefile.target
index 3d96182a7b..97ebe8f9bc 100644
--- a/tests/tcg/Makefile.target
+++ b/tests/tcg/Makefile.target
@@ -169,11 +169,10 @@ PLUGINS=$(filter-out $(DISABLE_PLUGINS), \
 # only expand MULTIARCH_TESTS which are common on most of our targets
 # to avoid an exponential explosion as new tests are added. We also
 # add some special helpers the run-plugin- rules can use below.
-# In more, extra tests can be added using ADDITIONAL_PLUGINS_TESTS variable.
 
 ifneq ($(MULTIARCH_TESTS),)
 $(foreach p,$(PLUGINS), \
-	$(foreach t,$(MULTIARCH_TESTS) $(ADDITIONAL_PLUGINS_TESTS),\
+	$(foreach t,$(MULTIARCH_TESTS),\
 		$(eval run-plugin-$(t)-with-$(p): $t $p) \
 		$(eval RUN_TESTS+=run-plugin-$(t)-with-$(p))))
 endif # MULTIARCH_TESTS

From ab8bf8f6e42e321dfb313cfdf95200135e9f7f8e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Fri, 25 Jul 2025 16:45:12 +0100
Subject: [PATCH 2639/2760] tests/tcg: don't include multiarch tests if not
 supported
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We are about to change the way the plugin runs are done and having
this included by default will complicate things.

Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250725154517.3523095-10-alex.bennee@linaro.org>
---
 tests/tcg/Makefile.target                          | 6 ++++++
 tests/tcg/multiarch/system/Makefile.softmmu-target | 5 +++++
 2 files changed, 11 insertions(+)

diff --git a/tests/tcg/Makefile.target b/tests/tcg/Makefile.target
index 97ebe8f9bc..a12b15637e 100644
--- a/tests/tcg/Makefile.target
+++ b/tests/tcg/Makefile.target
@@ -127,8 +127,14 @@ else
 # build options for bare programs are usually pretty different. They
 # are expected to provide their own build recipes.
 EXTRA_CFLAGS += -ffreestanding -fno-stack-protector
+
+# We skip the multiarch tests if the target hasn't provided a boot.S
+MULTIARCH_SOFTMMU_TARGETS = i386 alpha aarch64 arm loongarch64 s390x x86_64
+
+ifneq ($(filter $(TARGET_NAME),$(MULTIARCH_SOFTMMU_TARGETS)),)
 -include $(SRC_PATH)/tests/tcg/minilib/Makefile.target
 -include $(SRC_PATH)/tests/tcg/multiarch/system/Makefile.softmmu-target
+endif
 -include $(SRC_PATH)/tests/tcg/$(TARGET_NAME)/Makefile.softmmu-target
 
 endif
diff --git a/tests/tcg/multiarch/system/Makefile.softmmu-target b/tests/tcg/multiarch/system/Makefile.softmmu-target
index 07be001102..5acf270081 100644
--- a/tests/tcg/multiarch/system/Makefile.softmmu-target
+++ b/tests/tcg/multiarch/system/Makefile.softmmu-target
@@ -6,6 +6,11 @@
 # architecture to add to the test dependencies and deal with the
 # complications of building.
 #
+# To support the multiarch guests the target arch needs to provide a
+# boot.S that jumps to main and provides a __sys_outc functions.
+# Remember to update MULTIARCH_SOFTMMU_TARGETS in the tcg test
+# Makefile.target when this is done.
+#
 
 MULTIARCH_SRC=$(SRC_PATH)/tests/tcg/multiarch
 MULTIARCH_SYSTEM_SRC=$(MULTIARCH_SRC)/system

From d0aa5df7752deb4bbce34fcc625ce59fe36862be Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Fri, 25 Jul 2025 16:45:13 +0100
Subject: [PATCH 2640/2760] configure: expose PYTHON to
 test/tcg/config-host.mak
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This will be useful for making $shell calls to something more flexible
than the shell builtins.

Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250725154517.3523095-11-alex.bennee@linaro.org>
---
 configure | 1 +
 1 file changed, 1 insertion(+)

diff --git a/configure b/configure
index 95f67c1a82..825057ebf1 100755
--- a/configure
+++ b/configure
@@ -1800,6 +1800,7 @@ echo "SRC_PATH=$source_path" >> tests/tcg/$config_host_mak
 if test "$plugins" = "yes" ; then
     echo "CONFIG_PLUGIN=y" >> tests/tcg/$config_host_mak
 fi
+echo "PYTHON=$python" >> tests/tcg/$config_host_mak
 
 tcg_tests_targets=
 for target in $target_list; do

From 25aaf0cb7f13aa9e537fb6202099f142d9ffc58a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Fri, 25 Jul 2025 16:45:14 +0100
Subject: [PATCH 2641/2760] tests/tcg: reduce the number of plugin tests
 combinations
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

As our set of multiarch tests has grown the practice of running every
plugin with every test is becoming unsustainable. If we switch to
ensuring every test gets run with at least one plugin we can speed
things up.

Some plugins do need to be run with specific tests (for example the
memory instrumentation test). We can handle this by manually adding
them to EXTRA_RUNS. We also need to wrap rules in a CONFIG_PLUGIN test
so we don't enable the runs when plugins are not enabled.

Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250725154517.3523095-12-alex.bennee@linaro.org>
---
 tests/tcg/Makefile.target                     | 23 ++++++++++++++-----
 tests/tcg/multiarch/Makefile.target           |  8 +++++--
 .../multiarch/system/Makefile.softmmu-target  | 11 +++++----
 3 files changed, 30 insertions(+), 12 deletions(-)

diff --git a/tests/tcg/Makefile.target b/tests/tcg/Makefile.target
index a12b15637e..18afd5be19 100644
--- a/tests/tcg/Makefile.target
+++ b/tests/tcg/Makefile.target
@@ -173,14 +173,25 @@ PLUGINS=$(filter-out $(DISABLE_PLUGINS), \
 # We need to ensure expand the run-plugin-TEST-with-PLUGIN
 # pre-requistes manually here as we can't use stems to handle it. We
 # only expand MULTIARCH_TESTS which are common on most of our targets
-# to avoid an exponential explosion as new tests are added. We also
-# add some special helpers the run-plugin- rules can use below.
+# and rotate the plugins so we don't grow too out of control as new
+# tests are added. Plugins that need to run with a specific test
+# should ensure they add their combination to EXTRA_RUNS.
 
 ifneq ($(MULTIARCH_TESTS),)
-$(foreach p,$(PLUGINS), \
-	$(foreach t,$(MULTIARCH_TESTS),\
-		$(eval run-plugin-$(t)-with-$(p): $t $p) \
-		$(eval RUN_TESTS+=run-plugin-$(t)-with-$(p))))
+
+NUM_PLUGINS := $(words $(PLUGINS))
+NUM_TESTS := $(words $(MULTIARCH_TESTS))
+
+define mod_plus_one
+  $(shell $(PYTHON) -c "print( ($(1) % $(2)) + 1 )")
+endef
+
+$(foreach _idx, $(shell seq 1 $(NUM_TESTS)), \
+	$(eval _test := $(word $(_idx), $(MULTIARCH_TESTS))) \
+	$(eval _plugin := $(word $(call mod_plus_one, $(_idx), $(NUM_PLUGINS)), $(PLUGINS))) \
+	$(eval run-plugin-$(_test)-with-$(_plugin): $(_test) $(_plugin)) \
+	$(eval RUN_TESTS+=run-plugin-$(_test)-with-$(_plugin)))
+
 endif # MULTIARCH_TESTS
 endif # CONFIG_PLUGIN
 
diff --git a/tests/tcg/multiarch/Makefile.target b/tests/tcg/multiarch/Makefile.target
index bfdf7197a7..38345ff880 100644
--- a/tests/tcg/multiarch/Makefile.target
+++ b/tests/tcg/multiarch/Makefile.target
@@ -189,6 +189,10 @@ run-plugin-semiconsole-with-%:
 TESTS += semihosting semiconsole
 endif
 
+test-plugin-mem-access: CFLAGS+=-pthread -O0
+test-plugin-mem-access: LDFLAGS+=-pthread -O0
+
+ifeq ($(CONFIG_PLUGIN),y)
 # Test plugin memory access instrumentation
 run-plugin-test-plugin-mem-access-with-libmem.so: \
 	PLUGIN_ARGS=$(COMMA)print-accesses=true
@@ -197,8 +201,8 @@ run-plugin-test-plugin-mem-access-with-libmem.so: \
 	$(SRC_PATH)/tests/tcg/multiarch/check-plugin-output.sh \
 	$(QEMU) $<
 
-test-plugin-mem-access: CFLAGS+=-pthread -O0
-test-plugin-mem-access: LDFLAGS+=-pthread -O0
+EXTRA_RUNS += run-plugin-test-plugin-mem-access-with-libmem.so
+endif
 
 # Update TESTS
 TESTS += $(MULTIARCH_TESTS)
diff --git a/tests/tcg/multiarch/system/Makefile.softmmu-target b/tests/tcg/multiarch/system/Makefile.softmmu-target
index 5acf270081..4171b4e6aa 100644
--- a/tests/tcg/multiarch/system/Makefile.softmmu-target
+++ b/tests/tcg/multiarch/system/Makefile.softmmu-target
@@ -71,8 +71,11 @@ endif
 MULTIARCH_RUNS += run-gdbstub-memory run-gdbstub-interrupt \
 	run-gdbstub-untimely-packet run-gdbstub-registers
 
+ifeq ($(CONFIG_PLUGIN),y)
 # Test plugin memory access instrumentation
-run-plugin-memory-with-libmem.so: 		\
-	PLUGIN_ARGS=$(COMMA)region-summary=true
-run-plugin-memory-with-libmem.so: 		\
-	CHECK_PLUGIN_OUTPUT_COMMAND=$(MULTIARCH_SYSTEM_SRC)/validate-memory-counts.py $@.out
+run-plugin-memory-with-libmem.so: memory libmem.so
+run-plugin-memory-with-libmem.so: PLUGIN_ARGS=$(COMMA)region-summary=true
+run-plugin-memory-with-libmem.so: CHECK_PLUGIN_OUTPUT_COMMAND=$(MULTIARCH_SYSTEM_SRC)/validate-memory-counts.py $@.out
+
+EXTRA_RUNS += run-plugin-memory-with-libmem.so
+endif

From 408c8629105f32aa1d02d3004998ea453f69809b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Fri, 25 Jul 2025 16:45:15 +0100
Subject: [PATCH 2642/2760] tests/docker: add --arch-only to qemu deps for
 all-test-cross
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

If we want to build this container on non-x86 systems we might not
have all the cross-compilers needed for the ROM blobs we don't
actually build. Use --arch-only to avoid stalling on these missing
bits.

Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250725154517.3523095-13-alex.bennee@linaro.org>
---
 tests/docker/dockerfiles/debian-all-test-cross.docker | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/docker/dockerfiles/debian-all-test-cross.docker b/tests/docker/dockerfiles/debian-all-test-cross.docker
index 8ab244e018..5aa43749eb 100644
--- a/tests/docker/dockerfiles/debian-all-test-cross.docker
+++ b/tests/docker/dockerfiles/debian-all-test-cross.docker
@@ -15,7 +15,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
     apt-get update && \
     apt-get install -y eatmydata && \
     eatmydata apt-get dist-upgrade -y && \
-    apt build-dep -yy qemu
+    apt build-dep -yy --arch-only qemu
 
 # Add extra build tools and as many cross compilers as we can for testing
 RUN DEBIAN_FRONTEND=noninteractive eatmydata \

From 6da616bb17004f9332b2798353ebef88cac61cc2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Fri, 25 Jul 2025 16:45:16 +0100
Subject: [PATCH 2643/2760] tests/docker: handle host-arch selection for
 all-test-cross
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When building on non-x86 we get a bunch but not all of the compilers.
Handle this in the Dockerfile by probing the arch and expanding the
list available.

Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250725154517.3523095-14-alex.bennee@linaro.org>
---
 .../dockerfiles/debian-all-test-cross.docker  | 32 +++++++++++--------
 1 file changed, 18 insertions(+), 14 deletions(-)

diff --git a/tests/docker/dockerfiles/debian-all-test-cross.docker b/tests/docker/dockerfiles/debian-all-test-cross.docker
index 5aa43749eb..ef69bbc8a5 100644
--- a/tests/docker/dockerfiles/debian-all-test-cross.docker
+++ b/tests/docker/dockerfiles/debian-all-test-cross.docker
@@ -23,7 +23,9 @@ RUN DEBIAN_FRONTEND=noninteractive eatmydata \
         bison \
         ccache \
         clang  \
+        dpkg-dev \
         flex \
+        gcc \
         git \
         libclang-rt-dev \
         ninja-build \
@@ -33,16 +35,11 @@ RUN DEBIAN_FRONTEND=noninteractive eatmydata \
         python3-venv \
         python3-wheel
 
-RUN DEBIAN_FRONTEND=noninteractive eatmydata \
-        apt install -y --no-install-recommends \
-        gcc-aarch64-linux-gnu \
+# All the generally available compilers
+ENV AVAILABLE_COMPILERS gcc-aarch64-linux-gnu \
         libc6-dev-arm64-cross \
         gcc-arm-linux-gnueabihf \
         libc6-dev-armhf-cross \
-        gcc-hppa-linux-gnu \
-        libc6-dev-hppa-cross \
-        gcc-m68k-linux-gnu \
-        libc6-dev-m68k-cross \
         gcc-mips-linux-gnu \
         libc6-dev-mips-cross \
         gcc-mips64-linux-gnuabi64 \
@@ -51,18 +48,25 @@ RUN DEBIAN_FRONTEND=noninteractive eatmydata \
         libc6-dev-mips64el-cross \
         gcc-mipsel-linux-gnu \
         libc6-dev-mipsel-cross \
-        gcc-powerpc-linux-gnu \
-        libc6-dev-powerpc-cross \
-        gcc-powerpc64-linux-gnu \
-        libc6-dev-ppc64-cross \
         gcc-powerpc64le-linux-gnu \
         libc6-dev-ppc64el-cross \
         gcc-riscv64-linux-gnu \
         libc6-dev-riscv64-cross \
         gcc-s390x-linux-gnu \
-        libc6-dev-s390x-cross \
-        gcc-sparc64-linux-gnu \
-        libc6-dev-sparc64-cross && \
+        libc6-dev-s390x-cross
+
+RUN if dpkg-architecture -e amd64; then \
+  export AVAILABLE_COMPILERS="${AVAILABLE_COMPILERS} gcc-hppa-linux-gnu libc6-dev-hppa-cross"; \
+  export AVAILABLE_COMPILERS="${AVAILABLE_COMPILERS} gcc-m68k-linux-gnu libc6-dev-m68k-cross"; \
+  export AVAILABLE_COMPILERS="${AVAILABLE_COMPILERS} gcc-powerpc-linux-gnu libc6-dev-powerpc-cross"; \
+  export AVAILABLE_COMPILERS="${AVAILABLE_COMPILERS} gcc-powerpc64-linux-gnu libc6-dev-ppc64-cross"; \
+  export AVAILABLE_COMPILERS="${AVAILABLE_COMPILERS} gcc-sparc64-linux-gnu libc6-dev-sparc64-cross"; \
+  fi && \
+  echo "compilers: ${AVAILABLE_COMPILERS}"
+
+RUN DEBIAN_FRONTEND=noninteractive eatmydata \
+        apt install -y --no-install-recommends \
+        ${AVAILABLE_COMPILERS} && \
         dpkg-query --showformat '${Package}_${Version}_${Architecture}\n' --show > /packages.txt
 
 

From cac08383f06dc378afb23913d65a95442bbd5516 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Fri, 25 Jul 2025 16:45:17 +0100
Subject: [PATCH 2644/2760] tests/functional: expose sys.argv to unittest.main
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

With this we can call the supported we can take advantage of the
argument the module supports:

  env PYTHONPATH=/home/alex/lsrc/qemu.git/python:/home/alex/lsrc/qemu.git/tests/functional ./pyvenv/bin/python /home/alex/lsrc/qemu.git/tests/functional/test_aarch64_kvm.py --help
  usage: test_aarch64_kvm.py [-h] [-v] [-q] [--locals] [--durations N] [-f] [-c] [-b] [-k TESTNAMEPATTERNS] [tests ...]

  positional arguments:
    tests                a list of any number of test modules, classes and test methods.

  options:
    -h, --help           show this help message and exit
    -v, --verbose        Verbose output
    -q, --quiet          Quiet output
    --locals             Show local variables in tracebacks
    --durations N        Show the N slowest test cases (N=0 for all)
    -f, --failfast       Stop on first fail or error
    -c, --catch          Catch Ctrl-C and display results so far
    -b, --buffer         Buffer stdout and stderr during tests
    -k TESTNAMEPATTERNS  Only run tests which match the given substring

  Examples:
    test_aarch64_kvm.py test_module               - run tests from test_module
    test_aarch64_kvm.py module.TestClass          - run tests from module.TestClass
    test_aarch64_kvm.py module.Class.test_method  - run specified test method
    test_aarch64_kvm.py path/to/test_file.py      - run tests from test_file.py

  usage: test_aarch64_kvm.py discover [-h] [-v] [-q] [--locals] [--durations N] [-f] [-c] [-b] [-k TESTNAMEPATTERNS] [-s START] [-p PATTERN] [-t TOP]

  options:
    -h, --help            show this help message and exit
    -v, --verbose         Verbose output
    -q, --quiet           Quiet output
    --locals              Show local variables in tracebacks
    --durations N         Show the N slowest test cases (N=0 for all)
    -f, --failfast        Stop on first fail or error
    -c, --catch           Catch Ctrl-C and display results so far
    -b, --buffer          Buffer stdout and stderr during tests
    -k TESTNAMEPATTERNS   Only run tests which match the given substring
    -s, --start-directory START
                          Directory to start discovery ('.' default)
    -p, --pattern PATTERN
                          Pattern to match tests ('test*.py' default)
    -t, --top-level-directory TOP
                          Top level directory of project (defaults to start directory)

  For test discovery all test modules must be importable from the top level directory of the project.

Suggested-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250725154517.3523095-15-alex.bennee@linaro.org>
---
 tests/functional/qemu_test/testcase.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/functional/qemu_test/testcase.py b/tests/functional/qemu_test/testcase.py
index 2a78e735f1..5caf7b13fe 100644
--- a/tests/functional/qemu_test/testcase.py
+++ b/tests/functional/qemu_test/testcase.py
@@ -249,7 +249,7 @@ class QemuBaseTest(unittest.TestCase):
         tr = pycotap.TAPTestRunner(message_log = pycotap.LogMode.LogToError,
                                    test_output_log = pycotap.LogMode.LogToError)
         res = unittest.main(module = None, testRunner = tr, exit = False,
-                            argv=["__dummy__", path])
+                            argv=[sys.argv[0], path] + sys.argv[1:])
         for (test, message) in res.result.errors + res.result.failures:
 
             if hasattr(test, "log_filename"):

From bb743978f0aaf6aa7f7c796bae05bb9deb83b3f9 Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Thu, 17 Jul 2025 13:52:43 +0200
Subject: [PATCH 2645/2760] qga: Fix guest-network-get-route return value
 documentation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Tagged sections are only recognized at the beginning of a paragraph.
guest-network-get-route's Returns: isn't, and therefore gets rendered
as ordinary text within its paragraph:

    Retrieve information about route of network. Returns: List of route
    info of guest.

Since there is no (recognized) Returns: section, the doc generator
adds

    Return:
       [GuestNetworkRoute]

Note: only since recent commit 636c96cd77d (qapi: Fix undocumented
return values by generating something).

Insert the required blank line so that Returns: is recognized.
Result:

    Retrieve information about route of network.

    Return:
       [GuestNetworkRoute] -- List of route info of guest.

Fixes: commit 8e326d36dd16 (qga/linux: Add new api 'guest-network-get-route')
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20250717115246.3830007-2-armbru@redhat.com>
Reviewed-by: John Snow <jsnow@redhat.com>
---
 qga/qapi-schema.json | 1 +
 1 file changed, 1 insertion(+)

diff --git a/qga/qapi-schema.json b/qga/qapi-schema.json
index 6d770f7b8e..a569a14b55 100644
--- a/qga/qapi-schema.json
+++ b/qga/qapi-schema.json
@@ -1966,6 +1966,7 @@
 # @guest-network-get-route:
 #
 # Retrieve information about route of network.
+#
 # Returns: List of route info of guest.
 #
 # Since: 9.1

From d27340ff8a1036f9d174e9389dd3510083ad276d Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Thu, 17 Jul 2025 13:52:44 +0200
Subject: [PATCH 2646/2760] qga: Remove trivial "Returns:" sections
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The QAPI doc generator recently started to auto-generate return
documentation when there is no "Returns:" section (commit 636c96cd77d
"qapi: Fix undocumented return values by generating something").
Remove "Returns:" sections where the auto-generated text is obviously
no worse.  For instance, guest-info's documentation changes from

    Return:
       GuestAgentInfo -- GuestAgentInfo

to

    Return:
       GuestAgentInfo

The auto-generated returns all are in the exact same spot.

We did this for qapi/ in commit 0462da9d6b1 (qapi: remove trivial
"Returns:" sections).

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20250717115246.3830007-3-armbru@redhat.com>
Reviewed-by: John Snow <jsnow@redhat.com>
---
 qga/qapi-schema.json | 25 -------------------------
 1 file changed, 25 deletions(-)

diff --git a/qga/qapi-schema.json b/qga/qapi-schema.json
index a569a14b55..a9cc9150dc 100644
--- a/qga/qapi-schema.json
+++ b/qga/qapi-schema.json
@@ -202,8 +202,6 @@
 #
 # Get some information about the guest agent.
 #
-# Returns: @GuestAgentInfo
-#
 # Since: 0.15.0
 ##
 { 'command': 'guest-info',
@@ -285,8 +283,6 @@
 # @count: maximum number of bytes to read (default is 4KB, maximum is
 #     48MB)
 #
-# Returns: @GuestFileRead
-#
 # Since: 0.15.0
 ##
 { 'command': 'guest-file-read',
@@ -320,8 +316,6 @@
 # @count: bytes to write (actual bytes, after base64-decode), default
 #     is all content in buf-b64 buffer after base64 decoding
 #
-# Returns: @GuestFileWrite
-#
 # Since: 0.15.0
 ##
 { 'command': 'guest-file-write',
@@ -387,8 +381,6 @@
 #
 # @whence: Symbolic or numeric code for interpreting offset
 #
-# Returns: @GuestFileSeek
-#
 # Since: 0.15.0
 ##
 { 'command': 'guest-file-seek',
@@ -428,9 +420,6 @@
 #
 # Get guest fsfreeze state.
 #
-# Returns: GuestFsfreezeStatus ("thawed", "frozen", etc., as defined
-#     below)
-#
 # .. note:: This may fail to properly report the current state as a
 #    result of some other guest processes having issued an fs
 #    freeze/thaw.
@@ -749,8 +738,6 @@
 #
 # Get list of guest IP addresses, MAC addresses and netmasks.
 #
-# Returns: List of GuestNetworkInterface
-#
 # Since: 1.1
 ##
 { 'command': 'guest-network-get-interfaces',
@@ -1251,8 +1238,6 @@
 #
 # Get information relating to guest memory blocks.
 #
-# Returns: @GuestMemoryBlockInfo
-#
 # Since: 2.3
 ##
 { 'command': 'guest-get-memory-block-info',
@@ -1298,8 +1283,6 @@
 #
 # @pid: pid returned from guest-exec
 #
-# Returns: GuestExecStatus
-#
 # Since: 2.5
 ##
 { 'command': 'guest-exec-status',
@@ -1458,8 +1441,6 @@
 #
 # Retrieves the timezone information from the guest.
 #
-# Returns: A GuestTimezone dictionary.
-#
 # Since: 2.10
 ##
 { 'command': 'guest-get-timezone',
@@ -1533,8 +1514,6 @@
 #
 # Retrieve guest operating system information
 #
-# Returns: @GuestOSInfo
-#
 # Since: 2.10
 ##
 { 'command': 'guest-get-osinfo',
@@ -1604,8 +1583,6 @@
 #
 # Retrieve information about device drivers in Windows guest
 #
-# Returns: @GuestDeviceInfo
-#
 # Since: 5.2
 ##
 { 'command': 'guest-get-devices',
@@ -1633,8 +1610,6 @@
 #
 # @username: the user account to add the authorized keys
 #
-# Returns: @GuestAuthorizedKeys
-#
 # Since: 5.2
 ##
 { 'command': 'guest-ssh-get-authorized-keys',

From ef7e21964d54db7b7267c30578c3c6ec0f16ca08 Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Thu, 17 Jul 2025 13:52:45 +0200
Subject: [PATCH 2647/2760] qga: Rephrase return docs to avoid type name
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

"Returns: <description>" is rendered like

    Return: <Type> – <description>

Mentioning the type in the description again is commonly redundant.
There is just one such description.  Rephrase it not to mention the
type.

We did this for qapi/ in commit f7296f8de5c (qapi: rephrase return
docs to avoid type name).

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20250717115246.3830007-4-armbru@redhat.com>
Reviewed-by: John Snow <jsnow@redhat.com>
---
 qga/qapi-schema.json | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/qga/qapi-schema.json b/qga/qapi-schema.json
index a9cc9150dc..6c26ace3c9 100644
--- a/qga/qapi-schema.json
+++ b/qga/qapi-schema.json
@@ -534,8 +534,7 @@
 #     discarded.  The default value is zero, meaning "discard every
 #     free block".
 #
-# Returns: A @GuestFilesystemTrimResponse which contains the status of
-#     all trimmed paths.  (since 2.4)
+# Returns: status of all trimmed paths.  (since 2.4)
 #
 # Since: 1.2
 ##

From 62e1fa22f5734d1325e3b75cdc59f02c16339330 Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Thu, 17 Jul 2025 13:52:46 +0200
Subject: [PATCH 2648/2760] qga: Add cross-references
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Enclose command and type names in `backquotes`, so they become links
in generated HTML.

We did this for qapi/ in merge commit 504632dcc631.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20250717115246.3830007-5-armbru@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: John Snow <jsnow@redhat.com>
---
 qga/qapi-schema.json | 80 ++++++++++++++++++++++----------------------
 1 file changed, 40 insertions(+), 40 deletions(-)

diff --git a/qga/qapi-schema.json b/qga/qapi-schema.json
index 6c26ace3c9..8162d888bb 100644
--- a/qga/qapi-schema.json
+++ b/qga/qapi-schema.json
@@ -96,11 +96,11 @@
 # In cases where a partial stale response was previously received by
 # the client, this cannot always be done reliably.  One particular
 # scenario being if qemu-ga responses are fed character-by-character
-# into a JSON parser.  In these situations, using guest-sync-delimited
+# into a JSON parser.  In these situations, using `guest-sync-delimited`
 # may be optimal.
 #
 # For clients that fetch responses line by line and convert them to
-# JSON objects, guest-sync should be sufficient, but note that in
+# JSON objects, `guest-sync` should be sufficient, but note that in
 # cases where the channel is dirty some attempts at parsing the
 # response may result in a parser error.
 #
@@ -217,7 +217,7 @@
 #
 # This command does NOT return a response on success.  Success
 # condition is indicated by the VM exiting with a zero exit status or,
-# when running with --no-shutdown, by issuing the query-status QMP
+# when running with --no-shutdown, by issuing the `query-status` QMP
 # command to confirm the VM status is "shutdown".
 #
 # Since: 0.15.0
@@ -247,7 +247,7 @@
 #
 # Close an open file in the guest
 #
-# @handle: filehandle returned by guest-file-open
+# @handle: filehandle returned by `guest-file-open`
 #
 # Since: 0.15.0
 ##
@@ -278,7 +278,7 @@
 # As this command is just for limited, ad-hoc debugging, such as log
 # file access, the number of bytes to read is limited to 48 MB.
 #
-# @handle: filehandle returned by guest-file-open
+# @handle: filehandle returned by `guest-file-open`
 #
 # @count: maximum number of bytes to read (default is 4KB, maximum is
 #     48MB)
@@ -309,7 +309,7 @@
 #
 # Write to an open file in the guest.
 #
-# @handle: filehandle returned by guest-file-open
+# @handle: filehandle returned by `guest-file-open`
 #
 # @buf-b64: base64-encoded string representing data to be written
 #
@@ -340,7 +340,7 @@
 ##
 # @QGASeek:
 #
-# Symbolic names for use in @guest-file-seek
+# Symbolic names for use in `guest-file-seek`
 #
 # @set: Set to the specified offset (same effect as 'whence':0)
 #
@@ -355,7 +355,7 @@
 ##
 # @GuestFileWhence:
 #
-# Controls the meaning of offset to @guest-file-seek.
+# Controls the meaning of offset to `guest-file-seek`.
 #
 # @value: Integral value (0 for set, 1 for cur, 2 for end), available
 #     for historical reasons, and might differ from the host's or
@@ -375,7 +375,7 @@
 # current file position afterward.  Also encapsulates ftell()'s
 # functionality, with offset=0 and whence=1.
 #
-# @handle: filehandle returned by guest-file-open
+# @handle: filehandle returned by `guest-file-open`
 #
 # @offset: bytes to skip over in the file stream
 #
@@ -393,7 +393,7 @@
 #
 # Write file changes buffered in userspace to disk/kernel buffers
 #
-# @handle: filehandle returned by guest-file-open
+# @handle: filehandle returned by `guest-file-open`
 #
 # Since: 0.15.0
 ##
@@ -434,12 +434,12 @@
 # @guest-fsfreeze-freeze:
 #
 # Sync and freeze all freezable, local guest filesystems.  If this
-# command succeeded, you may call @guest-fsfreeze-thaw later to
+# command succeeded, you may call `guest-fsfreeze-thaw` later to
 # unfreeze.
 #
 # On error, all filesystems will be thawed.  If no filesystems are
-# frozen as a result of this call, then @guest-fsfreeze-status will
-# remain "thawed" and calling @guest-fsfreeze-thaw is not necessary.
+# frozen as a result of this call, then `guest-fsfreeze-status` will
+# remain "thawed" and calling `guest-fsfreeze-thaw` is not necessary.
 #
 # Returns: Number of file systems currently frozen.
 #
@@ -457,7 +457,7 @@
 # @guest-fsfreeze-freeze-list:
 #
 # Sync and freeze specified guest filesystems.  See also
-# @guest-fsfreeze-freeze.
+# `guest-fsfreeze-freeze`.
 #
 # On error, all filesystems will be thawed.
 #
@@ -482,7 +482,7 @@
 # Returns: Number of file systems thawed by this call
 #
 # .. note:: If the return value does not match the previous call to
-#    guest-fsfreeze-freeze, this likely means some freezable filesystems
+#    `guest-fsfreeze-freeze`, this likely means some freezable filesystems
 #    were unfrozen before this call, and that the filesystem state may
 #    have changed before issuing this command.
 #
@@ -513,7 +513,7 @@
 ##
 # @GuestFilesystemTrimResponse:
 #
-# @paths: list of @GuestFilesystemTrimResult per path that was trimmed
+# @paths: list of `GuestFilesystemTrimResult` per path that was trimmed
 #
 # Since: 2.4
 ##
@@ -557,7 +557,7 @@
 #
 # This command does NOT return a response on success.  There is a high
 # chance the command succeeded if the VM exits with a zero exit status
-# or, when running with --no-shutdown, by issuing the query-status QMP
+# or, when running with --no-shutdown, by issuing the `query-status` QMP
 # command to to confirm the VM status is "shutdown". However, the VM
 # could also exit (or set its status to "shutdown") due to other
 # reasons.
@@ -565,7 +565,7 @@
 # Errors:
 #     - If suspend to disk is not supported, Unsupported
 #
-# .. note:: It's strongly recommended to issue the guest-sync command
+# .. note:: It's strongly recommended to issue the `guest-sync` command
 #    before sending commands when the guest resumes.
 #
 # Since: 1.1
@@ -585,8 +585,8 @@
 # - pm-utils (via pm-hibernate)
 # - manual write into sysfs
 #
-# IMPORTANT: guest-suspend-ram requires working wakeup support in
-# QEMU. You should check QMP command query-current-machine returns
+# IMPORTANT: `guest-suspend-ram` requires working wakeup support in
+# QEMU. You should check QMP command `query-current-machine` returns
 # wakeup-suspend-support: true before issuing this command.  Failure
 # in doing so can result in a suspended guest that QEMU will not be
 # able to awaken, forcing the user to power cycle the guest to bring
@@ -595,14 +595,14 @@
 # This command does NOT return a response on success.  There are two
 # options to check for success:
 #
-# 1. Wait for the SUSPEND QMP event from QEMU
-# 2. Issue the query-status QMP command to confirm the VM status is
+# 1. Wait for the `SUSPEND` QMP event from QEMU
+# 2. Issue the `query-status` QMP command to confirm the VM status is
 #    "suspended"
 #
 # Errors:
 #     - If suspend to ram is not supported, Unsupported
 #
-# .. note:: It's strongly recommended to issue the guest-sync command
+# .. note:: It's strongly recommended to issue the `guest-sync` command
 #    before sending commands when the guest resumes.
 #
 # Since: 1.1
@@ -621,8 +621,8 @@
 # - systemd hybrid-sleep
 # - pm-utils (via pm-suspend-hybrid)
 #
-# IMPORTANT: guest-suspend-hybrid requires working wakeup support in
-# QEMU. You should check QMP command query-current-machine returns
+# IMPORTANT: `guest-suspend-hybrid` requires working wakeup support in
+# QEMU. You should check QMP command `query-current-machine` returns
 # wakeup-suspend-support: true before issuing this command.  Failure
 # in doing so can result in a suspended guest that QEMU will not be
 # able to awaken, forcing the user to power cycle the guest to bring
@@ -631,14 +631,14 @@
 # This command does NOT return a response on success.  There are two
 # options to check for success:
 #
-# 1. Wait for the SUSPEND QMP event from QEMU
-# 2. Issue the query-status QMP command to confirm the VM status is
+# 1. Wait for the `SUSPEND` QMP event from QEMU
+# 2. Issue the `query-status` QMP command to confirm the VM status is
 #    "suspended"
 #
 # Errors:
 #     - If hybrid suspend is not supported, Unsupported
 #
-# .. note:: It's strongly recommended to issue the guest-sync command
+# .. note:: It's strongly recommended to issue the `guest-sync` command
 #    before sending commands when the guest resumes.
 #
 # Since: 1.1
@@ -793,7 +793,7 @@
 #     There's no restriction on list length or on repeating the same
 #     @logical-id (with possibly different @online field).  Preferably
 #     the input list should describe a modified subset of
-#     @guest-get-vcpus' return value.
+#     `guest-get-vcpus`' return value.
 #
 # Returns: The length of the initial sublist that has been
 #     successfully processed.  The guest agent maximizes this value.
@@ -1069,7 +1069,7 @@
 #
 # Returns: The list of filesystems information mounted in the guest.
 #     The returned mountpoints may be specified to
-#     @guest-fsfreeze-freeze-list.  Network filesystems (such as CIFS
+#     `guest-fsfreeze-freeze-list`.  Network filesystems (such as CIFS
 #     and NFS) are not listed.
 #
 # Since: 2.2
@@ -1171,7 +1171,7 @@
 ##
 # @GuestMemoryBlockResponse:
 #
-# @phys-index: same with the 'phys-index' member of @GuestMemoryBlock.
+# @phys-index: same with the 'phys-index' member of `GuestMemoryBlock`.
 #
 # @response: the result of memory block operation.
 #
@@ -1201,11 +1201,11 @@
 #     guest-supported identifiers.  There's no restriction on list
 #     length or on repeating the same @phys-index (with possibly
 #     different @online field).  Preferably the input list should
-#     describe a modified subset of @guest-get-memory-blocks' return
+#     describe a modified subset of `guest-get-memory-blocks`' return
 #     value.
 #
 # Returns: The operation results, it is a list of
-#     @GuestMemoryBlockResponse, which is corresponding to the input
+#     `GuestMemoryBlockResponse`, which is corresponding to the input
 #     list.
 #
 #     Note: it will return an empty list if the @mem-blks list was
@@ -1258,7 +1258,7 @@
 #
 # @err-data: base64-encoded stderr of the process.  Note: @out-data
 #     and @err-data are present only if 'capture-output' was specified
-#     for 'guest-exec'.  This field will only be populated after the
+#     for `guest-exec`.  This field will only be populated after the
 #     process exits.
 #
 # @out-truncated: true if stdout was not fully captured due to size
@@ -1277,10 +1277,10 @@
 # @guest-exec-status:
 #
 # Check status of process associated with PID retrieved via
-# guest-exec.  Reap the process and associated metadata if it has
+# `guest-exec`.  Reap the process and associated metadata if it has
 # exited.
 #
-# @pid: pid returned from guest-exec
+# @pid: pid returned from `guest-exec`
 #
 # Since: 2.5
 ##
@@ -1301,7 +1301,7 @@
 ##
 # @GuestExecCaptureOutputMode:
 #
-# An enumeration of guest-exec capture modes.
+# An enumeration of `guest-exec` capture modes.
 #
 # @none: do not capture any output
 #
@@ -1310,7 +1310,7 @@
 # @stderr: only capture stderr
 #
 # @separated: capture both stdout and stderr, but separated into
-#     GuestExecStatus out-data and err-data, respectively
+#     `GuestExecStatus` out-data and err-data, respectively
 #
 # @merged: capture both stdout and stderr, but merge together into
 #     out-data.  Not effective on windows guests.
@@ -1324,10 +1324,10 @@
 ##
 # @GuestExecCaptureOutput:
 #
-# Controls what guest-exec output gets captures.
+# Controls what `guest-exec` output gets captures.
 #
 # @flag: captures both stdout and stderr if true.  Equivalent to
-#     GuestExecCaptureOutputMode::all.  (since 2.5)
+#     `GuestExecCaptureOutputMode`::all.  (since 2.5)
 #
 # @mode: capture mode; preferred interface
 #

From 1ebdd2d92611a573f9fcdf0fc7f31b1efd07ac30 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Wed, 23 Jul 2025 08:27:14 +0200
Subject: [PATCH 2649/2760] hw/i386: Fix 'use-legacy-x86-rom' property
 compatibility
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Commit 350785d41d8b ("ramfb: Add property to control if load the
romfile") introduced the `use-legacy-x86-rom` property for the
`vfio-pci-nohotplug` device, allowing control over VGA BIOS ROM
loading. However, the property compatibility setting was incorrectly
applied to the `vfio-pci` device instead, which causes all `vfio-pci`
devices to fail to load. This change fixes the issue by ensuring the
property is set on the correct device.

Fixes: d5fcf0d960d8 ("hw/i386: Add the ramfb romfile compatibility")
Cc: Gerd Hoffmann <kraxel@redhat.com>
Cc: Shaoqin Huang <shahuang@redhat.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250723062714.1245826-1-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/core/machine.c | 2 +-
 hw/i386/microvm.c | 2 +-
 hw/i386/pc_piix.c | 2 +-
 hw/i386/pc_q35.c  | 2 +-
 hw/vfio/pci.c     | 2 --
 hw/vfio/types.h   | 2 ++
 6 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/hw/core/machine.c b/hw/core/machine.c
index d6b2240fc2..bd47527479 100644
--- a/hw/core/machine.c
+++ b/hw/core/machine.c
@@ -41,7 +41,7 @@ GlobalProperty hw_compat_10_0[] = {
     { "scsi-hd", "dpofua", "off" },
     { "vfio-pci", "x-migration-load-config-after-iter", "off" },
     { "ramfb", "use-legacy-x86-rom", "true"},
-    { "vfio-pci", "use-legacy-x86-rom", "true" },
+    { "vfio-pci-nohotplug", "use-legacy-x86-rom", "true" },
 };
 const size_t hw_compat_10_0_len = G_N_ELEMENTS(hw_compat_10_0);
 
diff --git a/hw/i386/microvm.c b/hw/i386/microvm.c
index d90b69a162..94d22a232a 100644
--- a/hw/i386/microvm.c
+++ b/hw/i386/microvm.c
@@ -635,7 +635,7 @@ GlobalProperty microvm_properties[] = {
      */
     { "pcie-root-port", "io-reserve", "0" },
     { TYPE_RAMFB_DEVICE, "use-legacy-x86-rom", "true" },
-    { TYPE_VFIO_PCI, "use-legacy-x86-rom", "true" },
+    { TYPE_VFIO_PCI_NOHOTPLUG, "use-legacy-x86-rom", "true" },
 };
 
 static void microvm_class_init(ObjectClass *oc, const void *data)
diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
index ad5caff3a5..c03324281b 100644
--- a/hw/i386/pc_piix.c
+++ b/hw/i386/pc_piix.c
@@ -80,7 +80,7 @@ static const int ide_irq[MAX_IDE_BUS] = { 14, 15 };
 
 static GlobalProperty pc_piix_compat_defaults[] = {
     { TYPE_RAMFB_DEVICE, "use-legacy-x86-rom", "true" },
-    { TYPE_VFIO_PCI, "use-legacy-x86-rom", "true" },
+    { TYPE_VFIO_PCI_NOHOTPLUG, "use-legacy-x86-rom", "true" },
 };
 static const size_t pc_piix_compat_defaults_len =
     G_N_ELEMENTS(pc_piix_compat_defaults);
diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
index 9b9519fa02..b309b2b378 100644
--- a/hw/i386/pc_q35.c
+++ b/hw/i386/pc_q35.c
@@ -69,7 +69,7 @@
 static GlobalProperty pc_q35_compat_defaults[] = {
     { TYPE_VIRTIO_IOMMU_PCI, "aw-bits", "39" },
     { TYPE_RAMFB_DEVICE, "use-legacy-x86-rom", "true" },
-    { TYPE_VFIO_PCI, "use-legacy-x86-rom", "true" },
+    { TYPE_VFIO_PCI_NOHOTPLUG, "use-legacy-x86-rom", "true" },
 };
 static const size_t pc_q35_compat_defaults_len =
     G_N_ELEMENTS(pc_q35_compat_defaults);
diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index e72d514a4c..0c4606d9cb 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -49,8 +49,6 @@
 #include "vfio-migration-internal.h"
 #include "vfio-helpers.h"
 
-#define TYPE_VFIO_PCI_NOHOTPLUG "vfio-pci-nohotplug"
-
 /* Protected by BQL */
 static KVMRouteChange vfio_route_change;
 
diff --git a/hw/vfio/types.h b/hw/vfio/types.h
index fa20c29b9f..c19334ff25 100644
--- a/hw/vfio/types.h
+++ b/hw/vfio/types.h
@@ -18,4 +18,6 @@
 #define TYPE_VFIO_PCI "vfio-pci"
 /* TYPE_VFIO_PCI shares struct VFIOPCIDevice. */
 
+#define TYPE_VFIO_PCI_NOHOTPLUG "vfio-pci-nohotplug"
+
 #endif /* HW_VFIO_VFIO_TYPES_H */

From 1dc1220fbd30a200aea972fc3aa53d439aff466b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Wed, 16 Jul 2025 09:15:54 +0200
Subject: [PATCH 2650/2760] i386: Build SEV only for 64-bit target
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Recent changes broke build on 32-bit host. Since there is no 32-bit
support, restrict SEV to 64-bit.

Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250716071554.377356-1-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/i386/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/i386/Kconfig b/hw/i386/Kconfig
index 14d23e27b5..5139d23087 100644
--- a/hw/i386/Kconfig
+++ b/hw/i386/Kconfig
@@ -4,7 +4,7 @@ config X86_FW_OVMF
 config SEV
     bool
     select X86_FW_OVMF
-    depends on KVM
+    depends on KVM && X86_64
 
 config SGX
     bool

From 9751377c3a9445f597c5d0bf134a79c8cb58e45d Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Mon, 14 Jul 2025 12:21:30 -0700
Subject: [PATCH 2651/2760] vfio: fix sub-page bar after cpr
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Regions for sub-page BARs are normally mapped here, in response to the
guest writing to PCI config space:

  vfio_pci_write_config()
    pci_default_write_config()
      pci_update_mappings()
        memory_region_add_subregion()
    vfio_sub_page_bar_update_mapping()
      ... vfio_dma_map()

However, after CPR, the guest does not reconfigure the device and the
code path above is not taken.  To fix, in vfio_cpr_pci_post_load, call
vfio_sub_page_bar_update_mapping for each sub-page BAR with a valid
address.

Fixes: 7e9f21411302 ("vfio/container: restore DMA vaddr")

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Link: https://lore.kernel.org/qemu-devel/1752520890-223356-1-git-send-email-steven.sistare@oracle.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/cpr.c |  2 ++
 hw/vfio/pci.c | 14 ++++++++++++++
 hw/vfio/pci.h |  1 +
 3 files changed, 17 insertions(+)

diff --git a/hw/vfio/cpr.c b/hw/vfio/cpr.c
index af0f12a7ad..384b56c4c7 100644
--- a/hw/vfio/cpr.c
+++ b/hw/vfio/cpr.c
@@ -116,6 +116,8 @@ static int vfio_cpr_pci_post_load(void *opaque, int version_id)
     PCIDevice *pdev = &vdev->pdev;
     int nr_vectors;
 
+    vfio_sub_page_bar_update_mappings(vdev);
+
     if (msix_enabled(pdev)) {
         vfio_pci_msix_set_notifiers(vdev);
         nr_vectors = vdev->msix->entries;
diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index 0c4606d9cb..f5bc5359eb 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -2824,6 +2824,20 @@ static int vfio_pci_load_config(VFIODevice *vbasedev, QEMUFile *f)
     return ret;
 }
 
+void vfio_sub_page_bar_update_mappings(VFIOPCIDevice *vdev)
+{
+    PCIDevice *pdev = &vdev->pdev;
+    int page_size = qemu_real_host_page_size();
+    int bar;
+
+    for (bar = 0; bar < PCI_ROM_SLOT; bar++) {
+        PCIIORegion *r = &pdev->io_regions[bar];
+        if (r->addr != PCI_BAR_UNMAPPED && r->size > 0 && r->size < page_size) {
+            vfio_sub_page_bar_update_mapping(pdev, bar);
+        }
+    }
+}
+
 static VFIODeviceOps vfio_pci_ops = {
     .vfio_compute_needs_reset = vfio_pci_compute_needs_reset,
     .vfio_hot_reset_multi = vfio_pci_hot_reset_multi,
diff --git a/hw/vfio/pci.h b/hw/vfio/pci.h
index 248e5c4b16..bca289035a 100644
--- a/hw/vfio/pci.h
+++ b/hw/vfio/pci.h
@@ -219,6 +219,7 @@ void vfio_pci_write_config(PCIDevice *pdev,
 uint64_t vfio_vga_read(void *opaque, hwaddr addr, unsigned size);
 void vfio_vga_write(void *opaque, hwaddr addr, uint64_t data, unsigned size);
 
+void vfio_sub_page_bar_update_mappings(VFIOPCIDevice *vdev);
 bool vfio_opt_rom_in_denylist(VFIOPCIDevice *vdev);
 bool vfio_config_quirk_setup(VFIOPCIDevice *vdev, Error **errp);
 void vfio_vga_quirk_setup(VFIOPCIDevice *vdev);

From e0b33efe2acc3c6c651bb761394ef597e763e349 Mon Sep 17 00:00:00 2001
From: Tomita Moeko <tomitamoeko@gmail.com>
Date: Thu, 24 Jul 2025 00:09:05 +0800
Subject: [PATCH 2652/2760] vfio/igd: Require host VGA decode for legacy mode
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Commit a59d06305fff ("vfio/pci: Introduce x-pci-class-code option")
allows user to expose non-VGA IGD device as VGA controller to the
guest. However, legacy mode requires host VGA range access. Check
that GGC.IVD == 0 before enabling legacy mode to ensure IGD is a real
VGA device claiming host VGA ranges.

Signed-off-by: Tomita Moeko <tomitamoeko@gmail.com>
Reviewed-by: Alex Williamson <alex.williamson@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250723160906.44941-2-tomitamoeko@gmail.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 docs/igd-assign.txt |  1 +
 hw/vfio/igd.c       | 11 ++++++-----
 2 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/docs/igd-assign.txt b/docs/igd-assign.txt
index af4e8391fc..e54040335b 100644
--- a/docs/igd-assign.txt
+++ b/docs/igd-assign.txt
@@ -48,6 +48,7 @@ Intel document [1] shows how to dump VBIOS to file. For UEFI Option ROM, see
 QEMU also provides a "Legacy" mode that implicitly enables full functionality
 on IGD, it is automatically enabled when
 * IGD generation is 6 to 9 (Sandy Bridge to Comet Lake)
+* IGD claims VGA cycles on host (IGD is VGA controller on host)
 * Machine type is i440fx
 * IGD is assigned to guest BDF 00:02.0
 * ROM BAR or romfile is present
diff --git a/hw/vfio/igd.c b/hw/vfio/igd.c
index e7a9d1ffc1..5b1ad1a804 100644
--- a/hw/vfio/igd.c
+++ b/hw/vfio/igd.c
@@ -113,6 +113,7 @@ static int igd_gen(VFIOPCIDevice *vdev)
 #define IGD_BDSM 0x5c /* Base Data of Stolen Memory */
 #define IGD_BDSM_GEN11 0xc0 /* Base Data of Stolen Memory of gen 11 and later */
 
+#define IGD_GMCH_VGA_DISABLE        BIT(1)
 #define IGD_GMCH_GEN6_GMS_SHIFT     3       /* SNB_GMCH in i915 */
 #define IGD_GMCH_GEN6_GMS_MASK      0x1f
 #define IGD_GMCH_GEN8_GMS_SHIFT     8       /* BDW_GMCH in i915 */
@@ -533,12 +534,14 @@ static bool vfio_pci_igd_config_quirk(VFIOPCIDevice *vdev, Error **errp)
     /*
      * For backward compatibility, enable legacy mode when
      * - Device geneation is 6 to 9 (including both)
+     * - IGD claims VGA cycles on host
      * - Machine type is i440fx (pc_piix)
      * - IGD device is at guest BDF 00:02.0
      * - Not manually disabled by x-igd-legacy-mode=off
      */
     if ((vdev->igd_legacy_mode != ON_OFF_AUTO_OFF) &&
         (gen >= 6 && gen <= 9) &&
+        !(gmch & IGD_GMCH_VGA_DISABLE) &&
         !strcmp(MACHINE_GET_CLASS(qdev_get_machine())->family, "pc_piix") &&
         (&vdev->pdev == pci_find_device(pci_device_root_bus(&vdev->pdev),
         0, PCI_DEVFN(0x2, 0)))) {
@@ -568,12 +571,10 @@ static bool vfio_pci_igd_config_quirk(VFIOPCIDevice *vdev, Error **errp)
         }
 
         /*
-         * If IGD VGA Disable is clear (expected) and VGA is not already
-         * enabled, try to enable it. Probably shouldn't be using legacy mode
-         * without VGA, but also no point in us enabling VGA if disabled in
-         * hardware.
+         * If VGA is not already enabled, try to enable it. We shouldn't be
+         * using legacy mode without VGA.
          */
-        if (!(gmch & 0x2) && !vdev->vga && !vfio_populate_vga(vdev, &err)) {
+        if (!vdev->vga && !vfio_populate_vga(vdev, &err)) {
             error_setg(&err, "Unable to enable VGA access");
             goto error;
         }

From 0db7e4cb62026196f06755c77f943294d9879e5a Mon Sep 17 00:00:00 2001
From: Tomita Moeko <tomitamoeko@gmail.com>
Date: Thu, 24 Jul 2025 00:09:06 +0800
Subject: [PATCH 2653/2760] vfio/igd: Fix VGA regions are not exposed in legacy
 mode
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In commit a59d06305fff ("vfio/pci: Introduce x-pci-class-code option"),
pci_register_vga() has been moved ouside of vfio_populate_vga(). As a
result, IGD VGA ranges are no longer properly exposed to guest.

To fix this, call pci_register_vga() after vfio_populate_vga() legacy
mode. A wrapper function vfio_pci_config_register_vga() is introduced
to handle it.

Fixes: a59d06305fff ("vfio/pci: Introduce x-pci-class-code option")
Signed-off-by: Tomita Moeko <tomitamoeko@gmail.com>
Reviewed-by: Alex Williamson <alex.williamson@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250723160906.44941-3-tomitamoeko@gmail.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/igd.c | 10 +++++++---
 hw/vfio/pci.c | 13 ++++++++++---
 hw/vfio/pci.h |  1 +
 3 files changed, 18 insertions(+), 6 deletions(-)

diff --git a/hw/vfio/igd.c b/hw/vfio/igd.c
index 5b1ad1a804..ee0767b0b8 100644
--- a/hw/vfio/igd.c
+++ b/hw/vfio/igd.c
@@ -574,9 +574,13 @@ static bool vfio_pci_igd_config_quirk(VFIOPCIDevice *vdev, Error **errp)
          * If VGA is not already enabled, try to enable it. We shouldn't be
          * using legacy mode without VGA.
          */
-        if (!vdev->vga && !vfio_populate_vga(vdev, &err)) {
-            error_setg(&err, "Unable to enable VGA access");
-            goto error;
+        if (!vdev->vga) {
+            if (vfio_populate_vga(vdev, &err)) {
+                vfio_pci_config_register_vga(vdev);
+            } else {
+                error_setg(&err, "Unable to enable VGA access");
+                goto error;
+            }
         }
 
         /* Enable OpRegion and LPC bridge quirk */
diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index f5bc5359eb..4fa692c1a3 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -3162,6 +3162,15 @@ static void vfio_unregister_req_notifier(VFIOPCIDevice *vdev)
     vdev->req_enabled = false;
 }
 
+void vfio_pci_config_register_vga(VFIOPCIDevice *vdev)
+{
+    assert(vdev->vga != NULL);
+
+    pci_register_vga(&vdev->pdev, &vdev->vga->region[QEMU_PCI_VGA_MEM].mem,
+                     &vdev->vga->region[QEMU_PCI_VGA_IO_LO].mem,
+                     &vdev->vga->region[QEMU_PCI_VGA_IO_HI].mem);
+}
+
 bool vfio_pci_config_setup(VFIOPCIDevice *vdev, Error **errp)
 {
     PCIDevice *pdev = &vdev->pdev;
@@ -3283,9 +3292,7 @@ bool vfio_pci_config_setup(VFIOPCIDevice *vdev, Error **errp)
     vfio_bars_register(vdev);
 
     if (vdev->vga && vfio_is_vga(vdev)) {
-        pci_register_vga(&vdev->pdev, &vdev->vga->region[QEMU_PCI_VGA_MEM].mem,
-                         &vdev->vga->region[QEMU_PCI_VGA_IO_LO].mem,
-                         &vdev->vga->region[QEMU_PCI_VGA_IO_HI].mem);
+        vfio_pci_config_register_vga(vdev);
     }
 
     return true;
diff --git a/hw/vfio/pci.h b/hw/vfio/pci.h
index bca289035a..81465a8214 100644
--- a/hw/vfio/pci.h
+++ b/hw/vfio/pci.h
@@ -253,6 +253,7 @@ extern const VMStateDescription vfio_display_vmstate;
 
 void vfio_pci_bars_exit(VFIOPCIDevice *vdev);
 bool vfio_pci_add_capabilities(VFIOPCIDevice *vdev, Error **errp);
+void vfio_pci_config_register_vga(VFIOPCIDevice *vdev);
 bool vfio_pci_config_setup(VFIOPCIDevice *vdev, Error **errp);
 bool vfio_pci_interrupt_setup(VFIOPCIDevice *vdev, Error **errp);
 void vfio_pci_intx_eoi(VFIODevice *vbasedev);

From e895095c78ab877d40df2dd31ee79d85757d963b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <f4bug@amsat.org>
Date: Tue, 27 Apr 2021 15:33:37 +0200
Subject: [PATCH 2654/2760] target/mips: Only update MVPControl.EVP bit if
 executed by master VPE
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

According to the 'MIPS MT Application-Specific Extension' manual:

  If the VPE executing the instruction is not a Master VPE,
  with the MVP bit of the VPEConf0 register set, the EVP bit
  is unchanged by the instruction.

Modify the DVPE/EVPE opcodes to only update the MVPControl.EVP bit
if executed on a master VPE.

Cc: qemu-stable@nongnu.org
Reported-by: Hansni Bu
Buglink: https://bugs.launchpad.net/qemu/+bug/1926277
Fixes: f249412c749 ("mips: Add MT halting and waking of VPEs")
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
Message-ID: <20210427133343.159718-1-f4bug@amsat.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/mips/tcg/system/cp0_helper.c | 32 ++++++++++++++++-------------
 1 file changed, 18 insertions(+), 14 deletions(-)

diff --git a/target/mips/tcg/system/cp0_helper.c b/target/mips/tcg/system/cp0_helper.c
index 101b1e65fd..b69e70d7fc 100644
--- a/target/mips/tcg/system/cp0_helper.c
+++ b/target/mips/tcg/system/cp0_helper.c
@@ -1562,12 +1562,14 @@ target_ulong helper_dvpe(CPUMIPSState *env)
     CPUState *other_cs = first_cpu;
     target_ulong prev = env->mvp->CP0_MVPControl;
 
-    CPU_FOREACH(other_cs) {
-        MIPSCPU *other_cpu = MIPS_CPU(other_cs);
-        /* Turn off all VPEs except the one executing the dvpe.  */
-        if (&other_cpu->env != env) {
-            other_cpu->env.mvp->CP0_MVPControl &= ~(1 << CP0MVPCo_EVP);
-            mips_vpe_sleep(other_cpu);
+    if (env->CP0_VPEConf0 & (1 << CP0VPEC0_MVP)) {
+        CPU_FOREACH(other_cs) {
+            MIPSCPU *other_cpu = MIPS_CPU(other_cs);
+            /* Turn off all VPEs except the one executing the dvpe.  */
+            if (&other_cpu->env != env) {
+                other_cpu->env.mvp->CP0_MVPControl &= ~(1 << CP0MVPCo_EVP);
+                mips_vpe_sleep(other_cpu);
+            }
         }
     }
     return prev;
@@ -1578,15 +1580,17 @@ target_ulong helper_evpe(CPUMIPSState *env)
     CPUState *other_cs = first_cpu;
     target_ulong prev = env->mvp->CP0_MVPControl;
 
-    CPU_FOREACH(other_cs) {
-        MIPSCPU *other_cpu = MIPS_CPU(other_cs);
+    if (env->CP0_VPEConf0 & (1 << CP0VPEC0_MVP)) {
+        CPU_FOREACH(other_cs) {
+            MIPSCPU *other_cpu = MIPS_CPU(other_cs);
 
-        if (&other_cpu->env != env
-            /* If the VPE is WFI, don't disturb its sleep.  */
-            && !mips_vpe_is_wfi(other_cpu)) {
-            /* Enable the VPE.  */
-            other_cpu->env.mvp->CP0_MVPControl |= (1 << CP0MVPCo_EVP);
-            mips_vpe_wake(other_cpu); /* And wake it up.  */
+            if (&other_cpu->env != env
+                /* If the VPE is WFI, don't disturb its sleep.  */
+                && !mips_vpe_is_wfi(other_cpu)) {
+                /* Enable the VPE.  */
+                other_cpu->env.mvp->CP0_MVPControl |= (1 << CP0MVPCo_EVP);
+                mips_vpe_wake(other_cpu); /* And wake it up.  */
+            }
         }
     }
     return prev;

From 8e8cb3b5722babe7e7b597b3805bf09f24ed6979 Mon Sep 17 00:00:00 2001
From: Michael Tokarev <mjt@tls.msk.ru>
Date: Fri, 21 Feb 2025 16:48:56 +0300
Subject: [PATCH 2655/2760] hw/display/qxl-render: fix qxl_unpack_chunks()
 chunk size calculation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In case of multiple chunks, code in qxl_unpack_chunks() takes size of the
wrong (next in the chain) chunk, instead of using current chunk size.
This leads to wrong number of bytes being copied, and to crashes if next
chunk size is larger than the current one.

Based on the code by Gao Yong.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1628
Tested-by: Thaddeus Hogan <thaddeus@thogan.com>
Tested-by: Vadim Zeitlin <vadim@wxwidgets.org>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250221134856.478806-1-mjt@tls.msk.ru>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/display/qxl-render.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/hw/display/qxl-render.c b/hw/display/qxl-render.c
index eda6d3de37..c6a9ac1da1 100644
--- a/hw/display/qxl-render.c
+++ b/hw/display/qxl-render.c
@@ -222,6 +222,7 @@ static void qxl_unpack_chunks(void *dest, size_t size, PCIQXLDevice *qxl,
     uint32_t max_chunks = 32;
     size_t offset = 0;
     size_t bytes;
+    QXLPHYSICAL next_chunk_phys = 0;
 
     for (;;) {
         bytes = MIN(size - offset, chunk->data_size);
@@ -230,7 +231,15 @@ static void qxl_unpack_chunks(void *dest, size_t size, PCIQXLDevice *qxl,
         if (offset == size) {
             return;
         }
-        chunk = qxl_phys2virt(qxl, chunk->next_chunk, group_id,
+        next_chunk_phys = chunk->next_chunk;
+        /* fist time, only get the next chunk's data size */
+        chunk = qxl_phys2virt(qxl, next_chunk_phys, group_id,
+                              sizeof(QXLDataChunk));
+        if (!chunk) {
+            return;
+        }
+        /* second time, check data size and get data */
+        chunk = qxl_phys2virt(qxl, next_chunk_phys, group_id,
                               sizeof(QXLDataChunk) + chunk->data_size);
         if (!chunk) {
             return;

From 962316a6a339367e187b4728ef131ec6e635f364 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 8 Jul 2025 10:55:33 +0200
Subject: [PATCH 2656/2760] hw/vfio/vfio-migration: Remove unnecessary
 'qemu/typedefs.h' include
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

"qemu/typedefs.h" is already included by "qemu/osdep.h".

Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250708085859.7885-3-philmd@linaro.org>
---
 hw/vfio/vfio-migration-internal.h | 1 -
 1 file changed, 1 deletion(-)

diff --git a/hw/vfio/vfio-migration-internal.h b/hw/vfio/vfio-migration-internal.h
index 54141e27e6..814fbd9eba 100644
--- a/hw/vfio/vfio-migration-internal.h
+++ b/hw/vfio/vfio-migration-internal.h
@@ -13,7 +13,6 @@
 #include <linux/vfio.h>
 #endif
 
-#include "qemu/typedefs.h"
 #include "qemu/notify.h"
 
 /*

From b496a392fec656d8e7af81c496efa3d45fd59023 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Fri, 25 Jul 2025 13:17:28 -0700
Subject: [PATCH 2657/2760] migration: rename target.c to vfio.c
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Acked-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Peter Xu <peterx@redhat.com>
Message-ID: <20250725201729.17100-3-pierrick.bouvier@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 migration/meson.build          | 2 +-
 migration/{target.c => vfio.c} | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)
 rename migration/{target.c => vfio.c} (90%)

diff --git a/migration/meson.build b/migration/meson.build
index 9aa48b290e..276da3be5a 100644
--- a/migration/meson.build
+++ b/migration/meson.build
@@ -51,4 +51,4 @@ system_ss.add(when: qatzip, if_true: files('multifd-qatzip.c'))
 
 specific_ss.add(when: 'CONFIG_SYSTEM_ONLY',
                 if_true: files('ram.c',
-                               'target.c'))
+                               'vfio.c'))
diff --git a/migration/target.c b/migration/vfio.c
similarity index 90%
rename from migration/target.c
rename to migration/vfio.c
index 12fd399f0c..0b64e49ef0 100644
--- a/migration/target.c
+++ b/migration/vfio.c
@@ -1,5 +1,5 @@
 /*
- * QEMU live migration - functions that need to be compiled target-specific
+ * QEMU live migration - VFIO
  *
  * This work is licensed under the terms of the GNU GPL, version 2
  * or (at your option) any later version.

From 2bfcd27e00a49da2efa5d703121b94cd9cd4948b Mon Sep 17 00:00:00 2001
From: Luc Michel <luc.michel@amd.com>
Date: Wed, 16 Jul 2025 11:53:43 +0200
Subject: [PATCH 2658/2760] hw/net/cadence_gem: fix register mask
 initialization
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The gem_init_register_masks function was called at init time but it
relies on the num-priority-queues property. Call it at realize time
instead.

Cc: qemu-stable@nongnu.org
Fixes: 4c70e32f05f ("net: cadence_gem: Define access permission for interrupt registers")
Signed-off-by: Luc Michel <luc.michel@amd.com>
Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
Reviewed-by: Sai Pavan Boddu <sai.pavan.boddu@amd.com>
Message-ID: <20250716095432.81923-2-luc.michel@amd.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/net/cadence_gem.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
index 50025d5a6f..44446666de 100644
--- a/hw/net/cadence_gem.c
+++ b/hw/net/cadence_gem.c
@@ -1756,6 +1756,7 @@ static void gem_realize(DeviceState *dev, Error **errp)
         sysbus_init_irq(SYS_BUS_DEVICE(dev), &s->irq[i]);
     }
 
+    gem_init_register_masks(s);
     qemu_macaddr_default_if_unset(&s->conf.macaddr);
 
     s->nic = qemu_new_nic(&net_gem_info, &s->conf,
@@ -1776,7 +1777,6 @@ static void gem_init(Object *obj)
 
     DB_PRINT("\n");
 
-    gem_init_register_masks(s);
     memory_region_init_io(&s->iomem, OBJECT(s), &gem_ops, s,
                           "enet", sizeof(s->regs));
 

From 014bb30d218ef0d91c300324dec99138e999e32d Mon Sep 17 00:00:00 2001
From: Adam Williamson <awilliam@redhat.com>
Date: Thu, 17 Jul 2025 15:02:07 -0700
Subject: [PATCH 2659/2760] hw/xen/passthrough: add missing error-report
 include
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In commit cfcacbab38e ("xen/passthrough: use gsi to map pirq when
dom0 is PVH") an `error_report` was added to this file, but the
corresponding include of `qemu/error-report.h` was missed. This
only becomes apparent when building against Xen 4.20+ with trace
backend log disabled.

Fixes: cfcacbab38e4 (xen/passthrough: use gsi to map pirq when dom0 is PVH)
Signed-off-by: Adam Williamson <awilliam@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250717220207.171040-1-awilliam@redhat.com>
[PMD: Improved commit description, added Fixes: tag]
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/xen/xen_pt.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/xen/xen_pt.c b/hw/xen/xen_pt.c
index 9d16644d82..006b5b55f2 100644
--- a/hw/xen/xen_pt.c
+++ b/hw/xen/xen_pt.c
@@ -54,6 +54,7 @@
 
 #include "qemu/osdep.h"
 #include "qapi/error.h"
+#include "qemu/error-report.h"
 #include <sys/ioctl.h>
 
 #include "hw/pci/pci.h"

From 2865bf1c5795371ef441e9029bc22566ccff8299 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Thu, 24 Jul 2025 09:11:42 -0700
Subject: [PATCH 2660/2760] system/physmem: fix use-after-free with dispatch
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A use-after-free bug was reported when booting a Linux kernel during the
pci setup phase. It's quite hard to reproduce (needs smp, and favored by
having several pci devices with BAR and specific Linux config, which
is Debian default one in this case).

After investigation (see the associated bug ticket), it appears that,
under specific conditions, we might access a cached AddressSpaceDispatch
that was reclaimed by RCU thread meanwhile.
In the Linux boot scenario, during the pci phase, memory region are
destroyed/recreated, resulting in exposition of the bug.

The core of the issue is that we cache the dispatch associated to
current cpu in cpu->cpu_ases[asidx].memory_dispatch. It is updated with
tcg_commit, which runs asynchronously on a given cpu.
At some point, we leave the rcu critial section, and the RCU thread
starts reclaiming it, but tcg_commit is not yet invoked, resulting in
the use-after-free.

It's not the first problem around this area, and commit 0d58c660689 [1]
("softmmu: Use async_run_on_cpu in tcg_commit") already tried to
address it. It did a good job, but it seems that we found a specific
situation where it's not enough.

This patch takes a simple approach: remove the cached value creating the
issue, and make sure we always get the current mapping for address
space, using address_space_to_dispatch(cpu->cpu_ases[asidx].as).
It's equivalent to qatomic_rcu_read(&as->current_map)->dispatch;
This is not really costly, we just need two dereferences,
including one atomic (rcu) read, which is negligible considering we are
already on mmu slow path anyway.

Note that tcg_commit is still needed, as it's taking care of flushing
TLB, removing previously mapped entries.

Another solution would be to cache directly values under the dispatch
(dispatch themselves are not ref counted), keep an active reference on
associated memory section, and release it when appropriate (tricky).
Given the time already spent debugging this area now and previously, I
strongly prefer eliminating the root of the issue, instead of adding
more complexity for a hypothetical performance gain. RCU is precisely
used to ensure good performance when reading data, so caching is not as
beneficial as it might seem IMHO.

[1] https://gitlab.com/qemu-project/qemu/-/commit/0d58c660689f6da1e3feff8a997014003d928b3b

Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3040
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Tested-by: Michael Tokarev <mjt@tls.msk.ru>
Message-ID: <20250724161142.2803091-1-pierrick.bouvier@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 system/physmem.c | 15 +++------------
 1 file changed, 3 insertions(+), 12 deletions(-)

diff --git a/system/physmem.c b/system/physmem.c
index 130c148ffb..e5dd760e0b 100644
--- a/system/physmem.c
+++ b/system/physmem.c
@@ -165,13 +165,11 @@ static bool ram_is_cpr_compatible(RAMBlock *rb);
  * CPUAddressSpace: all the information a CPU needs about an AddressSpace
  * @cpu: the CPU whose AddressSpace this is
  * @as: the AddressSpace itself
- * @memory_dispatch: its dispatch pointer (cached, RCU protected)
  * @tcg_as_listener: listener for tracking changes to the AddressSpace
  */
 typedef struct CPUAddressSpace {
     CPUState *cpu;
     AddressSpace *as;
-    struct AddressSpaceDispatch *memory_dispatch;
     MemoryListener tcg_as_listener;
 } CPUAddressSpace;
 
@@ -692,7 +690,7 @@ address_space_translate_for_iotlb(CPUState *cpu, int asidx, hwaddr orig_addr,
     IOMMUTLBEntry iotlb;
     int iommu_idx;
     hwaddr addr = orig_addr;
-    AddressSpaceDispatch *d = cpu->cpu_ases[asidx].memory_dispatch;
+    AddressSpaceDispatch *d = address_space_to_dispatch(cpu->cpu_ases[asidx].as);
 
     for (;;) {
         section = address_space_translate_internal(d, addr, &addr, plen, false);
@@ -753,7 +751,7 @@ MemoryRegionSection *iotlb_to_section(CPUState *cpu,
 {
     int asidx = cpu_asidx_from_attrs(cpu, attrs);
     CPUAddressSpace *cpuas = &cpu->cpu_ases[asidx];
-    AddressSpaceDispatch *d = cpuas->memory_dispatch;
+    AddressSpaceDispatch *d = address_space_to_dispatch(cpuas->as);
     int section_index = index & ~TARGET_PAGE_MASK;
     MemoryRegionSection *ret;
 
@@ -2780,9 +2778,6 @@ static void tcg_log_global_after_sync(MemoryListener *listener)
 
 static void tcg_commit_cpu(CPUState *cpu, run_on_cpu_data data)
 {
-    CPUAddressSpace *cpuas = data.host_ptr;
-
-    cpuas->memory_dispatch = address_space_to_dispatch(cpuas->as);
     tlb_flush(cpu);
 }
 
@@ -2798,11 +2793,7 @@ static void tcg_commit(MemoryListener *listener)
     cpu = cpuas->cpu;
 
     /*
-     * Defer changes to as->memory_dispatch until the cpu is quiescent.
-     * Otherwise we race between (1) other cpu threads and (2) ongoing
-     * i/o for the current cpu thread, with data cached by mmu_lookup().
-     *
-     * In addition, queueing the work function will kick the cpu back to
+     * Queueing the work function will kick the cpu back to
      * the main loop, which will end the RCU critical section and reclaim
      * the memory data structures.
      *

From 653a75a9d7f957c4ba9387d1a54bccfdce49cb9c Mon Sep 17 00:00:00 2001
From: Michael Tokarev <mjt@tls.msk.ru>
Date: Mon, 28 Jul 2025 00:55:07 +0300
Subject: [PATCH 2661/2760] roms/Makefile: fix npcmNxx_bootrom build rules
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since commit 70ce076fa6dff60, the actual rom source dirs
are subdirs of vbootrom/ submodule, not in top-level of it.

Fixes: 70ce076fa6dff60 "roms: Update vbootrom to 1287b6e"
Fixes: 269b7effd90 ("pc-bios: Add NPCM8XX vBootrom")

Cc: qemu-stable@nongnu.org
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250727215511.807880-1-mjt@tls.msk.ru>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 roms/Makefile | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/roms/Makefile b/roms/Makefile
index beff58d9d5..6af68a922f 100644
--- a/roms/Makefile
+++ b/roms/Makefile
@@ -193,12 +193,12 @@ qboot:
 	cp qboot/build/bios.bin ../pc-bios/qboot.rom
 
 npcm7xx_bootrom:
-	$(MAKE) -C vbootrom CROSS_COMPILE=$(arm_cross_prefix)
-	cp vbootrom/npcm7xx_bootrom.bin ../pc-bios/npcm7xx_bootrom.bin
+	$(MAKE) -C vbootrom/npcm7xx CROSS_COMPILE=$(arm_cross_prefix)
+	cp vbootrom/npcm7xx/npcm7xx_bootrom.bin ../pc-bios/npcm7xx_bootrom.bin
 
 npcm8xx_bootrom:
-	$(MAKE) -C vbootrom CROSS_COMPILE=$(aarch64_cross_prefix)
-	cp vbootrom/npcm8xx_bootrom.bin ../pc-bios/npcm8xx_bootrom.bin
+	$(MAKE) -C vbootrom/npcm8xx CROSS_COMPILE=$(aarch64_cross_prefix)
+	cp vbootrom/npcm8xx/npcm8xx_bootrom.bin ../pc-bios/npcm8xx_bootrom.bin
 
 hppa-firmware:
 	$(MAKE) -C seabios-hppa parisc

From 67e4808403471427b73c8d2c3f4273d64908f480 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cl=C3=A9ment=20Chigot?= <chigot@adacore.com>
Date: Mon, 28 Jul 2025 11:05:18 +0200
Subject: [PATCH 2662/2760] hw/display/sm501: fix missing error-report.h
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

"qemu/error-report.h" was previously implicitly included. This is no
longer the case following 012842c075520dbe1bd96a2fdcf4e218874ba443.

However, the issue predates this change as `error-report.h` should have
been included when the `warn_report` call was introduced.

Fixes: fa140b9562 ("hw/sm501: allow compiling without PIXMAN")
Signed-off-by: Clément Chigot <chigot@adacore.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20250728090518.963573-1-chigot@adacore.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/display/sm501.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/display/sm501.c b/hw/display/sm501.c
index 6d2f18684c..bc091b3c9f 100644
--- a/hw/display/sm501.c
+++ b/hw/display/sm501.c
@@ -26,6 +26,7 @@
 #include "qemu/osdep.h"
 #include "qemu/units.h"
 #include "qapi/error.h"
+#include "qemu/error-report.h"
 #include "qemu/log.h"
 #include "qemu/module.h"
 #include "hw/usb/hcd-ohci.h"

From d4d91ed42eb93f64950a036f35efbd915feb95b3 Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Thu, 17 Jul 2025 13:57:51 +0200
Subject: [PATCH 2663/2760] qapi: Add more cross-references
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We recently (merge commit 504632dcc631) enclosed command and type
names in `backquotes`, so they become links in generated HTML.  Take
care of a few we missed.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20250717115751.3832597-1-armbru@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: John Snow <jsnow@redhat.com>
---
 qapi/dump.json      | 2 +-
 qapi/machine.json   | 2 +-
 qapi/migration.json | 4 ++--
 qapi/misc-i386.json | 2 +-
 qapi/run-state.json | 2 +-
 qapi/sockets.json   | 2 +-
 6 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/qapi/dump.json b/qapi/dump.json
index 32c8c1f06e..726b520870 100644
--- a/qapi/dump.json
+++ b/qapi/dump.json
@@ -79,7 +79,7 @@
 #
 # @detach: if true, QMP will return immediately rather than waiting
 #     for the dump to finish.  The user can track progress using
-#     "query-dump".  (since 2.6).
+#     `query-dump`.  (since 2.6).
 #
 # @begin: if specified, the starting physical address.
 #
diff --git a/qapi/machine.json b/qapi/machine.json
index 6f59f70ca6..038eab281c 100644
--- a/qapi/machine.json
+++ b/qapi/machine.json
@@ -2087,7 +2087,7 @@
 #
 # @deprecated-props: an optional list of properties that are flagged as
 #     deprecated by the CPU vendor.  The list depends on the
-#     CpuModelExpansionType: "static" properties are a subset of the
+#     `CpuModelExpansionType`: "static" properties are a subset of the
 #     enabled-properties for the expanded model; "full" properties are
 #     a set of properties that are deprecated across all models for
 #     the architecture.  (since: 10.1 -- since 9.1 on s390x --).
diff --git a/qapi/migration.json b/qapi/migration.json
index e08a99bb82..2387c21e9c 100644
--- a/qapi/migration.json
+++ b/qapi/migration.json
@@ -641,7 +641,7 @@
 #
 #     This mode supports VFIO devices provided the user first puts the
 #     guest in the suspended runstate, such as by issuing
-#     guest-suspend-ram to the QEMU guest agent.
+#     `guest-suspend-ram` to the QEMU guest agent.
 #
 #     Best performance is achieved when the memory backend is shared
 #     and the @x-ignore-shared migration capability is set, but this
@@ -1704,7 +1704,7 @@
 #
 # .. admonition:: Notes
 #
-#     1. The 'query-migrate' command should be used to check
+#     1. The `query-migrate` command should be used to check
 #        migration's progress and final result (this information is
 #        provided by the 'status' member).
 #
diff --git a/qapi/misc-i386.json b/qapi/misc-i386.json
index c8c91a241c..d1ce8caf25 100644
--- a/qapi/misc-i386.json
+++ b/qapi/misc-i386.json
@@ -8,7 +8,7 @@
 #
 # Reset the RTC interrupt reinjection backlog.  Can be used if another
 # mechanism to synchronize guest time is in effect, for example QEMU
-# guest agent's guest-set-time command.
+# guest agent's `guest-set-time` command.
 #
 # Use of this command is only applicable for x86 machines with an RTC,
 # and on other machines will silently return without performing any
diff --git a/qapi/run-state.json b/qapi/run-state.json
index 54ba5c9a3f..4757947ca6 100644
--- a/qapi/run-state.json
+++ b/qapi/run-state.json
@@ -20,7 +20,7 @@
 # @inmigrate: guest is paused waiting for an incoming migration.  Note
 #     that this state does not tell whether the machine will start at
 #     the end of the migration.  This depends on the command-line -S
-#     option and any invocation of 'stop' or 'cont' that has happened
+#     option and any invocation of `stop` or `cont` that has happened
 #     since QEMU was started.
 #
 # @internal-error: An internal error that prevents further guest
diff --git a/qapi/sockets.json b/qapi/sockets.json
index 82046b0b3a..32fac51728 100644
--- a/qapi/sockets.json
+++ b/qapi/sockets.json
@@ -143,7 +143,7 @@
 #
 # @str: decimal is for file descriptor number, otherwise it's a file
 #     descriptor name.  Named file descriptors are permitted in
-#     monitor commands, in combination with the 'getfd' command.
+#     monitor commands, in combination with the `getfd` command.
 #     Decimal file descriptors are permitted at startup or other
 #     contexts where no monitor context is active.
 #

From a3004697f7342258de6fdc3ed85943a33a4809cf Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Thu, 24 Jul 2025 11:17:41 +0200
Subject: [PATCH 2664/2760] qapi/accelerator: Fix markup of heading

The docs generated for qapi/accelerator.json shows text "=
Accelerators" instead of a heading.  This is because the patch that
added the heading crossed with the commit that changed heading
markup (commit 6c10778826a "docs/sphinx: remove special parsing for
freeform sections").  Fix the markup.

Fixes: 18da42ee4273 (qapi/accel: Move definitions related to accelerators in their own file)
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20250724091742.1950167-2-armbru@redhat.com>
---
 qapi/accelerator.json | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/qapi/accelerator.json b/qapi/accelerator.json
index 28d5ff4c49..fb28c8d920 100644
--- a/qapi/accelerator.json
+++ b/qapi/accelerator.json
@@ -4,7 +4,9 @@
 # SPDX-License-Identifier: GPL-2.0-or-later
 
 ##
-# = Accelerators
+# ************
+# Accelerators
+# ************
 ##
 
 { 'include': 'common.json' }

From 1047cc281631063ff2db481b8ea7eb755005236a Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Thu, 24 Jul 2025 11:17:42 +0200
Subject: [PATCH 2665/2760] tests/qapi-schema: Bury dead test case
 doc-non-first-section
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The test passed when it was added.  However, the commit adding it
neglected to make Meson aware of it, so it never ran automatically.
The test stopped making sense when we changed headings markup, and
ceased to pass then.  It should've been removed then.  Do that now.

Fixes: 6c10778826a8 (docs/sphinx: remove special parsing for freeform sections)
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20250724091742.1950167-3-armbru@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: John Snow <jsnow@redhat.com>
---
 tests/qapi-schema/doc-non-first-section.err  | 1 -
 tests/qapi-schema/doc-non-first-section.json | 6 ------
 tests/qapi-schema/doc-non-first-section.out  | 0
 3 files changed, 7 deletions(-)
 delete mode 100644 tests/qapi-schema/doc-non-first-section.err
 delete mode 100644 tests/qapi-schema/doc-non-first-section.json
 delete mode 100644 tests/qapi-schema/doc-non-first-section.out

diff --git a/tests/qapi-schema/doc-non-first-section.err b/tests/qapi-schema/doc-non-first-section.err
deleted file mode 100644
index eeced2bca7..0000000000
--- a/tests/qapi-schema/doc-non-first-section.err
+++ /dev/null
@@ -1 +0,0 @@
-doc-non-first-section.json:5:1: '=' heading must come first in a comment block
diff --git a/tests/qapi-schema/doc-non-first-section.json b/tests/qapi-schema/doc-non-first-section.json
deleted file mode 100644
index 1590876061..0000000000
--- a/tests/qapi-schema/doc-non-first-section.json
+++ /dev/null
@@ -1,6 +0,0 @@
-# = section must be first line
-
-##
-#
-# = Not first
-##
diff --git a/tests/qapi-schema/doc-non-first-section.out b/tests/qapi-schema/doc-non-first-section.out
deleted file mode 100644
index e69de29bb2..0000000000

From a14f6d3288bcfd4f3f7e6aca4572e2443cc1f91b Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Tue, 29 Jul 2025 11:16:41 +0200
Subject: [PATCH 2666/2760] docs/qapi-domain: Fix typos

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20250729091642.3513895-2-armbru@redhat.com>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
---
 docs/devel/qapi-domain.rst | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/devel/qapi-domain.rst b/docs/devel/qapi-domain.rst
index b71890f660..fe540d1e40 100644
--- a/docs/devel/qapi-domain.rst
+++ b/docs/devel/qapi-domain.rst
@@ -9,7 +9,7 @@ in Sphinx is provided by the QAPI Domain, located in
 `Python Domain
 <https://www.sphinx-doc.org/en/master/usage/domains/python.html>`_
 included with Sphinx, but provides special directives and roles
-speciically for annotating and documenting QAPI definitions
+for annotating and documenting QAPI definitions
 specifically.
 
 A `Domain
@@ -101,7 +101,7 @@ without types. The QAPI domain uses this class for features, returns,
 and enum values.
 
 TypedField:
-  * Creates a grouped, typed field. Multiple adjacent entres will be
+  * Creates a grouped, typed field. Multiple adjacent entries will be
     merged into one section, and the content will form a bulleted list.
   * *Must* take at least one argument, but supports up to two -
     nominally, a name and a type.

From a95b3c0ad857055198cdb272bca2af975092d060 Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Tue, 29 Jul 2025 11:16:42 +0200
Subject: [PATCH 2667/2760] MAINTAINERS: Cover docs/devel/qapi-domain.rst
 properly

Section QAPI already covers it, and that's fine.  It's missing from
"Sphinx documentation configuration and build machinery".  Add it
there.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20250729091642.3513895-3-armbru@redhat.com>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
[Improved commit message]
---
 MAINTAINERS | 1 +
 1 file changed, 1 insertion(+)

diff --git a/MAINTAINERS b/MAINTAINERS
index 37879ab64e..069d77f2f8 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -4433,6 +4433,7 @@ F: docs/requirements.txt
 F: docs/sphinx/
 F: docs/_templates/
 F: docs/devel/docs.rst
+F: docs/devel/qapi-domain.rst
 
 Rust build system integration
 M: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>

From 9b80226ece693197af8a981b424391b68b5bc38e Mon Sep 17 00:00:00 2001
From: Stefan Hajnoczi <stefanha@redhat.com>
Date: Tue, 29 Jul 2025 13:00:41 -0400
Subject: [PATCH 2668/2760] Update version for the v10.1.0-rc1 release

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 VERSION | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/VERSION b/VERSION
index c52f1cc9fe..8ae905b0dd 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-10.0.90
+10.0.91

From 77707bfdf871199bbee665e721ced961aaf3a798 Mon Sep 17 00:00:00 2001
From: Vac Chen <vacantron@gmail.com>
Date: Sun, 6 Jul 2025 14:55:54 +0800
Subject: [PATCH 2669/2760] target/riscv: Fix pmp range wraparound on zero

pmp_is_in_range() prefers to match addresses within the interval
[start, end]. To archieve this, pmpaddrX is decremented during the end
address update.

In TOR mode, a rule is ignored if its start address is greater than or
equal to its end address.

However, if pmpaddrX is set to 0, this decrement operation causes the
calulated end address to wrap around to UINT_MAX. In this scenario, the
address guard for this PMP entry would become ineffective.

This patch addresses the issue by moving the guard check earlier,
preventing the problematic wraparound when pmpaddrX is zero.

Signed-off-by: Vac Chen <vacantron@gmail.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250706065554.42953-1-vacantron@gmail.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/pmp.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/target/riscv/pmp.c b/target/riscv/pmp.c
index 3540327c9a..72f1372a49 100644
--- a/target/riscv/pmp.c
+++ b/target/riscv/pmp.c
@@ -211,11 +211,12 @@ void pmp_update_rule_addr(CPURISCVState *env, uint32_t pmp_index)
         break;
 
     case PMP_AMATCH_TOR:
+        if (prev_addr >= this_addr) {
+            sa = ea = 0u;
+            break;
+        }
         sa = prev_addr << 2; /* shift up from [xx:0] to [xx+2:2] */
         ea = (this_addr << 2) - 1u;
-        if (sa > ea) {
-            sa = ea = 0u;
-        }
         break;
 
     case PMP_AMATCH_NA4:

From 35d129399d319b7ab806e82ebacd52392e36bf61 Mon Sep 17 00:00:00 2001
From: Sunil V L <sunilvl@ventanamicro.com>
Date: Thu, 24 Jul 2025 16:33:48 +0530
Subject: [PATCH 2670/2760] bios-tables-test-allowed-diff.h: Allow RISC-V FADT
 and MADT changes

Signed-off-by: Sunil V L <sunilvl@ventanamicro.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Nutty Liu <liujingqi@lanxincomputing.com>
Message-ID: <20250724110350.452828-2-sunilvl@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 tests/qtest/bios-tables-test-allowed-diff.h | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/tests/qtest/bios-tables-test-allowed-diff.h b/tests/qtest/bios-tables-test-allowed-diff.h
index dfb8523c8b..0c3f7a6cac 100644
--- a/tests/qtest/bios-tables-test-allowed-diff.h
+++ b/tests/qtest/bios-tables-test-allowed-diff.h
@@ -1 +1,3 @@
 /* List of comma-separated changed AML files to ignore */
+"tests/data/acpi/riscv64/virt/APIC",
+"tests/data/acpi/riscv64/virt/FACP",

From a3b95362ce90d03d150dffed3add0cb600fb0850 Mon Sep 17 00:00:00 2001
From: Sunil V L <sunilvl@ventanamicro.com>
Date: Thu, 24 Jul 2025 16:33:49 +0530
Subject: [PATCH 2671/2760] hw/riscv/virt-acpi-build.c: Update FADT and MADT
 versions

RISC-V support is added only in ACPI 6.6. According to the ACPI 6.6
specification, the minor version of the Fixed ACPI Description Table
(FADT) should be 6, and the Multiple APIC Description Table (MADT)
should use revision 7. So, update the RISC-V FADT and MADT to reflect
correct versions.

Update the code comments to reflect ACPI 6.6 version details.

Signed-off-by: Sunil V L <sunilvl@ventanamicro.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Nutty Liu <liujingqi@lanxincomputing.com>
Message-ID: <20250724110350.452828-3-sunilvl@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt-acpi-build.c | 25 ++++++++++---------------
 1 file changed, 10 insertions(+), 15 deletions(-)

diff --git a/hw/riscv/virt-acpi-build.c b/hw/riscv/virt-acpi-build.c
index ee1416d264..f1406cb683 100644
--- a/hw/riscv/virt-acpi-build.c
+++ b/hw/riscv/virt-acpi-build.c
@@ -270,11 +270,8 @@ spcr_setup(GArray *table_data, BIOSLinker *linker, RISCVVirtState *s)
 #define RHCT_NODE_ARRAY_OFFSET 56
 
 /*
- * ACPI spec, Revision 6.5+
- * 5.2.36 RISC-V Hart Capabilities Table (RHCT)
- * REF: https://github.com/riscv-non-isa/riscv-acpi/issues/16
- *      https://drive.google.com/file/d/1nP3nFiH4jkPMp6COOxP6123DCZKR-tia/view
- *      https://drive.google.com/file/d/1sKbOa8m1UZw1JkquZYe3F1zQBN1xXsaf/view
+ * ACPI spec, Revision 6.6
+ * 5.2.37 RISC-V Hart Capabilities Table (RHCT)
  */
 static void build_rhct(GArray *table_data,
                        BIOSLinker *linker,
@@ -421,7 +418,10 @@ static void build_rhct(GArray *table_data,
     acpi_table_end(linker, &table);
 }
 
-/* FADT */
+/*
+ * ACPI spec, Revision 6.6
+ * 5.2.9 Fixed ACPI Description Table (MADT)
+ */
 static void build_fadt_rev6(GArray *table_data,
                             BIOSLinker *linker,
                             RISCVVirtState *s,
@@ -429,7 +429,7 @@ static void build_fadt_rev6(GArray *table_data,
 {
     AcpiFadtData fadt = {
         .rev = 6,
-        .minor_ver = 5,
+        .minor_ver = 6,
         .flags = 1 << ACPI_FADT_F_HW_REDUCED_ACPI,
         .xdsdt_tbl_offset = &dsdt_tbl_offset,
     };
@@ -508,11 +508,8 @@ static void build_dsdt(GArray *table_data,
 }
 
 /*
- * ACPI spec, Revision 6.5+
+ * ACPI spec, Revision 6.6
  * 5.2.12 Multiple APIC Description Table (MADT)
- * REF: https://github.com/riscv-non-isa/riscv-acpi/issues/15
- *      https://drive.google.com/file/d/1R6k4MshhN3WTT-hwqAquu5nX6xSEqK2l/view
- *      https://drive.google.com/file/d/1oMGPyOD58JaPgMl1pKasT-VKsIKia7zR/view
  */
 static void build_madt(GArray *table_data,
                        BIOSLinker *linker,
@@ -537,7 +534,7 @@ static void build_madt(GArray *table_data,
 
     hart_index_bits = imsic_num_bits(imsic_max_hart_per_socket);
 
-    AcpiTable table = { .sig = "APIC", .rev = 6, .oem_id = s->oem_id,
+    AcpiTable table = { .sig = "APIC", .rev = 7, .oem_id = s->oem_id,
                         .oem_table_id = s->oem_table_id };
 
     acpi_table_begin(&table, table_data);
@@ -812,10 +809,8 @@ static void build_rimt(GArray *table_data, BIOSLinker *linker,
 }
 
 /*
- * ACPI spec, Revision 6.5+
+ * ACPI spec, Revision 6.6
  * 5.2.16 System Resource Affinity Table (SRAT)
- * REF: https://github.com/riscv-non-isa/riscv-acpi/issues/25
- *      https://drive.google.com/file/d/1YTdDx2IPm5IeZjAW932EYU-tUtgS08tX/view
  */
 static void
 build_srat(GArray *table_data, BIOSLinker *linker, RISCVVirtState *vms)

From f3c8b7767f2e1fac37c727ca17b69e4f1e3351f2 Mon Sep 17 00:00:00 2001
From: Sunil V L <sunilvl@ventanamicro.com>
Date: Thu, 24 Jul 2025 16:33:50 +0530
Subject: [PATCH 2672/2760] tests/data/acpi/riscv64: Update expected FADT and
 MADT

Update the expected tables for the version change.
 /*
  *
  * ACPI Data Table [FACP]
  *
  * Format: [HexOffset DecimalOffset ByteLength]  FieldName : FieldValue (in hex)
  */

 [000h 0000 004h]                   Signature : "FACP"    [Fixed ACPI Description Table (FADT)]
 [004h 0004 004h]                Table Length : 00000114
 [008h 0008 001h]                    Revision : 06
-[009h 0009 001h]                    Checksum : 13
+[009h 0009 001h]                    Checksum : 12
 [00Ah 0010 006h]                      Oem ID : "BOCHS "
 [010h 0016 008h]                Oem Table ID : "BXPC    "
 [018h 0024 004h]                Oem Revision : 00000001
 [01Ch 0028 004h]             Asl Compiler ID : "BXPC"
 [020h 0032 004h]       Asl Compiler Revision : 00000001

 [024h 0036 004h]                FACS Address : 00000000
 [028h 0040 004h]                DSDT Address : 00000000
 [02Ch 0044 001h]                       Model : 00
 [02Dh 0045 001h]                  PM Profile : 00 [Unspecified]
 [02Eh 0046 002h]               SCI Interrupt : 0000
 [030h 0048 004h]            SMI Command Port : 00000000
 [034h 0052 001h]           ACPI Enable Value : 00
 [035h 0053 001h]          ACPI Disable Value : 00
 [036h 0054 001h]              S4BIOS Command : 00
 [037h 0055 001h]             P-State Control : 00
@@ -86,33 +86,33 @@
      Use APIC Physical Destination Mode (V4) : 0
                        Hardware Reduced (V5) : 1
                       Low Power S0 Idle (V5) : 0

 [074h 0116 00Ch]              Reset Register : [Generic Address Structure]
 [074h 0116 001h]                    Space ID : 00 [SystemMemory]
 [075h 0117 001h]                   Bit Width : 00
 [076h 0118 001h]                  Bit Offset : 00
 [077h 0119 001h]        Encoded Access Width : 00 [Undefined/Legacy]
 [078h 0120 008h]                     Address : 0000000000000000

 [080h 0128 001h]        Value to cause reset : 00
 [081h 0129 002h]   ARM Flags (decoded below) : 0000
                               PSCI Compliant : 0
                        Must use HVC for PSCI : 0

-[083h 0131 001h]         FADT Minor Revision : 05
+[083h 0131 001h]         FADT Minor Revision : 06
 [084h 0132 008h]                FACS Address : 0000000000000000
[...]

 /*
  *
  * ACPI Data Table [APIC]
  *
  * Format: [HexOffset DecimalOffset ByteLength]  FieldName : FieldValue (in hex)
  */

 [000h 0000 004h]                   Signature : "APIC"    [Multiple APIC Description Table (MADT)]
 [004h 0004 004h]                Table Length : 00000074
-[008h 0008 001h]                    Revision : 06
-[009h 0009 001h]                    Checksum : B4
+[008h 0008 001h]                    Revision : 07
+[009h 0009 001h]                    Checksum : B3
 [00Ah 0010 006h]                      Oem ID : "BOCHS "
 [010h 0016 008h]                Oem Table ID : "BXPC    "
[...]

Signed-off-by: Sunil V L <sunilvl@ventanamicro.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Nutty Liu <liujingqi@lanxincomputing.com>
Message-ID: <20250724110350.452828-4-sunilvl@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 tests/data/acpi/riscv64/virt/APIC           | Bin 116 -> 116 bytes
 tests/data/acpi/riscv64/virt/FACP           | Bin 276 -> 276 bytes
 tests/qtest/bios-tables-test-allowed-diff.h |   2 --
 3 files changed, 2 deletions(-)

diff --git a/tests/data/acpi/riscv64/virt/APIC b/tests/data/acpi/riscv64/virt/APIC
index 66a25dfd2d6ea2b607c024722b2eab95873a01e9..3fb5b753596fc7c2618b3d5210be8b00b0c177f6 100644
GIT binary patch
delta 16
XcmXRZ;c^V{bS`0FU|`=okt+)TB&q~M

delta 16
XcmXRZ;c^V{bS`0FU|`!akt+)TB&h^L

diff --git a/tests/data/acpi/riscv64/virt/FACP b/tests/data/acpi/riscv64/virt/FACP
index a5276b65ea8ce46cc9b40d96d98f0669c9089ed4..78e1b14b1d4ff0533a6a4c041f195a69b4ef114d 100644
GIT binary patch
delta 30
mcmbQjG=+)F&CxkPgpq-PO=u!lB_rF!iPaMgcqj8PasU8k76z;U

delta 30
mcmbQjG=+)F&CxkPgpq-PO?V<#B_r#^iPaMgcqj8PasU8k8wRWZ

diff --git a/tests/qtest/bios-tables-test-allowed-diff.h b/tests/qtest/bios-tables-test-allowed-diff.h
index 0c3f7a6cac..dfb8523c8b 100644
--- a/tests/qtest/bios-tables-test-allowed-diff.h
+++ b/tests/qtest/bios-tables-test-allowed-diff.h
@@ -1,3 +1 @@
 /* List of comma-separated changed AML files to ignore */
-"tests/data/acpi/riscv64/virt/APIC",
-"tests/data/acpi/riscv64/virt/FACP",

From b6f1244678bebaf7e2c775cfc66d452f95678ebf Mon Sep 17 00:00:00 2001
From: Yang Jialong <z_bajeer@yeah.net>
Date: Mon, 28 Jul 2025 13:51:14 +0800
Subject: [PATCH 2673/2760] intc/riscv_aplic: Fix target register read when
 source is inactive

The RISC-V Advanced interrupt Architecture:
4.5.16. Interrupt targets:
If interrupt source i is inactive in this domain, register target[i] is
read-only zero.

Signed-off-by: Yang Jialong <z_bajeer@yeah.net>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20250728055114.252024-1-z_bajeer@yeah.net>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/intc/riscv_aplic.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/hw/intc/riscv_aplic.c b/hw/intc/riscv_aplic.c
index 4fa5f7597b..a1d9fa5085 100644
--- a/hw/intc/riscv_aplic.c
+++ b/hw/intc/riscv_aplic.c
@@ -628,7 +628,7 @@ static void riscv_aplic_request(void *opaque, int irq, int level)
 
 static uint64_t riscv_aplic_read(void *opaque, hwaddr addr, unsigned size)
 {
-    uint32_t irq, word, idc;
+    uint32_t irq, word, idc, sm;
     RISCVAPLICState *aplic = opaque;
 
     /* Reads must be 4 byte words */
@@ -696,6 +696,10 @@ static uint64_t riscv_aplic_read(void *opaque, hwaddr addr, unsigned size)
     } else if ((APLIC_TARGET_BASE <= addr) &&
             (addr < (APLIC_TARGET_BASE + (aplic->num_irqs - 1) * 4))) {
         irq = ((addr - APLIC_TARGET_BASE) >> 2) + 1;
+        sm = aplic->sourcecfg[irq] & APLIC_SOURCECFG_SM_MASK;
+        if (sm == APLIC_SOURCECFG_SM_INACTIVE) {
+            return 0;
+        }
         return aplic->target[irq];
     } else if (!aplic->msimode && (APLIC_IDC_BASE <= addr) &&
             (addr < (APLIC_IDC_BASE + aplic->num_harts * APLIC_IDC_SIZE))) {

From e111ffe48b29ca8abd450af9ee5dd71af3f93536 Mon Sep 17 00:00:00 2001
From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Date: Mon, 28 Jul 2025 14:06:33 -0300
Subject: [PATCH 2674/2760] linux-user/strace.list: add riscv_hwprobe entry

We're missing a strace entry for riscv_hwprobe, and using -strace will
report it as "Unknown syscall 258".

After this patch we'll have:

$ ./build/qemu-riscv64 -strace test_mutex_riscv
110182 riscv_hwprobe(0x7f207efdc700,1,0,0,0,0) = 0
110182 brk(NULL) = 0x0000000000082000
(...)

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250728170633.113384-1-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 linux-user/strace.list | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/linux-user/strace.list b/linux-user/strace.list
index fdf94ef32a..ab818352a9 100644
--- a/linux-user/strace.list
+++ b/linux-user/strace.list
@@ -1716,3 +1716,6 @@
 { TARGET_NR_clock_gettime64, "clock_gettime64" , NULL, print_clock_gettime64,
                            print_syscall_ret_clock_gettime64 },
 #endif
+#ifdef TARGET_NR_riscv_hwprobe
+{ TARGET_NR_riscv_hwprobe, "riscv_hwprobe" , "%s(%p,%d,%d,%d,%d,%d)", NULL, NULL },
+#endif

From 16aa7771afeac422dcf7be2833d5426da6b814fa Mon Sep 17 00:00:00 2001
From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Date: Mon, 14 Jul 2025 10:37:39 -0300
Subject: [PATCH 2675/2760] target/riscv: do not call GETPC() in
 check_ret_from_m_mode()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

GETPC() should always be called from the top level helper, e.g. the
first helper that is called by the translation code. We stopped doing
that in commit 3157a553ec, and then we introduced problems when
unwinding the exceptions being thrown by helper_mret(), as reported by
[1].

Call GETPC() at the top level helper and pass the value along.

[1] https://gitlab.com/qemu-project/qemu/-/issues/3020

Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Fixes: 3157a553ec ("target/riscv: Add Smrnmi mnret instruction")
Closes: https://gitlab.com/qemu-project/qemu/-/issues/3020
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Nutty Liu <liujingqi@lanxincomputing.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250714133739.1248296-1-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/op_helper.c | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
index 15460bf84b..110292e84d 100644
--- a/target/riscv/op_helper.c
+++ b/target/riscv/op_helper.c
@@ -355,21 +355,22 @@ target_ulong helper_sret(CPURISCVState *env)
 }
 
 static void check_ret_from_m_mode(CPURISCVState *env, target_ulong retpc,
-                                  target_ulong prev_priv)
+                                  target_ulong prev_priv,
+                                  uintptr_t ra)
 {
     if (!(env->priv >= PRV_M)) {
-        riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC());
+        riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, ra);
     }
 
     if (!riscv_cpu_allow_16bit_insn(&env_archcpu(env)->cfg,
                                     env->priv_ver,
                                     env->misa_ext) && (retpc & 0x3)) {
-        riscv_raise_exception(env, RISCV_EXCP_INST_ADDR_MIS, GETPC());
+        riscv_raise_exception(env, RISCV_EXCP_INST_ADDR_MIS, ra);
     }
 
     if (riscv_cpu_cfg(env)->pmp &&
         !pmp_get_num_rules(env) && (prev_priv != PRV_M)) {
-        riscv_raise_exception(env, RISCV_EXCP_INST_ACCESS_FAULT, GETPC());
+        riscv_raise_exception(env, RISCV_EXCP_INST_ACCESS_FAULT, ra);
     }
 }
 static target_ulong ssdbltrp_mxret(CPURISCVState *env, target_ulong mstatus,
@@ -394,8 +395,9 @@ target_ulong helper_mret(CPURISCVState *env)
     target_ulong retpc = env->mepc & get_xepc_mask(env);
     uint64_t mstatus = env->mstatus;
     target_ulong prev_priv = get_field(mstatus, MSTATUS_MPP);
+    uintptr_t ra = GETPC();
 
-    check_ret_from_m_mode(env, retpc, prev_priv);
+    check_ret_from_m_mode(env, retpc, prev_priv, ra);
 
     target_ulong prev_virt = get_field(env->mstatus, MSTATUS_MPV) &&
                              (prev_priv != PRV_M);
@@ -443,8 +445,9 @@ target_ulong helper_mnret(CPURISCVState *env)
     target_ulong retpc = env->mnepc;
     target_ulong prev_priv = get_field(env->mnstatus, MNSTATUS_MNPP);
     target_ulong prev_virt;
+    uintptr_t ra = GETPC();
 
-    check_ret_from_m_mode(env, retpc, prev_priv);
+    check_ret_from_m_mode(env, retpc, prev_priv, ra);
 
     prev_virt = get_field(env->mnstatus, MNSTATUS_MNPV) &&
                 (prev_priv != PRV_M);

From 09ac27a9b59bf87786cb35f7126fb5788b0b4bca Mon Sep 17 00:00:00 2001
From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Date: Thu, 10 Jul 2025 07:05:25 -0300
Subject: [PATCH 2676/2760] riscv: Revert "Generate strided vector loads/stores
 with tcg nodes."

This reverts commit 28c12c1f2f50d7f7f1ebfc587c4777ecd50aac5b.

As reported in [1] this commit is breaking Linux vector code, and
although a simpler reproducer was provided, the fix itself isn't trivial
due to the amount and the nature of the changes. And we really do not
want to keep Linux broken while we work on it.

The revert will fix Linux and will give us time to do a proper fix.

[1] https://mail.gnu.org/archive/html/qemu-devel/2025-07/msg02525.html

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Tested-by: Eric Biggers <ebiggers@kernel.org>
Message-ID: <20250710100525.372985-1-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvv.c.inc | 323 ++++--------------------
 1 file changed, 50 insertions(+), 273 deletions(-)

diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
index 610bf9ff30..71f98fb350 100644
--- a/target/riscv/insn_trans/trans_rvv.c.inc
+++ b/target/riscv/insn_trans/trans_rvv.c.inc
@@ -864,286 +864,32 @@ GEN_VEXT_TRANS(vlm_v, MO_8, vlm_v, ld_us_mask_op, ld_us_mask_check)
 GEN_VEXT_TRANS(vsm_v, MO_8, vsm_v, st_us_mask_op, st_us_mask_check)
 
 /*
- * MAXSZ returns the maximum vector size can be operated in bytes,
- * which is used in GVEC IR when vl_eq_vlmax flag is set to true
- * to accelerate vector operation.
+ *** stride load and store
  */
-static inline uint32_t MAXSZ(DisasContext *s)
-{
-    int max_sz = s->cfg_ptr->vlenb << 3;
-    return max_sz >> (3 - s->lmul);
-}
-
-static inline uint32_t get_log2(uint32_t a)
-{
-    uint32_t i = 0;
-    for (; a > 0;) {
-        a >>= 1;
-        i++;
-    }
-    return i;
-}
-
-typedef void gen_tl_ldst(TCGv, TCGv_ptr, tcg_target_long);
-
-/*
- * Simulate the strided load/store main loop:
- *
- * for (i = env->vstart; i < env->vl; env->vstart = ++i) {
- *     k = 0;
- *     while (k < nf) {
- *         if (!vm && !vext_elem_mask(v0, i)) {
- *             vext_set_elems_1s(vd, vma, (i + k * max_elems) * esz,
- *                               (i + k * max_elems + 1) * esz);
- *             k++;
- *             continue;
- *         }
- *         target_ulong addr = base + stride * i + (k << log2_esz);
- *         ldst(env, adjust_addr(env, addr), i + k * max_elems, vd, ra);
- *         k++;
- *     }
- * }
- */
-static void gen_ldst_stride_main_loop(DisasContext *s, TCGv dest, uint32_t rs1,
-                                      uint32_t rs2, uint32_t vm, uint32_t nf,
-                                      gen_tl_ldst *ld_fn, gen_tl_ldst *st_fn,
-                                      bool is_load)
-{
-    TCGv addr = tcg_temp_new();
-    TCGv base = get_gpr(s, rs1, EXT_NONE);
-    TCGv stride = get_gpr(s, rs2, EXT_NONE);
-
-    TCGv i = tcg_temp_new();
-    TCGv i_esz = tcg_temp_new();
-    TCGv k = tcg_temp_new();
-    TCGv k_esz = tcg_temp_new();
-    TCGv k_max = tcg_temp_new();
-    TCGv mask = tcg_temp_new();
-    TCGv mask_offs = tcg_temp_new();
-    TCGv mask_offs_64 = tcg_temp_new();
-    TCGv mask_elem = tcg_temp_new();
-    TCGv mask_offs_rem = tcg_temp_new();
-    TCGv vreg = tcg_temp_new();
-    TCGv dest_offs = tcg_temp_new();
-    TCGv stride_offs = tcg_temp_new();
-
-    uint32_t max_elems = MAXSZ(s) >> s->sew;
-
-    TCGLabel *start = gen_new_label();
-    TCGLabel *end = gen_new_label();
-    TCGLabel *start_k = gen_new_label();
-    TCGLabel *inc_k = gen_new_label();
-    TCGLabel *end_k = gen_new_label();
-
-    MemOp atomicity = MO_ATOM_NONE;
-    if (s->sew == 0) {
-        atomicity = MO_ATOM_NONE;
-    } else {
-        atomicity = MO_ATOM_IFALIGN_PAIR;
-    }
-
-    mark_vs_dirty(s);
-
-    tcg_gen_addi_tl(mask, (TCGv)tcg_env, vreg_ofs(s, 0));
-
-    /* Start of outer loop. */
-    tcg_gen_mov_tl(i, cpu_vstart);
-    gen_set_label(start);
-    tcg_gen_brcond_tl(TCG_COND_GE, i, cpu_vl, end);
-    tcg_gen_shli_tl(i_esz, i, s->sew);
-    /* Start of inner loop. */
-    tcg_gen_movi_tl(k, 0);
-    gen_set_label(start_k);
-    tcg_gen_brcond_tl(TCG_COND_GE, k, tcg_constant_tl(nf), end_k);
-    /*
-     * If we are in mask agnostic regime and the operation is not unmasked we
-     * set the inactive elements to 1.
-     */
-    if (!vm && s->vma) {
-        TCGLabel *active_element = gen_new_label();
-        /* (i + k * max_elems) * esz */
-        tcg_gen_shli_tl(mask_offs, k, get_log2(max_elems << s->sew));
-        tcg_gen_add_tl(mask_offs, mask_offs, i_esz);
-
-        /*
-         * Check whether the i bit of the mask is 0 or 1.
-         *
-         * static inline int vext_elem_mask(void *v0, int index)
-         * {
-         *     int idx = index / 64;
-         *     int pos = index  % 64;
-         *     return (((uint64_t *)v0)[idx] >> pos) & 1;
-         * }
-         */
-        tcg_gen_shri_tl(mask_offs_64, mask_offs, 3);
-        tcg_gen_add_tl(mask_offs_64, mask_offs_64, mask);
-        tcg_gen_ld_i64((TCGv_i64)mask_elem, (TCGv_ptr)mask_offs_64, 0);
-        tcg_gen_rem_tl(mask_offs_rem, mask_offs, tcg_constant_tl(8));
-        tcg_gen_shr_tl(mask_elem, mask_elem, mask_offs_rem);
-        tcg_gen_andi_tl(mask_elem, mask_elem, 1);
-        tcg_gen_brcond_tl(TCG_COND_NE, mask_elem, tcg_constant_tl(0),
-                          active_element);
-        /*
-         * Set masked-off elements in the destination vector register to 1s.
-         * Store instructions simply skip this bit as memory ops access memory
-         * only for active elements.
-         */
-        if (is_load) {
-            tcg_gen_shli_tl(mask_offs, mask_offs, s->sew);
-            tcg_gen_add_tl(mask_offs, mask_offs, dest);
-            st_fn(tcg_constant_tl(-1), (TCGv_ptr)mask_offs, 0);
-        }
-        tcg_gen_br(inc_k);
-        gen_set_label(active_element);
-    }
-    /*
-     * The element is active, calculate the address with stride:
-     * target_ulong addr = base + stride * i + (k << log2_esz);
-     */
-    tcg_gen_mul_tl(stride_offs, stride, i);
-    tcg_gen_shli_tl(k_esz, k, s->sew);
-    tcg_gen_add_tl(stride_offs, stride_offs, k_esz);
-    tcg_gen_add_tl(addr, base, stride_offs);
-    /* Calculate the offset in the dst/src vector register. */
-    tcg_gen_shli_tl(k_max, k, get_log2(max_elems));
-    tcg_gen_add_tl(dest_offs, i, k_max);
-    tcg_gen_shli_tl(dest_offs, dest_offs, s->sew);
-    tcg_gen_add_tl(dest_offs, dest_offs, dest);
-    if (is_load) {
-        tcg_gen_qemu_ld_tl(vreg, addr, s->mem_idx, MO_LE | s->sew | atomicity);
-        st_fn((TCGv)vreg, (TCGv_ptr)dest_offs, 0);
-    } else {
-        ld_fn((TCGv)vreg, (TCGv_ptr)dest_offs, 0);
-        tcg_gen_qemu_st_tl(vreg, addr, s->mem_idx, MO_LE | s->sew | atomicity);
-    }
-    /*
-     * We don't execute the load/store above if the element was inactive.
-     * We jump instead directly to incrementing k and continuing the loop.
-     */
-    if (!vm && s->vma) {
-        gen_set_label(inc_k);
-    }
-    tcg_gen_addi_tl(k, k, 1);
-    tcg_gen_br(start_k);
-    /* End of the inner loop. */
-    gen_set_label(end_k);
-
-    tcg_gen_addi_tl(i, i, 1);
-    tcg_gen_mov_tl(cpu_vstart, i);
-    tcg_gen_br(start);
-
-    /* End of the outer loop. */
-    gen_set_label(end);
-
-    return;
-}
-
-
-/*
- * Set the tail bytes of the strided loads/stores to 1:
- *
- * for (k = 0; k < nf; ++k) {
- *     cnt = (k * max_elems + vl) * esz;
- *     tot = (k * max_elems + max_elems) * esz;
- *     for (i = cnt; i < tot; i += esz) {
- *         store_1s(-1, vd[vl+i]);
- *     }
- * }
- */
-static void gen_ldst_stride_tail_loop(DisasContext *s, TCGv dest, uint32_t nf,
-                                      gen_tl_ldst *st_fn)
-{
-    TCGv i = tcg_temp_new();
-    TCGv k = tcg_temp_new();
-    TCGv tail_cnt = tcg_temp_new();
-    TCGv tail_tot = tcg_temp_new();
-    TCGv tail_addr = tcg_temp_new();
-
-    TCGLabel *start = gen_new_label();
-    TCGLabel *end = gen_new_label();
-    TCGLabel *start_i = gen_new_label();
-    TCGLabel *end_i = gen_new_label();
-
-    uint32_t max_elems_b = MAXSZ(s);
-    uint32_t esz = 1 << s->sew;
-
-    /* Start of the outer loop. */
-    tcg_gen_movi_tl(k, 0);
-    tcg_gen_shli_tl(tail_cnt, cpu_vl, s->sew);
-    tcg_gen_movi_tl(tail_tot, max_elems_b);
-    tcg_gen_add_tl(tail_addr, dest, tail_cnt);
-    gen_set_label(start);
-    tcg_gen_brcond_tl(TCG_COND_GE, k, tcg_constant_tl(nf), end);
-    /* Start of the inner loop. */
-    tcg_gen_mov_tl(i, tail_cnt);
-    gen_set_label(start_i);
-    tcg_gen_brcond_tl(TCG_COND_GE, i, tail_tot, end_i);
-    /* store_1s(-1, vd[vl+i]); */
-    st_fn(tcg_constant_tl(-1), (TCGv_ptr)tail_addr, 0);
-    tcg_gen_addi_tl(tail_addr, tail_addr, esz);
-    tcg_gen_addi_tl(i, i, esz);
-    tcg_gen_br(start_i);
-    /* End of the inner loop. */
-    gen_set_label(end_i);
-    /* Update the counts */
-    tcg_gen_addi_tl(tail_cnt, tail_cnt, max_elems_b);
-    tcg_gen_addi_tl(tail_tot, tail_cnt, max_elems_b);
-    tcg_gen_addi_tl(k, k, 1);
-    tcg_gen_br(start);
-    /* End of the outer loop. */
-    gen_set_label(end);
-
-    return;
-}
+typedef void gen_helper_ldst_stride(TCGv_ptr, TCGv_ptr, TCGv,
+                                    TCGv, TCGv_env, TCGv_i32);
 
 static bool ldst_stride_trans(uint32_t vd, uint32_t rs1, uint32_t rs2,
-                              uint32_t data, DisasContext *s, bool is_load)
+                              uint32_t data, gen_helper_ldst_stride *fn,
+                              DisasContext *s)
 {
-    if (!s->vstart_eq_zero) {
-        return false;
-    }
+    TCGv_ptr dest, mask;
+    TCGv base, stride;
+    TCGv_i32 desc;
 
-    TCGv dest = tcg_temp_new();
+    dest = tcg_temp_new_ptr();
+    mask = tcg_temp_new_ptr();
+    base = get_gpr(s, rs1, EXT_NONE);
+    stride = get_gpr(s, rs2, EXT_NONE);
+    desc = tcg_constant_i32(simd_desc(s->cfg_ptr->vlenb,
+                                      s->cfg_ptr->vlenb, data));
 
-    uint32_t nf = FIELD_EX32(data, VDATA, NF);
-    uint32_t vm = FIELD_EX32(data, VDATA, VM);
-
-    /* Destination register and mask register */
-    tcg_gen_addi_tl(dest, (TCGv)tcg_env, vreg_ofs(s, vd));
-
-    /*
-     * Select the appropriate load/tore to retrieve data from the vector
-     * register given a specific sew.
-     */
-    static gen_tl_ldst * const ld_fns[4] = {
-        tcg_gen_ld8u_tl, tcg_gen_ld16u_tl,
-        tcg_gen_ld32u_tl, tcg_gen_ld_tl
-    };
-
-    static gen_tl_ldst * const st_fns[4] = {
-        tcg_gen_st8_tl, tcg_gen_st16_tl,
-        tcg_gen_st32_tl, tcg_gen_st_tl
-    };
-
-    gen_tl_ldst *ld_fn = ld_fns[s->sew];
-    gen_tl_ldst *st_fn = st_fns[s->sew];
-
-    if (ld_fn == NULL || st_fn == NULL) {
-        return false;
-    }
+    tcg_gen_addi_ptr(dest, tcg_env, vreg_ofs(s, vd));
+    tcg_gen_addi_ptr(mask, tcg_env, vreg_ofs(s, 0));
 
     mark_vs_dirty(s);
 
-    gen_ldst_stride_main_loop(s, dest, rs1, rs2, vm, nf, ld_fn, st_fn, is_load);
-
-    tcg_gen_movi_tl(cpu_vstart, 0);
-
-    /*
-     * Set the tail bytes to 1 if tail agnostic:
-     */
-    if (s->vta != 0 && is_load) {
-        gen_ldst_stride_tail_loop(s, dest, nf, st_fn);
-    }
+    fn(dest, mask, base, stride, tcg_env, desc);
 
     finalize_rvv_inst(s);
     return true;
@@ -1152,6 +898,16 @@ static bool ldst_stride_trans(uint32_t vd, uint32_t rs1, uint32_t rs2,
 static bool ld_stride_op(DisasContext *s, arg_rnfvm *a, uint8_t eew)
 {
     uint32_t data = 0;
+    gen_helper_ldst_stride *fn;
+    static gen_helper_ldst_stride * const fns[4] = {
+        gen_helper_vlse8_v, gen_helper_vlse16_v,
+        gen_helper_vlse32_v, gen_helper_vlse64_v
+    };
+
+    fn = fns[eew];
+    if (fn == NULL) {
+        return false;
+    }
 
     uint8_t emul = vext_get_emul(s, eew);
     data = FIELD_DP32(data, VDATA, VM, a->vm);
@@ -1159,7 +915,7 @@ static bool ld_stride_op(DisasContext *s, arg_rnfvm *a, uint8_t eew)
     data = FIELD_DP32(data, VDATA, NF, a->nf);
     data = FIELD_DP32(data, VDATA, VTA, s->vta);
     data = FIELD_DP32(data, VDATA, VMA, s->vma);
-    return ldst_stride_trans(a->rd, a->rs1, a->rs2, data, s, true);
+    return ldst_stride_trans(a->rd, a->rs1, a->rs2, data, fn, s);
 }
 
 static bool ld_stride_check(DisasContext *s, arg_rnfvm* a, uint8_t eew)
@@ -1177,13 +933,23 @@ GEN_VEXT_TRANS(vlse64_v, MO_64, rnfvm, ld_stride_op, ld_stride_check)
 static bool st_stride_op(DisasContext *s, arg_rnfvm *a, uint8_t eew)
 {
     uint32_t data = 0;
+    gen_helper_ldst_stride *fn;
+    static gen_helper_ldst_stride * const fns[4] = {
+        /* masked stride store */
+        gen_helper_vsse8_v,  gen_helper_vsse16_v,
+        gen_helper_vsse32_v,  gen_helper_vsse64_v
+    };
 
     uint8_t emul = vext_get_emul(s, eew);
     data = FIELD_DP32(data, VDATA, VM, a->vm);
     data = FIELD_DP32(data, VDATA, LMUL, emul);
     data = FIELD_DP32(data, VDATA, NF, a->nf);
+    fn = fns[eew];
+    if (fn == NULL) {
+        return false;
+    }
 
-    return ldst_stride_trans(a->rd, a->rs1, a->rs2, data, s, false);
+    return ldst_stride_trans(a->rd, a->rs1, a->rs2, data, fn, s);
 }
 
 static bool st_stride_check(DisasContext *s, arg_rnfvm* a, uint8_t eew)
@@ -1534,6 +1300,17 @@ GEN_LDST_WHOLE_TRANS(vs8r_v, int8_t, 8, false)
  *** Vector Integer Arithmetic Instructions
  */
 
+/*
+ * MAXSZ returns the maximum vector size can be operated in bytes,
+ * which is used in GVEC IR when vl_eq_vlmax flag is set to true
+ * to accelerate vector operation.
+ */
+static inline uint32_t MAXSZ(DisasContext *s)
+{
+    int max_sz = s->cfg_ptr->vlenb * 8;
+    return max_sz >> (3 - s->lmul);
+}
+
 static bool opivv_check(DisasContext *s, arg_rmrr *a)
 {
     return require_rvv(s) &&

From 30ef718423e8018723087cd17be0fd9c6dfa2e53 Mon Sep 17 00:00:00 2001
From: Xu Lu <luxu.kernel@bytedance.com>
Date: Tue, 8 Jul 2025 14:07:20 +0800
Subject: [PATCH 2677/2760] target/riscv: Fix exception type when VU accesses
 supervisor CSRs

When supervisor CSRs are accessed from VU-mode, a virtual instruction
exception should be raised instead of an illegal instruction.

Fixes: c1fbcecb3a (target/riscv: Fix csr number based privilege checking)
Signed-off-by: Xu Lu <luxu.kernel@bytedance.com>
Reviewed-by: Anup Patel <apatel@ventanamicro.com>
Reviewed-by: Nutty Liu <liujingqi@lanxincomputing.com>
Message-ID: <20250708060720.7030-1-luxu.kernel@bytedance.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index 8631be97c5..9bebfae3f0 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -5577,7 +5577,7 @@ static inline RISCVException riscv_csrrw_check(CPURISCVState *env,
 
     csr_priv = get_field(csrno, 0x300);
     if (!env->debugger && (effective_priv < csr_priv)) {
-        if (csr_priv == (PRV_S + 1) && env->virt_enabled) {
+        if (csr_priv <= (PRV_S + 1) && env->virt_enabled) {
             return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
         }
         return RISCV_EXCP_ILLEGAL_INST;

From e443ba03361b63218e6c3aa4f73d2cb5b9b1d372 Mon Sep 17 00:00:00 2001
From: Jay Chang <jay.chang@sifive.com>
Date: Tue, 1 Jul 2025 11:00:20 +0800
Subject: [PATCH 2678/2760] target/riscv: Restrict mideleg/medeleg/medelegh
 access to S-mode harts

RISC-V Privileged Spec states:
"In harts with S-mode, the medeleg and mideleg registers must exist, and
setting a bit in medeleg or mideleg will delegate the corresponding trap
, when occurring in S-mode or U-mode, to the S-mode trap handler. In
harts without S-mode, the medeleg and mideleg registers should not
exist."

Add smode predicate to ensure these CSRs are only accessible when S-mode
is supported.

Reviewed-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Jay Chang <jay.chang@sifive.com>
Reviewed-by: Nutty Liu<liujingqi@lanxincomputing.com>
Message-ID: <20250701030021.99218-2-jay.chang@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index 9bebfae3f0..5a6de07486 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -5862,8 +5862,8 @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
                           NULL,                read_mstatus_i128           },
     [CSR_MISA]        = { "misa",       any,   read_misa,    write_misa,
                           NULL,                read_misa_i128              },
-    [CSR_MIDELEG]     = { "mideleg",    any,   NULL, NULL,   rmw_mideleg   },
-    [CSR_MEDELEG]     = { "medeleg",    any,   read_medeleg, write_medeleg },
+    [CSR_MIDELEG]     = { "mideleg",    smode,   NULL, NULL,   rmw_mideleg   },
+    [CSR_MEDELEG]     = { "medeleg",    smode,   read_medeleg, write_medeleg },
     [CSR_MIE]         = { "mie",        any,   NULL, NULL,   rmw_mie       },
     [CSR_MTVEC]       = { "mtvec",      any,   read_mtvec,   write_mtvec   },
     [CSR_MCOUNTEREN]  = { "mcounteren", umode, read_mcounteren,
@@ -5871,7 +5871,7 @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
 
     [CSR_MSTATUSH]    = { "mstatush",   any32, read_mstatush,
                           write_mstatush                                   },
-    [CSR_MEDELEGH]    = { "medelegh",   any32, read_zero, write_ignore,
+    [CSR_MEDELEGH]    = { "medelegh",   smode32, read_zero, write_ignore,
                           .min_priv_ver = PRIV_VERSION_1_13_0              },
     [CSR_HEDELEGH]    = { "hedelegh",   hmode32, read_hedelegh, write_hedelegh,
                           .min_priv_ver = PRIV_VERSION_1_13_0              },

From 86bc3a0abf10072081cddd8dff25aa72c60e67b8 Mon Sep 17 00:00:00 2001
From: Jay Chang <jay.chang@sifive.com>
Date: Tue, 1 Jul 2025 11:00:21 +0800
Subject: [PATCH 2679/2760] target/riscv: Restrict midelegh access to S-mode
 harts

RISC-V AIA Spec states:
"For a machine-level environment, extension Smaia encompasses all added
CSRs and all modifications to interrupt response behavior that the AIA
specifies for a hart, over all privilege levels. For a supervisor-level
environment, extension Ssaia is essentially the same as Smaia except
excluding the machine-level CSRs and behavior not directly visible to
supervisor level."

Since midelegh is an AIA machine-mode CSR, add Smaia extension check in
aia_smode32 predicate.

Reviewed-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Jay Chang <jay.chang@sifive.com>
Reviewed-by: Nutty Liu<liujingqi@lanxincomputing.com>
Message-ID: <20250701030021.99218-3-jay.chang@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index 5a6de07486..8842e07a73 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -374,8 +374,11 @@ static RISCVException aia_smode(CPURISCVState *env, int csrno)
 static RISCVException aia_smode32(CPURISCVState *env, int csrno)
 {
     int ret;
+    int csr_priv = get_field(csrno, 0x300);
 
-    if (!riscv_cpu_cfg(env)->ext_ssaia) {
+    if (csr_priv == PRV_M && !riscv_cpu_cfg(env)->ext_smaia) {
+        return RISCV_EXCP_ILLEGAL_INST;
+    } else if (!riscv_cpu_cfg(env)->ext_ssaia) {
         return RISCV_EXCP_ILLEGAL_INST;
     }
 
@@ -5911,7 +5914,7 @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
     [CSR_MVIP]     = { "mvip",     aia_any, NULL, NULL, rmw_mvip    },
 
     /* Machine-Level High-Half CSRs (AIA) */
-    [CSR_MIDELEGH] = { "midelegh", aia_any32, NULL, NULL, rmw_midelegh },
+    [CSR_MIDELEGH] = { "midelegh", aia_smode32, NULL, NULL, rmw_midelegh },
     [CSR_MIEH]     = { "mieh",     aia_any32, NULL, NULL, rmw_mieh     },
     [CSR_MVIENH]   = { "mvienh",   aia_any32, NULL, NULL, rmw_mvienh   },
     [CSR_MVIPH]    = { "mviph",    aia_any32, NULL, NULL, rmw_mviph    },

From caab7ac83507e3e9a5fe2f37be5cfa759e766ba2 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Mon, 14 Jul 2025 09:54:46 +0800
Subject: [PATCH 2680/2760] target/loongarch: Fix valid virtual address
 checking

On LoongArch64 system, the high 32 bit of 64 bit virtual address should be
0x00000[0-7]yyy or 0xffff8yyy. The bit from 47 to 63 should be all 0 or
all 1.

Function get_physical_address() only checks bit 48 to 63, there will be
problem with the following test case. On physical machine, there is bus
error report and program exits abnormally. However on qemu TCG system
emulation mode, the program runs normally. The virtual address
0xffff000000000000ULL + addr and addr are treated the same on TLB entry
checking. This patch fixes this issue.

void main()
{
        void *addr, *addr1;
        int val;

        addr = malloc(100);
        *(int *)addr = 1;
        addr1 = 0xffff000000000000ULL + addr;
        val = *(int *)addr1;
        printf("val %d \n", val);
}

Cc: qemu-stable@nongnu.org
Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Acked-by: Song Gao <gaosong@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
Message-ID: <20250714015446.746163-1-maobibo@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 target/loongarch/cpu_helper.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/loongarch/cpu_helper.c b/target/loongarch/cpu_helper.c
index e172b11ce1..b5f732f15b 100644
--- a/target/loongarch/cpu_helper.c
+++ b/target/loongarch/cpu_helper.c
@@ -196,8 +196,8 @@ int get_physical_address(CPULoongArchState *env, hwaddr *physical,
     }
 
     /* Check valid extension */
-    addr_high = sextract64(address, TARGET_VIRT_ADDR_SPACE_BITS, 16);
-    if (!(addr_high == 0 || addr_high == -1)) {
+    addr_high = (int64_t)address >> (TARGET_VIRT_ADDR_SPACE_BITS - 1);
+    if (!(addr_high == 0 || addr_high == -1ULL)) {
         return TLBRET_BADADDR;
     }
 

From 31995cc4087123a13e9345153e0c39ffb44b9277 Mon Sep 17 00:00:00 2001
From: Song Gao <gaosong@loongson.cn>
Date: Fri, 25 Jul 2025 16:12:13 +0800
Subject: [PATCH 2681/2760] hw/intc/loongarch_ipi: Fix start fail with smp cpu
 < smp maxcpus on KVM

QEMU start failed when smp cpu < smp maxcpus , because qemu send a NULL
cpu to KVM, this patch adds a check for kvm_ipi_access_regs() to fix it.

run with '-smp 1,maxcpus=4,sockets=4,cores=1,threads=1'

we got:
Unexpected error in kvm_device_access() at ../accel/kvm/kvm-all.c:3477:
qemu-system-loongarch64: KVM_SET_DEVICE_ATTR failed: Group 1073741825 attr 0x0000000000010000: Invalid argument

Signed-off-by: Song Gao <gaosong@loongson.cn>
Reviewed-by: Bibo Mao <maobibo@loongson.cn>
Message-ID: <20250725081213.3867592-1-gaosong@loongson.cn>
---
 hw/intc/loongarch_ipi_kvm.c | 27 ++++++++++++++++-----------
 1 file changed, 16 insertions(+), 11 deletions(-)

diff --git a/hw/intc/loongarch_ipi_kvm.c b/hw/intc/loongarch_ipi_kvm.c
index 4cb3acc921..dd4c367abf 100644
--- a/hw/intc/loongarch_ipi_kvm.c
+++ b/hw/intc/loongarch_ipi_kvm.c
@@ -23,36 +23,41 @@ static void kvm_ipi_access_regs(void *opaque, bool write)
     LoongarchIPIState *lis = LOONGARCH_IPI(opaque);
     IPICore *core;
     uint64_t attr;
-    int cpu, fd = lis->dev_fd;
+    int i, cpu_index, fd = lis->dev_fd;
 
     if (fd == 0) {
         return;
     }
 
-    for (cpu = 0; cpu < ipi->num_cpu; cpu++) {
-        core = &ipi->cpu[cpu];
-        attr = (cpu << 16) | CORE_STATUS_OFF;
+    for (i = 0; i < ipi->num_cpu; i++) {
+        core = &ipi->cpu[i];
+        if (core->cpu == NULL) {
+            continue;
+        }
+        cpu_index = i;
+
+        attr = (cpu_index << 16) | CORE_STATUS_OFF;
         kvm_ipi_access_reg(fd, attr, &core->status, write);
 
-        attr = (cpu << 16) | CORE_EN_OFF;
+        attr = (cpu_index << 16) | CORE_EN_OFF;
         kvm_ipi_access_reg(fd, attr, &core->en, write);
 
-        attr = (cpu << 16) | CORE_SET_OFF;
+        attr = (cpu_index << 16) | CORE_SET_OFF;
         kvm_ipi_access_reg(fd, attr, &core->set, write);
 
-        attr = (cpu << 16) | CORE_CLEAR_OFF;
+        attr = (cpu_index << 16) | CORE_CLEAR_OFF;
         kvm_ipi_access_reg(fd, attr, &core->clear, write);
 
-        attr = (cpu << 16) | CORE_BUF_20;
+        attr = (cpu_index << 16) | CORE_BUF_20;
         kvm_ipi_access_reg(fd, attr, &core->buf[0], write);
 
-        attr = (cpu << 16) | CORE_BUF_28;
+        attr = (cpu_index << 16) | CORE_BUF_28;
         kvm_ipi_access_reg(fd, attr, &core->buf[2], write);
 
-        attr = (cpu << 16) | CORE_BUF_30;
+        attr = (cpu_index << 16) | CORE_BUF_30;
         kvm_ipi_access_reg(fd, attr, &core->buf[4], write);
 
-        attr = (cpu << 16) | CORE_BUF_38;
+        attr = (cpu_index << 16) | CORE_BUF_38;
         kvm_ipi_access_reg(fd, attr, &core->buf[6], write);
     }
 }

From cd9f752fee75238f842a91be1146c988bd16a010 Mon Sep 17 00:00:00 2001
From: Alex Richardson <alexrichardson@google.com>
Date: Fri, 25 Jul 2025 10:01:36 -0700
Subject: [PATCH 2682/2760] target/arm: add support for 64-bit PMCCNTR in
 AArch32 mode

In the PMUv3, a new AArch32 64-bit (MCRR/MRRC) accessor for the
PMCCNTR was added. In QEMU we forgot to implement this, so only
provide the 32-bit accessor. Since we have a 64-bit PMCCNTR
sysreg for AArch64, adding the 64-bit AArch32 version is easy.

We add the PMCCNTR to the v8_cp_reginfo because PMUv3 was added
in the ARMv8 architecture. This is consistent with how we
handle the existing PMCCNTR support, where we always implement
it for all v7 CPUs. This is arguably something we should
clean up so it is gated on ARM_FEATURE_PMU and/or an ID
register check for the relevant PMU version, but we should
do that as its own tidyup rather than being inconsistent between
this PMCCNTR accessor and the others.

Since the register name is the same as the 32-bit PMCCNTR, we set
ARM_CP_NO_GDB on the 32-bit one to avoid generating an invalid GDB XML.

See https://developer.arm.com/documentation/ddi0601/2024-06/AArch32-Registers/PMCCNTR--Performance-Monitors-Cycle-Count-Register?lang=en

Note for potential backporting:
 * this code in cpregs-pmu.c will be in helper.c on stable
   branches that don't have commit ae2086426d37

Cc: qemu-stable@nongnu.org
Signed-off-by: Alex Richardson <alexrichardson@google.com>
Message-id: 20250725170136.145116-1-alexrichardson@google.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpregs-pmu.c | 29 ++++++++++++++++++++++++-----
 1 file changed, 24 insertions(+), 5 deletions(-)

diff --git a/target/arm/cpregs-pmu.c b/target/arm/cpregs-pmu.c
index 0f295b1376..9c4431c18b 100644
--- a/target/arm/cpregs-pmu.c
+++ b/target/arm/cpregs-pmu.c
@@ -1067,11 +1067,6 @@ static const ARMCPRegInfo v7_pm_reginfo[] = {
       .fgt = FGT_PMSELR_EL0,
       .fieldoffset = offsetof(CPUARMState, cp15.c9_pmselr),
       .writefn = pmselr_write, .raw_writefn = raw_write, },
-    { .name = "PMCCNTR", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 0,
-      .access = PL0_RW, .resetvalue = 0, .type = ARM_CP_ALIAS | ARM_CP_IO,
-      .fgt = FGT_PMCCNTR_EL0,
-      .readfn = pmccntr_read, .writefn = pmccntr_write32,
-      .accessfn = pmreg_access_ccntr },
     { .name = "PMCCNTR_EL0", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 13, .opc2 = 0,
       .access = PL0_RW, .accessfn = pmreg_access_ccntr,
@@ -1211,6 +1206,23 @@ void define_pm_cpregs(ARMCPU *cpu)
         define_one_arm_cp_reg(cpu, &pmcr);
         define_one_arm_cp_reg(cpu, &pmcr64);
         define_arm_cp_regs(cpu, v7_pm_reginfo);
+        /*
+         * 32-bit AArch32 PMCCNTR. We don't expose this to GDB if the
+         * new-in-v8 PMUv3 64-bit AArch32 PMCCNTR register is implemented
+         * (as that will provide the GDB user's view of "PMCCNTR").
+         */
+        ARMCPRegInfo pmccntr = {
+            .name = "PMCCNTR",
+            .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 0,
+            .access = PL0_RW, .accessfn = pmreg_access_ccntr,
+            .resetvalue = 0, .type = ARM_CP_ALIAS | ARM_CP_IO,
+            .fgt = FGT_PMCCNTR_EL0,
+            .readfn = pmccntr_read, .writefn = pmccntr_write32,
+        };
+        if (arm_feature(env, ARM_FEATURE_V8)) {
+            pmccntr.type |= ARM_CP_NO_GDB;
+        }
+        define_one_arm_cp_reg(cpu, &pmccntr);
 
         for (unsigned i = 0, pmcrn = pmu_num_counters(env); i < pmcrn; i++) {
             g_autofree char *pmevcntr_name = g_strdup_printf("PMEVCNTR%d", i);
@@ -1276,6 +1288,13 @@ void define_pm_cpregs(ARMCPU *cpu)
               .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST,
               .fgt = FGT_PMCEIDN_EL0,
               .resetvalue = cpu->pmceid1 },
+            /* AArch32 64-bit PMCCNTR view: added in PMUv3 with Armv8 */
+            { .name = "PMCCNTR", .state = ARM_CP_STATE_AA32,
+              .cp = 15, .crm = 9, .opc1 = 0,
+              .access = PL0_RW, .accessfn = pmreg_access_ccntr, .resetvalue = 0,
+              .type = ARM_CP_ALIAS | ARM_CP_IO | ARM_CP_64BIT,
+              .fgt = FGT_PMCCNTR_EL0, .readfn = pmccntr_read,
+              .writefn = pmccntr_write,  },
         };
         define_arm_cp_regs(cpu, v8_pm_reginfo);
     }

From 6fcf5ebafad65adc19a616260ca7dc90005785d1 Mon Sep 17 00:00:00 2001
From: Jonah Palmer <jonah.palmer@oracle.com>
Date: Mon, 21 Jul 2025 15:02:08 +0000
Subject: [PATCH 2683/2760] virtio: fix off-by-one and invalid access in
 virtqueue_ordered_fill

Commit b44135daa372 introduced virtqueue_ordered_fill for
VIRTIO_F_IN_ORDER support but had a few issues:

* Conditional while loop used 'steps <= max_steps' but should've been
  'steps < max_steps' since reaching steps == max_steps would indicate
  that we didn't find an element, which is an error. Without this
  change, the code would attempt to read invalid data at an index
  outside of our search range.

* Incremented 'steps' using the next chain's ndescs instead of the
  current one.

This patch corrects the loop bounds and synchronizes 'steps' and index
increments.

We also add a defensive sanity check against malicious or invalid
descriptor counts to avoid a potential infinite loop and DoS.

Fixes: b44135daa372 ("virtio: virtqueue_ordered_fill - VIRTIO_F_IN_ORDER support")
Reported-by: terrynini <terrynini38514@gmail.com>
Signed-off-by: Jonah Palmer <jonah.palmer@oracle.com>
Message-Id: <20250721150208.2409779-1-jonah.palmer@oracle.com>
Reviewed-by: Si-Wei Liu <si-wei.liu@oracle.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/virtio/virtio.c | 22 ++++++++++++++++------
 1 file changed, 16 insertions(+), 6 deletions(-)

diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
index 2ab1d20769..9a81ad912e 100644
--- a/hw/virtio/virtio.c
+++ b/hw/virtio/virtio.c
@@ -938,18 +938,18 @@ static void virtqueue_packed_fill(VirtQueue *vq, const VirtQueueElement *elem,
 static void virtqueue_ordered_fill(VirtQueue *vq, const VirtQueueElement *elem,
                                    unsigned int len)
 {
-    unsigned int i, steps, max_steps;
+    unsigned int i, steps, max_steps, ndescs;
 
     i = vq->used_idx % vq->vring.num;
     steps = 0;
     /*
-     * We shouldn't need to increase 'i' by more than the distance
-     * between used_idx and last_avail_idx.
+     * We shouldn't need to increase 'i' by more than or equal to
+     * the distance between used_idx and last_avail_idx (max_steps).
      */
     max_steps = (vq->last_avail_idx - vq->used_idx) % vq->vring.num;
 
     /* Search for element in vq->used_elems */
-    while (steps <= max_steps) {
+    while (steps < max_steps) {
         /* Found element, set length and mark as filled */
         if (vq->used_elems[i].index == elem->index) {
             vq->used_elems[i].len = len;
@@ -957,8 +957,18 @@ static void virtqueue_ordered_fill(VirtQueue *vq, const VirtQueueElement *elem,
             break;
         }
 
-        i += vq->used_elems[i].ndescs;
-        steps += vq->used_elems[i].ndescs;
+        ndescs = vq->used_elems[i].ndescs;
+
+        /* Defensive sanity check */
+        if (unlikely(ndescs == 0 || ndescs > vq->vring.num)) {
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "%s: %s invalid ndescs %u at position %u\n",
+                          __func__, vq->vdev->name, ndescs, i);
+            return;
+        }
+
+        i += ndescs;
+        steps += ndescs;
 
         if (i >= vq->vring.num) {
             i -= vq->vring.num;

From c1997099dc26d95eb9f2249f2894aabf4cf0bf8b Mon Sep 17 00:00:00 2001
From: Hanna Czenczek <hreitz@redhat.com>
Date: Thu, 24 Jul 2025 14:59:27 +0200
Subject: [PATCH 2684/2760] vhost: Do not abort on log-start error

Commit 3688fec8923 ("memory: Add Error** argument to .log_global_start()
handler") enabled vhost_log_global_start() to return a proper error, but
did not change it to do so; instead, it still aborts the whole process
on error.

This crash can be reproduced by e.g. killing a virtiofsd daemon before
initiating migration.  In such a case, qemu should not crash, but just
make the attempted migration fail.

Buglink: https://issues.redhat.com/browse/RHEL-94534
Reported-by: Tingting Mao <timao@redhat.com>
Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
Message-Id: <20250724125928.61045-2-hreitz@redhat.com>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Tested-by: Lei Yang <leiyang@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/virtio/vhost.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c
index c30ea1156e..05ad5de629 100644
--- a/hw/virtio/vhost.c
+++ b/hw/virtio/vhost.c
@@ -1110,7 +1110,8 @@ static bool vhost_log_global_start(MemoryListener *listener, Error **errp)
 
     r = vhost_migration_log(listener, true);
     if (r < 0) {
-        abort();
+        error_setg_errno(errp, -r, "vhost: Failed to start logging");
+        return false;
     }
     return true;
 }

From d63c388dadb7717f6391e1bb7f11728c0c1a3e36 Mon Sep 17 00:00:00 2001
From: Hanna Czenczek <hreitz@redhat.com>
Date: Thu, 24 Jul 2025 14:59:28 +0200
Subject: [PATCH 2685/2760] vhost: Do not abort on log-stop error

Failing to stop logging in a vhost device is not exactly fatal.  We can
log such an error, but there is no need to abort the whole qemu process
because of it.

Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
Message-Id: <20250724125928.61045-3-hreitz@redhat.com>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Tested-by: Lei Yang <leiyang@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/virtio/vhost.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c
index 05ad5de629..6557c58d12 100644
--- a/hw/virtio/vhost.c
+++ b/hw/virtio/vhost.c
@@ -1122,7 +1122,8 @@ static void vhost_log_global_stop(MemoryListener *listener)
 
     r = vhost_migration_log(listener, false);
     if (r < 0) {
-        abort();
+        /* Not fatal, so report it, but take no further action */
+        warn_report("vhost: Failed to stop logging");
     }
 }
 

From 6071d13c6a37493a6b26e1609b09a98aa058038a Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Date: Sun, 27 Jul 2025 15:22:36 +0900
Subject: [PATCH 2686/2760] virtio-net: Fix VLAN filter table reset timing

Problem
-------

The expected initial state of the table depends on feature negotiation:

With VIRTIO_NET_F_CTRL_VLAN:
  The table must be empty in accordance with the specification.
Without VIRTIO_NET_F_CTRL_VLAN:
  The table must be filled to permit all VLAN traffic.

Prior to commit 06b636a1e2ad ("virtio-net: do not reset vlan filtering
at set_features"), virtio_net_set_features() always reset the VLAN
table. That commit changed the behavior to skip table reset when
VIRTIO_NET_F_CTRL_VLAN was negotiated, assuming the table would be
properly cleared during device reset and remain stable.

However, this assumption breaks when a driver renegotiates features:
1. Initial negotiation without VIRTIO_NET_F_CTRL_VLAN (table filled)
2. Renegotiation with VIRTIO_NET_F_CTRL_VLAN (table will not be cleared)

The problem was exacerbated by commit 0caed25cd171 ("virtio: Call
set_features during reset"), which triggered virtio_net_set_features()
during device reset, exposing the bug whenever VIRTIO_NET_F_CTRL_VLAN
was negotiated after a device reset.

Solution
--------

Fix the issue by initializing the table when virtio_net_set_features()
is called to change the VIRTIO_NET_F_CTRL_VLAN bit of
vdev->guest_features.

This approach ensures the correct table state regardless of feature
negotiation sequence by performing initialization in
virtio_net_set_features() as QEMU did prior to commit 06b636a1e2ad
("virtio-net: do not reset vlan filtering at set_features").

This change still preserves the goal of the commit, which was to avoid
resetting the table during migration, by checking whether the
VIRTIO_NET_F_CTRL_VLAN bit of vdev->guest_features is being changed;
vdev->guest_features is set before virtio_net_set_features() gets called
during migration.

It also avoids resetting the table when the driver sets a feature
bitmask with no change for the VIRTIO_NET_F_CTRL_VLAN bit, which makes
the operation idempotent and its semantics cleaner.

Additionally, this change ensures the table is initialized after
feature negotiation and before the DRIVER_OK status bit being set for
compatibility with the Linux driver before commit 50c0ada627f5
("virtio-net: fix race between ndo_open() and virtio_device_ready()"),
which did not ensure to set the DRIVER_OK status bit before modifying
the table.

Fixes: 06b636a1e2ad ("virtio-net: do not reset vlan filtering at set_features")
Cc: qemu-stable@nongnu.org
Reported-by: Konstantin Shkolnyy <kshk@linux.ibm.com>
Signed-off-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Tested-by: Konstantin Shkolnyy <kshk@linux.ibm.com>
Tested-by: Lei Yang <leiyang@redhat.com>
Message-Id: <20250727-vlan-v3-1-bbee738619b1@rsg.ci.i.u-tokyo.ac.jp>
Tested-by: Konstantin Shkolnyy <kshk@linux.ibm.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/net/virtio-net.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index c4c49b0f9c..6b5b5dace3 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -929,8 +929,9 @@ static void virtio_net_set_features(VirtIODevice *vdev, uint64_t features)
         vhost_net_save_acked_features(nc->peer);
     }
 
-    if (!virtio_has_feature(features, VIRTIO_NET_F_CTRL_VLAN)) {
-        memset(n->vlans, 0xff, MAX_VLAN >> 3);
+    if (virtio_has_feature(vdev->guest_features ^ features, VIRTIO_NET_F_CTRL_VLAN)) {
+        bool vlan = virtio_has_feature(features, VIRTIO_NET_F_CTRL_VLAN);
+        memset(n->vlans, vlan ? 0 : 0xff, MAX_VLAN >> 3);
     }
 
     if (virtio_has_feature(features, VIRTIO_NET_F_STANDBY)) {
@@ -3942,6 +3943,7 @@ static void virtio_net_device_realize(DeviceState *dev, Error **errp)
     n->mac_table.macs = g_malloc0(MAC_TABLE_ENTRIES * ETH_ALEN);
 
     n->vlans = g_malloc0(MAX_VLAN >> 3);
+    memset(n->vlans, 0xff, MAX_VLAN >> 3);
 
     nc = qemu_get_queue(n->nic);
     nc->rxfilter_notify_enabled = 1;
@@ -4041,7 +4043,6 @@ static void virtio_net_reset(VirtIODevice *vdev)
     memset(n->mac_table.macs, 0, MAC_TABLE_ENTRIES * ETH_ALEN);
     memcpy(&n->mac[0], &n->nic->conf->macaddr, sizeof(n->mac));
     qemu_format_nic_info_str(qemu_get_queue(n->nic), n->mac);
-    memset(n->vlans, 0, MAX_VLAN >> 3);
 
     /* Flush any async TX */
     for (i = 0;  i < n->max_queue_pairs; i++) {

From cad9aa6fbdccd95e56e10cfa57c354a20a333717 Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Date: Sun, 27 Jul 2025 15:50:08 +0900
Subject: [PATCH 2687/2760] pcie_sriov: Fix configuration and state
 synchronization

Fix issues in PCIe SR-IOV configuration register handling that caused
inconsistent internal state due to improper write mask handling and
incorrect migration behavior.

Two main problems were identified:

1. VF Enable bit write mask handling:
   pcie_sriov_config_write() incorrectly assumed that its val parameter
   was already masked, causing it to ignore the actual write mask.
   This led to the VF Enable bit being processed even when masked,
   resulting in incorrect VF registration/unregistration. It is
   identified as CVE-2025-54567.

2. Migration state inconsistency:
   pcie_sriov_pf_post_load() unconditionally called register_vfs()
   regardless of the VF Enable bit state, creating inconsistent
   internal state when VFs should not be enabled. Additionally,
   it failed to properly update the NumVFs write mask based on
   the current configuration. It is identified as CVE-2025-54566.

Root cause analysis revealed that both functions relied on incorrect
special-case assumptions instead of properly reading and consuming
the actual configuration values. This change introduces a unified
consume_config() function that reads actual configuration values and
synchronize the internal state without special-case assumptions.

The solution only adds register read overhead in non-hot-path code
while ensuring correct SR-IOV state management across configuration
writes and migration scenarios.

Fixes: 5e7dd17e4348 ("pcie_sriov: Remove num_vfs from PCIESriovPF")
Fixes: f9efcd47110d ("pcie_sriov: Register VFs after migration")
Fixes: CVE-2025-54566
Fixes: CVE-2025-54567
Cc: qemu-stable@nongnu.org
Reported-by: Corentin BAYET <corentin.bayet@reversetactics.com>
Signed-off-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Message-Id: <20250727-wmask-v2-1-394910b1c0b6@rsg.ci.i.u-tokyo.ac.jp>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/pci/pcie_sriov.c | 42 +++++++++++++++++++++++-------------------
 1 file changed, 23 insertions(+), 19 deletions(-)

diff --git a/hw/pci/pcie_sriov.c b/hw/pci/pcie_sriov.c
index 3ad18744f4..8a4bf0d6f7 100644
--- a/hw/pci/pcie_sriov.c
+++ b/hw/pci/pcie_sriov.c
@@ -64,6 +64,27 @@ static void unregister_vfs(PCIDevice *dev)
     pci_set_word(dev->wmask + dev->exp.sriov_cap + PCI_SRIOV_NUM_VF, 0xffff);
 }
 
+static void consume_config(PCIDevice *dev)
+{
+    uint8_t *cfg = dev->config + dev->exp.sriov_cap;
+
+    if (pci_get_word(cfg + PCI_SRIOV_CTRL) & PCI_SRIOV_CTRL_VFE) {
+        register_vfs(dev);
+    } else {
+        uint8_t *wmask = dev->wmask + dev->exp.sriov_cap;
+        uint16_t num_vfs = pci_get_word(cfg + PCI_SRIOV_NUM_VF);
+        uint16_t wmask_val = PCI_SRIOV_CTRL_MSE | PCI_SRIOV_CTRL_ARI;
+
+        unregister_vfs(dev);
+
+        if (num_vfs <= pci_get_word(cfg + PCI_SRIOV_TOTAL_VF)) {
+            wmask_val |= PCI_SRIOV_CTRL_VFE;
+        }
+
+        pci_set_word(wmask + PCI_SRIOV_CTRL, wmask_val);
+    }
+}
+
 static bool pcie_sriov_pf_init_common(PCIDevice *dev, uint16_t offset,
                                       uint16_t vf_dev_id, uint16_t init_vfs,
                                       uint16_t total_vfs, uint16_t vf_offset,
@@ -416,30 +437,13 @@ void pcie_sriov_config_write(PCIDevice *dev, uint32_t address,
     trace_sriov_config_write(dev->name, PCI_SLOT(dev->devfn),
                              PCI_FUNC(dev->devfn), off, val, len);
 
-    if (range_covers_byte(off, len, PCI_SRIOV_CTRL)) {
-        if (val & PCI_SRIOV_CTRL_VFE) {
-            register_vfs(dev);
-        } else {
-            unregister_vfs(dev);
-        }
-    } else if (range_covers_byte(off, len, PCI_SRIOV_NUM_VF)) {
-        uint8_t *cfg = dev->config + sriov_cap;
-        uint8_t *wmask = dev->wmask + sriov_cap;
-        uint16_t num_vfs = pci_get_word(cfg + PCI_SRIOV_NUM_VF);
-        uint16_t wmask_val = PCI_SRIOV_CTRL_MSE | PCI_SRIOV_CTRL_ARI;
-
-        if (num_vfs <= pci_get_word(cfg + PCI_SRIOV_TOTAL_VF)) {
-            wmask_val |= PCI_SRIOV_CTRL_VFE;
-        }
-
-        pci_set_word(wmask + PCI_SRIOV_CTRL, wmask_val);
-    }
+    consume_config(dev);
 }
 
 void pcie_sriov_pf_post_load(PCIDevice *dev)
 {
     if (dev->exp.sriov_cap) {
-        register_vfs(dev);
+        consume_config(dev);
     }
 }
 

From 96c75abc872c1a90c8e1f4a4d2ed35e89a1befe9 Mon Sep 17 00:00:00 2001
From: Sairaj Kodilkar <sarunkod@amd.com>
Date: Fri, 1 Aug 2025 11:35:02 +0530
Subject: [PATCH 2688/2760] hw/i386/amd_iommu: Fix MMIO register write tracing
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Define separate functions to trace MMIO write accesses instead of using
`trace_amdvi_mmio_read()` for both read and write.

Signed-off-by: Sairaj Kodilkar <sarunkod@amd.com>
Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20250801060507.3382-2-sarunkod@amd.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/amd_iommu.c | 23 ++++++++++++++++++-----
 1 file changed, 18 insertions(+), 5 deletions(-)

diff --git a/hw/i386/amd_iommu.c b/hw/i386/amd_iommu.c
index 5a24c17548..7fb0bb68f0 100644
--- a/hw/i386/amd_iommu.c
+++ b/hw/i386/amd_iommu.c
@@ -592,18 +592,31 @@ static void amdvi_cmdbuf_run(AMDVIState *s)
     }
 }
 
-static void amdvi_mmio_trace(hwaddr addr, unsigned size)
+static inline uint8_t amdvi_mmio_get_index(hwaddr addr)
 {
     uint8_t index = (addr & ~0x2000) / 8;
 
     if ((addr & 0x2000)) {
         /* high table */
         index = index >= AMDVI_MMIO_REGS_HIGH ? AMDVI_MMIO_REGS_HIGH : index;
-        trace_amdvi_mmio_read(amdvi_mmio_high[index], addr, size, addr & ~0x07);
     } else {
         index = index >= AMDVI_MMIO_REGS_LOW ? AMDVI_MMIO_REGS_LOW : index;
-        trace_amdvi_mmio_read(amdvi_mmio_low[index], addr, size, addr & ~0x07);
     }
+
+    return index;
+}
+
+static void amdvi_mmio_trace_read(hwaddr addr, unsigned size)
+{
+    uint8_t index = amdvi_mmio_get_index(addr);
+    trace_amdvi_mmio_read(amdvi_mmio_low[index], addr, size, addr & ~0x07);
+}
+
+static void amdvi_mmio_trace_write(hwaddr addr, unsigned size, uint64_t val)
+{
+    uint8_t index = amdvi_mmio_get_index(addr);
+    trace_amdvi_mmio_write(amdvi_mmio_low[index], addr, size, val,
+                           addr & ~0x07);
 }
 
 static uint64_t amdvi_mmio_read(void *opaque, hwaddr addr, unsigned size)
@@ -623,7 +636,7 @@ static uint64_t amdvi_mmio_read(void *opaque, hwaddr addr, unsigned size)
     } else if (size == 8) {
         val = amdvi_readq(s, addr);
     }
-    amdvi_mmio_trace(addr, size);
+    amdvi_mmio_trace_read(addr, size);
 
     return val;
 }
@@ -770,7 +783,7 @@ static void amdvi_mmio_write(void *opaque, hwaddr addr, uint64_t val,
         return;
     }
 
-    amdvi_mmio_trace(addr, size);
+    amdvi_mmio_trace_write(addr, size, val);
     switch (addr & ~0x07) {
     case AMDVI_MMIO_CONTROL:
         amdvi_mmio_reg_write(s, size, val, addr);

From 47d50cc421b832650822d73431d920bb8a80bc38 Mon Sep 17 00:00:00 2001
From: Sairaj Kodilkar <sarunkod@amd.com>
Date: Fri, 1 Aug 2025 11:35:03 +0530
Subject: [PATCH 2689/2760] hw/i386/amd_iommu: Remove unused and wrongly set
 ats_enabled field
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The ats_enabled field is set using HTTUNEN, which is wrong.
Fix this by removing the field as it is never used.

MST: includes a tweak suggested by Philippe

Fixes: d29a09ca68428 ("hw/i386: Introduce AMD IOMMU")
Signed-off-by: Sairaj Kodilkar <sarunkod@amd.com>
Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
Message-Id: <20250801060507.3382-3-sarunkod@amd.com>
Message-ID: <948a6ac3-ded9-475b-8c45-9d36220b442b@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/amd_iommu.c | 5 ++---
 hw/i386/amd_iommu.h | 1 -
 2 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/hw/i386/amd_iommu.c b/hw/i386/amd_iommu.c
index 7fb0bb68f0..037e78056d 100644
--- a/hw/i386/amd_iommu.c
+++ b/hw/i386/amd_iommu.c
@@ -646,7 +646,6 @@ static void amdvi_handle_control_write(AMDVIState *s)
     unsigned long control = amdvi_readq(s, AMDVI_MMIO_CONTROL);
     s->enabled = !!(control & AMDVI_MMIO_CONTROL_AMDVIEN);
 
-    s->ats_enabled = !!(control & AMDVI_MMIO_CONTROL_HTTUNEN);
     s->evtlog_enabled = s->enabled && !!(control &
                         AMDVI_MMIO_CONTROL_EVENTLOGEN);
 
@@ -1555,7 +1554,6 @@ static void amdvi_init(AMDVIState *s)
     s->excl_allow = false;
     s->mmio_enabled = false;
     s->enabled = false;
-    s->ats_enabled = false;
     s->cmdbuf_enabled = false;
 
     /* reset MMIO */
@@ -1626,7 +1624,8 @@ static const VMStateDescription vmstate_amdvi_sysbus_migratable = {
       /* Updated in  amdvi_handle_control_write() */
       VMSTATE_BOOL(enabled, AMDVIState),
       VMSTATE_BOOL(ga_enabled, AMDVIState),
-      VMSTATE_BOOL(ats_enabled, AMDVIState),
+      /* bool ats_enabled is obsolete */
+      VMSTATE_UNUSED(1), /* was ats_enabled */
       VMSTATE_BOOL(cmdbuf_enabled, AMDVIState),
       VMSTATE_BOOL(completion_wait_intr, AMDVIState),
       VMSTATE_BOOL(evtlog_enabled, AMDVIState),
diff --git a/hw/i386/amd_iommu.h b/hw/i386/amd_iommu.h
index 8b42913ed8..67078c6f1e 100644
--- a/hw/i386/amd_iommu.h
+++ b/hw/i386/amd_iommu.h
@@ -322,7 +322,6 @@ struct AMDVIState {
     uint64_t mmio_addr;
 
     bool enabled;                /* IOMMU enabled                */
-    bool ats_enabled;            /* address translation enabled  */
     bool cmdbuf_enabled;         /* command buffer enabled       */
     bool evtlog_enabled;         /* event log enabled            */
     bool excl_enabled;

From a7842d94067cddc80b47ac42fb6e49e2fc02a3c5 Mon Sep 17 00:00:00 2001
From: Sairaj Kodilkar <sarunkod@amd.com>
Date: Fri, 1 Aug 2025 11:35:04 +0530
Subject: [PATCH 2690/2760] hw/i386/amd_iommu: Move IOAPIC memory region
 initialization to the end

Setting up IOAPIC memory region requires mr_sys and mr_ir. Currently
these two memory regions are setup after the initializing the IOAPIC
memory region, which cause `amdvi_host_dma_iommu()` to use unitialized
mr_sys and mr_ir.

Move the IOAPIC memory region initialization to the end in order to use
the mr_sys and mr_ir regions after they are fully initialized.

Fixes: 577c470f4326 ("x86_iommu/amd: Prepare for interrupt remap support")
Signed-off-by: Sairaj Kodilkar <sarunkod@amd.com>
Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
Message-Id: <20250801060507.3382-4-sarunkod@amd.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/amd_iommu.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/hw/i386/amd_iommu.c b/hw/i386/amd_iommu.c
index 037e78056d..7308611bf1 100644
--- a/hw/i386/amd_iommu.c
+++ b/hw/i386/amd_iommu.c
@@ -1698,9 +1698,6 @@ static void amdvi_sysbus_realize(DeviceState *dev, Error **errp)
     s->iotlb = g_hash_table_new_full(amdvi_uint64_hash,
                                      amdvi_uint64_equal, g_free, g_free);
 
-    /* Pseudo address space under root PCI bus. */
-    x86ms->ioapic_as = amdvi_host_dma_iommu(bus, s, AMDVI_IOAPIC_SB_DEVID);
-
     /* set up MMIO */
     memory_region_init_io(&s->mr_mmio, OBJECT(s), &mmio_mem_ops, s,
                           "amdvi-mmio", AMDVI_MMIO_SIZE);
@@ -1723,6 +1720,9 @@ static void amdvi_sysbus_realize(DeviceState *dev, Error **errp)
     memory_region_add_subregion_overlap(&s->mr_sys, AMDVI_INT_ADDR_FIRST,
                                         &s->mr_ir, 1);
 
+    /* Pseudo address space under root PCI bus. */
+    x86ms->ioapic_as = amdvi_host_dma_iommu(bus, s, AMDVI_IOAPIC_SB_DEVID);
+
     if (kvm_enabled() && x86ms->apic_id_limit > 255 && !s->xtsup) {
         error_report("AMD IOMMU with x2APIC configuration requires xtsup=on");
         exit(EXIT_FAILURE);

From 47d3b32d6fb1c6ec8afb78d12d2420dbbb4c3499 Mon Sep 17 00:00:00 2001
From: Sairaj Kodilkar <sarunkod@amd.com>
Date: Fri, 1 Aug 2025 11:35:05 +0530
Subject: [PATCH 2691/2760] hw/i386/amd_iommu: Fix amdvi_write*()

amdvi_write*() function do not preserve the older values of W1C bits in
the MMIO register. This results in all W1C bits set to 0, when guest
tries to reset a single bit by writing 1 to it. Fix this by preserving
W1C bits in the old value of the MMIO register.

Fixes: d29a09ca68428 ("hw/i386: Introduce AMD IOMMU")
Suggested-by: Ethan MILON <ethan.milon@eviden.com>
Signed-off-by: Sairaj Kodilkar <sarunkod@amd.com>
Message-Id: <20250801060507.3382-5-sarunkod@amd.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/amd_iommu.c | 21 ++++++++++++++++++---
 1 file changed, 18 insertions(+), 3 deletions(-)

diff --git a/hw/i386/amd_iommu.c b/hw/i386/amd_iommu.c
index 7308611bf1..c9c32cf7b0 100644
--- a/hw/i386/amd_iommu.c
+++ b/hw/i386/amd_iommu.c
@@ -123,8 +123,13 @@ static void amdvi_writew(AMDVIState *s, hwaddr addr, uint16_t val)
     uint16_t romask = lduw_le_p(&s->romask[addr]);
     uint16_t w1cmask = lduw_le_p(&s->w1cmask[addr]);
     uint16_t oldval = lduw_le_p(&s->mmior[addr]);
+
+    uint16_t oldval_preserved = oldval & (romask | w1cmask);
+    uint16_t newval_write = val & ~romask;
+    uint16_t newval_w1c_set = val & w1cmask;
+
     stw_le_p(&s->mmior[addr],
-            ((oldval & romask) | (val & ~romask)) & ~(val & w1cmask));
+             (oldval_preserved | newval_write) & ~newval_w1c_set);
 }
 
 static void amdvi_writel(AMDVIState *s, hwaddr addr, uint32_t val)
@@ -132,8 +137,13 @@ static void amdvi_writel(AMDVIState *s, hwaddr addr, uint32_t val)
     uint32_t romask = ldl_le_p(&s->romask[addr]);
     uint32_t w1cmask = ldl_le_p(&s->w1cmask[addr]);
     uint32_t oldval = ldl_le_p(&s->mmior[addr]);
+
+    uint32_t oldval_preserved = oldval & (romask | w1cmask);
+    uint32_t newval_write = val & ~romask;
+    uint32_t newval_w1c_set = val & w1cmask;
+
     stl_le_p(&s->mmior[addr],
-            ((oldval & romask) | (val & ~romask)) & ~(val & w1cmask));
+             (oldval_preserved | newval_write) & ~newval_w1c_set);
 }
 
 static void amdvi_writeq(AMDVIState *s, hwaddr addr, uint64_t val)
@@ -141,8 +151,13 @@ static void amdvi_writeq(AMDVIState *s, hwaddr addr, uint64_t val)
     uint64_t romask = ldq_le_p(&s->romask[addr]);
     uint64_t w1cmask = ldq_le_p(&s->w1cmask[addr]);
     uint64_t oldval = ldq_le_p(&s->mmior[addr]);
+
+    uint64_t oldval_preserved = oldval & (romask | w1cmask);
+    uint64_t newval_write = val & ~romask;
+    uint64_t newval_w1c_set = val & w1cmask;
+
     stq_le_p(&s->mmior[addr],
-            ((oldval & romask) | (val & ~romask)) & ~(val & w1cmask));
+             (oldval_preserved | newval_write) & ~newval_w1c_set);
 }
 
 /* OR a 64-bit register with a 64-bit value */

From 10690920b0efb3ed8b166443bae8077104bb129d Mon Sep 17 00:00:00 2001
From: Sairaj Kodilkar <sarunkod@amd.com>
Date: Fri, 1 Aug 2025 11:35:06 +0530
Subject: [PATCH 2692/2760] hw/i386/amd_iommu: Support MMIO writes to the
 status register

Support the writes to the status register so that guest can reset the
EventOverflow, EventLogInt, ComWaitIntr, etc bits after servicing the
respective interrupt.

Signed-off-by: Sairaj Kodilkar <sarunkod@amd.com>
Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
Message-Id: <20250801060507.3382-6-sarunkod@amd.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/amd_iommu.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/hw/i386/amd_iommu.c b/hw/i386/amd_iommu.c
index c9c32cf7b0..6925085d29 100644
--- a/hw/i386/amd_iommu.c
+++ b/hw/i386/amd_iommu.c
@@ -862,6 +862,9 @@ static void amdvi_mmio_write(void *opaque, hwaddr addr, uint64_t val,
         amdvi_mmio_reg_write(s, size, val, addr);
         amdvi_handle_pprtail_write(s);
         break;
+    case AMDVI_MMIO_STATUS:
+        amdvi_mmio_reg_write(s, size, val, addr);
+        break;
     }
 }
 

From c0ef803a879b97f3d269348c968fb3874c2761f6 Mon Sep 17 00:00:00 2001
From: Sairaj Kodilkar <sarunkod@amd.com>
Date: Fri, 1 Aug 2025 11:35:07 +0530
Subject: [PATCH 2693/2760] hw/i386/amd_iommu: Fix event log generation

Current event logging code is broken, because of following issues

1. The code uses '|' instead of '&' to test the bit field, which causes
   vIOMMU to generate overflow interrupt for every log entry.
2. Code does not update the eventlog tail MMIO register after adding an
   entry to the buffer, because of which guest cannot process new
   entries (as head == tail means buffer is empty).
3. Compares eventlog tail (which is byte offset in the buffer) to
   eventlog length (which is number of maximum entries in the buffer).
   This causes vIOMMU to generate only fix number of event logs, after
   which it keeps on generating overflow interrupts, without
   actually resetting the log buffer.
4. Updates ComWaitInt instead of EventLogInt bitfield in Status
   register. Guest checks this field to see if there are new event log
   entries in the buffer.
5. Does not reset event log head and tail pointers when guest writes to
   eventlog base register.

Fix above issues, so that guest can process event log entries.

Fixes: d29a09ca68428 ("hw/i386: Introduce AMD IOMMU")
Signed-off-by: Sairaj Kodilkar <sarunkod@amd.com>
Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
Message-Id: <20250801060507.3382-7-sarunkod@amd.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/amd_iommu.c | 44 +++++++++++++++++++++++++++++++++++---------
 hw/i386/amd_iommu.h |  1 +
 2 files changed, 36 insertions(+), 9 deletions(-)

diff --git a/hw/i386/amd_iommu.c b/hw/i386/amd_iommu.c
index 6925085d29..26be69bec8 100644
--- a/hw/i386/amd_iommu.c
+++ b/hw/i386/amd_iommu.c
@@ -160,10 +160,10 @@ static void amdvi_writeq(AMDVIState *s, hwaddr addr, uint64_t val)
              (oldval_preserved | newval_write) & ~newval_w1c_set);
 }
 
-/* OR a 64-bit register with a 64-bit value */
+/* AND a 64-bit register with a 64-bit value */
 static bool amdvi_test_mask(AMDVIState *s, hwaddr addr, uint64_t val)
 {
-    return amdvi_readq(s, addr) | val;
+    return amdvi_readq(s, addr) & val;
 }
 
 /* OR a 64-bit register with a 64-bit value storing result in the register */
@@ -192,19 +192,31 @@ static void amdvi_generate_msi_interrupt(AMDVIState *s)
     }
 }
 
+static uint32_t get_next_eventlog_entry(AMDVIState *s)
+{
+    uint32_t evtlog_size = s->evtlog_len * AMDVI_EVENT_LEN;
+    return (s->evtlog_tail + AMDVI_EVENT_LEN) % evtlog_size;
+}
+
 static void amdvi_log_event(AMDVIState *s, uint64_t *evt)
 {
+    uint32_t evtlog_tail_next;
+
     /* event logging not enabled */
     if (!s->evtlog_enabled || amdvi_test_mask(s, AMDVI_MMIO_STATUS,
         AMDVI_MMIO_STATUS_EVT_OVF)) {
         return;
     }
 
+    evtlog_tail_next = get_next_eventlog_entry(s);
+
     /* event log buffer full */
-    if (s->evtlog_tail >= s->evtlog_len) {
-        amdvi_assign_orq(s, AMDVI_MMIO_STATUS, AMDVI_MMIO_STATUS_EVT_OVF);
-        /* generate interrupt */
-        amdvi_generate_msi_interrupt(s);
+    if (evtlog_tail_next == s->evtlog_head) {
+        /* generate overflow interrupt */
+        if (s->evtlog_intr) {
+            amdvi_assign_orq(s, AMDVI_MMIO_STATUS, AMDVI_MMIO_STATUS_EVT_OVF);
+            amdvi_generate_msi_interrupt(s);
+        }
         return;
     }
 
@@ -213,9 +225,13 @@ static void amdvi_log_event(AMDVIState *s, uint64_t *evt)
         trace_amdvi_evntlog_fail(s->evtlog, s->evtlog_tail);
     }
 
-    s->evtlog_tail += AMDVI_EVENT_LEN;
-    amdvi_assign_orq(s, AMDVI_MMIO_STATUS, AMDVI_MMIO_STATUS_COMP_INT);
-    amdvi_generate_msi_interrupt(s);
+    s->evtlog_tail = evtlog_tail_next;
+    amdvi_writeq_raw(s, AMDVI_MMIO_EVENT_TAIL, s->evtlog_tail);
+
+    if (s->evtlog_intr) {
+        amdvi_assign_orq(s, AMDVI_MMIO_STATUS, AMDVI_MMIO_STATUS_EVENT_INT);
+        amdvi_generate_msi_interrupt(s);
+    }
 }
 
 static void amdvi_setevent_bits(uint64_t *buffer, uint64_t value, int start,
@@ -731,9 +747,19 @@ static inline void amdvi_handle_excllim_write(AMDVIState *s)
 static inline void amdvi_handle_evtbase_write(AMDVIState *s)
 {
     uint64_t val = amdvi_readq(s, AMDVI_MMIO_EVENT_BASE);
+
+    if (amdvi_readq(s, AMDVI_MMIO_STATUS) & AMDVI_MMIO_STATUS_EVENT_INT)
+        /* Do not reset if eventlog interrupt bit is set*/
+        return;
+
     s->evtlog = val & AMDVI_MMIO_EVTLOG_BASE_MASK;
     s->evtlog_len = 1UL << (amdvi_readq(s, AMDVI_MMIO_EVTLOG_SIZE_BYTE)
                     & AMDVI_MMIO_EVTLOG_SIZE_MASK);
+
+    /* clear tail and head pointer to 0 when event base is updated */
+    s->evtlog_tail = s->evtlog_head = 0;
+    amdvi_writeq_raw(s, AMDVI_MMIO_EVENT_HEAD, s->evtlog_head);
+    amdvi_writeq_raw(s, AMDVI_MMIO_EVENT_TAIL, s->evtlog_tail);
 }
 
 static inline void amdvi_handle_evttail_write(AMDVIState *s)
diff --git a/hw/i386/amd_iommu.h b/hw/i386/amd_iommu.h
index 67078c6f1e..2476296c49 100644
--- a/hw/i386/amd_iommu.h
+++ b/hw/i386/amd_iommu.h
@@ -111,6 +111,7 @@
 #define AMDVI_MMIO_STATUS_CMDBUF_RUN  (1 << 4)
 #define AMDVI_MMIO_STATUS_EVT_RUN     (1 << 3)
 #define AMDVI_MMIO_STATUS_COMP_INT    (1 << 2)
+#define AMDVI_MMIO_STATUS_EVENT_INT   (1 << 1)
 #define AMDVI_MMIO_STATUS_EVT_OVF     (1 << 0)
 
 #define AMDVI_CMDBUF_ID_BYTE              0x07

From 8d5613d2eefa6ca94b3c642583488e20915c48f7 Mon Sep 17 00:00:00 2001
From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Date: Thu, 12 Jun 2025 17:17:25 +0200
Subject: [PATCH 2694/2760] tests/acpi: virt: add an empty HEST file

Such file will be used to track HEST table changes.

For now, disallow HEST table check until we update it to the
current data.

Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Acked-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Message-Id: <e25ea751a23c7d8da812233c83ce943efbeaaf91.1749741085.git.mchehab+huawei@kernel.org>
---
 tests/data/acpi/aarch64/virt/HEST           | 0
 tests/qtest/bios-tables-test-allowed-diff.h | 1 +
 2 files changed, 1 insertion(+)
 create mode 100644 tests/data/acpi/aarch64/virt/HEST

diff --git a/tests/data/acpi/aarch64/virt/HEST b/tests/data/acpi/aarch64/virt/HEST
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/tests/qtest/bios-tables-test-allowed-diff.h b/tests/qtest/bios-tables-test-allowed-diff.h
index dfb8523c8b..39901c58d6 100644
--- a/tests/qtest/bios-tables-test-allowed-diff.h
+++ b/tests/qtest/bios-tables-test-allowed-diff.h
@@ -1 +1,2 @@
 /* List of comma-separated changed AML files to ignore */
+"tests/data/acpi/aarch64/virt/HEST",

From 5088651138b94542807414eb841363b16d6aa535 Mon Sep 17 00:00:00 2001
From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Date: Thu, 12 Jun 2025 17:17:26 +0200
Subject: [PATCH 2695/2760] tests/qtest/bios-tables-test: extend to also check
 HEST table

Currently, aarch64 can generate a HEST table when loaded with
-machine ras=on. Add support for it.

Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Message-Id: <9ce77140500ef68cc939d63952c25579f711ea52.1749741085.git.mchehab+huawei@kernel.org>
---
 tests/qtest/bios-tables-test.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/qtest/bios-tables-test.c b/tests/qtest/bios-tables-test.c
index 6aec68decc..e7e6926c81 100644
--- a/tests/qtest/bios-tables-test.c
+++ b/tests/qtest/bios-tables-test.c
@@ -2208,7 +2208,7 @@ static void test_acpi_aarch64_virt_tcg(void)
 
     data.smbios_cpu_max_speed = 2900;
     data.smbios_cpu_curr_speed = 2700;
-    test_acpi_one("-cpu cortex-a57 "
+    test_acpi_one("-cpu cortex-a57 -machine ras=on "
                   "-smbios type=4,max-speed=2900,current-speed=2700", &data);
     free_test_data(&data);
 }

From cd16f08ad4bda8191e4de986d17184c9da5466cd Mon Sep 17 00:00:00 2001
From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Date: Thu, 12 Jun 2025 17:17:27 +0200
Subject: [PATCH 2696/2760] tests/acpi: virt: update HEST file with its current
 data

Now that HEST table is checked for aarch64, add the current
firmware file.

Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Acked-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Message-Id: <e3527be1610b2ef6b20ca2efa025de91a1f1e0a6.1749741085.git.mchehab+huawei@kernel.org>
---
 tests/data/acpi/aarch64/virt/HEST           | Bin 0 -> 132 bytes
 tests/qtest/bios-tables-test-allowed-diff.h |   1 -
 2 files changed, 1 deletion(-)

diff --git a/tests/data/acpi/aarch64/virt/HEST b/tests/data/acpi/aarch64/virt/HEST
index e69de29bb2d1d6434b8b29ae775ad8c2e48c5391..4c5d8c5b5da5b3241f93cd0839e94272bf6b1486 100644
GIT binary patch
literal 132
zcmeZp4Gw8xU|?W;<mB({5v<@85#X$#prF9Wz`y`vgJ=-uVqjqS|DS;o#0Fso76t|e
h2M~G7nSp_UfkOsF;=oX~91IY(|NcV&*c=811_0ZB6afGL

literal 0
HcmV?d00001

diff --git a/tests/qtest/bios-tables-test-allowed-diff.h b/tests/qtest/bios-tables-test-allowed-diff.h
index 39901c58d6..dfb8523c8b 100644
--- a/tests/qtest/bios-tables-test-allowed-diff.h
+++ b/tests/qtest/bios-tables-test-allowed-diff.h
@@ -1,2 +1 @@
 /* List of comma-separated changed AML files to ignore */
-"tests/data/acpi/aarch64/virt/HEST",

From e8145dcd311b58921f3a45121792cbfab38fd2f6 Mon Sep 17 00:00:00 2001
From: David Woodhouse <dwmw@amazon.co.uk>
Date: Mon, 14 Jul 2025 09:00:47 +0100
Subject: [PATCH 2697/2760] intel_iommu: Allow both Status Write and Interrupt
 Flag in QI wait

FreeBSD does both, and this appears to be perfectly valid. The VT-d
spec even talks about the ordering (the status write should be done
first, unsurprisingly).

We certainly shouldn't assert() and abort QEMU if the guest asks for
both.

Fixes: ed7b8fbcfb88 ("intel-iommu: add supports for queued invalidation interface")
Closes: https://gitlab.com/qemu-project/qemu/-/issues/3028
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Message-Id: <0122cbabc0adcc3cf878f5fd7834d8f258c7a2f2.camel@infradead.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/intel_iommu.c | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/hw/i386/intel_iommu.c b/hw/i386/intel_iommu.c
index fe9a5f2872..83c5e44413 100644
--- a/hw/i386/intel_iommu.c
+++ b/hw/i386/intel_iommu.c
@@ -2828,6 +2828,7 @@ static bool vtd_process_wait_desc(IntelIOMMUState *s, VTDInvDesc *inv_desc)
 {
     uint64_t mask[4] = {VTD_INV_DESC_WAIT_RSVD_LO, VTD_INV_DESC_WAIT_RSVD_HI,
                         VTD_INV_DESC_ALL_ONE, VTD_INV_DESC_ALL_ONE};
+    bool ret = true;
 
     if (!vtd_inv_desc_reserved_check(s, inv_desc, mask, false,
                                      __func__, "wait")) {
@@ -2839,8 +2840,6 @@ static bool vtd_process_wait_desc(IntelIOMMUState *s, VTDInvDesc *inv_desc)
         uint32_t status_data = (uint32_t)(inv_desc->lo >>
                                VTD_INV_DESC_WAIT_DATA_SHIFT);
 
-        assert(!(inv_desc->lo & VTD_INV_DESC_WAIT_IF));
-
         /* FIXME: need to be masked with HAW? */
         dma_addr_t status_addr = inv_desc->hi;
         trace_vtd_inv_desc_wait_sw(status_addr, status_data);
@@ -2849,18 +2848,22 @@ static bool vtd_process_wait_desc(IntelIOMMUState *s, VTDInvDesc *inv_desc)
                              &status_data, sizeof(status_data),
                              MEMTXATTRS_UNSPECIFIED)) {
             trace_vtd_inv_desc_wait_write_fail(inv_desc->hi, inv_desc->lo);
-            return false;
+            ret = false;
         }
-    } else if (inv_desc->lo & VTD_INV_DESC_WAIT_IF) {
+    }
+
+    if (inv_desc->lo & VTD_INV_DESC_WAIT_IF) {
         /* Interrupt flag */
         vtd_generate_completion_event(s);
-    } else {
+    }
+
+    if (!(inv_desc->lo & (VTD_INV_DESC_WAIT_IF | VTD_INV_DESC_WAIT_SW))) {
         error_report_once("%s: invalid wait desc: hi=%"PRIx64", lo=%"PRIx64
                           " (unknown type)", __func__, inv_desc->hi,
                           inv_desc->lo);
         return false;
     }
-    return true;
+    return ret;
 }
 
 static bool vtd_process_context_cache_desc(IntelIOMMUState *s,

From 4164adc476d85d46ef4901c05a9807b24473b00d Mon Sep 17 00:00:00 2001
From: Stefano Garzarella <sgarzare@redhat.com>
Date: Mon, 14 Jul 2025 12:26:23 +0200
Subject: [PATCH 2698/2760] MAINTAINERS: add net/vhost* files under `vhost`

net/vhost* files should be interesting for vhost maintainers/reviewers.

Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Message-Id: <20250714102626.34431-1-sgarzare@redhat.com>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 MAINTAINERS | 1 +
 1 file changed, 1 insertion(+)

diff --git a/MAINTAINERS b/MAINTAINERS
index 069d77f2f8..28cea34271 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2322,6 +2322,7 @@ F: include/*/vhost*
 F: subprojects/libvhost-user/
 F: block/export/vhost-user*
 F: util/vhost-user-server.c
+F: net/vhost*
 
 vhost-shadow-virtqueue
 R: Eugenio Pérez <eperezma@redhat.com>

From 4caf74916d09019e61c91f8cb1166510836d35e8 Mon Sep 17 00:00:00 2001
From: Stefano Garzarella <sgarzare@redhat.com>
Date: Mon, 14 Jul 2025 12:11:56 +0200
Subject: [PATCH 2699/2760] net/vdpa: fix potential fd leak in
 net_init_vhost_vdpa()

Coverity reported a file descriptor leak (CID 1490785) that happens if
`vhost_vdpa_get_max_queue_pairs()` returns 0, since in that case
net_host_vdpa_init(), which should take ownership of the fd, is never
called.

vhost_vdpa_get_max_queue_pairs() returns 1 if VIRTIO_NET_F_MQ is not
negotiated, or a negative error if the ioctl() fails, or the maximum
number of queue pairs exposed by the device in the config space in the
`max_virtqueue_pairs` field. In the VIRTIO spec we have:
     The device MUST set max_virtqueue_pairs to between 1 and 0x8000
     inclusive, if it offers VIRTIO_NET_F_MQ.

So, if `vhost_vdpa_get_max_queue_pairs()` returns 0, it's really an
error since the device is violating the VIRTIO spec.

Treat also `queue_pairs == 0` as an error, and jump to the `err` label,
to return a negative value to the caller in any case.

Coverity: CID 1490785
Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Message-Id: <20250714101156.30024-1-sgarzare@redhat.com>
Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Acked-by: Jason Wang <jasowang@redhat.com>
---
 net/vhost-vdpa.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c
index 6a30a44d2b..74d26a9497 100644
--- a/net/vhost-vdpa.c
+++ b/net/vhost-vdpa.c
@@ -1840,9 +1840,8 @@ int net_init_vhost_vdpa(const Netdev *netdev, const char *name,
 
     queue_pairs = vhost_vdpa_get_max_queue_pairs(vdpa_device_fd, features,
                                                  &has_cvq, errp);
-    if (queue_pairs < 0) {
-        qemu_close(vdpa_device_fd);
-        return queue_pairs;
+    if (queue_pairs <= 0) {
+        goto err;
     }
 
     r = vhost_vdpa_get_iova_range(vdpa_device_fd, &iova_range);

From a0555e36fc44ea98edf7c50924de8b973cd4267d Mon Sep 17 00:00:00 2001
From: Zenghui Yu <zenghui.yu@linux.dev>
Date: Wed, 30 Jul 2025 00:16:49 +0800
Subject: [PATCH 2700/2760] hw/intc/arm_gicv3_kvm: Remove writes to ICPENDR
 registers

As per the arm-vgic-v3 kernel doc [1]:

    Accesses to GICD_ICPENDR register region and GICR_ICPENDR0 registers
    have RAZ/WI semantics, meaning that reads always return 0 and writes
    are always ignored.

The state behind these registers (both 0 and 1 bits) is written by
writing to the GICD_ISPENDR and GICR_ISPENDR0 registers, unlike
some of the other set/clear register pairs.

Remove the useless writes to ICPENDR registers in kvm_arm_gicv3_put().

[1] https://docs.kernel.org/virt/kvm/devices/arm-vgic-v3.html

Signed-off-by: Zenghui Yu <zenghui.yu@linux.dev>
Message-id: 20250729161650.43758-2-zenghui.yu@linux.dev
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/intc/arm_gicv3_kvm.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/hw/intc/arm_gicv3_kvm.c b/hw/intc/arm_gicv3_kvm.c
index 8ed88e7429..f798a6e28c 100644
--- a/hw/intc/arm_gicv3_kvm.c
+++ b/hw/intc/arm_gicv3_kvm.c
@@ -387,8 +387,6 @@ static void kvm_arm_gicv3_put(GICv3State *s)
         reg = c->level;
         kvm_gic_line_level_access(s, 0, ncpu, &reg, true);
 
-        reg = ~0;
-        kvm_gicr_access(s, GICR_ICPENDR0, ncpu, &reg, true);
         reg = c->gicr_ipendr0;
         kvm_gicr_access(s, GICR_ISPENDR0, ncpu, &reg, true);
 
@@ -445,7 +443,7 @@ static void kvm_arm_gicv3_put(GICv3State *s)
     kvm_gic_put_line_level_bmp(s, s->level);
 
     /* s->pending bitmap -> GICD_ISPENDRn */
-    kvm_dist_putbmp(s, GICD_ISPENDR, GICD_ICPENDR, s->pending);
+    kvm_dist_putbmp(s, GICD_ISPENDR, 0, s->pending);
 
     /* s->active bitmap -> GICD_ISACTIVERn */
     kvm_dist_putbmp(s, GICD_ISACTIVER, GICD_ICACTIVER, s->active);

From b10bd4bd17ac8628ede8735a08ad82dc3b721c64 Mon Sep 17 00:00:00 2001
From: Zenghui Yu <zenghui.yu@linux.dev>
Date: Wed, 30 Jul 2025 00:16:50 +0800
Subject: [PATCH 2701/2760] hw/intc/arm_gicv3_kvm: Write all 1's to clear
 enable/active

KVM's userspace access interface to the GICD enable and active bits
is via set/clear register pairs which implement the hardware's "write
1s to the clear register to clear the 0 bits, and write 1s to the set
register to set the 1 bits" semantics.  We didn't get this right,
because we were writing 0 to the clear register.

Writing 0 to GICD_IC{ENABLE,ACTIVE}R architecturally has no effect on
interrupt status (all writes are simply ignored by KVM) and doesn't
comply with the intention of "first write to the clear-reg to clear
all bits".

Write all 1's to actually clear the enable/active status.

This didn't have any adverse effects on migration because there
we start with a clean VM state; it would be guest-visible when
doing a system reset, but since Linux always cleans up the
register state of the GIC during bootup before it enables it
most users won't have run into a problem here.

Cc: qemu-stable@nongnu.org
Fixes: 367b9f527bec ("hw/intc/arm_gicv3_kvm: Implement get/put functions")
Signed-off-by: Zenghui Yu <zenghui.yu@linux.dev>
Message-id: 20250729161650.43758-3-zenghui.yu@linux.dev
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/intc/arm_gicv3_kvm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/intc/arm_gicv3_kvm.c b/hw/intc/arm_gicv3_kvm.c
index f798a6e28c..6166283cd1 100644
--- a/hw/intc/arm_gicv3_kvm.c
+++ b/hw/intc/arm_gicv3_kvm.c
@@ -295,7 +295,7 @@ static void kvm_dist_putbmp(GICv3State *s, uint32_t offset,
          * the 1 bits.
          */
         if (clroffset != 0) {
-            reg = 0;
+            reg = ~0;
             kvm_gicd_access(s, clroffset, &reg, true);
             clroffset += 4;
         }

From e7b77e681f8ecf7d9360e47243f7c1a0fb88f51c Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Thu, 10 Jul 2025 18:43:12 +0100
Subject: [PATCH 2702/2760] hw/display/framebuffer: Add cast to force 64x64
 multiply

In framebuffer_update_display(), Coverity complains because we
multiply two values of type 'int' (which will be done as a 32x32
multiply and so in theory might overflow) and then add the result to
a ram_addr_t, which can be 64 bits.

4GB framebuffers are not plausible anyway, but keep Coverity happy
by adding casts which force these multiplies to be done as 64x64.

Coverity: CID 1487248
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Message-id: 20250710174312.1313177-1-peter.maydell@linaro.org
---
 hw/display/framebuffer.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/hw/display/framebuffer.c b/hw/display/framebuffer.c
index 4485aa335b..b4296e8a33 100644
--- a/hw/display/framebuffer.c
+++ b/hw/display/framebuffer.c
@@ -95,9 +95,9 @@ void framebuffer_update_display(
     }
     first = -1;
 
-    addr += i * src_width;
-    src += i * src_width;
-    dest += i * dest_row_pitch;
+    addr += (uint64_t)i * src_width;
+    src += (uint64_t)i * src_width;
+    dest += (uint64_t)i * dest_row_pitch;
 
     snap = memory_region_snapshot_and_clear_dirty(mem, addr, src_width * rows,
                                                   DIRTY_MEMORY_VGA);

From 4f2b82f60431e4792ecfd86a4d6b824248ee4c21 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Thu, 31 Jul 2025 14:43:38 +0100
Subject: [PATCH 2703/2760] target/arm: Reinstate bogus AArch32 DBGDTRTX
 register for migration compat

In commit 655659a74a we fixed some bugs in the encoding of the
Debug Communications Channel registers, including that we were
incorrectly exposing an AArch32 register at p14, 3, c0, c5, 0.

Unfortunately removing a register is a break of forwards migration
compatibility for TCG, because we will fail the migration if the
source QEMU passes us a cpreg which the destination QEMU does not
have.  We don't have a mechanism for saying "it's OK to ignore this
sysreg in the inbound data", so for the 10.1 release reinstate the
incorrect AArch32 register.

(We probably have had other cases in the past of breaking migration
compatibility like this, but we didn't notice because we didn't test
and in any case not that many people care about TCG migration
compatibility.  KVM migration compat is not affected because for KVM
we treat the kernel as the source of truth for what system registers
are present.)

Fixes: 655659a74a36b ("target/arm: Correct encoding of Debug Communications Channel registers")
Reported-by: Fabiano Rosas <farosas@suse.de>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250731134338.250203-1-peter.maydell@linaro.org
---
 target/arm/debug_helper.c | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/target/arm/debug_helper.c b/target/arm/debug_helper.c
index aee06d4d42..579516e154 100644
--- a/target/arm/debug_helper.c
+++ b/target/arm/debug_helper.c
@@ -940,6 +940,13 @@ static void dbgclaimclr_write(CPUARMState *env, const ARMCPRegInfo *ri,
     env->cp15.dbgclaim &= ~(value & 0xFF);
 }
 
+static CPAccessResult access_bogus(CPUARMState *env, const ARMCPRegInfo *ri,
+                                   bool isread)
+{
+    /* Always UNDEF, as if this cpreg didn't exist */
+    return CP_ACCESS_UNDEFINED;
+}
+
 static const ARMCPRegInfo debug_cp_reginfo[] = {
     /*
      * DBGDRAR, DBGDSAR: always RAZ since we don't implement memory mapped
@@ -1002,6 +1009,28 @@ static const ARMCPRegInfo debug_cp_reginfo[] = {
       .opc0 = 2, .opc1 = 3, .crn = 0, .crm = 4, .opc2 = 0,
       .access = PL0_RW, .accessfn = access_tdcc,
       .type = ARM_CP_CONST, .resetvalue = 0 },
+    /*
+     * This is not a real AArch32 register. We used to incorrectly expose
+     * this due to a QEMU bug; to avoid breaking migration compatibility we
+     * need to continue to provide it so that we don't fail the inbound
+     * migration when it tells us about a sysreg that we don't have.
+     * We set an always-fails .accessfn, which means that the guest doesn't
+     * actually see this register (it will always UNDEF, identically to if
+     * there were no cpreg definition for it other than that we won't print
+     * a LOG_UNIMP message about it), and we set the ARM_CP_NO_GDB flag so the
+     * gdbstub won't see it either.
+     * (We can't just set .access = 0, because add_cpreg_to_hashtable()
+     * helpfully ignores cpregs which aren't accessible to the highest
+     * implemented EL.)
+     *
+     * TODO: implement a system for being able to describe "this register
+     * can be ignored if it appears in the inbound stream"; then we can
+     * remove this temporary hack.
+     */
+    { .name = "BOGUS_DBGDTR_EL0", .state = ARM_CP_STATE_AA32,
+      .cp = 14, .opc1 = 3, .crn = 0, .crm = 5, .opc2 = 0,
+      .access = PL0_RW, .accessfn = access_bogus,
+      .type = ARM_CP_CONST | ARM_CP_NO_GDB, .resetvalue = 0 },
     /*
      * OSECCR_EL1 provides a mechanism for an operating system
      * to access the contents of EDECCR. EDECCR is not implemented though,

From 35cca0f95ff5345f54c11d116efc8940a0dab8aa Mon Sep 17 00:00:00 2001
From: Vacha Bhavsar <vacha.bhavsar@oss.qualcomm.com>
Date: Tue, 22 Jul 2025 17:37:35 +0000
Subject: [PATCH 2704/2760] target/arm: Fix big-endian handling of NEON gdb
 remote debugging

In the code for allowing the gdbstub to set the value of an AArch64
FP/SIMD register, we weren't accounting for target_big_endian()
being true. This meant that for aarch64_be-linux-user we would
set the two halves of the FP register the wrong way around.
The much more common case of a little-endian guest is not affected;
nor are big-endian hosts.

Correct the handling of this case.

Cc: qemu-stable@nongnu.org
Signed-off-by: Vacha Bhavsar <vacha.bhavsar@oss.qualcomm.com>
Message-id: 20250722173736.2332529-2-vacha.bhavsar@oss.qualcomm.com
[PMM: added comment, expanded commit message, fixed missing space]
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/gdbstub64.c | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/target/arm/gdbstub64.c b/target/arm/gdbstub64.c
index 64ee9b3b56..4fce58d895 100644
--- a/target/arm/gdbstub64.c
+++ b/target/arm/gdbstub64.c
@@ -115,8 +115,22 @@ int aarch64_gdb_set_fpu_reg(CPUState *cs, uint8_t *buf, int reg)
         /* 128 bit FP register */
         {
             uint64_t *q = aa64_vfp_qreg(env, reg);
-            q[0] = ldq_le_p(buf);
-            q[1] = ldq_le_p(buf + 8);
+
+            /*
+             * On the wire these are target-endian 128 bit values.
+             * In the CPU state these are host-order uint64_t values
+             * with the least-significant one first. This means they're
+             * the other way around for target_big_endian() (which is
+             * only true for us for aarch64_be-linux-user).
+             */
+            if (target_big_endian()) {
+                q[1] = ldq_p(buf);
+                q[0] = ldq_p(buf + 8);
+            } else{
+                q[0] = ldq_p(buf);
+                q[1] = ldq_p(buf + 8);
+            }
+
             return 16;
         }
     case 32:

From 97b3d732afec9b165c33697452e31267a845338f Mon Sep 17 00:00:00 2001
From: Vacha Bhavsar <vacha.bhavsar@oss.qualcomm.com>
Date: Tue, 22 Jul 2025 17:37:36 +0000
Subject: [PATCH 2705/2760] target/arm: Fix handling of setting SVE registers
 from gdb

The code to handle setting SVE registers via the gdbstub is broken:
 * it sets each pair of elements in the zregs[].d[] array in the
   wrong order for the most common (little endian) case: the least
   significant 64-bit value comes first
 * it makes no attempt to handle target_endian()
 * it does a simple copy out of the (target endian) gdbstub buffer
   into the (host endan) zregs data structure, which is wrong on
   big endian hosts

Fix all these problems:
 * use ldq_p() to read from the gdbstub buffer
 * check target_big_endian() to see if we need to handle the
   128-bit values the opposite way around

Cc: qemu-stable@nongnu.org
Signed-off-by: Vacha Bhavsar <vacha.bhavsar@oss.qualcomm.com>
Message-id: 20250722173736.2332529-3-vacha.bhavsar@oss.qualcomm.com
[PMM: adjusted commit message, fixed spacing]
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/gdbstub64.c | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/target/arm/gdbstub64.c b/target/arm/gdbstub64.c
index 4fce58d895..08e2858539 100644
--- a/target/arm/gdbstub64.c
+++ b/target/arm/gdbstub64.c
@@ -206,10 +206,17 @@ int aarch64_gdb_set_sve_reg(CPUState *cs, uint8_t *buf, int reg)
     case 0 ... 31:
     {
         int vq, len = 0;
-        uint64_t *p = (uint64_t *) buf;
         for (vq = 0; vq < cpu->sve_max_vq; vq++) {
-            env->vfp.zregs[reg].d[vq * 2 + 1] = *p++;
-            env->vfp.zregs[reg].d[vq * 2] = *p++;
+            if (target_big_endian()) {
+                env->vfp.zregs[reg].d[vq * 2 + 1] = ldq_p(buf);
+                buf += 8;
+                env->vfp.zregs[reg].d[vq * 2] = ldq_p(buf);
+            } else{
+                env->vfp.zregs[reg].d[vq * 2] = ldq_p(buf);
+                buf += 8;
+                env->vfp.zregs[reg].d[vq * 2 + 1] = ldq_p(buf);
+            }
+            buf += 8;
             len += 16;
         }
         return len;
@@ -224,9 +231,9 @@ int aarch64_gdb_set_sve_reg(CPUState *cs, uint8_t *buf, int reg)
     {
         int preg = reg - 34;
         int vq, len = 0;
-        uint64_t *p = (uint64_t *) buf;
         for (vq = 0; vq < cpu->sve_max_vq; vq = vq + 4) {
-            env->vfp.pregs[preg].p[vq / 4] = *p++;
+            env->vfp.pregs[preg].p[vq / 4] = ldq_p(buf);
+            buf += 8;
             len += 8;
         }
         return len;

From 676ab6a21117858393a4440e4cdc3d314277cf20 Mon Sep 17 00:00:00 2001
From: Gustavo Romero <gustavo.romero@linaro.org>
Date: Fri, 1 Aug 2025 00:13:05 +0000
Subject: [PATCH 2706/2760] tests/tcg: Fix run for tests with specific plugin
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Commit 25aaf0cb7f (“tests/tcg: reduce the number of plugin test
combinations”) added support for running tests with specific plugins
passed via the EXTRA_RUNS variable.

However, due to the optimization, the rules generated as a shuffled
combination of tests and plugins might not cover the rules required to
run the tests with a specific plugin passed via EXTRA_RUNS.

This commit fixes it by correctly generating the rules for the tests
that require a specific plugin to run, which are now passed via the
EXTRA_RUNS_WITH_PLUGIN instead of via the EXTRA_RUNS variable.

The fix essentially excludes the tests passed via EXTRA_RUNS_WITH_PLUGIN
from the rules created by the shuffled combination of tests and plugins,
to avoid running the tests twice, and generates the rules for the
test/plugin combinations listed in the EXTRA_RUNS_WITH_PLUGIN variable.

Signed-off-by: Gustavo Romero <gustavo.romero@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Tested-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-id: 20250801001305.2352554-1-gustavo.romero@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/tcg/Makefile.target                     | 20 ++++++++++++++++---
 tests/tcg/multiarch/Makefile.target           |  2 +-
 .../multiarch/system/Makefile.softmmu-target  |  2 +-
 tests/tcg/x86_64/Makefile.softmmu-target      |  2 +-
 4 files changed, 20 insertions(+), 6 deletions(-)

diff --git a/tests/tcg/Makefile.target b/tests/tcg/Makefile.target
index 18afd5be19..af72903f89 100644
--- a/tests/tcg/Makefile.target
+++ b/tests/tcg/Makefile.target
@@ -170,6 +170,10 @@ endif
 PLUGINS=$(filter-out $(DISABLE_PLUGINS), \
 	$(patsubst %.c, lib%.so, $(notdir $(wildcard $(PLUGIN_SRC)/*.c))))
 
+strip-plugin = $(wordlist 1, 1, $(subst -with-, ,$1))
+extract-plugin = $(wordlist 2, 2, $(subst -with-, ,$1))
+extract-test = $(subst run-plugin-,,$(wordlist 1, 1, $(subst -with-, ,$1)))
+
 # We need to ensure expand the run-plugin-TEST-with-PLUGIN
 # pre-requistes manually here as we can't use stems to handle it. We
 # only expand MULTIARCH_TESTS which are common on most of our targets
@@ -179,6 +183,13 @@ PLUGINS=$(filter-out $(DISABLE_PLUGINS), \
 
 ifneq ($(MULTIARCH_TESTS),)
 
+# Extract extra tests from the extra test+plugin combination.
+EXTRA_TESTS_WITH_PLUGIN=$(foreach test, \
+                        $(EXTRA_RUNS_WITH_PLUGIN),$(call extract-test,$(test)))
+# Exclude tests that were specified to run with specific plugins from the tests
+# which can run with any plugin combination, so we don't run it twice.
+MULTIARCH_TESTS:=$(filter-out $(EXTRA_TESTS_WITH_PLUGIN), $(MULTIARCH_TESTS))
+
 NUM_PLUGINS := $(words $(PLUGINS))
 NUM_TESTS := $(words $(MULTIARCH_TESTS))
 
@@ -186,19 +197,22 @@ define mod_plus_one
   $(shell $(PYTHON) -c "print( ($(1) % $(2)) + 1 )")
 endef
 
+# Rules for running tests with any plugin combination, i.e., no specific plugin.
 $(foreach _idx, $(shell seq 1 $(NUM_TESTS)), \
 	$(eval _test := $(word $(_idx), $(MULTIARCH_TESTS))) \
 	$(eval _plugin := $(word $(call mod_plus_one, $(_idx), $(NUM_PLUGINS)), $(PLUGINS))) \
 	$(eval run-plugin-$(_test)-with-$(_plugin): $(_test) $(_plugin)) \
 	$(eval RUN_TESTS+=run-plugin-$(_test)-with-$(_plugin)))
 
+# Rules for running extra tests with specific plugins.
+$(foreach f,$(EXTRA_RUNS_WITH_PLUGIN), \
+    $(eval $(f): $(call extract-test,$(f)) $(call extract-plugin,$(f))))
+
 endif # MULTIARCH_TESTS
 endif # CONFIG_PLUGIN
 
-strip-plugin = $(wordlist 1, 1, $(subst -with-, ,$1))
-extract-plugin = $(wordlist 2, 2, $(subst -with-, ,$1))
-
 RUN_TESTS+=$(EXTRA_RUNS)
+RUN_TESTS+=$(EXTRA_RUNS_WITH_PLUGIN)
 
 # Some plugins need additional arguments above the default to fully
 # exercise things. We can define them on a per-test basis here.
diff --git a/tests/tcg/multiarch/Makefile.target b/tests/tcg/multiarch/Makefile.target
index 38345ff880..8dc65d7a06 100644
--- a/tests/tcg/multiarch/Makefile.target
+++ b/tests/tcg/multiarch/Makefile.target
@@ -201,7 +201,7 @@ run-plugin-test-plugin-mem-access-with-libmem.so: \
 	$(SRC_PATH)/tests/tcg/multiarch/check-plugin-output.sh \
 	$(QEMU) $<
 
-EXTRA_RUNS += run-plugin-test-plugin-mem-access-with-libmem.so
+EXTRA_RUNS_WITH_PLUGIN += run-plugin-test-plugin-mem-access-with-libmem.so
 endif
 
 # Update TESTS
diff --git a/tests/tcg/multiarch/system/Makefile.softmmu-target b/tests/tcg/multiarch/system/Makefile.softmmu-target
index 4171b4e6aa..98c4eda5e0 100644
--- a/tests/tcg/multiarch/system/Makefile.softmmu-target
+++ b/tests/tcg/multiarch/system/Makefile.softmmu-target
@@ -77,5 +77,5 @@ run-plugin-memory-with-libmem.so: memory libmem.so
 run-plugin-memory-with-libmem.so: PLUGIN_ARGS=$(COMMA)region-summary=true
 run-plugin-memory-with-libmem.so: CHECK_PLUGIN_OUTPUT_COMMAND=$(MULTIARCH_SYSTEM_SRC)/validate-memory-counts.py $@.out
 
-EXTRA_RUNS += run-plugin-memory-with-libmem.so
+EXTRA_RUNS_WITH_PLUGIN += run-plugin-memory-with-libmem.so
 endif
diff --git a/tests/tcg/x86_64/Makefile.softmmu-target b/tests/tcg/x86_64/Makefile.softmmu-target
index 3e30ca9307..4e65f58b57 100644
--- a/tests/tcg/x86_64/Makefile.softmmu-target
+++ b/tests/tcg/x86_64/Makefile.softmmu-target
@@ -40,5 +40,5 @@ run-plugin-patch-target-with-libpatch.so:		\
 run-plugin-patch-target-with-libpatch.so:		\
 	CHECK_PLUGIN_OUTPUT_COMMAND=$(X64_SYSTEM_SRC)/validate-patch.py $@.out
 run-plugin-patch-target-with-libpatch.so: patch-target libpatch.so
-EXTRA_RUNS+=run-plugin-patch-target-with-libpatch.so
+EXTRA_RUNS_WITH_PLUGIN+=run-plugin-patch-target-with-libpatch.so
 endif

From 7bf9ae8cc2484f83ec77ad475538d78355e424ea Mon Sep 17 00:00:00 2001
From: Michael Tokarev <mjt@tls.msk.ru>
Date: Mon, 28 Jul 2025 01:19:18 +0300
Subject: [PATCH 2707/2760] roms/vbootrom: update to 7b1eb5f7fe6a
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Changes:

7b1eb5f ast27x0: Fix Makefile to unconditionally set CC to support correct cross-compilation
601d410 ast27x0: Fix missing SCU module reset for SSP and TSP initialization
80768e4 ast27x0: Initialize and enable SSP/TSP using SCU with reserved-memory from DTB
f8ab635 ast27x0: Show build date and git version
53294f5 Add initial support for AST27x0
b1c2803 Dynamically detects NPCM8XX UBOOT destination and size.
4f54dfc Automatically search for UBOOT location for NPCM8xx images.

The actual bootroms are not updated yet.

Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Link: https://lore.kernel.org/qemu-devel/2a89ad4c8f5665d07952a4f1749caa6ec0cd3d9c.1753654515.git.mjt@tls.msk.ru
[ clg: Update to latest vbootrom ]
Reviewed-by: Jamin Lin <jamin_lin@aspeedtech.com>
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 roms/vbootrom | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/roms/vbootrom b/roms/vbootrom
index 1287b6e42e..183c9ff805 160000
--- a/roms/vbootrom
+++ b/roms/vbootrom
@@ -1 +1 @@
-Subproject commit 1287b6e42e839ba2ab0f06268c5b53ae60df3537
+Subproject commit 183c9ff8056b7946db1ae49cc23e8980ac413174

From 5ff7ad61c0af08d81dc7fd050c14b944fbeb9c35 Mon Sep 17 00:00:00 2001
From: Michael Tokarev <mjt@tls.msk.ru>
Date: Mon, 28 Jul 2025 01:19:19 +0300
Subject: [PATCH 2708/2760] roms/Makefile: build ast27x0_bootrom
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3052
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/qemu-devel/607a943a587248fbe0ff0897de80aee98a093caa.1753654515.git.mjt@tls.msk.ru
[ clg: Removed make CC= workaround ]
Reviewed-by: Jamin Lin <jamin_lin@aspeedtech.com>
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 roms/Makefile | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/roms/Makefile b/roms/Makefile
index 6af68a922f..4c8793c5bd 100644
--- a/roms/Makefile
+++ b/roms/Makefile
@@ -68,6 +68,7 @@ default help:
 	@echo "  u-boot.sam460      -- update u-boot.sam460"
 	@echo "  npcm7xx_bootrom    -- update vbootrom for npcm7xx"
 	@echo "  npcm8xx_bootrom    -- update vbootrom for npcm8xx"
+	@echo "  ast27x0_bootrom    -- update vbootrom for ast27x0"
 	@echo "  efi                -- update UEFI (edk2) platform firmware"
 	@echo "  opensbi32-generic  -- update OpenSBI for 32-bit generic machine"
 	@echo "  opensbi64-generic  -- update OpenSBI for 64-bit generic machine"
@@ -200,6 +201,10 @@ npcm8xx_bootrom:
 	$(MAKE) -C vbootrom/npcm8xx CROSS_COMPILE=$(aarch64_cross_prefix)
 	cp vbootrom/npcm8xx/npcm8xx_bootrom.bin ../pc-bios/npcm8xx_bootrom.bin
 
+ast27x0_bootrom:
+	$(MAKE) -C vbootrom/ast27x0 CROSS_COMPILE=$(aarch64_cross_prefix)
+	cp vbootrom/ast27x0/ast27x0_bootrom.bin ../pc-bios/ast27x0_bootrom.bin
+
 hppa-firmware:
 	$(MAKE) -C seabios-hppa parisc
 	cp seabios-hppa/out/hppa-firmware.img      ../pc-bios/

From d63961f957ffaa586b166846f2c6a580923b08f6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Tue, 29 Jul 2025 19:34:59 +0200
Subject: [PATCH 2709/2760] pc-bios: Update vbootrom image to commit
 183c9ff8056b
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Full changelog since last update (1287b6e42e83) :

Hao Wu (2):
      Automatically search for UBOOT location for NPCM8xx images.
      Dynamically detects NPCM8XX UBOOT destination and size.

Jamin Lin (5):
      Add initial support for AST27x0
      ast27x0: Show build date and git version
      ast27x0: Initialize and enable SSP/TSP using SCU with reserved-memory from DTB
      ast27x0: Fix missing SCU module reset for SSP and TSP initialization
      ast27x0: Fix Makefile to unconditionally set CC to support correct cross-compilation

Compiled with gcc version 13.3.0

Reviewed-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 pc-bios/ast27x0_bootrom.bin | Bin 15552 -> 16408 bytes
 pc-bios/npcm7xx_bootrom.bin | Bin 768 -> 672 bytes
 pc-bios/npcm8xx_bootrom.bin | Bin 608 -> 672 bytes
 3 files changed, 0 insertions(+), 0 deletions(-)

diff --git a/pc-bios/ast27x0_bootrom.bin b/pc-bios/ast27x0_bootrom.bin
index 0b9b3a2360e375bb6007ecdf13b39d931870f6fa..a4c94d64da55ade9b4beb2a409132f315fb51347 100644
GIT binary patch
delta 10177
zcmX?5IirDbgDoRt^kh56AV!bL6B+fHe%Mbw#Hcp;4Wmqb4;#aj1xyTEg&7zw6fZKG
zD8j&SVah3^iH|=sOnk&Fvg#qTnAQVk(N!nd8Kx{?WZ25Uz;J=#juBK&c-0j~hA9jT
z4VOL#JFfg1?X>c5^^p|^nB%W~W@cFR_WytJ$Mz08>jfAJ8yOfv7#JLOGH@J-`uhLB
zc)bEc;Xww5$=ytX_3!@w7l+s-yb5f7fbqoLj0{tr|Nk$}z{24Fw|dJ;hJ^M@2{RUb
z`pe8P@pCZaN@Iotm%c_bt^A(Myz*x@%gW!{3_l+<Gp~Kn%(C`@euHg0*j*eG7#J8P
zRxvS5VPs&qpr~Rp5o~^k^~A-D3{#jG7%n(Xv96y8mfT?tk$ho2aSkI?gM|%5EW>8v
zbg+R87Z@6>Cr)8xn3BL0Fi|n1E2xocWl<87!_IgH#_U8EhL93A_njsz3?|J?8iG^6
zSh#yW6T|BcW`>YNHiw;$n1xq8_&@*B6efo5Df<d0mGaeVKrC5fGqH}5VT#1A#-JPf
z_ZEpUFkHCSWDk+cv7NZ}Tiv9G%p$8w85yQ*7h;(BpGoAkGYdlqDC82Ez-D}4&|#RE
z%g8W=n}I>3*vVmHJrl!g#ozx!Oc)Ma0$H5M6mU_QVZkMEDBQ4}n8e61<!e2&$f|G6
z4x7HQFZi^dN$mAX7KRXzMNAwEE`by)F&y~Bz`*c<VFlyFFjy$GSWgsYXt<>N|NnGl
z1_qG@Ob$Ec86>hBnHWNvm_$!MWENf3z;NJF9y7xf5PgZ6VTuDIgJ~1PflDAcumi5x
zO>|;pm{R}nFylm!B55XuDR=+>7Y8YLz$~`P8ss`=@l{9v{}=zvEV>Gm4iA6~Vq!2|
z#OAOQ?5H~o6G7^oI1WVVGcrsOXJGj7eHqilhs@%u9)N<HongvDW(KVX3_r}k>W?r@
zRApqCqR7A?ven69;*tOV>%~C|MHv`AY*k{OxQ2yc$`@t^ttl`KGHesS{Qob`#L#f*
zA+v}UNbO!$kfEZhzA-bb+Rg-Gi)bxiU@!s6t%U0T@c%#9T>1b1r+;N;Smgl8JRcY=
zm?u7D7F)#v56OD#i4qJAmu~<2Ki!OhLF5rL11Q&la>56OCCn3lF)&PdyqR$#%yK3M
zh7V3WEE6BGF--Zv%&@9~fnm#|d{6>pC|m>1Wegt}6j;EPfO3!sgYfA^hm^WOmV!ed
zhh^eZ28JmhJ&!>-oQGKqV%ZaxiT5YpWKmQ4z)-?E@d{W?!_J4y6006Ci>&&>1j^|Q
z9~fBJCZ3(F$SPi63k}-_Mnu>iVt}fe!!dC`gnfab#d@MRL&K$M|Nc)0rA$yTNii^d
zh*D;rD9ym|p_-p%q7w_llyA%oS|D}Tn0}aj|NDQ7FayVgghdXP4h#%te;6626fa_!
zn7{_%3o|h!O#wwR*h?jx6PGYBOaT=_517SQfeNDU$<8Z(X1lEXt?lshZ}k~)p#+IT
zP=O}A$^jgQQma65W5vWU<pCpu2`HE!F-wDj9~{rMlmD_xxqV=0VFRbJHU>~sL$u35
z-FpF?ULj(W|NWo-g_&Vh0z1PNNGys%0(J@W#PZ3pY?Ae&s~8y=J}6#cn<&i0Fh!n$
zp%Bb}!Zz`{(3DxA^vw%$3Il^FC{KVwy$_sBI3_4EGz2j&V6X(M|HC#Bq?QRy?FMAE
zOBgIcF|5oi49<+;VDfpwGBE%gtqwcEQO^u@U<vC)FR(Z$x+THUorM(L&I}Aw_Wu7b
z4z^r`9c=mI$uHSdHK6)c*e4n>Fig1vDzHH%#T#~TfGr2>;h3N(G1-b;ij9$hV}gRj
z<T!RK(ZALER>F#M5eAM4jdBh@8z*mMmr#~-`1ycYSPK-DAD9_e{jEN<f`Li?8i)^K
zgX)&aKiET<9xzPy;}Dyi!QsKEFnJ?~GViwk|EDJ~Iap5NVi4Rs`5{L;<HX6Coc4?>
zC$Hp`XRMrjl5;)3@BjbP|Nj3k&ceX(p~Zr0ayyqTqt)c2T=tAwlUcdV>t+7`pFR`h
z2}Xu3AlE9%IQ(410IKyIek#Z?{A6Hg2m-l4fuSMj-~a#Of2+5_y#b1Oa46SsO?<%4
zx)RKO!!_}NF~d&<2Zo6c%t87YJ}|^^Pkdm_@Kd3IVd4XOsMs6siJzSr>nDP$GjI`B
z$2(Dif#HJ$GvCAq&I~^l4lqnqWMG^Ks`A7b8ZP}*X80+|!0_RLJJf&}o{0~<8Gb(W
zXZTsl1PVe>)h)Ve6F8MKXeluLFas5n3b%PCe*gD>dIFonPk9E0pYj|GJFl@ZOe}U{
zn0Q~Tp5de7zyBeiu!d(LWl;7x1<pQ?z-6k)DrSa;OIKJJrYr!548sS89$s*Czxw}Q
zJdw@eClil@<^yJlRiH9Cnd3l|5(C3eWe$d&AP3y|_ka46|Nq6ARa!1FM=bi3#Ne<~
ziN(Q;g<(ZdO8o<doheTkb{=JJ2ufvO*jaDDursNFd7`R>!%k%mhn;E`4m*<>Sh-a-
z9Cj*tIP6@?z{U;YCo(W{J35H&aBL9S@z`G2D3O8D+wp+N4rd0D9gGYuL5>b0J6s%u
zb};;Lx$Mv&w1a`6LCE2N&<+O%;T;JK4M7eK!XUArdQjXls<d2Uj9BzZ0n}PyVK7o)
zVAu(ZcV-=gs~<5sn6WrC1f?8c*qL&KVdoL%hM*LX+CMIr6(t;YCYmtpOyB_P6-wY?
z*qI=}uoGlif&^F$oQ@cEQ0(GGv21b)w}J~Otm7G&Uq57E2ytRyKF!R)+|9_)a4DXF
z5iACBu}Vg=h06c`CM+4s7Rf9O;OeSAL(xK!g<;~i|Nq4&f8f@bEW@KB^N^Wgl@f!4
zWfB8}sR9GTX^>`+qTe7zDLg8Zdw6^%-{Fy9JUIC)k34506R1jKTeWMlEU$R|mjC~!
zH?lBHe89l4Wj+Ig<r8r3Jh<WkGxMq?3=BU(hJnOB|Nk%kgqazfN`8Rz$bN7hc?o4d
z2I*sFnD~U5Vb!Mp|EE7>W(L(^-Od01Pk+G7vg&X3L2zpOTfKiJNDZi%c*@Mkw(1!(
z)2d~Y&+>{ZEM#CXmCsPNKvvEO^*q?aJbV_DJ@_0Z_wXqwD9SJh!9vlIfguFsPMBh_
z#~<(+Ocvoc@C8{2Dz-ruG6*nC{Q3X?^mq=3PY;<v?I8xO#dqfiEoR(R^njUZ)u;de
zr^_=iXD2c;gg68+One98voI8{WMBw!NMM-wYVuTmdEQ2l>;#614?soJ<b(X;G9b$x
zm>PsYg%AT{gAm982N)WJeu84)55I{5$Po+y3==_)I0P!Kst>LJwU6aF96l}NU<jF<
zARywo17sTmWA;OKi0z=LdCbh9CC|c8*a;F#V3@cbq{fAzkb|8eq@IBx`!E|r2*~A6
z{{Np23RVXJhKb82?-dZ2UGV?^bbAJd>?Q?=Dh@`5ka`D(LI(wgi7yx!LS|0>C?GC5
z`Tzgv^BEYjL3SuiaHw+r|3AcG0>i}K$%=yFlI>`+hyVT$acE$e*f=>*P+Aw}V-OAV
zu>vE+#~{x>W@cCg@+^Y_!^Hf_3k8)W)BgXTzMp|1I}_ZPX}HA4z#x(kz%Vgk@?Al3
z$0$&&Ffe4V`1e0VvBqJtii1jb0s~7oa<X~B%mg;`5krFz6C=aU=gbVNUNSRkH8C^<
zU7zeIq+FlC!VnVA%TSoX$PmJ)upmgDfiZgli0uGjJ1{YXXfZYfJz(b2f|<<N0Fg@o
zsZ&@O1WIWSnc1|I7(nXSR~=(u;s(Wx!@vJq7#JKZ75@J>J;cE2{g9bc>j5+Ss*Rvj
z@b~|gV>}E_g2zhagxDAvcD?|&AK1VOK+aq7|NnG{KmWHdGdS#gP%du-DnAn$*tC@l
z9I85g{||W(z%Wrwfk9AkvZk<lJ**miD9^C7k>Q6~0z-oktd@Ml%%~O5;_xZ)|NoFj
z#S9Zyff57@L*c`J|3e<gJM08GpA`MGK>B%5^h=3@40sET!T<6MJKr!fty;+N!~E9d
zzryl@pp+rc!BE)1$Pgm0!ceF%Syx0k5|k3o{QbYBk<nqNA`3%cBO}93$G`v0Udub|
z{Qm#HIEX&Y@WZTLk-;$W-~W*Lj0_*M1?NYBTGZSO4ML#o0J0a9YCs+X*?Zyt|LF%N
zZxj*c0htae-$6NS@(mFglLO!~hCxe#@rOCc-=J34Sq6p>P-X##1v8@-EX)`g8if9U
zvZ8^gfy+w<h7eF62UHb;nyjE|@o)8EaN+cbS!@-kIs=J2g6dNS2GfMBGK&TO{+krD
zF-!!xHHqnm`Q#0vBK6h({!e#c{9)c8z%a4&AE@A9&Gujf_1qY=9x}76dce%K%Ie?$
z>7ZH$me?E^8iYVz0nwmB0@im1iGi{Wyr6P`6jb1>nIjXN%D|wV1S)m}7$$y(WcA73
zVv?|6xdaZD3NZ!IuONr;FcdyuU<moF@30dTKa7*tib=bItdJLAD17kuKgj>!vWbD`
zz%7tCsQV70|5on>7wVv{IH;@tg_&v9S7C;qrZo<eP5%F%t}t0tTwVjDGC_%9;?Dp7
zr!R0)=q_er=>GEW|CR(chn>&=|DWE##IO@oT})1plt}%?%%~;u@Bj2i%nVuw*nXHV
zFk+av?EnAi!VF^E@eIP*oooytE)2rnpqB5#yYqt<GVUsx_y7NNCkA0}Q1*3XW(X-`
z{b9Z!h+*OkP+E0hDCA^h2wBj?FmcNN|I_a?F=QuAekd-@diU@D=?f+^O2|)Ekx<aA
z0;y$S%vNS(2$|2on9ce3e~40z!{lfG|BE*<HVA!T0F90`TzWM*S3;Tt)P>j%N+B~O
z6zWfc3}XCY4jUwigCw<84U7z+65wYC#E(A}SR8(~f^t6-sI}G*1WHMuR0T^-pll0@
zWKcN;id;5^h9FSt29++LlEVWOehds-pD{EDJz!>ol}Mu37+4&B=7S9W|9{Id76w63
zM|E<7q)ejm|Nqm?Y8)ni26cUzMOV%I`+s@@Gs30a|Nc*Z!1TlXvXgQ5W+vfoP@okH
zF-%ki1%?en;Ryy%Z6UnsA!|d><v;(YConQ>5oTeSIE8^>3n<NBpL|ymTAML82$evC
z2vpsJ;uM_74Aev>>qrSO=1;bjl4n$$94jS1xj{;TaqHxnQt~d`e?fVI!Ss7pg+=(^
z|0a*Xy-d+nj2sO?Mj*#BFl_zL#8{Z{=YPmUW?`*I%8V01{h`Qz|EGgIb>shk@k!DO
zj9rrzrR61efZG<(E(JHkPf(In{0Ax$5~YPzFaP^5{+S!pjy(j<ys*OKGgPHAOr^k4
zG?kODNE>9{_z$tNf#HYQR~Ck?A`A_e#K0YO(N!R)frcthLc4wom>IS(a5(IIRLnT>
z&_7V)hCvG?59-`AFfnX-81Jz2KNDm2LU8t%TJ?}wa@EQ||EDW3GMLVooGT*@Zi2#0
z1vLObeJWvQhMnN3Wo!_-_5Z*4W+sN6H^E-szY<=51~5#_1?6cQhC)!yoy5Sf1ys*E
zfSRNX4VPdA3y20a*{1&kbzk<cd<HGOL5+^sfBy}q%R>!Fff~?&)d03ttPBm8R)BKC
z1348Y=0B6`WR>bcqc^ak;pt|EiLemvhh~fej0{^6f*2;6KplF5ks;)Pe#1@%1BQv9
z7LEfWLx=*4!_Ih+ybMF(Nd|@xMF)^Mpe_xlHwY<y6%80Bf-=nC>fP{S=nFIBWPLeF
zU0+aaGBRudrGaoJXml7ePIN_zjyQ1gXZYzbxl~Ts0aQ#K2x6GX1hUnJp%7FyPZ466
zIG@Ym6R3Cu6<2y7IT?mRP@^QliDBaV|Nq4kj2I?@#yBTGkW*n?KDky_nSUubR`#xB
zVqn<dw1aQ5y}W45Q&1_uz_8_^zQay?0fs_Q`vEM!fN$dC&7k2c$f(lo|No~mFe20~
z1eMIejw?Y$Kd7Ym_4mIxsN{fD6Oe$IyhmQA-uy2lfif`uFq3CtFa%Y%pyCDAj|OQ5
z`4K!0#w@n#6sUp4#E`vJsX+=<nL@K~5U41g%EYh}lzm~b2#G<)RS!2aOawXb0K*US
z2cYVLgTYXNks)L=1B2IAkc%K04B{#V76!otCWf8AKwW7jSX*xoa#XDXMGqqb!v@70
zd=o)6$5&=1t;op-6{Hy*C*M`DW&t^PvWlXD&V}FLQ5CHQh9BnpnHUOr7#TvQFf<53
zd?*4QDfli8%H2m+OfFGW$XxmxRK+rU6cd;_>mjr7szXemN<)0rerO_e`1^kgXq4zP
zv)C#b2FPe%J(K9`MSuQ>d}9_~#lpZK0_qck#zGnX{0}+6<X|bkhoLax|NoFhOk$@&
zWg;j~cTfJSC@rA^$@y9ifB&1E|NmcHgrOk_H0(CHKuLn}(PUpGah6S>Tms@=1#xv-
zp=ktE!h`D1FU*XH(D;K0jk}<x;N+`H$`Xe_#S%CrG+g>B4Du=@oWXXi2N}w88)Qd>
zvW}qlZ%ATjVEAD!&(2WjGkL1A^5i|rHKNsj|4#=E34wZn2@DKdKQl9FU7hT!BG340
za;}QF)~O%=L*}zF6h62<Uup^ygSRk4L(u+HCKd<5O;lm6M~gv4u-GbzKa<y~h>1M>
z_CF+;u|a6-|Nr8}3=Kk?K`ywXqQd*`7sLe#3_r|8CiALFPu5X2V0=G0R#n;b)Sv$$
zpzi-8V~|<ms~-M_l#!s$A;^$>;IP@Zk_lP^J}zdMczW_qRcT0ic%Ul6`W}=`CjV5G
z7T5+F7Y=q@32VJgHc-=GoIg2IO`2;RG!#BFOs-QC69pxv$Ht5kA<Z^nEl^FOJ9({|
zw1VBQ|I-ir{ci#(az$2w>i4No&ERN!qb9@2!ORfyg_&Vh@nk`Dan5F_^nuBS>cTo8
zqhXpQK!pT@X!e7DkV*?=7^o$<nV~`G6DW8p)KwUlOrEQ*Eynl@T&bEQ)j3QCwP+X_
z8iKTbO}?kDX96<uZ#5*hfTm$UX#|u*F8%#K{Q(2R)-U!BJ3*=70W&1=gQi?2`)EiQ
z9QyY^WFeFAX;1|%^6UR}P&O<+q|gmY+!+iEAye2G1VOF-D~t_7uR+e4p&`S%>F@vP
z43l?iNb`a01?5Um+7ACY`I&|sFUavQ6W>i1)Kr&Q^%LAbF#(zNnOS1hoB#jCLFR!<
z{>c%VGOR72ihXjWrt;(kni8U0z<nWz?_mZVoP1VOTqES~|1Ad?8-zfCJdJ_D^vj?B
zTR?4xr~m(pUt?nk{LIX_3N)ZJSwKrXXoHgh|HKGTYm0$lE2#KEE^R>N>LX_1Rl%UP
z3j;&p1M&G%pq2={2n%Lh35vbX%#2!~aQw>5v}*C>MlE5<Ezp$8!1%-b5i_hd7g=?C
z@>(r<aEhB4D82cymJ<_?p{13vp_QQlgI8(JWJ6s=c0&u}WXrU)$&tG9Y`)G4WvVHY
zt8}F`H5qgi@=_~G6x=*R6pB+5i;^=G925*HRC6l082s`T$`W%jQxx2MohPr-HLec>
z^ISrl6w>lb^HLNNOCU;h6q54`GE-9&O7bBBTnuh5A@RPB?w-zYMG8r!B?_5&5EDUW
zWTYmhq!uAr0}_N7oRnHpo|>8mF-##bF9pnEtk|5X+rr3QTwIV=&QJm(C%@6VU9Vr1
zTAW%`mYSlQo0^+nRH<KFTmWS<V91r=lPfAME=f(%P0K9GEl(^;)lJ0IpI=atnyQ<e
zUz7@yt4COzS&*y?vb;DWu_%?nIWaFUzeFJ|GcQFUFFz$!LA6*RGf$x;BUK?KwJb9^
zRiUIPHC2y`p(r&S6xc<n=?Vo!`30#(C6&++&dgI#E#_i~hWRiSWJXeAajF$KL@E>%
ziZi*YU_7qL$Mh{H8Hm*DFfcGkFfcH@Is5<r2?hoR21h=Jxg7J@T_&?lVV%k{jX9j_
z-rcL$E??neaO7rSU~phyVDMmIU}!n_|Gx<v0|SE--vP$C67$4eCW}oGb)70QO?bM{
z48fTKv-oH8F$*zr-Mf4H=B?{Dkc?muU|?YAVPIe=x$-~mzXHfo1_rR;0tN<#hAaR7
zgDe3FgB-Vofq`MomH+<(Kmv|@3UgWJF*{9Wn!@PIb?+|3SxyiJ1A_?z1H%&r28J_N
z{{Q!2W?*2L{NF&O9yBw<z`!8G$iQ&t`v3nLAcLUTf`Ng-gpq;a&GrBPEf~SRU%)t5
zWS+3oWT7d7LDTtW@On%Yn8xoklP8+%-rbwX{s8%+fRTaW#f|^}XF$yZiM22?Fy!3)
z|6c|wRu2-K!N|Z+auezc1_lNZkgq_k1SEwZ^&quJ7#SG0-29IcGB+3*7!KV0|KA0q
z2pU>%K(iJ%5gr2RWnf}pV7c}GzY0QKJ%b1n1B1vdgo{85HJBI}WKb0{*f23L=-m4M
z-v_E06jA|93=Ao^{{No?67%5`n9DSeF@WpdT|Ne9ZdX2ryZ0O+Vj$nvFflM(x%K})
zDB2jH;-2^F@A854f)vbQVqkaxvjD2V4{VqtH^@<Ym>3v%ZvX!eiWZO_kk|z#1_p!M
zh%^Bbd&0!P5OW(fgnlqFFl3;K@h~$ml+@q;|K9*)8Z_7xm>C!*+(ro^1`}omh6T6(
z|L1|K134CyfM(qO|9=fg4C>fqB*$hjGcc&!`Trl3=s-$9dTN*%7+miB{}0Mhun?$s
z0fiO=0|O{d<}fob*xdR5-vE@@oFPHS<OEUx<$w|@0|UbmkU@9<|8D`A47EHSqzo$m
zgqeY1#ohn^bwK7o<zt|Z1383+g@IwqJ#eVigYq;u+qfbrP+?(UxB^jtRo;b#f#J)&
z|Nl2Y901lIg`_`)g@K{vKGgTnZ0U(4-@?McFylTb!PkSc71#hs!g1sVC6Fa73=Ajk
z|NmbAvA|$1+dNjM$t+Wt-KH{4V+0w6C^A4HcZG$4f#bpd|1lu-PLPlb0EGx5;J{_b
z9~K4%n+Hfy39?^+6*P(c|9=QbGc>pYp{@lPZotaGkn!OE{}hNk!Z9F4kU|D*cmyj0
z!;%O8|8s!ULDN$XD+9v}Br#B~X<%hw=y~w}e+B~s10%!adQ(YZZU&IA*RV1$oOtm6
zzXB-UCa*V@0hLamBz=dKfnmo(gvlVqA6OX});z=#M9!cf3PvfIL6NS&#=!9AA+(Ty
z1`#MAK}9#nJO?%g27yQLI0gH1a+sN@2sfnYEMQ|`nDFTT{|6x7O>Q<*76p~~pzvA2
z#=v0l7;5t5{bu5sAYWc!V_*n*49%|4G~hIu$sJTMgX{#A%b>guQu~LEfgyniwV<r8
z!Op;t^BCq1Z*$FhZgA#FVP{|vcmht;pfn3Ei@c$+=m<&*&`j3D&cLAY1nOF7Y@@3K
zxoHbK1B1&GXnE(z2M!N#5_AEDuQ#mTV^9EP@dxY-3@K0k|IYyh4pg!8WR?(^XF){_
z3kL(knkWDN?*OTpY;B<cid~RR790!=22Tmw1d62;4hDvRr~m)gfDD0J<O<3dV5`9O
zursW}1F4_F!N4%*>Hq%?Nb149aGJ`LJB`sFC7FO~+anwd3~!!-vL-lZ!n_R%q069X
z14Z}?4h9B^XK+KoO#&xSlfZQ<OZdIJS3!9K<YNI&28M!X|NnD<({sEf*vBACTsRpR
zT%Mzr58!Is6XJG|nhZ_`h7dezKo<0HGBBh($C5K$r!s+D40eelw+qxw;ORex1Dp)t
zMOL7AV?ZR#DU49dLG6ntoD2+0p8x+}19rK$m3}5Dv4gDC;9_97^Wy*iBai?Mn9DVf
z(`hot6n3YnY|~hsr?Y_Uy^biIKv^$_i-95MCA6Y}+UNyMlAuVc;bLH@c?nIDliyp3
zN^^s9#}!ca0J(Av7X!nDm;XWYD+~<qtOrUuPq-KucwRwkg30mL5}@1)GE#t>fg$A;
zwCypu-&)R&0i@o6n}OlXtN;HiAg*^nYRrK$CN#Vl7(hPF;bvfvcnwRhpRJXIz(w-{
zZU%-quc76{WNjOnKyC&GP=sCJW?+zcgPM$;C$o6K@&G91eBowbaCw88Pr%91c`8!~
MG?t!lObnC*03Q;sRR910

delta 9267
zcmbQyz<8i?gDoSY?_@j1AV#mr6B+fH7T8Qa#Hhw%ugrXP@(V_p#H*|fQw}gOY!zl;
zxKO-Ed!h&f!-XlQv?o6P%rNm0v&gE4%wk#(m_=7<volONz{s$bfq~%y!yRp?obak_
zMusU23=Nk)2Rp9(8tt_5Z}pKC`<0om9$=2Y_L-Ss)tkwQOyZ1RCRZ{^*T4P$UmRkl
z@G7u50Xh={85yQL`~P1Y<e<ORJ6AF!v|mb?vFOuZW`>EMgBe$Tjb>W;J(+ps&uo^J
zzqJ{D%7X3Vn83imFj0(&VG1Jy!v#eZ-HBlHI!q?oGBQkIVqm!7G{s~hSZ;?2MDB%2
z{X{cHs0IsDh+u~4L_@HF3>O$0OeX3vGE7loIB+S1Az<QXW~NmSn3+~NFf&YXU}7*$
zVsqFDwq%Xz#D~nntDHCvL@6;cOc7^bxbVHqeBwi9@l_9)g;%X%XPEMknL*2e>4zCu
z{S@<w5{wK}bQtOxM3S5wCdM;}yjJ}CKg5wC;G#0af=ggU6=oCpVGe0AnJCQAaLMog
z|LHIP{}%@tD$2lcVe2RJiTW%IQ@$`WXiZ^&8ve#=B1jDrL&K$q%pzJKwc)HF2Z*lv
z#>}uvlnKNZ(OSU3VDg}zS$LHm)PN6AgY*CYpZ=AZVU+_cYB?+>K4cbK^@afytqd0!
zT1+NNFf?4!{{Mfv83TjJBW4Crl7K{CiN(Z63=C5qZ)Thbvm6}scPu7OV`G@|gPCDf
z0|UdBNBIsr;~5wV9oH~0gn)hf0b<GX|Nq5B7=%wRI;7MMvJ@<5V>$6G1H%-MrpJ)<
z2eE96<;3HYCE3)JE-<)QP22-k(y;R(v&5<g%p$8|nV{~yVl{E=<U}^{dOK)5G%!Mg
zYKr;9RWM)K*iKvyW4D-06lZ9-^z7gN>D&wqBA_6YVqmxs_1S!)Gy}th>iZTGk1{h%
z`O3_o1yc8w@rT*>zyG&@;v4K>5xa>~7#OC2GQb07@l~Kq@IBeNe&x?>mzBS@9e)0;
zJ`T?jka!XW$J0X=P~1p?<7qx4!;}Y%3?`tUe8eoh>LD{kjRhOSl%LRGe30+3Q=WmL
z(1#HkiXqnEs48UunFCS33hL17|LgyY!wh-#@Bj2K%nYj*urO>vkH0hqhA9uK9X8Ep
zVtAd&z!36)J8{z#CWh_@%wns+*=LFM#0o}+DIkl#3r(2?iWX&N;nVQw+G05|6dV^0
zJ5i#`#Kmf&KUe}3Ns{15`T$GeSF9#_FfdHH{Qti=*pe;Q6G0ZnO`gl4sv`!8?<3X|
z%^4V`-1+}s930F&HelcG{r_J)UWNH8BLl|-MUly`IHb5>Tm_NIT%1-3kdkEIN>~XZ
z!oV@1QOe=xLPmxy!ZHj(^;!&ti3|)O3m6-M6d3HUf#e=A3u}QQ@B=gBs=w8T!12Yv
zB!3Mg2IGTDG?3Yor*MYIFfcNhf@1msvj|w@_hjdlf2+@cHBRF4U}Tu=$)(J@@&Etn
z2}}-_Q@9ue*G;bEYG>@3%*buexMH#+w>)FX<V5cE{2u@RPyhS>zc>p6!-bX`c9Z3K
zY#B`_$MV=Ss!pEEV{Re-|Nr!vP){>3GHhXF;FzE!;qY@21E?@|_^BYl@RNa|AqeC=
z1%`&8e^9lPWB3(fK<@opy>BHmL&GI-cyKfP1eMD53{0;R7#KnnGLkJE7#U0xn3%hr
z7?@8pGBgD31SJV(;Z>ixL1`Bf79hhDvXm{7Sr{gMgjsNaUxNh{_LE=mt3Vh$0x}SW
zh5%H=N5DrGq~<X*!>VV@jH{l4N>m1ht<DS%KNA@oEFVtZC?H?o$i!gsfSGO87EpNo
z|G)JKGxMrOkSwU!VrE;l?*ISkjVufkLH?i5z+m|V98CvTJYZ&C1*&Y8FfjZCIT0lO
z>HmLmkbaPtzr!n*{ov#PDsVtS@))dt|H>!K46FV!GpJ5n{r~^;hs?~N;;Op@6d~0h
z!&$(FgA4{~nw%gg;xPCB|LF}34Ba5p?=vui194$Svc*9L22=SAWs3*QEUW%j9|WfZ
zkVeJ~NT7X%1=<=x3rG+>5p;ksRD={vK<0zuNl}JD2sxg9{r^85R3M?p1t>@-rwAE9
zOqe2M5C}10|4L8>2bsViz%cR0|NqnDIUGJQvM_{zs-(qt=Laoj+*Jgs);|9KKV6=I
zIXjV&A;ckoVd7g5pM{}tB?Ci<LjuFZmy-pB<#`u^WG668ybtpBWLsfz6;N=4Jm$dE
zAoK^6HyIm*e*OP1et@At=m*S`1;QrvFb6RNFiZqFXdg6KK?b~rDwOAN`1Fv2Aq1ut
z=J<to=Laoh+*Jh1Kk^KW*^C?zN3Q+<fBIu)1}%AzL)jq?T>)~q3qzp>J3~l414H&>
zHinP~%uIZ%9{m459TdS10t^%9PgWEWXPi0NQbbyE(*OU{?HL%dn-m<XPBJotJYZ-L
zl4M{I>6x4>A}-nX|Nr!41_tdz|Ne*AGcad2|N9@}V8Af3Ve(uN@xUsmtkYkJEJ!bd
z!F(y?C<lcMD1;cGA)~+u2^p9tL0JJ5APfo&6VoRD6;Wo4ovbJ-E*TE;hyz36O9qAz
zB?cyKrT_m!5+*QA44fP&Ds2b~Hjt^Hn18{{v<hb0BZdZWieX}8*!i59Vbx1!My)1>
zhM>!nCyFX3Hn1>+#Pc!~b}%x8Fe)qv0tMy)5ZeL5PGDjP(PC@}0=fSIGnW?37RCms
zJV>p=!XQxceaOtFrNqz>^njUt)iDMp?#=)IPgj^MC?>AC=Kufc4uAh|ImW{vc&tQD
zhz;bH|DXzpO$($N<etS~)q!H-ycxg$hdc;in5d?}AjmSgR7@S3R3IhxLwSas3mJZx
zC4l?|Er~(?e#FeE70=@E$?^aHkVnM~6PJQQi-n=^;J^PN59A$of?Nm*6Vl9?{Qtk`
zba@_3gC@&}OE6xYY$`4<SP!y`gQ0K%BSVP13PYj8<WzCxL|9m@`TKuMBcsDkMHYs@
zMn;C6ihuu`y_R>_`R)IIaS(l);fGnhB7>phzyBfg85uri3(k*v|Np-@H$#IEs6~wI
zYLL(V%QNge3(EJCABqc$z-(b)faEuj>PZqZqPxK*7K4@p;}3I?|3MY>+sTF!2px<J
z4MM-61>ocW34?l0Murej!xB<&39o`wZinGz)gxvxP{RY<ik1KOe|iD~gK0umnMK3D
z|0cz33==_)1|`2mOh3#)&iGpmFF_|l%XY1VfB&b0oYWw|Ffr;MsEA?B&R}E+dBn_+
zruC4SWfiEH7ytKvI;hG5r8=1Z92gpeK=BNsLFEYpgTqb+jssC3F_>kr;(@^dQnrDL
z0)-rz;8X?%?Iuu3CBQK8)8s%&dE`*L1S+LKCQPo8R1kdtauW|j;R6PSkk9%KJ3-N@
zIC-O_v<}Q6@&XKn2mbyCg%r3zW8gV(3*-o7$4vepDZ{D+O7)WkrQ{7@S`(BQCW3Os
z0w;y;VkU;}EC2p)Nnmr>`4m)oGBNA~RZU=*L`ccVe*F7?`Xgortp{vB%oi9jOq~D!
z|8!vnG46N<;p~-@CrSwiPXGUZx)X!2Hz?C4GBbosWBp;iAc$e&L{M^cU?>E|=Yl4N
ziM{{-PruK^kln<>5W>tL=3URglASc6MQXE?aW|;)09EQc{{EkSVDeWfc@~gkCyPic
zXcmEtVPMQwW@HGN&%l`d^3VSer5cCHPyhcHZ(?i^`oaL}6*gRYIXPBZS^yOBpw{aa
zSc+<pR?uDi_y6<-j6cj_ox~7GqFl9rkzor1gTv1zh{t~_usHmzpL|wYydGpbC^SLY
z8x+kTV?o6hC|KASKm`$`rUn%@prXV2|NrR+7#Oxb0~ZINN|_B_NHMTD{7eN!!vFtU
zj<GNZeug^jZ}nbqZ4c@`eqm->1?obA`Zx><3`rAJKpmMHhsmEoLC-9@D(~<A=?%;X
zFXV#KCi4&T%TC7Ko0){WK>=PY#4u3|6k0Y6g(pCbWM<)24_O<6ru_Loy#ds!WMKex
z0k(hwd*<YgGDx)~V}no$G#o*Vkp?D)ouI}Z$h(sjG(;x<kP%>Xn#?IH&*(T=Q&wIU
z7CxXF?jaLH$RlG=-%3~u)W_L4IZ;;L<H{dU4r4I=o>gIC{`bGhBXAE$bQL2<LlDzn
zaIW3@pNX;1;m`k&hs?rSkCYiFf^^&b`#&Az>Fdx?ntVrIa`IhSc1DlMPi5u75d(``
zP)h_<Lw$y}7XSYJKm7p%D2y1uJs0HG$o_x-#gX}-$OZWh-Hd;D%vksDzbIBiCRfNA
zWM2Faad-p64>M6#hOHtD4VT2gT~X0hAP<6i4x9c#x;O`z8MZKRIP82>%s6rNKTw+v
z<YKW^$Nv4FuE4~w<zc+T&i_n|*$2TzlGLh)%#y1zp#i#MvY@;)I2=HJfSJ7a|NrT?
z|Nj>kW@gw4N??;28-#BD|1Z9oiDBmrXi$O*LU^qnz%VfYRLIyc6ml>!gd{OAYyq_Z
z92gjOg33G4SP3kWL3~&fw&ovr3?%R>$gpRScIiY=+sPKmuoS3a4LA*BTgA%Ia0z6=
z0;uCA-;q~g+&H;VQ5ozvgqtCm<mqOHiLiKXfo9(Wj0{^6f*2<9L#=)RY9;A6>|`)t
zm<VdJB``9CD6lx}v;)b@Kw2z{4j^+Jem(#<tr3-qq5;E1P)4^`W@fxPd5VIDuGYW*
z(?K?X`XS{^(D*WDoT!8pUm#CEU}E^0F!`l|vIodJpg1`Y#4z#J-~ZF)Z5RqY7#TvQ
z2r*2Y&*kt5RG5RxSuUu1KpoixCx(gd{{I(GFk+ba201AF;XyGUDhw(wm>3u~IGNak
zTdI#iK@!Zk66C-y%#2!(K&2Q1!<L8o4m<4y7z#n&2dkH{p9oS58~eBcYT_^=)ExxX
zF~N>2K~>q`YDkb=`ukt}bFic6N=W?&5d`@SlxHT3DCr3P`vXbt3XDI@<XIRD7fcRR
z5(Y;dNExUZ4@&Sy|No!9pNS!Rt5Sm$s1X4zWP(6d%v7X82IMzHR%TrFa5KY1kUI}B
z{4jq2s{c3`3>_F5LN0@QlMO+Ttc-9L0}F#-0uzJT&Yz&RJ`-|Fb`Me^%eV>@Sd0t|
z6BI-2Cw>)X`1zHYNh@YDr?NDo@nltHYaUn}g8iAItYFaa8=Pge8W?_<?`L8t)B!~(
zLxT{cbpq{GOM|+gkO9TX8<Z6ogC<{87UzVveO4(<{-`W2*7WCp$Tw!;RV)k)BG=d$
zChlhvd;Q?|WH}WnMvKXoD$+9l|3YkX`1{}N9C*m7AqdtJoV-9qg0XgTpsG07h3lY6
z0xX;d5;g@nycQ}956xi4m0y^VJY9kCG$?cvCjV7YW(Db7Jy}sz7;H2s_Q0M8+2{;1
z8Z3MbYV_nBRUN?(zaViB3KMyDhQgf5D^-;tHTD_R8c|PBlOf+>=R;<ORS66XTR$^1
zX<eBdt0vFbKDky+Tx->j{~`0)7z!U;pD#6qiNRZ#p&@AhDHDqW;I_E1)}zIssz7Yj
z+251*sfkG({PsU2n6W_!RO}ZsGze{iIpu|#3hzXyQxX_{n43(NRF{T0!$jSH@!jN9
zb!E#{fBuI&1`X&MgA5g4HRU&?xCISIf=s&$H4Rh|Fo9}zW`>E6iy0=Kn7mhAItCOr
zun+;M0H;x;Jog5imwuQtu`mR}^4I5JN60`1v|F&@KR7R~#2BDa(9mGCp6sb1%@zF{
z5}?A2lk+shBw@BbHfEd%Y3)L4R-VZ-HKgk={QN(C!QcNTkfL8?6{xx62sHpPL=7o6
zL2V02GH28RHT>;)7z{O-8A84=Gpyo;1|6u%1epP9h=XciJ*Zg^7=D<26$TZRkU=MC
z*<c7BGlyCJ9aPRSh-M%72dTzE27wyjn;9B}KqD~Vq!gj4!l*g9R#RJS!q5NH6Brpx
zlIk2LgNExtZN39PC-2kL1E(@rP*47#DWb6E@Birxj0{`9*gNcmxC4^gU_<wl6|^My
z7XAAlvXDvmG^kCp;^$;HEjf-?&={SZp(VrG^%vCp>(r9Ag#{|81OOFH*MIz<{?)%>
zr#K6PU@4Pmw+KT+P(73A>tqIo5D|t3A&@U%CO1sJtEH}B^7H?6g+KpIrm!&xerA?f
z1uCzvFg6H*#{R(mRM3`TjRLi8COc{?!@I&??HhK2EEQ!C?FL!U%)k&b<=_7;pso@q
zh+vikPM)YOu4D4||CR%c4ML!poW{UldgagmEuiMulmGw4udy)%er9G|1^3|vZE@QP
zPHXHZ>VVqK3=CUAWhHvq2&xYrF$=Hq1T_sA7z!VV&zAx<^1x1((UB1~{P}<S190;g
zlFUGH7(CfmN1XA-<WwDb4p_)-o}v@T#A9G+Wn^q+Xu;rEP&E0Yo+5jSS*o$Ih1q0D
zefiBU2BnOXj~d>Zyu#RG@_l2`dIJUq1_=fRhBFuc|G&V%z`)?B>&WLYmt!8g%Vf4G
ztW#O0F^6;AyL<K8<tuz3Ic^391{Vef1|J3nhKx)9|5va;^%TtIo5$-hnP&?3RIX{9
z(>Z3a&t#j$I-7-QC)d5Zw{PCMegnk}kW~T<3>M(w_8Hgy|5pKtFfcF(FfcHz0O4!@
z|AQ<734<KDhk=3N#<l<dV?Y9qx|0{0h|23aay#9-3vrnR0|UbcklgkE{{xu8j+%VY
zM5SKW5i}alz`&rx$iN_S>;HcpkRm7sS?0pXz@Tvp;Q)|BA{ZGMEN=b(9|2Ma3K505
zEc2M1Co}nQ-Mf1k5)dH04U7y78AxV=#6VL?4Y&UP*8u5dsE7K9k%3{#t^fZOz=9C5
zJ&X(t3*ZVNViy=07`EK{|33h#4&?JEj0_APZvFoc3Ka%lK7qMR^B8plxbEHMV{p=S
z;&$a@xO-0*<Vdg#0|Uqo2_^=Hl-vLRo7960a@2K#Xmf{XVt^>JVPaq?x&8k?Xfg#9
zw-7acV3Qqn9l1fiNnm1NSaSRSe;bfF(C8^)VqiFP8xcJqbsbC$41aE;hT<G128Mc`
zJOBTKd;zuq7L2aYP=p$Igo%Mc<j(*9CP<dtU}9h}xdRJENa(y_VqoyN^Z!2&R2|5t
z49pA+4tM^8vMU4F4sa+W!#q(B_Js;F1H*+o|Nny$2}mzUqXjbq!<ReID1ir`3n+vf
zbr~2KK=BvD%)s#B&j0^5jG$z%>j()UCMSp@X9!mp5}F;LM0fB1{~nM9aP#WpA!?yP
zzJ{5BA>-cv{}vzvonZz>fnDpQ>&Ojq*ac<=hMN2T|9ij;0*9I_SPdvzKx)1)GcYV5
zphkj)f#FE~{r~@Wpcn+P3}%oG3j;&M18Dq$Tn)C&6UDLw76yib2k5y0k^({IfTFjB
zg@Iwoga7|4V0IbIWt+$9G<otY3t>ne1cm1g76yhF5B~qp0I7m|KL8R$h~NYl0#8^N
z7*rmjM)nUD1_qgj@In9@AAxY!g6xoCWnc(-`2T+n$PSQ?3<4oeVVS}VQVA(89J#@k
zc(8(Iz5f5_04av1#u!!xhK`2_F;Ia~z{<c-^YH)w0+2dK-O0I@lH#C}1?2SwtPBi$
z9{&HY0g6*c-N`d8WpqGtU<<CWGB9j-gzyDO!wXghh82(CVKw=#rHl<&11M%?*ccez
zJc5=0&hU&2_97^SfDCY8V_=YY43F5!x>hn0U;{wuyM&E_Vb0_K|6f3z`q5fs@>)B7
zNF;z$^#(Qu29GEI|AWeKaF&6_70VQ6m#Ivi_wHVWgb~Q&ci0#hGM+&5Iw&;3>BDI<
zlRKg$1eL*{G7+Snhn<0;2Ag^{EE+(CiVZsh!-OXY=Zacu=7anKipm;x1_q0#NDc+(
zZ7+COID!(6lP=g(E7%zrBA!CS4dhU4YMpf%K#sfua^zEZ!8duKwUnKsE(56KXW?LA
zSn%}!{}M>(Ir4$S#(6SJ2*SUhVoHaDf#J>5|Njp_)J^_qtpJGvkohSb3=AdDP|O!|
z)MWrg-4qT6h8fTP|L=h63$y`OW6rQ@45a1+$ZRAvjW#ln*aJE64+jH-!*is}2zH>;
zWEO9P13_V@!pXo;@EmRtv{H8hRqC!&S;FCw4Dw6>Cj-No=l}l;KvFQWS|?Boz-jtq
z0b5>(|3Gf&;ACJ}@&aCHOg6L?7IoAG$!y?cVAz2w6X>W5N|rZ3cD#V+AZWlkO=g+G
z>^hYR<alVRbL4h`JC1<?94R7P3=9k}(d`4Z4s5s>7(`zF|K9>}`Q(eX`jVj3!@vOY
zR|^*dL%^&5|Ia`J8<Z6^?RX%83Ce7HxEL6oyn@yXphN>s-Cm$%1+D`?vGIV5f#Jt1
zq=W@l<20FR3L_{bLb3{4Lqr7B=6L=8Kd8|H&S3#_x#n>?P3D-w?lhHck_{^;M?xJ6
zN-zQ33=C6V!|RU87wse<p$&3C12+T1hu8oAFM#^uubmtyHG%YP;bvfndGr5&15`@a
z9;y%I`zPEC3~SyXl4zv8l9;X|H^@jC9tH-Jw}=9y*Ivc}9BiOC4B%m4*zp#gdZ97p
gJekD<HHB61FfcrM3(qQ(AKHtvIO-a(PYjd;0F(<%kpKVy

diff --git a/pc-bios/npcm7xx_bootrom.bin b/pc-bios/npcm7xx_bootrom.bin
index 903f126636f9ef5d1100c056656ccfb2b32e5e10..92282892b70dbcd6828c5054dff33ffe3385c485 100644
GIT binary patch
delta 218
zcmZo*Tfn-ZgR!26f#J8ofBlEI{{Mf)!0`7!1H=FS4NU+4D=_{AV+Q4dtyd(DNipaw
ze9g?taHn9eP6ms$Ny3-s+{*qRs+|P3PEPm#z~G{kA?7{HiTQ%0M}^D(?-Sl9We9`$
zVqkv9djW6hYVVEy9~hkcKU6zj`oW>dmB8aQ+mUf{s{aQD$BRE47#%iV{NbX=^p&CL
z|Mw&R8NM<U2<&C``171$e*k;vst|vFCk94_1_ptK4-8BU4Ot8f4228~43noY`S2(*
GAOHa1WmOyi

delta 298
zcmZ3$+Q7D<gRx$af#J2mfBlEI{{Mf)!0`7!1H=FS519V{S77`L#ta4v9t$|=zGObo
z^nlsH;Q<3f%wy&Ujt>MH_TFGPFz+dgf%7AV11(R#{r~@p+hD=t-zpIG6$VXDnH(29
zW>A>&w8dclQ)Y&shfE9%Tr~{ypE5A?KiK#G|7#Y7DfLeakR&splH33Pf1O}3|0$2b
z<);h`!H?M(7`T`e7d-wgvfwd?;-sex3XM-)6y`r=HeT>B0%Vckg2xVw6Q43L1UzP8
zVBm65ocNSUr|Hr8|Nmbz@iaUVXxRHgf?@ts5FNlCx@rOg14D?vzf(5@9|HpeBSQm&
XK*I+HCWeN|9!x$H3q*Jn84v&f8yI@#

diff --git a/pc-bios/npcm8xx_bootrom.bin b/pc-bios/npcm8xx_bootrom.bin
index 6370d6475635c4d445d2b927311edcd591949c82..45fb40fb5987ab681cc902659d85e76a7385cb53 100644
GIT binary patch
delta 215
zcmaFBvVe6%2BV+@69X75fYFmH8MW&beohQhuv<{X$k23&QDEOE1r~;#P7Av(IlWl<
z=~3sYPfi^#KRGit1Ti-(Dq>{VaEXCs!zC34hoAEqm|ibrWC&4VaN0SafjQfeks;)7
z_5PKAnHeT3{c+r>`onSO17=pO`~Uw>|66@<#R3Kn!2`_k*Ay98CfYMFynguie+Vl>
z17{FSVq&1kBqkYEmH+?$tAO3fz#zlGz@Wpxz+m$K|Njn<SO}lMT&8)9Zj&9E<N>PE
BOUnQN

delta 152
zcmZ3$`haCa2BRPY69X6|!05@9jM_ebtM{)|_&G61!EQm(UuK4hj0{be7zOryQea`&
z$#kJN$cb@55u-!HB}ax0pBNY>TzdWg|MW!0rXa<H1w~8=`!6{%FzozWeQ?DA=J;!q
u4VZLPQ~v+|uL8D+fkB3WfkB6XfuZF8|NlN9F-JauxlHpI11C2!$pZk`xiWkJ


From 13ed972b4ce57198914a37217251d30fbec20e41 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Mon, 4 Aug 2025 09:46:33 +0800
Subject: [PATCH 2710/2760] hw/ssi/aspeed_smc: Fix incorrect FMC_WDT2 register
 read on AST1030
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

On AST1030, reading the FMC_WDT2 register always returns 0xFFFFFFFF.
This issue is due to the aspeed_smc_read function, which checks for the
ASPEED_SMC_FEATURE_WDT_CONTROL feature. Since AST1030 was missing this
feature flag, the read operation fails and returns -1.

To resolve this, add the WDT_CONTROL feature to AST1030's feature set
so that FMC_WDT2 can be correctly accessed by firmware.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Fixes: 2850df6a81bcdc2e063dfdd56751ee2d11c58030 ("aspeed/smc: Add AST1030 support ")
Link: https://lore.kernel.org/qemu-devel/20250804014633.512737-1-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/ssi/aspeed_smc.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/ssi/aspeed_smc.c b/hw/ssi/aspeed_smc.c
index 614528b8ef..e33496f502 100644
--- a/hw/ssi/aspeed_smc.c
+++ b/hw/ssi/aspeed_smc.c
@@ -1857,7 +1857,8 @@ static void aspeed_1030_fmc_class_init(ObjectClass *klass, const void *data)
     asc->resets            = aspeed_1030_fmc_resets;
     asc->flash_window_base = 0x80000000;
     asc->flash_window_size = 0x10000000;
-    asc->features          = ASPEED_SMC_FEATURE_DMA;
+    asc->features          = ASPEED_SMC_FEATURE_DMA |
+                             ASPEED_SMC_FEATURE_WDT_CONTROL;
     asc->dma_flash_mask    = 0x0FFFFFFC;
     asc->dma_dram_mask     = 0x000BFFFC;
     asc->dma_start_length  = 1;

From 41ae2640c4d88dabed9469b3a3bda4d6c0317240 Mon Sep 17 00:00:00 2001
From: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Date: Thu, 17 Jul 2025 21:59:28 +0300
Subject: [PATCH 2711/2760] docs/devel/submitting-a-patch.rst: add b4 section
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add a section about b4, an actively maintained and widely packaged CLI
tool for contributing to patch-based development projects.

Reviewed-by: Gustavo Romero <gustavo.romero@linaro.org>
Signed-off-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Message-ID: <20250717-docs_add_b4_section-v2-1-69212ed39299@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 docs/devel/submitting-a-patch.rst | 40 +++++++++++++++++++++++++++++--
 1 file changed, 38 insertions(+), 2 deletions(-)

diff --git a/docs/devel/submitting-a-patch.rst b/docs/devel/submitting-a-patch.rst
index f7917b899f..dd1cf32ad3 100644
--- a/docs/devel/submitting-a-patch.rst
+++ b/docs/devel/submitting-a-patch.rst
@@ -235,6 +235,38 @@ to another list.) ``git send-email`` (`step-by-step setup guide
 works best for delivering the patch without mangling it, but
 attachments can be used as a last resort on a first-time submission.
 
+.. _use_b4:
+
+Use B4
+~~~~~~
+
+The `b4`_ tool, used for Linux kernel development, can also be used for QEMU
+development. It is packaged in most distros and PyPi. The QEMU source tree
+includes a ``b4`` project configuration file at the root: ``.b4-config``.
+
+Example workflow to prepare a patch series:
+
+1. Start with a clean checkout of the ``master`` branch.
+2. Create a new series with a topical branch name using ``b4 prep -n descriptive-name``.
+   ``b4`` will create a ``b4/descriptive-name`` branch and switch to it.
+3. Commit your changes, following this page's guidelines about proper commit messages etc.
+4. Write a descriptive cover letter with ``b4 prep --edit-cover``.
+5. Add maintainer and reviewer CCs with ``b4 prep --auto-to-cc``. You can make
+   changes to Cc: and To: recipients by editing the cover letter.
+6. Run patch checks with ``b4 prep --check``.
+7. Optionally review the patches with ``b4 send --dry-run`` which will print the
+   raw patches in standard output.
+
+To send the patches, you can:
+
+- Setup ``git-send-email`` and use ``b4 send``, or
+- Export the patches to files using ``b4 send -o OUTPUT_DIR`` and send them manually.
+
+For more details, consult the `b4 documentation`_.
+
+.. _b4 documentation: https://b4.docs.kernel.org/
+.. _b4: https://github.com/mricon/b4/
+
 .. _use_git_publish:
 
 Use git-publish
@@ -418,7 +450,7 @@ Retrieve an existing series
 ---------------------------
 
 If you want to apply an existing series on top of your tree, you can simply use
-`b4 <https://github.com/mricon/b4>`__.
+`b4`_.
 
 ::
 
@@ -533,7 +565,11 @@ summary belongs. The `git-publish
 <https://github.com/stefanha/git-publish>`__ script can help with
 tracking a good summary across versions. Also, the `git-backport-diff
 <https://github.com/codyprime/git-scripts>`__ script can help focus
-reviewers on what changed between revisions.
+reviewers on what changed between revisions. The ``b4`` tool automatically
+generates a version history section in the cover letter, including links to the
+previous versions on `Lore`_.
+
+.. _Lore: https://lore.kernel.org/
 
 .. _tips_and_tricks:
 

From 0311a6edb9db34a41a2662d94c37e1fbaabf6ecf Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Mon, 21 Jul 2025 16:33:41 +0100
Subject: [PATCH 2712/2760] scripts/make-release: Go back to cloning all the
 EDK2 submodules
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In commit bd0da3a3d4f we changed make-release so that instead of
cloning every git submodule of EDK2 we only cloned a fixed list.
The original motivation for this was that one of the submodules:
 * was from a non-github repo
 * that repo had a "SSL certificate expired" failure
 * wasn't actually needed for the set of EDK2 binaries we build
and at the time we were trying to build the EDK2 binaries in one of
our CI jobs.

Unfortunately this change meant that we were exposed to bugs where
EDK2 adds a new submodule and the sources we ship in the release
tarball won't build any more.  In particular, in EDK2 commit
c6bb7d54beb05 the MipiSysTLib submodule was added, causing failure of
the ROM build in our tarball starting from QEMU release 8.2.0:

/tmp/qemu-10.0.0/roms/edk2/MdePkg/MdePkg.dec(32): error 000E: File/directory not found in workspace
        Library/MipiSysTLib/mipisyst/library/include is not found in packages path:
        /tmp/qemu-10.0.0/roms/.
        /tmp/qemu-10.0.0/roms/edk2

(Building from a QEMU git checkout works fine.)

In the intervening time EDK2 moved the submodule that had a problem
to be one they mirrored themselves (and at time of writing all their
submodules are hosted on github), and we stopped trying to build
EDK2 binaries in our own CI jobs with commit 690ceb71936f9037f6.

Go back to cloning every EDK2 submodule, so we don't have an
untested explicit list of submodules which will break without
our noticing it.

This increases the size of the QEMU tarball .tar.xz file from
133M to 139M in my testing.

Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3041
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Message-ID: <20250721153341.2910800-1-peter.maydell@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 scripts/make-release | 20 +++++++++-----------
 1 file changed, 9 insertions(+), 11 deletions(-)

diff --git a/scripts/make-release b/scripts/make-release
index 4509a9fabf..87f563ef5f 100755
--- a/scripts/make-release
+++ b/scripts/make-release
@@ -62,17 +62,15 @@ meson subprojects download $SUBPROJECTS
 (cd roms/skiboot && ./make_version.sh > .version)
 # Fetch edk2 submodule's submodules, since it won't have access to them via
 # the tarball later.
-#
-# A more uniform way to handle this sort of situation would be nice, but we
-# don't necessarily have much control over how a submodule handles its
-# submodule dependencies, so we continue to handle these on a case-by-case
-# basis for now.
-(cd roms/edk2 && \
-    git submodule update --init --depth 1 -- \
-        ArmPkg/Library/ArmSoftFloatLib/berkeley-softfloat-3 \
-        BaseTools/Source/C/BrotliCompress/brotli \
-        CryptoPkg/Library/OpensslLib/openssl \
-        MdeModulePkg/Library/BrotliCustomDecompressLib/brotli)
+
+# As recommended by the EDK2 readme, we don't use --recursive here.
+# EDK2 won't use any code or feature from a submodule of a submodule,
+# so we don't need to add them to the tarball.
+# Although we don't necessarily need all of the submodules that EDK2
+# has, we clone them all, to avoid running into problems where EDK2
+# adds a new submodule or changes its use of an existing one and
+# the sources we ship in the tarball then fail to build.
+(cd roms/edk2 && git submodule update --init --depth 1)
 popd
 
 exclude=(--exclude=.git)

From 61432e805e5028df0a3df5a76915cdc3007ecd41 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Mon, 4 Aug 2025 11:43:08 +0100
Subject: [PATCH 2713/2760] tests/docker: fix debian-all-test-cross
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

It turns out you can't easily expand an ENV var across multiple steps
in a dockerfile. This meant we silently dropped the architectures we
should have even on amd64 hosts. As the updated AVAILABLE_COMPILERS is
only needed for the following apt install line just merge them.

Fixes: 6da616bb170 (tests/docker: handle host-arch selection for all-test-cross)
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250804104308.250949-1-alex.bennee@linaro.org>
---
 tests/docker/dockerfiles/debian-all-test-cross.docker | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/tests/docker/dockerfiles/debian-all-test-cross.docker b/tests/docker/dockerfiles/debian-all-test-cross.docker
index ef69bbc8a5..420a4e33e6 100644
--- a/tests/docker/dockerfiles/debian-all-test-cross.docker
+++ b/tests/docker/dockerfiles/debian-all-test-cross.docker
@@ -62,9 +62,7 @@ RUN if dpkg-architecture -e amd64; then \
   export AVAILABLE_COMPILERS="${AVAILABLE_COMPILERS} gcc-powerpc64-linux-gnu libc6-dev-ppc64-cross"; \
   export AVAILABLE_COMPILERS="${AVAILABLE_COMPILERS} gcc-sparc64-linux-gnu libc6-dev-sparc64-cross"; \
   fi && \
-  echo "compilers: ${AVAILABLE_COMPILERS}"
-
-RUN DEBIAN_FRONTEND=noninteractive eatmydata \
+  DEBIAN_FRONTEND=noninteractive eatmydata \
         apt install -y --no-install-recommends \
         ${AVAILABLE_COMPILERS} && \
         dpkg-query --showformat '${Package}_${Version}_${Architecture}\n' --show > /packages.txt

From 0a9a27305da030a83e65714f6ba202dbcaf448a3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 29 Jul 2025 15:56:39 +0200
Subject: [PATCH 2714/2760] hw/sd/sdcard: Do not ignore errors in
 sd_cmd_to_sendingdata()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Unfortunately when adding sd_cmd_to_sendingdata() in commit
f486bf7d109 we neglected to return any possible error. Fix.

Fixes: f486bf7d109 ("hw/sd/sdcard: Introduce sd_cmd_to_sendingdata and sd_generic_read_byte")
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20250804133406.17456-2-philmd@linaro.org>
---
 hw/sd/sd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index c275fdda2d..0bb385268e 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -1305,7 +1305,7 @@ static sd_rsp_type_t sd_cmd_to_sendingdata(SDState *sd, SDRequest req,
                                            const void *data, size_t size)
 {
     if (sd->state != sd_transfer_state) {
-        sd_invalid_state_for_cmd(sd, req);
+        return sd_invalid_state_for_cmd(sd, req);
     }
 
     sd->state = sd_sendingdata_state;

From 3025ea65bd515196e871adc8959336c51b9d27bc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 4 Aug 2025 11:32:44 +0200
Subject: [PATCH 2715/2760] hw/sd/sdcard: Factor sd_response_size() out
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Set @rsplen once before switching to fill the response buffer.
This will allow to assert in a single place that the buffer is
big enough to be filled with the response.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250804133406.17456-3-philmd@linaro.org>
---
 hw/sd/sd.c | 36 +++++++++++++++++++++++++++++-------
 1 file changed, 29 insertions(+), 7 deletions(-)

diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index 0bb385268e..76ce54664f 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -729,6 +729,33 @@ static int sd_req_crc_validate(SDRequest *req)
     return sd_crc7(buffer, 5) != req->crc;  /* TODO */
 }
 
+static size_t sd_response_size(SDState *sd, sd_rsp_type_t rtype)
+{
+    switch (rtype) {
+    case sd_r1:
+    case sd_r1b:
+        return 4;
+
+    case sd_r2_i:
+    case sd_r2_s:
+        return 16;
+
+    case sd_r3:
+    case sd_r7:
+        return 4;
+
+    case sd_r6:
+        return 4;
+
+    case sd_r0:
+    case sd_illegal:
+        return 0;
+
+    default:
+        g_assert_not_reached();
+    }
+}
+
 static void sd_response_r1_make(SDState *sd, uint8_t *response)
 {
     stl_be_p(response, sd->card_status);
@@ -2203,36 +2230,32 @@ static int sd_do_command(SDState *sd, SDRequest *req,
     }
 
 send_response:
+    rsplen = sd_response_size(sd, rtype);
+
     switch (rtype) {
     case sd_r1:
     case sd_r1b:
         sd_response_r1_make(sd, response);
-        rsplen = 4;
         break;
 
     case sd_r2_i:
         memcpy(response, sd->cid, sizeof(sd->cid));
-        rsplen = 16;
         break;
 
     case sd_r2_s:
         memcpy(response, sd->csd, sizeof(sd->csd));
-        rsplen = 16;
         break;
 
     case sd_r3:
         sd_response_r3_make(sd, response);
-        rsplen = 4;
         break;
 
     case sd_r6:
         sd_response_r6_make(sd, response);
-        rsplen = 4;
         break;
 
     case sd_r7:
         sd_response_r7_make(sd, response);
-        rsplen = 4;
         break;
 
     case sd_r0:
@@ -2244,7 +2267,6 @@ send_response:
         sd->data_offset = 0;
         /* fall-through */
     case sd_illegal:
-        rsplen = 0;
         break;
     default:
         g_assert_not_reached();

From b82e7a2a1da5638c4c51fcf5a254b65762080b85 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 31 Jul 2025 13:55:25 +0200
Subject: [PATCH 2716/2760] hw/sd/sdbus: Provide buffer size to
 sdbus_do_command()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We provide to sdbus_do_command() a pointer to a buffer to be
filled with a varying number of bytes. By not providing the
buffer size, the callee can not check the buffer is big enough.
Pass the buffer size as argument to follow good practices.

sdbus_do_command() doesn't return any error, only the size filled
in the buffer. Convert the returned type to unsigned and remove
the few unreachable lines in callers.

This allow to check for possible overflow in sd_do_command().

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250804133406.17456-4-philmd@linaro.org>
---
 hw/sd/allwinner-sdhost.c |  7 ++-----
 hw/sd/bcm2835_sdhost.c   |  7 ++-----
 hw/sd/core.c             |  5 +++--
 hw/sd/omap_mmc.c         |  5 +++--
 hw/sd/pl181.c            |  6 ++----
 hw/sd/sd.c               |  6 ++++--
 hw/sd/sdhci.c            |  6 +++---
 hw/sd/ssi-sd.c           | 12 +++++++-----
 include/hw/sd/sd.h       | 23 +++++++++++++++++++++--
 9 files changed, 47 insertions(+), 30 deletions(-)

diff --git a/hw/sd/allwinner-sdhost.c b/hw/sd/allwinner-sdhost.c
index b31da5c399..9d61b372e7 100644
--- a/hw/sd/allwinner-sdhost.c
+++ b/hw/sd/allwinner-sdhost.c
@@ -233,7 +233,7 @@ static void allwinner_sdhost_send_command(AwSdHostState *s)
 {
     SDRequest request;
     uint8_t resp[16];
-    int rlen;
+    size_t rlen;
 
     /* Auto clear load flag */
     s->command &= ~SD_CMDR_LOAD;
@@ -246,10 +246,7 @@ static void allwinner_sdhost_send_command(AwSdHostState *s)
         request.arg = s->command_arg;
 
         /* Send request to SD bus */
-        rlen = sdbus_do_command(&s->sdbus, &request, resp);
-        if (rlen < 0) {
-            goto error;
-        }
+        rlen = sdbus_do_command(&s->sdbus, &request, resp, sizeof(resp));
 
         /* If the command has a response, store it in the response registers */
         if ((s->command & SD_CMDR_RESPONSE)) {
diff --git a/hw/sd/bcm2835_sdhost.c b/hw/sd/bcm2835_sdhost.c
index 29debdf59e..f7cef7bb1c 100644
--- a/hw/sd/bcm2835_sdhost.c
+++ b/hw/sd/bcm2835_sdhost.c
@@ -113,15 +113,12 @@ static void bcm2835_sdhost_send_command(BCM2835SDHostState *s)
 {
     SDRequest request;
     uint8_t rsp[16];
-    int rlen;
+    size_t rlen;
 
     request.cmd = s->cmd & SDCMD_CMD_MASK;
     request.arg = s->cmdarg;
 
-    rlen = sdbus_do_command(&s->sdbus, &request, rsp);
-    if (rlen < 0) {
-        goto error;
-    }
+    rlen = sdbus_do_command(&s->sdbus, &request, rsp, sizeof(rsp));
     if (!(s->cmd & SDCMD_NO_RESPONSE)) {
         if (rlen == 0 || (rlen == 4 && (s->cmd & SDCMD_LONG_RESPONSE))) {
             goto error;
diff --git a/hw/sd/core.c b/hw/sd/core.c
index 4b30218b52..d3c9017445 100644
--- a/hw/sd/core.c
+++ b/hw/sd/core.c
@@ -90,7 +90,8 @@ void sdbus_set_voltage(SDBus *sdbus, uint16_t millivolts)
     }
 }
 
-int sdbus_do_command(SDBus *sdbus, SDRequest *req, uint8_t *response)
+size_t sdbus_do_command(SDBus *sdbus, SDRequest *req,
+                        uint8_t *resp, size_t respsz)
 {
     SDState *card = get_card(sdbus);
 
@@ -98,7 +99,7 @@ int sdbus_do_command(SDBus *sdbus, SDRequest *req, uint8_t *response)
     if (card) {
         SDCardClass *sc = SDMMC_COMMON_GET_CLASS(card);
 
-        return sc->do_command(card, req, response);
+        return sc->do_command(card, req, resp, respsz);
     }
 
     return 0;
diff --git a/hw/sd/omap_mmc.c b/hw/sd/omap_mmc.c
index b7648d41cc..5a1d25defa 100644
--- a/hw/sd/omap_mmc.c
+++ b/hw/sd/omap_mmc.c
@@ -130,7 +130,8 @@ static void omap_mmc_command(OMAPMMCState *host, int cmd, int dir,
                              sd_rsp_type_t resptype, int init)
 {
     uint32_t rspstatus, mask;
-    int rsplen, timeout;
+    size_t rsplen;
+    int timeout;
     SDRequest request;
     uint8_t response[16];
 
@@ -157,7 +158,7 @@ static void omap_mmc_command(OMAPMMCState *host, int cmd, int dir,
     request.arg = host->arg;
     request.crc = 0; /* FIXME */
 
-    rsplen = sdbus_do_command(&host->sdbus, &request, response);
+    rsplen = sdbus_do_command(&host->sdbus, &request, response, sizeof(response));
 
     /* TODO: validate CRCs */
     switch (resptype) {
diff --git a/hw/sd/pl181.c b/hw/sd/pl181.c
index b8fc9f86f1..5d56ead4d9 100644
--- a/hw/sd/pl181.c
+++ b/hw/sd/pl181.c
@@ -173,14 +173,12 @@ static void pl181_do_command(PL181State *s)
 {
     SDRequest request;
     uint8_t response[16];
-    int rlen;
+    size_t rlen;
 
     request.cmd = s->cmd & PL181_CMD_INDEX;
     request.arg = s->cmdarg;
     trace_pl181_command_send(request.cmd, request.arg);
-    rlen = sdbus_do_command(&s->sdbus, &request, response);
-    if (rlen < 0)
-        goto error;
+    rlen = sdbus_do_command(&s->sdbus, &request, response, sizeof(response));
     if (s->cmd & PL181_CMD_RESPONSE) {
         if (rlen == 0 || (rlen == 4 && (s->cmd & PL181_CMD_LONGRESP)))
             goto error;
diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index 76ce54664f..069107a2e7 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -2166,8 +2166,9 @@ static bool cmd_valid_while_locked(SDState *sd, unsigned cmd)
     return cmd_class == 0 || cmd_class == 7;
 }
 
-static int sd_do_command(SDState *sd, SDRequest *req,
-                         uint8_t *response) {
+static size_t sd_do_command(SDState *sd, SDRequest *req,
+                            uint8_t *response, size_t respsz)
+{
     int last_state;
     sd_rsp_type_t rtype;
     int rsplen;
@@ -2231,6 +2232,7 @@ static int sd_do_command(SDState *sd, SDRequest *req,
 
 send_response:
     rsplen = sd_response_size(sd, rtype);
+    assert(rsplen <= respsz);
 
     switch (rtype) {
     case sd_r1:
diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
index 226ff133ff..3c897e54b7 100644
--- a/hw/sd/sdhci.c
+++ b/hw/sd/sdhci.c
@@ -337,7 +337,7 @@ static void sdhci_send_command(SDHCIState *s)
 {
     SDRequest request;
     uint8_t response[16];
-    int rlen;
+    size_t rlen;
     bool timeout = false;
 
     s->errintsts = 0;
@@ -346,7 +346,7 @@ static void sdhci_send_command(SDHCIState *s)
     request.arg = s->argument;
 
     trace_sdhci_send_command(request.cmd, request.arg);
-    rlen = sdbus_do_command(&s->sdbus, &request, response);
+    rlen = sdbus_do_command(&s->sdbus, &request, response, sizeof(response));
 
     if (s->cmdreg & SDHC_CMD_RESPONSE) {
         if (rlen == 4) {
@@ -400,7 +400,7 @@ static void sdhci_end_transfer(SDHCIState *s)
         request.cmd = 0x0C;
         request.arg = 0;
         trace_sdhci_end_transfer(request.cmd, request.arg);
-        sdbus_do_command(&s->sdbus, &request, response);
+        sdbus_do_command(&s->sdbus, &request, response, sizeof(response));
         /* Auto CMD12 response goes to the upper Response register */
         s->rspreg[3] = ldl_be_p(response);
     }
diff --git a/hw/sd/ssi-sd.c b/hw/sd/ssi-sd.c
index 6c90a86ab4..3025f8f15f 100644
--- a/hw/sd/ssi-sd.c
+++ b/hw/sd/ssi-sd.c
@@ -146,8 +146,9 @@ static uint32_t ssi_sd_transfer(SSIPeripheral *dev, uint32_t val)
             /* manually issue cmd12 to stop the transfer */
             request.cmd = 12;
             request.arg = 0;
-            s->arglen = sdbus_do_command(&s->sdbus, &request, longresp);
-            if (s->arglen <= 0) {
+            s->arglen = sdbus_do_command(&s->sdbus, &request,
+                                         longresp, sizeof(longresp));
+            if (s->arglen == 0) {
                 s->arglen = 1;
                 /* a zero value indicates the card is busy */
                 s->response[0] = 0;
@@ -171,8 +172,9 @@ static uint32_t ssi_sd_transfer(SSIPeripheral *dev, uint32_t val)
             request.cmd = s->cmd;
             request.arg = ldl_be_p(s->cmdarg);
             DPRINTF("CMD%d arg 0x%08x\n", s->cmd, request.arg);
-            s->arglen = sdbus_do_command(&s->sdbus, &request, longresp);
-            if (s->arglen <= 0) {
+            s->arglen = sdbus_do_command(&s->sdbus, &request,
+                                         longresp, sizeof(longresp));
+            if (s->arglen == 0) {
                 s->arglen = 1;
                 s->response[0] = 4;
                 DPRINTF("SD command failed\n");
@@ -333,7 +335,7 @@ static int ssi_sd_post_load(void *opaque, int version_id)
         return -EINVAL;
     }
     if (s->mode == SSI_SD_CMDARG &&
-        (s->arglen < 0 || s->arglen >= ARRAY_SIZE(s->cmdarg))) {
+        (s->arglen >= ARRAY_SIZE(s->cmdarg))) {
         return -EINVAL;
     }
     if (s->mode == SSI_SD_RESPONSE &&
diff --git a/include/hw/sd/sd.h b/include/hw/sd/sd.h
index d6bad17513..55d363f58f 100644
--- a/include/hw/sd/sd.h
+++ b/include/hw/sd/sd.h
@@ -96,7 +96,17 @@ struct SDCardClass {
     DeviceClass parent_class;
     /*< public >*/
 
-    int (*do_command)(SDState *sd, SDRequest *req, uint8_t *response);
+    /**
+     * Process a SD command request.
+     * @sd: card
+     * @req: command request
+     * @resp: buffer to receive the command response
+     * @respsz: size of @resp buffer
+     *
+     * Return: size of the response
+     */
+    size_t (*do_command)(SDState *sd, SDRequest *req,
+                         uint8_t *resp, size_t respsz);
     /**
      * Write a byte to a SD card.
      * @sd: card
@@ -153,7 +163,16 @@ struct SDBusClass {
 void sdbus_set_voltage(SDBus *sdbus, uint16_t millivolts);
 uint8_t sdbus_get_dat_lines(SDBus *sdbus);
 bool sdbus_get_cmd_line(SDBus *sdbus);
-int sdbus_do_command(SDBus *sd, SDRequest *req, uint8_t *response);
+/**
+ * sdbus_do_command: Process a SD command request
+ * @sd: card
+ * @req: command request
+ * @resp: buffer to receive the command response
+ * @respsz: size of @resp buffer
+ *
+ * Return: size of the response
+ */
+size_t sdbus_do_command(SDBus *sd, SDRequest *req, uint8_t *resp, size_t respsz);
 /**
  * Write a byte to a SD bus.
  * @sd: bus

From 1585ab9f1baf6f0b471483455a74ea7abe9add0f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 29 Jul 2025 14:04:43 +0200
Subject: [PATCH 2717/2760] hw/sd/sdcard: Fill SPI response bits in card code
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

ssi-sd.c contains the SPI link layer adaptation,
while sd.c contains all the SD card internal details.

We already handle the response values in sd.c, but
missed the SPI case. Complete them (fill R1, prepend
R1 in R3/R7 and always return something in SPI mode).
Remove all the duplication in ssi-sd.c.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Acked-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250804133406.17456-5-philmd@linaro.org>
---
 hw/sd/sd.c     | 32 ++++++++++++++++---
 hw/sd/ssi-sd.c | 87 ++++----------------------------------------------
 2 files changed, 35 insertions(+), 84 deletions(-)

diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index 069107a2e7..cbcc180f6a 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -734,22 +734,24 @@ static size_t sd_response_size(SDState *sd, sd_rsp_type_t rtype)
     switch (rtype) {
     case sd_r1:
     case sd_r1b:
-        return 4;
+        return sd_is_spi(sd) ? 1 : 4;
 
     case sd_r2_i:
     case sd_r2_s:
+        assert(!sd_is_spi(sd));
         return 16;
 
     case sd_r3:
     case sd_r7:
-        return 4;
+        return sd_is_spi(sd) ? 5 : 4;
 
     case sd_r6:
+        assert(!sd_is_spi(sd));
         return 4;
 
     case sd_r0:
     case sd_illegal:
-        return 0;
+        return sd_is_spi(sd) ? 1 : 0;
 
     default:
         g_assert_not_reached();
@@ -758,7 +760,19 @@ static size_t sd_response_size(SDState *sd, sd_rsp_type_t rtype)
 
 static void sd_response_r1_make(SDState *sd, uint8_t *response)
 {
-    stl_be_p(response, sd->card_status);
+    if (sd_is_spi(sd)) {
+        response[0] = sd->state == sd_idle_state
+                   && !FIELD_EX32(sd->ocr, OCR, CARD_POWER_UP);
+        response[0] |= FIELD_EX32(sd->card_status, CSR, ERASE_RESET) << 1;
+        response[0] |= FIELD_EX32(sd->card_status, CSR, ILLEGAL_COMMAND) << 2;
+        response[0] |= FIELD_EX32(sd->card_status, CSR, COM_CRC_ERROR) << 3;
+        response[0] |= FIELD_EX32(sd->card_status, CSR, ERASE_SEQ_ERROR) << 4;
+        response[0] |= FIELD_EX32(sd->card_status, CSR, ADDRESS_ERROR) << 5;
+        response[0] |= FIELD_EX32(sd->card_status, CSR, BLOCK_LEN_ERROR) << 6;
+        response[0] |= 0 << 7;
+    } else {
+        stl_be_p(response, sd->card_status);
+    }
 
     /* Clear the "clear on read" status bits */
     sd->card_status &= ~CARD_STATUS_C;
@@ -766,6 +780,11 @@ static void sd_response_r1_make(SDState *sd, uint8_t *response)
 
 static void sd_response_r3_make(SDState *sd, uint8_t *response)
 {
+    if (sd_is_spi(sd)) {
+        /* Prepend R1 */
+        sd_response_r1_make(sd, response);
+        response++;
+    }
     stl_be_p(response, sd->ocr & ACMD41_R3_MASK);
 }
 
@@ -783,6 +802,11 @@ static void sd_response_r6_make(SDState *sd, uint8_t *response)
 
 static void sd_response_r7_make(SDState *sd, uint8_t *response)
 {
+    if (sd_is_spi(sd)) {
+        /* Prepend R1 */
+        sd_response_r1_make(sd, response);
+        response++;
+    }
     stl_be_p(response, sd->vhs);
 }
 
diff --git a/hw/sd/ssi-sd.c b/hw/sd/ssi-sd.c
index 3025f8f15f..2d5c0ad501 100644
--- a/hw/sd/ssi-sd.c
+++ b/hw/sd/ssi-sd.c
@@ -70,23 +70,6 @@ struct ssi_sd_state {
 #define TYPE_SSI_SD "ssi-sd"
 OBJECT_DECLARE_SIMPLE_TYPE(ssi_sd_state, SSI_SD)
 
-/* State word bits.  */
-#define SSI_SDR_LOCKED          0x0001
-#define SSI_SDR_WP_ERASE        0x0002
-#define SSI_SDR_ERROR           0x0004
-#define SSI_SDR_CC_ERROR        0x0008
-#define SSI_SDR_ECC_FAILED      0x0010
-#define SSI_SDR_WP_VIOLATION    0x0020
-#define SSI_SDR_ERASE_PARAM     0x0040
-#define SSI_SDR_OUT_OF_RANGE    0x0080
-#define SSI_SDR_IDLE            0x0100
-#define SSI_SDR_ERASE_RESET     0x0200
-#define SSI_SDR_ILLEGAL_COMMAND 0x0400
-#define SSI_SDR_COM_CRC_ERROR   0x0800
-#define SSI_SDR_ERASE_SEQ_ERROR 0x1000
-#define SSI_SDR_ADDRESS_ERROR   0x2000
-#define SSI_SDR_PARAMETER_ERROR 0x4000
-
 /* multiple block write */
 #define SSI_TOKEN_MULTI_WRITE   0xfc
 /* terminate multiple block write */
@@ -104,7 +87,7 @@ static uint32_t ssi_sd_transfer(SSIPeripheral *dev, uint32_t val)
 {
     ssi_sd_state *s = SSI_SD(dev);
     SDRequest request;
-    uint8_t longresp[16];
+    uint8_t longresp[5];
 
     /*
      * Special case: allow CMD12 (STOP TRANSMISSION) while reading data.
@@ -171,74 +154,18 @@ static uint32_t ssi_sd_transfer(SSIPeripheral *dev, uint32_t val)
             /* FIXME: Check CRC.  */
             request.cmd = s->cmd;
             request.arg = ldl_be_p(s->cmdarg);
-            DPRINTF("CMD%d arg 0x%08x\n", s->cmd, request.arg);
             s->arglen = sdbus_do_command(&s->sdbus, &request,
                                          longresp, sizeof(longresp));
-            if (s->arglen == 0) {
-                s->arglen = 1;
-                s->response[0] = 4;
-                DPRINTF("SD command failed\n");
-            } else if (s->cmd == 8 || s->cmd == 58) {
-                /* CMD8/CMD58 returns R3/R7 response */
-                DPRINTF("Returned R3/R7\n");
-                s->arglen = 5;
-                s->response[0] = 1;
-                memcpy(&s->response[1], longresp, 4);
-            } else if (s->arglen != 4) {
-                BADF("Unexpected response to cmd %d\n", s->cmd);
-                /* Illegal command is about as near as we can get.  */
-                s->arglen = 1;
-                s->response[0] = 4;
-            } else {
-                /* All other commands return status.  */
-                uint32_t cardstatus;
-                uint16_t status;
+            DPRINTF("CMD%d arg 0x%08x = %d\n", s->cmd, request.arg, s->arglen);
+            assert(s->arglen > 0);
                 /* CMD13 returns a 2-byte statuse work. Other commands
                    only return the first byte.  */
                 s->arglen = (s->cmd == 13) ? 2 : 1;
+            memcpy(s->response, longresp, s->arglen);
 
-                /* handle R1b */
-                if (s->cmd == 28 || s->cmd == 29 || s->cmd == 38) {
-                    s->stopping = 1;
-                }
-
-                cardstatus = ldl_be_p(longresp);
-                status = 0;
-                if (((cardstatus >> 9) & 0xf) < 4)
-                    status |= SSI_SDR_IDLE;
-                if (cardstatus & ERASE_RESET)
-                    status |= SSI_SDR_ERASE_RESET;
-                if (cardstatus & ILLEGAL_COMMAND)
-                    status |= SSI_SDR_ILLEGAL_COMMAND;
-                if (cardstatus & COM_CRC_ERROR)
-                    status |= SSI_SDR_COM_CRC_ERROR;
-                if (cardstatus & ERASE_SEQ_ERROR)
-                    status |= SSI_SDR_ERASE_SEQ_ERROR;
-                if (cardstatus & ADDRESS_ERROR)
-                    status |= SSI_SDR_ADDRESS_ERROR;
-                if (cardstatus & CARD_IS_LOCKED)
-                    status |= SSI_SDR_LOCKED;
-                if (cardstatus & (LOCK_UNLOCK_FAILED | WP_ERASE_SKIP))
-                    status |= SSI_SDR_WP_ERASE;
-                if (cardstatus & SD_ERROR)
-                    status |= SSI_SDR_ERROR;
-                if (cardstatus & CC_ERROR)
-                    status |= SSI_SDR_CC_ERROR;
-                if (cardstatus & CARD_ECC_FAILED)
-                    status |= SSI_SDR_ECC_FAILED;
-                if (cardstatus & WP_VIOLATION)
-                    status |= SSI_SDR_WP_VIOLATION;
-                if (cardstatus & ERASE_PARAM)
-                    status |= SSI_SDR_ERASE_PARAM;
-                if (cardstatus & (OUT_OF_RANGE | CID_CSD_OVERWRITE))
-                    status |= SSI_SDR_OUT_OF_RANGE;
-                /* ??? Don't know what Parameter Error really means, so
-                   assume it's set if the second byte is nonzero.  */
-                if (status & 0xff)
-                    status |= SSI_SDR_PARAMETER_ERROR;
-                s->response[0] = status >> 8;
-                s->response[1] = status;
-                DPRINTF("Card status 0x%02x\n", status);
+            /* handle R1b (busy signal) */
+            if (s->cmd == 28 || s->cmd == 29 || s->cmd == 38) {
+                s->stopping = 1;
             }
             s->mode = SSI_SD_PREP_RESP;
             s->response_pos = 0;

From 0f2ff994793247c710c79f95302f3e8c10d070de Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 29 Jul 2025 14:05:09 +0200
Subject: [PATCH 2718/2760] hw/sd/sdcard: Implement SPI R2 return value
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In SPI mode, R2 is a 2-byte value.
Implement in spi_response_r2_make() and
return SPI R2 in the SEND_STATUS commands.

Reported-by: Guenter Roeck <linux@roeck-us.net>
Fixes: 775616c3ae8 ("Partial SD card SPI mode support")
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Acked-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250804133406.17456-6-philmd@linaro.org>
---
 hw/sd/sd.c     | 38 +++++++++++++++++++++++++++++++++++---
 hw/sd/ssi-sd.c |  3 ---
 2 files changed, 35 insertions(+), 6 deletions(-)

diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index cbcc180f6a..01ec6d951c 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -61,6 +61,7 @@
 typedef enum {
     sd_r0 = 0,    /* no response */
     sd_r1,        /* normal response command */
+    spi_r2,       /* STATUS */
     sd_r2_i,      /* CID register */
     sd_r2_s,      /* CSD register */
     sd_r3,        /* OCR register */
@@ -247,6 +248,7 @@ static const char *sd_response_name(sd_rsp_type_t rsp)
     static const char *response_name[] = {
         [sd_r0]     = "RESP#0 (no response)",
         [sd_r1]     = "RESP#1 (normal cmd)",
+        [spi_r2]    = "RESP#2 (STATUS reg)",
         [sd_r2_i]   = "RESP#2 (CID reg)",
         [sd_r2_s]   = "RESP#2 (CSD reg)",
         [sd_r3]     = "RESP#3 (OCR reg)",
@@ -736,6 +738,10 @@ static size_t sd_response_size(SDState *sd, sd_rsp_type_t rtype)
     case sd_r1b:
         return sd_is_spi(sd) ? 1 : 4;
 
+    case spi_r2:
+        assert(sd_is_spi(sd));
+        return 2;
+
     case sd_r2_i:
     case sd_r2_s:
         assert(!sd_is_spi(sd));
@@ -778,6 +784,22 @@ static void sd_response_r1_make(SDState *sd, uint8_t *response)
     sd->card_status &= ~CARD_STATUS_C;
 }
 
+static void spi_response_r2_make(SDState *sd, uint8_t *resp)
+{
+    /* Prepend R1 */
+    sd_response_r1_make(sd, resp);
+
+    resp[1]  = FIELD_EX32(sd->card_status, CSR, CARD_IS_LOCKED) << 0;
+    resp[1] |= (FIELD_EX32(sd->card_status, CSR, LOCK_UNLOCK_FAILED)
+                || FIELD_EX32(sd->card_status, CSR, WP_ERASE_SKIP)) << 1;
+    resp[1] |= FIELD_EX32(sd->card_status, CSR, ERROR) << 2;
+    resp[1] |= FIELD_EX32(sd->card_status, CSR, CC_ERROR) << 3;
+    resp[1] |= FIELD_EX32(sd->card_status, CSR, CARD_ECC_FAILED) << 4;
+    resp[1] |= FIELD_EX32(sd->card_status, CSR, WP_VIOLATION) << 5;
+    resp[1] |= FIELD_EX32(sd->card_status, CSR, ERASE_PARAM) << 6;
+    resp[1] |= FIELD_EX32(sd->card_status, CSR, OUT_OF_RANGE) << 7;
+}
+
 static void sd_response_r3_make(SDState *sd, uint8_t *response)
 {
     if (sd_is_spi(sd)) {
@@ -1643,7 +1665,7 @@ static sd_rsp_type_t sd_cmd_SEND_STATUS(SDState *sd, SDRequest req)
     }
 
     if (sd_is_spi(sd)) {
-        return sd_r2_s;
+        return spi_r2;
     }
 
     return sd_req_rca_same(sd, req) ? sd_r1 : sd_r0;
@@ -1957,8 +1979,14 @@ static sd_rsp_type_t sd_acmd_SET_BUS_WIDTH(SDState *sd, SDRequest req)
 /* ACMD13 */
 static sd_rsp_type_t sd_acmd_SD_STATUS(SDState *sd, SDRequest req)
 {
-    return sd_cmd_to_sendingdata(sd, req, 0,
-                                 sd->sd_status, sizeof(sd->sd_status));
+    sd_rsp_type_t rsp;
+
+    rsp = sd_cmd_to_sendingdata(sd, req, 0,
+                                sd->sd_status, sizeof(sd->sd_status));
+    if (sd_is_spi(sd) && rsp != sd_illegal) {
+        return spi_r2;
+    }
+    return rsp;
 }
 
 /* ACMD22 */
@@ -2264,6 +2292,10 @@ send_response:
         sd_response_r1_make(sd, response);
         break;
 
+    case spi_r2:
+        spi_response_r2_make(sd, response);
+        break;
+
     case sd_r2_i:
         memcpy(response, sd->cid, sizeof(sd->cid));
         break;
diff --git a/hw/sd/ssi-sd.c b/hw/sd/ssi-sd.c
index 2d5c0ad501..594dead19e 100644
--- a/hw/sd/ssi-sd.c
+++ b/hw/sd/ssi-sd.c
@@ -158,9 +158,6 @@ static uint32_t ssi_sd_transfer(SSIPeripheral *dev, uint32_t val)
                                          longresp, sizeof(longresp));
             DPRINTF("CMD%d arg 0x%08x = %d\n", s->cmd, request.arg, s->arglen);
             assert(s->arglen > 0);
-                /* CMD13 returns a 2-byte statuse work. Other commands
-                   only return the first byte.  */
-                s->arglen = (s->cmd == 13) ? 2 : 1;
             memcpy(s->response, longresp, s->arglen);
 
             /* handle R1b (busy signal) */

From 3241a61a1374b4d9b0e835fb3fa5b4085377eebb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 30 Jul 2025 17:35:06 +0200
Subject: [PATCH 2719/2760] hw/sd/sdcard: Use complete SEND_OP_COND
 implementation in SPI mode
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

While spi_cmd_SEND_OP_COND() is incomplete, sd_cmd_SEND_OP_COND()
is, except it doesn't return the correct value in SPI mode.
Correct and use, removing the need for spi_cmd_SEND_OP_COND().

Fixes: 775616c3ae8 ("Partial SD card SPI mode support")
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Acked-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250804133406.17456-7-philmd@linaro.org>
---
 hw/sd/sd.c | 15 +++++----------
 1 file changed, 5 insertions(+), 10 deletions(-)

diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index 01ec6d951c..df2a272c6a 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -1414,14 +1414,6 @@ static sd_rsp_type_t sd_cmd_GO_IDLE_STATE(SDState *sd, SDRequest req)
     return sd_is_spi(sd) ? sd_r1 : sd_r0;
 }
 
-/* CMD1 */
-static sd_rsp_type_t spi_cmd_SEND_OP_COND(SDState *sd, SDRequest req)
-{
-    sd->state = sd_transfer_state;
-
-    return sd_r1;
-}
-
 /* CMD2 */
 static sd_rsp_type_t sd_cmd_ALL_SEND_CID(SDState *sd, SDRequest req)
 {
@@ -2046,6 +2038,9 @@ static sd_rsp_type_t sd_cmd_SEND_OP_COND(SDState *sd, SDRequest req)
         sd->state = sd_ready_state;
     }
 
+    if (sd_is_spi(sd)) {
+        return sd_r1;
+    }
     return sd_r3;
 }
 
@@ -2590,7 +2585,7 @@ static const SDProto sd_proto_spi = {
     .name = "SPI",
     .cmd = {
         [0]  = {0,  sd_spi, "GO_IDLE_STATE", sd_cmd_GO_IDLE_STATE},
-        [1]  = {0,  sd_spi, "SEND_OP_COND", spi_cmd_SEND_OP_COND},
+        [1]  = {0,  sd_spi, "SEND_OP_COND", sd_cmd_SEND_OP_COND},
         [5]  = {9,  sd_spi, "IO_SEND_OP_COND", sd_cmd_optional},
         [6]  = {10, sd_spi, "SWITCH_FUNCTION", sd_cmd_SWITCH_FUNCTION},
         [8]  = {0,  sd_spi, "SEND_IF_COND", sd_cmd_SEND_IF_COND},
@@ -2626,7 +2621,7 @@ static const SDProto sd_proto_spi = {
         [13] = {8,  sd_spi, "SD_STATUS", sd_acmd_SD_STATUS},
         [22] = {8,  sd_spi, "SEND_NUM_WR_BLOCKS", sd_acmd_SEND_NUM_WR_BLOCKS},
         [23] = {8,  sd_spi, "SET_WR_BLK_ERASE_COUNT", sd_acmd_SET_WR_BLK_ERASE_COUNT},
-        [41] = {8,  sd_spi, "SEND_OP_COND", spi_cmd_SEND_OP_COND},
+        [41] = {8,  sd_spi, "SEND_OP_COND", sd_cmd_SEND_OP_COND},
         [42] = {8,  sd_spi, "SET_CLR_CARD_DETECT", sd_acmd_SET_CLR_CARD_DETECT},
         [51] = {8,  sd_spi, "SEND_SCR", sd_acmd_SEND_SCR},
     },

From 3c7bde41a37546a49e10adafc54e9201ac087585 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 31 Jul 2025 11:17:52 +0200
Subject: [PATCH 2720/2760] hw/sd/sdcard: Allow using SWITCH_FUNCTION in more
 SPI states
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In SPI mode, SWITCH_FUNCTION is valid in all mode
(except the IDLE one).

Fixes: 775616c3ae8 ("Partial SD card SPI mode support")
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Acked-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250804133406.17456-8-philmd@linaro.org>
---
 hw/sd/sd.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index df2a272c6a..a9efa15859 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -1488,8 +1488,14 @@ static sd_rsp_type_t sd_cmd_SWITCH_FUNCTION(SDState *sd, SDRequest req)
     if (sd->mode != sd_data_transfer_mode) {
         return sd_invalid_mode_for_cmd(sd, req);
     }
-    if (sd->state != sd_transfer_state) {
-        return sd_invalid_state_for_cmd(sd, req);
+    if (sd_is_spi(sd)) {
+        if (sd->state == sd_idle_state) {
+            return sd_invalid_state_for_cmd(sd, req);
+        }
+    } else {
+        if (sd->state != sd_transfer_state) {
+            return sd_invalid_state_for_cmd(sd, req);
+        }
     }
 
     sd_function_switch(sd, req.arg);

From 7574baef43f0d1bd6982be7d5087af3bca2a7a4f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 31 Jul 2025 15:38:18 +0200
Subject: [PATCH 2721/2760] hw/sd/sdcard: Factor spi_cmd_SEND_CxD() out
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

spi_cmd_SEND_CSD() and spi_cmd_SEND_CID() are very
similar. Factor the common code as spi_cmd_SEND_CxD().

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Acked-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250804133406.17456-9-philmd@linaro.org>
---
 hw/sd/sd.c | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index a9efa15859..ee81dc0999 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -1588,14 +1588,19 @@ static sd_rsp_type_t emmc_cmd_SEND_EXT_CSD(SDState *sd, SDRequest req)
                                  sd->ext_csd, sizeof(sd->ext_csd));
 }
 
-/* CMD9 */
-static sd_rsp_type_t spi_cmd_SEND_CSD(SDState *sd, SDRequest req)
+static sd_rsp_type_t spi_cmd_SEND_CxD(SDState *sd, SDRequest req,
+                                      const void *data, size_t size)
 {
     if (sd->state != sd_standby_state) {
         return sd_invalid_state_for_cmd(sd, req);
     }
-    return sd_cmd_to_sendingdata(sd, req, sd_req_get_address(sd, req),
-                                 sd->csd, 16);
+    return sd_cmd_to_sendingdata(sd, req, 0, data, size);
+}
+
+/* CMD9 */
+static sd_rsp_type_t spi_cmd_SEND_CSD(SDState *sd, SDRequest req)
+{
+    return spi_cmd_SEND_CxD(sd, req, sd->csd, sizeof(sd->csd));
 }
 
 static sd_rsp_type_t sd_cmd_SEND_CSD(SDState *sd, SDRequest req)
@@ -1610,11 +1615,7 @@ static sd_rsp_type_t sd_cmd_SEND_CSD(SDState *sd, SDRequest req)
 /* CMD10 */
 static sd_rsp_type_t spi_cmd_SEND_CID(SDState *sd, SDRequest req)
 {
-    if (sd->state != sd_standby_state) {
-        return sd_invalid_state_for_cmd(sd, req);
-    }
-    return sd_cmd_to_sendingdata(sd, req, sd_req_get_address(sd, req),
-                                 sd->cid, 16);
+    return spi_cmd_SEND_CxD(sd, req, sd->cid, sizeof(sd->cid));
 }
 
 static sd_rsp_type_t sd_cmd_SEND_CID(SDState *sd, SDRequest req)

From 823d9b00452b62dcee1b0692c578c6fa5eef517e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 31 Jul 2025 15:58:31 +0200
Subject: [PATCH 2722/2760] hw/sd/sdcard: Disable checking STBY mode in SPI
 SEND_CSD/CID
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The card should be in STANDBY mode to process SEND_CSD or SEND_CID,
but is still in IDLE mode.

Unfortunately I don't have enough time to keep debugging this issue,
so disable the check for the time being and the next release, as it
blocks Linux. I'll keep looking.

Reported-by: Guenter Roeck <linux@roeck-us.net>
Reported-by: Ben Dooks <ben.dooks@codethink.co.uk>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Acked-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250804133406.17456-10-philmd@linaro.org>
---
 hw/sd/sd.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index ee81dc0999..22f3099771 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -1591,9 +1591,20 @@ static sd_rsp_type_t emmc_cmd_SEND_EXT_CSD(SDState *sd, SDRequest req)
 static sd_rsp_type_t spi_cmd_SEND_CxD(SDState *sd, SDRequest req,
                                       const void *data, size_t size)
 {
+    /*
+     * XXX as of v10.1.0-rc1 command is reached in sd_idle_state,
+     * so disable this check.
     if (sd->state != sd_standby_state) {
         return sd_invalid_state_for_cmd(sd, req);
     }
+    */
+
+    /*
+     * Since SPI returns CSD and CID on the DAT lines,
+     * switch to sd_transfer_state.
+     */
+    sd->state = sd_transfer_state;
+
     return sd_cmd_to_sendingdata(sd, req, 0, data, size);
 }
 

From 40b242884ed7aeb30613dd42eca6e8712d607c46 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 31 Jul 2025 11:44:28 +0200
Subject: [PATCH 2723/2760] hw/sd/sdcard: Remove SDState::mode field
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

SD card mode is a superset of its state (SDState::state),
no need to migrate it.

Use sd_mode() to get the SDCardModes from the SDCardStates.

Fixes: 50a5be6c3d5 ("hw/sd.c: add SD card save/load support")
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Acked-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250804133406.17456-11-philmd@linaro.org>
---
 hw/sd/sd.c         | 35 +++++++++++++++++------------------
 hw/sd/trace-events |  4 ++--
 2 files changed, 19 insertions(+), 20 deletions(-)

diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index 22f3099771..8c290595f0 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -147,7 +147,6 @@ struct SDState {
 
     /* Runtime changeables */
 
-    uint32_t mode;    /* current card mode, one of SDCardModes */
     int32_t state;    /* current card state, one of SDCardStates */
     uint32_t vhs;
     bool wp_switch;
@@ -315,27 +314,24 @@ static void sd_set_voltage(SDState *sd, uint16_t millivolts)
     }
 }
 
-static void sd_set_mode(SDState *sd)
+static enum SDCardModes sd_mode(SDState *sd)
 {
     switch (sd->state) {
     case sd_inactive_state:
-        sd->mode = sd_inactive;
-        break;
-
+        return sd_inactive;
     case sd_idle_state:
     case sd_ready_state:
     case sd_identification_state:
-        sd->mode = sd_card_identification_mode;
-        break;
-
+        return sd_card_identification_mode;
     case sd_standby_state:
     case sd_transfer_state:
     case sd_sendingdata_state:
     case sd_receivingdata_state:
     case sd_programming_state:
     case sd_disconnect_state:
-        sd->mode = sd_data_transfer_mode;
-        break;
+        return sd_data_transfer_mode;
+    default:
+        g_assert_not_reached();
     }
 }
 
@@ -1025,7 +1021,7 @@ static const VMStateDescription sd_vmstate = {
     .minimum_version_id = 2,
     .pre_load = sd_vmstate_pre_load,
     .fields = (const VMStateField[]) {
-        VMSTATE_UINT32(mode, SDState),
+        VMSTATE_UNUSED(4),
         VMSTATE_INT32(state, SDState),
         VMSTATE_UINT8_ARRAY(cid, SDState, 16),
         VMSTATE_UINT8_ARRAY(csd, SDState, 16),
@@ -1325,7 +1321,7 @@ static sd_rsp_type_t sd_invalid_state_for_cmd(SDState *sd, SDRequest req)
 static sd_rsp_type_t sd_invalid_mode_for_cmd(SDState *sd, SDRequest req)
 {
     qemu_log_mask(LOG_GUEST_ERROR, "%s: CMD%i in a wrong mode: %s (spec %s)\n",
-                  sd->proto->name, req.cmd, sd_mode_name(sd->mode),
+                  sd->proto->name, req.cmd, sd_mode_name(sd_mode(sd)),
                   sd_version_str(sd->spec_version));
 
     return sd_illegal;
@@ -1485,7 +1481,7 @@ static sd_rsp_type_t emmc_cmd_sleep_awake(SDState *sd, SDRequest req)
 /* CMD6 */
 static sd_rsp_type_t sd_cmd_SWITCH_FUNCTION(SDState *sd, SDRequest req)
 {
-    if (sd->mode != sd_data_transfer_mode) {
+    if (sd_mode(sd) != sd_data_transfer_mode) {
         return sd_invalid_mode_for_cmd(sd, req);
     }
     if (sd_is_spi(sd)) {
@@ -1658,7 +1654,7 @@ static sd_rsp_type_t sd_cmd_STOP_TRANSMISSION(SDState *sd, SDRequest req)
 /* CMD13 */
 static sd_rsp_type_t sd_cmd_SEND_STATUS(SDState *sd, SDRequest req)
 {
-    if (sd->mode != sd_data_transfer_mode) {
+    if (sd_mode(sd) != sd_data_transfer_mode) {
         return sd_invalid_mode_for_cmd(sd, req);
     }
 
@@ -1684,7 +1680,7 @@ static sd_rsp_type_t sd_cmd_SEND_STATUS(SDState *sd, SDRequest req)
 /* CMD15 */
 static sd_rsp_type_t sd_cmd_GO_INACTIVE_STATE(SDState *sd, SDRequest req)
 {
-    if (sd->mode != sd_data_transfer_mode) {
+    if (sd_mode(sd) != sd_data_transfer_mode) {
         return sd_invalid_mode_for_cmd(sd, req);
     }
     switch (sd->state) {
@@ -2090,7 +2086,9 @@ static sd_rsp_type_t sd_normal_command(SDState *sd, SDRequest req)
     if (req.cmd != 55 || sd->expecting_acmd) {
         trace_sdcard_normal_command(sd->proto->name,
                                     sd->last_cmd_name, req.cmd,
-                                    req.arg, sd_state_name(sd->state));
+                                    req.arg,
+                                    sd_mode_name(sd_mode(sd)),
+                                    sd_state_name(sd->state));
     }
 
     /* Not interpreting this as an app command */
@@ -2176,7 +2174,9 @@ static sd_rsp_type_t sd_app_command(SDState *sd,
 {
     sd->last_cmd_name = sd_acmd_name(sd, req.cmd);
     trace_sdcard_app_command(sd->proto->name, sd->last_cmd_name,
-                             req.cmd, req.arg, sd_state_name(sd->state));
+                             req.cmd, req.arg,
+                             sd_mode_name(sd_mode(sd)),
+                             sd_state_name(sd->state));
     sd->card_status |= APP_CMD;
 
     if (sd->proto->acmd[req.cmd].handler) {
@@ -2276,7 +2276,6 @@ static size_t sd_do_command(SDState *sd, SDRequest *req,
     }
 
     last_state = sd->state;
-    sd_set_mode(sd);
 
     if (sd->expecting_acmd) {
         sd->expecting_acmd = false;
diff --git a/hw/sd/trace-events b/hw/sd/trace-events
index db0644256d..8d49840917 100644
--- a/hw/sd/trace-events
+++ b/hw/sd/trace-events
@@ -37,8 +37,8 @@ sdhci_write_dataport(uint16_t data_count) "write buffer filled with %u bytes of
 sdhci_capareg(const char *desc, uint16_t val) "%s: %u"
 
 # sd.c
-sdcard_normal_command(const char *proto, const char *cmd_desc, uint8_t cmd, uint32_t arg, const char *state) "%s %20s/ CMD%02d arg 0x%08x (state %s)"
-sdcard_app_command(const char *proto, const char *acmd_desc, uint8_t acmd, uint32_t arg, const char *state) "%s %23s/ACMD%02d arg 0x%08x (state %s)"
+sdcard_normal_command(const char *proto, const char *cmd_desc, uint8_t cmd, uint32_t arg, const char *mode, const char *state) "%s %20s/ CMD%02d arg 0x%08x (mode %s, state %s)"
+sdcard_app_command(const char *proto, const char *acmd_desc, uint8_t acmd, uint32_t arg, const char *mode, const char *state) "%s %23s/ACMD%02d arg 0x%08x (mode %s, state %s)"
 sdcard_response(const char *rspdesc, int rsplen) "%s (sz:%d)"
 sdcard_powerup(void) ""
 sdcard_inquiry_cmd41(void) ""

From 90fd1591314781e7da8560e4008f411aba501b4a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 30 Jul 2025 17:10:24 +0200
Subject: [PATCH 2724/2760] tests/functional: Test SD cards in SPI mode (using
 sifive_u machine)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add a test which uses the sifive_u machine to boot a Linux
kernel from a SD card connected via a SPI interface.

Inspired from the command provided in:
- https://lore.kernel.org/qemu-devel/94b2c5bf-53d0-4c74-8264-f3021916f38c@roeck-us.net/
- https://lore.kernel.org/qemu-devel/840016d0-0d49-4ef4-8372-b62b3bcd0ac6@codethink.co.uk/

Inspired-by: Guenter Roeck <linux@roeck-us.net>
Inspired-by: Ben Dooks <ben.dooks@codethink.co.uk>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Acked-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250804133406.17456-12-philmd@linaro.org>
---
 MAINTAINERS                               |  1 +
 tests/functional/meson.build              |  1 +
 tests/functional/test_riscv64_sifive_u.py | 51 +++++++++++++++++++++++
 3 files changed, 53 insertions(+)
 create mode 100755 tests/functional/test_riscv64_sifive_u.py

diff --git a/MAINTAINERS b/MAINTAINERS
index 28cea34271..a07086ed76 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1695,6 +1695,7 @@ S: Supported
 F: docs/system/riscv/sifive_u.rst
 F: hw/*/*sifive*.c
 F: include/hw/*/*sifive*.h
+F: tests/functional/test_riscv64_sifive_u.py
 
 AMD Microblaze-V Generic Board
 M: Sai Pavan Boddu <sai.pavan.boddu@amd.com>
diff --git a/tests/functional/meson.build b/tests/functional/meson.build
index ecf965adc6..311c6f1806 100644
--- a/tests/functional/meson.build
+++ b/tests/functional/meson.build
@@ -274,6 +274,7 @@ tests_riscv64_system_quick = [
 ]
 
 tests_riscv64_system_thorough = [
+  'riscv64_sifive_u',
   'riscv64_tuxrun',
 ]
 
diff --git a/tests/functional/test_riscv64_sifive_u.py b/tests/functional/test_riscv64_sifive_u.py
new file mode 100755
index 0000000000..dc4cb8a4a9
--- /dev/null
+++ b/tests/functional/test_riscv64_sifive_u.py
@@ -0,0 +1,51 @@
+#!/usr/bin/env python3
+#
+# Functional test that boots a Linux kernel on a Sifive U machine
+# and checks the console
+#
+# Copyright (c) Linaro Ltd.
+#
+# Author:
+#  Philippe Mathieu-Daudé
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+import os
+
+from qemu_test import Asset, LinuxKernelTest
+from qemu_test import skipIfMissingCommands
+
+
+class SifiveU(LinuxKernelTest):
+
+    ASSET_KERNEL = Asset(
+        'https://storage.tuxboot.com/buildroot/20241119/riscv64/Image',
+        '2bd8132a3bf21570290042324fff48c987f42f2a00c08de979f43f0662ebadba')
+    ASSET_ROOTFS = Asset(
+        ('https://github.com/groeck/linux-build-test/raw/'
+         '9819da19e6eef291686fdd7b029ea00e764dc62f/rootfs/riscv64/'
+         'rootfs.ext2.gz'),
+        'b6ed95610310b7956f9bf20c4c9c0c05fea647900df441da9dfe767d24e8b28b')
+
+    def test_riscv64_sifive_u_mmc_spi(self):
+        self.set_machine('sifive_u')
+        kernel_path = self.ASSET_KERNEL.fetch()
+        rootfs_path = self.uncompress(self.ASSET_ROOTFS)
+
+        self.vm.set_console()
+        kernel_command_line = (self.KERNEL_COMMON_COMMAND_LINE +
+                               'root=/dev/mmcblk0 rootwait '
+                               'earlycon=sbi console=ttySIF0 '
+                               'panic=-1 noreboot')
+        self.vm.add_args('-kernel', kernel_path,
+                         '-drive', f'file={rootfs_path},if=sd,format=raw',
+                         '-append', kernel_command_line,
+                         '-no-reboot')
+        self.vm.launch()
+        self.wait_for_console_pattern('Boot successful.')
+
+        os.remove(rootfs_path)
+
+
+if __name__ == '__main__':
+    LinuxKernelTest.main()

From 4e5d58969ed6927a7f1b08ba6223c34c8b990c92 Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Mon, 4 Aug 2025 13:35:48 +0800
Subject: [PATCH 2725/2760] target/i386/cpu: Move addressable ID encoding out
 of compat property in CPUID[0x1]
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Currently, the addressable ID encoding for CPUID[0x1].EBX[bits 16-23]
(Maximum number of addressable IDs for logical processors in this
physical package) is covered by vendor_cpuid_only_v2 compat property.
The previous consideration was to avoid breaking migration and this
compat property makes it unfriendly to backport the commit f985a1195ba2
("i386/cpu: Fix number of addressable IDs field for CPUID.01H.EBX
[23:16]").

However, NetBSD booting is broken since the commit 88dd4ca06c83
("i386/cpu: Use APIC ID info to encode cache topo in CPUID[4]"),
because NetBSD calculates smt information via `lp_max` / `core_max` for
legacy Intel CPUs which doesn't support 0xb leaf, where `lp_max` is from
CPUID[0x1].EBX.bits[16-23] and `core_max` is from CPUID[0x4].0x0.bits[26
-31].

The commit 88dd4ca0 changed the encoding rule of `core_max` but didn't
update `lp_max`, so that NetBSD would get the wrong smt information,
which leads to the module loading failure.

Luckily, the commit f985a1195ba2 ("i386/cpu: Fix number of addressable
IDs field for CPUID.01H.EBX[23:16]") updated the encoding rule for
`lp_max` and accidentally fixed the NetBSD issue too. This also shows
that using CPUID[0x1] and CPUID[0x4].0x0 to calculate HT/SMT information
is a common practice to detect CPU topology on legacy Intel CPUs.

Therefore, it's necessary to backport the commit f985a1195ba2 to
previous stable QEMU to help address the similar issues as well. Then
the compat property is not needed any more since all stable QEMUs will
follow the same encoding way.

So, in CPUID[0x1], move addressable ID encoding out of compat property.

Reported-by: Michael Tokarev <mjt@tls.msk.ru>
Inspired-by: Chuang Xu <xuchuangxclwt@bytedance.com>
Fixes: commit f985a1195ba2 ("i386/cpu: Fix number of addressable IDs field for CPUID.01H.EBX[23:16]")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3061
Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Tested-by: Michael Tokarev <mjt@tls.msk.ru>
Message-ID: <20250804053548.1808629-1-zhao1.liu@intel.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/i386/cpu.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 251d5760a0..673f8583c8 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -7885,8 +7885,7 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
              * count, but Intel needs maximum number of addressable IDs for
              * logical processors per package.
              */
-            if (cpu->vendor_cpuid_only_v2 &&
-                (IS_INTEL_CPU(env) || IS_ZHAOXIN_CPU(env))) {
+            if ((IS_INTEL_CPU(env) || IS_ZHAOXIN_CPU(env))) {
                 num = 1 << apicid_pkg_offset(topo_info);
             } else {
                 num = threads_per_pkg;

From eb013cd6a11951a8d76e737e9f6e89c96b059b48 Mon Sep 17 00:00:00 2001
From: Eric Auger <eric.auger@redhat.com>
Date: Mon, 4 Aug 2025 17:20:07 +0200
Subject: [PATCH 2726/2760] hw/i386/microvm: Explicitly select ACPI_PCI
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

With a microvm-only build based on a custom device config,
we get a link failure due to undefined reference to
build_pci_host_bridge_osc_method() which is defined in hw/acpi/pci.c and
whose compilation depends on CONFIG_ACPI_PCI. Although CONFIG_ACPI
and CONFIG_PCI are set with such configuration, implied CONFIG_ACPI_PCI
in config PCI_EXPRESS_GENERIC_BRIDGE is not selected as expected.

It Looks like CONFIG_ACPI_PCI must be enforced and this patch selects
CONFIG_ACPI_PCI in MICROVM config directly as done for PC config.

Reproducer:

../configure \
 --without-default-features \
 --target-list=x86_64-softmmu \
 --enable-kvm --disable-tcg \
 --enable-pixman \
 --enable-vnc \
 --audio-drv-list="" \
 --without-default-devices \
 --with-devices-x86_64=microvm \
 --enable-vhost-user

with configs/devices/x86_64-softmmu/microvm.mak:
CONFIG_PCI_DEVICES=n

CONFIG_MICROVM=y

CONFIG_VIRTIO_BLK=y
CONFIG_VIRTIO_SERIAL=y
CONFIG_VIRTIO_INPUT=y
CONFIG_VIRTIO_INPUT_HOST=y
CONFIG_VHOST_USER_INPUT=y
CONFIG_VIRTIO_NET=y
CONFIG_VIRTIO_SCSI=y
CONFIG_VIRTIO_RNG=y
CONFIG_VIRTIO_CRYPTO=y
CONFIG_VIRTIO_BALLOON=y
CONFIG_VIRTIO_GPU=y
CONFIG_VHOST_USER_GPU=y

FAILED: qemu-system-x86_64
cc -m64 @qemu-system-x86_64.rsp
/usr/bin/ld: libsystem.a.p/hw_pci-host_gpex-acpi.c.o: in function `acpi_dsdt_add_host_bridge_methods':
hw/pci-host/gpex-acpi.c:83:(.text+0x274): undefined reference to `build_pci_host_bridge_osc_method'
collect2: error: ld returned 1 exit status

Fixes: af151d50eac24 "hw/pci-host/gpex-acpi: Use build_pci_host_bridge_osc_method"
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reported-by: Michael Tokarev <mjt@tls.msk.ru>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Message-ID: <20250804152008.247673-1-eric.auger@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/i386/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/i386/Kconfig b/hw/i386/Kconfig
index 5139d23087..3a0e2b8ebb 100644
--- a/hw/i386/Kconfig
+++ b/hw/i386/Kconfig
@@ -131,6 +131,7 @@ config MICROVM
     select I8259
     select MC146818RTC
     select VIRTIO_MMIO
+    select ACPI_PCI
     select ACPI_HW_REDUCED
     select PCI_EXPRESS_GENERIC_BRIDGE
     select USB_XHCI_SYSBUS

From b217d987a3c5c6e2473956723b396bc1ff0f5b2b Mon Sep 17 00:00:00 2001
From: Michael Tokarev <mjt@tls.msk.ru>
Date: Fri, 1 Aug 2025 14:53:14 +0300
Subject: [PATCH 2727/2760] qga: correctly write to /sys/power/state on linux

Commit v9.0.0-343-g2048129625 introduced usage of
g_file_set_contents() function to write to /sys/power/state.
This function uses G_FILE_SET_CONTENTS_CONSISTENT flag to
g_file_set_contents_full(), which is implemented by creating
a temp file in the same directory and renaming it to the final
destination.  Which is not how sysfs works.

Here, there's not a big deal to do open/write/close - it becomes
almost the same as using g_file_set_contents[_full]().  But it
does not have surprises like this.

Also, since this is linux code, it should be ok to use %m in
the error reporting function.

Fixes: 2048129625 "qga/commands-posix: don't do fork()/exec() when suspending via sysfs"
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3057
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-ID: <20250801115316.6845-1-mjt@tls.msk.ru>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 qga/commands-linux.c | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/qga/commands-linux.c b/qga/commands-linux.c
index 9e8a934b9a..9dc0c82503 100644
--- a/qga/commands-linux.c
+++ b/qga/commands-linux.c
@@ -1400,20 +1400,22 @@ static bool linux_sys_state_supports_mode(SuspendMode mode, Error **errp)
 
 static void linux_sys_state_suspend(SuspendMode mode, Error **errp)
 {
-    g_autoptr(GError) local_gerr = NULL;
     const char *sysfile_strs[3] = {"disk", "mem", NULL};
     const char *sysfile_str = sysfile_strs[mode];
+    int fd;
 
     if (!sysfile_str) {
         error_setg(errp, "unknown guest suspend mode");
         return;
     }
 
-    if (!g_file_set_contents(LINUX_SYS_STATE_FILE, sysfile_str,
-                             -1, &local_gerr)) {
-        error_setg(errp, "suspend: cannot write to '%s': %s",
-                   LINUX_SYS_STATE_FILE, local_gerr->message);
-        return;
+    fd = open(LINUX_SYS_STATE_FILE, O_WRONLY);
+    if (fd < 0 || write(fd, sysfile_str, strlen(sysfile_str)) < 0) {
+        error_setg(errp, "suspend: cannot write to '%s': %m",
+                   LINUX_SYS_STATE_FILE);
+    }
+    if (fd >= 0) {
+        close(fd);
     }
 }
 

From afeb002e0ad49dcf388dedbc6995f6561885e376 Mon Sep 17 00:00:00 2001
From: Michael Tokarev <mjt@tls.msk.ru>
Date: Tue, 5 Aug 2025 21:17:30 +0300
Subject: [PATCH 2728/2760] tests/qemu-iotests/tests/mirror-sparse: skip if
 O_DIRECT is not supported

This test uses cache.direct=true, but does not check if O_DIRECT
is supported by the underlying filesystem, and fails, for example,
on a tmpfs (which is rather common on various auto-builders, in CI,
etc).

Fix this by using `_supported_cache_modes none directsync`.

Fixes: c0ddcb2cbc146e "tests: Add iotest mirror-sparse for recent patches"
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-ID: <20250805181731.282677-1-mjt@tls.msk.ru>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 tests/qemu-iotests/tests/mirror-sparse | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tests/qemu-iotests/tests/mirror-sparse b/tests/qemu-iotests/tests/mirror-sparse
index cfcaa600ab..3b183eea88 100755
--- a/tests/qemu-iotests/tests/mirror-sparse
+++ b/tests/qemu-iotests/tests/mirror-sparse
@@ -40,6 +40,7 @@ cd ..
 _supported_fmt qcow2 raw  # Format of the source. dst is always raw file
 _supported_proto file
 _supported_os Linux
+_supported_cache_modes none directsync
 _require_disk_usage
 
 echo

From e0006a86615baa70bc9d8b183e528aed91c1ac90 Mon Sep 17 00:00:00 2001
From: Stefan Hajnoczi <stefanha@redhat.com>
Date: Tue, 5 Aug 2025 15:05:57 -0400
Subject: [PATCH 2729/2760] Update version for the v10.1.0-rc2 release

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 VERSION | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/VERSION b/VERSION
index 8ae905b0dd..c08f99e23e 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-10.0.91
+10.0.92

From a04ba043a3b03b49466b8ba95290e0507f268069 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 5 Aug 2025 19:24:31 +0100
Subject: [PATCH 2730/2760] meson: remove 'gnutls-bug1717-workaround' for
 migration TLS crashes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The implementation of this workaround does not currently work, so
remove the option entirely to avoid exposing it to users. The code
will remain (temporarily dormant) to be fixed in the next release
cycle.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/qemu-devel/20250805182431.504158-1-berrange@redhat.com
Signed-off-by: Fabiano Rosas <farosas@suse.de>
---
 meson.build                   | 6 +++---
 meson_options.txt             | 2 --
 scripts/meson-buildoptions.sh | 5 -----
 3 files changed, 3 insertions(+), 10 deletions(-)

diff --git a/meson.build b/meson.build
index e53cd5b413..a7b3c683ce 100644
--- a/meson.build
+++ b/meson.build
@@ -1836,11 +1836,11 @@ if get_option('gnutls').enabled() or (get_option('gnutls').auto() and have_syste
                         required: get_option('gnutls'))
   endif
 
-  if gnutls.found() and not get_option('gnutls-bug1717-workaround').disabled()
+  #if gnutls.found() and not get_option('gnutls-bug1717-workaround').disabled()
     # XXX: when bug 1717 is resolved, add logic to probe for
     # the GNUTLS fixed version number to handle the 'auto' case
-    gnutls_bug1717_workaround = true
-  endif
+  #  gnutls_bug1717_workaround = true
+  #endif
 endif
 
 # We prefer use of gnutls for crypto, unless the options
diff --git a/meson_options.txt b/meson_options.txt
index dd33530750..fff1521e58 100644
--- a/meson_options.txt
+++ b/meson_options.txt
@@ -174,8 +174,6 @@ option('libcbor', type : 'feature', value : 'auto',
        description: 'libcbor support')
 option('gnutls', type : 'feature', value : 'auto',
        description: 'GNUTLS cryptography support')
-option('gnutls-bug1717-workaround', type: 'feature', value : 'auto',
-       description: 'GNUTLS workaround for https://gitlab.com/gnutls/gnutls/-/issues/1717')
 option('nettle', type : 'feature', value : 'auto',
        description: 'nettle cryptography support')
 option('gcrypt', type : 'feature', value : 'auto',
diff --git a/scripts/meson-buildoptions.sh b/scripts/meson-buildoptions.sh
index d559e260ed..0ebe6bc52a 100644
--- a/scripts/meson-buildoptions.sh
+++ b/scripts/meson-buildoptions.sh
@@ -123,9 +123,6 @@ meson_options_help() {
   printf "%s\n" '  gio             use libgio for D-Bus support'
   printf "%s\n" '  glusterfs       Glusterfs block device driver'
   printf "%s\n" '  gnutls          GNUTLS cryptography support'
-  printf "%s\n" '  gnutls-bug1717-workaround'
-  printf "%s\n" '                  GNUTLS workaround for'
-  printf "%s\n" '                  https://gitlab.com/gnutls/gnutls/-/issues/1717'
   printf "%s\n" '  gtk             GTK+ user interface'
   printf "%s\n" '  gtk-clipboard   clipboard support for the gtk UI (EXPERIMENTAL, MAY HANG)'
   printf "%s\n" '  guest-agent     Build QEMU Guest Agent'
@@ -334,8 +331,6 @@ _meson_option_parse() {
     --disable-glusterfs) printf "%s" -Dglusterfs=disabled ;;
     --enable-gnutls) printf "%s" -Dgnutls=enabled ;;
     --disable-gnutls) printf "%s" -Dgnutls=disabled ;;
-    --enable-gnutls-bug1717-workaround) printf "%s" -Dgnutls-bug1717-workaround=enabled ;;
-    --disable-gnutls-bug1717-workaround) printf "%s" -Dgnutls-bug1717-workaround=disabled ;;
     --enable-gtk) printf "%s" -Dgtk=enabled ;;
     --disable-gtk) printf "%s" -Dgtk=disabled ;;
     --enable-gtk-clipboard) printf "%s" -Dgtk_clipboard=enabled ;;

From c7ac771ee750e37808928b62388fd27dcbf00f46 Mon Sep 17 00:00:00 2001
From: William Hu <purplearmadillo77@proton.me>
Date: Thu, 3 Apr 2025 01:07:56 +0000
Subject: [PATCH 2731/2760] ui/curses: Fix infinite loop on windows
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Replace -1 comparisons for wint_t with WEOF to fix infinite loop caused by a
65535 == -1 comparison.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2905
Signed-off-by: William Hu <purplearmadillo77@proton.me>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
[ Marc-André - Add missing similar code change, remove a comment ]
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-ID: <tSO5to8--iex6QMThG3Z8ElfnNOUahK_yitw2G2tEVRPoMKV936CBdrpyfbeNpVEpziKqeQ1ShBwPOoDkofgApM8YWwnPKJR_JrPDThV8Bc=@proton.me>
---
 ui/curses.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/ui/curses.c b/ui/curses.c
index a39aee8762..161f78c35c 100644
--- a/ui/curses.c
+++ b/ui/curses.c
@@ -265,7 +265,8 @@ static int curses2foo(const int _curses2foo[], const int _curseskey2foo[],
 
 static void curses_refresh(DisplayChangeListener *dcl)
 {
-    int chr, keysym, keycode, keycode_alt;
+    wint_t chr = 0;
+    int keysym, keycode, keycode_alt;
     enum maybe_keycode maybe_keycode = CURSES_KEYCODE;
 
     curses_winch_check();
@@ -284,8 +285,9 @@ static void curses_refresh(DisplayChangeListener *dcl)
         /* while there are any pending key strokes to process */
         chr = console_getch(&maybe_keycode);
 
-        if (chr == -1)
+        if (chr == WEOF) {
             break;
+        }
 
 #ifdef KEY_RESIZE
         /* this shouldn't occur when we use a custom SIGWINCH handler */
@@ -304,9 +306,9 @@ static void curses_refresh(DisplayChangeListener *dcl)
         /* alt or esc key */
         if (keycode == 1) {
             enum maybe_keycode next_maybe_keycode = CURSES_KEYCODE;
-            int nextchr = console_getch(&next_maybe_keycode);
+            wint_t nextchr = console_getch(&next_maybe_keycode);
 
-            if (nextchr != -1) {
+            if (nextchr != WEOF) {
                 chr = nextchr;
                 maybe_keycode = next_maybe_keycode;
                 keycode_alt = ALT;

From 5a5d18c75666378ff5db70268dbd39bd38488f21 Mon Sep 17 00:00:00 2001
From: Michael Tokarev <mjt@tls.msk.ru>
Date: Wed, 6 Aug 2025 10:48:37 +0300
Subject: [PATCH 2732/2760] tests/qemu-iotests/tests/mirror-sparse: actually
 require O_DIRECT

Commit c0ddcb2cbc146e introduced the test which uses cache=direct
mode, without checking if the scratch filesystem supports O_DIRECT.
A subsequent commit, afeb002e0ad49d, tried to fix that issue, but
instead of checking for o_direct, it checked for
`_supported_cache_modes none directsync`, which is not what the
original mirror-sparse test uses.  Fix both by actually checking
for o_direct.

Fixes: c0ddcb2cbc146e "tests: Add iotest mirror-sparse for recent patches"
Fixes: afeb002e0ad49d "tests/qemu-iotests/tests/mirror-sparse: skip if O_DIRECT is not supported"
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 tests/qemu-iotests/tests/mirror-sparse | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/qemu-iotests/tests/mirror-sparse b/tests/qemu-iotests/tests/mirror-sparse
index 3b183eea88..ee7101bd50 100755
--- a/tests/qemu-iotests/tests/mirror-sparse
+++ b/tests/qemu-iotests/tests/mirror-sparse
@@ -40,7 +40,7 @@ cd ..
 _supported_fmt qcow2 raw  # Format of the source. dst is always raw file
 _supported_proto file
 _supported_os Linux
-_supported_cache_modes none directsync
+_require_o_direct
 _require_disk_usage
 
 echo

From 8c9aae4364b25f0fd791eb3128b7650d7720d473 Mon Sep 17 00:00:00 2001
From: Stefan Weil via <qemu-trivial@nongnu.org>
Date: Wed, 6 Aug 2025 22:45:58 +0200
Subject: [PATCH 2733/2760] meson: Fix brlapi compile test for Windows builds

brlapi__openConnection returns a brlapi_fileDescriptor which is a pointer
for Windows builds.

The test for brlapi fails with cross builds on Debian trixie
(x86_64-w64-mingw32-gcc (GCC) 14-win32):

testfile.c:4:30: error: returning 'brlapi_fileDescriptor' {aka 'void *'} from a function with return type 'int' makes integer from pointer without a cast [-Wint-conversion]
    4 |      int main(void) { return brlapi__openConnection (NULL, NULL, NULL); }
      |                              ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-----------
../../../meson.build:1607: WARNING: could not link brlapi, disabling

Signed-off-by: Stefan Weil <sw@weilnetz.de>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 meson.build | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/meson.build b/meson.build
index a7b3c683ce..50c774a195 100644
--- a/meson.build
+++ b/meson.build
@@ -1586,9 +1586,11 @@ if not get_option('brlapi').auto() or have_system
   brlapi = cc.find_library('brlapi', has_headers: ['brlapi.h'],
                          required: get_option('brlapi'))
   if brlapi.found() and not cc.links('''
-     #include <brlapi.h>
-     #include <stddef.h>
-     int main(void) { return brlapi__openConnection (NULL, NULL, NULL); }''', dependencies: brlapi)
+    #include <brlapi.h>
+    #include <stddef.h>
+    int main(void) {
+      return brlapi__openConnection(NULL, NULL, NULL) == BRLAPI_INVALID_FILE_DESCRIPTOR;
+    }''', dependencies: brlapi)
     brlapi = not_found
     if get_option('brlapi').enabled()
       error('could not link brlapi')

From e66644c48e96e81848c6aa94b185f59fc212d080 Mon Sep 17 00:00:00 2001
From: WANG Rui <wangrui@loongson.cn>
Date: Mon, 4 Aug 2025 21:22:12 +0800
Subject: [PATCH 2734/2760] target/loongarch: Fix [X]VLDI raising exception
 incorrectly

According to the specification, [X]VLDI should trigger an invalid instruction
exception only when Bit[12] is 1 and Bit[11:8] > 12. This patch fixes an issue
where an exception was incorrectly raised even when Bit[12] was 0.

Test case:

```
    .global main
main:
    vldi    $vr0, 3328
    ret
```

Reported-by: Zhou Qiankang <wszqkzqk@qq.com>
Signed-off-by: WANG Rui <wangrui@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
Message-ID: <20250804132212.4816-1-wangrui@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 target/loongarch/tcg/insn_trans/trans_vec.c.inc | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/target/loongarch/tcg/insn_trans/trans_vec.c.inc b/target/loongarch/tcg/insn_trans/trans_vec.c.inc
index 78730029cb..38bccf2838 100644
--- a/target/loongarch/tcg/insn_trans/trans_vec.c.inc
+++ b/target/loongarch/tcg/insn_trans/trans_vec.c.inc
@@ -3585,7 +3585,9 @@ static bool gen_vldi(DisasContext *ctx, arg_vldi *a, uint32_t oprsz)
     int sel, vece;
     uint64_t value;
 
-    if (!check_valid_vldi_mode(a)) {
+    sel = (a->imm >> 12) & 0x1;
+
+    if (sel && !check_valid_vldi_mode(a)) {
         generate_exception(ctx, EXCCODE_INE);
         return true;
     }
@@ -3594,8 +3596,6 @@ static bool gen_vldi(DisasContext *ctx, arg_vldi *a, uint32_t oprsz)
         return true;
     }
 
-    sel = (a->imm >> 12) & 0x1;
-
     if (sel) {
         value = vldi_get_value(ctx, a->imm);
         vece = MO_64;

From 76cfb87f5fcad4008359e44bf37508c265da1221 Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Wed, 16 Jul 2025 11:06:08 -0700
Subject: [PATCH 2735/2760] vfio/pci: augment set_handler
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Extend vfio_pci_msi_set_handler() so it can set or clear the handler.
Add a similar accessor for INTx.  No functional change.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/1752689169-233452-2-git-send-email-steven.sistare@oracle.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/cpr.c |  2 +-
 hw/vfio/pci.c | 13 +++++++++++--
 hw/vfio/pci.h |  3 ++-
 3 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/hw/vfio/cpr.c b/hw/vfio/cpr.c
index 384b56c4c7..ade7ff745d 100644
--- a/hw/vfio/cpr.c
+++ b/hw/vfio/cpr.c
@@ -70,7 +70,7 @@ static void vfio_cpr_claim_vectors(VFIOPCIDevice *vdev, int nr_vectors,
         fd = vfio_cpr_load_vector_fd(vdev, "interrupt", i);
         if (fd >= 0) {
             vfio_pci_vector_init(vdev, i);
-            vfio_pci_msi_set_handler(vdev, i);
+            vfio_pci_msi_set_handler(vdev, i, true);
         }
 
         if (vfio_cpr_load_vector_fd(vdev, "kvm_interrupt", i) >= 0) {
diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index 4fa692c1a3..4cd6894ca8 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -413,6 +413,14 @@ bool vfio_pci_intx_enable(VFIOPCIDevice *vdev, Error **errp)
     return vfio_intx_enable(vdev, errp);
 }
 
+void vfio_pci_intx_set_handler(VFIOPCIDevice *vdev, bool enable)
+{
+    int fd = event_notifier_get_fd(&vdev->intx.interrupt);
+    IOHandler *handler = (enable ? vfio_intx_interrupt : NULL);
+
+    qemu_set_fd_handler(fd, handler, NULL, vdev);
+}
+
 /*
  * MSI/X
  */
@@ -451,12 +459,13 @@ static void vfio_msi_interrupt(void *opaque)
     notify(&vdev->pdev, nr);
 }
 
-void vfio_pci_msi_set_handler(VFIOPCIDevice *vdev, int nr)
+void vfio_pci_msi_set_handler(VFIOPCIDevice *vdev, int nr, bool enable)
 {
     VFIOMSIVector *vector = &vdev->msi_vectors[nr];
     int fd = event_notifier_get_fd(&vector->interrupt);
+    IOHandler *handler = (enable ? vfio_msi_interrupt : NULL);
 
-    qemu_set_fd_handler(fd, vfio_msi_interrupt, NULL, vector);
+    qemu_set_fd_handler(fd, handler, NULL, vector);
 }
 
 /*
diff --git a/hw/vfio/pci.h b/hw/vfio/pci.h
index 81465a8214..2b564baf88 100644
--- a/hw/vfio/pci.h
+++ b/hw/vfio/pci.h
@@ -209,8 +209,9 @@ void vfio_pci_add_kvm_msi_virq(VFIOPCIDevice *vdev, VFIOMSIVector *vector,
 void vfio_pci_prepare_kvm_msi_virq_batch(VFIOPCIDevice *vdev);
 void vfio_pci_commit_kvm_msi_virq_batch(VFIOPCIDevice *vdev);
 bool vfio_pci_intx_enable(VFIOPCIDevice *vdev, Error **errp);
+void vfio_pci_intx_set_handler(VFIOPCIDevice *vdev, bool enable);
 void vfio_pci_msix_set_notifiers(VFIOPCIDevice *vdev);
-void vfio_pci_msi_set_handler(VFIOPCIDevice *vdev, int nr);
+void vfio_pci_msi_set_handler(VFIOPCIDevice *vdev, int nr, bool enable);
 
 uint32_t vfio_pci_read_config(PCIDevice *pdev, uint32_t addr, int len);
 void vfio_pci_write_config(PCIDevice *pdev,

From 322ee16824dc3d301477812a5dacb0249e1efe8c Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Wed, 16 Jul 2025 11:06:09 -0700
Subject: [PATCH 2736/2760] vfio/pci: preserve pending interrupts
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

cpr-transfer may lose a VFIO interrupt because the KVM instance is
destroyed and recreated.  If an interrupt arrives in the middle, it is
dropped.  To fix, stop pending new interrupts during cpr save, and pick
up the pieces.  In more detail:

Stop the VCPUs. Call kvm_irqchip_remove_irqfd_notifier_gsi --> KVM_IRQFD to
deassign the irqfd gsi that routes interrupts directly to the VCPU and KVM.
After this call, interrupts fall back to the kernel vfio_msihandler, which
writes to QEMU's kvm_interrupt eventfd.  CPR already preserves that
eventfd.  When the route is re-established in new QEMU, the kernel tests
the eventfd and injects an interrupt to KVM if necessary.

Deassign INTx in a similar manner.  For both MSI and INTx, remove the
eventfd handler so old QEMU does not consume an event.

If an interrupt was already pended to KVM prior to the completion of
kvm_irqchip_remove_irqfd_notifier_gsi, it will be recovered by the
subsequent call to cpu_synchronize_all_states, which pulls KVM interrupt
state to userland prior to saving it in vmstate.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Link: https://lore.kernel.org/qemu-devel/1752689169-233452-3-git-send-email-steven.sistare@oracle.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/cpr.c              | 91 ++++++++++++++++++++++++++++++++++++++
 hw/vfio/pci.c              |  2 +
 hw/vfio/pci.h              |  1 +
 include/hw/vfio/vfio-cpr.h |  6 +++
 4 files changed, 100 insertions(+)

diff --git a/hw/vfio/cpr.c b/hw/vfio/cpr.c
index ade7ff745d..a831243e02 100644
--- a/hw/vfio/cpr.c
+++ b/hw/vfio/cpr.c
@@ -200,3 +200,94 @@ void vfio_cpr_add_kvm_notifier(void)
                                     MIG_MODE_CPR_TRANSFER);
     }
 }
+
+static int set_irqfd_notifier_gsi(KVMState *s, EventNotifier *n,
+                                  EventNotifier *rn, int virq, bool enable)
+{
+    if (enable) {
+        return kvm_irqchip_add_irqfd_notifier_gsi(s, n, rn, virq);
+    } else {
+        return kvm_irqchip_remove_irqfd_notifier_gsi(s, n, virq);
+    }
+}
+
+static int vfio_cpr_set_msi_virq(VFIOPCIDevice *vdev, Error **errp, bool enable)
+{
+    const char *op = (enable ? "enable" : "disable");
+    PCIDevice *pdev = &vdev->pdev;
+    int i, nr_vectors, ret = 0;
+
+    if (msix_enabled(pdev)) {
+        nr_vectors = vdev->msix->entries;
+
+    } else if (msi_enabled(pdev)) {
+        nr_vectors = msi_nr_vectors_allocated(pdev);
+
+    } else if (vfio_pci_read_config(pdev, PCI_INTERRUPT_PIN, 1)) {
+        ret = set_irqfd_notifier_gsi(kvm_state, &vdev->intx.interrupt,
+                                     &vdev->intx.unmask, vdev->intx.route.irq,
+                                     enable);
+        if (ret) {
+            error_setg_errno(errp, -ret, "failed to %s INTx irq %d",
+                             op, vdev->intx.route.irq);
+            return ret;
+        }
+        vfio_pci_intx_set_handler(vdev, enable);
+        return ret;
+
+    } else {
+        return 0;
+    }
+
+    for (i = 0; i < nr_vectors; i++) {
+        VFIOMSIVector *vector = &vdev->msi_vectors[i];
+        if (vector->use) {
+            ret = set_irqfd_notifier_gsi(kvm_state, &vector->kvm_interrupt,
+                                         NULL, vector->virq, enable);
+            if (ret) {
+                error_setg_errno(errp, -ret,
+                                 "failed to %s msi vector %d virq %d",
+                                 op, i, vector->virq);
+                return ret;
+            }
+            vfio_pci_msi_set_handler(vdev, i, enable);
+        }
+    }
+
+    return ret;
+}
+
+/*
+ * When CPR starts, detach IRQs from the VFIO device so future interrupts
+ * are posted to kvm_interrupt, which is preserved in new QEMU.  Interrupts
+ * that were already posted to the old KVM instance, but not delivered to the
+ * VCPU, are recovered via KVM_GET_LAPIC and pushed to the new KVM instance
+ * in new QEMU.
+ *
+ * If CPR fails, reattach the IRQs.
+ */
+static int vfio_cpr_pci_notifier(NotifierWithReturn *notifier,
+                                 MigrationEvent *e, Error **errp)
+{
+    VFIOPCIDevice *vdev =
+        container_of(notifier, VFIOPCIDevice, cpr.transfer_notifier);
+
+    if (e->type == MIG_EVENT_PRECOPY_SETUP) {
+        return vfio_cpr_set_msi_virq(vdev, errp, false);
+    } else if (e->type == MIG_EVENT_PRECOPY_FAILED) {
+        return vfio_cpr_set_msi_virq(vdev, errp, true);
+    }
+    return 0;
+}
+
+void vfio_cpr_pci_register_device(VFIOPCIDevice *vdev)
+{
+    migration_add_notifier_mode(&vdev->cpr.transfer_notifier,
+                                vfio_cpr_pci_notifier,
+                                MIG_MODE_CPR_TRANSFER);
+}
+
+void vfio_cpr_pci_unregister_device(VFIOPCIDevice *vdev)
+{
+    migration_remove_notifier(&vdev->cpr.transfer_notifier);
+}
diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index 4cd6894ca8..d5ea4a5a83 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -3001,6 +3001,7 @@ void vfio_pci_put_device(VFIOPCIDevice *vdev)
 {
     vfio_display_finalize(vdev);
     vfio_bars_finalize(vdev);
+    vfio_cpr_pci_unregister_device(vdev);
     g_free(vdev->emulated_config_bits);
     g_free(vdev->rom);
     /*
@@ -3480,6 +3481,7 @@ static void vfio_pci_realize(PCIDevice *pdev, Error **errp)
     vfio_pci_register_err_notifier(vdev);
     vfio_pci_register_req_notifier(vdev);
     vfio_setup_resetfn_quirk(vdev);
+    vfio_cpr_pci_register_device(vdev);
 
     return;
 
diff --git a/hw/vfio/pci.h b/hw/vfio/pci.h
index 2b564baf88..810a842f4a 100644
--- a/hw/vfio/pci.h
+++ b/hw/vfio/pci.h
@@ -188,6 +188,7 @@ struct VFIOPCIDevice {
     bool skip_vsc_check;
     VFIODisplay *dpy;
     Notifier irqchip_change_notifier;
+    VFIOPCICPR cpr;
 };
 
 /* Use uin32_t for vendor & device so PCI_ANY_ID expands and cannot match hw */
diff --git a/include/hw/vfio/vfio-cpr.h b/include/hw/vfio/vfio-cpr.h
index 80ad20d216..d37daffbc5 100644
--- a/include/hw/vfio/vfio-cpr.h
+++ b/include/hw/vfio/vfio-cpr.h
@@ -38,6 +38,10 @@ typedef struct VFIODeviceCPR {
     uint32_t ioas_id;
 } VFIODeviceCPR;
 
+typedef struct VFIOPCICPR {
+    NotifierWithReturn transfer_notifier;
+} VFIOPCICPR;
+
 bool vfio_legacy_cpr_register_container(struct VFIOContainer *container,
                                         Error **errp);
 void vfio_legacy_cpr_unregister_container(struct VFIOContainer *container);
@@ -77,5 +81,7 @@ extern const VMStateDescription vfio_cpr_pci_vmstate;
 extern const VMStateDescription vmstate_cpr_vfio_devices;
 
 void vfio_cpr_add_kvm_notifier(void);
+void vfio_cpr_pci_register_device(struct VFIOPCIDevice *vdev);
+void vfio_cpr_pci_unregister_device(struct VFIOPCIDevice *vdev);
 
 #endif /* HW_VFIO_VFIO_CPR_H */

From d9f4b45713e4e000a42ed1f33cb06b806173b559 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Tue, 5 Aug 2025 08:55:43 +0200
Subject: [PATCH 2737/2760] vfio: Document 'use-legacy-x86-rom' property
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Commit 350785d41d8b ("ramfb: Add property to control if load the
romfile") introduced the `use-legacy-x86-rom` property for the
`vfio-pci-nohotplug` device. Add documentation for the property.

Fixes: d5fcf0d960d8 ("hw/i386: Add the ramfb romfile compatibility")
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/qemu-devel/20250805065543.120091-1-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/pci.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index d5ea4a5a83..07257d0fa0 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -3901,6 +3901,9 @@ static void vfio_pci_nohotplug_dev_class_init(ObjectClass *klass,
                                           "x-ramfb-migrate",
                                           "Override default migration support for ramfb support "
                                           "(DEBUG)");
+    object_class_property_set_description(klass, /* 10.1 */
+                                          "use-legacy-x86-rom",
+                                          "Controls loading of a legacy VGA BIOS ROM");
 }
 
 static const TypeInfo vfio_pci_nohotplug_dev_info = {

From 13b4d19ced4430a777a0ab9d08bda86b3fd01fca Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Thu, 31 Jul 2025 07:40:42 +0200
Subject: [PATCH 2738/2760] docs/devel/qapi-code-gen: Add two cross-references
 we missed

Missed in commit 9c66762a601 (docs/qapi-code-gen: add
cross-references).

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20250731054044.4011789-2-armbru@redhat.com>
Reviewed-by: John Snow <jsnow@redhat.com>
---
 docs/devel/qapi-code-gen.rst | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/devel/qapi-code-gen.rst b/docs/devel/qapi-code-gen.rst
index dfdbeac5a5..138921b386 100644
--- a/docs/devel/qapi-code-gen.rst
+++ b/docs/devel/qapi-code-gen.rst
@@ -646,9 +646,9 @@ Member 'event' names the event.  This is the event name used in the
 Client JSON Protocol.
 
 Member 'data' defines the event-specific data.  It defaults to an
-empty MEMBERS object.
+empty MEMBERS_ object.
 
-If 'data' is a MEMBERS object, then MEMBERS defines event-specific
+If 'data' is a MEMBERS_ object, then MEMBERS defines event-specific
 data just like a struct type's 'data' defines struct type members.
 
 If 'data' is a STRING, then STRING names a complex type whose members

From 60e847dcf06aa4cc41cf7535d5ea4b1f5b34a616 Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Thu, 31 Jul 2025 07:40:43 +0200
Subject: [PATCH 2739/2760] docs/devel/qapi-code-gen: Fix typos in QAPI schema
 language grammar

Fixes: 3248c1aaf2db (docs: update the documentation upfront about schema configuration)
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20250731054044.4011789-3-armbru@redhat.com>
Reviewed-by: John Snow <jsnow@redhat.com>
---
 docs/devel/qapi-code-gen.rst | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/devel/qapi-code-gen.rst b/docs/devel/qapi-code-gen.rst
index 138921b386..2cd51729c3 100644
--- a/docs/devel/qapi-code-gen.rst
+++ b/docs/devel/qapi-code-gen.rst
@@ -786,8 +786,8 @@ Configuring the schema
 Syntax::
 
     COND = STRING
-         | { 'all: [ COND, ... ] }
-         | { 'any: [ COND, ... ] }
+         | { 'all': [ COND, ... ] }
+         | { 'any': [ COND, ... ] }
          | { 'not': COND }
 
 All definitions take an optional 'if' member.  Its value must be a

From 79f57adce686d0027608af4be363cde2409e5740 Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Thu, 31 Jul 2025 07:40:44 +0200
Subject: [PATCH 2740/2760] docs/devel/qapi-code-gen: Update cross-reference
 syntax

The new QAPI code generator creates a cross-reference target for each
definition documentation.  Enabled for the QEMU QMP Reference manual
in commit a377f39f38f, and for the QEMU Storage Daemon QMP Reference
Manual and the QEMU Guest Agent Protocol Reference in commit
a6af5443440.  We've put these targets to use since, but neglected to
update doc comment markup documentation.  Do that now.

Co-developed-by: John Snow <jsnow@redhat.com>
Signed-off-by: John Snow <jsnow@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20250731054044.4011789-4-armbru@redhat.com>
---
 docs/devel/qapi-code-gen.rst | 11 ++++++++---
 docs/devel/qapi-domain.rst   |  1 +
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/docs/devel/qapi-code-gen.rst b/docs/devel/qapi-code-gen.rst
index 2cd51729c3..d97602f464 100644
--- a/docs/devel/qapi-code-gen.rst
+++ b/docs/devel/qapi-code-gen.rst
@@ -943,9 +943,14 @@ The usual ****strong****, *\*emphasized\** and ````literal```` markup
 should be used.  If you need a single literal ``*``, you will need to
 backslash-escape it.
 
-Use ``@foo`` to reference a name in the schema.  This is an rST
-extension.  It is rendered the same way as ````foo````, but carries
-additional meaning.
+Use ```foo``` to reference a definition in the schema.  This generates
+a link to the definition.  In the event that such a cross-reference is
+ambiguous, you can use `QAPI cross-reference roles
+<QAPI-domain-cross-references>` to disambiguate.
+
+Use @foo to reference a member description within the current
+definition.  This is an rST extension.  It is currently rendered the
+same way as ````foo````, but carries additional meaning.
 
 Example::
 
diff --git a/docs/devel/qapi-domain.rst b/docs/devel/qapi-domain.rst
index fe540d1e40..1924f12d42 100644
--- a/docs/devel/qapi-domain.rst
+++ b/docs/devel/qapi-domain.rst
@@ -375,6 +375,7 @@ Will allow you to add arbitrary field lists in QAPI directives::
 
       :see also: Lorem ipsum, dolor sit amet ...
 
+.. _QAPI-domain-cross-references:
 
 Cross-references
 ================

From 31b737b19dca4d50758f5e9834d27b683102f2f1 Mon Sep 17 00:00:00 2001
From: Klaus Jensen <k.jensen@samsung.com>
Date: Tue, 3 Jun 2025 14:59:05 +0200
Subject: [PATCH 2741/2760] hw/nvme: fix namespace attachment

Commit 6ccca4b6bb9f ("hw/nvme: rework csi handling") introduced a bug in
Namespace Attachment, causing it to

  a) not allow a controller to attach namespaces to other controllers
  b) assert if a valid non-attached namespace is detached

This fixes both issues.

Fixes: 6ccca4b6bb9f ("hw/nvme: rework csi handling")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2976
Reviewed-by: Jesper Wendel Devantier <foss@defmacro.it>
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
---
 hw/nvme/ctrl.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c
index e764ec7683..6c06d7f8f9 100644
--- a/hw/nvme/ctrl.c
+++ b/hw/nvme/ctrl.c
@@ -6816,7 +6816,7 @@ static uint16_t nvme_ns_attachment(NvmeCtrl *n, NvmeRequest *req)
 
         switch (sel) {
         case NVME_NS_ATTACHMENT_ATTACH:
-            if (nvme_ns(n, nsid)) {
+            if (nvme_ns(ctrl, nsid)) {
                 return NVME_NS_ALREADY_ATTACHED | NVME_DNR;
             }
 
@@ -6824,7 +6824,7 @@ static uint16_t nvme_ns_attachment(NvmeCtrl *n, NvmeRequest *req)
                 return NVME_NS_PRIVATE | NVME_DNR;
             }
 
-            if (!nvme_csi_supported(n, ns->csi)) {
+            if (!nvme_csi_supported(ctrl, ns->csi)) {
                 return NVME_IOCS_NOT_SUPPORTED | NVME_DNR;
             }
 
@@ -6834,6 +6834,10 @@ static uint16_t nvme_ns_attachment(NvmeCtrl *n, NvmeRequest *req)
             break;
 
         case NVME_NS_ATTACHMENT_DETACH:
+            if (!nvme_ns(ctrl, nsid)) {
+                return NVME_NS_NOT_ATTACHED | NVME_DNR;
+            }
+
             nvme_detach_ns(ctrl, ns);
             nvme_update_dsm_limits(ctrl, NULL);
 

From bc0c24fdb157b014932a5012fe4ccbeba7617f17 Mon Sep 17 00:00:00 2001
From: Klaus Jensen <k.jensen@samsung.com>
Date: Tue, 3 Jun 2025 14:59:06 +0200
Subject: [PATCH 2742/2760] hw/nvme: revert CMIC behavior

Commit cd59f50ab017 ("hw/nvme: always initialize a subsystem") causes
the controller to always set the CMIC.MCTRS ("Multiple Controllers")
bit. While spec-compliant, this is a deviation from the previous
behavior where this was only set if an nvme-subsys device was explicitly
created (to configure a subsystem with multiple controllers/namespaces).

Revert the behavior to only set CMIC.MCTRS if an nvme-subsys device is
created explicitly.

Reported-by: Alan Adamson <alan.adamson@oracle.com>
Fixes: cd59f50ab017 ("hw/nvme: always initialize a subsystem")
Reviewed-by: Alan Adamson <alan.adamson@oracle.com>
Tested-by: Alan Adamson <alan.adamson@oracle.com>
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
---
 hw/nvme/ctrl.c | 30 +++++++++++++++++-------------
 1 file changed, 17 insertions(+), 13 deletions(-)

diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c
index 6c06d7f8f9..fa48412ef4 100644
--- a/hw/nvme/ctrl.c
+++ b/hw/nvme/ctrl.c
@@ -8780,7 +8780,7 @@ static void nvme_init_ctrl(NvmeCtrl *n, PCIDevice *pci_dev)
     uint8_t *pci_conf = pci_dev->config;
     uint64_t cap = ldq_le_p(&n->bar.cap);
     NvmeSecCtrlEntry *sctrl = nvme_sctrl(n);
-    uint32_t ctratt;
+    uint32_t ctratt = le32_to_cpu(id->ctratt);
     uint16_t oacs;
 
     memcpy(n->cse.acs, nvme_cse_acs_default, sizeof(n->cse.acs));
@@ -8798,10 +8798,11 @@ static void nvme_init_ctrl(NvmeCtrl *n, PCIDevice *pci_dev)
 
     id->oaes = cpu_to_le32(NVME_OAES_NS_ATTR);
 
-    ctratt = NVME_CTRATT_ELBAS;
+    ctratt |= NVME_CTRATT_ELBAS;
     if (n->params.ctratt.mem) {
         ctratt |= NVME_CTRATT_MEM;
     }
+    id->ctratt = cpu_to_le32(ctratt);
 
     id->rab = 6;
 
@@ -8884,17 +8885,6 @@ static void nvme_init_ctrl(NvmeCtrl *n, PCIDevice *pci_dev)
     id->psd[0].enlat = cpu_to_le32(0x10);
     id->psd[0].exlat = cpu_to_le32(0x4);
 
-    id->cmic |= NVME_CMIC_MULTI_CTRL;
-    ctratt |= NVME_CTRATT_ENDGRPS;
-
-    id->endgidmax = cpu_to_le16(0x1);
-
-    if (n->subsys->endgrp.fdp.enabled) {
-        ctratt |= NVME_CTRATT_FDPS;
-    }
-
-    id->ctratt = cpu_to_le32(ctratt);
-
     NVME_CAP_SET_MQES(cap, n->params.mqes);
     NVME_CAP_SET_CQR(cap, 1);
     NVME_CAP_SET_TO(cap, 0xf);
@@ -8927,6 +8917,20 @@ static int nvme_init_subsys(NvmeCtrl *n, Error **errp)
         }
 
         n->subsys = NVME_SUBSYS(dev);
+    } else {
+        NvmeIdCtrl *id = &n->id_ctrl;
+        uint32_t ctratt = le32_to_cpu(id->ctratt);
+
+        id->cmic |= NVME_CMIC_MULTI_CTRL;
+        ctratt |= NVME_CTRATT_ENDGRPS;
+
+        id->endgidmax = cpu_to_le16(0x1);
+
+        if (n->subsys->endgrp.fdp.enabled) {
+            ctratt |= NVME_CTRATT_FDPS;
+        }
+
+        id->ctratt = cpu_to_le32(ctratt);
     }
 
     cntlid = nvme_subsys_register_ctrl(n, errp);

From 53493c1f836f4dda90a6b5f2fb3d9264918c6871 Mon Sep 17 00:00:00 2001
From: Keith Busch <kbusch@kernel.org>
Date: Fri, 1 Aug 2025 07:24:57 -0700
Subject: [PATCH 2743/2760] hw/nvme: cap MDTS value for internal limitation

The emulated device had let the user set whatever max transfers size
they wanted, including no limit. However the device does have an
internal limit of 1024 segments. NVMe doesn't report max segments,
though. This is implicitly inferred based on the MDTS and MPSMIN values.

IOV_MAX is currently 1024 which 4k PRPs can exceed with 2MB transfers.
Don't allow MDTS values that can exceed this, otherwise users risk
seeing "internal error" status to their otherwise protocol compliant
commands.

Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
---
 hw/nvme/ctrl.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c
index fa48412ef4..f5ee6bf260 100644
--- a/hw/nvme/ctrl.c
+++ b/hw/nvme/ctrl.c
@@ -8339,6 +8339,11 @@ static bool nvme_check_params(NvmeCtrl *n, Error **errp)
         host_memory_backend_set_mapped(n->pmr.dev, true);
     }
 
+    if (!n->params.mdts || ((1 << n->params.mdts) + 1) > IOV_MAX) {
+        error_setg(errp, "mdts exceeds IOV_MAX");
+        return false;
+    }
+
     if (n->params.zasl > n->params.mdts) {
         error_setg(errp, "zoned.zasl (Zone Append Size Limit) must be less "
                    "than or equal to mdts (Maximum Data Transfer Size)");

From 621dbaee0152a283042db3cac6a51f91b3e06024 Mon Sep 17 00:00:00 2001
From: Stefan Hajnoczi <stefanha@redhat.com>
Date: Mon, 11 Aug 2025 12:23:15 -0400
Subject: [PATCH 2744/2760] tests/functional: fix URLs in PCI hotplug test for
 aarch64
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Debian trixie has been released. The "stable" alias no longer refers to
the Debian bookworm release, so URLs referring to bookworm artifacts via
the "stable" alias no longer work.

Switch to explicit release naming ("bookworm") to make a permalink so
the test passes again.

Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Fixes: 374a245573b8 ("tests/functional: Add PCI hotplug test for aarch64")
Resolves: #3073 ("PCI hotplug test for aarch64 fails due to broken Debian installer URL")
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-ID: <20250811162315.59997-1-stefanha@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 tests/functional/test_aarch64_hotplug_pci.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/functional/test_aarch64_hotplug_pci.py b/tests/functional/test_aarch64_hotplug_pci.py
index c9bb7f1d97..0c67991b89 100755
--- a/tests/functional/test_aarch64_hotplug_pci.py
+++ b/tests/functional/test_aarch64_hotplug_pci.py
@@ -15,12 +15,12 @@ from qemu_test import BUILD_DIR
 class HotplugPCI(LinuxKernelTest):
 
     ASSET_KERNEL = Asset(
-        ('https://ftp.debian.org/debian/dists/stable/main/installer-arm64/'
+        ('https://ftp.debian.org/debian/dists/bookworm/main/installer-arm64/'
          '20230607+deb12u11/images/netboot/debian-installer/arm64/linux'),
          'd92a60392ce1e379ca198a1a820899f8f0d39a62d047c41ab79492f81541a9d9')
 
     ASSET_INITRD = Asset(
-        ('https://ftp.debian.org/debian/dists/stable/main/installer-arm64/'
+        ('https://ftp.debian.org/debian/dists/bookworm/main/installer-arm64/'
          '20230607+deb12u11/images/netboot/debian-installer/arm64/initrd.gz'),
          '9f817f76951f3237bca8216bee35267bfb826815687f4b2fcdd5e6c2a917790c')
 

From f757d9d90d19b914d4023663bfc4da73bbbf007e Mon Sep 17 00:00:00 2001
From: Mauro Matteo Cascella <mcascell@redhat.com>
Date: Mon, 11 Aug 2025 12:11:24 +0200
Subject: [PATCH 2745/2760] hw/uefi: clear uefi-vars buffer in uefi_vars_write
 callback

When the guest writes to register UEFI_VARS_REG_BUFFER_SIZE, the .write
callback `uefi_vars_write` is invoked. The function allocates a
heap buffer without zeroing the memory, leaving the buffer filled with
residual data from prior allocations. When the guest later reads from
register UEFI_VARS_REG_PIO_BUFFER_TRANSFER, the .read callback
`uefi_vars_read` returns leftover metadata or other sensitive process
memory from the previously allocated buffer, leading to an information
disclosure vulnerability.

Fixes: CVE-2025-8860
Fixes: 90ca4e03c27d ("hw/uefi: add var-service-core.c")
Reported-by: ZDI <zdi-disclosures@trendmicro.com>
Suggested-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com>
Message-ID: <20250811101128.17661-1-mcascell@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
 hw/uefi/var-service-core.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/uefi/var-service-core.c b/hw/uefi/var-service-core.c
index feec5a5958..6ab8df091a 100644
--- a/hw/uefi/var-service-core.c
+++ b/hw/uefi/var-service-core.c
@@ -259,8 +259,8 @@ static void uefi_vars_write(void *opaque, hwaddr addr, uint64_t val, unsigned si
         uv->buf_size = val;
         g_free(uv->buffer);
         g_free(uv->pio_xfer_buffer);
-        uv->buffer = g_malloc(uv->buf_size);
-        uv->pio_xfer_buffer = g_malloc(uv->buf_size);
+        uv->buffer = g_malloc0(uv->buf_size);
+        uv->pio_xfer_buffer = g_malloc0(uv->buf_size);
         break;
     case UEFI_VARS_REG_DMA_BUFFER_ADDR_LO:
         uv->buf_addr_lo = val;

From 88e5a28d5aabb57f44c1805fbba0a458023f5106 Mon Sep 17 00:00:00 2001
From: Gerd Hoffmann <kraxel@redhat.com>
Date: Mon, 11 Aug 2025 15:01:08 +0200
Subject: [PATCH 2746/2760] hw/uefi: return success for notifications
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Set status to SUCCESS for ready-to-boot and exit-boot-services
notification calls.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-ID: <20250811130110.820958-2-kraxel@redhat.com>
---
 hw/uefi/var-service-vars.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/hw/uefi/var-service-vars.c b/hw/uefi/var-service-vars.c
index 37d05b71cf..cbeccdbd26 100644
--- a/hw/uefi/var-service-vars.c
+++ b/hw/uefi/var-service-vars.c
@@ -702,12 +702,14 @@ uint32_t uefi_vars_mm_vars_proto(uefi_vars_state *uv)
     case SMM_VARIABLE_FUNCTION_READY_TO_BOOT:
         trace_uefi_event("ready-to-boot");
         uv->ready_to_boot = true;
+        mvar->status = EFI_SUCCESS;
         length = 0;
         break;
 
     case SMM_VARIABLE_FUNCTION_EXIT_BOOT_SERVICE:
         trace_uefi_event("exit-boot-service");
         uv->exit_boot_service = true;
+        mvar->status = EFI_SUCCESS;
         length = 0;
         break;
 

From fc8ee8fe58ad410f27fca64e4ad212c5a3eabe00 Mon Sep 17 00:00:00 2001
From: Gerd Hoffmann <kraxel@redhat.com>
Date: Mon, 11 Aug 2025 15:01:09 +0200
Subject: [PATCH 2747/2760] hw/uefi: check access for first variable
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When listing variables (via get-next-variable-name) only the names of
variables which can be accessed will be returned.  That check was
missing for the first variable though.  Add it.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-ID: <20250811130110.820958-3-kraxel@redhat.com>
---
 hw/uefi/var-service-vars.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/hw/uefi/var-service-vars.c b/hw/uefi/var-service-vars.c
index cbeccdbd26..8533533ea5 100644
--- a/hw/uefi/var-service-vars.c
+++ b/hw/uefi/var-service-vars.c
@@ -357,6 +357,9 @@ uefi_vars_mm_get_next_variable(uefi_vars_state *uv, mm_header *mhdr,
     if (uefi_strlen(name, nv->name_size) == 0) {
         /* empty string -> first */
         var = QTAILQ_FIRST(&uv->variables);
+        while (var && !check_access(uv, var)) {
+            var = QTAILQ_NEXT(var, next);
+        }
         if (!var) {
             return uefi_vars_mm_error(mhdr, mvar, EFI_NOT_FOUND);
         }

From 040237436f423253f3397547aa78d449394dfbca Mon Sep 17 00:00:00 2001
From: Gerd Hoffmann <kraxel@redhat.com>
Date: Mon, 11 Aug 2025 15:01:10 +0200
Subject: [PATCH 2748/2760] hw/uefi: open json file in binary mode
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fixes file length discrepancies due to line ending conversions
on windows hosts.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3058
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-ID: <20250811130110.820958-4-kraxel@redhat.com>
---
 hw/uefi/var-service-json.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/uefi/var-service-json.c b/hw/uefi/var-service-json.c
index ad3462cd15..f5f1556833 100644
--- a/hw/uefi/var-service-json.c
+++ b/hw/uefi/var-service-json.c
@@ -172,7 +172,7 @@ static GString *uefi_vars_to_json(uefi_vars_state *uv)
 void uefi_vars_json_init(uefi_vars_state *uv, Error **errp)
 {
     if (uv->jsonfile) {
-        uv->jsonfd = qemu_create(uv->jsonfile, O_RDWR, 0666, errp);
+        uv->jsonfd = qemu_create(uv->jsonfile, O_RDWR | O_BINARY, 0666, errp);
     }
 }
 

From 65677b7aad05edd20a8d2fe1c27b944f1ff9a002 Mon Sep 17 00:00:00 2001
From: Kevin Wolf <kwolf@redhat.com>
Date: Mon, 11 Aug 2025 16:29:23 +0200
Subject: [PATCH 2749/2760] configure: Don't disable Rust for too old meson
 version

If the user explicitly specified --enable-rust, don't just fail if meson
is too old for Rust support, but do the same thing as if meson was too
old for the C code: Just download a newer one.

In order to avoid the additional download for people who aren't
intentionally opting in to Rust, keep the automatic disabling based on
the meson version as the default if neither --enable-rust nor
--disable-rust were given.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20250811142923.89983-1-kwolf@redhat.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 configure       | 8 +++++---
 pythondeps.toml | 4 ++++
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/configure b/configure
index 825057ebf1..274a778764 100755
--- a/configure
+++ b/configure
@@ -1186,10 +1186,12 @@ fi
 meson_version=$($meson --version)
 if test "$rust" != disabled && ! version_ge "$meson_version" 1.8.1; then
   if test "$rust" = enabled; then
-    error_exit "Rust support needs Meson 1.8.1 or newer"
+    $mkvenv ensuregroup --dir "${source_path}/python/wheels" \
+         ${source_path}/pythondeps.toml meson-rust || exit 1
+  else
+    echo "Rust needs Meson 1.8.1, disabling" 2>&1
+    rust=disabled
   fi
-  echo "Rust needs Meson 1.8.1, disabling" 2>&1
-  rust=disabled
 fi
 if test "$rust" != disabled && has "$rustc" && $rustc -vV > "${TMPDIR1}/${TMPB}.out"; then
   rust_host_triple=$(sed -n 's/^host: //p' "${TMPDIR1}/${TMPB}.out")
diff --git a/pythondeps.toml b/pythondeps.toml
index b2eec940ce..d0f52b14f7 100644
--- a/pythondeps.toml
+++ b/pythondeps.toml
@@ -22,6 +22,10 @@
 meson = { accepted = ">=1.5.0", installed = "1.8.1", canary = "meson" }
 pycotap = { accepted = ">=1.1.0", installed = "1.3.1" }
 
+[meson-rust]
+# The install key should match the version in python/wheels/
+meson = { accepted = ">=1.8.1", installed = "1.8.1", canary = "meson" }
+
 [docs]
 # Please keep the installed versions in sync with docs/requirements.txt
 sphinx = { accepted = ">=3.4.3", installed = "6.2.1", canary = "sphinx-build" }

From 4af976ef398e4e823addc00bf1c58787ba4952fe Mon Sep 17 00:00:00 2001
From: Kevin Wolf <kwolf@redhat.com>
Date: Mon, 11 Aug 2025 15:40:10 +0200
Subject: [PATCH 2750/2760] rbd: Fix .bdrv_get_specific_info implementation

qemu_rbd_get_specific_info() has at least two problems:

The first is that it issues a blocking rbd_read() call in order to probe
the encryption format for the image while querying the node. This means
that if the connection to the server goes down, not only I/O is stuck
(which is unavoidable), but query-names-block-nodes will actually make
the whole QEMU instance unresponsive. .bdrv_get_specific_info
implementations shouldn't perform blocking operations, but only return
what is already known.

The second is that the information returned isn't even correct. If the
image is already opened with encryption enabled at the RBD level, we'll
probe for "double encryption", i.e. if the encrypted data contains
another encryption header. If it doesn't (which is the normal case), we
won't return the encryption format. If it does, we return misleading
information because it looks like we're talking about the outer level
(the encryption format of the image itself) while the information is
about an encryption header in the guest data.

Fix this by storing the encryption format in BDRVRBDState when the image
is opened (and we do blocking operations anyway) and returning only the
stored information in qemu_rbd_get_specific_info().

The information we'll store is either the actual encryption format that
we enabled on the RBD level, or if the image is unencrypted, the result
of the same probing as we previously did when querying the node. Probing
image formats based on content that can be modified by the guest has
long been known as problematic, but as long as we only output it to the
user instead of making decisions based on it, it should be okay. It is
undoubtedly useful in the context of 'qemu-img info' when you're trying
to figure out which encryption options you have to use to open the
image successfully.

Fixes: 42e4ac9ef5a6 ("block/rbd: Add support for rbd image encryption")
Buglink: https://issues.redhat.com/browse/RHEL-105440
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20250811134010.81787-1-kwolf@redhat.com>
Reviewed-by: Hanna Czenczek <hreitz@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/rbd.c          | 104 ++++++++++++++++++++++++++++---------------
 qapi/block-core.json |   9 +++-
 2 files changed, 76 insertions(+), 37 deletions(-)

diff --git a/block/rbd.c b/block/rbd.c
index 951cd63f9a..3611dc81cf 100644
--- a/block/rbd.c
+++ b/block/rbd.c
@@ -99,6 +99,14 @@ typedef struct BDRVRBDState {
     char *namespace;
     uint64_t image_size;
     uint64_t object_size;
+
+    /*
+     * If @bs->encrypted is true, this is the encryption format actually loaded
+     * at the librbd level. If it is false, it is the result of probing.
+     * RBD_IMAGE_ENCRYPTION_FORMAT__MAX means that encryption is not enabled and
+     * probing didn't find any known encryption header either.
+     */
+    RbdImageEncryptionFormat encryption_format;
 } BDRVRBDState;
 
 typedef struct RBDTask {
@@ -470,10 +478,12 @@ static int qemu_rbd_encryption_format(rbd_image_t image,
     return 0;
 }
 
-static int qemu_rbd_encryption_load(rbd_image_t image,
+static int qemu_rbd_encryption_load(BlockDriverState *bs,
+                                    rbd_image_t image,
                                     RbdEncryptionOptions *encrypt,
                                     Error **errp)
 {
+    BDRVRBDState *s = bs->opaque;
     int r = 0;
     g_autofree char *passphrase = NULL;
     rbd_encryption_luks1_format_options_t luks_opts;
@@ -544,15 +554,19 @@ static int qemu_rbd_encryption_load(rbd_image_t image,
         error_setg_errno(errp, -r, "encryption load fail");
         return r;
     }
+    bs->encrypted = true;
+    s->encryption_format = encrypt->format;
 
     return 0;
 }
 
 #ifdef LIBRBD_SUPPORTS_ENCRYPTION_LOAD2
-static int qemu_rbd_encryption_load2(rbd_image_t image,
+static int qemu_rbd_encryption_load2(BlockDriverState *bs,
+                                     rbd_image_t image,
                                      RbdEncryptionOptions *encrypt,
                                      Error **errp)
 {
+    BDRVRBDState *s = bs->opaque;
     int r = 0;
     int encrypt_count = 1;
     int i;
@@ -638,6 +652,8 @@ static int qemu_rbd_encryption_load2(rbd_image_t image,
         error_setg_errno(errp, -r, "layered encryption load fail");
         goto exit;
     }
+    bs->encrypted = true;
+    s->encryption_format = encrypt->format;
 
 exit:
     for (i = 0; i < encrypt_count; ++i) {
@@ -671,6 +687,45 @@ exit:
 #endif
 #endif
 
+/*
+ * For an image without encryption enabled on the rbd layer, probe the start of
+ * the image if it could be opened as an encrypted image so that we can display
+ * it when the user queries the node (most importantly in qemu-img).
+ *
+ * If the guest writes an encryption header to its disk after this probing, this
+ * won't be reflected when queried, but that's okay. There is no reason why the
+ * user should want to apply encryption at the rbd level while the image is
+ * still in use. This is just guest data.
+ */
+static void qemu_rbd_encryption_probe(BlockDriverState *bs)
+{
+    BDRVRBDState *s = bs->opaque;
+    char buf[RBD_ENCRYPTION_LUKS_HEADER_VERIFICATION_LEN] = {0};
+    int r;
+
+    assert(s->encryption_format == RBD_IMAGE_ENCRYPTION_FORMAT__MAX);
+
+    r = rbd_read(s->image, 0,
+                 RBD_ENCRYPTION_LUKS_HEADER_VERIFICATION_LEN, buf);
+    if (r < RBD_ENCRYPTION_LUKS_HEADER_VERIFICATION_LEN) {
+        return;
+    }
+
+    if (memcmp(buf, rbd_luks_header_verification,
+               RBD_ENCRYPTION_LUKS_HEADER_VERIFICATION_LEN) == 0) {
+        s->encryption_format = RBD_IMAGE_ENCRYPTION_FORMAT_LUKS;
+    } else if (memcmp(buf, rbd_luks2_header_verification,
+               RBD_ENCRYPTION_LUKS_HEADER_VERIFICATION_LEN) == 0) {
+        s->encryption_format = RBD_IMAGE_ENCRYPTION_FORMAT_LUKS2;
+    } else if (memcmp(buf, rbd_layered_luks_header_verification,
+               RBD_ENCRYPTION_LUKS_HEADER_VERIFICATION_LEN) == 0) {
+        s->encryption_format = RBD_IMAGE_ENCRYPTION_FORMAT_LUKS;
+    } else if (memcmp(buf, rbd_layered_luks2_header_verification,
+               RBD_ENCRYPTION_LUKS_HEADER_VERIFICATION_LEN) == 0) {
+        s->encryption_format = RBD_IMAGE_ENCRYPTION_FORMAT_LUKS2;
+    }
+}
+
 /* FIXME Deprecate and remove keypairs or make it available in QMP. */
 static int qemu_rbd_do_create(BlockdevCreateOptions *options,
                               const char *keypairs, const char *password_secret,
@@ -1133,17 +1188,18 @@ static int qemu_rbd_open(BlockDriverState *bs, QDict *options, int flags,
         goto failed_open;
     }
 
+    s->encryption_format = RBD_IMAGE_ENCRYPTION_FORMAT__MAX;
     if (opts->encrypt) {
 #ifdef LIBRBD_SUPPORTS_ENCRYPTION
         if (opts->encrypt->parent) {
 #ifdef LIBRBD_SUPPORTS_ENCRYPTION_LOAD2
-            r = qemu_rbd_encryption_load2(s->image, opts->encrypt, errp);
+            r = qemu_rbd_encryption_load2(bs, s->image, opts->encrypt, errp);
 #else
             r = -ENOTSUP;
             error_setg(errp, "RBD library does not support layered encryption");
 #endif
         } else {
-            r = qemu_rbd_encryption_load(s->image, opts->encrypt, errp);
+            r = qemu_rbd_encryption_load(bs, s->image, opts->encrypt, errp);
         }
         if (r < 0) {
             goto failed_post_open;
@@ -1153,6 +1209,8 @@ static int qemu_rbd_open(BlockDriverState *bs, QDict *options, int flags,
         error_setg(errp, "RBD library does not support image encryption");
         goto failed_post_open;
 #endif
+    } else {
+        qemu_rbd_encryption_probe(bs);
     }
 
     r = rbd_stat(s->image, &info, sizeof(info));
@@ -1412,17 +1470,6 @@ static ImageInfoSpecific *qemu_rbd_get_specific_info(BlockDriverState *bs,
 {
     BDRVRBDState *s = bs->opaque;
     ImageInfoSpecific *spec_info;
-    char buf[RBD_ENCRYPTION_LUKS_HEADER_VERIFICATION_LEN] = {0};
-    int r;
-
-    if (s->image_size >= RBD_ENCRYPTION_LUKS_HEADER_VERIFICATION_LEN) {
-        r = rbd_read(s->image, 0,
-                     RBD_ENCRYPTION_LUKS_HEADER_VERIFICATION_LEN, buf);
-        if (r < 0) {
-            error_setg_errno(errp, -r, "cannot read image start for probe");
-            return NULL;
-        }
-    }
 
     spec_info = g_new(ImageInfoSpecific, 1);
     *spec_info = (ImageInfoSpecific){
@@ -1430,28 +1477,13 @@ static ImageInfoSpecific *qemu_rbd_get_specific_info(BlockDriverState *bs,
         .u.rbd.data = g_new0(ImageInfoSpecificRbd, 1),
     };
 
-    if (memcmp(buf, rbd_luks_header_verification,
-               RBD_ENCRYPTION_LUKS_HEADER_VERIFICATION_LEN) == 0) {
-        spec_info->u.rbd.data->encryption_format =
-                RBD_IMAGE_ENCRYPTION_FORMAT_LUKS;
-        spec_info->u.rbd.data->has_encryption_format = true;
-    } else if (memcmp(buf, rbd_luks2_header_verification,
-               RBD_ENCRYPTION_LUKS_HEADER_VERIFICATION_LEN) == 0) {
-        spec_info->u.rbd.data->encryption_format =
-                RBD_IMAGE_ENCRYPTION_FORMAT_LUKS2;
-        spec_info->u.rbd.data->has_encryption_format = true;
-    } else if (memcmp(buf, rbd_layered_luks_header_verification,
-               RBD_ENCRYPTION_LUKS_HEADER_VERIFICATION_LEN) == 0) {
-        spec_info->u.rbd.data->encryption_format =
-                RBD_IMAGE_ENCRYPTION_FORMAT_LUKS;
-        spec_info->u.rbd.data->has_encryption_format = true;
-    } else if (memcmp(buf, rbd_layered_luks2_header_verification,
-               RBD_ENCRYPTION_LUKS_HEADER_VERIFICATION_LEN) == 0) {
-        spec_info->u.rbd.data->encryption_format =
-                RBD_IMAGE_ENCRYPTION_FORMAT_LUKS2;
-        spec_info->u.rbd.data->has_encryption_format = true;
+    if (s->encryption_format == RBD_IMAGE_ENCRYPTION_FORMAT__MAX) {
+        assert(!bs->encrypted);
     } else {
-        spec_info->u.rbd.data->has_encryption_format = false;
+        ImageInfoSpecificRbd *rbd_info = spec_info->u.rbd.data;
+
+        rbd_info->has_encryption_format = true;
+        rbd_info->encryption_format = s->encryption_format;
     }
 
     return spec_info;
diff --git a/qapi/block-core.json b/qapi/block-core.json
index ebbe95b3d8..dc6eb4ae23 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
@@ -159,7 +159,14 @@
 ##
 # @ImageInfoSpecificRbd:
 #
-# @encryption-format: Image encryption format
+# @encryption-format: Image encryption format. If encryption is enabled for the
+#     image (see encrypted in BlockNodeInfo), this is the actual format in which the
+#     image is accessed. If encryption is not enabled, this is the result of
+#     probing when the image was opened, to give a suggestion which encryption
+#     format could be enabled. Note that probing results can be changed by the
+#     guest by writing a (possibly partial) encryption format header to the
+#     image, so don't treat this information as trusted if the guest is not
+#     trusted.
 #
 # Since: 6.1
 ##

From c0df98ab1f3d348bc05f09d1c093abc529f2b530 Mon Sep 17 00:00:00 2001
From: Werner Fink <werner@suse.de>
Date: Wed, 6 Aug 2025 08:54:51 +0200
Subject: [PATCH 2751/2760] qemu-iotests: Ignore indentation in Killed messages

New bash 5.3 uses a different padding for reporting job status.

Resolves: boo#1246830
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3050
Signed-off-by: Werner Fink <werner@suse.de>
Message-ID: <aJL8RH8ePPNEteMg@boole.nue2.suse.org>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Tested-by: Martin Kletzander <mkletzan@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 tests/qemu-iotests/039.out       | 10 +++++-----
 tests/qemu-iotests/061.out       |  4 ++--
 tests/qemu-iotests/137.out       |  2 +-
 tests/qemu-iotests/common.filter |  2 +-
 4 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/tests/qemu-iotests/039.out b/tests/qemu-iotests/039.out
index e52484d4be..8fdbcc528a 100644
--- a/tests/qemu-iotests/039.out
+++ b/tests/qemu-iotests/039.out
@@ -11,7 +11,7 @@ No errors were found on the image.
 Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728
 wrote 512/512 bytes at offset 0
 512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
-./common.rc: Killed                  ( VALGRIND_QEMU="${VALGRIND_QEMU_IO}" _qemu_proc_exec "${VALGRIND_LOGFILE}" "$QEMU_IO_PROG" $QEMU_IO_ARGS "$@" )
+./common.rc: Killed ( VALGRIND_QEMU="${VALGRIND_QEMU_IO}" _qemu_proc_exec "${VALGRIND_LOGFILE}" "$QEMU_IO_PROG" $QEMU_IO_ARGS "$@" )
 incompatible_features     [0]
 ERROR cluster 5 refcount=0 reference=1
 ERROR OFLAG_COPIED data cluster: l2_entry=8000000000050000 refcount=0
@@ -46,7 +46,7 @@ read 512/512 bytes at offset 0
 Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728
 wrote 512/512 bytes at offset 0
 512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
-./common.rc: Killed                  ( VALGRIND_QEMU="${VALGRIND_QEMU_IO}" _qemu_proc_exec "${VALGRIND_LOGFILE}" "$QEMU_IO_PROG" $QEMU_IO_ARGS "$@" )
+./common.rc: Killed ( VALGRIND_QEMU="${VALGRIND_QEMU_IO}" _qemu_proc_exec "${VALGRIND_LOGFILE}" "$QEMU_IO_PROG" $QEMU_IO_ARGS "$@" )
 incompatible_features     [0]
 ERROR cluster 5 refcount=0 reference=1
 Rebuilding refcount structure
@@ -60,7 +60,7 @@ incompatible_features     []
 Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728
 wrote 512/512 bytes at offset 0
 512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
-./common.rc: Killed                  ( VALGRIND_QEMU="${VALGRIND_QEMU_IO}" _qemu_proc_exec "${VALGRIND_LOGFILE}" "$QEMU_IO_PROG" $QEMU_IO_ARGS "$@" )
+./common.rc: Killed ( VALGRIND_QEMU="${VALGRIND_QEMU_IO}" _qemu_proc_exec "${VALGRIND_LOGFILE}" "$QEMU_IO_PROG" $QEMU_IO_ARGS "$@" )
 incompatible_features     []
 No errors were found on the image.
 
@@ -79,7 +79,7 @@ No errors were found on the image.
 Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728
 wrote 512/512 bytes at offset 0
 512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
-./common.rc: Killed                  ( VALGRIND_QEMU="${VALGRIND_QEMU_IO}" _qemu_proc_exec "${VALGRIND_LOGFILE}" "$QEMU_IO_PROG" $QEMU_IO_ARGS "$@" )
+./common.rc: Killed ( VALGRIND_QEMU="${VALGRIND_QEMU_IO}" _qemu_proc_exec "${VALGRIND_LOGFILE}" "$QEMU_IO_PROG" $QEMU_IO_ARGS "$@" )
 incompatible_features     [0]
 ERROR cluster 5 refcount=0 reference=1
 ERROR OFLAG_COPIED data cluster: l2_entry=8000000000050000 refcount=0
@@ -89,7 +89,7 @@ Data may be corrupted, or further writes to the image may corrupt it.
 Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728
 wrote 512/512 bytes at offset 0
 512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
-./common.rc: Killed                  ( VALGRIND_QEMU="${VALGRIND_QEMU_IO}" _qemu_proc_exec "${VALGRIND_LOGFILE}" "$QEMU_IO_PROG" $QEMU_IO_ARGS "$@" )
+./common.rc: Killed ( VALGRIND_QEMU="${VALGRIND_QEMU_IO}" _qemu_proc_exec "${VALGRIND_LOGFILE}" "$QEMU_IO_PROG" $QEMU_IO_ARGS "$@" )
 incompatible_features     []
 No errors were found on the image.
 *** done
diff --git a/tests/qemu-iotests/061.out b/tests/qemu-iotests/061.out
index 24c33add7c..951c6bf3e6 100644
--- a/tests/qemu-iotests/061.out
+++ b/tests/qemu-iotests/061.out
@@ -118,7 +118,7 @@ No errors were found on the image.
 Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864
 wrote 131072/131072 bytes at offset 0
 128 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
-./common.rc: Killed                  ( VALGRIND_QEMU="${VALGRIND_QEMU_IO}" _qemu_proc_exec "${VALGRIND_LOGFILE}" "$QEMU_IO_PROG" $QEMU_IO_ARGS "$@" )
+./common.rc: Killed ( VALGRIND_QEMU="${VALGRIND_QEMU_IO}" _qemu_proc_exec "${VALGRIND_LOGFILE}" "$QEMU_IO_PROG" $QEMU_IO_ARGS "$@" )
 magic                     0x514649fb
 version                   3
 backing_file_offset       0x0
@@ -304,7 +304,7 @@ No errors were found on the image.
 Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864
 wrote 131072/131072 bytes at offset 0
 128 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
-./common.rc: Killed                  ( VALGRIND_QEMU="${VALGRIND_QEMU_IO}" _qemu_proc_exec "${VALGRIND_LOGFILE}" "$QEMU_IO_PROG" $QEMU_IO_ARGS "$@" )
+./common.rc: Killed ( VALGRIND_QEMU="${VALGRIND_QEMU_IO}" _qemu_proc_exec "${VALGRIND_LOGFILE}" "$QEMU_IO_PROG" $QEMU_IO_ARGS "$@" )
 magic                     0x514649fb
 version                   3
 backing_file_offset       0x0
diff --git a/tests/qemu-iotests/137.out b/tests/qemu-iotests/137.out
index 86377c80cd..e19df5b6ba 100644
--- a/tests/qemu-iotests/137.out
+++ b/tests/qemu-iotests/137.out
@@ -35,7 +35,7 @@ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864
 qemu-io: Unsupported value 'blubb' for qcow2 option 'overlap-check'. Allowed are any of the following: none, constant, cached, all
 wrote 512/512 bytes at offset 0
 512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
-./common.rc: Killed                  ( VALGRIND_QEMU="${VALGRIND_QEMU_IO}" _qemu_proc_exec "${VALGRIND_LOGFILE}" "$QEMU_IO_PROG" $QEMU_IO_ARGS "$@" )
+./common.rc: Killed ( VALGRIND_QEMU="${VALGRIND_QEMU_IO}" _qemu_proc_exec "${VALGRIND_LOGFILE}" "$QEMU_IO_PROG" $QEMU_IO_ARGS "$@" )
 OK: Dirty bit not set
 Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864
 qemu-io: Parameter 'lazy-refcounts' expects 'on' or 'off'
diff --git a/tests/qemu-iotests/common.filter b/tests/qemu-iotests/common.filter
index 67f819d866..511a55b1e8 100644
--- a/tests/qemu-iotests/common.filter
+++ b/tests/qemu-iotests/common.filter
@@ -74,7 +74,7 @@ _filter_qemu_io()
 {
     _filter_win32 | \
     gsed -e "s/[0-9]* ops\; [0-9/:. sec]* ([0-9/.inf]* [EPTGMKiBbytes]*\/sec and [0-9/.inf]* ops\/sec)/X ops\; XX:XX:XX.X (XXX YYY\/sec and XXX ops\/sec)/" \
-        -e "s/: line [0-9][0-9]*:  *[0-9][0-9]*\( Aborted\| Killed\)/:\1/" \
+        -e "s/: line [0-9][0-9]*:  *[0-9][0-9]*\( Aborted\| Killed\) \{2,\}/:\1 /" \
         -e "s/qemu-io> //g"
 }
 

From e262646e12acd6c1132e03d57fea20680a503251 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 8 Aug 2025 14:57:44 +0200
Subject: [PATCH 2752/2760] hw/sd/ssi-sd: Return noise (dummy byte) when no
 card connected
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Commit 1585ab9f1ba ("hw/sd/sdcard: Fill SPI response bits in card
code") exposed a bug in the SPI adapter: if no SD card is plugged,
we are returning "there is a card with an error". This is wrong,
we shouldn't return any particular packet response, but the noise
shifted on the MISO line. Return the dummy byte, otherwise we get:

  qemu-system-riscv64: ../hw/sd/ssi-sd.c:160: ssi_sd_transfer: Assertion `s->arglen > 0' failed.

Reported-by: Guenter Roeck <linux@roeck-us.net>
Fixes: 775616c3ae8 ("Partial SD card SPI mode support")
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Gustavo Romero <gustavo.romero@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20250812140415.70153-2-philmd@linaro.org>
---
 hw/sd/ssi-sd.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/hw/sd/ssi-sd.c b/hw/sd/ssi-sd.c
index 594dead19e..3aacbd0387 100644
--- a/hw/sd/ssi-sd.c
+++ b/hw/sd/ssi-sd.c
@@ -89,6 +89,10 @@ static uint32_t ssi_sd_transfer(SSIPeripheral *dev, uint32_t val)
     SDRequest request;
     uint8_t longresp[5];
 
+    if (!sdbus_get_inserted(&s->sdbus)) {
+        return SSI_DUMMY;
+    }
+
     /*
      * Special case: allow CMD12 (STOP TRANSMISSION) while reading data.
      *

From 7db162fa013878b06a528686ece79ad99f699c71 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 8 Aug 2025 15:45:34 +0200
Subject: [PATCH 2753/2760] tests/functional: Test SPI-SD adapter without SD
 card connected
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

SPI-SD adapter should be usable, even without any SD card
wired. Refactor test_riscv64_sifive_u_mmc_spi() to make it
more generic and add another test, inspired by this report:
https://lore.kernel.org/qemu-devel/5b2dc427-f0db-4332-a997-fe0c82415acd@roeck-us.net/

Inspired-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Gustavo Romero <gustavo.romero@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20250812140415.70153-3-philmd@linaro.org>
---
 tests/functional/test_riscv64_sifive_u.py | 22 +++++++++++++++++-----
 1 file changed, 17 insertions(+), 5 deletions(-)

diff --git a/tests/functional/test_riscv64_sifive_u.py b/tests/functional/test_riscv64_sifive_u.py
index dc4cb8a4a9..358ff0d1f6 100755
--- a/tests/functional/test_riscv64_sifive_u.py
+++ b/tests/functional/test_riscv64_sifive_u.py
@@ -27,25 +27,37 @@ class SifiveU(LinuxKernelTest):
          'rootfs.ext2.gz'),
         'b6ed95610310b7956f9bf20c4c9c0c05fea647900df441da9dfe767d24e8b28b')
 
-    def test_riscv64_sifive_u_mmc_spi(self):
+    def do_test_riscv64_sifive_u_mmc_spi(self, connect_card):
         self.set_machine('sifive_u')
         kernel_path = self.ASSET_KERNEL.fetch()
         rootfs_path = self.uncompress(self.ASSET_ROOTFS)
 
         self.vm.set_console()
         kernel_command_line = (self.KERNEL_COMMON_COMMAND_LINE +
-                               'root=/dev/mmcblk0 rootwait '
                                'earlycon=sbi console=ttySIF0 '
-                               'panic=-1 noreboot')
+                               'root=/dev/mmcblk0 ')
         self.vm.add_args('-kernel', kernel_path,
-                         '-drive', f'file={rootfs_path},if=sd,format=raw',
                          '-append', kernel_command_line,
                          '-no-reboot')
+        if connect_card:
+            kernel_command_line += 'panic=-1 noreboot rootwait '
+            self.vm.add_args('-drive', f'file={rootfs_path},if=sd,format=raw')
+            pattern = 'Boot successful.'
+        else:
+            kernel_command_line += 'panic=0 noreboot '
+            pattern = 'Cannot open root device "mmcblk0" or unknown-block(0,0)'
+
         self.vm.launch()
-        self.wait_for_console_pattern('Boot successful.')
+        self.wait_for_console_pattern(pattern)
 
         os.remove(rootfs_path)
 
+    def test_riscv64_sifive_u_nommc_spi(self):
+        self.do_test_riscv64_sifive_u_mmc_spi(False)
+
+    def test_riscv64_sifive_u_mmc_spi(self):
+        self.do_test_riscv64_sifive_u_mmc_spi(True)
+
 
 if __name__ == '__main__':
     LinuxKernelTest.main()

From 6ad034e71232c2929ed546304c9d249312bb632f Mon Sep 17 00:00:00 2001
From: "Sv. Lockal" <lockalsash@gmail.com>
Date: Mon, 11 Aug 2025 15:01:59 -0400
Subject: [PATCH 2754/2760] mkvenv: Support pip 25.2

Fix compilation with pip-25.2 due to missing distlib.version

Bug: https://gitlab.com/qemu-project/qemu/-/issues/3062

Signed-off-by: Sv. Lockal <lockalsash@gmail.com>
[Edits: Type "safety" whackamole --js]
Signed-off-by: John Snow <jsnow@redhat.com>
Message-ID: <20250811190159.237321-1-jsnow@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 python/scripts/mkvenv.py | 64 +++++++++++++++++++++++++++++++++++++---
 1 file changed, 60 insertions(+), 4 deletions(-)

diff --git a/python/scripts/mkvenv.py b/python/scripts/mkvenv.py
index 8ac5b0b2a0..f102527c4d 100644
--- a/python/scripts/mkvenv.py
+++ b/python/scripts/mkvenv.py
@@ -84,6 +84,7 @@ from typing import (
     Sequence,
     Tuple,
     Union,
+    cast,
 )
 import venv
 
@@ -94,17 +95,39 @@ import venv
 HAVE_DISTLIB = True
 try:
     import distlib.scripts
-    import distlib.version
 except ImportError:
     try:
         # Reach into pip's cookie jar.  pylint and flake8 don't understand
         # that these imports will be used via distlib.xxx.
         from pip._vendor import distlib
         import pip._vendor.distlib.scripts  # noqa, pylint: disable=unused-import
-        import pip._vendor.distlib.version  # noqa, pylint: disable=unused-import
     except ImportError:
         HAVE_DISTLIB = False
 
+# pip 25.2 does not vendor distlib.version, but it uses vendored
+# packaging.version
+HAVE_DISTLIB_VERSION = True
+try:
+    import distlib.version  # pylint: disable=ungrouped-imports
+except ImportError:
+    try:
+        # pylint: disable=unused-import,ungrouped-imports
+        import pip._vendor.distlib.version  # noqa
+    except ImportError:
+        HAVE_DISTLIB_VERSION = False
+
+HAVE_PACKAGING_VERSION = True
+try:
+    # Do not bother importing non-vendored packaging, because it is not
+    # in stdlib.
+    from pip._vendor import packaging
+    # pylint: disable=unused-import
+    import pip._vendor.packaging.requirements  # noqa
+    import pip._vendor.packaging.version  # noqa
+except ImportError:
+    HAVE_PACKAGING_VERSION = False
+
+
 # Try to load tomllib, with a fallback to tomli.
 # HAVE_TOMLLIB is checked below, just-in-time, so that mkvenv does not fail
 # outside the venv or before a potential call to ensurepip in checkpip().
@@ -133,6 +156,39 @@ class Ouch(RuntimeError):
     """An Exception class we can't confuse with a builtin."""
 
 
+class Matcher:
+    """Compatibility appliance for version/requirement string parsing."""
+    def __init__(self, name_and_constraint: str):
+        """Create a matcher from a requirement-like string."""
+        if HAVE_DISTLIB_VERSION:
+            self._m = distlib.version.LegacyMatcher(name_and_constraint)
+        elif HAVE_PACKAGING_VERSION:
+            self._m = packaging.requirements.Requirement(name_and_constraint)
+        else:
+            raise Ouch("found neither distlib.version nor packaging.version")
+        self.name = self._m.name
+
+    def match(self, version_str: str) -> bool:
+        """Return True if `version` satisfies the stored constraint."""
+        if HAVE_DISTLIB_VERSION:
+            return cast(
+                bool,
+                self._m.match(distlib.version.LegacyVersion(version_str))
+            )
+
+        assert HAVE_PACKAGING_VERSION
+        return cast(
+            bool,
+            self._m.specifier.contains(
+                packaging.version.Version(version_str), prereleases=True
+            )
+        )
+
+    def __repr__(self) -> str:
+        """Stable debug representation delegated to the backend."""
+        return repr(self._m)
+
+
 class QemuEnvBuilder(venv.EnvBuilder):
     """
     An extension of venv.EnvBuilder for building QEMU's configure-time venv.
@@ -669,7 +725,7 @@ def _do_ensure(
     canary = None
     for name, info in group.items():
         constraint = _make_version_constraint(info, False)
-        matcher = distlib.version.LegacyMatcher(name + constraint)
+        matcher = Matcher(name + constraint)
         print(f"mkvenv: checking for {matcher}", file=sys.stderr)
 
         dist: Optional[Distribution] = None
@@ -683,7 +739,7 @@ def _do_ensure(
             # Always pass installed package to pip, so that they can be
             # updated if the requested version changes
             or not _is_system_package(dist)
-            or not matcher.match(distlib.version.LegacyVersion(dist.version))
+            or not matcher.match(dist.version)
         ):
             absent.append(name + _make_version_constraint(info, True))
             if len(absent) == 1:

From b2a948220763b0d5184285a6b72d7eb13d51aad2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Mon, 4 Aug 2025 17:29:59 +0100
Subject: [PATCH 2755/2760] readthedocs: don't build extra formats
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We don't build the PDFs ourselves for the hosted docs and it looks
like rtd can't manage building PDFs now they have gone over a certain
size. Disable the extra formats so we can at least have the online
stuff again.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20250804162959.330060-1-alex.bennee@linaro.org>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 .readthedocs.yml | 2 --
 1 file changed, 2 deletions(-)

diff --git a/.readthedocs.yml b/.readthedocs.yml
index 0b262469ce..639f628612 100644
--- a/.readthedocs.yml
+++ b/.readthedocs.yml
@@ -21,5 +21,3 @@ python:
   install:
     - requirements: docs/requirements.txt
 
-# We want all the document formats
-formats: all

From 0c0729b46a3680c233e0d45647d5193c5c5083f9 Mon Sep 17 00:00:00 2001
From: Vivek Kasireddy <vivek.kasireddy@intel.com>
Date: Fri, 18 Jul 2025 16:40:39 -0700
Subject: [PATCH 2756/2760] ui/spice: Destroy the temporary egl fb after the
 blit is submitted
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The temporary egl fb scanout_tex_fb is only needed to facilitate the
blit to the display surface's texture (ssd->ds->texture). Therefore,
destroy it after the blit is submitted. And, also make sure that it
is empty initialized before it is actually used.

Fixes: f851cd65 ("ui/spice: Blit the scanout texture if its memory layout is not linear")
Reported-by: Peter Maydell <peter.maydell@linaro.org>
Cc: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Vivek Kasireddy <vivek.kasireddy@intel.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-ID: <20250718234039.2266704-1-vivek.kasireddy@intel.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 ui/spice-display.c | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/ui/spice-display.c b/ui/spice-display.c
index 9ce622cefc..669832c561 100644
--- a/ui/spice-display.c
+++ b/ui/spice-display.c
@@ -1183,20 +1183,20 @@ static void qemu_spice_gl_release_dmabuf(DisplayChangeListener *dcl,
     egl_dmabuf_release_texture(dmabuf);
 }
 
-static bool spice_gl_blit_scanout_texture(SimpleSpiceDisplay *ssd,
-                                          egl_fb *scanout_tex_fb)
+static bool spice_gl_blit_scanout_texture(SimpleSpiceDisplay *ssd)
 {
     uint32_t offsets[DMABUF_MAX_PLANES], strides[DMABUF_MAX_PLANES];
     int fds[DMABUF_MAX_PLANES], num_planes, fourcc;
+    egl_fb scanout_tex_fb = {};
     uint64_t modifier;
     bool ret;
 
-    egl_fb_destroy(scanout_tex_fb);
-    egl_fb_setup_for_tex(scanout_tex_fb,
+    egl_fb_setup_for_tex(&scanout_tex_fb,
                          surface_width(ssd->ds), surface_height(ssd->ds),
                          ssd->ds->texture, false);
-    egl_fb_blit(scanout_tex_fb, &ssd->guest_fb, false);
+    egl_fb_blit(&scanout_tex_fb, &ssd->guest_fb, false);
     glFlush();
+    egl_fb_destroy(&scanout_tex_fb);
 
     if (!ssd->new_scanout_texture) {
         return true;
@@ -1330,9 +1330,7 @@ static void qemu_spice_gl_update(DisplayChangeListener *dcl,
     }
 
     if (spice_remote_client && ssd->blit_scanout_texture) {
-        egl_fb scanout_tex_fb;
-
-        ret = spice_gl_blit_scanout_texture(ssd, &scanout_tex_fb);
+        ret = spice_gl_blit_scanout_texture(ssd);
         if (!ret) {
             return;
         }

From de784dc0a0128146a88437d57ea27a58af507de0 Mon Sep 17 00:00:00 2001
From: Stefan Hajnoczi <stefanha@redhat.com>
Date: Tue, 12 Aug 2025 16:26:39 -0400
Subject: [PATCH 2757/2760] Update version for the v10.1.0-rc3 release

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 VERSION | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/VERSION b/VERSION
index c08f99e23e..d53c9cff27 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-10.0.92
+10.0.93

From faaaf017d5b9c9f84fb86dcee016944176eee0d9 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Tue, 19 Aug 2025 17:02:35 +0200
Subject: [PATCH 2758/2760] Revert "i386/cpu: Warn about why CPUID_EXT_PDCM is
 not available"
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This reverts commit 00268e00027459abede448662f8794d78eb4b0a4.
(The only conflict is in the !is_tdx_vm() part of the condition,
which is safe to keep).

mark_unavailable_features() actively blocks usage of the feature,
so it is a functional change, not merely a emitting warning.
The commit was intended to merely warn if PDCM was enabled when
the performance counters are not, so revert it.

Reported-by: Christian A. Ehrhardt <christian.ehrhardt@canonical.com>
Analyzed-by: Daniel P. Berrangé <berrange@redhat.com>
Analyzed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20250819150235.785559-1-pbonzini@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 target/i386/cpu.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 673f8583c8..6d85149e6e 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -8946,9 +8946,6 @@ void x86_cpu_expand_features(X86CPU *cpu, Error **errp)
 
     /* PDCM is fixed1 bit for TDX */
     if (!cpu->enable_pmu && !is_tdx_vm()) {
-        mark_unavailable_features(cpu, FEAT_1_ECX,
-                                  env->user_features[FEAT_1_ECX] & CPUID_EXT_PDCM,
-                                  "This feature is not available due to PMU being disabled");
         env->features[FEAT_1_ECX] &= ~CPUID_EXT_PDCM;
     }
 

From 88f72048d2f5835a1b9eaba690c7861393aef283 Mon Sep 17 00:00:00 2001
From: Stefan Hajnoczi <stefanha@redhat.com>
Date: Tue, 19 Aug 2025 10:39:59 -0400
Subject: [PATCH 2759/2760] Update version for the v10.1.0-rc4 release

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 VERSION | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/VERSION b/VERSION
index d53c9cff27..dadcbd47d3 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-10.0.93
+10.0.94

From f8b2f64e2336a28bf0d50b6ef8a7d8c013e9bcf3 Mon Sep 17 00:00:00 2001
From: Stefan Hajnoczi <stefanha@redhat.com>
Date: Tue, 26 Aug 2025 11:23:27 -0400
Subject: [PATCH 2760/2760] Update version for the v10.1.0 release

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 VERSION | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/VERSION b/VERSION
index dadcbd47d3..4149c39eec 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-10.0.94
+10.1.0